Latest update - v3.0.0

sunrash · May 2, 2019 · b842b7a · b842b7a
1 parent fe74be9
commit b842b7a
Show file tree

Hide file tree

Showing 4 changed files with 58 additions and 58 deletions.
diff --git a/README.md b/README.md
@@ -30,7 +30,7 @@ Default support is in bold type.
 - [Google(Gmail)](https://gmail.com/) : _TLSv1.3_ **final**
 - [NSS TLS 1.3(Mozilla)](https://tls13.crypto.mozilla.org/) : _TLSv1.3_ **final**
 
-[Compatible OpenSSL-3.0.0-dev (OpenSSL, 23705 commits)](https://github.com/openssl/openssl/tree/ee215c7eea91f193d4765127eb31332758753058)
+[Compatible OpenSSL-3.0.0-dev (OpenSSL, 23791 commits)](https://github.com/openssl/openssl/tree/e8fb288cc5057bb198a7f1c6e46f3b64b5d7a476)
 
 ## Patch files
 

diff --git a/openssl-3.0.0-dev-chacha_draft.patch b/openssl-3.0.0-dev-chacha_draft.patch
@@ -11,7 +11,7 @@ index a97eaa1685..24112723f0 100644
  #endif
  }
 diff --git a/crypto/evp/e_chacha20_poly1305.c b/crypto/evp/e_chacha20_poly1305.c
-index 37902000a0..6c9078321a 100644
+index ccef031b89..083179398c 100644
 --- a/crypto/evp/e_chacha20_poly1305.c
 +++ b/crypto/evp/e_chacha20_poly1305.c
 @@ -156,6 +156,7 @@ typedef struct {
@@ -291,10 +291,10 @@ index 2240916ff4..2a61f1a23a 100644
 
  ISO-US 10046 2 1	: dhpublicnumber		: X9.42 DH
 diff --git a/include/openssl/evp.h b/include/openssl/evp.h
-index a903b29ffe..059a38eb2e 100644
+index 6fc0f35114..c26c6d0182 100644
 --- a/include/openssl/evp.h
 +++ b/include/openssl/evp.h
-@@ -930,6 +930,7 @@ const EVP_CIPHER *EVP_camellia_256_ctr(void);
+@@ -933,6 +933,7 @@ const EVP_CIPHER *EVP_camellia_256_ctr(void);
  const EVP_CIPHER *EVP_chacha20(void);
  #  ifndef OPENSSL_NO_POLY1305
  const EVP_CIPHER *EVP_chacha20_poly1305(void);
@@ -372,7 +372,7 @@ index 4db2b6a0db..5b07fb3cba 100644
  # define TLS1_TXT_ECDHE_ECDSA_WITH_CHACHA20_POLY1305       "ECDHE-ECDSA-CHACHA20-POLY1305"
  # define TLS1_TXT_DHE_RSA_WITH_CHACHA20_POLY1305           "DHE-RSA-CHACHA20-POLY1305"
 diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
-index 330b9e3f0c..fc6889acae 100644
+index 4ed9894d52..64a0759274 100644
 --- a/ssl/s3_lib.c
 +++ b/ssl/s3_lib.c
 @@ -2083,6 +2083,54 @@ static SSL_CIPHER ssl3_ciphers[] = {
@@ -480,7 +480,7 @@ index 5aa04dbd53..8b2b7e7b36 100644
      } else if (c->algorithm_mac & SSL_AEAD) {
          /* We're supposed to have handled all the AEAD modes above */
 diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
-index a5df3cfb7f..a049c7653a 100644
+index 4a72864980..5da1a0f0c0 100644
 --- a/ssl/ssl_locl.h
 +++ b/ssl/ssl_locl.h
 @@ -234,12 +234,13 @@
@@ -499,11 +499,11 @@ index a5df3cfb7f..a049c7653a 100644
  # define SSL_ARIA                (SSL_ARIAGCM)
 
 diff --git a/util/libcrypto.num b/util/libcrypto.num
-index 9569bf43f3..6cc9ce933c 100644
+index 8259ddbb5e..1869da0de5 100644
 --- a/util/libcrypto.num
 +++ b/util/libcrypto.num
-@@ -4795,3 +4795,4 @@ EVP_MD_upref                            4742	3_0_0	EXIST::FUNCTION:
- EVP_MD_fetch                            4743	3_0_0	EXIST::FUNCTION:
- EVP_set_default_properties              4744	3_0_0	EXIST::FUNCTION:
- OSSL_PARAM_construct_end                4745	3_0_0	EXIST::FUNCTION:
-+EVP_chacha20_poly1305_draft             4746	3_0_0	EXIST::FUNCTION:CHACHA,POLY1305
+@@ -4800,3 +4800,4 @@ EVP_CIPHER_upref                        4747	3_0_0	EXIST::FUNCTION:
+ EVP_CIPHER_fetch                        4748	3_0_0	EXIST::FUNCTION:
+ EVP_CIPHER_mode                         4749	3_0_0	EXIST::FUNCTION:
+ OPENSSL_info                            4750	3_0_0	EXIST::FUNCTION:
++EVP_chacha20_poly1305_draft             4751	3_0_0	EXIST::FUNCTION:CHACHA,POLY1305
diff --git a/openssl-equal-3.0.0-dev.patch b/openssl-equal-3.0.0-dev.patch
@@ -1,8 +1,8 @@
 diff --git a/crypto/err/openssl.txt b/crypto/err/openssl.txt
-index a3d15c9a5f..86aa9acdb7 100644
+index 5c444f5ba7..fba529cfff 100644
 --- a/crypto/err/openssl.txt
 +++ b/crypto/err/openssl.txt
-@@ -2892,6 +2892,8 @@ SSL_R_MISSING_TMP_DH_KEY:171:missing tmp dh key
+@@ -2922,6 +2922,8 @@ SSL_R_MISSING_TMP_DH_KEY:171:missing tmp dh key
  SSL_R_MISSING_TMP_ECDH_KEY:311:missing tmp ecdh key
  SSL_R_MIXED_HANDSHAKE_AND_NON_HANDSHAKE_DATA:293:\
  	mixed handshake and non handshake data
@@ -11,7 +11,7 @@ index a3d15c9a5f..86aa9acdb7 100644
  SSL_R_NOT_ON_RECORD_BOUNDARY:182:not on record boundary
  SSL_R_NOT_REPLACING_CERTIFICATE:289:not replacing certificate
  SSL_R_NOT_SERVER:284:not server
-@@ -2998,7 +3000,9 @@ SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES:242:unable to load ssl3 md5 routines
+@@ -3028,7 +3030,9 @@ SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES:242:unable to load ssl3 md5 routines
  SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES:243:unable to load ssl3 sha1 routines
  SSL_R_UNEXPECTED_CCS_MESSAGE:262:unexpected ccs message
  SSL_R_UNEXPECTED_END_OF_EARLY_DATA:178:unexpected end of early data
@@ -71,7 +71,7 @@ index 7f776f97f7..bef78d6c2c 100644
  # define SSL_R_UNINITIALIZED                              276
  # define SSL_R_UNKNOWN_ALERT_TYPE                         246
 diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
-index 330b9e3f0c..a2b2a85bab 100644
+index 4ed9894d52..a12372354a 100644
 --- a/ssl/s3_lib.c
 +++ b/ssl/s3_lib.c
 @@ -168,7 +168,7 @@ static SSL_CIPHER ssl3_ciphers[] = {
@@ -101,7 +101,7 @@ index 330b9e3f0c..a2b2a85bab 100644
       DTLS1_BAD_VER, DTLS1_2_VERSION,
       SSL_HIGH | SSL_FIPS,
       SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
-@@ -4118,6 +4118,17 @@ int ssl3_put_cipher_by_char(const SSL_CIPHER *c, WPACKET *pkt, size_t *len)
+@@ -4112,6 +4112,17 @@ int ssl3_put_cipher_by_char(const SSL_CIPHER *c, WPACKET *pkt, size_t *len)
      return 1;
  }
 
@@ -119,7 +119,7 @@ index 330b9e3f0c..a2b2a85bab 100644
  /*
   * ssl3_choose_cipher - choose a cipher from those offered by the client
   * @s: SSL connection
-@@ -4127,16 +4138,24 @@ int ssl3_put_cipher_by_char(const SSL_CIPHER *c, WPACKET *pkt, size_t *len)
+@@ -4121,16 +4132,24 @@ int ssl3_put_cipher_by_char(const SSL_CIPHER *c, WPACKET *pkt, size_t *len)
   * Returns the selected cipher or NULL when no common ciphers.
   */
  const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
@@ -150,7 +150,7 @@ index 330b9e3f0c..a2b2a85bab 100644
 
      /* Let's see which ciphers we can support */
 
-@@ -4163,54 +4182,13 @@ const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
+@@ -4157,54 +4176,13 @@ const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
      } OSSL_TRACE_END(TLS_CIPHER);
 
      /* SUITE-B takes precedence over server preference and ChaCha priortiy */
@@ -208,7 +208,7 @@ index 330b9e3f0c..a2b2a85bab 100644
          allow = srvr;
      }
 
-@@ -4241,14 +4219,16 @@ const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
+@@ -4235,14 +4213,16 @@ const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
      for (i = 0; i < sk_SSL_CIPHER_num(prio); i++) {
          c = sk_SSL_CIPHER_value(prio, i);
 
@@ -227,7 +227,7 @@ index 330b9e3f0c..a2b2a85bab 100644
 
          /*
           * Since TLS 1.3 ciphersuites can be used with any auth or
-@@ -4270,10 +4250,10 @@ const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
+@@ -4264,10 +4244,10 @@ const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
  #ifndef OPENSSL_NO_PSK
              /* with PSK there must be server callback set */
              if ((alg_k & SSL_PSK) && s->psk_server_callback == NULL)
@@ -240,28 +240,28 @@ index 330b9e3f0c..a2b2a85bab 100644
              OSSL_TRACE7(TLS_CIPHER,
                          "%d:[%08lX:%08lX:%08lX:%08lX]%p:%s\n",
                          ok, alg_k, alg_a, mask_k, mask_a, (void *)c, c->name);
-@@ -4289,6 +4269,14 @@ const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
+@@ -4283,6 +4263,14 @@ const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
 
              if (!ok)
                  continue;
 +
 +            safari_ec = 0;
 +#if !defined(OPENSSL_NO_EC)
 +            if ((alg_k & SSL_kECDHE) && (alg_a & SSL_aECDSA)) {
-+                if (s->s3->is_probably_safari)
++                if (s->s3.is_probably_safari)
 +                    safari_ec = 1;
 +            }
 +#endif
          }
          ii = sk_SSL_CIPHER_find(allow, c);
          if (ii >= 0) {
-@@ -4296,14 +4284,7 @@ const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
+@@ -4290,14 +4278,7 @@ const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
              if (!ssl_security(s, SSL_SECOP_CIPHER_SHARED,
                                c->strength_bits, 0, (void *)c))
                  continue;
 -#if !defined(OPENSSL_NO_EC)
 -            if ((alg_k & SSL_kECDHE) && (alg_a & SSL_aECDSA)
--                && s->s3->is_probably_safari) {
+-                && s->s3.is_probably_safari) {
 -                if (!ret)
 -                    ret = sk_SSL_CIPHER_value(allow, ii);
 -                continue;
@@ -271,7 +271,7 @@ index 330b9e3f0c..a2b2a85bab 100644
              if (prefer_sha256) {
                  const SSL_CIPHER *tmp = sk_SSL_CIPHER_value(allow, ii);
 
-@@ -4315,13 +4296,38 @@ const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
+@@ -4309,13 +4290,38 @@ const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
                      ret = tmp;
                  continue;
              }
@@ -789,7 +789,7 @@ index afe1b58214..f38ac1558c 100644
      {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_UNINITIALIZED), "uninitialized"},
      {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_UNKNOWN_ALERT_TYPE), "unknown alert type"},
 diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
-index f63e16b592..8f462b7108 100644
+index 89a410057b..88a037e6c4 100644
 --- a/ssl/ssl_lib.c
 +++ b/ssl/ssl_lib.c
 @@ -1120,6 +1120,71 @@ int SSL_set1_param(SSL *ssl, X509_VERIFY_PARAM *vpm)
@@ -874,7 +874,7 @@ index f63e16b592..8f462b7108 100644
      sk_SSL_CIPHER_free(s->cipher_list_by_id);
      sk_SSL_CIPHER_free(s->tls13_ciphersuites);
 
-@@ -2499,9 +2565,9 @@ STACK_OF(SSL_CIPHER) *SSL_get_ciphers(const SSL *s)
+@@ -2492,9 +2558,9 @@ STACK_OF(SSL_CIPHER) *SSL_get_ciphers(const SSL *s)
  {
      if (s != NULL) {
          if (s->cipher_list != NULL) {
@@ -886,7 +886,7 @@ index f63e16b592..8f462b7108 100644
          }
      }
      return NULL;
-@@ -2575,8 +2641,8 @@ const char *SSL_get_cipher_list(const SSL *s, int n)
+@@ -2568,8 +2634,8 @@ const char *SSL_get_cipher_list(const SSL *s, int n)
   * preference */
  STACK_OF(SSL_CIPHER) *SSL_CTX_get_ciphers(const SSL_CTX *ctx)
  {
@@ -897,7 +897,7 @@ index f63e16b592..8f462b7108 100644
      return NULL;
  }
 
-@@ -3027,7 +3093,7 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)
+@@ -3018,7 +3084,7 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)
                                  ret->tls13_ciphersuites,
                                  &ret->cipher_list, &ret->cipher_list_by_id,
                                  SSL_DEFAULT_CIPHER_LIST, ret->cert)
@@ -906,7 +906,7 @@ index f63e16b592..8f462b7108 100644
          SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_LIBRARY_HAS_NO_CIPHERS);
          goto err2;
      }
-@@ -3203,7 +3269,7 @@ void SSL_CTX_free(SSL_CTX *a)
+@@ -3194,7 +3260,7 @@ void SSL_CTX_free(SSL_CTX *a)
  #ifndef OPENSSL_NO_CT
      CTLOG_STORE_free(a->ctlog_store);
  #endif
@@ -915,7 +915,7 @@ index f63e16b592..8f462b7108 100644
      sk_SSL_CIPHER_free(a->cipher_list_by_id);
      sk_SSL_CIPHER_free(a->tls13_ciphersuites);
      ssl_cert_free(a->cert);
-@@ -3879,13 +3945,15 @@ SSL *SSL_dup(SSL *s)
+@@ -3870,13 +3936,15 @@ SSL *SSL_dup(SSL *s)
 
      /* dup the cipher_list and cipher_list_by_id stacks */
      if (s->cipher_list != NULL) {
@@ -936,7 +936,7 @@ index f63e16b592..8f462b7108 100644
      /* Dup the client_CA list */
      if (!dup_ca_names(&ret->ca_names, s->ca_names)
 diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
-index a5df3cfb7f..ac455639ea 100644
+index 4a72864980..20954aea62 100644
 --- a/ssl/ssl_locl.h
 +++ b/ssl/ssl_locl.h
 @@ -744,9 +744,46 @@ typedef struct ssl_ctx_ext_secure_st {
@@ -987,7 +987,7 @@ index a5df3cfb7f..ac455639ea 100644
      /* same as above but sorted for lookup */
      STACK_OF(SSL_CIPHER) *cipher_list_by_id;
      /* TLSv1.3 specific ciphersuites */
-@@ -1145,7 +1182,7 @@ struct ssl_st {
+@@ -1319,7 +1356,7 @@ struct ssl_st {
      /* Per connection DANE state */
      SSL_DANE dane;
      /* crypto */
@@ -1029,7 +1029,7 @@ index a5df3cfb7f..ac455639ea 100644
  __owur int ssl3_new(SSL *s);
  void ssl3_free(SSL *s);
 diff --git a/ssl/statem/statem_srvr.c b/ssl/statem/statem_srvr.c
-index 781efd236e..4ce62feed7 100644
+index fe495a3a68..cdfbfbd52b 100644
 --- a/ssl/statem/statem_srvr.c
 +++ b/ssl/statem/statem_srvr.c
 @@ -1755,7 +1755,7 @@ static int tls_early_post_process_client_hello(SSL *s)