From 5b465b332eb4965c316e667eb0b681be8a7c3e75 Mon Sep 17 00:00:00 2001 From: Hakase Date: Wed, 26 Dec 2018 08:58:54 +0900 Subject: [PATCH] Latest update. --- Configurations/descrip.mms.tmpl | 52 +++-- Configure | 4 +- apps/apps.c | 134 ++++++------ apps/apps.h | 2 + apps/ocsp.c | 2 +- apps/s_client.c | 16 +- crypto/asn1/a_digest.c | 12 +- crypto/asn1/a_sign.c | 32 ++- crypto/asn1/a_verify.c | 18 +- crypto/cms/cms_pwri.c | 1 + crypto/engine/eng_devcrypto.c | 7 +- crypto/err/err.c | 5 + crypto/evp/p_lib.c | 2 +- crypto/kdf/tls1_prf.c | 46 ++-- crypto/modes/modes_lcl.h | 4 +- crypto/modes/siv128.c | 54 ++--- crypto/rsa/rsa_pk1.c | 2 +- crypto/rsa/rsa_x931g.c | 2 + crypto/x509/x509_txt.c | 4 + crypto/x509/x509_vfy.c | 11 +- crypto/x509v3/v3_purp.c | 23 +- doc/man1/ca.pod | 2 +- doc/man1/ciphers.pod | 2 +- doc/man1/cms.pod | 10 +- doc/man1/enc.pod | 2 +- doc/man1/genpkey.pod | 6 +- doc/man1/ocsp.pod | 2 +- doc/man1/pkcs8.pod | 2 +- doc/man1/s_client.pod | 2 +- doc/man1/s_server.pod | 6 +- doc/man1/smime.pod | 2 +- doc/man1/storeutl.pod | 2 +- doc/man1/verify.pod | 2 +- doc/man3/ASN1_INTEGER_get_int64.pod | 2 +- doc/man3/ASYNC_WAIT_CTX_new.pod | 8 +- doc/man3/ASYNC_start_job.pod | 2 +- doc/man3/BIO_new_CMS.pod | 2 +- doc/man3/BN_generate_prime.pod | 4 +- doc/man3/BN_rand.pod | 3 +- doc/man3/BN_security_bits.pod | 2 +- doc/man3/BUF_MEM_new.pod | 2 +- doc/man3/CTLOG_STORE_get0_log_by_id.pod | 2 +- doc/man3/DH_size.pod | 2 +- doc/man3/DTLS_get_data_mtu.pod | 2 +- doc/man3/DTLS_set_timer_cb.pod | 2 +- doc/man3/DTLSv1_listen.pod | 6 +- doc/man3/EC_GROUP_copy.pod | 4 +- doc/man3/EVP_DigestInit.pod | 8 +- doc/man3/EVP_DigestSignInit.pod | 2 +- doc/man3/EVP_DigestVerifyInit.pod | 2 +- doc/man3/EVP_EncryptInit.pod | 2 +- doc/man3/EVP_MAC.pod | 2 +- doc/man3/EVP_PKEY_CTX_ctrl.pod | 5 +- doc/man3/EVP_PKEY_CTX_new.pod | 2 +- doc/man3/EVP_PKEY_decrypt.pod | 2 +- doc/man3/EVP_PKEY_derive.pod | 2 +- doc/man3/EVP_PKEY_encrypt.pod | 2 +- doc/man3/EVP_PKEY_get_default_digest_nid.pod | 2 +- doc/man3/EVP_PKEY_keygen.pod | 2 +- doc/man3/EVP_PKEY_new.pod | 9 +- doc/man3/EVP_PKEY_print_private.pod | 2 +- doc/man3/EVP_PKEY_sign.pod | 2 +- doc/man3/EVP_PKEY_supports_digest_nid.pod | 2 +- doc/man3/EVP_PKEY_verify.pod | 2 +- doc/man3/EVP_PKEY_verify_recover.pod | 2 +- doc/man3/EVP_SignInit.pod | 2 +- doc/man3/OPENSSL_secure_malloc.pod | 2 +- doc/man3/OSSL_STORE_INFO.pod | 2 +- doc/man3/OSSL_STORE_LOADER.pod | 2 +- doc/man3/OSSL_STORE_SEARCH.pod | 2 +- doc/man3/OSSL_STORE_expect.pod | 2 +- doc/man3/OSSL_STORE_open.pod | 2 +- doc/man3/OpenSSL_version.pod | 2 +- doc/man3/PEM_read_bio_ex.pod | 2 +- doc/man3/PEM_write_bio_CMS_stream.pod | 2 +- doc/man3/PEM_write_bio_PKCS7_stream.pod | 2 +- doc/man3/PKCS7_sign.pod | 4 +- doc/man3/PKCS7_sign_add_signer.pod | 2 +- doc/man3/RAND_bytes.pod | 2 +- doc/man3/RSA_get0_key.pod | 1 + doc/man3/RSA_size.pod | 2 +- doc/man3/SRP_VBASE_new.pod | 4 +- doc/man3/SRP_create_verifier.pod | 2 +- doc/man3/SRP_user_pwd_new.pod | 2 +- doc/man3/SSL_CIPHER_get_name.pod | 14 +- doc/man3/SSL_COMP_add_compression_method.pod | 5 +- doc/man3/SSL_CONF_CTX_new.pod | 2 +- doc/man3/SSL_CONF_CTX_set1_prefix.pod | 2 +- doc/man3/SSL_CONF_CTX_set_flags.pod | 2 +- doc/man3/SSL_CONF_CTX_set_ssl_ctx.pod | 2 +- doc/man3/SSL_CONF_cmd.pod | 8 +- doc/man3/SSL_CONF_cmd_argv.pod | 2 +- doc/man3/SSL_CTX_add1_chain_cert.pod | 2 +- doc/man3/SSL_CTX_config.pod | 2 +- doc/man3/SSL_CTX_dane_enable.pod | 2 +- doc/man3/SSL_CTX_get0_param.pod | 2 +- doc/man3/SSL_CTX_set1_curves.pod | 4 +- doc/man3/SSL_CTX_set1_verify_cert_store.pod | 2 +- doc/man3/SSL_CTX_set_default_passwd_cb.pod | 2 +- doc/man3/SSL_CTX_set_mode.pod | 4 +- doc/man3/SSL_CTX_set_msg_callback.pod | 3 +- doc/man3/SSL_CTX_set_options.pod | 6 +- doc/man3/SSL_CTX_set_security_level.pod | 2 +- doc/man3/SSL_CTX_set_session_ticket_cb.pod | 4 +- doc/man3/SSL_CTX_set_split_send_fragment.pod | 4 +- doc/man3/SSL_CTX_set_srp_password.pod | 2 +- doc/man3/SSL_CTX_set_tlsext_status_cb.pod | 4 +- doc/man3/SSL_SESSION_free.pod | 2 +- doc/man3/SSL_SESSION_get0_cipher.pod | 4 +- doc/man3/SSL_SESSION_get0_hostname.pod | 4 +- doc/man3/SSL_SESSION_get0_id_context.pod | 2 +- doc/man3/SSL_SESSION_get_protocol_version.pod | 4 +- doc/man3/SSL_SESSION_has_ticket.pod | 4 +- doc/man3/SSL_SESSION_is_resumable.pod | 2 +- doc/man3/SSL_SESSION_set1_id.pod | 2 +- doc/man3/SSL_export_keying_material.pod | 2 +- doc/man3/SSL_extension_supported.pod | 2 +- doc/man3/SSL_get_all_async_fds.pod | 4 +- doc/man3/SSL_get_error.pod | 4 +- doc/man3/SSL_get_version.pod | 2 +- doc/man3/SSL_read.pod | 2 +- doc/man3/SSL_set1_host.pod | 2 +- doc/man3/SSL_want.pod | 3 +- doc/man3/SSL_write.pod | 2 +- doc/man3/UI_create_method.pod | 5 +- doc/man3/UI_new.pod | 5 +- doc/man3/X509_NAME_ENTRY_get_object.pod | 3 - doc/man3/X509_STORE_CTX_new.pod | 4 +- doc/man3/X509_STORE_CTX_set_verify_cb.pod | 3 +- doc/man3/X509_STORE_new.pod | 2 +- doc/man3/X509_STORE_set_verify_cb_func.pod | 7 +- doc/man3/X509_VERIFY_PARAM_set_flags.pod | 8 +- doc/man3/X509_get0_signature.pod | 10 +- doc/man3/X509_get_serialNumber.pod | 5 +- doc/man3/X509_get_subject_name.pod | 4 +- doc/man3/X509_sign.pod | 8 +- doc/man3/i2d_CMS_bio_stream.pod | 2 +- doc/man3/i2d_PKCS7_bio_stream.pod | 2 +- doc/man7/EVP_MAC_HMAC.pod | 2 +- doc/man7/ct.pod | 4 +- include/openssl/dtls1.h | 8 +- include/openssl/evp.h | 2 +- include/openssl/tls1.h | 4 +- include/openssl/x509_vfy.h | 4 + ssl/d1_lib.c | 2 +- ssl/ssl_locl.h | 3 + ssl/statem/statem_clnt.c | 2 +- ssl/statem/statem_lib.c | 10 +- ssl/t1_lib.c | 2 +- test/asynciotest.c | 2 +- test/clienthellotest.c | 2 +- test/dtlstest.c | 8 +- test/fatalerrtest.c | 2 +- test/gosttest.c | 2 +- test/recordlentest.c | 2 +- test/servername_test.c | 2 +- test/ssl_test.c | 27 +-- test/sslapitest.c | 55 +++-- test/sslbuffertest.c | 2 +- test/sslcorrupttest.c | 2 +- test/ssltest_old.c | 8 +- test/tls13ccstest.c | 2 +- util/find-doc-nits | 10 +- util/process_docs.pl | 201 +++++++++--------- 164 files changed, 642 insertions(+), 534 deletions(-) diff --git a/Configurations/descrip.mms.tmpl b/Configurations/descrip.mms.tmpl index 0ef49487..2950b43b 100644 --- a/Configurations/descrip.mms.tmpl +++ b/Configurations/descrip.mms.tmpl @@ -816,7 +816,7 @@ $target : $args{generator}->[0] $deps \@ $incs_on \@ extradefines = "$defs" PIPE \$(CPP) $cppflags \$\@-S | - - \$(PERL) -ne "/^#(\\s*line)?\\s*[0-9]+\\s+""/ or print" > \$\@-i + \$(PERL) -ne "/^#(\\s*line)?\\s*[0-9]+\\s+""/ or print" > \$\@-i \@ DELETE/SYMBOL/LOCAL extradefines \@ $incs_off RENAME \$\@-i \$\@ @@ -844,7 +844,7 @@ EOF sub src2obj { my %args = @_; - my @srcs = map { (my $x = $_) =~ s/\.[sS]$/.asm/; $x + my @srcs = map { (my $x = $_) =~ s/\.s$/.asm/; $x } ( @{$args{srcs}} ); (my $obj = $args{obj}) =~ s|\.o$||; my $deps = join(", -\n\t\t", @srcs, @{$args{deps}}); @@ -864,20 +864,6 @@ EOF my $before = $unified_info{before}->{$obj.".OBJ"} || "\@ !"; my $after = $unified_info{after}->{$obj.".OBJ"} || "\@ !"; - if ($srcs[0] =~ /\.asm$/) { - my $asflags = { shlib => ' $(LIB_ASFLAGS)', - lib => ' $(LIB_ASFLAGS)', - dso => ' $(DSO_ASFLAGS)', - bin => ' $(BIN_ASFLAGS)' } -> {$args{intent}}; - return <<"EOF"; -$obj.OBJ : $deps - ${before} - SET DEFAULT $forward - \$(AS) $asflags \$(ASOUTFLAG)${objd}${objn}.OBJ $srcs - SET DEFAULT $backward -EOF - } - my $cflags; if ($args{installed}) { $cflags = { shlib => '$(LIB_CFLAGS)', @@ -895,6 +881,10 @@ EOF dso => '$(DSO_CPPFLAGS)', bin => '$(BIN_CPPFLAGS)' } -> {$args{intent}}; my $defs = join("", map { ",".$_ } @{$args{defs}}); + my $asflags = { shlib => ' $(LIB_ASFLAGS)', + lib => ' $(LIB_ASFLAGS)', + dso => ' $(DSO_ASFLAGS)', + bin => ' $(BIN_ASFLAGS)' } -> {$args{intent}}; my @incs_cmds = includes({ shlib => '$(LIB_INCLUDES)', lib => '$(LIB_INCLUDES)', @@ -907,6 +897,36 @@ EOF } @{$args{incs}}); my $incs_on = join("\n\t\@ ", @{$incs_cmds[0]}) || '!'; my $incs_off = join("\n\t\@ ", @{$incs_cmds[1]}) || '!'; + + if ($srcs[0] =~ /\.asm$/) { + return <<"EOF"; +$obj.OBJ : $deps + ${before} + SET DEFAULT $forward + \$(AS) $asflags \$(ASOUTFLAG)${objd}${objn}.OBJ $srcs + SET DEFAULT $backward + ${after} + - PURGE $obj.OBJ +EOF + } elsif ($srcs[0] =~ /.S$/) { + return <<"EOF"; +$obj.OBJ : $deps + ${before} + SET DEFAULT $forward + \@ $incs_on + \@ extradefines = "$defs" + PIPE \$(CPP) ${cflags} $srcs | - + \$(PERL) -ne "/^#(\\s*line)?\\s*[0-9]+\\s+""/ or print" - + > ${objd}${objn}.asm + \@ DELETE/SYMBOL/LOCAL extradefines + \@ $incs_off + SET DEFAULT $backward + ${after} + \$(AS) $asflags \$(ASOUTFLAG)$obj.OBJ $obj.asm + - PURGE $obj.OBJ +EOF + } + my $depbuild = $disabled{makedepend} ? "" : " /MMS=(FILE=${objd}${objn}.D,TARGET=$obj.OBJ)"; diff --git a/Configure b/Configure index 80c58b18..da090030 100755 --- a/Configure +++ b/Configure @@ -1112,13 +1112,13 @@ foreach my $feature (@{$target{disable}}) { $disabled{$feature} = 'config'; } foreach my $feature (@{$target{enable}}) { - if ("default" eq ($disabled{$_} // "")) { + if ("default" eq ($disabled{$feature} // "")) { if (exists $deprecated_disablables{$feature}) { warn "***** config $target enables deprecated feature $feature\n"; } elsif (!grep { $feature eq $_ } @disablables) { die "***** config $target enables unknown feature $feature\n"; } - delete $disabled{$_}; + delete $disabled{$feature}; } } diff --git a/apps/apps.c b/apps/apps.c index c00fdcd8..67d28eeb 100644 --- a/apps/apps.c +++ b/apps/apps.c @@ -280,78 +280,78 @@ const UI_METHOD *get_ui_method(void) return ui_method; } -int password_callback(char *buf, int bufsiz, int verify, PW_CB_DATA *cb_tmp) +int password_callback(char *buf, int bufsiz, int verify, PW_CB_DATA *cb_data) { int res = 0; - UI *ui = NULL; - PW_CB_DATA *cb_data = (PW_CB_DATA *)cb_tmp; + UI *ui; + int ok = 0; + char *buff = NULL; + int ui_flags = 0; + const char *prompt_info = NULL; + char *prompt; - ui = UI_new_method(ui_method); - if (ui) { - int ok = 0; - char *buff = NULL; - int ui_flags = 0; - const char *prompt_info = NULL; - char *prompt; + if ((ui = UI_new_method(ui_method)) == NULL) + return 0; - if (cb_data != NULL && cb_data->prompt_info != NULL) - prompt_info = cb_data->prompt_info; - prompt = UI_construct_prompt(ui, "pass phrase", prompt_info); - if (!prompt) { - BIO_printf(bio_err, "Out of memory\n"); - UI_free(ui); - return 0; - } - - ui_flags |= UI_INPUT_FLAG_DEFAULT_PWD; - UI_ctrl(ui, UI_CTRL_PRINT_ERRORS, 1, 0, 0); - - /* We know that there is no previous user data to return to us */ - (void)UI_add_user_data(ui, cb_data); - - ok = UI_add_input_string(ui, prompt, ui_flags, buf, - PW_MIN_LENGTH, bufsiz - 1); - - if (ok >= 0 && verify) { - buff = app_malloc(bufsiz, "password buffer"); - ok = UI_add_verify_string(ui, prompt, ui_flags, buff, - PW_MIN_LENGTH, bufsiz - 1, buf); - } - if (ok >= 0) - do { - ok = UI_process(ui); - } while (ok < 0 && UI_ctrl(ui, UI_CTRL_IS_REDOABLE, 0, 0, 0)); - - OPENSSL_clear_free(buff, (unsigned int)bufsiz); - - if (ok >= 0) - res = strlen(buf); - if (ok == -1) { - BIO_printf(bio_err, "User interface error\n"); - ERR_print_errors(bio_err); - OPENSSL_cleanse(buf, (unsigned int)bufsiz); - res = 0; - } - if (ok == -2) { - BIO_printf(bio_err, "aborted!\n"); - OPENSSL_cleanse(buf, (unsigned int)bufsiz); - res = 0; - } + if (cb_data != NULL && cb_data->prompt_info != NULL) + prompt_info = cb_data->prompt_info; + prompt = UI_construct_prompt(ui, "pass phrase", prompt_info); + if (prompt == NULL) { + BIO_printf(bio_err, "Out of memory\n"); UI_free(ui); - OPENSSL_free(prompt); + return 0; } + + ui_flags |= UI_INPUT_FLAG_DEFAULT_PWD; + UI_ctrl(ui, UI_CTRL_PRINT_ERRORS, 1, 0, 0); + + /* We know that there is no previous user data to return to us */ + (void)UI_add_user_data(ui, cb_data); + + ok = UI_add_input_string(ui, prompt, ui_flags, buf, + PW_MIN_LENGTH, bufsiz - 1); + + if (ok >= 0 && verify) { + buff = app_malloc(bufsiz, "password buffer"); + ok = UI_add_verify_string(ui, prompt, ui_flags, buff, + PW_MIN_LENGTH, bufsiz - 1, buf); + } + if (ok >= 0) + do { + ok = UI_process(ui); + } while (ok < 0 && UI_ctrl(ui, UI_CTRL_IS_REDOABLE, 0, 0, 0)); + + OPENSSL_clear_free(buff, (unsigned int)bufsiz); + + if (ok >= 0) + res = strlen(buf); + if (ok == -1) { + BIO_printf(bio_err, "User interface error\n"); + ERR_print_errors(bio_err); + OPENSSL_cleanse(buf, (unsigned int)bufsiz); + res = 0; + } + if (ok == -2) { + BIO_printf(bio_err, "aborted!\n"); + OPENSSL_cleanse(buf, (unsigned int)bufsiz); + res = 0; + } + UI_free(ui); + OPENSSL_free(prompt); return res; } +int wrap_password_callback(char *buf, int bufsiz, int verify, void *userdata) +{ + return password_callback(buf, bufsiz, verify, (PW_CB_DATA *)userdata); +} + static char *app_get_pass(const char *arg, int keepbio); int app_passwd(const char *arg1, const char *arg2, char **pass1, char **pass2) { - int same; - if (arg2 == NULL || arg1 == NULL || strcmp(arg1, arg2)) - same = 0; - else - same = 1; + int same = arg1 != NULL && arg2 != NULL && strcmp(arg1, arg2) == 0; + if (arg1 != NULL) { *pass1 = app_get_pass(arg1, same); if (*pass1 == NULL) @@ -371,8 +371,8 @@ int app_passwd(const char *arg1, const char *arg2, char **pass1, char **pass2) static char *app_get_pass(const char *arg, int keepbio) { - char *tmp, tpass[APP_PASS_LEN]; static BIO *pwdbio = NULL; + char *tmp, tpass[APP_PASS_LEN]; int i; if (strncmp(arg, "pass:", 5) == 0) @@ -380,7 +380,7 @@ static char *app_get_pass(const char *arg, int keepbio) if (strncmp(arg, "env:", 4) == 0) { tmp = getenv(arg + 4); if (tmp == NULL) { - BIO_printf(bio_err, "Can't read environment variable %s\n", arg + 4); + BIO_printf(bio_err, "No environment variable %s\n", arg + 4); return NULL; } return OPENSSL_strdup(tmp); @@ -542,7 +542,7 @@ int add_oid_section(CONF *conf) } static int load_pkcs12(BIO *in, const char *desc, - pem_password_cb *pem_cb, void *cb_data, + pem_password_cb *pem_cb, PW_CB_DATA *cb_data, EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca) { const char *pass; @@ -749,20 +749,16 @@ EVP_PKEY *load_key(const char *file, int format, int maybe_stdin, if (format == FORMAT_ASN1) { pkey = d2i_PrivateKey_bio(key, NULL); } else if (format == FORMAT_PEM) { - pkey = PEM_read_bio_PrivateKey(key, NULL, - (pem_password_cb *)password_callback, - &cb_data); + pkey = PEM_read_bio_PrivateKey(key, NULL, wrap_password_callback, &cb_data); } else if (format == FORMAT_PKCS12) { - if (!load_pkcs12(key, key_descrip, - (pem_password_cb *)password_callback, &cb_data, + if (!load_pkcs12(key, key_descrip, wrap_password_callback, &cb_data, &pkey, NULL, NULL)) goto end; #if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DSA) && !defined (OPENSSL_NO_RC4) } else if (format == FORMAT_MSBLOB) { pkey = b2i_PrivateKey_bio(key); } else if (format == FORMAT_PVK) { - pkey = b2i_PVK_bio(key, (pem_password_cb *)password_callback, - &cb_data); + pkey = b2i_PVK_bio(key, wrap_password_callback, &cb_data); #endif } else { BIO_printf(bio_err, "bad input format specified for key file\n"); diff --git a/apps/apps.h b/apps/apps.h index 04f07899..460188df 100644 --- a/apps/apps.h +++ b/apps/apps.h @@ -437,6 +437,8 @@ typedef struct pw_cb_data { const char *prompt_info; } PW_CB_DATA; +/* We need both wrap and the "real" function because libcrypto uses both. */ +int wrap_password_callback(char *buf, int bufsiz, int verify, void *cb_data); int password_callback(char *buf, int bufsiz, int verify, PW_CB_DATA *cb_data); int setup_ui_method(void); diff --git a/apps/ocsp.c b/apps/ocsp.c index c129e9e5..fb0a95ba 100644 --- a/apps/ocsp.c +++ b/apps/ocsp.c @@ -863,6 +863,7 @@ static void killall(int ret, pid_t *kidpids) for (i = 0; i < multi; ++i) if (kidpids[i] != 0) (void)kill(kidpids[i], SIGTERM); + OPENSSL_free(kidpids); sleep(1); exit(ret); } @@ -977,7 +978,6 @@ static void spawn_loop(void) } /* The loop above can only break on termsig */ - OPENSSL_free(kidpids); syslog(LOG_INFO, "terminating on signal: %d", termsig); killall(0, kidpids); } diff --git a/apps/s_client.c b/apps/s_client.c index 8bdfbb65..51001d57 100644 --- a/apps/s_client.c +++ b/apps/s_client.c @@ -2535,12 +2535,16 @@ int s_client_main(int argc, char **argv) /* STARTTLS command requires CAPABILITIES... */ BIO_printf(fbio, "CAPABILITIES\r\n"); (void)BIO_flush(fbio); - /* wait for multi-line CAPABILITIES response */ - do { - mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ); - if (strstr(mbuf, "STARTTLS")) - foundit = 1; - } while (mbuf_len > 1 && mbuf[0] != '.'); + BIO_gets(fbio, mbuf, BUFSIZZ); + /* no point in trying to parse the CAPABILITIES response if there is none */ + if (strstr(mbuf, "101") != NULL) { + /* wait for multi-line CAPABILITIES response */ + do { + mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ); + if (strstr(mbuf, "STARTTLS")) + foundit = 1; + } while (mbuf_len > 1 && mbuf[0] != '.'); + } (void)BIO_flush(fbio); BIO_pop(fbio); BIO_free(fbio); diff --git a/crypto/asn1/a_digest.c b/crypto/asn1/a_digest.c index 0c00f186..ad6a17d2 100644 --- a/crypto/asn1/a_digest.c +++ b/crypto/asn1/a_digest.c @@ -23,18 +23,22 @@ int ASN1_digest(i2d_of_void *i2d, const EVP_MD *type, char *data, unsigned char *md, unsigned int *len) { - int i; + int inl; unsigned char *str, *p; - i = i2d(data, NULL); - if ((str = OPENSSL_malloc(i)) == NULL) { + inl = i2d(data, NULL); + if (inl <= 0) { + ASN1err(ASN1_F_ASN1_DIGEST, ERR_R_INTERNAL_ERROR); + return 0; + } + if ((str = OPENSSL_malloc(inl)) == NULL) { ASN1err(ASN1_F_ASN1_DIGEST, ERR_R_MALLOC_FAILURE); return 0; } p = str; i2d(data, &p); - if (!EVP_Digest(str, i, md, len, type, NULL)) { + if (!EVP_Digest(str, inl, md, len, type, NULL)) { OPENSSL_free(str); return 0; } diff --git a/crypto/asn1/a_sign.c b/crypto/asn1/a_sign.c index 9de4fb61..97e8efcb 100644 --- a/crypto/asn1/a_sign.c +++ b/crypto/asn1/a_sign.c @@ -29,7 +29,8 @@ int ASN1_sign(i2d_of_void *i2d, X509_ALGOR *algor1, X509_ALGOR *algor2, { EVP_MD_CTX *ctx = EVP_MD_CTX_new(); unsigned char *p, *buf_in = NULL, *buf_out = NULL; - int i, inl = 0, outl = 0, outll = 0; + int i, inl = 0, outl = 0; + size_t inll = 0, outll = 0; X509_ALGOR *a; if (ctx == NULL) { @@ -70,10 +71,15 @@ int ASN1_sign(i2d_of_void *i2d, X509_ALGOR *algor1, X509_ALGOR *algor2, } } inl = i2d(data, NULL); - buf_in = OPENSSL_malloc((unsigned int)inl); + if (inl <= 0) { + ASN1err(ASN1_F_ASN1_SIGN, ERR_R_INTERNAL_ERROR); + goto err; + } + inll = (size_t)inl; + buf_in = OPENSSL_malloc(inll); outll = outl = EVP_PKEY_size(pkey); - buf_out = OPENSSL_malloc((unsigned int)outl); - if ((buf_in == NULL) || (buf_out == NULL)) { + buf_out = OPENSSL_malloc(outll); + if (buf_in == NULL || buf_out == NULL) { outl = 0; ASN1err(ASN1_F_ASN1_SIGN, ERR_R_MALLOC_FAILURE); goto err; @@ -101,7 +107,7 @@ int ASN1_sign(i2d_of_void *i2d, X509_ALGOR *algor1, X509_ALGOR *algor2, signature->flags |= ASN1_STRING_FLAG_BITS_LEFT; err: EVP_MD_CTX_free(ctx); - OPENSSL_clear_free((char *)buf_in, (unsigned int)inl); + OPENSSL_clear_free((char *)buf_in, inll); OPENSSL_clear_free((char *)buf_out, outll); return outl; } @@ -138,7 +144,7 @@ int ASN1_item_sign_ctx(const ASN1_ITEM *it, EVP_PKEY *pkey; unsigned char *buf_in = NULL, *buf_out = NULL; size_t inl = 0, outl = 0, outll = 0; - int signid, paramtype; + int signid, paramtype, buf_len = 0; int rv; type = EVP_MD_CTX_md(ctx); @@ -198,10 +204,16 @@ int ASN1_item_sign_ctx(const ASN1_ITEM *it, } - inl = ASN1_item_i2d(asn, &buf_in, it); + buf_len = ASN1_item_i2d(asn, &buf_in, it); + if (buf_len <= 0) { + outl = 0; + ASN1err(ASN1_F_ASN1_ITEM_SIGN_CTX, ERR_R_INTERNAL_ERROR); + goto err; + } + inl = buf_len; outll = outl = EVP_PKEY_size(pkey); - buf_out = OPENSSL_malloc((unsigned int)outl); - if ((buf_in == NULL) || (buf_out == NULL)) { + buf_out = OPENSSL_malloc(outll); + if (buf_in == NULL || buf_out == NULL) { outl = 0; ASN1err(ASN1_F_ASN1_ITEM_SIGN_CTX, ERR_R_MALLOC_FAILURE); goto err; @@ -223,7 +235,7 @@ int ASN1_item_sign_ctx(const ASN1_ITEM *it, signature->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07); signature->flags |= ASN1_STRING_FLAG_BITS_LEFT; err: - OPENSSL_clear_free((char *)buf_in, (unsigned int)inl); + OPENSSL_clear_free((char *)buf_in, inl); OPENSSL_clear_free((char *)buf_out, outll); return outl; } diff --git a/crypto/asn1/a_verify.c b/crypto/asn1/a_verify.c index dc3e9720..1f245831 100644 --- a/crypto/asn1/a_verify.c +++ b/crypto/asn1/a_verify.c @@ -48,6 +48,10 @@ int ASN1_verify(i2d_of_void *i2d, X509_ALGOR *a, ASN1_BIT_STRING *signature, } inl = i2d(data, NULL); + if (inl <= 0) { + ASN1err(ASN1_F_ASN1_VERIFY, ERR_R_INTERNAL_ERROR); + goto err; + } buf_in = OPENSSL_malloc((unsigned int)inl); if (buf_in == NULL) { ASN1err(ASN1_F_ASN1_VERIFY, ERR_R_MALLOC_FAILURE); @@ -87,8 +91,8 @@ int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *a, EVP_MD_CTX *ctx = NULL; unsigned char *buf_in = NULL; int ret = -1, inl = 0; - int mdnid, pknid; + size_t inll = 0; if (!pkey) { ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ERR_R_PASSED_NULL_PARAMETER); @@ -127,8 +131,8 @@ int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *a, goto err; ret = -1; } else { - const EVP_MD *type; - type = EVP_get_digestbynid(mdnid); + const EVP_MD *type = EVP_get_digestbynid(mdnid); + if (type == NULL) { ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM); @@ -150,11 +154,15 @@ int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *a, } inl = ASN1_item_i2d(asn, &buf_in, it); - + if (inl <= 0) { + ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ERR_R_INTERNAL_ERROR); + goto err; + } if (buf_in == NULL) { ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ERR_R_MALLOC_FAILURE); goto err; } + inll = inl; ret = EVP_DigestVerify(ctx, signature->data, (size_t)signature->length, buf_in, inl); @@ -164,7 +172,7 @@ int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *a, } ret = 1; err: - OPENSSL_clear_free(buf_in, (unsigned int)inl); + OPENSSL_clear_free(buf_in, inll); EVP_MD_CTX_free(ctx); return ret; } diff --git a/crypto/cms/cms_pwri.c b/crypto/cms/cms_pwri.c index af979b55..980252d1 100644 --- a/crypto/cms/cms_pwri.c +++ b/crypto/cms/cms_pwri.c @@ -373,6 +373,7 @@ int cms_RecipientInfo_pwri_crypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri, goto err; } + OPENSSL_clear_free(ec->key, ec->keylen); ec->key = key; ec->keylen = keylen; diff --git a/crypto/engine/eng_devcrypto.c b/crypto/engine/eng_devcrypto.c index bfdb8fc6..ec6337de 100644 --- a/crypto/engine/eng_devcrypto.c +++ b/crypto/engine/eng_devcrypto.c @@ -25,6 +25,8 @@ #include "internal/engine.h" +/* #define ENGINE_DEVCRYPTO_DEBUG */ + #ifdef CRYPTO_ALGORITHM_MIN # define CHECK_BSD_STYLE_MACROS #endif @@ -1156,7 +1158,10 @@ void engine_load_devcrypto_int() ENGINE *e = NULL; if ((cfd = open("/dev/crypto", O_RDWR, 0)) < 0) { - fprintf(stderr, "Could not open /dev/crypto: %s\n", strerror(errno)); +#ifndef ENGINE_DEVCRYPTO_DEBUG + if (errno != ENOENT) +#endif + fprintf(stderr, "Could not open /dev/crypto: %s\n", strerror(errno)); return; } diff --git a/crypto/err/err.c b/crypto/err/err.c index bc671c91..c80aa6be 100644 --- a/crypto/err/err.c +++ b/crypto/err/err.c @@ -697,6 +697,7 @@ DEFINE_RUN_ONCE_STATIC(err_do_init) ERR_STATE *ERR_get_state(void) { ERR_STATE *state; + int saveerrno = get_last_sys_error(); if (!OPENSSL_init_crypto(OPENSSL_INIT_BASE_ONLY, NULL)) return NULL; @@ -728,6 +729,7 @@ ERR_STATE *ERR_get_state(void) OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL); } + set_sys_error(saveerrno); return state; } @@ -737,6 +739,8 @@ ERR_STATE *ERR_get_state(void) */ int err_shelve_state(void **state) { + int saveerrno = get_last_sys_error(); + if (!OPENSSL_init_crypto(OPENSSL_INIT_BASE_ONLY, NULL)) return 0; @@ -747,6 +751,7 @@ int err_shelve_state(void **state) if (!CRYPTO_THREAD_set_local(&err_thread_local, (ERR_STATE*)-1)) return 0; + set_sys_error(saveerrno); return 1; } diff --git a/crypto/evp/p_lib.c b/crypto/evp/p_lib.c index 4c21549f..5f599ab8 100644 --- a/crypto/evp/p_lib.c +++ b/crypto/evp/p_lib.c @@ -42,7 +42,7 @@ int EVP_PKEY_security_bits(const EVP_PKEY *pkey) return pkey->ameth->pkey_security_bits(pkey); } -int EVP_PKEY_size(EVP_PKEY *pkey) +int EVP_PKEY_size(const EVP_PKEY *pkey) { if (pkey && pkey->ameth && pkey->ameth->pkey_size) return pkey->ameth->pkey_size(pkey); diff --git a/crypto/kdf/tls1_prf.c b/crypto/kdf/tls1_prf.c index c3be7dd1..24ad59b9 100644 --- a/crypto/kdf/tls1_prf.c +++ b/crypto/kdf/tls1_prf.c @@ -178,8 +178,7 @@ static int tls1_prf_P_hash(const EVP_MD *md, unsigned char *out, size_t olen) { int chunk; - EVP_MD_CTX *ctx = NULL, *ctx_tmp = NULL, *ctx_init = NULL; - EVP_PKEY *mac_key = NULL; + EVP_MAC_CTX *ctx = NULL, *ctx_tmp = NULL, *ctx_init = NULL; unsigned char A1[EVP_MAX_MD_SIZE]; size_t A1_len; int ret = 0; @@ -188,47 +187,49 @@ static int tls1_prf_P_hash(const EVP_MD *md, if (!ossl_assert(chunk > 0)) goto err; - ctx = EVP_MD_CTX_new(); - ctx_tmp = EVP_MD_CTX_new(); - ctx_init = EVP_MD_CTX_new(); + ctx = EVP_MAC_CTX_new_id(EVP_MAC_HMAC); + ctx_tmp = EVP_MAC_CTX_new_id(EVP_MAC_HMAC); + ctx_init = EVP_MAC_CTX_new_id(EVP_MAC_HMAC); if (ctx == NULL || ctx_tmp == NULL || ctx_init == NULL) goto err; - EVP_MD_CTX_set_flags(ctx_init, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW); - mac_key = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL, sec, sec_len); - if (mac_key == NULL) + if (EVP_MAC_ctrl(ctx_init, EVP_MAC_CTRL_SET_FLAGS, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW) != 1) goto err; - if (!EVP_DigestSignInit(ctx_init, NULL, md, NULL, mac_key)) + if (EVP_MAC_ctrl(ctx_init, EVP_MAC_CTRL_SET_MD, md) != 1) goto err; - if (!EVP_MD_CTX_copy_ex(ctx, ctx_init)) + if (EVP_MAC_ctrl(ctx_init, EVP_MAC_CTRL_SET_KEY, sec, sec_len) != 1) goto err; - if (seed != NULL && !EVP_DigestSignUpdate(ctx, seed, seed_len)) + if (!EVP_MAC_init(ctx_init)) goto err; - if (!EVP_DigestSignFinal(ctx, A1, &A1_len)) + if (!EVP_MAC_CTX_copy(ctx, ctx_init)) + goto err; + if (seed != NULL && !EVP_MAC_update(ctx, seed, seed_len)) + goto err; + if (!EVP_MAC_final(ctx, A1, &A1_len)) goto err; for (;;) { /* Reinit mac contexts */ - if (!EVP_MD_CTX_copy_ex(ctx, ctx_init)) + if (!EVP_MAC_CTX_copy(ctx, ctx_init)) goto err; - if (!EVP_DigestSignUpdate(ctx, A1, A1_len)) + if (!EVP_MAC_update(ctx, A1, A1_len)) goto err; - if (olen > (size_t)chunk && !EVP_MD_CTX_copy_ex(ctx_tmp, ctx)) + if (olen > (size_t)chunk && !EVP_MAC_CTX_copy(ctx_tmp, ctx)) goto err; - if (seed && !EVP_DigestSignUpdate(ctx, seed, seed_len)) + if (seed != NULL && !EVP_MAC_update(ctx, seed, seed_len)) goto err; if (olen > (size_t)chunk) { size_t mac_len; - if (!EVP_DigestSignFinal(ctx, out, &mac_len)) + if (!EVP_MAC_final(ctx, out, &mac_len)) goto err; out += mac_len; olen -= mac_len; /* calc the next A1 value */ - if (!EVP_DigestSignFinal(ctx_tmp, A1, &A1_len)) + if (!EVP_MAC_final(ctx_tmp, A1, &A1_len)) goto err; } else { /* last one */ - if (!EVP_DigestSignFinal(ctx, A1, &A1_len)) + if (!EVP_MAC_final(ctx, A1, &A1_len)) goto err; memcpy(out, A1, olen); break; @@ -236,10 +237,9 @@ static int tls1_prf_P_hash(const EVP_MD *md, } ret = 1; err: - EVP_PKEY_free(mac_key); - EVP_MD_CTX_free(ctx); - EVP_MD_CTX_free(ctx_tmp); - EVP_MD_CTX_free(ctx_init); + EVP_MAC_CTX_free(ctx); + EVP_MAC_CTX_free(ctx_tmp); + EVP_MAC_CTX_free(ctx_init); OPENSSL_cleanse(A1, sizeof(A1)); return ret; } diff --git a/crypto/modes/modes_lcl.h b/crypto/modes/modes_lcl.h index d042d300..0517808f 100644 --- a/crypto/modes/modes_lcl.h +++ b/crypto/modes/modes_lcl.h @@ -206,8 +206,8 @@ struct siv128_context { SIV_BLOCK d; SIV_BLOCK tag; EVP_CIPHER_CTX *cipher_ctx; - CMAC_CTX *cmac_ctx_init; - CMAC_CTX *cmac_ctx; + EVP_MAC_CTX *mac_ctx_init; + EVP_MAC_CTX *mac_ctx; int final_ret; int crypto_ok; }; diff --git a/crypto/modes/siv128.c b/crypto/modes/siv128.c index f4d07d51..99b11d17 100644 --- a/crypto/modes/siv128.c +++ b/crypto/modes/siv128.c @@ -10,7 +10,6 @@ #include #include #include -#include #include "modes_lcl.h" #ifndef OPENSSL_NO_SIV @@ -94,15 +93,15 @@ __owur static ossl_inline int siv128_do_s2v_p(SIV128_CONTEXT *ctx, SIV_BLOCK *ou SIV_BLOCK t; size_t out_len = sizeof(out->byte); - if (!CMAC_CTX_copy(ctx->cmac_ctx, ctx->cmac_ctx_init)) + if (!EVP_MAC_CTX_copy(ctx->mac_ctx, ctx->mac_ctx_init)) return 0; if (len >= SIV_LEN) { - if (!CMAC_Update(ctx->cmac_ctx, in, len - SIV_LEN)) + if (!EVP_MAC_update(ctx->mac_ctx, in, len - SIV_LEN)) return 0; memcpy(&t, in + (len-SIV_LEN), SIV_LEN); siv128_xorblock(&t, &ctx->d); - if (!CMAC_Update(ctx->cmac_ctx, t.byte, SIV_LEN)) + if (!EVP_MAC_update(ctx->mac_ctx, t.byte, SIV_LEN)) return 0; } else { memset(&t, 0, sizeof(t)); @@ -110,10 +109,10 @@ __owur static ossl_inline int siv128_do_s2v_p(SIV128_CONTEXT *ctx, SIV_BLOCK *ou t.byte[len] = 0x80; siv128_dbl(&ctx->d); siv128_xorblock(&t, &ctx->d); - if (!CMAC_Update(ctx->cmac_ctx, t.byte, SIV_LEN)) + if (!EVP_MAC_update(ctx->mac_ctx, t.byte, SIV_LEN)) return 0; } - if (!CMAC_Final(ctx->cmac_ctx, out->byte, &out_len) + if (!EVP_MAC_final(ctx->mac_ctx, out->byte, &out_len) || out_len != SIV_LEN) return 0; return 1; @@ -160,21 +159,22 @@ int CRYPTO_siv128_init(SIV128_CONTEXT *ctx, const unsigned char *key, int klen, memset(&ctx->d, 0, sizeof(ctx->d)); ctx->cipher_ctx = NULL; - ctx->cmac_ctx = NULL; - ctx->cmac_ctx_init = NULL; + ctx->mac_ctx = NULL; + ctx->mac_ctx_init = NULL; if (key == NULL || cbc == NULL || ctr == NULL || (ctx->cipher_ctx = EVP_CIPHER_CTX_new()) == NULL - || (ctx->cmac_ctx_init = CMAC_CTX_new()) == NULL - || (ctx->cmac_ctx = CMAC_CTX_new()) == NULL - || !CMAC_Init(ctx->cmac_ctx_init, key, klen, cbc, NULL) + || (ctx->mac_ctx_init = EVP_MAC_CTX_new_id(EVP_MAC_CMAC)) == NULL + || (ctx->mac_ctx = EVP_MAC_CTX_new_id(EVP_MAC_CMAC)) == NULL + || !EVP_MAC_ctrl(ctx->mac_ctx_init, EVP_MAC_CTRL_SET_CIPHER, cbc) + || !EVP_MAC_ctrl(ctx->mac_ctx_init, EVP_MAC_CTRL_SET_KEY, key, klen) || !EVP_EncryptInit_ex(ctx->cipher_ctx, ctr, NULL, key + klen, NULL) - || !CMAC_CTX_copy(ctx->cmac_ctx, ctx->cmac_ctx_init) - || !CMAC_Update(ctx->cmac_ctx, zero, sizeof(zero)) - || !CMAC_Final(ctx->cmac_ctx, ctx->d.byte, &out_len)) { + || !EVP_MAC_CTX_copy(ctx->mac_ctx, ctx->mac_ctx_init) + || !EVP_MAC_update(ctx->mac_ctx, zero, sizeof(zero)) + || !EVP_MAC_final(ctx->mac_ctx, ctx->d.byte, &out_len)) { EVP_CIPHER_CTX_free(ctx->cipher_ctx); - CMAC_CTX_free(ctx->cmac_ctx_init); - CMAC_CTX_free(ctx->cmac_ctx); + EVP_MAC_CTX_free(ctx->mac_ctx_init); + EVP_MAC_CTX_free(ctx->mac_ctx); return 0; } @@ -192,9 +192,9 @@ int CRYPTO_siv128_copy_ctx(SIV128_CONTEXT *dest, SIV128_CONTEXT *src) memcpy(&dest->d, &src->d, sizeof(src->d)); if (!EVP_CIPHER_CTX_copy(dest->cipher_ctx, src->cipher_ctx)) return 0; - if (!CMAC_CTX_copy(dest->cmac_ctx_init, src->cmac_ctx_init)) + if (!EVP_MAC_CTX_copy(dest->mac_ctx_init, src->mac_ctx_init)) return 0; - /* no need to copy cmac_ctx since it's temp storage */ + /* no need to copy mac_ctx since it's temp storage */ return 1; } @@ -206,18 +206,18 @@ int CRYPTO_siv128_copy_ctx(SIV128_CONTEXT *dest, SIV128_CONTEXT *src) int CRYPTO_siv128_aad(SIV128_CONTEXT *ctx, const unsigned char *aad, size_t len) { - SIV_BLOCK cmac_out; + SIV_BLOCK mac_out; size_t out_len = SIV_LEN; siv128_dbl(&ctx->d); - if (!CMAC_CTX_copy(ctx->cmac_ctx, ctx->cmac_ctx_init) - || !CMAC_Update(ctx->cmac_ctx, aad, len) - || !CMAC_Final(ctx->cmac_ctx, cmac_out.byte, &out_len) + if (!EVP_MAC_CTX_copy(ctx->mac_ctx, ctx->mac_ctx_init) + || !EVP_MAC_update(ctx->mac_ctx, aad, len) + || !EVP_MAC_final(ctx->mac_ctx, mac_out.byte, &out_len) || out_len != SIV_LEN) return 0; - siv128_xorblock(&ctx->d, &cmac_out); + siv128_xorblock(&ctx->d, &mac_out); return 1; @@ -328,10 +328,10 @@ int CRYPTO_siv128_cleanup(SIV128_CONTEXT *ctx) if (ctx != NULL) { EVP_CIPHER_CTX_free(ctx->cipher_ctx); ctx->cipher_ctx = NULL; - CMAC_CTX_free(ctx->cmac_ctx_init); - ctx->cmac_ctx_init = NULL; - CMAC_CTX_free(ctx->cmac_ctx); - ctx->cmac_ctx = NULL; + EVP_MAC_CTX_free(ctx->mac_ctx_init); + ctx->mac_ctx_init = NULL; + EVP_MAC_CTX_free(ctx->mac_ctx); + ctx->mac_ctx = NULL; OPENSSL_cleanse(&ctx->d, sizeof(ctx->d)); OPENSSL_cleanse(&ctx->tag, sizeof(ctx->tag)); ctx->final_ret = -1; diff --git a/crypto/rsa/rsa_pk1.c b/crypto/rsa/rsa_pk1.c index 13f1d827..cb7518e1 100644 --- a/crypto/rsa/rsa_pk1.c +++ b/crypto/rsa/rsa_pk1.c @@ -161,7 +161,7 @@ int RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen, unsigned int good, found_zero_byte, mask; int zero_index = 0, msg_index, mlen = -1; - if (tlen < 0 || flen < 0) + if (tlen <= 0 || flen <= 0) return -1; /* diff --git a/crypto/rsa/rsa_x931g.c b/crypto/rsa/rsa_x931g.c index bc03875f..16017772 100644 --- a/crypto/rsa/rsa_x931g.c +++ b/crypto/rsa/rsa_x931g.c @@ -128,6 +128,8 @@ int RSA_X931_derive_ex(RSA *rsa, BIGNUM *p1, BIGNUM *p2, BIGNUM *q1, /* calculate inverse of q mod p */ rsa->iqmp = BN_mod_inverse(NULL, rsa->q, rsa->p, ctx2); + if (rsa->iqmp == NULL) + goto err; ret = 1; err: diff --git a/crypto/x509/x509_txt.c b/crypto/x509/x509_txt.c index 299c3551..767d33b4 100644 --- a/crypto/x509/x509_txt.c +++ b/crypto/x509/x509_txt.c @@ -174,6 +174,10 @@ const char *X509_verify_cert_error_string(long n) return "OCSP verification failed"; case X509_V_ERR_OCSP_CERT_UNKNOWN: return "OCSP unknown cert"; + case X509_V_ERR_SIGNATURE_ALGORITHM_MISMATCH: + return "Subject signature algorithm and issuer public key algorithm mismatch"; + case X509_V_ERR_NO_ISSUER_PUBLIC_KEY: + return "Issuer certificate doesn't have a public key"; default: /* Printing an error number into a static buffer is not thread-safe */ diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index 95a95c69..bbf61d44 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -3232,12 +3232,19 @@ static int check_key_level(X509_STORE_CTX *ctx, X509 *cert) EVP_PKEY *pkey = X509_get0_pubkey(cert); int level = ctx->param->auth_level; + /* + * At security level zero, return without checking for a supported public + * key type. Some engines support key types not understood outside the + * engine, and we only need to understand the key when enforcing a security + * floor. + */ + if (level <= 0) + return 1; + /* Unsupported or malformed keys are not secure */ if (pkey == NULL) return 0; - if (level <= 0) - return 1; if (level > NUM_AUTH_LEVELS) level = NUM_AUTH_LEVELS; diff --git a/crypto/x509v3/v3_purp.c b/crypto/x509v3/v3_purp.c index 2080adbe..d0ac7e6e 100644 --- a/crypto/x509v3/v3_purp.c +++ b/crypto/x509v3/v3_purp.c @@ -764,8 +764,9 @@ static int no_check(const X509_PURPOSE *xp, const X509 *x, int ca) * subject name. * These are: * 1. Check issuer_name(subject) == subject_name(issuer) - * 2. If akid(subject) exists check it matches issuer - * 3. If key_usage(issuer) exists check it supports certificate signing + * 2. If akid(subject) exists, check that it matches issuer + * 3. Check that issuer public key algorithm matches subject signature algorithm + * 4. If key_usage(issuer) exists, check that it supports certificate signing * returns 0 for OK, positive for reason for mismatch, reasons match * codes for X509_verify_cert() */ @@ -785,6 +786,24 @@ int X509_check_issued(X509 *issuer, X509 *subject) return ret; } + { + /* + * Check if the subject signature algorithm matches the issuer's PUBKEY + * algorithm + */ + EVP_PKEY *i_pkey = X509_get0_pubkey(issuer); + X509_ALGOR *s_algor = &subject->cert_info.signature; + int s_pknid = NID_undef, s_mdnid = NID_undef; + + if (i_pkey == NULL) + return X509_V_ERR_NO_ISSUER_PUBLIC_KEY; + + if (!OBJ_find_sigid_algs(OBJ_obj2nid(s_algor->algorithm), + &s_mdnid, &s_pknid) + || EVP_PKEY_type(s_pknid) != EVP_PKEY_base_id(i_pkey)) + return X509_V_ERR_SIGNATURE_ALGORITHM_MISMATCH; + } + if (subject->ex_flags & EXFLAG_PROXY) { if (ku_reject(issuer, KU_DIGITAL_SIGNATURE)) return X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE; diff --git a/doc/man1/ca.pod b/doc/man1/ca.pod index 2e84bd6c..cf6fe7e5 100644 --- a/doc/man1/ca.pod +++ b/doc/man1/ca.pod @@ -230,7 +230,7 @@ The section of the configuration file containing certificate extensions to be added when a certificate is issued (defaults to B unless the B<-extfile> option is used). If no extension section is present then, a V1 certificate is created. If the extension section -is present (even if it is empty), then a V3 certificate is created. See the:w +is present (even if it is empty), then a V3 certificate is created. See the L manual page for details of the extension section format. diff --git a/doc/man1/ciphers.pod b/doc/man1/ciphers.pod index 43680fb7..b5bca974 100644 --- a/doc/man1/ciphers.pod +++ b/doc/man1/ciphers.pod @@ -777,7 +777,7 @@ The B<-V> option for the B command was added in OpenSSL 1.0.0. The B<-stdname> is only available if OpenSSL is built with tracing enabled (B argument to Configure) before OpenSSL 1.1.1. -The B<-convert> was added in OpenSSL 1.1.1. +The B<-convert> option was added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man1/cms.pod b/doc/man1/cms.pod index 7be08af9..3d360e42 100644 --- a/doc/man1/cms.pod +++ b/doc/man1/cms.pod @@ -724,14 +724,14 @@ No revocation checking is done on the signer's certificate. The use of multiple B<-signer> options and the B<-resign> command were first added in OpenSSL 1.0.0. -The B option was first added in OpenSSL 1.0.2. +The B option was added in OpenSSL 1.0.2. -Support for RSA-OAEP and RSA-PSS was first added to OpenSSL 1.0.2. +Support for RSA-OAEP and RSA-PSS was added in OpenSSL 1.0.2. -The use of non-RSA keys with B<-encrypt> and B<-decrypt> was first added -to OpenSSL 1.0.2. +The use of non-RSA keys with B<-encrypt> and B<-decrypt> +was added in OpenSSL 1.0.2. -The -no_alt_chains options was first added to OpenSSL 1.0.2b. +The -no_alt_chains option was added in OpenSSL 1.0.2b. =head1 COPYRIGHT diff --git a/doc/man1/enc.pod b/doc/man1/enc.pod index ef8d7d91..7a6ce5a2 100644 --- a/doc/man1/enc.pod +++ b/doc/man1/enc.pod @@ -417,7 +417,7 @@ certain parameters. So if, for example, you want to use RC2 with a =head1 HISTORY -The default digest was changed from MD5 to SHA256 in Openssl 1.1.0. +The default digest was changed from MD5 to SHA256 in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man1/genpkey.pod b/doc/man1/genpkey.pod index 4a2c064e..1774974a 100644 --- a/doc/man1/genpkey.pod +++ b/doc/man1/genpkey.pod @@ -319,9 +319,9 @@ Generate an ED448 private key: =head1 HISTORY The ability to use NIST curve names, and to generate an EC key directly, -were added in OpenSSL 1.0.2. The ability to generate X25519 keys was added in -OpenSSL 1.1.0. The ability to generate X448, ED25519 and ED448 keys was added in -OpenSSL 1.1.1. +were added in OpenSSL 1.0.2. +The ability to generate X25519 keys was added in OpenSSL 1.1.0. +The ability to generate X448, ED25519 and ED448 keys was added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man1/ocsp.pod b/doc/man1/ocsp.pod index 7bfa6936..c8c32763 100644 --- a/doc/man1/ocsp.pod +++ b/doc/man1/ocsp.pod @@ -486,7 +486,7 @@ to a second file. =head1 HISTORY -The -no_alt_chains options was first added to OpenSSL 1.1.0. +The -no_alt_chains option was added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man1/pkcs8.pod b/doc/man1/pkcs8.pod index f2bde1a1..8099c907 100644 --- a/doc/man1/pkcs8.pod +++ b/doc/man1/pkcs8.pod @@ -305,7 +305,7 @@ L =head1 HISTORY -The B<-iter> option was added to OpenSSL 1.1.0. +The B<-iter> option was added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man1/s_client.pod b/doc/man1/s_client.pod index fa6a28f1..1a241e60 100644 --- a/doc/man1/s_client.pod +++ b/doc/man1/s_client.pod @@ -811,7 +811,7 @@ L =head1 HISTORY -The B<-no_alt_chains> option was first added to OpenSSL 1.1.0. +The B<-no_alt_chains> option was added in OpenSSL 1.1.0. The B<-name> option was added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man1/s_server.pod b/doc/man1/s_server.pod index 80b82de1..e86c2b36 100644 --- a/doc/man1/s_server.pod +++ b/doc/man1/s_server.pod @@ -829,10 +829,10 @@ L =head1 HISTORY -The -no_alt_chains option was first added to OpenSSL 1.1.0. +The -no_alt_chains option was added in OpenSSL 1.1.0. -The -allow-no-dhe-kex and -prioritize_chacha options were first added to -OpenSSL 1.1.1. +The +-allow-no-dhe-kex and -prioritize_chacha options were added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man1/smime.pod b/doc/man1/smime.pod index 7d5b7460..be20161d 100644 --- a/doc/man1/smime.pod +++ b/doc/man1/smime.pod @@ -510,7 +510,7 @@ structures may cause parsing errors. The use of multiple B<-signer> options and the B<-resign> command were first added in OpenSSL 1.0.0 -The -no_alt_chains options was first added to OpenSSL 1.1.0. +The -no_alt_chains option was added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man1/storeutl.pod b/doc/man1/storeutl.pod index 63c616e7..210a8878 100644 --- a/doc/man1/storeutl.pod +++ b/doc/man1/storeutl.pod @@ -119,7 +119,7 @@ L =head1 HISTORY -B B was added to OpenSSL 1.1.1. +The B B app was added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man1/verify.pod b/doc/man1/verify.pod index ef77e9c9..6465fd8b 100644 --- a/doc/man1/verify.pod +++ b/doc/man1/verify.pod @@ -762,7 +762,7 @@ L =head1 HISTORY -The B<-show_chain> option was first added to OpenSSL 1.1.0. +The B<-show_chain> option was added in OpenSSL 1.1.0. The B<-issuer_checks> option is deprecated as of OpenSSL 1.1.0 and is silently ignored. diff --git a/doc/man3/ASN1_INTEGER_get_int64.pod b/doc/man3/ASN1_INTEGER_get_int64.pod index 7cc7584c..da1e432a 100644 --- a/doc/man3/ASN1_INTEGER_get_int64.pod +++ b/doc/man3/ASN1_INTEGER_get_int64.pod @@ -119,7 +119,7 @@ L ASN1_INTEGER_set_int64(), ASN1_INTEGER_get_int64(), ASN1_ENUMERATED_set_int64() and ASN1_ENUMERATED_get_int64() -were added to OpenSSL 1.1.0. +were added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man3/ASYNC_WAIT_CTX_new.pod b/doc/man3/ASYNC_WAIT_CTX_new.pod index 54790133..eeb2777a 100644 --- a/doc/man3/ASYNC_WAIT_CTX_new.pod +++ b/doc/man3/ASYNC_WAIT_CTX_new.pod @@ -127,10 +127,10 @@ L, L =head1 HISTORY -ASYNC_WAIT_CTX_new, ASYNC_WAIT_CTX_free, ASYNC_WAIT_CTX_set_wait_fd, -ASYNC_WAIT_CTX_get_fd, ASYNC_WAIT_CTX_get_all_fds, -ASYNC_WAIT_CTX_get_changed_fds, ASYNC_WAIT_CTX_clear_fd were first added to -OpenSSL 1.1.0. +ASYNC_WAIT_CTX_new(), ASYNC_WAIT_CTX_free(), ASYNC_WAIT_CTX_set_wait_fd(), +ASYNC_WAIT_CTX_get_fd(), ASYNC_WAIT_CTX_get_all_fds(), +ASYNC_WAIT_CTX_get_changed_fds() and ASYNC_WAIT_CTX_clear_fd() +were added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man3/ASYNC_start_job.pod b/doc/man3/ASYNC_start_job.pod index 723d5341..95694b63 100644 --- a/doc/man3/ASYNC_start_job.pod +++ b/doc/man3/ASYNC_start_job.pod @@ -317,7 +317,7 @@ L, L ASYNC_init_thread, ASYNC_cleanup_thread, ASYNC_start_job, ASYNC_pause_job, ASYNC_get_current_job, ASYNC_get_wait_ctx(), ASYNC_block_pause(), ASYNC_unblock_pause() and ASYNC_is_capable() were first -added to OpenSSL 1.1.0. +added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man3/BIO_new_CMS.pod b/doc/man3/BIO_new_CMS.pod index 841cb17f..4872b56e 100644 --- a/doc/man3/BIO_new_CMS.pod +++ b/doc/man3/BIO_new_CMS.pod @@ -61,7 +61,7 @@ L =head1 HISTORY -BIO_new_CMS() was added to OpenSSL 1.0.0 +The BIO_new_CMS() function was added in OpenSSL 1.0.0. =head1 COPYRIGHT diff --git a/doc/man3/BN_generate_prime.pod b/doc/man3/BN_generate_prime.pod index 7784b80e..253fde3c 100644 --- a/doc/man3/BN_generate_prime.pod +++ b/doc/man3/BN_generate_prime.pod @@ -197,8 +197,8 @@ L, L, L =head1 HISTORY -BN_GENCB_new(), BN_GENCB_free(), -and BN_GENCB_get_arg() were added in OpenSSL 1.1.0 +The BN_GENCB_new(), BN_GENCB_free(), +and BN_GENCB_get_arg() functions were added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man3/BN_rand.pod b/doc/man3/BN_rand.pod index 18f70908..3ceeff1d 100644 --- a/doc/man3/BN_rand.pod +++ b/doc/man3/BN_rand.pod @@ -73,7 +73,8 @@ a future release. =item * -BN_priv_rand() and BN_priv_rand_range() were added in OpenSSL 1.1.1. +The +BN_priv_rand() and BN_priv_rand_range() functions were added in OpenSSL 1.1.1. =back diff --git a/doc/man3/BN_security_bits.pod b/doc/man3/BN_security_bits.pod index 9762be93..3b9bf887 100644 --- a/doc/man3/BN_security_bits.pod +++ b/doc/man3/BN_security_bits.pod @@ -33,7 +33,7 @@ function. The symmetric algorithms are not covered neither. =head1 HISTORY -BN_security_bits() was added in OpenSSL 1.1.0. +The BN_security_bits() function was added in OpenSSL 1.1.0. =head1 SEE ALSO diff --git a/doc/man3/BUF_MEM_new.pod b/doc/man3/BUF_MEM_new.pod index dfca6fe0..262e18f3 100644 --- a/doc/man3/BUF_MEM_new.pod +++ b/doc/man3/BUF_MEM_new.pod @@ -61,7 +61,7 @@ L. =head1 HISTORY -BUF_MEM_new_ex() was added in OpenSSL 1.1.0. +The BUF_MEM_new_ex() function was added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man3/CTLOG_STORE_get0_log_by_id.pod b/doc/man3/CTLOG_STORE_get0_log_by_id.pod index 3f4f1b9f..813b9d97 100644 --- a/doc/man3/CTLOG_STORE_get0_log_by_id.pod +++ b/doc/man3/CTLOG_STORE_get0_log_by_id.pod @@ -35,7 +35,7 @@ L =head1 HISTORY -This function was added in OpenSSL 1.1.0. +The CTLOG_STORE_get0_log_by_id() function was added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man3/DH_size.pod b/doc/man3/DH_size.pod index 3899a842..3161ef3e 100644 --- a/doc/man3/DH_size.pod +++ b/doc/man3/DH_size.pod @@ -43,7 +43,7 @@ L =head1 HISTORY -DH_bits() was added in OpenSSL 1.1.0. +The DH_bits() function was added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man3/DTLS_get_data_mtu.pod b/doc/man3/DTLS_get_data_mtu.pod index c73ee173..ee74fa17 100644 --- a/doc/man3/DTLS_get_data_mtu.pod +++ b/doc/man3/DTLS_get_data_mtu.pod @@ -22,7 +22,7 @@ Returns the maximum data payload size on success, or 0 on failure. =head1 HISTORY -This function was added in OpenSSL 1.1.1 +The DTLS_get_data_mtu() function was added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man3/DTLS_set_timer_cb.pod b/doc/man3/DTLS_set_timer_cb.pod index 78907b90..5014e77d 100644 --- a/doc/man3/DTLS_set_timer_cb.pod +++ b/doc/man3/DTLS_set_timer_cb.pod @@ -26,7 +26,7 @@ Returns void. =head1 HISTORY -This function was added in OpenSSL 1.1.1 +The DTLS_set_timer_cb() function was added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man3/DTLSv1_listen.pod b/doc/man3/DTLSv1_listen.pod index 60d73ae7..be4d5314 100644 --- a/doc/man3/DTLSv1_listen.pod +++ b/doc/man3/DTLSv1_listen.pod @@ -117,10 +117,10 @@ L, L =head1 HISTORY -SSL_stateless() was first added in OpenSSL 1.1.1. +The SSL_stateless() function was added in OpenSSL 1.1.1. -DTLSv1_listen() return codes were clarified in OpenSSL 1.1.0. The type of "peer" -also changed in OpenSSL 1.1.0. +The DTLSv1_listen() return codes were clarified in OpenSSL 1.1.0. +The type of "peer" also changed in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man3/EC_GROUP_copy.pod b/doc/man3/EC_GROUP_copy.pod index 1854f8bb..453825a7 100644 --- a/doc/man3/EC_GROUP_copy.pod +++ b/doc/man3/EC_GROUP_copy.pod @@ -89,7 +89,7 @@ named curve form is used and the parameters must have a corresponding named curve NID set. If asn1_flags is B the parameters are explicitly encoded. The functions EC_GROUP_get_asn1_flag and EC_GROUP_set_asn1_flag get and set the status of the asn1_flag for the curve. -Note: B was first added to OpenSSL 1.1.0, for +Note: B was added in OpenSSL 1.1.0, for previous versions of OpenSSL the value 0 must be used instead. Before OpenSSL 1.1.0 the default form was to use explicit parameters (meaning that applications would have to explicitly set the named curve form) in OpenSSL @@ -175,7 +175,7 @@ and EC_GROUP_get_degree return the order, cofactor, curve name (NID), ASN1 flag, specified curve respectively. If there is no curve name associated with a curve then EC_GROUP_get_curve_name will return 0. EC_GROUP_get0_order() returns an internal pointer to the group order. -EC_GROUP_get_order_bits() returns the number of bits in the group order. +EC_GROUP_order_bits() returns the number of bits in the group order. EC_GROUP_get0_cofactor() returns an internal pointer to the group cofactor. EC_GROUP_get0_seed returns a pointer to the seed that was used to generate the parameter b, or NULL if the seed is not diff --git a/doc/man3/EVP_DigestInit.pod b/doc/man3/EVP_DigestInit.pod index ccb59cff..f7ecda5c 100644 --- a/doc/man3/EVP_DigestInit.pod +++ b/doc/man3/EVP_DigestInit.pod @@ -369,15 +369,15 @@ L =head1 HISTORY -EVP_MD_CTX_create() and EVP_MD_CTX_destroy() were renamed to -EVP_MD_CTX_new() and EVP_MD_CTX_free() in OpenSSL 1.1.0. +The EVP_MD_CTX_create() and EVP_MD_CTX_destroy() functions were renamed to +EVP_MD_CTX_new() and EVP_MD_CTX_free() in OpenSSL 1.1.0, respectively. The link between digests and signing algorithms was fixed in OpenSSL 1.0 and later, so now EVP_sha1() can be used with RSA and DSA. -EVP_dss1() was removed in OpenSSL 1.1.0. +The EVP_dss1() function was removed in OpenSSL 1.1.0. -EVP_MD_CTX_set_pkey_ctx() was added in 1.1.1. +The EVP_MD_CTX_set_pkey_ctx() function was added in 1.1.1. =head1 COPYRIGHT diff --git a/doc/man3/EVP_DigestSignInit.pod b/doc/man3/EVP_DigestSignInit.pod index df880aef..b584d706 100644 --- a/doc/man3/EVP_DigestSignInit.pod +++ b/doc/man3/EVP_DigestSignInit.pod @@ -152,7 +152,7 @@ L, L =head1 HISTORY EVP_DigestSignInit(), EVP_DigestSignUpdate() and EVP_DigestSignFinal() -were first added to OpenSSL 1.0.0. +were added in OpenSSL 1.0.0. =head1 COPYRIGHT diff --git a/doc/man3/EVP_DigestVerifyInit.pod b/doc/man3/EVP_DigestVerifyInit.pod index a13d3f1f..d3275f2c 100644 --- a/doc/man3/EVP_DigestVerifyInit.pod +++ b/doc/man3/EVP_DigestVerifyInit.pod @@ -98,7 +98,7 @@ L, L =head1 HISTORY EVP_DigestVerifyInit(), EVP_DigestVerifyUpdate() and EVP_DigestVerifyFinal() -were first added to OpenSSL 1.0.0. +were added in OpenSSL 1.0.0. =head1 COPYRIGHT diff --git a/doc/man3/EVP_EncryptInit.pod b/doc/man3/EVP_EncryptInit.pod index 61c47e09..dc9366ba 100644 --- a/doc/man3/EVP_EncryptInit.pod +++ b/doc/man3/EVP_EncryptInit.pod @@ -675,7 +675,7 @@ L =head1 HISTORY -Support for OCB mode was added in OpenSSL 1.1.0 +Support for OCB mode was added in OpenSSL 1.1.0. B was made opaque in OpenSSL 1.1.0. As a result, EVP_CIPHER_CTX_reset() appeared and EVP_CIPHER_CTX_cleanup() diff --git a/doc/man3/EVP_MAC.pod b/doc/man3/EVP_MAC.pod index 58a34706..0e0d749b 100644 --- a/doc/man3/EVP_MAC.pod +++ b/doc/man3/EVP_MAC.pod @@ -111,7 +111,7 @@ This functions takes variable arguments, the exact expected arguments depend on C. EVP_MAC_ctrl() can be called both before and after EVP_MAC_init(), but the effect will depend on what control is being use. -See below for a description of standard controls. +See L below for a description of standard controls. EVP_MAC_vctrl() is the variant of EVP_MAC_ctrl() that takes a C argument instead of variadic arguments. diff --git a/doc/man3/EVP_PKEY_CTX_ctrl.pod b/doc/man3/EVP_PKEY_CTX_ctrl.pod index 7446321f..e09a2fe7 100644 --- a/doc/man3/EVP_PKEY_CTX_ctrl.pod +++ b/doc/man3/EVP_PKEY_CTX_ctrl.pod @@ -359,7 +359,7 @@ B when generating EC parameters or an EC key. The encoding can be B for explicit parameters (the default in versions of OpenSSL before 1.1.0) or B to use named curve form. For maximum compatibility the named curve form should be used. Note: the -B value was only added to OpenSSL 1.1.0; previous +B value was added in OpenSSL 1.1.0; previous versions should use 0 instead. =head2 ECDH parameters @@ -439,8 +439,9 @@ L =head1 HISTORY +The EVP_PKEY_CTX_set1_id(), EVP_PKEY_CTX_get1_id() and EVP_PKEY_CTX_get1_id_len() -macros were added in 1.1.1, other functions were first added to OpenSSL 1.0.0. +macros were added in 1.1.1, other functions were added in OpenSSL 1.0.0. =head1 COPYRIGHT diff --git a/doc/man3/EVP_PKEY_CTX_new.pod b/doc/man3/EVP_PKEY_CTX_new.pod index f53ba74c..a556289e 100644 --- a/doc/man3/EVP_PKEY_CTX_new.pod +++ b/doc/man3/EVP_PKEY_CTX_new.pod @@ -48,7 +48,7 @@ L =head1 HISTORY -These functions were first added to OpenSSL 1.0.0. +These functions were added in OpenSSL 1.0.0. =head1 COPYRIGHT diff --git a/doc/man3/EVP_PKEY_decrypt.pod b/doc/man3/EVP_PKEY_decrypt.pod index a7e15666..a2363af2 100644 --- a/doc/man3/EVP_PKEY_decrypt.pod +++ b/doc/man3/EVP_PKEY_decrypt.pod @@ -91,7 +91,7 @@ L =head1 HISTORY -These functions were first added to OpenSSL 1.0.0. +These functions were added in OpenSSL 1.0.0. =head1 COPYRIGHT diff --git a/doc/man3/EVP_PKEY_derive.pod b/doc/man3/EVP_PKEY_derive.pod index cfc635a1..a6747f41 100644 --- a/doc/man3/EVP_PKEY_derive.pod +++ b/doc/man3/EVP_PKEY_derive.pod @@ -89,7 +89,7 @@ L, =head1 HISTORY -These functions were first added to OpenSSL 1.0.0. +These functions were added in OpenSSL 1.0.0. =head1 COPYRIGHT diff --git a/doc/man3/EVP_PKEY_encrypt.pod b/doc/man3/EVP_PKEY_encrypt.pod index 5418a00a..1e9742de 100644 --- a/doc/man3/EVP_PKEY_encrypt.pod +++ b/doc/man3/EVP_PKEY_encrypt.pod @@ -96,7 +96,7 @@ L =head1 HISTORY -These functions were first added to OpenSSL 1.0.0. +These functions were added in OpenSSL 1.0.0. =head1 COPYRIGHT diff --git a/doc/man3/EVP_PKEY_get_default_digest_nid.pod b/doc/man3/EVP_PKEY_get_default_digest_nid.pod index ee01164d..b2098a42 100644 --- a/doc/man3/EVP_PKEY_get_default_digest_nid.pod +++ b/doc/man3/EVP_PKEY_get_default_digest_nid.pod @@ -38,7 +38,7 @@ L, =head1 HISTORY -This function was first added to OpenSSL 1.0.0. +This function was added in OpenSSL 1.0.0. =head1 COPYRIGHT diff --git a/doc/man3/EVP_PKEY_keygen.pod b/doc/man3/EVP_PKEY_keygen.pod index 36bb3d7a..439d7d11 100644 --- a/doc/man3/EVP_PKEY_keygen.pod +++ b/doc/man3/EVP_PKEY_keygen.pod @@ -189,7 +189,7 @@ L =head1 HISTORY -These functions were first added to OpenSSL 1.0.0. +These functions were added in OpenSSL 1.0.0. EVP_PKEY_check(), EVP_PKEY_public_check() and EVP_PKEY_param_check() were added in OpenSSL 1.1.1. diff --git a/doc/man3/EVP_PKEY_new.pod b/doc/man3/EVP_PKEY_new.pod index 320c0150..8b3b012b 100644 --- a/doc/man3/EVP_PKEY_new.pod +++ b/doc/man3/EVP_PKEY_new.pod @@ -114,12 +114,15 @@ L =head1 HISTORY -EVP_PKEY_new() and EVP_PKEY_free() exist in all versions of OpenSSL. +The +EVP_PKEY_new() and EVP_PKEY_free() functions exist in all versions of OpenSSL. -EVP_PKEY_up_ref() was first added to OpenSSL 1.1.0. +The EVP_PKEY_up_ref() function was added in OpenSSL 1.1.0. + +The EVP_PKEY_new_raw_private_key(), EVP_PKEY_new_raw_public_key(), EVP_PKEY_new_CMAC_key(), EVP_PKEY_new_raw_private_key() and -EVP_PKEY_get_raw_public_key() were first added to OpenSSL 1.1.1. +EVP_PKEY_get_raw_public_key() functions were added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man3/EVP_PKEY_print_private.pod b/doc/man3/EVP_PKEY_print_private.pod index 32a09576..0e8f889f 100644 --- a/doc/man3/EVP_PKEY_print_private.pod +++ b/doc/man3/EVP_PKEY_print_private.pod @@ -47,7 +47,7 @@ L =head1 HISTORY -These functions were first added to OpenSSL 1.0.0. +These functions were added in OpenSSL 1.0.0. =head1 COPYRIGHT diff --git a/doc/man3/EVP_PKEY_sign.pod b/doc/man3/EVP_PKEY_sign.pod index de49cacf..b9211b83 100644 --- a/doc/man3/EVP_PKEY_sign.pod +++ b/doc/man3/EVP_PKEY_sign.pod @@ -101,7 +101,7 @@ L =head1 HISTORY -These functions were first added to OpenSSL 1.0.0. +These functions were added in OpenSSL 1.0.0. =head1 COPYRIGHT diff --git a/doc/man3/EVP_PKEY_supports_digest_nid.pod b/doc/man3/EVP_PKEY_supports_digest_nid.pod index 8000eac8..0dfc1163 100644 --- a/doc/man3/EVP_PKEY_supports_digest_nid.pod +++ b/doc/man3/EVP_PKEY_supports_digest_nid.pod @@ -39,7 +39,7 @@ L, =head1 HISTORY -This function was first added to OpenSSL 3.0.0. +The EVP_PKEY_supports_digest_nid() function was added in OpenSSL 3.0.0. =head1 COPYRIGHT diff --git a/doc/man3/EVP_PKEY_verify.pod b/doc/man3/EVP_PKEY_verify.pod index 20a10f03..5b0d15a7 100644 --- a/doc/man3/EVP_PKEY_verify.pod +++ b/doc/man3/EVP_PKEY_verify.pod @@ -89,7 +89,7 @@ L =head1 HISTORY -These functions were first added to OpenSSL 1.0.0. +These functions were added in OpenSSL 1.0.0. =head1 COPYRIGHT diff --git a/doc/man3/EVP_PKEY_verify_recover.pod b/doc/man3/EVP_PKEY_verify_recover.pod index 1e7f2108..22538fd0 100644 --- a/doc/man3/EVP_PKEY_verify_recover.pod +++ b/doc/man3/EVP_PKEY_verify_recover.pod @@ -100,7 +100,7 @@ L =head1 HISTORY -These functions were first added to OpenSSL 1.0.0. +These functions were added in OpenSSL 1.0.0. =head1 COPYRIGHT diff --git a/doc/man3/EVP_SignInit.pod b/doc/man3/EVP_SignInit.pod index 2fcceb1c..02786d07 100644 --- a/doc/man3/EVP_SignInit.pod +++ b/doc/man3/EVP_SignInit.pod @@ -17,7 +17,7 @@ functions void EVP_SignInit(EVP_MD_CTX *ctx, const EVP_MD *type); - int EVP_PKEY_size(EVP_PKEY *pkey); + int EVP_PKEY_size(const EVP_PKEY *pkey); int EVP_PKEY_security_bits(const EVP_PKEY *pkey); =head1 DESCRIPTION diff --git a/doc/man3/OPENSSL_secure_malloc.pod b/doc/man3/OPENSSL_secure_malloc.pod index 75243226..feaa12d3 100644 --- a/doc/man3/OPENSSL_secure_malloc.pod +++ b/doc/man3/OPENSSL_secure_malloc.pod @@ -120,7 +120,7 @@ L =head1 HISTORY -OPENSSL_secure_clear_free() was added in OpenSSL 1.1.0g. +The OPENSSL_secure_clear_free() function was added in OpenSSL 1.1.0g. =head1 COPYRIGHT diff --git a/doc/man3/OSSL_STORE_INFO.pod b/doc/man3/OSSL_STORE_INFO.pod index 5bd35953..bf694749 100644 --- a/doc/man3/OSSL_STORE_INFO.pod +++ b/doc/man3/OSSL_STORE_INFO.pod @@ -190,7 +190,7 @@ OSSL_STORE_INFO_get0_CERT(), OSSL_STORE_INFO_get0_CRL(), OSSL_STORE_INFO_type_string(), OSSL_STORE_INFO_free(), OSSL_STORE_INFO_new_NAME(), OSSL_STORE_INFO_new_PARAMS(), OSSL_STORE_INFO_new_PKEY(), OSSL_STORE_INFO_new_CERT() and OSSL_STORE_INFO_new_CRL() -were added to OpenSSL 1.1.1. +were added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man3/OSSL_STORE_LOADER.pod b/doc/man3/OSSL_STORE_LOADER.pod index 7d8cbdcd..0a4d2f7a 100644 --- a/doc/man3/OSSL_STORE_LOADER.pod +++ b/doc/man3/OSSL_STORE_LOADER.pod @@ -250,7 +250,7 @@ OSSL_STORE_LOADER_set_eof(), OSSL_STORE_LOADER_set_close(), OSSL_STORE_LOADER_free(), OSSL_STORE_register_loader(), OSSL_STORE_unregister_loader(), OSSL_STORE_open_fn(), OSSL_STORE_ctrl_fn(), OSSL_STORE_load_fn(), OSSL_STORE_eof_fn() and OSSL_STORE_close_fn() -were added to OpenSSL 1.1.1. +were added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man3/OSSL_STORE_SEARCH.pod b/doc/man3/OSSL_STORE_SEARCH.pod index de166f8f..7dc84227 100644 --- a/doc/man3/OSSL_STORE_SEARCH.pod +++ b/doc/man3/OSSL_STORE_SEARCH.pod @@ -179,7 +179,7 @@ OSSL_STORE_SEARCH_get0_name(), OSSL_STORE_SEARCH_get0_serial(), OSSL_STORE_SEARCH_get0_bytes(), and OSSL_STORE_SEARCH_get0_string() -were added to OpenSSL 1.1.1. +were added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man3/OSSL_STORE_expect.pod b/doc/man3/OSSL_STORE_expect.pod index ae9b0e24..05d6ea35 100644 --- a/doc/man3/OSSL_STORE_expect.pod +++ b/doc/man3/OSSL_STORE_expect.pod @@ -65,7 +65,7 @@ L =head1 HISTORY OSSL_STORE_expect(), OSSL_STORE_supports_search() and OSSL_STORE_find() -were added to OpenSSL 1.1.1. +were added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man3/OSSL_STORE_open.pod b/doc/man3/OSSL_STORE_open.pod index 3053410f..be61ad5b 100644 --- a/doc/man3/OSSL_STORE_open.pod +++ b/doc/man3/OSSL_STORE_open.pod @@ -147,7 +147,7 @@ L OSSL_STORE_CTX(), OSSL_STORE_post_process_info_fn(), OSSL_STORE_open(), OSSL_STORE_ctrl(), OSSL_STORE_load(), OSSL_STORE_eof() and OSSL_STORE_close() -were added to OpenSSL 1.1.1. +were added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man3/OpenSSL_version.pod b/doc/man3/OpenSSL_version.pod index f2e56441..679273e6 100644 --- a/doc/man3/OpenSSL_version.pod +++ b/doc/man3/OpenSSL_version.pod @@ -176,7 +176,7 @@ L =head1 HISTORY -The macros and functions described here were added to OpenSSL 3.0.0, +The macros and functions described here were added in OpenSSL 3.0.0, with the exception of the L ones. =head1 COPYRIGHT diff --git a/doc/man3/PEM_read_bio_ex.pod b/doc/man3/PEM_read_bio_ex.pod index 2ade8f2a..761fe2c0 100644 --- a/doc/man3/PEM_read_bio_ex.pod +++ b/doc/man3/PEM_read_bio_ex.pod @@ -56,7 +56,7 @@ L =head1 HISTORY -PEM_read_bio_ex() was added in OpenSSL 1.1.1. +The PEM_read_bio_ex() function was added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man3/PEM_write_bio_CMS_stream.pod b/doc/man3/PEM_write_bio_CMS_stream.pod index cdae89ed..f555b259 100644 --- a/doc/man3/PEM_write_bio_CMS_stream.pod +++ b/doc/man3/PEM_write_bio_CMS_stream.pod @@ -36,7 +36,7 @@ L =head1 HISTORY -PEM_write_bio_CMS_stream() was added to OpenSSL 1.0.0 +The PEM_write_bio_CMS_stream() function was added in OpenSSL 1.0.0. =head1 COPYRIGHT diff --git a/doc/man3/PEM_write_bio_PKCS7_stream.pod b/doc/man3/PEM_write_bio_PKCS7_stream.pod index 52beab95..badc5397 100644 --- a/doc/man3/PEM_write_bio_PKCS7_stream.pod +++ b/doc/man3/PEM_write_bio_PKCS7_stream.pod @@ -35,7 +35,7 @@ L =head1 HISTORY -PEM_write_bio_PKCS7_stream() was added to OpenSSL 1.0.0 +The PEM_write_bio_PKCS7_stream() function was added in OpenSSL 1.0.0. =head1 COPYRIGHT diff --git a/doc/man3/PKCS7_sign.pod b/doc/man3/PKCS7_sign.pod index bfff65e1..4a14aac7 100644 --- a/doc/man3/PKCS7_sign.pod +++ b/doc/man3/PKCS7_sign.pod @@ -108,9 +108,9 @@ L, L =head1 HISTORY The B flag, and the ability for B, B, -and B parameters to be B to be was added in OpenSSL 1.0.0 +and B parameters to be B were added in OpenSSL 1.0.0. -The B flag was added in OpenSSL 1.0.0 +The B flag was added in OpenSSL 1.0.0. =head1 COPYRIGHT diff --git a/doc/man3/PKCS7_sign_add_signer.pod b/doc/man3/PKCS7_sign_add_signer.pod index 0a27f30b..30f113b7 100644 --- a/doc/man3/PKCS7_sign_add_signer.pod +++ b/doc/man3/PKCS7_sign_add_signer.pod @@ -83,7 +83,7 @@ L, =head1 HISTORY -PPKCS7_sign_add_signer() was added to OpenSSL 1.0.0 +The PPKCS7_sign_add_signer() function was added in OpenSSL 1.0.0. =head1 COPYRIGHT diff --git a/doc/man3/RAND_bytes.pod b/doc/man3/RAND_bytes.pod index 7407deeb..86d37b3f 100644 --- a/doc/man3/RAND_bytes.pod +++ b/doc/man3/RAND_bytes.pod @@ -53,7 +53,7 @@ RAND_pseudo_bytes() was deprecated in OpenSSL 1.1.0; use RAND_bytes() instead. =item * -RAND_priv_bytes() was added in OpenSSL 1.1.1. +The RAND_priv_bytes() function was added in OpenSSL 1.1.1. =back diff --git a/doc/man3/RSA_get0_key.pod b/doc/man3/RSA_get0_key.pod index b8262ea8..8515f6ed 100644 --- a/doc/man3/RSA_get0_key.pod +++ b/doc/man3/RSA_get0_key.pod @@ -157,6 +157,7 @@ L, L =head1 HISTORY +The RSA_get_multi_prime_extra_count(), RSA_get0_multi_prime_factors(), RSA_get0_multi_prime_crt_params(), RSA_set0_multi_prime_params(), and RSA_get_version() functions were added in OpenSSL 1.1.1. diff --git a/doc/man3/RSA_size.pod b/doc/man3/RSA_size.pod index b087ece3..ccc11ba7 100644 --- a/doc/man3/RSA_size.pod +++ b/doc/man3/RSA_size.pod @@ -41,7 +41,7 @@ L =head1 HISTORY -RSA_bits() was added in OpenSSL 1.1.0. +The RSA_bits() function was added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man3/SRP_VBASE_new.pod b/doc/man3/SRP_VBASE_new.pod index 4c26f432..d780cf24 100644 --- a/doc/man3/SRP_VBASE_new.pod +++ b/doc/man3/SRP_VBASE_new.pod @@ -83,9 +83,9 @@ L =head1 HISTORY -SRP_VBASE_add0_user() was first added to OpenSSL 1.2.0. +The SRP_VBASE_add0_user() function was added in OpenSSL 3.0.0. -All other functions were first added to OpenSSL 1.0.1. +All other functions were added in OpenSSL 1.0.1. =head1 COPYRIGHT diff --git a/doc/man3/SRP_create_verifier.pod b/doc/man3/SRP_create_verifier.pod index 133b002c..facb530c 100644 --- a/doc/man3/SRP_create_verifier.pod +++ b/doc/man3/SRP_create_verifier.pod @@ -96,7 +96,7 @@ L =head1 HISTORY -These functions were first added to OpenSSL 1.0.1. +These functions were added in OpenSSL 1.0.1. =head1 COPYRIGHT diff --git a/doc/man3/SRP_user_pwd_new.pod b/doc/man3/SRP_user_pwd_new.pod index 3a0363fb..b1799d17 100644 --- a/doc/man3/SRP_user_pwd_new.pod +++ b/doc/man3/SRP_user_pwd_new.pod @@ -56,7 +56,7 @@ L =head1 HISTORY -These functions were made public in OpenSSL 1.2.0. +These functions were made public in OpenSSL 3.0.0. =head1 COPYRIGHT diff --git a/doc/man3/SSL_CIPHER_get_name.pod b/doc/man3/SSL_CIPHER_get_name.pod index 94240eb6..51c3941f 100644 --- a/doc/man3/SSL_CIPHER_get_name.pod +++ b/doc/man3/SSL_CIPHER_get_name.pod @@ -179,19 +179,19 @@ protocol-specific ID. =head1 HISTORY -SSL_CIPHER_get_version() was updated to always return the correct protocol -string in OpenSSL 1.1.0. +The SSL_CIPHER_get_version() function was updated to always return the +correct protocol string in OpenSSL 1.1.0. -SSL_CIPHER_description() was changed to return B on error, +The SSL_CIPHER_description() function was changed to return B on error, rather than a fixed string, in OpenSSL 1.1.0. -SSL_CIPHER_get_handshake_digest() was added in OpenSSL 1.1.1. +The SSL_CIPHER_get_handshake_digest() function was added in OpenSSL 1.1.1. -SSL_CIPHER_standard_name() was globally available in OpenSSL 1.1.1. Before -OpenSSL 1.1.1, tracing (B argument to Configure) was +The SSL_CIPHER_standard_name() function was globally available in OpenSSL 1.1.1. + Before OpenSSL 1.1.1, tracing (B argument to Configure) was required to enable this function. -OPENSSL_cipher_name() was added in OpenSSL 1.1.1. +The OPENSSL_cipher_name() function was added in OpenSSL 1.1.1. =head1 SEE ALSO diff --git a/doc/man3/SSL_COMP_add_compression_method.pod b/doc/man3/SSL_COMP_add_compression_method.pod index baf3c658..51d4c748 100644 --- a/doc/man3/SSL_COMP_add_compression_method.pod +++ b/doc/man3/SSL_COMP_add_compression_method.pod @@ -91,9 +91,8 @@ L =head1 HISTORY -SSL_COMP_free_compression_methods() was deprecated in OpenSSL 1.1.0; -do not use it. -SSL_COMP_get0_name() and SSL_comp_get_id() were added in OpenSSL 1.1.0d. +The SSL_COMP_free_compression_methods() function was deprecated in OpenSSL 1.1.0. +The SSL_COMP_get0_name() and SSL_comp_get_id() functions were added in OpenSSL 1.1.0d. =head1 COPYRIGHT diff --git a/doc/man3/SSL_CONF_CTX_new.pod b/doc/man3/SSL_CONF_CTX_new.pod index 9c2b3b39..e3f4eedd 100644 --- a/doc/man3/SSL_CONF_CTX_new.pod +++ b/doc/man3/SSL_CONF_CTX_new.pod @@ -36,7 +36,7 @@ L =head1 HISTORY -These functions were first added to OpenSSL 1.0.2 +These functions were added in OpenSSL 1.0.2. =head1 COPYRIGHT diff --git a/doc/man3/SSL_CONF_CTX_set1_prefix.pod b/doc/man3/SSL_CONF_CTX_set1_prefix.pod index 7af6634f..a4bda537 100644 --- a/doc/man3/SSL_CONF_CTX_set1_prefix.pod +++ b/doc/man3/SSL_CONF_CTX_set1_prefix.pod @@ -44,7 +44,7 @@ L =head1 HISTORY -These functions were first added to OpenSSL 1.0.2 +These functions were added in OpenSSL 1.0.2. =head1 COPYRIGHT diff --git a/doc/man3/SSL_CONF_CTX_set_flags.pod b/doc/man3/SSL_CONF_CTX_set_flags.pod index e57c0880..56c01ed2 100644 --- a/doc/man3/SSL_CONF_CTX_set_flags.pod +++ b/doc/man3/SSL_CONF_CTX_set_flags.pod @@ -70,7 +70,7 @@ L =head1 HISTORY -These functions were first added to OpenSSL 1.0.2 +These functions were added in OpenSSL 1.0.2. =head1 COPYRIGHT diff --git a/doc/man3/SSL_CONF_CTX_set_ssl_ctx.pod b/doc/man3/SSL_CONF_CTX_set_ssl_ctx.pod index 9c769c23..a1e77803 100644 --- a/doc/man3/SSL_CONF_CTX_set_ssl_ctx.pod +++ b/doc/man3/SSL_CONF_CTX_set_ssl_ctx.pod @@ -42,7 +42,7 @@ L =head1 HISTORY -These functions were first added to OpenSSL 1.0.2 +These functions were added in OpenSSL 1.0.2. =head1 COPYRIGHT diff --git a/doc/man3/SSL_CONF_cmd.pod b/doc/man3/SSL_CONF_cmd.pod index 9348b129..0a51e9ed 100644 --- a/doc/man3/SSL_CONF_cmd.pod +++ b/doc/man3/SSL_CONF_cmd.pod @@ -670,12 +670,12 @@ L =head1 HISTORY -SSL_CONF_cmd() was first added to OpenSSL 1.0.2 +The SSL_CONF_cmd() function was added in OpenSSL 1.0.2. -B doesn't have effect since 1.1.0, but the macro is retained -for backwards compatibility. +The B option doesn't have effect since 1.1.0, but the macro +is retained for backwards compatibility. -B was first added to OpenSSL 1.1.0. In earlier versions of +The B was added in OpenSSL 1.1.0. In earlier versions of OpenSSL passing a command which didn't take an argument would return B. diff --git a/doc/man3/SSL_CONF_cmd_argv.pod b/doc/man3/SSL_CONF_cmd_argv.pod index 34fa2184..6f8879a8 100644 --- a/doc/man3/SSL_CONF_cmd_argv.pod +++ b/doc/man3/SSL_CONF_cmd_argv.pod @@ -37,7 +37,7 @@ L =head1 HISTORY -These functions were first added to OpenSSL 1.0.2 +These functions were added in OpenSSL 1.0.2. =head1 COPYRIGHT diff --git a/doc/man3/SSL_CTX_add1_chain_cert.pod b/doc/man3/SSL_CTX_add1_chain_cert.pod index af83d056..b4bca729 100644 --- a/doc/man3/SSL_CTX_add1_chain_cert.pod +++ b/doc/man3/SSL_CTX_add1_chain_cert.pod @@ -144,7 +144,7 @@ L =head1 HISTORY -These functions were first added to OpenSSL 1.0.2. +These functions were added in OpenSSL 1.0.2. =head1 COPYRIGHT diff --git a/doc/man3/SSL_CTX_config.pod b/doc/man3/SSL_CTX_config.pod index f18e4dc0..a05009e5 100644 --- a/doc/man3/SSL_CTX_config.pod +++ b/doc/man3/SSL_CTX_config.pod @@ -77,7 +77,7 @@ L =head1 HISTORY -SSL_CTX_config() and SSL_config() were first added to OpenSSL 1.1.0 +The SSL_CTX_config() and SSL_config() functions were added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man3/SSL_CTX_dane_enable.pod b/doc/man3/SSL_CTX_dane_enable.pod index 48663e90..f051c5a3 100644 --- a/doc/man3/SSL_CTX_dane_enable.pod +++ b/doc/man3/SSL_CTX_dane_enable.pod @@ -368,7 +368,7 @@ L =head1 HISTORY -These functions were first added to OpenSSL 1.1.0. +These functions were added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man3/SSL_CTX_get0_param.pod b/doc/man3/SSL_CTX_get0_param.pod index 444f3e1d..ff970645 100644 --- a/doc/man3/SSL_CTX_get0_param.pod +++ b/doc/man3/SSL_CTX_get0_param.pod @@ -50,7 +50,7 @@ L =head1 HISTORY -These functions were first added to OpenSSL 1.0.2. +These functions were added in OpenSSL 1.0.2. =head1 COPYRIGHT diff --git a/doc/man3/SSL_CTX_set1_curves.pod b/doc/man3/SSL_CTX_set1_curves.pod index eee7591a..b6f647e9 100644 --- a/doc/man3/SSL_CTX_set1_curves.pod +++ b/doc/man3/SSL_CTX_set1_curves.pod @@ -97,8 +97,8 @@ L =head1 HISTORY -The curve functions were first added to OpenSSL 1.0.2. The equivalent group -functions were first added to OpenSSL 1.1.1. +The curve functions were added in OpenSSL 1.0.2. The equivalent group +functions were added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man3/SSL_CTX_set1_verify_cert_store.pod b/doc/man3/SSL_CTX_set1_verify_cert_store.pod index 4484af39..c712553e 100644 --- a/doc/man3/SSL_CTX_set1_verify_cert_store.pod +++ b/doc/man3/SSL_CTX_set1_verify_cert_store.pod @@ -86,7 +86,7 @@ L =head1 HISTORY -These functions were first added to OpenSSL 1.0.2. +These functions were added in OpenSSL 1.0.2. =head1 COPYRIGHT diff --git a/doc/man3/SSL_CTX_set_default_passwd_cb.pod b/doc/man3/SSL_CTX_set_default_passwd_cb.pod index b74e0755..4d381648 100644 --- a/doc/man3/SSL_CTX_set_default_passwd_cb.pod +++ b/doc/man3/SSL_CTX_set_default_passwd_cb.pod @@ -94,7 +94,7 @@ truncated. SSL_CTX_get_default_passwd_cb(), SSL_CTX_get_default_passwd_cb_userdata(), SSL_set_default_passwd_cb() and SSL_set_default_passwd_cb_userdata() were -first added to OpenSSL 1.1.0 +added in OpenSSL 1.1.0. =head1 SEE ALSO diff --git a/doc/man3/SSL_CTX_set_mode.pod b/doc/man3/SSL_CTX_set_mode.pod index de4d5f26..06e9a29c 100644 --- a/doc/man3/SSL_CTX_set_mode.pod +++ b/doc/man3/SSL_CTX_set_mode.pod @@ -140,8 +140,8 @@ L, L =head1 HISTORY -SSL_MODE_ASYNC was first added to OpenSSL 1.1.0. -SSL_MODE_NO_KTLS_TX was first added to OpenSSL 3.0.0. +SSL_MODE_ASYNC was added in OpenSSL 1.1.0. +SSL_MODE_NO_KTLS_TX was added in OpenSSL 3.0.0. =head1 COPYRIGHT diff --git a/doc/man3/SSL_CTX_set_msg_callback.pod b/doc/man3/SSL_CTX_set_msg_callback.pod index 6055fe5d..9f7a1743 100644 --- a/doc/man3/SSL_CTX_set_msg_callback.pod +++ b/doc/man3/SSL_CTX_set_msg_callback.pod @@ -128,8 +128,7 @@ L, L =head1 HISTORY -The pseudo content type B was added in OpenSSL -1.1.1. +The pseudo content type B was added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man3/SSL_CTX_set_options.pod b/doc/man3/SSL_CTX_set_options.pod index 0b474d89..63d3aae9 100644 --- a/doc/man3/SSL_CTX_set_options.pod +++ b/doc/man3/SSL_CTX_set_options.pod @@ -361,10 +361,10 @@ L =head1 HISTORY The attempt to always try to use secure renegotiation was added in -Openssl 0.9.8m. +OpenSSL 0.9.8m. -B and B were added in -OpenSSL 1.1.1. +The B and B options +were added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man3/SSL_CTX_set_security_level.pod b/doc/man3/SSL_CTX_set_security_level.pod index 26e1eb91..600e47c1 100644 --- a/doc/man3/SSL_CTX_set_security_level.pod +++ b/doc/man3/SSL_CTX_set_security_level.pod @@ -176,7 +176,7 @@ data pointer or NULL if the ex data is not set. =head1 HISTORY -These functions were first added to OpenSSL 1.1.0 +These functions were added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man3/SSL_CTX_set_session_ticket_cb.pod b/doc/man3/SSL_CTX_set_session_ticket_cb.pod index 84029472..409dfc6e 100644 --- a/doc/man3/SSL_CTX_set_session_ticket_cb.pod +++ b/doc/man3/SSL_CTX_set_session_ticket_cb.pod @@ -177,8 +177,8 @@ L =head1 HISTORY -SSL_CTX_set_session_ticket_cb(), SSSL_SESSION_set1_ticket_appdata() and -SSL_SESSION_get_ticket_appdata() were added to OpenSSL 1.1.1. +The SSL_CTX_set_session_ticket_cb(), SSSL_SESSION_set1_ticket_appdata() +and SSL_SESSION_get_ticket_appdata() functions were added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man3/SSL_CTX_set_split_send_fragment.pod b/doc/man3/SSL_CTX_set_split_send_fragment.pod index 69ce3311..cf595eef 100644 --- a/doc/man3/SSL_CTX_set_split_send_fragment.pod +++ b/doc/man3/SSL_CTX_set_split_send_fragment.pod @@ -169,8 +169,8 @@ SSL_CTX_set_split_send_fragment(), SSL_set_split_send_fragment(), SSL_CTX_set_default_read_buffer_len() and SSL_set_default_read_buffer_len() functions were added in OpenSSL 1.1.0. -SSL_CTX_set_tlsext_max_fragment_length(), SSL_set_tlsext_max_fragment_length() -and SSL_SESSION_get_max_fragment_length() were added in OpenSSL 1.1.1. +The SSL_CTX_set_tlsext_max_fragment_length(), SSL_set_tlsext_max_fragment_length() +and SSL_SESSION_get_max_fragment_length() functions were added in OpenSSL 1.1.1. =head1 SEE ALSO diff --git a/doc/man3/SSL_CTX_set_srp_password.pod b/doc/man3/SSL_CTX_set_srp_password.pod index 3d845d46..0936885f 100644 --- a/doc/man3/SSL_CTX_set_srp_password.pod +++ b/doc/man3/SSL_CTX_set_srp_password.pod @@ -202,7 +202,7 @@ L =head1 HISTORY -These functions were first added to OpenSSL 1.0.1. +These functions were added in OpenSSL 1.0.1. =head1 COPYRIGHT diff --git a/doc/man3/SSL_CTX_set_tlsext_status_cb.pod b/doc/man3/SSL_CTX_set_tlsext_status_cb.pod index 6e3eaae1..c791b466 100644 --- a/doc/man3/SSL_CTX_set_tlsext_status_cb.pod +++ b/doc/man3/SSL_CTX_set_tlsext_status_cb.pod @@ -108,8 +108,8 @@ side if the client requested OCSP stapling. Otherwise -1 is returned. =head1 HISTORY -SSL_get_tlsext_status_type(), SSL_CTX_get_tlsext_status_type() and -SSL_CTX_set_tlsext_status_type() were added in OpenSSL 1.1.0. +The SSL_get_tlsext_status_type(), SSL_CTX_get_tlsext_status_type() +and SSL_CTX_set_tlsext_status_type() functions were added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man3/SSL_SESSION_free.pod b/doc/man3/SSL_SESSION_free.pod index 4ff390ce..10fc8e95 100644 --- a/doc/man3/SSL_SESSION_free.pod +++ b/doc/man3/SSL_SESSION_free.pod @@ -73,7 +73,7 @@ L =head1 HISTORY -SSL_SESSION_dup() was added in OpenSSL 1.1.1. +The SSL_SESSION_dup() function was added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man3/SSL_SESSION_get0_cipher.pod b/doc/man3/SSL_SESSION_get0_cipher.pod index 09970d28..3883a6fa 100644 --- a/doc/man3/SSL_SESSION_get0_cipher.pod +++ b/doc/man3/SSL_SESSION_get0_cipher.pod @@ -43,8 +43,8 @@ L =head1 HISTORY -SSL_SESSION_get0_cipher() was first added to OpenSSL 1.1.0. -SSL_SESSION_set_cipher() was first added to OpenSSL 1.1.1. +The SSL_SESSION_get0_cipher() function was added in OpenSSL 1.1.0. +The SSL_SESSION_set_cipher() function was added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man3/SSL_SESSION_get0_hostname.pod b/doc/man3/SSL_SESSION_get0_hostname.pod index 8545864e..f54a21d8 100644 --- a/doc/man3/SSL_SESSION_get0_hostname.pod +++ b/doc/man3/SSL_SESSION_get0_hostname.pod @@ -59,8 +59,8 @@ L =head1 HISTORY -SSL_SESSION_set1_hostname(), SSL_SESSION_get0_alpn_selected() and -SSL_SESSION_set1_alpn_selected() were added in OpenSSL 1.1.1. +The SSL_SESSION_set1_hostname(), SSL_SESSION_get0_alpn_selected() and +SSL_SESSION_set1_alpn_selected() functions were added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man3/SSL_SESSION_get0_id_context.pod b/doc/man3/SSL_SESSION_get0_id_context.pod index a09d60e5..2929fbb7 100644 --- a/doc/man3/SSL_SESSION_get0_id_context.pod +++ b/doc/man3/SSL_SESSION_get0_id_context.pod @@ -42,7 +42,7 @@ L =head1 HISTORY -SSL_SESSION_get0_id_context() was first added to OpenSSL 1.1.0 +The SSL_SESSION_get0_id_context() function was added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man3/SSL_SESSION_get_protocol_version.pod b/doc/man3/SSL_SESSION_get_protocol_version.pod index 2c27041e..b8b9b5aa 100644 --- a/doc/man3/SSL_SESSION_get_protocol_version.pod +++ b/doc/man3/SSL_SESSION_get_protocol_version.pod @@ -41,8 +41,8 @@ L =head1 HISTORY -SSL_SESSION_get_protocol_version() was first added to OpenSSL 1.1.0. -SSL_SESSION_set_protocol_version() was first added to OpenSSL 1.1.1. +The SSL_SESSION_get_protocol_version() function was added in OpenSSL 1.1.0. +The SSL_SESSION_set_protocol_version() function was added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man3/SSL_SESSION_has_ticket.pod b/doc/man3/SSL_SESSION_has_ticket.pod index 7eec27c8..b4849d3a 100644 --- a/doc/man3/SSL_SESSION_has_ticket.pod +++ b/doc/man3/SSL_SESSION_has_ticket.pod @@ -44,8 +44,8 @@ L =head1 HISTORY -SSL_SESSION_has_ticket, SSL_SESSION_get_ticket_lifetime_hint and -SSL_SESSION_get0_ticket were added in OpenSSL 1.1.0. +The SSL_SESSION_has_ticket(), SSL_SESSION_get_ticket_lifetime_hint() +and SSL_SESSION_get0_ticket() functions were added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man3/SSL_SESSION_is_resumable.pod b/doc/man3/SSL_SESSION_is_resumable.pod index 325ec390..6df7ed75 100644 --- a/doc/man3/SSL_SESSION_is_resumable.pod +++ b/doc/man3/SSL_SESSION_is_resumable.pod @@ -30,7 +30,7 @@ L =head1 HISTORY -SSL_SESSION_is_resumable() was first added to OpenSSL 1.1.1 +The SSL_SESSION_is_resumable() function was added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man3/SSL_SESSION_set1_id.pod b/doc/man3/SSL_SESSION_set1_id.pod index 1e79f9cc..14e27656 100644 --- a/doc/man3/SSL_SESSION_set1_id.pod +++ b/doc/man3/SSL_SESSION_set1_id.pod @@ -36,7 +36,7 @@ L =head1 HISTORY -SSL_SESSION_set1_id() was first added to OpenSSL 1.1.0 +The SSL_SESSION_set1_id() function was added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man3/SSL_export_keying_material.pod b/doc/man3/SSL_export_keying_material.pod index e483b26f..5a9c4a6e 100644 --- a/doc/man3/SSL_export_keying_material.pod +++ b/doc/man3/SSL_export_keying_material.pod @@ -73,7 +73,7 @@ SSL_export_keying_material_early() returns 0 on failure or 1 on success. =head1 HISTORY -SSL_export_keying_material_early() was first added in OpenSSL 1.1.1. +The SSL_export_keying_material_early() function was added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man3/SSL_extension_supported.pod b/doc/man3/SSL_extension_supported.pod index 39039fc9..3f974342 100644 --- a/doc/man3/SSL_extension_supported.pod +++ b/doc/man3/SSL_extension_supported.pod @@ -277,7 +277,7 @@ internally by OpenSSL and 0 otherwise. =head1 HISTORY -The function SSL_CTX_add_custom_ext() was added in OpenSSL 1.1.1. +The SSL_CTX_add_custom_ext() function was added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man3/SSL_get_all_async_fds.pod b/doc/man3/SSL_get_all_async_fds.pod index 77515feb..a3e17a68 100644 --- a/doc/man3/SSL_get_all_async_fds.pod +++ b/doc/man3/SSL_get_all_async_fds.pod @@ -73,8 +73,8 @@ L, L =head1 HISTORY -SSL_waiting_for_async(), SSL_get_all_async_fds() and SSL_get_changed_async_fds() -were first added to OpenSSL 1.1.0. +The SSL_waiting_for_async(), SSL_get_all_async_fds() +and SSL_get_changed_async_fds() functions were added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man3/SSL_get_error.pod b/doc/man3/SSL_get_error.pod index a24e83cc..876aac7b 100644 --- a/doc/man3/SSL_get_error.pod +++ b/doc/man3/SSL_get_error.pod @@ -158,8 +158,8 @@ L =head1 HISTORY -SSL_ERROR_WANT_ASYNC was added in OpenSSL 1.1.0. -SSL_ERROR_WANT_CLIENT_HELLO_CB was added in OpenSSL 1.1.1. +The SSL_ERROR_WANT_ASYNC error code was added in OpenSSL 1.1.0. +The SSL_ERROR_WANT_CLIENT_HELLO_CB error code was added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man3/SSL_get_version.pod b/doc/man3/SSL_get_version.pod index 9a5935aa..d1292774 100644 --- a/doc/man3/SSL_get_version.pod +++ b/doc/man3/SSL_get_version.pod @@ -97,7 +97,7 @@ L =head1 HISTORY -SSL_is_dtls() was added in OpenSSL 1.1.0. +The SSL_is_dtls() function was added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man3/SSL_read.pod b/doc/man3/SSL_read.pod index ebdd86ac..c60bd230 100644 --- a/doc/man3/SSL_read.pod +++ b/doc/man3/SSL_read.pod @@ -128,7 +128,7 @@ You should instead call SSL_get_error() to find out if it's retryable. =head1 HISTORY -SSL_read_ex() and SSL_peek_ex() were added in OpenSSL 1.1.1. +The SSL_read_ex() and SSL_peek_ex() functions were added in OpenSSL 1.1.1. =head1 SEE ALSO diff --git a/doc/man3/SSL_set1_host.pod b/doc/man3/SSL_set1_host.pod index 97661126..3fc6ec37 100644 --- a/doc/man3/SSL_set1_host.pod +++ b/doc/man3/SSL_set1_host.pod @@ -104,7 +104,7 @@ L. =head1 HISTORY -These functions were first added to OpenSSL 1.1.0. +These functions were added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man3/SSL_want.pod b/doc/man3/SSL_want.pod index 6d649852..6fce429b 100644 --- a/doc/man3/SSL_want.pod +++ b/doc/man3/SSL_want.pod @@ -101,7 +101,8 @@ L, L =head1 HISTORY -SSL_want_client_hello_cb() and SSL_CLIENT_HELLO_CB were added in OpenSSL 1.1.1. +The SSL_want_client_hello_cb() function and the SSL_CLIENT_HELLO_CB return value +were added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man3/SSL_write.pod b/doc/man3/SSL_write.pod index c5b239ce..4daaec2d 100644 --- a/doc/man3/SSL_write.pod +++ b/doc/man3/SSL_write.pod @@ -106,7 +106,7 @@ You should instead call SSL_get_error() to find out if it's retryable. =head1 HISTORY -SSL_write_ex() was added in OpenSSL 1.1.1. +The SSL_write_ex() function was added in OpenSSL 1.1.1. =head1 SEE ALSO diff --git a/doc/man3/UI_create_method.pod b/doc/man3/UI_create_method.pod index 0cfb9d5c..5508446d 100644 --- a/doc/man3/UI_create_method.pod +++ b/doc/man3/UI_create_method.pod @@ -205,9 +205,8 @@ L, L, L =head1 HISTORY -UI_method_set_data_duplicator(), UI_method_get_data_duplicator() and -UI_method_get_data_destructor() -were added in OpenSSL 1.1.1. +The UI_method_set_data_duplicator(), UI_method_get_data_duplicator() +and UI_method_get_data_destructor() functions were added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man3/UI_new.pod b/doc/man3/UI_new.pod index 025a935f..09cbd13f 100644 --- a/doc/man3/UI_new.pod +++ b/doc/man3/UI_new.pod @@ -233,14 +233,13 @@ UI_process() returns 0 on success or a negative value on error. UI_ctrl() returns a mask on success or -1 on error. -UI_get_default_method(), UI_get_method(), UI_Openssl(), UI_null() and +UI_get_default_method(), UI_get_method(), UI_OpenSSL(), UI_null() and UI_set_method() return either a valid B structure or NULL respectively. =head1 HISTORY -UI_dup_user_data() -was added in OpenSSL 1.1.1. +The UI_dup_user_data() function was added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man3/X509_NAME_ENTRY_get_object.pod b/doc/man3/X509_NAME_ENTRY_get_object.pod index 1530e787..7533a586 100644 --- a/doc/man3/X509_NAME_ENTRY_get_object.pod +++ b/doc/man3/X509_NAME_ENTRY_get_object.pod @@ -51,9 +51,6 @@ X509_NAME_ENTRY_get_object() and X509_NAME_ENTRY_get_data() can be used to examine an B function as returned by X509_NAME_get_entry() for example. -X509_NAME_ENTRY_create_by_txt(), X509_NAME_ENTRY_create_by_NID(), -and X509_NAME_ENTRY_create_by_OBJ() create and return an - X509_NAME_ENTRY_create_by_txt(), X509_NAME_ENTRY_create_by_OBJ(), X509_NAME_ENTRY_create_by_NID() and X509_NAME_ENTRY_set_data() are seldom used in practice because B structures diff --git a/doc/man3/X509_STORE_CTX_new.pod b/doc/man3/X509_STORE_CTX_new.pod index 3feb5176..89e548dc 100644 --- a/doc/man3/X509_STORE_CTX_new.pod +++ b/doc/man3/X509_STORE_CTX_new.pod @@ -159,8 +159,8 @@ L =head1 HISTORY -X509_STORE_CTX_set0_crls() was first added to OpenSSL 1.0.0 -X509_STORE_CTX_get_num_untrusted() was first added to OpenSSL 1.1.0 +The X509_STORE_CTX_set0_crls() function was added in OpenSSL 1.0.0. +The X509_STORE_CTX_get_num_untrusted() function was added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man3/X509_STORE_CTX_set_verify_cb.pod b/doc/man3/X509_STORE_CTX_set_verify_cb.pod index 731acb77..6e462467 100644 --- a/doc/man3/X509_STORE_CTX_set_verify_cb.pod +++ b/doc/man3/X509_STORE_CTX_set_verify_cb.pod @@ -192,12 +192,13 @@ L =head1 HISTORY +The X509_STORE_CTX_get_get_issuer(), X509_STORE_CTX_get_check_issued(), X509_STORE_CTX_get_check_revocation(), X509_STORE_CTX_get_get_crl(), X509_STORE_CTX_get_check_crl(), X509_STORE_CTX_get_cert_crl(), X509_STORE_CTX_get_check_policy(), X509_STORE_CTX_get_lookup_certs(), X509_STORE_CTX_get_lookup_crls() -and X509_STORE_CTX_get_cleanup() were added in OpenSSL 1.1.0. +and X509_STORE_CTX_get_cleanup() functions were added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man3/X509_STORE_new.pod b/doc/man3/X509_STORE_new.pod index ee4ca02f..1ef3a71b 100644 --- a/doc/man3/X509_STORE_new.pod +++ b/doc/man3/X509_STORE_new.pod @@ -44,7 +44,7 @@ L =head1 HISTORY The X509_STORE_up_ref(), X509_STORE_lock() and X509_STORE_unlock() -functions were added in OpenSSL 1.1.0 +functions were added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man3/X509_STORE_set_verify_cb_func.pod b/doc/man3/X509_STORE_set_verify_cb_func.pod index 2590b533..b6069a3b 100644 --- a/doc/man3/X509_STORE_set_verify_cb_func.pod +++ b/doc/man3/X509_STORE_set_verify_cb_func.pod @@ -237,8 +237,9 @@ L =head1 HISTORY -X509_STORE_set_verify_cb() was added to OpenSSL 1.0.0. +The X509_STORE_set_verify_cb() function was added in OpenSSL 1.0.0. +The functions X509_STORE_set_verify_cb(), X509_STORE_get_verify_cb(), X509_STORE_set_verify(), X509_STORE_CTX_get_verify(), X509_STORE_set_get_issuer(), X509_STORE_get_get_issuer(), @@ -250,8 +251,8 @@ X509_STORE_set_cert_crl(), X509_STORE_get_cert_crl(), X509_STORE_set_check_policy(), X509_STORE_get_check_policy(), X509_STORE_set_lookup_certs(), X509_STORE_get_lookup_certs(), X509_STORE_set_lookup_crls(), X509_STORE_get_lookup_crls(), -X509_STORE_set_cleanup() and X509_STORE_get_cleanup() were added in -OpenSSL 1.1.0. +X509_STORE_set_cleanup() and X509_STORE_get_cleanup() +were added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man3/X509_VERIFY_PARAM_set_flags.pod b/doc/man3/X509_VERIFY_PARAM_set_flags.pod index 5f490441..d8ee7f67 100644 --- a/doc/man3/X509_VERIFY_PARAM_set_flags.pod +++ b/doc/man3/X509_VERIFY_PARAM_set_flags.pod @@ -368,11 +368,11 @@ L =head1 HISTORY -The B flag was added in OpenSSL 1.1.0 -The flag B was deprecated in -OpenSSL 1.1.0, and has no effect. +The B flag was added in OpenSSL 1.1.0. +The flag B was deprecated in OpenSSL 1.1.0 +and has no effect. -X509_VERIFY_PARAM_get_hostflags() was added in OpenSSL 1.1.0i. +The X509_VERIFY_PARAM_get_hostflags() function was added in OpenSSL 1.1.0i. =head1 COPYRIGHT diff --git a/doc/man3/X509_get0_signature.pod b/doc/man3/X509_get0_signature.pod index 96695ce4..eb3ebd1c 100644 --- a/doc/man3/X509_get0_signature.pod +++ b/doc/man3/X509_get0_signature.pod @@ -109,12 +109,14 @@ L =head1 HISTORY -X509_get0_signature() and X509_get_signature_nid() were first added to -OpenSSL 1.0.2. +The +X509_get0_signature() and X509_get_signature_nid() functions were +added in OpenSSL 1.0.2. +The X509_REQ_get0_signature(), X509_REQ_get_signature_nid(), -X509_CRL_get0_signature() and X509_CRL_get_signature_nid() were first added -to OpenSSL 1.1.0. +X509_CRL_get0_signature() and X509_CRL_get_signature_nid() were +added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man3/X509_get_serialNumber.pod b/doc/man3/X509_get_serialNumber.pod index ce807070..5594c8a2 100644 --- a/doc/man3/X509_get_serialNumber.pod +++ b/doc/man3/X509_get_serialNumber.pod @@ -56,8 +56,9 @@ L =head1 HISTORY -X509_get_serialNumber() and X509_set_serialNumber() are available in -all versions of OpenSSL. X509_get0_serialNumber() was added in OpenSSL 1.1.0. +The X509_get_serialNumber() and X509_set_serialNumber() functions are +available in all versions of OpenSSL. +The X509_get0_serialNumber() function was added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/doc/man3/X509_get_subject_name.pod b/doc/man3/X509_get_subject_name.pod index f50f22a7..21bb4030 100644 --- a/doc/man3/X509_get_subject_name.pod +++ b/doc/man3/X509_get_subject_name.pod @@ -53,8 +53,8 @@ and X509_CRL_set_issuer_name() return 1 for success and 0 for failure. X509_REQ_get_subject_name() is a function in OpenSSL 1.1.0 and a macro in earlier versions. -X509_CRL_get_issuer() is a function in OpenSSL 1.1.0. It was first added -to OpenSSL 1.0.0 as a macro. +X509_CRL_get_issuer() is a function in OpenSSL 1.1.0. It was previously +added in OpenSSL 1.0.0 as a macro. =head1 SEE ALSO diff --git a/doc/man3/X509_sign.pod b/doc/man3/X509_sign.pod index 69426be2..ffc44413 100644 --- a/doc/man3/X509_sign.pod +++ b/doc/man3/X509_sign.pod @@ -81,11 +81,11 @@ L =head1 HISTORY -X509_sign(), X509_REQ_sign() and X509_CRL_sign() are available in all -versions of OpenSSL. +The X509_sign(), X509_REQ_sign() and X509_CRL_sign() functions are +available in all versions of OpenSSL. -X509_sign_ctx(), X509_REQ_sign_ctx() and X509_CRL_sign_ctx() were first added -to OpenSSL 1.0.1. +The X509_sign_ctx(), X509_REQ_sign_ctx() +and X509_CRL_sign_ctx() functions were added OpenSSL 1.0.1. =head1 COPYRIGHT diff --git a/doc/man3/i2d_CMS_bio_stream.pod b/doc/man3/i2d_CMS_bio_stream.pod index 061e7f36..88289b11 100644 --- a/doc/man3/i2d_CMS_bio_stream.pod +++ b/doc/man3/i2d_CMS_bio_stream.pod @@ -39,7 +39,7 @@ L =head1 HISTORY -i2d_CMS_bio_stream() was added to OpenSSL 1.0.0 +The i2d_CMS_bio_stream() function was added in OpenSSL 1.0.0. =head1 COPYRIGHT diff --git a/doc/man3/i2d_PKCS7_bio_stream.pod b/doc/man3/i2d_PKCS7_bio_stream.pod index 7d64f1e7..ced178bd 100644 --- a/doc/man3/i2d_PKCS7_bio_stream.pod +++ b/doc/man3/i2d_PKCS7_bio_stream.pod @@ -39,7 +39,7 @@ L =head1 HISTORY -i2d_PKCS7_bio_stream() was added to OpenSSL 1.0.0 +The i2d_PKCS7_bio_stream() function was added in OpenSSL 1.0.0. =head1 COPYRIGHT diff --git a/doc/man7/EVP_MAC_HMAC.pod b/doc/man7/EVP_MAC_HMAC.pod index b5ae94d4..c8aa0475 100644 --- a/doc/man7/EVP_MAC_HMAC.pod +++ b/doc/man7/EVP_MAC_HMAC.pod @@ -49,7 +49,7 @@ There are no corresponding string control types. These work as described in L. -EVP_MAC_ctrl_str() type string for B: "digest" +EVP_MAC_ctrl_str() type string for B: "digest" The value is expected to be the name of a cipher. diff --git a/doc/man7/ct.pod b/doc/man7/ct.pod index 9811de3a..ca2a43e4 100644 --- a/doc/man7/ct.pod +++ b/doc/man7/ct.pod @@ -15,7 +15,7 @@ clients, as defined in RFC 6962. This verification can provide some confidence that a certificate has been publicly logged in a set of CT logs. By default, these checks are disabled. They can be enabled using -SSL_CTX_ct_enable() or SSL_ct_enable(). +L or L. This library can also be used to parse and examine CT data structures, such as Signed Certificate Timestamps (SCTs), or to read a list of CT logs. There are @@ -39,7 +39,7 @@ L =head1 HISTORY -This library was added in OpenSSL 1.1.0. +The ct library was added in OpenSSL 1.1.0. =head1 COPYRIGHT diff --git a/include/openssl/dtls1.h b/include/openssl/dtls1.h index 21b5252e..f717afbe 100644 --- a/include/openssl/dtls1.h +++ b/include/openssl/dtls1.h @@ -14,10 +14,14 @@ extern "C" { #endif +#include + # define DTLS1_VERSION 0xFEFF # define DTLS1_2_VERSION 0xFEFD -# define DTLS_MIN_VERSION DTLS1_VERSION -# define DTLS_MAX_VERSION DTLS1_2_VERSION +# if !OPENSSL_API_3 +# define DTLS_MIN_VERSION DTLS1_VERSION +# define DTLS_MAX_VERSION DTLS1_2_VERSION +# endif # define DTLS1_VERSION_MAJOR 0xFE # define DTLS1_BAD_VER 0x0100 diff --git a/include/openssl/evp.h b/include/openssl/evp.h index c04f51bd..774f102e 100644 --- a/include/openssl/evp.h +++ b/include/openssl/evp.h @@ -1056,7 +1056,7 @@ int EVP_PKEY_id(const EVP_PKEY *pkey); int EVP_PKEY_base_id(const EVP_PKEY *pkey); int EVP_PKEY_bits(const EVP_PKEY *pkey); int EVP_PKEY_security_bits(const EVP_PKEY *pkey); -int EVP_PKEY_size(EVP_PKEY *pkey); +int EVP_PKEY_size(const EVP_PKEY *pkey); int EVP_PKEY_set_type(EVP_PKEY *pkey, int type); int EVP_PKEY_set_type_str(EVP_PKEY *pkey, const char *str, int len); int EVP_PKEY_set_alias_type(EVP_PKEY *pkey, int type); diff --git a/include/openssl/tls1.h b/include/openssl/tls1.h index 8a27caba..e145b178 100644 --- a/include/openssl/tls1.h +++ b/include/openssl/tls1.h @@ -28,7 +28,9 @@ extern "C" { # define TLS1_1_VERSION 0x0302 # define TLS1_2_VERSION 0x0303 # define TLS1_3_VERSION 0x0304 -# define TLS_MAX_VERSION TLS1_3_VERSION +# if !OPENSSL_API_3 +# define TLS_MAX_VERSION TLS1_3_VERSION +# endif /* TODO(TLS1.3) REMOVE ME: Version indicators for draft version */ # define TLS1_3_VERSION_DRAFT_23 0x7f17 diff --git a/include/openssl/x509_vfy.h b/include/openssl/x509_vfy.h index cfc8c89a..0df80282 100644 --- a/include/openssl/x509_vfy.h +++ b/include/openssl/x509_vfy.h @@ -185,6 +185,10 @@ void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth); # define X509_V_ERR_OCSP_VERIFY_FAILED 74 /* Couldn't verify cert through OCSP */ # define X509_V_ERR_OCSP_CERT_UNKNOWN 75 /* Certificate wasn't recognized by the OCSP responder */ +# define X509_V_ERR_SIGNATURE_ALGORITHM_MISMATCH 76 +# define X509_V_ERR_NO_ISSUER_PUBLIC_KEY 77 + + /* Certificate verify flags */ # if !OPENSSL_API_1_1_0 diff --git a/ssl/d1_lib.c b/ssl/d1_lib.c index 2da9ebbd..d3f681ba 100644 --- a/ssl/d1_lib.c +++ b/ssl/d1_lib.c @@ -192,7 +192,7 @@ int dtls1_clear(SSL *s) return 0; if (s->method->version == DTLS_ANY_VERSION) - s->version = DTLS_MAX_VERSION; + s->version = DTLS_MAX_VERSION_INTERNAL; #ifndef OPENSSL_NO_DTLS1_METHOD else if (s->options & SSL_OP_CISCO_ANYCONNECT) s->client_version = s->version = DTLS1_BAD_VER; diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h index 74156c55..c196117a 100644 --- a/ssl/ssl_locl.h +++ b/ssl/ssl_locl.h @@ -131,6 +131,9 @@ (c)[1]=(unsigned char)(((l)>> 8)&0xff), \ (c)[2]=(unsigned char)(((l) )&0xff)),(c)+=3) +# define TLS_MAX_VERSION_INTERNAL TLS1_3_VERSION +# define DTLS_MAX_VERSION_INTERNAL DTLS1_2_VERSION + /* * DTLS version numbers are strange because they're inverted. Except for * DTLS1_BAD_VER, which should be considered "lower" than the rest. diff --git a/ssl/statem/statem_clnt.c b/ssl/statem/statem_clnt.c index c1a572f3..3b6cbb76 100644 --- a/ssl/statem/statem_clnt.c +++ b/ssl/statem/statem_clnt.c @@ -163,7 +163,7 @@ static int ossl_statem_client13_read_transition(SSL *s, int mt) return 1; } if (mt == SSL3_MT_CERTIFICATE_REQUEST) { -#if DTLS_MAX_VERSION != DTLS1_2_VERSION +#if DTLS_MAX_VERSION_INTERNAL != DTLS1_2_VERSION # error TODO(DTLS1.3): Restore digest for PHA before adding message. #endif if (!SSL_IS_DTLS(s) && s->post_handshake_auth == SSL_PHA_EXT_SENT) { diff --git a/ssl/statem/statem_lib.c b/ssl/statem/statem_lib.c index d05fa9f5..a08f4fa0 100644 --- a/ssl/statem/statem_lib.c +++ b/ssl/statem/statem_lib.c @@ -1417,7 +1417,7 @@ typedef struct { const SSL_METHOD *(*smeth) (void); } version_info; -#if TLS_MAX_VERSION != TLS1_3_VERSION +#if TLS_MAX_VERSION_INTERNAL != TLS1_3_VERSION # error Code needs update for TLS_method() support beyond TLS1_3_VERSION. #endif @@ -1451,7 +1451,7 @@ static const version_info tls_version_table[] = { {0, NULL, NULL}, }; -#if DTLS_MAX_VERSION != DTLS1_2_VERSION +#if DTLS_MAX_VERSION_INTERNAL != DTLS1_2_VERSION # error Code needs update for DTLS_method() support beyond DTLS1_2_VERSION. #endif @@ -1684,12 +1684,12 @@ int ssl_set_version_bound(int method_version, int version, int *bound) return 0; case TLS_ANY_VERSION: - if (version < SSL3_VERSION || version > TLS_MAX_VERSION) + if (version < SSL3_VERSION || version > TLS_MAX_VERSION_INTERNAL) return 0; break; case DTLS_ANY_VERSION: - if (DTLS_VERSION_GT(version, DTLS_MAX_VERSION) || + if (DTLS_VERSION_GT(version, DTLS_MAX_VERSION_INTERNAL) || DTLS_VERSION_LT(version, DTLS1_BAD_VER)) return 0; break; @@ -1735,7 +1735,7 @@ int ssl_choose_server_version(SSL *s, CLIENTHELLO_MSG *hello, DOWNGRADE *dgrd) * With version-flexible methods we have an initial state with: * * s->method->version == (D)TLS_ANY_VERSION, - * s->version == (D)TLS_MAX_VERSION. + * s->version == (D)TLS_MAX_VERSION_INTERNAL. * * So we detect version-flexible methods via the method version, not the * handle version. diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index ee2278c6..5dc645ad 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -121,7 +121,7 @@ int tls1_clear(SSL *s) return 0; if (s->method->version == TLS_ANY_VERSION) - s->version = TLS_MAX_VERSION; + s->version = TLS_MAX_VERSION_INTERNAL; else s->version = s->method->version; diff --git a/test/asynciotest.c b/test/asynciotest.c index db9f2182..1085b4af 100644 --- a/test/asynciotest.c +++ b/test/asynciotest.c @@ -297,7 +297,7 @@ static int test_asyncio(int test) char buf[sizeof(testdata)]; if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, &serverctx, &clientctx, cert, privkey))) goto end; diff --git a/test/clienthellotest.c b/test/clienthellotest.c index 2343145b..6c778315 100644 --- a/test/clienthellotest.c +++ b/test/clienthellotest.c @@ -78,7 +78,7 @@ static int test_client_hello(int currtest) ctx = SSL_CTX_new(TLS_method()); if (!TEST_ptr(ctx)) goto end; - if (!TEST_true(SSL_CTX_set_max_proto_version(ctx, TLS_MAX_VERSION))) + if (!TEST_true(SSL_CTX_set_max_proto_version(ctx, 0))) goto end; switch(currtest) { diff --git a/test/dtlstest.c b/test/dtlstest.c index 62aa8567..0b048869 100644 --- a/test/dtlstest.c +++ b/test/dtlstest.c @@ -63,7 +63,7 @@ static int test_dtls_unprocessed(int testidx) if (!TEST_true(create_ssl_ctx_pair(DTLS_server_method(), DTLS_client_method(), - DTLS1_VERSION, DTLS_MAX_VERSION, + DTLS1_VERSION, 0, &sctx, &cctx, cert, privkey))) return 0; @@ -154,7 +154,7 @@ static int test_dtls_drop_records(int idx) if (!TEST_true(create_ssl_ctx_pair(DTLS_server_method(), DTLS_client_method(), - DTLS1_VERSION, DTLS_MAX_VERSION, + DTLS1_VERSION, 0, &sctx, &cctx, cert, privkey))) return 0; @@ -265,7 +265,7 @@ static int test_cookie(void) if (!TEST_true(create_ssl_ctx_pair(DTLS_server_method(), DTLS_client_method(), - DTLS1_VERSION, DTLS_MAX_VERSION, + DTLS1_VERSION, 0, &sctx, &cctx, cert, privkey))) return 0; @@ -297,7 +297,7 @@ static int test_dtls_duplicate_records(void) if (!TEST_true(create_ssl_ctx_pair(DTLS_server_method(), DTLS_client_method(), - DTLS1_VERSION, DTLS_MAX_VERSION, + DTLS1_VERSION, 0, &sctx, &cctx, cert, privkey))) return 0; diff --git a/test/fatalerrtest.c b/test/fatalerrtest.c index 280eed26..32919144 100644 --- a/test/fatalerrtest.c +++ b/test/fatalerrtest.c @@ -29,7 +29,7 @@ static int test_fatalerr(void) }; if (!TEST_true(create_ssl_ctx_pair(TLS_method(), TLS_method(), - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, &sctx, &cctx, cert, privkey))) goto err; diff --git a/test/gosttest.c b/test/gosttest.c index 26e435d6..398effa0 100644 --- a/test/gosttest.c +++ b/test/gosttest.c @@ -41,7 +41,7 @@ static int test_tls13(int idx) if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), TLS1_VERSION, - TLS_MAX_VERSION, + 0, &sctx, &cctx, ciphers[idx].certnum == 0 ? cert1 : cert2, diff --git a/test/recordlentest.c b/test/recordlentest.c index 5dc878b3..a73e4436 100644 --- a/test/recordlentest.c +++ b/test/recordlentest.c @@ -103,7 +103,7 @@ static int test_record_overflow(int idx) ERR_clear_error(); if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, &sctx, &cctx, cert, privkey))) goto end; diff --git a/test/servername_test.c b/test/servername_test.c index bad29ec9..0614d4bf 100644 --- a/test/servername_test.c +++ b/test/servername_test.c @@ -186,7 +186,7 @@ static int server_setup_sni(void) if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, &sctx, &cctx, cert, privkey)) || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL, NULL))) diff --git a/test/ssl_test.c b/test/ssl_test.c index 16cb7250..4f82bf72 100644 --- a/test/ssl_test.c +++ b/test/ssl_test.c @@ -406,8 +406,7 @@ static int test_handshake(int idx) #ifndef OPENSSL_NO_DTLS if (test_ctx->method == SSL_TEST_METHOD_DTLS) { server_ctx = SSL_CTX_new(DTLS_server_method()); - if (!TEST_true(SSL_CTX_set_max_proto_version(server_ctx, - DTLS_MAX_VERSION))) + if (!TEST_true(SSL_CTX_set_max_proto_version(server_ctx, 0))) goto err; if (test_ctx->extra.server.servername_callback != SSL_TEST_SERVERNAME_CB_NONE) { @@ -415,17 +414,14 @@ static int test_handshake(int idx) goto err; } client_ctx = SSL_CTX_new(DTLS_client_method()); - if (!TEST_true(SSL_CTX_set_max_proto_version(client_ctx, - DTLS_MAX_VERSION))) + if (!TEST_true(SSL_CTX_set_max_proto_version(client_ctx, 0))) goto err; if (test_ctx->handshake_mode == SSL_TEST_HANDSHAKE_RESUME) { resume_server_ctx = SSL_CTX_new(DTLS_server_method()); - if (!TEST_true(SSL_CTX_set_max_proto_version(resume_server_ctx, - DTLS_MAX_VERSION))) + if (!TEST_true(SSL_CTX_set_max_proto_version(resume_server_ctx, 0))) goto err; resume_client_ctx = SSL_CTX_new(DTLS_client_method()); - if (!TEST_true(SSL_CTX_set_max_proto_version(resume_client_ctx, - DTLS_MAX_VERSION))) + if (!TEST_true(SSL_CTX_set_max_proto_version(resume_client_ctx, 0))) goto err; if (!TEST_ptr(resume_server_ctx) || !TEST_ptr(resume_client_ctx)) @@ -435,31 +431,26 @@ static int test_handshake(int idx) #endif if (test_ctx->method == SSL_TEST_METHOD_TLS) { server_ctx = SSL_CTX_new(TLS_server_method()); - if (!TEST_true(SSL_CTX_set_max_proto_version(server_ctx, - TLS_MAX_VERSION))) + if (!TEST_true(SSL_CTX_set_max_proto_version(server_ctx, 0))) goto err; /* SNI on resumption isn't supported/tested yet. */ if (test_ctx->extra.server.servername_callback != SSL_TEST_SERVERNAME_CB_NONE) { if (!TEST_ptr(server2_ctx = SSL_CTX_new(TLS_server_method()))) goto err; - if (!TEST_true(SSL_CTX_set_max_proto_version(server2_ctx, - TLS_MAX_VERSION))) + if (!TEST_true(SSL_CTX_set_max_proto_version(server2_ctx, 0))) goto err; } client_ctx = SSL_CTX_new(TLS_client_method()); - if (!TEST_true(SSL_CTX_set_max_proto_version(client_ctx, - TLS_MAX_VERSION))) + if (!TEST_true(SSL_CTX_set_max_proto_version(client_ctx, 0))) goto err; if (test_ctx->handshake_mode == SSL_TEST_HANDSHAKE_RESUME) { resume_server_ctx = SSL_CTX_new(TLS_server_method()); - if (!TEST_true(SSL_CTX_set_max_proto_version(resume_server_ctx, - TLS_MAX_VERSION))) + if (!TEST_true(SSL_CTX_set_max_proto_version(resume_server_ctx, 0))) goto err; resume_client_ctx = SSL_CTX_new(TLS_client_method()); - if (!TEST_true(SSL_CTX_set_max_proto_version(resume_client_ctx, - TLS_MAX_VERSION))) + if (!TEST_true(SSL_CTX_set_max_proto_version(resume_client_ctx, 0))) goto err; if (!TEST_ptr(resume_server_ctx) || !TEST_ptr(resume_client_ctx)) diff --git a/test/sslapitest.c b/test/sslapitest.c index fb70562b..d52380c2 100644 --- a/test/sslapitest.c +++ b/test/sslapitest.c @@ -317,7 +317,7 @@ static int test_keylog(void) if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, &sctx, &cctx, cert, privkey))) return 0; @@ -399,7 +399,7 @@ static int test_keylog_no_master_key(void) error_writing_log = 0; if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, &sctx, &cctx, cert, privkey)) || !TEST_true(SSL_CTX_set_max_early_data(sctx, SSL3_RT_MAX_PLAIN_LENGTH))) @@ -545,7 +545,7 @@ static int test_client_hello_cb(void) int testctr = 0, testresult = 0; if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, &sctx, &cctx, cert, privkey))) goto end; SSL_CTX_set_client_hello_cb(sctx, full_client_hello_callback, &testctr); @@ -846,15 +846,13 @@ static int test_ktls_no_client_no_server(void) static int test_large_message_tls(void) { return execute_test_large_message(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, - 0); + TLS1_VERSION, 0, 0); } static int test_large_message_tls_read_ahead(void) { return execute_test_large_message(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, - 1); + TLS1_VERSION, 0, 1); } #ifndef OPENSSL_NO_DTLS @@ -866,8 +864,7 @@ static int test_large_message_dtls(void) */ return execute_test_large_message(DTLS_server_method(), DTLS_client_method(), - DTLS1_VERSION, DTLS_MAX_VERSION, - 0); + DTLS1_VERSION, 0, 0); } #endif @@ -927,7 +924,7 @@ static int test_tlsext_status_type(void) BIO *certbio = NULL; if (!create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, &sctx, &cctx, cert, privkey)) return 0; @@ -1096,7 +1093,7 @@ static int execute_test_session(int maxprot, int use_int_cache, numnewsesstick = 2; if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, &sctx, &cctx, cert, privkey))) return 0; @@ -1444,7 +1441,7 @@ static int setup_ticket_test(int stateful, int idx, SSL_CTX **sctx, int sess_id_ctx = 1; if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, sctx, + TLS1_VERSION, 0, sctx, cctx, cert, privkey)) || !TEST_true(SSL_CTX_set_num_tickets(*sctx, idx)) || !TEST_true(SSL_CTX_set_session_id_context(*sctx, @@ -1644,7 +1641,7 @@ static int test_psk_tickets(void) int sess_id_ctx = 1; if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, &sctx, + TLS1_VERSION, 0, &sctx, &cctx, NULL, NULL)) || !TEST_true(SSL_CTX_set_session_id_context(sctx, (void *)&sess_id_ctx, @@ -1770,7 +1767,7 @@ static int test_ssl_set_bio(int idx) } if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, &sctx, &cctx, cert, privkey))) goto end; @@ -1995,7 +1992,7 @@ static int test_set_sigalgs(int idx) : &testsigalgs[idx - OSSL_NELEM(testsigalgs)]; if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, &sctx, &cctx, cert, privkey))) return 0; @@ -2235,7 +2232,7 @@ static int setupearly_data_test(SSL_CTX **cctx, SSL_CTX **sctx, SSL **clientssl, if (*sctx == NULL && !TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, sctx, cctx, cert, privkey))) return 0; @@ -2561,7 +2558,7 @@ static int test_early_data_replay_int(int idx, int usecb, int confopt) allow_ed_cb_called = 0; if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, &sctx, + TLS1_VERSION, 0, &sctx, &cctx, cert, privkey))) return 0; @@ -3286,7 +3283,7 @@ static int test_set_ciphersuite(int idx) int testresult = 0; if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, &sctx, &cctx, cert, privkey)) || !TEST_true(SSL_CTX_set_ciphersuites(sctx, "TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_SHA256"))) @@ -3356,7 +3353,7 @@ static int test_ciphersuite_change(void) /* Create a session based on SHA-256 */ if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, &sctx, &cctx, cert, privkey)) || !TEST_true(SSL_CTX_set_ciphersuites(cctx, "TLS_AES_128_GCM_SHA256")) @@ -3496,7 +3493,7 @@ static int test_tls13_psk(int idx) int testresult = 0; if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, &sctx, &cctx, idx == 3 ? NULL : cert, idx == 3 ? NULL : privkey))) goto end; @@ -3744,7 +3741,7 @@ static int test_stateless(void) int testresult = 0; if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, &sctx, &cctx, cert, privkey))) goto end; @@ -3968,13 +3965,13 @@ static int test_custom_exts(int tst) snicb = 0; if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, &sctx, &cctx, cert, privkey))) goto end; if (tst == 2 && !TEST_true(create_ssl_ctx_pair(TLS_server_method(), NULL, - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, &sctx2, NULL, cert, privkey))) goto end; @@ -4254,7 +4251,7 @@ static int test_export_key_mat(int tst) return 1; #endif if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, &sctx, &cctx, cert, privkey))) goto end; @@ -4452,7 +4449,7 @@ static int test_ssl_clear(int idx) /* Create an initial connection */ if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, &sctx, &cctx, cert, privkey)) || (idx == 1 && !TEST_true(SSL_CTX_set_max_proto_version(cctx, @@ -4608,7 +4605,7 @@ static int test_pha_key_update(void) int testresult = 0; if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, &sctx, &cctx, cert, privkey))) return 0; @@ -4831,7 +4828,7 @@ static int test_srp(int tst) } if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, &sctx, &cctx, cert, privkey))) goto end; @@ -5160,14 +5157,14 @@ static int test_ssl_pending(int tst) if (tst == 0) { if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, &sctx, &cctx, cert, privkey))) goto end; } else { #ifndef OPENSSL_NO_DTLS if (!TEST_true(create_ssl_ctx_pair(DTLS_server_method(), DTLS_client_method(), - DTLS1_VERSION, DTLS_MAX_VERSION, + DTLS1_VERSION, 0, &sctx, &cctx, cert, privkey))) goto end; #else diff --git a/test/sslbuffertest.c b/test/sslbuffertest.c index 0870bb70..0ee7bdba 100644 --- a/test/sslbuffertest.c +++ b/test/sslbuffertest.c @@ -166,7 +166,7 @@ int setup_tests(void) return 0; if (!create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, &serverctx, &clientctx, cert, pkey)) { TEST_error("Failed to create SSL_CTX pair\n"); return 0; diff --git a/test/sslcorrupttest.c b/test/sslcorrupttest.c index 2c198093..1ca899db 100644 --- a/test/sslcorrupttest.c +++ b/test/sslcorrupttest.c @@ -194,7 +194,7 @@ static int test_ssl_corrupt(int testidx) TEST_info("Starting #%d, %s", testidx, cipher_list[testidx]); if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, &sctx, &cctx, cert, privkey))) return 0; diff --git a/test/ssltest_old.c b/test/ssltest_old.c index f1966242..f26bf851 100644 --- a/test/ssltest_old.c +++ b/test/ssltest_old.c @@ -1331,8 +1331,8 @@ int main(int argc, char *argv[]) min_version = TLS1_2_VERSION; max_version = TLS1_2_VERSION; } else { - min_version = SSL3_VERSION; - max_version = TLS_MAX_VERSION; + min_version = 0; + max_version = 0; } #endif #ifndef OPENSSL_NO_DTLS @@ -1345,8 +1345,8 @@ int main(int argc, char *argv[]) min_version = DTLS1_2_VERSION; max_version = DTLS1_2_VERSION; } else { - min_version = DTLS_MIN_VERSION; - max_version = DTLS_MAX_VERSION; + min_version = 0; + max_version = 0; } } #endif diff --git a/test/tls13ccstest.c b/test/tls13ccstest.c index 7609f0c4..521a992c 100644 --- a/test/tls13ccstest.c +++ b/test/tls13ccstest.c @@ -255,7 +255,7 @@ static int test_tls13ccs(int tst) chsessidlen = 0; if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - TLS1_VERSION, TLS_MAX_VERSION, + TLS1_VERSION, 0, &sctx, &cctx, cert, privkey)) || !TEST_true(SSL_CTX_set_max_early_data(sctx, SSL3_RT_MAX_PLAIN_LENGTH))) diff --git a/util/find-doc-nits b/util/find-doc-nits index affe4eba..d722d3ca 100755 --- a/util/find-doc-nits +++ b/util/find-doc-nits @@ -35,7 +35,7 @@ Find small errors (nits) in documentation. Options: -l Print bogus links -n Print nits in POD pages -p Warn if non-public name documented (implies -n) - -u List undocumented functions + -u Count undocumented functions -h Print this help message -c List undocumented commands and options EOF @@ -270,6 +270,7 @@ my %docced; sub checkmacros() { my $count = 0; + my %seen; print "# Checking macros (approximate)\n"; foreach my $f ( glob('include/openssl/*.h') ) { @@ -281,7 +282,7 @@ sub checkmacros() while ( ) { next unless /^#\s*define\s*(\S+)\(/; my $macro = $1; - next if $docced{$macro}; + next if $docced{$macro} || defined $seen{$macro}; next if $macro =~ /i2d_/ || $macro =~ /d2i_/ || $macro =~ /DEPRECATEDIN/ @@ -289,6 +290,7 @@ sub checkmacros() || $macro =~ /DECLARE_/; print "$f:$macro\n" if $opt_d; $count++; + $seen{$macro} = 1; } close(IN); } @@ -300,15 +302,17 @@ sub printem() my $libname = shift; my $numfile = shift; my $count = 0; + my %seen; foreach my $func ( &parsenum($numfile) ) { - next if $docced{$func}; + next if $docced{$func} || defined $seen{$func}; # Skip ASN1 utilities next if $func =~ /^ASN1_/; print "$libname:$func\n" if $opt_d; $count++; + $seen{$func} = 1; } print "# Found $count missing from $numfile\n\n"; } diff --git a/util/process_docs.pl b/util/process_docs.pl index d2fef5de..a4287c27 100755 --- a/util/process_docs.pl +++ b/util/process_docs.pl @@ -84,114 +84,123 @@ my $symlink_exists = eval { symlink("",""); 1 }; foreach my $section (sort @{$options{section}}) { my $subdir = "man$section"; - my @podsourcedirs = map { catfile($_, $subdir); } @{$options{sourcedir}}; - my @podglobs = map { catfile($_, "*.pod"); } @podsourcedirs; + foreach my $sourcedir (@{$options{sourcedir}}) { + my $podsourcedir = catfile($sourcedir, $subdir); + my $podglob = catfile($podsourcedir, "*.pod"); - foreach my $podfile (map { glob $_ } @podglobs) { - my $podname = basename($podfile, ".pod"); - my $podpath = catfile($podfile); - my %podinfo = extract_pod_info($podpath, - { debug => $options{debug}, - section => $section }); - my @podfiles = grep { $_ ne $podname } @{$podinfo{names}}; + foreach my $podfile (glob $podglob) { + my $podname = basename($podfile, ".pod"); + my $podpath = catfile($podfile); + my %podinfo = extract_pod_info($podpath, + { debug => $options{debug}, + section => $section }); + my @podfiles = grep { $_ ne $podname } @{$podinfo{names}}; - my $updir = updir(); - my $name = uc $podname; - my $suffix = { man => ".$podinfo{section}".($options{suffix} // ""), - html => ".html" } -> {$options{type}}; - my $generate = { man => "pod2man --name=$name --section=$podinfo{section} --center=OpenSSL --release=$config{version} \"$podpath\"", - html => "pod2html \"--podroot=$options{sourcedir}\" --htmldir=$updir --podpath=man1:man3:man5:man7 \"--infile=$podpath\" \"--title=$podname\" --quiet" - } -> {$options{type}}; - my $output_dir = catdir($options{destdir}, "man$podinfo{section}"); - my $output_file = $podname . $suffix; - my $output_path = catfile($output_dir, $output_file); + my $updir = updir(); + my $name = uc $podname; + my $suffix = + { man => ".$podinfo{section}".($options{suffix} // ""), + html => ".html" } -> {$options{type}}; + my $generate = + { man => <<"_____", +pod2man --name=$name --section=$podinfo{section} --center=OpenSSL --release=$config{version} "$podpath" +_____ + html => <<"_____", +pod2html "--podroot=$sourcedir" --htmldir=$updir --podpath=man1:man3:man5:man7 "--infile=$podpath" "--title=$podname" --quiet +_____ + } -> {$options{type}}; + my $output_dir = catdir($options{destdir}, "man$podinfo{section}"); + my $output_file = $podname . $suffix; + my $output_path = catfile($output_dir, $output_file); - if (! $options{remove}) { - my @output; - print STDERR "DEBUG: Processing, using \"$generate\"\n" - if $options{debug}; - unless ($options{"dry-run"}) { - @output = `$generate`; - map { s|href="http://man\.he\.net/(man\d/[^"]+)(?:\.html)?"|href="../$1.html"|g; } @output - if $options{type} eq "html"; - if ($options{type} eq "man") { - # Because some *roff parsers are more strict than others, - # multiple lines in the NAME section must be merged into - # one. - my $in_name = 0; - my $name_line = ""; - my @newoutput = (); - foreach (@output) { - if ($in_name) { - if (/^\.SH "/) { - $in_name = 0; - push @newoutput, $name_line."\n"; - } else { - chomp (my $x = $_); - $name_line .= " " if $name_line; - $name_line .= $x; - next; - } - } - if (/^\.SH +"NAME" *$/) { - $in_name = 1; - } - push @newoutput, $_; - } - @output = @newoutput; - } - } - print STDERR "DEBUG: Done processing\n" if $options{debug}; - - if (! -d $output_dir) { - print STDERR "DEBUG: Creating directory $output_dir\n" if $options{debug}; - unless ($options{"dry-run"}) { - mkpath $output_dir - or die "Trying to create directory $output_dir: $!\n"; - } - } - print STDERR "DEBUG: Writing $output_path\n" if $options{debug}; - unless ($options{"dry-run"}) { - open my $output_fh, '>', $output_path - or die "Trying to write to $output_path: $!\n"; - foreach (@output) { - print $output_fh $_; - } - close $output_fh; - } - print STDERR "DEBUG: Done writing $output_path\n" if $options{debug}; - } else { - print STDERR "DEBUG: Removing $output_path\n" if $options{debug}; - unless ($options{"dry-run"}) { - while (unlink $output_path) {} - } - } - print "$output_path\n"; - - foreach (@podfiles) { - my $link_file = $_ . $suffix; - my $link_path = catfile($output_dir, $link_file); if (! $options{remove}) { - if ($symlink_exists) { - print STDERR "DEBUG: Linking $link_path -> $output_file\n" + my @output; + print STDERR "DEBUG: Processing, using \"$generate\"\n" + if $options{debug}; + unless ($options{"dry-run"}) { + @output = `$generate`; + map { s|href="http://man\.he\.net/(man\d/[^"]+)(?:\.html)?"|href="../$1.html"|g; } @output + if $options{type} eq "html"; + if ($options{type} eq "man") { + # Because some *roff parsers are more strict than + # others, multiple lines in the NAME section must + # be merged into one. + my $in_name = 0; + my $name_line = ""; + my @newoutput = (); + foreach (@output) { + if ($in_name) { + if (/^\.SH "/) { + $in_name = 0; + push @newoutput, $name_line."\n"; + } else { + chomp (my $x = $_); + $name_line .= " " if $name_line; + $name_line .= $x; + next; + } + } + if (/^\.SH +"NAME" *$/) { + $in_name = 1; + } + push @newoutput, $_; + } + @output = @newoutput; + } + } + print STDERR "DEBUG: Done processing\n" if $options{debug}; + + if (! -d $output_dir) { + print STDERR "DEBUG: Creating directory $output_dir\n" if $options{debug}; unless ($options{"dry-run"}) { - symlink $output_file, $link_path; + mkpath $output_dir + or die "Trying to create directory $output_dir: $!\n"; + } + } + print STDERR "DEBUG: Writing $output_path\n" if $options{debug}; + unless ($options{"dry-run"}) { + open my $output_fh, '>', $output_path + or die "Trying to write to $output_path: $!\n"; + foreach (@output) { + print $output_fh $_; + } + close $output_fh; + } + print STDERR "DEBUG: Done writing $output_path\n" if $options{debug}; + } else { + print STDERR "DEBUG: Removing $output_path\n" if $options{debug}; + unless ($options{"dry-run"}) { + while (unlink $output_path) {} + } + } + print "$output_path\n"; + + foreach (@podfiles) { + my $link_file = $_ . $suffix; + my $link_path = catfile($output_dir, $link_file); + if (! $options{remove}) { + if ($symlink_exists) { + print STDERR "DEBUG: Linking $link_path -> $output_file\n" + if $options{debug}; + unless ($options{"dry-run"}) { + symlink $output_file, $link_path; + } + } else { + print STDERR "DEBUG: Copying $output_path to link_path\n" + if $options{debug}; + unless ($options{"dry-run"}) { + copy $output_path, $link_path; + } } } else { - print STDERR "DEBUG: Copying $output_path to link_path\n" - if $options{debug}; + print STDERR "DEBUG: Removing $link_path\n" if $options{debug}; unless ($options{"dry-run"}) { - copy $output_path, $link_path; + while (unlink $link_path) {} } } - } else { - print STDERR "DEBUG: Removing $link_path\n" if $options{debug}; - unless ($options{"dry-run"}) { - while (unlink $link_path) {} - } + print "$link_path -> $output_path\n"; } - print "$link_path -> $output_path\n"; } } }