pkgsrc-Changes archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
CVS commit: pkgsrc/security/openssl
Module Name: pkgsrc
Committed By: wiz
Date: Thu Mar 23 06:16:22 UTC 2023
Modified Files:
pkgsrc/security/openssl: Makefile distinfo
Added Files:
pkgsrc/security/openssl/patches: patch-crypto_x509v3_pcy__local.h
patch-crypto_x509v3_pcy__node.c patch-crypto_x509v3_pcy__tree.c
Log Message:
openssl: update to 1.1.1tnb1.
Add upstream patches fixing CVE-2023-0464
To generate a diff of this commit:
cvs rdiff -u -r1.287 -r1.288 pkgsrc/security/openssl/Makefile
cvs rdiff -u -r1.165 -r1.166 pkgsrc/security/openssl/distinfo
cvs rdiff -u -r0 -r1.1 \
pkgsrc/security/openssl/patches/patch-crypto_x509v3_pcy__local.h \
pkgsrc/security/openssl/patches/patch-crypto_x509v3_pcy__node.c \
pkgsrc/security/openssl/patches/patch-crypto_x509v3_pcy__tree.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: pkgsrc/security/openssl/Makefile
diff -u pkgsrc/security/openssl/Makefile:1.287 pkgsrc/security/openssl/Makefile:1.288
--- pkgsrc/security/openssl/Makefile:1.287 Tue Feb 7 16:34:42 2023
+++ pkgsrc/security/openssl/Makefile Thu Mar 23 06:16:22 2023
@@ -1,9 +1,10 @@
-# $NetBSD: Makefile,v 1.287 2023/02/07 16:34:42 jperkin Exp $
+# $NetBSD: Makefile,v 1.288 2023/03/23 06:16:22 wiz Exp $
# Remember to upload-distfiles when updating OpenSSL -- otherwise it
# is not possible for users who have bootstrapped without OpenSSL
# to install it and enable HTTPS fetching.
DISTNAME= openssl-1.1.1t
+PKGREVISION= 1
CATEGORIES= security
MASTER_SITES= https://www.openssl.org/source/
Index: pkgsrc/security/openssl/distinfo
diff -u pkgsrc/security/openssl/distinfo:1.165 pkgsrc/security/openssl/distinfo:1.166
--- pkgsrc/security/openssl/distinfo:1.165 Tue Feb 7 16:34:42 2023
+++ pkgsrc/security/openssl/distinfo Thu Mar 23 06:16:22 2023
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.165 2023/02/07 16:34:42 jperkin Exp $
+$NetBSD: distinfo,v 1.166 2023/03/23 06:16:22 wiz Exp $
BLAKE2s (openssl-1.1.1t.tar.gz) = ef41c557d0e29387b2e6e41349054c1f45e0ab6a208070450c42bc0491ec7b2e
SHA512 (openssl-1.1.1t.tar.gz) = 628676c9c3bc1cf46083d64f61943079f97f0eefd0264042e40a85dbbd988f271bfe01cd1135d22cc3f67a298f1d078041f8f2e97b0da0d93fe172da573da18c
@@ -6,3 +6,6 @@ Size (openssl-1.1.1t.tar.gz) = 9881866 b
SHA1 (patch-Configurations_shared-info.pl) = 0e835f6e343b5d05ef9a0e6ef2a195201262d15c
SHA1 (patch-Configurations_unix-Makefile.tmpl) = 3f47dd453381485aeb6c37dc53f932428fdcef50
SHA1 (patch-Configure) = 479f1bc826f7721f6b44d6b5a6cf460432924bf2
+SHA1 (patch-crypto_x509v3_pcy__local.h) = 274d1877db4107879398f982e4e9652054ee624e
+SHA1 (patch-crypto_x509v3_pcy__node.c) = c394da4e084765ee668f6b1b8bd72d4ae62b047a
+SHA1 (patch-crypto_x509v3_pcy__tree.c) = 92d87af1dbd55db15d03c3e18c48f018f7c32a67
Added files:
Index: pkgsrc/security/openssl/patches/patch-crypto_x509v3_pcy__local.h
diff -u /dev/null pkgsrc/security/openssl/patches/patch-crypto_x509v3_pcy__local.h:1.1
--- /dev/null Thu Mar 23 06:16:22 2023
+++ pkgsrc/security/openssl/patches/patch-crypto_x509v3_pcy__local.h Thu Mar 23 06:16:22 2023
@@ -0,0 +1,29 @@
+$NetBSD: patch-crypto_x509v3_pcy__local.h,v 1.1 2023/03/23 06:16:22 wiz Exp $
+
+x509: excessive resource use verifying policy constraints
+https://github.com/openssl/openssl/commit/879f7080d7e141f415c79eaa3a8ac4a3dad0348b
+
+--- crypto/x509v3/pcy_local.h.orig 2023-02-07 13:37:05.000000000 +0000
++++ crypto/x509v3/pcy_local.h
+@@ -111,6 +111,11 @@ struct X509_POLICY_LEVEL_st {
+ };
+
+ struct X509_POLICY_TREE_st {
++ /* The number of nodes in the tree */
++ size_t node_count;
++ /* The maximum number of nodes in the tree */
++ size_t node_maximum;
++
+ /* This is the tree 'level' data */
+ X509_POLICY_LEVEL *levels;
+ int nlevel;
+@@ -159,7 +164,8 @@ X509_POLICY_NODE *tree_find_sk(STACK_OF(
+ X509_POLICY_NODE *level_add_node(X509_POLICY_LEVEL *level,
+ X509_POLICY_DATA *data,
+ X509_POLICY_NODE *parent,
+- X509_POLICY_TREE *tree);
++ X509_POLICY_TREE *tree,
++ int extra_data);
+ void policy_node_free(X509_POLICY_NODE *node);
+ int policy_node_match(const X509_POLICY_LEVEL *lvl,
+ const X509_POLICY_NODE *node, const ASN1_OBJECT *oid);
Index: pkgsrc/security/openssl/patches/patch-crypto_x509v3_pcy__node.c
diff -u /dev/null pkgsrc/security/openssl/patches/patch-crypto_x509v3_pcy__node.c:1.1
--- /dev/null Thu Mar 23 06:16:22 2023
+++ pkgsrc/security/openssl/patches/patch-crypto_x509v3_pcy__node.c Thu Mar 23 06:16:22 2023
@@ -0,0 +1,50 @@
+$NetBSD: patch-crypto_x509v3_pcy__node.c,v 1.1 2023/03/23 06:16:22 wiz Exp $
+
+x509: excessive resource use verifying policy constraints
+https://github.com/openssl/openssl/commit/879f7080d7e141f415c79eaa3a8ac4a3dad0348b
+
+--- crypto/x509v3/pcy_node.c.orig 2023-02-07 13:37:05.000000000 +0000
++++ crypto/x509v3/pcy_node.c
+@@ -59,10 +59,15 @@ X509_POLICY_NODE *level_find_node(const
+ X509_POLICY_NODE *level_add_node(X509_POLICY_LEVEL *level,
+ X509_POLICY_DATA *data,
+ X509_POLICY_NODE *parent,
+- X509_POLICY_TREE *tree)
++ X509_POLICY_TREE *tree,
++ int extra_data)
+ {
+ X509_POLICY_NODE *node;
+
++ /* Verify that the tree isn't too large. This mitigates CVE-2023-0464 */
++ if (tree->node_maximum > 0 && tree->node_count >= tree->node_maximum)
++ return NULL;
++
+ node = OPENSSL_zalloc(sizeof(*node));
+ if (node == NULL) {
+ X509V3err(X509V3_F_LEVEL_ADD_NODE, ERR_R_MALLOC_FAILURE);
+@@ -70,7 +75,7 @@ X509_POLICY_NODE *level_add_node(X509_PO
+ }
+ node->data = data;
+ node->parent = parent;
+- if (level) {
++ if (level != NULL) {
+ if (OBJ_obj2nid(data->valid_policy) == NID_any_policy) {
+ if (level->anyPolicy)
+ goto node_error;
+@@ -90,7 +95,7 @@ X509_POLICY_NODE *level_add_node(X509_PO
+ }
+ }
+
+- if (tree) {
++ if (extra_data) {
+ if (tree->extra_data == NULL)
+ tree->extra_data = sk_X509_POLICY_DATA_new_null();
+ if (tree->extra_data == NULL){
+@@ -103,6 +108,7 @@ X509_POLICY_NODE *level_add_node(X509_PO
+ }
+ }
+
++ tree->node_count++;
+ if (parent)
+ parent->nchild++;
+
Index: pkgsrc/security/openssl/patches/patch-crypto_x509v3_pcy__tree.c
diff -u /dev/null pkgsrc/security/openssl/patches/patch-crypto_x509v3_pcy__tree.c:1.1
--- /dev/null Thu Mar 23 06:16:22 2023
+++ pkgsrc/security/openssl/patches/patch-crypto_x509v3_pcy__tree.c Thu Mar 23 06:16:22 2023
@@ -0,0 +1,126 @@
+$NetBSD: patch-crypto_x509v3_pcy__tree.c,v 1.1 2023/03/23 06:16:22 wiz Exp $
+
+x509: excessive resource use verifying policy constraints
+https://github.com/openssl/openssl/commit/879f7080d7e141f415c79eaa3a8ac4a3dad0348b
+
+--- crypto/x509v3/pcy_tree.c.orig 2023-02-07 13:37:05.000000000 +0000
++++ crypto/x509v3/pcy_tree.c
+@@ -14,6 +14,18 @@
+ #include "pcy_local.h"
+
+ /*
++ * If the maximum number of nodes in the policy tree isn't defined, set it to
++ * a generous default of 1000 nodes.
++ *
++ * Defining this to be zero means unlimited policy tree growth which opens the
++ * door on CVE-2023-0464.
++ */
++
++#ifndef OPENSSL_POLICY_TREE_NODES_MAX
++# define OPENSSL_POLICY_TREE_NODES_MAX 1000
++#endif
++
++/*
+ * Enable this to print out the complete policy tree at various point during
+ * evaluation.
+ */
+@@ -168,6 +180,9 @@ static int tree_init(X509_POLICY_TREE **
+ return X509_PCY_TREE_INTERNAL;
+ }
+
++ /* Limit the growth of the tree to mitigate CVE-2023-0464 */
++ tree->node_maximum = OPENSSL_POLICY_TREE_NODES_MAX;
++
+ /*
+ * http://tools.ietf.org/html/rfc5280#section-6.1.2, figure 3.
+ *
+@@ -184,7 +199,7 @@ static int tree_init(X509_POLICY_TREE **
+ level = tree->levels;
+ if ((data = policy_data_new(NULL, OBJ_nid2obj(NID_any_policy), 0)) == NULL)
+ goto bad_tree;
+- if (level_add_node(level, data, NULL, tree) == NULL) {
++ if (level_add_node(level, data, NULL, tree, 1) == NULL) {
+ policy_data_free(data);
+ goto bad_tree;
+ }
+@@ -243,7 +258,8 @@ static int tree_init(X509_POLICY_TREE **
+ * Return value: 1 on success, 0 otherwise
+ */
+ static int tree_link_matching_nodes(X509_POLICY_LEVEL *curr,
+- X509_POLICY_DATA *data)
++ X509_POLICY_DATA *data,
++ X509_POLICY_TREE *tree)
+ {
+ X509_POLICY_LEVEL *last = curr - 1;
+ int i, matched = 0;
+@@ -253,13 +269,13 @@ static int tree_link_matching_nodes(X509
+ X509_POLICY_NODE *node = sk_X509_POLICY_NODE_value(last->nodes, i);
+
+ if (policy_node_match(last, node, data->valid_policy)) {
+- if (level_add_node(curr, data, node, NULL) == NULL)
++ if (level_add_node(curr, data, node, tree, 0) == NULL)
+ return 0;
+ matched = 1;
+ }
+ }
+ if (!matched && last->anyPolicy) {
+- if (level_add_node(curr, data, last->anyPolicy, NULL) == NULL)
++ if (level_add_node(curr, data, last->anyPolicy, tree, 0) == NULL)
+ return 0;
+ }
+ return 1;
+@@ -272,7 +288,8 @@ static int tree_link_matching_nodes(X509
+ * Return value: 1 on success, 0 otherwise.
+ */
+ static int tree_link_nodes(X509_POLICY_LEVEL *curr,
+- const X509_POLICY_CACHE *cache)
++ const X509_POLICY_CACHE *cache,
++ X509_POLICY_TREE *tree)
+ {
+ int i;
+
+@@ -280,7 +297,7 @@ static int tree_link_nodes(X509_POLICY_L
+ X509_POLICY_DATA *data = sk_X509_POLICY_DATA_value(cache->data, i);
+
+ /* Look for matching nodes in previous level */
+- if (!tree_link_matching_nodes(curr, data))
++ if (!tree_link_matching_nodes(curr, data, tree))
+ return 0;
+ }
+ return 1;
+@@ -311,7 +328,7 @@ static int tree_add_unmatched(X509_POLIC
+ /* Curr may not have anyPolicy */
+ data->qualifier_set = cache->anyPolicy->qualifier_set;
+ data->flags |= POLICY_DATA_FLAG_SHARED_QUALIFIERS;
+- if (level_add_node(curr, data, node, tree) == NULL) {
++ if (level_add_node(curr, data, node, tree, 1) == NULL) {
+ policy_data_free(data);
+ return 0;
+ }
+@@ -373,7 +390,7 @@ static int tree_link_any(X509_POLICY_LEV
+ }
+ /* Finally add link to anyPolicy */
+ if (last->anyPolicy &&
+- level_add_node(curr, cache->anyPolicy, last->anyPolicy, NULL) == NULL)
++ level_add_node(curr, cache->anyPolicy, last->anyPolicy, tree, 0) == NULL)
+ return 0;
+ return 1;
+ }
+@@ -555,7 +572,7 @@ static int tree_calculate_user_set(X509_
+ extra->qualifier_set = anyPolicy->data->qualifier_set;
+ extra->flags = POLICY_DATA_FLAG_SHARED_QUALIFIERS
+ | POLICY_DATA_FLAG_EXTRA_NODE;
+- node = level_add_node(NULL, extra, anyPolicy->parent, tree);
++ node = level_add_node(NULL, extra, anyPolicy->parent, tree, 1);
+ }
+ if (!tree->user_policies) {
+ tree->user_policies = sk_X509_POLICY_NODE_new_null();
+@@ -582,7 +599,7 @@ static int tree_evaluate(X509_POLICY_TRE
+
+ for (i = 1; i < tree->nlevel; i++, curr++) {
+ cache = policy_cache_set(curr->cert);
+- if (!tree_link_nodes(curr, cache))
++ if (!tree_link_nodes(curr, cache, tree))
+ return X509_PCY_TREE_INTERNAL;
+
+ if (!(curr->flags & X509_V_FLAG_INHIBIT_ANY)
Home |
Main Index |
Thread Index |
Old Index