Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update.

Browse Source
This commit is contained in:
Hakase
2019-09-21 00:43:47 +09:00
parent 2e57f602ae
commit 62515c7d8d
1131 changed files with 47556 additions and 24957 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crypto/crmf/crmf_err.c
+1 -44
View File
@@ -13,47 +13,6 @@
#ifndef OPENSSL_NO_ERR
static const ERR_STRING_DATA CRMF_str_functs[] = {
{ERR_PACK(ERR_LIB_CRMF, CRMF_F_CRMF_POPOSIGNINGKEY_INIT, 0),
"CRMF_poposigningkey_init"},
{ERR_PACK(ERR_LIB_CRMF, CRMF_F_OSSL_CRMF_CERTID_GEN, 0),
"OSSL_CRMF_CERTID_gen"},
{ERR_PACK(ERR_LIB_CRMF, CRMF_F_OSSL_CRMF_CERTTEMPLATE_FILL, 0),
"OSSL_CRMF_CERTTEMPLATE_fill"},
{ERR_PACK(ERR_LIB_CRMF, CRMF_F_OSSL_CRMF_ENCRYPTEDVALUE_GET1_ENCCERT, 0),
"OSSL_CRMF_ENCRYPTEDVALUE_get1_encCert"},
{ERR_PACK(ERR_LIB_CRMF, CRMF_F_OSSL_CRMF_MSGS_VERIFY_POPO, 0),
"OSSL_CRMF_MSGS_verify_popo"},
{ERR_PACK(ERR_LIB_CRMF, CRMF_F_OSSL_CRMF_MSG_CREATE_POPO, 0),
"OSSL_CRMF_MSG_create_popo"},
{ERR_PACK(ERR_LIB_CRMF, CRMF_F_OSSL_CRMF_MSG_GET0_TMPL, 0),
"OSSL_CRMF_MSG_get0_tmpl"},
{ERR_PACK(ERR_LIB_CRMF, CRMF_F_OSSL_CRMF_MSG_GET_CERTREQID, 0),
"OSSL_CRMF_MSG_get_certReqId"},
{ERR_PACK(ERR_LIB_CRMF, CRMF_F_OSSL_CRMF_MSG_PKIPUBLICATIONINFO_PUSH0_SINGLEPUBINFO, 0),
"OSSL_CRMF_MSG_PKIPublicationInfo_push0_SinglePubInfo"},
{ERR_PACK(ERR_LIB_CRMF, CRMF_F_OSSL_CRMF_MSG_PUSH0_EXTENSION, 0),
"OSSL_CRMF_MSG_push0_extension"},
{ERR_PACK(ERR_LIB_CRMF, CRMF_F_OSSL_CRMF_MSG_PUSH0_REGCTRL, 0),
"OSSL_CRMF_MSG_push0_regCtrl"},
{ERR_PACK(ERR_LIB_CRMF, CRMF_F_OSSL_CRMF_MSG_PUSH0_REGINFO, 0),
"OSSL_CRMF_MSG_push0_regInfo"},
{ERR_PACK(ERR_LIB_CRMF, CRMF_F_OSSL_CRMF_MSG_SET0_EXTENSIONS, 0),
"OSSL_CRMF_MSG_set0_extensions"},
{ERR_PACK(ERR_LIB_CRMF, CRMF_F_OSSL_CRMF_MSG_SET0_SINGLEPUBINFO, 0),
"OSSL_CRMF_MSG_set0_SinglePubInfo"},
{ERR_PACK(ERR_LIB_CRMF, CRMF_F_OSSL_CRMF_MSG_SET_CERTREQID, 0),
"OSSL_CRMF_MSG_set_certReqId"},
{ERR_PACK(ERR_LIB_CRMF, CRMF_F_OSSL_CRMF_MSG_SET_PKIPUBLICATIONINFO_ACTION, 0),
"OSSL_CRMF_MSG_set_PKIPublicationInfo_action"},
{ERR_PACK(ERR_LIB_CRMF, CRMF_F_OSSL_CRMF_MSG_SET_VALIDITY, 0),
"OSSL_CRMF_MSG_set_validity"},
{ERR_PACK(ERR_LIB_CRMF, CRMF_F_OSSL_CRMF_PBMP_NEW, 0),
"OSSL_CRMF_pbmp_new"},
{ERR_PACK(ERR_LIB_CRMF, CRMF_F_OSSL_CRMF_PBM_NEW, 0), "OSSL_CRMF_pbm_new"},
{0, NULL}
};
static const ERR_STRING_DATA CRMF_str_reasons[] = {
{ERR_PACK(ERR_LIB_CRMF, 0, CRMF_R_BAD_PBM_ITERATIONCOUNT),
"bad pbm iterationcount"},
@@ -95,10 +54,8 @@ static const ERR_STRING_DATA CRMF_str_reasons[] = {
int ERR_load_CRMF_strings(void)
{
#ifndef OPENSSL_NO_ERR
if (ERR_func_error_string(CRMF_str_functs[0].error) == NULL) {
ERR_load_strings_const(CRMF_str_functs);
if (ERR_reason_error_string(CRMF_str_reasons[0].error) == NULL)
ERR_load_strings_const(CRMF_str_reasons);
}
#endif
return 1;
}
crypto/crmf/crmf_lib.c
+29 -24
View File
@@ -29,6 +29,7 @@
#include <openssl/asn1t.h>
#include "crmf_int.h"
#include "internal/constant_time_locl.h"
/* explicit #includes not strictly needed since implied by the above: */
#include <openssl/crmf.h>
@@ -200,10 +201,7 @@ OSSL_CRMF_CERTID *OSSL_CRMF_CERTID_gen(const X509_NAME *issuer,
/*
* id-regCtrl-protocolEncrKey Control (section 6.6)
*
* For some reason X509_PUBKEY_dup() is not implemented in OpenSSL X509
* TODO: check whether that should go elsewhere
*/
static IMPLEMENT_ASN1_DUP_FUNCTION(X509_PUBKEY)
IMPLEMENT_CRMF_CTRL_FUNC(protocolEncrKey, X509_PUBKEY, regCtrl)
/*-
@@ -299,20 +297,20 @@ int OSSL_CRMF_MSG_set_certReqId(OSSL_CRMF_MSG *crm, int rid)
}
/* get ASN.1 encoded integer, return -1 on error */
static int crmf_asn1_get_int(int func, const ASN1_INTEGER *a)
static int crmf_asn1_get_int(const ASN1_INTEGER *a)
{
int64_t res;
if (!ASN1_INTEGER_get_int64(&res, a)) {
CRMFerr(func, ASN1_R_INVALID_NUMBER);
CRMFerr(0, ASN1_R_INVALID_NUMBER);
return -1;
}
if (res < INT_MIN) {
CRMFerr(func, ASN1_R_TOO_SMALL);
CRMFerr(0, ASN1_R_TOO_SMALL);
return -1;
}
if (res > INT_MAX) {
CRMFerr(func, ASN1_R_TOO_LARGE);
CRMFerr(0, ASN1_R_TOO_LARGE);
return -1;
}
return (int)res;
@@ -324,8 +322,7 @@ int OSSL_CRMF_MSG_get_certReqId(OSSL_CRMF_MSG *crm)
CRMFerr(CRMF_F_OSSL_CRMF_MSG_GET_CERTREQID, CRMF_R_NULL_ARGUMENT);
return -1;
}
return crmf_asn1_get_int(CRMF_F_OSSL_CRMF_MSG_GET_CERTREQID,
crm->certReq->certReqId);
return crmf_asn1_get_int(crm->certReq->certReqId);
}
@@ -658,7 +655,9 @@ X509 *OSSL_CRMF_ENCRYPTEDVALUE_get1_encCert(OSSL_CRMF_ENCRYPTEDVALUE *ecert,
X509 *cert = NULL; /* decrypted certificate */
EVP_CIPHER_CTX *evp_ctx = NULL; /* context for symmetric encryption */
unsigned char *ek = NULL; /* decrypted symmetric encryption key */
size_t eksize = 0; /* size of decrypted symmetric encryption key */
const EVP_CIPHER *cipher = NULL; /* used cipher */
int cikeysize = 0; /* key size from cipher */
unsigned char *iv = NULL; /* initial vector for symmetric encryption */
unsigned char *outbuf = NULL; /* decryption output buffer */
const unsigned char *p = NULL; /* needed for decoding ASN1 */
@@ -677,18 +676,31 @@ X509 *OSSL_CRMF_ENCRYPTEDVALUE_get1_encCert(OSSL_CRMF_ENCRYPTEDVALUE *ecert,
CRMF_R_UNSUPPORTED_CIPHER);
return NULL;
}
/* select symmetric cipher based on algorithm given in message */
if ((cipher = EVP_get_cipherbynid(symmAlg)) == NULL) {
CRMFerr(CRMF_F_OSSL_CRMF_ENCRYPTEDVALUE_GET1_ENCCERT,
CRMF_R_UNSUPPORTED_CIPHER);
goto end;
}
cikeysize = EVP_CIPHER_key_length(cipher);
/* first the symmetric key needs to be decrypted */
pkctx = EVP_PKEY_CTX_new(pkey, NULL);
if (pkctx != NULL && EVP_PKEY_decrypt_init(pkctx)) {
ASN1_BIT_STRING *encKey = ecert->encSymmKey;
size_t eksize = 0;
size_t failure;
int retval;
if (EVP_PKEY_decrypt(pkctx, NULL, &eksize, encKey->data, encKey->length)
<= 0
|| (ek = OPENSSL_malloc(eksize)) == NULL
|| EVP_PKEY_decrypt(pkctx, ek, &eksize, encKey->data,
encKey->length) <= 0) {
if (EVP_PKEY_decrypt(pkctx, NULL, &eksize,
encKey->data, encKey->length) <= 0
|| (ek = OPENSSL_malloc(eksize)) == NULL)
goto oom;
retval = EVP_PKEY_decrypt(pkctx, ek, &eksize,
encKey->data, encKey->length);
ERR_clear_error(); /* error state may have sensitive information */
failure = ~constant_time_is_zero_s(constant_time_msb(retval)
| constant_time_is_zero(retval));
failure |= ~constant_time_eq_s(eksize, (size_t)cikeysize);
if (failure) {
CRMFerr(CRMF_F_OSSL_CRMF_ENCRYPTEDVALUE_GET1_ENCCERT,
CRMF_R_ERROR_DECRYPTING_SYMMETRIC_KEY);
goto end;
@@ -696,13 +708,6 @@ X509 *OSSL_CRMF_ENCRYPTEDVALUE_get1_encCert(OSSL_CRMF_ENCRYPTEDVALUE *ecert,
} else {
goto oom;
}
/* select symmetric cipher based on algorithm given in message */
if ((cipher = EVP_get_cipherbynid(symmAlg)) == NULL) {
CRMFerr(CRMF_F_OSSL_CRMF_ENCRYPTEDVALUE_GET1_ENCCERT,
CRMF_R_UNSUPPORTED_CIPHER);
goto end;
}
if ((iv = OPENSSL_malloc(EVP_CIPHER_iv_length(cipher))) == NULL)
goto oom;
if (ASN1_TYPE_get_octetstring(ecert->symmAlg->parameter, iv,
@@ -747,7 +752,7 @@ X509 *OSSL_CRMF_ENCRYPTEDVALUE_get1_encCert(OSSL_CRMF_ENCRYPTEDVALUE *ecert,
EVP_PKEY_CTX_free(pkctx);
OPENSSL_free(outbuf);
EVP_CIPHER_CTX_free(evp_ctx);
OPENSSL_free(ek);
OPENSSL_clear_free(ek, eksize);
OPENSSL_free(iv);
return cert;
}
crypto/crmf/crmf_pbm.c
+22 -8
View File
@@ -12,6 +12,8 @@
*/
#include <string.h>
#include <openssl/rand.h>
#include <openssl/evp.h>
@@ -22,6 +24,8 @@
#include <openssl/crmf.h>
#include <openssl/err.h>
#include <openssl/evp.h>
#include <openssl/params.h>
#include <openssl/core_names.h>
/*-
* creates and initializes OSSL_CRMF_PBMPARAMETER (section 4.4)
@@ -120,9 +124,10 @@ OSSL_CRMF_PBMPARAMETER *OSSL_CRMF_pbmp_new(size_t slen, int owfnid,
int OSSL_CRMF_pbm_new(const OSSL_CRMF_PBMPARAMETER *pbmp,
const unsigned char *msg, size_t msglen,
const unsigned char *sec, size_t seclen,
unsigned char **mac, size_t *maclen)
unsigned char **out, size_t *outlen)
{
int mac_nid, hmac_md_nid = NID_undef;
const char *mdname = NULL;
const EVP_MD *m = NULL;
EVP_MD_CTX *ctx = NULL;
unsigned char basekey[EVP_MAX_MD_SIZE];
@@ -130,9 +135,12 @@ int OSSL_CRMF_pbm_new(const OSSL_CRMF_PBMPARAMETER *pbmp,
int64_t iterations;
unsigned char *mac_res = 0;
int ok = 0;
EVP_MAC *mac = NULL;
EVP_MAC_CTX *mctx = NULL;
OSSL_PARAM macparams[3] =
{ OSSL_PARAM_END, OSSL_PARAM_END, OSSL_PARAM_END };
if (mac == NULL || pbmp == NULL || pbmp->mac == NULL
if (out == NULL || pbmp == NULL || pbmp->mac == NULL
|| pbmp->mac->algorithm == NULL || msg == NULL || sec == NULL) {
CRMFerr(CRMF_F_OSSL_CRMF_PBM_NEW, CRMF_R_NULL_ARGUMENT);
goto err;
@@ -193,17 +201,22 @@ int OSSL_CRMF_pbm_new(const OSSL_CRMF_PBMPARAMETER *pbmp,
mac_nid = OBJ_obj2nid(pbmp->mac->algorithm);
if (!EVP_PBE_find(EVP_PBE_TYPE_PRF, mac_nid, NULL, &hmac_md_nid, NULL)
|| ((m = EVP_get_digestbynid(hmac_md_nid)) == NULL)) {
|| ((mdname = OBJ_nid2sn(hmac_md_nid)) == NULL)) {
CRMFerr(CRMF_F_OSSL_CRMF_PBM_NEW, CRMF_R_UNSUPPORTED_ALGORITHM);
goto err;
}
if ((mctx = EVP_MAC_CTX_new(EVP_get_macbyname("HMAC"))) == NULL
|| EVP_MAC_ctrl(mctx, EVP_MAC_CTRL_SET_MD, m) <= 0
|| EVP_MAC_ctrl(mctx, EVP_MAC_CTRL_SET_KEY, basekey, bklen) <= 0
macparams[0] =
OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST,
(char *)mdname, 0);
macparams[1] =
OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY, basekey, bklen);
if ((mac = EVP_MAC_fetch(NULL, "HMAC", NULL)) == NULL
|| (mctx = EVP_MAC_CTX_new(mac)) == NULL
|| !EVP_MAC_CTX_set_params(mctx, macparams)
|| !EVP_MAC_init(mctx)
|| !EVP_MAC_update(mctx, msg, msglen)
|| !EVP_MAC_final(mctx, mac_res, maclen))
|| !EVP_MAC_final(mctx, mac_res, outlen, EVP_MAX_MD_SIZE))
goto err;
ok = 1;
@@ -212,10 +225,11 @@ int OSSL_CRMF_pbm_new(const OSSL_CRMF_PBMPARAMETER *pbmp,
/* cleanup */
OPENSSL_cleanse(basekey, bklen);
EVP_MAC_CTX_free(mctx);
EVP_MAC_free(mac);
EVP_MD_CTX_free(ctx);
if (ok == 1) {
*mac = mac_res;
*out = mac_res;
return 1;
}