From 315108b81694de474bbc273c0050b195047f5eed Mon Sep 17 00:00:00 2001 From: Pierre Pronchery Date: Fri, 22 Sep 2023 16:52:58 +0200 Subject: openssl: Vendor import of OpenSSL 3.0.11 Major changes between OpenSSL 3.0.10 and OpenSSL 3.0.11: * Fix POLY1305 MAC implementation corrupting XMM registers on Windows ([CVE-2023-4807]) Release notes can otherwise be found at https://www.openssl.org/news/openssl-3.0-notes.html. Obtained from: https://www.openssl.org/source/openssl-3.0.11.tar.gz Sponsored by: The FreeBSD Foundation Test Plan: ``` $ git status On branch vendor/openssl-3.0 Your branch is up to date with 'origin/vendor/openssl-3.0'. nothing to commit, working tree clean $ OSSLVER=3.0.11 $ XLIST=FREEBSD-Xlist $ (cd ..; fetch https://www.openssl.org/source/openssl-${OSSLVER}.tar.gz https://www.openssl.org/source/openssl-${OSSLVER}.tar.gz.asc) openssl-3.0.11.tar.gz 14 MB 17 MBps 01s openssl-3.0.11.tar.gz.asc 833 B 8301 kBps 00s $ gpg --list-keys /home/khorben/.gnupg/pubring.kbx -------------------------------- pub rsa4096 2011-03-01 [SCA] DC34EE5DB2417BCC151E5100E5F8F8212F77A498 uid [ unknown] Willem Toorop sub rsa4096 2011-03-01 [E] pub rsa4096 2014-10-04 [SC] [expires: 2024-01-30] EFC0A467D613CB83C7ED6D30D894E2CE8B3D79F5 uid [ unknown] OpenSSL security team uid [ unknown] OpenSSL OMC uid [ unknown] OpenSSL Security sub rsa4096 2014-10-04 [E] [expires: 2024-01-30] $ gpg --verify ../openssl-${OSSLVER}.tar.gz.asc ../openssl-${OSSLVER}.tar.gz gpg: Signature made Tue Sep 19 15:02:51 2023 CEST gpg: using RSA key EFC0A467D613CB83C7ED6D30D894E2CE8B3D79F5 gpg: Good signature from "OpenSSL security team " [unknown] gpg: aka "OpenSSL OMC " [unknown] gpg: aka "OpenSSL Security " [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: EFC0 A467 D613 CB83 C7ED 6D30 D894 E2CE 8B3D 79F5 $ tar -x -X $XLIST -f ../openssl-${OSSLVER}.tar.gz -C .. $ rsync --exclude FREEBSD.* --delete -av ../openssl-${OSSLVER}/* . [...] $ diff -arq ../openssl-${OSSLVER} . Only in .: .git Only in .: FREEBSD-Xlist Only in .: FREEBSD-upgrade Only in .: appveyor.yml $ git status FREEBSD* On branch vendor/openssl-3.0 Your branch is up to date with 'origin/vendor/openssl-3.0'. nothing to commit, working tree clean ``` --- apps/cmp.c | 2 +- apps/lib/apps.c | 13 ++++++------- apps/req.c | 8 ++++---- apps/s_server.c | 2 +- 4 files changed, 12 insertions(+), 13 deletions(-) (limited to 'apps') diff --git a/apps/cmp.c b/apps/cmp.c index a317fdb0bf3e..c479b1549660 100644 --- a/apps/cmp.c +++ b/apps/cmp.c @@ -2512,7 +2512,7 @@ static int get_opts(int argc, char **argv) } break; case OPT_CSR: - opt_csr = opt_arg(); + opt_csr = opt_str(); break; case OPT_OUT_TRUSTED: opt_out_trusted = opt_str(); diff --git a/apps/lib/apps.c b/apps/lib/apps.c index 4baeb352fedf..572f6a3f8f28 100644 --- a/apps/lib/apps.c +++ b/apps/lib/apps.c @@ -944,7 +944,7 @@ int load_key_certs_crls_suppress(const char *uri, int format, int maybe_stdin, BIO *bio; if (!maybe_stdin) { - BIO_printf(bio_err, "No filename or uri specified for loading"); + BIO_printf(bio_err, "No filename or uri specified for loading\n"); goto end; } uri = ""; @@ -960,10 +960,8 @@ int load_key_certs_crls_suppress(const char *uri, int format, int maybe_stdin, ctx = OSSL_STORE_open_ex(uri, libctx, propq, get_ui_method(), &uidata, params, NULL, NULL); } - if (ctx == NULL) { - BIO_printf(bio_err, "Could not open file or uri for loading"); + if (ctx == NULL) goto end; - } if (expect > 0 && !OSSL_STORE_expect(ctx, expect)) goto end; @@ -1948,16 +1946,17 @@ X509_NAME *parse_name(const char *cp, int chtype, int canmulti, nid = OBJ_txt2nid(typestr); if (nid == NID_undef) { BIO_printf(bio_err, - "%s: Skipping unknown %s name attribute \"%s\"\n", + "%s warning: Skipping unknown %s name attribute \"%s\"\n", opt_getprog(), desc, typestr); if (ismulti) BIO_printf(bio_err, - "Hint: a '+' in a value string needs be escaped using '\\' else a new member of a multi-valued RDN is expected\n"); + "%s hint: a '+' in a value string needs be escaped using '\\' else a new member of a multi-valued RDN is expected\n", + opt_getprog()); continue; } if (*valstr == '\0') { BIO_printf(bio_err, - "%s: No value provided for %s name attribute \"%s\", skipped\n", + "%s warning: No value provided for %s name attribute \"%s\", skipped\n", opt_getprog(), desc, typestr); continue; } diff --git a/apps/req.c b/apps/req.c index 73b320a7098c..926f0796bc8f 100644 --- a/apps/req.c +++ b/apps/req.c @@ -990,10 +990,10 @@ int req_main(int argc, char **argv) else tpubkey = X509_REQ_get0_pubkey(req); if (tpubkey == NULL) { - fprintf(stdout, "Modulus is unavailable\n"); + BIO_puts(bio_err, "Modulus is unavailable\n"); goto end; } - fprintf(stdout, "Modulus="); + BIO_puts(out, "Modulus="); if (EVP_PKEY_is_a(tpubkey, "RSA") || EVP_PKEY_is_a(tpubkey, "RSA-PSS")) { BIGNUM *n = NULL; @@ -1002,9 +1002,9 @@ int req_main(int argc, char **argv) BN_print(out, n); BN_free(n); } else { - fprintf(stdout, "Wrong Algorithm type"); + BIO_puts(out, "Wrong Algorithm type"); } - fprintf(stdout, "\n"); + BIO_puts(out, "\n"); } if (!noout && !gen_x509) { diff --git a/apps/s_server.c b/apps/s_server.c index a203d6a091ca..c8ccdfd03ca1 100644 --- a/apps/s_server.c +++ b/apps/s_server.c @@ -789,7 +789,7 @@ const OPTIONS s_server_options[] = { "second server certificate chain file in PEM format"}, {"dkey", OPT_DKEY, '<', "Second private key file to use (usually for DSA)"}, - {"dkeyform", OPT_DKEYFORM, 'F', + {"dkeyform", OPT_DKEYFORM, 'f', "Second key file format (ENGINE, other values ignored)"}, {"dpass", OPT_DPASS, 's', "Second private key and cert file pass phrase source"}, -- cgit v1.3