Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update.

Browse Source
This commit is contained in:
Hakase
2020-05-17 20:27:18 +09:00
parent ad9fce94c2
commit 3a6d64bb68
619 changed files with 13638 additions and 4698 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crypto/asn1/a_strnid.c
+3 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 1999-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1999-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -12,6 +12,8 @@
#include <openssl/asn1.h>
#include <openssl/objects.h>
DEFINE_STACK_OF(ASN1_STRING_TABLE)
static STACK_OF(ASN1_STRING_TABLE) *stable = NULL;
static void st_free(ASN1_STRING_TABLE *tbl);
static int sk_table_cmp(const ASN1_STRING_TABLE *const *a,
crypto/asn1/asn1_gen.c
+4 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2002-2016 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2002-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -23,6 +23,9 @@
#define ASN1_GEN_STR(str,val) {str, sizeof(str) - 1, val}
DEFINE_STACK_OF(ASN1_TYPE)
DEFINE_STACK_OF(CONF_VALUE)
#define ASN1_FLAG_EXP_MAX 20
/* Maximum number of nested sequences */
#define ASN1_GEN_SEQ_MAX_DEPTH 50
crypto/asn1/asn1_lib.c
+2
View File
@@ -13,6 +13,8 @@
#include <openssl/asn1.h>
#include "asn1_local.h"
DEFINE_STACK_OF(ASN1_UTF8STRING)
static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
long max);
static void asn1_put_length(unsigned char **pp, int length);
crypto/asn1/asn_mime.c
+3
View File
@@ -18,6 +18,9 @@
#include "internal/bio.h"
#include "asn1_local.h"
DEFINE_STACK_OF(BIO)
DEFINE_STACK_OF(X509_ALGOR)
/*
* Generalised MIME like utilities for streaming ASN1. Although many have a
* PKCS7/CMS like flavour others are more general purpose.
crypto/asn1/asn_moid.c
+3 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2002-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2002-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -16,6 +16,8 @@
#include "crypto/asn1.h"
#include "crypto/objects.h"
DEFINE_STACK_OF(CONF_VALUE)
/* Simple ASN1 OID module: add all objects in a given section */
static int do_create(const char *value, const char *name);
crypto/asn1/asn_mstbl.c
+2 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2012-2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2012-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -13,6 +13,7 @@
#include <openssl/conf.h>
#include <openssl/x509v3.h>
DEFINE_STACK_OF(CONF_VALUE)
/* Multi string module: add table entries from a given section */
static int do_tcreate(const char *value, const char *name);
crypto/asn1/d2i_pr.c
+3
View File
@@ -18,6 +18,7 @@
#include "crypto/asn1.h"
#include "crypto/evp.h"
DEFINE_STACK_OF(ASN1_TYPE)
EVP_PKEY *d2i_PrivateKey_ex(int type, EVP_PKEY **a, const unsigned char **pp,
long length, OPENSSL_CTX *libctx, const char *propq)
{
@@ -57,6 +58,8 @@ EVP_PKEY *d2i_PrivateKey_ex(int type, EVP_PKEY **a, const unsigned char **pp,
goto err;
EVP_PKEY_free(ret);
ret = tmp;
if (EVP_PKEY_type(type) != EVP_PKEY_base_id(ret))
goto err;
} else {
ASN1err(0, ERR_R_ASN1_LIB);
goto err;
crypto/asn1/tasn_dec.c
+2 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -17,6 +17,7 @@
#include "internal/numbers.h"
#include "asn1_local.h"
DEFINE_STACK_OF(ASN1_VALUE)
/*
* Constructed types with a recursive definition (such as can be found in PKCS7)
crypto/asn1/tasn_fre.c
+3 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -13,6 +13,8 @@
#include <openssl/objects.h>
#include "asn1_local.h"
DEFINE_STACK_OF(ASN1_VALUE)
/* Free up an ASN1 structure */
void ASN1_item_free(ASN1_VALUE *val, const ASN1_ITEM *it)
crypto/asn1/tasn_new.c
+3 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -15,6 +15,8 @@
#include <string.h>
#include "asn1_local.h"
DEFINE_STACK_OF(ASN1_VALUE)
static int asn1_item_embed_new(ASN1_VALUE **pval, const ASN1_ITEM *it,
int embed);
static int asn1_primitive_new(ASN1_VALUE **pval, const ASN1_ITEM *it,
crypto/bio/bio_lib.c
+2
View File
@@ -788,7 +788,9 @@ void bio_cleanup(void)
/* Internal variant of the below BIO_wait() not calling BIOerr() */
static int bio_wait(BIO *bio, time_t max_time, unsigned int milliseconds)
{
#ifndef OPENSSL_NO_SOCK
int fd;
#endif
if (max_time == 0)
return 1;
crypto/bn/bn_conv.c
+3 -3
View File
@@ -1,5 +1,5 @@
/*
* Copyright 1995-2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -46,8 +46,8 @@ char *BN_bn2hex(const BIGNUM *a)
return buf;
}
#ifndef FIPS_MODE
/* No BIO_snprintf in FIPS_MODE */
#ifndef FIPS_MODULE
/* No BIO_snprintf in FIPS_MODULE */
/* Must 'OPENSSL_free' the returned data */
char *BN_bn2dec(const BIGNUM *a)
{
crypto/bn/bn_ctx.c
+6 -6
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -90,7 +90,7 @@ struct bignum_ctx {
OPENSSL_CTX *libctx;
};
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* Debugging functionality */
static void ctxdbg(BIO *channel, const char *text, BN_CTX *ctx)
{
@@ -126,7 +126,7 @@ static void ctxdbg(BIO *channel, const char *text, BN_CTX *ctx)
#else
/* TODO(3.0): Consider if we want to do this in FIPS mode */
# define CTXDBG(str, ctx) do {} while(0)
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
BN_CTX *BN_CTX_new_ex(OPENSSL_CTX *ctx)
{
@@ -143,7 +143,7 @@ BN_CTX *BN_CTX_new_ex(OPENSSL_CTX *ctx)
return ret;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX *BN_CTX_new(void)
{
return BN_CTX_new_ex(NULL);
@@ -159,7 +159,7 @@ BN_CTX *BN_CTX_secure_new_ex(OPENSSL_CTX *ctx)
return ret;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX *BN_CTX_secure_new(void)
{
return BN_CTX_secure_new_ex(NULL);
@@ -170,7 +170,7 @@ void BN_CTX_free(BN_CTX *ctx)
{
if (ctx == NULL)
return;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
OSSL_TRACE_BEGIN(BN_CTX) {
BN_POOL_ITEM *pool = ctx->pool.head;
BIO_printf(trc_out,
crypto/bn/bn_dh.c
+3 -3
View File
@@ -22,7 +22,7 @@
/* DH parameters from RFC3526 */
# ifndef FIPS_MODE
# ifndef FIPS_MODULE
/*
* "1536-bit MODP Group" from RFC3526, Section 2.
*
@@ -60,7 +60,7 @@ static const BN_ULONG modp_1536_q[] = {
BN_DEF(0x4533E63A, 0x94812704), BN_DEF(0xC06E0E68, 0x62633145),
BN_DEF(0x10B4611A, 0xE487ED51), BN_DEF(0xFFFFFFFF, 0x7FFFFFFF)
};
# endif /* FIPS_MODE */
# endif /* FIPS_MODULE */
/*-
* "2048-bit MODP Group" from RFC3526, Section 3.
@@ -1037,7 +1037,7 @@ make_dh_bn(ffdhe6144_q)
make_dh_bn(ffdhe8192_p)
make_dh_bn(ffdhe8192_q)
# ifndef FIPS_MODE
# ifndef FIPS_MODULE
make_dh_bn(modp_1536_p)
make_dh_bn(modp_1536_q)
# endif
crypto/bn/bn_prime.c
+5 -5
View File
@@ -1,5 +1,5 @@
/*
* Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -207,7 +207,7 @@ int BN_generate_prime_ex2(BIGNUM *ret, int bits, int safe,
return found;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
int BN_generate_prime_ex(BIGNUM *ret, int bits, int safe,
const BIGNUM *add, const BIGNUM *rem, BN_GENCB *cb)
{
@@ -265,7 +265,7 @@ static int bn_is_prime_int(const BIGNUM *w, int checks, BN_CTX *ctx,
int do_trial_division, BN_GENCB *cb)
{
int i, status, ret = -1;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX *ctxlocal = NULL;
#else
@@ -301,7 +301,7 @@ static int bn_is_prime_int(const BIGNUM *w, int checks, BN_CTX *ctx,
if (!BN_GENCB_call(cb, 1, -1))
return -1;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (ctx == NULL && (ctxlocal = ctx = BN_CTX_new()) == NULL)
goto err;
#endif
@@ -311,7 +311,7 @@ static int bn_is_prime_int(const BIGNUM *w, int checks, BN_CTX *ctx,
goto err;
ret = (status == BN_PRIMETEST_PROBABLY_PRIME);
err:
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX_free(ctxlocal);
#endif
return ret;
crypto/bn/bn_rand.c
+4 -4
View File
@@ -103,7 +103,7 @@ int BN_rand_ex(BIGNUM *rnd, int bits, int top, int bottom, BN_CTX *ctx)
{
return bnrand(NORMAL, rnd, bits, top, bottom, ctx);
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
{
return bnrand(NORMAL, rnd, bits, top, bottom, NULL);
@@ -120,7 +120,7 @@ int BN_priv_rand_ex(BIGNUM *rnd, int bits, int top, int bottom, BN_CTX *ctx)
return bnrand(PRIVATE, rnd, bits, top, bottom, ctx);
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
int BN_priv_rand(BIGNUM *rnd, int bits, int top, int bottom)
{
return bnrand(PRIVATE, rnd, bits, top, bottom, NULL);
@@ -199,7 +199,7 @@ int BN_rand_range_ex(BIGNUM *r, const BIGNUM *range, BN_CTX *ctx)
return bnrand_range(NORMAL, r, range, ctx);
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
int BN_rand_range(BIGNUM *r, const BIGNUM *range)
{
return bnrand_range(NORMAL, r, range, NULL);
@@ -211,7 +211,7 @@ int BN_priv_rand_range_ex(BIGNUM *r, const BIGNUM *range, BN_CTX *ctx)
return bnrand_range(PRIVATE, r, range, ctx);
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
int BN_priv_rand_range(BIGNUM *r, const BIGNUM *range)
{
return bnrand_range(PRIVATE, r, range, NULL);
crypto/bn/bn_rsa_fips186_4.c
+2 -2
View File
@@ -1,8 +1,8 @@
/*
* Copyright 2018-2019 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved.
* Copyright (c) 2018-2019, Oracle and/or its affiliates. All rights reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
crypto/bn/build.info
+5 -3
View File
@@ -112,16 +112,18 @@ $COMMON=bn_add.c bn_div.c bn_exp.c bn_lib.c bn_ctx.c bn_mul.c \
bn_kron.c bn_sqrt.c bn_gcd.c bn_prime.c bn_sqr.c \
bn_recp.c bn_mont.c bn_mpi.c bn_exp2.c bn_gf2m.c bn_nist.c \
bn_x931p.c bn_intern.c bn_dh.c \
bn_rsa_fips186_4.c $BNDH $BNASM
SOURCE[../../libcrypto]=$COMMON bn_print.c bn_err.c bn_srp.c
bn_rsa_fips186_4.c $BNDH
SOURCE[../../libcrypto]=$COMMON $BNASM bn_print.c bn_err.c bn_srp.c
IF[{- !$disabled{'deprecated-3.0'} -}]
SOURCE[../../libcrypto]=bn_depr.c
ENDIF
SOURCE[../../providers/libfips.a]=$COMMON
SOURCE[../../providers/libfips.a]=$COMMON $BNASM
SOURCE[../../providers/liblegacy.a]=$BNASM
# Implementations are now spread across several libraries, so the defines
# need to be applied to all affected libraries and modules.
DEFINE[../../libcrypto]=$BNDEF
DEFINE[../../providers/libfips.a]=$BNDEF
DEFINE[../../providers/liblegacy.a]=$BNDEF
DEFINE[../../providers/libimplementations.a]=$BNDEF
INCLUDE[../../libcrypto]=../../crypto/include
crypto/build.info
+1 -2
View File
@@ -77,7 +77,7 @@ $UTIL_DEFINE=$CPUIDDEF
SOURCE[../libcrypto]=$UTIL_COMMON \
mem.c mem_sec.c \
cversion.c info.c cpt_err.c ebcdic.c uid.c o_time.c o_dir.c \
o_fopen.c getenv.c o_init.c o_fips.c init.c trace.c provider.c \
o_fopen.c getenv.c o_init.c init.c trace.c provider.c \
$UPLINKSRC
SOURCE[../providers/libfips.a]=$UTIL_COMMON
SOURCE[../providers/liblegacy.a]=$UTIL_COMMON
@@ -94,7 +94,6 @@ DEFINE[../providers/libcommon.a]=$UTIL_DEFINE
DEPEND[info.o]=buildinf.h
DEPEND[cversion.o]=buildinf.h
GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(CC) $(LIB_CFLAGS) $(CPPFLAGS_Q)" "$(PLATFORM)"
DEPEND[buildinf.h]=../configdata.pm
GENERATE[uplink-x86.s]=../ms/uplink-x86.pl
GENERATE[uplink-x86_64.s]=../ms/uplink-x86_64.pl
crypto/cmp/cmp_asn.c
+8 -3
View File
@@ -17,6 +17,8 @@
#include <openssl/cmp.h>
#include <openssl/crmf.h>
DEFINE_STACK_OF(OSSL_CMP_ITAV)
/* ASN.1 declarations from RFC4210 */
ASN1_SEQUENCE(OSSL_CMP_REVANNCONTENT) = {
/* OSSL_CMP_PKISTATUS is effectively ASN1_INTEGER so it is used directly */
@@ -68,7 +70,8 @@ ASN1_SEQUENCE(OSSL_CMP_ERRORMSGCONTENT) = {
* so it is used directly
*
*/
ASN1_SEQUENCE_OF_OPT(OSSL_CMP_ERRORMSGCONTENT, errorDetails, ASN1_UTF8STRING)
ASN1_SEQUENCE_OF_OPT(OSSL_CMP_ERRORMSGCONTENT, errorDetails,
ASN1_UTF8STRING)
} ASN1_SEQUENCE_END(OSSL_CMP_ERRORMSGCONTENT)
IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_ERRORMSGCONTENT)
@@ -350,8 +353,10 @@ ASN1_CHOICE(OSSL_CMP_PKIBODY) = {
ASN1_EXP(OSSL_CMP_PKIBODY, value.cr, OSSL_CRMF_MSGS, 2),
ASN1_EXP(OSSL_CMP_PKIBODY, value.cp, OSSL_CMP_CERTREPMESSAGE, 3),
ASN1_EXP(OSSL_CMP_PKIBODY, value.p10cr, X509_REQ, 4),
ASN1_EXP(OSSL_CMP_PKIBODY, value.popdecc, OSSL_CMP_POPODECKEYCHALLCONTENT, 5),
ASN1_EXP(OSSL_CMP_PKIBODY, value.popdecr, OSSL_CMP_POPODECKEYRESPCONTENT, 6),
ASN1_EXP(OSSL_CMP_PKIBODY, value.popdecc,
OSSL_CMP_POPODECKEYCHALLCONTENT, 5),
ASN1_EXP(OSSL_CMP_PKIBODY, value.popdecr,
OSSL_CMP_POPODECKEYRESPCONTENT, 6),
ASN1_EXP(OSSL_CMP_PKIBODY, value.kur, OSSL_CRMF_MSGS, 7),
ASN1_EXP(OSSL_CMP_PKIBODY, value.kup, OSSL_CMP_CERTREPMESSAGE, 8),
ASN1_EXP(OSSL_CMP_PKIBODY, value.krr, OSSL_CRMF_MSGS, 9),
crypto/cmp/cmp_client.c
+9 -2
View File
@@ -21,6 +21,12 @@
#include "openssl/cmp_util.h"
DEFINE_STACK_OF(ASN1_UTF8STRING)
DEFINE_STACK_OF(X509_CRL)
DEFINE_STACK_OF(OSSL_CMP_CERTRESPONSE)
DEFINE_STACK_OF(OSSL_CMP_PKISI)
DEFINE_STACK_OF(OSSL_CRMF_CERTID)
#define IS_CREP(t) ((t) == OSSL_CMP_PKIBODY_IP || (t) == OSSL_CMP_PKIBODY_CP \
|| (t) == OSSL_CMP_PKIBODY_KUP)
@@ -170,7 +176,7 @@ static int send_receive_check(OSSL_CMP_CTX *ctx, const OSSL_CMP_MSG *req,
if (*rep == NULL) {
CMPerr(0, CMP_R_TRANSFER_ERROR); /* or receiving response */
ERR_add_error_data(1, req_type_str);
ERR_add_error_data(2, "request sent: ", req_type_str);
ERR_add_error_data(2, ", expected response: ", expected_type_str);
return 0;
}
@@ -205,7 +211,8 @@ static int send_receive_check(OSSL_CMP_CTX *ctx, const OSSL_CMP_MSG *req,
char buf[OSSL_CMP_PKISI_BUFLEN];
if (save_statusInfo(ctx, si)
&& OSSL_CMP_CTX_snprint_PKIStatus(ctx, buf, sizeof(buf)) != NULL)
&& OSSL_CMP_CTX_snprint_PKIStatus(ctx, buf,
sizeof(buf)) != NULL)
ERR_add_error_data(1, buf);
if (emc->errorCode != NULL
&& BIO_snprintf(buf, sizeof(buf), "; errorCode: %ld",
crypto/cmp/cmp_ctx.c
+13 -4
View File
@@ -20,7 +20,16 @@
#include <openssl/crmf.h>
#include <openssl/err.h>
/* Get current certificate store containing trusted root CA certs */
DEFINE_STACK_OF(X509)
DEFINE_STACK_OF(X509_EXTENSION)
DEFINE_STACK_OF(POLICYINFO)
DEFINE_STACK_OF(ASN1_UTF8STRING)
DEFINE_STACK_OF(GENERAL_NAME)
DEFINE_STACK_OF(OSSL_CMP_ITAV)
/*
* Get current certificate store containing trusted root CA certs
*/
X509_STORE *OSSL_CMP_CTX_get0_trustedStore(const OSSL_CMP_CTX *ctx)
{
if (ctx == NULL) {
@@ -155,7 +164,7 @@ void OSSL_CMP_CTX_free(OSSL_CMP_CTX *ctx)
X509_STORE_free(ctx->trusted);
sk_X509_pop_free(ctx->untrusted_certs, X509_free);
X509_free(ctx->clCert);
X509_free(ctx->cert);
EVP_PKEY_free(ctx->pkey);
ASN1_OCTET_STRING_free(ctx->referenceValue);
if (ctx->secretValue != NULL)
@@ -667,12 +676,12 @@ int OSSL_CMP_CTX_push1_subjectAltName(OSSL_CMP_CTX *ctx,
* Set our own client certificate, used for example in KUR and when
* doing the IR with existing certificate.
*/
DEFINE_OSSL_CMP_CTX_set1_up_ref(clCert, X509)
DEFINE_OSSL_CMP_CTX_set1_up_ref(cert, X509)
/*
* Set the old certificate that we are updating in KUR
* or the certificate to be revoked in RR, respectively.
* Also used as reference cert (defaulting to clCert) for deriving subject DN
* Also used as reference cert (defaulting to cert) for deriving subject DN
* and SANs. Its issuer is used as default recipient in the CMP message header.
*/
DEFINE_OSSL_CMP_CTX_set1_up_ref(oldCert, X509)
crypto/cmp/cmp_hdr.c
+29 -20
View File
@@ -20,6 +20,9 @@
#include <openssl/cmp.h>
#include <openssl/err.h>
DEFINE_STACK_OF(ASN1_UTF8STRING)
DEFINE_STACK_OF(OSSL_CMP_ITAV)
int ossl_cmp_hdr_set_pvno(OSSL_CMP_PKIHEADER *hdr, int pvno)
{
if (!ossl_assert(hdr != NULL))
@@ -38,7 +41,8 @@ int ossl_cmp_hdr_get_pvno(const OSSL_CMP_PKIHEADER *hdr)
return (int)pvno;
}
ASN1_OCTET_STRING *OSSL_CMP_HDR_get0_transactionID(const OSSL_CMP_PKIHEADER *hdr)
ASN1_OCTET_STRING *OSSL_CMP_HDR_get0_transactionID(const
OSSL_CMP_PKIHEADER *hdr)
{
if (hdr == NULL) {
CMPerr(0, CMP_R_NULL_ARGUMENT);
@@ -263,6 +267,25 @@ int ossl_cmp_hdr_has_implicitConfirm(const OSSL_CMP_PKIHEADER *hdr)
return 0;
}
/*
* set ctx->transactionID in CMP header
* if ctx->transactionID is NULL, a random one is created with 128 bit
* according to section 5.1.1:
*
* It is RECOMMENDED that the clients fill the transactionID field with
* 128 bits of (pseudo-) random data for the start of a transaction to
* reduce the probability of having the transactionID in use at the server.
*/
int ossl_cmp_hdr_set_transactionID(OSSL_CMP_CTX *ctx, OSSL_CMP_PKIHEADER *hdr)
{
if (ctx->transactionID == NULL
&& !set1_aostr_else_random(&ctx->transactionID, NULL,
OSSL_CMP_TRANSACTIONID_LENGTH))
return 0;
return ossl_cmp_asn1_octet_string_set1(&hdr->transactionID,
ctx->transactionID);
}
/* fill in all fields of the hdr according to the info given in ctx */
int ossl_cmp_hdr_init(OSSL_CMP_CTX *ctx, OSSL_CMP_PKIHEADER *hdr)
{
@@ -280,8 +303,8 @@ int ossl_cmp_hdr_init(OSSL_CMP_CTX *ctx, OSSL_CMP_PKIHEADER *hdr)
* The sender name is copied from the subject of the client cert, if any,
* or else from the subject name provided for certification requests.
*/
sender = ctx->clCert != NULL ?
X509_get_subject_name(ctx->clCert) : ctx->subjectName;
sender = ctx->cert != NULL ?
X509_get_subject_name(ctx->cert) : ctx->subjectName;
if (!ossl_cmp_hdr_set1_sender(hdr, sender))
return 0;
@@ -298,8 +321,8 @@ int ossl_cmp_hdr_init(OSSL_CMP_CTX *ctx, OSSL_CMP_PKIHEADER *hdr)
rcp = ctx->issuer;
} else if (ctx->oldCert != NULL) {
rcp = X509_get_issuer_name(ctx->oldCert);
} else if (ctx->clCert != NULL) {
rcp = X509_get_issuer_name(ctx->clCert);
} else if (ctx->cert != NULL) {
rcp = X509_get_issuer_name(ctx->cert);
}
if (!ossl_cmp_hdr_set1_recipient(hdr, rcp))
return 0;
@@ -313,21 +336,7 @@ int ossl_cmp_hdr_init(OSSL_CMP_CTX *ctx, OSSL_CMP_PKIHEADER *hdr)
ctx->recipNonce))
return 0;
/*
* set ctx->transactionID in CMP header
* if ctx->transactionID is NULL, a random one is created with 128 bit
* according to section 5.1.1:
*
* It is RECOMMENDED that the clients fill the transactionID field with
* 128 bits of (pseudo-) random data for the start of a transaction to
* reduce the probability of having the transactionID in use at the server.
*/
if (ctx->transactionID == NULL
&& !set1_aostr_else_random(&ctx->transactionID, NULL,
OSSL_CMP_TRANSACTIONID_LENGTH))
return 0;
if (!ossl_cmp_asn1_octet_string_set1(&hdr->transactionID,
ctx->transactionID))
if (!ossl_cmp_hdr_set_transactionID(ctx, hdr))
return 0;
/*-
crypto/cmp/cmp_http.c
+4 -2
View File
@@ -28,6 +28,8 @@
#include <openssl/cmp.h>
#include <openssl/err.h>
DEFINE_STACK_OF(CONF_VALUE)
/*
* Send the PKIMessage req and on success return the response, else NULL.
* Any previous error queue entries will likely be removed by ERR_clear_error().
@@ -56,8 +58,8 @@ OSSL_CMP_MSG *OSSL_CMP_MSG_http_perform(OSSL_CMP_CTX *ctx,
OSSL_CMP_CTX_get_http_cb_arg(ctx) != NULL,
ctx->proxy, ctx->no_proxy, NULL, NULL,
ctx->http_cb, OSSL_CMP_CTX_get_http_cb_arg(ctx),
headers, content_type_pkix,
(ASN1_VALUE *)req, ASN1_ITEM_rptr(OSSL_CMP_MSG),
headers, content_type_pkix, (const ASN1_VALUE *)req,
ASN1_ITEM_rptr(OSSL_CMP_MSG),
0, 0, ctx->msg_timeout, content_type_pkix,
ASN1_ITEM_rptr(OSSL_CMP_MSG));
crypto/cmp/cmp_local.h
+7 -6
View File
@@ -68,8 +68,8 @@ struct ossl_cmp_ctx_st {
/* client authentication */
int unprotectedSend; /* send unprotected PKI messages */
X509 *clCert; /* client cert used to identify and sign for MSG_SIG_ALG */
EVP_PKEY *pkey; /* the key pair corresponding to clCert */
X509 *cert; /* protection cert used to identify and sign for MSG_SIG_ALG */
EVP_PKEY *pkey; /* the key pair corresponding to cert */
ASN1_OCTET_STRING *referenceValue; /* optional user name for MSG_MAC_ALG */
ASN1_OCTET_STRING *secretValue; /* password/shared secret for MSG_MAC_ALG */
/* PBMParameters for MSG_MAC_ALG */
@@ -790,7 +790,7 @@ int ossl_cmp_ctx_set1_recipNonce(OSSL_CMP_CTX *ctx,
/* from cmp_status.c */
int ossl_cmp_pkisi_get_status(const OSSL_CMP_PKISI *si);
const char *ossl_cmp_PKIStatus_to_string(int status);
OSSL_CMP_PKIFREETEXT *ossl_cmp_pkisi_get0_statusString(const OSSL_CMP_PKISI *si);
OSSL_CMP_PKIFREETEXT *ossl_cmp_pkisi_get0_statusString(const OSSL_CMP_PKISI *s);
int ossl_cmp_pkisi_get_pkifailureinfo(const OSSL_CMP_PKISI *si);
int ossl_cmp_pkisi_check_pkifailureinfo(const OSSL_CMP_PKISI *si, int index);
@@ -814,6 +814,7 @@ int ossl_cmp_hdr_set_implicitConfirm(OSSL_CMP_PKIHEADER *hdr);
int ossl_cmp_hdr_has_implicitConfirm(const OSSL_CMP_PKIHEADER *hdr);
# define OSSL_CMP_TRANSACTIONID_LENGTH 16
# define OSSL_CMP_SENDERNONCE_LENGTH 16
int ossl_cmp_hdr_set_transactionID(OSSL_CMP_CTX *ctx, OSSL_CMP_PKIHEADER *hdr);
int ossl_cmp_hdr_init(OSSL_CMP_CTX *ctx, OSSL_CMP_PKIHEADER *hdr);
/* from cmp_msg.c */
@@ -885,13 +886,13 @@ OSSL_CMP_MSG *ossl_cmp_pollRep_new(OSSL_CMP_CTX *ctx, int crid,
int64_t poll_after);
OSSL_CMP_PKISI *
ossl_cmp_revrepcontent_get_pkisi(OSSL_CMP_REVREPCONTENT *rrep, int rsid);
OSSL_CRMF_CERTID *ossl_cmp_revrepcontent_get_CertId(OSSL_CMP_REVREPCONTENT *rrep,
OSSL_CRMF_CERTID *ossl_cmp_revrepcontent_get_CertId(OSSL_CMP_REVREPCONTENT *rc,
int rsid);
OSSL_CMP_POLLREP *
ossl_cmp_pollrepcontent_get0_pollrep(const OSSL_CMP_POLLREPCONTENT *prc,
int rid);
OSSL_CMP_CERTRESPONSE *
ossl_cmp_certrepmessage_get0_certresponse(const OSSL_CMP_CERTREPMESSAGE *crepmsg,
ossl_cmp_certrepmessage_get0_certresponse(const OSSL_CMP_CERTREPMESSAGE *crm,
int rid);
X509 *ossl_cmp_certresponse_get1_certificate(EVP_PKEY *privkey,
const OSSL_CMP_CERTRESPONSE *crep);
@@ -916,6 +917,6 @@ int ossl_cmp_verify_popo(const OSSL_CMP_MSG *msg, int accept_RAVerified);
int ossl_cmp_exchange_certConf(OSSL_CMP_CTX *ctx, int fail_info,
const char *txt);
int ossl_cmp_exchange_error(OSSL_CMP_CTX *ctx, int status, int fail_info,
const char *txt, int errorCode, const char *details);
const char *txt, int errorCode, const char *detail);
#endif /* !defined(OSSL_CRYPTO_CMP_LOCAL_H) */
crypto/cmp/cmp_msg.c
+26 -4
View File
@@ -20,6 +20,16 @@
#include <openssl/err.h>
#include <openssl/x509.h>
DEFINE_STACK_OF(OSSL_CMP_CERTSTATUS)
DEFINE_STACK_OF(OSSL_CMP_ITAV)
DEFINE_STACK_OF(GENERAL_NAME)
DEFINE_STACK_OF(X509_EXTENSION)
DEFINE_STACK_OF(OSSL_CMP_PKISI)
DEFINE_STACK_OF(OSSL_CRMF_MSG)
DEFINE_STACK_OF(OSSL_CMP_CERTRESPONSE)
DEFINE_STACK_OF(OSSL_CRMF_CERTID)
DEFINE_STACK_OF(ASN1_UTF8STRING)
OSSL_CMP_PKIHEADER *OSSL_CMP_MSG_get0_header(const OSSL_CMP_MSG *msg)
{
if (msg == NULL) {
@@ -208,7 +218,7 @@ static const X509_NAME *determine_subj(OSSL_CMP_CTX *ctx, X509 *refcert,
static OSSL_CRMF_MSG *crm_new(OSSL_CMP_CTX *ctx, int bodytype, int rid)
{
OSSL_CRMF_MSG *crm = NULL;
X509 *refcert = ctx->oldCert != NULL ? ctx->oldCert : ctx->clCert;
X509 *refcert = ctx->oldCert != NULL ? ctx->oldCert : ctx->cert;
/* refcert defaults to current client cert */
EVP_PKEY *rkey = OSSL_CMP_CTX_get0_newPkey(ctx, 0);
STACK_OF(GENERAL_NAME) *default_sans = NULL;
@@ -574,9 +584,9 @@ int ossl_cmp_msg_gen_push1_ITAVs(OSSL_CMP_MSG *msg,
return 0;
for (i = 0; i < sk_OSSL_CMP_ITAV_num(itavs); i++) {
if ((itav = OSSL_CMP_ITAV_dup(sk_OSSL_CMP_ITAV_value(itavs, i))) == NULL)
return 0;
if (!ossl_cmp_msg_gen_push0_ITAV(msg, itav)) {
itav = OSSL_CMP_ITAV_dup(sk_OSSL_CMP_ITAV_value(itavs, i));
if (itav == NULL
|| !ossl_cmp_msg_gen_push0_ITAV(msg, itav)) {
OSSL_CMP_ITAV_free(itav);
return 0;
}
@@ -972,6 +982,18 @@ X509 *ossl_cmp_certresponse_get1_certificate(EVP_PKEY *privkey,
return crt;
}
int OSSL_CMP_MSG_update_transactionID(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg)
{
if (ctx == NULL || msg == NULL) {
CMPerr(0, CMP_R_NULL_ARGUMENT);
return 0;
}
if (!ossl_cmp_hdr_set_transactionID(ctx, msg->header))
return 0;
return msg->header->protectionAlg == NULL
|| ossl_cmp_msg_protect(ctx, msg);
}
OSSL_CMP_MSG *ossl_cmp_msg_load(const char *file)
{
OSSL_CMP_MSG *msg = NULL;
crypto/cmp/cmp_protect.c
+67 -73
View File
@@ -18,6 +18,8 @@
#include <openssl/err.h>
#include <openssl/x509.h>
DEFINE_STACK_OF(X509)
/*
* This function is also used for verification from cmp_vfy.
*
@@ -143,21 +145,18 @@ int ossl_cmp_msg_add_extraCerts(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg)
&& (msg->extraCerts = sk_X509_new_null()) == NULL)
return 0;
if (ctx->clCert != NULL) {
/* Make sure that our own cert gets sent, in the first position */
if (!X509_up_ref(ctx->clCert))
if (ctx->cert != NULL && ctx->pkey != NULL) {
/* make sure that our own cert is included in the first position */
if (!ossl_cmp_sk_X509_add1_cert(msg->extraCerts, ctx->cert, 1, 1))
return 0;
if (!sk_X509_push(msg->extraCerts, ctx->clCert)) {
X509_free(ctx->clCert);
return 0;
}
/* if we have untrusted store, try to add intermediate certs */
/* if we have untrusted certs, try to add intermediate certs */
if (ctx->untrusted_certs != NULL) {
STACK_OF(X509) *chain =
ossl_cmp_build_cert_chain(ctx->untrusted_certs, ctx->clCert);
ossl_cmp_build_cert_chain(ctx->untrusted_certs, ctx->cert);
int res = ossl_cmp_sk_X509_add1_certs(msg->extraCerts, chain,
1 /* no self-issued */,
1 /* no duplicates */, 0);
sk_X509_pop_free(chain, X509_free);
if (res == 0)
return 0;
@@ -225,6 +224,15 @@ int ossl_cmp_msg_protect(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg)
if (!ossl_assert(ctx != NULL && msg != NULL))
return 0;
/*
* For the case of re-protection remove pre-existing protection.
* TODO: Consider also removing any pre-existing extraCerts.
*/
X509_ALGOR_free(msg->header->protectionAlg);
msg->header->protectionAlg = NULL;
ASN1_BIT_STRING_free(msg->protection);
msg->protection = NULL;
if (ctx->unprotectedSend)
return 1;
@@ -236,84 +244,70 @@ int ossl_cmp_msg_protect(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg)
&& !ossl_cmp_hdr_set1_senderKID(msg->header,
ctx->referenceValue))
goto err;
/*
* add any additional certificates from ctx->extraCertsOut
* while not needed to validate the signing cert, the option to do
* this might be handy for certain use cases
*/
if (!ossl_cmp_msg_add_extraCerts(ctx, msg))
goto err;
if ((msg->protection =
ossl_cmp_calc_protection(msg, ctx->secretValue, NULL)) == NULL)
goto err;
} else {
} else if (ctx->cert != NULL && ctx->pkey != NULL) {
/*
* use MSG_SIG_ALG according to 5.1.3.3 if client Certificate and
* private key is given
*/
if (ctx->clCert != NULL && ctx->pkey != NULL) {
const ASN1_OCTET_STRING *subjKeyIDStr = NULL;
int algNID = 0;
ASN1_OBJECT *alg = NULL;
const ASN1_OCTET_STRING *subjKeyIDStr = NULL;
int algNID = 0;
ASN1_OBJECT *alg = NULL;
/* make sure that key and certificate match */
if (!X509_check_private_key(ctx->clCert, ctx->pkey)) {
CMPerr(0, CMP_R_CERT_AND_KEY_DO_NOT_MATCH);
goto err;
}
if (msg->header->protectionAlg == NULL)
if ((msg->header->protectionAlg = X509_ALGOR_new()) == NULL)
goto err;
if (!OBJ_find_sigid_by_algs(&algNID, ctx->digest,
EVP_PKEY_id(ctx->pkey))) {
CMPerr(0, CMP_R_UNSUPPORTED_KEY_TYPE);
goto err;
}
if ((alg = OBJ_nid2obj(algNID)) == NULL)
goto err;
if (!X509_ALGOR_set0(msg->header->protectionAlg,
alg, V_ASN1_UNDEF, NULL)) {
ASN1_OBJECT_free(alg);
goto err;
}
/*
* set senderKID to keyIdentifier of the used certificate according
* to section 5.1.1
*/
subjKeyIDStr = X509_get0_subject_key_id(ctx->clCert);
if (subjKeyIDStr == NULL)
subjKeyIDStr = ctx->referenceValue; /* fallback */
if (subjKeyIDStr != NULL
&& !ossl_cmp_hdr_set1_senderKID(msg->header, subjKeyIDStr))
goto err;
/*
* Add ctx->clCert followed, if possible, by its chain built
* from ctx->untrusted_certs, and then ctx->extraCertsOut
*/
if (!ossl_cmp_msg_add_extraCerts(ctx, msg))
goto err;
if ((msg->protection =
ossl_cmp_calc_protection(msg, NULL, ctx->pkey)) == NULL)
goto err;
} else {
CMPerr(0, CMP_R_MISSING_KEY_INPUT_FOR_CREATING_PROTECTION);
/* make sure that key and certificate match */
if (!X509_check_private_key(ctx->cert, ctx->pkey)) {
CMPerr(0, CMP_R_CERT_AND_KEY_DO_NOT_MATCH);
goto err;
}
if (msg->header->protectionAlg == NULL)
if ((msg->header->protectionAlg = X509_ALGOR_new()) == NULL)
goto err;
if (!OBJ_find_sigid_by_algs(&algNID, ctx->digest,
EVP_PKEY_id(ctx->pkey))) {
CMPerr(0, CMP_R_UNSUPPORTED_KEY_TYPE);
goto err;
}
if ((alg = OBJ_nid2obj(algNID)) == NULL)
goto err;
if (!X509_ALGOR_set0(msg->header->protectionAlg, alg,
V_ASN1_UNDEF, NULL)) {
ASN1_OBJECT_free(alg);
goto err;
}
/*
* set senderKID to keyIdentifier of the used certificate according
* to section 5.1.1
*/
subjKeyIDStr = X509_get0_subject_key_id(ctx->cert);
if (subjKeyIDStr == NULL)
subjKeyIDStr = ctx->referenceValue; /* fallback */
if (subjKeyIDStr != NULL
&& !ossl_cmp_hdr_set1_senderKID(msg->header, subjKeyIDStr))
goto err;
} else {
CMPerr(0, CMP_R_MISSING_KEY_INPUT_FOR_CREATING_PROTECTION);
goto err;
}
if ((msg->protection =
ossl_cmp_calc_protection(msg, ctx->secretValue, ctx->pkey)) == NULL)
goto err;
/*
* If present, add ctx->cert followed by its chain as far as possible.
* Finally add any additional certificates from ctx->extraCertsOut;
* even if not needed to validate the protection
* the option to do this might be handy for certain use cases.
*/
if (!ossl_cmp_msg_add_extraCerts(ctx, msg))
goto err;
/*
* As required by RFC 4210 section 5.1.1., if the sender name is not known
* to the client it set to NULL-DN. In this case for identification at least
* the senderKID must be set, where we took the referenceValue as fallback.
*/
if (ossl_cmp_general_name_is_NULL_DN(msg->header->sender)
&& msg->header->senderKID == NULL)
CMPerr(0, CMP_R_MISSING_SENDER_IDENTIFICATION);
crypto/cmp/cmp_server.c
+13 -5
View File
@@ -19,6 +19,11 @@
#include <openssl/cmp.h>
#include <openssl/err.h>
DEFINE_STACK_OF(OSSL_CRMF_MSG)
DEFINE_STACK_OF(X509)
DEFINE_STACK_OF(OSSL_CMP_ITAV)
DEFINE_STACK_OF(OSSL_CMP_CERTSTATUS)
/* the context for the generic CMP server */
struct ossl_cmp_srv_ctx_st
{
@@ -216,7 +221,8 @@ static OSSL_CMP_MSG *process_cert_request(OSSL_CMP_SRV_CTX *srv_ctx,
if (si == NULL)
goto err;
/* set OSSL_CMP_OPT_IMPLICIT_CONFIRM if and only if transaction ends */
if (!OSSL_CMP_CTX_set_option(srv_ctx->ctx, OSSL_CMP_OPT_IMPLICIT_CONFIRM,
if (!OSSL_CMP_CTX_set_option(srv_ctx->ctx,
OSSL_CMP_OPT_IMPLICIT_CONFIRM,
ossl_cmp_hdr_has_implicitConfirm(hdr)
&& srv_ctx->grantImplicitConfirm
/* do not set if polling starts: */
@@ -484,9 +490,9 @@ OSSL_CMP_MSG *OSSL_CMP_SRV_process_request(OSSL_CMP_SRV_CTX *srv_ctx,
tid);
OPENSSL_free(tid);
}
/* start of a new transaction, set transactionID and senderNonce */
if (!OSSL_CMP_CTX_set1_transactionID(ctx, hdr->transactionID)
|| !ossl_cmp_ctx_set1_recipNonce(ctx, hdr->senderNonce))
/* start of a new transaction, reset transactionID and senderNonce */
if (!OSSL_CMP_CTX_set1_transactionID(ctx, NULL)
|| !OSSL_CMP_CTX_set1_senderNonce(ctx, NULL))
goto err;
break;
default:
@@ -589,7 +595,9 @@ OSSL_CMP_MSG *OSSL_CMP_SRV_process_request(OSSL_CMP_SRV_CTX *srv_ctx,
case OSSL_CMP_PKIBODY_GENP:
case OSSL_CMP_PKIBODY_ERROR:
/* TODO possibly support further terminating response message types */
(void)OSSL_CMP_CTX_set1_transactionID(ctx, NULL); /* ignore any error */
/* prepare for next transaction, ignoring any errors here: */
(void)OSSL_CMP_CTX_set1_transactionID(ctx, NULL);
(void)OSSL_CMP_CTX_set1_senderNonce(ctx, NULL);
default: /* not closing transaction in other cases */
break;
crypto/cmp/cmp_status.c
+2
View File
@@ -26,6 +26,8 @@
#include <openssl/x509.h>
#include <openssl/asn1err.h> /* for ASN1_R_TOO_SMALL and ASN1_R_TOO_LARGE */
DEFINE_STACK_OF(ASN1_UTF8STRING)
/* CMP functions related to PKIStatus */
int ossl_cmp_pkisi_get_status(const OSSL_CMP_PKISI *si)
crypto/cmp/cmp_util.c
+4
View File
@@ -16,6 +16,10 @@
#include <openssl/err.h> /* should be implied by cmperr.h */
#include <openssl/x509v3.h>
DEFINE_STACK_OF(X509)
DEFINE_STACK_OF(X509_OBJECT)
DEFINE_STACK_OF(ASN1_UTF8STRING)
/*
* use trace API for CMP-specific logging, prefixed by "CMP " and severity
*/
crypto/cmp/cmp_vfy.c
+2
View File
@@ -22,6 +22,8 @@
#include <openssl/x509.h>
#include "crypto/x509.h"
DEFINE_STACK_OF(X509)
/*
* Verify a message protected by signature according to section 5.1.3.3
* (sha1+RSA/DSA or any other algorithm supported by OpenSSL).
crypto/cms/cms_env.c
+4
View File
@@ -18,6 +18,10 @@
#include "crypto/asn1.h"
#include "crypto/evp.h"
DEFINE_STACK_OF(CMS_RecipientInfo)
DEFINE_STACK_OF(CMS_RevocationInfoChoice)
DEFINE_STACK_OF(X509_ATTRIBUTE)
/* CMS EnvelopedData Utilities */
static void cms_env_set_version(CMS_EnvelopedData *env);
crypto/cms/cms_ess.c
+4 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2008-2019 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2008-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -19,6 +19,9 @@
#include "crypto/ess.h"
#include "crypto/cms.h"
DEFINE_STACK_OF(GENERAL_NAMES)
DEFINE_STACK_OF(CMS_SignerInfo)
IMPLEMENT_ASN1_FUNCTIONS(CMS_ReceiptRequest)
/* ESS services */
crypto/cms/cms_kari.c
+24 -20
View File
@@ -17,6 +17,8 @@
#include "cms_local.h"
#include "crypto/asn1.h"
DEFINE_STACK_OF(CMS_RecipientEncryptedKey)
/* Key Agreement Recipient Info (KARI) routines */
int CMS_RecipientInfo_kari_get0_alg(CMS_RecipientInfo *ri,
@@ -380,27 +382,27 @@ int cms_RecipientInfo_kari_init(CMS_RecipientInfo *ri, X509 *recip, EVP_PKEY *r
if (!cms_kari_create_ephemeral_key(kari, recipPubKey))
return 0;
} else {
/* Use originator key */
CMS_OriginatorIdentifierOrKey *oik = ri->d.kari->originator;
/* Use originator key */
CMS_OriginatorIdentifierOrKey *oik = ri->d.kari->originator;
if (originatorPrivKey == NULL && originator == NULL)
if (originatorPrivKey == NULL || originator == NULL)
return 0;
if (flags & CMS_USE_ORIGINATOR_KEYID) {
oik->type = CMS_OIK_KEYIDENTIFIER;
oik->d.subjectKeyIdentifier = ASN1_OCTET_STRING_new();
if (oik->d.subjectKeyIdentifier == NULL)
return 0;
if (!cms_set1_keyid(&oik->d.subjectKeyIdentifier, originator))
return 0;
} else {
oik->type = CMS_REK_ISSUER_SERIAL;
if (!cms_set1_ias(&oik->d.issuerAndSerialNumber, originator))
return 0;
}
if (flags & CMS_USE_ORIGINATOR_KEYID) {
oik->type = CMS_OIK_KEYIDENTIFIER;
oik->d.subjectKeyIdentifier = ASN1_OCTET_STRING_new();
if (oik->d.subjectKeyIdentifier == NULL)
return 0;
if (!cms_set1_keyid(&oik->d.subjectKeyIdentifier, originator))
return 0;
} else {
oik->type = CMS_REK_ISSUER_SERIAL;
if (!cms_set1_ias(&oik->d.issuerAndSerialNumber, originator))
return 0;
}
if (!cms_kari_set_originator_private_key(kari, originatorPrivKey))
return 0;
if (!cms_kari_set_originator_private_key(kari, originatorPrivKey))
return 0;
}
EVP_PKEY_up_ref(recipPubKey);
@@ -413,7 +415,7 @@ static int cms_wrap_init(CMS_KeyAgreeRecipientInfo *kari,
{
EVP_CIPHER_CTX *ctx = kari->ctx;
const EVP_CIPHER *kekcipher;
int keylen = EVP_CIPHER_key_length(cipher);
int keylen;
int ret;
/* If a suitable wrap algorithm is already set nothing to do */
@@ -423,8 +425,10 @@ static int cms_wrap_init(CMS_KeyAgreeRecipientInfo *kari,
return 0;
return 1;
}
else if (cipher != NULL
&& (EVP_CIPHER_flags(cipher) & EVP_CIPH_FLAG_GET_WRAP_CIPHER)) {
if (cipher == NULL)
return 0;
keylen = EVP_CIPHER_key_length(cipher);
if ((EVP_CIPHER_flags(cipher) & EVP_CIPH_FLAG_GET_WRAP_CIPHER) != 0) {
ret = EVP_CIPHER_meth_get_ctrl(cipher)(NULL, EVP_CTRL_GET_WRAP_CIPHER,
0, &kekcipher);
if (ret <= 0)
crypto/cms/cms_lib.c
+4
View File
@@ -16,6 +16,10 @@
#include <openssl/cms.h>
#include "cms_local.h"
DEFINE_STACK_OF(CMS_RevocationInfoChoice)
DEFINE_STACK_OF(X509)
DEFINE_STACK_OF(X509_CRL)
IMPLEMENT_ASN1_FUNCTIONS(CMS_ContentInfo)
IMPLEMENT_ASN1_PRINT_FUNCTION(CMS_ContentInfo)
crypto/cms/cms_pwri.c
+3 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2009-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2009-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -18,6 +18,8 @@
#include "cms_local.h"
#include "crypto/asn1.h"
DEFINE_STACK_OF(CMS_RecipientInfo)
int CMS_RecipientInfo_set0_password(CMS_RecipientInfo *ri,
unsigned char *pass, ossl_ssize_t passlen)
{
crypto/cms/cms_sd.c
+10 -2
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2008-2016 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2008-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -21,6 +21,12 @@
#include "crypto/cms.h"
#include "crypto/ess.h"
DEFINE_STACK_OF(CMS_RevocationInfoChoice)
DEFINE_STACK_OF(CMS_SignerInfo)
DEFINE_STACK_OF(X509)
DEFINE_STACK_OF(X509_ALGOR)
DEFINE_STACK_OF(X509_ATTRIBUTE)
/* CMS SignedData Utilities */
static CMS_SignedData *cms_get0_signed(CMS_ContentInfo *cms)
@@ -944,8 +950,10 @@ int CMS_add_simple_smimecap(STACK_OF(X509_ALGOR) **algs,
ASN1_INTEGER *key = NULL;
if (keysize > 0) {
key = ASN1_INTEGER_new();
if (key == NULL || !ASN1_INTEGER_set(key, keysize))
if (key == NULL || !ASN1_INTEGER_set(key, keysize)) {
ASN1_INTEGER_free(key);
return 0;
}
}
alg = X509_ALGOR_new();
if (alg == NULL) {
crypto/cms/cms_smime.c
+6
View File
@@ -16,6 +16,12 @@
#include "cms_local.h"
#include "crypto/asn1.h"
DEFINE_STACK_OF(CMS_SignerInfo)
DEFINE_STACK_OF(X509)
DEFINE_STACK_OF(X509_CRL)
DEFINE_STACK_OF(CMS_RecipientEncryptedKey)
DEFINE_STACK_OF(CMS_RecipientInfo)
static BIO *cms_get_text_bio(BIO *out, unsigned int flags)
{
BIO *rbio;
crypto/conf/conf_api.c
+3 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -16,6 +16,8 @@
#include <openssl/conf.h>
#include <openssl/conf_api.h>
DEFINE_STACK_OF(CONF_VALUE)
static void value_free_hash(const CONF_VALUE *a, LHASH_OF(CONF_VALUE) *conf);
static void value_free_stack_doall(CONF_VALUE *a);
crypto/conf/conf_def.c
+6 -7
View File
@@ -1,5 +1,5 @@
/*
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -27,6 +27,8 @@
# endif
#endif
DEFINE_STACK_OF(BIO)
#ifndef S_ISDIR
# define S_ISDIR(a) (((a) & S_IFMT) == S_IFDIR)
#endif
@@ -418,6 +420,7 @@ static int def_load_bio(CONF *conf, BIO *in, long *line)
OPENSSL_strlcpy(include_path, include_dir, newlen);
OPENSSL_strlcat(include_path, "/", newlen);
OPENSSL_strlcat(include_path, include, newlen);
OPENSSL_free(include);
} else {
include_path = include;
}
@@ -427,15 +430,11 @@ static int def_load_bio(CONF *conf, BIO *in, long *line)
next = process_include(include_path, &dirctx, &dirpath);
if (include_path != dirpath) {
/* dirpath will contain include in case of a directory */
OPENSSL_free(include);
if (include_path != include)
OPENSSL_free(include_path);
OPENSSL_free(include_path);
}
#else
next = BIO_new_file(include_path, "r");
OPENSSL_free(include);
if (include_path != include)
OPENSSL_free(include_path);
OPENSSL_free(include_path);
#endif
if (next != NULL) {
crypto/conf/conf_mod.c
+4
View File
@@ -18,6 +18,10 @@
#include <openssl/trace.h>
#include <openssl/engine.h>
DEFINE_STACK_OF(CONF_VALUE)
DEFINE_STACK_OF(CONF_MODULE)
DEFINE_STACK_OF(CONF_IMODULE)
#define DSO_mod_init_name "OPENSSL_init"
#define DSO_mod_finish_name "OPENSSL_finish"
crypto/conf/conf_ssl.c
+3 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -14,6 +14,8 @@
#include "internal/sslconf.h"
#include "conf_local.h"
DEFINE_STACK_OF(CONF_VALUE)
/*
* SSL library configuration module placeholder. We load it here but defer
* all decisions about its contents to libssl.
crypto/context.c
+5 -5
View File
@@ -39,7 +39,7 @@ struct openssl_ctx_st {
struct openssl_ctx_onfree_list_st *onfreelist;
};
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
static OPENSSL_CTX default_context_int;
/* Always points at default_context_int if it has been initialised */
@@ -119,7 +119,7 @@ static int context_deinit(OPENSSL_CTX *ctx)
return 1;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
void openssl_ctx_default_deinit(void)
{
context_deinit(default_context);
@@ -146,7 +146,7 @@ OPENSSL_CTX *OPENSSL_CTX_new(void)
return ctx;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
int OPENSSL_CTX_load_config(OPENSSL_CTX *ctx, const char *config_file)
{
return CONF_modules_load_file_with_libctx(ctx, config_file, NULL, 0) > 0;
@@ -162,7 +162,7 @@ void OPENSSL_CTX_free(OPENSSL_CTX *ctx)
OPENSSL_CTX *openssl_ctx_get_concrete(OPENSSL_CTX *ctx)
{
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (ctx == NULL) {
if (!RUN_ONCE(&default_context_init, do_default_context_init))
return 0;
@@ -174,7 +174,7 @@ OPENSSL_CTX *openssl_ctx_get_concrete(OPENSSL_CTX *ctx)
int openssl_ctx_is_default(OPENSSL_CTX *ctx)
{
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (ctx == NULL || ctx == default_context)
return 1;
#endif
crypto/core_algorithm.c
+2 -2
View File
@@ -37,11 +37,11 @@ static int algorithm_do_this(OSSL_PROVIDER *provider, void *cbdata)
cur_operation <= last_operation;
cur_operation++) {
const OSSL_ALGORITHM *map =
ossl_provider_query_operation(provider, data->operation_id,
ossl_provider_query_operation(provider, cur_operation,
&no_store);
if (map == NULL)
break;
continue;
ok = 1; /* As long as we've found *something* */
while (map->algorithm_names != NULL) {
crypto/core_namemap.c
+4 -4
View File
@@ -136,7 +136,7 @@ int ossl_namemap_name2num_n(const OSSL_NAMEMAP *namemap,
NAMENUM_ENTRY *namenum_entry, namenum_tmpl;
int number = 0;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (namemap == NULL)
namemap = ossl_namemap_stored(NULL);
#endif
@@ -198,7 +198,7 @@ int ossl_namemap_add_name_n(OSSL_NAMEMAP *namemap, int number,
NAMENUM_ENTRY *namenum = NULL;
int tmp_number;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (namemap == NULL)
namemap = ossl_namemap_stored(NULL);
#endif
@@ -309,7 +309,7 @@ int ossl_namemap_add_names(OSSL_NAMEMAP *namemap, int number,
* ==============
*/
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
#include <openssl/evp.h>
/* Creates an initial namemap with names found in the legacy method db */
@@ -366,7 +366,7 @@ OSSL_NAMEMAP *ossl_namemap_stored(OPENSSL_CTX *libctx)
openssl_ctx_get_data(libctx, OPENSSL_CTX_NAMEMAP_INDEX,
&stored_namemap_method);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (namemap != NULL && ossl_namemap_empty(namemap)) {
/* Before pilfering, we make sure the legacy database is populated */
OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
crypto/crmf/crmf_lib.c
+3
View File
@@ -36,6 +36,9 @@
#include <openssl/err.h>
#include <openssl/evp.h>
DEFINE_STACK_OF(X509_EXTENSION)
DEFINE_STACK_OF(OSSL_CRMF_MSG)
/*-
* atyp = Attribute Type
* valt = Value Type
crypto/ct/ct_log.c
+2
View File
@@ -18,6 +18,8 @@
#include "internal/cryptlib.h"
DEFINE_STACK_OF(CTLOG)
/*
* Information about a CT log server.
*/
crypto/ct/ct_oct.c
+3 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -21,6 +21,8 @@
#include "ct_local.h"
DEFINE_STACK_OF(SCT)
int o2i_SCT_signature(SCT *sct, const unsigned char **in, size_t len)
{
size_t siglen;
crypto/ct/ct_policy.c
+1
View File
@@ -40,6 +40,7 @@ CT_POLICY_EVAL_CTX *CT_POLICY_EVAL_CTX_new_with_libctx(OPENSSL_CTX *libctx,
ctx->propq = OPENSSL_strdup(propq);
if (ctx->propq == NULL) {
CTerr(0, ERR_R_MALLOC_FAILURE);
OPENSSL_free(ctx);
return NULL;
}
}
crypto/ct/ct_prn.c
+3 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -16,6 +16,8 @@
#include "ct_local.h"
DEFINE_STACK_OF(SCT)
static void SCT_signature_algorithms_print(const SCT *sct, BIO *out)
{
int nid = SCT_get_signature_nid(sct);
crypto/ct/ct_sct.c
+2
View File
@@ -19,6 +19,8 @@
#include "ct_local.h"
DEFINE_STACK_OF(SCT)
SCT *SCT_new(void)
{
SCT *sct = OPENSSL_zalloc(sizeof(*sct));
crypto/ct/ct_sct_ctx.c
+3 -1
View File
@@ -24,8 +24,10 @@ SCT_CTX *SCT_CTX_new(OPENSSL_CTX *libctx, const char *propq)
{
SCT_CTX *sctx = OPENSSL_zalloc(sizeof(*sctx));
if (sctx == NULL)
if (sctx == NULL) {
CTerr(CT_F_SCT_CTX_NEW, ERR_R_MALLOC_FAILURE);
return NULL;
}
sctx->libctx = libctx;
if (propq != NULL) {
crypto/ct/ct_x509v3.c
+3 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -13,6 +13,8 @@
#include "ct_local.h"
DEFINE_STACK_OF(SCT)
static char *i2s_poison(const X509V3_EXT_METHOD *method, void *val)
{
return OPENSSL_strdup("NULL");
crypto/der_writer.c
+33 -4
View File
@@ -24,12 +24,24 @@ static int int_start_context(WPACKET *pkt, int tag)
static int int_end_context(WPACKET *pkt, int tag)
{
/*
* If someone set the flag WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH on this
* sub-packet and this sub-packet has nothing written to it, the DER length
* will not be written, and the total written size will be unchanged before
* and after WPACKET_close(). We use size1 and size2 to determine if
* anything was written, and only write our tag if it has.
*
*/
size_t size1, size2;
if (tag < 0)
return 1;
if (!ossl_assert(tag <= 30))
return 0;
return WPACKET_close(pkt)
&& WPACKET_put_bytes_u8(pkt, DER_C_CONTEXT | tag);
return WPACKET_get_total_written(pkt, &size1)
&& WPACKET_close(pkt)
&& WPACKET_get_total_written(pkt, &size2)
&& (size1 == size2 || WPACKET_put_bytes_u8(pkt, DER_C_CONTEXT | tag));
}
int DER_w_precompiled(WPACKET *pkt, int tag,
@@ -136,7 +148,24 @@ int DER_w_begin_sequence(WPACKET *pkt, int tag)
int DER_w_end_sequence(WPACKET *pkt, int tag)
{
return WPACKET_close(pkt)
&& WPACKET_put_bytes_u8(pkt, DER_F_CONSTRUCTED | DER_P_SEQUENCE)
/*
* If someone set the flag WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH on this
* sub-packet and this sub-packet has nothing written to it, the DER length
* will not be written, and the total written size will be unchanged before
* and after WPACKET_close(). We use size1 and size2 to determine if
* anything was written, and only write our tag if it has.
*
* Because we know that int_end_context() needs to do the same check,
* we reproduce this flag if the written length was unchanged, or we will
* have an erroneous context tag.
*/
size_t size1, size2;
return WPACKET_get_total_written(pkt, &size1)
&& WPACKET_close(pkt)
&& WPACKET_get_total_written(pkt, &size2)
&& (size1 == size2
? WPACKET_set_flags(pkt, WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH)
: WPACKET_put_bytes_u8(pkt, DER_F_CONSTRUCTED | DER_P_SEQUENCE))
&& int_end_context(pkt, tag);
}
crypto/des/build.info
+5 -3
View File
@@ -14,7 +14,7 @@ IF[{- !$disabled{asm} -}]
ENDIF
LIBS=../../libcrypto
$COMMON=set_key.c ecb3_enc.c $DESASM
$COMMON=set_key.c ecb3_enc.c
$ALL=$COMMON\
ecb_enc.c cbc_enc.c \
cfb64enc.c cfb64ede.c cfb_enc.c \
@@ -22,8 +22,10 @@ $ALL=$COMMON\
str2key.c pcbc_enc.c qud_cksm.c rand_key.c \
fcrypt.c xcbc_enc.c cbc_cksm.c
SOURCE[../../libcrypto]=$ALL
SOURCE[../../providers/libfips.a]=$COMMON
SOURCE[../../libcrypto]=$ALL $DESASM
SOURCE[../../providers/libfips.a]=$COMMON $DESASM
SOURCE[../../providers/liblegacy.a]=$DESASM
DEFINE[../../libcrypto]=$DESDEF
DEFINE[../../providers/libfips.a]=$DESDEF
DEFINE[../../providers/liblegacy.a]=$DESDEF
crypto/dh/dh_check.c
+4 -4
View File
@@ -44,7 +44,7 @@ int DH_check_params_ex(const DH *dh)
return errflags == 0;
}
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
int DH_check_params(const DH *dh, int *ret)
{
int nid;
@@ -102,7 +102,7 @@ int DH_check_params(const DH *dh, int *ret)
BN_CTX_free(ctx);
return ok;
}
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
/*-
* Check that p is a safe prime and
@@ -140,7 +140,7 @@ int DH_check_ex(const DH *dh)
/* Note: according to documentation - this only checks the params */
int DH_check(const DH *dh, int *ret)
{
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
return DH_check_params(dh, ret);
#else
int ok = 0, r;
@@ -210,7 +210,7 @@ int DH_check(const DH *dh, int *ret)
BN_CTX_end(ctx);
BN_CTX_free(ctx);
return ok;
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
}
int DH_check_pub_key_ex(const DH *dh, const BIGNUM *pub_key)
crypto/dh/dh_gen.c
+9 -9
View File
@@ -30,10 +30,10 @@
#include "crypto/dh.h"
#include "dh_local.h"
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
static int dh_builtin_genparams(DH *ret, int prime_len, int generator,
BN_GENCB *cb);
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
int dh_generate_ffc_parameters(DH *dh, int type, int pbits,
int qbits, EVP_MD *md, BN_GENCB *cb)
@@ -47,7 +47,7 @@ int dh_generate_ffc_parameters(DH *dh, int type, int pbits,
qbits = (pbits >= 2048 ? SHA256_DIGEST_LENGTH :
SHA_DIGEST_LENGTH) * 8;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (type == DH_PARAMGEN_TYPE_FIPS_186_2)
ret = ffc_params_FIPS186_2_generate(dh->libctx, &dh->params,
FFC_PARAM_TYPE_DH,
@@ -96,7 +96,7 @@ int dh_get_named_group_uid_from_size(int pbits)
return nid;
}
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
static int dh_gen_named_group(OPENSSL_CTX *libctx, DH *ret, int prime_len)
{
@@ -116,12 +116,12 @@ static int dh_gen_named_group(OPENSSL_CTX *libctx, DH *ret, int prime_len)
DH_free(dh);
return ok;
}
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
int DH_generate_parameters_ex(DH *ret, int prime_len, int generator,
BN_GENCB *cb)
{
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
if (generator != 2)
return 0;
return dh_gen_named_group(ret->libctx, ret, prime_len);
@@ -129,10 +129,10 @@ int DH_generate_parameters_ex(DH *ret, int prime_len, int generator,
if (ret->meth->generate_params)
return ret->meth->generate_params(ret, prime_len, generator, cb);
return dh_builtin_genparams(ret, prime_len, generator, cb);
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/*-
* We generate DH parameters as follows
* find a prime p which is prime_len bits long,
@@ -238,4 +238,4 @@ static int dh_builtin_genparams(DH *ret, int prime_len, int generator,
BN_CTX_free(ctx);
return ok;
}
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
crypto/dh/dh_group_params.c
+2 -2
View File
@@ -59,7 +59,7 @@ static const DH_NAMED_GROUP dh_named_groups[] = {
FFDHE(4096),
FFDHE(6144),
FFDHE(8192),
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
MODP(1536),
#endif
MODP(2048),
@@ -71,7 +71,7 @@ static const DH_NAMED_GROUP dh_named_groups[] = {
* Additional dh named groups from RFC 5114 that have a different g.
* The uid can be any unique identifier.
*/
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
RFC5114("dh_1024_160", 1, 1024, 1024_160),
RFC5114("dh_2048_224", 2, 2048, 2048_224),
RFC5114("dh_2048_256", 3, 2048, 2048_256),
crypto/dh/dh_key.c
+10 -10
View File
@@ -20,7 +20,7 @@
#include "crypto/dh.h"
#include "crypto/security_bits.h"
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
# define MIN_STRENGTH 112
#else
# define MIN_STRENGTH 80
@@ -39,7 +39,7 @@ static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
BN_MONT_CTX *mont = NULL;
BIGNUM *tmp;
int ret = -1;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
int check_result;
#endif
@@ -74,7 +74,7 @@ static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
goto err;
}
/* TODO(3.0) : Solve in a PR related to Key validation for DH */
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (!DH_check_pub_key(dh, pub_key, &check_result) || check_result) {
DHerr(0, DH_R_INVALID_PUBKEY);
goto err;
@@ -95,7 +95,7 @@ static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
int DH_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
{
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
return compute_key(key, pub_key, dh);
#else
return dh->meth->compute_key(key, pub_key, dh);
@@ -106,7 +106,7 @@ int DH_compute_key_padded(unsigned char *key, const BIGNUM *pub_key, DH *dh)
{
int rv, pad;
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
rv = compute_key(key, pub_key, dh);
#else
rv = dh->meth->compute_key(key, pub_key, dh);
@@ -166,16 +166,16 @@ static int dh_finish(DH *dh)
return 1;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
void DH_set_default_method(const DH_METHOD *meth)
{
default_DH_method = meth;
}
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
int DH_generate_key(DH *dh)
{
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
return generate_key(dh);
#else
return dh->meth->generate_key(dh);
@@ -214,7 +214,7 @@ static int generate_key(DH *dh)
{
int ok = 0;
int generate_new_key = 0;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
unsigned l;
#endif
BN_CTX *ctx = NULL;
@@ -264,7 +264,7 @@ static int generate_key(DH *dh)
max_strength, priv_key))
goto err;
} else {
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
if (dh->params.q == NULL)
goto err;
#else
crypto/dh/dh_lib.c
+15 -15
View File
@@ -26,7 +26,7 @@
static DH *dh_new_intern(ENGINE *engine, OPENSSL_CTX *libctx);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
int DH_set_method(DH *dh, const DH_METHOD *meth)
{
/*
@@ -61,7 +61,7 @@ DH *DH_new_method(ENGINE *engine)
{
return dh_new_intern(engine, NULL);
}
#endif /* !FIPS_MODE */
#endif /* !FIPS_MODULE */
DH *dh_new_with_libctx(OPENSSL_CTX *libctx)
{
@@ -87,7 +87,7 @@ static DH *dh_new_intern(ENGINE *engine, OPENSSL_CTX *libctx)
ret->libctx = libctx;
ret->meth = DH_get_default_method();
#if !defined(FIPS_MODE) && !defined(OPENSSL_NO_ENGINE)
#if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_ENGINE)
ret->flags = ret->meth->flags; /* early default init */
if (engine) {
if (!ENGINE_init(engine)) {
@@ -108,10 +108,10 @@ static DH *dh_new_intern(ENGINE *engine, OPENSSL_CTX *libctx)
ret->flags = ret->meth->flags;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_DH, ret, &ret->ex_data))
goto err;
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
if ((ret->meth->init != NULL) && !ret->meth->init(ret)) {
DHerr(0, ERR_R_INIT_FAIL);
@@ -140,7 +140,7 @@ void DH_free(DH *r)
if (r->meth != NULL && r->meth->finish != NULL)
r->meth->finish(r);
#if !defined(FIPS_MODE)
#if !defined(FIPS_MODULE)
# if !defined(OPENSSL_NO_ENGINE)
ENGINE_finish(r->engine);
# endif
@@ -167,7 +167,7 @@ int DH_up_ref(DH *r)
return ((i > 1) ? 1 : 0);
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
int DH_set_ex_data(DH *d, int idx, void *arg)
{
return CRYPTO_set_ex_data(&d->ex_data, idx, arg);
@@ -310,12 +310,12 @@ void DH_set_flags(DH *dh, int flags)
dh->flags |= flags;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
ENGINE *DH_get0_engine(DH *dh)
{
return dh->engine;
}
#endif /*FIPS_MODE */
#endif /*FIPS_MODULE */
FFC_PARAMS *dh_get0_params(DH *dh)
{
@@ -400,7 +400,7 @@ int EVP_PKEY_CTX_set_dh_paramgen_type(EVP_PKEY_CTX *ctx, int typ)
if ((ret = dh_paramgen_check(ctx)) <= 0)
return ret;
#if !defined(FIPS_MODE)
#if !defined(FIPS_MODULE)
/* TODO(3.0): Remove this eventually when no more legacy */
if (ctx->op.keymgmt.genctx == NULL)
return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_DH, EVP_PKEY_OP_PARAMGEN,
@@ -426,7 +426,7 @@ int EVP_PKEY_CTX_set_dh_paramgen_prime_len(EVP_PKEY_CTX *ctx, int pbits)
if ((ret = dh_paramgen_check(ctx)) <= 0)
return ret;
#if !defined(FIPS_MODE)
#if !defined(FIPS_MODULE)
/* TODO(3.0): Remove this eventually when no more legacy */
if (ctx->op.keymgmt.genctx == NULL)
return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_DH, EVP_PKEY_OP_PARAMGEN,
@@ -447,7 +447,7 @@ int EVP_PKEY_CTX_set_dh_paramgen_subprime_len(EVP_PKEY_CTX *ctx, int qbits)
if ((ret = dh_paramgen_check(ctx)) <= 0)
return ret;
#if !defined(FIPS_MODE)
#if !defined(FIPS_MODULE)
/* TODO(3.0): Remove this eventually when no more legacy */
if (ctx->op.keymgmt.genctx == NULL)
return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_DH, EVP_PKEY_OP_PARAMGEN,
@@ -468,7 +468,7 @@ int EVP_PKEY_CTX_set_dh_paramgen_generator(EVP_PKEY_CTX *ctx, int gen)
if ((ret = dh_paramgen_check(ctx)) <= 0)
return ret;
#if !defined(FIPS_MODE)
#if !defined(FIPS_MODULE)
/* TODO(3.0): Remove this eventually when no more legacy */
if (ctx->op.keymgmt.genctx == NULL)
return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_DH, EVP_PKEY_OP_PARAMGEN,
@@ -490,7 +490,7 @@ int EVP_PKEY_CTX_set_dh_rfc5114(EVP_PKEY_CTX *ctx, int gen)
if ((ret = dh_paramgen_check(ctx)) <= 0)
return ret;
#if !defined(FIPS_MODE)
#if !defined(FIPS_MODULE)
/* TODO(3.0): Remove this eventually when no more legacy */
if (ctx->op.keymgmt.genctx == NULL)
return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_DHX, EVP_PKEY_OP_PARAMGEN,
@@ -520,7 +520,7 @@ int EVP_PKEY_CTX_set_dh_nid(EVP_PKEY_CTX *ctx, int nid)
if ((ret = dh_paramgen_check(ctx)) <= 0)
return ret;
#if !defined(FIPS_MODE)
#if !defined(FIPS_MODULE)
/* TODO(3.0): Remove this eventually when no more legacy */
if (ctx->op.keymgmt.genctx == NULL)
return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_DH,
crypto/dh/dh_local.h
+1 -1
View File
@@ -28,7 +28,7 @@ struct dh_st {
int flags;
BN_MONT_CTX *method_mont_p;
CRYPTO_REF_COUNT references;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
CRYPTO_EX_DATA ex_data;
ENGINE *engine;
#endif
crypto/dh/dh_pmeth.c
+5 -5
View File
@@ -306,7 +306,7 @@ static DH *ffc_params_generate(OPENSSL_CTX *libctx, DH_PKEY_CTX *dctx,
else
md = EVP_sha1();
}
# ifndef FIPS_MODE
# ifndef FIPS_MODULE
if (dctx->paramgen_type == DH_PARAMGEN_TYPE_FIPS_186_2)
rv = ffc_params_FIPS186_2_generate(libctx, &ret->params,
FFC_PARAM_TYPE_DH,
@@ -346,7 +346,7 @@ static int pkey_dh_paramgen(EVP_PKEY_CTX *ctx,
return 1;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (dctx->rfc5114_param) {
switch (dctx->rfc5114_param) {
case 1:
@@ -367,7 +367,7 @@ static int pkey_dh_paramgen(EVP_PKEY_CTX *ctx,
EVP_PKEY_assign(pkey, EVP_PKEY_DHX, dh);
return 1;
}
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
if (ctx->pkey_gencb != NULL) {
pcb = BN_GENCB_new();
@@ -375,9 +375,9 @@ static int pkey_dh_paramgen(EVP_PKEY_CTX *ctx,
return 0;
evp_pkey_set_cb_translate(pcb, ctx);
}
# ifdef FIPS_MODE
# ifdef FIPS_MODULE
dctx->paramgen_type = DH_PARAMGEN_TYPE_FIPS_186_4;
# endif /* FIPS_MODE */
# endif /* FIPS_MODULE */
if (dctx->paramgen_type >= DH_PARAMGEN_TYPE_FIPS_186_2) {
dh = ffc_params_generate(NULL, dctx, pcb);
BN_GENCB_free(pcb);
crypto/dsa/dsa_gen.c
+4 -4
View File
@@ -36,7 +36,7 @@ int dsa_generate_ffc_parameters(DSA *dsa, int type,
qbits = (pbits >= 2048 ? SHA256_DIGEST_LENGTH :
SHA_DIGEST_LENGTH) * 8;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (type == DSA_PARAMGEN_TYPE_FIPS_186_2)
ret = ffc_params_FIPS186_2_generate(dsa->libctx, &dsa->params,
FFC_PARAM_TYPE_DSA,
@@ -51,13 +51,13 @@ int dsa_generate_ffc_parameters(DSA *dsa, int type,
return ret;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
int DSA_generate_parameters_ex(DSA *dsa, int bits,
const unsigned char *seed_in, int seed_len,
int *counter_ret, unsigned long *h_ret,
BN_GENCB *cb)
{
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (dsa->meth->dsa_paramgen)
return dsa->meth->dsa_paramgen(dsa, bits, seed_in, seed_len,
counter_ret, h_ret, cb);
@@ -66,7 +66,7 @@ int DSA_generate_parameters_ex(DSA *dsa, int bits,
&& !ffc_params_set_validate_params(&dsa->params, seed_in, seed_len, -1))
return 0;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* The old code used FIPS 186-2 DSA Parameter generation */
if (bits <= 1024 && seed_len == 20) {
if (!dsa_generate_ffc_parameters(dsa, DSA_PARAMGEN_TYPE_FIPS_186_2,
crypto/dsa/dsa_key.c
+4 -4
View File
@@ -21,7 +21,7 @@
#include "crypto/dsa.h"
#include "dsa_local.h"
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
# define MIN_STRENGTH 112
#else
# define MIN_STRENGTH 80
@@ -32,7 +32,7 @@ static int dsa_keygen_pairwise_test(DSA *dsa, OSSL_CALLBACK *cb, void *cbarg);
int DSA_generate_key(DSA *dsa)
{
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (dsa->meth->dsa_keygen != NULL)
return dsa->meth->dsa_keygen(dsa);
#endif
@@ -96,9 +96,9 @@ static int dsa_keygen(DSA *dsa, int pairwise_test)
dsa->priv_key = priv_key;
dsa->pub_key = pub_key;
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
pairwise_test = 1;
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
ok = 1;
if (pairwise_test) {
crypto/dsa/dsa_lib.c
+11 -11
View File
@@ -27,7 +27,7 @@
static DSA *dsa_new_intern(ENGINE *engine, OPENSSL_CTX *libctx);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
int DSA_set_ex_data(DSA *d, int idx, void *arg)
{
@@ -124,7 +124,7 @@ int DSA_set_method(DSA *dsa, const DSA_METHOD *meth)
meth->init(dsa);
return 1;
}
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
const DSA_METHOD *DSA_get_method(DSA *d)
@@ -151,7 +151,7 @@ static DSA *dsa_new_intern(ENGINE *engine, OPENSSL_CTX *libctx)
ret->libctx = libctx;
ret->meth = DSA_get_default_method();
#if !defined(FIPS_MODE) && !defined(OPENSSL_NO_ENGINE)
#if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_ENGINE)
ret->flags = ret->meth->flags & ~DSA_FLAG_NON_FIPS_ALLOW; /* early default init */
if (engine) {
if (!ENGINE_init(engine)) {
@@ -172,7 +172,7 @@ static DSA *dsa_new_intern(ENGINE *engine, OPENSSL_CTX *libctx)
ret->flags = ret->meth->flags & ~DSA_FLAG_NON_FIPS_ALLOW;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (!crypto_new_ex_data_ex(libctx, CRYPTO_EX_INDEX_DSA, ret, &ret->ex_data))
goto err;
#endif
@@ -199,7 +199,7 @@ DSA *dsa_new_with_ctx(OPENSSL_CTX *libctx)
return dsa_new_intern(NULL, libctx);
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
DSA *DSA_new(void)
{
return dsa_new_intern(NULL, NULL);
@@ -221,11 +221,11 @@ void DSA_free(DSA *r)
if (r->meth != NULL && r->meth->finish != NULL)
r->meth->finish(r);
#if !defined(FIPS_MODE) && !defined(OPENSSL_NO_ENGINE)
#if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_ENGINE)
ENGINE_finish(r->engine);
#endif
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
CRYPTO_free_ex_data(CRYPTO_EX_INDEX_DSA, r, &r->ex_data);
#endif
@@ -430,7 +430,7 @@ int EVP_PKEY_CTX_set_dsa_paramgen_bits(EVP_PKEY_CTX *ctx, int nbits)
if ((ret = dsa_paramgen_check(ctx)) <= 0)
return ret;
#if !defined(FIPS_MODE)
#if !defined(FIPS_MODULE)
/* TODO(3.0): Remove this eventually when no more legacy */
if (ctx->op.keymgmt.genctx == NULL)
return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_DSA, EVP_PKEY_OP_PARAMGEN,
@@ -452,7 +452,7 @@ int EVP_PKEY_CTX_set_dsa_paramgen_q_bits(EVP_PKEY_CTX *ctx, int qbits)
if ((ret = dsa_paramgen_check(ctx)) <= 0)
return ret;
#if !defined(FIPS_MODE)
#if !defined(FIPS_MODULE)
/* TODO(3.0): Remove this eventually when no more legacy */
if (ctx->op.keymgmt.genctx == NULL)
return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_DSA, EVP_PKEY_OP_PARAMGEN,
@@ -475,7 +475,7 @@ int EVP_PKEY_CTX_set_dsa_paramgen_md_props(EVP_PKEY_CTX *ctx,
if ((ret = dsa_paramgen_check(ctx)) <= 0)
return ret;
#if !defined(FIPS_MODE)
#if !defined(FIPS_MODULE)
/* TODO(3.0): Remove this eventually when no more legacy */
if (ctx->op.keymgmt.genctx == NULL) {
const EVP_MD *md = EVP_get_digestbyname(md_name);
@@ -495,7 +495,7 @@ int EVP_PKEY_CTX_set_dsa_paramgen_md_props(EVP_PKEY_CTX *ctx,
return EVP_PKEY_CTX_set_params(ctx, params);
}
#if !defined(FIPS_MODE)
#if !defined(FIPS_MODULE)
int EVP_PKEY_CTX_set_dsa_paramgen_md(EVP_PKEY_CTX *ctx, const EVP_MD *md)
{
const char *md_name = (md == NULL) ? "" : EVP_MD_name(md);
crypto/dsa/dsa_local.h
+1 -1
View File
@@ -25,7 +25,7 @@ struct dsa_st {
/* Normally used to cache montgomery values */
BN_MONT_CTX *method_mont_p;
CRYPTO_REF_COUNT references;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
CRYPTO_EX_DATA ex_data;
#endif
const DSA_METHOD *meth;
crypto/dsa/dsa_ossl.c
+2 -2
View File
@@ -50,12 +50,12 @@ static DSA_METHOD openssl_dsa_meth = {
static const DSA_METHOD *default_DSA_method = &openssl_dsa_meth;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
void DSA_set_default_method(const DSA_METHOD *meth)
{
default_DSA_method = meth;
}
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
const DSA_METHOD *DSA_get_default_method(void)
{
crypto/dso/dso_dlfcn.c
+3 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -19,6 +19,8 @@
#include "dso_local.h"
#include "e_os.h"
DEFINE_STACK_OF(void)
#ifdef DSO_DLFCN
# ifdef HAVE_DLFCN_H
crypto/dso/dso_lib.c
+3 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -10,6 +10,8 @@
#include "dso_local.h"
#include "internal/refcount.h"
DEFINE_STACK_OF(void)
static DSO_METHOD *default_DSO_meth = NULL;
static DSO *DSO_new_method(DSO_METHOD *meth)
crypto/dso/dso_win32.c
+3 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -69,6 +69,8 @@ static void *win32_globallookup(const char *name);
static const char *openssl_strnchr(const char *string, int c, size_t len);
DEFINE_STACK_OF(void)
static DSO_METHOD dso_meth_win32 = {
"OpenSSL 'win32' shared library method",
win32_load,
crypto/ec/ec2_oct.c
+10 -10
View File
@@ -43,7 +43,7 @@ int ec_GF2m_simple_set_compressed_coordinates(const EC_GROUP *group,
{
BIGNUM *tmp, *x, *y, *z;
int ret = 0, z0;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX *new_ctx = NULL;
/* clear error queue */
@@ -81,7 +81,7 @@ int ec_GF2m_simple_set_compressed_coordinates(const EC_GROUP *group,
if (!BN_GF2m_add(tmp, x, tmp))
goto err;
if (!BN_GF2m_mod_solve_quad_arr(z, tmp, group->poly, ctx)) {
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
unsigned long err = ERR_peek_last_error();
if (ERR_GET_LIB(err) == ERR_LIB_BN
@@ -113,7 +113,7 @@ int ec_GF2m_simple_set_compressed_coordinates(const EC_GROUP *group,
err:
BN_CTX_end(ctx);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX_free(new_ctx);
#endif
return ret;
@@ -132,7 +132,7 @@ size_t ec_GF2m_simple_point2oct(const EC_GROUP *group, const EC_POINT *point,
int used_ctx = 0;
BIGNUM *x, *y, *yxi;
size_t field_len, i, skip;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX *new_ctx = NULL;
#endif
@@ -168,7 +168,7 @@ size_t ec_GF2m_simple_point2oct(const EC_GROUP *group, const EC_POINT *point,
goto err;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (ctx == NULL) {
ctx = new_ctx = BN_CTX_new();
if (ctx == NULL)
@@ -236,7 +236,7 @@ size_t ec_GF2m_simple_point2oct(const EC_GROUP *group, const EC_POINT *point,
if (used_ctx)
BN_CTX_end(ctx);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX_free(new_ctx);
#endif
return ret;
@@ -244,7 +244,7 @@ size_t ec_GF2m_simple_point2oct(const EC_GROUP *group, const EC_POINT *point,
err:
if (used_ctx)
BN_CTX_end(ctx);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX_free(new_ctx);
#endif
return 0;
@@ -263,7 +263,7 @@ int ec_GF2m_simple_oct2point(const EC_GROUP *group, EC_POINT *point,
BIGNUM *x, *y, *yxi;
size_t field_len, enc_len;
int ret = 0;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX *new_ctx = NULL;
#endif
@@ -305,7 +305,7 @@ int ec_GF2m_simple_oct2point(const EC_GROUP *group, EC_POINT *point,
return 0;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (ctx == NULL) {
ctx = new_ctx = BN_CTX_new();
if (ctx == NULL)
@@ -358,7 +358,7 @@ int ec_GF2m_simple_oct2point(const EC_GROUP *group, EC_POINT *point,
err:
BN_CTX_end(ctx);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX_free(new_ctx);
#endif
return ret;
crypto/ec/ec2_smpl.c
+14 -14
View File
@@ -182,7 +182,7 @@ int ec_GF2m_simple_group_check_discriminant(const EC_GROUP *group,
{
int ret = 0;
BIGNUM *b;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX *new_ctx = NULL;
if (ctx == NULL) {
@@ -213,7 +213,7 @@ int ec_GF2m_simple_group_check_discriminant(const EC_GROUP *group,
err:
BN_CTX_end(ctx);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX_free(new_ctx);
#endif
return ret;
@@ -361,7 +361,7 @@ int ec_GF2m_simple_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
{
BIGNUM *x0, *y0, *x1, *y1, *x2, *y2, *s, *t;
int ret = 0;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX *new_ctx = NULL;
#endif
@@ -377,7 +377,7 @@ int ec_GF2m_simple_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
return 1;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (ctx == NULL) {
ctx = new_ctx = BN_CTX_new();
if (ctx == NULL)
@@ -467,7 +467,7 @@ int ec_GF2m_simple_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
err:
BN_CTX_end(ctx);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX_free(new_ctx);
#endif
return ret;
@@ -514,7 +514,7 @@ int ec_GF2m_simple_is_on_curve(const EC_GROUP *group, const EC_POINT *point,
int (*field_mul) (const EC_GROUP *, BIGNUM *, const BIGNUM *,
const BIGNUM *, BN_CTX *);
int (*field_sqr) (const EC_GROUP *, BIGNUM *, const BIGNUM *, BN_CTX *);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX *new_ctx = NULL;
#endif
@@ -528,7 +528,7 @@ int ec_GF2m_simple_is_on_curve(const EC_GROUP *group, const EC_POINT *point,
if (!point->Z_is_one)
return -1;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (ctx == NULL) {
ctx = new_ctx = BN_CTX_new();
if (ctx == NULL)
@@ -566,7 +566,7 @@ int ec_GF2m_simple_is_on_curve(const EC_GROUP *group, const EC_POINT *point,
err:
BN_CTX_end(ctx);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX_free(new_ctx);
#endif
return ret;
@@ -584,7 +584,7 @@ int ec_GF2m_simple_cmp(const EC_GROUP *group, const EC_POINT *a,
{
BIGNUM *aX, *aY, *bX, *bY;
int ret = -1;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX *new_ctx = NULL;
#endif
@@ -599,7 +599,7 @@ int ec_GF2m_simple_cmp(const EC_GROUP *group, const EC_POINT *a,
return ((BN_cmp(a->X, b->X) == 0) && BN_cmp(a->Y, b->Y) == 0) ? 0 : 1;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (ctx == NULL) {
ctx = new_ctx = BN_CTX_new();
if (ctx == NULL)
@@ -623,7 +623,7 @@ int ec_GF2m_simple_cmp(const EC_GROUP *group, const EC_POINT *a,
err:
BN_CTX_end(ctx);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX_free(new_ctx);
#endif
return ret;
@@ -635,14 +635,14 @@ int ec_GF2m_simple_make_affine(const EC_GROUP *group, EC_POINT *point,
{
BIGNUM *x, *y;
int ret = 0;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX *new_ctx = NULL;
#endif
if (point->Z_is_one || EC_POINT_is_at_infinity(group, point))
return 1;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (ctx == NULL) {
ctx = new_ctx = BN_CTX_new();
if (ctx == NULL)
@@ -670,7 +670,7 @@ int ec_GF2m_simple_make_affine(const EC_GROUP *group, EC_POINT *point,
err:
BN_CTX_end(ctx);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX_free(new_ctx);
#endif
return ret;
crypto/ec/ec_asn1.c
+2 -2
View File
@@ -21,7 +21,7 @@
#include "internal/nelem.h"
#include "crypto/asn1_dsa.h"
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
int EC_GROUP_get_basis_type(const EC_GROUP *group)
{
@@ -1237,7 +1237,7 @@ int i2o_ECPublicKey(const EC_KEY *a, unsigned char **out)
DECLARE_ASN1_FUNCTIONS(ECDSA_SIG)
DECLARE_ASN1_ENCODE_FUNCTIONS_name(ECDSA_SIG, ECDSA_SIG)
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
ECDSA_SIG *ECDSA_SIG_new(void)
{
crypto/ec/ec_check.c
+2 -2
View File
@@ -45,7 +45,7 @@ int EC_GROUP_check_named_curve(const EC_GROUP *group, int nist_only,
int EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx)
{
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
/*
* ECC domain parameter validation.
* See SP800-56A R3 5.5.2 "Assurances of Domain-Parameter Validity" Part 1b.
@@ -114,5 +114,5 @@ int EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx)
BN_CTX_free(new_ctx);
EC_POINT_free(point);
return ret;
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
}
crypto/ec/ec_ctrl.c
+1 -1
View File
@@ -463,7 +463,7 @@ int EVP_PKEY_CTX_get_ec_paramgen_curve_name(EVP_PKEY_CTX *ctx,
return 1;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
int EVP_PKEY_CTX_set_ec_paramgen_curve_nid(EVP_PKEY_CTX *ctx, int nid)
{
if (ctx == NULL || !EVP_PKEY_CTX_IS_GEN_OP(ctx)) {
crypto/ec/ec_curve.c
+21 -21
View File
@@ -200,7 +200,7 @@ static const struct {
}
};
# ifndef FIPS_MODE
# ifndef FIPS_MODULE
/* the x9.62 prime curves (minus the nist prime curves) */
static const struct {
EC_CURVE_DATA h;
@@ -379,7 +379,7 @@ static const struct {
0x43, 0x21, 0x46, 0x52, 0x65, 0x51
}
};
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
static const struct {
EC_CURVE_DATA h;
@@ -419,7 +419,7 @@ static const struct {
}
};
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* the secg prime curves (minus the nist and x9.62 prime curves) */
static const struct {
EC_CURVE_DATA h;
@@ -841,13 +841,13 @@ static const struct {
0x5C, 0x5C, 0x2A, 0x3D
}
};
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
#ifndef OPENSSL_NO_EC2M
/* characteristic two curves */
# ifndef FIPS_MODE
# ifndef FIPS_MODULE
static const struct {
EC_CURVE_DATA h;
unsigned char data[20 + 15 * 6];
@@ -975,7 +975,7 @@ static const struct {
0x33, 0x04, 0x9B, 0xA9, 0x8F
}
};
# endif /* FIPS_MODE */
# endif /* FIPS_MODULE */
static const struct {
EC_CURVE_DATA h;
@@ -1007,7 +1007,7 @@ static const struct {
}
};
# ifndef FIPS_MODE
# ifndef FIPS_MODULE
static const struct {
EC_CURVE_DATA h;
unsigned char data[0 + 21 * 6];
@@ -1036,7 +1036,7 @@ static const struct {
0xAA, 0xB6, 0x89, 0xC2, 0x9C, 0xA7, 0x10, 0x27, 0x9B
}
};
# endif /* FIPS_MODE */
# endif /* FIPS_MODULE */
static const struct {
EC_CURVE_DATA h;
@@ -1067,7 +1067,7 @@ static const struct {
}
};
# ifndef FIPS_MODE
# ifndef FIPS_MODULE
static const struct {
EC_CURVE_DATA h;
unsigned char data[20 + 25 * 6];
@@ -1143,7 +1143,7 @@ static const struct {
0xD5
}
};
# endif /* FIPS_MODE */
# endif /* FIPS_MODULE */
static const struct {
EC_CURVE_DATA h;
@@ -1219,7 +1219,7 @@ static const struct {
}
};
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
static const struct {
EC_CURVE_DATA h;
unsigned char data[0 + 30 * 6];
@@ -1255,7 +1255,7 @@ static const struct {
0x1D, 0xA8, 0x00, 0xE4, 0x78, 0xA5
}
};
# endif /* FIPS_MODE */
# endif /* FIPS_MODULE */
static const struct {
EC_CURVE_DATA h;
@@ -1539,7 +1539,7 @@ static const struct {
}
};
# ifndef FIPS_MODE
# ifndef FIPS_MODULE
static const struct {
EC_CURVE_DATA h;
unsigned char data[20 + 21 * 6];
@@ -2224,7 +2224,7 @@ static const struct {
0xED, 0xF9, 0x7C, 0x44, 0xDB, 0x9F, 0x24, 0x20, 0xBA, 0xFC, 0xA7, 0x5E
}
};
# endif /* FIPS_MODE */
# endif /* FIPS_MODULE */
#endif /* OPENSSL_NO_EC2M */
/*
@@ -2235,7 +2235,7 @@ static const struct {
* generation mechanism is different from those defined in ANSI X9.62.
*/
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
static const struct {
EC_CURVE_DATA h;
unsigned char data[0 + 20 * 6];
@@ -2775,9 +2775,9 @@ static const struct {
0x9C, 0xA9, 0x00, 0x69
}
};
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
#if !defined(OPENSSL_NO_SM2) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_SM2) && !defined(FIPS_MODULE)
static const struct {
EC_CURVE_DATA h;
unsigned char data[0 + 32 * 6];
@@ -2824,7 +2824,7 @@ typedef struct _ec_list_element_st {
const char *comment;
} ec_list_element;
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
static const ec_list_element curve_list[] = {
/* prime field curves */
/* secg curves */
@@ -3113,7 +3113,7 @@ static const ec_list_element curve_list[] = {
"SM2 curve over a 256 bit prime field"},
# endif
};
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
#define curve_list_length OSSL_NELEM(curve_list)
@@ -3165,7 +3165,7 @@ int ec_curve_name2nid(const char *name)
if ((nid = EC_curve_nist2nid(name)) != NID_undef)
return nid;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/*
* TODO(3.0) Figure out if we can use other names than the NIST names
* ("B-163", "K-163" & "P-192") in the FIPS module, or if other names
@@ -3302,7 +3302,7 @@ EC_GROUP *EC_GROUP_new_by_curve_name_ex(OPENSSL_CTX *libctx, int nid)
return ret;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
EC_GROUP *EC_GROUP_new_by_curve_name(int nid)
{
return EC_GROUP_new_by_curve_name_ex(NULL, nid);
crypto/ec/ec_key.c
+9 -9
View File
@@ -26,7 +26,7 @@
static int ecdsa_keygen_pairwise_test(EC_KEY *eckey, OSSL_CALLBACK *cb,
void *cbarg);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
EC_KEY *EC_KEY_new(void)
{
return ec_key_new_method_int(NULL, NULL);
@@ -56,7 +56,7 @@ EC_KEY *EC_KEY_new_by_curve_name_ex(OPENSSL_CTX *ctx, int nid)
return ret;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
EC_KEY *EC_KEY_new_by_curve_name(int nid)
{
return EC_KEY_new_by_curve_name_ex(NULL, nid);
@@ -79,14 +79,14 @@ void EC_KEY_free(EC_KEY *r)
if (r->meth != NULL && r->meth->finish != NULL)
r->meth->finish(r);
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
ENGINE_finish(r->engine);
#endif
if (r->group && r->group->meth->keyfinish)
r->group->meth->keyfinish(r);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
CRYPTO_free_ex_data(CRYPTO_EX_INDEX_EC_KEY, r, &r->ex_data);
#endif
CRYPTO_THREAD_lock_free(r->lock);
@@ -108,7 +108,7 @@ EC_KEY *EC_KEY_copy(EC_KEY *dest, const EC_KEY *src)
dest->meth->finish(dest);
if (dest->group && dest->group->meth->keyfinish)
dest->group->meth->keyfinish(dest);
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
if (ENGINE_finish(dest->engine) == 0)
return 0;
dest->engine = NULL;
@@ -156,14 +156,14 @@ EC_KEY *EC_KEY_copy(EC_KEY *dest, const EC_KEY *src)
dest->conv_form = src->conv_form;
dest->version = src->version;
dest->flags = src->flags;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_EC_KEY,
&dest->ex_data, &src->ex_data))
return NULL;
#endif
if (src->meth != dest->meth) {
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
if (src->engine != NULL && ENGINE_init(src->engine) == 0)
return NULL;
dest->engine = src->engine;
@@ -312,9 +312,9 @@ int ec_generate_key(OPENSSL_CTX *libctx, EC_KEY *eckey, int pairwise_test)
eckey->dirty_cnt++;
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
pairwise_test = 1;
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
ok = 1;
if (pairwise_test) {
crypto/ec/ec_kmeth.c
+4 -4
View File
@@ -65,7 +65,7 @@ int EC_KEY_set_method(EC_KEY *key, const EC_KEY_METHOD *meth)
if (finish != NULL)
finish(key);
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
ENGINE_finish(key->engine);
key->engine = NULL;
#endif
@@ -96,7 +96,7 @@ EC_KEY *ec_key_new_method_int(OPENSSL_CTX *libctx, ENGINE *engine)
}
ret->meth = EC_KEY_get_default_method();
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
if (engine != NULL) {
if (!ENGINE_init(engine)) {
ECerr(EC_F_EC_KEY_NEW_METHOD_INT, ERR_R_ENGINE_LIB);
@@ -118,7 +118,7 @@ EC_KEY *ec_key_new_method_int(OPENSSL_CTX *libctx, ENGINE *engine)
ret->conv_form = POINT_CONVERSION_UNCOMPRESSED;
/* No ex_data inside the FIPS provider */
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_EC_KEY, ret, &ret->ex_data)) {
goto err;
}
@@ -135,7 +135,7 @@ EC_KEY *ec_key_new_method_int(OPENSSL_CTX *libctx, ENGINE *engine)
return NULL;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
EC_KEY *EC_KEY_new_method(ENGINE *engine)
{
return ec_key_new_method_int(NULL, engine);
crypto/ec/ec_lib.c
+46 -20
View File
@@ -65,7 +65,7 @@ EC_GROUP *EC_GROUP_new_ex(OPENSSL_CTX *libctx, const EC_METHOD *meth)
return NULL;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
EC_GROUP *EC_GROUP_new(const EC_METHOD *meth)
{
return EC_GROUP_new_ex(NULL, meth);
@@ -597,7 +597,7 @@ int EC_GROUP_cmp(const EC_GROUP *a, const EC_GROUP *b, BN_CTX *ctx)
{
int r = 0;
BIGNUM *a1, *a2, *a3, *b1, *b2, *b3;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX *ctx_new = NULL;
#endif
@@ -612,7 +612,7 @@ int EC_GROUP_cmp(const EC_GROUP *a, const EC_GROUP *b, BN_CTX *ctx)
if (a->meth->flags & EC_FLAGS_CUSTOM_CURVE)
return 0;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (ctx == NULL)
ctx_new = ctx = BN_CTX_new();
#endif
@@ -628,7 +628,7 @@ int EC_GROUP_cmp(const EC_GROUP *a, const EC_GROUP *b, BN_CTX *ctx)
b3 = BN_CTX_get(ctx);
if (b3 == NULL) {
BN_CTX_end(ctx);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX_free(ctx_new);
#endif
return -1;
@@ -680,7 +680,7 @@ int EC_GROUP_cmp(const EC_GROUP *a, const EC_GROUP *b, BN_CTX *ctx)
}
end:
BN_CTX_end(ctx);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX_free(ctx_new);
#endif
return r;
@@ -1041,13 +1041,14 @@ int EC_POINTs_make_affine(const EC_GROUP *group, size_t num,
* methods.
*/
#ifndef OPENSSL_NO_DEPRECATED_3_0
int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
size_t num, const EC_POINT *points[],
const BIGNUM *scalars[], BN_CTX *ctx)
{
int ret = 0;
size_t i = 0;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX *new_ctx = NULL;
#endif
@@ -1066,7 +1067,7 @@ int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
}
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (ctx == NULL)
ctx = new_ctx = BN_CTX_secure_new();
#endif
@@ -1081,26 +1082,51 @@ int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
/* use default */
ret = ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX_free(new_ctx);
#endif
return ret;
}
#endif
int EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,
const EC_POINT *point, const BIGNUM *p_scalar, BN_CTX *ctx)
{
/* just a convenient interface to EC_POINTs_mul() */
int ret = 0;
#ifndef FIPS_MODULE
BN_CTX *new_ctx = NULL;
#endif
const EC_POINT *points[1];
const BIGNUM *scalars[1];
if (!ec_point_is_compat(r, group)
|| (point != NULL && !ec_point_is_compat(point, group))) {
ECerr(EC_F_EC_POINT_MUL, EC_R_INCOMPATIBLE_OBJECTS);
return 0;
}
points[0] = point;
scalars[0] = p_scalar;
if (g_scalar == NULL && p_scalar == NULL)
return EC_POINT_set_to_infinity(group, r);
return EC_POINTs_mul(group, r, g_scalar,
(point != NULL
&& p_scalar != NULL), points, scalars, ctx);
#ifndef FIPS_MODULE
if (ctx == NULL)
ctx = new_ctx = BN_CTX_secure_new();
#endif
if (ctx == NULL) {
ECerr(EC_F_EC_POINT_MUL, ERR_R_INTERNAL_ERROR);
return 0;
}
if (group->meth->mul != NULL)
ret = group->meth->mul(group, r, g_scalar, point != NULL
&& p_scalar != NULL, &point, &p_scalar, ctx);
else
/* use default */
ret = ec_wNAF_mul(group, r, g_scalar, point != NULL
&& p_scalar != NULL, &point, &p_scalar, ctx);
#ifndef FIPS_MODULE
BN_CTX_free(new_ctx);
#endif
return ret;
}
int EC_GROUP_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
@@ -1161,7 +1187,7 @@ static int ec_precompute_mont_data(EC_GROUP *group)
return ret;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
int EC_KEY_set_ex_data(EC_KEY *key, int idx, void *arg)
{
return CRYPTO_set_ex_data(&key->ex_data, idx, arg);
@@ -1185,14 +1211,14 @@ static int ec_field_inverse_mod_ord(const EC_GROUP *group, BIGNUM *r,
{
BIGNUM *e = NULL;
int ret = 0;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX *new_ctx = NULL;
#endif
if (group->mont_data == NULL)
return 0;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (ctx == NULL)
ctx = new_ctx = BN_CTX_secure_new();
#endif
@@ -1222,7 +1248,7 @@ static int ec_field_inverse_mod_ord(const EC_GROUP *group, BIGNUM *r,
err:
BN_CTX_end(ctx);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX_free(new_ctx);
#endif
return ret;
crypto/ec/ec_local.h
+1 -1
View File
@@ -288,7 +288,7 @@ struct ec_key_st {
point_conversion_form_t conv_form;
CRYPTO_REF_COUNT references;
int flags;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
CRYPTO_EX_DATA ex_data;
#endif
CRYPTO_RWLOCK *lock;
crypto/ec/ec_mult.c
+3 -3
View File
@@ -833,7 +833,7 @@ int ec_wNAF_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
EC_POINT **points = NULL;
EC_PRE_COMP *pre_comp;
int ret = 0;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX *new_ctx = NULL;
#endif
@@ -848,7 +848,7 @@ int ec_wNAF_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
goto err;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (ctx == NULL)
ctx = new_ctx = BN_CTX_new();
#endif
@@ -965,7 +965,7 @@ int ec_wNAF_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
err:
BN_CTX_end(ctx);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX_free(new_ctx);
#endif
EC_ec_pre_comp_free(pre_comp);
crypto/ec/ecp_nistp224.c
+5 -5
View File
@@ -1299,7 +1299,7 @@ int ec_GFp_nistp224_group_set_curve(EC_GROUP *group, const BIGNUM *p,
{
int ret = 0;
BIGNUM *curve_p, *curve_a, *curve_b;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX *new_ctx = NULL;
if (ctx == NULL)
@@ -1326,7 +1326,7 @@ int ec_GFp_nistp224_group_set_curve(EC_GROUP *group, const BIGNUM *p,
ret = ec_GFp_simple_group_set_curve(group, p, a, b, ctx);
err:
BN_CTX_end(ctx);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX_free(new_ctx);
#endif
return ret;
@@ -1617,14 +1617,14 @@ int ec_GFp_nistp224_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
BIGNUM *x, *y;
EC_POINT *generator = NULL;
felem tmp_felems[32];
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX *new_ctx = NULL;
#endif
/* throw away old precomputation */
EC_pre_comp_free(group);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (ctx == NULL)
ctx = new_ctx = BN_CTX_new();
#endif
@@ -1738,7 +1738,7 @@ int ec_GFp_nistp224_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
err:
BN_CTX_end(ctx);
EC_POINT_free(generator);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX_free(new_ctx);
#endif
EC_nistp224_pre_comp_free(pre);
crypto/ec/ecp_nistp256.c
+5 -5
View File
@@ -1912,7 +1912,7 @@ int ec_GFp_nistp256_group_set_curve(EC_GROUP *group, const BIGNUM *p,
{
int ret = 0;
BIGNUM *curve_p, *curve_a, *curve_b;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX *new_ctx = NULL;
if (ctx == NULL)
@@ -1939,7 +1939,7 @@ int ec_GFp_nistp256_group_set_curve(EC_GROUP *group, const BIGNUM *p,
ret = ec_GFp_simple_group_set_curve(group, p, a, b, ctx);
err:
BN_CTX_end(ctx);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX_free(new_ctx);
#endif
return ret;
@@ -2239,14 +2239,14 @@ int ec_GFp_nistp256_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
EC_POINT *generator = NULL;
smallfelem tmp_smallfelems[32];
felem x_tmp, y_tmp, z_tmp;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX *new_ctx = NULL;
#endif
/* throw away old precomputation */
EC_pre_comp_free(group);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (ctx == NULL)
ctx = new_ctx = BN_CTX_new();
#endif
@@ -2370,7 +2370,7 @@ int ec_GFp_nistp256_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
err:
BN_CTX_end(ctx);
EC_POINT_free(generator);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX_free(new_ctx);
#endif
EC_nistp256_pre_comp_free(pre);
crypto/ec/ecp_nistp521.c
+5 -5
View File
@@ -1752,7 +1752,7 @@ int ec_GFp_nistp521_group_set_curve(EC_GROUP *group, const BIGNUM *p,
{
int ret = 0;
BIGNUM *curve_p, *curve_a, *curve_b;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX *new_ctx = NULL;
if (ctx == NULL)
@@ -1779,7 +1779,7 @@ int ec_GFp_nistp521_group_set_curve(EC_GROUP *group, const BIGNUM *p,
ret = ec_GFp_simple_group_set_curve(group, p, a, b, ctx);
err:
BN_CTX_end(ctx);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX_free(new_ctx);
#endif
return ret;
@@ -2075,14 +2075,14 @@ int ec_GFp_nistp521_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
BIGNUM *x, *y;
EC_POINT *generator = NULL;
felem tmp_felems[16];
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX *new_ctx = NULL;
#endif
/* throw away old precomputation */
EC_pre_comp_free(group);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (ctx == NULL)
ctx = new_ctx = BN_CTX_new();
#endif
@@ -2176,7 +2176,7 @@ int ec_GFp_nistp521_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
err:
BN_CTX_end(ctx);
EC_POINT_free(generator);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
BN_CTX_free(new_ctx);
#endif
EC_nistp521_pre_comp_free(pre);
crypto/ec/ecp_oct.c
+2 -2
View File
@@ -28,7 +28,7 @@ int ec_GFp_simple_set_compressed_coordinates(const EC_GROUP *group,
BIGNUM *tmp1, *tmp2, *x, *y;
int ret = 0;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* clear error queue */
ERR_clear_error();
#endif
@@ -107,7 +107,7 @@ int ec_GFp_simple_set_compressed_coordinates(const EC_GROUP *group,
}
if (!BN_mod_sqrt(y, tmp1, group->field, ctx)) {
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
unsigned long err = ERR_peek_last_error();
if (ERR_GET_LIB(err) == ERR_LIB_BN
crypto/ec/ecx_backend.c
+38 -10
View File
@@ -9,6 +9,8 @@
#include <openssl/core_names.h>
#include <openssl/params.h>
#include <openssl/ec.h>
#include <openssl/err.h>
#include "crypto/ecx.h"
#include "ecx_backend.h"
@@ -18,10 +20,35 @@
* implementations alike.
*/
int ecx_public_from_private(ECX_KEY *key)
{
switch (key->type) {
case ECX_KEY_TYPE_X25519:
X25519_public_from_private(key->pubkey, key->privkey);
break;
case ECX_KEY_TYPE_ED25519:
if (!ED25519_public_from_private(key->libctx, key->pubkey, key->privkey)) {
ECerr(0, EC_R_FAILED_MAKING_PUBLIC_KEY);
return 0;
}
break;
case ECX_KEY_TYPE_X448:
X448_public_from_private(key->pubkey, key->privkey);
break;
case ECX_KEY_TYPE_ED448:
if (!ED448_public_from_private(key->libctx, key->pubkey, key->privkey)) {
ECerr(0, EC_R_FAILED_MAKING_PUBLIC_KEY);
return 0;
}
break;
}
return 1;
}
int ecx_key_fromdata(ECX_KEY *ecx, const OSSL_PARAM params[],
int include_private)
{
size_t privkeylen = 0, pubkeylen;
size_t privkeylen = 0, pubkeylen = 0;
const OSSL_PARAM *param_priv_key = NULL, *param_pub_key;
unsigned char *pubkey;
@@ -32,11 +59,8 @@ int ecx_key_fromdata(ECX_KEY *ecx, const OSSL_PARAM params[],
if (include_private)
param_priv_key =
OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_PRIV_KEY);
/*
* If a private key is present then a public key must also be present.
* Alternatively we've just got a public key.
*/
if (param_pub_key == NULL)
if (param_pub_key == NULL && param_priv_key == NULL)
return 0;
if (param_priv_key != NULL
@@ -46,15 +70,19 @@ int ecx_key_fromdata(ECX_KEY *ecx, const OSSL_PARAM params[],
return 0;
pubkey = ecx->pubkey;
if (!OSSL_PARAM_get_octet_string(param_pub_key,
(void **)&pubkey,
sizeof(ecx->pubkey), &pubkeylen))
if (param_pub_key != NULL
&& !OSSL_PARAM_get_octet_string(param_pub_key,
(void **)&pubkey,
sizeof(ecx->pubkey), &pubkeylen))
return 0;
if (pubkeylen != ecx->keylen
if ((param_pub_key != NULL && pubkeylen != ecx->keylen)
|| (param_priv_key != NULL && privkeylen != ecx->keylen))
return 0;
if (param_pub_key == NULL && !ecx_public_from_private(ecx))
return 0;
ecx->haspubkey = 1;
return 1;
crypto/ec/ecx_backend.h
+3 -3
View File
@@ -13,8 +13,8 @@
: ((id) == EVP_PKEY_X448 ? X448_KEYLEN \
: ED448_KEYLEN))
#define KEYNID2TYPE(id) \
(IS25519(id) ? ECX_KEY_TYPE_X25519 \
(IS25519(id) ? ((id) == EVP_PKEY_X25519 ? ECX_KEY_TYPE_X25519 \
: ECX_KEY_TYPE_ED25519) \
: ((id) == EVP_PKEY_X448 ? ECX_KEY_TYPE_X448 \
: ((id) == EVP_PKEY_ED25519 ? ECX_KEY_TYPE_ED25519 \
: ECX_KEY_TYPE_ED448)))
: ECX_KEY_TYPE_ED448))
#define KEYLEN(p) KEYLENID((p)->ameth->pkey_id)
crypto/ec/ecx_key.c
+2 -1
View File
@@ -10,13 +10,14 @@
#include <openssl/err.h>
#include "crypto/ecx.h"
ECX_KEY *ecx_key_new(ECX_KEY_TYPE type, int haspubkey)
ECX_KEY *ecx_key_new(OPENSSL_CTX *libctx, ECX_KEY_TYPE type, int haspubkey)
{
ECX_KEY *ret = OPENSSL_zalloc(sizeof(*ret));
if (ret == NULL)
return NULL;
ret->libctx = libctx;
ret->haspubkey = haspubkey;
switch (type) {
case ECX_KEY_TYPE_X25519:
crypto/ec/ecx_meth.c
+9 -25
View File
@@ -59,7 +59,7 @@ static int ecx_key_op(EVP_PKEY *pkey, int id, const X509_ALGOR *palg,
}
}
key = ecx_key_new(KEYNID2TYPE(id), 1);
key = ecx_key_new(libctx, KEYNID2TYPE(id), 1);
if (key == NULL) {
ECerr(EC_F_ECX_KEY_OP, ERR_R_MALLOC_FAILURE);
return 0;
@@ -88,25 +88,9 @@ static int ecx_key_op(EVP_PKEY *pkey, int id, const X509_ALGOR *palg,
} else {
memcpy(privkey, p, KEYLENID(id));
}
switch (id) {
case EVP_PKEY_X25519:
X25519_public_from_private(pubkey, privkey);
break;
case EVP_PKEY_ED25519:
if (!ED25519_public_from_private(libctx, pubkey, privkey)) {
ECerr(EC_F_ECX_KEY_OP, EC_R_FAILED_MAKING_PUBLIC_KEY);
return 0;
}
break;
case EVP_PKEY_X448:
X448_public_from_private(pubkey, privkey);
break;
case EVP_PKEY_ED448:
if (!ED448_public_from_private(libctx, pubkey, privkey)) {
ECerr(EC_F_ECX_KEY_OP, EC_R_FAILED_MAKING_PUBLIC_KEY);
return 0;
}
break;
if (!ecx_public_from_private(key)) {
ECerr(EC_F_ECX_KEY_OP, EC_R_FAILED_MAKING_PUBLIC_KEY);
goto err;
}
}
@@ -455,7 +439,7 @@ static int ecx_generic_import_from(const OSSL_PARAM params[], void *vpctx,
{
EVP_PKEY_CTX *pctx = vpctx;
EVP_PKEY *pkey = EVP_PKEY_CTX_get0_pkey(pctx);
ECX_KEY *ecx = ecx_key_new(KEYNID2TYPE(keytype), 0);
ECX_KEY *ecx = ecx_key_new(pctx->libctx, KEYNID2TYPE(keytype), 0);
if (ecx == NULL) {
ERR_raise(ERR_LIB_DH, ERR_R_MALLOC_FAILURE);
@@ -963,7 +947,7 @@ static int s390x_pkey_ecx_keygen25519(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
};
ECX_KEY *key = ecx_key_new(ECX_KEY_TYPE_X25519, 1);
ECX_KEY *key = ecx_key_new(ctx->libctx, ECX_KEY_TYPE_X25519, 1);
unsigned char *privkey = NULL, *pubkey;
if (key == NULL) {
@@ -1005,7 +989,7 @@ static int s390x_pkey_ecx_keygen448(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
};
ECX_KEY *key = ecx_key_new(ECX_KEY_TYPE_X448, 1);
ECX_KEY *key = ecx_key_new(ctx->libctx, ECX_KEY_TYPE_X448, 1);
unsigned char *privkey = NULL, *pubkey;
if (key == NULL) {
@@ -1050,7 +1034,7 @@ static int s390x_pkey_ecd_keygen25519(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
};
unsigned char x_dst[32], buff[SHA512_DIGEST_LENGTH];
ECX_KEY *key = ecx_key_new(ECX_KEY_TYPE_ED25519, 1);
ECX_KEY *key = ecx_key_new(ctx->libctx, ECX_KEY_TYPE_ED25519, 1);
unsigned char *privkey = NULL, *pubkey;
unsigned int sz;
@@ -1107,7 +1091,7 @@ static int s390x_pkey_ecd_keygen448(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
0x24, 0xbc, 0xb6, 0x6e, 0x71, 0x46, 0x3f, 0x69, 0x00
};
unsigned char x_dst[57], buff[114];
ECX_KEY *key = ecx_key_new(ECX_KEY_TYPE_ED448, 1);
ECX_KEY *key = ecx_key_new(ctx->libctx, ECX_KEY_TYPE_ED448, 1);
unsigned char *privkey = NULL, *pubkey;
EVP_MD_CTX *hashctx = NULL;
crypto/engine/eng_cnf.c
+3 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2002-2016 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2002-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -11,6 +11,8 @@
#include <openssl/conf.h>
#include <openssl/trace.h>
DEFINE_STACK_OF(CONF_VALUE)
/* ENGINE config module */
static const char *skip_dot(const char *name)
crypto/engine/eng_dyn.c
+3 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2001-2016 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2001-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -17,6 +17,8 @@
* prototypes.
*/
DEFINE_STACK_OF_STRING()
/* Our ENGINE handlers */
static int dynamic_init(ENGINE *e);
static int dynamic_finish(ENGINE *e);
crypto/err/openssl.txt
+10 -5
View File
@@ -696,6 +696,7 @@ EC_F_EC_POINT_INVERT:210:EC_POINT_invert
EC_F_EC_POINT_IS_AT_INFINITY:118:EC_POINT_is_at_infinity
EC_F_EC_POINT_IS_ON_CURVE:119:EC_POINT_is_on_curve
EC_F_EC_POINT_MAKE_AFFINE:120:EC_POINT_make_affine
EC_F_EC_POINT_MUL:309:
EC_F_EC_POINT_NEW:121:EC_POINT_new
EC_F_EC_POINT_OCT2POINT:122:EC_POINT_oct2point
EC_F_EC_POINT_POINT2BUF:281:EC_POINT_point2buf
@@ -948,6 +949,7 @@ OCSP_F_OCSP_MATCH_ISSUERID:109:ocsp_match_issuerid
OCSP_F_OCSP_REQUEST_SIGN:110:OCSP_request_sign
OCSP_F_OCSP_REQUEST_VERIFY:116:OCSP_request_verify
OCSP_F_OCSP_RESPONSE_GET1_BASIC:111:OCSP_response_get1_basic
OSSL_STORE_F_FILE_ATTACH:128:
OSSL_STORE_F_FILE_CTRL:129:file_ctrl
OSSL_STORE_F_FILE_FIND:138:file_find
OSSL_STORE_F_FILE_GET_PASS:118:file_get_pass
@@ -955,10 +957,8 @@ OSSL_STORE_F_FILE_LOAD:119:file_load
OSSL_STORE_F_FILE_LOAD_TRY_DECODE:124:file_load_try_decode
OSSL_STORE_F_FILE_NAME_TO_URI:126:file_name_to_uri
OSSL_STORE_F_FILE_OPEN:120:file_open
OSSL_STORE_F_OSSL_STORE_ATTACH_PEM_BIO:127:ossl_store_attach_pem_bio
OSSL_STORE_F_OSSL_STORE_ATTACH:127:
OSSL_STORE_F_OSSL_STORE_EXPECT:130:OSSL_STORE_expect
OSSL_STORE_F_OSSL_STORE_FILE_ATTACH_PEM_BIO_INT:128:\
ossl_store_file_attach_pem_bio_int
OSSL_STORE_F_OSSL_STORE_FIND:131:OSSL_STORE_find
OSSL_STORE_F_OSSL_STORE_GET0_LOADER_INT:100:ossl_store_get0_loader_int
OSSL_STORE_F_OSSL_STORE_INFO_GET1_CERT:101:OSSL_STORE_INFO_get1_CERT
@@ -1001,17 +1001,17 @@ PEM_F_D2I_PKCS8PRIVATEKEY_BIO:120:d2i_PKCS8PrivateKey_bio
PEM_F_D2I_PKCS8PRIVATEKEY_FP:121:d2i_PKCS8PrivateKey_fp
PEM_F_DO_B2I:132:do_b2i
PEM_F_DO_B2I_BIO:133:do_b2i_bio
PEM_F_DO_BLOB_HEADER:134:do_blob_header
PEM_F_DO_I2B:146:do_i2b
PEM_F_DO_PK8PKEY:126:do_pk8pkey
PEM_F_DO_PK8PKEY_FP:125:do_pk8pkey_fp
PEM_F_DO_PVK_BODY:135:do_PVK_body
PEM_F_DO_PVK_HEADER:136:do_PVK_header
PEM_F_GET_HEADER_AND_DATA:143:get_header_and_data
PEM_F_GET_NAME:144:get_name
PEM_F_I2B_PVK:137:i2b_PVK
PEM_F_I2B_PVK_BIO:138:i2b_PVK_bio
PEM_F_LOAD_IV:101:load_iv
PEM_F_OSSL_DO_BLOB_HEADER:134:ossl_do_blob_header
PEM_F_OSSL_DO_PVK_HEADER:136:ossl_do_PVK_header
PEM_F_PEM_ASN1_READ:102:PEM_ASN1_read
PEM_F_PEM_ASN1_READ_BIO:103:PEM_ASN1_read_bio
PEM_F_PEM_ASN1_WRITE:104:PEM_ASN1_write
@@ -2559,6 +2559,7 @@ EVP_R_NO_KEYMGMT_AVAILABLE:199:no keymgmt available
EVP_R_NO_KEYMGMT_PRESENT:196:no keymgmt present
EVP_R_NO_KEY_SET:154:no key set
EVP_R_NO_OPERATION_SET:149:no operation set
EVP_R_NULL_MAC_PKEY_CTX:208:null mac pkey ctx
EVP_R_ONLY_ONESHOT_SUPPORTED:177:only oneshot supported
EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE:150:\
operation not supported for this keytype
@@ -2571,6 +2572,7 @@ EVP_R_PKEY_APPLICATION_ASN1_METHOD_ALREADY_REGISTERED:179:\
EVP_R_PRIVATE_KEY_DECODE_ERROR:145:private key decode error
EVP_R_PRIVATE_KEY_ENCODE_ERROR:146:private key encode error
EVP_R_PUBLIC_KEY_NOT_RSA:106:public key not rsa
EVP_R_SET_DEFAULT_PROPERTY_FAILURE:209:set default property failure
EVP_R_TOO_MANY_RECORDS:183:too many records
EVP_R_UNKNOWN_CIPHER:160:unknown cipher
EVP_R_UNKNOWN_DIGEST:161:unknown digest
@@ -2841,6 +2843,7 @@ PROV_R_INVALID_PADDING_MODE:168:invalid padding mode
PROV_R_INVALID_PSS_SALTLEN:169:invalid pss saltlen
PROV_R_INVALID_SALT_LENGTH:112:invalid salt length
PROV_R_INVALID_SEED_LENGTH:154:invalid seed length
PROV_R_INVALID_SIGNATURE_SIZE:179:invalid signature size
PROV_R_INVALID_TAG:110:invalid tag
PROV_R_INVALID_TAGLEN:118:invalid taglen
PROV_R_INVALID_X931_DIGEST:170:invalid x931 digest
@@ -2862,6 +2865,8 @@ PROV_R_NOT_SUPPORTED:136:not supported
PROV_R_NOT_XOF_OR_INVALID_LENGTH:113:not xof or invalid length
PROV_R_NO_KEY_SET:114:no key set
PROV_R_NO_PARAMETERS_SET:177:no parameters set
PROV_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE:178:\
operation not supported for this keytype
PROV_R_OUTPUT_BUFFER_TOO_SMALL:106:output buffer too small
PROV_R_PSS_SALTLEN_TOO_SMALL:172:pss saltlen too small
PROV_R_READ_KEY:159:read key
crypto/ess/ess_lib.c
+5
View File
@@ -13,6 +13,11 @@
#include <openssl/ess.h>
#include "crypto/ess.h"
DEFINE_STACK_OF(ESS_CERT_ID)
DEFINE_STACK_OF(ESS_CERT_ID_V2)
DEFINE_STACK_OF(X509)
DEFINE_STACK_OF(GENERAL_NAME)
static ESS_CERT_ID *ESS_CERT_ID_new_init(X509 *cert, int issuer_needed);
static ESS_CERT_ID_V2 *ESS_CERT_ID_V2_new_init(const EVP_MD *hash_alg,
X509 *cert, int issuer_needed);
crypto/evp/digest.c
+14 -14
View File
@@ -24,7 +24,7 @@ int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)
if (ctx == NULL)
return 1;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* TODO(3.0): Temporarily no support for EVP_DigestSign* in FIPS module */
/*
* pctx should be freed by the user of EVP_MD_CTX
@@ -59,7 +59,7 @@ int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)
OPENSSL_clear_free(ctx->md_data, ctx->digest->ctx_size);
}
#if !defined(FIPS_MODE) && !defined(OPENSSL_NO_ENGINE)
#if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_ENGINE)
ENGINE_finish(ctx->engine);
#endif
@@ -94,7 +94,7 @@ int EVP_DigestInit(EVP_MD_CTX *ctx, const EVP_MD *type)
int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
{
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
ENGINE *tmpimpl = NULL;
#endif
@@ -114,7 +114,7 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
ctx->reqdigest = type;
/* TODO(3.0): Legacy work around code below. Remove this */
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
/*
* Whether it's nice or not, "Inits" can be used on "Final"'d contexts so
* this context may already have an ENGINE! Try to avoid releasing the
@@ -145,7 +145,7 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
*/
if (ctx->engine != NULL
|| impl != NULL
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
|| tmpimpl != NULL
#endif
|| (ctx->flags & EVP_MD_CTX_FLAG_NO_INIT) != 0) {
@@ -164,7 +164,7 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
/* TODO(3.0): Start of non-legacy code below */
if (type->prov == NULL) {
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
/* We only do explicit fetches inside the FIPS module */
EVPerr(EVP_F_EVP_DIGESTINIT_EX, EVP_R_INITIALIZATION_ERROR);
return 0;
@@ -205,7 +205,7 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
/* TODO(3.0): Remove legacy code below */
legacy:
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
if (type) {
if (impl != NULL) {
if (!ENGINE_init(impl)) {
@@ -257,10 +257,10 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
}
}
}
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
skip_to_init:
#endif
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/*
* TODO(3.0): Temporarily no support for EVP_DigestSign* inside FIPS module
* or when using providers.
@@ -452,7 +452,7 @@ int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in)
/* copied EVP_MD_CTX should free the copied EVP_PKEY_CTX */
EVP_MD_CTX_clear_flags(out, EVP_MD_CTX_FLAG_KEEP_PKEY_CTX);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* TODO(3.0): Temporarily no support for EVP_DigestSign* in FIPS module */
if (in->pctx != NULL) {
out->pctx = EVP_PKEY_CTX_dup(in->pctx);
@@ -468,7 +468,7 @@ int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in)
/* TODO(3.0): Remove legacy code below */
legacy:
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
/* Make sure it's safe to copy a digest context using an ENGINE */
if (in->engine && !ENGINE_init(in->engine)) {
EVPerr(EVP_F_EVP_MD_CTX_COPY_EX, ERR_R_ENGINE_LIB);
@@ -509,7 +509,7 @@ int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in)
out->update = in->update;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* TODO(3.0): Temporarily no support for EVP_DigestSign* in FIPS module */
if (in->pctx) {
out->pctx = EVP_PKEY_CTX_dup(in->pctx);
@@ -724,7 +724,7 @@ EVP_MD *evp_md_new(void)
* provider based, we know that none of its code depends on legacy
* NIDs or any functionality that use them.
*/
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* TODO(3.x) get rid of the need for legacy NIDs */
static void set_legacy_nid(const char *name, void *vlegacy_nid)
{
@@ -764,7 +764,7 @@ static void *evp_md_from_dispatch(int name_id,
return NULL;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* TODO(3.x) get rid of the need for legacy NIDs */
md->type = NID_undef;
evp_names_do_all(prov, name_id, set_legacy_nid, &md->type);
crypto/evp/e_aes.c
+5 -5
View File
@@ -71,7 +71,7 @@ typedef struct {
const unsigned char iv[16]);
} EVP_AES_XTS_CTX;
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
static const int allow_insecure_decrypt = 0;
#else
static const int allow_insecure_decrypt = 1;
@@ -2901,7 +2901,7 @@ static int aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
return rv;
}
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
/*
* See SP800-38D (GCM) Section 8 "Uniqueness requirement on IVS and keys"
*
@@ -2923,7 +2923,7 @@ static int aes_gcm_iv_generate(EVP_AES_GCM_CTX *gctx, int offset)
return 0;
return 1;
}
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
static int aes_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
const unsigned char *in, size_t len)
@@ -2937,7 +2937,7 @@ static int aes_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
if (gctx->tls_aad_len >= 0)
return aes_gcm_tls_cipher(ctx, out, in, len);
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
/*
* FIPS requires generation of AES-GCM IV's inside the FIPS module.
* The IV can still be set externally (the security policy will state that
@@ -2954,7 +2954,7 @@ static int aes_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
#else
if (!gctx->iv_set)
return -1;
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
if (in) {
if (out == NULL) {
crypto/evp/evp_cnf.c
+12 -8
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2012-2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2012-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -15,9 +15,10 @@
#include <openssl/x509v3.h>
#include <openssl/trace.h>
DEFINE_STACK_OF(CONF_VALUE)
/* Algorithm configuration module. */
/* TODO(3.0): the config module functions should be passed a library context */
static int alg_module_init(CONF_IMODULE *md, const CONF *cnf)
{
int i;
@@ -44,14 +45,17 @@ static int alg_module_init(CONF_IMODULE *md, const CONF *cnf)
}
/*
* fips_mode is deprecated and should not be used in new
* configurations. Old configurations are likely to ONLY
* have this, so we assume that no default properties have
* been set before this.
* configurations.
*/
if (m > 0)
EVP_set_default_properties(NULL, "fips=yes");
if (!EVP_default_properties_enable_fips(cnf->libctx, m > 0)) {
EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_SET_DEFAULT_PROPERTY_FAILURE);
return 0;
}
} else if (strcmp(oval->name, "default_properties") == 0) {
EVP_set_default_properties(NULL, oval->value);
if (!EVP_set_default_properties(cnf->libctx, oval->value)) {
EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_SET_DEFAULT_PROPERTY_FAILURE);
return 0;
}
} else {
EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_UNKNOWN_OPTION);
ERR_add_error_data(4, "name=", oval->name,
crypto/evp/evp_enc.c
+12 -12
View File
@@ -51,7 +51,7 @@ int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *ctx)
OPENSSL_cleanse(ctx->cipher_data, ctx->cipher->ctx_size);
}
OPENSSL_free(ctx->cipher_data);
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
ENGINE_finish(ctx->engine);
#endif
memset(ctx, 0, sizeof(*ctx));
@@ -81,7 +81,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
ENGINE *impl, const unsigned char *key,
const unsigned char *iv, int enc)
{
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
ENGINE *tmpimpl = NULL;
#endif
const EVP_CIPHER *tmpcipher;
@@ -106,7 +106,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
/* TODO(3.0): Legacy work around code below. Remove this */
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
/*
* Whether it's nice or not, "Inits" can be used on "Final"'d contexts so
* this context may already have an ENGINE! Try to avoid releasing the
@@ -127,7 +127,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
* If there are engines involved then we should use legacy handling for now.
*/
if (ctx->engine != NULL
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
|| tmpimpl != NULL
#endif
|| impl != NULL) {
@@ -321,7 +321,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
cipher = ctx->cipher;
if (cipher->prov == NULL) {
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
/* We only do explicit fetches inside the FIPS module */
EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_INITIALIZATION_ERROR);
return 0;
@@ -404,7 +404,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
ctx->encrypt = enc;
ctx->flags = flags;
}
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
if (impl != NULL) {
if (!ENGINE_init(impl)) {
EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_INITIALIZATION_ERROR);
@@ -460,7 +460,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
}
}
}
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
skip_to_init:
#endif
if (ctx->cipher == NULL)
@@ -1340,7 +1340,7 @@ int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key)
if (ctx->cipher->flags & EVP_CIPH_RAND_KEY)
return EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_RAND_KEY, 0, key);
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
return 0;
#else
{
@@ -1351,7 +1351,7 @@ int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key)
return 0;
return 1;
}
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
}
int EVP_CIPHER_CTX_copy(EVP_CIPHER_CTX *out, const EVP_CIPHER_CTX *in)
@@ -1390,7 +1390,7 @@ int EVP_CIPHER_CTX_copy(EVP_CIPHER_CTX *out, const EVP_CIPHER_CTX *in)
/* TODO(3.0): Remove legacy code below */
legacy:
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
/* Make sure it's safe to copy a cipher context using an ENGINE */
if (in->engine && !ENGINE_init(in->engine)) {
EVPerr(EVP_F_EVP_CIPHER_CTX_COPY, ERR_R_ENGINE_LIB);
@@ -1440,7 +1440,7 @@ EVP_CIPHER *evp_cipher_new(void)
* provider based, we know that none of its code depends on legacy
* NIDs or any functionality that use them.
*/
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* TODO(3.x) get rid of the need for legacy NIDs */
static void set_legacy_nid(const char *name, void *vlegacy_nid)
{
@@ -1478,7 +1478,7 @@ static void *evp_cipher_from_dispatch(const int name_id,
return NULL;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* TODO(3.x) get rid of the need for legacy NIDs */
cipher->nid = NID_undef;
evp_names_do_all(prov, name_id, set_legacy_nid, &cipher->nid);
crypto/evp/evp_err.c
+3
View File
@@ -114,6 +114,7 @@ static const ERR_STRING_DATA EVP_str_reasons[] = {
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_NO_KEYMGMT_PRESENT), "no keymgmt present"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_NO_KEY_SET), "no key set"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_NO_OPERATION_SET), "no operation set"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_NULL_MAC_PKEY_CTX), "null mac pkey ctx"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_ONLY_ONESHOT_SUPPORTED),
"only oneshot supported"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE),
@@ -132,6 +133,8 @@ static const ERR_STRING_DATA EVP_str_reasons[] = {
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_PRIVATE_KEY_ENCODE_ERROR),
"private key encode error"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_PUBLIC_KEY_NOT_RSA), "public key not rsa"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_SET_DEFAULT_PROPERTY_FAILURE),
"set default property failure"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_TOO_MANY_RECORDS), "too many records"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_UNKNOWN_CIPHER), "unknown cipher"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_UNKNOWN_DIGEST), "unknown digest"},
crypto/evp/evp_fetch.c
+35 -3
View File
@@ -301,7 +301,7 @@ void *evp_generic_fetch(OPENSSL_CTX *libctx, int operation_id,
if (ret == NULL) {
int code = EVP_R_FETCH_FAILED;
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
ERR_raise(ERR_LIB_EVP, code);
#else
ERR_raise_data(ERR_LIB_EVP, code,
@@ -339,7 +339,7 @@ void *evp_generic_fetch_by_number(OPENSSL_CTX *libctx, int operation_id,
if (ret == NULL) {
int code = EVP_R_FETCH_FAILED;
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
ERR_raise(ERR_LIB_EVP, code);
#else
{
@@ -367,10 +367,42 @@ int EVP_set_default_properties(OPENSSL_CTX *libctx, const char *propq)
if (store != NULL)
return ossl_method_store_set_global_properties(store, propq);
EVPerr(EVP_F_EVP_SET_DEFAULT_PROPERTIES, ERR_R_INTERNAL_ERROR);
EVPerr(0, ERR_R_INTERNAL_ERROR);
return 0;
}
static int evp_default_properties_merge(OPENSSL_CTX *libctx, const char *propq)
{
OSSL_METHOD_STORE *store = get_evp_method_store(libctx);
if (store != NULL)
return ossl_method_store_merge_global_properties(store, propq);
EVPerr(0, ERR_R_INTERNAL_ERROR);
return 0;
}
static int evp_default_property_is_enabled(OPENSSL_CTX *libctx,
const char *prop_name)
{
OSSL_METHOD_STORE *store = get_evp_method_store(libctx);
return ossl_method_store_global_property_is_enabled(store, prop_name);
}
int EVP_default_properties_is_fips_enabled(OPENSSL_CTX *libctx)
{
return evp_default_property_is_enabled(libctx, "fips");
}
int EVP_default_properties_enable_fips(OPENSSL_CTX *libctx, int enable)
{
const char *query = (enable != 0) ? "fips=yes" : "-fips";
return evp_default_properties_merge(libctx, query);
}
struct do_all_data_st {
void (*user_fn)(void *method, void *arg);
void *user_arg;
crypto/evp/evp_lib.c
+7 -7
View File
@@ -18,7 +18,7 @@
#include "internal/provider.h"
#include "evp_local.h"
#if !defined(FIPS_MODE)
#if !defined(FIPS_MODULE)
int EVP_CIPHER_param_to_asn1(EVP_CIPHER_CTX *c, ASN1_TYPE *type)
{
int ret = -1; /* Assume the worst */
@@ -206,7 +206,7 @@ int EVP_CIPHER_set_asn1_iv(EVP_CIPHER_CTX *c, ASN1_TYPE *type)
}
return i;
}
#endif /* !defined(FIPS_MODE) */
#endif /* !defined(FIPS_MODULE) */
/* Convert the various cipher NIDs and dummies to a proper OID NID */
int EVP_CIPHER_type(const EVP_CIPHER *ctx)
@@ -258,7 +258,7 @@ int EVP_CIPHER_type(const EVP_CIPHER *ctx)
return NID_des_cfb64;
default:
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
return NID_undef;
#else
{
@@ -548,7 +548,7 @@ const char *EVP_CIPHER_name(const EVP_CIPHER *cipher)
{
if (cipher->prov != NULL)
return evp_first_name(cipher->prov, cipher->name_id);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
return OBJ_nid2sn(EVP_CIPHER_nid(cipher));
#else
return NULL;
@@ -589,7 +589,7 @@ const char *EVP_MD_name(const EVP_MD *md)
{
if (md->prov != NULL)
return evp_first_name(md->prov, md->name_id);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
return OBJ_nid2sn(EVP_MD_nid(md));
#else
return NULL;
@@ -844,7 +844,7 @@ EVP_PKEY_CTX *EVP_MD_CTX_pkey_ctx(const EVP_MD_CTX *ctx)
return ctx->pctx;
}
#if !defined(FIPS_MODE)
#if !defined(FIPS_MODULE)
/* TODO(3.0): EVP_DigestSign* not yet supported in FIPS module */
void EVP_MD_CTX_set_pkey_ctx(EVP_MD_CTX *ctx, EVP_PKEY_CTX *pctx)
{
@@ -864,7 +864,7 @@ void EVP_MD_CTX_set_pkey_ctx(EVP_MD_CTX *ctx, EVP_PKEY_CTX *pctx)
EVP_MD_CTX_clear_flags(ctx, EVP_MD_CTX_FLAG_KEEP_PKEY_CTX);
}
}
#endif /* !defined(FIPS_MODE) */
#endif /* !defined(FIPS_MODULE) */
void *EVP_MD_CTX_md_data(const EVP_MD_CTX *ctx)
{

Some files were not shown because too many files have changed in this diff Show More