Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update

Browse Source
This commit is contained in:
Hakase
2019-05-28 23:10:56 +09:00
parent 64d458de91
commit 9a23f88dc2
49 changed files with 24989 additions and 223 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crypto/asn1/asn1_err.c
+3 -1
View File
@@ -1,6 +1,6 @@
/*
* Generated by util/mkerr.pl DO NOT EDIT
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -107,6 +107,7 @@ static const ERR_STRING_DATA ASN1_str_functs[] = {
{ERR_PACK(ERR_LIB_ASN1, ASN1_F_D2I_ASN1_UINTEGER, 0), "d2i_ASN1_UINTEGER"},
{ERR_PACK(ERR_LIB_ASN1, ASN1_F_D2I_AUTOPRIVATEKEY, 0),
"d2i_AutoPrivateKey"},
{ERR_PACK(ERR_LIB_ASN1, ASN1_F_D2I_KEYPARAMS, 0), "d2i_KeyParams"},
{ERR_PACK(ERR_LIB_ASN1, ASN1_F_D2I_PRIVATEKEY, 0), "d2i_PrivateKey"},
{ERR_PACK(ERR_LIB_ASN1, ASN1_F_D2I_PUBLICKEY, 0), "d2i_PublicKey"},
{ERR_PACK(ERR_LIB_ASN1, ASN1_F_DO_BUF, 0), "do_buf"},
@@ -119,6 +120,7 @@ static const ERR_STRING_DATA ASN1_str_functs[] = {
{ERR_PACK(ERR_LIB_ASN1, ASN1_F_I2D_ASN1_OBJECT, 0), "i2d_ASN1_OBJECT"},
{ERR_PACK(ERR_LIB_ASN1, ASN1_F_I2D_DSA_PUBKEY, 0), "i2d_DSA_PUBKEY"},
{ERR_PACK(ERR_LIB_ASN1, ASN1_F_I2D_EC_PUBKEY, 0), "i2d_EC_PUBKEY"},
{ERR_PACK(ERR_LIB_ASN1, ASN1_F_I2D_KEYPARAMS, 0), "i2d_KeyParams"},
{ERR_PACK(ERR_LIB_ASN1, ASN1_F_I2D_PRIVATEKEY, 0), "i2d_PrivateKey"},
{ERR_PACK(ERR_LIB_ASN1, ASN1_F_I2D_PUBLICKEY, 0), "i2d_PublicKey"},
{ERR_PACK(ERR_LIB_ASN1, ASN1_F_I2D_RSA_PUBKEY, 0), "i2d_RSA_PUBKEY"},
crypto/asn1/build.info
+2 -1
View File
@@ -13,4 +13,5 @@ SOURCE[../../libcrypto]=\
x_pkey.c bio_asn1.c bio_ndef.c asn_mime.c \
asn1_gen.c asn1_par.c asn1_lib.c asn1_err.c a_strnid.c \
evp_asn1.c asn_pack.c p5_pbe.c p5_pbev2.c p5_scrypt.c p8_pkey.c \
asn_moid.c asn_mstbl.c asn1_item_list.c
asn_moid.c asn_mstbl.c asn1_item_list.c \
d2i_param.c i2d_param.c
crypto/asn1/d2i_param.c
+65
View File
@@ -0,0 +1,65 @@
/*
* Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <stdio.h>
#include "internal/cryptlib.h"
#include <openssl/evp.h>
#include <openssl/asn1.h>
#include "internal/evp_int.h"
#include "internal/asn1_int.h"
EVP_PKEY *d2i_KeyParams(int type, EVP_PKEY **a, const unsigned char **pp,
long length)
{
EVP_PKEY *ret = NULL;
const unsigned char *p = *pp;
if ((a == NULL) || (*a == NULL)) {
if ((ret = EVP_PKEY_new()) == NULL)
return NULL;
} else
ret = *a;
if (type != EVP_PKEY_id(ret) && !EVP_PKEY_set_type(ret, type))
goto err;
if (ret->ameth == NULL || ret->ameth->param_decode == NULL) {
ASN1err(ASN1_F_D2I_KEYPARAMS, ASN1_R_UNSUPPORTED_TYPE);
goto err;
}
if (!ret->ameth->param_decode(ret, &p, length))
goto err;
if (a != NULL)
(*a) = ret;
return ret;
err:
if (a == NULL || *a != ret)
EVP_PKEY_free(ret);
return NULL;
}
EVP_PKEY *d2i_KeyParams_bio(int type, EVP_PKEY **a, BIO *in)
{
BUF_MEM *b = NULL;
const unsigned char *p;
void *ret = NULL;
int len;
len = asn1_d2i_read_bio(in, &b);
if (len < 0)
goto err;
p = (unsigned char *)b->data;
ret = d2i_KeyParams(type, a, &p, len);
err:
BUF_MEM_free(b);
return ret;
}
crypto/asn1/i2d_param.c
+30
View File
@@ -0,0 +1,30 @@
/*
* Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <stdio.h>
#include "internal/cryptlib.h"
#include <openssl/evp.h>
#include <openssl/objects.h>
#include <openssl/asn1.h>
#include "internal/asn1_int.h"
#include "internal/evp_int.h"
int i2d_KeyParams(const EVP_PKEY *a, unsigned char **pp)
{
if (a->ameth != NULL && a->ameth->param_encode != NULL)
return a->ameth->param_encode(a, pp);
ASN1err(ASN1_F_I2D_KEYPARAMS, ASN1_R_UNSUPPORTED_TYPE);
return -1;
}
int i2d_KeyParams_bio(BIO *bp, const EVP_PKEY *pkey)
{
return ASN1_i2d_bio_of(EVP_PKEY, i2d_KeyParams, bp, pkey);
}
crypto/build.info
+6 -1
View File
@@ -12,6 +12,9 @@ LIBS=../libcrypto
SOURCE[../libcrypto]=provider_core.c provider_predefined.c provider_conf.c \
core_fetch.c core_namemap.c
SOURCE[../providers/fips]=provider_core.c provider_predefined.c \
core_fetch.c core_namemap.c
# Central utilities
SOURCE[../libcrypto]=\
cryptlib.c mem.c mem_dbg.c cversion.c info.c ex_data.c cpt_err.c \
@@ -23,7 +26,9 @@ SOURCE[../libcrypto]=\
# FIPS module
SOURCE[../providers/fips]=\
cryptlib.c mem.c mem_clr.c params.c bsearch.c
cryptlib.c mem.c mem_clr.c params.c bsearch.c ex_data.c o_str.c \
ctype.c threads_pthread.c threads_win.c threads_none.c context.c \
sparse_array.c
DEPEND[cversion.o]=buildinf.h
crypto/context.c
+1 -1
View File
@@ -36,10 +36,10 @@ struct openssl_ctx_st {
#ifndef FIPS_MODE
static OPENSSL_CTX default_context_int;
#endif
/* Always points at default_context_int if it has been initialised */
static OPENSSL_CTX *default_context = NULL;
#endif
static int context_init(OPENSSL_CTX *ctx)
{
crypto/err/openssl.txt
+2
View File
@@ -80,6 +80,7 @@ ASN1_F_COLLECT_DATA:140:collect_data
ASN1_F_D2I_ASN1_OBJECT:147:d2i_ASN1_OBJECT
ASN1_F_D2I_ASN1_UINTEGER:150:d2i_ASN1_UINTEGER
ASN1_F_D2I_AUTOPRIVATEKEY:207:d2i_AutoPrivateKey
ASN1_F_D2I_KEYPARAMS:144:d2i_KeyParams
ASN1_F_D2I_PRIVATEKEY:154:d2i_PrivateKey
ASN1_F_D2I_PUBLICKEY:155:d2i_PublicKey
ASN1_F_DO_BUF:142:do_buf
@@ -91,6 +92,7 @@ ASN1_F_I2D_ASN1_BIO_STREAM:211:i2d_ASN1_bio_stream
ASN1_F_I2D_ASN1_OBJECT:143:i2d_ASN1_OBJECT
ASN1_F_I2D_DSA_PUBKEY:161:i2d_DSA_PUBKEY
ASN1_F_I2D_EC_PUBKEY:181:i2d_EC_PUBKEY
ASN1_F_I2D_KEYPARAMS:145:i2d_KeyParams
ASN1_F_I2D_PRIVATEKEY:163:i2d_PrivateKey
ASN1_F_I2D_PUBLICKEY:164:i2d_PublicKey
ASN1_F_I2D_RSA_PUBKEY:165:i2d_RSA_PUBKEY
crypto/evp/build.info
+4
View File
@@ -20,6 +20,10 @@ SOURCE[../../libcrypto]=\
SOURCE[../../libcrypto]=\
evp_fetch.c
# FIPS Module
SOURCE[../../providers/fips]=\
digest.c evp_enc.c evp_lib.c evp_fetch.c cmeth_lib.c
INCLUDE[e_aes.o]=.. ../modes
INCLUDE[e_aes_cbc_hmac_sha1.o]=../modes
INCLUDE[e_aes_cbc_hmac_sha256.o]=../modes
crypto/evp/digest.c
+31 -8
View File
@@ -55,10 +55,14 @@ int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)
* pctx should be freed by the user of EVP_MD_CTX
* if EVP_MD_CTX_FLAG_KEEP_PKEY_CTX is set
*/
#ifndef FIPS_MODE
/* TODO(3.0): Temporarily no support for EVP_DigestSign* in FIPS module */
if (!EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_KEEP_PKEY_CTX))
EVP_PKEY_CTX_free(ctx->pctx);
#ifndef OPENSSL_NO_ENGINE
# ifndef OPENSSL_NO_ENGINE
ENGINE_finish(ctx->engine);
# endif
#endif
OPENSSL_cleanse(ctx, sizeof(*ctx));
@@ -102,8 +106,9 @@ int EVP_DigestInit(EVP_MD_CTX *ctx, const EVP_MD *type)
int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
{
EVP_MD *provmd;
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
ENGINE *tmpimpl = NULL;
#endif
EVP_MD_CTX_clear_flags(ctx, EVP_MD_CTX_FLAG_CLEANED);
@@ -111,7 +116,7 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
ctx->reqdigest = type;
/* TODO(3.0): Legacy work around code below. Remove this */
#ifndef OPENSSL_NO_ENGINE
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
/*
* Whether it's nice or not, "Inits" can be used on "Final"'d contexts so
* this context may already have an ENGINE! Try to avoid releasing the
@@ -132,7 +137,9 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
*/
if (ctx->engine != NULL
|| impl != NULL
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
|| tmpimpl != NULL
#endif
|| ctx->pctx != NULL
|| (ctx->flags & EVP_MD_CTX_FLAG_NO_INIT) != 0) {
if (ctx->digest == ctx->fetched_digest)
@@ -160,7 +167,13 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
/* TODO(3.0): Start of non-legacy code below */
if (type->prov == NULL) {
provmd = EVP_MD_fetch(NULL, OBJ_nid2sn(type->type), "");
#ifdef FIPS_MODE
/* We only do explict fetches inside the FIPS module */
EVPerr(EVP_F_EVP_DIGESTINIT_EX, EVP_R_INITIALIZATION_ERROR);
return 0;
#else
EVP_MD *provmd = EVP_MD_fetch(NULL, OBJ_nid2sn(type->type), "");
if (provmd == NULL) {
EVPerr(EVP_F_EVP_DIGESTINIT_EX, EVP_R_INITIALIZATION_ERROR);
return 0;
@@ -168,6 +181,7 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
type = provmd;
EVP_MD_meth_free(ctx->fetched_digest);
ctx->fetched_digest = provmd;
#endif
}
ctx->digest = type;
@@ -189,7 +203,7 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
/* TODO(3.0): Remove legacy code below */
legacy:
#ifndef OPENSSL_NO_ENGINE
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
if (type) {
/*
* Ensure an ENGINE left lying around from last time is cleared (the
@@ -247,16 +261,19 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
}
}
}
#ifndef OPENSSL_NO_ENGINE
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
skip_to_init:
#endif
if (ctx->pctx) {
#ifndef FIPS_MODE
/* TODO(3.0): Temporarily no support for EVP_DigestSign* in FIPS module */
if (ctx->pctx != NULL) {
int r;
r = EVP_PKEY_CTX_ctrl(ctx->pctx, -1, EVP_PKEY_OP_TYPE_SIG,
EVP_PKEY_CTRL_DIGESTINIT, 0, ctx);
if (r <= 0 && (r != -2))
return 0;
}
#endif
if (ctx->flags & EVP_MD_CTX_FLAG_NO_INIT)
return 1;
return ctx->digest->init(ctx);
@@ -397,6 +414,8 @@ int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in)
/* copied EVP_MD_CTX should free the copied EVP_PKEY_CTX */
EVP_MD_CTX_clear_flags(out, EVP_MD_CTX_FLAG_KEEP_PKEY_CTX);
#ifndef FIPS_MODE
/* TODO(3.0): Temporarily no support for EVP_DigestSign* in FIPS module */
if (in->pctx != NULL) {
out->pctx = EVP_PKEY_CTX_dup(in->pctx);
if (out->pctx == NULL) {
@@ -405,12 +424,13 @@ int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in)
return 0;
}
}
#endif
return 1;
/* TODO(3.0): Remove legacy code below */
legacy:
#ifndef OPENSSL_NO_ENGINE
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
/* Make sure it's safe to copy a digest context using an ENGINE */
if (in->engine && !ENGINE_init(in->engine)) {
EVPerr(EVP_F_EVP_MD_CTX_COPY_EX, ERR_R_ENGINE_LIB);
@@ -451,6 +471,8 @@ int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in)
out->update = in->update;
#ifndef FIPS_MODE
/* TODO(3.0): Temporarily no support for EVP_DigestSign* in FIPS module */
if (in->pctx) {
out->pctx = EVP_PKEY_CTX_dup(in->pctx);
if (!out->pctx) {
@@ -458,6 +480,7 @@ int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in)
return 0;
}
}
#endif
if (out->digest->copy)
return out->digest->copy(out, in);
crypto/evp/evp_enc.c
+35 -16
View File
@@ -51,7 +51,7 @@ int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *ctx)
OPENSSL_cleanse(ctx->cipher_data, ctx->cipher->ctx_size);
}
OPENSSL_free(ctx->cipher_data);
#ifndef OPENSSL_NO_ENGINE
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
ENGINE_finish(ctx->engine);
#endif
memset(ctx, 0, sizeof(*ctx));
@@ -81,8 +81,9 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
ENGINE *impl, const unsigned char *key,
const unsigned char *iv, int enc)
{
EVP_CIPHER *provciph = NULL;
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
ENGINE *tmpimpl = NULL;
#endif
const EVP_CIPHER *tmpcipher;
/*
@@ -105,7 +106,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
/* TODO(3.0): Legacy work around code below. Remove this */
#ifndef OPENSSL_NO_ENGINE
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
/*
* Whether it's nice or not, "Inits" can be used on "Final"'d contexts so
* this context may already have an ENGINE! Try to avoid releasing the
@@ -126,8 +127,10 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
* If there are engines involved then we should use legacy handling for now.
*/
if (ctx->engine != NULL
|| impl != NULL
|| tmpimpl != NULL) {
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
|| tmpimpl != NULL
#endif
|| impl != NULL) {
if (ctx->cipher == ctx->fetched_cipher)
ctx->cipher = NULL;
EVP_CIPHER_meth_free(ctx->fetched_cipher);
@@ -194,7 +197,14 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
cipher = ctx->cipher;
if (cipher->prov == NULL) {
provciph = EVP_CIPHER_fetch(NULL, OBJ_nid2sn(cipher->nid), "");
#ifdef FIPS_MODE
/* We only do explict fetches inside the FIPS module */
EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_INITIALIZATION_ERROR);
return 0;
#else
EVP_CIPHER *provciph =
EVP_CIPHER_fetch(NULL, OBJ_nid2sn(cipher->nid), "");
if (provciph == NULL) {
EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_INITIALIZATION_ERROR);
return 0;
@@ -202,6 +212,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
cipher = provciph;
EVP_CIPHER_meth_free(ctx->fetched_cipher);
ctx->fetched_cipher = provciph;
#endif
}
ctx->cipher = cipher;
@@ -279,7 +290,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
ctx->encrypt = enc;
ctx->flags = flags;
}
#ifndef OPENSSL_NO_ENGINE
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
if (impl != NULL) {
if (!ENGINE_init(impl)) {
EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_INITIALIZATION_ERROR);
@@ -335,7 +346,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
}
}
}
#ifndef OPENSSL_NO_ENGINE
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
skip_to_init:
#endif
if (ctx->cipher == NULL)
@@ -576,7 +587,12 @@ int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
return 0;
}
if (ctx->cipher == NULL || ctx->cipher->prov == NULL)
if (ctx->cipher == NULL) {
EVPerr(EVP_F_EVP_ENCRYPTUPDATE, EVP_R_NO_CIPHER_SET);
return 0;
}
if (ctx->cipher->prov == NULL)
goto legacy;
blocksize = EVP_CIPHER_CTX_block_size(ctx);
@@ -820,7 +836,12 @@ int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
return 0;
}
if (ctx->cipher == NULL || ctx->cipher->prov == NULL)
if (ctx->cipher == NULL) {
EVPerr(EVP_F_EVP_DECRYPTFINAL_EX, EVP_R_NO_CIPHER_SET);
return 0;
}
if (ctx->cipher->prov == NULL)
goto legacy;
blocksize = EVP_CIPHER_CTX_block_size(ctx);
@@ -847,11 +868,6 @@ int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
legacy:
*outl = 0;
if (ctx->cipher == NULL) {
EVPerr(EVP_F_EVP_DECRYPTFINAL_EX, EVP_R_NO_CIPHER_SET);
return 0;
}
if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) {
i = ctx->cipher->do_cipher(ctx, out, NULL, 0);
if (i < 0)
@@ -966,6 +982,8 @@ int EVP_CIPHER_CTX_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr)
return ret;
}
#if !defined(FIPS_MODE)
/* TODO(3.0): No support for RAND yet in the FIPS module */
int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key)
{
int kl;
@@ -976,6 +994,7 @@ int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key)
return 0;
return 1;
}
#endif
int EVP_CIPHER_CTX_copy(EVP_CIPHER_CTX *out, const EVP_CIPHER_CTX *in)
{
@@ -1013,7 +1032,7 @@ int EVP_CIPHER_CTX_copy(EVP_CIPHER_CTX *out, const EVP_CIPHER_CTX *in)
/* TODO(3.0): Remove legacy code below */
legacy:
#ifndef OPENSSL_NO_ENGINE
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
/* Make sure it's safe to copy a cipher context using an ENGINE */
if (in->engine && !ENGINE_init(in->engine)) {
EVPerr(EVP_F_EVP_CIPHER_CTX_COPY, ERR_R_ENGINE_LIB);
crypto/evp/evp_key.c
+4
View File
@@ -14,6 +14,10 @@
#include <openssl/evp.h>
#include <openssl/ui.h>
#ifndef BUFSIZ
# define BUFSIZ 256
#endif
/* should be init to zeros. */
static char prompt_string[80];
crypto/evp/evp_lib.c
+18 -7
View File
@@ -17,6 +17,7 @@
#include "internal/provider.h"
#include "evp_locl.h"
#if !defined(FIPS_MODE)
int EVP_CIPHER_param_to_asn1(EVP_CIPHER_CTX *c, ASN1_TYPE *type)
{
int ret;
@@ -146,12 +147,12 @@ int EVP_CIPHER_set_asn1_iv(EVP_CIPHER_CTX *c, ASN1_TYPE *type)
}
return i;
}
#endif /* !defined(FIPS_MODE) */
/* Convert the various cipher NIDs and dummies to a proper OID NID */
int EVP_CIPHER_type(const EVP_CIPHER *ctx)
{
int nid;
ASN1_OBJECT *otmp;
nid = EVP_CIPHER_nid(ctx);
switch (nid) {
@@ -198,12 +199,19 @@ int EVP_CIPHER_type(const EVP_CIPHER *ctx)
return NID_des_cfb64;
default:
/* Check it has an OID and it is valid */
otmp = OBJ_nid2obj(nid);
if (OBJ_get0_data(otmp) == NULL)
nid = NID_undef;
ASN1_OBJECT_free(otmp);
return nid;
#ifdef FIPS_MODE
return NID_undef;
#else
{
/* Check it has an OID and it is valid */
ASN1_OBJECT *otmp = OBJ_nid2obj(nid);
if (OBJ_get0_data(otmp) == NULL)
nid = NID_undef;
ASN1_OBJECT_free(otmp);
return nid;
}
#endif
}
}
@@ -596,6 +604,8 @@ EVP_PKEY_CTX *EVP_MD_CTX_pkey_ctx(const EVP_MD_CTX *ctx)
return ctx->pctx;
}
#if !defined(FIPS_MODE)
/* TODO(3.0): EVP_DigestSign* not yet supported in FIPS module */
void EVP_MD_CTX_set_pkey_ctx(EVP_MD_CTX *ctx, EVP_PKEY_CTX *pctx)
{
/*
@@ -614,6 +624,7 @@ void EVP_MD_CTX_set_pkey_ctx(EVP_MD_CTX *ctx, EVP_PKEY_CTX *pctx)
EVP_MD_CTX_clear_flags(ctx, EVP_MD_CTX_FLAG_KEEP_PKEY_CTX);
}
}
#endif /* !defined(FIPS_MODE) */
void *EVP_MD_CTX_md_data(const EVP_MD_CTX *ctx)
{
crypto/kdf/hkdf.c
+99 -6
View File
@@ -28,7 +28,7 @@ static int HKDF(const EVP_MD *evp_md,
unsigned char *okm, size_t okm_len);
static int HKDF_Extract(const EVP_MD *evp_md,
const unsigned char *salt, size_t salt_len,
const unsigned char *key, size_t key_len,
const unsigned char *ikm, size_t ikm_len,
unsigned char *prk, size_t prk_len);
static int HKDF_Expand(const EVP_MD *evp_md,
const unsigned char *prk, size_t prk_len,
@@ -240,9 +240,34 @@ const EVP_KDF hkdf_kdf_meth = {
kdf_hkdf_derive
};
/*
* Refer to "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)"
* Section 2 (https://tools.ietf.org/html/rfc5869#section-2) and
* "Cryptographic Extraction and Key Derivation: The HKDF Scheme"
* Section 4.2 (https://eprint.iacr.org/2010/264.pdf).
*
* From the paper:
* The scheme HKDF is specified as:
* HKDF(XTS, SKM, CTXinfo, L) = K(1) | K(2) | ... | K(t)
*
* where:
* SKM is source key material
* XTS is extractor salt (which may be null or constant)
* CTXinfo is context information (may be null)
* L is the number of key bits to be produced by KDF
* k is the output length in bits of the hash function used with HMAC
* t = ceil(L/k)
* the value K(t) is truncated to its first d = L mod k bits.
*
* From RFC 5869:
* 2.2. Step 1: Extract
* HKDF-Extract(salt, IKM) -> PRK
* 2.3. Step 2: Expand
* HKDF-Expand(PRK, info, L) -> OKM
*/
static int HKDF(const EVP_MD *evp_md,
const unsigned char *salt, size_t salt_len,
const unsigned char *key, size_t key_len,
const unsigned char *ikm, size_t ikm_len,
const unsigned char *info, size_t info_len,
unsigned char *okm, size_t okm_len)
{
@@ -255,18 +280,44 @@ static int HKDF(const EVP_MD *evp_md,
return 0;
prk_len = (size_t)sz;
if (!HKDF_Extract(evp_md, salt, salt_len, key, key_len, prk, prk_len))
/* Step 1: HKDF-Extract(salt, IKM) -> PRK */
if (!HKDF_Extract(evp_md, salt, salt_len, ikm, ikm_len, prk, prk_len))
return 0;
/* Step 2: HKDF-Expand(PRK, info, L) -> OKM */
ret = HKDF_Expand(evp_md, prk, prk_len, info, info_len, okm, okm_len);
OPENSSL_cleanse(prk, sizeof(prk));
return ret;
}
/*
* Refer to "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)"
* Section 2.2 (https://tools.ietf.org/html/rfc5869#section-2.2).
*
* 2.2. Step 1: Extract
*
* HKDF-Extract(salt, IKM) -> PRK
*
* Options:
* Hash a hash function; HashLen denotes the length of the
* hash function output in octets
*
* Inputs:
* salt optional salt value (a non-secret random value);
* if not provided, it is set to a string of HashLen zeros.
* IKM input keying material
*
* Output:
* PRK a pseudorandom key (of HashLen octets)
*
* The output PRK is calculated as follows:
*
* PRK = HMAC-Hash(salt, IKM)
*/
static int HKDF_Extract(const EVP_MD *evp_md,
const unsigned char *salt, size_t salt_len,
const unsigned char *key, size_t key_len,
const unsigned char *ikm, size_t ikm_len,
unsigned char *prk, size_t prk_len)
{
int sz = EVP_MD_size(evp_md);
@@ -277,9 +328,49 @@ static int HKDF_Extract(const EVP_MD *evp_md,
KDFerr(KDF_F_HKDF_EXTRACT, KDF_R_WRONG_OUTPUT_BUFFER_SIZE);
return 0;
}
return HMAC(evp_md, salt, salt_len, key, key_len, prk, NULL) != NULL;
/* calc: PRK = HMAC-Hash(salt, IKM) */
return HMAC(evp_md, salt, salt_len, ikm, ikm_len, prk, NULL) != NULL;
}
/*
* Refer to "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)"
* Section 2.3 (https://tools.ietf.org/html/rfc5869#section-2.3).
*
* 2.3. Step 2: Expand
*
* HKDF-Expand(PRK, info, L) -> OKM
*
* Options:
* Hash a hash function; HashLen denotes the length of the
* hash function output in octets
*
* Inputs:
* PRK a pseudorandom key of at least HashLen octets
* (usually, the output from the extract step)
* info optional context and application specific information
* (can be a zero-length string)
* L length of output keying material in octets
* (<= 255*HashLen)
*
* Output:
* OKM output keying material (of L octets)
*
* The output OKM is calculated as follows:
*
* N = ceil(L/HashLen)
* T = T(1) | T(2) | T(3) | ... | T(N)
* OKM = first L octets of T
*
* where:
* T(0) = empty string (zero length)
* T(1) = HMAC-Hash(PRK, T(0) | info | 0x01)
* T(2) = HMAC-Hash(PRK, T(1) | info | 0x02)
* T(3) = HMAC-Hash(PRK, T(2) | info | 0x03)
* ...
*
* (where the constant concatenated to the end of each T(n) is a
* single octet.)
*/
static int HKDF_Expand(const EVP_MD *evp_md,
const unsigned char *prk, size_t prk_len,
const unsigned char *info, size_t info_len,
@@ -295,8 +386,9 @@ static int HKDF_Expand(const EVP_MD *evp_md,
if (sz <= 0)
return 0;
dig_len = (size_t)sz;
n = okm_len / dig_len;
/* calc: N = ceil(L/HashLen) */
n = okm_len / dig_len;
if (okm_len % dig_len)
n++;
@@ -313,6 +405,7 @@ static int HKDF_Expand(const EVP_MD *evp_md,
size_t copy_len;
const unsigned char ctr = i;
/* calc: T(i) = HMAC-Hash(PRK, T(i - 1) | info | i) */
if (i > 1) {
if (!HMAC_Init_ex(hmac, NULL, 0, NULL, NULL))
goto err;
crypto/kdf/tls1_prf.c
+117 -35
View File
@@ -7,6 +7,44 @@
* https://www.openssl.org/source/license.html
*/
/*
* Refer to "The TLS Protocol Version 1.0" Section 5
* (https://tools.ietf.org/html/rfc2246#section-5) and
* "The Transport Layer Security (TLS) Protocol Version 1.2" Section 5
* (https://tools.ietf.org/html/rfc5246#section-5).
*
* For TLS v1.0 and TLS v1.1 the TLS PRF algorithm is given by:
*
* PRF(secret, label, seed) = P_MD5(S1, label + seed) XOR
* P_SHA-1(S2, label + seed)
*
* where P_MD5 and P_SHA-1 are defined by P_<hash>, below, and S1 and S2 are
* two halves of the secret (with the possibility of one shared byte, in the
* case where the length of the original secret is odd). S1 is taken from the
* first half of the secret, S2 from the second half.
*
* For TLS v1.2 the TLS PRF algorithm is given by:
*
* PRF(secret, label, seed) = P_<hash>(secret, label + seed)
*
* where hash is SHA-256 for all cipher suites defined in RFC 5246 as well as
* those published prior to TLS v1.2 while the TLS v1.2 protocol is in effect,
* unless defined otherwise by the cipher suite.
*
* P_<hash> is an expansion function that uses a single hash function to expand
* a secret and seed into an arbitrary quantity of output:
*
* P_<hash>(secret, seed) = HMAC_<hash>(secret, A(1) + seed) +
* HMAC_<hash>(secret, A(2) + seed) +
* HMAC_<hash>(secret, A(3) + seed) + ...
*
* where + indicates concatenation. P_<hash> can be iterated as many times as
* is necessary to produce the required quantity of data.
*
* A(i) is defined as:
* A(0) = seed
* A(i) = HMAC_<hash>(secret, A(i-1))
*/
#include <stdio.h>
#include <stdarg.h>
#include <string.h>
@@ -82,7 +120,7 @@ static int kdf_tls1_prf_ctrl(EVP_KDF_IMPL *impl, int cmd, va_list args)
if (impl->sec == NULL)
return 0;
impl->seclen = len;
impl->seclen = len;
return 1;
case EVP_KDF_CTRL_RESET_TLS_SEED:
@@ -168,25 +206,41 @@ const EVP_KDF tls1_prf_kdf_meth = {
kdf_tls1_prf_derive
};
/*
* Refer to "The TLS Protocol Version 1.0" Section 5
* (https://tools.ietf.org/html/rfc2246#section-5) and
* "The Transport Layer Security (TLS) Protocol Version 1.2" Section 5
* (https://tools.ietf.org/html/rfc5246#section-5).
*
* P_<hash> is an expansion function that uses a single hash function to expand
* a secret and seed into an arbitrary quantity of output:
*
* P_<hash>(secret, seed) = HMAC_<hash>(secret, A(1) + seed) +
* HMAC_<hash>(secret, A(2) + seed) +
* HMAC_<hash>(secret, A(3) + seed) + ...
*
* where + indicates concatenation. P_<hash> can be iterated as many times as
* is necessary to produce the required quantity of data.
*
* A(i) is defined as:
* A(0) = seed
* A(i) = HMAC_<hash>(secret, A(i-1))
*/
static int tls1_prf_P_hash(const EVP_MD *md,
const unsigned char *sec, size_t sec_len,
const unsigned char *seed, size_t seed_len,
unsigned char *out, size_t olen)
{
int chunk;
EVP_MAC_CTX *ctx = NULL, *ctx_tmp = NULL, *ctx_init = NULL;
unsigned char A1[EVP_MAX_MD_SIZE];
size_t A1_len;
size_t chunk;
EVP_MAC_CTX *ctx = NULL, *ctx_Ai = NULL, *ctx_init = NULL;
unsigned char Ai[EVP_MAX_MD_SIZE];
size_t Ai_len;
int ret = 0;
chunk = EVP_MD_size(md);
if (!ossl_assert(chunk > 0))
goto err;
ctx = EVP_MAC_CTX_new_id(EVP_MAC_HMAC);
ctx_tmp = EVP_MAC_CTX_new_id(EVP_MAC_HMAC);
ctx_Ai = EVP_MAC_CTX_new_id(EVP_MAC_HMAC);
ctx_init = EVP_MAC_CTX_new_id(EVP_MAC_HMAC);
if (ctx == NULL || ctx_tmp == NULL || ctx_init == NULL)
if (ctx == NULL || ctx_Ai == NULL || ctx_init == NULL)
goto err;
if (EVP_MAC_ctrl(ctx_init, EVP_MAC_CTRL_SET_FLAGS, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW) != 1)
goto err;
@@ -196,59 +250,85 @@ static int tls1_prf_P_hash(const EVP_MD *md,
goto err;
if (!EVP_MAC_init(ctx_init))
goto err;
if (!EVP_MAC_CTX_copy(ctx, ctx_init))
chunk = EVP_MAC_size(ctx_init);
if (chunk == 0)
goto err;
if (seed != NULL && !EVP_MAC_update(ctx, seed, seed_len))
/* A(0) = seed */
if (!EVP_MAC_CTX_copy(ctx_Ai, ctx_init))
goto err;
if (!EVP_MAC_final(ctx, A1, &A1_len))
if (seed != NULL && !EVP_MAC_update(ctx_Ai, seed, seed_len))
goto err;
for (;;) {
/* Reinit mac contexts */
/* calc: A(i) = HMAC_<hash>(secret, A(i-1)) */
if (!EVP_MAC_final(ctx_Ai, Ai, &Ai_len))
goto err;
/* calc next chunk: HMAC_<hash>(secret, A(i) + seed) */
if (!EVP_MAC_CTX_copy(ctx, ctx_init))
goto err;
if (!EVP_MAC_update(ctx, A1, A1_len))
if (!EVP_MAC_update(ctx, Ai, Ai_len))
goto err;
if (olen > (size_t)chunk && !EVP_MAC_CTX_copy(ctx_tmp, ctx))
/* save state for calculating next A(i) value */
if (olen > chunk && !EVP_MAC_CTX_copy(ctx_Ai, ctx))
goto err;
if (seed != NULL && !EVP_MAC_update(ctx, seed, seed_len))
goto err;
if (olen > (size_t)chunk) {
size_t mac_len;
if (!EVP_MAC_final(ctx, out, &mac_len))
if (olen <= chunk) {
/* last chunk - use Ai as temp bounce buffer */
if (!EVP_MAC_final(ctx, Ai, &Ai_len))
goto err;
out += mac_len;
olen -= mac_len;
/* calc the next A1 value */
if (!EVP_MAC_final(ctx_tmp, A1, &A1_len))
goto err;
} else { /* last one */
if (!EVP_MAC_final(ctx, A1, &A1_len))
goto err;
memcpy(out, A1, olen);
memcpy(out, Ai, olen);
break;
}
if (!EVP_MAC_final(ctx, out, NULL))
goto err;
out += chunk;
olen -= chunk;
}
ret = 1;
err:
EVP_MAC_CTX_free(ctx);
EVP_MAC_CTX_free(ctx_tmp);
EVP_MAC_CTX_free(ctx_Ai);
EVP_MAC_CTX_free(ctx_init);
OPENSSL_cleanse(A1, sizeof(A1));
OPENSSL_cleanse(Ai, sizeof(Ai));
return ret;
}
/*
* Refer to "The TLS Protocol Version 1.0" Section 5
* (https://tools.ietf.org/html/rfc2246#section-5) and
* "The Transport Layer Security (TLS) Protocol Version 1.2" Section 5
* (https://tools.ietf.org/html/rfc5246#section-5).
*
* For TLS v1.0 and TLS v1.1:
*
* PRF(secret, label, seed) = P_MD5(S1, label + seed) XOR
* P_SHA-1(S2, label + seed)
*
* S1 is taken from the first half of the secret, S2 from the second half.
*
* L_S = length in bytes of secret;
* L_S1 = L_S2 = ceil(L_S / 2);
*
* For TLS v1.2:
*
* PRF(secret, label, seed) = P_<hash>(secret, label + seed)
*/
static int tls1_prf_alg(const EVP_MD *md,
const unsigned char *sec, size_t slen,
const unsigned char *seed, size_t seed_len,
unsigned char *out, size_t olen)
{
if (EVP_MD_type(md) == NID_md5_sha1) {
/* TLS v1.0 and TLS v1.1 */
size_t i;
unsigned char *tmp;
if (!tls1_prf_P_hash(EVP_md5(), sec, slen/2 + (slen & 1),
/* calc: L_S1 = L_S2 = ceil(L_S / 2) */
size_t L_S1 = (slen + 1) / 2;
size_t L_S2 = L_S1;
if (!tls1_prf_P_hash(EVP_md5(), sec, L_S1,
seed, seed_len, out, olen))
return 0;
@@ -256,7 +336,7 @@ static int tls1_prf_alg(const EVP_MD *md,
KDFerr(KDF_F_TLS1_PRF_ALG, ERR_R_MALLOC_FAILURE);
return 0;
}
if (!tls1_prf_P_hash(EVP_sha1(), sec + slen/2, slen/2 + (slen & 1),
if (!tls1_prf_P_hash(EVP_sha1(), sec + slen - L_S2, L_S2,
seed, seed_len, tmp, olen)) {
OPENSSL_clear_free(tmp, olen);
return 0;
@@ -266,6 +346,8 @@ static int tls1_prf_alg(const EVP_MD *md,
OPENSSL_clear_free(tmp, olen);
return 1;
}
/* TLS v1.2 */
if (!tls1_prf_P_hash(md, sec, slen, seed, seed_len, out, olen))
return 0;
crypto/lhash/build.info
+2
View File
@@ -1,3 +1,5 @@
LIBS=../../libcrypto
SOURCE[../../libcrypto]=\
lhash.c lh_stats.c
SOURCE[../../providers/fips]=\
lhash.c
crypto/ocsp/ocsp_ext.c
+2 -2
View File
@@ -439,6 +439,7 @@ X509_EXTENSION *OCSP_url_svcloc_new(X509_NAME *issuer, const char **urls)
if ((sloc = OCSP_SERVICELOC_new()) == NULL)
goto err;
X509_NAME_free(sloc->issuer);
if ((sloc->issuer = X509_NAME_dup(issuer)) == NULL)
goto err;
if (urls && *urls
@@ -449,12 +450,11 @@ X509_EXTENSION *OCSP_url_svcloc_new(X509_NAME *issuer, const char **urls)
goto err;
if ((ad->method = OBJ_nid2obj(NID_ad_OCSP)) == NULL)
goto err;
if ((ad->location = GENERAL_NAME_new()) == NULL)
goto err;
if ((ia5 = ASN1_IA5STRING_new()) == NULL)
goto err;
if (!ASN1_STRING_set((ASN1_STRING *)ia5, *urls, -1))
goto err;
/* ad->location is allocated inside ACCESS_DESCRIPTION_new */
ad->location->type = GEN_URI;
ad->location->d.ia5 = ia5;
ia5 = NULL;
crypto/property/build.info
+2
View File
@@ -1,3 +1,5 @@
LIBS=../../libcrypto
SOURCE[../../libcrypto]=property_string.c property_parse.c property.c \
property_err.c defn_cache.c
SOURCE[../../providers/fips]=\
property_string.c property_parse.c property.c defn_cache.c
crypto/property/property.c
+3
View File
@@ -391,6 +391,8 @@ IMPLEMENT_LHASH_DOALL_ARG(QUERY, IMPL_CACHE_FLUSH);
*/
static void impl_cache_flush_cache(QUERY *c, IMPL_CACHE_FLUSH *state)
{
#if !defined(FIPS_MODE)
/* TODO(3.0): No RAND_bytes yet in FIPS module. Add this back when available */
OSSL_METHOD_STORE *store = state->store;
unsigned int n;
@@ -404,6 +406,7 @@ static void impl_cache_flush_cache(QUERY *c, IMPL_CACHE_FLUSH *state)
OPENSSL_free(lh_QUERY_delete(state->cache, c));
else
state->nelem++;
#endif /* !defined(FIPS_MODE) */
}
static void impl_cache_flush_one_alg(ossl_uintmax_t idx, ALGORITHM *alg,
crypto/provider_core.c
+44 -4
View File
@@ -275,7 +275,9 @@ void ossl_provider_free(OSSL_PROVIDER *prov)
* the store. All we have to do here is clean it out.
*/
if (ref == 0) {
#ifndef FIPS_MODE
DSO_free(prov->module);
#endif
OPENSSL_free(prov->name);
OPENSSL_free(prov->path);
sk_INFOPAIR_pop_free(prov->parameters, free_infopair);
@@ -338,9 +340,11 @@ static const OSSL_DISPATCH *core_dispatch; /* Define further down */
/*
* Internal version that doesn't affect the store flags, and thereby avoid
* locking. Direct callers must remember to set the store flags when
* appropriate
* appropriate. The libctx parameter is only necessary when FIPS_MODE is set
* (i.e. we are being called from inside the FIPS module) - it is ignored for
* other uses.
*/
static int provider_activate(OSSL_PROVIDER *prov)
static int provider_activate(OSSL_PROVIDER *prov, OPENSSL_CTX *libctx)
{
const OSSL_DISPATCH *provider_dispatch = NULL;
@@ -352,6 +356,9 @@ static int provider_activate(OSSL_PROVIDER *prov)
* a loadable module.
*/
if (prov->init_function == NULL) {
#ifdef FIPS_MODE
return 0;
#else
if (prov->module == NULL) {
char *allocated_path = NULL;
const char *module_path = NULL;
@@ -389,15 +396,38 @@ static int provider_activate(OSSL_PROVIDER *prov)
if (prov->module != NULL)
prov->init_function = (OSSL_provider_init_fn *)
DSO_bind_func(prov->module, "OSSL_provider_init");
#endif
}
/*
* We call the initialise function for the provider.
*
* If FIPS_MODE is defined then we are inside the FIPS module and are about
* to recursively initialise ourselves. We need to do this so that we can
* get all the provider callback functions set up in order for us to be able
* to make EVP calls from within the FIPS module itself. Only algorithms
* from the FIPS module itself are available via the FIPS module EVP
* interface, i.e. we only ever have one provider available inside the FIPS
* module - the FIPS provider itself.
*
* For modules in general we cannot know what value will be used for the
* provctx - it is a "black box". But for the FIPS module we know that the
* provctx is really a library context. We default the provctx value to the
* same library context as was used for the EVP call that caused this call
* to "provider_activate".
*/
#ifdef FIPS_MODE
prov->provctx = libctx;
#endif
if (prov->init_function == NULL
|| !prov->init_function(prov, core_dispatch, &provider_dispatch,
&prov->provctx)) {
CRYPTOerr(CRYPTO_F_PROVIDER_ACTIVATE, ERR_R_INIT_FAIL);
ERR_add_error_data(2, "name=", prov->name);
#ifndef FIPS_MODE
DSO_free(prov->module);
prov->module = NULL;
#endif
return 0;
}
@@ -430,7 +460,7 @@ static int provider_activate(OSSL_PROVIDER *prov)
int ossl_provider_activate(OSSL_PROVIDER *prov)
{
if (provider_activate(prov)) {
if (provider_activate(prov, NULL)) {
CRYPTO_THREAD_write_lock(prov->store->lock);
prov->store->use_fallbacks = 0;
CRYPTO_THREAD_unlock(prov->store->lock);
@@ -507,7 +537,7 @@ int ossl_provider_forall_loaded(OPENSSL_CTX *ctx,
*/
if (prov->flag_fallback) {
activated_fallback_count++;
provider_activate(prov);
provider_activate(prov, ctx);
}
}
@@ -557,13 +587,21 @@ const DSO *ossl_provider_dso(OSSL_PROVIDER *prov)
const char *ossl_provider_module_name(OSSL_PROVIDER *prov)
{
#ifdef FIPS_MODE
return NULL;
#else
return DSO_get_filename(prov->module);
#endif
}
const char *ossl_provider_module_path(OSSL_PROVIDER *prov)
{
#ifdef FIPS_MODE
return NULL;
#else
/* FIXME: Ensure it's a full path */
return DSO_get_filename(prov->module);
#endif
}
/* Wrappers around calls to the provider */
@@ -643,6 +681,8 @@ static int core_get_params(const OSSL_PROVIDER *prov, const OSSL_PARAM params[])
static const OSSL_DISPATCH core_dispatch_[] = {
{ OSSL_FUNC_CORE_GET_PARAM_TYPES, (void (*)(void))core_get_param_types },
{ OSSL_FUNC_CORE_GET_PARAMS, (void (*)(void))core_get_params },
{ OSSL_FUNC_CORE_PUT_ERROR, (void (*)(void))ERR_put_error },
{ OSSL_FUNC_CORE_ADD_ERROR_VDATA, (void (*)(void))ERR_add_error_vdata },
{ 0, NULL }
};
static const OSSL_DISPATCH *core_dispatch = core_dispatch_;
crypto/provider_predefined.c
+5
View File
@@ -11,8 +11,13 @@
#include "provider_local.h"
OSSL_provider_init_fn ossl_default_provider_init;
OSSL_provider_init_fn fips_intern_provider_init;
const struct predefined_providers_st predefined_providers[] = {
#ifdef FIPS_MODE
{ "fips", fips_intern_provider_init, 1 },
#else
{ "default", ossl_default_provider_init, 1 },
#endif
{ NULL, NULL, 0 }
};
crypto/stack/build.info
+1
View File
@@ -1,2 +1,3 @@
LIBS=../../libcrypto
SOURCE[../../libcrypto]=stack.c
SOURCE[../../providers/fips]=stack.c
crypto/threads_pthread.c
+8 -4
View File
@@ -175,7 +175,10 @@ int CRYPTO_atomic_add(int *val, int amount, int *ret, CRYPTO_RWLOCK *lock)
return 1;
}
# ifdef OPENSSL_SYS_UNIX
# ifndef FIPS_MODE
/* TODO(3.0): No fork protection in FIPS module yet! */
# ifdef OPENSSL_SYS_UNIX
static pthread_once_t fork_once_control = PTHREAD_ONCE_INIT;
static void fork_once_func(void)
@@ -183,14 +186,15 @@ static void fork_once_func(void)
pthread_atfork(OPENSSL_fork_prepare,
OPENSSL_fork_parent, OPENSSL_fork_child);
}
# endif
# endif
int openssl_init_fork_handlers(void)
{
# ifdef OPENSSL_SYS_UNIX
# ifdef OPENSSL_SYS_UNIX
if (pthread_once(&fork_once_control, fork_once_func) == 0)
return 1;
# endif
# endif
return 0;
}
# endif /* FIPS_MODE */
#endif
crypto/x509v3/v3_genn.c
+2 -2
View File
@@ -143,7 +143,7 @@ void GENERAL_NAME_set0_value(GENERAL_NAME *a, int type, void *value)
a->type = type;
}
void *GENERAL_NAME_get0_value(GENERAL_NAME *a, int *ptype)
void *GENERAL_NAME_get0_value(const GENERAL_NAME *a, int *ptype)
{
if (ptype)
*ptype = a->type;
@@ -188,7 +188,7 @@ int GENERAL_NAME_set0_othername(GENERAL_NAME *gen,
return 1;
}
int GENERAL_NAME_get0_otherName(GENERAL_NAME *gen,
int GENERAL_NAME_get0_otherName(const GENERAL_NAME *gen,
ASN1_OBJECT **poid, ASN1_TYPE **pvalue)
{
if (gen->type != GEN_OTHERNAME)