Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update

Browse Source
This commit is contained in:
Hakase
2019-04-01 00:21:15 +09:00
parent c03e0c45f8
commit 48ec086472
209 changed files with 7552 additions and 2495 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/man3/BN_CTX_start.pod
+1
View File
@@ -27,6 +27,7 @@ calls must be made before calling any other functions that use the
B<ctx> as an argument.
Finally, BN_CTX_end() must be called before returning from the function.
If B<ctx> is NULL, nothing is done.
When BN_CTX_end() is called, the B<BIGNUM> pointers obtained from
BN_CTX_get() become invalid.
doc/man3/BN_new.pod
+1
View File
@@ -27,6 +27,7 @@ OPENSSL_secure_malloc(3) is used to store the value.
BN_clear() is used to destroy sensitive data such as keys when they
are no longer needed. It erases the memory used by B<a> and sets it
to the value 0.
If B<a> is NULL, nothing is done.
BN_free() frees the components of the B<BIGNUM>, and if it was created
by BN_new(), also the structure itself. BN_clear_free() additionally
doc/man3/EVP_KDF_CTX.pod
+33 -1
View File
@@ -135,6 +135,17 @@ EVP_KDF_ctrl_str() type string: "iter"
The value string is expected to be a decimal number.
=item B<EVP_KDF_CTRL_SET_MAC>
This control expects one argument: C<EVP_MAC *mac>
Some KDF implementations use a MAC as an underlying computation
algorithm, this control sets what the MAC algorithm should be.
EVP_KDF_ctrl_str() type string: "mac"
The value string is expected to be the name of a MAC.
=item B<EVP_KDF_CTRL_SET_MD>
This control expects one argument: C<EVP_MD *md>
@@ -168,6 +179,19 @@ decoded before being passed on as the control value.
=back
=item B<EVP_KDF_CTRL_SET_MAC_SIZE>
This control expects one argument: C<size_t size>
Used by implementations that use a MAC with a variable output size (KMAC). For
those KDF implementations that support it, this control sets the MAC output size.
The default value, if any, is implementation dependent.
EVP_KDF_ctrl_str() type string: "outlen"
The value string is expected to be a decimal number.
=item B<EVP_KDF_CTRL_SET_MAXMEM_BYTES>
This control expects one argument: C<uint64_t maxmem_bytes>
@@ -204,10 +228,18 @@ supported by the KDF algorithm.
=head1 SEE ALSO
L<EVP_KDF_SCRYPT(7)>
L<EVP_KDF_TLS1_PRF(7)>
L<EVP_KDF_PBKDF2(7)>
L<EVP_KDF_HKDF(7)>
L<EVP_KDF_SS(7)>
=head1 HISTORY
This functionality was added to OpenSSL 3.0.0.
=head1 COPYRIGHT
Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EVP_MAC.pod
+3
View File
@@ -202,6 +202,9 @@ For MAC implementations that use an underlying computation algorithm,
these controls set what the algorithm should be, and the engine that
implements the algorithm if needed.
Note that not all algorithms may support all digests. HMAC does not support
variable output length digests such as SHAKE128 or SHAKE256.
B<EVP_MAC_CTRL_SET_ENGINE> takes one argument: C<ENGINE *>
B<EVP_MAC_CTRL_SET_MD> takes one argument: C<EVP_MD *>
doc/man3/EVP_MD_fetch.pod
+162
View File
@@ -0,0 +1,162 @@
=pod
=head1 NAME
EVP_MD_fetch
- Functions to explicitly fetch algorithm implementations
=head1 SYNOPSIS
#include <openssl/evp.h>
EVP_MD *EVP_MD_fetch(OPENSSL_CTX *ctx, const char *algorithm,
const char *properties);
=head1 DESCRIPTION
The B<EVP_MD> object is used for representing a digest method implementation.
Having obtained a digest implementation as an B<EVP_MD> type it can be used to
calculate the digest of input data using functions such as
L<EVP_DigestInit_ex(3)>, L<EVP_DigestUpdate(3)> and L<EVP_DigestFinal_ex(3)>.
Digest implementations may be obtained in one of three ways, i.e. implicit
lookup, explicit lookup or user defined.
=over 4
=item Implicit Lookup
With implicit lookup an application can use functions such as L<EVP_sha256(3)>,
L<EVP_sha512(3)> or L<EVP_blake2b512(3)> to obtain an B<EVP_MD> object. When
used in a function like L<EVP_DigestInit_ex(3)> the actual implementation to
be used will be fetched implicitly using default search criteria. Typically,
(unless the default search criteria have been changed and/or different providers
have been loaded), this will return an implementation of the appropriate
algorithm from the default provider.
=item Explicit Lookup
With explicit lookup an application uses the EVP_MD_fetch() function to obtain
an algorithm implementation. An implementation with the given name and
satisfying the search criteria specified in the B<properties> parameter will be
looked for within the available providers and returned. See L<OSSL_PROVIDER(3)>
for information about providers.
=item User defined
Using the user defined approach an application constructs its own EVP_MD object.
See L<EVP_MD_meth_new(3)> for details.
=back
The EVP_MD_fetch() function will look for an algorithm within the providers that
have been loaded into the B<OPENSSL_CTX> given in the B<ctx> parameter. This
parameter may be NULL in which case the default B<OPENSSL_CTX> will be used. See
L<OPENSSL_CTX_new(3)> and L<OSSL_PROVIDER_load(3)> for further details.
The B<algorithm> parameter gives the name of the algorithm to be looked up.
Different algorithms can be made available by loading different providers. The
built-in default provider algorithm implementation names are: SHA1, SHA224,
SHA256, SHA384, SHA512, SHA512-224, SHA512-256,SHA3-224, SHA3-256, SHA3-384,
SHA3-512, SHAKE128, SHAKE256, SM3, BLAKE2b512, BLAKE2s256 and MD5-SHA1.
Additional algorithm implementations may be obtained by loading the "legacy"
provider. The names of these algorithms are: RIPEMD160, MD2, MD4, MD5, MDC2 and
whirlpool.
The B<properties> parameter specifies the search criteria that will be used to
look for an algorithm implementation. Properties are given as a comma delimited
string of name value pairs. In order for an implementation to match, all the
properties in the query string must match those defined for that implementation.
Any properties defined by an implementation but not given in the query string
are ignored. All algorithm implementations in the default provider have the
property "default=yes". All algorithm implementations in the legacy provider have
the property "legacy=yes". All algorithm implementations in the FIPS provider
have the property "fips=yes". In the event that more than one implementation
of the given algorithm name matches the specified properties then an unspecified
one of those implementations may be returned. The B<properties> parameter may be
NULL in which case any implementation from the available providers with the
given algorithm name will be returned.
The return value from a call to EVP_MD_fetch() must be freed by the caller using
L<EVP_MD_meth_free(3)>. Note that EVP_MD objects are reference counted. See
L<EVP_MD_upref(3)>.
=head1 RETURN VALUES
EVP_MD_fetch() returns a pointer to the algorithm implementation represented by
an EVP_MD object, or NULL on error.
=head1 EXAMPLES
Fetch any available implementation of SHA256 in the default context:
EVP_MD *md = EVP_MD_fetch(NULL, "SHA256", NULL);
Fetch an implementation of SHA256 from the default provider in the default
context:
EVP_MD *md = EVP_MD_fetch(NULL, "SHA256", "default=yes");
...
EVP_MD_meth_free(md);
Fetch an implementation of SHA256 that is not from the default provider in the
default context:
EVP_MD *md = EVP_MD_fetch(NULL, "SHA256", "default=no");
...
EVP_MD_meth_free(md);
Fetch an implementation of SHA256 from the default provider in the specified
context:
EVP_MD *md = EVP_MD_fetch(ctx, "SHA256", "default=yes");
...
EVP_MD_meth_free(md);
Load the legacy provider into the default context and then fetch an
implementation of whirlpool from it:
/* This only needs to be done once - usually at application start up */
OSSL_PROVIDER *legacy = OSSL_PROVIDER_load(NULL, "legacy");
EVP_MD *md = EVP_MD_fetch(NULL, "whirlpool", "legacy=yes");
...
EVP_MD_meth_free(md);
Note that in the above example the property string "legacy=yes" is optional
since, assuming no other providers have been loaded, the only implmentation of
the "whirlpool" algorithm is in the "legacy" provider. Also note that the
default provider should be explicitly loaded if it is required in addition to
other providers:
/* This only needs to be done once - usually at application start up */
OSSL_PROVIDER *legacy = OSSL_PROVIDER_load(NULL, "legacy");
OSSL_PROVIDER *default = OSSL_PROVIDER_load(NULL, "default");
EVP_MD *md_whirlpool = EVP_MD_fetch(NULL, "whirlpool", NULL);
EVP_MD *md_sha256 = EVP_MD_fetch(NULL, "SHA256", NULL);
...
EVP_MD_meth_free(md_whirlpool);
EVP_MD_meth_free(md_sha256);
=head1 SEE ALSO
L<EVP_DigestInit(3)>, L<EVP_MD_meth_new(3)>, L<EVP_MD_meth_free(3)>,
L<EVP_MD_upref(3)>, L<OSSL_PROVIDER_load(3)>, L<OPENSSL_CTX(3)>
=head1 HISTORY
The functions described here were added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man3/EVP_MD_meth_new.pod
+13 -4
View File
@@ -11,7 +11,7 @@ EVP_MD_meth_set_ctrl, EVP_MD_meth_get_input_blocksize,
EVP_MD_meth_get_result_size, EVP_MD_meth_get_app_datasize,
EVP_MD_meth_get_flags, EVP_MD_meth_get_init, EVP_MD_meth_get_update,
EVP_MD_meth_get_final, EVP_MD_meth_get_copy, EVP_MD_meth_get_cleanup,
EVP_MD_meth_get_ctrl
EVP_MD_meth_get_ctrl, EVP_MD_upref
- Routines to build up EVP_MD methods
=head1 SYNOPSIS
@@ -54,17 +54,21 @@ EVP_MD_meth_get_ctrl
int (*EVP_MD_meth_get_ctrl(const EVP_MD *md))(EVP_MD_CTX *ctx, int cmd,
int p1, void *p2);
int EVP_MD_upref(EVP_MD *md);
=head1 DESCRIPTION
The B<EVP_MD> type is a structure for digest method implementation.
It can also have associated public/private key signing and verifying
routines.
EVP_MD_meth_new() creates a new B<EVP_MD> structure.
EVP_MD_meth_new() creates a new B<EVP_MD> structure. Note that B<EVP_MD>
structures are reference counted.
EVP_MD_meth_dup() creates a copy of B<md>.
EVP_MD_meth_free() destroys a B<EVP_MD> structure.
EVP_MD_meth_free() decrements the reference count for the B<EVP_MD> structure.
If the reference count drops to 0 then the structure is freed.
EVP_MD_meth_set_input_blocksize() sets the internal input block size
for the method B<md> to B<blocksize> bytes.
@@ -158,6 +162,8 @@ EVP_MD_meth_get_cleanup() and EVP_MD_meth_get_ctrl() are all used
to retrieve the method data given with the EVP_MD_meth_set_*()
functions above.
EVP_MD_upref() increments the reference count for an EVP_MD structure.
=head1 RETURN VALUES
EVP_MD_meth_new() and EVP_MD_meth_dup() return a pointer to a newly
@@ -169,6 +175,8 @@ indicated sizes or flags.
All other EVP_CIPHER_meth_get_*() functions return pointers to their
respective B<md> function.
EVP_MD_upref() returns 1 for success or 0 otherwise.
=head1 SEE ALSO
L<EVP_DigestInit(3)>, L<EVP_SignInit(3)>, L<EVP_VerifyInit(3)>
@@ -176,7 +184,8 @@ L<EVP_DigestInit(3)>, L<EVP_SignInit(3)>, L<EVP_VerifyInit(3)>
=head1 HISTORY
The B<EVP_MD> structure was openly available in OpenSSL before version
1.1. The functions described here were added in OpenSSL 1.1.
1.1. EVP_MD_upref() was added in OpenSSL 3.0. All other functions described
here were added in OpenSSL 1.1.
=head1 COPYRIGHT
doc/man3/EVP_PKEY_set1_RSA.pod
+4 -1
View File
@@ -9,7 +9,7 @@ EVP_PKEY_assign_RSA, EVP_PKEY_assign_DSA, EVP_PKEY_assign_DH,
EVP_PKEY_assign_EC_KEY, EVP_PKEY_assign_POLY1305, EVP_PKEY_assign_SIPHASH,
EVP_PKEY_get0_hmac, EVP_PKEY_get0_poly1305, EVP_PKEY_get0_siphash,
EVP_PKEY_type, EVP_PKEY_id, EVP_PKEY_base_id, EVP_PKEY_set_alias_type,
EVP_PKEY_set1_engine - EVP_PKEY assignment functions
EVP_PKEY_set1_engine, EVP_PKEY_get0_engine - EVP_PKEY assignment functions
=head1 SYNOPSIS
@@ -45,6 +45,7 @@ EVP_PKEY_set1_engine - EVP_PKEY assignment functions
int EVP_PKEY_type(int type);
int EVP_PKEY_set_alias_type(EVP_PKEY *pkey, int type);
ENGINE *EVP_PKEY_get0_engine(const EVP_PKEY *pkey);
int EVP_PKEY_set1_engine(EVP_PKEY *pkey, ENGINE *engine);
=head1 DESCRIPTION
@@ -81,6 +82,8 @@ often seen in practice.
EVP_PKEY_type() returns the underlying type of the NID B<type>. For example
EVP_PKEY_type(EVP_PKEY_RSA2) will return B<EVP_PKEY_RSA>.
EVP_PKEY_get0_engine() returns a reference to the ENGINE handling B<pkey>.
EVP_PKEY_set1_engine() sets the ENGINE handling B<pkey> to B<engine>. It
must be called after the key algorithm and components are set up.
If B<engine> does not include an B<EVP_PKEY_METHOD> for B<pkey> an
doc/man3/HMAC.pod
+3 -1
View File
@@ -63,7 +63,9 @@ If B<md> is NULL, the digest is placed in a static array. The size of
the output is placed in B<md_len>, unless it is B<NULL>. Note: passing a NULL
value for B<md> to use the static array is not thread safe.
B<evp_md> can be EVP_sha1(), EVP_ripemd160() etc.
B<evp_md> is a message digest such as EVP_sha1(), EVP_ripemd160() etc. HMAC does
not support variable output length digests such as EVP_shake128() and
EVP_shake256().
HMAC_CTX_new() creates a new HMAC_CTX in heap memory.
doc/man3/OCSP_cert_to_id.pod
+2 -2
View File
@@ -19,8 +19,8 @@ OCSP_id_cmp, OCSP_id_get0_info - OCSP certificate ID utility functions
void OCSP_CERTID_free(OCSP_CERTID *id);
int OCSP_id_issuer_cmp(OCSP_CERTID *a, OCSP_CERTID *b);
int OCSP_id_cmp(OCSP_CERTID *a, OCSP_CERTID *b);
int OCSP_id_issuer_cmp(const OCSP_CERTID *a, const OCSP_CERTID *b);
int OCSP_id_cmp(const OCSP_CERTID *a, const OCSP_CERTID *b);
int OCSP_id_get0_info(ASN1_OCTET_STRING **piNameHash, ASN1_OBJECT **pmd,
ASN1_OCTET_STRING **pikeyHash,
doc/man3/OSSL_CRMF_MSG_get0_tmpl.pod
+1 -1
View File
@@ -58,7 +58,7 @@ B<RFC 4211>
Copyright 2007-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
doc/man3/OSSL_CRMF_MSG_set1_regCtrl_regToken.pod
+1 -1
View File
@@ -98,7 +98,7 @@ RFC 4211
Copyright 2007-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
doc/man3/OSSL_CRMF_MSG_set1_regInfo_certReq.pod
+1 -1
View File
@@ -41,7 +41,7 @@ RFC 4211
Copyright 2007-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
doc/man3/OSSL_CRMF_MSG_set_validity.pod
+1 -1
View File
@@ -97,7 +97,7 @@ RFC 4211
Copyright 2007-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
doc/man3/OSSL_CRMF_pbmp_new.pod
+1 -1
View File
@@ -70,7 +70,7 @@ RFC 4211 section 4.4
Copyright 2007-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
doc/man3/OSSL_PARAM_TYPE.pod
+11 -3
View File
@@ -272,7 +272,9 @@ This example is for setting parameters on some object:
=head2 Example 2
This example is for requesting parameters on some object:
This example is for requesting parameters on some object, and also
demonstrates that the requestor isn't obligated to request all
available parameters:
const char *foo = NULL;
size_t foo_l;
@@ -289,8 +291,14 @@ could fill in the parameters like this:
/* const OSSL_PARAM *params */
OSSL_PARAM_set_utf8_ptr(OSSL_PARAM_locate(params, "foo"), "foo value");
OSSL_PARAM_set_utf8_string(OSSL_PARAM_locate(params, "bar"), "bar value");
const OSSL_PARAM *p;
if ((p = OSSL_PARAM_locate(params, "foo")) == NULL)
OSSL_PARAM_set_utf8_ptr(p, "foo value");
if ((p = OSSL_PARAM_locate(params, "bar")) == NULL)
OSSL_PARAM_set_utf8_ptr(p, "bar value");
if ((p = OSSL_PARAM_locate(params, "cookie")) == NULL)
OSSL_PARAM_set_utf8_ptr(p, "cookie value");
=head1 SEE ALSO
doc/man3/OSSL_trace_enabled.pod
+1 -1
View File
@@ -40,7 +40,7 @@ The tracing output is divided into types which are enabled
individually by the application.
The tracing types are described in detail in
L<OSSL_trace_set_callback(3)/Trace types>.
The fallback type C<OSSL_TRACE_CATEGORY_ANY> should I<not> be used
The fallback type C<OSSL_TRACE_CATEGORY_ALL> should I<not> be used
with the functions described here.
Tracing for a specific category is enabled if a so called
doc/man3/OSSL_trace_set_channel.pod
+7 -1
View File
@@ -178,9 +178,15 @@ Traces BIGNUM context operations.
=back
There is also C<OSSL_TRACE_CATEGORY_ANY>, which works as a fallback
There is also C<OSSL_TRACE_CATEGORY_ALL>, which works as a fallback
and can be used to get I<all> trace output.
Note, however, that in this case all trace output will effectively be
associated with the 'ALL' category, which is undesirable if the
application intends to include the category name in the trace output.
In this case it is better to register separate channels for each
trace category instead.
=head1 RETURN VALUES
OSSL_trace_set_channel(), OSSL_trace_set_prefix(),
doc/man3/X509_get0_sm2_id.pod
+43
View File
@@ -0,0 +1,43 @@
=pod
=head1 NAME
X509_get0_sm2_id, X509_set_sm2_id - get or set SM2 ID for certificate operations
=head1 SYNOPSIS
#include <openssl/x509.h>
ASN1_OCTET_STRING *X509_get0_sm2_id(X509 *x);
void X509_set_sm2_id(X509 *x, ASN1_OCTET_STRING *sm2_id);
=head1 DESCRIPTION
X509_get0_sm2_id() gets the ID value of an SM2 certificate B<x> by returning an
B<ASN1_OCTET_STRING> object which should not be freed by the caller.
X509_set_sm2_id() sets the B<sm2_id> value to an SM2 certificate B<x>.
=head1 NOTES
SM2 signature algorithm requires an ID value when generating and verifying a
signature. The functions described in this manual provide the user with the
ability to set and retrieve the SM2 ID value.
=head1 RETURN VALUES
X509_set_sm2_id() does not return a value.
=head1 SEE ALSO
L<X509_verify(3)>, L<SM2(7)>
=head1 COPYRIGHT
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut