From 704c3822e0a3e4f48a3b7c0c29ee098c177a4b13 Mon Sep 17 00:00:00 2001 From: Hakase Date: Sat, 13 Apr 2019 23:25:53 +0900 Subject: [PATCH] Latest update, add TLS 1.3 session time configuration. --- CHANGES | 19 + Configurations/10-main.conf | 2 +- Configurations/common.tmpl | 4 +- Configurations/shared-info.pl | 1 + Configure | 49 +- INSTALL | 14 +- apps/ecparam.c | 19 +- apps/enc.c | 2 +- apps/include/fmt.h | 4 +- apps/ocsp.c | 34 +- apps/pkeyutl.c | 4 +- apps/s_client.c | 4 +- apps/s_server.c | 2 + apps/speed.c | 99 ++- apps/verify.c | 40 +- crypto/aes/aes_ige.c | 14 + crypto/bio/b_addr.c | 6 + crypto/bio/bss_sock.c | 19 +- crypto/build.info | 8 +- crypto/conf/conf_lib.c | 6 +- crypto/conf/conf_mall.c | 2 + crypto/conf/conf_mod.c | 4 + crypto/core_fetch.c | 5 +- crypto/cpt_err.c | 10 + crypto/dso/dso_openssl.c | 2 +- crypto/ec/curve25519.c | 3 +- crypto/ec/curve448/curve448utils.h | 6 +- crypto/ec/ec_check.c | 17 +- crypto/ec/ec_curve.c | 123 +++- crypto/ec/ec_key.c | 150 ++++- crypto/ec/ec_lcl.h | 13 +- crypto/ec/ec_lib.c | 45 +- crypto/ec/ecdsa_ossl.c | 2 +- crypto/engine/eng_cnf.c | 6 +- crypto/err/openssl.txt | 16 + crypto/evp/digest.c | 19 +- crypto/evp/e_aes.c | 133 ++-- crypto/evp/e_chacha20_poly1305.c | 2 +- crypto/evp/evp_cnf.c | 22 +- crypto/evp/evp_enc.c | 19 +- crypto/evp/evp_err.c | 12 + crypto/evp/evp_fetch.c | 40 +- crypto/evp/evp_lib.c | 12 +- crypto/evp/evp_locl.h | 4 +- crypto/evp/p_open.c | 2 +- crypto/ex_data.c | 9 +- crypto/include/internal/dso_conf.h.in | 5 +- crypto/include/internal/evp_int.h | 1 + crypto/include/internal/x509_int.h | 2 +- crypto/init.c | 12 +- crypto/kdf/hkdf.c | 34 +- crypto/mem.c | 12 +- crypto/modes/modes_lcl.h | 6 + crypto/params.c | 27 +- crypto/pem/pem_sign.c | 2 +- crypto/property/property_parse.c | 1 + crypto/provider_conf.c | 184 ++++++ crypto/provider_core.c | 102 +++- crypto/rand/drbg_ctr.c | 6 + crypto/rand/rand_err.c | 5 +- crypto/rand/rand_lib.c | 12 - crypto/rand/rand_win.c | 4 +- crypto/rsa/rsa_ameth.c | 4 +- crypto/s390xcap.c | 612 +++++++++---------- crypto/sha/build.info | 2 + crypto/trace.c | 2 +- crypto/x509/x509_lu.c | 3 + crypto/x509/x_all.c | 5 +- crypto/x509/x_x509.c | 13 +- doc/internal/man3/evp_generic_fetch.pod | 7 +- doc/internal/man3/ossl_method_construct.pod | 7 +- doc/man1/ecparam.pod | 6 + doc/man1/ocsp.pod | 7 + doc/man1/speed.pod | 5 + doc/man3/BIO_connect.pod | 14 +- doc/man3/BIO_ctrl.pod | 15 +- doc/man3/BN_rand.pod | 20 +- doc/man3/BN_security_bits.pod | 10 +- doc/man3/DES_random_key.pod | 12 +- doc/man3/EC_GROUP_copy.pod | 22 +- doc/man3/EVP_DigestInit.pod | 7 +- doc/man3/EVP_MD_fetch.pod | 33 +- doc/man3/EVP_set_default_properties.pod | 52 ++ doc/man3/OSSL_PARAM_TYPE.pod | 26 +- doc/man3/OSSL_trace_set_channel.pod | 4 + doc/man3/PEM_read_bio_PrivateKey.pod | 12 +- doc/man3/RAND_DRBG_generate.pod | 24 +- doc/man3/RAND_DRBG_get0_master.pod | 11 +- doc/man3/RAND_DRBG_new.pod | 10 +- doc/man3/RAND_DRBG_reseed.pod | 19 +- doc/man3/RAND_DRBG_set_callbacks.pod | 20 +- doc/man3/RAND_add.pod | 12 +- doc/man3/RAND_bytes.pod | 20 +- doc/man3/RAND_cleanup.pod | 10 +- doc/man3/SSL_CIPHER_get_name.pod | 17 +- doc/man3/SSL_CTX_new.pod | 14 +- doc/man3/SSL_CTX_set_default_passwd_cb.pod | 12 +- doc/man3/SSL_CTX_set_min_proto_version.pod | 10 +- doc/man3/SSL_CTX_set_split_send_fragment.pod | 10 +- doc/man3/SSL_read.pod | 10 +- doc/man3/SSL_write.pod | 10 +- doc/man3/X509_get0_sm2_id.pod | 12 +- doc/man3/X509_get_subject_name.pod | 18 +- doc/man5/config.pod | 90 ++- doc/man7/RAND_DRBG.pod | 7 +- engines/build.info | 12 +- include/internal/bio.h | 37 +- include/internal/core.h | 4 +- include/internal/dsoerr.h | 7 +- include/internal/ktls.h | 107 +++- include/internal/provider.h | 7 +- include/internal/refcount.h | 2 +- include/openssl/aes.h | 2 + include/openssl/bio.h | 9 +- include/openssl/core_numbers.h | 2 + include/openssl/cryptoerr.h | 5 + include/openssl/ec.h | 1 + include/openssl/evp.h | 2 + include/openssl/evperr.h | 8 + include/openssl/params.h | 5 +- include/openssl/randerr.h | 2 + include/openssl/ssl.h | 7 +- include/openssl/trace.h | 2 +- include/openssl/x509.h | 2 +- providers/build.info | 22 + providers/common/digests/build.info | 4 +- providers/common/digests/sha2.c | 6 + providers/fips/build.info | 2 + providers/fips/fipsprov.c | 99 +++ providers/legacy/build.info | 4 + providers/legacy/digests/build.info | 4 + providers/legacy/digests/md2.c | 63 ++ providers/legacy/legacyprov.c | 101 +++ ssl/record/rec_layer_s3.c | 10 +- ssl/record/ssl3_record.c | 47 +- ssl/ssl_locl.h | 3 +- ssl/ssl_sess.c | 22 +- ssl/t1_enc.c | 87 ++- test/build.info | 14 +- test/drbg_cavs_test.c | 5 + test/drbgtest.c | 87 ++- test/ectest.c | 316 +++++++++- test/evp_extra_test.c | 98 ++- test/igetest.c | 17 +- test/md2test.c | 14 + test/p_test.c | 20 +- test/params_api_test.c | 204 +++---- test/params_test.c | 35 +- test/provider_internal_test.c | 52 +- test/provider_internal_test.conf.in | 13 + test/provider_test.c | 10 +- test/recipes/02-test_internal_provider.t | 5 +- test/recipes/05-test_md2.t | 5 + test/recipes/15-test_ecparam.t | 10 +- test/recipes/25-test_verify.t | 2 +- test/recipes/30-test_evp_data/evpciph.txt | 2 +- test/recipes/30-test_evp_extra.t | 5 +- test/recipes/80-test_cms.t | 8 + test/sslapitest.c | 167 ++++- test/verify_extra_test.c | 46 ++ util/find-doc-nits | 23 +- util/libcrypto.num | 11 +- util/libssl.num | 1 + util/perl/OpenSSL/Test.pm | 70 ++- util/perl/OpenSSL/Test/Utils.pm | 5 +- util/private.num | 1 + 166 files changed, 3539 insertions(+), 1083 deletions(-) create mode 100644 crypto/provider_conf.c create mode 100644 doc/man3/EVP_set_default_properties.pod create mode 100644 providers/fips/build.info create mode 100644 providers/fips/fipsprov.c create mode 100644 providers/legacy/build.info create mode 100644 providers/legacy/digests/build.info create mode 100644 providers/legacy/digests/md2.c create mode 100644 providers/legacy/legacyprov.c create mode 100644 test/provider_internal_test.conf.in diff --git a/CHANGES b/CHANGES index 1d093142..164787c4 100644 --- a/CHANGES +++ b/CHANGES @@ -9,6 +9,24 @@ Changes between 1.1.1 and 3.0.0 [xx XXX xxxx] + *) The functions AES_ige_encrypt() and AES_bi_ige_encrypt() have been + deprecated. These undocumented functions were never integrated into the EVP + layer and implement the AES Infinite Garble Extension (IGE) mode and AES + Bi-directional IGE mode. These modes were never formally standardised and + usage of these functions is believed to be very small. In particular + AES_bi_ige_encrypt() has a known bug. It accepts 2 AES keys, but only one + is ever used. The security implications are believed to be minimal, but + this issue was never fixed for backwards compatibility reasons. New code + should not use these modes. + [Matt Caswell] + + *) Add prediction resistance to the DRBG reseeding process. + [Paul Dale] + + *) Limit the number of blocks in a data unit for AES-XTS to 2^20 as + mandated by IEEE Std 1619-2018. + [Paul Dale] + *) Added newline escaping functionality to a filename when using openssl dgst. This output format is to replicate the output format found in the '*sum' checksum programs. This aims to preserve backward compatibility. @@ -16,6 +34,7 @@ *) Removed the heartbeat message in DTLS feature, as it has very little usage and doesn't seem to fulfill a valuable purpose. + The configuration option is now deprecated. [Richard Levitte] *) Changed the output of 'openssl {digestname} < file' to display the diff --git a/Configurations/10-main.conf b/Configurations/10-main.conf index 0e3afd34..27e587fb 100644 --- a/Configurations/10-main.conf +++ b/Configurations/10-main.conf @@ -1431,7 +1431,7 @@ my %targets = ( #### Cygwin "Cygwin-common" => { - inherit_from => [ "BASE_unix", asm("x86_asm") ], + inherit_from => [ "BASE_unix" ], template => 1, CC => "gcc", diff --git a/Configurations/common.tmpl b/Configurations/common.tmpl index 5ca0d562..62b1102c 100644 --- a/Configurations/common.tmpl +++ b/Configurations/common.tmpl @@ -151,9 +151,9 @@ return "" if $cache{$lib}; $OUT .= obj2dso(lib => $lib, attrs => $unified_info{attributes}->{$lib}, - objs => $unified_info{shared_sources}->{$lib}, + objs => $unified_info{sources}->{$lib}, deps => [ resolvedepends($lib) ]); - foreach (@{$unified_info{shared_sources}->{$lib}}) { + foreach (@{$unified_info{sources}->{$lib}}) { # If this is somehow a compiled object, take care of it that way # Otherwise, it might simply be generated if (defined $unified_info{sources}->{$_}) { diff --git a/Configurations/shared-info.pl b/Configurations/shared-info.pl index 3df12a32..f821ad7e 100644 --- a/Configurations/shared-info.pl +++ b/Configurations/shared-info.pl @@ -32,6 +32,7 @@ my %shared_info; return { %{$shared_info{'gnu-shared'}}, shared_defflag => '-Wl,--version-script=', + dso_ldflags => '-z defs', }; }, 'bsd-gcc-shared' => sub { return $shared_info{'linux-shared'}; }, diff --git a/Configure b/Configure index 5aaa6401..3b7ca360 100755 --- a/Configure +++ b/Configure @@ -24,7 +24,7 @@ use OpenSSL::Glob; my $orig_death_handler = $SIG{__DIE__}; $SIG{__DIE__} = \&death_handler; -my $usage="Usage: Configure [no- ...] [enable- ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [no-asm] [no-dso] [no-egd] [sctp] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--config=FILE] os/compiler[:flags]\n"; +my $usage="Usage: Configure [no- ...] [enable- ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [no-asm] [no-egd] [sctp] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--config=FILE] os/compiler[:flags]\n"; # Options: # @@ -59,8 +59,6 @@ my $usage="Usage: Configure [no- ...] [enable- ...] [-Dxxx] [-lx # [no-]pic [don't] try to build position independent code when supported. # If disabled, it also disables shared and dynamic-engine. # no-asm do not use assembler -# no-dso do not compile in any native shared-library methods. This -# will ensure that all methods just return NULL. # no-egd do not compile support for the entropy-gathering daemon APIs # [no-]zlib [don't] compile support for zlib compression. # zlib-dynamic Like "zlib", but the zlib library is expected to be a shared @@ -76,7 +74,7 @@ my $usage="Usage: Configure [no- ...] [enable- ...] [-Dxxx] [-lx # -static while -static is also a pass-through compiler option (and # as such is limited to environments where it's actually # meaningful), it triggers a number configuration options, -# namely no-dso, no-pic, no-shared and no-threads. It is +# namely no-pic, no-shared and no-threads. It is # argued that the only reason to produce statically linked # binaries (and in context it means executables linked with # -static flag, and not just executables linked with static @@ -359,7 +357,6 @@ my @disablables = ( "dgram", "dh", "dsa", - "dso", "dtls", "dynamic-engine", "ec", @@ -372,14 +369,17 @@ my @disablables = ( "err", "external-tests", "filenames", + "fips", "fuzz-libfuzzer", "fuzz-afl", "gost", "idea", + "legacy", "makedepend", "md2", "md4", "mdc2", + "module", "msan", "multiblock", "nextprotoneg", @@ -440,6 +440,8 @@ my %deprecated_disablables = ( "hw-padlock" => "padlockeng", "ripemd" => "rmd160", "ui" => "ui-console", + "dso" => undef, + "heartbeats" => undef, ); # All of the following are disabled by default: @@ -494,12 +496,25 @@ my @disable_cascades = ( "crypto-mdebug" => [ "crypto-mdebug-backtrace" ], - # Without DSO, we can't load dynamic engines, so don't build them dynamic - "dso" => [ "dynamic-engine" ], + # If no modules, then no dynamic engines either + "module" => [ "dynamic-engine" ], - # Without position independent code, there can be no shared libraries or DSOs - "pic" => [ "shared" ], + # Without shared libraries, dynamic engines aren't possible. + # This is due to them having to link with libcrypto and register features + # using the ENGINE functionality, and since that relies on global tables, + # those *have* to be exacty the same as the ones accessed from the app, + # which cannot be guaranteed if shared libraries aren't present. + # (note that even with shared libraries, both the app and dynamic engines + # must be linked with the same library) "shared" => [ "dynamic-engine" ], + # Other modules don't necessarily have to link with libcrypto, so shared + # libraries do not have to be a condition to produce those. + + # Without position independent code, there can be no shared libraries + # or modules. + "pic" => [ "shared", "module" ], + + "module" => [ "fips", "legacy" ], "engine" => [ grep /eng$/, @disablables ], "hw" => [ "padlockeng" ], @@ -518,6 +533,7 @@ my @disable_cascades = ( sub { !$disabled{"msan"} } => [ "asm" ], sub { $disabled{cmac}; } => [ "siv" ], + "legacy" => [ "md2" ], ); # Avoid protocol support holes. Also disable all versions below N, if version @@ -876,7 +892,6 @@ while (@argvcopy) elsif (/^-static$/) { push @{$useradd{LDFLAGS}}, $_; - $disabled{"dso"} = "forced"; $disabled{"pic"} = "forced"; $disabled{"shared"} = "forced"; $disabled{"threads"} = "forced"; @@ -1211,9 +1226,9 @@ foreach my $what (sort keys %disabled) { $config{options} .= " no-$what"; - if (!grep { $what eq $_ } ( 'buildtest-c++', 'dso', 'threads', 'shared', - 'pic', 'dynamic-engine', 'makedepend', - 'zlib-dynamic', 'zlib', 'sse2' )) { + if (!grep { $what eq $_ } ( 'buildtest-c++', 'fips', 'threads', 'shared', + 'module', 'pic', 'dynamic-engine', 'makedepend', + 'zlib-dynamic', 'zlib', 'sse2', 'legacy' )) { (my $WHAT = uc $what) =~ s|-|_|g; my $skipdir = $what; @@ -1317,9 +1332,8 @@ if ($target{shared_target} eq "") { $no_shared_warn = 1 if (!$disabled{shared} || !$disabled{"dynamic-engine"}); - $disabled{shared} = "no-shared-target"; $disabled{pic} = $disabled{shared} = $disabled{"dynamic-engine"} = - "no-shared-target"; + $disabled{module} = "no-shared-target"; } if ($disabled{"dynamic-engine"}) { @@ -2196,9 +2210,8 @@ EOF src => [ 'sources', 'shared_sources' ], dst => 'shared_sources' } }, - modules => { dso => { src => [ 'sources', - 'shared_sources' ], - dst => 'shared_sources' } }, + modules => { dso => { src => [ 'sources' ], + dst => 'sources' } }, scripts => { script => { src => [ 'sources' ], dst => 'sources' } } } -> {$prodtype}; diff --git a/INSTALL b/INSTALL index cffa241a..50722a10 100644 --- a/INSTALL +++ b/INSTALL @@ -353,9 +353,6 @@ on BSD implementations, in which case it can be disabled with no-devcryptoeng. - no-dso - Don't build support for loading Dynamic Shared Objects. - no-dynamic-engine Don't build the dynamically loaded engines. This only has an effect in a "shared" build @@ -397,6 +394,9 @@ Don't compile in filename and line number information (e.g. for errors and memory allocation). + no-fips + Don't compile the FIPS module + enable-fuzz-libfuzzer, enable-fuzz-afl Build with support for fuzzing using either libfuzzer or AFL. These are developer options only. They may not work on all @@ -409,9 +409,17 @@ available if the GOST algorithms are also available through loading an externally supplied engine. + no-legacy + Don't build the legacy provider. Disabling this also disables + the legacy algorithms: MD2 (already disabled by default). + no-makedepend Don't generate dependencies. + no-module + Don't build any dynamically loadable engines. This also + implies 'no-dynamic-engine'. + no-multiblock Don't build support for writing multiple records in one go in libssl (Note: this is a different capability to the diff --git a/apps/ecparam.c b/apps/ecparam.c index 24fda049..0c893a39 100644 --- a/apps/ecparam.c +++ b/apps/ecparam.c @@ -30,7 +30,7 @@ typedef enum OPTION_choice { OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_TEXT, OPT_C, OPT_CHECK, OPT_LIST_CURVES, OPT_NO_SEED, OPT_NOOUT, OPT_NAME, - OPT_CONV_FORM, OPT_PARAM_ENC, OPT_GENKEY, OPT_ENGINE, + OPT_CONV_FORM, OPT_PARAM_ENC, OPT_GENKEY, OPT_ENGINE, OPT_CHECK_NAMED, OPT_R_ENUM } OPTION_CHOICE; @@ -43,6 +43,8 @@ const OPTIONS ecparam_options[] = { {"text", OPT_TEXT, '-', "Print the ec parameters in text form"}, {"C", OPT_C, '-', "Print a 'C' function creating the parameters"}, {"check", OPT_CHECK, '-', "Validate the ec parameters"}, + {"check_named", OPT_CHECK_NAMED, '-', + "Check that named EC curve parameters have not been modified"}, {"list_curves", OPT_LIST_CURVES, '-', "Prints a list of all curve 'short names'"}, {"no_seed", OPT_NO_SEED, '-', @@ -90,7 +92,7 @@ int ecparam_main(int argc, char **argv) int informat = FORMAT_PEM, outformat = FORMAT_PEM, noout = 0, C = 0; int ret = 1, private = 0; int list_curves = 0, no_seed = 0, check = 0, new_form = 0; - int text = 0, i, genkey = 0; + int text = 0, i, genkey = 0, check_named = 0; prog = opt_init(argc, argv, ecparam_options); while ((o = opt_next()) != OPT_EOF) { @@ -127,6 +129,9 @@ int ecparam_main(int argc, char **argv) case OPT_CHECK: check = 1; break; + case OPT_CHECK_NAMED: + check_named = 1; + break; case OPT_LIST_CURVES: list_curves = 1; break; @@ -266,6 +271,16 @@ int ecparam_main(int argc, char **argv) goto end; } + if (check_named) { + BIO_printf(bio_err, "validating named elliptic curve parameters: "); + if (EC_GROUP_check_named_curve(group, 0) <= 0) { + BIO_printf(bio_err, "failed\n"); + ERR_print_errors(bio_err); + goto end; + } + BIO_printf(bio_err, "ok\n"); + } + if (check) { BIO_printf(bio_err, "checking elliptic curve parameters: "); if (!EC_GROUP_check(group, NULL)) { diff --git a/apps/enc.c b/apps/enc.c index fbc3664d..57ce9243 100644 --- a/apps/enc.c +++ b/apps/enc.c @@ -500,7 +500,7 @@ int enc_main(int argc, char **argv) if (hiv != NULL) { int siz = EVP_CIPHER_iv_length(cipher); if (siz == 0) { - BIO_printf(bio_err, "warning: iv not use by this cipher\n"); + BIO_printf(bio_err, "warning: iv not used by this cipher\n"); } else if (!set_hex(hiv, iv, siz)) { BIO_printf(bio_err, "invalid hex iv value\n"); goto end; diff --git a/apps/include/fmt.h b/apps/include/fmt.h index 538a20a5..e3da9a44 100644 --- a/apps/include/fmt.h +++ b/apps/include/fmt.h @@ -32,8 +32,8 @@ # define FORMAT_PKCS12 6 # define FORMAT_SMIME (7 | B_FORMAT_TEXT) # define FORMAT_ENGINE 8 /* Not really a file format */ -# define FORMAT_PEMRSA (9 | B_FORMAT_TEXT) /* PEM RSAPubicKey format */ -# define FORMAT_ASN1RSA 10 /* DER RSAPubicKey format */ +# define FORMAT_PEMRSA (9 | B_FORMAT_TEXT) /* PEM RSAPublicKey format */ +# define FORMAT_ASN1RSA 10 /* DER RSAPublicKey format */ # define FORMAT_MSBLOB 11 /* MS Key blob format */ # define FORMAT_PVK 12 /* MS PVK file format */ # define FORMAT_HTTP 13 /* Download using HTTP */ diff --git a/apps/ocsp.c b/apps/ocsp.c index ddcab4c2..9f2cf453 100644 --- a/apps/ocsp.c +++ b/apps/ocsp.c @@ -99,7 +99,8 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req EVP_PKEY *rkey, const EVP_MD *md, STACK_OF(OPENSSL_STRING) *sigopts, STACK_OF(X509) *rother, unsigned long flags, - int nmin, int ndays, int badsig); + int nmin, int ndays, int badsig, + const EVP_MD *resp_md); static char **lookup_serial(CA_DB *db, ASN1_INTEGER *ser); static BIO *init_responder(const char *port); @@ -138,6 +139,7 @@ typedef enum OPTION_choice { OPT_RESPOUT, OPT_PATH, OPT_ISSUER, OPT_CERT, OPT_SERIAL, OPT_INDEX, OPT_CA, OPT_NMIN, OPT_REQUEST, OPT_NDAYS, OPT_RSIGNER, OPT_RKEY, OPT_ROTHER, OPT_RMD, OPT_RSIGOPT, OPT_HEADER, + OPT_RCID, OPT_V_ENUM, OPT_MD, OPT_MULTI @@ -220,6 +222,7 @@ const OPTIONS ocsp_options[] = { {"rmd", OPT_RMD, 's', "Digest Algorithm to use in signature of OCSP response"}, {"rsigopt", OPT_RSIGOPT, 's', "OCSP response signature parameter in n:v form"}, {"header", OPT_HEADER, 's', "key=value header to add"}, + {"rcid", OPT_RCID, 's', "Use specified algorithm for cert id in response"}, {"", OPT_MD, '-', "Any supported digest algorithm (sha1,sha256, ... )"}, OPT_V_OPTIONS, {NULL} @@ -243,6 +246,7 @@ int ocsp_main(int argc, char **argv) STACK_OF(X509) *issuers = NULL; X509 *issuer = NULL, *cert = NULL; STACK_OF(X509) *rca_cert = NULL; + const EVP_MD *resp_certid_md = NULL; X509 *signer = NULL, *rsigner = NULL; X509_STORE *store = NULL; X509_VERIFY_PARAM *vpm = NULL; @@ -499,6 +503,11 @@ int ocsp_main(int argc, char **argv) if (!X509V3_add_value(header, value, &headers)) goto end; break; + case OPT_RCID: + resp_certid_md = EVP_get_digestbyname(opt_arg()); + if (resp_certid_md == NULL) + goto opthelp; + break; case OPT_MD: if (trailing_md) { BIO_printf(bio_err, @@ -684,7 +693,8 @@ redo_accept: if (rdb != NULL) { make_ocsp_response(bio_err, &resp, req, rdb, rca_cert, rsigner, rkey, - rsign_md, rsign_sigopts, rother, rflags, nmin, ndays, badsig); + rsign_md, rsign_sigopts, rother, rflags, nmin, ndays, badsig, + resp_certid_md); if (cbio != NULL) send_ocsp_response(cbio, resp); } else if (host != NULL) { @@ -1138,7 +1148,8 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req EVP_PKEY *rkey, const EVP_MD *rmd, STACK_OF(OPENSSL_STRING) *sigopts, STACK_OF(X509) *rother, unsigned long flags, - int nmin, int ndays, int badsig) + int nmin, int ndays, int badsig, + const EVP_MD *resp_md) { ASN1_TIME *thisupd = NULL, *nextupd = NULL; OCSP_CERTID *cid; @@ -1169,6 +1180,8 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req int found = 0; ASN1_OBJECT *cert_id_md_oid; const EVP_MD *cert_id_md; + OCSP_CERTID *cid_resp_md = NULL; + one = OCSP_request_onereq_get0(req, i); cid = OCSP_onereq_get0_id(one); @@ -1184,11 +1197,18 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req X509 *ca_cert = sk_X509_value(ca, jj); OCSP_CERTID *ca_id = OCSP_cert_to_id(cert_id_md, NULL, ca_cert); - if (OCSP_id_issuer_cmp(ca_id, cid) == 0) + if (OCSP_id_issuer_cmp(ca_id, cid) == 0) { found = 1; - + if (resp_md != NULL) + cid_resp_md = OCSP_cert_to_id(resp_md, NULL, ca_cert); + } OCSP_CERTID_free(ca_id); } + OCSP_id_get0_info(NULL, NULL, NULL, &serial, cid); + inf = lookup_serial(db, serial); + + /* at this point, we can have cid be an alias of cid_resp_md */ + cid = (cid_resp_md != NULL) ? cid_resp_md : cid; if (!found) { OCSP_basic_add1_status(bs, cid, @@ -1196,8 +1216,6 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req 0, NULL, thisupd, nextupd); continue; } - OCSP_id_get0_info(NULL, NULL, NULL, &serial, cid); - inf = lookup_serial(db, serial); if (inf == NULL) { OCSP_basic_add1_status(bs, cid, V_OCSP_CERTSTATUS_UNKNOWN, @@ -1212,6 +1230,7 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req ASN1_GENERALIZEDTIME *invtm = NULL; OCSP_SINGLERESP *single; int reason = -1; + unpack_revinfo(&revtm, &reason, &inst, &invtm, inf[DB_rev_date]); single = OCSP_basic_add1_status(bs, cid, V_OCSP_CERTSTATUS_REVOKED, @@ -1227,6 +1246,7 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req ASN1_TIME_free(revtm); ASN1_GENERALIZEDTIME_free(invtm); } + OCSP_CERTID_free(cid_resp_md); } OCSP_copy_nonce(bs, req); diff --git a/apps/pkeyutl.c b/apps/pkeyutl.c index 7f1e6213..c8cac0d6 100644 --- a/apps/pkeyutl.c +++ b/apps/pkeyutl.c @@ -688,7 +688,7 @@ static int do_raw_keyop(int pkey_op, EVP_PKEY_CTX *ctx, if (filesize < 0) { BIO_printf(bio_err, "Error: unable to determine file size for oneshot operation\n"); - return rv; + goto end; } mbuf = app_malloc(filesize, "oneshot sign/verify buffer"); switch(pkey_op) { @@ -717,7 +717,6 @@ static int do_raw_keyop(int pkey_op, EVP_PKEY_CTX *ctx, } break; } - OPENSSL_free(mbuf); goto end; } @@ -767,6 +766,7 @@ static int do_raw_keyop(int pkey_op, EVP_PKEY_CTX *ctx, } end: + OPENSSL_free(mbuf); EVP_MD_CTX_free(mctx); return rv; } diff --git a/apps/s_client.c b/apps/s_client.c index 6d7a83f3..282d137b 100644 --- a/apps/s_client.c +++ b/apps/s_client.c @@ -2277,7 +2277,7 @@ int s_client_main(int argc, char **argv) do { mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ); } - while (mbuf_len > 3 && mbuf[3] == '-'); + while (mbuf_len > 3 && (!isdigit(mbuf[0]) || !isdigit(mbuf[1]) || !isdigit(mbuf[2]) || mbuf[3] != ' ')); (void)BIO_flush(fbio); BIO_pop(fbio); BIO_free(fbio); @@ -3313,6 +3313,8 @@ static void print_stuff(BIO *bio, SSL *s, int full) #ifndef OPENSSL_NO_KTLS if (BIO_get_ktls_send(SSL_get_wbio(s))) BIO_printf(bio_err, "Using Kernel TLS for sending\n"); + if (BIO_get_ktls_recv(SSL_get_rbio(s))) + BIO_printf(bio_err, "Using Kernel TLS for receiving\n"); #endif if (OSSL_TRACE_ENABLED(TLS)) { diff --git a/apps/s_server.c b/apps/s_server.c index 92d4579a..381b1c96 100644 --- a/apps/s_server.c +++ b/apps/s_server.c @@ -2921,6 +2921,8 @@ static void print_connection_info(SSL *con) #ifndef OPENSSL_NO_KTLS if (BIO_get_ktls_send(SSL_get_wbio(con))) BIO_printf(bio_err, "Using Kernel TLS for sending\n"); + if (BIO_get_ktls_recv(SSL_get_rbio(con))) + BIO_printf(bio_err, "Using Kernel TLS for receiving\n"); #endif (void)BIO_flush(bio_s_out); diff --git a/apps/speed.c b/apps/speed.c index 5674e324..72826f82 100644 --- a/apps/speed.c +++ b/apps/speed.c @@ -57,6 +57,9 @@ # include #endif #include +#ifndef OPENSSL_NO_CMAC +#include +#endif #include #ifndef OPENSSL_NO_RMD160 # include @@ -163,10 +166,12 @@ static int DES_ede3_cbc_encrypt_loop(void *args); #endif static int AES_cbc_128_encrypt_loop(void *args); static int AES_cbc_192_encrypt_loop(void *args); -static int AES_ige_128_encrypt_loop(void *args); static int AES_cbc_256_encrypt_loop(void *args); +#if !OPENSSL_API_3 +static int AES_ige_128_encrypt_loop(void *args); static int AES_ige_192_encrypt_loop(void *args); static int AES_ige_256_encrypt_loop(void *args); +#endif static int CRYPTO_gcm128_aad_loop(void *args); static int RAND_bytes_loop(void *args); static int EVP_Update_loop(void *args); @@ -300,7 +305,7 @@ typedef enum OPTION_choice { OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, OPT_ELAPSED, OPT_EVP, OPT_HMAC, OPT_DECRYPT, OPT_ENGINE, OPT_MULTI, OPT_MR, OPT_MB, OPT_MISALIGN, OPT_ASYNCJOBS, OPT_R_ENUM, - OPT_PRIMES, OPT_SECONDS, OPT_BYTES, OPT_AEAD + OPT_PRIMES, OPT_SECONDS, OPT_BYTES, OPT_AEAD, OPT_CMAC } OPTION_CHOICE; const OPTIONS speed_options[] = { @@ -309,6 +314,9 @@ const OPTIONS speed_options[] = { {"help", OPT_HELP, '-', "Display this summary"}, {"evp", OPT_EVP, 's', "Use EVP-named cipher or digest"}, {"hmac", OPT_HMAC, 's', "HMAC using EVP-named digest"}, +#ifndef OPENSSL_NO_CMAC + {"cmac", OPT_CMAC, 's', "CMAC using EVP-named cipher"}, +#endif {"decrypt", OPT_DECRYPT, '-', "Time decryption instead of encryption (only EVP)"}, {"aead", OPT_AEAD, '-', @@ -371,6 +379,7 @@ const OPTIONS speed_options[] = { #define D_GHASH 29 #define D_RAND 30 #define D_EVP_HMAC 31 +#define D_EVP_CMAC 32 /* name of algorithms to test */ static const char *names[] = { @@ -381,7 +390,7 @@ static const char *names[] = { "camellia-128 cbc", "camellia-192 cbc", "camellia-256 cbc", "evp", "sha256", "sha512", "whirlpool", "aes-128 ige", "aes-192 ige", "aes-256 ige", "ghash", - "rand", "hmac" + "rand", "hmac", "cmac" }; #define ALGOR_NUM OSSL_NELEM(names) @@ -421,9 +430,11 @@ static const OPT_PAIR doit_choices[] = { {"aes-128-cbc", D_CBC_128_AES}, {"aes-192-cbc", D_CBC_192_AES}, {"aes-256-cbc", D_CBC_256_AES}, +#if !OPENSSL_API_3 {"aes-128-ige", D_IGE_128_AES}, {"aes-192-ige", D_IGE_192_AES}, {"aes-256-ige", D_IGE_256_AES}, +#endif #ifndef OPENSSL_NO_RC2 {"rc2-cbc", D_CBC_RC2}, {"rc2", D_CBC_RC2}, @@ -629,6 +640,9 @@ typedef struct loopargs_st { #endif EVP_CIPHER_CTX *ctx; HMAC_CTX *hctx; +#ifndef OPENSSL_NO_CMAC + CMAC_CTX *cmac_ctx; +#endif GCM128_CONTEXT *gcm_ctx; } loopargs_t; static int run_benchmark(int async_jobs, int (*loop_function) (void *), @@ -859,6 +873,7 @@ static int AES_cbc_256_encrypt_loop(void *args) return count; } +#if !OPENSSL_API_3 static int AES_ige_128_encrypt_loop(void *args) { loopargs_t *tempargs = *(loopargs_t **) args; @@ -894,6 +909,7 @@ static int AES_ige_256_encrypt_loop(void *args) (size_t)lengths[testnum], &aes_ks3, iv, AES_ENCRYPT); return count; } +#endif static int CRYPTO_gcm128_aad_loop(void *args) { @@ -1064,6 +1080,33 @@ static int EVP_HMAC_loop(void *args) return count; } +#ifndef OPENSSL_NO_CMAC +static const EVP_CIPHER *evp_cmac_cipher = NULL; +static char *evp_cmac_name = NULL; + +static int EVP_CMAC_loop(void *args) +{ + loopargs_t *tempargs = *(loopargs_t **) args; + unsigned char *buf = tempargs->buf; + CMAC_CTX *cmac_ctx = tempargs->cmac_ctx; + static const char key[16] = "This is a key..."; + unsigned char mac[16]; + size_t len = sizeof(mac); + int count; +#ifndef SIGALRM + int nb_iter = save_count * 4 * lengths[0] / lengths[testnum]; +#endif + + for (count = 0; COND(nb_iter); count++) { + if (!CMAC_Init(cmac_ctx, key, sizeof(key), evp_cmac_cipher, NULL) + || !CMAC_Update(cmac_ctx, buf, lengths[testnum]) + || !CMAC_Final(cmac_ctx, mac, &len)) + return -1; + } + return count; +} +#endif + #ifndef OPENSSL_NO_RSA static long rsa_c[RSA_NUM][2]; /* # RSA iteration test */ @@ -1610,6 +1653,17 @@ int speed_main(int argc, char **argv) } doit[D_EVP_HMAC] = 1; break; + case OPT_CMAC: +#ifndef OPENSSL_NO_CMAC + evp_cmac_cipher = EVP_get_cipherbyname(opt_arg()); + if (evp_cmac_cipher == NULL) { + BIO_printf(bio_err, "%s: %s is an unknown cipher\n", + prog, opt_arg()); + goto end; + } + doit[D_EVP_CMAC] = 1; +#endif + break; case OPT_DECRYPT: decrypt = 1; break; @@ -1848,9 +1902,9 @@ int speed_main(int argc, char **argv) e = setup_engine(engine_id, 0); /* No parameters; turn on everything. */ - if (argc == 0 && !doit[D_EVP] && !doit[D_EVP_HMAC]) { + if (argc == 0 && !doit[D_EVP] && !doit[D_EVP_HMAC] && !doit[D_EVP_CMAC]) { for (i = 0; i < ALGOR_NUM; i++) - if (i != D_EVP && i != D_EVP_HMAC) + if (i != D_EVP && i != D_EVP_HMAC && i != D_EVP_CMAC) doit[i] = 1; #ifndef OPENSSL_NO_RSA for (i = 0; i < RSA_NUM; i++) @@ -2381,6 +2435,7 @@ int speed_main(int argc, char **argv) } } +#if !OPENSSL_API_3 if (doit[D_IGE_128_AES]) { for (testnum = 0; testnum < size_num; testnum++) { print_message(names[D_IGE_128_AES], c[D_IGE_128_AES][testnum], @@ -2414,6 +2469,7 @@ int speed_main(int argc, char **argv) print_result(D_IGE_256_AES, testnum, count, d); } } +#endif if (doit[D_GHASH]) { for (i = 0; i < loopargs_len; i++) { loopargs[i].gcm_ctx = @@ -2719,6 +2775,36 @@ int speed_main(int argc, char **argv) } } +#ifndef OPENSSL_NO_CMAC + if (doit[D_EVP_CMAC]) { + if (evp_cmac_cipher != NULL) { + const char *cipher_name = OBJ_nid2ln(EVP_CIPHER_type(evp_cmac_cipher)); + evp_cmac_name = app_malloc(sizeof("CMAC()") + strlen(cipher_name), + "CMAC name"); + sprintf(evp_cmac_name, "CMAC(%s)", cipher_name); + names[D_EVP_CMAC] = evp_cmac_name; + + for (i = 0; i < loopargs_len; i++) { + loopargs[i].cmac_ctx = CMAC_CTX_new(); + if (loopargs[i].cmac_ctx == NULL) { + BIO_printf(bio_err, "CMAC malloc failure, exiting..."); + exit(1); + } + } + for (testnum = 0; testnum < size_num; testnum++) { + print_message(names[D_EVP_CMAC], save_count, lengths[testnum], + seconds.sym); + Time_F(START); + count = run_benchmark(async_jobs, EVP_CMAC_loop, loopargs); + d = Time_F(STOP); + print_result(D_EVP_CMAC, testnum, count, d); + } + for (i = 0; i < loopargs_len; i++) + CMAC_CTX_free(loopargs[i].cmac_ctx); + } + } +#endif + for (i = 0; i < loopargs_len; i++) if (RAND_bytes(loopargs[i].buf, 36) <= 0) goto end; @@ -3418,6 +3504,9 @@ int speed_main(int argc, char **argv) #endif } OPENSSL_free(evp_hmac_name); +#ifndef OPENSSL_NO_CMAC + OPENSSL_free(evp_cmac_name); +#endif if (async_jobs > 0) { for (i = 0; i < loopargs_len; i++) diff --git a/apps/verify.c b/apps/verify.c index 67d32762..3767972a 100644 --- a/apps/verify.c +++ b/apps/verify.c @@ -246,27 +246,37 @@ static int check(X509_STORE *ctx, const char *file, if (sm2id != NULL) { #ifndef OPENSSL_NO_SM2 - ASN1_OCTET_STRING v; + ASN1_OCTET_STRING *v; - v.data = sm2id; - v.length = sm2idlen; + v = ASN1_OCTET_STRING_new(); + if (v == NULL) { + BIO_printf(bio_err, "error: SM2 ID allocation failed\n"); + goto end; + } - X509_set_sm2_id(x, &v); + if (!ASN1_OCTET_STRING_set(v, sm2id, sm2idlen)) { + BIO_printf(bio_err, "error: setting SM2 ID failed\n"); + ASN1_OCTET_STRING_free(v); + goto end; + } + + X509_set0_sm2_id(x, v); #endif } csc = X509_STORE_CTX_new(); if (csc == NULL) { - printf("error %s: X.509 store context allocation failed\n", - (file == NULL) ? "stdin" : file); + BIO_printf(bio_err, "error %s: X.509 store context allocation failed\n", + (file == NULL) ? "stdin" : file); goto end; } X509_STORE_set_flags(ctx, vflags); if (!X509_STORE_CTX_init(csc, ctx, x, uchain)) { X509_STORE_CTX_free(csc); - printf("error %s: X.509 store context initialization failed\n", - (file == NULL) ? "stdin" : file); + BIO_printf(bio_err, + "error %s: X.509 store context initialization failed\n", + (file == NULL) ? "stdin" : file); goto end; } if (tchain != NULL) @@ -275,28 +285,30 @@ static int check(X509_STORE *ctx, const char *file, X509_STORE_CTX_set0_crls(csc, crls); i = X509_verify_cert(csc); if (i > 0 && X509_STORE_CTX_get_error(csc) == X509_V_OK) { - printf("%s: OK\n", (file == NULL) ? "stdin" : file); + BIO_printf(bio_out, "%s: OK\n", (file == NULL) ? "stdin" : file); ret = 1; if (show_chain) { int j; chain = X509_STORE_CTX_get1_chain(csc); num_untrusted = X509_STORE_CTX_get_num_untrusted(csc); - printf("Chain:\n"); + BIO_printf(bio_out, "Chain:\n"); for (j = 0; j < sk_X509_num(chain); j++) { X509 *cert = sk_X509_value(chain, j); - printf("depth=%d: ", j); + BIO_printf(bio_out, "depth=%d: ", j); X509_NAME_print_ex_fp(stdout, X509_get_subject_name(cert), 0, get_nameopt()); if (j < num_untrusted) - printf(" (untrusted)"); - printf("\n"); + BIO_printf(bio_out, " (untrusted)"); + BIO_printf(bio_out, "\n"); } sk_X509_pop_free(chain, X509_free); } } else { - printf("error %s: verification failed\n", (file == NULL) ? "stdin" : file); + BIO_printf(bio_err, + "error %s: verification failed\n", + (file == NULL) ? "stdin" : file); } X509_STORE_CTX_free(csc); diff --git a/crypto/aes/aes_ige.c b/crypto/aes/aes_ige.c index e19922a1..351c1734 100644 --- a/crypto/aes/aes_ige.c +++ b/crypto/aes/aes_ige.c @@ -9,6 +9,10 @@ #include "internal/cryptlib.h" +#if OPENSSL_API_3 +NON_EMPTY_TRANSLATION_UNIT +#else + #include #include "aes_locl.h" @@ -34,6 +38,7 @@ typedef struct { /* N.B. The IV for this mode is _twice_ the block size */ +/* Use of this function is deprecated. */ void AES_ige_encrypt(const unsigned char *in, unsigned char *out, size_t length, const AES_KEY *key, unsigned char *ivec, const int enc) @@ -162,6 +167,14 @@ void AES_ige_encrypt(const unsigned char *in, unsigned char *out, /* * Note that its effectively impossible to do biIGE in anything other * than a single pass, so no provision is made for chaining. + * + * NB: The implementation of AES_bi_ige_encrypt has a bug. It is supposed to use + * 2 AES keys, but in fact only one is ever used. This bug has been present + * since this code was first implemented. It is believed to have minimal + * security impact in practice and has therefore not been fixed for backwards + * compatibility reasons. + * + * Use of this function is deprecated. */ /* N.B. The IV for this mode is _four times_ the block size */ @@ -282,3 +295,4 @@ void AES_bi_ige_encrypt(const unsigned char *in, unsigned char *out, } } } +#endif diff --git a/crypto/bio/b_addr.c b/crypto/bio/b_addr.c index 4be74e4e..0f398243 100644 --- a/crypto/bio/b_addr.c +++ b/crypto/bio/b_addr.c @@ -683,6 +683,12 @@ int BIO_lookup_ex(const char *host, const char *service, int lookup_type, hints.ai_family = family; hints.ai_socktype = socktype; hints.ai_protocol = protocol; +#ifdef AI_ADDRCONFIG +#ifdef AF_UNSPEC + if (family == AF_UNSPEC) +#endif + hints.ai_flags |= AI_ADDRCONFIG; +#endif if (lookup_type == BIO_LOOKUP_SERVER) hints.ai_flags |= AI_PASSIVE; diff --git a/crypto/bio/bss_sock.c b/crypto/bio/bss_sock.c index 60e5adc0..0c994593 100644 --- a/crypto/bio/bss_sock.c +++ b/crypto/bio/bss_sock.c @@ -108,7 +108,12 @@ static int sock_read(BIO *b, char *out, int outl) if (out != NULL) { clear_socket_error(); - ret = readsocket(b->num, out, outl); +# ifndef OPENSSL_NO_KTLS + if (BIO_get_ktls_recv(b)) + ret = ktls_read_record(b->num, out, outl); + else +# endif + ret = readsocket(b->num, out, outl); BIO_clear_retry_flags(b); if (ret <= 0) { if (BIO_sock_should_retry(ret)) @@ -177,20 +182,22 @@ static long sock_ctrl(BIO *b, int cmd, long num, void *ptr) ret = 1; break; # ifndef OPENSSL_NO_KTLS - case BIO_CTRL_SET_KTLS_SEND: + case BIO_CTRL_SET_KTLS: crypto_info = (struct tls12_crypto_info_aes_gcm_128 *)ptr; ret = ktls_start(b->num, crypto_info, sizeof(*crypto_info), num); if (ret) - BIO_set_ktls_flag(b); + BIO_set_ktls_flag(b, num); break; case BIO_CTRL_GET_KTLS_SEND: - return BIO_should_ktls_flag(b); - case BIO_CTRL_SET_KTLS_SEND_CTRL_MSG: + return BIO_should_ktls_flag(b, 1); + case BIO_CTRL_GET_KTLS_RECV: + return BIO_should_ktls_flag(b, 0); + case BIO_CTRL_SET_KTLS_TX_SEND_CTRL_MSG: BIO_set_ktls_ctrl_msg_flag(b); b->ptr = (void *)num; ret = 0; break; - case BIO_CTRL_CLEAR_KTLS_CTRL_MSG: + case BIO_CTRL_CLEAR_KTLS_TX_CTRL_MSG: BIO_clear_ktls_ctrl_msg_flag(b); ret = 0; break; diff --git a/crypto/build.info b/crypto/build.info index 535fa35a..77dcffb9 100644 --- a/crypto/build.info +++ b/crypto/build.info @@ -9,7 +9,8 @@ SUBDIRS=objects buffer bio stack lhash rand evp asn1 pem x509 x509v3 conf \ LIBS=../libcrypto # The Core -SOURCE[../libcrypto]=provider_core.c provider_predefined.c core_fetch.c +SOURCE[../libcrypto]=provider_core.c provider_predefined.c provider_conf.c \ + core_fetch.c # Central utilities SOURCE[../libcrypto]=\ @@ -20,6 +21,11 @@ SOURCE[../libcrypto]=\ trace.c provider.c params.c \ {- $target{cpuid_asm_src} -} {- $target{uplink_aux_src} -} +# FIPS module +SOURCE[../providers/fips]=\ + cryptlib.c mem.c mem_clr.c params.c + + DEPEND[cversion.o]=buildinf.h GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(CC) $(LIB_CFLAGS) $(CPPFLAGS_Q)" "$(PLATFORM)" DEPEND[buildinf.h]=../configdata.pm diff --git a/crypto/conf/conf_lib.c b/crypto/conf/conf_lib.c index 606563a4..13d061b2 100644 --- a/crypto/conf/conf_lib.c +++ b/crypto/conf/conf_lib.c @@ -356,8 +356,10 @@ OPENSSL_INIT_SETTINGS *OPENSSL_INIT_new(void) { OPENSSL_INIT_SETTINGS *ret = malloc(sizeof(*ret)); - if (ret != NULL) - memset(ret, 0, sizeof(*ret)); + if (ret == NULL) + return NULL; + + memset(ret, 0, sizeof(*ret)); ret->flags = DEFAULT_CONF_MFLAGS; return ret; diff --git a/crypto/conf/conf_mall.c b/crypto/conf/conf_mall.c index e1d0e7ae..28003a8f 100644 --- a/crypto/conf/conf_mall.c +++ b/crypto/conf/conf_mall.c @@ -14,6 +14,7 @@ #include #include #include +#include "internal/provider.h" #include "conf_lcl.h" /* Load all OpenSSL builtin modules */ @@ -28,4 +29,5 @@ void OPENSSL_load_builtin_modules(void) #endif EVP_add_alg_module(); conf_add_ssl_module(); + ossl_provider_add_conf_module(); } diff --git a/crypto/conf/conf_mod.c b/crypto/conf/conf_mod.c index 3ad09a79..56b19467 100644 --- a/crypto/conf/conf_mod.c +++ b/crypto/conf/conf_mod.c @@ -14,6 +14,7 @@ #include "internal/conf.h" #include "internal/dso.h" #include +#include #define DSO_mod_init_name "OPENSSL_init" #define DSO_mod_finish_name "OPENSSL_finish" @@ -92,6 +93,7 @@ int CONF_modules_load(const CONF *cnf, const char *appname, return 1; } + OSSL_TRACE1(CONF, "Configuration in section %s\n", vsection); values = NCONF_get_section(cnf, vsection); if (!values) @@ -100,6 +102,8 @@ int CONF_modules_load(const CONF *cnf, const char *appname, for (i = 0; i < sk_CONF_VALUE_num(values); i++) { vl = sk_CONF_VALUE_value(values, i); ret = module_run(cnf, vl->name, vl->value, flags); + OSSL_TRACE3(CONF, "Running module %s (%s) returned %d\n", + vl->name, vl->value, ret); if (ret <= 0) if (!(flags & CONF_MFLAGS_IGNORE_ERRORS)) return ret; diff --git a/crypto/core_fetch.c b/crypto/core_fetch.c index d38e1325..2c4b0d71 100644 --- a/crypto/core_fetch.c +++ b/crypto/core_fetch.c @@ -35,8 +35,9 @@ static int ossl_method_construct_this(OSSL_PROVIDER *provider, void *cbdata) const OSSL_ALGORITHM *thismap = map++; void *method = NULL; - if ((method = data->mcm->construct(thismap->implementation, provider, - data->mcm_data)) == NULL) + if ((method = data->mcm->construct(thismap->algorithm_name, + thismap->implementation, provider, + data->mcm_data)) == NULL) continue; /* diff --git a/crypto/cpt_err.c b/crypto/cpt_err.c index 3c3265dc..8c386925 100644 --- a/crypto/cpt_err.c +++ b/crypto/cpt_err.c @@ -50,8 +50,12 @@ static const ERR_STRING_DATA CRYPTO_str_functs[] = { "OSSL_PROVIDER_add_builtin"}, {ERR_PACK(ERR_LIB_CRYPTO, CRYPTO_F_OSSL_PROVIDER_ACTIVATE, 0), "ossl_provider_activate"}, + {ERR_PACK(ERR_LIB_CRYPTO, CRYPTO_F_OSSL_PROVIDER_ADD_PARAMETER, 0), + "ossl_provider_add_parameter"}, {ERR_PACK(ERR_LIB_CRYPTO, CRYPTO_F_OSSL_PROVIDER_NEW, 0), "ossl_provider_new"}, + {ERR_PACK(ERR_LIB_CRYPTO, CRYPTO_F_OSSL_PROVIDER_SET_MODULE_PATH, 0), + "ossl_provider_set_module_path"}, {ERR_PACK(ERR_LIB_CRYPTO, CRYPTO_F_PKEY_HMAC_INIT, 0), "pkey_hmac_init"}, {ERR_PACK(ERR_LIB_CRYPTO, CRYPTO_F_PKEY_POLY1305_INIT, 0), "pkey_poly1305_init"}, @@ -59,6 +63,10 @@ static const ERR_STRING_DATA CRYPTO_str_functs[] = { "pkey_siphash_init"}, {ERR_PACK(ERR_LIB_CRYPTO, CRYPTO_F_PROVIDER_ACTIVATE, 0), "provider_activate"}, + {ERR_PACK(ERR_LIB_CRYPTO, CRYPTO_F_PROVIDER_CONF_INIT, 0), + "provider_conf_init"}, + {ERR_PACK(ERR_LIB_CRYPTO, CRYPTO_F_PROVIDER_CONF_LOAD, 0), + "provider_conf_load"}, {ERR_PACK(ERR_LIB_CRYPTO, CRYPTO_F_PROVIDER_NEW, 0), "provider_new"}, {ERR_PACK(ERR_LIB_CRYPTO, CRYPTO_F_PROVIDER_STORE_NEW, 0), "provider_store_new"}, @@ -75,6 +83,8 @@ static const ERR_STRING_DATA CRYPTO_str_reasons[] = { "odd number of digits"}, {ERR_PACK(ERR_LIB_CRYPTO, 0, CRYPTO_R_PROVIDER_ALREADY_EXISTS), "provider already exists"}, + {ERR_PACK(ERR_LIB_CRYPTO, 0, CRYPTO_R_PROVIDER_SECTION_ERROR), + "provider section error"}, {0, NULL} }; diff --git a/crypto/dso/dso_openssl.c b/crypto/dso/dso_openssl.c index d834b2ec..0e244380 100644 --- a/crypto/dso/dso_openssl.c +++ b/crypto/dso/dso_openssl.c @@ -9,7 +9,7 @@ #include "dso_locl.h" -#if !defined(DSO_VMS) && !defined(DSO_DLCFN) && !defined(DSO_DL) && !defined(DSO_WIN32) && !defined(DSO_DLFCN) +#ifdef DSO_NONE static DSO_METHOD dso_meth_null = { "NULL shared library method" diff --git a/crypto/ec/curve25519.c b/crypto/ec/curve25519.c index 7d12c5d5..ca2b6cc5 100644 --- a/crypto/ec/curve25519.c +++ b/crypto/ec/curve25519.c @@ -1,5 +1,5 @@ /* - * Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2016-2019 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -254,6 +254,7 @@ static void x25519_scalar_mulx(uint8_t out[32], const uint8_t scalar[32], #if defined(X25519_ASM) \ || ( (defined(__SIZEOF_INT128__) && __SIZEOF_INT128__ == 16) \ && !defined(__sparc__) \ + && (!defined(__SIZEOF_LONG__) || (__SIZEOF_LONG__ == 8)) \ && !(defined(__ANDROID__) && !defined(__clang__)) ) /* * Base 2^51 implementation. It's virtually no different from reference diff --git a/crypto/ec/curve448/curve448utils.h b/crypto/ec/curve448/curve448utils.h index 9c4952be..0ac69a66 100644 --- a/crypto/ec/curve448/curve448utils.h +++ b/crypto/ec/curve448/curve448utils.h @@ -1,5 +1,5 @@ /* - * Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2017-2019 The OpenSSL Project Authors. All Rights Reserved. * Copyright 2015 Cryptography Research, Inc. * * Licensed under the Apache License 2.0 (the "License"). You may not use @@ -24,7 +24,9 @@ */ # ifndef C448_WORD_BITS # if (defined(__SIZEOF_INT128__) && (__SIZEOF_INT128__ == 16)) \ - && !defined(__sparc__) + && !defined(__sparc__) \ + && (!defined(__SIZEOF_LONG__) || (__SIZEOF_LONG__ == 8)) + # define C448_WORD_BITS 64 /* The number of bits in a word */ # else # define C448_WORD_BITS 32 /* The number of bits in a word */ diff --git a/crypto/ec/ec_check.c b/crypto/ec/ec_check.c index 322d0fe5..097d7e1c 100644 --- a/crypto/ec/ec_check.c +++ b/crypto/ec/ec_check.c @@ -1,5 +1,5 @@ /* - * Copyright 2002-2016 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2002-2019 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -10,6 +10,16 @@ #include "ec_lcl.h" #include +int EC_GROUP_check_named_curve(const EC_GROUP *group, int nist_only) +{ + int nid; + + nid = ec_curve_nid_from_params(group); + if (nid > 0 && nist_only && EC_curve_nid2nist(nid) == NULL) + nid = NID_undef; + return nid; +} + int EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx) { int ret = 0; @@ -17,6 +27,11 @@ int EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx) BN_CTX *new_ctx = NULL; EC_POINT *point = NULL; + if (group == NULL || group->meth == NULL) { + ECerr(EC_F_EC_GROUP_CHECK, ERR_R_PASSED_NULL_PARAMETER); + return 0; + } + /* Custom curves assumed to be correct */ if ((group->meth->flags & EC_FLAGS_CUSTOM_CURVE) != 0) return 1; diff --git a/crypto/ec/ec_curve.c b/crypto/ec/ec_curve.c index 641cf3f2..6c7c9ddb 100644 --- a/crypto/ec/ec_curve.c +++ b/crypto/ec/ec_curve.c @@ -14,6 +14,7 @@ #include #include #include "internal/nelem.h" +#include "internal/o_str.h" typedef struct { int field_type, /* either NID_X9_62_prime_field or @@ -1136,6 +1137,7 @@ static const struct { }, { /* no seed */ + /* p */ 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, @@ -1209,6 +1211,7 @@ static const struct { }, { /* no seed */ + /* p */ 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, @@ -1244,6 +1247,7 @@ static const struct { }, { /* no seed */ + /* p */ 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0xA1, @@ -1278,7 +1282,7 @@ static const struct { NID_X9_62_characteristic_two_field, 20, 36, 2 }, { - /* no seed */ + /* seed */ 0x77, 0xE2, 0xB0, 0x73, 0x70, 0xEB, 0x0F, 0x83, 0x2A, 0x6D, 0xD5, 0xB6, 0x2D, 0xFC, 0x88, 0xCD, 0x06, 0xBB, 0x84, 0xBE, /* p */ @@ -3197,3 +3201,120 @@ int EC_curve_nist2nid(const char *name) } return NID_undef; } + +#define NUM_BN_FIELDS 6 +/* + * Validates EC domain parameter data for known named curves. + * This can be used when a curve is loaded explicitly (without a curve + * name) or to validate that domain parameters have not been modified. + * + * Returns: The nid associated with the found named curve, or NID_undef + * if not found. If there was an error it returns -1. + */ +int ec_curve_nid_from_params(const EC_GROUP *group) +{ + int ret = -1, nid, len, field_type, param_len; + size_t i, seed_len; + const unsigned char *seed, *params_seed, *params; + unsigned char *param_bytes = NULL; + const EC_CURVE_DATA *data; + const EC_POINT *generator = NULL; + const EC_METHOD *meth; + const BIGNUM *cofactor = NULL; + /* An array of BIGNUMs for (p, a, b, x, y, order) */ + BIGNUM *bn[NUM_BN_FIELDS] = {NULL, NULL, NULL, NULL, NULL, NULL}; + BN_CTX *ctx = NULL; + + meth = EC_GROUP_method_of(group); + if (meth == NULL) + return -1; + /* Use the optional named curve nid as a search field */ + nid = EC_GROUP_get_curve_name(group); + field_type = EC_METHOD_get_field_type(meth); + seed_len = EC_GROUP_get_seed_len(group); + seed = EC_GROUP_get0_seed(group); + cofactor = EC_GROUP_get0_cofactor(group); + + ctx = BN_CTX_new(); + if (ctx == NULL) + return -1; + BN_CTX_start(ctx); + + /* + * The built-in curves contains data fields (p, a, b, x, y, order) that are + * all zero-padded to be the same size. The size of the padding is + * determined by either the number of bytes in the field modulus (p) or the + * EC group order, whichever is larger. + */ + param_len = BN_num_bytes(group->order); + len = BN_num_bytes(group->field); + if (len > param_len) + param_len = len; + + /* Allocate space to store the padded data for (p, a, b, x, y, order) */ + param_bytes = OPENSSL_malloc(param_len * NUM_BN_FIELDS); + if (param_bytes == NULL) + goto end; + + /* Create the bignums */ + for (i = 0; i < NUM_BN_FIELDS; ++i) { + if ((bn[i] = BN_CTX_get(ctx)) == NULL) + goto end; + } + /* + * Fill in the bn array with the same values as the internal curves + * i.e. the values are p, a, b, x, y, order. + */ + /* Get p, a & b */ + if (!(EC_GROUP_get_curve(group, bn[0], bn[1], bn[2], ctx) + && ((generator = EC_GROUP_get0_generator(group)) != NULL) + /* Get x & y */ + && EC_POINT_get_affine_coordinates(group, generator, bn[3], bn[4], ctx) + /* Get order */ + && EC_GROUP_get_order(group, bn[5], ctx))) + goto end; + + /* + * Convert the bignum array to bytes that are joined together to form + * a single buffer that contains data for all fields. + * (p, a, b, x, y, order) are all zero padded to be the same size. + */ + for (i = 0; i < NUM_BN_FIELDS; ++i) { + if (BN_bn2binpad(bn[i], ¶m_bytes[i*param_len], param_len) <= 0) + goto end; + } + + for (i = 0; i < curve_list_length; i++) { + const ec_list_element curve = curve_list[i]; + + data = curve.data; + /* Get the raw order byte data */ + params_seed = (const unsigned char *)(data + 1); /* skip header */ + params = params_seed + data->seed_len; + + /* Look for unique fields in the fixed curve data */ + if (data->field_type == field_type + && param_len == data->param_len + && (nid <= 0 || nid == curve.nid) + /* check the optional cofactor (ignore if its zero) */ + && (BN_is_zero(cofactor) + || BN_is_word(cofactor, (const BN_ULONG)curve.data->cofactor)) + /* Check the optional seed (ignore if its not set) */ + && (data->seed_len == 0 || seed_len == 0 + || ((size_t)data->seed_len == seed_len + && OPENSSL_memcmp(params_seed, seed, seed_len) == 0)) + /* Check that the groups params match the built-in curve params */ + && OPENSSL_memcmp(param_bytes, params, param_len * NUM_BN_FIELDS) + == 0) { + ret = curve.nid; + goto end; + } + } + /* Gets here if the group was not found */ + ret = NID_undef; +end: + OPENSSL_free(param_bytes); + BN_CTX_end(ctx); + BN_CTX_free(ctx); + return ret; +} diff --git a/crypto/ec/ec_key.c b/crypto/ec/ec_key.c index 637ba141..76aea4f4 100644 --- a/crypto/ec/ec_key.c +++ b/crypto/ec/ec_key.c @@ -1,5 +1,5 @@ /* - * Copyright 2002-2018 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2002-2019 The OpenSSL Project Authors. All Rights Reserved. * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved * * Licensed under the Apache License 2.0 (the "License"). You may not use @@ -195,59 +195,90 @@ int ossl_ec_key_gen(EC_KEY *eckey) return eckey->group->meth->keygen(eckey); } +/* + * ECC Key generation. + * See SP800-56AR3 5.6.1.2.2 "Key Pair Generation by Testing Candidates" + * + * Params: + * eckey An EC key object that contains domain params. The generated keypair + * is stored in this object. + * Returns 1 if the keypair was generated or 0 otherwise. + */ int ec_key_simple_generate_key(EC_KEY *eckey) { int ok = 0; - BN_CTX *ctx = NULL; BIGNUM *priv_key = NULL; const BIGNUM *order = NULL; EC_POINT *pub_key = NULL; - - if ((ctx = BN_CTX_new()) == NULL) - goto err; + const EC_GROUP *group = eckey->group; if (eckey->priv_key == NULL) { - priv_key = BN_new(); + priv_key = BN_secure_new(); if (priv_key == NULL) goto err; } else priv_key = eckey->priv_key; - order = EC_GROUP_get0_order(eckey->group); + /* + * Steps (1-2): Check domain parameters and security strength. + * These steps must be done by the user. This would need to be + * stated in the security policy. + */ + + order = EC_GROUP_get0_order(group); if (order == NULL) goto err; + /* + * Steps (3-7): priv_key = DRBG_RAND(order_n_bits) (range [1, n-1]). + * Although this is slightly different from the standard, it is effectively + * equivalent as it gives an unbiased result ranging from 1..n-1. It is also + * faster as the standard needs to retry more often. Also doing + * 1 + rand[0..n-2] would effect the way that tests feed dummy entropy into + * rand so the simpler backward compatible method has been used here. + */ do if (!BN_priv_rand_range(priv_key, order)) goto err; while (BN_is_zero(priv_key)) ; if (eckey->pub_key == NULL) { - pub_key = EC_POINT_new(eckey->group); + pub_key = EC_POINT_new(group); if (pub_key == NULL) goto err; } else pub_key = eckey->pub_key; - if (!EC_POINT_mul(eckey->group, pub_key, priv_key, NULL, NULL, ctx)) + /* Step (8) : pub_key = priv_key * G (where G is a point on the curve) */ + if (!EC_POINT_mul(group, pub_key, priv_key, NULL, NULL, NULL)) goto err; eckey->priv_key = priv_key; eckey->pub_key = pub_key; + priv_key = NULL; + pub_key = NULL; ok = 1; - err: - if (eckey->pub_key == NULL) - EC_POINT_free(pub_key); - if (eckey->priv_key != priv_key) - BN_free(priv_key); - BN_CTX_free(ctx); +err: + /* Step (9): If there is an error return an invalid keypair. */ + if (!ok) { + BN_clear(eckey->priv_key); + if (eckey->pub_key != NULL) + EC_POINT_set_to_infinity(group, eckey->pub_key); + } + + EC_POINT_free(pub_key); + BN_clear_free(priv_key); return ok; } int ec_key_simple_generate_public_key(EC_KEY *eckey) { + /* + * See SP800-56AR3 5.6.1.2.2: Step (8) + * pub_key = priv_key * G (where G is a point on the curve) + */ return EC_POINT_mul(eckey->group, eckey->pub_key, eckey->priv_key, NULL, NULL, NULL); } @@ -267,6 +298,58 @@ int EC_KEY_check_key(const EC_KEY *eckey) return eckey->group->meth->keycheck(eckey); } +/* + * Check the range of the EC public key. + * See SP800-56A R3 Section 5.6.2.3.3 (Part 2) + * i.e. + * - If q = odd prime p: Verify that xQ and yQ are integers in the + * interval[0, p − 1], OR + * - If q = 2m: Verify that xQ and yQ are bit strings of length m bits. + * Returns 1 if the public key has a valid range, otherwise it returns 0. + */ +static int ec_key_public_range_check(BN_CTX *ctx, const EC_KEY *key) +{ + int ret = 0; + BIGNUM *x, *y; + + BN_CTX_start(ctx); + x = BN_CTX_get(ctx); + y = BN_CTX_get(ctx); + if (y == NULL) + goto err; + + if (!EC_POINT_get_affine_coordinates(key->group, key->pub_key, x, y, ctx)) + goto err; + + if (EC_METHOD_get_field_type(key->group->meth) == NID_X9_62_prime_field) { + if (BN_is_negative(x) + || BN_cmp(x, key->group->field) >= 0 + || BN_is_negative(y) + || BN_cmp(y, key->group->field) >= 0) { + goto err; + } + } else { + int m = EC_GROUP_get_degree(key->group); + if (BN_num_bits(x) > m || BN_num_bits(y) > m) { + goto err; + } + } + ret = 1; +err: + BN_CTX_end(ctx); + return ret; +} + +/* + * ECC Key validation as specified in SP800-56A R3. + * Section 5.6.2.3.3 ECC Full Public-Key Validation + * Section 5.6.2.1.2 Owner Assurance of Private-Key Validity + * Section 5.6.2.1.4 Owner Assurance of Pair-wise Consistency + * NOTES: + * Before calling this method in fips mode, there should be an assurance that + * an approved elliptic-curve group is used. + * Returns 1 if the key is valid, otherwise it returns 0. + */ int ec_key_simple_check_key(const EC_KEY *eckey) { int ok = 0; @@ -279,6 +362,7 @@ int ec_key_simple_check_key(const EC_KEY *eckey) return 0; } + /* 5.6.2.3.3 (Step 1): Q != infinity */ if (EC_POINT_is_at_infinity(eckey->group, eckey->pub_key)) { ECerr(EC_F_EC_KEY_SIMPLE_CHECK_KEY, EC_R_POINT_AT_INFINITY); goto err; @@ -286,20 +370,28 @@ int ec_key_simple_check_key(const EC_KEY *eckey) if ((ctx = BN_CTX_new()) == NULL) goto err; + if ((point = EC_POINT_new(eckey->group)) == NULL) goto err; - /* testing whether the pub_key is on the elliptic curve */ + /* 5.6.2.3.3 (Step 2) Test if the public key is in range */ + if (!ec_key_public_range_check(ctx, eckey)) { + ECerr(EC_F_EC_KEY_SIMPLE_CHECK_KEY, EC_R_COORDINATES_OUT_OF_RANGE); + goto err; + } + + /* 5.6.2.3.3 (Step 3) is the pub_key on the elliptic curve */ if (EC_POINT_is_on_curve(eckey->group, eckey->pub_key, ctx) <= 0) { ECerr(EC_F_EC_KEY_SIMPLE_CHECK_KEY, EC_R_POINT_IS_NOT_ON_CURVE); goto err; } - /* testing whether pub_key * order is the point at infinity */ + order = eckey->group->order; if (BN_is_zero(order)) { ECerr(EC_F_EC_KEY_SIMPLE_CHECK_KEY, EC_R_INVALID_GROUP_ORDER); goto err; } + /* 5.6.2.3.3 (Step 4) : pub_key * order is the point at infinity. */ if (!EC_POINT_mul(eckey->group, point, NULL, eckey->pub_key, order, ctx)) { ECerr(EC_F_EC_KEY_SIMPLE_CHECK_KEY, ERR_R_EC_LIB); goto err; @@ -308,15 +400,21 @@ int ec_key_simple_check_key(const EC_KEY *eckey) ECerr(EC_F_EC_KEY_SIMPLE_CHECK_KEY, EC_R_WRONG_ORDER); goto err; } - /* - * in case the priv_key is present : check if generator * priv_key == - * pub_key - */ + if (eckey->priv_key != NULL) { - if (BN_cmp(eckey->priv_key, order) >= 0) { + /* + * 5.6.2.1.2 Owner Assurance of Private-Key Validity + * The private key is in the range [1, order-1] + */ + if (BN_cmp(eckey->priv_key, BN_value_one()) < 0 + || BN_cmp(eckey->priv_key, order) >= 0) { ECerr(EC_F_EC_KEY_SIMPLE_CHECK_KEY, EC_R_WRONG_ORDER); goto err; } + /* + * Section 5.6.2.1.4 Owner Assurance of Pair-wise Consistency (b) + * Check if generator * priv_key = pub_key + */ if (!EC_POINT_mul(eckey->group, point, eckey->priv_key, NULL, NULL, ctx)) { ECerr(EC_F_EC_KEY_SIMPLE_CHECK_KEY, ERR_R_EC_LIB); @@ -368,12 +466,10 @@ int EC_KEY_set_public_key_affine_coordinates(EC_KEY *key, BIGNUM *x, goto err; /* - * Check if retrieved coordinates match originals and are less than field - * order: if not values are out of range. + * Check if retrieved coordinates match originals. The range check is done + * inside EC_KEY_check_key(). */ - if (BN_cmp(x, tx) || BN_cmp(y, ty) - || (BN_cmp(x, key->group->field) >= 0) - || (BN_cmp(y, key->group->field) >= 0)) { + if (BN_cmp(x, tx) || BN_cmp(y, ty)) { ECerr(EC_F_EC_KEY_SET_PUBLIC_KEY_AFFINE_COORDINATES, EC_R_COORDINATES_OUT_OF_RANGE); goto err; diff --git a/crypto/ec/ec_lcl.h b/crypto/ec/ec_lcl.h index 6b90ef3a..c54789ba 100644 --- a/crypto/ec/ec_lcl.h +++ b/crypto/ec/ec_lcl.h @@ -309,13 +309,10 @@ struct ec_point_st { static ossl_inline int ec_point_is_compat(const EC_POINT *point, const EC_GROUP *group) { - if (group->meth != point->meth - || (group->curve_name != 0 - && point->curve_name != 0 - && group->curve_name != point->curve_name)) - return 0; - - return 1; + return group->meth == point->meth + && (group->curve_name == 0 + || point->curve_name == 0 + || group->curve_name == point->curve_name); } NISTP224_PRE_COMP *EC_nistp224_pre_comp_dup(NISTP224_PRE_COMP *); @@ -595,6 +592,8 @@ int ec_key_simple_generate_key(EC_KEY *eckey); int ec_key_simple_generate_public_key(EC_KEY *eckey); int ec_key_simple_check_key(const EC_KEY *eckey); +int ec_curve_nid_from_params(const EC_GROUP *group); + /* EC_METHOD definitions */ struct ec_key_method_st { diff --git a/crypto/ec/ec_lib.c b/crypto/ec/ec_lib.c index 798382ac..762cac4f 100644 --- a/crypto/ec/ec_lib.c +++ b/crypto/ec/ec_lib.c @@ -284,15 +284,17 @@ int EC_GROUP_set_generator(EC_GROUP *group, const EC_POINT *generator, if (order != NULL) { if (!BN_copy(group->order, order)) return 0; - } else + } else { BN_zero(group->order); + } + /* The cofactor is an optional field, so it should be able to be NULL. */ if (cofactor != NULL) { if (!BN_copy(group->cofactor, cofactor)) return 0; - } else + } else { BN_zero(group->cofactor); - + } /* * Some groups have an order with * factors of two, which makes the Montgomery setup fail. @@ -530,30 +532,43 @@ int EC_GROUP_cmp(const EC_GROUP *a, const EC_GROUP *b, BN_CTX *ctx) !b->meth->group_get_curve(b, b1, b2, b3, ctx)) r = 1; - if (r || BN_cmp(a1, b1) || BN_cmp(a2, b2) || BN_cmp(a3, b3)) + /* return 1 if the curve parameters are different */ + if (r || BN_cmp(a1, b1) != 0 || BN_cmp(a2, b2) != 0 || BN_cmp(a3, b3) != 0) r = 1; /* XXX EC_POINT_cmp() assumes that the methods are equal */ + /* return 1 if the generators are different */ if (r || EC_POINT_cmp(a, EC_GROUP_get0_generator(a), - EC_GROUP_get0_generator(b), ctx)) + EC_GROUP_get0_generator(b), ctx) != 0) r = 1; if (!r) { const BIGNUM *ao, *bo, *ac, *bc; - /* compare the order and cofactor */ + /* compare the orders */ ao = EC_GROUP_get0_order(a); bo = EC_GROUP_get0_order(b); + if (ao == NULL || bo == NULL) { + /* return an error if either order is NULL */ + r = -1; + goto end; + } + if (BN_cmp(ao, bo) != 0) { + /* return 1 if orders are different */ + r = 1; + goto end; + } + /* + * It gets here if the curve parameters and generator matched. + * Now check the optional cofactors (if both are present). + */ ac = EC_GROUP_get0_cofactor(a); bc = EC_GROUP_get0_cofactor(b); - if (ao == NULL || bo == NULL) { - BN_CTX_end(ctx); - BN_CTX_free(ctx_new); - return -1; - } - if (BN_cmp(ao, bo) || BN_cmp(ac, bc)) + /* Returns 1 (mismatch) if both cofactors are specified and different */ + if (!BN_is_zero(ac) && !BN_is_zero(bc) && BN_cmp(ac, bc) != 0) r = 1; + /* Returns 0 if the parameters matched */ } - +end: BN_CTX_end(ctx); BN_CTX_free(ctx_new); @@ -622,8 +637,8 @@ int EC_POINT_copy(EC_POINT *dest, const EC_POINT *src) } if (dest->meth != src->meth || (dest->curve_name != src->curve_name - && dest->curve_name != 0 - && src->curve_name != 0)) { + && dest->curve_name != 0 + && src->curve_name != 0)) { ECerr(EC_F_EC_POINT_COPY, EC_R_INCOMPATIBLE_OBJECTS); return 0; } diff --git a/crypto/ec/ecdsa_ossl.c b/crypto/ec/ecdsa_ossl.c index a790e0ad..a488d5c8 100644 --- a/crypto/ec/ecdsa_ossl.c +++ b/crypto/ec/ecdsa_ossl.c @@ -59,7 +59,7 @@ static int ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, } } - k = BN_new(); /* this value is later returned in *kinvp */ + k = BN_secure_new(); /* this value is later returned in *kinvp */ r = BN_new(); /* this value is later returned in *rp */ X = BN_new(); if (k == NULL || r == NULL || X == NULL) { diff --git a/crypto/engine/eng_cnf.c b/crypto/engine/eng_cnf.c index c87a8a14..9f647c4a 100644 --- a/crypto/engine/eng_cnf.c +++ b/crypto/engine/eng_cnf.c @@ -49,7 +49,7 @@ static int int_engine_configure(const char *name, const char *value, const CONF int soft = 0; name = skip_dot(name); - OSSL_TRACE1(ENGINE_CONF, "Configuring engine %s\n", name); + OSSL_TRACE1(CONF, "Configuring engine %s\n", name); /* Value is a section containing ENGINE commands */ ecmds = NCONF_get_section(cnf, value); @@ -63,7 +63,7 @@ static int int_engine_configure(const char *name, const char *value, const CONF ecmd = sk_CONF_VALUE_value(ecmds, i); ctrlname = skip_dot(ecmd->name); ctrlvalue = ecmd->value; - OSSL_TRACE2(ENGINE_CONF, "ENGINE conf: doing ctrl(%s,%s)\n", + OSSL_TRACE2(CONF, "ENGINE: doing ctrl(%s,%s)\n", ctrlname, ctrlvalue); /* First handle some special pseudo ctrls */ @@ -148,7 +148,7 @@ static int int_engine_module_init(CONF_IMODULE *md, const CONF *cnf) STACK_OF(CONF_VALUE) *elist; CONF_VALUE *cval; int i; - OSSL_TRACE2(ENGINE_CONF, "Called engine module: name %s, value %s\n", + OSSL_TRACE2(CONF, "Called engine module: name %s, value %s\n", CONF_imodule_get_name(md), CONF_imodule_get_value(md)); /* Value is a section containing ENGINEs to configure */ elist = NCONF_get_section(cnf, CONF_imodule_get_value(md)); diff --git a/crypto/err/openssl.txt b/crypto/err/openssl.txt index df8690a1..f7117f16 100644 --- a/crypto/err/openssl.txt +++ b/crypto/err/openssl.txt @@ -392,11 +392,15 @@ CRYPTO_F_OPENSSL_SK_DEEP_COPY:127:OPENSSL_sk_deep_copy CRYPTO_F_OPENSSL_SK_DUP:128:OPENSSL_sk_dup CRYPTO_F_OSSL_PROVIDER_ACTIVATE:130:ossl_provider_activate CRYPTO_F_OSSL_PROVIDER_ADD_BUILTIN:132:OSSL_PROVIDER_add_builtin +CRYPTO_F_OSSL_PROVIDER_ADD_PARAMETER:139:ossl_provider_add_parameter CRYPTO_F_OSSL_PROVIDER_NEW:131:ossl_provider_new +CRYPTO_F_OSSL_PROVIDER_SET_MODULE_PATH:140:ossl_provider_set_module_path CRYPTO_F_PKEY_HMAC_INIT:123:pkey_hmac_init CRYPTO_F_PKEY_POLY1305_INIT:124:pkey_poly1305_init CRYPTO_F_PKEY_SIPHASH_INIT:125:pkey_siphash_init CRYPTO_F_PROVIDER_ACTIVATE:134:provider_activate +CRYPTO_F_PROVIDER_CONF_INIT:137:provider_conf_init +CRYPTO_F_PROVIDER_CONF_LOAD:138:provider_conf_load CRYPTO_F_PROVIDER_NEW:135:provider_new CRYPTO_F_PROVIDER_STORE_NEW:136:provider_store_new CRYPTO_F_SK_RESERVE:129:sk_reserve @@ -750,12 +754,16 @@ ESS_F_ESS_SIGNING_CERT_NEW_INIT:102:ESS_SIGNING_CERT_new_init ESS_F_ESS_SIGNING_CERT_V2_ADD:105:ESS_SIGNING_CERT_V2_add ESS_F_ESS_SIGNING_CERT_V2_NEW_INIT:103:ESS_SIGNING_CERT_V2_new_init EVP_F_AESNI_INIT_KEY:165:aesni_init_key +EVP_F_AESNI_XTS_INIT_KEY:233:aesni_xts_init_key EVP_F_AES_GCM_CTRL:196:aes_gcm_ctrl EVP_F_AES_GCM_TLS_CIPHER:207:aes_gcm_tls_cipher EVP_F_AES_INIT_KEY:133:aes_init_key EVP_F_AES_OCB_CIPHER:169:aes_ocb_cipher EVP_F_AES_T4_INIT_KEY:178:aes_t4_init_key +EVP_F_AES_T4_XTS_INIT_KEY:234:aes_t4_xts_init_key EVP_F_AES_WRAP_CIPHER:170:aes_wrap_cipher +EVP_F_AES_XTS_CIPHER:229:aes_xts_cipher +EVP_F_AES_XTS_INIT_KEY:235:aes_xts_init_key EVP_F_ALG_MODULE_INIT:177:alg_module_init EVP_F_ARIA_CCM_INIT_KEY:175:aria_ccm_init_key EVP_F_ARIA_GCM_CTRL:197:aria_gcm_ctrl @@ -795,6 +803,7 @@ EVP_F_EVP_MAC_CTRL_STR:210:EVP_MAC_ctrl_str EVP_F_EVP_MAC_CTX_COPY:211:EVP_MAC_CTX_copy EVP_F_EVP_MAC_CTX_NEW:213:EVP_MAC_CTX_new EVP_F_EVP_MAC_INIT:212:EVP_MAC_init +EVP_F_EVP_MD_BLOCK_SIZE:232:EVP_MD_block_size EVP_F_EVP_MD_CTX_COPY_EX:110:EVP_MD_CTX_copy_ex EVP_F_EVP_MD_SIZE:162:EVP_MD_size EVP_F_EVP_OPENINIT:102:EVP_OpenInit @@ -849,6 +858,7 @@ EVP_F_EVP_PKEY_VERIFY:142:EVP_PKEY_verify EVP_F_EVP_PKEY_VERIFY_INIT:143:EVP_PKEY_verify_init EVP_F_EVP_PKEY_VERIFY_RECOVER:144:EVP_PKEY_verify_recover EVP_F_EVP_PKEY_VERIFY_RECOVER_INIT:145:EVP_PKEY_verify_recover_init +EVP_F_EVP_SET_DEFAULT_PROPERTIES:236:EVP_set_default_properties EVP_F_EVP_SIGNFINAL:107:EVP_SignFinal EVP_F_EVP_VERIFYFINAL:108:EVP_VerifyFinal EVP_F_GMAC_CTRL:215:gmac_ctrl @@ -1093,6 +1103,7 @@ PROP_F_PARSE_OCT:105:parse_oct PROP_F_PARSE_STRING:106:parse_string PROP_F_PARSE_UNQUOTED:107:parse_unquoted RAND_F_DRBG_BYTES:101:drbg_bytes +RAND_F_DRBG_CTR_INIT:125:drbg_ctr_init RAND_F_DRBG_GET_ENTROPY:105:drbg_get_entropy RAND_F_DRBG_SETUP:117:drbg_setup RAND_F_GET_ENTROPY:106:get_entropy @@ -2159,6 +2170,7 @@ CRYPTO_R_FIPS_MODE_NOT_SUPPORTED:101:fips mode not supported CRYPTO_R_ILLEGAL_HEX_DIGIT:102:illegal hex digit CRYPTO_R_ODD_NUMBER_OF_DIGITS:103:odd number of digits CRYPTO_R_PROVIDER_ALREADY_EXISTS:104:provider already exists +CRYPTO_R_PROVIDER_SECTION_ERROR:105:provider section error CT_R_BASE64_DECODE_ERROR:108:base64 decode error CT_R_INVALID_LOG_ID_LENGTH:100:invalid log id length CT_R_LOG_CONF_INVALID:109:log conf invalid @@ -2413,6 +2425,8 @@ EVP_R_UNSUPPORTED_SALT_TYPE:126:unsupported salt type EVP_R_UPDATE_ERROR:189:update error EVP_R_WRAP_MODE_NOT_ALLOWED:170:wrap mode not allowed EVP_R_WRONG_FINAL_BLOCK_LENGTH:109:wrong final block length +EVP_R_XTS_DATA_UNIT_IS_TOO_LARGE:191:xts data unit is too large +EVP_R_XTS_DUPLICATED_KEYS:192:xts duplicated keys KDF_R_INVALID_DIGEST:100:invalid digest KDF_R_INVALID_MAC_TYPE:116:invalid mac type KDF_R_MISSING_ITERATION_COUNT:109:missing iteration count @@ -2594,6 +2608,8 @@ RAND_R_ADDITIONAL_INPUT_TOO_LONG:102:additional input too long RAND_R_ALREADY_INSTANTIATED:103:already instantiated RAND_R_ARGUMENT_OUT_OF_RANGE:105:argument out of range RAND_R_CANNOT_OPEN_FILE:121:Cannot open file +RAND_R_DERIVATION_FUNCTION_MANDATORY_FOR_FIPS:137:\ + derivation function mandatory for fips RAND_R_DRBG_ALREADY_INITIALIZED:129:drbg already initialized RAND_R_DRBG_NOT_INITIALISED:104:drbg not initialised RAND_R_ENTROPY_INPUT_TOO_LONG:106:entropy input too long diff --git a/crypto/evp/digest.c b/crypto/evp/digest.c index 7b497255..527c5d66 100644 --- a/crypto/evp/digest.c +++ b/crypto/evp/digest.c @@ -83,6 +83,7 @@ void EVP_MD_CTX_free(EVP_MD_CTX *ctx) EVP_MD_meth_free(ctx->fetched_digest); ctx->fetched_digest = NULL; ctx->digest = NULL; + ctx->reqdigest = NULL; OPENSSL_free(ctx); return; @@ -106,6 +107,9 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl) EVP_MD_CTX_clear_flags(ctx, EVP_MD_CTX_FLAG_CLEANED); + if (type != NULL) + ctx->reqdigest = type; + /* TODO(3.0): Legacy work around code below. Remove this */ #ifndef OPENSSL_NO_ENGINE /* @@ -141,6 +145,7 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl) if (type->prov == NULL) { switch(type->type) { case NID_sha256: + case NID_md2: break; default: goto legacy; @@ -545,6 +550,11 @@ static void *evp_md_from_dispatch(int mdtype, const OSSL_DISPATCH *fns, break; md->size = OSSL_get_OP_digest_size(fns); break; + case OSSL_FUNC_DIGEST_BLOCK_SIZE: + if (md->dblock_size != NULL) + break; + md->dblock_size = OSSL_get_OP_digest_block_size(fns); + break; } } if ((fncnt != 0 && fncnt != 5) @@ -576,10 +586,17 @@ static void evp_md_free(void *md) EVP_MD_meth_free(md); } +static int evp_md_nid(void *vmd) +{ + EVP_MD *md = vmd; + + return md->type; +} + EVP_MD *EVP_MD_fetch(OPENSSL_CTX *ctx, const char *algorithm, const char *properties) { return evp_generic_fetch(ctx, OSSL_OP_DIGEST, algorithm, properties, evp_md_from_dispatch, evp_md_upref, - evp_md_free); + evp_md_free, evp_md_nid); } diff --git a/crypto/evp/e_aes.c b/crypto/evp/e_aes.c index 5b473bca..4f98cdc3 100644 --- a/crypto/evp/e_aes.c +++ b/crypto/evp/e_aes.c @@ -1,5 +1,5 @@ /* - * Copyright 2001-2018 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2001-2019 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -390,22 +390,33 @@ static int aesni_xts_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, return 1; if (key) { + /* The key is two half length keys in reality */ + const int bytes = EVP_CIPHER_CTX_key_length(ctx) / 2; + const int bits = bytes * 8; + + /* + * Verify that the two keys are different. + * + * This addresses Rogaway's vulnerability. + * See comment in aes_xts_init_key() below. + */ + if (memcmp(key, key + bytes, bytes) == 0) { + EVPerr(EVP_F_AESNI_XTS_INIT_KEY, EVP_R_XTS_DUPLICATED_KEYS); + return 0; + } + /* key_len is two AES keys */ if (enc) { - aesni_set_encrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 4, - &xctx->ks1.ks); + aesni_set_encrypt_key(key, bits, &xctx->ks1.ks); xctx->xts.block1 = (block128_f) aesni_encrypt; xctx->stream = aesni_xts_encrypt; } else { - aesni_set_decrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 4, - &xctx->ks1.ks); + aesni_set_decrypt_key(key, bits, &xctx->ks1.ks); xctx->xts.block1 = (block128_f) aesni_decrypt; xctx->stream = aesni_xts_decrypt; } - aesni_set_encrypt_key(key + EVP_CIPHER_CTX_key_length(ctx) / 2, - EVP_CIPHER_CTX_key_length(ctx) * 4, - &xctx->ks2.ks); + aesni_set_encrypt_key(key + bytes, bits, &xctx->ks2.ks); xctx->xts.block2 = (block128_f) aesni_encrypt; xctx->xts.key1 = &xctx->ks1; @@ -796,7 +807,21 @@ static int aes_t4_xts_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, return 1; if (key) { - int bits = EVP_CIPHER_CTX_key_length(ctx) * 4; + /* The key is two half length keys in reality */ + const int bytes = EVP_CIPHER_CTX_key_length(ctx) / 2; + const int bits = bytes * 8; + + /* + * Verify that the two keys are different. + * + * This addresses Rogaway's vulnerability. + * See comment in aes_xts_init_key() below. + */ + if (memcmp(key, key + bytes, bytes) == 0) { + EVPerr(EVP_F_AES_T4_XTS_INIT_KEY, EVP_R_XTS_DUPLICATED_KEYS); + return 0; + } + xctx->stream = NULL; /* key_len is two AES keys */ if (enc) { @@ -813,8 +838,7 @@ static int aes_t4_xts_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, return 0; } } else { - aes_t4_set_decrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 4, - &xctx->ks1.ks); + aes_t4_set_decrypt_key(key, bits, &xctx->ks1.ks); xctx->xts.block1 = (block128_f) aes_t4_decrypt; switch (bits) { case 128: @@ -828,9 +852,7 @@ static int aes_t4_xts_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, } } - aes_t4_set_encrypt_key(key + EVP_CIPHER_CTX_key_length(ctx) / 2, - EVP_CIPHER_CTX_key_length(ctx) * 4, - &xctx->ks2.ks); + aes_t4_set_encrypt_key(key + bytes, bits, &xctx->ks2.ks); xctx->xts.block2 = (block128_f) aes_t4_encrypt; xctx->xts.key1 = &xctx->ks1; @@ -3414,8 +3436,33 @@ static int aes_xts_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, if (!iv && !key) return 1; - if (key) + if (key) { do { + /* The key is two half length keys in reality */ + const int bytes = EVP_CIPHER_CTX_key_length(ctx) / 2; + const int bits = bytes * 8; + + /* + * Verify that the two keys are different. + * + * This addresses the vulnerability described in Rogaway's + * September 2004 paper: + * + * "Efficient Instantiations of Tweakable Blockciphers and + * Refinements to Modes OCB and PMAC". + * (http://web.cs.ucdavis.edu/~rogaway/papers/offsets.pdf) + * + * FIPS 140-2 IG A.9 XTS-AES Key Generation Requirements states + * that: + * "The check for Key_1 != Key_2 shall be done at any place + * BEFORE using the keys in the XTS-AES algorithm to process + * data with them." + */ + if (memcmp(key, key + bytes, bytes) == 0) { + EVPerr(EVP_F_AES_XTS_INIT_KEY, EVP_R_XTS_DUPLICATED_KEYS); + return 0; + } + #ifdef AES_XTS_ASM xctx->stream = enc ? AES_xts_encrypt : AES_xts_decrypt; #else @@ -3425,26 +3472,20 @@ static int aes_xts_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, #ifdef HWAES_CAPABLE if (HWAES_CAPABLE) { if (enc) { - HWAES_set_encrypt_key(key, - EVP_CIPHER_CTX_key_length(ctx) * 4, - &xctx->ks1.ks); + HWAES_set_encrypt_key(key, bits, &xctx->ks1.ks); xctx->xts.block1 = (block128_f) HWAES_encrypt; # ifdef HWAES_xts_encrypt xctx->stream = HWAES_xts_encrypt; # endif } else { - HWAES_set_decrypt_key(key, - EVP_CIPHER_CTX_key_length(ctx) * 4, - &xctx->ks1.ks); + HWAES_set_decrypt_key(key, bits, &xctx->ks1.ks); xctx->xts.block1 = (block128_f) HWAES_decrypt; # ifdef HWAES_xts_decrypt xctx->stream = HWAES_xts_decrypt; #endif } - HWAES_set_encrypt_key(key + EVP_CIPHER_CTX_key_length(ctx) / 2, - EVP_CIPHER_CTX_key_length(ctx) * 4, - &xctx->ks2.ks); + HWAES_set_encrypt_key(key + bytes, bits, &xctx->ks2.ks); xctx->xts.block2 = (block128_f) HWAES_encrypt; xctx->xts.key1 = &xctx->ks1; @@ -3459,20 +3500,14 @@ static int aes_xts_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, #ifdef VPAES_CAPABLE if (VPAES_CAPABLE) { if (enc) { - vpaes_set_encrypt_key(key, - EVP_CIPHER_CTX_key_length(ctx) * 4, - &xctx->ks1.ks); + vpaes_set_encrypt_key(key, bits, &xctx->ks1.ks); xctx->xts.block1 = (block128_f) vpaes_encrypt; } else { - vpaes_set_decrypt_key(key, - EVP_CIPHER_CTX_key_length(ctx) * 4, - &xctx->ks1.ks); + vpaes_set_decrypt_key(key, bits, &xctx->ks1.ks); xctx->xts.block1 = (block128_f) vpaes_decrypt; } - vpaes_set_encrypt_key(key + EVP_CIPHER_CTX_key_length(ctx) / 2, - EVP_CIPHER_CTX_key_length(ctx) * 4, - &xctx->ks2.ks); + vpaes_set_encrypt_key(key + bytes, bits, &xctx->ks2.ks); xctx->xts.block2 = (block128_f) vpaes_encrypt; xctx->xts.key1 = &xctx->ks1; @@ -3482,22 +3517,19 @@ static int aes_xts_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, (void)0; /* terminate potentially open 'else' */ if (enc) { - AES_set_encrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 4, - &xctx->ks1.ks); + AES_set_encrypt_key(key, bits, &xctx->ks1.ks); xctx->xts.block1 = (block128_f) AES_encrypt; } else { - AES_set_decrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 4, - &xctx->ks1.ks); + AES_set_decrypt_key(key, bits, &xctx->ks1.ks); xctx->xts.block1 = (block128_f) AES_decrypt; } - AES_set_encrypt_key(key + EVP_CIPHER_CTX_key_length(ctx) / 2, - EVP_CIPHER_CTX_key_length(ctx) * 4, - &xctx->ks2.ks); + AES_set_encrypt_key(key + bytes, bits, &xctx->ks2.ks); xctx->xts.block2 = (block128_f) AES_encrypt; xctx->xts.key1 = &xctx->ks1; } while (0); + } if (iv) { xctx->xts.key2 = &xctx->ks2; @@ -3520,20 +3552,15 @@ static int aes_xts_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, return 0; /* - * Verify that the two keys are different. - * - * This addresses the vulnerability described in Rogaway's September 2004 - * paper (http://web.cs.ucdavis.edu/~rogaway/papers/offsets.pdf): - * "Efficient Instantiations of Tweakable Blockciphers and Refinements - * to Modes OCB and PMAC". - * - * FIPS 140-2 IG A.9 XTS-AES Key Generation Requirements states that: - * "The check for Key_1 != Key_2 shall be done at any place BEFORE - * using the keys in the XTS-AES algorithm to process data with them." - */ - if (CRYPTO_memcmp(xctx->xts.key1, xctx->xts.key2, - EVP_CIPHER_CTX_key_length(ctx) / 2) == 0) + * Impose a limit of 2^20 blocks per data unit as specifed by + * IEEE Std 1619-2018. The earlier and obsolete IEEE Std 1619-2007 + * indicated that this was a SHOULD NOT rather than a MUST NOT. + * NIST SP 800-38E mandates the same limit. + */ + if (len > XTS_MAX_BLOCKS_PER_DATA_UNIT * AES_BLOCK_SIZE) { + EVPerr(EVP_F_AES_XTS_CIPHER, EVP_R_XTS_DATA_UNIT_IS_TOO_LARGE); return 0; + } if (xctx->stream) (*xctx->stream) (in, out, len, diff --git a/crypto/evp/e_chacha20_poly1305.c b/crypto/evp/e_chacha20_poly1305.c index 56832b63..6c907832 100644 --- a/crypto/evp/e_chacha20_poly1305.c +++ b/crypto/evp/e_chacha20_poly1305.c @@ -671,7 +671,7 @@ static EVP_CIPHER chacha20_poly1305_draft = { NID_chacha20_poly1305_draft, 1, /* block_size */ CHACHA_KEY_SIZE, /* key_len */ - 0, /* iv_len, none */ + 0, /* iv_len, none */ EVP_CIPH_FLAG_AEAD_CIPHER | EVP_CIPH_CUSTOM_IV | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT | EVP_CIPH_CUSTOM_COPY | EVP_CIPH_FLAG_CUSTOM_CIPHER, diff --git a/crypto/evp/evp_cnf.c b/crypto/evp/evp_cnf.c index f75ea675..7cfa0a27 100644 --- a/crypto/evp/evp_cnf.c +++ b/crypto/evp/evp_cnf.c @@ -13,9 +13,11 @@ #include #include #include +#include /* Algorithm configuration module. */ +/* TODO(3.0): the config module functions should be passed a library context */ static int alg_module_init(CONF_IMODULE *md, const CONF *cnf) { int i; @@ -23,6 +25,9 @@ static int alg_module_init(CONF_IMODULE *md, const CONF *cnf) STACK_OF(CONF_VALUE) *sktmp; CONF_VALUE *oval; + OSSL_TRACE2(CONF, "Loading EVP module: name %s, value %s\n", + CONF_imodule_get_name(md), CONF_imodule_get_value(md)); + oid_section = CONF_imodule_get_value(md); if ((sktmp = NCONF_get_section(cnf, oid_section)) == NULL) { EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_ERROR_LOADING_SECTION); @@ -32,18 +37,26 @@ static int alg_module_init(CONF_IMODULE *md, const CONF *cnf) oval = sk_CONF_VALUE_value(sktmp, i); if (strcmp(oval->name, "fips_mode") == 0) { int m; + if (!X509V3_get_value_bool(oval, &m)) { EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_INVALID_FIPS_MODE); return 0; } - if (m > 0) { - EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_FIPS_MODE_NOT_SUPPORTED); - return 0; - } + /* + * fips_mode is deprecated and should not be used in new + * configurations. Old configurations are likely to ONLY + * have this, so we assume that no default properties have + * been set before this. + */ + if (m > 0) + EVP_set_default_properties(NULL, "fips=yes"); + } else if (strcmp(oval->name, "default_properties") == 0) { + EVP_set_default_properties(NULL, oval->value); } else { EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_UNKNOWN_OPTION); ERR_add_error_data(4, "name=", oval->name, ", value=", oval->value); + return 0; } } @@ -52,5 +65,6 @@ static int alg_module_init(CONF_IMODULE *md, const CONF *cnf) void EVP_add_alg_module(void) { + OSSL_TRACE(CONF, "Adding config module 'alg_section'\n"); CONF_module_add("alg_section", alg_module_init, 0); } diff --git a/crypto/evp/evp_enc.c b/crypto/evp/evp_enc.c index 7fdf7598..641ad197 100644 --- a/crypto/evp/evp_enc.c +++ b/crypto/evp/evp_enc.c @@ -305,6 +305,11 @@ static int evp_EncryptDecryptUpdate(EVP_CIPHER_CTX *ctx, bl = ctx->cipher->block_size; + if (inl <= 0) { + *outl = 0; + return inl == 0; + } + if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) { /* If block size > 1 then the cipher will have to do this check */ if (bl == 1 && is_partially_overlapping(out, in, cmpl)) { @@ -320,10 +325,6 @@ static int evp_EncryptDecryptUpdate(EVP_CIPHER_CTX *ctx, return 1; } - if (inl <= 0) { - *outl = 0; - return inl == 0; - } if (is_partially_overlapping(out + ctx->buf_len, in, cmpl)) { EVPerr(EVP_F_EVP_ENCRYPTDECRYPTUPDATE, EVP_R_PARTIALLY_OVERLAPPING); return 0; @@ -457,6 +458,11 @@ int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl, if (EVP_CIPHER_CTX_test_flags(ctx, EVP_CIPH_FLAG_LENGTH_BITS)) cmpl = (cmpl + 7) / 8; + if (inl <= 0) { + *outl = 0; + return inl == 0; + } + if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) { if (b == 1 && is_partially_overlapping(out, in, cmpl)) { EVPerr(EVP_F_EVP_DECRYPTUPDATE, EVP_R_PARTIALLY_OVERLAPPING); @@ -472,11 +478,6 @@ int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl, return 1; } - if (inl <= 0) { - *outl = 0; - return inl == 0; - } - if (ctx->flags & EVP_CIPH_NO_PADDING) return evp_EncryptDecryptUpdate(ctx, out, outl, in, inl); diff --git a/crypto/evp/evp_err.c b/crypto/evp/evp_err.c index 068120ef..a9f8800b 100644 --- a/crypto/evp/evp_err.c +++ b/crypto/evp/evp_err.c @@ -15,12 +15,17 @@ static const ERR_STRING_DATA EVP_str_functs[] = { {ERR_PACK(ERR_LIB_EVP, EVP_F_AESNI_INIT_KEY, 0), "aesni_init_key"}, + {ERR_PACK(ERR_LIB_EVP, EVP_F_AESNI_XTS_INIT_KEY, 0), "aesni_xts_init_key"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_AES_GCM_CTRL, 0), "aes_gcm_ctrl"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_AES_GCM_TLS_CIPHER, 0), "aes_gcm_tls_cipher"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_AES_INIT_KEY, 0), "aes_init_key"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_AES_OCB_CIPHER, 0), "aes_ocb_cipher"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_AES_T4_INIT_KEY, 0), "aes_t4_init_key"}, + {ERR_PACK(ERR_LIB_EVP, EVP_F_AES_T4_XTS_INIT_KEY, 0), + "aes_t4_xts_init_key"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_AES_WRAP_CIPHER, 0), "aes_wrap_cipher"}, + {ERR_PACK(ERR_LIB_EVP, EVP_F_AES_XTS_CIPHER, 0), "aes_xts_cipher"}, + {ERR_PACK(ERR_LIB_EVP, EVP_F_AES_XTS_INIT_KEY, 0), "aes_xts_init_key"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_ALG_MODULE_INIT, 0), "alg_module_init"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_ARIA_CCM_INIT_KEY, 0), "aria_ccm_init_key"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_ARIA_GCM_CTRL, 0), "aria_gcm_ctrl"}, @@ -70,6 +75,7 @@ static const ERR_STRING_DATA EVP_str_functs[] = { {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_MAC_CTX_COPY, 0), "EVP_MAC_CTX_copy"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_MAC_CTX_NEW, 0), "EVP_MAC_CTX_new"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_MAC_INIT, 0), "EVP_MAC_init"}, + {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_MD_BLOCK_SIZE, 0), "EVP_MD_block_size"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_MD_CTX_COPY_EX, 0), "EVP_MD_CTX_copy_ex"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_MD_SIZE, 0), "EVP_MD_size"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_OPENINIT, 0), "EVP_OpenInit"}, @@ -150,6 +156,8 @@ static const ERR_STRING_DATA EVP_str_functs[] = { "EVP_PKEY_verify_recover"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_PKEY_VERIFY_RECOVER_INIT, 0), "EVP_PKEY_verify_recover_init"}, + {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_SET_DEFAULT_PROPERTIES, 0), + "EVP_set_default_properties"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_SIGNFINAL, 0), "EVP_SignFinal"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_VERIFYFINAL, 0), "EVP_VerifyFinal"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_GMAC_CTRL, 0), "gmac_ctrl"}, @@ -303,6 +311,10 @@ static const ERR_STRING_DATA EVP_str_reasons[] = { "wrap mode not allowed"}, {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_WRONG_FINAL_BLOCK_LENGTH), "wrong final block length"}, + {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_XTS_DATA_UNIT_IS_TOO_LARGE), + "xts data unit is too large"}, + {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_XTS_DUPLICATED_KEYS), + "xts duplicated keys"}, {0, NULL} }; diff --git a/crypto/evp/evp_fetch.c b/crypto/evp/evp_fetch.c index e50dd592..012383f0 100644 --- a/crypto/evp/evp_fetch.c +++ b/crypto/evp/evp_fetch.c @@ -62,6 +62,7 @@ struct method_data_st { OSSL_PROVIDER *); int (*refcnt_up_method)(void *method); void (*destruct_method)(void *method); + int (*nid_method)(void *method); }; /* @@ -78,8 +79,7 @@ static void *alloc_tmp_method_store(void) ossl_method_store_free(store); } -static -struct OSSL_METHOD_STORE *get_default_method_store(OPENSSL_CTX *libctx) +static OSSL_METHOD_STORE *get_default_method_store(OPENSSL_CTX *libctx) { if (!RUN_ONCE(&default_method_store_init_flag, do_default_method_store_init)) @@ -107,29 +107,35 @@ static void *get_method_from_store(OPENSSL_CTX *libctx, void *store, } static int put_method_in_store(OPENSSL_CTX *libctx, void *store, - const char *propdef, void *method, - void *data) + const char *propdef, + void *method, void *data) { struct method_data_st *methdata = data; + int nid = methdata->nid_method(method); + + if (nid == NID_undef) + return 0; if (store == NULL && (store = get_default_method_store(libctx)) == NULL) return 0; if (methdata->refcnt_up_method(method) - && ossl_method_store_add(store, methdata->nid, propdef, method, + && ossl_method_store_add(store, nid, propdef, method, methdata->destruct_method)) return 1; return 0; } -static void *construct_method(const OSSL_DISPATCH *fns, OSSL_PROVIDER *prov, +static void *construct_method(const char *algorithm_name, + const OSSL_DISPATCH *fns, OSSL_PROVIDER *prov, void *data) { struct method_data_st *methdata = data; void *method = NULL; + int nid = OBJ_sn2nid(algorithm_name); - if (methdata->nid == NID_undef) { + if (nid == NID_undef) { /* Create a new NID for that name on the fly */ ASN1_OBJECT tmpobj; @@ -140,13 +146,13 @@ static void *construct_method(const OSSL_DISPATCH *fns, OSSL_PROVIDER *prov, tmpobj.length = 0; tmpobj.data = NULL; - methdata->nid = OBJ_add_object(&tmpobj); + nid = OBJ_add_object(&tmpobj); } - if (methdata->nid == NID_undef) + if (nid == NID_undef) return NULL; - method = methdata->method_from_dispatch(methdata->nid, fns, prov); + method = methdata->method_from_dispatch(nid, fns, prov); if (method == NULL) return NULL; return method; @@ -164,7 +170,8 @@ void *evp_generic_fetch(OPENSSL_CTX *libctx, int operation_id, void *(*new_method)(int nid, const OSSL_DISPATCH *fns, OSSL_PROVIDER *prov), int (*upref_method)(void *), - void (*free_method)(void *)) + void (*free_method)(void *), + int (*nid_method)(void *)) { int nid = OBJ_sn2nid(algorithm); void *method = NULL; @@ -187,6 +194,7 @@ void *evp_generic_fetch(OPENSSL_CTX *libctx, int operation_id, mcmdata.destruct_method = free_method; mcmdata.refcnt_up_method = upref_method; mcmdata.destruct_method = free_method; + mcmdata.nid_method = nid_method; method = ossl_method_construct(libctx, operation_id, algorithm, properties, 0 /* !force_cache */, &mcm, &mcmdata); @@ -195,3 +203,13 @@ void *evp_generic_fetch(OPENSSL_CTX *libctx, int operation_id, return method; } + +int EVP_set_default_properties(OPENSSL_CTX *libctx, const char *propq) +{ + OSSL_METHOD_STORE *store = get_default_method_store(libctx); + + if (store != NULL) + return ossl_method_store_set_global_properties(store, propq); + EVPerr(EVP_F_EVP_SET_DEFAULT_PROPERTIES, ERR_R_INTERNAL_ERROR); + return 0; +} diff --git a/crypto/evp/evp_lib.c b/crypto/evp/evp_lib.c index 219ae532..914a19cc 100644 --- a/crypto/evp/evp_lib.c +++ b/crypto/evp/evp_lib.c @@ -298,6 +298,14 @@ int EVP_CIPHER_CTX_nid(const EVP_CIPHER_CTX *ctx) int EVP_MD_block_size(const EVP_MD *md) { + if (md == NULL) { + EVPerr(EVP_F_EVP_MD_BLOCK_SIZE, EVP_R_MESSAGE_DIGEST_IS_NULL); + return -1; + } + + if (md->prov != NULL && md->dblock_size != NULL) + return (int)md->dblock_size(); + return md->block_size; } @@ -479,9 +487,9 @@ int (*EVP_MD_meth_get_ctrl(const EVP_MD *md))(EVP_MD_CTX *ctx, int cmd, const EVP_MD *EVP_MD_CTX_md(const EVP_MD_CTX *ctx) { - if (!ctx) + if (ctx == NULL) return NULL; - return ctx->digest; + return ctx->reqdigest; } EVP_PKEY_CTX *EVP_MD_CTX_pkey_ctx(const EVP_MD_CTX *ctx) diff --git a/crypto/evp/evp_locl.h b/crypto/evp/evp_locl.h index 936824a8..efa2db8f 100644 --- a/crypto/evp/evp_locl.h +++ b/crypto/evp/evp_locl.h @@ -10,6 +10,7 @@ /* EVP_MD_CTX related stuff */ struct evp_md_ctx_st { + const EVP_MD *reqdigest; /* The original requested digest */ const EVP_MD *digest; ENGINE *engine; /* functional reference if 'digest' is * ENGINE-provided */ @@ -89,4 +90,5 @@ void *evp_generic_fetch(OPENSSL_CTX *ctx, int operation_id, void *(*new_method)(int nid, const OSSL_DISPATCH *fns, OSSL_PROVIDER *prov), int (*upref_method)(void *), - void (*free_method)(void *)); + void (*free_method)(void *), + int (*nid_method)(void *)); diff --git a/crypto/evp/p_open.c b/crypto/evp/p_open.c index c9cd9b16..a141eb4d 100644 --- a/crypto/evp/p_open.c +++ b/crypto/evp/p_open.c @@ -40,7 +40,7 @@ int EVP_OpenInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type, } size = EVP_PKEY_size(priv); - key = OPENSSL_malloc(size + 2); + key = OPENSSL_malloc(size); if (key == NULL) { /* ERROR */ EVPerr(EVP_F_EVP_OPENINIT, ERR_R_MALLOC_FAILURE); diff --git a/crypto/ex_data.c b/crypto/ex_data.c index a728bfbb..5f83191b 100644 --- a/crypto/ex_data.c +++ b/crypto/ex_data.c @@ -235,7 +235,7 @@ int CRYPTO_new_ex_data(int class_index, void *obj, CRYPTO_EX_DATA *ad) return 0; } for (i = 0; i < mx; i++) { - if (storage[i] && storage[i]->new_func) { + if (storage[i] != NULL && storage[i]->new_func != NULL) { ptr = CRYPTO_get_ex_data(ad, i); storage[i]->new_func(obj, ptr, ad, i, storage[i]->argl, storage[i]->argp); @@ -299,7 +299,7 @@ int CRYPTO_dup_ex_data(int class_index, CRYPTO_EX_DATA *to, for (i = 0; i < mx; i++) { ptr = CRYPTO_get_ex_data(from, i); - if (storage[i] && storage[i]->dup_func) + if (storage[i] != NULL && storage[i]->dup_func != NULL) if (!storage[i]->dup_func(to, from, &ptr, i, storage[i]->argl, storage[i]->argp)) goto err; @@ -380,6 +380,8 @@ int CRYPTO_alloc_ex_data(int class_index, void *obj, CRYPTO_EX_DATA *ad, return 1; ip = get_and_lock(class_index); + if (ip == NULL) + return 0; f = sk_EX_CALLBACK_value(ip->meth, idx); CRYPTO_THREAD_unlock(ex_data_lock); @@ -387,6 +389,9 @@ int CRYPTO_alloc_ex_data(int class_index, void *obj, CRYPTO_EX_DATA *ad, * This should end up calling CRYPTO_set_ex_data(), which allocates * everything necessary to support placing the new data in the right spot. */ + if (f->new_func == NULL) + return 0; + f->new_func(obj, curval, ad, idx, f->argl, f->argp); return 1; diff --git a/crypto/include/internal/dso_conf.h.in b/crypto/include/internal/dso_conf.h.in index 6e6b9bc2..b6703f7c 100644 --- a/crypto/include/internal/dso_conf.h.in +++ b/crypto/include/internal/dso_conf.h.in @@ -10,7 +10,6 @@ #ifndef HEADER_DSO_CONF_H # define HEADER_DSO_CONF_H -{- output_off() if $disabled{dso} -} {- # The DSO code currently always implements all functions so that no # applications will have to worry about that from a compilation point # of view. However, the "method"s may return zero unless that platform @@ -18,6 +17,9 @@ # by a define "DSO_" ... we translate the "dso_scheme" config # string entry into using the following logic; my $scheme = uc $target{dso_scheme}; + if (!$scheme) { + $scheme = "NONE"; + } my @macros = ( "DSO_$scheme" ); if ($scheme eq 'DLFCN') { @macros = ( "DSO_DLFCN", "HAVE_DLFCN_H" ); @@ -26,5 +28,4 @@ } join("\n", map { "# define $_" } @macros); -} # define DSO_EXTENSION "{- platform->dsoext() -}" -{- output_on() if $disabled{dso} -} #endif diff --git a/crypto/include/internal/evp_int.h b/crypto/include/internal/evp_int.h index ab8ce00e..c9328981 100644 --- a/crypto/include/internal/evp_int.h +++ b/crypto/include/internal/evp_int.h @@ -204,6 +204,7 @@ struct evp_md_st { OSSL_OP_digest_freectx_fn *freectx; OSSL_OP_digest_dupctx_fn *dupctx; OSSL_OP_digest_size_fn *size; + OSSL_OP_digest_block_size_fn *dblock_size; } /* EVP_MD */ ; diff --git a/crypto/include/internal/x509_int.h b/crypto/include/internal/x509_int.h index 93f923e0..7c40b159 100644 --- a/crypto/include/internal/x509_int.h +++ b/crypto/include/internal/x509_int.h @@ -184,7 +184,7 @@ struct x509_st { CRYPTO_RWLOCK *lock; volatile int ex_cached; # ifndef OPENSSL_NO_SM2 - ASN1_OCTET_STRING sm2_id; + ASN1_OCTET_STRING *sm2_id; # endif } /* X509 */ ; diff --git a/crypto/init.c b/crypto/init.c index dfc5c5f8..43fe1a6e 100644 --- a/crypto/init.c +++ b/crypto/init.c @@ -160,8 +160,7 @@ DEFINE_RUN_ONCE_STATIC(ossl_init_load_crypto_nodelete) { OSSL_TRACE(INIT, "ossl_init_load_crypto_nodelete()\n"); -#if !defined(OPENSSL_NO_DSO) \ - && !defined(OPENSSL_USE_NODELETE) \ +#if !defined(OPENSSL_USE_NODELETE) \ && !defined(OPENSSL_NO_PINSHARED) # if defined(DSO_WIN32) && !defined(_WIN32_WCE) { @@ -179,7 +178,7 @@ DEFINE_RUN_ONCE_STATIC(ossl_init_load_crypto_nodelete) (ret == TRUE ? "No!" : "Yes.")); return (ret == TRUE) ? 1 : 0; } -# else +# elif !defined(DSO_NONE) /* * Deliberately leak a reference to ourselves. This will force the library * to remain loaded until the atexit() handler is run at process exit. @@ -671,7 +670,7 @@ int OPENSSL_init_crypto(uint64_t opts, const OPENSSL_INIT_SETTINGS *settings) ret = RUN_ONCE(&config, ossl_init_config); conf_settings = NULL; CRYPTO_THREAD_unlock(init_lock); - if (!ret) + if (ret <= 0) return 0; } @@ -733,8 +732,7 @@ int OPENSSL_atexit(void (*handler)(void)) { OPENSSL_INIT_STOP *newhand; -#if !defined(OPENSSL_NO_DSO) \ - && !defined(OPENSSL_USE_NODELETE)\ +#if !defined(OPENSSL_USE_NODELETE)\ && !defined(OPENSSL_NO_PINSHARED) { union { @@ -759,7 +757,7 @@ int OPENSSL_atexit(void (*handler)(void)) if (!ret) return 0; } -# else +# elif !defined(DSO_NONE) /* * Deliberately leak a reference to the handler. This will force the * library/code containing the handler to remain loaded until we run the diff --git a/crypto/kdf/hkdf.c b/crypto/kdf/hkdf.c index bfccf167..c8b3f03a 100644 --- a/crypto/kdf/hkdf.c +++ b/crypto/kdf/hkdf.c @@ -182,6 +182,8 @@ static int kdf_hkdf_ctrl_str(EVP_KDF_IMPL *impl, const char *type, static size_t kdf_hkdf_size(EVP_KDF_IMPL *impl) { + int sz; + if (impl->mode != EVP_KDF_HKDF_MODE_EXTRACT_ONLY) return SIZE_MAX; @@ -189,7 +191,11 @@ static size_t kdf_hkdf_size(EVP_KDF_IMPL *impl) KDFerr(KDF_F_KDF_HKDF_SIZE, KDF_R_MISSING_MESSAGE_DIGEST); return 0; } - return EVP_MD_size(impl->md); + sz = EVP_MD_size(impl->md); + if (sz < 0) + return 0; + + return sz; } static int kdf_hkdf_derive(EVP_KDF_IMPL *impl, unsigned char *key, @@ -241,8 +247,13 @@ static int HKDF(const EVP_MD *evp_md, unsigned char *okm, size_t okm_len) { unsigned char prk[EVP_MAX_MD_SIZE]; - int ret; - size_t prk_len = EVP_MD_size(evp_md); + int ret, sz; + size_t prk_len; + + sz = EVP_MD_size(evp_md); + if (sz < 0) + return 0; + prk_len = (size_t)sz; if (!HKDF_Extract(evp_md, salt, salt_len, key, key_len, prk, prk_len)) return 0; @@ -258,7 +269,11 @@ static int HKDF_Extract(const EVP_MD *evp_md, const unsigned char *key, size_t key_len, unsigned char *prk, size_t prk_len) { - if (prk_len != (size_t)EVP_MD_size(evp_md)) { + int sz = EVP_MD_size(evp_md); + + if (sz < 0) + return 0; + if (prk_len != (size_t)sz) { KDFerr(KDF_F_HKDF_EXTRACT, KDF_R_WRONG_OUTPUT_BUFFER_SIZE); return 0; } @@ -271,11 +286,16 @@ static int HKDF_Expand(const EVP_MD *evp_md, unsigned char *okm, size_t okm_len) { HMAC_CTX *hmac; - int ret = 0; + int ret = 0, sz; unsigned int i; unsigned char prev[EVP_MAX_MD_SIZE]; - size_t done_len = 0, dig_len = EVP_MD_size(evp_md); - size_t n = okm_len / dig_len; + size_t done_len = 0, dig_len, n; + + sz = EVP_MD_size(evp_md); + if (sz <= 0) + return 0; + dig_len = (size_t)sz; + n = okm_len / dig_len; if (okm_len % dig_len) n++; diff --git a/crypto/mem.c b/crypto/mem.c index 5feece36..562d6b51 100644 --- a/crypto/mem.c +++ b/crypto/mem.c @@ -14,7 +14,7 @@ #include #include #include -#ifndef OPENSSL_NO_CRYPTO_MDEBUG_BACKTRACE +#if !defined(OPENSSL_NO_CRYPTO_MDEBUG_BACKTRACE) && !defined(FIPS_MODE) # include #endif @@ -30,7 +30,7 @@ static void *(*realloc_impl)(void *, size_t, const char *, int) static void (*free_impl)(void *, const char *, int) = CRYPTO_free; -#ifndef OPENSSL_NO_CRYPTO_MDEBUG +#if !defined(OPENSSL_NO_CRYPTO_MDEBUG) && !defined(FIPS_MODE) # include "internal/tsan_assist.h" static TSAN_QUALIFIER int malloc_count; @@ -94,7 +94,7 @@ void CRYPTO_get_mem_functions( *f = free_impl; } -#ifndef OPENSSL_NO_CRYPTO_MDEBUG +#if !defined(OPENSSL_NO_CRYPTO_MDEBUG) && !defined(FIPS_MODE) void CRYPTO_get_alloc_counts(int *mcount, int *rcount, int *fcount) { if (mcount != NULL) @@ -209,7 +209,7 @@ void *CRYPTO_malloc(size_t num, const char *file, int line) */ allow_customize = 0; } -#ifndef OPENSSL_NO_CRYPTO_MDEBUG +#if !defined(OPENSSL_NO_CRYPTO_MDEBUG) && !defined(FIPS_MODE) if (call_malloc_debug) { CRYPTO_mem_debug_malloc(NULL, num, 0, file, line); ret = malloc(num); @@ -250,7 +250,7 @@ void *CRYPTO_realloc(void *str, size_t num, const char *file, int line) return NULL; } -#ifndef OPENSSL_NO_CRYPTO_MDEBUG +#if !defined(OPENSSL_NO_CRYPTO_MDEBUG) && !defined(FIPS_MODE) if (call_malloc_debug) { void *ret; CRYPTO_mem_debug_realloc(str, NULL, num, 0, file, line); @@ -300,7 +300,7 @@ void CRYPTO_free(void *str, const char *file, int line) return; } -#ifndef OPENSSL_NO_CRYPTO_MDEBUG +#if !defined(OPENSSL_NO_CRYPTO_MDEBUG) && !defined(FIPS_MODE) if (call_malloc_debug) { CRYPTO_mem_debug_free(str, 0, file, line); free(str); diff --git a/crypto/modes/modes_lcl.h b/crypto/modes/modes_lcl.h index 0517808f..aed79ffb 100644 --- a/crypto/modes/modes_lcl.h +++ b/crypto/modes/modes_lcl.h @@ -133,6 +133,12 @@ struct gcm128_context { #endif }; +/* + * The maximum permitted number of cipher blocks per data unit in XTS mode. + * Reference IEEE Std 1619-2018. + */ +#define XTS_MAX_BLOCKS_PER_DATA_UNIT (1<<20) + struct xts128_context { void *key1, *key2; block128_f block1, block2; diff --git a/crypto/params.c b/crypto/params.c index 367b2abd..bdb1fa92 100644 --- a/crypto/params.c +++ b/crypto/params.c @@ -348,6 +348,13 @@ OSSL_PARAM OSSL_PARAM_construct_size_t(const char *key, size_t *buf, return ossl_param_construct(key, OSSL_PARAM_UNSIGNED_INTEGER, buf, sizeof(size_t), rsize); } +#ifndef FIPS_MODE +/* + * TODO(3.0): Make this available in FIPS mode. + * + * Temporarily we don't include these functions in FIPS mode to avoid pulling + * in the entire BN sub-library into the module at this point. + */ int OSSL_PARAM_get_BN(const OSSL_PARAM *p, BIGNUM **val) { BIGNUM *b; @@ -375,6 +382,10 @@ int OSSL_PARAM_set_BN(const OSSL_PARAM *p, const BIGNUM *val) if (val == NULL || p->data_type != OSSL_PARAM_UNSIGNED_INTEGER) return 0; + /* For the moment, only positive values are permitted */ + if (BN_is_negative(val)) + return 0; + bytes = (size_t)BN_num_bytes(val); SET_RETURN_SIZE(p, bytes); return p->data_size >= bytes @@ -387,6 +398,7 @@ OSSL_PARAM OSSL_PARAM_construct_BN(const char *key, unsigned char *buf, return ossl_param_construct(key, OSSL_PARAM_UNSIGNED_INTEGER, buf, bsize, rsize); } +#endif int OSSL_PARAM_get_double(const OSSL_PARAM *p, double *val) { @@ -568,13 +580,20 @@ int OSSL_PARAM_set_octet_ptr(const OSSL_PARAM *p, const void *val, } OSSL_PARAM OSSL_PARAM_construct_utf8_ptr(const char *key, char **buf, - size_t *rsize) + size_t bsize, size_t *rsize) { - return ossl_param_construct(key, OSSL_PARAM_UTF8_PTR, buf, 0, rsize); + return ossl_param_construct(key, OSSL_PARAM_UTF8_PTR, buf, bsize, rsize); } OSSL_PARAM OSSL_PARAM_construct_octet_ptr(const char *key, void **buf, - size_t *rsize) + size_t bsize, size_t *rsize) { - return ossl_param_construct(key, OSSL_PARAM_OCTET_PTR, buf, 0, rsize); + return ossl_param_construct(key, OSSL_PARAM_OCTET_PTR, buf, bsize, rsize); +} + +OSSL_PARAM OSSL_PARAM_construct_end(void) +{ + OSSL_PARAM end = OSSL_PARAM_END; + + return end; } diff --git a/crypto/pem/pem_sign.c b/crypto/pem/pem_sign.c index d8f6d07a..4be03a47 100644 --- a/crypto/pem/pem_sign.c +++ b/crypto/pem/pem_sign.c @@ -31,7 +31,7 @@ int PEM_SignFinal(EVP_MD_CTX *ctx, unsigned char *sigret, int i, ret = 0; unsigned int m_len; - m = OPENSSL_malloc(EVP_PKEY_size(pkey) + 2); + m = OPENSSL_malloc(EVP_PKEY_size(pkey)); if (m == NULL) { PEMerr(PEM_F_PEM_SIGNFINAL, ERR_R_MALLOC_FAILURE); goto err; diff --git a/crypto/property/property_parse.c b/crypto/property/property_parse.c index 074da51c..faaaee8f 100644 --- a/crypto/property/property_parse.c +++ b/crypto/property/property_parse.c @@ -523,6 +523,7 @@ int ossl_property_parse_init(void) { static const char *const predefined_names[] = { "default", /* Being provided by the default built-in provider */ + "legacy", /* Provided by the legacy provider */ "provider", /* Name of provider (default, fips) */ "version", /* Version number of this provider */ "fips", /* FIPS supporting provider */ diff --git a/crypto/provider_conf.c b/crypto/provider_conf.c new file mode 100644 index 00000000..74162a88 --- /dev/null +++ b/crypto/provider_conf.c @@ -0,0 +1,184 @@ +/* + * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include +#include +#include +#include +#include +#include "internal/provider.h" + +/* PROVIDER config module */ + +DEFINE_STACK_OF(OSSL_PROVIDER) +static STACK_OF(OSSL_PROVIDER) *activated_providers = NULL; + +static const char *skip_dot(const char *name) +{ + const char *p = strchr(name, '.'); + + if (p != NULL) + return p + 1; + return name; +} + +static int provider_conf_params(OSSL_PROVIDER *prov, + const char *name, const char *value, + const CONF *cnf) +{ + STACK_OF(CONF_VALUE) *sect; + int ok = 1; + + sect = NCONF_get_section(cnf, value); + if (sect != NULL) { + int i; + char buffer[512]; + size_t buffer_len = 0; + + OSSL_TRACE1(CONF, "Provider params: start section %s\n", value); + + if (name != NULL) { + OPENSSL_strlcpy(buffer, name, sizeof(buffer)); + OPENSSL_strlcat(buffer, ".", sizeof(buffer)); + buffer_len = strlen(buffer); + } + + for (i = 0; i < sk_CONF_VALUE_num(sect); i++) { + CONF_VALUE *sectconf = sk_CONF_VALUE_value(sect, i); + + if (buffer_len + strlen(sectconf->name) >= sizeof(buffer)) + return 0; + buffer[buffer_len] = '\0'; + OPENSSL_strlcat(buffer, sectconf->name, sizeof(buffer)); + if (!provider_conf_params(prov, buffer, sectconf->value, cnf)) + return 0; + } + + OSSL_TRACE1(CONF, "Provider params: finish section %s\n", value); + } else { + OSSL_TRACE2(CONF, "Provider params: %s = %s\n", name, value); + ok = ossl_provider_add_parameter(prov, name, value); + } + + return ok; +} + +static int provider_conf_load(OPENSSL_CTX *libctx, const char *name, + const char *value, const CONF *cnf) +{ + int i; + STACK_OF(CONF_VALUE) *ecmds; + int soft = 0; + OSSL_PROVIDER *prov = NULL; + const char *path = NULL; + long activate = 0; + int ok = 0; + + name = skip_dot(name); + OSSL_TRACE1(CONF, "Configuring provider %s\n", name); + /* Value is a section containing PROVIDER commands */ + ecmds = NCONF_get_section(cnf, value); + + if (!ecmds) { + CRYPTOerr(CRYPTO_F_PROVIDER_CONF_LOAD, CRYPTO_R_PROVIDER_SECTION_ERROR); + return 0; + } + + /* Find the needed data first */ + for (i = 0; i < sk_CONF_VALUE_num(ecmds); i++) { + CONF_VALUE *ecmd = sk_CONF_VALUE_value(ecmds, i); + const char *confname = skip_dot(ecmd->name); + const char *confvalue = ecmd->value; + + OSSL_TRACE2(CONF, "Provider command: %s = %s\n", + confname, confvalue); + + /* First handle some special pseudo confs */ + + /* Override provider name to use */ + if (strcmp(confname, "identity") == 0) + name = confvalue; + else if (strcmp(confname, "soft_load") == 0) + soft = 1; + /* Load a dynamic PROVIDER */ + else if (strcmp(confname, "module") == 0) + path = confvalue; + else if (strcmp(confname, "activate") == 0) + activate = 1; + } + + prov = ossl_provider_new(libctx, name, NULL); + if (prov == NULL) { + if (soft) + ERR_clear_error(); + return 0; + } + + if (path != NULL) + ossl_provider_set_module_path(prov, path); + + ok = provider_conf_params(prov, NULL, value, cnf); + + if (ok && activate) { + if (!ossl_provider_activate(prov)) { + ok = 0; + } else { + if (activated_providers == NULL) + activated_providers = sk_OSSL_PROVIDER_new_null(); + sk_OSSL_PROVIDER_push(activated_providers, prov); + ok = 1; + } + } + + if (!(activate && ok)) + ossl_provider_free(prov); + + return ok; +} + +static int provider_conf_init(CONF_IMODULE *md, const CONF *cnf) +{ + STACK_OF(CONF_VALUE) *elist; + CONF_VALUE *cval; + int i; + + OSSL_TRACE1(CONF, "Loading providers module: section %s\n", + CONF_imodule_get_value(md)); + + /* Value is a section containing PROVIDERs to configure */ + elist = NCONF_get_section(cnf, CONF_imodule_get_value(md)); + + if (!elist) { + CRYPTOerr(CRYPTO_F_PROVIDER_CONF_INIT, + CRYPTO_R_PROVIDER_SECTION_ERROR); + return 0; + } + + for (i = 0; i < sk_CONF_VALUE_num(elist); i++) { + cval = sk_CONF_VALUE_value(elist, i); + if (!provider_conf_load(NULL, cval->name, cval->value, cnf)) + return 0; + } + + return 1; +} + + +static void provider_conf_deinit(CONF_IMODULE *md) +{ + sk_OSSL_PROVIDER_pop_free(activated_providers, ossl_provider_free); + activated_providers = NULL; + OSSL_TRACE(CONF, "Cleaned up providers\n"); +} + +void ossl_provider_add_conf_module(void) +{ + OSSL_TRACE(CONF, "Adding config module 'providers'\n"); + CONF_module_add("providers", provider_conf_init, provider_conf_deinit); +} diff --git a/crypto/provider_core.c b/crypto/provider_core.c index 7a184a7d..9f4c0170 100644 --- a/crypto/provider_core.c +++ b/crypto/provider_core.c @@ -9,6 +9,7 @@ #include #include +#include #include #include "internal/cryptlib.h" #include "internal/nelem.h" @@ -25,6 +26,12 @@ static OSSL_PROVIDER *provider_new(const char *name, * ========================= */ +typedef struct { + char *name; + char *value; +} INFOPAIR; +DEFINE_STACK_OF(INFOPAIR) + struct provider_store_st; /* Forward declaration */ struct ossl_provider_st { @@ -36,8 +43,10 @@ struct ossl_provider_st { CRYPTO_REF_COUNT refcnt; CRYPTO_RWLOCK *refcnt_lock; /* For the ref counter */ char *name; + char *path; DSO *module; OSSL_provider_init_fn *init_function; + STACK_OF(INFOPAIR) *parameters; struct provider_store_st *store; /* The store this instance belongs to */ /* Provider side functions */ @@ -243,6 +252,13 @@ OSSL_PROVIDER *ossl_provider_new(OPENSSL_CTX *libctx, const char *name, return prov; } +static void free_infopair(INFOPAIR *pair) +{ + OPENSSL_free(pair->name); + OPENSSL_free(pair->value); + OPENSSL_free(pair); +} + void ossl_provider_free(OSSL_PROVIDER *prov) { if (prov != NULL) { @@ -270,6 +286,8 @@ void ossl_provider_free(OSSL_PROVIDER *prov) if (ref == 0) { DSO_free(prov->module); OPENSSL_free(prov->name); + OPENSSL_free(prov->path); + sk_INFOPAIR_pop_free(prov->parameters, free_infopair); #ifndef HAVE_ATOMICS CRYPTO_THREAD_lock_free(prov->refcnt_lock); #endif @@ -278,6 +296,40 @@ void ossl_provider_free(OSSL_PROVIDER *prov) } } +/* Setters */ +int ossl_provider_set_module_path(OSSL_PROVIDER *prov, const char *module_path) +{ + OPENSSL_free(prov->path); + if (module_path == NULL) + return 1; + if ((prov->path = OPENSSL_strdup(module_path)) != NULL) + return 1; + CRYPTOerr(CRYPTO_F_OSSL_PROVIDER_SET_MODULE_PATH, ERR_R_MALLOC_FAILURE); + return 0; +} + +int ossl_provider_add_parameter(OSSL_PROVIDER *prov, + const char *name, const char *value) +{ + INFOPAIR *pair = NULL; + + if ((pair = OPENSSL_zalloc(sizeof(*pair))) != NULL + && (prov->parameters != NULL + || (prov->parameters = sk_INFOPAIR_new_null()) != NULL) + && (pair->name = OPENSSL_strdup(name)) != NULL + && (pair->value = OPENSSL_strdup(value)) != NULL + && sk_INFOPAIR_push(prov->parameters, pair) > 0) + return 1; + + if (pair != NULL) { + OPENSSL_free(pair->name); + OPENSSL_free(pair->value); + OPENSSL_free(pair); + } + CRYPTOerr(CRYPTO_F_OSSL_PROVIDER_ADD_PARAMETER, ERR_R_MALLOC_FAILURE); + return 0; +} + /* * Provider activation. * @@ -310,8 +362,9 @@ static int provider_activate(OSSL_PROVIDER *prov) */ if (prov->init_function == NULL) { if (prov->module == NULL) { - char *platform_module_name = NULL; - char *module_path = NULL; + char *allocated_path = NULL; + const char *module_path = NULL; + char *merged_path = NULL; const char *load_dir = ossl_safe_getenv("OPENSSL_MODULES"); if ((prov->module = DSO_new()) == NULL) { @@ -324,19 +377,22 @@ static int provider_activate(OSSL_PROVIDER *prov) DSO_ctrl(prov->module, DSO_CTRL_SET_FLAGS, DSO_FLAG_NAME_TRANSLATION_EXT_ONLY, NULL); - if ((platform_module_name = - DSO_convert_filename(prov->module, prov->name)) == NULL - || (module_path = - DSO_merge(prov->module, platform_module_name, - load_dir)) == NULL - || DSO_load(prov->module, module_path, NULL, - DSO_FLAG_NAME_TRANSLATION_EXT_ONLY) == NULL) { + + module_path = prov->path; + if (module_path == NULL) + module_path = allocated_path = + DSO_convert_filename(prov->module, prov->name); + if (module_path != NULL) + merged_path = DSO_merge(prov->module, module_path, load_dir); + + if (merged_path == NULL + || (DSO_load(prov->module, merged_path, NULL, 0)) == NULL) { DSO_free(prov->module); prov->module = NULL; } - OPENSSL_free(platform_module_name); - OPENSSL_free(module_path); + OPENSSL_free(merged_path); + OPENSSL_free(allocated_path); } if (prov->module != NULL) @@ -565,17 +621,21 @@ static const OSSL_ITEM *core_get_param_types(const OSSL_PROVIDER *prov) static int core_get_params(const OSSL_PROVIDER *prov, const OSSL_PARAM params[]) { int i; + const OSSL_PARAM *p; - for (i = 0; params[i].key != NULL; i++) { - if (strcmp(params[i].key, "openssl-version") == 0) { - *(void **)params[i].data = OPENSSL_VERSION_STR; - if (params[i].return_size) - *params[i].return_size = sizeof(OPENSSL_VERSION_STR); - } else if (strcmp(params[i].key, "provider-name") == 0) { - *(void **)params[i].data = prov->name; - if (params[i].return_size) - *params[i].return_size = strlen(prov->name) + 1; - } + if ((p = OSSL_PARAM_locate(params, "openssl-version")) != NULL) + OSSL_PARAM_set_utf8_ptr(p, OPENSSL_VERSION_STR); + if ((p = OSSL_PARAM_locate(params, "provider-name")) != NULL) + OSSL_PARAM_set_utf8_ptr(p, prov->name); + + if (prov->parameters == NULL) + return 1; + + for (i = 0; i < sk_INFOPAIR_num(prov->parameters); i++) { + INFOPAIR *pair = sk_INFOPAIR_value(prov->parameters, i); + + if ((p = OSSL_PARAM_locate(params, pair->name)) != NULL) + OSSL_PARAM_set_utf8_ptr(p, pair->value); } return 1; diff --git a/crypto/rand/drbg_ctr.c b/crypto/rand/drbg_ctr.c index 0f999254..4c11e657 100644 --- a/crypto/rand/drbg_ctr.c +++ b/crypto/rand/drbg_ctr.c @@ -422,6 +422,11 @@ int drbg_ctr_init(RAND_DRBG *drbg) drbg->max_perslen = DRBG_MAX_LENGTH; drbg->max_adinlen = DRBG_MAX_LENGTH; } else { +#ifdef FIPS_MODE + RANDerr(RAND_F_DRBG_CTR_INIT, + RAND_R_DERIVATION_FUNCTION_MANDATORY_FOR_FIPS); + return 0; +#else drbg->min_entropylen = drbg->seedlen; drbg->max_entropylen = drbg->seedlen; /* Nonce not used */ @@ -429,6 +434,7 @@ int drbg_ctr_init(RAND_DRBG *drbg) drbg->max_noncelen = 0; drbg->max_perslen = drbg->seedlen; drbg->max_adinlen = drbg->seedlen; +#endif } drbg->max_request = 1 << 16; diff --git a/crypto/rand/rand_err.c b/crypto/rand/rand_err.c index c8996139..5c0dc3d8 100644 --- a/crypto/rand/rand_err.c +++ b/crypto/rand/rand_err.c @@ -1,6 +1,6 @@ /* * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -15,6 +15,7 @@ static const ERR_STRING_DATA RAND_str_functs[] = { {ERR_PACK(ERR_LIB_RAND, RAND_F_DRBG_BYTES, 0), "drbg_bytes"}, + {ERR_PACK(ERR_LIB_RAND, RAND_F_DRBG_CTR_INIT, 0), "drbg_ctr_init"}, {ERR_PACK(ERR_LIB_RAND, RAND_F_DRBG_GET_ENTROPY, 0), "drbg_get_entropy"}, {ERR_PACK(ERR_LIB_RAND, RAND_F_DRBG_SETUP, 0), "drbg_setup"}, {ERR_PACK(ERR_LIB_RAND, RAND_F_GET_ENTROPY, 0), "get_entropy"}, @@ -60,6 +61,8 @@ static const ERR_STRING_DATA RAND_str_reasons[] = { {ERR_PACK(ERR_LIB_RAND, 0, RAND_R_ARGUMENT_OUT_OF_RANGE), "argument out of range"}, {ERR_PACK(ERR_LIB_RAND, 0, RAND_R_CANNOT_OPEN_FILE), "Cannot open file"}, + {ERR_PACK(ERR_LIB_RAND, 0, RAND_R_DERIVATION_FUNCTION_MANDATORY_FOR_FIPS), + "derivation function mandatory for fips"}, {ERR_PACK(ERR_LIB_RAND, 0, RAND_R_DRBG_ALREADY_INITIALIZED), "drbg already initialized"}, {ERR_PACK(ERR_LIB_RAND, 0, RAND_R_DRBG_NOT_INITIALISED), diff --git a/crypto/rand/rand_lib.c b/crypto/rand/rand_lib.c index a298b751..2b779605 100644 --- a/crypto/rand/rand_lib.c +++ b/crypto/rand/rand_lib.c @@ -183,17 +183,6 @@ size_t rand_drbg_get_entropy(RAND_DRBG *drbg, } } else { - if (prediction_resistance) { - /* - * We don't have any entropy sources that comply with the NIST - * standard to provide prediction resistance (see NIST SP 800-90C, - * Section 5.4). - */ - RANDerr(RAND_F_RAND_DRBG_GET_ENTROPY, - RAND_R_PREDICTION_RESISTANCE_NOT_SUPPORTED); - goto err; - } - /* Get entropy by polling system entropy sources. */ entropy_available = rand_pool_acquire_entropy(pool); } @@ -203,7 +192,6 @@ size_t rand_drbg_get_entropy(RAND_DRBG *drbg, *pout = rand_pool_detach(pool); } - err: if (drbg->seed_pool == NULL) rand_pool_free(pool); return ret; diff --git a/crypto/rand/rand_win.c b/crypto/rand/rand_win.c index 278aee08..17ab1371 100644 --- a/crypto/rand/rand_win.c +++ b/crypto/rand/rand_win.c @@ -18,8 +18,8 @@ # endif # include -/* On Windows 7 or higher use BCrypt instead of the legacy CryptoAPI */ -# if defined(_MSC_VER) && defined(_WIN32_WINNT) && _WIN32_WINNT >= 0x0601 +/* On Windows Vista or higher use BCrypt instead of the legacy CryptoAPI */ +# if defined(_MSC_VER) && defined(_WIN32_WINNT) && _WIN32_WINNT >= 0x0600 # define USE_BCRYPTGENRANDOM # endif diff --git a/crypto/rsa/rsa_ameth.c b/crypto/rsa/rsa_ameth.c index 139415e6..82d1d56d 100644 --- a/crypto/rsa/rsa_ameth.c +++ b/crypto/rsa/rsa_ameth.c @@ -583,10 +583,12 @@ static RSA_PSS_PARAMS *rsa_ctx_to_pss(EVP_PKEY_CTX *pkctx) return NULL; if (saltlen == -1) { saltlen = EVP_MD_size(sigmd); - } else if (saltlen == -2) { + } else if (saltlen == -2 || saltlen == -3) { saltlen = EVP_PKEY_size(pk) - EVP_MD_size(sigmd) - 2; if ((EVP_PKEY_bits(pk) & 0x7) == 1) saltlen--; + if (saltlen < 0) + return NULL; } return rsa_pss_params_create(sigmd, mgf1md, saltlen); diff --git a/crypto/s390xcap.c b/crypto/s390xcap.c index 9772bd59..717849e5 100644 --- a/crypto/s390xcap.c +++ b/crypto/s390xcap.c @@ -152,17 +152,17 @@ static int parse_env(struct OPENSSL_s390xcap_st *cap) * Facility detection would fail on real hw (no STFLE). */ static const struct OPENSSL_s390xcap_st z900 = { - .stfle = {0ULL, 0ULL, 0ULL, 0ULL}, - .kimd = {0ULL, 0ULL}, - .klmd = {0ULL, 0ULL}, - .km = {0ULL, 0ULL}, - .kmc = {0ULL, 0ULL}, - .kmac = {0ULL, 0ULL}, - .kmctr = {0ULL, 0ULL}, - .kmo = {0ULL, 0ULL}, - .kmf = {0ULL, 0ULL}, - .prno = {0ULL, 0ULL}, - .kma = {0ULL, 0ULL}, + /*.stfle = */{0ULL, 0ULL, 0ULL, 0ULL}, + /*.kimd = */{0ULL, 0ULL}, + /*.klmd = */{0ULL, 0ULL}, + /*.km = */{0ULL, 0ULL}, + /*.kmc = */{0ULL, 0ULL}, + /*.kmac = */{0ULL, 0ULL}, + /*.kmctr = */{0ULL, 0ULL}, + /*.kmo = */{0ULL, 0ULL}, + /*.kmf = */{0ULL, 0ULL}, + /*.prno = */{0ULL, 0ULL}, + /*.kma = */{0ULL, 0ULL}, }; /*- @@ -170,25 +170,25 @@ static int parse_env(struct OPENSSL_s390xcap_st *cap) * Implements MSA. Facility detection would fail on real hw (no STFLE). */ static const struct OPENSSL_s390xcap_st z990 = { - .stfle = {S390X_CAPBIT(S390X_MSA), - 0ULL, 0ULL, 0ULL}, - .kimd = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_SHA_1), - 0ULL}, - .klmd = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_SHA_1), - 0ULL}, - .km = {S390X_CAPBIT(S390X_QUERY), - 0ULL}, - .kmc = {S390X_CAPBIT(S390X_QUERY), - 0ULL}, - .kmac = {S390X_CAPBIT(S390X_QUERY), - 0ULL}, - .kmctr = {0ULL, 0ULL}, - .kmo = {0ULL, 0ULL}, - .kmf = {0ULL, 0ULL}, - .prno = {0ULL, 0ULL}, - .kma = {0ULL, 0ULL}, + /*.stfle = */{S390X_CAPBIT(S390X_MSA), + 0ULL, 0ULL, 0ULL}, + /*.kimd = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_SHA_1), + 0ULL}, + /*.klmd = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_SHA_1), + 0ULL}, + /*.km = */{S390X_CAPBIT(S390X_QUERY), + 0ULL}, + /*.kmc = */{S390X_CAPBIT(S390X_QUERY), + 0ULL}, + /*.kmac = */{S390X_CAPBIT(S390X_QUERY), + 0ULL}, + /*.kmctr = */{0ULL, 0ULL}, + /*.kmo = */{0ULL, 0ULL}, + /*.kmf = */{0ULL, 0ULL}, + /*.prno = */{0ULL, 0ULL}, + /*.kma = */{0ULL, 0ULL}, }; /*- @@ -196,30 +196,30 @@ static int parse_env(struct OPENSSL_s390xcap_st *cap) * Implements MSA and MSA1. */ static const struct OPENSSL_s390xcap_st z9 = { - .stfle = {S390X_CAPBIT(S390X_MSA) - | S390X_CAPBIT(S390X_STCKF), - 0ULL, 0ULL, 0ULL}, - .kimd = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_SHA_1) - | S390X_CAPBIT(S390X_SHA_256), - 0ULL}, - .klmd = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_SHA_1) - | S390X_CAPBIT(S390X_SHA_256), - 0ULL}, - .km = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128), - 0ULL}, - .kmc = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128), - 0ULL}, - .kmac = {S390X_CAPBIT(S390X_QUERY), - 0ULL}, - .kmctr = {0ULL, 0ULL}, - .kmo = {0ULL, 0ULL}, - .kmf = {0ULL, 0ULL}, - .prno = {0ULL, 0ULL}, - .kma = {0ULL, 0ULL}, + /*.stfle = */{S390X_CAPBIT(S390X_MSA) + | S390X_CAPBIT(S390X_STCKF), + 0ULL, 0ULL, 0ULL}, + /*.kimd = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_SHA_1) + | S390X_CAPBIT(S390X_SHA_256), + 0ULL}, + /*.klmd = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_SHA_1) + | S390X_CAPBIT(S390X_SHA_256), + 0ULL}, + /*.km = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128), + 0ULL}, + /*.kmc = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128), + 0ULL}, + /*.kmac = */{S390X_CAPBIT(S390X_QUERY), + 0ULL}, + /*.kmctr = */{0ULL, 0ULL}, + /*.kmo = */{0ULL, 0ULL}, + /*.kmf = */{0ULL, 0ULL}, + /*.prno = */{0ULL, 0ULL}, + /*.kma = */{0ULL, 0ULL}, }; /*- @@ -227,36 +227,36 @@ static int parse_env(struct OPENSSL_s390xcap_st *cap) * Implements MSA and MSA1-2. */ static const struct OPENSSL_s390xcap_st z10 = { - .stfle = {S390X_CAPBIT(S390X_MSA) - | S390X_CAPBIT(S390X_STCKF), - 0ULL, 0ULL, 0ULL}, - .kimd = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_SHA_1) - | S390X_CAPBIT(S390X_SHA_256) - | S390X_CAPBIT(S390X_SHA_512), - 0ULL}, - .klmd = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_SHA_1) - | S390X_CAPBIT(S390X_SHA_256) - | S390X_CAPBIT(S390X_SHA_512), - 0ULL}, - .km = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256), - 0ULL}, - .kmc = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256), - 0ULL}, - .kmac = {S390X_CAPBIT(S390X_QUERY), - 0ULL}, - .kmctr = {0ULL, 0ULL}, - .kmo = {0ULL, 0ULL}, - .kmf = {0ULL, 0ULL}, - .prno = {0ULL, 0ULL}, - .kma = {0ULL, 0ULL}, + /*.stfle = */{S390X_CAPBIT(S390X_MSA) + | S390X_CAPBIT(S390X_STCKF), + 0ULL, 0ULL, 0ULL}, + /*.kimd = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_SHA_1) + | S390X_CAPBIT(S390X_SHA_256) + | S390X_CAPBIT(S390X_SHA_512), + 0ULL}, + /*.klmd = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_SHA_1) + | S390X_CAPBIT(S390X_SHA_256) + | S390X_CAPBIT(S390X_SHA_512), + 0ULL}, + /*.km = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256), + 0ULL}, + /*.kmc = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256), + 0ULL}, + /*.kmac = */{S390X_CAPBIT(S390X_QUERY), + 0ULL}, + /*.kmctr = */{0ULL, 0ULL}, + /*.kmo = */{0ULL, 0ULL}, + /*.kmf = */{0ULL, 0ULL}, + /*.prno = */{0ULL, 0ULL}, + /*.kma = */{0ULL, 0ULL}, }; /*- @@ -264,55 +264,55 @@ static int parse_env(struct OPENSSL_s390xcap_st *cap) * Implements MSA and MSA1-4. */ static const struct OPENSSL_s390xcap_st z196 = { - .stfle = {S390X_CAPBIT(S390X_MSA) - | S390X_CAPBIT(S390X_STCKF), - S390X_CAPBIT(S390X_MSA3) - | S390X_CAPBIT(S390X_MSA4), - 0ULL, 0ULL}, - .kimd = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_SHA_1) - | S390X_CAPBIT(S390X_SHA_256) - | S390X_CAPBIT(S390X_SHA_512), - S390X_CAPBIT(S390X_GHASH)}, - .klmd = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_SHA_1) - | S390X_CAPBIT(S390X_SHA_256) - | S390X_CAPBIT(S390X_SHA_512), - 0ULL}, - .km = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256) - | S390X_CAPBIT(S390X_XTS_AES_128) - | S390X_CAPBIT(S390X_XTS_AES_256), - 0ULL}, - .kmc = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256), - 0ULL}, - .kmac = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256), - 0ULL}, - .kmctr = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256), - 0ULL}, - .kmo = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256), - 0ULL}, - .kmf = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256), - 0ULL}, - .prno = {0ULL, 0ULL}, - .kma = {0ULL, 0ULL}, + /*.stfle = */{S390X_CAPBIT(S390X_MSA) + | S390X_CAPBIT(S390X_STCKF), + S390X_CAPBIT(S390X_MSA3) + | S390X_CAPBIT(S390X_MSA4), + 0ULL, 0ULL}, + /*.kimd = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_SHA_1) + | S390X_CAPBIT(S390X_SHA_256) + | S390X_CAPBIT(S390X_SHA_512), + S390X_CAPBIT(S390X_GHASH)}, + /*.klmd = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_SHA_1) + | S390X_CAPBIT(S390X_SHA_256) + | S390X_CAPBIT(S390X_SHA_512), + 0ULL}, + /*.km = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256) + | S390X_CAPBIT(S390X_XTS_AES_128) + | S390X_CAPBIT(S390X_XTS_AES_256), + 0ULL}, + /*.kmc = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256), + 0ULL}, + /*.kmac = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256), + 0ULL}, + /*.kmctr = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256), + 0ULL}, + /*.kmo = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256), + 0ULL}, + /*.kmf = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256), + 0ULL}, + /*.prno = */{0ULL, 0ULL}, + /*.kma = */{0ULL, 0ULL}, }; /*- @@ -320,55 +320,55 @@ static int parse_env(struct OPENSSL_s390xcap_st *cap) * Implements MSA and MSA1-4. */ static const struct OPENSSL_s390xcap_st zEC12 = { - .stfle = {S390X_CAPBIT(S390X_MSA) - | S390X_CAPBIT(S390X_STCKF), - S390X_CAPBIT(S390X_MSA3) - | S390X_CAPBIT(S390X_MSA4), - 0ULL, 0ULL}, - .kimd = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_SHA_1) - | S390X_CAPBIT(S390X_SHA_256) - | S390X_CAPBIT(S390X_SHA_512), + /*.stfle = */{S390X_CAPBIT(S390X_MSA) + | S390X_CAPBIT(S390X_STCKF), + S390X_CAPBIT(S390X_MSA3) + | S390X_CAPBIT(S390X_MSA4), + 0ULL, 0ULL}, + /*.kimd = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_SHA_1) + | S390X_CAPBIT(S390X_SHA_256) + | S390X_CAPBIT(S390X_SHA_512), S390X_CAPBIT(S390X_GHASH)}, - .klmd = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_SHA_1) - | S390X_CAPBIT(S390X_SHA_256) - | S390X_CAPBIT(S390X_SHA_512), - 0ULL}, - .km = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256) - | S390X_CAPBIT(S390X_XTS_AES_128) - | S390X_CAPBIT(S390X_XTS_AES_256), - 0ULL}, - .kmc = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256), - 0ULL}, - .kmac = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256), - 0ULL}, - .kmctr = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256), - 0ULL}, - .kmo = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256), - 0ULL}, - .kmf = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256), - 0ULL}, - .prno = {0ULL, 0ULL}, - .kma = {0ULL, 0ULL}, + /*.klmd = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_SHA_1) + | S390X_CAPBIT(S390X_SHA_256) + | S390X_CAPBIT(S390X_SHA_512), + 0ULL}, + /*.km = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256) + | S390X_CAPBIT(S390X_XTS_AES_128) + | S390X_CAPBIT(S390X_XTS_AES_256), + 0ULL}, + /*.kmc = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256), + 0ULL}, + /*.kmac = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256), + 0ULL}, + /*.kmctr = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256), + 0ULL}, + /*.kmo = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256), + 0ULL}, + /*.kmf = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256), + 0ULL}, + /*.prno = */{0ULL, 0ULL}, + /*.kma = */{0ULL, 0ULL}, }; /*- @@ -376,59 +376,59 @@ static int parse_env(struct OPENSSL_s390xcap_st *cap) * Implements MSA and MSA1-5. */ static const struct OPENSSL_s390xcap_st z13 = { - .stfle = {S390X_CAPBIT(S390X_MSA) - | S390X_CAPBIT(S390X_STCKF) - | S390X_CAPBIT(S390X_MSA5), - S390X_CAPBIT(S390X_MSA3) - | S390X_CAPBIT(S390X_MSA4), - S390X_CAPBIT(S390X_VX), - 0ULL}, - .kimd = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_SHA_1) - | S390X_CAPBIT(S390X_SHA_256) - | S390X_CAPBIT(S390X_SHA_512), - S390X_CAPBIT(S390X_GHASH)}, - .klmd = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_SHA_1) - | S390X_CAPBIT(S390X_SHA_256) - | S390X_CAPBIT(S390X_SHA_512), - 0ULL}, - .km = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256) - | S390X_CAPBIT(S390X_XTS_AES_128) - | S390X_CAPBIT(S390X_XTS_AES_256), - 0ULL}, - .kmc = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256), - 0ULL}, - .kmac = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256), - 0ULL}, - .kmctr = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256), - 0ULL}, - .kmo = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256), - 0ULL}, - .kmf = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256), - 0ULL}, - .prno = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_SHA_512_DRNG), - 0ULL}, - .kma = {0ULL, 0ULL}, + /*.stfle = */{S390X_CAPBIT(S390X_MSA) + | S390X_CAPBIT(S390X_STCKF) + | S390X_CAPBIT(S390X_MSA5), + S390X_CAPBIT(S390X_MSA3) + | S390X_CAPBIT(S390X_MSA4), + S390X_CAPBIT(S390X_VX), + 0ULL}, + /*.kimd = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_SHA_1) + | S390X_CAPBIT(S390X_SHA_256) + | S390X_CAPBIT(S390X_SHA_512), + S390X_CAPBIT(S390X_GHASH)}, + /*.klmd = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_SHA_1) + | S390X_CAPBIT(S390X_SHA_256) + | S390X_CAPBIT(S390X_SHA_512), + 0ULL}, + /*.km = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256) + | S390X_CAPBIT(S390X_XTS_AES_128) + | S390X_CAPBIT(S390X_XTS_AES_256), + 0ULL}, + /*.kmc = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256), + 0ULL}, + /*.kmac = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256), + 0ULL}, + /*.kmctr = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256), + 0ULL}, + /*.kmo = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256), + 0ULL}, + /*.kmf = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256), + 0ULL}, + /*.prno = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_SHA_512_DRNG), + 0ULL}, + /*.kma = */{0ULL, 0ULL}, }; /*- @@ -436,78 +436,78 @@ static int parse_env(struct OPENSSL_s390xcap_st *cap) * Implements MSA and MSA1-8. */ static const struct OPENSSL_s390xcap_st z14 = { - .stfle = {S390X_CAPBIT(S390X_MSA) - | S390X_CAPBIT(S390X_STCKF) - | S390X_CAPBIT(S390X_MSA5), - S390X_CAPBIT(S390X_MSA3) - | S390X_CAPBIT(S390X_MSA4), - S390X_CAPBIT(S390X_VX) - | S390X_CAPBIT(S390X_VXD) - | S390X_CAPBIT(S390X_VXE) - | S390X_CAPBIT(S390X_MSA8), - 0ULL}, - .kimd = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_SHA_1) - | S390X_CAPBIT(S390X_SHA_256) - | S390X_CAPBIT(S390X_SHA_512) - | S390X_CAPBIT(S390X_SHA3_224) - | S390X_CAPBIT(S390X_SHA3_256) - | S390X_CAPBIT(S390X_SHA3_384) - | S390X_CAPBIT(S390X_SHA3_512) - | S390X_CAPBIT(S390X_SHAKE_128) - | S390X_CAPBIT(S390X_SHAKE_256), - S390X_CAPBIT(S390X_GHASH)}, - .klmd = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_SHA_1) - | S390X_CAPBIT(S390X_SHA_256) - | S390X_CAPBIT(S390X_SHA_512) - | S390X_CAPBIT(S390X_SHA3_224) - | S390X_CAPBIT(S390X_SHA3_256) - | S390X_CAPBIT(S390X_SHA3_384) - | S390X_CAPBIT(S390X_SHA3_512) - | S390X_CAPBIT(S390X_SHAKE_128) - | S390X_CAPBIT(S390X_SHAKE_256), - 0ULL}, - .km = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256) - | S390X_CAPBIT(S390X_XTS_AES_128) - | S390X_CAPBIT(S390X_XTS_AES_256), - 0ULL}, - .kmc = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256), - 0ULL}, - .kmac = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256), - 0ULL}, - .kmctr = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256), - 0ULL}, - .kmo = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256), - 0ULL}, - .kmf = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256), - 0ULL}, - .prno = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_SHA_512_DRNG), - S390X_CAPBIT(S390X_TRNG)}, - .kma = {S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_AES_128) - | S390X_CAPBIT(S390X_AES_192) - | S390X_CAPBIT(S390X_AES_256), - 0ULL}, + /*.stfle = */{S390X_CAPBIT(S390X_MSA) + | S390X_CAPBIT(S390X_STCKF) + | S390X_CAPBIT(S390X_MSA5), + S390X_CAPBIT(S390X_MSA3) + | S390X_CAPBIT(S390X_MSA4), + S390X_CAPBIT(S390X_VX) + | S390X_CAPBIT(S390X_VXD) + | S390X_CAPBIT(S390X_VXE) + | S390X_CAPBIT(S390X_MSA8), + 0ULL}, + /*.kimd = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_SHA_1) + | S390X_CAPBIT(S390X_SHA_256) + | S390X_CAPBIT(S390X_SHA_512) + | S390X_CAPBIT(S390X_SHA3_224) + | S390X_CAPBIT(S390X_SHA3_256) + | S390X_CAPBIT(S390X_SHA3_384) + | S390X_CAPBIT(S390X_SHA3_512) + | S390X_CAPBIT(S390X_SHAKE_128) + | S390X_CAPBIT(S390X_SHAKE_256), + S390X_CAPBIT(S390X_GHASH)}, + /*.klmd = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_SHA_1) + | S390X_CAPBIT(S390X_SHA_256) + | S390X_CAPBIT(S390X_SHA_512) + | S390X_CAPBIT(S390X_SHA3_224) + | S390X_CAPBIT(S390X_SHA3_256) + | S390X_CAPBIT(S390X_SHA3_384) + | S390X_CAPBIT(S390X_SHA3_512) + | S390X_CAPBIT(S390X_SHAKE_128) + | S390X_CAPBIT(S390X_SHAKE_256), + 0ULL}, + /*.km = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256) + | S390X_CAPBIT(S390X_XTS_AES_128) + | S390X_CAPBIT(S390X_XTS_AES_256), + 0ULL}, + /*.kmc = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256), + 0ULL}, + /*.kmac = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256), + 0ULL}, + /*.kmctr = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256), + 0ULL}, + /*.kmo = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256), + 0ULL}, + /*.kmf = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256), + 0ULL}, + /*.prno = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_SHA_512_DRNG), + S390X_CAPBIT(S390X_TRNG)}, + /*.kma = */{S390X_CAPBIT(S390X_QUERY) + | S390X_CAPBIT(S390X_AES_128) + | S390X_CAPBIT(S390X_AES_192) + | S390X_CAPBIT(S390X_AES_256), + 0ULL}, }; char *tok_begin, *tok_end, *buff, tok[S390X_STFLE_MAX][LEN + 1]; diff --git a/crypto/sha/build.info b/crypto/sha/build.info index 58d15bbb..242a08e3 100644 --- a/crypto/sha/build.info +++ b/crypto/sha/build.info @@ -3,6 +3,8 @@ SOURCE[../../libcrypto]=\ sha1dgst.c sha1_one.c sha256.c sha512.c {- $target{sha1_asm_src} -} \ {- $target{keccak1600_asm_src} -} +SOURCE[../../providers/fips]= sha256.c + GENERATE[sha1-586.s]=asm/sha1-586.pl \ $(PERLASM_SCHEME) $(LIB_CFLAGS) $(LIB_CPPFLAGS) $(PROCESSOR) DEPEND[sha1-586.s]=../perlasm/x86asm.pl diff --git a/crypto/trace.c b/crypto/trace.c index efcf8be7..ecfc6d4e 100644 --- a/crypto/trace.c +++ b/crypto/trace.c @@ -124,7 +124,7 @@ static const struct trace_category_st trace_categories[] = { TRACE_CATEGORY_(INIT), TRACE_CATEGORY_(TLS), TRACE_CATEGORY_(TLS_CIPHER), - TRACE_CATEGORY_(ENGINE_CONF), + TRACE_CATEGORY_(CONF), TRACE_CATEGORY_(ENGINE_TABLE), TRACE_CATEGORY_(ENGINE_REF_COUNT), TRACE_CATEGORY_(PKCS5V2), diff --git a/crypto/x509/x509_lu.c b/crypto/x509/x509_lu.c index fa8153d3..e994633f 100644 --- a/crypto/x509/x509_lu.c +++ b/crypto/x509/x509_lu.c @@ -297,6 +297,9 @@ int X509_STORE_CTX_get_by_subject(X509_STORE_CTX *vs, X509_LOOKUP_TYPE type, if (ctx == NULL) return 0; + stmp.type = X509_LU_NONE; + stmp.data.ptr = NULL; + CRYPTO_THREAD_write_lock(ctx->lock); tmp = X509_OBJECT_retrieve_by_subject(ctx->objs, type, name); CRYPTO_THREAD_unlock(ctx->lock); diff --git a/crypto/x509/x_all.c b/crypto/x509/x_all.c index afcf0b7b..9c9e8ffa 100644 --- a/crypto/x509/x_all.c +++ b/crypto/x509/x_all.c @@ -72,7 +72,10 @@ static int x509_verify_sm2(X509 *x, EVP_PKEY *pkey, int mdnid, int pknid) ret = 0; goto err; } - if (EVP_PKEY_CTX_set1_id(pctx, x->sm2_id.data, x->sm2_id.length) != 1) { + /* NOTE: we tolerate no actual ID, to provide maximum flexibility */ + if (x->sm2_id != NULL + && EVP_PKEY_CTX_set1_id(pctx, x->sm2_id->data, + x->sm2_id->length) != 1) { X509err(X509_F_X509_VERIFY_SM2, ERR_R_EVP_LIB); ret = 0; goto err; diff --git a/crypto/x509/x_x509.c b/crypto/x509/x_x509.c index 901a3e6a..78e1a756 100644 --- a/crypto/x509/x_x509.c +++ b/crypto/x509/x_x509.c @@ -72,6 +72,9 @@ static int x509_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it, #ifndef OPENSSL_NO_RFC3779 ret->rfc3779_addr = NULL; ret->rfc3779_asid = NULL; +#endif +#ifndef OPENSSL_NO_SM2 + ret->sm2_id = NULL; #endif ret->aux = NULL; ret->crldp = NULL; @@ -91,6 +94,9 @@ static int x509_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it, #ifndef OPENSSL_NO_RFC3779 sk_IPAddressFamily_pop_free(ret->rfc3779_addr, IPAddressFamily_free); ASIdentifiers_free(ret->rfc3779_asid); +#endif +#ifndef OPENSSL_NO_SM2 + ASN1_OCTET_STRING_free(ret->sm2_id); #endif break; @@ -246,13 +252,14 @@ int X509_get_signature_nid(const X509 *x) } #ifndef OPENSSL_NO_SM2 -void X509_set_sm2_id(X509 *x, ASN1_OCTET_STRING *sm2_id) +void X509_set0_sm2_id(X509 *x, ASN1_OCTET_STRING *sm2_id) { - x->sm2_id = *sm2_id; + ASN1_OCTET_STRING_free(x->sm2_id); + x->sm2_id = sm2_id; } ASN1_OCTET_STRING *X509_get0_sm2_id(X509 *x) { - return &x->sm2_id; + return x->sm2_id; } #endif diff --git a/doc/internal/man3/evp_generic_fetch.pod b/doc/internal/man3/evp_generic_fetch.pod index b871cd1f..881aaf95 100644 --- a/doc/internal/man3/evp_generic_fetch.pod +++ b/doc/internal/man3/evp_generic_fetch.pod @@ -14,7 +14,8 @@ evp_generic_fetch - generic algorithm fetcher and method creator for EVP void *(*new_method)(int nid, const OSSL_DISPATCH *fns, OSSL_PROVIDER *prov), int (*upref_method)(void *), - void (*free_method)(void *)); + void (*free_method)(void *), + int (*nid_method)(void *)); =head1 DESCRIPTION @@ -41,6 +42,10 @@ one. frees the given method. +=item nid_method() + +returns the nid associated with the given method. + =back =head1 RETURN VALUES diff --git a/doc/internal/man3/ossl_method_construct.pod b/doc/internal/man3/ossl_method_construct.pod index 36646354..7b682dd0 100644 --- a/doc/internal/man3/ossl_method_construct.pod +++ b/doc/internal/man3/ossl_method_construct.pod @@ -21,8 +21,8 @@ OSSL_METHOD_CONSTRUCT_METHOD, ossl_method_construct int (*put)(OPENSSL_CTX *libctx, void *store, const char *propdef, void *method, void *data); /* Construct a new method */ - void *(*construct)(const OSSL_DISPATCH *fns, OSSL_PROVIDER *prov, - void *data); + void *(*construct)(const char *algorithm_name, const OSSL_DISPATCH *fns, + OSSL_PROVIDER *prov, void *data); /* Destruct a method */ void (*destruct)(void *method); }; @@ -107,7 +107,8 @@ This function is expected to increment the C's reference count. =item construct() -Constructs a sub-system method given a dispatch table C. +Constructs a sub-system method for the given C and the given +dispatch table C. The associated I C is passed as well, to make it possible for the sub-system constructor to keep a reference, which diff --git a/doc/man1/ecparam.pod b/doc/man1/ecparam.pod index ed39788b..fac930ea 100644 --- a/doc/man1/ecparam.pod +++ b/doc/man1/ecparam.pod @@ -17,6 +17,7 @@ B [B<-text>] [B<-C>] [B<-check>] +[B<-check_named>] [B<-name arg>] [B<-list_curves>] [B<-conv_form arg>] @@ -79,6 +80,11 @@ be loaded by calling the get_ec_group_XXX() function. Validate the elliptic curve parameters. +=item B<-check_named> + +Validate the elliptic name curve parameters by checking if the curve parameters +match any built-in curves. + =item B<-name arg> Use the EC parameters with the specified 'short' name. Use B<-list_curves> diff --git a/doc/man1/ocsp.pod b/doc/man1/ocsp.pod index c8c32763..4c0aaac1 100644 --- a/doc/man1/ocsp.pod +++ b/doc/man1/ocsp.pod @@ -88,6 +88,7 @@ B B [B<-ndays n>] [B<-resp_key_id>] [B<-nrequest n>] +[B<-rcid I>] [B<-I>] =head1 DESCRIPTION @@ -304,6 +305,12 @@ status information is immediately available. In this case the age of the B field is checked to see it is not older than B seconds old. By default this additional check is not performed. +=item B<-rcid I> + +This option sets the digest algorithm to use for certificate identification +in the OCSP response. Any digest supported by the OpenSSL B command can +be used. The default is the same digest algorithm used in the request. + =item B<-I> This option sets digest algorithm to use for certificate identification in the diff --git a/doc/man1/speed.pod b/doc/man1/speed.pod index e164c614..1cb4494e 100644 --- a/doc/man1/speed.pod +++ b/doc/man1/speed.pod @@ -13,6 +13,7 @@ B [B<-elapsed>] [B<-evp algo>] [B<-hmac algo>] +[B<-cmac algo>] [B<-decrypt>] [B<-rand file...>] [B<-writerand file>] @@ -60,6 +61,10 @@ aes-128-cbc-hmac-sha1, then B<-mb> will time multi-buffer operation. Time the HMAC algorithm using the specified message digest. +=item B<-cmac cipher> + +Time the CMAC algorithm using the specified cipher e.g. B. + =item B<-decrypt> Time the decryption instead of encryption. Affects only the EVP testing. diff --git a/doc/man3/BIO_connect.pod b/doc/man3/BIO_connect.pod index 00e4463c..c0edae71 100644 --- a/doc/man3/BIO_connect.pod +++ b/doc/man3/BIO_connect.pod @@ -95,19 +95,19 @@ B (-1) on error. When an error has occurred, the OpenSSL error stack will hold the error data and errno has the system error. -=head1 HISTORY - -BIO_gethostname(), BIO_get_port(), BIO_get_host_ip(), -BIO_get_accept_socket() and BIO_accept() were deprecated in -OpenSSL 1.1.0. Use the functions described above instead. - =head1 SEE ALSO L +=head1 HISTORY + +BIO_gethostname(), BIO_get_port(), BIO_get_host_ip(), +BIO_get_accept_socket() and BIO_accept() were deprecated in OpenSSL 1.1.0. +Use the functions described above instead. + =head1 COPYRIGHT -Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2016-2019 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/BIO_ctrl.pod b/doc/man3/BIO_ctrl.pod index 29e72aad..f51593fb 100644 --- a/doc/man3/BIO_ctrl.pod +++ b/doc/man3/BIO_ctrl.pod @@ -5,7 +5,8 @@ BIO_ctrl, BIO_callback_ctrl, BIO_ptr_ctrl, BIO_int_ctrl, BIO_reset, BIO_seek, BIO_tell, BIO_flush, BIO_eof, BIO_set_close, BIO_get_close, BIO_pending, BIO_wpending, BIO_ctrl_pending, BIO_ctrl_wpending, -BIO_get_info_callback, BIO_set_info_callback, BIO_info_cb, BIO_get_ktls_send +BIO_get_info_callback, BIO_set_info_callback, BIO_info_cb, BIO_get_ktls_send, +BIO_get_ktls_recv - BIO control operations =head1 SYNOPSIS @@ -35,6 +36,7 @@ BIO_get_info_callback, BIO_set_info_callback, BIO_info_cb, BIO_get_ktls_send int BIO_set_info_callback(BIO *b, BIO_info_cb *cb); int BIO_get_ktls_send(BIO *b); + int BIO_get_ktls_recv(BIO *b); =head1 DESCRIPTION @@ -74,8 +76,10 @@ Not all BIOs support these calls. BIO_ctrl_pending() and BIO_ctrl_wpending() return a size_t type and are functions, BIO_pending() and BIO_wpending() are macros which call BIO_ctrl(). -BIO_get_ktls_send() return 1 if the BIO is using the Kernel TLS data-path for +BIO_get_ktls_send() returns 1 if the BIO is using the Kernel TLS data-path for sending. Otherwise, it returns zero. +BIO_get_ktls_recv() returns 1 if the BIO is using the Kernel TLS data-path for +receiving. Otherwise, it returns zero. =head1 RETURN VALUES @@ -97,8 +101,10 @@ BIO_get_close() returns the close flag value: BIO_CLOSE or BIO_NOCLOSE. BIO_pending(), BIO_ctrl_pending(), BIO_wpending() and BIO_ctrl_wpending() return the amount of pending data. -BIO_get_ktls_send() return 1 if the BIO is using the Kernel TLS data-path for +BIO_get_ktls_send() returns 1 if the BIO is using the Kernel TLS data-path for sending. Otherwise, it returns zero. +BIO_get_ktls_recv() returns 1 if the BIO is using the Kernel TLS data-path for +receiving. Otherwise, it returns zero. =head1 NOTES @@ -134,7 +140,8 @@ the case of BIO_seek() on a file BIO for a successful operation. =head1 HISTORY -The BIO_get_ktls_send() function was added in OpenSSL 3.0.0. +The BIO_get_ktls_send() and BIO_get_ktls_recv() functions were added in +OpenSSL 3.0.0. =head1 COPYRIGHT diff --git a/doc/man3/BN_rand.pod b/doc/man3/BN_rand.pod index 3ceeff1d..93e8c3f9 100644 --- a/doc/man3/BN_rand.pod +++ b/doc/man3/BN_rand.pod @@ -59,6 +59,15 @@ seeded with enough randomness to ensure an unpredictable byte sequence. The functions return 1 on success, 0 on error. The error codes can be obtained by L. +=head1 SEE ALSO + +L, +L, +L, +L, +L, +L + =head1 HISTORY =over 2 @@ -78,18 +87,9 @@ BN_priv_rand() and BN_priv_rand_range() functions were added in OpenSSL 1.1.1. =back -=head1 SEE ALSO - -L, -L, -L, -L, -L, -L - =head1 COPYRIGHT -Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/BN_security_bits.pod b/doc/man3/BN_security_bits.pod index 3b9bf887..f02bf2e0 100644 --- a/doc/man3/BN_security_bits.pod +++ b/doc/man3/BN_security_bits.pod @@ -31,17 +31,17 @@ Number of security bits. ECC (Elliptic Curve Cryptography) is not covered by the BN_security_bits() function. The symmetric algorithms are not covered neither. -=head1 HISTORY - -The BN_security_bits() function was added in OpenSSL 1.1.0. - =head1 SEE ALSO L, L, L +=head1 HISTORY + +The BN_security_bits() function was added in OpenSSL 1.1.0. + =head1 COPYRIGHT -Copyright 2017 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2017-2019 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/DES_random_key.pod b/doc/man3/DES_random_key.pod index f5203b84..4f0f25a5 100644 --- a/doc/man3/DES_random_key.pod +++ b/doc/man3/DES_random_key.pod @@ -296,6 +296,11 @@ last 4 bytes of the checksum of the input. DES_fcrypt() returns a pointer to the caller-provided buffer and DES_crypt() - to a static buffer on success; otherwise they return NULL. +=head1 SEE ALSO + +L, +L + =head1 HISTORY The requirement that the B parameter to DES_crypt() and DES_fcrypt() @@ -304,14 +309,9 @@ OpenSSL 1.1.0. Previous versions tried to use the letter uppercase B if both character were not present, and could crash when given non-ASCII on some platforms. -=head1 SEE ALSO - -L, -L - =head1 COPYRIGHT -Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/EC_GROUP_copy.pod b/doc/man3/EC_GROUP_copy.pod index 3f7108d0..b62eaa95 100644 --- a/doc/man3/EC_GROUP_copy.pod +++ b/doc/man3/EC_GROUP_copy.pod @@ -9,7 +9,8 @@ EC_GROUP_set_curve_name, EC_GROUP_get_curve_name, EC_GROUP_set_asn1_flag, EC_GROUP_get_asn1_flag, EC_GROUP_set_point_conversion_form, EC_GROUP_get_point_conversion_form, EC_GROUP_get0_seed, EC_GROUP_get_seed_len, EC_GROUP_set_seed, EC_GROUP_get_degree, -EC_GROUP_check, EC_GROUP_check_discriminant, EC_GROUP_cmp, +EC_GROUP_check, EC_GROUP_check_named_curve, +EC_GROUP_check_discriminant, EC_GROUP_cmp, EC_GROUP_get_basis_type, EC_GROUP_get_trinomial_basis, EC_GROUP_get_pentanomial_basis, EC_GROUP_get0_field - Functions for manipulating EC_GROUP objects @@ -50,6 +51,7 @@ EC_GROUP_get_pentanomial_basis, EC_GROUP_get0_field int EC_GROUP_get_degree(const EC_GROUP *group); int EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx); + int EC_GROUP_check_named_curve(const EC_GROUP *group, int nist_only); int EC_GROUP_check_discriminant(const EC_GROUP *group, BN_CTX *ctx); @@ -128,7 +130,7 @@ in that a parameter obtained in this way is highly unlikely to be susceptible to If the seed is present for a curve then the b parameter was generated in a verifiable fashion using that seed. The OpenSSL EC library does not use this seed value but does enable you to inspect it using EC_GROUP_get0_seed. This returns a pointer to a memory block containing the seed that was used. The length of the memory block can be obtained using EC_GROUP_get_seed_len. A number of the -builtin curves within the library provide seed values that can be obtained. It is also possible to set a custom seed using +built-in curves within the library provide seed values that can be obtained. It is also possible to set a custom seed using EC_GROUP_set_seed and passing a pointer to a memory block, along with the length of the seed. Again, the EC library will not use this seed value, although it will be preserved in any ASN1 based communications. @@ -143,6 +145,14 @@ The function EC_GROUP_check performs a number of checks on a curve to verify tha verifying that the discriminant is non zero; that a generator has been defined; that the generator is on the curve and has the correct order. +The function EC_GROUP_check_named_curve determines if the group's domain parameters match one of the built-in curves supported by the library. +The curve name is returned as a B if it matches. If the group's domain parameters have been modified then no match will be found. +If the curve name of the given group is B (e.g. it has been created by using explicit parameters with no curve name), +then this method can be used to lookup the name of the curve that matches the group domain parameters. The built-in curves contain +aliases, so that multiple NID's can map to the same domain parameters. For such curves it is unspecified which of the aliases will be +returned if the curve name of the given group is NID_undef. +If B is 1 it will only look for NIST approved curves, otherwise it searches all built-in curves. + EC_GROUP_cmp compares B and B to determine whether they represent the same curve or not. The functions EC_GROUP_get_basis_type, EC_GROUP_get_trinomial_basis and EC_GROUP_get_pentanomial_basis should only be called for curves @@ -175,6 +185,8 @@ EC_GROUP_get_order, EC_GROUP_get_cofactor, EC_GROUP_get_curve_name, EC_GROUP_get and EC_GROUP_get_degree return the order, cofactor, curve name (NID), ASN1 flag, point_conversion_form and degree for the specified curve respectively. If there is no curve name associated with a curve then EC_GROUP_get_curve_name will return 0. +EC_GROUP_check_named_curve() returns the nid of the matching named curve, otherwise it returns 0 for no match, or -1 on error. + EC_GROUP_get0_order() returns an internal pointer to the group order. EC_GROUP_order_bits() returns the number of bits in the group order. EC_GROUP_get0_cofactor() returns an internal pointer to the group cofactor. @@ -198,9 +210,13 @@ L, L, L, L, L, L, L +=head1 HISTORY + +The EC_GROUP_check_named_curve() function was added in OpenSSL 3.0. + =head1 COPYRIGHT -Copyright 2013-2017 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2013-2019 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/EVP_DigestInit.pod b/doc/man3/EVP_DigestInit.pod index 37cdb274..4f5e38c3 100644 --- a/doc/man3/EVP_DigestInit.pod +++ b/doc/man3/EVP_DigestInit.pod @@ -182,7 +182,12 @@ EVP_MD_meth_set_app_datasize(). =item EVP_MD_CTX_md() -Returns the B structure corresponding to the passed B. +Returns the B structure corresponding to the passed B. This +will be the same B object originally passed to EVP_DigestInit_ex() (or +other similar function) when the EVP_MD_CTX was first initialised. Note that +where explicit fetch is in use (see L) the value returned from +this function will not have its reference count incremented and therefore it +should not be used after the EVP_MD_CTX is freed. =item EVP_MD_CTX_set_update_fn() diff --git a/doc/man3/EVP_MD_fetch.pod b/doc/man3/EVP_MD_fetch.pod index 17481089..cba3bc4f 100644 --- a/doc/man3/EVP_MD_fetch.pod +++ b/doc/man3/EVP_MD_fetch.pod @@ -21,13 +21,13 @@ calculate the digest of input data using functions such as L, L and L. Digest implementations may be obtained in one of three ways, i.e. implicit -lookup, explicit lookup or user defined. +fetch, explicit fetch or user defined. =over 4 -=item Implicit Lookup +=item Implicit Fetch -With implicit lookup an application can use functions such as L, +With implicit fetch an application can use functions such as L, L or L to obtain an B object. When used in a function like L the actual implementation to be used will be fetched implicitly using default search criteria. Typically, @@ -35,13 +35,15 @@ be used will be fetched implicitly using default search criteria. Typically, have been loaded), this will return an implementation of the appropriate algorithm from the default provider. -=item Explicit Lookup +=item Explicit Fetch -With explicit lookup an application uses the EVP_MD_fetch() function to obtain +With explicit fetch an application uses the EVP_MD_fetch() function to obtain an algorithm implementation. An implementation with the given name and -satisfying the search criteria specified in the B parameter will be -looked for within the available providers and returned. See L -for information about providers. +satisfying the search criteria specified in the B parameter +combined with the default search criteria will be looked for within the +available providers and returned. +See L for information on default search criteria +and L for information about providers. =item User defined @@ -83,6 +85,18 @@ The return value from a call to EVP_MD_fetch() must be freed by the caller using L. Note that EVP_MD objects are reference counted. See L. +=head1 NOTES + +Where an application that previously used implicit fetch is converted to use +explicit fetch care should be taken with the L function. +Specifically, this function returns the EVP_MD object orginally passed to +EVP_DigestInit_ex() (or other similar function). With implicit fetch the +returned EVP_MD object is guaranteed to be available throughout the application +lifetime. However, with explicit fetch EVP_MD objects are reference counted. +EVP_MD_CTX_md does not increment the reference count and so the returned EVP_MD +object may not be accessible beyond the lifetime of the EVP_MD_CTX it is +associated with. + =head1 RETURN VALUES EVP_MD_fetch() returns a pointer to the algorithm implementation represented by @@ -144,7 +158,8 @@ other providers: =head1 SEE ALSO L, L, L, -L, L, L +L, L, L, +L =head1 HISTORY diff --git a/doc/man3/EVP_set_default_properties.pod b/doc/man3/EVP_set_default_properties.pod new file mode 100644 index 00000000..077913c2 --- /dev/null +++ b/doc/man3/EVP_set_default_properties.pod @@ -0,0 +1,52 @@ +=pod + +=head1 NAME + +EVP_set_default_properties +- Set default properties for future algorithm fetches + +=head1 SYNOPSIS + + #include + + int EVP_set_default_properties(OPENSSL_CTX *libctx, const char *propq); + +=head1 DESCRIPTION + +EVP_set_default_properties() sets the default properties for all +future EVP algorithm fetches, implicit as well as explicit. + +=for comment TODO(3.0) We should consider having an EVP document in +section 7 that details everything about implicit vs explicit fetches +and how they relate to properties. + +EVP_set_default_properties stores the properties given with the string +I among the EVP data that's been stored in the library context +given with I (NULL signifies the default library context). + +Any previous default property for the specified library context will +be dropped. + +=head1 RETURN VALUES + +EVP_set_default_properties() returns 1 on success, or 0 on failure. +The latter adds an error on the error stack. + +=head1 SEE ALSO + +L + +=head1 HISTORY + +The functions described here were added in OpenSSL 3.0. + +=head1 COPYRIGHT + +Copyright 2019 The OpenSSL Project Authors. All Rights Reserved. + +Licensed under the Apache License 2.0 (the "License"). You may not use +this file except in compliance with the License. You can obtain a copy +in the file LICENSE in the source distribution or at +L. + +=cut diff --git a/doc/man3/OSSL_PARAM_TYPE.pod b/doc/man3/OSSL_PARAM_TYPE.pod index 2842eae3..4585f25a 100644 --- a/doc/man3/OSSL_PARAM_TYPE.pod +++ b/doc/man3/OSSL_PARAM_TYPE.pod @@ -10,7 +10,8 @@ OSSL_PARAM_SIZED_octet_ptr, OSSL_PARAM_END, OSSL_PARAM_construct_TYPE, OSSL_PARAM_END, OSSL_PARAM_construct_BN, OSSL_PARAM_construct_utf8_string, OSSL_PARAM_construct_utf8_ptr, OSSL_PARAM_construct_octet_string, -OSSL_PARAM_construct_octet_ptr, OSSL_PARAM_locate, OSSL_PARAM_get_TYPE, +OSSL_PARAM_construct_octet_ptr, OSSL_PARAM_construct_end, +OSSL_PARAM_locate, OSSL_PARAM_get_TYPE, OSSL_PARAM_set_TYPE, OSSL_PARAM_get_BN, OSSL_PARAM_set_BN, OSSL_PARAM_get_utf8_string, OSSL_PARAM_set_utf8_string, OSSL_PARAM_get_octet_string, OSSL_PARAM_set_octet_string, @@ -43,9 +44,10 @@ OSSL_PARAM_set_octet_ptr OSSL_PARAM OSSL_PARAM_construct_octet_string(const char *key, void *buf, size_t bsize, size_t *rsize); OSSL_PARAM OSSL_PARAM_construct_utf8_ptr(const char *key, char **buf, - size_t *rsize); + size_t bsize, size_t *rsize); OSSL_PARAM OSSL_PARAM_construct_octet_ptr(const char *key, void **buf, - size_t *rsize); + size_t bsize, size_t *rsize); + OSSL_PARAM OSSL_PARAM_construct_end(void); OSSL_PARAM *OSSL_PARAM_locate(OSSL_PARAM *array, const char *key); @@ -171,13 +173,16 @@ size B is created. OSSL_PARAM_construct_utf8_ptr() is a function that constructes a UTF string pointer OSSL_PARAM structure. -A parameter with name B, storage pointer B<*buf> and return size B -is created. +A parameter with name B, storage pointer B<*buf>, size B and +return size B is created. OSSL_PARAM_construct_octet_ptr() is a function that constructes an OCTET string pointer OSSL_PARAM structure. -A parameter with name B, storage pointer B<*buf> and return size B -is created. +A parameter with name B, storage pointer B<*buf>, size B and +return size B is created. + +OSSL_PARAM_construct_end() is a function that constructs the terminating +OSSL_PARAM structure. OSSL_PARAM_locate() is a function that searches an B of parameters for the one matching the B name. @@ -249,6 +254,13 @@ Integral types will be widened and sign extended as required. Apart from that, the functions must be used appropriately for the expected type of the parameter. +For OSSL_PARAM_get_utf8_ptr() and OSSL_PARAM_get_octet_ptr(), B +is not relevant if the purpose is to send the B array to a +I, i.e. to get parameter data back. +In that case, B can safely be given zero. +See L for further information on the +possible purposes. + =head1 EXAMPLES Reusing the examples from L to just show how diff --git a/doc/man3/OSSL_trace_set_channel.pod b/doc/man3/OSSL_trace_set_channel.pod index 46e248f4..cb349674 100644 --- a/doc/man3/OSSL_trace_set_channel.pod +++ b/doc/man3/OSSL_trace_set_channel.pod @@ -176,6 +176,10 @@ point during evaluation. Traces BIGNUM context operations. +=item C + +Traces the OSSL_PROVIDER configuration. + =back There is also C, which works as a fallback diff --git a/doc/man3/PEM_read_bio_PrivateKey.pod b/doc/man3/PEM_read_bio_PrivateKey.pod index a5a63c48..69ff679b 100644 --- a/doc/man3/PEM_read_bio_PrivateKey.pod +++ b/doc/man3/PEM_read_bio_PrivateKey.pod @@ -459,20 +459,20 @@ Skeleton pass phrase callback: return len; } +=head1 SEE ALSO + +L, L, +L + =head1 HISTORY The old Netscape certificate sequences were no longer documented in OpenSSL 1.1.0; applications should use the PKCS7 standard instead as they will be formally deprecated in a future releases. -=head1 SEE ALSO - -L, L, -L - =head1 COPYRIGHT -Copyright 2001-2018 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2001-2019 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/RAND_DRBG_generate.pod b/doc/man3/RAND_DRBG_generate.pod index 0066c86e..e0778ea2 100644 --- a/doc/man3/RAND_DRBG_generate.pod +++ b/doc/man3/RAND_DRBG_generate.pod @@ -29,7 +29,9 @@ number of generate requests (I) or the maximum timespan (I) since its last seeding have been reached. If this is the case, the DRBG reseeds automatically. Additionally, an immediate reseeding can be requested by setting the -B flag to 1. See NOTES section for more details. +B flag to 1. +Requesting prediction resistance is a relative expensive operation. +See NOTES section for more details. The caller can optionally provide additional data to be used for reseeding by passing a pointer B to a buffer of length B. @@ -59,15 +61,9 @@ If necessary, they can be changed using L and L, respectively. A request for prediction resistance can only be satisfied by pulling fresh -entropy from one of the approved entropy sources listed in section 5.5.2 of -[NIST SP 800-90C]. -Since the default DRBG implementation does not have access to such an approved -entropy source, a request for prediction resistance will always fail. -In other words, prediction resistance is currently not supported yet by the DRBG. - -=head1 HISTORY - -The RAND_DRBG functions were added in OpenSSL 1.1.1. +entropy from a live entropy source (section 5.5.2 of [NIST SP 800-90C]). +It is up to the user to ensure that a live entropy source is configured +and is being used. =head1 SEE ALSO @@ -76,9 +72,15 @@ L, L, L +=head1 HISTORY + +The RAND_DRBG functions were added in OpenSSL 1.1.1. + +Prediction resistance is supported from OpenSSL 3.0.0. + =head1 COPYRIGHT -Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2017-2019 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/RAND_DRBG_get0_master.pod b/doc/man3/RAND_DRBG_get0_master.pod index e8298873..62f6fdbd 100644 --- a/doc/man3/RAND_DRBG_get0_master.pod +++ b/doc/man3/RAND_DRBG_get0_master.pod @@ -53,11 +53,6 @@ During initialization, it is possible to change the reseed interval and reseed time interval. It is also possible to exchange the reseeding callbacks entirely. - -=head1 HISTORY - -The RAND_DRBG functions were added in OpenSSL 1.1.1. - =head1 SEE ALSO L, @@ -68,9 +63,13 @@ L, L, L +=head1 HISTORY + +The RAND_DRBG functions were added in OpenSSL 1.1.1. + =head1 COPYRIGHT -Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2017-2019 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/RAND_DRBG_new.pod b/doc/man3/RAND_DRBG_new.pod index 27142abf..8b738406 100644 --- a/doc/man3/RAND_DRBG_new.pod +++ b/doc/man3/RAND_DRBG_new.pod @@ -134,10 +134,6 @@ To ensure that they are applied to the global and thread-local DRBG instances RAND_DRBG_set_defaults() before creating any thread and before calling any cryptographic routines that obtain random data directly or indirectly. -=head1 HISTORY - -The RAND_DRBG functions were added in OpenSSL 1.1.1. - =head1 SEE ALSO L, @@ -145,9 +141,13 @@ L, L, L +=head1 HISTORY + +The RAND_DRBG functions were added in OpenSSL 1.1.1. + =head1 COPYRIGHT -Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2017-2019 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/RAND_DRBG_reseed.pod b/doc/man3/RAND_DRBG_reseed.pod index ca08a39b..40375603 100644 --- a/doc/man3/RAND_DRBG_reseed.pod +++ b/doc/man3/RAND_DRBG_reseed.pod @@ -13,7 +13,8 @@ RAND_DRBG_set_reseed_defaults #include int RAND_DRBG_reseed(RAND_DRBG *drbg, - const unsigned char *adin, size_t adinlen); + const unsigned char *adin, size_t adinlen, + int prediction_resistance); int RAND_DRBG_set_reseed_interval(RAND_DRBG *drbg, unsigned int interval); @@ -37,6 +38,10 @@ and mixing in the specified additional data provided in the buffer B of length B. The additional data can be omitted by setting B to NULL and B to 0. +An immediate reseeding can be requested by setting the +B flag to 1. +Requesting prediction resistance is a relative expensive operation. +See NOTES section for more details. RAND_DRBG_set_reseed_interval() sets the reseed interval of the B, which is the maximum allowed number @@ -88,10 +93,6 @@ To ensure that they are applied to the global and thread-local DRBG instances RAND_DRBG_set_reseed_defaults() before creating any thread and before calling any cryptographic routines that obtain random data directly or indirectly. -=head1 HISTORY - -The RAND_DRBG functions were added in OpenSSL 1.1.1. - =head1 SEE ALSO L, @@ -99,9 +100,15 @@ L, L. L +=head1 HISTORY + +The RAND_DRBG functions were added in OpenSSL 1.1.1. + +Prediction resistance is supported from OpenSSL 3.0.0. + =head1 COPYRIGHT -Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2017-2019 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/RAND_DRBG_set_callbacks.pod b/doc/man3/RAND_DRBG_set_callbacks.pod index 9a1d1572..09a6ef1f 100644 --- a/doc/man3/RAND_DRBG_set_callbacks.pod +++ b/doc/man3/RAND_DRBG_set_callbacks.pod @@ -104,12 +104,9 @@ contents safely before freeing it, in order not to leave sensitive information about the DRBG's state in memory. A request for prediction resistance can only be satisfied by pulling fresh -entropy from one of the approved entropy sources listed in section 5.5.2 of -[NIST SP 800-90C]. -Since the default implementation of the get_entropy callback does not have access -to such an approved entropy source, a request for prediction resistance will -always fail. -In other words, prediction resistance is currently not supported yet by the DRBG. +entropy from a live entropy source (section 5.5.2 of [NIST SP 800-90C]). +It is up to the user to ensure that a live entropy source is configured +and is being used. The derivation function is disabled during initialization by calling the RAND_DRBG_set() function with the RAND_DRBG_FLAG_CTR_NO_DF flag. @@ -124,20 +121,19 @@ In this case the DRBG will automatically request an extra amount of entropy utilize for the nonce, following the recommendations of [NIST SP 800-90A Rev. 1], section 8.6.7. - -=head1 HISTORY - -The RAND_DRBG functions were added in OpenSSL 1.1.1. - =head1 SEE ALSO L, L, L +=head1 HISTORY + +The RAND_DRBG functions were added in OpenSSL 1.1.1. + =head1 COPYRIGHT -Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2017-2019 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/RAND_add.pod b/doc/man3/RAND_add.pod index 65232d97..ed7824db 100644 --- a/doc/man3/RAND_add.pod +++ b/doc/man3/RAND_add.pod @@ -80,11 +80,6 @@ RAND_event() returns RAND_status(). The other functions do not return values. -=head1 HISTORY - -RAND_event() and RAND_screen() were deprecated in OpenSSL 1.1.0 and should -not be used. - =head1 SEE ALSO L, @@ -92,9 +87,14 @@ L, L, L +=head1 HISTORY + +RAND_event() and RAND_screen() were deprecated in OpenSSL 1.1.0 and should +not be used. + =head1 COPYRIGHT -Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/RAND_bytes.pod b/doc/man3/RAND_bytes.pod index 86d37b3f..fb1e1c9a 100644 --- a/doc/man3/RAND_bytes.pod +++ b/doc/man3/RAND_bytes.pod @@ -43,6 +43,15 @@ return 1 on success, -1 if not supported by the current RAND method, or 0 on other failure. The error code can be obtained by L. +=head1 SEE ALSO + +L, +L, +L, +L, +L, +L + =head1 HISTORY =over 2 @@ -57,18 +66,9 @@ The RAND_priv_bytes() function was added in OpenSSL 1.1.1. =back -=head1 SEE ALSO - -L, -L, -L, -L, -L, -L - =head1 COPYRIGHT -Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/RAND_cleanup.pod b/doc/man3/RAND_cleanup.pod index 129d5793..dfe76a7b 100644 --- a/doc/man3/RAND_cleanup.pod +++ b/doc/man3/RAND_cleanup.pod @@ -25,18 +25,18 @@ L. RAND_cleanup() returns no value. +=head1 SEE ALSO + +L + =head1 HISTORY RAND_cleanup() was deprecated in OpenSSL 1.1.0; do not use it. See L -=head1 SEE ALSO - -L - =head1 COPYRIGHT -Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/SSL_CIPHER_get_name.pod b/doc/man3/SSL_CIPHER_get_name.pod index 51c3941f..26ee6a0f 100644 --- a/doc/man3/SSL_CIPHER_get_name.pod +++ b/doc/man3/SSL_CIPHER_get_name.pod @@ -124,7 +124,10 @@ Textual representation of the cipher name. =item -Protocol version, such as B, when the cipher was first defined. +The minimum protocol version that the ciphersuite supports, such as B. +Note that this is not always the same as the protocol version in which the +ciphersuite was first defined because some ciphersuites are backwards compatible +with earlier protocol versions. =item Kx= @@ -177,6 +180,11 @@ SSL_CIPHER_get_id() returns a 4-byte integer representing the OpenSSL-specific I SSL_CIPHER_get_protocol_id() returns a 2-byte integer representing the TLS protocol-specific ID. +=head1 SEE ALSO + +L, L, +L, L + =head1 HISTORY The SSL_CIPHER_get_version() function was updated to always return the @@ -193,14 +201,9 @@ required to enable this function. The OPENSSL_cipher_name() function was added in OpenSSL 1.1.1. -=head1 SEE ALSO - -L, L, -L, L - =head1 COPYRIGHT -Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/SSL_CTX_new.pod b/doc/man3/SSL_CTX_new.pod index 371827d8..4b3e8ddb 100644 --- a/doc/man3/SSL_CTX_new.pod +++ b/doc/man3/SSL_CTX_new.pod @@ -190,6 +190,11 @@ SSL_CTX_up_ref() returns 1 for success and 0 for failure. =back +=head1 SEE ALSO + +L, L, L, +L, L, L + =head1 HISTORY Support for SSLv2 and the corresponding SSLv2_method(), @@ -198,18 +203,13 @@ removed in OpenSSL 1.1.0. SSLv23_method(), SSLv23_server_method() and SSLv23_client_method() were deprecated and the preferred TLS_method(), TLS_server_method() -and TLS_client_method() functions were introduced in OpenSSL 1.1.0. +and TLS_client_method() functions were added in OpenSSL 1.1.0. All version-specific methods were deprecated in OpenSSL 1.1.0. -=head1 SEE ALSO - -L, L, L, -L, L, L - =head1 COPYRIGHT -Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/SSL_CTX_set_default_passwd_cb.pod b/doc/man3/SSL_CTX_set_default_passwd_cb.pod index 4d381648..bc19890c 100644 --- a/doc/man3/SSL_CTX_set_default_passwd_cb.pod +++ b/doc/man3/SSL_CTX_set_default_passwd_cb.pod @@ -90,20 +90,20 @@ truncated. return strlen(buf); } +=head1 SEE ALSO + +L, +L + =head1 HISTORY SSL_CTX_get_default_passwd_cb(), SSL_CTX_get_default_passwd_cb_userdata(), SSL_set_default_passwd_cb() and SSL_set_default_passwd_cb_userdata() were added in OpenSSL 1.1.0. -=head1 SEE ALSO - -L, -L - =head1 COPYRIGHT -Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/SSL_CTX_set_min_proto_version.pod b/doc/man3/SSL_CTX_set_min_proto_version.pod index 32a47cf6..45f82107 100644 --- a/doc/man3/SSL_CTX_set_min_proto_version.pod +++ b/doc/man3/SSL_CTX_set_min_proto_version.pod @@ -52,18 +52,18 @@ lowest or highest protocol, respectively. All these functions are implemented using macros. +=head1 SEE ALSO + +L, L + =head1 HISTORY The setter functions were added in OpenSSL 1.1.0. The getter functions were added in OpenSSL 1.1.1. -=head1 SEE ALSO - -L, L - =head1 COPYRIGHT -Copyright 2016 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2016-2019 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/SSL_CTX_set_split_send_fragment.pod b/doc/man3/SSL_CTX_set_split_send_fragment.pod index cf595eef..5f0ff3f7 100644 --- a/doc/man3/SSL_CTX_set_split_send_fragment.pod +++ b/doc/man3/SSL_CTX_set_split_send_fragment.pod @@ -162,6 +162,10 @@ SSL_set_default_read_buffer_len(), SSL_CTX_set_tlsext_max_fragment_length(), SSL_set_tlsext_max_fragment_length() and SSL_SESSION_get_max_fragment_length() all these functions are implemented using macros. +=head1 SEE ALSO + +L, L + =head1 HISTORY The SSL_CTX_set_max_pipelines(), SSL_set_max_pipelines(), @@ -172,13 +176,9 @@ functions were added in OpenSSL 1.1.0. The SSL_CTX_set_tlsext_max_fragment_length(), SSL_set_tlsext_max_fragment_length() and SSL_SESSION_get_max_fragment_length() functions were added in OpenSSL 1.1.1. -=head1 SEE ALSO - -L, L - =head1 COPYRIGHT -Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2016-2019 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/SSL_read.pod b/doc/man3/SSL_read.pod index c60bd230..f5c02a35 100644 --- a/doc/man3/SSL_read.pod +++ b/doc/man3/SSL_read.pod @@ -126,10 +126,6 @@ You should instead call SSL_get_error() to find out if it's retryable. =back -=head1 HISTORY - -The SSL_read_ex() and SSL_peek_ex() functions were added in OpenSSL 1.1.1. - =head1 SEE ALSO L, L, @@ -140,9 +136,13 @@ L, L, L, L, L +=head1 HISTORY + +The SSL_read_ex() and SSL_peek_ex() functions were added in OpenSSL 1.1.1. + =head1 COPYRIGHT -Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/SSL_write.pod b/doc/man3/SSL_write.pod index 4daaec2d..a73bc062 100644 --- a/doc/man3/SSL_write.pod +++ b/doc/man3/SSL_write.pod @@ -104,10 +104,6 @@ You should instead call SSL_get_error() to find out if it's retryable. =back -=head1 HISTORY - -The SSL_write_ex() function was added in OpenSSL 1.1.1. - =head1 SEE ALSO L, L, L @@ -116,9 +112,13 @@ L, L L, L, L +=head1 HISTORY + +The SSL_write_ex() function was added in OpenSSL 1.1.1. + =head1 COPYRIGHT -Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/X509_get0_sm2_id.pod b/doc/man3/X509_get0_sm2_id.pod index 84da71e8..9698c869 100644 --- a/doc/man3/X509_get0_sm2_id.pod +++ b/doc/man3/X509_get0_sm2_id.pod @@ -2,20 +2,24 @@ =head1 NAME -X509_get0_sm2_id, X509_set_sm2_id - get or set SM2 ID for certificate operations +X509_get0_sm2_id, X509_set0_sm2_id - get or set SM2 ID for certificate operations =head1 SYNOPSIS #include ASN1_OCTET_STRING *X509_get0_sm2_id(X509 *x); - void X509_set_sm2_id(X509 *x, ASN1_OCTET_STRING *sm2_id); + void X509_set0_sm2_id(X509 *x, ASN1_OCTET_STRING *sm2_id); =head1 DESCRIPTION X509_get0_sm2_id() gets the ID value of an SM2 certificate B by returning an B object which should not be freed by the caller. -X509_set_sm2_id() sets the B value to an SM2 certificate B. + +X509_set0_sm2_id() sets the B value to an SM2 certificate B. Calling +this function transfers the memory management of the value to the X509 object, +and therefore the value that has been passed in should not be freed by the +caller after this function has been called. =head1 NOTES @@ -25,7 +29,7 @@ ability to set and retrieve the SM2 ID value. =head1 RETURN VALUES -X509_set_sm2_id() does not return a value. +X509_set0_sm2_id() does not return a value. =head1 SEE ALSO diff --git a/doc/man3/X509_get_subject_name.pod b/doc/man3/X509_get_subject_name.pod index 21bb4030..8c9d854b 100644 --- a/doc/man3/X509_get_subject_name.pod +++ b/doc/man3/X509_get_subject_name.pod @@ -48,14 +48,6 @@ and X509_CRL_get_issuer() return an B pointer. X509_set_subject_name(), X509_set_issuer_name(), X509_REQ_set_subject_name() and X509_CRL_set_issuer_name() return 1 for success and 0 for failure. -=head1 HISTORY - -X509_REQ_get_subject_name() is a function in OpenSSL 1.1.0 and a macro in -earlier versions. - -X509_CRL_get_issuer() is a function in OpenSSL 1.1.0. It was previously -added in OpenSSL 1.0.0 as a macro. - =head1 SEE ALSO L, @@ -74,9 +66,17 @@ L, L, L +=head1 HISTORY + +X509_REQ_get_subject_name() is a function in OpenSSL 1.1.0 and a macro in +earlier versions. + +X509_CRL_get_issuer() is a function in OpenSSL 1.1.0. It was previously +added in OpenSSL 1.0.0 as a macro. + =head1 COPYRIGHT -Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2015-2019 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man5/config.pod b/doc/man5/config.pod index 3d0842c4..cac4ef67 100644 --- a/doc/man5/config.pod +++ b/doc/man5/config.pod @@ -106,6 +106,7 @@ section containing configuration module specific information. E.g.: oid_section = new_oids engines = engine_section + providers = provider_section [new_oids] @@ -115,6 +116,10 @@ section containing configuration module specific information. E.g.: ... engine stuff here ... + [provider_section] + + ... provider stuff here ... + The features of each configuration module are described below. =head2 ASN1 Object Configuration Module @@ -216,14 +221,86 @@ For example: # Supply all default algorithms default_algorithms = ALL +=head2 Provider Configuration Module + +This provider configuration module has the name B. The +value of this variable points to a section containing further provider +configuration information. + +The section pointed to by B is a table of provider names +(though see B below) and further sections containing +configuration information specific to each provider module. + +Each provider specific section is used to load its module, perform +activation and set parameters to pass to the provider on demand. The +actual operation performed depends on the name of the name value pair. +The currently supported commands are listed below. + +For example: + + [provider_section] + + # Configure provider named "foo" + foo = foo_section + # Configure provider named "bar" + bar = bar_section + + [foo_section] + ... "foo" provider specific parameters ... + + [bar_section] + ... "bar" provider specific parameters ... + +The command B is used to give the provider name. For example: + + [provider_section] + # This would normally handle a provider named "foo" + foo = foo_section + + [foo_section] + # Override default name and use "myfoo" instead. + identity = myfoo + +The parameter B loads and adds a provider module from the +given module path. That path may be a simple file name, a relative +path or an absolute path. + +The parameter B determines whether to activate the +provider. The value has no importance, the presence of the parameter +is enough for activation to take place. + +All parameters in the section as well as sub-sections are made +available to the provider. + =head2 EVP Configuration Module -This modules has the name B which points to a section containing +This module has the name B which points to a section containing algorithm commands. -Currently the only algorithm command supported is B whose -value can only be the boolean string B. If B is set to B, -an error occurs as this library version is not FIPS capable. +The supported algorithm commands are: + +=over 4 + +=item B + +The value may be anything that is acceptable as a property query +string for EVP_set_default_properties(). + +=item B (deprecated) + +The value is a boolean that can be B or B. If the value is +B, this is exactly equivalent to: + + default_properties = fips=yes + +If the value is B, nothing happens. + +=back + +These two commands should not be used together, as there is no control +over how they affect each other. +The use of B is strongly discouraged and is only present +for backward compatibility with earlier OpenSSL FIPS modules. =head2 SSL Configuration Module @@ -405,6 +482,11 @@ Ignored in set-user-ID and set-group-ID programs. The path to the engines directory. Ignored in set-user-ID and set-group-ID programs. +=item B + +The path to the directory with OpenSSL modules, such as providers. +Ignored in set-user-ID and set-group-ID programs. + =back =head1 BUGS diff --git a/doc/man7/RAND_DRBG.pod b/doc/man7/RAND_DRBG.pod index f3fa605e..48d4ace0 100644 --- a/doc/man7/RAND_DRBG.pod +++ b/doc/man7/RAND_DRBG.pod @@ -192,9 +192,10 @@ I parameter to 1 when calling L. The document [NIST SP 800-90C] describes prediction resistance requests in detail and imposes strict conditions on the entropy sources that are approved for providing prediction resistance. -Since the default DRBG implementation does not have access to such an approved -entropy source, a request for prediction resistance will currently always fail. -In other words, prediction resistance is currently not supported yet by the DRBG. +A request for prediction resistance can only be satisfied by pulling fresh +entropy from a live entropy source (section 5.5.2 of [NIST SP 800-90C]). +It is up to the user to ensure that a live entropy source is configured +and is being used. For the three shared DRBGs (and only for these) there is another way to diff --git a/engines/build.info b/engines/build.info index 16907da5..3189f9f3 100644 --- a/engines/build.info +++ b/engines/build.info @@ -21,7 +21,7 @@ IF[{- !$disabled{"engine"} -}] DEPEND[padlock]=../libcrypto INCLUDE[padlock]=../include IF[{- defined $target{shared_defflag} -}] - SHARED_SOURCE[padlock]=padlock.ld + SOURCE[padlock]=padlock.ld GENERATE[padlock.ld]=../util/engines.num ENDIF ENDIF @@ -31,7 +31,7 @@ IF[{- !$disabled{"engine"} -}] DEPEND[capi]=../libcrypto INCLUDE[capi]=../include IF[{- defined $target{shared_defflag} -}] - SHARED_SOURCE[capi]=capi.ld + SOURCE[capi]=capi.ld GENERATE[capi.ld]=../util/engines.num ENDIF ENDIF @@ -41,7 +41,7 @@ IF[{- !$disabled{"engine"} -}] DEPEND[afalg]=../libcrypto INCLUDE[afalg]= ../include IF[{- defined $target{shared_defflag} -}] - SHARED_SOURCE[afalg]=afalg.ld + SOURCE[afalg]=afalg.ld GENERATE[afalg.ld]=../util/engines.num ENDIF ENDIF @@ -51,7 +51,7 @@ IF[{- !$disabled{"engine"} -}] DEPEND[devcrypto]=../libcrypto INCLUDE[devcrypto]=../include IF[{- defined $target{shared_defflag} -}] - SHARED_SOURCE[devcrypto]=devcrypto.ld + SOURCE[devcrypto]=devcrypto.ld GENERATE[devcrypto.ld]=../util/engines.num ENDIF ENDIF @@ -61,14 +61,14 @@ IF[{- !$disabled{"engine"} -}] DEPEND[dasync]=../libcrypto INCLUDE[dasync]=../include IF[{- defined $target{shared_defflag} -}] - SHARED_SOURCE[dasync]=dasync.ld + SOURCE[dasync]=dasync.ld GENERATE[dasync.ld]=../util/engines.num ENDIF SOURCE[ossltest]=e_ossltest.c DEPEND[ossltest]=../libcrypto INCLUDE[ossltest]=../include IF[{- defined $target{shared_defflag} -}] - SHARED_SOURCE[ossltest]=ossltest.ld + SOURCE[ossltest]=ossltest.ld GENERATE[ossltest.ld]=../util/engines.num ENDIF ENDIF diff --git a/include/internal/bio.h b/include/internal/bio.h index 1e80d5ac..8f368e36 100644 --- a/include/internal/bio.h +++ b/include/internal/bio.h @@ -35,35 +35,38 @@ void bio_cleanup(void); int bwrite_conv(BIO *bio, const char *data, size_t datal, size_t *written); int bread_conv(BIO *bio, char *data, size_t datal, size_t *read); -# define BIO_CTRL_SET_KTLS_SEND 72 -# define BIO_CTRL_SET_KTLS_SEND_CTRL_MSG 74 -# define BIO_CTRL_CLEAR_KTLS_CTRL_MSG 75 +/* Changes to these internal BIOs must also update include/openssl/bio.h */ +# define BIO_CTRL_SET_KTLS 72 +# define BIO_CTRL_SET_KTLS_TX_SEND_CTRL_MSG 74 +# define BIO_CTRL_CLEAR_KTLS_TX_CTRL_MSG 75 /* * This is used with socket BIOs: - * BIO_FLAGS_KTLS means we are using ktls with this BIO. - * BIO_FLAGS_KTLS_CTRL_MSG means we are about to send a ctrl message next. + * BIO_FLAGS_KTLS_TX means we are using ktls with this BIO for sending. + * BIO_FLAGS_KTLS_TX_CTRL_MSG means we are about to send a ctrl message next. + * BIO_FLAGS_KTLS_RX means we are using ktls with this BIO for receiving. */ -# define BIO_FLAGS_KTLS 0x800 -# define BIO_FLAGS_KTLS_CTRL_MSG 0x1000 +# define BIO_FLAGS_KTLS_TX 0x800 +# define BIO_FLAGS_KTLS_TX_CTRL_MSG 0x1000 +# define BIO_FLAGS_KTLS_RX 0x2000 /* KTLS related controls and flags */ -# define BIO_set_ktls_flag(b) \ - BIO_set_flags(b, BIO_FLAGS_KTLS) -# define BIO_should_ktls_flag(b) \ - BIO_test_flags(b, BIO_FLAGS_KTLS) +# define BIO_set_ktls_flag(b, is_tx) \ + BIO_set_flags(b, (is_tx) ? BIO_FLAGS_KTLS_TX : BIO_FLAGS_KTLS_RX) +# define BIO_should_ktls_flag(b, is_tx) \ + BIO_test_flags(b, (is_tx) ? BIO_FLAGS_KTLS_TX : BIO_FLAGS_KTLS_RX) # define BIO_set_ktls_ctrl_msg_flag(b) \ - BIO_set_flags(b, BIO_FLAGS_KTLS_CTRL_MSG) + BIO_set_flags(b, BIO_FLAGS_KTLS_TX_CTRL_MSG) # define BIO_should_ktls_ctrl_msg_flag(b) \ - BIO_test_flags(b, (BIO_FLAGS_KTLS_CTRL_MSG)) + BIO_test_flags(b, BIO_FLAGS_KTLS_TX_CTRL_MSG) # define BIO_clear_ktls_ctrl_msg_flag(b) \ - BIO_clear_flags(b, (BIO_FLAGS_KTLS_CTRL_MSG)) + BIO_clear_flags(b, BIO_FLAGS_KTLS_TX_CTRL_MSG) # define BIO_set_ktls(b, keyblob, is_tx) \ - BIO_ctrl(b, BIO_CTRL_SET_KTLS_SEND, is_tx, keyblob) + BIO_ctrl(b, BIO_CTRL_SET_KTLS, is_tx, keyblob) # define BIO_set_ktls_ctrl_msg(b, record_type) \ - BIO_ctrl(b, BIO_CTRL_SET_KTLS_SEND_CTRL_MSG, record_type, NULL) + BIO_ctrl(b, BIO_CTRL_SET_KTLS_TX_SEND_CTRL_MSG, record_type, NULL) # define BIO_clear_ktls_ctrl_msg(b) \ - BIO_ctrl(b, BIO_CTRL_CLEAR_KTLS_CTRL_MSG, 0, NULL) + BIO_ctrl(b, BIO_CTRL_CLEAR_KTLS_TX_CTRL_MSG, 0, NULL) #endif diff --git a/include/internal/core.h b/include/internal/core.h index b395025e..06a0775f 100644 --- a/include/internal/core.h +++ b/include/internal/core.h @@ -38,8 +38,8 @@ typedef struct ossl_method_construct_method_st { int (*put)(OPENSSL_CTX *libctx, void *store, const char *propdef, void *method, void *data); /* Construct a new method */ - void *(*construct)(const OSSL_DISPATCH *fns, OSSL_PROVIDER *prov, - void *data); + void *(*construct)(const char *algorithm_name, const OSSL_DISPATCH *fns, + OSSL_PROVIDER *prov, void *data); /* Destruct a method */ void (*destruct)(void *method, void *data); } OSSL_METHOD_CONSTRUCT_METHOD; diff --git a/include/internal/dsoerr.h b/include/internal/dsoerr.h index 3645aa5c..8347d854 100644 --- a/include/internal/dsoerr.h +++ b/include/internal/dsoerr.h @@ -17,11 +17,9 @@ # include -# ifndef OPENSSL_NO_DSO - -# ifdef __cplusplus +# ifdef __cplusplus extern "C" -# endif +# endif int ERR_load_DSO_strings(void); /* @@ -83,5 +81,4 @@ int ERR_load_DSO_strings(void); # define DSO_R_UNLOAD_FAILED 107 # define DSO_R_UNSUPPORTED 108 -# endif #endif diff --git a/include/internal/ktls.h b/include/internal/ktls.h index 23a0397a..5495a8de 100644 --- a/include/internal/ktls.h +++ b/include/internal/ktls.h @@ -21,10 +21,11 @@ # ifndef PEDANTIC # warning "KTLS requires Kernel Headers >= 4.13.0" -# warning "Skipping Compilation of KTLS data path" +# warning "Skipping Compilation of KTLS" # endif # define TLS_TX 1 +# define TLS_RX 2 # define TLS_CIPHER_AES_GCM_128 51 # define TLS_CIPHER_AES_GCM_128_IV_SIZE 8 @@ -67,11 +68,19 @@ static ossl_inline int ktls_send_ctrl_message(int fd, unsigned char record_type, return -1; } +static ossl_inline int ktls_read_record(int fd, void *data, size_t length) +{ + return -1; +} + # else /* KERNEL_VERSION */ # include # include # include +# include "openssl/ssl3.h" +# include "openssl/tls1.h" +# include "openssl/evp.h" # ifndef SOL_TLS # define SOL_TLS 282 @@ -96,16 +105,16 @@ static ossl_inline int ktls_enable(int fd) * The TLS_TX socket option changes the send/sendmsg handlers of the TCP socket. * If successful, then data sent using this socket will be encrypted and * encapsulated in TLS records using the crypto_info provided here. + * The TLS_RX socket option changes the recv/recvmsg handlers of the TCP socket. + * If successful, then data received using this socket will be decrypted, + * authenticated and decapsulated using the crypto_info provided here. */ static ossl_inline int ktls_start(int fd, struct tls12_crypto_info_aes_gcm_128 *crypto_info, size_t len, int is_tx) { - if (is_tx) - return setsockopt(fd, SOL_TLS, TLS_TX, crypto_info, - sizeof(*crypto_info)) ? 0 : 1; - else - return 0; + return setsockopt(fd, SOL_TLS, is_tx ? TLS_TX : TLS_RX, + crypto_info, sizeof(*crypto_info)) ? 0 : 1; } /* @@ -121,12 +130,15 @@ static ossl_inline int ktls_send_ctrl_message(int fd, unsigned char record_type, struct msghdr msg; int cmsg_len = sizeof(record_type); struct cmsghdr *cmsg; - char buf[CMSG_SPACE(cmsg_len)]; + union { + struct cmsghdr hdr; + char buf[CMSG_SPACE(sizeof(unsigned char))]; + } cmsgbuf; struct iovec msg_iov; /* Vector of data to send/receive into */ memset(&msg, 0, sizeof(msg)); - msg.msg_control = buf; - msg.msg_controllen = sizeof(buf); + msg.msg_control = cmsgbuf.buf; + msg.msg_controllen = sizeof(cmsgbuf.buf); cmsg = CMSG_FIRSTHDR(&msg); cmsg->cmsg_level = SOL_TLS; cmsg->cmsg_type = TLS_SET_RECORD_TYPE; @@ -142,7 +154,76 @@ static ossl_inline int ktls_send_ctrl_message(int fd, unsigned char record_type, return sendmsg(fd, &msg, 0); } -# endif /* KERNEL_VERSION */ -# endif /* OPENSSL_SYS_LINUX */ -# endif /* HEADER_INTERNAL_KTLS */ -#endif /* OPENSSL_NO_KTLS */ +# define K_MIN1_RX 17 +# if LINUX_VERSION_CODE < KERNEL_VERSION(K_MAJ, K_MIN1_RX, K_MIN2) + +# ifndef PEDANTIC +# warning "KTLS requires Kernel Headers >= 4.17.0 for receiving" +# warning "Skipping Compilation of KTLS receive data path" +# endif + +static ossl_inline int ktls_read_record(int fd, void *data, size_t length) +{ + return -1; +} + +# else + +/* + * Receive a TLS record using the crypto_info provided in ktls_start. + * The kernel strips the TLS record header, IV and authentication tag, + * returning only the plaintext data or an error on failure. + * We add the TLS record header here to satisfy routines in rec_layer_s3.c + */ +static ossl_inline int ktls_read_record(int fd, void *data, size_t length) +{ + struct msghdr msg; + struct cmsghdr *cmsg; + union { + struct cmsghdr hdr; + char buf[CMSG_SPACE(sizeof(unsigned char))]; + } cmsgbuf; + struct iovec msg_iov; + int ret; + unsigned char *p = data; + const size_t prepend_length = SSL3_RT_HEADER_LENGTH; + + if (length < prepend_length + EVP_GCM_TLS_TAG_LEN) { + errno = EINVAL; + return -1; + } + + memset(&msg, 0, sizeof(msg)); + msg.msg_control = cmsgbuf.buf; + msg.msg_controllen = sizeof(cmsgbuf.buf); + + msg_iov.iov_base = p + prepend_length; + msg_iov.iov_len = length - prepend_length - EVP_GCM_TLS_TAG_LEN; + msg.msg_iov = &msg_iov; + msg.msg_iovlen = 1; + + ret = recvmsg(fd, &msg, 0); + if (ret < 0) + return ret; + + if (msg.msg_controllen > 0) { + cmsg = CMSG_FIRSTHDR(&msg); + if (cmsg->cmsg_type == TLS_GET_RECORD_TYPE) { + p[0] = *((unsigned char *)CMSG_DATA(cmsg)); + p[1] = TLS1_2_VERSION_MAJOR; + p[2] = TLS1_2_VERSION_MINOR; + /* returned length is limited to msg_iov.iov_len above */ + p[3] = (ret >> 8) & 0xff; + p[4] = ret & 0xff; + ret += prepend_length; + } + } + + return ret; +} + +# endif +# endif +# endif +# endif +#endif diff --git a/include/internal/provider.h b/include/internal/provider.h index 8af20a7c..4966cc25 100644 --- a/include/internal/provider.h +++ b/include/internal/provider.h @@ -33,8 +33,10 @@ int ossl_provider_upref(OSSL_PROVIDER *prov); void ossl_provider_free(OSSL_PROVIDER *prov); /* Setters */ -int ossl_provider_add_module_location(OSSL_PROVIDER *prov, const char *loc); int ossl_provider_set_fallback(OSSL_PROVIDER *prov); +int ossl_provider_set_module_path(OSSL_PROVIDER *prov, const char *module_path); +int ossl_provider_add_parameter(OSSL_PROVIDER *prov, const char *name, + const char *value); /* * Activate the Provider @@ -64,6 +66,9 @@ const OSSL_ALGORITHM *ossl_provider_query_operation(const OSSL_PROVIDER *prov, int operation_id, int *no_cache); +/* Configuration */ +void ossl_provider_add_conf_module(void); + # ifdef __cplusplus } # endif diff --git a/include/internal/refcount.h b/include/internal/refcount.h index f74f7941..eddf1241 100644 --- a/include/internal/refcount.h +++ b/include/internal/refcount.h @@ -106,7 +106,7 @@ static __inline int CRYPTO_DOWN_REF(volatile int *val, int *ret, void *lock) # if _WIN32_WCE >= 0x600 extern long __cdecl _InterlockedExchangeAdd(long volatile*, long); # else - // under Windows CE we still have old-style Interlocked* functions + /* under Windows CE we still have old-style Interlocked* functions */ extern long __cdecl InterlockedExchangeAdd(long volatile*, long); # define _InterlockedExchangeAdd InterlockedExchangeAdd # endif diff --git a/include/openssl/aes.h b/include/openssl/aes.h index e0e5ff3b..060aa0f6 100644 --- a/include/openssl/aes.h +++ b/include/openssl/aes.h @@ -67,6 +67,7 @@ void AES_cfb8_encrypt(const unsigned char *in, unsigned char *out, void AES_ofb128_encrypt(const unsigned char *in, unsigned char *out, size_t length, const AES_KEY *key, unsigned char *ivec, int *num); +# if !OPENSSL_API_3 /* NB: the IV is _two_ blocks long */ void AES_ige_encrypt(const unsigned char *in, unsigned char *out, size_t length, const AES_KEY *key, @@ -76,6 +77,7 @@ void AES_bi_ige_encrypt(const unsigned char *in, unsigned char *out, size_t length, const AES_KEY *key, const AES_KEY *key2, const unsigned char *ivec, const int enc); +# endif int AES_wrap_key(AES_KEY *key, const unsigned char *iv, unsigned char *out, diff --git a/include/openssl/bio.h b/include/openssl/bio.h index ed9d4895..85cbe0ae 100644 --- a/include/openssl/bio.h +++ b/include/openssl/bio.h @@ -145,15 +145,20 @@ extern "C" { # define BIO_CTRL_DGRAM_SET_PEEK_MODE 71 -/* internal BIO see include/internal/bio.h: +/* + * internal BIO see include/internal/bio.h: * # define BIO_CTRL_SET_KTLS_SEND 72 * # define BIO_CTRL_SET_KTLS_SEND_CTRL_MSG 74 - * # define BIO_CTRL_CLEAR_KTLS_CTRL_MSG 75 + * # define BIO_CTRL_CLEAR_KTLS_CTRL_MSG 75 */ # define BIO_CTRL_GET_KTLS_SEND 73 +# define BIO_CTRL_GET_KTLS_RECV 76 + # define BIO_get_ktls_send(b) \ BIO_ctrl(b, BIO_CTRL_GET_KTLS_SEND, 0, NULL) +# define BIO_get_ktls_recv(b) \ + BIO_ctrl(b, BIO_CTRL_GET_KTLS_RECV, 0, NULL) /* modifiers */ # define BIO_FP_READ 0x02 diff --git a/include/openssl/core_numbers.h b/include/openssl/core_numbers.h index a7238547..1e536277 100644 --- a/include/openssl/core_numbers.h +++ b/include/openssl/core_numbers.h @@ -84,6 +84,7 @@ OSSL_CORE_MAKE_FUNC(const OSSL_ALGORITHM *,provider_query_operation, # define OSSL_FUNC_DIGEST_FREECTX 6 # define OSSL_FUNC_DIGEST_DUPCTX 7 # define OSSL_FUNC_DIGEST_SIZE 8 +# define OSSL_FUNC_DIGEST_BLOCK_SIZE 9 OSSL_CORE_MAKE_FUNC(void *, OP_digest_newctx, (void)) OSSL_CORE_MAKE_FUNC(int, OP_digest_init, (void *vctx)) @@ -98,6 +99,7 @@ OSSL_CORE_MAKE_FUNC(void, OP_digest_cleanctx, (void *vctx)) OSSL_CORE_MAKE_FUNC(void, OP_digest_freectx, (void *vctx)) OSSL_CORE_MAKE_FUNC(void *, OP_digest_dupctx, (void *vctx)) OSSL_CORE_MAKE_FUNC(size_t, OP_digest_size, (void)) +OSSL_CORE_MAKE_FUNC(size_t, OP_digest_block_size, (void)) # ifdef __cplusplus } diff --git a/include/openssl/cryptoerr.h b/include/openssl/cryptoerr.h index b38b272a..ff5767a1 100644 --- a/include/openssl/cryptoerr.h +++ b/include/openssl/cryptoerr.h @@ -45,11 +45,15 @@ int ERR_load_CRYPTO_strings(void); # define CRYPTO_F_OPENSSL_SK_DUP 128 # define CRYPTO_F_OSSL_PROVIDER_ADD_BUILTIN 132 # define CRYPTO_F_OSSL_PROVIDER_ACTIVATE 130 +# define CRYPTO_F_OSSL_PROVIDER_ADD_PARAMETER 139 # define CRYPTO_F_OSSL_PROVIDER_NEW 131 +# define CRYPTO_F_OSSL_PROVIDER_SET_MODULE_PATH 140 # define CRYPTO_F_PKEY_HMAC_INIT 123 # define CRYPTO_F_PKEY_POLY1305_INIT 124 # define CRYPTO_F_PKEY_SIPHASH_INIT 125 # define CRYPTO_F_PROVIDER_ACTIVATE 134 +# define CRYPTO_F_PROVIDER_CONF_INIT 137 +# define CRYPTO_F_PROVIDER_CONF_LOAD 138 # define CRYPTO_F_PROVIDER_NEW 135 # define CRYPTO_F_PROVIDER_STORE_NEW 136 # define CRYPTO_F_SK_RESERVE 129 @@ -61,5 +65,6 @@ int ERR_load_CRYPTO_strings(void); # define CRYPTO_R_ILLEGAL_HEX_DIGIT 102 # define CRYPTO_R_ODD_NUMBER_OF_DIGITS 103 # define CRYPTO_R_PROVIDER_ALREADY_EXISTS 104 +# define CRYPTO_R_PROVIDER_SECTION_ERROR 105 #endif diff --git a/include/openssl/ec.h b/include/openssl/ec.h index 8d4d1b19..af559cb2 100644 --- a/include/openssl/ec.h +++ b/include/openssl/ec.h @@ -422,6 +422,7 @@ size_t EC_get_builtin_curves(EC_builtin_curve *r, size_t nitems); const char *EC_curve_nid2nist(int nid); int EC_curve_nist2nid(const char *name); +int EC_GROUP_check_named_curve(const EC_GROUP *group, int nist_only); /********************************************************************/ /* EC_POINT functions */ diff --git a/include/openssl/evp.h b/include/openssl/evp.h index 52319cc4..059a38eb 100644 --- a/include/openssl/evp.h +++ b/include/openssl/evp.h @@ -69,6 +69,8 @@ extern "C" { #endif +int EVP_set_default_properties(OPENSSL_CTX *libctx, const char *propq); + # define EVP_PKEY_MO_SIGN 0x0001 # define EVP_PKEY_MO_VERIFY 0x0002 # define EVP_PKEY_MO_ENCRYPT 0x0004 diff --git a/include/openssl/evperr.h b/include/openssl/evperr.h index 598930af..e62cfb3b 100644 --- a/include/openssl/evperr.h +++ b/include/openssl/evperr.h @@ -24,12 +24,16 @@ int ERR_load_EVP_strings(void); * EVP function codes. */ # define EVP_F_AESNI_INIT_KEY 165 +# define EVP_F_AESNI_XTS_INIT_KEY 233 # define EVP_F_AES_GCM_CTRL 196 # define EVP_F_AES_GCM_TLS_CIPHER 207 # define EVP_F_AES_INIT_KEY 133 # define EVP_F_AES_OCB_CIPHER 169 # define EVP_F_AES_T4_INIT_KEY 178 +# define EVP_F_AES_T4_XTS_INIT_KEY 234 # define EVP_F_AES_WRAP_CIPHER 170 +# define EVP_F_AES_XTS_CIPHER 229 +# define EVP_F_AES_XTS_INIT_KEY 235 # define EVP_F_ALG_MODULE_INIT 177 # define EVP_F_ARIA_CCM_INIT_KEY 175 # define EVP_F_ARIA_GCM_CTRL 197 @@ -69,6 +73,7 @@ int ERR_load_EVP_strings(void); # define EVP_F_EVP_MAC_CTX_COPY 211 # define EVP_F_EVP_MAC_CTX_NEW 213 # define EVP_F_EVP_MAC_INIT 212 +# define EVP_F_EVP_MD_BLOCK_SIZE 232 # define EVP_F_EVP_MD_CTX_COPY_EX 110 # define EVP_F_EVP_MD_SIZE 162 # define EVP_F_EVP_OPENINIT 102 @@ -123,6 +128,7 @@ int ERR_load_EVP_strings(void); # define EVP_F_EVP_PKEY_VERIFY_INIT 143 # define EVP_F_EVP_PKEY_VERIFY_RECOVER 144 # define EVP_F_EVP_PKEY_VERIFY_RECOVER_INIT 145 +# define EVP_F_EVP_SET_DEFAULT_PROPERTIES 236 # define EVP_F_EVP_SIGNFINAL 107 # define EVP_F_EVP_VERIFYFINAL 108 # define EVP_F_GMAC_CTRL 215 @@ -225,5 +231,7 @@ int ERR_load_EVP_strings(void); # define EVP_R_UPDATE_ERROR 189 # define EVP_R_WRAP_MODE_NOT_ALLOWED 170 # define EVP_R_WRONG_FINAL_BLOCK_LENGTH 109 +# define EVP_R_XTS_DATA_UNIT_IS_TOO_LARGE 191 +# define EVP_R_XTS_DUPLICATED_KEYS 192 #endif diff --git a/include/openssl/params.h b/include/openssl/params.h index 10ed28d3..aea24bb2 100644 --- a/include/openssl/params.h +++ b/include/openssl/params.h @@ -132,11 +132,12 @@ OSSL_PARAM OSSL_PARAM_construct_double(const char *key, double *buf, OSSL_PARAM OSSL_PARAM_construct_utf8_string(const char *key, char *buf, size_t bsize, size_t *rsize); OSSL_PARAM OSSL_PARAM_construct_utf8_ptr(const char *key, char **buf, - size_t *rsize); + size_t bsize, size_t *rsize); OSSL_PARAM OSSL_PARAM_construct_octet_string(const char *key, void *buf, size_t bsize, size_t *rsize); OSSL_PARAM OSSL_PARAM_construct_octet_ptr(const char *key, void **buf, - size_t *rsize); + size_t bsize, size_t *rsize); +OSSL_PARAM OSSL_PARAM_construct_end(void); int OSSL_PARAM_get_int(const OSSL_PARAM *p, int *val); int OSSL_PARAM_get_uint(const OSSL_PARAM *p, unsigned int *val); diff --git a/include/openssl/randerr.h b/include/openssl/randerr.h index 26c20ae9..bc1c0639 100644 --- a/include/openssl/randerr.h +++ b/include/openssl/randerr.h @@ -24,6 +24,7 @@ int ERR_load_RAND_strings(void); * RAND function codes. */ # define RAND_F_DRBG_BYTES 101 +# define RAND_F_DRBG_CTR_INIT 125 # define RAND_F_DRBG_GET_ENTROPY 105 # define RAND_F_DRBG_SETUP 117 # define RAND_F_GET_ENTROPY 106 @@ -56,6 +57,7 @@ int ERR_load_RAND_strings(void); # define RAND_R_ALREADY_INSTANTIATED 103 # define RAND_R_ARGUMENT_OUT_OF_RANGE 105 # define RAND_R_CANNOT_OPEN_FILE 121 +# define RAND_R_DERIVATION_FUNCTION_MANDATORY_FOR_FIPS 137 # define RAND_R_DRBG_ALREADY_INITIALIZED 129 # define RAND_R_DRBG_NOT_INITIALISED 104 # define RAND_R_ENTROPY_INPUT_TOO_LONG 106 diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h index 472bc029..b6be7c0e 100644 --- a/include/openssl/ssl.h +++ b/include/openssl/ssl.h @@ -501,7 +501,7 @@ typedef int (*SSL_async_callback_fn)(SSL *s, void *arg); */ # define SSL_MODE_ASYNC 0x00000100U /* - * Use the kernel TLS transmission data-path. + * Don't use the kernel TLS data-path for sending. */ # define SSL_MODE_NO_KTLS_TX 0x00000200U /* @@ -516,6 +516,10 @@ typedef int (*SSL_async_callback_fn)(SSL *s, void *arg); * - OpenSSL 1.1.1 and 1.1.1a */ # define SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG 0x00000400U +/* + * Don't use the kernel TLS data-path for receiving. + */ +# define SSL_MODE_NO_KTLS_RX 0x00000800U /* Cert related flags */ /* @@ -1506,6 +1510,7 @@ __owur SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth); int SSL_CTX_up_ref(SSL_CTX *ctx); void SSL_CTX_free(SSL_CTX *); __owur long SSL_CTX_set_timeout(SSL_CTX *ctx, long t); +__owur long SSL_CTX_set_timeout_tls13(SSL_CTX *ctx, long t); __owur long SSL_CTX_get_timeout(const SSL_CTX *ctx); __owur X509_STORE *SSL_CTX_get_cert_store(const SSL_CTX *); void SSL_CTX_set_cert_store(SSL_CTX *, X509_STORE *); diff --git a/include/openssl/trace.h b/include/openssl/trace.h index 48c98ca3..79598ab6 100644 --- a/include/openssl/trace.h +++ b/include/openssl/trace.h @@ -41,7 +41,7 @@ extern "C" { # define OSSL_TRACE_CATEGORY_INIT 2 # define OSSL_TRACE_CATEGORY_TLS 3 # define OSSL_TRACE_CATEGORY_TLS_CIPHER 4 -# define OSSL_TRACE_CATEGORY_ENGINE_CONF 5 +# define OSSL_TRACE_CATEGORY_CONF 5 # define OSSL_TRACE_CATEGORY_ENGINE_TABLE 6 # define OSSL_TRACE_CATEGORY_ENGINE_REF_COUNT 7 # define OSSL_TRACE_CATEGORY_PKCS5V2 8 diff --git a/include/openssl/x509.h b/include/openssl/x509.h index 4de88bd5..7f80da3c 100644 --- a/include/openssl/x509.h +++ b/include/openssl/x509.h @@ -567,7 +567,7 @@ void X509_get0_signature(const ASN1_BIT_STRING **psig, int X509_get_signature_nid(const X509 *x); # ifndef OPENSSL_NO_SM2 -void X509_set_sm2_id(X509 *x, ASN1_OCTET_STRING *sm2_id); +void X509_set0_sm2_id(X509 *x, ASN1_OCTET_STRING *sm2_id); ASN1_OCTET_STRING *X509_get0_sm2_id(X509 *x); # endif diff --git a/providers/build.info b/providers/build.info index ec4162bd..1628e1fe 100644 --- a/providers/build.info +++ b/providers/build.info @@ -1 +1,23 @@ SUBDIRS=common default + +IF[{- !$disabled{fips} -}] + SUBDIRS=fips + MODULES=fips + IF[{- defined $target{shared_defflag} -}] + SOURCE[fips]=fips.ld + GENERATE[fips.ld]=../util/providers.num + ENDIF + INCLUDE[fips]=.. ../include ../crypto/include + DEFINE[fips]=FIPS_MODE +ENDIF + +IF[{- !$disabled{legacy} -}] + SUBDIRS=legacy + MODULES=legacy + IF[{- defined $target{shared_defflag} -}] + SOURCE[legacy]=legacy.ld + GENERATE[legacy.ld]=../util/providers.num + ENDIF + INCLUDE[legacy]=.. ../include ../crypto/include + DEPEND[legacy]=../libcrypto +ENDIF diff --git a/providers/common/digests/build.info b/providers/common/digests/build.info index a3c2369f..b98df29f 100644 --- a/providers/common/digests/build.info +++ b/providers/common/digests/build.info @@ -1,3 +1,5 @@ -LIBS=../../../libcrypto SOURCE[../../../libcrypto]=\ sha2.c + +SOURCE[../../fips]=\ + sha2.c diff --git a/providers/common/digests/sha2.c b/providers/common/digests/sha2.c index b538ab9c..4332e981 100644 --- a/providers/common/digests/sha2.c +++ b/providers/common/digests/sha2.c @@ -50,6 +50,11 @@ static size_t sha256_size(void) return SHA256_DIGEST_LENGTH; } +static size_t sha256_block_size(void) +{ + return SHA256_CBLOCK; +} + extern const OSSL_DISPATCH sha256_functions[]; const OSSL_DISPATCH sha256_functions[] = { { OSSL_FUNC_DIGEST_NEWCTX, (void (*)(void))sha256_newctx }, @@ -59,5 +64,6 @@ const OSSL_DISPATCH sha256_functions[] = { { OSSL_FUNC_DIGEST_FREECTX, (void (*)(void))sha256_freectx }, { OSSL_FUNC_DIGEST_DUPCTX, (void (*)(void))sha256_dupctx }, { OSSL_FUNC_DIGEST_SIZE, (void (*)(void))sha256_size }, + { OSSL_FUNC_DIGEST_BLOCK_SIZE, (void (*)(void))sha256_block_size }, { 0, NULL } }; diff --git a/providers/fips/build.info b/providers/fips/build.info new file mode 100644 index 00000000..93720622 --- /dev/null +++ b/providers/fips/build.info @@ -0,0 +1,2 @@ + +SOURCE[../fips]=fipsprov.c diff --git a/providers/fips/fipsprov.c b/providers/fips/fipsprov.c new file mode 100644 index 00000000..d3671b5a --- /dev/null +++ b/providers/fips/fipsprov.c @@ -0,0 +1,99 @@ +/* + * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include +#include +#include +#include +#include +#include + +/* Functions provided by the core */ +static OSSL_core_get_param_types_fn *c_get_param_types = NULL; +static OSSL_core_get_params_fn *c_get_params = NULL; + +/* Parameters we provide to the core */ +static const OSSL_ITEM fips_param_types[] = { + { OSSL_PARAM_UTF8_PTR, OSSL_PROV_PARAM_NAME }, + { OSSL_PARAM_UTF8_PTR, OSSL_PROV_PARAM_VERSION }, + { OSSL_PARAM_UTF8_PTR, OSSL_PROV_PARAM_BUILDINFO }, + { 0, NULL } +}; + +static const OSSL_ITEM *fips_get_param_types(const OSSL_PROVIDER *prov) +{ + return fips_param_types; +} + +static int fips_get_params(const OSSL_PROVIDER *prov, + const OSSL_PARAM params[]) +{ + const OSSL_PARAM *p; + + p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_NAME); + if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, "OpenSSL FIPS Provider")) + return 0; + p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_VERSION); + if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, OPENSSL_VERSION_STR)) + return 0; + p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_BUILDINFO); + if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, OPENSSL_FULL_VERSION_STR)) + return 0; + + return 1; +} + +extern const OSSL_DISPATCH sha256_functions[]; + +static const OSSL_ALGORITHM fips_digests[] = { + { "SHA256", "fips=yes", sha256_functions }, + { NULL, NULL, NULL } +}; + +static const OSSL_ALGORITHM *fips_query(OSSL_PROVIDER *prov, + int operation_id, + int *no_cache) +{ + *no_cache = 0; + switch (operation_id) { + case OSSL_OP_DIGEST: + return fips_digests; + } + return NULL; +} + +/* Functions we provide to the core */ +static const OSSL_DISPATCH fips_dispatch_table[] = { + { OSSL_FUNC_PROVIDER_GET_PARAM_TYPES, (void (*)(void))fips_get_param_types }, + { OSSL_FUNC_PROVIDER_GET_PARAMS, (void (*)(void))fips_get_params }, + { OSSL_FUNC_PROVIDER_QUERY_OPERATION, (void (*)(void))fips_query }, + { 0, NULL } +}; + +int OSSL_provider_init(const OSSL_PROVIDER *provider, + const OSSL_DISPATCH *in, + const OSSL_DISPATCH **out) +{ + for (; in->function_id != 0; in++) { + switch (in->function_id) { + case OSSL_FUNC_CORE_GET_PARAM_TYPES: + c_get_param_types = OSSL_get_core_get_param_types(in); + break; + case OSSL_FUNC_CORE_GET_PARAMS: + c_get_params = OSSL_get_core_get_params(in); + break; + /* Just ignore anything we don't understand */ + default: + break; + } + } + + *out = fips_dispatch_table; + return 1; +} diff --git a/providers/legacy/build.info b/providers/legacy/build.info new file mode 100644 index 00000000..df7e9ac7 --- /dev/null +++ b/providers/legacy/build.info @@ -0,0 +1,4 @@ +SUBDIRS=digests + +SOURCE[../legacy]=\ + legacyprov.c diff --git a/providers/legacy/digests/build.info b/providers/legacy/digests/build.info new file mode 100644 index 00000000..c4e1278a --- /dev/null +++ b/providers/legacy/digests/build.info @@ -0,0 +1,4 @@ +IF[{- !$disabled{md2} -}] + SOURCE[../../legacy]=\ + md2.c +ENDIF diff --git a/providers/legacy/digests/md2.c b/providers/legacy/digests/md2.c new file mode 100644 index 00000000..c941dd7d --- /dev/null +++ b/providers/legacy/digests/md2.c @@ -0,0 +1,63 @@ +/* + * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include +#include +#include + +static int md2_final(void *ctx, unsigned char *md, size_t *size) +{ + if (MD2_Final(md, ctx)) { + *size = MD2_DIGEST_LENGTH; + return 1; + } + + return 0; +} + +static void *md2_newctx(void) +{ + MD2_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx)); + + return ctx; +} + +static void md2_freectx(void *vctx) +{ + MD2_CTX *ctx = (MD2_CTX *)vctx; + + OPENSSL_clear_free(ctx, sizeof(*ctx)); +} + +static void *md2_dupctx(void *ctx) +{ + MD2_CTX *in = (MD2_CTX *)ctx; + MD2_CTX *ret = OPENSSL_malloc(sizeof(*ret)); + + *ret = *in; + + return ret; +} + +static size_t md2_size(void) +{ + return MD2_DIGEST_LENGTH; +} + +extern const OSSL_DISPATCH md2_functions[]; +const OSSL_DISPATCH md2_functions[] = { + { OSSL_FUNC_DIGEST_NEWCTX, (void (*)(void))md2_newctx }, + { OSSL_FUNC_DIGEST_INIT, (void (*)(void))MD2_Init }, + { OSSL_FUNC_DIGEST_UPDDATE, (void (*)(void))MD2_Update }, + { OSSL_FUNC_DIGEST_FINAL, (void (*)(void))md2_final }, + { OSSL_FUNC_DIGEST_FREECTX, (void (*)(void))md2_freectx }, + { OSSL_FUNC_DIGEST_DUPCTX, (void (*)(void))md2_dupctx }, + { OSSL_FUNC_DIGEST_SIZE, (void (*)(void))md2_size }, + { 0, NULL } +}; diff --git a/providers/legacy/legacyprov.c b/providers/legacy/legacyprov.c new file mode 100644 index 00000000..48e89338 --- /dev/null +++ b/providers/legacy/legacyprov.c @@ -0,0 +1,101 @@ +/* + * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include +#include +#include +#include +#include +#include + +/* Functions provided by the core */ +static OSSL_core_get_param_types_fn *c_get_param_types = NULL; +static OSSL_core_get_params_fn *c_get_params = NULL; + +/* Parameters we provide to the core */ +static const OSSL_ITEM legacy_param_types[] = { + { OSSL_PARAM_UTF8_PTR, OSSL_PROV_PARAM_NAME }, + { OSSL_PARAM_UTF8_PTR, OSSL_PROV_PARAM_VERSION }, + { OSSL_PARAM_UTF8_PTR, OSSL_PROV_PARAM_BUILDINFO }, + { 0, NULL } +}; + +static const OSSL_ITEM *legacy_get_param_types(const OSSL_PROVIDER *prov) +{ + return legacy_param_types; +} + +static int legacy_get_params(const OSSL_PROVIDER *prov, + const OSSL_PARAM params[]) +{ + const OSSL_PARAM *p; + + p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_NAME); + if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, "OpenSSL Legacy Provider")) + return 0; + p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_VERSION); + if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, OPENSSL_VERSION_STR)) + return 0; + p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_BUILDINFO); + if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, OPENSSL_FULL_VERSION_STR)) + return 0; + + return 1; +} + +extern const OSSL_DISPATCH md2_functions[]; + +static const OSSL_ALGORITHM legacy_digests[] = { +#ifndef OPENSSL_NO_MD2 + { "MD2", "legacy=yes", md2_functions }, +#endif + { NULL, NULL, NULL } +}; + +static const OSSL_ALGORITHM *legacy_query(OSSL_PROVIDER *prov, + int operation_id, + int *no_cache) +{ + *no_cache = 0; + switch (operation_id) { + case OSSL_OP_DIGEST: + return legacy_digests; + } + return NULL; +} + +/* Functions we provide to the core */ +static const OSSL_DISPATCH legacy_dispatch_table[] = { + { OSSL_FUNC_PROVIDER_GET_PARAM_TYPES, (void (*)(void))legacy_get_param_types }, + { OSSL_FUNC_PROVIDER_GET_PARAMS, (void (*)(void))legacy_get_params }, + { OSSL_FUNC_PROVIDER_QUERY_OPERATION, (void (*)(void))legacy_query }, + { 0, NULL } +}; + +int OSSL_provider_init(const OSSL_PROVIDER *provider, + const OSSL_DISPATCH *in, + const OSSL_DISPATCH **out) +{ + for (; in->function_id != 0; in++) { + switch (in->function_id) { + case OSSL_FUNC_CORE_GET_PARAM_TYPES: + c_get_param_types = OSSL_get_core_get_param_types(in); + break; + case OSSL_FUNC_CORE_GET_PARAMS: + c_get_params = OSSL_get_core_get_params(in); + break; + /* Just ignore anything we don't understand */ + default: + break; + } + } + + *out = legacy_dispatch_table; + return 1; +} diff --git a/ssl/record/rec_layer_s3.c b/ssl/record/rec_layer_s3.c index b2122776..8b2320d2 100644 --- a/ssl/record/rec_layer_s3.c +++ b/ssl/record/rec_layer_s3.c @@ -268,11 +268,15 @@ int ssl3_read_n(SSL *s, size_t n, size_t max, int extend, int clearold, return -1; } - /* We always act like read_ahead is set for DTLS */ - if (!s->rlayer.read_ahead && !SSL_IS_DTLS(s)) + /* + * Ktls always reads full records. + * Also, we always act like read_ahead is set for DTLS. + */ + if (!BIO_get_ktls_recv(s->rbio) && !s->rlayer.read_ahead + && !SSL_IS_DTLS(s)) { /* ignore max parameter */ max = n; - else { + } else { if (max < n) max = n; if (max > rb->len - rb->offset) diff --git a/ssl/record/ssl3_record.c b/ssl/record/ssl3_record.c index e1231d24..24694b3f 100644 --- a/ssl/record/ssl3_record.c +++ b/ssl/record/ssl3_record.c @@ -187,9 +187,11 @@ int ssl3_get_record(SSL *s) size_t num_recs = 0, max_recs, j; PACKET pkt, sslv2pkt; size_t first_rec_len; + int is_ktls_left; rr = RECORD_LAYER_get_rrec(&s->rlayer); rbuf = RECORD_LAYER_get_rbuf(&s->rlayer); + is_ktls_left = (rbuf->left > 0); max_recs = s->max_pipelines; if (max_recs == 0) max_recs = 1; @@ -208,8 +210,32 @@ int ssl3_get_record(SSL *s) rret = ssl3_read_n(s, SSL3_RT_HEADER_LENGTH, SSL3_BUFFER_get_len(rbuf), 0, num_recs == 0 ? 1 : 0, &n); - if (rret <= 0) - return rret; /* error or non-blocking */ + if (rret <= 0) { + if (!BIO_get_ktls_recv(s->rbio)) + return rret; /* error or non-blocking */ +#ifndef OPENSSL_NO_KTLS + switch (errno) { + case EBADMSG: + SSLfatal(s, SSL_AD_BAD_RECORD_MAC, + SSL_F_SSL3_GET_RECORD, + SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC); + break; + case EMSGSIZE: + SSLfatal(s, SSL_AD_RECORD_OVERFLOW, + SSL_F_SSL3_GET_RECORD, + SSL_R_PACKET_LENGTH_TOO_LONG); + break; + case EINVAL: + SSLfatal(s, SSL_AD_PROTOCOL_VERSION, + SSL_F_SSL3_GET_RECORD, + SSL_R_WRONG_VERSION_NUMBER); + break; + default: + break; + } + return rret; +#endif + } RECORD_LAYER_set_rstate(&s->rlayer, SSL_ST_READ_BODY); p = RECORD_LAYER_get_packet(&s->rlayer); @@ -387,7 +413,7 @@ int ssl3_get_record(SSL *s) len -= SSL3_RT_MAX_COMPRESSED_OVERHEAD; #endif - if (thisrr->length > len) { + if (thisrr->length > len && !BIO_get_ktls_recv(s->rbio)) { SSLfatal(s, SSL_AD_RECORD_OVERFLOW, SSL_F_SSL3_GET_RECORD, SSL_R_ENCRYPTED_LENGTH_TOO_LONG); return -1; @@ -405,6 +431,7 @@ int ssl3_get_record(SSL *s) } else { more = thisrr->length; } + if (more > 0) { /* now s->packet_length == SSL3_RT_HEADER_LENGTH */ @@ -492,6 +519,13 @@ int ssl3_get_record(SSL *s) return 1; } + /* + * KTLS reads full records. If there is any data left, + * then it is from before enabling ktls + */ + if (BIO_get_ktls_recv(s->rbio) && !is_ktls_left) + goto skip_decryption; + /* * If in encrypt-then-mac mode calculate mac from encrypted record. All * the details below are public so no timing details can leak. @@ -674,6 +708,8 @@ int ssl3_get_record(SSL *s) return -1; } + skip_decryption: + for (j = 0; j < num_recs; j++) { thisrr = &rr[j]; @@ -735,7 +771,7 @@ int ssl3_get_record(SSL *s) return -1; } - if (thisrr->length > SSL3_RT_MAX_PLAIN_LENGTH) { + if (thisrr->length > SSL3_RT_MAX_PLAIN_LENGTH && !BIO_get_ktls_recv(s->rbio)) { SSLfatal(s, SSL_AD_RECORD_OVERFLOW, SSL_F_SSL3_GET_RECORD, SSL_R_DATA_LENGTH_TOO_LONG); return -1; @@ -743,7 +779,8 @@ int ssl3_get_record(SSL *s) /* If received packet overflows current Max Fragment Length setting */ if (s->session != NULL && USE_MAX_FRAGMENT_LENGTH_EXT(s->session) - && thisrr->length > GET_MAX_FRAGMENT_LENGTH(s->session)) { + && thisrr->length > GET_MAX_FRAGMENT_LENGTH(s->session) + && !BIO_get_ktls_recv(s->rbio)) { SSLfatal(s, SSL_AD_RECORD_OVERFLOW, SSL_F_SSL3_GET_RECORD, SSL_R_DATA_LENGTH_TOO_LONG); return -1; diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h index f150613c..7fb3b651 100644 --- a/ssl/ssl_locl.h +++ b/ssl/ssl_locl.h @@ -810,6 +810,7 @@ struct ssl_ctx_st { * things up */ long session_timeout; + long session_timeout_tls13; /* * If this callback is not null, it will be called each time a session id * is added to the cache. If this function returns 1, it means that the @@ -1565,7 +1566,7 @@ typedef struct cert_pkey_st CERT_PKEY; * CERT_PKEY entries */ typedef struct { - int nid; /* NID of pubic key algorithm */ + int nid; /* NID of public key algorithm */ uint32_t amask; /* authmask corresponding to key type */ } SSL_CERT_LOOKUP; diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c index d04b4fab..29f631c4 100644 --- a/ssl/ssl_sess.c +++ b/ssl/ssl_sess.c @@ -400,10 +400,13 @@ int ssl_get_new_session(SSL *s, int session) } /* If the context has a default timeout, use it */ - if (s->session_ctx->session_timeout == 0) + if (s->session_ctx->session_timeout == 0 || s->session_ctx->session_timeout_tls13 == 0) ss->timeout = SSL_get_default_timeout(s); else - ss->timeout = s->session_ctx->session_timeout; + if (SSL_IS_TLS13(s)) + ss->timeout = s->session_ctx->session_timeout_tls13; + else + ss->timeout = s->session_ctx->session_timeout; SSL_SESSION_free(s->session); s->session = NULL; @@ -1024,11 +1027,24 @@ long SSL_CTX_set_timeout(SSL_CTX *s, long t) return l; } +long SSL_CTX_set_timeout_tls13(SSL_CTX *s, long t) +{ + long l; + if (s == NULL) + return 0; + l = s->session_timeout_tls13; + s->session_timeout_tls13 = t; + return l; +} + long SSL_CTX_get_timeout(const SSL_CTX *s) { if (s == NULL) return 0; - return s->session_timeout; + if (SSL_IS_TLS13(s) && s->session_timeout_tls13) + return s->session_timeout_tls13; + else + return s->session_timeout; } int SSL_set_session_secret_cb(SSL *s, diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c index fe4ba938..5925e6a1 100644 --- a/ssl/t1_enc.c +++ b/ssl/t1_enc.c @@ -83,6 +83,39 @@ static int tls1_generate_key_block(SSL *s, unsigned char *km, size_t num) return ret; } +#ifndef OPENSSL_NO_KTLS + /* + * Count the number of records that were not processed yet from record boundary. + * + * This function assumes that there are only fully formed records read in the + * record layer. If read_ahead is enabled, then this might be false and this + * function will fail. + */ +static int count_unprocessed_records(SSL *s) +{ + SSL3_BUFFER *rbuf = RECORD_LAYER_get_rbuf(&s->rlayer); + PACKET pkt, subpkt; + int count = 0; + + if (!PACKET_buf_init(&pkt, rbuf->buf + rbuf->offset, rbuf->left)) + return -1; + + while (PACKET_remaining(&pkt) > 0) { + /* Skip record type and version */ + if (!PACKET_forward(&pkt, 3)) + return -1; + + /* Read until next record */ + if (PACKET_get_length_prefixed_2(&pkt, &subpkt)) + return -1; + + count += 1; + } + + return count; +} +#endif + int tls1_change_cipher_state(SSL *s, int which) { unsigned char *p, *mac_secret; @@ -101,8 +134,10 @@ int tls1_change_cipher_state(SSL *s, int which) int reuse_dd = 0; #ifndef OPENSSL_NO_KTLS struct tls12_crypto_info_aes_gcm_128 crypto_info; - BIO *wbio; + BIO *bio; unsigned char geniv[12]; + int count_unprocessed; + int bit; #endif c = s->s3->tmp.new_sym_enc; @@ -326,8 +361,8 @@ int tls1_change_cipher_state(SSL *s, int which) if (s->compress) goto skip_ktls; - if ((which & SSL3_CC_READ) || - ((which & SSL3_CC_WRITE) && (s->mode & SSL_MODE_NO_KTLS_TX))) + if (((which & SSL3_CC_READ) && (s->mode & SSL_MODE_NO_KTLS_RX)) + || ((which & SSL3_CC_WRITE) && (s->mode & SSL_MODE_NO_KTLS_TX))) goto skip_ktls; /* ktls supports only the maximum fragment size */ @@ -344,19 +379,26 @@ int tls1_change_cipher_state(SSL *s, int which) if (s->version != TLS1_2_VERSION) goto skip_ktls; - wbio = s->wbio; - if (!ossl_assert(wbio != NULL)) { + if (which & SSL3_CC_WRITE) + bio = s->wbio; + else + bio = s->rbio; + + if (!ossl_assert(bio != NULL)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR); goto err; } /* All future data will get encrypted by ktls. Flush the BIO or skip ktls */ - if (BIO_flush(wbio) <= 0) - goto skip_ktls; + if (which & SSL3_CC_WRITE) { + if (BIO_flush(bio) <= 0) + goto skip_ktls; + } /* ktls doesn't support renegotiation */ - if (BIO_get_ktls_send(s->wbio)) { + if ((BIO_get_ktls_send(s->wbio) && (which & SSL3_CC_WRITE)) || + (BIO_get_ktls_recv(s->rbio) && (which & SSL3_CC_READ))) { SSLfatal(s, SSL_AD_NO_RENEGOTIATION, SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR); goto err; @@ -373,12 +415,33 @@ int tls1_change_cipher_state(SSL *s, int which) TLS_CIPHER_AES_GCM_128_IV_SIZE); memcpy(crypto_info.salt, geniv, TLS_CIPHER_AES_GCM_128_SALT_SIZE); memcpy(crypto_info.key, key, EVP_CIPHER_key_length(c)); - memcpy(crypto_info.rec_seq, &s->rlayer.write_sequence, - TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE); + if (which & SSL3_CC_WRITE) + memcpy(crypto_info.rec_seq, &s->rlayer.write_sequence, + TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE); + else + memcpy(crypto_info.rec_seq, &s->rlayer.read_sequence, + TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE); + + if (which & SSL3_CC_READ) { + count_unprocessed = count_unprocessed_records(s); + if (count_unprocessed < 0) + goto skip_ktls; + + /* increment the crypto_info record sequence */ + while (count_unprocessed) { + for (bit = 7; bit >= 0; bit--) { /* increment */ + ++crypto_info.rec_seq[bit]; + if (crypto_info.rec_seq[bit] != 0) + break; + } + count_unprocessed--; + } + } /* ktls works with user provided buffers directly */ - if (BIO_set_ktls(wbio, &crypto_info, which & SSL3_CC_WRITE)) { - ssl3_release_write_buffer(s); + if (BIO_set_ktls(bio, &crypto_info, which & SSL3_CC_WRITE)) { + if (which & SSL3_CC_WRITE) + ssl3_release_write_buffer(s); SSL_set_options(s, SSL_OP_NO_RENEGOTIATION); } diff --git a/test/build.info b/test/build.info index 13d66308..ded3bd77 100644 --- a/test/build.info +++ b/test/build.info @@ -186,6 +186,9 @@ IF[{- !$disabled{tests} -}] SOURCE[evp_extra_test]=evp_extra_test.c INCLUDE[evp_extra_test]=../include ../apps/include ../crypto/include DEPEND[evp_extra_test]=../libcrypto libtestutil.a + IF[{- $disabled{fips} || !$target{dso_scheme} -}] + DEFINE[evp_extra_test]=NO_FIPS_MODULE + ENDIF SOURCE[igetest]=igetest.c INCLUDE[igetest]=../include ../apps/include @@ -603,7 +606,7 @@ IF[{- !$disabled{tests} -}] SOURCE[provider_test]=provider_test.c p_test.c INCLUDE[provider_test]=../include ../apps/include DEPEND[provider_test]=../libcrypto.a libtestutil.a - IF[{- !$disabled{shared} -}] + IF[{- !$disabled{module} -}] MODULES{noinst}=p_test SOURCE[p_test]=p_test.c INCLUDE[p_test]=../include @@ -611,10 +614,13 @@ IF[{- !$disabled{tests} -}] SOURCE[p_test]=p_test.ld GENERATE[p_test.ld]=../util/providers.num ENDIF - ELSE - DEFINE[provider_test]=OPENSSL_NO_SHARED - DEFINE[provider_internal_test]=OPENSSL_NO_SHARED ENDIF + IF[{- $disabled{module} || !$target{dso_scheme} -}] + DEFINE[provider_test]=NO_PROVIDER_MODULE + DEFINE[provider_internal_test]=NO_PROVIDER_MODULE + ENDIF + DEPEND[]=provider_internal_test.conf + GENERATE[provider_internal_test.conf]=provider_internal_test.conf.in PROGRAMS{noinst}=params_test SOURCE[params_test]=params_test.c diff --git a/test/drbg_cavs_test.c b/test/drbg_cavs_test.c index 99d44725..8138269b 100644 --- a/test/drbg_cavs_test.c +++ b/test/drbg_cavs_test.c @@ -254,6 +254,11 @@ static int test_cavs_kats(const struct drbg_kat *test[], int i) const struct drbg_kat *td = test[i]; int rv = 0; +#ifdef FIPS_MODE + /* FIPS mode doesn't support instantiating without a derivation function */ + if ((td->flags & USE_DF) == 0) + return 1; +#endif switch (td->type) { case NO_RESEED: if (!single_kat_no_reseed(td)) diff --git a/test/drbgtest.c b/test/drbgtest.c index 652b93ad..bf4c723c 100644 --- a/test/drbgtest.c +++ b/test/drbgtest.c @@ -104,9 +104,12 @@ typedef struct drbg_selftest_data_st { make_drbg_test_data(nid, 0, pr, p) static DRBG_SELFTEST_DATA drbg_test[] = { +#ifndef FIPS_MODE + /* FIPS mode doesn't support CTR DRBG without a derivation function */ make_drbg_test_data_no_df (NID_aes_128_ctr, aes_128_no_df, 0), make_drbg_test_data_no_df (NID_aes_192_ctr, aes_192_no_df, 0), make_drbg_test_data_no_df (NID_aes_256_ctr, aes_256_no_df, 1), +#endif make_drbg_test_data_use_df(NID_aes_128_ctr, aes_128_use_df, 0), make_drbg_test_data_use_df(NID_aes_192_ctr, aes_192_use_df, 0), make_drbg_test_data_use_df(NID_aes_256_ctr, aes_256_use_df, 1), @@ -1009,6 +1012,83 @@ static int test_rand_add(void) return 1; } +static int test_rand_drbg_prediction_resistance(void) +{ + RAND_DRBG *m = NULL, *i = NULL, *s = NULL; + unsigned char buf1[51], buf2[sizeof(buf1)]; + int ret = 0, mreseed, ireseed, sreseed; + + /* Initialise a three long DRBG chain */ + if (!TEST_ptr(m = RAND_DRBG_new(0, 0, NULL)) + || !TEST_true(disable_crngt(m)) + || !TEST_true(RAND_DRBG_instantiate(m, NULL, 0)) + || !TEST_ptr(i = RAND_DRBG_new(0, 0, m)) + || !TEST_true(RAND_DRBG_instantiate(i, NULL, 0)) + || !TEST_ptr(s = RAND_DRBG_new(0, 0, i)) + || !TEST_true(RAND_DRBG_instantiate(s, NULL, 0))) + goto err; + + /* During a normal reseed, only the slave DRBG should be reseed */ + mreseed = ++m->reseed_prop_counter; + ireseed = ++i->reseed_prop_counter; + sreseed = s->reseed_prop_counter; + if (!TEST_true(RAND_DRBG_reseed(s, NULL, 0, 0)) + || !TEST_int_eq(m->reseed_prop_counter, mreseed) + || !TEST_int_eq(i->reseed_prop_counter, ireseed) + || !TEST_int_gt(s->reseed_prop_counter, sreseed)) + goto err; + + /* + * When prediction resistance is requested, the request should be + * propagated to the master, so that the entire DRBG chain reseeds. + */ + sreseed = s->reseed_prop_counter; + if (!TEST_true(RAND_DRBG_reseed(s, NULL, 0, 1)) + || !TEST_int_gt(m->reseed_prop_counter, mreseed) + || !TEST_int_gt(i->reseed_prop_counter, ireseed) + || !TEST_int_gt(s->reseed_prop_counter, sreseed)) + goto err; + + /* During a normal generate, only the slave DRBG should be reseed */ + mreseed = ++m->reseed_prop_counter; + ireseed = ++i->reseed_prop_counter; + sreseed = s->reseed_prop_counter; + if (!TEST_true(RAND_DRBG_generate(s, buf1, sizeof(buf1), 0, NULL, 0)) + || !TEST_int_eq(m->reseed_prop_counter, mreseed) + || !TEST_int_eq(i->reseed_prop_counter, ireseed) + || !TEST_int_gt(s->reseed_prop_counter, sreseed)) + goto err; + + /* + * When a prediction resistant generate is requested, the request + * should be propagated to the master, reseeding the entire DRBG chain. + */ + sreseed = s->reseed_prop_counter; + if (!TEST_true(RAND_DRBG_generate(s, buf2, sizeof(buf2), 1, NULL, 0)) + || !TEST_int_gt(m->reseed_prop_counter, mreseed) + || !TEST_int_gt(i->reseed_prop_counter, ireseed) + || !TEST_int_gt(s->reseed_prop_counter, sreseed) + || !TEST_mem_ne(buf1, sizeof(buf1), buf2, sizeof(buf2))) + goto err; + + /* Verify that a normal reseed still only reseeds the slave DRBG */ + mreseed = ++m->reseed_prop_counter; + ireseed = ++i->reseed_prop_counter; + sreseed = s->reseed_prop_counter; + if (!TEST_true(RAND_DRBG_reseed(s, NULL, 0, 0)) + || !TEST_int_eq(m->reseed_prop_counter, mreseed) + || !TEST_int_eq(i->reseed_prop_counter, ireseed) + || !TEST_int_gt(s->reseed_prop_counter, sreseed)) + goto err; + + ret = 1; +err: + RAND_DRBG_free(s); + RAND_DRBG_free(i); + RAND_DRBG_free(m); + return ret; +} + static int test_multi_set(void) { int rv = 0; @@ -1107,14 +1187,16 @@ static int test_set_defaults(void) && TEST_int_eq(public->type, NID_sha256) && TEST_int_eq(public->flags, RAND_DRBG_FLAG_PUBLIC) - /* Change DRBG defaults and change master and check again */ + /* FIPS mode doesn't support CTR DRBG without a derivation function */ +#ifndef FIPS_MODE + /* Change DRBG defaults and change master and check again */ && TEST_true(RAND_DRBG_set_defaults(NID_aes_256_ctr, RAND_DRBG_FLAG_CTR_NO_DF)) && TEST_true(RAND_DRBG_uninstantiate(master)) && TEST_int_eq(master->type, NID_aes_256_ctr) && TEST_int_eq(master->flags, RAND_DRBG_FLAG_MASTER|RAND_DRBG_FLAG_CTR_NO_DF) - +#endif /* Reset back to the standard defaults */ && TEST_true(RAND_DRBG_set_defaults(RAND_DRBG_TYPE, RAND_DRBG_FLAGS @@ -1247,6 +1329,7 @@ int setup_tests(void) ADD_TEST(test_rand_drbg_reseed); ADD_TEST(test_rand_seed); ADD_TEST(test_rand_add); + ADD_TEST(test_rand_drbg_prediction_resistance); ADD_TEST(test_multi_set); ADD_TEST(test_set_defaults); #if defined(OPENSSL_THREADS) diff --git a/test/ectest.c b/test/ectest.c index 59c7e99d..ab75acea 100644 --- a/test/ectest.c +++ b/test/ectest.c @@ -8,6 +8,7 @@ * https://www.openssl.org/source/license.html */ +#include #include "internal/nelem.h" #include "testutil.h" @@ -1556,6 +1557,262 @@ static const unsigned char p521_explicit[] = { 0xbb, 0x6f, 0xb7, 0x1e, 0x91, 0x38, 0x64, 0x09, 0x02, 0x01, 0x01, }; +/* + * This test validates a named curve's group parameters using + * EC_GROUP_check_named_curve(). It also checks that modifying any of the + * group parameters results in the curve not being valid. + */ +static int check_named_curve_test(int id) +{ + int ret = 0, nid, field_nid, has_seed; + EC_GROUP *group = NULL, *gtest = NULL; + const EC_POINT *group_gen = NULL; + EC_POINT *other_gen = NULL; + BIGNUM *group_p = NULL, *group_a = NULL, *group_b = NULL; + BIGNUM *other_p = NULL, *other_a = NULL, *other_b = NULL; + BIGNUM *group_cofactor = NULL, *other_cofactor = NULL; + BIGNUM *other_order = NULL; + const BIGNUM *group_order = NULL; + BN_CTX *bn_ctx = NULL; + static const unsigned char invalid_seed[] = "THIS IS NOT A VALID SEED"; + static size_t invalid_seed_len = sizeof(invalid_seed); + + /* Do some setup */ + nid = curves[id].nid; + if (!TEST_ptr(bn_ctx = BN_CTX_new()) + || !TEST_ptr(group = EC_GROUP_new_by_curve_name(nid)) + || !TEST_ptr(gtest = EC_GROUP_dup(group)) + || !TEST_ptr(group_p = BN_new()) + || !TEST_ptr(group_a = BN_new()) + || !TEST_ptr(group_b = BN_new()) + || !TEST_ptr(group_cofactor = BN_new()) + || !TEST_ptr(group_gen = EC_GROUP_get0_generator(group)) + || !TEST_ptr(group_order = EC_GROUP_get0_order(group)) + || !TEST_true(EC_GROUP_get_cofactor(group, group_cofactor, NULL)) + || !TEST_true(EC_GROUP_get_curve(group, group_p, group_a, group_b, NULL)) + || !TEST_ptr(other_gen = EC_POINT_dup(group_gen, group)) + || !TEST_true(EC_POINT_add(group, other_gen, group_gen, group_gen, NULL)) + || !TEST_ptr(other_order = BN_dup(group_order)) + || !TEST_true(BN_add_word(other_order, 1)) + || !TEST_ptr(other_a = BN_dup(group_a)) + || !TEST_true(BN_add_word(other_a, 1)) + || !TEST_ptr(other_b = BN_dup(group_b)) + || !TEST_true(BN_add_word(other_b, 1)) + || !TEST_ptr(other_cofactor = BN_dup(group_cofactor)) + || !TEST_true(BN_add_word(other_cofactor, 1))) + goto err; + + /* Determine if the built-in curve has a seed field set */ + has_seed = (EC_GROUP_get_seed_len(group) > 0); + field_nid = EC_METHOD_get_field_type(EC_GROUP_method_of(group)); + if (field_nid == NID_X9_62_characteristic_two_field) { + if (!TEST_ptr(other_p = BN_dup(group_p)) + || !TEST_true(BN_lshift1(other_p, other_p))) + goto err; + } else { + if (!TEST_ptr(other_p = BN_dup(group_p))) + goto err; + /* + * Just choosing any arbitrary prime does not work.. + * Setting p via ec_GFp_nist_group_set_curve() needs the prime to be a + * nist prime. So only select one of these as an alternate prime. + */ + if (!TEST_ptr(BN_copy(other_p, + BN_ucmp(BN_get0_nist_prime_192(), other_p) == 0 ? + BN_get0_nist_prime_256() : + BN_get0_nist_prime_192()))) + goto err; + } + + /* Passes because this is a valid curve */ + if (!TEST_int_eq(EC_GROUP_check_named_curve(group, 0), nid) + /* Only NIST curves pass */ + || !TEST_int_eq(EC_GROUP_check_named_curve(group, 1), + EC_curve_nid2nist(nid) != NULL ? nid : NID_undef)) + goto err; + + /* Fail if the curve name doesn't match the parameters */ + EC_GROUP_set_curve_name(group, nid + 1); + ERR_set_mark(); + if (!TEST_int_le(EC_GROUP_check_named_curve(group, 0), 0)) + goto err; + ERR_pop_to_mark(); + + /* Restore curve name and ensure it's passing */ + EC_GROUP_set_curve_name(group, nid); + if (!TEST_int_eq(EC_GROUP_check_named_curve(group, 0), nid)) + goto err; + + if (!TEST_int_eq(EC_GROUP_set_seed(group, invalid_seed, invalid_seed_len), + invalid_seed_len)) + goto err; + + if (has_seed) { + /* + * If the built-in curve has a seed and we set the seed to another value + * then it will fail the check. + */ + if (!TEST_int_eq(EC_GROUP_check_named_curve(group, 0), 0)) + goto err; + } else { + /* + * If the built-in curve does not have a seed then setting the seed will + * pass the check (as the seed is optional). + */ + if (!TEST_int_eq(EC_GROUP_check_named_curve(group, 0), nid)) + goto err; + } + /* Pass if the seed is unknown (as it is optional) */ + if (!TEST_int_eq(EC_GROUP_set_seed(group, NULL, 0), 1) + || !TEST_int_eq(EC_GROUP_check_named_curve(group, 0), nid)) + goto err; + + /* Check that a duped group passes */ + if (!TEST_int_eq(EC_GROUP_check_named_curve(gtest, 0), nid)) + goto err; + + /* check that changing any generator parameter fails */ + if (!TEST_true(EC_GROUP_set_generator(gtest, other_gen, group_order, + group_cofactor)) + || !TEST_int_eq(EC_GROUP_check_named_curve(gtest, 0), 0) + || !TEST_true(EC_GROUP_set_generator(gtest, group_gen, other_order, + group_cofactor)) + || !TEST_int_eq(EC_GROUP_check_named_curve(gtest, 0), 0) + /* The order is not an optional field, so this should fail */ + || !TEST_true(EC_GROUP_set_generator(gtest, group_gen, NULL, + group_cofactor)) + || !TEST_int_le(EC_GROUP_check_named_curve(gtest, 0), 0) + || !TEST_true(EC_GROUP_set_generator(gtest, group_gen, group_order, + other_cofactor)) + || !TEST_int_eq(EC_GROUP_check_named_curve(gtest, 0), 0) + /* Check that if the cofactor is not set then it still passes */ + || !TEST_true(EC_GROUP_set_generator(gtest, group_gen, group_order, + NULL)) + || !TEST_int_eq(EC_GROUP_check_named_curve(gtest, 0), nid) + /* check that restoring the generator passes */ + || !TEST_true(EC_GROUP_set_generator(gtest, group_gen, group_order, + group_cofactor)) + || !TEST_int_eq(EC_GROUP_check_named_curve(gtest, 0), nid)) + goto err; + + /* + * check that changing any curve parameter fails + * + * Setting arbitrary p, a or b might fail for some EC_GROUPs + * depending on the internal EC_METHOD implementation, hence run + * these tests conditionally to the success of EC_GROUP_set_curve(). + */ + ERR_set_mark(); + if (EC_GROUP_set_curve(gtest, other_p, group_a, group_b, NULL)) { + if (!TEST_int_le(EC_GROUP_check_named_curve(gtest, 0), 0)) + goto err; + } else { + /* clear the error stack if EC_GROUP_set_curve() failed */ + ERR_pop_to_mark(); + ERR_set_mark(); + } + if (EC_GROUP_set_curve(gtest, group_p, other_a, group_b, NULL)) { + if (!TEST_int_le(EC_GROUP_check_named_curve(gtest, 0), 0)) + goto err; + } else { + /* clear the error stack if EC_GROUP_set_curve() failed */ + ERR_pop_to_mark(); + ERR_set_mark(); + } + if (EC_GROUP_set_curve(gtest, group_p, group_a, other_b, NULL)) { + if (!TEST_int_le(EC_GROUP_check_named_curve(gtest, 0), 0)) + goto err; + } else { + /* clear the error stack if EC_GROUP_set_curve() failed */ + ERR_pop_to_mark(); + ERR_set_mark(); + } + ERR_pop_to_mark(); + + /* Check that restoring the curve parameters passes */ + if (!TEST_true(EC_GROUP_set_curve(gtest, group_p, group_a, group_b, NULL)) + || !TEST_int_eq(EC_GROUP_check_named_curve(gtest, 0), nid)) + goto err; + + ret = 1; +err: + BN_free(group_p); + BN_free(other_p); + BN_free(group_a); + BN_free(other_a); + BN_free(group_b); + BN_free(other_b); + BN_free(group_cofactor); + BN_free(other_cofactor); + BN_free(other_order); + EC_POINT_free(other_gen); + EC_GROUP_free(gtest); + EC_GROUP_free(group); + BN_CTX_free(bn_ctx); + return ret; +} + +/* + * This checks the lookup capability of EC_GROUP_check_named_curve() + * when the given group was created with explicit parameters. + * + * It is possible to retrieve an alternative alias that does not match + * the original nid in this case. + */ +static int check_named_curve_lookup_test(int id) +{ + int ret = 0, nid, rv = 0; + EC_GROUP *g = NULL , *ga = NULL; + ECPARAMETERS *p = NULL, *pa = NULL; + BN_CTX *ctx = NULL; + + /* Do some setup */ + nid = curves[id].nid; + if (!TEST_ptr(ctx = BN_CTX_new()) + || !TEST_ptr(g = EC_GROUP_new_by_curve_name(nid)) + || !TEST_ptr(p = EC_GROUP_get_ecparameters(g, NULL))) + goto err; + + /* replace with group from explicit parameters */ + EC_GROUP_free(g); + if (!TEST_ptr(g = EC_GROUP_new_from_ecparameters(p))) + goto err; + + if (!TEST_int_gt(rv = EC_GROUP_check_named_curve(g, 0), 0)) + goto err; + if (rv != nid) { + /* + * Found an alias: + * fail if the returned nid is not an alias of the original group. + * + * The comparison here is done by comparing two explicit + * parameter EC_GROUPs with EC_GROUP_cmp(), to ensure the + * comparison happens with unnamed EC_GROUPs using the same + * EC_METHODs. + */ + if (!TEST_ptr(ga = EC_GROUP_new_by_curve_name(rv)) + || !TEST_ptr(pa = EC_GROUP_get_ecparameters(ga, NULL))) + goto err; + + /* replace with group from explicit parameters, then compare */ + EC_GROUP_free(ga); + if (!TEST_ptr(ga = EC_GROUP_new_from_ecparameters(pa)) + || !TEST_int_eq(EC_GROUP_cmp(g, ga, ctx), 0)) + goto err; + } + + ret = 1; + + err: + EC_GROUP_free(g); + EC_GROUP_free(ga); + ECPARAMETERS_free(p); + ECPARAMETERS_free(pa); + BN_CTX_free(ctx); + + return ret; +} + static int parameter_test(void) { EC_GROUP *group = NULL, *group2 = NULL; @@ -1598,7 +1855,59 @@ err: OPENSSL_free(buf); return r; } -#endif + +static int check_ec_key_field_public_range_test(int id) +{ + int ret = 0, type = 0; + const EC_POINT *pub = NULL; + const EC_GROUP *group = NULL; + const EC_METHOD *meth = NULL; + const BIGNUM *field = NULL; + BIGNUM *x = NULL, *y = NULL; + EC_KEY *key = NULL; + + if (!(TEST_ptr(x = BN_new()) + && TEST_ptr(y = BN_new()) + && TEST_ptr(key = EC_KEY_new_by_curve_name(curves[id].nid)) + && TEST_ptr(group = EC_KEY_get0_group(key)) + && TEST_ptr(meth = EC_GROUP_method_of(group)) + && TEST_ptr(field = EC_GROUP_get0_field(group)) + && TEST_int_gt(EC_KEY_generate_key(key), 0) + && TEST_int_gt(EC_KEY_check_key(key), 0) + && TEST_ptr(pub = EC_KEY_get0_public_key(key)) + && TEST_int_gt(EC_POINT_get_affine_coordinates(group, pub, x, y, + NULL), 0))) + goto err; + + /* + * Make the public point out of range by adding the field (which will still + * be the same point on the curve). The add is different for char2 fields. + */ + type = EC_METHOD_get_field_type(meth); + if (type == NID_X9_62_characteristic_two_field) { + /* test for binary curves */ + if (!TEST_true(BN_GF2m_add(x, x, field))) + goto err; + } else if (type == NID_X9_62_prime_field) { + /* test for prime curves */ + if (!TEST_true(BN_add(x, x, field))) + goto err; + } else { + /* this should never happen */ + TEST_error("Unsupported EC_METHOD field_type"); + goto err; + } + if (!TEST_int_le(EC_KEY_set_public_key_affine_coordinates(key, x, y), 0)) + goto err; + + ret = 1; +err: + BN_free(x); + BN_free(y); + EC_KEY_free(key); + return ret; +} +#endif /* OPENSSL_NO_EC */ int setup_tests(void) { @@ -1621,7 +1930,10 @@ int setup_tests(void) ADD_ALL_TESTS(internal_curve_test, crv_len); ADD_ALL_TESTS(internal_curve_test_method, crv_len); ADD_TEST(group_field_test); -#endif + ADD_ALL_TESTS(check_named_curve_test, crv_len); + ADD_ALL_TESTS(check_named_curve_lookup_test, crv_len); + ADD_ALL_TESTS(check_ec_key_field_public_range_test, crv_len); +#endif /* OPENSSL_NO_EC */ return 1; } diff --git a/test/evp_extra_test.c b/test/evp_extra_test.c index f07ae94a..724a1441 100644 --- a/test/evp_extra_test.c +++ b/test/evp_extra_test.c @@ -1083,7 +1083,8 @@ static int calculate_digest(const EVP_MD *md, const char *msg, size_t len, || !TEST_true(EVP_DigestUpdate(ctx, msg, len)) || !TEST_true(EVP_DigestFinal_ex(ctx, out, NULL)) || !TEST_mem_eq(out, SHA256_DIGEST_LENGTH, exptd, - SHA256_DIGEST_LENGTH)) + SHA256_DIGEST_LENGTH) + || !TEST_true(md == EVP_MD_CTX_md(ctx))) goto err; ret = 1; @@ -1097,12 +1098,14 @@ static int calculate_digest(const EVP_MD *md, const char *msg, size_t len, * Test 0: Test with the default OPENSSL_CTX * Test 1: Test with an explicit OPENSSL_CTX * Test 2: Explicit OPENSSL_CTX with explicit load of default provider + * Test 3: Explicit OPENSSL_CTX with explicit load of default and fips provider + * Test 4: Explicit OPENSSL_CTX with explicit load of fips provider */ static int test_EVP_MD_fetch(int tst) { OPENSSL_CTX *ctx = NULL; EVP_MD *md = NULL; - OSSL_PROVIDER *prov = NULL; + OSSL_PROVIDER *defltprov = NULL, *fipsprov = NULL; int ret = 0; const char testmsg[] = "Hello world"; const unsigned char exptd[] = { @@ -1116,25 +1119,35 @@ static int test_EVP_MD_fetch(int tst) if (!TEST_ptr(ctx)) goto err; - if (tst == 2) { - prov = OSSL_PROVIDER_load(ctx, "default"); - if (!TEST_ptr(prov)) + if (tst == 2 || tst == 3) { + defltprov = OSSL_PROVIDER_load(ctx, "default"); + if (!TEST_ptr(defltprov)) + goto err; + } + if (tst == 3 || tst == 4) { + fipsprov = OSSL_PROVIDER_load(ctx, "fips"); + if (!TEST_ptr(fipsprov)) goto err; } } /* Implicit fetching of the MD should produce the expected result */ if (!TEST_true(calculate_digest(EVP_sha256(), testmsg, sizeof(testmsg), - exptd))) + exptd)) + || !TEST_int_eq(EVP_MD_size(EVP_sha256()), SHA256_DIGEST_LENGTH) + || !TEST_int_eq(EVP_MD_block_size(EVP_sha256()), SHA256_CBLOCK)) goto err; + /* - * Test that without loading any providers or specifying any properties we - * can get a sha256 md from the default provider. + * Test that without specifying any properties we can get a sha256 md from a + * provider. */ if (!TEST_ptr(md = EVP_MD_fetch(ctx, "SHA256", NULL)) || !TEST_ptr(md) || !TEST_int_eq(EVP_MD_nid(md), NID_sha256) - || !TEST_true(calculate_digest(md, testmsg, sizeof(testmsg), exptd))) + || !TEST_true(calculate_digest(md, testmsg, sizeof(testmsg), exptd)) + || !TEST_int_eq(EVP_MD_size(md), SHA256_DIGEST_LENGTH) + || !TEST_int_eq(EVP_MD_block_size(md), SHA256_CBLOCK)) goto err; /* Also test EVP_MD_upref() while we're doing this */ @@ -1146,26 +1159,67 @@ static int test_EVP_MD_fetch(int tst) md = NULL; /* - * We've only loaded the default provider so explicitly asking for a - * non-default implementation should fail. + * In tests 0 - 2 we've only loaded the default provider so explicitly + * asking for a non-default implementation should fail. In tests 3 and 4 we + * have the FIPS provider loaded so we should succeed in that case. */ - if (!TEST_ptr_null(md = EVP_MD_fetch(ctx, "SHA256", "default=no"))) - goto err; - - /* Explicitly asking for the default implementation should succeeed */ - if (!TEST_ptr(md = EVP_MD_fetch(ctx, "SHA256", "default=yes")) - || !TEST_int_eq(EVP_MD_nid(md), NID_sha256) - || !TEST_true(calculate_digest(md, testmsg, sizeof(testmsg), exptd))) - goto err; + md = EVP_MD_fetch(ctx, "SHA256", "default=no"); + if (tst == 3 || tst == 4) { + if (!TEST_ptr(md) + || !TEST_true(calculate_digest(md, testmsg, sizeof(testmsg), + exptd))) + goto err; + } else { + if (!TEST_ptr_null(md)) + goto err; + } EVP_MD_meth_free(md); md = NULL; + /* + * Explicitly asking for the default implementation should succeeed except + * in test 4 where the default provider is not loaded. + */ + md = EVP_MD_fetch(ctx, "SHA256", "default=yes"); + if (tst != 4) { + if (!TEST_ptr(md) + || !TEST_int_eq(EVP_MD_nid(md), NID_sha256) + || !TEST_true(calculate_digest(md, testmsg, sizeof(testmsg), + exptd)) + || !TEST_int_eq(EVP_MD_size(md), SHA256_DIGEST_LENGTH) + || !TEST_int_eq(EVP_MD_block_size(md), SHA256_CBLOCK)) + goto err; + } else { + if (!TEST_ptr_null(md)) + goto err; + } + + EVP_MD_meth_free(md); + md = NULL; + + /* + * Explicitly asking for a fips implementation should succeed if we have + * the FIPS provider loaded and fail otherwise + */ + md = EVP_MD_fetch(ctx, "SHA256", "fips=yes"); + if (tst == 3 || tst == 4) { + if (!TEST_ptr(md) + || !TEST_true(calculate_digest(md, testmsg, sizeof(testmsg), + exptd))) + goto err; + } else { + if (!TEST_ptr_null(md)) + goto err; + } + + ret = 1; err: EVP_MD_meth_free(md); - OSSL_PROVIDER_unload(prov); + OSSL_PROVIDER_unload(defltprov); + OSSL_PROVIDER_unload(fipsprov); OPENSSL_CTX_free(ctx); return ret; } @@ -1199,6 +1253,10 @@ int setup_tests(void) ADD_ALL_TESTS(test_invalide_ec_char2_pub_range_decode, OSSL_NELEM(ec_der_pub_keys)); #endif +#ifdef NO_FIPS_MODULE ADD_ALL_TESTS(test_EVP_MD_fetch, 3); +#else + ADD_ALL_TESTS(test_EVP_MD_fetch, 5); +#endif return 1; } diff --git a/test/igetest.c b/test/igetest.c index 9cc551f4..a4b8cfab 100644 --- a/test/igetest.c +++ b/test/igetest.c @@ -15,19 +15,21 @@ #include "internal/nelem.h" #include "testutil.h" -#define TEST_SIZE 128 -#define BIG_TEST_SIZE 10240 +#if !OPENSSL_API_3 -#if BIG_TEST_SIZE < TEST_SIZE -#error BIG_TEST_SIZE is smaller than TEST_SIZE -#endif +# define TEST_SIZE 128 +# define BIG_TEST_SIZE 10240 + +# if BIG_TEST_SIZE < TEST_SIZE +# error BIG_TEST_SIZE is smaller than TEST_SIZE +# endif static unsigned char rkey[16]; static unsigned char rkey2[16]; static unsigned char plaintext[BIG_TEST_SIZE]; static unsigned char saved_iv[AES_BLOCK_SIZE * 4]; -#define MAX_VECTOR_SIZE 64 +# define MAX_VECTOR_SIZE 64 struct ige_test { const unsigned char key[16]; @@ -432,9 +434,11 @@ static int test_bi_ige_garble3(void) /* Fail if there is more than 1% matching bytes */ return TEST_size_t_le(matches, sizeof(checktext) / 100); } +#endif int setup_tests(void) { +#if !OPENSSL_API_3 RAND_bytes(rkey, sizeof(rkey)); RAND_bytes(rkey2, sizeof(rkey2)); RAND_bytes(plaintext, sizeof(plaintext)); @@ -450,5 +454,6 @@ int setup_tests(void) ADD_TEST(test_bi_ige_garble3); ADD_ALL_TESTS(test_ige_vectors, OSSL_NELEM(ige_test_vectors)); ADD_ALL_TESTS(test_bi_ige_vectors, OSSL_NELEM(bi_ige_test_vectors)); +#endif return 1; } diff --git a/test/md2test.c b/test/md2test.c index 3491e13e..47f55b75 100644 --- a/test/md2test.c +++ b/test/md2test.c @@ -9,9 +9,12 @@ #include +#include #include "internal/nelem.h" #include "testutil.h" +static OSSL_PROVIDER *prov = NULL; + #ifndef OPENSSL_NO_MD2 # include # include @@ -58,6 +61,17 @@ static int test_md2(int n) } #endif +int global_init(void) +{ + prov = OSSL_PROVIDER_load(NULL, "legacy"); + + return prov != NULL; +} +void cleanup_tests(void) +{ + OSSL_PROVIDER_unload(prov); +} + int setup_tests(void) { #ifndef OPENSSL_NO_MD2 diff --git a/test/p_test.c b/test/p_test.c index 9e1ba8ed..bf13a0a0 100644 --- a/test/p_test.c +++ b/test/p_test.c @@ -52,21 +52,33 @@ static int p_get_params(const OSSL_PROVIDER *prov, OSSL_PARAM params[]) if (strcmp(p->key, "greeting") == 0) { static char *opensslv = NULL; static char *provname = NULL; + static char *greeting = NULL; static OSSL_PARAM counter_request[] = { + /* Known libcrypto provided parameters */ { "openssl-version", OSSL_PARAM_UTF8_PTR, &opensslv, sizeof(&opensslv), NULL }, { "provider-name", OSSL_PARAM_UTF8_PTR, &provname, sizeof(&provname), NULL}, + + /* This might be present, if there's such a configuration */ + { "greeting", OSSL_PARAM_UTF8_PTR, + &greeting, sizeof(&greeting), NULL }, + { NULL, 0, NULL, 0, NULL } }; char buf[256]; size_t buf_l; if (c_get_params(prov, counter_request)) { - const char *versionp = *(void **)counter_request[0].data; - const char *namep = *(void **)counter_request[1].data; - sprintf(buf, "Hello OpenSSL %.20s, greetings from %s!", - versionp, namep); + if (greeting) { + strcpy(buf, greeting); + } else { + const char *versionp = *(void **)counter_request[0].data; + const char *namep = *(void **)counter_request[1].data; + + sprintf(buf, "Hello OpenSSL %.20s, greetings from %s!", + versionp, namep); + } } else { sprintf(buf, "Howdy stranger..."); } diff --git a/test/params_api_test.c b/test/params_api_test.c index 15dfb16f..df708da7 100644 --- a/test/params_api_test.c +++ b/test/params_api_test.c @@ -26,7 +26,15 @@ static void swap_copy(unsigned char *out, const void *in, size_t len) out[j] = ((unsigned char *)in)[len - j - 1]; } -static void copy_to_le(unsigned char *out, const void *in, size_t len) +/* + * A memory copy that converts the native byte ordering either to or from + * little endian format. + * + * On a little endian machine copying either is just a memcpy(3), on a + * big endian machine copying from native to or from little endian involves + * byte reversal. + */ +static void le_copy(unsigned char *out, const void *in, size_t len) { DECLARE_IS_ENDIAN; @@ -36,16 +44,6 @@ static void copy_to_le(unsigned char *out, const void *in, size_t len) swap_copy(out, in, len); } -static void copy_be_to_native(unsigned char *out, const void *in, size_t len) -{ - DECLARE_IS_ENDIAN; - - if (IS_LITTLE_ENDIAN) - swap_copy(out, in, len); - else - memcpy(out, in, len); -} - static const struct { size_t len; unsigned char value[MAX_LEN]; @@ -60,8 +58,8 @@ static const struct { 0x89, 0x67, 0xf2, 0x68, 0x33, 0xa0, 0x14, 0xb0 } }, }; -static int test_param_type_extra(const OSSL_PARAM *param, unsigned char *cmp, - size_t width) +static int test_param_type_extra(const OSSL_PARAM *param, + const unsigned char *cmp, size_t width) { int32_t i32; int64_t i64; @@ -85,17 +83,17 @@ static int test_param_type_extra(const OSSL_PARAM *param, unsigned char *cmp, /* Check signed types */ if (bit32) { - copy_to_le(buf, &i32, sizeof(i32)); + le_copy(buf, &i32, sizeof(i32)); sz = sizeof(i32) < width ? sizeof(i32) : width; if (!TEST_mem_eq(buf, sz, cmp, sz)) return 0; } - copy_to_le(buf, &i64, sizeof(i64)); + le_copy(buf, &i64, sizeof(i64)); sz = sizeof(i64) < width ? sizeof(i64) : width; if (!TEST_mem_eq(buf, sz, cmp, sz)) return 0; if (sizet && !signd) { - copy_to_le(buf, &s, sizeof(s)); + le_copy(buf, &s, sizeof(s)); sz = sizeof(s) < width ? sizeof(s) : width; if (!TEST_mem_eq(buf, sz, cmp, sz)) return 0; @@ -133,268 +131,248 @@ static int test_param_type_extra(const OSSL_PARAM *param, unsigned char *cmp, static int test_param_int(int n) { int in, out; - unsigned char buf[MAX_LEN], le[MAX_LEN], cmp[sizeof(int)]; + unsigned char buf[MAX_LEN], cmp[sizeof(int)]; const size_t len = raw_values[n].len >= sizeof(int) ? sizeof(int) : raw_values[n].len; OSSL_PARAM param = OSSL_PARAM_int("a", NULL); memset(buf, 0, sizeof(buf)); - memset(le, 0, sizeof(le)); - copy_be_to_native(buf, raw_values[n].value, len); - swap_copy(le, raw_values[n].value, len); + le_copy(buf, raw_values[n].value, sizeof(in)); memcpy(&in, buf, sizeof(in)); param.data = &out; if (!TEST_true(OSSL_PARAM_set_int(¶m, in))) return 0; - copy_to_le(cmp, &out, sizeof(out)); - if (!TEST_mem_eq(cmp, len, le, len)) + le_copy(cmp, &out, sizeof(out)); + if (!TEST_mem_eq(cmp, len, raw_values[n].value, len)) return 0; in = 0; - param.data = buf; if (!TEST_true(OSSL_PARAM_get_int(¶m, &in))) return 0; - copy_to_le(cmp, &in, sizeof(in)); - if (!TEST_mem_eq(cmp, sizeof(in), le, sizeof(in))) + le_copy(cmp, &in, sizeof(in)); + if (!TEST_mem_eq(cmp, sizeof(in), raw_values[n].value, sizeof(in))) return 0; param.data = &out; - return test_param_type_extra(¶m, le, sizeof(int)); + return test_param_type_extra(¶m, raw_values[n].value, sizeof(int)); } static int test_param_long(int n) { long int in, out; - unsigned char buf[MAX_LEN], le[MAX_LEN], cmp[sizeof(long int)]; + unsigned char buf[MAX_LEN], cmp[sizeof(long int)]; const size_t len = raw_values[n].len >= sizeof(long int) ? sizeof(long int) : raw_values[n].len; OSSL_PARAM param = OSSL_PARAM_long("a", NULL); memset(buf, 0, sizeof(buf)); - memset(le, 0, sizeof(le)); - copy_be_to_native(buf, raw_values[n].value, len); - swap_copy(le, raw_values[n].value, len); + le_copy(buf, raw_values[n].value, sizeof(in)); memcpy(&in, buf, sizeof(in)); param.data = &out; if (!TEST_true(OSSL_PARAM_set_long(¶m, in))) return 0; - copy_to_le(cmp, &out, sizeof(out)); - if (!TEST_mem_eq(cmp, len, le, len)) + le_copy(cmp, &out, sizeof(out)); + if (!TEST_mem_eq(cmp, len, raw_values[n].value, len)) return 0; in = 0; - param.data = buf; if (!TEST_true(OSSL_PARAM_get_long(¶m, &in))) return 0; - copy_to_le(cmp, &in, sizeof(in)); - if (!TEST_mem_eq(cmp, sizeof(in), le, sizeof(in))) + le_copy(cmp, &in, sizeof(in)); + if (!TEST_mem_eq(cmp, sizeof(in), raw_values[n].value, sizeof(in))) return 0; param.data = &out; - return test_param_type_extra(¶m, le, sizeof(long int)); + return test_param_type_extra(¶m, raw_values[n].value, sizeof(long int)); } static int test_param_uint(int n) { unsigned int in, out; - unsigned char buf[MAX_LEN], le[MAX_LEN], cmp[sizeof(unsigned int)]; + unsigned char buf[MAX_LEN], cmp[sizeof(unsigned int)]; const size_t len = raw_values[n].len >= sizeof(unsigned int) ? sizeof(unsigned int) : raw_values[n].len; OSSL_PARAM param = OSSL_PARAM_uint("a", NULL); + memset(buf, 0, sizeof(buf)); - memset(le, 0, sizeof(le)); - copy_be_to_native(buf, raw_values[n].value, len); - swap_copy(le, raw_values[n].value, len); + le_copy(buf, raw_values[n].value, sizeof(in)); memcpy(&in, buf, sizeof(in)); param.data = &out; if (!TEST_true(OSSL_PARAM_set_uint(¶m, in))) return 0; - copy_to_le(cmp, &out, sizeof(out)); - if (!TEST_mem_eq(cmp, len, le, len)) + le_copy(cmp, &out, sizeof(out)); + if (!TEST_mem_eq(cmp, len, raw_values[n].value, len)) return 0; in = 0; - param.data = buf; if (!TEST_true(OSSL_PARAM_get_uint(¶m, &in))) return 0; - copy_to_le(cmp, &in, sizeof(in)); - if (!TEST_mem_eq(cmp, sizeof(in), le, sizeof(in))) + le_copy(cmp, &in, sizeof(in)); + if (!TEST_mem_eq(cmp, sizeof(in), raw_values[n].value, sizeof(in))) return 0; param.data = &out; - return test_param_type_extra(¶m, le, sizeof(unsigned int)); + return test_param_type_extra(¶m, raw_values[n].value, sizeof(unsigned int)); } static int test_param_ulong(int n) { unsigned long int in, out; - unsigned char buf[MAX_LEN], le[MAX_LEN], cmp[sizeof(unsigned long int)]; + unsigned char buf[MAX_LEN], cmp[sizeof(unsigned long int)]; const size_t len = raw_values[n].len >= sizeof(unsigned long int) ? sizeof(unsigned long int) : raw_values[n].len; OSSL_PARAM param = OSSL_PARAM_ulong("a", NULL); + memset(buf, 0, sizeof(buf)); - memset(le, 0, sizeof(le)); - copy_be_to_native(buf, raw_values[n].value, len); - swap_copy(le, raw_values[n].value, len); + le_copy(buf, raw_values[n].value, sizeof(in)); memcpy(&in, buf, sizeof(in)); param.data = &out; if (!TEST_true(OSSL_PARAM_set_ulong(¶m, in))) return 0; - copy_to_le(cmp, &out, sizeof(out)); - if (!TEST_mem_eq(cmp, len, le, len)) + le_copy(cmp, &out, sizeof(out)); + if (!TEST_mem_eq(cmp, len, raw_values[n].value, len)) return 0; in = 0; - param.data = buf; if (!TEST_true(OSSL_PARAM_get_ulong(¶m, &in))) return 0; - copy_to_le(cmp, &in, sizeof(in)); - if (!TEST_mem_eq(cmp, sizeof(in), le, sizeof(in))) + le_copy(cmp, &in, sizeof(in)); + if (!TEST_mem_eq(cmp, sizeof(in), raw_values[n].value, sizeof(in))) return 0; param.data = &out; - return test_param_type_extra(¶m, le, sizeof(unsigned long int)); + return test_param_type_extra(¶m, raw_values[n].value, sizeof(unsigned long int)); } static int test_param_int32(int n) { int32_t in, out; - unsigned char buf[MAX_LEN], le[MAX_LEN], cmp[sizeof(int32_t)]; + unsigned char buf[MAX_LEN], cmp[sizeof(int32_t)]; const size_t len = raw_values[n].len >= sizeof(int32_t) ? sizeof(int32_t) : raw_values[n].len; OSSL_PARAM param = OSSL_PARAM_int32("a", NULL); + memset(buf, 0, sizeof(buf)); - memset(le, 0, sizeof(le)); - copy_be_to_native(buf, raw_values[n].value, len); - swap_copy(le, raw_values[n].value, len); + le_copy(buf, raw_values[n].value, sizeof(in)); memcpy(&in, buf, sizeof(in)); param.data = &out; if (!TEST_true(OSSL_PARAM_set_int32(¶m, in))) return 0; - copy_to_le(cmp, &out, sizeof(out)); - if (!TEST_mem_eq(cmp, len, le, len)) + le_copy(cmp, &out, sizeof(out)); + if (!TEST_mem_eq(cmp, len, raw_values[n].value, len)) return 0; in = 0; - param.data = buf; if (!TEST_true(OSSL_PARAM_get_int32(¶m, &in))) return 0; - copy_to_le(cmp, &in, sizeof(in)); - if (!TEST_mem_eq(cmp, sizeof(in), le, sizeof(in))) + le_copy(cmp, &in, sizeof(in)); + if (!TEST_mem_eq(cmp, sizeof(in), raw_values[n].value, sizeof(in))) return 0; param.data = &out; - return test_param_type_extra(¶m, le, sizeof(int32_t)); + return test_param_type_extra(¶m, raw_values[n].value, sizeof(int32_t)); } static int test_param_uint32(int n) { uint32_t in, out; - unsigned char buf[MAX_LEN], le[MAX_LEN], cmp[sizeof(uint32_t)]; + unsigned char buf[MAX_LEN], cmp[sizeof(uint32_t)]; const size_t len = raw_values[n].len >= sizeof(uint32_t) ? sizeof(uint32_t) : raw_values[n].len; OSSL_PARAM param = OSSL_PARAM_uint32("a", NULL); + memset(buf, 0, sizeof(buf)); - memset(le, 0, sizeof(le)); - copy_be_to_native(buf, raw_values[n].value, len); - swap_copy(le, raw_values[n].value, len); + le_copy(buf, raw_values[n].value, sizeof(in)); memcpy(&in, buf, sizeof(in)); param.data = &out; if (!TEST_true(OSSL_PARAM_set_uint32(¶m, in))) return 0; - copy_to_le(cmp, &out, sizeof(out)); - if (!TEST_mem_eq(cmp, len, le, len)) + le_copy(cmp, &out, sizeof(out)); + if (!TEST_mem_eq(cmp, len, raw_values[n].value, len)) return 0; in = 0; - param.data = buf; if (!TEST_true(OSSL_PARAM_get_uint32(¶m, &in))) return 0; - copy_to_le(cmp, &in, sizeof(in)); - if (!TEST_mem_eq(cmp, sizeof(in), le, sizeof(in))) + le_copy(cmp, &in, sizeof(in)); + if (!TEST_mem_eq(cmp, sizeof(in), raw_values[n].value, sizeof(in))) return 0; param.data = &out; - return test_param_type_extra(¶m, le, sizeof(uint32_t)); + return test_param_type_extra(¶m, raw_values[n].value, sizeof(uint32_t)); } static int test_param_int64(int n) { int64_t in, out; - unsigned char buf[MAX_LEN], le[MAX_LEN], cmp[sizeof(int64_t)]; + unsigned char buf[MAX_LEN], cmp[sizeof(int64_t)]; const size_t len = raw_values[n].len >= sizeof(int64_t) ? sizeof(int64_t) : raw_values[n].len; OSSL_PARAM param = OSSL_PARAM_int64("a", NULL); + memset(buf, 0, sizeof(buf)); - memset(le, 0, sizeof(le)); - copy_be_to_native(buf, raw_values[n].value, len); - swap_copy(le, raw_values[n].value, len); + le_copy(buf, raw_values[n].value, sizeof(in)); memcpy(&in, buf, sizeof(in)); param.data = &out; if (!TEST_true(OSSL_PARAM_set_int64(¶m, in))) return 0; - copy_to_le(cmp, &out, sizeof(out)); - if (!TEST_mem_eq(cmp, len, le, len)) + le_copy(cmp, &out, sizeof(out)); + if (!TEST_mem_eq(cmp, len, raw_values[n].value, len)) return 0; in = 0; - param.data = buf; if (!TEST_true(OSSL_PARAM_get_int64(¶m, &in))) return 0; - copy_to_le(cmp, &in, sizeof(in)); - if (!TEST_mem_eq(cmp, sizeof(in), le, sizeof(in))) + le_copy(cmp, &in, sizeof(in)); + if (!TEST_mem_eq(cmp, sizeof(in), raw_values[n].value, sizeof(in))) return 0; param.data = &out; - return test_param_type_extra(¶m, le, sizeof(int64_t)); + return test_param_type_extra(¶m, raw_values[n].value, sizeof(int64_t)); } static int test_param_uint64(int n) { uint64_t in, out; - unsigned char buf[MAX_LEN], le[MAX_LEN], cmp[sizeof(uint64_t)]; + unsigned char buf[MAX_LEN], cmp[sizeof(uint64_t)]; const size_t len = raw_values[n].len >= sizeof(uint64_t) ? sizeof(uint64_t) : raw_values[n].len; OSSL_PARAM param = OSSL_PARAM_uint64("a", NULL); + memset(buf, 0, sizeof(buf)); - memset(le, 0, sizeof(le)); - copy_be_to_native(buf, raw_values[n].value, len); - swap_copy(le, raw_values[n].value, len); + le_copy(buf, raw_values[n].value, sizeof(in)); memcpy(&in, buf, sizeof(in)); param.data = &out; if (!TEST_true(OSSL_PARAM_set_uint64(¶m, in))) return 0; - copy_to_le(cmp, &out, sizeof(out)); - if (!TEST_mem_eq(cmp, len, le, len)) + le_copy(cmp, &out, sizeof(out)); + if (!TEST_mem_eq(cmp, len, raw_values[n].value, len)) return 0; in = 0; - param.data = buf; if (!TEST_true(OSSL_PARAM_get_uint64(¶m, &in))) return 0; - copy_to_le(cmp, &in, sizeof(in)); - if (!TEST_mem_eq(cmp, sizeof(in), le, sizeof(in))) + le_copy(cmp, &in, sizeof(in)); + if (!TEST_mem_eq(cmp, sizeof(in), raw_values[n].value, sizeof(in))) return 0; param.data = &out; - return test_param_type_extra(¶m, le, sizeof(uint64_t)); + return test_param_type_extra(¶m, raw_values[n].value, sizeof(uint64_t)); } static int test_param_size_t(int n) { size_t in, out; - unsigned char buf[MAX_LEN], le[MAX_LEN], cmp[sizeof(size_t)]; + unsigned char buf[MAX_LEN], cmp[sizeof(size_t)]; const size_t len = raw_values[n].len >= sizeof(size_t) ? sizeof(size_t) : raw_values[n].len; OSSL_PARAM param = OSSL_PARAM_size_t("a", NULL); + memset(buf, 0, sizeof(buf)); - memset(le, 0, sizeof(le)); - copy_be_to_native(buf, raw_values[n].value, len); - swap_copy(le, raw_values[n].value, len); + le_copy(buf, raw_values[n].value, sizeof(in)); memcpy(&in, buf, sizeof(in)); param.data = &out; if (!TEST_true(OSSL_PARAM_set_size_t(¶m, in))) return 0; - copy_to_le(cmp, &out, sizeof(out)); - if (!TEST_mem_eq(cmp, len, le, len)) + le_copy(cmp, &out, sizeof(out)); + if (!TEST_mem_eq(cmp, len, raw_values[n].value, len)) return 0; in = 0; - param.data = buf; if (!TEST_true(OSSL_PARAM_get_size_t(¶m, &in))) return 0; - copy_to_le(cmp, &in, sizeof(in)); - if (!TEST_mem_eq(cmp, sizeof(in), le, sizeof(in))) + le_copy(cmp, &in, sizeof(in)); + if (!TEST_mem_eq(cmp, sizeof(in), raw_values[n].value, sizeof(in))) return 0; param.data = &out; - return test_param_type_extra(¶m, le, sizeof(size_t)); + return test_param_type_extra(¶m, raw_values[n].value, sizeof(size_t)); } static int test_param_bignum(int n) { - unsigned char buf[MAX_LEN], bnbuf[MAX_LEN], le[MAX_LEN]; + unsigned char buf[MAX_LEN], bnbuf[MAX_LEN]; const size_t len = raw_values[n].len; size_t bnsize; BIGNUM *b = NULL, *c = NULL; @@ -406,9 +384,8 @@ static int test_param_bignum(int n) param.data_size = len; param.return_size = &bnsize; - copy_be_to_native(buf, raw_values[n].value, len); - swap_copy(le, raw_values[n].value, len); - if (!TEST_ptr(b = BN_bin2bn(raw_values[n].value, (int)len, NULL))) + le_copy(buf, raw_values[n].value, len); + if (!TEST_ptr(b = BN_lebin2bn(raw_values[n].value, (int)len, NULL))) goto err; if (!TEST_true(OSSL_PARAM_set_BN(¶m, b)) @@ -471,7 +448,6 @@ static int test_param_construct(void) void *vp, *vpn = NULL, *vp2; OSSL_PARAM *p; const OSSL_PARAM *cp; - static const OSSL_PARAM pend = OSSL_PARAM_END; int i, n = 0, ret = 0; unsigned int u; long int l; @@ -499,9 +475,9 @@ static int test_param_construct(void) &sz); params[n++] = OSSL_PARAM_construct_octet_string("octstr", buf, sizeof(buf), &sz); - params[n++] = OSSL_PARAM_construct_utf8_ptr("utf8ptr", &bufp, &sz); - params[n++] = OSSL_PARAM_construct_octet_ptr("octptr", &vp, &sz); - params[n] = pend; + params[n++] = OSSL_PARAM_construct_utf8_ptr("utf8ptr", &bufp, 0, &sz); + params[n++] = OSSL_PARAM_construct_octet_ptr("octptr", &vp, 0, &sz); + params[n] = OSSL_PARAM_construct_end(); /* Search failure */ if (!TEST_ptr_null(OSSL_PARAM_locate(params, "fnord"))) diff --git a/test/params_test.c b/test/params_test.c index 338e6b20..aae91f1f 100644 --- a/test/params_test.c +++ b/test/params_test.c @@ -143,8 +143,10 @@ static int raw_set_params(void *vobj, const OSSL_PARAM *params) return 0; } else if (strcmp(params->key, "p5") == 0) { strncpy(obj->p5, params->data, params->data_size); + obj->p5_l = strlen(obj->p5) + 1; } else if (strcmp(params->key, "p6") == 0) { obj->p6 = *(const char **)params->data; + obj->p6_l = params->data_size; } return 1; @@ -233,10 +235,13 @@ static int api_set_params(void *vobj, const OSSL_PARAM *params) char *p5_ptr = obj->p5; if (!TEST_true(OSSL_PARAM_get_utf8_string(p, &p5_ptr, sizeof(obj->p5)))) return 0; + obj->p5_l = strlen(obj->p5) + 1; + } + if ((p = OSSL_PARAM_locate(params, "p6")) != NULL) { + if (!TEST_true(OSSL_PARAM_get_utf8_ptr(p, &obj->p6))) + return 0; + obj->p6_l = strlen(obj->p6) + 1; } - if ((p = OSSL_PARAM_locate(params, "p6")) != NULL - && !TEST_true(OSSL_PARAM_get_utf8_ptr(p, &obj->p6))) - return 0; return 1; } @@ -364,7 +369,8 @@ static const OSSL_PARAM static_raw_params[] = { &bignumbin_l }, { "p4", OSSL_PARAM_UTF8_STRING, &app_p4, sizeof(app_p4), &app_p4_l }, { "p5", OSSL_PARAM_UTF8_STRING, &app_p5, sizeof(app_p5), &app_p5_l }, - { "p6", OSSL_PARAM_UTF8_PTR, &app_p6, sizeof(app_p6), &app_p6_l }, + /* sizeof(app_p6_init), because we know that's what we're using */ + { "p6", OSSL_PARAM_UTF8_PTR, &app_p6, sizeof(app_p6_init), &app_p6_l }, { "foo", OSSL_PARAM_OCTET_STRING, &foo, sizeof(foo), &foo_l }, { NULL, 0, NULL, 0, NULL } }; @@ -377,8 +383,9 @@ static const OSSL_PARAM static_api_params[] = { &app_p4, sizeof(app_p4), &app_p4_l), OSSL_PARAM_DEFN("p5", OSSL_PARAM_UTF8_STRING, &app_p5, sizeof(app_p5), &app_p5_l), + /* sizeof(app_p6_init), because we know that's what we're using */ OSSL_PARAM_DEFN("p6", OSSL_PARAM_UTF8_PTR, - &app_p6, sizeof(app_p6), &app_p6_l), + &app_p6, sizeof(app_p6_init), &app_p6_l), OSSL_PARAM_DEFN("foo", OSSL_PARAM_OCTET_STRING, &foo, sizeof(foo), &foo_l), OSSL_PARAM_END }; @@ -391,7 +398,6 @@ static OSSL_PARAM *construct_api_params(void) { size_t n = 0; static OSSL_PARAM params[10]; - OSSL_PARAM param_end = OSSL_PARAM_END; params[n++] = OSSL_PARAM_construct_int("p1", &app_p1, NULL); params[n++] = OSSL_PARAM_construct_BN("p3", bignumbin, sizeof(bignumbin), @@ -400,11 +406,12 @@ static OSSL_PARAM *construct_api_params(void) &app_p4_l); params[n++] = OSSL_PARAM_construct_utf8_string("p5", app_p5, sizeof(app_p5), &app_p5_l); + /* sizeof(app_p6_init), because we know that's what we're using */ params[n++] = OSSL_PARAM_construct_utf8_ptr("p6", (char **)&app_p6, - &app_p6_l); + sizeof(app_p6_init), &app_p6_l); params[n++] = OSSL_PARAM_construct_octet_string("foo", &foo, sizeof(foo), &foo_l); - params[n++] = param_end; + params[n++] = OSSL_PARAM_construct_end(); return params; } @@ -473,7 +480,9 @@ static int test_case_variant(const OSSL_PARAM *params, || !TEST_ptr(BN_native2bn(bignumbin, bignumbin_l, app_p3)) || !TEST_BN_eq(app_p3, verify_p3) /* "provider" value */ || !TEST_str_eq(app_p4, p4_init) /* "provider" value */ + || !TEST_size_t_eq(app_p5_l, sizeof(p5_init)) /* "provider" value */ || !TEST_str_eq(app_p5, p5_init) /* "provider" value */ + || !TEST_size_t_eq(app_p6_l, sizeof(p6_init)) /* "provider" value */ || !TEST_str_eq(app_p6, p6_init) /* "provider" value */ || !TEST_char_eq(foo[0], app_foo_init) /* Should remain untouched */ || !TEST_int_eq(foo_l, sizeof(app_foo_init))) @@ -494,7 +503,11 @@ static int test_case_variant(const OSSL_PARAM *params, || !TEST_double_eq(sneakpeek->p2, p2_init) /* Should remain untouched */ || !TEST_BN_eq(sneakpeek->p3, app_p3) /* app value set */ || !TEST_str_eq(sneakpeek->p4, app_p4) /* app value set */ - || !TEST_str_eq(sneakpeek->p5, app_p5)) /* app value set */ + || !TEST_size_t_eq(sneakpeek->p5_l, app_p5_l) /* app value set */ + || !TEST_str_eq(sneakpeek->p5, app_p5) /* app value set */ + || !TEST_size_t_eq(sneakpeek->p6_l, + sizeof(app_p6_init)) /* app value set */ + || !TEST_str_eq(sneakpeek->p6, app_p6)) /* app value set */ errcnt++; } @@ -516,7 +529,11 @@ static int test_case_variant(const OSSL_PARAM *params, || !TEST_ptr(BN_native2bn(bignumbin, bignumbin_l, app_p3)) || !TEST_BN_eq(app_p3, verify_p3) /* app value */ || !TEST_str_eq(app_p4, app_p4_init) /* app value */ + || !TEST_size_t_eq(app_p5_l, + sizeof(app_p5_init)) /* app value */ || !TEST_str_eq(app_p5, app_p5_init) /* app value */ + || !TEST_size_t_eq(app_p6_l, + sizeof(app_p6_init)) /* app value */ || !TEST_str_eq(app_p6, app_p6_init) /* app value */ || !TEST_char_eq(foo[0], app_foo_init) /* Should remain untouched */ || !TEST_int_eq(foo_l, sizeof(app_foo_init))) diff --git a/test/provider_internal_test.c b/test/provider_internal_test.c index 7f6bb20e..6123d6b4 100644 --- a/test/provider_internal_test.c +++ b/test/provider_internal_test.c @@ -8,14 +8,10 @@ */ #include +#include #include "internal/provider.h" #include "testutil.h" -#if !defined(DSO_VMS) && !defined(DSO_DLCFN) && !defined(DSO_DL) \ - && !defined(DSO_WIN32) && !defined(DSO_DLFCN) -# define OPENSSL_NO_DSO -#endif - extern OSSL_provider_init_fn PROVIDER_INIT_FUNCTION_NAME; static char buf[256]; @@ -25,20 +21,11 @@ static OSSL_PARAM greeting_request[] = { { NULL, 0, NULL, 0, NULL } }; -static int test_provider(OSSL_PROVIDER *prov) +static int test_provider(OSSL_PROVIDER *prov, const char *expected_greeting) { - const char *name = NULL; const char *greeting = NULL; - char expected_greeting[256]; int ret = 0; - if (!TEST_ptr(name = ossl_provider_name(prov))) - return 0; - - BIO_snprintf(expected_greeting, sizeof(expected_greeting), - "Hello OpenSSL %.20s, greetings from %s!", - OPENSSL_VERSION_STR, name); - ret = TEST_true(ossl_provider_activate(prov)) && TEST_true(ossl_provider_get_params(prov, greeting_request)) @@ -46,10 +33,22 @@ static int test_provider(OSSL_PROVIDER *prov) && TEST_size_t_gt(greeting_request[0].data_size, 0) && TEST_str_eq(greeting, expected_greeting); + TEST_info("Got this greeting: %s\n", greeting); ossl_provider_free(prov); return ret; } +static const char *expected_greeting1(const char *name) +{ + static char expected_greeting[256] = ""; + + BIO_snprintf(expected_greeting, sizeof(expected_greeting), + "Hello OpenSSL %.20s, greetings from %s!", + OPENSSL_VERSION_STR, name); + + return expected_greeting; +} + static int test_builtin_provider(void) { const char *name = "p_test_builtin"; @@ -58,10 +57,10 @@ static int test_builtin_provider(void) return TEST_ptr(prov = ossl_provider_new(NULL, name, PROVIDER_INIT_FUNCTION_NAME)) - && test_provider(prov); + && test_provider(prov, expected_greeting1(name)); } -#ifndef OPENSSL_NO_DSO +#ifndef NO_PROVIDER_MODULE static int test_loaded_provider(void) { const char *name = "p_test"; @@ -69,15 +68,30 @@ static int test_loaded_provider(void) return TEST_ptr(prov = ossl_provider_new(NULL, name, NULL)) - && test_provider(prov); + && test_provider(prov, expected_greeting1(name)); +} + +static int test_configured_provider(void) +{ + const char *name = "p_test_configured"; + OSSL_PROVIDER *prov = NULL; + /* This MUST match the config file */ + const char *expected_greeting = + "Hello OpenSSL, greetings from Test Provider"; + + return + OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL) + && TEST_ptr(prov = ossl_provider_find(NULL, name)) + && test_provider(prov, expected_greeting); } #endif int setup_tests(void) { ADD_TEST(test_builtin_provider); -#ifndef OPENSSL_NO_DSO +#ifndef NO_PROVIDER_MODULE ADD_TEST(test_loaded_provider); + ADD_TEST(test_configured_provider); #endif return 1; } diff --git a/test/provider_internal_test.conf.in b/test/provider_internal_test.conf.in new file mode 100644 index 00000000..12c29243 --- /dev/null +++ b/test/provider_internal_test.conf.in @@ -0,0 +1,13 @@ +{- use platform -} +openssl_conf = openssl_init + +[openssl_init] +providers = providers + +[providers] +p_test_configured = p_test_configured + +[p_test_configured] +module = {- platform->dso('p_test') -} +activate = 1 +greeting = Hello OpenSSL, greetings from Test Provider diff --git a/test/provider_test.c b/test/provider_test.c index cba7cbaa..c00f5ab4 100644 --- a/test/provider_test.c +++ b/test/provider_test.c @@ -11,12 +11,6 @@ #include #include "testutil.h" -#if !defined(DSO_VMS) && !defined(DSO_DLCFN) && !defined(DSO_DL) \ - && !defined(DSO_WIN32) && !defined(DSO_DLFCN) -# define OPENSSL_NO_DSO -#endif - - extern OSSL_provider_init_fn PROVIDER_INIT_FUNCTION_NAME; static char buf[256]; @@ -55,7 +49,7 @@ static int test_builtin_provider(void) && test_provider(name); } -#ifndef OPENSSL_NO_DSO +#ifndef NO_PROVIDER_MODULE static int test_loaded_provider(void) { const char *name = "p_test"; @@ -67,7 +61,7 @@ static int test_loaded_provider(void) int setup_tests(void) { ADD_TEST(test_builtin_provider); -#ifndef OPENSSL_NO_DSO +#ifndef NO_PROVIDER_MODULE ADD_TEST(test_loaded_provider); #endif return 1; diff --git a/test/recipes/02-test_internal_provider.t b/test/recipes/02-test_internal_provider.t index 8275eb27..615d17a8 100644 --- a/test/recipes/02-test_internal_provider.t +++ b/test/recipes/02-test_internal_provider.t @@ -7,12 +7,13 @@ # https://www.openssl.org/source/license.html use strict; -use OpenSSL::Test qw(:DEFAULT bldtop_dir); +use OpenSSL::Test qw(:DEFAULT bldtop_dir bldtop_file); use OpenSSL::Test::Simple; use OpenSSL::Test::Utils; setup("test_internal_provider"); -$ENV{"OPENSSL_MODULES"} = bldtop_dir("test"); +$ENV{OPENSSL_MODULES} = bldtop_dir("test"); +$ENV{OPENSSL_CONF} = bldtop_file("test", "provider_internal_test.conf"); simple_test("test_internal_provider", "provider_internal_test"); diff --git a/test/recipes/05-test_md2.t b/test/recipes/05-test_md2.t index 8ac4f38b..e60e7912 100644 --- a/test/recipes/05-test_md2.t +++ b/test/recipes/05-test_md2.t @@ -8,5 +8,10 @@ use OpenSSL::Test::Simple; +use OpenSSL::Test qw/:DEFAULT bldtop_dir/; + +setup("test_md2"); + +$ENV{OPENSSL_MODULES} = bldtop_dir("providers"); simple_test("test_md2", "md2test", "md2"); diff --git a/test/recipes/15-test_ecparam.t b/test/recipes/15-test_ecparam.t index 1d0b59c1..ee147757 100644 --- a/test/recipes/15-test_ecparam.t +++ b/test/recipes/15-test_ecparam.t @@ -23,12 +23,20 @@ plan skip_all => "EC isn't supported in this build" my @valid = glob(data_file("valid", "*.pem")); my @invalid = glob(data_file("invalid", "*.pem")); -plan tests => scalar @valid + scalar @invalid; +plan tests => scalar @valid + scalar @invalid + scalar @valid + scalar @invalid; foreach (@valid) { ok(run(app([qw{openssl ecparam -noout -check -in}, $_]))); } +foreach (@valid) { + ok(run(app([qw{openssl ecparam -noout -check_named -in}, $_]))); +} + foreach (@invalid) { ok(!run(app([qw{openssl ecparam -noout -check -in}, $_]))); } + +foreach (@invalid) { + ok(!run(app([qw{openssl ecparam -noout -check_named -in}, $_]))); +} diff --git a/test/recipes/25-test_verify.t b/test/recipes/25-test_verify.t index e4939478..96bfd03e 100644 --- a/test/recipes/25-test_verify.t +++ b/test/recipes/25-test_verify.t @@ -375,7 +375,7 @@ SKIP: { } SKIP: { - skip "SM2 is not supported by this OpenSSL build", 1 + skip "SM2 is not supported by this OpenSSL build", 2 if disabled("sm2"); # Test '-sm2-id' and '-sm2-hex-id' option diff --git a/test/recipes/30-test_evp_data/evpciph.txt b/test/recipes/30-test_evp_data/evpciph.txt index c6a117cf..7c87a6fd 100644 --- a/test/recipes/30-test_evp_data/evpciph.txt +++ b/test/recipes/30-test_evp_data/evpciph.txt @@ -1184,7 +1184,7 @@ Key = 0000000000000000000000000000000000000000000000000000000000000000 IV = 00000000000000000000000000000000 Plaintext = 0000000000000000000000000000000000000000000000000000000000000000 Ciphertext = 917cf69ebd68b2ec9b9fe9a3eadda692cd43d2f59598ed858c02c2652fbf922e -Result = CIPHERUPDATE_ERROR +Result = KEY_SET_ERROR Cipher = aes-128-xts Key = 1111111111111111111111111111111122222222222222222222222222222222 diff --git a/test/recipes/30-test_evp_extra.t b/test/recipes/30-test_evp_extra.t index 98ecf26f..b6fd97af 100644 --- a/test/recipes/30-test_evp_extra.t +++ b/test/recipes/30-test_evp_extra.t @@ -10,9 +10,12 @@ use strict; use warnings; -use OpenSSL::Test; +use OpenSSL::Test qw/:DEFAULT bldtop_dir/; setup("test_evp_extra"); plan tests => 1; + +$ENV{OPENSSL_MODULES} = bldtop_dir("providers"); + ok(run(test(["evp_extra_test"])), "running evp_extra_test"); diff --git a/test/recipes/80-test_cms.t b/test/recipes/80-test_cms.t index 76f1ec20..7beebcc0 100644 --- a/test/recipes/80-test_cms.t +++ b/test/recipes/80-test_cms.t @@ -324,6 +324,14 @@ my @smime_cms_param_tests = ( "-CAfile", catfile($smdir, "smroot.pem"), "-out", "smtst.txt" ] ], + [ "signed content test streaming PEM format, RSA keys, PSS signature, saltlen=-3", + [ "-sign", "-in", $smcont, "-outform", "PEM", "-nodetach", + "-signer", catfile($smdir, "smrsa1.pem"), "-keyopt", "rsa_padding_mode:pss", + "-keyopt", "rsa_pss_saltlen:-3", "-out", "test.cms" ], + [ "-verify", "-in", "test.cms", "-inform", "PEM", + "-CAfile", catfile($smdir, "smroot.pem"), "-out", "smtst.txt" ] + ], + [ "signed content test streaming PEM format, RSA keys, PSS signature, no attributes", [ "-sign", "-in", $smcont, "-outform", "PEM", "-nodetach", "-noattr", "-signer", catfile($smdir, "smrsa1.pem"), "-keyopt", "rsa_padding_mode:pss", diff --git a/test/sslapitest.c b/test/sslapitest.c index bccf055f..7ca8c759 100644 --- a/test/sslapitest.c +++ b/test/sslapitest.c @@ -723,6 +723,8 @@ static int ping_pong_query(SSL *clientssl, SSL *serverssl, int cfd, int sfd) size_t err = 0; char crec_wseq_before[TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE]; char crec_wseq_after[TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE]; + char crec_rseq_before[TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE]; + char crec_rseq_after[TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE]; char srec_wseq_before[TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE]; char srec_wseq_after[TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE]; char srec_rseq_before[TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE]; @@ -731,6 +733,8 @@ static int ping_pong_query(SSL *clientssl, SSL *serverssl, int cfd, int sfd) cbuf[0] = count++; memcpy(crec_wseq_before, &clientssl->rlayer.write_sequence, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE); + memcpy(crec_rseq_before, &clientssl->rlayer.read_sequence, + TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE); memcpy(srec_wseq_before, &serverssl->rlayer.write_sequence, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE); memcpy(srec_rseq_before, &serverssl->rlayer.read_sequence, @@ -756,6 +760,8 @@ static int ping_pong_query(SSL *clientssl, SSL *serverssl, int cfd, int sfd) memcpy(crec_wseq_after, &clientssl->rlayer.write_sequence, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE); + memcpy(crec_rseq_after, &clientssl->rlayer.read_sequence, + TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE); memcpy(srec_wseq_after, &serverssl->rlayer.write_sequence, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE); memcpy(srec_rseq_after, &serverssl->rlayer.read_sequence, @@ -786,16 +792,33 @@ static int ping_pong_query(SSL *clientssl, SSL *serverssl, int cfd, int sfd) goto end; } - if (!TEST_mem_ne(srec_rseq_before, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE, - srec_rseq_after, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE)) - goto end; + if (clientssl->mode & SSL_MODE_NO_KTLS_RX) { + if (!TEST_mem_ne(crec_rseq_before, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE, + crec_rseq_after, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE)) + goto end; + } else { + if (!TEST_mem_eq(crec_rseq_before, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE, + crec_rseq_after, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE)) + goto end; + } + + if (serverssl->mode & SSL_MODE_NO_KTLS_RX) { + if (!TEST_mem_ne(srec_rseq_before, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE, + srec_rseq_after, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE)) + goto end; + } else { + if (!TEST_mem_eq(srec_rseq_before, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE, + srec_rseq_after, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE)) + goto end; + } return 1; end: return 0; } -static int execute_test_ktls(int cis_ktls_tx, int sis_ktls_tx) +static int execute_test_ktls(int cis_ktls_tx, int cis_ktls_rx, + int sis_ktls_tx, int sis_ktls_rx) { SSL_CTX *cctx = NULL, *sctx = NULL; SSL *clientssl = NULL, *serverssl = NULL; @@ -830,6 +853,16 @@ static int execute_test_ktls(int cis_ktls_tx, int sis_ktls_tx) goto end; } + if (!cis_ktls_rx) { + if (!TEST_true(SSL_set_mode(clientssl, SSL_MODE_NO_KTLS_RX))) + goto end; + } + + if (!sis_ktls_rx) { + if (!TEST_true(SSL_set_mode(serverssl, SSL_MODE_NO_KTLS_RX))) + goto end; + } + if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))) goto end; @@ -850,6 +883,22 @@ static int execute_test_ktls(int cis_ktls_tx, int sis_ktls_tx) goto end; } + if (!cis_ktls_rx) { + if (!TEST_false(BIO_get_ktls_recv(clientssl->rbio))) + goto end; + } else { + if (!TEST_true(BIO_get_ktls_recv(clientssl->rbio))) + goto end; + } + + if (!sis_ktls_rx) { + if (!TEST_false(BIO_get_ktls_recv(serverssl->rbio))) + goto end; + } else { + if (!TEST_true(BIO_get_ktls_recv(serverssl->rbio))) + goto end; + } + if (!TEST_true(ping_pong_query(clientssl, serverssl, cfd, sfd))) goto end; @@ -869,24 +918,84 @@ end: return testresult; } +static int test_ktls_no_txrx_client_no_txrx_server(void) +{ + return execute_test_ktls(0, 0, 0, 0); +} + +static int test_ktls_no_rx_client_no_txrx_server(void) +{ + return execute_test_ktls(1, 0, 0, 0); +} + +static int test_ktls_no_tx_client_no_txrx_server(void) +{ + return execute_test_ktls(0, 1, 0, 0); +} + +static int test_ktls_client_no_txrx_server(void) +{ + return execute_test_ktls(1, 1, 0, 0); +} + +static int test_ktls_no_txrx_client_no_rx_server(void) +{ + return execute_test_ktls(0, 0, 1, 0); +} + +static int test_ktls_no_rx_client_no_rx_server(void) +{ + return execute_test_ktls(1, 0, 1, 0); +} + +static int test_ktls_no_tx_client_no_rx_server(void) +{ + return execute_test_ktls(0, 1, 1, 0); +} + +static int test_ktls_client_no_rx_server(void) +{ + return execute_test_ktls(1, 1, 1, 0); +} + +static int test_ktls_no_txrx_client_no_tx_server(void) +{ + return execute_test_ktls(0, 0, 0, 1); +} + +static int test_ktls_no_rx_client_no_tx_server(void) +{ + return execute_test_ktls(1, 0, 0, 1); +} + +static int test_ktls_no_tx_client_no_tx_server(void) +{ + return execute_test_ktls(0, 1, 0, 1); +} + +static int test_ktls_client_no_tx_server(void) +{ + return execute_test_ktls(1, 1, 0, 1); +} + +static int test_ktls_no_txrx_client_server(void) +{ + return execute_test_ktls(0, 0, 1, 1); +} + +static int test_ktls_no_rx_client_server(void) +{ + return execute_test_ktls(1, 0, 1, 1); +} + +static int test_ktls_no_tx_client_server(void) +{ + return execute_test_ktls(0, 1, 1, 1); +} + static int test_ktls_client_server(void) { - return execute_test_ktls(1, 1); -} - -static int test_ktls_no_client_server(void) -{ - return execute_test_ktls(0, 1); -} - -static int test_ktls_client_no_server(void) -{ - return execute_test_ktls(1, 0); -} - -static int test_ktls_no_client_no_server(void) -{ - return execute_test_ktls(0, 0); + return execute_test_ktls(1, 1, 1, 1); } #endif @@ -6155,10 +6264,22 @@ int setup_tests(void) #if !defined(OPENSSL_NO_TLS1_2) && !defined(OPENSSL_NO_KTLS) \ && !defined(OPENSSL_NO_SOCK) + ADD_TEST(test_ktls_no_txrx_client_no_txrx_server); + ADD_TEST(test_ktls_no_rx_client_no_txrx_server); + ADD_TEST(test_ktls_no_tx_client_no_txrx_server); + ADD_TEST(test_ktls_client_no_txrx_server); + ADD_TEST(test_ktls_no_txrx_client_no_rx_server); + ADD_TEST(test_ktls_no_rx_client_no_rx_server); + ADD_TEST(test_ktls_no_tx_client_no_rx_server); + ADD_TEST(test_ktls_client_no_rx_server); + ADD_TEST(test_ktls_no_txrx_client_no_tx_server); + ADD_TEST(test_ktls_no_rx_client_no_tx_server); + ADD_TEST(test_ktls_no_tx_client_no_tx_server); + ADD_TEST(test_ktls_client_no_tx_server); + ADD_TEST(test_ktls_no_txrx_client_server); + ADD_TEST(test_ktls_no_rx_client_server); + ADD_TEST(test_ktls_no_tx_client_server); ADD_TEST(test_ktls_client_server); - ADD_TEST(test_ktls_no_client_server); - ADD_TEST(test_ktls_client_no_server); - ADD_TEST(test_ktls_no_client_no_server); #endif ADD_TEST(test_large_message_tls); ADD_TEST(test_large_message_tls_read_ahead); diff --git a/test/verify_extra_test.c b/test/verify_extra_test.c index 468de620..f16b3f0b 100644 --- a/test/verify_extra_test.c +++ b/test/verify_extra_test.c @@ -8,6 +8,7 @@ */ #include +#include #include #include #include @@ -177,6 +178,48 @@ static int test_store_ctx(void) OPT_TEST_DECLARE_USAGE("roots.pem untrusted.pem bad.pem\n") +#ifndef OPENSSL_NO_SM2 +static int test_sm2_id(void) +{ + /* we only need an X509 structure, no matter if it's a real SM2 cert */ + X509 *x = NULL; + BIO *bio = NULL; + int ret = 0; + ASN1_OCTET_STRING *v = NULL, *v2 = NULL; + char *sm2id = "this is an ID"; + + bio = BIO_new_file(bad_f, "r"); + if (bio == NULL) + goto err; + + x = PEM_read_bio_X509(bio, NULL, 0, NULL); + if (x == NULL) + goto err; + + v = ASN1_OCTET_STRING_new(); + if (v == NULL) + goto err; + + if (!ASN1_OCTET_STRING_set(v, (unsigned char *)sm2id, (int)strlen(sm2id))) { + ASN1_OCTET_STRING_free(v); + goto err; + } + + X509_set0_sm2_id(x, v); + + v2 = X509_get0_sm2_id(x); + if (!TEST_ptr(v2) + || !TEST_int_eq(ASN1_OCTET_STRING_cmp(v, v2), 0)) + goto err; + + ret = 1; + err: + X509_free(x); + BIO_free(bio); + return ret; +} +#endif + int setup_tests(void) { if (!TEST_ptr(roots_f = test_get_argument(0)) @@ -186,5 +229,8 @@ int setup_tests(void) ADD_TEST(test_alt_chains_cert_forgery); ADD_TEST(test_store_ctx); +#ifndef OPENSSL_NO_SM2 + ADD_TEST(test_sm2_id); +#endif return 1; } diff --git a/util/find-doc-nits b/util/find-doc-nits index 5d5c2d05..66966eb3 100755 --- a/util/find-doc-nits +++ b/util/find-doc-nits @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2002-2018 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2002-2019 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -142,16 +142,18 @@ sub name_synopsis() } } -# Check if EXAMPLES is located after RETURN VALUES section. -sub check_example_location() +# Check if SECTION is located before BEFORE +sub check_section_location() { my $filename = shift; my $contents = shift; + my $section = shift; + my $before = shift; - return unless $contents =~ /=head1 RETURN VALUES/ - and $contents =~ /=head1 EXAMPLES/; - print "$filename: RETURN VAULES should be placed before EXAMPLES section\n" - if $contents =~ /=head1 EXAMPLES.*=head1 RETURN VALUES/ms; + return unless $contents =~ /=head1 $section/ + and $contents =~ /=head1 $before/; + print "$filename: $section should be placed before $before section\n" + if $contents =~ /=head1 $before.*=head1 $section/ms; } sub check() @@ -167,7 +169,12 @@ sub check() close POD; } - &check_example_location($filename, $contents) if $filename =~ m|man3/|; + # Check if EXAMPLES is located after RETURN VALUES section. + &check_section_location($filename, $contents, "RETURN VALUES", "EXAMPLES") if $filename =~ m|man3/|; + # Check if HISTORY is located after SEE ALSO + &check_section_location($filename, $contents, "SEE ALSO", "HISTORY") if $filename =~ m|man3/|; + # Check if SEE ALSO is located after EXAMPLES + &check_section_location($filename, $contents, "EXAMPLES", "SEE ALSO") if $filename =~ m|man3/|; my $id = "${filename}:1:"; diff --git a/util/libcrypto.num b/util/libcrypto.num index 8b153624..3cd27492 100644 --- a/util/libcrypto.num +++ b/util/libcrypto.num @@ -684,7 +684,7 @@ PKCS7_SIGNER_INFO_it 683 3_0_0 EXIST:!EXPORT_VAR_AS_FUNCTION: PKCS7_SIGNER_INFO_it 683 3_0_0 EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION: CRYPTO_ocb128_copy_ctx 684 3_0_0 EXIST::FUNCTION:OCB TS_REQ_get_ext_d2i 685 3_0_0 EXIST::FUNCTION:TS -AES_ige_encrypt 686 3_0_0 EXIST::FUNCTION: +AES_ige_encrypt 686 3_0_0 EXIST::FUNCTION:DEPRECATEDIN_3 d2i_SXNET 687 3_0_0 EXIST::FUNCTION: CTLOG_get0_log_id 688 3_0_0 EXIST::FUNCTION:CT CMS_RecipientInfo_ktri_get0_signer_id 689 3_0_0 EXIST::FUNCTION:CMS @@ -1456,7 +1456,7 @@ EVP_PKEY_get0_DH 1442 3_0_0 EXIST::FUNCTION:DH d2i_OCSP_CRLID 1443 3_0_0 EXIST::FUNCTION:OCSP EVP_CIPHER_CTX_set_padding 1444 3_0_0 EXIST::FUNCTION: CTLOG_new_from_base64 1445 3_0_0 EXIST::FUNCTION:CT -AES_bi_ige_encrypt 1446 3_0_0 EXIST::FUNCTION: +AES_bi_ige_encrypt 1446 3_0_0 EXIST::FUNCTION:DEPRECATEDIN_3 ERR_pop_to_mark 1447 3_0_0 EXIST::FUNCTION: CRL_DIST_POINTS_new 1449 3_0_0 EXIST::FUNCTION: EVP_PKEY_get0_asn1 1450 3_0_0 EXIST::FUNCTION: @@ -4788,9 +4788,12 @@ OSSL_PARAM_get_utf8_ptr 4735 3_0_0 EXIST::FUNCTION: OSSL_PARAM_set_utf8_ptr 4736 3_0_0 EXIST::FUNCTION: OSSL_PARAM_get_octet_ptr 4737 3_0_0 EXIST::FUNCTION: OSSL_PARAM_set_octet_ptr 4738 3_0_0 EXIST::FUNCTION: -X509_set_sm2_id 4739 3_0_0 EXIST::FUNCTION:SM2 +X509_set0_sm2_id 4739 3_0_0 EXIST::FUNCTION:SM2 X509_get0_sm2_id 4740 3_0_0 EXIST::FUNCTION:SM2 EVP_PKEY_get0_engine 4741 3_0_0 EXIST::FUNCTION:ENGINE EVP_MD_upref 4742 3_0_0 EXIST::FUNCTION: EVP_MD_fetch 4743 3_0_0 EXIST::FUNCTION: -EVP_chacha20_poly1305_draft 4744 3_0_0 EXIST::FUNCTION:CHACHA,POLY1305 +EVP_set_default_properties 4744 3_0_0 EXIST::FUNCTION: +OSSL_PARAM_construct_end 4745 3_0_0 EXIST::FUNCTION: +EC_GROUP_check_named_curve 4746 3_0_0 EXIST::FUNCTION:EC +EVP_chacha20_poly1305_draft 4747 3_0_0 EXIST::FUNCTION:CHACHA,POLY1305 diff --git a/util/libssl.num b/util/libssl.num index d59ccf99..2a9a218d 100644 --- a/util/libssl.num +++ b/util/libssl.num @@ -503,3 +503,4 @@ SSL_CTX_set_async_callback_arg 503 3_0_0 EXIST::FUNCTION: SSL_set_async_callback 504 3_0_0 EXIST::FUNCTION: SSL_set_async_callback_arg 505 3_0_0 EXIST::FUNCTION: SSL_get_async_status 506 3_0_0 EXIST::FUNCTION: +SSL_CTX_set_timeout_tls13 507 3_0_0 EXIST::FUNCTION: diff --git a/util/perl/OpenSSL/Test.pm b/util/perl/OpenSSL/Test.pm index daf40cb1..5d6e9d9b 100644 --- a/util/perl/OpenSSL/Test.pm +++ b/util/perl/OpenSSL/Test.pm @@ -1,4 +1,4 @@ -# Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2016-2019 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -14,7 +14,7 @@ use Test::More 0.96; use Exporter; use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS); -$VERSION = "0.8"; +$VERSION = "1.0"; @ISA = qw(Exporter); @EXPORT = (@Test::More::EXPORT, qw(setup run indir cmd app fuzz test perlapp perltest subtest)); @@ -22,7 +22,8 @@ $VERSION = "0.8"; srctop_dir srctop_file data_file data_dir pipe with cmdstr quotify - openssl_versions)); + openssl_versions + ok_nofips is_nofips isnt_nofips)); =head1 NAME @@ -831,6 +832,63 @@ sub openssl_versions { return @versions; } +=over 4 + +=item B + +C is equivalent to using C when the environment variable +C is undefined, otherwise it is equivalent to C. This can be +used for C tests that must fail when testing a FIPS provider. The parameters +are the same as used by C which is an expression EXPR followed by the test +description TEST_NAME. + +An example: + + ok_nofips(run(app(["md5.pl"])), "md5 should fail in fips mode"); + +=item B + +C is equivalent to using C when the environment variable +C is undefined, otherwise it is equivalent to C. This can be +used for C tests that must fail when testing a FIPS provider. The parameters +are the same as used by C which has 2 arguments EXPR1 and EXPR2 that can be +compared using eq or ne, followed by a test description TEST_NAME. + +An example: + + is_nofips(ultimate_answer(), 42, "Meaning of Life"); + +=item B + +C is equivalent to using C when the environment variable +C is undefined, otherwise it is equivalent to C. This can be +used for C tests that must fail when testing a FIPS provider. The +parameters are the same as used by C which has 2 arguments EXPR1 and EXPR2 +that can be compared using ne or eq, followed by a test description TEST_NAME. + +An example: + + isnt_nofips($foo, '', "Got some foo"); + +=back + +=cut + +sub ok_nofips { + return ok(!$_[0], @_[1..$#_]) if defined $ENV{FIPS_MODE}; + return ok($_[0], @_[1..$#_]); +} + +sub is_nofips { + return isnt($_[0], $_[1], @_[2..$#_]) if defined $ENV{FIPS_MODE}; + return is($_[0], $_[1], @_[2..$#_]); +} + +sub isnt_nofips { + return is($_[0], $_[1], @_[2..$#_]) if defined $ENV{FIPS_MODE}; + return isnt($_[0], $_[1], @_[2..$#_]); +} + ###################################################################### # private functions. These are never exported. @@ -861,6 +919,12 @@ are located. Defaults to C<$TOP/test> (adapted to the operating system). If defined, it puts testing in a different mode, where a recipe with failures will result in a C at the end of its run. +=item B + +If defined it indicates that the FIPS provider is being tested. Tests may use +B, B and B to invert test results +i.e. Some tests may only work in non FIPS mode. + =back =cut diff --git a/util/perl/OpenSSL/Test/Utils.pm b/util/perl/OpenSSL/Test/Utils.pm index 18ef9685..dcff6a5c 100644 --- a/util/perl/OpenSSL/Test/Utils.pm +++ b/util/perl/OpenSSL/Test/Utils.pm @@ -1,4 +1,4 @@ -# Copyright 2016 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2016-2019 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -53,6 +53,7 @@ STRING is "tls", or for all the available DTLS versions if STRING is returned list can be used with B and B. =item B + =item B In an array context returns an array with each element set to 1 if the @@ -67,6 +68,7 @@ disabled. Returns an item from the %config hash in \$TOP/configdata.pm. =item B + =item B Return true if IPv4 / IPv6 is possible to use on the current system. @@ -225,7 +227,6 @@ sub have_IPv6 { return $have_IPv6; } - =head1 SEE ALSO L diff --git a/util/private.num b/util/private.num index 6c37fc05..f15957b1 100644 --- a/util/private.num +++ b/util/private.num @@ -116,6 +116,7 @@ BIO_get_cipher_ctx define BIO_get_cipher_status define BIO_get_close define BIO_get_ktls_send define +BIO_get_ktls_recv define BIO_get_conn_address define BIO_get_conn_hostname define BIO_get_conn_port define