diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 00000000..7b384b11 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,14 @@ + + +##### Checklist + +- [ ] documentation is added or updated +- [ ] tests are added or updated diff --git a/.travis-create-release.sh b/.travis-create-release.sh index 311cedd6..b39a0013 100644 --- a/.travis-create-release.sh +++ b/.travis-create-release.sh @@ -5,7 +5,7 @@ ./Configure dist if [ "$1" == osx ]; then make NAME='_srcdist' TARFILE='_srcdist.tar' \ - TAR_COMMAND='$(TAR) $(TARFLAGS) -cvf -' tar + TAR_COMMAND='$(TAR) $(TARFLAGS) -cf -' tar else make TARFILE='_srcdist.tar' NAME='_srcdist' dist fi diff --git a/.travis.yml b/.travis.yml index 0586fb3e..6c0468a9 100644 --- a/.travis.yml +++ b/.travis.yml @@ -124,7 +124,7 @@ before_script: fi - if [ -n "$DESTDIR" ]; then sh .travis-create-release.sh $TRAVIS_OS_NAME; - tar -xvzf _srcdist.tar.gz; + tar -xzf _srcdist.tar.gz; mkdir _build; cd _build; srcdir=../_srcdist; @@ -133,14 +133,14 @@ before_script: srcdir=.; top=.; fi - - if [ "$CC" == i686-w64-mingw32-gcc ]; then + - if [ "$CC" = i686-w64-mingw32-gcc ]; then export CROSS_COMPILE=${CC%%gcc}; unset CC; $srcdir/Configure mingw $CONFIG_OPTS -Wno-pedantic-ms-format; - elif [ "$CC" == x86_64-w64-mingw32-gcc ]; then + elif [ "$CC" = x86_64-w64-mingw32-gcc ]; then export CROSS_COMPILE=${CC%%gcc}; unset CC; $srcdir/Configure mingw64 $CONFIG_OPTS -Wno-pedantic-ms-format; else - if [ "$CC" == clang-3.9 ]; then + if [ "$CC" = clang-3.9 ]; then sudo cp .travis-apt-pin.preferences /etc/apt/preferences.d/no-ubuntu-clang; curl -sSL "http://apt.llvm.org/llvm-snapshot.gpg.key" | sudo -E apt-key add -; echo "deb http://apt.llvm.org/trusty/ llvm-toolchain-trusty-3.9 main" | sudo tee -a /etc/apt/sources.list > /dev/null; @@ -199,18 +199,22 @@ script: echo -e '+\057\057\057\057 MAKE TEST FAILED'; false; fi; else - if $make build_tests; then + if $make build_tests >~/build.log 2>&1; then echo -e '+\057\057\057\057\057 MAKE BUILD_TESTS OK'; else - echo -e '+\057\057\057\057\057 MAKE BUILD_TESTS FAILED'; false; + echo -e '+\057\057\057\057\057 MAKE BUILD_TESTS FAILED'; + cat ~/build.log + false; fi; fi - if [ -n "$DESTDIR" ]; then mkdir "$top/$DESTDIR"; - if $make install install_docs DESTDIR="$top/$DESTDIR"; then + if $make install install_docs DESTDIR="$top/$DESTDIR" >~/install.log 2>&1 ; then echo -e '+\057\057\057\057\057\057 MAKE INSTALL OK'; else - echo -e '+\057\057\057\057\057\057 MAKE INSTALL FAILED'; false; + echo -e '+\057\057\057\057\057\057 MAKE INSTALL FAILED'; + cat ~/install.log; + false; fi; fi - cd $top diff --git a/CHANGES b/CHANGES index e08644a5..dcbe2916 100644 --- a/CHANGES +++ b/CHANGES @@ -9,6 +9,24 @@ Changes between 1.1.0g and 1.1.1 [xx XXX xxxx] + *) On POSIX (BSD, Linux, ...) systems the ocsp(1) command running + in responder mode now supports the new "-multi" option, which + spawns the specified number of child processes to handle OCSP + requests. The "-timeout" option now also limits the OCSP + responder's patience to wait to receive the full client request + on a newly accepted connection. Child processes are respawned + as needed, and the CA index file is automatically reloaded + when changed. This makes it possible to run the "ocsp" responder + as a long-running service, making the OpenSSL CA somewhat more + feature-complete. In this mode, most diagnostic messages logged + after entering the event loop are logged via syslog(3) rather than + written to stderr. + [Viktor Dukhovni] + + *) Added support for X448 and Ed448. Heavily based on original work by + Mike Hamburg. + [Matt Caswell] + *) Extend OSSL_STORE with capabilities to search and to narrow the set of objects loaded. This adds the functions OSSL_STORE_expect() and OSSL_STORE_find() as well as needed tools to construct searches and @@ -3256,8 +3274,11 @@ to work with OPENSSL_NO_SSL_INTERN defined. [Steve Henson] - *) Add SRP support. - [Tom Wu and Ben Laurie] + *) A long standing patch to add support for SRP from EdelWeb (Peter + Sylvester and Christophe Renou) was integrated. + [Christophe Renou , Peter Sylvester + , Tom Wu , and + Ben Laurie] *) Add functions to copy EVP_PKEY_METHOD and retrieve flags and id. [Steve Henson] diff --git a/Configurations/00-base-templates.conf b/Configurations/00-base-templates.conf index 0350997f..c074bd6e 100644 --- a/Configurations/00-base-templates.conf +++ b/Configurations/00-base-templates.conf @@ -8,6 +8,9 @@ my %targets=( lflags => "", defines => [], includes => [], + lib_cflags => "", + lib_cppflags => "", + lib_defines => [], thread_scheme => "(unknown)", # Assume we don't know thread_defines => [], @@ -46,16 +49,16 @@ my %targets=( build_scheme => [ "unified", "unix" ], build_file => "Makefile", - ar => "ar", - arflags => "r", - cc => "cc", - hashbangperl => "/usr/bin/env perl", - ranlib => sub { which("$config{cross_compile_prefix}ranlib") + AR => "ar", + ARFLAGS => "r", + CC => "cc", + HASHBANGPERL => "/usr/bin/env perl", + RANLIB => sub { which("$config{cross_compile_prefix}ranlib") ? "ranlib" : "" }, - rc => "windres", + RC => "windres", #### THESE WILL BE ENABLED IN OpenSSL 1.2 - #hashbangperl => "PERL", # Only Unix actually cares + #HASHBANGPERL => "PERL", # Only Unix actually cares }, BASE_common => { @@ -84,19 +87,19 @@ my %targets=( inherit_from => [ "BASE_common" ], template => 1, - ar => "ar", - arflags => "r", - cc => "cc", + AR => "ar", + ARFLAGS => "r", + CC => "cc", lflags => sub { $withargs{zlib_lib} ? "-L".$withargs{zlib_lib} : () }, ex_libs => sub { !defined($disabled{zlib}) && defined($disabled{"zlib-dynamic"}) ? "-lz" : () }, - hashbangperl => "/usr/bin/env perl", # Only Unix actually cares - ranlib => sub { which("$config{cross_compile_prefix}ranlib") + HASHBANGPERL => "/usr/bin/env perl", # Only Unix actually cares + RANLIB => sub { which("$config{cross_compile_prefix}ranlib") ? "ranlib" : "" }, - rc => "windres", + RC => "windres", build_scheme => [ "unified", "unix" ], build_file => "Makefile", @@ -106,6 +109,15 @@ my %targets=( inherit_from => [ "BASE_common" ], template => 1, + lib_defines => + sub { + my @defs = (); + unless ($disabled{"zlib-dynamic"}) { + my $zlib = $withargs{zlib_lib} // "ZLIB1"; + push @defs, quotify("perl", 'LIBZ="' . $zlib . '"'); + } + return [ @defs ]; + }, ex_libs => sub { unless ($disabled{zlib}) { @@ -116,16 +128,16 @@ my %targets=( return (); }, - ld => "link", - lflags => "/nologo", - loutflag => "/out:", - ar => "lib", - arflags => "/nologo", + LD => "link", + LDFLAGS => "/nologo", + ldoutflag => "/out:", + AR => "lib", + ARFLAGS => "/nologo", aroutflag => "/out:", - rc => "rc", + RC => "rc", rcoutflag => "/fo", - mt => "mt", - mtflags => "-nologo", + MT => "mt", + MTFLAGS => "-nologo", mtinflag => "-manifest ", mtoutflag => "-outputresource:", diff --git a/Configurations/10-main.conf b/Configurations/10-main.conf index 3ee07176..6c73d9f4 100644 --- a/Configurations/10-main.conf +++ b/Configurations/10-main.conf @@ -6,16 +6,20 @@ my $vc_win64a_info = {}; sub vc_win64a_info { unless (%$vc_win64a_info) { if (`nasm -v 2>NUL` =~ /NASM version ([0-9]+\.[0-9]+)/ && $1 >= 2.0) { - $vc_win64a_info = { as => "nasm", - asflags => "-f win64 -DNEAR -Ox -g", - asoutflag => "-o" }; + $vc_win64a_info = { AS => "nasm", + ASFLAGS => "-g", + asflags => "-Ox -f win64 -DNEAR", + asoutflag => "-o " }; } elsif ($disabled{asm}) { - $vc_win64a_info = { as => "ml64", - asflags => "/c /Cp /Cx /Zi", + # assembler is still used to compile uplink shim + $vc_win64a_info = { AS => "ml64", + ASFLAGS => "/nologo /Zi", + asflags => "/c /Cp /Cx", asoutflag => "/Fo" }; } else { $die->("NASM not found - please read INSTALL and NOTES.WIN for further details\n"); - $vc_win64a_info = { as => "{unknown}", + $vc_win64a_info = { AS => "{unknown}", + ASFLAGS => "", asflags => "", asoutflag => "" }; } @@ -29,18 +33,22 @@ sub vc_win32_info { my $ver=`nasm -v 2>NUL`; my $vew=`nasmw -v 2>NUL`; if ($ver ne "" || $vew ne "") { - $vc_win32_info = { as => $ver ge $vew ? "nasm" : "nasmw", + $vc_win32_info = { AS => $ver ge $vew ? "nasm" : "nasmw", + ASFLAGS => "", asflags => "-f win32", - asoutflag => "-o", + asoutflag => "-o ", perlasm_scheme => "win32n" }; } elsif ($disabled{asm}) { - $vc_win32_info = { as => "ml", - asflags => "/nologo /Cp /coff /c /Cx /Zi", + # not actually used, uplink shim is inlined into C code + $vc_win32_info = { AS => "ml", + ASFLAGS => "/nologo /Zi", + asflags => "/Cp /coff /c /Cx", asoutflag => "/Fo", perlasm_scheme => "win32" }; } else { $die->("NASM not found - please read INSTALL and NOTES.WIN for further details\n"); - $vc_win32_info = { as => "{unknown}", + $vc_win32_info = { AS => "{unknown}", + ASFLAGS => "", asflags => "", asoutflag => "", perlasm_scheme => "win32" }; @@ -150,9 +158,10 @@ sub vms_info { if ($config{target} =~ /-ia64/) { `PIPE ias -H 2> NL:`; if ($? == 0) { - $vms_info->{as} = "ias"; - $vms_info->{asflags} = '-d debug "-N" vms_upcase'; - $vms_info->{asoutflag} = "-o"; + $vms_info->{AS} = "ias"; + $vms_info->{ASFLAGS} = '-d debug'; + $vms_info->{asflags} = '"-N" vms_upcase'; + $vms_info->{asoutflag} = "-o "; $vms_info->{perlasm_scheme} = "ias"; } } @@ -165,27 +174,28 @@ my %targets = ( #### Basic configs that should work on any 32-bit box "gcc" => { inherit_from => [ "BASE_unix" ], - cc => "gcc", - cflags => picker(debug => "-O0 -g", + CC => "gcc", + CFLAGS => picker(debug => "-O0 -g", release => "-O3"), thread_scheme => "(unknown)", bn_ops => "BN_LLONG", }, "cc" => { inherit_from => [ "BASE_unix" ], - cc => "cc", - cflags => "-O", + CC => "cc", + CFLAGS => "-O", thread_scheme => "(unknown)", }, #### VOS Configurations "vos-gcc" => { inherit_from => [ "BASE_unix" ], - cc => "gcc", - cflags => picker(default => "-Wall", + CC => "gcc", + CFLAGS => picker(default => "-Wall", debug => "-O0 -g", release => "-O3"), - cppflags => "-D_POSIX_C_SOURCE=200112L -D_BSD -D_VOS_EXTENDED_NAMES -DB_ENDIAN", + cppflags => "-D_POSIX_C_SOURCE=200112L -D_BSD -D_VOS_EXTENDED_NAMES", + lib_cppflags => "-DB_ENDIAN", thread_scheme => "(unknown)", sys_id => "VOS", lflags => add("-Wl,-map"), @@ -197,7 +207,7 @@ my %targets = ( "solaris-common" => { inherit_from => [ "BASE_unix" ], template => 1, - cppflags => "-DFILIO_H", + lib_cppflags => "-DFILIO_H", ex_libs => add("-lsocket -lnsl -ldl"), dso_scheme => "dlfcn", thread_scheme => "pthreads", @@ -210,12 +220,12 @@ my %targets = ( # /usr/ccs/bin/as. Failure to comply will result in compile # failures [at least] in 32-bit build. inherit_from => [ "solaris-common", asm("x86_elf_asm") ], - cc => "gcc", - cflags => add_before(picker(default => "-Wall", + CC => "gcc", + CFLAGS => add_before(picker(default => "-Wall", debug => "-O0 -g", - release => "-O3 -fomit-frame-pointer"), - threads("-pthread")), - cppflags => add("-DL_ENDIAN"), + release => "-O3 -fomit-frame-pointer")), + cflags => add(threads("-pthread")), + lib_cppflags => add("-DL_ENDIAN"), ex_libs => add(threads("-pthread")), bn_ops => "BN_LLONG", shared_cflag => "-fPIC", @@ -231,12 +241,12 @@ my %targets = ( # to consider using gcc shared build even with vendor compiler:-) # -- inherit_from => [ "solaris-common", asm("x86_64_asm") ], - cc => "gcc", - cflags => add_before(picker(default => "-m64 -Wall", + CC => "gcc", + CFLAGS => add_before(picker(default => "-Wall", debug => "-O0 -g", - release => "-O3"), - threads("-pthread")), - cppflags => add("-DL_ENDIAN"), + release => "-O3")), + cflags => add_before("-m64", threads("-pthread")), + lib_cppflags => add("-DL_ENDIAN"), ex_libs => add(threads("-pthread")), bn_ops => "SIXTY_FOUR_BIT_LONG", perlasm_scheme => "elf", @@ -260,11 +270,12 @@ my %targets = ( # "solaris64-x86_64-cc" => { inherit_from => [ "solaris-common", asm("x86_64_asm") ], - cc => "cc", - cflags => add_before(picker(default => "-xarch=generic64 -xstrconst -Xa", - debug => "-g", + CC => "cc", + CFLAGS => add_before(picker(debug => "-g", release => "-xO5 -xdepend -xbuiltin")), - cppflags => add("-DL_ENDIAN", threads("-D_REENTRANT")), + cflags => add_before("-xarch=generic64 -xstrconst -Xa"), + cppflags => add(threads("-D_REENTRANT")), + lib_cppflags => add("-DL_ENDIAN"), thread_scheme => "pthreads", lflags => add(threads("-mt")), ex_libs => add(threads("-lpthread")), @@ -278,12 +289,12 @@ my %targets = ( #### SPARC Solaris with GNU C setups "solaris-sparcv7-gcc" => { inherit_from => [ "solaris-common" ], - cc => "gcc", - cflags => add_before(picker(default => "-Wall", + CC => "gcc", + CFLAGS => add_before(picker(default => "-Wall", debug => "-O0 -g", - release => "-O3"), - threads("-pthread")), - cppflags => add("-DB_ENDIAN -DBN_DIV2W"), + release => "-O3")), + cflags => add(threads("-pthread")), + lib_cppflags => add("-DB_ENDIAN -DBN_DIV2W"), ex_libs => add(threads("-pthread")), bn_ops => "BN_LLONG RC4_CHAR", shared_cflag => "-fPIC", @@ -312,12 +323,12 @@ my %targets = ( # SC5.0 note: Compiler common patch 107357-01 or later is required! "solaris-sparcv7-cc" => { inherit_from => [ "solaris-common" ], - cc => "cc", - cflags => add_before(picker(default => "-xstrconst -Xa", - debug => "-g", + CC => "cc", + CFLAGS => add_before(picker(debug => "-g", release => "-xO5 -xdepend")), - cppflags => add("-DB_ENDIAN -DBN_DIV2W", - threads("-D_REENTRANT")), + cflags => add_before("-xstrconst -Xa"), + cppflags => add(threads("-D_REENTRANT")), + lib_cppflags => add("-DB_ENDIAN -DBN_DIV2W"), lflags => add(threads("-mt")), ex_libs => add(threads("-lpthread")), bn_ops => "BN_LLONG RC4_CHAR", @@ -344,12 +355,14 @@ my %targets = ( # Only N32 and N64 ABIs are supported. "irix-mips3-gcc" => { inherit_from => [ "BASE_unix", asm("mips64_asm") ], - cc => "gcc", - cflags => combine(picker(default => "-mabi=n32", - debug => "-g -O0", - release => "-O3")), + CC => "gcc", + CFLAGS => picker(debug => "-g -O0", + release => "-O3"), + cflags => "-mabi=n32", cppflags => combine("-DB_ENDIAN -DBN_DIV3W", threads("-D_SGI_MP_SOURCE")), + cppflags => threads("-D_SGI_MP_SOURCE"), + lib_cppflags => "-DB_ENDIAN -DBN_DIV3W", ex_libs => add(threads("-lpthread")), bn_ops => "RC4_CHAR SIXTY_FOUR_BIT", thread_scheme => "pthreads", @@ -361,12 +374,12 @@ my %targets = ( }, "irix-mips3-cc" => { inherit_from => [ "BASE_unix", asm("mips64_asm") ], - cc => "cc", - cflags => combine(picker(default => "-n32 -mips3 -use_readonly_const -G0 -rdata_shared", - debug => "-g -O0", - release => "-O2")), - cppflags => combine("-DB_ENDIAN -DBN_DIV3W", - threads("-D_SGI_MP_SOURCE")), + CC => "cc", + CFLAGS => picker(debug => "-g -O0", + release => "-O2"), + cflags => "-n32 -mips3 -use_readonly_const -G0 -rdata_shared", + cppflags => threads("-D_SGI_MP_SOURCE"), + lib_cppflags => "-DB_ENDIAN -DBN_DIV3W", ex_libs => add(threads("-lpthread")), bn_ops => "RC4_CHAR SIXTY_FOUR_BIT", thread_scheme => "pthreads", @@ -379,12 +392,12 @@ my %targets = ( # N64 ABI builds. "irix64-mips4-gcc" => { inherit_from => [ "BASE_unix", asm("mips64_asm") ], - cc => "gcc", - cflags => combine(picker(default => "-mabi=64 -mips4", - debug => "-g -O0", - release => "-O3")), - cppflags => combine("-DB_ENDIAN -DBN_DIV3W", - threads("-D_SGI_MP_SOURCE")), + CC => "gcc", + CFLAGS => picker(debug => "-g -O0", + release => "-O3"), + cflags => "-mabi=64 -mips4", + cppflags => threads("-D_SGI_MP_SOURCE"), + lib_cppflags => "-DB_ENDIAN -DBN_DIV3W", ex_libs => add(threads("-lpthread")), bn_ops => "RC4_CHAR SIXTY_FOUR_BIT_LONG", thread_scheme => "pthreads", @@ -396,13 +409,13 @@ my %targets = ( }, "irix64-mips4-cc" => { inherit_from => [ "BASE_unix", asm("mips64_asm") ], - cc => "cc", - cflags => combine(picker(default => "-64 -mips4 -use_readonly_const -G0 -rdata_shared", - debug => "-g -O0", - release => "-O2")), - cppflags => combine("-DB_ENDIAN -DBN_DIV3W", - threads("-D_SGI_MP_SOURCE")), - ex_libs => add(threads("-lpthread")), + CC => "cc", + CFLAGS => picker(debug => "-g -O0", + release => "-O2"), + cflags => "-64 -mips4 -use_readonly_const -G0 -rdata_shared", + cppflags => threads("-D_SGI_MP_SOURCE"), + lib_cppflags => "-DB_ENDIAN -DBN_DIV3W", + ex_libs => threads("-lpthread"), bn_ops => "RC4_CHAR SIXTY_FOUR_BIT_LONG", thread_scheme => "pthreads", perlasm_scheme => "64", @@ -441,11 +454,11 @@ my %targets = ( # thus adequate performance is provided even with PA-RISC 1.1 build. "hpux-parisc-gcc" => { inherit_from => [ "BASE_unix" ], - cc => "gcc", - cflags => combine(picker(debug => "-O0 -g", - release => "-O3"), - threads("-pthread")), - cppflags => "-DB_ENDIAN -DBN_DIV2W", + CC => "gcc", + CFLAGS => picker(debug => "-O0 -g", + release => "-O3"), + cflags => add(threads("-pthread")), + lib_cppflags => "-DB_ENDIAN -DBN_DIV2W", ex_libs => add("-Wl,+s -ldld", threads("-pthread")), bn_ops => "BN_LLONG", thread_scheme => "pthreads", @@ -461,10 +474,11 @@ my %targets = ( }, "hpux64-parisc2-gcc" => { inherit_from => [ "BASE_unix", asm("parisc20_64_asm") ], - cc => "gcc", - cflags => combine(picker(debug => "-O0 -g", + CC => "gcc", + CFLAGS => combine(picker(debug => "-O0 -g", release => "-O3")), - cppflags => combine("-DB_ENDIAN", threads("-D_REENTRANT")), + cppflags => threads("-D_REENTRANT"), + lib_cppflags => "-DB_ENDIAN", ex_libs => add("-ldl"), bn_ops => "SIXTY_FOUR_BIT_LONG RC4_CHAR", thread_scheme => "pthreads", @@ -479,12 +493,12 @@ my %targets = ( # More attempts at unified 10.X and 11.X targets for HP C compiler. "hpux-parisc-cc" => { inherit_from => [ "BASE_unix" ], - cc => "cc", - cflags => combine(picker(default => "+Optrs_strongly_typed -Ae +ESlit", - debug => "+O0 +d -g", - release => "+O3")), - cppflags => combine("-DB_ENDIAN -DBN_DIV2W -DMD32_XARRAY", - threads("-D_REENTRANT")), + CC => "cc", + CFLAGS => picker(debug => "+O0 +d -g", + release => "+O3"), + cflags => "+Optrs_strongly_typed -Ae +ESlit", + cppflags => threads("-D_REENTRANT"), + lib_cppflags => "-DB_ENDIAN -DBN_DIV2W -DMD32_XARRAY", ex_libs => add("-Wl,+s -ldld",threads("-lpthread")), bn_ops => "RC4_CHAR", thread_scheme => "pthreads", @@ -501,12 +515,12 @@ my %targets = ( }, "hpux64-parisc2-cc" => { inherit_from => [ "BASE_unix", asm("parisc20_64_asm") ], - cc => "cc", - cflags => combine(picker(default => "+DD64 +Optrs_strongly_typed -Ae +ESlit", - debug => "+O0 +d -g", - release => "+O3")), - cppflags => combine("-DB_ENDIAN -DMD32_XARRAY", - threads("-D_REENTRANT")), + CC => "cc", + CFLAGS => picker(debug => "+O0 +d -g", + release => "+O3") , + cflags => "+DD64 +Optrs_strongly_typed -Ae +ESlit", + cppflags => threads("-D_REENTRANT") , + lib_cppflags => "-DB_ENDIAN -DMD32_XARRAY", ex_libs => add("-ldl",threads("-lpthread")), bn_ops => "SIXTY_FOUR_BIT_LONG RC4_CHAR", thread_scheme => "pthreads", @@ -521,11 +535,12 @@ my %targets = ( # HP/UX IA-64 targets "hpux-ia64-cc" => { inherit_from => [ "BASE_unix", asm("ia64_asm") ], - cc => "cc", - cflags => combine(picker(default => "-Ae +DD32 +Olit=all -z", - debug => "+O0 +d -g", - release => "+O2")), - cppflags => combine("-DB_ENDIAN", threads("-D_REENTRANT")), + CC => "cc", + CFLAGS => picker(debug => "+O0 +d -g", + release => "+O2"), + cflags => "-Ae +DD32 +Olit=all -z", + cppflags => add(threads("-D_REENTRANT")), + lib_cppflags => "-DB_ENDIAN", ex_libs => add("-ldl",threads("-lpthread")), bn_ops => "SIXTY_FOUR_BIT", thread_scheme => "pthreads", @@ -538,11 +553,12 @@ my %targets = ( }, "hpux64-ia64-cc" => { inherit_from => [ "BASE_unix", asm("ia64_asm") ], - cc => "cc", - cflags => combine(picker(default => "-Ae +DD64 +Olit=all -z", - debug => "+O0 +d -g", - release => "+O3")), - cppflags => combine("-DB_ENDIAN", threads("-D_REENTRANT")), + CC => "cc", + CFLAGS => picker(debug => "+O0 +d -g", + release => "+O3"), + cflags => "-Ae +DD64 +Olit=all -z", + cppflags => threads("-D_REENTRANT"), + lib_cppflags => "-DB_ENDIAN", ex_libs => add("-ldl", threads("-lpthread")), bn_ops => "SIXTY_FOUR_BIT_LONG", thread_scheme => "pthreads", @@ -556,11 +572,11 @@ my %targets = ( # GCC builds... "hpux-ia64-gcc" => { inherit_from => [ "BASE_unix", asm("ia64_asm") ], - cc => "gcc", - cflags => combine(picker(debug => "-O0 -g", - release => "-O3"), - threads("-pthread")), - cppflags => "-DB_ENDIAN", + CC => "gcc", + CFLAGS => picker(debug => "-O0 -g", + release => "-O3"), + cflags => add(threads("-pthread")), + lib_cppflags => "-DB_ENDIAN", ex_libs => add("-ldl", threads("-pthread")), bn_ops => "SIXTY_FOUR_BIT", thread_scheme => "pthreads", @@ -573,12 +589,11 @@ my %targets = ( }, "hpux64-ia64-gcc" => { inherit_from => [ "BASE_unix", asm("ia64_asm") ], - cc => "gcc", - cflags => combine(picker(default => "-mlp64", - debug => "-O0 -g", - release => "-O3"), - threads("-pthread")), - cppflags => "-DB_ENDIAN", + CC => "gcc", + CFLAGS => picker(debug => "-O0 -g", + release => "-O3"), + cflags => combine("-mlp64", threads("-pthread")), + lib_cppflags => "-DB_ENDIAN", ex_libs => add("-ldl", threads("-pthread")), bn_ops => "SIXTY_FOUR_BIT_LONG", thread_scheme => "pthreads", @@ -593,10 +608,11 @@ my %targets = ( #### HP MPE/iX http://jazz.external.hp.com/src/openssl/ "MPE/iX-gcc" => { inherit_from => [ "BASE_unix" ], - cc => "gcc", - cflags => "-O3", - cppflags => "-D_ENDIAN -DBN_DIV2W -D_POSIX_SOURCE -D_SOCKET_SOURCE", - includes => add("/SYSLOG/PUB"), + CC => "gcc", + CFLAGS => "-O3", + cppflags => "-D_POSIX_SOURCE -D_SOCKET_SOURCE", + includes => [ "/SYSLOG/PUB" ], + lib_cppflags => "-DBN_DIV2W", sys_id => "MPE", lflags => add("-L/SYSLOG/PUB"), ex_libs => add("-lsyslog -lsocket -lcurses"), @@ -610,8 +626,9 @@ my %targets = ( #### but not anymore... "tru64-alpha-gcc" => { inherit_from => [ "BASE_unix", asm("alpha_asm") ], - cc => "gcc", - cflags => combine("-std=c9x -O3", threads("-pthread")), + CC => "gcc", + CFLAGS => "-O3", + cflags => add("-std=c9x", threads("-pthread")), cppflags => "-D_XOPEN_SOURCE=500 -D_OSF_SOURCE", ex_libs => add("-lrt", threads("-pthread")), # for mlock(2) bn_ops => "SIXTY_FOUR_BIT_LONG", @@ -622,9 +639,10 @@ my %targets = ( }, "tru64-alpha-cc" => { inherit_from => [ "BASE_unix", asm("alpha_asm") ], - cc => "cc", - cflags => combine("-std1 -tune host -fast -readonly_strings", - threads("-pthread")), + CC => "cc", + CFLAGS => "-tune host -fast", + cflags => add("-std1 -readonly_strings", + threads("-pthread")), cppflags => "-D_XOPEN_SOURCE=500 -D_OSF_SOURCE", ex_libs => add("-lrt", threads("-pthread")), # for mlock(2) bn_ops => "SIXTY_FOUR_BIT_LONG", @@ -642,17 +660,17 @@ my %targets = ( # throw in -D[BL]_ENDIAN, whichever appropriate... "linux-generic32" => { inherit_from => [ "BASE_unix" ], - cc => "gcc", - cxx => "g++", - cflags => combine(picker(default => "-Wall", - debug => "-O0 -g", - release => "-O3"), - threads("-pthread")), - cxxflags => combine(picker(default => "-std=c++11 -Wall", - debug => "-O0 -g", - release => "-O3"), - threads("-pthread")), - cppflags => "-DOPENSSL_USE_NODELETE", + CC => "gcc", + CXX => "g++", + CFLAGS => picker(default => "-Wall", + debug => "-O0 -g", + release => "-O3"), + CXXFLAGS => picker(default => "-Wall", + debug => "-O0 -g", + release => "-O3"), + cflags => threads("-pthread"), + cxxflags => combine("-std=c++11", threads("-pthread")), + lib_cppflags => "-DOPENSSL_USE_NODELETE", ex_libs => add("-ldl", threads("-pthread")), bn_ops => "BN_LLONG RC4_CHAR", thread_scheme => "pthreads", @@ -674,14 +692,16 @@ my %targets = ( "linux-ppc64" => { inherit_from => [ "linux-generic64", asm("ppc64_asm") ], cflags => add("-m64"), - cppflags => add("-DB_ENDIAN"), + cxxflags => add("-m64"), + lib_cppflags => add("-DB_ENDIAN"), perlasm_scheme => "linux64", multilib => "64", }, "linux-ppc64le" => { inherit_from => [ "linux-generic64", asm("ppc64_asm") ], cflags => add("-m64"), - cppflags => add("-DL_ENDIAN"), + cxxflags => add("-m64"), + lib_cppflags => add("-DL_ENDIAN"), perlasm_scheme => "linux64le", }, @@ -727,6 +747,7 @@ my %targets = ( "linux-arm64ilp32" => { # https://wiki.linaro.org/Platform/arm64-ilp32 inherit_from => [ "linux-generic32", asm("aarch64_asm") ], cflags => add("-mabi=ilp32"), + cxxflags => add("-mabi=ilp32"), bn_ops => "SIXTY_FOUR_BIT RC4_CHAR", perlasm_scheme => "linux64", }, @@ -736,7 +757,8 @@ my %targets = ( # support, if no -march was specified at command line. inherit_from => [ "linux-generic32", asm("mips32_asm") ], cflags => add("-mabi=32"), - cppflags => add("-DBN_DIV3W"), + cxxflags => add("-mabi=32"), + lib_cppflags => add("-DBN_DIV3W"), perlasm_scheme => "o32", }, # mips32 and mips64 below refer to contemporary MIPS Architecture @@ -744,7 +766,8 @@ my %targets = ( "linux-mips64" => { inherit_from => [ "linux-generic32", asm("mips64_asm") ], cflags => add("-mabi=n32"), - cppflags => add("-DBN_DIV3W"), + cxxflags => add("-mabi=n32"), + lib_cppflags => add("-DBN_DIV3W"), bn_ops => "SIXTY_FOUR_BIT RC4_CHAR", perlasm_scheme => "n32", multilib => "32", @@ -752,7 +775,8 @@ my %targets = ( "linux64-mips64" => { inherit_from => [ "linux-generic64", asm("mips64_asm") ], cflags => add("-mabi=64"), - cppflags => add("-DBN_DIV3W"), + cxxflags => add("-mabi=64"), + lib_cppflags => add("-DBN_DIV3W"), perlasm_scheme => "64", multilib => "64", }, @@ -762,17 +786,17 @@ my %targets = ( #### machines where gcc doesn't understand -m32 and -m64 "linux-elf" => { inherit_from => [ "linux-generic32", asm("x86_elf_asm") ], - cflags => add(picker(release => "-fomit-frame-pointer")), - cppflags => add("-DL_ENDIAN"), + CFLAGS => add(picker(release => "-fomit-frame-pointer")), + lib_cppflags => add("-DL_ENDIAN"), bn_ops => "BN_LLONG", }, "linux-aout" => { inherit_from => [ "BASE_unix", asm("x86_asm") ], - cc => "gcc", - cflags => add(picker(default => "-Wall", + CC => "gcc", + CFLAGS => add(picker(default => "-Wall", debug => "-O0 -g", release => "-O3 -fomit-frame-pointer")), - cppflags => add("-DL_ENDIAN"), + lib_cppflags => add("-DL_ENDIAN"), bn_ops => "BN_LLONG", thread_scheme => "(unknown)", perlasm_scheme => "a.out", @@ -781,36 +805,37 @@ my %targets = ( #### X86 / X86_64 targets "linux-x86" => { inherit_from => [ "linux-generic32", asm("x86_asm") ], - cflags => add(picker(default => "-m32", - release => "-fomit-frame-pointer")), - cppflags => add("-DL_ENDIAN"), + CFLAGS => add(picker(release => "-fomit-frame-pointer")), + cflags => add("-m32"), + cxxflags => add("-m32"), + lib_cppflags => add("-DL_ENDIAN"), bn_ops => "BN_LLONG", perlasm_scheme => "elf", }, "linux-x86-clang" => { inherit_from => [ "linux-x86" ], - cc => "clang", - cxx => "clang++", - cflags => add("-Wextra"), + CC => "clang", + CXX => "clang++", }, "linux-x86_64" => { inherit_from => [ "linux-generic64", asm("x86_64_asm") ], cflags => add("-m64"), - cppflags => add("-DL_ENDIAN"), + cxxflags => add("-m64"), + lib_cppflags => add("-DL_ENDIAN"), bn_ops => "SIXTY_FOUR_BIT_LONG", perlasm_scheme => "elf", multilib => "64", }, "linux-x86_64-clang" => { inherit_from => [ "linux-x86_64" ], - cc => "clang", - cxx => "clang++", - cflags => add("-Wextra"), + CC => "clang", + CXX => "clang++", }, "linux-x32" => { inherit_from => [ "linux-generic32", asm("x86_64_asm") ], cflags => add("-mx32"), - cppflags => add("-DL_ENDIAN"), + cxxflags => add("-mx32"), + lib_cppflags => add("-DL_ENDIAN"), bn_ops => "SIXTY_FOUR_BIT", perlasm_scheme => "elf32", multilib => "x32", @@ -824,7 +849,8 @@ my %targets = ( "linux64-s390x" => { inherit_from => [ "linux-generic64", asm("s390x_asm") ], cflags => add("-m64"), - cppflags => add("-DB_ENDIAN"), + cxxflags => add("-m64"), + lib_cppflags => add("-DB_ENDIAN"), perlasm_scheme => "64", multilib => "64", }, @@ -847,7 +873,8 @@ my %targets = ( # inherit_from => [ "linux-generic32", asm("s390x_asm") ], cflags => add("-m31 -Wa,-mzarch"), - cppflags => add("-DB_ENDIAN"), + cxxflags => add("-m31 -Wa,-mzarch"), + lib_cppflags => add("-DB_ENDIAN"), bn_asm_src => sub { my $r=join(" ",@_); $r=~s|asm/s390x\.S|bn_asm.c|; $r; }, perlasm_scheme => "31", multilib => "/highgprs", @@ -857,34 +884,39 @@ my %targets = ( "linux-sparcv8" => { inherit_from => [ "linux-generic32", asm("sparcv8_asm") ], cflags => add("-mcpu=v8"), - cppflags => add("-DB_ENDIAN -DBN_DIV2W"), + cxxflags => add("-mcpu=v8"), + lib_cppflags => add("-DB_ENDIAN -DBN_DIV2W"), }, "linux-sparcv9" => { # it's a real mess with -mcpu=ultrasparc option under Linux, # but -Wa,-Av8plus should do the trick no matter what. inherit_from => [ "linux-generic32", asm("sparcv9_asm") ], cflags => add("-m32 -mcpu=ultrasparc -Wa,-Av8plus"), - cppflags => add("-DB_ENDIAN -DBN_DIV2W"), + cxxflags => add("-m32 -mcpu=ultrasparc -Wa,-Av8plus"), + lib_cppflags => add("-DB_ENDIAN -DBN_DIV2W"), }, "linux64-sparcv9" => { # GCC 3.1 is a requirement inherit_from => [ "linux-generic64", asm("sparcv9_asm") ], cflags => add("-m64 -mcpu=ultrasparc"), - cppflags => add("-DB_ENDIAN"), + cxxflags => add("-m64 -mcpu=ultrasparc"), + lib_cppflags => add("-DB_ENDIAN"), bn_ops => "BN_LLONG RC4_CHAR", multilib => "64", }, "linux-alpha-gcc" => { inherit_from => [ "linux-generic64", asm("alpha_asm") ], - cppflags => add("-DL_ENDIAN"), + lib_cppflags => add("-DL_ENDIAN"), bn_ops => "SIXTY_FOUR_BIT_LONG", }, "linux-c64xplus" => { inherit_from => [ "BASE_unix" ], # TI_CGT_C6000_7.3.x is a requirement - cc => "cl6x", - cflags => "--linux -ea=.s -eo=.o -mv6400+ -o2 -ox -ms -pden", + CC => "cl6x", + CFLAGS => "-o2 -ox -ms", + cflags => "--linux -ea=.s -eo=.o -mv6400+ -pden", + cxxflags => "--linux -ea=.s -eo=.o -mv6400+ -pden", cppflags => combine("-DOPENSSL_SMALL_FOOTPRINT", threads("-D_REENTRANT")), bn_ops => "BN_LLONG", @@ -906,97 +938,6 @@ my %targets = ( ranlib => "true", }, -#### Android: linux-* but without pointers to headers and libs. - # - # It takes pair of prior-set environment variables to make it work: - # - # CROSS_SYSROOT=/some/where/android-ndk-/platforms/android-/arch- - # CROSS_COMPILE= - # - # As well as PATH adjusted to cover ${CROSS_COMPILE}gcc and company. - # For example to compile for ICS and ARM with NDK 10d, you'd: - # - # ANDROID_NDK=/some/where/android-ndk-10d - # CROSS_SYSROOT=$ANDROID_NDK/platforms/android-14/arch-arm - # CROSS_COMPILE=arm-linux-androideabi- - # PATH=$ANDROID_NDK/toolchains/arm-linux-androideabi-4.8/prebuild/linux-x86_64/bin - # - "android" => { - inherit_from => [ "linux-generic32" ], - # Special note about unconditional -fPIC and -pie. The underlying - # reason is that Lollipop refuses to run non-PIE. But what about - # older systems and NDKs? -fPIC was never problem, so the only - # concern is -pie. Older toolchains, e.g. r4, appear to handle it - # and binaries turn mostly functional. "Mostly" means that oldest - # Androids, such as Froyo, fail to handle executable, but newer - # systems are perfectly capable of executing binaries targeting - # Froyo. Keep in mind that in the nutshell Android builds are - # about JNI, i.e. shared libraries, not applications. - cflags => add(picker(default => "-mandroid -fPIC --sysroot=\$(CROSS_SYSROOT) -Wa,--noexecstack")), - bin_cflags => "-pie", - }, - "android-x86" => { - inherit_from => [ "android", asm("x86_asm") ], - cflags => add(picker(release => "-fomit-frame-pointer")), - bn_ops => "BN_LLONG", - perlasm_scheme => "android", - }, - ################################################################ - # Contemporary Android applications can provide multiple JNI - # providers in .apk, targeting multiple architectures. Among - # them there is "place" for two ARM flavours: generic eabi and - # armv7-a/hard-float. However, it should be noted that OpenSSL's - # ability to engage NEON is not constrained by ABI choice, nor - # is your ability to call OpenSSL from your application code - # compiled with floating-point ABI other than default 'soft'. - # [Latter thanks to __attribute__((pcs("aapcs"))) declaration.] - # This means that choice of ARM libraries you provide in .apk - # is driven by application needs. For example if application - # itself benefits from NEON or is floating-point intensive, then - # it might be appropriate to provide both libraries. Otherwise - # just generic eabi would do. But in latter case it would be - # appropriate to - # - # ./Configure android-armeabi -D__ARM_MAX_ARCH__=8 - # - # in order to build "universal" binary and allow OpenSSL take - # advantage of NEON when it's available. - # - "android-armeabi" => { - inherit_from => [ "android", asm("armv4_asm") ], - }, - "android-mips" => { - inherit_from => [ "android", asm("mips32_asm") ], - perlasm_scheme => "o32", - }, - - "android64" => { - inherit_from => [ "linux-generic64" ], - cflags => add(picker(default => "-mandroid -fPIC --sysroot=\$(CROSS_SYSROOT) -Wa,--noexecstack")), - bin_cflags => "-pie", - }, - "android64-aarch64" => { - inherit_from => [ "android64", asm("aarch64_asm") ], - perlasm_scheme => "linux64", - }, - "android64-x86_64" => { - inherit_from => [ "android64", asm("x86_64_asm") ], - perlasm_scheme => "elf", - }, - "android64-mips64" => { - ############################################################ - # You are more than likely have to specify target processor - # on ./Configure command line. Trouble is that toolchain's - # default is MIPS64r6 (at least in r10d), but there are no - # such processors around (or they are too rare to spot one). - # Actual problem is that MIPS64r6 is binary incompatible - # with previous MIPS ISA versions, in sense that unlike - # prior versions original MIPS binary code will fail. - # - inherit_from => [ "android64", asm("mips64_asm") ], - perlasm_scheme => "64", - }, - #### *BSD "BSD-generic32" => { # As for thread cflag. Idea is to maintain "collective" set of @@ -1007,11 +948,11 @@ my %targets = ( # -D_THREAD_SAFE and sometimes -D_REENTRANT. FreeBSD 5.x # expands it as -lc_r, which seems to be sufficient? inherit_from => [ "BASE_unix" ], - cc => "cc", - cflags => combine(picker(default => "-Wall", - debug => "-O0 -g", - release => "-O3"), - threads("-pthread")), + CC => "cc", + CFLAGS => picker(default => "-Wall", + debug => "-O0 -g", + release => "-O3"), + cflags => threads("-pthread"), cppflags => threads("-D_THREAD_SAFE -D_REENTRANT"), ex_libs => add(threads("-pthread")), enable => add("devcryptoeng"), @@ -1029,8 +970,8 @@ my %targets = ( "BSD-x86" => { inherit_from => [ "BSD-generic32", asm("x86_asm") ], - cflags => add(picker(release => "-fomit-frame-pointer")), - cppflags => add("-DL_ENDIAN"), + CFLAGS => add(picker(release => "-fomit-frame-pointer")), + lib_cppflags => add("-DL_ENDIAN"), bn_ops => "BN_LLONG", shared_target => "bsd-shared", perlasm_scheme => "a.out", @@ -1043,35 +984,35 @@ my %targets = ( "BSD-sparcv8" => { inherit_from => [ "BSD-generic32", asm("sparcv8_asm") ], cflags => add("-mcpu=v8"), - cppflags => add("-DB_ENDIAN"), + lib_cppflags => add("-DB_ENDIAN"), }, "BSD-sparc64" => { # -DMD32_REG_T=int doesn't actually belong in sparc64 target, it # simply *happens* to work around a compiler bug in gcc 3.3.3, # triggered by RIPEMD160 code. inherit_from => [ "BSD-generic64", asm("sparcv9_asm") ], - cppflags => add("-DB_ENDIAN -DMD32_REG_T=int"), + lib_cppflags => add("-DB_ENDIAN -DMD32_REG_T=int"), bn_ops => "BN_LLONG", }, "BSD-ia64" => { inherit_from => [ "BSD-generic64", asm("ia64_asm") ], - cppflags => add("-DL_ENDIAN"), + lib_cppflags => add("-DL_ENDIAN"), bn_ops => "SIXTY_FOUR_BIT_LONG", }, "BSD-x86_64" => { inherit_from => [ "BSD-generic64", asm("x86_64_asm") ], - cppflags => add("-DL_ENDIAN"), + lib_cppflags => add("-DL_ENDIAN"), bn_ops => "SIXTY_FOUR_BIT_LONG", perlasm_scheme => "elf", }, "bsdi-elf-gcc" => { inherit_from => [ "BASE_unix", asm("x86_elf_asm") ], - cc => "gcc", - cflags => "-fomit-frame-pointer -O3 -Wall", - cppflags => "-DPERL5 -DL_ENDIAN", + CC => "gcc", + CFLAGS => "-fomit-frame-pointer -O3 -Wall", + lib_cppflags => "-DPERL5 -DL_ENDIAN", ex_libs => add("-ldl"), bn_ops => "BN_LLONG", thread_scheme => "(unknown)", @@ -1083,16 +1024,16 @@ my %targets = ( "nextstep" => { inherit_from => [ "BASE_unix" ], - cc => "cc", - cflags => "-O -Wall", + CC => "cc", + CFLAGS => "-O -Wall", unistd => "", bn_ops => "BN_LLONG", thread_scheme => "(unknown)", }, "nextstep3.3" => { inherit_from => [ "BASE_unix" ], - cc => "cc", - cflags => "-O3 -Wall", + CC => "cc", + CFLAGS => "-O3 -Wall", unistd => "", bn_ops => "BN_LLONG", thread_scheme => "(unknown)", @@ -1101,14 +1042,14 @@ my %targets = ( # QNX "qnx4" => { inherit_from => [ "BASE_unix" ], - cc => "cc", - cflags => "", - cppflags => "-DL_ENDIAN -DTERMIO", + CC => "cc", + CFLAGS => "", + lib_cppflags => "-DL_ENDIAN -DTERMIO", thread_scheme => "(unknown)", }, "QNX6" => { inherit_from => [ "BASE_unix" ], - cc => "gcc", + CC => "gcc", ex_libs => add("-lsocket"), dso_scheme => "dlfcn", shared_target => "bsd-gcc-shared", @@ -1117,9 +1058,9 @@ my %targets = ( }, "QNX6-i386" => { inherit_from => [ "BASE_unix", asm("x86_elf_asm") ], - cc => "gcc", - cflags => "-O2 -Wall", - cppflags => "-DL_ENDIAN", + CC => "gcc", + CFLAGS => "-O2 -Wall", + lib_cppflags => "-DL_ENDIAN", ex_libs => add("-lsocket"), dso_scheme => "dlfcn", shared_target => "bsd-gcc-shared", @@ -1140,25 +1081,27 @@ my %targets = ( # UnixWare 2.0x fails destest with -O. "unixware-2.0" => { inherit_from => [ "BASE_unix" ], - cc => "cc", - cflags => combine(threads("-Kthread")), - cppflags => "-DFILIO_H -DNO_STRINGS_H", + CC => "cc", + cflags => threads("-Kthread"), + lib_cppflags => "-DFILIO_H -DNO_STRINGS_H", ex_libs => add("-lsocket -lnsl -lresolv -lx"), thread_scheme => "uithreads", }, "unixware-2.1" => { inherit_from => [ "BASE_unix" ], - cc => "cc", - cflags => combine("-O", threads("-Kthread")), - cppflags => "-DFILIO_H", + CC => "cc", + CFLAGS => "-O", + cflags => threads("-Kthread"), + lib_cppflags => "-DFILIO_H", ex_libs => add("-lsocket -lnsl -lresolv -lx"), thread_scheme => "uithreads", }, "unixware-7" => { inherit_from => [ "BASE_unix", asm("x86_elf_asm") ], - cc => "cc", - cflags => combine("-O -Kalloca", threads("-Kthread")), - cppflags => "-DFILIO_H", + CC => "cc", + CFLAGS => "-O", + cflags => combine("-Kalloca", threads("-Kthread")), + lib_cppflags => "-DFILIO_H", ex_libs => add("-lsocket -lnsl"), thread_scheme => "uithreads", bn_ops => "BN_LLONG", @@ -1170,10 +1113,10 @@ my %targets = ( }, "unixware-7-gcc" => { inherit_from => [ "BASE_unix", asm("x86_elf_asm") ], - cc => "gcc", - cflags => combine("-O3 -fomit-frame-pointer -Wall"), - cppflags => add("-DL_ENDIAN -DFILIO_H", - threads("-D_REENTRANT")), + CC => "gcc", + CFLAGS => "-O3 -fomit-frame-pointer -Wall", + cppflags => add(threads("-D_REENTRANT")), + lib_cppflags => add("-DL_ENDIAN -DFILIO_H"), ex_libs => add("-lsocket -lnsl"), bn_ops => "BN_LLONG", thread_scheme => "pthreads", @@ -1218,11 +1161,11 @@ my %targets = ( # current value of $OBJECT_MODE. "aix-gcc" => { inherit_from => [ "BASE_unix", asm("ppc32_asm") ], - cc => "gcc", - cflags => combine(picker(debug => "-O0 -g", - release => "-O"), - threads("-pthread")), - cppflags => "-DB_ENDIAN", + CC => "gcc", + CFLAGS => picker(debug => "-O0 -g", + release => "-O"), + cflags => add(threads("-pthread")), + lib_cppflags => "-DB_ENDIAN", ex_libs => add(threads("-pthread")), sys_id => "AIX", bn_ops => "BN_LLONG RC4_CHAR", @@ -1236,12 +1179,11 @@ my %targets = ( }, "aix64-gcc" => { inherit_from => [ "BASE_unix", asm("ppc64_asm") ], - cc => "gcc", - cflags => combine(picker(default => "-maix64", - debug => "-O0 -g", - release => "-O"), - threads("-pthread")), - cppflags => "-DB_ENDIAN", + CC => "gcc", + CFLAGS => picker(debug => "-O0 -g", + release => "-O"), + cflags => combine("-maix64", threads("-pthread")), + lib_cppflags => "-DB_ENDIAN", ex_libs => add(threads("-pthread")), sys_id => "AIX", bn_ops => "SIXTY_FOUR_BIT_LONG RC4_CHAR", @@ -1255,12 +1197,13 @@ my %targets = ( }, "aix-cc" => { inherit_from => [ "BASE_unix", asm("ppc32_asm") ], - cc => "cc", - cflags => combine(picker(default => "-q32 -qmaxmem=16384 -qro -qroconst", - debug => "-O0 -g", - release => "-O"), + CC => "cc", + CFLAGS => picker(debug => "-O0 -g", + release => "-O"), + cflags => combine("-q32 -qmaxmem=16384 -qro -qroconst", threads("-qthreaded")), - cppflags => combine("-DB_ENDIAN", threads("-D_THREAD_SAFE")), + cppflags => threads("-D_THREAD_SAFE"), + lib_cppflags => "-DB_ENDIAN", sys_id => "AIX", bn_ops => "BN_LLONG RC4_CHAR", thread_scheme => "pthreads", @@ -1274,12 +1217,13 @@ my %targets = ( }, "aix64-cc" => { inherit_from => [ "BASE_unix", asm("ppc64_asm") ], - cc => "cc", - cflags => combine(picker(default => "-q64 -qmaxmem=16384 -qro -qroconst", - debug => "-O0 -g", - release => "-O"), + CC => "cc", + CFLAGS => picker(debug => "-O0 -g", + release => "-O"), + cflags => combine("-q64 -qmaxmem=16384 -qro -qroconst", threads("-qthreaded")), - cppflags => combine("-DB_ENDIAN", threads("-D_THREAD_SAFE")), + cppflags => threads("-D_THREAD_SAFE"), + lib_cppflags => "-DB_ENDIAN", sys_id => "AIX", bn_ops => "SIXTY_FOUR_BIT_LONG RC4_CHAR", thread_scheme => "pthreads", @@ -1295,9 +1239,11 @@ my %targets = ( # SIEMENS BS2000/OSD: an EBCDIC-based mainframe "BS2000-OSD" => { inherit_from => [ "BASE_unix" ], - cc => "c89", - cflags => "-O -XLLML -XLLMK -XL", - cppflags => "-DB_ENDIAN -DCHARSET_EBCDIC", + CC => "c89", + CFLAGS => "-O", + cflags => "-XLLML -XLLMK -XL", + cppflags => "-DCHARSET_EBCDIC", + lib_cppflags => "-DB_ENDIAN", ex_libs => add("-lsocket -lnsl"), bn_ops => "THIRTY_TWO_BIT RC4_CHAR", thread_scheme => "(unknown)", @@ -1305,60 +1251,63 @@ my %targets = ( #### Visual C targets # -# Win64 targets, WIN64I denotes IA-64 and WIN64A - AMD64 +# Win64 targets, WIN64I denotes IA-64/Itanium and WIN64A - AMD64 # -# Note about -wd4090, disable warning C4090. This warning returns false +# Note about /wd4090, disable warning C4090. This warning returns false # positives in some situations. Disabling it altogether masks both # legitimate and false cases, but as we compile on multiple platforms, # we rely on other compilers to catch legitimate cases. # # Also note that we force threads no matter what. Configuring "no-threads" # is ignored. +# +# UNICODE is defined in VC-common and applies to all targets. It used to +# be an opt-in option for VC-WIN32, but not anymore. The original reason +# was because ANSI API was *native* system interface for no longer +# supported Windows 9x. Keep in mind that UNICODE only affects how +# OpenSSL libraries interact with underlying OS, it doesn't affect API +# that OpenSSL presents to application. + "VC-common" => { inherit_from => [ "BASE_Windows" ], template => 1, - cc => "cl", - cpp => '$(CC) /EP /C', - cflags => "-W3 -wd4090 -Gs0 -GF -Gy -nologo", - defines => add("OPENSSL_SYS_WIN32", "WIN32_LEAN_AND_MEAN", - "L_ENDIAN", "_CRT_SECURE_NO_DEPRECATE", - "_WINSOCK_DEPRECATED_NO_WARNINGS", - sub { my @defs = (); - unless ($disabled{"zlib-dynamic"}) { - my $zlib = - $withargs{zlib_lib} // "ZLIB1"; - push @defs, - quotify("perl", - 'LIBZ="' . $zlib . '"'); - } - return [ @defs ]; - }), + CC => "cl", + CPP => '$(CC) /EP /C', + CFLAGS => "/W3 /wd4090 /nologo", + LDFLAGS => add("/debug"), coutflag => "/Fo", - lib_cflags => add("/Zi /Fdossl_static"), - dso_cflags => "/Zi /Fddso", - bin_cflags => "/Zi /Fdapp", - lflags => add("/debug"), + defines => add("OPENSSL_SYS_WIN32", "WIN32_LEAN_AND_MEAN", + "UNICODE", "_UNICODE", + "_CRT_SECURE_NO_DEPRECATE", + "_WINSOCK_DEPRECATED_NO_WARNINGS"), + lib_cflags => add("/Zi /Fdossl_static.pdb"), + lib_defines => add("L_ENDIAN"), + dso_cflags => "/Zi /Fddso.pdb", + bin_cflags => "/Zi /Fdapp.pdb", shared_ldflag => "/dll", shared_target => "win-shared", # meaningless except it gives Configure a hint thread_scheme => "winthreads", dso_scheme => "win32", apps_aux_src => add("win32_init.c"), + bn_ops => "EXPORT_VAR_AS_FN", + # additional parameter to build_scheme denotes install-path "flavour" + build_scheme => add("VC-common", { separator => undef }), }, "VC-noCE-common" => { inherit_from => [ "VC-common" ], template => 1, - cflags => add(picker(debug => + CFLAGS => add(picker(debug => '/Od', + release => '/O2')), + cflags => add(picker(default => '/Gs0 /GF /Gy', + debug => sub { - ($disabled{shared} ? "" : "/MDd") - ." /Od"; + ($disabled{shared} ? "" : "/MDd"); }, release => sub { - ($disabled{shared} ? "" : "/MD") - ." /O2"; + ($disabled{shared} ? "" : "/MD"); })), - defines => add(picker(default => [ "UNICODE", "_UNICODE" ], - debug => [ "DEBUG", "_DEBUG" ])), + defines => add(picker(debug => [ "DEBUG", "_DEBUG" ])), lib_cflags => add(sub { $disabled{shared} ? "/MT /Zl" : () }), # Following might/should appears controversial, i.e. defining # /MDd without evaluating $disabled{shared}. It works in @@ -1390,15 +1339,14 @@ my %targets = ( push @ex_libs, 'bufferoverflowu.lib' if (`cl 2>&1` =~ /14\.00\.4[0-9]{4}\./); return join(" ", @_, @ex_libs); }), - bn_ops => "SIXTY_FOUR_BIT EXPORT_VAR_AS_FN", - build_scheme => add("VC-W64", { separator => undef }), + bn_ops => add("SIXTY_FOUR_BIT"), }, "VC-WIN64I" => { inherit_from => [ "VC-WIN64-common", asm("ia64_asm"), sub { $disabled{shared} ? () : "ia64_uplink" } ], - as => "ias", - asflags => "-d debug", - asoutflag => "-o", + AS => "ias", + ASFLAGS => "-d debug", + asoutflag => "-o ", sys_id => "WIN64I", bn_asm_src => sub { return undef unless @_; my $r=join(" ",@_); $r=~s|bn-ia64.s|bn_asm.c|; $r; }, @@ -1408,9 +1356,10 @@ my %targets = ( "VC-WIN64A" => { inherit_from => [ "VC-WIN64-common", asm("x86_64_asm"), sub { $disabled{shared} ? () : "x86_64_uplink" } ], - as => sub { vc_win64a_info()->{as} }, - asflags => sub { vc_win64a_info()->{asflags} }, + AS => sub { vc_win64a_info()->{AS} }, + ASFLAGS => sub { vc_win64a_info()->{ASFLAGS} }, asoutflag => sub { vc_win64a_info()->{asoutflag} }, + asflags => sub { vc_win64a_info()->{asflags} }, sys_id => "WIN64A", bn_asm_src => sub { return undef unless @_; my $r=join(" ",@_); $r=~s|asm/x86_64-gcc|bn_asm|; $r; }, @@ -1418,60 +1367,46 @@ my %targets = ( multilib => "-x64", }, "VC-WIN32" => { - # x86 Win32 target defaults to ANSI API, if you want UNICODE, - # configure with 'perl Configure VC-WIN32 -DUNICODE -D_UNICODE' inherit_from => [ "VC-noCE-common", asm("x86_asm"), sub { $disabled{shared} ? () : "uplink_common" } ], - cflags => add("-WX"), - as => sub { vc_win32_info()->{as} }, - asflags => sub { vc_win32_info()->{asflags} }, + CFLAGS => add("/WX"), + AS => sub { vc_win32_info()->{AS} }, + ASFLAGS => sub { vc_win32_info()->{ASFLAGS} }, asoutflag => sub { vc_win32_info()->{asoutflag} }, - ex_libs => add(sub { - my @ex_libs = (); - # WIN32 UNICODE build gets linked with unicows.lib for - # backward compatibility with Win9x. - push @ex_libs, 'unicows.lib' - if (grep { $_ eq "UNICODE" } @{$user{CPPDEFINES}}); - return join(" ", @ex_libs, @_); - }), + asflags => sub { vc_win32_info()->{asflags} }, sys_id => "WIN32", - bn_ops => "BN_LLONG EXPORT_VAR_AS_FN", + bn_ops => add("BN_LLONG"), perlasm_scheme => sub { vc_win32_info()->{perlasm_scheme} }, - build_scheme => add("VC-W32", { separator => undef }), + # "WOW" stands for "Windows on Windows", and "VC-WOW" engages + # some installation path heuristics in windows-makefile.tmpl... + build_scheme => add("VC-WOW", { separator => undef }), }, "VC-CE" => { inherit_from => [ "VC-common" ], - as => "ml", - asflags => "/nologo /Cp /coff /c /Cx /Zi", - asoutflag => "/Fo", - cc => "cl", + CFLAGS => add(picker(debug => "/Od", + release => "/O1i")), + CPPDEFINES => picker(debug => [ "DEBUG", "_DEBUG" ]), + LDFLAGS => add("/nologo /opt:ref"), cflags => - picker(default => - combine('/W3 /WX /GF /Gy /nologo', - sub { vc_wince_info()->{cflags}; }, - sub { `cl 2>&1` =~ /Version ([0-9]+)\./ && $1>=14 - ? ($disabled{shared} ? " /MT" : " /MD") - : " /MC"; }), - debug => "/Od", - release => "/O1i"), + combine('/GF /Gy', + sub { vc_wince_info()->{cflags}; }, + sub { `cl 2>&1` =~ /Version ([0-9]+)\./ && $1>=14 + ? ($disabled{shared} ? " /MT" : " /MD") + : " /MC"; }), cppflags => sub { vc_wince_info()->{cppflags}; }, - defines => - picker(default => [ "UNICODE", "_UNICODE", "OPENSSL_SYS_WINCE", - "WIN32_LEAN_AND_MEAN", "L_ENDIAN", "DSO_WIN32", - "NO_CHMOD", "OPENSSL_SMALL_FOOTPRINT" ], - debug => [ "DEBUG", "_DEBUG" ]), + lib_defines => add("NO_CHMOD", "OPENSSL_SMALL_FOOTPRINT"), + lib_cppflags => sub { vc_wince_info()->{cppflags}; }, includes => add(combine(sub { defined(env('WCECOMPAT')) ? '$(WCECOMPAT)/include' : (); }, sub { defined(env('PORTSDK_LIBPATH')) ? '$(PORTSDK_LIBPATH)/../../include' : (); })), - lflags => add(combine("/nologo /opt:ref", - sub { vc_wince_info()->{lflags}; }, + lflags => add(combine(sub { vc_wince_info()->{lflags}; }, sub { defined(env('PORTSDK_LIBPATH')) ? "/entry:mainCRTstartup" : (); })), sys_id => "WINCE", - bn_ops => "BN_LLONG EXPORT_VAR_AS_FN", + bn_ops => add("BN_LLONG"), ex_libs => add(sub { my @ex_libs = (); push @ex_libs, 'ws2.lib' unless $disabled{sock}; @@ -1491,19 +1426,20 @@ my %targets = ( if (env('TARGETCPU') eq "X86"); return @ex_libs; }), - build_scheme => add("VC-WCE", { separator => undef }), }, #### MinGW "mingw" => { inherit_from => [ "BASE_unix", asm("x86_asm"), sub { $disabled{shared} ? () : "x86_uplink" } ], - cc => "gcc", - cflags => picker(default => "-m32 -Wall", + CC => "gcc", + CFLAGS => picker(default => "-Wall", debug => "-g -O0", release => "-O3 -fomit-frame-pointer"), - cppflags => combine("-DL_ENDIAN -DWIN32_LEAN_AND_MEAN", - "-DUNICODE -D_UNICODE", threads("-D_MT")), + cflags => "-m32", + cppflags => combine("-DUNICODE -D_UNICODE -DWIN32_LEAN_AND_MEAN", + threads("-D_MT")), + lib_cppflags => "-DL_ENDIAN", sys_id => "MINGW32", ex_libs => add("-lws2_32 -lgdi32 -lcrypt32"), bn_ops => "BN_LLONG EXPORT_VAR_AS_FN", @@ -1528,12 +1464,14 @@ my %targets = ( # environment. And as mingw64 is always consistent with itself, # Applink is never engaged and can as well be omitted. inherit_from => [ "BASE_unix", asm("x86_64_asm") ], - cc => "gcc", - cflags => picker(default => "-m64 -Wall", + CC => "gcc", + CFLAGS => picker(default => "-Wall", debug => "-g -O0", release => "-O3"), - cppflags => combine("-DL_ENDIAN -DWIN32_LEAN_AND_MEAN", - "-DUNICODE -D_UNICODE", threads("-D_MT")), + cflags => "-m64", + cppflags => combine("-DUNICODE -D_UNICODE -DWIN32_LEAN_AND_MEAN", + threads("-D_MT")), + lib_cppflags => "-DL_ENDIAN", sys_id => "MINGW64", ex_libs => add("-lws2_32 -lgdi32 -lcrypt32"), bn_ops => "SIXTY_FOUR_BIT EXPORT_VAR_AS_FN", @@ -1552,18 +1490,18 @@ my %targets = ( #### UEFI "UEFI" => { inherit_from => [ "BASE_unix" ], - cc => "cc", - cflags => "-O", - cppflags => "-DL_ENDIAN", + CC => "cc", + CFLAGS => "-O", + lib_cppflags => "-DL_ENDIAN", sys_id => "UEFI", }, #### UWIN "UWIN" => { inherit_from => [ "BASE_unix" ], - cc => "cc", - cflags => "-O -Wall", - cppflags => "-DTERMIOS -DL_ENDIAN", + CC => "cc", + CFLAGS => "-O -Wall", + lib_cppflags => "-DTERMIOS -DL_ENDIAN", sys_id => "UWIN", bn_ops => "BN_LLONG", dso_scheme => "win32", @@ -1572,11 +1510,11 @@ my %targets = ( #### Cygwin "Cygwin-x86" => { inherit_from => [ "BASE_unix", asm("x86_asm") ], - cc => "gcc", - cflags => picker(default => "-Wall", + CC => "gcc", + CFLAGS => picker(default => "-Wall", debug => "-g -O0", release => "-O3 -fomit-frame-pointer"), - cppflags => "-DTERMIOS -DL_ENDIAN", + lib_cppflags => "-DTERMIOS -DL_ENDIAN", sys_id => "CYGWIN", bn_ops => "BN_LLONG", thread_scheme => "pthread", @@ -1588,11 +1526,11 @@ my %targets = ( }, "Cygwin-x86_64" => { inherit_from => [ "BASE_unix", asm("x86_64_asm") ], - cc => "gcc", - cflags => picker(default => "-Wall", + CC => "gcc", + CFLAGS => picker(default => "-Wall", debug => "-g -O0", release => "-O3"), - cppflags => "-DTERMIOS -DL_ENDIAN", + lib_cppflags => "-DTERMIOS -DL_ENDIAN", sys_id => "CYGWIN", bn_ops => "SIXTY_FOUR_BIT_LONG", thread_scheme => "pthread", @@ -1624,13 +1562,12 @@ my %targets = ( "darwin-common" => { inherit_from => [ "BASE_unix" ], template => 1, - cc => "cc", - cflags => picker(default => "", - debug => "-g -O0", + CC => "cc", + CFLAGS => picker(debug => "-g -O0", release => "-O3"), cppflags => threads("-D_REENTRANT"), + lflags => "-Wl,-search_paths_first", sys_id => "MACOSX", - plib_lflags => "-Wl,-search_paths_first", bn_ops => "BN_LLONG RC4_CHAR", thread_scheme => "pthreads", perlasm_scheme => "osx32", @@ -1646,28 +1583,30 @@ my %targets = ( "darwin-ppc-cc" => { inherit_from => [ "darwin-common", asm("ppc32_asm") ], cflags => add("-arch ppc -std=gnu9x -Wa,-force_cpusubtype_ALL"), - cppflags => add("-DB_ENDIAN"), + lib_cppflags => add("-DB_ENDIAN"), + shared_cflag => add("-fno-common"), perlasm_scheme => "osx32", }, "darwin64-ppc-cc" => { inherit_from => [ "darwin-common", asm("ppc64_asm") ], cflags => add("-arch ppc64 -std=gnu9x"), - cppflags => add("-DB_ENDIAN"), + lib_cppflags => add("-DB_ENDIAN"), bn_ops => "SIXTY_FOUR_BIT_LONG RC4_CHAR", perlasm_scheme => "osx64", }, "darwin-i386-cc" => { inherit_from => [ "darwin-common", asm("x86_asm") ], - cflags => add(picker(default => "-arch i386", - release => "-fomit-frame-pointer")), - cppflags => add("-DL_ENDIAN"), + CFLAGS => add(picker(release => "-fomit-frame-pointer")), + cflags => add("-arch i386"), + lib_cppflags => add("-DL_ENDIAN"), bn_ops => "BN_LLONG RC4_INT", perlasm_scheme => "macosx", }, "darwin64-x86_64-cc" => { inherit_from => [ "darwin-common", asm("x86_64_asm") ], - cflags => add("-arch x86_64 -Wall"), - cppflags => add("-DL_ENDIAN"), + CFLAGS => add("-Wall"), + cflags => add("-arch x86_64"), + lib_cppflags => add("-DL_ENDIAN"), bn_ops => "SIXTY_FOUR_BIT_LONG", perlasm_scheme => "macosx", }, @@ -1713,10 +1652,10 @@ my %targets = ( "hurd-x86" => { inherit_from => [ "BASE_unix" ], inherit_from => [ asm("x86_elf_asm") ], - cc => "gcc", - cflags => combine("-O3 -fomit-frame-pointer -Wall", - threads("-pthread")), - cppflags => "-DL_ENDIAN", + CC => "gcc", + CFLAGS => "-O3 -fomit-frame-pointer -Wall", + cflags => threads("-pthread"), + lib_cppflags => "-DL_ENDIAN", ex_libs => add("-ldl", threads("-pthread")), bn_ops => "BN_LLONG", thread_scheme => "pthreads", @@ -1729,8 +1668,9 @@ my %targets = ( ##### VxWorks for various targets "vxworks-ppc60x" => { inherit_from => [ "BASE_unix" ], - cc => "ccppc", - cflags => "-mrtp -mhard-float -mstrict-align -fno-implicit-fp -O2 -fstrength-reduce -fno-builtin -fno-strict-aliasing -Wall", + CC => "ccppc", + CFLAGS => "-O2 -Wall -fstrength-reduce", + cflags => "-mrtp -mhard-float -mstrict-align -fno-implicit-fp -fno-builtin -fno-strict-aliasing", cppflags => combine("-D_REENTRANT -DPPC32_fp60x -DCPU=PPC32", "_DTOOL_FAMILY=gnu -DTOOL=gnu", "-I\$(WIND_BASE)/target/usr/h", @@ -1741,8 +1681,9 @@ my %targets = ( }, "vxworks-ppcgen" => { inherit_from => [ "BASE_unix" ], - cc => "ccppc", - cflags => "-mrtp -msoft-float -mstrict-align -O1 -fno-builtin -fno-strict-aliasing -Wall", + CC => "ccppc", + CFLAGS => "-O1 -Wall", + cflags => "-mrtp -msoft-float -mstrict-align -fno-builtin -fno-strict-aliasing", cppflags => combine("-D_REENTRANT -DPPC32 -DCPU=PPC32", "-DTOOL_FAMILY=gnu -DTOOL=gnu", "-I\$(WIND_BASE)/target/usr/h", @@ -1753,8 +1694,9 @@ my %targets = ( }, "vxworks-ppc405" => { inherit_from => [ "BASE_unix" ], - cc => "ccppc", - cflags => "-g -msoft-float -mlongcall", + CC => "ccppc", + CFLAGS => "-g", + cflags => "-msoft-float -mlongcall", cppflags => combine("-D_REENTRANT -DPPC32 -DCPU=PPC405", "-DTOOL_FAMILY=gnu -DTOOL=gnu", "-I\$(WIND_BASE)/target/h"), @@ -1763,8 +1705,9 @@ my %targets = ( }, "vxworks-ppc750" => { inherit_from => [ "BASE_unix" ], - cc => "ccppc", - cflags => "-ansi -nostdinc -fvolatile -fno-builtin -fno-for-scope -fsigned-char -Wall -msoft-float -mlongcall \$(DEBUG_FLAG)", + CC => "ccppc", + CFLAGS => "-ansi -fvolatile -Wall \$(DEBUG_FLAG)", + cflags => "-nostdinc -fno-builtin -fno-for-scope -fsigned-char -msoft-float -mlongcall", cppflags => combine("-DPPC750 -D_REENTRANT -DCPU=PPC604", "-I\$(WIND_BASE)/target/h"), sys_id => "VXWORKS", @@ -1772,8 +1715,9 @@ my %targets = ( }, "vxworks-ppc750-debug" => { inherit_from => [ "BASE_unix" ], - cc => "ccppc", - cflags => "-ansi -nostdinc -fvolatile -fno-builtin -fno-for-scope -fsigned-char -Wall -msoft-float -mlongcall -g", + CC => "ccppc", + CFLAGS => "-ansi -fvolatile -Wall -g", + cflags => "-nostdinc -fno-builtin -fno-for-scope -fsigned-char -msoft-float -mlongcall", cppflags => combine("-DPPC750 -D_REENTRANT -DCPU=PPC604", "-DPEDANTIC -DDEBUG", "-I\$(WIND_BASE)/target/h"), @@ -1782,7 +1726,7 @@ my %targets = ( }, "vxworks-ppc860" => { inherit_from => [ "BASE_unix" ], - cc => "ccppc", + CC => "ccppc", cflags => "-nostdinc -msoft-float", cppflags => combine("-DCPU=PPC860 -DNO_STRINGS_H", "-I\$(WIND_BASE)/target/h"), @@ -1791,7 +1735,7 @@ my %targets = ( }, "vxworks-simlinux" => { inherit_from => [ "BASE_unix" ], - cc => "ccpentium", + CC => "ccpentium", cflags => "-B\$(WIND_BASE)/host/\$(WIND_HOST_TYPE)/lib/gcc-lib/ -fno-builtin -fno-defer-pop", cppflags => combine("-D_VSB_CONFIG_FILE=\"\$(WIND_BASE)/target/lib/h/config/vsbConfig.h\"", "-DL_ENDIAN -DCPU=SIMLINUX -DNO_STRINGS_H", @@ -1805,8 +1749,9 @@ my %targets = ( }, "vxworks-mips" => { inherit_from => [ "BASE_unix", asm("mips32_asm") ], - cc => "ccmips", - cflags => "-mrtp -mips2 -O -G 0 -B\$(WIND_BASE)/host/\$(WIND_HOST_TYPE)/lib/gcc-lib/ -msoft-float -mno-branch-likely -fno-builtin -fno-defer-pop", + CC => "ccmips", + CFLAGS => "-O -G 0", + cflags => "-mrtp -mips2 -B\$(WIND_BASE)/host/\$(WIND_HOST_TYPE)/lib/gcc-lib/ -msoft-float -mno-branch-likely -fno-builtin -fno-defer-pop", cppflags => combine("-D_VSB_CONFIG_FILE=\"\$(WIND_BASE)/target/lib/h/config/vsbConfig.h\"", "-DCPU=MIPS32 -DNO_STRINGS_H", "-DTOOL_FAMILY=gnu -DTOOL=gnu", @@ -1825,7 +1770,7 @@ my %targets = ( #### uClinux "uClinux-dist" => { inherit_from => [ "BASE_unix" ], - cc => sub { env('CC') }, + CC => sub { env('CC') }, cppflags => threads("-D_REENTRANT"), ex_libs => add("\$(LDLIBS)"), bn_ops => "BN_LLONG", @@ -1838,7 +1783,7 @@ my %targets = ( }, "uClinux-dist64" => { inherit_from => [ "BASE_unix" ], - cc => sub { env('CC') }, + CC => sub { env('CC') }, cppflags => threads("-D_REENTRANT"), ex_libs => add("\$(LDLIBS)"), bn_ops => "SIXTY_FOUR_BIT_LONG", @@ -1858,9 +1803,9 @@ my %targets = ( "vms-generic" => { inherit_from => [ "BASE_VMS" ], template => 1, - cc => "CC/DECC", - cpp => '$(CC)/PREPROCESS_ONLY=SYS$OUTPUT:', - cflags => + CC => "CC/DECC", + CPP => '$(CC)/PREPROCESS_ONLY=SYS$OUTPUT:', + CFLAGS => combine(picker(default => "/STANDARD=(ISOC94,RELAXED)/NOLIST/PREFIX=ALL", debug => "/NOOPTIMIZE/DEBUG", release => "/OPTIMIZE/NODEBUG"), @@ -1868,7 +1813,7 @@ my %targets = ( @{vms_info()->{disable_warns}}; @warnings ? "/WARNINGS=DISABLE=(".join(",",@warnings).")" : (); }), - defines => + lib_defines => add("OPENSSL_USE_NODELETE", sub { return vms_info()->{def_zlib} @@ -1886,9 +1831,10 @@ my %targets = ( dso_scheme => "vms", thread_scheme => "pthreads", - as => sub { vms_info()->{as} }, - asflags => sub { vms_info()->{asflags} }, + AS => sub { vms_info()->{AS} }, + ASFLAGS => sub { vms_info()->{ASFLAGS} }, asoutflag => sub { vms_info()->{asoutflag} }, + asflags => sub { vms_info()->{asflags} }, perlasm_scheme => sub { vms_info()->{perlasm_scheme} }, apps_aux_src => "vms_term_sock.c", diff --git a/Configurations/15-android.conf b/Configurations/15-android.conf new file mode 100644 index 00000000..b5248580 --- /dev/null +++ b/Configurations/15-android.conf @@ -0,0 +1,214 @@ +#### Android... +# +# It takes *one* prior-set environment variable to make it work: +# +# ANDROID_NDK=/some/where/android-ndk- +# +# As well as PATH *adjusted* to cover ${CROSS_COMPILE}gcc and company. +# +# Note that it's different from original instructions that required to +# set CROSS_SYSROOT [to $ANDROID_NDK/platforms/android-/arch-] +# and CROSS_COMPILE. CROSS_SYSROOT is still recognized [and even required +# for some legacy targets], but if not set, it's detected and set to the +# latest Android platform available with appointed NDK automatically. If +# you need to target older platform, pass additional -D__ANDROID_API__=N +# to Configure. For example, to compile for ICS on ARM with NDK 10d: +# +# ANDROID_NDK=/some/where/android-ndk-10d +# PATH=$ANDROID_NDK/toolchains/arm-linux-androideabi-4.8/prebuild/linux-x86_64/bin:$PATH +# [..]./Configure android-arm -D__ANDROID_API__=14 +# +# One can engage clang by passing CC=clang to Configure. In such case +# PATH needs even more adjustments to cover NDK's clang itself, as well +# as unprefixed, yet target-specific ar and ranlib [or not, if you use +# binutils-multiarch]. + +{ + my $android_ndk = {}; + my %triplet = ( + arm => "arm-linux-androideabi", + arm64 => "aarch64-linux-android", + mips => "mipsel-linux-android", + mips64 => "mips64el-linux-android", + x86 => "i686-linux-android", + x86_64 => "x86_64-linux-android", + ); + + sub android_ndk { + unless (%$android_ndk) { + my $ndk = $ENV{ANDROID_NDK}; + die "\$ANDROID_NDK is not defined" if (!$ndk); + die "\$ANDROID_NDK=$ndk is invalid" if (!-d "$ndk/platforms"); + + my $sysroot; + + if (!($sysroot = $ENV{CROSS_SYSROOT})) { + my $api = "*"; + + # see if user passed -D__ANDROID_API__=N + foreach (@{$useradd{CPPDEFINES}}) { + if (m|__ANDROID_API__=([0-9]+)|) { + $api = $1; + last; + } + } + + # list available platforms [numerically] + my @platforms = sort { $a =~ m/-([0-9]+)$/; my $aa = $1; + $b =~ m/-([0-9]+)$/; $aa <=> $1; + } glob("$ndk/platforms/android-$api"); + die "no $ndk/platforms/android-$api" if ($#platforms < 0); + + $config{target} =~ m|[^-]+-([^-]+)$|; # split on dash + $sysroot = "@platforms[$#platforms]/arch-$1"; + } + die "no sysroot=$sysroot" if (!-d $sysroot); + + $sysroot =~ m|/android-([0-9]+)/arch-(\w+)/?$|; + my ($api, $arch) = ($1, $2); + + my $triarch = $triplet{$arch}; + my $cflags = "-Wa,--noexecstack"; + my $cppflags; + + # see if user passed CC=clang + if ($user{CC} eq "clang") { + if (which("clang") !~ m|^$ndk/.*/prebuilt/([^/]+)/|) { + die "no NDK clang on \$PATH"; + } + # harmonize with gcc default + (my $tridefault = $triarch) =~ s|^arm-|armv5te-|; + $cflags .= " -target $tridefault -gcc-toolchain " + . "\$(ANDROID_NDK)/toolchains/$triarch-4.9/prebuilt/$1"; + $user{CROSS_COMPILE} = undef; + } else { + $cflags .= " -mandroid"; + $user{CROSS_COMPILE} = "$triarch-"; + } + + if (!-d "$sysroot/usr/include") { + my $incroot = "$ndk/sysroot/usr/include"; + die "no $incroot" if (!-d $incroot); + die "no $incroot/$triarch" if (!-d "$incroot/$triarch"); + $incroot =~ s|^$ndk/||; + $cppflags = "-D__ANDROID_API__=$api"; + $cppflags .= " -isystem \$(ANDROID_NDK)/$incroot/$triarch"; + $cppflags .= " -isystem \$(ANDROID_NDK)/$incroot"; + } + + $sysroot =~ s|^$ndk/||; + $android_ndk = { + cflags => "$cflags --sysroot=\$(ANDROID_NDK)/$sysroot", + cppflags => $cppflags, + bn_ops => $arch =~ m/64$/ ? "SIXTY_FOUR_BIT_LONG" + : "BN_LLONG", + }; + } + + return $android_ndk; + } +} + +my %targets = ( + "android" => { + inherit_from => [ "linux-generic32" ], + template => 1, + ################################################################ + # Special note about -pie. The underlying reason is that + # Lollipop refuses to run non-PIE. But what about older systems + # and NDKs? -fPIC was never problem, so the only concern is -pie. + # Older toolchains, e.g. r4, appear to handle it and binaries + # turn out mostly functional. "Mostly" means that oldest + # Androids, such as Froyo, fail to handle executable, but newer + # systems are perfectly capable of executing binaries targeting + # Froyo. Keep in mind that in the nutshell Android builds are + # about JNI, i.e. shared libraries, not applications. + cflags => add(sub { android_ndk()->{cflags} }), + cppflags => add(sub { android_ndk()->{cppflags} }), + cxxflags => add(sub { android_ndk()->{cflags} }), + bn_ops => sub { android_ndk()->{bn_ops} }, + bin_cflags => "-pie", + }, + "android-arm" => { + ################################################################ + # Contemporary Android applications can provide multiple JNI + # providers in .apk, targeting multiple architectures. Among + # them there is "place" for two ARM flavours: generic eabi and + # armv7-a/hard-float. However, it should be noted that OpenSSL's + # ability to engage NEON is not constrained by ABI choice, nor + # is your ability to call OpenSSL from your application code + # compiled with floating-point ABI other than default 'soft'. + # [Latter thanks to __attribute__((pcs("aapcs"))) declaration.] + # This means that choice of ARM libraries you provide in .apk + # is driven by application needs. For example if application + # itself benefits from NEON or is floating-point intensive, then + # it might be appropriate to provide both libraries. Otherwise + # just generic eabi would do. But in latter case it would be + # appropriate to + # + # ./Configure android-arm -D__ARM_MAX_ARCH__=8 + # + # in order to build "universal" binary and allow OpenSSL take + # advantage of NEON when it's available. + # + # Keep in mind that [just like with linux-armv4] we rely on + # compiler defaults, which is not necessarily what you had + # in mind, in which case you would have to pass additional + # -march and/or -mfloat-abi flags. NDK defaults to armv5te. + # + inherit_from => [ "android", asm("armv4_asm") ], + }, + "android-arm64" => { + inherit_from => [ "android", asm("aarch64_asm") ], + perlasm_scheme => "linux64", + }, + + "android-mips" => { + inherit_from => [ "android", asm("mips32_asm") ], + perlasm_scheme => "o32", + }, + "android-mips64" => { + ################################################################ + # You are more than likely have to specify target processor + # on ./Configure command line. Trouble is that toolchain's + # default is MIPS64r6 (at least in r10d), but there are no + # such processors around (or they are too rare to spot one). + # Actual problem is that MIPS64r6 is binary incompatible + # with previous MIPS ISA versions, in sense that unlike + # prior versions original MIPS binary code will fail. + # + inherit_from => [ "android", asm("mips64_asm") ], + perlasm_scheme => "64", + }, + + "android-x86" => { + inherit_from => [ "android", asm("x86_asm") ], + CFLAGS => add(picker(release => "-fomit-frame-pointer")), + bn_ops => add("RC4_INT"), + perlasm_scheme => "android", + }, + "android-x86_64" => { + inherit_from => [ "android", asm("x86_64_asm") ], + bn_ops => add("RC4_INT"), + perlasm_scheme => "elf", + }, + + #################################################################### + # Backward compatible targets, [might] requre $CROSS_SYSROOT + # + "android-armeabi" => { + inherit_from => [ "android-arm" ], + }, + "android64" => { + inherit_from => [ "android" ], + }, + "android64-aarch64" => { + inherit_from => [ "android-arm64" ], + }, + "android64-x86_64" => { + inherit_from => [ "android-x86_64" ], + }, + "android64-mips64" => { + inherit_from => [ "android-mips64" ], + }, +); diff --git a/Configurations/50-djgpp.conf b/Configurations/50-djgpp.conf index b4d19e20..a8853a81 100644 --- a/Configurations/50-djgpp.conf +++ b/Configurations/50-djgpp.conf @@ -5,8 +5,9 @@ my %targets = ( "DJGPP" => { inherit_from => [ asm("x86_asm") ], - cc => "gcc", - cflags => "-I/dev/env/WATT_ROOT/inc -DTERMIOS -DL_ENDIAN -fomit-frame-pointer -O2 -Wall", + CC => "gcc", + CFLAGS => "-fomit-frame-pointer -O2 -Wall", + cflags => "-I/dev/env/WATT_ROOT/inc -DTERMIOS -DL_ENDIAN", sys_id => "MSDOS", lflags => add("-L/dev/env/WATT_ROOT/lib"), ex_libs => add("-lwatt"), diff --git a/Configurations/50-haiku.conf b/Configurations/50-haiku.conf index b57e1487..cd6d10e5 100644 --- a/Configurations/50-haiku.conf +++ b/Configurations/50-haiku.conf @@ -1,10 +1,11 @@ my %targets = ( "haiku-common" => { template => 1, - cc => "cc", - cflags => add_before(picker(default => "-DL_ENDIAN -Wall -include \$(SRCDIR)/os-dep/haiku.h", + CC => "cc", + CFLAGS => add_before(picker(default => "-Wall", debug => "-g -O0", - release => "-O2"), + release => "-O2")), + cflags => add_before("-DL_ENDIAN -include \$(SRCDIR)/os-dep/haiku.h", threads("-D_REENTRANT")), sys_id => "HAIKU", ex_libs => "-lnetwork", @@ -18,7 +19,7 @@ my %targets = ( }, "haiku-x86" => { inherit_from => [ "haiku-common", asm("x86_elf_asm") ], - cflags => add(picker(release => "-fomit-frame-pointer")), + CFLAGS => add(picker(release => "-fomit-frame-pointer")), bn_ops => "BN_LLONG", }, "haiku-x86_64" => { diff --git a/Configurations/50-masm.conf b/Configurations/50-masm.conf index e2b54e34..2c55dddc 100644 --- a/Configurations/50-masm.conf +++ b/Configurations/50-masm.conf @@ -11,9 +11,10 @@ my %targets = ( "VC-WIN64A-masm" => { inherit_from => [ "VC-WIN64-common", asm("x86_64_asm"), sub { $disabled{shared} ? () : "x86_64_uplink" } ], - as => "ml64", - asflags => "/nologo /c /Cp /Cx /Zi", + AS => "ml64", + ASFLAGS => "/nologo /Zi", asoutflag => "/Fo", + asflags => "/c /Cp /Cx", sys_id => "WIN64A", bn_asm_src => sub { return undef unless @_; my $r=join(" ",@_); $r=~s|asm/x86_64-gcc|bn_asm|; $r; }, diff --git a/Configurations/50-win-onecore.conf b/Configurations/50-win-onecore.conf new file mode 100644 index 00000000..1207621e --- /dev/null +++ b/Configurations/50-win-onecore.conf @@ -0,0 +1,56 @@ +# Windows OneCore targets. +# +# OneCore is new API stability "contract" that transends Desktop, IoT and +# Mobile[?] Windows editions. It's a set up "umbrella" libraries that +# export subset of Win32 API that are common to all Windows 10 devices. +# +# TODO: drop onecore_downlevel.lib. + +my %targets = ( + "VC-WIN32-ONECORE" => { + inherit_from => [ "VC-WIN32" ], + # /NODEFAULTLIB:kernel32.lib is needed, because MSVCRT.LIB has + # hidden reference to kernel32.lib, but we don't actually want + # it in "onecore" build. + lflags => add("/NODEFAULTLIB:kernel32.lib"), + ex_libs => "onecore.lib onecore_downlevel.lib", + }, + "VC-WIN64A-ONECORE" => { + inherit_from => [ "VC-WIN64A" ], + lflags => add("/NODEFAULTLIB:kernel32.lib"), + ex_libs => "onecore.lib onecore_downlevel.lib", + }, + + # Windows on ARM targets. ARM compilers are additional components in + # VS2017, i.e. they are not installed by default. And when installed, + # there are no "ARM Tool Command Prompt"s on Start menu, you have + # to locate vcvarsall.bat and act accordingly. VC-WIN32-ARM has + # received limited testing with evp_test.exe on Windows 10 IoT Core, + # but not VC-WIN64-ARM, no hardware... In other words they are not + # actually supported... + # + # Another thing to keep in mind [in cross-compilation scenario such + # as this one] is that target's file system has nothing to do with + # compilation system's one. This means that you're are likely to use + # --prefix and --openssldir with target-specific values. 'nmake install' + # step is effectively meaningless in cross-compilation case, though + # it might be useful to 'nmake install DESTDIR=S:\ome\where' where you + # can point Visual Studio to when compiling custom application code. + + "VC-WIN32-ARM" => { + inherit_from => [ "VC-noCE-common" ], + defines => add("_ARM_WINAPI_PARTITION_DESKTOP_SDK_AVAILABLE"), + bn_ops => "BN_LLONG RC4_CHAR EXPORT_VAR_AS_FN", + lflags => add("/NODEFAULTLIB:kernel32.lib"), + ex_libs => "onecore.lib onecore_downlevel.lib", + multilib => "-arm", + }, + "VC-WIN64-ARM" => { + inherit_from => [ "VC-noCE-common" ], + defines => add("_ARM_WINAPI_PARTITION_DESKTOP_SDK_AVAILABLE"), + bn_ops => "SIXTY_FOUR_BIT RC4_CHAR EXPORT_VAR_AS_FN", + lflags => add("/NODEFAULTLIB:kernel32.lib"), + ex_libs => "onecore.lib onecore_downlevel.lib", + multilib => "-arm64", + }, +); diff --git a/Configurations/90-team.conf b/Configurations/90-team.conf index 31382182..a5cc6da4 100644 --- a/Configurations/90-team.conf +++ b/Configurations/90-team.conf @@ -5,7 +5,7 @@ my %targets = ( "purify" => { inherit_from => [ 'BASE_unix' ], cc => "purify gcc", - cflags => "-g -Wall", + CFLAGS => "-g -Wall", thread_scheme => "(unknown)", ex_libs => add(" ","-lsocket -lnsl"), }, @@ -81,8 +81,8 @@ my %targets = ( }, "dist" => { inherit_from => [ 'BASE_unix' ], - cc => "cc", - cflags => "-O", + CC => "cc", + CFLAGS => "-O", thread_scheme => "(unknown)", }, "debug-test-64-clang" => { diff --git a/Configurations/README b/Configurations/README index 8d32a254..d809824b 100644 --- a/Configurations/README +++ b/Configurations/README @@ -45,19 +45,24 @@ In each table entry, the following keys are significant: Note: if the same feature is both enabled and disabled, disable wins. + as => The assembler command. This is not always + used (for example on Unix, where the C + compiler is used instead). + asflags => Default assembler command flags [4]. cpp => The C preprocessor command, normally not given, as the build file defaults are usually good enough. - cppflags => The C preprocessor flags. + cppflags => Default C preprocessor flags [4]. defines => As an alternative, macro definitions may be - given here instead of in `cppflags'. If - given here, they MUST be as an array of the - string such as "MACRO=value", or just + given here instead of in `cppflags' [4]. + If given here, they MUST be as an array of + the string such as "MACRO=value", or just "MACRO" for definitions without value. includes => As an alternative, inclusion directories - may be given here instead of in `cppflags'. - If given here, the MUST be an array of - strings, one directory specification each. + may be given here instead of in `cppflags' + [4]. If given here, the MUST be an array + of strings, one directory specification + each. cc => The C compiler command, usually one of "cc", "gcc" or "clang". This command is normally also used to link object files and @@ -67,14 +72,9 @@ In each table entry, the following keys are significant: also used when linking a program where at least one of the object file is made from C++ source. - cflags => Flags that are used at all times when - compiling C object files. - cxxflags => Flags that are used at all times when - compiling C++ object files. If unset, it - gets the same value as cflags. - shared_cflag => Extra compilation flags used when - compiling for shared libraries, typically - something like "-fPIC". + cflags => Defaults C compiler flags [4]. + cxxflags => Default C++ compiler flags [4]. If unset, + it gets the same value as cflags. (linking is a complex thing, see [3] below) ld => Linker command, usually not defined @@ -82,13 +82,24 @@ In each table entry, the following keys are significant: instead). (NOTE: this is here for future use, it's not implemented yet) - lflags => Flags that are used when linking apps. - shared_ldflag => Flags that are used when linking shared - or dynamic libraries. - plib_lflags => Extra linking flags to appear just before - the libraries on the command line. + lflags => Default flags used when linking apps, + shared libraries or DSOs [4]. ex_libs => Extra libraries that are needed when - linking. + linking shared libraries, DSOs or programs. + + shared_cppflags => Extra C preprocessor flags used when + processing C files for shared libraries. + shared_cflag => Extra C compiler flags used when compiling + for shared libraries, typically something + like "-fPIC". + shared_ldflag => Extra linking flags used when linking + shared libraries. + module_cppflags + module_cflags + module_ldflags => Has the same function as the corresponding + `shared_' attributes, but for building DSOs. + When unset, they get the same values as the + corresponding `shared_' attributes. ar => The library archive command, the default is "ar". @@ -338,18 +349,20 @@ In each table entry, the following keys are significant: of this file): shared libraries: - {ld} $(CFLAGS) {shared_ldflag} -shared -o libfoo.so \ - -Wl,--whole-archive libfoo.a -Wl,--no-whole-archive \ - {plib_lflags} -lcrypto {ex_libs} + {ld} $(CFLAGS) {lflags} {shared_ldflag} -o libfoo.so \ + foo/something.o foo/somethingelse.o {ex_libs} shared objects: - {ld} $(CFLAGS) {shared_ldflag} -shared -o libeng.so \ - blah1.o blah2.o {plib_lflags} -lcrypto {ex_libs} + {ld} $(CFLAGS) {lflags} {module_ldflags} -o libeng.so \ + blah1.o blah2.o -lcrypto {ex_libs} applications: {ld} $(CFLAGS) {lflags} -o app \ - app1.o utils.o {plib_lflags} -lssl -lcrypto {ex_libs} + app1.o utils.o -lssl -lcrypto {ex_libs} +[4] There are variants of these attribute, prefixed with `lib_', + `dso_' or `bin_'. Those variants replace the unprefixed attribute + when building library, DSO or program modules specifically. Historically, the target configurations came in form of a string with values separated by colons. This use is deprecated. The string form diff --git a/Configurations/descrip.mms.tmpl b/Configurations/descrip.mms.tmpl index 2364644b..7e7bf71e 100644 --- a/Configurations/descrip.mms.tmpl +++ b/Configurations/descrip.mms.tmpl @@ -171,51 +171,174 @@ OPENSSLDIR_C={- $osslprefix -}DATAROOT:[000000] # Where installed engines reside, for C ENGINESDIR_C={- $osslprefix -}ENGINES{- $sover_dirname.$target{pointer_size} -}: -CC= {- $config{cc} -} -CPP= {- $config{cpp} -} -DEFINES={- our $defines = join(",", - '__dummy', # To make comma processing easier - @{$config{defines}}) -} -INCLUDES={- our $includes = join(',', @{$config{includes}}) -} -CPPFLAGS='qual_includes'{- our $cppflags = join('', @{$config{cppflags}}) -} -CPPFLAGS_Q={- (my $x = $cppflags) =~ s|"|""|g; - (my $d = $defines) =~ s|"|""|g; - $x .= "/INCLUDE=($includes)" if $includes; - $x .= "/DEFINE=($d)"; - $x; -} -CFLAGS={- join('', @{$config{cflags}}) -} -LDFLAGS= {- join('', @{$config{lflags}}) -} -EX_LIBS= {- join('', map { ','.$_ } @{$config{ex_libs}}) -} +##### User defined commands and flags ################################ -LIB_DEFINES=$(DEFINES){- join("", (map { ",$_" } - @{$target{shared_defines}}, - 'OPENSSLDIR="""$(OPENSSLDIR_C)"""', - 'ENGINESDIR="""$(ENGINESDIR_C)"""')) -} -LIB_CPPFLAGS=$(CPPFLAGS)/DEFINE=($(LIB_DEFINES)) -LIB_CFLAGS=$(CFLAGS){- $target{lib_cflags} // "" -} -DSO_DEFINES=$(DEFINES){- join("", (map { ",$_" } @{$target{dso_defines}})) -} -DSO_CPPFLAGS=$(CPPFLAGS)/DEFINE=($(DSO_DEFINES)) -DSO_CFLAGS=$(CFLAGS){- $target{dso_cflags} // "" -} -BIN_DEFINES=$(DEFINES){- join("", (map { ",$_" } @{$target{bin_defines}})) -} -BIN_CPPFLAGS=$(CPPFLAGS)/DEFINE=($(BIN_DEFINES)) -BIN_CFLAGS=$(CFLAGS){- $target{bin_cflags} // "" -} -NO_INST_LIB_CFLAGS=$(CFLAGS){- $target{no_inst_lib_cflags} - // $target{lib_cflags} - // "" -} -NO_INST_DSO_CFLAGS=$(CFLAGS){- $target{no_inst_dso_cflags} - // $target{dso_cflags} - // "" -} -NO_INST_BIN_CFLAGS=$(CFLAGS){- $target{no_inst_bin_cflags} - // $target{bin_cflags} - // "" -} +CC={- $config{CC} -} +CPP={- $config{CPP} -} +DEFINES={- our $defines1 = join('', map { ",$_" } @{$config{CPPDEFINES}}) -} +INCLUDES={- our $includes1 = join(',', @{$config{CPPINCLUDES}}) -} +CPPFLAGS={- our $cppflags1 = join('', @{$config{CPPFLAGS}}) -} +CFLAGS={- join('', @{$config{CFLAGS}}) -} +LDFLAGS={- join('', @{$config{LFLAGS}}) -} +EX_LIBS={- join('', map { ",$_" } @{$config{LDLIBS}}) -} PERL={- $config{perl} -} -AS={- $config{as} -} -ASFLAGS={- join(' ', @{$config{asflags}}) -} +AS={- $config{AS} -} +ASFLAGS={- join(' ', @{$config{ASFLAGS}}) -} + +##### Special command flags ########################################## + ASOUTFLAG={- $target{asoutflag} -}$(OSSL_EMPTY) + +##### Project flags ################################################## + +# Variables starting with CNF_ are common variables for all product types + +CNF_ASFLAGS={- join('', $target{asflags} || (), + @{$config{asflags}}) -} +CNF_DEFINES={- our $defines2 = join('', map { ",$_" } @{$target{defines}}, + @{$config{defines}}) -} +CNF_INCLUDES={- our $includes2 = join(',', @{$target{includes}}, + @{$config{includes}}) -} +CNF_CPPFLAGS={- our $cppflags2 = join('', $target{cppflags} || (), + @{$config{cppflags}}) -} +CNF_CFLAGS={- join('', $target{cflags} || (), + @{$config{cflags}}) -} +CNF_CXXFLAGS={- join('', $target{cxxflags} || (), + @{$config{cxxflags}}) -} +CNF_LDFLAGS={- join('', $target{lflags} || (), + @{$config{lflags}}) -} +CNF_EX_LIBS={- join('', map{ ",$_" } @{$target{ex_libs}}, + @{$config{ex_libs}}) -} + +# Variables starting with LIB_ are used to build library object files +# and shared libraries. +# Variables starting with DSO_ are used to build DSOs and their object files. +# Variables starting with BIN_ are used to build programs and their object +# files. + +LIB_ASFLAGS={- join(' ', $target{lib_asflags} || (), + @{$config{lib_asflags}}, + '$(CNF_ASFLAGS)', '$(ASFLAGS)') -} +LIB_DEFINES={- our $lib_defines = + join('', (map { ",$_" } @{$target{lib_defines}}, + @{$target{shared_defines}}, + @{$config{lib_defines}}, + @{$config{shared_defines}})); + join('', $lib_defines, + (map { ",$_" } 'OPENSSLDIR="""$(OPENSSLDIR_C)"""', + 'ENGINESDIR="""$(ENGINESDIR_C)"""'), + '$(CNF_DEFINES)', '$(DEFINES)') -} +LIB_INCLUDES={- our $lib_includes = + join(',', @{$target{lib_includes}}, + @{$target{shared_includes}}, + @{$config{lib_includes}}, + @{$config{shared_includes}}) -} +LIB_CPPFLAGS={- our $lib_cppflags = + join('', $target{lib_cppflags} || (), + $target{shared_cppflags} || (), + @{$config{lib_cppflags}}, + @{$config{shared_cppflag}}); + join('', "'qual_includes'", + '/DEFINE=(__dummy$(LIB_DEFINES))', + $lib_cppflags, + '$(CNF_CPPFLAGS)', '$(CPPFLAGS)') -} +LIB_CFLAGS={- join('', $target{lib_cflags} || (), + $target{shared_cflag} || (), + @{$config{lib_cflags}}, + @{$config{shared_cflag}}, + '$(CNF_CFLAGS)', '$(CFLAGS)') -} +LIB_LDFLAGS={- join('', $target{lib_lflags} || (), + $target{shared_ldflag} || (), + @{$config{lib_lflags}}, + @{$config{shared_ldflag}}, + '$(CNF_LDFLAGS)', '$(LDFLAGS)') -} +LIB_EX_LIBS=$(CNF_EX_LIBS)$(EX_LIBS) +DSO_ASFLAGS={- join(' ', $target{dso_asflags} || (), + $target{module_asflags} || (), + @{$config{dso_asflags}}, + @{$config{module_asflags}}, + '$(CNF_ASFLAGS)', '$(ASFLAGS)') -} +DSO_DEFINES={- join('', (map { ",$_" } @{$target{dso_defines}}, + @{$target{module_defines}}, + @{$config{dso_defines}}, + @{$config{module_defines}}), + '$(CNF_DEFINES)', '$(DEFINES)') -} +DSO_INCLUDES={- join(',', @{$target{dso_includes}}, + @{$target{module_includes}}, + @{$config{dso_includes}}, + @{$config{module_includes}}) -} +DSO_CPPFLAGS={- join('', "'qual_includes'", + '/DEFINE=(__dummy$(DSO_DEFINES))', + $target{dso_cppflags} || (), + $target{module_cppflags} || (), + @{$config{dso_cppflags}}, + @{$config{module_cppflags}}, + '$(CNF_CPPFLAGS)', '$(CPPFLAGS)') -} +DSO_CFLAGS={- join('', $target{dso_cflags} || (), + $target{module_cflags} || (), + @{$config{dso_cflags}}, + @{$config{module_cflags}}, + '$(CNF_CFLAGS)', '$(CFLAGS)') -} +DSO_LDFLAGS={- join('', $target{dso_lflags} || (), + $target{module_ldflags} || (), + @{$config{dso_lflags}}, + @{$config{module_ldflags}}, + '$(CNF_LDFLAGS)', '$(LDFLAGS)') -} +DSO_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS) +BIN_ASFLAGS={- join(' ', $target{bin_asflags} || (), + @{$config{bin_asflags}}, + '$(CNF_ASFLAGS)', '$(ASFLAGS)') -} +BIN_DEFINES={- join('', (map { ",$_" } @{$target{bin_defines}}, + @{$config{bin_defines}}), + '$(CNF_DEFINES)', '$(DEFINES)') -} +BIN_INCLUDES={- join(',', @{$target{bin_includes}}, + @{$config{bin_includes}}) -} +BIN_CPPFLAGS={- join('', "'qual_includes'", + '/DEFINE=(__dummy$(DSO_DEFINES))', + $target{bin_cppflags} || (), + @{$config{bin_cppflag}}, + '$(CNF_CPPFLAGS)', '$(CPPFLAGS)') -} +BIN_CFLAGS={- join('', $target{bin_cflag} || (), + @{$config{bin_cflag}}, + '$(CNF_CFLAGS)', '$(CFLAGS)') -} +BIN_LDFLAGS={- join('', $target{bin_lflags} || (), + @{$config{bin_lflags}} || (), + '$(CNF_LDFLAGS)', '$(LDFLAGS)') -} +BIN_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS) +NO_INST_LIB_CFLAGS={- join('', $target{no_inst_lib_cflags} + // $target{lib_cflags} + // (), + $target{shared_cflag} || (), + @{$config{lib_cflags}}, + @{$config{shared_cflag}}, + '$(CNF_CFLAGS)', '$(CFLAGS)') -} +NO_INST_DSO_CFLAGS={- join('', $target{no_inst_lib_cflags} + // $target{lib_cflags} + // (), + $target{dso_cflags} || (), + @{$config{lib_cflags}}, + @{$config{dso_cflags}}, + '$(CNF_CFLAGS)', '$(CFLAGS)') -} +NO_INST_BIN_CFLAGS={- join('', $target{no_inst_bin_cflags} + // $target{bin_cflags} + // (), + @{$config{bin_cflags}}, + '$(CNF_CFLAGS)', '$(CFLAGS)') -} + PERLASM_SCHEME={- $target{perlasm_scheme} -} +# CPPFLAGS_Q is used for one thing only: to build up buildinf.h +CPPFLAGS_Q={- (my $c = $lib_cppflags.$cppflags2.$cppflags1) =~ s|"|""|g; + (my $d = $lib_defines.$defines2.$defines1) =~ s|"|""|g; + my $i = join(',', $lib_includes || (), $includes2 || (), + $includes1 || ()); + my $x = $c; + $x .= "/INCLUDE=($i)" if $i; + $x .= "/DEFINE=($d)" if $d; + $x; -} + # .FIRST and .LAST are special targets with MMS and MMK. # The defines in there are for C. includes that look like # this: @@ -381,16 +504,7 @@ distclean : clean depend : descrip.mms descrip.mms : FORCE @ ! {- output_off() if $disabled{makedepend}; "" -} - @ $(PERL) -pe "if (/^# DO NOT DELETE.*/) { exit(0); }" - - < descrip.mms > descrip.mms-new - @ OPEN/APPEND DESCRIP descrip.mms-new - @ WRITE DESCRIP "# DO NOT DELETE THIS LINE -- make depend depends on it." - {- join("\n\t", map { "\@ IF F\$SEARCH(\"$_\") .NES. \"\" THEN TYPE $_ /OUTPUT=DESCRIP:" } @deps); -} - @ CLOSE DESCRIP - @ PIPE ( $(PERL) -e "use File::Compare qw/compare_text/; my $x = compare_text(""descrip.mms"",""descrip.mms-new""); exit(0x10000000 + ($x == 0));" || - - RENAME descrip.mms-new descrip.mms ) - @ IF F$SEARCH("descrip.mms-new") .NES. "" THEN DELETE descrip.mms-new;* - -@ SPAWN/OUTPUT=NLA0: PURGE/NOLOG descrip.mms + @ $(PERL) {- sourcefile("util", "add-depends.pl") -} @ ! {- output_on() if $disabled{makedepend}; "" -} # Install helper targets ############################################# @@ -666,6 +780,7 @@ EOF my @incs_cmds = includes({ lib => '$(LIB_INCLUDES)', dso => '$(DSO_INCLUDES)', bin => '$(BIN_INCLUDES)' } -> {$args{intent}}, + '$(CNF_INCLUDES)', '$(INCLUDES)', @{$args{incs}}); my $incs_on = join("\n\t\@ ", @{$incs_cmds[0]}) || '!'; @@ -725,11 +840,14 @@ EOF my $after = $unified_info{after}->{$obj.".OBJ"} || "\@ !"; if ($srcs[0] =~ /\.asm$/) { + my $asflags = { lib => ' $(LIB_ASFLAGS)', + dso => ' $(DSO_ASFLAGS)', + bin => ' $(BIN_ASFLAGS)' } -> {$args{intent}}; return <<"EOF"; $obj.OBJ : $deps ${before} SET DEFAULT $forward - \$(AS) \$(ASFLAGS) \$(ASOUTFLAG)${objd}${objn}.OBJ $srcs + \$(AS) $asflags \$(ASOUTFLAG)${objd}${objn}.OBJ $srcs SET DEFAULT $backward EOF } @@ -817,8 +935,8 @@ $shlib.EXE : $lib.OLB $deps $write_opt1 $write_opt2 CLOSE OPT_FILE - LINK \$(LDFLAGS)/SHARE=\$\@ $defs[0]-translated/OPT,- - $lib-components.OPT/OPT \$(EX_LIBS) + LINK \$(LIB_LDFLAGS)/SHARE=\$\@ $defs[0]-translated/OPT,- + $lib-components.OPT/OPT \$(LIB_EX_LIBS) DELETE $defs[0]-translated;*,$lib-components.OPT;* PURGE $shlib.EXE,$shlib.MAP EOF @@ -861,7 +979,7 @@ $lib.EXE : $deps $write_opt1 $write_opt2 CLOSE OPT_FILE - LINK \$(LDFLAGS)/SHARE=\$\@ $lib.OPT/OPT \$(EX_LIBS) + LINK \$(DSO_LDFLAGS)/SHARE=\$\@ $lib.OPT/OPT \$(DSO_EX_LIBS) - PURGE $lib.EXE,$lib.OPT,$lib.MAP EOF . ($config{target} =~ m|alpha| ? "" : <<"EOF" @@ -949,7 +1067,7 @@ $bin.EXE : $deps @ CLOSE OPT_FILE TYPE $bin.opt ! For debugging - pipe SPAWN/WAIT/NOLOG/OUT=$bin.LINKLOG - - LINK \$(LDFLAGS)/EXEC=\$\@ $bin.OPT/OPT \$(EX_LIBS) ; - + LINK \$(BIN_LDFLAGS)/EXEC=\$\@ $bin.OPT/OPT \$(BIN_EX_LIBS) ; - link_status = \$status ; link_severity = link_status .AND. 7 @ search_severity = 1 -@ IF link_severity .EQ. 0 THEN - diff --git a/Configurations/shared-info.pl b/Configurations/shared-info.pl index 97163488..f3c4cb6f 100644 --- a/Configurations/shared-info.pl +++ b/Configurations/shared-info.pl @@ -13,12 +13,12 @@ sub detect_gnu_ld { my @lines = - `$config{cross_compile_prefix}$config{cc} -Wl,-V /dev/null 2>&1`; + `$config{CROSS_COMPILE}$config{CC} -Wl,-V /dev/null 2>&1`; return grep /^GNU ld/, @lines; } sub detect_gnu_cc { my @lines = - `$config{cross_compile_prefix}$config{cc} -v 2>&1`; + `$config{CROSS_COMPILE}$config{CC} -v 2>&1`; return grep /gcc/, @lines; } @@ -42,7 +42,7 @@ my %shared_info; }; }, 'darwin-shared' => { - dso_lflags => '-bundle', + module_ldflags => '-bundle', shared_ldflag => '-dynamiclib -current_version $(SHLIB_VERSION_NUMBER) -compatibility_version $(SHLIB_VERSION_NUMBER)', shared_sonameflag => '-install_name $(INSTALLTOP)/$(LIBDIR)/', }, @@ -61,7 +61,7 @@ my %shared_info; 'alpha-osf1-shared' => sub { return $shared_info{'gnu-shared'} if detect_gnu_ld(); return { - dso_lflags => '-shared -Wl,-Bsymbolic', + module_ldflags => '-shared -Wl,-Bsymbolic', shared_ldflag => '-shared -Wl,-Bsymbolic -set_version $(SHLIB_VERSION_NUMBER)', }; }, diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl index 78b1a5e5..0be8cb15 100644 --- a/Configurations/unix-Makefile.tmpl +++ b/Configurations/unix-Makefile.tmpl @@ -107,8 +107,7 @@ DEPS={- join(" ", map { (my $x = $_) =~ s|\.o$|$depext|; $x; } {- output_on() if $disabled{makedepend}; "" -} GENERATED_MANDATORY={- join(" ", @{$unified_info{depends}->{""}} ) -} GENERATED={- join(" ", - ( map { (my $x = $_) =~ s|\.S$|\.s|; $x } - grep { defined $unified_info{generate}->{$_} } + ( grep { defined $unified_info{generate}->{$_} } map { @{$unified_info{sources}->{$_}} } grep { /\.o$/ } keys %{$unified_info{sources}} ), ( grep { /\.h$/ } keys %{$unified_info{generate}} )) -} @@ -188,61 +187,141 @@ HTMLSUFFIX=html # For "optional" echo messages, to get "real" silence ECHO = echo -CROSS_COMPILE= {- $config{cross_compile_prefix} -} -CPPFLAGS={- our $cppflags = join(" ", - (map { "-D".$_} @{$config{defines}}), - (map { "-I".$_} @{$config{includes}}), - @{$config{cppflags}}) -} -CPPFLAGS_Q={- $cppflags =~ s|([\\"])|\\$1|g; $cppflags -} -CC= $(CROSS_COMPILE){- $config{cc} -} -CFLAGS={- join(' ', @{$config{cflags}}) -} -CXX={- $config{cxx} ? "\$(CROSS_COMPILE)$config{cxx}" : '' -} -CXXFLAGS={- join(' ', @{$config{cxxflags}}) -} -LDFLAGS= {- join(' ', @{$config{lflags}}) -} -PLIB_LDFLAGS= {- join(' ', @{$config{plib_lflags}}) -} -EX_LIBS= {- join(' ', @{$config{ex_libs}}) -} - -LIB_CPPFLAGS={- join(' ', '$(CPPFLAGS)', - $target{shared_cppflag} || (), - (map { '-D'.$_ } - ('OPENSSLDIR="\"$(OPENSSLDIR)\""', - 'ENGINESDIR="\"$(ENGINESDIR)\""'))) -} -LIB_CFLAGS={- join(' ', '$(CFLAGS)', $target{shared_cflag} || ()) -} -LIB_CXXFLAGS={- join(' ', '$(CXXFLAGS)', $target{shared_cxxflag} || ()) -} -LIB_LDFLAGS={- join(' ', '$(LDFLAGS)', $target{shared_ldflag} || (), $config{shared_ldflag} || ()) -} -DSO_CPPFLAGS={- join(' ', '$(CPPFLAGS)', $target{dso_cppflags} || ()) -} -DSO_CFLAGS={- join(' ', '$(CFLAGS)', $target{dso_cflags} || ()) -} -DSO_CXXFLAGS={- join(' ', '$(CXXFLAGS)', $target{dso_cxxflags} || ()) -} -DSO_LDFLAGS={- join(' ', '$(LDFLAGS)', $target{dso_lflags} || ()) -} -BIN_CPPFLAGS={- join(' ', '$(CPPFLAGS)', $target{bin_cppflags} || ()) -} -BIN_CFLAGS={- join(' ', '$(CFLAGS)', $target{bin_cflags} || ()) -} -BIN_CXXFLAGS={- join(' ', '$(CXXFLAGS)', $target{bin_cxxflags} || ()) -} -BIN_LDFLAGS={- join(' ', '$(LDFLAGS)', $target{bin_lflags} || ()) -} - -PERL={- $config{perl} -} - -AR=$(CROSS_COMPILE){- $config{ar} -} -ARFLAGS= {- join(' ', @{$config{arflags}}) -} -RANLIB={- $config{ranlib} ? "\$(CROSS_COMPILE)$config{ranlib}" : "true"; -} -RC= $(CROSS_COMPILE){- $target{rc} || "windres" -} -RCFLAGS={- join(' ', @{$config{rcflags}}) -} {- $target{shared_rcflag} -} -RM= rm -f -RMDIR= rmdir -TAR= {- $target{tar} || "tar" -} -TARFLAGS= {- $target{tarflags} -} -MAKEDEPEND={- $config{makedepprog} -} - -BASENAME= openssl -NAME= $(BASENAME)-$(VERSION) -TARFILE= ../$(NAME).tar +##### User defined commands and flags ################################ # We let the C compiler driver to take care of .s files. This is done in # order to be excused from maintaining a separate set of architecture # dependent assembler flags. E.g. if you throw -mcpu=ultrasparc at SPARC # gcc, then the driver will automatically translate it to -xarch=v8plus -# and pass it down to assembler. -AS={- $config{as} ? "\$(CROSS_COMPILE)$config{as}" : '$(CC) -c' -} -ASFLAGS={- join(' ', @{$config{asflags}}) || '$(CFLAGS)' -} +# and pass it down to assembler. In any case, we do not define AS or +# ASFLAGS for this reason. + +CROSS_COMPILE={- $config{CROSS_COMPILE} -} +CC=$(CROSS_COMPILE){- $config{CC} -} +CXX={- $config{CXX} ? "\$(CROSS_COMPILE)$config{CXX}" : '' -} +CPPFLAGS={- our $cppflags1 = join(" ", + (map { "-D".$_} @{$config{CPPDEFINES}}), + (map { "-I".$_} @{$config{CPPINCLUDES}}), + @{$config{CPPFLAGS}}) -} +CFLAGS={- join(' ', @{$config{CFLAGS}}) -} +CXXFLAGS={- join(' ', @{$config{CXXFLAGS}}) -} +LDFLAGS= {- join(' ', @{$config{LDFLAGS}}) -} +EX_LIBS= {- join(' ', @{$config{LDLIBS}}) -} + +MAKEDEPEND={- $config{makedepprog} -} + +PERL={- $config{perl} -} + +AR=$(CROSS_COMPILE){- $config{AR} -} +ARFLAGS= {- join(' ', @{$config{ARFLAGS}}) -} +RANLIB={- $config{RANLIB} ? "\$(CROSS_COMPILE)$config{RANLIB}" : "true"; -} +RC= $(CROSS_COMPILE){- $config{RC} -} +RCFLAGS={- join(' ', @{$config{RCFLAGS}}) -} {- $target{shared_rcflag} -} + +RM= rm -f +RMDIR= rmdir +TAR= {- $target{TAR} || "tar" -} +TARFLAGS= {- $target{TARFLAGS} -} + +BASENAME= openssl +NAME= $(BASENAME)-$(VERSION) +TARFILE= ../$(NAME).tar + +##### Project flags ################################################## + +# Variables starting with CNF_ are common variables for all product types + +CNF_CPPFLAGS={- our $cppflags2 = + join(' ', $target{cppflags} || (), + (map { "-D".$_} @{$target{defines}}, + @{$config{defines}}), + (map { "-I".$_} @{$target{includes}}, + @{$config{includes}}), + @{$config{cppflags}}) -} +CNF_CFLAGS={- join(' ', $target{cflags} || (), + @{$config{cflags}}) -} +CNF_CXXFLAGS={- join(' ', $target{cxxflags} || (), + @{$config{cxxflags}}) -} +CNF_LDFLAGS={- join(' ', $target{lflags} || (), + @{$config{lflags}}) -} +CNF_EX_LIBS={- join(' ', $target{ex_libs} || (), + @{$config{ex_libs}}) -} + +# Variables starting with LIB_ are used to build library object files +# and shared libraries. +# Variables starting with DSO_ are used to build DSOs and their object files. +# Variables starting with BIN_ are used to build programs and their object +# files. + +LIB_CPPFLAGS={- our $lib_cppflags = + join(' ', $target{lib_cppflags} || (), + $target{shared_cppflag} || (), + (map { '-D'.$_ } + @{$config{lib_defines}}, + @{$config{shared_defines}}), + @{$config{lib_cppflags}}, + @{$config{shared_cppflag}}); + join(' ', $lib_cppflags, + (map { '-D'.$_ } + 'OPENSSLDIR="\"$(OPENSSLDIR)\""', + 'ENGINESDIR="\"$(ENGINESDIR)\""'), + '$(CNF_CPPFLAGS)', '$(CPPFLAGS)') -} +LIB_CFLAGS={- join(' ', $target{lib_cflags} || (), + $target{shared_cflag} || (), + @{$config{lib_cflags}}, + @{$config{shared_cflag}}, + '$(CNF_CFLAGS)', '$(CFLAGS)') -} +LIB_CXXFLAGS={- join(' ', $target{lib_cxxflags} || (), + $target{shared_cxxflag} || (), + @{$config{lib_cxxflags}}, + @{$config{shared_cxxflag}}, + '$(CNF_CXXFLAGS)', '$(CXXFLAGS)') -} +LIB_LDFLAGS={- join(' ', $target{shared_ldflag} || (), + $config{shared_ldflag} || (), + '$(CNF_LDFLAGS)', '$(LDFLAGS)') -} +LIB_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS) +DSO_CPPFLAGS={- join(' ', $target{dso_cppflags} || (), + $target{module_cppflags} || (), + @{$config{dso_cppflags}}, + @{$config{module_cppflags}}, + '$(CNF_CPPFLAGS)', '$(CPPFLAGS)') -} +DSO_CFLAGS={- join(' ', $target{dso_cflags} || (), + $target{module_cflags} || (), + @{$config{dso_cflags}}, + @{$config{module_cflags}}, + '$(CNF_CFLAGS)', '$(CFLAGS)') -} +DSO_CXXFLAGS={- join(' ', $target{dso_cxxflags} || (), + $target{module_cxxflags} || (), + @{$config{dso_cxxflags}}, + @{$config{module_cxxflag}}, + '$(CNF_CXXFLAGS)', '$(CXXFLAGS)') -} +DSO_LDFLAGS={- join(' ', $target{dso_ldflags} || (), + $target{module_ldflags} || (), + @{$config{dso_ldflags}}, + @{$config{module_ldflags}}, + '$(CNF_LDFLAGS)', '$(LDFLAGS)') -} +DSO_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS) +BIN_CPPFLAGS={- join(' ', $target{bin_cppflags} || (), + @{$config{bin_cppflags}}, + '$(CNF_CPPFLAGS)', '$(CPPFLAGS)') -} +BIN_CFLAGS={- join(' ', $target{bin_cflags} || (), + @{$config{bin_cflags}}, + '$(CNF_CFLAGS)', '$(CFLAGS)') -} +BIN_CXXFLAGS={- join(' ', $target{bin_cxxflags} || (), + @{$config{bin_cxxflags}}, + '$(CNF_CXXFLAGS)', '$(CXXFLAGS)') -} +BIN_LDFLAGS={- join(' ', $target{bin_lflags} || (), + @{$config{bin_lflags}}, + '$(CNF_LDFLAGS)', '$(LDFLAGS)') -} +BIN_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS) + +# CPPFLAGS_Q is used for one thing only: to build up buildinf.h +CPPFLAGS_Q={- $cppflags1 =~ s|([\\"])|\\$1|g; + $cppflags2 =~ s|([\\"])|\\$1|g; + $lib_cppflags =~ s|([\\"])|\\$1|g; + join(' ', $lib_cppflags || (), $cppflags2 || (), + $cppflags1 || ()) -} + PERLASM_SCHEME= {- $target{perlasm_scheme} -} # For x86 assembler: Set PROCESSOR to 386 if you want to support @@ -340,19 +419,7 @@ distclean: clean # concatenate only if that is true. depend: @: {- output_off() if $disabled{makedepend}; "" -} - @if egrep "^# DO NOT DELETE THIS LINE" Makefile >/dev/null && [ -z "`find $(DEPS) -newer Makefile 2>/dev/null; exit 0`" ]; then :; else \ - ( $(PERL) -pe 'exit 0 if /^# DO NOT DELETE THIS LINE.*/' < Makefile; \ - echo '# DO NOT DELETE THIS LINE -- make depend depends on it.'; \ - echo; \ - for f in $(DEPS); do \ - if [ -f $$f ]; then cat $$f; fi; \ - done ) > Makefile.new; \ - if cmp Makefile.new Makefile >/dev/null 2>&1; then \ - rm -f Makefile.new; \ - else \ - mv -f Makefile.new Makefile; \ - fi; \ - fi + @$(PERL) $(SRCDIR)/util/add-depends.pl @: {- output_on() if $disabled{makedepend}; "" -} # Install helper targets ############################################# @@ -651,13 +718,18 @@ generate_crypto_bn: ( cd $(SRCDIR); $(PERL) crypto/bn/bn_prime.pl > crypto/bn/bn_prime.h ) generate_crypto_objects: + ( cd $(SRCDIR); $(PERL) crypto/objects/objects.pl -n \ + crypto/objects/objects.txt \ + crypto/objects/obj_mac.num \ + > crypto/objects/obj_mac.new && \ + mv crypto/objects/obj_mac.new crypto/objects/obj_mac.num ) ( cd $(SRCDIR); $(PERL) crypto/objects/objects.pl \ crypto/objects/objects.txt \ crypto/objects/obj_mac.num \ - include/openssl/obj_mac.h ) + > include/openssl/obj_mac.h ) ( cd $(SRCDIR); $(PERL) crypto/objects/obj_dat.pl \ include/openssl/obj_mac.h \ - crypto/objects/obj_dat.h ) + > crypto/objects/obj_dat.h ) ( cd $(SRCDIR); $(PERL) crypto/objects/objxref.pl \ crypto/objects/obj_mac.num \ crypto/objects/obj_xref.txt \ @@ -707,7 +779,7 @@ tags TAGS: FORCE # If your tar command doesn't support --owner and --group, make sure to # use one that does, for example GNU tar -TAR_COMMAND=$(TAR) $(TARFLAGS) --owner 0 --group 0 -cvf - +TAR_COMMAND=$(TAR) $(TARFLAGS) --owner 0 --group 0 -cf - PREPARE_CMD=: tar: set -e; \ @@ -767,7 +839,7 @@ libcrypto.pc: echo 'Description: OpenSSL cryptography library'; \ echo 'Version: '$(VERSION); \ echo 'Libs: -L$${libdir} -lcrypto'; \ - echo 'Libs.private: $(EX_LIBS)'; \ + echo 'Libs.private: $(LIB_EX_LIBS)'; \ echo 'Cflags: -I$${includedir}' ) > libcrypto.pc libssl.pc: @@ -872,20 +944,6 @@ EOF bin => '$(BIN_CFLAGS) $(BIN_CPPFLAGS)' } -> {$args{intent}}; if (defined($generator)) { - # If the target is named foo.S in build.info, we want to - # end up generating foo.s in two steps. - if ($args{src} =~ /\.S$/) { - (my $target = $args{src}) =~ s|\.S$|.s|; - return <<"EOF"; -$target: $args{generator}->[0] $deps - ( trap "rm -f \$@.*" INT 0; \\ - $generator \$@.S; \\ - \$(CPP) $incs $cppflags \$@.S | \\ - \$(PERL) -ne '/^#(line)?\\s*[0-9]+/ or print' > \$@.i && \\ - mv -f \$@.i \$@ ) -EOF - } - # Otherwise.... return <<"EOF"; $args{src}: $args{generator}->[0] $deps $generator \$@ @@ -905,12 +963,7 @@ EOF sub src2obj { my %args = @_; (my $obj = $args{obj}) =~ s|\.o$||; - my @srcs = map { if ($unified_info{generate}->{$_}) { - (my $x = $_) =~ s/\.S$/.s/; $x - } else { - $_ - } - } ( @{$args{srcs}} ); + my @srcs = @{$args{srcs}}; my $srcs = join(" ", @srcs); my $deps = join(" ", @srcs, @{$args{deps}}); my $incs = join("", map { " -I".$_ } @{$args{incs}}); @@ -940,12 +993,30 @@ EOF bin => '$(BIN_CFLAGS) $(BIN_CPPFLAGS)' } -> {$args{intent}}; } - $cmdflags .= $cmdcompile; - my $recipe = <<"EOF"; -$obj$objext: $deps -EOF - if (defined $makedepprog && $makedepprog !~ /\/makedepend/) { + my $recipe; + # extension-specific rules + if (grep /\.s$/, @srcs) { $recipe .= <<"EOF"; +$obj$objext: $deps + $cmd $cmdflags -c -o \$\@ $srcs +EOF + } elsif (grep /\.S$/, @srcs) { + # In case one wonders why not just $(CC) -c file.S. While it + # does work with contemporary compilers, there are some legacy + # ones that get it wrong. Hence the elaborate scheme... We + # don't care to maintain dependecy lists, because dependency + # is rather weak, at most one header file that lists constants + # which are assigned in ascending order. + $recipe .= <<"EOF"; +$obj$objext: $deps + ( trap "rm -f \$@.*" INT 0; \\ + \$(CPP) $incs $cmdflags $srcs | \\ + \$(PERL) -ne '/^#(line)?\\s*[0-9]+/ or print' > \$@.s && \\ + $cmd $cmdflags -c -o \$\@ \$@.s ) +EOF + } elsif (defined $makedepprog && $makedepprog !~ /\/makedepend/) { + $recipe .= <<"EOF"; +$obj$objext: $deps $cmd $incs $cmdflags -MMD -MF $obj$depext.tmp -MT \$\@ -c -o \$\@ $srcs \@touch $obj$depext.tmp \@if cmp $obj$depext.tmp $obj$depext > /dev/null 2> /dev/null; then \\ @@ -956,7 +1027,8 @@ EOF EOF } else { $recipe .= <<"EOF"; - $cmd $incs $cmdflags -o \$\@ $srcs +$obj$objext: $deps + $cmd $incs $cmdflags $cmdcompile -o \$\@ $srcs EOF if (defined $makedepprog && $makedepprog =~ /\/makedepend/) { $recipe .= <<"EOF"; @@ -1020,7 +1092,7 @@ EOF $target: $deps \$(CC) \$(LIB_CFLAGS) $linkflags\$(LIB_LDFLAGS)$shared_soname$shared_imp \\ -o $target_full$shared_def $objs \\ - \$(PLIB_LDFLAGS) $linklibs \$(EX_LIBS) + $linklibs \$(LIB_EX_LIBS) EOF if (windowsdll()) { $recipe .= <<"EOF"; @@ -1063,7 +1135,7 @@ EOF $target: $objs $deps \$(CC) \$(DSO_CFLAGS) $linkflags\$(DSO_LDFLAGS) \\ -o $target $objs \\ - \$(PLIB_LDFLAGS) $linklibs \$(EX_LIBS) + $linklibs \$(DSO_EX_LIBS) EOF } sub obj2lib { @@ -1111,7 +1183,7 @@ $bin$exeext: $objs $deps rm -f $bin$exeext \$\${LDCMD:-$cmd} $cmdflags $linkflags\$(BIN_LDFLAGS) \\ -o $bin$exeext $objs \\ - \$(PLIB_LDFLAGS) $linklibs \$(EX_LIBS) + $linklibs \$(BIN_EX_LIBS) EOF } sub in2script { diff --git a/Configurations/windows-makefile.tmpl b/Configurations/windows-makefile.tmpl index 2f6426d1..b2742e01 100644 --- a/Configurations/windows-makefile.tmpl +++ b/Configurations/windows-makefile.tmpl @@ -14,18 +14,18 @@ (our $sover_dirname = $config{shlib_version_number}) =~ s|\.|_|g; + my $build_scheme = $target{build_scheme}; + my $install_flavour = $build_scheme->[$#$build_scheme]; # last element my $win_installenv = - $target{build_scheme}->[2] eq "VC-W32" ? - "ProgramFiles(x86)" : "ProgramW6432"; + $install_flavour eq "VC-WOW" ? "ProgramFiles(x86)" + : "ProgramW6432"; my $win_commonenv = - $target{build_scheme}->[2] eq "VC-W32" - ? "CommonProgramFiles(x86)" : "CommonProgramW6432"; + $install_flavour eq "VC-WOW" ? "CommonProgramFiles(x86)" + : "CommonProgramW6432"; our $win_installroot = - defined($ENV{$win_installenv}) - ? $win_installenv : 'ProgramFiles'; + defined($ENV{$win_installenv}) ? $win_installenv : 'ProgramFiles'; our $win_commonroot = - defined($ENV{$win_commonenv}) - ? $win_commonenv : 'CommonProgramFiles'; + defined($ENV{$win_commonenv}) ? $win_commonenv : 'CommonProgramFiles'; # expand variables early $win_installroot = $ENV{$win_installroot}; @@ -163,50 +163,143 @@ ENGINESDIR=$(ENGINESDIR_dev)$(ENGINESDIR_dir) libdir={- file_name_is_absolute($libdir) ? $libdir : '$(INSTALLTOP)\$(LIBDIR)' -} -CC={- $config{cc} -} -CPP={- $config{cpp} -} -CPPFLAGS={- our $cppflags = join(" ", - (map { "-D".$_} @{$config{defines}}), - (map { " /I ".$_} @{$config{includes}}), - @{$config{cppflags}}) -} -CPPFLAGS_Q={- $cppflags =~ s|([\\"])|\\$1|g; $cppflags -} -CFLAGS={- join(' ', @{$config{cflags}}) -} -COUTFLAG={- $target{coutflag} || "/Fo" -}$(OSSL_EMPTY) -RC={- $config{rc} -} -RCOUTFLAG={- $target{rcoutflag} || "/fo" -}$(OSSL_EMPTY) -LD={- $config{ld} -} -LDFLAGS={- join(' ', @{$config{lflags}}) -} -LDOUTFLAG={- $target{loutflag} || "/out:" -}$(OSSL_EMPTY) -EX_LIBS={- join(' ', @{$config{ex_libs}}) -} +##### User defined commands and flags ################################ -LIB_CPPFLAGS={- join(' ', '$(CPPFLAGS)', - $target{shared_cppflag} || (), - (map { quotify_l("-D".$_) } - "OPENSSLDIR=\"$openssldir\"", - "ENGINESDIR=\"$enginesdir\"")) -} -LIB_CFLAGS={- join(' ', '$(CFLAGS)', $target{lib_cflags} || (), $target{shared_cflag} || ()) -} -LIB_LDFLAGS={- join(' ', '$(LDFLAGS)', $target{shared_ldflag} || (), $config{shared_ldflag} || ()) -} -DSO_CPPFLAGS={- join(' ', '$(CPPFLAGS)', $target{dso_cppflags} || ()) -} -DSO_CFLAGS={- join(' ', '$(CFLAGS)', $target{dso_cflags} || ()) -} -DSO_LDFLAGS={- join(' ', '$(LDFLAGS)', $target{dso_ldflag} || ()) -} -BIN_CPPFLAGS={- join(' ', '$(CPPFLAGS)', $target{dso_cppflags} || ()) -} -BIN_CFLAGS={- join(' ', '$(CFLAGS)', $target{bin_cflags} || ()) -} -BIN_LDFLAGS={- join(' ', '$(LDFLAGS)', $target{bin_lflags} || ()) -} +CC={- $config{CC} -} +CPP={- $config{CPP} -} +CPPFLAGS={- our $cppflags1 = join(" ", + (map { "-D".$_} @{$config{CPPDEFINES}}), + (map { " /I ".$_} @{$config{CPPINCLUDES}}), + @{$config{CPPFLAGS}}) -} +CFLAGS={- join(' ', @{$config{CFLAGS}}) -} +LD={- $config{LD} -} +LDFLAGS={- join(' ', @{$config{LDFLAGS}}) -} +EX_LIBS={- join(' ', @{$config{LDLIBS}}) -} PERL={- $config{perl} -} -AR={- $config{ar} -} -ARFLAGS= {- join(' ', @{$config{arflags}}) -} -AROUTFLAG={- $target{aroutflag} || "/out:" -}$(OSSL_EMPTY) +AR={- $config{AR} -} +ARFLAGS= {- join(' ', @{$config{ARFLAGS}}) -} -MT={- $config{mt} -} -MTFLAGS= {- join(' ', @{$config{mtflags}}) -} -MTINFLAG={- $target{mtinflag} || "-manifest " -}$(OSSL_EMPTY) -MTOUTFLAG={- $target{mtoutflag} || "-outputresource:" -}$(OSSL_EMPTY) +MT={- $config{MT} -} +MTFLAGS= {- join(' ', @{$config{MTFLAGS}}) -} -AS={- $config{as} -} -ASFLAGS={- join(' ', @{$config{asflags}}) -} +AS={- $config{AS} -} +ASFLAGS={- join(' ', @{$config{ASFLAGS}}) -} + +RC={- $config{RC} -} + +##### Special command flags ########################################## + +COUTFLAG={- $target{coutflag} -}$(OSSL_EMPTY) +LDOUTFLAG={- $target{ldoutflag} -}$(OSSL_EMPTY) +AROUTFLAG={- $target{aroutflag} -}$(OSSL_EMPTY) +MTINFLAG={- $target{mtinflag} -}$(OSSL_EMPTY) +MTOUTFLAG={- $target{mtoutflag} -}$(OSSL_EMPTY) ASOUTFLAG={- $target{asoutflag} -}$(OSSL_EMPTY) +RCOUTFLAG={- $target{rcoutflag} -}$(OSSL_EMPTY) + +##### Project flags ################################################## + +# Variables starting with CNF_ are common variables for all product types + +CNF_ASFLAGS={- join(' ', $target{asflags} || (), + @{$config{asflags}}) -} +CNF_CPPFLAGS={- our $cppfags2 = + join(' ', $target{cppflags} || (), + (map { quotify_l("-D".$_) } @{$target{defines}}, + @{$config{defines}}), + (map { quotify_l("-I".$_) } @{$target{includes}}, + @{$config{includes}}), + @{$config{cppflags}}) -} +CNF_CFLAGS={- join(' ', $target{cflags} || (), + @{$config{cflags}}) -} +CNF_CXXFLAGS={- join(' ', $target{cxxflags} || (), + @{$config{cxxflags}}) -} +CNF_LDFLAGS={- join(' ', $target{lflags} || (), + @{$config{lflags}}) -} +CNF_EX_LIBS={- join(' ', $target{ex_libs} || (), + @{$config{ex_libs}}) -} + +# Variables starting with LIB_ are used to build library object files +# and shared libraries. +# Variables starting with DSO_ are used to build DSOs and their object files. +# Variables starting with BIN_ are used to build programs and their object +# files. + +LIB_ASFLAGS={- join(' ', $target{lib_asflags} || (), + @{$config{lib_asflags}}, + '$(CNF_ASFLAGS)', '$(ASFLAGS)') -} +LIB_CPPFLAGS={- our $lib_cppflags = + join(' ', $target{lib_cppflags} || (), + $target{shared_cppflag} || (), + (map { quotify_l("-D".$_) } + @{$target{lib_defines}}, + @{$target{shared_defines}}, + @{$config{lib_defines}}, + @{$config{shared_defines}}), + (map { quotify_l("-I".$_) } + @{$target{lib_includes}}, + @{$target{shared_includes}}, + @{$config{lib_includes}}, + @{$config{shared_includes}}), + @{$config{lib_cppflags}}, + @{$config{shared_cppflag}}); + join(' ', $lib_cppflags, + (map { quotify_l("-D".$_) } + "OPENSSLDIR=\"$openssldir\"", + "ENGINESDIR=\"$enginesdir\""), + '$(CNF_CPPFLAGS)', '$(CPPFLAGS)') -} +LIB_CFLAGS={- join(' ', $target{lib_cflags} || (), + $target{shared_cflag} || (), + @{$config{lib_cflags}}, + @{$config{shared_cflag}}, + '$(CNF_CFLAGS)', '$(CFLAGS)') -} +LIB_LDFLAGS={- join(' ', $target{shared_ldflag} || (), + $config{shared_ldflag} || (), + '$(CNF_LDFLAGS)', '$(LDFLAGS)') -} +LIB_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS) +DSO_ASFLAGS={- join(' ', $target{dso_asflags} || (), + $target{module_asflags} || (), + @{$config{dso_asflags}}, + @{$config{module_asflags}}, + '$(CNF_ASFLAGS)', '$(ASFLAGS)') -} +DSO_CPPFLAGS={- join(' ', $target{dso_cppflags} || (), + $target{module_cppflags} || (), + @{$config{dso_cppflags}}, + @{$config{module_cppflags}}, + '$(CNF_CPPFLAGS)', '$(CPPFLAGS)') -} +DSO_CFLAGS={- join(' ', $target{dso_cflags} || (), + $target{module_cflags} || (), + @{$config{dso_cflags}}, + @{$config{module_cflags}}, + '$(CNF_CFLAGS)', '$(CFLAGS)') -} +DSO_LDFLAGS={- join(' ', $target{dso_lflags} || (), + $target{module_ldflags} || (), + @{$config{dso_lflags}}, + @{$config{module_ldflags}}, + '$(CNF_LDFLAGS)', '$(LDFLAGS)') -} +DSO_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS) +BIN_ASFLAGS={- join(' ', $target{bin_asflags} || (), + @{$config{bin_asflags}}, + '$(CNF_ASFLAGS)', '$(ASFLAGS)') -} +BIN_CPPFLAGS={- join(' ', $target{bin_cppflags} || (), + @{$config{bin_cppflags}}, + '$(CNF_CPPFLAGS)', '$(CPPFLAGS)') -} +BIN_CFLAGS={- join(' ', $target{bin_cflags} || (), + @{$config{bin_cflags}}, + '$(CNF_CFLAGS)', '$(CFLAGS)') -} +BIN_LDFLAGS={- join(' ', $target{bin_lflags} || (), + @{$config{bin_lflags}}, + '$(CNF_LDFLAGS)', '$(LDFLAGS)') -} +BIN_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS) + +# CPPFLAGS_Q is used for one thing only: to build up buildinf.h +CPPFLAGS_Q={- $cppflags1 =~ s|([\\"])|\\$1|g; + $cppflags2 =~ s|([\\"])|\\$1|g; + join(' ', $lib_cppflags || (), $cppflags2 || (), + $cppflags1 || ()) -} + PERLASM_SCHEME= {- $target{perlasm_scheme} -} PROCESSOR= {- $config{processor} -} @@ -288,6 +381,9 @@ distclean: clean -del /Q /F makefile depend: + @ rem {- output_off() if $disabled{makedepend}; "" -} + @ "$(PERL)" "$(SRCDIR)\util\add-depends.pl" + @ rem {- output_on() if $disabled{makedepend}; "" -} # Install helper targets ############################################# @@ -406,7 +502,8 @@ reconfigure reconf: sub generatesrc { my %args = @_; (my $target = $args{src}) =~ s/\.[sS]$/.asm/; - my $generator = '"'.join('" "', @{$args{generator}}).'"'; + my ($gen0, @gens) = @{$args{generator}}; + my $generator = '"'.$gen0.'"'.join('', map { " $_" } @gens); my $generator_incs = join("", map { " -I \"$_\"" } @{$args{generator_incs}}); my $incs = join("", map { " /I \"$_\"" } @{$args{incs}}); my $deps = @{$args{deps}} ? @@ -483,6 +580,9 @@ EOF $cflags .= { lib => ' $(LIB_CPPFLAGS)', dso => ' $(DSO_CPPFLAGS)', bin => ' $(BIN_CPPFLAGS)' } -> {$args{intent}}; + my $asflags = { lib => ' $(LIB_ASFLAGS)', + dso => ' $(DSO_ASFLAGS)', + bin => ' $(BIN_ASFLAGS)' } -> {$args{intent}}; my $makedepprog = $config{makedepprog}; if ($srcs[0] =~ /\.rc$/) { return <<"EOF"; @@ -494,7 +594,7 @@ EOF if ($srcs[0] =~ /\.asm$/) { return <<"EOF"; $obj$objext: $deps - \$(AS) \$(ASFLAGS) \$(ASOUTFLAG)\$\@ $srcs + \$(AS) $asflags \$(ASOUTFLAG)\$\@ $srcs EOF } return <<"EOF" if (!$disabled{makedepend}); @@ -541,7 +641,7 @@ $target: $deps \$(LD) \$(LDFLAGS) \$(LIB_LDFLAGS) \\ /implib:\$@ \$(LDOUTFLAG)$shlib$shlibext$shared_def @<< || (DEL /Q \$(\@B).* $shlib.* && EXIT 1) $objs -$linklibs\$(EX_LIBS) +$linklibs\$(LIB_EX_LIBS) << IF EXIST $shlib$shlibext.manifest \\ \$(MT) \$(MTFLAGS) \$(MTINFLAG)$shlib$shlibext.manifest \$(MTOUTFLAG)$shlib$shlibext @@ -572,7 +672,7 @@ EXPORTS v_check @2 << $objs -$linklibs \$(EX_LIBS) +$linklibs \$(DSO_EX_LIBS) << IF EXIST $dso$dsoext.manifest \\ \$(MT) \$(MTFLAGS) \$(MTINFLAG)$dso$dsoext.manifest \$(MTOUTFLAG)$dso$dsoext @@ -612,7 +712,7 @@ $bin$exeext: $deps \$(LD) \$(LDFLAGS) \$(BIN_LDFLAGS) \$(LDOUTFLAG)$bin$exeext @<< $objs setargv.obj -$linklibs\$(EX_LIBS) +$linklibs\$(BIN_EX_LIBS) << IF EXIST $bin$exeext.manifest \\ \$(MT) \$(MTFLAGS) \$(MTINFLAG)$bin$exeext.manifest \$(MTOUTFLAG)$bin$exeext diff --git a/Configure b/Configure old mode 100755 new mode 100644 index 3c40a0e2..adb098e7 --- a/Configure +++ b/Configure @@ -568,15 +568,31 @@ my %user_synonyms = ( HASHBANGPERL=> 'PERL', RC => 'WINDRES', ); -my %user_to_target = ( - # If not given here, the value is the lc of the key - CPPDEFINES => 'defines', - CPPINCLUDES => 'includes', - CROSS_COMPILE => 'cross_compile_prefix', - LDFLAGS => 'lflags', - LDLIBS => 'ex_libs', + +# Some target attributes have been renamed, this is the translation table +my %target_attr_translate =( + ar => 'AR', + as => 'AS', + cc => 'CC', + cxx => 'CXX', + cpp => 'CPP', + hashbangperl => 'HASHBANGPERL', + ld => 'LD', + mt => 'MT', + ranlib => 'RANLIB', + rc => 'RC', + rm => 'RM', ); +# Initialisers coming from 'config' scripts +$config{defines} = [ split(/$list_separator_re/, env('__CNF_CPPDEFINES')) ], +$config{includes} = [ split(/$list_separator_re/, env('__CNF_CPPINCLUDES')) ], +$config{cppflags} = [ env('__CNF_CPPFLAGS') || () ], +$config{cflags} = [ env('__CNF_CFLAGS') || () ], +$config{cxxflags} = [ env('__CNF_CXXFLAGS') || () ], +$config{lflags} = [ env('__CNF_LDFLAGS') || () ], +$config{ex_libs} = [ env('__CNF_LDLIBS') || () ], + $config{openssl_api_defines}=[]; $config{openssl_algorithm_defines}=[]; $config{openssl_thread_defines}=[]; @@ -605,10 +621,10 @@ while (@argvcopy) { $user{$1} = ref $user{$1} eq "ARRAY" ? [] : undef; } - if (exists $useradd{$1}) - { - $useradd{$1} = []; - } + #if (exists $useradd{$1}) + # { + # $useradd{$1} = []; + # } next; } @@ -875,6 +891,33 @@ while (@argvcopy) } } +# If any %useradd entry has been set, we must check that the environment +# variables haven't been set. We start by checking of any %useradd entry +# is set. +if (grep { scalar @$_ > 0 } values %useradd) { + # Hash of env / make variables names. The possible values are: + # 1 - environment set + # 2 - %useradd entry set + # 3 - both set + my %detected_env = + map { my $v = 0; + $v += 1 if env($_); + $v += 2 if @{$useradd{$_}}; + $_ => $v } + keys %useradd; + + # If any of the corresponding environment variables is set, we error + if (grep { $_ & 1 } values %detected_env) { + my $names = join(', ', grep { $detected_env{$_} > 0 } + sort keys %detected_env); + die <<"_____"; +***** Mixing env / make variables and additional compiler/linker flags as +***** configure command line option is not permitted. +***** Affected env / make variables: $names +_____ + } +} + foreach (keys %user) { my $value = env($_); $value //= defined $user_synonyms{$_} ? env($user_synonyms{$_}) : undef; @@ -969,13 +1012,19 @@ my %target = resolve_config($target); &usage if (!%target || $target{template}); +foreach (keys %target_attr_translate) { + $target{$target_attr_translate{$_}} = $target{$_} + if $target{$_}; + delete $target{$_}; +} + %target = ( %{$table{DEFAULTS}}, %target ); # Make the flags to build DSOs the same as for shared libraries unless they # are already defined -$target{dso_cflags} = $target{shared_cflag} unless defined $target{dso_cflags}; -$target{dso_cxxflags} = $target{shared_cxxflag} unless defined $target{dso_cxxflags}; -$target{dso_lflags} = $target{shared_ldflag} unless defined $target{dso_lflags}; +$target{module_cflags} = $target{shared_cflag} unless defined $target{module_cflags}; +$target{module_cxxflags} = $target{shared_cxxflag} unless defined $target{module_cxxflags}; +$target{module_ldflags} = $target{shared_ldflag} unless defined $target{module_ldflags}; { my $shared_info_pl = catfile(dirname($0), "Configurations", "shared-info.pl"); @@ -997,10 +1046,10 @@ $target{dso_lflags} = $target{shared_ldflag} unless defined $target{dso_lflags}; # Windows and VMS. if (defined $si) { # Just as above, copy certain shared_* attributes to the corresponding - # dso_ attribute unless the latter is already defined - $si->{dso_cflags} = $si->{shared_cflag} unless defined $si->{dso_cflags}; - $si->{dso_cxxflags} = $si->{shared_cxxflag} unless defined $si->{dso_cxxflags}; - $si->{dso_lflags} = $si->{shared_ldflag} unless defined $si->{dso_lflags}; + # module_ attribute unless the latter is already defined + $si->{module_cflags} = $si->{shared_cflag} unless defined $si->{module_cflags}; + $si->{module_cxxflags} = $si->{shared_cxxflag} unless defined $si->{module_cxxflags}; + $si->{module_ldflags} = $si->{shared_ldflag} unless defined $si->{module_ldflags}; foreach (sort keys %$si) { $target{$_} = defined $target{$_} ? add($si->{$_})->($target{$_}) @@ -1031,7 +1080,8 @@ foreach my $feature (@{$target{enable}}) { } } -$target{cxxflags}//=$target{cflags} if $target{cxx}; +$target{CXXFLAGS}//=$target{CFLAGS} if $target{CXX}; +$target{cxxflags}//=$target{cflags} if $target{CXX}; $target{exe_extension}=""; $target{exe_extension}=".exe" if ($config{target} eq "DJGPP" || $config{target} =~ /^(?:Cygwin|mingw)/); @@ -1048,7 +1098,6 @@ $target{dso_extension}=$target{shared_extension_simple}; # the default string. $config{perl} = ($^O ne "VMS" ? $^X : "perl"); foreach (keys %user) { - my $target_key = $user_to_target{$_} // lc $_; my $ref_type = ref $user{$_}; # Temporary function. Takes an intended ref type (empty string or "ARRAY") @@ -1074,12 +1123,11 @@ foreach (keys %user) { return $value; }; - $config{$target_key} = + $config{$_} = $mkvalue->($ref_type, $user{$_}) - || $mkvalue->($ref_type, $target{$target_key}); - delete $config{$target_key} unless defined $config{$target_key}; + || $mkvalue->($ref_type, $target{$_}); + delete $config{$_} unless defined $config{$_}; } -$config{plib_lflags} = [ $target{plib_lflags} ]; # Allow overriding the build file name $config{build_file} = env('BUILDFILE') || $target{build_file} || "Makefile"; @@ -1149,10 +1197,10 @@ foreach my $checker (($builder_platform."-".$target{build_file}."-checker.pm", push @{$config{defines}}, "NDEBUG" if $config{build_type} eq "release"; -if ($target =~ /^mingw/ && `$config{cc} --target-help 2>&1` =~ m/-mno-cygwin/m) +if ($target =~ /^mingw/ && `$config{CC} --target-help 2>&1` =~ m/-mno-cygwin/m) { push @{$config{cflags}}, "-mno-cygwin"; - push @{$config{cxxflags}}, "-mno-cygwin" if $config{cxx}; + push @{$config{cxxflags}}, "-mno-cygwin" if $config{CXX}; push @{$config{shared_ldflag}}, "-mno-cygwin"; } @@ -1164,7 +1212,7 @@ if ($target =~ /linux.*-mips/ && !$disabled{asm} $value = '-mips2' if ($target =~ /mips32/); $value = '-mips3' if ($target =~ /mips64/); unshift @{$config{cflags}}, $value; - unshift @{$config{cxxflags}}, $value if $config{cxx}; + unshift @{$config{cxxflags}}, $value if $config{CXX}; } # The DSO code currently always implements all functions so that no @@ -1178,15 +1226,15 @@ if (!$disabled{dso} && $target{dso_scheme} ne "") $target{dso_scheme} =~ tr/[a-z]/[A-Z]/; if ($target{dso_scheme} eq "DLFCN") { - unshift @{$config{defines}}, "DSO_DLFCN", "HAVE_DLFCN_H"; + unshift @{$config{lib_defines}}, "DSO_DLFCN", "HAVE_DLFCN_H"; } elsif ($target{dso_scheme} eq "DLFCN_NO_H") { - unshift @{$config{defines}}, "DSO_DLFCN"; + unshift @{$config{lib_defines}}, "DSO_DLFCN"; } else { - unshift @{$config{defines}}, "DSO_$target{dso_scheme}"; + unshift @{$config{lib_defines}}, "DSO_$target{dso_scheme}"; } } @@ -1237,16 +1285,16 @@ if ($target{shared_target} eq "") } if ($disabled{"dynamic-engine"}) { - push @{$config{defines}}, "OPENSSL_NO_DYNAMIC_ENGINE"; + push @{$config{openssl_other_defines}}, "OPENSSL_NO_DYNAMIC_ENGINE"; $config{dynamic_engines} = 0; } else { - push @{$config{defines}}, "OPENSSL_NO_STATIC_ENGINE"; + push @{$config{openssl_other_defines}}, "OPENSSL_NO_STATIC_ENGINE"; $config{dynamic_engines} = 1; } unless ($disabled{asan}) { push @{$config{cflags}}, "-fsanitize=address"; - push @{$config{cxxflags}}, "-fsanitize=address" if $config{cxx}; + push @{$config{cxxflags}}, "-fsanitize=address" if $config{CXX}; } unless ($disabled{ubsan}) { @@ -1254,18 +1302,18 @@ unless ($disabled{ubsan}) { # platforms. push @{$config{cflags}}, "-fsanitize=undefined", "-fno-sanitize-recover=all"; push @{$config{cxxflags}}, "-fsanitize=undefined", "-fno-sanitize-recover=all" - if $config{cxx}; + if $config{CXX}; } unless ($disabled{msan}) { push @{$config{cflags}}, "-fsanitize=memory"; - push @{$config{cxxflags}}, "-fsanitize=memory" if $config{cxx}; + push @{$config{cxxflags}}, "-fsanitize=memory" if $config{CXX}; } unless ($disabled{"fuzz-libfuzzer"} && $disabled{"fuzz-afl"} && $disabled{asan} && $disabled{ubsan} && $disabled{msan}) { push @{$config{cflags}}, "-fno-omit-frame-pointer", "-g"; - push @{$config{cxxflags}}, "-fno-omit-frame-pointer", "-g" if $config{cxx}; + push @{$config{cxxflags}}, "-fno-omit-frame-pointer", "-g" if $config{CXX}; } # # Platform fix-ups @@ -1275,9 +1323,9 @@ unless ($disabled{"fuzz-libfuzzer"} && $disabled{"fuzz-afl"} if ($disabled{pic}) { foreach (qw(shared_cflag shared_cxxflag shared_cppflag - shared_defines shared_includes shared_ldflag - dso_cflags dso_cxxflags dso_cppflags - dso_defines dso_includes dso_lflags)) + shared_defines shared_includes shared_ldflag + module_cflags module_cxxflags module_cppflags + module_defines module_includes module_lflags)) { delete $config{$_}; $target{$_} = ""; @@ -1285,7 +1333,7 @@ if ($disabled{pic}) } else { - push @{$config{defines}}, "OPENSSL_PIC"; + push @{$config{lib_defines}}, "OPENSSL_PIC"; } if ($target{sys_id} ne "") @@ -1295,69 +1343,69 @@ if ($target{sys_id} ne "") unless ($disabled{asm}) { $target{cpuid_asm_src}=$table{DEFAULTS}->{cpuid_asm_src} if ($config{processor} eq "386"); - push @{$config{defines}}, "OPENSSL_CPUID_OBJ" if ($target{cpuid_asm_src} ne "mem_clr.c"); + push @{$config{lib_defines}}, "OPENSSL_CPUID_OBJ" if ($target{cpuid_asm_src} ne "mem_clr.c"); $target{bn_asm_src} =~ s/\w+-gf2m.c// if (defined($disabled{ec2m})); # bn-586 is the only one implementing bn_*_part_words - push @{$config{defines}}, "OPENSSL_BN_ASM_PART_WORDS" if ($target{bn_asm_src} =~ /bn-586/); - push @{$config{defines}}, "OPENSSL_IA32_SSE2" if (!$disabled{sse2} && $target{bn_asm_src} =~ /86/); + push @{$config{lib_defines}}, "OPENSSL_BN_ASM_PART_WORDS" if ($target{bn_asm_src} =~ /bn-586/); + push @{$config{lib_defines}}, "OPENSSL_IA32_SSE2" if (!$disabled{sse2} && $target{bn_asm_src} =~ /86/); - push @{$config{defines}}, "OPENSSL_BN_ASM_MONT" if ($target{bn_asm_src} =~ /-mont/); - push @{$config{defines}}, "OPENSSL_BN_ASM_MONT5" if ($target{bn_asm_src} =~ /-mont5/); - push @{$config{defines}}, "OPENSSL_BN_ASM_GF2m" if ($target{bn_asm_src} =~ /-gf2m/); + push @{$config{lib_defines}}, "OPENSSL_BN_ASM_MONT" if ($target{bn_asm_src} =~ /-mont/); + push @{$config{lib_defines}}, "OPENSSL_BN_ASM_MONT5" if ($target{bn_asm_src} =~ /-mont5/); + push @{$config{lib_defines}}, "OPENSSL_BN_ASM_GF2m" if ($target{bn_asm_src} =~ /-gf2m/); if ($target{sha1_asm_src}) { - push @{$config{defines}}, "SHA1_ASM" if ($target{sha1_asm_src} =~ /sx86/ || $target{sha1_asm_src} =~ /sha1/); - push @{$config{defines}}, "SHA256_ASM" if ($target{sha1_asm_src} =~ /sha256/); - push @{$config{defines}}, "SHA512_ASM" if ($target{sha1_asm_src} =~ /sha512/); + push @{$config{lib_defines}}, "SHA1_ASM" if ($target{sha1_asm_src} =~ /sx86/ || $target{sha1_asm_src} =~ /sha1/); + push @{$config{lib_defines}}, "SHA256_ASM" if ($target{sha1_asm_src} =~ /sha256/); + push @{$config{lib_defines}}, "SHA512_ASM" if ($target{sha1_asm_src} =~ /sha512/); } if ($target{rc4_asm_src} ne $table{DEFAULTS}->{rc4_asm_src}) { - push @{$config{defines}}, "RC4_ASM"; + push @{$config{lib_defines}}, "RC4_ASM"; } if ($target{md5_asm_src}) { - push @{$config{defines}}, "MD5_ASM"; + push @{$config{lib_defines}}, "MD5_ASM"; } $target{cast_asm_src}=$table{DEFAULTS}->{cast_asm_src} unless $disabled{pic}; # CAST assembler is not PIC if ($target{rmd160_asm_src}) { - push @{$config{defines}}, "RMD160_ASM"; + push @{$config{lib_defines}}, "RMD160_ASM"; } if ($target{aes_asm_src}) { - push @{$config{defines}}, "AES_ASM" if ($target{aes_asm_src} =~ m/\baes-/);; + push @{$config{lib_defines}}, "AES_ASM" if ($target{aes_asm_src} =~ m/\baes-/);; # aes-ctr.fake is not a real file, only indication that assembler # module implements AES_ctr32_encrypt... - push @{$config{defines}}, "AES_CTR_ASM" if ($target{aes_asm_src} =~ s/\s*aes-ctr\.fake//); + push @{$config{lib_defines}}, "AES_CTR_ASM" if ($target{aes_asm_src} =~ s/\s*aes-ctr\.fake//); # aes-xts.fake indicates presence of AES_xts_[en|de]crypt... - push @{$config{defines}}, "AES_XTS_ASM" if ($target{aes_asm_src} =~ s/\s*aes-xts\.fake//); + push @{$config{lib_defines}}, "AES_XTS_ASM" if ($target{aes_asm_src} =~ s/\s*aes-xts\.fake//); $target{aes_asm_src} =~ s/\s*(vpaes|aesni)-x86\.s//g if ($disabled{sse2}); - push @{$config{defines}}, "VPAES_ASM" if ($target{aes_asm_src} =~ m/vpaes/); - push @{$config{defines}}, "BSAES_ASM" if ($target{aes_asm_src} =~ m/bsaes/); + push @{$config{lib_defines}}, "VPAES_ASM" if ($target{aes_asm_src} =~ m/vpaes/); + push @{$config{lib_defines}}, "BSAES_ASM" if ($target{aes_asm_src} =~ m/bsaes/); } if ($target{wp_asm_src} =~ /mmx/) { if ($config{processor} eq "386") { $target{wp_asm_src}=$table{DEFAULTS}->{wp_asm_src}; } elsif (!$disabled{"whirlpool"}) { - push @{$config{defines}}, "WHIRLPOOL_ASM"; + push @{$config{lib_defines}}, "WHIRLPOOL_ASM"; } } if ($target{modes_asm_src} =~ /ghash-/) { - push @{$config{defines}}, "GHASH_ASM"; + push @{$config{lib_defines}}, "GHASH_ASM"; } if ($target{ec_asm_src} =~ /ecp_nistz256/) { - push @{$config{defines}}, "ECP_NISTZ256_ASM"; + push @{$config{lib_defines}}, "ECP_NISTZ256_ASM"; } if ($target{ec_asm_src} =~ /x25519/) { - push @{$config{defines}}, "X25519_ASM"; + push @{$config{lib_defines}}, "X25519_ASM"; } if ($target{padlock_asm_src} ne $table{DEFAULTS}->{padlock_asm_src}) { - push @{$config{defines}}, "PADLOCK_ASM"; + push @{$config{lib_defines}}, "PADLOCK_ASM"; } if ($target{poly1305_asm_src} ne "") { - push @{$config{defines}}, "POLY1305_ASM"; + push @{$config{lib_defines}}, "POLY1305_ASM"; } } -my %predefined = compiler_predefined($config{cc}); +my %predefined = compiler_predefined($config{CC}); # Check for makedepend capabilities. if (!$disabled{makedepend}) { @@ -1368,7 +1416,7 @@ if (!$disabled{makedepend}) { } elsif ($predefined{__GNUC__} >= 3) { # We know that GNU C version 3 and up as well as all clang # versions support dependency generation - $config{makedepprog} = "\$(CROSS_COMPILE)$config{cc}"; + $config{makedepprog} = "\$(CROSS_COMPILE)$config{CC}"; } else { # In all other cases, we look for 'makedepend', and disable the # capability if not found. @@ -1410,7 +1458,7 @@ die "Exactly one of SIXTY_FOUR_BIT|SIXTY_FOUR_BIT_LONG|THIRTY_TWO_BIT can be set $config{cflags} = [ map { (my $x = $_) =~ s/([\\\"])/\\$1/g; $x } @{$config{cflags}} ]; $config{cxxflags} = [ map { (my $x = $_) =~ s/([\\\"])/\\$1/g; $x } - @{$config{cxxflags}} ] if $config{cxx}; + @{$config{cxxflags}} ] if $config{CXX}; if (defined($config{api})) { $config{openssl_api_defines} = [ "OPENSSL_MIN_API=".$apitable->{$config{api}} ]; @@ -1420,7 +1468,7 @@ if (defined($config{api})) { if (defined($predefined{__clang__}) && !$disabled{asm}) { push @{$config{cflags}}, "-Qunused-arguments"; - push @{$config{cxxflags}}, "-Qunused-arguments" if $config{cxx}; + push @{$config{cxxflags}}, "-Qunused-arguments" if $config{CXX}; } if ($strict_warnings) @@ -1436,7 +1484,7 @@ if ($strict_warnings) push @{$config{cflags}}, $wopt unless grep { $_ eq $wopt } @{$config{cflags}}; push @{$config{cxxflags}}, $wopt - if ($config{cxx} + if ($config{CXX} && !grep { $_ eq $wopt } @{$config{cxxflags}}); } if (defined($predefined{__clang__})) @@ -1446,7 +1494,7 @@ if ($strict_warnings) push @{$config{cflags}}, $wopt unless grep { $_ eq $wopt } @{$config{cflags}}; push @{$config{cxxflags}}, $wopt - if ($config{cxx} + if ($config{CXX} && !grep { $_ eq $wopt } @{$config{cxxflags}}); } } @@ -1459,7 +1507,7 @@ unless ($disabled{"crypto-mdebug-backtrace"}) push @{$config{cflags}}, $wopt unless grep { $_ eq $wopt } @{$config{cflags}}; push @{$config{cxxflags}}, $wopt - if ($config{cxx} + if ($config{CXX} && !grep { $_ eq $wopt } @{$config{cxxflags}}); } if ($target =~ /^BSD-/) @@ -1472,7 +1520,7 @@ unless ($disabled{afalgeng}) { $config{afalgeng}=""; if ($target =~ m/^linux/) { my $minver = 4*10000 + 1*100 + 0; - if ($config{cross_compile_prefix} eq "") { + if ($config{CROSS_COMPILE} eq "") { my $verstr = `uname -r`; my ($ma, $mi1, $mi2) = split("\\.", $verstr); ($mi2) = $mi2 =~ /(\d+)/; @@ -1499,12 +1547,10 @@ foreach (keys %useradd) { die "internal error: \$useradd{$_} isn't an ARRAY\n" unless ref $useradd{$_} eq 'ARRAY'; - my $target_key = $user_to_target{$_} // lc $_; - - if (defined $config{$target_key}) { - push @{$config{$target_key}}, @{$useradd{$_}}; + if (defined $config{$_}) { + push @{$config{$_}}, @{$useradd{$_}}; } else { - $config{$target_key} = [ @{$useradd{$_}} ]; + $config{$_} = [ @{$useradd{$_}} ]; } } @@ -1641,6 +1687,10 @@ if ($builder eq "unified") { my %sharednames = (); my %generate = (); + # We want to detect configdata.pm in the source tree, so we + # don't use it if the build tree is different. + my $src_configdata = cleanfile($srcdir, "configdata.pm", $blddir); + push @{$config{build_infos}}, catfile(abs2rel($sourced, $blddir), $f); my $template = Text::Template->new(TYPE => 'FILE', @@ -1937,7 +1987,7 @@ EOF # If it isn't in the source tree, we assume it's generated # in the build tree - if (! -f $s || $generate{$_}) { + if ($s eq $src_configdata || ! -f $s || $generate{$_}) { $s = cleanfile($buildd, $_, $blddir); } # We recognise C++, C and asm files @@ -1965,7 +2015,7 @@ EOF # If it isn't in the source tree, we assume it's generated # in the build tree - if (! -f $s || $generate{$_}) { + if ($s eq $src_configdata || ! -f $s || $generate{$_}) { $s = cleanfile($buildd, $_, $blddir); } @@ -2015,7 +2065,7 @@ EOF # If the destination doesn't exist in source, it can only be # a generated file in the build tree. - if ($ddest ne "" && ! -f $ddest) { + if ($ddest ne "" && ($ddest eq $src_configdata || ! -f $ddest)) { $ddest = cleanfile($buildd, $_, $blddir); if ($unified_info{rename}->{$ddest}) { $ddest = $unified_info{rename}->{$ddest}; @@ -2029,7 +2079,8 @@ EOF # in the build tree rather than the source tree, and assume # and that there are lines to build it in a BEGINRAW..ENDRAW # section or in the Makefile template. - if (! -f $d + if ($d eq $src_configdata + || ! -f $d || (grep { $d eq $_ } map { cleanfile($srcdir, $_, $blddir) } grep { /\.h$/ } keys %{$unified_info{generate}})) { @@ -2056,7 +2107,7 @@ EOF # If the destination doesn't exist in source, it can only be # a generated file in the build tree. - if (! -f $ddest) { + if ($ddest eq $src_configdata || ! -f $ddest) { $ddest = cleanfile($buildd, $_, $blddir); if ($unified_info{rename}->{$ddest}) { $ddest = $unified_info{rename}->{$ddest}; @@ -2089,16 +2140,12 @@ EOF next if $dest eq ""; foreach my $d (keys %{$unified_info{depends}->{$dest}}) { next unless $d =~ /\.(h|pm)$/; - if ($d eq "configdata.pm" - || defined($unified_info{generate}->{$d})) { - my $i = cleandir($blddir, dirname($d)); - push @{$unified_info{includes}->{$dest}->{build}}, $i - unless grep { $_ eq $i } @{$unified_info{includes}->{$dest}->{build}}; - } else { - my $i = cleandir($srcdir, dirname($d)); - push @{$unified_info{includes}->{$dest}->{source}}, $i - unless grep { $_ eq $i } @{$unified_info{includes}->{$dest}->{source}}; - } + my $i = dirname($d); + my $spot = + $d eq "configdata.pm" || defined($unified_info{generate}->{$d}) + ? 'build' : 'source'; + push @{$unified_info{includes}->{$dest}->{$spot}}, $i + unless grep { $_ eq $i } @{$unified_info{includes}->{$dest}->{$spot}}; } } @@ -2168,7 +2215,7 @@ foreach (grep /_(asm|aux)_src$/, keys %target) { print "Creating configdata.pm\n"; open(OUT,">configdata.pm") || die "unable to create configdata.pm: $!\n"; print OUT <<"EOF"; -#! $config{hashbangperl} +#! $config{HASHBANGPERL} package configdata; @@ -2306,10 +2353,9 @@ EOF } print OUT "# The following data is only used when this files is use as a script\n"; -print OUT "my \%makevars = (\n"; +print OUT "my \@makevars = (\n"; foreach (sort keys %user) { - print OUT ' ',$_,' ' x (20 - length $_),'=> ', - "'",$user_to_target{$_} || lc $_,"',\n"; + print OUT " '",$_,"',\n"; } print OUT ");\n"; print OUT "my \%disabled_info = (\n"; @@ -2440,16 +2486,17 @@ _____ } if ($dump || $makevars) { print "\nMakevars:\n\n"; - foreach my $var (sort keys %makevars) { + foreach my $var (@makevars) { my $prefix = ''; - $prefix = $config{cross_compile_prefix} + $prefix = $config{CROSS_COMPILE} if grep { $var eq $_ } @user_crossable; + $prefix //= ''; print ' ',$var,' ' x (16 - length $var),'= ', - (ref $config{$makevars{$var}} eq 'ARRAY' - ? join(' ', @{$config{$makevars{$var}}}) - : $prefix.$config{$makevars{$var}}), + (ref $config{$var} eq 'ARRAY' + ? join(' ', @{$config{$var}}) + : $prefix.$config{$var}), "\n" - if defined $config{$makevars{$var}}; + if defined $config{$var}; } my @buildfile = ($config{builddir}, $config{build_file}); @@ -2619,14 +2666,6 @@ or position independent code, please let us know (but please first make sure you have tried with a current version of OpenSSL). EOF -print <<"EOF" if (-f catfile($srcdir, "configdata.pm") && $srcdir ne $blddir); - -WARNING: there are indications that another build was made in the source -directory. This build may have picked up artifacts from that build, the -safest course of action is to clean the source directory and redo this -configuration. -EOF - print <<"EOF"; ********************************************************************** @@ -3007,11 +3046,11 @@ sub compiler_predefined { return () if $^O eq 'VMS'; - die 'compiler_predefines called without a default compiler' + die 'compiler_predefined called without a default compiler' unless $default_compiler; if (! $predefined{$default_compiler}) { - my $cc = "$config{cross_compile_prefix}$default_compiler"; + my $cc = "$config{CROSS_COMPILE}$default_compiler"; $predefined{$default_compiler} = {}; @@ -3084,7 +3123,6 @@ sub print_table_entry "ld", "lflags", "loutflag", - "plib_lflags", "ex_libs", "bn_ops", "apps_aux_src", diff --git a/INSTALL b/INSTALL index 3c8548dd..08758339 100644 --- a/INSTALL +++ b/INSTALL @@ -581,30 +581,12 @@ RCFLAGS Flags for the Windows reources manipulator. RM The command to remove files and directories. - These can be mixed with flags given on the command line. - Any variable assignment resets any corresponding flags - given before it, so for example: + These cannot be mixed with compiling / linking flags given + on the command line. In other words, something like this + isn't permitted. ./config -DFOO CPPFLAGS=-DBAR -DCOOKIE - Will end up having 'CPPFLAGS=-DBAR -DCOOKIE'. - - Here is how the flags documented above are collected as - augmentation of these variables: - - -Dxxx xxx is collected in CPPDEFINES - -Ixxx xxx is collected in CPPINCLUDES - -Wp,xxx collected in CPPFLAGS - -Lxxx collected in LDFLAGS - -lxxx collected in LDLIBS - -Wp,xxx collected in LDLIBS - -rpath xxx collected in LDLIBS - -R xxx collected in LDLIBS - -framework xxx collected in LDLIBS - -static collected in LDLIBS - -xxx collected in CFLAGS - +xxx collected in CFLAGS - reconf reconfigure Reconfigure from earlier data. This fetches the previous diff --git a/README b/README index 344f1619..84913bce 100644 --- a/README +++ b/README @@ -1,5 +1,5 @@ - OpenSSL 1.1.1-pre2 (alpha) 27 Feb 2018 + OpenSSL 1.1.1-pre3-dev Copyright (c) 1998-2018 The OpenSSL Project Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson diff --git a/apps/CA.pl.in b/apps/CA.pl.in index 784c22f6..bbaf6a9a 100644 --- a/apps/CA.pl.in +++ b/apps/CA.pl.in @@ -1,4 +1,4 @@ -#!{- $config{hashbangperl} -} +#!{- $config{HASHBANGPERL} -} # Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the OpenSSL license (the "License"). You may not use diff --git a/apps/apps.c b/apps/apps.c index 0438bdb9..5a32dc0a 100644 --- a/apps/apps.c +++ b/apps/apps.c @@ -25,6 +25,12 @@ #endif #include #include +#ifdef __VMS +# include +# include +# include +# include +#endif #include #include #include @@ -1532,12 +1538,27 @@ CA_DB *load_index(const char *dbfile, DB_ATTR *db_attr) BIO *in; CONF *dbattr_conf = NULL; char buf[BSIZE]; +#ifndef OPENSSL_NO_POSIX_IO + FILE *dbfp; + struct stat dbst; +#endif in = BIO_new_file(dbfile, "r"); if (in == NULL) { ERR_print_errors(bio_err); goto err; } + +#ifndef OPENSSL_NO_POSIX_IO + BIO_get_fp(in, &dbfp); + if (fstat(fileno(dbfp), &dbst) == -1) { + SYSerr(SYS_F_FSTAT, errno); + ERR_add_error_data(3, "fstat('", dbfile, "')"); + ERR_print_errors(bio_err); + goto err; + } +#endif + if ((tmpdb = TXT_DB_read(in, DB_NUMBER)) == NULL) goto err; @@ -1564,6 +1585,11 @@ CA_DB *load_index(const char *dbfile, DB_ATTR *db_attr) } } + retdb->dbfname = OPENSSL_strdup(dbfile); +#ifndef OPENSSL_NO_POSIX_IO + retdb->dbst = dbst; +#endif + err: NCONF_free(dbattr_conf); TXT_DB_free(tmpdb); @@ -1709,6 +1735,7 @@ void free_index(CA_DB *db) { if (db) { TXT_DB_free(db->db); + OPENSSL_free(db->dbfname); OPENSSL_free(db); } } @@ -2340,6 +2367,116 @@ int app_isdir(const char *name) } #endif +/* app_dirname section */ + +/* + * This exactly follows what POSIX's + * dirname does, but is implemented + * in a more platform independent way. + * + * path dirname + * /usr/lib /usr + * /usr/ / + * usr . + * / / + * . . + * .. . + * "" . + * + * Note: this function also keeps the + * possibility of modifying the 'path' + * string same as POSIX dirname. + */ +static char *posix_dirname(char *path) +{ + size_t l; + char *ret = "."; + + l = strlen(path); + if (l == 0) + goto out; + if (strcmp(path, ".") == 0) + goto out; + if (strcmp(path, "..") == 0) + goto out; + if (strcmp(path, "/") == 0) { + ret = "/"; + goto out; + } + if (path[l - 1] == '/') { + /* /usr/ */ + path[l - 1] = '\0'; + } + if ((ret = strrchr(path, '/')) == NULL) { + /* usr */ + ret = "."; + } else if (ret == path) { + /* /usr */ + *++ret = '\0'; + ret = path; + } else { + /* /usr/lib */ + *ret = '\0'; + ret = path; + } + out: + return ret; +} + +/* + * TODO: implement app_dirname for Windows. + */ +#if !defined(_WIN32) +char *app_dirname(char *path) +{ + return posix_dirname(path); +} +#elif defined(__VMS) +/* + * sys$filescan fills the given item list with pointers into the original + * path string, so all we need to do is to find the file name and simply + * put a NUL byte wherever the FSCN$_NAME pointer points. If there is no + * file name part and the path string isn't the empty string, we know for + * a fact that the whole string is a directory spec and return it as is. + * Otherwise or if that pointer is the starting address of the original + * path string, we know to return "sys$disk:[]", which corresponds to the + * Unixly ".". + * + * If sys$filescan returns an error status, we know that this is not + * parsable as a VMS file spec, and then use the fallback, in case we + * have a Unix type path. + */ +char *app_dirname(char *path) +{ + char *ret = "sys$disk:[]"; + struct dsc$descriptor_s dsc_path = { 0 }; + ile2 itemlist[] = { + {0, FSCN$_NAME, 0}, + {0, 0, 0} + }; + int fields; + int status; + + dsc_path.dsc$a_pointer = path; + dsc_path.dsc$w_length = strlen(path); + status = sys$filescan(&dsc_path, itemlist, &fields, 0, 0); + + if (!(status & 1)) + return posix_dirname(path); + + if ((fields & (1 << FSCN$_NAME)) == 0) { + if (dsc_path.dsc$w_length != 0) + ret = path; + } else if (itemlist[0].ile2$ps_bufaddr != path) { + if (itemlist[0].ile2$ps_bufaddr != path) { + *itemlist[0].ile2$ps_bufaddr = '\0'; + ret = path; + } + } + return ret; +} +#endif + /* raw_read|write section */ #if defined(__VMS) # include "vms_term_sock.h" diff --git a/apps/apps.h b/apps/apps.h index daaef369..aa635276 100644 --- a/apps/apps.h +++ b/apps/apps.h @@ -14,6 +14,12 @@ # include "internal/nelem.h" # include +# include +# ifndef OPENSSL_NO_POSIX_IO +# include +# include +# endif + # include # include # include @@ -509,6 +515,10 @@ typedef struct db_attr_st { typedef struct ca_db_st { DB_ATTR attributes; TXT_DB *db; + char *dbfname; +# ifndef OPENSSL_NO_POSIX_IO + struct stat dbst; +# endif } CA_DB; void* app_malloc(int sz, const char *what); @@ -594,6 +604,7 @@ void store_setup_crl_download(X509_STORE *st); int app_isdir(const char *); int app_access(const char *, int flag); +char *app_dirname(char *path); int fileno_stdin(void); int fileno_stdout(void); int raw_read_stdin(void *, int); diff --git a/apps/genrsa.c b/apps/genrsa.c index 464657c2..2bc8fa08 100644 --- a/apps/genrsa.c +++ b/apps/genrsa.c @@ -44,7 +44,7 @@ const OPTIONS genrsa_options[] = { {"3", OPT_3, '-', "Use 3 for the E value"}, {"F4", OPT_F4, '-', "Use F4 (0x10001) for the E value"}, {"f4", OPT_F4, '-', "Use F4 (0x10001) for the E value"}, - {"out", OPT_OUT, 's', "Output the key to specified file"}, + {"out", OPT_OUT, '>', "Output the key to specified file"}, OPT_R_OPTIONS, {"passout", OPT_PASSOUT, 's', "Output file pass phrase source"}, {"", OPT_CIPHER, '-', "Encrypt the output with any supported cipher"}, diff --git a/apps/ocsp.c b/apps/ocsp.c index bd16a5b8..82c11e8b 100644 --- a/apps/ocsp.c +++ b/apps/ocsp.c @@ -26,6 +26,7 @@ NON_EMPTY_TRANSLATION_UNIT /* Needs to be included before the openssl headers */ # include "apps.h" # include "progs.h" +# include "internal/sockets.h" # include # include # include @@ -33,6 +34,23 @@ NON_EMPTY_TRANSLATION_UNIT # include # include # include +# include + +# if defined(OPENSSL_SYS_UNIX) && !defined(OPENSSL_NO_SOCK) +# define OCSP_DAEMON +# include +# include +# include +# include +# define MAXERRLEN 1000 /* limit error text sent to syslog to 1000 bytes */ +# else +# undef LOG_INFO +# undef LOG_WARNING +# undef LOG_ERR +# define LOG_INFO 0 +# define LOG_WARNING 1 +# define LOG_ERR 2 +# endif /* Maximum leeway in validity period: default 5 minutes */ # define MAX_VALIDITY_PERIOD (5 * 60) @@ -56,8 +74,19 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req static char **lookup_serial(CA_DB *db, ASN1_INTEGER *ser); static BIO *init_responder(const char *port); -static int do_responder(OCSP_REQUEST **preq, BIO **pcbio, BIO *acbio); +static int do_responder(OCSP_REQUEST **preq, BIO **pcbio, BIO *acbio, int timeout); static int send_ocsp_response(BIO *cbio, OCSP_RESPONSE *resp); +static void log_message(int level, const char *fmt, ...); +static char *prog; +static int multi = 0; + +# ifdef OCSP_DAEMON +static int acfd = (int) INVALID_SOCKET; +static int index_changed(CA_DB *); +static void spawn_loop(void); +static int print_syslog(const char *str, size_t len, void *levPtr); +static void sock_timeout(int signum); +# endif # ifndef OPENSSL_NO_SOCK static OCSP_RESPONSE *query_responder(BIO *cbio, const char *host, @@ -81,7 +110,8 @@ typedef enum OPTION_choice { OPT_INDEX, OPT_CA, OPT_NMIN, OPT_REQUEST, OPT_NDAYS, OPT_RSIGNER, OPT_RKEY, OPT_ROTHER, OPT_RMD, OPT_RSIGOPT, OPT_HEADER, OPT_V_ENUM, - OPT_MD + OPT_MD, + OPT_MULTI } OPTION_CHOICE; const OPTIONS ocsp_options[] = { @@ -101,6 +131,9 @@ const OPTIONS ocsp_options[] = { "Don't include any certificates in response"}, {"resp_key_id", OPT_RESP_KEY_ID, '-', "Identify response by signing certificate key ID"}, +# ifdef OCSP_DAEMON + {"multi", OPT_MULTI, 'p', "run multiple responder processes"}, +# endif {"no_certs", OPT_NO_CERTS, '-', "Don't include any certificates in signed request"}, {"no_signature_verify", OPT_NO_SIGNATURE_VERIFY, '-', @@ -197,13 +230,10 @@ int ocsp_main(int argc, char **argv) int accept_count = -1, add_nonce = 1, noverify = 0, use_ssl = -1; int vpmtouched = 0, badsig = 0, i, ignore_err = 0, nmin = 0, ndays = -1; int req_text = 0, resp_text = 0, ret = 1; -#ifndef OPENSSL_NO_SOCK int req_timeout = -1; -#endif long nsec = MAX_VALIDITY_PERIOD, maxage = -1; unsigned long sign_flags = 0, verify_flags = 0, rflags = 0; OPTION_CHOICE o; - char *prog; reqnames = sk_OPENSSL_STRING_new_null(); if (reqnames == NULL) @@ -451,9 +481,13 @@ int ocsp_main(int argc, char **argv) goto opthelp; trailing_md = 1; break; + case OPT_MULTI: +# ifdef OCSP_DAEMON + multi = atoi(opt_arg()); +# endif + break; } } - if (trailing_md) { BIO_printf(bio_err, "%s: Digest must be before -cert or -serial\n", prog); @@ -464,7 +498,7 @@ int ocsp_main(int argc, char **argv) goto opthelp; /* Have we anything to do? */ - if (req == NULL&& reqin == NULL + if (req == NULL && reqin == NULL && respin == NULL && !(port != NULL && ridx_filename != NULL)) goto opthelp; @@ -514,14 +548,53 @@ int ocsp_main(int argc, char **argv) if (rkey == NULL) goto end; } + + if (ridx_filename != NULL + && (rkey != NULL || rsigner != NULL || rca_cert != NULL)) { + BIO_printf(bio_err, + "Responder mode requires certificate, key, and CA.\n"); + goto end; + } + + if (ridx_filename != NULL) { + rdb = load_index(ridx_filename, NULL); + if (rdb == NULL || !index_index(rdb)) { + ret = 1; + goto end; + } + } + +# ifdef OCSP_DAEMON + if (multi && acbio != NULL) + spawn_loop(); + if (acbio != NULL && req_timeout > 0) + signal(SIGALRM, sock_timeout); +#endif + if (acbio != NULL) - BIO_printf(bio_err, "Waiting for OCSP client connections...\n"); + log_message(LOG_INFO, "waiting for OCSP client connections..."); redo_accept: if (acbio != NULL) { - if (!do_responder(&req, &cbio, acbio)) - goto end; +# ifdef OCSP_DAEMON + if (index_changed(rdb)) { + CA_DB *newrdb = load_index(ridx_filename, NULL); + + if (newrdb != NULL) { + free_index(rdb); + rdb = newrdb; + } else { + log_message(LOG_ERR, "error reloading updated index: %s", + ridx_filename); + } + } +# endif + + req = NULL; + if (!do_responder(&req, &cbio, acbio, req_timeout)) + goto redo_accept; + if (req == NULL) { resp = OCSP_response_create(OCSP_RESPONSE_STATUS_MALFORMEDREQUEST, @@ -577,21 +650,6 @@ redo_accept: BIO_free(derbio); } - if (ridx_filename != NULL - && (rkey == NULL || rsigner == NULL || rca_cert == NULL)) { - BIO_printf(bio_err, - "Need a responder certificate, key and CA for this operation!\n"); - goto end; - } - - if (ridx_filename != NULL && rdb == NULL) { - rdb = load_index(ridx_filename, NULL); - if (rdb == NULL) - goto end; - if (!index_index(rdb)) - goto end; - } - if (rdb != NULL) { make_ocsp_response(bio_err, &resp, req, rdb, rca_cert, rsigner, rkey, rsign_md, rsign_sigopts, rother, rflags, nmin, ndays, badsig); @@ -637,10 +695,10 @@ redo_accept: if (i != OCSP_RESPONSE_STATUS_SUCCESSFUL) { BIO_printf(out, "Responder Error: %s (%d)\n", OCSP_response_status_str(i), i); - if (ignore_err) - goto redo_accept; - ret = 0; - goto end; + if (!ignore_err) { + ret = 0; + goto end; + } } if (resp_text) @@ -746,6 +804,180 @@ redo_accept: return ret; } +static void +log_message(int level, const char *fmt, ...) +{ + va_list ap; + + va_start(ap, fmt); +# ifdef OCSP_DAEMON + if (multi) { + vsyslog(level, fmt, ap); + if (level >= LOG_ERR) + ERR_print_errors_cb(print_syslog, &level); + } +# endif + if (!multi) { + BIO_printf(bio_err, "%s: ", prog); + BIO_vprintf(bio_err, fmt, ap); + BIO_printf(bio_err, "\n"); + } + va_end(ap); +} + +# ifdef OCSP_DAEMON + +static int print_syslog(const char *str, size_t len, void *levPtr) +{ + int level = *(int *)levPtr; + int ilen = (len > MAXERRLEN) ? MAXERRLEN : len; + + syslog(level, "%.*s", ilen, str); + + return ilen; +} + +static int index_changed(CA_DB *rdb) +{ + struct stat sb; + + if (rdb != NULL && stat(rdb->dbfname, &sb) != -1) { + if (rdb->dbst.st_mtime != sb.st_mtime + || rdb->dbst.st_ctime != sb.st_ctime + || rdb->dbst.st_ino != sb.st_ino + || rdb->dbst.st_dev != sb.st_dev) { + syslog(LOG_INFO, "index file changed, reloading"); + return 1; + } + } + return 0; +} + +static void killall(int ret, pid_t *kidpids) +{ + int i; + + for (i = 0; i < multi; ++i) + if (kidpids[i] != 0) + (void)kill(kidpids[i], SIGTERM); + sleep(1); + exit(ret); +} + +static int termsig = 0; + +static void noteterm (int sig) +{ + termsig = sig; +} + +/* + * Loop spawning up to `multi` child processes, only child processes return + * from this function. The parent process loops until receiving a termination + * signal, kills extant children and exits without returning. + */ +static void spawn_loop(void) +{ + const char *signame; + pid_t *kidpids = NULL; + int status; + int procs = 0; + int i; + + openlog(prog, LOG_PID, LOG_DAEMON); + + if (setpgid(0, 0)) { + syslog(LOG_ERR, "fatal: error detaching from parent process group: %s", + strerror(errno)); + exit(1); + } + kidpids = app_malloc(multi * sizeof(*kidpids), "child PID array"); + for (i = 0; i < multi; ++i) + kidpids[i] = 0; + + signal(SIGINT, noteterm); + signal(SIGTERM, noteterm); + + while (termsig == 0) { + pid_t fpid; + + /* + * Wait for a child to replace when we're at the limit. + * Slow down if a child exited abnormally or waitpid() < 0 + */ + while (termsig == 0 && procs >= multi) { + if ((fpid = waitpid(-1, &status, 0)) > 0) { + for (i = 0; i < procs; ++i) { + if (kidpids[i] == fpid) { + kidpids[i] = 0; + --procs; + break; + } + } + if (i >= multi) { + syslog(LOG_ERR, "fatal: internal error: " + "no matching child slot for pid: %ld", + (long) fpid); + killall(1, kidpids); + } + if (status != 0) { + if (WIFEXITED(status)) + syslog(LOG_WARNING, "child process: %ld, exit status: %d", + (long)fpid, WEXITSTATUS(status)); + else if (WIFSIGNALED(status)) + syslog(LOG_WARNING, "child process: %ld, term signal %d%s", + (long)fpid, WTERMSIG(status), + WCOREDUMP(status) ? " (core dumped)" : ""); + sleep(1); + } + break; + } else if (errno != EINTR) { + syslog(LOG_ERR, "fatal: waitpid(): %s", strerror(errno)); + killall(1, kidpids); + } + } + if (termsig) + break; + + switch(fpid = fork()) { + case -1: /* error */ + /* System critically low on memory, pause and try again later */ + sleep(30); + break; + case 0: /* child */ + signal(SIGINT, SIG_DFL); + signal(SIGTERM, SIG_DFL); + if (termsig) + _exit(0); + if (RAND_poll() <= 0) { + syslog(LOG_ERR, "fatal: RAND_poll() failed"); + _exit(1); + } + return; + default: /* parent */ + for (i = 0; i < multi; ++i) { + if (kidpids[i] == 0) { + kidpids[i] = fpid; + procs++; + break; + } + } + if (i >= multi) { + syslog(LOG_ERR, "fatal: internal error: no free child slots"); + killall(1, kidpids); + } + break; + } + } + + /* The loop above can only break on termsig */ + signame = strsignal(termsig); + syslog(LOG_INFO, "terminating on signal: %s(%d)", + signame ? signame : "", termsig); + killall(0, kidpids); +} +# endif + static int add_ocsp_cert(OCSP_REQUEST **req, X509 *cert, const EVP_MD *cert_id_md, X509 *issuer, STACK_OF(OCSP_CERTID) *ids) @@ -1035,16 +1267,14 @@ static BIO *init_responder(const char *port) if (acbio == NULL || BIO_set_bind_mode(acbio, BIO_BIND_REUSEADDR) < 0 || BIO_set_accept_port(acbio, port) < 0) { - BIO_printf(bio_err, "Error setting up accept BIO\n"); - ERR_print_errors(bio_err); + log_message(LOG_ERR, "Error setting up accept BIO"); goto err; } BIO_set_accept_bios(acbio, bufbio); bufbio = NULL; if (BIO_do_accept(acbio) <= 0) { - BIO_printf(bio_err, "Error starting accept\n"); - ERR_print_errors(bio_err); + log_message(LOG_ERR, "Error starting accept"); goto err; } @@ -1083,7 +1313,16 @@ static int urldecode(char *p) } # endif -static int do_responder(OCSP_REQUEST **preq, BIO **pcbio, BIO *acbio) +# ifdef OCSP_DAEMON +static void sock_timeout(int signum) +{ + if (acfd != (int)INVALID_SOCKET) + (void)shutdown(acfd, SHUT_RD); +} +# endif + +static int do_responder(OCSP_REQUEST **preq, BIO **pcbio, BIO *acbio, + int timeout) { # ifdef OPENSSL_NO_SOCK return 0; @@ -1093,27 +1332,37 @@ static int do_responder(OCSP_REQUEST **preq, BIO **pcbio, BIO *acbio) char inbuf[2048], reqbuf[2048]; char *p, *q; BIO *cbio = NULL, *getbio = NULL, *b64 = NULL; + const char *client; - if (BIO_do_accept(acbio) <= 0) { - BIO_printf(bio_err, "Error accepting connection\n"); - ERR_print_errors(bio_err); + *preq = NULL; + + /* Connection loss before accept() is routine, ignore silently */ + if (BIO_do_accept(acbio) <= 0) return 0; - } cbio = BIO_pop(acbio); *pcbio = cbio; + client = BIO_get_peer_name(cbio); + +# ifdef OCSP_DAEMON + if (timeout > 0) { + (void) BIO_get_fd(cbio, &acfd); + alarm(timeout); + } +# endif /* Read the request line. */ len = BIO_gets(cbio, reqbuf, sizeof(reqbuf)); if (len <= 0) - return 1; + goto out; + if (strncmp(reqbuf, "GET ", 4) == 0) { /* Expecting GET {sp} /URL {sp} HTTP/1.x */ for (p = reqbuf + 4; *p == ' '; ++p) continue; if (*p != '/') { - BIO_printf(bio_err, "Invalid request -- bad URL\n"); - return 1; + log_message(LOG_INFO, "Invalid request -- bad URL: %s", client); + goto out; } p++; @@ -1122,37 +1371,51 @@ static int do_responder(OCSP_REQUEST **preq, BIO **pcbio, BIO *acbio) if (*q == ' ') break; if (strncmp(q, " HTTP/1.", 8) != 0) { - BIO_printf(bio_err, "Invalid request -- bad HTTP version\n"); - return 1; + log_message(LOG_INFO, + "Invalid request -- bad HTTP version: %s", client); + goto out; } *q = '\0'; + + /* + * Skip "GET / HTTP..." requests often used by load-balancers + */ + if (p[1] == '\0') + goto out; + len = urldecode(p); if (len <= 0) { - BIO_printf(bio_err, "Invalid request -- bad URL encoding\n"); - return 1; + log_message(LOG_INFO, + "Invalid request -- bad URL encoding: %s", client); + goto out; } if ((getbio = BIO_new_mem_buf(p, len)) == NULL || (b64 = BIO_new(BIO_f_base64())) == NULL) { - BIO_printf(bio_err, "Could not allocate memory\n"); - ERR_print_errors(bio_err); - return 1; + log_message(LOG_ERR, "Could not allocate base64 bio: %s", client); + goto out; } BIO_set_flags(b64, BIO_FLAGS_BASE64_NO_NL); getbio = BIO_push(b64, getbio); } else if (strncmp(reqbuf, "POST ", 5) != 0) { - BIO_printf(bio_err, "Invalid request -- bad HTTP verb\n"); - return 1; + log_message(LOG_INFO, "Invalid request -- bad HTTP verb: %s", client); + goto out; } /* Read and skip past the headers. */ for (;;) { len = BIO_gets(cbio, inbuf, sizeof(inbuf)); if (len <= 0) - return 1; + goto out; if ((inbuf[0] == '\r') || (inbuf[0] == '\n')) break; } +# ifdef OCSP_DAEMON + /* Clear alarm before we close the client socket */ + alarm(0); + timeout = 0; +# endif + /* Try to read OCSP request */ if (getbio != NULL) { req = d2i_OCSP_REQUEST_bio(getbio, NULL); @@ -1161,13 +1424,17 @@ static int do_responder(OCSP_REQUEST **preq, BIO **pcbio, BIO *acbio) req = d2i_OCSP_REQUEST_bio(cbio, NULL); } - if (req == NULL) { - BIO_printf(bio_err, "Error parsing OCSP request\n"); - ERR_print_errors(bio_err); - } + if (req == NULL) + log_message(LOG_ERR, "Error parsing OCSP request"); *preq = req; +out: +# ifdef OCSP_DAEMON + if (timeout > 0) + alarm(0); + acfd = (int)INVALID_SOCKET; +# endif return 1; # endif } diff --git a/apps/openssl-vms.cnf b/apps/openssl-vms.cnf index a3ca3930..f4a25112 100644 --- a/apps/openssl-vms.cnf +++ b/apps/openssl-vms.cnf @@ -3,6 +3,10 @@ # This is mostly being used for generation of certificate requests. # +# Note that you can include other files from the main configuration +# file using the .include directive. +#.include filename + # This definition stops the following lines choking if HOME isn't # defined. HOME = . diff --git a/apps/openssl.cnf b/apps/openssl.cnf index 32ee9e9f..7d1a8bb6 100644 --- a/apps/openssl.cnf +++ b/apps/openssl.cnf @@ -3,6 +3,10 @@ # This is mostly being used for generation of certificate requests. # +# Note that you can include other files from the main configuration +# file using the .include directive. +#.include filename + # This definition stops the following lines choking if HOME isn't # defined. HOME = . diff --git a/apps/opt.c b/apps/opt.c index a9d163a4..90256363 100644 --- a/apps/opt.c +++ b/apps/opt.c @@ -613,13 +613,17 @@ int opt_verify(int opt, X509_VERIFY_PARAM *vpm) */ int opt_next(void) { - char *p; + char *p, *estr; const OPTIONS *o; int ival; long lval; unsigned long ulval; ossl_intmax_t imval; ossl_uintmax_t umval; +#if !defined(_WIN32) + char *c; + int oerrno; +#endif /* Look at current arg; at end of the list? */ arg = NULL; @@ -676,13 +680,13 @@ int opt_next(void) /* Just a string. */ break; case '/': - if (app_isdir(arg) >= 0) + if (app_isdir(arg) > 0) break; BIO_printf(bio_err, "%s: Not a directory: %s\n", prog, arg); return -1; case '<': /* Input file. */ - if (strcmp(arg, "-") == 0 || app_access(arg, R_OK) >= 0) + if (strcmp(arg, "-") == 0 || app_access(arg, R_OK) == 0) break; BIO_printf(bio_err, "%s: Cannot open input file %s, %s\n", @@ -690,11 +694,38 @@ int opt_next(void) return -1; case '>': /* Output file. */ - if (strcmp(arg, "-") == 0 || app_access(arg, W_OK) >= 0 || errno == ENOENT) +#if !defined(_WIN32) + c = OPENSSL_strdup(arg); + if (c == NULL) { + BIO_printf(bio_err, + "%s: Memory allocation failure\n", prog); + return -1; + } + oerrno = errno; + errno = 0; + if (strcmp(arg, "-") == 0 + || (app_access(app_dirname(c), W_OK) == 0 + && app_isdir(arg) <= 0 + && (app_access(arg, W_OK) == 0 || errno == ENOENT))) { + OPENSSL_free(c); break; + } + OPENSSL_free(c); + if (errno == 0) + /* only possible if 'arg' is a directory */ + estr = "is a directory"; + else + estr = strerror(errno); + errno = oerrno; +#else + if (strcmp(arg, "-") == 0 || app_access(arg, W_OK) == 0 + || errno == ENOENT) + break; + estr = strerror(errno); +#endif BIO_printf(bio_err, "%s: Cannot open output file %s, %s\n", - prog, arg, strerror(errno)); + prog, arg, estr); return -1; case 'p': case 'n': diff --git a/apps/rehash.c b/apps/rehash.c index d918ac89..6f2b5da4 100644 --- a/apps/rehash.c +++ b/apps/rehash.c @@ -293,24 +293,6 @@ static int ends_with_dirsep(const char *path) return *path == '/'; } -static int massage_filename(char *name) -{ -# ifdef __VMS - char *p = strchr(name, ';'); - char *q = p; - - if (q != NULL) { - for (q++; *q != '\0'; q++) { - if (!isdigit((unsigned char)*q)) - return 1; - } - } - - *p = '\0'; -# endif - return 1; -} - /* * Process a directory; return number of errors found. */ @@ -346,7 +328,6 @@ static int do_dir(const char *dirname, enum Hash h) } while ((filename = OPENSSL_DIR_read(&d, dirname)) != NULL) { if ((copy = strdup(filename)) == NULL - || !massage_filename(copy) || sk_OPENSSL_STRING_push(files, copy) == 0) { BIO_puts(bio_err, "out of memory\n"); exit(1); diff --git a/apps/s_apps.h b/apps/s_apps.h index 614aab80..1ca8ff95 100644 --- a/apps/s_apps.h +++ b/apps/s_apps.h @@ -58,6 +58,11 @@ int generate_cookie_callback(SSL *ssl, unsigned char *cookie, int verify_cookie_callback(SSL *ssl, const unsigned char *cookie, unsigned int cookie_len); +int generate_stateless_cookie_callback(SSL *ssl, unsigned char *cookie, + size_t *cookie_len); +int verify_stateless_cookie_callback(SSL *ssl, const unsigned char *cookie, + size_t cookie_len); + typedef struct ssl_excert_st SSL_EXCERT; void ssl_ctx_set_excert(SSL_CTX *ctx, SSL_EXCERT *exc); diff --git a/apps/s_cb.c b/apps/s_cb.c index 23031092..820491a0 100644 --- a/apps/s_cb.c +++ b/apps/s_cb.c @@ -231,6 +231,9 @@ static const char *get_sigtype(int nid) case NID_ED25519: return "Ed25519"; + case NID_ED448: + return "Ed448"; + default: return NULL; } @@ -533,9 +536,9 @@ static STRINT_PAIR handshakes[] = { {", CertificateVerify", SSL3_MT_CERTIFICATE_VERIFY}, {", ClientKeyExchange", SSL3_MT_CLIENT_KEY_EXCHANGE}, {", Finished", SSL3_MT_FINISHED}, - {", CertificateUrl", 21}, + {", CertificateUrl", SSL3_MT_CERTIFICATE_URL}, {", CertificateStatus", SSL3_MT_CERTIFICATE_STATUS}, - {", SupplementalData", 23}, + {", SupplementalData", SSL3_MT_SUPPLEMENTAL_DATA}, {", KeyUpdate", SSL3_MT_KEY_UPDATE}, #ifndef OPENSSL_NO_NEXTPROTONEG {", NextProto", SSL3_MT_NEXT_PROTO}, @@ -752,6 +755,22 @@ int verify_cookie_callback(SSL *ssl, const unsigned char *cookie, return 0; } + +int generate_stateless_cookie_callback(SSL *ssl, unsigned char *cookie, + size_t *cookie_len) +{ + unsigned int temp; + int res = generate_cookie_callback(ssl, cookie, &temp); + *cookie_len = temp; + return res; +} + +int verify_stateless_cookie_callback(SSL *ssl, const unsigned char *cookie, + size_t cookie_len) +{ + return verify_cookie_callback(ssl, cookie, cookie_len); +} + #endif /* diff --git a/apps/s_client.c b/apps/s_client.c index a319d217..1ed853d1 100644 --- a/apps/s_client.c +++ b/apps/s_client.c @@ -197,19 +197,13 @@ static int psk_use_session_cb(SSL *s, const EVP_MD *md, return 0; } - if (key_len == EVP_MD_size(EVP_sha256())) - cipher = SSL_CIPHER_find(s, tls13_aes128gcmsha256_id); - else if (key_len == EVP_MD_size(EVP_sha384())) - cipher = SSL_CIPHER_find(s, tls13_aes256gcmsha384_id); - + /* We default to SHA-256 */ + cipher = SSL_CIPHER_find(s, tls13_aes128gcmsha256_id); if (cipher == NULL) { - /* Doesn't look like a suitable TLSv1.3 key. Ignore it */ - OPENSSL_free(key); - *id = NULL; - *idlen = 0; - *sess = NULL; - return 1; + BIO_printf(bio_err, "Error finding suitable ciphersuite\n"); + return 0; } + usesess = SSL_SESSION_new(); if (usesess == NULL || !SSL_SESSION_set1_master_key(usesess, key, key_len) diff --git a/apps/s_server.c b/apps/s_server.c index c772069a..d21631e8 100644 --- a/apps/s_server.c +++ b/apps/s_server.c @@ -208,14 +208,10 @@ static int psk_find_session_cb(SSL *ssl, const unsigned char *identity, return 0; } - if (key_len == EVP_MD_size(EVP_sha256())) - cipher = SSL_CIPHER_find(ssl, tls13_aes128gcmsha256_id); - else if (key_len == EVP_MD_size(EVP_sha384())) - cipher = SSL_CIPHER_find(ssl, tls13_aes256gcmsha384_id); - + /* We default to SHA256 */ + cipher = SSL_CIPHER_find(ssl, tls13_aes128gcmsha256_id); if (cipher == NULL) { - /* Doesn't look like a suitable TLSv1.3 key. Ignore it */ - OPENSSL_free(key); + BIO_printf(bio_err, "Error finding suitable ciphersuite\n"); return 0; } @@ -1570,6 +1566,8 @@ int s_server_main(int argc, char *argv[]) break; case OPT_EARLY_DATA: early_data = 1; + if (max_early_data == -1) + max_early_data = SSL3_RT_MAX_PLAIN_LENGTH; break; } } @@ -2040,6 +2038,10 @@ int s_server_main(int argc, char *argv[]) SSL_CTX_set_cookie_generate_cb(ctx, generate_cookie_callback); SSL_CTX_set_cookie_verify_cb(ctx, verify_cookie_callback); + /* Set TLS1.3 cookie generation and verification callbacks */ + SSL_CTX_set_stateless_cookie_generate_cb(ctx, generate_stateless_cookie_callback); + SSL_CTX_set_stateless_cookie_verify_cb(ctx, verify_stateless_cookie_callback); + if (ctx2 != NULL) { SSL_CTX_set_verify(ctx2, s_server_verify, verify_callback); if (!SSL_CTX_set_session_id_context(ctx2, diff --git a/apps/sess_id.c b/apps/sess_id.c index 70966de3..8fd584f3 100644 --- a/apps/sess_id.c +++ b/apps/sess_id.c @@ -30,7 +30,7 @@ const OPTIONS sess_id_options[] = { {"outform", OPT_OUTFORM, 'f', "Output format - default PEM (PEM, DER or NSS)"}, {"in", OPT_IN, 's', "Input file - default stdin"}, - {"out", OPT_OUT, 's', "Output file - default stdout"}, + {"out", OPT_OUT, '>', "Output file - default stdout"}, {"text", OPT_TEXT, '-', "Print ssl session id details"}, {"cert", OPT_CERT, '-', "Output certificate "}, {"noout", OPT_NOOUT, '-', "Don't output the encoded session info"}, diff --git a/apps/speed.c b/apps/speed.c index c59f266f..66271fdd 100644 --- a/apps/speed.c +++ b/apps/speed.c @@ -118,7 +118,7 @@ #define RSA_NUM 7 #define DSA_NUM 3 -#define EC_NUM 17 +#define EC_NUM 18 #define MAX_ECDH_SIZE 256 #define MISALIGN 64 @@ -533,6 +533,7 @@ static OPT_PAIR rsa_choices[] = { #define R_EC_B409 14 #define R_EC_B571 15 #define R_EC_X25519 16 +#define R_EC_X448 17 #ifndef OPENSSL_NO_EC static OPT_PAIR ecdsa_choices[] = { {"ecdsap160", R_EC_P160}, @@ -572,6 +573,7 @@ static OPT_PAIR ecdh_choices[] = { {"ecdhb409", R_EC_B409}, {"ecdhb571", R_EC_B571}, {"ecdhx25519", R_EC_X25519}, + {"ecdhx448", R_EC_X448}, {NULL} }; #endif @@ -1377,7 +1379,7 @@ int speed_main(int argc, char **argv) NID_sect233r1, NID_sect283r1, NID_sect409r1, NID_sect571r1, /* Other */ - NID_X25519 + NID_X25519, NID_X448 }; static const char *test_curves_names[EC_NUM] = { /* Prime Curves */ @@ -1389,7 +1391,7 @@ int speed_main(int argc, char **argv) "nistb233", "nistb283", "nistb409", "nistb571", /* Other */ - "X25519" + "X25519", "X448" }; static const int test_curves_bits[EC_NUM] = { 160, 192, 224, @@ -1397,7 +1399,7 @@ int speed_main(int argc, char **argv) 163, 233, 283, 409, 571, 163, 233, 283, 409, - 571, 253 /* X25519 */ + 571, 253, 448 }; int ecdsa_doit[EC_NUM] = { 0 }; diff --git a/apps/srp.c b/apps/srp.c index 5e7f3b9f..689574a4 100644 --- a/apps/srp.c +++ b/apps/srp.c @@ -1,10 +1,14 @@ /* * Copyright 2004-2018 The OpenSSL Project Authors. All Rights Reserved. + * Copyright (c) 2004, EdelKey Project. All Rights Reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy * in the file LICENSE in the source distribution or at * https://www.openssl.org/source/license.html + * + * Originally written by Christophe Renou and Peter Sylvester, + * for the EdelKey project. */ #include diff --git a/apps/storeutl.c b/apps/storeutl.c index d40d263e..0f310d2e 100644 --- a/apps/storeutl.c +++ b/apps/storeutl.c @@ -14,6 +14,7 @@ #include #include #include +#include /* s2i_ASN1_INTEGER */ static int process(const char *uri, const UI_METHOD *uimeth, PW_CB_DATA *uidata, int expected, int criterion, OSSL_STORE_SEARCH *search, diff --git a/apps/tsget.in b/apps/tsget.in index 71bcc245..c3420db6 100644 --- a/apps/tsget.in +++ b/apps/tsget.in @@ -1,4 +1,4 @@ -#!{- $config{hashbangperl} -} +#!{- $config{HASHBANGPERL} -} # Copyright 2002-2016 The OpenSSL Project Authors. All Rights Reserved. # Copyright (c) 2002 The OpenTSA Project. All rights reserved. # diff --git a/apps/version.c b/apps/version.c index 0ff0299d..2aca1636 100644 --- a/apps/version.c +++ b/apps/version.c @@ -105,7 +105,8 @@ opthelp: dirty = version = 1; break; case OPT_A: - seed = cflags = version = date = platform = dir = engdir = 1; + seed = options = cflags = version = date = platform = dir = engdir + = 1; break; } } diff --git a/config b/config old mode 100755 new mode 100644 index 00f90876..92dfa4af --- a/config +++ b/config @@ -40,6 +40,15 @@ EOF esac done +# Environment that's being passed to Configure +__CNF_CPPDEFINES= +__CNF_CPPINCLUDES= +__CNF_CPPFLAGS= +__CNF_CFLAGS= +__CNF_CXXFLAGS= +__CNF_LDFLAGS= +__CNF_LDLIBS= + # First get uname entries that we use below [ "$MACHINE" ] || MACHINE=`(uname -m) 2>/dev/null` || MACHINE="unknown" @@ -504,10 +513,12 @@ case "$GUESSOS" in OUT="darwin64-x86_64-cc" fi ;; armv6+7-*-iphoneos) - options="$options -arch%20armv6 -arch%20armv7" + __CNF_CFLAGS="$__CNF_CFLAGS -arch%20armv6 -arch%20armv7" + __CNF_CXXFLAGS="$__CNF_CXXFLAGS -arch%20armv6 -arch%20armv7" OUT="iphoneos-cross" ;; *-*-iphoneos) - options="$options -arch%20${MACHINE}" + __CNF_CFLAGS="$__CNF_CFLAGS -arch%20${MACHINE}" + __CNF_CXXFLAGS="$__CNF_CXXFLAGS -arch%20${MACHINE}" OUT="iphoneos-cross" ;; arm64-*-iphoneos|*-*-ios64) OUT="ios64-cross" ;; @@ -519,9 +530,12 @@ case "$GUESSOS" in esac if [ "$CC" = "gcc" ]; then case ${ISA:-generic} in - EV5|EV45) options="$options -mcpu=ev5";; - EV56|PCA56) options="$options -mcpu=ev56";; - *) options="$options -mcpu=ev6";; + EV5|EV45) __CNF_CFLAGS="$__CNF_CFLAGS -mcpu=ev5" + __CNF_CXXFLAGS="$__CNF_CFLAGS -mcpu=ev5";; + EV56|PCA56) __CNF_CFLAGS="$__CNF_CFLAGS -mcpu=ev56" + __CNF_CXXFLAGS="$__CNF_CXXFLAGS -mcpu=ev56";; + *) __CNF_CFLAGS="$__CNF_CFLAGS -mcpu=ev6" + __CNF_CXXFLAGS="$__CNF_CXXFLAGS -mcpu=ev6";; esac fi ;; @@ -538,7 +552,12 @@ case "$GUESSOS" in OUT="linux-ppc64" else OUT="linux-ppc" - (echo "__LP64__" | gcc -E -x c - 2>/dev/null | grep "^__LP64__" 2>&1 > /dev/null) || options="$options -m32" + if (echo "__LP64__" | gcc -E -x c - 2>/dev/null | grep "^__LP64__" 2>&1 > /dev/null); then + :; + else + __CNF_CFLAGS="$__CNF_CFLAGS -m32" + __CNF_CXXFLAGS="$__CNF_CXXFLAGS -m32" + fi fi ;; ppc64le-*-linux2) OUT="linux-ppc64le" ;; @@ -574,7 +593,8 @@ case "$GUESSOS" in sun4u*) OUT="linux-sparcv9" ;; sun4m) OUT="linux-sparcv8" ;; sun4d) OUT="linux-sparcv8" ;; - *) OUT="linux-generic32"; options="$options -DB_ENDIAN" ;; + *) OUT="linux-generic32"; + __CNF_CPPFLAGS="$__CNF_CPPFLAGS -DB_ENDIAN" ;; esac ;; parisc*-*-linux2) # 64-bit builds under parisc64 linux are not supported and @@ -596,16 +616,25 @@ case "$GUESSOS" in CPUSCHEDULE=`echo $CPUSCHEDULE|sed -e 's/7300LC/7100LC/' -e 's/8.00/8000/'` # Finish Model transformations - options="$options -DB_ENDIAN -mschedule=$CPUSCHEDULE -march=$CPUARCH" + __CNF_CPPFLAGS="$__CNF_CPPFLAGS -DB_ENDIAN" + __CNF_CFLAGS="$__CNF_CFLAGS -mschedule=$CPUSCHEDULE -march=$CPUARCH" + __CNF_CXXFLAGS="$__CNF_CXXFLAGS -mschedule=$CPUSCHEDULE -march=$CPUARCH" OUT="linux-generic32" ;; armv[1-3]*-*-linux2) OUT="linux-generic32" ;; - armv[7-9]*-*-linux2) OUT="linux-armv4"; options="$options -march=armv7-a" ;; + armv[7-9]*-*-linux2) OUT="linux-armv4" + __CNF_CFLAGS="$__CNF_CFLAGS -march=armv7-a" + __CNF_CXXFLAGS="$__CNF_CXXFLAGS -march=armv7-a" + ;; arm*-*-linux2) OUT="linux-armv4" ;; aarch64-*-linux2) OUT="linux-aarch64" ;; - sh*b-*-linux2) OUT="linux-generic32"; options="$options -DB_ENDIAN" ;; - sh*-*-linux2) OUT="linux-generic32"; options="$options -DL_ENDIAN" ;; - m68k*-*-linux2) OUT="linux-generic32"; options="$options -DB_ENDIAN" ;; - s390-*-linux2) OUT="linux-generic32"; options="$options -DB_ENDIAN" ;; + sh*b-*-linux2) OUT="linux-generic32"; + __CNF_CPPFLAGS="$__CNF_CPPFLAGS -DB_ENDIAN" ;; + sh*-*-linux2) OUT="linux-generic32"; + __CNF_CPPFLAGS="$__CNF_CPPFLAGS -DL_ENDIAN" ;; + m68k*-*-linux2) OUT="linux-generic32"; + __CNF_CPPFLAGS="$__CNF_CPPFLAGS -DB_ENDIAN" ;; + s390-*-linux2) OUT="linux-generic32"; + __CNF_CPPFLAGS="$__CNF_CPPFLAGS -DB_ENDIAN" ;; s390x-*-linux2) # To be uncommented when glibc bug is fixed, see Configure... #if egrep -e '^features.* highgprs' /proc/cpuinfo >/dev/null ; then @@ -687,9 +716,12 @@ case "$GUESSOS" in ;; *-*-sunos4) OUT="sunos-$CC" ;; - *86*-*-bsdi4) OUT="BSD-x86-elf"; options="$options no-sse2 -ldl" ;; - alpha*-*-*bsd*) OUT="BSD-generic64"; options="$options -DL_ENDIAN" ;; - powerpc64-*-*bsd*) OUT="BSD-generic64"; options="$options -DB_ENDIAN" ;; + *86*-*-bsdi4) OUT="BSD-x86-elf"; options="$options no-sse2"; + __CNF_LDFLAGS="$__CNF_LDFLAGS -ldl" ;; + alpha*-*-*bsd*) OUT="BSD-generic64"; + __CNF_CPPFLAGS="$__CNF_CPPFLAGS -DL_ENDIAN" ;; + powerpc64-*-*bsd*) OUT="BSD-generic64"; + __CNF_CPPFLAGS="$__CNF_CPPFLAGS -DB_ENDIAN" ;; sparc64-*-*bsd*) OUT="BSD-sparc64" ;; ia64-*-*bsd*) OUT="BSD-ia64" ;; x86_64-*-dragonfly*) OUT="BSD-x86_64" ;; @@ -716,7 +748,8 @@ case "$GUESSOS" in if [ "$CC" = "gcc" ]; then OUT="unixware-7-gcc" ; options="$options no-sse2" else - OUT="unixware-7" ; options="$options no-sse2 -D__i386__" + OUT="unixware-7" ; options="$options no-sse2" + __CNF_CPPFLAGS="$__CNF_CPPFLAGS -D__i386__" fi ;; *-*-[Uu]nix[Ww]are20*) OUT="unixware-2.0"; options="$options no-sse2 no-sha512" ;; @@ -763,7 +796,7 @@ case "$GUESSOS" in else # Motorola(?) CPU OUT="hpux-$CC" fi - options="$options -D_REENTRANT" ;; + __CNF_CPPFLAGS="$__CNF_CPPFLAGS -D_REENTRANT" ;; *-hpux) OUT="hpux-parisc-$CC" ;; *-aix) [ "$KERNEL_BITS" ] || KERNEL_BITS=`(getconf KERNEL_BITMODE) 2>/dev/null` @@ -802,7 +835,9 @@ case "$GUESSOS" in *-*-qnx6) OUT="QNX6" ;; x86-*-android|i?86-*-android) OUT="android-x86" ;; armv[7-9]*-*-android) - OUT="android-armeabi"; options="$options -march=armv7-a" ;; + OUT="android-armeabi" + __CNF_CFLAGS="$__CNF_CFLAGS -march=armv7-a" + __CNF_CXXFLAGS="$__CNF_CXXFLAGS -march=armv7-a";; arm*-*-android) OUT="android-armeabi" ;; *) OUT=`echo $GUESSOS | awk -F- '{print $3}'`;; esac @@ -816,7 +851,7 @@ esac # See whether we can compile Atalla support #if [ -f /usr/include/atasi.h ] #then -# options="$options -DATALLA" +# __CNF_CPPFLAGS="$__CNF_CPPFLAGS -DATALLA" #fi if [ -n "$CONFIG_OPTIONS" ]; then @@ -824,9 +859,11 @@ if [ -n "$CONFIG_OPTIONS" ]; then fi if expr "$options" : '.*no\-asm' > /dev/null; then :; else - sh -c "$CROSS_COMPILE${CC:-gcc} -Wa,--help -c -o /tmp/null.$$.o -x assembler /dev/null && rm /tmp/null.$$.o" 2>&1 | \ - grep \\--noexecstack >/dev/null && \ - options="$options -Wa,--noexecstack" + if sh -c "$CROSS_COMPILE${CC:-gcc} -Wa,--help -c -o /tmp/null.$$.o -x assembler /dev/null && rm /tmp/null.$$.o" 2>&1 | \ + grep \\--noexecstack >/dev/null; then + __CNF_CFLAGS="$__CNF_CFLAGS -Wa,--noexecstack" + __CNF_CXXFLAGS="$__CNF_CXXFLAGS -Wa,--noexecstack" + fi fi # gcc < 2.8 does not support -march=ultrasparc @@ -900,12 +937,28 @@ OUT="$OUT" $PERL $THERE/Configure LIST | grep "$OUT" > /dev/null if [ $? = "0" ]; then if [ "$VERBOSE" = "true" ]; then - echo $PERL $THERE/Configure $OUT $options + echo /usr/bin/env \ + __CNF_CPPDEFINES="'$__CNF_CPPDEFINES'" \ + __CNF_CPPINCLUDES="'$__CNF_CPPINCLUDES'" \ + __CNF_CPPFLAGS="'$__CNF_CPPFLAGS'" \ + __CNF_CFLAGS="'$__CNF_CFLAGS'" \ + __CNF_CXXFLAGS="'$__CNF_CXXFLAGS'" \ + __CNF_LDFLAGS="'$__CNF_LDFLAGS'" \ + __CNF_LDLIBS="'$__CNF_LDLIBS'" \ + $PERL $THERE/Configure $OUT $options fi if [ "$DRYRUN" = "false" ]; then # eval to make sure quoted options, possibly with spaces inside, # are treated right - eval $PERL $THERE/Configure $OUT $options + eval /usr/bin/env \ + __CNF_CPPDEFINES="'$__CNF_CPPDEFINES'" \ + __CNF_CPPINCLUDES="'$__CNF_CPPINCLUDES'" \ + __CNF_CPPFLAGS="'$__CNF_CPPFLAGS'" \ + __CNF_CFLAGS="'$__CNF_CFLAGS'" \ + __CNF_CXXFLAGS="'$__CNF_CXXFLAGS'" \ + __CNF_LDFLAGS="'$__CNF_LDFLAGS'" \ + __CNF_LDLIBS="'$__CNF_LDLIBS'" \ + $PERL $THERE/Configure $OUT $options fi else echo "This system ($OUT) is not supported. See file INSTALL for details." diff --git a/crypto/LPdir_unix.c b/crypto/LPdir_unix.c index 6648a60c..356089d7 100644 --- a/crypto/LPdir_unix.c +++ b/crypto/LPdir_unix.c @@ -1,5 +1,5 @@ /* - * Copyright 2004-2016 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2004-2018 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -11,7 +11,7 @@ * This file is dual-licensed and is also available under the following * terms: * - * Copyright (c) 2004, Richard Levitte + * Copyright (c) 2004, 2018, Richard Levitte * All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -46,6 +46,9 @@ #ifndef LPDIR_H # include "LPdir.h" #endif +#ifdef __VMS +# include +#endif /* * The POSIXly macro for the maximum number of characters in a file path is @@ -73,6 +76,10 @@ struct LP_dir_context_st { DIR *dir; char entry_name[LP_ENTRY_SIZE + 1]; +#ifdef __VMS + int expect_file_generations; + char previous_entry_name[LP_ENTRY_SIZE + 1]; +#endif }; const char *LP_find_file(LP_DIR_CTX **ctx, const char *directory) @@ -93,6 +100,15 @@ const char *LP_find_file(LP_DIR_CTX **ctx, const char *directory) } memset(*ctx, 0, sizeof(**ctx)); +#ifdef __VMS + { + char c = directory[strlen(directory) - 1]; + + if (c == ']' || c == '>' || c == ':') + (*ctx)->expect_file_generations = 1; + } +#endif + (*ctx)->dir = opendir(directory); if ((*ctx)->dir == NULL) { int save_errno = errno; /* Probably not needed, but I'm paranoid */ @@ -103,6 +119,13 @@ const char *LP_find_file(LP_DIR_CTX **ctx, const char *directory) } } +#ifdef __VMS + strncpy((*ctx)->previous_entry_name, (*ctx)->entry_name, + sizeof((*ctx)->previous_entry_name)); + + again: +#endif + direntry = readdir((*ctx)->dir); if (direntry == NULL) { return 0; @@ -111,6 +134,18 @@ const char *LP_find_file(LP_DIR_CTX **ctx, const char *directory) strncpy((*ctx)->entry_name, direntry->d_name, sizeof((*ctx)->entry_name) - 1); (*ctx)->entry_name[sizeof((*ctx)->entry_name) - 1] = '\0'; +#ifdef __VMS + if ((*ctx)->expect_file_generations) { + char *p = (*ctx)->entry_name + strlen((*ctx)->entry_name); + + while(p > (*ctx)->entry_name && isdigit(p[-1])) + p--; + if (p > (*ctx)->entry_name && p[-1] == ';') + p[-1] = '\0'; + if (strcasecmp((*ctx)->entry_name, (*ctx)->previous_entry_name) == 0) + goto again; + } +#endif return (*ctx)->entry_name; } diff --git a/crypto/aes/asm/aes-586.pl b/crypto/aes/asm/aes-586.pl old mode 100755 new mode 100644 diff --git a/crypto/aes/asm/aes-armv4.pl b/crypto/aes/asm/aes-armv4.pl index c6474b8a..2fa07551 100644 --- a/crypto/aes/asm/aes-armv4.pl +++ b/crypto/aes/asm/aes-armv4.pl @@ -203,7 +203,7 @@ AES_encrypt: adr r3,. #endif stmdb sp!,{r1,r4-r12,lr} -#ifdef __APPLE__ +#if defined(__thumb2__) || defined(__APPLE__) adr $tbl,AES_Te #else sub $tbl,r3,#AES_encrypt-AES_Te @ Te @@ -481,7 +481,7 @@ _armv4_AES_set_encrypt_key: mov lr,r1 @ bits mov $key,r2 @ key -#ifdef __APPLE__ +#if defined(__thumb2__) || defined(__APPLE__) adr $tbl,AES_Te+1024 @ Te4 #else sub $tbl,r3,#_armv4_AES_set_encrypt_key-AES_Te-1024 @ Te4 @@ -979,7 +979,7 @@ AES_decrypt: adr r3,. #endif stmdb sp!,{r1,r4-r12,lr} -#ifdef __APPLE__ +#if defined(__thumb2__) || defined(__APPLE__) adr $tbl,AES_Td #else sub $tbl,r3,#AES_decrypt-AES_Td @ Td diff --git a/crypto/aes/asm/aes-sparcv9.pl b/crypto/aes/asm/aes-sparcv9.pl old mode 100755 new mode 100644 diff --git a/crypto/aes/asm/aes-x86_64.pl b/crypto/aes/asm/aes-x86_64.pl old mode 100755 new mode 100644 diff --git a/crypto/aes/asm/aesp8-ppc.pl b/crypto/aes/asm/aesp8-ppc.pl old mode 100755 new mode 100644 diff --git a/crypto/aes/asm/aesv8-armx.pl b/crypto/aes/asm/aesv8-armx.pl old mode 100755 new mode 100644 diff --git a/crypto/aes/asm/bsaes-armv7.pl b/crypto/aes/asm/bsaes-armv7.pl index 0c5e762a..8a5f3f1b 100644 --- a/crypto/aes/asm/bsaes-armv7.pl +++ b/crypto/aes/asm/bsaes-armv7.pl @@ -742,7 +742,7 @@ $code.=<<___; _bsaes_decrypt8: adr $const,. vldmia $key!, {@XMM[9]} @ round 0 key -#ifdef __APPLE__ +#if defined(__thumb2__) || defined(__APPLE__) adr $const,.LM0ISR #else add $const,$const,#.LM0ISR-_bsaes_decrypt8 @@ -841,7 +841,7 @@ _bsaes_const: _bsaes_encrypt8: adr $const,. vldmia $key!, {@XMM[9]} @ round 0 key -#ifdef __APPLE__ +#if defined(__thumb2__) || defined(__APPLE__) adr $const,.LM0SR #else sub $const,$const,#_bsaes_encrypt8-.LM0SR @@ -949,7 +949,7 @@ $code.=<<___; _bsaes_key_convert: adr $const,. vld1.8 {@XMM[7]}, [$inp]! @ load round 0 key -#ifdef __APPLE__ +#if defined(__thumb2__) || defined(__APPLE__) adr $const,.LM0 #else sub $const,$const,#_bsaes_key_convert-.LM0 diff --git a/crypto/aes/asm/vpaes-armv8.pl b/crypto/aes/asm/vpaes-armv8.pl old mode 100755 new mode 100644 diff --git a/crypto/arm64cpuid.pl b/crypto/arm64cpuid.pl old mode 100755 new mode 100644 diff --git a/crypto/armcap.c b/crypto/armcap.c index d6707330..1b3c2722 100644 --- a/crypto/armcap.c +++ b/crypto/armcap.c @@ -191,7 +191,7 @@ void OPENSSL_cpuid_setup(void) _armv8_sha256_probe(); OPENSSL_armcap_P |= ARMV8_SHA256; } -# ifdef __aarch64__ +# if defined(__aarch64__) && !defined(__APPLE__) if (sigsetjmp(ill_jmp, 1) == 0) { _armv8_sha512_probe(); OPENSSL_armcap_P |= ARMV8_SHA512; diff --git a/crypto/asn1/standard_methods.h b/crypto/asn1/standard_methods.h index d366aa09..7d1f97e3 100644 --- a/crypto/asn1/standard_methods.h +++ b/crypto/asn1/standard_methods.h @@ -42,6 +42,7 @@ static const EVP_PKEY_ASN1_METHOD *standard_methods[] = { #endif #ifndef OPENSSL_NO_EC &ecx25519_asn1_meth, + &ecx448_asn1_meth, #endif #ifndef OPENSSL_NO_POLY1305 &poly1305_asn1_meth, @@ -51,6 +52,7 @@ static const EVP_PKEY_ASN1_METHOD *standard_methods[] = { #endif #ifndef OPENSSL_NO_EC &ed25519_asn1_meth, + &ed448_asn1_meth, #endif }; diff --git a/crypto/bn/asm/armv8-mont.pl b/crypto/bn/asm/armv8-mont.pl old mode 100755 new mode 100644 diff --git a/crypto/bn/asm/rsaz-avx2.pl b/crypto/bn/asm/rsaz-avx2.pl old mode 100755 new mode 100644 diff --git a/crypto/bn/asm/rsaz-x86_64.pl b/crypto/bn/asm/rsaz-x86_64.pl old mode 100755 new mode 100644 diff --git a/crypto/bn/asm/sparct4-mont.pl b/crypto/bn/asm/sparct4-mont.pl old mode 100755 new mode 100644 diff --git a/crypto/bn/asm/sparcv9a-mont.pl b/crypto/bn/asm/sparcv9a-mont.pl old mode 100755 new mode 100644 diff --git a/crypto/bn/asm/x86-mont.pl b/crypto/bn/asm/x86-mont.pl old mode 100755 new mode 100644 diff --git a/crypto/bn/asm/x86_64-mont.pl b/crypto/bn/asm/x86_64-mont.pl old mode 100755 new mode 100644 diff --git a/crypto/bn/asm/x86_64-mont5.pl b/crypto/bn/asm/x86_64-mont5.pl old mode 100755 new mode 100644 diff --git a/crypto/bn/bn_rand.c b/crypto/bn/bn_rand.c index 0be21600..743779f9 100644 --- a/crypto/bn/bn_rand.c +++ b/crypto/bn/bn_rand.c @@ -112,7 +112,7 @@ int BN_priv_rand(BIGNUM *rnd, int bits, int top, int bottom) /* random number r: 0 <= r < range */ static int bnrand_range(BNRAND_FLAG flag, BIGNUM *r, const BIGNUM *range) { - int b, n; + int n; int count = 100; if (range->neg || BN_is_zero(range)) { @@ -132,11 +132,9 @@ static int bnrand_range(BNRAND_FLAG flag, BIGNUM *r, const BIGNUM *range) * than range */ do { - b = flag == NORMAL - ? BN_rand(r, n + 1, BN_RAND_TOP_ANY, BN_RAND_BOTTOM_ANY) - : BN_priv_rand(r, n + 1, BN_RAND_TOP_ANY, BN_RAND_BOTTOM_ANY); - if (!b) + if (!bnrand(flag, r, n + 1, BN_RAND_TOP_ANY, BN_RAND_BOTTOM_ANY)) return 0; + /* * If r < 3*range, use r := r MOD range (which is either r, r - * range, or r - 2*range). Otherwise, iterate once more. Since @@ -161,7 +159,7 @@ static int bnrand_range(BNRAND_FLAG flag, BIGNUM *r, const BIGNUM *range) } else { do { /* range = 11..._2 or range = 101..._2 */ - if (!BN_rand(r, n, BN_RAND_TOP_ANY, BN_RAND_BOTTOM_ANY)) + if (!bnrand(flag, r, n, BN_RAND_TOP_ANY, BN_RAND_BOTTOM_ANY)) return 0; if (!--count) { diff --git a/crypto/build.info b/crypto/build.info index 0a8f6e22..368671a5 100644 --- a/crypto/build.info +++ b/crypto/build.info @@ -11,7 +11,7 @@ EXTRA= ../ms/uplink-x86.pl ../ms/uplink.c ../ms/applink.c \ ppccpuid.pl pariscid.pl alphacpuid.pl arm64cpuid.pl armv4cpuid.pl DEPEND[cversion.o]=buildinf.h -GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(CC) $(CFLAGS) $(CPPFLAGS_Q)" "$(PLATFORM)" +GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(CC) $(LIB_CFLAGS) $(CPPFLAGS_Q)" "$(PLATFORM)" DEPEND[buildinf.h]=../configdata.pm GENERATE[uplink-x86.s]=../ms/uplink-x86.pl $(PERLASM_SCHEME) diff --git a/crypto/chacha/asm/chacha-armv4.pl b/crypto/chacha/asm/chacha-armv4.pl old mode 100755 new mode 100644 diff --git a/crypto/chacha/asm/chacha-armv8.pl b/crypto/chacha/asm/chacha-armv8.pl old mode 100755 new mode 100644 diff --git a/crypto/chacha/asm/chacha-c64xplus.pl b/crypto/chacha/asm/chacha-c64xplus.pl old mode 100755 new mode 100644 diff --git a/crypto/chacha/asm/chacha-ppc.pl b/crypto/chacha/asm/chacha-ppc.pl old mode 100755 new mode 100644 diff --git a/crypto/chacha/asm/chacha-s390x.pl b/crypto/chacha/asm/chacha-s390x.pl old mode 100755 new mode 100644 diff --git a/crypto/chacha/asm/chacha-x86.pl b/crypto/chacha/asm/chacha-x86.pl old mode 100755 new mode 100644 diff --git a/crypto/chacha/asm/chacha-x86_64.pl b/crypto/chacha/asm/chacha-x86_64.pl old mode 100755 new mode 100644 diff --git a/crypto/conf/conf_def.c b/crypto/conf/conf_def.c index 82e191ae..752859d9 100644 --- a/crypto/conf/conf_def.c +++ b/crypto/conf/conf_def.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2017 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -12,12 +12,20 @@ #include #include #include "internal/cryptlib.h" +#include "internal/o_dir.h" #include #include #include #include "conf_def.h" #include #include +#ifndef OPENSSL_NO_POSIX_IO +# include +# ifdef _WIN32 +# define stat _stat +# define strcasecmp _stricmp +# endif +#endif /* * The maximum length we can grow a value to after variable expansion. 64k @@ -26,12 +34,18 @@ #define MAX_CONF_VALUE_LENGTH 65536 static char *eat_ws(CONF *conf, char *p); +static void trim_ws(CONF *conf, char *start); static char *eat_alpha_numeric(CONF *conf, char *p); static void clear_comments(CONF *conf, char *p); static int str_copy(CONF *conf, char *section, char **to, char *from); static char *scan_quote(CONF *conf, char *p); static char *scan_dquote(CONF *conf, char *p); #define scan_esc(conf,p) (((IS_EOF((conf),(p)[1]))?((p)+1):((p)+2))) +#ifndef OPENSSL_NO_POSIX_IO +static BIO *process_include(char *include, OPENSSL_DIR_CTX **dirctx, + char **dirpath); +static BIO *get_next_file(const char *path, OPENSSL_DIR_CTX **dirctx); +#endif static CONF *def_create(CONF_METHOD *meth); static int def_init_default(CONF *conf); @@ -173,6 +187,11 @@ static int def_load_bio(CONF *conf, BIO *in, long *line) char *section = NULL, *buf; char *start, *psection, *pname; void *h = (void *)(conf->data); + STACK_OF(BIO) *biosk = NULL; +#ifndef OPENSSL_NO_POSIX_IO + char *dirpath = NULL; + OPENSSL_DIR_CTX *dirctx = NULL; +#endif if ((buff = BUF_MEM_new()) == NULL) { CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_BUF_LIB); @@ -205,11 +224,39 @@ static int def_load_bio(CONF *conf, BIO *in, long *line) } p = &(buff->data[bufnum]); *p = '\0'; + read_retry: BIO_gets(in, p, CONFBUFSIZE - 1); p[CONFBUFSIZE - 1] = '\0'; ii = i = strlen(p); - if (i == 0 && !again) - break; + if (i == 0 && !again) { + /* the currently processed BIO is at EOF */ + BIO *parent; + +#ifndef OPENSSL_NO_POSIX_IO + /* continue processing with the next file from directory */ + if (dirctx != NULL) { + BIO *next; + + if ((next = get_next_file(dirpath, &dirctx)) != NULL) { + BIO_vfree(in); + in = next; + goto read_retry; + } else { + OPENSSL_free(dirpath); + dirpath = NULL; + } + } +#endif + /* no more files in directory, continue with processing parent */ + if ((parent = sk_BIO_pop(biosk)) == NULL) { + /* everything processed get out of the loop */ + break; + } else { + BIO_vfree(in); + in = parent; + goto read_retry; + } + } again = 0; while (i > 0) { if ((p[i - 1] != '\r') && (p[i - 1] != '\n')) @@ -285,7 +332,6 @@ static int def_load_bio(CONF *conf, BIO *in, long *line) continue; } else { pname = s; - psection = NULL; end = eat_alpha_numeric(conf, s); if ((end[0] == ':') && (end[1] == ':')) { *end = '\0'; @@ -293,29 +339,57 @@ static int def_load_bio(CONF *conf, BIO *in, long *line) psection = pname; pname = end; end = eat_alpha_numeric(conf, end); + } else { + psection = section; } p = eat_ws(conf, end); - if (*p != '=') { + if (strncmp(pname, ".include", 8) == 0 && p != pname + 8) { + char *include = NULL; + BIO *next; + + trim_ws(conf, p); + if (!str_copy(conf, psection, &include, p)) + goto err; + /* get the BIO of the included file */ +#ifndef OPENSSL_NO_POSIX_IO + next = process_include(include, &dirctx, &dirpath); + if (include != dirpath) { + /* dirpath will contain include in case of a directory */ + OPENSSL_free(include); + } +#else + next = BIO_new_file(include, "r"); + OPENSSL_free(include); +#endif + if (next != NULL) { + /* push the currently processing BIO onto stack */ + if (biosk == NULL) { + if ((biosk = sk_BIO_new_null()) == NULL) { + CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_MALLOC_FAILURE); + goto err; + } + } + if (!sk_BIO_push(biosk, in)) { + CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_MALLOC_FAILURE); + goto err; + } + /* continue with reading from the included BIO */ + in = next; + } + continue; + } else if (*p != '=') { CONFerr(CONF_F_DEF_LOAD_BIO, CONF_R_MISSING_EQUAL_SIGN); goto err; } *end = '\0'; p++; start = eat_ws(conf, p); - while (!IS_EOF(conf, *p)) - p++; - p--; - while ((p != start) && (IS_WS(conf, *p))) - p--; - p++; - *p = '\0'; + trim_ws(conf, start); if ((v = OPENSSL_malloc(sizeof(*v))) == NULL) { CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_MALLOC_FAILURE); goto err; } - if (psection == NULL) - psection = section; v->name = OPENSSL_strdup(pname); v->value = NULL; if (v->name == NULL) { @@ -345,10 +419,17 @@ static int def_load_bio(CONF *conf, BIO *in, long *line) } BUF_MEM_free(buff); OPENSSL_free(section); + sk_BIO_pop_free(biosk, BIO_vfree); return 1; err: BUF_MEM_free(buff); OPENSSL_free(section); + sk_BIO_pop_free(biosk, BIO_vfree); +#ifndef OPENSSL_NO_POSIX_IO + OPENSSL_free(dirpath); + if (dirctx != NULL) + OPENSSL_DIR_end(&dirctx); +#endif if (line != NULL) *line = eline; BIO_snprintf(btmp, sizeof(btmp), "%ld", eline); @@ -555,6 +636,102 @@ static int str_copy(CONF *conf, char *section, char **pto, char *from) return 0; } +#ifndef OPENSSL_NO_POSIX_IO +/* + * Check whether included path is a directory. + * Returns next BIO to process and in case of a directory + * also an opened directory context and the include path. + */ +static BIO *process_include(char *include, OPENSSL_DIR_CTX **dirctx, + char **dirpath) +{ + struct stat st = { 0 }; + BIO *next; + + if (stat(include, &st) < 0) { + SYSerr(SYS_F_STAT, errno); + ERR_add_error_data(1, include); + /* missing include file is not fatal error */ + return NULL; + } + + if ((st.st_mode & S_IFDIR) == S_IFDIR) { + if (*dirctx != NULL) { + CONFerr(CONF_F_PROCESS_INCLUDE, + CONF_R_RECURSIVE_DIRECTORY_INCLUDE); + ERR_add_error_data(1, include); + return NULL; + } + /* a directory, load its contents */ + if ((next = get_next_file(include, dirctx)) != NULL) + *dirpath = include; + return next; + } + + next = BIO_new_file(include, "r"); + return next; +} + +/* + * Get next file from the directory path. + * Returns BIO of the next file to read and updates dirctx. + */ +static BIO *get_next_file(const char *path, OPENSSL_DIR_CTX **dirctx) +{ + const char *filename; + + while ((filename = OPENSSL_DIR_read(dirctx, path)) != NULL) { + size_t namelen; + + namelen = strlen(filename); + + + if ((namelen > 5 && strcasecmp(filename + namelen - 5, ".conf") == 0) + || (namelen > 4 && strcasecmp(filename + namelen - 4, ".cnf") == 0)) { + size_t newlen; + char *newpath; + BIO *bio; + + newlen = strlen(path) + namelen + 2; + newpath = OPENSSL_zalloc(newlen); + if (newpath == NULL) { + CONFerr(CONF_F_GET_NEXT_FILE, ERR_R_MALLOC_FAILURE); + break; + } +#ifdef OPENSSL_SYS_VMS + /* + * If the given path isn't clear VMS syntax, + * we treat it as on Unix. + */ + { + size_t pathlen = strlen(path); + + if (path[pathlen - 1] == ']' || path[pathlen - 1] == '>' + || path[pathlen - 1] == ':') { + /* Clear VMS directory syntax, just copy as is */ + OPENSSL_strlcpy(newpath, path, newlen); + } + } +#endif + if (newpath[0] == '\0') { + OPENSSL_strlcpy(newpath, path, newlen); + OPENSSL_strlcat(newpath, "/", newlen); + } + OPENSSL_strlcat(newpath, filename, newlen); + + bio = BIO_new_file(newpath, "r"); + OPENSSL_free(newpath); + /* Errors when opening files are non-fatal. */ + if (bio != NULL) + return bio; + } + } + OPENSSL_DIR_end(dirctx); + *dirctx = NULL; + return NULL; +} +#endif + static char *eat_ws(CONF *conf, char *p) { while (IS_WS(conf, *p) && (!IS_EOF(conf, *p))) @@ -562,6 +739,19 @@ static char *eat_ws(CONF *conf, char *p) return p; } +static void trim_ws(CONF *conf, char *start) +{ + char *p = start; + + while (!IS_EOF(conf, *p)) + p++; + p--; + while ((p >= start) && IS_WS(conf, *p)) + p--; + p++; + *p = '\0'; +} + static char *eat_alpha_numeric(CONF *conf, char *p) { for (;;) { diff --git a/crypto/conf/conf_err.c b/crypto/conf/conf_err.c index 8ba243ca..dd20a1aa 100644 --- a/crypto/conf/conf_err.c +++ b/crypto/conf/conf_err.c @@ -1,6 +1,6 @@ /* * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 1995-2017 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -20,6 +20,7 @@ static const ERR_STRING_DATA CONF_str_functs[] = { {ERR_PACK(ERR_LIB_CONF, CONF_F_CONF_PARSE_LIST, 0), "CONF_parse_list"}, {ERR_PACK(ERR_LIB_CONF, CONF_F_DEF_LOAD, 0), "def_load"}, {ERR_PACK(ERR_LIB_CONF, CONF_F_DEF_LOAD_BIO, 0), "def_load_bio"}, + {ERR_PACK(ERR_LIB_CONF, CONF_F_GET_NEXT_FILE, 0), "get_next_file"}, {ERR_PACK(ERR_LIB_CONF, CONF_F_MODULE_INIT, 0), "module_init"}, {ERR_PACK(ERR_LIB_CONF, CONF_F_MODULE_LOAD_DSO, 0), "module_load_dso"}, {ERR_PACK(ERR_LIB_CONF, CONF_F_MODULE_RUN, 0), "module_run"}, @@ -33,6 +34,7 @@ static const ERR_STRING_DATA CONF_str_functs[] = { {ERR_PACK(ERR_LIB_CONF, CONF_F_NCONF_LOAD_BIO, 0), "NCONF_load_bio"}, {ERR_PACK(ERR_LIB_CONF, CONF_F_NCONF_LOAD_FP, 0), "NCONF_load_fp"}, {ERR_PACK(ERR_LIB_CONF, CONF_F_NCONF_NEW, 0), "NCONF_new"}, + {ERR_PACK(ERR_LIB_CONF, CONF_F_PROCESS_INCLUDE, 0), "process_include"}, {ERR_PACK(ERR_LIB_CONF, CONF_F_STR_COPY, 0), "str_copy"}, {0, NULL} }; @@ -56,6 +58,8 @@ static const ERR_STRING_DATA CONF_str_reasons[] = { {ERR_PACK(ERR_LIB_CONF, 0, CONF_R_NO_SECTION), "no section"}, {ERR_PACK(ERR_LIB_CONF, 0, CONF_R_NO_SUCH_FILE), "no such file"}, {ERR_PACK(ERR_LIB_CONF, 0, CONF_R_NO_VALUE), "no value"}, + {ERR_PACK(ERR_LIB_CONF, 0, CONF_R_RECURSIVE_DIRECTORY_INCLUDE), + "recursive directory include"}, {ERR_PACK(ERR_LIB_CONF, 0, CONF_R_UNABLE_TO_CREATE_NEW_SECTION), "unable to create new section"}, {ERR_PACK(ERR_LIB_CONF, 0, CONF_R_UNKNOWN_MODULE_NAME), diff --git a/crypto/ec/asm/ecp_nistz256-armv4.pl b/crypto/ec/asm/ecp_nistz256-armv4.pl old mode 100755 new mode 100644 diff --git a/crypto/ec/asm/ecp_nistz256-avx2.pl b/crypto/ec/asm/ecp_nistz256-avx2.pl old mode 100755 new mode 100644 diff --git a/crypto/ec/asm/ecp_nistz256-ppc64.pl b/crypto/ec/asm/ecp_nistz256-ppc64.pl old mode 100755 new mode 100644 diff --git a/crypto/ec/asm/ecp_nistz256-sparcv9.pl b/crypto/ec/asm/ecp_nistz256-sparcv9.pl old mode 100755 new mode 100644 diff --git a/crypto/ec/asm/ecp_nistz256-x86.pl b/crypto/ec/asm/ecp_nistz256-x86.pl old mode 100755 new mode 100644 diff --git a/crypto/ec/asm/ecp_nistz256-x86_64.pl b/crypto/ec/asm/ecp_nistz256-x86_64.pl old mode 100755 new mode 100644 diff --git a/crypto/ec/asm/x25519-x86_64.pl b/crypto/ec/asm/x25519-x86_64.pl old mode 100755 new mode 100644 index 68a7771a..930d7bdb --- a/crypto/ec/asm/x25519-x86_64.pl +++ b/crypto/ec/asm/x25519-x86_64.pl @@ -40,12 +40,12 @@ # P4 +22% +40% # Sandy Bridge -3% +11% # Haswell -1% +13% -# Broadwell(***) +26% +30% -# Skylake(***) +30% +47% +# Broadwell(***) +30% +35% +# Skylake(***) +33% +47% # Silvermont +20% +26% # Goldmont +40% +50% # Bulldozer +20% +9% -# Ryzen(***) +35% +32% +# Ryzen(***) +43% +40% # VIA +170% +120% # # (*) amd64-51 is popular assembly implementation with 2^51 radix, @@ -631,13 +631,10 @@ x25519_fe64_sqr: and \$38,%rax add %rax,$acc0 - adc \$0,$acc1 - mov $acc0,8*0(%rdi) - adc \$0,$acc2 mov $acc1,8*1(%rdi) - adc \$0,$acc3 mov $acc2,8*2(%rdi) mov $acc3,8*3(%rdi) + mov $acc0,8*0(%rdi) mov 8*3(%rsp),%r15 mov 8*4(%rsp),%r14 @@ -674,13 +671,10 @@ x25519_fe64_mul121666: and \$38,%rax add %rax,$acc0 - adc \$0,$acc1 - mov $acc0,8*0(%rdi) - adc \$0,$acc2 mov $acc1,8*1(%rdi) - adc \$0,$acc3 mov $acc2,8*2(%rdi) mov $acc3,8*3(%rdi) + mov $acc0,8*0(%rdi) ret .size x25519_fe64_mul121666,.-x25519_fe64_mul121666 @@ -769,14 +763,11 @@ x25519_fe64_tobytes: and \$19,%rax add %rax,$acc0 - adc \$0,$acc1 - adc \$0,$acc2 - adc \$0,$acc3 - mov $acc0,8*0(%rdi) mov $acc1,8*1(%rdi) mov $acc2,8*2(%rdi) mov $acc3,8*3(%rdi) + mov $acc0,8*0(%rdi) ret .size x25519_fe64_tobytes,.-x25519_fe64_tobytes @@ -815,4 +806,4 @@ ___ $code =~ s/\`([^\`]*)\`/eval $1/gem; print $code; -close $STDOUT; +close STDOUT; diff --git a/crypto/ec/curve25519.c b/crypto/ec/curve25519.c index 45525f47..0f18ff7c 100644 --- a/crypto/ec/curve25519.c +++ b/crypto/ec/curve25519.c @@ -13,7 +13,8 @@ #if defined(X25519_ASM) \ || ( (defined(__SIZEOF_INT128__) && __SIZEOF_INT128__ == 16) \ - && !defined(__sparc__) ) + && !defined(__sparc__) \ + && !(defined(__ANDROID__) && !defined(__clang__)) ) /* * Base 2^51 implementation. */ diff --git a/crypto/ec/curve448/curve448.c b/crypto/ec/curve448/curve448.c index 8ced622b..7dc68c88 100644 --- a/crypto/ec/curve448/curve448.c +++ b/crypto/ec/curve448/curve448.c @@ -579,7 +579,7 @@ static int recode_wnaf(struct smvt_control *control, assert(position >= 0); if (odd & (1 << (table_bits + 1))) delta -= (1 << (table_bits + 1)); - current -= delta << pos; + current -= delta * (1 << pos); control[position].power = pos + 16 * (w - 1); control[position].addend = delta; position--; diff --git a/crypto/ec/curve448/f_generic.c b/crypto/ec/curve448/f_generic.c index 6babea6e..ed8f36d8 100644 --- a/crypto/ec/curve448/f_generic.c +++ b/crypto/ec/curve448/f_generic.c @@ -122,7 +122,7 @@ void gf_strong_reduce(gf a) * it was < p, so now scarry = -1 and this = x - p + 2^255 so let's add * back in p. will carry back off the top for 2^255. */ - assert(word_is_zero(scarry) | word_is_zero(scarry + 1)); + assert(scarry == 0 || scarry == -1); scarry_0 = (word_t)scarry; @@ -135,7 +135,7 @@ void gf_strong_reduce(gf a) carry >>= LIMB_PLACE_VALUE(LIMBPERM(i)); } - assert(word_is_zero(carry + scarry_0)); + assert(carry < 2 && ((word_t)carry + scarry_0) == 0); } /* Subtract two gf elements d=a-b */ diff --git a/crypto/ec/curve448/scalar.c b/crypto/ec/curve448/scalar.c index 0f14bc4b..b5702c02 100644 --- a/crypto/ec/curve448/scalar.c +++ b/crypto/ec/curve448/scalar.c @@ -135,9 +135,9 @@ void curve448_scalar_add(curve448_scalar_t out, const curve448_scalar_t a, static ossl_inline void scalar_decode_short(curve448_scalar_t s, const unsigned char *ser, - unsigned int nbytes) + size_t nbytes) { - unsigned int i, j, k = 0; + size_t i, j, k = 0; for (i = 0; i < C448_SCALAR_LIMBS; i++) { c448_word_t out = 0; diff --git a/crypto/ec/ec_err.c b/crypto/ec/ec_err.c index 588e95c1..fe90c01e 100644 --- a/crypto/ec/ec_err.c +++ b/crypto/ec/ec_err.c @@ -242,6 +242,10 @@ static const ERR_STRING_DATA EC_str_functs[] = { "ossl_ecdsa_verify_sig"}, {ERR_PACK(ERR_LIB_EC, EC_F_PKEY_ECD_CTRL, 0), "pkey_ecd_ctrl"}, {ERR_PACK(ERR_LIB_EC, EC_F_PKEY_ECD_DIGESTSIGN, 0), "pkey_ecd_digestsign"}, + {ERR_PACK(ERR_LIB_EC, EC_F_PKEY_ECD_DIGESTSIGN25519, 0), + "pkey_ecd_digestsign25519"}, + {ERR_PACK(ERR_LIB_EC, EC_F_PKEY_ECD_DIGESTSIGN448, 0), + "pkey_ecd_digestsign448"}, {ERR_PACK(ERR_LIB_EC, EC_F_PKEY_ECX_DERIVE, 0), "pkey_ecx_derive"}, {ERR_PACK(ERR_LIB_EC, EC_F_PKEY_EC_CTRL, 0), "pkey_ec_ctrl"}, {ERR_PACK(ERR_LIB_EC, EC_F_PKEY_EC_CTRL_STR, 0), "pkey_ec_ctrl_str"}, @@ -249,6 +253,7 @@ static const ERR_STRING_DATA EC_str_functs[] = { {ERR_PACK(ERR_LIB_EC, EC_F_PKEY_EC_KEYGEN, 0), "pkey_ec_keygen"}, {ERR_PACK(ERR_LIB_EC, EC_F_PKEY_EC_PARAMGEN, 0), "pkey_ec_paramgen"}, {ERR_PACK(ERR_LIB_EC, EC_F_PKEY_EC_SIGN, 0), "pkey_ec_sign"}, + {ERR_PACK(ERR_LIB_EC, EC_F_VALIDATE_ECX_DERIVE, 0), "validate_ecx_derive"}, {0, NULL} }; diff --git a/crypto/ec/ec_lcl.h b/crypto/ec/ec_lcl.h index 421cd470..413a9068 100644 --- a/crypto/ec/ec_lcl.h +++ b/crypto/ec/ec_lcl.h @@ -14,6 +14,7 @@ #include #include #include "internal/refcount.h" +#include "curve448/curve448_lcl.h" #if defined(__SUNPRO_C) # if __SUNPRO_C >= 0x520 diff --git a/crypto/ec/ecx_meth.c b/crypto/ec/ecx_meth.c index 4f7cfec7..272dfc6b 100644 --- a/crypto/ec/ecx_meth.c +++ b/crypto/ec/ecx_meth.c @@ -16,30 +16,39 @@ #include "internal/evp_int.h" #include "ec_lcl.h" -#define X25519_KEYLEN 32 #define X25519_BITS 253 #define X25519_SECURITY_BITS 128 #define ED25519_SIGSIZE 64 -typedef struct { - unsigned char pubkey[X25519_KEYLEN]; - unsigned char *privkey; -} X25519_KEY; +#define X448_BITS 448 +#define ED448_BITS 456 +#define X448_SECURITY_BITS 224 + +#define ED448_SIGSIZE 114 + +#define ISX448(id) ((id) == EVP_PKEY_X448) +#define IS25519(id) ((id) == EVP_PKEY_X25519 || (id) == EVP_PKEY_ED25519) +#define KEYLENID(id) (IS25519(id) ? X25519_KEYLEN \ + : ((id) == EVP_PKEY_X448 ? X448_KEYLEN \ + : ED448_KEYLEN)) +#define KEYLEN(p) KEYLENID((p)->ameth->pkey_id) + typedef enum { - X25519_PUBLIC, - X25519_PRIVATE, - X25519_KEYGEN + KEY_OP_PUBLIC, + KEY_OP_PRIVATE, + KEY_OP_KEYGEN } ecx_key_op_t; /* Setup EVP_PKEY using public, private or generation */ static int ecx_key_op(EVP_PKEY *pkey, int id, const X509_ALGOR *palg, const unsigned char *p, int plen, ecx_key_op_t op) { - X25519_KEY *xkey; + ECX_KEY *key = NULL; + unsigned char *privkey, *pubkey; - if (op != X25519_KEYGEN) { + if (op != KEY_OP_KEYGEN) { if (palg != NULL) { int ptype; @@ -51,69 +60,85 @@ static int ecx_key_op(EVP_PKEY *pkey, int id, const X509_ALGOR *palg, } } - if (p == NULL || plen != X25519_KEYLEN) { + if (p == NULL || plen != KEYLENID(id)) { ECerr(EC_F_ECX_KEY_OP, EC_R_INVALID_ENCODING); return 0; } } - xkey = OPENSSL_zalloc(sizeof(*xkey)); - if (xkey == NULL) { + key = OPENSSL_zalloc(sizeof(*key)); + if (key == NULL) { ECerr(EC_F_ECX_KEY_OP, ERR_R_MALLOC_FAILURE); return 0; } + pubkey = key->pubkey; - if (op == X25519_PUBLIC) { - memcpy(xkey->pubkey, p, plen); + if (op == KEY_OP_PUBLIC) { + memcpy(pubkey, p, plen); } else { - xkey->privkey = OPENSSL_secure_malloc(X25519_KEYLEN); - if (xkey->privkey == NULL) { + privkey = key->privkey = OPENSSL_secure_malloc(KEYLENID(id)); + if (privkey == NULL) { ECerr(EC_F_ECX_KEY_OP, ERR_R_MALLOC_FAILURE); - OPENSSL_free(xkey); - return 0; + goto err; } - if (op == X25519_KEYGEN) { - if (RAND_bytes(xkey->privkey, X25519_KEYLEN) <= 0) { - OPENSSL_secure_free(xkey->privkey); - OPENSSL_free(xkey); - return 0; + if (op == KEY_OP_KEYGEN) { + if (RAND_priv_bytes(privkey, KEYLENID(id)) <= 0) { + OPENSSL_secure_free(privkey); + key->privkey = NULL; + goto err; } if (id == EVP_PKEY_X25519) { - xkey->privkey[0] &= 248; - xkey->privkey[31] &= 127; - xkey->privkey[31] |= 64; + privkey[0] &= 248; + privkey[X25519_KEYLEN - 1] &= 127; + privkey[X25519_KEYLEN - 1] |= 64; + } else if (id == EVP_PKEY_X448) { + privkey[0] &= 252; + privkey[X448_KEYLEN - 1] |= 128; } } else { - memcpy(xkey->privkey, p, X25519_KEYLEN); + memcpy(privkey, p, KEYLENID(id)); + } + switch (id) { + case EVP_PKEY_X25519: + X25519_public_from_private(pubkey, privkey); + break; + case EVP_PKEY_ED25519: + ED25519_public_from_private(pubkey, privkey); + break; + case EVP_PKEY_X448: + X448_public_from_private(pubkey, privkey); + break; + case EVP_PKEY_ED448: + ED448_public_from_private(pubkey, privkey); + break; } - if (id == EVP_PKEY_X25519) - X25519_public_from_private(xkey->pubkey, xkey->privkey); - else - ED25519_public_from_private(xkey->pubkey, xkey->privkey); } - EVP_PKEY_assign(pkey, id, xkey); + EVP_PKEY_assign(pkey, id, key); return 1; + err: + OPENSSL_free(key); + return 0; } static int ecx_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey) { - const X25519_KEY *xkey = pkey->pkey.ptr; + const ECX_KEY *ecxkey = pkey->pkey.ecx; unsigned char *penc; - if (xkey == NULL) { + if (ecxkey == NULL) { ECerr(EC_F_ECX_PUB_ENCODE, EC_R_INVALID_KEY); return 0; } - penc = OPENSSL_memdup(xkey->pubkey, X25519_KEYLEN); + penc = OPENSSL_memdup(ecxkey->pubkey, KEYLEN(pkey)); if (penc == NULL) { ECerr(EC_F_ECX_PUB_ENCODE, ERR_R_MALLOC_FAILURE); return 0; } if (!X509_PUBKEY_set0_param(pk, OBJ_nid2obj(pkey->ameth->pkey_id), - V_ASN1_UNDEF, NULL, penc, X25519_KEYLEN)) { + V_ASN1_UNDEF, NULL, penc, KEYLEN(pkey))) { OPENSSL_free(penc); ECerr(EC_F_ECX_PUB_ENCODE, ERR_R_MALLOC_FAILURE); return 0; @@ -130,17 +155,18 @@ static int ecx_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey) if (!X509_PUBKEY_get0_param(NULL, &p, &pklen, &palg, pubkey)) return 0; return ecx_key_op(pkey, pkey->ameth->pkey_id, palg, p, pklen, - X25519_PUBLIC); + KEY_OP_PUBLIC); } static int ecx_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b) { - const X25519_KEY *akey = a->pkey.ptr; - const X25519_KEY *bkey = b->pkey.ptr; + const ECX_KEY *akey = a->pkey.ecx; + const ECX_KEY *bkey = b->pkey.ecx; if (akey == NULL || bkey == NULL) return -2; - return !CRYPTO_memcmp(akey->pubkey, bkey->pubkey, X25519_KEYLEN); + + return CRYPTO_memcmp(akey->pubkey, bkey->pubkey, KEYLEN(a)) == 0; } static int ecx_priv_decode(EVP_PKEY *pkey, const PKCS8_PRIV_KEY_INFO *p8) @@ -163,25 +189,25 @@ static int ecx_priv_decode(EVP_PKEY *pkey, const PKCS8_PRIV_KEY_INFO *p8) plen = ASN1_STRING_length(oct); } - rv = ecx_key_op(pkey, pkey->ameth->pkey_id, palg, p, plen, X25519_PRIVATE); + rv = ecx_key_op(pkey, pkey->ameth->pkey_id, palg, p, plen, KEY_OP_PRIVATE); ASN1_OCTET_STRING_free(oct); return rv; } static int ecx_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey) { - const X25519_KEY *xkey = pkey->pkey.ptr; + const ECX_KEY *ecxkey = pkey->pkey.ecx; ASN1_OCTET_STRING oct; unsigned char *penc = NULL; int penclen; - if (xkey == NULL || xkey->privkey == NULL) { + if (ecxkey == NULL || ecxkey->privkey == NULL) { ECerr(EC_F_ECX_PRIV_ENCODE, EC_R_INVALID_PRIVATE_KEY); return 0; } - oct.data = xkey->privkey; - oct.length = X25519_KEYLEN; + oct.data = ecxkey->privkey; + oct.length = KEYLEN(pkey); oct.flags = 0; penclen = i2d_ASN1_OCTET_STRING(&oct, &penc); @@ -202,26 +228,34 @@ static int ecx_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey) static int ecx_size(const EVP_PKEY *pkey) { - return X25519_KEYLEN; + return KEYLEN(pkey); } static int ecx_bits(const EVP_PKEY *pkey) { - return X25519_BITS; + if (IS25519(pkey->ameth->pkey_id)) { + return X25519_BITS; + } else if(ISX448(pkey->ameth->pkey_id)) { + return X448_BITS; + } else { + return ED448_BITS; + } } static int ecx_security_bits(const EVP_PKEY *pkey) { - return X25519_SECURITY_BITS; + if (IS25519(pkey->ameth->pkey_id)) { + return X25519_SECURITY_BITS; + } else { + return X448_SECURITY_BITS; + } } static void ecx_free(EVP_PKEY *pkey) { - X25519_KEY *xkey = pkey->pkey.ptr; - - if (xkey) - OPENSSL_secure_clear_free(xkey->privkey, X25519_KEYLEN); - OPENSSL_free(xkey); + if (pkey->pkey.ecx != NULL) + OPENSSL_secure_clear_free(pkey->pkey.ecx->privkey, KEYLEN(pkey)); + OPENSSL_free(pkey->pkey.ecx); } /* "parameters" are always equal */ @@ -233,12 +267,11 @@ static int ecx_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b) static int ecx_key_print(BIO *bp, const EVP_PKEY *pkey, int indent, ASN1_PCTX *ctx, ecx_key_op_t op) { - const X25519_KEY *xkey = pkey->pkey.ptr; - + const ECX_KEY *ecxkey = pkey->pkey.ecx; const char *nm = OBJ_nid2ln(pkey->ameth->pkey_id); - if (op == X25519_PRIVATE) { - if (xkey == NULL || xkey->privkey == NULL) { + if (op == KEY_OP_PRIVATE) { + if (ecxkey == NULL || ecxkey->privkey == NULL) { if (BIO_printf(bp, "%*s\n", indent, "") <= 0) return 0; return 1; @@ -247,10 +280,11 @@ static int ecx_key_print(BIO *bp, const EVP_PKEY *pkey, int indent, return 0; if (BIO_printf(bp, "%*spriv:\n", indent, "") <= 0) return 0; - if (ASN1_buf_print(bp, xkey->privkey, X25519_KEYLEN, indent + 4) == 0) + if (ASN1_buf_print(bp, ecxkey->privkey, KEYLEN(pkey), + indent + 4) == 0) return 0; } else { - if (xkey == NULL) { + if (ecxkey == NULL) { if (BIO_printf(bp, "%*s\n", indent, "") <= 0) return 0; return 1; @@ -260,7 +294,9 @@ static int ecx_key_print(BIO *bp, const EVP_PKEY *pkey, int indent, } if (BIO_printf(bp, "%*spub:\n", indent, "") <= 0) return 0; - if (ASN1_buf_print(bp, xkey->pubkey, X25519_KEYLEN, indent + 4) == 0) + + if (ASN1_buf_print(bp, ecxkey->pubkey, KEYLEN(pkey), + indent + 4) == 0) return 0; return 1; } @@ -268,13 +304,13 @@ static int ecx_key_print(BIO *bp, const EVP_PKEY *pkey, int indent, static int ecx_priv_print(BIO *bp, const EVP_PKEY *pkey, int indent, ASN1_PCTX *ctx) { - return ecx_key_print(bp, pkey, indent, ctx, X25519_PRIVATE); + return ecx_key_print(bp, pkey, indent, ctx, KEY_OP_PRIVATE); } static int ecx_pub_print(BIO *bp, const EVP_PKEY *pkey, int indent, ASN1_PCTX *ctx) { - return ecx_key_print(bp, pkey, indent, ctx, X25519_PUBLIC); + return ecx_key_print(bp, pkey, indent, ctx, KEY_OP_PUBLIC); } static int ecx_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2) @@ -282,16 +318,16 @@ static int ecx_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2) switch (op) { case ASN1_PKEY_CTRL_SET1_TLS_ENCPT: - return ecx_key_op(pkey, EVP_PKEY_X25519, NULL, arg2, arg1, - X25519_PUBLIC); + return ecx_key_op(pkey, pkey->ameth->pkey_id, NULL, arg2, arg1, + KEY_OP_PUBLIC); case ASN1_PKEY_CTRL_GET1_TLS_ENCPT: - if (pkey->pkey.ptr != NULL) { - const X25519_KEY *xkey = pkey->pkey.ptr; + if (pkey->pkey.ecx != NULL) { unsigned char **ppt = arg2; - *ppt = OPENSSL_memdup(xkey->pubkey, X25519_KEYLEN); + + *ppt = OPENSSL_memdup(pkey->pkey.ecx->pubkey, KEYLEN(pkey)); if (*ppt != NULL) - return X25519_KEYLEN; + return KEYLEN(pkey); } return 0; @@ -335,21 +371,58 @@ const EVP_PKEY_ASN1_METHOD ecx25519_asn1_meth = { NULL }; -static int ecd_size(const EVP_PKEY *pkey) +const EVP_PKEY_ASN1_METHOD ecx448_asn1_meth = { + EVP_PKEY_X448, + EVP_PKEY_X448, + 0, + "X448", + "OpenSSL X448 algorithm", + + ecx_pub_decode, + ecx_pub_encode, + ecx_pub_cmp, + ecx_pub_print, + + ecx_priv_decode, + ecx_priv_encode, + ecx_priv_print, + + ecx_size, + ecx_bits, + ecx_security_bits, + + 0, 0, 0, 0, + ecx_cmp_parameters, + 0, 0, + + ecx_free, + ecx_ctrl, + NULL, + NULL +}; + +static int ecd_size25519(const EVP_PKEY *pkey) { return ED25519_SIGSIZE; } +static int ecd_size448(const EVP_PKEY *pkey) +{ + return ED448_SIGSIZE; +} + static int ecd_item_verify(EVP_MD_CTX *ctx, const ASN1_ITEM *it, void *asn, X509_ALGOR *sigalg, ASN1_BIT_STRING *str, EVP_PKEY *pkey) { const ASN1_OBJECT *obj; int ptype; + int nid; + /* Sanity check: make sure it is ED25519/ED448 with absent parameters */ X509_ALGOR_get0(&obj, &ptype, NULL, sigalg); - /* Sanity check: make sure it is ED25519 with absent parameters */ - if (OBJ_obj2nid(obj) != NID_ED25519 || ptype != V_ASN1_UNDEF) { + nid = OBJ_obj2nid(obj); + if ((nid != NID_ED25519 && nid != NID_ED448) || ptype != V_ASN1_UNDEF) { ECerr(EC_F_ECD_ITEM_VERIFY, EC_R_INVALID_ENCODING); return 0; } @@ -360,9 +433,9 @@ static int ecd_item_verify(EVP_MD_CTX *ctx, const ASN1_ITEM *it, void *asn, return 2; } -static int ecd_item_sign(EVP_MD_CTX *ctx, const ASN1_ITEM *it, void *asn, - X509_ALGOR *alg1, X509_ALGOR *alg2, - ASN1_BIT_STRING *str) +static int ecd_item_sign25519(EVP_MD_CTX *ctx, const ASN1_ITEM *it, void *asn, + X509_ALGOR *alg1, X509_ALGOR *alg2, + ASN1_BIT_STRING *str) { /* Set algorithms identifiers */ X509_ALGOR_set0(alg1, OBJ_nid2obj(NID_ED25519), V_ASN1_UNDEF, NULL); @@ -372,14 +445,35 @@ static int ecd_item_sign(EVP_MD_CTX *ctx, const ASN1_ITEM *it, void *asn, return 3; } -static int ecd_sig_info_set(X509_SIG_INFO *siginf, const X509_ALGOR *alg, - const ASN1_STRING *sig) +static int ecd_sig_info_set25519(X509_SIG_INFO *siginf, const X509_ALGOR *alg, + const ASN1_STRING *sig) { X509_SIG_INFO_set(siginf, NID_undef, NID_ED25519, X25519_SECURITY_BITS, X509_SIG_INFO_TLS); return 1; } +static int ecd_item_sign448(EVP_MD_CTX *ctx, const ASN1_ITEM *it, void *asn, + X509_ALGOR *alg1, X509_ALGOR *alg2, + ASN1_BIT_STRING *str) +{ + /* Set algorithm identifier */ + X509_ALGOR_set0(alg1, OBJ_nid2obj(NID_ED448), V_ASN1_UNDEF, NULL); + if (alg2 != NULL) + X509_ALGOR_set0(alg2, OBJ_nid2obj(NID_ED448), V_ASN1_UNDEF, NULL); + /* Algorithm identifier set: carry on as normal */ + return 3; +} + +static int ecd_sig_info_set448(X509_SIG_INFO *siginf, const X509_ALGOR *alg, + const ASN1_STRING *sig) +{ + X509_SIG_INFO_set(siginf, NID_undef, NID_ED448, X448_SECURITY_BITS, + X509_SIG_INFO_TLS); + return 1; +} + + const EVP_PKEY_ASN1_METHOD ed25519_asn1_meth = { EVP_PKEY_ED25519, EVP_PKEY_ED25519, @@ -396,7 +490,7 @@ const EVP_PKEY_ASN1_METHOD ed25519_asn1_meth = { ecx_priv_encode, ecx_priv_print, - ecd_size, + ecd_size25519, ecx_bits, ecx_security_bits, @@ -409,37 +503,98 @@ const EVP_PKEY_ASN1_METHOD ed25519_asn1_meth = { NULL, NULL, ecd_item_verify, - ecd_item_sign, - ecd_sig_info_set + ecd_item_sign25519, + ecd_sig_info_set25519 +}; + +const EVP_PKEY_ASN1_METHOD ed448_asn1_meth = { + EVP_PKEY_ED448, + EVP_PKEY_ED448, + 0, + "ED448", + "OpenSSL ED448 algorithm", + + ecx_pub_decode, + ecx_pub_encode, + ecx_pub_cmp, + ecx_pub_print, + + ecx_priv_decode, + ecx_priv_encode, + ecx_priv_print, + + ecd_size448, + ecx_bits, + ecx_security_bits, + + 0, 0, 0, 0, + ecx_cmp_parameters, + 0, 0, + + ecx_free, + 0, + NULL, + NULL, + ecd_item_verify, + ecd_item_sign448, + ecd_sig_info_set448 }; static int pkey_ecx_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey) { - return ecx_key_op(pkey, ctx->pmeth->pkey_id, NULL, NULL, 0, X25519_KEYGEN); + return ecx_key_op(pkey, ctx->pmeth->pkey_id, NULL, NULL, 0, KEY_OP_KEYGEN); } -static int pkey_ecx_derive(EVP_PKEY_CTX *ctx, unsigned char *key, - size_t *keylen) +static int validate_ecx_derive(EVP_PKEY_CTX *ctx, unsigned char *key, + size_t *keylen, + const unsigned char **privkey, + const unsigned char **pubkey) { - const X25519_KEY *pkey, *peerkey; + const ECX_KEY *ecxkey, *peerkey; if (ctx->pkey == NULL || ctx->peerkey == NULL) { - ECerr(EC_F_PKEY_ECX_DERIVE, EC_R_KEYS_NOT_SET); + ECerr(EC_F_VALIDATE_ECX_DERIVE, EC_R_KEYS_NOT_SET); return 0; } - pkey = ctx->pkey->pkey.ptr; - peerkey = ctx->peerkey->pkey.ptr; - if (pkey == NULL || pkey->privkey == NULL) { - ECerr(EC_F_PKEY_ECX_DERIVE, EC_R_INVALID_PRIVATE_KEY); + ecxkey = ctx->pkey->pkey.ecx; + peerkey = ctx->peerkey->pkey.ecx; + if (ecxkey == NULL || ecxkey->privkey == NULL) { + ECerr(EC_F_VALIDATE_ECX_DERIVE, EC_R_INVALID_PRIVATE_KEY); return 0; } if (peerkey == NULL) { - ECerr(EC_F_PKEY_ECX_DERIVE, EC_R_INVALID_PEER_KEY); + ECerr(EC_F_VALIDATE_ECX_DERIVE, EC_R_INVALID_PEER_KEY); return 0; } - *keylen = X25519_KEYLEN; - if (key != NULL && X25519(key, pkey->privkey, peerkey->pubkey) == 0) + *privkey = ecxkey->privkey; + *pubkey = peerkey->pubkey; + + return 1; +} + +static int pkey_ecx_derive25519(EVP_PKEY_CTX *ctx, unsigned char *key, + size_t *keylen) +{ + const unsigned char *privkey, *pubkey; + + if (!validate_ecx_derive(ctx, key, keylen, &privkey, &pubkey) + || (key != NULL + && X25519(key, privkey, pubkey) == 0)) return 0; + *keylen = X25519_KEYLEN; + return 1; +} + +static int pkey_ecx_derive448(EVP_PKEY_CTX *ctx, unsigned char *key, + size_t *keylen) +{ + const unsigned char *privkey, *pubkey; + + if (!validate_ecx_derive(ctx, key, keylen, &privkey, &pubkey) + || (key != NULL + && X448(key, privkey, pubkey) == 0)) + return 0; + *keylen = X448_KEYLEN; return 1; } @@ -456,23 +611,33 @@ const EVP_PKEY_METHOD ecx25519_pkey_meth = { 0, 0, 0, 0, 0, 0, 0, pkey_ecx_keygen, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, - pkey_ecx_derive, + pkey_ecx_derive25519, pkey_ecx_ctrl, 0 }; -static int pkey_ecd_digestsign(EVP_MD_CTX *ctx, unsigned char *sig, - size_t *siglen, const unsigned char *tbs, - size_t tbslen) +const EVP_PKEY_METHOD ecx448_pkey_meth = { + EVP_PKEY_X448, + 0, 0, 0, 0, 0, 0, 0, + pkey_ecx_keygen, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + pkey_ecx_derive448, + pkey_ecx_ctrl, + 0 +}; + +static int pkey_ecd_digestsign25519(EVP_MD_CTX *ctx, unsigned char *sig, + size_t *siglen, const unsigned char *tbs, + size_t tbslen) { - const X25519_KEY *edkey = EVP_MD_CTX_pkey_ctx(ctx)->pkey->pkey.ptr; + const ECX_KEY *edkey = EVP_MD_CTX_pkey_ctx(ctx)->pkey->pkey.ecx; if (sig == NULL) { *siglen = ED25519_SIGSIZE; return 1; } if (*siglen < ED25519_SIGSIZE) { - ECerr(EC_F_PKEY_ECD_DIGESTSIGN, EC_R_BUFFER_TOO_SMALL); + ECerr(EC_F_PKEY_ECD_DIGESTSIGN25519, EC_R_BUFFER_TOO_SMALL); return 0; } @@ -482,11 +647,33 @@ static int pkey_ecd_digestsign(EVP_MD_CTX *ctx, unsigned char *sig, return 1; } -static int pkey_ecd_digestverify(EVP_MD_CTX *ctx, const unsigned char *sig, - size_t siglen, const unsigned char *tbs, - size_t tbslen) +static int pkey_ecd_digestsign448(EVP_MD_CTX *ctx, unsigned char *sig, + size_t *siglen, const unsigned char *tbs, + size_t tbslen) { - const X25519_KEY *edkey = EVP_MD_CTX_pkey_ctx(ctx)->pkey->pkey.ptr; + const ECX_KEY *edkey = EVP_MD_CTX_pkey_ctx(ctx)->pkey->pkey.ecx; + + if (sig == NULL) { + *siglen = ED448_SIGSIZE; + return 1; + } + if (*siglen < ED448_SIGSIZE) { + ECerr(EC_F_PKEY_ECD_DIGESTSIGN448, EC_R_BUFFER_TOO_SMALL); + return 0; + } + + if (ED448_sign(sig, tbs, tbslen, edkey->pubkey, edkey->privkey, NULL, + 0) == 0) + return 0; + *siglen = ED448_SIGSIZE; + return 1; +} + +static int pkey_ecd_digestverify25519(EVP_MD_CTX *ctx, const unsigned char *sig, + size_t siglen, const unsigned char *tbs, + size_t tbslen) +{ + const ECX_KEY *edkey = EVP_MD_CTX_pkey_ctx(ctx)->pkey->pkey.ecx; if (siglen != ED25519_SIGSIZE) return 0; @@ -494,6 +681,18 @@ static int pkey_ecd_digestverify(EVP_MD_CTX *ctx, const unsigned char *sig, return ED25519_verify(tbs, tbslen, sig, edkey->pubkey); } +static int pkey_ecd_digestverify448(EVP_MD_CTX *ctx, const unsigned char *sig, + size_t siglen, const unsigned char *tbs, + size_t tbslen) +{ + const ECX_KEY *edkey = EVP_MD_CTX_pkey_ctx(ctx)->pkey->pkey.ecx; + + if (siglen != ED448_SIGSIZE) + return 0; + + return ED448_verify(tbs, tbslen, sig, edkey->pubkey, NULL, 0); +} + static int pkey_ecd_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) { switch (type) { @@ -517,6 +716,17 @@ const EVP_PKEY_METHOD ed25519_pkey_meth = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, pkey_ecd_ctrl, 0, - pkey_ecd_digestsign, - pkey_ecd_digestverify + pkey_ecd_digestsign25519, + pkey_ecd_digestverify25519 +}; + +const EVP_PKEY_METHOD ed448_pkey_meth = { + EVP_PKEY_ED448, EVP_PKEY_FLAG_SIGCTX_CUSTOM, + 0, 0, 0, 0, 0, 0, + pkey_ecx_keygen, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + pkey_ecd_ctrl, + 0, + pkey_ecd_digestsign448, + pkey_ecd_digestverify448 }; diff --git a/crypto/engine/eng_rdrand.c b/crypto/engine/eng_rdrand.c index 7be64e3f..261e5deb 100644 --- a/crypto/engine/eng_rdrand.c +++ b/crypto/engine/eng_rdrand.c @@ -1,5 +1,5 @@ /* - * Copyright 2011-2016 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2011-2018 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -20,28 +20,15 @@ defined(__x86_64) || defined(__x86_64__) || \ defined(_M_AMD64) || defined (_M_X64)) && defined(OPENSSL_CPUID_OBJ) -size_t OPENSSL_ia32_rdrand(void); +size_t OPENSSL_ia32_rdrand_bytes(unsigned char *buf, size_t len); static int get_random_bytes(unsigned char *buf, int num) { - size_t rnd; - - while (num >= (int)sizeof(size_t)) { - if ((rnd = OPENSSL_ia32_rdrand()) == 0) - return 0; - - *((size_t *)buf) = rnd; - buf += sizeof(size_t); - num -= sizeof(size_t); - } - if (num) { - if ((rnd = OPENSSL_ia32_rdrand()) == 0) - return 0; - - memcpy(buf, &rnd, num); + if (num < 0) { + return 0; } - return 1; + return (size_t)num == OPENSSL_ia32_rdrand_bytes(buf, (size_t)num); } static int random_status(void) diff --git a/crypto/engine/eng_table.c b/crypto/engine/eng_table.c index 219253a3..ffdecb99 100644 --- a/crypto/engine/eng_table.c +++ b/crypto/engine/eng_table.c @@ -109,6 +109,11 @@ int engine_table_register(ENGINE_TABLE **table, ENGINE_CLEANUP_CB *cleanup, } fnd->funct = NULL; (void)lh_ENGINE_PILE_insert(&(*table)->piles, fnd); + if (lh_ENGINE_PILE_retrieve(&(*table)->piles, &tmplate) != fnd) { + sk_ENGINE_free(fnd->sk); + OPENSSL_free(fnd); + goto end; + } } /* A registration shouldn't add duplicate entries */ (void)sk_ENGINE_delete_ptr(fnd->sk, e); diff --git a/crypto/err/err.c b/crypto/err/err.c index d69fbf87..68afa93a 100644 --- a/crypto/err/err.c +++ b/crypto/err/err.c @@ -89,6 +89,7 @@ static ERR_STRING_DATA ERR_str_functs[] = { {ERR_PACK(0, SYS_F_IOCTL, 0), "ioctl"}, {ERR_PACK(0, SYS_F_STAT, 0), "stat"}, {ERR_PACK(0, SYS_F_FCNTL, 0), "fcntl"}, + {ERR_PACK(0, SYS_F_FSTAT, 0), "fstat"}, {0, NULL}, }; diff --git a/crypto/err/openssl.txt b/crypto/err/openssl.txt index e406becd..d867007b 100644 --- a/crypto/err/openssl.txt +++ b/crypto/err/openssl.txt @@ -299,6 +299,7 @@ CONF_F_CONF_LOAD_FP:103:CONF_load_fp CONF_F_CONF_PARSE_LIST:119:CONF_parse_list CONF_F_DEF_LOAD:120:def_load CONF_F_DEF_LOAD_BIO:121:def_load_bio +CONF_F_GET_NEXT_FILE:107:get_next_file CONF_F_MODULE_INIT:115:module_init CONF_F_MODULE_LOAD_DSO:117:module_load_dso CONF_F_MODULE_RUN:118:module_run @@ -311,6 +312,7 @@ CONF_F_NCONF_LOAD:113:NCONF_load CONF_F_NCONF_LOAD_BIO:110:NCONF_load_bio CONF_F_NCONF_LOAD_FP:114:NCONF_load_fp CONF_F_NCONF_NEW:111:NCONF_new +CONF_F_PROCESS_INCLUDE:116:process_include CONF_F_STR_COPY:101:str_copy CRYPTO_F_CRYPTO_DUP_EX_DATA:110:CRYPTO_dup_ex_data CRYPTO_F_CRYPTO_FREE_EX_DATA:111:CRYPTO_free_ex_data @@ -594,6 +596,8 @@ EC_F_OSSL_ECDSA_SIGN_SIG:249:ossl_ecdsa_sign_sig EC_F_OSSL_ECDSA_VERIFY_SIG:250:ossl_ecdsa_verify_sig EC_F_PKEY_ECD_CTRL:271:pkey_ecd_ctrl EC_F_PKEY_ECD_DIGESTSIGN:272:pkey_ecd_digestsign +EC_F_PKEY_ECD_DIGESTSIGN25519:276:pkey_ecd_digestsign25519 +EC_F_PKEY_ECD_DIGESTSIGN448:277:pkey_ecd_digestsign448 EC_F_PKEY_ECX_DERIVE:269:pkey_ecx_derive EC_F_PKEY_EC_CTRL:197:pkey_ec_ctrl EC_F_PKEY_EC_CTRL_STR:198:pkey_ec_ctrl_str @@ -601,6 +605,7 @@ EC_F_PKEY_EC_DERIVE:217:pkey_ec_derive EC_F_PKEY_EC_KEYGEN:199:pkey_ec_keygen EC_F_PKEY_EC_PARAMGEN:219:pkey_ec_paramgen EC_F_PKEY_EC_SIGN:218:pkey_ec_sign +EC_F_VALIDATE_ECX_DERIVE:278:validate_ecx_derive ENGINE_F_DIGEST_UPDATE:198:digest_update ENGINE_F_DYNAMIC_CTRL:180:dynamic_ctrl ENGINE_F_DYNAMIC_GET_DATA_CTX:181:dynamic_get_data_ctx @@ -902,6 +907,7 @@ RAND_F_GET_ENTROPY:106:get_entropy RAND_F_RAND_BYTES:100:RAND_bytes RAND_F_RAND_DRBG_ENABLE_LOCKING:119:rand_drbg_enable_locking RAND_F_RAND_DRBG_GENERATE:107:RAND_DRBG_generate +RAND_F_RAND_DRBG_GET_ENTROPY:120:rand_drbg_get_entropy RAND_F_RAND_DRBG_INSTANTIATE:108:RAND_DRBG_instantiate RAND_F_RAND_DRBG_NEW:109:RAND_DRBG_new RAND_F_RAND_DRBG_RESEED:110:RAND_DRBG_reseed @@ -1177,6 +1183,7 @@ SSL_F_SSL_SESSION_SET1_ID:423:SSL_SESSION_set1_id SSL_F_SSL_SESSION_SET1_ID_CONTEXT:312:SSL_SESSION_set1_id_context SSL_F_SSL_SET_ALPN_PROTOS:344:SSL_set_alpn_protos SSL_F_SSL_SET_CERT:191:ssl_set_cert +SSL_F_SSL_SET_CERT_AND_KEY:621:ssl_set_cert_and_key SSL_F_SSL_SET_CIPHER_LIST:271:SSL_set_cipher_list SSL_F_SSL_SET_CT_VALIDATION_CALLBACK:399:SSL_set_ct_validation_callback SSL_F_SSL_SET_FD:192:SSL_set_fd @@ -1869,6 +1876,7 @@ CONF_R_NO_CONF_OR_ENVIRONMENT_VARIABLE:106:no conf or environment variable CONF_R_NO_SECTION:107:no section CONF_R_NO_SUCH_FILE:114:no such file CONF_R_NO_VALUE:108:no value +CONF_R_RECURSIVE_DIRECTORY_INCLUDE:111:recursive directory include CONF_R_UNABLE_TO_CREATE_NEW_SECTION:103:unable to create new section CONF_R_UNKNOWN_MODULE_NAME:113:unknown module name CONF_R_VARIABLE_EXPANSION_TOO_LONG:116:variable expansion too long @@ -2294,6 +2302,7 @@ RAND_R_NOT_A_REGULAR_FILE:122:Not a regular file RAND_R_NOT_INSTANTIATED:115:not instantiated RAND_R_NO_DRBG_IMPLEMENTATION_SELECTED:128:no drbg implementation selected RAND_R_PARENT_LOCKING_NOT_ENABLED:130:parent locking not enabled +RAND_R_PARENT_STRENGTH_TOO_WEAK:131:parent strength too weak RAND_R_PERSONALISATION_STRING_TOO_LONG:116:personalisation string too long RAND_R_PRNG_NOT_SEEDED:100:PRNG not seeded RAND_R_RANDOM_POOL_OVERFLOW:125:random pool overflow @@ -2517,6 +2526,7 @@ SSL_R_LIBRARY_HAS_NO_CIPHERS:161:library has no ciphers SSL_R_MISSING_DSA_SIGNING_CERT:165:missing dsa signing cert SSL_R_MISSING_ECDSA_SIGNING_CERT:381:missing ecdsa signing cert SSL_R_MISSING_FATAL:256:missing fatal +SSL_R_MISSING_PARAMETERS:290:missing parameters SSL_R_MISSING_RSA_CERTIFICATE:168:missing rsa certificate SSL_R_MISSING_RSA_ENCRYPTING_CERT:169:missing rsa encrypting cert SSL_R_MISSING_RSA_SIGNING_CERT:170:missing rsa signing cert @@ -2527,6 +2537,7 @@ SSL_R_MISSING_SUPPORTED_GROUPS_EXTENSION:209:missing supported groups extension SSL_R_MISSING_TMP_DH_KEY:171:missing tmp dh key SSL_R_MISSING_TMP_ECDH_KEY:311:missing tmp ecdh key SSL_R_NOT_ON_RECORD_BOUNDARY:182:not on record boundary +SSL_R_NOT_REPLACING_CERTIFICATE:289:not replacing certificate SSL_R_NOT_SERVER:284:not server SSL_R_NO_APPLICATION_PROTOCOL:235:no application protocol SSL_R_NO_CERTIFICATES_RETURNED:176:no certificates returned @@ -2538,6 +2549,7 @@ SSL_R_NO_CIPHERS_SPECIFIED:183:no ciphers specified SSL_R_NO_CIPHER_MATCH:185:no cipher match SSL_R_NO_CLIENT_CERT_METHOD:331:no client cert method SSL_R_NO_COMPRESSION_SPECIFIED:187:no compression specified +SSL_R_NO_COOKIE_CALLBACK_SET:287:no cookie callback set SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER:330:\ Peer haven't sent GOST certificate, required for selected ciphersuite SSL_R_NO_METHOD_SPECIFIED:188:no method specified @@ -2568,6 +2580,7 @@ SSL_R_PEM_NAME_BAD_PREFIX:391:pem name bad prefix SSL_R_PEM_NAME_TOO_SHORT:392:pem name too short SSL_R_PIPELINE_FAILURE:406:pipeline failure SSL_R_POST_HANDSHAKE_AUTH_ENCODING_ERR:278:post handshake auth encoding err +SSL_R_PRIVATE_KEY_MISMATCH:288:private key mismatch SSL_R_PROTOCOL_IS_SHUTDOWN:207:protocol is shutdown SSL_R_PSK_IDENTITY_NOT_FOUND:223:psk identity not found SSL_R_PSK_NO_CLIENT_CB:224:psk no client cb diff --git a/crypto/evp/bio_b64.c b/crypto/evp/bio_b64.c index cade6f8f..e70fc322 100644 --- a/crypto/evp/bio_b64.c +++ b/crypto/evp/bio_b64.c @@ -289,6 +289,14 @@ static int b64_read(BIO *b, char *out, int outl) (unsigned char *)ctx->tmp, i); ctx->tmp_len = 0; } + /* + * If eof or an error was signalled, then the condition + * 'ctx->cont <= 0' will prevent b64_read() from reading + * more data on subsequent calls. This assignment was + * deleted accidentally in commit 5562cfaca4f3. + */ + ctx->cont = i; + ctx->buf_off = 0; if (i < 0) { ret_code = 0; diff --git a/crypto/evp/e_aes.c b/crypto/evp/e_aes.c index 1d5007ac..bed9b274 100644 --- a/crypto/evp/e_aes.c +++ b/crypto/evp/e_aes.c @@ -17,6 +17,7 @@ #include "internal/evp_int.h" #include "modes_lcl.h" #include +#include #include "evp_locl.h" typedef struct { @@ -1404,8 +1405,14 @@ static int s390x_aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr) memcpy(gctx->iv, ptr, arg); enc = EVP_CIPHER_CTX_encrypting(c); - if (enc && RAND_bytes(gctx->iv + arg, gctx->ivlen - arg) <= 0) - return 0; + if (enc) { + if (c->drbg != NULL) { + if (RAND_DRBG_bytes(c->drbg, gctx->iv + arg, gctx->ivlen - arg) == 0) + return 0; + } else if (RAND_bytes(gctx->iv + arg, gctx->ivlen - arg) <= 0) { + return 0; + } + } gctx->iv_gen = 1; return 1; @@ -2632,9 +2639,14 @@ static int aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr) return 0; if (arg) memcpy(gctx->iv, ptr, arg); - if (EVP_CIPHER_CTX_encrypting(c) - && RAND_bytes(gctx->iv + arg, gctx->ivlen - arg) <= 0) - return 0; + if (EVP_CIPHER_CTX_encrypting(c)) { + if (c->drbg != NULL) { + if (RAND_DRBG_bytes(c->drbg, gctx->iv + arg, gctx->ivlen - arg) == 0) + return 0; + } else if (RAND_bytes(gctx->iv + arg, gctx->ivlen - arg) <= 0) { + return 0; + } + } gctx->iv_gen = 1; return 1; diff --git a/crypto/evp/e_aes_cbc_hmac_sha1.c b/crypto/evp/e_aes_cbc_hmac_sha1.c index 09d24dc3..053189e6 100644 --- a/crypto/evp/e_aes_cbc_hmac_sha1.c +++ b/crypto/evp/e_aes_cbc_hmac_sha1.c @@ -17,9 +17,11 @@ #include #include #include +#include #include "modes_lcl.h" #include "internal/evp_int.h" #include "internal/constant_time_locl.h" +#include "evp_locl.h" typedef struct { AES_KEY ks; @@ -154,7 +156,8 @@ void aesni_multi_cbc_encrypt(CIPH_DESC *, void *, int); static size_t tls1_1_multi_block_encrypt(EVP_AES_HMAC_SHA1 *key, unsigned char *out, const unsigned char *inp, - size_t inp_len, int n4x) + size_t inp_len, int n4x, + RAND_DRBG *drbg) { /* n4x is 1 or 2 */ HASH_DESC hash_d[8], edges[8]; CIPH_DESC ciph_d[8]; @@ -174,8 +177,13 @@ static size_t tls1_1_multi_block_encrypt(EVP_AES_HMAC_SHA1 *key, # endif /* ask for IVs in bulk */ - if (RAND_bytes((IVs = blocks[0].c), 16 * x4) <= 0) + IVs = blocks[0].c; + if (drbg != NULL) { + if (RAND_DRBG_bytes(drbg, IVs, 16 * x4) == 0) + return 0; + } else if (RAND_bytes(IVs, 16 * x4) <= 0) { return 0; + } ctx = (SHA1_MB_CTX *) (storage + 32 - ((size_t)storage % 32)); /* align */ @@ -893,7 +901,8 @@ static int aesni_cbc_hmac_sha1_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, return (int)tls1_1_multi_block_encrypt(key, param->out, param->inp, param->len, - param->interleave / 4); + param->interleave / 4, + ctx->drbg); } case EVP_CTRL_TLS1_1_MULTIBLOCK_DECRYPT: # endif diff --git a/crypto/evp/e_aes_cbc_hmac_sha256.c b/crypto/evp/e_aes_cbc_hmac_sha256.c index caac0c9d..215e02f1 100644 --- a/crypto/evp/e_aes_cbc_hmac_sha256.c +++ b/crypto/evp/e_aes_cbc_hmac_sha256.c @@ -18,9 +18,11 @@ #include #include #include +#include #include "modes_lcl.h" #include "internal/constant_time_locl.h" #include "internal/evp_int.h" +#include "evp_locl.h" typedef struct { AES_KEY ks; @@ -150,7 +152,8 @@ void aesni_multi_cbc_encrypt(CIPH_DESC *, void *, int); static size_t tls1_1_multi_block_encrypt(EVP_AES_HMAC_SHA256 *key, unsigned char *out, const unsigned char *inp, - size_t inp_len, int n4x) + size_t inp_len, int n4x, + RAND_DRBG *drbg) { /* n4x is 1 or 2 */ HASH_DESC hash_d[8], edges[8]; CIPH_DESC ciph_d[8]; @@ -170,8 +173,13 @@ static size_t tls1_1_multi_block_encrypt(EVP_AES_HMAC_SHA256 *key, # endif /* ask for IVs in bulk */ - if (RAND_bytes((IVs = blocks[0].c), 16 * x4) <= 0) + IVs = blocks[0].c; + if (drbg != NULL) { + if (RAND_DRBG_bytes(drbg, IVs, 16 * x4) == 0) + return 0; + } else if (RAND_bytes(IVs, 16 * x4) <= 0) { return 0; + } /* align */ ctx = (SHA256_MB_CTX *) (storage + 32 - ((size_t)storage % 32)); @@ -877,7 +885,8 @@ static int aesni_cbc_hmac_sha256_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, return (int)tls1_1_multi_block_encrypt(key, param->out, param->inp, param->len, - param->interleave / 4); + param->interleave / 4, + ctx->drbg); } case EVP_CTRL_TLS1_1_MULTIBLOCK_DECRYPT: # endif diff --git a/crypto/evp/e_aria.c b/crypto/evp/e_aria.c index 00e008a3..10525a84 100644 --- a/crypto/evp/e_aria.c +++ b/crypto/evp/e_aria.c @@ -15,6 +15,7 @@ # include # include "internal/aria.h" # include "internal/evp_int.h" +# include "internal/rand.h" # include "modes_lcl.h" # include "evp_locl.h" @@ -301,9 +302,14 @@ static int aria_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr) return 0; if (arg) memcpy(gctx->iv, ptr, arg); - if (EVP_CIPHER_CTX_encrypting(c) - && RAND_bytes(gctx->iv + arg, gctx->ivlen - arg) <= 0) - return 0; + if (EVP_CIPHER_CTX_encrypting(c)) { + if (c->drbg != NULL) { + if (RAND_DRBG_bytes(c->drbg, gctx->iv + arg, gctx->ivlen - arg) == 0) + return 0; + } else if (RAND_bytes(gctx->iv + arg, gctx->ivlen - arg) <= 0) { + return 0; + } + } gctx->iv_gen = 1; return 1; diff --git a/crypto/evp/e_des.c b/crypto/evp/e_des.c index 9b2facfe..d8c4afa8 100644 --- a/crypto/evp/e_des.c +++ b/crypto/evp/e_des.c @@ -15,6 +15,8 @@ # include "internal/evp_int.h" # include # include +# include +# include "evp_locl.h" typedef struct { union { @@ -229,8 +231,12 @@ static int des_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr) switch (type) { case EVP_CTRL_RAND_KEY: - if (RAND_bytes(ptr, 8) <= 0) + if (c->drbg != NULL) { + if (RAND_DRBG_bytes(c->drbg, ptr, 8) == 0) + return 0; + } else if (RAND_bytes(ptr, 8) <= 0) { return 0; + } DES_set_odd_parity((DES_cblock *)ptr); return 1; diff --git a/crypto/evp/e_des3.c b/crypto/evp/e_des3.c index da77936c..75e6ecf3 100644 --- a/crypto/evp/e_des3.c +++ b/crypto/evp/e_des3.c @@ -15,6 +15,7 @@ # include "internal/evp_int.h" # include # include +# include # include "evp_locl.h" typedef struct { @@ -283,8 +284,12 @@ static int des3_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr) switch (type) { case EVP_CTRL_RAND_KEY: - if (RAND_bytes(ptr, EVP_CIPHER_CTX_key_length(ctx)) <= 0) + if (ctx->drbg != NULL) { + if (RAND_DRBG_bytes(ctx->drbg, ptr, EVP_CIPHER_CTX_key_length(ctx)) == 0) + return 0; + } else if (RAND_bytes(ptr, EVP_CIPHER_CTX_key_length(ctx)) <= 0) { return 0; + } DES_set_odd_parity(deskey); if (EVP_CIPHER_CTX_key_length(ctx) >= 16) DES_set_odd_parity(deskey + 1); @@ -372,8 +377,12 @@ static int des_ede3_wrap(EVP_CIPHER_CTX *ctx, unsigned char *out, memcpy(out + inl + 8, sha1tmp, 8); OPENSSL_cleanse(sha1tmp, SHA_DIGEST_LENGTH); /* Generate random IV */ - if (RAND_bytes(EVP_CIPHER_CTX_iv_noconst(ctx), 8) <= 0) + if (ctx->drbg != NULL) { + if (RAND_DRBG_bytes(ctx->drbg, EVP_CIPHER_CTX_iv_noconst(ctx), 8) == 0) + return -1; + } else if (RAND_bytes(EVP_CIPHER_CTX_iv_noconst(ctx), 8) <= 0) { return -1; + } memcpy(out, EVP_CIPHER_CTX_iv_noconst(ctx), 8); /* Encrypt everything after IV in place */ des_ede_cbc_cipher(ctx, out + 8, out + 8, inl + 8); diff --git a/crypto/evp/evp_enc.c b/crypto/evp/evp_enc.c index 2c4a2db6..3176c615 100644 --- a/crypto/evp/evp_enc.c +++ b/crypto/evp/evp_enc.c @@ -15,6 +15,7 @@ #include #include #include "internal/evp_int.h" +#include "internal/rand.h" #include "evp_locl.h" int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *c) @@ -577,6 +578,15 @@ int EVP_CIPHER_CTX_set_padding(EVP_CIPHER_CTX *ctx, int pad) int EVP_CIPHER_CTX_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr) { int ret; + + if (type == EVP_CTRL_GET_DRBG) { + *(RAND_DRBG **)ptr = ctx->drbg; + return 1; + } + if (type == EVP_CTRL_SET_DRBG) { + ctx->drbg = ptr; + return 1; + } if (!ctx->cipher) { EVPerr(EVP_F_EVP_CIPHER_CTX_CTRL, EVP_R_NO_CIPHER_SET); return 0; @@ -600,8 +610,12 @@ int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key) { if (ctx->cipher->flags & EVP_CIPH_RAND_KEY) return EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_RAND_KEY, 0, key); - if (RAND_bytes(key, ctx->key_len) <= 0) + if (ctx->drbg) { + if (RAND_DRBG_bytes(ctx->drbg, key, ctx->key_len) == 0) + return 0; + } else if (RAND_bytes(key, ctx->key_len) <= 0) { return 0; + } return 1; } diff --git a/crypto/evp/evp_locl.h b/crypto/evp/evp_locl.h index 209577b7..82b9433f 100644 --- a/crypto/evp/evp_locl.h +++ b/crypto/evp/evp_locl.h @@ -39,6 +39,7 @@ struct evp_cipher_ctx_st { int final_used; int block_mask; unsigned char final[EVP_MAX_BLOCK_LENGTH]; /* possible final block */ + RAND_DRBG *drbg; } /* EVP_CIPHER_CTX */ ; int PKCS5_v2_PBKDF2_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, diff --git a/crypto/evp/p_seal.c b/crypto/evp/p_seal.c index 50ea6023..3b79dab8 100644 --- a/crypto/evp/p_seal.c +++ b/crypto/evp/p_seal.c @@ -14,6 +14,8 @@ #include #include #include +#include +#include "evp_locl.h" int EVP_SealInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type, unsigned char **ek, int *ekl, unsigned char *iv, @@ -31,9 +33,14 @@ int EVP_SealInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type, return 1; if (EVP_CIPHER_CTX_rand_key(ctx, key) <= 0) return 0; - if (EVP_CIPHER_CTX_iv_length(ctx) - && RAND_bytes(iv, EVP_CIPHER_CTX_iv_length(ctx)) <= 0) - return 0; + if (EVP_CIPHER_CTX_iv_length(ctx)) { + if (ctx->drbg) { + if (RAND_DRBG_bytes(ctx->drbg, iv, EVP_CIPHER_CTX_iv_length(ctx)) == 0) + return 0; + } else if (RAND_bytes(iv, EVP_CIPHER_CTX_iv_length(ctx)) <= 0) { + return 0; + } + } if (!EVP_EncryptInit_ex(ctx, NULL, NULL, key, iv)) return 0; diff --git a/crypto/evp/pmeth_lib.c b/crypto/evp/pmeth_lib.c index 2d9f4fc6..d3b81367 100644 --- a/crypto/evp/pmeth_lib.c +++ b/crypto/evp/pmeth_lib.c @@ -51,6 +51,7 @@ static const EVP_PKEY_METHOD *standard_methods[] = { &tls1_prf_pkey_meth, #ifndef OPENSSL_NO_EC &ecx25519_pkey_meth, + &ecx448_pkey_meth, #endif &hkdf_pkey_meth, #ifndef OPENSSL_NO_POLY1305 @@ -61,6 +62,7 @@ static const EVP_PKEY_METHOD *standard_methods[] = { #endif #ifndef OPENSSL_NO_EC &ed25519_pkey_meth, + &ed448_pkey_meth, #endif }; diff --git a/crypto/include/internal/asn1_int.h b/crypto/include/internal/asn1_int.h index 90d525aa..664d4d69 100644 --- a/crypto/include/internal/asn1_int.h +++ b/crypto/include/internal/asn1_int.h @@ -68,7 +68,9 @@ extern const EVP_PKEY_ASN1_METHOD dhx_asn1_meth; extern const EVP_PKEY_ASN1_METHOD dsa_asn1_meths[5]; extern const EVP_PKEY_ASN1_METHOD eckey_asn1_meth; extern const EVP_PKEY_ASN1_METHOD ecx25519_asn1_meth; +extern const EVP_PKEY_ASN1_METHOD ecx448_asn1_meth; extern const EVP_PKEY_ASN1_METHOD ed25519_asn1_meth; +extern const EVP_PKEY_ASN1_METHOD ed448_asn1_meth; extern const EVP_PKEY_ASN1_METHOD poly1305_asn1_meth; extern const EVP_PKEY_ASN1_METHOD hmac_asn1_meth; diff --git a/crypto/include/internal/evp_int.h b/crypto/include/internal/evp_int.h index a838a2a3..77c87313 100644 --- a/crypto/include/internal/evp_int.h +++ b/crypto/include/internal/evp_int.h @@ -90,7 +90,9 @@ extern const EVP_PKEY_METHOD dhx_pkey_meth; extern const EVP_PKEY_METHOD dsa_pkey_meth; extern const EVP_PKEY_METHOD ec_pkey_meth; extern const EVP_PKEY_METHOD ecx25519_pkey_meth; +extern const EVP_PKEY_METHOD ecx448_pkey_meth; extern const EVP_PKEY_METHOD ed25519_pkey_meth; +extern const EVP_PKEY_METHOD ed448_pkey_meth; extern const EVP_PKEY_METHOD hmac_pkey_meth; extern const EVP_PKEY_METHOD rsa_pkey_meth; extern const EVP_PKEY_METHOD rsa_pss_pkey_meth; @@ -361,6 +363,21 @@ const EVP_CIPHER *EVP_##cname##_ecb(void) { return &cname##_ecb; } cipher##_init_key, NULL, NULL, NULL, NULL) +# ifndef OPENSSL_NO_EC + +#define X25519_KEYLEN 32 +#define X448_KEYLEN 56 +#define ED448_KEYLEN 57 + +#define MAX_KEYLEN ED448_KEYLEN + +typedef struct { + unsigned char pubkey[MAX_KEYLEN]; + unsigned char *privkey; +} ECX_KEY; + +#endif + /* * Type needs to be a bit field Sub-type needs to be for variations on the * method, as in, can it do arbitrary encryption.... @@ -385,6 +402,7 @@ struct evp_pkey_st { # endif # ifndef OPENSSL_NO_EC struct ec_key_st *ec; /* ECC */ + ECX_KEY *ecx; /* X25519, X448, Ed25519, Ed448 */ # endif } pkey; int save_parameters; diff --git a/crypto/md5/asm/md5-x86_64.pl b/crypto/md5/asm/md5-x86_64.pl old mode 100755 new mode 100644 diff --git a/crypto/mem.c b/crypto/mem.c index b3f7a1fa..33644678 100644 --- a/crypto/mem.c +++ b/crypto/mem.c @@ -201,7 +201,14 @@ void *CRYPTO_malloc(size_t num, const char *file, int line) return NULL; FAILTEST(); - allow_customize = 0; + if (allow_customize) { + /* + * Disallow customization after the first allocation. We only set this + * if necessary to avoid a store to the same cache line on every + * allocation. + */ + allow_customize = 0; + } #ifndef OPENSSL_NO_CRYPTO_MDEBUG if (call_malloc_debug) { CRYPTO_mem_debug_malloc(NULL, num, 0, file, line); @@ -243,7 +250,6 @@ void *CRYPTO_realloc(void *str, size_t num, const char *file, int line) return NULL; } - allow_customize = 0; #ifndef OPENSSL_NO_CRYPTO_MDEBUG if (call_malloc_debug) { void *ret; diff --git a/crypto/mem_sec.c b/crypto/mem_sec.c index 77bf165f..1c132703 100644 --- a/crypto/mem_sec.c +++ b/crypto/mem_sec.c @@ -33,8 +33,10 @@ # include # if defined(OPENSSL_SYS_LINUX) # include -# include -# include +# if defined(SYS_mlock2) +# include +# include +# endif # endif # include # include @@ -45,6 +47,9 @@ #ifndef PAGE_SIZE # define PAGE_SIZE 4096 #endif +#if !defined(MAP_ANON) && defined(MAP_ANONYMOUS) +# define MAP_ANON MAP_ANONYMOUS +#endif #ifdef IMPLEMENTED static size_t secure_mem_used; diff --git a/crypto/modes/asm/ghash-ia64.pl b/crypto/modes/asm/ghash-ia64.pl old mode 100755 new mode 100644 diff --git a/crypto/modes/asm/ghashp8-ppc.pl b/crypto/modes/asm/ghashp8-ppc.pl old mode 100755 new mode 100644 diff --git a/crypto/objects/obj_dat.c b/crypto/objects/obj_dat.c index 06a3fb34..f4412f66 100644 --- a/crypto/objects/obj_dat.c +++ b/crypto/objects/obj_dat.c @@ -213,7 +213,7 @@ int OBJ_add_object(const ASN1_OBJECT *obj) err: for (i = ADDED_DATA; i <= ADDED_NID; i++) OPENSSL_free(ao[i]); - OPENSSL_free(o); + ASN1_OBJECT_free(o); return NID_undef; } diff --git a/crypto/objects/obj_dat.h b/crypto/objects/obj_dat.h index 61b12bf0..8aa6b8b4 100644 --- a/crypto/objects/obj_dat.h +++ b/crypto/objects/obj_dat.h @@ -10,7 +10,7 @@ */ /* Serialized OID's */ -static const unsigned char so[7342] = { +static const unsigned char so[7595] = { 0x2A,0x86,0x48,0x86,0xF7,0x0D, /* [ 0] OBJ_rsadsi */ 0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01, /* [ 6] OBJ_pkcs */ 0x2A,0x86,0x48,0x86,0xF7,0x0D,0x02,0x02, /* [ 13] OBJ_md2 */ @@ -1032,9 +1032,32 @@ static const unsigned char so[7342] = { 0x2A,0x81,0x1C,0xCF,0x55,0x01,0x83,0x78, /* [ 7315] OBJ_sm3WithRSAEncryption */ 0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01,0x01,0x0F, /* [ 7323] OBJ_sha512_224WithRSAEncryption */ 0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01,0x01,0x10, /* [ 7332] OBJ_sha512_256WithRSAEncryption */ + 0x2A,0x85,0x03,0x07,0x01,0x02,0x01,0x01, /* [ 7341] OBJ_id_tc26_gost_3410_2012_256_constants */ + 0x2A,0x85,0x03,0x07,0x01,0x02,0x01,0x01,0x01, /* [ 7349] OBJ_id_tc26_gost_3410_2012_256_paramSetA */ + 0x2A,0x85,0x03,0x07,0x01,0x02,0x01,0x02,0x03, /* [ 7358] OBJ_id_tc26_gost_3410_2012_512_paramSetC */ + 0x2A,0x86,0x24, /* [ 7367] OBJ_ISO_UA */ + 0x2A,0x86,0x24,0x02,0x01,0x01,0x01, /* [ 7370] OBJ_ua_pki */ + 0x2A,0x86,0x24,0x02,0x01,0x01,0x01,0x01,0x01,0x01, /* [ 7377] OBJ_dstu28147 */ + 0x2A,0x86,0x24,0x02,0x01,0x01,0x01,0x01,0x01,0x01,0x02, /* [ 7387] OBJ_dstu28147_ofb */ + 0x2A,0x86,0x24,0x02,0x01,0x01,0x01,0x01,0x01,0x01,0x03, /* [ 7398] OBJ_dstu28147_cfb */ + 0x2A,0x86,0x24,0x02,0x01,0x01,0x01,0x01,0x01,0x01,0x05, /* [ 7409] OBJ_dstu28147_wrap */ + 0x2A,0x86,0x24,0x02,0x01,0x01,0x01,0x01,0x01,0x02, /* [ 7420] OBJ_hmacWithDstu34311 */ + 0x2A,0x86,0x24,0x02,0x01,0x01,0x01,0x01,0x02,0x01, /* [ 7430] OBJ_dstu34311 */ + 0x2A,0x86,0x24,0x02,0x01,0x01,0x01,0x01,0x03,0x01,0x01, /* [ 7440] OBJ_dstu4145le */ + 0x2A,0x86,0x24,0x02,0x01,0x01,0x01,0x01,0x03,0x01,0x01,0x01,0x01, /* [ 7451] OBJ_dstu4145be */ + 0x2A,0x86,0x24,0x02,0x01,0x01,0x01,0x01,0x03,0x01,0x01,0x02,0x00, /* [ 7464] OBJ_uacurve0 */ + 0x2A,0x86,0x24,0x02,0x01,0x01,0x01,0x01,0x03,0x01,0x01,0x02,0x01, /* [ 7477] OBJ_uacurve1 */ + 0x2A,0x86,0x24,0x02,0x01,0x01,0x01,0x01,0x03,0x01,0x01,0x02,0x02, /* [ 7490] OBJ_uacurve2 */ + 0x2A,0x86,0x24,0x02,0x01,0x01,0x01,0x01,0x03,0x01,0x01,0x02,0x03, /* [ 7503] OBJ_uacurve3 */ + 0x2A,0x86,0x24,0x02,0x01,0x01,0x01,0x01,0x03,0x01,0x01,0x02,0x04, /* [ 7516] OBJ_uacurve4 */ + 0x2A,0x86,0x24,0x02,0x01,0x01,0x01,0x01,0x03,0x01,0x01,0x02,0x05, /* [ 7529] OBJ_uacurve5 */ + 0x2A,0x86,0x24,0x02,0x01,0x01,0x01,0x01,0x03,0x01,0x01,0x02,0x06, /* [ 7542] OBJ_uacurve6 */ + 0x2A,0x86,0x24,0x02,0x01,0x01,0x01,0x01,0x03,0x01,0x01,0x02,0x07, /* [ 7555] OBJ_uacurve7 */ + 0x2A,0x86,0x24,0x02,0x01,0x01,0x01,0x01,0x03,0x01,0x01,0x02,0x08, /* [ 7568] OBJ_uacurve8 */ + 0x2A,0x86,0x24,0x02,0x01,0x01,0x01,0x01,0x03,0x01,0x01,0x02,0x09, /* [ 7581] OBJ_uacurve9 */ }; -#define NUM_NID 1147 +#define NUM_NID 1170 static const ASN1_OBJECT nid_objs[NUM_NID] = { {"UNDEF", "undefined", NID_undef}, {"rsadsi", "RSA Data Security, Inc.", NID_rsadsi, 6, &so[0]}, @@ -2183,9 +2206,32 @@ static const ASN1_OBJECT nid_objs[NUM_NID] = { {"RSA-SM3", "sm3WithRSAEncryption", NID_sm3WithRSAEncryption, 8, &so[7315]}, {"RSA-SHA512/224", "sha512-224WithRSAEncryption", NID_sha512_224WithRSAEncryption, 9, &so[7323]}, {"RSA-SHA512/256", "sha512-256WithRSAEncryption", NID_sha512_256WithRSAEncryption, 9, &so[7332]}, + {"id-tc26-gost-3410-2012-256-constants", "id-tc26-gost-3410-2012-256-constants", NID_id_tc26_gost_3410_2012_256_constants, 8, &so[7341]}, + {"id-tc26-gost-3410-2012-256-paramSetA", "GOST R 34.10-2012 (256 bit) ParamSet A", NID_id_tc26_gost_3410_2012_256_paramSetA, 9, &so[7349]}, + {"id-tc26-gost-3410-2012-512-paramSetC", "GOST R 34.10-2012 (512 bit) ParamSet C", NID_id_tc26_gost_3410_2012_512_paramSetC, 9, &so[7358]}, + {"ISO-UA", "ISO-UA", NID_ISO_UA, 3, &so[7367]}, + {"ua-pki", "ua-pki", NID_ua_pki, 7, &so[7370]}, + {"dstu28147", "DSTU Gost 28147-2009", NID_dstu28147, 10, &so[7377]}, + {"dstu28147-ofb", "DSTU Gost 28147-2009 OFB mode", NID_dstu28147_ofb, 11, &so[7387]}, + {"dstu28147-cfb", "DSTU Gost 28147-2009 CFB mode", NID_dstu28147_cfb, 11, &so[7398]}, + {"dstu28147-wrap", "DSTU Gost 28147-2009 key wrap", NID_dstu28147_wrap, 11, &so[7409]}, + {"hmacWithDstu34311", "HMAC DSTU Gost 34311-95", NID_hmacWithDstu34311, 10, &so[7420]}, + {"dstu34311", "DSTU Gost 34311-95", NID_dstu34311, 10, &so[7430]}, + {"dstu4145le", "DSTU 4145-2002 little endian", NID_dstu4145le, 11, &so[7440]}, + {"dstu4145be", "DSTU 4145-2002 big endian", NID_dstu4145be, 13, &so[7451]}, + {"uacurve0", "DSTU curve 0", NID_uacurve0, 13, &so[7464]}, + {"uacurve1", "DSTU curve 1", NID_uacurve1, 13, &so[7477]}, + {"uacurve2", "DSTU curve 2", NID_uacurve2, 13, &so[7490]}, + {"uacurve3", "DSTU curve 3", NID_uacurve3, 13, &so[7503]}, + {"uacurve4", "DSTU curve 4", NID_uacurve4, 13, &so[7516]}, + {"uacurve5", "DSTU curve 5", NID_uacurve5, 13, &so[7529]}, + {"uacurve6", "DSTU curve 6", NID_uacurve6, 13, &so[7542]}, + {"uacurve7", "DSTU curve 7", NID_uacurve7, 13, &so[7555]}, + {"uacurve8", "DSTU curve 8", NID_uacurve8, 13, &so[7568]}, + {"uacurve9", "DSTU curve 9", NID_uacurve9, 13, &so[7581]}, }; -#define NUM_SN 1138 +#define NUM_SN 1161 static const unsigned int sn_objs[NUM_SN] = { 364, /* "AD_DVCS" */ 419, /* "AES-128-CBC" */ @@ -2345,6 +2391,7 @@ static const unsigned int sn_objs[NUM_SN] = { 1004, /* "INN" */ 181, /* "ISO" */ 1140, /* "ISO-CN" */ + 1150, /* "ISO-UA" */ 183, /* "ISO-US" */ 645, /* "ITU-T" */ 646, /* "JOINT-ISO-ITU-T" */ @@ -2605,6 +2652,13 @@ static const unsigned int sn_objs[NUM_SN] = { 452, /* "domainRelatedObject" */ 802, /* "dsa_with_SHA224" */ 803, /* "dsa_with_SHA256" */ + 1152, /* "dstu28147" */ + 1154, /* "dstu28147-cfb" */ + 1153, /* "dstu28147-ofb" */ + 1155, /* "dstu28147-wrap" */ + 1157, /* "dstu34311" */ + 1159, /* "dstu4145be" */ + 1158, /* "dstu4145le" */ 791, /* "ecdsa-with-Recommended" */ 416, /* "ecdsa-with-SHA1" */ 793, /* "ecdsa-with-SHA224" */ @@ -2653,6 +2707,7 @@ static const unsigned int sn_objs[NUM_SN] = { 1012, /* "grasshopper-ecb" */ 1017, /* "grasshopper-mac" */ 1014, /* "grasshopper-ofb" */ + 1156, /* "hmacWithDstu34311" */ 797, /* "hmacWithMD5" */ 163, /* "hmacWithSHA1" */ 798, /* "hmacWithSHA224" */ @@ -2940,9 +2995,12 @@ static const unsigned int sn_objs[NUM_SN] = { 1000, /* "id-tc26-digest-constants" */ 1002, /* "id-tc26-gost-28147-constants" */ 1003, /* "id-tc26-gost-28147-param-Z" */ + 1147, /* "id-tc26-gost-3410-2012-256-constants" */ + 1148, /* "id-tc26-gost-3410-2012-256-paramSetA" */ 996, /* "id-tc26-gost-3410-2012-512-constants" */ 998, /* "id-tc26-gost-3410-2012-512-paramSetA" */ 999, /* "id-tc26-gost-3410-2012-512-paramSetB" */ + 1149, /* "id-tc26-gost-3410-2012-512-paramSetC" */ 997, /* "id-tc26-gost-3410-2012-512-paramSetTest" */ 988, /* "id-tc26-hmac-gost-3411-2012-256" */ 989, /* "id-tc26-hmac-gost-3411-2012-512" */ @@ -3297,6 +3355,17 @@ static const unsigned int sn_objs[NUM_SN] = { 1020, /* "tlsfeature" */ 682, /* "tpBasis" */ 375, /* "trustRoot" */ + 1151, /* "ua-pki" */ + 1160, /* "uacurve0" */ + 1161, /* "uacurve1" */ + 1162, /* "uacurve2" */ + 1163, /* "uacurve3" */ + 1164, /* "uacurve4" */ + 1165, /* "uacurve5" */ + 1166, /* "uacurve6" */ + 1167, /* "uacurve7" */ + 1168, /* "uacurve8" */ + 1169, /* "uacurve9" */ 436, /* "ucl" */ 102, /* "uid" */ 888, /* "uniqueMember" */ @@ -3327,7 +3396,7 @@ static const unsigned int sn_objs[NUM_SN] = { 1093, /* "x509ExtAdmission" */ }; -#define NUM_LN 1138 +#define NUM_LN 1161 static const unsigned int ln_objs[NUM_LN] = { 363, /* "AD Time Stamping" */ 405, /* "ANSI X9.62" */ @@ -3348,6 +3417,23 @@ static const unsigned int ln_objs[NUM_LN] = { 131, /* "Code Signing" */ 1024, /* "Ctrl/Provision WAP Termination" */ 1023, /* "Ctrl/provision WAP Access" */ + 1159, /* "DSTU 4145-2002 big endian" */ + 1158, /* "DSTU 4145-2002 little endian" */ + 1152, /* "DSTU Gost 28147-2009" */ + 1154, /* "DSTU Gost 28147-2009 CFB mode" */ + 1153, /* "DSTU Gost 28147-2009 OFB mode" */ + 1155, /* "DSTU Gost 28147-2009 key wrap" */ + 1157, /* "DSTU Gost 34311-95" */ + 1160, /* "DSTU curve 0" */ + 1161, /* "DSTU curve 1" */ + 1162, /* "DSTU curve 2" */ + 1163, /* "DSTU curve 3" */ + 1164, /* "DSTU curve 4" */ + 1165, /* "DSTU curve 5" */ + 1166, /* "DSTU curve 6" */ + 1167, /* "DSTU curve 7" */ + 1168, /* "DSTU curve 8" */ + 1169, /* "DSTU curve 9" */ 783, /* "Diffie-Hellman based MAC" */ 382, /* "Directory" */ 392, /* "Domain" */ @@ -3366,8 +3452,10 @@ static const unsigned int ln_objs[NUM_LN] = { 850, /* "GOST 34.10-94 Cryptocom" */ 811, /* "GOST R 34.10-2001" */ 817, /* "GOST R 34.10-2001 DH" */ + 1148, /* "GOST R 34.10-2012 (256 bit) ParamSet A" */ 998, /* "GOST R 34.10-2012 (512 bit) ParamSet A" */ 999, /* "GOST R 34.10-2012 (512 bit) ParamSet B" */ + 1149, /* "GOST R 34.10-2012 (512 bit) ParamSet C" */ 997, /* "GOST R 34.10-2012 (512 bit) testing parameter set" */ 979, /* "GOST R 34.10-2012 with 256 bit modulus" */ 980, /* "GOST R 34.10-2012 with 512 bit modulus" */ @@ -3384,6 +3472,7 @@ static const unsigned int ln_objs[NUM_LN] = { 808, /* "GOST R 34.11-94 with GOST R 34.10-94" */ 852, /* "GOST R 34.11-94 with GOST R 34.10-94 Cryptocom" */ 854, /* "GOST R 3410-2001 Parameter Set Cryptocom" */ + 1156, /* "HMAC DSTU Gost 34311-95" */ 988, /* "HMAC GOST 34.11-2012 256 bit" */ 989, /* "HMAC GOST 34.11-2012 512 bit" */ 810, /* "HMAC GOST 34.11-94" */ @@ -3399,6 +3488,7 @@ static const unsigned int ln_objs[NUM_LN] = { 1140, /* "ISO CN Member Body" */ 182, /* "ISO Member Body" */ 183, /* "ISO US Member Body" */ + 1150, /* "ISO-UA" */ 667, /* "Independent" */ 665, /* "Inherit all" */ 647, /* "International Organizations" */ @@ -4056,6 +4146,7 @@ static const unsigned int ln_objs[NUM_LN] = { 981, /* "id-tc26-digest" */ 1000, /* "id-tc26-digest-constants" */ 1002, /* "id-tc26-gost-28147-constants" */ + 1147, /* "id-tc26-gost-3410-2012-256-constants" */ 996, /* "id-tc26-gost-3410-2012-512-constants" */ 987, /* "id-tc26-mac" */ 978, /* "id-tc26-sign" */ @@ -4437,6 +4528,7 @@ static const unsigned int ln_objs[NUM_LN] = { 106, /* "title" */ 1021, /* "tls1-prf" */ 682, /* "tpBasis" */ + 1151, /* "ua-pki" */ 436, /* "ucl" */ 0, /* "undefined" */ 102, /* "uniqueIdentifier" */ @@ -4469,7 +4561,7 @@ static const unsigned int ln_objs[NUM_LN] = { 125, /* "zlib compression" */ }; -#define NUM_OBJ 1027 +#define NUM_OBJ 1050 static const unsigned int obj_objs[NUM_OBJ] = { 0, /* OBJ_undef 0 */ 181, /* OBJ_iso 1 */ @@ -4491,6 +4583,7 @@ static const unsigned int obj_objs[NUM_OBJ] = { 678, /* OBJ_wap 2 23 43 */ 435, /* OBJ_pss 0 9 2342 */ 1140, /* OBJ_ISO_CN 1 2 156 */ + 1150, /* OBJ_ISO_UA 1 2 804 */ 183, /* OBJ_ISO_US 1 2 840 */ 381, /* OBJ_iana 1 3 6 1 */ 1034, /* OBJ_X25519 1 3 101 110 */ @@ -4869,6 +4962,7 @@ static const unsigned int obj_objs[NUM_OBJ] = { 995, /* OBJ_id_tc26_sign_constants 1 2 643 7 1 2 1 */ 1000, /* OBJ_id_tc26_digest_constants 1 2 643 7 1 2 2 */ 1001, /* OBJ_id_tc26_cipher_constants 1 2 643 7 1 2 5 */ + 1151, /* OBJ_ua_pki 1 2 804 2 1 1 1 */ 2, /* OBJ_pkcs 1 2 840 113549 1 */ 431, /* OBJ_hold_instruction_none 1 2 840 10040 2 1 */ 432, /* OBJ_hold_instruction_call_issuer 1 2 840 10040 2 2 */ @@ -4954,6 +5048,7 @@ static const unsigned int obj_objs[NUM_OBJ] = { 989, /* OBJ_id_tc26_hmac_gost_3411_2012_512 1 2 643 7 1 1 4 2 */ 992, /* OBJ_id_tc26_agreement_gost_3410_2012_256 1 2 643 7 1 1 6 1 */ 993, /* OBJ_id_tc26_agreement_gost_3410_2012_512 1 2 643 7 1 1 6 2 */ + 1147, /* OBJ_id_tc26_gost_3410_2012_256_constants 1 2 643 7 1 2 1 1 */ 996, /* OBJ_id_tc26_gost_3410_2012_512_constants 1 2 643 7 1 2 1 2 */ 1002, /* OBJ_id_tc26_gost_28147_constants 1 2 643 7 1 2 5 1 */ 186, /* OBJ_pkcs1 1 2 840 113549 1 1 */ @@ -5156,9 +5251,11 @@ static const unsigned int obj_objs[NUM_OBJ] = { 1120, /* OBJ_aria_128_ccm 1 2 410 200046 1 1 37 */ 1121, /* OBJ_aria_192_ccm 1 2 410 200046 1 1 38 */ 1122, /* OBJ_aria_256_ccm 1 2 410 200046 1 1 39 */ + 1148, /* OBJ_id_tc26_gost_3410_2012_256_paramSetA 1 2 643 7 1 2 1 1 1 */ 997, /* OBJ_id_tc26_gost_3410_2012_512_paramSetTest 1 2 643 7 1 2 1 2 0 */ 998, /* OBJ_id_tc26_gost_3410_2012_512_paramSetA 1 2 643 7 1 2 1 2 1 */ 999, /* OBJ_id_tc26_gost_3410_2012_512_paramSetB 1 2 643 7 1 2 1 2 2 */ + 1149, /* OBJ_id_tc26_gost_3410_2012_512_paramSetC 1 2 643 7 1 2 1 2 3 */ 1003, /* OBJ_id_tc26_gost_28147_param_Z 1 2 643 7 1 2 5 1 1 */ 108, /* OBJ_cast5_cbc 1 2 840 113533 7 66 10 */ 112, /* OBJ_pbeWithMD5AndCast5_CBC 1 2 840 113533 7 66 12 */ @@ -5383,6 +5480,9 @@ static const unsigned int obj_objs[NUM_OBJ] = { 455, /* OBJ_pilotOrganization 0 9 2342 19200300 100 4 20 */ 456, /* OBJ_pilotDSA 0 9 2342 19200300 100 4 21 */ 457, /* OBJ_qualityLabelledData 0 9 2342 19200300 100 4 22 */ + 1152, /* OBJ_dstu28147 1 2 804 2 1 1 1 1 1 1 */ + 1156, /* OBJ_hmacWithDstu34311 1 2 804 2 1 1 1 1 1 2 */ + 1157, /* OBJ_dstu34311 1 2 804 2 1 1 1 1 2 1 */ 189, /* OBJ_id_smime_mod 1 2 840 113549 1 9 16 0 */ 190, /* OBJ_id_smime_ct 1 2 840 113549 1 9 16 1 */ 191, /* OBJ_id_smime_aa 1 2 840 113549 1 9 16 2 */ @@ -5417,6 +5517,10 @@ static const unsigned int obj_objs[NUM_OBJ] = { 907, /* OBJ_id_camellia128_wrap 1 2 392 200011 61 1 1 3 2 */ 908, /* OBJ_id_camellia192_wrap 1 2 392 200011 61 1 1 3 3 */ 909, /* OBJ_id_camellia256_wrap 1 2 392 200011 61 1 1 3 4 */ + 1153, /* OBJ_dstu28147_ofb 1 2 804 2 1 1 1 1 1 1 2 */ + 1154, /* OBJ_dstu28147_cfb 1 2 804 2 1 1 1 1 1 1 3 */ + 1155, /* OBJ_dstu28147_wrap 1 2 804 2 1 1 1 1 1 1 5 */ + 1158, /* OBJ_dstu4145le 1 2 804 2 1 1 1 1 3 1 1 */ 196, /* OBJ_id_smime_mod_cms 1 2 840 113549 1 9 16 0 1 */ 197, /* OBJ_id_smime_mod_ess 1 2 840 113549 1 9 16 0 2 */ 198, /* OBJ_id_smime_mod_oid 1 2 840 113549 1 9 16 0 3 */ @@ -5498,4 +5602,15 @@ static const unsigned int obj_objs[NUM_OBJ] = { 957, /* OBJ_jurisdictionCountryName 1 3 6 1 4 1 311 60 2 1 3 */ 1056, /* OBJ_blake2b512 1 3 6 1 4 1 1722 12 2 1 16 */ 1057, /* OBJ_blake2s256 1 3 6 1 4 1 1722 12 2 2 8 */ + 1159, /* OBJ_dstu4145be 1 2 804 2 1 1 1 1 3 1 1 1 1 */ + 1160, /* OBJ_uacurve0 1 2 804 2 1 1 1 1 3 1 1 2 0 */ + 1161, /* OBJ_uacurve1 1 2 804 2 1 1 1 1 3 1 1 2 1 */ + 1162, /* OBJ_uacurve2 1 2 804 2 1 1 1 1 3 1 1 2 2 */ + 1163, /* OBJ_uacurve3 1 2 804 2 1 1 1 1 3 1 1 2 3 */ + 1164, /* OBJ_uacurve4 1 2 804 2 1 1 1 1 3 1 1 2 4 */ + 1165, /* OBJ_uacurve5 1 2 804 2 1 1 1 1 3 1 1 2 5 */ + 1166, /* OBJ_uacurve6 1 2 804 2 1 1 1 1 3 1 1 2 6 */ + 1167, /* OBJ_uacurve7 1 2 804 2 1 1 1 1 3 1 1 2 7 */ + 1168, /* OBJ_uacurve8 1 2 804 2 1 1 1 1 3 1 1 2 8 */ + 1169, /* OBJ_uacurve9 1 2 804 2 1 1 1 1 3 1 1 2 9 */ }; diff --git a/crypto/objects/obj_dat.pl b/crypto/objects/obj_dat.pl index 392617c0..e80900d0 100644 --- a/crypto/objects/obj_dat.pl +++ b/crypto/objects/obj_dat.pl @@ -152,8 +152,7 @@ for (my $i = 0; $i < $n; $i++) { } # Finally ready to generate the output. -open(OUT, ">$ARGV[1]") || die "Can't open output file $ARGV[1], $!"; -print OUT <<"EOF"; +print <<"EOF"; /* * WARNING: do not edit! * Generated by crypto/objects/obj_dat.pl @@ -167,44 +166,44 @@ print OUT <<"EOF"; EOF -print OUT "/* Serialized OID's */\n"; -printf OUT "static const unsigned char so[%d] = {\n", $lvalues + 1; -print OUT @lvalues; -print OUT "};\n\n"; +print "/* Serialized OID's */\n"; +printf "static const unsigned char so[%d] = {\n", $lvalues + 1; +print @lvalues; +print "};\n\n"; -printf OUT "#define NUM_NID %d\n", $n; -printf OUT "static const ASN1_OBJECT nid_objs[NUM_NID] = {\n"; -print OUT @out; -print OUT "};\n\n"; +printf "#define NUM_NID %d\n", $n; +printf "static const ASN1_OBJECT nid_objs[NUM_NID] = {\n"; +print @out; +print "};\n\n"; { no warnings "uninitialized"; @a = grep(defined $sn{$nid{$_}}, 0 .. $n); } -printf OUT "#define NUM_SN %d\n", $#a + 1; -printf OUT "static const unsigned int sn_objs[NUM_SN] = {\n"; +printf "#define NUM_SN %d\n", $#a + 1; +printf "static const unsigned int sn_objs[NUM_SN] = {\n"; foreach (sort { $sn{$nid{$a}} cmp $sn{$nid{$b}} } @a) { - printf OUT " %4d, /* \"$sn{$nid{$_}}\" */\n", $_; + printf " %4d, /* \"$sn{$nid{$_}}\" */\n", $_; } -print OUT "};\n\n"; +print "};\n\n"; { no warnings "uninitialized"; @a = grep(defined $ln{$nid{$_}}, 0 .. $n); } -printf OUT "#define NUM_LN %d\n", $#a + 1; -printf OUT "static const unsigned int ln_objs[NUM_LN] = {\n"; +printf "#define NUM_LN %d\n", $#a + 1; +printf "static const unsigned int ln_objs[NUM_LN] = {\n"; foreach (sort { $ln{$nid{$a}} cmp $ln{$nid{$b}} } @a) { - printf OUT " %4d, /* \"$ln{$nid{$_}}\" */\n", $_; + printf " %4d, /* \"$ln{$nid{$_}}\" */\n", $_; } -print OUT "};\n\n"; +print "};\n\n"; { no warnings "uninitialized"; @a = grep(defined $obj{$nid{$_}}, 0 .. $n); } -printf OUT "#define NUM_OBJ %d\n", $#a + 1; -printf OUT "static const unsigned int obj_objs[NUM_OBJ] = {\n"; +printf "#define NUM_OBJ %d\n", $#a + 1; +printf "static const unsigned int obj_objs[NUM_OBJ] = {\n"; # Compare DER; prefer shorter; if some length, use the "smaller" encoding. sub obj_cmp @@ -224,8 +223,6 @@ foreach (sort obj_cmp @a) { my $v = $objd{$m}; $v =~ s/L//g; $v =~ s/,/ /g; - printf OUT " %4d, /* %-32s %s */\n", $_, $m, $v; + printf " %4d, /* %-32s %s */\n", $_, $m, $v; } -print OUT "};\n"; - -close OUT; +print "};\n"; diff --git a/crypto/objects/obj_mac.num b/crypto/objects/obj_mac.num index bef6050a..d1f0a955 100644 --- a/crypto/objects/obj_mac.num +++ b/crypto/objects/obj_mac.num @@ -1144,3 +1144,26 @@ sm3 1143 sm3WithRSAEncryption 1144 sha512_224WithRSAEncryption 1145 sha512_256WithRSAEncryption 1146 +id_tc26_gost_3410_2012_256_constants 1147 +id_tc26_gost_3410_2012_256_paramSetA 1148 +id_tc26_gost_3410_2012_512_paramSetC 1149 +ISO_UA 1150 +ua_pki 1151 +dstu28147 1152 +dstu28147_ofb 1153 +dstu28147_cfb 1154 +dstu28147_wrap 1155 +hmacWithDstu34311 1156 +dstu34311 1157 +dstu4145le 1158 +dstu4145be 1159 +uacurve0 1160 +uacurve1 1161 +uacurve2 1162 +uacurve3 1163 +uacurve4 1164 +uacurve5 1165 +uacurve6 1166 +uacurve7 1167 +uacurve8 1168 +uacurve9 1169 diff --git a/crypto/objects/obj_xref.h b/crypto/objects/obj_xref.h index ebd5bf5a..9606e57d 100644 --- a/crypto/objects/obj_xref.h +++ b/crypto/objects/obj_xref.h @@ -74,6 +74,7 @@ static const nid_triple sigoid_srt[] = { {NID_id_tc26_signwithdigest_gost3410_2012_512, NID_id_GostR3411_2012_512, NID_id_GostR3410_2012_512}, {NID_ED25519, NID_undef, NID_ED25519}, + {NID_ED448, NID_undef, NID_ED448}, {NID_RSA_SHA3_224, NID_sha3_224, NID_rsaEncryption}, {NID_RSA_SHA3_256, NID_sha3_256, NID_rsaEncryption}, {NID_RSA_SHA3_384, NID_sha3_384, NID_rsaEncryption}, @@ -120,8 +121,8 @@ static const nid_triple *const sigoid_srt_xref[] = { &sigoid_srt[28], &sigoid_srt[40], &sigoid_srt[41], - &sigoid_srt[43], &sigoid_srt[44], &sigoid_srt[45], &sigoid_srt[46], + &sigoid_srt[47], }; diff --git a/crypto/objects/obj_xref.txt b/crypto/objects/obj_xref.txt index c8dee7b8..ca3e7446 100644 --- a/crypto/objects/obj_xref.txt +++ b/crypto/objects/obj_xref.txt @@ -22,6 +22,7 @@ RSA_SHA3_512 sha3_512 rsaEncryption # method should handle this explicitly. rsassaPss undef rsaEncryption ED25519 undef ED25519 +ED448 undef ED448 # Alternative deprecated OIDs. By using the older "rsa" OID this # type will be recognized by not normally used. diff --git a/crypto/objects/objects.pl b/crypto/objects/objects.pl index 20f726d4..8f9b67f9 100644 --- a/crypto/objects/objects.pl +++ b/crypto/objects/objects.pl @@ -6,7 +6,12 @@ # in the file LICENSE in the source distribution or at # https://www.openssl.org/source/license.html -# Output year depends on the year of the script and the input files. +use Getopt::Std; + +our($opt_n); +getopts('n'); + +# Output year depends on the year of the script and the input file. my $YEAR = [localtime([stat($0)]->[9])]->[5] + 1900; my $iYEAR = [localtime([stat($ARGV[0])]->[9])]->[5] + 1900; $YEAR = $iYEAR if $iYEAR > $YEAR; @@ -123,15 +128,15 @@ print STDERR "Added OID $Cname\n"; } close IN; -open (NUMOUT,">$ARGV[1]") || die "Can't open output file $ARGV[1]"; -foreach (sort { $a <=> $b } keys %nidn) - { - print NUMOUT $nidn{$_},"\t\t",$_,"\n"; - } -close NUMOUT; +if ( $opt_n ) { + foreach (sort { $a <=> $b } keys %nidn) + { + print $nidn{$_},"\t\t",$_,"\n"; + } + exit; +} -open (OUT,">$ARGV[2]") || die "Can't open output file $ARGV[2]"; -print OUT <<"EOF"; +print <<"EOF"; /* * WARNING: do not edit! * Generated by crypto/objects/objects.pl @@ -161,15 +166,13 @@ sub expand foreach (sort { $a <=> $b } keys %ordern) { $Cname=$ordern{$_}; - print OUT "\n"; - print OUT expand("#define SN_$Cname\t\t\"$sn{$Cname}\"\n") if $sn{$Cname} ne ""; - print OUT expand("#define LN_$Cname\t\t\"$ln{$Cname}\"\n") if $ln{$Cname} ne ""; - print OUT expand("#define NID_$Cname\t\t$nid{$Cname}\n") if $nid{$Cname} ne ""; - print OUT expand("#define OBJ_$Cname\t\t$obj{$Cname}\n") if $obj{$Cname} ne ""; + print "\n"; + print expand("#define SN_$Cname\t\t\"$sn{$Cname}\"\n") if $sn{$Cname} ne ""; + print expand("#define LN_$Cname\t\t\"$ln{$Cname}\"\n") if $ln{$Cname} ne ""; + print expand("#define NID_$Cname\t\t$nid{$Cname}\n") if $nid{$Cname} ne ""; + print expand("#define OBJ_$Cname\t\t$obj{$Cname}\n") if $obj{$Cname} ne ""; } -close OUT; - sub process_oid { local($oid)=@_; diff --git a/crypto/objects/objects.txt b/crypto/objects/objects.txt index 74550be2..be200bc5 100644 --- a/crypto/objects/objects.txt +++ b/crypto/objects/objects.txt @@ -1337,10 +1337,13 @@ id-tc26-agreement 2 : id-tc26-agreement-gost-3410-2012-512 id-tc26 2 : id-tc26-constants id-tc26-constants 1 : id-tc26-sign-constants +id-tc26-sign-constants 1: id-tc26-gost-3410-2012-256-constants +id-tc26-gost-3410-2012-256-constants 1 : id-tc26-gost-3410-2012-256-paramSetA: GOST R 34.10-2012 (256 bit) ParamSet A id-tc26-sign-constants 2: id-tc26-gost-3410-2012-512-constants id-tc26-gost-3410-2012-512-constants 0 : id-tc26-gost-3410-2012-512-paramSetTest: GOST R 34.10-2012 (512 bit) testing parameter set id-tc26-gost-3410-2012-512-constants 1 : id-tc26-gost-3410-2012-512-paramSetA: GOST R 34.10-2012 (512 bit) ParamSet A id-tc26-gost-3410-2012-512-constants 2 : id-tc26-gost-3410-2012-512-paramSetB: GOST R 34.10-2012 (512 bit) ParamSet B +id-tc26-gost-3410-2012-512-constants 3 : id-tc26-gost-3410-2012-512-paramSetC: GOST R 34.10-2012 (512 bit) ParamSet C id-tc26-constants 2 : id-tc26-digest-constants id-tc26-constants 5 : id-tc26-cipher-constants @@ -1609,3 +1612,33 @@ id-pkinit 5 : pkInitKDC : Signing KDC Response : ffdhe4096 : ffdhe6144 : ffdhe8192 + +# OIDs for DSTU-4145/DSTU-7564 (http://zakon2.rada.gov.ua/laws/show/z0423-17) + +# DSTU OIDs +member-body 804 : ISO-UA +ISO-UA 2 1 1 1 : ua-pki +ua-pki 1 1 1 : dstu28147 : DSTU Gost 28147-2009 +dstu28147 2 : dstu28147-ofb : DSTU Gost 28147-2009 OFB mode +dstu28147 3 : dstu28147-cfb : DSTU Gost 28147-2009 CFB mode +dstu28147 5 : dstu28147-wrap : DSTU Gost 28147-2009 key wrap + +ua-pki 1 1 2 : hmacWithDstu34311 : HMAC DSTU Gost 34311-95 +ua-pki 1 2 1 : dstu34311 : DSTU Gost 34311-95 + +ua-pki 1 3 1 1 : dstu4145le : DSTU 4145-2002 little endian +dstu4145le 1 1 : dstu4145be : DSTU 4145-2002 big endian + +# 1.2.804. 2.1.1.1 1.3.1.1 .2.6 +# UA ua-pki 4145 le +# DSTU named curves +dstu4145le 2 0 : uacurve0 : DSTU curve 0 +dstu4145le 2 1 : uacurve1 : DSTU curve 1 +dstu4145le 2 2 : uacurve2 : DSTU curve 2 +dstu4145le 2 3 : uacurve3 : DSTU curve 3 +dstu4145le 2 4 : uacurve4 : DSTU curve 4 +dstu4145le 2 5 : uacurve5 : DSTU curve 5 +dstu4145le 2 6 : uacurve6 : DSTU curve 6 +dstu4145le 2 7 : uacurve7 : DSTU curve 7 +dstu4145le 2 8 : uacurve8 : DSTU curve 8 +dstu4145le 2 9 : uacurve9 : DSTU curve 9 diff --git a/crypto/pem/pem_lib.c b/crypto/pem/pem_lib.c index 97b8a0d7..1f0f8d6c 100644 --- a/crypto/pem/pem_lib.c +++ b/crypto/pem/pem_lib.c @@ -722,14 +722,14 @@ static int sanitize_line(char *linebuf, int len, unsigned int flags) static const char beginstr[] = "-----BEGIN "; static const char endstr[] = "-----END "; static const char tailstr[] = "-----\n"; -#define BEGINLEN (sizeof(beginstr) - 1) -#define ENDLEN (sizeof(endstr) - 1) -#define TAILLEN (sizeof(tailstr) - 1) +#define BEGINLEN ((int)(sizeof(beginstr) - 1)) +#define ENDLEN ((int)(sizeof(endstr) - 1)) +#define TAILLEN ((int)(sizeof(tailstr) - 1)) static int get_name(BIO *bp, char **name, unsigned int flags) { char *linebuf; int ret = 0; - size_t len; + int len; /* * Need to hold trailing NUL (accounted for by BIO_gets() and the newline diff --git a/crypto/perlasm/arm-xlate.pl b/crypto/perlasm/arm-xlate.pl old mode 100755 new mode 100644 diff --git a/crypto/perlasm/ppc-xlate.pl b/crypto/perlasm/ppc-xlate.pl old mode 100755 new mode 100644 diff --git a/crypto/perlasm/x86_64-xlate.pl b/crypto/perlasm/x86_64-xlate.pl old mode 100755 new mode 100644 diff --git a/crypto/pkcs7/pk7_doit.c b/crypto/pkcs7/pk7_doit.c index c5baf046..4585031d 100644 --- a/crypto/pkcs7/pk7_doit.c +++ b/crypto/pkcs7/pk7_doit.c @@ -316,16 +316,18 @@ BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio) } if (bio == NULL) { - if (PKCS7_is_detached(p7)) + if (PKCS7_is_detached(p7)) { bio = BIO_new(BIO_s_null()); - else if (os && os->length > 0) + } else if (os && os->length > 0) { bio = BIO_new_mem_buf(os->data, os->length); - if (bio == NULL) { + } else { bio = BIO_new(BIO_s_mem()); if (bio == NULL) goto err; BIO_set_mem_eof_return(bio, 0); } + if (bio == NULL) + goto err; } if (out) BIO_push(out, bio); diff --git a/crypto/poly1305/asm/poly1305-armv4.pl b/crypto/poly1305/asm/poly1305-armv4.pl old mode 100755 new mode 100644 diff --git a/crypto/poly1305/asm/poly1305-armv8.pl b/crypto/poly1305/asm/poly1305-armv8.pl old mode 100755 new mode 100644 diff --git a/crypto/poly1305/asm/poly1305-c64xplus.pl b/crypto/poly1305/asm/poly1305-c64xplus.pl old mode 100755 new mode 100644 diff --git a/crypto/poly1305/asm/poly1305-mips.pl b/crypto/poly1305/asm/poly1305-mips.pl old mode 100755 new mode 100644 diff --git a/crypto/poly1305/asm/poly1305-ppc.pl b/crypto/poly1305/asm/poly1305-ppc.pl old mode 100755 new mode 100644 diff --git a/crypto/poly1305/asm/poly1305-ppcfp.pl b/crypto/poly1305/asm/poly1305-ppcfp.pl old mode 100755 new mode 100644 diff --git a/crypto/poly1305/asm/poly1305-s390x.pl b/crypto/poly1305/asm/poly1305-s390x.pl old mode 100755 new mode 100644 diff --git a/crypto/poly1305/asm/poly1305-sparcv9.pl b/crypto/poly1305/asm/poly1305-sparcv9.pl old mode 100755 new mode 100644 diff --git a/crypto/poly1305/asm/poly1305-x86.pl b/crypto/poly1305/asm/poly1305-x86.pl old mode 100755 new mode 100644 diff --git a/crypto/poly1305/asm/poly1305-x86_64.pl b/crypto/poly1305/asm/poly1305-x86_64.pl old mode 100755 new mode 100644 diff --git a/crypto/ppccpuid.pl b/crypto/ppccpuid.pl old mode 100755 new mode 100644 diff --git a/crypto/rand/drbg_ctr.c b/crypto/rand/drbg_ctr.c index 99cd9976..0496cb0a 100644 --- a/crypto/rand/drbg_ctr.c +++ b/crypto/rand/drbg_ctr.c @@ -366,6 +366,6 @@ int drbg_ctr_init(RAND_DRBG *drbg) } drbg->max_request = 1 << 16; - drbg->reseed_interval = MAX_RESEED_INTERVAL; + return 1; } diff --git a/crypto/rand/drbg_lib.c b/crypto/rand/drbg_lib.c index c43f571d..12070d75 100644 --- a/crypto/rand/drbg_lib.c +++ b/crypto/rand/drbg_lib.c @@ -113,6 +113,12 @@ static const char ossl_pers_string[] = "OpenSSL NIST SP 800-90A DRBG"; static CRYPTO_ONCE rand_drbg_init = CRYPTO_ONCE_STATIC_INIT; +static unsigned int master_reseed_interval = MASTER_RESEED_INTERVAL; +static unsigned int slave_reseed_interval = SLAVE_RESEED_INTERVAL; + +static time_t master_reseed_time_interval = MASTER_RESEED_TIME_INTERVAL; +static time_t slave_reseed_time_interval = SLAVE_RESEED_TIME_INTERVAL; + static RAND_DRBG *drbg_setup(RAND_DRBG *parent); static RAND_DRBG *rand_drbg_new(int secure, @@ -175,9 +181,27 @@ static RAND_DRBG *rand_drbg_new(int secure, drbg->secure = secure && CRYPTO_secure_allocated(drbg); drbg->fork_count = rand_fork_count; drbg->parent = parent; + + if (parent == NULL) { + drbg->reseed_interval = master_reseed_interval; + drbg->reseed_time_interval = master_reseed_time_interval; + } else { + drbg->reseed_interval = slave_reseed_interval; + drbg->reseed_time_interval = slave_reseed_time_interval; + } + if (RAND_DRBG_set(drbg, type, flags) == 0) goto err; + if (parent != NULL && drbg->strength > parent->strength) { + /* + * We currently don't support the algorithm from NIST SP 800-90C + * 10.1.2 to use a weaker DRBG as source + */ + RANDerr(RAND_F_RAND_DRBG_NEW, RAND_R_PARENT_STRENGTH_TOO_WEAK); + goto err; + } + if (!RAND_DRBG_set_callbacks(drbg, rand_drbg_get_entropy, rand_drbg_cleanup_entropy, NULL, NULL)) @@ -701,6 +725,38 @@ int RAND_DRBG_set_reseed_time_interval(RAND_DRBG *drbg, time_t interval) return 1; } +/* + * Set the default values for reseed (time) intervals of new DRBG instances + * + * The default values can be set independently for master DRBG instances + * (without a parent) and slave DRBG instances (with parent). + * + * Returns 1 on success, 0 on failure. + */ + +int RAND_DRBG_set_reseed_defaults( + unsigned int _master_reseed_interval, + unsigned int _slave_reseed_interval, + time_t _master_reseed_time_interval, + time_t _slave_reseed_time_interval + ) +{ + if (_master_reseed_interval > MAX_RESEED_INTERVAL + || _slave_reseed_interval > MAX_RESEED_INTERVAL) + return 0; + + if (_master_reseed_time_interval > MAX_RESEED_TIME_INTERVAL + || _slave_reseed_time_interval > MAX_RESEED_TIME_INTERVAL) + return 0; + + master_reseed_interval = _master_reseed_interval; + slave_reseed_interval = _slave_reseed_interval; + + master_reseed_time_interval = _master_reseed_time_interval; + slave_reseed_time_interval = _slave_reseed_time_interval; + + return 1; +} /* * Locks the given drbg. Locking a drbg which does not have locking @@ -800,14 +856,6 @@ static RAND_DRBG *drbg_setup(RAND_DRBG *parent) if (rand_drbg_enable_locking(drbg) == 0) goto err; - if (parent == NULL) { - drbg->reseed_interval = MASTER_RESEED_INTERVAL; - drbg->reseed_time_interval = MASTER_RESEED_TIME_INTERVAL; - } else { - drbg->reseed_interval = SLAVE_RESEED_INTERVAL; - drbg->reseed_time_interval = SLAVE_RESEED_TIME_INTERVAL; - } - /* enable seed propagation */ drbg->reseed_counter = 1; diff --git a/crypto/rand/rand_err.c b/crypto/rand/rand_err.c index e92c33f4..22467d83 100644 --- a/crypto/rand/rand_err.c +++ b/crypto/rand/rand_err.c @@ -23,6 +23,8 @@ static const ERR_STRING_DATA RAND_str_functs[] = { "rand_drbg_enable_locking"}, {ERR_PACK(ERR_LIB_RAND, RAND_F_RAND_DRBG_GENERATE, 0), "RAND_DRBG_generate"}, + {ERR_PACK(ERR_LIB_RAND, RAND_F_RAND_DRBG_GET_ENTROPY, 0), + "rand_drbg_get_entropy"}, {ERR_PACK(ERR_LIB_RAND, RAND_F_RAND_DRBG_INSTANTIATE, 0), "RAND_DRBG_instantiate"}, {ERR_PACK(ERR_LIB_RAND, RAND_F_RAND_DRBG_NEW, 0), "RAND_DRBG_new"}, @@ -86,6 +88,8 @@ static const ERR_STRING_DATA RAND_str_reasons[] = { "no drbg implementation selected"}, {ERR_PACK(ERR_LIB_RAND, 0, RAND_R_PARENT_LOCKING_NOT_ENABLED), "parent locking not enabled"}, + {ERR_PACK(ERR_LIB_RAND, 0, RAND_R_PARENT_STRENGTH_TOO_WEAK), + "parent strength too weak"}, {ERR_PACK(ERR_LIB_RAND, 0, RAND_R_PERSONALISATION_STRING_TOO_LONG), "personalisation string too long"}, {ERR_PACK(ERR_LIB_RAND, 0, RAND_R_PRNG_NOT_SEEDED), "PRNG not seeded"}, diff --git a/crypto/rand/rand_lib.c b/crypto/rand/rand_lib.c index b8b7b6e8..d3289356 100644 --- a/crypto/rand/rand_lib.c +++ b/crypto/rand/rand_lib.c @@ -176,8 +176,18 @@ size_t rand_drbg_get_entropy(RAND_DRBG *drbg, { size_t ret = 0; size_t entropy_available = 0; - RAND_POOL *pool = RAND_POOL_new(entropy, min_len, max_len); + RAND_POOL *pool; + if (drbg->parent && drbg->strength > drbg->parent->strength) { + /* + * We currently don't support the algorithm from NIST SP 800-90C + * 10.1.2 to use a weaker DRBG as source + */ + RANDerr(RAND_F_RAND_DRBG_GET_ENTROPY, RAND_R_PARENT_STRENGTH_TOO_WEAK); + return 0; + } + + pool = RAND_POOL_new(entropy, min_len, max_len); if (pool == NULL) return 0; diff --git a/crypto/rc4/asm/rc4-c64xplus.pl b/crypto/rc4/asm/rc4-c64xplus.pl index 9f282fe4..8aa3fc4c 100644 --- a/crypto/rc4/asm/rc4-c64xplus.pl +++ b/crypto/rc4/asm/rc4-c64xplus.pl @@ -186,5 +186,7 @@ rc4_options: .align 4 ___ +$output=pop; +open STDOUT,">$output"; print $code; close STDOUT; diff --git a/crypto/rc4/asm/rc4-x86_64.pl b/crypto/rc4/asm/rc4-x86_64.pl old mode 100755 new mode 100644 diff --git a/crypto/rsa/rsa_ameth.c b/crypto/rsa/rsa_ameth.c index 98121b5e..de9e3c10 100644 --- a/crypto/rsa/rsa_ameth.c +++ b/crypto/rsa/rsa_ameth.c @@ -967,7 +967,8 @@ static int rsa_cms_encrypt(CMS_RecipientInfo *ri) int pad_mode = RSA_PKCS1_PADDING, rv = 0, labellen; unsigned char *label; - CMS_RecipientInfo_ktri_get0_algs(ri, NULL, NULL, &alg); + if (CMS_RecipientInfo_ktri_get0_algs(ri, NULL, NULL, &alg) <= 0) + return 0; if (pkctx) { if (EVP_PKEY_CTX_get_rsa_padding(pkctx, &pad_mode) <= 0) return 0; diff --git a/crypto/s390xcpuid.pl b/crypto/s390xcpuid.pl old mode 100755 new mode 100644 diff --git a/crypto/sha/asm/keccak1600-armv4.pl b/crypto/sha/asm/keccak1600-armv4.pl old mode 100755 new mode 100644 index 16d23931..a9ad3cbc --- a/crypto/sha/asm/keccak1600-armv4.pl +++ b/crypto/sha/asm/keccak1600-armv4.pl @@ -1573,6 +1573,9 @@ ___ } } +$output=pop; +open STDOUT,">$output"; + foreach (split($/,$code)) { s/\`([^\`]*)\`/eval $1/ge; diff --git a/crypto/sha/asm/keccak1600-armv8.pl b/crypto/sha/asm/keccak1600-armv8.pl old mode 100755 new mode 100644 diff --git a/crypto/sha/asm/keccak1600-avx2.pl b/crypto/sha/asm/keccak1600-avx2.pl old mode 100755 new mode 100644 index 82ca6728..2a63dd6c --- a/crypto/sha/asm/keccak1600-avx2.pl +++ b/crypto/sha/asm/keccak1600-avx2.pl @@ -476,5 +476,7 @@ iotas: .asciz "Keccak-1600 absorb and squeeze for AVX2, CRYPTOGAMS by " ___ +$output=pop; +open STDOUT,">$output"; print $code; close STDOUT; diff --git a/crypto/sha/asm/keccak1600-avx512.pl b/crypto/sha/asm/keccak1600-avx512.pl old mode 100755 new mode 100644 index 6766f975..bde2aa13 --- a/crypto/sha/asm/keccak1600-avx512.pl +++ b/crypto/sha/asm/keccak1600-avx512.pl @@ -545,5 +545,7 @@ iotas: .asciz "Keccak-1600 absorb and squeeze for AVX-512F, CRYPTOGAMS by " ___ +$output=pop; +open STDOUT,">$output"; print $code; close STDOUT; diff --git a/crypto/sha/asm/keccak1600-avx512vl.pl b/crypto/sha/asm/keccak1600-avx512vl.pl old mode 100755 new mode 100644 index 53f1e847..9c202fba --- a/crypto/sha/asm/keccak1600-avx512vl.pl +++ b/crypto/sha/asm/keccak1600-avx512vl.pl @@ -386,5 +386,7 @@ iotas: .asciz "Keccak-1600 absorb and squeeze for AVX512VL, CRYPTOGAMS by " ___ +$output=pop; +open STDOUT,">$output"; print $code; close STDOUT; diff --git a/crypto/sha/asm/keccak1600-c64x.pl b/crypto/sha/asm/keccak1600-c64x.pl old mode 100755 new mode 100644 index 585f64b7..d13471fa --- a/crypto/sha/asm/keccak1600-c64x.pl +++ b/crypto/sha/asm/keccak1600-c64x.pl @@ -879,4 +879,7 @@ iotas: .align 4 ___ +$output=pop; +open STDOUT,">$output"; print $code; +close STDOUT; diff --git a/crypto/sha/asm/keccak1600-mmx.pl b/crypto/sha/asm/keccak1600-mmx.pl old mode 100755 new mode 100644 diff --git a/crypto/sha/asm/keccak1600-ppc64.pl b/crypto/sha/asm/keccak1600-ppc64.pl old mode 100755 new mode 100644 diff --git a/crypto/sha/asm/keccak1600-s390x.pl b/crypto/sha/asm/keccak1600-s390x.pl old mode 100755 new mode 100644 diff --git a/crypto/sha/asm/keccak1600-x86_64.pl b/crypto/sha/asm/keccak1600-x86_64.pl old mode 100755 new mode 100644 diff --git a/crypto/sha/asm/keccak1600p8-ppc.pl b/crypto/sha/asm/keccak1600p8-ppc.pl old mode 100755 new mode 100644 diff --git a/crypto/sha/asm/sha1-ppc.pl b/crypto/sha/asm/sha1-ppc.pl old mode 100755 new mode 100644 diff --git a/crypto/sha/asm/sha1-x86_64.pl b/crypto/sha/asm/sha1-x86_64.pl old mode 100755 new mode 100644 diff --git a/crypto/sha/asm/sha512-ia64.pl b/crypto/sha/asm/sha512-ia64.pl old mode 100755 new mode 100644 diff --git a/crypto/sha/asm/sha512-parisc.pl b/crypto/sha/asm/sha512-parisc.pl old mode 100755 new mode 100644 diff --git a/crypto/sha/asm/sha512-ppc.pl b/crypto/sha/asm/sha512-ppc.pl old mode 100755 new mode 100644 diff --git a/crypto/sha/asm/sha512-x86_64.pl b/crypto/sha/asm/sha512-x86_64.pl old mode 100755 new mode 100644 diff --git a/crypto/sha/asm/sha512p8-ppc.pl b/crypto/sha/asm/sha512p8-ppc.pl old mode 100755 new mode 100644 diff --git a/crypto/srp/srp_lib.c b/crypto/srp/srp_lib.c index e79352cb..b97d630d 100644 --- a/crypto/srp/srp_lib.c +++ b/crypto/srp/srp_lib.c @@ -1,10 +1,14 @@ /* - * Copyright 2011-2016 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2004-2018 The OpenSSL Project Authors. All Rights Reserved. + * Copyright (c) 2004, EdelKey Project. All Rights Reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy * in the file LICENSE in the source distribution or at * https://www.openssl.org/source/license.html + * + * Originally written by Christophe Renou and Peter Sylvester, + * for the EdelKey project. */ #ifndef OPENSSL_NO_SRP diff --git a/crypto/srp/srp_vfy.c b/crypto/srp/srp_vfy.c index eb4a38d4..56ae94b1 100644 --- a/crypto/srp/srp_vfy.c +++ b/crypto/srp/srp_vfy.c @@ -1,10 +1,14 @@ /* - * Copyright 2011-2016 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2004-2018 The OpenSSL Project Authors. All Rights Reserved. + * Copyright (c) 2004, EdelKey Project. All Rights Reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy * in the file LICENSE in the source distribution or at * https://www.openssl.org/source/license.html + * + * Originally written by Christophe Renou and Peter Sylvester, + * for the EdelKey project. */ #ifndef OPENSSL_NO_SRP diff --git a/crypto/store/loader_file.c b/crypto/store/loader_file.c index ea1b3216..1d36cd2f 100644 --- a/crypto/store/loader_file.c +++ b/crypto/store/loader_file.c @@ -236,35 +236,35 @@ static OSSL_STORE_INFO *try_decode_PKCS12(const char *pem_name, } if (PKCS12_parse(p12, pass, &pkey, &cert, &chain)) { - OSSL_STORE_INFO *si_pkey = NULL; - OSSL_STORE_INFO *si_cert = NULL; - OSSL_STORE_INFO *si_ca = NULL; + OSSL_STORE_INFO *osi_pkey = NULL; + OSSL_STORE_INFO *osi_cert = NULL; + OSSL_STORE_INFO *osi_ca = NULL; if ((ctx = sk_OSSL_STORE_INFO_new_null()) != NULL - && (si_pkey = OSSL_STORE_INFO_new_PKEY(pkey)) != NULL - && sk_OSSL_STORE_INFO_push(ctx, si_pkey) != 0 - && (si_cert = OSSL_STORE_INFO_new_CERT(cert)) != NULL - && sk_OSSL_STORE_INFO_push(ctx, si_cert) != 0) { + && (osi_pkey = OSSL_STORE_INFO_new_PKEY(pkey)) != NULL + && sk_OSSL_STORE_INFO_push(ctx, osi_pkey) != 0 + && (osi_cert = OSSL_STORE_INFO_new_CERT(cert)) != NULL + && sk_OSSL_STORE_INFO_push(ctx, osi_cert) != 0) { ok = 1; - si_pkey = NULL; - si_cert = NULL; + osi_pkey = NULL; + osi_cert = NULL; while(sk_X509_num(chain) > 0) { X509 *ca = sk_X509_value(chain, 0); - if ((si_ca = OSSL_STORE_INFO_new_CERT(ca)) == NULL - || sk_OSSL_STORE_INFO_push(ctx, si_ca) == 0) { + if ((osi_ca = OSSL_STORE_INFO_new_CERT(ca)) == NULL + || sk_OSSL_STORE_INFO_push(ctx, osi_ca) == 0) { ok = 0; break; } - si_ca = NULL; + osi_ca = NULL; (void)sk_X509_shift(chain); } } if (!ok) { - OSSL_STORE_INFO_free(si_ca); - OSSL_STORE_INFO_free(si_cert); - OSSL_STORE_INFO_free(si_pkey); + OSSL_STORE_INFO_free(osi_ca); + OSSL_STORE_INFO_free(osi_cert); + OSSL_STORE_INFO_free(osi_pkey); sk_OSSL_STORE_INFO_pop_free(ctx, OSSL_STORE_INFO_free); EVP_PKEY_free(pkey); X509_free(cert); diff --git a/crypto/x509/x509type.c b/crypto/x509/x509type.c index 37f4d312..7eef1fb3 100644 --- a/crypto/x509/x509type.c +++ b/crypto/x509/x509type.c @@ -41,6 +41,7 @@ int X509_certificate_type(const X509 *x, const EVP_PKEY *pkey) case EVP_PKEY_EC: ret = EVP_PK_EC | EVP_PKT_SIGN | EVP_PKT_EXCH; break; + case EVP_PKEY_ED448: case EVP_PKEY_ED25519: ret = EVP_PKT_SIGN; break; diff --git a/crypto/x86_64cpuid.pl b/crypto/x86_64cpuid.pl index 0a88c7a4..513d0056 100644 --- a/crypto/x86_64cpuid.pl +++ b/crypto/x86_64cpuid.pl @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2005-2016 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2005-2018 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the OpenSSL license (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -434,21 +434,6 @@ ___ sub gen_random { my $rdop = shift; print<<___; -.globl OPENSSL_ia32_${rdop} -.type OPENSSL_ia32_${rdop},\@abi-omnipotent -.align 16 -OPENSSL_ia32_${rdop}: - mov \$8,%ecx -.Loop_${rdop}: - ${rdop} %rax - jc .Lbreak_${rdop} - loop .Loop_${rdop} -.Lbreak_${rdop}: - cmp \$0,%rax - cmove %rcx,%rax - ret -.size OPENSSL_ia32_${rdop},.-OPENSSL_ia32_${rdop} - .globl OPENSSL_ia32_${rdop}_bytes .type OPENSSL_ia32_${rdop}_bytes,\@abi-omnipotent .align 16 @@ -482,11 +467,12 @@ OPENSSL_ia32_${rdop}_bytes: mov %r10b,($arg1) lea 1($arg1),$arg1 inc %rax - shr \$8,%r8 + shr \$8,%r10 dec $arg2 jnz .Ltail_${rdop}_bytes .Ldone_${rdop}_bytes: + xor %r10,%r10 # Clear sensitive data from register ret .size OPENSSL_ia32_${rdop}_bytes,.-OPENSSL_ia32_${rdop}_bytes ___ diff --git a/crypto/x86cpuid.pl b/crypto/x86cpuid.pl index 08c129a2..d43dda4d 100644 --- a/crypto/x86cpuid.pl +++ b/crypto/x86cpuid.pl @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2004-2016 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2004-2018 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the OpenSSL license (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -453,18 +453,6 @@ my $max = "ebp"; sub gen_random { my $rdop = shift; -&function_begin_B("OPENSSL_ia32_${rdop}"); - &mov ("ecx",8); -&set_label("loop"); - &${rdop}("eax"); - &jc (&label("break")); - &loop (&label("loop")); -&set_label("break"); - &cmp ("eax",0); - &cmove ("eax","ecx"); - &ret (); -&function_end_B("OPENSSL_ia32_${rdop}"); - &function_begin_B("OPENSSL_ia32_${rdop}_bytes"); &push ("edi"); &push ("ebx"); @@ -502,6 +490,7 @@ my $rdop = shift; &jnz (&label("tail")); &set_label("done"); + &xor ("edx","edx"); # Clear random value from registers &pop ("ebx"); &pop ("edi"); &ret (); diff --git a/doc/HOWTO/keys.txt b/doc/HOWTO/keys.txt index 1662c170..9f0967cf 100644 --- a/doc/HOWTO/keys.txt +++ b/doc/HOWTO/keys.txt @@ -98,7 +98,7 @@ it may be reasonable to avoid protecting it with a password, since otherwise someone would have to type in the password every time the server needs to access the key. -For X25519, it's treated as a distinct algorithm but not as one of +For X25519 and X448, it's treated as a distinct algorithm but not as one of the curves listed with 'ecparam -list_curves' option. You can use the following command to generate an X25519 key: diff --git a/doc/man1/genpkey.pod b/doc/man1/genpkey.pod index d8f1c24f..fc83efa4 100644 --- a/doc/man1/genpkey.pod +++ b/doc/man1/genpkey.pod @@ -241,10 +241,10 @@ numeric OID. Following parameter sets are supported: =back -=head1 X25519 KEY GENERATION OPTIONS - -The X25519 algorithm does not currently support any key generation options. +=head1 X25519 and X448 KEY GENERATION OPTIONS +The X25519 and X448 algorithms do not currently support any key generation +options. =head1 NOTES diff --git a/doc/man1/ocsp.pod b/doc/man1/ocsp.pod index e32a68c5..c9feef8f 100644 --- a/doc/man1/ocsp.pod +++ b/doc/man1/ocsp.pod @@ -28,6 +28,7 @@ B B [B<-no_nonce>] [B<-url URL>] [B<-host host:port>] +[B<-multi process-count>] [B<-header>] [B<-path>] [B<-CApath dir>] @@ -187,7 +188,22 @@ This may be repeated. =item B<-timeout seconds> -Connection timeout to the OCSP responder in seconds +Connection timeout to the OCSP responder in seconds. +On POSIX systems, when running as an OCSP responder, this option also limits +the time that the responder is willing to wait for the client request. +This time is measured from the time the responder accepts the connection until +the complete request is received. + +=item B<-multi process-count> + +Run the specified number of OCSP responder child processes, with the parent +process respawning child processes as needed. +Child processes will detect changes in the CA index file and automatically +reload it. +When running as a responder B<-timeout> option is recommended to limit the time +each child is willing to wait for the client's OCSP response. +This option is available on POSIX systems (that support the fork() and other +required unix system-calls). =item B<-CAfile file>, B<-CApath pathname> diff --git a/doc/man1/openssl.pod b/doc/man1/openssl.pod index bda9ecf4..9b951f51 100644 --- a/doc/man1/openssl.pod +++ b/doc/man1/openssl.pod @@ -208,7 +208,7 @@ Generate pseudo-random bytes. =item L|rehash(1)> -Create symbolic links to certficate and CRL files named by the hash values. +Create symbolic links to certificate and CRL files named by the hash values. =item L|req(1)> diff --git a/doc/man1/pkeyutl.pod b/doc/man1/pkeyutl.pod index 4c12f13b..f693e229 100644 --- a/doc/man1/pkeyutl.pod +++ b/doc/man1/pkeyutl.pod @@ -282,10 +282,10 @@ verify operations use ECDSA and derive uses ECDH. Currently there are no additional options other than B. Only the SHA1 digest can be used and this digest is assumed by default. -=head1 X25519 ALGORITHM +=head1 X25519 and X448 ALGORITHMS -The X25519 algorithm supports key derivation only. Currently there are no -additional options. +The X25519 and X448 algorithms support key derivation only. Currently there are +no additional options. =head1 EXAMPLES diff --git a/doc/man1/s_client.pod b/doc/man1/s_client.pod index 6e47140f..f101b336 100644 --- a/doc/man1/s_client.pod +++ b/doc/man1/s_client.pod @@ -145,7 +145,7 @@ Print out a usage message. This specifies the host and optional port to connect to. It is possible to select the host and port using the optional target positional argument instead. -If neither this nor the target positonal argument are specified then an attempt +If neither this nor the target positional argument are specified then an attempt is made to connect to the local host on port 4433. =item B<-bind host:port>] @@ -499,7 +499,7 @@ For example strings, see L =item B<-curves curvelist> Specifies the list of supported curves to be sent by the client. The curve is -is ultimately selected by the server. For a list of all curves, use: +ultimately selected by the server. For a list of all curves, use: $ openssl ecparam -list_curves diff --git a/doc/man3/ADMISSIONS.pod b/doc/man3/ADMISSIONS.pod index c38ad040..5dcf72e2 100644 --- a/doc/man3/ADMISSIONS.pod +++ b/doc/man3/ADMISSIONS.pod @@ -99,10 +99,10 @@ The B, B, B, and B types are opaque structures representing the analogous types defined in the Common PKI Specification published by L. -Knowledge of those strutures and their semantics is assumed. +Knowledge of those structures and their semantics is assumed. The conventional routines to convert between DER and the local format -are desribed in L. +are described in L. The conventional routines to allocate and free the types are defined in L. diff --git a/doc/man3/ASN1_STRING_length.pod b/doc/man3/ASN1_STRING_length.pod index 18886125..85d35654 100644 --- a/doc/man3/ASN1_STRING_length.pod +++ b/doc/man3/ASN1_STRING_length.pod @@ -71,8 +71,8 @@ utility functions should be used instead. In general it cannot be assumed that the data returned by ASN1_STRING_data() is null terminated or does not contain embedded nulls. The actual format of the data will depend on the actual string type itself: for example -for and IA5String the data will be ASCII, for a BMPString two bytes per -character in big endian format, UTF8String will be in UTF8 format. +for an IA5String the data will be ASCII, for a BMPString two bytes per +character in big endian format, and for an UTF8String it will be in UTF8 format. Similar care should be take to ensure the data is in the correct format when calling ASN1_STRING_set(). diff --git a/doc/man3/ASN1_TIME_set.pod b/doc/man3/ASN1_TIME_set.pod index d45cfe6d..4ae640be 100644 --- a/doc/man3/ASN1_TIME_set.pod +++ b/doc/man3/ASN1_TIME_set.pod @@ -155,7 +155,7 @@ in the B and B parameters instead of directly manipulating a time_t value. ASN1_TIME_adj() may change the type from ASN1_GENERALIZEDTIME to ASN1_UTCTIME, -or vise-versa, based on the resulting year. The ASN1_GENERALIZEDTIME_adj() and +or vice versa, based on the resulting year. The ASN1_GENERALIZEDTIME_adj() and ASN1_UTCTIME_adj() functions will not modify the type of the return structure. It is recommended that functions starting with ASN1_TIME be used instead of diff --git a/doc/man3/BIO_s_mem.pod b/doc/man3/BIO_s_mem.pod index b55ecbfe..050d7786 100644 --- a/doc/man3/BIO_s_mem.pod +++ b/doc/man3/BIO_s_mem.pod @@ -56,14 +56,14 @@ zero then it will return B when it is empty and it will set the read retry flag (that is BIO_read_retry(b) is true). To avoid ambiguity with a normal positive return value B should be set to a negative value, typically -1. -BIO_get_mem_data() sets B to a pointer to the start of the memory BIOs data +BIO_get_mem_data() sets *B to a pointer to the start of the memory BIOs data and returns the total amount of data available. It is implemented as a macro. BIO_set_mem_buf() sets the internal BUF_MEM structure to B and sets the close flag to B, that is B should be either BIO_CLOSE or BIO_NOCLOSE. It is a macro. -BIO_get_mem_ptr() places the underlying BUF_MEM structure in B. It is +BIO_get_mem_ptr() places the underlying BUF_MEM structure in *B. It is a macro. BIO_new_mem_buf() creates a memory BIO using B bytes of data at B, diff --git a/doc/man3/DH_generate_parameters.pod b/doc/man3/DH_generate_parameters.pod index 56ad4b12..bcbc12ce 100644 --- a/doc/man3/DH_generate_parameters.pod +++ b/doc/man3/DH_generate_parameters.pod @@ -111,10 +111,10 @@ The parameter B is invalid. =back -DH_check_ex(), DH_check_params() and DH_check_pub_key_ex() are similiar with -DH_check() and DH_check_params() respectively, but the error reasons are set -to the OpenSSL error handling framework instead of returning by the function -parameters. +DH_check_ex(), DH_check_params() and DH_check_pub_key_ex() are similar to +DH_check() and DH_check_params() respectively, but the error reasons are added +to the thread's error queue instead of provided as return values from the +function. =head1 RETURN VALUES diff --git a/doc/man3/DTLSv1_listen.pod b/doc/man3/DTLSv1_listen.pod index 50f16bc8..858e3931 100644 --- a/doc/man3/DTLSv1_listen.pod +++ b/doc/man3/DTLSv1_listen.pod @@ -64,10 +64,11 @@ does not support this), then B<*peer> will be cleared and the family set to AF_UNSPEC. Typically user code is expected to "connect" the underlying socket to the peer and continue the handshake in a connected state. -Prior to calling these functions user code must ensure that cookie generation +Prior to calling DTLSv1_listen() user code must ensure that cookie generation and verification callbacks have been set up using SSL_CTX_set_cookie_generate_cb() and SSL_CTX_set_cookie_verify_cb() -respectively. +respectively. For SSL_stateless(), SSL_CTX_set_stateless_cookie_generate_cb() +and SSL_CTX_set_stateless_cookie_verify_cb() must be used instead. Since DTLSv1_listen() operates entirely statelessly whilst processing incoming ClientHellos it is unable to process fragmented messages (since this would @@ -88,8 +89,9 @@ start. =head1 RETURN VALUES For SSL_stateless() a return value of 1 indicates success and the B object -will be set up ready to continue the handshake. A return value of 0 indicates -failure. User code may retry the SSL_stateless() call. +will be set up ready to continue the handshake. A return value of 0 or -1 +indicates failure. If the value is 0 then a HelloRetryRequest was sent. A value +of -1 indicates any other error. User code may retry the SSL_stateless() call. For DTLSv1_listen() a return value of >= 1 indicates success. The B object will be set up ready to continue the handshake. the B value will also be diff --git a/doc/man3/EVP_CIPHER_meth_new.pod b/doc/man3/EVP_CIPHER_meth_new.pod index a33cb763..15f71612 100644 --- a/doc/man3/EVP_CIPHER_meth_new.pod +++ b/doc/man3/EVP_CIPHER_meth_new.pod @@ -73,7 +73,7 @@ EVP_CIPHER_meth_dup() creates a copy of B. EVP_CIPHER_meth_free() destroys a B structure. -EVP_CIPHER_meth_iv_length() sets the length of the IV. +EVP_CIPHER_meth_set_iv_length() sets the length of the IV. This is only needed when the implemented cipher mode requires it. EVP_CIPHER_meth_set_flags() sets the flags to describe optional diff --git a/doc/man3/EVP_DigestInit.pod b/doc/man3/EVP_DigestInit.pod index 187292fc..45c361e6 100644 --- a/doc/man3/EVP_DigestInit.pod +++ b/doc/man3/EVP_DigestInit.pod @@ -217,8 +217,8 @@ preference to the low level interfaces. This is because the code then becomes transparent to the digest used and much more flexible. New applications should use the SHA-2 (such as L) or the SHA-3 -digest algorithms (such as L). The other digest algorithms are -still in common use. +digest algorithms (such as L). The other digest algorithms +are still in common use. For most applications the B parameter to EVP_DigestInit_ex() will be set to NULL to use the default digest implementation. diff --git a/doc/man3/EVP_EncryptInit.pod b/doc/man3/EVP_EncryptInit.pod index 619a94ec..b1b51cb3 100644 --- a/doc/man3/EVP_EncryptInit.pod +++ b/doc/man3/EVP_EncryptInit.pod @@ -59,33 +59,33 @@ EVP_enc_null void EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *ctx); int EVP_EncryptInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type, - ENGINE *impl, unsigned char *key, unsigned char *iv); + ENGINE *impl, const unsigned char *key, const unsigned char *iv); int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl, const unsigned char *in, int inl); int EVP_EncryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl); int EVP_DecryptInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type, - ENGINE *impl, unsigned char *key, unsigned char *iv); + ENGINE *impl, const unsigned char *key, const unsigned char *iv); int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl, const unsigned char *in, int inl); int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl); int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type, - ENGINE *impl, unsigned char *key, unsigned char *iv, int enc); + ENGINE *impl, const unsigned char *key, const unsigned char *iv, int enc); int EVP_CipherUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, - int *outl, unsigned char *in, int inl); + int *outl, const unsigned char *in, int inl); int EVP_CipherFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl); int EVP_EncryptInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type, - unsigned char *key, unsigned char *iv); + const unsigned char *key, const unsigned char *iv); int EVP_EncryptFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl); int EVP_DecryptInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type, - unsigned char *key, unsigned char *iv); + const unsigned char *key, const unsigned char *iv); int EVP_DecryptFinal(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl); int EVP_CipherInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type, - unsigned char *key, unsigned char *iv, int enc); + const unsigned char *key, const unsigned char *iv, int enc); int EVP_CipherFinal(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl); int EVP_CIPHER_CTX_set_padding(EVP_CIPHER_CTX *x, int padding); @@ -457,6 +457,20 @@ This call is only valid when decrypting data. =back +=head1 Random numbers + +The following can be used to select the DRBG that is used to generate the random +numbers: + +EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_SET_DRBG, 0, drbg) + +The following can be used to get the DRBG: + +EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GET_DRBG, 0, &drbg) + +By default it's set to NULL which results in RAND_bytes() being used. + + =head1 NOTES Where possible the B interface to symmetric ciphers should be used in diff --git a/doc/man3/EVP_md5.pod b/doc/man3/EVP_md5.pod index 1048c0fd..30e72a22 100644 --- a/doc/man3/EVP_md5.pod +++ b/doc/man3/EVP_md5.pod @@ -16,7 +16,7 @@ EVP_md5 MD5 is a cryptographic hash function standardized in RFC 1321 and designed by Ronald Rivest. -The CMU Software Engieneering Institute considers MD5 unsuitable for further +The CMU Software Engineering Institute considers MD5 unsuitable for further use since its security has been severely compromised. =over 4 diff --git a/doc/man3/OSSL_STORE_LOADER.pod b/doc/man3/OSSL_STORE_LOADER.pod index e6e520ec..87c135a1 100644 --- a/doc/man3/OSSL_STORE_LOADER.pod +++ b/doc/man3/OSSL_STORE_LOADER.pod @@ -162,7 +162,7 @@ It is otherwise expected to return 0. =item B This function takes a B pointer and is expected to -return 1 to indicate that an error occured in a previous call to the +return 1 to indicate that an error occurred in a previous call to the B function. It is otherwise expected to return 0. diff --git a/doc/man3/OSSL_STORE_SEARCH.pod b/doc/man3/OSSL_STORE_SEARCH.pod index 411664d4..6d36a190 100644 --- a/doc/man3/OSSL_STORE_SEARCH.pod +++ b/doc/man3/OSSL_STORE_SEARCH.pod @@ -45,7 +45,7 @@ OSSL_STORE_SEARCH_get0_digest =head1 DESCRIPTION -These functions are use to specify search criteria to help search for specific +These functions are used to specify search criteria to help search for specific objects through other names than just the URI that's given to OSSL_STORE_open(). For example, this can be useful for an application that has received a URI and then wants to add on search criteria in a uniform and supported manner. @@ -122,7 +122,7 @@ accordingly. A criterion of this type is created with OSSL_STORE_SEARCH_by_key_fingerprint() and the actual fingerprint and its length can be retrieved with OSSL_STORE_SEARCH_get0_bytes(). -The digest can be retreived with OSSL_STORE_SEARCH_get0_digest(). +The digest can be retrieved with OSSL_STORE_SEARCH_get0_digest(). =item OSSL_STORE_SEARCH_BY_ALIAS diff --git a/doc/man3/OSSL_STORE_expect.pod b/doc/man3/OSSL_STORE_expect.pod index ab0e8784..e3f06b55 100644 --- a/doc/man3/OSSL_STORE_expect.pod +++ b/doc/man3/OSSL_STORE_expect.pod @@ -14,7 +14,7 @@ OSSL_STORE_find int OSSL_STORE_expect(OSSL_STORE_CTX *ctx, int expected_type); int OSSL_STORE_supports_search(OSSL_STORE_CTX *ctx, int criterion_type); - + int OSSL_STORE_find(OSSL_STORE_CTX *ctx, OSSL_STORE_SEARCH *search); =head1 DESCRIPTION diff --git a/doc/man3/OSSL_STORE_open.pod b/doc/man3/OSSL_STORE_open.pod index 3a05a880..92b2493f 100644 --- a/doc/man3/OSSL_STORE_open.pod +++ b/doc/man3/OSSL_STORE_open.pod @@ -86,7 +86,7 @@ object and return it wrapped with B. OSSL_STORE_eof() takes a B and checks if we've reached the end of data. -OSSL_STORE_error() takes a B and checks if an error occured in +OSSL_STORE_error() takes a B and checks if an error occurred in the last OSSL_STORE_load() call. Note that it may still be meaningful to try and load more objects, unless OSSL_STORE_eof() shows that the end of data has been reached. @@ -125,7 +125,7 @@ returned B. OSSL_STORE_eof() returns 1 if the end of data has been reached, otherwise 0. -OSSL_STORE_error() returns 1 if an error occured in a OSSL_STORE_load() call, +OSSL_STORE_error() returns 1 if an error occurred in an OSSL_STORE_load() call, otherwise 0. OSSL_STORE_ctrl() and OSSL_STORE_close() returns 1 on success, or 0 on failure. diff --git a/doc/man3/SSL_CTX_set_psk_client_callback.pod b/doc/man3/SSL_CTX_set_psk_client_callback.pod index e771072f..5350d797 100644 --- a/doc/man3/SSL_CTX_set_psk_client_callback.pod +++ b/doc/man3/SSL_CTX_set_psk_client_callback.pod @@ -14,48 +14,33 @@ SSL_set_psk_use_session_callback #include + typedef int (*SSL_psk_use_session_cb_func)(SSL *ssl, const EVP_MD *md, + const unsigned char **id, + size_t *idlen, + SSL_SESSION **sess); + + + void SSL_CTX_set_psk_use_session_callback(SSL_CTX *ctx, + SSL_psk_use_session_cb_func cb); + void SSL_set_psk_use_session_callback(SSL *s, SSL_psk_use_session_cb_func cb); + + typedef unsigned int (*SSL_psk_client_cb_func)(SSL *ssl, const char *hint, char *identity, unsigned int max_identity_len, unsigned char *psk, unsigned int max_psk_len); - typedef int (*SSL_psk_use_session_cb_func)(SSL *ssl, const EVP_MD *md, - const unsigned char **id, - size_t *idlen, - SSL_SESSION **sess); void SSL_CTX_set_psk_client_callback(SSL_CTX *ctx, SSL_psk_client_cb_func cb); void SSL_set_psk_client_callback(SSL *ssl, SSL_psk_client_cb_func cb); - void SSL_CTX_set_psk_use_session_callback(SSL_CTX *ctx, - SSL_psk_use_session_cb_func cb); - void SSL_set_psk_use_session_callback(SSL *s, SSL_psk_use_session_cb_func cb); =head1 DESCRIPTION -TLSv1.3 Pre-Shared Keys (PSKs) and PSKs for TLSv1.2 and below are not -compatible. - -A client application wishing to use PSK ciphersuites for TLSv1.2 and below must -provide a callback function. This function will be called when the client is -sending the ClientKeyExchange message to the server. - -The purpose of the callback function is to select the PSK identity and -the pre-shared key to use during the connection setup phase. - -The callback is set using functions SSL_CTX_set_psk_client_callback() -or SSL_set_psk_client_callback(). The callback function is given the -connection in parameter B, a B-terminated PSK identity hint -sent by the server in parameter B, a buffer B of -length B bytes where the resulting -B-terminated identity is to be stored, and a buffer B of -length B bytes where the resulting pre-shared key is to -be stored. - -A client application wishing to use TLSv1.3 PSKs must set a different callback -using either SSL_CTX_set_psk_use_session_callback() or -SSL_set_psk_use_session_callback() as appropriate. +A client application wishing to use TLSv1.3 PSKs should use either +SSL_CTX_set_psk_use_session_callback() or SSL_set_psk_use_session_callback() as +appropriate. These functions cannot be used for TLSv1.2 and below PSKs. The callback function is given a pointer to the SSL connection in B. @@ -113,6 +98,33 @@ case no PSK will be sent to the server but the handshake will continue. To do this the callback should return successfully and ensure that B<*sess> is NULL. The contents of B<*id> and B<*idlen> will be ignored. +A client application wishing to use PSK ciphersuites for TLSv1.2 and below must +provide a different callback function. This function will be called when the +client is sending the ClientKeyExchange message to the server. + +The purpose of the callback function is to select the PSK identity and +the pre-shared key to use during the connection setup phase. + +The callback is set using functions SSL_CTX_set_psk_client_callback() +or SSL_set_psk_client_callback(). The callback function is given the +connection in parameter B, a B-terminated PSK identity hint +sent by the server in parameter B, a buffer B of +length B bytes where the resulting +B-terminated identity is to be stored, and a buffer B of +length B bytes where the resulting pre-shared key is to +be stored. + +The callback for use in TLSv1.2 will also work in TLSv1.3 although it is +recommended to use SSL_CTX_set_psk_use_session_callback() +or SSL_set_psk_use_session_callback() for this purpose instead. If TLSv1.3 has +been negotiated then OpenSSL will first check to see if a callback has been set +via SSL_CTX_set_psk_use_session_callback() or SSL_set_psk_use_session_callback() +and it will use that in preference. If no such callback is present then it will +check to see if a callback has been set via SSL_CTX_set_psk_client_callback() or +SSL_set_psk_client_callback() and use that. In this case the B value will +always be NULL and the handshake digest will default to SHA-256 for any returned +PSK. + =head1 NOTES Note that parameter B given to the callback may be B. diff --git a/doc/man3/SSL_CTX_set_session_ticket_cb.pod b/doc/man3/SSL_CTX_set_session_ticket_cb.pod new file mode 100644 index 00000000..e9aeb909 --- /dev/null +++ b/doc/man3/SSL_CTX_set_session_ticket_cb.pod @@ -0,0 +1,149 @@ +=pod + +=head1 NAME + +SSL_CTX_set_session_ticket_cb, +SSL_SESSION_get0_ticket_appdata, +SSL_SESSION_set1_ticket_appdata, +SSL_CTX_generate_session_ticket_fn, +SSL_CTX_decrypt_session_ticket_fn - manage session ticket application data + +=head1 SYNOPSIS + + #include + + typedef int (*SSL_CTX_generate_session_ticket_fn)(SSL *s, void *arg); + typedef SSL_TICKET_RETURN (*SSL_CTX_decrypt_session_ticket_fn)(SSL *s, SSL_SESSION *ss, + const unsigned char *keyname, + size_t keyname_len, + SSL_TICKET_RETURN retv, + void *arg); + int SSL_CTX_set_session_ticket_cb(SSL_CTX *ctx, + SSL_CTX_generate_session_ticket_fn gen_cb, + SSL_CTX_decrypt_session_ticket_fn dec_cb, + void *arg); + int SSL_SESSION_set1_ticket_appdata(SSL_SESSION *ss, const void *data, size_t len); + int SSL_SESSION_get0_ticket_appdata(SSL_SESSION *ss, void **data, size_t *len); + +=head1 DESCRIPTION + +SSL_CTX_set_set_session_ticket_cb() sets the application callbacks B +and B that are used by a server to set and get application data stored +with a session, and placed into a session ticket. Either callback function may +be set to NULL. The value of B is passed to the callbacks. + +B is the application defined callback invoked when a session ticket is +about to be created. The application can call SSL_SESSION_set1_ticket_appdata() +at this time to add application data to the session ticket. The value of B +is the same as that given to SSL_CTX_set_session_ticket_cb(). The B +callback is defined as type B. + +B is the application defined callback invoked after session ticket +decryption has been attempted and any session ticket application data is available. +The application can call SSL_SESSION_get_ticket_appdata() at this time to retrieve +the application data. The value of B is the same as that given to +SSL_CTX_set_session_ticket_cb(). The B arguement is the result of the ticket +decryption. The B and B identify the key used to decrypt the +session ticket. The B callback is defined as type +B. + +SSL_SESSION_set1_ticket_appdata() sets the application data specified by +B and B into B which is then placed into any generated session +tickets. It can be called at any time before a session ticket is created to +update the data placed into the session ticket. However, given that sessions +and tickets are created by the handshake, the B is provided to notify +the application that a session ticket is about to be generated. + +SSL_SESSION_get0_ticket_appdata() assigns B to the session ticket +application data and assigns B to the length of the session ticket +application data from B. The application data can be set via +SSL_SESSION_set1_ticket_appdata() or by a session ticket. NULL will be assigned +to B and 0 will be assigned to B if there is no session ticket +application data. SSL_SESSION_get0_ticket_appdata() can be called any time +after a session has been created. The B is provided to notify the +application that a session ticket has just been decrypted. + +=head1 NOTES + +When the B callback is invoked, the SSL_SESSION B has not yet been +assigned to the SSL B. The B indicates the result of the ticket +decryption which can be modified by the callback before being returned. The +callback must check the B value before performing any action, as it's +called even if ticket decryption fails. + +The B and B arguments to B may be used to identify +the key that was used to encrypt the session ticket. + +When the B callback is invoked, the SSL_get_session() function can be +used to retrieve the SSL_SESSION for SSL_SESSION_set1_ticket_appdata(). + +=head1 RETURN VALUES + +The SSL_CTX_set_session_ticket_cb(), SSL_SESSION_set1_ticket_appdata() and +SSL_SESSION_get0_ticket_appdata() functions return 1 on success and 0 on +failure. + +The B callback must return 1 to continue the connection. A return of 0 +will terminate the connection with an INTERNAL_ERROR alert. + +The B callback must return one of the following B +values. Under normal circumstances the B value is returned unmodified, +but the callback can change the behavior of the post-ticket decryption code +by returning something different. The B callback must check the B +value before performing any action. + + typedef int SSL_TICKET_RETURN; + +=over 4 + +=item SSL_TICKET_FATAL_ERR_MALLOC + +Fatal error, malloc failure. + +=item SSL_TICKET_FATAL_ERR_OTHER + +Fatal error, either from parsing or decrypting the ticket. + +=item SSL_TICKET_NONE + +No ticket present. + +=item SSL_TICKET_EMPTY + +Empty ticket present. + +=item SSL_TICKET_NO_DECRYPT + +The ticket couldn't be decrypted. + +=item SSL_TICKET_SUCCESS + +A ticket was successfully decrypted, any session ticket application data should +be available. + +=item TICKET_SUCCESS_RENEW + +Same as B, but the ticket needs to be renewed. + +=back + +=head1 SEE ALSO + +L, +L + +=head1 HISTORY + +SSL_CTX_set_session_ticket_cb(), SSSL_SESSION_set1_ticket_appdata() and +SSL_SESSION_get_ticket_appdata() were added to OpenSSL 1.1.1. + +=head1 COPYRIGHT + +Copyright 2017 The OpenSSL Project Authors. All Rights Reserved. + +Licensed under the OpenSSL license (the "License"). You may not use +this file except in compliance with the License. You can obtain a copy +in the file LICENSE in the source distribution or at +L. + +=cut diff --git a/doc/man3/SSL_CTX_set_stateless_cookie_generate_cb.pod b/doc/man3/SSL_CTX_set_stateless_cookie_generate_cb.pod new file mode 100644 index 00000000..f29153ed --- /dev/null +++ b/doc/man3/SSL_CTX_set_stateless_cookie_generate_cb.pod @@ -0,0 +1,58 @@ +=pod + +=head1 NAME + +SSL_CTX_set_stateless_cookie_generate_cb, +SSL_CTX_set_stateless_cookie_verify_cb +- Callback functions for stateless TLS1.3 cookies + +=head1 SYNOPSIS + + #include + + void SSL_CTX_set_stateless_cookie_generate_cb( + SSL_CTX *ctx, + int (*gen_stateless_cookie_cb) (SSL *ssl, + unsigned char *cookie, + size_t *cookie_len)); + void SSL_CTX_set_stateless_cookie_verify_cb( + SSL_CTX *ctx, + int (*verify_stateless_cookie_cb) (SSL *ssl, + const unsigned char *cookie, + size_t cookie_len)); + +=head1 DESCRIPTION + +SSL_CTX_set_cookie_generate_cb() sets the callback used by L +to generate the application-controlled portion of the cookie provided to clients +in the HelloRetryRequest transmitted as a response to a ClientHello with a +missing or invalid cookie. gen_stateless_cookie_cb() must write at most +SSL_COOKIE_LENGTH bytes into B, and must write the number of bytes +written to B. If a cookie cannot be generated, a zero return value +can be used to abort the handshake. + +SSL_CTX_set_cookie_verify_cb() sets the callback used by L to +determine whether the application-controlled portion of a ClientHello cookie is +valid. A nonzero return value from app_verify_cookie_cb() communicates that the +cookie is valid. The integrity of the entire cookie, including the +application-controlled portion, is automatically verified by HMAC before +verify_stateless_cookie_cb() is called. + +=head1 RETURN VALUES + +Neither function returns a value. + +=head1 SEE ALSO + +L + +=head1 COPYRIGHT + +Copyright 2018 The OpenSSL Project Authors. All Rights Reserved. + +Licensed under the OpenSSL license (the "License"). You may not use +this file except in compliance with the License. You can obtain a copy +in the file LICENSE in the source distribution or at +L. + +=cut diff --git a/doc/man3/SSL_CTX_set_tlsext_use_srtp.pod b/doc/man3/SSL_CTX_set_tlsext_use_srtp.pod index 2746d501..2bc3a43e 100644 --- a/doc/man3/SSL_CTX_set_tlsext_use_srtp.pod +++ b/doc/man3/SSL_CTX_set_tlsext_use_srtp.pod @@ -75,7 +75,7 @@ SSL_get_selected_srtp_profile(). This function will return NULL if no SRTP protection profile was negotiated. The memory returned from this function should not be freed by the caller. -If an SRTP protection profile has been sucessfully negotiated then the SRTP +If an SRTP protection profile has been successfully negotiated then the SRTP keying material (on both the client and server) should be obtained via a call to L. This call should provide a label value of "EXTRACTOR-dtls_srtp" and a NULL context value (use_context is 0). The total diff --git a/doc/man3/SSL_CTX_use_certificate.pod b/doc/man3/SSL_CTX_use_certificate.pod index 22420f97..a0c92e6e 100644 --- a/doc/man3/SSL_CTX_use_certificate.pod +++ b/doc/man3/SSL_CTX_use_certificate.pod @@ -11,7 +11,8 @@ SSL_CTX_use_PrivateKey_file, SSL_CTX_use_RSAPrivateKey, SSL_CTX_use_RSAPrivateKey_ASN1, SSL_CTX_use_RSAPrivateKey_file, SSL_use_PrivateKey_file, SSL_use_PrivateKey_ASN1, SSL_use_PrivateKey, SSL_use_RSAPrivateKey, SSL_use_RSAPrivateKey_ASN1, -SSL_use_RSAPrivateKey_file, SSL_CTX_check_private_key, SSL_check_private_key +SSL_use_RSAPrivateKey_file, SSL_CTX_check_private_key, SSL_check_private_key, +SSL_CTX_use_cert_and_key, SSL_use_cert_and_key - load certificate and key data =head1 SYNOPSIS @@ -45,6 +46,9 @@ SSL_use_RSAPrivateKey_file, SSL_CTX_check_private_key, SSL_check_private_key int SSL_CTX_check_private_key(const SSL_CTX *ctx); int SSL_check_private_key(const SSL *ssl); + int SSL_CTX_use_cert_and_key(SSL_CTX *ctx, X509 *x, EVP_PKEY *pkey, STACK_OF(X509) *chain, int override); + int SSL_use_cert_and_key(SSL *ssl, X509 *x, EVP_PKEY *pkey, STACK_OF(X509) *chain, int override); + =head1 DESCRIPTION These functions load the certificates and private keys into the SSL_CTX @@ -94,6 +98,19 @@ key pair the new certificate needs to be set with SSL_use_certificate() or SSL_CTX_use_certificate() before setting the private key with SSL_CTX_use_PrivateKey() or SSL_use_PrivateKey(). +SSL_CTX_use_cert_and_key() and SSL_use_cert_and_key() assign the X.509 +certificate B, private key B, and certificate B onto the +corresponding B or B. The B argument must be the private +key of the X.509 certificate B. If the B argument is 0, then +B, B and B are set only if all were not previously set. +If B is non-0, then the certificate, private key and chain certs +are always set. If B is NULL, then the public key of B is used as +the private key. This is intended to be used with hardware (via the ENGINE +inteface) that stores the private key securely, such that it cannot be +accessed by OpenSSL. The reference count of the public key is incremented +(twice if there is no private key); it is not copied nor duplicated. This +allows all private key validations checks to succeed without an actual +private key being assigned via SSL_CTX_use_PrivateKey(), etc. SSL_CTX_use_PrivateKey_ASN1() adds the private key of type B stored at memory location B (length B) to B. @@ -170,7 +187,7 @@ L =head1 COPYRIGHT -Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved. Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/SSL_CTX_use_psk_identity_hint.pod b/doc/man3/SSL_CTX_use_psk_identity_hint.pod index d41c0cce..2f4773d0 100644 --- a/doc/man3/SSL_CTX_use_psk_identity_hint.pod +++ b/doc/man3/SSL_CTX_use_psk_identity_hint.pod @@ -16,52 +16,30 @@ SSL_set_psk_find_session_callback #include - typedef unsigned int (*SSL_psk_server_cb_func)(SSL *ssl, - const char *identity, - unsigned char *psk, - unsigned int max_psk_len); - typedef int (*SSL_psk_find_session_cb_func)(SSL *ssl, const unsigned char *identity, size_t identity_len, SSL_SESSION **sess); + + void SSL_CTX_set_psk_find_session_callback(SSL_CTX *ctx, + SSL_psk_find_session_cb_func cb); + void SSL_set_psk_find_session_callback(SSL *s, SSL_psk_find_session_cb_func cb); + + typedef unsigned int (*SSL_psk_server_cb_func)(SSL *ssl, + const char *identity, + unsigned char *psk, + unsigned int max_psk_len); + int SSL_CTX_use_psk_identity_hint(SSL_CTX *ctx, const char *hint); int SSL_use_psk_identity_hint(SSL *ssl, const char *hint); void SSL_CTX_set_psk_server_callback(SSL_CTX *ctx, SSL_psk_server_cb_func cb); void SSL_set_psk_server_callback(SSL *ssl, SSL_psk_server_cb_func cb); - void SSL_CTX_set_psk_find_session_callback(SSL_CTX *ctx, - SSL_psk_find_session_cb_func cb); - void SSL_set_psk_find_session_callback(SSL *s, SSL_psk_find_session_cb_func cb); - =head1 DESCRIPTION -TLSv1.3 Pre-Shared Keys (PSKs) and PSKs for TLSv1.2 and below are not -compatible. - -Identity hints are not relevant for TLSv1.3. A server application wishing to use -PSK ciphersuites for TLSv1.2 and below may call SSL_CTX_use_psk_identity_hint() -to set the given B-terminated PSK identity hint B for SSL context -object B. SSL_use_psk_identity_hint() sets the given B-terminated PSK -identity hint B for the SSL connection object B. If B is -B the current hint from B or B is deleted. - -In the case where PSK identity hint is B, the server does not send the -ServerKeyExchange message to the client. - -A server application for TLSv1.2 and below must provide a callback function -which is called when the server receives the ClientKeyExchange message from the -client. The purpose of the callback function is to validate the -received PSK identity and to fetch the pre-shared key used during the -connection setup phase. The callback is set using the functions -SSL_CTX_set_psk_server_callback() or SSL_set_psk_server_callback(). The callback -function is given the connection in parameter B, B-terminated PSK -identity sent by the client in parameter B, and a buffer B of -length B bytes where the pre-shared key is to be stored. - -A client application wishing to use TLSv1.3 PSKs must set a different callback +A client application wishing to use TLSv1.3 PSKs should set a callback using either SSL_CTX_set_psk_use_session_callback() or SSL_set_psk_use_session_callback() as appropriate. @@ -77,6 +55,36 @@ case no PSK will be used but the handshake will continue. To do this the callback should return successfully and ensure that B<*sess> is NULL. +Identity hints are not relevant for TLSv1.3. A server application wishing to use +PSK ciphersuites for TLSv1.2 and below may call SSL_CTX_use_psk_identity_hint() +to set the given B-terminated PSK identity hint B for SSL context +object B. SSL_use_psk_identity_hint() sets the given B-terminated PSK +identity hint B for the SSL connection object B. If B is +B the current hint from B or B is deleted. + +In the case where PSK identity hint is B, the server does not send the +ServerKeyExchange message to the client. + +A server application wishing to use PSKs for TLSv1.2 and below must provide a +callback function which is called when the server receives the +ClientKeyExchange message from the client. The purpose of the callback function +is to validate the received PSK identity and to fetch the pre-shared key used +during the connection setup phase. The callback is set using the functions +SSL_CTX_set_psk_server_callback() or SSL_set_psk_server_callback(). The callback +function is given the connection in parameter B, B-terminated PSK +identity sent by the client in parameter B, and a buffer B of +length B bytes where the pre-shared key is to be stored. + +The callback for use in TLSv1.2 will also work in TLSv1.3 although it is +recommended to use SSL_CTX_set_psk_find_session_callback() +or SSL_set_psk_find_session_callback() for this purpose instead. If TLSv1.3 has +been negotiated then OpenSSL will first check to see if a callback has been set +via SSL_CTX_set_psk_find_session_callback() or SSL_set_psk_find_session_callback() +and it will use that in preference. If no such callback is present then it will +check to see if a callback has been set via SSL_CTX_set_psk_server_callback() or +SSL_set_psk_server_callback() and use that. In this case the handshake digest +will default to SHA-256 for any returned PSK. + =head1 NOTES A connection established via a TLSv1.3 PSK will appear as if session resumption diff --git a/doc/man3/SSL_read_early_data.pod b/doc/man3/SSL_read_early_data.pod index d9167569..a420e732 100644 --- a/doc/man3/SSL_read_early_data.pod +++ b/doc/man3/SSL_read_early_data.pod @@ -101,7 +101,9 @@ was rejected or SSL_EARLY_DATA_NOT_SENT if no early data was sent. This function may be called by either the client or the server. A server uses the SSL_read_early_data() function to receive early data on a -connection. As for SSL_write_early_data() this must be the first IO function +connection for which early data has been enabled using +SSL_CTX_set_max_early_data() or SSL_set_max_early_data(). As for +SSL_write_early_data(), this must be the first IO function called on a connection, i.e. it must occur before any calls to L, L, L, L, or other similar functions. @@ -165,12 +167,16 @@ further action taken. When a session is created between a server and a client the server will specify the maximum amount of any early data that it will accept on any future -connection attempt. By default this is approximately 16k. A server may override -this default value by calling SSL_CTX_set_max_early_data() or +connection attempt. By default the server does not accept early data; a +server may indicate support for early data by calling +SSL_CTX_set_max_early_data() or SSL_set_max_early_data() to set it for the whole SSL_CTX or an individual SSL object respectively. Similarly the SSL_CTX_get_max_early_data() and SSL_get_max_early_data() functions can be used to obtain the current maximum early data settings for the SSL_CTX and SSL objects respectively. +Generally a server application will either use both of SSL_read_early_data() +and SSL_CTX_set_max_early_data() (or SSL_set_max_early_data()), or neither +of them, since there is no practical benefit from using only one of them. In the event that the current maximum early data setting for the server is different to that originally specified in a session that a client is resuming diff --git a/doc/man3/UI_STRING.pod b/doc/man3/UI_STRING.pod index 5a464a37..09a7d0be 100644 --- a/doc/man3/UI_STRING.pod +++ b/doc/man3/UI_STRING.pod @@ -120,11 +120,11 @@ UI_get0_test_string() returns the UI string action description string for B type UI strings, NULL for any other type. UI_get_result_minsize() returns the minimum allowed result size for -the UI string for for B and B type strings, +the UI string for B and B type strings, -1 for any other type. UI_get_result_maxsize() returns the minimum allowed result size for -the UI string for for B and B type strings, +the UI string for B and B type strings, -1 for any other type. UI_set_result() returns 0 on success or when the UI string is of any diff --git a/doc/man3/X509_STORE_add_cert.pod b/doc/man3/X509_STORE_add_cert.pod new file mode 100644 index 00000000..4c80153f --- /dev/null +++ b/doc/man3/X509_STORE_add_cert.pod @@ -0,0 +1,100 @@ +=pod + +=head1 NAME + +X509_STORE_add_cert, X509_STORE_add_crl, X509_STORE_set_depth, +X509_STORE_set_flags, X509_STORE_set_purpose, X509_STORE_set_trust, +X509_STORE_load_locations, +X509_STORE_set_default_paths +- X509_STORE manipulation + +=head1 SYNOPSIS + + #include + + int X509_STORE_add_cert(X509_STORE *ctx, X509 *x); + int X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x); + int X509_STORE_set_depth(X509_STORE *store, int depth); + int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags); + int X509_STORE_set_purpose(X509_STORE *ctx, int purpose); + int X509_STORE_set_trust(X509_STORE *ctx, int trust); + + int X509_STORE_load_locations(X509_STORE *ctx, + const char *file, const char *dir); + int X509_STORE_set_default_paths(X509_STORE *ctx); + +=head1 DESCRIPTION + +The B structure is intended to be a consolidated mechanism for +holding information about X.509 certificates and CRLs, and constructing +and validating chains of certificates terminating in trusted roots. +It admits multiple lookup mechanisms and efficient scaling performance +with large numbers of certificates, and a great deal of flexibility in +how validation and policy checks are performed. + +L creates an empty B structure, which contains +no information about trusted certificates or where such certificates +are located on disk, and is generally not usable. Normally, trusted +certificates will be added to the B to prepare it for use, +via mechanisms such as X509_STORE_add_lookup() and X509_LOOKUP_file(), or +PEM_read_bio_X509_AUX() and X509_STORE_add_cert(). CRLs can also be added, +and many behaviors configured as desired. + +Once the B is suitably configured, X509_STORE_CTX_new() is +used to instantiate a single-use B for each chain-building +and verification operation. That process includes providing the end-entity +certificate to be verified and an additional set of untrusted certificates +that may be used in chain-building. As such, it is expected that the +certificates included in the B are certificates that represent +trusted entities such as root certificate authorities (CAs). +OpenSSL represents these trusted certificates internally as B objects +with an associated B, as are produced by +PEM_read_bio_X509_AUX() and similar routines that refer to X509_AUX. +The public interfaces that operate on such trusted certificates still +operate on pointers to B objects, though. + +X509_STORE_add_cert() and X509_STORE_add_crl() add the respective object +to the B's local storage. Untrusted objects should not be +added in this way. + +X509_STORE_set_depth(), X509_STORE_set_flags(), X509_STORE_set_purpose(), +X509_STORE_set_trust(), and X509_STORE_set1_param() set the default values +for the corresponding values used in certificate chain validation. Their +behavior is documented in the corresponding B manual +pages, e.g., L. + +X509_STORE_load_locations() loads trusted certificate(s) into an +B from a given file and/or directory path. It is permitted +to specify just a file, just a directory, or both paths. The certificates +in the directory must be in hashed form, as documented in +L. + +X509_STORE_set_default_paths() is somewhat misnamed, in that it does not +set what default paths should be used for loading certificates. Instead, +it loads certificates into the B from the hardcoded default +paths. + +=head1 RETURN VALUES + +X509_STORE_add_cert(), X509_STORE_add_crl(), X509_STORE_set_depth(), +X509_STORE_set_flags(), X509_STORE_set_purpose(), +X509_STORE_set_trust(), X509_STORE_load_locations(), and +X509_STORE_set_default_paths() return 1 on success or 0 on failure. + +=head1 SEE ALSO + +L. +L. +L, +L + +=head1 COPYRIGHT + +Copyright 2017 The OpenSSL Project Authors. All Rights Reserved. + +Licensed under the OpenSSL license (the "License"). You may not use +this file except in compliance with the License. You can obtain a copy +in the file LICENSE in the source distribution or at +L. + +=cut diff --git a/doc/man3/d2i_X509.pod b/doc/man3/d2i_X509.pod index 80c5c9dd..71985a44 100644 --- a/doc/man3/d2i_X509.pod +++ b/doc/man3/d2i_X509.pod @@ -461,7 +461,7 @@ Represents a PKCS#3 DH parameters structure. =item B -Represents a ANSI X9.42 DH parameters structure. +Represents an ANSI X9.42 DH parameters structure. =item B diff --git a/doc/man5/config.pod b/doc/man5/config.pod index a7cc16b2..485ec087 100644 --- a/doc/man5/config.pod +++ b/doc/man5/config.pod @@ -27,6 +27,21 @@ The environment is mapped onto a section called B. Comments can be included by preceding them with the B<#> character +Other files can be included using the B<.include> directive followed +by a path. If the path points to a directory all files with +names ending with B<.cnf> or B<.conf> are included from the directory. +Recursive inclusion of directories from files in such directory is not +supported. That means the files in the included directory can also contain +B<.include> directives but only inclusion of regular files is supported +there. The inclusion of directories is not supported on systems without +POSIX IO support. + +It is strongly recommended to use absolute paths with the B<.include> +directive. Relative paths are evaluated based on the application current +working directory so unless the configuration file containing the +B<.include> directive is application specific the inclusion will not +work as expected. + Each section in a configuration file consists of a number of name and value pairs of the form B @@ -52,6 +67,9 @@ or the B<\> character. By making the last character of a line a B<\> a B string can be spread across multiple lines. In addition the sequences B<\n>, B<\r>, B<\b> and B<\t> are recognized. +All expansion and escape rules as described above that apply to B +also apply to the path of the B<.include> directive. + =head1 OPENSSL LIBRARY CONFIGURATION Applications can automatically configure certain diff --git a/doc/man7/Ed25519.pod b/doc/man7/Ed25519.pod index a75164a1..da6cbc00 100644 --- a/doc/man7/Ed25519.pod +++ b/doc/man7/Ed25519.pod @@ -2,16 +2,18 @@ =head1 NAME -Ed25519 - EVP_PKEY Ed25519 support +Ed25519, +Ed448 +- EVP_PKEY Ed25519 and Ed448 support =head1 DESCRIPTION -The B EVP_PKEY implementation supports key generation, one shot -digest sign and digest verify using PureEdDSA and B (see RFC8032). -It has associated private and public key formats compatible with +The B and B EVP_PKEY implementation supports key generation, +one-shot digest sign and digest verify using PureEdDSA and B or B +(see RFC8032). It has associated private and public key formats compatible with draft-ietf-curdle-pkix-04. -No additional parameters can be set during key generation one shot signing or +No additional parameters can be set during key generation one-shot signing or verification. In particular, because PureEdDSA is used, when signing or verifying a digest must B be specified. @@ -19,20 +21,24 @@ verifying a digest must B be specified. The PureEdDSA algorithm does not support the streaming mechanism of other signature algorithms using, for example, EVP_DigestUpdate(). -The message to sign or verify must be passed using the one shot +The message to sign or verify must be passed using the one-shot EVP_DigestSign() asn EVP_DigestVerify() functions. When calling EVP_DigestSignInit() or EVP_DigestSignUpdate() the digest parameter B be set to B. Applications wishing to sign certificates (or other structures such as -CRLs or certificate requests) using Ed25519 can either use X509_sign() +CRLs or certificate requests) using Ed25519 or Ed448 can either use X509_sign() or X509_sign_ctx() in the usual way. A context for the B algorithm can be obtained by calling: EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_ED25519, NULL); +For the B algorithm a context can be obtained by calling: + + EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_ED448, NULL); + =head1 EXAMPLE This example generates an B private key and writes it to standard @@ -57,7 +63,7 @@ L, =head1 COPYRIGHT -Copyright 2017 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved. Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man7/X25519.pod b/doc/man7/X25519.pod index 96522c50..69ab0b4a 100644 --- a/doc/man7/X25519.pod +++ b/doc/man7/X25519.pod @@ -2,13 +2,15 @@ =head1 NAME -X25519 - EVP_PKEY X25519 support +X25519, +X448 +- EVP_PKEY X25519 and X448 support =head1 DESCRIPTION -The B EVP_PKEY implementation supports key generation and key -derivation using B. It has associated private and public key formats -compatible with draft-ietf-curdle-pkix-03. +The B and B EVP_PKEY implementation supports key generation and +key derivation using B and B. It has associated private and public +key formats compatible with draft-ietf-curdle-pkix-03. No additional parameters can be set during key generation. @@ -21,6 +23,10 @@ A context for the B algorithm can be obtained by calling: EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_X25519, NULL); +For the B algorithm a context can be obtained by calling: + + EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_X448, NULL); + =head1 EXAMPLE This example generates an B private key and writes it to standard @@ -37,7 +43,7 @@ output in PEM format: PEM_write_PrivateKey(stdout, pkey, NULL, NULL, 0, NULL, NULL); The key derivation example in L can be used with -B. +B and B. =head1 SEE ALSO @@ -48,7 +54,7 @@ L =head1 COPYRIGHT -Copyright 2017 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved. Licensed under the OpenSSL license (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man7/ssl.pod b/doc/man7/ssl.pod index f3604bb1..03efc520 100644 --- a/doc/man7/ssl.pod +++ b/doc/man7/ssl.pod @@ -403,6 +403,8 @@ Use the file path to locate trusted CA certificates. =item int B(SSL_CTX *ctx, const char *file, int type); +=item int B(SSL_CTX *ctx, X509 *x, EVP_PKEY *pkey, STACK_OF(X509) *chain, int override); + =item X509 *B(const SSL_CTX *ctx); =item EVP_PKEY *B(const SSL_CTX *ctx); @@ -712,6 +714,8 @@ Returns the current handshake state. =item int B(SSL *ssl, const char *file, int type); +=item int B(SSL *ssl, X509 *x, EVP_PKEY *pkey, STACK_OF(X509) *chain, int override); + =item int B(const SSL *ssl); =item int B(const SSL *ssl); @@ -825,7 +829,7 @@ L =head1 HISTORY -B, B and B where removed +B, B and B were removed in OpenSSL 1.1.0. The return type of B was changed from void to int in diff --git a/doc/test.patch b/doc/test.patch deleted file mode 100644 index 3ed14c6f..00000000 --- a/doc/test.patch +++ /dev/null @@ -1,24 +0,0 @@ ---- ciphers.pod 2018-04-09 02:53:14.337756676 +0900 -+++ ciphers2.pod 2018-04-09 02:53:03.060663965 +0900 -@@ -405,6 +405,21 @@ - - =back - -+=head1 EQUAL PREFERENCE GROUPS -+ -+If configuring a server, one may also configure equal-preference groups to -+partially respect the client's preferences when -+B is enabled. Ciphers in an equal-preference -+group have equal priority and use the client order. This may be used to -+enforce that AEADs are preferred but select AES-GCM vs. ChaCha20-Poly1305 -+based on client preferences. An equal-preference is specified with square -+brackets, combining multiple selectors separated by |. For example: -+ -+ [ECDHE-ECDSA-CHACHA20-POLY1305|ECDHE-ECDSA-AES128-GCM-SHA256] -+ -+ Once an equal-preference group is used, future directives must be -+ opcode-less. -+ - =head1 CIPHER SUITE NAMES - - The following lists give the SSL or TLS cipher suites names from the diff --git a/fuzz/helper.py b/fuzz/helper.py old mode 100755 new mode 100644 diff --git a/fuzz/mkfuzzoids.pl b/fuzz/mkfuzzoids.pl old mode 100755 new mode 100644 diff --git a/fuzz/oids.txt b/fuzz/oids.txt index bb776d61..455c5ee2 100644 --- a/fuzz/oids.txt +++ b/fuzz/oids.txt @@ -1019,3 +1019,26 @@ OBJ_sm3="\x2A\x81\x1C\xCF\x55\x01\x83\x11" OBJ_sm3WithRSAEncryption="\x2A\x81\x1C\xCF\x55\x01\x83\x78" OBJ_sha512_224WithRSAEncryption="\x2A\x86\x48\x86\xF7\x0D\x01\x01\x0F" OBJ_sha512_256WithRSAEncryption="\x2A\x86\x48\x86\xF7\x0D\x01\x01\x10" +OBJ_id_tc26_gost_3410_2012_256_constants="\x2A\x85\x03\x07\x01\x02\x01\x01" +OBJ_id_tc26_gost_3410_2012_256_paramSetA="\x2A\x85\x03\x07\x01\x02\x01\x01\x01" +OBJ_id_tc26_gost_3410_2012_512_paramSetC="\x2A\x85\x03\x07\x01\x02\x01\x02\x03" +OBJ_ISO_UA="\x2A\x86\x24" +OBJ_ua_pki="\x2A\x86\x24\x02\x01\x01\x01" +OBJ_dstu28147="\x2A\x86\x24\x02\x01\x01\x01\x01\x01\x01" +OBJ_dstu28147_ofb="\x2A\x86\x24\x02\x01\x01\x01\x01\x01\x01\x02" +OBJ_dstu28147_cfb="\x2A\x86\x24\x02\x01\x01\x01\x01\x01\x01\x03" +OBJ_dstu28147_wrap="\x2A\x86\x24\x02\x01\x01\x01\x01\x01\x01\x05" +OBJ_hmacWithDstu34311="\x2A\x86\x24\x02\x01\x01\x01\x01\x01\x02" +OBJ_dstu34311="\x2A\x86\x24\x02\x01\x01\x01\x01\x02\x01" +OBJ_dstu4145le="\x2A\x86\x24\x02\x01\x01\x01\x01\x03\x01\x01" +OBJ_dstu4145be="\x2A\x86\x24\x02\x01\x01\x01\x01\x03\x01\x01\x01\x01" +OBJ_uacurve0="\x2A\x86\x24\x02\x01\x01\x01\x01\x03\x01\x01\x02\x00" +OBJ_uacurve1="\x2A\x86\x24\x02\x01\x01\x01\x01\x03\x01\x01\x02\x01" +OBJ_uacurve2="\x2A\x86\x24\x02\x01\x01\x01\x01\x03\x01\x01\x02\x02" +OBJ_uacurve3="\x2A\x86\x24\x02\x01\x01\x01\x01\x03\x01\x01\x02\x03" +OBJ_uacurve4="\x2A\x86\x24\x02\x01\x01\x01\x01\x03\x01\x01\x02\x04" +OBJ_uacurve5="\x2A\x86\x24\x02\x01\x01\x01\x01\x03\x01\x01\x02\x05" +OBJ_uacurve6="\x2A\x86\x24\x02\x01\x01\x01\x01\x03\x01\x01\x02\x06" +OBJ_uacurve7="\x2A\x86\x24\x02\x01\x01\x01\x01\x03\x01\x01\x02\x07" +OBJ_uacurve8="\x2A\x86\x24\x02\x01\x01\x01\x01\x03\x01\x01\x02\x08" +OBJ_uacurve9="\x2A\x86\x24\x02\x01\x01\x01\x01\x03\x01\x01\x02\x09" diff --git a/include/internal/rand.h b/include/internal/rand.h index 471b6b55..9f6b1ab9 100644 --- a/include/internal/rand.h +++ b/include/internal/rand.h @@ -56,6 +56,13 @@ int RAND_DRBG_bytes(RAND_DRBG *drbg, unsigned char *out, size_t outlen); int RAND_DRBG_set_reseed_interval(RAND_DRBG *drbg, unsigned int interval); int RAND_DRBG_set_reseed_time_interval(RAND_DRBG *drbg, time_t interval); +int RAND_DRBG_set_reseed_defaults( + unsigned int master_reseed_interval, + unsigned int slave_reseed_interval, + time_t master_reseed_time_interval, + time_t slave_reseed_time_interval + ); + RAND_DRBG *RAND_DRBG_get0_master(void); RAND_DRBG *RAND_DRBG_get0_public(void); RAND_DRBG *RAND_DRBG_get0_private(void); diff --git a/include/openssl/conferr.h b/include/openssl/conferr.h index d623cea6..d2d0c7ba 100644 --- a/include/openssl/conferr.h +++ b/include/openssl/conferr.h @@ -25,6 +25,7 @@ int ERR_load_CONF_strings(void); # define CONF_F_CONF_PARSE_LIST 119 # define CONF_F_DEF_LOAD 120 # define CONF_F_DEF_LOAD_BIO 121 +# define CONF_F_GET_NEXT_FILE 107 # define CONF_F_MODULE_INIT 115 # define CONF_F_MODULE_LOAD_DSO 117 # define CONF_F_MODULE_RUN 118 @@ -37,6 +38,7 @@ int ERR_load_CONF_strings(void); # define CONF_F_NCONF_LOAD_BIO 110 # define CONF_F_NCONF_LOAD_FP 114 # define CONF_F_NCONF_NEW 111 +# define CONF_F_PROCESS_INCLUDE 116 # define CONF_F_STR_COPY 101 /* @@ -54,6 +56,7 @@ int ERR_load_CONF_strings(void); # define CONF_R_NO_SECTION 107 # define CONF_R_NO_SUCH_FILE 114 # define CONF_R_NO_VALUE 108 +# define CONF_R_RECURSIVE_DIRECTORY_INCLUDE 111 # define CONF_R_UNABLE_TO_CREATE_NEW_SECTION 103 # define CONF_R_UNKNOWN_MODULE_NAME 113 # define CONF_R_VARIABLE_EXPANSION_TOO_LONG 116 diff --git a/include/openssl/ecerr.h b/include/openssl/ecerr.h index 289cd8c5..dbaa8d15 100644 --- a/include/openssl/ecerr.h +++ b/include/openssl/ecerr.h @@ -167,6 +167,8 @@ int ERR_load_EC_strings(void); # define EC_F_OSSL_ECDSA_VERIFY_SIG 250 # define EC_F_PKEY_ECD_CTRL 271 # define EC_F_PKEY_ECD_DIGESTSIGN 272 +# define EC_F_PKEY_ECD_DIGESTSIGN25519 276 +# define EC_F_PKEY_ECD_DIGESTSIGN448 277 # define EC_F_PKEY_ECX_DERIVE 269 # define EC_F_PKEY_EC_CTRL 197 # define EC_F_PKEY_EC_CTRL_STR 198 @@ -174,6 +176,7 @@ int ERR_load_EC_strings(void); # define EC_F_PKEY_EC_KEYGEN 199 # define EC_F_PKEY_EC_PARAMGEN 219 # define EC_F_PKEY_EC_SIGN 218 +# define EC_F_VALIDATE_ECX_DERIVE 278 /* * EC reason codes. diff --git a/include/openssl/err.h b/include/openssl/err.h index a602660c..6d460be3 100644 --- a/include/openssl/err.h +++ b/include/openssl/err.h @@ -166,6 +166,7 @@ typedef struct err_state_st { # define SYS_F_IOCTL 21 # define SYS_F_STAT 22 # define SYS_F_FCNTL 23 +# define SYS_F_FSTAT 24 /* reasons */ # define ERR_R_SYS_LIB ERR_LIB_SYS/* 2 */ diff --git a/include/openssl/evp.h b/include/openssl/evp.h index 268e90f3..9727e9df 100644 --- a/include/openssl/evp.h +++ b/include/openssl/evp.h @@ -59,6 +59,8 @@ # define EVP_PKEY_SIPHASH NID_siphash # define EVP_PKEY_X25519 NID_X25519 # define EVP_PKEY_ED25519 NID_ED25519 +# define EVP_PKEY_X448 NID_X448 +# define EVP_PKEY_ED448 NID_ED448 #ifdef __cplusplus extern "C" { @@ -344,6 +346,8 @@ int (*EVP_CIPHER_meth_get_ctrl(const EVP_CIPHER *cipher))(EVP_CIPHER_CTX *, # define EVP_CTRL_SET_PIPELINE_INPUT_BUFS 0x23 /* Set the input buffer lengths to use for a pipelined operation */ # define EVP_CTRL_SET_PIPELINE_INPUT_LENS 0x24 +# define EVP_CTRL_GET_DRBG 0x25 +# define EVP_CTRL_SET_DRBG 0x26 /* Padding modes */ #define EVP_PADDING_PKCS7 1 diff --git a/include/openssl/obj_mac.h b/include/openssl/obj_mac.h index 4014a49a..b7fd2897 100644 --- a/include/openssl/obj_mac.h +++ b/include/openssl/obj_mac.h @@ -4209,6 +4209,15 @@ #define NID_id_tc26_sign_constants 995 #define OBJ_id_tc26_sign_constants OBJ_id_tc26_constants,1L +#define SN_id_tc26_gost_3410_2012_256_constants "id-tc26-gost-3410-2012-256-constants" +#define NID_id_tc26_gost_3410_2012_256_constants 1147 +#define OBJ_id_tc26_gost_3410_2012_256_constants OBJ_id_tc26_sign_constants,1L + +#define SN_id_tc26_gost_3410_2012_256_paramSetA "id-tc26-gost-3410-2012-256-paramSetA" +#define LN_id_tc26_gost_3410_2012_256_paramSetA "GOST R 34.10-2012 (256 bit) ParamSet A" +#define NID_id_tc26_gost_3410_2012_256_paramSetA 1148 +#define OBJ_id_tc26_gost_3410_2012_256_paramSetA OBJ_id_tc26_gost_3410_2012_256_constants,1L + #define SN_id_tc26_gost_3410_2012_512_constants "id-tc26-gost-3410-2012-512-constants" #define NID_id_tc26_gost_3410_2012_512_constants 996 #define OBJ_id_tc26_gost_3410_2012_512_constants OBJ_id_tc26_sign_constants,2L @@ -4228,6 +4237,11 @@ #define NID_id_tc26_gost_3410_2012_512_paramSetB 999 #define OBJ_id_tc26_gost_3410_2012_512_paramSetB OBJ_id_tc26_gost_3410_2012_512_constants,2L +#define SN_id_tc26_gost_3410_2012_512_paramSetC "id-tc26-gost-3410-2012-512-paramSetC" +#define LN_id_tc26_gost_3410_2012_512_paramSetC "GOST R 34.10-2012 (512 bit) ParamSet C" +#define NID_id_tc26_gost_3410_2012_512_paramSetC 1149 +#define OBJ_id_tc26_gost_3410_2012_512_paramSetC OBJ_id_tc26_gost_3410_2012_512_constants,3L + #define SN_id_tc26_digest_constants "id-tc26-digest-constants" #define NID_id_tc26_digest_constants 1000 #define OBJ_id_tc26_digest_constants OBJ_id_tc26_constants,2L @@ -4983,3 +4997,101 @@ #define SN_ffdhe8192 "ffdhe8192" #define NID_ffdhe8192 1130 + +#define SN_ISO_UA "ISO-UA" +#define NID_ISO_UA 1150 +#define OBJ_ISO_UA OBJ_member_body,804L + +#define SN_ua_pki "ua-pki" +#define NID_ua_pki 1151 +#define OBJ_ua_pki OBJ_ISO_UA,2L,1L,1L,1L + +#define SN_dstu28147 "dstu28147" +#define LN_dstu28147 "DSTU Gost 28147-2009" +#define NID_dstu28147 1152 +#define OBJ_dstu28147 OBJ_ua_pki,1L,1L,1L + +#define SN_dstu28147_ofb "dstu28147-ofb" +#define LN_dstu28147_ofb "DSTU Gost 28147-2009 OFB mode" +#define NID_dstu28147_ofb 1153 +#define OBJ_dstu28147_ofb OBJ_dstu28147,2L + +#define SN_dstu28147_cfb "dstu28147-cfb" +#define LN_dstu28147_cfb "DSTU Gost 28147-2009 CFB mode" +#define NID_dstu28147_cfb 1154 +#define OBJ_dstu28147_cfb OBJ_dstu28147,3L + +#define SN_dstu28147_wrap "dstu28147-wrap" +#define LN_dstu28147_wrap "DSTU Gost 28147-2009 key wrap" +#define NID_dstu28147_wrap 1155 +#define OBJ_dstu28147_wrap OBJ_dstu28147,5L + +#define SN_hmacWithDstu34311 "hmacWithDstu34311" +#define LN_hmacWithDstu34311 "HMAC DSTU Gost 34311-95" +#define NID_hmacWithDstu34311 1156 +#define OBJ_hmacWithDstu34311 OBJ_ua_pki,1L,1L,2L + +#define SN_dstu34311 "dstu34311" +#define LN_dstu34311 "DSTU Gost 34311-95" +#define NID_dstu34311 1157 +#define OBJ_dstu34311 OBJ_ua_pki,1L,2L,1L + +#define SN_dstu4145le "dstu4145le" +#define LN_dstu4145le "DSTU 4145-2002 little endian" +#define NID_dstu4145le 1158 +#define OBJ_dstu4145le OBJ_ua_pki,1L,3L,1L,1L + +#define SN_dstu4145be "dstu4145be" +#define LN_dstu4145be "DSTU 4145-2002 big endian" +#define NID_dstu4145be 1159 +#define OBJ_dstu4145be OBJ_dstu4145le,1L,1L + +#define SN_uacurve0 "uacurve0" +#define LN_uacurve0 "DSTU curve 0" +#define NID_uacurve0 1160 +#define OBJ_uacurve0 OBJ_dstu4145le,2L,0L + +#define SN_uacurve1 "uacurve1" +#define LN_uacurve1 "DSTU curve 1" +#define NID_uacurve1 1161 +#define OBJ_uacurve1 OBJ_dstu4145le,2L,1L + +#define SN_uacurve2 "uacurve2" +#define LN_uacurve2 "DSTU curve 2" +#define NID_uacurve2 1162 +#define OBJ_uacurve2 OBJ_dstu4145le,2L,2L + +#define SN_uacurve3 "uacurve3" +#define LN_uacurve3 "DSTU curve 3" +#define NID_uacurve3 1163 +#define OBJ_uacurve3 OBJ_dstu4145le,2L,3L + +#define SN_uacurve4 "uacurve4" +#define LN_uacurve4 "DSTU curve 4" +#define NID_uacurve4 1164 +#define OBJ_uacurve4 OBJ_dstu4145le,2L,4L + +#define SN_uacurve5 "uacurve5" +#define LN_uacurve5 "DSTU curve 5" +#define NID_uacurve5 1165 +#define OBJ_uacurve5 OBJ_dstu4145le,2L,5L + +#define SN_uacurve6 "uacurve6" +#define LN_uacurve6 "DSTU curve 6" +#define NID_uacurve6 1166 +#define OBJ_uacurve6 OBJ_dstu4145le,2L,6L + +#define SN_uacurve7 "uacurve7" +#define LN_uacurve7 "DSTU curve 7" +#define NID_uacurve7 1167 +#define OBJ_uacurve7 OBJ_dstu4145le,2L,7L + +#define SN_uacurve8 "uacurve8" +#define LN_uacurve8 "DSTU curve 8" +#define NID_uacurve8 1168 +#define OBJ_uacurve8 OBJ_dstu4145le,2L,8L + +#define SN_uacurve9 "uacurve9" +#define LN_uacurve9 "DSTU curve 9" +#define NID_uacurve9 1169 +#define OBJ_uacurve9 OBJ_dstu4145le,2L,9L diff --git a/include/openssl/opensslconf.h.in b/include/openssl/opensslconf.h.in index 16aa82e6..dc36a74f 100644 --- a/include/openssl/opensslconf.h.in +++ b/include/openssl/opensslconf.h.in @@ -30,7 +30,7 @@ extern "C" { } foreach (@{$config{openssl_api_defines}}) { (my $macro, my $value) = $_ =~ /^(.*?)=(.*?)$/; - $OUT .= "#define OPENSSL_MIN_API $value\n"; + $OUT .= "#define $macro $value\n"; } if (@{$config{openssl_algorithm_defines}}) { foreach (@{$config{openssl_algorithm_defines}}) { diff --git a/include/openssl/opensslv.h b/include/openssl/opensslv.h index 3de3776b..32b6f4d4 100644 --- a/include/openssl/opensslv.h +++ b/include/openssl/opensslv.h @@ -39,8 +39,8 @@ extern "C" { * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for * major minor fix final patch/beta) */ -# define OPENSSL_VERSION_NUMBER 0x10101002L -# define OPENSSL_VERSION_TEXT "OpenSSL 1.1.1-pre2 (alpha) 27 Feb 2018" +# define OPENSSL_VERSION_NUMBER 0x10101003L +# define OPENSSL_VERSION_TEXT "OpenSSL 1.1.1-pre3-dev xx XXX xxxx" #define OPENSSL_MAKE_VERSION(maj,min,fix,patch) ((0x10000000L)+((maj&0xff)<<20)+((min&0xff)<<12)+((fix&0xff)<<4)+patch) diff --git a/include/openssl/randerr.h b/include/openssl/randerr.h index 4cfc06d9..81bda4ba 100644 --- a/include/openssl/randerr.h +++ b/include/openssl/randerr.h @@ -26,6 +26,7 @@ int ERR_load_RAND_strings(void); # define RAND_F_RAND_BYTES 100 # define RAND_F_RAND_DRBG_ENABLE_LOCKING 119 # define RAND_F_RAND_DRBG_GENERATE 107 +# define RAND_F_RAND_DRBG_GET_ENTROPY 120 # define RAND_F_RAND_DRBG_INSTANTIATE 108 # define RAND_F_RAND_DRBG_NEW 109 # define RAND_F_RAND_DRBG_RESEED 110 @@ -67,6 +68,7 @@ int ERR_load_RAND_strings(void); # define RAND_R_NOT_INSTANTIATED 115 # define RAND_R_NO_DRBG_IMPLEMENTATION_SELECTED 128 # define RAND_R_PARENT_LOCKING_NOT_ENABLED 130 +# define RAND_R_PARENT_STRENGTH_TOO_WEAK 131 # define RAND_R_PERSONALISATION_STRING_TOO_LONG 116 # define RAND_R_PRNG_NOT_SEEDED 100 # define RAND_R_RANDOM_POOL_OVERFLOW 125 diff --git a/include/openssl/srp.h b/include/openssl/srp.h index f2b6ec75..aaf13558 100644 --- a/include/openssl/srp.h +++ b/include/openssl/srp.h @@ -1,10 +1,14 @@ /* - * Copyright 2011-2016 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2004-2018 The OpenSSL Project Authors. All Rights Reserved. + * Copyright (c) 2004, EdelKey Project. All Rights Reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy * in the file LICENSE in the source distribution or at * https://www.openssl.org/source/license.html + * + * Originally written by Christophe Renou and Peter Sylvester, + * for the EdelKey project. */ #ifndef HEADER_SRP_H diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h index 825490b5..ec29405c 100644 --- a/include/openssl/ssl.h +++ b/include/openssl/ssl.h @@ -546,8 +546,8 @@ typedef int (*SSL_verify_cb)(int preverify_ok, X509_STORE_CTX *x509_ctx); # define SSL_CONF_TYPE_DIR 0x3 # define SSL_CONF_TYPE_NONE 0x4 -/* Length of a TLSv1.3 cookie */ -# define SSL_COOKIE_LENGTH 255 +/* Maximum length of the application-controlled segment of a a TLSv1.3 cookie */ +# define SSL_COOKIE_LENGTH 4096 /* * Note: SSL[_CTX]_set_{options,mode} use |= op on the previous value, they @@ -726,6 +726,17 @@ void SSL_CTX_set_cookie_verify_cb(SSL_CTX *ctx, *cookie, unsigned int cookie_len)); + +void SSL_CTX_set_stateless_cookie_generate_cb( + SSL_CTX *ctx, + int (*gen_stateless_cookie_cb) (SSL *ssl, + unsigned char *cookie, + size_t *cookie_len)); +void SSL_CTX_set_stateless_cookie_verify_cb( + SSL_CTX *ctx, + int (*verify_stateless_cookie_cb) (SSL *ssl, + const unsigned char *cookie, + size_t cookie_len)); # ifndef OPENSSL_NO_NEXTPROTONEG typedef int (*SSL_CTX_npn_advertised_cb_func)(SSL *ssl, @@ -1505,6 +1516,8 @@ __owur int SSL_use_PrivateKey_ASN1(int pk, SSL *ssl, const unsigned char *d, long len); __owur int SSL_use_certificate(SSL *ssl, X509 *x); __owur int SSL_use_certificate_ASN1(SSL *ssl, const unsigned char *d, int len); +__owur int SSL_use_cert_and_key(SSL *ssl, X509 *x509, EVP_PKEY *privatekey, + STACK_OF(X509) *chain, int override); /* serverinfo file format versions */ @@ -1634,6 +1647,8 @@ __owur int SSL_CTX_use_PrivateKey_ASN1(int pk, SSL_CTX *ctx, __owur int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x); __owur int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, const unsigned char *d); +__owur int SSL_CTX_use_cert_and_key(SSL_CTX *ctx, X509 *x509, EVP_PKEY *privatekey, + STACK_OF(X509) *chain, int override); void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb); void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx, void *u); @@ -2290,6 +2305,38 @@ __owur const struct openssl_ssl_test_functions *SSL_test_functions(void); __owur int SSL_free_buffers(SSL *ssl); __owur int SSL_alloc_buffers(SSL *ssl); +/* Return codes for tls_get_ticket_from_client() and tls_decrypt_ticket() */ +typedef int SSL_TICKET_RETURN; + +/* Support for ticket appdata */ +/* fatal error, malloc failure */ +# define SSL_TICKET_FATAL_ERR_MALLOC 0 +/* fatal error, either from parsing or decrypting the ticket */ +# define SSL_TICKET_FATAL_ERR_OTHER 1 +/* No ticket present */ +# define SSL_TICKET_NONE 2 +/* Empty ticket present */ +# define SSL_TICKET_EMPTY 3 +/* the ticket couldn't be decrypted */ +# define SSL_TICKET_NO_DECRYPT 4 +/* a ticket was successfully decrypted */ +# define SSL_TICKET_SUCCESS 5 +/* same as above but the ticket needs to be renewed */ +# define SSL_TICKET_SUCCESS_RENEW 6 + +typedef int (*SSL_CTX_generate_session_ticket_fn)(SSL *s, void *arg); +typedef SSL_TICKET_RETURN (*SSL_CTX_decrypt_session_ticket_fn)(SSL *s, SSL_SESSION *ss, + const unsigned char *keyname, + size_t keyname_length, + SSL_TICKET_RETURN retv, + void *arg); +int SSL_CTX_set_session_ticket_cb(SSL_CTX *ctx, + SSL_CTX_generate_session_ticket_fn gen_cb, + SSL_CTX_decrypt_session_ticket_fn dec_cb, + void *arg); +int SSL_SESSION_set1_ticket_appdata(SSL_SESSION *ss, const void *data, size_t len); +int SSL_SESSION_get0_ticket_appdata(SSL_SESSION *ss, void **data, size_t *len); + extern const char SSL_version_str[]; diff --git a/include/openssl/ssl3.h b/include/openssl/ssl3.h index 7518f681..6d0ed11b 100644 --- a/include/openssl/ssl3.h +++ b/include/openssl/ssl3.h @@ -299,7 +299,9 @@ extern "C" { # define SSL3_MT_CERTIFICATE_VERIFY 15 # define SSL3_MT_CLIENT_KEY_EXCHANGE 16 # define SSL3_MT_FINISHED 20 +# define SSL3_MT_CERTIFICATE_URL 21 # define SSL3_MT_CERTIFICATE_STATUS 22 +# define SSL3_MT_SUPPLEMENTAL_DATA 23 # define SSL3_MT_KEY_UPDATE 24 # ifndef OPENSSL_NO_NEXTPROTONEG # define SSL3_MT_NEXT_PROTO 67 diff --git a/include/openssl/sslerr.h b/include/openssl/sslerr.h index a3b58191..1373a486 100644 --- a/include/openssl/sslerr.h +++ b/include/openssl/sslerr.h @@ -211,6 +211,7 @@ int ERR_load_SSL_strings(void); # define SSL_F_SSL_SESSION_SET1_ID_CONTEXT 312 # define SSL_F_SSL_SET_ALPN_PROTOS 344 # define SSL_F_SSL_SET_CERT 191 +# define SSL_F_SSL_SET_CERT_AND_KEY 621 # define SSL_F_SSL_SET_CIPHER_LIST 271 # define SSL_F_SSL_SET_CT_VALIDATION_CALLBACK 399 # define SSL_F_SSL_SET_FD 192 @@ -566,6 +567,7 @@ int ERR_load_SSL_strings(void); # define SSL_R_MISSING_DSA_SIGNING_CERT 165 # define SSL_R_MISSING_ECDSA_SIGNING_CERT 381 # define SSL_R_MISSING_FATAL 256 +# define SSL_R_MISSING_PARAMETERS 290 # define SSL_R_MISSING_RSA_CERTIFICATE 168 # define SSL_R_MISSING_RSA_ENCRYPTING_CERT 169 # define SSL_R_MISSING_RSA_SIGNING_CERT 170 @@ -578,6 +580,7 @@ int ERR_load_SSL_strings(void); # define SSL_R_MIXED_SPECIAL_OPERATOR_WITH_GROUPS 101 # define SSL_R_NESTED_GROUP 108 # define SSL_R_NOT_ON_RECORD_BOUNDARY 182 +# define SSL_R_NOT_REPLACING_CERTIFICATE 289 # define SSL_R_NOT_SERVER 284 # define SSL_R_NO_APPLICATION_PROTOCOL 235 # define SSL_R_NO_CERTIFICATES_RETURNED 176 @@ -589,6 +592,7 @@ int ERR_load_SSL_strings(void); # define SSL_R_NO_CIPHER_MATCH 185 # define SSL_R_NO_CLIENT_CERT_METHOD 331 # define SSL_R_NO_COMPRESSION_SPECIFIED 187 +# define SSL_R_NO_COOKIE_CALLBACK_SET 287 # define SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER 330 # define SSL_R_NO_METHOD_SPECIFIED 188 # define SSL_R_NO_PEM_EXTENSIONS 389 @@ -617,6 +621,7 @@ int ERR_load_SSL_strings(void); # define SSL_R_PEM_NAME_TOO_SHORT 392 # define SSL_R_PIPELINE_FAILURE 406 # define SSL_R_POST_HANDSHAKE_AUTH_ENCODING_ERR 278 +# define SSL_R_PRIVATE_KEY_MISMATCH 288 # define SSL_R_PROTOCOL_IS_SHUTDOWN 207 # define SSL_R_PSK_IDENTITY_NOT_FOUND 223 # define SSL_R_PSK_NO_CLIENT_CB 224 diff --git a/include/openssl/sslerr.h.orig b/include/openssl/sslerr.h.orig new file mode 100644 index 00000000..454877df --- /dev/null +++ b/include/openssl/sslerr.h.orig @@ -0,0 +1,746 @@ +/* + * Generated by util/mkerr.pl DO NOT EDIT + * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the OpenSSL license (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#ifndef HEADER_SSLERR_H +# define HEADER_SSLERR_H + +# ifdef __cplusplus +extern "C" +# endif +int ERR_load_SSL_strings(void); + +/* + * SSL function codes. + */ +# define SSL_F_ADD_CLIENT_KEY_SHARE_EXT 438 +# define SSL_F_ADD_KEY_SHARE 512 +# define SSL_F_BYTES_TO_CIPHER_LIST 519 +# define SSL_F_CHECK_SUITEB_CIPHER_LIST 331 +# define SSL_F_CONSTRUCT_CA_NAMES 552 +# define SSL_F_CONSTRUCT_KEY_EXCHANGE_TBS 553 +# define SSL_F_CREATE_SYNTHETIC_MESSAGE_HASH 539 +# define SSL_F_CT_MOVE_SCTS 345 +# define SSL_F_CT_STRICT 349 +# define SSL_F_CUSTOM_EXT_ADD 554 +# define SSL_F_CUSTOM_EXT_PARSE 555 +# define SSL_F_D2I_SSL_SESSION 103 +# define SSL_F_DANE_CTX_ENABLE 347 +# define SSL_F_DANE_MTYPE_SET 393 +# define SSL_F_DANE_TLSA_ADD 394 +# define SSL_F_DERIVE_SECRET_KEY_AND_IV 514 +# define SSL_F_DO_DTLS1_WRITE 245 +# define SSL_F_DO_SSL3_WRITE 104 +# define SSL_F_DTLS1_BUFFER_RECORD 247 +# define SSL_F_DTLS1_CHECK_TIMEOUT_NUM 318 +# define SSL_F_DTLS1_HEARTBEAT 305 +# define SSL_F_DTLS1_PREPROCESS_FRAGMENT 288 +# define SSL_F_DTLS1_PROCESS_BUFFERED_RECORDS 424 +# define SSL_F_DTLS1_PROCESS_RECORD 257 +# define SSL_F_DTLS1_READ_BYTES 258 +# define SSL_F_DTLS1_READ_FAILED 339 +# define SSL_F_DTLS1_RETRANSMIT_MESSAGE 390 +# define SSL_F_DTLS1_WRITE_APP_DATA_BYTES 268 +# define SSL_F_DTLS1_WRITE_BYTES 545 +# define SSL_F_DTLSV1_LISTEN 350 +# define SSL_F_DTLS_CONSTRUCT_CHANGE_CIPHER_SPEC 371 +# define SSL_F_DTLS_CONSTRUCT_HELLO_VERIFY_REQUEST 385 +# define SSL_F_DTLS_GET_REASSEMBLED_MESSAGE 370 +# define SSL_F_DTLS_PROCESS_HELLO_VERIFY 386 +# define SSL_F_DTLS_WAIT_FOR_DRY 592 +# define SSL_F_EARLY_DATA_COUNT_OK 532 +# define SSL_F_FINAL_EARLY_DATA 556 +# define SSL_F_FINAL_EC_PT_FORMATS 485 +# define SSL_F_FINAL_EMS 486 +# define SSL_F_FINAL_KEY_SHARE 503 +# define SSL_F_FINAL_MAXFRAGMENTLEN 557 +# define SSL_F_FINAL_RENEGOTIATE 483 +# define SSL_F_FINAL_SERVER_NAME 558 +# define SSL_F_FINAL_SIG_ALGS 497 +# define SSL_F_GET_CERT_VERIFY_TBS_DATA 588 +# define SSL_F_NSS_KEYLOG_INT 500 +# define SSL_F_OPENSSL_INIT_SSL 342 +# define SSL_F_OSSL_STATEM_CLIENT13_READ_TRANSITION 436 +# define SSL_F_OSSL_STATEM_CLIENT13_WRITE_TRANSITION 598 +# define SSL_F_OSSL_STATEM_CLIENT_CONSTRUCT_MESSAGE 430 +# define SSL_F_OSSL_STATEM_CLIENT_POST_PROCESS_MESSAGE 593 +# define SSL_F_OSSL_STATEM_CLIENT_PROCESS_MESSAGE 594 +# define SSL_F_OSSL_STATEM_CLIENT_READ_TRANSITION 417 +# define SSL_F_OSSL_STATEM_CLIENT_WRITE_TRANSITION 599 +# define SSL_F_OSSL_STATEM_SERVER13_READ_TRANSITION 437 +# define SSL_F_OSSL_STATEM_SERVER13_WRITE_TRANSITION 600 +# define SSL_F_OSSL_STATEM_SERVER_CONSTRUCT_MESSAGE 431 +# define SSL_F_OSSL_STATEM_SERVER_POST_PROCESS_MESSAGE 601 +# define SSL_F_OSSL_STATEM_SERVER_POST_WORK 602 +# define SSL_F_OSSL_STATEM_SERVER_PROCESS_MESSAGE 603 +# define SSL_F_OSSL_STATEM_SERVER_READ_TRANSITION 418 +# define SSL_F_OSSL_STATEM_SERVER_WRITE_TRANSITION 604 +# define SSL_F_PARSE_CA_NAMES 541 +# define SSL_F_PROCESS_KEY_SHARE_EXT 439 +# define SSL_F_READ_STATE_MACHINE 352 +# define SSL_F_SET_CLIENT_CIPHERSUITE 540 +# define SSL_F_SRP_GENERATE_CLIENT_MASTER_SECRET 595 +# define SSL_F_SRP_GENERATE_SERVER_MASTER_SECRET 589 +# define SSL_F_SRP_VERIFY_SERVER_PARAM 596 +# define SSL_F_SSL3_CHANGE_CIPHER_STATE 129 +# define SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM 130 +# define SSL_F_SSL3_CTRL 213 +# define SSL_F_SSL3_CTX_CTRL 133 +# define SSL_F_SSL3_DIGEST_CACHED_RECORDS 293 +# define SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC 292 +# define SSL_F_SSL3_ENC 608 +# define SSL_F_SSL3_FINAL_FINISH_MAC 285 +# define SSL_F_SSL3_FINISH_MAC 587 +# define SSL_F_SSL3_GENERATE_KEY_BLOCK 238 +# define SSL_F_SSL3_GENERATE_MASTER_SECRET 388 +# define SSL_F_SSL3_GET_RECORD 143 +# define SSL_F_SSL3_INIT_FINISHED_MAC 397 +# define SSL_F_SSL3_OUTPUT_CERT_CHAIN 147 +# define SSL_F_SSL3_READ_BYTES 148 +# define SSL_F_SSL3_READ_N 149 +# define SSL_F_SSL3_SETUP_KEY_BLOCK 157 +# define SSL_F_SSL3_SETUP_READ_BUFFER 156 +# define SSL_F_SSL3_SETUP_WRITE_BUFFER 291 +# define SSL_F_SSL3_WRITE_BYTES 158 +# define SSL_F_SSL3_WRITE_PENDING 159 +# define SSL_F_SSL_ADD_CERT_CHAIN 316 +# define SSL_F_SSL_ADD_CERT_TO_BUF 319 +# define SSL_F_SSL_ADD_CERT_TO_WPACKET 493 +# define SSL_F_SSL_ADD_CLIENTHELLO_RENEGOTIATE_EXT 298 +# define SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT 277 +# define SSL_F_SSL_ADD_CLIENTHELLO_USE_SRTP_EXT 307 +# define SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK 215 +# define SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK 216 +# define SSL_F_SSL_ADD_SERVERHELLO_RENEGOTIATE_EXT 299 +# define SSL_F_SSL_ADD_SERVERHELLO_TLSEXT 278 +# define SSL_F_SSL_ADD_SERVERHELLO_USE_SRTP_EXT 308 +# define SSL_F_SSL_BAD_METHOD 160 +# define SSL_F_SSL_BUILD_CERT_CHAIN 332 +# define SSL_F_SSL_BYTES_TO_CIPHER_LIST 161 +# define SSL_F_SSL_CACHE_CIPHERLIST 520 +# define SSL_F_SSL_CERT_ADD0_CHAIN_CERT 346 +# define SSL_F_SSL_CERT_DUP 221 +# define SSL_F_SSL_CERT_NEW 162 +# define SSL_F_SSL_CERT_SET0_CHAIN 340 +# define SSL_F_SSL_CHECK_PRIVATE_KEY 163 +# define SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT 280 +# define SSL_F_SSL_CHECK_SRP_EXT_CLIENTHELLO 606 +# define SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG 279 +# define SSL_F_SSL_CHOOSE_CLIENT_VERSION 607 +# define SSL_F_SSL_CIPHER_LIST_TO_BYTES 425 +# define SSL_F_SSL_CIPHER_PROCESS_RULESTR 230 +# define SSL_F_SSL_CIPHER_STRENGTH_SORT 231 +# define SSL_F_SSL_CLEAR 164 +# define SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD 165 +# define SSL_F_SSL_CONF_CMD 334 +# define SSL_F_SSL_CREATE_CIPHER_LIST 166 +# define SSL_F_SSL_CTRL 232 +# define SSL_F_SSL_CTX_CHECK_PRIVATE_KEY 168 +# define SSL_F_SSL_CTX_ENABLE_CT 398 +# define SSL_F_SSL_CTX_MAKE_PROFILES 309 +# define SSL_F_SSL_CTX_NEW 169 +# define SSL_F_SSL_CTX_SET_ALPN_PROTOS 343 +# define SSL_F_SSL_CTX_SET_CIPHER_LIST 269 +# define SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE 290 +# define SSL_F_SSL_CTX_SET_CT_VALIDATION_CALLBACK 396 +# define SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT 219 +# define SSL_F_SSL_CTX_SET_SSL_VERSION 170 +# define SSL_F_SSL_CTX_SET_TLSEXT_MAX_FRAGMENT_LENGTH 551 +# define SSL_F_SSL_CTX_USE_CERTIFICATE 171 +# define SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1 172 +# define SSL_F_SSL_CTX_USE_CERTIFICATE_FILE 173 +# define SSL_F_SSL_CTX_USE_PRIVATEKEY 174 +# define SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1 175 +# define SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE 176 +# define SSL_F_SSL_CTX_USE_PSK_IDENTITY_HINT 272 +# define SSL_F_SSL_CTX_USE_RSAPRIVATEKEY 177 +# define SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1 178 +# define SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE 179 +# define SSL_F_SSL_CTX_USE_SERVERINFO 336 +# define SSL_F_SSL_CTX_USE_SERVERINFO_EX 543 +# define SSL_F_SSL_CTX_USE_SERVERINFO_FILE 337 +# define SSL_F_SSL_DANE_DUP 403 +# define SSL_F_SSL_DANE_ENABLE 395 +# define SSL_F_SSL_DERIVE 590 +# define SSL_F_SSL_DO_CONFIG 391 +# define SSL_F_SSL_DO_HANDSHAKE 180 +# define SSL_F_SSL_DUP_CA_LIST 408 +# define SSL_F_SSL_ENABLE_CT 402 +# define SSL_F_SSL_GENERATE_PKEY_GROUP 559 +# define SSL_F_SSL_GENERATE_SESSION_ID 547 +# define SSL_F_SSL_GET_NEW_SESSION 181 +# define SSL_F_SSL_GET_PREV_SESSION 217 +# define SSL_F_SSL_GET_SERVER_CERT_INDEX 322 +# define SSL_F_SSL_GET_SIGN_PKEY 183 +# define SSL_F_SSL_HANDSHAKE_HASH 560 +# define SSL_F_SSL_INIT_WBIO_BUFFER 184 +# define SSL_F_SSL_KEY_UPDATE 515 +# define SSL_F_SSL_LOAD_CLIENT_CA_FILE 185 +# define SSL_F_SSL_LOG_MASTER_SECRET 498 +# define SSL_F_SSL_LOG_RSA_CLIENT_KEY_EXCHANGE 499 +# define SSL_F_SSL_MODULE_INIT 392 +# define SSL_F_SSL_NEW 186 +# define SSL_F_SSL_NEXT_PROTO_VALIDATE 565 +# define SSL_F_SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT 300 +# define SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT 302 +# define SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT 310 +# define SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT 301 +# define SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT 303 +# define SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT 311 +# define SSL_F_SSL_PEEK 270 +# define SSL_F_SSL_PEEK_EX 432 +# define SSL_F_SSL_PEEK_INTERNAL 522 +# define SSL_F_SSL_READ 223 +# define SSL_F_SSL_READ_EARLY_DATA 529 +# define SSL_F_SSL_READ_EX 434 +# define SSL_F_SSL_READ_INTERNAL 523 +# define SSL_F_SSL_RENEGOTIATE 516 +# define SSL_F_SSL_RENEGOTIATE_ABBREVIATED 546 +# define SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT 320 +# define SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT 321 +# define SSL_F_SSL_SESSION_DUP 348 +# define SSL_F_SSL_SESSION_NEW 189 +# define SSL_F_SSL_SESSION_PRINT_FP 190 +# define SSL_F_SSL_SESSION_SET1_ID 423 +# define SSL_F_SSL_SESSION_SET1_ID_CONTEXT 312 +# define SSL_F_SSL_SET_ALPN_PROTOS 344 +# define SSL_F_SSL_SET_CERT 191 +# define SSL_F_SSL_SET_CERT_AND_KEY 621 +# define SSL_F_SSL_SET_CIPHER_LIST 271 +# define SSL_F_SSL_SET_CT_VALIDATION_CALLBACK 399 +# define SSL_F_SSL_SET_FD 192 +# define SSL_F_SSL_SET_PKEY 193 +# define SSL_F_SSL_SET_RFD 194 +# define SSL_F_SSL_SET_SESSION 195 +# define SSL_F_SSL_SET_SESSION_ID_CONTEXT 218 +# define SSL_F_SSL_SET_SESSION_TICKET_EXT 294 +# define SSL_F_SSL_SET_TLSEXT_MAX_FRAGMENT_LENGTH 550 +# define SSL_F_SSL_SET_WFD 196 +# define SSL_F_SSL_SHUTDOWN 224 +# define SSL_F_SSL_SRP_CTX_INIT 313 +# define SSL_F_SSL_START_ASYNC_JOB 389 +# define SSL_F_SSL_UNDEFINED_FUNCTION 197 +# define SSL_F_SSL_UNDEFINED_VOID_FUNCTION 244 +# define SSL_F_SSL_USE_CERTIFICATE 198 +# define SSL_F_SSL_USE_CERTIFICATE_ASN1 199 +# define SSL_F_SSL_USE_CERTIFICATE_FILE 200 +# define SSL_F_SSL_USE_PRIVATEKEY 201 +# define SSL_F_SSL_USE_PRIVATEKEY_ASN1 202 +# define SSL_F_SSL_USE_PRIVATEKEY_FILE 203 +# define SSL_F_SSL_USE_PSK_IDENTITY_HINT 273 +# define SSL_F_SSL_USE_RSAPRIVATEKEY 204 +# define SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1 205 +# define SSL_F_SSL_USE_RSAPRIVATEKEY_FILE 206 +# define SSL_F_SSL_VALIDATE_CT 400 +# define SSL_F_SSL_VERIFY_CERT_CHAIN 207 +# define SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE 616 +# define SSL_F_SSL_WRITE 208 +# define SSL_F_SSL_WRITE_EARLY_DATA 526 +# define SSL_F_SSL_WRITE_EARLY_FINISH 527 +# define SSL_F_SSL_WRITE_EX 433 +# define SSL_F_SSL_WRITE_INTERNAL 524 +# define SSL_F_STATE_MACHINE 353 +# define SSL_F_TLS12_CHECK_PEER_SIGALG 333 +# define SSL_F_TLS12_COPY_SIGALGS 533 +# define SSL_F_TLS13_CHANGE_CIPHER_STATE 440 +# define SSL_F_TLS13_ENC 609 +# define SSL_F_TLS13_FINAL_FINISH_MAC 605 +# define SSL_F_TLS13_GENERATE_SECRET 591 +# define SSL_F_TLS13_HKDF_EXPAND 561 +# define SSL_F_TLS13_RESTORE_HANDSHAKE_DIGEST_FOR_PHA 617 +# define SSL_F_TLS13_SAVE_HANDSHAKE_DIGEST_FOR_PHA 618 +# define SSL_F_TLS13_SETUP_KEY_BLOCK 441 +# define SSL_F_TLS1_CHANGE_CIPHER_STATE 209 +# define SSL_F_TLS1_CHECK_DUPLICATE_EXTENSIONS 341 +# define SSL_F_TLS1_ENC 401 +# define SSL_F_TLS1_EXPORT_KEYING_MATERIAL 314 +# define SSL_F_TLS1_GET_CURVELIST 338 +# define SSL_F_TLS1_PRF 284 +# define SSL_F_TLS1_SETUP_KEY_BLOCK 211 +# define SSL_F_TLS1_SET_SERVER_SIGALGS 335 +# define SSL_F_TLS_CHOOSE_SIGALG 513 +# define SSL_F_TLS_CLIENT_KEY_EXCHANGE_POST_WORK 354 +# define SSL_F_TLS_COLLECT_EXTENSIONS 435 +# define SSL_F_TLS_CONSTRUCT_CERTIFICATE_AUTHORITIES 542 +# define SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST 372 +# define SSL_F_TLS_CONSTRUCT_CERT_STATUS 429 +# define SSL_F_TLS_CONSTRUCT_CERT_STATUS_BODY 494 +# define SSL_F_TLS_CONSTRUCT_CERT_VERIFY 496 +# define SSL_F_TLS_CONSTRUCT_CHANGE_CIPHER_SPEC 427 +# define SSL_F_TLS_CONSTRUCT_CKE_DHE 404 +# define SSL_F_TLS_CONSTRUCT_CKE_ECDHE 405 +# define SSL_F_TLS_CONSTRUCT_CKE_GOST 406 +# define SSL_F_TLS_CONSTRUCT_CKE_PSK_PREAMBLE 407 +# define SSL_F_TLS_CONSTRUCT_CKE_RSA 409 +# define SSL_F_TLS_CONSTRUCT_CKE_SRP 410 +# define SSL_F_TLS_CONSTRUCT_CLIENT_CERTIFICATE 484 +# define SSL_F_TLS_CONSTRUCT_CLIENT_HELLO 487 +# define SSL_F_TLS_CONSTRUCT_CLIENT_KEY_EXCHANGE 488 +# define SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY 489 +# define SSL_F_TLS_CONSTRUCT_CTOS_ALPN 466 +# define SSL_F_TLS_CONSTRUCT_CTOS_CERTIFICATE 355 +# define SSL_F_TLS_CONSTRUCT_CTOS_COOKIE 535 +# define SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA 530 +# define SSL_F_TLS_CONSTRUCT_CTOS_EC_PT_FORMATS 467 +# define SSL_F_TLS_CONSTRUCT_CTOS_EMS 468 +# define SSL_F_TLS_CONSTRUCT_CTOS_ETM 469 +# define SSL_F_TLS_CONSTRUCT_CTOS_HELLO 356 +# define SSL_F_TLS_CONSTRUCT_CTOS_KEY_EXCHANGE 357 +# define SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE 470 +# define SSL_F_TLS_CONSTRUCT_CTOS_MAXFRAGMENTLEN 549 +# define SSL_F_TLS_CONSTRUCT_CTOS_NPN 471 +# define SSL_F_TLS_CONSTRUCT_CTOS_PADDING 472 +# define SSL_F_TLS_CONSTRUCT_CTOS_POST_HANDSHAKE_AUTH 619 +# define SSL_F_TLS_CONSTRUCT_CTOS_PSK 501 +# define SSL_F_TLS_CONSTRUCT_CTOS_PSK_KEX_MODES 509 +# define SSL_F_TLS_CONSTRUCT_CTOS_RENEGOTIATE 473 +# define SSL_F_TLS_CONSTRUCT_CTOS_SCT 474 +# define SSL_F_TLS_CONSTRUCT_CTOS_SERVER_NAME 475 +# define SSL_F_TLS_CONSTRUCT_CTOS_SESSION_TICKET 476 +# define SSL_F_TLS_CONSTRUCT_CTOS_SIG_ALGS 477 +# define SSL_F_TLS_CONSTRUCT_CTOS_SRP 478 +# define SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST 479 +# define SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS 480 +# define SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS 481 +# define SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP 482 +# define SSL_F_TLS_CONSTRUCT_CTOS_VERIFY 358 +# define SSL_F_TLS_CONSTRUCT_ENCRYPTED_EXTENSIONS 443 +# define SSL_F_TLS_CONSTRUCT_END_OF_EARLY_DATA 536 +# define SSL_F_TLS_CONSTRUCT_EXTENSIONS 447 +# define SSL_F_TLS_CONSTRUCT_FINISHED 359 +# define SSL_F_TLS_CONSTRUCT_HELLO_REQUEST 373 +# define SSL_F_TLS_CONSTRUCT_HELLO_RETRY_REQUEST 510 +# define SSL_F_TLS_CONSTRUCT_KEY_UPDATE 517 +# define SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET 428 +# define SSL_F_TLS_CONSTRUCT_NEXT_PROTO 426 +# define SSL_F_TLS_CONSTRUCT_SERVER_CERTIFICATE 490 +# define SSL_F_TLS_CONSTRUCT_SERVER_HELLO 491 +# define SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE 492 +# define SSL_F_TLS_CONSTRUCT_STOC_ALPN 451 +# define SSL_F_TLS_CONSTRUCT_STOC_CERTIFICATE 374 +# define SSL_F_TLS_CONSTRUCT_STOC_COOKIE 613 +# define SSL_F_TLS_CONSTRUCT_STOC_CRYPTOPRO_BUG 452 +# define SSL_F_TLS_CONSTRUCT_STOC_DONE 375 +# define SSL_F_TLS_CONSTRUCT_STOC_EARLY_DATA 531 +# define SSL_F_TLS_CONSTRUCT_STOC_EARLY_DATA_INFO 525 +# define SSL_F_TLS_CONSTRUCT_STOC_EC_PT_FORMATS 453 +# define SSL_F_TLS_CONSTRUCT_STOC_EMS 454 +# define SSL_F_TLS_CONSTRUCT_STOC_ETM 455 +# define SSL_F_TLS_CONSTRUCT_STOC_HELLO 376 +# define SSL_F_TLS_CONSTRUCT_STOC_KEY_EXCHANGE 377 +# define SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE 456 +# define SSL_F_TLS_CONSTRUCT_STOC_MAXFRAGMENTLEN 548 +# define SSL_F_TLS_CONSTRUCT_STOC_NEXT_PROTO_NEG 457 +# define SSL_F_TLS_CONSTRUCT_STOC_PSK 504 +# define SSL_F_TLS_CONSTRUCT_STOC_RENEGOTIATE 458 +# define SSL_F_TLS_CONSTRUCT_STOC_SERVER_NAME 459 +# define SSL_F_TLS_CONSTRUCT_STOC_SESSION_TICKET 460 +# define SSL_F_TLS_CONSTRUCT_STOC_STATUS_REQUEST 461 +# define SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_GROUPS 544 +# define SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_VERSIONS 611 +# define SSL_F_TLS_CONSTRUCT_STOC_USE_SRTP 462 +# define SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO 521 +# define SSL_F_TLS_FINISH_HANDSHAKE 597 +# define SSL_F_TLS_GET_MESSAGE_BODY 351 +# define SSL_F_TLS_GET_MESSAGE_HEADER 387 +# define SSL_F_TLS_HANDLE_ALPN 562 +# define SSL_F_TLS_HANDLE_STATUS_REQUEST 563 +# define SSL_F_TLS_PARSE_CERTIFICATE_AUTHORITIES 566 +# define SSL_F_TLS_PARSE_CLIENTHELLO_TLSEXT 449 +# define SSL_F_TLS_PARSE_CTOS_ALPN 567 +# define SSL_F_TLS_PARSE_CTOS_COOKIE 614 +# define SSL_F_TLS_PARSE_CTOS_EARLY_DATA 568 +# define SSL_F_TLS_PARSE_CTOS_EC_PT_FORMATS 569 +# define SSL_F_TLS_PARSE_CTOS_EMS 570 +# define SSL_F_TLS_PARSE_CTOS_KEY_SHARE 463 +# define SSL_F_TLS_PARSE_CTOS_MAXFRAGMENTLEN 571 +# define SSL_F_TLS_PARSE_CTOS_POST_HANDSHAKE_AUTH 620 +# define SSL_F_TLS_PARSE_CTOS_PSK 505 +# define SSL_F_TLS_PARSE_CTOS_PSK_KEX_MODES 572 +# define SSL_F_TLS_PARSE_CTOS_RENEGOTIATE 464 +# define SSL_F_TLS_PARSE_CTOS_SERVER_NAME 573 +# define SSL_F_TLS_PARSE_CTOS_SESSION_TICKET 574 +# define SSL_F_TLS_PARSE_CTOS_SIG_ALGS 575 +# define SSL_F_TLS_PARSE_CTOS_SIG_ALGS_CERT 615 +# define SSL_F_TLS_PARSE_CTOS_SRP 576 +# define SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST 577 +# define SSL_F_TLS_PARSE_CTOS_SUPPORTED_GROUPS 578 +# define SSL_F_TLS_PARSE_CTOS_USE_SRTP 465 +# define SSL_F_TLS_PARSE_STOC_ALPN 579 +# define SSL_F_TLS_PARSE_STOC_COOKIE 534 +# define SSL_F_TLS_PARSE_STOC_EARLY_DATA 538 +# define SSL_F_TLS_PARSE_STOC_EARLY_DATA_INFO 528 +# define SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS 580 +# define SSL_F_TLS_PARSE_STOC_KEY_SHARE 445 +# define SSL_F_TLS_PARSE_STOC_MAXFRAGMENTLEN 581 +# define SSL_F_TLS_PARSE_STOC_NPN 582 +# define SSL_F_TLS_PARSE_STOC_PSK 502 +# define SSL_F_TLS_PARSE_STOC_RENEGOTIATE 448 +# define SSL_F_TLS_PARSE_STOC_SCT 564 +# define SSL_F_TLS_PARSE_STOC_SERVER_NAME 583 +# define SSL_F_TLS_PARSE_STOC_SESSION_TICKET 584 +# define SSL_F_TLS_PARSE_STOC_STATUS_REQUEST 585 +# define SSL_F_TLS_PARSE_STOC_SUPPORTED_VERSIONS 612 +# define SSL_F_TLS_PARSE_STOC_USE_SRTP 446 +# define SSL_F_TLS_POST_PROCESS_CLIENT_HELLO 378 +# define SSL_F_TLS_POST_PROCESS_CLIENT_KEY_EXCHANGE 384 +# define SSL_F_TLS_PREPARE_CLIENT_CERTIFICATE 360 +# define SSL_F_TLS_PROCESS_AS_HELLO_RETRY_REQUEST 610 +# define SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST 361 +# define SSL_F_TLS_PROCESS_CERT_STATUS 362 +# define SSL_F_TLS_PROCESS_CERT_STATUS_BODY 495 +# define SSL_F_TLS_PROCESS_CERT_VERIFY 379 +# define SSL_F_TLS_PROCESS_CHANGE_CIPHER_SPEC 363 +# define SSL_F_TLS_PROCESS_CKE_DHE 411 +# define SSL_F_TLS_PROCESS_CKE_ECDHE 412 +# define SSL_F_TLS_PROCESS_CKE_GOST 413 +# define SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE 414 +# define SSL_F_TLS_PROCESS_CKE_RSA 415 +# define SSL_F_TLS_PROCESS_CKE_SRP 416 +# define SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE 380 +# define SSL_F_TLS_PROCESS_CLIENT_HELLO 381 +# define SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE 382 +# define SSL_F_TLS_PROCESS_ENCRYPTED_EXTENSIONS 444 +# define SSL_F_TLS_PROCESS_END_OF_EARLY_DATA 537 +# define SSL_F_TLS_PROCESS_FINISHED 364 +# define SSL_F_TLS_PROCESS_HELLO_REQ 507 +# define SSL_F_TLS_PROCESS_HELLO_RETRY_REQUEST 511 +# define SSL_F_TLS_PROCESS_INITIAL_SERVER_FLIGHT 442 +# define SSL_F_TLS_PROCESS_KEY_EXCHANGE 365 +# define SSL_F_TLS_PROCESS_KEY_UPDATE 518 +# define SSL_F_TLS_PROCESS_NEW_SESSION_TICKET 366 +# define SSL_F_TLS_PROCESS_NEXT_PROTO 383 +# define SSL_F_TLS_PROCESS_SERVER_CERTIFICATE 367 +# define SSL_F_TLS_PROCESS_SERVER_DONE 368 +# define SSL_F_TLS_PROCESS_SERVER_HELLO 369 +# define SSL_F_TLS_PROCESS_SKE_DHE 419 +# define SSL_F_TLS_PROCESS_SKE_ECDHE 420 +# define SSL_F_TLS_PROCESS_SKE_PSK_PREAMBLE 421 +# define SSL_F_TLS_PROCESS_SKE_SRP 422 +# define SSL_F_TLS_PSK_DO_BINDER 506 +# define SSL_F_TLS_SCAN_CLIENTHELLO_TLSEXT 450 +# define SSL_F_TLS_SETUP_HANDSHAKE 508 +# define SSL_F_USE_CERTIFICATE_CHAIN_FILE 220 +# define SSL_F_WRITE_STATE_MACHINE 586 + +/* + * SSL reason codes. + */ +# define SSL_R_APP_DATA_IN_HANDSHAKE 100 +# define SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT 272 +# define SSL_R_AT_LEAST_TLS_1_0_NEEDED_IN_FIPS_MODE 143 +# define SSL_R_AT_LEAST_TLS_1_2_NEEDED_IN_SUITEB_MODE 158 +# define SSL_R_BAD_CHANGE_CIPHER_SPEC 103 +# define SSL_R_BAD_CIPHER 186 +# define SSL_R_BAD_DATA 390 +# define SSL_R_BAD_DATA_RETURNED_BY_CALLBACK 106 +# define SSL_R_BAD_DECOMPRESSION 107 +# define SSL_R_BAD_DH_VALUE 102 +# define SSL_R_BAD_DIGEST_LENGTH 111 +# define SSL_R_BAD_EARLY_DATA 233 +# define SSL_R_BAD_ECC_CERT 304 +# define SSL_R_BAD_ECPOINT 306 +# define SSL_R_BAD_EXTENSION 110 +# define SSL_R_BAD_HANDSHAKE_LENGTH 332 +# define SSL_R_BAD_HANDSHAKE_STATE 236 +# define SSL_R_BAD_HELLO_REQUEST 105 +# define SSL_R_BAD_HRR_VERSION 263 +# define SSL_R_BAD_KEY_SHARE 108 +# define SSL_R_BAD_KEY_UPDATE 122 +# define SSL_R_BAD_LENGTH 271 +# define SSL_R_BAD_PACKET 240 +# define SSL_R_BAD_PACKET_LENGTH 115 +# define SSL_R_BAD_PROTOCOL_VERSION_NUMBER 116 +# define SSL_R_BAD_PSK 219 +# define SSL_R_BAD_PSK_IDENTITY 114 +# define SSL_R_BAD_RECORD_TYPE 443 +# define SSL_R_BAD_RSA_ENCRYPT 119 +# define SSL_R_BAD_SIGNATURE 123 +# define SSL_R_BAD_SRP_A_LENGTH 347 +# define SSL_R_BAD_SRP_PARAMETERS 371 +# define SSL_R_BAD_SRTP_MKI_VALUE 352 +# define SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST 353 +# define SSL_R_BAD_SSL_FILETYPE 124 +# define SSL_R_BAD_VALUE 384 +# define SSL_R_BAD_WRITE_RETRY 127 +# define SSL_R_BINDER_DOES_NOT_VERIFY 253 +# define SSL_R_BIO_NOT_SET 128 +# define SSL_R_BLOCK_CIPHER_PAD_IS_WRONG 129 +# define SSL_R_BN_LIB 130 +# define SSL_R_CALLBACK_FAILED 234 +# define SSL_R_CANNOT_CHANGE_CIPHER 109 +# define SSL_R_CA_DN_LENGTH_MISMATCH 131 +# define SSL_R_CA_KEY_TOO_SMALL 397 +# define SSL_R_CA_MD_TOO_WEAK 398 +# define SSL_R_CCS_RECEIVED_EARLY 133 +# define SSL_R_CERTIFICATE_VERIFY_FAILED 134 +# define SSL_R_CERT_CB_ERROR 377 +# define SSL_R_CERT_LENGTH_MISMATCH 135 +# define SSL_R_CIPHERSUITE_DIGEST_HAS_CHANGED 218 +# define SSL_R_CIPHER_CODE_WRONG_LENGTH 137 +# define SSL_R_CIPHER_OR_HASH_UNAVAILABLE 138 +# define SSL_R_CLIENTHELLO_TLSEXT 226 +# define SSL_R_COMPRESSED_LENGTH_TOO_LONG 140 +# define SSL_R_COMPRESSION_DISABLED 343 +# define SSL_R_COMPRESSION_FAILURE 141 +# define SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE 307 +# define SSL_R_COMPRESSION_LIBRARY_ERROR 142 +# define SSL_R_CONNECTION_TYPE_NOT_SET 144 +# define SSL_R_CONTEXT_NOT_DANE_ENABLED 167 +# define SSL_R_COOKIE_GEN_CALLBACK_FAILURE 400 +# define SSL_R_COOKIE_MISMATCH 308 +# define SSL_R_CUSTOM_EXT_HANDLER_ALREADY_INSTALLED 206 +# define SSL_R_DANE_ALREADY_ENABLED 172 +# define SSL_R_DANE_CANNOT_OVERRIDE_MTYPE_FULL 173 +# define SSL_R_DANE_NOT_ENABLED 175 +# define SSL_R_DANE_TLSA_BAD_CERTIFICATE 180 +# define SSL_R_DANE_TLSA_BAD_CERTIFICATE_USAGE 184 +# define SSL_R_DANE_TLSA_BAD_DATA_LENGTH 189 +# define SSL_R_DANE_TLSA_BAD_DIGEST_LENGTH 192 +# define SSL_R_DANE_TLSA_BAD_MATCHING_TYPE 200 +# define SSL_R_DANE_TLSA_BAD_PUBLIC_KEY 201 +# define SSL_R_DANE_TLSA_BAD_SELECTOR 202 +# define SSL_R_DANE_TLSA_NULL_DATA 203 +# define SSL_R_DATA_BETWEEN_CCS_AND_FINISHED 145 +# define SSL_R_DATA_LENGTH_TOO_LONG 146 +# define SSL_R_DECRYPTION_FAILED 147 +# define SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC 281 +# define SSL_R_DH_KEY_TOO_SMALL 394 +# define SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG 148 +# define SSL_R_DIGEST_CHECK_FAILED 149 +# define SSL_R_DTLS_MESSAGE_TOO_BIG 334 +# define SSL_R_DUPLICATE_COMPRESSION_ID 309 +# define SSL_R_ECC_CERT_NOT_FOR_SIGNING 318 +# define SSL_R_ECDH_REQUIRED_FOR_SUITEB_MODE 374 +# define SSL_R_EE_KEY_TOO_SMALL 399 +# define SSL_R_EMPTY_SRTP_PROTECTION_PROFILE_LIST 354 +# define SSL_R_ENCRYPTED_LENGTH_TOO_LONG 150 +# define SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST 151 +# define SSL_R_ERROR_SETTING_TLSA_BASE_DOMAIN 204 +# define SSL_R_EXCEEDS_MAX_FRAGMENT_SIZE 194 +# define SSL_R_EXCESSIVE_MESSAGE_SIZE 152 +# define SSL_R_EXTENSION_NOT_RECEIVED 279 +# define SSL_R_EXTRA_DATA_IN_MESSAGE 153 +# define SSL_R_EXT_LENGTH_MISMATCH 163 +# define SSL_R_FAILED_TO_INIT_ASYNC 405 +# define SSL_R_FRAGMENTED_CLIENT_HELLO 401 +# define SSL_R_GOT_A_FIN_BEFORE_A_CCS 154 +# define SSL_R_HTTPS_PROXY_REQUEST 155 +# define SSL_R_HTTP_REQUEST 156 +# define SSL_R_ILLEGAL_POINT_COMPRESSION 162 +# define SSL_R_ILLEGAL_SUITEB_DIGEST 380 +# define SSL_R_INAPPROPRIATE_FALLBACK 373 +# define SSL_R_INCONSISTENT_COMPRESSION 340 +# define SSL_R_INCONSISTENT_EARLY_DATA_ALPN 222 +# define SSL_R_INCONSISTENT_EARLY_DATA_SNI 231 +# define SSL_R_INCONSISTENT_EXTMS 104 +# define SSL_R_INSUFFICIENT_SECURITY 241 +# define SSL_R_INVALID_ALERT 205 +# define SSL_R_INVALID_CCS_MESSAGE 260 +# define SSL_R_INVALID_CERTIFICATE_OR_ALG 238 +# define SSL_R_INVALID_COMMAND 280 +# define SSL_R_INVALID_COMPRESSION_ALGORITHM 341 +# define SSL_R_INVALID_CONFIG 283 +# define SSL_R_INVALID_CONFIGURATION_NAME 113 +# define SSL_R_INVALID_CONTEXT 282 +# define SSL_R_INVALID_CT_VALIDATION_TYPE 212 +# define SSL_R_INVALID_KEY_UPDATE_TYPE 120 +# define SSL_R_INVALID_MAX_EARLY_DATA 174 +# define SSL_R_INVALID_NULL_CMD_NAME 385 +# define SSL_R_INVALID_SEQUENCE_NUMBER 402 +# define SSL_R_INVALID_SERVERINFO_DATA 388 +# define SSL_R_INVALID_SESSION_ID 999 +# define SSL_R_INVALID_SRP_USERNAME 357 +# define SSL_R_INVALID_STATUS_RESPONSE 328 +# define SSL_R_INVALID_TICKET_KEYS_LENGTH 325 +# define SSL_R_LENGTH_MISMATCH 159 +# define SSL_R_LENGTH_TOO_LONG 404 +# define SSL_R_LENGTH_TOO_SHORT 160 +# define SSL_R_LIBRARY_BUG 274 +# define SSL_R_LIBRARY_HAS_NO_CIPHERS 161 +# define SSL_R_MISSING_DSA_SIGNING_CERT 165 +# define SSL_R_MISSING_ECDSA_SIGNING_CERT 381 +# define SSL_R_MISSING_FATAL 256 +# define SSL_R_MISSING_PARAMETERS 290 +# define SSL_R_MISSING_RSA_CERTIFICATE 168 +# define SSL_R_MISSING_RSA_ENCRYPTING_CERT 169 +# define SSL_R_MISSING_RSA_SIGNING_CERT 170 +# define SSL_R_MISSING_SIGALGS_EXTENSION 112 +# define SSL_R_MISSING_SIGNING_CERT 221 +# define SSL_R_MISSING_SRP_PARAM 358 +# define SSL_R_MISSING_SUPPORTED_GROUPS_EXTENSION 209 +# define SSL_R_MISSING_TMP_DH_KEY 171 +# define SSL_R_MISSING_TMP_ECDH_KEY 311 +# define SSL_R_NOT_ON_RECORD_BOUNDARY 182 +# define SSL_R_NOT_REPLACING_CERTIFICATE 289 +# define SSL_R_NOT_SERVER 284 +# define SSL_R_NO_APPLICATION_PROTOCOL 235 +# define SSL_R_NO_CERTIFICATES_RETURNED 176 +# define SSL_R_NO_CERTIFICATE_ASSIGNED 177 +# define SSL_R_NO_CERTIFICATE_SET 179 +# define SSL_R_NO_CHANGE_FOLLOWING_HRR 214 +# define SSL_R_NO_CIPHERS_AVAILABLE 181 +# define SSL_R_NO_CIPHERS_SPECIFIED 183 +# define SSL_R_NO_CIPHER_MATCH 185 +# define SSL_R_NO_CLIENT_CERT_METHOD 331 +# define SSL_R_NO_COMPRESSION_SPECIFIED 187 +# define SSL_R_NO_COOKIE_CALLBACK_SET 287 +# define SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER 330 +# define SSL_R_NO_METHOD_SPECIFIED 188 +# define SSL_R_NO_PEM_EXTENSIONS 389 +# define SSL_R_NO_PRIVATE_KEY_ASSIGNED 190 +# define SSL_R_NO_PROTOCOLS_AVAILABLE 191 +# define SSL_R_NO_RENEGOTIATION 339 +# define SSL_R_NO_REQUIRED_DIGEST 324 +# define SSL_R_NO_SHARED_CIPHER 193 +# define SSL_R_NO_SHARED_GROUPS 410 +# define SSL_R_NO_SHARED_SIGNATURE_ALGORITHMS 376 +# define SSL_R_NO_SRTP_PROFILES 359 +# define SSL_R_NO_SUITABLE_KEY_SHARE 101 +# define SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM 118 +# define SSL_R_NO_VALID_SCTS 216 +# define SSL_R_NO_VERIFY_COOKIE_CALLBACK 403 +# define SSL_R_NULL_SSL_CTX 195 +# define SSL_R_NULL_SSL_METHOD_PASSED 196 +# define SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED 197 +# define SSL_R_OLD_SESSION_COMPRESSION_ALGORITHM_NOT_RETURNED 344 +# define SSL_R_OVERFLOW_ERROR 237 +# define SSL_R_PACKET_LENGTH_TOO_LONG 198 +# define SSL_R_PARSE_TLSEXT 227 +# define SSL_R_PATH_TOO_LONG 270 +# define SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE 199 +# define SSL_R_PEM_NAME_BAD_PREFIX 391 +# define SSL_R_PEM_NAME_TOO_SHORT 392 +# define SSL_R_PIPELINE_FAILURE 406 +# define SSL_R_POST_HANDSHAKE_AUTH_ENCODING_ERR 278 +# define SSL_R_PRIVATE_KEY_MISMATCH 288 +# define SSL_R_PROTOCOL_IS_SHUTDOWN 207 +# define SSL_R_PSK_IDENTITY_NOT_FOUND 223 +# define SSL_R_PSK_NO_CLIENT_CB 224 +# define SSL_R_PSK_NO_SERVER_CB 225 +# define SSL_R_READ_BIO_NOT_SET 211 +# define SSL_R_READ_TIMEOUT_EXPIRED 312 +# define SSL_R_RECORD_LENGTH_MISMATCH 213 +# define SSL_R_RECORD_TOO_SMALL 298 +# define SSL_R_RENEGOTIATE_EXT_TOO_LONG 335 +# define SSL_R_RENEGOTIATION_ENCODING_ERR 336 +# define SSL_R_RENEGOTIATION_MISMATCH 337 +# define SSL_R_REQUEST_PENDING 285 +# define SSL_R_REQUEST_SENT 286 +# define SSL_R_REQUIRED_CIPHER_MISSING 215 +# define SSL_R_REQUIRED_COMPRESSION_ALGORITHM_MISSING 342 +# define SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING 345 +# define SSL_R_SCT_VERIFICATION_FAILED 208 +# define SSL_R_SERVERHELLO_TLSEXT 275 +# define SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED 277 +# define SSL_R_SHUTDOWN_WHILE_IN_INIT 407 +# define SSL_R_SIGNATURE_ALGORITHMS_ERROR 360 +# define SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE 220 +# define SSL_R_SRP_A_CALC 361 +# define SSL_R_SRTP_COULD_NOT_ALLOCATE_PROFILES 362 +# define SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG 363 +# define SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE 364 +# define SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH 232 +# define SSL_R_SSL3_EXT_INVALID_SERVERNAME 319 +# define SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE 320 +# define SSL_R_SSL3_SESSION_ID_TOO_LONG 300 +# define SSL_R_SSLV3_ALERT_BAD_CERTIFICATE 1042 +# define SSL_R_SSLV3_ALERT_BAD_RECORD_MAC 1020 +# define SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED 1045 +# define SSL_R_SSLV3_ALERT_CERTIFICATE_REVOKED 1044 +# define SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN 1046 +# define SSL_R_SSLV3_ALERT_DECOMPRESSION_FAILURE 1030 +# define SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE 1040 +# define SSL_R_SSLV3_ALERT_ILLEGAL_PARAMETER 1047 +# define SSL_R_SSLV3_ALERT_NO_CERTIFICATE 1041 +# define SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE 1010 +# define SSL_R_SSLV3_ALERT_UNSUPPORTED_CERTIFICATE 1043 +# define SSL_R_SSL_COMMAND_SECTION_EMPTY 117 +# define SSL_R_SSL_COMMAND_SECTION_NOT_FOUND 125 +# define SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION 228 +# define SSL_R_SSL_HANDSHAKE_FAILURE 229 +# define SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS 230 +# define SSL_R_SSL_NEGATIVE_LENGTH 372 +# define SSL_R_SSL_SECTION_EMPTY 126 +# define SSL_R_SSL_SECTION_NOT_FOUND 136 +# define SSL_R_SSL_SESSION_ID_CALLBACK_FAILED 301 +# define SSL_R_SSL_SESSION_ID_CONFLICT 302 +# define SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG 273 +# define SSL_R_SSL_SESSION_ID_HAS_BAD_LENGTH 303 +# define SSL_R_SSL_SESSION_ID_TOO_LONG 408 +# define SSL_R_SSL_SESSION_VERSION_MISMATCH 210 +# define SSL_R_STILL_IN_INIT 121 +# define SSL_R_TLSV1_ALERT_ACCESS_DENIED 1049 +# define SSL_R_TLSV1_ALERT_DECODE_ERROR 1050 +# define SSL_R_TLSV1_ALERT_DECRYPTION_FAILED 1021 +# define SSL_R_TLSV1_ALERT_DECRYPT_ERROR 1051 +# define SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION 1060 +# define SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK 1086 +# define SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY 1071 +# define SSL_R_TLSV1_ALERT_INTERNAL_ERROR 1080 +# define SSL_R_TLSV1_ALERT_NO_RENEGOTIATION 1100 +# define SSL_R_TLSV1_ALERT_PROTOCOL_VERSION 1070 +# define SSL_R_TLSV1_ALERT_RECORD_OVERFLOW 1022 +# define SSL_R_TLSV1_ALERT_UNKNOWN_CA 1048 +# define SSL_R_TLSV1_ALERT_USER_CANCELLED 1090 +# define SSL_R_TLSV1_BAD_CERTIFICATE_HASH_VALUE 1114 +# define SSL_R_TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE 1113 +# define SSL_R_TLSV1_CERTIFICATE_UNOBTAINABLE 1111 +# define SSL_R_TLSV1_UNRECOGNIZED_NAME 1112 +# define SSL_R_TLSV1_UNSUPPORTED_EXTENSION 1110 +# define SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT 365 +# define SSL_R_TLS_HEARTBEAT_PENDING 366 +# define SSL_R_TLS_ILLEGAL_EXPORTER_LABEL 367 +# define SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST 157 +# define SSL_R_TOO_MANY_KEY_UPDATES 132 +# define SSL_R_TOO_MANY_WARN_ALERTS 409 +# define SSL_R_TOO_MUCH_EARLY_DATA 164 +# define SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS 314 +# define SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS 239 +# define SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES 242 +# define SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES 243 +# define SSL_R_UNEXPECTED_CCS_MESSAGE 262 +# define SSL_R_UNEXPECTED_END_OF_EARLY_DATA 178 +# define SSL_R_UNEXPECTED_MESSAGE 244 +# define SSL_R_UNEXPECTED_RECORD 245 +# define SSL_R_UNINITIALIZED 276 +# define SSL_R_UNKNOWN_ALERT_TYPE 246 +# define SSL_R_UNKNOWN_CERTIFICATE_TYPE 247 +# define SSL_R_UNKNOWN_CIPHER_RETURNED 248 +# define SSL_R_UNKNOWN_CIPHER_TYPE 249 +# define SSL_R_UNKNOWN_CMD_NAME 386 +# define SSL_R_UNKNOWN_COMMAND 139 +# define SSL_R_UNKNOWN_DIGEST 368 +# define SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE 250 +# define SSL_R_UNKNOWN_PKEY_TYPE 251 +# define SSL_R_UNKNOWN_PROTOCOL 252 +# define SSL_R_UNKNOWN_SSL_VERSION 254 +# define SSL_R_UNKNOWN_STATE 255 +# define SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED 338 +# define SSL_R_UNSOLICITED_EXTENSION 217 +# define SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM 257 +# define SSL_R_UNSUPPORTED_ELLIPTIC_CURVE 315 +# define SSL_R_UNSUPPORTED_PROTOCOL 258 +# define SSL_R_UNSUPPORTED_SSL_VERSION 259 +# define SSL_R_UNSUPPORTED_STATUS_TYPE 329 +# define SSL_R_USE_SRTP_NOT_NEGOTIATED 369 +# define SSL_R_VERSION_TOO_HIGH 166 +# define SSL_R_VERSION_TOO_LOW 396 +# define SSL_R_WRONG_CERTIFICATE_TYPE 383 +# define SSL_R_WRONG_CIPHER_RETURNED 261 +# define SSL_R_WRONG_CURVE 378 +# define SSL_R_WRONG_SIGNATURE_LENGTH 264 +# define SSL_R_WRONG_SIGNATURE_SIZE 265 +# define SSL_R_WRONG_SIGNATURE_TYPE 370 +# define SSL_R_WRONG_SSL_VERSION 266 +# define SSL_R_WRONG_VERSION_NUMBER 267 +# define SSL_R_X509_LIB 268 +# define SSL_R_X509_VERIFICATION_SETUP_PROBLEMS 269 + +#endif diff --git a/ms/cmp.pl b/ms/cmp.pl old mode 100755 new mode 100644 diff --git a/ms/uplink-common.pl b/ms/uplink-common.pl old mode 100755 new mode 100644 diff --git a/ms/uplink-ia64.pl b/ms/uplink-ia64.pl old mode 100755 new mode 100644 diff --git a/ms/uplink-x86.pl b/ms/uplink-x86.pl old mode 100755 new mode 100644 diff --git a/ms/uplink-x86_64.pl b/ms/uplink-x86_64.pl old mode 100755 new mode 100644 diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c index 4c63d4ac..f775f26b 100644 --- a/ssl/s3_enc.c +++ b/ssl/s3_enc.c @@ -167,6 +167,7 @@ int ssl3_change_cipher_state(SSL *s, int which) */ EVP_CIPHER_CTX_reset(s->enc_write_ctx); } + EVP_CIPHER_CTX_ctrl(s->enc_write_ctx, EVP_CTRL_SET_DRBG, 0, s->drbg); dd = s->enc_write_ctx; if (ssl_replace_hash(&s->write_hash, m) == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_CHANGE_CIPHER_STATE, diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c index 5b36bb78..b11285cf 100644 --- a/ssl/s3_lib.c +++ b/ssl/s3_lib.c @@ -4200,10 +4200,11 @@ const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt, s->version != DTLS1_VERSION)) ok = 0; - /* Not use weak cipher after TLSv1.0 */ - if ((alg_a & SSL_aRSA) && + /* not use ECDSA under TLS v1.2 */ + // if ((alg_a & SSL_aECDSA) && s->version != TLS1_2_VERSION) ok = 0; + if ((alg_a & SSL_aRSA) && (alg_k & SSL_kRSA) && - (s->version != TLS1_VERSION)) ok = 0; + (s->version != TLS1_VERSION)) ok = 0; #ifndef OPENSSL_NO_PSK /* with PSK there must be server callback set */ diff --git a/ssl/ssl_asn1.c b/ssl/ssl_asn1.c index 9327b339..7d39ba15 100644 --- a/ssl/ssl_asn1.c +++ b/ssl/ssl_asn1.c @@ -43,6 +43,7 @@ typedef struct { ASN1_OCTET_STRING *alpn_selected; ASN1_OCTET_STRING *tick_nonce; uint32_t tlsext_max_fragment_len_mode; + ASN1_OCTET_STRING *ticket_appdata; } SSL_SESSION_ASN1; ASN1_SEQUENCE(SSL_SESSION_ASN1) = { @@ -73,7 +74,8 @@ ASN1_SEQUENCE(SSL_SESSION_ASN1) = { ASN1_EXP_OPT_EMBED(SSL_SESSION_ASN1, max_early_data, ZUINT32, 15), ASN1_EXP_OPT(SSL_SESSION_ASN1, alpn_selected, ASN1_OCTET_STRING, 16), ASN1_EXP_OPT(SSL_SESSION_ASN1, tick_nonce, ASN1_OCTET_STRING, 17), - ASN1_EXP_OPT_EMBED(SSL_SESSION_ASN1, tlsext_max_fragment_len_mode, ZUINT32, 18) + ASN1_EXP_OPT_EMBED(SSL_SESSION_ASN1, tlsext_max_fragment_len_mode, ZUINT32, 18), + ASN1_EXP_OPT(SSL_SESSION_ASN1, ticket_appdata, ASN1_OCTET_STRING, 19) } static_ASN1_SEQUENCE_END(SSL_SESSION_ASN1) IMPLEMENT_STATIC_ASN1_ENCODE_FUNCTIONS(SSL_SESSION_ASN1) @@ -123,6 +125,7 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp) #endif ASN1_OCTET_STRING alpn_selected; ASN1_OCTET_STRING tick_nonce; + ASN1_OCTET_STRING ticket_appdata; long l; @@ -200,6 +203,12 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp) as.tlsext_max_fragment_len_mode = in->ext.max_fragment_len_mode; + if (in->ticket_appdata == NULL) + as.ticket_appdata = NULL; + else + ssl_session_oinit(&as.ticket_appdata, &ticket_appdata, + in->ticket_appdata, in->ticket_appdata_len); + return i2d_SSL_SESSION_ASN1(&as, pp); } @@ -376,6 +385,15 @@ SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, ret->ext.max_fragment_len_mode = as->tlsext_max_fragment_len_mode; + if (as->ticket_appdata != NULL) { + ret->ticket_appdata = as->ticket_appdata->data; + ret->ticket_appdata_len = as->ticket_appdata->length; + as->ticket_appdata->data = NULL; + } else { + ret->ticket_appdata = NULL; + ret->ticket_appdata_len = 0; + } + M_ASN1_free_of(as, SSL_SESSION_ASN1); if ((a != NULL) && (*a == NULL)) diff --git a/ssl/ssl_cert_table.h b/ssl/ssl_cert_table.h index fd6a1ad1..1376441a 100644 --- a/ssl/ssl_cert_table.h +++ b/ssl/ssl_cert_table.h @@ -18,5 +18,6 @@ static const SSL_CERT_LOOKUP ssl_cert_info [] = { {NID_id_GostR3410_2001, SSL_aGOST01}, /* SSL_PKEY_GOST01 */ {NID_id_GostR3410_2012_256, SSL_aGOST12}, /* SSL_PKEY_GOST12_256 */ {NID_id_GostR3410_2012_512, SSL_aGOST12}, /* SSL_PKEY_GOST12_512 */ - {EVP_PKEY_ED25519, SSL_aECDSA} /* SSL_PKEY_ED25519 */ + {EVP_PKEY_ED25519, SSL_aECDSA}, /* SSL_PKEY_ED25519 */ + {EVP_PKEY_ED448, SSL_aECDSA} /* SSL_PKEY_ED448 */ }; diff --git a/ssl/ssl_err.c b/ssl/ssl_err.c index 35e804e3..1404b61e 100644 --- a/ssl/ssl_err.c +++ b/ssl/ssl_err.c @@ -306,6 +306,8 @@ static const ERR_STRING_DATA SSL_str_functs[] = { {ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SET_ALPN_PROTOS, 0), "SSL_set_alpn_protos"}, {ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SET_CERT, 0), "ssl_set_cert"}, + {ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SET_CERT_AND_KEY, 0), + "ssl_set_cert_and_key"}, {ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SET_CIPHER_LIST, 0), "SSL_set_cipher_list"}, {ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SET_CT_VALIDATION_CALLBACK, 0), @@ -914,6 +916,7 @@ static const ERR_STRING_DATA SSL_str_reasons[] = { {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_MISSING_ECDSA_SIGNING_CERT), "missing ecdsa signing cert"}, {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_MISSING_FATAL), "missing fatal"}, + {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_MISSING_PARAMETERS), "missing parameters"}, {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_MISSING_RSA_CERTIFICATE), "missing rsa certificate"}, {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_MISSING_RSA_ENCRYPTING_CERT), @@ -936,6 +939,8 @@ static const ERR_STRING_DATA SSL_str_reasons[] = { {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_NESTED_GROUP), "nested group"}, {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_NOT_ON_RECORD_BOUNDARY), "not on record boundary"}, + {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_NOT_REPLACING_CERTIFICATE), + "not replacing certificate"}, {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_NOT_SERVER), "not server"}, {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_NO_APPLICATION_PROTOCOL), "no application protocol"}, @@ -955,6 +960,8 @@ static const ERR_STRING_DATA SSL_str_reasons[] = { "no client cert method"}, {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_NO_COMPRESSION_SPECIFIED), "no compression specified"}, + {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_NO_COOKIE_CALLBACK_SET), + "no cookie callback set"}, {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER), "Peer haven't sent GOST certificate, required for selected ciphersuite"}, {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_NO_METHOD_SPECIFIED), @@ -998,6 +1005,8 @@ static const ERR_STRING_DATA SSL_str_reasons[] = { {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_PIPELINE_FAILURE), "pipeline failure"}, {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_POST_HANDSHAKE_AUTH_ENCODING_ERR), "post handshake auth encoding err"}, + {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_PRIVATE_KEY_MISMATCH), + "private key mismatch"}, {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_PROTOCOL_IS_SHUTDOWN), "protocol is shutdown"}, {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_PSK_IDENTITY_NOT_FOUND), diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c index 3bd2af95..374f0d36 100644 --- a/ssl/ssl_lib.c +++ b/ssl/ssl_lib.c @@ -3068,10 +3068,22 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth) ret->ext.status_type = TLSEXT_STATUSTYPE_nothing; /* - * Default max early data is a fully loaded single record. Could be split - * across multiple records in practice + * We cannot usefully set a default max_early_data here (which gets + * propagated in SSL_new(), for the following reason: setting the + * SSL field causes tls_construct_stoc_early_data() to tell the + * client that early data will be accepted when constructing a TLS 1.3 + * session ticket, and the client will accordingly send us early data + * when using that ticket (if the client has early data to send). + * However, in order for the early data to actually be consumed by + * the application, the application must also have calls to + * SSL_read_early_data(); otherwise we'll just skip past the early data + * and ignore it. So, since the application must add calls to + * SSL_read_early_data(), we also require them to add + * calls to SSL_CTX_set_max_early_data() in order to use early data, + * eliminating the bandwidth-wasting early data in the case described + * above. */ - ret->max_early_data = SSL3_RT_MAX_PLAIN_LENGTH; + ret->max_early_data = 0; return ret; err: @@ -3312,6 +3324,12 @@ void ssl_set_masks(SSL *s) && pvalid[SSL_PKEY_ED25519] & CERT_PKEY_EXPLICIT_SIGN && TLS1_get_version(s) == TLS1_2_VERSION) mask_a |= SSL_aECDSA; + + /* Allow Ed448 for TLS 1.2 if peer supports it */ + if (!(mask_a & SSL_aECDSA) && ssl_has_cert(s, SSL_PKEY_ED448) + && pvalid[SSL_PKEY_ED448] & CERT_PKEY_EXPLICIT_SIGN + && TLS1_get_version(s) == TLS1_2_VERSION) + mask_a |= SSL_aECDSA; #endif #ifndef OPENSSL_NO_EC @@ -5402,7 +5420,10 @@ int SSL_stateless(SSL *s) if (ret > 0 && s->ext.cookieok) return 1; - return 0; + if (s->hello_retry_request == SSL_HRR_PENDING && !ossl_statem_in_error(s)) + return 0; + + return -1; } void SSL_force_post_handshake_auth(SSL *ssl) @@ -5456,3 +5477,14 @@ int SSL_verify_client_post_handshake(SSL *ssl) ossl_statem_set_in_init(ssl, 1); return 1; } + +int SSL_CTX_set_session_ticket_cb(SSL_CTX *ctx, + SSL_CTX_generate_session_ticket_fn gen_cb, + SSL_CTX_decrypt_session_ticket_fn dec_cb, + void *arg) +{ + ctx->generate_ticket_cb = gen_cb; + ctx->decrypt_ticket_cb = dec_cb; + ctx->ticket_cb_data = arg; + return 1; +} diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h index c05ac8b7..0eda278d 100644 --- a/ssl/ssl_locl.h +++ b/ssl/ssl_locl.h @@ -381,7 +381,8 @@ # define SSL_PKEY_GOST12_256 5 # define SSL_PKEY_GOST12_512 6 # define SSL_PKEY_ED25519 7 -# define SSL_PKEY_NUM 8 +# define SSL_PKEY_ED448 8 +# define SSL_PKEY_NUM 9 /* * Pseudo-constant. GOST cipher suites can use different certs for 1 * SSL_CIPHER. So let's see which one we have in fact. @@ -590,6 +591,8 @@ struct ssl_session_st { # ifndef OPENSSL_NO_SRP char *srp_username; # endif + unsigned char *ticket_appdata; + size_t ticket_appdata_len; uint32_t flags; CRYPTO_RWLOCK *lock; }; @@ -854,6 +857,14 @@ struct ssl_ctx_st { int (*app_verify_cookie_cb) (SSL *ssl, const unsigned char *cookie, unsigned int cookie_len); + /* TLS1.3 app-controlled cookie generate callback */ + int (*gen_stateless_cookie_cb) (SSL *ssl, unsigned char *cookie, + size_t *cookie_len); + + /* TLS1.3 verify app-controlled cookie callback */ + int (*verify_stateless_cookie_cb) (SSL *ssl, const unsigned char *cookie, + size_t cookie_len); + CRYPTO_EX_DATA ex_data; const EVP_MD *md5; /* For SSLv3/TLSv1 'ssl3-md5' */ @@ -1061,6 +1072,11 @@ struct ssl_ctx_st { size_t (*record_padding_cb)(SSL *s, int type, size_t len, void *arg); void *record_padding_arg; size_t block_padding; + + /* Session ticket appdata */ + SSL_CTX_generate_session_ticket_fn generate_ticket_cb; + SSL_CTX_decrypt_session_ticket_fn decrypt_ticket_cb; + void *ticket_cb_data; }; struct ssl_st { @@ -1999,6 +2015,7 @@ typedef enum downgrade_en { #define TLSEXT_SIGALG_gostr34102001_gostr3411 0xeded #define TLSEXT_SIGALG_ed25519 0x0807 +#define TLSEXT_SIGALG_ed448 0x0808 /* Known PSK key exchange modes */ #define TLSEXT_KEX_MODE_KE 0x00 @@ -2487,30 +2504,12 @@ void tls1_get_supported_groups(SSL *s, const uint16_t **pgroups, __owur int tls1_set_server_sigalgs(SSL *s); -/* Return codes for tls_get_ticket_from_client() and tls_decrypt_ticket() */ -typedef enum ticket_en { - /* fatal error, malloc failure */ - TICKET_FATAL_ERR_MALLOC, - /* fatal error, either from parsing or decrypting the ticket */ - TICKET_FATAL_ERR_OTHER, - /* No ticket present */ - TICKET_NONE, - /* Empty ticket present */ - TICKET_EMPTY, - /* the ticket couldn't be decrypted */ - TICKET_NO_DECRYPT, - /* a ticket was successfully decrypted */ - TICKET_SUCCESS, - /* same as above but the ticket needs to be renewed */ - TICKET_SUCCESS_RENEW -} TICKET_RETURN; - -__owur TICKET_RETURN tls_get_ticket_from_client(SSL *s, CLIENTHELLO_MSG *hello, - SSL_SESSION **ret); -__owur TICKET_RETURN tls_decrypt_ticket(SSL *s, const unsigned char *etick, - size_t eticklen, - const unsigned char *sess_id, - size_t sesslen, SSL_SESSION **psess); +__owur SSL_TICKET_RETURN tls_get_ticket_from_client(SSL *s, CLIENTHELLO_MSG *hello, + SSL_SESSION **ret); +__owur SSL_TICKET_RETURN tls_decrypt_ticket(SSL *s, const unsigned char *etick, + size_t eticklen, + const unsigned char *sess_id, + size_t sesslen, SSL_SESSION **psess); __owur int tls_use_ticket(SSL *s); diff --git a/ssl/ssl_rsa.c b/ssl/ssl_rsa.c index fe2dd867..7eff731e 100644 --- a/ssl/ssl_rsa.c +++ b/ssl/ssl_rsa.c @@ -1035,3 +1035,114 @@ int SSL_CTX_use_serverinfo_file(SSL_CTX *ctx, const char *file) BIO_free(bin); return ret; } + +static int ssl_set_cert_and_key(SSL *ssl, SSL_CTX *ctx, X509 *x509, EVP_PKEY *privatekey, + STACK_OF(X509) *chain, int override) +{ + int ret = 0; + size_t i; + int j; + int rv; + CERT *c = ssl != NULL ? ssl->cert : ctx->cert; + STACK_OF(X509) *dup_chain = NULL; + EVP_PKEY *pubkey = NULL; + + /* Do all security checks before anything else */ + rv = ssl_security_cert(ssl, ctx, x509, 0, 1); + if (rv != 1) { + SSLerr(SSL_F_SSL_SET_CERT_AND_KEY, rv); + goto out; + } + for (j = 0; j < sk_X509_num(chain); j++) { + rv = ssl_security_cert(ssl, ctx, sk_X509_value(chain, j), 0, 0); + if (rv != 1) { + SSLerr(SSL_F_SSL_SET_CERT_AND_KEY, rv); + goto out; + } + } + + pubkey = X509_get_pubkey(x509); /* bumps reference */ + if (pubkey == NULL) + goto out; + if (privatekey == NULL) { + privatekey = pubkey; + } else { + /* For RSA, which has no parameters, missing returns 0 */ + if (EVP_PKEY_missing_parameters(privatekey)) { + if (EVP_PKEY_missing_parameters(pubkey)) { + /* nobody has parameters? - error */ + SSLerr(SSL_F_SSL_SET_CERT_AND_KEY, SSL_R_MISSING_PARAMETERS); + goto out; + } else { + /* copy to privatekey from pubkey */ + EVP_PKEY_copy_parameters(privatekey, pubkey); + } + } else if (EVP_PKEY_missing_parameters(pubkey)) { + /* copy to pubkey from privatekey */ + EVP_PKEY_copy_parameters(pubkey, privatekey); + } /* else both have parameters */ + + /* Copied from ssl_set_cert/pkey */ +#ifndef OPENSSL_NO_RSA + if ((EVP_PKEY_id(privatekey) == EVP_PKEY_RSA) && + ((RSA_flags(EVP_PKEY_get0_RSA(privatekey)) & RSA_METHOD_FLAG_NO_CHECK))) + /* no-op */ ; + else +#endif + /* check that key <-> cert match */ + if (EVP_PKEY_cmp(pubkey, privatekey) != 1) { + SSLerr(SSL_F_SSL_SET_CERT_AND_KEY, SSL_R_PRIVATE_KEY_MISMATCH); + goto out; + } + } + if (ssl_cert_lookup_by_pkey(pubkey, &i) == NULL) { + SSLerr(SSL_F_SSL_SET_CERT_AND_KEY, SSL_R_UNKNOWN_CERTIFICATE_TYPE); + goto out; + } + + if (!override && (c->pkeys[i].x509 != NULL + || c->pkeys[i].privatekey != NULL + || c->pkeys[i].chain != NULL)) { + /* No override, and something already there */ + SSLerr(SSL_F_SSL_SET_CERT_AND_KEY, SSL_R_NOT_REPLACING_CERTIFICATE); + goto out; + } + + if (chain != NULL) { + dup_chain = X509_chain_up_ref(chain); + if (dup_chain == NULL) { + SSLerr(SSL_F_SSL_SET_CERT_AND_KEY, ERR_R_MALLOC_FAILURE); + goto out; + } + } + + sk_X509_pop_free(c->pkeys[i].chain, X509_free); + c->pkeys[i].chain = dup_chain; + + X509_free(c->pkeys[i].x509); + X509_up_ref(x509); + c->pkeys[i].x509 = x509; + + EVP_PKEY_free(c->pkeys[i].privatekey); + EVP_PKEY_up_ref(privatekey); + c->pkeys[i].privatekey = privatekey; + + c->key = &(c->pkeys[i]); + + ret = 1; + out: + EVP_PKEY_free(pubkey); + return ret; +} + +int SSL_use_cert_and_key(SSL *ssl, X509 *x509, EVP_PKEY *privatekey, + STACK_OF(X509) *chain, int override) +{ + return ssl_set_cert_and_key(ssl, NULL, x509, privatekey, chain, override); +} + +int SSL_CTX_use_cert_and_key(SSL_CTX *ctx, X509 *x509, EVP_PKEY *privatekey, + STACK_OF(X509) *chain, int override) +{ + return ssl_set_cert_and_key(NULL, ctx, x509, privatekey, chain, override); +} diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c index 5d2e1719..1873237c 100644 --- a/ssl/ssl_sess.c +++ b/ssl/ssl_sess.c @@ -134,6 +134,7 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket) dest->peer_chain = NULL; dest->peer = NULL; dest->ext.tick_nonce = NULL; + dest->ticket_appdata = NULL; memset(&dest->ex_data, 0, sizeof(dest->ex_data)); /* We deliberately don't copy the prev and next pointers */ @@ -244,6 +245,13 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket) } #endif + if (src->ticket_appdata != NULL) { + dest->ticket_appdata = + OPENSSL_memdup(src->ticket_appdata, src->ticket_appdata_len); + if (dest->ticket_appdata == NULL) + goto err; + } + return dest; err: SSLerr(SSL_F_SSL_SESSION_DUP, ERR_R_MALLOC_FAILURE); @@ -471,7 +479,7 @@ int ssl_get_prev_session(SSL *s, CLIENTHELLO_MSG *hello) SSL_SESSION *ret = NULL; int fatal = 0, discard; int try_session_cache = 0; - TICKET_RETURN r; + SSL_TICKET_RETURN r; if (SSL_IS_TLS13(s)) { if (!tls_parse_extension(s, TLSEXT_IDX_psk_kex_modes, @@ -486,20 +494,20 @@ int ssl_get_prev_session(SSL *s, CLIENTHELLO_MSG *hello) /* sets s->ext.ticket_expected */ r = tls_get_ticket_from_client(s, hello, &ret); switch (r) { - case TICKET_FATAL_ERR_MALLOC: - case TICKET_FATAL_ERR_OTHER: + case SSL_TICKET_FATAL_ERR_MALLOC: + case SSL_TICKET_FATAL_ERR_OTHER: fatal = 1; SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_GET_PREV_SESSION, ERR_R_INTERNAL_ERROR); goto err; - case TICKET_NONE: - case TICKET_EMPTY: + case SSL_TICKET_NONE: + case SSL_TICKET_EMPTY: if (hello->session_id_len > 0) try_session_cache = 1; break; - case TICKET_NO_DECRYPT: - case TICKET_SUCCESS: - case TICKET_SUCCESS_RENEW: + case SSL_TICKET_NO_DECRYPT: + case SSL_TICKET_SUCCESS: + case SSL_TICKET_SUCCESS_RENEW: break; } } @@ -806,6 +814,7 @@ void SSL_SESSION_free(SSL_SESSION *ss) #endif OPENSSL_free(ss->ext.alpn_selected); OPENSSL_free(ss->ext.tick_nonce); + OPENSSL_free(ss->ticket_appdata); CRYPTO_THREAD_lock_free(ss->lock); OPENSSL_clear_free(ss, sizeof(*ss)); } @@ -1269,4 +1278,45 @@ void SSL_CTX_set_cookie_verify_cb(SSL_CTX *ctx, ctx->app_verify_cookie_cb = cb; } +int SSL_SESSION_set1_ticket_appdata(SSL_SESSION *ss, const void *data, size_t len) +{ + OPENSSL_free(ss->ticket_appdata); + ss->ticket_appdata_len = 0; + if (data == NULL || len == 0) { + ss->ticket_appdata = NULL; + return 1; + } + ss->ticket_appdata = OPENSSL_memdup(data, len); + if (ss->ticket_appdata != NULL) { + ss->ticket_appdata_len = len; + return 1; + } + return 0; +} + +int SSL_SESSION_get0_ticket_appdata(SSL_SESSION *ss, void **data, size_t *len) +{ + *data = ss->ticket_appdata; + *len = ss->ticket_appdata_len; + return 1; +} + +void SSL_CTX_set_stateless_cookie_generate_cb( + SSL_CTX *ctx, + int (*cb) (SSL *ssl, + unsigned char *cookie, + size_t *cookie_len)) +{ + ctx->gen_stateless_cookie_cb = cb; +} + +void SSL_CTX_set_stateless_cookie_verify_cb( + SSL_CTX *ctx, + int (*cb) (SSL *ssl, + const unsigned char *cookie, + size_t cookie_len)) +{ + ctx->verify_stateless_cookie_cb = cb; +} + IMPLEMENT_PEM_rw(SSL_SESSION, SSL_SESSION, PEM_STRING_SSL_SESSION, SSL_SESSION) diff --git a/ssl/statem/extensions.c b/ssl/statem/extensions.c index 722943fa..0641a253 100644 --- a/ssl/statem/extensions.c +++ b/ssl/statem/extensions.c @@ -211,7 +211,7 @@ static const EXTENSION_DEFINITION ext_defs[] = { { TLSEXT_TYPE_status_request, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO - | SSL_EXT_TLS1_3_CERTIFICATE, + | SSL_EXT_TLS1_3_CERTIFICATE | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST, init_status_request, tls_parse_ctos_status_request, tls_parse_stoc_status_request, tls_construct_stoc_status_request, tls_construct_ctos_status_request, NULL @@ -263,7 +263,7 @@ static const EXTENSION_DEFINITION ext_defs[] = { { TLSEXT_TYPE_signed_certificate_timestamp, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO - | SSL_EXT_TLS1_3_CERTIFICATE, + | SSL_EXT_TLS1_3_CERTIFICATE | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST, NULL, /* * No server side support for this, but can be provided by a custom @@ -516,11 +516,20 @@ int extension_is_relevant(SSL *s, unsigned int extctx, unsigned int thisctx) && (extctx & SSL_EXT_TLS_IMPLEMENTATION_ONLY) != 0) || (s->version == SSL3_VERSION && (extctx & SSL_EXT_SSL3_ALLOWED) == 0) + /* + * Note that SSL_IS_TLS13() means "TLS 1.3 has been negotiated", + * which is never true when generating the ClientHello. + * However, version negotiation *has* occurred by the time the + * ClientHello extensions are being parsed. + * Be careful to allow TLS 1.3-only extensions when generating + * the ClientHello. + */ || (is_tls13 && (extctx & SSL_EXT_TLS1_2_AND_BELOW_ONLY) != 0) - || (!is_tls13 && (extctx & SSL_EXT_TLS1_3_ONLY) != 0) + || (!is_tls13 && (extctx & SSL_EXT_TLS1_3_ONLY) != 0 + && (thisctx & SSL_EXT_CLIENT_HELLO) == 0) + || (s->server && !is_tls13 && (extctx & SSL_EXT_TLS1_3_ONLY) != 0) || (s->hit && (extctx & SSL_EXT_IGNORE_ON_RESUMPTION) != 0)) return 0; - return 1; } @@ -762,14 +771,7 @@ int should_add_extension(SSL *s, unsigned int extctx, unsigned int thisctx, return 0; /* Check if this extension is defined for our protocol. If not, skip */ - if ((SSL_IS_DTLS(s) && (extctx & SSL_EXT_TLS_IMPLEMENTATION_ONLY) != 0) - || (s->version == SSL3_VERSION - && (extctx & SSL_EXT_SSL3_ALLOWED) == 0) - || (SSL_IS_TLS13(s) - && (extctx & SSL_EXT_TLS1_2_AND_BELOW_ONLY) != 0) - || (!SSL_IS_TLS13(s) - && (extctx & SSL_EXT_TLS1_3_ONLY) != 0 - && (thisctx & SSL_EXT_CLIENT_HELLO) == 0) + if (!extension_is_relevant(s, extctx, thisctx) || ((extctx & SSL_EXT_TLS1_3_ONLY) != 0 && (thisctx & SSL_EXT_CLIENT_HELLO) != 0 && (SSL_IS_DTLS(s) || max_version < TLS1_3_VERSION))) @@ -1426,7 +1428,7 @@ int tls_psk_do_binder(SSL *s, const EVP_MD *md, const unsigned char *msgstart, const char external_label[] = "ext binder"; const char nonce_label[] = "resumption"; const char *label; - size_t bindersize, labelsize, hashsize = EVP_MD_size(md); + size_t bindersize, labelsize, psklen, hashsize = EVP_MD_size(md); int ret = -1; int usepskfored = 0; @@ -1444,16 +1446,12 @@ int tls_psk_do_binder(SSL *s, const EVP_MD *md, const unsigned char *msgstart, labelsize = sizeof(resumption_label) - 1; } - if (sess->master_key_length != hashsize) { - SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PSK_DO_BINDER, - SSL_R_BAD_PSK); - goto err; - } - if (external) { psk = sess->master_key; + psklen = sess->master_key_length; } else { psk = tmppsk; + psklen = hashsize; if (!tls13_hkdf_expand(s, md, sess->master_key, (const unsigned char *)nonce_label, sizeof(nonce_label) - 1, sess->ext.tick_nonce, @@ -1475,7 +1473,7 @@ int tls_psk_do_binder(SSL *s, const EVP_MD *md, const unsigned char *msgstart, early_secret = (unsigned char *)s->early_secret; else early_secret = (unsigned char *)sess->early_secret; - if (!tls13_generate_secret(s, md, NULL, psk, hashsize, early_secret)) { + if (!tls13_generate_secret(s, md, NULL, psk, psklen, early_secret)) { /* SSLfatal() already called */ goto err; } diff --git a/ssl/statem/extensions_clnt.c b/ssl/statem/extensions_clnt.c index 6bc3d0da..9bf2d1cb 100644 --- a/ssl/statem/extensions_clnt.c +++ b/ssl/statem/extensions_clnt.c @@ -705,9 +705,10 @@ EXT_RETURN tls_construct_ctos_key_share(SSL *s, WPACKET *pkt, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } -#endif - return EXT_RETURN_SENT; +#else + return EXT_RETURN_NOT_SENT; +#endif } EXT_RETURN tls_construct_ctos_cookie(SSL *s, WPACKET *pkt, unsigned int context, @@ -743,6 +744,7 @@ EXT_RETURN tls_construct_ctos_early_data(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { + char identity[PSK_MAX_IDENTITY_LEN + 1]; const unsigned char *id = NULL; size_t idlen = 0; SSL_SESSION *psksess = NULL; @@ -762,6 +764,58 @@ EXT_RETURN tls_construct_ctos_early_data(SSL *s, WPACKET *pkt, return EXT_RETURN_FAIL; } + if (psksess == NULL && s->psk_client_callback != NULL) { + unsigned char psk[PSK_MAX_PSK_LEN]; + size_t psklen = 0; + + memset(identity, 0, sizeof(identity)); + psklen = s->psk_client_callback(s, NULL, identity, sizeof(identity) - 1, + psk, sizeof(psk)); + + if (psklen > PSK_MAX_PSK_LEN) { + SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, + SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR); + return EXT_RETURN_FAIL; + } else if (psklen > 0) { + const unsigned char tls13_aes128gcmsha256_id[] = { 0x13, 0x01 }; + const SSL_CIPHER *cipher; + + idlen = strlen(identity); + if (idlen > PSK_MAX_IDENTITY_LEN) { + SSLfatal(s, SSL_AD_INTERNAL_ERROR, + SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, + ERR_R_INTERNAL_ERROR); + return EXT_RETURN_FAIL; + } + id = (unsigned char *)identity; + + /* + * We found a PSK using an old style callback. We don't know + * the digest so we default to SHA256 as per the TLSv1.3 spec + */ + cipher = SSL_CIPHER_find(s, tls13_aes128gcmsha256_id); + if (cipher == NULL) { + SSLfatal(s, SSL_AD_INTERNAL_ERROR, + SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, + ERR_R_INTERNAL_ERROR); + return EXT_RETURN_FAIL; + } + + psksess = SSL_SESSION_new(); + if (psksess == NULL + || !SSL_SESSION_set1_master_key(psksess, psk, psklen) + || !SSL_SESSION_set_cipher(psksess, cipher) + || !SSL_SESSION_set_protocol_version(psksess, TLS1_3_VERSION)) { + SSLfatal(s, SSL_AD_INTERNAL_ERROR, + SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, + ERR_R_INTERNAL_ERROR); + OPENSSL_cleanse(psk, psklen); + return EXT_RETURN_FAIL; + } + OPENSSL_cleanse(psk, psklen); + } + } + SSL_SESSION_free(s->psksession); s->psksession = psksess; if (psksess != NULL) { @@ -1397,6 +1451,12 @@ int tls_parse_stoc_session_ticket(SSL *s, PACKET *pkt, unsigned int context, int tls_parse_stoc_status_request(SSL *s, PACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { + if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST) { + /* We ignore this if the server sends a CertificateRequest */ + /* TODO(TLS1.3): Add support for this */ + return 1; + } + /* * MUST only be sent if we've requested a status * request message. In TLS <= 1.2 it must also be empty. @@ -1435,6 +1495,12 @@ int tls_parse_stoc_status_request(SSL *s, PACKET *pkt, unsigned int context, int tls_parse_stoc_sct(SSL *s, PACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { + if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST) { + /* We ignore this if the server sends it in a CertificateRequest */ + /* TODO(TLS1.3): Add support for this */ + return 1; + } + /* * Only take it if we asked for it - i.e if there is no CT validation * callback set, then a custom extension MAY be processing it, so we diff --git a/ssl/statem/extensions_srvr.c b/ssl/statem/extensions_srvr.c index d1be32c2..425cd80e 100644 --- a/ssl/statem/extensions_srvr.c +++ b/ssl/statem/extensions_srvr.c @@ -729,7 +729,7 @@ int tls_parse_ctos_cookie(SSL *s, PACKET *pkt, unsigned int context, X509 *x, unsigned long tm, now; /* Ignore any cookie if we're not set up to verify it */ - if (s->ctx->app_verify_cookie_cb == NULL + if (s->ctx->verify_stateless_cookie_cb == NULL || (s->s3->flags & TLS1_FLAGS_STATELESS) == 0) return 1; @@ -852,7 +852,7 @@ int tls_parse_ctos_cookie(SSL *s, PACKET *pkt, unsigned int context, X509 *x, } /* Verify the app cookie */ - if (s->ctx->app_verify_cookie_cb(s, PACKET_data(&appcookie), + if (s->ctx->verify_stateless_cookie_cb(s, PACKET_data(&appcookie), PACKET_remaining(&appcookie)) == 0) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_CTOS_COOKIE, SSL_R_COOKIE_MISMATCH); @@ -1028,6 +1028,7 @@ int tls_parse_ctos_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x, for (id = 0; PACKET_remaining(&identities) != 0; id++) { PACKET identity; unsigned long ticket_agel; + size_t idlen; if (!PACKET_get_length_prefixed_2(&identities, &identity) || !PACKET_get_net_4(&identities, &ticket_agel)) { @@ -1036,15 +1037,66 @@ int tls_parse_ctos_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x, return 0; } + idlen = PACKET_remaining(&identity); if (s->psk_find_session_cb != NULL - && !s->psk_find_session_cb(s, PACKET_data(&identity), - PACKET_remaining(&identity), + && !s->psk_find_session_cb(s, PACKET_data(&identity), idlen, &sess)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_PSK, SSL_R_BAD_EXTENSION); return 0; } + if(sess == NULL + && s->psk_server_callback != NULL + && idlen <= PSK_MAX_IDENTITY_LEN) { + char *pskid = NULL; + unsigned char pskdata[PSK_MAX_PSK_LEN]; + unsigned int pskdatalen; + + if (!PACKET_strndup(&identity, &pskid)) { + SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_PSK, + ERR_R_INTERNAL_ERROR); + return 0; + } + pskdatalen = s->psk_server_callback(s, pskid, pskdata, + sizeof(pskdata)); + OPENSSL_free(pskid); + if (pskdatalen > PSK_MAX_PSK_LEN) { + SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_PSK, + ERR_R_INTERNAL_ERROR); + return 0; + } else if (pskdatalen > 0) { + const SSL_CIPHER *cipher; + const unsigned char tls13_aes128gcmsha256_id[] = { 0x13, 0x01 }; + + /* + * We found a PSK using an old style callback. We don't know + * the digest so we default to SHA256 as per the TLSv1.3 spec + */ + cipher = SSL_CIPHER_find(s, tls13_aes128gcmsha256_id); + if (cipher == NULL) { + OPENSSL_cleanse(pskdata, pskdatalen); + SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_PSK, + ERR_R_INTERNAL_ERROR); + return 0; + } + + sess = SSL_SESSION_new(); + if (sess == NULL + || !SSL_SESSION_set1_master_key(sess, pskdata, + pskdatalen) + || !SSL_SESSION_set_cipher(sess, cipher) + || !SSL_SESSION_set_protocol_version(sess, + TLS1_3_VERSION)) { + OPENSSL_cleanse(pskdata, pskdatalen); + SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_PSK, + ERR_R_INTERNAL_ERROR); + goto err; + } + OPENSSL_cleanse(pskdata, pskdatalen); + } + } + if (sess != NULL) { /* We found a PSK */ SSL_SESSION *sesstmp = ssl_session_dup(sess, 0); @@ -1072,13 +1124,13 @@ int tls_parse_ctos_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x, PACKET_remaining(&identity), NULL, 0, &sess); - if (ret == TICKET_FATAL_ERR_MALLOC - || ret == TICKET_FATAL_ERR_OTHER) { + if (ret == SSL_TICKET_FATAL_ERR_MALLOC + || ret == SSL_TICKET_FATAL_ERR_OTHER) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_PSK, ERR_R_INTERNAL_ERROR); return 0; } - if (ret == TICKET_NO_DECRYPT) + if (ret == SSL_TICKET_NO_DECRYPT) continue; ticket_age = (uint32_t)ticket_agel; @@ -1624,16 +1676,20 @@ EXT_RETURN tls_construct_stoc_cookie(SSL *s, WPACKET *pkt, unsigned int context, { unsigned char *hashval1, *hashval2, *appcookie1, *appcookie2, *cookie; unsigned char *hmac, *hmac2; - size_t startlen, ciphlen, totcookielen, hashlen, hmaclen; - unsigned int appcookielen; + size_t startlen, ciphlen, totcookielen, hashlen, hmaclen, appcookielen; EVP_MD_CTX *hctx; EVP_PKEY *pkey; int ret = EXT_RETURN_FAIL; - if (s->ctx->app_gen_cookie_cb == NULL - || (s->s3->flags & TLS1_FLAGS_STATELESS) == 0) + if ((s->s3->flags & TLS1_FLAGS_STATELESS) == 0) return EXT_RETURN_NOT_SENT; + if (s->ctx->gen_stateless_cookie_cb == NULL) { + SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_COOKIE, + SSL_R_NO_COOKIE_CALLBACK_SET); + return EXT_RETURN_FAIL; + } + if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_cookie) || !WPACKET_start_sub_packet_u16(pkt) || !WPACKET_start_sub_packet_u16(pkt) @@ -1676,7 +1732,7 @@ EXT_RETURN tls_construct_stoc_cookie(SSL *s, WPACKET *pkt, unsigned int context, } /* Generate the application cookie */ - if (s->ctx->app_gen_cookie_cb(s, appcookie1, &appcookielen) == 0) { + if (s->ctx->gen_stateless_cookie_cb(s, appcookie1, &appcookielen) == 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_COOKIE, SSL_R_COOKIE_GEN_CALLBACK_FAILURE); return EXT_RETURN_FAIL; diff --git a/ssl/statem/statem_srvr.c b/ssl/statem/statem_srvr.c index 506d6948..21127bb0 100644 --- a/ssl/statem/statem_srvr.c +++ b/ssl/statem/statem_srvr.c @@ -3729,6 +3729,10 @@ int tls_construct_new_session_ticket(SSL *s, WPACKET *pkt) s->session->ext.max_early_data = s->max_early_data; } + if (tctx->generate_ticket_cb != NULL && + tctx->generate_ticket_cb(s, tctx->ticket_cb_data) == 0) + goto err; + /* get session encoding length */ slen_full = i2d_SSL_SESSION(s->session, NULL); /* @@ -3754,6 +3758,7 @@ int tls_construct_new_session_ticket(SSL *s, WPACKET *pkt) SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET, ERR_R_MALLOC_FAILURE); goto err; } + EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_SET_DRBG, 0, s->drbg); p = senc; if (!i2d_SSL_SESSION(s->session, &p)) { diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c index 465d4834..774625a2 100644 --- a/ssl/t1_enc.c +++ b/ssl/t1_enc.c @@ -170,6 +170,7 @@ int tls1_change_cipher_state(SSL *s, int which) ERR_R_MALLOC_FAILURE); goto err; } + EVP_CIPHER_CTX_ctrl(s->enc_write_ctx, EVP_CTRL_SET_DRBG, 0, s->drbg); dd = s->enc_write_ctx; if (SSL_IS_DTLS(s)) { mac_ctx = EVP_MD_CTX_new(); diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index 57f95599..596fdd4c 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -165,6 +165,7 @@ static const TLS_GROUP_INFO nid_list[] = { {NID_brainpoolP384r1, 192, TLS_CURVE_PRIME}, /* brainpoolP384r1 (27) */ {NID_brainpoolP512r1, 256, TLS_CURVE_PRIME}, /* brainpool512r1 (28) */ {EVP_PKEY_X25519, 128, TLS_CURVE_CUSTOM}, /* X25519 (29) */ + {EVP_PKEY_X448, 224, TLS_CURVE_CUSTOM}, /* X448 (30) */ }; static const unsigned char ecformats_default[] = { @@ -177,6 +178,7 @@ static const unsigned char ecformats_default[] = { static const uint16_t eccurves_default[] = { 29, /* X25519 (29) */ 23, /* secp256r1 (23) */ + 30, /* X448 (30) */ 25, /* secp521r1 (25) */ 24, /* secp384r1 (24) */ }; @@ -622,6 +624,7 @@ static const uint16_t tls12_sigalgs[] = { TLSEXT_SIGALG_ecdsa_secp384r1_sha384, TLSEXT_SIGALG_ecdsa_secp521r1_sha512, TLSEXT_SIGALG_ed25519, + TLSEXT_SIGALG_ed448, #endif TLSEXT_SIGALG_rsa_pss_pss_sha256, @@ -672,6 +675,9 @@ static const SIGALG_LOOKUP sigalg_lookup_tbl[] = { {"ed25519", TLSEXT_SIGALG_ed25519, NID_undef, -1, EVP_PKEY_ED25519, SSL_PKEY_ED25519, NID_undef, NID_undef}, + {"ed448", TLSEXT_SIGALG_ed448, + NID_undef, -1, EVP_PKEY_ED448, SSL_PKEY_ED448, + NID_undef, NID_undef}, {NULL, TLSEXT_SIGALG_ecdsa_sha224, NID_sha224, SSL_MD_SHA224_IDX, EVP_PKEY_EC, SSL_PKEY_ECC, NID_ecdsa_with_SHA224, NID_undef}, @@ -764,7 +770,8 @@ static const uint16_t tls_default_sigalg[] = { TLSEXT_SIGALG_gostr34102001_gostr3411, /* SSL_PKEY_GOST01 */ TLSEXT_SIGALG_gostr34102012_256_gostr34112012_256, /* SSL_PKEY_GOST12_256 */ TLSEXT_SIGALG_gostr34102012_512_gostr34112012_512, /* SSL_PKEY_GOST12_512 */ - 0 /* SSL_PKEY_ED25519 */ + 0, /* SSL_PKEY_ED25519 */ + 0, /* SSL_PKEY_ED448 */ }; /* Lookup TLS signature algorithm */ @@ -1198,8 +1205,8 @@ int tls1_set_server_sigalgs(SSL *s) * s->ctx->ext.ticket_key_cb asked to renew the client's ticket. * Otherwise, s->ext.ticket_expected is set to 0. */ -TICKET_RETURN tls_get_ticket_from_client(SSL *s, CLIENTHELLO_MSG *hello, - SSL_SESSION **ret) +SSL_TICKET_RETURN tls_get_ticket_from_client(SSL *s, CLIENTHELLO_MSG *hello, + SSL_SESSION **ret) { int retv; size_t size; @@ -1214,11 +1221,11 @@ TICKET_RETURN tls_get_ticket_from_client(SSL *s, CLIENTHELLO_MSG *hello, * resumption. */ if (s->version <= SSL3_VERSION || !tls_use_ticket(s)) - return TICKET_NONE; + return SSL_TICKET_NONE; ticketext = &hello->pre_proc_exts[TLSEXT_IDX_session_ticket]; if (!ticketext->present) - return TICKET_NONE; + return SSL_TICKET_NONE; size = PACKET_remaining(&ticketext->data); if (size == 0) { @@ -1227,7 +1234,7 @@ TICKET_RETURN tls_get_ticket_from_client(SSL *s, CLIENTHELLO_MSG *hello, * one. */ s->ext.ticket_expected = 1; - return TICKET_EMPTY; + return SSL_TICKET_EMPTY; } if (s->ext.session_secret_cb) { /* @@ -1236,25 +1243,49 @@ TICKET_RETURN tls_get_ticket_from_client(SSL *s, CLIENTHELLO_MSG *hello, * abbreviated handshake based on external mechanism to * calculate the master secret later. */ - return TICKET_NO_DECRYPT; + return SSL_TICKET_NO_DECRYPT; } retv = tls_decrypt_ticket(s, PACKET_data(&ticketext->data), size, hello->session_id, hello->session_id_len, ret); + + /* + * If set, the decrypt_ticket_cb() is always called regardless of the + * return from tls_decrypt_ticket(). The callback is responsible for + * checking |retv| before it performs any action + */ + if (s->session_ctx->decrypt_ticket_cb != NULL) { + size_t keyname_len = size; + + if (keyname_len > TLSEXT_KEYNAME_LENGTH) + keyname_len = TLSEXT_KEYNAME_LENGTH; + retv = s->session_ctx->decrypt_ticket_cb(s, *ret, + PACKET_data(&ticketext->data), + keyname_len, + retv, s->session_ctx->ticket_cb_data); + } + switch (retv) { - case TICKET_NO_DECRYPT: + case SSL_TICKET_NO_DECRYPT: s->ext.ticket_expected = 1; - return TICKET_NO_DECRYPT; + return SSL_TICKET_NO_DECRYPT; - case TICKET_SUCCESS: - return TICKET_SUCCESS; + case SSL_TICKET_SUCCESS: + return SSL_TICKET_SUCCESS; - case TICKET_SUCCESS_RENEW: + case SSL_TICKET_SUCCESS_RENEW: s->ext.ticket_expected = 1; - return TICKET_SUCCESS; + return SSL_TICKET_SUCCESS; + + case SSL_TICKET_EMPTY: + s->ext.ticket_expected = 1; + return SSL_TICKET_EMPTY; + + case SSL_TICKET_NONE: + return SSL_TICKET_NONE; default: - return TICKET_FATAL_ERR_OTHER; + return SSL_TICKET_FATAL_ERR_OTHER; } } @@ -1268,15 +1299,15 @@ TICKET_RETURN tls_get_ticket_from_client(SSL *s, CLIENTHELLO_MSG *hello, * psess: (output) on return, if a ticket was decrypted, then this is set to * point to the resulting session. */ -TICKET_RETURN tls_decrypt_ticket(SSL *s, const unsigned char *etick, - size_t eticklen, const unsigned char *sess_id, - size_t sesslen, SSL_SESSION **psess) +SSL_TICKET_RETURN tls_decrypt_ticket(SSL *s, const unsigned char *etick, + size_t eticklen, const unsigned char *sess_id, + size_t sesslen, SSL_SESSION **psess) { SSL_SESSION *sess; unsigned char *sdec; const unsigned char *p; int slen, renew_ticket = 0, declen; - TICKET_RETURN ret = TICKET_FATAL_ERR_OTHER; + SSL_TICKET_RETURN ret = SSL_TICKET_FATAL_ERR_OTHER; size_t mlen; unsigned char tick_hmac[EVP_MAX_MD_SIZE]; HMAC_CTX *hctx = NULL; @@ -1285,17 +1316,17 @@ TICKET_RETURN tls_decrypt_ticket(SSL *s, const unsigned char *etick, /* Need at least keyname + iv */ if (eticklen < TLSEXT_KEYNAME_LENGTH + EVP_MAX_IV_LENGTH) { - ret = TICKET_NO_DECRYPT; + ret = SSL_TICKET_NO_DECRYPT; goto err; } /* Initialize session ticket encryption and HMAC contexts */ hctx = HMAC_CTX_new(); if (hctx == NULL) - return TICKET_FATAL_ERR_MALLOC; + return SSL_TICKET_FATAL_ERR_MALLOC; ctx = EVP_CIPHER_CTX_new(); if (ctx == NULL) { - ret = TICKET_FATAL_ERR_MALLOC; + ret = SSL_TICKET_FATAL_ERR_MALLOC; goto err; } if (tctx->ext.ticket_key_cb) { @@ -1306,7 +1337,7 @@ TICKET_RETURN tls_decrypt_ticket(SSL *s, const unsigned char *etick, if (rv < 0) goto err; if (rv == 0) { - ret = TICKET_NO_DECRYPT; + ret = SSL_TICKET_NO_DECRYPT; goto err; } if (rv == 2) @@ -1315,7 +1346,7 @@ TICKET_RETURN tls_decrypt_ticket(SSL *s, const unsigned char *etick, /* Check key name matches */ if (memcmp(etick, tctx->ext.tick_key_name, TLSEXT_KEYNAME_LENGTH) != 0) { - ret = TICKET_NO_DECRYPT; + ret = SSL_TICKET_NO_DECRYPT; goto err; } if (HMAC_Init_ex(hctx, tctx->ext.tick_hmac_key, @@ -1338,7 +1369,7 @@ TICKET_RETURN tls_decrypt_ticket(SSL *s, const unsigned char *etick, /* Sanity check ticket length: must exceed keyname + IV + HMAC */ if (eticklen <= TLSEXT_KEYNAME_LENGTH + EVP_CIPHER_CTX_iv_length(ctx) + mlen) { - ret = TICKET_NO_DECRYPT; + ret = SSL_TICKET_NO_DECRYPT; goto err; } eticklen -= mlen; @@ -1350,7 +1381,7 @@ TICKET_RETURN tls_decrypt_ticket(SSL *s, const unsigned char *etick, HMAC_CTX_free(hctx); if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen)) { EVP_CIPHER_CTX_free(ctx); - return TICKET_NO_DECRYPT; + return SSL_TICKET_NO_DECRYPT; } /* Attempt to decrypt session data */ /* Move p after IV to start of encrypted ticket, update length */ @@ -1361,12 +1392,12 @@ TICKET_RETURN tls_decrypt_ticket(SSL *s, const unsigned char *etick, (int)eticklen) <= 0) { EVP_CIPHER_CTX_free(ctx); OPENSSL_free(sdec); - return TICKET_FATAL_ERR_OTHER; + return SSL_TICKET_FATAL_ERR_OTHER; } if (EVP_DecryptFinal(ctx, sdec + slen, &declen) <= 0) { EVP_CIPHER_CTX_free(ctx); OPENSSL_free(sdec); - return TICKET_NO_DECRYPT; + return SSL_TICKET_NO_DECRYPT; } slen += declen; EVP_CIPHER_CTX_free(ctx); @@ -1380,7 +1411,7 @@ TICKET_RETURN tls_decrypt_ticket(SSL *s, const unsigned char *etick, /* Some additional consistency checks */ if (slen != 0 || sess->session_id_length != 0) { SSL_SESSION_free(sess); - return TICKET_NO_DECRYPT; + return SSL_TICKET_NO_DECRYPT; } /* * The session ID, if non-empty, is used by some clients to detect @@ -1393,15 +1424,15 @@ TICKET_RETURN tls_decrypt_ticket(SSL *s, const unsigned char *etick, sess->session_id_length = sesslen; *psess = sess; if (renew_ticket) - return TICKET_SUCCESS_RENEW; + return SSL_TICKET_SUCCESS_RENEW; else - return TICKET_SUCCESS; + return SSL_TICKET_SUCCESS; } ERR_clear_error(); /* * For session parse failure, indicate that we need to send a new ticket. */ - return TICKET_NO_DECRYPT; + return SSL_TICKET_NO_DECRYPT; err: EVP_CIPHER_CTX_free(ctx); HMAC_CTX_free(hctx); @@ -2180,6 +2211,7 @@ void tls1_set_cert_validity(SSL *s) tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_GOST12_256); tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_GOST12_512); tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ED25519); + tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ED448); } /* User level utility function to check a chain is suitable */ diff --git a/ssl/t1_trce.c b/ssl/t1_trce.c index fa975be1..3186b987 100644 --- a/ssl/t1_trce.c +++ b/ssl/t1_trce.c @@ -79,7 +79,7 @@ static const ssl_trace_tbl ssl_content_tbl[] = { {SSL3_RT_APPLICATION_DATA, "ApplicationData"}, }; -/* Handshake types */ +/* Handshake types, sorted by ascending id */ static const ssl_trace_tbl ssl_handshake_tbl[] = { {SSL3_MT_HELLO_REQUEST, "HelloRequest"}, {SSL3_MT_CLIENT_HELLO, "ClientHello"}, @@ -94,10 +94,10 @@ static const ssl_trace_tbl ssl_handshake_tbl[] = { {SSL3_MT_SERVER_DONE, "ServerHelloDone"}, {SSL3_MT_CERTIFICATE_VERIFY, "CertificateVerify"}, {SSL3_MT_CLIENT_KEY_EXCHANGE, "ClientKeyExchange"}, - {SSL3_MT_CERTIFICATE_STATUS, "CertificateStatus"}, - {SSL3_MT_CLIENT_KEY_EXCHANGE, "ClientKeyExchange"}, {SSL3_MT_FINISHED, "Finished"}, + {SSL3_MT_CERTIFICATE_URL, "CertificateUrl"}, {SSL3_MT_CERTIFICATE_STATUS, "CertificateStatus"}, + {SSL3_MT_SUPPLEMENTAL_DATA, "SupplementalData"}, {SSL3_MT_KEY_UPDATE, "KeyUpdate"}, # ifndef OPENSSL_NO_NEXTPROTONEG {SSL3_MT_NEXT_PROTO, "NextProto"}, @@ -449,7 +449,7 @@ static const ssl_trace_tbl ssl_comp_tbl[] = { {0x0001, "Zlib Compression"} }; -/* Extensions */ +/* Extensions sorted by ascending id */ static const ssl_trace_tbl ssl_exts_tbl[] = { {TLSEXT_TYPE_server_name, "server_name"}, {TLSEXT_TYPE_max_fragment_length, "max_fragment_length"}, @@ -461,28 +461,32 @@ static const ssl_trace_tbl ssl_exts_tbl[] = { {TLSEXT_TYPE_client_authz, "client_authz"}, {TLSEXT_TYPE_server_authz, "server_authz"}, {TLSEXT_TYPE_cert_type, "cert_type"}, - {TLSEXT_TYPE_key_share, "key_share"}, - {TLSEXT_TYPE_psk, "psk"}, - {TLSEXT_TYPE_psk_kex_modes, "psk_key_exchange_modes"}, {TLSEXT_TYPE_supported_groups, "supported_groups"}, {TLSEXT_TYPE_ec_point_formats, "ec_point_formats"}, {TLSEXT_TYPE_srp, "srp"}, {TLSEXT_TYPE_signature_algorithms, "signature_algorithms"}, {TLSEXT_TYPE_use_srtp, "use_srtp"}, - {TLSEXT_TYPE_session_ticket, "session_ticket"}, - {TLSEXT_TYPE_supported_versions, "supported_versions"}, - {TLSEXT_TYPE_renegotiate, "renegotiate"}, -# ifndef OPENSSL_NO_NEXTPROTONEG - {TLSEXT_TYPE_next_proto_neg, "next_proto_neg"}, -# endif + {TLSEXT_TYPE_heartbeat, "tls_heartbeat"}, {TLSEXT_TYPE_application_layer_protocol_negotiation, "application_layer_protocol_negotiation"}, {TLSEXT_TYPE_signed_certificate_timestamp, "signed_certificate_timestamps"}, {TLSEXT_TYPE_padding, "padding"}, {TLSEXT_TYPE_encrypt_then_mac, "encrypt_then_mac"}, {TLSEXT_TYPE_extended_master_secret, "extended_master_secret"}, + {TLSEXT_TYPE_session_ticket, "session_ticket"}, + {TLSEXT_TYPE_psk, "psk"}, {TLSEXT_TYPE_early_data, "early_data"}, - {TLSEXT_TYPE_post_handshake_auth, "post_handshake_auth"} + {TLSEXT_TYPE_supported_versions, "supported_versions"}, + {TLSEXT_TYPE_cookie, "cookie_ext"}, + {TLSEXT_TYPE_psk_kex_modes, "psk_key_exchange_modes"}, + {TLSEXT_TYPE_certificate_authorities, "certificate_authorities"}, + {TLSEXT_TYPE_post_handshake_auth, "post_handshake_auth"}, + {TLSEXT_TYPE_signature_algorithms_cert, "signature_algorithms_cert"}, + {TLSEXT_TYPE_key_share, "key_share"}, + {TLSEXT_TYPE_renegotiate, "renegotiate"}, +# ifndef OPENSSL_NO_NEXTPROTONEG + {TLSEXT_TYPE_next_proto_neg, "next_proto_neg"}, +# endif }; static const ssl_trace_tbl ssl_groups_tbl[] = { @@ -515,6 +519,7 @@ static const ssl_trace_tbl ssl_groups_tbl[] = { {27, "brainpoolP384r1"}, {28, "brainpoolP512r1"}, {29, "ecdh_x25519"}, + {30, "ecdh_x448"}, {256, "ffdhe2048"}, {257, "ffdhe3072"}, {258, "ffdhe4096"}, @@ -544,6 +549,7 @@ static const ssl_trace_tbl ssl_sigalg_tbl[] = { {TLSEXT_SIGALG_ecdsa_secp521r1_sha512, "ecdsa_secp521r1_sha512"}, {TLSEXT_SIGALG_ecdsa_sha224, "ecdsa_sha224"}, {TLSEXT_SIGALG_ed25519, "ed25519"}, + {TLSEXT_SIGALG_ed448, "ed448"}, {TLSEXT_SIGALG_ecdsa_sha1, "ecdsa_sha1"}, {TLSEXT_SIGALG_rsa_pss_rsae_sha256, "rsa_pss_rsae_sha256"}, {TLSEXT_SIGALG_rsa_pss_rsae_sha384, "rsa_pss_rsae_sha384"}, diff --git a/ssl/tls13_enc.c b/ssl/tls13_enc.c index 63328045..5982c8e9 100644 --- a/ssl/tls13_enc.c +++ b/ssl/tls13_enc.c @@ -406,6 +406,7 @@ int tls13_change_cipher_state(SSL *s, int which) SSL_F_TLS13_CHANGE_CIPHER_STATE, ERR_R_MALLOC_FAILURE); goto err; } + EVP_CIPHER_CTX_ctrl(s->enc_write_ctx, EVP_CTRL_SET_DRBG, 0, s->drbg); } ciph_ctx = s->enc_write_ctx; iv = s->write_iv; diff --git a/ssl/tls_srp.c b/ssl/tls_srp.c index 37adcbca..d7323289 100644 --- a/ssl/tls_srp.c +++ b/ssl/tls_srp.c @@ -1,10 +1,14 @@ /* - * Copyright 2004-2016 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2004-2018 The OpenSSL Project Authors. All Rights Reserved. + * Copyright (c) 2004, EdelKey Project. All Rights Reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy * in the file LICENSE in the source distribution or at * https://www.openssl.org/source/license.html + * + * Originally written by Christophe Renou and Peter Sylvester, + * for the EdelKey project. */ #include diff --git a/test/bntests.pl b/test/bntests.pl old mode 100755 new mode 100644 diff --git a/test/build.info b/test/build.info index 38fcf842..9fcaa7d8 100644 --- a/test/build.info +++ b/test/build.info @@ -35,6 +35,7 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=MAIN bftest ssltest_old dsatest exptest rsa_test \ evp_test evp_extra_test igetest v3nametest v3ext \ crltest danetest bad_dtls_test lhash_test \ + conf_include_test \ constant_time_test verify_extra_test clienthellotest \ packettest asynctest secmemtest srptest memleaktest stack_test \ dtlsv1listentest ct_test threadstest afalgtest d2i_test \ @@ -390,6 +391,10 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=MAIN INCLUDE[time_offset_test]=../include DEPEND[time_offset_test]=../libcrypto libtestutil.a + SOURCE[conf_include_test]=conf_include_test.c + INCLUDE[conf_include_test]=../include + DEPEND[conf_include_test]=../libcrypto libtestutil.a + # Internal test programs. These are essentially a collection of internal # test routines. Some of them need to reach internal symbols that aren't # available through the shared library (at least on Linux, Solaris, Windows @@ -400,7 +405,8 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=MAIN # names with the DLL import libraries. IF[{- $disabled{shared} || $target{build_scheme}->[1] ne 'windows' -}] PROGRAMS_NO_INST=asn1_internal_test modes_internal_test x509_internal_test \ - tls13encryptiontest wpackettest ctype_internal_test + tls13encryptiontest wpackettest ctype_internal_test \ + rdrand_sanitytest IF[{- !$disabled{poly1305} -}] PROGRAMS_NO_INST=poly1305_internal_test ENDIF @@ -460,6 +466,10 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=MAIN SOURCE[curve448_internal_test]=curve448_internal_test.c INCLUDE[curve448_internal_test]=.. ../include ../crypto/ec/curve448 DEPEND[curve448_internal_test]=../libcrypto.a libtestutil.a + + SOURCE[rdrand_sanitytest]=rdrand_sanitytest.c + INCLUDE[rdrand_sanitytest]=../include + DEPEND[rdrand_sanitytest]=../libcrypto.a libtestutil.a ENDIF IF[{- !$disabled{mdc2} -}] diff --git a/test/certs/client-ed448-cert.pem b/test/certs/client-ed448-cert.pem new file mode 100644 index 00000000..3d6d5e87 --- /dev/null +++ b/test/certs/client-ed448-cert.pem @@ -0,0 +1,15 @@ +-----BEGIN CERTIFICATE----- +MIICQDCCASigAwIBAgIBAjANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdSb290 +IENBMCAXDTE4MDIyNzE3MTAxN1oYDzIxMTgwMjI4MTcxMDE3WjAXMRUwEwYDVQQD +DAxDbGllbnQtRWQ0NDgwQzAFBgMrZXEDOgB4bFbdmw9IviAHXKt/2/hRDaiEr6JH +bsLr3IPNQq3XIYxYh4AIPx3YffYW3xukHDGWTQ50dptQiwCjezB5MB0GA1UdDgQW +BBTEno3ezhmTYZzGdD65nVRMp3f2hzAfBgNVHSMEGDAWgBSO9SWvHptrhD18gJrJ +U5xNcvejUjAJBgNVHRMEAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMBcGA1UdEQQQ +MA6CDENsaWVudC1FZDQ0ODANBgkqhkiG9w0BAQsFAAOCAQEAP2/y30iko57i8lUY +ju9Vb4V0TCATKa+HNnzHG1jyWAgiWpPtHe269Cnb8AvdwWKVeppKkG6LeWHo3btP +LOd8xEFhnklM4rPkxMYMCQ0lcw2xagbw3CW12mLs15N3QCjxSnA/kuuftzor9fRl +gzazVh4Kf/jXtlRyBI6R4+bXSGgKhIipdBF5xWmTPvZBViWKxgysQuP1bNzw9AC4 +QMGm4ApOVuY9iE8dPYKgJUVGWc3d9l23fkd422kEgz5euK66HovjYaBj0S0kZhEZ +tWUCRTcv4k40ke2jr8/Zm3Ugab09XWU2T98k/OvXu+Y0AlLMZp2ehC6wXObprEXv +dY5URg== +-----END CERTIFICATE----- diff --git a/test/certs/client-ed448-key.pem b/test/certs/client-ed448-key.pem new file mode 100644 index 00000000..ab4d7ff3 --- /dev/null +++ b/test/certs/client-ed448-key.pem @@ -0,0 +1,4 @@ +-----BEGIN PRIVATE KEY----- +MEcCAQAwBQYDK2VxBDsEOWmRn7GCRupyB1q/qQZ+h1lEt+TGtZSNJ5U+Saa+X+hk +gWpeKJP9MTpw7kdMAeAhb6XlhCANH2zV9A== +-----END PRIVATE KEY----- diff --git a/test/certs/mkcert.sh b/test/certs/mkcert.sh old mode 100755 new mode 100644 index 7048f277..1d4b5037 --- a/test/certs/mkcert.sh +++ b/test/certs/mkcert.sh @@ -55,6 +55,7 @@ key() { args=("${args[@]}" -pkeyopt ec_param_enc:named_curve);; dsa) args=(-paramfile "$bits");; ed25519) ;; + ed448) ;; *) printf "Unsupported key algorithm: %s\n" "$alg" >&2; return 1;; esac stderr_onerror \ diff --git a/test/certs/server-ed448-cert.pem b/test/certs/server-ed448-cert.pem new file mode 100644 index 00000000..740f2755 --- /dev/null +++ b/test/certs/server-ed448-cert.pem @@ -0,0 +1,14 @@ +-----BEGIN CERTIFICATE----- +MIICHTCCAQWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdSb290 +IENBMCAXDTE4MDIyNzE1MDcxM1oYDzIxMTgwMjI4MTUwNzEzWjAQMQ4wDAYDVQQD +DAVFZDQ0ODBDMAUGAytlcQM6ABBicYlhG1s3AoG5BFmY3r50lJzjQoER4zwuieEe +QTvKxLEV06vGh79UWO6yQ5FxqmxvM1F/Xw7RAKNfMF0wHQYDVR0OBBYEFAwa1L4m +3pwA8+IEJ7K/4izrjJIHMB8GA1UdIwQYMBaAFHB/Lq6DaFmYBCMqzes+F80k3QFJ +MAkGA1UdEwQCMAAwEAYDVR0RBAkwB4IFRWQ0NDgwDQYJKoZIhvcNAQELBQADggEB +AAugH2aE6VvArnOVjKBtalqtHlx+NCC3+S65sdWc9A9sNgI1ZiN7dn76TKn5d0T7 +NqV8nY1rwQg6WPGrCD6Eh63qhotytqYIxltppb4MOUJcz/Zf0ZwhB5bUfwNB//Ih +5aZT86FpXVuyMnwUTWPcISJqpZiBv95yzZFMpniHFvecvV445ly4TFW5y6VURh40 +Tg4tMgjPTE7ADw+dX4FvnTWY3blxT1GzGxGvqWW4HgP8dOETnjmAwCzN0nUVmH9s +7ybHORcSljcpe0XH6L/K7mbI+r8mVLsAoIzUeDwUdKKJZ2uGEtdhQDmJBp4EjOXE +3qIn3wEQQ6ax4NIwkZihdLI= +-----END CERTIFICATE----- diff --git a/test/certs/server-ed448-key.pem b/test/certs/server-ed448-key.pem new file mode 100644 index 00000000..25a750fe --- /dev/null +++ b/test/certs/server-ed448-key.pem @@ -0,0 +1,4 @@ +-----BEGIN PRIVATE KEY----- +MEcCAQAwBQYDK2VxBDsEOTiHqANC9pFHbs8VAeqZ52cwKi0jPTSM5GjsKW4vbgG6 +BMFSdURqGj2FD02H7xsyrR20pIXI1GbE+A== +-----END PRIVATE KEY----- diff --git a/test/certs/setup.sh b/test/certs/setup.sh old mode 100755 new mode 100644 diff --git a/test/clienthellotest.c b/test/clienthellotest.c index 4f6bd40c..5cff519e 100644 --- a/test/clienthellotest.c +++ b/test/clienthellotest.c @@ -111,12 +111,19 @@ static int test_client_hello(int currtest) * F5_WORKAROUND_MIN_MSG_LEN bytes long - meaning padding will be * needed. */ - if (currtest == TEST_ADD_PADDING - && (!TEST_false(SSL_CTX_set_alpn_protos(ctx, + if (currtest == TEST_ADD_PADDING) { + if (!TEST_false(SSL_CTX_set_alpn_protos(ctx, (unsigned char *)alpn_prots, - sizeof(alpn_prots) - 1)))) + sizeof(alpn_prots) - 1))) + goto end; + /* + * Otherwise we need to make sure we have a small enough message to + * not need padding. + */ + } else if (!TEST_true(SSL_CTX_set_cipher_list(ctx, + "AES128-SHA:TLS13-AES-128-GCM-SHA256"))) { goto end; - + } break; default: diff --git a/test/conf_include_test.c b/test/conf_include_test.c new file mode 100644 index 00000000..41e4da04 --- /dev/null +++ b/test/conf_include_test.c @@ -0,0 +1,161 @@ +/* + * Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the OpenSSL license (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include +#include +#include +#include +#include "testutil.h" + +#ifdef _WIN32 +# include +# define DIRSEP "/\\" +# define chdir _chdir +# define DIRSEP_PRESERVE 0 +#elif !defined(OPENSSL_NO_POSIX_IO) +# include +# ifndef OPENSSL_SYS_VMS +# define DIRSEP "/" +# define DIRSEP_PRESERVE 0 +# else +# define DIRSEP "/]:" +# define DIRSEP_PRESERVE 1 +# endif +#else +/* the test does not work without chdir() */ +# define chdir(x) (-1); +# define DIRSEP "" +# define DIRSEP_PRESERVE 0 +#endif + +/* changes path to that of the filename */ +static int change_path(const char *file) +{ + char *s = OPENSSL_strdup(file); + char *p = s; + char *last = NULL; + int ret; + + if (s == NULL) + return -1; + + while ((p = strpbrk(p, DIRSEP)) != NULL) { + last = p++; + } + if (last == NULL) + return 0; + last[DIRSEP_PRESERVE] = 0; + + TEST_note("changing path to %s", s); + ret = chdir(s); + OPENSSL_free(s); + return ret; +} + +/* + * This test program checks the operation of the .include directive. + */ + +static CONF *conf; +static BIO *in; +static int expect_failure = 0; + +static int test_load_config(void) +{ + long errline; + long val; + char *str; + long err; + + if (!TEST_int_gt(NCONF_load_bio(conf, in, &errline), 0) + || !TEST_int_eq(err = ERR_peek_error(), 0)) { + if (expect_failure) + return 1; + TEST_note("Failure loading the configuration at line %ld", errline); + return 0; + } + if (expect_failure) { + TEST_note("Failure expected but did not happen"); + return 0; + } + + if (!TEST_int_gt(CONF_modules_load(conf, NULL, 0), 0)) { + TEST_note("Failed in CONF_modules_load"); + return 0; + } + + /* verify whether RANDFILE is set correctly */ + str = NCONF_get_string(conf, "", "RANDFILE"); + if (!TEST_ptr(str) || !TEST_str_eq(str, "./.rnd")) { + TEST_note("RANDFILE incorrect"); + return 0; + } + + /* verify whether CA_default/default_days is set */ + val = 0; + if (!TEST_int_eq(NCONF_get_number(conf, "CA_default", "default_days", &val), 1) + || !TEST_int_eq(val, 365)) { + TEST_note("default_days incorrect"); + return 0; + } + + /* verify whether req/default_bits is set */ + val = 0; + if (!TEST_int_eq(NCONF_get_number(conf, "req", "default_bits", &val), 1) + || !TEST_int_eq(val, 2048)) { + TEST_note("default_bits incorrect"); + return 0; + } + + /* verify whether countryName_default is set correctly */ + str = NCONF_get_string(conf, "req_distinguished_name", "countryName_default"); + if (!TEST_ptr(str) || !TEST_str_eq(str, "AU")) { + TEST_note("countryName_default incorrect"); + return 0; + } + + return 1; +} + +int setup_tests(void) +{ + const char *conf_file; + const char *arg2; + + if (!TEST_ptr(conf = NCONF_new(NULL))) + return 0; + + conf_file = test_get_argument(0); + + if (!TEST_ptr(conf_file) + || !TEST_ptr(in = BIO_new_file(conf_file, "r"))) { + TEST_note("Unable to open the file argument"); + return 0; + } + + if ((arg2 = test_get_argument(1)) != NULL && *arg2 == 'f') { + expect_failure = 1; + } + + /* + * For this test we need to chdir as we use relative + * path names in the config files. + */ + change_path(conf_file); + + ADD_TEST(test_load_config); + return 1; +} + +void cleanup_tests(void) +{ + BIO_vfree(in); + NCONF_free(conf); + CONF_modules_unload(1); +} diff --git a/test/ctype_internal_test.c b/test/ctype_internal_test.c index 9cb2321b..f1e392eb 100644 --- a/test/ctype_internal_test.c +++ b/test/ctype_internal_test.c @@ -15,10 +15,10 @@ /* * Even though the VMS C RTL claims to be C99 compatible, it's not entirely - * so far (C RTL version 8.4). For the sake of these tests, we therefore - * define our own. + * so far (C RTL version 8.4). Same applies to OSF. For the sake of these + * tests, we therefore define our own. */ -#if defined(__VMS) && __CRTL_VER <= 80400000 +#if (defined(__VMS) && __CRTL_VER <= 80400000) || defined(__osf__) static int isblank(int c) { return c == ' ' || c == '\t'; @@ -35,7 +35,9 @@ static int test_ctype_chars(int n) return TEST_int_eq(isalpha(n) != 0, ossl_isalpha(n) != 0) && TEST_int_eq(isalnum(n) != 0, ossl_isalnum(n) != 0) +#if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 199901L && TEST_int_eq(isblank(n) != 0, ossl_isblank(n) != 0) +#endif && TEST_int_eq(iscntrl(n) != 0, ossl_iscntrl(n) != 0) && TEST_int_eq(isdigit(n) != 0, ossl_isdigit(n) != 0) && TEST_int_eq(isgraph(n) != 0, ossl_isgraph(n) != 0) diff --git a/test/ecdsatest.c b/test/ecdsatest.c index e53afdf3..6a15b3af 100644 --- a/test/ecdsatest.c +++ b/test/ecdsatest.c @@ -239,7 +239,7 @@ static int test_builtin(void) unsigned char dirt, offset; nid = curves[n].nid; - if (nid == NID_ipsec4 || nid == NID_X25519) + if (nid == NID_ipsec4) continue; /* create new ecdsa key (== EC_KEY) */ if (!TEST_ptr(eckey = EC_KEY_new()) diff --git a/test/ectest.c b/test/ectest.c index 93417528..e49920ce 100644 --- a/test/ectest.c +++ b/test/ectest.c @@ -1152,12 +1152,6 @@ static int internal_curve_test_method(int n) int r, nid = curves[n].nid; EC_GROUP *group; - /* - * Skip for X25519 because low level operations such as EC_POINT_mul() - * are not supported for this curve - */ - if (nid == NID_X25519) - return 1; if (!TEST_ptr(group = EC_GROUP_new_by_curve_name(nid))) { TEST_info("Curve %s failed\n", OBJ_nid2sn(nid)); return 0; diff --git a/test/handshake_helper.c b/test/handshake_helper.c index c0265ab3..9b781b03 100644 --- a/test/handshake_helper.c +++ b/test/handshake_helper.c @@ -38,6 +38,7 @@ void HANDSHAKE_RESULT_free(HANDSHAKE_RESULT *result) OPENSSL_free(result->server_npn_negotiated); OPENSSL_free(result->client_alpn_negotiated); OPENSSL_free(result->server_alpn_negotiated); + OPENSSL_free(result->result_session_ticket_app_data); sk_X509_NAME_pop_free(result->server_ca_names, X509_NAME_free); sk_X509_NAME_pop_free(result->client_ca_names, X509_NAME_free); OPENSSL_free(result->cipher); @@ -64,6 +65,7 @@ typedef struct ctx_data_st { size_t alpn_protocols_len; char *srp_user; char *srp_password; + char *session_ticket_app_data; } CTX_DATA; /* |ctx_data| itself is stack-allocated. */ @@ -77,6 +79,8 @@ static void ctx_data_free_data(CTX_DATA *ctx_data) ctx_data->srp_user = NULL; OPENSSL_free(ctx_data->srp_password); ctx_data->srp_password = NULL; + OPENSSL_free(ctx_data->session_ticket_app_data); + ctx_data->session_ticket_app_data = NULL; } static int ex_data_idx; @@ -453,6 +457,26 @@ static int server_srp_cb(SSL *s, int *ad, void *arg) } #endif /* !OPENSSL_NO_SRP */ +static int generate_session_ticket_cb(SSL *s, void *arg) +{ + CTX_DATA *server_ctx_data = arg; + SSL_SESSION *ss = SSL_get_session(s); + char *app_data = server_ctx_data->session_ticket_app_data; + + if (ss == NULL || app_data == NULL) + return 0; + + return SSL_SESSION_set1_ticket_appdata(ss, app_data, strlen(app_data)); +} + +static SSL_TICKET_RETURN decrypt_session_ticket_cb(SSL *s, SSL_SESSION *ss, + const unsigned char *keyname, + size_t keyname_len, + SSL_TICKET_RETURN retv, void *arg) +{ + return retv; +} + /* * Configure callbacks and other properties that can't be set directly * in the server/client CONF. @@ -607,6 +631,21 @@ static int configure_handshake_ctx(SSL_CTX *server_ctx, SSL_CTX *server2_ctx, OPENSSL_free(alpn_protos); } + if (extra->server.session_ticket_app_data != NULL) { + server_ctx_data->session_ticket_app_data = + OPENSSL_strdup(extra->server.session_ticket_app_data); + SSL_CTX_set_session_ticket_cb(server_ctx, generate_session_ticket_cb, + decrypt_session_ticket_cb, server_ctx_data); + } + if (extra->server2.session_ticket_app_data != NULL) { + if (!TEST_ptr(server2_ctx)) + goto err; + server2_ctx_data->session_ticket_app_data = + OPENSSL_strdup(extra->server2.session_ticket_app_data); + SSL_CTX_set_session_ticket_cb(server2_ctx, NULL, + decrypt_session_ticket_cb, server2_ctx_data); + } + /* * Use fixed session ticket keys so that we can decrypt a ticket created with * one CTX in another CTX. Don't address server2 for the moment. @@ -1583,6 +1622,11 @@ static HANDSHAKE_RESULT *do_handshake_internal( SSL_get0_alpn_selected(server.ssl, &proto, &proto_len); ret->server_alpn_negotiated = dup_str(proto, proto_len); + if ((sess = SSL_get0_session(server.ssl)) != NULL) { + SSL_SESSION_get0_ticket_appdata(sess, (void**)&tick, &tick_len); + ret->result_session_ticket_app_data = OPENSSL_strndup((const char*)tick, tick_len); + } + ret->client_resumed = SSL_session_reused(client.ssl); ret->server_resumed = SSL_session_reused(server.ssl); diff --git a/test/handshake_helper.h b/test/handshake_helper.h index 9dcbeb78..8b112307 100644 --- a/test/handshake_helper.h +++ b/test/handshake_helper.h @@ -65,6 +65,8 @@ typedef struct handshake_result { /* Session id status */ ssl_session_id_t session_id; char *cipher; + /* session ticket application data */ + char *result_session_ticket_app_data; } HANDSHAKE_RESULT; HANDSHAKE_RESULT *HANDSHAKE_RESULT_new(void); diff --git a/test/ossl_shim/build.info b/test/ossl_shim/build.info index aa5f0624..12250600 100644 --- a/test/ossl_shim/build.info +++ b/test/ossl_shim/build.info @@ -1,4 +1,4 @@ -IF[{- defined $target{cxx} && !$disabled{"external-tests"}-}] +IF[{- defined $target{CXX} && !$disabled{"external-tests"} -}] PROGRAMS_NO_INST=ossl_shim SOURCE[ossl_shim]=ossl_shim.cc async_bio.cc packeted_bio.cc test_config.cc INCLUDE[ossl_shim]=. include ../../include diff --git a/test/ossl_shim/ossl_shim.cc b/test/ossl_shim/ossl_shim.cc index 5ef195c6..739d1bd1 100644 --- a/test/ossl_shim/ossl_shim.cc +++ b/test/ossl_shim/ossl_shim.cc @@ -533,6 +533,12 @@ static bssl::UniquePtr SetupCtx(const TestConfig *config) { !SSL_CTX_set_max_proto_version(ssl_ctx.get(), TLS1_3_VERSION)) { return nullptr; } +#else + /* Ensure we don't negotiate TLSv1.3 until we can handle it */ + if (!config->is_dtls && + !SSL_CTX_set_max_proto_version(ssl_ctx.get(), TLS1_2_VERSION)) { + return nullptr; + } #endif std::string cipher_list = "ALL"; @@ -968,7 +974,7 @@ static bool DoExchange(bssl::UniquePtr *out_session, } if (config->enable_all_curves) { static const int kAllCurves[] = { - NID_X9_62_prime256v1, NID_secp384r1, NID_secp521r1, NID_X25519, + NID_X25519, NID_X9_62_prime256v1, NID_X448, NID_secp521r1, NID_secp384r1 }; if (!SSL_set1_curves(ssl.get(), kAllCurves, OPENSSL_ARRAY_SIZE(kAllCurves))) { diff --git a/test/packettest.c b/test/packettest.c index 716dec30..9b482fa6 100644 --- a/test/packettest.c +++ b/test/packettest.c @@ -47,7 +47,7 @@ static int test_PACKET_end(void) static int test_PACKET_get_1(void) { - unsigned int i; + unsigned int i = 0; PACKET pkt; if (!TEST_true(PACKET_buf_init(&pkt, smbuf, BUF_LEN)) @@ -64,7 +64,7 @@ static int test_PACKET_get_1(void) static int test_PACKET_get_4(void) { - unsigned long i; + unsigned long i = 0; PACKET pkt; if (!TEST_true(PACKET_buf_init(&pkt, smbuf, BUF_LEN)) @@ -81,7 +81,7 @@ static int test_PACKET_get_4(void) static int test_PACKET_get_net_2(void) { - unsigned int i; + unsigned int i = 0; PACKET pkt; if (!TEST_true(PACKET_buf_init(&pkt, smbuf, BUF_LEN)) @@ -98,7 +98,7 @@ static int test_PACKET_get_net_2(void) static int test_PACKET_get_net_3(void) { - unsigned long i; + unsigned long i = 0; PACKET pkt; if (!TEST_true(PACKET_buf_init(&pkt, smbuf, BUF_LEN)) @@ -115,7 +115,7 @@ static int test_PACKET_get_net_3(void) static int test_PACKET_get_net_4(void) { - unsigned long i; + unsigned long i = 0; PACKET pkt; if (!TEST_true(PACKET_buf_init(&pkt, smbuf, BUF_LEN)) @@ -133,7 +133,7 @@ static int test_PACKET_get_net_4(void) static int test_PACKET_get_sub_packet(void) { PACKET pkt, subpkt; - unsigned long i; + unsigned long i = 0; if (!TEST_true(PACKET_buf_init(&pkt, smbuf, BUF_LEN)) || !TEST_true(PACKET_get_sub_packet(&pkt, &subpkt, 4)) @@ -153,7 +153,7 @@ static int test_PACKET_get_sub_packet(void) static int test_PACKET_get_bytes(void) { - const unsigned char *bytes; + const unsigned char *bytes = NULL; PACKET pkt; if (!TEST_true(PACKET_buf_init(&pkt, smbuf, BUF_LEN)) @@ -285,7 +285,7 @@ static int test_PACKET_contains_zero_byte(void) static int test_PACKET_forward(void) { - const unsigned char *byte; + const unsigned char *byte = NULL; PACKET pkt; if (!TEST_true(PACKET_buf_init(&pkt, smbuf, BUF_LEN)) diff --git a/test/rdrand_sanitytest.c b/test/rdrand_sanitytest.c new file mode 100644 index 00000000..21d5139f --- /dev/null +++ b/test/rdrand_sanitytest.c @@ -0,0 +1,125 @@ +/* + * Copyright 2018-2018 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the OpenSSL license (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include +#include +#include +#include "testutil.h" +#include + +#if (defined(__i386) || defined(__i386__) || defined(_M_IX86) || \ + defined(__x86_64) || defined(__x86_64__) || \ + defined(_M_AMD64) || defined (_M_X64)) && defined(OPENSSL_CPUID_OBJ) + +size_t OPENSSL_ia32_rdrand_bytes(unsigned char *buf, size_t len); +size_t OPENSSL_ia32_rdseed_bytes(unsigned char *buf, size_t len); + +void OPENSSL_cpuid_setup(); + +extern unsigned int OPENSSL_ia32cap_P[4]; + +static int sanity_check_bytes(size_t (*rng)(unsigned char *, size_t), + int rounds, int min_failures, int max_retries, int max_zero_words) +{ + int testresult = 0; + unsigned char prior[31] = {0}, buf[31] = {0}, check[7]; + int failures = 0, zero_words = 0; + + int i; + for (i = 0; i < rounds; i++) { + size_t generated = 0; + + int retry; + for (retry = 0; retry < max_retries; retry++) { + generated = rng(buf, sizeof(buf)); + if (generated == sizeof(buf)) + break; + failures++; + } + + /*- + * Verify that we don't have too many unexpected runs of zeroes, + * implying that we might be accidentally using the 32-bit RDRAND + * instead of the 64-bit one on 64-bit systems. + */ + size_t j; + for (j = 0; j < sizeof(buf) - 1; j++) { + if (buf[j] == 0 && buf[j+1] == 0) { + zero_words++; + } + } + + if (!TEST_int_eq(generated, sizeof(buf))) + goto end; + if (!TEST_false(!memcmp(prior, buf, sizeof(buf)))) + goto end; + + /* Verify that the last 7 bytes of buf aren't all the same value */ + unsigned char *tail = &buf[sizeof(buf) - sizeof(check)]; + memset(check, tail[0], 7); + if (!TEST_false(!memcmp(check, tail, sizeof(check)))) + goto end; + + /* Save the result and make sure it's different next time */ + memcpy(prior, buf, sizeof(buf)); + } + + if (!TEST_int_le(zero_words, max_zero_words)) + goto end; + + if (!TEST_int_ge(failures, min_failures)) + goto end; + + testresult = 1; +end: + return testresult; +} + +static int sanity_check_rdrand_bytes() +{ + return sanity_check_bytes(OPENSSL_ia32_rdrand_bytes, 1000, 0, 10, 10); +} + +static int sanity_check_rdseed_bytes() +{ + /*- + * RDSEED may take many retries to succeed; note that this is effectively + * multiplied by the 8x retry loop in asm, and failure probabilities are + * increased by the fact that we need either 4 or 8 samples depending on + * the platform. + */ + return sanity_check_bytes(OPENSSL_ia32_rdseed_bytes, 1000, 1, 10000, 10); +} + +int setup_tests() { + OPENSSL_cpuid_setup(); + + int have_rdseed = (OPENSSL_ia32cap_P[2] & (1 << 18)) != 0; + int have_rdrand = (OPENSSL_ia32cap_P[1] & (1 << (62 - 32))) != 0; + + if (have_rdrand) { + ADD_TEST(sanity_check_rdrand_bytes); + } + + if (have_rdseed) { + ADD_TEST(sanity_check_rdseed_bytes); + } + + return 1; +} + + +#else + +int setup_tests() +{ + return 1; +} + +#endif diff --git a/test/recipes/06-test-rdrand.t b/test/recipes/06-test-rdrand.t new file mode 100644 index 00000000..07ee7c84 --- /dev/null +++ b/test/recipes/06-test-rdrand.t @@ -0,0 +1,25 @@ +#! /usr/bin/perl + +# Copyright 2018-2018 The OpenSSL Project Authors. All Rights Reserved. +# +# Licensed under the OpenSSL license (the "License"). You may not use +# this file except in compliance with the License. You can obtain a copy +# in the file LICENSE in the source distribution or at +# https://www.openssl.org/source/license.html + +use strict; + +use OpenSSL::Test; # get 'plan' +use OpenSSL::Test::Simple; +use OpenSSL::Test::Utils; + +setup("test_rdrand_sanity"); + +plan skip_all => "This test is unsupported in a shared library build on Windows" + if $^O eq 'MSWin32' && !disabled("shared"); + +# We also need static builds to be enabled even on linux +plan skip_all => "This test is unsupported if static builds are not enabled" + if disabled("static"); + +simple_test("test_rdrand_sanity", "rdrand_sanitytest"); diff --git a/test/recipes/15-test_out_option.t b/test/recipes/15-test_out_option.t new file mode 100644 index 00000000..018ff3d0 --- /dev/null +++ b/test/recipes/15-test_out_option.t @@ -0,0 +1,60 @@ +#! /usr/bin/env perl +# Copyright 2018 The OpenSSL Project Authors. All Rights Reserved. +# +# Licensed under the OpenSSL license (the "License"). You may not use +# this file except in compliance with the License. You can obtain a copy +# in the file LICENSE in the source distribution or at +# https://www.openssl.org/source/license.html + + +use strict; +use warnings; + +use File::Spec; +use OpenSSL::Test qw/:DEFAULT srctop_file/; +use OpenSSL::Test::Utils; + +setup("test_out_option"); + +plan skip_all => "'-out' option tests are not available on Windows" + if $^O eq 'MSWin32'; + +plan tests => 11; + +# The following patterns should be tested: +# +# path dirname +# /usr/ / +# / / +# . . +# .. . + +test_illegal_path('/usr/'); +test_illegal_path('/'); +test_illegal_path('./'); +test_illegal_path('../'); + +# Test for trying to create a file in a non-exist directory +my @chars = ("A".."Z", "a".."z", "0".."9"); +my $rand_path = $chars[rand @chars] for 1..32; +$rand_path .= "/test.pem"; + +test_illegal_path($rand_path); +test_legal_path('test.pem'); +unlink 'test.pem'; + +sub test_illegal_path { + my $path = File::Spec->canonpath($_[0]); + + my $start = time(); + ok(!run(app([ 'openssl', 'genrsa', '-out', $path, '16384'])), "invalid output path: $path"); + my $end = time(); + # The above process should exit in 2 seconds if the path is not valid + ok($end - $start < 2, "check time consumed"); +} + +sub test_legal_path { + my $path = File::Spec->canonpath($_[0]); + + ok(run(app([ 'openssl', 'genrsa', '-out', $path, '2048'])), "valid output path: $path"); +} diff --git a/test/recipes/30-test_evp_data/evppkey.txt b/test/recipes/30-test_evp_data/evppkey.txt index 2e88c119..017ab41f 100644 --- a/test/recipes/30-test_evp_data/evppkey.txt +++ b/test/recipes/30-test_evp_data/evppkey.txt @@ -748,6 +748,56 @@ Result = KEYOP_INIT_ERROR Function = EVP_PKEY_verify_init Reason = operation not supported for this keytype +Title = X448 test vectors (from RFC7748 6.2) + +PrivateKey=Alice-448 +-----BEGIN PRIVATE KEY----- +MEYCAQAwBQYDK2VvBDoEOJqPSSXRUZ9Xdc9GsEtYANTunui66LxVZdSYwo3Zybr1 +dKlBl0SJc5EAY4Km8SerHZrC2MClmHJr +-----END PRIVATE KEY----- + +PublicKey=Alice-448-PUBLIC +-----BEGIN PUBLIC KEY----- +MEIwBQYDK2VvAzkAmwj3zDG34+Z9ItWuoSEHSic70rg94Jxj+qc9LCLF2bvINmRy +QdlT1AxbEtqIEg1TF3+A5TLEH6A= +-----END PUBLIC KEY----- + +PrivPubKeyPair = Alice-448:Alice-448-PUBLIC + +PrivateKey=Bob-448 +-----BEGIN PRIVATE KEY----- +MEYCAQAwBQYDK2VvBDoEOBwwanrCoOLgmQspRHDLoznmRTdysHWBHY+tDR1pJ8Eg +u17olysNPiE3TJySGwnRsDZvELZRc5kt +-----END PRIVATE KEY----- + +PublicKey=Bob-448-PUBLIC +-----BEGIN PUBLIC KEY----- +MEIwBQYDK2VvAzkAPreoKbDNIPW8/AtZm2/sz22kYnEHvbDU80W0MCfYuXL8PjT7 +QjKhPKcG3LV67D2uB73BxnvzNgk= +-----END PUBLIC KEY----- + +PrivPubKeyPair = Bob-448:Bob-448-PUBLIC + +Derive=Alice-448 +PeerKey=Bob-448-PUBLIC +SharedSecret=07fff4181ac6cc95ec1c16a94a0f74d12da232ce40a77552281d282bb60c0b56fd2464c335543936521c24403085d59a449a5037514a879d + +Derive=Bob-448 +PeerKey=Alice-448-PUBLIC +SharedSecret=07fff4181ac6cc95ec1c16a94a0f74d12da232ce40a77552281d282bb60c0b56fd2464c335543936521c24403085d59a449a5037514a879d + +# Illegal sign/verify operations with X448 key + +Sign=Alice-448 +Result = KEYOP_INIT_ERROR +Function = EVP_PKEY_sign_init +Reason = operation not supported for this keytype + +Verify=Alice-448 +Result = KEYOP_INIT_ERROR +Function = EVP_PKEY_verify_init +Reason = operation not supported for this keytype + # Additional RSA-PSS and RSA-OAEP tests converted from # ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip @@ -17172,9 +17222,18 @@ Result = KEYPAIR_MISMATCH PrivPubKeyPair = Bob-25519:Alice-25519-PUBLIC Result = KEYPAIR_MISMATCH +PrivPubKeyPair = Alice-448:Bob-448-PUBLIC +Result = KEYPAIR_MISMATCH + +PrivPubKeyPair = Bob-448:Alice-448-PUBLIC +Result = KEYPAIR_MISMATCH + PrivPubKeyPair = Alice-25519:P-256-PUBLIC Result = KEYPAIR_TYPE_MISMATCH +PrivPubKeyPair = Alice-448:P-256-PUBLIC +Result = KEYPAIR_TYPE_MISMATCH + PrivPubKeyPair = RSA-2048:P-256-PUBLIC Result = KEYPAIR_TYPE_MISMATCH @@ -17448,6 +17507,198 @@ DigestSign = SHA256 Key = ED25519-1 Result = DIGESTSIGNINIT_ERROR + +Title = ED448 tests from RFC8032 + +PrivateKey=ED448-1 +-----BEGIN PRIVATE KEY----- +MEcCAQAwBQYDK2VxBDsEOWyCpWLLgI0Q1jK+ichRPr9skp803fqMn2PJlg7240ij +UoyKP8wvBE45o/xblEkvjwMudUmiAJj5Ww== +-----END PRIVATE KEY----- + +PrivateKey=ED448-2 +-----BEGIN PRIVATE KEY----- +MEcCAQAwBQYDK2VxBDsEOcTqsF01cAfGMvPbtISJkk1VKwj+DDU6DUofAKzaLEY6 +++pnxejSh3xeO8OXplmUnvgCHpVOChInTg== +-----END PRIVATE KEY----- + +PrivateKey=ED448-3 +-----BEGIN PRIVATE KEY----- +MEcCAQAwBQYDK2VxBDsEOc0j0k9xQnTnRDQyN7kykPUR9kJfmOZEWf8gPomFCD/9 +9gUAVTq8DgXNAhhL24nEzNZ+GHlRJn6zKA== +-----END PRIVATE KEY----- + +PrivateKey=ED448-4 +-----BEGIN PRIVATE KEY----- +MEcCAQAwBQYDK2VxBDsEOSWM3UraMu2cn/VOY3Vq5YL7j6sqxyHyyOZ2pydoUT2T +n2Pd21VgkTPymt+G7Jkp3MtSwcX9L/fiGw== +-----END PRIVATE KEY----- + +PrivateKey=ED448-5 +-----BEGIN PRIVATE KEY----- +MEcCAQAwBQYDK2VxBDsEOX706EVEI2dS+7VrjzGiOhDkKBT19VygN83MEcZMmjsp +ScG7YHADFGEXMqbC/qmO68AmahGpOXAQDg== +-----END PRIVATE KEY----- + +PrivateKey=ED448-6 +-----BEGIN PRIVATE KEY----- +MEcCAQAwBQYDK2VxBDsEOdZd80GtE+AIVnaIuu3ajp3NwX3AJJdOpbQie2Uw4zm/ +8h+Z5oymlo88ym3+D7n0+rT6E11VQuo/AQ== +-----END PRIVATE KEY----- + +PrivateKey=ED448-7 +-----BEGIN PRIVATE KEY----- +MEcCAQAwBQYDK2VxBDsEOS7F/jwXBFq9sTal5qkT4yq3WuaLU9L8FJt35QQTLTdW +m352a6dKGb1hYjQ6IchZCqnOvKkBTGNt9Q== +-----END PRIVATE KEY----- + +PrivateKey=ED448-8 +-----BEGIN PRIVATE KEY----- +MEcCAQAwBQYDK2VxBDsEOYctCTeA9dNzDffCEmZLN7ig8k9WgQ2qg4LNT6P3djTs +RNxU8cLtm+qG+vt2Mti+GZ6hZfWtVd2c6A== +-----END PRIVATE KEY----- + +PublicKey=ED448-1-PUBLIC +-----BEGIN PUBLIC KEY----- +MEMwBQYDK2VxAzoAX9dEm1m0Yf0s54fsYWrUah2hNCSFpw4fig6nXYDpZ3jt8SR2 +m0bHBhvWeD3x5Q9s0foavq/oJWGA +-----END PUBLIC KEY----- + +PublicKey=ED448-2-PUBLIC +-----BEGIN PUBLIC KEY----- +MEMwBQYDK2VxAzoAQ7oo9DDN/0Vq5TFUX37NCsg0pV2TWMA3K/oMbGeYwIZq6gHr +AHQoArhDjqTLghacI1FgYntMOpSA +-----END PUBLIC KEY----- + +PublicKey=ED448-3-PUBLIC +-----BEGIN PUBLIC KEY----- +MEMwBQYDK2VxAzoA3OqeePNaG/NJmoMbELhskKrAHNhLZ6AQm1WjbpMoseNl/OFh +1xznExpUPqTLX36fHYsAaWRHABQA +-----END PUBLIC KEY----- + +PublicKey=ED448-4-PUBLIC +-----BEGIN PUBLIC KEY----- +MEMwBQYDK2VxAzoAO6FtoMbyzB8wGHdAdW9eeY1rxfwBXXxjzJUQ7j/UStwk2Olo +tuRub5TRm5RTYXJr114UnvCYF/WA +-----END PUBLIC KEY----- + +PublicKey=ED448-5-PUBLIC +-----BEGIN PUBLIC KEY----- +MEMwBQYDK2VxAzoAs9oHmwqkk6V3ICnwRnuuvuWoES2dOiJTI2HaKU97s4FcXcWe +F2tNnzgcoJOOE8bAexdL5l36V46A +-----END PUBLIC KEY----- + +PublicKey=ED448-6-PUBLIC +-----BEGIN PUBLIC KEY----- +MEMwBQYDK2VxAzoA35cF9Y7bq4Asf4Njz+VWCrHGEywgqfHdFjSDom+KxTo51oCL +9KHfvSYbCZuwOz+1CQbLKL2KCB8A +-----END PUBLIC KEY----- + +PublicKey=ED448-7-PUBLIC +-----BEGIN PUBLIC KEY----- +MEMwBQYDK2VxAzoAeXVvAU3P4gefXdnnGL5BceLvJIagjyUYb2v/Q6mTa5v+EkAr +CK5leYo9geIunsgOdpCGLvPU7ToA +-----END PUBLIC KEY----- + +PublicKey=ED448-8-PUBLIC +-----BEGIN PUBLIC KEY----- +MEMwBQYDK2VxAzoAqBsuinClrJT/28ybrfw/6wgB8lhXi7EUrUTs4ewOeZ2gjv+4 +HF1oXAxW9k7srvjN8RzDhzeDjPQA +-----END PUBLIC KEY----- + +PrivPubKeyPair = ED448-1:ED448-1-PUBLIC + +PrivPubKeyPair = ED448-2:ED448-2-PUBLIC + +PrivPubKeyPair = ED448-3:ED448-3-PUBLIC + +PrivPubKeyPair = ED448-4:ED448-4-PUBLIC + +PrivPubKeyPair = ED448-5:ED448-5-PUBLIC + +PrivPubKeyPair = ED448-6:ED448-6-PUBLIC + +PrivPubKeyPair = ED448-7:ED448-7-PUBLIC + +PrivPubKeyPair = ED448-8:ED448-8-PUBLIC + +OneShotDigestSign = NULL +Key = ED448-1 +Input = "" +Output = 533a37f6bbe457251f023c0d88f976ae2dfb504a843e34d2074fd823d41a591f2b233f034f628281f2fd7a22ddd47d7828c59bd0a21bfd3980ff0d2028d4b18a9df63e006c5d1c2d345b925d8dc00b4104852db99ac5c7cdda8530a113a0f4dbb61149f05a7363268c71d95808ff2e652600 + +OneShotDigestSign = NULL +Key = ED448-2 +Input = 03 +Output = 26b8f91727bd62897af15e41eb43c377efb9c610d48f2335cb0bd0087810f4352541b143c4b981b7e18f62de8ccdf633fc1bf037ab7cd779805e0dbcc0aae1cbcee1afb2e027df36bc04dcecbf154336c19f0af7e0a6472905e799f1953d2a0ff3348ab21aa4adafd1d234441cf807c03a00 + +OneShotDigestSign = NULL +Key = ED448-3 +Input = 0c3e544074ec63b0265e0c +Output = 1f0a8888ce25e8d458a21130879b840a9089d999aaba039eaf3e3afa090a09d389dba82c4ff2ae8ac5cdfb7c55e94d5d961a29fe0109941e00b8dbdeea6d3b051068df7254c0cdc129cbe62db2dc957dbb47b51fd3f213fb8698f064774250a5028961c9bf8ffd973fe5d5c206492b140e00 + +OneShotDigestSign = NULL +Key = ED448-4 +Input = 64a65f3cdedcdd66811e2915 +Output = 7eeeab7c4e50fb799b418ee5e3197ff6bf15d43a14c34389b59dd1a7b1b85b4ae90438aca634bea45e3a2695f1270f07fdcdf7c62b8efeaf00b45c2c96ba457eb1a8bf075a3db28e5c24f6b923ed4ad747c3c9e03c7079efb87cb110d3a99861e72003cbae6d6b8b827e4e6c143064ff3c00 + +OneShotDigestSign = NULL +Key = ED448-5 +Input = 64a65f3cdedcdd66811e2915e7 +Output = 6a12066f55331b6c22acd5d5bfc5d71228fbda80ae8dec26bdd306743c5027cb4890810c162c027468675ecf645a83176c0d7323a2ccde2d80efe5a1268e8aca1d6fbc194d3f77c44986eb4ab4177919ad8bec33eb47bbb5fc6e28196fd1caf56b4e7e0ba5519234d047155ac727a1053100 + +OneShotDigestSign = NULL +Key = ED448-6 +Input = bd0f6a3747cd561bdddf4640a332461a4a30a12a434cd0bf40d766d9c6d458e5512204a30c17d1f50b5079631f64eb3112182da3005835461113718d1a5ef944 +Output = 554bc2480860b49eab8532d2a533b7d578ef473eeb58c98bb2d0e1ce488a98b18dfde9b9b90775e67f47d4a1c3482058efc9f40d2ca033a0801b63d45b3b722ef552bad3b4ccb667da350192b61c508cf7b6b5adadc2c8d9a446ef003fb05cba5f30e88e36ec2703b349ca229c2670833900 + +OneShotDigestSign = NULL +Key = ED448-7 +Input = 15777532b0bdd0d1389f636c5f6b9ba734c90af572877e2d272dd078aa1e567cfa80e12928bb542330e8409f3174504107ecd5efac61ae7504dabe2a602ede89e5cca6257a7c77e27a702b3ae39fc769fc54f2395ae6a1178cab4738e543072fc1c177fe71e92e25bf03e4ecb72f47b64d0465aaea4c7fad372536c8ba516a6039c3c2a39f0e4d832be432dfa9a706a6e5c7e19f397964ca4258002f7c0541b590316dbc5622b6b2a6fe7a4abffd96105eca76ea7b98816af0748c10df048ce012d901015a51f189f3888145c03650aa23ce894c3bd889e030d565071c59f409a9981b51878fd6fc110624dcbcde0bf7a69ccce38fabdf86f3bef6044819de11 +Output = c650ddbb0601c19ca11439e1640dd931f43c518ea5bea70d3dcde5f4191fe53f00cf966546b72bcc7d58be2b9badef28743954e3a44a23f880e8d4f1cfce2d7a61452d26da05896f0a50da66a239a8a188b6d825b3305ad77b73fbac0836ecc60987fd08527c1a8e80d5823e65cafe2a3d00 + +OneShotDigestSign = NULL +Key = ED448-8 +Input = 6ddf802e1aae4986935f7f981ba3f0351d6273c0a0c22c9c0e8339168e675412a3debfaf435ed651558007db4384b650fcc07e3b586a27a4f7a00ac8a6fec2cd86ae4bf1570c41e6a40c931db27b2faa15a8cedd52cff7362c4e6e23daec0fbc3a79b6806e316efcc7b68119bf46bc76a26067a53f296dafdbdc11c77f7777e972660cf4b6a9b369a6665f02e0cc9b6edfad136b4fabe723d2813db3136cfde9b6d044322fee2947952e031b73ab5c603349b307bdc27bc6cb8b8bbd7bd323219b8033a581b59eadebb09b3c4f3d2277d4f0343624acc817804728b25ab797172b4c5c21a22f9c7839d64300232eb66e53f31c723fa37fe387c7d3e50bdf9813a30e5bb12cf4cd930c40cfb4e1fc622592a49588794494d56d24ea4b40c89fc0596cc9ebb961c8cb10adde976a5d602b1c3f85b9b9a001ed3c6a4d3b1437f52096cd1956d042a597d561a596ecd3d1735a8d570ea0ec27225a2c4aaff26306d1526c1af3ca6d9cf5a2c98f47e1c46db9a33234cfd4d81f2c98538a09ebe76998d0d8fd25997c7d255c6d66ece6fa56f11144950f027795e653008f4bd7ca2dee85d8e90f3dc315130ce2a00375a318c7c3d97be2c8ce5b6db41a6254ff264fa6155baee3b0773c0f497c573f19bb4f4240281f0b1f4f7be857a4e59d416c06b4c50fa09e1810ddc6b1467baeac5a3668d11b6ecaa901440016f389f80acc4db977025e7f5924388c7e340a732e554440e76570f8dd71b7d640b3450d1fd5f0410a18f9a3494f707c717b79b4bf75c98400b096b21653b5d217cf3565c9597456f70703497a078763829bc01bb1cbc8fa04eadc9a6e3f6699587a9e75c94e5bab0036e0b2e711392cff0047d0d6b05bd2a588bc109718954259f1d86678a579a3120f19cfb2963f177aeb70f2d4844826262e51b80271272068ef5b3856fa8535aa2a88b2d41f2a0e2fda7624c2850272ac4a2f561f8f2f7a318bfd5caf9696149e4ac824ad3460538fdc25421beec2cc6818162d06bbed0c40a387192349db67a118bada6cd5ab0140ee273204f628aad1c135f770279a651e24d8c14d75a6059d76b96a6fd857def5e0b354b27ab937a5815d16b5fae407ff18222c6d1ed263be68c95f32d908bd895cd76207ae726487567f9a67dad79abec316f683b17f2d02bf07e0ac8b5bc6162cf94697b3c27cd1fea49b27f23ba2901871962506520c392da8b6ad0d99f7013fbc06c2c17a569500c8a7696481c1cd33e9b14e40b82e79a5f5db82571ba97bae3ad3e0479515bb0e2b0f3bfcd1fd33034efc6245eddd7ee2086ddae2600d8ca73e214e8c2b0bdb2b047c6a464a562ed77b73d2d841c4b34973551257713b753632efba348169abc90a68f42611a40126d7cb21b58695568186f7e569d2ff0f9e745d0487dd2eb997cafc5abf9dd102e62ff66cba87 +Output = e301345a41a39a4d72fff8df69c98075a0cc082b802fc9b2b6bc503f926b65bddf7f4c8f1cb49f6396afc8a70abe6d8aef0db478d4c6b2970076c6a0484fe76d76b3a97625d79f1ce240e7c576750d295528286f719b413de9ada3e8eb78ed573603ce30d8bb761785dc30dbc320869e1a00 + +# Verify test +OneShotDigestVerify = NULL +Key = ED448-1-PUBLIC +Input = "" +Output = 533a37f6bbe457251f023c0d88f976ae2dfb504a843e34d2074fd823d41a591f2b233f034f628281f2fd7a22ddd47d7828c59bd0a21bfd3980ff0d2028d4b18a9df63e006c5d1c2d345b925d8dc00b4104852db99ac5c7cdda8530a113a0f4dbb61149f05a7363268c71d95808ff2e652600 + +# Corrupted input +OneShotDigestVerify = NULL +Key = ED448-1-PUBLIC +Input = "bad" +Output = 533a37f6bbe457251f023c0d88f976ae2dfb504a843e34d2074fd823d41a591f2b233f034f628281f2fd7a22ddd47d7828c59bd0a21bfd3980ff0d2028d4b18a9df63e006c5d1c2d345b925d8dc00b4104852db99ac5c7cdda8530a113a0f4dbb61149f05a7363268c71d95808ff2e652600 +Result = VERIFY_ERROR + +# Corrupted signature +OneShotDigestVerify = NULL +Key = ED448-1-PUBLIC +Input = "" +Output = 533a37f6bbe457251f023c0d88f976ae2dfb504a843e34d2074fd823d41a591f2b233f034f628281f2fd7a22ddd47d7828c59bd0a21bfd3980ff0d2028d4b18a9df63e006c5d1c2d345b925d8dc00b4104852db99ac5c7cdda8530a113a0f4dbb61149f05a7363268c71d95808ff2e652601 +Result = VERIFY_ERROR + +# Make sure update calls return an error +DigestSign = NULL +Key = ED448-1 +Input = "Test" +Result = DIGESTUPDATE_ERROR + +DigestVerify = NULL +Key = ED448-1-PUBLIC +Input = "Test" +Result = DIGESTUPDATE_ERROR + +# Attempt to set invalid digest +DigestSign = SHA256 +Key = ED448-1 +Result = DIGESTSIGNINIT_ERROR + + # Key generation tests KeyGen = rsaEncryption Ctrl = rsa_keygen_bits:128 diff --git a/test/recipes/80-test_ssl_new.t b/test/recipes/80-test_ssl_new.t index d5a130f7..8d52d1b3 100644 --- a/test/recipes/80-test_ssl_new.t +++ b/test/recipes/80-test_ssl_new.t @@ -28,7 +28,7 @@ map { s/\^// } @conf_files if $^O eq "VMS"; # We hard-code the number of tests to double-check that the globbing above # finds all files as expected. -plan tests => 26; # = scalar @conf_srcs +plan tests => 27; # = scalar @conf_srcs # Some test results depend on the configuration of enabled protocols. We only # verify generated sources in the default configuration. diff --git a/test/recipes/90-test_includes.t b/test/recipes/90-test_includes.t new file mode 100644 index 00000000..5169700c --- /dev/null +++ b/test/recipes/90-test_includes.t @@ -0,0 +1,25 @@ +#! /usr/bin/perl + +use strict; +use warnings; +use OpenSSL::Test qw/:DEFAULT data_file/; +use OpenSSL::Test::Utils; + +setup("test_includes"); + +plan skip_all => "test_includes doesn't work without posix-io" + if disabled("posix-io"); + +plan tests => # The number of tests being performed + 3 + + ($^O eq "VMS" ? 2 : 0); + +ok(run(test(["conf_include_test", data_file("includes.cnf")])), "test directory includes"); +ok(run(test(["conf_include_test", data_file("includes-file.cnf")])), "test file includes"); +if ($^O eq "VMS") { + ok(run(test(["conf_include_test", data_file("vms-includes.cnf")])), + "test directory includes, VMS syntax"); + ok(run(test(["conf_include_test", data_file("vms-includes-file.cnf")])), + "test file includes, VMS syntax"); +} +ok(run(test(["conf_include_test", data_file("includes-broken.cnf"), "f"])), "test broken includes"); diff --git a/test/recipes/90-test_includes_data/conf-includes/includes1.cnf b/test/recipes/90-test_includes_data/conf-includes/includes1.cnf new file mode 100644 index 00000000..66c89006 --- /dev/null +++ b/test/recipes/90-test_includes_data/conf-includes/includes1.cnf @@ -0,0 +1,36 @@ +[ default ] +# +# SSLeay example configuration file. +# This is mostly being used for generation of certificate requests. +# + +RANDFILE = ./.rnd + +#################################################################### +[ ca ] +default_ca = CA_default # The default ca section + +#################################################################### +[ CA_default ] + +dir = ./demoCA # Where everything is kept +certs = $dir/certs # Where the issued certs are kept +crl_dir = $dir/crl # Where the issued crl are kept +database = $dir/index.txt # database index file. +new_certs_dir = $dir/new_certs # default place for new certs. + +certificate = $dir/CAcert.pem # The CA certificate +serial = $dir/serial # The current serial number +crl = $dir/crl.pem # The current CRL +private_key = $dir/private/CAkey.pem# The private key +RANDFILE = $dir/private/.rand # private random number file + +default_days = 365 # how long to certify for +default_crl_days= 30 # how long before next CRL +default_md = md5 # which md to use. + +# A few difference way of specifying how similar the request should look +# For type CA, the listed attributes must be the same, and the optional +# and supplied fields are just that :-) +policy = policy_match + diff --git a/test/recipes/90-test_includes_data/conf-includes/includes2.cnf b/test/recipes/90-test_includes_data/conf-includes/includes2.cnf new file mode 100644 index 00000000..aa5e67c0 --- /dev/null +++ b/test/recipes/90-test_includes_data/conf-includes/includes2.cnf @@ -0,0 +1,53 @@ +# For the CA policy +[ policy_match ] +countryName = match +stateOrProvinceName = match +organizationName = match +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +# For the 'anything' policy +# At this point in time, you must list all acceptable 'object' +# types. +[ policy_anything ] +countryName = optional +stateOrProvinceName = optional +localityName = optional +organizationName = optional +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +#################################################################### +[ req ] +default_bits = 2048 +default_keyfile = testkey.pem +distinguished_name = req_distinguished_name +encrypt_rsa_key = no + +[ req_distinguished_name ] +countryName = Country Name (2 letter code) +countryName_default = AU +countryName_value = AU + +stateOrProvinceName = State or Province Name (full name) +stateOrProvinceName_default = Queensland +stateOrProvinceName_value = + +localityName = Locality Name (eg, city) +localityName_value = Brisbane + +organizationName = Organization Name (eg, company) +organizationName_default = +organizationName_value = CryptSoft Pty Ltd + +organizationalUnitName = Organizational Unit Name (eg, section) +organizationalUnitName_default = +organizationalUnitName_value = . + +commonName = Common Name (eg, YOUR name) +commonName_value = Eric Young + +emailAddress = Email Address +emailAddress_value = eay@mincom.oz.au diff --git a/test/recipes/90-test_includes_data/includes-broken.cnf b/test/recipes/90-test_includes_data/includes-broken.cnf new file mode 100644 index 00000000..d38e18c5 --- /dev/null +++ b/test/recipes/90-test_includes_data/includes-broken.cnf @@ -0,0 +1,5 @@ +# +# Example configuration file using includes. +# + +.include includes-broken3.cnf diff --git a/test/recipes/90-test_includes_data/includes-file.cnf b/test/recipes/90-test_includes_data/includes-file.cnf new file mode 100644 index 00000000..1737b70d --- /dev/null +++ b/test/recipes/90-test_includes_data/includes-file.cnf @@ -0,0 +1,5 @@ +# +# Example configuration file using includes. +# + +.include includes.cnf diff --git a/test/recipes/90-test_includes_data/includes.cnf b/test/recipes/90-test_includes_data/includes.cnf new file mode 100644 index 00000000..345eeb98 --- /dev/null +++ b/test/recipes/90-test_includes_data/includes.cnf @@ -0,0 +1,5 @@ +# +# Example configuration file using includes. +# + +.include conf-includes diff --git a/test/recipes/90-test_includes_data/vms-includes-file.cnf b/test/recipes/90-test_includes_data/vms-includes-file.cnf new file mode 100644 index 00000000..f3b72e70 --- /dev/null +++ b/test/recipes/90-test_includes_data/vms-includes-file.cnf @@ -0,0 +1,5 @@ +# +# Example configuration file using includes. +# + +.include vms-includes.cnf diff --git a/test/recipes/90-test_includes_data/vms-includes.cnf b/test/recipes/90-test_includes_data/vms-includes.cnf new file mode 100644 index 00000000..ed4367bc --- /dev/null +++ b/test/recipes/90-test_includes_data/vms-includes.cnf @@ -0,0 +1,5 @@ +# +# Example configuration file using includes. +# + +.include [.conf-includes] diff --git a/test/recipes/95-test_external_krb5_data/krb5.sh b/test/recipes/95-test_external_krb5_data/krb5.sh old mode 100755 new mode 100644 diff --git a/test/recipes/95-test_external_pyca_data/cryptography.sh b/test/recipes/95-test_external_pyca_data/cryptography.sh old mode 100755 new mode 100644 diff --git a/test/shlibloadtest.c b/test/shlibloadtest.c index 131d1f63..5f8ec55a 100644 --- a/test/shlibloadtest.c +++ b/test/shlibloadtest.c @@ -52,12 +52,10 @@ static int shlib_sym(SHLIB lib, const char *symname, SHLIB_SYM *sym) return *sym != NULL; } -# ifdef OPENSSL_USE_NODELETE static int shlib_close(SHLIB lib) { return dlclose(lib) != 0 ? 0 : 1; } -# endif #endif #ifdef DSO_WIN32 @@ -81,12 +79,10 @@ static int shlib_sym(SHLIB lib, const char *symname, SHLIB_SYM *sym) return *sym != NULL; } -# ifdef OPENSSL_USE_NODELETE static int shlib_close(SHLIB lib) { return FreeLibrary(lib) == 0 ? 0 : 1; } -# endif #endif @@ -149,7 +145,6 @@ static int test_lib(void) if (!TEST_int_eq(myOpenSSL_version_num(), OPENSSL_VERSION_NUMBER)) goto end; -#ifdef OPENSSL_USE_NODELETE switch (test_type) { case JUST_CRYPTO: if (!TEST_true(shlib_close(cryptolib))) @@ -166,7 +161,6 @@ static int test_lib(void) goto end; break; } -#endif result = 1; end: diff --git a/test/ssl-tests/14-curves.conf b/test/ssl-tests/14-curves.conf index ab04c2ef..f76f08fd 100644 --- a/test/ssl-tests/14-curves.conf +++ b/test/ssl-tests/14-curves.conf @@ -1,6 +1,6 @@ # Generated with generate_ssl_tests.pl -num_tests = 29 +num_tests = 30 test-0 = 0-curve-sect163k1 test-1 = 1-curve-sect163r1 @@ -31,6 +31,7 @@ test-25 = 25-curve-brainpoolP256r1 test-26 = 26-curve-brainpoolP384r1 test-27 = 27-curve-brainpoolP512r1 test-28 = 28-curve-X25519 +test-29 = 29-curve-X448 # =========================================================== [0-curve-sect163k1] @@ -843,3 +844,31 @@ ExpectedResult = Success ExpectedTmpKeyType = X25519 +# =========================================================== + +[29-curve-X448] +ssl_conf = 29-curve-X448-ssl + +[29-curve-X448-ssl] +server = 29-curve-X448-server +client = 29-curve-X448-client + +[29-curve-X448-server] +Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem +CipherString = DEFAULT +Curves = X448 +MaxProtocol = TLSv1.2 +PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem + +[29-curve-X448-client] +CipherString = ECDHE +Curves = X448 +MaxProtocol = TLSv1.2 +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem +VerifyMode = Peer + +[test-29] +ExpectedResult = Success +ExpectedTmpKeyType = X448 + + diff --git a/test/ssl-tests/14-curves.conf.in b/test/ssl-tests/14-curves.conf.in index 9f6e4339..2f8077c4 100644 --- a/test/ssl-tests/14-curves.conf.in +++ b/test/ssl-tests/14-curves.conf.in @@ -17,7 +17,7 @@ my @curves = ("sect163k1", "sect163r1", "sect163r2", "sect193r1", "secp160r2", "secp192k1", "prime192v1", "secp224k1", "secp224r1", "secp256k1", "prime256v1", "secp384r1", "secp521r1", "brainpoolP256r1", "brainpoolP384r1", - "brainpoolP512r1", "X25519"); + "brainpoolP512r1", "X25519", "X448"); our @tests = (); diff --git a/test/ssl-tests/20-cert-select.conf b/test/ssl-tests/20-cert-select.conf index 609e2166..1f415bfe 100644 --- a/test/ssl-tests/20-cert-select.conf +++ b/test/ssl-tests/20-cert-select.conf @@ -1,46 +1,52 @@ # Generated with generate_ssl_tests.pl -num_tests = 39 +num_tests = 45 test-0 = 0-ECDSA CipherString Selection test-1 = 1-Ed25519 CipherString and Signature Algorithm Selection -test-2 = 2-RSA CipherString Selection -test-3 = 3-RSA-PSS Certificate CipherString Selection -test-4 = 4-P-256 CipherString and Signature Algorithm Selection -test-5 = 5-Ed25519 CipherString and Curves Selection -test-6 = 6-ECDSA CipherString Selection, no ECDSA certificate -test-7 = 7-ECDSA Signature Algorithm Selection -test-8 = 8-ECDSA Signature Algorithm Selection SHA384 -test-9 = 9-ECDSA Signature Algorithm Selection SHA1 -test-10 = 10-ECDSA Signature Algorithm Selection compressed point -test-11 = 11-ECDSA Signature Algorithm Selection, no ECDSA certificate -test-12 = 12-RSA Signature Algorithm Selection -test-13 = 13-RSA-PSS Signature Algorithm Selection -test-14 = 14-RSA-PSS Certificate Legacy Signature Algorithm Selection -test-15 = 15-RSA-PSS Certificate Unified Signature Algorithm Selection -test-16 = 16-Only RSA-PSS Certificate -test-17 = 17-RSA-PSS Certificate, no PSS signature algorithms -test-18 = 18-Suite B P-256 Hash Algorithm Selection -test-19 = 19-Suite B P-384 Hash Algorithm Selection -test-20 = 20-TLS 1.2 Ed25519 Client Auth -test-21 = 21-Only RSA-PSS Certificate, TLS v1.1 -test-22 = 22-TLS 1.3 ECDSA Signature Algorithm Selection -test-23 = 23-TLS 1.3 ECDSA Signature Algorithm Selection compressed point -test-24 = 24-TLS 1.3 ECDSA Signature Algorithm Selection SHA1 -test-25 = 25-TLS 1.3 ECDSA Signature Algorithm Selection with PSS -test-26 = 26-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS -test-27 = 27-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate -test-28 = 28-TLS 1.3 RSA Signature Algorithm Selection, no PSS -test-29 = 29-TLS 1.3 RSA-PSS Signature Algorithm Selection -test-30 = 30-TLS 1.3 Ed25519 Signature Algorithm Selection -test-31 = 31-TLS 1.3 Ed25519 CipherString and Groups Selection -test-32 = 32-TLS 1.3 RSA Client Auth Signature Algorithm Selection -test-33 = 33-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names -test-34 = 34-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection -test-35 = 35-TLS 1.3 Ed25519 Client Auth -test-36 = 36-TLS 1.2 DSA Certificate Test -test-37 = 37-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms -test-38 = 38-TLS 1.3 DSA Certificate Test +test-2 = 2-Ed448 CipherString and Signature Algorithm Selection +test-3 = 3-RSA CipherString Selection +test-4 = 4-RSA-PSS Certificate CipherString Selection +test-5 = 5-P-256 CipherString and Signature Algorithm Selection +test-6 = 6-Ed25519 CipherString and Curves Selection +test-7 = 7-Ed448 CipherString and Curves Selection +test-8 = 8-ECDSA CipherString Selection, no ECDSA certificate +test-9 = 9-ECDSA Signature Algorithm Selection +test-10 = 10-ECDSA Signature Algorithm Selection SHA384 +test-11 = 11-ECDSA Signature Algorithm Selection SHA1 +test-12 = 12-ECDSA Signature Algorithm Selection compressed point +test-13 = 13-ECDSA Signature Algorithm Selection, no ECDSA certificate +test-14 = 14-RSA Signature Algorithm Selection +test-15 = 15-RSA-PSS Signature Algorithm Selection +test-16 = 16-RSA-PSS Certificate Legacy Signature Algorithm Selection +test-17 = 17-RSA-PSS Certificate Unified Signature Algorithm Selection +test-18 = 18-Only RSA-PSS Certificate +test-19 = 19-RSA-PSS Certificate, no PSS signature algorithms +test-20 = 20-Suite B P-256 Hash Algorithm Selection +test-21 = 21-Suite B P-384 Hash Algorithm Selection +test-22 = 22-TLS 1.2 Ed25519 Client Auth +test-23 = 23-TLS 1.2 Ed448 Client Auth +test-24 = 24-Only RSA-PSS Certificate, TLS v1.1 +test-25 = 25-TLS 1.3 ECDSA Signature Algorithm Selection +test-26 = 26-TLS 1.3 ECDSA Signature Algorithm Selection compressed point +test-27 = 27-TLS 1.3 ECDSA Signature Algorithm Selection SHA1 +test-28 = 28-TLS 1.3 ECDSA Signature Algorithm Selection with PSS +test-29 = 29-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS +test-30 = 30-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate +test-31 = 31-TLS 1.3 RSA Signature Algorithm Selection, no PSS +test-32 = 32-TLS 1.3 RSA-PSS Signature Algorithm Selection +test-33 = 33-TLS 1.3 Ed25519 Signature Algorithm Selection +test-34 = 34-TLS 1.3 Ed448 Signature Algorithm Selection +test-35 = 35-TLS 1.3 Ed25519 CipherString and Groups Selection +test-36 = 36-TLS 1.3 Ed448 CipherString and Groups Selection +test-37 = 37-TLS 1.3 RSA Client Auth Signature Algorithm Selection +test-38 = 38-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names +test-39 = 39-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection +test-40 = 40-TLS 1.3 Ed25519 Client Auth +test-41 = 41-TLS 1.3 Ed448 Client Auth +test-42 = 42-TLS 1.2 DSA Certificate Test +test-43 = 43-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms +test-44 = 44-TLS 1.3 DSA Certificate Test # =========================================================== [0-ECDSA CipherString Selection] @@ -55,8 +61,10 @@ Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem -EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem -EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem MaxProtocol = TLSv1.2 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem @@ -88,8 +96,10 @@ Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem -EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem -EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem MaxProtocol = TLSv1.2 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem @@ -110,57 +120,62 @@ ExpectedServerSignType = Ed25519 # =========================================================== -[2-RSA CipherString Selection] -ssl_conf = 2-RSA CipherString Selection-ssl +[2-Ed448 CipherString and Signature Algorithm Selection] +ssl_conf = 2-Ed448 CipherString and Signature Algorithm Selection-ssl -[2-RSA CipherString Selection-ssl] -server = 2-RSA CipherString Selection-server -client = 2-RSA CipherString Selection-client +[2-Ed448 CipherString and Signature Algorithm Selection-ssl] +server = 2-Ed448 CipherString and Signature Algorithm Selection-server +client = 2-Ed448 CipherString and Signature Algorithm Selection-client -[2-RSA CipherString Selection-server] +[2-Ed448 CipherString and Signature Algorithm Selection-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem -EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem -EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem MaxProtocol = TLSv1.2 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem -[2-RSA CipherString Selection-client] -CipherString = aRSA +[2-Ed448 CipherString and Signature Algorithm Selection-client] +CipherString = aECDSA MaxProtocol = TLSv1.2 +RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem +SignatureAlgorithms = ed448:ECDSA+SHA256 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer [test-2] ExpectedResult = Success -ExpectedServerCertType = RSA -ExpectedServerSignType = RSA-PSS +ExpectedServerCANames = empty +ExpectedServerCertType = Ed448 +ExpectedServerSignType = Ed448 # =========================================================== -[3-RSA-PSS Certificate CipherString Selection] -ssl_conf = 3-RSA-PSS Certificate CipherString Selection-ssl +[3-RSA CipherString Selection] +ssl_conf = 3-RSA CipherString Selection-ssl -[3-RSA-PSS Certificate CipherString Selection-ssl] -server = 3-RSA-PSS Certificate CipherString Selection-server -client = 3-RSA-PSS Certificate CipherString Selection-client +[3-RSA CipherString Selection-ssl] +server = 3-RSA CipherString Selection-server +client = 3-RSA CipherString Selection-client -[3-RSA-PSS Certificate CipherString Selection-server] +[3-RSA CipherString Selection-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem -EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem -EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem MaxProtocol = TLSv1.2 -PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem -PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem -[3-RSA-PSS Certificate CipherString Selection-client] +[3-RSA CipherString Selection-client] CipherString = aRSA MaxProtocol = TLSv1.2 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem @@ -168,127 +183,203 @@ VerifyMode = Peer [test-3] ExpectedResult = Success +ExpectedServerCertType = RSA +ExpectedServerSignType = RSA-PSS + + +# =========================================================== + +[4-RSA-PSS Certificate CipherString Selection] +ssl_conf = 4-RSA-PSS Certificate CipherString Selection-ssl + +[4-RSA-PSS Certificate CipherString Selection-ssl] +server = 4-RSA-PSS Certificate CipherString Selection-server +client = 4-RSA-PSS Certificate CipherString Selection-client + +[4-RSA-PSS Certificate CipherString Selection-server] +Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem +CipherString = DEFAULT +ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem +ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem +MaxProtocol = TLSv1.2 +PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem +PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem +PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem + +[4-RSA-PSS Certificate CipherString Selection-client] +CipherString = aRSA +MaxProtocol = TLSv1.2 +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem +VerifyMode = Peer + +[test-4] +ExpectedResult = Success ExpectedServerCertType = RSA-PSS ExpectedServerSignType = RSA-PSS # =========================================================== -[4-P-256 CipherString and Signature Algorithm Selection] -ssl_conf = 4-P-256 CipherString and Signature Algorithm Selection-ssl +[5-P-256 CipherString and Signature Algorithm Selection] +ssl_conf = 5-P-256 CipherString and Signature Algorithm Selection-ssl -[4-P-256 CipherString and Signature Algorithm Selection-ssl] -server = 4-P-256 CipherString and Signature Algorithm Selection-server -client = 4-P-256 CipherString and Signature Algorithm Selection-client +[5-P-256 CipherString and Signature Algorithm Selection-ssl] +server = 5-P-256 CipherString and Signature Algorithm Selection-server +client = 5-P-256 CipherString and Signature Algorithm Selection-client -[4-P-256 CipherString and Signature Algorithm Selection-server] +[5-P-256 CipherString and Signature Algorithm Selection-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem -EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem -EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem MaxProtocol = TLSv1.2 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem -[4-P-256 CipherString and Signature Algorithm Selection-client] +[5-P-256 CipherString and Signature Algorithm Selection-client] CipherString = aECDSA MaxProtocol = TLSv1.2 SignatureAlgorithms = ECDSA+SHA256:ed25519 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer -[test-4] -ExpectedResult = Success -ExpectedServerCertType = P-256 -ExpectedServerSignHash = SHA256 -ExpectedServerSignType = EC - - -# =========================================================== - -[5-Ed25519 CipherString and Curves Selection] -ssl_conf = 5-Ed25519 CipherString and Curves Selection-ssl - -[5-Ed25519 CipherString and Curves Selection-ssl] -server = 5-Ed25519 CipherString and Curves Selection-server -client = 5-Ed25519 CipherString and Curves Selection-client - -[5-Ed25519 CipherString and Curves Selection-server] -Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem -CipherString = DEFAULT -ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem -ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem -EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem -EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem -MaxProtocol = TLSv1.2 -PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem - -[5-Ed25519 CipherString and Curves Selection-client] -CipherString = aECDSA -Curves = X25519 -MaxProtocol = TLSv1.2 -SignatureAlgorithms = ECDSA+SHA256:ed25519 -VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem -VerifyMode = Peer - [test-5] ExpectedResult = Success +ExpectedServerCertType = P-256 +ExpectedServerSignHash = SHA256 +ExpectedServerSignType = EC + + +# =========================================================== + +[6-Ed25519 CipherString and Curves Selection] +ssl_conf = 6-Ed25519 CipherString and Curves Selection-ssl + +[6-Ed25519 CipherString and Curves Selection-ssl] +server = 6-Ed25519 CipherString and Curves Selection-server +client = 6-Ed25519 CipherString and Curves Selection-client + +[6-Ed25519 CipherString and Curves Selection-server] +Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem +CipherString = DEFAULT +ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem +ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem +MaxProtocol = TLSv1.2 +PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem + +[6-Ed25519 CipherString and Curves Selection-client] +CipherString = aECDSA +Curves = X25519 +MaxProtocol = TLSv1.2 +SignatureAlgorithms = ECDSA+SHA256:ed25519 +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem +VerifyMode = Peer + +[test-6] +ExpectedResult = Success ExpectedServerCertType = Ed25519 ExpectedServerSignType = Ed25519 # =========================================================== -[6-ECDSA CipherString Selection, no ECDSA certificate] -ssl_conf = 6-ECDSA CipherString Selection, no ECDSA certificate-ssl +[7-Ed448 CipherString and Curves Selection] +ssl_conf = 7-Ed448 CipherString and Curves Selection-ssl -[6-ECDSA CipherString Selection, no ECDSA certificate-ssl] -server = 6-ECDSA CipherString Selection, no ECDSA certificate-server -client = 6-ECDSA CipherString Selection, no ECDSA certificate-client +[7-Ed448 CipherString and Curves Selection-ssl] +server = 7-Ed448 CipherString and Curves Selection-server +client = 7-Ed448 CipherString and Curves Selection-client -[6-ECDSA CipherString Selection, no ECDSA certificate-server] +[7-Ed448 CipherString and Curves Selection-server] +Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem +CipherString = DEFAULT +ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem +ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem +MaxProtocol = TLSv1.2 +PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem + +[7-Ed448 CipherString and Curves Selection-client] +CipherString = aECDSA +Curves = X448 +MaxProtocol = TLSv1.2 +SignatureAlgorithms = ECDSA+SHA256:ed448 +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem +VerifyMode = Peer + +[test-7] +ExpectedResult = Success +ExpectedServerCertType = Ed448 +ExpectedServerSignType = Ed448 + + +# =========================================================== + +[8-ECDSA CipherString Selection, no ECDSA certificate] +ssl_conf = 8-ECDSA CipherString Selection, no ECDSA certificate-ssl + +[8-ECDSA CipherString Selection, no ECDSA certificate-ssl] +server = 8-ECDSA CipherString Selection, no ECDSA certificate-server +client = 8-ECDSA CipherString Selection, no ECDSA certificate-client + +[8-ECDSA CipherString Selection, no ECDSA certificate-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT MaxProtocol = TLSv1.2 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem -[6-ECDSA CipherString Selection, no ECDSA certificate-client] +[8-ECDSA CipherString Selection, no ECDSA certificate-client] CipherString = aECDSA MaxProtocol = TLSv1.2 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer -[test-6] +[test-8] ExpectedResult = ServerFail # =========================================================== -[7-ECDSA Signature Algorithm Selection] -ssl_conf = 7-ECDSA Signature Algorithm Selection-ssl +[9-ECDSA Signature Algorithm Selection] +ssl_conf = 9-ECDSA Signature Algorithm Selection-ssl -[7-ECDSA Signature Algorithm Selection-ssl] -server = 7-ECDSA Signature Algorithm Selection-server -client = 7-ECDSA Signature Algorithm Selection-client +[9-ECDSA Signature Algorithm Selection-ssl] +server = 9-ECDSA Signature Algorithm Selection-server +client = 9-ECDSA Signature Algorithm Selection-client -[7-ECDSA Signature Algorithm Selection-server] +[9-ECDSA Signature Algorithm Selection-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem -EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem -EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem MaxProtocol = TLSv1.2 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem -[7-ECDSA Signature Algorithm Selection-client] +[9-ECDSA Signature Algorithm Selection-client] CipherString = DEFAULT SignatureAlgorithms = ECDSA+SHA256 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer -[test-7] +[test-9] ExpectedResult = Success ExpectedServerCertType = P-256 ExpectedServerSignHash = SHA256 @@ -297,30 +388,32 @@ ExpectedServerSignType = EC # =========================================================== -[8-ECDSA Signature Algorithm Selection SHA384] -ssl_conf = 8-ECDSA Signature Algorithm Selection SHA384-ssl +[10-ECDSA Signature Algorithm Selection SHA384] +ssl_conf = 10-ECDSA Signature Algorithm Selection SHA384-ssl -[8-ECDSA Signature Algorithm Selection SHA384-ssl] -server = 8-ECDSA Signature Algorithm Selection SHA384-server -client = 8-ECDSA Signature Algorithm Selection SHA384-client +[10-ECDSA Signature Algorithm Selection SHA384-ssl] +server = 10-ECDSA Signature Algorithm Selection SHA384-server +client = 10-ECDSA Signature Algorithm Selection SHA384-client -[8-ECDSA Signature Algorithm Selection SHA384-server] +[10-ECDSA Signature Algorithm Selection SHA384-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem -EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem -EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem MaxProtocol = TLSv1.2 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem -[8-ECDSA Signature Algorithm Selection SHA384-client] +[10-ECDSA Signature Algorithm Selection SHA384-client] CipherString = DEFAULT SignatureAlgorithms = ECDSA+SHA384 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer -[test-8] +[test-10] ExpectedResult = Success ExpectedServerCertType = P-256 ExpectedServerSignHash = SHA384 @@ -329,30 +422,32 @@ ExpectedServerSignType = EC # =========================================================== -[9-ECDSA Signature Algorithm Selection SHA1] -ssl_conf = 9-ECDSA Signature Algorithm Selection SHA1-ssl +[11-ECDSA Signature Algorithm Selection SHA1] +ssl_conf = 11-ECDSA Signature Algorithm Selection SHA1-ssl -[9-ECDSA Signature Algorithm Selection SHA1-ssl] -server = 9-ECDSA Signature Algorithm Selection SHA1-server -client = 9-ECDSA Signature Algorithm Selection SHA1-client +[11-ECDSA Signature Algorithm Selection SHA1-ssl] +server = 11-ECDSA Signature Algorithm Selection SHA1-server +client = 11-ECDSA Signature Algorithm Selection SHA1-client -[9-ECDSA Signature Algorithm Selection SHA1-server] +[11-ECDSA Signature Algorithm Selection SHA1-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem -EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem -EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem MaxProtocol = TLSv1.2 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem -[9-ECDSA Signature Algorithm Selection SHA1-client] +[11-ECDSA Signature Algorithm Selection SHA1-client] CipherString = DEFAULT SignatureAlgorithms = ECDSA+SHA1 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer -[test-9] +[test-11] ExpectedResult = Success ExpectedServerCertType = P-256 ExpectedServerSignHash = SHA1 @@ -361,14 +456,14 @@ ExpectedServerSignType = EC # =========================================================== -[10-ECDSA Signature Algorithm Selection compressed point] -ssl_conf = 10-ECDSA Signature Algorithm Selection compressed point-ssl +[12-ECDSA Signature Algorithm Selection compressed point] +ssl_conf = 12-ECDSA Signature Algorithm Selection compressed point-ssl -[10-ECDSA Signature Algorithm Selection compressed point-ssl] -server = 10-ECDSA Signature Algorithm Selection compressed point-server -client = 10-ECDSA Signature Algorithm Selection compressed point-client +[12-ECDSA Signature Algorithm Selection compressed point-ssl] +server = 12-ECDSA Signature Algorithm Selection compressed point-server +client = 12-ECDSA Signature Algorithm Selection compressed point-client -[10-ECDSA Signature Algorithm Selection compressed point-server] +[12-ECDSA Signature Algorithm Selection compressed point-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-cecdsa-cert.pem @@ -376,13 +471,13 @@ ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-cecdsa-key.pem MaxProtocol = TLSv1.2 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem -[10-ECDSA Signature Algorithm Selection compressed point-client] +[12-ECDSA Signature Algorithm Selection compressed point-client] CipherString = DEFAULT SignatureAlgorithms = ECDSA+SHA256 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer -[test-10] +[test-12] ExpectedResult = Success ExpectedServerCertType = P-256 ExpectedServerSignHash = SHA256 @@ -391,55 +486,57 @@ ExpectedServerSignType = EC # =========================================================== -[11-ECDSA Signature Algorithm Selection, no ECDSA certificate] -ssl_conf = 11-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl +[13-ECDSA Signature Algorithm Selection, no ECDSA certificate] +ssl_conf = 13-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl -[11-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl] -server = 11-ECDSA Signature Algorithm Selection, no ECDSA certificate-server -client = 11-ECDSA Signature Algorithm Selection, no ECDSA certificate-client +[13-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl] +server = 13-ECDSA Signature Algorithm Selection, no ECDSA certificate-server +client = 13-ECDSA Signature Algorithm Selection, no ECDSA certificate-client -[11-ECDSA Signature Algorithm Selection, no ECDSA certificate-server] +[13-ECDSA Signature Algorithm Selection, no ECDSA certificate-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT MaxProtocol = TLSv1.2 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem -[11-ECDSA Signature Algorithm Selection, no ECDSA certificate-client] +[13-ECDSA Signature Algorithm Selection, no ECDSA certificate-client] CipherString = DEFAULT SignatureAlgorithms = ECDSA+SHA256 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer -[test-11] +[test-13] ExpectedResult = ServerFail # =========================================================== -[12-RSA Signature Algorithm Selection] -ssl_conf = 12-RSA Signature Algorithm Selection-ssl +[14-RSA Signature Algorithm Selection] +ssl_conf = 14-RSA Signature Algorithm Selection-ssl -[12-RSA Signature Algorithm Selection-ssl] -server = 12-RSA Signature Algorithm Selection-server -client = 12-RSA Signature Algorithm Selection-client +[14-RSA Signature Algorithm Selection-ssl] +server = 14-RSA Signature Algorithm Selection-server +client = 14-RSA Signature Algorithm Selection-client -[12-RSA Signature Algorithm Selection-server] +[14-RSA Signature Algorithm Selection-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem -EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem -EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem MaxProtocol = TLSv1.2 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem -[12-RSA Signature Algorithm Selection-client] +[14-RSA Signature Algorithm Selection-client] CipherString = DEFAULT SignatureAlgorithms = RSA+SHA256 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer -[test-12] +[test-14] ExpectedResult = Success ExpectedServerCertType = RSA ExpectedServerSignHash = SHA256 @@ -448,125 +545,105 @@ ExpectedServerSignType = RSA # =========================================================== -[13-RSA-PSS Signature Algorithm Selection] -ssl_conf = 13-RSA-PSS Signature Algorithm Selection-ssl +[15-RSA-PSS Signature Algorithm Selection] +ssl_conf = 15-RSA-PSS Signature Algorithm Selection-ssl -[13-RSA-PSS Signature Algorithm Selection-ssl] -server = 13-RSA-PSS Signature Algorithm Selection-server -client = 13-RSA-PSS Signature Algorithm Selection-client +[15-RSA-PSS Signature Algorithm Selection-ssl] +server = 15-RSA-PSS Signature Algorithm Selection-server +client = 15-RSA-PSS Signature Algorithm Selection-client -[13-RSA-PSS Signature Algorithm Selection-server] +[15-RSA-PSS Signature Algorithm Selection-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem -EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem -EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem MaxProtocol = TLSv1.2 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem -[13-RSA-PSS Signature Algorithm Selection-client] +[15-RSA-PSS Signature Algorithm Selection-client] CipherString = DEFAULT SignatureAlgorithms = RSA-PSS+SHA256 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer -[test-13] -ExpectedResult = Success -ExpectedServerCertType = RSA -ExpectedServerSignHash = SHA256 -ExpectedServerSignType = RSA-PSS - - -# =========================================================== - -[14-RSA-PSS Certificate Legacy Signature Algorithm Selection] -ssl_conf = 14-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl - -[14-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl] -server = 14-RSA-PSS Certificate Legacy Signature Algorithm Selection-server -client = 14-RSA-PSS Certificate Legacy Signature Algorithm Selection-client - -[14-RSA-PSS Certificate Legacy Signature Algorithm Selection-server] -Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem -CipherString = DEFAULT -ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem -ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem -EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem -EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem -MaxProtocol = TLSv1.2 -PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem -PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem -PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem - -[14-RSA-PSS Certificate Legacy Signature Algorithm Selection-client] -CipherString = DEFAULT -SignatureAlgorithms = RSA-PSS+SHA256 -VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem -VerifyMode = Peer - -[test-14] -ExpectedResult = Success -ExpectedServerCertType = RSA -ExpectedServerSignHash = SHA256 -ExpectedServerSignType = RSA-PSS - - -# =========================================================== - -[15-RSA-PSS Certificate Unified Signature Algorithm Selection] -ssl_conf = 15-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl - -[15-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl] -server = 15-RSA-PSS Certificate Unified Signature Algorithm Selection-server -client = 15-RSA-PSS Certificate Unified Signature Algorithm Selection-client - -[15-RSA-PSS Certificate Unified Signature Algorithm Selection-server] -Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem -CipherString = DEFAULT -ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem -ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem -EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem -EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem -MaxProtocol = TLSv1.2 -PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem -PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem -PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem - -[15-RSA-PSS Certificate Unified Signature Algorithm Selection-client] -CipherString = DEFAULT -SignatureAlgorithms = rsa_pss_pss_sha256 -VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem -VerifyMode = Peer - [test-15] ExpectedResult = Success -ExpectedServerCertType = RSA-PSS +ExpectedServerCertType = RSA ExpectedServerSignHash = SHA256 ExpectedServerSignType = RSA-PSS # =========================================================== -[16-Only RSA-PSS Certificate] -ssl_conf = 16-Only RSA-PSS Certificate-ssl +[16-RSA-PSS Certificate Legacy Signature Algorithm Selection] +ssl_conf = 16-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl -[16-Only RSA-PSS Certificate-ssl] -server = 16-Only RSA-PSS Certificate-server -client = 16-Only RSA-PSS Certificate-client +[16-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl] +server = 16-RSA-PSS Certificate Legacy Signature Algorithm Selection-server +client = 16-RSA-PSS Certificate Legacy Signature Algorithm Selection-client -[16-Only RSA-PSS Certificate-server] -Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem +[16-RSA-PSS Certificate Legacy Signature Algorithm Selection-server] +Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT -PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem +ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem +ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem +MaxProtocol = TLSv1.2 +PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem +PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem +PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem -[16-Only RSA-PSS Certificate-client] +[16-RSA-PSS Certificate Legacy Signature Algorithm Selection-client] CipherString = DEFAULT +SignatureAlgorithms = RSA-PSS+SHA256 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer [test-16] ExpectedResult = Success +ExpectedServerCertType = RSA +ExpectedServerSignHash = SHA256 +ExpectedServerSignType = RSA-PSS + + +# =========================================================== + +[17-RSA-PSS Certificate Unified Signature Algorithm Selection] +ssl_conf = 17-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl + +[17-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl] +server = 17-RSA-PSS Certificate Unified Signature Algorithm Selection-server +client = 17-RSA-PSS Certificate Unified Signature Algorithm Selection-client + +[17-RSA-PSS Certificate Unified Signature Algorithm Selection-server] +Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem +CipherString = DEFAULT +ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem +ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem +MaxProtocol = TLSv1.2 +PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem +PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem +PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem + +[17-RSA-PSS Certificate Unified Signature Algorithm Selection-client] +CipherString = DEFAULT +SignatureAlgorithms = rsa_pss_pss_sha256 +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem +VerifyMode = Peer + +[test-17] +ExpectedResult = Success ExpectedServerCertType = RSA-PSS ExpectedServerSignHash = SHA256 ExpectedServerSignType = RSA-PSS @@ -574,38 +651,64 @@ ExpectedServerSignType = RSA-PSS # =========================================================== -[17-RSA-PSS Certificate, no PSS signature algorithms] -ssl_conf = 17-RSA-PSS Certificate, no PSS signature algorithms-ssl +[18-Only RSA-PSS Certificate] +ssl_conf = 18-Only RSA-PSS Certificate-ssl -[17-RSA-PSS Certificate, no PSS signature algorithms-ssl] -server = 17-RSA-PSS Certificate, no PSS signature algorithms-server -client = 17-RSA-PSS Certificate, no PSS signature algorithms-client +[18-Only RSA-PSS Certificate-ssl] +server = 18-Only RSA-PSS Certificate-server +client = 18-Only RSA-PSS Certificate-client -[17-RSA-PSS Certificate, no PSS signature algorithms-server] +[18-Only RSA-PSS Certificate-server] Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem CipherString = DEFAULT PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem -[17-RSA-PSS Certificate, no PSS signature algorithms-client] +[18-Only RSA-PSS Certificate-client] +CipherString = DEFAULT +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem +VerifyMode = Peer + +[test-18] +ExpectedResult = Success +ExpectedServerCertType = RSA-PSS +ExpectedServerSignHash = SHA256 +ExpectedServerSignType = RSA-PSS + + +# =========================================================== + +[19-RSA-PSS Certificate, no PSS signature algorithms] +ssl_conf = 19-RSA-PSS Certificate, no PSS signature algorithms-ssl + +[19-RSA-PSS Certificate, no PSS signature algorithms-ssl] +server = 19-RSA-PSS Certificate, no PSS signature algorithms-server +client = 19-RSA-PSS Certificate, no PSS signature algorithms-client + +[19-RSA-PSS Certificate, no PSS signature algorithms-server] +Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem +CipherString = DEFAULT +PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem + +[19-RSA-PSS Certificate, no PSS signature algorithms-client] CipherString = DEFAULT SignatureAlgorithms = RSA+SHA256 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer -[test-17] +[test-19] ExpectedResult = ServerFail # =========================================================== -[18-Suite B P-256 Hash Algorithm Selection] -ssl_conf = 18-Suite B P-256 Hash Algorithm Selection-ssl +[20-Suite B P-256 Hash Algorithm Selection] +ssl_conf = 20-Suite B P-256 Hash Algorithm Selection-ssl -[18-Suite B P-256 Hash Algorithm Selection-ssl] -server = 18-Suite B P-256 Hash Algorithm Selection-server -client = 18-Suite B P-256 Hash Algorithm Selection-client +[20-Suite B P-256 Hash Algorithm Selection-ssl] +server = 20-Suite B P-256 Hash Algorithm Selection-server +client = 20-Suite B P-256 Hash Algorithm Selection-client -[18-Suite B P-256 Hash Algorithm Selection-server] +[20-Suite B P-256 Hash Algorithm Selection-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = SUITEB128 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/p256-server-cert.pem @@ -613,13 +716,13 @@ ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/p256-server-key.pem MaxProtocol = TLSv1.2 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem -[18-Suite B P-256 Hash Algorithm Selection-client] +[20-Suite B P-256 Hash Algorithm Selection-client] CipherString = DEFAULT SignatureAlgorithms = ECDSA+SHA384:ECDSA+SHA256 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/p384-root.pem VerifyMode = Peer -[test-18] +[test-20] ExpectedResult = Success ExpectedServerCertType = P-256 ExpectedServerSignHash = SHA256 @@ -628,14 +731,14 @@ ExpectedServerSignType = EC # =========================================================== -[19-Suite B P-384 Hash Algorithm Selection] -ssl_conf = 19-Suite B P-384 Hash Algorithm Selection-ssl +[21-Suite B P-384 Hash Algorithm Selection] +ssl_conf = 21-Suite B P-384 Hash Algorithm Selection-ssl -[19-Suite B P-384 Hash Algorithm Selection-ssl] -server = 19-Suite B P-384 Hash Algorithm Selection-server -client = 19-Suite B P-384 Hash Algorithm Selection-client +[21-Suite B P-384 Hash Algorithm Selection-ssl] +server = 21-Suite B P-384 Hash Algorithm Selection-server +client = 21-Suite B P-384 Hash Algorithm Selection-client -[19-Suite B P-384 Hash Algorithm Selection-server] +[21-Suite B P-384 Hash Algorithm Selection-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = SUITEB128 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/p384-server-cert.pem @@ -643,13 +746,13 @@ ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/p384-server-key.pem MaxProtocol = TLSv1.2 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem -[19-Suite B P-384 Hash Algorithm Selection-client] +[21-Suite B P-384 Hash Algorithm Selection-client] CipherString = DEFAULT SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/p384-root.pem VerifyMode = Peer -[test-19] +[test-21] ExpectedResult = Success ExpectedServerCertType = P-384 ExpectedServerSignHash = SHA384 @@ -658,30 +761,30 @@ ExpectedServerSignType = EC # =========================================================== -[20-TLS 1.2 Ed25519 Client Auth] -ssl_conf = 20-TLS 1.2 Ed25519 Client Auth-ssl +[22-TLS 1.2 Ed25519 Client Auth] +ssl_conf = 22-TLS 1.2 Ed25519 Client Auth-ssl -[20-TLS 1.2 Ed25519 Client Auth-ssl] -server = 20-TLS 1.2 Ed25519 Client Auth-server -client = 20-TLS 1.2 Ed25519 Client Auth-client +[22-TLS 1.2 Ed25519 Client Auth-ssl] +server = 22-TLS 1.2 Ed25519 Client Auth-server +client = 22-TLS 1.2 Ed25519 Client Auth-client -[20-TLS 1.2 Ed25519 Client Auth-server] +[22-TLS 1.2 Ed25519 Client Auth-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem VerifyMode = Require -[20-TLS 1.2 Ed25519 Client Auth-client] +[22-TLS 1.2 Ed25519 Client Auth-client] CipherString = DEFAULT -EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed25519-cert.pem -EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed25519-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed25519-key.pem MaxProtocol = TLSv1.2 MinProtocol = TLSv1.2 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer -[test-20] +[test-22] ExpectedClientCertType = Ed25519 ExpectedClientSignType = Ed25519 ExpectedResult = Success @@ -689,113 +792,52 @@ ExpectedResult = Success # =========================================================== -[21-Only RSA-PSS Certificate, TLS v1.1] -ssl_conf = 21-Only RSA-PSS Certificate, TLS v1.1-ssl +[23-TLS 1.2 Ed448 Client Auth] +ssl_conf = 23-TLS 1.2 Ed448 Client Auth-ssl -[21-Only RSA-PSS Certificate, TLS v1.1-ssl] -server = 21-Only RSA-PSS Certificate, TLS v1.1-server -client = 21-Only RSA-PSS Certificate, TLS v1.1-client +[23-TLS 1.2 Ed448 Client Auth-ssl] +server = 23-TLS 1.2 Ed448 Client Auth-server +client = 23-TLS 1.2 Ed448 Client Auth-client -[21-Only RSA-PSS Certificate, TLS v1.1-server] -Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem -CipherString = DEFAULT -PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem - -[21-Only RSA-PSS Certificate, TLS v1.1-client] -CipherString = DEFAULT -MaxProtocol = TLSv1.1 -VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem -VerifyMode = Peer - -[test-21] -ExpectedResult = ServerFail - - -# =========================================================== - -[22-TLS 1.3 ECDSA Signature Algorithm Selection] -ssl_conf = 22-TLS 1.3 ECDSA Signature Algorithm Selection-ssl - -[22-TLS 1.3 ECDSA Signature Algorithm Selection-ssl] -server = 22-TLS 1.3 ECDSA Signature Algorithm Selection-server -client = 22-TLS 1.3 ECDSA Signature Algorithm Selection-client - -[22-TLS 1.3 ECDSA Signature Algorithm Selection-server] +[23-TLS 1.2 Ed448 Client Auth-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT -ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem -ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem -EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem -EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem -MaxProtocol = TLSv1.3 -MinProtocol = TLSv1.3 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem +VerifyMode = Require -[22-TLS 1.3 ECDSA Signature Algorithm Selection-client] +[23-TLS 1.2 Ed448 Client Auth-client] CipherString = DEFAULT -SignatureAlgorithms = ECDSA+SHA256 -VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem -VerifyMode = Peer - -[test-22] -ExpectedResult = Success -ExpectedServerCANames = empty -ExpectedServerCertType = P-256 -ExpectedServerSignHash = SHA256 -ExpectedServerSignType = EC - - -# =========================================================== - -[23-TLS 1.3 ECDSA Signature Algorithm Selection compressed point] -ssl_conf = 23-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl - -[23-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl] -server = 23-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server -client = 23-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client - -[23-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server] -Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem -CipherString = DEFAULT -ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-cecdsa-cert.pem -ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-cecdsa-key.pem -MaxProtocol = TLSv1.3 -MinProtocol = TLSv1.3 -PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem - -[23-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client] -CipherString = DEFAULT -SignatureAlgorithms = ECDSA+SHA256 +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed448-key.pem +MaxProtocol = TLSv1.2 +MinProtocol = TLSv1.2 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer [test-23] -ExpectedResult = ServerFail +ExpectedClientCertType = Ed448 +ExpectedClientSignType = Ed448 +ExpectedResult = Success # =========================================================== -[24-TLS 1.3 ECDSA Signature Algorithm Selection SHA1] -ssl_conf = 24-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl +[24-Only RSA-PSS Certificate, TLS v1.1] +ssl_conf = 24-Only RSA-PSS Certificate, TLS v1.1-ssl -[24-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl] -server = 24-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server -client = 24-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client +[24-Only RSA-PSS Certificate, TLS v1.1-ssl] +server = 24-Only RSA-PSS Certificate, TLS v1.1-server +client = 24-Only RSA-PSS Certificate, TLS v1.1-client -[24-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server] -Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem +[24-Only RSA-PSS Certificate, TLS v1.1-server] +Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem CipherString = DEFAULT -ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem -ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem -EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem -EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem -MaxProtocol = TLSv1.3 -MinProtocol = TLSv1.3 -PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem +PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem -[24-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client] +[24-Only RSA-PSS Certificate, TLS v1.1-client] CipherString = DEFAULT -SignatureAlgorithms = ECDSA+SHA1 +MaxProtocol = TLSv1.1 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer @@ -805,34 +847,35 @@ ExpectedResult = ServerFail # =========================================================== -[25-TLS 1.3 ECDSA Signature Algorithm Selection with PSS] -ssl_conf = 25-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl +[25-TLS 1.3 ECDSA Signature Algorithm Selection] +ssl_conf = 25-TLS 1.3 ECDSA Signature Algorithm Selection-ssl -[25-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl] -server = 25-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server -client = 25-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client +[25-TLS 1.3 ECDSA Signature Algorithm Selection-ssl] +server = 25-TLS 1.3 ECDSA Signature Algorithm Selection-server +client = 25-TLS 1.3 ECDSA Signature Algorithm Selection-client -[25-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server] +[25-TLS 1.3 ECDSA Signature Algorithm Selection-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem -EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem -EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem MaxProtocol = TLSv1.3 MinProtocol = TLSv1.3 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem -[25-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client] +[25-TLS 1.3 ECDSA Signature Algorithm Selection-client] CipherString = DEFAULT -RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem -SignatureAlgorithms = ECDSA+SHA256:RSA-PSS+SHA256 +SignatureAlgorithms = ECDSA+SHA256 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer [test-25] ExpectedResult = Success -ExpectedServerCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem +ExpectedServerCANames = empty ExpectedServerCertType = P-256 ExpectedServerSignHash = SHA256 ExpectedServerSignType = EC @@ -840,56 +883,57 @@ ExpectedServerSignType = EC # =========================================================== -[26-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS] -ssl_conf = 26-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl +[26-TLS 1.3 ECDSA Signature Algorithm Selection compressed point] +ssl_conf = 26-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl -[26-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl] -server = 26-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server -client = 26-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client +[26-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl] +server = 26-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server +client = 26-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client -[26-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server] +[26-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT -ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem -ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem -EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem -EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-cecdsa-cert.pem +ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-cecdsa-key.pem MaxProtocol = TLSv1.3 MinProtocol = TLSv1.3 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem -[26-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client] +[26-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client] CipherString = DEFAULT -SignatureAlgorithms = ECDSA+SHA384:RSA-PSS+SHA384 +SignatureAlgorithms = ECDSA+SHA256 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer [test-26] -ExpectedResult = Success -ExpectedServerCertType = RSA -ExpectedServerSignHash = SHA384 -ExpectedServerSignType = RSA-PSS +ExpectedResult = ServerFail # =========================================================== -[27-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate] -ssl_conf = 27-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl +[27-TLS 1.3 ECDSA Signature Algorithm Selection SHA1] +ssl_conf = 27-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl -[27-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl] -server = 27-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server -client = 27-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client +[27-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl] +server = 27-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server +client = 27-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client -[27-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server] +[27-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT +ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem +ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem MaxProtocol = TLSv1.3 MinProtocol = TLSv1.3 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem -[27-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client] +[27-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client] CipherString = DEFAULT -SignatureAlgorithms = ECDSA+SHA256 +SignatureAlgorithms = ECDSA+SHA1 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer @@ -899,61 +943,163 @@ ExpectedResult = ServerFail # =========================================================== -[28-TLS 1.3 RSA Signature Algorithm Selection, no PSS] -ssl_conf = 28-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl +[28-TLS 1.3 ECDSA Signature Algorithm Selection with PSS] +ssl_conf = 28-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl -[28-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl] -server = 28-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server -client = 28-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client +[28-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl] +server = 28-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server +client = 28-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client -[28-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server] +[28-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem -EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem -EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem MaxProtocol = TLSv1.3 MinProtocol = TLSv1.3 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem -[28-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client] +[28-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client] CipherString = DEFAULT -SignatureAlgorithms = RSA+SHA256 +RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem +SignatureAlgorithms = ECDSA+SHA256:RSA-PSS+SHA256 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer [test-28] +ExpectedResult = Success +ExpectedServerCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem +ExpectedServerCertType = P-256 +ExpectedServerSignHash = SHA256 +ExpectedServerSignType = EC + + +# =========================================================== + +[29-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS] +ssl_conf = 29-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl + +[29-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl] +server = 29-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server +client = 29-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client + +[29-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server] +Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem +CipherString = DEFAULT +ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem +ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem +MaxProtocol = TLSv1.3 +MinProtocol = TLSv1.3 +PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem + +[29-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client] +CipherString = DEFAULT +SignatureAlgorithms = ECDSA+SHA384:RSA-PSS+SHA384 +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem +VerifyMode = Peer + +[test-29] +ExpectedResult = Success +ExpectedServerCertType = RSA +ExpectedServerSignHash = SHA384 +ExpectedServerSignType = RSA-PSS + + +# =========================================================== + +[30-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate] +ssl_conf = 30-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl + +[30-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl] +server = 30-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server +client = 30-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client + +[30-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server] +Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem +CipherString = DEFAULT +MaxProtocol = TLSv1.3 +MinProtocol = TLSv1.3 +PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem + +[30-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client] +CipherString = DEFAULT +SignatureAlgorithms = ECDSA+SHA256 +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem +VerifyMode = Peer + +[test-30] ExpectedResult = ServerFail # =========================================================== -[29-TLS 1.3 RSA-PSS Signature Algorithm Selection] -ssl_conf = 29-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl +[31-TLS 1.3 RSA Signature Algorithm Selection, no PSS] +ssl_conf = 31-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl -[29-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl] -server = 29-TLS 1.3 RSA-PSS Signature Algorithm Selection-server -client = 29-TLS 1.3 RSA-PSS Signature Algorithm Selection-client +[31-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl] +server = 31-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server +client = 31-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client -[29-TLS 1.3 RSA-PSS Signature Algorithm Selection-server] +[31-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem -EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem -EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem MaxProtocol = TLSv1.3 MinProtocol = TLSv1.3 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem -[29-TLS 1.3 RSA-PSS Signature Algorithm Selection-client] +[31-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client] +CipherString = DEFAULT +SignatureAlgorithms = RSA+SHA256 +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem +VerifyMode = Peer + +[test-31] +ExpectedResult = ServerFail + + +# =========================================================== + +[32-TLS 1.3 RSA-PSS Signature Algorithm Selection] +ssl_conf = 32-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl + +[32-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl] +server = 32-TLS 1.3 RSA-PSS Signature Algorithm Selection-server +client = 32-TLS 1.3 RSA-PSS Signature Algorithm Selection-client + +[32-TLS 1.3 RSA-PSS Signature Algorithm Selection-server] +Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem +CipherString = DEFAULT +ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem +ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem +MaxProtocol = TLSv1.3 +MinProtocol = TLSv1.3 +PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem + +[32-TLS 1.3 RSA-PSS Signature Algorithm Selection-client] CipherString = DEFAULT SignatureAlgorithms = RSA-PSS+SHA256 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer -[test-29] +[test-32] ExpectedResult = Success ExpectedServerCertType = RSA ExpectedServerSignHash = SHA256 @@ -962,31 +1108,33 @@ ExpectedServerSignType = RSA-PSS # =========================================================== -[30-TLS 1.3 Ed25519 Signature Algorithm Selection] -ssl_conf = 30-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl +[33-TLS 1.3 Ed25519 Signature Algorithm Selection] +ssl_conf = 33-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl -[30-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl] -server = 30-TLS 1.3 Ed25519 Signature Algorithm Selection-server -client = 30-TLS 1.3 Ed25519 Signature Algorithm Selection-client +[33-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl] +server = 33-TLS 1.3 Ed25519 Signature Algorithm Selection-server +client = 33-TLS 1.3 Ed25519 Signature Algorithm Selection-client -[30-TLS 1.3 Ed25519 Signature Algorithm Selection-server] +[33-TLS 1.3 Ed25519 Signature Algorithm Selection-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem -EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem -EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem MaxProtocol = TLSv1.3 MinProtocol = TLSv1.3 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem -[30-TLS 1.3 Ed25519 Signature Algorithm Selection-client] +[33-TLS 1.3 Ed25519 Signature Algorithm Selection-client] CipherString = DEFAULT SignatureAlgorithms = ed25519 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer -[test-30] +[test-33] ExpectedResult = Success ExpectedServerCertType = Ed25519 ExpectedServerSignType = Ed25519 @@ -994,32 +1142,68 @@ ExpectedServerSignType = Ed25519 # =========================================================== -[31-TLS 1.3 Ed25519 CipherString and Groups Selection] -ssl_conf = 31-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl +[34-TLS 1.3 Ed448 Signature Algorithm Selection] +ssl_conf = 34-TLS 1.3 Ed448 Signature Algorithm Selection-ssl -[31-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl] -server = 31-TLS 1.3 Ed25519 CipherString and Groups Selection-server -client = 31-TLS 1.3 Ed25519 CipherString and Groups Selection-client +[34-TLS 1.3 Ed448 Signature Algorithm Selection-ssl] +server = 34-TLS 1.3 Ed448 Signature Algorithm Selection-server +client = 34-TLS 1.3 Ed448 Signature Algorithm Selection-client -[31-TLS 1.3 Ed25519 CipherString and Groups Selection-server] +[34-TLS 1.3 Ed448 Signature Algorithm Selection-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem -EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem -EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem MaxProtocol = TLSv1.3 MinProtocol = TLSv1.3 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem -[31-TLS 1.3 Ed25519 CipherString and Groups Selection-client] +[34-TLS 1.3 Ed448 Signature Algorithm Selection-client] +CipherString = DEFAULT +SignatureAlgorithms = ed448 +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem +VerifyMode = Peer + +[test-34] +ExpectedResult = Success +ExpectedServerCertType = Ed448 +ExpectedServerSignType = Ed448 + + +# =========================================================== + +[35-TLS 1.3 Ed25519 CipherString and Groups Selection] +ssl_conf = 35-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl + +[35-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl] +server = 35-TLS 1.3 Ed25519 CipherString and Groups Selection-server +client = 35-TLS 1.3 Ed25519 CipherString and Groups Selection-client + +[35-TLS 1.3 Ed25519 CipherString and Groups Selection-server] +Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem +CipherString = DEFAULT +ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem +ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem +MaxProtocol = TLSv1.3 +MinProtocol = TLSv1.3 +PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem + +[35-TLS 1.3 Ed25519 CipherString and Groups Selection-client] CipherString = DEFAULT Groups = X25519 SignatureAlgorithms = ECDSA+SHA256:ed25519 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer -[test-31] +[test-35] ExpectedResult = Success ExpectedServerCertType = P-256 ExpectedServerSignType = EC @@ -1027,14 +1211,49 @@ ExpectedServerSignType = EC # =========================================================== -[32-TLS 1.3 RSA Client Auth Signature Algorithm Selection] -ssl_conf = 32-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl +[36-TLS 1.3 Ed448 CipherString and Groups Selection] +ssl_conf = 36-TLS 1.3 Ed448 CipherString and Groups Selection-ssl -[32-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl] -server = 32-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server -client = 32-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client +[36-TLS 1.3 Ed448 CipherString and Groups Selection-ssl] +server = 36-TLS 1.3 Ed448 CipherString and Groups Selection-server +client = 36-TLS 1.3 Ed448 CipherString and Groups Selection-client -[32-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server] +[36-TLS 1.3 Ed448 CipherString and Groups Selection-server] +Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem +CipherString = DEFAULT +ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem +ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem +MaxProtocol = TLSv1.3 +MinProtocol = TLSv1.3 +PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem + +[36-TLS 1.3 Ed448 CipherString and Groups Selection-client] +CipherString = DEFAULT +Groups = X448 +SignatureAlgorithms = ECDSA+SHA256:ed448 +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem +VerifyMode = Peer + +[test-36] +ExpectedResult = Success +ExpectedServerCertType = P-256 +ExpectedServerSignType = EC + + +# =========================================================== + +[37-TLS 1.3 RSA Client Auth Signature Algorithm Selection] +ssl_conf = 37-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl + +[37-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl] +server = 37-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server +client = 37-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client + +[37-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT ClientSignatureAlgorithms = PSS+SHA256 @@ -1042,7 +1261,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem VerifyMode = Require -[32-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client] +[37-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client] CipherString = DEFAULT ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-client-chain.pem ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-key.pem @@ -1053,7 +1272,7 @@ RSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer -[test-32] +[test-37] ExpectedClientCANames = empty ExpectedClientCertType = RSA ExpectedClientSignHash = SHA256 @@ -1063,14 +1282,14 @@ ExpectedResult = Success # =========================================================== -[33-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names] -ssl_conf = 33-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl +[38-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names] +ssl_conf = 38-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl -[33-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl] -server = 33-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server -client = 33-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client +[38-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl] +server = 38-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server +client = 38-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client -[33-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server] +[38-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT ClientSignatureAlgorithms = PSS+SHA256 @@ -1079,7 +1298,7 @@ RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem VerifyMode = Require -[33-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client] +[38-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client] CipherString = DEFAULT ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-client-chain.pem ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-key.pem @@ -1090,7 +1309,7 @@ RSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer -[test-33] +[test-38] ExpectedClientCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem ExpectedClientCertType = RSA ExpectedClientSignHash = SHA256 @@ -1100,14 +1319,14 @@ ExpectedResult = Success # =========================================================== -[34-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection] -ssl_conf = 34-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl +[39-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection] +ssl_conf = 39-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl -[34-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl] -server = 34-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server -client = 34-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client +[39-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl] +server = 39-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server +client = 39-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client -[34-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server] +[39-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT ClientSignatureAlgorithms = ECDSA+SHA256 @@ -1115,7 +1334,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem VerifyMode = Require -[34-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client] +[39-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client] CipherString = DEFAULT ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-client-chain.pem ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-key.pem @@ -1126,7 +1345,7 @@ RSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer -[test-34] +[test-39] ExpectedClientCertType = P-256 ExpectedClientSignHash = SHA256 ExpectedClientSignType = EC @@ -1135,21 +1354,21 @@ ExpectedResult = Success # =========================================================== -[35-TLS 1.3 Ed25519 Client Auth] -ssl_conf = 35-TLS 1.3 Ed25519 Client Auth-ssl +[40-TLS 1.3 Ed25519 Client Auth] +ssl_conf = 40-TLS 1.3 Ed25519 Client Auth-ssl -[35-TLS 1.3 Ed25519 Client Auth-ssl] -server = 35-TLS 1.3 Ed25519 Client Auth-server -client = 35-TLS 1.3 Ed25519 Client Auth-client +[40-TLS 1.3 Ed25519 Client Auth-ssl] +server = 40-TLS 1.3 Ed25519 Client Auth-server +client = 40-TLS 1.3 Ed25519 Client Auth-client -[35-TLS 1.3 Ed25519 Client Auth-server] +[40-TLS 1.3 Ed25519 Client Auth-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem VerifyMode = Require -[35-TLS 1.3 Ed25519 Client Auth-client] +[40-TLS 1.3 Ed25519 Client Auth-client] CipherString = DEFAULT EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed25519-cert.pem EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed25519-key.pem @@ -1158,7 +1377,7 @@ MinProtocol = TLSv1.3 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer -[test-35] +[test-40] ExpectedClientCertType = Ed25519 ExpectedClientSignType = Ed25519 ExpectedResult = Success @@ -1166,14 +1385,45 @@ ExpectedResult = Success # =========================================================== -[36-TLS 1.2 DSA Certificate Test] -ssl_conf = 36-TLS 1.2 DSA Certificate Test-ssl +[41-TLS 1.3 Ed448 Client Auth] +ssl_conf = 41-TLS 1.3 Ed448 Client Auth-ssl -[36-TLS 1.2 DSA Certificate Test-ssl] -server = 36-TLS 1.2 DSA Certificate Test-server -client = 36-TLS 1.2 DSA Certificate Test-client +[41-TLS 1.3 Ed448 Client Auth-ssl] +server = 41-TLS 1.3 Ed448 Client Auth-server +client = 41-TLS 1.3 Ed448 Client Auth-client -[36-TLS 1.2 DSA Certificate Test-server] +[41-TLS 1.3 Ed448 Client Auth-server] +Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem +CipherString = DEFAULT +PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem +VerifyMode = Require + +[41-TLS 1.3 Ed448 Client Auth-client] +CipherString = DEFAULT +EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed448-cert.pem +EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed448-key.pem +MaxProtocol = TLSv1.3 +MinProtocol = TLSv1.3 +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem +VerifyMode = Peer + +[test-41] +ExpectedClientCertType = Ed448 +ExpectedClientSignType = Ed448 +ExpectedResult = Success + + +# =========================================================== + +[42-TLS 1.2 DSA Certificate Test] +ssl_conf = 42-TLS 1.2 DSA Certificate Test-ssl + +[42-TLS 1.2 DSA Certificate Test-ssl] +server = 42-TLS 1.2 DSA Certificate Test-server +client = 42-TLS 1.2 DSA Certificate Test-client + +[42-TLS 1.2 DSA Certificate Test-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = ALL DHParameters = ${ENV::TEST_CERTS_DIR}/dhp2048.pem @@ -1183,26 +1433,26 @@ MaxProtocol = TLSv1.2 MinProtocol = TLSv1.2 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem -[36-TLS 1.2 DSA Certificate Test-client] +[42-TLS 1.2 DSA Certificate Test-client] CipherString = ALL SignatureAlgorithms = DSA+SHA256:DSA+SHA1 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer -[test-36] +[test-42] ExpectedResult = Success # =========================================================== -[37-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms] -ssl_conf = 37-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl +[43-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms] +ssl_conf = 43-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl -[37-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl] -server = 37-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server -client = 37-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client +[43-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl] +server = 43-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server +client = 43-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client -[37-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server] +[43-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT ClientSignatureAlgorithms = ECDSA+SHA1:DSA+SHA256:RSA+SHA256 @@ -1210,25 +1460,25 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem VerifyMode = Request -[37-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client] +[43-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client] CipherString = DEFAULT VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer -[test-37] +[test-43] ExpectedResult = ServerFail # =========================================================== -[38-TLS 1.3 DSA Certificate Test] -ssl_conf = 38-TLS 1.3 DSA Certificate Test-ssl +[44-TLS 1.3 DSA Certificate Test] +ssl_conf = 44-TLS 1.3 DSA Certificate Test-ssl -[38-TLS 1.3 DSA Certificate Test-ssl] -server = 38-TLS 1.3 DSA Certificate Test-server -client = 38-TLS 1.3 DSA Certificate Test-client +[44-TLS 1.3 DSA Certificate Test-ssl] +server = 44-TLS 1.3 DSA Certificate Test-server +client = 44-TLS 1.3 DSA Certificate Test-client -[38-TLS 1.3 DSA Certificate Test-server] +[44-TLS 1.3 DSA Certificate Test-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = ALL DSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-dsa-cert.pem @@ -1237,13 +1487,13 @@ MaxProtocol = TLSv1.3 MinProtocol = TLSv1.3 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem -[38-TLS 1.3 DSA Certificate Test-client] +[44-TLS 1.3 DSA Certificate Test-client] CipherString = ALL SignatureAlgorithms = DSA+SHA1:DSA+SHA256:ECDSA+SHA256 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer -[test-38] +[test-44] ExpectedResult = ServerFail diff --git a/test/ssl-tests/20-cert-select.conf.in b/test/ssl-tests/20-cert-select.conf.in index ff77f6bd..c6589c73 100644 --- a/test/ssl-tests/20-cert-select.conf.in +++ b/test/ssl-tests/20-cert-select.conf.in @@ -12,8 +12,10 @@ use OpenSSL::Test::Utils; my $server = { "ECDSA.Certificate" => test_pem("server-ecdsa-cert.pem"), "ECDSA.PrivateKey" => test_pem("server-ecdsa-key.pem"), - "EdDSA.Certificate" => test_pem("server-ed25519-cert.pem"), - "EdDSA.PrivateKey" => test_pem("server-ed25519-key.pem"), + "Ed25519.Certificate" => test_pem("server-ed25519-cert.pem"), + "Ed25519.PrivateKey" => test_pem("server-ed25519-key.pem"), + "Ed448.Certificate" => test_pem("server-ed448-cert.pem"), + "Ed448.PrivateKey" => test_pem("server-ed448-key.pem"), "MaxProtocol" => "TLSv1.2" }; @@ -22,8 +24,10 @@ my $server_pss = { "PSS.PrivateKey" => test_pem("server-pss-key.pem"), "ECDSA.Certificate" => test_pem("server-ecdsa-cert.pem"), "ECDSA.PrivateKey" => test_pem("server-ecdsa-key.pem"), - "EdDSA.Certificate" => test_pem("server-ed25519-cert.pem"), - "EdDSA.PrivateKey" => test_pem("server-ed25519-key.pem"), + "Ed25519.Certificate" => test_pem("server-ed25519-cert.pem"), + "Ed25519.PrivateKey" => test_pem("server-ed25519-key.pem"), + "Ed448.Certificate" => test_pem("server-ed448-cert.pem"), + "Ed448.PrivateKey" => test_pem("server-ed448-key.pem"), "MaxProtocol" => "TLSv1.2" }; @@ -66,6 +70,23 @@ our @tests = ( "ExpectedResult" => "Success" }, }, + { + name => "Ed448 CipherString and Signature Algorithm Selection", + server => $server, + client => { + "CipherString" => "aECDSA", + "MaxProtocol" => "TLSv1.2", + "SignatureAlgorithms" => "ed448:ECDSA+SHA256", + "RequestCAFile" => test_pem("root-cert.pem"), + }, + test => { + "ExpectedServerCertType" =>, "Ed448", + "ExpectedServerSignType" =>, "Ed448", + # Note: certificate_authorities not sent for TLS < 1.3 + "ExpectedServerCANames" =>, "empty", + "ExpectedResult" => "Success" + }, + }, { name => "RSA CipherString Selection", server => $server, @@ -124,6 +145,23 @@ our @tests = ( "ExpectedResult" => "Success" }, }, + { + name => "Ed448 CipherString and Curves Selection", + server => $server, + client => { + "CipherString" => "aECDSA", + "MaxProtocol" => "TLSv1.2", + "SignatureAlgorithms" => "ECDSA+SHA256:ed448", + # Excluding P-256 from the supported curves list means server + # certificate should be Ed25519 and not P-256 + "Curves" => "X448" + }, + test => { + "ExpectedServerCertType" =>, "Ed448", + "ExpectedServerSignType" =>, "Ed448", + "ExpectedResult" => "Success" + }, + }, { name => "ECDSA CipherString Selection, no ECDSA certificate", server => { @@ -323,8 +361,8 @@ our @tests = ( "VerifyMode" => "Require" }, client => { - "EdDSA.Certificate" => test_pem("client-ed25519-cert.pem"), - "EdDSA.PrivateKey" => test_pem("client-ed25519-key.pem"), + "Ed25519.Certificate" => test_pem("client-ed25519-cert.pem"), + "Ed25519.PrivateKey" => test_pem("client-ed25519-key.pem"), "MinProtocol" => "TLSv1.2", "MaxProtocol" => "TLSv1.2" }, @@ -334,6 +372,24 @@ our @tests = ( "ExpectedResult" => "Success" }, }, + { + name => "TLS 1.2 Ed448 Client Auth", + server => { + "VerifyCAFile" => test_pem("root-cert.pem"), + "VerifyMode" => "Require" + }, + client => { + "Ed448.Certificate" => test_pem("client-ed448-cert.pem"), + "Ed448.PrivateKey" => test_pem("client-ed448-key.pem"), + "MinProtocol" => "TLSv1.2", + "MaxProtocol" => "TLSv1.2" + }, + test => { + "ExpectedClientCertType" => "Ed448", + "ExpectedClientSignType" => "Ed448", + "ExpectedResult" => "Success" + }, + }, ); my @tests_tls_1_1 = ( @@ -354,8 +410,10 @@ push @tests, @tests_tls_1_1 unless disabled("tls1_1"); my $server_tls_1_3 = { "ECDSA.Certificate" => test_pem("server-ecdsa-cert.pem"), "ECDSA.PrivateKey" => test_pem("server-ecdsa-key.pem"), - "EdDSA.Certificate" => test_pem("server-ed25519-cert.pem"), - "EdDSA.PrivateKey" => test_pem("server-ed25519-key.pem"), + "Ed25519.Certificate" => test_pem("server-ed25519-cert.pem"), + "Ed25519.PrivateKey" => test_pem("server-ed25519-key.pem"), + "Ed448.Certificate" => test_pem("server-ed448-cert.pem"), + "Ed448.PrivateKey" => test_pem("server-ed448-key.pem"), "MinProtocol" => "TLSv1.3", "MaxProtocol" => "TLSv1.3" }; @@ -365,8 +423,10 @@ my $server_tls_1_3_pss = { "PSS.PrivateKey" => test_pem("server-pss-key.pem"), "ECDSA.Certificate" => test_pem("server-ecdsa-cert.pem"), "ECDSA.PrivateKey" => test_pem("server-ecdsa-key.pem"), - "EdDSA.Certificate" => test_pem("server-ed25519-cert.pem"), - "EdDSA.PrivateKey" => test_pem("server-ed25519-key.pem"), + "Ed25519.Certificate" => test_pem("server-ed25519-cert.pem"), + "Ed25519.PrivateKey" => test_pem("server-ed25519-key.pem"), + "Ed448.Certificate" => test_pem("server-ed448-cert.pem"), + "Ed448.PrivateKey" => test_pem("server-ed449-key.pem"), "MinProtocol" => "TLSv1.3", "MaxProtocol" => "TLSv1.3" }; @@ -496,6 +556,18 @@ my @tests_tls_1_3 = ( "ExpectedResult" => "Success" }, }, + { + name => "TLS 1.3 Ed448 Signature Algorithm Selection", + server => $server_tls_1_3, + client => { + "SignatureAlgorithms" => "ed448", + }, + test => { + "ExpectedServerCertType" => "Ed448", + "ExpectedServerSignType" => "Ed448", + "ExpectedResult" => "Success" + }, + }, { name => "TLS 1.3 Ed25519 CipherString and Groups Selection", server => $server_tls_1_3, @@ -512,6 +584,22 @@ my @tests_tls_1_3 = ( "ExpectedResult" => "Success" }, }, + { + name => "TLS 1.3 Ed448 CipherString and Groups Selection", + server => $server_tls_1_3, + client => { + "SignatureAlgorithms" => "ECDSA+SHA256:ed448", + # Excluding P-256 from the supported groups list should + # mean server still uses a P-256 certificate because supported + # groups is not used in signature selection for TLS 1.3 + "Groups" => "X448" + }, + test => { + "ExpectedServerCertType" =>, "P-256", + "ExpectedServerSignType" =>, "EC", + "ExpectedResult" => "Success" + }, + }, { name => "TLS 1.3 RSA Client Auth Signature Algorithm Selection", server => { @@ -578,6 +666,24 @@ my @tests_tls_1_3 = ( "ExpectedResult" => "Success" }, }, + { + name => "TLS 1.3 Ed448 Client Auth", + server => { + "VerifyCAFile" => test_pem("root-cert.pem"), + "VerifyMode" => "Require" + }, + client => { + "EdDSA.Certificate" => test_pem("client-ed448-cert.pem"), + "EdDSA.PrivateKey" => test_pem("client-ed448-key.pem"), + "MinProtocol" => "TLSv1.3", + "MaxProtocol" => "TLSv1.3" + }, + test => { + "ExpectedClientCertType" => "Ed448", + "ExpectedClientSignType" => "Ed448", + "ExpectedResult" => "Success" + }, + }, ); push @tests, @tests_tls_1_3 unless disabled("tls1_3"); diff --git a/test/ssl-tests/27-ticket-appdata.conf b/test/ssl-tests/27-ticket-appdata.conf new file mode 100644 index 00000000..863ca7a9 --- /dev/null +++ b/test/ssl-tests/27-ticket-appdata.conf @@ -0,0 +1,146 @@ +# Generated with generate_ssl_tests.pl + +num_tests = 4 + +test-0 = 0-session-ticket-app-data12 +test-1 = 1-session-ticket-app-data12 +test-2 = 2-session-ticket-app-data13 +test-3 = 3-session-ticket-app-data13 +# =========================================================== + +[0-session-ticket-app-data12] +ssl_conf = 0-session-ticket-app-data12-ssl + +[0-session-ticket-app-data12-ssl] +server = 0-session-ticket-app-data12-server +client = 0-session-ticket-app-data12-client +resume-server = 0-session-ticket-app-data12-server +resume-client = 0-session-ticket-app-data12-client + +[0-session-ticket-app-data12-server] +Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem +CipherString = DEFAULT +Options = SessionTicket +PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem + +[0-session-ticket-app-data12-client] +CipherString = DEFAULT +MaxProtocol = TLSv1.2 +Options = SessionTicket +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem +VerifyMode = Peer + +[test-0] +ExpectedResult = Success +ExpectedSessionTicketAppData = HelloWorld +HandshakeMode = Resume +ResumptionExpected = Yes +SessionTicketExpected = Yes +server = 0-session-ticket-app-data12-server-extra +resume-server = 0-session-ticket-app-data12-server-extra + +[0-session-ticket-app-data12-server-extra] +SessionTicketAppData = HelloWorld + + +# =========================================================== + +[1-session-ticket-app-data12] +ssl_conf = 1-session-ticket-app-data12-ssl + +[1-session-ticket-app-data12-ssl] +server = 1-session-ticket-app-data12-server +client = 1-session-ticket-app-data12-client +resume-server = 1-session-ticket-app-data12-server +resume-client = 1-session-ticket-app-data12-client + +[1-session-ticket-app-data12-server] +Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem +CipherString = DEFAULT +Options = SessionTicket +PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem + +[1-session-ticket-app-data12-client] +CipherString = DEFAULT +MaxProtocol = TLSv1.2 +Options = SessionTicket +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem +VerifyMode = Peer + +[test-1] +ExpectedResult = Success +ExpectedSessionTicketAppData = +HandshakeMode = Resume +ResumptionExpected = Yes +SessionTicketExpected = Yes + + +# =========================================================== + +[2-session-ticket-app-data13] +ssl_conf = 2-session-ticket-app-data13-ssl + +[2-session-ticket-app-data13-ssl] +server = 2-session-ticket-app-data13-server +client = 2-session-ticket-app-data13-client +resume-server = 2-session-ticket-app-data13-server +resume-client = 2-session-ticket-app-data13-client + +[2-session-ticket-app-data13-server] +Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem +CipherString = DEFAULT +Options = SessionTicket +PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem + +[2-session-ticket-app-data13-client] +CipherString = DEFAULT +MaxProtocol = TLSv1.3 +Options = SessionTicket +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem +VerifyMode = Peer + +[test-2] +ExpectedResult = Success +ExpectedSessionTicketAppData = HelloWorld +HandshakeMode = Resume +ResumptionExpected = Yes +SessionTicketExpected = Yes +server = 2-session-ticket-app-data13-server-extra +resume-server = 2-session-ticket-app-data13-server-extra + +[2-session-ticket-app-data13-server-extra] +SessionTicketAppData = HelloWorld + + +# =========================================================== + +[3-session-ticket-app-data13] +ssl_conf = 3-session-ticket-app-data13-ssl + +[3-session-ticket-app-data13-ssl] +server = 3-session-ticket-app-data13-server +client = 3-session-ticket-app-data13-client +resume-server = 3-session-ticket-app-data13-server +resume-client = 3-session-ticket-app-data13-client + +[3-session-ticket-app-data13-server] +Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem +CipherString = DEFAULT +Options = SessionTicket +PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem + +[3-session-ticket-app-data13-client] +CipherString = DEFAULT +MaxProtocol = TLSv1.3 +Options = SessionTicket +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem +VerifyMode = Peer + +[test-3] +ExpectedResult = Success +ExpectedSessionTicketAppData = +HandshakeMode = Resume +ResumptionExpected = Yes +SessionTicketExpected = Yes + + diff --git a/test/ssl-tests/27-ticket-appdata.conf.in b/test/ssl-tests/27-ticket-appdata.conf.in new file mode 100644 index 00000000..ed919d9b --- /dev/null +++ b/test/ssl-tests/27-ticket-appdata.conf.in @@ -0,0 +1,99 @@ +# -*- mode: perl; -*- +# Copyright 2018 The OpenSSL Project Authors. All Rights Reserved. +# +# Licensed under the OpenSSL license (the "License"). You may not use +# this file except in compliance with the License. You can obtain a copy +# in the file LICENSE in the source distribution or at +# https://www.openssl.org/source/license.html + + +## Test session ticket app data + +use strict; +use warnings; + +package ssltests; +use OpenSSL::Test::Utils; + +our @tests12 = ( + { + "name" => "session-ticket-app-data12", + "client" => { + "MaxProtocol" => "TLSv1.2", + "Options" => "SessionTicket", + }, + "server" => { + "Options" => "SessionTicket", + "extra" => { + "SessionTicketAppData" => "HelloWorld", + }, + }, + "test" => { + "HandshakeMode" => "Resume", + "ExpectedResult" => "Success", + "SessionTicketExpected" => "Yes", + "ResumptionExpected" => "Yes", + "ExpectedSessionTicketAppData" => "HelloWorld", + } + }, + { + "name" => "session-ticket-app-data12", + "client" => { + "MaxProtocol" => "TLSv1.2", + "Options" => "SessionTicket", + }, + "server" => { + "Options" => "SessionTicket", + }, + "test" => { + "HandshakeMode" => "Resume", + "ExpectedResult" => "Success", + "SessionTicketExpected" => "Yes", + "ResumptionExpected" => "Yes", + "ExpectedSessionTicketAppData" => "", + } + } +); +our @tests13 = ( + { + "name" => "session-ticket-app-data13", + "client" => { + "MaxProtocol" => "TLSv1.3", + "Options" => "SessionTicket", + }, + "server" => { + "Options" => "SessionTicket", + "extra" => { + "SessionTicketAppData" => "HelloWorld", + }, + }, + "test" => { + "HandshakeMode" => "Resume", + "ExpectedResult" => "Success", + "SessionTicketExpected" => "Yes", + "ResumptionExpected" => "Yes", + "ExpectedSessionTicketAppData" => "HelloWorld", + } + }, + { + "name" => "session-ticket-app-data13", + "client" => { + "MaxProtocol" => "TLSv1.3", + "Options" => "SessionTicket", + }, + "server" => { + "Options" => "SessionTicket", + }, + "test" => { + "HandshakeMode" => "Resume", + "ExpectedResult" => "Success", + "SessionTicketExpected" => "Yes", + "ResumptionExpected" => "Yes", + "ExpectedSessionTicketAppData" => "", + } + } +); + +our @tests = (); +push @tests, @tests12 unless disabled("tls1_2"); +push @tests, @tests13 unless disabled("tls1_3"); diff --git a/test/ssl_cert_table_internal_test.c b/test/ssl_cert_table_internal_test.c index b298cfe2..5adcb8d4 100644 --- a/test/ssl_cert_table_internal_test.c +++ b/test/ssl_cert_table_internal_test.c @@ -70,6 +70,8 @@ static int test_ssl_cert_table(void) return 0; if (!test_cert_table(EVP_PKEY_ED25519, SSL_aECDSA, SSL_PKEY_ED25519)) return 0; + if (!test_cert_table(EVP_PKEY_ED448, SSL_aECDSA, SSL_PKEY_ED448)) + return 0; return 1; } diff --git a/test/ssl_test.c b/test/ssl_test.c index a21a0f77..778c3303 100644 --- a/test/ssl_test.c +++ b/test/ssl_test.c @@ -188,6 +188,27 @@ static int check_alpn(HANDSHAKE_RESULT *result, SSL_TEST_CTX *test_ctx) return ret; } +static int check_session_ticket_app_data(HANDSHAKE_RESULT *result, + SSL_TEST_CTX *test_ctx) +{ + size_t result_len = 0; + size_t expected_len = 0; + + /* consider empty and NULL strings to be the same */ + if (result->result_session_ticket_app_data != NULL) + result_len = strlen(result->result_session_ticket_app_data); + if (test_ctx->expected_session_ticket_app_data != NULL) + expected_len = strlen(test_ctx->expected_session_ticket_app_data); + if (result_len == 0 && expected_len == 0) + return 1; + + if (!TEST_str_eq(result->result_session_ticket_app_data, + test_ctx->expected_session_ticket_app_data)) + return 0; + + return 1; +} + static int check_resumption(HANDSHAKE_RESULT *result, SSL_TEST_CTX *test_ctx) { if (!TEST_int_eq(result->client_resumed, result->server_resumed)) @@ -352,6 +373,7 @@ static int check_test(HANDSHAKE_RESULT *result, SSL_TEST_CTX *test_ctx) #endif ret &= check_cipher(result, test_ctx); ret &= check_alpn(result, test_ctx); + ret &= check_session_ticket_app_data(result, test_ctx); ret &= check_resumption(result, test_ctx); ret &= check_tmp_key(result, test_ctx); ret &= check_server_cert_type(result, test_ctx); diff --git a/test/ssl_test_ctx.c b/test/ssl_test_ctx.c index c55b2728..76769669 100644 --- a/test/ssl_test_ctx.c +++ b/test/ssl_test_ctx.c @@ -99,6 +99,7 @@ static const test_enum ssl_test_results[] = { {"ServerFail", SSL_TEST_SERVER_FAIL}, {"ClientFail", SSL_TEST_CLIENT_FAIL}, {"InternalError", SSL_TEST_INTERNAL_ERROR}, + {"FirstHandshakeFailed", SSL_TEST_FIRST_HANDSHAKE_FAILED}, }; __owur static int parse_expected_result(SSL_TEST_CTX *test_ctx, const char *value) @@ -360,6 +361,10 @@ IMPLEMENT_SSL_TEST_STRING_OPTION(SSL_TEST_SERVER_CONF, server, srp_user) IMPLEMENT_SSL_TEST_STRING_OPTION(SSL_TEST_CLIENT_CONF, client, srp_password) IMPLEMENT_SSL_TEST_STRING_OPTION(SSL_TEST_SERVER_CONF, server, srp_password) +/* Session Ticket App Data options */ +IMPLEMENT_SSL_TEST_STRING_OPTION(SSL_TEST_CTX, test, expected_session_ticket_app_data) +IMPLEMENT_SSL_TEST_STRING_OPTION(SSL_TEST_SERVER_CONF, server, session_ticket_app_data) + /* Handshake mode */ static const test_enum ssl_handshake_modes[] = { @@ -664,6 +669,7 @@ static const ssl_test_ctx_option ssl_test_ctx_options[] = { { "ExpectedClientCANames", &parse_expected_client_ca_names }, { "UseSCTP", &parse_test_use_sctp }, { "ExpectedCipher", &parse_test_expected_cipher }, + { "ExpectedSessionTicketAppData", &parse_test_expected_session_ticket_app_data }, }; /* Nested client options. */ @@ -700,6 +706,7 @@ static const ssl_test_server_option ssl_test_server_options[] = { { "SRPUser", &parse_server_srp_user }, { "SRPPassword", &parse_server_srp_password }, { "ForcePHA", &parse_server_force_pha }, + { "SessionTicketAppData", &parse_server_session_ticket_app_data }, }; SSL_TEST_CTX *SSL_TEST_CTX_new() @@ -729,6 +736,8 @@ static void ssl_test_extra_conf_free_data(SSL_TEST_EXTRA_CONF *conf) OPENSSL_free(conf->server2.srp_password); OPENSSL_free(conf->client.srp_user); OPENSSL_free(conf->client.srp_password); + OPENSSL_free(conf->server.session_ticket_app_data); + OPENSSL_free(conf->server2.session_ticket_app_data); } static void ssl_test_ctx_free_extra_data(SSL_TEST_CTX *ctx) @@ -742,6 +751,7 @@ void SSL_TEST_CTX_free(SSL_TEST_CTX *ctx) ssl_test_ctx_free_extra_data(ctx); OPENSSL_free(ctx->expected_npn_protocol); OPENSSL_free(ctx->expected_alpn_protocol); + OPENSSL_free(ctx->expected_session_ticket_app_data); sk_X509_NAME_pop_free(ctx->expected_server_ca_names, X509_NAME_free); sk_X509_NAME_pop_free(ctx->expected_client_ca_names, X509_NAME_free); OPENSSL_free(ctx->expected_cipher); diff --git a/test/ssl_test_ctx.h b/test/ssl_test_ctx.h index f9b9217b..e26c2076 100644 --- a/test/ssl_test_ctx.h +++ b/test/ssl_test_ctx.h @@ -127,6 +127,7 @@ typedef struct { char *srp_password; /* Forced PHA */ int force_pha; + char *session_ticket_app_data; } SSL_TEST_SERVER_CONF; typedef struct { @@ -216,6 +217,8 @@ typedef struct { /* Whether to expect a session id from the server */ ssl_session_id_t session_id_expected; char *expected_cipher; + /* Expected Session Ticket Application Data */ + char *expected_session_ticket_app_data; } SSL_TEST_CTX; const char *ssl_test_result_name(ssl_test_result_t result); diff --git a/test/ssl_test_ctx_test.c b/test/ssl_test_ctx_test.c index 70ebb2a0..e0458a17 100644 --- a/test/ssl_test_ctx_test.c +++ b/test/ssl_test_ctx_test.c @@ -55,6 +55,8 @@ static int serverconf_eq(SSL_TEST_SERVER_CONF *serv, || !TEST_str_eq(serv->alpn_protocols, serv2->alpn_protocols) || !TEST_int_eq(serv->broken_session_ticket, serv2->broken_session_ticket) + || !TEST_str_eq(serv->session_ticket_app_data, + serv2->session_ticket_app_data) || !TEST_int_eq(serv->cert_status, serv2->cert_status)) return 0; return 1; @@ -95,6 +97,8 @@ static int testctx_eq(SSL_TEST_CTX *ctx, SSL_TEST_CTX *ctx2) ctx2->expected_alpn_protocol) || !TEST_str_eq(ctx->expected_cipher, ctx2->expected_cipher) + || !TEST_str_eq(ctx->expected_session_ticket_app_data, + ctx2->expected_session_ticket_app_data) || !TEST_int_eq(ctx->resumption_expected, ctx2->resumption_expected) || !TEST_int_eq(ctx->session_id_expected, diff --git a/test/sslapitest.c b/test/sslapitest.c index 6480885f..32f60e56 100644 --- a/test/sslapitest.c +++ b/test/sslapitest.c @@ -1415,6 +1415,8 @@ static const char *srvid; static int use_session_cb_cnt = 0; static int find_session_cb_cnt = 0; +static int psk_client_cb_cnt = 0; +static int psk_server_cb_cnt = 0; static int use_session_cb(SSL *ssl, const EVP_MD *md, const unsigned char **id, size_t *idlen, SSL_SESSION **sess) @@ -1447,6 +1449,34 @@ static int use_session_cb(SSL *ssl, const EVP_MD *md, const unsigned char **id, return 1; } +static unsigned int psk_client_cb(SSL *ssl, const char *hint, char *id, + unsigned int max_id_len, + unsigned char *psk, + unsigned int max_psk_len) +{ + unsigned int psklen = 0; + + psk_client_cb_cnt++; + + if (strlen(pskid) + 1 > max_id_len) + return 0; + + /* We should only ever be called a maximum of twice per connection */ + if (psk_client_cb_cnt > 2) + return 0; + + if (clientpsk == NULL) + return 0; + + /* We'll reuse the PSK we set up for TLSv1.3 */ + if (SSL_SESSION_get_master_key(clientpsk, NULL, 0) > max_psk_len) + return 0; + psklen = SSL_SESSION_get_master_key(clientpsk, psk, max_psk_len); + strncpy(id, pskid, max_id_len); + + return psklen; +} + static int find_session_cb(SSL *ssl, const unsigned char *identity, size_t identity_len, SSL_SESSION **sess) { @@ -1473,6 +1503,33 @@ static int find_session_cb(SSL *ssl, const unsigned char *identity, return 1; } +static unsigned int psk_server_cb(SSL *ssl, const char *identity, + unsigned char *psk, unsigned int max_psk_len) +{ + unsigned int psklen = 0; + + psk_server_cb_cnt++; + + /* We should only ever be called a maximum of twice per connection */ + if (find_session_cb_cnt > 2) + return 0; + + if (serverpsk == NULL) + return 0; + + /* Identity should match that set by the client */ + if (strcmp(srvid, identity) != 0) { + return 0; + } + + /* We'll reuse the PSK we set up for TLSv1.3 */ + if (SSL_SESSION_get_master_key(serverpsk, NULL, 0) > max_psk_len) + return 0; + psklen = SSL_SESSION_get_master_key(serverpsk, psk, max_psk_len); + + return psklen; +} + #define MSG1 "Hello" #define MSG2 "World." #define MSG3 "This" @@ -1482,6 +1539,7 @@ static int find_session_cb(SSL *ssl, const unsigned char *identity, #define MSG7 "message." #define TLS13_AES_256_GCM_SHA384_BYTES ((const unsigned char *)"\x13\x02") +#define TLS13_AES_128_GCM_SHA256_BYTES ((const unsigned char *)"\x13\x01") /* * Helper method to setup objects for early data test. Caller frees objects on @@ -1492,7 +1550,11 @@ static int setupearly_data_test(SSL_CTX **cctx, SSL_CTX **sctx, SSL **clientssl, { if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), sctx, - cctx, cert, privkey))) + cctx, cert, privkey)) + || !TEST_true(SSL_CTX_set_max_early_data(*sctx, + SSL3_RT_MAX_PLAIN_LENGTH)) + || !TEST_true(SSL_CTX_set_max_early_data(*cctx, + SSL3_RT_MAX_PLAIN_LENGTH))) return 0; if (idx == 1) { @@ -2436,7 +2498,7 @@ static int test_ciphersuite_change(void) return testresult; } -static int test_tls13_psk(void) +static int test_tls13_psk(int idx) { SSL_CTX *sctx = NULL, *cctx = NULL; SSL *serverssl = NULL, *clientssl = NULL; @@ -2454,11 +2516,31 @@ static int test_tls13_psk(void) &cctx, cert, privkey))) goto end; - SSL_CTX_set_psk_use_session_callback(cctx, use_session_cb); - SSL_CTX_set_psk_find_session_callback(sctx, find_session_cb); + /* + * We use a ciphersuite with SHA256 to ease testing old style PSK callbacks + * which will always default to SHA256 + */ + if (!TEST_true(SSL_CTX_set_cipher_list(cctx, "TLS13-AES-128-GCM-SHA256"))) + goto end; + + /* + * Test 0: New style callbacks only + * Test 1: New and old style callbacks (only the new ones should be used) + * Test 2: Old style callbacks only + */ + if (idx == 0 || idx == 1) { + SSL_CTX_set_psk_use_session_callback(cctx, use_session_cb); + SSL_CTX_set_psk_find_session_callback(sctx, find_session_cb); + } + if (idx == 1 || idx == 2) { + SSL_CTX_set_psk_client_callback(cctx, psk_client_cb); + SSL_CTX_set_psk_server_callback(sctx, psk_server_cb); + } srvid = pskid; use_session_cb_cnt = 0; find_session_cb_cnt = 0; + psk_client_cb_cnt = 0; + psk_server_cb_cnt = 0; /* Check we can create a connection if callback decides not to send a PSK */ if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, @@ -2466,21 +2548,37 @@ static int test_tls13_psk(void) || !TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)) || !TEST_false(SSL_session_reused(clientssl)) - || !TEST_false(SSL_session_reused(serverssl)) - || !TEST_true(use_session_cb_cnt == 1) - || !TEST_true(find_session_cb_cnt == 0)) + || !TEST_false(SSL_session_reused(serverssl))) goto end; + if (idx == 0 || idx == 1) { + if (!TEST_true(use_session_cb_cnt == 1) + || !TEST_true(find_session_cb_cnt == 0) + /* + * If no old style callback then below should be 0 + * otherwise 1 + */ + || !TEST_true(psk_client_cb_cnt == idx) + || !TEST_true(psk_server_cb_cnt == 0)) + goto end; + } else { + if (!TEST_true(use_session_cb_cnt == 0) + || !TEST_true(find_session_cb_cnt == 0) + || !TEST_true(psk_client_cb_cnt == 1) + || !TEST_true(psk_server_cb_cnt == 0)) + goto end; + } + shutdown_ssl_connection(serverssl, clientssl); serverssl = clientssl = NULL; - use_session_cb_cnt = 0; + use_session_cb_cnt = psk_client_cb_cnt = 0; if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL, NULL))) goto end; /* Create the PSK */ - cipher = SSL_CIPHER_find(clientssl, TLS13_AES_256_GCM_SHA384_BYTES); + cipher = SSL_CIPHER_find(clientssl, TLS13_AES_128_GCM_SHA256_BYTES); clientpsk = SSL_SESSION_new(); if (!TEST_ptr(clientpsk) || !TEST_ptr(cipher) @@ -2496,14 +2594,27 @@ static int test_tls13_psk(void) /* Check we can create a connection and the PSK is used */ if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)) || !TEST_true(SSL_session_reused(clientssl)) - || !TEST_true(SSL_session_reused(serverssl)) - || !TEST_true(use_session_cb_cnt == 1) - || !TEST_true(find_session_cb_cnt == 1)) + || !TEST_true(SSL_session_reused(serverssl))) goto end; + if (idx == 0 || idx == 1) { + if (!TEST_true(use_session_cb_cnt == 1) + || !TEST_true(find_session_cb_cnt == 1) + || !TEST_true(psk_client_cb_cnt == 0) + || !TEST_true(psk_server_cb_cnt == 0)) + goto end; + } else { + if (!TEST_true(use_session_cb_cnt == 0) + || !TEST_true(find_session_cb_cnt == 0) + || !TEST_true(psk_client_cb_cnt == 1) + || !TEST_true(psk_server_cb_cnt == 1)) + goto end; + } + shutdown_ssl_connection(serverssl, clientssl); serverssl = clientssl = NULL; use_session_cb_cnt = find_session_cb_cnt = 0; + psk_client_cb_cnt = psk_server_cb_cnt = 0; if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL, NULL))) @@ -2519,14 +2630,27 @@ static int test_tls13_psk(void) */ if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)) || !TEST_true(SSL_session_reused(clientssl)) - || !TEST_true(SSL_session_reused(serverssl)) - || !TEST_true(use_session_cb_cnt == 2) - || !TEST_true(find_session_cb_cnt == 2)) + || !TEST_true(SSL_session_reused(serverssl))) goto end; + if (idx == 0 || idx == 1) { + if (!TEST_true(use_session_cb_cnt == 2) + || !TEST_true(find_session_cb_cnt == 2) + || !TEST_true(psk_client_cb_cnt == 0) + || !TEST_true(psk_server_cb_cnt == 0)) + goto end; + } else { + if (!TEST_true(use_session_cb_cnt == 0) + || !TEST_true(find_session_cb_cnt == 0) + || !TEST_true(psk_client_cb_cnt == 2) + || !TEST_true(psk_server_cb_cnt == 2)) + goto end; + } + shutdown_ssl_connection(serverssl, clientssl); serverssl = clientssl = NULL; use_session_cb_cnt = find_session_cb_cnt = 0; + psk_client_cb_cnt = psk_server_cb_cnt = 0; /* * Check that if the server rejects the PSK we can still connect, but with @@ -2538,11 +2662,27 @@ static int test_tls13_psk(void) || !TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)) || !TEST_false(SSL_session_reused(clientssl)) - || !TEST_false(SSL_session_reused(serverssl)) - || !TEST_true(use_session_cb_cnt == 1) - || !TEST_true(find_session_cb_cnt == 1)) + || !TEST_false(SSL_session_reused(serverssl))) goto end; + if (idx == 0 || idx == 1) { + if (!TEST_true(use_session_cb_cnt == 1) + || !TEST_true(find_session_cb_cnt == 1) + || !TEST_true(psk_client_cb_cnt == 0) + /* + * If no old style callback then below should be 0 + * otherwise 1 + */ + || !TEST_true(psk_server_cb_cnt == idx)) + goto end; + } else { + if (!TEST_true(use_session_cb_cnt == 0) + || !TEST_true(find_session_cb_cnt == 0) + || !TEST_true(psk_client_cb_cnt == 1) + || !TEST_true(psk_server_cb_cnt == 1)) + goto end; + } + shutdown_ssl_connection(serverssl, clientssl); serverssl = clientssl = NULL; testresult = 1; @@ -2583,6 +2723,21 @@ static int verify_cookie_callback(SSL *ssl, const unsigned char *cookie, return 0; } +static int generate_stateless_cookie_callback(SSL *ssl, unsigned char *cookie, + size_t *cookie_len) +{ + unsigned int temp; + int res = generate_cookie_callback(ssl, cookie, &temp); + *cookie_len = temp; + return res; +} + +static int verify_stateless_cookie_callback(SSL *ssl, const unsigned char *cookie, + size_t cookie_len) +{ + return verify_cookie_callback(ssl, cookie, cookie_len); +} + static int test_stateless(void) { SSL_CTX *sctx = NULL, *cctx = NULL; @@ -2594,20 +2749,40 @@ static int test_stateless(void) &cctx, cert, privkey))) goto end; - /* Set up the cookie generation and verification callbacks */ - SSL_CTX_set_cookie_generate_cb(sctx, generate_cookie_callback); - SSL_CTX_set_cookie_verify_cb(sctx, verify_cookie_callback); - /* The arrival of CCS messages can confuse the test */ SSL_CTX_clear_options(cctx, SSL_OP_ENABLE_MIDDLEBOX_COMPAT); + if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, + NULL, NULL)) + /* Send the first ClientHello */ + || !TEST_false(create_ssl_connection(serverssl, clientssl, + SSL_ERROR_WANT_READ)) + /* + * This should fail with a -1 return because we have no callbacks + * set up + */ + || !TEST_int_eq(SSL_stateless(serverssl), -1)) + goto end; + + /* Fatal error so abandon the connection from this client */ + SSL_free(clientssl); + clientssl = NULL; + + /* Set up the cookie generation and verification callbacks */ + SSL_CTX_set_stateless_cookie_generate_cb(sctx, generate_stateless_cookie_callback); + SSL_CTX_set_stateless_cookie_verify_cb(sctx, verify_stateless_cookie_callback); + + /* + * Create a new connection from the client (we can reuse the server SSL + * object). + */ if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL, NULL)) /* Send the first ClientHello */ || !TEST_false(create_ssl_connection(serverssl, clientssl, SSL_ERROR_WANT_READ)) /* This should fail because there is no cookie */ - || !TEST_false(SSL_stateless(serverssl))) + || !TEST_int_eq(SSL_stateless(serverssl), 0)) goto end; /* Abandon the connection from this client */ @@ -2624,12 +2799,12 @@ static int test_stateless(void) || !TEST_false(create_ssl_connection(serverssl, clientssl, SSL_ERROR_WANT_READ)) /* This should fail because there is no cookie */ - || !TEST_false(SSL_stateless(serverssl)) + || !TEST_int_eq(SSL_stateless(serverssl), 0) /* Send the second ClientHello */ || !TEST_false(create_ssl_connection(serverssl, clientssl, SSL_ERROR_WANT_READ)) /* This should succeed because a cookie is now present */ - || !TEST_true(SSL_stateless(serverssl)) + || !TEST_int_eq(SSL_stateless(serverssl), 1) /* Complete the connection */ || !TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))) @@ -3502,7 +3677,7 @@ int setup_tests(void) #endif #ifndef OPENSSL_NO_TLS1_3 ADD_TEST(test_ciphersuite_change); - ADD_TEST(test_tls13_psk); + ADD_ALL_TESTS(test_tls13_psk, 3); ADD_ALL_TESTS(test_custom_exts, 5); ADD_TEST(test_stateless); ADD_TEST(test_pha_key_update); diff --git a/test/tls13ccstest.c b/test/tls13ccstest.c index c95010fb..afea0ea5 100644 --- a/test/tls13ccstest.c +++ b/test/tls13ccstest.c @@ -255,7 +255,11 @@ static int test_tls13ccs(int tst) chsessidlen = 0; if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), - &sctx, &cctx, cert, privkey))) + &sctx, &cctx, cert, privkey)) + || !TEST_true(SSL_CTX_set_max_early_data(sctx, + SSL3_RT_MAX_PLAIN_LENGTH)) + || !TEST_true(SSL_CTX_set_max_early_data(cctx, + SSL3_RT_MAX_PLAIN_LENGTH))) goto err; /* diff --git a/tools/c_rehash.in b/tools/c_rehash.in index e6582220..3a9e44a5 100644 --- a/tools/c_rehash.in +++ b/tools/c_rehash.in @@ -1,4 +1,4 @@ -#!{- $config{hashbangperl} -} +#!{- $config{HASHBANGPERL} -} # {- join("\n# ", @autowarntext) -} # Copyright 1999-2016 The OpenSSL Project Authors. All Rights Reserved. diff --git a/util/add-depends.pl b/util/add-depends.pl new file mode 100644 index 00000000..573986d6 --- /dev/null +++ b/util/add-depends.pl @@ -0,0 +1,50 @@ +#! /usr/bin/env perl +# Copyright 2018 The OpenSSL Project Authors. All Rights Reserved. +# +# Licensed under the OpenSSL license (the "License"). You may not use +# this file except in compliance with the License. You can obtain a copy +# in the file LICENSE in the source distribution or at +# https://www.openssl.org/source/license.html + +use lib '.'; +use configdata; + +use File::Compare qw(compare_text); + +my $buildfile = $config{build_file}; +my $buildfile_new = "$buildfile-$$"; +my $depext = $target{dep_extension} || ".d"; +my @deps = + grep { -f $_ } + map { (my $x = $_) =~ s|\.o$|$depext|; $x; } + grep { $unified_info{sources}->{$_}->[0] =~ /\.cc?$/ } + keys %{$unified_info{sources}}; + +open IBF, $buildfile or die "Trying to read $buildfile: $!\n"; +open OBF, '>', $buildfile_new or die "Trying to write $buildfile_new: $!\n"; +while () { + $force_rewrite = 0; + last if /^# DO NOT DELETE THIS LINE/; + print OBF or die "$!\n"; + $force_rewrite = 1; +} +close IBF; + +print OBF "# DO NOT DELETE THIS LINE -- make depend depends on it.\n"; + +foreach (@deps) { + open IBF,$_ or die "Trying to read $_: $!\n"; + while () { + print OBF or die "$!\n"; + } + close IBF; +} +close OBF; + +if (compare_text($buildfile_new, $buildfile) != 0) { + rename $buildfile_new, $buildfile + or die "Trying to rename $buildfile_new -> $buildfile: $!\n"; +} +# On VMS, we want to remove all generations of this file, in case there are +# more than one +while (unlink $buildfile_new) {} diff --git a/util/ck_errf.pl b/util/ck_errf.pl old mode 100755 new mode 100644 diff --git a/util/dofile.pl b/util/dofile.pl index 0f2e8f0b..2ea54e30 100644 --- a/util/dofile.pl +++ b/util/dofile.pl @@ -99,9 +99,9 @@ package main; # This adds quotes (") around the given string, and escapes any $, @, \, # " and ' by prepending a \ to them. sub quotify1 { - my $s = shift @_; + my $s = my $orig = shift @_; $s =~ s/([\$\@\\"'])/\\$1/g; - '"'.$s.'"'; + $s ne $orig || $s =~ /\s/ ? '"'.$s.'"' : $s; } # quotify_l LIST diff --git a/util/find-doc-nits b/util/find-doc-nits old mode 100755 new mode 100644 diff --git a/util/find-unused-errs b/util/find-unused-errs old mode 100755 new mode 100644 diff --git a/util/libcrypto.num b/util/libcrypto.num index bd94e27d..a96bd2f7 100644 --- a/util/libcrypto.num +++ b/util/libcrypto.num @@ -4521,3 +4521,4 @@ OSSL_STORE_SEARCH_by_alias 4462 1_1_1 EXIST::FUNCTION: OSSL_STORE_LOADER_set_find 4463 1_1_1 EXIST::FUNCTION: OSSL_STORE_SEARCH_free 4464 1_1_1 EXIST::FUNCTION: OSSL_STORE_SEARCH_get0_digest 4465 1_1_1 EXIST::FUNCTION: +RAND_DRBG_set_reseed_defaults 4466 1_1_1 EXIST::FUNCTION: diff --git a/util/libssl.num b/util/libssl.num index 48c5eca1..db844e33 100644 --- a/util/libssl.num +++ b/util/libssl.num @@ -477,3 +477,10 @@ SSL_stateless 477 1_1_1 EXIST::FUNCTION: SSL_verify_client_post_handshake 478 1_1_1 EXIST::FUNCTION: SSL_force_post_handshake_auth 479 1_1_1 EXIST::FUNCTION: SSL_export_keying_material_early 480 1_1_1 EXIST::FUNCTION: +SSL_CTX_use_cert_and_key 481 1_1_1 EXIST::FUNCTION: +SSL_use_cert_and_key 482 1_1_1 EXIST::FUNCTION: +SSL_SESSION_get0_ticket_appdata 483 1_1_1 EXIST::FUNCTION: +SSL_SESSION_set1_ticket_appdata 484 1_1_1 EXIST::FUNCTION: +SSL_CTX_set_session_ticket_cb 485 1_1_1 EXIST::FUNCTION: +SSL_CTX_set_stateless_cookie_generate_cb 486 1_1_1 EXIST::FUNCTION: +SSL_CTX_set_stateless_cookie_verify_cb 487 1_1_1 EXIST::FUNCTION: diff --git a/util/mkbuildinf.pl b/util/mkbuildinf.pl old mode 100755 new mode 100644 diff --git a/util/mkdef.pl b/util/mkdef.pl old mode 100755 new mode 100644 diff --git a/util/mkdir-p.pl b/util/mkdir-p.pl old mode 100755 new mode 100644 diff --git a/util/mkerr.pl b/util/mkerr.pl old mode 100755 new mode 100644 diff --git a/util/mkrc.pl b/util/mkrc.pl old mode 100755 new mode 100644 diff --git a/util/openssl-format-source b/util/openssl-format-source old mode 100755 new mode 100644 diff --git a/util/openssl-update-copyright b/util/openssl-update-copyright old mode 100755 new mode 100644 diff --git a/util/opensslwrap.sh b/util/opensslwrap.sh old mode 100755 new mode 100644 diff --git a/util/private.num b/util/private.num index c106e608..6c1a0ef3 100644 --- a/util/private.num +++ b/util/private.num @@ -248,7 +248,9 @@ SSL_CTX_build_cert_chain define SSL_CTX_clear_chain_certs define SSL_CTX_clear_extra_chain_certs define SSL_CTX_clear_mode define +SSL_CTX_decrypt_session_ticket_fn define SSL_CTX_disable_ct define +SSL_CTX_generate_session_ticket_fn define SSL_CTX_get0_chain_certs define SSL_CTX_get_default_read_ahead define SSL_CTX_get_max_cert_list define diff --git a/util/process_docs.pl b/util/process_docs.pl old mode 100755 new mode 100644 diff --git a/util/shlib_wrap.sh.in b/util/shlib_wrap.sh.in old mode 100755 new mode 100644