[3.10] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-105174) (GH...

Upgrade builds to OpenSSL 1.1.1u.

This OpenSSL version addresses a pile if less-urgent CVEs since 1.1.1t.

The Mac/BuildScript/build-installer.py was already updated.

Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9.

Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting).

(cherry picked from commit ede89af).
(cherry picked from commit a5d2b546c1b0b73d0695b98838a3ddd497382999)
(cherry picked from commit f90d3f68db720bd6d0deda8cc0030339ccd43858)

Co-authored-by: Gregory P. Smith <greg@krypto.org>

diff --git a/.azure-pipelines/ci.yml b/.azure-pipelines/ci.yml
index 92f3f41a31ad0a039fcfd7abfece16eb7e2ecdac..56caf0bc5256fa7ced050161e650048209a1a261 100644 (file)
--- a/.azure-pipelines/ci.yml
+++ b/.azure-pipelines/ci.yml
@@ -57,7 +57,7 @@ jobs:
   variables:
     testRunTitle: '$(build.sourceBranchName)-linux'
     testRunPlatform: linux
-    openssl_version: 1.1.1t
+    openssl_version: 1.1.1u
 
   steps:
   - template: ./posix-steps.yml
@@ -83,7 +83,7 @@ jobs:
   variables:
     testRunTitle: '$(Build.SourceBranchName)-linux-coverage'
     testRunPlatform: linux-coverage
-    openssl_version: 1.1.1t
+    openssl_version: 1.1.1u
 
   steps:
   - template: ./posix-steps.yml

diff --git a/.azure-pipelines/pr.yml b/.azure-pipelines/pr.yml
index 654d32540c2a41c066a556a4ed700f6abcdd6b72..a882129ac4ecee5e492d8670dc01cbcb7aa4f93f 100644 (file)
--- a/.azure-pipelines/pr.yml
+++ b/.azure-pipelines/pr.yml
@@ -57,7 +57,7 @@ jobs:
   variables:
     testRunTitle: '$(system.pullRequest.TargetBranch)-linux'
     testRunPlatform: linux
-    openssl_version: 1.1.1t
+    openssl_version: 1.1.1u
 
   steps:
   - template: ./posix-steps.yml
@@ -83,7 +83,7 @@ jobs:
   variables:
     testRunTitle: '$(Build.SourceBranchName)-linux-coverage'
     testRunPlatform: linux-coverage
-    openssl_version: 1.1.1t
+    openssl_version: 1.1.1u
 
   steps:
   - template: ./posix-steps.yml

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 591df445bf166f47cea72ec540a406df47a759b4..f51a93e3112092afc3f402a599f53285fc7982a2 100644 (file)
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -203,7 +203,7 @@ jobs:
     needs: check_source
     if: needs.check_source.outputs.run_tests == 'true'
     env:
-      OPENSSL_VER: 1.1.1t
+      OPENSSL_VER: 1.1.1u
       PYTHONSTRICTEXTENSIONBUILD: 1
     steps:
     - uses: actions/checkout@v3
@@ -247,7 +247,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        openssl_ver: [1.1.1t, 3.0.8, 3.1.0-beta1]
+        openssl_ver: [1.1.1u, 3.0.9, 3.1.1]
     env:
       OPENSSL_VER: ${{ matrix.openssl_ver }}
       MULTISSL_DIR: ${{ github.workspace }}/multissl

diff --git a/Mac/BuildScript/build-installer.py b/Mac/BuildScript/build-installer.py
index 114cc1005d4d5c3373f6bc8f963b5af3b1341356..8f3353712f23135a8797c41f900373af84002a34 100755 (executable)
--- a/Mac/BuildScript/build-installer.py
+++ b/Mac/BuildScript/build-installer.py
@@ -246,9 +246,9 @@ def library_recipes():
 
     result.extend([
           dict(
-              name="OpenSSL 1.1.1t",
-              url="https://www.openssl.org/source/openssl-1.1.1t.tar.gz",
-              checksum='8dee9b24bdb1dcbf0c3d1e9b02fb8f6bf22165e807f45adeb7c9677536859d3b',
+              name="OpenSSL 1.1.1u",
+              url="https://www.openssl.org/source/openssl-1.1.1u.tar.gz",
+              checksum='e2f8d84b523eecd06c7be7626830370300fbcc15386bf5142d72758f6963ebc6',
               buildrecipe=build_universal_openssl,
               configure=None,
               install=None,

diff --git a/Misc/NEWS.d/next/Security/2023-06-01-03-24-58.gh-issue-103142.GLWDMX.rst b/Misc/NEWS.d/next/Security/2023-06-01-03-24-58.gh-issue-103142.GLWDMX.rst
new file mode 100644 (file)
index 0000000..7e08368
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2023-06-01-03-24-58.gh-issue-103142.GLWDMX.rst
@@ -0,0 +1,2 @@
+The version of OpenSSL used in our binary builds has been upgraded to 1.1.1u
+to address several CVEs.

diff --git a/Modules/_ssl_data_111.h b/Modules/_ssl_data_111.h
index 85a2f7ec1561ea8178d407015fe3577517a41a7d..093c786e6a26f61ff69da0bccdf14c623eba9359 100644 (file)
--- a/Modules/_ssl_data_111.h
+++ b/Modules/_ssl_data_111.h
@@ -1,4 +1,4 @@
-/* File generated by Tools/ssl/make_ssl_data.py *//* Generated on 2021-04-09T09:36:21.493286 */
+/* File generated by Tools/ssl/make_ssl_data.py *//* Generated on 2023-06-01T02:58:04.081473 */
 static struct py_ssl_library_code library_codes[] = {
 #ifdef ERR_LIB_ASN1
     {"ASN1", ERR_LIB_ASN1},
@@ -1375,6 +1375,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"UNSUPPORTED_COMPRESSION_ALGORITHM", 46, 151},
   #endif
+  #ifdef CMS_R_UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM
+    {"UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM", ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM},
+  #else
+    {"UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM", 46, 194},
+  #endif
   #ifdef CMS_R_UNSUPPORTED_CONTENT_TYPE
     {"UNSUPPORTED_CONTENT_TYPE", ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_TYPE},
   #else
@@ -4860,6 +4865,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"MISSING_PARAMETERS", 20, 290},
   #endif
+  #ifdef SSL_R_MISSING_PSK_KEX_MODES_EXTENSION
+    {"MISSING_PSK_KEX_MODES_EXTENSION", ERR_LIB_SSL, SSL_R_MISSING_PSK_KEX_MODES_EXTENSION},
+  #else
+    {"MISSING_PSK_KEX_MODES_EXTENSION", 20, 310},
+  #endif
   #ifdef SSL_R_MISSING_RSA_CERTIFICATE
     {"MISSING_RSA_CERTIFICATE", ERR_LIB_SSL, SSL_R_MISSING_RSA_CERTIFICATE},
   #else
@@ -5065,6 +5075,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"NULL_SSL_METHOD_PASSED", 20, 196},
   #endif
+  #ifdef SSL_R_OCSP_CALLBACK_FAILURE
+    {"OCSP_CALLBACK_FAILURE", ERR_LIB_SSL, SSL_R_OCSP_CALLBACK_FAILURE},
+  #else
+    {"OCSP_CALLBACK_FAILURE", 20, 294},
+  #endif
   #ifdef SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED
     {"OLD_SESSION_CIPHER_NOT_RETURNED", ERR_LIB_SSL, SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED},
   #else

diff --git a/Modules/_ssl_data_300.h b/Modules/_ssl_data_300.h
index 6be8b24ee1a02174cb69a8da9c15411aef71ed75..dc66731f6b6093ccab2a31f1bc137fe6569067e9 100644 (file)
--- a/Modules/_ssl_data_300.h
+++ b/Modules/_ssl_data_300.h
@@ -1,4 +1,4 @@
-/* File generated by Tools/ssl/make_ssl_data.py *//* Generated on 2021-04-09T09:44:43.288448 */
+/* File generated by Tools/ssl/make_ssl_data.py *//* Generated on 2023-06-01T03:03:52.163218 */
 static struct py_ssl_library_code library_codes[] = {
 #ifdef ERR_LIB_ASN1
     {"ASN1", ERR_LIB_ASN1},
@@ -1035,6 +1035,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"NO_INVERSE", 3, 108},
   #endif
+  #ifdef BN_R_NO_PRIME_CANDIDATE
+    {"NO_PRIME_CANDIDATE", ERR_LIB_BN, BN_R_NO_PRIME_CANDIDATE},
+  #else
+    {"NO_PRIME_CANDIDATE", 3, 121},
+  #endif
   #ifdef BN_R_NO_SOLUTION
     {"NO_SOLUTION", ERR_LIB_BN, BN_R_NO_SOLUTION},
   #else
@@ -1255,6 +1260,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"INVALID_OPTION", 58, 174},
   #endif
+  #ifdef CMP_R_MISSING_CERTID
+    {"MISSING_CERTID", ERR_LIB_CMP, CMP_R_MISSING_CERTID},
+  #else
+    {"MISSING_CERTID", 58, 165},
+  #endif
   #ifdef CMP_R_MISSING_KEY_INPUT_FOR_CREATING_PROTECTION
     {"MISSING_KEY_INPUT_FOR_CREATING_PROTECTION", ERR_LIB_CMP, CMP_R_MISSING_KEY_INPUT_FOR_CREATING_PROTECTION},
   #else
@@ -1280,21 +1290,41 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"MISSING_PRIVATE_KEY", 58, 131},
   #endif
+  #ifdef CMP_R_MISSING_PRIVATE_KEY_FOR_POPO
+    {"MISSING_PRIVATE_KEY_FOR_POPO", ERR_LIB_CMP, CMP_R_MISSING_PRIVATE_KEY_FOR_POPO},
+  #else
+    {"MISSING_PRIVATE_KEY_FOR_POPO", 58, 190},
+  #endif
   #ifdef CMP_R_MISSING_PROTECTION
     {"MISSING_PROTECTION", ERR_LIB_CMP, CMP_R_MISSING_PROTECTION},
   #else
     {"MISSING_PROTECTION", 58, 143},
   #endif
+  #ifdef CMP_R_MISSING_PUBLIC_KEY
+    {"MISSING_PUBLIC_KEY", ERR_LIB_CMP, CMP_R_MISSING_PUBLIC_KEY},
+  #else
+    {"MISSING_PUBLIC_KEY", 58, 183},
+  #endif
   #ifdef CMP_R_MISSING_REFERENCE_CERT
     {"MISSING_REFERENCE_CERT", ERR_LIB_CMP, CMP_R_MISSING_REFERENCE_CERT},
   #else
     {"MISSING_REFERENCE_CERT", 58, 168},
   #endif
+  #ifdef CMP_R_MISSING_SECRET
+    {"MISSING_SECRET", ERR_LIB_CMP, CMP_R_MISSING_SECRET},
+  #else
+    {"MISSING_SECRET", 58, 178},
+  #endif
   #ifdef CMP_R_MISSING_SENDER_IDENTIFICATION
     {"MISSING_SENDER_IDENTIFICATION", ERR_LIB_CMP, CMP_R_MISSING_SENDER_IDENTIFICATION},
   #else
     {"MISSING_SENDER_IDENTIFICATION", 58, 111},
   #endif
+  #ifdef CMP_R_MISSING_TRUST_ANCHOR
+    {"MISSING_TRUST_ANCHOR", ERR_LIB_CMP, CMP_R_MISSING_TRUST_ANCHOR},
+  #else
+    {"MISSING_TRUST_ANCHOR", 58, 179},
+  #endif
   #ifdef CMP_R_MISSING_TRUST_STORE
     {"MISSING_TRUST_STORE", ERR_LIB_CMP, CMP_R_MISSING_TRUST_STORE},
   #else
@@ -1455,6 +1485,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"WRONG_ALGORITHM_OID", 58, 138},
   #endif
+  #ifdef CMP_R_WRONG_CERTID
+    {"WRONG_CERTID", ERR_LIB_CMP, CMP_R_WRONG_CERTID},
+  #else
+    {"WRONG_CERTID", 58, 189},
+  #endif
   #ifdef CMP_R_WRONG_CERTID_IN_RP
     {"WRONG_CERTID_IN_RP", ERR_LIB_CMP, CMP_R_WRONG_CERTID_IN_RP},
   #else
@@ -1885,6 +1920,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"UNSUPPORTED_COMPRESSION_ALGORITHM", 46, 151},
   #endif
+  #ifdef CMS_R_UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM
+    {"UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM", ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM},
+  #else
+    {"UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM", 46, 194},
+  #endif
   #ifdef CMS_R_UNSUPPORTED_CONTENT_TYPE
     {"UNSUPPORTED_CONTENT_TYPE", ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_TYPE},
   #else
@@ -2045,6 +2085,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"RECURSIVE_DIRECTORY_INCLUDE", 14, 111},
   #endif
+  #ifdef CONF_R_RELATIVE_PATH
+    {"RELATIVE_PATH", ERR_LIB_CONF, CONF_R_RELATIVE_PATH},
+  #else
+    {"RELATIVE_PATH", 14, 125},
+  #endif
   #ifdef CONF_R_SSL_COMMAND_SECTION_EMPTY
     {"SSL_COMMAND_SECTION_EMPTY", ERR_LIB_CONF, CONF_R_SSL_COMMAND_SECTION_EMPTY},
   #else
@@ -2235,6 +2280,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"INSUFFICIENT_SECURE_DATA_SPACE", 15, 108},
   #endif
+  #ifdef CRYPTO_R_INVALID_NEGATIVE_VALUE
+    {"INVALID_NEGATIVE_VALUE", ERR_LIB_CRYPTO, CRYPTO_R_INVALID_NEGATIVE_VALUE},
+  #else
+    {"INVALID_NEGATIVE_VALUE", 15, 122},
+  #endif
   #ifdef CRYPTO_R_INVALID_NULL_ARGUMENT
     {"INVALID_NULL_ARGUMENT", ERR_LIB_CRYPTO, CRYPTO_R_INVALID_NULL_ARGUMENT},
   #else
@@ -2605,6 +2655,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"SEED_LEN_SMALL", 10, 110},
   #endif
+  #ifdef DSA_R_TOO_MANY_RETRIES
+    {"TOO_MANY_RETRIES", ERR_LIB_DSA, DSA_R_TOO_MANY_RETRIES},
+  #else
+    {"TOO_MANY_RETRIES", 10, 116},
+  #endif
   #ifdef DSO_R_CTRL_FAILED
     {"CTRL_FAILED", ERR_LIB_DSO, DSO_R_CTRL_FAILED},
   #else
@@ -2745,6 +2800,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"EC_GROUP_NEW_BY_NAME_FAILURE", 16, 119},
   #endif
+  #ifdef EC_R_EXPLICIT_PARAMS_NOT_SUPPORTED
+    {"EXPLICIT_PARAMS_NOT_SUPPORTED", ERR_LIB_EC, EC_R_EXPLICIT_PARAMS_NOT_SUPPORTED},
+  #else
+    {"EXPLICIT_PARAMS_NOT_SUPPORTED", 16, 127},
+  #endif
   #ifdef EC_R_FAILED_MAKING_PUBLIC_KEY
     {"FAILED_MAKING_PUBLIC_KEY", ERR_LIB_EC, EC_R_FAILED_MAKING_PUBLIC_KEY},
   #else
@@ -2850,6 +2910,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"INVALID_KEY", 16, 116},
   #endif
+  #ifdef EC_R_INVALID_LENGTH
+    {"INVALID_LENGTH", ERR_LIB_EC, EC_R_INVALID_LENGTH},
+  #else
+    {"INVALID_LENGTH", 16, 117},
+  #endif
   #ifdef EC_R_INVALID_NAMED_GROUP_CONVERSION
     {"INVALID_NAMED_GROUP_CONVERSION", ERR_LIB_EC, EC_R_INVALID_NAMED_GROUP_CONVERSION},
   #else
@@ -3010,6 +3075,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"SLOT_FULL", 16, 108},
   #endif
+  #ifdef EC_R_TOO_MANY_RETRIES
+    {"TOO_MANY_RETRIES", ERR_LIB_EC, EC_R_TOO_MANY_RETRIES},
+  #else
+    {"TOO_MANY_RETRIES", 16, 176},
+  #endif
   #ifdef EC_R_UNDEFINED_GENERATOR
     {"UNDEFINED_GENERATOR", ERR_LIB_EC, EC_R_UNDEFINED_GENERATOR},
   #else
@@ -3690,6 +3760,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"PUBLIC_KEY_NOT_RSA", 6, 106},
   #endif
+  #ifdef EVP_R_SETTING_XOF_FAILED
+    {"SETTING_XOF_FAILED", ERR_LIB_EVP, EVP_R_SETTING_XOF_FAILED},
+  #else
+    {"SETTING_XOF_FAILED", 6, 227},
+  #endif
   #ifdef EVP_R_SET_DEFAULT_PROPERTY_FAILURE
     {"SET_DEFAULT_PROPERTY_FAILURE", ERR_LIB_EVP, EVP_R_SET_DEFAULT_PROPERTY_FAILURE},
   #else
@@ -3865,6 +3940,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"FAILED_READING_DATA", 61, 128},
   #endif
+  #ifdef HTTP_R_HEADER_PARSE_ERROR
+    {"HEADER_PARSE_ERROR", ERR_LIB_HTTP, HTTP_R_HEADER_PARSE_ERROR},
+  #else
+    {"HEADER_PARSE_ERROR", 61, 126},
+  #endif
   #ifdef HTTP_R_INCONSISTENT_CONTENT_LENGTH
     {"INCONSISTENT_CONTENT_LENGTH", ERR_LIB_HTTP, HTTP_R_INCONSISTENT_CONTENT_LENGTH},
   #else
@@ -3935,6 +4015,16 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"RESPONSE_PARSE_ERROR", 61, 104},
   #endif
+  #ifdef HTTP_R_RETRY_TIMEOUT
+    {"RETRY_TIMEOUT", ERR_LIB_HTTP, HTTP_R_RETRY_TIMEOUT},
+  #else
+    {"RETRY_TIMEOUT", 61, 129},
+  #endif
+  #ifdef HTTP_R_SERVER_CANCELED_CONNECTION
+    {"SERVER_CANCELED_CONNECTION", ERR_LIB_HTTP, HTTP_R_SERVER_CANCELED_CONNECTION},
+  #else
+    {"SERVER_CANCELED_CONNECTION", 61, 127},
+  #endif
   #ifdef HTTP_R_SOCK_NOT_SUPPORTED
     {"SOCK_NOT_SUPPORTED", ERR_LIB_HTTP, HTTP_R_SOCK_NOT_SUPPORTED},
   #else
@@ -4100,6 +4190,16 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"UNSUPPORTED_REQUESTORNAME_TYPE", 39, 129},
   #endif
+  #ifdef OSSL_DECODER_R_COULD_NOT_DECODE_OBJECT
+    {"COULD_NOT_DECODE_OBJECT", ERR_LIB_OSSL_DECODER, OSSL_DECODER_R_COULD_NOT_DECODE_OBJECT},
+  #else
+    {"COULD_NOT_DECODE_OBJECT", 60, 101},
+  #endif
+  #ifdef OSSL_DECODER_R_DECODER_NOT_FOUND
+    {"DECODER_NOT_FOUND", ERR_LIB_OSSL_DECODER, OSSL_DECODER_R_DECODER_NOT_FOUND},
+  #else
+    {"DECODER_NOT_FOUND", 60, 102},
+  #endif
   #ifdef OSSL_DECODER_R_MISSING_GET_PARAMS
     {"MISSING_GET_PARAMS", ERR_LIB_OSSL_DECODER, OSSL_DECODER_R_MISSING_GET_PARAMS},
   #else
@@ -4190,6 +4290,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"NOT_PARAMETERS", 44, 104},
   #endif
+  #ifdef OSSL_STORE_R_NO_LOADERS_FOUND
+    {"NO_LOADERS_FOUND", ERR_LIB_OSSL_STORE, OSSL_STORE_R_NO_LOADERS_FOUND},
+  #else
+    {"NO_LOADERS_FOUND", 44, 123},
+  #endif
   #ifdef OSSL_STORE_R_PASSPHRASE_CALLBACK_ERROR
     {"PASSPHRASE_CALLBACK_ERROR", ERR_LIB_OSSL_STORE, OSSL_STORE_R_PASSPHRASE_CALLBACK_ERROR},
   #else
@@ -4935,6 +5040,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"INVALID_DIGEST_SIZE", 57, 218},
   #endif
+  #ifdef PROV_R_INVALID_INPUT_LENGTH
+    {"INVALID_INPUT_LENGTH", ERR_LIB_PROV, PROV_R_INVALID_INPUT_LENGTH},
+  #else
+    {"INVALID_INPUT_LENGTH", 57, 230},
+  #endif
   #ifdef PROV_R_INVALID_ITERATION_COUNT
     {"INVALID_ITERATION_COUNT", ERR_LIB_PROV, PROV_R_INVALID_ITERATION_COUNT},
   #else
@@ -4970,6 +5080,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"INVALID_MODE", 57, 125},
   #endif
+  #ifdef PROV_R_INVALID_OUTPUT_LENGTH
+    {"INVALID_OUTPUT_LENGTH", ERR_LIB_PROV, PROV_R_INVALID_OUTPUT_LENGTH},
+  #else
+    {"INVALID_OUTPUT_LENGTH", 57, 217},
+  #endif
   #ifdef PROV_R_INVALID_PADDING_MODE
     {"INVALID_PADDING_MODE", ERR_LIB_PROV, PROV_R_INVALID_PADDING_MODE},
   #else
@@ -5035,6 +5150,16 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"KEY_SIZE_TOO_SMALL", 57, 171},
   #endif
+  #ifdef PROV_R_LENGTH_TOO_LARGE
+    {"LENGTH_TOO_LARGE", ERR_LIB_PROV, PROV_R_LENGTH_TOO_LARGE},
+  #else
+    {"LENGTH_TOO_LARGE", 57, 202},
+  #endif
+  #ifdef PROV_R_MISMATCHING_DOMAIN_PARAMETERS
+    {"MISMATCHING_DOMAIN_PARAMETERS", ERR_LIB_PROV, PROV_R_MISMATCHING_DOMAIN_PARAMETERS},
+  #else
+    {"MISMATCHING_DOMAIN_PARAMETERS", 57, 203},
+  #endif
   #ifdef PROV_R_MISSING_CEK_ALG
     {"MISSING_CEK_ALG", ERR_LIB_PROV, PROV_R_MISSING_CEK_ALG},
   #else
@@ -5695,6 +5820,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"INVALID_LABEL", 4, 160},
   #endif
+  #ifdef RSA_R_INVALID_LENGTH
+    {"INVALID_LENGTH", ERR_LIB_RSA, RSA_R_INVALID_LENGTH},
+  #else
+    {"INVALID_LENGTH", 4, 181},
+  #endif
   #ifdef RSA_R_INVALID_MESSAGE_LENGTH
     {"INVALID_MESSAGE_LENGTH", ERR_LIB_RSA, RSA_R_INVALID_MESSAGE_LENGTH},
   #else
@@ -5880,6 +6010,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"Q_NOT_PRIME", 4, 129},
   #endif
+  #ifdef RSA_R_RANDOMNESS_SOURCE_STRENGTH_INSUFFICIENT
+    {"RANDOMNESS_SOURCE_STRENGTH_INSUFFICIENT", ERR_LIB_RSA, RSA_R_RANDOMNESS_SOURCE_STRENGTH_INSUFFICIENT},
+  #else
+    {"RANDOMNESS_SOURCE_STRENGTH_INSUFFICIENT", 4, 180},
+  #endif
   #ifdef RSA_R_RSA_OPERATIONS_NOT_SUPPORTED
     {"RSA_OPERATIONS_NOT_SUPPORTED", ERR_LIB_RSA, RSA_R_RSA_OPERATIONS_NOT_SUPPORTED},
   #else
@@ -6680,6 +6815,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"INVALID_TICKET_KEYS_LENGTH", 20, 325},
   #endif
+  #ifdef SSL_R_LEGACY_SIGALG_DISALLOWED_OR_UNSUPPORTED
+    {"LEGACY_SIGALG_DISALLOWED_OR_UNSUPPORTED", ERR_LIB_SSL, SSL_R_LEGACY_SIGALG_DISALLOWED_OR_UNSUPPORTED},
+  #else
+    {"LEGACY_SIGALG_DISALLOWED_OR_UNSUPPORTED", 20, 333},
+  #endif
   #ifdef SSL_R_LENGTH_MISMATCH
     {"LENGTH_MISMATCH", ERR_LIB_SSL, SSL_R_LENGTH_MISMATCH},
   #else
@@ -6725,6 +6865,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"MISSING_PARAMETERS", 20, 290},
   #endif
+  #ifdef SSL_R_MISSING_PSK_KEX_MODES_EXTENSION
+    {"MISSING_PSK_KEX_MODES_EXTENSION", ERR_LIB_SSL, SSL_R_MISSING_PSK_KEX_MODES_EXTENSION},
+  #else
+    {"MISSING_PSK_KEX_MODES_EXTENSION", 20, 310},
+  #endif
   #ifdef SSL_R_MISSING_RSA_CERTIFICATE
     {"MISSING_RSA_CERTIFICATE", ERR_LIB_SSL, SSL_R_MISSING_RSA_CERTIFICATE},
   #else
@@ -6940,6 +7085,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"NULL_SSL_METHOD_PASSED", 20, 196},
   #endif
+  #ifdef SSL_R_OCSP_CALLBACK_FAILURE
+    {"OCSP_CALLBACK_FAILURE", ERR_LIB_SSL, SSL_R_OCSP_CALLBACK_FAILURE},
+  #else
+    {"OCSP_CALLBACK_FAILURE", 20, 305},
+  #endif
   #ifdef SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED
     {"OLD_SESSION_CIPHER_NOT_RETURNED", ERR_LIB_SSL, SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED},
   #else

diff --git a/PCbuild/get_externals.bat b/PCbuild/get_externals.bat
index aee6471ea272925866566a5d38aeeea9de1678d4..34d6e2cd7919ea97bc297e459885f13e87dd4935 100644 (file)
--- a/PCbuild/get_externals.bat
+++ b/PCbuild/get_externals.bat
@@ -53,7 +53,7 @@ echo.Fetching external libraries...
 set libraries=
 set libraries=%libraries%                                       bzip2-1.0.8
 if NOT "%IncludeLibffiSrc%"=="false" set libraries=%libraries%  libffi-3.3.0
-if NOT "%IncludeSSLSrc%"=="false" set libraries=%libraries%     openssl-1.1.1t
+if NOT "%IncludeSSLSrc%"=="false" set libraries=%libraries%     openssl-1.1.1u
 set libraries=%libraries%                                       sqlite-3.40.1.0
 if NOT "%IncludeTkinterSrc%"=="false" set libraries=%libraries% tcl-core-8.6.12.0
 if NOT "%IncludeTkinterSrc%"=="false" set libraries=%libraries% tk-8.6.12.0
@@ -77,7 +77,7 @@ echo.Fetching external binaries...
 
 set binaries=
 if NOT "%IncludeLibffi%"=="false"  set binaries=%binaries% libffi-3.3.0
-if NOT "%IncludeSSL%"=="false"     set binaries=%binaries% openssl-bin-1.1.1t
+if NOT "%IncludeSSL%"=="false"     set binaries=%binaries% openssl-bin-1.1.1u
 if NOT "%IncludeTkinter%"=="false" set binaries=%binaries% tcltk-8.6.12.0
 if NOT "%IncludeSSLSrc%"=="false"  set binaries=%binaries% nasm-2.11.06
 

diff --git a/PCbuild/python.props b/PCbuild/python.props
index c93f25261e73e6da899cd32fcae33137521c99f1..33d5f8fb7a5964f1b8317ce90e5dcffe540bdea5 100644 (file)
--- a/PCbuild/python.props
+++ b/PCbuild/python.props
@@ -70,8 +70,8 @@
     <libffiDir Condition="$(libffiDir) == ''">$(ExternalsDir)libffi-3.3.0\</libffiDir>
     <libffiOutDir Condition="$(libffiOutDir) == ''">$(libffiDir)$(ArchName)\</libffiOutDir>
     <libffiIncludeDir Condition="$(libffiIncludeDir) == ''">$(libffiOutDir)include</libffiIncludeDir>
-    <opensslDir Condition="$(opensslDir) == ''">$(ExternalsDir)openssl-1.1.1t\</opensslDir>
-    <opensslOutDir Condition="$(opensslOutDir) == ''">$(ExternalsDir)openssl-bin-1.1.1t\$(ArchName)\</opensslOutDir>
+    <opensslDir Condition="$(opensslDir) == ''">$(ExternalsDir)openssl-1.1.1u\</opensslDir>
+    <opensslOutDir Condition="$(opensslOutDir) == ''">$(ExternalsDir)openssl-bin-1.1.1u\$(ArchName)\</opensslOutDir>
     <opensslIncludeDir Condition="$(opensslIncludeDir) == ''">$(opensslOutDir)include</opensslIncludeDir>
     <nasmDir Condition="$(nasmDir) == ''">$(ExternalsDir)\nasm-2.11.06\</nasmDir>
     <zlibDir Condition="$(zlibDir) == ''">$(ExternalsDir)\zlib-1.2.13\</zlibDir>

diff --git a/PCbuild/readme.txt b/PCbuild/readme.txt
index 3dcd5bb7f327b8f0cb86d180e76f472a05156d7a..43f56851bc90d727fa56a0c762d6cf2b3ad66ef9 100644 (file)
--- a/PCbuild/readme.txt
+++ b/PCbuild/readme.txt
@@ -167,7 +167,7 @@ _lzma
     Homepage:
         https://tukaani.org/xz/
 _ssl
-    Python wrapper for version 1.1.1t of the OpenSSL secure sockets
+    Python wrapper for version 1.1.1u of the OpenSSL secure sockets
     library, which is downloaded from our binaries repository at
     https://github.com/python/cpython-bin-deps.
 

diff --git a/Tools/ssl/multissltests.py b/Tools/ssl/multissltests.py
index 27e9032395fd24c090e5759079e171ba0fc1b720..c15405b704cea27efc6ff3520d4aa28cfa617782 100755 (executable)
--- a/Tools/ssl/multissltests.py
+++ b/Tools/ssl/multissltests.py
@@ -47,8 +47,9 @@ OPENSSL_OLD_VERSIONS = [
 ]
 
 OPENSSL_RECENT_VERSIONS = [
-    "1.1.1t",
-    "3.0.8"
+    "1.1.1u",
+    "3.0.9",
+    "3.1.1",
 ]
 
 LIBRESSL_OLD_VERSIONS = [