Skip to content

Commit 5111afd

Browse files
BillyONealBillyONeal
authored
[openssl] Don't set openssldir to a potentially-world-writable location. (#50518)
1 parent a621075 commit 5111afd

5 files changed

Lines changed: 74 additions & 40 deletions

File tree

‎ports/openssl/vcpkg.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"name": "openssl",
33
"version": "3.6.1",
4-
"port-version": 2,
4+
"port-version": 3,
55
"description": "OpenSSL is an open source project that provides a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. It is also a general-purpose cryptography library.",
66
"homepage": "https://www.openssl.org",
77
"license": "Apache-2.0",

‎ports/openssl/windows/install-layout.patch‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ index f71f3bf..116954f 100644
77
our $modulesdir_dev = $modulesprefix_dev;
88
our $modulesdir_dir =
99
- catdir($modulesprefix_dir, "ossl-modules");
10-
+ catdir($modulesprefix_dir, "../bin");
10+
+ catdir($modulesprefix_dir, "../bin"); # change lib/ossl-modules to bin
1111
our $modulesdir = catpath($modulesdir_dev, $modulesdir_dir);
1212
our $enginesdir_dev = $modulesprefix_dev;
1313
our $enginesdir_dir =

‎ports/openssl/windows/portfile.cmake‎

Lines changed: 66 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ if(VCPKG_CONCURRENCY GREATER "1")
4141
vcpkg_list(APPEND CONFIGURE_OPTIONS no-makedepend)
4242
endif()
4343

44-
cmake_path(NATIVE_PATH CURRENT_PACKAGES_DIR NORMALIZE install_dir_native)
44+
cmake_path(NATIVE_PATH CURRENT_PACKAGES_DIR NORMALIZE current_packages_dir_native)
4545

4646
# Clang always uses /Z7; Patching /Zi /Fd<Name> out of openssl requires more work.
4747
set(OPENSSL_BUILD_MAKES_PDBS ON)
@@ -71,15 +71,19 @@ endif()
7171
cmake_path(NATIVE_PATH VCPKG_DETECTED_CMAKE_AR NORMALIZE ar)
7272
cmake_path(NATIVE_PATH VCPKG_DETECTED_CMAKE_LINKER NORMALIZE ld)
7373

74+
# We can't set openssldir because that would leak build machine information into the built binaries,
75+
# and introduce vulnerabilities where OpenSSL would search those locations at runtime, potentially
76+
# unexpectedly loading code from there. For example CVE-2019-12572
77+
#
78+
# Put the built bits in subdirectories with DESTDIR then move them where they go after the fact
79+
# instead.
7480
vcpkg_build_nmake(
7581
SOURCE_PATH "${SOURCE_PATH}"
7682
PREFER_JOM
7783
CL_LANGUAGE NONE
7884
PRERUN_SHELL_RELEASE "${PERL}" Configure
7985
${CONFIGURE_OPTIONS}
8086
${OPENSSL_ARCH}
81-
"--prefix=${install_dir_native}"
82-
"--openssldir=${install_dir_native}"
8387
"AS=${as}"
8488
"CC=${cc}"
8589
"CFLAGS=${VCPKG_COMBINED_C_FLAGS_RELEASE}"
@@ -91,8 +95,6 @@ vcpkg_build_nmake(
9195
${CONFIGURE_OPTIONS}
9296
${OPENSSL_ARCH}
9397
--debug
94-
"--prefix=${install_dir_native}\\debug"
95-
"--openssldir=${install_dir_native}\\debug"
9698
"AS=${as}"
9799
"CC=${cc}"
98100
"CFLAGS=${VCPKG_COMBINED_C_FLAGS_DEBUG}"
@@ -106,53 +108,80 @@ vcpkg_build_nmake(
106108
OPTIONS
107109
"INSTALL_PDBS=${OPENSSL_BUILD_MAKES_PDBS}" # install-pdbs.patch
108110
OPTIONS_RELEASE
111+
"DESTDIR=${current_packages_dir_native}"
109112
install_runtime install_ssldirs # extra targets
113+
OPTIONS_DEBUG
114+
"DESTDIR=${current_packages_dir_native}/debug"
110115
)
111116

117+
function(z_rearrange_openssl_dirs)
118+
cmake_parse_arguments(PARSE_ARGV 0 arg "" "OUT_PROGRAM_FILES_DIR;FLAVOR_PREFIX" "")
119+
120+
if(DEFINED arg_UNPARSED_ARGUMENTS)
121+
message(FATAL_ERROR "z_rearrange_openssl_dirs was passed extra arguments: ${arg_UNPARSED_ARGUMENTS}")
122+
endif()
123+
124+
# The resulting directory will contain something like "Program Files" or "Program Files (x86)";
125+
# globbing here to be architecture agnostic
126+
set(prefix_packages_dir "${CURRENT_PACKAGES_DIR}${arg_FLAVOR_PREFIX}")
127+
file(GLOB flavor_programfiles_dir LIST_DIRECTORIES true "${prefix_packages_dir}/Program*")
128+
if(NOT flavor_programfiles_dir)
129+
message(FATAL_ERROR "${flavor_programfiles_dir}: error: couldn't find program files dir")
130+
endif()
131+
132+
if(DEFINED arg_OUT_PROGRAM_FILES_DIR)
133+
set("${arg_OUT_PROGRAM_FILES_DIR}" "${flavor_programfiles_dir}" PARENT_SCOPE)
134+
endif()
135+
136+
set(flavor_openssl_dir "${flavor_programfiles_dir}/OpenSSL")
137+
if(NOT EXISTS "${flavor_openssl_dir}")
138+
message(FATAL_ERROR "${flavor_openssl_dir}: should exist and be OpenSSLDir")
139+
endif()
140+
141+
# ideally we would use RENAME rather than COPY and REMOVE_RECURSE but CMake doesn't have an out
142+
# of the box way to do that correctly merging directories
143+
file(GLOB flavor_openssl_dirs LIST_DIRECTORIES true "${flavor_openssl_dir}/*")
144+
file(COPY ${flavor_openssl_dirs} DESTINATION "${prefix_packages_dir}")
145+
file(REMOVE_RECURSE "${flavor_openssl_dir}")
146+
endfunction()
147+
148+
z_rearrange_openssl_dirs(FLAVOR_PREFIX "" OUT_PROGRAM_FILES_DIR release_programfiles)
149+
if(NOT VCPKG_BUILD_TYPE)
150+
z_rearrange_openssl_dirs(FLAVOR_PREFIX "/debug" OUT_PROGRAM_FILES_DIR debug_programfiles)
151+
file(REMOVE_RECURSE "${CURRENT_PACKAGES_DIR}/debug/include")
152+
file(REMOVE_RECURSE "${debug_programfiles}")
153+
file(REMOVE "${CURRENT_PACKAGES_DIR}/debug/bin/c_rehash.pl")
154+
endif()
155+
112156
set(scripts "bin/c_rehash.pl" "misc/CA.pl" "misc/tsget.pl")
113157
if("tools" IN_LIST FEATURES)
114158
file(MAKE_DIRECTORY "${CURRENT_PACKAGES_DIR}/tools/${PORT}")
115-
file(RENAME "${CURRENT_PACKAGES_DIR}/openssl.cnf" "${CURRENT_PACKAGES_DIR}/tools/${PORT}/openssl.cnf")
159+
file(COPY_FILE "${release_programfiles}/Common Files/SSL/openssl.cnf" "${CURRENT_PACKAGES_DIR}/tools/${PORT}/openssl.cnf")
116160
if("fips" IN_LIST FEATURES)
117-
file(RENAME "${CURRENT_PACKAGES_DIR}/fipsmodule.cnf" "${CURRENT_PACKAGES_DIR}/tools/${PORT}/fipsmodule.cnf")
161+
file(COPY_FILE "${release_programfiles}/Common Files/SSL/fipsmodule.cnf" "${CURRENT_PACKAGES_DIR}/tools/${PORT}/fipsmodule.cnf")
118162
endif()
119-
foreach(script IN LISTS scripts)
120-
file(COPY "${CURRENT_PACKAGES_DIR}/${script}" DESTINATION "${CURRENT_PACKAGES_DIR}/tools/${PORT}")
121-
file(REMOVE "${CURRENT_PACKAGES_DIR}/${script}" "${CURRENT_PACKAGES_DIR}/debug/${script}")
122-
endforeach()
163+
164+
file(RENAME "${CURRENT_PACKAGES_DIR}/bin/c_rehash.pl" "${CURRENT_PACKAGES_DIR}/tools/${PORT}/c_rehash.pl")
165+
file(RENAME "${release_programfiles}/Common Files/SSL/misc/CA.pl" "${CURRENT_PACKAGES_DIR}/tools/${PORT}/CA.pl")
166+
file(RENAME "${release_programfiles}/Common Files/SSL/misc/tsget.pl" "${CURRENT_PACKAGES_DIR}/tools/${PORT}/tsget.pl")
123167
vcpkg_copy_tools(TOOL_NAMES openssl AUTO_CLEAN)
124168
else()
125-
file(REMOVE "${CURRENT_PACKAGES_DIR}/openssl.cnf")
126-
file(REMOVE "${CURRENT_PACKAGES_DIR}/fipsmodule.cnf")
127-
foreach(script IN LISTS scripts)
128-
file(REMOVE "${CURRENT_PACKAGES_DIR}/${script}" "${CURRENT_PACKAGES_DIR}/debug/${script}")
129-
endforeach()
169+
file(REMOVE
170+
"${CURRENT_PACKAGES_DIR}/bin/c_rehash.pl"
171+
"${release_programfiles}/Common Files/SSL/misc/CA.pl"
172+
"${release_programfiles}/Common Files/SSL/misc/tsget.pl"
173+
)
174+
130175
if(VCPKG_LIBRARY_LINKAGE STREQUAL "static")
131176
file(REMOVE_RECURSE "${CURRENT_PACKAGES_DIR}/bin" "${CURRENT_PACKAGES_DIR}/debug/bin")
132177
endif()
133178
endif()
134179

135180
vcpkg_copy_pdbs()
181+
vcpkg_cmake_config_fixup()
136182

137-
file(REMOVE_RECURSE
138-
"${CURRENT_PACKAGES_DIR}/certs"
139-
"${CURRENT_PACKAGES_DIR}/misc"
140-
"${CURRENT_PACKAGES_DIR}/private"
141-
"${CURRENT_PACKAGES_DIR}/lib/engines-3"
142-
"${CURRENT_PACKAGES_DIR}/debug/certs"
143-
"${CURRENT_PACKAGES_DIR}/debug/misc"
144-
"${CURRENT_PACKAGES_DIR}/debug/lib/engines-3"
145-
"${CURRENT_PACKAGES_DIR}/debug/private"
146-
"${CURRENT_PACKAGES_DIR}/debug/include"
147-
"${CURRENT_PACKAGES_DIR}/debug/share"
148-
)
149-
file(REMOVE
150-
"${CURRENT_PACKAGES_DIR}/ct_log_list.cnf"
151-
"${CURRENT_PACKAGES_DIR}/ct_log_list.cnf.dist"
152-
"${CURRENT_PACKAGES_DIR}/openssl.cnf.dist"
153-
"${CURRENT_PACKAGES_DIR}/debug/ct_log_list.cnf"
154-
"${CURRENT_PACKAGES_DIR}/debug/ct_log_list.cnf.dist"
155-
"${CURRENT_PACKAGES_DIR}/debug/openssl.cnf"
156-
"${CURRENT_PACKAGES_DIR}/debug/openssl.cnf.dist"
157-
"${CURRENT_PACKAGES_DIR}/debug/fipsmodule.cnf"
183+
file(REMOVE_RECURSE # to pass empty directories check
184+
"${release_programfiles}/Common Files/SSL/certs"
185+
"${release_programfiles}/Common Files/SSL/misc"
186+
"${release_programfiles}/Common Files/SSL/private"
158187
)

‎versions/baseline.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7318,7 +7318,7 @@
73187318
},
73197319
"openssl": {
73207320
"baseline": "3.6.1",
7321-
"port-version": 2
7321+
"port-version": 3
73227322
},
73237323
"opensubdiv": {
73247324
"baseline": "3.5.0",

‎versions/o-/openssl.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
{
22
"versions": [
3+
{
4+
"git-tree": "4d02bbb044439adeced1af6fc8a45f819c8bb5e2",
5+
"version": "3.6.1",
6+
"port-version": 3
7+
},
38
{
49
"git-tree": "13ecbd590e54cff1467a8196b5f0dcab74ae1c24",
510
"version": "3.6.1",

0 commit comments

Comments
 (0)
⚡