From 75a46534f3911151895652337634643b40b2b482 Mon Sep 17 00:00:00 2001 From: Hakase Date: Sat, 22 Sep 2018 13:24:05 +0900 Subject: [PATCH] Latest update - https://github.com/openssl/openssl/commit/46d085096c6ead624c61e4b8b301421301511e64 --- Configurations/00-base-templates.conf | 2 +- Configurations/README | 2 +- Configurations/common0.tmpl | 2 +- INSTALL | 10 +-- apps/ca.c | 2 +- crypto/LPdir_unix.c | 2 +- crypto/bn/asm/x86_64-gcc.c | 6 -- crypto/engine/eng_devcrypto.c | 2 +- crypto/evp/e_aes.c | 2 +- crypto/o_fopen.c | 4 +- crypto/rsa/rsa_meth.c | 4 +- crypto/ui/ui_openssl.c | 18 +++++ demos/evp/Makefile | 8 +- demos/evp/gmac.c | 103 ++++++++++++++++++++++++ doc/man1/enc.pod | 25 ++++++ doc/man3/EVP_PKEY_CTX_set_hkdf_md.pod | 4 +- doc/man3/RSA_meth_new.pod | 4 +- doc/man3/SSL_CTX_set_quiet_shutdown.pod | 4 +- doc/man3/SSL_get_error.pod | 2 +- doc/man3/SSL_set_shutdown.pod | 8 +- doc/man3/SSL_shutdown.pod | 78 ++++++++++-------- doc/man7/RAND_DRBG.pod | 2 +- e_os.h | 2 +- include/openssl/rsa.h | 4 +- ssl/ssl_ciph.c | 2 +- ssl/ssl_lib.c | 4 + ssl/ssl_locl.h | 3 +- ssl/statem/statem_srvr.c | 32 ++++---- test/build.info | 5 +- test/evp_test.c | 4 +- test/rsa_complex.c | 27 +++++++ test/sslapitest.c | 95 ++++++++++++++++++++++ test/ssltestlib.c | 4 +- util/add-depends.pl | 6 +- util/mkdef.pl | 2 +- 35 files changed, 384 insertions(+), 100 deletions(-) create mode 100644 demos/evp/gmac.c create mode 100644 test/rsa_complex.c diff --git a/Configurations/00-base-templates.conf b/Configurations/00-base-templates.conf index 516e3cd5..dd0649d2 100644 --- a/Configurations/00-base-templates.conf +++ b/Configurations/00-base-templates.conf @@ -45,7 +45,7 @@ my %targets=( shared_extension => "", #### Defaults for the benefit of the config targets who don't inherit - #### a BASE and assume Unixly defaults + #### a BASE and assume Unix defaults #### THESE WILL DISAPPEAR IN OpenSSL 1.2 build_scheme => [ "unified", "unix" ], build_file => "Makefile", diff --git a/Configurations/README b/Configurations/README index 6ae981f9..a03d445a 100644 --- a/Configurations/README +++ b/Configurations/README @@ -233,7 +233,7 @@ In each table entry, the following keys are significant: apps, as needed by the target. This code cannot be placed in a library, as the rest of the code isn't expected to link to it - explicitely. + explicitly. cpuid_asm_src => assembler implementation of cpuid code as well as OPENSSL_cleanse(). Default to mem_clr.c diff --git a/Configurations/common0.tmpl b/Configurations/common0.tmpl index c0060095..03acb3e0 100644 --- a/Configurations/common0.tmpl +++ b/Configurations/common0.tmpl @@ -16,7 +16,7 @@ ? () : ( map { @{$unified_info{shared_sources}->{$_}} } keys %{$unified_info{shared_sources}} ), - # Things we explicitely depend on are usually generated + # Things we explicitly depend on are usually generated ( map { $_ eq "" ? () : @{$unified_info{depends}->{$_}} } keys %{$unified_info{depends}} )); our @generated = diff --git a/INSTALL b/INSTALL index ff0aa6d1..4ce6651b 100644 --- a/INSTALL +++ b/INSTALL @@ -614,8 +614,8 @@ Windows, and as a comma separated list of libraries on VMS. RANLIB The library archive indexer. - RC The Windows resources manipulator. - RCFLAGS Flags for the Windows reources manipulator. + RC The Windows resource compiler. + RCFLAGS Flags for the Windows resource compiler. RM The command to remove files and directories. These cannot be mixed with compiling / linking flags given @@ -969,7 +969,7 @@ BUILDFILE Use a different build file name than the platform default - ("Makefile" on Unixly platforms, "makefile" on native Windows, + ("Makefile" on Unix-like platforms, "makefile" on native Windows, "descrip.mms" on OpenVMS). This requires that there is a corresponding build file template. See Configurations/README for further information. @@ -1171,7 +1171,7 @@ part of the file name, i.e. for OpenSSL 1.1.x, 1.1 is somehow part of the name. - On most POSIXly platforms, shared libraries are named libcrypto.so.1.1 + On most POSIX platforms, shared libraries are named libcrypto.so.1.1 and libssl.so.1.1. on Cygwin, shared libraries are named cygcrypto-1.1.dll and cygssl-1.1.dll @@ -1202,7 +1202,7 @@ The seeding method can be configured using the --with-rand-seed option, which can be used to specify a comma separated list of seed methods. However in most cases OpenSSL will choose a suitable default method, - so it is not necessary to explicitely provide this option. Note also + so it is not necessary to explicitly provide this option. Note also that not all methods are available on all platforms. I) On operating systems which provide a suitable randomness source (in diff --git a/apps/ca.c b/apps/ca.c index 48f7cd19..847809a5 100644 --- a/apps/ca.c +++ b/apps/ca.c @@ -605,7 +605,7 @@ end_of_options: /* * outdir is a directory spec, but access() for VMS demands a * filename. We could use the DEC C routine to convert the - * directory syntax to Unixly, and give that to app_isdir, + * directory syntax to Unix, and give that to app_isdir, * but for now the fopen will catch the error if it's not a * directory */ diff --git a/crypto/LPdir_unix.c b/crypto/LPdir_unix.c index 356089d7..b1022895 100644 --- a/crypto/LPdir_unix.c +++ b/crypto/LPdir_unix.c @@ -51,7 +51,7 @@ #endif /* - * The POSIXly macro for the maximum number of characters in a file path is + * The POSIX macro for the maximum number of characters in a file path is * NAME_MAX. However, some operating systems use PATH_MAX instead. * Therefore, it seems natural to first check for PATH_MAX and use that, and * if it doesn't exist, use NAME_MAX. diff --git a/crypto/bn/asm/x86_64-gcc.c b/crypto/bn/asm/x86_64-gcc.c index d38f3371..e6f16983 100644 --- a/crypto/bn/asm/x86_64-gcc.c +++ b/crypto/bn/asm/x86_64-gcc.c @@ -64,12 +64,6 @@ * machine. */ -# if defined(_WIN64) || !defined(__LP64__) -# define BN_ULONG unsigned long long -# else -# define BN_ULONG unsigned long -# endif - # undef mul # undef mul_add diff --git a/crypto/engine/eng_devcrypto.c b/crypto/engine/eng_devcrypto.c index 9deaf5c6..6d97e998 100644 --- a/crypto/engine/eng_devcrypto.c +++ b/crypto/engine/eng_devcrypto.c @@ -69,7 +69,7 @@ static const struct cipher_data_st { { NID_aes_192_cbc, 16, 192 / 8, 16, EVP_CIPH_CBC_MODE, CRYPTO_AES_CBC }, { NID_aes_256_cbc, 16, 256 / 8, 16, EVP_CIPH_CBC_MODE, CRYPTO_AES_CBC }, #ifndef OPENSSL_NO_RC4 - { NID_rc4, 1, 16, 0, CRYPTO_ARC4 }, + { NID_rc4, 1, 16, 0, EVP_CIPH_STREAM_CIPHER, CRYPTO_ARC4 }, #endif #if !defined(CHECK_BSD_STYLE_MACROS) || defined(CRYPTO_AES_CTR) { NID_aes_128_ctr, 16, 128 / 8, 16, EVP_CIPH_CTR_MODE, CRYPTO_AES_CTR }, diff --git a/crypto/evp/e_aes.c b/crypto/evp/e_aes.c index f81ad660..0901196e 100644 --- a/crypto/evp/e_aes.c +++ b/crypto/evp/e_aes.c @@ -2255,7 +2255,7 @@ static int s390x_aes_ccm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, if (!cctx->aes.ccm.len_set) { /*- - * In case message length was not previously set explicitely via + * In case message length was not previously set explicitly via * Update(), set it now. */ ivec = EVP_CIPHER_CTX_iv_noconst(ctx); diff --git a/crypto/o_fopen.c b/crypto/o_fopen.c index f08f99b4..7d51ad72 100644 --- a/crypto/o_fopen.c +++ b/crypto/o_fopen.c @@ -25,14 +25,12 @@ # endif # endif +#include "e_os.h" #include "internal/cryptlib.h" #if !defined(OPENSSL_NO_STDIO) # include -# ifdef _WIN32 -# include -# endif # ifdef __DJGPP__ # include # endif diff --git a/crypto/rsa/rsa_meth.c b/crypto/rsa/rsa_meth.c index f5880a73..def19f37 100644 --- a/crypto/rsa/rsa_meth.c +++ b/crypto/rsa/rsa_meth.c @@ -163,13 +163,13 @@ int RSA_meth_set_priv_dec(RSA_METHOD *meth, /* Can be null */ int (*RSA_meth_get_mod_exp(const RSA_METHOD *meth)) - (BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx) + (BIGNUM *r0, const BIGNUM *i, RSA *rsa, BN_CTX *ctx) { return meth->rsa_mod_exp; } int RSA_meth_set_mod_exp(RSA_METHOD *meth, - int (*mod_exp) (BIGNUM *r0, const BIGNUM *I, RSA *rsa, + int (*mod_exp) (BIGNUM *r0, const BIGNUM *i, RSA *rsa, BN_CTX *ctx)) { meth->rsa_mod_exp = mod_exp; diff --git a/crypto/ui/ui_openssl.c b/crypto/ui/ui_openssl.c index 45d48202..6b996134 100644 --- a/crypto/ui/ui_openssl.c +++ b/crypto/ui/ui_openssl.c @@ -415,6 +415,24 @@ static int open_console(UI *ui) is_a_tty = 0; else # endif +# ifdef ENXIO + /* + * Solaris can return ENXIO. + * This should be ok + */ + if (errno == ENXIO) + is_a_tty = 0; + else +# endif +# ifdef EIO + /* + * Linux can return EIO. + * This should be ok + */ + if (errno == EIO) + is_a_tty = 0; + else +# endif # ifdef ENODEV /* * MacOS X returns ENODEV (Operation not supported by device), diff --git a/demos/evp/Makefile b/demos/evp/Makefile index c2e10a1d..1fb0f39c 100644 --- a/demos/evp/Makefile +++ b/demos/evp/Makefile @@ -7,17 +7,19 @@ # # LD_LIBRARY_PATH=../.. ./aesccm # LD_LIBRARY_PATH=../.. ./aesgcm +# LD_LIBRARY_PATH=../.. ./gmac CFLAGS = $(OPENSSL_INCS_LOCATION) LDFLAGS = $(OPENSSL_LIBS_LOCATION) -lssl -lcrypto -all: aesccm aesgcm +all: aesccm aesgcm gmac aesccm: aesccm.o aesgcm: aesgcm.o +gmac: gmac.o -aesccm aesgcm: +aesccm aesgcm gmac: $(CC) $(CFLAGS) -o $@ $< $(LDFLAGS) clean: - $(RM) aesccm aesgcm *.o + $(RM) aesccm aesgcm gmac *.o diff --git a/demos/evp/gmac.c b/demos/evp/gmac.c new file mode 100644 index 00000000..0b2231b3 --- /dev/null +++ b/demos/evp/gmac.c @@ -0,0 +1,103 @@ +/* + * Copyright 2018 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the OpenSSL license (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +/* + * Simple AES GMAC test program, uses the same NIST data used for the FIPS + * self test but uses the application level EVP APIs. + */ +#include +#include +#include +#include +#include + +/* AES-GMAC test data from NIST public test vectors */ + +static const unsigned char gmac_key[] = { 0x77, 0xbe, 0x63, 0x70, 0x89, 0x71, 0xc4, 0xe2, + 0x40, 0xd1, 0xcb, 0x79, 0xe8, 0xd7, 0x7f, 0xeb }; +static const unsigned char gmac_iv[] = { 0xe0, 0xe0, 0x0f, 0x19, 0xfe, 0xd7, 0xba, 0x01, + 0x36, 0xa7, 0x97, 0xf3 }; +static const unsigned char gmac_aad[] = { 0x7a, 0x43, 0xec, 0x1d, 0x9c, 0x0a, 0x5a, 0x78, + 0xa0, 0xb1, 0x65, 0x33, 0xa6, 0x21, 0x3c, 0xab }; + +static const unsigned char gmac_tag[] = { 0x20, 0x9f, 0xcc, 0x8d, 0x36, 0x75, 0xed, 0x93, + 0x8e, 0x9c, 0x71, 0x66, 0x70, 0x9d, 0xd9, 0x46 }; + +static int aes_gmac(void) +{ + EVP_CIPHER_CTX *ctx; + int outlen, tmplen; + unsigned char outbuf[1024]; + int ret = 0; + + printf("AES GMAC:\n"); + printf("Authenticated Data:\n"); + BIO_dump_fp(stdout, gmac_aad, sizeof(gmac_aad)); + + if ((ctx = EVP_CIPHER_CTX_new()) == NULL) { + printf("EVP_CIPHER_CTX_new: failed\n"); + goto err; + } + + /* Set cipher type and mode */ + if (!EVP_EncryptInit_ex(ctx, EVP_aes_128_gcm(), NULL, NULL, NULL)) { + printf("EVP_EncryptInit_ex: failed\n"); + goto err; + } + + /* Set IV length if default 96 bits is not appropriate */ + if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN, sizeof(gmac_iv), + NULL)) { + printf("EVP_CIPHER_CTX_ctrl: set IV length failed\n"); + goto err; + } + + /* Initialise key and IV */ + if (!EVP_EncryptInit_ex(ctx, NULL, NULL, gmac_key, gmac_iv)) { + printf("EVP_EncryptInit_ex: set key and IV failed\n"); + goto err; + } + + /* Zero or more calls to specify any AAD */ + if (!EVP_EncryptUpdate(ctx, NULL, &outlen, gmac_aad, sizeof(gmac_aad))) { + printf("EVP_EncryptUpdate: setting AAD failed\n"); + goto err; + } + + /* Finalise: note get no output for GMAC */ + if (!EVP_EncryptFinal_ex(ctx, outbuf, &outlen)) { + printf("EVP_EncryptFinal_ex: failed\n"); + goto err; + } + + /* Get tag */ + if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, 16, outbuf)) { + printf("EVP_CIPHER_CTX_ctrl: failed\n"); + goto err; + } + + /* Output tag */ + printf("Tag:\n"); + BIO_dump_fp(stdout, outbuf, 16); + + /* Is the tag correct? */ + if (memcmp(outbuf, gmac_tag, sizeof(gmac_tag)) != 0) { + printf("Expected:\n"); + BIO_dump_fp(stdout, gmac_tag, sizeof(gmac_tag)); + } else + ret = 1; +err: + EVP_CIPHER_CTX_free(ctx); + return ret; +} + +int main(int argc, char **argv) +{ + return aes_gmac() ? EXIT_SUCCESS : EXIT_FAILURE; +} diff --git a/doc/man1/enc.pod b/doc/man1/enc.pod index 01cca4ea..55b1b513 100644 --- a/doc/man1/enc.pod +++ b/doc/man1/enc.pod @@ -277,6 +277,7 @@ standard data format and performs the needed key/iv/nonce management. bf-cbc Blowfish in CBC mode bf Alias for bf-cbc + blowfish Alias for bf-cbc bf-cfb Blowfish in CFB mode bf-ecb Blowfish in ECB mode bf-ofb Blowfish in OFB mode @@ -288,6 +289,8 @@ standard data format and performs the needed key/iv/nonce management. cast5-ecb CAST5 in ECB mode cast5-ofb CAST5 in OFB mode + chacha20 ChaCha20 algorithm + des-cbc DES in CBC mode des Alias for des-cbc des-cfb DES in CFB mode @@ -334,6 +337,19 @@ standard data format and performs the needed key/iv/nonce management. rc5-ecb RC5 cipher in ECB mode rc5-ofb RC5 cipher in OFB mode + seed-cbc SEED cipher in CBC mode + seed Alias for seed-cbc + seed-cfb SEED cipher in CFB mode + seed-ecb SEED cipher in ECB mode + seed-ofb SEED cipher in OFB mode + + sm4-cbc SM4 cipher in CBC mode + sm4 Alias for sm4-cbc + sm4-cfb SM4 cipher in CFB mode + sm4-ctr SM4 cipher in CTR mode + sm4-ecb SM4 cipher in ECB mode + sm4-ofb SM4 cipher in OFB mode + aes-[128|192|256]-cbc 128/192/256 bit AES in CBC mode aes[128|192|256] Alias for aes-[128|192|256]-cbc aes-[128|192|256]-cfb 128/192/256 bit AES in 128 bit CFB mode @@ -343,6 +359,15 @@ standard data format and performs the needed key/iv/nonce management. aes-[128|192|256]-ecb 128/192/256 bit AES in ECB mode aes-[128|192|256]-ofb 128/192/256 bit AES in OFB mode + aria-[128|192|256]-cbc 128/192/256 bit ARIA in CBC mode + aria[128|192|256] Alias for aria-[128|192|256]-cbc + aria-[128|192|256]-cfb 128/192/256 bit ARIA in 128 bit CFB mode + aria-[128|192|256]-cfb1 128/192/256 bit ARIA in 1 bit CFB mode + aria-[128|192|256]-cfb8 128/192/256 bit ARIA in 8 bit CFB mode + aria-[128|192|256]-ctr 128/192/256 bit ARIA in CTR mode + aria-[128|192|256]-ecb 128/192/256 bit ARIA in ECB mode + aria-[128|192|256]-ofb 128/192/256 bit ARIA in OFB mode + camellia-[128|192|256]-cbc 128/192/256 bit Camellia in CBC mode camellia[128|192|256] Alias for camellia-[128|192|256]-cbc camellia-[128|192|256]-cfb 128/192/256 bit Camellia in 128 bit CFB mode diff --git a/doc/man3/EVP_PKEY_CTX_set_hkdf_md.pod b/doc/man3/EVP_PKEY_CTX_set_hkdf_md.pod index 1433a50a..e8f19cfc 100644 --- a/doc/man3/EVP_PKEY_CTX_set_hkdf_md.pod +++ b/doc/man3/EVP_PKEY_CTX_set_hkdf_md.pod @@ -68,12 +68,12 @@ error occurs. =back -EVP_PKEY_set_hkdf_md() sets the message digest associated with the HKDF. +EVP_PKEY_CTX_set_hkdf_md() sets the message digest associated with the HKDF. EVP_PKEY_CTX_set1_hkdf_salt() sets the salt to B bytes of the buffer B. Any existing value is replaced. -EVP_PKEY_CTX_set_hkdf_key() sets the key to B bytes of the buffer +EVP_PKEY_CTX_set1_hkdf_key() sets the key to B bytes of the buffer B. Any existing value is replaced. EVP_PKEY_CTX_add1_hkdf_info() sets the info value to B bytes of the diff --git a/doc/man3/RSA_meth_new.pod b/doc/man3/RSA_meth_new.pod index 69ba9dfc..f2109515 100644 --- a/doc/man3/RSA_meth_new.pod +++ b/doc/man3/RSA_meth_new.pod @@ -64,10 +64,10 @@ RSA_meth_get_multi_prime_keygen, RSA_meth_set_multi_prime_keygen unsigned char *to, RSA *rsa, int padding)); /* Can be null */ - int (*RSA_meth_get_mod_exp(const RSA_METHOD *meth))(BIGNUM *r0, const BIGNUM *I, + int (*RSA_meth_get_mod_exp(const RSA_METHOD *meth))(BIGNUM *r0, const BIGNUM *i, RSA *rsa, BN_CTX *ctx); int RSA_meth_set_mod_exp(RSA_METHOD *rsa, - int (*mod_exp)(BIGNUM *r0, const BIGNUM *I, RSA *rsa, + int (*mod_exp)(BIGNUM *r0, const BIGNUM *i, RSA *rsa, BN_CTX *ctx)); /* Can be null */ diff --git a/doc/man3/SSL_CTX_set_quiet_shutdown.pod b/doc/man3/SSL_CTX_set_quiet_shutdown.pod index 99922eb5..d3e6d9ff 100644 --- a/doc/man3/SSL_CTX_set_quiet_shutdown.pod +++ b/doc/man3/SSL_CTX_set_quiet_shutdown.pod @@ -33,7 +33,7 @@ SSL_get_quiet_shutdown() returns the "quiet shutdown" setting of B. =head1 NOTES Normally when a SSL connection is finished, the parties must send out -"close notify" alert messages using L +close_notify alert messages using L for a clean shutdown. When setting the "quiet shutdown" flag to 1, L @@ -41,7 +41,7 @@ will set the internal flags to SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN. (L then behaves like L called with SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN.) -The session is thus considered to be shutdown, but no "close notify" alert +The session is thus considered to be shutdown, but no close_notify alert is sent to the peer. This behaviour violates the TLS standard. The default is normal shutdown behaviour as described by the TLS standard. diff --git a/doc/man3/SSL_get_error.pod b/doc/man3/SSL_get_error.pod index 01446a24..b3ab5056 100644 --- a/doc/man3/SSL_get_error.pod +++ b/doc/man3/SSL_get_error.pod @@ -39,7 +39,7 @@ if and only if B 0>. =item SSL_ERROR_ZERO_RETURN The TLS/SSL peer has closed the connection for writing by sending the -"close notify" alert. +close_notify alert. No more data can be read. Note that B does not necessarily indicate that the underlying transport has been closed. diff --git a/doc/man3/SSL_set_shutdown.pod b/doc/man3/SSL_set_shutdown.pod index 04bcc478..70108079 100644 --- a/doc/man3/SSL_set_shutdown.pod +++ b/doc/man3/SSL_set_shutdown.pod @@ -30,12 +30,12 @@ No shutdown setting, yet. =item SSL_SENT_SHUTDOWN -A "close notify" shutdown alert was sent to the peer, the connection is being +A close_notify shutdown alert was sent to the peer, the connection is being considered closed and the session is closed and correct. =item SSL_RECEIVED_SHUTDOWN -A shutdown alert was received form the peer, either a normal "close notify" +A shutdown alert was received form the peer, either a normal close_notify or a fatal error. =back @@ -47,13 +47,13 @@ the ssl session. If the session is still open, when L or L is called, it is considered bad and removed according to RFC2246. The actual condition for a correctly closed session is SSL_SENT_SHUTDOWN -(according to the TLS RFC, it is acceptable to only send the "close notify" +(according to the TLS RFC, it is acceptable to only send the close_notify alert but to not wait for the peer's answer, when the underlying connection is closed). SSL_set_shutdown() can be used to set this state without sending a close alert to the peer (see L). -If a "close notify" was received, SSL_RECEIVED_SHUTDOWN will be set, +If a close_notify was received, SSL_RECEIVED_SHUTDOWN will be set, for setting SSL_SENT_SHUTDOWN the application must however still call L or SSL_set_shutdown() itself. diff --git a/doc/man3/SSL_shutdown.pod b/doc/man3/SSL_shutdown.pod index 453853d6..0a3d6d37 100644 --- a/doc/man3/SSL_shutdown.pod +++ b/doc/man3/SSL_shutdown.pod @@ -13,27 +13,36 @@ SSL_shutdown - shut down a TLS/SSL connection =head1 DESCRIPTION SSL_shutdown() shuts down an active TLS/SSL connection. It sends the -"close notify" shutdown alert to the peer. +close_notify shutdown alert to the peer. =head1 NOTES -SSL_shutdown() tries to send the "close notify" shutdown alert to the peer. +SSL_shutdown() tries to send the close_notify shutdown alert to the peer. Whether the operation succeeds or not, the SSL_SENT_SHUTDOWN flag is set and a currently open session is considered closed and good and will be kept in the session cache for further reuse. -The shutdown procedure consists of 2 steps: the sending of the "close notify" -shutdown alert and the reception of the peer's "close notify" shutdown -alert. According to the TLS standard, it is acceptable for an application -to only send its shutdown alert and then close the underlying connection -without waiting for the peer's response (this way resources can be saved, -as the process can already terminate or serve another connection). -When the underlying connection shall be used for more communications, the -complete shutdown procedure (bidirectional "close notify" alerts) must be -performed, so that the peers stay synchronized. +The shutdown procedure consists of two steps: sending of the close_notify +shutdown alert, and reception of the peer's close_notify shutdown alert. +The order of those two steps depends on the application. -SSL_shutdown() supports both uni- and bidirectional shutdown by its 2 step -behaviour. +It is acceptable for an application to only send its shutdown alert and +then close the underlying connection without waiting for the peer's response. +This way resources can be saved, as the process can already terminate or +serve another connection. +This should only be done when it is known that the other side will not send more +data, otherwise there is a risk of a truncation attack. + +When a client only writes and never reads from the connection, and the server +has sent a session ticket to establish a session, the client might not be able +to resume the session because it did not received and process the session ticket +from the server. +In case the application wants to be able to resume the session, it is recommended to +do a complete shutdown procedure (bidirectional close_notify alerts). + +When the underlying connection shall be used for more communications, the +complete shutdown procedure must be performed, so that the peers stay +synchronized. SSL_shutdown() only closes the write direction. It is not possible to call SSL_write() after calling SSL_shutdown(). @@ -41,45 +50,43 @@ The read direction is closed by the peer. =head2 First to close the connection -When the application is the first party to send the "close notify" +When the application is the first party to send the close_notify alert, SSL_shutdown() will only send the alert and then set the SSL_SENT_SHUTDOWN flag (so that the session is considered good and will be kept in the cache). -SSL_shutdown() will then return with 0. +If successful, SSL_shutdown() will return 0. + If a unidirectional shutdown is enough (the underlying connection shall be -closed anyway), this first call to SSL_shutdown() is sufficient. +closed anyway), this first successful call to SSL_shutdown() is sufficient. In order to complete the bidirectional shutdown handshake, the peer needs -to send back a "close notify" alert. +to send back a close_notify alert. The SSL_RECEIVED_SHUTDOWN flag will be set after receiving and processing it. -SSL_shutdown() will return 1 when it has been received. -The peer is still allowed to send data after receiving the "close notify" +The peer is still allowed to send data after receiving the close_notify event. -If the peer did send data it needs to be processed by calling SSL_read() -before calling SSL_shutdown() a second time. +When it is done sending data, it will send the close_notify alert. +SSL_read() should be called until all data is received. SSL_read() will indicate the end of the peer data by returning <= 0 and SSL_get_error() returning SSL_ERROR_ZERO_RETURN. -It is recommended to call SSL_read() between SSL_shutdown() calls. =head2 Peer closes the connection -If the peer already sent the "close notify" alert B it was +If the peer already sent the close_notify alert B it was already processed implicitly inside another function (L), the SSL_RECEIVED_SHUTDOWN flag is set. SSL_read() will return <= 0 in that case, and SSL_get_error() will return SSL_ERROR_ZERO_RETURN. -SSL_shutdown() will send the "close notify" alert, set the SSL_SENT_SHUTDOWN -flag and will immediately return with 1. +SSL_shutdown() will send the close_notify alert, set the SSL_SENT_SHUTDOWN +flag. +If successful, SSL_shutdown() will return 1. + Whether SSL_RECEIVED_SHUTDOWN is already set can be checked using the SSL_get_shutdown() (see also L call. =head1 NOTES -It is recommended to do a bidirectional shutdown by checking the return value -of SSL_shutdown() and call it again until it returns 1 or a fatal error. - The behaviour of SSL_shutdown() additionally depends on the underlying BIO. If the underlying BIO is B, SSL_shutdown() will only return once the handshake step has been finished or an error occurred. @@ -95,8 +102,13 @@ nothing is to be done, but select() can be used to check for the required condition. When using a buffering BIO, like a BIO pair, data must be written into or retrieved out of the BIO before being able to continue. +After SSL_shutdown() returned 0, it is possible to call SSL_shutdown() again +to wait for the peer's close_notify alert. +SSL_shutdown() will return 1 in that case. +However, it is recommended to wait for it using SSL_read() instead. + SSL_shutdown() can be modified to only set the connection to "shutdown" -state but not actually send the "close notify" alert messages, +state but not actually send the close_notify alert messages, see L. When "quiet shutdown" is enabled, SSL_shutdown() will always succeed and return 1. @@ -109,16 +121,16 @@ The following return values can occur: =item Z<>0 -The shutdown is not yet finished: the "close notify" was send but the peer +The shutdown is not yet finished: the close_notify was sent but the peer did not send it back yet. -Call SSL_shutdown() again to do a bidirectional shutdown. +Call SSL_read() to do a bidirectional shutdown. The output of L may be misleading, as an erroneous SSL_ERROR_SYSCALL may be flagged even though no error occurred. =item Z<>1 -The shutdown was successfully completed. The "close notify" alert was sent -and the peer's "close notify" alert was received. +The shutdown was successfully completed. The close_notify alert was sent +and the peer's close_notify alert was received. =item E0 diff --git a/doc/man7/RAND_DRBG.pod b/doc/man7/RAND_DRBG.pod index b89c30d4..ba457f05 100644 --- a/doc/man7/RAND_DRBG.pod +++ b/doc/man7/RAND_DRBG.pod @@ -189,7 +189,7 @@ In addition to automatic reseeding, the caller can request an immediate reseeding of the DRBG with fresh entropy by setting the I parameter to 1 when calling L. -The dcoument [NIST SP 800-90C] describes prediction resistance requests +The document [NIST SP 800-90C] describes prediction resistance requests in detail and imposes strict conditions on the entropy sources that are approved for providing prediction resistance. Since the default DRBG implementation does not have access to such an approved diff --git a/e_os.h b/e_os.h index 5769029b..8991e620 100644 --- a/e_os.h +++ b/e_os.h @@ -245,7 +245,7 @@ extern FILE *_imp___iob; Finally, we add the VMS C facility code 0x35a000, because there are some programs, such as Perl, that will reinterpret the code back to something - POSIXly. 'man perlvms' explains it further. + POSIX. 'man perlvms' explains it further. NOTE: the perlvms manual wants to turn all codes 2 to 255 into success codes (status type = 1). I couldn't disagree more. Fortunately, the diff --git a/include/openssl/rsa.h b/include/openssl/rsa.h index a611b6a0..a38ba12f 100644 --- a/include/openssl/rsa.h +++ b/include/openssl/rsa.h @@ -456,9 +456,9 @@ int RSA_meth_set_priv_dec(RSA_METHOD *rsa, unsigned char *to, RSA *rsa, int padding)); int (*RSA_meth_get_mod_exp(const RSA_METHOD *meth)) - (BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx); + (BIGNUM *r0, const BIGNUM *i, RSA *rsa, BN_CTX *ctx); int RSA_meth_set_mod_exp(RSA_METHOD *rsa, - int (*mod_exp) (BIGNUM *r0, const BIGNUM *I, RSA *rsa, + int (*mod_exp) (BIGNUM *r0, const BIGNUM *i, RSA *rsa, BN_CTX *ctx)); int (*RSA_meth_get_bn_mod_exp(const RSA_METHOD *meth)) (BIGNUM *r, const BIGNUM *a, const BIGNUM *p, diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c index 205f868a..dc190fa3 100644 --- a/ssl/ssl_ciph.c +++ b/ssl/ssl_ciph.c @@ -1360,7 +1360,7 @@ static int ciphersuite_cb(const char *elem, int len, void *arg) return 1; } -int set_ciphersuites(STACK_OF(SSL_CIPHER) **currciphers, const char *str) +static __owur int set_ciphersuites(STACK_OF(SSL_CIPHER) **currciphers, const char *str) { STACK_OF(SSL_CIPHER) *newciphers = sk_SSL_CIPHER_new_null(); diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c index 926a7a04..a80c81ac 100644 --- a/ssl/ssl_lib.c +++ b/ssl/ssl_lib.c @@ -654,6 +654,10 @@ int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth) ctx->method = meth; + if (!SSL_CTX_set_ciphersuites(ctx, TLS_DEFAULT_CIPHERSUITES)) { + SSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION, SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS); + return 0; + } sk = ssl_create_cipher_list(ctx->method, ctx->tls13_ciphersuites, &(ctx->cipher_list), diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h index 9afa4888..c3ee5c16 100644 --- a/ssl/ssl_locl.h +++ b/ssl/ssl_locl.h @@ -471,7 +471,7 @@ struct ssl_method_st { long (*ssl_ctx_callback_ctrl) (SSL_CTX *s, int cb_id, void (*fp) (void)); }; -# define TLS13_MAX_RESUMPTION_PSK_LENGTH 64 +# define TLS13_MAX_RESUMPTION_PSK_LENGTH PSK_MAX_PSK_LEN /*- * Lets make this into an ASN.1 type structure as follows @@ -2290,7 +2290,6 @@ __owur int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b); DECLARE_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER, ssl_cipher_id); __owur int ssl_cipher_ptr_id_cmp(const SSL_CIPHER *const *ap, const SSL_CIPHER *const *bp); -__owur int set_ciphersuites(STACK_OF(SSL_CIPHER) **currciphers, const char *str); __owur STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, STACK_OF(SSL_CIPHER) *tls13_ciphersuites, struct ssl_cipher_preference_list_st **cipher_list, diff --git a/ssl/statem/statem_srvr.c b/ssl/statem/statem_srvr.c index 0a747f39..ed69108a 100644 --- a/ssl/statem/statem_srvr.c +++ b/ssl/statem/statem_srvr.c @@ -2057,10 +2057,6 @@ static int tls_early_post_process_client_hello(SSL *s) #else s->session->compress_meth = (comp == NULL) ? 0 : comp->id; #endif - if (!tls1_set_server_sigalgs(s)) { - /* SSLfatal() already called */ - goto err; - } } sk_SSL_CIPHER_free(ciphers); @@ -2228,19 +2224,25 @@ WORK_STATE tls_post_process_client_hello(SSL *s, WORK_STATE wst) if (wst == WORK_MORE_B) { if (!s->hit || SSL_IS_TLS13(s)) { /* Let cert callback update server certificates if required */ - if (!s->hit && s->cert->cert_cb != NULL) { - int rv = s->cert->cert_cb(s, s->cert->cert_cb_arg); - if (rv == 0) { - SSLfatal(s, SSL_AD_INTERNAL_ERROR, - SSL_F_TLS_POST_PROCESS_CLIENT_HELLO, - SSL_R_CERT_CB_ERROR); + if (!s->hit) { + if (s->cert->cert_cb != NULL) { + int rv = s->cert->cert_cb(s, s->cert->cert_cb_arg); + if (rv == 0) { + SSLfatal(s, SSL_AD_INTERNAL_ERROR, + SSL_F_TLS_POST_PROCESS_CLIENT_HELLO, + SSL_R_CERT_CB_ERROR); + goto err; + } + if (rv < 0) { + s->rwstate = SSL_X509_LOOKUP; + return WORK_MORE_B; + } + s->rwstate = SSL_NOTHING; + } + if (!tls1_set_server_sigalgs(s)) { + /* SSLfatal already called */ goto err; } - if (rv < 0) { - s->rwstate = SSL_X509_LOOKUP; - return WORK_MORE_B; - } - s->rwstate = SSL_NOTHING; } /* In TLSv1.3 we selected the ciphersuite before resumption */ diff --git a/test/build.info b/test/build.info index fa154f07..c0b8ecee 100644 --- a/test/build.info +++ b/test/build.info @@ -26,7 +26,7 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=main PROGRAMS_NO_INST=\ versions \ aborttest test_test \ - sanitytest exdatatest bntest \ + sanitytest rsa_complex exdatatest bntest \ ectest ecstresstest ecdsatest gmdifftest pbelutest ideatest \ md2test \ hmactest \ @@ -64,6 +64,9 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=main INCLUDE[sanitytest]=../include DEPEND[sanitytest]=../libcrypto libtestutil.a + SOURCE[rsa_complex]=rsa_complex.c + INCLUDE[rsa_complex]=../include + SOURCE[test_test]=test_test.c INCLUDE[test_test]=../include DEPEND[test_test]=../libcrypto libtestutil.a diff --git a/test/evp_test.c b/test/evp_test.c index 98301e65..2ac69e11 100644 --- a/test/evp_test.c +++ b/test/evp_test.c @@ -459,7 +459,7 @@ typedef struct cipher_data_st { size_t plaintext_len; unsigned char *ciphertext; size_t ciphertext_len; - /* GCM, CCM only */ + /* GCM, CCM and OCB only */ unsigned char *aad; size_t aad_len; unsigned char *tag; @@ -487,7 +487,7 @@ static int cipher_test_init(EVP_TEST *t, const char *alg) if (m == EVP_CIPH_GCM_MODE || m == EVP_CIPH_OCB_MODE || m == EVP_CIPH_CCM_MODE) - cdat->aead = EVP_CIPHER_mode(cipher); + cdat->aead = m; else if (EVP_CIPHER_flags(cipher) & EVP_CIPH_FLAG_AEAD_CIPHER) cdat->aead = -1; else diff --git a/test/rsa_complex.c b/test/rsa_complex.c new file mode 100644 index 00000000..fac58125 --- /dev/null +++ b/test/rsa_complex.c @@ -0,0 +1,27 @@ +/* + * Copyright 2018 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the OpenSSL license (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +/* + * Check to see if there is a conflict between complex.h and openssl/rsa.h. + * The former defines "I" as a macro and earlier versions of the latter use + * for function arguments. + */ +#if defined(__STDC_VERSION__) +# if __STDC_VERSION__ >= 199901L +# include +# endif +#endif +#include +#include + +int main(int argc, char *argv[]) +{ + /* There are explicitly no run time checks for this one */ + return EXIT_SUCCESS; +} diff --git a/test/sslapitest.c b/test/sslapitest.c index bb518857..15fe0037 100644 --- a/test/sslapitest.c +++ b/test/sslapitest.c @@ -5497,6 +5497,100 @@ static int test_shutdown(int tst) return testresult; } +static int cert_cb_cnt; + +static int cert_cb(SSL *s, void *arg) +{ + SSL_CTX *ctx = (SSL_CTX *)arg; + + if (cert_cb_cnt == 0) { + /* Suspend the handshake */ + cert_cb_cnt++; + return -1; + } else if (cert_cb_cnt == 1) { + /* + * Update the SSL_CTX, set the certificate and private key and then + * continue the handshake normally. + */ + if (ctx != NULL && !TEST_ptr(SSL_set_SSL_CTX(s, ctx))) + return 0; + + if (!TEST_true(SSL_use_certificate_file(s, cert, SSL_FILETYPE_PEM)) + || !TEST_true(SSL_use_PrivateKey_file(s, privkey, + SSL_FILETYPE_PEM)) + || !TEST_true(SSL_check_private_key(s))) + return 0; + cert_cb_cnt++; + return 1; + } + + /* Abort the handshake */ + return 0; +} + +/* + * Test the certificate callback. + * Test 0: Callback fails + * Test 1: Success - no SSL_set_SSL_CTX() in the callback + * Test 2: Success - SSL_set_SSL_CTX() in the callback + */ +static int test_cert_cb_int(int prot, int tst) +{ + SSL_CTX *cctx = NULL, *sctx = NULL, *snictx = NULL; + SSL *clientssl = NULL, *serverssl = NULL; + int testresult = 0, ret; + + if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), + TLS_client_method(), + TLS1_VERSION, + prot, + &sctx, &cctx, NULL, NULL))) + goto end; + + if (tst == 0) + cert_cb_cnt = -1; + else + cert_cb_cnt = 0; + if (tst == 2) + snictx = SSL_CTX_new(TLS_server_method()); + SSL_CTX_set_cert_cb(sctx, cert_cb, snictx); + + if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, + NULL, NULL))) + goto end; + + ret = create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE); + if (!TEST_true(tst == 0 ? !ret : ret) + || (tst > 0 && !TEST_int_eq(cert_cb_cnt, 2))) { + goto end; + } + + testresult = 1; + + end: + SSL_free(serverssl); + SSL_free(clientssl); + SSL_CTX_free(sctx); + SSL_CTX_free(cctx); + SSL_CTX_free(snictx); + + return testresult; +} + +static int test_cert_cb(int tst) +{ + int testresult = 1; + +#ifndef OPENSSL_NO_TLS1_2 + testresult &= test_cert_cb_int(TLS1_2_VERSION, tst); +#endif +#ifdef OPENSSL_NO_TLS1_3 + testresult &= test_cert_cb_int(TLS1_3_VERSION, tst); +#endif + + return testresult; +} + int setup_tests(void) { if (!TEST_ptr(cert = test_get_argument(0)) @@ -5599,6 +5693,7 @@ int setup_tests(void) ADD_ALL_TESTS(test_ssl_get_shared_ciphers, OSSL_NELEM(shared_ciphers_data)); ADD_ALL_TESTS(test_ticket_callbacks, 12); ADD_ALL_TESTS(test_shutdown, 7); + ADD_ALL_TESTS(test_cert_cb, 3); return 1; } diff --git a/test/ssltestlib.c b/test/ssltestlib.c index a055d3b5..71b78584 100644 --- a/test/ssltestlib.c +++ b/test/ssltestlib.c @@ -712,7 +712,9 @@ int create_bare_ssl_connection(SSL *serverssl, SSL *clientssl, int want) err = SSL_get_error(serverssl, rets); } - if (!servererr && rets <= 0 && err != SSL_ERROR_WANT_READ) { + if (!servererr && rets <= 0 + && err != SSL_ERROR_WANT_READ + && err != SSL_ERROR_WANT_X509_LOOKUP) { TEST_info("SSL_accept() failed %d, %d", rets, err); servererr = 1; } diff --git a/util/add-depends.pl b/util/add-depends.pl index 3ba266e3..deb0de23 100644 --- a/util/add-depends.pl +++ b/util/add-depends.pl @@ -63,7 +63,7 @@ my $abs_blddir = rel2abs($blddir); # files we depend on in the same directory that only differ by character case, # we're fine. my %depconv_cache = - map { lc catfile($abs_blddir, $_) => $_ } + map { catfile($abs_blddir, $_) => $_ } keys %{$unified_info{generate}}; my %procedures = ( @@ -139,7 +139,7 @@ my %procedures = ( # VMS C gives us absolute paths, always. Let's see if we can # make them relative instead. - $line = lc canonpath($line); + $line = canonpath($line); unless (defined $depconv_cache{$line}) { my $dep = $line; @@ -184,7 +184,7 @@ my %procedures = ( # VC gives us absolute paths for all include files, so to # remove system header dependencies, we need to check that # they don't match $abs_srcdir or $abs_blddir. - $tail = lc canonpath($tail); + $tail = canonpath($tail); unless (defined $depconv_cache{$tail}) { my $dep = $tail; diff --git a/util/mkdef.pl b/util/mkdef.pl index 327728ee..657162b4 100755 --- a/util/mkdef.pl +++ b/util/mkdef.pl @@ -247,7 +247,7 @@ $crypto.=" include/internal/o_str.h"; $crypto.=" include/internal/err.h"; $crypto.=" include/internal/sslconf.h"; foreach my $f ( glob(catfile($config{sourcedir},'include/openssl/*.h')) ) { - my $fn = "include/openssl/" . lc(basename($f)); + my $fn = "include/openssl/" . basename($f); $crypto .= " $fn" if !defined $skipthese{$fn}; }