OpenSSL used to provide their software downloads on openssl.org.
Now they use links to Github releases.
OpenSSL 1.1.1w is also available at Github, but with a small
difference in the URL scheme.
Signed-off-by: Markus Theil <theil.markus@gmail.com>
This changes openssl to use makeBinaryWrapper since makeWrapper uses
non-overridable runtimeShell that causes infinite recursion. That is,
fetchurl in pkgs/top-level/all-packages.nix is bootstrapped by
overriding dependencies to use stdenv.fetchurlBoot.
Changelog: https://github.com/openssl/openssl/blob/openssl-3.2/CHANGES.md#changes-between-321-and-322-4-jun-2024
CVEs fixed:
- Fixed potential use after free after SSL_free_buffers() is called.
(CVE-2024-4741)
- Fixed an issue where checking excessively long DSA keys or parameters may be very slow.
(CVE-2024-4603)
- Fixed an issue where some non-default TLS server configurations can cause unbounded memory
growth when processing TLSv1.3 sessions. An attacker may exploit certain server configurations
to trigger unbounded memory growth that would lead to a Denial of Service.
(CVE-2024-2511)
Signed-off-by: Markus Theil <theil.markus@gmail.com>
Changelog: https://github.com/openssl/openssl/blob/openssl-3.0/CHANGES.md#changes-between-3013-and-3014-4-jun-2024
CVEs fixed:
- Fixed potential use after free after SSL_free_buffers() is called.
(CVE-2024-4741)
- Fixed an issue where checking excessively long DSA keys or parameters may be very slow.
(CVE-2024-4603)
- Fixed an issue where some non-default TLS server configurations can cause unbounded
memory growth when processing TLSv1.3 sessions. An attacker may exploit certain
server configurations to trigger unbounded memory growth that would lead to a
Denial of Service.
(CVE-2024-2511)
Signed-off-by: Markus Theil <theil.markus@gmail.com>
OpenSSL 3.1 is the most recent release to develop against,
while OpenSSL 3.0 is a LTS release, most developers should
probably choose now (see:
https://github.com/openssl/openssl/issues/20722).
Add OpenSSL 3.1.1 in order to allow development against this
version with Nix.
Currently OpenSSL 3.0 and 3.1 are independent release lines.
Signed-off-by: Markus Theil <theil.markus@gmail.com>
Openssl assumes that CFLAGS contains all of the flags that will be
passed to the compiler. This assumption fails for nixpkgs due to
our cc-wrapper.
On mips platforms, openssl scans CFLAGS to see if the user passed a
-march flag; if not, it adds its own:
if ($target =~ /linux.*-mips/ && !$disabled{asm}
&& !grep { $_ =~ /-m(ips|arch=)/ } (@{$config{CFLAGS}})) {
# minimally required architecture flags for assembly modules
my $value;
$value = '-mips2' if ($target =~ /mips32/);
$value = '-mips3' if ($target =~ /mips64/);
unshift @{$config{cflags}}, $value;
unshift @{$config{cxxflags}}, $value if $config{CXX};
}
Unfortunately since nixpkgs adds `-march=` in the wrapper, rather
than the CFLAGS, openssl can't see it. The result is two
conflicting `-march=` flags and a build failure when the user has
customized `hostPlatform.gcc.arch`:
openssl-mips64el-unknown-linux-gnuabin32> mips64el-unknown-linux-gnuabin32-gcc -I. -Iinclude -Iapps/include -fPIC -pthread -mabi=n32 -mips3 -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DOPENSSL_PIC -DOPENSSLDIR="\"/nix/store/8kwvrgwdk56ml6sz5swr71fv9mv4592w-openssl-mips64el-unknown-linux-gnuabin32-3.0.9/etc/ssl\"" -DENGINESDIR="\"/nix/store/8kwvrgwdk56ml6sz5swr71fv9mv4592w-openssl-mips64el-unknown-linux-gnuabin32-3.0.9/lib/engines-3\"" -DMODULESDIR="\"/nix/store/8kwvrgwdk56ml6sz5swr71fv9mv4592w-openssl-mips64el-unknown-linux-gnuabin32-3.0.9/lib/ossl-modules\"" -DOPENSSL_BUILDING_OPENSSL -DNDEBUG -MMD -MF apps/lib/libapps-lib-engine.d.tmp -MT apps/lib/libapps-lib-engine.o -c -o apps/lib/libapps-lib-engine.o apps/lib/engine.c
cc1: error: '-mips3' conflicts with the other architecture options, which specify a mips64r2 processor
cc1: error: '-mips3' conflicts with the other architecture options, which specify a mips64r2 processor
make[1]: *** [Makefile:4254: apps/lib/libapps-lib-app_libctx.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make[1]: *** [Makefile:4262: apps/lib/libapps-lib-app_params.o] Error 1
make[1]: *** [Makefile:4270: apps/lib/libapps-lib-app_provider.o] Error 1
This commit defeats the perl code above by passing `CFLAGS=-march`
to openssl's `./Configure` script.
