Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update OpenSSL-1.1.1-pre8-dev

Browse Source
This commit is contained in:
Hakase
2018-06-14 23:58:15 +09:00
parent 7b0e27998c
commit 9a4ebe1ae3
51 changed files with 1109 additions and 288 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGES
+4
View File
@@ -8,6 +8,10 @@
release branch.
Changes between 1.1.0h and 1.1.1 [xx XXX xxxx]
*) Add blinding to an ECDSA signature to protect against side channel attacks
discovered by Keegan Ryan (NCC Group).
[Matt Caswell]
*) Enforce checking in the pkeyutl command line app to ensure that the input
length does not exceed the maximum supported digest length when performing
a sign, verify or verifyrecover operation.
Configurations/10-main.conf
+33 -81
View File
@@ -211,8 +211,11 @@ my %targets = (
ex_libs => add("-lsocket -lnsl -ldl"),
dso_scheme => "dlfcn",
thread_scheme => "pthreads",
shared_target => "solaris-shared",
shared_target => "self",
shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
shared_ldflag => "-Wl,-Bsymbolic",
shared_defflag => "-Wl,-M,",
shared_sonameflag=> "-Wl,-h,",
},
#### Solaris x86 with GNU C setups
"solaris-x86-gcc" => {
@@ -229,7 +232,7 @@ my %targets = (
ex_libs => add(threads("-pthread")),
bn_ops => "BN_LLONG",
shared_cflag => "-fPIC",
shared_ldflag => "-shared -static-libgcc",
shared_ldflag => add("-shared -static-libgcc"),
},
"solaris64-x86_64-gcc" => {
# -shared -static-libgcc might appear controversial, but modules
@@ -251,7 +254,7 @@ my %targets = (
bn_ops => "SIXTY_FOUR_BIT_LONG",
perlasm_scheme => "elf",
shared_cflag => "-fPIC",
shared_ldflag => "-shared -static-libgcc",
shared_ldflag => add("-shared -static-libgcc"),
multilib => "/64",
},
@@ -282,7 +285,7 @@ my %targets = (
bn_ops => "SIXTY_FOUR_BIT_LONG",
perlasm_scheme => "elf",
shared_cflag => "-KPIC",
shared_ldflag => "-G -dy -z text",
shared_ldflag => add("-G -dy -z text"),
multilib => "/64",
},
@@ -298,7 +301,7 @@ my %targets = (
ex_libs => add(threads("-pthread")),
bn_ops => "BN_LLONG RC4_CHAR",
shared_cflag => "-fPIC",
shared_ldflag => "-shared",
shared_ldflag => add("-shared"),
},
"solaris-sparcv8-gcc" => {
inherit_from => [ "solaris-sparcv7-gcc", asm("sparcv8_asm") ],
@@ -333,7 +336,7 @@ my %targets = (
ex_libs => add(threads("-lpthread")),
bn_ops => "BN_LLONG RC4_CHAR",
shared_cflag => "-KPIC",
shared_ldflag => "-G -dy -z text",
shared_ldflag => add("-G -dy -z text"),
},
####
"solaris-sparcv8-cc" => {
@@ -1114,85 +1117,74 @@ my %targets = (
# variable, then you should know that in OpenSSL case it's considered
# only in ./config. Once configured, build procedure remains "deaf" to
# current value of $OBJECT_MODE.
"aix-common" => {
inherit_from => [ "BASE_unix" ],
template => 1,
sys_id => "AIX",
lib_cppflags => "-DB_ENDIAN",
thread_scheme => "pthreads",
dso_scheme => "dlfcn",
shared_target => "self",
shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
bin_lflags => shared("-Wl,-bsvr4"),
module_ldflags => "-Wl,-G,-bsymbolic,-bexpall,-bnolibpath",
shared_ldflag => "-Wl,-G,-bsymbolic,-bnolibpath",
shared_defflag => "-Wl,-bE:",
},
"aix-gcc" => {
inherit_from => [ "BASE_unix", asm("ppc32_asm") ],
inherit_from => [ "aix-common", asm("ppc32_asm") ],
CC => "gcc",
CFLAGS => picker(debug => "-O0 -g",
release => "-O"),
cflags => add(threads("-pthread")),
lib_cppflags => "-DB_ENDIAN",
ex_libs => add(threads("-pthread")),
sys_id => "AIX",
ex_libs => threads("-pthread"),
bn_ops => "BN_LLONG RC4_CHAR",
thread_scheme => "pthreads",
perlasm_scheme => "aix32",
dso_scheme => "dlfcn",
shared_target => "aix-shared",
shared_ldflag => "-shared -static-libgcc -Wl,-G",
shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
shared_ldflag => add("-shared -static-libgcc"),
AR => add("-X32"),
RANLIB => add("-X32"),
},
"aix64-gcc" => {
inherit_from => [ "BASE_unix", asm("ppc64_asm") ],
inherit_from => [ "aix-common", asm("ppc64_asm") ],
CC => "gcc",
CFLAGS => picker(debug => "-O0 -g",
release => "-O"),
cflags => combine("-maix64", threads("-pthread")),
lib_cppflags => "-DB_ENDIAN",
ex_libs => add(threads("-pthread")),
sys_id => "AIX",
ex_libs => threads("-pthread"),
bn_ops => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
thread_scheme => "pthreads",
perlasm_scheme => "aix64",
dso_scheme => "dlfcn",
shared_target => "aix-shared",
shared_ldflag => "-shared -static-libgcc -Wl,-G",
shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
shared_ldflag => add("-shared -static-libgcc"),
AR => add("-X64"),
RANLIB => add("-X64"),
},
"aix-cc" => {
inherit_from => [ "BASE_unix", asm("ppc32_asm") ],
inherit_from => [ "aix-common", asm("ppc32_asm") ],
CC => "cc",
CFLAGS => picker(debug => "-O0 -g",
release => "-O"),
cflags => combine("-q32 -qmaxmem=16384 -qro -qroconst",
threads("-qthreaded")),
cppflags => threads("-D_THREAD_SAFE"),
lib_cppflags => "-DB_ENDIAN",
sys_id => "AIX",
bn_ops => "BN_LLONG RC4_CHAR",
thread_scheme => "pthreads",
ex_libs => threads("-lpthreads"),
bn_ops => "BN_LLONG RC4_CHAR",
perlasm_scheme => "aix32",
dso_scheme => "dlfcn",
shared_target => "aix-shared",
shared_cflag => "-qpic",
shared_ldflag => "-G",
shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
AR => add("-X32"),
RANLIB => add("-X32"),
},
"aix64-cc" => {
inherit_from => [ "BASE_unix", asm("ppc64_asm") ],
inherit_from => [ "aix-common", asm("ppc64_asm") ],
CC => "cc",
CFLAGS => picker(debug => "-O0 -g",
release => "-O"),
cflags => combine("-q64 -qmaxmem=16384 -qro -qroconst",
threads("-qthreaded")),
cppflags => threads("-D_THREAD_SAFE"),
lib_cppflags => "-DB_ENDIAN",
sys_id => "AIX",
bn_ops => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
thread_scheme => "pthreads",
ex_libs => threads("-lpthreads"),
bn_ops => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
perlasm_scheme => "aix64",
dso_scheme => "dlfcn",
shared_target => "aix-shared",
shared_cflag => "-qpic",
shared_ldflag => "-G",
shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
AR => add("-X64"),
RANLIB => add("-X64"),
},
@@ -1573,46 +1565,6 @@ my %targets = (
perlasm_scheme => "macosx",
},
#### iPhoneOS/iOS
#
# It takes three prior-set environment variables to make it work:
#
# CROSS_COMPILE=/where/toolchain/is/usr/bin/ [note ending slash]
# CROSS_TOP=/where/SDKs/are
# CROSS_SDK=iPhoneOSx.y.sdk
#
# Exact paths vary with Xcode releases, but for couple of last ones
# they would look like this:
#
# CROSS_COMPILE=`xcode-select --print-path`/Toolchains/XcodeDefault.xctoolchain/usr/bin/
# CROSS_TOP=`xcode-select --print-path`/Platforms/iPhoneOS.platform/Developer
# CROSS_SDK=iPhoneOS.sdk
#
"iphoneos-cross" => {
inherit_from => [ "darwin-common" ],
cflags => add("-isysroot \$(CROSS_TOP)/SDKs/\$(CROSS_SDK) -fno-common"),
sys_id => "iOS",
disable => [ "engine" ],
},
"ios-cross" => {
inherit_from => [ "darwin-common", asm("armv4_asm") ],
# It should be possible to go below iOS 6 and even add -arch armv6,
# thus targeting iPhone pre-3GS, but it's assumed to be irrelevant
# at this point.
cflags => add("-arch armv7 -mios-version-min=6.0.0 -isysroot \$(CROSS_TOP)/SDKs/\$(CROSS_SDK) -fno-common"),
sys_id => "iOS",
perlasm_scheme => "ios32",
disable => [ "engine" ],
},
"ios64-cross" => {
inherit_from => [ "darwin-common", asm("aarch64_asm") ],
cflags => add("-arch arm64 -mios-version-min=7.0.0 -isysroot \$(CROSS_TOP)/SDKs/\$(CROSS_SDK) -fno-common"),
sys_id => "iOS",
bn_ops => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
perlasm_scheme => "ios64",
disable => [ "engine" ],
},
##### GNU Hurd
"hurd-x86" => {
inherit_from => [ "BASE_unix" ],
Configurations/15-ios.conf
+64
View File
@@ -0,0 +1,64 @@
#### iPhoneOS/iOS
#
# It takes recent enough XCode to use following two targets. It shouldn't
# be a problem by now, but if they don't work, original targets below
# that depend on manual definition of environment variables should still
# work...
#
my %targets = (
"ios-xcrun" => {
inherit_from => [ "darwin-common", asm("armv4_asm") ],
# It should be possible to go below iOS 6 and even add -arch armv6,
# thus targeting iPhone pre-3GS, but it's assumed to be irrelevant
# at this point.
CC => "xcrun -sdk iphoneos cc",
cflags => add("-arch armv7 -mios-version-min=6.0.0 -fno-common"),
sys_id => "iOS",
perlasm_scheme => "ios32",
disable => [ "engine" ],
},
"ios64-xcrun" => {
inherit_from => [ "darwin-common", asm("aarch64_asm") ],
CC => "xcrun -sdk iphoneos cc",
cflags => add("-arch arm64 -mios-version-min=7.0.0 -fno-common"),
sys_id => "iOS",
bn_ops => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
perlasm_scheme => "ios64",
disable => [ "engine" ],
},
"iossimulator-xcrun" => {
inherit_from => [ "darwin-common" ],
CC => "xcrun -sdk iphonesimulator cc",
sys_id => "iOS",
disable => [ "engine" ],
},
# It takes three prior-set environment variables to make it work:
#
# CROSS_COMPILE=/where/toolchain/is/usr/bin/ [note ending slash]
# CROSS_TOP=/where/SDKs/are
# CROSS_SDK=iPhoneOSx.y.sdk
#
# Exact paths vary with Xcode releases, but for couple of last ones
# they would look like this:
#
# CROSS_COMPILE=`xcode-select --print-path`/Toolchains/XcodeDefault.xctoolchain/usr/bin/
# CROSS_TOP=`xcode-select --print-path`/Platforms/iPhoneOS.platform/Developer
# CROSS_SDK=iPhoneOS.sdk
#
"iphoneos-cross" => {
inherit_from => [ "darwin-common" ],
cflags => add("-isysroot \$(CROSS_TOP)/SDKs/\$(CROSS_SDK) -fno-common"),
sys_id => "iOS",
disable => [ "engine" ],
},
"ios-cross" => {
inherit_from => [ "ios-xcrun" ],
CC => "cc",
cflags => add("-isysroot \$(CROSS_TOP)/SDKs/\$(CROSS_SDK)"),
},
"ios64-cross" => {
inherit_from => [ "ios64-xcrun" ],
CC => "cc",
cflags => add("-isysroot \$(CROSS_TOP)/SDKs/\$(CROSS_SDK)"),
},
);
Configurations/shared-info.pl
-8
View File
@@ -65,10 +65,6 @@ my %shared_info;
shared_ldflag => '-shared -Wl,-Bsymbolic -set_version $(SHLIB_VERSION_NUMBER)',
};
},
'solaris-shared' => {
shared_ldflag => '-Wl,-Bsymbolic',
shared_defflag => '-Wl,-M,',
},
'svr3-shared' => sub {
return $shared_info{'gnu-shared'} if detect_gnu_ld();
return {
@@ -95,8 +91,4 @@ my %shared_info;
shared_ldflag => '-Wl,-B,symbolic,+vnocompatwarnings,-z,+s,+cdp,../:,+cdp,./:',
shared_sonameflag => '-Wl,+h,',
},
'aix-shared' => {
bin_lflags => '-Wl,-bsvr4',
shared_ldflag => '-Wl,-bexpall,-bnolibpath,-bM:SRE',
},
);
Configurations/unix-Makefile.tmpl
+5 -3
View File
@@ -760,11 +760,13 @@ generate_fuzz_oids:
# Set to -force to force a rebuild
ERROR_REBUILD=
errors:
( cd $(SRCDIR); $(PERL) util/ck_errf.pl -strict */*.c */*/*.c )
( b=`pwd`; cd $(SRCDIR); \
( b=`pwd`; set -e; cd $(SRCDIR); \
$(PERL) util/ck_errf.pl -strict -internal; \
$(PERL) -I$$b util/mkerr.pl $(ERROR_REBUILD) -internal )
( b=`pwd`; cd $(SRCDIR)/engines; \
( b=`pwd`; set -e; cd $(SRCDIR)/engines; \
for E in *.ec ; do \
$(PERL) ../util/ck_errf.pl -strict \
-conf $$E `basename $$E .ec`.c; \
$(PERL) -I$$b ../util/mkerr.pl $(ERROR_REBUILD) -static \
-conf $$E `basename $$E .ec`.c ; \
done )
Configure
+4 -1
View File
@@ -2777,7 +2777,10 @@ sub threads {
return sub { add($disabled{threads} ? () : @flags)->(); }
}
sub shared {
my @flags = @_;
return sub { add($disabled{shared} ? () : @flags)->(); }
}
our $add_called = 0;
# Helper function to implement adding values to already existing configuration
build.info
+8
View File
@@ -33,6 +33,14 @@ IF[{- defined $target{shared_defflag} -}]
SHARED_SOURCE[libcrypto]=libcrypto.def
SHARED_SOURCE[libssl]=libssl.def
ELSIF[{- $config{target} =~ /^aix/ -}]
GENERATE[libcrypto.map]=util/mkdef.pl crypto aix
DEPEND[libcrypto.map]=util/libcrypto.num
GENERATE[libssl.map]=util/mkdef.pl ssl aix
DEPEND[libssl.map]=util/libssl.num
SHARED_SOURCE[libcrypto]=libcrypto.map
SHARED_SOURCE[libssl]=libssl.map
ELSE
GENERATE[libcrypto.map]=util/mkdef.pl crypto linux
DEPEND[libcrypto.map]=util/libcrypto.num
crypto/asn1/ameth_lib.c
+16
View File
@@ -417,3 +417,19 @@ void EVP_PKEY_asn1_set_set_pub_key(EVP_PKEY_ASN1_METHOD *ameth,
{
ameth->set_pub_key = set_pub_key;
}
void EVP_PKEY_asn1_set_get_priv_key(EVP_PKEY_ASN1_METHOD *ameth,
int (*get_priv_key) (const EVP_PKEY *pk,
unsigned char *priv,
size_t *len))
{
ameth->get_priv_key = get_priv_key;
}
void EVP_PKEY_asn1_set_get_pub_key(EVP_PKEY_ASN1_METHOD *ameth,
int (*get_pub_key) (const EVP_PKEY *pk,
unsigned char *pub,
size_t *len))
{
ameth->get_pub_key = get_pub_key;
}
crypto/bn/asm/sparcv9-mont.pl
+3
View File
@@ -493,6 +493,9 @@ $code.=<<___;
mulx $npj,$mul1,$acc1
add $tpj,$car1,$car1
ld [$np+$j],$npj ! np[j]
srlx $car1,32,$tmp0
and $car1,$mask,$car1
add $tmp0,$sbit,$sbit
add $acc0,$car1,$car1
ld [$tp+8],$tpj ! tp[j]
add $acc1,$car1,$car1
crypto/chacha/asm/chacha-ppc.pl
+6 -5
View File
@@ -438,9 +438,9 @@ my ($a,$b,$c,$d)=@_;
"&vxor ('$b','$b','$c')",
"&vrlw ('$b','$b','$seven')",
"&vsldoi ('$c','$c','$c',8)",
"&vsldoi ('$b','$b','$b',$odd?4:12)",
"&vsldoi ('$d','$d','$d',$odd?12:4)"
"&vrldoi ('$c','$c',8)",
"&vrldoi ('$b','$b',$odd?4:12)",
"&vrldoi ('$d','$d',$odd?12:4)"
);
}
@@ -1334,11 +1334,12 @@ foreach (split("\n",$code)) {
s/\?lvsr/lvsl/ or
s/\?lvsl/lvsr/ or
s/\?(vperm\s+v[0-9]+,\s*)(v[0-9]+,\s*)(v[0-9]+,\s*)(v[0-9]+)/$1$3$2$4/ or
s/(vsldoi\s+v[0-9]+,\s*)(v[0-9]+,)\s*(v[0-9]+,\s*)([0-9]+)/$1$3$2 16-$4/;
s/vrldoi(\s+v[0-9]+,\s*)(v[0-9]+,)\s*([0-9]+)/vsldoi$1$2$2 16-$3/;
} else { # little-endian
s/le\?// or
s/be\?/#be#/ or
s/\?([a-z]+)/$1/;
s/\?([a-z]+)/$1/ or
s/vrldoi(\s+v[0-9]+,\s*)(v[0-9]+,)\s*([0-9]+)/vsldoi$1$2$2 $3/;
}
print $_,"\n";
crypto/dh/dh_key.c
+6 -1
View File
@@ -78,10 +78,15 @@ static int generate_key(DH *dh)
int ok = 0;
int generate_new_key = 0;
unsigned l;
BN_CTX *ctx;
BN_CTX *ctx = NULL;
BN_MONT_CTX *mont = NULL;
BIGNUM *pub_key = NULL, *priv_key = NULL;
if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS) {
DHerr(DH_F_GENERATE_KEY, DH_R_MODULUS_TOO_LARGE);
return 0;
}
ctx = BN_CTX_new();
if (ctx == NULL)
goto err;
crypto/ec/ecdsa_ossl.c
+63 -7
View File
@@ -196,7 +196,8 @@ ECDSA_SIG *ossl_ecdsa_sign_sig(const unsigned char *dgst, int dgst_len,
EC_KEY *eckey)
{
int ok = 0, i;
BIGNUM *kinv = NULL, *s, *m = NULL, *tmp = NULL;
BIGNUM *kinv = NULL, *s, *m = NULL, *tmp = NULL, *blind = NULL;
BIGNUM *blindm = NULL;
const BIGNUM *order, *ckinv;
BN_CTX *ctx = NULL;
const EC_GROUP *group;
@@ -229,8 +230,18 @@ ECDSA_SIG *ossl_ecdsa_sign_sig(const unsigned char *dgst, int dgst_len,
}
s = ret->s;
if ((ctx = BN_CTX_new()) == NULL ||
(tmp = BN_new()) == NULL || (m = BN_new()) == NULL) {
ctx = BN_CTX_secure_new();
if (ctx == NULL) {
ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_MALLOC_FAILURE);
goto err;
}
BN_CTX_start(ctx);
tmp = BN_CTX_get(ctx);
m = BN_CTX_get(ctx);
blind = BN_CTX_get(ctx);
blindm = BN_CTX_get(ctx);
if (blindm == NULL) {
ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_MALLOC_FAILURE);
goto err;
}
@@ -270,18 +281,64 @@ ECDSA_SIG *ossl_ecdsa_sign_sig(const unsigned char *dgst, int dgst_len,
}
}
if (!BN_mod_mul(tmp, priv_key, ret->r, order, ctx)) {
/*
* The normal signature calculation is:
*
* s := k^-1 * (m + r * priv_key) mod order
*
* We will blind this to protect against side channel attacks
*
* s := k^-1 * blind^-1 * (blind * m + blind * r * priv_key) mod order
*/
/* Generate a blinding value */
do {
if (!BN_priv_rand(blind, BN_num_bits(order) - 1,
BN_RAND_TOP_ANY, BN_RAND_BOTTOM_ANY))
goto err;
} while (BN_is_zero(blind));
BN_set_flags(blind, BN_FLG_CONSTTIME);
BN_set_flags(blindm, BN_FLG_CONSTTIME);
BN_set_flags(tmp, BN_FLG_CONSTTIME);
/* tmp := blind * priv_key * r mod order */
if (!BN_mod_mul(tmp, blind, priv_key, order, ctx)) {
ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
goto err;
}
if (!BN_mod_add_quick(s, tmp, m, order)) {
if (!BN_mod_mul(tmp, tmp, ret->r, order, ctx)) {
ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
goto err;
}
/* blindm := blind * m mod order */
if (!BN_mod_mul(blindm, blind, m, order, ctx)) {
ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
goto err;
}
/* s : = (blind * priv_key * r) + (blind * m) mod order */
if (!BN_mod_add_quick(s, tmp, blindm, order)) {
ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
goto err;
}
/* s:= s * blind^-1 mod order */
if (BN_mod_inverse(blind, blind, order, ctx) == NULL) {
ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
goto err;
}
if (!BN_mod_mul(s, s, blind, order, ctx)) {
ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
goto err;
}
/* s := s * k^-1 mod order */
if (!BN_mod_mul(s, s, ckinv, order, ctx)) {
ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
goto err;
}
if (BN_is_zero(s)) {
/*
* if kinv and r have been supplied by the caller, don't
@@ -303,9 +360,8 @@ ECDSA_SIG *ossl_ecdsa_sign_sig(const unsigned char *dgst, int dgst_len,
ECDSA_SIG_free(ret);
ret = NULL;
}
BN_CTX_end(ctx);
BN_CTX_free(ctx);
BN_clear_free(m);
BN_clear_free(tmp);
BN_clear_free(kinv);
return ret;
}
crypto/ec/ecx_meth.c
+49
View File
@@ -354,6 +354,47 @@ static int ecx_set_pub_key(EVP_PKEY *pkey, const unsigned char *pub, size_t len)
KEY_OP_PUBLIC);
}
static int ecx_get_priv_key(const EVP_PKEY *pkey, unsigned char *priv,
size_t *len)
{
const ECX_KEY *key = pkey->pkey.ecx;
if (priv == NULL) {
*len = KEYLENID(pkey->ameth->pkey_id);
return 1;
}
if (key == NULL
|| key->privkey == NULL
|| *len < (size_t)KEYLENID(pkey->ameth->pkey_id))
return 0;
*len = KEYLENID(pkey->ameth->pkey_id);
memcpy(priv, key->privkey, *len);
return 1;
}
static int ecx_get_pub_key(const EVP_PKEY *pkey, unsigned char *pub,
size_t *len)
{
const ECX_KEY *key = pkey->pkey.ecx;
if (pub == NULL) {
*len = KEYLENID(pkey->ameth->pkey_id);
return 1;
}
if (key == NULL
|| *len < (size_t)KEYLENID(pkey->ameth->pkey_id))
return 0;
*len = KEYLENID(pkey->ameth->pkey_id);
memcpy(pub, key->pubkey, *len);
return 1;
}
const EVP_PKEY_ASN1_METHOD ecx25519_asn1_meth = {
EVP_PKEY_X25519,
EVP_PKEY_X25519,
@@ -393,6 +434,8 @@ const EVP_PKEY_ASN1_METHOD ecx25519_asn1_meth = {
ecx_set_priv_key,
ecx_set_pub_key,
ecx_get_priv_key,
ecx_get_pub_key,
};
const EVP_PKEY_ASN1_METHOD ecx448_asn1_meth = {
@@ -434,6 +477,8 @@ const EVP_PKEY_ASN1_METHOD ecx448_asn1_meth = {
ecx_set_priv_key,
ecx_set_pub_key,
ecx_get_priv_key,
ecx_get_pub_key,
};
static int ecd_size25519(const EVP_PKEY *pkey)
@@ -547,6 +592,8 @@ const EVP_PKEY_ASN1_METHOD ed25519_asn1_meth = {
ecx_set_priv_key,
ecx_set_pub_key,
ecx_get_priv_key,
ecx_get_pub_key,
};
const EVP_PKEY_ASN1_METHOD ed448_asn1_meth = {
@@ -587,6 +634,8 @@ const EVP_PKEY_ASN1_METHOD ed448_asn1_meth = {
ecx_set_priv_key,
ecx_set_pub_key,
ecx_get_priv_key,
ecx_get_pub_key,
};
static int pkey_ecx_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
crypto/err/openssl.txt
+3
View File
@@ -757,6 +757,8 @@ EVP_F_EVP_PKEY_GET0_HMAC:183:EVP_PKEY_get0_hmac
EVP_F_EVP_PKEY_GET0_POLY1305:184:EVP_PKEY_get0_poly1305
EVP_F_EVP_PKEY_GET0_RSA:121:EVP_PKEY_get0_RSA
EVP_F_EVP_PKEY_GET0_SIPHASH:172:EVP_PKEY_get0_siphash
EVP_F_EVP_PKEY_GET_RAW_PRIVATE_KEY:202:EVP_PKEY_get_raw_private_key
EVP_F_EVP_PKEY_GET_RAW_PUBLIC_KEY:203:EVP_PKEY_get_raw_public_key
EVP_F_EVP_PKEY_KEYGEN:146:EVP_PKEY_keygen
EVP_F_EVP_PKEY_KEYGEN_INIT:147:EVP_PKEY_keygen_init
EVP_F_EVP_PKEY_METH_ADD0:194:EVP_PKEY_meth_add0
@@ -2199,6 +2201,7 @@ EVP_R_EXPECTING_A_EC_KEY:142:expecting a ec key
EVP_R_EXPECTING_A_POLY1305_KEY:164:expecting a poly1305 key
EVP_R_EXPECTING_A_SIPHASH_KEY:175:expecting a siphash key
EVP_R_FIPS_MODE_NOT_SUPPORTED:167:fips mode not supported
EVP_R_GET_RAW_KEY_FAILED:182:get raw key failed
EVP_R_ILLEGAL_SCRYPT_PARAMETERS:171:illegal scrypt parameters
EVP_R_INITIALIZATION_ERROR:134:initialization error
EVP_R_INPUT_NOT_INITIALIZED:111:input not initialized
crypto/evp/evp_err.c
+5
View File
@@ -93,6 +93,10 @@ static const ERR_STRING_DATA EVP_str_functs[] = {
{ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_PKEY_GET0_RSA, 0), "EVP_PKEY_get0_RSA"},
{ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_PKEY_GET0_SIPHASH, 0),
"EVP_PKEY_get0_siphash"},
{ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_PKEY_GET_RAW_PRIVATE_KEY, 0),
"EVP_PKEY_get_raw_private_key"},
{ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_PKEY_GET_RAW_PUBLIC_KEY, 0),
"EVP_PKEY_get_raw_public_key"},
{ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_PKEY_KEYGEN, 0), "EVP_PKEY_keygen"},
{ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_PKEY_KEYGEN_INIT, 0),
"EVP_PKEY_keygen_init"},
@@ -185,6 +189,7 @@ static const ERR_STRING_DATA EVP_str_reasons[] = {
"expecting a siphash key"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_FIPS_MODE_NOT_SUPPORTED),
"fips mode not supported"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_GET_RAW_KEY_FAILED), "get raw key failed"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_ILLEGAL_SCRYPT_PARAMETERS),
"illegal scrypt parameters"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_INITIALIZATION_ERROR),
crypto/evp/p_lib.c
+34
View File
@@ -280,6 +280,40 @@ EVP_PKEY *EVP_PKEY_new_raw_public_key(int type, ENGINE *e,
return NULL;
}
int EVP_PKEY_get_raw_private_key(const EVP_PKEY *pkey, unsigned char *priv,
size_t *len)
{
if (pkey->ameth->get_priv_key == NULL) {
EVPerr(EVP_F_EVP_PKEY_GET_RAW_PRIVATE_KEY,
EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
return 0;
}
if (!pkey->ameth->get_priv_key(pkey, priv, len)) {
EVPerr(EVP_F_EVP_PKEY_GET_RAW_PRIVATE_KEY, EVP_R_GET_RAW_KEY_FAILED);
return 0;
}
return 1;
}
int EVP_PKEY_get_raw_public_key(const EVP_PKEY *pkey, unsigned char *pub,
size_t *len)
{
if (pkey->ameth->get_pub_key == NULL) {
EVPerr(EVP_F_EVP_PKEY_GET_RAW_PUBLIC_KEY,
EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
return 0;
}
if (!pkey->ameth->get_pub_key(pkey, pub, len)) {
EVPerr(EVP_F_EVP_PKEY_GET_RAW_PUBLIC_KEY, EVP_R_GET_RAW_KEY_FAILED);
return 0;
}
return 1;
}
EVP_PKEY *EVP_PKEY_new_CMAC_key(ENGINE *e, const unsigned char *priv,
size_t len, const EVP_CIPHER *cipher)
{
crypto/hmac/hm_ameth.c
+21
View File
@@ -72,6 +72,25 @@ static int hmac_set_priv_key(EVP_PKEY *pkey, const unsigned char *priv,
return 1;
}
static int hmac_get_priv_key(const EVP_PKEY *pkey, unsigned char *priv,
size_t *len)
{
ASN1_OCTET_STRING *os = (ASN1_OCTET_STRING *)pkey->pkey.ptr;
if (priv == NULL) {
*len = ASN1_STRING_length(os);
return 1;
}
if (os == NULL || *len < (size_t)ASN1_STRING_length(os))
return 0;
*len = ASN1_STRING_length(os);
memcpy(priv, ASN1_STRING_get0_data(os), *len);
return 1;
}
const EVP_PKEY_ASN1_METHOD hmac_asn1_meth = {
EVP_PKEY_HMAC,
EVP_PKEY_HMAC,
@@ -103,4 +122,6 @@ const EVP_PKEY_ASN1_METHOD hmac_asn1_meth = {
hmac_set_priv_key,
NULL,
hmac_get_priv_key,
NULL,
};
crypto/include/internal/asn1_int.h
+2
View File
@@ -61,6 +61,8 @@ struct evp_pkey_asn1_method_st {
/* Get/set raw private/public key data */
int (*set_priv_key) (EVP_PKEY *pk, const unsigned char *priv, size_t len);
int (*set_pub_key) (EVP_PKEY *pk, const unsigned char *pub, size_t len);
int (*get_priv_key) (const EVP_PKEY *pk, unsigned char *priv, size_t *len);
int (*get_pub_key) (const EVP_PKEY *pk, unsigned char *pub, size_t *len);
} /* EVP_PKEY_ASN1_METHOD */ ;
DEFINE_STACK_OF_CONST(EVP_PKEY_ASN1_METHOD)
crypto/modes/modes_lcl.h
+8 -7
View File
@@ -178,12 +178,13 @@ struct ocb128_context {
OCB_BLOCK l_dollar;
OCB_BLOCK *l;
/* Must be reset for each session */
u64 blocks_hashed;
u64 blocks_processed;
OCB_BLOCK tag;
OCB_BLOCK offset_aad;
OCB_BLOCK sum;
OCB_BLOCK offset;
OCB_BLOCK checksum;
struct {
u64 blocks_hashed;
u64 blocks_processed;
OCB_BLOCK offset_aad;
OCB_BLOCK sum;
OCB_BLOCK offset;
OCB_BLOCK checksum;
} sess;
};
#endif /* OPENSSL_NO_OCB */
crypto/modes/ocb128.c
+66 -65
View File
@@ -239,6 +239,9 @@ int CRYPTO_ocb128_setiv(OCB128_CONTEXT *ctx, const unsigned char *iv,
return -1;
}
/* Reset nonce-dependent variables */
memset(&ctx->sess, 0, sizeof(ctx->sess));
/* Nonce = num2str(TAGLEN mod 128,7) || zeros(120-bitlen(N)) || 1 || N */
nonce[0] = ((taglen * 8) % 128) << 1;
memset(nonce + 1, 0, 15);
@@ -259,10 +262,10 @@ int CRYPTO_ocb128_setiv(OCB128_CONTEXT *ctx, const unsigned char *iv,
/* Offset_0 = Stretch[1+bottom..128+bottom] */
shift = bottom % 8;
ocb_block_lshift(stretch + (bottom / 8), shift, ctx->offset.c);
ocb_block_lshift(stretch + (bottom / 8), shift, ctx->sess.offset.c);
mask = 0xff;
mask <<= 8 - shift;
ctx->offset.c[15] |=
ctx->sess.offset.c[15] |=
(*(stretch + (bottom / 8) + 16) & mask) >> (8 - shift);
return 1;
@@ -281,25 +284,25 @@ int CRYPTO_ocb128_aad(OCB128_CONTEXT *ctx, const unsigned char *aad,
/* Calculate the number of blocks of AAD provided now, and so far */
num_blocks = len / 16;
all_num_blocks = num_blocks + ctx->blocks_hashed;
all_num_blocks = num_blocks + ctx->sess.blocks_hashed;
/* Loop through all full blocks of AAD */
for (i = ctx->blocks_hashed + 1; i <= all_num_blocks; i++) {
for (i = ctx->sess.blocks_hashed + 1; i <= all_num_blocks; i++) {
OCB_BLOCK *lookup;
/* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
lookup = ocb_lookup_l(ctx, ocb_ntz(i));
if (lookup == NULL)
return 0;
ocb_block16_xor(&ctx->offset_aad, lookup, &ctx->offset_aad);
ocb_block16_xor(&ctx->sess.offset_aad, lookup, &ctx->sess.offset_aad);
memcpy(tmp.c, aad, 16);
aad += 16;
/* Sum_i = Sum_{i-1} xor ENCIPHER(K, A_i xor Offset_i) */
ocb_block16_xor(&ctx->offset_aad, &tmp, &tmp);
ocb_block16_xor(&ctx->sess.offset_aad, &tmp, &tmp);
ctx->encrypt(tmp.c, tmp.c, ctx->keyenc);
ocb_block16_xor(&tmp, &ctx->sum, &ctx->sum);
ocb_block16_xor(&tmp, &ctx->sess.sum, &ctx->sess.sum);
}
/*
@@ -310,20 +313,21 @@ int CRYPTO_ocb128_aad(OCB128_CONTEXT *ctx, const unsigned char *aad,
if (last_len > 0) {
/* Offset_* = Offset_m xor L_* */
ocb_block16_xor(&ctx->offset_aad, &ctx->l_star, &ctx->offset_aad);
ocb_block16_xor(&ctx->sess.offset_aad, &ctx->l_star,
&ctx->sess.offset_aad);
/* CipherInput = (A_* || 1 || zeros(127-bitlen(A_*))) xor Offset_* */
memset(tmp.c, 0, 16);
memcpy(tmp.c, aad, last_len);
tmp.c[last_len] = 0x80;
ocb_block16_xor(&ctx->offset_aad, &tmp, &tmp);
ocb_block16_xor(&ctx->sess.offset_aad, &tmp, &tmp);
/* Sum = Sum_m xor ENCIPHER(K, CipherInput) */
ctx->encrypt(tmp.c, tmp.c, ctx->keyenc);
ocb_block16_xor(&tmp, &ctx->sum, &ctx->sum);
ocb_block16_xor(&tmp, &ctx->sess.sum, &ctx->sess.sum);
}
ctx->blocks_hashed = all_num_blocks;
ctx->sess.blocks_hashed = all_num_blocks;
return 1;
}
@@ -344,7 +348,7 @@ int CRYPTO_ocb128_encrypt(OCB128_CONTEXT *ctx,
* so far
*/
num_blocks = len / 16;
all_num_blocks = num_blocks + ctx->blocks_processed;
all_num_blocks = num_blocks + ctx->sess.blocks_processed;
if (num_blocks && all_num_blocks == (size_t)all_num_blocks
&& ctx->stream != NULL) {
@@ -360,11 +364,11 @@ int CRYPTO_ocb128_encrypt(OCB128_CONTEXT *ctx,
return 0;
ctx->stream(in, out, num_blocks, ctx->keyenc,
(size_t)ctx->blocks_processed + 1, ctx->offset.c,
(const unsigned char (*)[16])ctx->l, ctx->checksum.c);
(size_t)ctx->sess.blocks_processed + 1, ctx->sess.offset.c,
(const unsigned char (*)[16])ctx->l, ctx->sess.checksum.c);
} else {
/* Loop through all full blocks to be encrypted */
for (i = ctx->blocks_processed + 1; i <= all_num_blocks; i++) {
for (i = ctx->sess.blocks_processed + 1; i <= all_num_blocks; i++) {
OCB_BLOCK *lookup;
OCB_BLOCK tmp;
@@ -372,18 +376,18 @@ int CRYPTO_ocb128_encrypt(OCB128_CONTEXT *ctx,
lookup = ocb_lookup_l(ctx, ocb_ntz(i));
if (lookup == NULL)
return 0;
ocb_block16_xor(&ctx->offset, lookup, &ctx->offset);
ocb_block16_xor(&ctx->sess.offset, lookup, &ctx->sess.offset);
memcpy(tmp.c, in, 16);
in += 16;
/* Checksum_i = Checksum_{i-1} xor P_i */
ocb_block16_xor(&tmp, &ctx->checksum, &ctx->checksum);
ocb_block16_xor(&tmp, &ctx->sess.checksum, &ctx->sess.checksum);
/* C_i = Offset_i xor ENCIPHER(K, P_i xor Offset_i) */
ocb_block16_xor(&ctx->offset, &tmp, &tmp);
ocb_block16_xor(&ctx->sess.offset, &tmp, &tmp);
ctx->encrypt(tmp.c, tmp.c, ctx->keyenc);
ocb_block16_xor(&ctx->offset, &tmp, &tmp);
ocb_block16_xor(&ctx->sess.offset, &tmp, &tmp);
memcpy(out, tmp.c, 16);
out += 16;
@@ -400,10 +404,10 @@ int CRYPTO_ocb128_encrypt(OCB128_CONTEXT *ctx,
OCB_BLOCK pad;
/* Offset_* = Offset_m xor L_* */
ocb_block16_xor(&ctx->offset, &ctx->l_star, &ctx->offset);
ocb_block16_xor(&ctx->sess.offset, &ctx->l_star, &ctx->sess.offset);
/* Pad = ENCIPHER(K, Offset_*) */
ctx->encrypt(ctx->offset.c, pad.c, ctx->keyenc);
ctx->encrypt(ctx->sess.offset.c, pad.c, ctx->keyenc);
/* C_* = P_* xor Pad[1..bitlen(P_*)] */
ocb_block_xor(in, pad.c, last_len, out);
@@ -412,10 +416,10 @@ int CRYPTO_ocb128_encrypt(OCB128_CONTEXT *ctx,
memset(pad.c, 0, 16); /* borrow pad */
memcpy(pad.c, in, last_len);
pad.c[last_len] = 0x80;
ocb_block16_xor(&pad, &ctx->checksum, &ctx->checksum);
ocb_block16_xor(&pad, &ctx->sess.checksum, &ctx->sess.checksum);
}
ctx->blocks_processed = all_num_blocks;
ctx->sess.blocks_processed = all_num_blocks;
return 1;
}
@@ -436,7 +440,7 @@ int CRYPTO_ocb128_decrypt(OCB128_CONTEXT *ctx,
* so far
*/
num_blocks = len / 16;
all_num_blocks = num_blocks + ctx->blocks_processed;
all_num_blocks = num_blocks + ctx->sess.blocks_processed;
if (num_blocks && all_num_blocks == (size_t)all_num_blocks
&& ctx->stream != NULL) {
@@ -452,30 +456,30 @@ int CRYPTO_ocb128_decrypt(OCB128_CONTEXT *ctx,
return 0;
ctx->stream(in, out, num_blocks, ctx->keydec,
(size_t)ctx->blocks_processed + 1, ctx->offset.c,
(const unsigned char (*)[16])ctx->l, ctx->checksum.c);
(size_t)ctx->sess.blocks_processed + 1, ctx->sess.offset.c,
(const unsigned char (*)[16])ctx->l, ctx->sess.checksum.c);
} else {
OCB_BLOCK tmp;
/* Loop through all full blocks to be decrypted */
for (i = ctx->blocks_processed + 1; i <= all_num_blocks; i++) {
for (i = ctx->sess.blocks_processed + 1; i <= all_num_blocks; i++) {
/* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
OCB_BLOCK *lookup = ocb_lookup_l(ctx, ocb_ntz(i));
if (lookup == NULL)
return 0;
ocb_block16_xor(&ctx->offset, lookup, &ctx->offset);
ocb_block16_xor(&ctx->sess.offset, lookup, &ctx->sess.offset);
memcpy(tmp.c, in, 16);
in += 16;
/* P_i = Offset_i xor DECIPHER(K, C_i xor Offset_i) */
ocb_block16_xor(&ctx->offset, &tmp, &tmp);
ocb_block16_xor(&ctx->sess.offset, &tmp, &tmp);
ctx->decrypt(tmp.c, tmp.c, ctx->keydec);
ocb_block16_xor(&ctx->offset, &tmp, &tmp);
ocb_block16_xor(&ctx->sess.offset, &tmp, &tmp);
/* Checksum_i = Checksum_{i-1} xor P_i */
ocb_block16_xor(&tmp, &ctx->checksum, &ctx->checksum);
ocb_block16_xor(&tmp, &ctx->sess.checksum, &ctx->sess.checksum);
memcpy(out, tmp.c, 16);
out += 16;
@@ -492,10 +496,10 @@ int CRYPTO_ocb128_decrypt(OCB128_CONTEXT *ctx,
OCB_BLOCK pad;
/* Offset_* = Offset_m xor L_* */
ocb_block16_xor(&ctx->offset, &ctx->l_star, &ctx->offset);
ocb_block16_xor(&ctx->sess.offset, &ctx->l_star, &ctx->sess.offset);
/* Pad = ENCIPHER(K, Offset_*) */
ctx->encrypt(ctx->offset.c, pad.c, ctx->keyenc);
ctx->encrypt(ctx->sess.offset.c, pad.c, ctx->keyenc);
/* P_* = C_* xor Pad[1..bitlen(C_*)] */
ocb_block_xor(in, pad.c, last_len, out);
@@ -504,39 +508,46 @@ int CRYPTO_ocb128_decrypt(OCB128_CONTEXT *ctx,
memset(pad.c, 0, 16); /* borrow pad */
memcpy(pad.c, out, last_len);
pad.c[last_len] = 0x80;
ocb_block16_xor(&pad, &ctx->checksum, &ctx->checksum);
ocb_block16_xor(&pad, &ctx->sess.checksum, &ctx->sess.checksum);
}
ctx->blocks_processed = all_num_blocks;
ctx->sess.blocks_processed = all_num_blocks;
return 1;
}
static int ocb_finish(OCB128_CONTEXT *ctx, unsigned char *tag, size_t len,
int write)
{
OCB_BLOCK tmp;
if (len > 16 || len < 1) {
return -1;
}
/*
* Tag = ENCIPHER(K, Checksum_* xor Offset_* xor L_$) xor HASH(K,A)
*/
ocb_block16_xor(&ctx->sess.checksum, &ctx->sess.offset, &tmp);
ocb_block16_xor(&ctx->l_dollar, &tmp, &tmp);
ctx->encrypt(tmp.c, tmp.c, ctx->keyenc);
ocb_block16_xor(&tmp, &ctx->sess.sum, &tmp);
if (write) {
memcpy(tag, &tmp, len);
return 1;
} else {
return CRYPTO_memcmp(&tmp, tag, len);
}
}
/*
* Calculate the tag and verify it against the supplied tag
*/
int CRYPTO_ocb128_finish(OCB128_CONTEXT *ctx, const unsigned char *tag,
size_t len)
{
OCB_BLOCK tmp;
/*
* Tag = ENCIPHER(K, Checksum_* xor Offset_* xor L_$) xor HASH(K,A)
*/
ocb_block16_xor(&ctx->checksum, &ctx->offset, &tmp);
ocb_block16_xor(&ctx->l_dollar, &tmp, &tmp);
ctx->encrypt(tmp.c, tmp.c, ctx->keyenc);
ocb_block16_xor(&tmp, &ctx->sum, &ctx->tag);
if (len > 16 || len < 1) {
return -1;
}
/* Compare the tag if we've been given one */
if (tag)
return CRYPTO_memcmp(&ctx->tag, tag, len);
else
return -1;
return ocb_finish(ctx, (unsigned char*)tag, len, 0);
}
/*
@@ -544,17 +555,7 @@ int CRYPTO_ocb128_finish(OCB128_CONTEXT *ctx, const unsigned char *tag,
*/
int CRYPTO_ocb128_tag(OCB128_CONTEXT *ctx, unsigned char *tag, size_t len)
{
if (len > 16 || len < 1) {
return -1;
}
/* Calculate the tag */
CRYPTO_ocb128_finish(ctx, NULL, 0);
/* Copy the tag into the supplied buffer */
memcpy(tag, ctx->tag.c, len);
return 1;
return ocb_finish(ctx, tag, len, 1);
}
/*
crypto/objects/obj_dat.h
+93 -5
View File
@@ -10,7 +10,7 @@
*/
/* Serialized OID's */
static const unsigned char so[7626] = {
static const unsigned char so[7746] = {
0x2A,0x86,0x48,0x86,0xF7,0x0D, /* [ 0] OBJ_rsadsi */
0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01, /* [ 6] OBJ_pkcs */
0x2A,0x86,0x48,0x86,0xF7,0x0D,0x02,0x02, /* [ 13] OBJ_md2 */
@@ -1060,9 +1060,23 @@ static const unsigned char so[7626] = {
0x2B,0x6F, /* [ 7610] OBJ_ieee */
0x2B,0x6F,0x02,0x8C,0x53, /* [ 7612] OBJ_ieee_siswg */
0x2A,0x81,0x1C,0xCF,0x55,0x01,0x82,0x2D, /* [ 7617] OBJ_sm2 */
0x2A,0x85,0x03,0x07,0x01,0x01,0x05,0x01, /* [ 7625] OBJ_id_tc26_cipher_gostr3412_2015_magma */
0x2A,0x85,0x03,0x07,0x01,0x01,0x05,0x01,0x01, /* [ 7633] OBJ_id_tc26_cipher_gostr3412_2015_magma_ctracpkm */
0x2A,0x85,0x03,0x07,0x01,0x01,0x05,0x01,0x02, /* [ 7642] OBJ_id_tc26_cipher_gostr3412_2015_magma_ctracpkm_omac */
0x2A,0x85,0x03,0x07,0x01,0x01,0x05,0x02, /* [ 7651] OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik */
0x2A,0x85,0x03,0x07,0x01,0x01,0x05,0x02,0x01, /* [ 7659] OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm */
0x2A,0x85,0x03,0x07,0x01,0x01,0x05,0x02,0x02, /* [ 7668] OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac */
0x2A,0x85,0x03,0x07,0x01,0x01,0x07, /* [ 7677] OBJ_id_tc26_wrap */
0x2A,0x85,0x03,0x07,0x01,0x01,0x07,0x01, /* [ 7684] OBJ_id_tc26_wrap_gostr3412_2015_magma */
0x2A,0x85,0x03,0x07,0x01,0x01,0x07,0x01,0x01, /* [ 7692] OBJ_id_tc26_wrap_gostr3412_2015_magma_kexp15 */
0x2A,0x85,0x03,0x07,0x01,0x01,0x07,0x02, /* [ 7701] OBJ_id_tc26_wrap_gostr3412_2015_kuznyechik */
0x2A,0x85,0x03,0x07,0x01,0x01,0x07,0x01,0x01, /* [ 7709] OBJ_id_tc26_wrap_gostr3412_2015_kuznyechik_kexp15 */
0x2A,0x85,0x03,0x07,0x01,0x02,0x01,0x01,0x02, /* [ 7718] OBJ_id_tc26_gost_3410_2012_256_paramSetB */
0x2A,0x85,0x03,0x07,0x01,0x02,0x01,0x01,0x03, /* [ 7727] OBJ_id_tc26_gost_3410_2012_256_paramSetC */
0x2A,0x85,0x03,0x07,0x01,0x02,0x01,0x01,0x04, /* [ 7736] OBJ_id_tc26_gost_3410_2012_256_paramSetD */
};
#define NUM_NID 1173
#define NUM_NID 1193
static const ASN1_OBJECT nid_objs[NUM_NID] = {
{"UNDEF", "undefined", NID_undef},
{"rsadsi", "RSA Data Security, Inc.", NID_rsadsi, 6, &so[0]},
@@ -2237,9 +2251,29 @@ static const ASN1_OBJECT nid_objs[NUM_NID] = {
{"ieee", "ieee", NID_ieee, 2, &so[7610]},
{"ieee-siswg", "IEEE Security in Storage Working Group", NID_ieee_siswg, 5, &so[7612]},
{"SM2", "sm2", NID_sm2, 8, &so[7617]},
{"id-tc26-cipher-gostr3412-2015-magma", "id-tc26-cipher-gostr3412-2015-magma", NID_id_tc26_cipher_gostr3412_2015_magma, 8, &so[7625]},
{"id-tc26-cipher-gostr3412-2015-magma-ctracpkm", "id-tc26-cipher-gostr3412-2015-magma-ctracpkm", NID_id_tc26_cipher_gostr3412_2015_magma_ctracpkm, 9, &so[7633]},
{"id-tc26-cipher-gostr3412-2015-magma-ctracpkm-omac", "id-tc26-cipher-gostr3412-2015-magma-ctracpkm-omac", NID_id_tc26_cipher_gostr3412_2015_magma_ctracpkm_omac, 9, &so[7642]},
{"id-tc26-cipher-gostr3412-2015-kuznyechik", "id-tc26-cipher-gostr3412-2015-kuznyechik", NID_id_tc26_cipher_gostr3412_2015_kuznyechik, 8, &so[7651]},
{"id-tc26-cipher-gostr3412-2015-kuznyechik-ctracpkm", "id-tc26-cipher-gostr3412-2015-kuznyechik-ctracpkm", NID_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm, 9, &so[7659]},
{"id-tc26-cipher-gostr3412-2015-kuznyechik-ctracpkm-omac", "id-tc26-cipher-gostr3412-2015-kuznyechik-ctracpkm-omac", NID_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac, 9, &so[7668]},
{"id-tc26-wrap", "id-tc26-wrap", NID_id_tc26_wrap, 7, &so[7677]},
{"id-tc26-wrap-gostr3412-2015-magma", "id-tc26-wrap-gostr3412-2015-magma", NID_id_tc26_wrap_gostr3412_2015_magma, 8, &so[7684]},
{"id-tc26-wrap-gostr3412-2015-magma-kexp15", "id-tc26-wrap-gostr3412-2015-magma-kexp15", NID_id_tc26_wrap_gostr3412_2015_magma_kexp15, 9, &so[7692]},
{"id-tc26-wrap-gostr3412-2015-kuznyechik", "id-tc26-wrap-gostr3412-2015-kuznyechik", NID_id_tc26_wrap_gostr3412_2015_kuznyechik, 8, &so[7701]},
{"id-tc26-wrap-gostr3412-2015-kuznyechik-kexp15", "id-tc26-wrap-gostr3412-2015-kuznyechik-kexp15", NID_id_tc26_wrap_gostr3412_2015_kuznyechik_kexp15, 9, &so[7709]},
{"id-tc26-gost-3410-2012-256-paramSetB", "GOST R 34.10-2012 (256 bit) ParamSet B", NID_id_tc26_gost_3410_2012_256_paramSetB, 9, &so[7718]},
{"id-tc26-gost-3410-2012-256-paramSetC", "GOST R 34.10-2012 (256 bit) ParamSet C", NID_id_tc26_gost_3410_2012_256_paramSetC, 9, &so[7727]},
{"id-tc26-gost-3410-2012-256-paramSetD", "GOST R 34.10-2012 (256 bit) ParamSet D", NID_id_tc26_gost_3410_2012_256_paramSetD, 9, &so[7736]},
{"magma-ecb", "magma-ecb", NID_magma_ecb},
{"magma-ctr", "magma-ctr", NID_magma_ctr},
{"magma-ofb", "magma-ofb", NID_magma_ofb},
{"magma-cbc", "magma-cbc", NID_magma_cbc},
{"magma-cfb", "magma-cfb", NID_magma_cfb},
{"magma-mac", "magma-mac", NID_magma_mac},
};
#define NUM_SN 1164
#define NUM_SN 1184
static const unsigned int sn_objs[NUM_SN] = {
364, /* "AD_DVCS" */
419, /* "AES-128-CBC" */
@@ -2999,6 +3033,12 @@ static const unsigned int sn_objs[NUM_SN] = {
977, /* "id-tc26-algorithms" */
990, /* "id-tc26-cipher" */
1001, /* "id-tc26-cipher-constants" */
1176, /* "id-tc26-cipher-gostr3412-2015-kuznyechik" */
1177, /* "id-tc26-cipher-gostr3412-2015-kuznyechik-ctracpkm" */
1178, /* "id-tc26-cipher-gostr3412-2015-kuznyechik-ctracpkm-omac" */
1173, /* "id-tc26-cipher-gostr3412-2015-magma" */
1174, /* "id-tc26-cipher-gostr3412-2015-magma-ctracpkm" */
1175, /* "id-tc26-cipher-gostr3412-2015-magma-ctracpkm-omac" */
994, /* "id-tc26-constants" */
981, /* "id-tc26-digest" */
1000, /* "id-tc26-digest-constants" */
@@ -3006,6 +3046,9 @@ static const unsigned int sn_objs[NUM_SN] = {
1003, /* "id-tc26-gost-28147-param-Z" */
1147, /* "id-tc26-gost-3410-2012-256-constants" */
1148, /* "id-tc26-gost-3410-2012-256-paramSetA" */
1184, /* "id-tc26-gost-3410-2012-256-paramSetB" */
1185, /* "id-tc26-gost-3410-2012-256-paramSetC" */
1186, /* "id-tc26-gost-3410-2012-256-paramSetD" */
996, /* "id-tc26-gost-3410-2012-512-constants" */
998, /* "id-tc26-gost-3410-2012-512-paramSetA" */
999, /* "id-tc26-gost-3410-2012-512-paramSetB" */
@@ -3019,6 +3062,11 @@ static const unsigned int sn_objs[NUM_SN] = {
984, /* "id-tc26-signwithdigest" */
985, /* "id-tc26-signwithdigest-gost3410-2012-256" */
986, /* "id-tc26-signwithdigest-gost3410-2012-512" */
1179, /* "id-tc26-wrap" */
1182, /* "id-tc26-wrap-gostr3412-2015-kuznyechik" */
1183, /* "id-tc26-wrap-gostr3412-2015-kuznyechik-kexp15" */
1180, /* "id-tc26-wrap-gostr3412-2015-magma" */
1181, /* "id-tc26-wrap-gostr3412-2015-magma-kexp15" */
676, /* "identified-organization" */
1170, /* "ieee" */
1171, /* "ieee-siswg" */
@@ -3045,6 +3093,12 @@ static const unsigned int sn_objs[NUM_SN] = {
476, /* "lastModifiedTime" */
157, /* "localKeyID" */
480, /* "mXRecord" */
1190, /* "magma-cbc" */
1191, /* "magma-cfb" */
1188, /* "magma-ctr" */
1187, /* "magma-ecb" */
1192, /* "magma-mac" */
1189, /* "magma-ofb" */
460, /* "mail" */
493, /* "mailPreferenceOption" */
467, /* "manager" */
@@ -3407,7 +3461,7 @@ static const unsigned int sn_objs[NUM_SN] = {
1093, /* "x509ExtAdmission" */
};
#define NUM_LN 1164
#define NUM_LN 1184
static const unsigned int ln_objs[NUM_LN] = {
363, /* "AD Time Stamping" */
405, /* "ANSI X9.62" */
@@ -3464,6 +3518,9 @@ static const unsigned int ln_objs[NUM_LN] = {
811, /* "GOST R 34.10-2001" */
817, /* "GOST R 34.10-2001 DH" */
1148, /* "GOST R 34.10-2012 (256 bit) ParamSet A" */
1184, /* "GOST R 34.10-2012 (256 bit) ParamSet B" */
1185, /* "GOST R 34.10-2012 (256 bit) ParamSet C" */
1186, /* "GOST R 34.10-2012 (256 bit) ParamSet D" */
998, /* "GOST R 34.10-2012 (512 bit) ParamSet A" */
999, /* "GOST R 34.10-2012 (512 bit) ParamSet B" */
1149, /* "GOST R 34.10-2012 (512 bit) ParamSet C" */
@@ -4154,6 +4211,12 @@ static const unsigned int ln_objs[NUM_LN] = {
977, /* "id-tc26-algorithms" */
990, /* "id-tc26-cipher" */
1001, /* "id-tc26-cipher-constants" */
1176, /* "id-tc26-cipher-gostr3412-2015-kuznyechik" */
1177, /* "id-tc26-cipher-gostr3412-2015-kuznyechik-ctracpkm" */
1178, /* "id-tc26-cipher-gostr3412-2015-kuznyechik-ctracpkm-omac" */
1173, /* "id-tc26-cipher-gostr3412-2015-magma" */
1174, /* "id-tc26-cipher-gostr3412-2015-magma-ctracpkm" */
1175, /* "id-tc26-cipher-gostr3412-2015-magma-ctracpkm-omac" */
994, /* "id-tc26-constants" */
981, /* "id-tc26-digest" */
1000, /* "id-tc26-digest-constants" */
@@ -4164,6 +4227,11 @@ static const unsigned int ln_objs[NUM_LN] = {
978, /* "id-tc26-sign" */
995, /* "id-tc26-sign-constants" */
984, /* "id-tc26-signwithdigest" */
1179, /* "id-tc26-wrap" */
1182, /* "id-tc26-wrap-gostr3412-2015-kuznyechik" */
1183, /* "id-tc26-wrap-gostr3412-2015-kuznyechik-kexp15" */
1180, /* "id-tc26-wrap-gostr3412-2015-magma" */
1181, /* "id-tc26-wrap-gostr3412-2015-magma-kexp15" */
34, /* "idea-cbc" */
35, /* "idea-cfb" */
36, /* "idea-ecb" */
@@ -4201,6 +4269,12 @@ static const unsigned int ln_objs[NUM_LN] = {
157, /* "localKeyID" */
15, /* "localityName" */
480, /* "mXRecord" */
1190, /* "magma-cbc" */
1191, /* "magma-cfb" */
1188, /* "magma-ctr" */
1187, /* "magma-ecb" */
1192, /* "magma-mac" */
1189, /* "magma-ofb" */
493, /* "mailPreferenceOption" */
467, /* "manager" */
3, /* "md2" */
@@ -4575,7 +4649,7 @@ static const unsigned int ln_objs[NUM_LN] = {
125, /* "zlib compression" */
};
#define NUM_OBJ 1055
#define NUM_OBJ 1069
static const unsigned int obj_objs[NUM_OBJ] = {
0, /* OBJ_undef 0 */
181, /* OBJ_iso 1 */
@@ -4975,6 +5049,7 @@ static const unsigned int obj_objs[NUM_OBJ] = {
987, /* OBJ_id_tc26_mac 1 2 643 7 1 1 4 */
990, /* OBJ_id_tc26_cipher 1 2 643 7 1 1 5 */
991, /* OBJ_id_tc26_agreement 1 2 643 7 1 1 6 */
1179, /* OBJ_id_tc26_wrap 1 2 643 7 1 1 7 */
995, /* OBJ_id_tc26_sign_constants 1 2 643 7 1 2 1 */
1000, /* OBJ_id_tc26_digest_constants 1 2 643 7 1 2 2 */
1001, /* OBJ_id_tc26_cipher_constants 1 2 643 7 1 2 5 */
@@ -5063,8 +5138,12 @@ static const unsigned int obj_objs[NUM_OBJ] = {
986, /* OBJ_id_tc26_signwithdigest_gost3410_2012_512 1 2 643 7 1 1 3 3 */
988, /* OBJ_id_tc26_hmac_gost_3411_2012_256 1 2 643 7 1 1 4 1 */
989, /* OBJ_id_tc26_hmac_gost_3411_2012_512 1 2 643 7 1 1 4 2 */
1173, /* OBJ_id_tc26_cipher_gostr3412_2015_magma 1 2 643 7 1 1 5 1 */
1176, /* OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik 1 2 643 7 1 1 5 2 */
992, /* OBJ_id_tc26_agreement_gost_3410_2012_256 1 2 643 7 1 1 6 1 */
993, /* OBJ_id_tc26_agreement_gost_3410_2012_512 1 2 643 7 1 1 6 2 */
1180, /* OBJ_id_tc26_wrap_gostr3412_2015_magma 1 2 643 7 1 1 7 1 */
1182, /* OBJ_id_tc26_wrap_gostr3412_2015_kuznyechik 1 2 643 7 1 1 7 2 */
1147, /* OBJ_id_tc26_gost_3410_2012_256_constants 1 2 643 7 1 2 1 1 */
996, /* OBJ_id_tc26_gost_3410_2012_512_constants 1 2 643 7 1 2 1 2 */
1002, /* OBJ_id_tc26_gost_28147_constants 1 2 643 7 1 2 5 1 */
@@ -5270,7 +5349,16 @@ static const unsigned int obj_objs[NUM_OBJ] = {
1120, /* OBJ_aria_128_ccm 1 2 410 200046 1 1 37 */
1121, /* OBJ_aria_192_ccm 1 2 410 200046 1 1 38 */
1122, /* OBJ_aria_256_ccm 1 2 410 200046 1 1 39 */
1174, /* OBJ_id_tc26_cipher_gostr3412_2015_magma_ctracpkm 1 2 643 7 1 1 5 1 1 */
1175, /* OBJ_id_tc26_cipher_gostr3412_2015_magma_ctracpkm_omac 1 2 643 7 1 1 5 1 2 */
1177, /* OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm 1 2 643 7 1 1 5 2 1 */
1178, /* OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac 1 2 643 7 1 1 5 2 2 */
1181, /* OBJ_id_tc26_wrap_gostr3412_2015_magma_kexp15 1 2 643 7 1 1 7 1 1 */
1183, /* OBJ_id_tc26_wrap_gostr3412_2015_kuznyechik_kexp15 1 2 643 7 1 1 7 1 1 */
1148, /* OBJ_id_tc26_gost_3410_2012_256_paramSetA 1 2 643 7 1 2 1 1 1 */
1184, /* OBJ_id_tc26_gost_3410_2012_256_paramSetB 1 2 643 7 1 2 1 1 2 */
1185, /* OBJ_id_tc26_gost_3410_2012_256_paramSetC 1 2 643 7 1 2 1 1 3 */
1186, /* OBJ_id_tc26_gost_3410_2012_256_paramSetD 1 2 643 7 1 2 1 1 4 */
997, /* OBJ_id_tc26_gost_3410_2012_512_paramSetTest 1 2 643 7 1 2 1 2 0 */
998, /* OBJ_id_tc26_gost_3410_2012_512_paramSetA 1 2 643 7 1 2 1 2 1 */
999, /* OBJ_id_tc26_gost_3410_2012_512_paramSetB 1 2 643 7 1 2 1 2 2 */
crypto/objects/obj_mac.num
+20
View File
@@ -1170,3 +1170,23 @@ uacurve9 1169
ieee 1170
ieee_siswg 1171
sm2 1172
id_tc26_cipher_gostr3412_2015_magma 1173
id_tc26_cipher_gostr3412_2015_magma_ctracpkm 1174
id_tc26_cipher_gostr3412_2015_magma_ctracpkm_omac 1175
id_tc26_cipher_gostr3412_2015_kuznyechik 1176
id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm 1177
id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac 1178
id_tc26_wrap 1179
id_tc26_wrap_gostr3412_2015_magma 1180
id_tc26_wrap_gostr3412_2015_magma_kexp15 1181
id_tc26_wrap_gostr3412_2015_kuznyechik 1182
id_tc26_wrap_gostr3412_2015_kuznyechik_kexp15 1183
id_tc26_gost_3410_2012_256_paramSetB 1184
id_tc26_gost_3410_2012_256_paramSetC 1185
id_tc26_gost_3410_2012_256_paramSetD 1186
magma_ecb 1187
magma_ctr 1188
magma_ofb 1189
magma_cbc 1190
magma_cfb 1191
magma_mac 1192
crypto/objects/objects.txt
+23
View File
@@ -1339,16 +1339,31 @@ id-tc26-mac 1 : id-tc26-hmac-gost-3411-2012-256 : HMAC GOST 34.11-2012 256 bit
id-tc26-mac 2 : id-tc26-hmac-gost-3411-2012-512 : HMAC GOST 34.11-2012 512 bit
id-tc26-algorithms 5 : id-tc26-cipher
id-tc26-cipher 1 : id-tc26-cipher-gostr3412-2015-magma
id-tc26-cipher-gostr3412-2015-magma 1 : id-tc26-cipher-gostr3412-2015-magma-ctracpkm
id-tc26-cipher-gostr3412-2015-magma 2 : id-tc26-cipher-gostr3412-2015-magma-ctracpkm-omac
id-tc26-cipher 2 : id-tc26-cipher-gostr3412-2015-kuznyechik
id-tc26-cipher-gostr3412-2015-kuznyechik 1 : id-tc26-cipher-gostr3412-2015-kuznyechik-ctracpkm
id-tc26-cipher-gostr3412-2015-kuznyechik 2 : id-tc26-cipher-gostr3412-2015-kuznyechik-ctracpkm-omac
id-tc26-algorithms 6 : id-tc26-agreement
id-tc26-agreement 1 : id-tc26-agreement-gost-3410-2012-256
id-tc26-agreement 2 : id-tc26-agreement-gost-3410-2012-512
id-tc26-algorithms 7 : id-tc26-wrap
id-tc26-wrap 1 : id-tc26-wrap-gostr3412-2015-magma
id-tc26-wrap-gostr3412-2015-magma 1 : id-tc26-wrap-gostr3412-2015-magma-kexp15
id-tc26-wrap 2 : id-tc26-wrap-gostr3412-2015-kuznyechik
id-tc26-wrap-gostr3412-2015-magma 1 : id-tc26-wrap-gostr3412-2015-kuznyechik-kexp15
id-tc26 2 : id-tc26-constants
id-tc26-constants 1 : id-tc26-sign-constants
id-tc26-sign-constants 1: id-tc26-gost-3410-2012-256-constants
id-tc26-gost-3410-2012-256-constants 1 : id-tc26-gost-3410-2012-256-paramSetA: GOST R 34.10-2012 (256 bit) ParamSet A
id-tc26-gost-3410-2012-256-constants 2 : id-tc26-gost-3410-2012-256-paramSetB: GOST R 34.10-2012 (256 bit) ParamSet B
id-tc26-gost-3410-2012-256-constants 3 : id-tc26-gost-3410-2012-256-paramSetC: GOST R 34.10-2012 (256 bit) ParamSet C
id-tc26-gost-3410-2012-256-constants 4 : id-tc26-gost-3410-2012-256-paramSetD: GOST R 34.10-2012 (256 bit) ParamSet D
id-tc26-sign-constants 2: id-tc26-gost-3410-2012-512-constants
id-tc26-gost-3410-2012-512-constants 0 : id-tc26-gost-3410-2012-512-paramSetTest: GOST R 34.10-2012 (512 bit) testing parameter set
id-tc26-gost-3410-2012-512-constants 1 : id-tc26-gost-3410-2012-512-paramSetA: GOST R 34.10-2012 (512 bit) ParamSet A
@@ -1374,6 +1389,14 @@ member-body 643 100 112 : issuerSignTool : Signing Tool of Issuer
: grasshopper-cfb
: grasshopper-mac
#GOST R34.13-2015 Magma
: magma-ecb
: magma-ctr
: magma-ofb
: magma-cbc
: magma-cfb
: magma-mac
# Definitions for Camellia cipher - CBC MODE
1 2 392 200011 61 1 1 1 2 : CAMELLIA-128-CBC : camellia-128-cbc
crypto/poly1305/poly1305_ameth.c
+21
View File
@@ -67,6 +67,25 @@ static int poly1305_set_priv_key(EVP_PKEY *pkey, const unsigned char *priv,
return 1;
}
static int poly1305_get_priv_key(const EVP_PKEY *pkey, unsigned char *priv,
size_t *len)
{
ASN1_OCTET_STRING *os = (ASN1_OCTET_STRING *)pkey->pkey.ptr;
if (priv == NULL) {
*len = POLY1305_KEY_SIZE;
return 1;
}
if (os == NULL || *len < POLY1305_KEY_SIZE)
return 0;
memcpy(priv, ASN1_STRING_get0_data(os), ASN1_STRING_length(os));
*len = POLY1305_KEY_SIZE;
return 1;
}
const EVP_PKEY_ASN1_METHOD poly1305_asn1_meth = {
EVP_PKEY_POLY1305,
EVP_PKEY_POLY1305,
@@ -98,4 +117,6 @@ const EVP_PKEY_ASN1_METHOD poly1305_asn1_meth = {
poly1305_set_priv_key,
NULL,
poly1305_get_priv_key,
NULL,
};
crypto/rand/rand_unix.c
+18 -8
View File
@@ -229,17 +229,9 @@ static size_t sysctl_random(char *buf, size_t buflen)
*/
int syscall_random(void *buf, size_t buflen)
{
union {
void *p;
int (*f)(void *buffer, size_t length);
} p_getentropy;
/*
* Do runtime detection to find getentropy().
*
* We could cache the result of the lookup, but we normally don't
* call this function often.
*
* Known OSs that should support this:
* - Darwin since 16 (OSX 10.12, IOS 10.0).
* - Solaris since 11.3
@@ -247,9 +239,27 @@ int syscall_random(void *buf, size_t buflen)
* - Linux since 3.17 with glibc 2.25
* - FreeBSD since 12.0 (1200061)
*/
# if defined(__GNUC__) && __GNUC__>=2 && defined(__ELF__)
extern int getentropy(void *bufer, size_t length) __attribute__((weak));
if (getentropy != NULL)
return getentropy(buf, buflen) == 0 ? buflen : 0;
# else
union {
void *p;
int (*f)(void *buffer, size_t length);
} p_getentropy;
/*
* We could cache the result of the lookup, but we normally don't
* call this function often.
*/
ERR_set_mark();
p_getentropy.p = DSO_global_lookup("getentropy");
ERR_pop_to_mark();
if (p_getentropy.p != NULL)
return p_getentropy.f(buf, buflen) == 0 ? buflen : 0;
# endif
/* Linux supports this since version 3.17 */
# if defined(__linux) && defined(SYS_getrandom)
crypto/siphash/siphash_ameth.c
+21
View File
@@ -68,6 +68,25 @@ static int siphash_set_priv_key(EVP_PKEY *pkey, const unsigned char *priv,
return 1;
}
static int siphash_get_priv_key(const EVP_PKEY *pkey, unsigned char *priv,
size_t *len)
{
ASN1_OCTET_STRING *os = (ASN1_OCTET_STRING *)pkey->pkey.ptr;
if (priv == NULL) {
*len = SIPHASH_KEY_SIZE;
return 1;
}
if (os == NULL || *len < SIPHASH_KEY_SIZE)
return 0;
memcpy(priv, ASN1_STRING_get0_data(os), ASN1_STRING_length(os));
*len = SIPHASH_KEY_SIZE;
return 1;
}
const EVP_PKEY_ASN1_METHOD siphash_asn1_meth = {
EVP_PKEY_SIPHASH,
EVP_PKEY_SIPHASH,
@@ -99,4 +118,6 @@ const EVP_PKEY_ASN1_METHOD siphash_asn1_meth = {
siphash_set_priv_key,
NULL,
siphash_get_priv_key,
NULL,
};
crypto/srp/srp_vfy.c
+1 -1
View File
@@ -189,7 +189,7 @@ static SRP_user_pwd *SRP_user_pwd_new(void)
SRP_user_pwd *ret;
if ((ret = OPENSSL_malloc(sizeof(*ret))) == NULL) {
/* SRPerr(SRP_F_SRP_USER_PWD_NEW, ERR_R_MALLOC_FAILURE); */
/* SRPerr(SRP_F_SRP_USER_PWD_NEW, ERR_R_MALLOC_FAILURE); */ /*ckerr_ignore*/
return NULL;
}
ret->N = NULL;
crypto/x509/x509type.c
+3
View File
@@ -35,6 +35,9 @@ int X509_certificate_type(const X509 *x, const EVP_PKEY *pkey)
/* if (!sign only extension) */
ret |= EVP_PKT_ENC;
break;
case EVP_PKEY_RSA_PSS:
ret = EVP_PK_RSA | EVP_PKT_SIGN;
break;
case EVP_PKEY_DSA:
ret = EVP_PK_DSA | EVP_PKT_SIGN;
break;
doc/man1/s_client.pod
+50 -1
View File
@@ -23,9 +23,19 @@ B<openssl> B<s_client>
[B<-certform DER|PEM>]
[B<-key filename>]
[B<-keyform DER|PEM>]
[B<-cert_chain filename>]
[B<-build_chain>]
[B<-xkey>]
[B<-xcert>]
[B<-xchain>]
[B<-xchain_build>]
[B<-xcertform PEM|DER>]
[B<-xkeyform PEM|DER>]
[B<-pass arg>]
[B<-CApath directory>]
[B<-CAfile filename>]
[B<-chainCApath directory>]
[B<-chainCAfile filename>]
[B<-no-CAfile>]
[B<-no-CApath>]
[B<-requestCAfile filename>]
@@ -60,6 +70,7 @@ B<openssl> B<s_client>
[B<-verify_hostname hostname>]
[B<-verify_ip ip>]
[B<-verify_name name>]
[B<-build_chain>]
[B<-x509_strict>]
[B<-reconnect>]
[B<-showcerts>]
@@ -212,6 +223,34 @@ be used.
The private format to use: DER or PEM. PEM is the default.
=item B<-cert_chain>
A file containing trusted certificates to use when attempting to build the
client/server certificate chain related to the certificate specified via the
B<-cert> option.
=item B<-build_chain>
Specify whether the application should build the certificate chain to be
provided to the server.
=item B<-xkey infile>, B<-xcert infile>, B<-xchain>
Specify an extra certificate, private key and certificate chain. These behave
in the same manner as the B<-cert>, B<-key> and B<-cert_chain> options. When
specified, the callback returning the first valid chain will be in use by the
client.
=item B<-xchain_build>
Specify whether the application should build the certificate chain to be
provided to the server for the extra certificates provided via B<-xkey infile>,
B<-xcert infile>, B<-xchain> options.
=item B<-xcertform PEM|DER>, B<-xkeyform PEM|DER>
Extra certificate and private key format respectively.
=item B<-pass arg>
the private key password source. For more information about the format of B<arg>
@@ -240,7 +279,7 @@ set multiple options. See the L<x509(1)> manual page for details.
=item B<-CApath directory>
The directory to use for server certificate verification. This directory
must be in "hash format", see B<verify> for more information. These are
must be in "hash format", see L<verify(1)> for more information. These are
also used when building the client certificate chain.
=item B<-CAfile file>
@@ -248,6 +287,16 @@ also used when building the client certificate chain.
A file containing trusted certificates to use during server authentication
and to use when attempting to build the client certificate chain.
=item B<-chainCApath directory>
The directory to use for building the chain provided to the server. This
directory must be in "hash format", see L<verify(1)> for more information.
=item B<-chainCAfile file>
A file containing trusted certificates to use when attempting to build the
client certificate chain.
=item B<-no-CAfile>
Do not load the trusted CA certificates from the default file location
doc/man1/s_server.pod
+45 -1
View File
@@ -246,6 +246,17 @@ certificate and some require a certificate with a certain public key type:
for example the DSS cipher suites require a certificate containing a DSS
(DSA) key. If not specified then the filename "server.pem" will be used.
=item B<-cert_chain>
A file containing trusted certificates to use when attempting to build the
client/server certificate chain related to the certificate specified via the
B<-cert> option.
=item B<-build_chain>
Specify whether the application should build the certificate chain to be
provided to the client.
=item B<-nameopt val>
Option which determines how the subject or issuer names are displayed. The
@@ -295,10 +306,33 @@ and some a DSS (DSA) key. By using RSA and DSS certificates and keys
a server can support clients which only support RSA or DSS cipher suites
by using an appropriate certificate.
=item B<-dcert_chain>
A file containing trusted certificates to use when attempting to build the
server certificate chain when a certificate specified via the B<-dcert> option
is in use.
=item B<-dcertform PEM|DER>, B<-dkeyform PEM|DER>, B<-dpass val>
Additional certificate and private key format and passphrase respectively.
=item B<-xkey infile>, B<-xcert infile>, B<-xchain>
Specify an extra certificate, private key and certificate chain. These behave
in the same manner as the B<-cert>, B<-key> and B<-cert_chain> options. When
specified, the callback returning the first valid chain will be in use by
the server.
=item B<-xchain_build>
Specify whether the application should build the certificate chain to be
provided to the client for the extra certificates provided via B<-xkey infile>,
B<-xcert infile>, B<-xchain> options.
=item B<-xcertform PEM|DER>, B<-xkeyform PEM|DER>
Extra certificate and private key format respectively.
=item B<-nbio_test>
Tests non blocking I/O.
@@ -333,9 +367,19 @@ a certificate is requested.
=item B<-CApath dir>
The directory to use for client certificate verification. This directory
must be in "hash format", see B<verify> for more information. These are
must be in "hash format", see L<verify(1)> for more information. These are
also used when building the server certificate chain.
=item B<-chainCApath dir>
The directory to use for building the chain provided to the client. This
directory must be in "hash format", see L<verify(1)> for more information.
=item B<-chainCAfile file>
A file containing trusted certificates to use when attempting to build the
server certificate chain.
=item B<-no-CAfile>
Do not load the trusted CA certificates from the default file location.
doc/man3/BUF_MEM_new.pod
-2
View File
@@ -6,8 +6,6 @@ BUF_MEM_new, BUF_MEM_new_ex, BUF_MEM_free, BUF_MEM_grow,
BUF_MEM_grow_clean, BUF_reverse
- simple character array structure
standard C library equivalents
=head1 SYNOPSIS
#include <openssl/buffer.h>
doc/man3/DSA_sign.pod
+6 -7
View File
@@ -23,13 +23,12 @@ digest B<dgst> using the private key B<dsa> and places its ASN.1 DER
encoding at B<sigret>. The length of the signature is places in
*B<siglen>. B<sigret> must point to DSA_size(B<dsa>) bytes of memory.
DSA_sign_setup() may be used to precompute part of the signing
operation in case signature generation is time-critical. It expects
B<dsa> to contain DSA parameters. It places the precomputed values
in newly allocated B<BIGNUM>s at *B<kinvp> and *B<rp>, after freeing
the old ones unless *B<kinvp> and *B<rp> are NULL. These values may
be passed to DSA_sign() in B<dsa-E<gt>kinv> and B<dsa-E<gt>r>.
B<ctx> is a pre-allocated B<BN_CTX> or NULL.
DSA_sign_setup() is defined only for backward binary compatibility and
should not be used.
Since OpenSSL 1.1.0 the DSA type is opaque and the output of
DSA_sign_setup() cannot be used anyway: calling this function will only
cause overhead, and does not affect the actual signature
(pre-)computation.
DSA_verify() verifies that the signature B<sigbuf> of size B<siglen>
matches a given message digest B<dgst> of size B<len>.
doc/man3/EVP_PKEY_ASN1_METHOD.pod
+15 -2
View File
@@ -21,6 +21,8 @@ EVP_PKEY_asn1_set_param_check,
EVP_PKEY_asn1_set_security_bits,
EVP_PKEY_asn1_set_set_priv_key,
EVP_PKEY_asn1_set_set_pub_key,
EVP_PKEY_asn1_set_get_priv_key,
EVP_PKEY_asn1_set_get_pub_key,
EVP_PKEY_get0_asn1
- manipulating and registering EVP_PKEY_ASN1_METHOD structure
@@ -125,6 +127,16 @@ EVP_PKEY_get0_asn1
const unsigned char *pub,
size_t len));
void EVP_PKEY_asn1_set_get_priv_key(EVP_PKEY_ASN1_METHOD *ameth,
int (*get_priv_key) (const EVP_PKEY *pk,
unsigned char *priv,
size_t *len));
void EVP_PKEY_asn1_set_get_pub_key(EVP_PKEY_ASN1_METHOD *ameth,
int (*get_pub_key) (const EVP_PKEY *pk,
unsigned char *pub,
size_t *len));
const EVP_PKEY_ASN1_METHOD *EVP_PKEY_get0_asn1(const EVP_PKEY *pkey);
=head1 DESCRIPTION
@@ -390,8 +402,9 @@ EVP_PKEY_asn1_set_param(), EVP_PKEY_asn1_set_free(),
EVP_PKEY_asn1_set_ctrl(), EVP_PKEY_asn1_set_item(),
EVP_PKEY_asn1_set_siginf(), EVP_PKEY_asn1_set_check(),
EVP_PKEY_asn1_set_public_check(), EVP_PKEY_asn1_set_param_check(),
EVP_PKEY_asn1_set_security_bits(), EVP_PKEY_asn1_set_set_priv_key() and
EVP_PKEY_asn1_set_set_pub_key() set the diverse methods of the given
EVP_PKEY_asn1_set_security_bits(), EVP_PKEY_asn1_set_set_priv_key(),
EVP_PKEY_asn1_set_set_pub_key(), EVP_PKEY_asn1_set_get_priv_key() and
EVP_PKEY_asn1_set_get_pub_key() set the diverse methods of the given
B<EVP_PKEY_ASN1_METHOD> object.
EVP_PKEY_get0_asn1() finds the B<EVP_PKEY_ASN1_METHOD> associated
doc/man3/EVP_PKEY_new.pod
+39 -10
View File
@@ -8,8 +8,10 @@ EVP_PKEY_free,
EVP_PKEY_new_raw_private_key,
EVP_PKEY_new_raw_public_key,
EVP_PKEY_new_CMAC_key,
EVP_PKEY_new_mac_key
- public/private key allocation functions
EVP_PKEY_new_mac_key,
EVP_PKEY_get_raw_private_key,
EVP_PKEY_get_raw_public_key
- public/private key allocation and raw key handling functions
=head1 SYNOPSIS
@@ -28,10 +30,16 @@ EVP_PKEY_new_mac_key
EVP_PKEY *EVP_PKEY_new_mac_key(int type, ENGINE *e, const unsigned char *key,
int keylen);
int EVP_PKEY_get_raw_private_key(const EVP_PKEY *pkey, unsigned char *priv,
size_t *len);
int EVP_PKEY_get_raw_public_key(const EVP_PKEY *pkey, unsigned char *pub,
size_t *len);
=head1 DESCRIPTION
The EVP_PKEY_new() function allocates an empty B<EVP_PKEY> structure which is
used by OpenSSL to store private keys. The reference count is set to B<1>.
used by OpenSSL to store public and private keys. The reference count is set to
B<1>.
EVP_PKEY_up_ref() increments the reference count of B<key>.
@@ -63,14 +71,32 @@ creation of a CMAC in the B<cipher> argument.
EVP_PKEY_new_mac_key() works in the same way as EVP_PKEY_new_raw_private_key().
New applications should use EVP_PKEY_new_raw_private_key() instead.
EVP_PKEY_get_raw_private_key() fills the buffer provided by B<priv> with raw
private key data. The number of bytes written is populated in B<*len>. If the
buffer B<priv> is NULL then B<*len> is populated with the number of bytes
required to hold the key. The calling application is responsible for ensuring
that the buffer is large enough to receive the private key data. This function
only works for algorithms that support raw private keys. Currently this is:
B<EVP_PKEY_HMAC>, B<EVP_PKEY_POLY1305>, B<EVP_PKEY_SIPHASH>, B<EVP_PKEY_X25519>,
B<EVP_PKEY_ED25519>, B<EVP_PKEY_X448> or B<EVP_PKEY_ED448>.
EVP_PKEY_get_raw_public_key() fills the buffer provided by B<pub> with raw
public key data. The number of bytes written is populated in B<*len>. If the
buffer B<pub> is NULL then B<*len> is populated with the number of bytes
required to hold the key. The calling application is responsible for ensuring
that the buffer is large enough to receive the public key data. This function
only works for algorithms that support raw public keys. Currently this is:
B<EVP_PKEY_X25519>, B<EVP_PKEY_ED25519>, B<EVP_PKEY_X448> or B<EVP_PKEY_ED448>.
=head1 NOTES
The B<EVP_PKEY> structure is used by various OpenSSL functions which require a
general private key without reference to any particular algorithm.
The structure returned by EVP_PKEY_new() is empty. To add a private key to this
empty structure the functions described in L<EVP_PKEY_set1_RSA(3)> should be
used.
The structure returned by EVP_PKEY_new() is empty. To add a private or public
key to this empty structure use the appropriate functions described in
L<EVP_PKEY_set1_RSA(3)>, L<EVP_PKEY_set1_DSA>, L<EVP_PKEY_set1_DH> or
L<EVP_PKEY_set1_EC_KEY>.
=head1 RETURN VALUES
@@ -78,19 +104,22 @@ EVP_PKEY_new(), EVP_PKEY_new_raw_private_key(), EVP_PKEY_new_raw_public_key(),
EVP_PKEY_new_CMAC_key() and EVP_PKEY_new_mac_key() return either the newly
allocated B<EVP_PKEY> structure or B<NULL> if an error occurred.
EVP_PKEY_up_ref() returns 1 for success and 0 for failure.
EVP_PKEY_up_ref(), EVP_PKEY_get_raw_private_key() and
EVP_PKEY_get_raw_public_key() return 1 for success and 0 for failure.
=head1 SEE ALSO
L<EVP_PKEY_set1_RSA(3)>
L<EVP_PKEY_set1_RSA(3)>, L<EVP_PKEY_set1_DSA>, L<EVP_PKEY_set1_DH> or
L<EVP_PKEY_set1_EC_KEY>
=head1 HISTORY
EVP_PKEY_new() and EVP_PKEY_free() exist in all versions of OpenSSL.
EVP_PKEY_up_ref() was first added to OpenSSL 1.1.0.
EVP_PKEY_new_raw_private_key(), EVP_PKEY_new_raw_public_key() and
EVP_PKEY_new_CMAC_key() were first added to OpenSSL 1.1.1.
EVP_PKEY_new_raw_private_key(), EVP_PKEY_new_raw_public_key(),
EVP_PKEY_new_CMAC_key(), EVP_PKEY_new_raw_private_key() and
EVP_PKEY_get_raw_public_key() were first added to OpenSSL 1.1.1.
=head1 COPYRIGHT
doc/man3/SSL_get_current_cipher.pod
+1 -1
View File
@@ -15,7 +15,7 @@ SSL_get_pending_cipher - get SSL_CIPHER of a connection
const char *SSL_get_cipher_name(const SSL *s);
const char *SSL_get_cipher(const SSL *s);
int SSL_get_cipher_bits(const SSL *s, int *np) \
int SSL_get_cipher_bits(const SSL *s, int *np);
const char *SSL_get_cipher_version(const SSL *s);
=head1 DESCRIPTION
doc/man3/X509v3_get_ext_by_NID.pod
+4 -2
View File
@@ -115,8 +115,8 @@ initial extension will not be checked.
X509v3_get_ext_count() returns the extension count.
X509v3_get_ext() and X509v3_delete_ext() return an B<X509_EXTENSION> pointer
or B<NULL> if an error occurs.
X509v3_get_ext(), X509v3_delete_ext() and X509_delete_ext() return an
B<X509_EXTENSION> pointer or B<NULL> if an error occurs.
X509v3_get_ext_by_NID() X509v3_get_ext_by_OBJ() and
X509v3_get_ext_by_critical() return the an extension index or B<-1> if an
@@ -124,6 +124,8 @@ error occurs.
X509v3_add_ext() returns a stack of extensions or B<NULL> on error.
X509_add_ext() returns 1 on success and 0 on error.
=head1 SEE ALSO
L<X509V3_get_d2i(3)>
doc/man7/ossl_store-file.pod
+6 -9
View File
@@ -47,17 +47,14 @@ only).
When needed, the 'file' scheme loader will require a pass phrase by
using the C<UI_METHOD> that was passed via OSSL_STORE_open().
This pass phrase is used as it is, which may present some challenge
when the file that's loaded contains a PKCS#12 object.
This pass phrase is expected to be UTF-8 encoded, anything else will
give an undefined result.
The files made accessible through this loader are expected to be
standard compliant with regards to pass phrase encoding.
Files that aren't should be re-generated with a correctly encoded pass
phrase.
See L<passphrase-encoding(7)> for more information.
=begin comment
The treatment of pass phrases is currently being worked on and may
change.
=end comment
=head1 SEE ALSO
L<ossl_store(7)>, L<passphrase-encoding(7)>
doc/man7/ossl_store.pod
+7
View File
@@ -33,6 +33,13 @@ dynamically from the calling application or from a loadable engine.
Support for the 'file' scheme is built into C<libcrypto>.
See L<ossl_store-file(7)> for more information.
=head2 UI_METHOD and pass phrases
The B<OSS_STORE> API does nothing to enforce any specific format or
encoding on the pass phrase that the B<UI_METHOD> provides. However,
the pass phrase is expected to be UTF-8 encoded. The result of any
other encoding is undefined.
=head1 EXAMPLES
=head2 A generic call
doc/man7/passphrase-encoding.pod
+9 -11
View File
@@ -4,7 +4,7 @@
=head1 NAME
password encoding
passphrase-encoding
- How diverse parts of OpenSSL treat pass phrases character encoding
=head1 DESCRIPTION
@@ -61,11 +61,11 @@ OpenSSL still does this, to be able to read files produced with older versions.
It should be noted that this approach isn't entirely fault free.
A passphrase encoded in ISO-8859-2 could very well have a sequence such as
A pass phrase encoded in ISO-8859-2 could very well have a sequence such as
0xC3 0xAF (which is the two characters "LATIN CAPITAL LETTER A WITH BREVE"
and "LATIN CAPITAL LETTER Z WITH DOT ABOVE" in ISO-8859-2 encoding), but would
be misinterpreted as the perfectly valid UTF-8 encoded code point U+00EF (LATIN
SMALL LETTER I WITH DIARESIS) I<if the passphrase doesn't contain anything that
SMALL LETTER I WITH DIARESIS) I<if the pass phrase doesn't contain anything that
would be invalid UTF-8>.
A pass phrase that contains this kind of byte sequence will give a different
outcome in OpenSSL 1.1.0 and newer than in OpenSSL older than 1.1.0.
@@ -80,13 +80,11 @@ than 1.1.0 was misinterpreted as ISO-8859-1 sequences.
L<ossl_store(7)> acts as a general interface to access all kinds of objects,
potentially protected with a pass phrase, a PIN or something else.
This API currently doesn't stipulate any specific encoding of pass phrases, but
uses the underlying routines with their behaviours.
This means that when using the built-in C<file:> scheme loader, the pass phrase
to unlock a PKCS#12 file will be treated as described for PKCS#12 above, and
the pass phrase for a PEM files will be treated as the general case described
above, since that loader uses the same underlying routines.
I<Note that other loaders will have their own behaviours>.
This API stipulates that pass phrases should be UTF-8 encoded, and that any
other pass phrase encoding may give undefined results.
This API relies on the application to ensure UTF-8 encoding, and doesn't check
that this is the case, so what it gets, it will also pass to the underlying
loader.
=head1 RECOMMENDATIONS
@@ -135,7 +133,7 @@ following:
=item 1.
Try the password that you have as it is in the character encoding of your
Try the pass phrase that you have as it is in the character encoding of your
environment.
It's possible that its byte sequence is exactly right.
fuzz/oids.txt
+14
View File
@@ -1047,3 +1047,17 @@ OBJ_uacurve9="\x2A\x86\x24\x02\x01\x01\x01\x01\x03\x01\x01\x02\x09"
OBJ_ieee="\x2B\x6F"
OBJ_ieee_siswg="\x2B\x6F\x02\x8C\x53"
OBJ_sm2="\x2A\x81\x1C\xCF\x55\x01\x82\x2D"
OBJ_id_tc26_cipher_gostr3412_2015_magma="\x2A\x85\x03\x07\x01\x01\x05\x01"
OBJ_id_tc26_cipher_gostr3412_2015_magma_ctracpkm="\x2A\x85\x03\x07\x01\x01\x05\x01\x01"
OBJ_id_tc26_cipher_gostr3412_2015_magma_ctracpkm_omac="\x2A\x85\x03\x07\x01\x01\x05\x01\x02"
OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik="\x2A\x85\x03\x07\x01\x01\x05\x02"
OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm="\x2A\x85\x03\x07\x01\x01\x05\x02\x01"
OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac="\x2A\x85\x03\x07\x01\x01\x05\x02\x02"
OBJ_id_tc26_wrap="\x2A\x85\x03\x07\x01\x01\x07"
OBJ_id_tc26_wrap_gostr3412_2015_magma="\x2A\x85\x03\x07\x01\x01\x07\x01"
OBJ_id_tc26_wrap_gostr3412_2015_magma_kexp15="\x2A\x85\x03\x07\x01\x01\x07\x01\x01"
OBJ_id_tc26_wrap_gostr3412_2015_kuznyechik="\x2A\x85\x03\x07\x01\x01\x07\x02"
OBJ_id_tc26_wrap_gostr3412_2015_kuznyechik_kexp15="\x2A\x85\x03\x07\x01\x01\x07\x01\x01"
OBJ_id_tc26_gost_3410_2012_256_paramSetB="\x2A\x85\x03\x07\x01\x02\x01\x01\x02"
OBJ_id_tc26_gost_3410_2012_256_paramSetC="\x2A\x85\x03\x07\x01\x02\x01\x01\x03"
OBJ_id_tc26_gost_3410_2012_256_paramSetD="\x2A\x85\x03\x07\x01\x02\x01\x01\x04"
include/openssl/evp.h
+13
View File
@@ -1238,6 +1238,14 @@ void EVP_PKEY_asn1_set_set_pub_key(EVP_PKEY_ASN1_METHOD *ameth,
int (*set_pub_key) (EVP_PKEY *pk,
const unsigned char *pub,
size_t len));
void EVP_PKEY_asn1_set_get_priv_key(EVP_PKEY_ASN1_METHOD *ameth,
int (*get_priv_key) (const EVP_PKEY *pk,
unsigned char *priv,
size_t *len));
void EVP_PKEY_asn1_set_get_pub_key(EVP_PKEY_ASN1_METHOD *ameth,
int (*get_pub_key) (const EVP_PKEY *pk,
unsigned char *pub,
size_t *len));
void EVP_PKEY_asn1_set_security_bits(EVP_PKEY_ASN1_METHOD *ameth,
int (*pkey_security_bits) (const EVP_PKEY
@@ -1352,6 +1360,11 @@ EVP_PKEY *EVP_PKEY_new_raw_private_key(int type, ENGINE *e,
EVP_PKEY *EVP_PKEY_new_raw_public_key(int type, ENGINE *e,
const unsigned char *pub,
size_t len);
int EVP_PKEY_get_raw_private_key(const EVP_PKEY *pkey, unsigned char *priv,
size_t *len);
int EVP_PKEY_get_raw_public_key(const EVP_PKEY *pkey, unsigned char *pub,
size_t *len);
EVP_PKEY *EVP_PKEY_new_CMAC_key(ENGINE *e, const unsigned char *priv,
size_t len, const EVP_CIPHER *cipher);
include/openssl/evperr.h
+3
View File
@@ -79,6 +79,8 @@ int ERR_load_EVP_strings(void);
# define EVP_F_EVP_PKEY_GET0_POLY1305 184
# define EVP_F_EVP_PKEY_GET0_RSA 121
# define EVP_F_EVP_PKEY_GET0_SIPHASH 172
# define EVP_F_EVP_PKEY_GET_RAW_PRIVATE_KEY 202
# define EVP_F_EVP_PKEY_GET_RAW_PUBLIC_KEY 203
# define EVP_F_EVP_PKEY_KEYGEN 146
# define EVP_F_EVP_PKEY_KEYGEN_INIT 147
# define EVP_F_EVP_PKEY_METH_ADD0 194
@@ -139,6 +141,7 @@ int ERR_load_EVP_strings(void);
# define EVP_R_EXPECTING_A_POLY1305_KEY 164
# define EVP_R_EXPECTING_A_SIPHASH_KEY 175
# define EVP_R_FIPS_MODE_NOT_SUPPORTED 167
# define EVP_R_GET_RAW_KEY_FAILED 182
# define EVP_R_ILLEGAL_SCRYPT_PARAMETERS 171
# define EVP_R_INITIALIZATION_ERROR 134
# define EVP_R_INPUT_NOT_INITIALIZED 111
include/openssl/obj_mac.h
+77
View File
@@ -4218,6 +4218,30 @@
#define NID_id_tc26_cipher 990
#define OBJ_id_tc26_cipher OBJ_id_tc26_algorithms,5L
#define SN_id_tc26_cipher_gostr3412_2015_magma "id-tc26-cipher-gostr3412-2015-magma"
#define NID_id_tc26_cipher_gostr3412_2015_magma 1173
#define OBJ_id_tc26_cipher_gostr3412_2015_magma OBJ_id_tc26_cipher,1L
#define SN_id_tc26_cipher_gostr3412_2015_magma_ctracpkm "id-tc26-cipher-gostr3412-2015-magma-ctracpkm"
#define NID_id_tc26_cipher_gostr3412_2015_magma_ctracpkm 1174
#define OBJ_id_tc26_cipher_gostr3412_2015_magma_ctracpkm OBJ_id_tc26_cipher_gostr3412_2015_magma,1L
#define SN_id_tc26_cipher_gostr3412_2015_magma_ctracpkm_omac "id-tc26-cipher-gostr3412-2015-magma-ctracpkm-omac"
#define NID_id_tc26_cipher_gostr3412_2015_magma_ctracpkm_omac 1175
#define OBJ_id_tc26_cipher_gostr3412_2015_magma_ctracpkm_omac OBJ_id_tc26_cipher_gostr3412_2015_magma,2L
#define SN_id_tc26_cipher_gostr3412_2015_kuznyechik "id-tc26-cipher-gostr3412-2015-kuznyechik"
#define NID_id_tc26_cipher_gostr3412_2015_kuznyechik 1176
#define OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik OBJ_id_tc26_cipher,2L
#define SN_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm "id-tc26-cipher-gostr3412-2015-kuznyechik-ctracpkm"
#define NID_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm 1177
#define OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik,1L
#define SN_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac "id-tc26-cipher-gostr3412-2015-kuznyechik-ctracpkm-omac"
#define NID_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac 1178
#define OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik,2L
#define SN_id_tc26_agreement "id-tc26-agreement"
#define NID_id_tc26_agreement 991
#define OBJ_id_tc26_agreement OBJ_id_tc26_algorithms,6L
@@ -4230,6 +4254,26 @@
#define NID_id_tc26_agreement_gost_3410_2012_512 993
#define OBJ_id_tc26_agreement_gost_3410_2012_512 OBJ_id_tc26_agreement,2L
#define SN_id_tc26_wrap "id-tc26-wrap"
#define NID_id_tc26_wrap 1179
#define OBJ_id_tc26_wrap OBJ_id_tc26_algorithms,7L
#define SN_id_tc26_wrap_gostr3412_2015_magma "id-tc26-wrap-gostr3412-2015-magma"
#define NID_id_tc26_wrap_gostr3412_2015_magma 1180
#define OBJ_id_tc26_wrap_gostr3412_2015_magma OBJ_id_tc26_wrap,1L
#define SN_id_tc26_wrap_gostr3412_2015_magma_kexp15 "id-tc26-wrap-gostr3412-2015-magma-kexp15"
#define NID_id_tc26_wrap_gostr3412_2015_magma_kexp15 1181
#define OBJ_id_tc26_wrap_gostr3412_2015_magma_kexp15 OBJ_id_tc26_wrap_gostr3412_2015_magma,1L
#define SN_id_tc26_wrap_gostr3412_2015_kuznyechik "id-tc26-wrap-gostr3412-2015-kuznyechik"
#define NID_id_tc26_wrap_gostr3412_2015_kuznyechik 1182
#define OBJ_id_tc26_wrap_gostr3412_2015_kuznyechik OBJ_id_tc26_wrap,2L
#define SN_id_tc26_wrap_gostr3412_2015_kuznyechik_kexp15 "id-tc26-wrap-gostr3412-2015-kuznyechik-kexp15"
#define NID_id_tc26_wrap_gostr3412_2015_kuznyechik_kexp15 1183
#define OBJ_id_tc26_wrap_gostr3412_2015_kuznyechik_kexp15 OBJ_id_tc26_wrap_gostr3412_2015_magma,1L
#define SN_id_tc26_constants "id-tc26-constants"
#define NID_id_tc26_constants 994
#define OBJ_id_tc26_constants OBJ_id_tc26,2L
@@ -4247,6 +4291,21 @@
#define NID_id_tc26_gost_3410_2012_256_paramSetA 1148
#define OBJ_id_tc26_gost_3410_2012_256_paramSetA OBJ_id_tc26_gost_3410_2012_256_constants,1L
#define SN_id_tc26_gost_3410_2012_256_paramSetB "id-tc26-gost-3410-2012-256-paramSetB"
#define LN_id_tc26_gost_3410_2012_256_paramSetB "GOST R 34.10-2012 (256 bit) ParamSet B"
#define NID_id_tc26_gost_3410_2012_256_paramSetB 1184
#define OBJ_id_tc26_gost_3410_2012_256_paramSetB OBJ_id_tc26_gost_3410_2012_256_constants,2L
#define SN_id_tc26_gost_3410_2012_256_paramSetC "id-tc26-gost-3410-2012-256-paramSetC"
#define LN_id_tc26_gost_3410_2012_256_paramSetC "GOST R 34.10-2012 (256 bit) ParamSet C"
#define NID_id_tc26_gost_3410_2012_256_paramSetC 1185
#define OBJ_id_tc26_gost_3410_2012_256_paramSetC OBJ_id_tc26_gost_3410_2012_256_constants,3L
#define SN_id_tc26_gost_3410_2012_256_paramSetD "id-tc26-gost-3410-2012-256-paramSetD"
#define LN_id_tc26_gost_3410_2012_256_paramSetD "GOST R 34.10-2012 (256 bit) ParamSet D"
#define NID_id_tc26_gost_3410_2012_256_paramSetD 1186
#define OBJ_id_tc26_gost_3410_2012_256_paramSetD OBJ_id_tc26_gost_3410_2012_256_constants,4L
#define SN_id_tc26_gost_3410_2012_512_constants "id-tc26-gost-3410-2012-512-constants"
#define NID_id_tc26_gost_3410_2012_512_constants 996
#define OBJ_id_tc26_gost_3410_2012_512_constants OBJ_id_tc26_sign_constants,2L
@@ -4331,6 +4390,24 @@
#define SN_grasshopper_mac "grasshopper-mac"
#define NID_grasshopper_mac 1017
#define SN_magma_ecb "magma-ecb"
#define NID_magma_ecb 1187
#define SN_magma_ctr "magma-ctr"
#define NID_magma_ctr 1188
#define SN_magma_ofb "magma-ofb"
#define NID_magma_ofb 1189
#define SN_magma_cbc "magma-cbc"
#define NID_magma_cbc 1190
#define SN_magma_cfb "magma-cfb"
#define NID_magma_cfb 1191
#define SN_magma_mac "magma-mac"
#define NID_magma_mac 1192
#define SN_camellia_128_cbc "CAMELLIA-128-CBC"
#define LN_camellia_128_cbc "camellia-128-cbc"
#define NID_camellia_128_cbc 751
ssl/record/rec_layer_s3.c
+30 -33
View File
@@ -1209,6 +1209,7 @@ int ssl3_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
SSL3_RECORD *rr;
SSL3_BUFFER *rbuf;
void (*cb) (const SSL *ssl, int type2, int val) = NULL;
int is_tls13 = SSL_IS_TLS13(s);
rbuf = &s->rlayer.rbuf;
@@ -1340,7 +1341,7 @@ int ssl3_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
if (type == SSL3_RECORD_get_type(rr)
|| (SSL3_RECORD_get_type(rr) == SSL3_RT_CHANGE_CIPHER_SPEC
&& type == SSL3_RT_HANDSHAKE && recvd_type != NULL
&& !SSL_IS_TLS13(s))) {
&& !is_tls13)) {
/*
* SSL3_RT_APPLICATION_DATA or
* SSL3_RT_HANDSHAKE or
@@ -1524,7 +1525,8 @@ int ssl3_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
cb(s, SSL_CB_READ_ALERT, j);
}
if (alert_level == SSL3_AL_WARNING) {
if (alert_level == SSL3_AL_WARNING
|| (is_tls13 && alert_descr == SSL_AD_USER_CANCELLED)) {
s->s3->warn_alert = alert_descr;
SSL3_RECORD_set_read(rr);
@@ -1534,34 +1536,19 @@ int ssl3_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
SSL_R_TOO_MANY_WARN_ALERTS);
return -1;
}
}
if (alert_descr == SSL_AD_CLOSE_NOTIFY) {
s->shutdown |= SSL_RECEIVED_SHUTDOWN;
return 0;
}
/*
* Apart from close_notify the only other warning alert in TLSv1.3
* is user_cancelled - which we just ignore.
*/
if (SSL_IS_TLS13(s) && alert_descr != SSL_AD_USER_CANCELLED) {
SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_SSL3_READ_BYTES,
SSL_R_UNKNOWN_ALERT_TYPE);
return -1;
}
/*
* This is a warning but we receive it if we requested
* renegotiation and the peer denied it. Terminate with a fatal
* alert because if application tried to renegotiate it
* presumably had a good reason and expects it to succeed. In
* future we might have a renegotiation where we don't care if
* the peer refused it where we carry on.
*/
if (alert_descr == SSL_AD_NO_RENEGOTIATION) {
SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_SSL3_READ_BYTES,
SSL_R_NO_RENEGOTIATION);
return -1;
}
} else if (alert_level == SSL3_AL_FATAL) {
/*
* Apart from close_notify the only other warning alert in TLSv1.3
* is user_cancelled - which we just ignore.
*/
if (is_tls13 && alert_descr == SSL_AD_USER_CANCELLED) {
goto start;
} else if (alert_descr == SSL_AD_CLOSE_NOTIFY
&& (is_tls13 || alert_level == SSL3_AL_WARNING)) {
s->shutdown |= SSL_RECEIVED_SHUTDOWN;
return 0;
} else if (alert_level == SSL3_AL_FATAL || is_tls13) {
char tmp[16];
s->rwstate = SSL_NOTHING;
@@ -1574,13 +1561,23 @@ int ssl3_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
SSL3_RECORD_set_read(rr);
SSL_CTX_remove_session(s->session_ctx, s->session);
return 0;
} else {
SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_SSL3_READ_BYTES,
SSL_R_UNKNOWN_ALERT_TYPE);
} else if (alert_descr == SSL_AD_NO_RENEGOTIATION) {
/*
* This is a warning but we receive it if we requested
* renegotiation and the peer denied it. Terminate with a fatal
* alert because if application tried to renegotiate it
* presumably had a good reason and expects it to succeed. In
* future we might have a renegotiation where we don't care if
* the peer refused it where we carry on.
*/
SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_SSL3_READ_BYTES,
SSL_R_NO_RENEGOTIATION);
return -1;
}
goto start;
SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_SSL3_READ_BYTES,
SSL_R_UNKNOWN_ALERT_TYPE);
return -1;
}
if (s->shutdown & SSL_SENT_SHUTDOWN) { /* but we have not received a
ssl/ssl_sess.c
+3 -3
View File
@@ -769,11 +769,11 @@ static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
if (lck)
CRYPTO_THREAD_unlock(ctx->lock);
if (ret)
SSL_SESSION_free(r);
if (ctx->remove_session_cb != NULL)
ctx->remove_session_cb(ctx, c);
if (ret)
SSL_SESSION_free(r);
} else
ret = 0;
return ret;
ssl/statem/extensions.c
+3 -1
View File
@@ -984,7 +984,9 @@ static int final_server_name(SSL *s, unsigned int context, int sent)
return 0;
case SSL_TLSEXT_ERR_ALERT_WARNING:
ssl3_send_alert(s, SSL3_AL_WARNING, altmp);
/* TLSv1.3 doesn't have warning alerts so we suppress this */
if (!SSL_IS_TLS13(s))
ssl3_send_alert(s, SSL3_AL_WARNING, altmp);
return 1;
case SSL_TLSEXT_ERR_NOACK:
test/evp_extra_test.c
+84
View File
@@ -9,6 +9,7 @@
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <openssl/bio.h>
#include <openssl/crypto.h>
#include <openssl/err.h>
@@ -476,6 +477,88 @@ static int test_EVP_PKCS82PKEY(void)
}
#endif
static struct keys_st {
int type;
char *priv;
char *pub;
} keys[] = {
{
EVP_PKEY_HMAC, "0123456789", NULL
}, {
EVP_PKEY_POLY1305, "01234567890123456789012345678901", NULL
}, {
EVP_PKEY_SIPHASH, "0123456789012345", NULL
},
#ifndef OPENSSL_NO_EC
{
EVP_PKEY_X25519, "01234567890123456789012345678901",
"abcdefghijklmnopqrstuvwxyzabcdef"
}, {
EVP_PKEY_ED25519, "01234567890123456789012345678901",
"abcdefghijklmnopqrstuvwxyzabcdef"
}, {
EVP_PKEY_X448,
"01234567890123456789012345678901234567890123456789012345",
"abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcd"
}, {
EVP_PKEY_ED448,
"012345678901234567890123456789012345678901234567890123456",
"abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcde"
}
#endif
};
static int test_set_get_raw_keys_int(int tst, int pub)
{
int ret = 0;
unsigned char buf[80];
unsigned char *in;
size_t inlen, len = 0;
EVP_PKEY *pkey;
/* Check if this algorithm supports public keys */
if (keys[tst].pub == NULL)
return 1;
memset(buf, 0, sizeof(buf));
if (pub) {
inlen = strlen(keys[tst].pub);
in = (unsigned char *)keys[tst].pub;
pkey = EVP_PKEY_new_raw_public_key(keys[tst].type,
NULL,
in,
inlen);
} else {
inlen = strlen(keys[tst].priv);
in = (unsigned char *)keys[tst].priv;
pkey = EVP_PKEY_new_raw_private_key(keys[tst].type,
NULL,
in,
inlen);
}
if (!TEST_ptr(pkey)
|| (!pub && !TEST_true(EVP_PKEY_get_raw_private_key(pkey, NULL, &len)))
|| (pub && !TEST_true(EVP_PKEY_get_raw_public_key(pkey, NULL, &len)))
|| !TEST_true(len == inlen)
|| (!pub && !TEST_true(EVP_PKEY_get_raw_private_key(pkey, buf, &len)))
|| (pub && !TEST_true(EVP_PKEY_get_raw_public_key(pkey, buf, &len)))
|| !TEST_mem_eq(in, inlen, buf, len))
goto done;
ret = 1;
done:
EVP_PKEY_free(pkey);
return ret;
}
static int test_set_get_raw_keys(int tst)
{
return test_set_get_raw_keys_int(tst, 0)
&& test_set_get_raw_keys_int(tst, 1);
}
static int pkey_custom_check(EVP_PKEY *pkey)
{
return 0xbeef;
@@ -581,6 +664,7 @@ int setup_tests(void)
#ifndef OPENSSL_NO_EC
ADD_TEST(test_EVP_PKCS82PKEY);
#endif
ADD_ALL_TESTS(test_set_get_raw_keys, OSSL_NELEM(keys));
custom_pmeth = EVP_PKEY_meth_new(0xdefaced, 0);
if (!TEST_ptr(custom_pmeth))
return 0;
util/ck_errf.pl
+83 -6
View File
@@ -16,14 +16,85 @@
use strict;
use warnings;
my $config;
my $err_strict = 0;
my $bad = 0;
my $debug = 0;
my $internal = 0;
foreach my $file (@ARGV) {
if ( $file eq "-strict" ) {
sub help
{
print STDERR <<"EOF";
mkerr.pl [options] [files...]
Options:
-conf FILE Use the named config file FILE instead of the default.
-debug Verbose output debugging on stderr.
-internal Generate code that is to be built as part of OpenSSL itself.
Also scans internal list of files.
-strict If any error was found, fail with exit code 1, otherwise 0.
-help Show this help text.
... Additional arguments are added to the file list to scan,
if '-internal' was NOT specified on the command line.
EOF
}
while ( @ARGV ) {
my $arg = $ARGV[0];
last unless $arg =~ /-.*/;
$arg = $1 if $arg =~ /-(-.*)/;
if ( $arg eq "-conf" ) {
$config = $ARGV[1];
shift @ARGV;
} elsif ( $arg eq "-debug" ) {
$debug = 1;
} elsif ( $arg eq "-internal" ) {
$internal = 1;
} elsif ( $arg eq "-strict" ) {
$err_strict = 1;
next;
} elsif ( $arg =~ /-*h(elp)?/ ) {
&help();
exit;
} elsif ( $arg =~ /-.*/ ) {
die "Unknown option $arg; use -h for help.\n";
}
shift @ARGV;
}
my @source;
if ( $internal ) {
die "Extra parameters given.\n" if @ARGV;
$config = "crypto/err/openssl.ec" unless defined $config;
@source = ( glob('crypto/*.c'), glob('crypto/*/*.c'),
glob('ssl/*.c'), glob('ssl/*/*.c') );
} else {
die "Configuration file not given.\nSee '$0 -help' for information\n"
unless defined $config;
@source = @ARGV;
}
# To detect if there is any error generation for a libcrypto/libssl libs
# we don't know, we need to find out what libs we do know. That list is
# readily available in crypto/err/openssl.ec, in form of lines starting
# with "L ". Note that we always rely on the modules SYS and ERR to be
# generally available.
my %libs = ( SYS => 1, ERR => 1 );
open my $cfh, $config or die "Trying to read $config: $!\n";
while (<$cfh>) {
s|\R$||; # Better chomp
next unless m|^L ([0-9A-Z_]+)\s|;
next if $1 eq "NONE";
$libs{$1} = 1;
}
my $bad = 0;
foreach my $file (@source) {
open( IN, "<$file" ) || die "Can't open $file, $!";
my $func = "";
while (<IN>) {
@@ -33,17 +104,23 @@ foreach my $file (@ARGV) {
$func = $1;
$func =~ tr/A-Z/a-z/;
}
if ( /([A-Z0-9]+)err\(([^,]+)/ && !/ckerr_ignore/ ) {
if ( /([A-Z0-9_]+[A-Z0-9])err\(([^,]+)/ && !/ckerr_ignore/ ) {
my $errlib = $1;
my $n = $2;
unless ( $libs{$errlib} ) {
print "$file:$.:$errlib not listed in $config\n";
$libs{$errlib} = 1; # To not display it again
$bad = 1;
}
if ( $func eq "" ) {
print "$file:$.:???:$n\n";
$bad = 1;
next;
}
if ( $n !~ /([^_]+)_F_(.+)$/ ) {
if ( $n !~ /^(.+)_F_(.+)$/ ) {
#print "check -$file:$.:$func:$n\n";
next;
}
util/libcrypto.num
+4
View File
@@ -4563,3 +4563,7 @@ X509_OBJECT_set1_X509 4514 1_1_0i EXIST::FUNCTION:
X509_LOOKUP_meth_get_get_by_issuer_serial 4515 1_1_0i EXIST::FUNCTION:
X509_LOOKUP_meth_set_init 4516 1_1_0i EXIST::FUNCTION:
X509_OBJECT_set1_X509_CRL 4517 1_1_0i EXIST::FUNCTION:
EVP_PKEY_get_raw_public_key 4518 1_1_1 EXIST::FUNCTION:
EVP_PKEY_get_raw_private_key 4519 1_1_1 EXIST::FUNCTION:
EVP_PKEY_asn1_set_get_priv_key 4520 1_1_1 EXIST::FUNCTION:
EVP_PKEY_asn1_set_get_pub_key 4521 1_1_1 EXIST::FUNCTION:
util/mkdef.pl
+12 -6
View File
@@ -126,6 +126,7 @@ my $W32=0;
my $NT=0;
my $UNIX=0;
my $linux=0;
my $aix=0;
# Set this to make typesafe STACK definitions appear in DEF
my $safe_stack_def = 0;
@@ -171,12 +172,15 @@ foreach (@ARGV, split(/ /, $config{options}))
if($_ eq "NT") {
$W32 = 1;
$NT = 1;
}
if ($_ eq "linux") {
} elsif ($_ eq "linux") {
$linux=1;
$UNIX=1;
} elsif ($_ eq "aix") {
$aix=1;
$UNIX=1;
} elsif ($_ eq "VMS") {
$VMS=1;
}
$VMS=1 if $_ eq "VMS";
if ($_ eq "zlib" || $_ eq "enable-zlib" || $_ eq "zlib-dynamic"
|| $_ eq "enable-zlib-dynamic") {
$zlib = 1;
@@ -204,11 +208,11 @@ if (!$libname) {
}
# If no platform is given, assume WIN32
if ($W32 + $VMS + $linux == 0) {
if ($W32 + $VMS + $linux + $aix == 0) {
$W32 = 1;
}
die "Please, only one platform at a time"
if ($W32 + $VMS + $linux > 1);
if ($W32 + $VMS + $linux + $aix > 1);
if (!$do_ssl && !$do_crypto)
{
@@ -1237,6 +1241,8 @@ EOF
$prevsymversion = $symversion;
}
print OUT " $s2;\n";
} elsif ($aix) {
print OUT "$s2\n";
} elsif ($VMS) {
while(++$prevnum < $n) {
my $symline=" ,SPARE -\n ,SPARE -\n";
@@ -1288,7 +1294,7 @@ EOF
} elsif ($VMS) {
print OUT ")\n";
(my $libvmaj, my $libvmin, my $libvedit) =
$currversion =~ /^(\d+)_(\d+)_(\d+)$/;
$currversion =~ /^(\d+)_(\d+)_(\d+)[a-z]{0,2}$/;
# The reason to multiply the edit number with 100 is to make space
# for the possibility that we want to encode the patch letters
print OUT "GSMATCH=LEQUAL,",($libvmaj * 100 + $libvmin),",",($libvedit * 100),"\n";
util/perl/OpenSSL/Test.pm
+1 -1
View File
@@ -20,7 +20,7 @@ $VERSION = "0.8";
perlapp perltest subtest));
@EXPORT_OK = (@Test::More::EXPORT_OK, qw(bldtop_dir bldtop_file
srctop_dir srctop_file
data_file
data_file data_dir
pipe with cmdstr quotify
openssl_versions));