Re: [Patch] CryptoPkg/OpensslLib: Upgrade OpenSSL version to 1.0.2k

[Laszlo Ersek <lersek@redhat.com>]

On 02/24/17 14:52, Long, Qin wrote:
> Laszlo,
> 
> This upgrade may have some conflicts with your last patch series. It could be resolved /merged easily.
> It will be better to have your validations based on this new openssl version. 

Why will it be better?

> (And I just noticed two changes (ssl_conf.c & NO_PQUEUE) were duplicated in this patch.)

Well, technically, I posted those patches first (two versions,
actually), and they are mostly reviewed by now (thanks to you as well).
So I think they should go in first, and this is the patch that should be
rebased.

Patches that are already on the list (and are ready to be merged
especially) should not be pre-empted by more recently posted patches
(especially if they still need review and/or testing).

Thanks,
Laszlo

> 
> 
> Best Regards & Thanks,
> LONG, Qin
> 
>> -----Original Message-----
>> From: Long, Qin
>> Sent: Friday, February 24, 2017 9:39 PM
>> To: edk2-devel@lists.01.org; Long, Qin <qin.long@intel.com>
>> Cc: Ye, Ting <ting.ye@intel.com>; Wu, Jiaxin <jiaxin.wu@intel.com>;
>> lersek@redhat.com
>> Subject: [Patch] CryptoPkg/OpensslLib: Upgrade OpenSSL version to 1.0.2k
>>
>> OpenSSL 1.0.2k was released with several severity fixes at
>> 26-Jan-2017 (https://www.openssl.org/news/secadv/20170126.txt).
>> This patch is to upgrade the supported OpenSSL version in
>> CryptoPkg/OpensslLib to catch the latest release 1.0.2k.
>>
>> Cc: Ye Ting <ting.ye@intel.com>
>> Cc: Wu Jiaxin <jiaxin.wu@intel.com>
>> Cc: Laszlo Ersek <lersek@redhat.com>
>> Contributed-under: TianoCore Contribution Agreement 1.0
>> Signed-off-by: Qin Long <qin.long@intel.com>
>> ---
>>  CryptoPkg/CryptoPkg.dec                            |  4 ++--
>>  ...ssl-1.0.2j.patch => EDKII_openssl-1.0.2k.patch} | 26 +++++++++++----------
>> -
>>  CryptoPkg/Library/OpensslLib/Install.cmd           |  2 +-
>>  CryptoPkg/Library/OpensslLib/Install.sh            |  2 +-
>>  CryptoPkg/Library/OpensslLib/OpensslLib.inf        |  7 +++---
>>  CryptoPkg/Library/OpensslLib/Patch-HOWTO.txt       | 26 +++++++++++------
>> -----
>>  CryptoPkg/Library/OpensslLib/opensslconf.h         |  6 -----
>>  7 files changed, 34 insertions(+), 39 deletions(-)  rename
>> CryptoPkg/Library/OpensslLib/{EDKII_openssl-1.0.2j.patch => EDKII_openssl-
>> 1.0.2k.patch} (96%)
>>
>> diff --git a/CryptoPkg/CryptoPkg.dec b/CryptoPkg/CryptoPkg.dec index
>> eee26cbccc..27c832707a 100644
>> --- a/CryptoPkg/CryptoPkg.dec
>> +++ b/CryptoPkg/CryptoPkg.dec
>> @@ -4,7 +4,7 @@
>>  #  This Package provides cryptographic-related libraries for UEFI security
>> modules.
>>  #  It also provides a test application to test libraries.
>>  #
>> -#  Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.<BR>
>> +#  Copyright (c) 2009 - 2017, Intel Corporation. All rights
>> +reserved.<BR>
>>  #  This program and the accompanying materials  #  are licensed and made
>> available under the terms and conditions of the BSD License  #  which
>> accompanies this distribution.  The full text of the license may be found at
>> @@ -24,7 +24,7 @@
>>
>>  [Includes]
>>    Include
>> -  Library/OpensslLib/openssl-1.0.2j/include
>> +  Library/OpensslLib/openssl-1.0.2k/include
>>
>>  [LibraryClasses]
>>    ##  @libraryclass  Provides basic library functions for cryptographic
>> primitives.
>> diff --git a/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2j.patch
>> b/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2k.patch
>> similarity index 96%
>> rename from CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2j.patch
>> rename to CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2k.patch
>> index ecd13a9d5f..cc0ce6822e 100644
>> --- a/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2j.patch
>> +++ b/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2k.patch
>> @@ -1,8 +1,8 @@
>>  diff --git a/Configure b/Configure
>> -index c39f71a..98dd1d0 100755
>> +index 5da7cad..c2cc9c5 100755
>>  --- a/Configure
>>  +++ b/Configure
>> -@@ -609,6 +609,9 @@ my %table=(
>> +@@ -611,6 +611,9 @@ my %table=(
>>   # with itself, Applink is never engaged and can as well be omitted.
>>   "mingw64", "gcc:-mno-cygwin -DL_ENDIAN -O3 -Wall -
>> DWIN32_LEAN_AND_MEAN -DUNICODE -D_UNICODE::-D_MT:MINGW64:-
>> lws2_32 -lgdi32 -lcrypt32:SIXTY_FOUR_BIT RC4_CHUNK_LL DES_INT
>> EXPORT_VAR_AS_FN:${x86_64_asm}:mingw64:win32:cygwin-shared:-
>> D_WINDLL:-mno-cygwin:.dll.a",
>>
>> @@ -12,7 +12,7 @@ index c39f71a..98dd1d0 100755
>>   # UWIN
>>   "UWIN", "cc:-DTERMIOS -DL_ENDIAN -O -Wall:::UWIN::BN_LLONG
>> ${x86_gcc_des} ${x86_gcc_opts}:${no_asm}:win32",
>>
>> -@@ -1083,7 +1086,7 @@ if (defined($disabled{"md5"}) ||
>> defined($disabled{"sha"})
>> +@@ -1085,7 +1088,7 @@ if (defined($disabled{"md5"}) ||
>> +defined($disabled{"sha"})
>>   	}
>>
>>   if (defined($disabled{"ec"}) || defined($disabled{"dsa"}) @@ -22,10 +22,10
>> @@ index c39f71a..98dd1d0 100755
>>   	$disabled{"gost"} = "forced";
>>   	}
>>  diff --git a/apps/apps.c b/apps/apps.c
>> -index 9fdc3e0..6c183b0 100644
>> +index c487bd9..64ade15 100644
>>  --- a/apps/apps.c
>>  +++ b/apps/apps.c
>> -@@ -2375,6 +2375,8 @@ int args_verify(char ***pargs, int *pargc,
>> +@@ -2386,6 +2386,8 @@ int args_verify(char ***pargs, int *pargc,
>>           flags |= X509_V_FLAG_PARTIAL_CHAIN;
>>       else if (!strcmp(arg, "-no_alt_chains"))
>>           flags |= X509_V_FLAG_NO_ALT_CHAINS; @@ -254,7 +254,7 @@ index
>> d5a5514..bede55c 100644
>>           goto err;
>>
>>  diff --git a/crypto/bn/bn_prime.c b/crypto/bn/bn_prime.c -index
>> 1d25687..ad641c3 100644
>> +index 8177fd2..4dab3bb 100644
>>  --- a/crypto/bn/bn_prime.c
>>  +++ b/crypto/bn/bn_prime.c
>>  @@ -131,7 +131,7 @@
>> @@ -298,7 +298,7 @@ index 1d25687..ad641c3 100644
>>       if (ctx != NULL) {
>>           BN_CTX_end(ctx);
>>           BN_CTX_free(ctx);
>> -@@ -375,10 +380,9 @@ static int witness(BIGNUM *w, const BIGNUM *a,
>> const BIGNUM *a1,
>> +@@ -376,10 +381,9 @@ static int witness(BIGNUM *w, const BIGNUM *a,
>> +const BIGNUM *a1,
>>       return 1;
>>   }
>>
>> @@ -861,7 +861,7 @@ index 585aa8b..04c6cfc 100644
>>   /*
>>    * Borland C seems too stupid to be able to shift and do longs in the  diff --git
>> a/crypto/evp/evp.h b/crypto/evp/evp.h -index 39ab793..ad1e350 100644
>> +index d258ef8..376f260 100644
>>  --- a/crypto/evp/evp.h
>>  +++ b/crypto/evp/evp.h
>>  @@ -602,11 +602,13 @@ int EVP_MD_CTX_copy(EVP_MD_CTX *out, const
>> EVP_MD_CTX *in); @@ -1470,7 +1470,7 @@ index bbc3189..29695f9 100644
>> +  +#endif /* OPENSSL_NO_STDIO */  diff --git a/crypto/x509/x509_vfy.c
>> b/crypto/x509/x509_vfy.c -index 8334b3f..d075f66 100644
>> +index b147201..5bf3f07 100644
>>  --- a/crypto/x509/x509_vfy.c
>>  +++ b/crypto/x509/x509_vfy.c
>>  @@ -1064,6 +1064,8 @@ static int check_crl_time(X509_STORE_CTX *ctx,
>> X509_CRL *crl, int notify) @@ -1915,10 +1915,10 @@ index 499f0e8..5672f99
>> 100644
>>               os.data = NULL;
>>               os.length = 0;
>>  diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c -index f48ebae..ac4f08c 100644
>> +index 1be6fb0..cbec97c 100644
>>  --- a/ssl/ssl_cert.c
>>  +++ b/ssl/ssl_cert.c
>> -@@ -857,12 +857,12 @@ int SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 *x)
>> +@@ -855,12 +855,12 @@ int SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 *x)
>>       return (add_client_CA(&(ctx->client_CA), x));
>>   }
>>
>> @@ -1932,7 +1932,7 @@ index f48ebae..ac4f08c 100644
>>   /**
>>    * Load CA certs from a file into a ::STACK. Note that it is somewhat
>> misnamed;
>>    * it doesn't really have anything to do with clients (except that a common
>> use -@@ -930,7 +930,6 @@ STACK_OF(X509_NAME)
>> *SSL_load_client_CA_file(const char *file)
>> +@@ -928,7 +928,6 @@ STACK_OF(X509_NAME)
>> *SSL_load_client_CA_file(const
>> +char *file)
>>           ERR_clear_error();
>>       return (ret);
>>   }
>> @@ -1940,7 +1940,7 @@ index f48ebae..ac4f08c 100644
>>
>>   /**
>>    * Add a file of certs to a stack.
>> -@@ -1050,6 +1049,7 @@ int
>> SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
>> +@@ -1048,6 +1047,7 @@ int
>> +SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
>>       CRYPTO_w_unlock(CRYPTO_LOCK_READDIR);
>>       return ret;
>>   }
>> diff --git a/CryptoPkg/Library/OpensslLib/Install.cmd
>> b/CryptoPkg/Library/OpensslLib/Install.cmd
>> index 093414d4b8..e040cda259 100755
>> --- a/CryptoPkg/Library/OpensslLib/Install.cmd
>> +++ b/CryptoPkg/Library/OpensslLib/Install.cmd
>> @@ -1,4 +1,4 @@
>> -cd openssl-1.0.2j
>> +cd openssl-1.0.2k
>>  copy ..\opensslconf.h           crypto
>>  if not exist include\openssl mkdir include\openssl
>>  copy e_os2.h                    include\openssl
>> diff --git a/CryptoPkg/Library/OpensslLib/Install.sh
>> b/CryptoPkg/Library/OpensslLib/Install.sh
>> index 7bd55f6ae3..40811e20a6 100755
>> --- a/CryptoPkg/Library/OpensslLib/Install.sh
>> +++ b/CryptoPkg/Library/OpensslLib/Install.sh
>> @@ -1,6 +1,6 @@
>>  #!/bin/sh
>>
>> -cd openssl-1.0.2j
>> +cd openssl-1.0.2k
>>  cp ../opensslconf.h           crypto
>>  mkdir -p                      include/openssl
>>  cp e_os2.h                    include/openssl
>> diff --git a/CryptoPkg/Library/OpensslLib/OpensslLib.inf
>> b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
>> index c14e36d341..3acc397ace 100644
>> --- a/CryptoPkg/Library/OpensslLib/OpensslLib.inf
>> +++ b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
>> @@ -1,7 +1,7 @@
>>  ## @file
>>  #  This module provides openSSL Library implementation.
>>  #
>> -#  Copyright (c) 2010 - 2016, Intel Corporation. All rights reserved.<BR>
>> +#  Copyright (c) 2010 - 2017, Intel Corporation. All rights
>> +reserved.<BR>
>>  #  This program and the accompanying materials  #  are licensed and made
>> available under the terms and conditions of the BSD License  #  which
>> accompanies this distribution.  The full text of the license may be found at
>> @@ -20,7 +20,7 @@
>>    MODULE_TYPE                    = BASE
>>    VERSION_STRING                 = 1.0
>>    LIBRARY_CLASS                  = OpensslLib
>> -  DEFINE OPENSSL_PATH            = openssl-1.0.2j
>> +  DEFINE OPENSSL_PATH            = openssl-1.0.2k
>>    DEFINE OPENSSL_FLAGS           = -DL_ENDIAN -
>> DOPENSSL_SMALL_FOOTPRINT -D_CRT_SECURE_NO_DEPRECATE -
>> D_CRT_NONSTDC_NO_DEPRECATE
>>
>>  #
>> @@ -516,6 +516,7 @@
>>    $(OPENSSL_PATH)/ssl/ssl_asn1.c
>>    $(OPENSSL_PATH)/ssl/ssl_txt.c
>>    $(OPENSSL_PATH)/ssl/ssl_algs.c
>> +  $(OPENSSL_PATH)/ssl/ssl_conf.c
>>    $(OPENSSL_PATH)/ssl/bio_ssl.c
>>    $(OPENSSL_PATH)/ssl/ssl_err.c
>>    $(OPENSSL_PATH)/ssl/kssl.c
>> @@ -550,7 +551,7 @@
>>    # C4702: Potentially uninitialized local variable name used
>>    # C4311: pointer truncation from 'type' to 'type'
>>    #
>> -  MSFT:*_*_IA32_CC_FLAGS    = -U_WIN32 -U_WIN64 -U_MSC_VER
>> $(OPENSSL_FLAGS) /wd4244 /wd4245 /wd4701 /wd4702 /wd4706
>> +  MSFT:*_*_IA32_CC_FLAGS    = -U_WIN32 -U_WIN64 -U_MSC_VER
>> $(OPENSSL_FLAGS) /wd4244 /wd4245 /wd4267 /wd4701 /wd4702 /wd4706
>>    MSFT:*_*_X64_CC_FLAGS     = -U_WIN32 -U_WIN64 -U_MSC_VER
>> $(OPENSSL_FLAGS) /wd4133 /wd4244 /wd4245 /wd4267 /wd4701 /wd4305
>> /wd4306 /wd4702 /wd4706 /wd4311
>>    MSFT:*_*_IPF_CC_FLAGS     = -U_WIN32 -U_WIN64 -U_MSC_VER
>> $(OPENSSL_FLAGS) /wd4133 /wd4244 /wd4245 /wd4267 /wd4701 /wd4305
>> /wd4306 /wd4702 /wd4706
>>
>> diff --git a/CryptoPkg/Library/OpensslLib/Patch-HOWTO.txt
>> b/CryptoPkg/Library/OpensslLib/Patch-HOWTO.txt
>> index d7e3d9e875..8418802ac7 100644
>> --- a/CryptoPkg/Library/OpensslLib/Patch-HOWTO.txt
>> +++ b/CryptoPkg/Library/OpensslLib/Patch-HOWTO.txt
>> @@ -17,36 +17,36 @@ cryptography. This patch will enable openssl building
>> under UEFI environment.
>>
>> ==========================================================
>> ======================
>>                                  OpenSSL-Version
>> ==========================================================
>> ======================
>> -  Current supported OpenSSL version for UEFI Crypto Library is 1.0.2j.
>> -    http://www.openssl.org/source/openssl-1.0.2j.tar.gz
>> +  Current supported OpenSSL version for UEFI Crypto Library is 1.0.2k.
>> +    http://www.openssl.org/source/openssl-1.0.2k.tar.gz
>>
>>
>>
>> ==========================================================
>> ======================
>>                        HOW to Install Openssl for UEFI Building
>> ==========================================================
>> ======================
>> -1.  Download OpenSSL 1.0.2j from official website:
>> -    http://www.openssl.org/source/openssl-1.0.2j.tar.gz
>> +1.  Download OpenSSL 1.0.2k from official website:
>> +    http://www.openssl.org/source/openssl-1.0.2k.tar.gz
>>
>> -    NOTE: Some web browsers may rename the downloaded TAR file to
>> openssl-1.0.2j.tar.tar.
>> -          When you do the download, rename the "openssl-1.0.2j.tar.tar" to
>> -          "openssl-1.0.2j.tar.gz" or rename the local downloaded file with
>> ".tar.tar"
>> +    NOTE: Some web browsers may rename the downloaded TAR file to
>> openssl-1.0.2k.tar.tar.
>> +          When you do the download, rename the "openssl-1.0.2k.tar.tar" to
>> +          "openssl-1.0.2k.tar.gz" or rename the local downloaded file with
>> ".tar.tar"
>>            extension to ".tar.gz".
>>
>> -2.  Extract TAR into CryptoPkg/Library/OpensslLib/openssl-1.0.2j
>> +2.  Extract TAR into CryptoPkg/Library/OpensslLib/openssl-1.0.2k
>>
>>      NOTE: If you use WinZip to unpack the openssl source in Windows, please
>>            uncheck the WinZip smart CR/LF conversion option (WINZIP: Options -->
>>            Configuration --> Miscellaneous --> "TAR file smart CR/LF conversion").
>>
>> -3.  Apply this patch: EDKII_openssl-1.0.2j.patch, and make installation
>> +3.  Apply this patch: EDKII_openssl-1.0.2k.patch, and make installation
>>
>>      For Windows Environment:
>>      ------------------------
>>      1) Make sure the patch utility has been installed in your machine.
>>         Install Cygwin or get the patch utility binary from
>>            http://gnuwin32.sourceforge.net/packages/patch.htm
>> -    2) cd $(WORKSPACE)\CryptoPkg\Library\OpensslLib\openssl-1.0.2j
>> -    3) patch -p1 -i ..\EDKII_openssl-1.0.2j.patch
>> +    2) cd $(WORKSPACE)\CryptoPkg\Library\OpensslLib\openssl-1.0.2k
>> +    3) patch -p1 -i ..\EDKII_openssl-1.0.2k.patch
>>      4) cd ..
>>      5) Install.cmd
>>
>> @@ -54,8 +54,8 @@ cryptography. This patch will enable openssl building
>> under UEFI environment.
>>      -----------------------
>>      1) Make sure the patch utility has been installed in your machine.
>>         Patch utility is available from http://directory.fsf.org/project/patch/
>> -    2) cd $(WORKSPACE)/CryptoPkg/Library/OpensslLib/openssl-1.0.2j
>> -    3) patch -p1 -i ../EDKII_openssl-1.0.2j.patch
>> +    2) cd $(WORKSPACE)/CryptoPkg/Library/OpensslLib/openssl-1.0.2k
>> +    3) patch -p1 -i ../EDKII_openssl-1.0.2k.patch
>>      4) cd ..
>>      5) ./Install.sh
>>
>> diff --git a/CryptoPkg/Library/OpensslLib/opensslconf.h
>> b/CryptoPkg/Library/OpensslLib/opensslconf.h
>> index adcaa01d6b..e0054a45fc 100644
>> --- a/CryptoPkg/Library/OpensslLib/opensslconf.h
>> +++ b/CryptoPkg/Library/OpensslLib/opensslconf.h
>> @@ -92,9 +92,6 @@ extern "C" {
>>  #ifndef OPENSSL_NO_POSIX_IO
>>  # define OPENSSL_NO_POSIX_IO
>>  #endif
>> -#ifndef OPENSSL_NO_PQUEUE
>> -# define OPENSSL_NO_PQUEUE
>> -#endif
>>  #ifndef OPENSSL_NO_RC2
>>  # define OPENSSL_NO_RC2
>>  #endif
>> @@ -263,9 +260,6 @@ extern "C" {
>>  # if defined(OPENSSL_NO_POSIX_IO) && !defined(NO_POSIX_IO)  #  define
>> NO_POSIX_IO  # endif -# if defined(OPENSSL_NO_PQUEUE)
>> && !defined(NO_PQUEUE) -#  define NO_PQUEUE -# endif  # if
>> defined(OPENSSL_NO_RC2) && !defined(NO_RC2)  #  define NO_RC2  #
>> endif
>> --
>> 2.11.1.windows.1
>