GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — deps: upgrade openssl sources to openssl-3.5.2 · nodejs/node@33b06df

File tree

Expand file treeCollapse file tree
Open diff view settings
Filter options
  • deps/openssl/openssl
    • CHANGES.md
    • NEWS.md
    • VERSION.dat
    • apps
      • asn1parse.c
      • rand.c
    • crypto
      • dh
        • dh_check.c
      • encode_decode
        • decoder_lib.c
        • decoder_pkey.c
        • encoder_local.h
      • evp
        • asymcipher.c
        • keymgmt_meth.c
        • m_sigver.c
      • perlasm
        • x86asm.pl
      • provider_core.c
      • rsa
        • rsa_gen.c
      • slh_dsa
        • slh_hash.c
      • sm2
        • sm2_sign.c
      • store
        • store_lib.c
      • x509
        • x_crl.c
    • fuzz
      • dtlsserver.c
    • include
      • crypto
        • bn_conf.h
        • dh.h
        • dso_conf.h
        • rsa.h
      • internal
        • param_names.h
        • quic_ackm.h
      • openssl
        • asn1.h
        • asn1t.h
        • bio.h
        • cmp.h
        • cms.h
        • comp.h
        • conf.h
        • configuration.h
        • core_dispatch.h
        • core_names.h
        • crmf.h
        • crypto.h
        • ct.h
        • err.h
        • ess.h
        • fipskey.h
        • lhash.h
        • ocsp.h
        • opensslv.h
        • pem.h
        • pkcs12.h
        • pkcs7.h
        • safestack.h
        • self_test.h
        • srp.h
        • ssl.h
        • ui.h
        • x509.h
        • x509_acert.h
        • x509_vfy.h
        • x509v3.h
    • providers
      • fips-sources.checksums
      • fips.checksum
      • fips
        • fipsprov.c
        • self_test_data.inc
      • implementations
        • encode_decode
          • decode_pem2der.c
        • kem
          • ml_kem_kem.c
        • keymgmt
          • dh_kmgmt.c
          • ec_kmgmt.c
          • ecx_kmgmt.c
          • rsa_kmgmt.c
      • legacyprov.c
    • ssl/quic
      • quic_ackm.c
      • quic_channel.c
      • quic_rx_depack.c
    • util/perl/TLSProxy
      • Proxy.pm

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
Dismiss banner
Expand file treeCollapse file tree
Open diff view settings
Collapse file

‎deps/openssl/openssl/CHANGES.md‎

Copy file name to clipboardExpand all lines: deps/openssl/openssl/CHANGES.md
+7Lines changed: 7 additions & 0 deletions
  • Display the source diff
  • Display the rich diff
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,13 @@ OpenSSL Releases
2828
OpenSSL 3.5
2929
-----------
3030

31+
### Changes between 3.5.1 and 3.5.2 [5 Aug 2025]
32+
33+
* The FIPS provider now performs a PCT on key import for RSA, EC and ECX.
34+
This is mandated by FIPS 140-3 IG 10.3.A additional comment 1.
35+
36+
*Dr Paul Dale*
37+
3138
### Changes between 3.5.0 and 3.5.1 [1 Jul 2025]
3239

3340
* Fix x509 application adds trusted use instead of rejected use.
Collapse file

‎deps/openssl/openssl/NEWS.md‎

Copy file name to clipboardExpand all lines: deps/openssl/openssl/NEWS.md
+4Lines changed: 4 additions & 0 deletions
  • Display the source diff
  • Display the rich diff
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,10 @@ OpenSSL Releases
2323
OpenSSL 3.5
2424
-----------
2525

26+
### Major changes between OpenSSL 3.5.1 and OpenSSL 3.5.2 [5 Aug 2025]
27+
28+
* none
29+
2630
### Major changes between OpenSSL 3.5.0 and OpenSSL 3.5.1 [1 Jul 2025]
2731

2832
OpenSSL 3.5.1 is a security patch release. The most severe CVE fixed in this
Collapse file

‎deps/openssl/openssl/VERSION.dat‎

Copy file name to clipboard
+2-2Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
MAJOR=3
22
MINOR=5
3-
PATCH=1
3+
PATCH=2
44
PRE_RELEASE_TAG=
55
BUILD_METADATA=
6-
RELEASE_DATE="1 Jul 2025"
6+
RELEASE_DATE="5 Aug 2025"
77
SHLIB_VERSION=3
Collapse file

‎deps/openssl/openssl/apps/asn1parse.c‎

Copy file name to clipboardExpand all lines: deps/openssl/openssl/apps/asn1parse.c
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,8 @@ const OPTIONS asn1parse_options[] = {
4040
{"length", OPT_LENGTH, 'p', "length of section in file"},
4141
{"strparse", OPT_STRPARSE, 'p',
4242
"offset; a series of these can be used to 'dig'"},
43-
{"genstr", OPT_GENSTR, 's', "string to generate ASN1 structure from"},
4443
{OPT_MORE_STR, 0, 0, "into multiple ASN1 blob wrappings"},
44+
{"genstr", OPT_GENSTR, 's', "string to generate ASN1 structure from"},
4545
{"genconf", OPT_GENCONF, 's', "file to generate ASN1 structure from"},
4646
{"strictpem", OPT_STRICTPEM, 0,
4747
"equivalent to '-inform pem' (obsolete)"},
Collapse file

‎deps/openssl/openssl/apps/rand.c‎

Copy file name to clipboardExpand all lines: deps/openssl/openssl/apps/rand.c
+2-2Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1998-2022 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1998-2025 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the Apache License 2.0 (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -199,7 +199,7 @@ int rand_main(int argc, char **argv)
199199
int chunk;
200200

201201
chunk = scaled_num > buflen ? (int)buflen : (int)scaled_num;
202-
r = RAND_bytes(buf, chunk);
202+
r = RAND_bytes_ex(app_get0_libctx(), buf, chunk, 0);
203203
if (r <= 0)
204204
goto end;
205205
if (format != FORMAT_TEXT) {
Collapse file

‎deps/openssl/openssl/crypto/dh/dh_check.c‎

Copy file name to clipboardExpand all lines: deps/openssl/openssl/crypto/dh/dh_check.c
+32-4Lines changed: 32 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the Apache License 2.0 (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -16,6 +16,7 @@
1616
#include <stdio.h>
1717
#include "internal/cryptlib.h"
1818
#include <openssl/bn.h>
19+
#include <openssl/self_test.h>
1920
#include "dh_local.h"
2021
#include "crypto/dh.h"
2122

@@ -329,17 +330,27 @@ int ossl_dh_check_priv_key(const DH *dh, const BIGNUM *priv_key, int *ret)
329330
* FFC pairwise check from SP800-56A R3.
330331
* Section 5.6.2.1.4 Owner Assurance of Pair-wise Consistency
331332
*/
332-
int ossl_dh_check_pairwise(const DH *dh)
333+
int ossl_dh_check_pairwise(const DH *dh, int return_on_null_numbers)
333334
{
334335
int ret = 0;
335336
BN_CTX *ctx = NULL;
336337
BIGNUM *pub_key = NULL;
338+
OSSL_SELF_TEST *st = NULL;
339+
OSSL_CALLBACK *stcb = NULL;
340+
void *stcbarg = NULL;
337341

338342
if (dh->params.p == NULL
339343
|| dh->params.g == NULL
340344
|| dh->priv_key == NULL
341345
|| dh->pub_key == NULL)
342-
return 0;
346+
return return_on_null_numbers;
347+
348+
OSSL_SELF_TEST_get_callback(dh->libctx, &stcb, &stcbarg);
349+
st = OSSL_SELF_TEST_new(stcb, stcbarg);
350+
if (st == NULL)
351+
goto err;
352+
OSSL_SELF_TEST_onbegin(st, OSSL_SELF_TEST_TYPE_PCT,
353+
OSSL_SELF_TEST_DESC_PCT_DH);
343354

344355
ctx = BN_CTX_new_ex(dh->libctx);
345356
if (ctx == NULL)
@@ -351,10 +362,27 @@ int ossl_dh_check_pairwise(const DH *dh)
351362
/* recalculate the public key = (g ^ priv) mod p */
352363
if (!ossl_dh_generate_public_key(ctx, dh, dh->priv_key, pub_key))
353364
goto err;
365+
366+
#ifdef FIPS_MODULE
367+
{
368+
int len;
369+
unsigned char bytes[1024] = {0}; /* Max key size of 8192 bits */
370+
371+
if (BN_num_bytes(pub_key) > (int)sizeof(bytes))
372+
goto err;
373+
len = BN_bn2bin(pub_key, bytes);
374+
OSSL_SELF_TEST_oncorrupt_byte(st, bytes);
375+
if (BN_bin2bn(bytes, len, pub_key) == NULL)
376+
goto err;
377+
}
378+
#endif
354379
/* check it matches the existing public_key */
355380
ret = BN_cmp(pub_key, dh->pub_key) == 0;
356-
err:
381+
err:
357382
BN_free(pub_key);
358383
BN_CTX_free(ctx);
384+
385+
OSSL_SELF_TEST_onend(st, ret);
386+
OSSL_SELF_TEST_free(st);
359387
return ret;
360388
}
Collapse file

‎deps/openssl/openssl/crypto/encode_decode/decoder_lib.c‎

Copy file name to clipboardExpand all lines: deps/openssl/openssl/crypto/encode_decode/decoder_lib.c
+28Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -537,6 +537,14 @@ static void collect_extra_decoder(OSSL_DECODER *decoder, void *arg)
537537
}
538538
}
539539

540+
static int decoder_sk_cmp(const OSSL_DECODER_INSTANCE *const *a,
541+
const OSSL_DECODER_INSTANCE *const *b)
542+
{
543+
if ((*a)->score == (*b)->score)
544+
return (*a)->order - (*b)->order;
545+
return (*a)->score - (*b)->score;
546+
}
547+
540548
int OSSL_DECODER_CTX_add_extra(OSSL_DECODER_CTX *ctx,
541549
OSSL_LIB_CTX *libctx, const char *propq)
542550
{
@@ -595,6 +603,26 @@ int OSSL_DECODER_CTX_add_extra(OSSL_DECODER_CTX *ctx,
595603
OSSL_DECODER_do_all_provided(libctx, collect_all_decoders, skdecoders);
596604
numdecoders = sk_OSSL_DECODER_num(skdecoders);
597605

606+
/*
607+
* If there are provided or default properties, sort the initial decoder list
608+
* by property matching score so that the highest scored provider is selected
609+
* first.
610+
*/
611+
if (propq != NULL || ossl_ctx_global_properties(libctx, 0) != NULL) {
612+
int num_decoder_insts = sk_OSSL_DECODER_INSTANCE_num(ctx->decoder_insts);
613+
int i;
614+
OSSL_DECODER_INSTANCE *di;
615+
sk_OSSL_DECODER_INSTANCE_compfunc old_cmp =
616+
sk_OSSL_DECODER_INSTANCE_set_cmp_func(ctx->decoder_insts, decoder_sk_cmp);
617+
618+
for (i = 0; i < num_decoder_insts; i++) {
619+
di = sk_OSSL_DECODER_INSTANCE_value(ctx->decoder_insts, i);
620+
di->order = i;
621+
}
622+
sk_OSSL_DECODER_INSTANCE_sort(ctx->decoder_insts);
623+
sk_OSSL_DECODER_INSTANCE_set_cmp_func(ctx->decoder_insts, old_cmp);
624+
}
625+
598626
memset(&data, 0, sizeof(data));
599627
data.ctx = ctx;
600628
data.w_prev_start = 0;
Collapse file

‎deps/openssl/openssl/crypto/encode_decode/decoder_pkey.c‎

Copy file name to clipboardExpand all lines: deps/openssl/openssl/crypto/encode_decode/decoder_pkey.c
+60-12Lines changed: 60 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -222,15 +222,21 @@ struct collect_data_st {
222222
int total; /* number of matching results */
223223
char error_occurred;
224224
char keytype_resolved;
225+
OSSL_PROPERTY_LIST *pq;
225226

226227
STACK_OF(EVP_KEYMGMT) *keymgmts;
227228
};
228229

229-
static void collect_decoder_keymgmt(EVP_KEYMGMT *keymgmt, OSSL_DECODER *decoder,
230-
void *provctx, struct collect_data_st *data)
230+
/*
231+
* Add decoder instance to the decoder context if it is compatible. Returns 1
232+
* if a decoder was added, 0 otherwise.
233+
*/
234+
static int collect_decoder_keymgmt(EVP_KEYMGMT *keymgmt, OSSL_DECODER *decoder,
235+
void *provctx, struct collect_data_st *data)
231236
{
232237
void *decoderctx = NULL;
233238
OSSL_DECODER_INSTANCE *di = NULL;
239+
const OSSL_PROPERTY_LIST *props;
234240

235241
/*
236242
* We already checked the EVP_KEYMGMT is applicable in check_keymgmt so we
@@ -239,17 +245,17 @@ static void collect_decoder_keymgmt(EVP_KEYMGMT *keymgmt, OSSL_DECODER *decoder,
239245

240246
if (keymgmt->name_id != decoder->base.id)
241247
/* Mismatch is not an error, continue. */
242-
return;
248+
return 0;
243249

244250
if ((decoderctx = decoder->newctx(provctx)) == NULL) {
245251
data->error_occurred = 1;
246-
return;
252+
return 0;
247253
}
248254

249255
if ((di = ossl_decoder_instance_new(decoder, decoderctx)) == NULL) {
250256
decoder->freectx(decoderctx);
251257
data->error_occurred = 1;
252-
return;
258+
return 0;
253259
}
254260

255261
/*
@@ -263,7 +269,7 @@ static void collect_decoder_keymgmt(EVP_KEYMGMT *keymgmt, OSSL_DECODER *decoder,
263269
|| OPENSSL_strcasecmp(data->ctx->start_input_type, "PEM") != 0)) {
264270
/* Mismatch is not an error, continue. */
265271
ossl_decoder_instance_free(di);
266-
return;
272+
return 0;
267273
}
268274

269275
OSSL_TRACE_BEGIN(DECODER) {
@@ -275,13 +281,30 @@ static void collect_decoder_keymgmt(EVP_KEYMGMT *keymgmt, OSSL_DECODER *decoder,
275281
OSSL_DECODER_get0_properties(decoder));
276282
} OSSL_TRACE_END(DECODER);
277283

284+
/*
285+
* Get the property match score so the decoders can be prioritized later.
286+
*/
287+
props = ossl_decoder_parsed_properties(decoder);
288+
if (data->pq != NULL && props != NULL) {
289+
di->score = ossl_property_match_count(data->pq, props);
290+
/*
291+
* Mismatch of mandatory properties is not an error, the decoder is just
292+
* ignored, continue.
293+
*/
294+
if (di->score < 0) {
295+
ossl_decoder_instance_free(di);
296+
return 0;
297+
}
298+
}
299+
278300
if (!ossl_decoder_ctx_add_decoder_inst(data->ctx, di)) {
279301
ossl_decoder_instance_free(di);
280302
data->error_occurred = 1;
281-
return;
303+
return 0;
282304
}
283305

284306
++data->total;
307+
return 1;
285308
}
286309

287310
static void collect_decoder(OSSL_DECODER *decoder, void *arg)
@@ -321,7 +344,9 @@ static void collect_decoder(OSSL_DECODER *decoder, void *arg)
321344
for (i = 0; i < end_i; ++i) {
322345
keymgmt = sk_EVP_KEYMGMT_value(keymgmts, i);
323346

324-
collect_decoder_keymgmt(keymgmt, decoder, provctx, data);
347+
/* Only add this decoder once */
348+
if (collect_decoder_keymgmt(keymgmt, decoder, provctx, data))
349+
break;
325350
if (data->error_occurred)
326351
return;
327352
}
@@ -407,6 +432,8 @@ static int ossl_decoder_ctx_setup_for_pkey(OSSL_DECODER_CTX *ctx,
407432
struct decoder_pkey_data_st *process_data = NULL;
408433
struct collect_data_st collect_data = { NULL };
409434
STACK_OF(EVP_KEYMGMT) *keymgmts = NULL;
435+
OSSL_PROPERTY_LIST **plp;
436+
OSSL_PROPERTY_LIST *pq = NULL, *p2 = NULL;
410437

411438
OSSL_TRACE_BEGIN(DECODER) {
412439
const char *input_type = ctx->start_input_type;
@@ -442,6 +469,25 @@ static int ossl_decoder_ctx_setup_for_pkey(OSSL_DECODER_CTX *ctx,
442469
process_data->selection = ctx->selection;
443470
process_data->keymgmts = keymgmts;
444471

472+
/*
473+
* Collect passed and default properties to prioritize the decoders.
474+
*/
475+
if (propquery != NULL)
476+
p2 = pq = ossl_parse_query(libctx, propquery, 1);
477+
478+
plp = ossl_ctx_global_properties(libctx, 0);
479+
if (plp != NULL && *plp != NULL) {
480+
if (pq == NULL) {
481+
pq = *plp;
482+
} else {
483+
p2 = ossl_property_merge(pq, *plp);
484+
ossl_property_free(pq);
485+
if (p2 == NULL)
486+
goto err;
487+
pq = p2;
488+
}
489+
}
490+
445491
/*
446492
* Enumerate all keymgmts into a stack.
447493
*
@@ -457,10 +503,11 @@ static int ossl_decoder_ctx_setup_for_pkey(OSSL_DECODER_CTX *ctx,
457503
* upfront, as this ensures that the names for all loaded providers have
458504
* been registered by the time we try to resolve the keytype string.
459505
*/
460-
collect_data.ctx = ctx;
461-
collect_data.libctx = libctx;
462-
collect_data.keymgmts = keymgmts;
463-
collect_data.keytype = keytype;
506+
collect_data.ctx = ctx;
507+
collect_data.libctx = libctx;
508+
collect_data.keymgmts = keymgmts;
509+
collect_data.keytype = keytype;
510+
collect_data.pq = pq;
464511
EVP_KEYMGMT_do_all_provided(libctx, collect_keymgmt, &collect_data);
465512

466513
if (collect_data.error_occurred)
@@ -496,6 +543,7 @@ static int ossl_decoder_ctx_setup_for_pkey(OSSL_DECODER_CTX *ctx,
496543
ok = 1;
497544
err:
498545
decoder_clean_pkey_construct_arg(process_data);
546+
ossl_property_free(p2);
499547
return ok;
500548
}
501549

Collapse file

‎deps/openssl/openssl/crypto/encode_decode/encoder_local.h‎

Copy file name to clipboardExpand all lines: deps/openssl/openssl/crypto/encode_decode/encoder_local.h
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,8 @@ struct ossl_decoder_instance_st {
109109
const char *input_type; /* Never NULL */
110110
const char *input_structure; /* May be NULL */
111111
int input_type_id;
112+
int order; /* For stable ordering of decoders wrt proqs */
113+
int score; /* For ordering decoders wrt proqs */
112114

113115
unsigned int flag_input_structure_was_set : 1;
114116
};
Collapse file

‎deps/openssl/openssl/crypto/evp/asymcipher.c‎

Copy file name to clipboardExpand all lines: deps/openssl/openssl/crypto/evp/asymcipher.c
+6-2Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -261,10 +261,12 @@ int EVP_PKEY_encrypt(EVP_PKEY_CTX *ctx,
261261

262262
cipher = ctx->op.ciph.cipher;
263263
desc = cipher->description != NULL ? cipher->description : "";
264+
ERR_set_mark();
264265
ret = cipher->encrypt(ctx->op.ciph.algctx, out, outlen, (out == NULL ? 0 : *outlen), in, inlen);
265-
if (ret <= 0)
266+
if (ret <= 0 && ERR_count_to_mark() == 0)
266267
ERR_raise_data(ERR_LIB_EVP, EVP_R_PROVIDER_ASYM_CIPHER_FAILURE,
267268
"%s encrypt:%s", cipher->type_name, desc);
269+
ERR_clear_last_mark();
268270
return ret;
269271

270272
legacy:
@@ -309,10 +311,12 @@ int EVP_PKEY_decrypt(EVP_PKEY_CTX *ctx,
309311

310312
cipher = ctx->op.ciph.cipher;
311313
desc = cipher->description != NULL ? cipher->description : "";
314+
ERR_set_mark();
312315
ret = cipher->decrypt(ctx->op.ciph.algctx, out, outlen, (out == NULL ? 0 : *outlen), in, inlen);
313-
if (ret <= 0)
316+
if (ret <= 0 && ERR_count_to_mark() == 0)
314317
ERR_raise_data(ERR_LIB_EVP, EVP_R_PROVIDER_ASYM_CIPHER_FAILURE,
315318
"%s decrypt:%s", cipher->type_name, desc);
319+
ERR_clear_last_mark();
316320

317321
return ret;
318322

0 commit comments

Comments
0 (0)
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.