From 6ed909873d71fca3010536abf6b872fafb4e42bd Mon Sep 17 00:00:00 2001 From: Hakase Date: Thu, 23 Aug 2018 00:44:44 +0900 Subject: [PATCH] Update pre10 --- CHANGES | 2 +- Configure | 19 +- NEWS | 2 +- README | 2 +- apps/ca.c | 22 +- apps/req.c | 11 +- apps/s_client.c | 14 +- crypto/ec/ecp_smpl.c | 63 ++--- crypto/ec/ecx_meth.c | 16 +- crypto/mem_sec.c | 16 +- crypto/rand/rand_lib.c | 8 +- crypto/rand/rand_unix.c | 106 +++++--- crypto/threads_none.c | 12 - crypto/threads_pthread.c | 38 --- crypto/threads_win.c | 12 - crypto/uid.c | 16 +- crypto/x509/x509_meth.c | 4 +- doc/man1/ca.pod | 9 +- doc/man1/req.pod | 10 +- doc/man1/s_client.pod | 8 +- doc/man3/BIO_s_file.pod | 2 +- doc/man3/BN_generate_prime.pod | 2 +- doc/man3/CRYPTO_THREAD_run_once.pod | 17 +- doc/man3/EVP_PKEY_get_default_digest_nid.pod | 3 +- doc/man3/RSA_generate_key.pod | 2 +- doc/man3/SSL_CTX_set_verify.pod | 17 +- doc/man7/Ed25519.pod | 10 +- include/internal/refcount.h | 73 +++++- include/openssl/crypto.h | 2 - include/openssl/opensslv.h | 4 +- include/openssl/ssl.h | 3 +- include/openssl/x509_vfy.h | 2 +- ssl/ssl_cert.c | 3 +- ssl/ssl_lib.c | 10 +- ssl/ssl_locl.h | 7 +- ssl/statem/extensions.c | 2 +- ssl/statem/extensions_clnt.c | 21 +- ssl/statem/statem_lib.c | 153 ++++++----- ssl/t1_lib.c | 2 +- test/evp_test.c | 99 +++++--- test/handshake_helper.c | 4 +- test/ossl_shim/ossl_config.json | 7 +- test/recipes/30-test_evp_data/evpciph.txt | 2 +- test/recipes/30-test_evp_data/evppkey.txt | 2 +- test/recipes/30-test_evp_data/evppkey_ecc.txt | 237 ++++++++++++++++++ test/recipes/70-test_tls13downgrade.t | 19 +- test/recipes/70-test_tls13messages.t | 2 +- test/secmemtest.c | 44 ++++ test/ssl-tests/26-tls13_client_auth.conf | 16 +- test/ssl-tests/26-tls13_client_auth.conf.in | 33 ++- test/ssl_test_ctx.c | 6 +- test/ssl_test_ctx.h | 4 +- test/sslapitest.c | 7 +- util/libcrypto.num | 2 - util/libssl.num | 3 +- 55 files changed, 818 insertions(+), 394 deletions(-) diff --git a/CHANGES b/CHANGES index 760160fa..e2e61bb7 100644 --- a/CHANGES +++ b/CHANGES @@ -7,7 +7,7 @@ https://github.com/openssl/openssl/commits/ and pick the appropriate release branch. - Changes between 1.1.0h and 1.1.1 [xx XXX xxxx] + Changes between 1.1.0i and 1.1.1 [xx XXX xxxx] *) s390x assembly pack: add (improved) hardware-support for the following cryptographic primitives: sha3, shake, aes-gcm, aes-ccm, aes-ctr, aes-ofb, diff --git a/Configure b/Configure index c9f6ea76..3baa8ce0 100755 --- a/Configure +++ b/Configure @@ -1010,9 +1010,18 @@ if (scalar(@seed_sources) == 0) { print "Using os-specific seed configuration\n"; push @seed_sources, 'os'; } -die "Cannot seed with none and anything else" - if scalar(grep { $_ eq 'none' } @seed_sources) > 0 - && scalar(@seed_sources) > 1; +if (scalar(grep { $_ eq 'none' } @seed_sources) > 0) { + die "Cannot seed with none and anything else" if scalar(@seed_sources) > 1; + warn <<_____ if scalar(@seed_sources) == 1; +You have selected the --with-rand-seed=none option, which effectively disables +automatic reseeding of the OpenSSL random generator. All operations depending +on the random generator such as creating keys will not work unless the random +generator is seeded manually by the application. + +Please read the 'Note on random number generation' section in the INSTALL +instructions and the RAND_DRBG(7) manual page for more details. +_____ +} push @{$config{openssl_other_defines}}, map { (my $x = $_) =~ tr|[\-a-z]|[_A-Z]|; "OPENSSL_RAND_SEED_$x" } @seed_sources; @@ -1432,7 +1441,7 @@ if (!$disabled{makedepend}) { } } -if (!$disabled{asm}) { +if (!$disabled{asm} && !$predefined{__MACH__} && $^O ne 'VMS') { # probe for -Wa,--noexecstack option... if ($predefined{__clang__}) { # clang has builtin assembler, which doesn't recognize --help, @@ -1440,7 +1449,7 @@ if (!$disabled{asm}) { # supported platforms even when it's meaningless. In other words # probe would fail, but probed option always accepted... push @{$config{cflags}}, "-Wa,--noexecstack", "-Qunused-arguments"; - } elsif ($^O ne 'VMS') { + } else { my $cc = $config{CROSS_COMPILE}.$config{CC}; open(PIPE, "$cc -Wa,--help -c -o null.$$.o -x assembler /dev/null 2>&1 |"); while() { diff --git a/NEWS b/NEWS index 1f98b931..9ac74561 100644 --- a/NEWS +++ b/NEWS @@ -5,7 +5,7 @@ This file gives a brief overview of the major changes between each OpenSSL release. For more details please read the CHANGES file. - Major changes between OpenSSL 1.1.0h and OpenSSL 1.1.1 [in pre-release] + Major changes between OpenSSL 1.1.0i and OpenSSL 1.1.1 [in pre-release] o Support for TLSv1.3 added o Move the display of configuration data to configdata.pm. diff --git a/README b/README index d6c36552..6075f166 100644 --- a/README +++ b/README @@ -1,5 +1,5 @@ - OpenSSL 1.1.1-pre9-dev + OpenSSL 1.1.1-pre10-dev Copyright (c) 1998-2018 The OpenSSL Project Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson diff --git a/apps/ca.c b/apps/ca.c index 558809ee..48f7cd19 100644 --- a/apps/ca.c +++ b/apps/ca.c @@ -255,7 +255,7 @@ int ca_main(int argc, char **argv) int batch = 0, default_op = 1, doupdatedb = 0, ext_copy = EXT_COPY_NONE; int keyformat = FORMAT_PEM, multirdn = 0, notext = 0, output_der = 0; int ret = 1, email_dn = 1, req = 0, verbose = 0, gencrl = 0, dorevoke = 0; - int rand_ser = 0, i, j, selfsign = 0; + int rand_ser = 0, i, j, selfsign = 0, def_nid, def_ret; long crldays = 0, crlhours = 0, crlsec = 0, days = 0; unsigned long chtype = MBSTRING_ASC, certopt = 0; X509 *x509 = NULL, *x509p = NULL, *x = NULL; @@ -728,24 +728,28 @@ end_of_options: } } - if (md == NULL && (md = lookup_conf(conf, section, ENV_DEFAULT_MD)) == NULL) - goto end; - - if (strcmp(md, "null") == 0) { + def_ret = EVP_PKEY_get_default_digest_nid(pkey, &def_nid); + /* + * EVP_PKEY_get_default_digest_nid() returns 2 if the digest is + * mandatory for this algorithm. + */ + if (def_ret == 2 && def_nid == NID_undef) { + /* The signing algorithm requires there to be no digest */ dgst = EVP_md_null(); + } else if (md == NULL + && (md = lookup_conf(conf, section, ENV_DEFAULT_MD)) == NULL) { + goto end; } else { if (strcmp(md, "default") == 0) { - int def_nid; - if (EVP_PKEY_get_default_digest_nid(pkey, &def_nid) <= 0) { + if (def_ret <= 0) { BIO_puts(bio_err, "no default digest\n"); goto end; } md = (char *)OBJ_nid2sn(def_nid); } - if (!opt_md(md, &dgst)) { + if (!opt_md(md, &dgst)) goto end; - } } if (req) { diff --git a/apps/req.c b/apps/req.c index 48f3a3ab..08a1468e 100644 --- a/apps/req.c +++ b/apps/req.c @@ -1601,10 +1601,19 @@ static int do_sign_init(EVP_MD_CTX *ctx, EVP_PKEY *pkey, const EVP_MD *md, STACK_OF(OPENSSL_STRING) *sigopts) { EVP_PKEY_CTX *pkctx = NULL; - int i; + int i, def_nid; if (ctx == NULL) return 0; + /* + * EVP_PKEY_get_default_digest_nid() returns 2 if the digest is mandatory + * for this algorithm. + */ + if (EVP_PKEY_get_default_digest_nid(pkey, &def_nid) == 2 + && def_nid == NID_undef) { + /* The signing algorithm requires there to be no digest */ + md = NULL; + } if (!EVP_DigestSignInit(ctx, &pkctx, md, NULL, pkey)) return 0; for (i = 0; i < sk_OPENSSL_STRING_num(sigopts); i++) { diff --git a/apps/s_client.c b/apps/s_client.c index 8f9ad9dd..dcaa10cf 100644 --- a/apps/s_client.c +++ b/apps/s_client.c @@ -595,7 +595,7 @@ typedef enum OPTION_choice { OPT_CT, OPT_NOCT, OPT_CTLOG_FILE, #endif OPT_DANE_TLSA_RRDATA, OPT_DANE_EE_NO_NAME, - OPT_FORCE_PHA, + OPT_ENABLE_PHA, OPT_R_ENUM } OPTION_CHOICE; @@ -786,7 +786,7 @@ const OPTIONS s_client_options[] = { #endif {"keylogfile", OPT_KEYLOG_FILE, '>', "Write TLS secrets to file"}, {"early_data", OPT_EARLY_DATA, '<', "File to send as early data"}, - {"force_pha", OPT_FORCE_PHA, '-', "Force-enable post-handshake-authentication"}, + {"enable_pha", OPT_ENABLE_PHA, '-', "Enable post-handshake-authentication"}, {NULL, OPT_EOF, 0x00, NULL} }; @@ -975,7 +975,7 @@ int s_client_main(int argc, char **argv) int isdtls = 0; #endif char *psksessf = NULL; - int force_pha = 0; + int enable_pha = 0; FD_ZERO(&readfds); FD_ZERO(&writefds); @@ -1492,8 +1492,8 @@ int s_client_main(int argc, char **argv) case OPT_EARLY_DATA: early_data_file = opt_arg(); break; - case OPT_FORCE_PHA: - force_pha = 1; + case OPT_ENABLE_PHA: + enable_pha = 1; break; } } @@ -1944,8 +1944,8 @@ int s_client_main(int argc, char **argv) if (con == NULL) goto end; - if (force_pha) - SSL_force_post_handshake_auth(con); + if (enable_pha) + SSL_set_post_handshake_auth(con, 1); if (sess_in != NULL) { SSL_SESSION *sess; diff --git a/crypto/ec/ecp_smpl.c b/crypto/ec/ecp_smpl.c index 7ac519ca..d0c5557f 100644 --- a/crypto/ec/ecp_smpl.c +++ b/crypto/ec/ecp_smpl.c @@ -1483,10 +1483,10 @@ int ec_GFp_simple_ladder_pre(const EC_GROUP *group, } /*- - * Differential addition-and-doubling using Eq. (8) and (10) from Izu-Takagi + * Differential addition-and-doubling using Eq. (9) and (10) from Izu-Takagi * "A fast parallel elliptic curve multiplication resistant against side channel * attacks", as described at - * https://hyperelliptic.org/EFD/g1p/auto-shortw-xz.html#ladder-ladd-2002-it-3 + * https://hyperelliptic.org/EFD/g1p/auto-shortw-xz.html#ladder-ladd-2002-it-4 */ int ec_GFp_simple_ladder_step(const EC_GROUP *group, EC_POINT *r, EC_POINT *s, @@ -1511,39 +1511,42 @@ int ec_GFp_simple_ladder_step(const EC_GROUP *group, || !group->meth->field_mul(group, t2, r->X, s->Z, ctx) || !group->meth->field_mul(group, t3, r->Z, s->X, ctx) || !group->meth->field_mul(group, t4, group->a, t1, ctx) - || !BN_mod_sub_quick(t4, t0, t4, group->field) - || !BN_mod_add_quick(t5, t3, t2, group->field) - || !group->meth->field_sqr(group, t4, t4, ctx) - || !group->meth->field_mul(group, t5, t1, t5, ctx) - || !BN_mod_lshift_quick(t0, group->b, 2, group->field) - || !group->meth->field_mul(group, t5, t0, t5, ctx) - || !BN_mod_sub_quick(t5, t4, t5, group->field) + || !BN_mod_add_quick(t0, t0, t4, group->field) + || !BN_mod_add_quick(t4, t3, t2, group->field) + || !group->meth->field_mul(group, t0, t4, t0, ctx) + || !group->meth->field_sqr(group, t1, t1, ctx) + || !BN_mod_lshift_quick(t7, group->b, 2, group->field) + || !group->meth->field_mul(group, t1, t7, t1, ctx) + || !BN_mod_lshift1_quick(t0, t0, group->field) + || !BN_mod_add_quick(t0, t1, t0, group->field) + || !BN_mod_sub_quick(t1, t2, t3, group->field) + || !group->meth->field_sqr(group, t1, t1, ctx) + || !group->meth->field_mul(group, t3, t1, p->X, ctx) + || !group->meth->field_mul(group, t0, p->Z, t0, ctx) /* s->X coord output */ - || !group->meth->field_mul(group, s->X, t5, p->Z, ctx) - || !BN_mod_sub_quick(t3, t2, t3, group->field) - || !group->meth->field_sqr(group, t3, t3, ctx) + || !BN_mod_sub_quick(s->X, t0, t3, group->field) /* s->Z coord output */ - || !group->meth->field_mul(group, s->Z, t3, p->X, ctx) - || !group->meth->field_sqr(group, t2, r->X, ctx) - || !group->meth->field_sqr(group, t4, r->Z, ctx) - || !group->meth->field_mul(group, t1, t4, group->a, ctx) - || !BN_mod_add_quick(t6, r->X, r->Z, group->field) + || !group->meth->field_mul(group, s->Z, p->Z, t1, ctx) + || !group->meth->field_sqr(group, t3, r->X, ctx) + || !group->meth->field_sqr(group, t2, r->Z, ctx) + || !group->meth->field_mul(group, t4, t2, group->a, ctx) + || !BN_mod_add_quick(t5, r->X, r->Z, group->field) + || !group->meth->field_sqr(group, t5, t5, ctx) + || !BN_mod_sub_quick(t5, t5, t3, group->field) + || !BN_mod_sub_quick(t5, t5, t2, group->field) + || !BN_mod_sub_quick(t6, t3, t4, group->field) || !group->meth->field_sqr(group, t6, t6, ctx) - || !BN_mod_sub_quick(t6, t6, t2, group->field) - || !BN_mod_sub_quick(t6, t6, t4, group->field) - || !BN_mod_sub_quick(t7, t2, t1, group->field) - || !group->meth->field_sqr(group, t7, t7, ctx) - || !group->meth->field_mul(group, t5, t4, t6, ctx) - || !group->meth->field_mul(group, t5, t0, t5, ctx) + || !group->meth->field_mul(group, t0, t2, t5, ctx) + || !group->meth->field_mul(group, t0, t7, t0, ctx) /* r->X coord output */ - || !BN_mod_sub_quick(r->X, t7, t5, group->field) - || !BN_mod_add_quick(t2, t2, t1, group->field) - || !group->meth->field_sqr(group, t5, t4, ctx) - || !group->meth->field_mul(group, t5, t5, t0, ctx) - || !group->meth->field_mul(group, t6, t6, t2, ctx) - || !BN_mod_lshift1_quick(t6, t6, group->field) + || !BN_mod_sub_quick(r->X, t6, t0, group->field) + || !BN_mod_add_quick(t6, t3, t4, group->field) + || !group->meth->field_sqr(group, t3, t2, ctx) + || !group->meth->field_mul(group, t7, t3, t7, ctx) + || !group->meth->field_mul(group, t5, t5, t6, ctx) + || !BN_mod_lshift1_quick(t5, t5, group->field) /* r->Z coord output */ - || !BN_mod_add_quick(r->Z, t5, t6, group->field)) + || !BN_mod_add_quick(r->Z, t7, t5, group->field)) goto err; ret = 1; diff --git a/crypto/ec/ecx_meth.c b/crypto/ec/ecx_meth.c index e75e07b0..b76bfdb6 100644 --- a/crypto/ec/ecx_meth.c +++ b/crypto/ec/ecx_meth.c @@ -331,8 +331,18 @@ static int ecx_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2) } return 0; + default: + return -2; + + } +} + +static int ecd_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2) +{ + switch (op) { case ASN1_PKEY_CTRL_DEFAULT_MD_NID: - *(int *)arg2 = NID_sha256; + /* We currently only support Pure EdDSA which takes no digest */ + *(int *)arg2 = NID_undef; return 2; default: @@ -579,7 +589,7 @@ const EVP_PKEY_ASN1_METHOD ed25519_asn1_meth = { 0, 0, ecx_free, - 0, + ecd_ctrl, NULL, NULL, ecd_item_verify, @@ -621,7 +631,7 @@ const EVP_PKEY_ASN1_METHOD ed448_asn1_meth = { 0, 0, ecx_free, - 0, + ecd_ctrl, NULL, NULL, ecd_item_verify, diff --git a/crypto/mem_sec.c b/crypto/mem_sec.c index 959c6371..c4190bed 100644 --- a/crypto/mem_sec.c +++ b/crypto/mem_sec.c @@ -137,11 +137,12 @@ void *CRYPTO_secure_malloc(size_t num, const char *file, int line) void *CRYPTO_secure_zalloc(size_t num, const char *file, int line) { - void *ret = CRYPTO_secure_malloc(num, file, line); - - if (ret != NULL) - memset(ret, 0, num); - return ret; +#ifdef IMPLEMENTED + if (secure_mem_initialized) + /* CRYPTO_secure_malloc() zeroes allocations when it is implemented */ + return CRYPTO_secure_malloc(num, file, line); +#endif + return CRYPTO_zalloc(num, file, line); } void CRYPTO_secure_free(void *ptr, const char *file, int line) @@ -588,6 +589,9 @@ static void *sh_malloc(size_t size) OPENSSL_assert(WITHIN_ARENA(chunk)); + /* zero the free list header as a precaution against information leakage */ + memset(chunk, 0, sizeof(SH_LIST)); + return chunk; } @@ -620,6 +624,8 @@ static void sh_free(void *ptr) list--; + /* Zero the higher addressed block's free list pointers */ + memset(ptr > buddy ? ptr : buddy, 0, sizeof(SH_LIST)); if (ptr > buddy) ptr = buddy; diff --git a/crypto/rand/rand_lib.c b/crypto/rand/rand_lib.c index 6123d148..e9bc9522 100644 --- a/crypto/rand/rand_lib.c +++ b/crypto/rand/rand_lib.c @@ -31,6 +31,8 @@ int rand_fork_count; static CRYPTO_RWLOCK *rand_nonce_lock; static int rand_nonce_count; +static int rand_cleaning_up = 0; + #ifdef OPENSSL_RAND_SEED_RDTSC /* * IMPORTANT NOTE: It is not currently possible to use this code @@ -324,7 +326,7 @@ DEFINE_RUN_ONCE_STATIC(do_rand_init) if (rand_nonce_lock == NULL) goto err2; - if (!rand_pool_init()) + if (!rand_cleaning_up && !rand_pool_init()) goto err3; return 1; @@ -346,10 +348,12 @@ void rand_cleanup_int(void) { const RAND_METHOD *meth = default_RAND_meth; + rand_cleaning_up = 1; + if (meth != NULL && meth->cleanup != NULL) meth->cleanup(); - rand_pool_cleanup(); RAND_set_rand_method(NULL); + rand_pool_cleanup(); #ifndef OPENSSL_NO_ENGINE CRYPTO_THREAD_lock_free(rand_engine_lock); rand_engine_lock = NULL; diff --git a/crypto/rand/rand_unix.c b/crypto/rand/rand_unix.c index f482de06..9c62a04e 100644 --- a/crypto/rand/rand_unix.c +++ b/crypto/rand/rand_unix.c @@ -77,8 +77,6 @@ static uint64_t get_timer_bits(void); # endif #endif /* defined(OPENSSL_SYS_UNIX) || defined(__DJGPP__) */ -int syscall_random(void *buf, size_t buflen); - #if (defined(OPENSSL_SYS_VXWORKS) || defined(OPENSSL_SYS_UEFI)) && \ !defined(OPENSSL_RAND_SEED_NONE) # error "UEFI and VXWorks only support seeding NONE" @@ -88,6 +86,8 @@ int syscall_random(void *buf, size_t buflen); || defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_VXWORKS) \ || defined(OPENSSL_SYS_UEFI)) +static ssize_t syscall_random(void *buf, size_t buflen); + # if defined(OPENSSL_SYS_VOS) # ifndef OPENSSL_RAND_SEED_OS @@ -192,22 +192,29 @@ void rand_pool_keep_random_devices_open(int keep) # if (defined(__FreeBSD__) || defined(__NetBSD__)) && defined(KERN_ARND) /* * sysctl_random(): Use sysctl() to read a random number from the kernel - * Returns the size on success, 0 on failure. + * Returns the number of bytes returned in buf on success, -1 on failure. */ -static size_t sysctl_random(char *buf, size_t buflen) +static ssize_t sysctl_random(char *buf, size_t buflen) { int mib[2]; size_t done = 0; size_t len; + /* + * Note: sign conversion between size_t and ssize_t is safe even + * without a range check, see comment in syscall_random() + */ + /* * On FreeBSD old implementations returned longs, newer versions support * variable sizes up to 256 byte. The code below would not work properly * when the sysctl returns long and we want to request something not a * multiple of longs, which should never be the case. */ - if (!ossl_assert(buflen % sizeof(long) == 0)) - return 0; + if (!ossl_assert(buflen % sizeof(long) == 0)) { + errno = EINVAL; + return -1; + } /* * On NetBSD before 4.0 KERN_ARND was an alias for KERN_URND, and only @@ -217,7 +224,8 @@ static size_t sysctl_random(char *buf, size_t buflen) * Just return an error on older NetBSD versions. */ #if defined(__NetBSD__) && __NetBSD_Version__ < 400000000 - return 0; + errno = ENOSYS; + return -1; #endif mib[0] = CTL_KERN; @@ -226,7 +234,7 @@ static size_t sysctl_random(char *buf, size_t buflen) do { len = buflen; if (sysctl(mib, 2, buf, &len, NULL, 0) == -1) - return done; + return done > 0 ? done : -1; done += len; buf += len; buflen -= len; @@ -238,10 +246,20 @@ static size_t sysctl_random(char *buf, size_t buflen) /* * syscall_random(): Try to get random data using a system call - * returns the number of bytes returned in buf, or <= 0 on error. + * returns the number of bytes returned in buf, or < 0 on error. */ -int syscall_random(void *buf, size_t buflen) +static ssize_t syscall_random(void *buf, size_t buflen) { + /* + * Note: 'buflen' equals the size of the buffer which is used by the + * get_entropy() callback of the RAND_DRBG. It is roughly bounded by + * + * 2 * DRBG_MINMAX_FACTOR * (RAND_DRBG_STRENGTH / 8) = 2^13 + * + * which is way below the OSSL_SSIZE_MAX limit. Therefore sign conversion + * between size_t and ssize_t is safe even without a range check. + */ + /* * Do runtime detection to find getentropy(). * @@ -253,10 +271,10 @@ int syscall_random(void *buf, size_t buflen) * - FreeBSD since 12.0 (1200061) */ # if defined(__GNUC__) && __GNUC__>=2 && defined(__ELF__) && !defined(__hpux) - extern int getentropy(void *bufer, size_t length) __attribute__((weak)); + extern int getentropy(void *buffer, size_t length) __attribute__((weak)); if (getentropy != NULL) - return getentropy(buf, buflen) == 0 ? buflen : 0; + return getentropy(buf, buflen) == 0 ? (ssize_t)buflen : -1; # else union { void *p; @@ -271,19 +289,18 @@ int syscall_random(void *buf, size_t buflen) p_getentropy.p = DSO_global_lookup("getentropy"); ERR_pop_to_mark(); if (p_getentropy.p != NULL) - return p_getentropy.f(buf, buflen) == 0 ? buflen : 0; + return p_getentropy.f(buf, buflen) == 0 ? (ssize_t)buflen : -1; # endif /* Linux supports this since version 3.17 */ # if defined(__linux) && defined(SYS_getrandom) - return (int)syscall(SYS_getrandom, buf, buflen, 0); -# endif - -# if (defined(__FreeBSD__) || defined(__NetBSD__)) && defined(KERN_ARND) - return (int)sysctl_random(buf, buflen); -# endif - + return syscall(SYS_getrandom, buf, buflen, 0); +# elif (defined(__FreeBSD__) || defined(__NetBSD__)) && defined(KERN_ARND) + return sysctl_random(buf, buflen); +# else + errno = ENOSYS; return -1; +# endif } #if !defined(OPENSSL_RAND_SEED_NONE) && defined(OPENSSL_RAND_SEED_DEVRANDOM) @@ -441,17 +458,25 @@ size_t rand_pool_acquire_entropy(RAND_POOL *pool) unsigned char *buffer; # ifdef OPENSSL_RAND_SEED_GETRANDOM - bytes_needed = rand_pool_bytes_needed(pool, 1 /*entropy_factor*/); - buffer = rand_pool_add_begin(pool, bytes_needed); - if (buffer != NULL) { - size_t bytes = 0; + { + ssize_t bytes; + /* Maximum allowed number of consecutive unsuccessful attempts */ + int attempts = 3; - if (syscall_random(buffer, bytes_needed) == (int)bytes_needed) - bytes = bytes_needed; - - rand_pool_add_end(pool, bytes, 8 * bytes); - entropy_available = rand_pool_entropy_available(pool); + bytes_needed = rand_pool_bytes_needed(pool, 1 /*entropy_factor*/); + while (bytes_needed != 0 && attempts-- > 0) { + buffer = rand_pool_add_begin(pool, bytes_needed); + bytes = syscall_random(buffer, bytes_needed); + if (bytes > 0) { + rand_pool_add_end(pool, bytes, 8 * bytes); + bytes_needed -= bytes; + attempts = 3; /* reset counter after successful attempt */ + } else if (bytes < 0 && errno != EINTR) { + break; + } + } } + entropy_available = rand_pool_entropy_available(pool); if (entropy_available > 0) return entropy_available; # endif @@ -468,22 +493,27 @@ size_t rand_pool_acquire_entropy(RAND_POOL *pool) size_t i; for (i = 0; bytes_needed > 0 && i < OSSL_NELEM(random_device_paths); i++) { + ssize_t bytes = 0; + /* Maximum allowed number of consecutive unsuccessful attempts */ + int attempts = 3; const int fd = get_random_device(i); if (fd == -1) continue; - buffer = rand_pool_add_begin(pool, bytes_needed); - if (buffer != NULL) { - const ssize_t n = read(fd, buffer, bytes_needed); - if (n <= 0) { - close_random_device(i); - continue; + while (bytes_needed != 0 && attempts-- > 0) { + buffer = rand_pool_add_begin(pool, bytes_needed); + bytes = read(fd, buffer, bytes_needed); + + if (bytes > 0) { + rand_pool_add_end(pool, bytes, 8 * bytes); + bytes_needed -= bytes; + attempts = 3; /* reset counter after successful attempt */ + } else if (bytes < 0 && errno != EINTR) { + break; } - - rand_pool_add_end(pool, n, 8 * n); } - if (!keep_random_devices_open) + if (bytes < 0 || !keep_random_devices_open) close_random_device(i); bytes_needed = rand_pool_bytes_needed(pool, 1 /*entropy_factor*/); diff --git a/crypto/threads_none.c b/crypto/threads_none.c index ab6db8e3..4b1940ae 100644 --- a/crypto/threads_none.c +++ b/crypto/threads_none.c @@ -128,18 +128,6 @@ int CRYPTO_atomic_add(int *val, int amount, int *ret, CRYPTO_RWLOCK *lock) return 1; } -int CRYPTO_atomic_read(int *val, int *ret, CRYPTO_RWLOCK *lock) -{ - *ret = *val; - return 1; -} - -int CRYPTO_atomic_write(int *val, int n, CRYPTO_RWLOCK *lock) -{ - *val = n; - return 1; -} - int openssl_init_fork_handlers(void) { return 0; diff --git a/crypto/threads_pthread.c b/crypto/threads_pthread.c index 8d30e1c6..5a59779e 100644 --- a/crypto/threads_pthread.c +++ b/crypto/threads_pthread.c @@ -175,44 +175,6 @@ int CRYPTO_atomic_add(int *val, int amount, int *ret, CRYPTO_RWLOCK *lock) return 1; } -int CRYPTO_atomic_read(int *val, int *ret, CRYPTO_RWLOCK *lock) -{ -# if defined(__GNUC__) && defined(__ATOMIC_ACQUIRE) - if (__atomic_is_lock_free(sizeof(*val), val)) { - __atomic_load(val, ret, __ATOMIC_ACQUIRE); - return 1; - } -# endif - if (!CRYPTO_THREAD_read_lock(lock)) - return 0; - - *ret = *val; - - if (!CRYPTO_THREAD_unlock(lock)) - return 0; - - return 1; -} - -int CRYPTO_atomic_write(int *val, int n, CRYPTO_RWLOCK *lock) -{ -# if defined(__GNUC__) && defined(__ATOMIC_RELEASE) - if (__atomic_is_lock_free(sizeof(*val), val)) { - __atomic_store(val, &n, __ATOMIC_RELEASE); - return 1; - } -# endif - if (!CRYPTO_THREAD_write_lock(lock)) - return 0; - - *val = n; - - if (!CRYPTO_THREAD_unlock(lock)) - return 0; - - return 1; -} - # ifdef OPENSSL_SYS_UNIX static pthread_once_t fork_once_control = PTHREAD_ONCE_INIT; diff --git a/crypto/threads_win.c b/crypto/threads_win.c index 7fdbc1f6..d8fdfb74 100644 --- a/crypto/threads_win.c +++ b/crypto/threads_win.c @@ -155,18 +155,6 @@ int CRYPTO_atomic_add(int *val, int amount, int *ret, CRYPTO_RWLOCK *lock) return 1; } -int CRYPTO_atomic_read(int *val, int *ret, CRYPTO_RWLOCK *lock) -{ - *ret = InterlockedCompareExchange(val, 0, 0); - return 1; -} - -int CRYPTO_atomic_write(int *val, int n, CRYPTO_RWLOCK *lock) -{ - InterlockedExchange(val, n); - return 1; -} - int openssl_init_fork_handlers(void) { return 0; diff --git a/crypto/uid.c b/crypto/uid.c index 4e1890f2..b2bfee32 100644 --- a/crypto/uid.c +++ b/crypto/uid.c @@ -31,12 +31,18 @@ int OPENSSL_issetugid(void) # include OPENSSL_UNISTD # include +# if defined(__GLIBC__) && defined(__GLIBC_PREREQ) +# if __GLIBC_PREREQ(2, 16) +# include +# endif +# endif + int OPENSSL_issetugid(void) { - if (getuid() != geteuid()) - return 1; - if (getgid() != getegid()) - return 1; - return 0; +# ifdef AT_SECURE + return getauxval(AT_SECURE) != 0; +# else + return getuid() != geteuid() || getgid() != getegid(); +# endif } #endif diff --git a/crypto/x509/x509_meth.c b/crypto/x509/x509_meth.c index 05ed4bf8..9dc587a0 100644 --- a/crypto/x509/x509_meth.c +++ b/crypto/x509/x509_meth.c @@ -58,9 +58,9 @@ int (*X509_LOOKUP_meth_get_new_item(const X509_LOOKUP_METHOD* method)) int X509_LOOKUP_meth_set_free( X509_LOOKUP_METHOD *method, - void (*free) (X509_LOOKUP *ctx)) + void (*free_fn) (X509_LOOKUP *ctx)) { - method->free = free; + method->free = free_fn; return 1; } diff --git a/doc/man1/ca.pod b/doc/man1/ca.pod index ebd8a438..9b282e64 100644 --- a/doc/man1/ca.pod +++ b/doc/man1/ca.pod @@ -184,9 +184,9 @@ The number of days to certify the certificate for. =item B<-md alg> The message digest to use. -Any digest supported by the OpenSSL B command can be used. If the signing -key is using Ed25519 or Ed448 then you should specify "null" for the digest. -This option also applies to CRLs. +Any digest supported by the OpenSSL B command can be used. For signing +algorithms that do not support a digest (i.e. Ed25519 and Ed448) any message +digest that is set is ignored. This option also applies to CRLs. =item B<-policy arg> @@ -453,7 +453,8 @@ least one of these must be present to generate a CRL. =item B -The same as the B<-md> option. Mandatory. +The same as the B<-md> option. Mandatory except where the signing algorithm does +not require a digest (i.e. Ed25519 and Ed448). =item B diff --git a/doc/man1/req.pod b/doc/man1/req.pod index db467bba..51f3ec44 100644 --- a/doc/man1/req.pod +++ b/doc/man1/req.pod @@ -209,7 +209,7 @@ the configuration file. Some public key algorithms may override this choice. For instance, DSA signatures always use SHA1, GOST R 34.10 signatures always use -GOST R 34.11-94 (B<-md_gost94>). +GOST R 34.11-94 (B<-md_gost94>), Ed25519 and Ed448 never use any digest. =item B<-config filename> @@ -394,10 +394,10 @@ option. For compatibility B is an equivalent option. =item B -This option specifies the digest algorithm to use. -Any digest supported by the OpenSSL B command can be used. -If not present then MD5 is used. -This option can be overridden on the command line. +This option specifies the digest algorithm to use. Any digest supported by the +OpenSSL B command can be used. This option can be overridden on the +command line. Certain signing algorithms (i.e. Ed25519 and Ed448) will ignore +any digest that has been set. =item B diff --git a/doc/man1/s_client.pod b/doc/man1/s_client.pod index 80152e1b..fa5cb0a9 100644 --- a/doc/man1/s_client.pod +++ b/doc/man1/s_client.pod @@ -134,7 +134,7 @@ B B [B<-ctlogfile>] [B<-keylogfile file>] [B<-early_data file>] -[B<-force_pha>] +[B<-enable_pha>] [B] =head1 DESCRIPTION @@ -700,10 +700,10 @@ Reads the contents of the specified file and attempts to send it as early data to the server. This will only work with resumed sessions that support early data and when the server accepts the early data. -=item B<-force_pha> +=item B<-enable_pha> -For TLSv1.3 only, always send the Post-Handshake Authentication extension, -whether or not a certificate has been provided via B<-cert>. +For TLSv1.3 only, send the Post-Handshake Authentication extension. This will +happen whether or not a certificate has been provided via B<-cert>. =item B<[target]> diff --git a/doc/man3/BIO_s_file.pod b/doc/man3/BIO_s_file.pod index 14ce9520..3829112e 100644 --- a/doc/man3/BIO_s_file.pod +++ b/doc/man3/BIO_s_file.pod @@ -54,7 +54,7 @@ BIO_CLOSE, BIO_NOCLOSE (the close flag) BIO_FP_TEXT (sets the underlying stream to text mode, default is binary: this only has any effect under Win32). -BIO_set_fp() set the fp of a file BIO to B. B has the same +BIO_set_fp() sets the fp of a file BIO to B. B has the same meaning as in BIO_new_fp(), it is a macro. BIO_get_fp() retrieves the fp of a file BIO, it is a macro. diff --git a/doc/man3/BN_generate_prime.pod b/doc/man3/BN_generate_prime.pod index 08158c19..ed17d3d3 100644 --- a/doc/man3/BN_generate_prime.pod +++ b/doc/man3/BN_generate_prime.pod @@ -143,7 +143,7 @@ A callback is invoked through a call to B. This will check the type of the callback and will invoke B for new style callbacks or B for old style. -It is possible to obtained the argument associated with a BN_GENCB structure +It is possible to obtain the argument associated with a BN_GENCB structure (set via a call to BN_GENCB_set or BN_GENCB_set_old) using BN_GENCB_get_arg. BN_generate_prime() (deprecated) works in the same way as diff --git a/doc/man3/CRYPTO_THREAD_run_once.pod b/doc/man3/CRYPTO_THREAD_run_once.pod index a290278b..32776131 100644 --- a/doc/man3/CRYPTO_THREAD_run_once.pod +++ b/doc/man3/CRYPTO_THREAD_run_once.pod @@ -4,8 +4,8 @@ CRYPTO_THREAD_run_once, CRYPTO_THREAD_lock_new, CRYPTO_THREAD_read_lock, CRYPTO_THREAD_write_lock, -CRYPTO_THREAD_unlock, CRYPTO_THREAD_lock_free, CRYPTO_atomic_add, -CRYPTO_atomic_read, CRYPTO_atomic_write - OpenSSL thread support +CRYPTO_THREAD_unlock, CRYPTO_THREAD_lock_free, +CRYPTO_atomic_add - OpenSSL thread support =head1 SYNOPSIS @@ -21,8 +21,6 @@ CRYPTO_atomic_read, CRYPTO_atomic_write - OpenSSL thread support void CRYPTO_THREAD_lock_free(CRYPTO_RWLOCK *lock); int CRYPTO_atomic_add(int *val, int amount, int *ret, CRYPTO_RWLOCK *lock); - int CRYPTO_atomic_read(int *val, int *ret, CRYPTO_RWLOCK *lock); - int CRYPTO_atomic_write(int *val, int n, CRYPTO_RWLOCK *lock); =head1 DESCRIPTION @@ -77,17 +75,6 @@ operations are supported on the specific platform. Because of this, if a variable is modified by CRYPTO_atomic_add() then CRYPTO_atomic_add() must be the only way that the variable is modified. -=item * - -CRYPTO_atomic_read() atomically reads B and returns the result of -the operation in B. B will be locked, unless atomic operations -are supported on the specific platform. - -=item * - -CRYPTO_atomic_write() atomically writes B to B. B will be -locked, unless atomic operations are supported on the specific platform. - =back =head1 RETURN VALUES diff --git a/doc/man3/EVP_PKEY_get_default_digest_nid.pod b/doc/man3/EVP_PKEY_get_default_digest_nid.pod index 3dce5c59..6113115a 100644 --- a/doc/man3/EVP_PKEY_get_default_digest_nid.pod +++ b/doc/man3/EVP_PKEY_get_default_digest_nid.pod @@ -13,7 +13,8 @@ EVP_PKEY_get_default_digest_nid - get default signature digest The EVP_PKEY_get_default_digest_nid() function sets B to the default message digest NID for the public key signature operations associated with key -B. +B. Note that some signature algorithms (i.e. Ed25519 and Ed448) do not use +a digest during signing. In this case B will be set to NID_undef. =head1 NOTES diff --git a/doc/man3/RSA_generate_key.pod b/doc/man3/RSA_generate_key.pod index fb3d86ca..a4c078a4 100644 --- a/doc/man3/RSA_generate_key.pod +++ b/doc/man3/RSA_generate_key.pod @@ -93,7 +93,7 @@ L, L, L =head1 HISTORY RSA_generate_key() was deprecated in OpenSSL 0.9.8; use -RSA_generate_key_ex() intsead. +RSA_generate_key_ex() instead. =head1 COPYRIGHT diff --git a/doc/man3/SSL_CTX_set_verify.pod b/doc/man3/SSL_CTX_set_verify.pod index 71655479..c192f9af 100644 --- a/doc/man3/SSL_CTX_set_verify.pod +++ b/doc/man3/SSL_CTX_set_verify.pod @@ -7,7 +7,8 @@ SSL_CTX_set_verify, SSL_set_verify, SSL_CTX_set_verify_depth, SSL_set_verify_depth, SSL_verify_cb, SSL_verify_client_post_handshake, -SSL_force_post_handshake_auth +SSL_set_post_handshake_auth, +SSL_CTX_set_post_handshake_auth - set peer certificate verification parameters =head1 SYNOPSIS @@ -24,7 +25,8 @@ SSL_force_post_handshake_auth void SSL_set_verify_depth(SSL *ssl, int depth); int SSL_verify_client_post_handshake(SSL *ssl); - void SSL_force_post_handshake_auth(SSL *ssl); + void SSL_CTX_set_post_handshake_auth(SSL_CTX *ctx, int val); + void SSL_set_post_handshake_auth(SSL *ssl, int val); =head1 DESCRIPTION @@ -48,10 +50,11 @@ verification that shall be allowed for B. SSL_set_verify_depth() sets the maximum B for the certificate chain verification that shall be allowed for B. -SSL_force_post_handshake_auth() forces the Post-Handshake Authentication -extension to be added to the ClientHello regardless of certificate configuration -at the time of the initial handshake, such that post-handshake authentication -can be requested by the server. A certificate callback will need to be set via +SSL_CTX_set_post_handshake_auth() and SSL_set_post_handshake_auth() enable the +Post-Handshake Authentication extension to be added to the ClientHello such that +post-handshake authentication can be requested by the server. If B is 0 +then the extension is not sent, otherwise it is. By default the extension is not +sent. A certificate callback will need to be set via SSL_CTX_set_client_cert_cb() if no certificate is provided at initialization. SSL_verify_client_post_handshake() causes a CertificateRequest message to be @@ -341,7 +344,7 @@ L =head1 HISTORY The SSL_VERIFY_POST_HANDSHAKE option, and the SSL_verify_client_post_handshake() -and SSL_force_post_handshake_auth() functions were added in OpenSSL 1.1.1. +and SSL_set_post_handshake_auth() functions were added in OpenSSL 1.1.1. =head1 COPYRIGHT diff --git a/doc/man7/Ed25519.pod b/doc/man7/Ed25519.pod index eacc05f2..466e543c 100644 --- a/doc/man7/Ed25519.pod +++ b/doc/man7/Ed25519.pod @@ -13,18 +13,18 @@ one-shot digest sign and digest verify using PureEdDSA and B or B be specified. +No additional parameters can be set during key generation, one-shot signing or +verification. In particular, because PureEdDSA is used, a digest must B be +specified when signing or verifying. =head1 NOTES The PureEdDSA algorithm does not support the streaming mechanism of other signature algorithms using, for example, EVP_DigestUpdate(). The message to sign or verify must be passed using the one-shot -EVP_DigestSign() asn EVP_DigestVerify() functions. +EVP_DigestSign() and EVP_DigestVerify() functions. -When calling EVP_DigestSignInit() or EVP_DigestSignUpdate() the +When calling EVP_DigestSignInit() or EVP_DigestVerifyInit(), the digest parameter B be set to B. Applications wishing to sign certificates (or other structures such as diff --git a/include/internal/refcount.h b/include/internal/refcount.h index c1663a0f..75d70a64 100644 --- a/include/internal/refcount.h +++ b/include/internal/refcount.h @@ -1,5 +1,5 @@ /* - * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -18,26 +18,36 @@ # if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 201112L \ && !defined(__STDC_NO_ATOMICS__) -# include -# define HAVE_C11_ATOMICS +# include +# define HAVE_C11_ATOMICS # endif # if defined(HAVE_C11_ATOMICS) && defined(ATOMIC_INT_LOCK_FREE) \ && ATOMIC_INT_LOCK_FREE > 0 -# define HAVE_ATOMICS 1 +# define HAVE_ATOMICS 1 typedef _Atomic int CRYPTO_REF_COUNT; -static ossl_inline int CRYPTO_UP_REF(_Atomic int *val, int *ret, void *lock) +static inline int CRYPTO_UP_REF(_Atomic int *val, int *ret, void *lock) { *ret = atomic_fetch_add_explicit(val, 1, memory_order_relaxed) + 1; return 1; } -static ossl_inline int CRYPTO_DOWN_REF(_Atomic int *val, int *ret, void *lock) +/* + * Changes to shared structure other than reference counter have to be + * serialized. And any kind of serialization implies a release fence. This + * means that by the time reference counter is decremented all other + * changes are visible on all processors. Hence decrement itself can be + * relaxed. In case it hits zero, object will be destructed. Since it's + * last use of the object, destructor programmer might reason that access + * to mutable members doesn't have to be serialized anymore, which would + * otherwise imply an acquire fence. Hence conditional acquire fence... + */ +static inline int CRYPTO_DOWN_REF(_Atomic int *val, int *ret, void *lock) { - *ret = atomic_fetch_sub_explicit(val, 1, memory_order_release) - 1; + *ret = atomic_fetch_sub_explicit(val, 1, memory_order_relaxed) - 1; if (*ret == 0) atomic_thread_fence(memory_order_acquire); return 1; @@ -45,24 +55,65 @@ static ossl_inline int CRYPTO_DOWN_REF(_Atomic int *val, int *ret, void *lock) # elif defined(__GNUC__) && defined(__ATOMIC_RELAXED) && __GCC_ATOMIC_INT_LOCK_FREE > 0 -# define HAVE_ATOMICS 1 +# define HAVE_ATOMICS 1 typedef int CRYPTO_REF_COUNT; -static ossl_inline int CRYPTO_UP_REF(int *val, int *ret, void *lock) +static __inline__ int CRYPTO_UP_REF(int *val, int *ret, void *lock) { *ret = __atomic_fetch_add(val, 1, __ATOMIC_RELAXED) + 1; return 1; } -static ossl_inline int CRYPTO_DOWN_REF(int *val, int *ret, void *lock) +static __inline__ int CRYPTO_DOWN_REF(int *val, int *ret, void *lock) { - *ret = __atomic_fetch_sub(val, 1, __ATOMIC_RELEASE) - 1; + *ret = __atomic_fetch_sub(val, 1, __ATOMIC_RELAXED) - 1; if (*ret == 0) __atomic_thread_fence(__ATOMIC_ACQUIRE); return 1; } +# elif defined(_MSC_VER) && _MSC_VER>=1200 + +# define HAVE_ATOMICS 1 + +typedef volatile int CRYPTO_REF_COUNT; + +# if (defined(_M_ARM) && _M_ARM>=7) || defined(_M_ARM64) +# include +# if defined(_M_ARM64) && !defined(_ARM_BARRIER_ISH) +# define _ARM_BARRIER_ISH _ARM64_BARRIER_ISH +# endif + +static __inline int CRYPTO_UP_REF(volatile int *val, int *ret, void *lock) +{ + *ret = _InterlockedExchangeAdd_nf(val, 1) + 1; + return 1; +} + +static __inline int CRYPTO_DOWN_REF(volatile int *val, int *ret, void *lock) +{ + *ret = _InterlockedExchangeAdd_nf(val, -1) - 1; + if (*ret == 0) + __dmb(_ARM_BARRIER_ISH); + return 1; +} +# else +# pragma intrinsic(_InterlockedExchangeAdd) + +static __inline int CRYPTO_UP_REF(volatile int *val, int *ret, void *lock) +{ + *ret = _InterlockedExchangeAdd(val, 1) + 1; + return 1; +} + +static __inline int CRYPTO_DOWN_REF(volatile int *val, int *ret, void *lock) +{ + *ret = _InterlockedExchangeAdd(val, -1) - 1; + return 1; +} +# endif + # else typedef int CRYPTO_REF_COUNT; diff --git a/include/openssl/crypto.h b/include/openssl/crypto.h index c2ad65e0..7e50b1bf 100644 --- a/include/openssl/crypto.h +++ b/include/openssl/crypto.h @@ -73,8 +73,6 @@ int CRYPTO_THREAD_unlock(CRYPTO_RWLOCK *lock); void CRYPTO_THREAD_lock_free(CRYPTO_RWLOCK *lock); int CRYPTO_atomic_add(int *val, int amount, int *ret, CRYPTO_RWLOCK *lock); -int CRYPTO_atomic_read(int *val, int *ret, CRYPTO_RWLOCK *lock); -int CRYPTO_atomic_write(int *val, int n, CRYPTO_RWLOCK *lock); /* * The following can be used to detect memory leaks in the library. If diff --git a/include/openssl/opensslv.h b/include/openssl/opensslv.h index a4e75db5..b866670e 100644 --- a/include/openssl/opensslv.h +++ b/include/openssl/opensslv.h @@ -39,8 +39,8 @@ extern "C" { * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for * major minor fix final patch/beta) */ -# define OPENSSL_VERSION_NUMBER 0x10101009L -# define OPENSSL_VERSION_TEXT "OpenSSL 1.1.1-pre9-dev xx XXX xxxx" +# define OPENSSL_VERSION_NUMBER 0x1010100aL +# define OPENSSL_VERSION_TEXT "OpenSSL 1.1.1-pre10-dev xx XXX xxxx" /*- * The macros below are to be used for shared library (.so, .dll, ...) diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h index 155d6515..eb689c1c 100644 --- a/include/openssl/ssl.h +++ b/include/openssl/ssl.h @@ -1898,7 +1898,8 @@ int SSL_renegotiate_abbreviated(SSL *s); __owur int SSL_renegotiate_pending(SSL *s); int SSL_shutdown(SSL *s); __owur int SSL_verify_client_post_handshake(SSL *s); -void SSL_force_post_handshake_auth(SSL *s); +void SSL_CTX_set_post_handshake_auth(SSL_CTX *ctx, int val); +void SSL_set_post_handshake_auth(SSL *s, int val); __owur const SSL_METHOD *SSL_CTX_get_ssl_method(SSL_CTX *ctx); __owur const SSL_METHOD *SSL_get_ssl_method(SSL *s); diff --git a/include/openssl/x509_vfy.h b/include/openssl/x509_vfy.h index a657ec21..2adb1559 100644 --- a/include/openssl/x509_vfy.h +++ b/include/openssl/x509_vfy.h @@ -401,7 +401,7 @@ int (*X509_LOOKUP_meth_get_new_item(const X509_LOOKUP_METHOD* method)) (X509_LOOKUP *ctx); int X509_LOOKUP_meth_set_free(X509_LOOKUP_METHOD *method, - void (*free) (X509_LOOKUP *ctx)); + void (*free_fn) (X509_LOOKUP *ctx)); void (*X509_LOOKUP_meth_get_free(const X509_LOOKUP_METHOD* method)) (X509_LOOKUP *ctx); diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c index df5cff79..e740a8c2 100644 --- a/ssl/ssl_cert.c +++ b/ssl/ssl_cert.c @@ -947,7 +947,8 @@ static int ssl_security_default_callback(const SSL *s, const SSL_CTX *ctx, if (level >= 2 && c->algorithm_enc == SSL_RC4) return 0; /* Level 3: forward secure ciphersuites only */ - if (level >= 3 && !(c->algorithm_mkey & (SSL_kEDH | SSL_kEECDH))) + if (level >= 3 && (c->min_tls != TLS1_3_VERSION || + !(c->algorithm_mkey & (SSL_kEDH | SSL_kEECDH)))) return 0; break; } diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c index d753825a..8f50d6d3 100644 --- a/ssl/ssl_lib.c +++ b/ssl/ssl_lib.c @@ -702,6 +702,7 @@ SSL *SSL_new(SSL_CTX *ctx) s->max_early_data = ctx->max_early_data; s->recv_max_early_data = ctx->recv_max_early_data; s->num_tickets = ctx->num_tickets; + s->pha_enabled = ctx->pha_enabled; /* Shallow copy of the ciphersuites stack */ s->tls13_ciphersuites = sk_SSL_CIPHER_dup(ctx->tls13_ciphersuites); @@ -5523,9 +5524,14 @@ int SSL_stateless(SSL *s) return -1; } -void SSL_force_post_handshake_auth(SSL *ssl) +void SSL_CTX_set_post_handshake_auth(SSL_CTX *ctx, int val) { - ssl->pha_forced = 1; + ctx->pha_enabled = val; +} + +void SSL_set_post_handshake_auth(SSL *ssl, int val) +{ + ssl->pha_enabled = val; } int SSL_verify_client_post_handshake(SSL *ssl) diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h index 38e95528..9afa4888 100644 --- a/ssl/ssl_locl.h +++ b/ssl/ssl_locl.h @@ -1100,6 +1100,9 @@ struct ssl_ctx_st { /* Callback to determine if early_data is acceptable or not */ SSL_allow_early_data_cb_fn allow_early_data_cb; void *allow_early_data_cb_data; + + /* Do we advertise Post-handshake auth support? */ + int pha_enabled; }; struct ssl_st { @@ -1430,7 +1433,7 @@ struct ssl_st { int key_update; /* Post-handshake authentication state */ SSL_PHA_STATE post_handshake_auth; - int pha_forced; + int pha_enabled; uint8_t* pha_context; size_t pha_context_len; int certreqs_sent; @@ -2427,7 +2430,7 @@ __owur int ssl_choose_server_version(SSL *s, CLIENTHELLO_MSG *hello, __owur int ssl_choose_client_version(SSL *s, int version, RAW_EXTENSION *extensions); __owur int ssl_get_min_max_version(const SSL *s, int *min_version, - int *max_version); + int *max_version, int *real_max); __owur long tls1_default_timeout(void); __owur int dtls1_do_write(SSL *s, int type); diff --git a/ssl/statem/extensions.c b/ssl/statem/extensions.c index 12c712e8..307e6b9d 100644 --- a/ssl/statem/extensions.c +++ b/ssl/statem/extensions.c @@ -810,7 +810,7 @@ int tls_construct_extensions(SSL *s, WPACKET *pkt, unsigned int context, } if ((context & SSL_EXT_CLIENT_HELLO) != 0) { - reason = ssl_get_min_max_version(s, &min_version, &max_version); + reason = ssl_get_min_max_version(s, &min_version, &max_version, NULL); if (reason != 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_EXTENSIONS, reason); diff --git a/ssl/statem/extensions_clnt.c b/ssl/statem/extensions_clnt.c index a1defe74..99981c9e 100644 --- a/ssl/statem/extensions_clnt.c +++ b/ssl/statem/extensions_clnt.c @@ -507,7 +507,7 @@ EXT_RETURN tls_construct_ctos_supported_versions(SSL *s, WPACKET *pkt, { int currv, min_version, max_version, reason; - reason = ssl_get_min_max_version(s, &min_version, &max_version); + reason = ssl_get_min_max_version(s, &min_version, &max_version, NULL); if (reason != 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, reason); @@ -1210,23 +1210,8 @@ EXT_RETURN tls_construct_ctos_post_handshake_auth(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx) { #ifndef OPENSSL_NO_TLS1_3 - if (!s->pha_forced) { - int i, n = 0; - - /* check for cert, if present, we can do post-handshake auth */ - if (s->cert == NULL) - return EXT_RETURN_NOT_SENT; - - for (i = 0; i < SSL_PKEY_NUM; i++) { - if (s->cert->pkeys[i].x509 != NULL - && s->cert->pkeys[i].privatekey != NULL) - n++; - } - - /* no identity certificates, so no extension */ - if (n == 0) - return EXT_RETURN_NOT_SENT; - } + if (!s->pha_enabled) + return EXT_RETURN_NOT_SENT; /* construct extension - 0 length, no contents */ if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_post_handshake_auth) diff --git a/ssl/statem/statem_lib.c b/ssl/statem/statem_lib.c index df0a3983..47c0b0a5 100644 --- a/ssl/statem/statem_lib.c +++ b/ssl/statem/statem_lib.c @@ -105,7 +105,7 @@ int tls_setup_handshake(SSL *s) * enabled. For clients we do this check during construction of the * ClientHello. */ - if (ssl_get_min_max_version(s, &ver_min, &ver_max) != 0) { + if (ssl_get_min_max_version(s, &ver_min, &ver_max, NULL) != 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_SETUP_HANDSHAKE, ERR_R_INTERNAL_ERROR); return 0; @@ -1665,9 +1665,16 @@ static void check_for_downgrade(SSL *s, int vers, DOWNGRADE *dgrd) if (vers == TLS1_2_VERSION && ssl_version_supported(s, TLS1_3_VERSION, NULL)) { *dgrd = DOWNGRADE_TO_1_2; - } else if (!SSL_IS_DTLS(s) && vers < TLS1_2_VERSION - && (ssl_version_supported(s, TLS1_2_VERSION, NULL) - || ssl_version_supported(s, TLS1_3_VERSION, NULL))) { + } else if (!SSL_IS_DTLS(s) + && vers < TLS1_2_VERSION + /* + * We need to ensure that a server that disables TLSv1.2 + * (creating a hole between TLSv1.3 and TLSv1.1) can still + * complete handshakes with clients that support TLSv1.2 and + * below. Therefore we do not enable the sentinel if TLSv1.3 is + * enabled and TLSv1.2 is not. + */ + && ssl_version_supported(s, TLS1_2_VERSION, NULL)) { *dgrd = DOWNGRADE_TO_1_1; } else { *dgrd = DOWNGRADE_NONE; @@ -1857,8 +1864,7 @@ int ssl_choose_client_version(SSL *s, int version, RAW_EXTENSION *extensions) { const version_info *vent; const version_info *table; - int highver = 0; - int origv; + int ret, ver_min, ver_max, real_max, origv; origv = s->version; s->version = version; @@ -1905,65 +1911,62 @@ int ssl_choose_client_version(SSL *s, int version, RAW_EXTENSION *extensions) break; } + ret = ssl_get_min_max_version(s, &ver_min, &ver_max, &real_max); + if (ret != 0) { + s->version = origv; + SSLfatal(s, SSL_AD_PROTOCOL_VERSION, + SSL_F_SSL_CHOOSE_CLIENT_VERSION, ret); + return 0; + } + if (SSL_IS_DTLS(s) ? DTLS_VERSION_LT(s->version, ver_min) + : s->version < ver_min) { + s->version = origv; + SSLfatal(s, SSL_AD_PROTOCOL_VERSION, + SSL_F_SSL_CHOOSE_CLIENT_VERSION, SSL_R_UNSUPPORTED_PROTOCOL); + return 0; + } else if (SSL_IS_DTLS(s) ? DTLS_VERSION_GT(s->version, ver_max) + : s->version > ver_max) { + s->version = origv; + SSLfatal(s, SSL_AD_PROTOCOL_VERSION, + SSL_F_SSL_CHOOSE_CLIENT_VERSION, SSL_R_UNSUPPORTED_PROTOCOL); + return 0; + } + + if ((s->mode & SSL_MODE_SEND_FALLBACK_SCSV) == 0) + real_max = ver_max; + + /* Check for downgrades */ + if (s->version == TLS1_2_VERSION && real_max > s->version) { + if (memcmp(tls12downgrade, + s->s3->server_random + SSL3_RANDOM_SIZE + - sizeof(tls12downgrade), + sizeof(tls12downgrade)) == 0) { + s->version = origv; + SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, + SSL_F_SSL_CHOOSE_CLIENT_VERSION, + SSL_R_INAPPROPRIATE_FALLBACK); + return 0; + } + } else if (!SSL_IS_DTLS(s) + && s->version < TLS1_2_VERSION + && real_max > s->version) { + if (memcmp(tls11downgrade, + s->s3->server_random + SSL3_RANDOM_SIZE + - sizeof(tls11downgrade), + sizeof(tls11downgrade)) == 0) { + s->version = origv; + SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, + SSL_F_SSL_CHOOSE_CLIENT_VERSION, + SSL_R_INAPPROPRIATE_FALLBACK); + return 0; + } + } + for (vent = table; vent->version != 0; ++vent) { - const SSL_METHOD *method; - int err; - - if (vent->cmeth == NULL) + if (vent->cmeth == NULL || s->version != vent->version) continue; - if (highver != 0 && s->version != vent->version) - continue; - - if (highver == 0 && (s->mode & SSL_MODE_SEND_FALLBACK_SCSV) != 0) - highver = vent->version; - - method = vent->cmeth(); - err = ssl_method_error(s, method); - if (err != 0) { - if (s->version == vent->version) { - s->version = origv; - SSLfatal(s, SSL_AD_PROTOCOL_VERSION, - SSL_F_SSL_CHOOSE_CLIENT_VERSION, err); - return 0; - } - - continue; - } - if (highver == 0) - highver = vent->version; - - if (s->version != vent->version) - continue; - - /* Check for downgrades */ - if (s->version == TLS1_2_VERSION && highver > s->version) { - if (memcmp(tls12downgrade, - s->s3->server_random + SSL3_RANDOM_SIZE - - sizeof(tls12downgrade), - sizeof(tls12downgrade)) == 0) { - s->version = origv; - SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, - SSL_F_SSL_CHOOSE_CLIENT_VERSION, - SSL_R_INAPPROPRIATE_FALLBACK); - return 0; - } - } else if (!SSL_IS_DTLS(s) - && s->version < TLS1_2_VERSION - && highver > s->version) { - if (memcmp(tls11downgrade, - s->s3->server_random + SSL3_RANDOM_SIZE - - sizeof(tls11downgrade), - sizeof(tls11downgrade)) == 0) { - s->version = origv; - SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, - SSL_F_SSL_CHOOSE_CLIENT_VERSION, - SSL_R_INAPPROPRIATE_FALLBACK); - return 0; - } - } - - s->method = method; + s->method = vent->cmeth(); return 1; } @@ -1978,6 +1981,9 @@ int ssl_choose_client_version(SSL *s, int version, RAW_EXTENSION *extensions) * @s: The SSL connection * @min_version: The minimum supported version * @max_version: The maximum supported version + * @real_max: The highest version below the lowest compile time version hole + * where that hole lies above at least one run-time enabled + * protocol. * * Work out what version we should be using for the initial ClientHello if the * version is initially (D)TLS_ANY_VERSION. We apply any explicit SSL_OP_NO_xxx @@ -1992,9 +1998,10 @@ int ssl_choose_client_version(SSL *s, int version, RAW_EXTENSION *extensions) * Returns 0 on success or an SSL error reason number on failure. On failure * min_version and max_version will also be set to 0. */ -int ssl_get_min_max_version(const SSL *s, int *min_version, int *max_version) +int ssl_get_min_max_version(const SSL *s, int *min_version, int *max_version, + int *real_max) { - int version; + int version, tmp_real_max; int hole; const SSL_METHOD *single = NULL; const SSL_METHOD *method; @@ -2011,6 +2018,12 @@ int ssl_get_min_max_version(const SSL *s, int *min_version, int *max_version) * ssl_method_error(s, s->method) */ *min_version = *max_version = s->version; + /* + * Providing a real_max only makes sense where we're using a version + * flexible method. + */ + if (!ossl_assert(real_max == NULL)) + return ERR_R_INTERNAL_ERROR; return 0; case TLS_ANY_VERSION: table = tls_version_table; @@ -2043,6 +2056,9 @@ int ssl_get_min_max_version(const SSL *s, int *min_version, int *max_version) */ *min_version = version = 0; hole = 1; + if (real_max != NULL) + *real_max = 0; + tmp_real_max = 0; for (vent = table; vent->version != 0; ++vent) { /* * A table entry with a NULL client method is still a hole in the @@ -2050,15 +2066,22 @@ int ssl_get_min_max_version(const SSL *s, int *min_version, int *max_version) */ if (vent->cmeth == NULL) { hole = 1; + tmp_real_max = 0; continue; } method = vent->cmeth(); + + if (hole == 1 && tmp_real_max == 0) + tmp_real_max = vent->version; + if (ssl_method_error(s, method) != 0) { hole = 1; } else if (!hole) { single = NULL; *min_version = method->version; } else { + if (real_max != NULL && tmp_real_max != 0) + *real_max = tmp_real_max; version = (single = method)->version; *min_version = version; hole = 0; @@ -2093,7 +2116,7 @@ int ssl_set_client_hello_version(SSL *s) if (!SSL_IS_FIRST_HANDSHAKE(s)) return 0; - ret = ssl_get_min_max_version(s, &ver_min, &ver_max); + ret = ssl_get_min_max_version(s, &ver_min, &ver_max, NULL); if (ret != 0) return ret; diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index df27ba6b..ca05a3a5 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -1103,7 +1103,7 @@ int ssl_set_client_disabled(SSL *s) s->s3->tmp.mask_k = 0; ssl_set_sig_mask(&s->s3->tmp.mask_a, s, SSL_SECOP_SIGALG_MASK); if (ssl_get_min_max_version(s, &s->s3->tmp.min_ver, - &s->s3->tmp.max_ver) != 0) + &s->s3->tmp.max_ver, NULL) != 0) return 0; #ifndef OPENSSL_NO_PSK /* with PSK there must be client callback set */ diff --git a/test/evp_test.c b/test/evp_test.c index 667c9451..5391563a 100644 --- a/test/evp_test.c +++ b/test/evp_test.c @@ -74,6 +74,27 @@ static int find_key(EVP_PKEY **ppk, const char *name, KEY_LIST *lst); static int parse_bin(const char *value, unsigned char **buf, size_t *buflen); +/* + * Compare two memory regions for equality, returning zero if they differ. + * However, if there is expected to be an error and the actual error + * matches then the memory is expected to be different so handle this + * case without producing unnecessary test framework output. + */ +static int memory_err_compare(EVP_TEST *t, const char *err, + const void *expected, size_t expected_len, + const void *got, size_t got_len) +{ + int r; + + if (t->expected_err != NULL && strcmp(t->expected_err, err) == 0) + r = !TEST_mem_ne(expected, expected_len, got, got_len); + else + r = TEST_mem_eq(expected, expected_len, got, got_len); + if (!r) + t->err = err; + return r; +} + /* * Structure used to hold a list of blocks of memory to test * calls to "update" like functions. @@ -397,10 +418,11 @@ static int digest_test_run(EVP_TEST *t) t->err = "DIGEST_LENGTH_MISMATCH"; goto err; } - if (!TEST_mem_eq(expected->output, expected->output_len, got, got_len)) { - t->err = "DIGEST_MISMATCH"; + if (!memory_err_compare(t, "DIGEST_MISMATCH", + expected->output, expected->output_len, + got, got_len)) goto err; - } + t->err = NULL; err: @@ -688,11 +710,9 @@ static int cipher_test_enc(EVP_TEST *t, int enc, t->err = "CIPHERFINAL_ERROR"; goto err; } - if (!TEST_mem_eq(expected_out, out_len, - tmp + out_misalign, tmplen + tmpflen)) { - t->err = "VALUE_MISMATCH"; + if (!memory_err_compare(t, "VALUE_MISMATCH", expected_out, out_len, + tmp + out_misalign, tmplen + tmpflen)) goto err; - } if (enc && expected->aead) { unsigned char rtag[16]; @@ -705,11 +725,10 @@ static int cipher_test_enc(EVP_TEST *t, int enc, t->err = "TAG_RETRIEVE_ERROR"; goto err; } - if (!TEST_mem_eq(expected->tag, expected->tag_len, - rtag, expected->tag_len)) { - t->err = "TAG_VALUE_MISMATCH"; + if (!memory_err_compare(t, "TAG_VALUE_MISMATCH", + expected->tag, expected->tag_len, + rtag, expected->tag_len)) goto err; - } } t->err = NULL; ok = 1; @@ -950,8 +969,9 @@ static int mac_test_run(EVP_TEST *t) goto err; } if (!EVP_DigestSignFinal(mctx, got, &got_len) - || !TEST_mem_eq(expected->output, expected->output_len, - got, got_len)) { + || !memory_err_compare(t, "TEST_MAC_ERR", + expected->output, expected->output_len, + got, got_len)) { t->err = "TEST_MAC_ERR"; goto err; } @@ -1108,10 +1128,11 @@ static int pkey_test_run(EVP_TEST *t) t->err = "KEYOP_ERROR"; goto err; } - if (!TEST_mem_eq(expected->output, expected->output_len, got, got_len)) { - t->err = "KEYOP_MISMATCH"; + if (!memory_err_compare(t, "KEYOP_MISMATCH", + expected->output, expected->output_len, + got, got_len)) goto err; - } + t->err = NULL; err: OPENSSL_free(got); @@ -1226,10 +1247,10 @@ static int pderive_test_run(EVP_TEST *t) t->err = "DERIVE_ERROR"; goto err; } - if (!TEST_mem_eq(expected->output, expected->output_len, got, got_len)) { - t->err = "SHARED_SECRET_MISMATCH"; + if (!memory_err_compare(t, "SHARED_SECRET_MISMATCH", + expected->output, expected->output_len, + got, got_len)) goto err; - } t->err = NULL; err: @@ -1444,11 +1465,10 @@ static int pbe_test_run(EVP_TEST *t) goto err; } } - if (!TEST_mem_eq(expected->key, expected->key_len, - key, expected->key_len)) { - t->err = "KEY_MISMATCH"; + if (!memory_err_compare(t, "KEY_MISMATCH", expected->key, expected->key_len, + key, expected->key_len)) goto err; - } + t->err = NULL; err: OPENSSL_free(key); @@ -1559,11 +1579,10 @@ static int encode_test_run(EVP_TEST *t) EVP_ENCODE_CTX_free(encode_ctx); - if (!TEST_mem_eq(expected->output, expected->output_len, - encode_out, output_len)) { - t->err = "BAD_ENCODING"; + if (!memory_err_compare(t, "BAD_ENCODING", + expected->output, expected->output_len, + encode_out, output_len)) goto err; - } } if (!TEST_ptr(decode_out = @@ -1585,8 +1604,9 @@ static int encode_test_run(EVP_TEST *t) output_len += chunk_len; if (expected->encoding != BASE64_INVALID_ENCODING - && !TEST_mem_eq(expected->input, expected->input_len, - decode_out, output_len)) { + && !memory_err_compare(t, "BAD_DECODING", + expected->input, expected->input_len, + decode_out, output_len)) { t->err = "BAD_DECODING"; goto err; } @@ -1687,10 +1707,11 @@ static int kdf_test_run(EVP_TEST *t) t->err = "KDF_DERIVE_ERROR"; goto err; } - if (!TEST_mem_eq(expected->output, expected->output_len, got, got_len)) { - t->err = "KDF_MISMATCH"; + if (!memory_err_compare(t, "KDF_MISMATCH", + expected->output, expected->output_len, + got, got_len)) goto err; - } + t->err = NULL; err: @@ -2079,11 +2100,12 @@ static int digestsign_test_run(EVP_TEST *t) t->err = "DIGESTSIGNFINAL_ERROR"; goto err; } - if (!TEST_mem_eq(expected->output, expected->output_len, got, got_len)) { - t->err = "SIGNATURE_MISMATCH"; + if (!memory_err_compare(t, "SIGNATURE_MISMATCH", + expected->output, expected->output_len, + got, got_len)) goto err; - } + t->err = NULL; err: OPENSSL_free(got); return 1; @@ -2156,11 +2178,12 @@ static int oneshot_digestsign_test_run(EVP_TEST *t) t->err = "DIGESTSIGN_ERROR"; goto err; } - if (!TEST_mem_eq(expected->output, expected->output_len, got, got_len)) { - t->err = "SIGNATURE_MISMATCH"; + if (!memory_err_compare(t, "SIGNATURE_MISMATCH", + expected->output, expected->output_len, + got, got_len)) goto err; - } + t->err = NULL; err: OPENSSL_free(got); return 1; diff --git a/test/handshake_helper.c b/test/handshake_helper.c index c40a0e7c..a5b8d800 100644 --- a/test/handshake_helper.c +++ b/test/handshake_helper.c @@ -726,8 +726,8 @@ static void configure_handshake_ssl(SSL *server, SSL *client, if (extra->client.servername != SSL_TEST_SERVERNAME_NONE) SSL_set_tlsext_host_name(client, ssl_servername_name(extra->client.servername)); - if (extra->client.force_pha) - SSL_force_post_handshake_auth(client); + if (extra->client.enable_pha) + SSL_set_post_handshake_auth(client, 1); } /* The status for each connection phase. */ diff --git a/test/ossl_shim/ossl_config.json b/test/ossl_shim/ossl_config.json index 0643d711..1e574990 100644 --- a/test/ossl_shim/ossl_config.json +++ b/test/ossl_shim/ossl_config.json @@ -248,7 +248,12 @@ "DTLS-Retransmit-Server-12":"Test failure - reason unknown", "DTLS-Retransmit-Fudge":"Test failure - reason unknown", "DTLS-Retransmit-Fragmented":"Test failure - reason unknown", - "TrailingMessageData-ClientHello-DTLS":"Test failure - reason unknown" + "TrailingMessageData-ClientHello-DTLS":"Test failure - reason unknown", + "SendFallbackSCSV":"Current runner version uses old draft TLSv1.3", + "VersionNegotiationExtension-TLS11":"Current runner version uses old draft TLSv1.3", + "VersionNegotiationExtension-TLS1":"Current runner version uses old draft TLSv1.3", + "VersionNegotiationExtension-SSL3":"Current runner version uses old draft TLSv1.3", + "ConflictingVersionNegotiation":"Current runner version uses old draft TLSv1.3" }, "ErrorMap" : { ":UNEXPECTED_MESSAGE:":"unexpected message", diff --git a/test/recipes/30-test_evp_data/evpciph.txt b/test/recipes/30-test_evp_data/evpciph.txt index bd789643..422d8b35 100644 --- a/test/recipes/30-test_evp_data/evpciph.txt +++ b/test/recipes/30-test_evp_data/evpciph.txt @@ -19,7 +19,7 @@ # -K 000102030405060708090A0B0C0D0E0F1011121314151617 -iv 0001020304050607 | # xxd -ps -u -Title = DES Tests (varous sources) +Title = DES Tests (various sources) Cipher = DES-EDE3-CFB1 Key = 000102030405060708090A0B0C0D0E0F1011121314151617 diff --git a/test/recipes/30-test_evp_data/evppkey.txt b/test/recipes/30-test_evp_data/evppkey.txt index d482c147..2d769d4c 100644 --- a/test/recipes/30-test_evp_data/evppkey.txt +++ b/test/recipes/30-test_evp_data/evppkey.txt @@ -17287,7 +17287,7 @@ PeerKey=BOB_cf_sect283k1_PUB Ctrl=ecdh_cofactor_mode:1 Result = DERIVE_ERROR -Title = Test keypair mistmatches +Title = Test keypair mismatches PrivPubKeyPair = Alice-25519:Bob-25519-PUBLIC Result = KEYPAIR_MISMATCH diff --git a/test/recipes/30-test_evp_data/evppkey_ecc.txt b/test/recipes/30-test_evp_data/evppkey_ecc.txt index 685af179..8e95c023 100644 --- a/test/recipes/30-test_evp_data/evppkey_ecc.txt +++ b/test/recipes/30-test_evp_data/evppkey_ecc.txt @@ -4364,3 +4364,240 @@ PeerKey=ALICE_cf_wap-wsg-idm-ecid-wtls9_PUB SharedSecret=948d3030e95cead39a1bb3d8a01c2be178517ba7 # tests: 484 + +Title=zero x-coord regression tests + +PrivateKey=ALICE_zero_prime192v1 +-----BEGIN PRIVATE KEY----- +MDkCAQAwEwYHKoZIzj0CAQYIKoZIzj0DAQEEHzAdAgEBBBhaPNk8jG5hSG6y8tUqUoOaNNsZ3APU +pps= +-----END PRIVATE KEY----- + +PublicKey=BOB_zero_prime192v1_PUB +-----BEGIN PUBLIC KEY----- +MEkwEwYHKoZIzj0CAQYIKoZIzj0DAQEDMgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAe2hWBe5g +DLNj216pEvK7XjoKLg5gNg8S +-----END PUBLIC KEY----- + +# ECDH Alice with Bob peer +Derive=ALICE_zero_prime192v1 +PeerKey=BOB_zero_prime192v1_PUB +SharedSecret=baaffd49a8399d2ad52cbbe24d47b67afb4b3cf436f1cd65 + +PrivateKey=ALICE_zero_prime192v2 +-----BEGIN PRIVATE KEY----- +MDkCAQAwEwYHKoZIzj0CAQYIKoZIzj0DAQIEHzAdAgEBBBj1AIQMJ7jqYIKCvxYAS+qKMmKmH0to +41k= +-----END PRIVATE KEY----- + +PublicKey=BOB_zero_prime192v2_PUB +-----BEGIN PUBLIC KEY----- +MEkwEwYHKoZIzj0CAQYIKoZIzj0DAQIDMgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4Gj7Qqt +2wx/jwFlKgvE4rnd50LspdMk +-----END PUBLIC KEY----- + +# ECDH Alice with Bob peer +Derive=ALICE_zero_prime192v2 +PeerKey=BOB_zero_prime192v2_PUB +SharedSecret=b8f200a4b87064f2e8600685ca3e69b8e661a117aabc770b + +PrivateKey=ALICE_zero_prime192v3 +-----BEGIN PRIVATE KEY----- +MDkCAQAwEwYHKoZIzj0CAQYIKoZIzj0DAQMEHzAdAgEBBBh/maLQMSlea9BfLqGy5NPuK0YAH/cz +GqI= +-----END PRIVATE KEY----- + +PublicKey=BOB_zero_prime192v3_PUB +-----BEGIN PUBLIC KEY----- +MEkwEwYHKoZIzj0CAQYIKoZIzj0DAQMDMgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZEzb63e2 +3MKatRLR9Y1M5JEdI9jwMocI +-----END PUBLIC KEY----- + +# ECDH Alice with Bob peer +Derive=ALICE_zero_prime192v3 +PeerKey=BOB_zero_prime192v3_PUB +SharedSecret=b5de857d355bc5b9e270a4c290ea9728d764d8b243ff5d8d + +PrivateKey=ALICE_zero_prime239v1 +-----BEGIN PRIVATE KEY----- +MD8CAQAwEwYHKoZIzj0CAQYIKoZIzj0DAQQEJTAjAgEBBB5pYWzRYI+c6O7NXCt0H2kw8XRL3rhe +4MrJT8j++CI= +-----END PRIVATE KEY----- + +PublicKey=BOB_zero_prime239v1_PUB +-----BEGIN PUBLIC KEY----- +MFUwEwYHKoZIzj0CAQYIKoZIzj0DAQQDPgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +Ox02uwNNLFuvDRn5ip8TxvW0W22R7UzJa9Av6/nh +-----END PUBLIC KEY----- + +# ECDH Alice with Bob peer +Derive=ALICE_zero_prime239v1 +PeerKey=BOB_zero_prime239v1_PUB +SharedSecret=6b6206408bd05d42daa2cd224c401a1230b44e184f17b82f385f22dac215 + +PrivateKey=ALICE_zero_prime239v2 +-----BEGIN PRIVATE KEY----- +MD8CAQAwEwYHKoZIzj0CAQYIKoZIzj0DAQUEJTAjAgEBBB5l8bB7Cpmr7vyx9FiOT2wEF3YOFbDG +bmRr3Vi/xr4= +-----END PRIVATE KEY----- + +PublicKey=BOB_zero_prime239v2_PUB +-----BEGIN PUBLIC KEY----- +MFUwEwYHKoZIzj0CAQYIKoZIzj0DAQUDPgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +IOg3VJGQ89d1GWg4Igxcj5xpDmJiP8tv+e4mxt5U +-----END PUBLIC KEY----- + +# ECDH Alice with Bob peer +Derive=ALICE_zero_prime239v2 +PeerKey=BOB_zero_prime239v2_PUB +SharedSecret=772c2819c960c78f28f21f6542b7409294fad1f84567c44c4b7678dc0e42 + +PrivateKey=ALICE_zero_prime239v3 +-----BEGIN PRIVATE KEY----- +MD8CAQAwEwYHKoZIzj0CAQYIKoZIzj0DAQYEJTAjAgEBBB5HF5FABzUOTYMZg9UdZTx/oRERm/fU +M/+otKzpLjA= +-----END PRIVATE KEY----- + +PublicKey=BOB_zero_prime239v3_PUB +-----BEGIN PUBLIC KEY----- +MFUwEwYHKoZIzj0CAQYIKoZIzj0DAQYDPgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AsZ4u6r3qQI78EYBpiSgWjqNpoeShjr5piecMBWj +-----END PUBLIC KEY----- + +# ECDH Alice with Bob peer +Derive=ALICE_zero_prime239v3 +PeerKey=BOB_zero_prime239v3_PUB +SharedSecret=56a71f5dd1611e8032c3e2d8224d86e5e8c2fc6480d74c0e282282decd43 + +PrivateKey=ALICE_zero_prime256v1 +-----BEGIN PRIVATE KEY----- +MEECAQAwEwYHKoZIzj0CAQYIKoZIzj0DAQcEJzAlAgEBBCDXhMb6aR4JR2+l2tmgYqP0r8S4jtym +yH++awvF2nGhhg== +-----END PRIVATE KEY----- + +PublicKey=BOB_zero_prime256v1_PUB +-----BEGIN PUBLIC KEY----- +MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AABmSFx4Di+D1yQzvV2EoGu2VBwq8x2uhxcov4VqF0+T9A== +-----END PUBLIC KEY----- + +# ECDH Alice with Bob peer +Derive=ALICE_zero_prime256v1 +PeerKey=BOB_zero_prime256v1_PUB +SharedSecret=c4f5607deb8501f1a4ba23fce4122a4343a17ada2c86a9c8e0d03d92d4a4c84c + +PrivateKey=ALICE_zero_secp112r2 +-----BEGIN PRIVATE KEY----- +MCwCAQAwEAYHKoZIzj0CAQYFK4EEAAcEFTATAgEBBA4hh3tRkG3tnA0496ffMw== +-----END PRIVATE KEY----- + +PublicKey=BOB_zero_secp112r2_PUB +-----BEGIN PUBLIC KEY----- +MDIwEAYHKoZIzj0CAQYFK4EEAAcDHgAEAAAAAAAAAAAAAAAAAAAS5eEOWDV/Wk7w4djyDQ== +-----END PUBLIC KEY----- + +# ECDH Alice with Bob peer +Derive=ALICE_zero_secp112r2 +PeerKey=BOB_zero_secp112r2_PUB +SharedSecret=958cc1cb425713678830a4d7d95e + +PrivateKey=ALICE_zero_secp128r1 +-----BEGIN PRIVATE KEY----- +MC4CAQAwEAYHKoZIzj0CAQYFK4EEABwEFzAVAgEBBBCykSzic/h3T2K6SkSP1SGt +-----END PRIVATE KEY----- + +PublicKey=BOB_zero_secp128r1_PUB +-----BEGIN PUBLIC KEY----- +MDYwEAYHKoZIzj0CAQYFK4EEABwDIgAEAAAAAAAAAAAAAAAAAAAAAABya8M5aeOpNG3z799IdHc= +-----END PUBLIC KEY----- + +# ECDH Alice with Bob peer +Derive=ALICE_zero_secp128r1 +PeerKey=BOB_zero_secp128r1_PUB +SharedSecret=5235d452066f126cd7e99eea00fd3068 + +PrivateKey=ALICE_zero_secp160r1 +-----BEGIN PRIVATE KEY----- +MDMCAQAwEAYHKoZIzj0CAQYFK4EEAAgEHDAaAgEBBBUACoRnbig69XLlh5VcRexpbbn5zwA= +-----END PRIVATE KEY----- + +PublicKey=BOB_zero_secp160r1_PUB +-----BEGIN PUBLIC KEY----- +MD4wEAYHKoZIzj0CAQYFK4EEAAgDKgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAG/w1po29wYlxlygXs +MGfbiGg5ng== +-----END PUBLIC KEY----- + +# ECDH Alice with Bob peer +Derive=ALICE_zero_secp160r1 +PeerKey=BOB_zero_secp160r1_PUB +SharedSecret=9ccd0ab8d093b6acdb3fe14c3736a0dfe61a4666 + +PrivateKey=ALICE_zero_secp160r2 +-----BEGIN PRIVATE KEY----- +MDMCAQAwEAYHKoZIzj0CAQYFK4EEAB4EHDAaAgEBBBUAQFGxInSw1eAvd45E9TUdbXtJGnA= +-----END PRIVATE KEY----- + +PublicKey=BOB_zero_secp160r2_PUB +-----BEGIN PUBLIC KEY----- +MD4wEAYHKoZIzj0CAQYFK4EEAB4DKgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAZtSBSZqfmXp47v5z2 +ZZZl2JFxDg== +-----END PUBLIC KEY----- + +# ECDH Alice with Bob peer +Derive=ALICE_zero_secp160r2 +PeerKey=BOB_zero_secp160r2_PUB +SharedSecret=303e0a282ac86f463fe834cb51b0057be42ed5ab + +PrivateKey=ALICE_zero_secp384r1 +-----BEGIN PRIVATE KEY----- +ME4CAQAwEAYHKoZIzj0CAQYFK4EEACIENzA1AgEBBDD6kgzKbg28zbQyVTdC0IdHbm0UCQt2Rdbi +VVHJeYRSnNpFOiFLaOsGOmwoeZzj6jc= +-----END PRIVATE KEY----- + +PublicKey=BOB_zero_secp384r1_PUB +-----BEGIN PUBLIC KEY----- +MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAPPme8E9RpepjC6P5+WDdWToUyb45/SvSFdO0sIqq+Gu/kn8sRuUqsG+3 +QriFDlIe +-----END PUBLIC KEY----- + +# ECDH Alice with Bob peer +Derive=ALICE_zero_secp384r1 +PeerKey=BOB_zero_secp384r1_PUB +SharedSecret=b1cfeaeef51dfd487d3a8b2849f1592e04d63f2d2c88b310a6290ebfe5399f5ffe954eabd0619231393e56c35b242986 + +PrivateKey=ALICE_zero_secp521r1 +-----BEGIN PRIVATE KEY----- +MGACAQAwEAYHKoZIzj0CAQYFK4EEACMESTBHAgEBBEIAbddDLMUWbAsY7l3vbNDmntXuAUcDYPg5 +w/cgUwSCIvrV9MBeSG8AWqT16riHmHlsn+XI5PAJM6eij3JDahnu9Mo= +-----END PRIVATE KEY----- + +PublicKey=BOB_zero_secp521r1_PUB +-----BEGIN PUBLIC KEY----- +MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0g7J/qa1d8ENJsobtEb0CymeZIsa +1Qiq0GiJb+4/jmFLxjBU1Xcr8Bpl1BLgvKqOll0vXTMtfzn4RtRArgAfT4c= +-----END PUBLIC KEY----- + +# ECDH Alice with Bob peer +Derive=ALICE_zero_secp521r1 +PeerKey=BOB_zero_secp521r1_PUB +SharedSecret=003fc3028f61db94b20c7cd177923b6e73f12f0ab067c9ce8866755e3c82abb39c9863cde74fa80b32520bd7dd0eb156c30c08911503b67b2661f1264d09bb231423 + +PrivateKey=ALICE_zero_wap-wsg-idm-ecid-wtls7 +-----BEGIN PRIVATE KEY----- +MDMCAQAwEAYHKoZIzj0CAQYFZysBBAcEHDAaAgEBBBUAoGng7WzYr4P9vtdc3BS/UiNWmc0= +-----END PRIVATE KEY----- + +PublicKey=BOB_zero_wap-wsg-idm-ecid-wtls7_PUB +-----BEGIN PUBLIC KEY----- +MD4wEAYHKoZIzj0CAQYFZysBBAcDKgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAZtSBSZqfmXp47v5z2 +ZZZl2JFxDg== +-----END PUBLIC KEY----- + +# ECDH Alice with Bob peer +Derive=ALICE_zero_wap-wsg-idm-ecid-wtls7 +PeerKey=BOB_zero_wap-wsg-idm-ecid-wtls7_PUB +SharedSecret=6582fc03bbb340fcf24a5fe8fcdf722655efa8b9 + +# tests: 14 diff --git a/test/recipes/70-test_tls13downgrade.t b/test/recipes/70-test_tls13downgrade.t index f7c88123..bdb360a7 100644 --- a/test/recipes/70-test_tls13downgrade.t +++ b/test/recipes/70-test_tls13downgrade.t @@ -45,7 +45,7 @@ use constant { $proxy->filter(\&downgrade_filter); my $testtype = DOWNGRADE_TO_TLS_1_2; $proxy->start() or plan skip_all => "Unable to start up Proxy for tests"; -plan tests => 4; +plan tests => 6; ok(TLSProxy::Message->fail(), "Downgrade TLSv1.3 to TLSv1.2"); #Test 2: Downgrade from TLSv1.3 to TLSv1.1 @@ -73,6 +73,23 @@ ok(TLSProxy::Message->fail() && $alert->description() == TLSProxy::Message::AL_DESC_ILLEGAL_PARAMETER, "Fallback from TLSv1.3"); +SKIP: { + skip "TLSv1.1 disabled", 2 if disabled("tls1_1"); + #Test 5: A client side protocol "hole" should not be detected as a downgrade + $proxy->clear(); + $proxy->filter(undef); + $proxy->clientflags("-no_tls1_2"); + $proxy->start(); + ok(TLSProxy::Message->success(), "TLSv1.2 client-side protocol hole"); + + #Test 6: A server side protocol "hole" should not be detected as a downgrade + $proxy->clear(); + $proxy->filter(undef); + $proxy->serverflags("-no_tls1_2"); + $proxy->start(); + ok(TLSProxy::Message->success(), "TLSv1.2 server-side protocol hole"); +} + sub downgrade_filter { my $proxy = shift; diff --git a/test/recipes/70-test_tls13messages.t b/test/recipes/70-test_tls13messages.t index 35f36b6c..be6a2db5 100644 --- a/test/recipes/70-test_tls13messages.t +++ b/test/recipes/70-test_tls13messages.t @@ -214,7 +214,7 @@ SKIP: { #Test 6: A client auth handshake $proxy->clear(); -$proxy->clientflags("-cert ".srctop_file("apps", "server.pem")); +$proxy->clientflags("-enable_pha -cert ".srctop_file("apps", "server.pem")); $proxy->serverflags("-Verify 5"); $proxy->start(); checkhandshake($proxy, checkhandshake::CLIENT_AUTH_HANDSHAKE, diff --git a/test/secmemtest.c b/test/secmemtest.c index 9efa2c89..2795abb5 100644 --- a/test/secmemtest.c +++ b/test/secmemtest.c @@ -129,8 +129,52 @@ static int test_sec_mem(void) #endif } +static int test_sec_mem_clear(void) +{ +#if defined(OPENSSL_SYS_LINUX) || defined(OPENSSL_SYS_UNIX) + const int size = 64; + unsigned char *p = NULL; + int i, res = 0; + + if (!TEST_true(CRYPTO_secure_malloc_init(4096, 32)) + || !TEST_ptr(p = OPENSSL_secure_malloc(size))) + goto err; + + for (i = 0; i < size; i++) + if (!TEST_uchar_eq(p[i], 0)) + goto err; + + for (i = 0; i < size; i++) + p[i] = (unsigned char)(i + ' ' + 1); + + OPENSSL_secure_free(p); + + /* + * A deliberate use after free here to verify that the memory has been + * cleared properly. Since secure free doesn't return the memory to + * libc's memory pool, it technically isn't freed. However, the header + * bytes have to be skipped and these consist of two pointers in the + * current implementation. + */ + for (i = sizeof(void *) * 2; i < size; i++) + if (!TEST_uchar_eq(p[i], 0)) + return 0; + + res = 1; + p = NULL; + +err: + OPENSSL_secure_free(p); + CRYPTO_secure_malloc_done(); + return res; +#else + return 1; +#endif +} + int setup_tests(void) { ADD_TEST(test_sec_mem); + ADD_TEST(test_sec_mem_clear); return 1; } diff --git a/test/ssl-tests/26-tls13_client_auth.conf b/test/ssl-tests/26-tls13_client_auth.conf index 55361dde..9c423919 100644 --- a/test/ssl-tests/26-tls13_client_auth.conf +++ b/test/ssl-tests/26-tls13_client_auth.conf @@ -299,6 +299,10 @@ ExpectedClientSignHash = SHA256 ExpectedClientSignType = RSA-PSS ExpectedResult = Success HandshakeMode = PostHandshakeAuth +client = 8-client-auth-TLSv1.3-require-post-handshake-client-extra + +[8-client-auth-TLSv1.3-require-post-handshake-client-extra] +EnablePHA = Yes # =========================================================== @@ -337,6 +341,10 @@ ExpectedClientSignHash = SHA256 ExpectedClientSignType = RSA-PSS ExpectedResult = Success HandshakeMode = PostHandshakeAuth +client = 9-client-auth-TLSv1.3-require-non-empty-names-post-handshake-client-extra + +[9-client-auth-TLSv1.3-require-non-empty-names-post-handshake-client-extra] +EnablePHA = Yes # =========================================================== @@ -369,6 +377,10 @@ VerifyMode = Peer ExpectedResult = ServerFail ExpectedServerAlert = UnknownCA HandshakeMode = PostHandshakeAuth +client = 10-client-auth-TLSv1.3-noroot-post-handshake-client-extra + +[10-client-auth-TLSv1.3-noroot-post-handshake-client-extra] +EnablePHA = Yes # =========================================================== @@ -401,7 +413,7 @@ HandshakeMode = PostHandshakeAuth client = 11-client-auth-TLSv1.3-request-force-client-post-handshake-client-extra [11-client-auth-TLSv1.3-request-force-client-post-handshake-client-extra] -ForcePHA = Yes +EnablePHA = Yes # =========================================================== @@ -471,6 +483,6 @@ client = 13-client-auth-TLSv1.3-request-force-both-post-handshake-client-extra ForcePHA = Yes [13-client-auth-TLSv1.3-request-force-both-post-handshake-client-extra] -ForcePHA = Yes +EnablePHA = Yes diff --git a/test/ssl-tests/26-tls13_client_auth.conf.in b/test/ssl-tests/26-tls13_client_auth.conf.in index e53cda23..018dd825 100644 --- a/test/ssl-tests/26-tls13_client_auth.conf.in +++ b/test/ssl-tests/26-tls13_client_auth.conf.in @@ -176,6 +176,9 @@ our @tests = ( "MaxProtocol" => "TLSv1.3", "Certificate" => test_pem("ee-client-chain.pem"), "PrivateKey" => test_pem("ee-key.pem"), + extra => { + "EnablePHA" => "Yes", + }, }, test => { "ExpectedResult" => "Success", @@ -201,6 +204,9 @@ our @tests = ( "MaxProtocol" => "TLSv1.3", "Certificate" => test_pem("ee-client-chain.pem"), "PrivateKey" => test_pem("ee-key.pem"), + extra => { + "EnablePHA" => "Yes", + }, }, test => { "ExpectedResult" => "Success", @@ -223,6 +229,9 @@ our @tests = ( "MaxProtocol" => "TLSv1.3", "Certificate" => test_pem("ee-client-chain.pem"), "PrivateKey" => test_pem("ee-key.pem"), + extra => { + "EnablePHA" => "Yes", + }, }, test => { "ExpectedResult" => "ServerFail", @@ -240,9 +249,9 @@ our @tests = ( client => { "MinProtocol" => "TLSv1.3", "MaxProtocol" => "TLSv1.3", - extra => { - "ForcePHA" => "Yes", - }, + extra => { + "EnablePHA" => "Yes", + }, }, test => { "ExpectedResult" => "Success", @@ -255,9 +264,9 @@ our @tests = ( "MinProtocol" => "TLSv1.3", "MaxProtocol" => "TLSv1.3", "VerifyMode" => "RequestPostHandshake", - extra => { - "ForcePHA" => "Yes", - }, + extra => { + "ForcePHA" => "Yes", + }, }, client => { "MinProtocol" => "TLSv1.3", @@ -274,16 +283,16 @@ our @tests = ( "MinProtocol" => "TLSv1.3", "MaxProtocol" => "TLSv1.3", "VerifyMode" => "RequestPostHandshake", - extra => { - "ForcePHA" => "Yes", - }, + extra => { + "ForcePHA" => "Yes", + }, }, client => { "MinProtocol" => "TLSv1.3", "MaxProtocol" => "TLSv1.3", - extra => { - "ForcePHA" => "Yes", - }, + extra => { + "EnablePHA" => "Yes", + }, }, test => { "ExpectedResult" => "Success", diff --git a/test/ssl_test_ctx.c b/test/ssl_test_ctx.c index cb4b8606..75333853 100644 --- a/test/ssl_test_ctx.c +++ b/test/ssl_test_ctx.c @@ -629,9 +629,9 @@ __owur static int parse_expected_client_ca_names(SSL_TEST_CTX *test_ctx, IMPLEMENT_SSL_TEST_STRING_OPTION(SSL_TEST_CTX, test, expected_cipher) -/* Client and Server ForcePHA */ +/* Client and Server PHA */ -IMPLEMENT_SSL_TEST_BOOL_OPTION(SSL_TEST_CLIENT_CONF, client, force_pha) +IMPLEMENT_SSL_TEST_BOOL_OPTION(SSL_TEST_CLIENT_CONF, client, enable_pha) IMPLEMENT_SSL_TEST_BOOL_OPTION(SSL_TEST_SERVER_CONF, server, force_pha) /* Known test options and their corresponding parse methods. */ @@ -689,7 +689,7 @@ static const ssl_test_client_option ssl_test_client_options[] = { { "SRPUser", &parse_client_srp_user }, { "SRPPassword", &parse_client_srp_password }, { "MaxFragmentLenExt", &parse_max_fragment_len_mode }, - { "ForcePHA", &parse_client_force_pha }, + { "EnablePHA", &parse_client_enable_pha }, }; /* Nested server options. */ diff --git a/test/ssl_test_ctx.h b/test/ssl_test_ctx.h index e26c2076..86d227d8 100644 --- a/test/ssl_test_ctx.h +++ b/test/ssl_test_ctx.h @@ -108,8 +108,8 @@ typedef struct { char *reneg_ciphers; char *srp_user; char *srp_password; - /* Forced PHA */ - int force_pha; + /* PHA enabled */ + int enable_pha; } SSL_TEST_CLIENT_CONF; typedef struct { diff --git a/test/sslapitest.c b/test/sslapitest.c index c65bf59f..d21b39d8 100644 --- a/test/sslapitest.c +++ b/test/sslapitest.c @@ -1270,7 +1270,7 @@ static int check_resumption(int idx, SSL_CTX *sctx, SSL_CTX *cctx, int succ) || !TEST_true(SSL_set_session(clientssl, sesscache[i]))) goto end; - SSL_force_post_handshake_auth(clientssl); + SSL_set_post_handshake_auth(clientssl, 1); if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))) @@ -1377,7 +1377,7 @@ static int test_tickets(int stateful, int idx) &clientssl, NULL, NULL))) goto end; - SSL_force_post_handshake_auth(clientssl); + SSL_set_post_handshake_auth(clientssl, 1); if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)) @@ -4331,13 +4331,12 @@ static int test_pha_key_update(void) || !TEST_true(SSL_CTX_set_max_proto_version(cctx, TLS1_3_VERSION))) goto end; + SSL_CTX_set_post_handshake_auth(cctx, 1); if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL, NULL))) goto end; - SSL_force_post_handshake_auth(clientssl); - if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))) goto end; diff --git a/util/libcrypto.num b/util/libcrypto.num index ed8a8f01..d69a6dcf 100644 --- a/util/libcrypto.num +++ b/util/libcrypto.num @@ -4396,8 +4396,6 @@ EVP_PKEY_meth_set_check 4341 1_1_1 EXIST::FUNCTION: EVP_PKEY_meth_get_check 4342 1_1_1 EXIST::FUNCTION: EVP_PKEY_meth_remove 4343 1_1_1 EXIST::FUNCTION: OPENSSL_sk_reserve 4344 1_1_1 EXIST::FUNCTION: -CRYPTO_atomic_read 4345 1_1_1 EXIST::FUNCTION: -CRYPTO_atomic_write 4346 1_1_1 EXIST::FUNCTION: EVP_PKEY_set1_engine 4347 1_1_0g EXIST::FUNCTION:ENGINE DH_new_by_nid 4348 1_1_1 EXIST::FUNCTION:DH DH_get_nid 4349 1_1_1 EXIST::FUNCTION:DH diff --git a/util/libssl.num b/util/libssl.num index 9b6d2661..3c31d7cc 100644 --- a/util/libssl.num +++ b/util/libssl.num @@ -475,7 +475,7 @@ SSL_set_tlsext_max_fragment_length 475 1_1_1 EXIST::FUNCTION: SSL_SESSION_get_max_fragment_length 476 1_1_1 EXIST::FUNCTION: SSL_stateless 477 1_1_1 EXIST::FUNCTION: SSL_verify_client_post_handshake 478 1_1_1 EXIST::FUNCTION: -SSL_force_post_handshake_auth 479 1_1_1 EXIST::FUNCTION: +SSL_set_post_handshake_auth 479 1_1_1 EXIST::FUNCTION: SSL_export_keying_material_early 480 1_1_1 EXIST::FUNCTION: SSL_CTX_use_cert_and_key 481 1_1_1 EXIST::FUNCTION: SSL_use_cert_and_key 482 1_1_1 EXIST::FUNCTION: @@ -496,3 +496,4 @@ SSL_set_recv_max_early_data 496 1_1_1 EXIST::FUNCTION: SSL_get_recv_max_early_data 497 1_1_1 EXIST::FUNCTION: SSL_CTX_get_recv_max_early_data 498 1_1_1 EXIST::FUNCTION: SSL_CTX_set_recv_max_early_data 499 1_1_1 EXIST::FUNCTION: +SSL_CTX_set_post_handshake_auth 500 1_1_1 EXIST::FUNCTION: