[PATCH v2 0/2] Update OpenSSL version to 1.1.0h

[PATCH v2 0/2] Update OpenSSL version to 1.1.0h

[Long Qin]

Updating the supported OpenSSL version to 1.1.0h release.
Additional patch is to address / fix one HOWTO documentation issue
about submodule update command which used the wrong "--remote" option.
(Thanks Laszlo's catch).

Long Qin (2):
  CryptoPkg/OpensslLib: Fix the documentation about submodule update
  CryptoPkg/OpensslLib: Update OpenSSL version to 1.1.0h

 CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt | 2 +-
 CryptoPkg/Library/OpensslLib/openssl           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

-- 
2.16.1.windows.1

[PATCH v2 1/2] CryptoPkg/OpensslLib: Fix the documentation about submodule update

[Long Qin]

This patch is to drop "--remote" option from the original suggested
submodule update command ("$ git submodule update --recursive
--remote") in HOWTO document.

"--remote" option will integrate changes from the upstream subproject
with the submodules's "current HEAD", instead of using the edk2
superproject's "recorded SHA-1". It is wrong here for the edk2
consumers to updating the working tree of the submodules to match the
commit / release tag that the superproject expects.

Removing "--remote" option to fix the documentation issue here.

Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Ye Ting <ting.ye@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Long Qin <qin.long@intel.com>
---
 CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt b/CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt
index ac63d4c077..36f8e711dd 100644
--- a/CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt
+++ b/CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt
@@ -40,7 +40,7 @@ or
   And use the following combined commands to pull the remote submodule updates
 (e.g. Updating the new supported OpenSSL release tag):
      $ git pull --recurse-submodules && \
-       git submodule update --recursive --remote
+       git submodule update --recursive
 
 =============================================================================
                       About process_files.pl
-- 
2.16.1.windows.1

[PATCH v2 2/2] CryptoPkg/OpensslLib: Update OpenSSL version to 1.1.0h

[Long Qin]

(https://bugzilla.tianocore.org/show_bug.cgi?id=927)

(V2 Update:
    Removing the wrong "--remote" option from git submodule update
    command in this commit message. Thanks Leszlo's clarification
    to correct this)

Update OpenSSL version to 1.1.0h release (27-Mar-2018) to include the
fix for CVE-2018-0739 issue (Handling of crafted recursive ASN.1
structures can cause a stack overflow and resulting denial of service,
Refer to https://www.openssl.org/news/secadv/20180327.txt for more
information).

Please note "git pull" will not update the submodule repository.
use the following commend to make your existing submodule track this
update:
   $ git submodule update -–recursive

Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Ye Ting <ting.ye@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Long Qin <qin.long@intel.com>
---
 CryptoPkg/Library/OpensslLib/openssl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CryptoPkg/Library/OpensslLib/openssl b/CryptoPkg/Library/OpensslLib/openssl
index b2758a2292..d4e4bd2a81 160000
--- a/CryptoPkg/Library/OpensslLib/openssl
+++ b/CryptoPkg/Library/OpensslLib/openssl
@@ -1 +1 @@
-Subproject commit b2758a2292aceda93e9f44c219b94fe21bb9a650
+Subproject commit d4e4bd2a8163f355fa8a3884077eaec7adc75ff7
-- 
2.16.1.windows.1

Re: [PATCH v2 1/2] CryptoPkg/OpensslLib: Fix the documentation about submodule update

[Laszlo Ersek]

Hello Qin,

On 04/12/18 05:08, Long Qin wrote:
> This patch is to drop "--remote" option from the original suggested
> submodule update command ("$ git submodule update --recursive
> --remote") in HOWTO document.
> 
> "--remote" option will integrate changes from the upstream subproject
> with the submodules's "current HEAD", instead of using the edk2
> superproject's "recorded SHA-1". It is wrong here for the edk2

The commit message makes sense, and the patch is good, but I think
there's a significant typo in the commit message.

Namely, the word "wrong" is wrong :) Instead, it should be "important".

Or else, "it is the goal for the edk2 consumes to ...".

Do you agree?

(I'll come to the second patch sometime later.)

Thanks!
Laszlo

> consumers to updating the working tree of the submodules to match the
> commit / release tag that the superproject expects.
> 
> Removing "--remote" option to fix the documentation issue here.
> 
> Cc: Laszlo Ersek <lersek@redhat.com>
> Cc: Ye Ting <ting.ye@intel.com>
> Contributed-under: TianoCore Contribution Agreement 1.0
> Signed-off-by: Long Qin <qin.long@intel.com>
> ---
>  CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt b/CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt
> index ac63d4c077..36f8e711dd 100644
> --- a/CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt
> +++ b/CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt
> @@ -40,7 +40,7 @@ or
>    And use the following combined commands to pull the remote submodule updates
>  (e.g. Updating the new supported OpenSSL release tag):
>       $ git pull --recurse-submodules && \
> -       git submodule update --recursive --remote
> +       git submodule update --recursive
>  
>  =============================================================================
>                        About process_files.pl
> 

Re: [PATCH v2 1/2] CryptoPkg/OpensslLib: Fix the documentation about submodule update

[Long, Qin]

Ah, "it's wrong here" means "the existence of "--remote" in original suggested command is wrong". 
"It's important" looks also make sense to address the "update" goal.  I can update that, if old message will cause confusion.


Best Regards & Thanks,
LONG, Qin

-----Original Message-----
From: Laszlo Ersek [mailto:lersek@redhat.com] 
Sent: Thursday, April 12, 2018 5:56 PM
To: Long, Qin <qin.long@intel.com>; Ye, Ting <ting.ye@intel.com>
Cc: edk2-devel@lists.01.org
Subject: Re: [PATCH v2 1/2] CryptoPkg/OpensslLib: Fix the documentation about submodule update

Hello Qin,

On 04/12/18 05:08, Long Qin wrote:
> This patch is to drop "--remote" option from the original suggested 
> submodule update command ("$ git submodule update --recursive
> --remote") in HOWTO document.
> 
> "--remote" option will integrate changes from the upstream subproject 
> with the submodules's "current HEAD", instead of using the edk2 
> superproject's "recorded SHA-1". It is wrong here for the edk2

The commit message makes sense, and the patch is good, but I think there's a significant typo in the commit message.

Namely, the word "wrong" is wrong :) Instead, it should be "important".

Or else, "it is the goal for the edk2 consumes to ...".

Do you agree?

(I'll come to the second patch sometime later.)

Thanks!
Laszlo

> consumers to updating the working tree of the submodules to match the 
> commit / release tag that the superproject expects.
> 
> Removing "--remote" option to fix the documentation issue here.
> 
> Cc: Laszlo Ersek <lersek@redhat.com>
> Cc: Ye Ting <ting.ye@intel.com>
> Contributed-under: TianoCore Contribution Agreement 1.0
> Signed-off-by: Long Qin <qin.long@intel.com>
> ---
>  CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt 
> b/CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt
> index ac63d4c077..36f8e711dd 100644
> --- a/CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt
> +++ b/CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt
> @@ -40,7 +40,7 @@ or
>    And use the following combined commands to pull the remote 
> submodule updates  (e.g. Updating the new supported OpenSSL release tag):
>       $ git pull --recurse-submodules && \
> -       git submodule update --recursive --remote
> +       git submodule update --recursive
>  
>  =============================================================================
>                        About process_files.pl
> 

Re: [PATCH v2 1/2] CryptoPkg/OpensslLib: Fix the documentation about submodule update

[Laszlo Ersek]

On 04/12/18 12:03, Long, Qin wrote:
> 
> Ah, "it's wrong here" means "the existence of "--remote" in original suggested command is wrong". 
> "It's important" looks also make sense to address the "update" goal.  I can update that, if old message will cause confusion.

Ah, you used "for" in the sense of "because". :)

Yup, please clarify the commit message a little bit, I was indeed
confused by it.

Thanks!
Laszlo

> 
> 
> Best Regards & Thanks,
> LONG, Qin
> 
> -----Original Message-----
> From: Laszlo Ersek [mailto:lersek@redhat.com] 
> Sent: Thursday, April 12, 2018 5:56 PM
> To: Long, Qin <qin.long@intel.com>; Ye, Ting <ting.ye@intel.com>
> Cc: edk2-devel@lists.01.org
> Subject: Re: [PATCH v2 1/2] CryptoPkg/OpensslLib: Fix the documentation about submodule update
> 
> Hello Qin,
> 
> On 04/12/18 05:08, Long Qin wrote:
>> This patch is to drop "--remote" option from the original suggested 
>> submodule update command ("$ git submodule update --recursive
>> --remote") in HOWTO document.
>>
>> "--remote" option will integrate changes from the upstream subproject 
>> with the submodules's "current HEAD", instead of using the edk2 
>> superproject's "recorded SHA-1". It is wrong here for the edk2
> 
> The commit message makes sense, and the patch is good, but I think there's a significant typo in the commit message.
> 
> Namely, the word "wrong" is wrong :) Instead, it should be "important".
> 
> Or else, "it is the goal for the edk2 consumes to ...".
> 
> Do you agree?
> 
> (I'll come to the second patch sometime later.)
> 
> Thanks!
> Laszlo
> 
>> consumers to updating the working tree of the submodules to match the 
>> commit / release tag that the superproject expects.
>>
>> Removing "--remote" option to fix the documentation issue here.
>>
>> Cc: Laszlo Ersek <lersek@redhat.com>
>> Cc: Ye Ting <ting.ye@intel.com>
>> Contributed-under: TianoCore Contribution Agreement 1.0
>> Signed-off-by: Long Qin <qin.long@intel.com>
>> ---
>>  CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt 
>> b/CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt
>> index ac63d4c077..36f8e711dd 100644
>> --- a/CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt
>> +++ b/CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt
>> @@ -40,7 +40,7 @@ or
>>    And use the following combined commands to pull the remote 
>> submodule updates  (e.g. Updating the new supported OpenSSL release tag):
>>       $ git pull --recurse-submodules && \
>> -       git submodule update --recursive --remote
>> +       git submodule update --recursive
>>  
>>  =============================================================================
>>                        About process_files.pl
>>
> 

Re: [PATCH v2 1/2] CryptoPkg/OpensslLib: Fix the documentation about submodule update

[Laszlo Ersek]

On 04/12/18 12:03, Long, Qin wrote:
> 
> Ah, "it's wrong here" means "the existence of "--remote" in original suggested command is wrong". 
> "It's important" looks also make sense to address the "update" goal.  I can update that, if old message will cause confusion.

With the commit message clarified:

Reviewed-by: Laszlo Ersek <lersek@redhat.com>

Thanks
Laszlo

> 
> -----Original Message-----
> From: Laszlo Ersek [mailto:lersek@redhat.com] 
> Sent: Thursday, April 12, 2018 5:56 PM
> To: Long, Qin <qin.long@intel.com>; Ye, Ting <ting.ye@intel.com>
> Cc: edk2-devel@lists.01.org
> Subject: Re: [PATCH v2 1/2] CryptoPkg/OpensslLib: Fix the documentation about submodule update
> 
> Hello Qin,
> 
> On 04/12/18 05:08, Long Qin wrote:
>> This patch is to drop "--remote" option from the original suggested 
>> submodule update command ("$ git submodule update --recursive
>> --remote") in HOWTO document.
>>
>> "--remote" option will integrate changes from the upstream subproject 
>> with the submodules's "current HEAD", instead of using the edk2 
>> superproject's "recorded SHA-1". It is wrong here for the edk2
> 
> The commit message makes sense, and the patch is good, but I think there's a significant typo in the commit message.
> 
> Namely, the word "wrong" is wrong :) Instead, it should be "important".
> 
> Or else, "it is the goal for the edk2 consumes to ...".
> 
> Do you agree?
> 
> (I'll come to the second patch sometime later.)
> 
> Thanks!
> Laszlo
> 
>> consumers to updating the working tree of the submodules to match the 
>> commit / release tag that the superproject expects.
>>
>> Removing "--remote" option to fix the documentation issue here.
>>
>> Cc: Laszlo Ersek <lersek@redhat.com>
>> Cc: Ye Ting <ting.ye@intel.com>
>> Contributed-under: TianoCore Contribution Agreement 1.0
>> Signed-off-by: Long Qin <qin.long@intel.com>
>> ---
>>  CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt 
>> b/CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt
>> index ac63d4c077..36f8e711dd 100644
>> --- a/CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt
>> +++ b/CryptoPkg/Library/OpensslLib/OpenSSL-HOWTO.txt
>> @@ -40,7 +40,7 @@ or
>>    And use the following combined commands to pull the remote 
>> submodule updates  (e.g. Updating the new supported OpenSSL release tag):
>>       $ git pull --recurse-submodules && \
>> -       git submodule update --recursive --remote
>> +       git submodule update --recursive
>>  
>>  =============================================================================
>>                        About process_files.pl
>>
> 
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel
> 

Re: [PATCH v2 2/2] CryptoPkg/OpensslLib: Update OpenSSL version to 1.1.0h

[Laszlo Ersek]

On 04/12/18 05:08, Long Qin wrote:
> (https://bugzilla.tianocore.org/show_bug.cgi?id=927)
> 
> (V2 Update:
>     Removing the wrong "--remote" option from git submodule update
>     command in this commit message. Thanks Leszlo's clarification
>     to correct this)

(1) "Laszlo", not "Leszlo" :)

> 
> Update OpenSSL version to 1.1.0h release (27-Mar-2018) to include the
> fix for CVE-2018-0739 issue (Handling of crafted recursive ASN.1
> structures can cause a stack overflow and resulting denial of service,
> Refer to https://www.openssl.org/news/secadv/20180327.txt for more
> information).
> 
> Please note "git pull" will not update the submodule repository.
> use the following commend to make your existing submodule track this
> update:
>    $ git submodule update -–recursive

(2) OK, so this is a tricky one. The "--recursive" option starts with
two hyphen characters (ASCII 0x2D). However, the string above starts
with a hyphen (ASCII 0x2D) and then a unicode EN DASH codepoint
(U+2013). Please replace it with a normal hyphen.

More below:

> 
> Cc: Laszlo Ersek <lersek@redhat.com>
> Cc: Ye Ting <ting.ye@intel.com>
> Contributed-under: TianoCore Contribution Agreement 1.0
> Signed-off-by: Long Qin <qin.long@intel.com>
> ---
>  CryptoPkg/Library/OpensslLib/openssl | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/CryptoPkg/Library/OpensslLib/openssl b/CryptoPkg/Library/OpensslLib/openssl
> index b2758a2292..d4e4bd2a81 160000
> --- a/CryptoPkg/Library/OpensslLib/openssl
> +++ b/CryptoPkg/Library/OpensslLib/openssl
> @@ -1 +1 @@
> -Subproject commit b2758a2292aceda93e9f44c219b94fe21bb9a650
> +Subproject commit d4e4bd2a8163f355fa8a3884077eaec7adc75ff7
> 

With the commit msg updates:

Reviewed-by: Laszlo Ersek <lersek@redhat.com>

I also tested this patch, with an off-disk Secure Boot, and an HTTPS
boot. Both worked fine.

Tested-by: Laszlo Ersek <lersek@redhat.com>

Thanks!
Laszlo

Re: [PATCH v2 2/2] CryptoPkg/OpensslLib: Update OpenSSL version to 1.1.0h

[Long, Qin]

Thanks, Laszlo!
Pushed these two fixes with updates by the commits:
a701ea0fe1d5178eb4fd2659d83461751cb9e7c9
b85b20fba42e25ff658ed1a470250d530c189027


Best Regards & Thanks,
LONG, Qin

From: Laszlo Ersek [mailto:lersek@redhat.com]
Sent: Saturday, April 14, 2018 4:08 AM
To: Long, Qin <qin.long@intel.com>; Ye, Ting <ting.ye@intel.com>
Cc: edk2-devel@lists.01.org
Subject: Re: [edk2] [PATCH v2 2/2] CryptoPkg/OpensslLib: Update OpenSSL version to 1.1.0h

On 04/12/18 05:08, Long Qin wrote:
> (https://bugzilla.tianocore.org/show_bug.cgi?id=927)
>
> (V2 Update:
>     Removing the wrong "--remote" option from git submodule update
>     command in this commit message. Thanks Leszlo's clarification
>     to correct this)

(1) "Laszlo", not "Leszlo" :)

Apology!. ☺


>
> Update OpenSSL version to 1.1.0h release (27-Mar-2018) to include the
> fix for CVE-2018-0739 issue (Handling of crafted recursive ASN.1
> structures can cause a stack overflow and resulting denial of service,
> Refer to https://www.openssl.org/news/secadv/20180327.txt for more
> information).
>
> Please note "git pull" will not update the submodule repository.
> use the following commend to make your existing submodule track this
> update:
>    $ git submodule update -–recursive

(2) OK, so this is a tricky one. The "--recursive" option starts with
two hyphen characters (ASCII 0x2D). However, the string above starts
with a hyphen (ASCII 0x2D) and then a unicode EN DASH codepoint
(U+2013). Please replace it with a normal hyphen.

More below:

>
> Cc: Laszlo Ersek <lersek@redhat.com<mailto:lersek@redhat.com>>
> Cc: Ye Ting <ting.ye@intel.com<mailto:ting.ye@intel.com>>
> Contributed-under: TianoCore Contribution Agreement 1.0
> Signed-off-by: Long Qin <qin.long@intel.com<mailto:qin.long@intel.com>>
> ---
>  CryptoPkg/Library/OpensslLib/openssl | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/CryptoPkg/Library/OpensslLib/openssl b/CryptoPkg/Library/OpensslLib/openssl
> index b2758a2292..d4e4bd2a81 160000
> --- a/CryptoPkg/Library/OpensslLib/openssl
> +++ b/CryptoPkg/Library/OpensslLib/openssl
> @@ -1 +1 @@
> -Subproject commit b2758a2292aceda93e9f44c219b94fe21bb9a650
> +Subproject commit d4e4bd2a8163f355fa8a3884077eaec7adc75ff7
>

With the commit msg updates:

Reviewed-by: Laszlo Ersek <lersek@redhat.com<mailto:lersek@redhat.com>>

I also tested this patch, with an off-disk Secure Boot, and an HTTPS
boot. Both worked fine.

Tested-by: Laszlo Ersek <lersek@redhat.com<mailto:lersek@redhat.com>>

Thanks!
Laszlo