Upgrade OpenSSL to 1.1.0j

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1393

BZ#1089 (https://bugzilla.tianocore.org/show_bug.cgi?id=1089) requests
to upgrade the OpenSSL to the latest 1.1.1 release. Since OpenSSL-1.1.1
has many changes, more porting efforts and feature evaluation are needed.
This might lead to a situation that it cannot catch the Q1'19 stable tag.

One of the solution is upgrade current version (1.1.0h) to 1.1.0j.
According to following web page in openssl.org, all security issues
solved in 1.1.1 have been also back-ported to 1.1.0.j. This can make
sure that no security vulnerabilities left in edk2 master before 1.1.1.

https://www.openssl.org/news/vulnerabilities-1.1.1.html

Cc: Ting Ye <ting.ye@intel.com>
Cc: Gang Wei <gang.wei@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Jian J Wang <jian.j.wang@intel.com>
Reviewed-by: Gang Wei <gang.wei@intel.com>
Reviewed-by: Ting Ye <ting.ye@intel.com>

diff --git a/CryptoPkg/CryptoPkg.dsc b/CryptoPkg/CryptoPkg.dsc
index a0334d628b31658b8173961184542b965270a28c..321abe4d4c22026a0adae12b64593acbed499020 100644 (file)
--- a/CryptoPkg/CryptoPkg.dsc
+++ b/CryptoPkg/CryptoPkg.dsc
@@ -121,6 +121,7 @@
   CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf\r
   CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf\r
   CryptoPkg/Library/TlsLib/TlsLib.inf\r
   CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf\r
   CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf\r
   CryptoPkg/Library/TlsLib/TlsLib.inf\r

+  CryptoPkg/Library/OpensslLib/OpensslLib.inf\r

 \r
 [Components.IA32, Components.X64]\r
   CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf\r
 \r
 [Components.IA32, Components.X64]\r
   CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf\r

diff --git a/CryptoPkg/Library/Include/openssl/opensslconf.h b/CryptoPkg/Library/Include/openssl/opensslconf.h
index 1917d7ab24c5e6ed8e25130fb287605e62185e1e..28dd9ab93c613f7469df979d97ea267dd6ba8473 100644 (file)
--- a/CryptoPkg/Library/Include/openssl/opensslconf.h
+++ b/CryptoPkg/Library/Include/openssl/opensslconf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated from include/openssl/opensslconf.h.in
  *
  * WARNING: do not edit!
  * Generated from include/openssl/opensslconf.h.in
  *

- * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.

  *
  * Licensed under the OpenSSL license (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
  *
  * Licensed under the OpenSSL license (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy


@@ -235,12 +235,18 @@ extern "C" {
  * still won't see them if the library has been built to disable deprecated
  * functions.
  */
  * still won't see them if the library has been built to disable deprecated
  * functions.
  */

-#if defined(OPENSSL_NO_DEPRECATED)
-# define DECLARE_DEPRECATED(f)
-#elif __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ > 0)
-# define DECLARE_DEPRECATED(f)    f __attribute__ ((deprecated));
-#else
-# define DECLARE_DEPRECATED(f)   f;
+#ifndef DECLARE_DEPRECATED
+# if defined(OPENSSL_NO_DEPRECATED)
+#  define DECLARE_DEPRECATED(f)
+# else
+#  define DECLARE_DEPRECATED(f)   f;
+#  ifdef __GNUC__
+#   if __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ > 0)
+#    undef DECLARE_DEPRECATED
+#    define DECLARE_DEPRECATED(f)    f __attribute__ ((deprecated));
+#   endif
+#  endif
+# endif

 #endif
 
 #ifndef OPENSSL_FILE
 #endif
 
 #ifndef OPENSSL_FILE

diff --git a/CryptoPkg/Library/OpensslLib/OpensslLib.inf b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
index 0300856cf292183a8d89249a15cc2319efa8501a..6162d291434aa731dc4c33a9892bdce9b3f00216 100644 (file)
--- a/CryptoPkg/Library/OpensslLib/OpensslLib.inf
+++ b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
@@ -175,6 +175,7 @@
   $(OPENSSL_PATH)/crypto/conf/conf_mall.c\r
   $(OPENSSL_PATH)/crypto/conf/conf_mod.c\r
   $(OPENSSL_PATH)/crypto/conf/conf_sap.c\r
   $(OPENSSL_PATH)/crypto/conf/conf_mall.c\r
   $(OPENSSL_PATH)/crypto/conf/conf_mod.c\r
   $(OPENSSL_PATH)/crypto/conf/conf_sap.c\r

+  $(OPENSSL_PATH)/crypto/conf/conf_ssl.c\r

   $(OPENSSL_PATH)/crypto/cpt_err.c\r
   $(OPENSSL_PATH)/crypto/cryptlib.c\r
   $(OPENSSL_PATH)/crypto/cversion.c\r
   $(OPENSSL_PATH)/crypto/cpt_err.c\r
   $(OPENSSL_PATH)/crypto/cryptlib.c\r
   $(OPENSSL_PATH)/crypto/cversion.c\r


@@ -281,6 +282,7 @@
   $(OPENSSL_PATH)/crypto/evp/pmeth_lib.c\r
   $(OPENSSL_PATH)/crypto/evp/scrypt.c\r
   $(OPENSSL_PATH)/crypto/ex_data.c\r
   $(OPENSSL_PATH)/crypto/evp/pmeth_lib.c\r
   $(OPENSSL_PATH)/crypto/evp/scrypt.c\r
   $(OPENSSL_PATH)/crypto/ex_data.c\r

+  $(OPENSSL_PATH)/crypto/getenv.c\r

   $(OPENSSL_PATH)/crypto/hmac/hm_ameth.c\r
   $(OPENSSL_PATH)/crypto/hmac/hm_pmeth.c\r
   $(OPENSSL_PATH)/crypto/hmac/hmac.c\r
   $(OPENSSL_PATH)/crypto/hmac/hm_ameth.c\r
   $(OPENSSL_PATH)/crypto/hmac/hm_pmeth.c\r
   $(OPENSSL_PATH)/crypto/hmac/hmac.c\r


@@ -418,6 +420,7 @@
   $(OPENSSL_PATH)/crypto/x509/x509_err.c\r
   $(OPENSSL_PATH)/crypto/x509/x509_ext.c\r
   $(OPENSSL_PATH)/crypto/x509/x509_lu.c\r
   $(OPENSSL_PATH)/crypto/x509/x509_err.c\r
   $(OPENSSL_PATH)/crypto/x509/x509_ext.c\r
   $(OPENSSL_PATH)/crypto/x509/x509_lu.c\r

+  $(OPENSSL_PATH)/crypto/x509/x509_meth.c\r

   $(OPENSSL_PATH)/crypto/x509/x509_obj.c\r
   $(OPENSSL_PATH)/crypto/x509/x509_r2x.c\r
   $(OPENSSL_PATH)/crypto/x509/x509_req.c\r
   $(OPENSSL_PATH)/crypto/x509/x509_obj.c\r
   $(OPENSSL_PATH)/crypto/x509/x509_r2x.c\r
   $(OPENSSL_PATH)/crypto/x509/x509_req.c\r

diff --git a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
index 23be4e1e1420cf985fa3d7e408d74544f3894f40..b04bf62b4e9993a7c968055a6fa81cf37137d36a 100644 (file)
--- a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
+++ b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
@@ -175,6 +175,7 @@
   $(OPENSSL_PATH)/crypto/conf/conf_mall.c\r
   $(OPENSSL_PATH)/crypto/conf/conf_mod.c\r
   $(OPENSSL_PATH)/crypto/conf/conf_sap.c\r
   $(OPENSSL_PATH)/crypto/conf/conf_mall.c\r
   $(OPENSSL_PATH)/crypto/conf/conf_mod.c\r
   $(OPENSSL_PATH)/crypto/conf/conf_sap.c\r

+  $(OPENSSL_PATH)/crypto/conf/conf_ssl.c\r

   $(OPENSSL_PATH)/crypto/cpt_err.c\r
   $(OPENSSL_PATH)/crypto/cryptlib.c\r
   $(OPENSSL_PATH)/crypto/cversion.c\r
   $(OPENSSL_PATH)/crypto/cpt_err.c\r
   $(OPENSSL_PATH)/crypto/cryptlib.c\r
   $(OPENSSL_PATH)/crypto/cversion.c\r


@@ -281,6 +282,7 @@
   $(OPENSSL_PATH)/crypto/evp/pmeth_lib.c\r
   $(OPENSSL_PATH)/crypto/evp/scrypt.c\r
   $(OPENSSL_PATH)/crypto/ex_data.c\r
   $(OPENSSL_PATH)/crypto/evp/pmeth_lib.c\r
   $(OPENSSL_PATH)/crypto/evp/scrypt.c\r
   $(OPENSSL_PATH)/crypto/ex_data.c\r

+  $(OPENSSL_PATH)/crypto/getenv.c\r

   $(OPENSSL_PATH)/crypto/hmac/hm_ameth.c\r
   $(OPENSSL_PATH)/crypto/hmac/hm_pmeth.c\r
   $(OPENSSL_PATH)/crypto/hmac/hmac.c\r
   $(OPENSSL_PATH)/crypto/hmac/hm_ameth.c\r
   $(OPENSSL_PATH)/crypto/hmac/hm_pmeth.c\r
   $(OPENSSL_PATH)/crypto/hmac/hmac.c\r


@@ -418,6 +420,7 @@
   $(OPENSSL_PATH)/crypto/x509/x509_err.c\r
   $(OPENSSL_PATH)/crypto/x509/x509_ext.c\r
   $(OPENSSL_PATH)/crypto/x509/x509_lu.c\r
   $(OPENSSL_PATH)/crypto/x509/x509_err.c\r
   $(OPENSSL_PATH)/crypto/x509/x509_ext.c\r
   $(OPENSSL_PATH)/crypto/x509/x509_lu.c\r

+  $(OPENSSL_PATH)/crypto/x509/x509_meth.c\r

   $(OPENSSL_PATH)/crypto/x509/x509_obj.c\r
   $(OPENSSL_PATH)/crypto/x509/x509_r2x.c\r
   $(OPENSSL_PATH)/crypto/x509/x509_req.c\r
   $(OPENSSL_PATH)/crypto/x509/x509_obj.c\r
   $(OPENSSL_PATH)/crypto/x509/x509_r2x.c\r
   $(OPENSSL_PATH)/crypto/x509/x509_req.c\r

diff --git a/CryptoPkg/Library/OpensslLib/openssl b/CryptoPkg/Library/OpensslLib/openssl
index d4e4bd2a8163f355fa8a3884077eaec7adc75ff7..74f2d9c1ec5f5510e1d3da5a9f03c28df0977762 160000 (submodule)
--- a/CryptoPkg/Library/OpensslLib/openssl
+++ b/CryptoPkg/Library/OpensslLib/openssl
@@ -1 +1 @@
-Subproject commit d4e4bd2a8163f355fa8a3884077eaec7adc75ff7
+Subproject commit 74f2d9c1ec5f5510e1d3da5a9f03c28df0977762

diff --git a/CryptoPkg/Library/OpensslLib/process_files.pl b/CryptoPkg/Library/OpensslLib/process_files.pl
old mode 100644 (file)
new mode 100755 (executable)