Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update

Browse Source
This commit is contained in:
Hakase
2019-07-13 19:13:22 +09:00
parent 9a23f88dc2
commit 2e57f602ae
542 changed files with 17287 additions and 6184 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGES
+45 -3
View File
@@ -9,6 +9,48 @@
Changes between 1.1.1 and 3.0.0 [xx XXX xxxx]
*) Removed NextStep support and the macro OPENSSL_UNISTD
[Rich Salz]
*) Removed DES_check_key. Also removed OPENSSL_IMPLEMENT_GLOBAL,
OPENSSL_GLOBAL_REF, OPENSSL_DECLARE_GLOBAL.
Also removed "export var as function" capability; we do not export
variables, only functions.
[Rich Salz]
*) RC5_32_set_key has been changed to return an int type, with 0 indicating
an error and 1 indicating success. In previous versions of OpenSSL this
was a void type. If a key was set longer than the maximum possible this
would crash.
[Matt Caswell]
*) Support SM2 signing and verification schemes with X509 certificate.
[Paul Yang]
*) Use SHA256 as the default digest for TS query in the ts app.
[Tomas Mraz]
*) Change PBKDF2 to conform to SP800-132 instead of the older PKCS5 RFC2898.
This checks that the salt length is at least 128 bits, the derived key
length is at least 112 bits, and that the iteration count is at least 1000.
For backwards compatibility these checks are disabled by default in the
default provider, but are enabled by default in the fips provider.
To enable or disable these checks use the control
EVP_KDF_CTRL_SET_PBKDF2_PKCS5_MODE.
[Shane Lontis]
*) Default cipher lists/suites are now available via a function, the
#defines are deprecated.
[Todd Short]
*) Add target VC-WIN32-UWP, VC-WIN64A-UWP, VC-WIN32-ARM-UWP and
VC-WIN64-ARM-UWP in Windows OneCore target for making building libraries
for Windows Store apps easier. Also, the "no-uplink" option has been added.
[Kenji Mouri]
*) Join the directories crypto/x509 and crypto/x509v3
[Richard Levitte]
*) Change the default RSA, DSA and DH size to 2048 bit instead of 1024.
This changes the size when using the genpkey app when no size is given. It
fixes an omission in earlier changes that changed all RSA, DSA and DH
@@ -420,7 +462,7 @@
SSL_set_ciphersuites()
[Matt Caswell]
*) Memory allocation failures consistenly add an error to the error
*) Memory allocation failures consistently add an error to the error
stack.
[Rich Salz]
@@ -6958,7 +7000,7 @@
reason texts, thereby removing some of the footprint that may not
be interesting if those errors aren't displayed anyway.
NOTE: it's still possible for any application or module to have it's
NOTE: it's still possible for any application or module to have its
own set of error texts inserted. The routines are there, just not
used by default when no-err is given.
[Richard Levitte]
@@ -8924,7 +8966,7 @@ des-cbc 3624.96k 5258.21k 5530.91k 5624.30k 5628.26k
Changes between 0.9.6g and 0.9.6h [5 Dec 2002]
*) New function OPENSSL_cleanse(), which is used to cleanse a section of
memory from it's contents. This is done with a counter that will
memory from its contents. This is done with a counter that will
place alternating values in each byte. This can be used to solve
two issues: 1) the removal of calls to memset() by highly optimizing
compilers, and 2) cleansing with other values than 0, since those can
CONTRIBUTING
+10 -2
View File
@@ -19,8 +19,16 @@ guidelines:
1. Anything other than a trivial contribution requires a Contributor
License Agreement (CLA), giving us permission to use your code. See
https://www.openssl.org/policies/cla.html for details. If your
contribution is too small to require a CLA, put "CLA: trivial" on a
line by itself in your commit message body.
contribution is too small to require a CLA (e.g. fixing a spelling
mistake), place the text "CLA: trivial" on a line by itself separated by
an empty line from the rest of the commit message. It is not sufficient to
only place the text in the GitHub pull request description.
To amend a missing "CLA: trivial" line after submission, do the following:
git commit --amend
[add the line, save and quit the editor]
git push -f
2. All source files should start with the following text (with
appropriate comment characters at the start of each line and the
Configurations/00-base-templates.conf
-208
View File
@@ -14,28 +14,6 @@ my %targets=(
thread_scheme => "(unknown)", # Assume we don't know
thread_defines => [],
apps_aux_src => "",
apps_init_src => "",
cpuid_asm_src => "mem_clr.c",
uplink_aux_src => "",
bn_asm_src => "bn_asm.c",
ec_asm_src => "",
des_asm_src => "des_enc.c fcrypt_b.c",
aes_asm_src => "aes_core.c aes_cbc.c",
bf_asm_src => "bf_enc.c",
md5_asm_src => "",
cast_asm_src => "c_enc.c",
rc4_asm_src => "rc4_enc.c rc4_skey.c",
rmd160_asm_src => "",
rc5_asm_src => "rc5_enc.c",
wp_asm_src => "wp_block.c",
cmll_asm_src => "camellia.c cmll_misc.c cmll_cbc.c",
modes_asm_src => "",
padlock_asm_src => "",
chacha_asm_src => "chacha_enc.c",
poly1305_asm_src => "",
keccak1600_asm_src => "keccak1600.c",
unistd => "<unistd.h>",
shared_target => "",
shared_cflag => "",
@@ -168,190 +146,4 @@ my %targets=(
perl_platform => 'VMS',
},
uplink_common => {
template => 1,
apps_init_src => add("../ms/applink.c"),
uplink_aux_src => add("../ms/uplink.c"),
defines => add("OPENSSL_USE_APPLINK"),
},
x86_uplink => {
inherit_from => [ "uplink_common" ],
template => 1,
uplink_aux_src => add("uplink-x86.s"),
},
x86_64_uplink => {
inherit_from => [ "uplink_common" ],
template => 1,
uplink_aux_src => add("uplink-x86_64.s"),
},
ia64_uplink => {
inherit_from => [ "uplink_common" ],
template => 1,
uplink_aux_src => add("uplink-ia64.s"),
},
x86_asm => {
template => 1,
cpuid_asm_src => "x86cpuid.s",
bn_asm_src => "bn-586.s co-586.s x86-mont.s x86-gf2m.s",
ec_asm_src => "ecp_nistz256.c ecp_nistz256-x86.s",
des_asm_src => "des-586.s crypt586.s",
aes_asm_src => "aes-586.s vpaes-x86.s aesni-x86.s",
bf_asm_src => "bf-586.s",
md5_asm_src => "md5-586.s",
cast_asm_src => "cast-586.s",
sha1_asm_src => "sha1-586.s sha256-586.s sha512-586.s",
rc4_asm_src => "rc4-586.s",
rmd160_asm_src => "rmd-586.s",
rc5_asm_src => "rc5-586.s",
wp_asm_src => "wp_block.c wp-mmx.s",
cmll_asm_src => "cmll-x86.s",
modes_asm_src => "ghash-x86.s",
padlock_asm_src => "e_padlock-x86.s",
chacha_asm_src => "chacha-x86.s",
poly1305_asm_src=> "poly1305-x86.s",
},
x86_elf_asm => {
template => 1,
inherit_from => [ "x86_asm" ],
perlasm_scheme => "elf"
},
x86_64_asm => {
template => 1,
cpuid_asm_src => "x86_64cpuid.s",
bn_asm_src => "asm/x86_64-gcc.c x86_64-mont.s x86_64-mont5.s x86_64-gf2m.s rsaz_exp.c rsaz-x86_64.s rsaz-avx2.s",
ec_asm_src => "ecp_nistz256.c ecp_nistz256-x86_64.s x25519-x86_64.s",
aes_asm_src => "aes-x86_64.s vpaes-x86_64.s bsaes-x86_64.s aesni-x86_64.s aesni-sha1-x86_64.s aesni-sha256-x86_64.s aesni-mb-x86_64.s",
md5_asm_src => "md5-x86_64.s",
sha1_asm_src => "sha1-x86_64.s sha256-x86_64.s sha512-x86_64.s sha1-mb-x86_64.s sha256-mb-x86_64.s",
rc4_asm_src => "rc4-x86_64.s rc4-md5-x86_64.s",
wp_asm_src => "wp-x86_64.s",
cmll_asm_src => "cmll-x86_64.s cmll_misc.c",
modes_asm_src => "ghash-x86_64.s aesni-gcm-x86_64.s",
padlock_asm_src => "e_padlock-x86_64.s",
chacha_asm_src => "chacha-x86_64.s",
poly1305_asm_src=> "poly1305-x86_64.s",
keccak1600_asm_src => "keccak1600-x86_64.s",
},
ia64_asm => {
template => 1,
cpuid_asm_src => "ia64cpuid.s",
bn_asm_src => "bn-ia64.s ia64-mont.s",
aes_asm_src => "aes_core.c aes_cbc.c aes-ia64.s",
sha1_asm_src => "sha1-ia64.s sha256-ia64.s sha512-ia64.s",
modes_asm_src => "ghash-ia64.s",
chacha_asm_src => "chacha-ia64.S",
poly1305_asm_src=> "asm/poly1305-ia64.S",
perlasm_scheme => "void"
},
sparcv9_asm => {
template => 1,
cpuid_asm_src => "sparcv9cap.c sparccpuid.S",
bn_asm_src => "asm/sparcv8plus.S sparcv9-mont.S sparcv9a-mont.S vis3-mont.S sparct4-mont.S sparcv9-gf2m.S",
ec_asm_src => "ecp_nistz256.c ecp_nistz256-sparcv9.S",
des_asm_src => "des_enc-sparc.S fcrypt_b.c dest4-sparcv9.S",
aes_asm_src => "aes_core.c aes_cbc.c aes-sparcv9.S aest4-sparcv9.S aesfx-sparcv9.S",
md5_asm_src => "md5-sparcv9.S",
sha1_asm_src => "sha1-sparcv9.S sha256-sparcv9.S sha512-sparcv9.S",
cmll_asm_src => "camellia.c cmll_misc.c cmll_cbc.c cmllt4-sparcv9.S",
modes_asm_src => "ghash-sparcv9.S",
poly1305_asm_src=> "poly1305-sparcv9.S",
perlasm_scheme => "void"
},
sparcv8_asm => {
template => 1,
cpuid_asm_src => "",
bn_asm_src => "asm/sparcv8.S",
des_asm_src => "des_enc-sparc.S fcrypt_b.c",
perlasm_scheme => "void"
},
alpha_asm => {
template => 1,
cpuid_asm_src => "alphacpuid.s",
bn_asm_src => "bn_asm.c alpha-mont.S",
sha1_asm_src => "sha1-alpha.S",
modes_asm_src => "ghash-alpha.S",
perlasm_scheme => "void"
},
mips32_asm => {
template => 1,
bn_asm_src => "bn-mips.S mips-mont.S",
aes_asm_src => "aes_cbc.c aes-mips.S",
sha1_asm_src => "sha1-mips.S sha256-mips.S",
},
mips64_asm => {
inherit_from => [ "mips32_asm" ],
template => 1,
sha1_asm_src => add("sha512-mips.S"),
poly1305_asm_src=> "poly1305-mips.S",
},
s390x_asm => {
template => 1,
cpuid_asm_src => "s390xcap.c s390xcpuid.S",
bn_asm_src => "asm/s390x.S s390x-mont.S s390x-gf2m.s",
aes_asm_src => "aes-s390x.S aes-ctr.fake aes-xts.fake",
sha1_asm_src => "sha1-s390x.S sha256-s390x.S sha512-s390x.S",
rc4_asm_src => "rc4-s390x.s",
modes_asm_src => "ghash-s390x.S",
chacha_asm_src => "chacha-s390x.S",
poly1305_asm_src=> "poly1305-s390x.S",
keccak1600_asm_src => "keccak1600-s390x.S",
},
armv4_asm => {
template => 1,
cpuid_asm_src => "armcap.c armv4cpuid.S",
bn_asm_src => "bn_asm.c armv4-mont.S armv4-gf2m.S",
ec_asm_src => "ecp_nistz256.c ecp_nistz256-armv4.S",
aes_asm_src => "aes_cbc.c aes-armv4.S bsaes-armv7.S aesv8-armx.S",
sha1_asm_src => "sha1-armv4-large.S sha256-armv4.S sha512-armv4.S",
modes_asm_src => "ghash-armv4.S ghashv8-armx.S",
chacha_asm_src => "chacha-armv4.S",
poly1305_asm_src=> "poly1305-armv4.S",
keccak1600_asm_src => "keccak1600-armv4.S",
perlasm_scheme => "void"
},
aarch64_asm => {
template => 1,
cpuid_asm_src => "armcap.c arm64cpuid.S",
ec_asm_src => "ecp_nistz256.c ecp_nistz256-armv8.S",
bn_asm_src => "bn_asm.c armv8-mont.S",
aes_asm_src => "aes_core.c aes_cbc.c aesv8-armx.S vpaes-armv8.S",
sha1_asm_src => "sha1-armv8.S sha256-armv8.S sha512-armv8.S",
modes_asm_src => "ghashv8-armx.S",
chacha_asm_src => "chacha-armv8.S",
poly1305_asm_src=> "poly1305-armv8.S",
keccak1600_asm_src => "keccak1600-armv8.S",
},
parisc11_asm => {
template => 1,
cpuid_asm_src => "pariscid.s",
bn_asm_src => "bn_asm.c parisc-mont.s",
aes_asm_src => "aes_core.c aes_cbc.c aes-parisc.s",
sha1_asm_src => "sha1-parisc.s sha256-parisc.s sha512-parisc.s",
rc4_asm_src => "rc4-parisc.s",
modes_asm_src => "ghash-parisc.s",
perlasm_scheme => "32"
},
parisc20_64_asm => {
template => 1,
inherit_from => [ "parisc11_asm" ],
perlasm_scheme => "64",
},
ppc32_asm => {
template => 1,
cpuid_asm_src => "ppccpuid.s ppccap.c",
bn_asm_src => "bn-ppc.s ppc-mont.s",
aes_asm_src => "aes_core.c aes_cbc.c aes-ppc.s vpaes-ppc.s aesp8-ppc.s",
sha1_asm_src => "sha1-ppc.s sha256-ppc.s sha512-ppc.s sha256p8-ppc.s sha512p8-ppc.s",
modes_asm_src => "ghashp8-ppc.s",
chacha_asm_src => "chacha-ppc.s",
poly1305_asm_src=> "poly1305-ppc.s poly1305-ppcfp.s",
},
ppc64_asm => {
inherit_from => [ "ppc32_asm" ],
template => 1,
ec_asm_src => "ecp_nistz256.c ecp_nistz256-ppc64.s x25519-ppc64.s",
keccak1600_asm_src => "keccak1600-ppc64.s",
},
);
Configurations/10-main.conf
+178 -117
View File
@@ -221,7 +221,7 @@ my %targets = (
# NB. GNU C has to be configured to use GNU assembler, and not
# /usr/ccs/bin/as. Failure to comply will result in compile
# failures [at least] in 32-bit build.
inherit_from => [ "solaris-common", asm("x86_elf_asm") ],
inherit_from => [ "solaris-common" ],
CC => "gcc",
CFLAGS => add_before(picker(default => "-Wall",
debug => "-O0 -g",
@@ -232,6 +232,8 @@ my %targets = (
bn_ops => "BN_LLONG",
shared_cflag => "-fPIC",
shared_ldflag => add_before("-shared -static-libgcc"),
asm_arch => 'x86',
perlasm_scheme => 'elf',
},
"solaris64-x86_64-gcc" => {
# -shared -static-libgcc might appear controversial, but modules
@@ -242,7 +244,7 @@ my %targets = (
# code [thanks to inline assembler], I would actually recommend
# to consider using gcc shared build even with vendor compiler:-)
# -- <appro@openssl.org>
inherit_from => [ "solaris-common", asm("x86_64_asm") ],
inherit_from => [ "solaris-common" ],
CC => "gcc",
CFLAGS => add_before(picker(default => "-Wall",
debug => "-O0 -g",
@@ -251,6 +253,7 @@ my %targets = (
lib_cppflags => add("-DL_ENDIAN"),
ex_libs => add(threads("-pthread")),
bn_ops => "SIXTY_FOUR_BIT_LONG",
asm_arch => 'x86_64',
perlasm_scheme => "elf",
shared_cflag => "-fPIC",
shared_ldflag => add_before("-shared -static-libgcc"),
@@ -271,7 +274,7 @@ my %targets = (
# Consider switching to solaris64-x86_64-gcc even here...
#
"solaris64-x86_64-cc" => {
inherit_from => [ "solaris-common", asm("x86_64_asm") ],
inherit_from => [ "solaris-common" ],
CC => "cc",
CFLAGS => add_before(picker(debug => "-g",
release => "-xO5 -xdepend -xbuiltin")),
@@ -282,6 +285,7 @@ my %targets = (
lflags => add(threads("-mt")),
ex_libs => add(threads("-lpthread")),
bn_ops => "SIXTY_FOUR_BIT_LONG",
asm_arch => 'x86_64',
perlasm_scheme => "elf",
shared_cflag => "-KPIC",
shared_ldflag => add_before("-G -dy -z text"),
@@ -303,14 +307,18 @@ my %targets = (
shared_ldflag => add_before("-shared"),
},
"solaris-sparcv8-gcc" => {
inherit_from => [ "solaris-sparcv7-gcc", asm("sparcv8_asm") ],
inherit_from => [ "solaris-sparcv7-gcc" ],
cflags => add_before("-mcpu=v8"),
asm_arch => 'sparcv8',
perlasm_scheme => 'void',
},
"solaris-sparcv9-gcc" => {
# -m32 should be safe to add as long as driver recognizes
# -mcpu=ultrasparc
inherit_from => [ "solaris-sparcv7-gcc", asm("sparcv9_asm") ],
inherit_from => [ "solaris-sparcv7-gcc" ],
cflags => add_before("-m32 -mcpu=ultrasparc"),
asm_arch => 'sparcv9',
perlasm_scheme => 'void',
},
"solaris64-sparcv9-gcc" => {
inherit_from => [ "solaris-sparcv9-gcc" ],
@@ -339,17 +347,23 @@ my %targets = (
},
####
"solaris-sparcv8-cc" => {
inherit_from => [ "solaris-sparcv7-cc", asm("sparcv8_asm") ],
inherit_from => [ "solaris-sparcv7-cc" ],
cflags => add_before("-xarch=v8"),
asm_arch => 'sparcv8',
perlasm_scheme => 'void',
},
"solaris-sparcv9-cc" => {
inherit_from => [ "solaris-sparcv7-cc", asm("sparcv9_asm") ],
inherit_from => [ "solaris-sparcv7-cc" ],
cflags => add_before("-xarch=v8plus"),
asm_arch => 'sparcv9',
perlasm_scheme => 'void',
},
"solaris64-sparcv9-cc" => {
inherit_from => [ "solaris-sparcv7-cc", asm("sparcv9_asm") ],
inherit_from => [ "solaris-sparcv7-cc" ],
cflags => add_before("-xarch=v9"),
bn_ops => "BN_LLONG RC4_CHAR",
asm_arch => 'sparcv9',
perlasm_scheme => 'void',
multilib => "/64",
},
@@ -368,45 +382,49 @@ my %targets = (
shared_sonameflag=> "-Wl,-soname,",
},
"irix-mips3-gcc" => {
inherit_from => [ "irix-common", asm("mips64_asm") ],
inherit_from => [ "irix-common" ],
CC => "gcc",
CFLAGS => picker(debug => "-g -O0",
release => "-O3"),
LDFLAGS => "-static-libgcc",
cflags => "-mabi=n32",
bn_ops => "RC4_CHAR SIXTY_FOUR_BIT",
asm_arch => 'mips64',
perlasm_scheme => "n32",
multilib => "32",
},
"irix-mips3-cc" => {
inherit_from => [ "irix-common", asm("mips64_asm") ],
inherit_from => [ "irix-common" ],
CC => "cc",
CFLAGS => picker(debug => "-g -O0",
release => "-O2"),
cflags => "-n32 -mips3 -use_readonly_const -G0 -rdata_shared",
bn_ops => "RC4_CHAR SIXTY_FOUR_BIT",
asm_arch => 'mips64',
perlasm_scheme => "n32",
multilib => "32",
},
# N64 ABI builds.
"irix64-mips4-gcc" => {
inherit_from => [ "irix-common", asm("mips64_asm") ],
inherit_from => [ "irix-common" ],
CC => "gcc",
CFLAGS => picker(debug => "-g -O0",
release => "-O3"),
LDFLAGS => "-static-libgcc",
cflags => "-mabi=64 -mips4",
bn_ops => "RC4_CHAR SIXTY_FOUR_BIT_LONG",
asm_arch => 'mips64',
perlasm_scheme => "64",
multilib => "64",
},
"irix64-mips4-cc" => {
inherit_from => [ "irix-common", asm("mips64_asm") ],
inherit_from => [ "irix-common" ],
CC => "cc",
CFLAGS => picker(debug => "-g -O0",
release => "-O2"),
cflags => "-64 -mips4 -use_readonly_const -G0 -rdata_shared",
bn_ops => "RC4_CHAR SIXTY_FOUR_BIT_LONG",
asm_arch => 'mips64',
perlasm_scheme => "64",
multilib => "64",
},
@@ -466,17 +484,21 @@ my %targets = (
shared_extension => ".sl.\$(SHLIB_VERSION_NUMBER)",
},
"hpux-parisc1_1-gcc" => {
inherit_from => [ "hpux-parisc-gcc", asm("parisc11_asm") ],
inherit_from => [ "hpux-parisc-gcc" ],
asm_arch => 'parisc11',
perlasm_scheme => "32",
multilib => "/pa1.1",
},
"hpux64-parisc2-gcc" => {
inherit_from => [ "hpux-common", asm("parisc20_64_asm") ],
inherit_from => [ "hpux-common" ],
CC => "gcc",
CFLAGS => combine(picker(debug => "-O0 -g",
release => "-O3")),
cflags => add(threads("-pthread")),
ex_libs => add("-ldl", threads("-pthread")),
bn_ops => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
asm_arch => 'parisc20_64',
perlasm_scheme => "64",
shared_cflag => "-fpic",
shared_ldflag => add_before("-shared"),
shared_extension => ".sl.\$(SHLIB_VERSION_NUMBER)",
@@ -500,12 +522,14 @@ my %targets = (
shared_extension => ".sl.\$(SHLIB_VERSION_NUMBER)",
},
"hpux-parisc1_1-cc" => {
inherit_from => [ "hpux-parisc-cc", asm("parisc11_asm") ],
inherit_from => [ "hpux-parisc-cc" ],
cflags => add_before("+DA1.1"),
asm_arch => 'parisc11',
perlasm_scheme => "32",
multilib => "/pa1.1",
},
"hpux64-parisc2-cc" => {
inherit_from => [ "hpux-common", asm("parisc20_64_asm") ],
inherit_from => [ "hpux-common" ],
CC => "cc",
CFLAGS => picker(debug => "+O0 +d -g",
release => "+O3") ,
@@ -514,6 +538,8 @@ my %targets = (
lib_cppflags => add("-DMD32_XARRAY"),
ex_libs => add("-ldl", threads("-lpthread")),
bn_ops => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
asm_arch => 'parisc20_64',
perlasm_scheme => "64",
shared_cflag => "+Z",
shared_ldflag => add_before("-b"),
shared_extension => ".sl.\$(SHLIB_VERSION_NUMBER)",
@@ -522,7 +548,7 @@ my %targets = (
# HP/UX IA-64 targets
"hpux-ia64-cc" => {
inherit_from => [ "hpux-common", asm("ia64_asm") ],
inherit_from => [ "hpux-common" ],
CC => "cc",
CFLAGS => picker(debug => "+O0 +d -g",
release => "+O2"),
@@ -530,12 +556,14 @@ my %targets = (
cppflags => add(threads("-D_REENTRANT")),
ex_libs => add("-ldl", threads("-lpthread")),
bn_ops => "SIXTY_FOUR_BIT",
asm_arch => 'ia64',
perlasm_scheme => 'void',
shared_cflag => "+Z",
shared_ldflag => add_before("-b"),
multilib => "/hpux32",
},
"hpux64-ia64-cc" => {
inherit_from => [ "hpux-common", asm("ia64_asm") ],
inherit_from => [ "hpux-common" ],
CC => "cc",
CFLAGS => picker(debug => "+O0 +d -g",
release => "+O3"),
@@ -543,31 +571,37 @@ my %targets = (
cppflags => threads("-D_REENTRANT"),
ex_libs => add("-ldl", threads("-lpthread")),
bn_ops => "SIXTY_FOUR_BIT_LONG",
asm_arch => 'ia64',
perlasm_scheme => 'void',
shared_cflag => "+Z",
shared_ldflag => add_before("-b"),
multilib => "/hpux64",
},
# GCC builds...
"hpux-ia64-gcc" => {
inherit_from => [ "hpux-common", asm("ia64_asm") ],
inherit_from => [ "hpux-common" ],
CC => "gcc",
CFLAGS => picker(debug => "-O0 -g",
release => "-O3"),
cflags => add(threads("-pthread")),
ex_libs => add("-ldl", threads("-pthread")),
bn_ops => "SIXTY_FOUR_BIT",
asm_arch => 'ia64',
perlasm_scheme => 'void',
shared_cflag => "-fpic",
shared_ldflag => add_before("-shared"),
multilib => "/hpux32",
},
"hpux64-ia64-gcc" => {
inherit_from => [ "hpux-common", asm("ia64_asm") ],
inherit_from => [ "hpux-common" ],
CC => "gcc",
CFLAGS => picker(debug => "-O0 -g",
release => "-O3"),
cflags => combine("-mlp64", threads("-pthread")),
ex_libs => add("-ldl", threads("-pthread")),
bn_ops => "SIXTY_FOUR_BIT_LONG",
asm_arch => 'ia64',
perlasm_scheme => 'void',
shared_cflag => "-fpic",
shared_ldflag => add_before("-shared"),
multilib => "/hpux64",
@@ -593,20 +627,22 @@ my %targets = (
#### there were even osf1-* configs targeting prior versions provided,
#### but not anymore...
"tru64-alpha-gcc" => {
inherit_from => [ "BASE_unix", asm("alpha_asm") ],
inherit_from => [ "BASE_unix" ],
CC => "gcc",
CFLAGS => "-O3",
cflags => add("-std=c9x", threads("-pthread")),
cppflags => "-D_XOPEN_SOURCE=500 -D_OSF_SOURCE",
ex_libs => add("-lrt", threads("-pthread")), # for mlock(2)
bn_ops => "SIXTY_FOUR_BIT_LONG",
asm_arch => 'alpha',
perlasm_scheme => "void",
thread_scheme => "pthreads",
dso_scheme => "dlfcn",
shared_target => "alpha-osf1-shared",
shared_extension => ".so",
},
"tru64-alpha-cc" => {
inherit_from => [ "BASE_unix", asm("alpha_asm") ],
inherit_from => [ "BASE_unix" ],
CC => "cc",
CFLAGS => "-tune host -fast",
cflags => add("-std1 -readonly_strings",
@@ -614,6 +650,8 @@ my %targets = (
cppflags => "-D_XOPEN_SOURCE=500 -D_OSF_SOURCE",
ex_libs => add("-lrt", threads("-pthread")), # for mlock(2)
bn_ops => "SIXTY_FOUR_BIT_LONG",
asm_arch => 'alpha',
perlasm_scheme => "void",
thread_scheme => "pthreads",
dso_scheme => "dlfcn",
shared_target => "alpha-osf1-shared",
@@ -654,22 +692,25 @@ my %targets = (
},
"linux-ppc" => {
inherit_from => [ "linux-generic32", asm("ppc32_asm") ],
inherit_from => [ "linux-generic32" ],
asm_arch => 'ppc32',
perlasm_scheme => "linux32",
},
"linux-ppc64" => {
inherit_from => [ "linux-generic64", asm("ppc64_asm") ],
inherit_from => [ "linux-generic64" ],
cflags => add("-m64"),
cxxflags => add("-m64"),
lib_cppflags => add("-DB_ENDIAN"),
asm_arch => 'ppc64',
perlasm_scheme => "linux64",
multilib => "64",
},
"linux-ppc64le" => {
inherit_from => [ "linux-generic64", asm("ppc64_asm") ],
inherit_from => [ "linux-generic64" ],
cflags => add("-m64"),
cxxflags => add("-m64"),
lib_cppflags => add("-DL_ENDIAN"),
asm_arch => 'ppc64',
perlasm_scheme => "linux64le",
},
@@ -705,43 +746,49 @@ my %targets = (
#
# ./Configure linux-armv4 -march=armv6 -D__ARM_MAX_ARCH__=8
#
inherit_from => [ "linux-generic32", asm("armv4_asm") ],
inherit_from => [ "linux-generic32" ],
asm_arch => 'armv4',
perlasm_scheme => "linux32",
},
"linux-aarch64" => {
inherit_from => [ "linux-generic64", asm("aarch64_asm") ],
inherit_from => [ "linux-generic64" ],
asm_arch => 'aarch64',
perlasm_scheme => "linux64",
},
"linux-arm64ilp32" => { # https://wiki.linaro.org/Platform/arm64-ilp32
inherit_from => [ "linux-generic32", asm("aarch64_asm") ],
inherit_from => [ "linux-generic32" ],
cflags => add("-mabi=ilp32"),
cxxflags => add("-mabi=ilp32"),
bn_ops => "SIXTY_FOUR_BIT RC4_CHAR",
asm_arch => 'aarch64',
perlasm_scheme => "linux64",
},
"linux-mips32" => {
# Configure script adds minimally required -march for assembly
# support, if no -march was specified at command line.
inherit_from => [ "linux-generic32", asm("mips32_asm") ],
inherit_from => [ "linux-generic32" ],
cflags => add("-mabi=32"),
cxxflags => add("-mabi=32"),
asm_arch => 'mips32',
perlasm_scheme => "o32",
},
# mips32 and mips64 below refer to contemporary MIPS Architecture
# specifications, MIPS32 and MIPS64, rather than to kernel bitness.
"linux-mips64" => {
inherit_from => [ "linux-generic32", asm("mips64_asm") ],
inherit_from => [ "linux-generic32" ],
cflags => add("-mabi=n32"),
cxxflags => add("-mabi=n32"),
bn_ops => "SIXTY_FOUR_BIT RC4_CHAR",
asm_arch => 'mips64',
perlasm_scheme => "n32",
multilib => "32",
},
"linux64-mips64" => {
inherit_from => [ "linux-generic64", asm("mips64_asm") ],
inherit_from => [ "linux-generic64" ],
cflags => add("-mabi=64"),
cxxflags => add("-mabi=64"),
asm_arch => 'mips64',
perlasm_scheme => "64",
multilib => "64",
},
@@ -750,13 +797,15 @@ my %targets = (
#### These two targets are a bit aged and are to be used on older Linux
#### machines where gcc doesn't understand -m32 and -m64
"linux-elf" => {
inherit_from => [ "linux-generic32", asm("x86_elf_asm") ],
inherit_from => [ "linux-generic32" ],
CFLAGS => add(picker(release => "-fomit-frame-pointer")),
lib_cppflags => add("-DL_ENDIAN"),
bn_ops => "BN_LLONG",
asm_arch => 'x86',
perlasm_scheme => "elf",
},
"linux-aout" => {
inherit_from => [ "BASE_unix", asm("x86_asm") ],
inherit_from => [ "BASE_unix" ],
CC => "gcc",
CFLAGS => add(picker(default => "-Wall",
debug => "-O0 -g",
@@ -764,17 +813,19 @@ my %targets = (
lib_cppflags => add("-DL_ENDIAN"),
bn_ops => "BN_LLONG",
thread_scheme => "(unknown)",
asm_arch => 'x86',
perlasm_scheme => "a.out",
},
#### X86 / X86_64 targets
"linux-x86" => {
inherit_from => [ "linux-generic32", asm("x86_asm") ],
inherit_from => [ "linux-generic32" ],
CFLAGS => add(picker(release => "-fomit-frame-pointer")),
cflags => add("-m32"),
cxxflags => add("-m32"),
lib_cppflags => add("-DL_ENDIAN"),
bn_ops => "BN_LLONG",
asm_arch => 'x86',
perlasm_scheme => "elf",
},
"linux-x86-clang" => {
@@ -783,11 +834,12 @@ my %targets = (
CXX => "clang++",
},
"linux-x86_64" => {
inherit_from => [ "linux-generic64", asm("x86_64_asm") ],
inherit_from => [ "linux-generic64" ],
cflags => add("-m64"),
cxxflags => add("-m64"),
lib_cppflags => add("-DL_ENDIAN"),
bn_ops => "SIXTY_FOUR_BIT_LONG",
asm_arch => 'x86_64',
perlasm_scheme => "elf",
multilib => "64",
},
@@ -797,25 +849,29 @@ my %targets = (
CXX => "clang++",
},
"linux-x32" => {
inherit_from => [ "linux-generic32", asm("x86_64_asm") ],
inherit_from => [ "linux-generic32" ],
cflags => add("-mx32"),
cxxflags => add("-mx32"),
lib_cppflags => add("-DL_ENDIAN"),
bn_ops => "SIXTY_FOUR_BIT",
asm_arch => 'x86_64',
perlasm_scheme => "elf32",
multilib => "x32",
},
"linux-ia64" => {
inherit_from => [ "linux-generic64", asm("ia64_asm") ],
inherit_from => [ "linux-generic64" ],
bn_ops => "SIXTY_FOUR_BIT_LONG",
asm_arch => 'ia64',
perlasm_scheme => 'void',
},
"linux64-s390x" => {
inherit_from => [ "linux-generic64", asm("s390x_asm") ],
inherit_from => [ "linux-generic64" ],
cflags => add("-m64"),
cxxflags => add("-m64"),
lib_cppflags => add("-DB_ENDIAN"),
asm_arch => 's390x',
perlasm_scheme => "64",
multilib => "64",
},
@@ -836,44 +892,52 @@ my %targets = (
# yet, because of couple of bugs in glibc
# sysdeps/s390/dl-procinfo.c affecting ldconfig and ld.so.1...
#
inherit_from => [ "linux-generic32", asm("s390x_asm") ],
inherit_from => [ "linux-generic32" ],
cflags => add("-m31 -Wa,-mzarch"),
cxxflags => add("-m31 -Wa,-mzarch"),
lib_cppflags => add("-DB_ENDIAN"),
bn_asm_src => sub { my $r=join(" ",@_); $r=~s|asm/s390x\.S|bn_asm.c|; $r; },
asm_arch => 's390x',
perlasm_scheme => "31",
multilib => "/highgprs",
},
#### SPARC Linux setups
"linux-sparcv8" => {
inherit_from => [ "linux-generic32", asm("sparcv8_asm") ],
inherit_from => [ "linux-generic32" ],
cflags => add("-mcpu=v8"),
cxxflags => add("-mcpu=v8"),
lib_cppflags => add("-DB_ENDIAN -DBN_DIV2W"),
asm_arch => 'sparcv8',
perlasm_scheme => 'void',
},
"linux-sparcv9" => {
# it's a real mess with -mcpu=ultrasparc option under Linux,
# but -Wa,-Av8plus should do the trick no matter what.
inherit_from => [ "linux-generic32", asm("sparcv9_asm") ],
inherit_from => [ "linux-generic32" ],
cflags => add("-m32 -mcpu=ultrasparc -Wa,-Av8plus"),
cxxflags => add("-m32 -mcpu=ultrasparc -Wa,-Av8plus"),
lib_cppflags => add("-DB_ENDIAN -DBN_DIV2W"),
asm_arch => 'sparcv9',
perlasm_scheme => 'void',
},
"linux64-sparcv9" => {
# GCC 3.1 is a requirement
inherit_from => [ "linux-generic64", asm("sparcv9_asm") ],
inherit_from => [ "linux-generic64" ],
cflags => add("-m64 -mcpu=ultrasparc"),
cxxflags => add("-m64 -mcpu=ultrasparc"),
lib_cppflags => add("-DB_ENDIAN"),
bn_ops => "BN_LLONG RC4_CHAR",
asm_arch => 'sparcv9',
perlasm_scheme => 'void',
multilib => "64",
},
"linux-alpha-gcc" => {
inherit_from => [ "linux-generic64", asm("alpha_asm") ],
inherit_from => [ "linux-generic64" ],
lib_cppflags => add("-DL_ENDIAN"),
bn_ops => "SIXTY_FOUR_BIT_LONG",
asm_arch => 'alpha',
perlasm_scheme => "void",
},
"linux-c64xplus" => {
inherit_from => [ "BASE_unix" ],
@@ -885,15 +949,8 @@ my %targets = (
cppflags => combine("-DOPENSSL_SMALL_FOOTPRINT",
threads("-D_REENTRANT")),
bn_ops => "BN_LLONG",
cpuid_asm_src => "c64xpluscpuid.s",
bn_asm_src => "asm/bn-c64xplus.asm c64xplus-gf2m.s",
aes_asm_src => "aes-c64xplus.s aes_cbc.c aes-ctr.fake",
sha1_asm_src => "sha1-c64xplus.s sha256-c64xplus.s sha512-c64xplus.s",
rc4_asm_src => "rc4-c64xplus.s",
modes_asm_src => "ghash-c64xplus.s",
chacha_asm_src => "chacha-c64xplus.s",
poly1305_asm_src => "poly1305-c64xplus.s",
thread_scheme => "pthreads",
asm_arch => 'c64xplus',
perlasm_scheme => "void",
dso_scheme => "dlfcn",
shared_target => "linux-shared",
@@ -932,11 +989,12 @@ my %targets = (
},
"BSD-x86" => {
inherit_from => [ "BSD-generic32", asm("x86_asm") ],
inherit_from => [ "BSD-generic32" ],
CFLAGS => add(picker(release => "-fomit-frame-pointer")),
lib_cppflags => add("-DL_ENDIAN"),
bn_ops => "BN_LLONG",
shared_target => "bsd-shared",
asm_arch => 'x86',
perlasm_scheme => "a.out",
},
"BSD-x86-elf" => {
@@ -945,62 +1003,54 @@ my %targets = (
},
"BSD-sparcv8" => {
inherit_from => [ "BSD-generic32", asm("sparcv8_asm") ],
inherit_from => [ "BSD-generic32" ],
cflags => add("-mcpu=v8"),
lib_cppflags => add("-DB_ENDIAN"),
asm_arch => 'sparcv8',
perlasm_scheme => 'void',
},
"BSD-sparc64" => {
# -DMD32_REG_T=int doesn't actually belong in sparc64 target, it
# simply *happens* to work around a compiler bug in gcc 3.3.3,
# triggered by RIPEMD160 code.
inherit_from => [ "BSD-generic64", asm("sparcv9_asm") ],
inherit_from => [ "BSD-generic64" ],
lib_cppflags => add("-DB_ENDIAN -DMD32_REG_T=int"),
bn_ops => "BN_LLONG",
asm_arch => 'sparcv9',
perlasm_scheme => 'void',
},
"BSD-ia64" => {
inherit_from => [ "BSD-generic64", asm("ia64_asm") ],
inherit_from => [ "BSD-generic64" ],
lib_cppflags => add("-DL_ENDIAN"),
bn_ops => "SIXTY_FOUR_BIT_LONG",
asm_arch => 'ia64',
perlasm_scheme => 'void',
},
"BSD-x86_64" => {
inherit_from => [ "BSD-generic64", asm("x86_64_asm") ],
inherit_from => [ "BSD-generic64" ],
lib_cppflags => add("-DL_ENDIAN"),
bn_ops => "SIXTY_FOUR_BIT_LONG",
asm_arch => 'x86_64',
perlasm_scheme => "elf",
},
"bsdi-elf-gcc" => {
inherit_from => [ "BASE_unix", asm("x86_elf_asm") ],
inherit_from => [ "BASE_unix" ],
CC => "gcc",
CFLAGS => "-fomit-frame-pointer -O3 -Wall",
lib_cppflags => "-DPERL5 -DL_ENDIAN",
ex_libs => add("-ldl"),
bn_ops => "BN_LLONG",
asm_arch => 'x86',
perlasm_scheme => "elf",
thread_scheme => "(unknown)",
dso_scheme => "dlfcn",
shared_target => "bsd-gcc-shared",
shared_cflag => "-fPIC",
},
"nextstep" => {
inherit_from => [ "BASE_unix" ],
CC => "cc",
CFLAGS => "-O -Wall",
unistd => "<libc.h>",
bn_ops => "BN_LLONG",
thread_scheme => "(unknown)",
},
"nextstep3.3" => {
inherit_from => [ "BASE_unix" ],
CC => "cc",
CFLAGS => "-O3 -Wall",
unistd => "<libc.h>",
bn_ops => "BN_LLONG",
thread_scheme => "(unknown)",
},
#### SCO/Caldera targets.
#
# Originally we had like unixware-*, unixware-*-pentium, unixware-*-p6, etc.
@@ -1030,7 +1080,7 @@ my %targets = (
thread_scheme => "uithreads",
},
"unixware-7" => {
inherit_from => [ "BASE_unix", asm("x86_elf_asm") ],
inherit_from => [ "BASE_unix" ],
CC => "cc",
CFLAGS => "-O",
cflags => combine("-Kalloca", threads("-Kthread")),
@@ -1038,13 +1088,14 @@ my %targets = (
ex_libs => add("-lsocket -lnsl"),
thread_scheme => "uithreads",
bn_ops => "BN_LLONG",
asm_arch => 'x86',
perlasm_scheme => "elf-1",
dso_scheme => "dlfcn",
shared_target => "svr5-shared",
shared_cflag => "-Kpic",
},
"unixware-7-gcc" => {
inherit_from => [ "BASE_unix", asm("x86_elf_asm") ],
inherit_from => [ "BASE_unix" ],
CC => "gcc",
CFLAGS => "-O3 -fomit-frame-pointer -Wall",
cppflags => add(threads("-D_REENTRANT")),
@@ -1052,6 +1103,7 @@ my %targets = (
ex_libs => add("-lsocket -lnsl"),
bn_ops => "BN_LLONG",
thread_scheme => "pthreads",
asm_arch => 'x86',
perlasm_scheme => "elf-1",
dso_scheme => "dlfcn",
shared_target => "gnu-shared",
@@ -1059,23 +1111,25 @@ my %targets = (
},
# SCO 5 - Ben Laurie says the -O breaks the SCO cc.
"sco5-cc" => {
inherit_from => [ "BASE_unix", asm("x86_elf_asm") ],
inherit_from => [ "BASE_unix" ],
cc => "cc",
cflags => "-belf",
ex_libs => add("-lsocket -lnsl"),
thread_scheme => "(unknown)",
asm_arch => 'x86',
perlasm_scheme => "elf-1",
dso_scheme => "dlfcn",
shared_target => "svr3-shared",
shared_cflag => "-Kpic",
},
"sco5-gcc" => {
inherit_from => [ "BASE_unix", asm("x86_elf_asm") ],
inherit_from => [ "BASE_unix" ],
cc => "gcc",
cflags => "-O3 -fomit-frame-pointer",
ex_libs => add("-lsocket -lnsl"),
bn_ops => "BN_LLONG",
thread_scheme => "(unknown)",
asm_arch => 'x86',
perlasm_scheme => "elf-1",
dso_scheme => "dlfcn",
shared_target => "svr3-shared",
@@ -1097,32 +1151,34 @@ my %targets = (
thread_scheme => "pthreads",
dso_scheme => "dlfcn",
shared_target => "aix",
module_ldflags => "-Wl,-G,-bsymbolic,-bexpall",
module_ldflags => "-Wl,-G,-bsymbolic,-bnoentry",
shared_ldflag => "-Wl,-G,-bsymbolic,-bnoentry",
shared_defflag => "-Wl,-bE:",
perl_platform => 'AIX',
},
"aix-gcc" => {
inherit_from => [ "aix-common", asm("ppc32_asm") ],
inherit_from => [ "aix-common" ],
CC => "gcc",
CFLAGS => picker(debug => "-O0 -g",
release => "-O"),
cflags => add(threads("-pthread")),
ex_libs => threads("-pthread"),
bn_ops => "BN_LLONG RC4_CHAR",
asm_arch => 'ppc32',
perlasm_scheme => "aix32",
shared_ldflag => add_before("-shared -static-libgcc"),
AR => add("-X32"),
RANLIB => add("-X32"),
},
"aix64-gcc" => {
inherit_from => [ "aix-common", asm("ppc64_asm") ],
inherit_from => [ "aix-common" ],
CC => "gcc",
CFLAGS => picker(debug => "-O0 -g",
release => "-O"),
cflags => combine("-maix64", threads("-pthread")),
ex_libs => threads("-pthread"),
bn_ops => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
asm_arch => 'ppc64',
perlasm_scheme => "aix64",
shared_ldflag => add_before("-shared -static-libgcc"),
shared_extension => "64.so.\$(SHLIB_VERSION_NUMBER)",
@@ -1130,7 +1186,7 @@ my %targets = (
RANLIB => add("-X64"),
},
"aix-cc" => {
inherit_from => [ "aix-common", asm("ppc32_asm") ],
inherit_from => [ "aix-common" ],
CC => "cc",
CFLAGS => picker(debug => "-O0 -g",
release => "-O"),
@@ -1139,13 +1195,14 @@ my %targets = (
cppflags => threads("-D_THREAD_SAFE"),
ex_libs => threads("-lpthreads"),
bn_ops => "BN_LLONG RC4_CHAR",
asm_arch => 'ppc32',
perlasm_scheme => "aix32",
shared_cflag => "-qpic",
AR => add("-X32"),
RANLIB => add("-X32"),
},
"aix64-cc" => {
inherit_from => [ "aix-common", asm("ppc64_asm") ],
inherit_from => [ "aix-common" ],
CC => "cc",
CFLAGS => picker(debug => "-O0 -g",
release => "-O"),
@@ -1154,6 +1211,7 @@ my %targets = (
cppflags => threads("-D_THREAD_SAFE"),
ex_libs => threads("-lpthreads"),
bn_ops => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
asm_arch => 'ppc64',
perlasm_scheme => "aix64",
dso_scheme => "dlfcn",
shared_cflag => "-qpic",
@@ -1216,8 +1274,6 @@ my %targets = (
shared_target => "win-shared", # meaningless except it gives Configure a hint
thread_scheme => "winthreads",
dso_scheme => "win32",
apps_aux_src => add("win32_init.c"),
bn_ops => "EXPORT_VAR_AS_FN",
perl_platform => 'Windows::MSVC',
# additional parameter to build_scheme denotes install-path "flavour"
build_scheme => add("VC-common", { separator => undef }),
@@ -1272,33 +1328,30 @@ my %targets = (
bn_ops => add("SIXTY_FOUR_BIT"),
},
"VC-WIN64I" => {
inherit_from => [ "VC-WIN64-common", asm("ia64_asm"),
sub { $disabled{shared} ? () : "ia64_uplink" } ],
inherit_from => [ "VC-WIN64-common" ],
AS => "ias",
ASFLAGS => "-d debug",
asoutflag => "-o ",
sys_id => "WIN64I",
bn_asm_src => sub { return undef unless @_;
my $r=join(" ",@_); $r=~s|bn-ia64.s|bn_asm.c|; $r; },
uplink_arch => 'ia64',
asm_arch => 'ia64',
perlasm_scheme => "ias",
multilib => "-ia64",
},
"VC-WIN64A" => {
inherit_from => [ "VC-WIN64-common", asm("x86_64_asm"),
sub { $disabled{shared} ? () : "x86_64_uplink" } ],
inherit_from => [ "VC-WIN64-common" ],
AS => sub { vc_win64a_info()->{AS} },
ASFLAGS => sub { vc_win64a_info()->{ASFLAGS} },
asoutflag => sub { vc_win64a_info()->{asoutflag} },
asflags => sub { vc_win64a_info()->{asflags} },
sys_id => "WIN64A",
bn_asm_src => sub { return undef unless @_;
my $r=join(" ",@_); $r=~s|asm/x86_64-gcc|bn_asm|; $r; },
uplink_arch => 'x86_64',
asm_arch => 'x86_64',
perlasm_scheme => "auto",
multilib => "-x64",
},
"VC-WIN32" => {
inherit_from => [ "VC-noCE-common", asm("x86_asm"),
sub { $disabled{shared} ? () : "uplink_common" } ],
inherit_from => [ "VC-noCE-common" ],
CFLAGS => add("/WX"),
AS => sub { vc_win32_info()->{AS} },
ASFLAGS => sub { vc_win32_info()->{ASFLAGS} },
@@ -1306,6 +1359,8 @@ my %targets = (
asflags => sub { vc_win32_info()->{asflags} },
sys_id => "WIN32",
bn_ops => add("BN_LLONG"),
uplink_arch => 'common',
asm_arch => 'x86',
perlasm_scheme => sub { vc_win32_info()->{perlasm_scheme} },
# "WOW" stands for "Windows on Windows", and "VC-WOW" engages
# some installation path heuristics in windows-makefile.tmpl...
@@ -1370,40 +1425,41 @@ my %targets = (
threads("-D_MT")),
lib_cppflags => "-DL_ENDIAN",
ex_libs => add("-lws2_32 -lgdi32 -lcrypt32"),
bn_ops => "EXPORT_VAR_AS_FN",
thread_scheme => "winthreads",
dso_scheme => "win32",
shared_target => "mingw-shared",
shared_cppflags => add("_WINDLL"),
shared_ldflag => "-static-libgcc",
apps_aux_src => add("win32_init.c"),
perl_platform => 'mingw',
},
"mingw" => {
inherit_from => [ "mingw-common", asm("x86_asm"),
sub { $disabled{shared} ? () : "x86_uplink" } ],
inherit_from => [ "mingw-common" ],
CFLAGS => add(picker(release => "-fomit-frame-pointer")),
cflags => "-m32",
sys_id => "MINGW32",
bn_ops => add("BN_LLONG"),
asm_arch => 'x86',
uplink_arch => 'x86',
perlasm_scheme => "coff",
shared_rcflag => "--target=pe-i386",
multilib => "",
},
"mingw64" => {
# As for OPENSSL_USE_APPLINK. Applink makes it possible to use
# As for uplink_arch. Applink makes it possible to use
# .dll compiled with one compiler with application compiled with
# another compiler. It's possible to engage Applink support in
# mingw64 build, but it's not done, because till mingw64
# mingw64 build, but it's not done, because until mingw64
# supports structured exception handling, one can't seriously
# consider its binaries for using with non-mingw64 run-time
# environment. And as mingw64 is always consistent with itself,
# Applink is never engaged and can as well be omitted.
inherit_from => [ "mingw-common", asm("x86_64_asm") ],
inherit_from => [ "mingw-common" ],
cflags => "-m64",
sys_id => "MINGW64",
bn_ops => add("SIXTY_FOUR_BIT"),
asm_arch => 'x86_64',
uplink_arch => undef,
perlasm_scheme => "mingw64",
shared_rcflag => "--target=pe-x86-64",
multilib => "64",
@@ -1448,15 +1504,17 @@ my %targets = (
perl_platform => 'Cygwin',
},
"Cygwin-x86" => {
inherit_from => [ "Cygwin-common", asm("x86_asm") ],
inherit_from => [ "Cygwin-common" ],
CFLAGS => add(picker(release => "-O3 -fomit-frame-pointer")),
bn_ops => "BN_LLONG",
asm_arch => 'x86',
perlasm_scheme => "coff",
},
"Cygwin-x86_64" => {
inherit_from => [ "Cygwin-common", asm("x86_64_asm") ],
inherit_from => [ "Cygwin-common" ],
CC => "gcc",
bn_ops => "SIXTY_FOUR_BIT_LONG",
asm_arch => 'x86_64',
perlasm_scheme => "mingw64",
},
# Backward compatibility for those using this target
@@ -1500,46 +1558,51 @@ my %targets = (
# with future defaults for below two targets, because MacOS X
# for PPC has no future, it was discontinued by vendor in 2009.
"darwin-ppc-cc" => {
inherit_from => [ "darwin-common", asm("ppc32_asm") ],
inherit_from => [ "darwin-common" ],
cflags => add("-arch ppc -std=gnu9x -Wa,-force_cpusubtype_ALL"),
lib_cppflags => add("-DB_ENDIAN"),
shared_cflag => add("-fno-common"),
asm_arch => 'ppc32',
perlasm_scheme => "osx32",
},
"darwin64-ppc-cc" => {
inherit_from => [ "darwin-common", asm("ppc64_asm") ],
inherit_from => [ "darwin-common" ],
cflags => add("-arch ppc64 -std=gnu9x"),
lib_cppflags => add("-DB_ENDIAN"),
bn_ops => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
asm_arch => 'ppc64',
perlasm_scheme => "osx64",
},
"darwin-i386-cc" => {
inherit_from => [ "darwin-common", asm("x86_asm") ],
inherit_from => [ "darwin-common" ],
CFLAGS => add(picker(release => "-fomit-frame-pointer")),
cflags => add("-arch i386"),
lib_cppflags => add("-DL_ENDIAN"),
bn_ops => "BN_LLONG RC4_INT",
asm_arch => 'x86',
perlasm_scheme => "macosx",
},
"darwin64-x86_64-cc" => {
inherit_from => [ "darwin-common", asm("x86_64_asm") ],
inherit_from => [ "darwin-common" ],
CFLAGS => add("-Wall"),
cflags => add("-arch x86_64"),
lib_cppflags => add("-DL_ENDIAN"),
bn_ops => "SIXTY_FOUR_BIT_LONG",
asm_arch => 'x86_64',
perlasm_scheme => "macosx",
},
##### GNU Hurd
"hurd-x86" => {
inherit_from => [ "BASE_unix" ],
inherit_from => [ asm("x86_elf_asm") ],
CC => "gcc",
CFLAGS => "-O3 -fomit-frame-pointer -Wall",
cflags => threads("-pthread"),
lib_cppflags => "-DL_ENDIAN",
ex_libs => add("-ldl", threads("-pthread")),
bn_ops => "BN_LLONG",
asm_arch => 'x86',
perlasm_scheme => 'elf',
thread_scheme => "pthreads",
dso_scheme => "dlfcn",
shared_target => "linux-shared",
@@ -1629,7 +1692,7 @@ my %targets = (
ranlib => "ranlibpentium",
},
"vxworks-mips" => {
inherit_from => [ "BASE_unix", asm("mips32_asm") ],
inherit_from => [ "BASE_unix" ],
CC => "ccmips",
CFLAGS => "-O -G 0",
cflags => "-mrtp -mips2 -B\$(WIND_BASE)/host/\$(WIND_HOST_TYPE)/lib/gcc-lib/ -msoft-float -mno-branch-likely -fno-builtin -fno-defer-pop",
@@ -1644,6 +1707,7 @@ my %targets = (
lflags => add("-L \$(WIND_BASE)/target/usr/lib/mips/MIPSI32/sfcommon"),
ex_libs => add("-Wl,--defsym,__wrs_rtp_base=0xe0000000"),
thread_scheme => "pthreads",
asm_arch => 'mips32',
perlasm_scheme => "o32",
ranlib => "ranlibmips",
},
@@ -1725,8 +1789,6 @@ my %targets = (
disable => add('pinshared'),
apps_aux_src => "vms_term_sock.c vms_decc_argv.c",
apps_init_src => "vms_decc_init.c",
},
# From HELP CC/POINTER_SIZE:
@@ -1759,13 +1821,12 @@ my %targets = (
pointer_size => "64",
},
"vms-ia64" => {
inherit_from => [ "vms-generic",
sub { vms_info()->{AS}
? asm("ia64_asm")->() : () } ],
inherit_from => [ "vms-generic" ],
bn_ops => "SIXTY_FOUR_BIT RC4_INT",
asm_arch => sub { vms_info()->{AS} ? 'ia64' : undef },
perlasm_scheme => 'ias',
pointer_size => "",
modes_asm_src => "", # Because ghash-ia64.s doesn't work on VMS
},
"vms-ia64-p32" => {
inherit_from => [ "vms-ia64" ],
Configurations/15-android.conf
+13 -6
View File
@@ -199,18 +199,22 @@ my %targets = (
# -march and/or -mfloat-abi flags. NDK defaults to armv5te.
# Newer NDK versions reportedly require additional -latomic.
#
inherit_from => [ "android", asm("armv4_asm") ],
inherit_from => [ "android" ],
bn_ops => add("RC4_CHAR"),
asm_arch => 'armv4',
perlasm_scheme => "void",
},
"android-arm64" => {
inherit_from => [ "android", asm("aarch64_asm") ],
inherit_from => [ "android" ],
bn_ops => add("RC4_CHAR"),
asm_arch => 'aarch64',
perlasm_scheme => "linux64",
},
"android-mips" => {
inherit_from => [ "android", asm("mips32_asm") ],
inherit_from => [ "android" ],
bn_ops => add("RC4_CHAR"),
asm_arch => 'mips32',
perlasm_scheme => "o32",
},
"android-mips64" => {
@@ -223,20 +227,23 @@ my %targets = (
# with previous MIPS ISA versions, in sense that unlike
# prior versions original MIPS binary code will fail.
#
inherit_from => [ "android", asm("mips64_asm") ],
inherit_from => [ "android" ],
bn_ops => add("RC4_CHAR"),
asm_arch => 'mips64',
perlasm_scheme => "64",
},
"android-x86" => {
inherit_from => [ "android", asm("x86_asm") ],
inherit_from => [ "android" ],
CFLAGS => add(picker(release => "-fomit-frame-pointer")),
bn_ops => add("RC4_INT"),
asm_arch => 'x86',
perlasm_scheme => "android",
},
"android-x86_64" => {
inherit_from => [ "android", asm("x86_64_asm") ],
inherit_from => [ "android" ],
bn_ops => add("RC4_INT"),
asm_arch => 'x86_64',
perlasm_scheme => "elf",
},
Configurations/15-ios.conf
+5 -3
View File
@@ -1,6 +1,6 @@
#### iPhoneOS/iOS
#
# It takes recent enough XCode to use following two targets. It shouldn't
# It takes recent enough Xcode to use following two targets. It shouldn't
# be a problem by now, but if they don't work, original targets below
# that depend on manual definition of environment variables should still
# work...
@@ -13,19 +13,21 @@ my %targets = (
disable => [ "engine", "async" ],
},
"ios-xcrun" => {
inherit_from => [ "ios-common", asm("armv4_asm") ],
inherit_from => [ "ios-common" ],
# It should be possible to go below iOS 6 and even add -arch armv6,
# thus targeting iPhone pre-3GS, but it's assumed to be irrelevant
# at this point.
CC => "xcrun -sdk iphoneos cc",
cflags => add("-arch armv7 -mios-version-min=6.0.0 -fno-common"),
asm_arch => 'armv4',
perlasm_scheme => "ios32",
},
"ios64-xcrun" => {
inherit_from => [ "ios-common", asm("aarch64_asm") ],
inherit_from => [ "ios-common" ],
CC => "xcrun -sdk iphoneos cc",
cflags => add("-arch arm64 -mios-version-min=7.0.0 -fno-common"),
bn_ops => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
asm_arch => 'aarch64',
perlasm_scheme => "ios64",
},
"iossimulator-xcrun" => {
Configurations/50-djgpp.conf
+1 -1
View File
@@ -4,7 +4,6 @@
my %targets = (
"DJGPP" => {
inherit_from => [ asm("x86_asm") ],
CC => "gcc",
CFLAGS => "-fomit-frame-pointer -O2 -Wall",
cflags => "-I/dev/env/WATT_ROOT/inc -DTERMIOS -DL_ENDIAN",
@@ -12,6 +11,7 @@ my %targets = (
lflags => add("-L/dev/env/WATT_ROOT/lib"),
ex_libs => add("-lwatt"),
bn_ops => "BN_LLONG",
asm_arch => 'x86',
perlasm_scheme => "a.out",
},
);
Configurations/50-haiku.conf
+3 -1
View File
@@ -18,9 +18,11 @@ my %targets = (
perl_platform => 'Unix',
},
"haiku-x86" => {
inherit_from => [ "haiku-common", asm("x86_elf_asm") ],
inherit_from => [ "haiku-common" ],
CFLAGS => add(picker(release => "-fomit-frame-pointer")),
bn_ops => "BN_LLONG",
asm_arch => 'x86',
perlasm_scheme => 'elf',
},
"haiku-x86_64" => {
inherit_from => [ "haiku-common" ],
Configurations/50-masm.conf
+3 -4
View File
@@ -9,15 +9,14 @@
my %targets = (
"VC-WIN64A-masm" => {
inherit_from => [ "VC-WIN64-common", asm("x86_64_asm"),
sub { $disabled{shared} ? () : "x86_64_uplink" } ],
inherit_from => [ "VC-WIN64-common" ],
AS => "ml64",
ASFLAGS => "/nologo /Zi",
asoutflag => "/Fo",
asflags => "/c /Cp /Cx",
sys_id => "WIN64A",
bn_asm_src => sub { return undef unless @_;
my $r=join(" ",@_); $r=~s|asm/x86_64-gcc|bn_asm|; $r; },
uplink_arch => 'x86_64',
asm_arch => 'x86_64',
perlasm_scheme => "masm",
},
);
Configurations/50-win-onecore.conf
+52 -3
View File
@@ -1,6 +1,6 @@
# Windows OneCore targets.
#
# OneCore is new API stability "contract" that transends Desktop, IoT and
# OneCore is new API stability "contract" that transcends Desktop, IoT and
# Mobile[?] Windows editions. It's a set up "umbrella" libraries that
# export subset of Win32 API that are common to all Windows 10 devices.
#
@@ -47,7 +47,7 @@ my %targets = (
inherit_from => [ "VC-noCE-common" ],
defines => add("_ARM_WINAPI_PARTITION_DESKTOP_SDK_AVAILABLE",
"OPENSSL_SYS_WIN_CORE"),
bn_ops => "BN_LLONG RC4_CHAR EXPORT_VAR_AS_FN",
bn_ops => "BN_LLONG RC4_CHAR",
lflags => add("/NODEFAULTLIB:kernel32.lib"),
ex_libs => "onecore.lib",
multilib => "-arm",
@@ -56,9 +56,58 @@ my %targets = (
inherit_from => [ "VC-noCE-common" ],
defines => add("_ARM_WINAPI_PARTITION_DESKTOP_SDK_AVAILABLE",
"OPENSSL_SYS_WIN_CORE"),
bn_ops => "SIXTY_FOUR_BIT RC4_CHAR EXPORT_VAR_AS_FN",
bn_ops => "SIXTY_FOUR_BIT RC4_CHAR",
lflags => add("/NODEFAULTLIB:kernel32.lib"),
ex_libs => "onecore.lib",
multilib => "-arm64",
},
# Universal Windows Platform (UWP) App Support
# TODO
#
# The 'disable' attribute should have 'uplink'.
# however, these are checked in some 'inherit_from', which is processed
# very early, before the 'disable' attributes are seen.
# This is a problem that needs to be resolved in Configure first.
#
# But if you want to build library with Windows 10 Version 1809 SDK or
# earlier, the 'disable' attribute should also have 'asm'.
"VC-WIN32-UWP" => {
inherit_from => [ "VC-WIN32-ONECORE" ],
lflags => add("/APPCONTAINER"),
defines => add("WINAPI_FAMILY=WINAPI_FAMILY_APP",
"_WIN32_WINNT=0x0A00"),
dso_scheme => "",
disable => [ 'ui-console', 'stdio', 'async', 'uplink' ],
ex_libs => "WindowsApp.lib",
},
"VC-WIN64A-UWP" => {
inherit_from => [ "VC-WIN64A-ONECORE" ],
lflags => add("/APPCONTAINER"),
defines => add("WINAPI_FAMILY=WINAPI_FAMILY_APP",
"_WIN32_WINNT=0x0A00"),
dso_scheme => "",
disable => [ 'ui-console', 'stdio', 'async', 'uplink' ],
ex_libs => "WindowsApp.lib",
},
"VC-WIN32-ARM-UWP" => {
inherit_from => [ "VC-WIN32-ARM" ],
lflags => add("/APPCONTAINER"),
defines => add("WINAPI_FAMILY=WINAPI_FAMILY_APP",
"_WIN32_WINNT=0x0A00"),
dso_scheme => "",
disable => [ 'ui-console', 'stdio', 'async', 'uplink' ],
ex_libs => "WindowsApp.lib",
},
"VC-WIN64-ARM-UWP" => {
inherit_from => [ "VC-WIN64-ARM" ],
lflags => add("/APPCONTAINER"),
defines => add("WINAPI_FAMILY=WINAPI_FAMILY_APP",
"_WIN32_WINNT=0x0A00"),
dso_scheme => "",
disable => [ 'ui-console', 'stdio', 'async', 'uplink' ],
ex_libs => "WindowsApp.lib",
},
);
Configurations/90-team.norelease.conf
+9 -29
View File
@@ -24,6 +24,7 @@ my %targets = (
ex_libs => add(" ","-ldl"),
bn_ops => "SIXTY_FOUR_BIT_LONG",
thread_scheme => "pthreads",
asm_arch => 'x86_64',
perlasm_scheme => "elf",
dso_scheme => "dlfcn",
shared_target => "linux-shared",
@@ -38,6 +39,8 @@ my %targets = (
threads("-D_REENTRANT")),
ex_libs => add(" ","-ldl"),
bn_ops => "BN_LLONG",
asm_arch => 'x86',
perlasm_scheme => 'elf',
thread_scheme => "pthreads",
dso_scheme => "dlfcn",
},
@@ -48,44 +51,20 @@ my %targets = (
threads("-D_REENTRANT")),
ex_libs => add(" ","-ldl"),
bn_ops => "BN_LLONG",
asm_arch => 'x86',
perlasm_scheme => 'elf',
thread_scheme => "pthreads",
dso_scheme => "dlfcn",
},
"debug-linux-ia32-aes" => {
inherit_from => [ 'BASE_unix' ],
cc => "gcc",
cflags => combine("-DL_ENDIAN -O3 -fomit-frame-pointer -Wall",
threads("-D_REENTRANT")),
ex_libs => add(" ","-ldl"),
bn_ops => "BN_LLONG",
cpuid_asm_src => "x86cpuid.s",
bn_asm_src => "bn-586.s co-586.s x86-mont.s",
des_asm_src => "des-586.s crypt586.s",
aes_asm_src => "aes_x86core.s aes_cbc.s aesni-x86.s",
bf_asm_src => "bf-586.s",
md5_asm_src => "md5-586.s",
sha1_asm_src => "sha1-586.s sha256-586.s sha512-586.s",
cast_asm_src => "cast-586.s",
rc4_asm_src => "rc4-586.s",
rmd160_asm_src => "rmd-586.s",
rc5_asm_src => "rc5-586.s",
wp_asm_src => "wp_block.s wp-mmx.s",
modes_asm_src => "ghash-x86.s",
padlock_asm_src => "e_padlock-x86.s",
thread_scheme => "pthreads",
perlasm_scheme => "elf",
dso_scheme => "dlfcn",
shared_target => "linux-shared",
shared_cflag => "-fPIC",
},
"debug-test-64-clang" => {
inherit_from => [ 'BASE_unix', "x86_64_asm" ],
cc => "clang",
cflags => combine(join(' ', @gcc_devteam_warn),
"-Wno-error=overlength-strings -Wno-error=extended-offsetof -Wno-error=language-extension-token -Wno-error=unused-const-variable -Wstrict-overflow -Qunused-arguments -DBN_DEBUG -DCONF_DEBUG -DDEBUG_SAFESTACK -DDEBUG_UNUSED -g3 -O3 -pipe",
"-Wno-error=overlength-strings -Wno-error=extended-offsetof -Wno-error=language-extension-token -Wno-error=unused-const-variable -Wstrict-overflow -Qunused-arguments -DBN_DEBUG -DCONF_DEBUG -DDEBUG_UNUSED -g3 -O3 -pipe",
threads("${BSDthreads}")),
bn_ops => "SIXTY_FOUR_BIT_LONG",
thread_scheme => "pthreads",
asm_arch => 'x86_64',
perlasm_scheme => "elf",
dso_scheme => "dlfcn",
shared_target => "bsd-gcc-shared",
@@ -96,11 +75,12 @@ my %targets = (
cc => "clang",
cflags => combine("-arch x86_64 -DL_ENDIAN",
join(' ', @gcc_devteam_warn),
"-Wno-error=overlength-strings -Wno-error=extended-offsetof -Wno-error=language-extension-token -Wno-error=unused-const-variable -Wstrict-overflow -Qunused-arguments -DBN_DEBUG -DCONF_DEBUG -DDEBUG_SAFESTACK -DDEBUG_UNUSED -g3 -O3 -pipe",
"-Wno-error=overlength-strings -Wno-error=extended-offsetof -Wno-error=language-extension-token -Wno-error=unused-const-variable -Wstrict-overflow -Qunused-arguments -DBN_DEBUG -DCONF_DEBUG -DDEBUG_UNUSED -g3 -O3 -pipe",
threads("${BSDthreads}")),
sys_id => "MACOSX",
bn_ops => "SIXTY_FOUR_BIT_LONG",
thread_scheme => "pthreads",
asm_arch => 'x86_64',
perlasm_scheme => "macosx",
dso_scheme => "dlfcn",
shared_target => "darwin-shared",
Configurations/README
+7 -57
View File
@@ -165,6 +165,13 @@ In each table entry, the following keys are significant:
that use dlopen() et al but do not have
fcntl.h), "DL" (shl_load() et al), "WIN32"
and "VMS".
asm_arch => The architecture to be used for compiling assembly
source. This acts as a selector in build.info files.
uplink_arch => The architecture to be used for compiling uplink
source. This acts as a selector in build.info files.
This is separate from asm_arch because it's compiled
even when 'no-asm' is given, even though it contains
assembler source.
perlasm_scheme => The perlasm method used to create the
assembler files used when compiling with
assembler implementations.
@@ -229,63 +236,6 @@ In each table entry, the following keys are significant:
up of 'unsigned char's;
RC4_INT RC4 key schedule is made
up of 'unsigned int's;
EXPORT_VAR_AS_FN for shared libraries,
export vars as
accessor functions.
apps_aux_src => Extra source to build apps/openssl and other
apps, as needed by the target and that can be
collected in a library.
apps_init_src => Init source to build apps/openssl and other
apps, as needed by the target. This code
cannot be placed in a library, as the rest
of the code isn't expected to link to it
explicitly.
cpuid_asm_src => assembler implementation of cpuid code as
well as OPENSSL_cleanse().
Default to mem_clr.c
bn_asm_src => Assembler implementation of core bignum
functions.
Defaults to bn_asm.c
ec_asm_src => Assembler implementation of core EC
functions.
des_asm_src => Assembler implementation of core DES
encryption functions.
Defaults to 'des_enc.c fcrypt_b.c'
aes_asm_src => Assembler implementation of core AES
functions.
Defaults to 'aes_core.c aes_cbc.c'
bf_asm_src => Assembler implementation of core BlowFish
functions.
Defaults to 'bf_enc.c'
md5_asm_src => Assembler implementation of core MD5
functions.
sha1_asm_src => Assembler implementation of core SHA1,
functions, and also possibly SHA256 and
SHA512 ones.
cast_asm_src => Assembler implementation of core CAST
functions.
Defaults to 'c_enc.c'
rc4_asm_src => Assembler implementation of core RC4
functions.
Defaults to 'rc4_enc.c rc4_skey.c'
rmd160_asm_src => Assembler implementation of core RMD160
functions.
rc5_asm_src => Assembler implementation of core RC5
functions.
Defaults to 'rc5_enc.c'
wp_asm_src => Assembler implementation of core WHIRLPOOL
functions.
cmll_asm_src => Assembler implementation of core CAMELLIA
functions.
Defaults to 'camellia.c cmll_misc.c cmll_cbc.c'
modes_asm_src => Assembler implementation of cipher modes,
currently the functions gcm_gmult_4bit and
gcm_ghash_4bit.
padlock_asm_src => Assembler implementation of core parts of
the padlock engine. This is mandatory on
any platform where the padlock engine might
actually be built.
[1] as part of the target configuration, one can have a key called
Configurations/common0.tmpl
+1 -1
View File
@@ -22,7 +22,7 @@
our @generated =
sort ( ( grep { defined $unified_info{generate}->{$_} }
sort keys %generatables ),
# Scripts are assumed to be generated, so add thhem too
# Scripts are assumed to be generated, so add them too
( grep { defined $unified_info{sources}->{$_} }
@{$unified_info{scripts}} ) );
Configurations/platform/AIX.pm
+1
View File
@@ -12,6 +12,7 @@ require platform::Unix;
# Assume someone set @INC right before loading this module
use configdata;
sub dsoext { '.so' }
sub shlibextsimple { '.a' }
# In shared mode, the default static library names clashes with the final
Configurations/unix-Makefile.tmpl
+2 -3
View File
@@ -422,7 +422,7 @@ uninstall_sw: uninstall_runtime uninstall_engines uninstall_dev
install_docs: install_man_docs install_html_docs
uninstall_docs: uninstall_man_docs uninstall_html_docs
$(RM) -r -v $(DESTDIR)$(DOCDIR)
$(RM) -r $(DESTDIR)$(DOCDIR)
install_ssldirs:
@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(OPENSSLDIR)/certs
@@ -728,7 +728,7 @@ generate: generate_apps generate_crypto_bn generate_crypto_objects \
.PHONY: doc-nits
doc-nits: build_generated
(cd $(SRCDIR); $(PERL) util/find-doc-nits -n -p ) >doc-nits
(cd $(SRCDIR); $(PERL) util/find-doc-nits -n -p -s ) >doc-nits
@if [ -s doc-nits ] ; then cat doc-nits ; exit 1; \
else echo 'doc-nits: no errors.'; rm doc-nits ; fi
@@ -804,7 +804,6 @@ errors:
our @cryptoheaders =
qw( include/internal/dso.h
include/internal/o_dir.h
include/internal/o_str.h
include/internal/err.h
include/internal/sslconf.h );
our @cryptoskipheaders = ( @sslheaders,
Configurations/windows-makefile.tmpl
+12 -2
View File
@@ -287,7 +287,17 @@ DSO_ASFLAGS={- join(' ', $target{dso_asflags} || (),
@{$config{module_asflags}},
'$(CNF_ASFLAGS)', '$(ASFLAGS)') -}
DSO_CPPFLAGS={- join(' ', $target{dso_cppflags} || (),
$target{module_cppflags} || (),
$target{module_cppflag} || (),
(map { '-D'.quotify1($_) }
@{$target{dso_defines}},
@{$target{module_defines}},
@{$config{dso_defines}},
@{$config{module_defines}}),
(map { '-I'.quotify1($_) }
@{$target{dso_includes}},
@{$target{module_includes}},
@{$config{dso_includes}},
@{$config{module_includes}}),
@{$config{dso_cppflags}},
@{$config{module_cppflags}},
'$(CNF_CPPFLAGS)', '$(CPPFLAGS)') -}
@@ -539,7 +549,7 @@ reconfigure reconf:
$args{generator}->[1] || platform->dsoname($args{product});
return <<"EOF";
$target: $args{generator}->[0] $deps $mkdef
\$(PERL) $mkdef$ord_ver --ordinals $args{generator}->[0] --name $ord_name --OS windows > $target
"\$(PERL)" $mkdef$ord_ver --ordinals $args{generator}->[0] --name $ord_name --OS windows > $target
EOF
} elsif (!platform->isasm($args{src})) {
my $target = $args{src};
Configure
+81 -119
View File
@@ -64,6 +64,7 @@ my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [-Dxxx] [-lx
# zlib-dynamic Like "zlib", but the zlib library is expected to be a shared
# library and will be loaded in run-time by the OpenSSL library.
# sctp include SCTP support
# no-uplink Don't build support for UPLINK interface.
# enable-weak-ssl-ciphers
# Enable weak ciphers that are disabled by default.
# 386 generate 80386 code in assembly modules
@@ -88,9 +89,6 @@ my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [-Dxxx] [-lx
# linked openssl executable has rather debugging value than
# production quality.
#
# DEBUG_SAFESTACK use type-safe stacks to enforce type-safety on stack items
# provided to stack calls. Generates unique stack functions for
# each possible stack type.
# BN_LLONG use the type 'long long' in crypto/bn/bn.h
# RC4_CHAR use 'char' instead of 'int' for RC4_INT in crypto/rc4/rc4.h
# Following are set automatically by this script
@@ -415,6 +413,7 @@ my @disablables = (
"ubsan",
"ui-console",
"unit-test",
"uplink",
"whirlpool",
"weak-ssl-ciphers",
"zlib",
@@ -483,8 +482,9 @@ my @disable_cascades = (
"ssl3-method" => [ "ssl3" ],
"zlib" => [ "zlib-dynamic" ],
"des" => [ "mdc2" ],
"ec" => [ "ecdsa", "ecdh" ],
"ec" => [ "ecdsa", "ecdh", "sm2" ],
sub { $disabled{"ec"} && $disabled{"dh"} }
=> [ "tls1_3" ],
"dgram" => [ "dtls", "sctp" ],
"sock" => [ "dgram" ],
"dtls" => [ @dtls ],
@@ -507,7 +507,7 @@ my @disable_cascades = (
# which cannot be guaranteed if shared libraries aren't present.
# (note that even with shared libraries, both the app and dynamic engines
# must be linked with the same library)
"shared" => [ "dynamic-engine" ],
"shared" => [ "dynamic-engine", "uplink" ],
# Other modules don't necessarily have to link with libcrypto, so shared
# libraries do not have to be a condition to produce those.
@@ -527,7 +527,6 @@ my @disable_cascades = (
"apps" => [ "tests" ],
"tests" => [ "external-tests" ],
"comp" => [ "zlib" ],
"ec" => [ "tls1_3", "sm2" ],
"sm3" => [ "sm2" ],
sub { !$disabled{"unit-test"} } => [ "heartbeats" ],
@@ -1136,6 +1135,12 @@ foreach my $feature (@{$target{enable}}) {
delete $disabled{$feature};
}
}
# If uplink_arch isn't defined, disable uplink
$disabled{uplink} = 'no uplink_arch' unless (defined $target{uplink_arch});
# If asm_arch isn't defined, disable asm
$disabled{asm} = 'no asm_arch' unless (defined $target{asm_arch});
disable(); # Run a cascade now
$target{CXXFLAGS}//=$target{CFLAGS} if $target{CXX};
@@ -1399,71 +1404,6 @@ if ($target{sys_id} ne "")
}
unless ($disabled{asm}) {
$target{cpuid_asm_src}=$table{DEFAULTS}->{cpuid_asm_src} if ($config{processor} eq "386");
push @{$config{lib_defines}}, "OPENSSL_CPUID_OBJ" if ($target{cpuid_asm_src} ne "mem_clr.c");
$target{bn_asm_src} =~ s/\w+-gf2m.c// if (defined($disabled{ec2m}));
# bn-586 is the only one implementing bn_*_part_words
push @{$config{lib_defines}}, "OPENSSL_BN_ASM_PART_WORDS" if ($target{bn_asm_src} =~ /bn-586/);
push @{$config{lib_defines}}, "OPENSSL_IA32_SSE2" if (!$disabled{sse2} && $target{bn_asm_src} =~ /86/);
push @{$config{lib_defines}}, "OPENSSL_BN_ASM_MONT" if ($target{bn_asm_src} =~ /-mont/);
push @{$config{lib_defines}}, "OPENSSL_BN_ASM_MONT5" if ($target{bn_asm_src} =~ /-mont5/);
push @{$config{lib_defines}}, "OPENSSL_BN_ASM_GF2m" if ($target{bn_asm_src} =~ /-gf2m/);
push @{$config{lib_defines}}, "BN_DIV3W" if ($target{bn_asm_src} =~ /-div3w/);
if ($target{sha1_asm_src}) {
push @{$config{lib_defines}}, "SHA1_ASM" if ($target{sha1_asm_src} =~ /sx86/ || $target{sha1_asm_src} =~ /sha1/);
push @{$config{lib_defines}}, "SHA256_ASM" if ($target{sha1_asm_src} =~ /sha256/);
push @{$config{lib_defines}}, "SHA512_ASM" if ($target{sha1_asm_src} =~ /sha512/);
}
if ($target{keccak1600_asm_src} ne $table{DEFAULTS}->{keccak1600_asm_src}) {
push @{$config{lib_defines}}, "KECCAK1600_ASM";
}
if ($target{rc4_asm_src} ne $table{DEFAULTS}->{rc4_asm_src}) {
push @{$config{lib_defines}}, "RC4_ASM";
}
if ($target{md5_asm_src}) {
push @{$config{lib_defines}}, "MD5_ASM";
}
$target{cast_asm_src}=$table{DEFAULTS}->{cast_asm_src} unless $disabled{pic}; # CAST assembler is not PIC
if ($target{rmd160_asm_src}) {
push @{$config{lib_defines}}, "RMD160_ASM";
}
if ($target{aes_asm_src}) {
push @{$config{lib_defines}}, "AES_ASM" if ($target{aes_asm_src} =~ m/\baes-/);;
# aes-ctr.fake is not a real file, only indication that assembler
# module implements AES_ctr32_encrypt...
push @{$config{lib_defines}}, "AES_CTR_ASM" if ($target{aes_asm_src} =~ s/\s*aes-ctr\.fake//);
# aes-xts.fake indicates presence of AES_xts_[en|de]crypt...
push @{$config{lib_defines}}, "AES_XTS_ASM" if ($target{aes_asm_src} =~ s/\s*aes-xts\.fake//);
$target{aes_asm_src} =~ s/\s*(vpaes|aesni)-x86\.s//g if ($disabled{sse2});
push @{$config{lib_defines}}, "VPAES_ASM" if ($target{aes_asm_src} =~ m/vpaes/);
push @{$config{lib_defines}}, "BSAES_ASM" if ($target{aes_asm_src} =~ m/bsaes/);
}
if ($target{wp_asm_src} =~ /mmx/) {
if ($config{processor} eq "386") {
$target{wp_asm_src}=$table{DEFAULTS}->{wp_asm_src};
} elsif (!$disabled{"whirlpool"}) {
push @{$config{lib_defines}}, "WHIRLPOOL_ASM";
}
}
if ($target{modes_asm_src} =~ /ghash-/) {
push @{$config{lib_defines}}, "GHASH_ASM";
}
if ($target{ec_asm_src} =~ /ecp_nistz256/) {
push @{$config{lib_defines}}, "ECP_NISTZ256_ASM";
}
if ($target{ec_asm_src} =~ /x25519/) {
push @{$config{lib_defines}}, "X25519_ASM";
}
if ($target{padlock_asm_src} ne $table{DEFAULTS}->{padlock_asm_src}) {
push @{$config{dso_defines}}, "PADLOCK_ASM";
}
if ($target{poly1305_asm_src} ne "") {
push @{$config{lib_defines}}, "POLY1305_ASM";
}
}
my %predefined_C = compiler_predefined($config{CROSS_COMPILE}.$config{CC});
@@ -1516,7 +1456,6 @@ if (!$disabled{asm} && !$predefined_C{__MACH__} && $^O ne 'VMS') {
# Deal with bn_ops ###################################################
$config{bn_ll} =0;
$config{export_var_as_fn} =0;
my $def_int="unsigned int";
$config{rc4_int} =$def_int;
($config{b64l},$config{b64},$config{b32})=(0,0,1);
@@ -1524,7 +1463,6 @@ $config{rc4_int} =$def_int;
my $count = 0;
foreach (sort split(/\s+/,$target{bn_ops})) {
$count++ if /SIXTY_FOUR_BIT|SIXTY_FOUR_BIT_LONG|THIRTY_TWO_BIT/;
$config{export_var_as_fn}=1 if $_ eq 'EXPORT_VAR_AS_FN';
$config{bn_ll}=1 if $_ eq 'BN_LLONG';
$config{rc4_int}="unsigned char" if $_ eq 'RC4_CHAR';
($config{b64l},$config{b64},$config{b32})
@@ -1791,6 +1729,24 @@ if ($builder eq "unified") {
my %depends = ();
my %generate = ();
# Support for $variablename in build.info files.
# Embedded perl code is the ultimate master, still. If its output
# contains a dollar sign, it had better be escaped, or it will be
# taken for a variable name prefix.
my %variables = ();
my $variable_re = qr/\$([[:alpha:]][[:alnum:]_]*)/;
my $expand_variables = sub {
my $value = '';
my $value_rest = shift;
while ($value_rest =~ /(?<!\\)${variable_re}/) {
$value .= $`;
$value .= $variables{$1};
$value_rest = $';
}
return $value . $value_rest;
};
# We want to detect configdata.pm in the source tree, so we
# don't use it if the build tree is different.
my $src_configdata = cleanfile($srcdir, "configdata.pm", $blddir);
@@ -1828,7 +1784,7 @@ if ($builder eq "unified") {
qr/^\s*IF\[((?:\\.|[^\\\]])*)\]\s*$/
=> sub {
if (! @skip || $skip[$#skip] > 0) {
push @skip, !! $1;
push @skip, !! $expand_variables->($1);
} else {
push @skip, -1;
}
@@ -1837,7 +1793,7 @@ if ($builder eq "unified") {
=> sub { die "ELSIF out of scope" if ! @skip;
die "ELSIF following ELSE" if abs($skip[$#skip]) == 2;
$skip[$#skip] = -1 if $skip[$#skip] != 0;
$skip[$#skip] = !! $1
$skip[$#skip] = !! $expand_variables->($1)
if $skip[$#skip] == 0; },
qr/^\s*ELSE\s*$/
=> sub { die "ELSE out of scope" if ! @skip;
@@ -1846,10 +1802,18 @@ if ($builder eq "unified") {
qr/^\s*ENDIF\s*$/
=> sub { die "ENDIF out of scope" if ! @skip;
pop @skip; },
qr/^\s*${variable_re}\s*=\s*(.*?)\s*$/
=> sub {
if (!@skip || $skip[$#skip] > 0) {
my $n = $1;
my $v = $2;
$variables{$n} = $expand_variables->($v);
}
},
qr/^\s*SUBDIRS\s*=\s*(.*)\s*$/
=> sub {
if (!@skip || $skip[$#skip] > 0) {
foreach (tokenize($1)) {
foreach (tokenize($expand_variables->($1))) {
push @build_dirs, [ @curd, splitdir($_, 1) ];
}
}
@@ -1858,7 +1822,7 @@ if ($builder eq "unified") {
=> sub {
if (!@skip || $skip[$#skip] > 0) {
my @a = tokenize($1, qr|\s*,\s*|);
my @p = tokenize($2);
my @p = tokenize($expand_variables->($2));
push @programs, @p;
foreach my $a (@a) {
my $ak = $a;
@@ -1877,7 +1841,7 @@ if ($builder eq "unified") {
=> sub {
if (!@skip || $skip[$#skip] > 0) {
my @a = tokenize($1, qr|\s*,\s*|);
my @l = tokenize($2);
my @l = tokenize($expand_variables->($2));
push @libraries, @l;
foreach my $a (@a) {
my $ak = $a;
@@ -1896,7 +1860,7 @@ if ($builder eq "unified") {
=> sub {
if (!@skip || $skip[$#skip] > 0) {
my @a = tokenize($1, qr|\s*,\s*|);
my @m = tokenize($2);
my @m = tokenize($expand_variables->($2));
push @modules, @m;
foreach my $a (@a) {
my $ak = $a;
@@ -1915,7 +1879,7 @@ if ($builder eq "unified") {
=> sub {
if (!@skip || $skip[$#skip] > 0) {
my @a = tokenize($1, qr|\s*,\s*|);
my @s = tokenize($2);
my @s = tokenize($expand_variables->($2));
push @scripts, @s;
foreach my $a (@a) {
my $ak = $a;
@@ -1932,22 +1896,23 @@ if ($builder eq "unified") {
},
qr/^\s*ORDINALS\[((?:\\.|[^\\\]])+)\]\s*=\s*(.*)\s*$/,
=> sub { push @{$ordinals{$1}}, tokenize($2)
=> sub { push @{$ordinals{$1}}, tokenize($expand_variables->($2))
if !@skip || $skip[$#skip] > 0 },
qr/^\s*SOURCE\[((?:\\.|[^\\\]])+)\]\s*=\s*(.*)\s*$/
=> sub { push @{$sources{$1}}, tokenize($2)
=> sub { push @{$sources{$1}}, tokenize($expand_variables->($2))
if !@skip || $skip[$#skip] > 0 },
qr/^\s*SHARED_SOURCE\[((?:\\.|[^\\\]])+)\]\s*=\s*(.*)\s*$/
=> sub { push @{$shared_sources{$1}}, tokenize($2)
=> sub { push @{$shared_sources{$1}},
tokenize($expand_variables->($2))
if !@skip || $skip[$#skip] > 0 },
qr/^\s*INCLUDE\[((?:\\.|[^\\\]])+)\]\s*=\s*(.*)\s*$/
=> sub { push @{$includes{$1}}, tokenize($2)
=> sub { push @{$includes{$1}}, tokenize($expand_variables->($2))
if !@skip || $skip[$#skip] > 0 },
qr/^\s*DEFINE\[((?:\\.|[^\\\]])+)\]\s*=\s*(.*)\s*$/
=> sub { push @{$defines{$1}}, tokenize($2)
=> sub { push @{$defines{$1}}, tokenize($expand_variables->($2))
if !@skip || $skip[$#skip] > 0 },
qr/^\s*DEPEND\[((?:\\.|[^\\\]])*)\]\s*=\s*(.*)\s*$/
=> sub { push @{$depends{$1}}, tokenize($2)
=> sub { push @{$depends{$1}}, tokenize($expand_variables->($2))
if !@skip || $skip[$#skip] > 0 },
qr/^\s*GENERATE\[((?:\\.|[^\\\]])+)\]\s*=\s*(.*)\s*$/
=> sub { push @{$generate{$1}}, $2
@@ -2174,6 +2139,34 @@ They are ignored and should be replaced with a combination of GENERATE,
DEPEND and SHARED_SOURCE.
EOF
# Go through the sources of all libraries and check that the same basename
# doesn't appear more than once. Some static library archivers depend on
# them being unique.
{
my $err = 0;
foreach my $prod (keys %{$unified_info{libraries}}) {
my @prod_sources =
map { keys %{$unified_info{sources}->{$_}} }
keys %{$unified_info{sources}->{$prod}};
my %srccnt = ();
# Count how many times a given each source basename
# appears for each product.
foreach my $src (@prod_sources) {
$srccnt{basename $src}++;
}
foreach my $src (keys %srccnt) {
if ((my $cnt = $srccnt{$src}) > 1) {
print STDERR "$src appears $cnt times for the product $prod\n";
$err++
}
}
}
die if $err > 0;
}
# Massage the result
# If we depend on a header file or a perl module, add an inclusion of
@@ -2284,6 +2277,7 @@ EOF
}
}
}
# At this point, we have a number of sources with the value -1. They
# aren't part of the local build and are probably meant for a different
# platform, and can therefore be cleaned away. That happens when making
@@ -2898,18 +2892,6 @@ _____
# Thus, whenever there's mention of a returned value, it's about that
# intended value.
# Helper function to implement conditional inheritance depending on the
# value of $disabled{asm}. Used in inherit_from values as follows:
#
# inherit_from => [ "template", asm("asm_tmpl") ]
#
sub asm {
my @x = @_;
sub {
$disabled{asm} ? () : @x;
}
}
# Helper function to implement conditional value variants, with a default
# plus additional values based on the value of $config{build_type}.
# Arguments are given in hash table form:
@@ -3330,31 +3312,11 @@ sub print_table_entry
"includes",
"cc",
"cflags",
"unistd",
"ld",
"lflags",
"loutflag",
"ex_libs",
"bn_ops",
"apps_aux_src",
"cpuid_asm_src",
"uplink_aux_src",
"bn_asm_src",
"ec_asm_src",
"des_asm_src",
"aes_asm_src",
"bf_asm_src",
"md5_asm_src",
"cast_asm_src",
"sha1_asm_src",
"rc4_asm_src",
"rmd160_asm_src",
"rc5_asm_src",
"wp_asm_src",
"cmll_asm_src",
"modes_asm_src",
"padlock_asm_src",
"chacha_asm_src",
"poly1035_asm_src",
"thread_scheme",
"perlasm_scheme",
HACKING
+26
View File
@@ -0,0 +1,26 @@
MODIFYING OPENSSL SOURCE
------------------------
This document describes the way to add custom modifications to OpenSSL sources.
If you are adding new public functions to the custom library build, you need to
either add a prototype in one of the existing OpenSSL header files;
or provide a new header file and edit Configurations/unix-Makefile.tmpl to pick up that file.
After that perform the following steps:
./config -Werror --strict-warnings [your-options]
make update
make
make test
"make update" ensures that your functions declarations are added to util/libcrypto.num or util/libssl.num
If you plan to submit the changes you made to OpenSSL (see CONTRIBUTING), it's worth running:
make doc-nits
after running "make update" to ensure that documentation has correct format.
"make update" also generates files related to OIDs (in the crypto/objects/ folder) and errors.
If a merge error occurs in one of these generated files then the generated files need to be removed
and regenerated using "make update".
To aid in this process the generated files can be committed separately so they can be removed easily.
INSTALL
+11
View File
@@ -314,6 +314,9 @@
Don't build the CAPI engine. This option will be forced if
on a platform that does not support CAPI.
no-cmp
Don't build support for CMP features
no-cms
Don't build support for CMS features
@@ -555,6 +558,9 @@
Enable additional unit test APIs. This should not typically
be used in production deployments.
no-uplink
Don't build support for UPLINK interface.
enable-weak-ssl-ciphers
Build support for SSL/TLS ciphers that are considered "weak"
(e.g. RC4 based ciphersuites).
@@ -1200,6 +1206,11 @@
$ make TESTS='[89]? -90'
To stochastically verify that the algorithm that produces uniformly distributed
random numbers is operating correctly (with a false positive rate of 0.01%):
$ ./util/shlib_wrap.sh test/bntest -stochastic
Note on multi-threading
-----------------------
NEWS
+1 -1
View File
@@ -605,7 +605,7 @@
Major changes between OpenSSL 0.9.7h and OpenSSL 0.9.7i [14 Oct 2005]:
o Give EVP_MAX_MD_SIZE it's old value, except for a FIPS build.
o Give EVP_MAX_MD_SIZE its old value, except for a FIPS build.
Major changes between OpenSSL 0.9.7g and OpenSSL 0.9.7h [11 Oct 2005]:
NOTES.WIN
+10
View File
@@ -83,6 +83,16 @@
is, of course, to choose a different set of directories by using
--prefix and --openssldir when configuring.
Special notes for Universal Windows Platform builds, a.k.a. VC-*-UWP
--------------------------------------------------------------------
- UWP targets only support building the static and dynamic libraries.
- You should define the platform type to "uwp" and the target arch via
"vcvarsall.bat" before you compile. For example, if you want to build
"arm64" builds, you should type "vcvarsall.bat x86_arm64 uwp".
mingw and mingw64
=================
apps/build.info
+30 -11
View File
@@ -1,4 +1,25 @@
{- our @apps_openssl_src =
# Program init source, that don't have direct linkage with the rest of the
# source, and can therefore not be part of a library.
IF[{- !$disabled{uplink} -}]
$INITSRC=../ms/applink.c
ENDIF
IF[{- $config{target} =~ /^vms-/ -}]
$INITSRC=vms_decc_init.c
ENDIF
# Auxilliary program source
IF[{- $config{target} =~ /^(?:VC-|mingw)/ -}]
# It's called 'init', but doesn't have much 'init' in it...
$AUXLIBAPPSSRC=win32_init.c
ENDIF
IF[{- $config{target} =~ /^vms-/ -}]
$AUXLIBAPPSSRC=vms_term_sock.c vms_decc_argv.c
ENDIF
# Source for the 'openssl' program
# We need the perl variable for the DEPEND generator further down.
$OPENSSLSRC={-
our @opensslsrc =
qw(openssl.c
asn1pars.c ca.c ciphers.c cms.c crl.c crl2p7.c dgst.c dhparam.c
dsa.c dsaparam.c ec.c ecparam.c enc.c engine.c errstr.c gendsa.c
@@ -7,20 +28,18 @@
rsautl.c s_client.c s_server.c s_time.c sess_id.c smime.c speed.c
spkac.c srp.c ts.c verify.c version.c x509.c rehash.c storeutl.c
info.c);
our @apps_lib_src =
( qw(apps.c apps_ui.c opt.c fmt.c s_cb.c s_socket.c app_rand.c
bf_prefix.c),
split(/\s+/, $target{apps_aux_src}) );
our @apps_init_src = split(/\s+/, $target{apps_init_src});
"" -}
join(' ', @opensslsrc); -}
# Source for libapps
$LIBAPPSSRC=apps.c apps_ui.c opt.c fmt.c s_cb.c s_socket.c app_rand.c \
bf_prefix.c
IF[{- !$disabled{apps} -}]
LIBS{noinst}=libapps.a
SOURCE[libapps.a]={- join(" ", @apps_lib_src) -}
SOURCE[libapps.a]=$LIBAPPSSRC $AUXLIBAPPSSRC
INCLUDE[libapps.a]=.. ../include include
PROGRAMS=openssl
SOURCE[openssl]={- join(" ", @apps_init_src) -}
SOURCE[openssl]={- join(" ", @apps_openssl_src) -}
SOURCE[openssl]=$INITSRC $OPENSSLSRC
INCLUDE[openssl]=.. ../include include
DEPEND[openssl]=libapps.a ../libssl
@@ -30,7 +49,7 @@ IF[{- $config{target} =~ /^(?:Cygwin|mingw|VC-)/ -}]
ENDIF
{- join("\n ", map { (my $x = $_) =~ s|\.c$|.o|; "DEPEND[$x]=progs.h" }
@apps_openssl_src) -}
@opensslsrc) -}
GENERATE[progs.h]=progs.pl $(APPS_OPENSSL)
DEPEND[progs.h]=../configdata.pm
apps/ca.c
+63 -5
View File
@@ -96,7 +96,8 @@ static int certify(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509,
const char *enddate,
long days, int batch, const char *ext_sect, CONF *conf,
int verbose, unsigned long certopt, unsigned long nameopt,
int default_op, int ext_copy, int selfsign);
int default_op, int ext_copy, int selfsign,
unsigned char *sm2_id, size_t sm2idlen);
static int certify_cert(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509,
const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
STACK_OF(CONF_VALUE) *policy, CA_DB *db,
@@ -147,7 +148,7 @@ typedef enum OPTION_choice {
OPT_INFILES, OPT_SS_CERT, OPT_SPKAC, OPT_REVOKE, OPT_VALID,
OPT_EXTENSIONS, OPT_EXTFILE, OPT_STATUS, OPT_UPDATEDB, OPT_CRLEXTS,
OPT_RAND_SERIAL,
OPT_R_ENUM,
OPT_R_ENUM, OPT_SM2ID, OPT_SM2HEXID,
/* Do not change the order here; see related case statements below */
OPT_CRL_REASON, OPT_CRL_HOLD, OPT_CRL_COMPROMISE, OPT_CRL_CA_COMPROMISE
} OPTION_CHOICE;
@@ -217,6 +218,12 @@ const OPTIONS ca_options[] = {
OPT_R_OPTIONS,
#ifndef OPENSSL_NO_ENGINE
{"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
#endif
#ifndef OPENSSL_NO_SM2
{"sm2-id", OPT_SM2ID, 's',
"Specify an ID string to verify an SM2 certificate request"},
{"sm2-hex-id", OPT_SM2HEXID, 's',
"Specify a hex ID string to verify an SM2 certificate request"},
#endif
{NULL}
};
@@ -262,6 +269,9 @@ int ca_main(int argc, char **argv)
REVINFO_TYPE rev_type = REV_NONE;
X509_REVOKED *r = NULL;
OPTION_CHOICE o;
unsigned char *sm2_id = NULL;
size_t sm2_idlen = 0;
int sm2_free = 0;
prog = opt_init(argc, argv, ca_options);
while ((o = opt_next()) != OPT_EOF) {
@@ -425,6 +435,30 @@ opthelp:
case OPT_ENGINE:
e = setup_engine(opt_arg(), 0);
break;
case OPT_SM2ID:
/* we assume the input is not a hex string */
if (sm2_id != NULL) {
BIO_printf(bio_err,
"Use one of the options 'sm2-hex-id' or 'sm2-id'\n");
goto end;
}
sm2_id = (unsigned char *)opt_arg();
sm2_idlen = strlen((const char *)sm2_id);
break;
case OPT_SM2HEXID:
/* try to parse the input as hex string first */
if (sm2_id != NULL) {
BIO_printf(bio_err,
"Use one of the options 'sm2-hex-id' or 'sm2-id'\n");
goto end;
}
sm2_free = 1;
sm2_id = OPENSSL_hexstr2buf(opt_arg(), (long *)&sm2_idlen);
if (sm2_id == NULL) {
BIO_printf(bio_err, "Invalid hex string input\n");
goto end;
}
break;
}
}
end_of_options:
@@ -913,7 +947,8 @@ end_of_options:
j = certify(&x, infile, pkey, x509p, dgst, sigopts, attribs, db,
serial, subj, chtype, multirdn, email_dn, startdate,
enddate, days, batch, extensions, conf, verbose,
certopt, get_nameopt(), default_op, ext_copy, selfsign);
certopt, get_nameopt(), default_op, ext_copy, selfsign,
sm2_id, sm2_idlen);
if (j < 0)
goto end;
if (j > 0) {
@@ -932,7 +967,8 @@ end_of_options:
j = certify(&x, argv[i], pkey, x509p, dgst, sigopts, attribs, db,
serial, subj, chtype, multirdn, email_dn, startdate,
enddate, days, batch, extensions, conf, verbose,
certopt, get_nameopt(), default_op, ext_copy, selfsign);
certopt, get_nameopt(), default_op, ext_copy, selfsign,
sm2_id, sm2_idlen);
if (j < 0)
goto end;
if (j > 0) {
@@ -1230,6 +1266,8 @@ end_of_options:
ret = 0;
end:
if (sm2_free)
OPENSSL_free(sm2_id);
if (ret)
ERR_print_errors(bio_err);
BIO_free_all(Sout);
@@ -1268,7 +1306,8 @@ static int certify(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509,
const char *enddate,
long days, int batch, const char *ext_sect, CONF *lconf,
int verbose, unsigned long certopt, unsigned long nameopt,
int default_op, int ext_copy, int selfsign)
int default_op, int ext_copy, int selfsign,
unsigned char *sm2id, size_t sm2idlen)
{
X509_REQ *req = NULL;
BIO *in = NULL;
@@ -1300,6 +1339,25 @@ static int certify(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509,
BIO_printf(bio_err, "error unpacking public key\n");
goto end;
}
if (sm2id != NULL) {
#ifndef OPENSSL_NO_SM2
ASN1_OCTET_STRING *v;
v = ASN1_OCTET_STRING_new();
if (v == NULL) {
BIO_printf(bio_err, "error: SM2 ID allocation failed\n");
goto end;
}
if (!ASN1_OCTET_STRING_set(v, sm2id, sm2idlen)) {
BIO_printf(bio_err, "error: setting SM2 ID failed\n");
ASN1_OCTET_STRING_free(v);
goto end;
}
X509_REQ_set0_sm2_id(req, v);
#endif
}
i = X509_REQ_verify(req, pktmp);
pktmp = NULL;
if (i < 0) {
apps/cms.c
+8
View File
@@ -603,6 +603,14 @@ int cms_main(int argc, char **argv)
goto opthelp;
}
if (flags & CMS_CADES) {
if (flags & CMS_NOATTR) {
BIO_puts(bio_err, "Incompatible options: "
"CAdES required signed attributes\n");
goto opthelp;
}
}
if (operation & SMIME_SIGNERS) {
if (keyfile != NULL && signerfile == NULL) {
BIO_puts(bio_err, "Illegal -inkey without -signer\n");
apps/include/opt.h
+2 -1
View File
@@ -317,7 +317,8 @@ int opt_int(const char *arg, int *result);
int opt_ulong(const char *arg, unsigned long *result);
int opt_long(const char *arg, long *result);
#if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 199901L && \
defined(INTMAX_MAX) && defined(UINTMAX_MAX)
defined(INTMAX_MAX) && defined(UINTMAX_MAX) && \
!defined(OPENSSL_NO_INTTYPES_H)
int opt_imax(const char *arg, intmax_t *result);
int opt_umax(const char *arg, uintmax_t *result);
#else
apps/openssl.c
+14 -11
View File
@@ -1,5 +1,5 @@
/*
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -130,11 +130,8 @@ static size_t internal_trace_cb(const char *buf, size_t cnt,
{
int ret = 0;
tracedata *trace_data = vdata;
union {
char buffer[256], *hex;
CRYPTO_THREAD_ID tid;
unsigned long ltid;
} tid;
char buffer[256];
switch (cmd) {
case OSSL_TRACE_CTRL_BEGIN:
@@ -142,11 +139,11 @@ static size_t internal_trace_cb(const char *buf, size_t cnt,
return 0;
trace_data->ingroup = 1;
tid.ltid = 0;
tid.tid = CRYPTO_THREAD_get_current_id();
BIO_snprintf(buffer, sizeof(buffer), "TRACE[%lx]:%s: ", tid.ltid,
OSSL_trace_get_category_name(category));
tid = CRYPTO_THREAD_get_current_id();
hex = OPENSSL_buf2hexstr((const unsigned char *)&tid, sizeof(tid));
BIO_snprintf(buffer, sizeof(buffer), "TRACE[%s]:%s: ",
hex, OSSL_trace_get_category_name(category));
OPENSSL_free(hex);
BIO_ctrl(trace_data->bio, PREFIX_CTRL_SET_PREFIX,
strlen(buffer), buffer);
break;
@@ -216,6 +213,13 @@ static void setup_trace(const char *str)
{
char *val;
/*
* We add this handler as early as possible to ensure it's executed
* as late as possible, i.e. after the TRACE code has done its cleanup
* (which happens last in OPENSSL_cleanup).
*/
atexit(cleanup_trace);
trace_data_stack = sk_tracedata_new_null();
val = OPENSSL_strdup(str);
@@ -240,7 +244,6 @@ static void setup_trace(const char *str)
}
OPENSSL_free(val);
atexit(cleanup_trace);
}
#endif /* OPENSSL_NO_TRACE */
apps/opt.c
+3 -2
View File
@@ -15,7 +15,7 @@
#include "internal/nelem.h"
#include <string.h>
#if !defined(OPENSSL_SYS_MSDOS)
# include OPENSSL_UNISTD
# include <unistd.h>
#endif
#include <stdlib.h>
@@ -377,7 +377,8 @@ int opt_long(const char *value, long *result)
}
#if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 199901L && \
defined(INTMAX_MAX) && defined(UINTMAX_MAX)
defined(INTMAX_MAX) && defined(UINTMAX_MAX) && \
!defined(OPENSSL_NO_INTTYPES_H)
/* Parse an intmax_t, put it into *result; return 0 on failure, else 1. */
int opt_imax(const char *value, intmax_t *result)
apps/pkcs12.c
+1 -1
View File
@@ -838,7 +838,7 @@ static int alg_print(const X509_ALGOR *alg)
goto done;
}
BIO_printf(bio_err, ", Salt length: %d, Cost(N): %ld, "
"Block size(r): %ld, Paralelizm(p): %ld",
"Block size(r): %ld, Parallelism(p): %ld",
ASN1_STRING_length(kdf->salt),
ASN1_INTEGER_get(kdf->costParameter),
ASN1_INTEGER_get(kdf->blockSize),
apps/req.c
+155 -8
View File
@@ -90,7 +90,7 @@ typedef enum OPTION_choice {
OPT_VERIFY, OPT_NODES, OPT_NOOUT, OPT_VERBOSE, OPT_UTF8,
OPT_NAMEOPT, OPT_REQOPT, OPT_SUBJ, OPT_SUBJECT, OPT_TEXT, OPT_X509,
OPT_MULTIVALUE_RDN, OPT_DAYS, OPT_SET_SERIAL, OPT_ADDEXT, OPT_EXTENSIONS,
OPT_REQEXTS, OPT_PRECERT, OPT_MD,
OPT_REQEXTS, OPT_PRECERT, OPT_MD, OPT_SM2ID, OPT_SM2HEXID,
OPT_R_ENUM
} OPTION_CHOICE;
@@ -145,6 +145,12 @@ const OPTIONS req_options[] = {
{"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
{"keygen_engine", OPT_KEYGEN_ENGINE, 's',
"Specify engine to be used for key generation operations"},
#endif
#ifndef OPENSSL_NO_SM2
{"sm2-id", OPT_SM2ID, 's',
"Specify an ID string to verify an SM2 certificate request"},
{"sm2-hex-id", OPT_SM2HEXID, 's',
"Specify a hex ID string to verify an SM2 certificate request"},
#endif
{NULL}
};
@@ -239,6 +245,9 @@ int req_main(int argc, char **argv)
int nodes = 0, newhdr = 0, subject = 0, pubkey = 0, precert = 0;
long newkey = -1;
unsigned long chtype = MBSTRING_ASC, reqflag = 0;
unsigned char *sm2_id = NULL;
size_t sm2_idlen = 0;
int sm2_free = 0;
#ifndef OPENSSL_NO_DES
cipher = EVP_des_ede3_cbc();
@@ -414,6 +423,29 @@ int req_main(int argc, char **argv)
goto opthelp;
digest = md_alg;
break;
case OPT_SM2ID:
if (sm2_id != NULL) {
BIO_printf(bio_err,
"Use one of the options 'sm2-hex-id' or 'sm2-id'\n");
goto end;
}
sm2_id = (unsigned char *)opt_arg();
sm2_idlen = strlen((const char *)sm2_id);
break;
case OPT_SM2HEXID:
if (sm2_id != NULL) {
BIO_printf(bio_err,
"Use one of the options 'sm2-hex-id' or 'sm2-id'\n");
goto end;
}
/* try to parse the input as hex string first */
sm2_free = 1;
sm2_id = OPENSSL_hexstr2buf(opt_arg(), (long *)&sm2_idlen);
if (sm2_id == NULL) {
BIO_printf(bio_err, "Invalid hex string input\n");
goto end;
}
break;
}
}
argc = opt_num_rest();
@@ -844,6 +876,26 @@ int req_main(int argc, char **argv)
goto end;
}
if (sm2_id != NULL) {
#ifndef OPENSSL_NO_SM2
ASN1_OCTET_STRING *v;
v = ASN1_OCTET_STRING_new();
if (v == NULL) {
BIO_printf(bio_err, "error: SM2 ID allocation failed\n");
goto end;
}
if (!ASN1_OCTET_STRING_set(v, sm2_id, sm2_idlen)) {
BIO_printf(bio_err, "error: setting SM2 ID failed\n");
ASN1_OCTET_STRING_free(v);
goto end;
}
X509_REQ_set0_sm2_id(req, v);
#endif
}
i = X509_REQ_verify(req, tpubkey);
if (i < 0) {
@@ -881,9 +933,19 @@ int req_main(int argc, char **argv)
if (text) {
if (x509)
X509_print_ex(out, x509ss, get_nameopt(), reqflag);
ret = X509_print_ex(out, x509ss, get_nameopt(), reqflag);
else
X509_REQ_print_ex(out, req, get_nameopt(), reqflag);
ret = X509_REQ_print_ex(out, req, get_nameopt(), reqflag);
if (ret == 0) {
if (x509)
BIO_printf(bio_err, "Error printing certificate\n");
else
BIO_printf(bio_err, "Error printing certificate request\n");
ERR_print_errors(bio_err);
goto end;
}
}
if (subject) {
@@ -942,6 +1004,8 @@ int req_main(int argc, char **argv)
}
ret = 0;
end:
if (sm2_free)
OPENSSL_free(sm2_id);
if (ret) {
ERR_print_errors(bio_err);
}
@@ -1596,14 +1660,58 @@ static int genpkey_cb(EVP_PKEY_CTX *ctx)
return 1;
}
#ifndef OPENSSL_NO_SM2
static int ec_pkey_is_sm2(EVP_PKEY *pkey)
{
EC_KEY *eckey = NULL;
const EC_GROUP *group = NULL;
if (EVP_PKEY_id(pkey) == EVP_PKEY_SM2)
return 1;
if (EVP_PKEY_id(pkey) == EVP_PKEY_EC
&& (eckey = EVP_PKEY_get0_EC_KEY(pkey)) != NULL
&& (group = EC_KEY_get0_group(eckey)) != NULL
&& EC_GROUP_get_curve_name(group) == NID_sm2)
return 1;
return 0;
}
#endif
static int do_sign_init(EVP_MD_CTX *ctx, EVP_PKEY *pkey,
const EVP_MD *md, STACK_OF(OPENSSL_STRING) *sigopts)
{
EVP_PKEY_CTX *pkctx = NULL;
int i, def_nid;
#ifndef OPENSSL_NO_SM2
EVP_PKEY_CTX *pctx = NULL;
#endif
int i, def_nid, ret = 0;
if (ctx == NULL)
return 0;
goto err;
#ifndef OPENSSL_NO_SM2
if (ec_pkey_is_sm2(pkey)) {
/* initialize some SM2-specific code */
if (!EVP_PKEY_set_alias_type(pkey, EVP_PKEY_SM2)) {
BIO_printf(bio_err, "Internal error.\n");
goto err;
}
pctx = EVP_PKEY_CTX_new(pkey, NULL);
if (pctx == NULL) {
BIO_printf(bio_err, "memory allocation failure.\n");
goto err;
}
/* set SM2 ID from sig options before calling the real init routine */
for (i = 0; i < sk_OPENSSL_STRING_num(sigopts); i++) {
char *sigopt = sk_OPENSSL_STRING_value(sigopts, i);
if (pkey_ctrl_string(pctx, sigopt) <= 0) {
BIO_printf(bio_err, "parameter error \"%s\"\n", sigopt);
ERR_print_errors(bio_err);
goto err;
}
}
EVP_MD_CTX_set_pkey_ctx(ctx, pctx);
}
#endif
/*
* EVP_PKEY_get_default_digest_nid() returns 2 if the digest is mandatory
* for this algorithm.
@@ -1614,16 +1722,23 @@ static int do_sign_init(EVP_MD_CTX *ctx, EVP_PKEY *pkey,
md = NULL;
}
if (!EVP_DigestSignInit(ctx, &pkctx, md, NULL, pkey))
return 0;
goto err;
for (i = 0; i < sk_OPENSSL_STRING_num(sigopts); i++) {
char *sigopt = sk_OPENSSL_STRING_value(sigopts, i);
if (pkey_ctrl_string(pkctx, sigopt) <= 0) {
BIO_printf(bio_err, "parameter error \"%s\"\n", sigopt);
ERR_print_errors(bio_err);
return 0;
goto err;
}
}
return 1;
ret = 1;
err:
#ifndef OPENSSL_NO_SM2
if (!ret)
EVP_PKEY_CTX_free(pctx);
#endif
return ret;
}
int do_X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md,
@@ -1631,10 +1746,20 @@ int do_X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md,
{
int rv;
EVP_MD_CTX *mctx = EVP_MD_CTX_new();
#ifndef OPENSSL_NO_SM2
EVP_PKEY_CTX *pctx = NULL;
#endif
rv = do_sign_init(mctx, pkey, md, sigopts);
if (rv > 0)
rv = X509_sign_ctx(x, mctx);
#ifndef OPENSSL_NO_SM2
/* only in SM2 case we need to free the pctx explicitly */
if (ec_pkey_is_sm2(pkey)) {
pctx = EVP_MD_CTX_pkey_ctx(mctx);
EVP_PKEY_CTX_free(pctx);
}
#endif
EVP_MD_CTX_free(mctx);
return rv > 0 ? 1 : 0;
}
@@ -1644,9 +1769,20 @@ int do_X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md,
{
int rv;
EVP_MD_CTX *mctx = EVP_MD_CTX_new();
#ifndef OPENSSL_NO_SM2
EVP_PKEY_CTX *pctx = NULL;
#endif
rv = do_sign_init(mctx, pkey, md, sigopts);
if (rv > 0)
rv = X509_REQ_sign_ctx(x, mctx);
#ifndef OPENSSL_NO_SM2
/* only in SM2 case we need to free the pctx explicitly */
if (ec_pkey_is_sm2(pkey)) {
pctx = EVP_MD_CTX_pkey_ctx(mctx);
EVP_PKEY_CTX_free(pctx);
}
#endif
EVP_MD_CTX_free(mctx);
return rv > 0 ? 1 : 0;
}
@@ -1656,9 +1792,20 @@ int do_X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md,
{
int rv;
EVP_MD_CTX *mctx = EVP_MD_CTX_new();
#ifndef OPENSSL_NO_SM2
EVP_PKEY_CTX *pctx = NULL;
#endif
rv = do_sign_init(mctx, pkey, md, sigopts);
if (rv > 0)
rv = X509_CRL_sign_ctx(x, mctx);
#ifndef OPENSSL_NO_SM2
/* only in SM2 case we need to free the pctx explicitly */
if (ec_pkey_is_sm2(pkey)) {
pctx = EVP_MD_CTX_pkey_ctx(mctx);
EVP_PKEY_CTX_free(pctx);
}
#endif
EVP_MD_CTX_free(mctx);
return rv > 0 ? 1 : 0;
}
apps/s_client.c
+1 -1
View File
@@ -2395,7 +2395,7 @@ int s_client_main(int argc, char **argv)
(void)BIO_flush(fbio);
/*
* The first line is the HTTP response. According to RFC 7230,
* it's formated exactly like this:
* it's formatted exactly like this:
*
* HTTP/d.d ddd Reason text\r\n
*/
apps/s_time.c
+1 -1
View File
@@ -24,7 +24,7 @@
#include <openssl/err.h>
#include <internal/sockets.h>
#if !defined(OPENSSL_SYS_MSDOS)
# include OPENSSL_UNISTD
# include <unistd.h>
#endif
#define SSL_CONNECT_NAME "localhost:4433"
apps/speed.c
+6 -3
View File
@@ -29,7 +29,7 @@
#include <openssl/objects.h>
#include <openssl/async.h>
#if !defined(OPENSSL_SYS_MSDOS)
# include OPENSSL_UNISTD
# include <unistd.h>
#endif
#if defined(_WIN32)
@@ -1876,7 +1876,7 @@ int speed_main(int argc, char **argv)
}
buflen = lengths[size_num - 1];
if (buflen < 36) /* size of random vector in RSA bencmark */
if (buflen < 36) /* size of random vector in RSA benchmark */
buflen = 36;
buflen += MAX_MISALIGNMENT + 1;
loopargs[i].buf_malloc = app_malloc(buflen, "input buffer");
@@ -1985,7 +1985,10 @@ int speed_main(int argc, char **argv)
RC2_set_key(&rc2_ks, 16, key16, 128);
#endif
#ifndef OPENSSL_NO_RC5
RC5_32_set_key(&rc5_ks, 16, key16, 12);
if (!RC5_32_set_key(&rc5_ks, 16, key16, 12)) {
BIO_printf(bio_err, "Failed setting RC5 key\n");
goto end;
}
#endif
#ifndef OPENSSL_NO_BF
BF_set_key(&bf_ks, 16, key16);
apps/storeutl.c
+1 -1
View File
@@ -125,7 +125,7 @@ int storeutl_main(int argc, char *argv[])
}
/*
* If expected wasn't set at this point, it means the map
* isn't syncronised with the possible options leading here.
* isn't synchronised with the possible options leading here.
*/
OPENSSL_assert(expected != 0);
}
apps/ts.c
+1 -1
View File
@@ -425,7 +425,7 @@ static TS_REQ *create_query(BIO *data_bio, const char *digest, const EVP_MD *md,
ASN1_OBJECT *policy_obj = NULL;
ASN1_INTEGER *nonce_asn1 = NULL;
if (md == NULL && (md = EVP_get_digestbyname("sha1")) == NULL)
if (md == NULL && (md = EVP_get_digestbyname("sha256")) == NULL)
goto err;
if ((ts_req = TS_REQ_new()) == NULL)
goto err;
apps/verify.c
+10 -1
View File
@@ -169,11 +169,20 @@ int verify_main(int argc, char **argv)
v_verbose = 1;
break;
case OPT_SM2ID:
/* we assume the input is not a hex string */
if (sm2_id != NULL) {
BIO_printf(bio_err,
"Use one of the options 'sm2-hex-id' or 'sm2-id' \n");
goto end;
}
sm2_id = (unsigned char *)opt_arg();
sm2_idlen = strlen((const char *)sm2_id);
break;
case OPT_SM2HEXID:
if (sm2_id != NULL) {
BIO_printf(bio_err,
"Use one of the options 'sm2-hex-id' or 'sm2-id' \n");
goto end;
}
/* try to parse the input as hex string first */
sm2_free = 1;
sm2_id = OPENSSL_hexstr2buf(opt_arg(), (long *)&sm2_idlen);
config
+4 -15
View File
@@ -349,17 +349,6 @@ if [ -d /usr/apollo ]; then
exit 0
fi
# Now NeXT
ISNEXT=`hostinfo 2>/dev/null`
case "$ISNEXT" in
*'NeXT Mach 3.3'*)
echo "whatever-next-nextstep3.3"; exit 0
;;
*NeXT*)
echo "whatever-next-nextstep"; exit 0
;;
esac
# At this point we gone through all the one's
# we know of: Punt
@@ -498,12 +487,12 @@ case "$GUESSOS" in
OUT="darwin64-x86_64-cc"
fi ;;
armv6+7-*-iphoneos)
__CNF_CFLAGS="$__CNF_CFLAGS -arch%20armv6 -arch%20armv7"
__CNF_CXXFLAGS="$__CNF_CXXFLAGS -arch%20armv6 -arch%20armv7"
__CNF_CFLAGS="$__CNF_CFLAGS -arch armv6 -arch armv7"
__CNF_CXXFLAGS="$__CNF_CXXFLAGS -arch armv6 -arch armv7"
OUT="iphoneos-cross" ;;
*-*-iphoneos)
__CNF_CFLAGS="$__CNF_CFLAGS -arch%20${MACHINE}"
__CNF_CXXFLAGS="$__CNF_CXXFLAGS -arch%20${MACHINE}"
__CNF_CFLAGS="$__CNF_CFLAGS -arch ${MACHINE}"
__CNF_CXXFLAGS="$__CNF_CXXFLAGS -arch ${MACHINE}"
OUT="iphoneos-cross" ;;
arm64-*-iphoneos|*-*-ios64)
OUT="ios64-cross" ;;
crypto/README.sparse_array
+1 -1
View File
@@ -43,7 +43,7 @@ The tree height is dynamically increased as needed based on additions.
An empty tree is represented by a NULL root pointer. Inserting a value at
index 0 results in the allocation of a top level node full of null pointers
except for the single pointer to the user's data (N = SA_BLOCK_MAX for
breviety):
brevity):
+----+
|Root|
crypto/aes/asm/aes-s390x.pl
+2 -2
View File
@@ -38,14 +38,14 @@
# Implement AES_set_[en|de]crypt_key. Key schedule setup is avoided
# for 128-bit keys, if hardware support is detected.
# Januray 2009.
# January 2009.
#
# Add support for hardware AES192/256 and reschedule instructions to
# minimize/avoid Address Generation Interlock hazard and to favour
# dual-issue z10 pipeline. This gave ~25% improvement on z10 and
# almost 50% on z9. The gain is smaller on z10, because being dual-
# issue z10 makes it impossible to eliminate the interlock condition:
# critial path is not long enough. Yet it spends ~24 cycles per byte
# critical path is not long enough. Yet it spends ~24 cycles per byte
# processed with 128-bit key.
#
# Unlike previous version hardware support detection takes place only
crypto/aes/build.info
+65 -3
View File
@@ -1,7 +1,69 @@
LIBS=../../libcrypto
SOURCE[../../libcrypto]=\
aes_misc.c aes_ecb.c aes_cfb.c aes_ofb.c \
aes_ige.c aes_wrap.c {- $target{aes_asm_src} -}
$AESASM=aes_core.c aes_cbc.c
IF[{- !$disabled{asm} -}]
$AESASM_x86=aes-586.s
$AESDEF_x86=AES_ASM
$AESASM_x86_sse2=vpaes-x86.s aesni-x86.s
$AESDEF_x86_sse2=VPAES_ASM
$AESASM_x86_64=\
aes-x86_64.s vpaes-x86_64.s bsaes-x86_64.s aesni-x86_64.s \
aesni-sha1-x86_64.s aesni-sha256-x86_64.s aesni-mb-x86_64.s
$AESDEF_x86_64=AES_ASM VPAES_ASM BSAES_ASM
$AESASM_ia64=aes_core.c aes_cbc.c aes-ia64.s
$AESDEF_ia64=AES_ASM
$AESASM_sparcv9=\
aes_core.c aes_cbc.c aes-sparcv9.S aest4-sparcv9.S aesfx-sparcv9.S
$AESDEF_sparcv9=AES_ASM
$AESASM_mips32=aes_cbc.c aes-mips.S
$AESDEF_mips32=AES_ASM
$AESASM_mips64=$AESASM_mips32
$AESDEF_mips64=$AESDEF_mips32
$AESASM_s390x=aes-s390x.S
# aes-390x.S implements AES_ctr32_encrypt and AES_xts_[en|de]crypt
$AESDEF_s390x=AES_ASM AES_CTR_ASM AES_XTS_ASM
$AESASM_armv4=aes_cbc.c aes-armv4.S bsaes-armv7.S aesv8-armx.S
$AESDEF_armv4=AES_ASM BSAES_ASM
$AESASM_aarch64=aes_core.c aes_cbc.c aesv8-armx.S vpaes-armv8.S
$AESDEF_aarch64=VPAES_ASM
$AESASM_parisc11=aes_core.c aes_cbc.c aes-parisc.s
$AESDEF_parisc11=AES_ASM
$AESASM_parisc20_64=$AESASM_parisc11
$AESDEF_parisc20_64=$AESDEF_parisc11
$AESASM_ppc32=aes_core.c aes_cbc.c aes-ppc.s vpaes-ppc.s aesp8-ppc.s
$AESDEF_ppc32=AES_ASM VPAES_ASM
$AESASM_ppc64=$AESASM_ppc32
$AESDEF_ppc64=$AESDEF_ppc32
$AESASM_c64xplus=aes-c64xplus.s aes_cbc.c
# aes-c64xplus.s implements AES_ctr32_encrypt
$AESDEF_c64xplus=AES_ASM AES_CTR_ASM
# Now that we have defined all the arch specific variables, use the
# appropriate one, and define the appropriate macros
IF[$AESASM_{- $target{asm_arch} -}]
$AESASM=$AESASM_{- $target{asm_arch} -}
$AESDEF=$AESDEF_{- $target{asm_arch} -}
IF[{- !$disabled{sse2} -}]
$AESASM=$AESASM $AESASM_{- $target{asm_arch} -}_sse2
$AESDEF=$AESDEF $AESDEF_{- $target{asm_arch} -}_sse2
ENDIF
ENDIF
ENDIF
$COMMON=aes_misc.c aes_ecb.c $AESASM
SOURCE[../../libcrypto]=$COMMON aes_cfb.c aes_ofb.c aes_ige.c aes_wrap.c
DEFINE[../../libcrypto]=$AESDEF
SOURCE[../../providers/fips]=$COMMON
DEFINE[../../providers/fips]=$AESDEF
GENERATE[aes-ia64.s]=asm/aes-ia64.S
crypto/asn1/a_sign.c
+9 -4
View File
@@ -145,7 +145,7 @@ int ASN1_item_sign_ctx(const ASN1_ITEM *it,
unsigned char *buf_in = NULL, *buf_out = NULL;
size_t inl = 0, outl = 0, outll = 0;
int signid, paramtype, buf_len = 0;
int rv;
int rv, pkey_id;
type = EVP_MD_CTX_md(ctx);
pkey = EVP_PKEY_CTX_get0_pkey(EVP_MD_CTX_pkey_ctx(ctx));
@@ -184,9 +184,14 @@ int ASN1_item_sign_ctx(const ASN1_ITEM *it,
ASN1err(ASN1_F_ASN1_ITEM_SIGN_CTX, ASN1_R_CONTEXT_NOT_INITIALISED);
goto err;
}
if (!OBJ_find_sigid_by_algs(&signid,
EVP_MD_nid(type),
pkey->ameth->pkey_id)) {
pkey_id =
#ifndef OPENSSL_NO_SM2
EVP_PKEY_id(pkey) == NID_sm2 ? NID_sm2 :
#endif
pkey->ameth->pkey_id;
if (!OBJ_find_sigid_by_algs(&signid, EVP_MD_nid(type), pkey_id)) {
ASN1err(ASN1_F_ASN1_ITEM_SIGN_CTX,
ASN1_R_DIGEST_AND_KEY_TYPE_NOT_SUPPORTED);
goto err;
crypto/asn1/a_time.c
+1 -1
View File
@@ -67,7 +67,7 @@ static void determine_days(struct tm *tm)
}
c = y / 100;
y %= 100;
/* Zeller's congruance */
/* Zeller's congruence */
tm->tm_wday = (d + (13 * m) / 5 + y + y / 4 + c / 4 + 5 * c + 6) % 7;
}
crypto/asn1/a_type.c
+6 -2
View File
@@ -15,7 +15,9 @@
int ASN1_TYPE_get(const ASN1_TYPE *a)
{
if ((a->value.ptr != NULL) || (a->type == V_ASN1_NULL))
if (a->type == V_ASN1_BOOLEAN
|| a->type == V_ASN1_NULL
|| a->value.ptr != NULL)
return a->type;
else
return 0;
@@ -23,7 +25,9 @@ int ASN1_TYPE_get(const ASN1_TYPE *a)
void ASN1_TYPE_set(ASN1_TYPE *a, int type, void *value)
{
if (a->value.ptr != NULL) {
if (a->type != V_ASN1_BOOLEAN
&& a->type != V_ASN1_NULL
&& a->value.ptr != NULL) {
ASN1_TYPE **tmp_a = &a;
asn1_primitive_free((ASN1_VALUE **)tmp_a, NULL, 0);
}
crypto/async/async.c
+7 -4
View File
@@ -30,11 +30,13 @@
static CRYPTO_THREAD_LOCAL ctxkey;
static CRYPTO_THREAD_LOCAL poolkey;
static void async_delete_thread_state(void *arg);
static async_ctx *async_ctx_new(void)
{
async_ctx *nctx;
if (!ossl_init_thread_start(OPENSSL_INIT_THREAD_ASYNC))
if (!ossl_init_thread_start(NULL, NULL, async_delete_thread_state))
return NULL;
nctx = OPENSSL_malloc(sizeof(*nctx));
@@ -326,7 +328,7 @@ int ASYNC_init_thread(size_t max_size, size_t init_size)
if (!OPENSSL_init_crypto(OPENSSL_INIT_ASYNC, NULL))
return 0;
if (!ossl_init_thread_start(OPENSSL_INIT_THREAD_ASYNC))
if (!ossl_init_thread_start(NULL, NULL, async_delete_thread_state))
return 0;
pool = OPENSSL_zalloc(sizeof(*pool));
@@ -374,7 +376,8 @@ err:
return 0;
}
void async_delete_thread_state(void)
/* TODO(3.0): arg ignored for now */
static void async_delete_thread_state(void *arg)
{
async_pool *pool = (async_pool *)CRYPTO_THREAD_get_local(&poolkey);
@@ -393,7 +396,7 @@ void ASYNC_cleanup_thread(void)
if (!OPENSSL_init_crypto(OPENSSL_INIT_ASYNC, NULL))
return;
async_delete_thread_state();
async_delete_thread_state(NULL);
}
ASYNC_JOB *ASYNC_get_current_job(void)
crypto/bf/build.info
+13 -2
View File
@@ -1,6 +1,17 @@
LIBS=../../libcrypto
SOURCE[../../libcrypto]=bf_skey.c bf_ecb.c bf_cfb64.c bf_ofb64.c \
{- $target{bf_asm_src} -}
$BFASM=bf_enc.c
IF[{- !$disabled{asm} -}]
$BFASM_x86=bf-586.s
# Now that we have defined all the arch specific variables, use the
# appropriate one
IF[$BFASM_{- $target{asm_arch} -}]
$BFASM=$BFASM_{- $target{asm_arch} -}
ENDIF
ENDIF
SOURCE[../../libcrypto]=bf_skey.c bf_ecb.c bf_cfb64.c bf_ofb64.c $BFASM
GENERATE[bf-586.s]=asm/bf-586.pl \
$(PERLASM_SCHEME) $(LIB_CFLAGS) $(LIB_CPPFLAGS) $(PROCESSOR)
crypto/bio/b_addr.c
+14
View File
@@ -696,6 +696,7 @@ int BIO_lookup_ex(const char *host, const char *service, int lookup_type,
/* Note that |res| SHOULD be a 'struct addrinfo **' thanks to
* macro magic in bio_lcl.h
*/
retry:
switch ((gai_ret = getaddrinfo(host, service, &hints, res))) {
# ifdef EAI_SYSTEM
case EAI_SYSTEM:
@@ -706,6 +707,19 @@ int BIO_lookup_ex(const char *host, const char *service, int lookup_type,
case 0:
ret = 1; /* Success */
break;
# if (defined(EAI_FAMILY) || defined(EAI_ADDRFAMILY)) && defined(AI_ADDRCONFIG)
# ifdef EAI_FAMILY
case EAI_FAMILY:
# endif
# ifdef EAI_ADDRFAMILY
case EAI_ADDRFAMILY:
# endif
if (hints.ai_flags & AI_ADDRCONFIG) {
hints.ai_flags &= ~AI_ADDRCONFIG;
goto retry;
}
# endif
/* fall through */
default:
BIOerr(BIO_F_BIO_LOOKUP_EX, ERR_R_SYS_LIB);
ERR_add_error_data(1, gai_strerror(gai_ret));
crypto/bio/bio_lcl.h
+1 -1
View File
@@ -152,7 +152,7 @@ extern CRYPTO_RWLOCK *bio_type_lock;
void bio_sock_cleanup_int(void);
#if BIO_FLAGS_UPLINK==0
#if BIO_FLAGS_UPLINK_INTERNAL==0
/* Shortcut UPLINK calls on most platforms... */
# define UP_stdin stdin
# define UP_stdout stdout
crypto/bio/bss_dgram.c
+1 -1
View File
@@ -784,7 +784,7 @@ static long dgram_ctrl(BIO *b, int cmd, long num, void *ptr)
* reasons. When BIO_CTRL_DGRAM_SET_PEEK_MODE was first defined its value
* was incorrectly clashing with BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE. The
* value has been updated to a non-clashing value. However to preserve
* binary compatiblity we now respond to both the old value and the new one
* binary compatibility we now respond to both the old value and the new one
*/
case BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE:
case BIO_CTRL_DGRAM_SET_PEEK_MODE:
crypto/bio/bss_fd.c
+2 -2
View File
@@ -94,7 +94,7 @@ static int fd_new(BIO *bi)
bi->init = 0;
bi->num = -1;
bi->ptr = NULL;
bi->flags = BIO_FLAGS_UPLINK; /* essentially redundant */
bi->flags = BIO_FLAGS_UPLINK_INTERNAL; /* essentially redundant */
return 1;
}
@@ -107,7 +107,7 @@ static int fd_free(BIO *a)
UP_close(a->num);
}
a->init = 0;
a->flags = BIO_FLAGS_UPLINK;
a->flags = BIO_FLAGS_UPLINK_INTERNAL;
}
return 1;
}
crypto/bio/bss_file.c
+21 -21
View File
@@ -86,8 +86,8 @@ BIO *BIO_new_file(const char *filename, const char *mode)
return NULL;
}
BIO_clear_flags(ret, BIO_FLAGS_UPLINK); /* we did fopen -> we disengage
* UPLINK */
/* we did fopen -> we disengage UPLINK */
BIO_clear_flags(ret, BIO_FLAGS_UPLINK_INTERNAL);
BIO_set_fp(ret, file, fp_flags);
return ret;
}
@@ -100,7 +100,7 @@ BIO *BIO_new_fp(FILE *stream, int close_flag)
return NULL;
/* redundant flag, left for documentation purposes */
BIO_set_flags(ret, BIO_FLAGS_UPLINK);
BIO_set_flags(ret, BIO_FLAGS_UPLINK_INTERNAL);
BIO_set_fp(ret, stream, close_flag);
return ret;
}
@@ -115,7 +115,7 @@ static int file_new(BIO *bi)
bi->init = 0;
bi->num = 0;
bi->ptr = NULL;
bi->flags = BIO_FLAGS_UPLINK; /* default to UPLINK */
bi->flags = BIO_FLAGS_UPLINK_INTERNAL; /* default to UPLINK */
return 1;
}
@@ -125,12 +125,12 @@ static int file_free(BIO *a)
return 0;
if (a->shutdown) {
if ((a->init) && (a->ptr != NULL)) {
if (a->flags & BIO_FLAGS_UPLINK)
if (a->flags & BIO_FLAGS_UPLINK_INTERNAL)
UP_fclose(a->ptr);
else
fclose(a->ptr);
a->ptr = NULL;
a->flags = BIO_FLAGS_UPLINK;
a->flags = BIO_FLAGS_UPLINK_INTERNAL;
}
a->init = 0;
}
@@ -142,13 +142,13 @@ static int file_read(BIO *b, char *out, int outl)
int ret = 0;
if (b->init && (out != NULL)) {
if (b->flags & BIO_FLAGS_UPLINK)
if (b->flags & BIO_FLAGS_UPLINK_INTERNAL)
ret = UP_fread(out, 1, (int)outl, b->ptr);
else
ret = fread(out, 1, (int)outl, (FILE *)b->ptr);
if (ret == 0
&& (b->flags & BIO_FLAGS_UPLINK) ? UP_ferror((FILE *)b->ptr) :
ferror((FILE *)b->ptr)) {
&& (b->flags & BIO_FLAGS_UPLINK_INTERNAL
? UP_ferror((FILE *)b->ptr) : ferror((FILE *)b->ptr))) {
SYSerr(SYS_F_FREAD, get_last_sys_error());
BIOerr(BIO_F_FILE_READ, ERR_R_SYS_LIB);
ret = -1;
@@ -162,7 +162,7 @@ static int file_write(BIO *b, const char *in, int inl)
int ret = 0;
if (b->init && (in != NULL)) {
if (b->flags & BIO_FLAGS_UPLINK)
if (b->flags & BIO_FLAGS_UPLINK_INTERNAL)
ret = UP_fwrite(in, (int)inl, 1, b->ptr);
else
ret = fwrite(in, (int)inl, 1, (FILE *)b->ptr);
@@ -189,20 +189,20 @@ static long file_ctrl(BIO *b, int cmd, long num, void *ptr)
switch (cmd) {
case BIO_C_FILE_SEEK:
case BIO_CTRL_RESET:
if (b->flags & BIO_FLAGS_UPLINK)
if (b->flags & BIO_FLAGS_UPLINK_INTERNAL)
ret = (long)UP_fseek(b->ptr, num, 0);
else
ret = (long)fseek(fp, num, 0);
break;
case BIO_CTRL_EOF:
if (b->flags & BIO_FLAGS_UPLINK)
if (b->flags & BIO_FLAGS_UPLINK_INTERNAL)
ret = (long)UP_feof(fp);
else
ret = (long)feof(fp);
break;
case BIO_C_FILE_TELL:
case BIO_CTRL_INFO:
if (b->flags & BIO_FLAGS_UPLINK)
if (b->flags & BIO_FLAGS_UPLINK_INTERNAL)
ret = UP_ftell(b->ptr);
else
ret = ftell(fp);
@@ -212,22 +212,22 @@ static long file_ctrl(BIO *b, int cmd, long num, void *ptr)
b->shutdown = (int)num & BIO_CLOSE;
b->ptr = ptr;
b->init = 1;
# if BIO_FLAGS_UPLINK!=0
# if BIO_FLAGS_UPLINK_INTERNAL!=0
# if defined(__MINGW32__) && defined(__MSVCRT__) && !defined(_IOB_ENTRIES)
# define _IOB_ENTRIES 20
# endif
/* Safety net to catch purely internal BIO_set_fp calls */
# if defined(_MSC_VER) && _MSC_VER>=1900
if (ptr == stdin || ptr == stdout || ptr == stderr)
BIO_clear_flags(b, BIO_FLAGS_UPLINK);
BIO_clear_flags(b, BIO_FLAGS_UPLINK_INTERNAL);
# elif defined(_IOB_ENTRIES)
if ((size_t)ptr >= (size_t)stdin &&
(size_t)ptr < (size_t)(stdin + _IOB_ENTRIES))
BIO_clear_flags(b, BIO_FLAGS_UPLINK);
BIO_clear_flags(b, BIO_FLAGS_UPLINK_INTERNAL);
# endif
# endif
# ifdef UP_fsetmod
if (b->flags & BIO_FLAGS_UPLINK)
if (b->flags & BIO_FLAGS_UPLINK_INTERNAL)
UP_fsetmod(b->ptr, (char)((num & BIO_FP_TEXT) ? 't' : 'b'));
else
# endif
@@ -296,8 +296,8 @@ static long file_ctrl(BIO *b, int cmd, long num, void *ptr)
}
b->ptr = fp;
b->init = 1;
BIO_clear_flags(b, BIO_FLAGS_UPLINK); /* we did fopen -> we disengage
* UPLINK */
/* we did fopen -> we disengage UPLINK */
BIO_clear_flags(b, BIO_FLAGS_UPLINK_INTERNAL);
break;
case BIO_C_GET_FILE_PTR:
/* the ptr parameter is actually a FILE ** in this case. */
@@ -313,7 +313,7 @@ static long file_ctrl(BIO *b, int cmd, long num, void *ptr)
b->shutdown = (int)num;
break;
case BIO_CTRL_FLUSH:
st = b->flags & BIO_FLAGS_UPLINK
st = b->flags & BIO_FLAGS_UPLINK_INTERNAL
? UP_fflush(b->ptr) : fflush((FILE *)b->ptr);
if (st == EOF) {
SYSerr(SYS_F_FFLUSH, get_last_sys_error());
@@ -342,7 +342,7 @@ static int file_gets(BIO *bp, char *buf, int size)
int ret = 0;
buf[0] = '\0';
if (bp->flags & BIO_FLAGS_UPLINK) {
if (bp->flags & BIO_FLAGS_UPLINK_INTERNAL) {
if (!UP_fgets(buf, size, bp->ptr))
goto err;
} else {
crypto/bio/bss_mem.c
+1 -3
View File
@@ -259,9 +259,7 @@ static long mem_ctrl(BIO *b, int cmd, long num, void *ptr)
bm = bbm->buf;
if (bm->data != NULL) {
if (!(b->flags & BIO_FLAGS_MEM_RDONLY)) {
if (b->flags & BIO_FLAGS_NONCLEAR_RST) {
bm->length = bm->max;
} else {
if (!(b->flags & BIO_FLAGS_NONCLEAR_RST)) {
memset(bm->data, 0, bm->max);
bm->length = 0;
}
crypto/blake2/blake2b_mac.c
+14 -8
View File
@@ -10,7 +10,7 @@
#ifndef OPENSSL_NO_BLAKE2
# include <openssl/evp.h>
# include "blake2_locl.h"
# include "internal/blake2.h"
# include "internal/cryptlib.h"
# include "internal/evp_int.h"
@@ -26,7 +26,7 @@ static EVP_MAC_IMPL *blake2b_mac_new(void)
EVP_MAC_IMPL *macctx = OPENSSL_zalloc(sizeof(*macctx));
if (macctx != NULL) {
blake2b_param_init(&macctx->params);
/* ctx initialization is deferred to BLAKE2b_Init() */
/* ctx initialization is deferred to blake2b_init() */
}
return macctx;
}
@@ -39,10 +39,16 @@ static void blake2b_mac_free(EVP_MAC_IMPL *macctx)
}
}
static int blake2b_mac_copy(EVP_MAC_IMPL *dst, EVP_MAC_IMPL *src)
static EVP_MAC_IMPL *blake2b_mac_dup(const EVP_MAC_IMPL *src)
{
EVP_MAC_IMPL *dst;
dst = OPENSSL_zalloc(sizeof(*dst));
if (dst == NULL)
return NULL;
*dst = *src;
return 1;
return dst;
}
static int blake2b_mac_init(EVP_MAC_IMPL *macctx)
@@ -53,18 +59,18 @@ static int blake2b_mac_init(EVP_MAC_IMPL *macctx)
return 0;
}
return BLAKE2b_Init_key(&macctx->ctx, &macctx->params, macctx->key);
return blake2b_init_key(&macctx->ctx, &macctx->params, macctx->key);
}
static int blake2b_mac_update(EVP_MAC_IMPL *macctx, const unsigned char *data,
size_t datalen)
{
return BLAKE2b_Update(&macctx->ctx, data, datalen);
return blake2b_update(&macctx->ctx, data, datalen);
}
static int blake2b_mac_final(EVP_MAC_IMPL *macctx, unsigned char *out)
{
return BLAKE2b_Final(out, &macctx->ctx);
return blake2b_final(out, &macctx->ctx);
}
/*
@@ -177,7 +183,7 @@ static size_t blake2b_mac_size(EVP_MAC_IMPL *macctx)
const EVP_MAC blake2b_mac_meth = {
EVP_MAC_BLAKE2B,
blake2b_mac_new,
blake2b_mac_copy,
blake2b_mac_dup,
blake2b_mac_free,
blake2b_mac_size,
blake2b_mac_init,
crypto/blake2/blake2s_mac.c
+13 -7
View File
@@ -10,7 +10,7 @@
#ifndef OPENSSL_NO_BLAKE2
# include <openssl/evp.h>
# include "blake2_locl.h"
# include "internal/blake2.h"
# include "internal/cryptlib.h"
# include "internal/evp_int.h"
@@ -39,10 +39,16 @@ static void blake2s_mac_free(EVP_MAC_IMPL *macctx)
}
}
static int blake2s_mac_copy(EVP_MAC_IMPL *dst, EVP_MAC_IMPL *src)
static EVP_MAC_IMPL *blake2s_mac_dup(const EVP_MAC_IMPL *src)
{
EVP_MAC_IMPL *dst;
dst = OPENSSL_malloc(sizeof(*dst));
if (dst == NULL)
return NULL;
*dst = *src;
return 1;
return dst;
}
static int blake2s_mac_init(EVP_MAC_IMPL *macctx)
@@ -53,18 +59,18 @@ static int blake2s_mac_init(EVP_MAC_IMPL *macctx)
return 0;
}
return BLAKE2s_Init_key(&macctx->ctx, &macctx->params, macctx->key);
return blake2s_init_key(&macctx->ctx, &macctx->params, macctx->key);
}
static int blake2s_mac_update(EVP_MAC_IMPL *macctx, const unsigned char *data,
size_t datalen)
{
return BLAKE2s_Update(&macctx->ctx, data, datalen);
return blake2s_update(&macctx->ctx, data, datalen);
}
static int blake2s_mac_final(EVP_MAC_IMPL *macctx, unsigned char *out)
{
return BLAKE2s_Final(out, &macctx->ctx);
return blake2s_final(out, &macctx->ctx);
}
/*
@@ -177,7 +183,7 @@ static size_t blake2s_mac_size(EVP_MAC_IMPL *macctx)
const EVP_MAC blake2s_mac_meth = {
EVP_MAC_BLAKE2S,
blake2s_mac_new,
blake2s_mac_copy,
blake2s_mac_dup,
blake2s_mac_free,
blake2s_mac_size,
blake2s_mac_init,
crypto/blake2/build.info
+1 -1
View File
@@ -1,3 +1,3 @@
LIBS=../../libcrypto
SOURCE[../../libcrypto]=\
blake2b.c blake2s.c blake2b_mac.c blake2s_mac.c m_blake2b.c m_blake2s.c
blake2b_mac.c blake2s_mac.c m_blake2b.c m_blake2s.c
crypto/blake2/m_blake2b.c
+8 -19
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -7,37 +7,26 @@
* https://www.openssl.org/source/license.html
*/
/*
* Derived from the BLAKE2 reference implementation written by Samuel Neves.
* Copyright 2012, Samuel Neves <sneves@dei.uc.pt>
* More information about the BLAKE2 hash function and its implementations
* can be found at https://blake2.net.
*/
#include "internal/cryptlib.h"
#ifndef OPENSSL_NO_BLAKE2
# include <openssl/evp.h>
# include <openssl/objects.h>
# include "blake2_locl.h"
# include <stddef.h>
# include <openssl/obj_mac.h>
# include "internal/evp_int.h"
# include "internal/blake2.h"
static int init(EVP_MD_CTX *ctx)
{
BLAKE2B_PARAM P;
blake2b_param_init(&P);
return BLAKE2b_Init(EVP_MD_CTX_md_data(ctx), &P);
return blake2b512_init(EVP_MD_CTX_md_data(ctx));
}
static int update(EVP_MD_CTX *ctx, const void *data, size_t count)
{
return BLAKE2b_Update(EVP_MD_CTX_md_data(ctx), data, count);
return blake2b_update(EVP_MD_CTX_md_data(ctx), data, count);
}
static int final(EVP_MD_CTX *ctx, unsigned char *md)
{
return BLAKE2b_Final(md, EVP_MD_CTX_md_data(ctx));
return blake2b_final(md, EVP_MD_CTX_md_data(ctx));
}
static const EVP_MD blake2b_md = {
@@ -58,4 +47,4 @@ const EVP_MD *EVP_blake2b512(void)
{
return &blake2b_md;
}
#endif
#endif /* OPENSSL_NO_BLAKE2 */
crypto/blake2/m_blake2s.c
+8 -19
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -7,37 +7,26 @@
* https://www.openssl.org/source/license.html
*/
/*
* Derived from the BLAKE2 reference implementation written by Samuel Neves.
* Copyright 2012, Samuel Neves <sneves@dei.uc.pt>
* More information about the BLAKE2 hash function and its implementations
* can be found at https://blake2.net.
*/
#include "internal/cryptlib.h"
#ifndef OPENSSL_NO_BLAKE2
# include <openssl/evp.h>
# include <openssl/objects.h>
# include "blake2_locl.h"
# include <stddef.h>
# include <openssl/obj_mac.h>
# include "internal/evp_int.h"
# include "internal/blake2.h"
static int init(EVP_MD_CTX *ctx)
{
BLAKE2S_PARAM P;
blake2s_param_init(&P);
return BLAKE2s_Init(EVP_MD_CTX_md_data(ctx), &P);
return blake2s256_init(EVP_MD_CTX_md_data(ctx));
}
static int update(EVP_MD_CTX *ctx, const void *data, size_t count)
{
return BLAKE2s_Update(EVP_MD_CTX_md_data(ctx), data, count);
return blake2s_update(EVP_MD_CTX_md_data(ctx), data, count);
}
static int final(EVP_MD_CTX *ctx, unsigned char *md)
{
return BLAKE2s_Final(md, EVP_MD_CTX_md_data(ctx));
return blake2s_final(md, EVP_MD_CTX_md_data(ctx));
}
static const EVP_MD blake2s_md = {
@@ -58,4 +47,4 @@ const EVP_MD *EVP_blake2s256(void)
{
return &blake2s_md;
}
#endif
#endif /* OPENSSL_NO_BLAKE2 */
crypto/bn/asm/mips.pl
+1 -1
View File
@@ -800,7 +800,7 @@ $code.=<<___;
#if 0
/*
* The bn_div_3_words entry point is re-used for constant-time interface.
* Implementation is retained as hystorical reference.
* Implementation is retained as historical reference.
*/
.align 5
.globl bn_div_3_words
crypto/bn/bn_conv.c
+287
View File
@@ -0,0 +1,287 @@
/*
* Copyright 1995-2017 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <openssl/err.h>
#include "internal/ctype.h"
#include "bn_lcl.h"
static const char Hex[] = "0123456789ABCDEF";
/* Must 'OPENSSL_free' the returned data */
char *BN_bn2hex(const BIGNUM *a)
{
int i, j, v, z = 0;
char *buf;
char *p;
if (BN_is_zero(a))
return OPENSSL_strdup("0");
buf = OPENSSL_malloc(a->top * BN_BYTES * 2 + 2);
if (buf == NULL) {
BNerr(BN_F_BN_BN2HEX, ERR_R_MALLOC_FAILURE);
goto err;
}
p = buf;
if (a->neg)
*p++ = '-';
for (i = a->top - 1; i >= 0; i--) {
for (j = BN_BITS2 - 8; j >= 0; j -= 8) {
/* strip leading zeros */
v = (int)((a->d[i] >> j) & 0xff);
if (z || v != 0) {
*p++ = Hex[v >> 4];
*p++ = Hex[v & 0x0f];
z = 1;
}
}
}
*p = '\0';
err:
return buf;
}
#ifndef FIPS_MODE
/* No BIO_snprintf in FIPS_MODE */
/* Must 'OPENSSL_free' the returned data */
char *BN_bn2dec(const BIGNUM *a)
{
int i = 0, num, ok = 0, n, tbytes;
char *buf = NULL;
char *p;
BIGNUM *t = NULL;
BN_ULONG *bn_data = NULL, *lp;
int bn_data_num;
/*-
* get an upper bound for the length of the decimal integer
* num <= (BN_num_bits(a) + 1) * log(2)
* <= 3 * BN_num_bits(a) * 0.101 + log(2) + 1 (rounding error)
* <= 3 * BN_num_bits(a) / 10 + 3 * BN_num_bits / 1000 + 1 + 1
*/
i = BN_num_bits(a) * 3;
num = (i / 10 + i / 1000 + 1) + 1;
tbytes = num + 3; /* negative and terminator and one spare? */
bn_data_num = num / BN_DEC_NUM + 1;
bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));
buf = OPENSSL_malloc(tbytes);
if (buf == NULL || bn_data == NULL) {
BNerr(BN_F_BN_BN2DEC, ERR_R_MALLOC_FAILURE);
goto err;
}
if ((t = BN_dup(a)) == NULL)
goto err;
p = buf;
lp = bn_data;
if (BN_is_zero(t)) {
*p++ = '0';
*p++ = '\0';
} else {
if (BN_is_negative(t))
*p++ = '-';
while (!BN_is_zero(t)) {
if (lp - bn_data >= bn_data_num)
goto err;
*lp = BN_div_word(t, BN_DEC_CONV);
if (*lp == (BN_ULONG)-1)
goto err;
lp++;
}
lp--;
/*
* We now have a series of blocks, BN_DEC_NUM chars in length, where
* the last one needs truncation. The blocks need to be reversed in
* order.
*/
n = BIO_snprintf(p, tbytes - (size_t)(p - buf), BN_DEC_FMT1, *lp);
if (n < 0)
goto err;
p += n;
while (lp != bn_data) {
lp--;
n = BIO_snprintf(p, tbytes - (size_t)(p - buf), BN_DEC_FMT2, *lp);
if (n < 0)
goto err;
p += n;
}
}
ok = 1;
err:
OPENSSL_free(bn_data);
BN_free(t);
if (ok)
return buf;
OPENSSL_free(buf);
return NULL;
}
#endif
int BN_hex2bn(BIGNUM **bn, const char *a)
{
BIGNUM *ret = NULL;
BN_ULONG l = 0;
int neg = 0, h, m, i, j, k, c;
int num;
if (a == NULL || *a == '\0')
return 0;
if (*a == '-') {
neg = 1;
a++;
}
for (i = 0; i <= INT_MAX / 4 && ossl_isxdigit(a[i]); i++)
continue;
if (i == 0 || i > INT_MAX / 4)
goto err;
num = i + neg;
if (bn == NULL)
return num;
/* a is the start of the hex digits, and it is 'i' long */
if (*bn == NULL) {
if ((ret = BN_new()) == NULL)
return 0;
} else {
ret = *bn;
BN_zero(ret);
}
/* i is the number of hex digits */
if (bn_expand(ret, i * 4) == NULL)
goto err;
j = i; /* least significant 'hex' */
m = 0;
h = 0;
while (j > 0) {
m = (BN_BYTES * 2 <= j) ? BN_BYTES * 2 : j;
l = 0;
for (;;) {
c = a[j - m];
k = OPENSSL_hexchar2int(c);
if (k < 0)
k = 0; /* paranoia */
l = (l << 4) | k;
if (--m <= 0) {
ret->d[h++] = l;
break;
}
}
j -= BN_BYTES * 2;
}
ret->top = h;
bn_correct_top(ret);
*bn = ret;
bn_check_top(ret);
/* Don't set the negative flag if it's zero. */
if (ret->top != 0)
ret->neg = neg;
return num;
err:
if (*bn == NULL)
BN_free(ret);
return 0;
}
int BN_dec2bn(BIGNUM **bn, const char *a)
{
BIGNUM *ret = NULL;
BN_ULONG l = 0;
int neg = 0, i, j;
int num;
if (a == NULL || *a == '\0')
return 0;
if (*a == '-') {
neg = 1;
a++;
}
for (i = 0; i <= INT_MAX / 4 && ossl_isdigit(a[i]); i++)
continue;
if (i == 0 || i > INT_MAX / 4)
goto err;
num = i + neg;
if (bn == NULL)
return num;
/*
* a is the start of the digits, and it is 'i' long. We chop it into
* BN_DEC_NUM digits at a time
*/
if (*bn == NULL) {
if ((ret = BN_new()) == NULL)
return 0;
} else {
ret = *bn;
BN_zero(ret);
}
/* i is the number of digits, a bit of an over expand */
if (bn_expand(ret, i * 4) == NULL)
goto err;
j = BN_DEC_NUM - i % BN_DEC_NUM;
if (j == BN_DEC_NUM)
j = 0;
l = 0;
while (--i >= 0) {
l *= 10;
l += *a - '0';
a++;
if (++j == BN_DEC_NUM) {
if (!BN_mul_word(ret, BN_DEC_CONV)
|| !BN_add_word(ret, l))
goto err;
l = 0;
j = 0;
}
}
bn_correct_top(ret);
*bn = ret;
bn_check_top(ret);
/* Don't set the negative flag if it's zero. */
if (ret->top != 0)
ret->neg = neg;
return num;
err:
if (*bn == NULL)
BN_free(ret);
return 0;
}
int BN_asc2bn(BIGNUM **bn, const char *a)
{
const char *p = a;
if (*p == '-')
p++;
if (p[0] == '0' && (p[1] == 'X' || p[1] == 'x')) {
if (!BN_hex2bn(bn, p + 2))
return 0;
} else {
if (!BN_dec2bn(bn, p))
return 0;
}
/* Don't set the negative flag if it's zero. */
if (*a == '-' && (*bn)->top != 0)
(*bn)->neg = 1;
return 1;
}
crypto/bn/bn_ctx.c
+31 -5
View File
@@ -86,8 +86,11 @@ struct bignum_ctx {
int too_many;
/* Flags. */
int flags;
/* The library context */
OPENSSL_CTX *libctx;
};
#ifndef FIPS_MODE
/* Debugging functionality */
static void ctxdbg(BIO *channel, const char *text, BN_CTX *ctx)
{
@@ -120,35 +123,50 @@ static void ctxdbg(BIO *channel, const char *text, BN_CTX *ctx)
OSSL_TRACE_BEGIN(BN_CTX) { \
ctxdbg(trc_out, str, ctx); \
} OSSL_TRACE_END(BN_CTX)
#else
/* TODO(3.0): Consider if we want to do this in FIPS mode */
# define CTXDBG(str, ctx) do {} while(0)
#endif /* FIPS_MODE */
BN_CTX *BN_CTX_new(void)
BN_CTX *BN_CTX_new_ex(OPENSSL_CTX *ctx)
{
BN_CTX *ret;
if ((ret = OPENSSL_zalloc(sizeof(*ret))) == NULL) {
BNerr(BN_F_BN_CTX_NEW, ERR_R_MALLOC_FAILURE);
BNerr(BN_F_BN_CTX_NEW_EX, ERR_R_MALLOC_FAILURE);
return NULL;
}
/* Initialise the structure */
BN_POOL_init(&ret->pool);
BN_STACK_init(&ret->stack);
ret->libctx = ctx;
return ret;
}
BN_CTX *BN_CTX_secure_new(void)
BN_CTX *BN_CTX_new(void)
{
BN_CTX *ret = BN_CTX_new();
return BN_CTX_new_ex(NULL);
}
BN_CTX *BN_CTX_secure_new_ex(OPENSSL_CTX *ctx)
{
BN_CTX *ret = BN_CTX_new_ex(ctx);
if (ret != NULL)
ret->flags = BN_FLG_SECURE;
return ret;
}
BN_CTX *BN_CTX_secure_new(void)
{
return BN_CTX_secure_new_ex(NULL);
}
void BN_CTX_free(BN_CTX *ctx)
{
if (ctx == NULL)
return;
#ifndef FIPS_MODE
OSSL_TRACE_BEGIN(BN_CTX) {
BN_POOL_ITEM *pool = ctx->pool.head;
BIO_printf(trc_out,
@@ -163,6 +181,7 @@ void BN_CTX_free(BN_CTX *ctx)
}
BIO_printf(trc_out, "\n");
} OSSL_TRACE_END(BN_CTX);
#endif
BN_STACK_finish(&ctx->stack);
BN_POOL_finish(&ctx->pool);
OPENSSL_free(ctx);
@@ -226,6 +245,13 @@ BIGNUM *BN_CTX_get(BN_CTX *ctx)
return ret;
}
OPENSSL_CTX *bn_get_lib_ctx(BN_CTX *ctx)
{
if (ctx == NULL)
return NULL;
return ctx->libctx;
}
/************/
/* BN_STACK */
/************/
crypto/bn/bn_div.c
+1 -1
View File
@@ -258,7 +258,7 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
*
* - availability of constant-time bn_div_3_words;
* - dividend is at least as "wide" as divisor, limb-wise, zero-padded
* if so requied, which shouldn't be a privacy problem, because
* if so required, which shouldn't be a privacy problem, because
* divisor's length is considered public;
*/
int bn_div_fixed_top(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num,
crypto/bn/bn_err.c
+3 -1
View File
@@ -1,6 +1,6 @@
/*
* Generated by util/mkerr.pl DO NOT EDIT
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -29,6 +29,7 @@ static const ERR_STRING_DATA BN_str_functs[] = {
{ERR_PACK(ERR_LIB_BN, BN_F_BN_COMPUTE_WNAF, 0), "bn_compute_wNAF"},
{ERR_PACK(ERR_LIB_BN, BN_F_BN_CTX_GET, 0), "BN_CTX_get"},
{ERR_PACK(ERR_LIB_BN, BN_F_BN_CTX_NEW, 0), "BN_CTX_new"},
{ERR_PACK(ERR_LIB_BN, BN_F_BN_CTX_NEW_EX, 0), "BN_CTX_new_ex"},
{ERR_PACK(ERR_LIB_BN, BN_F_BN_CTX_START, 0), "BN_CTX_start"},
{ERR_PACK(ERR_LIB_BN, BN_F_BN_DIV, 0), "BN_div"},
{ERR_PACK(ERR_LIB_BN, BN_F_BN_DIV_RECP, 0), "BN_div_recp"},
@@ -95,6 +96,7 @@ static const ERR_STRING_DATA BN_str_reasons[] = {
{ERR_PACK(ERR_LIB_BN, 0, BN_R_NOT_INITIALIZED), "not initialized"},
{ERR_PACK(ERR_LIB_BN, 0, BN_R_NO_INVERSE), "no inverse"},
{ERR_PACK(ERR_LIB_BN, 0, BN_R_NO_SOLUTION), "no solution"},
{ERR_PACK(ERR_LIB_BN, 0, BN_R_NO_SUITABLE_DIGEST), "no suitable digest"},
{ERR_PACK(ERR_LIB_BN, 0, BN_R_PRIVATE_KEY_TOO_LARGE),
"private key too large"},
{ERR_PACK(ERR_LIB_BN, 0, BN_R_P_IS_NOT_PRIME), "p is not prime"},
crypto/bn/bn_lcl.h
+3 -1
View File
@@ -295,7 +295,7 @@ struct bn_gencb_st {
(b) > 23 ? 3 : 1)
/*
* BN_mod_exp_mont_conttime is based on the assumption that the L1 data cache
* BN_mod_exp_mont_consttime is based on the assumption that the L1 data cache
* line width of the target processor is at least the following value.
*/
# define MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH ( 64 )
@@ -668,4 +668,6 @@ static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)
return bn_expand2((a),(bits+BN_BITS2-1)/BN_BITS2);
}
OPENSSL_CTX *bn_get_lib_ctx(BN_CTX *ctx);
#endif
crypto/bn/bn_prime.c
+6 -2
View File
@@ -98,8 +98,12 @@ int BN_generate_prime_ex(BIGNUM *ret, int bits, int safe,
/* There are no prime numbers this small. */
BNerr(BN_F_BN_GENERATE_PRIME_EX, BN_R_BITS_TOO_SMALL);
return 0;
} else if (bits == 2 && safe) {
/* The smallest safe prime (7) is three bits. */
} else if (add == NULL && safe && bits < 6 && bits != 3) {
/*
* The smallest safe prime (7) is three bits.
* But the following two safe primes with less than 6 bits (11, 23)
* are unreachable for BN_rand with BN_RAND_TOP_TWO.
*/
BNerr(BN_F_BN_GENERATE_PRIME_EX, BN_R_BITS_TOO_SMALL);
return 0;
}
crypto/bn/bn_print.c
+1 -274
View File
@@ -8,284 +8,11 @@
*/
#include <stdio.h>
#include "internal/ctype.h"
#include <limits.h>
#include "internal/cryptlib.h"
#include <openssl/buffer.h>
#include <openssl/bio.h>
#include "bn_lcl.h"
static const char Hex[] = "0123456789ABCDEF";
/* Must 'OPENSSL_free' the returned data */
char *BN_bn2hex(const BIGNUM *a)
{
int i, j, v, z = 0;
char *buf;
char *p;
if (BN_is_zero(a))
return OPENSSL_strdup("0");
buf = OPENSSL_malloc(a->top * BN_BYTES * 2 + 2);
if (buf == NULL) {
BNerr(BN_F_BN_BN2HEX, ERR_R_MALLOC_FAILURE);
goto err;
}
p = buf;
if (a->neg)
*p++ = '-';
for (i = a->top - 1; i >= 0; i--) {
for (j = BN_BITS2 - 8; j >= 0; j -= 8) {
/* strip leading zeros */
v = (int)((a->d[i] >> j) & 0xff);
if (z || v != 0) {
*p++ = Hex[v >> 4];
*p++ = Hex[v & 0x0f];
z = 1;
}
}
}
*p = '\0';
err:
return buf;
}
/* Must 'OPENSSL_free' the returned data */
char *BN_bn2dec(const BIGNUM *a)
{
int i = 0, num, ok = 0, n, tbytes;
char *buf = NULL;
char *p;
BIGNUM *t = NULL;
BN_ULONG *bn_data = NULL, *lp;
int bn_data_num;
/*-
* get an upper bound for the length of the decimal integer
* num <= (BN_num_bits(a) + 1) * log(2)
* <= 3 * BN_num_bits(a) * 0.101 + log(2) + 1 (rounding error)
* <= 3 * BN_num_bits(a) / 10 + 3 * BN_num_bits / 1000 + 1 + 1
*/
i = BN_num_bits(a) * 3;
num = (i / 10 + i / 1000 + 1) + 1;
tbytes = num + 3; /* negative and terminator and one spare? */
bn_data_num = num / BN_DEC_NUM + 1;
bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));
buf = OPENSSL_malloc(tbytes);
if (buf == NULL || bn_data == NULL) {
BNerr(BN_F_BN_BN2DEC, ERR_R_MALLOC_FAILURE);
goto err;
}
if ((t = BN_dup(a)) == NULL)
goto err;
p = buf;
lp = bn_data;
if (BN_is_zero(t)) {
*p++ = '0';
*p++ = '\0';
} else {
if (BN_is_negative(t))
*p++ = '-';
while (!BN_is_zero(t)) {
if (lp - bn_data >= bn_data_num)
goto err;
*lp = BN_div_word(t, BN_DEC_CONV);
if (*lp == (BN_ULONG)-1)
goto err;
lp++;
}
lp--;
/*
* We now have a series of blocks, BN_DEC_NUM chars in length, where
* the last one needs truncation. The blocks need to be reversed in
* order.
*/
n = BIO_snprintf(p, tbytes - (size_t)(p - buf), BN_DEC_FMT1, *lp);
if (n < 0)
goto err;
p += n;
while (lp != bn_data) {
lp--;
n = BIO_snprintf(p, tbytes - (size_t)(p - buf), BN_DEC_FMT2, *lp);
if (n < 0)
goto err;
p += n;
}
}
ok = 1;
err:
OPENSSL_free(bn_data);
BN_free(t);
if (ok)
return buf;
OPENSSL_free(buf);
return NULL;
}
int BN_hex2bn(BIGNUM **bn, const char *a)
{
BIGNUM *ret = NULL;
BN_ULONG l = 0;
int neg = 0, h, m, i, j, k, c;
int num;
if (a == NULL || *a == '\0')
return 0;
if (*a == '-') {
neg = 1;
a++;
}
for (i = 0; i <= INT_MAX / 4 && ossl_isxdigit(a[i]); i++)
continue;
if (i == 0 || i > INT_MAX / 4)
goto err;
num = i + neg;
if (bn == NULL)
return num;
/* a is the start of the hex digits, and it is 'i' long */
if (*bn == NULL) {
if ((ret = BN_new()) == NULL)
return 0;
} else {
ret = *bn;
BN_zero(ret);
}
/* i is the number of hex digits */
if (bn_expand(ret, i * 4) == NULL)
goto err;
j = i; /* least significant 'hex' */
m = 0;
h = 0;
while (j > 0) {
m = (BN_BYTES * 2 <= j) ? BN_BYTES * 2 : j;
l = 0;
for (;;) {
c = a[j - m];
k = OPENSSL_hexchar2int(c);
if (k < 0)
k = 0; /* paranoia */
l = (l << 4) | k;
if (--m <= 0) {
ret->d[h++] = l;
break;
}
}
j -= BN_BYTES * 2;
}
ret->top = h;
bn_correct_top(ret);
*bn = ret;
bn_check_top(ret);
/* Don't set the negative flag if it's zero. */
if (ret->top != 0)
ret->neg = neg;
return num;
err:
if (*bn == NULL)
BN_free(ret);
return 0;
}
int BN_dec2bn(BIGNUM **bn, const char *a)
{
BIGNUM *ret = NULL;
BN_ULONG l = 0;
int neg = 0, i, j;
int num;
if (a == NULL || *a == '\0')
return 0;
if (*a == '-') {
neg = 1;
a++;
}
for (i = 0; i <= INT_MAX / 4 && ossl_isdigit(a[i]); i++)
continue;
if (i == 0 || i > INT_MAX / 4)
goto err;
num = i + neg;
if (bn == NULL)
return num;
/*
* a is the start of the digits, and it is 'i' long. We chop it into
* BN_DEC_NUM digits at a time
*/
if (*bn == NULL) {
if ((ret = BN_new()) == NULL)
return 0;
} else {
ret = *bn;
BN_zero(ret);
}
/* i is the number of digits, a bit of an over expand */
if (bn_expand(ret, i * 4) == NULL)
goto err;
j = BN_DEC_NUM - i % BN_DEC_NUM;
if (j == BN_DEC_NUM)
j = 0;
l = 0;
while (--i >= 0) {
l *= 10;
l += *a - '0';
a++;
if (++j == BN_DEC_NUM) {
if (!BN_mul_word(ret, BN_DEC_CONV)
|| !BN_add_word(ret, l))
goto err;
l = 0;
j = 0;
}
}
bn_correct_top(ret);
*bn = ret;
bn_check_top(ret);
/* Don't set the negative flag if it's zero. */
if (ret->top != 0)
ret->neg = neg;
return num;
err:
if (*bn == NULL)
BN_free(ret);
return 0;
}
int BN_asc2bn(BIGNUM **bn, const char *a)
{
const char *p = a;
if (*p == '-')
p++;
if (p[0] == '0' && (p[1] == 'X' || p[1] == 'x')) {
if (!BN_hex2bn(bn, p + 2))
return 0;
} else {
if (!BN_dec2bn(bn, p))
return 0;
}
/* Don't set the negative flag if it's zero. */
if (*a == '-' && (*bn)->top != 0)
(*bn)->neg = 1;
return 1;
}
#ifndef OPENSSL_NO_STDIO
int BN_print_fp(FILE *fp, const BIGNUM *a)
{
crypto/bn/bn_rand.c
+62 -21
View File
@@ -10,18 +10,22 @@
#include <stdio.h>
#include <time.h>
#include "internal/cryptlib.h"
#include "internal/rand_int.h"
#include "bn_lcl.h"
#include <openssl/rand.h>
#include <openssl/sha.h>
#include <openssl/evp.h>
typedef enum bnrand_flag_e {
NORMAL, TESTING, PRIVATE
} BNRAND_FLAG;
static int bnrand(BNRAND_FLAG flag, BIGNUM *rnd, int bits, int top, int bottom)
static int bnrand(BNRAND_FLAG flag, BIGNUM *rnd, int bits, int top, int bottom,
BN_CTX *ctx)
{
unsigned char *buf = NULL;
int b, ret = 0, bit, bytes, mask;
OPENSSL_CTX *libctx = bn_get_lib_ctx(ctx);
if (bits == 0) {
if (top != BN_RAND_TOP_ANY || bottom != BN_RAND_BOTTOM_ANY)
@@ -43,7 +47,8 @@ static int bnrand(BNRAND_FLAG flag, BIGNUM *rnd, int bits, int top, int bottom)
}
/* make a random number and set the top and bottom bits */
b = flag == NORMAL ? RAND_bytes(buf, bytes) : RAND_priv_bytes(buf, bytes);
b = flag == NORMAL ? rand_bytes_ex(libctx, buf, bytes)
: rand_priv_bytes_ex(libctx, buf, bytes);
if (b <= 0)
goto err;
@@ -55,7 +60,7 @@ static int bnrand(BNRAND_FLAG flag, BIGNUM *rnd, int bits, int top, int bottom)
unsigned char c;
for (i = 0; i < bytes; i++) {
if (RAND_bytes(&c, 1) <= 0)
if (rand_bytes_ex(libctx, &c, 1) <= 0)
goto err;
if (c >= 128 && i > 0)
buf[i] = buf[i - 1];
@@ -94,23 +99,33 @@ toosmall:
return 0;
}
int BN_rand_ex(BIGNUM *rnd, int bits, int top, int bottom, BN_CTX *ctx)
{
return bnrand(NORMAL, rnd, bits, top, bottom, ctx);
}
int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
{
return bnrand(NORMAL, rnd, bits, top, bottom);
return bnrand(NORMAL, rnd, bits, top, bottom, NULL);
}
int BN_bntest_rand(BIGNUM *rnd, int bits, int top, int bottom)
{
return bnrand(TESTING, rnd, bits, top, bottom);
return bnrand(TESTING, rnd, bits, top, bottom, NULL);
}
int BN_priv_rand_ex(BIGNUM *rnd, int bits, int top, int bottom, BN_CTX *ctx)
{
return bnrand(PRIVATE, rnd, bits, top, bottom, ctx);
}
int BN_priv_rand(BIGNUM *rnd, int bits, int top, int bottom)
{
return bnrand(PRIVATE, rnd, bits, top, bottom);
return bnrand(PRIVATE, rnd, bits, top, bottom, NULL);
}
/* random number r: 0 <= r < range */
static int bnrand_range(BNRAND_FLAG flag, BIGNUM *r, const BIGNUM *range)
static int bnrand_range(BNRAND_FLAG flag, BIGNUM *r, const BIGNUM *range,
BN_CTX *ctx)
{
int n;
int count = 100;
@@ -132,7 +147,8 @@ static int bnrand_range(BNRAND_FLAG flag, BIGNUM *r, const BIGNUM *range)
* than range
*/
do {
if (!bnrand(flag, r, n + 1, BN_RAND_TOP_ANY, BN_RAND_BOTTOM_ANY))
if (!bnrand(flag, r, n + 1, BN_RAND_TOP_ANY, BN_RAND_BOTTOM_ANY,
ctx))
return 0;
/*
@@ -159,7 +175,7 @@ static int bnrand_range(BNRAND_FLAG flag, BIGNUM *r, const BIGNUM *range)
} else {
do {
/* range = 11..._2 or range = 101..._2 */
if (!bnrand(flag, r, n, BN_RAND_TOP_ANY, BN_RAND_BOTTOM_ANY))
if (!bnrand(flag, r, n, BN_RAND_TOP_ANY, BN_RAND_BOTTOM_ANY, ctx))
return 0;
if (!--count) {
@@ -174,14 +190,24 @@ static int bnrand_range(BNRAND_FLAG flag, BIGNUM *r, const BIGNUM *range)
return 1;
}
int BN_rand_range_ex(BIGNUM *r, const BIGNUM *range, BN_CTX *ctx)
{
return bnrand_range(NORMAL, r, range, ctx);
}
int BN_rand_range(BIGNUM *r, const BIGNUM *range)
{
return bnrand_range(NORMAL, r, range);
return bnrand_range(NORMAL, r, range, NULL);
}
int BN_priv_rand_range_ex(BIGNUM *r, const BIGNUM *range, BN_CTX *ctx)
{
return bnrand_range(PRIVATE, r, range, ctx);
}
int BN_priv_rand_range(BIGNUM *r, const BIGNUM *range)
{
return bnrand_range(PRIVATE, r, range);
return bnrand_range(PRIVATE, r, range, NULL);
}
int BN_pseudo_rand(BIGNUM *rnd, int bits, int top, int bottom)
@@ -206,7 +232,7 @@ int BN_generate_dsa_nonce(BIGNUM *out, const BIGNUM *range,
const BIGNUM *priv, const unsigned char *message,
size_t message_len, BN_CTX *ctx)
{
SHA512_CTX sha;
EVP_MD_CTX *mdctx = EVP_MD_CTX_new();
/*
* We use 512 bits of random data per iteration to ensure that we have at
* least |range| bits of randomness.
@@ -217,8 +243,13 @@ int BN_generate_dsa_nonce(BIGNUM *out, const BIGNUM *range,
/* We generate |range|+8 bytes of random output. */
const unsigned num_k_bytes = BN_num_bytes(range) + 8;
unsigned char private_bytes[96];
unsigned char *k_bytes;
unsigned char *k_bytes = NULL;
int ret = 0;
EVP_MD *md = NULL;
OPENSSL_CTX *libctx = bn_get_lib_ctx(ctx);
if (mdctx == NULL)
goto err;
k_bytes = OPENSSL_malloc(num_k_bytes);
if (k_bytes == NULL)
@@ -238,15 +269,23 @@ int BN_generate_dsa_nonce(BIGNUM *out, const BIGNUM *range,
memcpy(private_bytes, priv->d, todo);
memset(private_bytes + todo, 0, sizeof(private_bytes) - todo);
for (done = 0; done < num_k_bytes;) {
if (RAND_priv_bytes(random_bytes, sizeof(random_bytes)) != 1)
md = EVP_MD_fetch(libctx, "SHA512", NULL);
if (md == NULL) {
BNerr(BN_F_BN_GENERATE_DSA_NONCE, BN_R_NO_SUITABLE_DIGEST);
goto err;
}
for (done = 0; done < num_k_bytes;) {
if (!rand_priv_bytes_ex(libctx, random_bytes, sizeof(random_bytes)))
goto err;
if (!EVP_DigestInit_ex(mdctx, md, NULL)
|| !EVP_DigestUpdate(mdctx, &done, sizeof(done))
|| !EVP_DigestUpdate(mdctx, private_bytes,
sizeof(private_bytes))
|| !EVP_DigestUpdate(mdctx, message, message_len)
|| !EVP_DigestUpdate(mdctx, random_bytes, sizeof(random_bytes))
|| !EVP_DigestFinal_ex(mdctx, digest, NULL))
goto err;
SHA512_Init(&sha);
SHA512_Update(&sha, &done, sizeof(done));
SHA512_Update(&sha, private_bytes, sizeof(private_bytes));
SHA512_Update(&sha, message, message_len);
SHA512_Update(&sha, random_bytes, sizeof(random_bytes));
SHA512_Final(digest, &sha);
todo = num_k_bytes - done;
if (todo > SHA512_DIGEST_LENGTH)
@@ -262,6 +301,8 @@ int BN_generate_dsa_nonce(BIGNUM *out, const BIGNUM *range,
ret = 1;
err:
EVP_MD_CTX_free(mdctx);
EVP_MD_meth_free(md);
OPENSSL_free(k_bytes);
OPENSSL_cleanse(private_bytes, sizeof(private_bytes));
return ret;
crypto/bn/bn_sqrt.c
+2 -1
View File
@@ -125,7 +125,8 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
* = a.
*
* (This is due to A.O.L. Atkin,
* <URL: http://listserv.nodak.edu/scripts/wa.exe?A2=ind9211&L=nmbrthry&O=T&P=562>,
* Subject: Square Roots and Cognate Matters modulo p=8n+5.
* URL: https://listserv.nodak.edu/cgi-bin/wa.exe?A2=ind9211&L=NMBRTHRY&P=4026
* November 1992.)
*/
crypto/bn/build.info
+112 -7
View File
@@ -1,12 +1,117 @@
LIBS=../../libcrypto
SOURCE[../../libcrypto]=\
bn_add.c bn_div.c bn_exp.c bn_lib.c bn_ctx.c bn_mul.c bn_mod.c \
bn_print.c bn_rand.c bn_shift.c bn_word.c bn_blind.c \
bn_kron.c bn_sqrt.c bn_gcd.c bn_prime.c bn_err.c bn_sqr.c \
{- $target{bn_asm_src} -} \
$BNASM=bn_asm.c
IF[{- !$disabled{asm} -}]
# Define source files and macros per asm architecture
# Known macros are:
#
# OPENSSL_BN_ASM_PART_WORDS For any collection with /-586/ file names
# OPENSSL_BN_ASM_MONT For any collection with /-mont/ file names
# OPENSSL_BN_ASM_MONT5 For any collection with /-mont5/ file names
# OPENSSL_BN_ASM_GF2m For any collection with /-gf2m/ file names
# OPENSSL_IA32_SSE2 For any collection with /86/ file names
# when sse2 is enabled
# BN_DIV3W For any collection with /-div3w/ file names
#
# All variables are named in such a way that they can be "indexed" with
# $target{asm_arch}
$BNASM_x86=bn-586.s co-586.s x86-mont.s x86-gf2m.s
# bn-586 is the only one implementing bn_*_part_words
# => OPENSSL_BN_ASM_PART_WORDS
$BNDEF_x86=OPENSSL_BN_ASM_PART_WORDS OPENSSL_BN_ASM_MONT OPENSSL_BN_ASM_GF2m
$BNDEF_x86_sse2=OPENSSL_IA32_SSE2
$BNASM_x86_64=\
x86_64-mont.s x86_64-mont5.s x86_64-gf2m.s rsaz_exp.c rsaz-x86_64.s \
rsaz-avx2.s
IF[{- $config{target} !~ /^VC/ -}]
$BNASM_x86_64=asm/x86_64-gcc.c $BNASM_x86_64
ELSE
$BNASM_x86_64=bn_asm.c $BNASM_x86_64
ENDIF
$BNDEF_x86_64=OPENSSL_BN_ASM_MONT OPENSSL_BN_ASM_MONT5 OPENSSL_BN_ASM_GF2m
$BNDEF_x86_64_sse2=OPENSSL_IA32_SSE2
IF[{- $config{target} !~ /^VC/ -}]
$BNASM_ia64=bn-ia64.s ia64-mont.s
ELSE
$BNASM_ia64=bn_asm.c ia64-mont.s
ENDIF
$BNASM_sparcv9=asm/sparcv8plus.S sparcv9-mont.S sparcv9a-mont.S vis3-mont.S \
sparct4-mont.S
$BNDEF_sparcv9=OPENSSL_BN_ASM_MONT
$BNASM_sparcv9_ec2m=sparcv9-gf2m.S
$BNDEF_sparcv9_ec2m=OPENSSL_BN_ASM_GF2m
$BNASM_sparcv8=asm/sparcv8.S
$BNASM_alpha=bn_asm.c alpha-mont.S
$BNDEF_alpha=OPENSSL_BN_ASM_MONT
$BNASM_mips32=bn-mips.S mips-mont.S
$BNDEF_mips32=OPENSSL_BN_ASM_MONT
$BNASM_mips64=$BNASM_mips32
$BNDEF_mips64=$BNDEF_mips32
IF[{- ($target{perlasm_scheme} // '') eq '31' -}]
$BNASM_s390x=bn_asm.c s390x-mont.S
ELSE
$BNASM_s390x=asm/s390x.S s390x-mont.S
ENDIF
$BNDEF_s390x=OPENSSL_BN_ASM_MONT
$BNASM_s390x_ec2m=s390x-gf2m.s
$BNDEF_s390x_ec2m=OPENSSL_BN_ASM_GF2m
$BNASM_armv4=bn_asm.c armv4-mont.S
$BNDEF_armv4=OPENSSL_BN_ASM_MONT
$BNASM_armv4_ec2m=armv4-gf2m.S
$BNDEF_armv4_ec2m=OPENSSL_BN_ASM_GF2m
$BNASM_aarch64=bn_asm.c armv8-mont.S
$BNDEF_aarch64=OPENSSL_BN_ASM_MONT
$BNASM_parisc11=bn_asm.c parisc-mont.s
$BNDEF_parisc11=OPENSSL_BN_ASM_MONT
$BNASM_parisc20_64=$BNASM_parisc11
$BNDEF_parisc20_64=$BNDEF_parisc11
$BNASM_ppc32=bn-ppc.s ppc-mont.s
$BNDEF_ppc32=OPENSSL_BN_ASM_MONT
$BNASM_ppc64=$BNASM_ppc32
$BNDEF_ppc64=$BNDEF_ppc32
$BNASM_c64xplus=asm/bn-c64xplus.asm
$BNASM_c64xplus_ec2m=c64xplus-gf2m.s
$BNDEF_c64xplus_ec2m=OPENSSL_BN_ASM_GF2m
# Now that we have defined all the arch specific variables, use the
# appropriate ones, and define the appropriate macros
IF[$BNASM_{- $target{asm_arch} -}]
$BNASM=$BNASM_{- $target{asm_arch} -}
$BNDEF=$BNDEF_{- $target{asm_arch} -}
IF[{- !$disabled{ec2m} -}]
$BNASM=$BNASM $BNASM_{- $target{asm_arch} -}_ec2m
$BNDEF=$BNDEF $BNDEF_{- $target{asm_arch} -}_ec2m
ENDIF
IF[{- !$disabled{sse2} -}]
$BNDEF_sse2=$BNDEF $BNDEF_{- $target{asm_arch} -}_sse2
ENDIF
ENDIF
ENDIF
$COMMON=bn_add.c bn_div.c bn_exp.c bn_lib.c bn_ctx.c bn_mul.c \
bn_mod.c bn_conv.c bn_rand.c bn_shift.c bn_word.c bn_blind.c \
bn_kron.c bn_sqrt.c bn_gcd.c bn_prime.c bn_sqr.c \
bn_recp.c bn_mont.c bn_mpi.c bn_exp2.c bn_gf2m.c bn_nist.c \
bn_depr.c bn_const.c bn_x931p.c bn_intern.c bn_dh.c bn_srp.c \
bn_rsa_fips186_4.c
bn_const.c bn_x931p.c bn_intern.c bn_dh.c \
bn_rsa_fips186_4.c $BNASM
SOURCE[../../libcrypto]=$COMMON bn_print.c bn_err.c bn_depr.c bn_srp.c
DEFINE[../../libcrypto]=$BNDEF
SOURCE[../../providers/fips]=$COMMON
DEFINE[../../providers/fips]=$BNDEF
INCLUDE[../../libcrypto]=../../crypto/include
INCLUDE[bn_exp.o]=..
crypto/build.info
+70 -19
View File
@@ -1,34 +1,85 @@
# Note that these directories are filtered in Configure. Look for %skipdir
# there for further explanations.
SUBDIRS=objects buffer bio stack lhash rand evp asn1 pem x509 x509v3 conf \
SUBDIRS=objects buffer bio stack lhash rand evp asn1 pem x509 conf \
txt_db pkcs7 pkcs12 ui kdf store property \
md2 md4 md5 sha mdc2 gmac hmac ripemd whrlpool poly1305 blake2 \
siphash sm3 des aes rc2 rc4 rc5 idea aria bf cast camellia \
seed sm4 chacha modes bn ec rsa dsa dh sm2 dso engine \
err comp ocsp cms ts srp cmac ct async kmac ess crmf
err comp ocsp cms ts srp cmac ct async kmac ess crmf cmp
LIBS=../libcrypto
# The Core
SOURCE[../libcrypto]=provider_core.c provider_predefined.c provider_conf.c \
core_fetch.c core_namemap.c
SOURCE[../providers/fips]=provider_core.c provider_predefined.c \
core_fetch.c core_namemap.c
$UPLINKSRC=
$UPLINKDEF=
IF[{- !$disabled{uplink} -}]
$UPLINKSRC_common=../ms/uplink.c
$UPLINKSRC_x86=$UPLINKSRC_common uplink-x86.s
$UPLINKSRC_x86_64=$UPLINKSRC_common uplink-x86_64.s
$UPLINKSRC_ia64=$UPLINKSRC_common uplink-ia64.s
IF[$UPLINKSRC_{- $target{uplink_arch} -}]
$UPLINKSRC=$UPLINKSRC_{- $target{uplink_arch} -}
$UPLINKDEF=OPENSSL_USE_APPLINK
ENDIF
ENDIF
$CPUIDASM=mem_clr.c
$CPUIDDEF=
IF[{- !$disabled{asm} && $config{processor} ne '386' -}]
$CPUIDASM_x86=x86cpuid.s
$CPUIDASM_x86_64=x86_64cpuid.s
$CPUIDASM_ia64=ia64cpuid.s
$CPUIDASM_sparcv9=sparcv9cap.c sparccpuid.S
$CPUIDASM_alpha=alphacpuid.s
$CPUIDASM_s390x=s390xcap.c s390xcpuid.S
$CPUIDASM_armv4=armcap.c armv4cpuid.S
$CPUIDASM_aarch64=armcap.c arm64cpuid.S
$CPUIDASM_parisc11=pariscid.s
$CPUIDASM_parisc20_64=$CPUIDASM_parisc11
$CPUIDASM_ppc32=ppccpuid.s ppccap.c
$CPUIDASM_ppc64=$CPUIDASM_ppc32
$CPUIDASM_c64xplus=c64xpluscpuid.s
# Now that we have defined all the arch specific variables, use the
# appropriate one, and define the appropriate macros
IF[$CPUIDASM_{- $target{asm_arch} -}]
$CPUIDASM=$CPUIDASM_{- $target{asm_arch} -}
$CPUIDDEF=OPENSSL_CPUID_OBJ
ENDIF
ENDIF
# The Core
$CORE_COMMON=provider_core.c provider_predefined.c core_fetch.c core_namemap.c
SOURCE[../libcrypto]=$CORE_COMMON provider_conf.c
SOURCE[../providers/fips]=$CORE_COMMON
# Central utilities
SOURCE[../libcrypto]=\
cryptlib.c mem.c mem_dbg.c cversion.c info.c ex_data.c cpt_err.c \
ebcdic.c uid.c o_time.c o_str.c o_dir.c o_fopen.c ctype.c \
threads_pthread.c threads_win.c threads_none.c getenv.c \
o_init.c o_fips.c mem_sec.c init.c context.c sparse_array.c \
trace.c provider.c params.c bsearch.c \
{- $target{cpuid_asm_src} -} {- $target{uplink_aux_src} -}
$UTIL_COMMON=\
cryptlib.c params.c bsearch.c ex_data.c o_str.c \
ctype.c threads_pthread.c threads_win.c threads_none.c initthread.c \
context.c sparse_array.c $CPUIDASM
$UTIL_DEFINE=$CPUIDDEF
SOURCE[../libcrypto]=$UTIL_COMMON \
mem.c mem_sec.c mem_str.c mem_dbg.c \
cversion.c info.c cpt_err.c ebcdic.c uid.c o_time.c o_dir.c \
o_fopen.c getenv.c o_init.c o_fips.c init.c trace.c provider.c \
$UPLINKSRC
DEFINE[../libcrypto]=$UTIL_DEFINE $UPLINKDEF
SOURCE[../providers/fips]=$UTIL_COMMON
DEFINE[../providers/fips]=$UTIL_DEFINE
# FIPS module
SOURCE[../providers/fips]=\
cryptlib.c mem.c mem_clr.c params.c bsearch.c ex_data.c o_str.c \
ctype.c threads_pthread.c threads_win.c threads_none.c context.c \
sparse_array.c
DEPEND[cversion.o]=buildinf.h
crypto/camellia/build.info
+15 -3
View File
@@ -1,7 +1,19 @@
LIBS=../../libcrypto
SOURCE[../../libcrypto]=\
cmll_ecb.c cmll_ofb.c cmll_cfb.c cmll_ctr.c \
{- $target{cmll_asm_src} -}
$CMLLASM=camellia.c cmll_misc.c cmll_cbc.c
IF[{- !$disabled{asm} -}]
$CMLLASM_x86=cmll-x86.s
$CMLLASM_x86_64=cmll-x86_64.s cmll_misc.c
$CMLLASM_sparcv9=camellia.c cmll_misc.c cmll_cbc.c cmllt4-sparcv9.S
# Now that we have defined all the arch specific variables, use the
# appropriate one
IF[$CMLLASM_{- $target{asm_arch} -}]
$CMLLASM=$CMLLASM_{- $target{asm_arch} -}
ENDIF
ENDIF
SOURCE[../../libcrypto]=cmll_ecb.c cmll_ofb.c cmll_cfb.c cmll_ctr.c $CMLLASM
GENERATE[cmll-x86.s]=asm/cmll-x86.pl \
$(PERLASM_SCHEME) $(LIB_CFLAGS) $(LIB_CPPFLAGS) \
crypto/cast/build.info
+14 -2
View File
@@ -1,6 +1,18 @@
LIBS=../../libcrypto
SOURCE[../../libcrypto]=\
c_skey.c c_ecb.c {- $target{cast_asm_src} -} c_cfb64.c c_ofb64.c
$CASTASM=c_enc.c
# CAST assembly source is not PIC
IF[{- !$disabled{asm} && !$disabled{pic} -}]
$CASTASM_x86=cast-586.s
# Now that we have defined all the arch specific variables, use the
# appropriate one
IF[$CASTASM_{- $target{asm_arch} -}]
$CASTASM=$CASTASM_{- $target{asm_arch} -}
ENDIF
ENDIF
SOURCE[../../libcrypto]=c_skey.c c_ecb.c $CASTASM c_cfb64.c c_ofb64.c
GENERATE[cast-586.s]=asm/cast-586.pl \
$(PERLASM_SCHEME) $(LIB_CFLAGS) $(LIB_CPPFLAGS) $(PROCESSOR)
crypto/chacha/build.info
+26 -1
View File
@@ -1,5 +1,30 @@
LIBS=../../libcrypto
SOURCE[../../libcrypto]={- $target{chacha_asm_src} -}
$CHACHAASM=chacha_enc.c
IF[{- !$disabled{asm} -}]
$CHACHAASM_x86=chacha-x86.s
$CHACHAASM_x86_64=chacha-x86_64.s
$CHACHAASM_ia64=chacha-ia64.S
$CHACHAASM_s390x=chacha-s390x.S
$CHACHAASM_armv4=chacha-armv4.S
$CHACHAASM_aarch64=chacha-armv8.S
$CHACHAASM_ppc32=chacha-ppc.s
$CHACHAASM_ppc64=$CHACHAASM_ppc32
$CHACHAASM_c64xplus=chacha-c64xplus.s
# Now that we have defined all the arch specific variables, use the
# appropriate one
IF[$CHACHAASM_{- $target{asm_arch} -}]
$CHACHAASM=$CHACHAASM_{- $target{asm_arch} -}
ENDIF
ENDIF
SOURCE[../../libcrypto]=$CHACHAASM
GENERATE[chacha-x86.s]=asm/chacha-x86.pl \
$(PERLASM_SCHEME) $(LIB_CFLAGS) $(LIB_CPPFLAGS) $(PROCESSOR)
crypto/cmac/cm_meth.c
+13 -5
View File
@@ -46,14 +46,22 @@ static void cmac_free(EVP_MAC_IMPL *cctx)
}
}
static int cmac_copy(EVP_MAC_IMPL *cdst, EVP_MAC_IMPL *csrc)
static EVP_MAC_IMPL *cmac_dup(const EVP_MAC_IMPL *csrc)
{
if (!CMAC_CTX_copy(cdst->ctx, csrc->ctx))
return 0;
EVP_MAC_IMPL *cdst = cmac_new();
if (cdst == NULL)
return NULL;
if (!CMAC_CTX_copy(cdst->ctx, csrc->ctx)) {
cmac_free(cdst);
return NULL;
}
cdst->tmpengine = csrc->tmpengine;
cdst->tmpcipher = csrc->tmpcipher;
return 1;
return cdst;
}
static size_t cmac_size(EVP_MAC_IMPL *cctx)
@@ -153,7 +161,7 @@ static int cmac_ctrl_str(EVP_MAC_IMPL *cctx, const char *type,
const EVP_MAC cmac_meth = {
EVP_MAC_CMAC,
cmac_new,
cmac_copy,
cmac_dup,
cmac_free,
cmac_size,
cmac_init,
crypto/cmp/build.info
+2
View File
@@ -0,0 +1,2 @@
LIBS=../../libcrypto
SOURCE[../../libcrypto]= cmp_asn.c cmp_err.c
crypto/cmp/cmp_asn.c
+398
View File
@@ -0,0 +1,398 @@
/*
* Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved.
* Copyright Nokia 2007-2019
* Copyright Siemens AG 2015-2019
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*
* CMP implementation by Martin Peylo, Miikka Viljanen, and David von Oheimb.
*/
#include <openssl/asn1t.h>
#include "cmp_int.h"
/* explicit #includes not strictly needed since implied by the above: */
#include <openssl/cmp.h>
#include <openssl/crmf.h>
/* ASN.1 declarations from RFC4210 */
ASN1_SEQUENCE(OSSL_CMP_REVANNCONTENT) = {
/* OSSL_CMP_PKISTATUS is effectively ASN1_INTEGER so it is used directly */
ASN1_SIMPLE(OSSL_CMP_REVANNCONTENT, status, ASN1_INTEGER),
ASN1_SIMPLE(OSSL_CMP_REVANNCONTENT, certId, OSSL_CRMF_CERTID),
ASN1_SIMPLE(OSSL_CMP_REVANNCONTENT, willBeRevokedAt, ASN1_GENERALIZEDTIME),
ASN1_SIMPLE(OSSL_CMP_REVANNCONTENT, badSinceDate, ASN1_GENERALIZEDTIME),
ASN1_OPT(OSSL_CMP_REVANNCONTENT, crlDetails, X509_EXTENSIONS)
} ASN1_SEQUENCE_END(OSSL_CMP_REVANNCONTENT)
IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_REVANNCONTENT)
ASN1_SEQUENCE(OSSL_CMP_CHALLENGE) = {
ASN1_OPT(OSSL_CMP_CHALLENGE, owf, X509_ALGOR),
ASN1_SIMPLE(OSSL_CMP_CHALLENGE, witness, ASN1_OCTET_STRING),
ASN1_SIMPLE(OSSL_CMP_CHALLENGE, challenge, ASN1_OCTET_STRING)
} ASN1_SEQUENCE_END(OSSL_CMP_CHALLENGE)
IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_CHALLENGE)
ASN1_ITEM_TEMPLATE(OSSL_CMP_POPODECKEYCHALLCONTENT) =
ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0,
OSSL_CMP_POPODECKEYCHALLCONTENT, OSSL_CMP_CHALLENGE)
ASN1_ITEM_TEMPLATE_END(OSSL_CMP_POPODECKEYCHALLCONTENT)
ASN1_ITEM_TEMPLATE(OSSL_CMP_POPODECKEYRESPCONTENT) =
ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0,
OSSL_CMP_POPODECKEYRESPCONTENT, ASN1_INTEGER)
ASN1_ITEM_TEMPLATE_END(OSSL_CMP_POPODECKEYRESPCONTENT)
ASN1_SEQUENCE(OSSL_CMP_CAKEYUPDANNCONTENT) = {
/* OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly */
ASN1_SIMPLE(OSSL_CMP_CAKEYUPDANNCONTENT, oldWithNew, X509),
/* OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly */
ASN1_SIMPLE(OSSL_CMP_CAKEYUPDANNCONTENT, newWithOld, X509),
/* OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly */
ASN1_SIMPLE(OSSL_CMP_CAKEYUPDANNCONTENT, newWithNew, X509)
} ASN1_SEQUENCE_END(OSSL_CMP_CAKEYUPDANNCONTENT)
IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_CAKEYUPDANNCONTENT)
ASN1_SEQUENCE(OSSL_CMP_ERRORMSGCONTENT) = {
ASN1_SIMPLE(OSSL_CMP_ERRORMSGCONTENT, pKIStatusInfo, OSSL_CMP_PKISI),
ASN1_OPT(OSSL_CMP_ERRORMSGCONTENT, errorCode, ASN1_INTEGER),
/*
* OSSL_CMP_PKIFREETEXT is effectively a sequence of ASN1_UTF8STRING
* so it is used directly
*
*/
ASN1_SEQUENCE_OF_OPT(OSSL_CMP_ERRORMSGCONTENT, errorDetails, ASN1_UTF8STRING)
} ASN1_SEQUENCE_END(OSSL_CMP_ERRORMSGCONTENT)
IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_ERRORMSGCONTENT)
ASN1_ADB_TEMPLATE(infotypeandvalue_default) = ASN1_OPT(OSSL_CMP_ITAV,
infoValue.other, ASN1_ANY);
/* ITAV means InfoTypeAndValue */
ASN1_ADB(OSSL_CMP_ITAV) = {
/* OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly */
ADB_ENTRY(NID_id_it_caProtEncCert, ASN1_OPT(OSSL_CMP_ITAV,
infoValue.caProtEncCert, X509)),
ADB_ENTRY(NID_id_it_signKeyPairTypes,
ASN1_SEQUENCE_OF_OPT(OSSL_CMP_ITAV,
infoValue.signKeyPairTypes, X509_ALGOR)),
ADB_ENTRY(NID_id_it_encKeyPairTypes,
ASN1_SEQUENCE_OF_OPT(OSSL_CMP_ITAV,
infoValue.encKeyPairTypes, X509_ALGOR)),
ADB_ENTRY(NID_id_it_preferredSymmAlg,
ASN1_OPT(OSSL_CMP_ITAV, infoValue.preferredSymmAlg,
X509_ALGOR)),
ADB_ENTRY(NID_id_it_caKeyUpdateInfo,
ASN1_OPT(OSSL_CMP_ITAV, infoValue.caKeyUpdateInfo,
OSSL_CMP_CAKEYUPDANNCONTENT)),
ADB_ENTRY(NID_id_it_currentCRL,
ASN1_OPT(OSSL_CMP_ITAV, infoValue.currentCRL, X509_CRL)),
ADB_ENTRY(NID_id_it_unsupportedOIDs,
ASN1_SEQUENCE_OF_OPT(OSSL_CMP_ITAV,
infoValue.unsupportedOIDs, ASN1_OBJECT)),
ADB_ENTRY(NID_id_it_keyPairParamReq,
ASN1_OPT(OSSL_CMP_ITAV, infoValue.keyPairParamReq,
ASN1_OBJECT)),
ADB_ENTRY(NID_id_it_keyPairParamRep,
ASN1_OPT(OSSL_CMP_ITAV, infoValue.keyPairParamRep,
X509_ALGOR)),
ADB_ENTRY(NID_id_it_revPassphrase,
ASN1_OPT(OSSL_CMP_ITAV, infoValue.revPassphrase,
OSSL_CRMF_ENCRYPTEDVALUE)),
ADB_ENTRY(NID_id_it_implicitConfirm,
ASN1_OPT(OSSL_CMP_ITAV, infoValue.implicitConfirm,
ASN1_NULL)),
ADB_ENTRY(NID_id_it_confirmWaitTime,
ASN1_OPT(OSSL_CMP_ITAV, infoValue.confirmWaitTime,
ASN1_GENERALIZEDTIME)),
ADB_ENTRY(NID_id_it_origPKIMessage,
ASN1_OPT(OSSL_CMP_ITAV, infoValue.origPKIMessage,
OSSL_CMP_MSGS)),
ADB_ENTRY(NID_id_it_suppLangTags,
ASN1_SEQUENCE_OF_OPT(OSSL_CMP_ITAV, infoValue.suppLangTagsValue,
ASN1_UTF8STRING)),
} ASN1_ADB_END(OSSL_CMP_ITAV, 0, infoType, 0,
&infotypeandvalue_default_tt, NULL);
ASN1_SEQUENCE(OSSL_CMP_ITAV) = {
ASN1_SIMPLE(OSSL_CMP_ITAV, infoType, ASN1_OBJECT),
ASN1_ADB_OBJECT(OSSL_CMP_ITAV)
} ASN1_SEQUENCE_END(OSSL_CMP_ITAV)
IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_ITAV)
IMPLEMENT_ASN1_DUP_FUNCTION(OSSL_CMP_ITAV)
OSSL_CMP_ITAV *OSSL_CMP_ITAV_create(ASN1_OBJECT *type, ASN1_TYPE *value)
{
OSSL_CMP_ITAV *itav;
if (type == NULL || (itav = OSSL_CMP_ITAV_new()) == NULL)
return NULL;
OSSL_CMP_ITAV_set0(itav, type, value);
return itav;
}
void OSSL_CMP_ITAV_set0(OSSL_CMP_ITAV *itav, ASN1_OBJECT *type,
ASN1_TYPE *value)
{
itav->infoType = type;
itav->infoValue.other = value;
}
ASN1_OBJECT *OSSL_CMP_ITAV_get0_type(const OSSL_CMP_ITAV *itav)
{
if (itav == NULL)
return NULL;
return itav->infoType;
}
ASN1_TYPE *OSSL_CMP_ITAV_get0_value(const OSSL_CMP_ITAV *itav)
{
if (itav == NULL)
return NULL;
return itav->infoValue.other;
}
int OSSL_CMP_ITAV_push0_stack_item(STACK_OF(OSSL_CMP_ITAV) **itav_sk_p,
OSSL_CMP_ITAV *itav)
{
int created = 0;
if (itav_sk_p == NULL)
goto err;
if (*itav_sk_p == NULL) {
if ((*itav_sk_p = sk_OSSL_CMP_ITAV_new_null()) == NULL)
goto err;
created = 1;
}
if (itav != NULL) {
if (!sk_OSSL_CMP_ITAV_push(*itav_sk_p, itav))
goto err;
}
return 1;
err:
if (created != 0) {
sk_OSSL_CMP_ITAV_free(*itav_sk_p);
*itav_sk_p = NULL;
}
return 0;
}
ASN1_CHOICE(OSSL_CMP_CERTORENCCERT) = {
/* OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly */
ASN1_EXP(OSSL_CMP_CERTORENCCERT, value.certificate, X509, 0),
ASN1_EXP(OSSL_CMP_CERTORENCCERT, value.encryptedCert,
OSSL_CRMF_ENCRYPTEDVALUE, 1),
} ASN1_CHOICE_END(OSSL_CMP_CERTORENCCERT)
IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_CERTORENCCERT)
ASN1_SEQUENCE(OSSL_CMP_CERTIFIEDKEYPAIR) = {
ASN1_SIMPLE(OSSL_CMP_CERTIFIEDKEYPAIR, certOrEncCert,
OSSL_CMP_CERTORENCCERT),
ASN1_EXP_OPT(OSSL_CMP_CERTIFIEDKEYPAIR, privateKey,
OSSL_CRMF_ENCRYPTEDVALUE, 0),
ASN1_EXP_OPT(OSSL_CMP_CERTIFIEDKEYPAIR, publicationInfo,
OSSL_CRMF_PKIPUBLICATIONINFO, 1)
} ASN1_SEQUENCE_END(OSSL_CMP_CERTIFIEDKEYPAIR)
IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_CERTIFIEDKEYPAIR)
ASN1_SEQUENCE(OSSL_CMP_REVDETAILS) = {
ASN1_SIMPLE(OSSL_CMP_REVDETAILS, certDetails, OSSL_CRMF_CERTTEMPLATE),
ASN1_OPT(OSSL_CMP_REVDETAILS, crlEntryDetails, X509_EXTENSIONS)
} ASN1_SEQUENCE_END(OSSL_CMP_REVDETAILS)
IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_REVDETAILS)
ASN1_ITEM_TEMPLATE(OSSL_CMP_REVREQCONTENT) =
ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, OSSL_CMP_REVREQCONTENT,
OSSL_CMP_REVDETAILS)
ASN1_ITEM_TEMPLATE_END(OSSL_CMP_REVREQCONTENT)
ASN1_SEQUENCE(OSSL_CMP_REVREPCONTENT) = {
ASN1_SEQUENCE_OF(OSSL_CMP_REVREPCONTENT, status, OSSL_CMP_PKISI),
ASN1_EXP_SEQUENCE_OF_OPT(OSSL_CMP_REVREPCONTENT, revCerts, OSSL_CRMF_CERTID,
0),
ASN1_EXP_SEQUENCE_OF_OPT(OSSL_CMP_REVREPCONTENT, crls, X509_CRL, 1)
} ASN1_SEQUENCE_END(OSSL_CMP_REVREPCONTENT)
IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_REVREPCONTENT)
ASN1_SEQUENCE(OSSL_CMP_KEYRECREPCONTENT) = {
ASN1_SIMPLE(OSSL_CMP_KEYRECREPCONTENT, status, OSSL_CMP_PKISI),
ASN1_EXP_OPT(OSSL_CMP_KEYRECREPCONTENT, newSigCert, X509, 0),
ASN1_EXP_SEQUENCE_OF_OPT(OSSL_CMP_KEYRECREPCONTENT, caCerts, X509, 1),
ASN1_EXP_SEQUENCE_OF_OPT(OSSL_CMP_KEYRECREPCONTENT, keyPairHist,
OSSL_CMP_CERTIFIEDKEYPAIR, 2)
} ASN1_SEQUENCE_END(OSSL_CMP_KEYRECREPCONTENT)
IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_KEYRECREPCONTENT)
ASN1_ITEM_TEMPLATE(OSSL_CMP_PKISTATUS) =
ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_UNIVERSAL, 0, status, ASN1_INTEGER)
ASN1_ITEM_TEMPLATE_END(OSSL_CMP_PKISTATUS)
ASN1_SEQUENCE(OSSL_CMP_PKISI) = {
ASN1_SIMPLE(OSSL_CMP_PKISI, status, OSSL_CMP_PKISTATUS),
/*
* CMP_PKIFREETEXT is effectively a sequence of ASN1_UTF8STRING
* so it is used directly
*/
ASN1_SEQUENCE_OF_OPT(OSSL_CMP_PKISI, statusString, ASN1_UTF8STRING),
/*
* OSSL_CMP_PKIFAILUREINFO is effectively ASN1_BIT_STRING so used directly
*/
ASN1_OPT(OSSL_CMP_PKISI, failInfo, ASN1_BIT_STRING)
} ASN1_SEQUENCE_END(OSSL_CMP_PKISI)
IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_PKISI)
IMPLEMENT_ASN1_DUP_FUNCTION(OSSL_CMP_PKISI)
ASN1_SEQUENCE(OSSL_CMP_CERTSTATUS) = {
ASN1_SIMPLE(OSSL_CMP_CERTSTATUS, certHash, ASN1_OCTET_STRING),
ASN1_SIMPLE(OSSL_CMP_CERTSTATUS, certReqId, ASN1_INTEGER),
ASN1_OPT(OSSL_CMP_CERTSTATUS, statusInfo, OSSL_CMP_PKISI)
} ASN1_SEQUENCE_END(OSSL_CMP_CERTSTATUS)
IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_CERTSTATUS)
ASN1_ITEM_TEMPLATE(OSSL_CMP_CERTCONFIRMCONTENT) =
ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, OSSL_CMP_CERTCONFIRMCONTENT,
OSSL_CMP_CERTSTATUS)
ASN1_ITEM_TEMPLATE_END(OSSL_CMP_CERTCONFIRMCONTENT)
ASN1_SEQUENCE(OSSL_CMP_CERTRESPONSE) = {
ASN1_SIMPLE(OSSL_CMP_CERTRESPONSE, certReqId, ASN1_INTEGER),
ASN1_SIMPLE(OSSL_CMP_CERTRESPONSE, status, OSSL_CMP_PKISI),
ASN1_OPT(OSSL_CMP_CERTRESPONSE, certifiedKeyPair,
OSSL_CMP_CERTIFIEDKEYPAIR),
ASN1_OPT(OSSL_CMP_CERTRESPONSE, rspInfo, ASN1_OCTET_STRING)
} ASN1_SEQUENCE_END(OSSL_CMP_CERTRESPONSE)
IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_CERTRESPONSE)
ASN1_SEQUENCE(OSSL_CMP_POLLREQ) = {
ASN1_SIMPLE(OSSL_CMP_POLLREQ, certReqId, ASN1_INTEGER)
} ASN1_SEQUENCE_END(OSSL_CMP_POLLREQ)
IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_POLLREQ)
ASN1_ITEM_TEMPLATE(OSSL_CMP_POLLREQCONTENT) =
ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, OSSL_CMP_POLLREQCONTENT,
OSSL_CMP_POLLREQ)
ASN1_ITEM_TEMPLATE_END(OSSL_CMP_POLLREQCONTENT)
ASN1_SEQUENCE(OSSL_CMP_POLLREP) = {
ASN1_SIMPLE(OSSL_CMP_POLLREP, certReqId, ASN1_INTEGER),
ASN1_SIMPLE(OSSL_CMP_POLLREP, checkAfter, ASN1_INTEGER),
ASN1_SEQUENCE_OF_OPT(OSSL_CMP_POLLREP, reason, ASN1_UTF8STRING),
} ASN1_SEQUENCE_END(OSSL_CMP_POLLREP)
IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_POLLREP)
ASN1_ITEM_TEMPLATE(OSSL_CMP_POLLREPCONTENT) =
ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0,
OSSL_CMP_POLLREPCONTENT,
OSSL_CMP_POLLREP)
ASN1_ITEM_TEMPLATE_END(OSSL_CMP_POLLREPCONTENT)
ASN1_SEQUENCE(OSSL_CMP_CERTREPMESSAGE) = {
/* OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly */
ASN1_EXP_SEQUENCE_OF_OPT(OSSL_CMP_CERTREPMESSAGE, caPubs, X509, 1),
ASN1_SEQUENCE_OF(OSSL_CMP_CERTREPMESSAGE, response, OSSL_CMP_CERTRESPONSE)
} ASN1_SEQUENCE_END(OSSL_CMP_CERTREPMESSAGE)
IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_CERTREPMESSAGE)
ASN1_ITEM_TEMPLATE(OSSL_CMP_GENMSGCONTENT) =
ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, OSSL_CMP_GENMSGCONTENT,
OSSL_CMP_ITAV)
ASN1_ITEM_TEMPLATE_END(OSSL_CMP_GENMSGCONTENT)
ASN1_ITEM_TEMPLATE(OSSL_CMP_GENREPCONTENT) =
ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, OSSL_CMP_GENREPCONTENT,
OSSL_CMP_ITAV)
ASN1_ITEM_TEMPLATE_END(OSSL_CMP_GENREPCONTENT)
ASN1_ITEM_TEMPLATE(OSSL_CMP_CRLANNCONTENT) =
ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0,
OSSL_CMP_CRLANNCONTENT, X509_CRL)
ASN1_ITEM_TEMPLATE_END(OSSL_CMP_CRLANNCONTENT)
ASN1_CHOICE(OSSL_CMP_PKIBODY) = {
ASN1_EXP(OSSL_CMP_PKIBODY, value.ir, OSSL_CRMF_MSGS, 0),
ASN1_EXP(OSSL_CMP_PKIBODY, value.ip, OSSL_CMP_CERTREPMESSAGE, 1),
ASN1_EXP(OSSL_CMP_PKIBODY, value.cr, OSSL_CRMF_MSGS, 2),
ASN1_EXP(OSSL_CMP_PKIBODY, value.cp, OSSL_CMP_CERTREPMESSAGE, 3),
ASN1_EXP(OSSL_CMP_PKIBODY, value.p10cr, X509_REQ, 4),
ASN1_EXP(OSSL_CMP_PKIBODY, value.popdecc, OSSL_CMP_POPODECKEYCHALLCONTENT, 5),
ASN1_EXP(OSSL_CMP_PKIBODY, value.popdecr, OSSL_CMP_POPODECKEYRESPCONTENT, 6),
ASN1_EXP(OSSL_CMP_PKIBODY, value.kur, OSSL_CRMF_MSGS, 7),
ASN1_EXP(OSSL_CMP_PKIBODY, value.kup, OSSL_CMP_CERTREPMESSAGE, 8),
ASN1_EXP(OSSL_CMP_PKIBODY, value.krr, OSSL_CRMF_MSGS, 9),
ASN1_EXP(OSSL_CMP_PKIBODY, value.krp, OSSL_CMP_KEYRECREPCONTENT, 10),
ASN1_EXP(OSSL_CMP_PKIBODY, value.rr, OSSL_CMP_REVREQCONTENT, 11),
ASN1_EXP(OSSL_CMP_PKIBODY, value.rp, OSSL_CMP_REVREPCONTENT, 12),
ASN1_EXP(OSSL_CMP_PKIBODY, value.ccr, OSSL_CRMF_MSGS, 13),
ASN1_EXP(OSSL_CMP_PKIBODY, value.ccp, OSSL_CMP_CERTREPMESSAGE, 14),
ASN1_EXP(OSSL_CMP_PKIBODY, value.ckuann, OSSL_CMP_CAKEYUPDANNCONTENT, 15),
ASN1_EXP(OSSL_CMP_PKIBODY, value.cann, X509, 16),
ASN1_EXP(OSSL_CMP_PKIBODY, value.rann, OSSL_CMP_REVANNCONTENT, 17),
ASN1_EXP(OSSL_CMP_PKIBODY, value.crlann, OSSL_CMP_CRLANNCONTENT, 18),
ASN1_EXP(OSSL_CMP_PKIBODY, value.pkiconf, ASN1_ANY, 19),
ASN1_EXP(OSSL_CMP_PKIBODY, value.nested, OSSL_CMP_MSGS, 20),
ASN1_EXP(OSSL_CMP_PKIBODY, value.genm, OSSL_CMP_GENMSGCONTENT, 21),
ASN1_EXP(OSSL_CMP_PKIBODY, value.genp, OSSL_CMP_GENREPCONTENT, 22),
ASN1_EXP(OSSL_CMP_PKIBODY, value.error, OSSL_CMP_ERRORMSGCONTENT, 23),
ASN1_EXP(OSSL_CMP_PKIBODY, value.certConf, OSSL_CMP_CERTCONFIRMCONTENT, 24),
ASN1_EXP(OSSL_CMP_PKIBODY, value.pollReq, OSSL_CMP_POLLREQCONTENT, 25),
ASN1_EXP(OSSL_CMP_PKIBODY, value.pollRep, OSSL_CMP_POLLREPCONTENT, 26),
} ASN1_CHOICE_END(OSSL_CMP_PKIBODY)
IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_PKIBODY)
ASN1_SEQUENCE(OSSL_CMP_PKIHEADER) = {
ASN1_SIMPLE(OSSL_CMP_PKIHEADER, pvno, ASN1_INTEGER),
ASN1_SIMPLE(OSSL_CMP_PKIHEADER, sender, GENERAL_NAME),
ASN1_SIMPLE(OSSL_CMP_PKIHEADER, recipient, GENERAL_NAME),
ASN1_EXP_OPT(OSSL_CMP_PKIHEADER, messageTime, ASN1_GENERALIZEDTIME, 0),
ASN1_EXP_OPT(OSSL_CMP_PKIHEADER, protectionAlg, X509_ALGOR, 1),
ASN1_EXP_OPT(OSSL_CMP_PKIHEADER, senderKID, ASN1_OCTET_STRING, 2),
ASN1_EXP_OPT(OSSL_CMP_PKIHEADER, recipKID, ASN1_OCTET_STRING, 3),
ASN1_EXP_OPT(OSSL_CMP_PKIHEADER, transactionID, ASN1_OCTET_STRING, 4),
ASN1_EXP_OPT(OSSL_CMP_PKIHEADER, senderNonce, ASN1_OCTET_STRING, 5),
ASN1_EXP_OPT(OSSL_CMP_PKIHEADER, recipNonce, ASN1_OCTET_STRING, 6),
/*
* OSSL_CMP_PKIFREETEXT is effectively a sequence of ASN1_UTF8STRING
* so it is used directly
*/
ASN1_EXP_SEQUENCE_OF_OPT(OSSL_CMP_PKIHEADER, freeText, ASN1_UTF8STRING, 7),
ASN1_EXP_SEQUENCE_OF_OPT(OSSL_CMP_PKIHEADER, generalInfo,
OSSL_CMP_ITAV, 8)
} ASN1_SEQUENCE_END(OSSL_CMP_PKIHEADER)
IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_PKIHEADER)
ASN1_SEQUENCE(CMP_PROTECTEDPART) = {
ASN1_SIMPLE(OSSL_CMP_MSG, header, OSSL_CMP_PKIHEADER),
ASN1_SIMPLE(OSSL_CMP_MSG, body, OSSL_CMP_PKIBODY)
} ASN1_SEQUENCE_END(CMP_PROTECTEDPART)
IMPLEMENT_ASN1_FUNCTIONS(CMP_PROTECTEDPART)
ASN1_SEQUENCE(OSSL_CMP_MSG) = {
ASN1_SIMPLE(OSSL_CMP_MSG, header, OSSL_CMP_PKIHEADER),
ASN1_SIMPLE(OSSL_CMP_MSG, body, OSSL_CMP_PKIBODY),
ASN1_EXP_OPT(OSSL_CMP_MSG, protection, ASN1_BIT_STRING, 0),
/* OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly */
ASN1_EXP_SEQUENCE_OF_OPT(OSSL_CMP_MSG, extraCerts, X509, 1)
} ASN1_SEQUENCE_END(OSSL_CMP_MSG)
IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_MSG)
IMPLEMENT_ASN1_DUP_FUNCTION(OSSL_CMP_MSG)
ASN1_ITEM_TEMPLATE(OSSL_CMP_MSGS) =
ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, OSSL_CMP_MSGS,
OSSL_CMP_MSG)
ASN1_ITEM_TEMPLATE_END(OSSL_CMP_MSGS)
crypto/cmp/cmp_err.c
+35
View File
@@ -0,0 +1,35 @@
/*
* Generated by util/mkerr.pl DO NOT EDIT
* Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <openssl/err.h>
#include <openssl/cmperr.h>
#ifndef OPENSSL_NO_ERR
static const ERR_STRING_DATA CMP_str_functs[] = {
{0, NULL}
};
static const ERR_STRING_DATA CMP_str_reasons[] = {
{0, NULL}
};
#endif
int ERR_load_CMP_strings(void)
{
#ifndef OPENSSL_NO_ERR
if (ERR_func_error_string(CMP_str_functs[0].error) == NULL) {
ERR_load_strings_const(CMP_str_functs);
ERR_load_strings_const(CMP_str_reasons);
}
#endif
return 1;
}
crypto/cmp/cmp_int.h
+589
View File
@@ -0,0 +1,589 @@
/*
* Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved.
* Copyright Nokia 2007-2019
* Copyright Siemens AG 2015-2019
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*
* CMP implementation by Martin Peylo, Miikka Viljanen, and David von Oheimb.
*/
#ifndef OSSL_HEADER_CMP_INT_H
# define OSSL_HEADER_CMP_INT_H
# include "internal/cryptlib.h"
# include <openssl/cmp.h>
# include <openssl/err.h>
/* explicit #includes not strictly needed since implied by the above: */
# include <openssl/crmf.h>
# include <openssl/ossl_typ.h>
# include <openssl/safestack.h>
# include <openssl/x509.h>
# include <openssl/x509v3.h>
/*
* ##########################################################################
* ASN.1 DECLARATIONS
* ##########################################################################
*/
/*-
* RevAnnContent ::= SEQUENCE {
* status PKIStatus,
* certId CertId,
* willBeRevokedAt GeneralizedTime,
* badSinceDate GeneralizedTime,
* crlDetails Extensions OPTIONAL
* -- extra CRL details (e.g., crl number, reason, location, etc.)
* }
*/
typedef struct OSSL_cmp_revanncontent_st {
ASN1_INTEGER *status;
OSSL_CRMF_CERTID *certId;
ASN1_GENERALIZEDTIME *willBeRevokedAt;
ASN1_GENERALIZEDTIME *badSinceDate;
X509_EXTENSIONS *crlDetails;
} OSSL_CMP_REVANNCONTENT;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_REVANNCONTENT)
/*-
* Challenge ::= SEQUENCE {
* owf AlgorithmIdentifier OPTIONAL,
*
* -- MUST be present in the first Challenge; MAY be omitted in
* -- any subsequent Challenge in POPODecKeyChallContent (if
* -- omitted, then the owf used in the immediately preceding
* -- Challenge is to be used).
*
* witness OCTET STRING,
* -- the result of applying the one-way function (owf) to a
* -- randomly-generated INTEGER, A. [Note that a different
* -- INTEGER MUST be used for each Challenge.]
* challenge OCTET STRING
* -- the encryption (under the public key for which the cert.
* -- request is being made) of Rand, where Rand is specified as
* -- Rand ::= SEQUENCE {
* -- int INTEGER,
* -- - the randomly-generated INTEGER A (above)
* -- sender GeneralName
* -- - the sender's name (as included in PKIHeader)
* -- }
* }
*/
typedef struct OSSL_cmp_challenge_st {
X509_ALGOR *owf;
ASN1_OCTET_STRING *witness;
ASN1_OCTET_STRING *challenge;
} OSSL_CMP_CHALLENGE;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_CHALLENGE)
/*-
* CAKeyUpdAnnContent ::= SEQUENCE {
* oldWithNew Certificate,
* newWithOld Certificate,
* newWithNew Certificate
* }
*/
typedef struct OSSL_cmp_cakeyupdanncontent_st {
X509 *oldWithNew;
X509 *newWithOld;
X509 *newWithNew;
} OSSL_CMP_CAKEYUPDANNCONTENT;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_CAKEYUPDANNCONTENT)
/*-
* declared already here as it will be used in OSSL_CMP_MSG (nested) and
* infoType and infoValue
*/
typedef STACK_OF(OSSL_CMP_MSG) OSSL_CMP_MSGS;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_MSGS)
/*-
* InfoTypeAndValue ::= SEQUENCE {
* infoType OBJECT IDENTIFIER,
* infoValue ANY DEFINED BY infoType OPTIONAL
* }
*/
struct OSSL_cmp_itav_st {
ASN1_OBJECT *infoType;
union {
char *ptr;
/* NID_id_it_caProtEncCert - CA Protocol Encryption Certificate */
X509 *caProtEncCert;
/* NID_id_it_signKeyPairTypes - Signing Key Pair Types */
STACK_OF(X509_ALGOR) *signKeyPairTypes;
/* NID_id_it_encKeyPairTypes - Encryption/Key Agreement Key Pair Types */
STACK_OF(X509_ALGOR) *encKeyPairTypes;
/* NID_id_it_preferredSymmAlg - Preferred Symmetric Algorithm */
X509_ALGOR *preferredSymmAlg;
/* NID_id_it_caKeyUpdateInfo - Updated CA Key Pair */
OSSL_CMP_CAKEYUPDANNCONTENT *caKeyUpdateInfo;
/* NID_id_it_currentCRL - CRL */
X509_CRL *currentCRL;
/* NID_id_it_unsupportedOIDs - Unsupported Object Identifiers */
STACK_OF(ASN1_OBJECT) *unsupportedOIDs;
/* NID_id_it_keyPairParamReq - Key Pair Parameters Request */
ASN1_OBJECT *keyPairParamReq;
/* NID_id_it_keyPairParamRep - Key Pair Parameters Response */
X509_ALGOR *keyPairParamRep;
/* NID_id_it_revPassphrase - Revocation Passphrase */
OSSL_CRMF_ENCRYPTEDVALUE *revPassphrase;
/* NID_id_it_implicitConfirm - ImplicitConfirm */
ASN1_NULL *implicitConfirm;
/* NID_id_it_confirmWaitTime - ConfirmWaitTime */
ASN1_GENERALIZEDTIME *confirmWaitTime;
/* NID_id_it_origPKIMessage - origPKIMessage */
OSSL_CMP_MSGS *origPKIMessage;
/* NID_id_it_suppLangTags - Supported Language Tags */
STACK_OF(ASN1_UTF8STRING) *suppLangTagsValue;
/* this is to be used for so far undeclared objects */
ASN1_TYPE *other;
} infoValue;
} /* OSSL_CMP_ITAV */;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_ITAV)
DECLARE_ASN1_DUP_FUNCTION(OSSL_CMP_ITAV)
typedef struct OSSL_cmp_certorenccert_st {
int type;
union {
X509 *certificate;
OSSL_CRMF_ENCRYPTEDVALUE *encryptedCert;
} value;
} OSSL_CMP_CERTORENCCERT;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_CERTORENCCERT)
/*-
* CertifiedKeyPair ::= SEQUENCE {
* certOrEncCert CertOrEncCert,
* privateKey [0] EncryptedValue OPTIONAL,
* -- see [CRMF] for comment on encoding
* publicationInfo [1] PKIPublicationInfo OPTIONAL
* }
*/
typedef struct OSSL_cmp_certifiedkeypair_st {
OSSL_CMP_CERTORENCCERT *certOrEncCert;
OSSL_CRMF_ENCRYPTEDVALUE *privateKey;
OSSL_CRMF_PKIPUBLICATIONINFO *publicationInfo;
} OSSL_CMP_CERTIFIEDKEYPAIR;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_CERTIFIEDKEYPAIR)
/*-
* PKIStatusInfo ::= SEQUENCE {
* status PKIStatus,
* statusString PKIFreeText OPTIONAL,
* failInfo PKIFailureInfo OPTIONAL
* }
*/
struct OSSL_cmp_pkisi_st {
OSSL_CMP_PKISTATUS *status;
OSSL_CMP_PKIFREETEXT *statusString;
OSSL_CMP_PKIFAILUREINFO *failInfo;
} /* OSSL_CMP_PKISI */;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_PKISI)
DECLARE_ASN1_DUP_FUNCTION(OSSL_CMP_PKISI)
/*-
* RevReqContent ::= SEQUENCE OF RevDetails
*
* RevDetails ::= SEQUENCE {
* certDetails CertTemplate,
* crlEntryDetails Extensions OPTIONAL
* }
*/
typedef struct OSSL_cmp_revdetails_st {
OSSL_CRMF_CERTTEMPLATE *certDetails;
X509_EXTENSIONS *crlEntryDetails;
} OSSL_CMP_REVDETAILS;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_REVDETAILS)
DEFINE_STACK_OF(OSSL_CMP_REVDETAILS)
/*-
* RevRepContent ::= SEQUENCE {
* status SEQUENCE SIZE (1..MAX) OF PKIStatusInfo,
* -- in same order as was sent in RevReqContent
* revCerts [0] SEQUENCE SIZE (1..MAX) OF CertId
* OPTIONAL,
* -- IDs for which revocation was requested
* -- (same order as status)
* crls [1] SEQUENCE SIZE (1..MAX) OF CertificateList
* OPTIONAL
* -- the resulting CRLs (there may be more than one)
* }
*/
struct OSSL_cmp_revrepcontent_st {
STACK_OF(OSSL_CMP_PKISI) *status;
STACK_OF(OSSL_CRMF_CERTID) *revCerts;
STACK_OF(X509_CRL) *crls;
} /* OSSL_CMP_REVREPCONTENT */;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_REVREPCONTENT)
/*-
* KeyRecRepContent ::= SEQUENCE {
* status PKIStatusInfo,
* newSigCert [0] Certificate OPTIONAL,
* caCerts [1] SEQUENCE SIZE (1..MAX) OF
* Certificate OPTIONAL,
* keyPairHist [2] SEQUENCE SIZE (1..MAX) OF
* CertifiedKeyPair OPTIONAL
* }
*/
typedef struct OSSL_cmp_keyrecrepcontent_st {
OSSL_CMP_PKISI *status;
X509 *newSigCert;
STACK_OF(X509) *caCerts;
STACK_OF(OSSL_CMP_CERTIFIEDKEYPAIR) *keyPairHist;
} OSSL_CMP_KEYRECREPCONTENT;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_KEYRECREPCONTENT)
/*-
* ErrorMsgContent ::= SEQUENCE {
* pKIStatusInfo PKIStatusInfo,
* errorCode INTEGER OPTIONAL,
* -- implementation-specific error codes
* errorDetails PKIFreeText OPTIONAL
* -- implementation-specific error details
* }
*/
typedef struct OSSL_cmp_errormsgcontent_st {
OSSL_CMP_PKISI *pKIStatusInfo;
ASN1_INTEGER *errorCode;
OSSL_CMP_PKIFREETEXT *errorDetails;
} OSSL_CMP_ERRORMSGCONTENT;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_ERRORMSGCONTENT)
/*-
* CertConfirmContent ::= SEQUENCE OF CertStatus
*
* CertStatus ::= SEQUENCE {
* certHash OCTET STRING,
* -- the hash of the certificate, using the same hash algorithm
* -- as is used to create and verify the certificate signature
* certReqId INTEGER,
* -- to match this confirmation with the corresponding req/rep
* statusInfo PKIStatusInfo OPTIONAL
* }
*/
struct OSSL_cmp_certstatus_st {
ASN1_OCTET_STRING *certHash;
ASN1_INTEGER *certReqId;
OSSL_CMP_PKISI *statusInfo;
} /* OSSL_CMP_CERTSTATUS */;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_CERTSTATUS)
typedef STACK_OF(OSSL_CMP_CERTSTATUS) OSSL_CMP_CERTCONFIRMCONTENT;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_CERTCONFIRMCONTENT)
/*-
* CertResponse ::= SEQUENCE {
* certReqId INTEGER,
* -- to match this response with corresponding request (a value
* -- of -1 is to be used if certReqId is not specified in the
* -- corresponding request)
* status PKIStatusInfo,
* certifiedKeyPair CertifiedKeyPair OPTIONAL,
* rspInfo OCTET STRING OPTIONAL
* -- analogous to the id-regInfo-utf8Pairs string defined
* -- for regInfo in CertReqMsg [CRMF]
* }
*/
struct OSSL_cmp_certresponse_st {
ASN1_INTEGER *certReqId;
OSSL_CMP_PKISI *status;
OSSL_CMP_CERTIFIEDKEYPAIR *certifiedKeyPair;
ASN1_OCTET_STRING *rspInfo;
} /* OSSL_CMP_CERTRESPONSE */;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_CERTRESPONSE)
/*-
* CertRepMessage ::= SEQUENCE {
* caPubs [1] SEQUENCE SIZE (1..MAX) OF CMPCertificate
* OPTIONAL,
* response SEQUENCE OF CertResponse
* }
*/
struct OSSL_cmp_certrepmessage_st {
STACK_OF(X509) *caPubs;
STACK_OF(OSSL_CMP_CERTRESPONSE) *response;
} /* OSSL_CMP_CERTREPMESSAGE */;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_CERTREPMESSAGE)
/*-
* PollReqContent ::= SEQUENCE OF SEQUENCE {
* certReqId INTEGER
* }
*/
typedef struct OSSL_cmp_pollreq_st {
ASN1_INTEGER *certReqId;
} OSSL_CMP_POLLREQ;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_POLLREQ)
DEFINE_STACK_OF(OSSL_CMP_POLLREQ)
typedef STACK_OF(OSSL_CMP_POLLREQ) OSSL_CMP_POLLREQCONTENT;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_POLLREQCONTENT)
/*-
* PollRepContent ::= SEQUENCE OF SEQUENCE {
* certReqId INTEGER,
* checkAfter INTEGER, -- time in seconds
* reason PKIFreeText OPTIONAL
* }
*/
struct OSSL_cmp_pollrep_st {
ASN1_INTEGER *certReqId;
ASN1_INTEGER *checkAfter;
OSSL_CMP_PKIFREETEXT *reason;
} /* OSSL_CMP_POLLREP */;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_POLLREP)
DEFINE_STACK_OF(OSSL_CMP_POLLREP)
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_POLLREPCONTENT)
/*-
* PKIHeader ::= SEQUENCE {
* pvno INTEGER { cmp1999(1), cmp2000(2) },
* sender GeneralName,
* -- identifies the sender
* recipient GeneralName,
* -- identifies the intended recipient
* messageTime [0] GeneralizedTime OPTIONAL,
* -- time of production of this message (used when sender
* -- believes that the transport will be "suitable"; i.e.,
* -- that the time will still be meaningful upon receipt)
* protectionAlg [1] AlgorithmIdentifier OPTIONAL,
* -- algorithm used for calculation of protection bits
* senderKID [2] KeyIdentifier OPTIONAL,
* recipKID [3] KeyIdentifier OPTIONAL,
* -- to identify specific keys used for protection
* transactionID [4] OCTET STRING OPTIONAL,
* -- identifies the transaction; i.e., this will be the same in
* -- corresponding request, response, certConf, and PKIConf
* -- messages
* senderNonce [5] OCTET STRING OPTIONAL,
* recipNonce [6] OCTET STRING OPTIONAL,
* -- nonces used to provide replay protection, senderNonce
* -- is inserted by the creator of this message; recipNonce
* -- is a nonce previously inserted in a related message by
* -- the intended recipient of this message
* freeText [7] PKIFreeText OPTIONAL,
* -- this may be used to indicate context-specific instructions
* -- (this field is intended for human consumption)
* generalInfo [8] SEQUENCE SIZE (1..MAX) OF
* InfoTypeAndValue OPTIONAL
* -- this may be used to convey context-specific information
* -- (this field not primarily intended for human consumption)
* }
*/
struct OSSL_cmp_pkiheader_st {
ASN1_INTEGER *pvno;
GENERAL_NAME *sender;
GENERAL_NAME *recipient;
ASN1_GENERALIZEDTIME *messageTime; /* 0 */
X509_ALGOR *protectionAlg; /* 1 */
ASN1_OCTET_STRING *senderKID; /* 2 */
ASN1_OCTET_STRING *recipKID; /* 3 */
ASN1_OCTET_STRING *transactionID; /* 4 */
ASN1_OCTET_STRING *senderNonce; /* 5 */
ASN1_OCTET_STRING *recipNonce; /* 6 */
OSSL_CMP_PKIFREETEXT *freeText; /* 7 */
STACK_OF(OSSL_CMP_ITAV) *generalInfo; /* 8 */
} /* OSSL_CMP_PKIHEADER */;
typedef STACK_OF(OSSL_CMP_CHALLENGE) OSSL_CMP_POPODECKEYCHALLCONTENT;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_POPODECKEYCHALLCONTENT)
typedef STACK_OF(ASN1_INTEGER) OSSL_CMP_POPODECKEYRESPCONTENT;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_POPODECKEYRESPCONTENT)
typedef STACK_OF(OSSL_CMP_REVDETAILS) OSSL_CMP_REVREQCONTENT;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_REVREQCONTENT)
typedef STACK_OF(X509_CRL) OSSL_CMP_CRLANNCONTENT;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_CRLANNCONTENT)
typedef STACK_OF(OSSL_CMP_ITAV) OSSL_CMP_GENMSGCONTENT;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_GENMSGCONTENT)
typedef STACK_OF(OSSL_CMP_ITAV) OSSL_CMP_GENREPCONTENT;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_GENREPCONTENT)
/*-
* PKIBody ::= CHOICE { -- message-specific body elements
* ir [0] CertReqMessages, --Initialization Request
* ip [1] CertRepMessage, --Initialization Response
* cr [2] CertReqMessages, --Certification Request
* cp [3] CertRepMessage, --Certification Response
* p10cr [4] CertificationRequest, --imported from [PKCS10]
* popdecc [5] POPODecKeyChallContent, --pop Challenge
* popdecr [6] POPODecKeyRespContent, --pop Response
* kur [7] CertReqMessages, --Key Update Request
* kup [8] CertRepMessage, --Key Update Response
* krr [9] CertReqMessages, --Key Recovery Request
* krp [10] KeyRecRepContent, --Key Recovery Response
* rr [11] RevReqContent, --Revocation Request
* rp [12] RevRepContent, --Revocation Response
* ccr [13] CertReqMessages, --Cross-Cert. Request
* ccp [14] CertRepMessage, --Cross-Cert. Response
* ckuann [15] CAKeyUpdAnnContent, --CA Key Update Ann.
* cann [16] CertAnnContent, --Certificate Ann.
* rann [17] RevAnnContent, --Revocation Ann.
* crlann [18] CRLAnnContent, --CRL Announcement
* pkiconf [19] PKIConfirmContent, --Confirmation
* nested [20] NestedMessageContent, --Nested Message
* genm [21] GenMsgContent, --General Message
* genp [22] GenRepContent, --General Response
* error [23] ErrorMsgContent, --Error Message
* certConf [24] CertConfirmContent, --Certificate confirm
* pollReq [25] PollReqContent, --Polling request
* pollRep [26] PollRepContent --Polling response
*/
typedef struct OSSL_cmp_pkibody_st {
int type;
union {
OSSL_CRMF_MSGS *ir; /* 0 */
OSSL_CMP_CERTREPMESSAGE *ip; /* 1 */
OSSL_CRMF_MSGS *cr; /* 2 */
OSSL_CMP_CERTREPMESSAGE *cp; /* 3 */
/* p10cr [4] CertificationRequest, --imported from [PKCS10] */
/*
* PKCS10_CERTIFICATIONREQUEST is effectively X509_REQ
* so it is used directly
*/
X509_REQ *p10cr; /* 4 */
/* popdecc [5] POPODecKeyChallContent, --pop Challenge */
/* POPODecKeyChallContent ::= SEQUENCE OF Challenge */
OSSL_CMP_POPODECKEYCHALLCONTENT *popdecc; /* 5 */
/* popdecr [6] POPODecKeyRespContent, --pop Response */
/* POPODecKeyRespContent ::= SEQUENCE OF INTEGER */
OSSL_CMP_POPODECKEYRESPCONTENT *popdecr; /* 6 */
OSSL_CRMF_MSGS *kur; /* 7 */
OSSL_CMP_CERTREPMESSAGE *kup; /* 8 */
OSSL_CRMF_MSGS *krr; /* 9 */
/* krp [10] KeyRecRepContent, --Key Recovery Response */
OSSL_CMP_KEYRECREPCONTENT *krp; /* 10 */
/* rr [11] RevReqContent, --Revocation Request */
OSSL_CMP_REVREQCONTENT *rr; /* 11 */
/* rp [12] RevRepContent, --Revocation Response */
OSSL_CMP_REVREPCONTENT *rp; /* 12 */
/* ccr [13] CertReqMessages, --Cross-Cert. Request */
OSSL_CRMF_MSGS *ccr; /* 13 */
/* ccp [14] CertRepMessage, --Cross-Cert. Response */
OSSL_CMP_CERTREPMESSAGE *ccp; /* 14 */
/* ckuann [15] CAKeyUpdAnnContent, --CA Key Update Ann. */
OSSL_CMP_CAKEYUPDANNCONTENT *ckuann; /* 15 */
/* cann [16] CertAnnContent, --Certificate Ann. */
/* OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly */
X509 *cann; /* 16 */
/* rann [17] RevAnnContent, --Revocation Ann. */
OSSL_CMP_REVANNCONTENT *rann; /* 17 */
/* crlann [18] CRLAnnContent, --CRL Announcement */
/* CRLAnnContent ::= SEQUENCE OF CertificateList */
OSSL_CMP_CRLANNCONTENT *crlann;
/* PKIConfirmContent ::= NULL */
/* pkiconf [19] PKIConfirmContent, --Confirmation */
/* OSSL_CMP_PKICONFIRMCONTENT would be only a typedef of ASN1_NULL */
/* OSSL_CMP_CONFIRMCONTENT *pkiconf; */
/*
* NOTE: this should ASN1_NULL according to the RFC
* but there might be a struct in it when sent from faulty servers...
*/
ASN1_TYPE *pkiconf; /* 19 */
/* nested [20] NestedMessageContent, --Nested Message */
/* NestedMessageContent ::= PKIMessages */
OSSL_CMP_MSGS *nested; /* 20 */
/* genm [21] GenMsgContent, --General Message */
/* GenMsgContent ::= SEQUENCE OF InfoTypeAndValue */
OSSL_CMP_GENMSGCONTENT *genm; /* 21 */
/* genp [22] GenRepContent, --General Response */
/* GenRepContent ::= SEQUENCE OF InfoTypeAndValue */
OSSL_CMP_GENREPCONTENT *genp; /* 22 */
/* error [23] ErrorMsgContent, --Error Message */
OSSL_CMP_ERRORMSGCONTENT *error; /* 23 */
/* certConf [24] CertConfirmContent, --Certificate confirm */
OSSL_CMP_CERTCONFIRMCONTENT *certConf; /* 24 */
/* pollReq [25] PollReqContent, --Polling request */
OSSL_CMP_POLLREQCONTENT *pollReq;
/* pollRep [26] PollRepContent --Polling response */
OSSL_CMP_POLLREPCONTENT *pollRep;
} value;
} OSSL_CMP_PKIBODY;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_PKIBODY)
/*-
* PKIProtection ::= BIT STRING
*
* PKIMessages ::= SEQUENCE SIZE (1..MAX) OF PKIMessage
*
* PKIMessage ::= SEQUENCE {
* header PKIHeader,
* body PKIBody,
* protection [0] PKIProtection OPTIONAL,
* extraCerts [1] SEQUENCE SIZE (1..MAX) OF CMPCertificate
* OPTIONAL
* }
*/
struct OSSL_cmp_msg_st {
OSSL_CMP_PKIHEADER *header;
OSSL_CMP_PKIBODY *body;
ASN1_BIT_STRING *protection; /* 0 */
/* OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly */
STACK_OF(X509) *extraCerts; /* 1 */
} /* OSSL_CMP_MSG */;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_MSG)
/*-
* ProtectedPart ::= SEQUENCE {
* header PKIHeader,
* body PKIBody
* }
*/
typedef struct cmp_protectedpart_st {
OSSL_CMP_PKIHEADER *header;
OSSL_CMP_PKIBODY *body;
} CMP_PROTECTEDPART;
DECLARE_ASN1_FUNCTIONS(CMP_PROTECTEDPART)
/*-
* this is not defined here as it is already in CRMF:
* id-PasswordBasedMac OBJECT IDENTIFIER ::= {1 2 840 113533 7 66 13}
* PBMParameter ::= SEQUENCE {
* salt OCTET STRING,
* -- note: implementations MAY wish to limit acceptable sizes
* -- of this string to values appropriate for their environment
* -- in order to reduce the risk of denial-of-service attacks
* owf AlgorithmIdentifier,
* -- AlgId for a One-Way Function (SHA-1 recommended)
* iterationCount INTEGER,
* -- number of times the OWF is applied
* -- note: implementations MAY wish to limit acceptable sizes
* -- of this integer to values appropriate for their environment
* -- in order to reduce the risk of denial-of-service attacks
* mac AlgorithmIdentifier
* -- the MAC AlgId (e.g., DES-MAC, Triple-DES-MAC [PKCS11],
* } -- or HMAC [RFC2104, RFC2202])
*/
/*-
* TODO: this is not yet defined here - but DH is anyway not used yet
*
* id-DHBasedMac OBJECT IDENTIFIER ::= {1 2 840 113533 7 66 30}
* DHBMParameter ::= SEQUENCE {
* owf AlgorithmIdentifier,
* -- AlgId for a One-Way Function (SHA-1 recommended)
* mac AlgorithmIdentifier
* -- the MAC AlgId (e.g., DES-MAC, Triple-DES-MAC [PKCS11],
* } -- or HMAC [RFC2104, RFC2202])
*/
/*-
* The following is not cared for, because it is described in section 5.2.5
* that this is beyond the scope of CMP
* OOBCert ::= CMPCertificate
*
* OOBCertHash ::= SEQUENCE {
* hashAlg [0] AlgorithmIdentifier OPTIONAL,
* certId [1] CertId OPTIONAL,
* hashVal BIT STRING
* -- hashVal is calculated over the DER encoding of the
* -- self-signed certificate with the identifier certID.
* }
*/
#endif /* !defined OSSL_HEADER_CMP_INT_H */
crypto/cms/cms_att.c
+133 -1
View File
@@ -13,6 +13,56 @@
#include <openssl/err.h>
#include <openssl/cms.h>
#include "cms_lcl.h"
#include "internal/nelem.h"
/*-
* Attribute flags.
* CMS attribute restrictions are discussed in
* - RFC 5652 Section 11.
* ESS attribute restrictions are discussed in
* - RFC 2634 Section 1.3.4 AND
* - RFC 5035 Section 5.4
*/
/* This is a signed attribute */
#define CMS_ATTR_F_SIGNED 0x01
/* This is an unsigned attribute */
#define CMS_ATTR_F_UNSIGNED 0x02
/* Must be present if there are any other attributes of the same type */
#define CMS_ATTR_F_REQUIRED_COND 0x10
/* There can only be one instance of this attribute */
#define CMS_ATTR_F_ONLY_ONE 0x20
/* The Attribute's value must have exactly one entry */
#define CMS_ATTR_F_ONE_ATTR_VALUE 0x40
/* Attributes rules for different attributes */
static const struct {
int nid; /* The attribute id */
int flags;
} cms_attribute_properties[] = {
/* See RFC Section 11 */
{ NID_pkcs9_contentType, CMS_ATTR_F_SIGNED
| CMS_ATTR_F_ONLY_ONE
| CMS_ATTR_F_ONE_ATTR_VALUE
| CMS_ATTR_F_REQUIRED_COND },
{ NID_pkcs9_messageDigest, CMS_ATTR_F_SIGNED
| CMS_ATTR_F_ONLY_ONE
| CMS_ATTR_F_ONE_ATTR_VALUE
| CMS_ATTR_F_REQUIRED_COND },
{ NID_pkcs9_signingTime, CMS_ATTR_F_SIGNED
| CMS_ATTR_F_ONLY_ONE
| CMS_ATTR_F_ONE_ATTR_VALUE },
{ NID_pkcs9_countersignature, CMS_ATTR_F_UNSIGNED },
/* ESS */
{ NID_id_smime_aa_signingCertificate, CMS_ATTR_F_SIGNED
| CMS_ATTR_F_ONLY_ONE
| CMS_ATTR_F_ONE_ATTR_VALUE },
{ NID_id_smime_aa_signingCertificateV2, CMS_ATTR_F_SIGNED
| CMS_ATTR_F_ONLY_ONE
| CMS_ATTR_F_ONE_ATTR_VALUE },
{ NID_id_smime_aa_receiptRequest, CMS_ATTR_F_SIGNED
| CMS_ATTR_F_ONLY_ONE
| CMS_ATTR_F_ONE_ATTR_VALUE }
};
/* CMS SignedData Attribute utilities */
@@ -149,4 +199,86 @@ void *CMS_unsigned_get0_data_by_OBJ(CMS_SignerInfo *si, ASN1_OBJECT *oid,
return X509at_get0_data_by_OBJ(si->unsignedAttrs, oid, lastpos, type);
}
/* Specific attribute cases */
/*
* Retrieve an attribute by nid from a stack of attributes starting at index
* *lastpos + 1.
* Returns the attribute or NULL if there is no attribute.
* If an attribute was found *lastpos returns the index of the found attribute.
*/
static X509_ATTRIBUTE *cms_attrib_get(int nid,
const STACK_OF(X509_ATTRIBUTE) *attrs,
int *lastpos)
{
X509_ATTRIBUTE *at;
int loc;
loc = X509at_get_attr_by_NID(attrs, nid, *lastpos);
if (loc < 0)
return NULL;
at = X509at_get_attr(attrs, loc);
*lastpos = loc;
return at;
}
static int cms_check_attribute(int nid, int flags, int type,
const STACK_OF(X509_ATTRIBUTE) *attrs,
int have_attrs)
{
int lastpos = -1;
X509_ATTRIBUTE *at = cms_attrib_get(nid, attrs, &lastpos);
if (at != NULL) {
int count = X509_ATTRIBUTE_count(at);
/* Is this attribute allowed? */
if (((flags & type) == 0)
/* check if multiple attributes of the same type are allowed */
|| (((flags & CMS_ATTR_F_ONLY_ONE) != 0)
&& cms_attrib_get(nid, attrs, &lastpos) != NULL)
/* Check if attribute should have exactly one value in its set */
|| (((flags & CMS_ATTR_F_ONE_ATTR_VALUE) != 0)
&& count != 1)
/* There should be at least one value */
|| count == 0)
return 0;
} else {
/* fail if a required attribute is missing */
if (have_attrs
&& ((flags & CMS_ATTR_F_REQUIRED_COND) != 0)
&& (flags & type) != 0)
return 0;
}
return 1;
}
/*
* Check that the signerinfo attributes obey the attribute rules which includes
* the following checks
* - If any signed attributes exist then there must be a Content Type
* and Message Digest attribute in the signed attributes.
* - The countersignature attribute is an optional unsigned attribute only.
* - Content Type, Message Digest, and Signing time attributes are signed
* attributes. Only one instance of each is allowed, with each of these
* attributes containing a single attribute value in its set.
*/
int CMS_si_check_attributes(const CMS_SignerInfo *si)
{
int i;
int have_signed_attrs = (CMS_signed_get_attr_count(si) > 0);
int have_unsigned_attrs = (CMS_unsigned_get_attr_count(si) > 0);
for (i = 0; i < (int)OSSL_NELEM(cms_attribute_properties); ++i) {
int nid = cms_attribute_properties[i].nid;
int flags = cms_attribute_properties[i].flags;
if (!cms_check_attribute(nid, flags, CMS_ATTR_F_SIGNED,
si->signedAttrs, have_signed_attrs)
|| !cms_check_attribute(nid, flags, CMS_ATTR_F_UNSIGNED,
si->unsignedAttrs, have_unsigned_attrs)) {
CMSerr(CMS_F_CMS_SI_CHECK_ATTRIBUTES, CMS_R_ATTRIBUTE_ERROR);
return 0;
}
}
return 1;
}
crypto/cms/cms_err.c
+4 -1
View File
@@ -1,6 +1,6 @@
/*
* Generated by util/mkerr.pl DO NOT EDIT
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -150,6 +150,8 @@ static const ERR_STRING_DATA CMS_str_functs[] = {
{ERR_PACK(ERR_LIB_CMS, CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT, 0),
"CMS_SignerInfo_verify_content"},
{ERR_PACK(ERR_LIB_CMS, CMS_F_CMS_SIGN_RECEIPT, 0), "CMS_sign_receipt"},
{ERR_PACK(ERR_LIB_CMS, CMS_F_CMS_SI_CHECK_ATTRIBUTES, 0),
"CMS_si_check_attributes"},
{ERR_PACK(ERR_LIB_CMS, CMS_F_CMS_STREAM, 0), "CMS_stream"},
{ERR_PACK(ERR_LIB_CMS, CMS_F_CMS_UNCOMPRESS, 0), "CMS_uncompress"},
{ERR_PACK(ERR_LIB_CMS, CMS_F_CMS_VERIFY, 0), "CMS_verify"},
@@ -159,6 +161,7 @@ static const ERR_STRING_DATA CMS_str_functs[] = {
static const ERR_STRING_DATA CMS_str_reasons[] = {
{ERR_PACK(ERR_LIB_CMS, 0, CMS_R_ADD_SIGNER_ERROR), "add signer error"},
{ERR_PACK(ERR_LIB_CMS, 0, CMS_R_ATTRIBUTE_ERROR), "attribute error"},
{ERR_PACK(ERR_LIB_CMS, 0, CMS_R_CERTIFICATE_ALREADY_PRESENT),
"certificate already present"},
{ERR_PACK(ERR_LIB_CMS, 0, CMS_R_CERTIFICATE_HAS_NO_KEYID),
crypto/cms/cms_lcl.h
+2
View File
@@ -416,6 +416,8 @@ int cms_RecipientInfo_kari_encrypt(const CMS_ContentInfo *cms,
/* PWRI routines */
int cms_RecipientInfo_pwri_crypt(const CMS_ContentInfo *cms, CMS_RecipientInfo *ri,
int en_de);
/* SignerInfo routines */
int CMS_si_check_attributes(const CMS_SignerInfo *si);
DECLARE_ASN1_ITEM(CMS_CertificateChoices)
DECLARE_ASN1_ITEM(CMS_DigestedData)
crypto/cms/cms_sd.c
+39 -14
View File
@@ -109,6 +109,27 @@ static void cms_sd_set_version(CMS_SignedData *sd)
}
/*
* RFC 5652 Section 11.1 Content Type
* The content-type attribute within signed-data MUST
* 1) be present if there are signed attributes
* 2) match the content type in the signed-data,
* 3) be a signed attribute.
* 4) not have more than one copy of the attribute.
*
* Note that since the CMS_SignerInfo_sign() always adds the "signing time"
* attribute, the content type attribute MUST be added also.
* Assumptions: This assumes that the attribute does not already exist.
*/
static int cms_set_si_contentType_attr(CMS_ContentInfo *cms, CMS_SignerInfo *si)
{
ASN1_OBJECT *ctype = cms->d.signedData->encapContentInfo->eContentType;
/* Add the contentType attribute */
return CMS_signed_add1_attr_by_NID(si, NID_pkcs9_contentType,
V_ASN1_OBJECT, ctype, -1) > 0;
}
/* Copy an existing messageDigest value */
static int cms_copy_messageDigest(CMS_ContentInfo *cms, CMS_SignerInfo *si)
@@ -325,13 +346,6 @@ CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms,
if (!i)
goto merr;
}
if (flags & CMS_REUSE_DIGEST) {
if (!cms_copy_messageDigest(cms, si))
goto err;
if (!(flags & (CMS_PARTIAL | CMS_KEY_PARAM)) &&
!CMS_SignerInfo_sign(si))
goto err;
}
if (flags & CMS_CADES) {
ESS_SIGNING_CERT *sc = NULL;
ESS_SIGNING_CERT_V2 *sc2 = NULL;
@@ -353,6 +367,15 @@ CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms,
if (!add_sc)
goto err;
}
if (flags & CMS_REUSE_DIGEST) {
if (!cms_copy_messageDigest(cms, si))
goto err;
if (!cms_set_si_contentType_attr(cms, si))
goto err;
if (!(flags & (CMS_PARTIAL | CMS_KEY_PARAM)) &&
!CMS_SignerInfo_sign(si))
goto err;
}
}
if (!(flags & CMS_NOCERTS)) {
@@ -370,8 +393,7 @@ CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms,
goto err;
if (EVP_PKEY_CTX_set_signature_md(si->pctx, md) <= 0)
goto err;
} else if (EVP_DigestSignInit(si->mctx, &si->pctx, md, NULL, pk) <=
0)
} else if (EVP_DigestSignInit(si->mctx, &si->pctx, md, NULL, pk) <= 0)
goto err;
}
@@ -579,8 +601,6 @@ static int cms_SignerInfo_content_sign(CMS_ContentInfo *cms,
*/
if (CMS_signed_get_attr_count(si) >= 0) {
ASN1_OBJECT *ctype =
cms->d.signedData->encapContentInfo->eContentType;
unsigned char md[EVP_MAX_MD_SIZE];
unsigned int mdlen;
if (!EVP_DigestFinal_ex(mctx, md, &mdlen))
@@ -589,9 +609,9 @@ static int cms_SignerInfo_content_sign(CMS_ContentInfo *cms,
V_ASN1_OCTET_STRING, md, mdlen))
goto err;
/* Copy content type across */
if (CMS_signed_add1_attr_by_NID(si, NID_pkcs9_contentType,
V_ASN1_OBJECT, ctype, -1) <= 0)
if (!cms_set_si_contentType_attr(cms, si))
goto err;
if (!CMS_SignerInfo_sign(si))
goto err;
} else if (si->pctx) {
@@ -671,6 +691,9 @@ int CMS_SignerInfo_sign(CMS_SignerInfo *si)
goto err;
}
if (!CMS_si_check_attributes(si))
goto err;
if (si->pctx)
pctx = si->pctx;
else {
@@ -717,7 +740,6 @@ int CMS_SignerInfo_sign(CMS_SignerInfo *si)
OPENSSL_free(abuf);
EVP_MD_CTX_reset(mctx);
return 0;
}
int CMS_SignerInfo_verify(CMS_SignerInfo *si)
@@ -732,6 +754,9 @@ int CMS_SignerInfo_verify(CMS_SignerInfo *si)
return -1;
}
if (!CMS_si_check_attributes(si))
return -1;
md = EVP_get_digestbyobj(si->digestAlgorithm->algorithm);
if (md == NULL)
return -1;
crypto/conf/conf_sap.c
+1 -1
View File
@@ -42,7 +42,7 @@ void OPENSSL_config(const char *appname)
int openssl_config_int(const OPENSSL_INIT_SETTINGS *settings)
{
int ret;
int ret = 0;
const char *filename;
const char *appname;
unsigned long flags;
crypto/context.c
+19 -34
View File
@@ -7,7 +7,7 @@
* https://www.openssl.org/source/license.html
*/
#include "internal/cryptlib.h"
#include "internal/cryptlib_int.h"
#include "internal/thread_once.h"
struct openssl_ctx_onfree_list_st {
@@ -80,6 +80,8 @@ static int context_deinit(OPENSSL_CTX *ctx)
if (ctx == NULL)
return 1;
ossl_ctx_thread_stop(ctx);
onfree = ctx->onfreelist;
while (onfree != NULL) {
onfree->fn(ctx);
@@ -129,6 +131,18 @@ void OPENSSL_CTX_free(OPENSSL_CTX *ctx)
OPENSSL_free(ctx);
}
OPENSSL_CTX *openssl_ctx_get_concrete(OPENSSL_CTX *ctx)
{
#ifndef FIPS_MODE
if (ctx == NULL) {
if (!RUN_ONCE(&default_context_init, do_default_context_init))
return 0;
return default_context;
}
#endif
return ctx;
}
static void openssl_ctx_generic_new(void *parent_ign, void *ptr_ign,
CRYPTO_EX_DATA *ad, int index,
long argl_ign, void *argp)
@@ -154,13 +168,7 @@ static int openssl_ctx_init_index(OPENSSL_CTX *ctx, int static_index,
{
int idx;
#ifndef FIPS_MODE
if (ctx == NULL) {
if (!RUN_ONCE(&default_context_init, do_default_context_init))
return 0;
ctx = default_context;
}
#endif
ctx = openssl_ctx_get_concrete(ctx);
if (ctx == NULL)
return 0;
@@ -180,13 +188,7 @@ void *openssl_ctx_get_data(OPENSSL_CTX *ctx, int index,
{
void *data = NULL;
#ifndef FIPS_MODE
if (ctx == NULL) {
if (!RUN_ONCE(&default_context_init, do_default_context_init))
return NULL;
ctx = default_context;
}
#endif
ctx = openssl_ctx_get_concrete(ctx);
if (ctx == NULL)
return NULL;
@@ -210,18 +212,7 @@ void *openssl_ctx_get_data(OPENSSL_CTX *ctx, int index,
OSSL_EX_DATA_GLOBAL *openssl_ctx_get_ex_data_global(OPENSSL_CTX *ctx)
{
/*
* The default context code is not needed in FIPS_MODE and ctx should never
* be NULL in the FIPS provider. However we compile this code out to ensure
* we fail immediately if ctx == NULL in FIPS_MODE
*/
#ifndef FIPS_MODE
if (ctx == NULL) {
if (!RUN_ONCE(&default_context_init, do_default_context_init))
return NULL;
ctx = default_context;
}
#endif
ctx = openssl_ctx_get_concrete(ctx);
if (ctx == NULL)
return NULL;
return &ctx->global;
@@ -232,13 +223,7 @@ int openssl_ctx_run_once(OPENSSL_CTX *ctx, unsigned int idx,
{
int done = 0, ret = 0;
#ifndef FIPS_MODE
if (ctx == NULL) {
if (!RUN_ONCE(&default_context_init, do_default_context_init))
return 0;
ctx = default_context;
}
#endif
ctx = openssl_ctx_get_concrete(ctx);
if (ctx == NULL)
return 0;
crypto/core_fetch.c
+9 -4
View File
@@ -31,6 +31,9 @@ static int ossl_method_construct_this(OSSL_PROVIDER *provider, void *cbdata)
const OSSL_ALGORITHM *map =
ossl_provider_query_operation(provider, data->operation_id, &no_store);
if (map == NULL)
return 0;
while (map->algorithm_name != NULL) {
const OSSL_ALGORITHM *thismap = map++;
void *method = NULL;
@@ -56,12 +59,12 @@ static int ossl_method_construct_this(OSSL_PROVIDER *provider, void *cbdata)
* If we haven't been told not to store,
* add to the global store
*/
data->mcm->put(data->libctx, NULL, method,
data->mcm->put(data->libctx, NULL, method, data->operation_id,
thismap->algorithm_name,
thismap->property_definition, data->mcm_data);
}
data->mcm->put(data->libctx, data->store, method,
data->mcm->put(data->libctx, data->store, method, data->operation_id,
thismap->algorithm_name, thismap->property_definition,
data->mcm_data);
@@ -80,7 +83,8 @@ void *ossl_method_construct(OPENSSL_CTX *libctx, int operation_id,
void *method = NULL;
if ((method =
mcm->get(libctx, NULL, name, propquery, mcm_data)) == NULL) {
mcm->get(libctx, NULL, operation_id, name, propquery, mcm_data))
== NULL) {
struct construct_data_st cbdata;
/*
@@ -98,7 +102,8 @@ void *ossl_method_construct(OPENSSL_CTX *libctx, int operation_id,
ossl_provider_forall_loaded(libctx, ossl_method_construct_this,
&cbdata);
method = mcm->get(libctx, cbdata.store, name, propquery, mcm_data);
method = mcm->get(libctx, cbdata.store, operation_id, name,
propquery, mcm_data);
mcm->dealloc_tmp_store(cbdata.store);
}
crypto/core_namemap.c
+98 -95
View File
@@ -7,45 +7,52 @@
* https://www.openssl.org/source/license.html
*/
#include "e_os.h" /* strcasecmp */
#include "internal/namemap.h"
#include <openssl/lhash.h>
#include <openssl/safestack.h>
#include "internal/lhash.h" /* openssl_lh_strcasehash */
/* The namemap entry */
/*-
* The namenum entry
* =================
*/
typedef struct {
char *name;
int number;
const char *name;
char body[1]; /* Sized appropriately to contain the name */
} NAMEMAP_ENTRY;
} NAMENUM_ENTRY;
DEFINE_LHASH_OF(NAMEMAP_ENTRY);
DEFINE_STACK_OF(NAMEMAP_ENTRY)
DEFINE_LHASH_OF(NAMENUM_ENTRY);
/* The namemap, which provides for bidirectional indexing */
/*-
* The namemap itself
* ==================
*/
struct ossl_namemap_st {
/* Flags */
unsigned int stored:1; /* If 1, it's stored in a library context */
CRYPTO_RWLOCK *lock;
LHASH_OF(NAMEMAP_ENTRY) *namenum; /* Name->number mapping */
STACK_OF(NAMEMAP_ENTRY) *numname; /* Number->name mapping */
LHASH_OF(NAMENUM_ENTRY) *namenum; /* Name->number mapping */
int max_number; /* Current max number */
};
/* LHASH callbacks */
static unsigned long namemap_hash(const NAMEMAP_ENTRY *n)
static unsigned long namenum_hash(const NAMENUM_ENTRY *n)
{
return OPENSSL_LH_strhash(n->name);
return openssl_lh_strcasehash(n->name);
}
static int namemap_cmp(const NAMEMAP_ENTRY *a, const NAMEMAP_ENTRY *b)
static int namenum_cmp(const NAMENUM_ENTRY *a, const NAMENUM_ENTRY *b)
{
return strcmp(a->name, b->name);
return strcasecmp(a->name, b->name);
}
static void namemap_free(NAMEMAP_ENTRY *n)
static void namenum_free(NAMENUM_ENTRY *n)
{
if (n != NULL)
OPENSSL_free(n->name);
OPENSSL_free(n);
}
@@ -75,7 +82,10 @@ static const OPENSSL_CTX_METHOD stored_namemap_method = {
stored_namemap_free,
};
/* API functions */
/*-
* API functions
* =============
*/
OSSL_NAMEMAP *ossl_namemap_stored(OPENSSL_CTX *libctx)
{
@@ -89,11 +99,9 @@ OSSL_NAMEMAP *ossl_namemap_new(void)
if ((namemap = OPENSSL_zalloc(sizeof(*namemap))) != NULL
&& (namemap->lock = CRYPTO_THREAD_lock_new()) != NULL
&& (namemap->numname = sk_NAMEMAP_ENTRY_new_null()) != NULL
&& (namemap->namenum =
lh_NAMEMAP_ENTRY_new(namemap_hash, namemap_cmp)) != NULL) {
lh_NAMENUM_ENTRY_new(namenum_hash, namenum_cmp)) != NULL)
return namemap;
}
ossl_namemap_free(namemap);
return NULL;
@@ -104,69 +112,71 @@ void ossl_namemap_free(OSSL_NAMEMAP *namemap)
if (namemap == NULL || namemap->stored)
return;
/* The elements will be freed by sk_NAMEMAP_ENTRY_pop_free() */
lh_NAMEMAP_ENTRY_free(namemap->namenum);
sk_NAMEMAP_ENTRY_pop_free(namemap->numname, namemap_free);
lh_NAMENUM_ENTRY_doall(namemap->namenum, namenum_free);
lh_NAMENUM_ENTRY_free(namemap->namenum);
CRYPTO_THREAD_lock_free(namemap->lock);
OPENSSL_free(namemap);
}
/*
* TODO(3.0) It isn't currently possible to have a default namemap in the
* FIPS module because if init and cleanup constraints, so we currently
* disable the code that would allow it when FIPS_MODE is defined.
*/
const char *ossl_namemap_name(const OSSL_NAMEMAP *namemap, int number)
{
NAMEMAP_ENTRY *entry;
#ifndef FIPS_MODE
if (namemap == NULL)
namemap = ossl_namemap_stored(NULL);
#endif
if (namemap == NULL || number == 0)
return NULL;
CRYPTO_THREAD_read_lock(namemap->lock);
entry = sk_NAMEMAP_ENTRY_value(namemap->numname, number);
CRYPTO_THREAD_unlock(namemap->lock);
if (entry != NULL)
return entry->name;
return NULL;
}
int ossl_namemap_number(const OSSL_NAMEMAP *namemap, const char *name)
{
NAMEMAP_ENTRY *entry, template;
#ifndef FIPS_MODE
if (namemap == NULL)
namemap = ossl_namemap_stored(NULL);
#endif
if (namemap == NULL)
return 0;
template.name = name;
CRYPTO_THREAD_read_lock(namemap->lock);
entry = lh_NAMEMAP_ENTRY_retrieve(namemap->namenum, &template);
CRYPTO_THREAD_unlock(namemap->lock);
if (entry == NULL)
return 0;
return entry->number;
}
int ossl_namemap_add(OSSL_NAMEMAP *namemap, const char *name)
{
NAMEMAP_ENTRY *entry;
typedef struct doall_names_data_st {
int number;
void (*fn)(const char *name, void *data);
void *data;
} DOALL_NAMES_DATA;
static void do_name(const NAMENUM_ENTRY *namenum, DOALL_NAMES_DATA *data)
{
if (namenum->number == data->number)
data->fn(namenum->name, data->data);
}
IMPLEMENT_LHASH_DOALL_ARG_CONST(NAMENUM_ENTRY, DOALL_NAMES_DATA);
void ossl_namemap_doall_names(const OSSL_NAMEMAP *namemap, int number,
void (*fn)(const char *name, void *data),
void *data)
{
DOALL_NAMES_DATA cbdata;
cbdata.number = number;
cbdata.fn = fn;
cbdata.data = data;
CRYPTO_THREAD_read_lock(namemap->lock);
lh_NAMENUM_ENTRY_doall_DOALL_NAMES_DATA(namemap->namenum, do_name,
&cbdata);
CRYPTO_THREAD_unlock(namemap->lock);
}
int ossl_namemap_name2num(const OSSL_NAMEMAP *namemap, const char *name)
{
NAMENUM_ENTRY *namenum_entry, namenum_tmpl;
int number = 0;
#ifndef FIPS_MODE
if (namemap == NULL)
namemap = ossl_namemap_stored(NULL);
#endif
if (namemap == NULL)
return 0;
namenum_tmpl.name = (char *)name;
namenum_tmpl.number = 0;
CRYPTO_THREAD_read_lock(namemap->lock);
namenum_entry =
lh_NAMENUM_ENTRY_retrieve(namemap->namenum, &namenum_tmpl);
if (namenum_entry != NULL)
number = namenum_entry->number;
CRYPTO_THREAD_unlock(namemap->lock);
return number;
}
int ossl_namemap_add(OSSL_NAMEMAP *namemap, int number, const char *name)
{
NAMENUM_ENTRY *namenum = NULL;
int tmp_number;
#ifndef FIPS_MODE
if (namemap == NULL)
@@ -176,36 +186,29 @@ int ossl_namemap_add(OSSL_NAMEMAP *namemap, const char *name)
if (name == NULL || namemap == NULL)
return 0;
if ((number = ossl_namemap_number(namemap, name)) != 0)
return number; /* Pretend success */
if ((entry = OPENSSL_zalloc(sizeof(*entry) + strlen(name))) == NULL)
goto err;
strcpy(entry->body, name);
entry->name = entry->body;
if ((tmp_number = ossl_namemap_name2num(namemap, name)) != 0)
return tmp_number; /* Pretend success */
CRYPTO_THREAD_write_lock(namemap->lock);
entry->number = sk_NAMEMAP_ENTRY_push(namemap->numname, entry);
if (entry->number == 0)
if ((namenum = OPENSSL_zalloc(sizeof(*namenum))) == NULL
|| (namenum->name = OPENSSL_strdup(name)) == NULL)
goto err;
(void)lh_NAMEMAP_ENTRY_insert(namemap->namenum, entry);
if (lh_NAMEMAP_ENTRY_error(namemap->namenum))
namenum->number = tmp_number =
number != 0 ? number : ++namemap->max_number;
(void)lh_NAMENUM_ENTRY_insert(namemap->namenum, namenum);
if (lh_NAMENUM_ENTRY_error(namemap->namenum))
goto err;
CRYPTO_THREAD_unlock(namemap->lock);
return entry->number;
return tmp_number;
err:
if (entry != NULL) {
if (entry->number != 0)
(void)sk_NAMEMAP_ENTRY_pop(namemap->numname);
lh_NAMEMAP_ENTRY_delete(namemap->namenum, entry);
namenum_free(namenum);
CRYPTO_THREAD_unlock(namemap->lock);
}
return 0;
}
crypto/crmf/crmf_asn.c
+3 -3
View File
@@ -1,7 +1,7 @@
/*-
* Copyright 2007-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright Nokia 2007-2018
* Copyright Siemens AG 2015-2018
* Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved.
* Copyright Nokia 2007-2019
* Copyright Siemens AG 2015-2019
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
crypto/crmf/crmf_int.h
+3 -3
View File
@@ -1,7 +1,7 @@
/*-
* Copyright 2007-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright Nokia 2007-2018
* Copyright Siemens AG 2015-2018
* Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved.
* Copyright Nokia 2007-2019
* Copyright Siemens AG 2015-2019
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
crypto/crmf/crmf_lib.c
+2 -2
View File
@@ -1,7 +1,7 @@
/*-
* Copyright 2007-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved.
* Copyright Nokia 2007-2018
* Copyright Siemens AG 2015-2018
* Copyright Siemens AG 2015-2019
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
crypto/crmf/crmf_pbm.c
+3 -3
View File
@@ -1,7 +1,7 @@
/*-
* Copyright 2007-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright Nokia 2007-2018
* Copyright Siemens AG 2015-2018
* Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved.
* Copyright Nokia 2007-2019
* Copyright Siemens AG 2015-2019
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
crypto/des/build.info
+15 -1
View File
@@ -1,10 +1,24 @@
$DESASM=des_enc.c fcrypt_b.c
IF[{- !$disabled{asm} -}]
$DESASM_x86=des-586.s crypt586.s
$DESASM_ia64=ghash-ia64.s
$DESASM_sparcv9=des_enc-sparc.S fcrypt_b.c dest4-sparcv9.S
$DESASM_sparcv8=des_enc-sparc.S fcrypt_b.c
# Now that we have defined all the arch specific variables, use the
# appropriate one
IF[$DESASM_{- $target{asm_arch} -}]
$DESASM=$DESASM_{- $target{asm_arch} -}
ENDIF
ENDIF
LIBS=../../libcrypto
SOURCE[../../libcrypto]=\
set_key.c ecb_enc.c cbc_enc.c \
ecb3_enc.c cfb64enc.c cfb64ede.c cfb_enc.c \
ofb64ede.c ofb64enc.c ofb_enc.c \
str2key.c pcbc_enc.c qud_cksm.c rand_key.c \
{- $target{des_asm_src} -} \
$DESASM \
fcrypt.c xcbc_enc.c cbc_cksm.c
GENERATE[des_enc-sparc.S]=asm/des_enc.m4
crypto/des/set_key.c
-8
View File
@@ -18,9 +18,6 @@
#include <openssl/crypto.h>
#include "des_locl.h"
/* defaults to false */
OPENSSL_IMPLEMENT_GLOBAL(int, DES_check_key, 0)
static const unsigned char odd_parity[256] = {
1, 1, 2, 2, 4, 4, 7, 7, 8, 8, 11, 11, 13, 13, 14, 14,
16, 16, 19, 19, 21, 21, 22, 22, 25, 25, 26, 26, 28, 28, 31, 31,
@@ -277,12 +274,7 @@ static const DES_LONG des_skb[8][64] = {
int DES_set_key(const_DES_cblock *key, DES_key_schedule *schedule)
{
if (DES_check_key) {
return DES_set_key_checked(key, schedule);
} else {
DES_set_key_unchecked(key, schedule);
return 0;
}
}
/*-
crypto/dh/dh_ameth.c
+14 -2
View File
@@ -488,6 +488,18 @@ static int dh_cms_encrypt(CMS_RecipientInfo *ri);
#endif
static int dh_pkey_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
{
switch (op) {
case ASN1_PKEY_CTRL_SET1_TLS_ENCPT:
return dh_buf2key(EVP_PKEY_get0_DH(pkey), arg2, arg1);
case ASN1_PKEY_CTRL_GET1_TLS_ENCPT:
return dh_key2buf(EVP_PKEY_get0_DH(pkey), arg2);
default:
return -2;
}
}
static int dhx_pkey_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
{
switch (op) {
#ifndef OPENSSL_NO_CMS
@@ -558,7 +570,7 @@ const EVP_PKEY_ASN1_METHOD dh_asn1_meth = {
0,
int_dh_free,
0,
dh_pkey_ctrl,
0, 0, 0, 0, 0,
@@ -597,7 +609,7 @@ const EVP_PKEY_ASN1_METHOD dhx_asn1_meth = {
0,
int_dh_free,
dh_pkey_ctrl,
dhx_pkey_ctrl,
0, 0, 0, 0, 0,
crypto/dh/dh_err.c
+3 -1
View File
@@ -1,6 +1,6 @@
/*
* Generated by util/mkerr.pl DO NOT EDIT
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -16,6 +16,7 @@
static const ERR_STRING_DATA DH_str_functs[] = {
{ERR_PACK(ERR_LIB_DH, DH_F_COMPUTE_KEY, 0), "compute_key"},
{ERR_PACK(ERR_LIB_DH, DH_F_DHPARAMS_PRINT_FP, 0), "DHparams_print_fp"},
{ERR_PACK(ERR_LIB_DH, DH_F_DH_BUF2KEY, 0), "dh_buf2key"},
{ERR_PACK(ERR_LIB_DH, DH_F_DH_BUILTIN_GENPARAMS, 0),
"dh_builtin_genparams"},
{ERR_PACK(ERR_LIB_DH, DH_F_DH_CHECK_EX, 0), "DH_check_ex"},
@@ -25,6 +26,7 @@ static const ERR_STRING_DATA DH_str_functs[] = {
{ERR_PACK(ERR_LIB_DH, DH_F_DH_CMS_SET_PEERKEY, 0), "dh_cms_set_peerkey"},
{ERR_PACK(ERR_LIB_DH, DH_F_DH_CMS_SET_SHARED_INFO, 0),
"dh_cms_set_shared_info"},
{ERR_PACK(ERR_LIB_DH, DH_F_DH_KEY2BUF, 0), "dh_key2buf"},
{ERR_PACK(ERR_LIB_DH, DH_F_DH_METH_DUP, 0), "DH_meth_dup"},
{ERR_PACK(ERR_LIB_DH, DH_F_DH_METH_NEW, 0), "DH_meth_new"},
{ERR_PACK(ERR_LIB_DH, DH_F_DH_METH_SET1_NAME, 0), "DH_meth_set1_name"},
crypto/dh/dh_kdf.c
+26 -124
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2013-2016 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2013-2019 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -14,137 +14,39 @@
# include <openssl/dh.h>
# include <openssl/evp.h>
# include <openssl/asn1.h>
#include <openssl/cms.h>
/* Key derivation from X9.42/RFC2631 */
/* Uses CMS functions, hence the #ifdef wrapper. */
#define DH_KDF_MAX (1L << 30)
/* Skip past an ASN1 structure: for OBJECT skip content octets too */
static int skip_asn1(unsigned char **pp, long *plen, int exptag)
{
const unsigned char *q = *pp;
int i, tag, xclass;
long tmplen;
i = ASN1_get_object(&q, &tmplen, &tag, &xclass, *plen);
if (i & 0x80)
return 0;
if (tag != exptag || xclass != V_ASN1_UNIVERSAL)
return 0;
if (tag == V_ASN1_OBJECT)
q += tmplen;
*plen -= q - *pp;
*pp = (unsigned char *)q;
return 1;
}
/*
* Encode the DH shared info structure, return an offset to the counter value
* so we can update the structure without reencoding it.
*/
static int dh_sharedinfo_encode(unsigned char **pder, unsigned char **pctr,
ASN1_OBJECT *key_oid, size_t outlen,
const unsigned char *ukm, size_t ukmlen)
{
unsigned char *p;
int derlen;
long tlen;
/* "magic" value to check offset is sane */
static unsigned char ctr[4] = { 0xF3, 0x17, 0x22, 0x53 };
X509_ALGOR atmp;
ASN1_OCTET_STRING ctr_oct, ukm_oct, *pukm_oct;
ASN1_TYPE ctr_atype;
if (ukmlen > DH_KDF_MAX || outlen > DH_KDF_MAX)
return 0;
ctr_oct.data = ctr;
ctr_oct.length = 4;
ctr_oct.flags = 0;
ctr_oct.type = V_ASN1_OCTET_STRING;
ctr_atype.type = V_ASN1_OCTET_STRING;
ctr_atype.value.octet_string = &ctr_oct;
atmp.algorithm = key_oid;
atmp.parameter = &ctr_atype;
if (ukm) {
ukm_oct.type = V_ASN1_OCTET_STRING;
ukm_oct.flags = 0;
ukm_oct.data = (unsigned char *)ukm;
ukm_oct.length = ukmlen;
pukm_oct = &ukm_oct;
} else
pukm_oct = NULL;
derlen = CMS_SharedInfo_encode(pder, &atmp, pukm_oct, outlen);
if (derlen <= 0)
return 0;
p = *pder;
tlen = derlen;
if (!skip_asn1(&p, &tlen, V_ASN1_SEQUENCE))
return 0;
if (!skip_asn1(&p, &tlen, V_ASN1_SEQUENCE))
return 0;
if (!skip_asn1(&p, &tlen, V_ASN1_OBJECT))
return 0;
if (!skip_asn1(&p, &tlen, V_ASN1_OCTET_STRING))
return 0;
if (CRYPTO_memcmp(p, ctr, 4))
return 0;
*pctr = p;
return derlen;
}
# include <openssl/kdf.h>
int DH_KDF_X9_42(unsigned char *out, size_t outlen,
const unsigned char *Z, size_t Zlen,
ASN1_OBJECT *key_oid,
const unsigned char *ukm, size_t ukmlen, const EVP_MD *md)
{
EVP_MD_CTX *mctx = NULL;
int rv = 0;
unsigned int i;
size_t mdlen;
unsigned char *der = NULL, *ctr;
int derlen;
if (Zlen > DH_KDF_MAX)
int ret = 0, nid;
EVP_KDF_CTX *kctx = NULL;
const EVP_KDF *kdf = NULL;
const char *oid_sn;
nid = OBJ_obj2nid(key_oid);
if (nid == NID_undef)
return 0;
mctx = EVP_MD_CTX_new();
if (mctx == NULL)
oid_sn = OBJ_nid2sn(nid);
if (oid_sn == NULL)
return 0;
mdlen = EVP_MD_size(md);
derlen = dh_sharedinfo_encode(&der, &ctr, key_oid, outlen, ukm, ukmlen);
if (derlen == 0)
kdf = EVP_get_kdfbyname(SN_x942kdf);
if (kdf == NULL)
goto err;
for (i = 1;; i++) {
unsigned char mtmp[EVP_MAX_MD_SIZE];
if (!EVP_DigestInit_ex(mctx, md, NULL)
|| !EVP_DigestUpdate(mctx, Z, Zlen))
goto err;
ctr[3] = i & 0xFF;
ctr[2] = (i >> 8) & 0xFF;
ctr[1] = (i >> 16) & 0xFF;
ctr[0] = (i >> 24) & 0xFF;
if (!EVP_DigestUpdate(mctx, der, derlen))
goto err;
if (outlen >= mdlen) {
if (!EVP_DigestFinal(mctx, out, NULL))
goto err;
outlen -= mdlen;
if (outlen == 0)
break;
out += mdlen;
} else {
if (!EVP_DigestFinal(mctx, mtmp, NULL))
goto err;
memcpy(out, mtmp, outlen);
OPENSSL_cleanse(mtmp, mdlen);
break;
}
}
rv = 1;
kctx = EVP_KDF_CTX_new(kdf);
ret =
kctx != NULL
&& EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MD, md) > 0
&& EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_KEY, Z, Zlen) > 0
&& (ukm == NULL
|| EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_UKM, ukm, ukmlen) > 0)
&& EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_CEK_ALG, oid_sn) > 0
&& EVP_KDF_derive(kctx, out, outlen) > 0;
err:
OPENSSL_free(der);
EVP_MD_CTX_free(mctx);
return rv;
EVP_KDF_CTX_free(kctx);
return ret;
}
#endif
#endif /* OPENSSL_NO_CMS */
crypto/dh/dh_key.c
+63
View File
@@ -228,3 +228,66 @@ static int dh_finish(DH *dh)
BN_MONT_CTX_free(dh->method_mont_p);
return 1;
}
int dh_buf2key(DH *dh, const unsigned char *buf, size_t len)
{
int err_reason = DH_R_BN_ERROR;
BIGNUM *pubkey = NULL;
const BIGNUM *p;
size_t p_size;
if ((pubkey = BN_bin2bn(buf, len, NULL)) == NULL)
goto err;
DH_get0_pqg(dh, &p, NULL, NULL);
if (p == NULL || (p_size = BN_num_bytes(p)) == 0) {
err_reason = DH_R_NO_PARAMETERS_SET;
goto err;
}
/*
* As per Section 4.2.8.1 of RFC 8446 fail if DHE's
* public key is of size not equal to size of p
*/
if (BN_is_zero(pubkey) || p_size != len) {
err_reason = DH_R_INVALID_PUBKEY;
goto err;
}
if (DH_set0_key(dh, pubkey, NULL) != 1)
goto err;
return 1;
err:
DHerr(DH_F_DH_BUF2KEY, err_reason);
BN_free(pubkey);
return 0;
}
size_t dh_key2buf(const DH *dh, unsigned char **pbuf_out)
{
const BIGNUM *pubkey;
unsigned char *pbuf;
const BIGNUM *p;
int p_size;
DH_get0_pqg(dh, &p, NULL, NULL);
DH_get0_key(dh, &pubkey, NULL);
if (p == NULL || pubkey == NULL
|| (p_size = BN_num_bytes(p)) == 0
|| BN_num_bytes(pubkey) == 0) {
DHerr(DH_F_DH_KEY2BUF, DH_R_INVALID_PUBKEY);
return 0;
}
if ((pbuf = OPENSSL_malloc(p_size)) == NULL) {
DHerr(DH_F_DH_KEY2BUF, ERR_R_MALLOC_FAILURE);
return 0;
}
/*
* As per Section 4.2.8.1 of RFC 8446 left pad public
* key with zeros to the size of p
*/
if (BN_bn2binpad(pubkey, pbuf, p_size) < 0) {
OPENSSL_free(pbuf);
DHerr(DH_F_DH_KEY2BUF, DH_R_BN_ERROR);
return 0;
}
*pbuf_out = pbuf;
return p_size;
}
crypto/dh/dh_locl.h
+3
View File
@@ -55,3 +55,6 @@ struct dh_method {
int (*generate_params) (DH *dh, int prime_len, int generator,
BN_GENCB *cb);
};
int dh_buf2key(DH *key, const unsigned char *buf, size_t len);
size_t dh_key2buf(const DH *dh, unsigned char **pbuf);
crypto/dsa/dsa_ameth.c
+1 -1
View File
@@ -505,7 +505,7 @@ static int dsa_pkey_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
case ASN1_PKEY_CTRL_DEFAULT_MD_NID:
*(int *)arg2 = NID_sha256;
return 2;
return 1;
default:
return -2;
crypto/dsa/dsa_ossl.c
+1 -1
View File
@@ -248,7 +248,7 @@ static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in,
* one bit longer than the modulus.
*
* There are some concerns about the efficacy of doing this. More
* specificly refer to the discussion starting with:
* specifically refer to the discussion starting with:
* https://github.com/openssl/openssl/pull/7486#discussion_r228323705
* The fix is to rework BN so these gymnastics aren't required.
*/
crypto/ec/asm/ecp_nistz256-x86_64.pl
+1 -1
View File
@@ -1301,7 +1301,7 @@ ecp_nistz256_ord_mul_montx:
################################# reduction
mulx 8*0+128(%r14), $t0, $t1
adcx $t0, $acc3 # guranteed to be zero
adcx $t0, $acc3 # guaranteed to be zero
adox $t1, $acc4
mulx 8*1+128(%r14), $t0, $t1
crypto/ec/asm/x25519-ppc64.pl
+2 -2
View File
@@ -451,7 +451,7 @@ x25519_fe64_tobytes:
and $t0,$t0,$t1
sldi $a3,$a3,1
add $t0,$t0,$t1 # compare to modulus in the same go
srdi $a3,$a3,1 # most signifcant bit cleared
srdi $a3,$a3,1 # most significant bit cleared
addc $a0,$a0,$t0
addze $a1,$a1
@@ -462,7 +462,7 @@ x25519_fe64_tobytes:
sradi $t0,$a3,63 # most significant bit -> mask
sldi $a3,$a3,1
andc $t0,$t1,$t0
srdi $a3,$a3,1 # most signifcant bit cleared
srdi $a3,$a3,1 # most significant bit cleared
subi $rp,$rp,1
subfc $a0,$t0,$a0
crypto/ec/build.info
+46 -1
View File
@@ -1,3 +1,47 @@
$ECASM=
IF[{- !$disabled{asm} -}]
$ECASM_x86=ecp_nistz256.c ecp_nistz256-x86.s
$ECDEF_x86=ECP_NISTZ256_ASM
$ECASM_x86_64=ecp_nistz256.c ecp_nistz256-x86_64.s x25519-x86_64.s
$ECDEF_x86_64=ECP_NISTZ256_ASM X25519_ASM
$ECASM_ia64=
$ECASM_sparcv9=ecp_nistz256.c ecp_nistz256-sparcv9.S
$ECDEF_sparcv9=ECP_NISTZ256_ASM
$ECASM_sparcv8=
$ECASM_alpha=
$ECASM_mips32=
$ECASM_mips64=
$ECASM_s390x=
$ECASM_armv4=ecp_nistz256.c ecp_nistz256-armv4.S
$ECDEF_armv4=ECP_NISTZ256_ASM
$ECASM_aarch64=ecp_nistz256.c ecp_nistz256-armv8.S
$ECDEF_aarch64=ECP_NISTZ256_ASM
$ECASM_parisc11=
$ECASM_parisc20_64=
$ECASM_ppc32=
$ECASM_ppc64=ecp_nistz256.c ecp_nistz256-ppc64.s x25519-ppc64.s
$ECDEF_ppc64=ECP_NISTZ256_ASM X25519_ASM
$ECASM_c64xplus=
# Now that we have defined all the arch specific variables, use the
# appropriate one, and define the appropriate macros
IF[$ECASM_{- $target{asm_arch} -}]
$ECASM=$ECASM_{- $target{asm_arch} -}
$ECDEF=$ECDEF_{- $target{asm_arch} -}
ENDIF
ENDIF
LIBS=../../libcrypto
SOURCE[../../libcrypto]=\
ec_lib.c ecp_smpl.c ecp_mont.c ecp_nist.c ec_cvt.c ec_mult.c \
@@ -8,7 +52,8 @@ SOURCE[../../libcrypto]=\
ecdsa_ossl.c ecdsa_sign.c ecdsa_vrf.c curve25519.c ecx_meth.c \
curve448/arch_32/f_impl.c curve448/f_generic.c curve448/scalar.c \
curve448/curve448_tables.c curve448/eddsa.c curve448/curve448.c \
{- $target{ec_asm_src} -}
$ECASM
DEFINE[../../libcrypto]=$ECDEF
GENERATE[ecp_nistz256-x86.s]=asm/ecp_nistz256-x86.pl \
$(PERLASM_SCHEME) $(LIB_CFLAGS) $(LIB_CPPFLAGS) $(PROCESSOR)
crypto/ec/ec_check.c
+8
View File
@@ -22,6 +22,13 @@ int EC_GROUP_check_named_curve(const EC_GROUP *group, int nist_only)
int EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx)
{
#ifdef FIPS_MODE
/*
* ECC domain parameter validation.
* See SP800-56A R3 5.5.2 "Assurances of Domain-Parameter Validity" Part 1b.
*/
return EC_GROUP_check_named_curve(group, 1) >= 0 ? 1 : 0;
#else
int ret = 0;
const BIGNUM *order;
BN_CTX *new_ctx = NULL;
@@ -84,4 +91,5 @@ int EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx)
BN_CTX_free(new_ctx);
EC_POINT_free(point);
return ret;
#endif /* FIPS_MODE */
}

Some files were not shown because too many files have changed in this diff Show More