bilibili / openssl Goto Github PK

Hello,

I noticed that the version of OpenSSL in this repo is subject to a recent security vulnerability (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3449). The issue can be resolved by updating to the latest version of OpenSSL or applying the following patch to ssl/statem/extensions.c (the line numbers in the patch might not exactly line up depending on what version of OpenSSL you have):

@@ -1137,8 +1137,9 @@
static int init_sig_algs(SSL *s, unsigned int context)
{
    /* Clear any signature algorithms extension received */
    OPENSSL_free(s->s3->tmp.peer_sigalgs);
    s->s3->tmp.peer_sigalgs = NULL;
+    s->s3->tmp.peer_sigalgslen = 0;

    return 1;
}

请问什么时候更新openssl版本到version 1_1_1 ? 目前的版本1_0_2存在安全漏洞.

I get the following error when I try to run the below code for a DTLS client server program using rust through visual studio code and its terminal. I have already installed openssl libraries using vcpkg and set the environment variables. I have also installed the c/c++ extensions for vscode.

Error: error: could not find native static library C, perhaps an -L flag is missing?
How do I resolve this error? My DTLS code is given below along with build.rs and cargo.toml. I get the same error when I try to run any openssl-dependant codes in C/C++/Rust.

MAIN.rs

'''
use openssl::ssl::SslMethod;
use std::{ io::{Read, Write},
net::UdpSocket, thread, time::Duration, };
use udp_dtls::{Certificate, DtlsAcceptor, DtlsConnector, Identity, SrtpProfile};
use udp_dtls::{DtlsAcceptorBuilder, UdpChannel};
fn main() { let buffer = include_bytes!("../test/identity.p12");
let identity = Identity::from_pkcs12(buffer, "mypass").unwrap();
let root_ca = include_bytes!("../test/root-ca.der"); let root_ca = Certificate::from_der(root_ca).unwrap();
let acceptor = DtlsAcceptor::builder(identity).build().unwrap();
let connector = DtlsConnector::builder() .add_srtp_profile(SrtpProfile::Aes128CmSha180) .add_srtp_profile(SrtpProfile::AeadAes256Gcm) .add_root_certificate(root_ca) .build() .unwrap();
let server = UdpSocket::bind("127.0.0.1:0").unwrap();
let client = UdpSocket::bind("127.0.0.1:0").unwrap();
let server_addr = server.local_addr().unwrap(); let client_addr = client.local_addr().unwrap();
let server_channel = UdpChannel { socket: server, remote_addr: client_addr, };
let client_channel = UdpChannel { socket: client, remote_addr: server_addr, };
let guard = thread::spawn(move || { let mut dtls_server = acceptor.accept(server_channel).unwrap(); let mut count = 0;
while true { let mut received = [0; 5];
dtls_server.read_exact(&mut received);
println!( "{:?} {:?}", count, String::from_utf8_lossy(received.as_ref()) );
count = count + 1; thread::sleep(Duration::from_millis(2)); } });
let mut dtls_client = connector.connect("foobar.com", client_channel).unwrap();
while true { let mut buf = [0; 5];
let buf = b"hello";
dtls_client.write_all(buf);
thread::sleep(Duration::from_millis(30)); } }
'''

CARGO.toml
'''
[package]
name = "udp-dtls"
version = "0.1.0"
authors = ["Timon Post https://github.com/TimonPost"]
edition = "2018"
description = "DTLS abstraction ontop of UDP"
repository = "https://github.com/TimonPost/udp-dtls"
documentation = "https://docs.rs/udp-dtls/"
license = "MIT"
keywords = ["DTLS", "UDP", "connection", "openssl", "ssl"] exclude = ["target", "Cargo.lock"] readme = "README.md" [dependencies] openssl = "0.10.19" openssl-probe = "0.1.2" log = "0.4.6" bytes = "0.4.11" [features] vendored = ["openssl/vendored"]
'''

BUILD.rs
'''
BUILD.rs
use std::fs::File;
use std::io::Write;
use std::process::Command;
use std::env;
fn main() -> std::io::Result<()> {

if let Ok(v) = env::var("DEP_OPENSSL_VERSION_NUMBER") {
    let version = u64::from_str_radix(&v, 16).unwrap();

    if version >= 0x1_01_01_00_0 {
        println!("cargo:rustc-cfg=openssl111");
    }
}

let certs_dir = "src/certs";
let keys_dir = "src/keys";
let scratch_dir = "openssl-temp";
let server_ext = &format!("{}/server_ext", scratch_dir);
let client_ext = &format!("{}/client_ext", scratch_dir);

for dir in &[certs_dir, keys_dir, scratch_dir] {
    // create if dir does not exist
    match std::fs::create_dir(dir) {
        _ => {}
    }
}

let mut file = File::create(server_ext).unwrap();
file.write(b"basicConstraints=CA:false\nkeyUsage=critical,keyEncipherment")?;

let mut file = File::create(client_ext).unwrap();
file.write(b"basicConstraints=CA:false\nkeyUsage=critical,digitalSignature")?;

// Generate self-signed CA
Command::new("openssl")
    .args(&[
        "req",
        "-x509",
        "-newkey",
        "rsa:2048",
        "-subj",
        "/CN=ca",
        "-nodes",
        "-keyout",
        &format!("{}/ca-key.pem", keys_dir),
        "-out",
        &format!("{}/ca-cert.pem", certs_dir),
        "-addext",
        "keyUsage=critical,keyCertSign",
    ])
    .output()?;

// Generate server key and CSR
Command::new("openssl")
    .args(&[
        "req",
        "-newkey",
        "rsa:2048",
        "-subj",
        "/CN=server",
        "-nodes",
        "-keyout",
        &format!("{}/server-key.pem", keys_dir),
        "-out",
        &format!("{}/server-csr.pem", scratch_dir),
    ])
    .output()?;

// Sign server CSR
Command::new("openssl")
    .args(&[
        "x509",
        "-req",
        "-CAcreateserial",
        "-CA",
        &format!("{}/ca-cert.pem", certs_dir),
        "-CAkey",
        &format!("{}/ca-key.pem", keys_dir),
        "-in",
        &format!("{}/server-csr.pem", scratch_dir),
        "-out",
        &format!("{}/server-cert.pem", certs_dir),
        "-extfile",
        server_ext,
    ])
    .output()?;

// Generate client key and CSR
Command::new("openssl")
    .args(&[
        "req",
        "-newkey",
        "rsa:2048",
        "-subj",
        "/CN=client",
        "-nodes",
        "-keyout",
        &format!("{}/client-key.pem", keys_dir),
        "-out",
        &format!("{}/client-csr.pem", scratch_dir),
    ])
    .output()?;

// Sign client CSR
Command::new("openssl")
    .args(&[
        "x509",
        "-req",
        "-CAcreateserial",
        "-CA",
        &format!("{}/ca-cert.pem", certs_dir),
        "-CAkey",
        &format!("{}/ca-key.pem", keys_dir),
        "-in",
        &format!("{}/client-csr.pem", scratch_dir),
        "-out",
        &format!("{}/client-cert.pem", certs_dir),
        "-extfile",
        client_ext,
    ])
    .output()?;

std::fs::remove_dir_all(scratch_dir)?;

Ok(())

}
'''

For further reference please check this link for full code: https://github.com/TimonPost/udp-dtls