diff --git a/.gitignore b/.gitignore index ff4b66fd..891f6f62 100644 --- a/.gitignore +++ b/.gitignore @@ -26,43 +26,7 @@ /include/openssl/opensslv.h # Auto generated doc files -# Keep this in sync with doc/man1/build.info -doc/man1/openssl-ca.pod -doc/man1/openssl-cms.pod -doc/man1/openssl-crl.pod -doc/man1/openssl-dgst.pod -doc/man1/openssl-dhparam.pod -doc/man1/openssl-dsa.pod -doc/man1/openssl-dsaparam.pod -doc/man1/openssl-ec.pod -doc/man1/openssl-ecparam.pod -doc/man1/openssl-enc.pod -doc/man1/openssl-gendsa.pod -doc/man1/openssl-genpkey.pod -doc/man1/openssl-genrsa.pod -doc/man1/openssl-ocsp.pod -doc/man1/openssl-passwd.pod -doc/man1/openssl-pkcs12.pod -doc/man1/openssl-pkcs7.pod -doc/man1/openssl-pkcs8.pod -doc/man1/openssl-pkey.pod -doc/man1/openssl-pkeyparam.pod -doc/man1/openssl-pkeyutl.pod -doc/man1/openssl-rand.pod -doc/man1/openssl-req.pod -doc/man1/openssl-rsa.pod -doc/man1/openssl-rsautl.pod -doc/man1/openssl-s_client.pod -doc/man1/openssl-s_server.pod -doc/man1/openssl-s_time.pod -doc/man1/openssl-smime.pod -doc/man1/openssl-speed.pod -doc/man1/openssl-spkac.pod -doc/man1/openssl-srp.pod -doc/man1/openssl-storeutl.pod -doc/man1/openssl-ts.pod -doc/man1/openssl-verify.pod -doc/man1/openssl-x509.pod +doc/man1/openssl-*.pod # error code files /crypto/err/openssl.txt.old @@ -96,12 +60,12 @@ doc/man1/openssl-x509.pod /test/confdump /test/bio_prefix_text # Other generated files in test/ -/test/provider_internal_test.conf -/test/fipsinstall.conf -/providers/fipsinstall.conf +/test/provider_internal_test.cnf +/test/fipsinstall.cnf +/providers/fipsinstall.cnf # Certain files that get created by tests on the fly -/test/test-runs +/test-runs /test/buildtest_* # Fuzz stuff. @@ -123,6 +87,8 @@ doc/man1/openssl-x509.pod /TAGS *.map *.ld +/apps/progs.c +/apps/progs.h # Windows (legacy) /tmp32 @@ -220,6 +186,7 @@ Makefile.save *.bak cscope.* *.d +*.d.tmp pod2htmd.tmp # Windows manifest files diff --git a/Configure b/Configure index 19b57d90..64e30fe2 100755 --- a/Configure +++ b/Configure @@ -265,6 +265,19 @@ if (grep /^reconf(igure)?$/, @argvcopy) { $config{perlargv} = [ @argvcopy ]; +# Historical: if known directories in crypto/ have been removed, it means +# that those sub-systems are disabled. +# (the other option would be to removed them from the SUBDIRS statement in +# crypto/build.info) +# We reverse the input list for cosmetic purely reasons, to compensate that +# 'unshift' adds at the front of the list (i.e. in reverse input order). +foreach ( reverse sort( 'aes', 'aria', 'bf', 'camellia', 'cast', 'des', 'dh', + 'dsa', 'ec', 'hmac', 'idea', 'md2', 'md5', 'mdc2', + 'rc2', 'rc4', 'rc5', 'ripemd', 'rsa', 'seed', 'sha', + 'sm2', 'sm3', 'sm4') ) { + unshift @argvcopy, "no-$_" if ! -d catdir($srcdir, 'crypto', $_); +} + # Collect version numbers my %version = (); diff --git a/apps/ca.c b/apps/ca.c index f201efe3..e3e2fd2e 100644 --- a/apps/ca.c +++ b/apps/ca.c @@ -148,7 +148,7 @@ typedef enum OPTION_choice { OPT_INFILES, OPT_SS_CERT, OPT_SPKAC, OPT_REVOKE, OPT_VALID, OPT_EXTENSIONS, OPT_EXTFILE, OPT_STATUS, OPT_UPDATEDB, OPT_CRLEXTS, OPT_RAND_SERIAL, - OPT_R_ENUM, OPT_SM2ID, OPT_SM2HEXID, + OPT_R_ENUM, OPT_SM2ID, OPT_SM2HEXID, OPT_PROV_ENUM, /* Do not change the order here; see related case statements below */ OPT_CRL_REASON, OPT_CRL_HOLD, OPT_CRL_COMPROMISE, OPT_CRL_CA_COMPROMISE } OPTION_CHOICE; @@ -177,6 +177,7 @@ const OPTIONS ca_options[] = { OPT_SECTION("Configuration"), {"config", OPT_CONFIG, 's', "A config file"}, {"name", OPT_NAME, 's', "The particular CA definition to use"}, + {"section", OPT_NAME, 's', "An alias for -name"}, {"policy", OPT_POLICY, 's', "The CA 'policy' to support"}, OPT_SECTION("Certificate"), @@ -237,6 +238,7 @@ const OPTIONS ca_options[] = { {"revoke", OPT_REVOKE, '<', "Revoke a cert (given in file)"}, OPT_R_OPTIONS, + OPT_PROV_OPTIONS, OPT_PARAMETERS(), {"certreq", 0, 0, "Certificate requests to be signed (optional)"}, @@ -361,6 +363,10 @@ opthelp: if (!opt_rand(o)) goto end; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; case OPT_KEY: key = opt_arg(); break; diff --git a/apps/ciphers.c b/apps/ciphers.c index 280a5ab4..9bbc12ae 100644 --- a/apps/ciphers.c +++ b/apps/ciphers.c @@ -27,7 +27,7 @@ typedef enum OPTION_choice { OPT_PSK, OPT_SRP, OPT_CIPHERSUITES, - OPT_V, OPT_UPPER_V, OPT_S + OPT_V, OPT_UPPER_V, OPT_S, OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS ciphers_options[] = { @@ -67,6 +67,7 @@ const OPTIONS ciphers_options[] = { #endif {"ciphersuites", OPT_CIPHERSUITES, 's', "Configure the TLSv1.3 ciphersuites to use"}, + OPT_PROV_OPTIONS, OPT_PARAMETERS(), {"cipher", 0, 0, "Cipher string to decode (optional)"}, @@ -169,6 +170,10 @@ int ciphers_main(int argc, char **argv) case OPT_CIPHERSUITES: ciphersuites = opt_arg(); break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } argv = opt_rest(); diff --git a/apps/cms.c b/apps/cms.c index d67116d3..c8c303ea 100644 --- a/apps/cms.c +++ b/apps/cms.c @@ -81,10 +81,12 @@ typedef enum OPTION_choice { OPT_PASSIN, OPT_TO, OPT_FROM, OPT_SUBJECT, OPT_SIGNER, OPT_RECIP, OPT_CERTSOUT, OPT_MD, OPT_INKEY, OPT_KEYFORM, OPT_KEYOPT, OPT_RR_FROM, OPT_RR_TO, OPT_AES128_WRAP, OPT_AES192_WRAP, OPT_AES256_WRAP, - OPT_3DES_WRAP, OPT_ENGINE, + OPT_3DES_WRAP, OPT_WRAP, OPT_ENGINE, OPT_R_ENUM, + OPT_PROV_ENUM, OPT_V_ENUM, - OPT_CIPHER + OPT_CIPHER, + OPT_ORIGINATOR } OPTION_CHOICE; const OPTIONS cms_options[] = { @@ -197,6 +199,7 @@ const OPTIONS cms_options[] = { {"from", OPT_FROM, 's', "From address"}, {"subject", OPT_SUBJECT, 's', "Subject"}, {"signer", OPT_SIGNER, 's', "Signer certificate file"}, + {"originator", OPT_ORIGINATOR, 's', "Originator certificate file"}, {"recip", OPT_RECIP, '<', "Recipient cert file for decryption"}, {"receipt_request_from", OPT_RR_FROM, 's', "Create signed receipt request with specified email address"}, @@ -214,9 +217,11 @@ const OPTIONS cms_options[] = { # ifndef OPENSSL_NO_DES {"des3-wrap", OPT_3DES_WRAP, '-', "Use 3DES-EDE to wrap key"}, # endif + {"wrap", OPT_WRAP, 's', "Any wrap cipher to wrap key"}, OPT_R_OPTIONS, OPT_V_OPTIONS, + OPT_PROV_OPTIONS, OPT_PARAMETERS(), {"cert", 0, 0, "Recipient certs (optional; used only when encrypting)"}, @@ -236,7 +241,7 @@ int cms_main(int argc, char **argv) STACK_OF(OPENSSL_STRING) *rr_to = NULL, *rr_from = NULL; STACK_OF(OPENSSL_STRING) *sksigners = NULL, *skkeys = NULL; STACK_OF(X509) *encerts = NULL, *other = NULL; - X509 *cert = NULL, *recip = NULL, *signer = NULL; + X509 *cert = NULL, *recip = NULL, *signer = NULL, *originator = NULL; X509_STORE *store = NULL; X509_VERIFY_PARAM *vpm = NULL; char *certfile = NULL, *keyfile = NULL, *contfile = NULL; @@ -244,7 +249,7 @@ int cms_main(int argc, char **argv) char *certsoutfile = NULL; int noCAfile = 0, noCApath = 0, noCAstore = 0; char *infile = NULL, *outfile = NULL, *rctfile = NULL; - char *passinarg = NULL, *passin = NULL, *signerfile = NULL, *recipfile = NULL; + char *passinarg = NULL, *passin = NULL, *signerfile = NULL, *originatorfile = NULL, *recipfile = NULL; char *to = NULL, *from = NULL, *subject = NULL, *prog; cms_key_param *key_first = NULL, *key_param = NULL; int flags = CMS_DETACHED, noout = 0, print = 0, keyidx = -1, vpmtouched = 0; @@ -535,6 +540,9 @@ int cms_main(int argc, char **argv) } signerfile = opt_arg(); break; + case OPT_ORIGINATOR: + originatorfile = opt_arg(); + break; case OPT_INKEY: /* If previous -inkey argument add signer to list */ if (keyfile != NULL) { @@ -615,6 +623,10 @@ int cms_main(int argc, char **argv) if (!opt_rand(o)) goto end; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; case OPT_3DES_WRAP: # ifndef OPENSSL_NO_DES wrap_cipher = EVP_des_ede3_wrap(); @@ -629,6 +641,10 @@ int cms_main(int argc, char **argv) case OPT_AES256_WRAP: wrap_cipher = EVP_aes_256_wrap(); break; + case OPT_WRAP: + if (!opt_cipher(opt_unknown(), &wrap_cipher)) + goto end; + break; } } argc = opt_num_rest(); @@ -759,6 +775,14 @@ int cms_main(int argc, char **argv) } } + if (originatorfile != NULL) { + if ((originator = load_cert(originatorfile, FORMAT_PEM, + "originator certificate file")) == NULL) { + ERR_print_errors(bio_err); + goto end; + } + } + if (operation == SMIME_SIGN_RECEIPT) { if ((signer = load_cert(signerfile, FORMAT_PEM, "receipt signer certificate file")) == NULL) { @@ -767,7 +791,7 @@ int cms_main(int argc, char **argv) } } - if (operation == SMIME_DECRYPT) { + if ((operation == SMIME_DECRYPT) || (operation == SMIME_ENCRYPT)) { if (keyfile == NULL) keyfile = recipfile; } else if ((operation == SMIME_SIGN) || (operation == SMIME_SIGN_RECEIPT)) { @@ -877,23 +901,32 @@ int cms_main(int argc, char **argv) for (i = 0; i < sk_X509_num(encerts); i++) { CMS_RecipientInfo *ri; cms_key_param *kparam; - int tflags = flags; + int tflags = flags | CMS_KEY_PARAM; /* This flag enforces allocating the EVP_PKEY_CTX for the recipient here */ + EVP_PKEY_CTX *pctx; X509 *x = sk_X509_value(encerts, i); + int res; + for (kparam = key_first; kparam; kparam = kparam->next) { if (kparam->idx == i) { - tflags |= CMS_KEY_PARAM; break; } } - ri = CMS_add1_recipient_cert(cms, x, tflags); + ri = CMS_add1_recipient(cms, x, key, originator, tflags); if (ri == NULL) goto end; + + pctx = CMS_RecipientInfo_get0_pkey_ctx(ri); if (kparam != NULL) { - EVP_PKEY_CTX *pctx; - pctx = CMS_RecipientInfo_get0_pkey_ctx(ri); if (!cms_set_pkey_param(pctx, kparam->param)) goto end; } + + res = EVP_PKEY_CTX_ctrl(pctx, -1, -1, + EVP_PKEY_CTRL_CIPHER, + EVP_CIPHER_nid(cipher), NULL); + if (res <= 0 && res != -2) + goto end; + if (CMS_RecipientInfo_type(ri) == CMS_RECIPINFO_AGREE && wrap_cipher) { EVP_CIPHER_CTX *wctx; @@ -1039,7 +1072,7 @@ int cms_main(int argc, char **argv) } if (key != NULL) { - if (!CMS_decrypt_set1_pkey(cms, key, recip)) { + if (!CMS_decrypt_set1_pkey_and_peer(cms, key, recip, originator)) { BIO_puts(bio_err, "Error decrypting CMS using private key\n"); goto end; } diff --git a/apps/crl.c b/apps/crl.c index 14410f35..5e0a517a 100644 --- a/apps/crl.c +++ b/apps/crl.c @@ -24,7 +24,7 @@ typedef enum OPTION_choice { OPT_ISSUER, OPT_LASTUPDATE, OPT_NEXTUPDATE, OPT_FINGERPRINT, OPT_CRLNUMBER, OPT_BADSIG, OPT_GENDELTA, OPT_CAPATH, OPT_CAFILE, OPT_CASTORE, OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE, OPT_VERIFY, OPT_TEXT, OPT_HASH, - OPT_HASH_OLD, OPT_NOOUT, OPT_NAMEOPT, OPT_MD + OPT_HASH_OLD, OPT_NOOUT, OPT_NAMEOPT, OPT_MD, OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS crl_options[] = { @@ -69,6 +69,7 @@ const OPTIONS crl_options[] = { "Do not load certificates from the default certificates directory"}, {"no-CAstore", OPT_NOCASTORE, '-', "Do not load certificates from the default certificates store"}, + OPT_PROV_OPTIONS, {NULL} }; @@ -193,6 +194,11 @@ int crl_main(int argc, char **argv) case OPT_MD: if (!opt_md(opt_unknown(), &digest)) goto opthelp; + break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } argc = opt_num_rest(); diff --git a/apps/crl2p7.c b/apps/crl2p7.c index ffbee4cb..53bc88f7 100644 --- a/apps/crl2p7.c +++ b/apps/crl2p7.c @@ -23,7 +23,8 @@ static int add_certs_from_file(STACK_OF(X509) *stack, char *certfile); typedef enum OPTION_choice { OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, - OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_NOCRL, OPT_CERTFILE + OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_NOCRL, OPT_CERTFILE, + OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS crl2pkcs7_options[] = { @@ -40,6 +41,8 @@ const OPTIONS crl2pkcs7_options[] = { OPT_SECTION("Output"), {"out", OPT_OUT, '>', "Output file"}, {"outform", OPT_OUTFORM, 'F', "Output format - DER or PEM"}, + + OPT_PROV_OPTIONS, {NULL} }; @@ -93,6 +96,10 @@ int crl2pkcs7_main(int argc, char **argv) if (!sk_OPENSSL_STRING_push(certflst, opt_arg())) goto end; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } argc = opt_num_rest(); diff --git a/apps/dgst.c b/apps/dgst.c index 7a81cb28..dcb4c094 100644 --- a/apps/dgst.c +++ b/apps/dgst.c @@ -42,7 +42,7 @@ typedef enum OPTION_choice { OPT_HEX, OPT_BINARY, OPT_DEBUG, OPT_FIPS_FINGERPRINT, OPT_HMAC, OPT_MAC, OPT_SIGOPT, OPT_MACOPT, OPT_DIGEST, - OPT_R_ENUM + OPT_R_ENUM, OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS dgst_options[] = { @@ -82,6 +82,7 @@ const OPTIONS dgst_options[] = { "Compute HMAC with the key used in OpenSSL-FIPS fingerprint"}, OPT_R_OPTIONS, + OPT_PROV_OPTIONS, OPT_PARAMETERS(), {"file", 0, 0, "Files to digest (optional; default is stdin)"}, @@ -208,6 +209,10 @@ int dgst_main(int argc, char **argv) goto opthelp; md = m; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } argc = opt_num_rest(); diff --git a/apps/dhparam.c b/apps/dhparam.c index acff3661..3f694c5a 100644 --- a/apps/dhparam.c +++ b/apps/dhparam.c @@ -41,7 +41,7 @@ typedef enum OPTION_choice { OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_ENGINE, OPT_CHECK, OPT_TEXT, OPT_NOOUT, OPT_DSAPARAM, OPT_C, OPT_2, OPT_3, OPT_5, - OPT_R_ENUM + OPT_R_ENUM, OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS dhparam_options[] = { @@ -73,6 +73,7 @@ const OPTIONS dhparam_options[] = { {"5", OPT_5, '-', "Generate parameters using 5 as the generator value"}, OPT_R_OPTIONS, + OPT_PROV_OPTIONS, OPT_PARAMETERS(), {"numbits", 0, 0, "Number of bits if generating parameters (optional)"}, @@ -151,6 +152,10 @@ int dhparam_main(int argc, char **argv) if (!opt_rand(o)) goto end; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } argc = opt_num_rest(); diff --git a/apps/dsa.c b/apps/dsa.c index 9704a34c..082aa964 100644 --- a/apps/dsa.c +++ b/apps/dsa.c @@ -35,7 +35,8 @@ typedef enum OPTION_choice { /* Do not change the order here; see case statements below */ OPT_PVK_NONE, OPT_PVK_WEAK, OPT_PVK_STRONG, OPT_NOOUT, OPT_TEXT, OPT_MODULUS, OPT_PUBIN, - OPT_PUBOUT, OPT_CIPHER, OPT_PASSIN, OPT_PASSOUT + OPT_PUBOUT, OPT_CIPHER, OPT_PASSIN, OPT_PASSOUT, + OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS dsa_options[] = { @@ -66,6 +67,7 @@ const OPTIONS dsa_options[] = { {"pubout", OPT_PUBOUT, '-', "Output public key, not private"}, {"passout", OPT_PASSOUT, 's', "Output file pass phrase source"}, + OPT_PROV_OPTIONS, {NULL} }; @@ -147,6 +149,10 @@ int dsa_main(int argc, char **argv) if (!opt_cipher(opt_unknown(), &enc)) goto end; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } argc = opt_num_rest(); diff --git a/apps/dsaparam.c b/apps/dsaparam.c index eebffa0e..04e09e79 100644 --- a/apps/dsaparam.c +++ b/apps/dsaparam.c @@ -36,7 +36,7 @@ typedef enum OPTION_choice { OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_TEXT, OPT_C, OPT_NOOUT, OPT_GENKEY, OPT_ENGINE, OPT_VERBOSE, - OPT_R_ENUM + OPT_R_ENUM, OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS dsaparam_options[] = { @@ -62,6 +62,7 @@ const OPTIONS dsaparam_options[] = { {"genkey", OPT_GENKEY, '-', "Generate a DSA key"}, OPT_R_OPTIONS, + OPT_PROV_OPTIONS, OPT_PARAMETERS(), {"numbits", 0, 0, "Number of bits if generating parameters (optional)"}, @@ -122,6 +123,10 @@ int dsaparam_main(int argc, char **argv) if (!opt_rand(o)) goto end; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; case OPT_NOOUT: noout = 1; break; diff --git a/apps/ec.c b/apps/ec.c index 3d901bba..6a387992 100644 --- a/apps/ec.c +++ b/apps/ec.c @@ -40,7 +40,7 @@ typedef enum OPTION_choice { OPT_INFORM, OPT_OUTFORM, OPT_ENGINE, OPT_IN, OPT_OUT, OPT_NOOUT, OPT_TEXT, OPT_PARAM_OUT, OPT_PUBIN, OPT_PUBOUT, OPT_PASSIN, OPT_PASSOUT, OPT_PARAM_ENC, OPT_CONV_FORM, OPT_CIPHER, - OPT_NO_PUBLIC, OPT_CHECK + OPT_NO_PUBLIC, OPT_CHECK, OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS ec_options[] = { @@ -70,6 +70,8 @@ const OPTIONS ec_options[] = { {"pubout", OPT_PUBOUT, '-', "Output public key, not private"}, {"no_public", OPT_NO_PUBLIC, '-', "exclude public key from private key"}, {"passout", OPT_PASSOUT, 's', "Output file pass phrase source"}, + + OPT_PROV_OPTIONS, {NULL} }; @@ -161,6 +163,10 @@ int ec_main(int argc, char **argv) case OPT_CHECK: check = 1; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } argc = opt_num_rest(); diff --git a/apps/ecparam.c b/apps/ecparam.c index 307eb1f3..ed4f4f1f 100644 --- a/apps/ecparam.c +++ b/apps/ecparam.c @@ -31,7 +31,7 @@ typedef enum OPTION_choice { OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_TEXT, OPT_C, OPT_CHECK, OPT_LIST_CURVES, OPT_NO_SEED, OPT_NOOUT, OPT_NAME, OPT_CONV_FORM, OPT_PARAM_ENC, OPT_GENKEY, OPT_ENGINE, OPT_CHECK_NAMED, - OPT_R_ENUM + OPT_R_ENUM, OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS ecparam_options[] = { @@ -67,6 +67,7 @@ const OPTIONS ecparam_options[] = { {"conv_form", OPT_CONV_FORM, 's', "Specifies the point conversion form "}, OPT_R_OPTIONS, + OPT_PROV_OPTIONS, {NULL} }; @@ -169,6 +170,10 @@ int ecparam_main(int argc, char **argv) if (!opt_rand(o)) goto end; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; case OPT_ENGINE: e = setup_engine(opt_arg(), 0); break; diff --git a/apps/enc.c b/apps/enc.c index 2b23564f..74fd6f84 100644 --- a/apps/enc.c +++ b/apps/enc.c @@ -45,7 +45,7 @@ typedef enum OPTION_choice { OPT_NOPAD, OPT_SALT, OPT_NOSALT, OPT_DEBUG, OPT_UPPER_P, OPT_UPPER_A, OPT_A, OPT_Z, OPT_BUFSIZE, OPT_K, OPT_KFILE, OPT_UPPER_K, OPT_NONE, OPT_UPPER_S, OPT_IV, OPT_MD, OPT_ITER, OPT_PBKDF2, OPT_CIPHER, - OPT_R_ENUM + OPT_R_ENUM, OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS enc_options[] = { @@ -97,6 +97,7 @@ const OPTIONS enc_options[] = { {"", OPT_CIPHER, '-', "Any supported cipher"}, OPT_R_OPTIONS, + OPT_PROV_OPTIONS, {NULL} }; @@ -288,6 +289,10 @@ int enc_main(int argc, char **argv) if (!opt_rand(o)) goto end; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } if (opt_num_rest() != 0) { diff --git a/apps/gendsa.c b/apps/gendsa.c index a64ac16a..cf24416b 100644 --- a/apps/gendsa.c +++ b/apps/gendsa.c @@ -31,7 +31,7 @@ NON_EMPTY_TRANSLATION_UNIT typedef enum OPTION_choice { OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, OPT_OUT, OPT_PASSOUT, OPT_ENGINE, OPT_CIPHER, OPT_VERBOSE, - OPT_R_ENUM + OPT_R_ENUM, OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS gendsa_options[] = { @@ -47,6 +47,7 @@ const OPTIONS gendsa_options[] = { {"out", OPT_OUT, '>', "Output the key to the specified file"}, {"passout", OPT_PASSOUT, 's', "Output file pass phrase source"}, OPT_R_OPTIONS, + OPT_PROV_OPTIONS, {"", OPT_CIPHER, '-', "Encrypt the output with any supported cipher"}, {"verbose", OPT_VERBOSE, '-', "Verbose output"}, @@ -92,6 +93,10 @@ int gendsa_main(int argc, char **argv) if (!opt_rand(o)) goto end; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; case OPT_CIPHER: if (!opt_cipher(opt_unknown(), &enc)) goto end; diff --git a/apps/genpkey.c b/apps/genpkey.c index 3ae508c1..ef2979dd 100644 --- a/apps/genpkey.c +++ b/apps/genpkey.c @@ -24,7 +24,8 @@ static int genpkey_cb(EVP_PKEY_CTX *ctx); typedef enum OPTION_choice { OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, OPT_ENGINE, OPT_OUTFORM, OPT_OUT, OPT_PASS, OPT_PARAMFILE, - OPT_ALGORITHM, OPT_PKEYOPT, OPT_GENPARAM, OPT_TEXT, OPT_CIPHER + OPT_ALGORITHM, OPT_PKEYOPT, OPT_GENPARAM, OPT_TEXT, OPT_CIPHER, + OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS genpkey_options[] = { @@ -46,6 +47,8 @@ const OPTIONS genpkey_options[] = { {"text", OPT_TEXT, '-', "Print the in text"}, {"", OPT_CIPHER, '-', "Cipher to use to encrypt the key"}, + OPT_PROV_OPTIONS, + /* This is deliberately last. */ {OPT_HELP_STR, 1, 1, "Order of options may be important! See the documentation.\n"}, @@ -131,6 +134,11 @@ int genpkey_main(int argc, char **argv) BIO_printf(bio_err, "%s: cipher mode not supported\n", prog); goto end; } + break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } argc = opt_num_rest(); diff --git a/apps/genrsa.c b/apps/genrsa.c index 96fb23aa..a7d04fed 100644 --- a/apps/genrsa.c +++ b/apps/genrsa.c @@ -38,7 +38,7 @@ typedef enum OPTION_choice { OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, OPT_3, OPT_F4, OPT_ENGINE, OPT_OUT, OPT_PASSOUT, OPT_CIPHER, OPT_PRIMES, OPT_VERBOSE, - OPT_R_ENUM + OPT_R_ENUM, OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS genrsa_options[] = { @@ -63,6 +63,7 @@ const OPTIONS genrsa_options[] = { {"", OPT_CIPHER, '-', "Encrypt the output with any supported cipher"}, OPT_R_OPTIONS, + OPT_PROV_OPTIONS, OPT_PARAMETERS(), {"numbits", 0, 0, "Size of key in bits"}, @@ -118,6 +119,10 @@ opthelp: if (!opt_rand(o)) goto end; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; case OPT_PASSOUT: passoutarg = opt_arg(); break; diff --git a/apps/include/opt.h b/apps/include/opt.h index ac2c2360..b4257cca 100644 --- a/apps/include/opt.h +++ b/apps/include/opt.h @@ -265,6 +265,24 @@ OPT_R__FIRST: case OPT_R__LAST: break; \ case OPT_R_RAND: case OPT_R_WRITERAND +/* + * Provider options. + */ +# define OPT_PROV_ENUM \ + OPT_PROV__FIRST=1600, \ + OPT_PROV_PROVIDER, OPT_PROV_PROVIDER_PATH, \ + OPT_PROV__LAST + +# define OPT_PROV_OPTIONS \ + OPT_SECTION("Provider"), \ + { "provider", OPT_PROV_PROVIDER, 's', "Provder to load (can be specified multiple times)" }, \ + { "provider_path", OPT_PROV_PROVIDER_PATH, 's', "Provider load path" } + +# define OPT_PROV_CASES \ + OPT_PROV__FIRST: case OPT_PROV__LAST: break; \ + case OPT_PROV_PROVIDER: \ + case OPT_PROV_PROVIDER_PATH + /* * Option parsing. */ @@ -348,6 +366,7 @@ char **opt_rest(void); int opt_num_rest(void); int opt_verify(int i, X509_VERIFY_PARAM *vpm); int opt_rand(int i); +int opt_provider(int i); void opt_help(const OPTIONS * list); void opt_print(const OPTIONS * opt, int doingparams, int width); int opt_format_error(const char *s, unsigned long flags); diff --git a/apps/kdf.c b/apps/kdf.c index 82818f1f..0162ac89 100644 --- a/apps/kdf.c +++ b/apps/kdf.c @@ -19,7 +19,8 @@ typedef enum OPTION_choice { OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, - OPT_KDFOPT, OPT_BIN, OPT_KEYLEN, OPT_OUT + OPT_KDFOPT, OPT_BIN, OPT_KEYLEN, OPT_OUT, + OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS kdf_options[] = { @@ -36,6 +37,8 @@ const OPTIONS kdf_options[] = { {"binary", OPT_BIN, '-', "Output in binary format (default is hexadecimal)"}, + OPT_PROV_OPTIONS, + OPT_PARAMETERS(), {"kdf_name", 0, 0, "Name of the KDF algorithm"}, {NULL} @@ -80,6 +83,10 @@ opthelp: if (opts == NULL || !sk_OPENSSL_STRING_push(opts, opt_arg())) goto opthelp; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto err; + break; } } argc = opt_num_rest(); diff --git a/apps/lib/app_provider.c b/apps/lib/app_provider.c new file mode 100644 index 00000000..ac01e882 --- /dev/null +++ b/apps/lib/app_provider.c @@ -0,0 +1,51 @@ +/* + * Copyright 2020 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include "apps.h" +#include +#include + +/* + * See comments in opt_verify for explanation of this. + */ +enum prov_range { OPT_PROV_ENUM }; + +static int opt_provider_load(const char *provider) +{ + OSSL_PROVIDER *prov; + + prov = OSSL_PROVIDER_load(NULL, provider); + if (prov == NULL) { + opt_printf_stderr("%s: unable to load provider %s\n", + opt_getprog(), provider); + return 0; + } + return 1; +} + +static int opt_provider_path(const char *path) +{ + if (path != NULL && *path == '\0') + path = NULL; + return OSSL_PROVIDER_set_default_search_path(NULL, path); +} + +int opt_provider(int opt) +{ + switch ((enum prov_range)opt) { + case OPT_PROV__FIRST: + case OPT_PROV__LAST: + return 1; + case OPT_PROV_PROVIDER: + return opt_provider_load(opt_arg()); + case OPT_PROV_PROVIDER_PATH: + return opt_provider_path(opt_arg()); + } + return 0; +} diff --git a/apps/lib/build.info b/apps/lib/build.info index 3f68a2ed..a7be58b1 100644 --- a/apps/lib/build.info +++ b/apps/lib/build.info @@ -9,7 +9,7 @@ ENDIF # Source for libapps $LIBAPPSSRC=apps.c apps_ui.c opt.c fmt.c s_cb.c s_socket.c app_rand.c \ - columns.c app_params.c names.c + columns.c app_params.c names.c app_provider.c IF[{- !$disabled{apps} -}] LIBS{noinst}=../libapps.a diff --git a/apps/list.c b/apps/list.c index e8bb8533..28fd5c80 100644 --- a/apps/list.c +++ b/apps/list.c @@ -617,7 +617,8 @@ typedef enum HELPLIST_CHOICE { OPT_COMMANDS, OPT_DIGEST_COMMANDS, OPT_MAC_ALGORITHMS, OPT_OPTIONS, OPT_DIGEST_ALGORITHMS, OPT_CIPHER_COMMANDS, OPT_CIPHER_ALGORITHMS, OPT_PK_ALGORITHMS, OPT_PK_METHOD, OPT_ENGINES, OPT_DISABLED, - OPT_KDF_ALGORITHMS, OPT_MISSING_HELP, OPT_OBJECTS + OPT_KDF_ALGORITHMS, OPT_MISSING_HELP, OPT_OBJECTS, + OPT_PROV_ENUM } HELPLIST_CHOICE; const OPTIONS list_options[] = { @@ -655,6 +656,8 @@ const OPTIONS list_options[] = { "List options for specified command"}, {"objects", OPT_OBJECTS, '-', "List built in objects (OID<->name mappings)"}, + + OPT_PROV_OPTIONS, {NULL} }; @@ -741,6 +744,10 @@ opthelp: case OPT_VERBOSE: verbose = 1; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + return 1; + break; } done = 1; } diff --git a/apps/mac.c b/apps/mac.c index 6abcfcd4..bc236a7b 100644 --- a/apps/mac.c +++ b/apps/mac.c @@ -21,7 +21,8 @@ typedef enum OPTION_choice { OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, - OPT_MACOPT, OPT_BIN, OPT_IN, OPT_OUT + OPT_MACOPT, OPT_BIN, OPT_IN, OPT_OUT, + OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS mac_options[] = { @@ -40,6 +41,8 @@ const OPTIONS mac_options[] = { {"binary", OPT_BIN, '-', "Output in binary format (default is hexadecimal)"}, + OPT_PROV_OPTIONS, + OPT_PARAMETERS(), {"mac_name", 0, 0, "MAC algorithm"}, {NULL} @@ -89,6 +92,10 @@ opthelp: if (opts == NULL || !sk_OPENSSL_STRING_push(opts, opt_arg())) goto opthelp; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto err; + break; } } argc = opt_num_rest(); diff --git a/apps/nseq.c b/apps/nseq.c index 9d1e0950..e9aeea98 100644 --- a/apps/nseq.c +++ b/apps/nseq.c @@ -16,7 +16,8 @@ typedef enum OPTION_choice { OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, - OPT_TOSEQ, OPT_IN, OPT_OUT + OPT_TOSEQ, OPT_IN, OPT_OUT, + OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS nseq_options[] = { @@ -29,6 +30,8 @@ const OPTIONS nseq_options[] = { OPT_SECTION("Output"), {"toseq", OPT_TOSEQ, '-', "Output NS Sequence file"}, {"out", OPT_OUT, '>', "Output file"}, + + OPT_PROV_OPTIONS, {NULL} }; @@ -62,6 +65,10 @@ int nseq_main(int argc, char **argv) case OPT_OUT: outfile = opt_arg(); break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } argc = opt_num_rest(); diff --git a/apps/ocsp.c b/apps/ocsp.c index 3297b428..3c6b8cbd 100644 --- a/apps/ocsp.c +++ b/apps/ocsp.c @@ -137,7 +137,7 @@ typedef enum OPTION_choice { OPT_RCID, OPT_V_ENUM, OPT_MD, - OPT_MULTI + OPT_MULTI, OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS ocsp_options[] = { @@ -230,6 +230,7 @@ const OPTIONS ocsp_options[] = { {"status_age", OPT_STATUS_AGE, 'p', "Maximum status age in seconds"}, OPT_V_OPTIONS, + OPT_PROV_OPTIONS, {NULL} }; @@ -541,6 +542,10 @@ int ocsp_main(int argc, char **argv) multi = atoi(opt_arg()); # endif break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } if (trailing_md) { diff --git a/apps/passwd.c b/apps/passwd.c index 4626eeb2..f3faa585 100644 --- a/apps/passwd.c +++ b/apps/passwd.c @@ -58,7 +58,7 @@ typedef enum OPTION_choice { OPT_IN, OPT_NOVERIFY, OPT_QUIET, OPT_TABLE, OPT_REVERSE, OPT_APR1, OPT_1, OPT_5, OPT_6, OPT_CRYPT, OPT_AIXMD5, OPT_SALT, OPT_STDIN, - OPT_R_ENUM + OPT_R_ENUM, OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS passwd_options[] = { @@ -90,6 +90,7 @@ const OPTIONS passwd_options[] = { #endif OPT_R_OPTIONS, + OPT_PROV_OPTIONS, OPT_PARAMETERS(), {"password", 0, 0, "Password text to digest (optional)"}, @@ -191,6 +192,10 @@ int passwd_main(int argc, char **argv) if (!opt_rand(o)) goto end; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } argc = opt_num_rest(); diff --git a/apps/pkcs12.c b/apps/pkcs12.c index 091318b6..c2448a74 100644 --- a/apps/pkcs12.c +++ b/apps/pkcs12.c @@ -58,7 +58,7 @@ typedef enum OPTION_choice { OPT_INKEY, OPT_CERTFILE, OPT_NAME, OPT_CSP, OPT_CANAME, OPT_IN, OPT_OUT, OPT_PASSIN, OPT_PASSOUT, OPT_PASSWORD, OPT_CAPATH, OPT_CAFILE, OPT_CASTORE, OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE, OPT_ENGINE, - OPT_R_ENUM + OPT_R_ENUM, OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS pkcs12_options[] = { @@ -130,6 +130,7 @@ const OPTIONS pkcs12_options[] = { {"", OPT_CIPHER, '-', "Any supported cipher"}, OPT_R_OPTIONS, + OPT_PROV_OPTIONS, {NULL} }; @@ -307,6 +308,10 @@ int pkcs12_main(int argc, char **argv) case OPT_ENGINE: e = setup_engine(opt_arg(), 0); break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } argc = opt_num_rest(); diff --git a/apps/pkcs7.c b/apps/pkcs7.c index bd1cb101..9c74d99a 100644 --- a/apps/pkcs7.c +++ b/apps/pkcs7.c @@ -23,7 +23,8 @@ typedef enum OPTION_choice { OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_NOOUT, - OPT_TEXT, OPT_PRINT, OPT_PRINT_CERTS, OPT_ENGINE + OPT_TEXT, OPT_PRINT, OPT_PRINT_CERTS, OPT_ENGINE, + OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS pkcs7_options[] = { @@ -45,6 +46,8 @@ const OPTIONS pkcs7_options[] = { {"print", OPT_PRINT, '-', "Print out all fields of the PKCS7 structure"}, {"print_certs", OPT_PRINT_CERTS, '-', "Print_certs print any certs or crl in the input"}, + + OPT_PROV_OPTIONS, {NULL} }; @@ -99,6 +102,10 @@ int pkcs7_main(int argc, char **argv) case OPT_ENGINE: e = setup_engine(opt_arg(), 0); break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } argc = opt_num_rest(); diff --git a/apps/pkcs8.c b/apps/pkcs8.c index 1ccaff06..b058ea19 100644 --- a/apps/pkcs8.c +++ b/apps/pkcs8.c @@ -26,7 +26,7 @@ typedef enum OPTION_choice { #endif OPT_V2, OPT_V1, OPT_V2PRF, OPT_ITER, OPT_PASSIN, OPT_PASSOUT, OPT_TRADITIONAL, - OPT_R_ENUM + OPT_R_ENUM, OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS pkcs8_options[] = { @@ -63,6 +63,7 @@ const OPTIONS pkcs8_options[] = { #endif OPT_R_OPTIONS, + OPT_PROV_OPTIONS, {NULL} }; @@ -127,6 +128,10 @@ int pkcs8_main(int argc, char **argv) if (!opt_rand(o)) goto end; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; case OPT_TRADITIONAL: traditional = 1; break; diff --git a/apps/pkey.c b/apps/pkey.c index 54709f65..e90b3a59 100644 --- a/apps/pkey.c +++ b/apps/pkey.c @@ -37,7 +37,8 @@ typedef enum OPTION_choice { OPT_INFORM, OPT_OUTFORM, OPT_PASSIN, OPT_PASSOUT, OPT_ENGINE, OPT_IN, OPT_OUT, OPT_PUBIN, OPT_PUBOUT, OPT_TEXT_PUB, OPT_TEXT, OPT_NOOUT, OPT_MD, OPT_TRADITIONAL, OPT_CHECK, OPT_PUB_CHECK, - OPT_EC_PARAM_ENC, OPT_EC_CONV_FORM + OPT_EC_PARAM_ENC, OPT_EC_CONV_FORM, + OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS pkey_options[] = { @@ -72,6 +73,7 @@ const OPTIONS pkey_options[] = { {"text", OPT_TEXT, '-', "Output in plaintext as well"}, {"noout", OPT_NOOUT, '-', "Don't output the key"}, + OPT_PROV_OPTIONS, {NULL} }; @@ -177,6 +179,10 @@ int pkey_main(int argc, char **argv) ec_asn1_flag = i; break; #endif + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } argc = opt_num_rest(); diff --git a/apps/pkeyparam.c b/apps/pkeyparam.c index 5521909d..441523dd 100644 --- a/apps/pkeyparam.c +++ b/apps/pkeyparam.c @@ -19,7 +19,8 @@ typedef enum OPTION_choice { OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, OPT_IN, OPT_OUT, OPT_TEXT, OPT_NOOUT, - OPT_ENGINE, OPT_CHECK + OPT_ENGINE, OPT_CHECK, + OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS pkeyparam_options[] = { @@ -37,6 +38,8 @@ const OPTIONS pkeyparam_options[] = { {"out", OPT_OUT, '>', "Output file"}, {"text", OPT_TEXT, '-', "Print parameters as text"}, {"noout", OPT_NOOUT, '-', "Don't output encoded parameters"}, + + OPT_PROV_OPTIONS, {NULL} }; @@ -81,6 +84,10 @@ int pkeyparam_main(int argc, char **argv) case OPT_CHECK: check = 1; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } argc = opt_num_rest(); diff --git a/apps/pkeyutl.c b/apps/pkeyutl.c index 5bc43657..7f11b168 100644 --- a/apps/pkeyutl.c +++ b/apps/pkeyutl.c @@ -44,7 +44,7 @@ typedef enum OPTION_choice { OPT_VERIFY, OPT_VERIFYRECOVER, OPT_REV, OPT_ENCRYPT, OPT_DECRYPT, OPT_DERIVE, OPT_SIGFILE, OPT_INKEY, OPT_PEERKEY, OPT_PASSIN, OPT_PEERFORM, OPT_KEYFORM, OPT_PKEYOPT, OPT_PKEYOPT_PASSIN, OPT_KDF, - OPT_KDFLEN, OPT_R_ENUM, + OPT_KDFLEN, OPT_R_ENUM, OPT_PROV_ENUM, OPT_RAWIN, OPT_DIGEST } OPTION_CHOICE; @@ -92,6 +92,7 @@ const OPTIONS pkeyutl_options[] = { {"kdflen", OPT_KDFLEN, 'p', "KDF algorithm output length"}, OPT_R_OPTIONS, + OPT_PROV_OPTIONS, {NULL} }; @@ -165,6 +166,10 @@ int pkeyutl_main(int argc, char **argv) if (!opt_rand(o)) goto end; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; case OPT_ENGINE: e = setup_engine(opt_arg(), 0); break; diff --git a/apps/prime.c b/apps/prime.c index 5345e5b6..ff25f908 100644 --- a/apps/prime.c +++ b/apps/prime.c @@ -15,7 +15,8 @@ typedef enum OPTION_choice { OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, - OPT_HEX, OPT_GENERATE, OPT_BITS, OPT_SAFE, OPT_CHECKS + OPT_HEX, OPT_GENERATE, OPT_BITS, OPT_SAFE, OPT_CHECKS, + OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS prime_options[] = { @@ -32,6 +33,8 @@ const OPTIONS prime_options[] = { {"safe", OPT_SAFE, '-', "When used with -generate, generate a safe prime"}, + OPT_PROV_OPTIONS, + OPT_PARAMETERS(), {"number", 0, 0, "Number(s) to check for primality if not generating"}, {NULL} @@ -72,6 +75,10 @@ opthelp: /* ignore parameter and argument */ opt_arg(); break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } argc = opt_num_rest(); diff --git a/apps/progs.pl b/apps/progs.pl index e06ef999..03553efb 100644 --- a/apps/progs.pl +++ b/apps/progs.pl @@ -93,10 +93,11 @@ EOF my %cmd_disabler = ( ciphers => "sock", pkcs12 => "des", - genrsa => "rsa", - rsautl => "rsa", ); my %cmd_deprecated = ( + rsa => [ "3_0", "pkey", "rsa" ], + genrsa => [ "3_0", "genpkey", "rsa" ], + rsautl => [ "3_0", "pkeyutl", "rsa" ], dhparam => [ "3_0", "pkeyparam", "dh" ], dsaparam => [ "3_0", "pkeyparam", "dsa" ], dsa => [ "3_0", "pkey", "dsa" ], diff --git a/apps/rand.c b/apps/rand.c index 421ebfc2..7dc14cb3 100644 --- a/apps/rand.c +++ b/apps/rand.c @@ -21,7 +21,7 @@ typedef enum OPTION_choice { OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, OPT_OUT, OPT_ENGINE, OPT_BASE64, OPT_HEX, - OPT_R_ENUM + OPT_R_ENUM, OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS rand_options[] = { @@ -39,6 +39,7 @@ const OPTIONS rand_options[] = { {"hex", OPT_HEX, '-', "Hex encode output"}, OPT_R_OPTIONS, + OPT_PROV_OPTIONS, OPT_PARAMETERS(), {"num", 0, 0, "Number of bytes to generate"}, @@ -81,6 +82,10 @@ int rand_main(int argc, char **argv) case OPT_HEX: format = FORMAT_TEXT; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } argc = opt_num_rest(); diff --git a/apps/rehash.c b/apps/rehash.c index b7e6e7ec..de540642 100644 --- a/apps/rehash.c +++ b/apps/rehash.c @@ -447,7 +447,8 @@ static int do_dir(const char *dirname, enum Hash h) typedef enum OPTION_choice { OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, - OPT_COMPAT, OPT_OLD, OPT_N, OPT_VERBOSE + OPT_COMPAT, OPT_OLD, OPT_N, OPT_VERBOSE, + OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS rehash_options[] = { @@ -463,6 +464,8 @@ const OPTIONS rehash_options[] = { OPT_SECTION("Output"), {"v", OPT_VERBOSE, '-', "Verbose output"}, + OPT_PROV_OPTIONS, + OPT_PARAMETERS(), {"directory", 0, 0, "One or more directories to process (optional)"}, {NULL} @@ -499,6 +502,10 @@ int rehash_main(int argc, char **argv) case OPT_VERBOSE: verbose = 1; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } argc = opt_num_rest(); diff --git a/apps/req.c b/apps/req.c index 7140705f..51860172 100644 --- a/apps/req.c +++ b/apps/req.c @@ -32,7 +32,6 @@ # include #endif -#define SECTION "req" #define BITS "default_bits" #define KEYFILE "default_keyfile" @@ -77,6 +76,8 @@ static int join(char buf[], size_t buf_size, const char *name, static EVP_PKEY_CTX *set_keygen_ctx(const char *gstr, int *pkey_type, long *pkeylen, char **palgnam, ENGINE *keygen_engine); + +static const char *section = "req"; static CONF *req_conf = NULL; static CONF *addext_conf = NULL; static int batch = 0; @@ -91,7 +92,8 @@ typedef enum OPTION_choice { OPT_NAMEOPT, OPT_REQOPT, OPT_SUBJ, OPT_SUBJECT, OPT_TEXT, OPT_X509, OPT_MULTIVALUE_RDN, OPT_DAYS, OPT_SET_SERIAL, OPT_ADDEXT, OPT_EXTENSIONS, OPT_REQEXTS, OPT_PRECERT, OPT_MD, OPT_SM2ID, OPT_SM2HEXID, - OPT_R_ENUM + OPT_SECTION, + OPT_R_ENUM, OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS req_options[] = { @@ -109,6 +111,7 @@ const OPTIONS req_options[] = { OPT_SECTION("Certificate"), {"new", OPT_NEW, '-', "New request"}, {"config", OPT_CONFIG, '<', "Request template file"}, + {"section", OPT_SECTION, 's', "Config section to use (default \"req\")"}, {"utf8", OPT_UTF8, '-', "Input characters are UTF8 (default ASCII)"}, {"nameopt", OPT_NAMEOPT, 's', "Various certificate name options"}, {"reqopt", OPT_REQOPT, 's', "Various request text options"}, @@ -160,6 +163,7 @@ const OPTIONS req_options[] = { {"modulus", OPT_MODULUS, '-', "RSA modulus"}, OPT_R_OPTIONS, + OPT_PROV_OPTIONS, {NULL} }; @@ -308,6 +312,9 @@ int req_main(int argc, char **argv) case OPT_CONFIG: template = opt_arg(); break; + case OPT_SECTION: + section = opt_arg(); + break; case OPT_KEYFORM: if (!opt_format(opt_arg(), OPT_FMT_ANY, &keyform)) goto opthelp; @@ -331,6 +338,10 @@ int req_main(int argc, char **argv) if (!opt_rand(o)) goto end; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; case OPT_NEWKEY: keyalg = opt_arg(); newreq = 1; @@ -514,7 +525,7 @@ int req_main(int argc, char **argv) goto end; if (md_alg == NULL) { - p = NCONF_get_string(req_conf, SECTION, "default_md"); + p = NCONF_get_string(req_conf, section, "default_md"); if (p == NULL) { ERR_clear_error(); } else { @@ -525,7 +536,7 @@ int req_main(int argc, char **argv) } if (extensions == NULL) { - extensions = NCONF_get_string(req_conf, SECTION, V3_EXTENSIONS); + extensions = NCONF_get_string(req_conf, section, V3_EXTENSIONS); if (extensions == NULL) ERR_clear_error(); } @@ -553,19 +564,19 @@ int req_main(int argc, char **argv) if (passin == NULL) { passin = nofree_passin = - NCONF_get_string(req_conf, SECTION, "input_password"); + NCONF_get_string(req_conf, section, "input_password"); if (passin == NULL) ERR_clear_error(); } if (passout == NULL) { passout = nofree_passout = - NCONF_get_string(req_conf, SECTION, "output_password"); + NCONF_get_string(req_conf, section, "output_password"); if (passout == NULL) ERR_clear_error(); } - p = NCONF_get_string(req_conf, SECTION, STRING_MASK); + p = NCONF_get_string(req_conf, section, STRING_MASK); if (p == NULL) ERR_clear_error(); @@ -575,7 +586,7 @@ int req_main(int argc, char **argv) } if (chtype != MBSTRING_UTF8) { - p = NCONF_get_string(req_conf, SECTION, UTF8_IN); + p = NCONF_get_string(req_conf, section, UTF8_IN); if (p == NULL) ERR_clear_error(); else if (strcmp(p, "yes") == 0) @@ -583,7 +594,7 @@ int req_main(int argc, char **argv) } if (req_exts == NULL) { - req_exts = NCONF_get_string(req_conf, SECTION, REQ_EXTENSIONS); + req_exts = NCONF_get_string(req_conf, section, REQ_EXTENSIONS); if (req_exts == NULL) ERR_clear_error(); } @@ -606,14 +617,14 @@ int req_main(int argc, char **argv) /* load_key() has already printed an appropriate message */ goto end; } else { - app_RAND_load_conf(req_conf, SECTION); + app_RAND_load_conf(req_conf, section); } } if (newreq && (pkey == NULL)) { - app_RAND_load_conf(req_conf, SECTION); + app_RAND_load_conf(req_conf, section); - if (!NCONF_get_number(req_conf, SECTION, BITS, &newkey)) { + if (!NCONF_get_number(req_conf, section, BITS, &newkey)) { newkey = DEFAULT_KEY_LENGTH; } @@ -683,7 +694,7 @@ int req_main(int argc, char **argv) genctx = NULL; if (keyout == NULL) { - keyout = NCONF_get_string(req_conf, SECTION, KEYFILE); + keyout = NCONF_get_string(req_conf, section, KEYFILE); if (keyout == NULL) ERR_clear_error(); } @@ -696,10 +707,10 @@ int req_main(int argc, char **argv) if (out == NULL) goto end; - p = NCONF_get_string(req_conf, SECTION, "encrypt_rsa_key"); + p = NCONF_get_string(req_conf, section, "encrypt_rsa_key"); if (p == NULL) { ERR_clear_error(); - p = NCONF_get_string(req_conf, SECTION, "encrypt_key"); + p = NCONF_get_string(req_conf, section, "encrypt_key"); if (p == NULL) ERR_clear_error(); } @@ -1057,13 +1068,13 @@ static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, char *subj, int multirdn, STACK_OF(CONF_VALUE) *dn_sk, *attr_sk = NULL; char *tmp, *dn_sect, *attr_sect; - tmp = NCONF_get_string(req_conf, SECTION, PROMPT); + tmp = NCONF_get_string(req_conf, section, PROMPT); if (tmp == NULL) ERR_clear_error(); if ((tmp != NULL) && strcmp(tmp, "no") == 0) no_prompt = 1; - dn_sect = NCONF_get_string(req_conf, SECTION, DISTINGUISHED_NAME); + dn_sect = NCONF_get_string(req_conf, section, DISTINGUISHED_NAME); if (dn_sect == NULL) { BIO_printf(bio_err, "unable to find '%s' in config\n", DISTINGUISHED_NAME); @@ -1075,7 +1086,7 @@ static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, char *subj, int multirdn, goto err; } - attr_sect = NCONF_get_string(req_conf, SECTION, ATTRIBUTES); + attr_sect = NCONF_get_string(req_conf, section, ATTRIBUTES); if (attr_sect == NULL) { ERR_clear_error(); attr_sk = NULL; diff --git a/apps/rsa.c b/apps/rsa.c index 82b34e7c..539b0144 100644 --- a/apps/rsa.c +++ b/apps/rsa.c @@ -33,7 +33,8 @@ typedef enum OPTION_choice { OPT_RSAPUBKEY_IN, OPT_RSAPUBKEY_OUT, /* Do not change the order here; see case statements below */ OPT_PVK_NONE, OPT_PVK_WEAK, OPT_PVK_STRONG, - OPT_NOOUT, OPT_TEXT, OPT_MODULUS, OPT_CHECK, OPT_CIPHER + OPT_NOOUT, OPT_TEXT, OPT_MODULUS, OPT_CHECK, OPT_CIPHER, + OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS rsa_options[] = { @@ -68,6 +69,8 @@ const OPTIONS rsa_options[] = { {"pvk-weak", OPT_PVK_WEAK, '-', "Enable 'Weak' PVK encoding level"}, {"pvk-none", OPT_PVK_NONE, '-', "Don't enforce PVK encoding"}, # endif + + OPT_PROV_OPTIONS, {NULL} }; @@ -157,6 +160,10 @@ int rsa_main(int argc, char **argv) if (!opt_cipher(opt_unknown(), &enc)) goto opthelp; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } argc = opt_num_rest(); diff --git a/apps/rsautl.c b/apps/rsautl.c index 99f1c440..ddd507ce 100644 --- a/apps/rsautl.c +++ b/apps/rsautl.c @@ -34,7 +34,7 @@ typedef enum OPTION_choice { OPT_RSA_RAW, OPT_OAEP, OPT_SSL, OPT_PKCS, OPT_X931, OPT_SIGN, OPT_VERIFY, OPT_REV, OPT_ENCRYPT, OPT_DECRYPT, OPT_PUBIN, OPT_CERTIN, OPT_INKEY, OPT_PASSIN, OPT_KEYFORM, - OPT_R_ENUM + OPT_R_ENUM, OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS rsautl_options[] = { @@ -69,6 +69,7 @@ const OPTIONS rsautl_options[] = { {"hexdump", OPT_HEXDUMP, '-', "Hex dump output"}, OPT_R_OPTIONS, + OPT_PROV_OPTIONS, {NULL} }; @@ -166,6 +167,10 @@ int rsautl_main(int argc, char **argv) if (!opt_rand(o)) goto end; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } argc = opt_num_rest(); diff --git a/apps/s_client.c b/apps/s_client.c index cb2af7ed..c06f2c82 100644 --- a/apps/s_client.c +++ b/apps/s_client.c @@ -600,7 +600,7 @@ typedef enum OPTION_choice { OPT_DANE_TLSA_RRDATA, OPT_DANE_EE_NO_NAME, OPT_ENABLE_PHA, OPT_SCTP_LABEL_BUG, - OPT_R_ENUM + OPT_R_ENUM, OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS s_client_options[] = { @@ -659,12 +659,12 @@ const OPTIONS s_client_options[] = { {"pass", OPT_PASS, 's', "Private key file pass phrase source"}, {"CApath", OPT_CAPATH, '/', "PEM format directory of CA's"}, {"CAfile", OPT_CAFILE, '<', "PEM format file of CA's"}, - {"CAstore", OPT_CAFILE, ':', "URI to store of CA's"}, + {"CAstore", OPT_CASTORE, ':', "URI to store of CA's"}, {"no-CAfile", OPT_NOCAFILE, '-', "Do not load the default certificates file"}, {"no-CApath", OPT_NOCAPATH, '-', "Do not load certificates from the default certificates directory"}, - {"no-CAstore", OPT_NOCAPATH, '-', + {"no-CAstore", OPT_NOCASTORE, '-', "Do not load certificates from the default certificates store"}, {"requestCAfile", OPT_REQCAFILE, '<', "PEM format file of CA names to send to the server"}, @@ -817,6 +817,7 @@ const OPTIONS s_client_options[] = { {"chainCAfile", OPT_CHAINCAFILE, '<', "CA file for certificate chain (PEM format)"}, OPT_X_OPTIONS, + OPT_PROV_OPTIONS, OPT_PARAMETERS(), {"host:port", 0, 0, "Where to connect; same as -connect option"}, @@ -1225,6 +1226,10 @@ int s_client_main(int argc, char **argv) if (!opt_rand(o)) goto end; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; case OPT_IGN_EOF: c_ign_eof = 1; break; diff --git a/apps/s_server.c b/apps/s_server.c index 69d9e048..4016270d 100644 --- a/apps/s_server.c +++ b/apps/s_server.c @@ -757,7 +757,8 @@ typedef enum OPTION_choice { OPT_R_ENUM, OPT_S_ENUM, OPT_V_ENUM, - OPT_X_ENUM + OPT_X_ENUM, + OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS s_server_options[] = { @@ -992,6 +993,7 @@ const OPTIONS s_server_options[] = { {"chainCAfile", OPT_CHAINCAFILE, '<', "CA file for certificate chain (PEM format)"}, OPT_X_OPTIONS, + OPT_PROV_OPTIONS, {NULL} }; @@ -1566,6 +1568,10 @@ int s_server_main(int argc, char *argv[]) if (!opt_rand(o)) goto end; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; case OPT_SERVERNAME: tlsextcbp.servername = opt_arg(); break; diff --git a/apps/s_time.c b/apps/s_time.c index babbdbe1..28e82f7c 100644 --- a/apps/s_time.c +++ b/apps/s_time.c @@ -48,7 +48,8 @@ typedef enum OPTION_choice { OPT_CAPATH, OPT_CAFILE, OPT_CASTORE, OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE, OPT_NEW, OPT_REUSE, OPT_BUGS, OPT_VERIFY, OPT_TIME, OPT_SSL3, - OPT_WWW, OPT_TLS1, OPT_TLS1_1, OPT_TLS1_2, OPT_TLS1_3 + OPT_WWW, OPT_TLS1, OPT_TLS1_1, OPT_TLS1_2, OPT_TLS1_3, + OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS s_time_options[] = { @@ -99,6 +100,7 @@ const OPTIONS s_time_options[] = { {"no-CAstore", OPT_NOCASTORE, '-', "Do not load certificates from the default certificates store URI"}, + OPT_PROV_OPTIONS, {NULL} }; @@ -226,6 +228,10 @@ int s_time_main(int argc, char **argv) min_version = TLS1_3_VERSION; max_version = TLS1_3_VERSION; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } argc = opt_num_rest(); diff --git a/apps/smime.c b/apps/smime.c index 149d3151..c7f74d48 100644 --- a/apps/smime.c +++ b/apps/smime.c @@ -42,7 +42,7 @@ typedef enum OPTION_choice { OPT_TO, OPT_FROM, OPT_SUBJECT, OPT_SIGNER, OPT_RECIP, OPT_MD, OPT_CIPHER, OPT_INKEY, OPT_KEYFORM, OPT_CERTFILE, OPT_CAFILE, OPT_CAPATH, OPT_CASTORE, OPT_NOCAFILE, OPT_NOCAPATH, OPT_NOCASTORE, - OPT_R_ENUM, + OPT_R_ENUM, OPT_PROV_ENUM, OPT_V_ENUM, OPT_IN, OPT_INFORM, OPT_OUT, OPT_OUTFORM, OPT_CONTENT @@ -121,6 +121,7 @@ const OPTIONS smime_options[] = { OPT_R_OPTIONS, OPT_V_OPTIONS, + OPT_PROV_OPTIONS, OPT_PARAMETERS(), {"cert", 0, 0, "Recipient certs, used when encrypting"}, @@ -244,6 +245,10 @@ int smime_main(int argc, char **argv) if (!opt_rand(o)) goto end; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; case OPT_ENGINE: e = setup_engine(opt_arg(), 0); break; diff --git a/apps/speed.c b/apps/speed.c index 0e94e7ca..c735ad20 100644 --- a/apps/speed.c +++ b/apps/speed.c @@ -253,7 +253,7 @@ static int opt_found(const char *name, unsigned int *result, typedef enum OPTION_choice { OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, OPT_ELAPSED, OPT_EVP, OPT_HMAC, OPT_DECRYPT, OPT_ENGINE, OPT_MULTI, - OPT_MR, OPT_MB, OPT_MISALIGN, OPT_ASYNCJOBS, OPT_R_ENUM, + OPT_MR, OPT_MB, OPT_MISALIGN, OPT_ASYNCJOBS, OPT_R_ENUM, OPT_PROV_ENUM, OPT_PRIMES, OPT_SECONDS, OPT_BYTES, OPT_AEAD, OPT_CMAC } OPTION_CHOICE; @@ -301,6 +301,7 @@ const OPTIONS speed_options[] = { "Use specified offset to mis-align buffers"}, OPT_R_OPTIONS, + OPT_PROV_OPTIONS, OPT_PARAMETERS(), {"algorithm", 0, 0, "Algorithm(s) to test (optional; otherwise tests all)"}, @@ -1706,6 +1707,10 @@ int speed_main(int argc, char **argv) if (!opt_rand(o)) goto end; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; case OPT_PRIMES: if (!opt_int(opt_arg(), &primes)) goto end; diff --git a/apps/spkac.c b/apps/spkac.c index 75e246a1..dbd3d452 100644 --- a/apps/spkac.c +++ b/apps/spkac.c @@ -24,7 +24,8 @@ typedef enum OPTION_choice { OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, OPT_NOOUT, OPT_PUBKEY, OPT_VERIFY, OPT_IN, OPT_OUT, OPT_ENGINE, OPT_KEY, OPT_CHALLENGE, OPT_PASSIN, OPT_SPKAC, - OPT_SPKSECT, OPT_KEYFORM + OPT_SPKSECT, OPT_KEYFORM, + OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS spkac_options[] = { @@ -49,6 +50,8 @@ const OPTIONS spkac_options[] = { {"noout", OPT_NOOUT, '-', "Don't print SPKAC"}, {"pubkey", OPT_PUBKEY, '-', "Output public key"}, {"verify", OPT_VERIFY, '-', "Verify SPKAC signature"}, + + OPT_PROV_OPTIONS, {NULL} }; @@ -116,6 +119,10 @@ int spkac_main(int argc, char **argv) case OPT_ENGINE: e = setup_engine(opt_arg(), 0); break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } argc = opt_num_rest(); diff --git a/apps/srp.c b/apps/srp.c index e7a18d68..646e86f1 100644 --- a/apps/srp.c +++ b/apps/srp.c @@ -193,7 +193,7 @@ typedef enum OPTION_choice { OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, OPT_VERBOSE, OPT_CONFIG, OPT_NAME, OPT_SRPVFILE, OPT_ADD, OPT_DELETE, OPT_MODIFY, OPT_LIST, OPT_GN, OPT_USERINFO, - OPT_PASSIN, OPT_PASSOUT, OPT_ENGINE, OPT_R_ENUM + OPT_PASSIN, OPT_PASSOUT, OPT_ENGINE, OPT_R_ENUM, OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS srp_options[] = { @@ -222,6 +222,7 @@ const OPTIONS srp_options[] = { {"passout", OPT_PASSOUT, 's', "Output file pass phrase source"}, OPT_R_OPTIONS, + OPT_PROV_OPTIONS, OPT_PARAMETERS(), {"user", 0, 0, "Username(s) to process (optional)"}, @@ -297,6 +298,10 @@ int srp_main(int argc, char **argv) if (!opt_rand(o)) goto end; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } argc = opt_num_rest(); diff --git a/apps/storeutl.c b/apps/storeutl.c index 85fb1ed8..c03eb08f 100644 --- a/apps/storeutl.c +++ b/apps/storeutl.c @@ -27,7 +27,7 @@ typedef enum OPTION_choice { OPT_SEARCHFOR_CERTS, OPT_SEARCHFOR_KEYS, OPT_SEARCHFOR_CRLS, OPT_CRITERION_SUBJECT, OPT_CRITERION_ISSUER, OPT_CRITERION_SERIAL, OPT_CRITERION_FINGERPRINT, OPT_CRITERION_ALIAS, - OPT_MD + OPT_MD, OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS storeutl_options[] = { @@ -59,6 +59,8 @@ const OPTIONS storeutl_options[] = { {"text", OPT_TEXT, '-', "Print a text form of the objects"}, {"noout", OPT_NOOUT, '-', "No PEM output, just status"}, + OPT_PROV_OPTIONS, + OPT_PARAMETERS(), {"uri", 0, 0, "URI of the store object"}, {NULL} @@ -250,6 +252,10 @@ int storeutl_main(int argc, char *argv[]) case OPT_MD: if (!opt_md(opt_unknown(), &digest)) goto opthelp; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } argc = opt_num_rest(); diff --git a/apps/ts.c b/apps/ts.c index c651c8e5..3d380beb 100644 --- a/apps/ts.c +++ b/apps/ts.c @@ -86,7 +86,7 @@ typedef enum OPTION_choice { OPT_IN, OPT_TOKEN_IN, OPT_OUT, OPT_TOKEN_OUT, OPT_TEXT, OPT_REPLY, OPT_QUERYFILE, OPT_PASSIN, OPT_INKEY, OPT_SIGNER, OPT_CHAIN, OPT_VERIFY, OPT_CAPATH, OPT_CAFILE, OPT_CASTORE, OPT_UNTRUSTED, - OPT_MD, OPT_V_ENUM, OPT_R_ENUM + OPT_MD, OPT_V_ENUM, OPT_R_ENUM, OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS ts_options[] = { @@ -127,6 +127,7 @@ const OPTIONS ts_options[] = { OPT_R_OPTIONS, OPT_V_OPTIONS, + OPT_PROV_OPTIONS, {NULL} }; @@ -219,6 +220,10 @@ int ts_main(int argc, char **argv) if (!opt_rand(o)) goto end; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; case OPT_TSPOLICY: policy = opt_arg(); break; diff --git a/apps/verify.c b/apps/verify.c index 5c504211..82ca35e9 100644 --- a/apps/verify.c +++ b/apps/verify.c @@ -31,7 +31,8 @@ typedef enum OPTION_choice { OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE, OPT_UNTRUSTED, OPT_TRUSTED, OPT_CRLFILE, OPT_CRL_DOWNLOAD, OPT_SHOW_CHAIN, OPT_V_ENUM, OPT_NAMEOPT, - OPT_VERBOSE, OPT_SM2ID, OPT_SM2HEXID + OPT_VERBOSE, OPT_SM2ID, OPT_SM2HEXID, + OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS verify_options[] = { @@ -73,6 +74,8 @@ const OPTIONS verify_options[] = { "Specify a hex ID string to verify an SM2 certificate"}, #endif + OPT_PROV_OPTIONS, + OPT_PARAMETERS(), {"cert", 0, 0, "Certificate(s) to verify (optional; stdin used otherwise)"}, {NULL} @@ -209,6 +212,10 @@ int verify_main(int argc, char **argv) goto end; } break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; } } argc = opt_num_rest(); diff --git a/apps/x509.c b/apps/x509.c index a8ec1181..3176cf52 100644 --- a/apps/x509.c +++ b/apps/x509.c @@ -61,7 +61,7 @@ typedef enum OPTION_choice { OPT_SUBJECT_HASH_OLD, OPT_ISSUER_HASH_OLD, OPT_BADSIG, OPT_MD, OPT_ENGINE, OPT_NOCERT, OPT_PRESERVE_DATES, - OPT_R_ENUM, OPT_EXT + OPT_R_ENUM, OPT_PROV_ENUM, OPT_EXT } OPTION_CHOICE; const OPTIONS x509_options[] = { @@ -144,6 +144,7 @@ const OPTIONS x509_options[] = { "The CA key, must be PEM format; if not in CAfile"}, {"extfile", OPT_EXTFILE, '<', "File with X509V3 extensions to add"}, OPT_R_OPTIONS, + OPT_PROV_OPTIONS, {"CAform", OPT_CAFORM, 'F', "CA format - default PEM"}, {"CAkeyform", OPT_CAKEYFORM, 'E', "CA key format - default PEM"}, {"sigopt", OPT_SIGOPT, 's', "Signature parameter in n:v form"}, @@ -270,6 +271,10 @@ int x509_main(int argc, char **argv) if (!opt_rand(o)) goto end; break; + case OPT_PROV_CASES: + if (!opt_provider(o)) + goto end; + break; case OPT_EXTENSIONS: extsect = opt_arg(); break; diff --git a/config b/config index e39481ca..7dfea228 100755 --- a/config +++ b/config @@ -847,14 +847,6 @@ case "$GUESSOS" in i386-*) options="$options 386" ;; esac -for i in aes aria bf camellia cast des dh dsa ec hmac idea md2 md5 mdc2 rc2 rc4 rc5 ripemd rsa seed sha sm2 sm3 sm4 -do - if [ ! -d $THERE/crypto/$i ] - then - options="$options no-$i" - fi -done - if [ -z "$OUT" ]; then OUT="$CC" fi diff --git a/crypto/aes/asm/aes-s390x.pl b/crypto/aes/asm/aes-s390x.pl index a0c817a1..175bd153 100644 --- a/crypto/aes/asm/aes-s390x.pl +++ b/crypto/aes/asm/aes-s390x.pl @@ -1989,7 +1989,7 @@ $code.=<<___; .Lxts_enc_done: stg $sp,$tweak+0($sp) # wipe tweak - stg $sp,$twesk+8($sp) + stg $sp,$tweak+8($sp) lm${g} %r6,$ra,6*$SIZE_T($sp) br $ra .size AES_xts_encrypt,.-AES_xts_encrypt @@ -2269,7 +2269,7 @@ $code.=<<___; stg $sp,$tweak-16+8($sp) .Lxts_dec_done: stg $sp,$tweak+0($sp) # wipe tweak - stg $sp,$twesk+8($sp) + stg $sp,$tweak+8($sp) lm${g} %r6,$ra,6*$SIZE_T($sp) br $ra .size AES_xts_decrypt,.-AES_xts_decrypt diff --git a/crypto/cms/cms_env.c b/crypto/cms/cms_env.c index ac34f3ef..003a406c 100644 --- a/crypto/cms/cms_env.c +++ b/crypto/cms/cms_env.c @@ -20,6 +20,8 @@ /* CMS EnvelopedData Utilities */ +static void cms_env_set_version(CMS_EnvelopedData *env); + CMS_EnvelopedData *cms_get0_enveloped(CMS_ContentInfo *cms) { if (OBJ_obj2nid(cms->contentType) != NID_pkcs7_enveloped) { @@ -122,6 +124,47 @@ CMS_ContentInfo *CMS_EnvelopedData_create(const EVP_CIPHER *cipher) return NULL; } +int cms_EnvelopedData_final(CMS_ContentInfo *cms, BIO *chain) +{ + CMS_EnvelopedData *env = NULL; + EVP_CIPHER_CTX *ctx = NULL; + BIO *mbio = BIO_find_type(chain, BIO_TYPE_CIPHER); + + env = cms_get0_enveloped(cms); + if (env == NULL) + return 0; + + if (mbio == NULL) { + CMSerr(CMS_F_CMS_ENVELOPEDDATA_FINAL, CMS_R_CONTENT_NOT_FOUND); + return 0; + } + + BIO_get_cipher_ctx(mbio, &ctx); + + /* + * If the selected cipher supports unprotected attributes, + * deal with it using special ctrl function + */ + if (EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(ctx)) & EVP_CIPH_FLAG_CIPHER_WITH_MAC) { + if (cms->d.envelopedData->unprotectedAttrs == NULL) + cms->d.envelopedData->unprotectedAttrs = sk_X509_ATTRIBUTE_new_null(); + + if (cms->d.envelopedData->unprotectedAttrs == NULL) { + CMSerr(CMS_F_CMS_ENVELOPEDDATA_FINAL, ERR_R_MALLOC_FAILURE); + return 0; + } + + if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_PROCESS_UNPROTECTED, + 1, env->unprotectedAttrs) <= 0) { + CMSerr(CMS_F_CMS_ENVELOPEDDATA_FINAL, CMS_R_CTRL_FAILURE); + return 0; + } + } + + cms_env_set_version(cms->d.envelopedData); + return 1; +} + /* Key Transport Recipient Info (KTRI) routines */ /* Initialise a ktri based on passed certificate and key */ @@ -176,8 +219,9 @@ static int cms_RecipientInfo_ktri_init(CMS_RecipientInfo *ri, X509 *recip, * Add a recipient certificate using appropriate type of RecipientInfo */ -CMS_RecipientInfo *CMS_add1_recipient_cert(CMS_ContentInfo *cms, - X509 *recip, unsigned int flags) +CMS_RecipientInfo *CMS_add1_recipient(CMS_ContentInfo *cms, X509 *recip, + EVP_PKEY *originatorPrivKey, + X509 *originator, unsigned int flags) { CMS_RecipientInfo *ri = NULL; CMS_EnvelopedData *env; @@ -193,7 +237,7 @@ CMS_RecipientInfo *CMS_add1_recipient_cert(CMS_ContentInfo *cms, pk = X509_get0_pubkey(recip); if (pk == NULL) { - CMSerr(CMS_F_CMS_ADD1_RECIPIENT_CERT, CMS_R_ERROR_GETTING_PUBLIC_KEY); + CMSerr(CMS_F_CMS_ADD1_RECIPIENT, CMS_R_ERROR_GETTING_PUBLIC_KEY); goto err; } @@ -205,12 +249,12 @@ CMS_RecipientInfo *CMS_add1_recipient_cert(CMS_ContentInfo *cms, break; case CMS_RECIPINFO_AGREE: - if (!cms_RecipientInfo_kari_init(ri, recip, pk, flags)) + if (!cms_RecipientInfo_kari_init(ri, recip, pk, originator, originatorPrivKey, flags)) goto err; break; default: - CMSerr(CMS_F_CMS_ADD1_RECIPIENT_CERT, + CMSerr(CMS_F_CMS_ADD1_RECIPIENT, CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE); goto err; @@ -222,13 +266,19 @@ CMS_RecipientInfo *CMS_add1_recipient_cert(CMS_ContentInfo *cms, return ri; merr: - CMSerr(CMS_F_CMS_ADD1_RECIPIENT_CERT, ERR_R_MALLOC_FAILURE); + CMSerr(CMS_F_CMS_ADD1_RECIPIENT, ERR_R_MALLOC_FAILURE); err: M_ASN1_free_of(ri, CMS_RecipientInfo); return NULL; } +CMS_RecipientInfo *CMS_add1_recipient_cert(CMS_ContentInfo *cms, + X509 *recip, unsigned int flags) +{ + return CMS_add1_recipient(cms, recip, NULL, NULL, flags); +} + int CMS_RecipientInfo_ktri_get0_algs(CMS_RecipientInfo *ri, EVP_PKEY **pk, X509 **recip, X509_ALGOR **palg) @@ -894,7 +944,34 @@ static void cms_env_set_version(CMS_EnvelopedData *env) env->version = 0; } -BIO *cms_EnvelopedData_init_bio(const CMS_ContentInfo *cms) +static BIO *cms_EnvelopedData_Decryption_init_bio(CMS_ContentInfo *cms) +{ + CMS_EncryptedContentInfo *ec = cms->d.envelopedData->encryptedContentInfo; + BIO *contentBio = cms_EncryptedContent_init_bio(ec); + EVP_CIPHER_CTX *ctx = NULL; + + if (contentBio == NULL) + return NULL; + + BIO_get_cipher_ctx(contentBio, &ctx); + if (ctx == NULL) { + BIO_free(contentBio); + return NULL; + } +/* + * If the selected cipher supports unprotected attributes, + * deal with it using special ctrl function + */ + if ((EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(ctx)) & EVP_CIPH_FLAG_CIPHER_WITH_MAC) + && EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_PROCESS_UNPROTECTED, 0, + cms->d.envelopedData->unprotectedAttrs) <= 0) { + BIO_free(contentBio); + return NULL; + } + return contentBio; +} + +static BIO *cms_EnvelopedData_Encryption_init_bio(CMS_ContentInfo *cms) { CMS_EncryptedContentInfo *ec; STACK_OF(CMS_RecipientInfo) *rinfos; @@ -907,22 +984,19 @@ BIO *cms_EnvelopedData_init_bio(const CMS_ContentInfo *cms) ec = cms->d.envelopedData->encryptedContentInfo; ret = cms_EncryptedContent_init_bio(ec); - /* If error or no cipher end of processing */ - - if (!ret || !ec->cipher) + /* If error end of processing */ + if (!ret) return ret; /* Now encrypt content key according to each RecipientInfo type */ - rinfos = cms->d.envelopedData->recipientInfos; for (i = 0; i < sk_CMS_RecipientInfo_num(rinfos); i++) { - ri = sk_CMS_RecipientInfo_value(rinfos, i); - if (CMS_RecipientInfo_encrypt(cms, ri) <= 0) { - CMSerr(CMS_F_CMS_ENVELOPEDDATA_INIT_BIO, - CMS_R_ERROR_SETTING_RECIPIENTINFO); - goto err; - } + ri = sk_CMS_RecipientInfo_value(rinfos, i); + if (CMS_RecipientInfo_encrypt(cms, ri) <= 0) { + CMSerr(0, CMS_R_ERROR_SETTING_RECIPIENTINFO); + goto err; + } } cms_env_set_version(cms->d.envelopedData); @@ -937,7 +1011,17 @@ BIO *cms_EnvelopedData_init_bio(const CMS_ContentInfo *cms) return ret; BIO_free(ret); return NULL; +} +BIO *cms_EnvelopedData_init_bio(CMS_ContentInfo *cms) +{ + if (cms->d.envelopedData->encryptedContentInfo->cipher != NULL) { + /* If cipher is set it's encryption */ + return cms_EnvelopedData_Encryption_init_bio(cms); + } + + /* If cipher is not set it's decryption */ + return cms_EnvelopedData_Decryption_init_bio(cms); } /* @@ -955,3 +1039,22 @@ int cms_pkey_get_ri_type(EVP_PKEY *pk) } return CMS_RECIPINFO_TRANS; } + +int cms_pkey_is_ri_type_supported(EVP_PKEY *pk, int ri_type) +{ + int supportedRiType; + + if (pk->ameth != NULL && pk->ameth->pkey_ctrl != NULL) { + int i, r; + + i = pk->ameth->pkey_ctrl(pk, ASN1_PKEY_CTRL_CMS_IS_RI_TYPE_SUPPORTED, ri_type, &r); + if (i > 0) + return r; + } + + supportedRiType = cms_pkey_get_ri_type(pk); + if (supportedRiType < 0) + return 0; + + return (supportedRiType == ri_type); +} diff --git a/crypto/cms/cms_kari.c b/crypto/cms/cms_kari.c index 6b0a59eb..3299e9b5 100644 --- a/crypto/cms/cms_kari.c +++ b/crypto/cms/cms_kari.c @@ -152,7 +152,7 @@ int CMS_RecipientEncryptedKey_cert_cmp(CMS_RecipientEncryptedKey *rek, return -1; } -int CMS_RecipientInfo_kari_set0_pkey(CMS_RecipientInfo *ri, EVP_PKEY *pk) +int CMS_RecipientInfo_kari_set0_pkey_and_peer(CMS_RecipientInfo *ri, EVP_PKEY *pk, X509 *peer) { EVP_PKEY_CTX *pctx; CMS_KeyAgreeRecipientInfo *kari = ri->d.kari; @@ -161,9 +161,18 @@ int CMS_RecipientInfo_kari_set0_pkey(CMS_RecipientInfo *ri, EVP_PKEY *pk) kari->pctx = NULL; if (pk == NULL) return 1; + pctx = EVP_PKEY_CTX_new(pk, NULL); if (pctx == NULL || EVP_PKEY_derive_init(pctx) <= 0) goto err; + + if (peer != NULL) { + EVP_PKEY *pub_pkey = X509_get0_pubkey(peer); + + if (EVP_PKEY_derive_set_peer(pctx, pub_pkey) <= 0) + goto err; + } + kari->pctx = pctx; return 1; err: @@ -171,6 +180,11 @@ int CMS_RecipientInfo_kari_set0_pkey(CMS_RecipientInfo *ri, EVP_PKEY *pk) return 0; } +int CMS_RecipientInfo_kari_set0_pkey(CMS_RecipientInfo *ri, EVP_PKEY *pk) +{ + return CMS_RecipientInfo_kari_set0_pkey_and_peer(ri, pk, NULL); +} + EVP_CIPHER_CTX *CMS_RecipientInfo_kari_get0_ctx(CMS_RecipientInfo *ri) { if (ri->type == CMS_RECIPINFO_AGREE) @@ -283,10 +297,29 @@ static int cms_kari_create_ephemeral_key(CMS_KeyAgreeRecipientInfo *kari, return rv; } +/* Set originator private key and initialise context based on it */ +static int cms_kari_set_originator_private_key(CMS_KeyAgreeRecipientInfo *kari, EVP_PKEY *originatorPrivKey ) +{ + EVP_PKEY_CTX *pctx = NULL; + int rv = 0; + + pctx = EVP_PKEY_CTX_new(originatorPrivKey, NULL); + if (pctx == NULL) + goto err; + if (EVP_PKEY_derive_init(pctx) <= 0) + goto err; + + kari->pctx = pctx; + rv = 1; + err: + if (rv == 0) + EVP_PKEY_CTX_free(pctx); + return rv; +} + /* Initialise a kari based on passed certificate and key */ -int cms_RecipientInfo_kari_init(CMS_RecipientInfo *ri, X509 *recip, - EVP_PKEY *pk, unsigned int flags) +int cms_RecipientInfo_kari_init(CMS_RecipientInfo *ri, X509 *recip, EVP_PKEY *recipPubKey, X509 * originator, EVP_PKEY *originatorPrivKey, unsigned int flags) { CMS_KeyAgreeRecipientInfo *kari; CMS_RecipientEncryptedKey *rek = NULL; @@ -321,12 +354,36 @@ int cms_RecipientInfo_kari_init(CMS_RecipientInfo *ri, X509 *recip, return 0; } - /* Create ephemeral key */ - if (!cms_kari_create_ephemeral_key(kari, pk)) - return 0; + if (originatorPrivKey == NULL && originator == NULL) { + /* Create ephemeral key */ + if (!cms_kari_create_ephemeral_key(kari, recipPubKey)) + return 0; + } else { + /* Use originator key */ + CMS_OriginatorIdentifierOrKey *oik = ri->d.kari->originator; - EVP_PKEY_up_ref(pk); - rek->pkey = pk; + if (originatorPrivKey == NULL && originator == NULL) + return 0; + + if (flags & CMS_USE_ORIGINATOR_KEYID) { + oik->type = CMS_OIK_KEYIDENTIFIER; + oik->d.subjectKeyIdentifier = ASN1_OCTET_STRING_new(); + if (oik->d.subjectKeyIdentifier == NULL) + return 0; + if (!cms_set1_keyid(&oik->d.subjectKeyIdentifier, originator)) + return 0; + } else { + oik->type = CMS_REK_ISSUER_SERIAL; + if (!cms_set1_ias(&oik->d.issuerAndSerialNumber, originator)) + return 0; + } + + if (!cms_kari_set_originator_private_key(kari, originatorPrivKey)) + return 0; + } + + EVP_PKEY_up_ref(recipPubKey); + rek->pkey = recipPubKey; return 1; } @@ -336,14 +393,30 @@ static int cms_wrap_init(CMS_KeyAgreeRecipientInfo *kari, EVP_CIPHER_CTX *ctx = kari->ctx; const EVP_CIPHER *kekcipher; int keylen = EVP_CIPHER_key_length(cipher); + int ret; + /* If a suitable wrap algorithm is already set nothing to do */ kekcipher = EVP_CIPHER_CTX_cipher(ctx); - - if (kekcipher) { + if (kekcipher != NULL) { if (EVP_CIPHER_CTX_mode(ctx) != EVP_CIPH_WRAP_MODE) return 0; return 1; } + else if (cipher != NULL + && (EVP_CIPHER_flags(cipher) & EVP_CIPH_FLAG_GET_WRAP_CIPHER)) { + ret = EVP_CIPHER_meth_get_ctrl(cipher)(NULL, EVP_CTRL_GET_WRAP_CIPHER, + 0, &kekcipher); + if (ret <= 0) + return 0; + + if (kekcipher != NULL) { + if (EVP_CIPHER_mode(kekcipher) != EVP_CIPH_WRAP_MODE) + return 0; + + return EVP_EncryptInit_ex(ctx, kekcipher, NULL, NULL, NULL); + } + } + /* * Pick a cipher based on content encryption cipher. If it is DES3 use * DES3 wrap otherwise use AES wrap similar to key size. diff --git a/crypto/cms/cms_lib.c b/crypto/cms/cms_lib.c index 245544e3..15aba4af 100644 --- a/crypto/cms/cms_lib.c +++ b/crypto/cms/cms_lib.c @@ -133,12 +133,14 @@ int CMS_dataFinal(CMS_ContentInfo *cms, BIO *cmsbio) switch (OBJ_obj2nid(cms->contentType)) { case NID_pkcs7_data: - case NID_pkcs7_enveloped: case NID_pkcs7_encrypted: case NID_id_smime_ct_compressedData: /* Nothing to do */ return 1; + case NID_pkcs7_enveloped: + return cms_EnvelopedData_final(cms, cmsbio); + case NID_pkcs7_signed: return cms_SignedData_final(cms, cmsbio); diff --git a/crypto/cms/cms_local.h b/crypto/cms/cms_local.h index 6cb31955..46956a09 100644 --- a/crypto/cms/cms_local.h +++ b/crypto/cms/cms_local.h @@ -402,13 +402,16 @@ int cms_Receipt_verify(CMS_ContentInfo *cms, CMS_ContentInfo *req_cms); int cms_msgSigDigest_add1(CMS_SignerInfo *dest, CMS_SignerInfo *src); ASN1_OCTET_STRING *cms_encode_Receipt(CMS_SignerInfo *si); -BIO *cms_EnvelopedData_init_bio(const CMS_ContentInfo *cms); +BIO *cms_EnvelopedData_init_bio(CMS_ContentInfo *cms); +int cms_EnvelopedData_final(CMS_ContentInfo *cms, BIO *chain); CMS_EnvelopedData *cms_get0_enveloped(CMS_ContentInfo *cms); int cms_env_asn1_ctrl(CMS_RecipientInfo *ri, int cmd); int cms_pkey_get_ri_type(EVP_PKEY *pk); +int cms_pkey_is_ri_type_supported(EVP_PKEY *pk, int ri_type); /* KARI routines */ int cms_RecipientInfo_kari_init(CMS_RecipientInfo *ri, X509 *recip, - EVP_PKEY *pk, unsigned int flags); + EVP_PKEY *recipPubKey, X509 *originator, + EVP_PKEY *originatorPrivKey, unsigned int flags); int cms_RecipientInfo_kari_encrypt(const CMS_ContentInfo *cms, CMS_RecipientInfo *ri); diff --git a/crypto/cms/cms_smime.c b/crypto/cms/cms_smime.c index 4ae85c03..d5112a83 100644 --- a/crypto/cms/cms_smime.c +++ b/crypto/cms/cms_smime.c @@ -576,19 +576,20 @@ CMS_ContentInfo *CMS_encrypt(STACK_OF(X509) *certs, BIO *data, return NULL; } -static int cms_kari_set1_pkey(CMS_ContentInfo *cms, CMS_RecipientInfo *ri, - EVP_PKEY *pk, X509 *cert) +static int cms_kari_set1_pkey_and_peer(CMS_ContentInfo *cms, CMS_RecipientInfo *ri, + EVP_PKEY *pk, X509 *cert, X509 *peer) { int i; STACK_OF(CMS_RecipientEncryptedKey) *reks; CMS_RecipientEncryptedKey *rek; + reks = CMS_RecipientInfo_kari_get0_reks(ri); for (i = 0; i < sk_CMS_RecipientEncryptedKey_num(reks); i++) { int rv; rek = sk_CMS_RecipientEncryptedKey_value(reks, i); if (cert != NULL && CMS_RecipientEncryptedKey_cert_cmp(rek, cert)) continue; - CMS_RecipientInfo_kari_set0_pkey(ri, pk); + CMS_RecipientInfo_kari_set0_pkey_and_peer(ri, pk, peer); rv = CMS_RecipientInfo_kari_decrypt(cms, ri, rek); CMS_RecipientInfo_kari_set0_pkey(ri, NULL); if (rv > 0) @@ -599,28 +600,37 @@ static int cms_kari_set1_pkey(CMS_ContentInfo *cms, CMS_RecipientInfo *ri, } int CMS_decrypt_set1_pkey(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert) +{ + return CMS_decrypt_set1_pkey_and_peer(cms, pk, cert, NULL); +} + +int CMS_decrypt_set1_pkey_and_peer(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert, X509 *peer) { STACK_OF(CMS_RecipientInfo) *ris; CMS_RecipientInfo *ri; - int i, r, ri_type; + int i, r, cms_pkey_ri_type; int debug = 0, match_ri = 0; ris = CMS_get0_RecipientInfos(cms); if (ris) debug = cms->d.envelopedData->encryptedContentInfo->debug; - ri_type = cms_pkey_get_ri_type(pk); - if (ri_type == CMS_RECIPINFO_NONE) { - CMSerr(CMS_F_CMS_DECRYPT_SET1_PKEY, - CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE); - return 0; + + cms_pkey_ri_type = cms_pkey_get_ri_type(pk); + if (cms_pkey_ri_type == CMS_RECIPINFO_NONE) { + CMSerr(CMS_F_CMS_DECRYPT_SET1_PKEY_AND_PEER, + CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE); + return 0; } for (i = 0; i < sk_CMS_RecipientInfo_num(ris); i++) { + int ri_type; + ri = sk_CMS_RecipientInfo_value(ris, i); - if (CMS_RecipientInfo_type(ri) != ri_type) + ri_type = CMS_RecipientInfo_type(ri); + if (!cms_pkey_is_ri_type_supported(pk, ri_type)) continue; match_ri = 1; if (ri_type == CMS_RECIPINFO_AGREE) { - r = cms_kari_set1_pkey(cms, ri, pk, cert); + r = cms_kari_set1_pkey_and_peer(cms, ri, pk, cert, peer); if (r > 0) return 1; if (r < 0) @@ -646,7 +656,7 @@ int CMS_decrypt_set1_pkey(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert) } if (r > 0) return 1; - CMSerr(CMS_F_CMS_DECRYPT_SET1_PKEY, CMS_R_DECRYPT_ERROR); + CMSerr(CMS_F_CMS_DECRYPT_SET1_PKEY_AND_PEER, CMS_R_DECRYPT_ERROR); return 0; } /* @@ -654,17 +664,17 @@ int CMS_decrypt_set1_pkey(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert) * successful decrypt. Always attempt to decrypt all recipients * to avoid leaking timing of a successful decrypt. */ - else if (r > 0 && debug) + else if (r > 0 && (debug || cms_pkey_ri_type != CMS_RECIPINFO_TRANS)) return 1; } } /* If no cert, key transport and not debugging always return success */ - if (cert == NULL && ri_type == CMS_RECIPINFO_TRANS && match_ri && !debug) { + if (cert == NULL && cms_pkey_ri_type == CMS_RECIPINFO_TRANS && match_ri && !debug) { ERR_clear_error(); return 1; } - CMSerr(CMS_F_CMS_DECRYPT_SET1_PKEY, CMS_R_NO_MATCHING_RECIPIENT); + CMSerr(CMS_F_CMS_DECRYPT_SET1_PKEY_AND_PEER, CMS_R_NO_MATCHING_RECIPIENT); return 0; } diff --git a/crypto/dh/build.info b/crypto/dh/build.info index bb71f4a1..56c085bb 100644 --- a/crypto/dh/build.info +++ b/crypto/dh/build.info @@ -1,9 +1,9 @@ LIBS=../../libcrypto -$COMMON=dh_lib.c dh_key.c dh_group_params.c +$COMMON=dh_lib.c dh_key.c dh_group_params.c dh_check.c SOURCE[../../libcrypto]=$COMMON\ - dh_asn1.c dh_gen.c dh_check.c dh_err.c dh_depr.c \ + dh_asn1.c dh_gen.c dh_err.c dh_depr.c \ dh_ameth.c dh_pmeth.c dh_prn.c dh_rfc5114.c dh_kdf.c dh_meth.c SOURCE[../../providers/libfips.a]=$COMMON diff --git a/crypto/dh/dh_group_params.c b/crypto/dh/dh_group_params.c index d2dd2582..d672ae30 100644 --- a/crypto/dh/dh_group_params.c +++ b/crypto/dh/dh_group_params.c @@ -22,6 +22,33 @@ #include #include "crypto/bn_dh.h" #include "crypto/dh.h" +#include "crypto/security_bits.h" + + +#define FFDHE(sz) { NID_ffdhe##sz, sz, &_bignum_ffdhe##sz##_p } +#define MODP(sz) { NID_modp_##sz, sz, &_bignum_modp_##sz##_p } + +typedef struct safe_prime_group_st { + int nid; + int32_t nbits; + const BIGNUM *p; +} SP_GROUP; + +static const SP_GROUP sp_groups[] = { + FFDHE(2048), + FFDHE(3072), + FFDHE(4096), + FFDHE(6144), + FFDHE(8192), +#ifndef FIPS_MODE + MODP(1536), +#endif + MODP(2048), + MODP(3072), + MODP(4096), + MODP(6144), + MODP(8192), +}; #ifndef FIPS_MODE static DH *dh_new_by_nid_with_ctx(OPENSSL_CTX *libctx, int nid); @@ -54,40 +81,24 @@ static DH *dh_param_init(OPENSSL_CTX *libctx, int nid, const BIGNUM *p, static DH *dh_new_by_nid_with_ctx(OPENSSL_CTX *libctx, int nid) { - /* - * The last parameter specified in these fields is - * 2 * max_target_security_strength. - * See SP800-56Ar3 Table(s) 25 & 26. - */ - switch (nid) { - case NID_ffdhe2048: - return dh_param_init(libctx, nid, &_bignum_ffdhe2048_p, 225); - case NID_ffdhe3072: - return dh_param_init(libctx, nid, &_bignum_ffdhe3072_p, 275); - case NID_ffdhe4096: - return dh_param_init(libctx, nid, &_bignum_ffdhe4096_p, 325); - case NID_ffdhe6144: - return dh_param_init(libctx, nid, &_bignum_ffdhe6144_p, 375); - case NID_ffdhe8192: - return dh_param_init(libctx, nid, &_bignum_ffdhe8192_p, 400); -#ifndef FIPS_MODE - case NID_modp_1536: - return dh_param_init(libctx, nid, &_bignum_modp_1536_p, 190); -#endif - case NID_modp_2048: - return dh_param_init(libctx, nid, &_bignum_modp_2048_p, 225); - case NID_modp_3072: - return dh_param_init(libctx, nid, &_bignum_modp_3072_p, 275); - case NID_modp_4096: - return dh_param_init(libctx, nid, &_bignum_modp_4096_p, 325); - case NID_modp_6144: - return dh_param_init(libctx, nid, &_bignum_modp_6144_p, 375); - case NID_modp_8192: - return dh_param_init(libctx, nid, &_bignum_modp_8192_p, 400); - default: - DHerr(0, DH_R_INVALID_PARAMETER_NID); - return NULL; + int i; + + for (i = 0; i < (int)OSSL_NELEM(sp_groups); ++i) { + if (sp_groups[i].nid == nid) { + int max_target_security_strength = + ifc_ffc_compute_security_bits(sp_groups[i].nbits); + + /* + * The last parameter specified here is + * 2 * max_target_security_strength. + * See SP800-56Ar3 Table(s) 25 & 26. + */ + return dh_param_init(libctx, nid, sp_groups[i].p, + 2 * max_target_security_strength); + } } + DHerr(0, DH_R_INVALID_PARAMETER_NID); + return NULL; } DH *DH_new_by_nid(int nid) @@ -98,49 +109,44 @@ DH *DH_new_by_nid(int nid) int DH_get_nid(DH *dh) { - int nid = dh->params.nid; + BIGNUM *q = NULL; + int i, nid; + if (dh == NULL) + return NID_undef; + + nid = dh->params.nid; + /* Just return if it is already cached */ if (nid != NID_undef) return nid; if (BN_get_word(dh->params.g) != 2) return NID_undef; - if (!BN_cmp(dh->params.p, &_bignum_ffdhe2048_p)) - nid = NID_ffdhe2048; - else if (!BN_cmp(dh->params.p, &_bignum_ffdhe3072_p)) - nid = NID_ffdhe3072; - else if (!BN_cmp(dh->params.p, &_bignum_ffdhe4096_p)) - nid = NID_ffdhe4096; - else if (!BN_cmp(dh->params.p, &_bignum_ffdhe6144_p)) - nid = NID_ffdhe6144; - else if (!BN_cmp(dh->params.p, &_bignum_ffdhe8192_p)) - nid = NID_ffdhe8192; -#ifndef FIPS_MODE - else if (!BN_cmp(dh->params.p, &_bignum_modp_1536_p)) - nid = NID_modp_1536; -#endif - else if (!BN_cmp(dh->params.p, &_bignum_modp_2048_p)) - nid = NID_modp_2048; - else if (!BN_cmp(dh->params.p, &_bignum_modp_3072_p)) - nid = NID_modp_3072; - else if (!BN_cmp(dh->params.p, &_bignum_modp_4096_p)) - nid = NID_modp_4096; - else if (!BN_cmp(dh->params.p, &_bignum_modp_6144_p)) - nid = NID_modp_6144; - else if (!BN_cmp(dh->params.p, &_bignum_modp_8192_p)) - nid = NID_modp_8192; - else - return NID_undef; - /* Verify q is correct if it exists - reset the nid if it is not correct */ - if (dh->params.q != NULL) { - BIGNUM *q = BN_dup(dh->params.p); + for (i = 0; i < (int)OSSL_NELEM(sp_groups); ++i) { + /* If a matching p is found then we will break out of the loop */ + if (!BN_cmp(dh->params.p, sp_groups[i].p)) { + /* Set q = (p - 1) / 2 (p is known to be odd so just shift right ) */ + q = BN_dup(dh->params.p); - /* Check q = p * 2 + 1 we already know q is odd, so just shift right */ - if (q == NULL || !BN_rshift1(q, q) || (BN_cmp(dh->params.q, q) != 0)) - nid = NID_undef; - BN_free(q); + if (q == NULL || !BN_rshift1(q, q)) + break; /* returns nid = NID_undef on failure */ + + /* Verify q is correct if it exists */ + if (dh->params.q != NULL) { + if (BN_cmp(dh->params.q, q) != 0) + break; /* returns nid = NID_undef if q does not match */ + } else { + /* assign the calculated q */ + dh->params.q = q; + q = NULL; /* set to NULL so it is not freed */ + } + dh->params.nid = sp_groups[i].nid; /* cache the nid */ + dh->length = 2 * ifc_ffc_compute_security_bits(sp_groups[i].nbits); + dh->dirty_cnt++; + break; + } } - dh->params.nid = nid; /* cache the nid */ + BN_free(q); return nid; } diff --git a/crypto/dh/dh_key.c b/crypto/dh/dh_key.c index 5748be81..ab2e25ea 100644 --- a/crypto/dh/dh_key.c +++ b/crypto/dh/dh_key.c @@ -251,8 +251,7 @@ static int generate_key(DH *dh) * (where s = max security strength supported). * N = dh->length (N = maximum bit length of private key) */ - if (dh->length == 0 - || dh->params.q == NULL + if (dh->params.q == NULL || dh->length > BN_num_bits(dh->params.q)) goto err; if (!ffc_generate_private_key(ctx, &dh->params, dh->length, diff --git a/crypto/dh/dh_lib.c b/crypto/dh/dh_lib.c index d7fe850f..29152dca 100644 --- a/crypto/dh/dh_lib.c +++ b/crypto/dh/dh_lib.c @@ -211,11 +211,16 @@ int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g) ffc_params_set0_pqg(&dh->params, p, q, g); dh->params.nid = NID_undef; - DH_get_nid(dh); /* Check if this is a named group and cache it */ - - if (q != NULL) - dh->length = BN_num_bits(q); - + /* + * Check if this is a named group. If it finds a named group then the + * 'q' and 'length' value are either already set or are set by the + * call. + */ + if (DH_get_nid(dh) == NID_undef) { + /* If its not a named group then set the 'length' if q is not NULL */ + if (q != NULL) + dh->length = BN_num_bits(q); + } dh->dirty_cnt++; return 1; } diff --git a/crypto/dsa/build.info b/crypto/dsa/build.info index 2cbea9b9..35a95a2b 100644 --- a/crypto/dsa/build.info +++ b/crypto/dsa/build.info @@ -1,9 +1,10 @@ LIBS=../../libcrypto -$COMMON=dsa_sign.c dsa_vrf.c dsa_lib.c dsa_ossl.c dsa_aid.c +$COMMON=dsa_sign.c dsa_vrf.c dsa_lib.c dsa_ossl.c dsa_aid.c dsa_check.c \ + dsa_key.c SOURCE[../../libcrypto]=$COMMON\ - dsa_gen.c dsa_key.c dsa_asn1.c \ + dsa_gen.c dsa_asn1.c \ dsa_err.c dsa_depr.c dsa_ameth.c dsa_pmeth.c dsa_prn.c \ dsa_meth.c SOURCE[../../providers/libfips.a]=$COMMON diff --git a/crypto/dsa/dsa_check.c b/crypto/dsa/dsa_check.c index 3b86d2dc..611a4e66 100644 --- a/crypto/dsa/dsa_check.c +++ b/crypto/dsa/dsa_check.c @@ -15,7 +15,6 @@ int dsa_check_params(const DSA *dsa, int *ret) { - int nid; /* * (2b) FFC domain params conform to FIPS-186-4 explicit domain param * validity tests. diff --git a/crypto/ec/curve448/eddsa.c b/crypto/ec/curve448/eddsa.c index 95fd6657..b5762cb5 100644 --- a/crypto/ec/curve448/eddsa.c +++ b/crypto/ec/curve448/eddsa.c @@ -58,7 +58,12 @@ static c448_error_t hash_init_with_dom(OPENSSL_CTX *ctx, EVP_MD_CTX *hashctx, const uint8_t *context, size_t context_len) { - const char *dom_s = "SigEd448"; +#ifdef CHARSET_EBCDIC + const char dom_s[] = {0x53, 0x69, 0x67, 0x45, + 0x64, 0x34, 0x34, 0x38, 0x00}; +#else + const char dom_s[] = "SigEd448"; +#endif uint8_t dom[2]; EVP_MD *shake256 = NULL; diff --git a/crypto/err/openssl.txt b/crypto/err/openssl.txt index 79645d3b..71cd9286 100644 --- a/crypto/err/openssl.txt +++ b/crypto/err/openssl.txt @@ -243,6 +243,7 @@ CMS_F_CMS_ADD0_CERT:164:CMS_add0_cert CMS_F_CMS_ADD0_RECIPIENT_KEY:100:CMS_add0_recipient_key CMS_F_CMS_ADD0_RECIPIENT_PASSWORD:165:CMS_add0_recipient_password CMS_F_CMS_ADD1_RECEIPTREQUEST:158:CMS_add1_ReceiptRequest +CMS_F_CMS_ADD1_RECIPIENT:184: CMS_F_CMS_ADD1_RECIPIENT_CERT:101:CMS_add1_recipient_cert CMS_F_CMS_ADD1_SIGNER:102:CMS_add1_signer CMS_F_CMS_ADD1_SIGNINGTIME:103:cms_add1_signingTime @@ -260,6 +261,7 @@ CMS_F_CMS_DECRYPT:112:CMS_decrypt CMS_F_CMS_DECRYPT_SET1_KEY:113:CMS_decrypt_set1_key CMS_F_CMS_DECRYPT_SET1_PASSWORD:166:CMS_decrypt_set1_password CMS_F_CMS_DECRYPT_SET1_PKEY:114:CMS_decrypt_set1_pkey +CMS_F_CMS_DECRYPT_SET1_PKEY_AND_PEER:185: CMS_F_CMS_DIGESTALGORITHM_FIND_CTX:115:cms_DigestAlgorithm_find_ctx CMS_F_CMS_DIGESTALGORITHM_INIT_BIO:116:cms_DigestAlgorithm_init_bio CMS_F_CMS_DIGESTEDDATA_DO_FINAL:117:cms_DigestedData_do_final @@ -272,6 +274,8 @@ CMS_F_CMS_ENCRYPTEDDATA_DECRYPT:121:CMS_EncryptedData_decrypt CMS_F_CMS_ENCRYPTEDDATA_ENCRYPT:122:CMS_EncryptedData_encrypt CMS_F_CMS_ENCRYPTEDDATA_SET1_KEY:123:CMS_EncryptedData_set1_key CMS_F_CMS_ENVELOPEDDATA_CREATE:124:CMS_EnvelopedData_create +CMS_F_CMS_ENVELOPEDDATA_ENCRYPTION_INIT_BIO:186: +CMS_F_CMS_ENVELOPEDDATA_FINAL:187: CMS_F_CMS_ENVELOPEDDATA_INIT_BIO:125:cms_EnvelopedData_init_bio CMS_F_CMS_ENVELOPED_DATA_INIT:126:cms_enveloped_data_init CMS_F_CMS_ENV_ASN1_CTRL:171:cms_env_asn1_ctrl diff --git a/crypto/err/openssl.txt.old b/crypto/err/openssl.txt.old index 0a37d5af..f14acc65 100644 --- a/crypto/err/openssl.txt.old +++ b/crypto/err/openssl.txt.old @@ -243,6 +243,7 @@ CMS_F_CMS_ADD0_CERT:164:CMS_add0_cert CMS_F_CMS_ADD0_RECIPIENT_KEY:100:CMS_add0_recipient_key CMS_F_CMS_ADD0_RECIPIENT_PASSWORD:165:CMS_add0_recipient_password CMS_F_CMS_ADD1_RECEIPTREQUEST:158:CMS_add1_ReceiptRequest +CMS_F_CMS_ADD1_RECIPIENT:184: CMS_F_CMS_ADD1_RECIPIENT_CERT:101:CMS_add1_recipient_cert CMS_F_CMS_ADD1_SIGNER:102:CMS_add1_signer CMS_F_CMS_ADD1_SIGNINGTIME:103:cms_add1_signingTime @@ -260,6 +261,7 @@ CMS_F_CMS_DECRYPT:112:CMS_decrypt CMS_F_CMS_DECRYPT_SET1_KEY:113:CMS_decrypt_set1_key CMS_F_CMS_DECRYPT_SET1_PASSWORD:166:CMS_decrypt_set1_password CMS_F_CMS_DECRYPT_SET1_PKEY:114:CMS_decrypt_set1_pkey +CMS_F_CMS_DECRYPT_SET1_PKEY_AND_PEER:185: CMS_F_CMS_DIGESTALGORITHM_FIND_CTX:115:cms_DigestAlgorithm_find_ctx CMS_F_CMS_DIGESTALGORITHM_INIT_BIO:116:cms_DigestAlgorithm_init_bio CMS_F_CMS_DIGESTEDDATA_DO_FINAL:117:cms_DigestedData_do_final @@ -272,6 +274,8 @@ CMS_F_CMS_ENCRYPTEDDATA_DECRYPT:121:CMS_EncryptedData_decrypt CMS_F_CMS_ENCRYPTEDDATA_ENCRYPT:122:CMS_EncryptedData_encrypt CMS_F_CMS_ENCRYPTEDDATA_SET1_KEY:123:CMS_EncryptedData_set1_key CMS_F_CMS_ENVELOPEDDATA_CREATE:124:CMS_EnvelopedData_create +CMS_F_CMS_ENVELOPEDDATA_ENCRYPTION_INIT_BIO:186: +CMS_F_CMS_ENVELOPEDDATA_FINAL:187: CMS_F_CMS_ENVELOPEDDATA_INIT_BIO:125:cms_EnvelopedData_init_bio CMS_F_CMS_ENVELOPED_DATA_INIT:126:cms_enveloped_data_init CMS_F_CMS_ENV_ASN1_CTRL:171:cms_env_asn1_ctrl diff --git a/crypto/evp/pmeth_gn.c b/crypto/evp/pmeth_gn.c index 4bea1a1b..84149fab 100644 --- a/crypto/evp/pmeth_gn.c +++ b/crypto/evp/pmeth_gn.c @@ -230,7 +230,7 @@ int EVP_PKEY_fromdata(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey, OSSL_PARAM params[]) if (ctx->operation == EVP_PKEY_OP_PARAMFROMDATA) selection = OSSL_KEYMGMT_SELECT_ALL_PARAMETERS; else - selection = OSSL_KEYMGMT_SELECT_KEYPAIR; + selection = OSSL_KEYMGMT_SELECT_ALL; keydata = evp_keymgmt_util_fromdata(*ppkey, ctx->keymgmt, selection, params); @@ -261,6 +261,6 @@ const OSSL_PARAM *EVP_PKEY_key_fromdata_settable(EVP_PKEY_CTX *ctx) /* We call fromdata_init to get ctx->keymgmt populated */ if (fromdata_init(ctx, EVP_PKEY_OP_UNDEFINED)) return evp_keymgmt_import_types(ctx->keymgmt, - OSSL_KEYMGMT_SELECT_KEYPAIR); + OSSL_KEYMGMT_SELECT_ALL); return NULL; } diff --git a/crypto/evp/pmeth_lib.c b/crypto/evp/pmeth_lib.c index c82a5438..906b0815 100644 --- a/crypto/evp/pmeth_lib.c +++ b/crypto/evp/pmeth_lib.c @@ -774,6 +774,13 @@ int EVP_PKEY_CTX_set_signature_md(EVP_PKEY_CTX *ctx, const EVP_MD *md) static int legacy_ctrl_to_param(EVP_PKEY_CTX *ctx, int keytype, int optype, int cmd, int p1, void *p2) { + /* + * GOST CMS format is different for different cipher algorithms. + * Most of other algorithms don't have such a difference + * so this ctrl is just ignored. + */ + if (cmd == EVP_PKEY_CTRL_CIPHER) + return -2; # ifndef OPENSSL_NO_DH if (keytype == EVP_PKEY_DH) { switch (cmd) { @@ -931,7 +938,7 @@ static int legacy_ctrl_str_to_param(EVP_PKEY_CTX *ctx, const char *name, else if (strcmp(name, "ecdh_cofactor_mode") == 0) name = OSSL_EXCHANGE_PARAM_EC_ECDH_COFACTOR_MODE; else if (strcmp(name, "ecdh_kdf_md") == 0) - name = OSSL_EXCHANGE_PARAM_KDF_TYPE; + name = OSSL_EXCHANGE_PARAM_KDF_DIGEST; # endif { diff --git a/crypto/ffc/ffc_key_generate.c b/crypto/ffc/ffc_key_generate.c index b8c85480..078e8d39 100644 --- a/crypto/ffc/ffc_key_generate.c +++ b/crypto/ffc/ffc_key_generate.c @@ -36,13 +36,19 @@ int ffc_generate_private_key(BN_CTX *ctx, const FFC_PARAMS *params, int ffc_generate_private_key_fips(BN_CTX *ctx, const FFC_PARAMS *params, int N, int s, BIGNUM *priv) { - int ret = 0; + int ret = 0, qbits = BN_num_bits(params->q); BIGNUM *m, *two_powN = NULL; /* Step (2) : check range of N */ - if (N < 2 * s || N > BN_num_bits(params->q)) + if (N < 2 * s || N > qbits) return 0; + /* Deal with the edge case where the value of N is not set */ + if (N == 0) { + N = qbits; + s = N / 2; + } + two_powN = BN_new(); /* 2^N */ if (two_powN == NULL || !BN_lshift(two_powN, BN_value_one(), N)) @@ -50,6 +56,7 @@ int ffc_generate_private_key_fips(BN_CTX *ctx, const FFC_PARAMS *params, /* Step (5) : M = min(2 ^ N, q) */ m = (BN_cmp(two_powN, params->q) > 0) ? params->q : two_powN; + do { /* Steps (3, 4 & 7) : c + 1 = 1 + random[0..2^N - 1] */ if (!BN_priv_rand_range_ex(priv, two_powN, ctx) diff --git a/crypto/provider_core.c b/crypto/provider_core.c index cac32540..026e784b 100644 --- a/crypto/provider_core.c +++ b/crypto/provider_core.c @@ -10,6 +10,7 @@ #include #include #include +#include #include #include #include "crypto/cryptlib.h" @@ -92,6 +93,7 @@ static int ossl_provider_cmp(const OSSL_PROVIDER * const *a, struct provider_store_st { STACK_OF(OSSL_PROVIDER) *providers; CRYPTO_RWLOCK *lock; + char *default_path; unsigned int use_fallbacks:1; }; @@ -101,6 +103,7 @@ static void provider_store_free(void *vstore) if (store == NULL) return; + OPENSSL_free(store->default_path); sk_OSSL_PROVIDER_pop_free(store->providers, ossl_provider_free); CRYPTO_THREAD_lock_free(store->lock); OPENSSL_free(store); @@ -384,6 +387,29 @@ int ossl_provider_add_parameter(OSSL_PROVIDER *prov, */ static const OSSL_DISPATCH *core_dispatch; /* Define further down */ +int OSSL_PROVIDER_set_default_search_path(OPENSSL_CTX *libctx, const char *path) +{ + struct provider_store_st *store; + char *p = NULL; + + if (path != NULL) { + p = OPENSSL_strdup(path); + if (p == NULL) { + CRYPTOerr(0, ERR_R_MALLOC_FAILURE); + return 0; + } + } + if ((store = get_provider_store(libctx)) != NULL + && CRYPTO_THREAD_write_lock(store->lock)) { + OPENSSL_free(store->default_path); + store->default_path = p; + CRYPTO_THREAD_unlock(store->lock); + return 1; + } + OPENSSL_free(p); + return 0; +} + /* * Internal version that doesn't affect the store flags, and thereby avoid * locking. Direct callers must remember to set the store flags when @@ -413,15 +439,24 @@ static int provider_activate(OSSL_PROVIDER *prov) char *allocated_path = NULL; const char *module_path = NULL; char *merged_path = NULL; - const char *load_dir = ossl_safe_getenv("OPENSSL_MODULES"); + const char *load_dir = NULL; + struct provider_store_st *store; if ((prov->module = DSO_new()) == NULL) { /* DSO_new() generates an error already */ return 0; } - if (load_dir == NULL) - load_dir = MODULESDIR; + if ((store = get_provider_store(prov->libctx)) == NULL + || !CRYPTO_THREAD_read_lock(store->lock)) + return 0; + load_dir = store->default_path; + + if (load_dir == NULL) { + load_dir = ossl_safe_getenv("OPENSSL_MODULES"); + if (load_dir == NULL) + load_dir = MODULESDIR; + } DSO_ctrl(prov->module, DSO_CTRL_SET_FLAGS, DSO_FLAG_NAME_TRANSLATION_EXT_ONLY, NULL); @@ -432,6 +467,7 @@ static int provider_activate(OSSL_PROVIDER *prov) DSO_convert_filename(prov->module, prov->name); if (module_path != NULL) merged_path = DSO_merge(prov->module, module_path, load_dir); + CRYPTO_THREAD_unlock(store->lock); if (merged_path == NULL || (DSO_load(prov->module, merged_path, NULL, 0)) == NULL) { diff --git a/crypto/rsa/rsa_lib.c b/crypto/rsa/rsa_lib.c index b118f614..b5003d3b 100644 --- a/crypto/rsa/rsa_lib.c +++ b/crypto/rsa/rsa_lib.c @@ -17,6 +17,7 @@ #include "crypto/bn.h" #include "crypto/evp.h" #include "crypto/rsa.h" +#include "crypto/security_bits.h" #include "rsa_local.h" static RSA *rsa_new_intern(ENGINE *engine, OPENSSL_CTX *libctx); @@ -275,11 +276,20 @@ static uint32_t ilog_e(uint64_t v) * NIST SP 800-56B rev 2 Appendix D: Maximum Security Strength Estimates for IFC * Modulus Lengths. * + * Note that this formula is also referred to in SP800-56A rev3 Appendix D: + * for FFC safe prime groups for modp and ffdhe. + * After Table 25 and Table 26 it refers to + * "The maximum security strength estimates were calculated using the formula in + * Section 7.5 of the FIPS 140 IG and rounded to the nearest multiple of eight + * bits". + * + * The formula is: + * * E = \frac{1.923 \sqrt[3]{nBits \cdot log_e(2)} * \cdot(log_e(nBits \cdot log_e(2))^{2/3} - 4.69}{log_e(2)} * The two cube roots are merged together here. */ -uint16_t rsa_compute_security_bits(int n) +uint16_t ifc_ffc_compute_security_bits(int n) { uint64_t x; uint32_t lx; @@ -316,6 +326,8 @@ uint16_t rsa_compute_security_bits(int n) return (y + 4) & ~7; } + + int RSA_security_bits(const RSA *rsa) { int bits = BN_num_bits(rsa->n); @@ -329,7 +341,7 @@ int RSA_security_bits(const RSA *rsa) return 0; } #endif - return rsa_compute_security_bits(bits); + return ifc_ffc_compute_security_bits(bits); } int RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d) diff --git a/crypto/rsa/rsa_local.h b/crypto/rsa/rsa_local.h index 11d7635c..ac885620 100644 --- a/crypto/rsa/rsa_local.h +++ b/crypto/rsa/rsa_local.h @@ -137,8 +137,6 @@ RSA_PRIME_INFO *rsa_multip_info_new(void); int rsa_multip_calc_product(RSA *rsa); int rsa_multip_cap(int bits); -uint16_t rsa_compute_security_bits(int n); - int rsa_sp800_56b_validate_strength(int nbits, int strength); int rsa_check_pminusq_diff(BIGNUM *diff, const BIGNUM *p, const BIGNUM *q, int nbits); diff --git a/crypto/rsa/rsa_sp800_56b_gen.c b/crypto/rsa/rsa_sp800_56b_gen.c index 1f8d01d4..a60a428b 100644 --- a/crypto/rsa/rsa_sp800_56b_gen.c +++ b/crypto/rsa/rsa_sp800_56b_gen.c @@ -11,6 +11,7 @@ #include #include #include "crypto/bn.h" +#include "crypto/security_bits.h" #include "rsa_local.h" #define RSA_FIPS1864_MIN_KEYGEN_KEYSIZE 2048 @@ -144,7 +145,7 @@ err: */ int rsa_sp800_56b_validate_strength(int nbits, int strength) { - int s = (int)rsa_compute_security_bits(nbits); + int s = (int)ifc_ffc_compute_security_bits(nbits); if (s < RSA_FIPS1864_MIN_KEYGEN_STRENGTH || s > RSA_FIPS1864_MAX_KEYGEN_STRENGTH) { diff --git a/doc/internal/man3/s2i_ASN1_UTF8STRING.pod b/doc/internal/man3/s2i_ASN1_UTF8STRING.pod index 03a309ba..c5b434a5 100644 --- a/doc/internal/man3/s2i_ASN1_UTF8STRING.pod +++ b/doc/internal/man3/s2i_ASN1_UTF8STRING.pod @@ -14,6 +14,7 @@ s2i_ASN1_UTF8STRING, ASN1_UTF8STRING *utf8); ASN1_UTF8STRING *s2i_ASN1_UTF8STRING(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, const char *str); + =head1 DESCRIPTION These functions convert OpenSSL objects to and from their ASN.1/string diff --git a/doc/man1/CA.pl.pod b/doc/man1/CA.pl.pod index db444d56..4c539708 100644 --- a/doc/man1/CA.pl.pod +++ b/doc/man1/CA.pl.pod @@ -174,11 +174,18 @@ Sign the request: CA.pl -signreq +=head1 ENVIRONMENT + +The environment variable B may be used to specify a +configuration option and value to the B and B commands invoked by +this script. It's value should be the option and pathname, as in +C<-config /path/to/conf-file>. + =head1 NOTES Most of the filenames mentioned can be modified by editing the B script. -If the demoCA directory already exists then the B<-newca> command will not +If the F directory already exists then the B<-newca> command will not overwrite it and will do nothing. This can happen if a previous call using the B<-newca> option terminated abnormally. To get the correct behaviour delete the demoCA directory if it already exists. diff --git a/doc/man1/build.info b/doc/man1/build.info index 13012d44..c48ff0ac 100644 --- a/doc/man1/build.info +++ b/doc/man1/build.info @@ -1,113 +1,163 @@ -# Keep this in sync with .gitignore! DEPEND[]= \ + openssl-asn1parse.pod \ openssl-ca.pod \ + openssl-ciphers.pod \ + openssl-cmds.pod \ openssl-cms.pod \ + openssl-crl2pkcs7.pod \ openssl-crl.pod \ openssl-dgst.pod \ openssl-dhparam.pod \ - openssl-dsa.pod \ openssl-dsaparam.pod \ - openssl-ec.pod \ + openssl-dsa.pod \ openssl-ecparam.pod \ + openssl-ec.pod \ openssl-enc.pod \ + openssl-engine.pod \ + openssl-errstr.pod \ + openssl-fipsinstall.pod \ openssl-gendsa.pod \ openssl-genpkey.pod \ openssl-genrsa.pod \ + openssl-info.pod \ + openssl-kdf.pod \ + openssl-list.pod \ + openssl-mac.pod \ + openssl-nseq.pod \ openssl-ocsp.pod \ openssl-passwd.pod \ openssl-pkcs12.pod \ openssl-pkcs7.pod \ openssl-pkcs8.pod \ - openssl-pkey.pod \ openssl-pkeyparam.pod \ + openssl-pkey.pod \ openssl-pkeyutl.pod \ + openssl-prime.pod \ + openssl-provider.pod \ openssl-rand.pod \ + openssl-rehash.pod \ openssl-req.pod \ openssl-rsa.pod \ openssl-rsautl.pod \ openssl-s_client.pod \ - openssl-s_server.pod \ - openssl-s_time.pod \ + openssl-sess_id.pod \ openssl-smime.pod \ openssl-speed.pod \ openssl-spkac.pod \ openssl-srp.pod \ + openssl-s_server.pod \ + openssl-s_time.pod \ openssl-storeutl.pod \ openssl-ts.pod \ openssl-verify.pod \ + openssl-version.pod \ openssl-x509.pod +DEPEND[openssl-asn1parse.pod]=../perlvars.pm DEPEND[openssl-ca.pod]=../perlvars.pm +DEPEND[openssl-ciphers.pod]=../perlvars.pm +DEPEND[openssl-cmds.pod]=../perlvars.pm DEPEND[openssl-cms.pod]=../perlvars.pm +DEPEND[openssl-crl2pkcs7.pod]=../perlvars.pm DEPEND[openssl-crl.pod]=../perlvars.pm DEPEND[openssl-dgst.pod]=../perlvars.pm DEPEND[openssl-dhparam.pod]=../perlvars.pm -DEPEND[openssl-dsa.pod]=../perlvars.pm DEPEND[openssl-dsaparam.pod]=../perlvars.pm -DEPEND[openssl-ec.pod]=../perlvars.pm +DEPEND[openssl-dsa.pod]=../perlvars.pm DEPEND[openssl-ecparam.pod]=../perlvars.pm +DEPEND[openssl-ec.pod]=../perlvars.pm DEPEND[openssl-enc.pod]=../perlvars.pm +DEPEND[openssl-engine.pod]=../perlvars.pm +DEPEND[openssl-errstr.pod]=../perlvars.pm +DEPEND[openssl-fipsinstall.pod]=../perlvars.pm DEPEND[openssl-gendsa.pod]=../perlvars.pm DEPEND[openssl-genpkey.pod]=../perlvars.pm DEPEND[openssl-genrsa.pod]=../perlvars.pm +DEPEND[openssl-info.pod]=../perlvars.pm +DEPEND[openssl-kdf.pod]=../perlvars.pm +DEPEND[openssl-list.pod]=../perlvars.pm +DEPEND[openssl-mac.pod]=../perlvars.pm +DEPEND[openssl-nseq.pod]=../perlvars.pm DEPEND[openssl-ocsp.pod]=../perlvars.pm DEPEND[openssl-passwd.pod]=../perlvars.pm DEPEND[openssl-pkcs12.pod]=../perlvars.pm DEPEND[openssl-pkcs7.pod]=../perlvars.pm DEPEND[openssl-pkcs8.pod]=../perlvars.pm -DEPEND[openssl-pkey.pod]=../perlvars.pm DEPEND[openssl-pkeyparam.pod]=../perlvars.pm +DEPEND[openssl-pkey.pod]=../perlvars.pm DEPEND[openssl-pkeyutl.pod]=../perlvars.pm +DEPEND[openssl-prime.pod]=../perlvars.pm +DEPEND[openssl-provider.pod]=../perlvars.pm DEPEND[openssl-rand.pod]=../perlvars.pm +DEPEND[openssl-rehash.pod]=../perlvars.pm DEPEND[openssl-req.pod]=../perlvars.pm DEPEND[openssl-rsa.pod]=../perlvars.pm DEPEND[openssl-rsautl.pod]=../perlvars.pm DEPEND[openssl-s_client.pod]=../perlvars.pm -DEPEND[openssl-s_server.pod]=../perlvars.pm -DEPEND[openssl-s_time.pod]=../perlvars.pm +DEPEND[openssl-sess_id.pod]=../perlvars.pm DEPEND[openssl-smime.pod]=../perlvars.pm DEPEND[openssl-speed.pod]=../perlvars.pm DEPEND[openssl-spkac.pod]=../perlvars.pm DEPEND[openssl-srp.pod]=../perlvars.pm +DEPEND[openssl-s_server.pod]=../perlvars.pm +DEPEND[openssl-s_time.pod]=../perlvars.pm DEPEND[openssl-storeutl.pod]=../perlvars.pm DEPEND[openssl-ts.pod]=../perlvars.pm DEPEND[openssl-verify.pod]=../perlvars.pm +DEPEND[openssl-version.pod]=../perlvars.pm DEPEND[openssl-x509.pod]=../perlvars.pm +GENERATE[openssl-asn1parse.pod]=openssl-asn1parse.pod.in GENERATE[openssl-ca.pod]=openssl-ca.pod.in +GENERATE[openssl-ciphers.pod]=openssl-ciphers.pod.in +GENERATE[openssl-cmds.pod]=openssl-cmds.pod.in GENERATE[openssl-cms.pod]=openssl-cms.pod.in +GENERATE[openssl-crl2pkcs7.pod]=openssl-crl2pkcs7.pod.in GENERATE[openssl-crl.pod]=openssl-crl.pod.in GENERATE[openssl-dgst.pod]=openssl-dgst.pod.in GENERATE[openssl-dhparam.pod]=openssl-dhparam.pod.in -GENERATE[openssl-dsa.pod]=openssl-dsa.pod.in GENERATE[openssl-dsaparam.pod]=openssl-dsaparam.pod.in -GENERATE[openssl-ec.pod]=openssl-ec.pod.in +GENERATE[openssl-dsa.pod]=openssl-dsa.pod.in GENERATE[openssl-ecparam.pod]=openssl-ecparam.pod.in +GENERATE[openssl-ec.pod]=openssl-ec.pod.in GENERATE[openssl-enc.pod]=openssl-enc.pod.in +GENERATE[openssl-engine.pod]=openssl-engine.pod.in +GENERATE[openssl-errstr.pod]=openssl-errstr.pod.in +GENERATE[openssl-fipsinstall.pod]=openssl-fipsinstall.pod.in GENERATE[openssl-gendsa.pod]=openssl-gendsa.pod.in GENERATE[openssl-genpkey.pod]=openssl-genpkey.pod.in GENERATE[openssl-genrsa.pod]=openssl-genrsa.pod.in +GENERATE[openssl-info.pod]=openssl-info.pod.in +GENERATE[openssl-kdf.pod]=openssl-kdf.pod.in +GENERATE[openssl-list.pod]=openssl-list.pod.in +GENERATE[openssl-mac.pod]=openssl-mac.pod.in +GENERATE[openssl-nseq.pod]=openssl-nseq.pod.in GENERATE[openssl-ocsp.pod]=openssl-ocsp.pod.in GENERATE[openssl-passwd.pod]=openssl-passwd.pod.in GENERATE[openssl-pkcs12.pod]=openssl-pkcs12.pod.in GENERATE[openssl-pkcs7.pod]=openssl-pkcs7.pod.in GENERATE[openssl-pkcs8.pod]=openssl-pkcs8.pod.in -GENERATE[openssl-pkey.pod]=openssl-pkey.pod.in GENERATE[openssl-pkeyparam.pod]=openssl-pkeyparam.pod.in +GENERATE[openssl-pkey.pod]=openssl-pkey.pod.in GENERATE[openssl-pkeyutl.pod]=openssl-pkeyutl.pod.in +GENERATE[openssl-prime.pod]=openssl-prime.pod.in +GENERATE[openssl-provider.pod]=openssl-provider.pod.in GENERATE[openssl-rand.pod]=openssl-rand.pod.in +GENERATE[openssl-rehash.pod]=openssl-rehash.pod.in GENERATE[openssl-req.pod]=openssl-req.pod.in GENERATE[openssl-rsa.pod]=openssl-rsa.pod.in GENERATE[openssl-rsautl.pod]=openssl-rsautl.pod.in GENERATE[openssl-s_client.pod]=openssl-s_client.pod.in -GENERATE[openssl-s_server.pod]=openssl-s_server.pod.in -GENERATE[openssl-s_time.pod]=openssl-s_time.pod.in +GENERATE[openssl-sess_id.pod]=openssl-sess_id.pod.in GENERATE[openssl-smime.pod]=openssl-smime.pod.in GENERATE[openssl-speed.pod]=openssl-speed.pod.in GENERATE[openssl-spkac.pod]=openssl-spkac.pod.in GENERATE[openssl-srp.pod]=openssl-srp.pod.in +GENERATE[openssl-s_server.pod]=openssl-s_server.pod.in +GENERATE[openssl-s_time.pod]=openssl-s_time.pod.in GENERATE[openssl-storeutl.pod]=openssl-storeutl.pod.in GENERATE[openssl-ts.pod]=openssl-ts.pod.in GENERATE[openssl-verify.pod]=openssl-verify.pod.in +GENERATE[openssl-version.pod]=openssl-version.pod.in GENERATE[openssl-x509.pod]=openssl-x509.pod.in diff --git a/doc/man1/openssl-asn1parse.pod b/doc/man1/openssl-asn1parse.pod.in similarity index 99% rename from doc/man1/openssl-asn1parse.pod rename to doc/man1/openssl-asn1parse.pod.in index 698ce478..9b959664 100644 --- a/doc/man1/openssl-asn1parse.pod +++ b/doc/man1/openssl-asn1parse.pod.in @@ -1,4 +1,5 @@ =pod +{- OpenSSL::safe::output_do_not_edit_headers(); -} =head1 NAME diff --git a/doc/man1/openssl-ca.pod.in b/doc/man1/openssl-ca.pod.in index 720db228..a3c83d80 100644 --- a/doc/man1/openssl-ca.pod.in +++ b/doc/man1/openssl-ca.pod.in @@ -12,6 +12,7 @@ B B [B<-verbose>] [B<-config> I] [B<-name> I
] +[B<-section> I
] [B<-gencrl>] [B<-revoke> I] [B<-valid> I] @@ -59,6 +60,7 @@ B B [B<-sm2-hex-id> I] {- $OpenSSL::safe::opt_r_synopsis -} {- $OpenSSL::safe::opt_engine_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} [I...] =for openssl ifdef engine sm2-id sm2-hex-id @@ -93,7 +95,7 @@ Specifies the configuration file to use. Optional; for a description of the default value, see L. -=item B<-name> I
+=item B<-name> I
, B<-section> I
Specifies the configuration file section to use (overrides B in the B section). @@ -308,6 +310,8 @@ certificate. The argument for this option is string of hexadecimal digits. {- $OpenSSL::safe::opt_engine_item -} +{- $OpenSSL::safe::opt_provider_item -} + =back =head1 CRL OPTIONS @@ -769,6 +773,8 @@ seeding mechanism. The new seeding mechanism makes it unnecessary to define a RANDFILE for saving and restoring randomness. This option is retained mainly for compatibility reasons. +The B<-section> option was added in OpenSSL 3.0.0. + =head1 SEE ALSO L, diff --git a/doc/man1/openssl-ciphers.pod b/doc/man1/openssl-ciphers.pod.in similarity index 99% rename from doc/man1/openssl-ciphers.pod rename to doc/man1/openssl-ciphers.pod.in index fcda3998..78e97a0a 100644 --- a/doc/man1/openssl-ciphers.pod +++ b/doc/man1/openssl-ciphers.pod.in @@ -1,4 +1,5 @@ =pod +{- OpenSSL::safe::output_do_not_edit_headers(); -} =head1 NAME @@ -22,6 +23,7 @@ B B [B<-stdname>] [B<-convert> I] [B<-ciphersuites> I] +{- $OpenSSL::safe::opt_provider_synopsis -} [I] =for openssl ifdef ssl3 tls1 tls1_1 tls1_2 tls1_3 psk srp @@ -40,6 +42,8 @@ determine the appropriate cipherlist. Print a usage message. +{- $OpenSSL::safe::opt_provider_item -} + =item B<-s> Only list supported ciphers: those consistent with the security level, and diff --git a/doc/man1/openssl-cmds.pod b/doc/man1/openssl-cmds.pod.in similarity index 98% rename from doc/man1/openssl-cmds.pod rename to doc/man1/openssl-cmds.pod.in index d44d40cf..50f0bc66 100644 --- a/doc/man1/openssl-cmds.pod +++ b/doc/man1/openssl-cmds.pod.in @@ -1,4 +1,5 @@ =pod +{- OpenSSL::safe::output_do_not_edit_headers(); -} =head1 NAME diff --git a/doc/man1/openssl-cms.pod.in b/doc/man1/openssl-cms.pod.in index 1965a952..944135bb 100644 --- a/doc/man1/openssl-cms.pod.in +++ b/doc/man1/openssl-cms.pod.in @@ -46,6 +46,7 @@ B B [B<-print>] [B<-md> I] [B<-I>] +[B<-wrap> I] [B<-nointern>] [B<-noverify>] [B<-nocerts>] @@ -58,6 +59,7 @@ B B [B<-certfile> I] [B<-certsout> I] [B<-signer> I] +[B<-originator> I] [B<-recip> I] [B<-keyid>] [B<-receipt_request_all>] @@ -79,6 +81,7 @@ B B {- $OpenSSL::safe::opt_trust_synopsis -} {- $OpenSSL::safe::opt_r_synopsis -} {- $OpenSSL::safe::opt_engine_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} [I ...] =for openssl ifdef des-wrap engine @@ -300,6 +303,12 @@ supported by your version of OpenSSL. If not specified triple DES is used. Only used with B<-encrypt> and B<-EncryptedData_create> commands. +=item B<-wrap> I + +Cipher algorithm to use for key wrap when encrypting the message using Key +Agreement for key transport. The algorithm specified should be suitable for key +wrap. + =item B<-nointern> When verifying a message normally certificates (if any) included in @@ -374,6 +383,11 @@ used multiple times if more than one signer is required. If a message is being verified then the signers certificates will be written to this file if the verification was successful. +=item B<-originator> I + +A certificate of the originator of the encrypted message. Necessary for +decryption when Key Agreement is in use for a shared key. + =item B<-recip> I When decrypting a message this specifies the recipients certificate. The @@ -477,6 +491,8 @@ Any verification errors cause the command to exit. {- $OpenSSL::safe::opt_engine_item -} +{- $OpenSSL::safe::opt_provider_item -} + =item I ... One or more certificates of message recipients: used when encrypting diff --git a/doc/man1/openssl-crl.pod.in b/doc/man1/openssl-crl.pod.in index c1272c25..c1bd31a4 100644 --- a/doc/man1/openssl-crl.pod.in +++ b/doc/man1/openssl-crl.pod.in @@ -29,6 +29,7 @@ B B [B<-nextupdate>] {- $OpenSSL::safe::opt_name_synopsis -} {- $OpenSSL::safe::opt_trust_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =for openssl ifdef hash_old @@ -123,6 +124,8 @@ Output the nextUpdate field. {- $OpenSSL::safe::opt_trust_item -} +{- $OpenSSL::safe::opt_provider_item -} + =back =head1 EXAMPLES diff --git a/doc/man1/openssl-crl2pkcs7.pod b/doc/man1/openssl-crl2pkcs7.pod.in similarity index 95% rename from doc/man1/openssl-crl2pkcs7.pod rename to doc/man1/openssl-crl2pkcs7.pod.in index 70662d4e..ee7f57d7 100644 --- a/doc/man1/openssl-crl2pkcs7.pod +++ b/doc/man1/openssl-crl2pkcs7.pod.in @@ -1,4 +1,5 @@ =pod +{- OpenSSL::safe::output_do_not_edit_headers(); -} =head1 NAME @@ -14,6 +15,7 @@ B B [B<-out> I] [B<-certfile> I] [B<-nocrl>] +{- $OpenSSL::safe::opt_provider_synopsis -} =head1 DESCRIPTION @@ -61,6 +63,8 @@ files. Normally a CRL is included in the output file. With this option no CRL is included in the output file and a CRL is not read from the input file. +{- $OpenSSL::safe::opt_provider_item -} + =back =head1 EXAMPLES diff --git a/doc/man1/openssl-dgst.pod.in b/doc/man1/openssl-dgst.pod.in index caa5b0a4..fad5b93f 100644 --- a/doc/man1/openssl-dgst.pod.in +++ b/doc/man1/openssl-dgst.pod.in @@ -32,6 +32,7 @@ B B|I {- $OpenSSL::safe::opt_engine_synopsis -} [B<-engine_impl> I] {- $OpenSSL::safe::opt_r_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} [I ...] =head1 DESCRIPTION @@ -184,6 +185,8 @@ used or it is configured to do so, see L. When used with the B<-engine> option, it specifies to also use engine I for digest operations. +{- $OpenSSL::safe::opt_provider_item -} + =item I ... File or files to digest. If no files are specified then standard input is diff --git a/doc/man1/openssl-dhparam.pod.in b/doc/man1/openssl-dhparam.pod.in index 906af1c2..2e45b248 100644 --- a/doc/man1/openssl-dhparam.pod.in +++ b/doc/man1/openssl-dhparam.pod.in @@ -23,6 +23,7 @@ B [B<-5>] {- $OpenSSL::safe::opt_engine_synopsis -} {- $OpenSSL::safe::opt_r_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} [I] =for openssl ifdef dsaparam engine @@ -109,6 +110,8 @@ be loaded by calling the get_dhNNNN() function. {- $OpenSSL::safe::opt_r_item -} +{- $OpenSSL::safe::opt_provider_item -} + =back =head1 NOTES diff --git a/doc/man1/openssl-dsa.pod.in b/doc/man1/openssl-dsa.pod.in index 03fcb7d0..ef05e978 100644 --- a/doc/man1/openssl-dsa.pod.in +++ b/doc/man1/openssl-dsa.pod.in @@ -37,6 +37,7 @@ B B [B<-pubin>] [B<-pubout>] {- $OpenSSL::safe::opt_engine_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =for openssl ifdef pvk-string pvk-weak pvk-none engine @@ -123,6 +124,8 @@ a public key. {- $OpenSSL::safe::opt_engine_item -} +{- $OpenSSL::safe::opt_provider_item -} + =back =head1 EXAMPLES diff --git a/doc/man1/openssl-dsaparam.pod.in b/doc/man1/openssl-dsaparam.pod.in index 51d44bd9..13e8d788 100644 --- a/doc/man1/openssl-dsaparam.pod.in +++ b/doc/man1/openssl-dsaparam.pod.in @@ -20,6 +20,7 @@ B [B<-verbose>] {- $OpenSSL::safe::opt_r_synopsis -} {- $OpenSSL::safe::opt_engine_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} [I] =head1 DESCRIPTION @@ -93,6 +94,8 @@ This option specifies that a parameter set should be generated of size I. It must be the last option. If this option is included then the input file (if any) is ignored. +{- $OpenSSL::safe::opt_provider_item -} + =back =head1 SEE ALSO diff --git a/doc/man1/openssl-ec.pod.in b/doc/man1/openssl-ec.pod.in index ed85ca04..f493a537 100644 --- a/doc/man1/openssl-ec.pod.in +++ b/doc/man1/openssl-ec.pod.in @@ -32,6 +32,7 @@ B B [B<-no_public>] [B<-check>] {- $OpenSSL::safe::opt_engine_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =for openssl ifdef engine @@ -141,6 +142,8 @@ This option checks the consistency of an EC private or public key. {- $OpenSSL::safe::opt_engine_item -} +{- $OpenSSL::safe::opt_provider_item -} + =back =head1 EXAMPLES diff --git a/doc/man1/openssl-ecparam.pod.in b/doc/man1/openssl-ecparam.pod.in index 934bf5a3..a42fa35e 100644 --- a/doc/man1/openssl-ecparam.pod.in +++ b/doc/man1/openssl-ecparam.pod.in @@ -26,6 +26,7 @@ B [B<-genkey>] {- $OpenSSL::safe::opt_engine_synopsis -} {- $OpenSSL::safe::opt_r_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =for openssl ifdef engine @@ -130,6 +131,8 @@ This option will generate an EC private key using the specified parameters. {- $OpenSSL::safe::opt_r_item -} +{- $OpenSSL::safe::opt_provider_item -} + =back =head1 EXAMPLES diff --git a/doc/man1/openssl-enc.pod.in b/doc/man1/openssl-enc.pod.in index 6b8ab2a2..a2cb11a6 100644 --- a/doc/man1/openssl-enc.pod.in +++ b/doc/man1/openssl-enc.pod.in @@ -40,6 +40,7 @@ B B|I [B<-none>] {- $OpenSSL::safe::opt_engine_synopsis -} {- $OpenSSL::safe::opt_r_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =for openssl ifdef z engine ciphers @@ -197,6 +198,8 @@ Use NULL cipher (no encryption or decryption of input). {- $OpenSSL::safe::opt_r_item -} +{- $OpenSSL::safe::opt_provider_item -} + {- $OpenSSL::safe::opt_engine_item -} =back diff --git a/doc/man1/openssl-engine.pod b/doc/man1/openssl-engine.pod.in similarity index 98% rename from doc/man1/openssl-engine.pod rename to doc/man1/openssl-engine.pod.in index 7110ceec..c4b06653 100644 --- a/doc/man1/openssl-engine.pod +++ b/doc/man1/openssl-engine.pod.in @@ -1,4 +1,5 @@ =pod +{- OpenSSL::safe::output_do_not_edit_headers(); -} =head1 NAME diff --git a/doc/man1/openssl-errstr.pod b/doc/man1/openssl-errstr.pod.in similarity index 95% rename from doc/man1/openssl-errstr.pod rename to doc/man1/openssl-errstr.pod.in index ea838d9e..3a4e5163 100644 --- a/doc/man1/openssl-errstr.pod +++ b/doc/man1/openssl-errstr.pod.in @@ -1,4 +1,5 @@ =pod +{- OpenSSL::safe::output_do_not_edit_headers(); -} =head1 NAME diff --git a/doc/man1/openssl-fipsinstall.pod b/doc/man1/openssl-fipsinstall.pod.in similarity index 91% rename from doc/man1/openssl-fipsinstall.pod rename to doc/man1/openssl-fipsinstall.pod.in index 7cad6091..6ea3fca4 100644 --- a/doc/man1/openssl-fipsinstall.pod +++ b/doc/man1/openssl-fipsinstall.pod.in @@ -1,4 +1,5 @@ =pod +{- OpenSSL::safe::output_do_not_edit_headers(); -} =head1 NAME @@ -128,21 +129,21 @@ values that can be used. =head1 EXAMPLES Calculate the mac of a FIPS module F and run a FIPS self test -for the module, and save the F configuration file: +for the module, and save the F configuration file: - openssl fipsinstall -module ./fips.so -out fips.conf -provider_name fips \ + openssl fipsinstall -module ./fips.so -out fips.cnf -provider_name fips \ -section_name fipsinstall -mac_name HMAC -macopt digest:SHA256 \ -macopt hexkey:000102030405060708090A0B0C0D0E0F10111213 -Verify that the configuration file F contains the correct info: +Verify that the configuration file F contains the correct info: - openssl fipsinstall -module ./fips.so -in fips.conf -provider_name fips \ + openssl fipsinstall -module ./fips.so -in fips.cnf -provider_name fips \ -section_name fips_install -mac_name HMAC -macopt digest:SHA256 \ -macopt hexkey:000102030405060708090A0B0C0D0E0F10111213 -verify Corrupt any self tests which have the description 'SHA1': - openssl fipsinstall -module ./fips.so -out fips.conf -provider_name fips \ + openssl fipsinstall -module ./fips.so -out fips.cnf -provider_name fips \ -section_name fipsinstall -mac_name HMAC -macopt digest:SHA256 \ -macopt hexkey:000102030405060708090A0B0C0D0E0F10111213 \ -corrupt_desc', 'SHA1' diff --git a/doc/man1/openssl-gendsa.pod.in b/doc/man1/openssl-gendsa.pod.in index f1f8fe5b..88fc6118 100644 --- a/doc/man1/openssl-gendsa.pod.in +++ b/doc/man1/openssl-gendsa.pod.in @@ -26,6 +26,7 @@ B B [B<-verbose>] {- $OpenSSL::safe::opt_r_synopsis -} {- $OpenSSL::safe::opt_engine_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} [I] =for openssl ifdef engine @@ -76,6 +77,8 @@ The DSA parameter file to use. The parameters in this file determine the size of the private key. DSA parameters can be generated and examined using the L command. +{- $OpenSSL::safe::opt_provider_item -} + =back =head1 NOTES diff --git a/doc/man1/openssl-genpkey.pod.in b/doc/man1/openssl-genpkey.pod.in index c031f238..4f1128a0 100644 --- a/doc/man1/openssl-genpkey.pod.in +++ b/doc/man1/openssl-genpkey.pod.in @@ -23,6 +23,7 @@ B B [B<-genparam>] [B<-text>] {- $OpenSSL::safe::opt_engine_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =for openssl ifdef engine @@ -104,6 +105,8 @@ parameters along with the PEM or DER structure. {- $OpenSSL::safe::opt_engine_item -} +{- $OpenSSL::safe::opt_provider_item -} + =back =head1 KEY GENERATION OPTIONS diff --git a/doc/man1/openssl-genrsa.pod.in b/doc/man1/openssl-genrsa.pod.in index 348f8cbb..a351a53c 100644 --- a/doc/man1/openssl-genrsa.pod.in +++ b/doc/man1/openssl-genrsa.pod.in @@ -30,6 +30,7 @@ B B [B<-verbose>] {- $OpenSSL::safe::opt_r_synopsis -} {- $OpenSSL::safe::opt_engine_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} [B] =for openssl ifdef engine @@ -85,6 +86,8 @@ Print extra details about the operations being performed. {- $OpenSSL::safe::opt_engine_item -} +{- $OpenSSL::safe::opt_provider_item -} + =item B The size of the private key to generate in bits. This must be the last option diff --git a/doc/man1/openssl-info.pod b/doc/man1/openssl-info.pod.in similarity index 97% rename from doc/man1/openssl-info.pod rename to doc/man1/openssl-info.pod.in index 6e16bb80..c8965b2a 100644 --- a/doc/man1/openssl-info.pod +++ b/doc/man1/openssl-info.pod.in @@ -1,4 +1,5 @@ =pod +{- OpenSSL::safe::output_do_not_edit_headers(); -} =head1 NAME diff --git a/doc/man1/openssl-kdf.pod b/doc/man1/openssl-kdf.pod.in similarity index 97% rename from doc/man1/openssl-kdf.pod rename to doc/man1/openssl-kdf.pod.in index d89f84fd..d7d8732c 100644 --- a/doc/man1/openssl-kdf.pod +++ b/doc/man1/openssl-kdf.pod.in @@ -1,4 +1,5 @@ =pod +{- OpenSSL::safe::output_do_not_edit_headers(); -} =head1 NAME @@ -12,6 +13,7 @@ B [B<-keylen> I] [B<-out> I] [B<-binary>] +{- $OpenSSL::safe::opt_provider_synopsis -} I =head1 DESCRIPTION @@ -79,6 +81,8 @@ To see the list of supported digests, use the command I. =back +{- $OpenSSL::safe::opt_provider_item -} + =item I Specifies the name of a supported KDF algorithm which will be used. diff --git a/doc/man1/openssl-list.pod b/doc/man1/openssl-list.pod.in similarity index 96% rename from doc/man1/openssl-list.pod rename to doc/man1/openssl-list.pod.in index 88bcc751..4ac7b5dc 100644 --- a/doc/man1/openssl-list.pod +++ b/doc/man1/openssl-list.pod.in @@ -1,4 +1,5 @@ =pod +{- OpenSSL::safe::output_do_not_edit_headers(); -} =head1 NAME @@ -23,6 +24,7 @@ B [B<-disabled>] [B<-objects>] [B<-options> I] +{- $OpenSSL::safe::opt_provider_synopsis -} =head1 DESCRIPTION @@ -102,6 +104,8 @@ of what type of parameter it takes, if any. This is an internal option, used for checking that the documentation is complete. +{- $OpenSSL::safe::opt_provider_item -} + =back =head2 Display of algorithm names diff --git a/doc/man1/openssl-mac.pod b/doc/man1/openssl-mac.pod.in similarity index 96% rename from doc/man1/openssl-mac.pod rename to doc/man1/openssl-mac.pod.in index e5ec7639..30901490 100644 --- a/doc/man1/openssl-mac.pod +++ b/doc/man1/openssl-mac.pod.in @@ -1,4 +1,5 @@ =pod +{- OpenSSL::safe::output_do_not_edit_headers(); -} =head1 NAME @@ -12,6 +13,7 @@ B [B<-in> I] [B<-out> I] [B<-binary>] +{- $OpenSSL::safe::opt_provider_synopsis -} I =head1 DESCRIPTION @@ -99,6 +101,8 @@ The default is the empty string "". =back +{- $OpenSSL::safe::opt_provider_item -} + =item I Specifies the name of a supported MAC algorithm which will be used. diff --git a/doc/man1/openssl-nseq.pod b/doc/man1/openssl-nseq.pod.in similarity index 92% rename from doc/man1/openssl-nseq.pod rename to doc/man1/openssl-nseq.pod.in index 5404e1f3..02db1532 100644 --- a/doc/man1/openssl-nseq.pod +++ b/doc/man1/openssl-nseq.pod.in @@ -1,4 +1,5 @@ =pod +{- OpenSSL::safe::output_do_not_edit_headers(); -} =head1 NAME @@ -11,6 +12,7 @@ B B [B<-in> I] [B<-out> I] [B<-toseq>] +{- $OpenSSL::safe::opt_provider_synopsis -} =head1 DESCRIPTION @@ -48,6 +50,8 @@ is the certificates contained in it. With the B<-toseq> option the situation is reversed: a Netscape certificate sequence is created from a file of certificates. +{- $OpenSSL::safe::opt_provider_item -} + =back =head1 EXAMPLES diff --git a/doc/man1/openssl-ocsp.pod.in b/doc/man1/openssl-ocsp.pod.in index 6b4c25cd..efa627b8 100644 --- a/doc/man1/openssl-ocsp.pod.in +++ b/doc/man1/openssl-ocsp.pod.in @@ -70,6 +70,7 @@ B B [B<-I>] {- $OpenSSL::safe::opt_trust_synopsis -} {- $OpenSSL::safe::opt_v_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =for openssl ifdef multi @@ -269,6 +270,8 @@ digest used by subsequent certificate identifiers. {- $OpenSSL::safe::opt_v_item -} +{- $OpenSSL::safe::opt_provider_item -} + =back =head2 OCSP Server Options diff --git a/doc/man1/openssl-passwd.pod.in b/doc/man1/openssl-passwd.pod.in index 83ef7ba6..ce2b6913 100644 --- a/doc/man1/openssl-passwd.pod.in +++ b/doc/man1/openssl-passwd.pod.in @@ -23,6 +23,7 @@ B [B<-table>] [B<-reverse>] {- $OpenSSL::safe::opt_r_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} [I] =for openssl ifdef crypt @@ -100,6 +101,8 @@ When the B<-table> option is used, reverse the order of cleartext and hash. {- $OpenSSL::safe::opt_r_item -} +{- $OpenSSL::safe::opt_provider_item -} + =back =head1 EXAMPLES diff --git a/doc/man1/openssl-pkcs12.pod.in b/doc/man1/openssl-pkcs12.pod.in index 7d562b00..631eec72 100644 --- a/doc/man1/openssl-pkcs12.pod.in +++ b/doc/man1/openssl-pkcs12.pod.in @@ -57,6 +57,7 @@ B B {- $OpenSSL::safe::opt_trust_synopsis -} {- $OpenSSL::safe::opt_r_synopsis -} {- $OpenSSL::safe::opt_engine_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =for openssl ifdef engine @@ -293,6 +294,8 @@ Write I as a Microsoft CSP name. {- $OpenSSL::safe::opt_engine_item -} +{- $OpenSSL::safe::opt_provider_item -} + =back =head1 NOTES diff --git a/doc/man1/openssl-pkcs7.pod.in b/doc/man1/openssl-pkcs7.pod.in index 77ef9f95..0a12d237 100644 --- a/doc/man1/openssl-pkcs7.pod.in +++ b/doc/man1/openssl-pkcs7.pod.in @@ -22,6 +22,7 @@ B B [B<-text>] [B<-noout>] {- $OpenSSL::safe::opt_engine_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =for openssl ifdef engine @@ -77,6 +78,8 @@ if B<-print_certs> is set). {- $OpenSSL::safe::opt_engine_item -} +{- $OpenSSL::safe::opt_provider_item -} + =back =head1 EXAMPLES diff --git a/doc/man1/openssl-pkcs8.pod.in b/doc/man1/openssl-pkcs8.pod.in index 34b469dd..f9e5fb1d 100644 --- a/doc/man1/openssl-pkcs8.pod.in +++ b/doc/man1/openssl-pkcs8.pod.in @@ -29,6 +29,7 @@ B B [B<-scrypt_p> I

] {- $OpenSSL::safe::opt_r_synopsis -} {- $OpenSSL::safe::opt_engine_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =for openssl ifdef engine scrypt scrypt_N scrypt_r scrypt_p @@ -150,6 +151,8 @@ Sets the scrypt I, I or I

parameters. {- $OpenSSL::safe::opt_engine_item -} +{- $OpenSSL::safe::opt_provider_item -} + =back =head1 NOTES diff --git a/doc/man1/openssl-pkey.pod.in b/doc/man1/openssl-pkey.pod.in index 31bf005f..8460aed1 100644 --- a/doc/man1/openssl-pkey.pod.in +++ b/doc/man1/openssl-pkey.pod.in @@ -31,6 +31,7 @@ B B [B<-ec_conv_form> I] [B<-ec_param_enc> I] {- $OpenSSL::safe::opt_engine_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =for openssl ifdef engine @@ -142,6 +143,8 @@ is currently not implemented in OpenSSL. {- $OpenSSL::safe::opt_engine_item -} +{- $OpenSSL::safe::opt_provider_item -} + =back =head1 EXAMPLES diff --git a/doc/man1/openssl-pkeyparam.pod.in b/doc/man1/openssl-pkeyparam.pod.in index 44881191..7f9d351a 100644 --- a/doc/man1/openssl-pkeyparam.pod.in +++ b/doc/man1/openssl-pkeyparam.pod.in @@ -19,6 +19,7 @@ B B [B<-noout>] [B<-check>] {- $OpenSSL::safe::opt_engine_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =for openssl ifdef engine @@ -59,6 +60,8 @@ This option checks the correctness of parameters. {- $OpenSSL::safe::opt_engine_item -} +{- $OpenSSL::safe::opt_provider_item -} + =back =head1 EXAMPLES diff --git a/doc/man1/openssl-pkeyutl.pod.in b/doc/man1/openssl-pkeyutl.pod.in index c239a046..0bca4838 100644 --- a/doc/man1/openssl-pkeyutl.pod.in +++ b/doc/man1/openssl-pkeyutl.pod.in @@ -37,6 +37,7 @@ B B {- $OpenSSL::safe::opt_engine_synopsis -} [B<-engine_impl>] {- $OpenSSL::safe::opt_r_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =for openssl ifdef engine engine_impl @@ -188,6 +189,8 @@ engine I for crypto operations. {- $OpenSSL::safe::opt_r_item -} +{- $OpenSSL::safe::opt_provider_item -} + =back =head1 NOTES diff --git a/doc/man1/openssl-prime.pod b/doc/man1/openssl-prime.pod.in similarity index 89% rename from doc/man1/openssl-prime.pod rename to doc/man1/openssl-prime.pod.in index aa9af221..3aee9014 100644 --- a/doc/man1/openssl-prime.pod +++ b/doc/man1/openssl-prime.pod.in @@ -1,4 +1,5 @@ =pod +{- OpenSSL::safe::output_do_not_edit_headers(); -} =head1 NAME @@ -12,6 +13,7 @@ B [B<-generate>] [B<-bits> I] [B<-safe>] +{- $OpenSSL::safe::opt_provider_synopsis -} [B<-checks> I] [I ...] @@ -48,6 +50,8 @@ Generate a prime with I bits. When used with B<-generate>, generates a "safe" prime. If the number generated is I, then check that C<(I-1)/2> is also prime. +{- $OpenSSL::safe::opt_provider_item -} + =item B<-checks> I This parameter is ignored. diff --git a/doc/man1/openssl-provider.pod b/doc/man1/openssl-provider.pod.in similarity index 95% rename from doc/man1/openssl-provider.pod rename to doc/man1/openssl-provider.pod.in index b29d2f5a..774f92b9 100644 --- a/doc/man1/openssl-provider.pod +++ b/doc/man1/openssl-provider.pod.in @@ -1,4 +1,5 @@ =pod +{- OpenSSL::safe::output_do_not_edit_headers(); -} =head1 NAME diff --git a/doc/man1/openssl-rand.pod.in b/doc/man1/openssl-rand.pod.in index b8a01750..8a6c8933 100644 --- a/doc/man1/openssl-rand.pod.in +++ b/doc/man1/openssl-rand.pod.in @@ -14,6 +14,7 @@ B [B<-hex>] {- $OpenSSL::safe::opt_engine_synopsis -} {- $OpenSSL::safe::opt_r_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} I =for openssl ifdef engine @@ -26,7 +27,7 @@ secure pseudo random number generator (CSPRNG). The random bytes are generated using the L function, which provides a security level of 256 bits, provided it managed to seed itself successfully from a trusted operating system entropy source. -Otherwise, the command will fail with a non-zero error code. +Otherwise, the command will fail with a nonzero error code. For more details, see L, L, and L. =head1 OPTIONS @@ -53,6 +54,8 @@ Show the output as a hex string. {- $OpenSSL::safe::opt_r_item -} +{- $OpenSSL::safe::opt_provider_item -} + =back =head1 SEE ALSO diff --git a/doc/man1/openssl-rehash.pod b/doc/man1/openssl-rehash.pod.in similarity index 95% rename from doc/man1/openssl-rehash.pod rename to doc/man1/openssl-rehash.pod.in index 241f2253..e21d07e9 100644 --- a/doc/man1/openssl-rehash.pod +++ b/doc/man1/openssl-rehash.pod.in @@ -1,4 +1,5 @@ =pod +{- OpenSSL::safe::output_do_not_edit_headers(); -} =for comment Original text by James Westby, contributed under the OpenSSL license. @@ -18,6 +19,7 @@ B [B<-compat>] [B<-n>] [B<-v>] +{- $OpenSSL::safe::opt_provider_synopsis -} [I] ... B @@ -26,6 +28,7 @@ B [B<-old>] [B<-n>] [B<-v>] +{- $OpenSSL::safe::opt_provider_synopsis -} [I] ... =head1 DESCRIPTION @@ -116,6 +119,8 @@ releases. Print messages about old links removed and new links created. By default, this command only lists each directory as it is processed. +{- $OpenSSL::safe::opt_provider_item -} + =back =head1 ENVIRONMENT diff --git a/doc/man1/openssl-req.pod.in b/doc/man1/openssl-req.pod.in index 598e6a8d..7587cb5a 100644 --- a/doc/man1/openssl-req.pod.in +++ b/doc/man1/openssl-req.pod.in @@ -30,6 +30,7 @@ B B [B<-keygen_engine> I] [B<-I>] [B<-config> I] +[B<-section> I] [B<-multivalue-rdn>] [B<-x509>] [B<-days> I] @@ -51,6 +52,7 @@ B B {- $OpenSSL::safe::opt_name_synopsis -} {- $OpenSSL::safe::opt_r_synopsis -} {- $OpenSSL::safe::opt_engine_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =for openssl ifdef engine keygen_engine sm2-id sm2-hex-id @@ -205,6 +207,10 @@ This allows an alternative configuration file to be specified. Optional; for a description of the default value, see L. +=item B<-section> I + +Specifies the name of the section to use; the default is B. + =item B<-subj> I Sets subject name for new request or supersedes the subject name @@ -323,13 +329,17 @@ argument for this option is string of hexadecimal digits. {- $OpenSSL::safe::opt_engine_item -} +{- $OpenSSL::safe::opt_provider_item -} + =back =head1 CONFIGURATION FILE FORMAT The configuration options are specified in the B section of -the configuration file. As with all configuration files if no -value is specified in the specific section (i.e. B) then +the configuration file. An alternate name be specified by using the +B<-section> option. +As with all configuration files, if no +value is specified in the specific section then the initial unnamed or B section is searched too. The options available are described in detail below. @@ -675,6 +685,10 @@ L, L, L +=head1 HISTORY + +The B<-section> option was added in OpenSSL 3.0.0. + =head1 COPYRIGHT Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man1/openssl-rsa.pod.in b/doc/man1/openssl-rsa.pod.in index 5b867225..e2c0b24a 100644 --- a/doc/man1/openssl-rsa.pod.in +++ b/doc/man1/openssl-rsa.pod.in @@ -40,6 +40,7 @@ B B [B<-RSAPublicKey_in>] [B<-RSAPublicKey_out>] {- $OpenSSL::safe::opt_engine_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =for openssl ifdef pvk-strong pvk-weak pvk-none engine @@ -136,6 +137,8 @@ Like B<-pubin> and B<-pubout> except B format is used instead. {- $OpenSSL::safe::opt_engine_item -} +{- $OpenSSL::safe::opt_provider_item -} + =back =head1 EXAMPLES diff --git a/doc/man1/openssl-rsautl.pod.in b/doc/man1/openssl-rsautl.pod.in index 1a3a1516..d28e6728 100644 --- a/doc/man1/openssl-rsautl.pod.in +++ b/doc/man1/openssl-rsautl.pod.in @@ -33,6 +33,7 @@ B B [B<-asn1parse>] {- $OpenSSL::safe::opt_engine_synopsis -} {- $OpenSSL::safe::opt_r_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =for openssl ifdef engine @@ -126,6 +127,8 @@ B<-verify> option. {- $OpenSSL::safe::opt_r_item -} +{- $OpenSSL::safe::opt_provider_item -} + =back =head1 NOTES diff --git a/doc/man1/openssl-s_client.pod.in b/doc/man1/openssl-s_client.pod.in index 0d3f54e1..982c54ae 100644 --- a/doc/man1/openssl-s_client.pod.in +++ b/doc/man1/openssl-s_client.pod.in @@ -120,6 +120,7 @@ B B {- $OpenSSL::safe::opt_trust_synopsis -} {- $OpenSSL::safe::opt_s_synopsis -} {- $OpenSSL::safe::opt_r_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} {- $OpenSSL::safe::opt_engine_synopsis -} [B<-ssl_client_engine> I] {- $OpenSSL::safe::opt_v_synopsis -} @@ -758,6 +759,8 @@ Set the minimal acceptable length, in bits, for B. {- $OpenSSL::safe::opt_r_item -} +{- $OpenSSL::safe::opt_provider_item -} + {- $OpenSSL::safe::opt_engine_item -} =item B<-ssl_client_engine> I diff --git a/doc/man1/openssl-s_server.pod.in b/doc/man1/openssl-s_server.pod.in index b31d4f6a..9a5ef10d 100644 --- a/doc/man1/openssl-s_server.pod.in +++ b/doc/man1/openssl-s_server.pod.in @@ -140,6 +140,7 @@ B B {- $OpenSSL::safe::opt_trust_synopsis -} {- $OpenSSL::safe::opt_r_synopsis -} {- $OpenSSL::safe::opt_engine_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =for openssl ifdef unix 4 6 unlink no_dhe nextprotoneg use_srtp engine @@ -661,6 +662,8 @@ data that was sent will be rejected. {- $OpenSSL::safe::opt_engine_item -} +{- $OpenSSL::safe::opt_provider_item -} + {- $OpenSSL::safe::opt_v_item -} If the server requests a client certificate, then diff --git a/doc/man1/openssl-s_time.pod.in b/doc/man1/openssl-s_time.pod.in index cf875910..8cdc2b43 100644 --- a/doc/man1/openssl-s_time.pod.in +++ b/doc/man1/openssl-s_time.pod.in @@ -28,6 +28,7 @@ B B {- $OpenSSL::safe::opt_name_synopsis -} [B<-cafile> I] {- $OpenSSL::safe::opt_trust_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =for openssl ifdef ssl3 tls1 tls1_1 tls1_2 tls1_3 @@ -122,6 +123,8 @@ can establish. {- $OpenSSL::safe::opt_trust_item -} +{- $OpenSSL::safe::opt_provider_item -} + =item B<-cafile> I This is an obsolete synonym for B<-CAfile>. diff --git a/doc/man1/openssl-sess_id.pod b/doc/man1/openssl-sess_id.pod.in similarity index 98% rename from doc/man1/openssl-sess_id.pod rename to doc/man1/openssl-sess_id.pod.in index bb49dbd5..f68f1807 100644 --- a/doc/man1/openssl-sess_id.pod +++ b/doc/man1/openssl-sess_id.pod.in @@ -1,4 +1,5 @@ =pod +{- OpenSSL::safe::output_do_not_edit_headers(); -} =head1 NAME diff --git a/doc/man1/openssl-smime.pod.in b/doc/man1/openssl-smime.pod.in index e9500924..c6775505 100644 --- a/doc/man1/openssl-smime.pod.in +++ b/doc/man1/openssl-smime.pod.in @@ -49,6 +49,7 @@ B B {- $OpenSSL::safe::opt_engine_synopsis -} {- $OpenSSL::safe::opt_r_synopsis -} {- $OpenSSL::safe::opt_v_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} I ... =for openssl ifdef engine @@ -288,6 +289,8 @@ Any verification errors cause the command to exit. {- $OpenSSL::safe::opt_r_item -} +{- $OpenSSL::safe::opt_provider_item -} + =item I ... One or more certificates of message recipients, used when encrypting diff --git a/doc/man1/openssl-speed.pod.in b/doc/man1/openssl-speed.pod.in index a15320c0..ac0e6b1c 100644 --- a/doc/man1/openssl-speed.pod.in +++ b/doc/man1/openssl-speed.pod.in @@ -25,6 +25,7 @@ B [B<-mr>] {- $OpenSSL::safe::opt_r_synopsis -} {- $OpenSSL::safe::opt_engine_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} [I ...] =for openssl ifdef hmac cmac multi async_jobs engine @@ -103,6 +104,8 @@ Produce the summary in a mechanical, machine-readable, format. {- $OpenSSL::safe::opt_engine_item -} +{- $OpenSSL::safe::opt_provider_item -} + =item I ... If any I is given, then those algorithms are tested, otherwise a diff --git a/doc/man1/openssl-spkac.pod.in b/doc/man1/openssl-spkac.pod.in index bfb17d12..4ea15fa5 100644 --- a/doc/man1/openssl-spkac.pod.in +++ b/doc/man1/openssl-spkac.pod.in @@ -25,6 +25,7 @@ B B [B<-noout>] [B<-verify>] {- $OpenSSL::safe::opt_engine_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =for openssl ifdef engine @@ -99,6 +100,8 @@ Verifies the digital signature on the supplied SPKAC. {- $OpenSSL::safe::opt_engine_item -} +{- $OpenSSL::safe::opt_provider_item -} + =back =head1 EXAMPLES diff --git a/doc/man1/openssl-srp.pod.in b/doc/man1/openssl-srp.pod.in index e9955d5c..ce480246 100644 --- a/doc/man1/openssl-srp.pod.in +++ b/doc/man1/openssl-srp.pod.in @@ -23,6 +23,7 @@ B [B<-passout> I] {- $OpenSSL::safe::opt_engine_synopsis -} {- $OpenSSL::safe::opt_r_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} [I ...] =for openssl ifdef engine @@ -74,6 +75,8 @@ see L. {- $OpenSSL::safe::opt_engine_item -} +{- $OpenSSL::safe::opt_provider_item -} + {- $OpenSSL::safe::opt_r_synopsis -} =back diff --git a/doc/man1/openssl-storeutl.pod.in b/doc/man1/openssl-storeutl.pod.in index 3bfca087..75c30651 100644 --- a/doc/man1/openssl-storeutl.pod.in +++ b/doc/man1/openssl-storeutl.pod.in @@ -28,6 +28,7 @@ B B [B<-fingerprint> I] [B<-I>] {- $OpenSSL::safe::opt_engine_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} I ... =head1 DESCRIPTION @@ -110,6 +111,8 @@ The digest that was used to compute the fingerprint given with B<-fingerprint>. {- $OpenSSL::safe::opt_engine_item -} +{- $OpenSSL::safe::opt_provider_item -} + =back =head1 SEE ALSO diff --git a/doc/man1/openssl-ts.pod.in b/doc/man1/openssl-ts.pod.in index f115f450..8d5e66e6 100644 --- a/doc/man1/openssl-ts.pod.in +++ b/doc/man1/openssl-ts.pod.in @@ -23,6 +23,7 @@ B<-query> [B<-out> I] [B<-text>] {- $OpenSSL::safe::opt_r_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} B B B<-reply> @@ -42,6 +43,7 @@ B<-reply> [B<-token_out>] [B<-text>] {- $OpenSSL::safe::opt_engine_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} B B B<-verify> @@ -54,6 +56,7 @@ B<-verify> [B<-CApath> I

] [B<-CAstore> I] {- $OpenSSL::safe::opt_v_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =for openssl ifdef engine @@ -285,6 +288,8 @@ instead of DER. (Optional) {- $OpenSSL::safe::opt_engine_item -} +{- $OpenSSL::safe::opt_provider_item -} + =back =head2 Timestamp Response verification diff --git a/doc/man1/openssl-verify.pod.in b/doc/man1/openssl-verify.pod.in index 3f13f307..fd41bbeb 100644 --- a/doc/man1/openssl-verify.pod.in +++ b/doc/man1/openssl-verify.pod.in @@ -21,6 +21,7 @@ B B {- $OpenSSL::safe::opt_trust_synopsis -} {- $OpenSSL::safe::opt_engine_synopsis -} {- $OpenSSL::safe::opt_v_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} [B<-->] [I ...] @@ -91,6 +92,8 @@ B<-trusted>, B<-untrusted> or B<-CRLfile> options. {- $OpenSSL::safe::opt_v_item -} +{- $OpenSSL::safe::opt_provider_item -} + =item B<--> Indicates the last option. All arguments following this are assumed to be diff --git a/doc/man1/openssl-version.pod b/doc/man1/openssl-version.pod.in similarity index 96% rename from doc/man1/openssl-version.pod rename to doc/man1/openssl-version.pod.in index 62d50ce7..d2aaaecb 100644 --- a/doc/man1/openssl-version.pod +++ b/doc/man1/openssl-version.pod.in @@ -1,4 +1,5 @@ =pod +{- OpenSSL::safe::output_do_not_edit_headers(); -} =head1 NAME diff --git a/doc/man1/openssl-x509.pod.in b/doc/man1/openssl-x509.pod.in index 1ec21101..8cf03d93 100644 --- a/doc/man1/openssl-x509.pod.in +++ b/doc/man1/openssl-x509.pod.in @@ -75,6 +75,7 @@ B B {- $OpenSSL::safe::opt_name_synopsis -} {- $OpenSSL::safe::opt_r_synopsis -} {- $OpenSSL::safe::opt_engine_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =for openssl ifdef engine subject_hash_old issuer_hash_old @@ -135,6 +136,8 @@ Cannot be used with the B<-days> option. {- $OpenSSL::safe::opt_engine_item -} +{- $OpenSSL::safe::opt_provider_item -} + =back =head2 Display Options diff --git a/doc/man1/openssl.pod b/doc/man1/openssl.pod index bd3daa1a..2f56ab75 100644 --- a/doc/man1/openssl.pod +++ b/doc/man1/openssl.pod @@ -755,6 +755,26 @@ This file can be used in a subsequent command invocation. =back +=head2 Provider Options + +With the move to provider based cryptographic operations in OpenSSL 3.0, +options were added to allow specific providers or sets of providers to be used. + +=over 4 + +=item B<-provider> I + +Use the provider identified by I and use all the methods it +implements (algorithms, key storage, etc.). This option can be specified +multiple time to load more than one provider. + +=item B<-provider_path> I + +Specify the search I that is used to locate provider modules. The format +of I varies depending on the operating system being used. + +=back + =head2 Extended Verification Options Sometimes there may be more than one certificate chain leading to an diff --git a/doc/man3/CMS_add1_recipient_cert.pod b/doc/man3/CMS_add1_recipient_cert.pod index b68183d1..34d1e0ee 100644 --- a/doc/man3/CMS_add1_recipient_cert.pod +++ b/doc/man3/CMS_add1_recipient_cert.pod @@ -2,12 +2,16 @@ =head1 NAME -CMS_add1_recipient_cert, CMS_add0_recipient_key - add recipients to a CMS enveloped data structure +CMS_add1_recipient, CMS_add1_recipient_cert, CMS_add0_recipient_key - add recipients to a CMS enveloped data structure =head1 SYNOPSIS #include + CMS_RecipientInfo *CMS_add1_recipient(CMS_ContentInfo *cms, X509 *recip, + EVP_PKEY *originatorPrivKey, + X509 *originator, unsigned int flags); + CMS_RecipientInfo *CMS_add1_recipient_cert(CMS_ContentInfo *cms, X509 *recip, unsigned int flags); @@ -20,6 +24,11 @@ CMS_add1_recipient_cert, CMS_add0_recipient_key - add recipients to a CMS envelo =head1 DESCRIPTION +CMS_add1_recipient() adds recipient B and provides the originator pkey +B and originator certificate B to CMS_ContentInfo. +The originator-related fields are relevant only in case when the keyAgreement +method of providing of the shared key is in use. + CMS_add1_recipient_cert() adds recipient B to CMS_ContentInfo enveloped data structure B as a KeyTransRecipientInfo structure. @@ -60,9 +69,14 @@ occurs. L, L, L, +=head1 HISTORY + +B and B were added in +OpenSSL 3.0. + =head1 COPYRIGHT -Copyright 2008-2016 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2008-2020 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/CMS_decrypt.pod b/doc/man3/CMS_decrypt.pod index 0c5834c5..3124fa83 100644 --- a/doc/man3/CMS_decrypt.pod +++ b/doc/man3/CMS_decrypt.pod @@ -2,7 +2,8 @@ =head1 NAME -CMS_decrypt - decrypt content from a CMS envelopedData structure +CMS_decrypt, CMS_decrypt_set1_pkey_and_peer, CMS_decrypt_set1_pkey - decrypt +content from a CMS envelopedData structure =head1 SYNOPSIS @@ -10,6 +11,9 @@ CMS_decrypt - decrypt content from a CMS envelopedData structure int CMS_decrypt(CMS_ContentInfo *cms, EVP_PKEY *pkey, X509 *cert, BIO *dcont, BIO *out, unsigned int flags); + int CMS_decrypt_set1_pkey_and_peer(CMS_ContentInfo *cms, + EVP_PKEY *pk, X509 *cert, X509 *peer); + int CMS_decrypt_set1_pkey(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert); =head1 DESCRIPTION @@ -21,6 +25,13 @@ B is an optional set of flags. The B parameter is used in the rare case where the encrypted content is detached. It will normally be set to NULL. +CMS_decrypt_set1_pkey_and_peer() associates the private key B, the +corresponding certificate B and the originator certificate B with +the CMS_ContentInfo structure B. + +CMS_decrypt_set1_pkey() associates the private key B, corresponding +certificate B with the CMS_ContentInfo structure B. + =head1 NOTES Although the recipients certificate is not needed to decrypt the data it is @@ -70,9 +81,13 @@ mentioned in CMS_verify() also applies to CMS_decrypt(). L, L +=head1 HISTORY + +B was added in OpenSSL 3.0. + =head1 COPYRIGHT -Copyright 2008-2016 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2008-2020 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/CMS_get0_RecipientInfos.pod b/doc/man3/CMS_get0_RecipientInfos.pod index 5d19e3d1..c6354381 100644 --- a/doc/man3/CMS_get0_RecipientInfos.pod +++ b/doc/man3/CMS_get0_RecipientInfos.pod @@ -5,6 +5,8 @@ CMS_get0_RecipientInfos, CMS_RecipientInfo_type, CMS_RecipientInfo_ktri_get0_signer_id, CMS_RecipientInfo_ktri_cert_cmp, CMS_RecipientInfo_set0_pkey, CMS_RecipientInfo_kekri_get0_id, +CMS_RecipientInfo_kari_set0_pkey_and_peer, +CMS_RecipientInfo_kari_set0_pkey, CMS_RecipientInfo_kekri_id_cmp, CMS_RecipientInfo_set0_key, CMS_RecipientInfo_decrypt, CMS_RecipientInfo_encrypt - CMS envelopedData RecipientInfo routines @@ -22,7 +24,9 @@ CMS_RecipientInfo_decrypt, CMS_RecipientInfo_encrypt ASN1_INTEGER **sno); int CMS_RecipientInfo_ktri_cert_cmp(CMS_RecipientInfo *ri, X509 *cert); int CMS_RecipientInfo_set0_pkey(CMS_RecipientInfo *ri, EVP_PKEY *pkey); - + int CMS_RecipientInfo_kari_set0_pkey_and_peer(CMS_RecipientInfo *ri, + EVP_PKEY *pk, X509 *peer); + int CMS_RecipientInfo_kari_set0_pkey(CMS_RecipientInfo *ri, EVP_PKEY *pk); int CMS_RecipientInfo_kekri_get0_id(CMS_RecipientInfo *ri, X509_ALGOR **palg, ASN1_OCTET_STRING **pid, ASN1_GENERALIZEDTIME **pdate, @@ -58,6 +62,13 @@ CMS_RecipientInfo_set0_pkey() associates the private key B with the CMS_RecipientInfo structure B, which must be of type CMS_RECIPINFO_TRANS. +CMS_RecipientInfo_kari_set0_pkey_and_peer() associates the private key B +and peer certificate B with the CMS_RecipientInfo structure B, which +must be of type CMS_RECIPINFO_AGREE. + +CMS_RecipientInfo_kari_set0_pkey() associates the private key B with the +CMS_RecipientInfo structure B, which must be of type CMS_RECIPINFO_AGREE. + CMS_RecipientInfo_kekri_get0_id() retrieves the key information from the CMS_RecipientInfo structure B which must be of type CMS_RECIPINFO_KEK. Any of the remaining parameters can be NULL if the application is not interested in @@ -127,9 +138,14 @@ Any error can be obtained from L. L, L +=head1 HISTORY + +B and B +were added in OpenSSL 3.0. + =head1 COPYRIGHT -Copyright 2008-2016 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2008-2020 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/DH_get0_pqg.pod b/doc/man3/DH_get0_pqg.pod index ab49a325..3806dab3 100644 --- a/doc/man3/DH_get0_pqg.pod +++ b/doc/man3/DH_get0_pqg.pod @@ -37,31 +37,38 @@ L: =head1 DESCRIPTION -A DH object contains the parameters B

, B and B. Note that the B -parameter is optional. It also contains a public key (B) and -(optionally) a private key (B). +A DH object contains the parameters I

, I and I. Note that the I +parameter is optional. It also contains a public key (I) and +(optionally) a private key (I). -The B

, B and B parameters can be obtained by calling DH_get0_pqg(). -If the parameters have not yet been set then B<*p>, B<*q> and B<*g> will be set +The I

, I and I parameters can be obtained by calling DH_get0_pqg(). +If the parameters have not yet been set then I<*p>, I<*q> and I<*g> will be set to NULL. Otherwise they are set to pointers to their respective values. These point directly to the internal representations of the values and therefore should not be freed directly. -Any of the out parameters B

, B, and B can be NULL, in which case no +Any of the out parameters I

, I, and I can be NULL, in which case no value will be returned for that parameter. -The B

, B and B values can be set by calling DH_set0_pqg() and passing -the new values for B

, B and B as parameters to the function. Calling +The I

, I and I values can be set by calling DH_set0_pqg() and passing +the new values for I

, I and I as parameters to the function. Calling this function transfers the memory management of the values to the DH object, and therefore the values that have been passed in should not be freed directly -after this function has been called. The B parameter may be NULL. +after this function has been called. The I parameter may be NULL. +DH_set0_pqg() also checks if the parameters associated with I

and I and +optionally I are associated with known safe prime groups. If it is a safe +prime group then the value of I will be set to q = (p - 1) / 2 if I is NULL. +For safe prime groups the optional length parameter I is set to twice +the value of the maximum_target_security_strength(BN_num_bits(I

)) as listed in +SP800-56Ar3 Table(s) 25 & 26. If it is not a safe prime group then the optional +length parameter will be set if I is not NULL to BN_num_bits(I). To get the public and private key values use the DH_get0_key() function. A -pointer to the public key will be stored in B<*pub_key>, and a pointer to the -private key will be stored in B<*priv_key>. Either may be NULL if they have not +pointer to the public key will be stored in I<*pub_key>, and a pointer to the +private key will be stored in I<*priv_key>. Either may be NULL if they have not been set yet, although if the private key has been set then the public key must be. The values point to the internal representation of the public key and private key values. This memory should not be freed directly. -Any of the out parameters B and B can be NULL, in which case +Any of the out parameters I and I can be NULL, in which case no value will be returned for that parameter. The public and private key values can be set using DH_set0_key(). Either @@ -70,14 +77,14 @@ untouched. As with DH_set0_pqg() this function transfers the memory management of the key values to the DH object, and therefore they should not be freed directly after this function has been called. -Any of the values B

, B, B, B, and B can also be +Any of the values I

, I, I, I, and I can also be retrieved separately by the corresponding function DH_get0_p(), DH_get0_q(), DH_get0_g(), DH_get0_priv_key(), and DH_get0_pub_key(), respectively. -DH_set_flags() sets the flags in the B parameter on the DH object. +DH_set_flags() sets the flags in the I parameter on the DH object. Multiple flags can be passed in one go (bitwise ORed together). Any flags that are already set are left set. DH_test_flags() tests to see whether the flags -passed in the B parameter are currently set in the DH object. Multiple +passed in the I parameter are currently set in the DH object. Multiple flags can be tested in one go. All flags that are currently set are returned, or zero if none of the flags are set. DH_clear_flags() clears the specified flags within the DH object. @@ -87,7 +94,7 @@ object, or NULL if no such ENGINE has been set. This function is deprecated. The DH_get_length() and DH_set_length() functions get and set the optional length parameter associated with this DH object. If the length is nonzero then -it is used, otherwise it is ignored. The B parameter indicates the +it is used, otherwise it is ignored. The I parameter indicates the length of the secret exponent (private key) in bits. These functions are deprecated. diff --git a/doc/man3/DH_new_by_nid.pod b/doc/man3/DH_new_by_nid.pod index 3456b9d5..a333ecb6 100644 --- a/doc/man3/DH_new_by_nid.pod +++ b/doc/man3/DH_new_by_nid.pod @@ -24,15 +24,22 @@ B, B, B, B, B or B. DH_get_nid() determines if the parameters contained in B match -any named set. It returns the NID corresponding to the matching parameters or -B if there is no match. This function is deprecated. +any named safe prime group. It returns the NID corresponding to the matching +parameters or B if there is no match. +Internally it caches the nid, so that any subsequent calls can fetch the +cached value. +If a matching p and g are not found and the value of parameter q is not set, +then it is set to q = (p - 1) / 2. +If parameter q is already set then it must also match the expected q otherwise +no match will be found. +This function is deprecated. =head1 RETURN VALUES DH_new_by_nid() returns a set of DH parameters or B if an error occurred. -DH_get_nid() returns the NID of the matching set of parameters or -B if there is no match. +DH_get_nid() returns the NID of the matching set of parameters for p and g +and optionally q, otherwise it returns B if there is no match. =head1 HISTORY diff --git a/doc/man3/EVP_PKEY_new.pod b/doc/man3/EVP_PKEY_new.pod index 3a2034d3..755587fa 100644 --- a/doc/man3/EVP_PKEY_new.pod +++ b/doc/man3/EVP_PKEY_new.pod @@ -72,21 +72,24 @@ EVP_PKEY_new_mac_key() works in the same way as EVP_PKEY_new_raw_private_key(). New applications should use EVP_PKEY_new_raw_private_key() instead. EVP_PKEY_get_raw_private_key() fills the buffer provided by B with raw -private key data. The number of bytes written is populated in B<*len>. If the -buffer B is NULL then B<*len> is populated with the number of bytes -required to hold the key. The calling application is responsible for ensuring -that the buffer is large enough to receive the private key data. This function -only works for algorithms that support raw private keys. Currently this is: -B, B, B, B, -B, B or B. +private key data. The size of the B buffer should be in B<*len> on entry +to the function, and on exit B<*len> is updated with the number of bytes +actually written. If the buffer B is NULL then B<*len> is populated with +the number of bytes required to hold the key. The calling application is +responsible for ensuring that the buffer is large enough to receive the private +key data. This function only works for algorithms that support raw private keys. +Currently this is: B, B, B, +B, B, B or B. EVP_PKEY_get_raw_public_key() fills the buffer provided by B with raw -public key data. The number of bytes written is populated in B<*len>. If the -buffer B is NULL then B<*len> is populated with the number of bytes -required to hold the key. The calling application is responsible for ensuring -that the buffer is large enough to receive the public key data. This function -only works for algorithms that support raw public keys. Currently this is: -B, B, B or B. +public key data. The size of the B buffer should be in B<*len> on entry +to the function, and on exit B<*len> is updated with the number of bytes +actually written. If the buffer B is NULL then B<*len> is populated with +the number of bytes required to hold the key. The calling application is +responsible for ensuring that the buffer is large enough to receive the public +key data. This function only works for algorithms that support raw public keys. +Currently this is: B, B, B or +B. =head1 NOTES diff --git a/doc/man3/OSSL_PROVIDER.pod b/doc/man3/OSSL_PROVIDER.pod index f4f8a3bd..8cedbadf 100644 --- a/doc/man3/OSSL_PROVIDER.pod +++ b/doc/man3/OSSL_PROVIDER.pod @@ -2,6 +2,7 @@ =head1 NAME +OSSL_PROVIDER_set_default_search_path, OSSL_PROVIDER, OSSL_PROVIDER_load, OSSL_PROVIDER_unload, OSSL_PROVIDER_available, OSSL_PROVIDER_gettable_params, OSSL_PROVIDER_get_params, @@ -13,6 +14,9 @@ OSSL_PROVIDER_add_builtin, OSSL_PROVIDER_name - provider routines typedef struct ossl_provider_st OSSL_PROVIDER; + void OSSL_PROVIDER_set_default_search_path(OPENSSL_CTX *libctx, + const char *path); + OSSL_PROVIDER *OSSL_PROVIDER_load(OPENSSL_CTX *libctx, const char *name); int OSSL_PROVIDER_unload(OSSL_PROVIDER *prov); int OSSL_PROVIDER_available(OPENSSL_CTX *libctx, const char *name); @@ -39,6 +43,11 @@ L for further details. =head2 Functions +OSSL_PROVIDER_set_default_search_path() specifies the default search B +that is to be used for looking for providers in the specified B. +If left unspecified, an environment variable and a fall back default value will +be used instead. + OSSL_PROVIDER_add_builtin() is used to add a built in provider to B store in the given library context, by associating a provider name with a provider initialization function. diff --git a/doc/man7/openssl-env.pod b/doc/man7/openssl-env.pod index be89f851..f59cd596 100644 --- a/doc/man7/openssl-env.pod +++ b/doc/man7/openssl-env.pod @@ -20,15 +20,22 @@ See L. =item B -Specifies the path to the B executable. Only used by -the B script. -See L. +Specifies the path to the B executable. Used by +the B script (see L) +and by the B script (see L -=item B +=item B, B -Specifies the path to a configuration file. +Specifies the path to a configuration file and the directory for +included files. See L and L. +=item B + +Specifies a configuration option and filename for the B and B +commands invoked by the B script. +See L. + =item B Specifies the directory from which dynamic engines are loaded. diff --git a/doc/man7/provider-keymgmt.pod b/doc/man7/provider-keymgmt.pod index 91b87cec..0f765f77 100644 --- a/doc/man7/provider-keymgmt.pod +++ b/doc/man7/provider-keymgmt.pod @@ -354,6 +354,32 @@ The private key value. =back +=head2 Built-in EC Import/Export Types + +The following Import/Export types are available for the built-in EC algorithm: + +=over 4 + +=item "curve-name" (B) + +The EC curve name. + +=item "use-cofactor-flag" (B) + +Enable Cofactor DH (ECC CDH) if this value is 1, otherwise it uses normal EC DH +if the value is zero. The cofactor variant multiplies the shared secret by the +EC curve's cofactor (note for some curves the cofactor is 1). + +=item "pub" (B) + +The public key value in EC point format. + +=item "priv" (B) + +The private key value. + +=back + =head2 Information Parameters See L for further details on the parameters structure. diff --git a/doc/perlvars.pm b/doc/perlvars.pm index bae8b15e..82d6e5a1 100644 --- a/doc/perlvars.pm +++ b/doc/perlvars.pm @@ -88,6 +88,17 @@ $OpenSSL::safe::opt_r_item = "" . "\n" . "See L for details."; +# Provider options +$OpenSSL::safe::opt_provider_synopsis = "" +. "[B<-provider> I]\n" +. "[B<-provider_path> I]"; +$OpenSSL::safe::opt_provider_item = "" +. "=item B<-provider> I\n" +. "\n" +. "=item B<-provider_path> I\n" +. "\n" +. "See L."; + # Engine option $OpenSSL::safe::opt_engine_synopsis = "" . "[B<-engine> I]"; diff --git a/include/crypto/security_bits.h b/include/crypto/security_bits.h new file mode 100644 index 00000000..c62d89bc --- /dev/null +++ b/include/crypto/security_bits.h @@ -0,0 +1,15 @@ +/* + * Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#ifndef OSSL_SECURITY_BITS_H +# define OSSL_SECURITY_BITS_H + +uint16_t ifc_ffc_compute_security_bits(int n); + +#endif diff --git a/include/openssl/cms.h b/include/openssl/cms.h index 1d502fa4..5f66e6df 100644 --- a/include/openssl/cms.h +++ b/include/openssl/cms.h @@ -80,6 +80,7 @@ DECLARE_ASN1_PRINT_FUNCTION(CMS_ContentInfo) # define CMS_KEY_PARAM 0x40000 # define CMS_ASCIICRLF 0x80000 # define CMS_CADES 0x100000 +# define CMS_USE_ORIGINATOR_KEYID 0x200000 const ASN1_OBJECT *CMS_get0_type(const CMS_ContentInfo *cms); @@ -150,6 +151,7 @@ int CMS_decrypt(CMS_ContentInfo *cms, EVP_PKEY *pkey, X509 *cert, BIO *dcont, BIO *out, unsigned int flags); int CMS_decrypt_set1_pkey(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert); +int CMS_decrypt_set1_pkey_and_peer(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert, X509 *peer); int CMS_decrypt_set1_key(CMS_ContentInfo *cms, unsigned char *key, size_t keylen, const unsigned char *id, size_t idlen); @@ -162,6 +164,8 @@ EVP_PKEY_CTX *CMS_RecipientInfo_get0_pkey_ctx(CMS_RecipientInfo *ri); CMS_ContentInfo *CMS_EnvelopedData_create(const EVP_CIPHER *cipher); CMS_RecipientInfo *CMS_add1_recipient_cert(CMS_ContentInfo *cms, X509 *recip, unsigned int flags); +CMS_RecipientInfo *CMS_add1_recipient(CMS_ContentInfo *cms, X509 *recip, + EVP_PKEY *originatorPrivKey, X509 * originator, unsigned int flags); int CMS_RecipientInfo_set0_pkey(CMS_RecipientInfo *ri, EVP_PKEY *pkey); int CMS_RecipientInfo_ktri_cert_cmp(CMS_RecipientInfo *ri, X509 *cert); int CMS_RecipientInfo_ktri_get0_algs(CMS_RecipientInfo *ri, @@ -326,6 +330,7 @@ int CMS_RecipientEncryptedKey_get0_id(CMS_RecipientEncryptedKey *rek, int CMS_RecipientEncryptedKey_cert_cmp(CMS_RecipientEncryptedKey *rek, X509 *cert); int CMS_RecipientInfo_kari_set0_pkey(CMS_RecipientInfo *ri, EVP_PKEY *pk); +int CMS_RecipientInfo_kari_set0_pkey_and_peer(CMS_RecipientInfo *ri, EVP_PKEY *pk, X509 *peer); EVP_CIPHER_CTX *CMS_RecipientInfo_kari_get0_ctx(CMS_RecipientInfo *ri); int CMS_RecipientInfo_kari_decrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri, diff --git a/include/openssl/cmserr.h b/include/openssl/cmserr.h index 10e0fd6a..494ae619 100644 --- a/include/openssl/cmserr.h +++ b/include/openssl/cmserr.h @@ -1,6 +1,6 @@ /* * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -39,6 +39,7 @@ int ERR_load_CMS_strings(void); # define CMS_F_CMS_ADD0_RECIPIENT_KEY 0 # define CMS_F_CMS_ADD0_RECIPIENT_PASSWORD 0 # define CMS_F_CMS_ADD1_RECEIPTREQUEST 0 +# define CMS_F_CMS_ADD1_RECIPIENT 0 # define CMS_F_CMS_ADD1_RECIPIENT_CERT 0 # define CMS_F_CMS_ADD1_SIGNER 0 # define CMS_F_CMS_ADD1_SIGNINGTIME 0 @@ -56,6 +57,7 @@ int ERR_load_CMS_strings(void); # define CMS_F_CMS_DECRYPT_SET1_KEY 0 # define CMS_F_CMS_DECRYPT_SET1_PASSWORD 0 # define CMS_F_CMS_DECRYPT_SET1_PKEY 0 +# define CMS_F_CMS_DECRYPT_SET1_PKEY_AND_PEER 0 # define CMS_F_CMS_DIGESTALGORITHM_FIND_CTX 0 # define CMS_F_CMS_DIGESTALGORITHM_INIT_BIO 0 # define CMS_F_CMS_DIGESTEDDATA_DO_FINAL 0 @@ -68,6 +70,8 @@ int ERR_load_CMS_strings(void); # define CMS_F_CMS_ENCRYPTEDDATA_ENCRYPT 0 # define CMS_F_CMS_ENCRYPTEDDATA_SET1_KEY 0 # define CMS_F_CMS_ENVELOPEDDATA_CREATE 0 +# define CMS_F_CMS_ENVELOPEDDATA_ENCRYPTION_INIT_BIO 0 +# define CMS_F_CMS_ENVELOPEDDATA_FINAL 0 # define CMS_F_CMS_ENVELOPEDDATA_INIT_BIO 0 # define CMS_F_CMS_ENVELOPED_DATA_INIT 0 # define CMS_F_CMS_ENV_ASN1_CTRL 0 diff --git a/include/openssl/evp.h b/include/openssl/evp.h index da87052b..845306a4 100644 --- a/include/openssl/evp.h +++ b/include/openssl/evp.h @@ -294,6 +294,10 @@ int (*EVP_CIPHER_meth_get_ctrl(const EVP_CIPHER *cipher))(EVP_CIPHER_CTX *, # define EVP_CIPH_FLAG_PIPELINE 0X800000 /* For provider implementations that handle ASN1 get/set param themselves */ # define EVP_CIPH_FLAG_CUSTOM_ASN1 0x1000000 +/* For ciphers generating unprotected CMS attributes */ +# define EVP_CIPH_FLAG_CIPHER_WITH_MAC 0x2000000 +/* For supplementary wrap cipher support */ +# define EVP_CIPH_FLAG_GET_WRAP_CIPHER 0x4000000 /* * Cipher context flag to indicate we can handle wrap mode: if allowed in @@ -372,6 +376,10 @@ int (*EVP_CIPHER_meth_get_ctrl(const EVP_CIPHER *cipher))(EVP_CIPHER_CTX *, # define EVP_CTRL_GET_IV 0x26 /* Tell the cipher it's doing a speed test (SIV disallows multiple ops) */ # define EVP_CTRL_SET_SPEED 0x27 +/* Get the unprotectedAttrs from cipher ctx */ +# define EVP_CTRL_PROCESS_UNPROTECTED 0x28 +/* Get the supplementary wrap cipher */ +#define EVP_CTRL_GET_WRAP_CIPHER 0x29 /* Padding modes */ #define EVP_PADDING_PKCS7 1 @@ -1260,6 +1268,7 @@ int EVP_PBE_get(int *ptype, int *ppbe_nid, size_t num); # define ASN1_PKEY_CTRL_SET1_TLS_ENCPT 0x9 # define ASN1_PKEY_CTRL_GET1_TLS_ENCPT 0xa # define ASN1_PKEY_CTRL_SUPPORTS_MD_NID 0xb +# define ASN1_PKEY_CTRL_CMS_IS_RI_TYPE_SUPPORTED 0xc int EVP_PKEY_asn1_get_count(void); const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_get0(int idx); diff --git a/include/openssl/provider.h b/include/openssl/provider.h index 86dabf42..c17f1d46 100644 --- a/include/openssl/provider.h +++ b/include/openssl/provider.h @@ -16,6 +16,9 @@ extern "C" { # endif +/* Set the default provider search path */ +int OSSL_PROVIDER_set_default_search_path(OPENSSL_CTX *, const char *path); + /* Load and unload a provider */ OSSL_PROVIDER *OSSL_PROVIDER_load(OPENSSL_CTX *, const char *name); int OSSL_PROVIDER_unload(OSSL_PROVIDER *prov); diff --git a/providers/defltprov.c b/providers/defltprov.c index 9400eee0..0f66aa2b 100644 --- a/providers/defltprov.c +++ b/providers/defltprov.c @@ -471,17 +471,17 @@ static const OSSL_ALGORITHM deflt_serializer[] = { #endif #ifndef OPENSSL_NO_EC - { "X25519", "provider=default,format=text,type=private", + { "X25519", "provider=default,fips=yes,format=text,type=private", x25519_priv_print_serializer_functions }, - { "X25519", "provider=default,format=text,type=public", + { "X25519", "provider=default,fips=yes,format=text,type=public", x25519_pub_print_serializer_functions }, - { "X25519", "provider=default,format=der,type=private", + { "X25519", "provider=default,fips=yes,format=der,type=private", x25519_priv_der_serializer_functions }, - { "X25519", "provider=default,format=der,type=public", + { "X25519", "provider=default,fips=yes,format=der,type=public", x25519_pub_der_serializer_functions }, - { "X25519", "provider=default,format=pem,type=private", + { "X25519", "provider=default,fips=yes,format=pem,type=private", x25519_priv_pem_serializer_functions }, - { "X25519", "provider=default,format=pem,type=public", + { "X25519", "provider=default,fips=yes,format=pem,type=public", x25519_pub_pem_serializer_functions }, { "X448", "provider=default,format=text,type=private", @@ -496,8 +496,26 @@ static const OSSL_ALGORITHM deflt_serializer[] = { x448_priv_pem_serializer_functions }, { "X448", "provider=default,format=pem,type=public", x448_pub_pem_serializer_functions }, -#endif + { "EC", "provider=default,fips=yes,format=text,type=private", + ec_priv_text_serializer_functions }, + { "EC", "provider=default,fips=yes,format=text,type=public", + ec_pub_text_serializer_functions }, + { "EC", "provider=default,fips=yes,format=text,type=parameters", + ec_param_text_serializer_functions }, + { "EC", "provider=default,fips=yes,format=der,type=private", + ec_priv_der_serializer_functions }, + { "EC", "provider=default,fips=yes,format=der,type=public", + ec_pub_der_serializer_functions }, + { "EC", "provider=default,fips=yes,format=der,type=parameters", + ec_param_der_serializer_functions }, + { "EC", "provider=default,fips=yes,format=pem,type=private", + ec_priv_pem_serializer_functions }, + { "EC", "provider=default,fips=yes,format=pem,type=public", + ec_pub_pem_serializer_functions }, + { "EC", "provider=default,fips=yes,format=pem,type=parameters", + ec_param_pem_serializer_functions }, +#endif { NULL, NULL, NULL } }; diff --git a/providers/implementations/include/prov/implementations.h b/providers/implementations/include/prov/implementations.h index a98d1139..ea33bedf 100644 --- a/providers/implementations/include/prov/implementations.h +++ b/providers/implementations/include/prov/implementations.h @@ -1,5 +1,5 @@ /* - * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -315,3 +315,13 @@ extern const OSSL_DISPATCH x448_priv_der_serializer_functions[]; extern const OSSL_DISPATCH x448_pub_der_serializer_functions[]; extern const OSSL_DISPATCH x448_priv_pem_serializer_functions[]; extern const OSSL_DISPATCH x448_pub_pem_serializer_functions[]; + +extern const OSSL_DISPATCH ec_priv_text_serializer_functions[]; +extern const OSSL_DISPATCH ec_pub_text_serializer_functions[]; +extern const OSSL_DISPATCH ec_param_text_serializer_functions[]; +extern const OSSL_DISPATCH ec_priv_der_serializer_functions[]; +extern const OSSL_DISPATCH ec_pub_der_serializer_functions[]; +extern const OSSL_DISPATCH ec_param_der_serializer_functions[]; +extern const OSSL_DISPATCH ec_priv_pem_serializer_functions[]; +extern const OSSL_DISPATCH ec_pub_pem_serializer_functions[]; +extern const OSSL_DISPATCH ec_param_pem_serializer_functions[]; diff --git a/providers/implementations/keymgmt/dh_kmgmt.c b/providers/implementations/keymgmt/dh_kmgmt.c index 90a583e7..6a6a06cc 100644 --- a/providers/implementations/keymgmt/dh_kmgmt.c +++ b/providers/implementations/keymgmt/dh_kmgmt.c @@ -16,13 +16,13 @@ #include #include #include +#include #include -#include "internal/param_build.h" -#include "crypto/dh.h" #include "prov/implementations.h" #include "prov/providercommon.h" #include "prov/provider_ctx.h" #include "crypto/dh.h" +#include "internal/param_build.h" static OSSL_OP_keymgmt_new_fn dh_newdata; static OSSL_OP_keymgmt_free_fn dh_freedata; @@ -30,6 +30,7 @@ static OSSL_OP_keymgmt_get_params_fn dh_get_params; static OSSL_OP_keymgmt_gettable_params_fn dh_gettable_params; static OSSL_OP_keymgmt_has_fn dh_has; static OSSL_OP_keymgmt_match_fn dh_match; +static OSSL_OP_keymgmt_validate_fn dh_validate; static OSSL_OP_keymgmt_import_fn dh_import; static OSSL_OP_keymgmt_import_types_fn dh_import_types; static OSSL_OP_keymgmt_export_fn dh_export; @@ -316,6 +317,46 @@ static const OSSL_PARAM *dh_gettable_params(void) return dh_params; } +static int dh_validate_public(DH *dh) +{ + const BIGNUM *pub_key = NULL; + + DH_get0_key(dh, &pub_key, NULL); + return DH_check_pub_key_ex(dh, pub_key); +} + +static int dh_validate_private(DH *dh) +{ + int status = 0; + const BIGNUM *priv_key = NULL; + + DH_get0_key(dh, NULL, &priv_key); + return dh_check_priv_key(dh, priv_key, &status);; +} + +static int dh_validate(void *keydata, int selection) +{ + DH *dh = keydata; + int ok = 0; + + if ((selection & DH_POSSIBLE_SELECTIONS) != 0) + ok = 1; + + if ((selection & OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS) != 0) + ok = ok && DH_check_params_ex(dh); + + if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0) + ok = ok && dh_validate_public(dh); + + if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0) + ok = ok && dh_validate_private(dh); + + if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) + == OSSL_KEYMGMT_SELECT_KEYPAIR) + ok = ok && dh_check_pairwise(dh); + return ok; +} + const OSSL_DISPATCH dh_keymgmt_functions[] = { { OSSL_FUNC_KEYMGMT_NEW, (void (*)(void))dh_newdata }, { OSSL_FUNC_KEYMGMT_FREE, (void (*)(void))dh_freedata }, @@ -323,6 +364,7 @@ const OSSL_DISPATCH dh_keymgmt_functions[] = { { OSSL_FUNC_KEYMGMT_GETTABLE_PARAMS, (void (*) (void))dh_gettable_params }, { OSSL_FUNC_KEYMGMT_HAS, (void (*)(void))dh_has }, { OSSL_FUNC_KEYMGMT_MATCH, (void (*)(void))dh_match }, + { OSSL_FUNC_KEYMGMT_VALIDATE, (void (*)(void))dh_validate }, { OSSL_FUNC_KEYMGMT_IMPORT, (void (*)(void))dh_import }, { OSSL_FUNC_KEYMGMT_IMPORT_TYPES, (void (*)(void))dh_import_types }, { OSSL_FUNC_KEYMGMT_EXPORT, (void (*)(void))dh_export }, diff --git a/providers/implementations/keymgmt/dsa_kmgmt.c b/providers/implementations/keymgmt/dsa_kmgmt.c index 494f2841..a4821f94 100644 --- a/providers/implementations/keymgmt/dsa_kmgmt.c +++ b/providers/implementations/keymgmt/dsa_kmgmt.c @@ -1,5 +1,5 @@ /* - * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -17,12 +17,11 @@ #include #include #include -#include "internal/param_build.h" -#include "crypto/dsa.h" #include "prov/implementations.h" #include "prov/providercommon.h" #include "prov/provider_ctx.h" #include "crypto/dsa.h" +#include "internal/param_build.h" static OSSL_OP_keymgmt_new_fn dsa_newdata; static OSSL_OP_keymgmt_free_fn dsa_freedata; @@ -30,6 +29,7 @@ static OSSL_OP_keymgmt_get_params_fn dsa_get_params; static OSSL_OP_keymgmt_gettable_params_fn dsa_gettable_params; static OSSL_OP_keymgmt_has_fn dsa_has; static OSSL_OP_keymgmt_match_fn dsa_match; +static OSSL_OP_keymgmt_validate_fn dsa_validate; static OSSL_OP_keymgmt_import_fn dsa_import; static OSSL_OP_keymgmt_import_types_fn dsa_import_types; static OSSL_OP_keymgmt_export_fn dsa_export; @@ -329,6 +329,55 @@ static const OSSL_PARAM *dsa_gettable_params(void) return dsa_params; } +static int dsa_validate_domparams(DSA *dsa) +{ + int status = 0; + + return dsa_check_params(dsa, &status); +} + +static int dsa_validate_public(DSA *dsa) +{ + int status = 0; + const BIGNUM *pub_key = NULL; + + DSA_get0_key(dsa, &pub_key, NULL); + return dsa_check_pub_key(dsa, pub_key, &status); +} + +static int dsa_validate_private(DSA *dsa) +{ + int status = 0; + const BIGNUM *priv_key = NULL; + + DSA_get0_key(dsa, NULL, &priv_key); + return dsa_check_priv_key(dsa, priv_key, &status); +} + +static int dsa_validate(void *keydata, int selection) +{ + DSA *dsa = keydata; + int ok = 0; + + if ((selection & DSA_POSSIBLE_SELECTIONS) != 0) + ok = 1; + + if ((selection & OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS) != 0) + ok = ok && dsa_validate_domparams(dsa); + + if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0) + ok = ok && dsa_validate_public(dsa); + + if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0) + ok = ok && dsa_validate_private(dsa); + + /* If the whole key is selected, we do a pairwise validation */ + if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) + == OSSL_KEYMGMT_SELECT_KEYPAIR) + ok = ok && dsa_check_pairwise(dsa); + return ok; +} + const OSSL_DISPATCH dsa_keymgmt_functions[] = { { OSSL_FUNC_KEYMGMT_NEW, (void (*)(void))dsa_newdata }, { OSSL_FUNC_KEYMGMT_FREE, (void (*)(void))dsa_freedata }, @@ -336,6 +385,7 @@ const OSSL_DISPATCH dsa_keymgmt_functions[] = { { OSSL_FUNC_KEYMGMT_GETTABLE_PARAMS, (void (*) (void))dsa_gettable_params }, { OSSL_FUNC_KEYMGMT_HAS, (void (*)(void))dsa_has }, { OSSL_FUNC_KEYMGMT_MATCH, (void (*)(void))dsa_match }, + { OSSL_FUNC_KEYMGMT_VALIDATE, (void (*)(void))dsa_validate }, { OSSL_FUNC_KEYMGMT_IMPORT, (void (*)(void))dsa_import }, { OSSL_FUNC_KEYMGMT_IMPORT_TYPES, (void (*)(void))dsa_import_types }, { OSSL_FUNC_KEYMGMT_EXPORT, (void (*)(void))dsa_export }, diff --git a/providers/implementations/keymgmt/ec_kmgmt.c b/providers/implementations/keymgmt/ec_kmgmt.c index 6a358aa9..107ab1b5 100644 --- a/providers/implementations/keymgmt/ec_kmgmt.c +++ b/providers/implementations/keymgmt/ec_kmgmt.c @@ -473,7 +473,7 @@ static int ec_import(void *keydata, int selection, const OSSL_PARAM params[]) { EC_KEY *ec = keydata; - int ok = 0; + int ok = 1; if (ec == NULL) return 0; diff --git a/providers/implementations/keymgmt/ecx_kmgmt.c b/providers/implementations/keymgmt/ecx_kmgmt.c index fe0193d9..d3aa9ba1 100644 --- a/providers/implementations/keymgmt/ecx_kmgmt.c +++ b/providers/implementations/keymgmt/ecx_kmgmt.c @@ -27,6 +27,8 @@ static OSSL_OP_keymgmt_import_types_fn ecx_imexport_types; static OSSL_OP_keymgmt_export_fn ecx_export; static OSSL_OP_keymgmt_export_types_fn ecx_imexport_types; +#define ECX_POSSIBLE_SELECTIONS (OSSL_KEYMGMT_SELECT_KEYPAIR) + static void *x25519_new_key(void *provctx) { return ecx_key_new(X25519_KEYLEN, 0); @@ -40,12 +42,9 @@ static void *x448_new_key(void *provctx) static int ecx_has(void *keydata, int selection) { ECX_KEY *key = keydata; - const int ecx_selections = OSSL_KEYMGMT_SELECT_PUBLIC_KEY - | OSSL_KEYMGMT_SELECT_PRIVATE_KEY; int ok = 1; - if ((selection & ~ecx_selections) != 0 - || (selection & ecx_selections) == 0) + if ((selection & ECX_POSSIBLE_SELECTIONS) == 0) return 0; if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0) @@ -63,29 +62,24 @@ static int ecx_import(void *keydata, int selection, const OSSL_PARAM params[]) size_t privkeylen = 0, pubkeylen; const OSSL_PARAM *param_priv_key = NULL, *param_pub_key; unsigned char *pubkey; - const int ecx_selections = OSSL_KEYMGMT_SELECT_PUBLIC_KEY - | OSSL_KEYMGMT_SELECT_PRIVATE_KEY; if (key == NULL) return 0; - if ((selection & ~ecx_selections) != 0 - || (selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) == 0) + if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) == 0) return 0; + param_pub_key = + OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_PUB_KEY); + if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0) param_priv_key = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_PRIV_KEY); - param_pub_key = - OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_PUB_KEY); - /* * If a private key is present then a public key must also be present. * Alternatively we've just got a public key. */ - if (param_pub_key == NULL - || (param_priv_key == NULL - && (selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0)) + if (param_pub_key == NULL) return 0; if (param_priv_key != NULL diff --git a/providers/implementations/serializers/build.info b/providers/implementations/serializers/build.info index d5873d10..66502c76 100644 --- a/providers/implementations/serializers/build.info +++ b/providers/implementations/serializers/build.info @@ -6,6 +6,7 @@ $RSA_GOAL=../../libimplementations.a $DH_GOAL=../../libimplementations.a $DSA_GOAL=../../libimplementations.a $ECX_GOAL=../../libimplementations.a +$EC_GOAL=../../libimplementations.a SOURCE[$SERIALIZER_GOAL]=serializer_common.c SOURCE[$RSA_GOAL]=serializer_rsa.c serializer_rsa_priv.c serializer_rsa_pub.c @@ -17,4 +18,5 @@ IF[{- !$disabled{dsa} -}] ENDIF IF[{- !$disabled{ec} -}] SOURCE[$ECX_GOAL]=serializer_ecx.c serializer_ecx_priv.c serializer_ecx_pub.c + SOURCE[$EC_GOAL]=serializer_ec.c serializer_ec_priv.c serializer_ec_pub.c serializer_ec_param.c ENDIF diff --git a/providers/implementations/serializers/serializer_common.c b/providers/implementations/serializers/serializer_common.c index b1ad523b..0b99f493 100644 --- a/providers/implementations/serializers/serializer_common.c +++ b/providers/implementations/serializers/serializer_common.c @@ -1,5 +1,5 @@ /* - * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -21,7 +21,7 @@ static PKCS8_PRIV_KEY_INFO * ossl_prov_p8info_from_obj(const void *obj, int obj_nid, - ASN1_STRING *params, + void *params, int params_type, int (*k2d)(const void *obj, unsigned char **pder)) @@ -72,7 +72,7 @@ static X509_SIG *ossl_prov_encp8_from_p8info(PKCS8_PRIV_KEY_INFO *p8info, } static X509_SIG *ossl_prov_encp8_from_obj(const void *obj, int obj_nid, - ASN1_STRING *params, + void *params, int params_type, int (*k2d)(const void *obj, unsigned char **pder), @@ -87,7 +87,7 @@ static X509_SIG *ossl_prov_encp8_from_obj(const void *obj, int obj_nid, } static X509_PUBKEY *ossl_prov_pubkey_from_obj(const void *obj, int obj_nid, - ASN1_STRING *params, + void *params, int params_type, int (*k2d)(const void *obj, unsigned char **pder)) @@ -272,18 +272,17 @@ int ossl_prov_print_labeled_buf(BIO *out, const char *label, return 1; } - -/* p2s = param to asn1_string, k2d = key to der */ +/* p2s = param to asn1, k2d = key to der */ int ossl_prov_write_priv_der_from_obj(BIO *out, const void *obj, int obj_nid, int (*p2s)(const void *obj, int nid, - ASN1_STRING **str, + void **str, int *strtype), int (*k2d)(const void *obj, unsigned char **pder), struct pkcs8_encrypt_ctx_st *ctx) { int ret = 0; - ASN1_STRING *str = NULL; + void *str = NULL; int strtype = V_ASN1_UNDEF; if (p2s != NULL && !p2s(obj, obj_nid, &str, &strtype)) @@ -312,14 +311,14 @@ int ossl_prov_write_priv_der_from_obj(BIO *out, const void *obj, int obj_nid, int ossl_prov_write_priv_pem_from_obj(BIO *out, const void *obj, int obj_nid, int (*p2s)(const void *obj, int nid, - ASN1_STRING **str, + void **str, int *strtype), int (*k2d)(const void *obj, unsigned char **pder), struct pkcs8_encrypt_ctx_st *ctx) { int ret = 0; - ASN1_STRING *str = NULL; + void *str = NULL; int strtype = V_ASN1_UNDEF; if (p2s != NULL && !p2s(obj, obj_nid, &str, &strtype)) @@ -348,13 +347,13 @@ int ossl_prov_write_priv_pem_from_obj(BIO *out, const void *obj, int obj_nid, int ossl_prov_write_pub_der_from_obj(BIO *out, const void *obj, int obj_nid, int (*p2s)(const void *obj, int nid, - ASN1_STRING **str, + void **str, int *strtype), int (*k2d)(const void *obj, unsigned char **pder)) { int ret = 0; - ASN1_STRING *str = NULL; + void *str = NULL; int strtype = V_ASN1_UNDEF; X509_PUBKEY *xpk = NULL; @@ -373,13 +372,13 @@ int ossl_prov_write_pub_der_from_obj(BIO *out, const void *obj, int obj_nid, int ossl_prov_write_pub_pem_from_obj(BIO *out, const void *obj, int obj_nid, int (*p2s)(const void *obj, int nid, - ASN1_STRING **str, + void **str, int *strtype), int (*k2d)(const void *obj, unsigned char **pder)) { int ret = 0; - ASN1_STRING *str = NULL; + void *str = NULL; int strtype = V_ASN1_UNDEF; X509_PUBKEY *xpk = NULL; @@ -395,4 +394,3 @@ int ossl_prov_write_pub_pem_from_obj(BIO *out, const void *obj, int obj_nid, X509_PUBKEY_free(xpk); return ret; } - diff --git a/providers/implementations/serializers/serializer_dh.c b/providers/implementations/serializers/serializer_dh.c index 31ba175d..b2517ed9 100644 --- a/providers/implementations/serializers/serializer_dh.c +++ b/providers/implementations/serializers/serializer_dh.c @@ -107,7 +107,7 @@ int ossl_prov_print_dh(BIO *out, DH *dh, enum dh_print_type type) } int ossl_prov_prepare_dh_params(const void *dh, int nid, - ASN1_STRING **pstr, int *pstrtype) + void **pstr, int *pstrtype) { ASN1_STRING *params = ASN1_STRING_new(); diff --git a/providers/implementations/serializers/serializer_dsa.c b/providers/implementations/serializers/serializer_dsa.c index 16ecb0d9..c26be47e 100644 --- a/providers/implementations/serializers/serializer_dsa.c +++ b/providers/implementations/serializers/serializer_dsa.c @@ -98,7 +98,7 @@ int ossl_prov_print_dsa(BIO *out, DSA *dsa, enum dsa_print_type type) } int ossl_prov_prepare_dsa_params(const void *dsa, int nid, - ASN1_STRING **pstr, int *pstrtype) + void **pstr, int *pstrtype) { ASN1_STRING *params = ASN1_STRING_new(); @@ -121,7 +121,7 @@ int ossl_prov_prepare_dsa_params(const void *dsa, int nid, } int ossl_prov_prepare_all_dsa_params(const void *dsa, int nid, - ASN1_STRING **pstr, int *pstrtype) + void **pstr, int *pstrtype) { const BIGNUM *p = DSA_get0_p(dsa); const BIGNUM *q = DSA_get0_q(dsa); diff --git a/providers/implementations/serializers/serializer_ec.c b/providers/implementations/serializers/serializer_ec.c new file mode 100644 index 00000000..3d455f15 --- /dev/null +++ b/providers/implementations/serializers/serializer_ec.c @@ -0,0 +1,150 @@ +/* + * Copyright 2020 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include +#include "crypto/ec.h" +#include "prov/bio.h" /* ossl_prov_bio_printf() */ +#include "prov/implementations.h" /* ec_keymgmt_functions */ +#include "serializer_local.h" + +void ec_get_new_free_import(OSSL_OP_keymgmt_new_fn **ec_new, + OSSL_OP_keymgmt_free_fn **ec_free, + OSSL_OP_keymgmt_import_fn **ec_import) +{ + *ec_new = ossl_prov_get_keymgmt_new(ec_keymgmt_functions); + *ec_free = ossl_prov_get_keymgmt_free(ec_keymgmt_functions); + *ec_import = ossl_prov_get_keymgmt_import(ec_keymgmt_functions); +} + +static int ossl_prov_print_ec_param(BIO *out, const EC_GROUP *group) +{ + const char *curve_name; + int curve_nid = EC_GROUP_get_curve_name(group); + + /* TODO(3.0): Explicit parameters are currently not supported */ + if (curve_nid == NID_undef) + return 0; + + if (ossl_prov_bio_printf(out, "%s: %s\n", "ASN1 OID", + OBJ_nid2sn(curve_nid)) <= 0) + return 0; + + /* TODO(3.0): Only named curves are currently supported */ + curve_name = EC_curve_nid2nist(curve_nid); + return (curve_name == NULL + || ossl_prov_bio_printf(out, "%s: %s\n", "NIST CURVE", + curve_name) > 0); +} + +int ossl_prov_print_eckey(BIO *out, EC_KEY *eckey, enum ec_print_type type) +{ + int ret = 0; + const char *type_label = NULL; + unsigned char *priv = NULL, *pub = NULL; + size_t priv_len = 0, pub_len = 0; + const EC_GROUP *group; + + if (eckey == NULL || (group = EC_KEY_get0_group(eckey)) == NULL) + goto null_err; + + switch (type) { + case ec_print_priv: + type_label = "Private-Key"; + break; + case ec_print_pub: + type_label = "Public-Key"; + break; + case ec_print_params: + type_label = "EC-Parameters"; + break; + } + + if (type == ec_print_priv) { + const BIGNUM *priv_key = EC_KEY_get0_private_key(eckey); + + if (priv_key == NULL) + goto null_err; + priv_len = EC_KEY_priv2buf(eckey, &priv); + if (priv_len == 0) + goto err; + } + + if (type == ec_print_priv || type == ec_print_pub) { + const EC_POINT *pub_pt = EC_KEY_get0_public_key(eckey); + + if (pub_pt == NULL) + goto null_err; + + pub_len = EC_KEY_key2buf(eckey, EC_KEY_get_conv_form(eckey), &pub, NULL); + if (pub_len == 0) + goto err; + } + + if (ossl_prov_bio_printf(out, "%s: (%d bit)\n", type_label, + EC_GROUP_order_bits(group)) <= 0) + goto err; + if (priv != NULL + && !ossl_prov_print_labeled_buf(out, "priv:", priv, priv_len)) + goto err; + if (pub != NULL + && !ossl_prov_print_labeled_buf(out, "pub:", pub, pub_len)) + goto err; + ret = ossl_prov_print_ec_param(out, group); +err: + OPENSSL_clear_free(priv, priv_len); + OPENSSL_free(pub); + return ret; +null_err: + ERR_raise(ERR_LIB_PROV, ERR_R_PASSED_NULL_PARAMETER); + goto err; +} + +int ossl_prov_prepare_ec_params(const void *eckey, int nid, + void **pstr, int *pstrtype) +{ + int curve_nid; + const EC_GROUP *group = EC_KEY_get0_group(eckey); + ASN1_OBJECT *params; + + if (group == NULL + || ((curve_nid = EC_GROUP_get_curve_name(group)) == NID_undef) + || ((params = OBJ_nid2obj(curve_nid)) == NULL)) { + /* TODO(3.0): Explicit curves are not supported */ + return 0; + } + + *pstr = params; + *pstrtype = V_ASN1_OBJECT; + return 1; +} + +int ossl_prov_ec_pub_to_der(const void *eckey, unsigned char **pder) +{ + return i2o_ECPublicKey(eckey, pder); +} + +int ossl_prov_ec_priv_to_der(const void *veckey, unsigned char **pder) +{ + EC_KEY *eckey = (EC_KEY *)veckey; + unsigned int old_flags; + int ret = 0; + + /* + * For PKCS8 the curve name appears in the PKCS8_PRIV_KEY_INFO object + * as the pkeyalg->parameter field. (For a named curve this is an OID) + * The pkey field is an octet string that holds the encoded + * ECPrivateKey SEQUENCE with the optional parameters field omitted. + * We omit this by setting the EC_PKEY_NO_PARAMETERS flag. + */ + old_flags = EC_KEY_get_enc_flags(eckey); /* save old flags */ + EC_KEY_set_enc_flags(eckey, old_flags | EC_PKEY_NO_PARAMETERS); + ret = i2d_ECPrivateKey(eckey, pder); + EC_KEY_set_enc_flags(eckey, old_flags); /* restore old flags */ + return ret; /* return the length of the der encoded data */ +} diff --git a/providers/implementations/serializers/serializer_ec_param.c b/providers/implementations/serializers/serializer_ec_param.c new file mode 100644 index 00000000..fdeedb5d --- /dev/null +++ b/providers/implementations/serializers/serializer_ec_param.c @@ -0,0 +1,153 @@ +/* + * Copyright 2020 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include +#include +#include +#include +#include +#include "prov/bio.h" +#include "prov/implementations.h" +#include "prov/providercommonerr.h" +#include "serializer_local.h" + +static OSSL_OP_serializer_newctx_fn ec_param_newctx; +static OSSL_OP_serializer_freectx_fn ec_param_freectx; +static OSSL_OP_serializer_serialize_data_fn ec_param_der_data; +static OSSL_OP_serializer_serialize_object_fn ec_param_der; +static OSSL_OP_serializer_serialize_data_fn ec_param_pem_data; +static OSSL_OP_serializer_serialize_object_fn ec_param_pem; + +static OSSL_OP_serializer_serialize_data_fn ec_param_print_data; +static OSSL_OP_serializer_serialize_object_fn ec_param_print; + + +/* There is no specific implementation context, so use the provider context */ +static void *ec_param_newctx(void *provctx) +{ + return provctx; +} + +static void ec_param_freectx(void *vctx) +{ +} + +/* Public key : DER */ +static int ec_param_der_data(void *vctx, const OSSL_PARAM params[], BIO *out, + OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg) +{ + OSSL_OP_keymgmt_new_fn *ec_new; + OSSL_OP_keymgmt_free_fn *ec_free; + OSSL_OP_keymgmt_import_fn *ec_import; + int ok = 0; + + ec_get_new_free_import(&ec_new, &ec_free, &ec_import); + + if (ec_import != NULL) { + EC_KEY *eckey; + + /* vctx == provctx */ + if ((eckey = ec_new(vctx)) != NULL + && ec_import(eckey, OSSL_KEYMGMT_SELECT_ALL_PARAMETERS, params) + && ec_param_der(vctx, eckey, out, cb, cbarg)) + ok = 1; + ec_free(eckey); + } + return ok; +} + +static int ec_param_der(void *vctx, void *eckey, BIO *out, + OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg) +{ + return i2d_ECPKParameters_bio(out, EC_KEY_get0_group(eckey)); +} + +/* Public key : PEM */ +static int ec_param_pem_data(void *vctx, const OSSL_PARAM params[], BIO *out, + OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg) +{ + OSSL_OP_keymgmt_new_fn *ec_new; + OSSL_OP_keymgmt_free_fn *ec_free; + OSSL_OP_keymgmt_import_fn *ec_import; + int ok = 0; + + ec_get_new_free_import(&ec_new, &ec_free, &ec_import); + + if (ec_import != NULL) { + EC_KEY *eckey; + + /* vctx == provctx */ + if ((eckey = ec_new(vctx)) != NULL + && ec_import(eckey, OSSL_KEYMGMT_SELECT_ALL_PARAMETERS, params) + && ec_param_pem(vctx, eckey, out, cb, cbarg)) + ok = 1; + ec_free(eckey); + } + return ok; +} + +static int ec_param_pem(void *vctx, void *eckey, BIO *out, + OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg) +{ + return PEM_write_bio_ECPKParameters(out, EC_KEY_get0_group(eckey)); +} + +static int ec_param_print_data(void *vctx, const OSSL_PARAM params[], BIO *out, + OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg) +{ + OSSL_OP_keymgmt_new_fn *ec_new; + OSSL_OP_keymgmt_free_fn *ec_free; + OSSL_OP_keymgmt_import_fn *ec_import; + int ok = 0; + + ec_get_new_free_import(&ec_new, &ec_free, &ec_import); + + if (ec_import != NULL) { + EC_KEY *eckey; + + /* vctx == provctx */ + if ((eckey = ec_new(vctx)) != NULL + && ec_import(eckey, OSSL_KEYMGMT_SELECT_ALL_PARAMETERS, params) + && ec_param_print(vctx, eckey, out, cb, cbarg)) + ok = 1; + ec_free(eckey); + } + return ok; +} + +static int ec_param_print(void *vctx, void *eckey, BIO *out, + OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg) +{ + return ossl_prov_print_eckey(out, eckey, ec_print_params); +} + +const OSSL_DISPATCH ec_param_der_serializer_functions[] = { + { OSSL_FUNC_SERIALIZER_NEWCTX, (void (*)(void))ec_param_newctx }, + { OSSL_FUNC_SERIALIZER_FREECTX, (void (*)(void))ec_param_freectx }, + { OSSL_FUNC_SERIALIZER_SERIALIZE_DATA, (void (*)(void))ec_param_der_data }, + { OSSL_FUNC_SERIALIZER_SERIALIZE_OBJECT, (void (*)(void))ec_param_der }, + { 0, NULL } +}; + +const OSSL_DISPATCH ec_param_pem_serializer_functions[] = { + { OSSL_FUNC_SERIALIZER_NEWCTX, (void (*)(void))ec_param_newctx }, + { OSSL_FUNC_SERIALIZER_FREECTX, (void (*)(void))ec_param_freectx }, + { OSSL_FUNC_SERIALIZER_SERIALIZE_DATA, (void (*)(void))ec_param_pem_data }, + { OSSL_FUNC_SERIALIZER_SERIALIZE_OBJECT, (void (*)(void))ec_param_pem }, + { 0, NULL } +}; + +const OSSL_DISPATCH ec_param_text_serializer_functions[] = { + { OSSL_FUNC_SERIALIZER_NEWCTX, (void (*)(void))ec_param_newctx }, + { OSSL_FUNC_SERIALIZER_FREECTX, (void (*)(void))ec_param_freectx }, + { OSSL_FUNC_SERIALIZER_SERIALIZE_OBJECT, (void (*)(void))ec_param_print }, + { OSSL_FUNC_SERIALIZER_SERIALIZE_DATA, + (void (*)(void))ec_param_print_data }, + { 0, NULL } +}; diff --git a/providers/implementations/serializers/serializer_ec_priv.c b/providers/implementations/serializers/serializer_ec_priv.c new file mode 100644 index 00000000..14ff2ae6 --- /dev/null +++ b/providers/implementations/serializers/serializer_ec_priv.c @@ -0,0 +1,261 @@ +/* + * Copyright 2020 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include +#include +#include +#include +#include +#include +#include +#include "prov/bio.h" +#include "prov/implementations.h" +#include "serializer_local.h" + +static OSSL_OP_serializer_newctx_fn ec_priv_newctx; +static OSSL_OP_serializer_freectx_fn ec_priv_freectx; +static OSSL_OP_serializer_set_ctx_params_fn ec_priv_set_ctx_params; +static OSSL_OP_serializer_settable_ctx_params_fn ec_priv_settable_ctx_params; +static OSSL_OP_serializer_serialize_data_fn ec_priv_der_data; +static OSSL_OP_serializer_serialize_object_fn ec_priv_der; +static OSSL_OP_serializer_serialize_data_fn ec_pem_priv_data; +static OSSL_OP_serializer_serialize_object_fn ec_pem_priv; + +static OSSL_OP_serializer_newctx_fn ec_print_newctx; +static OSSL_OP_serializer_freectx_fn ec_print_freectx; +static OSSL_OP_serializer_serialize_data_fn ec_priv_print_data; +static OSSL_OP_serializer_serialize_object_fn ec_priv_print; + + /* + * Context used for private key serialization. + */ +struct ec_priv_ctx_st { + void *provctx; + + struct pkcs8_encrypt_ctx_st sc; +}; + +/* Private key : context */ +static void *ec_priv_newctx(void *provctx) +{ + struct ec_priv_ctx_st *ctx = OPENSSL_zalloc(sizeof(*ctx)); + + if (ctx != NULL) { + ctx->provctx = provctx; + + /* -1 is the "whatever" indicator, i.e. the PKCS8 library default PBE */ + ctx->sc.pbe_nid = -1; + } + return ctx; +} + +static void ec_priv_freectx(void *vctx) +{ + struct ec_priv_ctx_st *ctx = vctx; + + EVP_CIPHER_free(ctx->sc.cipher); + OPENSSL_free(ctx->sc.cipher_pass); + OPENSSL_free(ctx); +} + +static const OSSL_PARAM *ec_priv_settable_ctx_params(void) +{ + static const OSSL_PARAM settables[] = { + OSSL_PARAM_utf8_string(OSSL_SERIALIZER_PARAM_CIPHER, NULL, 0), + OSSL_PARAM_octet_string(OSSL_SERIALIZER_PARAM_PASS, NULL, 0), + OSSL_PARAM_END, + }; + + return settables; +} + +static int ec_priv_set_ctx_params(void *vctx, const OSSL_PARAM params[]) +{ + struct ec_priv_ctx_st *ctx = vctx; + const OSSL_PARAM *p; + + if ((p = OSSL_PARAM_locate_const(params, OSSL_SERIALIZER_PARAM_CIPHER)) + != NULL) { + const OSSL_PARAM *propsp = + OSSL_PARAM_locate_const(params, OSSL_SERIALIZER_PARAM_PROPERTIES); + const char *props = NULL; + + if (p->data_type != OSSL_PARAM_UTF8_STRING) + return 0; + if (propsp != NULL && propsp->data_type != OSSL_PARAM_UTF8_STRING) + return 0; + props = (propsp != NULL ? propsp->data : NULL); + + EVP_CIPHER_free(ctx->sc.cipher); + ctx->sc.cipher_intent = p->data != NULL; + if (p->data != NULL + && ((ctx->sc.cipher = EVP_CIPHER_fetch(NULL, p->data, props)) + == NULL)) + return 0; + } + if ((p = OSSL_PARAM_locate_const(params, OSSL_SERIALIZER_PARAM_PASS)) + != NULL) { + OPENSSL_free(ctx->sc.cipher_pass); + ctx->sc.cipher_pass = NULL; + if (!OSSL_PARAM_get_octet_string(p, &ctx->sc.cipher_pass, 0, + &ctx->sc.cipher_pass_length)) + return 0; + } + return 1; +} + +/* Private key : DER */ +static int ec_priv_der_data(void *vctx, const OSSL_PARAM params[], BIO *out, + OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg) +{ + struct ec_priv_ctx_st *ctx = vctx; + OSSL_OP_keymgmt_new_fn *ec_new; + OSSL_OP_keymgmt_free_fn *ec_free; + OSSL_OP_keymgmt_import_fn *ec_import; + int ok = 0; + + ec_get_new_free_import(&ec_new, &ec_free, &ec_import); + + if (ec_import != NULL) { + EC_KEY *eckey; + + if ((eckey = ec_new(ctx->provctx)) != NULL + && ec_import(eckey, OSSL_KEYMGMT_SELECT_KEYPAIR, params) + && ec_priv_der(ctx, eckey, out, cb, cbarg)) + ok = 1; + ec_free(eckey); + } + return ok; +} + +static int ec_priv_der(void *vctx, void *eckey, BIO *out, + OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg) +{ + struct ec_priv_ctx_st *ctx = vctx; + + ctx->sc.cb = cb; + ctx->sc.cbarg = cbarg; + + return ossl_prov_write_priv_der_from_obj(out, eckey, EVP_PKEY_EC, + ossl_prov_prepare_ec_params, + ossl_prov_ec_priv_to_der, + &ctx->sc); +} + +/* Private key : PEM */ +static int ec_pem_priv_data(void *vctx, const OSSL_PARAM params[], BIO *out, + OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg) +{ + struct ec_priv_ctx_st *ctx = vctx; + OSSL_OP_keymgmt_new_fn *ec_new; + OSSL_OP_keymgmt_free_fn *ec_free; + OSSL_OP_keymgmt_import_fn *ec_import; + int ok = 0; + + ec_get_new_free_import(&ec_new, &ec_free, &ec_import); + + if (ec_import != NULL) { + EC_KEY *eckey; + + if ((eckey = ec_new(ctx->provctx)) != NULL + && ec_import(eckey, OSSL_KEYMGMT_SELECT_KEYPAIR, params) + && ec_pem_priv(ctx, eckey, out, cb, cbarg)) + ok = 1; + ec_free(eckey); + } + return ok; +} + +static int ec_pem_priv(void *vctx, void *eckey, BIO *out, + OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg) +{ + struct ec_priv_ctx_st *ctx = vctx; + + ctx->sc.cb = cb; + ctx->sc.cbarg = cbarg; + + return ossl_prov_write_priv_pem_from_obj(out, eckey, EVP_PKEY_EC, + ossl_prov_prepare_ec_params, + ossl_prov_ec_priv_to_der, + &ctx->sc); +} + +/* + * There's no specific print context, so we use the provider context + */ +static void *ec_print_newctx(void *provctx) +{ + return provctx; +} + +static void ec_print_freectx(void *ctx) +{ +} + +static int ec_priv_print_data(void *vctx, const OSSL_PARAM params[], BIO *out, + OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg) +{ + struct ec_priv_ctx_st *ctx = vctx; + OSSL_OP_keymgmt_new_fn *ec_new; + OSSL_OP_keymgmt_free_fn *ec_free; + OSSL_OP_keymgmt_import_fn *ec_import; + int ok = 0; + + ec_get_new_free_import(&ec_new, &ec_free, &ec_import); + + if (ec_import != NULL) { + EC_KEY *eckey; + + if ((eckey = ec_new(ctx->provctx)) != NULL + && ec_import(eckey, OSSL_KEYMGMT_SELECT_KEYPAIR, params) + && ec_priv_print(ctx, eckey, out, cb, cbarg)) + ok = 1; + ec_free(eckey); + } + return ok; +} + +static int ec_priv_print(void *vctx, void *eckey, BIO *out, + OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg) +{ + return ossl_prov_print_eckey(out, eckey, ec_print_priv); +} + +const OSSL_DISPATCH ec_priv_der_serializer_functions[] = { + { OSSL_FUNC_SERIALIZER_NEWCTX, (void (*)(void))ec_priv_newctx }, + { OSSL_FUNC_SERIALIZER_FREECTX, (void (*)(void))ec_priv_freectx }, + { OSSL_FUNC_SERIALIZER_SET_CTX_PARAMS, + (void (*)(void))ec_priv_set_ctx_params }, + { OSSL_FUNC_SERIALIZER_SETTABLE_CTX_PARAMS, + (void (*)(void))ec_priv_settable_ctx_params }, + { OSSL_FUNC_SERIALIZER_SERIALIZE_DATA, (void (*)(void))ec_priv_der_data }, + { OSSL_FUNC_SERIALIZER_SERIALIZE_OBJECT, (void (*)(void))ec_priv_der }, + { 0, NULL } +}; + +const OSSL_DISPATCH ec_priv_pem_serializer_functions[] = { + { OSSL_FUNC_SERIALIZER_NEWCTX, (void (*)(void))ec_priv_newctx }, + { OSSL_FUNC_SERIALIZER_FREECTX, (void (*)(void))ec_priv_freectx }, + { OSSL_FUNC_SERIALIZER_SET_CTX_PARAMS, + (void (*)(void))ec_priv_set_ctx_params }, + { OSSL_FUNC_SERIALIZER_SETTABLE_CTX_PARAMS, + (void (*)(void))ec_priv_settable_ctx_params }, + { OSSL_FUNC_SERIALIZER_SERIALIZE_DATA, (void (*)(void))ec_pem_priv_data }, + { OSSL_FUNC_SERIALIZER_SERIALIZE_OBJECT, (void (*)(void))ec_pem_priv }, + { 0, NULL } +}; + +const OSSL_DISPATCH ec_priv_text_serializer_functions[] = { + { OSSL_FUNC_SERIALIZER_NEWCTX, (void (*)(void))ec_print_newctx }, + { OSSL_FUNC_SERIALIZER_FREECTX, (void (*)(void))ec_print_freectx }, + { OSSL_FUNC_SERIALIZER_SERIALIZE_OBJECT, (void (*)(void))ec_priv_print }, + { OSSL_FUNC_SERIALIZER_SERIALIZE_DATA, + (void (*)(void))ec_priv_print_data }, + { 0, NULL } +}; diff --git a/providers/implementations/serializers/serializer_ec_pub.c b/providers/implementations/serializers/serializer_ec_pub.c new file mode 100644 index 00000000..e9d90f1d --- /dev/null +++ b/providers/implementations/serializers/serializer_ec_pub.c @@ -0,0 +1,159 @@ +/* + * Copyright 2020 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include +#include +#include +#include +#include +#include "prov/bio.h" +#include "prov/implementations.h" +#include "serializer_local.h" + +static OSSL_OP_serializer_newctx_fn ec_pub_newctx; +static OSSL_OP_serializer_freectx_fn ec_pub_freectx; +static OSSL_OP_serializer_serialize_data_fn ec_pub_der_data; +static OSSL_OP_serializer_serialize_object_fn ec_pub_der; +static OSSL_OP_serializer_serialize_data_fn ec_pub_pem_data; +static OSSL_OP_serializer_serialize_object_fn ec_pub_pem; + +static OSSL_OP_serializer_serialize_data_fn ec_pub_print_data; +static OSSL_OP_serializer_serialize_object_fn ec_pub_print; + +/* Public key : context */ + +/* + * There's no specific implementation context, so we use the provider context + */ +static void *ec_pub_newctx(void *provctx) +{ + return provctx; +} + +static void ec_pub_freectx(void *ctx) +{ +} + +/* Public key : DER */ +static int ec_pub_der_data(void *vctx, const OSSL_PARAM params[], BIO *out, + OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg) +{ + OSSL_OP_keymgmt_new_fn *ec_new; + OSSL_OP_keymgmt_free_fn *ec_free; + OSSL_OP_keymgmt_import_fn *ec_import; + int ok = 0; + + ec_get_new_free_import(&ec_new, &ec_free, &ec_import); + + if (ec_import != NULL) { + EC_KEY *eckey; + + /* vctx == provctx */ + if ((eckey = ec_new(vctx)) != NULL + && ec_import(eckey, OSSL_KEYMGMT_SELECT_KEYPAIR, params) + && ec_pub_der(vctx, eckey, out, cb, cbarg)) + ok = 1; + ec_free(eckey); + } + return ok; +} + +static int ec_pub_der(void *ctx, void *eckey, BIO *out, + OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg) +{ + return ossl_prov_write_pub_der_from_obj(out, eckey, EVP_PKEY_EC, + ossl_prov_prepare_ec_params, + ossl_prov_ec_pub_to_der); +} + +/* Public key : PEM */ +static int ec_pub_pem_data(void *vctx, const OSSL_PARAM params[], BIO *out, + OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg) +{ + OSSL_OP_keymgmt_new_fn *ec_new; + OSSL_OP_keymgmt_free_fn *ec_free; + OSSL_OP_keymgmt_import_fn *ec_import; + int ok = 0; + + ec_get_new_free_import(&ec_new, &ec_free, &ec_import); + + if (ec_import != NULL) { + EC_KEY *eckey; + + /* ctx == provctx */ + if ((eckey = ec_new(vctx)) != NULL + && ec_import(eckey, OSSL_KEYMGMT_SELECT_KEYPAIR, params) + && ec_pub_pem(vctx, eckey, out, cb, cbarg)) + ok = 1; + ec_free(eckey); + } + return ok; +} + +static int ec_pub_pem(void *vctx, void *eckey, BIO *out, + OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg) +{ + return ossl_prov_write_pub_pem_from_obj(out, eckey, EVP_PKEY_EC, + ossl_prov_prepare_ec_params, + ossl_prov_ec_pub_to_der); +} + +static int ec_pub_print_data(void *vctx, const OSSL_PARAM params[], BIO *out, + OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg) +{ + OSSL_OP_keymgmt_new_fn *ec_new; + OSSL_OP_keymgmt_free_fn *ec_free; + OSSL_OP_keymgmt_import_fn *ec_import; + int ok = 0; + + ec_get_new_free_import(&ec_new, &ec_free, &ec_import); + + if (ec_import != NULL) { + EC_KEY *eckey; + + /* ctx == provctx */ + if ((eckey = ec_new(vctx)) != NULL + && ec_import(eckey, OSSL_KEYMGMT_SELECT_KEYPAIR, params) + && ec_pub_print(vctx, eckey, out, cb, cbarg)) + ok = 1; + ec_free(eckey); + } + return ok; +} + +static int ec_pub_print(void *vctx, void *eckey, BIO *out, + OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg) +{ + return ossl_prov_print_eckey(out, eckey, ec_print_pub); +} + +const OSSL_DISPATCH ec_pub_der_serializer_functions[] = { + { OSSL_FUNC_SERIALIZER_NEWCTX, (void (*)(void))ec_pub_newctx }, + { OSSL_FUNC_SERIALIZER_FREECTX, (void (*)(void))ec_pub_freectx }, + { OSSL_FUNC_SERIALIZER_SERIALIZE_DATA, (void (*)(void))ec_pub_der_data }, + { OSSL_FUNC_SERIALIZER_SERIALIZE_OBJECT, (void (*)(void))ec_pub_der }, + { 0, NULL } +}; + +const OSSL_DISPATCH ec_pub_pem_serializer_functions[] = { + { OSSL_FUNC_SERIALIZER_NEWCTX, (void (*)(void))ec_pub_newctx }, + { OSSL_FUNC_SERIALIZER_FREECTX, (void (*)(void))ec_pub_freectx }, + { OSSL_FUNC_SERIALIZER_SERIALIZE_DATA, (void (*)(void))ec_pub_pem_data }, + { OSSL_FUNC_SERIALIZER_SERIALIZE_OBJECT, (void (*)(void))ec_pub_pem }, + { 0, NULL } +}; + +const OSSL_DISPATCH ec_pub_text_serializer_functions[] = { + { OSSL_FUNC_SERIALIZER_NEWCTX, (void (*)(void))ec_pub_newctx }, + { OSSL_FUNC_SERIALIZER_FREECTX, (void (*)(void))ec_pub_freectx }, + { OSSL_FUNC_SERIALIZER_SERIALIZE_OBJECT, (void (*)(void))ec_pub_print }, + { OSSL_FUNC_SERIALIZER_SERIALIZE_DATA, + (void (*)(void))ec_pub_print_data }, + { 0, NULL } +}; diff --git a/providers/implementations/serializers/serializer_local.h b/providers/implementations/serializers/serializer_local.h index ec27f144..3125dc8f 100644 --- a/providers/implementations/serializers/serializer_local.h +++ b/providers/implementations/serializers/serializer_local.h @@ -50,8 +50,17 @@ OSSL_OP_keymgmt_new_fn *ossl_prov_get_keymgmt_dsa_new(void); OSSL_OP_keymgmt_free_fn *ossl_prov_get_keymgmt_dsa_free(void); OSSL_OP_keymgmt_import_fn *ossl_prov_get_keymgmt_dsa_import(void); +void ec_get_new_free_import(OSSL_OP_keymgmt_new_fn **ec_new, + OSSL_OP_keymgmt_free_fn **ec_free, + OSSL_OP_keymgmt_import_fn **ec_import); + +int ossl_prov_prepare_ec_params(const void *eckey, int nid, + void **pstr, int *pstrtype); +int ossl_prov_ec_pub_to_der(const void *eckey, unsigned char **pder); +int ossl_prov_ec_priv_to_der(const void *eckey, unsigned char **pder); + int ossl_prov_prepare_dh_params(const void *dh, int nid, - ASN1_STRING **pstr, int *pstrtype); + void **pstr, int *pstrtype); int ossl_prov_dh_pub_to_der(const void *dh, unsigned char **pder); int ossl_prov_dh_priv_to_der(const void *dh, unsigned char **pder); @@ -63,14 +72,14 @@ int ossl_prov_ecx_pub_to_der(const void *ecxkey, unsigned char **pder); int ossl_prov_ecx_priv_to_der(const void *ecxkey, unsigned char **pder); int ossl_prov_prepare_dsa_params(const void *dsa, int nid, - ASN1_STRING **pstr, int *pstrtype); + void **pstr, int *pstrtype); /* * Special variant of ossl_prov_prepare_dsa_params() that requires all * three parameters (P, Q and G) to be set. This is used when serializing * the public key. */ int ossl_prov_prepare_all_dsa_params(const void *dsa, int nid, - ASN1_STRING **pstr, int *pstrtype); + void **pstr, int *pstrtype); int ossl_prov_dsa_pub_to_der(const void *dsa, unsigned char **pder); int ossl_prov_dsa_priv_to_der(const void *dsa, unsigned char **pder); @@ -88,6 +97,16 @@ enum dh_print_type { int ossl_prov_print_dh(BIO *out, DH *dh, enum dh_print_type type); +#ifndef OPENSSL_NO_EC +enum ec_print_type { + ec_print_priv, + ec_print_pub, + ec_print_params +}; + +int ossl_prov_print_eckey(BIO *out, EC_KEY *eckey, enum ec_print_type type); +#endif /* OPENSSL_NO_EC */ + enum dsa_print_type { dsa_print_priv, dsa_print_pub, @@ -107,27 +126,27 @@ int ossl_prov_print_ecx(BIO *out, ECX_KEY *ecxkey, enum ecx_print_type type); int ossl_prov_write_priv_der_from_obj(BIO *out, const void *obj, int obj_nid, int (*p2s)(const void *obj, int nid, - ASN1_STRING **str, + void **str, int *strtype), int (*k2d)(const void *obj, unsigned char **pder), struct pkcs8_encrypt_ctx_st *ctx); int ossl_prov_write_priv_pem_from_obj(BIO *out, const void *obj, int obj_nid, int (*p2s)(const void *obj, int nid, - ASN1_STRING **str, + void **str, int *strtype), int (*k2d)(const void *obj, unsigned char **pder), struct pkcs8_encrypt_ctx_st *ctx); int ossl_prov_write_pub_der_from_obj(BIO *out, const void *obj, int obj_nid, int (*p2s)(const void *obj, int nid, - ASN1_STRING **str, + void **str, int *strtype), int (*k2d)(const void *obj, unsigned char **pder)); int ossl_prov_write_pub_pem_from_obj(BIO *out, const void *obj, int obj_nid, int (*p2s)(const void *obj, int nid, - ASN1_STRING **str, + void **str, int *strtype), int (*k2d)(const void *obj, unsigned char **pder)); diff --git a/providers/implementations/serializers/serializer_rsa_priv.c b/providers/implementations/serializers/serializer_rsa_priv.c index c236739e..af0aadcd 100644 --- a/providers/implementations/serializers/serializer_rsa_priv.c +++ b/providers/implementations/serializers/serializer_rsa_priv.c @@ -46,7 +46,7 @@ struct rsa_priv_ctx_st { /* Helper functions to prepare RSA-PSS params for serialization */ static int prepare_rsa_params(const void *rsa, int nid, - ASN1_STRING **pstr, int *pstrtype) + void **pstr, int *pstrtype) { const RSA_PSS_PARAMS *pss = RSA_get0_pss_params(rsa); *pstr = NULL; @@ -62,7 +62,8 @@ static int prepare_rsa_params(const void *rsa, int nid, return 1; } /* Encode PSS parameters */ - if (ASN1_item_pack((void *)pss, ASN1_ITEM_rptr(RSA_PSS_PARAMS), pstr) + if (ASN1_item_pack((void *)pss, ASN1_ITEM_rptr(RSA_PSS_PARAMS), + (ASN1_STRING **)pstr) == NULL) return 0; diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index 8be168ef..fa2d6e01 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -1728,7 +1728,7 @@ static int tls12_sigalg_allowed(const SSL *s, int op, const SIGALG_LOOKUP *lu) if (lu->hash == NID_undef) return 1; /* Security bits: half digest bits */ - secbits = EVP_MD_size(ssl_md(s->ctx, lu->hash_idx)) * 4; + secbits = EVP_MD_size(ssl_md(lu->hash_idx)) * 4; /* Finally see if security callback allows it */ sigalgstr[0] = (lu->sigalg >> 8) & 0xff; sigalgstr[1] = lu->sigalg & 0xff; diff --git a/test/CAss.cnf b/test/CAss.cnf index 8ca62b5c..d63f8562 100644 --- a/test/CAss.cnf +++ b/test/CAss.cnf @@ -1,7 +1,3 @@ -# -# SSLeay example configuration file. -# This is mostly being used for generation of certificate requests. -# #################################################################### [ req ] diff --git a/test/CAssdh.cnf b/test/CAssdh.cnf deleted file mode 100644 index 7c08a6e1..00000000 --- a/test/CAssdh.cnf +++ /dev/null @@ -1,22 +0,0 @@ -# -# SSLeay example configuration file. -# This is mostly being used for generation of certificate requests. -# -# hacked by iang to do DH certs - CA - -#################################################################### -[ req ] -distinguished_name = req_distinguished_name -encrypt_rsa_key = no - -[ req_distinguished_name ] -countryName = Country Name (2 letter code) -countryName_default = CU -countryName_value = CU - -organizationName = Organization Name (eg, company) -organizationName_value = La Junta de la Revolucion - -commonName = Common Name (eg, YOUR name) -commonName_value = Junta - diff --git a/test/CAssdsa.cnf b/test/CAssdsa.cnf deleted file mode 100644 index 8328abd7..00000000 --- a/test/CAssdsa.cnf +++ /dev/null @@ -1,21 +0,0 @@ -# -# SSLeay example configuration file. -# This is mostly being used for generation of certificate requests. -# -# hacked by iang to do DSA certs - CA - -#################################################################### -[ req ] -distinguished_name = req_distinguished_name -encrypt_rsa_key = no - -[ req_distinguished_name ] -countryName = Country Name (2 letter code) -countryName_default = ES -countryName_value = ES - -organizationName = Organization Name (eg, company) -organizationName_value = Hermanos Locos - -commonName = Common Name (eg, YOUR name) -commonName_value = Hermanos Locos CA diff --git a/test/CAssrsa.cnf b/test/CAssrsa.cnf deleted file mode 100644 index d5aa20a7..00000000 --- a/test/CAssrsa.cnf +++ /dev/null @@ -1,22 +0,0 @@ -# -# SSLeay example configuration file. -# This is mostly being used for generation of certificate requests. -# -# create RSA certs - CA - -#################################################################### -[ req ] -distinguished_name = req_distinguished_name -encrypt_key = no - -[ req_distinguished_name ] -countryName = Country Name (2 letter code) -countryName_default = ES -countryName_value = ES - -organizationName = Organization Name (eg, company) -organizationName_value = Hermanos Locos - -commonName = Common Name (eg, YOUR name) -commonName_value = Hermanos Locos CA - diff --git a/test/P1ss.cnf b/test/P1ss.cnf index 03f3cdb1..69baaaf8 100644 --- a/test/P1ss.cnf +++ b/test/P1ss.cnf @@ -1,7 +1,3 @@ -# -# SSLeay example configuration file. -# This is mostly being used for generation of certificate requests. -# #################################################################### [ req ] diff --git a/test/P2ss.cnf b/test/P2ss.cnf index 5adaecc7..8d4f3c8a 100644 --- a/test/P2ss.cnf +++ b/test/P2ss.cnf @@ -1,7 +1,3 @@ -# -# SSLeay example configuration file. -# This is mostly being used for generation of certificate requests. -# #################################################################### [ req ] diff --git a/test/README.ssltest.md b/test/README.ssltest.md index 30360f76..6fc73015 100644 --- a/test/README.ssltest.md +++ b/test/README.ssltest.md @@ -2,7 +2,7 @@ SSL testcases are configured in the `ssl-tests` directory. -Each `ssl_*.conf.in` file contains a number of test configurations. These files +Each `ssl_*.cnf.in` file contains a number of test configurations. These files are used to generate testcases in the OpenSSL CONF format. The precise test output can be dependent on the library configuration. The test @@ -10,9 +10,9 @@ harness generates the output files on the fly. However, for verification, we also include checked-in configuration outputs corresponding to the default configuration. These testcases live in -`test/ssl-tests/*.conf` files. +`test/ssl-tests/*.cnf` files. -For more details, see `ssl-tests/01-simple.conf.in` for an example. +For more details, see `ssl-tests/01-simple.cnf.in` for an example. ## Configuring the test @@ -219,24 +219,24 @@ client => { ## Adding a test to the test harness 1. Add a new test configuration to `test/ssl-tests`, following the examples of - existing `*.conf.in` files (for example, `01-simple.conf.in`). + existing `*.cnf.in` files (for example, `01-simple.cnf.in`). -2. Generate the generated `*.conf` test input file. You can do so by running +2. Generate the generated `*.cnf` test input file. You can do so by running `generate_ssl_tests.pl`: ``` $ ./config $ cd test -$ TOP=.. perl -I ../util/perl/ generate_ssl_tests.pl ssl-tests/my.conf.in \ - > ssl-tests/my.conf +$ TOP=.. perl -I ../util/perl/ generate_ssl_tests.pl ssl-tests/my.cnf.in \ + > ssl-tests/my.cnf ``` -where `my.conf.in` is your test input file. +where `my.cnf.in` is your test input file. -For example, to generate the test cases in `ssl-tests/01-simple.conf.in`, do +For example, to generate the test cases in `ssl-tests/01-simple.cnf.in`, do ``` -$ TOP=.. perl -I ../util/perl/ generate_ssl_tests.pl ssl-tests/01-simple.conf.in > ssl-tests/01-simple.conf +$ TOP=.. perl -I ../util/perl/ generate_ssl_tests.pl ssl-tests/01-simple.cnf.in > ssl-tests/01-simple.cnf ``` Alternatively (hackish but simple), you can comment out @@ -273,15 +273,15 @@ environment variable to point to the location of the certs. E.g., from the root OpenSSL directory, do ``` -$ CTLOG_FILE=test/ct/log_list.conf TEST_CERTS_DIR=test/certs test/ssl_test \ - test/ssl-tests/01-simple.conf +$ CTLOG_FILE=test/ct/log_list.cnf TEST_CERTS_DIR=test/certs test/ssl_test \ + test/ssl-tests/01-simple.cnf ``` or for shared builds ``` -$ CTLOG_FILE=test/ct/log_list.conf TEST_CERTS_DIR=test/certs \ - util/wrap.pl test/ssl_test test/ssl-tests/01-simple.conf +$ CTLOG_FILE=test/ct/log_list.cnf TEST_CERTS_DIR=test/certs \ + util/wrap.pl test/ssl_test test/ssl-tests/01-simple.cnf ``` Note that the test expectations sometimes depend on the Configure settings. For @@ -293,7 +293,7 @@ The Perl test harness automatically generates expected outputs, so users who just run `make test` do not need any extra steps. However, when running a test manually, keep in mind that the repository version -of the generated `test/ssl-tests/*.conf` correspond to expected outputs in with +of the generated `test/ssl-tests/*.cnf` correspond to expected outputs in with the default Configure options. To run `ssl_test` manually from the command line in a build with a different configuration, you may need to generate the right -`*.conf` file from the `*.conf.in` input first. +`*.cnf` file from the `*.cnf.in` input first. diff --git a/test/Sssdsa.cnf b/test/Sssdsa.cnf deleted file mode 100644 index 2fb35e08..00000000 --- a/test/Sssdsa.cnf +++ /dev/null @@ -1,25 +0,0 @@ -# -# SSLeay example configuration file. -# This is mostly being used for generation of certificate requests. -# -# hacked by iang to do DSA certs - Server - -#################################################################### -[ req ] -distinguished_name = req_distinguished_name -encrypt_rsa_key = no - -[ req_distinguished_name ] -countryName = Country Name (2 letter code) -countryName_default = ES -countryName_value = ES - -organizationName = Organization Name (eg, company) -organizationName_value = Tortilleras S.A. - -0.commonName = Common Name (eg, YOUR name) -0.commonName_value = Torti - -1.commonName = Common Name (eg, YOUR name) -1.commonName_value = Gordita - diff --git a/test/Sssrsa.cnf b/test/Sssrsa.cnf deleted file mode 100644 index f2b6e72b..00000000 --- a/test/Sssrsa.cnf +++ /dev/null @@ -1,24 +0,0 @@ -# -# SSLeay example configuration file. -# This is mostly being used for generation of certificate requests. -# -# create RSA certs - Server - -#################################################################### -[ req ] -distinguished_name = req_distinguished_name -encrypt_key = no - -[ req_distinguished_name ] -countryName = Country Name (2 letter code) -countryName_default = ES -countryName_value = ES - -organizationName = Organization Name (eg, company) -organizationName_value = Tortilleras S.A. - -0.commonName = Common Name (eg, YOUR name) -0.commonName_value = Torti - -1.commonName = Common Name (eg, YOUR name) -1.commonName_value = Gordita diff --git a/test/Uss.cnf b/test/Uss.cnf index 27517bd1..95ffb67d 100644 --- a/test/Uss.cnf +++ b/test/Uss.cnf @@ -1,7 +1,3 @@ -# -# SSLeay example configuration file. -# This is mostly being used for generation of certificate requests. -# CN2 = Brother 2 diff --git a/test/build.info b/test/build.info index 01289f2c..e6a25106 100644 --- a/test/build.info +++ b/test/build.info @@ -35,6 +35,7 @@ IF[{- !$disabled{tests} -}] ectest ecstresstest gmdifftest pbelutest \ destest mdc2test \ enginetest exptest \ + ssltest_old exptest rsa_test \ evp_pkey_provided_test evp_test evp_extra_test evp_fetch_prov_test \ v3nametest v3ext \ crltest danetest bad_dtls_test lhash_test sparse_array_test \ @@ -152,7 +153,7 @@ IF[{- !$disabled{tests} -}] SOURCE[evp_pkey_provided_test]=evp_pkey_provided_test.c INCLUDE[evp_pkey_provided_test]=../include ../apps/include - DEPEND[evp_pkey_provided_test]=../libcrypto libtestutil.a + DEPEND[evp_pkey_provided_test]=../libcrypto.a libtestutil.a IF[{- !$disabled{'deprecated-3.0'} -}] PROGRAMS{noinst}=igetest bftest casttest @@ -486,8 +487,8 @@ IF[{- !$disabled{tests} -}] IF[1] PROGRAMS{noinst}=asn1_internal_test modes_internal_test x509_internal_test \ tls13encryptiontest wpackettest ctype_internal_test \ - rdrand_sanitytest property_test ideatest rsa_mp_test \ - rsa_sp800_56b_test bn_internal_test ecdsatest rsa_test \ + rdrand_sanitytest property_test ideatest \ + rsa_sp800_56b_test bn_internal_test ecdsatest \ rc2test rc4test rc5test hmactest ffc_internal_test \ asn1_dsa_internal_test dsatest dsa_no_digest_size_test \ dhtest ssltest_old @@ -717,8 +718,8 @@ IF[{- !$disabled{tests} -}] DEFINE[provider_test]=NO_PROVIDER_MODULE DEFINE[provider_internal_test]=NO_PROVIDER_MODULE ENDIF - DEPEND[]=provider_internal_test.conf - GENERATE[provider_internal_test.conf]=provider_internal_test.conf.in + DEPEND[]=provider_internal_test.cnf + GENERATE[provider_internal_test.cnf]=provider_internal_test.cnf.in PROGRAMS{noinst}=params_test SOURCE[params_test]=params_test.c diff --git a/test/ct/log_list.conf b/test/ct/log_list.cnf similarity index 100% rename from test/ct/log_list.conf rename to test/ct/log_list.cnf diff --git a/test/default-and-fips.cnf b/test/default-and-fips.cnf index 6db1a940..03f5a831 100644 --- a/test/default-and-fips.cnf +++ b/test/default-and-fips.cnf @@ -1,6 +1,6 @@ openssl_conf = openssl_init -.include fipsinstall.conf +.include fipsinstall.cnf [openssl_init] providers = provider_sect diff --git a/test/dhtest.c b/test/dhtest.c index b3e2e2fd..ebc45999 100644 --- a/test/dhtest.c +++ b/test/dhtest.c @@ -700,6 +700,7 @@ static int dh_test_prime_groups(int index) int ok = 0; DH *dh = NULL; const BIGNUM *p, *q, *g; + long len; if (!TEST_ptr(dh = DH_new_by_nid(prime_groups[index]))) goto err; @@ -709,11 +710,80 @@ static int dh_test_prime_groups(int index) if (!TEST_int_eq(DH_get_nid(dh), prime_groups[index])) goto err; + + len = DH_get_length(dh); + if (!TEST_true(len > 0) + || !TEST_true(len <= BN_num_bits(q))) + goto err; + ok = 1; err: DH_free(dh); return ok; } + +static int dh_get_nid(void) +{ + int ok = 0; + const BIGNUM *p, *q, *g; + BIGNUM *pcpy = NULL, *gcpy = NULL, *qcpy = NULL; + DH *dh1 = DH_new_by_nid(NID_ffdhe2048); + DH *dh2 = DH_new(); + + if (!TEST_ptr(dh1) + || !TEST_ptr(dh2)) + goto err; + + /* Set new DH parameters manually using a existing named group's p & g */ + DH_get0_pqg(dh1, &p, &q, &g); + if (!TEST_ptr(p) + || !TEST_ptr(q) + || !TEST_ptr(g) + || !TEST_ptr(pcpy = BN_dup(p)) + || !TEST_ptr(gcpy = BN_dup(g))) + goto err; + + if (!TEST_true(DH_set0_pqg(dh2, pcpy, NULL, gcpy))) + goto err; + pcpy = gcpy = NULL; + /* Test q is set if p and g are provided */ + if (!TEST_ptr(DH_get0_q(dh2))) + goto err; + + /* Test that setting p & g manually returns that it is a named group */ + if (!TEST_int_eq(DH_get_nid(dh2), NID_ffdhe2048)) + goto err; + + /* Test that after changing g it is no longer a named group */ + if (!TEST_ptr(gcpy = BN_dup(BN_value_one()))) + goto err; + if (!TEST_true(DH_set0_pqg(dh2, NULL, NULL, gcpy))) + goto err; + gcpy = NULL; + if (!TEST_int_eq(DH_get_nid(dh2), NID_undef)) + goto err; + + /* Test that setting an incorrect q results in this not being a named group */ + if (!TEST_ptr(pcpy = BN_dup(p)) + || !TEST_ptr(qcpy = BN_dup(q)) + || !TEST_ptr(gcpy = BN_dup(g)) + || !TEST_int_eq(BN_add_word(qcpy, 2), 1) + || !TEST_true(DH_set0_pqg(dh2, pcpy, qcpy, gcpy))) + goto err; + pcpy = qcpy = gcpy = NULL; + if (!TEST_int_eq(DH_get_nid(dh2), NID_undef)) + goto err; + + ok = 1; +err: + BN_free(pcpy); + BN_free(qcpy); + BN_free(gcpy); + DH_free(dh2); + DH_free(dh1); + return ok; +} + #endif @@ -726,6 +796,7 @@ int setup_tests(void) ADD_TEST(rfc5114_test); ADD_TEST(rfc7919_test); ADD_ALL_TESTS(dh_test_prime_groups, OSSL_NELEM(prime_groups)); + ADD_TEST(dh_get_nid); #endif return 1; } diff --git a/test/evp_pkey_provided_test.c b/test/evp_pkey_provided_test.c index c1616985..c395f185 100644 --- a/test/evp_pkey_provided_test.c +++ b/test/evp_pkey_provided_test.c @@ -1,5 +1,5 @@ /* - * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -15,6 +15,7 @@ #include #include "crypto/ecx.h" #include "internal/nelem.h" +#include "internal/param_build.h" #include "crypto/evp.h" /* For the internal API */ #include "testutil.h" @@ -155,7 +156,7 @@ static int test_print_key_type_using_serializer(const char *alg, int type, const char *pq; OSSL_SERIALIZER_CTX *ctx = NULL; BIO *membio = BIO_new(BIO_s_mem()); - int ret = 1; + int ret = 0; switch (type) { case PRIV_TEXT: @@ -187,10 +188,8 @@ static int test_print_key_type_using_serializer(const char *alg, int type, goto err; } - if (!TEST_ptr(membio)) { - ret = 0; + if (!TEST_ptr(membio)) goto err; - } /* Make a context, it's valid for several prints */ TEST_note("Setting up a OSSL_SERIALIZER context with passphrase"); @@ -203,7 +202,7 @@ static int test_print_key_type_using_serializer(const char *alg, int type, TEST_note("Testing with no encryption"); if (!TEST_true(OSSL_SERIALIZER_to_bio(ctx, membio)) || !TEST_true(compare_with_file(alg, type, membio))) - ret = 0; + goto err; if (type == PRIV_PEM) { /* Set a passphrase to be used later */ @@ -216,22 +215,22 @@ static int test_print_key_type_using_serializer(const char *alg, int type, TEST_note("Displaying PEM encrypted with AES-256-CBC"); if (!TEST_true(OSSL_SERIALIZER_CTX_set_cipher(ctx, "AES-256-CBC", NULL)) || !TEST_true(OSSL_SERIALIZER_to_bio(ctx, bio_out))) - ret = 0; + goto err; /* Use an invalid cipher name, which should generate no output */ TEST_note("NOT Displaying PEM encrypted with (invalid) FOO"); if (!TEST_false(OSSL_SERIALIZER_CTX_set_cipher(ctx, "FOO", NULL)) || !TEST_false(OSSL_SERIALIZER_to_bio(ctx, bio_out))) - ret = 0; + goto err; /* Clear the cipher. This should give us an unencrypted PEM again */ TEST_note("Testing with encryption cleared (no encryption)"); if (!TEST_true(OSSL_SERIALIZER_CTX_set_cipher(ctx, NULL, NULL)) || !TEST_true(OSSL_SERIALIZER_to_bio(ctx, membio)) || !TEST_true(compare_with_file(alg, type, membio))) - ret = 0; + goto err; } - + ret = 1; err: BIO_free(membio); OSSL_SERIALIZER_CTX_free(ctx); @@ -332,7 +331,7 @@ static int test_fromdata_rsa(void) static int test_fromdata_dh(void) { int ret = 0; - EVP_PKEY_CTX *ctx = NULL; + EVP_PKEY_CTX *ctx = NULL, *key_ctx = NULL; EVP_PKEY *pk = NULL; /* * 32-bit DH key, extracted from this command, @@ -368,9 +367,19 @@ static int test_fromdata_dh(void) ret = test_print_key_using_pem("DH", pk) && test_print_key_using_serializer("DH", pk); + if (!TEST_ptr(key_ctx = EVP_PKEY_CTX_new_from_pkey(NULL, pk, ""))) + goto err; + + if (!TEST_false(EVP_PKEY_check(key_ctx)) + || !TEST_true(EVP_PKEY_public_check(key_ctx)) + || !TEST_false(EVP_PKEY_private_check(key_ctx)) /* Need a q */ + || !TEST_true(EVP_PKEY_pairwise_check(key_ctx))) + goto err; + err: EVP_PKEY_free(pk); EVP_PKEY_CTX_free(ctx); + EVP_PKEY_CTX_free(key_ctx); return ret; } @@ -479,14 +488,79 @@ static int test_fromdata_ecx(int tst) ret = test_print_key_using_pem(alg, pk) && test_print_key_using_serializer(alg, pk); - err: +err: EVP_PKEY_free(pk); EVP_PKEY_CTX_free(ctx); return ret; } -#endif +static int test_fromdata_ec(void) +{ + int ret = 0; + EVP_PKEY_CTX *ctx = NULL; + EVP_PKEY *pk = NULL; + OSSL_PARAM_BLD bld; + BIGNUM *ec_priv_bn = NULL; + OSSL_PARAM *fromdata_params = NULL; + const char *alg = "EC"; + static const unsigned char ec_pub_keydata[] = { + 0x04, + 0x1b, 0x93, 0x67, 0x55, 0x1c, 0x55, 0x9f, 0x63, + 0xd1, 0x22, 0xa4, 0xd8, 0xd1, 0x0a, 0x60, 0x6d, + 0x02, 0xa5, 0x77, 0x57, 0xc8, 0xa3, 0x47, 0x73, + 0x3a, 0x6a, 0x08, 0x28, 0x39, 0xbd, 0xc9, 0xd2, + 0x80, 0xec, 0xe9, 0xa7, 0x08, 0x29, 0x71, 0x2f, + 0xc9, 0x56, 0x82, 0xee, 0x9a, 0x85, 0x0f, 0x6d, + 0x7f, 0x59, 0x5f, 0x8c, 0xd1, 0x96, 0x0b, 0xdf, + 0x29, 0x3e, 0x49, 0x07, 0x88, 0x3f, 0x9a, 0x29 + }; + static const unsigned char ec_priv_keydata[] = { + 0x33, 0xd0, 0x43, 0x83, 0xa9, 0x89, 0x56, 0x03, + 0xd2, 0xd7, 0xfe, 0x6b, 0x01, 0x6f, 0xe4, 0x59, + 0xcc, 0x0d, 0x9a, 0x24, 0x6c, 0x86, 0x1b, 0x2e, + 0xdc, 0x4b, 0x4d, 0x35, 0x43, 0xe1, 0x1b, 0xad + }; + + ossl_param_bld_init(&bld); + + if (!TEST_ptr(ec_priv_bn = BN_bin2bn(ec_priv_keydata, + sizeof(ec_priv_keydata), NULL))) + goto err; + + if (ossl_param_bld_push_utf8_string(&bld, OSSL_PKEY_PARAM_EC_NAME, + "prime256v1", 0) <= 0) + goto err; + if (ossl_param_bld_push_octet_string(&bld, OSSL_PKEY_PARAM_PUB_KEY, + ec_pub_keydata, + sizeof(ec_pub_keydata)) <= 0) + goto err; + if (ossl_param_bld_push_BN(&bld, OSSL_PKEY_PARAM_PRIV_KEY, ec_priv_bn) <= 0) + goto err; + if (!TEST_ptr(fromdata_params = ossl_param_bld_to_param(&bld))) + goto err; + ctx = EVP_PKEY_CTX_new_from_name(NULL, alg, NULL); + if (!TEST_ptr(ctx)) + goto err; + + if (!TEST_true(EVP_PKEY_key_fromdata_init(ctx)) + || !TEST_true(EVP_PKEY_fromdata(ctx, &pk, fromdata_params)) + || !TEST_int_eq(EVP_PKEY_bits(pk), 256) + || !TEST_int_eq(EVP_PKEY_security_bits(pk), 128) + || !TEST_int_eq(EVP_PKEY_size(pk), 2 + 35 * 2)) + goto err; + + ret = test_print_key_using_pem(alg, pk) + && test_print_key_using_serializer(alg, pk); +err: + BN_free(ec_priv_bn); + ossl_param_bld_free(fromdata_params); + EVP_PKEY_free(pk); + EVP_PKEY_CTX_free(ctx); + return ret; +} + +#endif /* OPENSSL_NO_EC */ int setup_tests(void) { @@ -504,6 +578,7 @@ int setup_tests(void) #endif #ifndef OPENSSL_NO_EC ADD_ALL_TESTS(test_fromdata_ecx, 2); + ADD_TEST(test_fromdata_ec); #endif return 1; } diff --git a/test/fips.cnf b/test/fips.cnf index d77d35b9..32c18be6 100644 --- a/test/fips.cnf +++ b/test/fips.cnf @@ -1,6 +1,6 @@ openssl_conf = openssl_init -.include fipsinstall.conf +.include fipsinstall.cnf [openssl_init] providers = provider_sect diff --git a/test/provider_internal_test.conf.in b/test/provider_internal_test.cnf.in similarity index 100% rename from test/provider_internal_test.conf.in rename to test/provider_internal_test.cnf.in diff --git a/test/recipes/02-test_internal_provider.t b/test/recipes/02-test_internal_provider.t index 615d17a8..2b77d4b5 100644 --- a/test/recipes/02-test_internal_provider.t +++ b/test/recipes/02-test_internal_provider.t @@ -14,6 +14,6 @@ use OpenSSL::Test::Utils; setup("test_internal_provider"); $ENV{OPENSSL_MODULES} = bldtop_dir("test"); -$ENV{OPENSSL_CONF} = bldtop_file("test", "provider_internal_test.conf"); +$ENV{OPENSSL_CONF} = bldtop_file("test", "provider_internal_test.cnf"); simple_test("test_internal_provider", "provider_internal_test"); diff --git a/test/recipes/03-test_fipsinstall.t b/test/recipes/03-test_fipsinstall.t index 71e8db10..3be6346a 100644 --- a/test/recipes/03-test_fipsinstall.t +++ b/test/recipes/03-test_fipsinstall.t @@ -30,7 +30,7 @@ my $infile = bldtop_file('providers', platform->dso('fips')); $ENV{OPENSSL_MODULES} = bldtop_dir("providers"); # fail if no module name -ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.conf', '-module', +ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', '-provider_name', 'fips', '-macopt', 'digest:SHA256', '-macopt', 'hexkey:00', '-section_name', 'fips_install'])), @@ -44,57 +44,57 @@ ok(!run(app(['openssl', 'fipsinstall', '-in', 'dummy.tmp', '-module', $infile, "fipsinstall verify fail"); -# output a fips.conf file containing mac data -ok(run(app(['openssl', 'fipsinstall', '-out', 'fips.conf', '-module', $infile, +# output a fips.cnf file containing mac data +ok(run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile, '-provider_name', 'fips', '-mac_name', 'HMAC', '-macopt', 'digest:SHA256', '-macopt', 'hexkey:00', '-section_name', 'fips_install'])), "fipsinstall"); -# verify the fips.conf file -ok(run(app(['openssl', 'fipsinstall', '-in', 'fips.conf', '-module', $infile, +# verify the fips.cnf file +ok(run(app(['openssl', 'fipsinstall', '-in', 'fips.cnf', '-module', $infile, '-provider_name', 'fips', '-mac_name', 'HMAC', '-macopt', 'digest:SHA256', '-macopt', 'hexkey:00', '-section_name', 'fips_install', '-verify'])), "fipsinstall verify"); -# fail to verify the fips.conf file if a different key is used -ok(!run(app(['openssl', 'fipsinstall', '-in', 'fips.conf', '-module', $infile, +# fail to verify the fips.cnf file if a different key is used +ok(!run(app(['openssl', 'fipsinstall', '-in', 'fips.cnf', '-module', $infile, '-provider_name', 'fips', '-mac_name', 'HMAC', '-macopt', 'digest:SHA256', '-macopt', 'hexkey:01', '-section_name', 'fips_install', '-verify'])), "fipsinstall verify fail bad key"); -# fail to verify the fips.conf file if a different mac digest is used -ok(!run(app(['openssl', 'fipsinstall', '-in', 'fips.conf', '-module', $infile, +# fail to verify the fips.cnf file if a different mac digest is used +ok(!run(app(['openssl', 'fipsinstall', '-in', 'fips.cnf', '-module', $infile, '-provider_name', 'fips', '-mac_name', 'HMAC', '-macopt', 'digest:SHA512', '-macopt', 'hexkey:00', '-section_name', 'fips_install', '-verify'])), "fipsinstall verify fail incorrect digest"); # corrupt the module hmac -ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.conf', '-module', $infile, +ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile, '-provider_name', 'fips', '-mac_name', 'HMAC', '-macopt', 'digest:SHA256', '-macopt', 'hexkey:00', '-section_name', 'fips_install', '-corrupt_desc', 'HMAC'])), "fipsinstall fails when the module integrity is corrupted"); # corrupt the first digest -ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.conf', '-module', $infile, +ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile, '-provider_name', 'fips', '-mac_name', 'HMAC', '-macopt', 'digest:SHA256', '-macopt', 'hexkey:00', '-section_name', 'fips_install', '-corrupt_desc', 'SHA1'])), "fipsinstall fails when the digest result is corrupted"); # corrupt another digest -ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.conf', '-module', $infile, +ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile, '-provider_name', 'fips', '-mac_name', 'HMAC', '-macopt', 'digest:SHA256', '-macopt', 'hexkey:00', '-section_name', 'fips_install', '-corrupt_desc', 'SHA3'])), "fipsinstall fails when the digest result is corrupted"); # corrupt DRBG -ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.conf', '-module', $infile, +ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile, '-provider_name', 'fips', '-mac_name', 'HMAC', '-macopt', 'digest:SHA256', '-macopt', 'hexkey:00', '-section_name', 'fips_install', '-corrupt_desc', 'CTR'])), diff --git a/test/recipes/04-test_conf.t b/test/recipes/04-test_conf.t index 9103cbc8..92a570c5 100644 --- a/test/recipes/04-test_conf.t +++ b/test/recipes/04-test_conf.t @@ -16,8 +16,8 @@ use File::Compare qw(compare_text); setup('test_conf'); my %input_result = ( - 'dollarid_on.conf' => 'dollarid_on.txt', - 'dollarid_off.conf' => 'dollarid_off.txt', + 'dollarid_on.cnf' => 'dollarid_on.txt', + 'dollarid_off.cnf' => 'dollarid_off.txt', ); plan skip_all => 'This is unsupported for cross compiled configurations' diff --git a/test/recipes/04-test_conf_data/dollarid_off.conf b/test/recipes/04-test_conf_data/dollarid_off.cnf similarity index 100% rename from test/recipes/04-test_conf_data/dollarid_off.conf rename to test/recipes/04-test_conf_data/dollarid_off.cnf diff --git a/test/recipes/04-test_conf_data/dollarid_on.conf b/test/recipes/04-test_conf_data/dollarid_on.cnf similarity index 100% rename from test/recipes/04-test_conf_data/dollarid_on.conf rename to test/recipes/04-test_conf_data/dollarid_on.cnf diff --git a/test/recipes/25-test_req.t b/test/recipes/25-test_req.t index 1a6efa8b..662109c8 100644 --- a/test/recipes/25-test_req.t +++ b/test/recipes/25-test_req.t @@ -15,7 +15,7 @@ use OpenSSL::Test qw/:DEFAULT srctop_file/; setup("test_req"); -plan tests => 15; +plan tests => 16; require_ok(srctop_file('test','recipes','tconversion.pl')); @@ -42,6 +42,34 @@ ok(!run(app([@addext_args, "-addext", $val, "-addext", $val2]))); ok(!run(app([@addext_args, "-addext", $val, "-addext", $val3]))); ok(!run(app([@addext_args, "-addext", $val2, "-addext", $val3]))); +subtest "generating alt certificate requests with RSA" => sub { + plan tests => 3; + + SKIP: { + skip "RSA is not supported by this OpenSSL build", 2 + if disabled("rsa"); + + ok(run(app(["openssl", "req", + "-config", srctop_file("test", "test.cnf"), + "-section", "altreq", + "-new", "-out", "testreq-rsa.pem", "-utf8", + "-key", srctop_file("test", "testrsa.pem")])), + "Generating request"); + + ok(run(app(["openssl", "req", + "-config", srctop_file("test", "test.cnf"), + "-verify", "-in", "testreq-rsa.pem", "-noout"])), + "Verifying signature on request"); + + ok(run(app(["openssl", "req", + "-config", srctop_file("test", "test.cnf"), + "-section", "altreq", + "-verify", "-in", "testreq-rsa.pem", "-noout"])), + "Verifying signature on request"); + } +}; + + subtest "generating certificate requests with RSA" => sub { plan tests => 2; diff --git a/test/recipes/30-test_evp.t b/test/recipes/30-test_evp.t index 575a471d..9b940aa5 100644 --- a/test/recipes/30-test_evp.t +++ b/test/recipes/30-test_evp.t @@ -84,7 +84,7 @@ unless ($no_fips) { $ENV{OPENSSL_CONF_INCLUDE} = bldtop_dir("providers"); ok(run(app(['openssl', 'fipsinstall', - '-out', bldtop_file('providers', 'fipsinstall.conf'), + '-out', bldtop_file('providers', 'fipsinstall.cnf'), '-module', $infile, '-provider_name', 'fips', '-mac_name', 'HMAC', '-macopt', 'digest:SHA256', '-macopt', 'hexkey:00', diff --git a/test/recipes/30-test_evp_fetch_prov.t b/test/recipes/30-test_evp_fetch_prov.t index ce7c8340..8ffd2a50 100644 --- a/test/recipes/30-test_evp_fetch_prov.t +++ b/test/recipes/30-test_evp_fetch_prov.t @@ -48,7 +48,7 @@ my @testdata = ( unless ($no_fips) { push @setups, { cmd => app(['openssl', 'fipsinstall', - '-out', bldtop_file('providers', 'fipsinstall.conf'), + '-out', bldtop_file('providers', 'fipsinstall.cnf'), '-module', bldtop_file('providers', platform->dso('fips')), '-provider_name', 'fips', '-mac_name', 'HMAC', '-macopt', 'digest:SHA256', '-macopt', 'hexkey:00', diff --git a/test/recipes/30-test_evp_pkey_provided.t b/test/recipes/30-test_evp_pkey_provided.t index 74b36645..d9efbeaa 100644 --- a/test/recipes/30-test_evp_pkey_provided.t +++ b/test/recipes/30-test_evp_pkey_provided.t @@ -1,6 +1,5 @@ #! /usr/bin/env perl -# Copyright 2018 The OpenSSL Project Authors. All Rights Reserved. -# Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved. +# Copyright 2020 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy diff --git a/test/recipes/30-test_evp_pkey_provided/EC.priv.der b/test/recipes/30-test_evp_pkey_provided/EC.priv.der new file mode 100644 index 00000000..2f74cfc1 Binary files /dev/null and b/test/recipes/30-test_evp_pkey_provided/EC.priv.der differ diff --git a/test/recipes/30-test_evp_pkey_provided/EC.priv.pem b/test/recipes/30-test_evp_pkey_provided/EC.priv.pem new file mode 100644 index 00000000..953b7a61 --- /dev/null +++ b/test/recipes/30-test_evp_pkey_provided/EC.priv.pem @@ -0,0 +1,5 @@ +-----BEGIN PRIVATE KEY----- +MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgM9BDg6mJVgPS1/5r +AW/kWcwNmiRshhsu3EtNNUPhG62hRANCAAQbk2dVHFWfY9EipNjRCmBtAqV3V8ij +R3M6aggoOb3J0oDs6acIKXEvyVaC7pqFD21/WV+M0ZYL3yk+SQeIP5op +-----END PRIVATE KEY----- diff --git a/test/recipes/30-test_evp_pkey_provided/EC.priv.txt b/test/recipes/30-test_evp_pkey_provided/EC.priv.txt new file mode 100644 index 00000000..9360d892 --- /dev/null +++ b/test/recipes/30-test_evp_pkey_provided/EC.priv.txt @@ -0,0 +1,13 @@ +Private-Key: (256 bit) +priv: + 33:d0:43:83:a9:89:56:03:d2:d7:fe:6b:01:6f:e4: + 59:cc:0d:9a:24:6c:86:1b:2e:dc:4b:4d:35:43:e1: + 1b:ad +pub: + 04:1b:93:67:55:1c:55:9f:63:d1:22:a4:d8:d1:0a: + 60:6d:02:a5:77:57:c8:a3:47:73:3a:6a:08:28:39: + bd:c9:d2:80:ec:e9:a7:08:29:71:2f:c9:56:82:ee: + 9a:85:0f:6d:7f:59:5f:8c:d1:96:0b:df:29:3e:49: + 07:88:3f:9a:29 +ASN1 OID: prime256v1 +NIST CURVE: P-256 diff --git a/test/recipes/30-test_evp_pkey_provided/EC.pub.der b/test/recipes/30-test_evp_pkey_provided/EC.pub.der new file mode 100644 index 00000000..b08f9a74 Binary files /dev/null and b/test/recipes/30-test_evp_pkey_provided/EC.pub.der differ diff --git a/test/recipes/30-test_evp_pkey_provided/EC.pub.pem b/test/recipes/30-test_evp_pkey_provided/EC.pub.pem new file mode 100644 index 00000000..16ec8382 --- /dev/null +++ b/test/recipes/30-test_evp_pkey_provided/EC.pub.pem @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEG5NnVRxVn2PRIqTY0QpgbQKld1fI +o0dzOmoIKDm9ydKA7OmnCClxL8lWgu6ahQ9tf1lfjNGWC98pPkkHiD+aKQ== +-----END PUBLIC KEY----- diff --git a/test/recipes/30-test_evp_pkey_provided/EC.pub.txt b/test/recipes/30-test_evp_pkey_provided/EC.pub.txt new file mode 100644 index 00000000..612ba89b --- /dev/null +++ b/test/recipes/30-test_evp_pkey_provided/EC.pub.txt @@ -0,0 +1,9 @@ +Public-Key: (256 bit) +pub: + 04:1b:93:67:55:1c:55:9f:63:d1:22:a4:d8:d1:0a: + 60:6d:02:a5:77:57:c8:a3:47:73:3a:6a:08:28:39: + bd:c9:d2:80:ec:e9:a7:08:29:71:2f:c9:56:82:ee: + 9a:85:0f:6d:7f:59:5f:8c:d1:96:0b:df:29:3e:49: + 07:88:3f:9a:29 +ASN1 OID: prime256v1 +NIST CURVE: P-256 diff --git a/test/recipes/70-test_comp.t b/test/recipes/70-test_comp.t index 9c5e16ed..9dc0cbb9 100644 --- a/test/recipes/70-test_comp.t +++ b/test/recipes/70-test_comp.t @@ -28,7 +28,7 @@ plan skip_all => "$test_name needs TLSv1.3 or TLSv1.2 enabled" if disabled("tls1_3") && disabled("tls1_2"); $ENV{OPENSSL_ia32cap} = '~0x200000200000000'; -$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf"); +$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.cnf"); use constant { MULTIPLE_COMPRESSIONS => 0, diff --git a/test/recipes/70-test_sslmessages.t b/test/recipes/70-test_sslmessages.t index 9f8c3226..95c4cbe5 100644 --- a/test/recipes/70-test_sslmessages.t +++ b/test/recipes/70-test_sslmessages.t @@ -30,7 +30,7 @@ plan skip_all => "$test_name needs TLS enabled" || (!disabled("tls1_3") && disabled("tls1_2")); $ENV{OPENSSL_ia32cap} = '~0x200000200000000'; -$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf"); +$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.cnf"); my $proxy = TLSProxy::Proxy->new( undef, diff --git a/test/recipes/70-test_sslversions.t b/test/recipes/70-test_sslversions.t index 45ecf5c5..636d2e79 100644 --- a/test/recipes/70-test_sslversions.t +++ b/test/recipes/70-test_sslversions.t @@ -49,7 +49,7 @@ my $proxy = TLSProxy::Proxy->new( ); #We're just testing various negative and unusual scenarios here. ssltest with -#02-protocol-version.conf should check all the various combinations of normal +#02-protocol-version.cnf should check all the various combinations of normal #version neg #Test 1: An empty supported_versions extension should not succeed diff --git a/test/recipes/70-test_tls13kexmodes.t b/test/recipes/70-test_tls13kexmodes.t index ad10edde..27cec7ad 100644 --- a/test/recipes/70-test_tls13kexmodes.t +++ b/test/recipes/70-test_tls13kexmodes.t @@ -32,7 +32,7 @@ plan skip_all => "$test_name needs EC enabled" if disabled("ec"); $ENV{OPENSSL_ia32cap} = '~0x200000200000000'; -$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf"); +$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.cnf"); @handmessages = ( diff --git a/test/recipes/70-test_tls13messages.t b/test/recipes/70-test_tls13messages.t index 02afbdc4..d9ea2118 100644 --- a/test/recipes/70-test_tls13messages.t +++ b/test/recipes/70-test_tls13messages.t @@ -32,7 +32,7 @@ plan skip_all => "$test_name needs EC enabled" if disabled("ec"); $ENV{OPENSSL_ia32cap} = '~0x200000200000000'; -$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf"); +$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.cnf"); @handmessages = ( diff --git a/test/recipes/70-test_tls13psk.t b/test/recipes/70-test_tls13psk.t index 11031f3f..ea48599d 100644 --- a/test/recipes/70-test_tls13psk.t +++ b/test/recipes/70-test_tls13psk.t @@ -28,7 +28,7 @@ plan skip_all => "$test_name needs TLSv1.3 enabled" if disabled("tls1_3"); $ENV{OPENSSL_ia32cap} = '~0x200000200000000'; -$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf"); +$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.cnf"); my $proxy = TLSProxy::Proxy->new( undef, diff --git a/test/recipes/80-test_ct.t b/test/recipes/80-test_ct.t index 87705cf6..0017cfdc 100644 --- a/test/recipes/80-test_ct.t +++ b/test/recipes/80-test_ct.t @@ -11,7 +11,7 @@ use OpenSSL::Test qw/:DEFAULT srctop_file srctop_dir/; use OpenSSL::Test::Simple; setup("test_ct"); -$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf"); +$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.cnf"); $ENV{CT_DIR} = srctop_dir("test", "ct"); $ENV{CERTS_DIR} = srctop_dir("test", "certs"); simple_test("test_ct", "ct_test", "ct", "ec"); diff --git a/test/recipes/80-test_ssl_new.t b/test/recipes/80-test_ssl_new.t index 01a49173..3b1857cc 100644 --- a/test/recipes/80-test_ssl_new.t +++ b/test/recipes/80-test_ssl_new.t @@ -19,9 +19,9 @@ use OpenSSL::Test::Utils qw/disabled alldisabled available_protocols/; setup("test_ssl_new"); $ENV{TEST_CERTS_DIR} = srctop_dir("test", "certs"); -$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf"); +$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.cnf"); -my @conf_srcs = glob(srctop_file("test", "ssl-tests", "*.conf.in")); +my @conf_srcs = glob(srctop_file("test", "ssl-tests", "*.cnf.in")); map { s/;.*// } @conf_srcs if $^O eq "VMS"; my @conf_files = map { basename($_, ".in") } @conf_srcs; map { s/\^// } @conf_files if $^O eq "VMS"; @@ -54,56 +54,56 @@ my $no_ocsp = disabled("ocsp"); # Add your test here if the test conf.in generates test cases and/or # expectations dynamically based on the OpenSSL compile-time config. my %conf_dependent_tests = ( - "02-protocol-version.conf" => !$is_default_tls, - "04-client_auth.conf" => !$is_default_tls || !$is_default_dtls + "02-protocol-version.cnf" => !$is_default_tls, + "04-client_auth.cnf" => !$is_default_tls || !$is_default_dtls || !disabled("sctp"), - "05-sni.conf" => disabled("tls1_1"), - "07-dtls-protocol-version.conf" => !$is_default_dtls || !disabled("sctp"), - "10-resumption.conf" => !$is_default_tls || $no_ec, - "11-dtls_resumption.conf" => !$is_default_dtls || !disabled("sctp"), - "16-dtls-certstatus.conf" => !$is_default_dtls || !disabled("sctp"), - "17-renegotiate.conf" => disabled("tls1_2"), - "18-dtls-renegotiate.conf" => disabled("dtls1_2") || !disabled("sctp"), - "19-mac-then-encrypt.conf" => !$is_default_tls, - "20-cert-select.conf" => !$is_default_tls || $no_dh || $no_dsa, - "22-compression.conf" => !$is_default_tls, - "25-cipher.conf" => disabled("poly1305") || disabled("chacha"), - "27-ticket-appdata.conf" => !$is_default_tls, - "28-seclevel.conf" => disabled("tls1_2") || $no_ec, - "30-extended-master-secret.conf" => disabled("tls1_2"), + "05-sni.cnf" => disabled("tls1_1"), + "07-dtls-protocol-version.cnf" => !$is_default_dtls || !disabled("sctp"), + "10-resumption.cnf" => !$is_default_tls || $no_ec, + "11-dtls_resumption.cnf" => !$is_default_dtls || !disabled("sctp"), + "16-dtls-certstatus.cnf" => !$is_default_dtls || !disabled("sctp"), + "17-renegotiate.cnf" => disabled("tls1_2"), + "18-dtls-renegotiate.cnf" => disabled("dtls1_2") || !disabled("sctp"), + "19-mac-then-encrypt.cnf" => !$is_default_tls, + "20-cert-select.cnf" => !$is_default_tls || $no_dh || $no_dsa, + "22-compression.cnf" => !$is_default_tls, + "25-cipher.cnf" => disabled("poly1305") || disabled("chacha"), + "27-ticket-appdata.cnf" => !$is_default_tls, + "28-seclevel.cnf" => disabled("tls1_2") || $no_ec, + "30-extended-master-secret.cnf" => disabled("tls1_2"), ); # Add your test here if it should be skipped for some compile-time # configurations. Default is $no_tls but some tests have different skip # conditions. my %skip = ( - "06-sni-ticket.conf" => $no_tls_below1_3, - "07-dtls-protocol-version.conf" => $no_dtls, - "08-npn.conf" => (disabled("tls1") && disabled("tls1_1") + "06-sni-ticket.cnf" => $no_tls_below1_3, + "07-dtls-protocol-version.cnf" => $no_dtls, + "08-npn.cnf" => (disabled("tls1") && disabled("tls1_1") && disabled("tls1_2")) || $no_npn, - "10-resumption.conf" => disabled("tls1_1") || disabled("tls1_2"), - "11-dtls_resumption.conf" => disabled("dtls1") || disabled("dtls1_2"), - "12-ct.conf" => $no_tls || $no_ct || $no_ec, + "10-resumption.cnf" => disabled("tls1_1") || disabled("tls1_2"), + "11-dtls_resumption.cnf" => disabled("dtls1") || disabled("dtls1_2"), + "12-ct.cnf" => $no_tls || $no_ct || $no_ec, # We could run some of these tests without TLS 1.2 if we had a per-test # disable instruction but that's a bizarre configuration not worth # special-casing for. # TODO(TLS 1.3): We should review this once we have TLS 1.3. - "13-fragmentation.conf" => disabled("tls1_2"), - "14-curves.conf" => disabled("tls1_2") || $no_ec || $no_ec2m, - "15-certstatus.conf" => $no_tls || $no_ocsp, - "16-dtls-certstatus.conf" => $no_dtls || $no_ocsp, - "17-renegotiate.conf" => $no_tls_below1_3, - "18-dtls-renegotiate.conf" => $no_dtls, - "19-mac-then-encrypt.conf" => $no_pre_tls1_3, - "20-cert-select.conf" => disabled("tls1_2") || $no_ec, - "21-key-update.conf" => disabled("tls1_3"), - "22-compression.conf" => disabled("zlib") || $no_tls, - "23-srp.conf" => (disabled("tls1") && disabled ("tls1_1") + "13-fragmentation.cnf" => disabled("tls1_2"), + "14-curves.cnf" => disabled("tls1_2") || $no_ec || $no_ec2m, + "15-certstatus.cnf" => $no_tls || $no_ocsp, + "16-dtls-certstatus.cnf" => $no_dtls || $no_ocsp, + "17-renegotiate.cnf" => $no_tls_below1_3, + "18-dtls-renegotiate.cnf" => $no_dtls, + "19-mac-then-encrypt.cnf" => $no_pre_tls1_3, + "20-cert-select.cnf" => disabled("tls1_2") || $no_ec, + "21-key-update.cnf" => disabled("tls1_3"), + "22-compression.cnf" => disabled("zlib") || $no_tls, + "23-srp.cnf" => (disabled("tls1") && disabled ("tls1_1") && disabled("tls1_2")) || disabled("srp"), - "24-padding.conf" => disabled("tls1_3"), - "25-cipher.conf" => disabled("ec") || disabled("tls1_2"), - "26-tls13_client_auth.conf" => disabled("tls1_3"), - "29-dtls-sctp-label-bug.conf" => disabled("sctp") || disabled("sock"), + "24-padding.cnf" => disabled("tls1_3"), + "25-cipher.cnf" => disabled("ec") || disabled("tls1_2"), + "26-tls13_client_auth.cnf" => disabled("tls1_3"), + "29-dtls-sctp-label-bug.cnf" => disabled("sctp") || disabled("sock"), ); foreach my $conf (@conf_files) { @@ -133,7 +133,7 @@ sub test_conf { "Getting output from generate_ssl_tests.pl."); SKIP: { - # Test 2. Compare against existing output in test/ssl_tests.conf. + # Test 2. Compare against existing output in test/ssl_tests.cnf. skip "Skipping generated source test for $conf", 1 if !$check_source; diff --git a/test/recipes/80-test_ssl_old.t b/test/recipes/80-test_ssl_old.t index 76e0758a..a4bdb6dd 100644 --- a/test/recipes/80-test_ssl_old.t +++ b/test/recipes/80-test_ssl_old.t @@ -18,7 +18,7 @@ use OpenSSL::Test::Utils; setup("test_ssl"); -$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf"); +$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.cnf"); my ($no_rsa, $no_dsa, $no_dh, $no_ec, $no_psk, $no_ssl3, $no_tls1, $no_tls1_1, $no_tls1_2, $no_tls1_3, diff --git a/test/recipes/80-test_ssl_test_ctx.t b/test/recipes/80-test_ssl_test_ctx.t index 5548f46d..7775bd93 100644 --- a/test/recipes/80-test_ssl_test_ctx.t +++ b/test/recipes/80-test_ssl_test_ctx.t @@ -15,5 +15,5 @@ use OpenSSL::Test qw/:DEFAULT srctop_file/; setup("test_ssl_test_ctx"); plan tests => 1; -ok(run(test(["ssl_test_ctx_test", srctop_file("test", "ssl_test_ctx_test.conf")])), - "running ssl_test_ctx_test ssl_test_ctx_test.conf"); +ok(run(test(["ssl_test_ctx_test", srctop_file("test", "ssl_test_ctx_test.cnf")])), + "running ssl_test_ctx_test ssl_test_ctx_test.cnf"); diff --git a/test/recipes/90-test_gost.t b/test/recipes/90-test_gost.t index b01243fa..f2010967 100644 --- a/test/recipes/90-test_gost.t +++ b/test/recipes/90-test_gost.t @@ -31,7 +31,7 @@ plan skip_all => "No test GOST engine found" plan tests => 1; $ENV{OPENSSL_CONF} = srctop_file("test", "recipes", "90-test_gost_data", - "gost.conf"); + "gost.cnf"); ok(run(test(["gosttest", srctop_file("test", "recipes", "90-test_gost_data", diff --git a/test/recipes/90-test_gost_data/gost.conf b/test/recipes/90-test_gost_data/gost.cnf similarity index 100% rename from test/recipes/90-test_gost_data/gost.conf rename to test/recipes/90-test_gost_data/gost.cnf diff --git a/test/recipes/90-test_includes_data/vms-includes.cnf b/test/recipes/90-test_includes_data/vms-includes.cnf index ed4367bc..30fc4ef8 100644 --- a/test/recipes/90-test_includes_data/vms-includes.cnf +++ b/test/recipes/90-test_includes_data/vms-includes.cnf @@ -2,4 +2,4 @@ # Example configuration file using includes. # -.include [.conf-includes] +.include [.cnf-includes] diff --git a/test/ssl-tests/01-simple.conf b/test/ssl-tests/01-simple.cnf similarity index 100% rename from test/ssl-tests/01-simple.conf rename to test/ssl-tests/01-simple.cnf diff --git a/test/ssl-tests/01-simple.conf.in b/test/ssl-tests/01-simple.cnf.in similarity index 100% rename from test/ssl-tests/01-simple.conf.in rename to test/ssl-tests/01-simple.cnf.in diff --git a/test/ssl-tests/02-protocol-version.conf b/test/ssl-tests/02-protocol-version.cnf similarity index 100% rename from test/ssl-tests/02-protocol-version.conf rename to test/ssl-tests/02-protocol-version.cnf diff --git a/test/ssl-tests/02-protocol-version.conf.in b/test/ssl-tests/02-protocol-version.cnf.in similarity index 100% rename from test/ssl-tests/02-protocol-version.conf.in rename to test/ssl-tests/02-protocol-version.cnf.in diff --git a/test/ssl-tests/03-custom_verify.conf b/test/ssl-tests/03-custom_verify.cnf similarity index 100% rename from test/ssl-tests/03-custom_verify.conf rename to test/ssl-tests/03-custom_verify.cnf diff --git a/test/ssl-tests/03-custom_verify.conf.in b/test/ssl-tests/03-custom_verify.cnf.in similarity index 100% rename from test/ssl-tests/03-custom_verify.conf.in rename to test/ssl-tests/03-custom_verify.cnf.in diff --git a/test/ssl-tests/04-client_auth.conf b/test/ssl-tests/04-client_auth.cnf similarity index 100% rename from test/ssl-tests/04-client_auth.conf rename to test/ssl-tests/04-client_auth.cnf diff --git a/test/ssl-tests/04-client_auth.conf.in b/test/ssl-tests/04-client_auth.cnf.in similarity index 100% rename from test/ssl-tests/04-client_auth.conf.in rename to test/ssl-tests/04-client_auth.cnf.in diff --git a/test/ssl-tests/05-sni.conf b/test/ssl-tests/05-sni.cnf similarity index 100% rename from test/ssl-tests/05-sni.conf rename to test/ssl-tests/05-sni.cnf diff --git a/test/ssl-tests/05-sni.conf.in b/test/ssl-tests/05-sni.cnf.in similarity index 100% rename from test/ssl-tests/05-sni.conf.in rename to test/ssl-tests/05-sni.cnf.in diff --git a/test/ssl-tests/06-sni-ticket.conf b/test/ssl-tests/06-sni-ticket.cnf similarity index 100% rename from test/ssl-tests/06-sni-ticket.conf rename to test/ssl-tests/06-sni-ticket.cnf diff --git a/test/ssl-tests/06-sni-ticket.conf.in b/test/ssl-tests/06-sni-ticket.cnf.in similarity index 100% rename from test/ssl-tests/06-sni-ticket.conf.in rename to test/ssl-tests/06-sni-ticket.cnf.in diff --git a/test/ssl-tests/07-dtls-protocol-version.conf b/test/ssl-tests/07-dtls-protocol-version.cnf similarity index 100% rename from test/ssl-tests/07-dtls-protocol-version.conf rename to test/ssl-tests/07-dtls-protocol-version.cnf diff --git a/test/ssl-tests/07-dtls-protocol-version.conf.in b/test/ssl-tests/07-dtls-protocol-version.cnf.in similarity index 100% rename from test/ssl-tests/07-dtls-protocol-version.conf.in rename to test/ssl-tests/07-dtls-protocol-version.cnf.in diff --git a/test/ssl-tests/08-npn.conf b/test/ssl-tests/08-npn.cnf similarity index 100% rename from test/ssl-tests/08-npn.conf rename to test/ssl-tests/08-npn.cnf diff --git a/test/ssl-tests/08-npn.conf.in b/test/ssl-tests/08-npn.cnf.in similarity index 100% rename from test/ssl-tests/08-npn.conf.in rename to test/ssl-tests/08-npn.cnf.in diff --git a/test/ssl-tests/09-alpn.conf b/test/ssl-tests/09-alpn.cnf similarity index 100% rename from test/ssl-tests/09-alpn.conf rename to test/ssl-tests/09-alpn.cnf diff --git a/test/ssl-tests/09-alpn.conf.in b/test/ssl-tests/09-alpn.cnf.in similarity index 100% rename from test/ssl-tests/09-alpn.conf.in rename to test/ssl-tests/09-alpn.cnf.in diff --git a/test/ssl-tests/10-resumption.conf b/test/ssl-tests/10-resumption.cnf similarity index 100% rename from test/ssl-tests/10-resumption.conf rename to test/ssl-tests/10-resumption.cnf diff --git a/test/ssl-tests/10-resumption.conf.in b/test/ssl-tests/10-resumption.cnf.in similarity index 100% rename from test/ssl-tests/10-resumption.conf.in rename to test/ssl-tests/10-resumption.cnf.in diff --git a/test/ssl-tests/11-dtls_resumption.conf b/test/ssl-tests/11-dtls_resumption.cnf similarity index 100% rename from test/ssl-tests/11-dtls_resumption.conf rename to test/ssl-tests/11-dtls_resumption.cnf diff --git a/test/ssl-tests/11-dtls_resumption.conf.in b/test/ssl-tests/11-dtls_resumption.cnf.in similarity index 100% rename from test/ssl-tests/11-dtls_resumption.conf.in rename to test/ssl-tests/11-dtls_resumption.cnf.in diff --git a/test/ssl-tests/12-ct.conf b/test/ssl-tests/12-ct.cnf similarity index 100% rename from test/ssl-tests/12-ct.conf rename to test/ssl-tests/12-ct.cnf diff --git a/test/ssl-tests/12-ct.conf.in b/test/ssl-tests/12-ct.cnf.in similarity index 100% rename from test/ssl-tests/12-ct.conf.in rename to test/ssl-tests/12-ct.cnf.in diff --git a/test/ssl-tests/13-fragmentation.conf b/test/ssl-tests/13-fragmentation.cnf similarity index 100% rename from test/ssl-tests/13-fragmentation.conf rename to test/ssl-tests/13-fragmentation.cnf diff --git a/test/ssl-tests/13-fragmentation.conf.in b/test/ssl-tests/13-fragmentation.cnf.in similarity index 100% rename from test/ssl-tests/13-fragmentation.conf.in rename to test/ssl-tests/13-fragmentation.cnf.in diff --git a/test/ssl-tests/14-curves.conf b/test/ssl-tests/14-curves.cnf similarity index 100% rename from test/ssl-tests/14-curves.conf rename to test/ssl-tests/14-curves.cnf diff --git a/test/ssl-tests/14-curves.conf.in b/test/ssl-tests/14-curves.cnf.in similarity index 100% rename from test/ssl-tests/14-curves.conf.in rename to test/ssl-tests/14-curves.cnf.in diff --git a/test/ssl-tests/15-certstatus.conf b/test/ssl-tests/15-certstatus.cnf similarity index 100% rename from test/ssl-tests/15-certstatus.conf rename to test/ssl-tests/15-certstatus.cnf diff --git a/test/ssl-tests/15-certstatus.conf.in b/test/ssl-tests/15-certstatus.cnf.in similarity index 100% rename from test/ssl-tests/15-certstatus.conf.in rename to test/ssl-tests/15-certstatus.cnf.in diff --git a/test/ssl-tests/16-dtls-certstatus.conf b/test/ssl-tests/16-dtls-certstatus.cnf similarity index 100% rename from test/ssl-tests/16-dtls-certstatus.conf rename to test/ssl-tests/16-dtls-certstatus.cnf diff --git a/test/ssl-tests/16-dtls-certstatus.conf.in b/test/ssl-tests/16-dtls-certstatus.cnf.in similarity index 100% rename from test/ssl-tests/16-dtls-certstatus.conf.in rename to test/ssl-tests/16-dtls-certstatus.cnf.in diff --git a/test/ssl-tests/17-renegotiate.conf b/test/ssl-tests/17-renegotiate.cnf similarity index 100% rename from test/ssl-tests/17-renegotiate.conf rename to test/ssl-tests/17-renegotiate.cnf diff --git a/test/ssl-tests/17-renegotiate.conf.in b/test/ssl-tests/17-renegotiate.cnf.in similarity index 100% rename from test/ssl-tests/17-renegotiate.conf.in rename to test/ssl-tests/17-renegotiate.cnf.in diff --git a/test/ssl-tests/18-dtls-renegotiate.conf b/test/ssl-tests/18-dtls-renegotiate.cnf similarity index 100% rename from test/ssl-tests/18-dtls-renegotiate.conf rename to test/ssl-tests/18-dtls-renegotiate.cnf diff --git a/test/ssl-tests/18-dtls-renegotiate.conf.in b/test/ssl-tests/18-dtls-renegotiate.cnf.in similarity index 100% rename from test/ssl-tests/18-dtls-renegotiate.conf.in rename to test/ssl-tests/18-dtls-renegotiate.cnf.in diff --git a/test/ssl-tests/19-mac-then-encrypt.conf b/test/ssl-tests/19-mac-then-encrypt.cnf similarity index 100% rename from test/ssl-tests/19-mac-then-encrypt.conf rename to test/ssl-tests/19-mac-then-encrypt.cnf diff --git a/test/ssl-tests/19-mac-then-encrypt.conf.in b/test/ssl-tests/19-mac-then-encrypt.cnf.in similarity index 100% rename from test/ssl-tests/19-mac-then-encrypt.conf.in rename to test/ssl-tests/19-mac-then-encrypt.cnf.in diff --git a/test/ssl-tests/20-cert-select.conf b/test/ssl-tests/20-cert-select.cnf similarity index 100% rename from test/ssl-tests/20-cert-select.conf rename to test/ssl-tests/20-cert-select.cnf diff --git a/test/ssl-tests/20-cert-select.conf.in b/test/ssl-tests/20-cert-select.cnf.in similarity index 100% rename from test/ssl-tests/20-cert-select.conf.in rename to test/ssl-tests/20-cert-select.cnf.in diff --git a/test/ssl-tests/21-key-update.conf b/test/ssl-tests/21-key-update.cnf similarity index 100% rename from test/ssl-tests/21-key-update.conf rename to test/ssl-tests/21-key-update.cnf diff --git a/test/ssl-tests/21-key-update.conf.in b/test/ssl-tests/21-key-update.cnf.in similarity index 100% rename from test/ssl-tests/21-key-update.conf.in rename to test/ssl-tests/21-key-update.cnf.in diff --git a/test/ssl-tests/22-compression.conf b/test/ssl-tests/22-compression.cnf similarity index 100% rename from test/ssl-tests/22-compression.conf rename to test/ssl-tests/22-compression.cnf diff --git a/test/ssl-tests/22-compression.conf.in b/test/ssl-tests/22-compression.cnf.in similarity index 100% rename from test/ssl-tests/22-compression.conf.in rename to test/ssl-tests/22-compression.cnf.in diff --git a/test/ssl-tests/23-srp.conf b/test/ssl-tests/23-srp.cnf similarity index 100% rename from test/ssl-tests/23-srp.conf rename to test/ssl-tests/23-srp.cnf diff --git a/test/ssl-tests/23-srp.conf.in b/test/ssl-tests/23-srp.cnf.in similarity index 100% rename from test/ssl-tests/23-srp.conf.in rename to test/ssl-tests/23-srp.cnf.in diff --git a/test/ssl-tests/24-padding.conf b/test/ssl-tests/24-padding.cnf similarity index 100% rename from test/ssl-tests/24-padding.conf rename to test/ssl-tests/24-padding.cnf diff --git a/test/ssl-tests/24-padding.conf.in b/test/ssl-tests/24-padding.cnf.in similarity index 100% rename from test/ssl-tests/24-padding.conf.in rename to test/ssl-tests/24-padding.cnf.in diff --git a/test/ssl-tests/25-cipher.conf b/test/ssl-tests/25-cipher.cnf similarity index 100% rename from test/ssl-tests/25-cipher.conf rename to test/ssl-tests/25-cipher.cnf diff --git a/test/ssl-tests/25-cipher.conf.in b/test/ssl-tests/25-cipher.cnf.in similarity index 100% rename from test/ssl-tests/25-cipher.conf.in rename to test/ssl-tests/25-cipher.cnf.in diff --git a/test/ssl-tests/26-tls13_client_auth.conf b/test/ssl-tests/26-tls13_client_auth.cnf similarity index 100% rename from test/ssl-tests/26-tls13_client_auth.conf rename to test/ssl-tests/26-tls13_client_auth.cnf diff --git a/test/ssl-tests/26-tls13_client_auth.conf.in b/test/ssl-tests/26-tls13_client_auth.cnf.in similarity index 99% rename from test/ssl-tests/26-tls13_client_auth.conf.in rename to test/ssl-tests/26-tls13_client_auth.cnf.in index 02a1ee2d..82d3ac2d 100644 --- a/test/ssl-tests/26-tls13_client_auth.conf.in +++ b/test/ssl-tests/26-tls13_client_auth.cnf.in @@ -8,7 +8,7 @@ ## Test TLSv1.3 certificate authentication -## Similar to 04-client_auth.conf.in output, but specific for +## Similar to 04-client_auth.cnf.in output, but specific for ## TLSv1.3 and post-handshake authentication use strict; diff --git a/test/ssl-tests/27-ticket-appdata.conf b/test/ssl-tests/27-ticket-appdata.cnf similarity index 100% rename from test/ssl-tests/27-ticket-appdata.conf rename to test/ssl-tests/27-ticket-appdata.cnf diff --git a/test/ssl-tests/27-ticket-appdata.conf.in b/test/ssl-tests/27-ticket-appdata.cnf.in similarity index 100% rename from test/ssl-tests/27-ticket-appdata.conf.in rename to test/ssl-tests/27-ticket-appdata.cnf.in diff --git a/test/ssl-tests/28-seclevel.cnf b/test/ssl-tests/28-seclevel.cnf new file mode 100644 index 00000000..99fa8109 --- /dev/null +++ b/test/ssl-tests/28-seclevel.cnf @@ -0,0 +1,150 @@ +# Generated with generate_ssl_tests.pl + +num_tests = 6 + +test-0 = 0-SECLEVEL 3 with default key +test-1 = 1-SECLEVEL 4 with ED448 key +test-2 = 2-SECLEVEL 5 server with ED448 key +test-3 = 3-SECLEVEL 5 client with ED448 key +test-4 = 4-SECLEVEL 3 with P-384 key, X25519 ECDHE +test-5 = 5-SECLEVEL 3 with ED448 key, TLSv1.2 +# =========================================================== + +[0-SECLEVEL 3 with default key] +ssl_conf = 0-SECLEVEL 3 with default key-ssl + +[0-SECLEVEL 3 with default key-ssl] +server = 0-SECLEVEL 3 with default key-server +client = 0-SECLEVEL 3 with default key-client + +[0-SECLEVEL 3 with default key-server] +Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem +CipherString = DEFAULT:@SECLEVEL=3 +PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem + +[0-SECLEVEL 3 with default key-client] +CipherString = DEFAULT +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem +VerifyMode = Peer + +[test-0] +ExpectedResult = ServerFail + + +# =========================================================== + +[1-SECLEVEL 4 with ED448 key] +ssl_conf = 1-SECLEVEL 4 with ED448 key-ssl + +[1-SECLEVEL 4 with ED448 key-ssl] +server = 1-SECLEVEL 4 with ED448 key-server +client = 1-SECLEVEL 4 with ED448 key-client + +[1-SECLEVEL 4 with ED448 key-server] +Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +CipherString = DEFAULT:@SECLEVEL=4 +PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem + +[1-SECLEVEL 4 with ED448 key-client] +CipherString = DEFAULT:@SECLEVEL=4 +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-ed448-cert.pem +VerifyMode = Peer + +[test-1] +ExpectedResult = Success + + +# =========================================================== + +[2-SECLEVEL 5 server with ED448 key] +ssl_conf = 2-SECLEVEL 5 server with ED448 key-ssl + +[2-SECLEVEL 5 server with ED448 key-ssl] +server = 2-SECLEVEL 5 server with ED448 key-server +client = 2-SECLEVEL 5 server with ED448 key-client + +[2-SECLEVEL 5 server with ED448 key-server] +Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +CipherString = DEFAULT:@SECLEVEL=5 +PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem + +[2-SECLEVEL 5 server with ED448 key-client] +CipherString = DEFAULT:@SECLEVEL=4 +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-ed448-cert.pem +VerifyMode = Peer + +[test-2] +ExpectedResult = ServerFail + + +# =========================================================== + +[3-SECLEVEL 5 client with ED448 key] +ssl_conf = 3-SECLEVEL 5 client with ED448 key-ssl + +[3-SECLEVEL 5 client with ED448 key-ssl] +server = 3-SECLEVEL 5 client with ED448 key-server +client = 3-SECLEVEL 5 client with ED448 key-client + +[3-SECLEVEL 5 client with ED448 key-server] +Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +CipherString = DEFAULT:@SECLEVEL=4 +PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem + +[3-SECLEVEL 5 client with ED448 key-client] +CipherString = DEFAULT:@SECLEVEL=5 +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-ed448-cert.pem +VerifyMode = Peer + +[test-3] +ExpectedResult = ServerFail + + +# =========================================================== + +[4-SECLEVEL 3 with P-384 key, X25519 ECDHE] +ssl_conf = 4-SECLEVEL 3 with P-384 key, X25519 ECDHE-ssl + +[4-SECLEVEL 3 with P-384 key, X25519 ECDHE-ssl] +server = 4-SECLEVEL 3 with P-384 key, X25519 ECDHE-server +client = 4-SECLEVEL 3 with P-384 key, X25519 ECDHE-client + +[4-SECLEVEL 3 with P-384 key, X25519 ECDHE-server] +Certificate = ${ENV::TEST_CERTS_DIR}/p384-server-cert.pem +CipherString = DEFAULT:@SECLEVEL=3 +Groups = X25519 +PrivateKey = ${ENV::TEST_CERTS_DIR}/p384-server-key.pem + +[4-SECLEVEL 3 with P-384 key, X25519 ECDHE-client] +CipherString = ECDHE:@SECLEVEL=3 +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/p384-root.pem +VerifyMode = Peer + +[test-4] +ExpectedResult = Success + + +# =========================================================== + +[5-SECLEVEL 3 with ED448 key, TLSv1.2] +ssl_conf = 5-SECLEVEL 3 with ED448 key, TLSv1.2-ssl + +[5-SECLEVEL 3 with ED448 key, TLSv1.2-ssl] +server = 5-SECLEVEL 3 with ED448 key, TLSv1.2-server +client = 5-SECLEVEL 3 with ED448 key, TLSv1.2-client + +[5-SECLEVEL 3 with ED448 key, TLSv1.2-server] +Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +CipherString = DEFAULT:@SECLEVEL=3 +MaxProtocol = TLSv1.2 +PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem + +[5-SECLEVEL 3 with ED448 key, TLSv1.2-client] +CipherString = DEFAULT +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-ed448-cert.pem +VerifyMode = Peer + +[test-5] +ExpectedResult = Success + + diff --git a/test/ssl-tests/28-seclevel.conf.in b/test/ssl-tests/28-seclevel.cnf.in similarity index 55% rename from test/ssl-tests/28-seclevel.conf.in rename to test/ssl-tests/28-seclevel.cnf.in index f2cdc477..aba50079 100644 --- a/test/ssl-tests/28-seclevel.conf.in +++ b/test/ssl-tests/28-seclevel.cnf.in @@ -23,13 +23,38 @@ our @tests = ( our @tests_ec = ( { - name => "SECLEVEL 3 with ED448 key", - server => { "CipherString" => "DEFAULT:\@SECLEVEL=3", + name => "SECLEVEL 4 with ED448 key", + server => { "CipherString" => "DEFAULT:\@SECLEVEL=4", "Certificate" => test_pem("server-ed448-cert.pem"), "PrivateKey" => test_pem("server-ed448-key.pem") }, - client => { "VerifyCAFile" => test_pem("root-ed448-cert.pem") }, + client => { "CipherString" => "DEFAULT:\@SECLEVEL=4", + "VerifyCAFile" => test_pem("root-ed448-cert.pem") }, test => { "ExpectedResult" => "Success" }, }, + { + # The Ed488 signature algorithm will not be enabled. + # Because of the config order, the certificate is first loaded, and + # then the security level is chaged. If you try this with s_server + # the order will be reversed and it will instead fail to load the key. + name => "SECLEVEL 5 server with ED448 key", + server => { "CipherString" => "DEFAULT:\@SECLEVEL=5", + "Certificate" => test_pem("server-ed448-cert.pem"), + "PrivateKey" => test_pem("server-ed448-key.pem") }, + client => { "CipherString" => "DEFAULT:\@SECLEVEL=4", + "VerifyCAFile" => test_pem("root-ed448-cert.pem") }, + test => { "ExpectedResult" => "ServerFail" }, + }, + { + # The client will not sent the Ed488 signature algorithm, so the server + # doesn't have a useable signature algorithm for the certificate. + name => "SECLEVEL 5 client with ED448 key", + server => { "CipherString" => "DEFAULT:\@SECLEVEL=4", + "Certificate" => test_pem("server-ed448-cert.pem"), + "PrivateKey" => test_pem("server-ed448-key.pem") }, + client => { "CipherString" => "DEFAULT:\@SECLEVEL=5", + "VerifyCAFile" => test_pem("root-ed448-cert.pem") }, + test => { "ExpectedResult" => "ServerFail" }, + }, { name => "SECLEVEL 3 with P-384 key, X25519 ECDHE", server => { "CipherString" => "DEFAULT:\@SECLEVEL=3", diff --git a/test/ssl-tests/28-seclevel.conf b/test/ssl-tests/28-seclevel.conf deleted file mode 100644 index 04a0c4fb..00000000 --- a/test/ssl-tests/28-seclevel.conf +++ /dev/null @@ -1,102 +0,0 @@ -# Generated with generate_ssl_tests.pl - -num_tests = 4 - -test-0 = 0-SECLEVEL 3 with default key -test-1 = 1-SECLEVEL 3 with ED448 key -test-2 = 2-SECLEVEL 3 with P-384 key, X25519 ECDHE -test-3 = 3-SECLEVEL 3 with ED448 key, TLSv1.2 -# =========================================================== - -[0-SECLEVEL 3 with default key] -ssl_conf = 0-SECLEVEL 3 with default key-ssl - -[0-SECLEVEL 3 with default key-ssl] -server = 0-SECLEVEL 3 with default key-server -client = 0-SECLEVEL 3 with default key-client - -[0-SECLEVEL 3 with default key-server] -Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem -CipherString = DEFAULT:@SECLEVEL=3 -PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem - -[0-SECLEVEL 3 with default key-client] -CipherString = DEFAULT -VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem -VerifyMode = Peer - -[test-0] -ExpectedResult = ServerFail - - -# =========================================================== - -[1-SECLEVEL 3 with ED448 key] -ssl_conf = 1-SECLEVEL 3 with ED448 key-ssl - -[1-SECLEVEL 3 with ED448 key-ssl] -server = 1-SECLEVEL 3 with ED448 key-server -client = 1-SECLEVEL 3 with ED448 key-client - -[1-SECLEVEL 3 with ED448 key-server] -Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem -CipherString = DEFAULT:@SECLEVEL=3 -PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem - -[1-SECLEVEL 3 with ED448 key-client] -CipherString = DEFAULT -VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-ed448-cert.pem -VerifyMode = Peer - -[test-1] -ExpectedResult = Success - - -# =========================================================== - -[2-SECLEVEL 3 with P-384 key, X25519 ECDHE] -ssl_conf = 2-SECLEVEL 3 with P-384 key, X25519 ECDHE-ssl - -[2-SECLEVEL 3 with P-384 key, X25519 ECDHE-ssl] -server = 2-SECLEVEL 3 with P-384 key, X25519 ECDHE-server -client = 2-SECLEVEL 3 with P-384 key, X25519 ECDHE-client - -[2-SECLEVEL 3 with P-384 key, X25519 ECDHE-server] -Certificate = ${ENV::TEST_CERTS_DIR}/p384-server-cert.pem -CipherString = DEFAULT:@SECLEVEL=3 -Groups = X25519 -PrivateKey = ${ENV::TEST_CERTS_DIR}/p384-server-key.pem - -[2-SECLEVEL 3 with P-384 key, X25519 ECDHE-client] -CipherString = ECDHE:@SECLEVEL=3 -VerifyCAFile = ${ENV::TEST_CERTS_DIR}/p384-root.pem -VerifyMode = Peer - -[test-2] -ExpectedResult = Success - - -# =========================================================== - -[3-SECLEVEL 3 with ED448 key, TLSv1.2] -ssl_conf = 3-SECLEVEL 3 with ED448 key, TLSv1.2-ssl - -[3-SECLEVEL 3 with ED448 key, TLSv1.2-ssl] -server = 3-SECLEVEL 3 with ED448 key, TLSv1.2-server -client = 3-SECLEVEL 3 with ED448 key, TLSv1.2-client - -[3-SECLEVEL 3 with ED448 key, TLSv1.2-server] -Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem -CipherString = DEFAULT:@SECLEVEL=3 -MaxProtocol = TLSv1.2 -PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem - -[3-SECLEVEL 3 with ED448 key, TLSv1.2-client] -CipherString = DEFAULT -VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-ed448-cert.pem -VerifyMode = Peer - -[test-3] -ExpectedResult = Success - - diff --git a/test/ssl-tests/29-dtls-sctp-label-bug.conf b/test/ssl-tests/29-dtls-sctp-label-bug.cnf similarity index 100% rename from test/ssl-tests/29-dtls-sctp-label-bug.conf rename to test/ssl-tests/29-dtls-sctp-label-bug.cnf diff --git a/test/ssl-tests/29-dtls-sctp-label-bug.conf.in b/test/ssl-tests/29-dtls-sctp-label-bug.cnf.in similarity index 100% rename from test/ssl-tests/29-dtls-sctp-label-bug.conf.in rename to test/ssl-tests/29-dtls-sctp-label-bug.cnf.in diff --git a/test/ssl-tests/30-extended-master-secret.conf b/test/ssl-tests/30-extended-master-secret.cnf similarity index 100% rename from test/ssl-tests/30-extended-master-secret.conf rename to test/ssl-tests/30-extended-master-secret.cnf diff --git a/test/ssl-tests/30-extended-master-secret.conf.in b/test/ssl-tests/30-extended-master-secret.cnf.in similarity index 100% rename from test/ssl-tests/30-extended-master-secret.conf.in rename to test/ssl-tests/30-extended-master-secret.cnf.in diff --git a/test/ssl_test_ctx_test.c b/test/ssl_test_ctx_test.c index fc7ec68f..877c8607 100644 --- a/test/ssl_test_ctx_test.c +++ b/test/ssl_test_ctx_test.c @@ -251,7 +251,7 @@ int setup_tests(void) if (!TEST_ptr(conf = NCONF_new(NULL))) return 0; - /* argument should point to test/ssl_test_ctx_test.conf */ + /* argument should point to test/ssl_test_ctx_test.cnf */ if (!TEST_int_gt(NCONF_load(conf, test_get_argument(0), NULL), 0)) return 0; diff --git a/test/ssl_test_ctx_test.conf b/test/ssl_test_ctx_test.cnf similarity index 100% rename from test/ssl_test_ctx_test.conf rename to test/ssl_test_ctx_test.cnf diff --git a/test/test.cnf b/test/test.cnf index 1e2fa31c..a686c3d8 100644 --- a/test/test.cnf +++ b/test/test.cnf @@ -1,7 +1,3 @@ -# -# SSLeay example configuration file. -# This is mostly being used for generation of certificate requests. -# #################################################################### [ ca ] @@ -58,28 +54,25 @@ default_keyfile = testkey.pem distinguished_name = req_distinguished_name encrypt_rsa_key = no +# Make altreq be identical to req +[ altreq ] +default_bits = 2048 +default_keyfile = testkey.pem +distinguished_name = req_distinguished_name +encrypt_rsa_key = no + [ req_distinguished_name ] -countryName = Country Name (2 letter code) -countryName_default = AU +countryName = C field countryName_value = AU - -stateOrProvinceName = State or Province Name (full name) -stateOrProvinceName_default = Queensland +stateOrProvinceName = SP field stateOrProvinceName_value = - -localityName = Locality Name (eg, city) +localityName = L field localityName_value = Brisbane - -organizationName = Organization Name (eg, company) -organizationName_default = +organizationName = O field organizationName_value = CryptSoft Pty Ltd - -organizationalUnitName = Organizational Unit Name (eg, section) -organizationalUnitName_default = +organizationalUnitName = OU field organizationalUnitName_value = . - -commonName = Common Name (eg, YOUR name) +commonName = CN field commonName_value = Eric Young - -emailAddress = Email Address +emailAddress = email field emailAddress_value = eay@mincom.oz.au diff --git a/util/fix-includes b/util/fix-includes index c4916387..c1435a76 100755 --- a/util/fix-includes +++ b/util/fix-includes @@ -14,6 +14,6 @@ find -name ossl_typ.h -o \( \ -name '*.ec' -o \ -name 'README*' -o \ -name '*.pod' -o \ - -name '*.conf' \ + -name '*.cnf' -o -name '*.conf' \ \) -exec sed -E -i \ -f util/fix-includes.sed {} \; diff --git a/util/libcrypto.num b/util/libcrypto.num index 6b9cd059..a143a83d 100644 --- a/util/libcrypto.num +++ b/util/libcrypto.num @@ -4912,6 +4912,9 @@ ASN1_GENERALIZEDTIME_dup ? 3_0_0 EXIST::FUNCTION: RAND_priv_bytes_ex ? 3_0_0 EXIST::FUNCTION: RAND_bytes_ex ? 3_0_0 EXIST::FUNCTION: EVP_PKEY_get_default_digest_name ? 3_0_0 EXIST::FUNCTION: +CMS_decrypt_set1_pkey_and_peer ? 3_0_0 EXIST::FUNCTION:CMS +CMS_add1_recipient ? 3_0_0 EXIST::FUNCTION:CMS +CMS_RecipientInfo_kari_set0_pkey_and_peer ? 3_0_0 EXIST::FUNCTION:CMS PKCS8_pkey_add1_attr ? 3_0_0 EXIST::FUNCTION: PKCS8_pkey_add1_attr_by_OBJ ? 3_0_0 EXIST::FUNCTION: EVP_PKEY_private_check ? 3_0_0 EXIST::FUNCTION: @@ -4952,4 +4955,5 @@ OSSL_SELF_TEST_free ? 3_0_0 EXIST::FUNCTION: OSSL_SELF_TEST_onbegin ? 3_0_0 EXIST::FUNCTION: OSSL_SELF_TEST_oncorrupt_byte ? 3_0_0 EXIST::FUNCTION: OSSL_SELF_TEST_onend ? 3_0_0 EXIST::FUNCTION: +OSSL_PROVIDER_set_default_search_path ? 3_0_0 EXIST::FUNCTION: EVP_chacha20_poly1305_draft ? 3_0_0 EXIST::FUNCTION:CHACHA,POLY1305 diff --git a/util/missingcrypto.txt b/util/missingcrypto.txt index be5535b8..99c2883b 100644 --- a/util/missingcrypto.txt +++ b/util/missingcrypto.txt @@ -325,7 +325,6 @@ CMS_RecipientInfo_kari_get0_ctx(3) CMS_RecipientInfo_kari_get0_orig_id(3) CMS_RecipientInfo_kari_get0_reks(3) CMS_RecipientInfo_kari_orig_id_cmp(3) -CMS_RecipientInfo_kari_set0_pkey(3) CMS_RecipientInfo_ktri_get0_algs(3) CMS_RecipientInfo_set0_password(3) CMS_SharedInfo_encode(3) @@ -347,7 +346,6 @@ CMS_dataInit(3) CMS_data_create(3) CMS_decrypt_set1_key(3) CMS_decrypt_set1_password(3) -CMS_decrypt_set1_pkey(3) CMS_digest_create(3) CMS_digest_verify(3) CMS_is_detached(3)