Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update.

Browse Source
This commit is contained in:
Hakase
2020-03-08 13:10:50 +09:00
parent b412d79e8b
commit be29e7bcc6
274 changed files with 2778 additions and 763 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+8 -41
View File
@@ -26,43 +26,7 @@
/include/openssl/opensslv.h
# Auto generated doc files
# Keep this in sync with doc/man1/build.info
doc/man1/openssl-ca.pod
doc/man1/openssl-cms.pod
doc/man1/openssl-crl.pod
doc/man1/openssl-dgst.pod
doc/man1/openssl-dhparam.pod
doc/man1/openssl-dsa.pod
doc/man1/openssl-dsaparam.pod
doc/man1/openssl-ec.pod
doc/man1/openssl-ecparam.pod
doc/man1/openssl-enc.pod
doc/man1/openssl-gendsa.pod
doc/man1/openssl-genpkey.pod
doc/man1/openssl-genrsa.pod
doc/man1/openssl-ocsp.pod
doc/man1/openssl-passwd.pod
doc/man1/openssl-pkcs12.pod
doc/man1/openssl-pkcs7.pod
doc/man1/openssl-pkcs8.pod
doc/man1/openssl-pkey.pod
doc/man1/openssl-pkeyparam.pod
doc/man1/openssl-pkeyutl.pod
doc/man1/openssl-rand.pod
doc/man1/openssl-req.pod
doc/man1/openssl-rsa.pod
doc/man1/openssl-rsautl.pod
doc/man1/openssl-s_client.pod
doc/man1/openssl-s_server.pod
doc/man1/openssl-s_time.pod
doc/man1/openssl-smime.pod
doc/man1/openssl-speed.pod
doc/man1/openssl-spkac.pod
doc/man1/openssl-srp.pod
doc/man1/openssl-storeutl.pod
doc/man1/openssl-ts.pod
doc/man1/openssl-verify.pod
doc/man1/openssl-x509.pod
doc/man1/openssl-*.pod
# error code files
/crypto/err/openssl.txt.old
@@ -96,12 +60,12 @@ doc/man1/openssl-x509.pod
/test/confdump
/test/bio_prefix_text
# Other generated files in test/
/test/provider_internal_test.conf
/test/fipsinstall.conf
/providers/fipsinstall.conf
/test/provider_internal_test.cnf
/test/fipsinstall.cnf
/providers/fipsinstall.cnf
# Certain files that get created by tests on the fly
/test/test-runs
/test-runs
/test/buildtest_*
# Fuzz stuff.
@@ -123,6 +87,8 @@ doc/man1/openssl-x509.pod
/TAGS
*.map
*.ld
/apps/progs.c
/apps/progs.h
# Windows (legacy)
/tmp32
@@ -220,6 +186,7 @@ Makefile.save
*.bak
cscope.*
*.d
*.d.tmp
pod2htmd.tmp
# Windows manifest files
Configure
+13
View File
@@ -265,6 +265,19 @@ if (grep /^reconf(igure)?$/, @argvcopy) {
$config{perlargv} = [ @argvcopy ];
# Historical: if known directories in crypto/ have been removed, it means
# that those sub-systems are disabled.
# (the other option would be to removed them from the SUBDIRS statement in
# crypto/build.info)
# We reverse the input list for cosmetic purely reasons, to compensate that
# 'unshift' adds at the front of the list (i.e. in reverse input order).
foreach ( reverse sort( 'aes', 'aria', 'bf', 'camellia', 'cast', 'des', 'dh',
'dsa', 'ec', 'hmac', 'idea', 'md2', 'md5', 'mdc2',
'rc2', 'rc4', 'rc5', 'ripemd', 'rsa', 'seed', 'sha',
'sm2', 'sm3', 'sm4') ) {
unshift @argvcopy, "no-$_" if ! -d catdir($srcdir, 'crypto', $_);
}
# Collect version numbers
my %version = ();
apps/ca.c
+7 -1
View File
@@ -148,7 +148,7 @@ typedef enum OPTION_choice {
OPT_INFILES, OPT_SS_CERT, OPT_SPKAC, OPT_REVOKE, OPT_VALID,
OPT_EXTENSIONS, OPT_EXTFILE, OPT_STATUS, OPT_UPDATEDB, OPT_CRLEXTS,
OPT_RAND_SERIAL,
OPT_R_ENUM, OPT_SM2ID, OPT_SM2HEXID,
OPT_R_ENUM, OPT_SM2ID, OPT_SM2HEXID, OPT_PROV_ENUM,
/* Do not change the order here; see related case statements below */
OPT_CRL_REASON, OPT_CRL_HOLD, OPT_CRL_COMPROMISE, OPT_CRL_CA_COMPROMISE
} OPTION_CHOICE;
@@ -177,6 +177,7 @@ const OPTIONS ca_options[] = {
OPT_SECTION("Configuration"),
{"config", OPT_CONFIG, 's', "A config file"},
{"name", OPT_NAME, 's', "The particular CA definition to use"},
{"section", OPT_NAME, 's', "An alias for -name"},
{"policy", OPT_POLICY, 's', "The CA 'policy' to support"},
OPT_SECTION("Certificate"),
@@ -237,6 +238,7 @@ const OPTIONS ca_options[] = {
{"revoke", OPT_REVOKE, '<', "Revoke a cert (given in file)"},
OPT_R_OPTIONS,
OPT_PROV_OPTIONS,
OPT_PARAMETERS(),
{"certreq", 0, 0, "Certificate requests to be signed (optional)"},
@@ -361,6 +363,10 @@ opthelp:
if (!opt_rand(o))
goto end;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
case OPT_KEY:
key = opt_arg();
break;
apps/ciphers.c
+6 -1
View File
@@ -27,7 +27,7 @@ typedef enum OPTION_choice {
OPT_PSK,
OPT_SRP,
OPT_CIPHERSUITES,
OPT_V, OPT_UPPER_V, OPT_S
OPT_V, OPT_UPPER_V, OPT_S, OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS ciphers_options[] = {
@@ -67,6 +67,7 @@ const OPTIONS ciphers_options[] = {
#endif
{"ciphersuites", OPT_CIPHERSUITES, 's',
"Configure the TLSv1.3 ciphersuites to use"},
OPT_PROV_OPTIONS,
OPT_PARAMETERS(),
{"cipher", 0, 0, "Cipher string to decode (optional)"},
@@ -169,6 +170,10 @@ int ciphers_main(int argc, char **argv)
case OPT_CIPHERSUITES:
ciphersuites = opt_arg();
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
argv = opt_rest();
apps/cms.c
+44 -11
View File
@@ -81,10 +81,12 @@ typedef enum OPTION_choice {
OPT_PASSIN, OPT_TO, OPT_FROM, OPT_SUBJECT, OPT_SIGNER, OPT_RECIP,
OPT_CERTSOUT, OPT_MD, OPT_INKEY, OPT_KEYFORM, OPT_KEYOPT, OPT_RR_FROM,
OPT_RR_TO, OPT_AES128_WRAP, OPT_AES192_WRAP, OPT_AES256_WRAP,
OPT_3DES_WRAP, OPT_ENGINE,
OPT_3DES_WRAP, OPT_WRAP, OPT_ENGINE,
OPT_R_ENUM,
OPT_PROV_ENUM,
OPT_V_ENUM,
OPT_CIPHER
OPT_CIPHER,
OPT_ORIGINATOR
} OPTION_CHOICE;
const OPTIONS cms_options[] = {
@@ -197,6 +199,7 @@ const OPTIONS cms_options[] = {
{"from", OPT_FROM, 's', "From address"},
{"subject", OPT_SUBJECT, 's', "Subject"},
{"signer", OPT_SIGNER, 's', "Signer certificate file"},
{"originator", OPT_ORIGINATOR, 's', "Originator certificate file"},
{"recip", OPT_RECIP, '<', "Recipient cert file for decryption"},
{"receipt_request_from", OPT_RR_FROM, 's',
"Create signed receipt request with specified email address"},
@@ -214,9 +217,11 @@ const OPTIONS cms_options[] = {
# ifndef OPENSSL_NO_DES
{"des3-wrap", OPT_3DES_WRAP, '-', "Use 3DES-EDE to wrap key"},
# endif
{"wrap", OPT_WRAP, 's', "Any wrap cipher to wrap key"},
OPT_R_OPTIONS,
OPT_V_OPTIONS,
OPT_PROV_OPTIONS,
OPT_PARAMETERS(),
{"cert", 0, 0, "Recipient certs (optional; used only when encrypting)"},
@@ -236,7 +241,7 @@ int cms_main(int argc, char **argv)
STACK_OF(OPENSSL_STRING) *rr_to = NULL, *rr_from = NULL;
STACK_OF(OPENSSL_STRING) *sksigners = NULL, *skkeys = NULL;
STACK_OF(X509) *encerts = NULL, *other = NULL;
X509 *cert = NULL, *recip = NULL, *signer = NULL;
X509 *cert = NULL, *recip = NULL, *signer = NULL, *originator = NULL;
X509_STORE *store = NULL;
X509_VERIFY_PARAM *vpm = NULL;
char *certfile = NULL, *keyfile = NULL, *contfile = NULL;
@@ -244,7 +249,7 @@ int cms_main(int argc, char **argv)
char *certsoutfile = NULL;
int noCAfile = 0, noCApath = 0, noCAstore = 0;
char *infile = NULL, *outfile = NULL, *rctfile = NULL;
char *passinarg = NULL, *passin = NULL, *signerfile = NULL, *recipfile = NULL;
char *passinarg = NULL, *passin = NULL, *signerfile = NULL, *originatorfile = NULL, *recipfile = NULL;
char *to = NULL, *from = NULL, *subject = NULL, *prog;
cms_key_param *key_first = NULL, *key_param = NULL;
int flags = CMS_DETACHED, noout = 0, print = 0, keyidx = -1, vpmtouched = 0;
@@ -535,6 +540,9 @@ int cms_main(int argc, char **argv)
}
signerfile = opt_arg();
break;
case OPT_ORIGINATOR:
originatorfile = opt_arg();
break;
case OPT_INKEY:
/* If previous -inkey argument add signer to list */
if (keyfile != NULL) {
@@ -615,6 +623,10 @@ int cms_main(int argc, char **argv)
if (!opt_rand(o))
goto end;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
case OPT_3DES_WRAP:
# ifndef OPENSSL_NO_DES
wrap_cipher = EVP_des_ede3_wrap();
@@ -629,6 +641,10 @@ int cms_main(int argc, char **argv)
case OPT_AES256_WRAP:
wrap_cipher = EVP_aes_256_wrap();
break;
case OPT_WRAP:
if (!opt_cipher(opt_unknown(), &wrap_cipher))
goto end;
break;
}
}
argc = opt_num_rest();
@@ -759,6 +775,14 @@ int cms_main(int argc, char **argv)
}
}
if (originatorfile != NULL) {
if ((originator = load_cert(originatorfile, FORMAT_PEM,
"originator certificate file")) == NULL) {
ERR_print_errors(bio_err);
goto end;
}
}
if (operation == SMIME_SIGN_RECEIPT) {
if ((signer = load_cert(signerfile, FORMAT_PEM,
"receipt signer certificate file")) == NULL) {
@@ -767,7 +791,7 @@ int cms_main(int argc, char **argv)
}
}
if (operation == SMIME_DECRYPT) {
if ((operation == SMIME_DECRYPT) || (operation == SMIME_ENCRYPT)) {
if (keyfile == NULL)
keyfile = recipfile;
} else if ((operation == SMIME_SIGN) || (operation == SMIME_SIGN_RECEIPT)) {
@@ -877,23 +901,32 @@ int cms_main(int argc, char **argv)
for (i = 0; i < sk_X509_num(encerts); i++) {
CMS_RecipientInfo *ri;
cms_key_param *kparam;
int tflags = flags;
int tflags = flags | CMS_KEY_PARAM; /* This flag enforces allocating the EVP_PKEY_CTX for the recipient here */
EVP_PKEY_CTX *pctx;
X509 *x = sk_X509_value(encerts, i);
int res;
for (kparam = key_first; kparam; kparam = kparam->next) {
if (kparam->idx == i) {
tflags |= CMS_KEY_PARAM;
break;
}
}
ri = CMS_add1_recipient_cert(cms, x, tflags);
ri = CMS_add1_recipient(cms, x, key, originator, tflags);
if (ri == NULL)
goto end;
if (kparam != NULL) {
EVP_PKEY_CTX *pctx;
pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
if (kparam != NULL) {
if (!cms_set_pkey_param(pctx, kparam->param))
goto end;
}
res = EVP_PKEY_CTX_ctrl(pctx, -1, -1,
EVP_PKEY_CTRL_CIPHER,
EVP_CIPHER_nid(cipher), NULL);
if (res <= 0 && res != -2)
goto end;
if (CMS_RecipientInfo_type(ri) == CMS_RECIPINFO_AGREE
&& wrap_cipher) {
EVP_CIPHER_CTX *wctx;
@@ -1039,7 +1072,7 @@ int cms_main(int argc, char **argv)
}
if (key != NULL) {
if (!CMS_decrypt_set1_pkey(cms, key, recip)) {
if (!CMS_decrypt_set1_pkey_and_peer(cms, key, recip, originator)) {
BIO_puts(bio_err, "Error decrypting CMS using private key\n");
goto end;
}
apps/crl.c
+7 -1
View File
@@ -24,7 +24,7 @@ typedef enum OPTION_choice {
OPT_ISSUER, OPT_LASTUPDATE, OPT_NEXTUPDATE, OPT_FINGERPRINT,
OPT_CRLNUMBER, OPT_BADSIG, OPT_GENDELTA, OPT_CAPATH, OPT_CAFILE, OPT_CASTORE,
OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE, OPT_VERIFY, OPT_TEXT, OPT_HASH,
OPT_HASH_OLD, OPT_NOOUT, OPT_NAMEOPT, OPT_MD
OPT_HASH_OLD, OPT_NOOUT, OPT_NAMEOPT, OPT_MD, OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS crl_options[] = {
@@ -69,6 +69,7 @@ const OPTIONS crl_options[] = {
"Do not load certificates from the default certificates directory"},
{"no-CAstore", OPT_NOCASTORE, '-',
"Do not load certificates from the default certificates store"},
OPT_PROV_OPTIONS,
{NULL}
};
@@ -193,6 +194,11 @@ int crl_main(int argc, char **argv)
case OPT_MD:
if (!opt_md(opt_unknown(), &digest))
goto opthelp;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
argc = opt_num_rest();
apps/crl2p7.c
+8 -1
View File
@@ -23,7 +23,8 @@ static int add_certs_from_file(STACK_OF(X509) *stack, char *certfile);
typedef enum OPTION_choice {
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_NOCRL, OPT_CERTFILE
OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_NOCRL, OPT_CERTFILE,
OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS crl2pkcs7_options[] = {
@@ -40,6 +41,8 @@ const OPTIONS crl2pkcs7_options[] = {
OPT_SECTION("Output"),
{"out", OPT_OUT, '>', "Output file"},
{"outform", OPT_OUTFORM, 'F', "Output format - DER or PEM"},
OPT_PROV_OPTIONS,
{NULL}
};
@@ -93,6 +96,10 @@ int crl2pkcs7_main(int argc, char **argv)
if (!sk_OPENSSL_STRING_push(certflst, opt_arg()))
goto end;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
argc = opt_num_rest();
apps/dgst.c
+6 -1
View File
@@ -42,7 +42,7 @@ typedef enum OPTION_choice {
OPT_HEX, OPT_BINARY, OPT_DEBUG, OPT_FIPS_FINGERPRINT,
OPT_HMAC, OPT_MAC, OPT_SIGOPT, OPT_MACOPT,
OPT_DIGEST,
OPT_R_ENUM
OPT_R_ENUM, OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS dgst_options[] = {
@@ -82,6 +82,7 @@ const OPTIONS dgst_options[] = {
"Compute HMAC with the key used in OpenSSL-FIPS fingerprint"},
OPT_R_OPTIONS,
OPT_PROV_OPTIONS,
OPT_PARAMETERS(),
{"file", 0, 0, "Files to digest (optional; default is stdin)"},
@@ -208,6 +209,10 @@ int dgst_main(int argc, char **argv)
goto opthelp;
md = m;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
argc = opt_num_rest();
apps/dhparam.c
+6 -1
View File
@@ -41,7 +41,7 @@ typedef enum OPTION_choice {
OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT,
OPT_ENGINE, OPT_CHECK, OPT_TEXT, OPT_NOOUT,
OPT_DSAPARAM, OPT_C, OPT_2, OPT_3, OPT_5,
OPT_R_ENUM
OPT_R_ENUM, OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS dhparam_options[] = {
@@ -73,6 +73,7 @@ const OPTIONS dhparam_options[] = {
{"5", OPT_5, '-', "Generate parameters using 5 as the generator value"},
OPT_R_OPTIONS,
OPT_PROV_OPTIONS,
OPT_PARAMETERS(),
{"numbits", 0, 0, "Number of bits if generating parameters (optional)"},
@@ -151,6 +152,10 @@ int dhparam_main(int argc, char **argv)
if (!opt_rand(o))
goto end;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
argc = opt_num_rest();
apps/dsa.c
+7 -1
View File
@@ -35,7 +35,8 @@ typedef enum OPTION_choice {
/* Do not change the order here; see case statements below */
OPT_PVK_NONE, OPT_PVK_WEAK, OPT_PVK_STRONG,
OPT_NOOUT, OPT_TEXT, OPT_MODULUS, OPT_PUBIN,
OPT_PUBOUT, OPT_CIPHER, OPT_PASSIN, OPT_PASSOUT
OPT_PUBOUT, OPT_CIPHER, OPT_PASSIN, OPT_PASSOUT,
OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS dsa_options[] = {
@@ -66,6 +67,7 @@ const OPTIONS dsa_options[] = {
{"pubout", OPT_PUBOUT, '-', "Output public key, not private"},
{"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
OPT_PROV_OPTIONS,
{NULL}
};
@@ -147,6 +149,10 @@ int dsa_main(int argc, char **argv)
if (!opt_cipher(opt_unknown(), &enc))
goto end;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
argc = opt_num_rest();
apps/dsaparam.c
+6 -1
View File
@@ -36,7 +36,7 @@ typedef enum OPTION_choice {
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_TEXT, OPT_C,
OPT_NOOUT, OPT_GENKEY, OPT_ENGINE, OPT_VERBOSE,
OPT_R_ENUM
OPT_R_ENUM, OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS dsaparam_options[] = {
@@ -62,6 +62,7 @@ const OPTIONS dsaparam_options[] = {
{"genkey", OPT_GENKEY, '-', "Generate a DSA key"},
OPT_R_OPTIONS,
OPT_PROV_OPTIONS,
OPT_PARAMETERS(),
{"numbits", 0, 0, "Number of bits if generating parameters (optional)"},
@@ -122,6 +123,10 @@ int dsaparam_main(int argc, char **argv)
if (!opt_rand(o))
goto end;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
case OPT_NOOUT:
noout = 1;
break;
apps/ec.c
+7 -1
View File
@@ -40,7 +40,7 @@ typedef enum OPTION_choice {
OPT_INFORM, OPT_OUTFORM, OPT_ENGINE, OPT_IN, OPT_OUT,
OPT_NOOUT, OPT_TEXT, OPT_PARAM_OUT, OPT_PUBIN, OPT_PUBOUT,
OPT_PASSIN, OPT_PASSOUT, OPT_PARAM_ENC, OPT_CONV_FORM, OPT_CIPHER,
OPT_NO_PUBLIC, OPT_CHECK
OPT_NO_PUBLIC, OPT_CHECK, OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS ec_options[] = {
@@ -70,6 +70,8 @@ const OPTIONS ec_options[] = {
{"pubout", OPT_PUBOUT, '-', "Output public key, not private"},
{"no_public", OPT_NO_PUBLIC, '-', "exclude public key from private key"},
{"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
OPT_PROV_OPTIONS,
{NULL}
};
@@ -161,6 +163,10 @@ int ec_main(int argc, char **argv)
case OPT_CHECK:
check = 1;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
argc = opt_num_rest();
apps/ecparam.c
+6 -1
View File
@@ -31,7 +31,7 @@ typedef enum OPTION_choice {
OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_TEXT, OPT_C,
OPT_CHECK, OPT_LIST_CURVES, OPT_NO_SEED, OPT_NOOUT, OPT_NAME,
OPT_CONV_FORM, OPT_PARAM_ENC, OPT_GENKEY, OPT_ENGINE, OPT_CHECK_NAMED,
OPT_R_ENUM
OPT_R_ENUM, OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS ecparam_options[] = {
@@ -67,6 +67,7 @@ const OPTIONS ecparam_options[] = {
{"conv_form", OPT_CONV_FORM, 's', "Specifies the point conversion form "},
OPT_R_OPTIONS,
OPT_PROV_OPTIONS,
{NULL}
};
@@ -169,6 +170,10 @@ int ecparam_main(int argc, char **argv)
if (!opt_rand(o))
goto end;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
case OPT_ENGINE:
e = setup_engine(opt_arg(), 0);
break;
apps/enc.c
+6 -1
View File
@@ -45,7 +45,7 @@ typedef enum OPTION_choice {
OPT_NOPAD, OPT_SALT, OPT_NOSALT, OPT_DEBUG, OPT_UPPER_P, OPT_UPPER_A,
OPT_A, OPT_Z, OPT_BUFSIZE, OPT_K, OPT_KFILE, OPT_UPPER_K, OPT_NONE,
OPT_UPPER_S, OPT_IV, OPT_MD, OPT_ITER, OPT_PBKDF2, OPT_CIPHER,
OPT_R_ENUM
OPT_R_ENUM, OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS enc_options[] = {
@@ -97,6 +97,7 @@ const OPTIONS enc_options[] = {
{"", OPT_CIPHER, '-', "Any supported cipher"},
OPT_R_OPTIONS,
OPT_PROV_OPTIONS,
{NULL}
};
@@ -288,6 +289,10 @@ int enc_main(int argc, char **argv)
if (!opt_rand(o))
goto end;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
if (opt_num_rest() != 0) {
apps/gendsa.c
+6 -1
View File
@@ -31,7 +31,7 @@ NON_EMPTY_TRANSLATION_UNIT
typedef enum OPTION_choice {
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
OPT_OUT, OPT_PASSOUT, OPT_ENGINE, OPT_CIPHER, OPT_VERBOSE,
OPT_R_ENUM
OPT_R_ENUM, OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS gendsa_options[] = {
@@ -47,6 +47,7 @@ const OPTIONS gendsa_options[] = {
{"out", OPT_OUT, '>', "Output the key to the specified file"},
{"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
OPT_R_OPTIONS,
OPT_PROV_OPTIONS,
{"", OPT_CIPHER, '-', "Encrypt the output with any supported cipher"},
{"verbose", OPT_VERBOSE, '-', "Verbose output"},
@@ -92,6 +93,10 @@ int gendsa_main(int argc, char **argv)
if (!opt_rand(o))
goto end;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
case OPT_CIPHER:
if (!opt_cipher(opt_unknown(), &enc))
goto end;
apps/genpkey.c
+9 -1
View File
@@ -24,7 +24,8 @@ static int genpkey_cb(EVP_PKEY_CTX *ctx);
typedef enum OPTION_choice {
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
OPT_ENGINE, OPT_OUTFORM, OPT_OUT, OPT_PASS, OPT_PARAMFILE,
OPT_ALGORITHM, OPT_PKEYOPT, OPT_GENPARAM, OPT_TEXT, OPT_CIPHER
OPT_ALGORITHM, OPT_PKEYOPT, OPT_GENPARAM, OPT_TEXT, OPT_CIPHER,
OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS genpkey_options[] = {
@@ -46,6 +47,8 @@ const OPTIONS genpkey_options[] = {
{"text", OPT_TEXT, '-', "Print the in text"},
{"", OPT_CIPHER, '-', "Cipher to use to encrypt the key"},
OPT_PROV_OPTIONS,
/* This is deliberately last. */
{OPT_HELP_STR, 1, 1,
"Order of options may be important! See the documentation.\n"},
@@ -131,6 +134,11 @@ int genpkey_main(int argc, char **argv)
BIO_printf(bio_err, "%s: cipher mode not supported\n", prog);
goto end;
}
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
argc = opt_num_rest();
apps/genrsa.c
+6 -1
View File
@@ -38,7 +38,7 @@ typedef enum OPTION_choice {
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
OPT_3, OPT_F4, OPT_ENGINE,
OPT_OUT, OPT_PASSOUT, OPT_CIPHER, OPT_PRIMES, OPT_VERBOSE,
OPT_R_ENUM
OPT_R_ENUM, OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS genrsa_options[] = {
@@ -63,6 +63,7 @@ const OPTIONS genrsa_options[] = {
{"", OPT_CIPHER, '-', "Encrypt the output with any supported cipher"},
OPT_R_OPTIONS,
OPT_PROV_OPTIONS,
OPT_PARAMETERS(),
{"numbits", 0, 0, "Size of key in bits"},
@@ -118,6 +119,10 @@ opthelp:
if (!opt_rand(o))
goto end;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
case OPT_PASSOUT:
passoutarg = opt_arg();
break;
apps/include/opt.h
+19
View File
@@ -265,6 +265,24 @@
OPT_R__FIRST: case OPT_R__LAST: break; \
case OPT_R_RAND: case OPT_R_WRITERAND
/*
* Provider options.
*/
# define OPT_PROV_ENUM \
OPT_PROV__FIRST=1600, \
OPT_PROV_PROVIDER, OPT_PROV_PROVIDER_PATH, \
OPT_PROV__LAST
# define OPT_PROV_OPTIONS \
OPT_SECTION("Provider"), \
{ "provider", OPT_PROV_PROVIDER, 's', "Provder to load (can be specified multiple times)" }, \
{ "provider_path", OPT_PROV_PROVIDER_PATH, 's', "Provider load path" }
# define OPT_PROV_CASES \
OPT_PROV__FIRST: case OPT_PROV__LAST: break; \
case OPT_PROV_PROVIDER: \
case OPT_PROV_PROVIDER_PATH
/*
* Option parsing.
*/
@@ -348,6 +366,7 @@ char **opt_rest(void);
int opt_num_rest(void);
int opt_verify(int i, X509_VERIFY_PARAM *vpm);
int opt_rand(int i);
int opt_provider(int i);
void opt_help(const OPTIONS * list);
void opt_print(const OPTIONS * opt, int doingparams, int width);
int opt_format_error(const char *s, unsigned long flags);
apps/kdf.c
+8 -1
View File
@@ -19,7 +19,8 @@
typedef enum OPTION_choice {
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
OPT_KDFOPT, OPT_BIN, OPT_KEYLEN, OPT_OUT
OPT_KDFOPT, OPT_BIN, OPT_KEYLEN, OPT_OUT,
OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS kdf_options[] = {
@@ -36,6 +37,8 @@ const OPTIONS kdf_options[] = {
{"binary", OPT_BIN, '-',
"Output in binary format (default is hexadecimal)"},
OPT_PROV_OPTIONS,
OPT_PARAMETERS(),
{"kdf_name", 0, 0, "Name of the KDF algorithm"},
{NULL}
@@ -80,6 +83,10 @@ opthelp:
if (opts == NULL || !sk_OPENSSL_STRING_push(opts, opt_arg()))
goto opthelp;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto err;
break;
}
}
argc = opt_num_rest();
apps/lib/app_provider.c
+51
View File
@@ -0,0 +1,51 @@
/*
* Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include "apps.h"
#include <openssl/err.h>
#include <openssl/provider.h>
/*
* See comments in opt_verify for explanation of this.
*/
enum prov_range { OPT_PROV_ENUM };
static int opt_provider_load(const char *provider)
{
OSSL_PROVIDER *prov;
prov = OSSL_PROVIDER_load(NULL, provider);
if (prov == NULL) {
opt_printf_stderr("%s: unable to load provider %s\n",
opt_getprog(), provider);
return 0;
}
return 1;
}
static int opt_provider_path(const char *path)
{
if (path != NULL && *path == '\0')
path = NULL;
return OSSL_PROVIDER_set_default_search_path(NULL, path);
}
int opt_provider(int opt)
{
switch ((enum prov_range)opt) {
case OPT_PROV__FIRST:
case OPT_PROV__LAST:
return 1;
case OPT_PROV_PROVIDER:
return opt_provider_load(opt_arg());
case OPT_PROV_PROVIDER_PATH:
return opt_provider_path(opt_arg());
}
return 0;
}
apps/lib/build.info
+1 -1
View File
@@ -9,7 +9,7 @@ ENDIF
# Source for libapps
$LIBAPPSSRC=apps.c apps_ui.c opt.c fmt.c s_cb.c s_socket.c app_rand.c \
columns.c app_params.c names.c
columns.c app_params.c names.c app_provider.c
IF[{- !$disabled{apps} -}]
LIBS{noinst}=../libapps.a
apps/list.c
+8 -1
View File
@@ -617,7 +617,8 @@ typedef enum HELPLIST_CHOICE {
OPT_COMMANDS, OPT_DIGEST_COMMANDS, OPT_MAC_ALGORITHMS, OPT_OPTIONS,
OPT_DIGEST_ALGORITHMS, OPT_CIPHER_COMMANDS, OPT_CIPHER_ALGORITHMS,
OPT_PK_ALGORITHMS, OPT_PK_METHOD, OPT_ENGINES, OPT_DISABLED,
OPT_KDF_ALGORITHMS, OPT_MISSING_HELP, OPT_OBJECTS
OPT_KDF_ALGORITHMS, OPT_MISSING_HELP, OPT_OBJECTS,
OPT_PROV_ENUM
} HELPLIST_CHOICE;
const OPTIONS list_options[] = {
@@ -655,6 +656,8 @@ const OPTIONS list_options[] = {
"List options for specified command"},
{"objects", OPT_OBJECTS, '-',
"List built in objects (OID<->name mappings)"},
OPT_PROV_OPTIONS,
{NULL}
};
@@ -741,6 +744,10 @@ opthelp:
case OPT_VERBOSE:
verbose = 1;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
return 1;
break;
}
done = 1;
}
apps/mac.c
+8 -1
View File
@@ -21,7 +21,8 @@
typedef enum OPTION_choice {
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
OPT_MACOPT, OPT_BIN, OPT_IN, OPT_OUT
OPT_MACOPT, OPT_BIN, OPT_IN, OPT_OUT,
OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS mac_options[] = {
@@ -40,6 +41,8 @@ const OPTIONS mac_options[] = {
{"binary", OPT_BIN, '-',
"Output in binary format (default is hexadecimal)"},
OPT_PROV_OPTIONS,
OPT_PARAMETERS(),
{"mac_name", 0, 0, "MAC algorithm"},
{NULL}
@@ -89,6 +92,10 @@ opthelp:
if (opts == NULL || !sk_OPENSSL_STRING_push(opts, opt_arg()))
goto opthelp;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto err;
break;
}
}
argc = opt_num_rest();
apps/nseq.c
+8 -1
View File
@@ -16,7 +16,8 @@
typedef enum OPTION_choice {
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
OPT_TOSEQ, OPT_IN, OPT_OUT
OPT_TOSEQ, OPT_IN, OPT_OUT,
OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS nseq_options[] = {
@@ -29,6 +30,8 @@ const OPTIONS nseq_options[] = {
OPT_SECTION("Output"),
{"toseq", OPT_TOSEQ, '-', "Output NS Sequence file"},
{"out", OPT_OUT, '>', "Output file"},
OPT_PROV_OPTIONS,
{NULL}
};
@@ -62,6 +65,10 @@ int nseq_main(int argc, char **argv)
case OPT_OUT:
outfile = opt_arg();
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
argc = opt_num_rest();
apps/ocsp.c
+6 -1
View File
@@ -137,7 +137,7 @@ typedef enum OPTION_choice {
OPT_RCID,
OPT_V_ENUM,
OPT_MD,
OPT_MULTI
OPT_MULTI, OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS ocsp_options[] = {
@@ -230,6 +230,7 @@ const OPTIONS ocsp_options[] = {
{"status_age", OPT_STATUS_AGE, 'p', "Maximum status age in seconds"},
OPT_V_OPTIONS,
OPT_PROV_OPTIONS,
{NULL}
};
@@ -541,6 +542,10 @@ int ocsp_main(int argc, char **argv)
multi = atoi(opt_arg());
# endif
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
if (trailing_md) {
apps/passwd.c
+6 -1
View File
@@ -58,7 +58,7 @@ typedef enum OPTION_choice {
OPT_IN,
OPT_NOVERIFY, OPT_QUIET, OPT_TABLE, OPT_REVERSE, OPT_APR1,
OPT_1, OPT_5, OPT_6, OPT_CRYPT, OPT_AIXMD5, OPT_SALT, OPT_STDIN,
OPT_R_ENUM
OPT_R_ENUM, OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS passwd_options[] = {
@@ -90,6 +90,7 @@ const OPTIONS passwd_options[] = {
#endif
OPT_R_OPTIONS,
OPT_PROV_OPTIONS,
OPT_PARAMETERS(),
{"password", 0, 0, "Password text to digest (optional)"},
@@ -191,6 +192,10 @@ int passwd_main(int argc, char **argv)
if (!opt_rand(o))
goto end;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
argc = opt_num_rest();
apps/pkcs12.c
+6 -1
View File
@@ -58,7 +58,7 @@ typedef enum OPTION_choice {
OPT_INKEY, OPT_CERTFILE, OPT_NAME, OPT_CSP, OPT_CANAME,
OPT_IN, OPT_OUT, OPT_PASSIN, OPT_PASSOUT, OPT_PASSWORD, OPT_CAPATH,
OPT_CAFILE, OPT_CASTORE, OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE, OPT_ENGINE,
OPT_R_ENUM
OPT_R_ENUM, OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS pkcs12_options[] = {
@@ -130,6 +130,7 @@ const OPTIONS pkcs12_options[] = {
{"", OPT_CIPHER, '-', "Any supported cipher"},
OPT_R_OPTIONS,
OPT_PROV_OPTIONS,
{NULL}
};
@@ -307,6 +308,10 @@ int pkcs12_main(int argc, char **argv)
case OPT_ENGINE:
e = setup_engine(opt_arg(), 0);
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
argc = opt_num_rest();
apps/pkcs7.c
+8 -1
View File
@@ -23,7 +23,8 @@
typedef enum OPTION_choice {
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_NOOUT,
OPT_TEXT, OPT_PRINT, OPT_PRINT_CERTS, OPT_ENGINE
OPT_TEXT, OPT_PRINT, OPT_PRINT_CERTS, OPT_ENGINE,
OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS pkcs7_options[] = {
@@ -45,6 +46,8 @@ const OPTIONS pkcs7_options[] = {
{"print", OPT_PRINT, '-', "Print out all fields of the PKCS7 structure"},
{"print_certs", OPT_PRINT_CERTS, '-',
"Print_certs print any certs or crl in the input"},
OPT_PROV_OPTIONS,
{NULL}
};
@@ -99,6 +102,10 @@ int pkcs7_main(int argc, char **argv)
case OPT_ENGINE:
e = setup_engine(opt_arg(), 0);
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
argc = opt_num_rest();
apps/pkcs8.c
+6 -1
View File
@@ -26,7 +26,7 @@ typedef enum OPTION_choice {
#endif
OPT_V2, OPT_V1, OPT_V2PRF, OPT_ITER, OPT_PASSIN, OPT_PASSOUT,
OPT_TRADITIONAL,
OPT_R_ENUM
OPT_R_ENUM, OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS pkcs8_options[] = {
@@ -63,6 +63,7 @@ const OPTIONS pkcs8_options[] = {
#endif
OPT_R_OPTIONS,
OPT_PROV_OPTIONS,
{NULL}
};
@@ -127,6 +128,10 @@ int pkcs8_main(int argc, char **argv)
if (!opt_rand(o))
goto end;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
case OPT_TRADITIONAL:
traditional = 1;
break;
apps/pkey.c
+7 -1
View File
@@ -37,7 +37,8 @@ typedef enum OPTION_choice {
OPT_INFORM, OPT_OUTFORM, OPT_PASSIN, OPT_PASSOUT, OPT_ENGINE,
OPT_IN, OPT_OUT, OPT_PUBIN, OPT_PUBOUT, OPT_TEXT_PUB,
OPT_TEXT, OPT_NOOUT, OPT_MD, OPT_TRADITIONAL, OPT_CHECK, OPT_PUB_CHECK,
OPT_EC_PARAM_ENC, OPT_EC_CONV_FORM
OPT_EC_PARAM_ENC, OPT_EC_CONV_FORM,
OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS pkey_options[] = {
@@ -72,6 +73,7 @@ const OPTIONS pkey_options[] = {
{"text", OPT_TEXT, '-', "Output in plaintext as well"},
{"noout", OPT_NOOUT, '-', "Don't output the key"},
OPT_PROV_OPTIONS,
{NULL}
};
@@ -177,6 +179,10 @@ int pkey_main(int argc, char **argv)
ec_asn1_flag = i;
break;
#endif
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
argc = opt_num_rest();
apps/pkeyparam.c
+8 -1
View File
@@ -19,7 +19,8 @@
typedef enum OPTION_choice {
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
OPT_IN, OPT_OUT, OPT_TEXT, OPT_NOOUT,
OPT_ENGINE, OPT_CHECK
OPT_ENGINE, OPT_CHECK,
OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS pkeyparam_options[] = {
@@ -37,6 +38,8 @@ const OPTIONS pkeyparam_options[] = {
{"out", OPT_OUT, '>', "Output file"},
{"text", OPT_TEXT, '-', "Print parameters as text"},
{"noout", OPT_NOOUT, '-', "Don't output encoded parameters"},
OPT_PROV_OPTIONS,
{NULL}
};
@@ -81,6 +84,10 @@ int pkeyparam_main(int argc, char **argv)
case OPT_CHECK:
check = 1;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
argc = opt_num_rest();
apps/pkeyutl.c
+6 -1
View File
@@ -44,7 +44,7 @@ typedef enum OPTION_choice {
OPT_VERIFY, OPT_VERIFYRECOVER, OPT_REV, OPT_ENCRYPT, OPT_DECRYPT,
OPT_DERIVE, OPT_SIGFILE, OPT_INKEY, OPT_PEERKEY, OPT_PASSIN,
OPT_PEERFORM, OPT_KEYFORM, OPT_PKEYOPT, OPT_PKEYOPT_PASSIN, OPT_KDF,
OPT_KDFLEN, OPT_R_ENUM,
OPT_KDFLEN, OPT_R_ENUM, OPT_PROV_ENUM,
OPT_RAWIN, OPT_DIGEST
} OPTION_CHOICE;
@@ -92,6 +92,7 @@ const OPTIONS pkeyutl_options[] = {
{"kdflen", OPT_KDFLEN, 'p', "KDF algorithm output length"},
OPT_R_OPTIONS,
OPT_PROV_OPTIONS,
{NULL}
};
@@ -165,6 +166,10 @@ int pkeyutl_main(int argc, char **argv)
if (!opt_rand(o))
goto end;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
case OPT_ENGINE:
e = setup_engine(opt_arg(), 0);
break;
apps/prime.c
+8 -1
View File
@@ -15,7 +15,8 @@
typedef enum OPTION_choice {
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
OPT_HEX, OPT_GENERATE, OPT_BITS, OPT_SAFE, OPT_CHECKS
OPT_HEX, OPT_GENERATE, OPT_BITS, OPT_SAFE, OPT_CHECKS,
OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS prime_options[] = {
@@ -32,6 +33,8 @@ const OPTIONS prime_options[] = {
{"safe", OPT_SAFE, '-',
"When used with -generate, generate a safe prime"},
OPT_PROV_OPTIONS,
OPT_PARAMETERS(),
{"number", 0, 0, "Number(s) to check for primality if not generating"},
{NULL}
@@ -72,6 +75,10 @@ opthelp:
/* ignore parameter and argument */
opt_arg();
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
argc = opt_num_rest();
apps/progs.pl
+3 -2
View File
@@ -93,10 +93,11 @@ EOF
my %cmd_disabler = (
ciphers => "sock",
pkcs12 => "des",
genrsa => "rsa",
rsautl => "rsa",
);
my %cmd_deprecated = (
rsa => [ "3_0", "pkey", "rsa" ],
genrsa => [ "3_0", "genpkey", "rsa" ],
rsautl => [ "3_0", "pkeyutl", "rsa" ],
dhparam => [ "3_0", "pkeyparam", "dh" ],
dsaparam => [ "3_0", "pkeyparam", "dsa" ],
dsa => [ "3_0", "pkey", "dsa" ],
apps/rand.c
+6 -1
View File
@@ -21,7 +21,7 @@
typedef enum OPTION_choice {
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
OPT_OUT, OPT_ENGINE, OPT_BASE64, OPT_HEX,
OPT_R_ENUM
OPT_R_ENUM, OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS rand_options[] = {
@@ -39,6 +39,7 @@ const OPTIONS rand_options[] = {
{"hex", OPT_HEX, '-', "Hex encode output"},
OPT_R_OPTIONS,
OPT_PROV_OPTIONS,
OPT_PARAMETERS(),
{"num", 0, 0, "Number of bytes to generate"},
@@ -81,6 +82,10 @@ int rand_main(int argc, char **argv)
case OPT_HEX:
format = FORMAT_TEXT;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
argc = opt_num_rest();
apps/rehash.c
+8 -1
View File
@@ -447,7 +447,8 @@ static int do_dir(const char *dirname, enum Hash h)
typedef enum OPTION_choice {
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
OPT_COMPAT, OPT_OLD, OPT_N, OPT_VERBOSE
OPT_COMPAT, OPT_OLD, OPT_N, OPT_VERBOSE,
OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS rehash_options[] = {
@@ -463,6 +464,8 @@ const OPTIONS rehash_options[] = {
OPT_SECTION("Output"),
{"v", OPT_VERBOSE, '-', "Verbose output"},
OPT_PROV_OPTIONS,
OPT_PARAMETERS(),
{"directory", 0, 0, "One or more directories to process (optional)"},
{NULL}
@@ -499,6 +502,10 @@ int rehash_main(int argc, char **argv)
case OPT_VERBOSE:
verbose = 1;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
argc = opt_num_rest();
apps/req.c
+29 -18
View File
@@ -32,7 +32,6 @@
# include <openssl/dsa.h>
#endif
#define SECTION "req"
#define BITS "default_bits"
#define KEYFILE "default_keyfile"
@@ -77,6 +76,8 @@ static int join(char buf[], size_t buf_size, const char *name,
static EVP_PKEY_CTX *set_keygen_ctx(const char *gstr,
int *pkey_type, long *pkeylen,
char **palgnam, ENGINE *keygen_engine);
static const char *section = "req";
static CONF *req_conf = NULL;
static CONF *addext_conf = NULL;
static int batch = 0;
@@ -91,7 +92,8 @@ typedef enum OPTION_choice {
OPT_NAMEOPT, OPT_REQOPT, OPT_SUBJ, OPT_SUBJECT, OPT_TEXT, OPT_X509,
OPT_MULTIVALUE_RDN, OPT_DAYS, OPT_SET_SERIAL, OPT_ADDEXT, OPT_EXTENSIONS,
OPT_REQEXTS, OPT_PRECERT, OPT_MD, OPT_SM2ID, OPT_SM2HEXID,
OPT_R_ENUM
OPT_SECTION,
OPT_R_ENUM, OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS req_options[] = {
@@ -109,6 +111,7 @@ const OPTIONS req_options[] = {
OPT_SECTION("Certificate"),
{"new", OPT_NEW, '-', "New request"},
{"config", OPT_CONFIG, '<', "Request template file"},
{"section", OPT_SECTION, 's', "Config section to use (default \"req\")"},
{"utf8", OPT_UTF8, '-', "Input characters are UTF8 (default ASCII)"},
{"nameopt", OPT_NAMEOPT, 's', "Various certificate name options"},
{"reqopt", OPT_REQOPT, 's', "Various request text options"},
@@ -160,6 +163,7 @@ const OPTIONS req_options[] = {
{"modulus", OPT_MODULUS, '-', "RSA modulus"},
OPT_R_OPTIONS,
OPT_PROV_OPTIONS,
{NULL}
};
@@ -308,6 +312,9 @@ int req_main(int argc, char **argv)
case OPT_CONFIG:
template = opt_arg();
break;
case OPT_SECTION:
section = opt_arg();
break;
case OPT_KEYFORM:
if (!opt_format(opt_arg(), OPT_FMT_ANY, &keyform))
goto opthelp;
@@ -331,6 +338,10 @@ int req_main(int argc, char **argv)
if (!opt_rand(o))
goto end;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
case OPT_NEWKEY:
keyalg = opt_arg();
newreq = 1;
@@ -514,7 +525,7 @@ int req_main(int argc, char **argv)
goto end;
if (md_alg == NULL) {
p = NCONF_get_string(req_conf, SECTION, "default_md");
p = NCONF_get_string(req_conf, section, "default_md");
if (p == NULL) {
ERR_clear_error();
} else {
@@ -525,7 +536,7 @@ int req_main(int argc, char **argv)
}
if (extensions == NULL) {
extensions = NCONF_get_string(req_conf, SECTION, V3_EXTENSIONS);
extensions = NCONF_get_string(req_conf, section, V3_EXTENSIONS);
if (extensions == NULL)
ERR_clear_error();
}
@@ -553,19 +564,19 @@ int req_main(int argc, char **argv)
if (passin == NULL) {
passin = nofree_passin =
NCONF_get_string(req_conf, SECTION, "input_password");
NCONF_get_string(req_conf, section, "input_password");
if (passin == NULL)
ERR_clear_error();
}
if (passout == NULL) {
passout = nofree_passout =
NCONF_get_string(req_conf, SECTION, "output_password");
NCONF_get_string(req_conf, section, "output_password");
if (passout == NULL)
ERR_clear_error();
}
p = NCONF_get_string(req_conf, SECTION, STRING_MASK);
p = NCONF_get_string(req_conf, section, STRING_MASK);
if (p == NULL)
ERR_clear_error();
@@ -575,7 +586,7 @@ int req_main(int argc, char **argv)
}
if (chtype != MBSTRING_UTF8) {
p = NCONF_get_string(req_conf, SECTION, UTF8_IN);
p = NCONF_get_string(req_conf, section, UTF8_IN);
if (p == NULL)
ERR_clear_error();
else if (strcmp(p, "yes") == 0)
@@ -583,7 +594,7 @@ int req_main(int argc, char **argv)
}
if (req_exts == NULL) {
req_exts = NCONF_get_string(req_conf, SECTION, REQ_EXTENSIONS);
req_exts = NCONF_get_string(req_conf, section, REQ_EXTENSIONS);
if (req_exts == NULL)
ERR_clear_error();
}
@@ -606,14 +617,14 @@ int req_main(int argc, char **argv)
/* load_key() has already printed an appropriate message */
goto end;
} else {
app_RAND_load_conf(req_conf, SECTION);
app_RAND_load_conf(req_conf, section);
}
}
if (newreq && (pkey == NULL)) {
app_RAND_load_conf(req_conf, SECTION);
app_RAND_load_conf(req_conf, section);
if (!NCONF_get_number(req_conf, SECTION, BITS, &newkey)) {
if (!NCONF_get_number(req_conf, section, BITS, &newkey)) {
newkey = DEFAULT_KEY_LENGTH;
}
@@ -683,7 +694,7 @@ int req_main(int argc, char **argv)
genctx = NULL;
if (keyout == NULL) {
keyout = NCONF_get_string(req_conf, SECTION, KEYFILE);
keyout = NCONF_get_string(req_conf, section, KEYFILE);
if (keyout == NULL)
ERR_clear_error();
}
@@ -696,10 +707,10 @@ int req_main(int argc, char **argv)
if (out == NULL)
goto end;
p = NCONF_get_string(req_conf, SECTION, "encrypt_rsa_key");
p = NCONF_get_string(req_conf, section, "encrypt_rsa_key");
if (p == NULL) {
ERR_clear_error();
p = NCONF_get_string(req_conf, SECTION, "encrypt_key");
p = NCONF_get_string(req_conf, section, "encrypt_key");
if (p == NULL)
ERR_clear_error();
}
@@ -1057,13 +1068,13 @@ static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, char *subj, int multirdn,
STACK_OF(CONF_VALUE) *dn_sk, *attr_sk = NULL;
char *tmp, *dn_sect, *attr_sect;
tmp = NCONF_get_string(req_conf, SECTION, PROMPT);
tmp = NCONF_get_string(req_conf, section, PROMPT);
if (tmp == NULL)
ERR_clear_error();
if ((tmp != NULL) && strcmp(tmp, "no") == 0)
no_prompt = 1;
dn_sect = NCONF_get_string(req_conf, SECTION, DISTINGUISHED_NAME);
dn_sect = NCONF_get_string(req_conf, section, DISTINGUISHED_NAME);
if (dn_sect == NULL) {
BIO_printf(bio_err, "unable to find '%s' in config\n",
DISTINGUISHED_NAME);
@@ -1075,7 +1086,7 @@ static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, char *subj, int multirdn,
goto err;
}
attr_sect = NCONF_get_string(req_conf, SECTION, ATTRIBUTES);
attr_sect = NCONF_get_string(req_conf, section, ATTRIBUTES);
if (attr_sect == NULL) {
ERR_clear_error();
attr_sk = NULL;
apps/rsa.c
+8 -1
View File
@@ -33,7 +33,8 @@ typedef enum OPTION_choice {
OPT_RSAPUBKEY_IN, OPT_RSAPUBKEY_OUT,
/* Do not change the order here; see case statements below */
OPT_PVK_NONE, OPT_PVK_WEAK, OPT_PVK_STRONG,
OPT_NOOUT, OPT_TEXT, OPT_MODULUS, OPT_CHECK, OPT_CIPHER
OPT_NOOUT, OPT_TEXT, OPT_MODULUS, OPT_CHECK, OPT_CIPHER,
OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS rsa_options[] = {
@@ -68,6 +69,8 @@ const OPTIONS rsa_options[] = {
{"pvk-weak", OPT_PVK_WEAK, '-', "Enable 'Weak' PVK encoding level"},
{"pvk-none", OPT_PVK_NONE, '-', "Don't enforce PVK encoding"},
# endif
OPT_PROV_OPTIONS,
{NULL}
};
@@ -157,6 +160,10 @@ int rsa_main(int argc, char **argv)
if (!opt_cipher(opt_unknown(), &enc))
goto opthelp;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
argc = opt_num_rest();
apps/rsautl.c
+6 -1
View File
@@ -34,7 +34,7 @@ typedef enum OPTION_choice {
OPT_RSA_RAW, OPT_OAEP, OPT_SSL, OPT_PKCS, OPT_X931,
OPT_SIGN, OPT_VERIFY, OPT_REV, OPT_ENCRYPT, OPT_DECRYPT,
OPT_PUBIN, OPT_CERTIN, OPT_INKEY, OPT_PASSIN, OPT_KEYFORM,
OPT_R_ENUM
OPT_R_ENUM, OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS rsautl_options[] = {
@@ -69,6 +69,7 @@ const OPTIONS rsautl_options[] = {
{"hexdump", OPT_HEXDUMP, '-', "Hex dump output"},
OPT_R_OPTIONS,
OPT_PROV_OPTIONS,
{NULL}
};
@@ -166,6 +167,10 @@ int rsautl_main(int argc, char **argv)
if (!opt_rand(o))
goto end;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
argc = opt_num_rest();
apps/s_client.c
+8 -3
View File
@@ -600,7 +600,7 @@ typedef enum OPTION_choice {
OPT_DANE_TLSA_RRDATA, OPT_DANE_EE_NO_NAME,
OPT_ENABLE_PHA,
OPT_SCTP_LABEL_BUG,
OPT_R_ENUM
OPT_R_ENUM, OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS s_client_options[] = {
@@ -659,12 +659,12 @@ const OPTIONS s_client_options[] = {
{"pass", OPT_PASS, 's', "Private key file pass phrase source"},
{"CApath", OPT_CAPATH, '/', "PEM format directory of CA's"},
{"CAfile", OPT_CAFILE, '<', "PEM format file of CA's"},
{"CAstore", OPT_CAFILE, ':', "URI to store of CA's"},
{"CAstore", OPT_CASTORE, ':', "URI to store of CA's"},
{"no-CAfile", OPT_NOCAFILE, '-',
"Do not load the default certificates file"},
{"no-CApath", OPT_NOCAPATH, '-',
"Do not load certificates from the default certificates directory"},
{"no-CAstore", OPT_NOCAPATH, '-',
{"no-CAstore", OPT_NOCASTORE, '-',
"Do not load certificates from the default certificates store"},
{"requestCAfile", OPT_REQCAFILE, '<',
"PEM format file of CA names to send to the server"},
@@ -817,6 +817,7 @@ const OPTIONS s_client_options[] = {
{"chainCAfile", OPT_CHAINCAFILE, '<',
"CA file for certificate chain (PEM format)"},
OPT_X_OPTIONS,
OPT_PROV_OPTIONS,
OPT_PARAMETERS(),
{"host:port", 0, 0, "Where to connect; same as -connect option"},
@@ -1225,6 +1226,10 @@ int s_client_main(int argc, char **argv)
if (!opt_rand(o))
goto end;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
case OPT_IGN_EOF:
c_ign_eof = 1;
break;
apps/s_server.c
+7 -1
View File
@@ -757,7 +757,8 @@ typedef enum OPTION_choice {
OPT_R_ENUM,
OPT_S_ENUM,
OPT_V_ENUM,
OPT_X_ENUM
OPT_X_ENUM,
OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS s_server_options[] = {
@@ -992,6 +993,7 @@ const OPTIONS s_server_options[] = {
{"chainCAfile", OPT_CHAINCAFILE, '<',
"CA file for certificate chain (PEM format)"},
OPT_X_OPTIONS,
OPT_PROV_OPTIONS,
{NULL}
};
@@ -1566,6 +1568,10 @@ int s_server_main(int argc, char *argv[])
if (!opt_rand(o))
goto end;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
case OPT_SERVERNAME:
tlsextcbp.servername = opt_arg();
break;
apps/s_time.c
+7 -1
View File
@@ -48,7 +48,8 @@ typedef enum OPTION_choice {
OPT_CAPATH, OPT_CAFILE, OPT_CASTORE,
OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE,
OPT_NEW, OPT_REUSE, OPT_BUGS, OPT_VERIFY, OPT_TIME, OPT_SSL3,
OPT_WWW, OPT_TLS1, OPT_TLS1_1, OPT_TLS1_2, OPT_TLS1_3
OPT_WWW, OPT_TLS1, OPT_TLS1_1, OPT_TLS1_2, OPT_TLS1_3,
OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS s_time_options[] = {
@@ -99,6 +100,7 @@ const OPTIONS s_time_options[] = {
{"no-CAstore", OPT_NOCASTORE, '-',
"Do not load certificates from the default certificates store URI"},
OPT_PROV_OPTIONS,
{NULL}
};
@@ -226,6 +228,10 @@ int s_time_main(int argc, char **argv)
min_version = TLS1_3_VERSION;
max_version = TLS1_3_VERSION;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
argc = opt_num_rest();
apps/smime.c
+6 -1
View File
@@ -42,7 +42,7 @@ typedef enum OPTION_choice {
OPT_TO, OPT_FROM, OPT_SUBJECT, OPT_SIGNER, OPT_RECIP, OPT_MD,
OPT_CIPHER, OPT_INKEY, OPT_KEYFORM, OPT_CERTFILE, OPT_CAFILE,
OPT_CAPATH, OPT_CASTORE, OPT_NOCAFILE, OPT_NOCAPATH, OPT_NOCASTORE,
OPT_R_ENUM,
OPT_R_ENUM, OPT_PROV_ENUM,
OPT_V_ENUM,
OPT_IN, OPT_INFORM, OPT_OUT,
OPT_OUTFORM, OPT_CONTENT
@@ -121,6 +121,7 @@ const OPTIONS smime_options[] = {
OPT_R_OPTIONS,
OPT_V_OPTIONS,
OPT_PROV_OPTIONS,
OPT_PARAMETERS(),
{"cert", 0, 0, "Recipient certs, used when encrypting"},
@@ -244,6 +245,10 @@ int smime_main(int argc, char **argv)
if (!opt_rand(o))
goto end;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
case OPT_ENGINE:
e = setup_engine(opt_arg(), 0);
break;
apps/speed.c
+6 -1
View File
@@ -253,7 +253,7 @@ static int opt_found(const char *name, unsigned int *result,
typedef enum OPTION_choice {
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
OPT_ELAPSED, OPT_EVP, OPT_HMAC, OPT_DECRYPT, OPT_ENGINE, OPT_MULTI,
OPT_MR, OPT_MB, OPT_MISALIGN, OPT_ASYNCJOBS, OPT_R_ENUM,
OPT_MR, OPT_MB, OPT_MISALIGN, OPT_ASYNCJOBS, OPT_R_ENUM, OPT_PROV_ENUM,
OPT_PRIMES, OPT_SECONDS, OPT_BYTES, OPT_AEAD, OPT_CMAC
} OPTION_CHOICE;
@@ -301,6 +301,7 @@ const OPTIONS speed_options[] = {
"Use specified offset to mis-align buffers"},
OPT_R_OPTIONS,
OPT_PROV_OPTIONS,
OPT_PARAMETERS(),
{"algorithm", 0, 0, "Algorithm(s) to test (optional; otherwise tests all)"},
@@ -1706,6 +1707,10 @@ int speed_main(int argc, char **argv)
if (!opt_rand(o))
goto end;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
case OPT_PRIMES:
if (!opt_int(opt_arg(), &primes))
goto end;
apps/spkac.c
+8 -1
View File
@@ -24,7 +24,8 @@ typedef enum OPTION_choice {
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
OPT_NOOUT, OPT_PUBKEY, OPT_VERIFY, OPT_IN, OPT_OUT,
OPT_ENGINE, OPT_KEY, OPT_CHALLENGE, OPT_PASSIN, OPT_SPKAC,
OPT_SPKSECT, OPT_KEYFORM
OPT_SPKSECT, OPT_KEYFORM,
OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS spkac_options[] = {
@@ -49,6 +50,8 @@ const OPTIONS spkac_options[] = {
{"noout", OPT_NOOUT, '-', "Don't print SPKAC"},
{"pubkey", OPT_PUBKEY, '-', "Output public key"},
{"verify", OPT_VERIFY, '-', "Verify SPKAC signature"},
OPT_PROV_OPTIONS,
{NULL}
};
@@ -116,6 +119,10 @@ int spkac_main(int argc, char **argv)
case OPT_ENGINE:
e = setup_engine(opt_arg(), 0);
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
argc = opt_num_rest();
apps/srp.c
+6 -1
View File
@@ -193,7 +193,7 @@ typedef enum OPTION_choice {
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
OPT_VERBOSE, OPT_CONFIG, OPT_NAME, OPT_SRPVFILE, OPT_ADD,
OPT_DELETE, OPT_MODIFY, OPT_LIST, OPT_GN, OPT_USERINFO,
OPT_PASSIN, OPT_PASSOUT, OPT_ENGINE, OPT_R_ENUM
OPT_PASSIN, OPT_PASSOUT, OPT_ENGINE, OPT_R_ENUM, OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS srp_options[] = {
@@ -222,6 +222,7 @@ const OPTIONS srp_options[] = {
{"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
OPT_R_OPTIONS,
OPT_PROV_OPTIONS,
OPT_PARAMETERS(),
{"user", 0, 0, "Username(s) to process (optional)"},
@@ -297,6 +298,10 @@ int srp_main(int argc, char **argv)
if (!opt_rand(o))
goto end;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
argc = opt_num_rest();
apps/storeutl.c
+7 -1
View File
@@ -27,7 +27,7 @@ typedef enum OPTION_choice {
OPT_SEARCHFOR_CERTS, OPT_SEARCHFOR_KEYS, OPT_SEARCHFOR_CRLS,
OPT_CRITERION_SUBJECT, OPT_CRITERION_ISSUER, OPT_CRITERION_SERIAL,
OPT_CRITERION_FINGERPRINT, OPT_CRITERION_ALIAS,
OPT_MD
OPT_MD, OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS storeutl_options[] = {
@@ -59,6 +59,8 @@ const OPTIONS storeutl_options[] = {
{"text", OPT_TEXT, '-', "Print a text form of the objects"},
{"noout", OPT_NOOUT, '-', "No PEM output, just status"},
OPT_PROV_OPTIONS,
OPT_PARAMETERS(),
{"uri", 0, 0, "URI of the store object"},
{NULL}
@@ -250,6 +252,10 @@ int storeutl_main(int argc, char *argv[])
case OPT_MD:
if (!opt_md(opt_unknown(), &digest))
goto opthelp;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
argc = opt_num_rest();
apps/ts.c
+6 -1
View File
@@ -86,7 +86,7 @@ typedef enum OPTION_choice {
OPT_IN, OPT_TOKEN_IN, OPT_OUT, OPT_TOKEN_OUT, OPT_TEXT,
OPT_REPLY, OPT_QUERYFILE, OPT_PASSIN, OPT_INKEY, OPT_SIGNER,
OPT_CHAIN, OPT_VERIFY, OPT_CAPATH, OPT_CAFILE, OPT_CASTORE, OPT_UNTRUSTED,
OPT_MD, OPT_V_ENUM, OPT_R_ENUM
OPT_MD, OPT_V_ENUM, OPT_R_ENUM, OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS ts_options[] = {
@@ -127,6 +127,7 @@ const OPTIONS ts_options[] = {
OPT_R_OPTIONS,
OPT_V_OPTIONS,
OPT_PROV_OPTIONS,
{NULL}
};
@@ -219,6 +220,10 @@ int ts_main(int argc, char **argv)
if (!opt_rand(o))
goto end;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
case OPT_TSPOLICY:
policy = opt_arg();
break;
apps/verify.c
+8 -1
View File
@@ -31,7 +31,8 @@ typedef enum OPTION_choice {
OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE,
OPT_UNTRUSTED, OPT_TRUSTED, OPT_CRLFILE, OPT_CRL_DOWNLOAD, OPT_SHOW_CHAIN,
OPT_V_ENUM, OPT_NAMEOPT,
OPT_VERBOSE, OPT_SM2ID, OPT_SM2HEXID
OPT_VERBOSE, OPT_SM2ID, OPT_SM2HEXID,
OPT_PROV_ENUM
} OPTION_CHOICE;
const OPTIONS verify_options[] = {
@@ -73,6 +74,8 @@ const OPTIONS verify_options[] = {
"Specify a hex ID string to verify an SM2 certificate"},
#endif
OPT_PROV_OPTIONS,
OPT_PARAMETERS(),
{"cert", 0, 0, "Certificate(s) to verify (optional; stdin used otherwise)"},
{NULL}
@@ -209,6 +212,10 @@ int verify_main(int argc, char **argv)
goto end;
}
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
}
}
argc = opt_num_rest();
apps/x509.c
+6 -1
View File
@@ -61,7 +61,7 @@ typedef enum OPTION_choice {
OPT_SUBJECT_HASH_OLD,
OPT_ISSUER_HASH_OLD,
OPT_BADSIG, OPT_MD, OPT_ENGINE, OPT_NOCERT, OPT_PRESERVE_DATES,
OPT_R_ENUM, OPT_EXT
OPT_R_ENUM, OPT_PROV_ENUM, OPT_EXT
} OPTION_CHOICE;
const OPTIONS x509_options[] = {
@@ -144,6 +144,7 @@ const OPTIONS x509_options[] = {
"The CA key, must be PEM format; if not in CAfile"},
{"extfile", OPT_EXTFILE, '<', "File with X509V3 extensions to add"},
OPT_R_OPTIONS,
OPT_PROV_OPTIONS,
{"CAform", OPT_CAFORM, 'F', "CA format - default PEM"},
{"CAkeyform", OPT_CAKEYFORM, 'E', "CA key format - default PEM"},
{"sigopt", OPT_SIGOPT, 's', "Signature parameter in n:v form"},
@@ -270,6 +271,10 @@ int x509_main(int argc, char **argv)
if (!opt_rand(o))
goto end;
break;
case OPT_PROV_CASES:
if (!opt_provider(o))
goto end;
break;
case OPT_EXTENSIONS:
extsect = opt_arg();
break;
config
-8
View File
@@ -847,14 +847,6 @@ case "$GUESSOS" in
i386-*) options="$options 386" ;;
esac
for i in aes aria bf camellia cast des dh dsa ec hmac idea md2 md5 mdc2 rc2 rc4 rc5 ripemd rsa seed sha sm2 sm3 sm4
do
if [ ! -d $THERE/crypto/$i ]
then
options="$options no-$i"
fi
done
if [ -z "$OUT" ]; then
OUT="$CC"
fi
crypto/aes/asm/aes-s390x.pl
+2 -2
View File
@@ -1989,7 +1989,7 @@ $code.=<<___;
.Lxts_enc_done:
stg $sp,$tweak+0($sp) # wipe tweak
stg $sp,$twesk+8($sp)
stg $sp,$tweak+8($sp)
lm${g} %r6,$ra,6*$SIZE_T($sp)
br $ra
.size AES_xts_encrypt,.-AES_xts_encrypt
@@ -2269,7 +2269,7 @@ $code.=<<___;
stg $sp,$tweak-16+8($sp)
.Lxts_dec_done:
stg $sp,$tweak+0($sp) # wipe tweak
stg $sp,$twesk+8($sp)
stg $sp,$tweak+8($sp)
lm${g} %r6,$ra,6*$SIZE_T($sp)
br $ra
.size AES_xts_decrypt,.-AES_xts_decrypt
crypto/cms/cms_env.c
+116 -13
View File
@@ -20,6 +20,8 @@
/* CMS EnvelopedData Utilities */
static void cms_env_set_version(CMS_EnvelopedData *env);
CMS_EnvelopedData *cms_get0_enveloped(CMS_ContentInfo *cms)
{
if (OBJ_obj2nid(cms->contentType) != NID_pkcs7_enveloped) {
@@ -122,6 +124,47 @@ CMS_ContentInfo *CMS_EnvelopedData_create(const EVP_CIPHER *cipher)
return NULL;
}
int cms_EnvelopedData_final(CMS_ContentInfo *cms, BIO *chain)
{
CMS_EnvelopedData *env = NULL;
EVP_CIPHER_CTX *ctx = NULL;
BIO *mbio = BIO_find_type(chain, BIO_TYPE_CIPHER);
env = cms_get0_enveloped(cms);
if (env == NULL)
return 0;
if (mbio == NULL) {
CMSerr(CMS_F_CMS_ENVELOPEDDATA_FINAL, CMS_R_CONTENT_NOT_FOUND);
return 0;
}
BIO_get_cipher_ctx(mbio, &ctx);
/*
* If the selected cipher supports unprotected attributes,
* deal with it using special ctrl function
*/
if (EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(ctx)) & EVP_CIPH_FLAG_CIPHER_WITH_MAC) {
if (cms->d.envelopedData->unprotectedAttrs == NULL)
cms->d.envelopedData->unprotectedAttrs = sk_X509_ATTRIBUTE_new_null();
if (cms->d.envelopedData->unprotectedAttrs == NULL) {
CMSerr(CMS_F_CMS_ENVELOPEDDATA_FINAL, ERR_R_MALLOC_FAILURE);
return 0;
}
if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_PROCESS_UNPROTECTED,
1, env->unprotectedAttrs) <= 0) {
CMSerr(CMS_F_CMS_ENVELOPEDDATA_FINAL, CMS_R_CTRL_FAILURE);
return 0;
}
}
cms_env_set_version(cms->d.envelopedData);
return 1;
}
/* Key Transport Recipient Info (KTRI) routines */
/* Initialise a ktri based on passed certificate and key */
@@ -176,8 +219,9 @@ static int cms_RecipientInfo_ktri_init(CMS_RecipientInfo *ri, X509 *recip,
* Add a recipient certificate using appropriate type of RecipientInfo
*/
CMS_RecipientInfo *CMS_add1_recipient_cert(CMS_ContentInfo *cms,
X509 *recip, unsigned int flags)
CMS_RecipientInfo *CMS_add1_recipient(CMS_ContentInfo *cms, X509 *recip,
EVP_PKEY *originatorPrivKey,
X509 *originator, unsigned int flags)
{
CMS_RecipientInfo *ri = NULL;
CMS_EnvelopedData *env;
@@ -193,7 +237,7 @@ CMS_RecipientInfo *CMS_add1_recipient_cert(CMS_ContentInfo *cms,
pk = X509_get0_pubkey(recip);
if (pk == NULL) {
CMSerr(CMS_F_CMS_ADD1_RECIPIENT_CERT, CMS_R_ERROR_GETTING_PUBLIC_KEY);
CMSerr(CMS_F_CMS_ADD1_RECIPIENT, CMS_R_ERROR_GETTING_PUBLIC_KEY);
goto err;
}
@@ -205,12 +249,12 @@ CMS_RecipientInfo *CMS_add1_recipient_cert(CMS_ContentInfo *cms,
break;
case CMS_RECIPINFO_AGREE:
if (!cms_RecipientInfo_kari_init(ri, recip, pk, flags))
if (!cms_RecipientInfo_kari_init(ri, recip, pk, originator, originatorPrivKey, flags))
goto err;
break;
default:
CMSerr(CMS_F_CMS_ADD1_RECIPIENT_CERT,
CMSerr(CMS_F_CMS_ADD1_RECIPIENT,
CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
goto err;
@@ -222,13 +266,19 @@ CMS_RecipientInfo *CMS_add1_recipient_cert(CMS_ContentInfo *cms,
return ri;
merr:
CMSerr(CMS_F_CMS_ADD1_RECIPIENT_CERT, ERR_R_MALLOC_FAILURE);
CMSerr(CMS_F_CMS_ADD1_RECIPIENT, ERR_R_MALLOC_FAILURE);
err:
M_ASN1_free_of(ri, CMS_RecipientInfo);
return NULL;
}
CMS_RecipientInfo *CMS_add1_recipient_cert(CMS_ContentInfo *cms,
X509 *recip, unsigned int flags)
{
return CMS_add1_recipient(cms, recip, NULL, NULL, flags);
}
int CMS_RecipientInfo_ktri_get0_algs(CMS_RecipientInfo *ri,
EVP_PKEY **pk, X509 **recip,
X509_ALGOR **palg)
@@ -894,7 +944,34 @@ static void cms_env_set_version(CMS_EnvelopedData *env)
env->version = 0;
}
BIO *cms_EnvelopedData_init_bio(const CMS_ContentInfo *cms)
static BIO *cms_EnvelopedData_Decryption_init_bio(CMS_ContentInfo *cms)
{
CMS_EncryptedContentInfo *ec = cms->d.envelopedData->encryptedContentInfo;
BIO *contentBio = cms_EncryptedContent_init_bio(ec);
EVP_CIPHER_CTX *ctx = NULL;
if (contentBio == NULL)
return NULL;
BIO_get_cipher_ctx(contentBio, &ctx);
if (ctx == NULL) {
BIO_free(contentBio);
return NULL;
}
/*
* If the selected cipher supports unprotected attributes,
* deal with it using special ctrl function
*/
if ((EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(ctx)) & EVP_CIPH_FLAG_CIPHER_WITH_MAC)
&& EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_PROCESS_UNPROTECTED, 0,
cms->d.envelopedData->unprotectedAttrs) <= 0) {
BIO_free(contentBio);
return NULL;
}
return contentBio;
}
static BIO *cms_EnvelopedData_Encryption_init_bio(CMS_ContentInfo *cms)
{
CMS_EncryptedContentInfo *ec;
STACK_OF(CMS_RecipientInfo) *rinfos;
@@ -907,20 +984,17 @@ BIO *cms_EnvelopedData_init_bio(const CMS_ContentInfo *cms)
ec = cms->d.envelopedData->encryptedContentInfo;
ret = cms_EncryptedContent_init_bio(ec);
/* If error or no cipher end of processing */
if (!ret || !ec->cipher)
/* If error end of processing */
if (!ret)
return ret;
/* Now encrypt content key according to each RecipientInfo type */
rinfos = cms->d.envelopedData->recipientInfos;
for (i = 0; i < sk_CMS_RecipientInfo_num(rinfos); i++) {
ri = sk_CMS_RecipientInfo_value(rinfos, i);
if (CMS_RecipientInfo_encrypt(cms, ri) <= 0) {
CMSerr(CMS_F_CMS_ENVELOPEDDATA_INIT_BIO,
CMS_R_ERROR_SETTING_RECIPIENTINFO);
CMSerr(0, CMS_R_ERROR_SETTING_RECIPIENTINFO);
goto err;
}
}
@@ -937,7 +1011,17 @@ BIO *cms_EnvelopedData_init_bio(const CMS_ContentInfo *cms)
return ret;
BIO_free(ret);
return NULL;
}
BIO *cms_EnvelopedData_init_bio(CMS_ContentInfo *cms)
{
if (cms->d.envelopedData->encryptedContentInfo->cipher != NULL) {
/* If cipher is set it's encryption */
return cms_EnvelopedData_Encryption_init_bio(cms);
}
/* If cipher is not set it's decryption */
return cms_EnvelopedData_Decryption_init_bio(cms);
}
/*
@@ -955,3 +1039,22 @@ int cms_pkey_get_ri_type(EVP_PKEY *pk)
}
return CMS_RECIPINFO_TRANS;
}
int cms_pkey_is_ri_type_supported(EVP_PKEY *pk, int ri_type)
{
int supportedRiType;
if (pk->ameth != NULL && pk->ameth->pkey_ctrl != NULL) {
int i, r;
i = pk->ameth->pkey_ctrl(pk, ASN1_PKEY_CTRL_CMS_IS_RI_TYPE_SUPPORTED, ri_type, &r);
if (i > 0)
return r;
}
supportedRiType = cms_pkey_get_ri_type(pk);
if (supportedRiType < 0)
return 0;
return (supportedRiType == ri_type);
}
crypto/cms/cms_kari.c
+81 -8
View File
@@ -152,7 +152,7 @@ int CMS_RecipientEncryptedKey_cert_cmp(CMS_RecipientEncryptedKey *rek,
return -1;
}
int CMS_RecipientInfo_kari_set0_pkey(CMS_RecipientInfo *ri, EVP_PKEY *pk)
int CMS_RecipientInfo_kari_set0_pkey_and_peer(CMS_RecipientInfo *ri, EVP_PKEY *pk, X509 *peer)
{
EVP_PKEY_CTX *pctx;
CMS_KeyAgreeRecipientInfo *kari = ri->d.kari;
@@ -161,9 +161,18 @@ int CMS_RecipientInfo_kari_set0_pkey(CMS_RecipientInfo *ri, EVP_PKEY *pk)
kari->pctx = NULL;
if (pk == NULL)
return 1;
pctx = EVP_PKEY_CTX_new(pk, NULL);
if (pctx == NULL || EVP_PKEY_derive_init(pctx) <= 0)
goto err;
if (peer != NULL) {
EVP_PKEY *pub_pkey = X509_get0_pubkey(peer);
if (EVP_PKEY_derive_set_peer(pctx, pub_pkey) <= 0)
goto err;
}
kari->pctx = pctx;
return 1;
err:
@@ -171,6 +180,11 @@ int CMS_RecipientInfo_kari_set0_pkey(CMS_RecipientInfo *ri, EVP_PKEY *pk)
return 0;
}
int CMS_RecipientInfo_kari_set0_pkey(CMS_RecipientInfo *ri, EVP_PKEY *pk)
{
return CMS_RecipientInfo_kari_set0_pkey_and_peer(ri, pk, NULL);
}
EVP_CIPHER_CTX *CMS_RecipientInfo_kari_get0_ctx(CMS_RecipientInfo *ri)
{
if (ri->type == CMS_RECIPINFO_AGREE)
@@ -283,10 +297,29 @@ static int cms_kari_create_ephemeral_key(CMS_KeyAgreeRecipientInfo *kari,
return rv;
}
/* Set originator private key and initialise context based on it */
static int cms_kari_set_originator_private_key(CMS_KeyAgreeRecipientInfo *kari, EVP_PKEY *originatorPrivKey )
{
EVP_PKEY_CTX *pctx = NULL;
int rv = 0;
pctx = EVP_PKEY_CTX_new(originatorPrivKey, NULL);
if (pctx == NULL)
goto err;
if (EVP_PKEY_derive_init(pctx) <= 0)
goto err;
kari->pctx = pctx;
rv = 1;
err:
if (rv == 0)
EVP_PKEY_CTX_free(pctx);
return rv;
}
/* Initialise a kari based on passed certificate and key */
int cms_RecipientInfo_kari_init(CMS_RecipientInfo *ri, X509 *recip,
EVP_PKEY *pk, unsigned int flags)
int cms_RecipientInfo_kari_init(CMS_RecipientInfo *ri, X509 *recip, EVP_PKEY *recipPubKey, X509 * originator, EVP_PKEY *originatorPrivKey, unsigned int flags)
{
CMS_KeyAgreeRecipientInfo *kari;
CMS_RecipientEncryptedKey *rek = NULL;
@@ -321,12 +354,36 @@ int cms_RecipientInfo_kari_init(CMS_RecipientInfo *ri, X509 *recip,
return 0;
}
if (originatorPrivKey == NULL && originator == NULL) {
/* Create ephemeral key */
if (!cms_kari_create_ephemeral_key(kari, pk))
if (!cms_kari_create_ephemeral_key(kari, recipPubKey))
return 0;
} else {
/* Use originator key */
CMS_OriginatorIdentifierOrKey *oik = ri->d.kari->originator;
if (originatorPrivKey == NULL && originator == NULL)
return 0;
EVP_PKEY_up_ref(pk);
rek->pkey = pk;
if (flags & CMS_USE_ORIGINATOR_KEYID) {
oik->type = CMS_OIK_KEYIDENTIFIER;
oik->d.subjectKeyIdentifier = ASN1_OCTET_STRING_new();
if (oik->d.subjectKeyIdentifier == NULL)
return 0;
if (!cms_set1_keyid(&oik->d.subjectKeyIdentifier, originator))
return 0;
} else {
oik->type = CMS_REK_ISSUER_SERIAL;
if (!cms_set1_ias(&oik->d.issuerAndSerialNumber, originator))
return 0;
}
if (!cms_kari_set_originator_private_key(kari, originatorPrivKey))
return 0;
}
EVP_PKEY_up_ref(recipPubKey);
rek->pkey = recipPubKey;
return 1;
}
@@ -336,14 +393,30 @@ static int cms_wrap_init(CMS_KeyAgreeRecipientInfo *kari,
EVP_CIPHER_CTX *ctx = kari->ctx;
const EVP_CIPHER *kekcipher;
int keylen = EVP_CIPHER_key_length(cipher);
int ret;
/* If a suitable wrap algorithm is already set nothing to do */
kekcipher = EVP_CIPHER_CTX_cipher(ctx);
if (kekcipher) {
if (kekcipher != NULL) {
if (EVP_CIPHER_CTX_mode(ctx) != EVP_CIPH_WRAP_MODE)
return 0;
return 1;
}
else if (cipher != NULL
&& (EVP_CIPHER_flags(cipher) & EVP_CIPH_FLAG_GET_WRAP_CIPHER)) {
ret = EVP_CIPHER_meth_get_ctrl(cipher)(NULL, EVP_CTRL_GET_WRAP_CIPHER,
0, &kekcipher);
if (ret <= 0)
return 0;
if (kekcipher != NULL) {
if (EVP_CIPHER_mode(kekcipher) != EVP_CIPH_WRAP_MODE)
return 0;
return EVP_EncryptInit_ex(ctx, kekcipher, NULL, NULL, NULL);
}
}
/*
* Pick a cipher based on content encryption cipher. If it is DES3 use
* DES3 wrap otherwise use AES wrap similar to key size.
crypto/cms/cms_lib.c
+3 -1
View File
@@ -133,12 +133,14 @@ int CMS_dataFinal(CMS_ContentInfo *cms, BIO *cmsbio)
switch (OBJ_obj2nid(cms->contentType)) {
case NID_pkcs7_data:
case NID_pkcs7_enveloped:
case NID_pkcs7_encrypted:
case NID_id_smime_ct_compressedData:
/* Nothing to do */
return 1;
case NID_pkcs7_enveloped:
return cms_EnvelopedData_final(cms, cmsbio);
case NID_pkcs7_signed:
return cms_SignedData_final(cms, cmsbio);
crypto/cms/cms_local.h
+5 -2
View File
@@ -402,13 +402,16 @@ int cms_Receipt_verify(CMS_ContentInfo *cms, CMS_ContentInfo *req_cms);
int cms_msgSigDigest_add1(CMS_SignerInfo *dest, CMS_SignerInfo *src);
ASN1_OCTET_STRING *cms_encode_Receipt(CMS_SignerInfo *si);
BIO *cms_EnvelopedData_init_bio(const CMS_ContentInfo *cms);
BIO *cms_EnvelopedData_init_bio(CMS_ContentInfo *cms);
int cms_EnvelopedData_final(CMS_ContentInfo *cms, BIO *chain);
CMS_EnvelopedData *cms_get0_enveloped(CMS_ContentInfo *cms);
int cms_env_asn1_ctrl(CMS_RecipientInfo *ri, int cmd);
int cms_pkey_get_ri_type(EVP_PKEY *pk);
int cms_pkey_is_ri_type_supported(EVP_PKEY *pk, int ri_type);
/* KARI routines */
int cms_RecipientInfo_kari_init(CMS_RecipientInfo *ri, X509 *recip,
EVP_PKEY *pk, unsigned int flags);
EVP_PKEY *recipPubKey, X509 *originator,
EVP_PKEY *originatorPrivKey, unsigned int flags);
int cms_RecipientInfo_kari_encrypt(const CMS_ContentInfo *cms,
CMS_RecipientInfo *ri);
crypto/cms/cms_smime.c
+23 -13
View File
@@ -576,19 +576,20 @@ CMS_ContentInfo *CMS_encrypt(STACK_OF(X509) *certs, BIO *data,
return NULL;
}
static int cms_kari_set1_pkey(CMS_ContentInfo *cms, CMS_RecipientInfo *ri,
EVP_PKEY *pk, X509 *cert)
static int cms_kari_set1_pkey_and_peer(CMS_ContentInfo *cms, CMS_RecipientInfo *ri,
EVP_PKEY *pk, X509 *cert, X509 *peer)
{
int i;
STACK_OF(CMS_RecipientEncryptedKey) *reks;
CMS_RecipientEncryptedKey *rek;
reks = CMS_RecipientInfo_kari_get0_reks(ri);
for (i = 0; i < sk_CMS_RecipientEncryptedKey_num(reks); i++) {
int rv;
rek = sk_CMS_RecipientEncryptedKey_value(reks, i);
if (cert != NULL && CMS_RecipientEncryptedKey_cert_cmp(rek, cert))
continue;
CMS_RecipientInfo_kari_set0_pkey(ri, pk);
CMS_RecipientInfo_kari_set0_pkey_and_peer(ri, pk, peer);
rv = CMS_RecipientInfo_kari_decrypt(cms, ri, rek);
CMS_RecipientInfo_kari_set0_pkey(ri, NULL);
if (rv > 0)
@@ -599,28 +600,37 @@ static int cms_kari_set1_pkey(CMS_ContentInfo *cms, CMS_RecipientInfo *ri,
}
int CMS_decrypt_set1_pkey(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert)
{
return CMS_decrypt_set1_pkey_and_peer(cms, pk, cert, NULL);
}
int CMS_decrypt_set1_pkey_and_peer(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert, X509 *peer)
{
STACK_OF(CMS_RecipientInfo) *ris;
CMS_RecipientInfo *ri;
int i, r, ri_type;
int i, r, cms_pkey_ri_type;
int debug = 0, match_ri = 0;
ris = CMS_get0_RecipientInfos(cms);
if (ris)
debug = cms->d.envelopedData->encryptedContentInfo->debug;
ri_type = cms_pkey_get_ri_type(pk);
if (ri_type == CMS_RECIPINFO_NONE) {
CMSerr(CMS_F_CMS_DECRYPT_SET1_PKEY,
cms_pkey_ri_type = cms_pkey_get_ri_type(pk);
if (cms_pkey_ri_type == CMS_RECIPINFO_NONE) {
CMSerr(CMS_F_CMS_DECRYPT_SET1_PKEY_AND_PEER,
CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
return 0;
}
for (i = 0; i < sk_CMS_RecipientInfo_num(ris); i++) {
int ri_type;
ri = sk_CMS_RecipientInfo_value(ris, i);
if (CMS_RecipientInfo_type(ri) != ri_type)
ri_type = CMS_RecipientInfo_type(ri);
if (!cms_pkey_is_ri_type_supported(pk, ri_type))
continue;
match_ri = 1;
if (ri_type == CMS_RECIPINFO_AGREE) {
r = cms_kari_set1_pkey(cms, ri, pk, cert);
r = cms_kari_set1_pkey_and_peer(cms, ri, pk, cert, peer);
if (r > 0)
return 1;
if (r < 0)
@@ -646,7 +656,7 @@ int CMS_decrypt_set1_pkey(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert)
}
if (r > 0)
return 1;
CMSerr(CMS_F_CMS_DECRYPT_SET1_PKEY, CMS_R_DECRYPT_ERROR);
CMSerr(CMS_F_CMS_DECRYPT_SET1_PKEY_AND_PEER, CMS_R_DECRYPT_ERROR);
return 0;
}
/*
@@ -654,17 +664,17 @@ int CMS_decrypt_set1_pkey(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert)
* successful decrypt. Always attempt to decrypt all recipients
* to avoid leaking timing of a successful decrypt.
*/
else if (r > 0 && debug)
else if (r > 0 && (debug || cms_pkey_ri_type != CMS_RECIPINFO_TRANS))
return 1;
}
}
/* If no cert, key transport and not debugging always return success */
if (cert == NULL && ri_type == CMS_RECIPINFO_TRANS && match_ri && !debug) {
if (cert == NULL && cms_pkey_ri_type == CMS_RECIPINFO_TRANS && match_ri && !debug) {
ERR_clear_error();
return 1;
}
CMSerr(CMS_F_CMS_DECRYPT_SET1_PKEY, CMS_R_NO_MATCHING_RECIPIENT);
CMSerr(CMS_F_CMS_DECRYPT_SET1_PKEY_AND_PEER, CMS_R_NO_MATCHING_RECIPIENT);
return 0;
}
crypto/dh/build.info
+2 -2
View File
@@ -1,9 +1,9 @@
LIBS=../../libcrypto
$COMMON=dh_lib.c dh_key.c dh_group_params.c
$COMMON=dh_lib.c dh_key.c dh_group_params.c dh_check.c
SOURCE[../../libcrypto]=$COMMON\
dh_asn1.c dh_gen.c dh_check.c dh_err.c dh_depr.c \
dh_asn1.c dh_gen.c dh_err.c dh_depr.c \
dh_ameth.c dh_pmeth.c dh_prn.c dh_rfc5114.c dh_kdf.c dh_meth.c
SOURCE[../../providers/libfips.a]=$COMMON
crypto/dh/dh_group_params.c
+69 -63
View File
@@ -22,6 +22,33 @@
#include <openssl/objects.h>
#include "crypto/bn_dh.h"
#include "crypto/dh.h"
#include "crypto/security_bits.h"
#define FFDHE(sz) { NID_ffdhe##sz, sz, &_bignum_ffdhe##sz##_p }
#define MODP(sz) { NID_modp_##sz, sz, &_bignum_modp_##sz##_p }
typedef struct safe_prime_group_st {
int nid;
int32_t nbits;
const BIGNUM *p;
} SP_GROUP;
static const SP_GROUP sp_groups[] = {
FFDHE(2048),
FFDHE(3072),
FFDHE(4096),
FFDHE(6144),
FFDHE(8192),
#ifndef FIPS_MODE
MODP(1536),
#endif
MODP(2048),
MODP(3072),
MODP(4096),
MODP(6144),
MODP(8192),
};
#ifndef FIPS_MODE
static DH *dh_new_by_nid_with_ctx(OPENSSL_CTX *libctx, int nid);
@@ -54,40 +81,24 @@ static DH *dh_param_init(OPENSSL_CTX *libctx, int nid, const BIGNUM *p,
static DH *dh_new_by_nid_with_ctx(OPENSSL_CTX *libctx, int nid)
{
int i;
for (i = 0; i < (int)OSSL_NELEM(sp_groups); ++i) {
if (sp_groups[i].nid == nid) {
int max_target_security_strength =
ifc_ffc_compute_security_bits(sp_groups[i].nbits);
/*
* The last parameter specified in these fields is
* The last parameter specified here is
* 2 * max_target_security_strength.
* See SP800-56Ar3 Table(s) 25 & 26.
*/
switch (nid) {
case NID_ffdhe2048:
return dh_param_init(libctx, nid, &_bignum_ffdhe2048_p, 225);
case NID_ffdhe3072:
return dh_param_init(libctx, nid, &_bignum_ffdhe3072_p, 275);
case NID_ffdhe4096:
return dh_param_init(libctx, nid, &_bignum_ffdhe4096_p, 325);
case NID_ffdhe6144:
return dh_param_init(libctx, nid, &_bignum_ffdhe6144_p, 375);
case NID_ffdhe8192:
return dh_param_init(libctx, nid, &_bignum_ffdhe8192_p, 400);
#ifndef FIPS_MODE
case NID_modp_1536:
return dh_param_init(libctx, nid, &_bignum_modp_1536_p, 190);
#endif
case NID_modp_2048:
return dh_param_init(libctx, nid, &_bignum_modp_2048_p, 225);
case NID_modp_3072:
return dh_param_init(libctx, nid, &_bignum_modp_3072_p, 275);
case NID_modp_4096:
return dh_param_init(libctx, nid, &_bignum_modp_4096_p, 325);
case NID_modp_6144:
return dh_param_init(libctx, nid, &_bignum_modp_6144_p, 375);
case NID_modp_8192:
return dh_param_init(libctx, nid, &_bignum_modp_8192_p, 400);
default:
return dh_param_init(libctx, nid, sp_groups[i].p,
2 * max_target_security_strength);
}
}
DHerr(0, DH_R_INVALID_PARAMETER_NID);
return NULL;
}
}
DH *DH_new_by_nid(int nid)
@@ -98,49 +109,44 @@ DH *DH_new_by_nid(int nid)
int DH_get_nid(DH *dh)
{
int nid = dh->params.nid;
BIGNUM *q = NULL;
int i, nid;
if (dh == NULL)
return NID_undef;
nid = dh->params.nid;
/* Just return if it is already cached */
if (nid != NID_undef)
return nid;
if (BN_get_word(dh->params.g) != 2)
return NID_undef;
if (!BN_cmp(dh->params.p, &_bignum_ffdhe2048_p))
nid = NID_ffdhe2048;
else if (!BN_cmp(dh->params.p, &_bignum_ffdhe3072_p))
nid = NID_ffdhe3072;
else if (!BN_cmp(dh->params.p, &_bignum_ffdhe4096_p))
nid = NID_ffdhe4096;
else if (!BN_cmp(dh->params.p, &_bignum_ffdhe6144_p))
nid = NID_ffdhe6144;
else if (!BN_cmp(dh->params.p, &_bignum_ffdhe8192_p))
nid = NID_ffdhe8192;
#ifndef FIPS_MODE
else if (!BN_cmp(dh->params.p, &_bignum_modp_1536_p))
nid = NID_modp_1536;
#endif
else if (!BN_cmp(dh->params.p, &_bignum_modp_2048_p))
nid = NID_modp_2048;
else if (!BN_cmp(dh->params.p, &_bignum_modp_3072_p))
nid = NID_modp_3072;
else if (!BN_cmp(dh->params.p, &_bignum_modp_4096_p))
nid = NID_modp_4096;
else if (!BN_cmp(dh->params.p, &_bignum_modp_6144_p))
nid = NID_modp_6144;
else if (!BN_cmp(dh->params.p, &_bignum_modp_8192_p))
nid = NID_modp_8192;
else
return NID_undef;
/* Verify q is correct if it exists - reset the nid if it is not correct */
for (i = 0; i < (int)OSSL_NELEM(sp_groups); ++i) {
/* If a matching p is found then we will break out of the loop */
if (!BN_cmp(dh->params.p, sp_groups[i].p)) {
/* Set q = (p - 1) / 2 (p is known to be odd so just shift right ) */
q = BN_dup(dh->params.p);
if (q == NULL || !BN_rshift1(q, q))
break; /* returns nid = NID_undef on failure */
/* Verify q is correct if it exists */
if (dh->params.q != NULL) {
BIGNUM *q = BN_dup(dh->params.p);
/* Check q = p * 2 + 1 we already know q is odd, so just shift right */
if (q == NULL || !BN_rshift1(q, q) || (BN_cmp(dh->params.q, q) != 0))
nid = NID_undef;
BN_free(q);
if (BN_cmp(dh->params.q, q) != 0)
break; /* returns nid = NID_undef if q does not match */
} else {
/* assign the calculated q */
dh->params.q = q;
q = NULL; /* set to NULL so it is not freed */
}
dh->params.nid = nid; /* cache the nid */
dh->params.nid = sp_groups[i].nid; /* cache the nid */
dh->length = 2 * ifc_ffc_compute_security_bits(sp_groups[i].nbits);
dh->dirty_cnt++;
break;
}
}
BN_free(q);
return nid;
}
crypto/dh/dh_key.c
+1 -2
View File
@@ -251,8 +251,7 @@ static int generate_key(DH *dh)
* (where s = max security strength supported).
* N = dh->length (N = maximum bit length of private key)
*/
if (dh->length == 0
|| dh->params.q == NULL
if (dh->params.q == NULL
|| dh->length > BN_num_bits(dh->params.q))
goto err;
if (!ffc_generate_private_key(ctx, &dh->params, dh->length,
crypto/dh/dh_lib.c
+8 -3
View File
@@ -211,11 +211,16 @@ int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g)
ffc_params_set0_pqg(&dh->params, p, q, g);
dh->params.nid = NID_undef;
DH_get_nid(dh); /* Check if this is a named group and cache it */
/*
* Check if this is a named group. If it finds a named group then the
* 'q' and 'length' value are either already set or are set by the
* call.
*/
if (DH_get_nid(dh) == NID_undef) {
/* If its not a named group then set the 'length' if q is not NULL */
if (q != NULL)
dh->length = BN_num_bits(q);
}
dh->dirty_cnt++;
return 1;
}
crypto/dsa/build.info
+3 -2
View File
@@ -1,9 +1,10 @@
LIBS=../../libcrypto
$COMMON=dsa_sign.c dsa_vrf.c dsa_lib.c dsa_ossl.c dsa_aid.c
$COMMON=dsa_sign.c dsa_vrf.c dsa_lib.c dsa_ossl.c dsa_aid.c dsa_check.c \
dsa_key.c
SOURCE[../../libcrypto]=$COMMON\
dsa_gen.c dsa_key.c dsa_asn1.c \
dsa_gen.c dsa_asn1.c \
dsa_err.c dsa_depr.c dsa_ameth.c dsa_pmeth.c dsa_prn.c \
dsa_meth.c
SOURCE[../../providers/libfips.a]=$COMMON
crypto/dsa/dsa_check.c
-1
View File
@@ -15,7 +15,6 @@
int dsa_check_params(const DSA *dsa, int *ret)
{
int nid;
/*
* (2b) FFC domain params conform to FIPS-186-4 explicit domain param
* validity tests.
crypto/ec/curve448/eddsa.c
+6 -1
View File
@@ -58,7 +58,12 @@ static c448_error_t hash_init_with_dom(OPENSSL_CTX *ctx, EVP_MD_CTX *hashctx,
const uint8_t *context,
size_t context_len)
{
const char *dom_s = "SigEd448";
#ifdef CHARSET_EBCDIC
const char dom_s[] = {0x53, 0x69, 0x67, 0x45,
0x64, 0x34, 0x34, 0x38, 0x00};
#else
const char dom_s[] = "SigEd448";
#endif
uint8_t dom[2];
EVP_MD *shake256 = NULL;
crypto/err/openssl.txt
+4
View File
@@ -243,6 +243,7 @@ CMS_F_CMS_ADD0_CERT:164:CMS_add0_cert
CMS_F_CMS_ADD0_RECIPIENT_KEY:100:CMS_add0_recipient_key
CMS_F_CMS_ADD0_RECIPIENT_PASSWORD:165:CMS_add0_recipient_password
CMS_F_CMS_ADD1_RECEIPTREQUEST:158:CMS_add1_ReceiptRequest
CMS_F_CMS_ADD1_RECIPIENT:184:
CMS_F_CMS_ADD1_RECIPIENT_CERT:101:CMS_add1_recipient_cert
CMS_F_CMS_ADD1_SIGNER:102:CMS_add1_signer
CMS_F_CMS_ADD1_SIGNINGTIME:103:cms_add1_signingTime
@@ -260,6 +261,7 @@ CMS_F_CMS_DECRYPT:112:CMS_decrypt
CMS_F_CMS_DECRYPT_SET1_KEY:113:CMS_decrypt_set1_key
CMS_F_CMS_DECRYPT_SET1_PASSWORD:166:CMS_decrypt_set1_password
CMS_F_CMS_DECRYPT_SET1_PKEY:114:CMS_decrypt_set1_pkey
CMS_F_CMS_DECRYPT_SET1_PKEY_AND_PEER:185:
CMS_F_CMS_DIGESTALGORITHM_FIND_CTX:115:cms_DigestAlgorithm_find_ctx
CMS_F_CMS_DIGESTALGORITHM_INIT_BIO:116:cms_DigestAlgorithm_init_bio
CMS_F_CMS_DIGESTEDDATA_DO_FINAL:117:cms_DigestedData_do_final
@@ -272,6 +274,8 @@ CMS_F_CMS_ENCRYPTEDDATA_DECRYPT:121:CMS_EncryptedData_decrypt
CMS_F_CMS_ENCRYPTEDDATA_ENCRYPT:122:CMS_EncryptedData_encrypt
CMS_F_CMS_ENCRYPTEDDATA_SET1_KEY:123:CMS_EncryptedData_set1_key
CMS_F_CMS_ENVELOPEDDATA_CREATE:124:CMS_EnvelopedData_create
CMS_F_CMS_ENVELOPEDDATA_ENCRYPTION_INIT_BIO:186:
CMS_F_CMS_ENVELOPEDDATA_FINAL:187:
CMS_F_CMS_ENVELOPEDDATA_INIT_BIO:125:cms_EnvelopedData_init_bio
CMS_F_CMS_ENVELOPED_DATA_INIT:126:cms_enveloped_data_init
CMS_F_CMS_ENV_ASN1_CTRL:171:cms_env_asn1_ctrl
crypto/err/openssl.txt.old
+4
View File
@@ -243,6 +243,7 @@ CMS_F_CMS_ADD0_CERT:164:CMS_add0_cert
CMS_F_CMS_ADD0_RECIPIENT_KEY:100:CMS_add0_recipient_key
CMS_F_CMS_ADD0_RECIPIENT_PASSWORD:165:CMS_add0_recipient_password
CMS_F_CMS_ADD1_RECEIPTREQUEST:158:CMS_add1_ReceiptRequest
CMS_F_CMS_ADD1_RECIPIENT:184:
CMS_F_CMS_ADD1_RECIPIENT_CERT:101:CMS_add1_recipient_cert
CMS_F_CMS_ADD1_SIGNER:102:CMS_add1_signer
CMS_F_CMS_ADD1_SIGNINGTIME:103:cms_add1_signingTime
@@ -260,6 +261,7 @@ CMS_F_CMS_DECRYPT:112:CMS_decrypt
CMS_F_CMS_DECRYPT_SET1_KEY:113:CMS_decrypt_set1_key
CMS_F_CMS_DECRYPT_SET1_PASSWORD:166:CMS_decrypt_set1_password
CMS_F_CMS_DECRYPT_SET1_PKEY:114:CMS_decrypt_set1_pkey
CMS_F_CMS_DECRYPT_SET1_PKEY_AND_PEER:185:
CMS_F_CMS_DIGESTALGORITHM_FIND_CTX:115:cms_DigestAlgorithm_find_ctx
CMS_F_CMS_DIGESTALGORITHM_INIT_BIO:116:cms_DigestAlgorithm_init_bio
CMS_F_CMS_DIGESTEDDATA_DO_FINAL:117:cms_DigestedData_do_final
@@ -272,6 +274,8 @@ CMS_F_CMS_ENCRYPTEDDATA_DECRYPT:121:CMS_EncryptedData_decrypt
CMS_F_CMS_ENCRYPTEDDATA_ENCRYPT:122:CMS_EncryptedData_encrypt
CMS_F_CMS_ENCRYPTEDDATA_SET1_KEY:123:CMS_EncryptedData_set1_key
CMS_F_CMS_ENVELOPEDDATA_CREATE:124:CMS_EnvelopedData_create
CMS_F_CMS_ENVELOPEDDATA_ENCRYPTION_INIT_BIO:186:
CMS_F_CMS_ENVELOPEDDATA_FINAL:187:
CMS_F_CMS_ENVELOPEDDATA_INIT_BIO:125:cms_EnvelopedData_init_bio
CMS_F_CMS_ENVELOPED_DATA_INIT:126:cms_enveloped_data_init
CMS_F_CMS_ENV_ASN1_CTRL:171:cms_env_asn1_ctrl
crypto/evp/pmeth_gn.c
+2 -2
View File
@@ -230,7 +230,7 @@ int EVP_PKEY_fromdata(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey, OSSL_PARAM params[])
if (ctx->operation == EVP_PKEY_OP_PARAMFROMDATA)
selection = OSSL_KEYMGMT_SELECT_ALL_PARAMETERS;
else
selection = OSSL_KEYMGMT_SELECT_KEYPAIR;
selection = OSSL_KEYMGMT_SELECT_ALL;
keydata = evp_keymgmt_util_fromdata(*ppkey, ctx->keymgmt, selection,
params);
@@ -261,6 +261,6 @@ const OSSL_PARAM *EVP_PKEY_key_fromdata_settable(EVP_PKEY_CTX *ctx)
/* We call fromdata_init to get ctx->keymgmt populated */
if (fromdata_init(ctx, EVP_PKEY_OP_UNDEFINED))
return evp_keymgmt_import_types(ctx->keymgmt,
OSSL_KEYMGMT_SELECT_KEYPAIR);
OSSL_KEYMGMT_SELECT_ALL);
return NULL;
}
crypto/evp/pmeth_lib.c
+8 -1
View File
@@ -774,6 +774,13 @@ int EVP_PKEY_CTX_set_signature_md(EVP_PKEY_CTX *ctx, const EVP_MD *md)
static int legacy_ctrl_to_param(EVP_PKEY_CTX *ctx, int keytype, int optype,
int cmd, int p1, void *p2)
{
/*
* GOST CMS format is different for different cipher algorithms.
* Most of other algorithms don't have such a difference
* so this ctrl is just ignored.
*/
if (cmd == EVP_PKEY_CTRL_CIPHER)
return -2;
# ifndef OPENSSL_NO_DH
if (keytype == EVP_PKEY_DH) {
switch (cmd) {
@@ -931,7 +938,7 @@ static int legacy_ctrl_str_to_param(EVP_PKEY_CTX *ctx, const char *name,
else if (strcmp(name, "ecdh_cofactor_mode") == 0)
name = OSSL_EXCHANGE_PARAM_EC_ECDH_COFACTOR_MODE;
else if (strcmp(name, "ecdh_kdf_md") == 0)
name = OSSL_EXCHANGE_PARAM_KDF_TYPE;
name = OSSL_EXCHANGE_PARAM_KDF_DIGEST;
# endif
{
crypto/ffc/ffc_key_generate.c
+9 -2
View File
@@ -36,13 +36,19 @@ int ffc_generate_private_key(BN_CTX *ctx, const FFC_PARAMS *params,
int ffc_generate_private_key_fips(BN_CTX *ctx, const FFC_PARAMS *params,
int N, int s, BIGNUM *priv)
{
int ret = 0;
int ret = 0, qbits = BN_num_bits(params->q);
BIGNUM *m, *two_powN = NULL;
/* Step (2) : check range of N */
if (N < 2 * s || N > BN_num_bits(params->q))
if (N < 2 * s || N > qbits)
return 0;
/* Deal with the edge case where the value of N is not set */
if (N == 0) {
N = qbits;
s = N / 2;
}
two_powN = BN_new();
/* 2^N */
if (two_powN == NULL || !BN_lshift(two_powN, BN_value_one(), N))
@@ -50,6 +56,7 @@ int ffc_generate_private_key_fips(BN_CTX *ctx, const FFC_PARAMS *params,
/* Step (5) : M = min(2 ^ N, q) */
m = (BN_cmp(two_powN, params->q) > 0) ? params->q : two_powN;
do {
/* Steps (3, 4 & 7) : c + 1 = 1 + random[0..2^N - 1] */
if (!BN_priv_rand_range_ex(priv, two_powN, ctx)
crypto/provider_core.c
+37 -1
View File
@@ -10,6 +10,7 @@
#include <openssl/core.h>
#include <openssl/core_numbers.h>
#include <openssl/core_names.h>
#include <openssl/provider.h>
#include <openssl/params.h>
#include <openssl/opensslv.h>
#include "crypto/cryptlib.h"
@@ -92,6 +93,7 @@ static int ossl_provider_cmp(const OSSL_PROVIDER * const *a,
struct provider_store_st {
STACK_OF(OSSL_PROVIDER) *providers;
CRYPTO_RWLOCK *lock;
char *default_path;
unsigned int use_fallbacks:1;
};
@@ -101,6 +103,7 @@ static void provider_store_free(void *vstore)
if (store == NULL)
return;
OPENSSL_free(store->default_path);
sk_OSSL_PROVIDER_pop_free(store->providers, ossl_provider_free);
CRYPTO_THREAD_lock_free(store->lock);
OPENSSL_free(store);
@@ -384,6 +387,29 @@ int ossl_provider_add_parameter(OSSL_PROVIDER *prov,
*/
static const OSSL_DISPATCH *core_dispatch; /* Define further down */
int OSSL_PROVIDER_set_default_search_path(OPENSSL_CTX *libctx, const char *path)
{
struct provider_store_st *store;
char *p = NULL;
if (path != NULL) {
p = OPENSSL_strdup(path);
if (p == NULL) {
CRYPTOerr(0, ERR_R_MALLOC_FAILURE);
return 0;
}
}
if ((store = get_provider_store(libctx)) != NULL
&& CRYPTO_THREAD_write_lock(store->lock)) {
OPENSSL_free(store->default_path);
store->default_path = p;
CRYPTO_THREAD_unlock(store->lock);
return 1;
}
OPENSSL_free(p);
return 0;
}
/*
* Internal version that doesn't affect the store flags, and thereby avoid
* locking. Direct callers must remember to set the store flags when
@@ -413,15 +439,24 @@ static int provider_activate(OSSL_PROVIDER *prov)
char *allocated_path = NULL;
const char *module_path = NULL;
char *merged_path = NULL;
const char *load_dir = ossl_safe_getenv("OPENSSL_MODULES");
const char *load_dir = NULL;
struct provider_store_st *store;
if ((prov->module = DSO_new()) == NULL) {
/* DSO_new() generates an error already */
return 0;
}
if ((store = get_provider_store(prov->libctx)) == NULL
|| !CRYPTO_THREAD_read_lock(store->lock))
return 0;
load_dir = store->default_path;
if (load_dir == NULL) {
load_dir = ossl_safe_getenv("OPENSSL_MODULES");
if (load_dir == NULL)
load_dir = MODULESDIR;
}
DSO_ctrl(prov->module, DSO_CTRL_SET_FLAGS,
DSO_FLAG_NAME_TRANSLATION_EXT_ONLY, NULL);
@@ -432,6 +467,7 @@ static int provider_activate(OSSL_PROVIDER *prov)
DSO_convert_filename(prov->module, prov->name);
if (module_path != NULL)
merged_path = DSO_merge(prov->module, module_path, load_dir);
CRYPTO_THREAD_unlock(store->lock);
if (merged_path == NULL
|| (DSO_load(prov->module, merged_path, NULL, 0)) == NULL) {
crypto/rsa/rsa_lib.c
+14 -2
View File
@@ -17,6 +17,7 @@
#include "crypto/bn.h"
#include "crypto/evp.h"
#include "crypto/rsa.h"
#include "crypto/security_bits.h"
#include "rsa_local.h"
static RSA *rsa_new_intern(ENGINE *engine, OPENSSL_CTX *libctx);
@@ -275,11 +276,20 @@ static uint32_t ilog_e(uint64_t v)
* NIST SP 800-56B rev 2 Appendix D: Maximum Security Strength Estimates for IFC
* Modulus Lengths.
*
* Note that this formula is also referred to in SP800-56A rev3 Appendix D:
* for FFC safe prime groups for modp and ffdhe.
* After Table 25 and Table 26 it refers to
* "The maximum security strength estimates were calculated using the formula in
* Section 7.5 of the FIPS 140 IG and rounded to the nearest multiple of eight
* bits".
*
* The formula is:
*
* E = \frac{1.923 \sqrt[3]{nBits \cdot log_e(2)}
* \cdot(log_e(nBits \cdot log_e(2))^{2/3} - 4.69}{log_e(2)}
* The two cube roots are merged together here.
*/
uint16_t rsa_compute_security_bits(int n)
uint16_t ifc_ffc_compute_security_bits(int n)
{
uint64_t x;
uint32_t lx;
@@ -316,6 +326,8 @@ uint16_t rsa_compute_security_bits(int n)
return (y + 4) & ~7;
}
int RSA_security_bits(const RSA *rsa)
{
int bits = BN_num_bits(rsa->n);
@@ -329,7 +341,7 @@ int RSA_security_bits(const RSA *rsa)
return 0;
}
#endif
return rsa_compute_security_bits(bits);
return ifc_ffc_compute_security_bits(bits);
}
int RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d)
crypto/rsa/rsa_local.h
-2
View File
@@ -137,8 +137,6 @@ RSA_PRIME_INFO *rsa_multip_info_new(void);
int rsa_multip_calc_product(RSA *rsa);
int rsa_multip_cap(int bits);
uint16_t rsa_compute_security_bits(int n);
int rsa_sp800_56b_validate_strength(int nbits, int strength);
int rsa_check_pminusq_diff(BIGNUM *diff, const BIGNUM *p, const BIGNUM *q,
int nbits);
crypto/rsa/rsa_sp800_56b_gen.c
+2 -1
View File
@@ -11,6 +11,7 @@
#include <openssl/err.h>
#include <openssl/bn.h>
#include "crypto/bn.h"
#include "crypto/security_bits.h"
#include "rsa_local.h"
#define RSA_FIPS1864_MIN_KEYGEN_KEYSIZE 2048
@@ -144,7 +145,7 @@ err:
*/
int rsa_sp800_56b_validate_strength(int nbits, int strength)
{
int s = (int)rsa_compute_security_bits(nbits);
int s = (int)ifc_ffc_compute_security_bits(nbits);
if (s < RSA_FIPS1864_MIN_KEYGEN_STRENGTH
|| s > RSA_FIPS1864_MAX_KEYGEN_STRENGTH) {
doc/internal/man3/s2i_ASN1_UTF8STRING.pod
+1
View File
@@ -14,6 +14,7 @@ s2i_ASN1_UTF8STRING,
ASN1_UTF8STRING *utf8);
ASN1_UTF8STRING *s2i_ASN1_UTF8STRING(X509V3_EXT_METHOD *method,
X509V3_CTX *ctx, const char *str);
=head1 DESCRIPTION
These functions convert OpenSSL objects to and from their ASN.1/string
doc/man1/CA.pl.pod
+8 -1
View File
@@ -174,11 +174,18 @@ Sign the request:
CA.pl -signreq
=head1 ENVIRONMENT
The environment variable B<OPENSSL_CONFIG> may be used to specify a
configuration option and value to the B<req> and B<ca> commands invoked by
this script. It's value should be the option and pathname, as in
C<-config /path/to/conf-file>.
=head1 NOTES
Most of the filenames mentioned can be modified by editing the B<CA.pl> script.
If the demoCA directory already exists then the B<-newca> command will not
If the F<demoCA> directory already exists then the B<-newca> command will not
overwrite it and will do nothing. This can happen if a previous call using
the B<-newca> option terminated abnormally. To get the correct behaviour
delete the demoCA directory if it already exists.
doc/man1/build.info
+66 -16
View File
@@ -1,113 +1,163 @@
# Keep this in sync with .gitignore!
DEPEND[]= \
openssl-asn1parse.pod \
openssl-ca.pod \
openssl-ciphers.pod \
openssl-cmds.pod \
openssl-cms.pod \
openssl-crl2pkcs7.pod \
openssl-crl.pod \
openssl-dgst.pod \
openssl-dhparam.pod \
openssl-dsa.pod \
openssl-dsaparam.pod \
openssl-ec.pod \
openssl-dsa.pod \
openssl-ecparam.pod \
openssl-ec.pod \
openssl-enc.pod \
openssl-engine.pod \
openssl-errstr.pod \
openssl-fipsinstall.pod \
openssl-gendsa.pod \
openssl-genpkey.pod \
openssl-genrsa.pod \
openssl-info.pod \
openssl-kdf.pod \
openssl-list.pod \
openssl-mac.pod \
openssl-nseq.pod \
openssl-ocsp.pod \
openssl-passwd.pod \
openssl-pkcs12.pod \
openssl-pkcs7.pod \
openssl-pkcs8.pod \
openssl-pkey.pod \
openssl-pkeyparam.pod \
openssl-pkey.pod \
openssl-pkeyutl.pod \
openssl-prime.pod \
openssl-provider.pod \
openssl-rand.pod \
openssl-rehash.pod \
openssl-req.pod \
openssl-rsa.pod \
openssl-rsautl.pod \
openssl-s_client.pod \
openssl-s_server.pod \
openssl-s_time.pod \
openssl-sess_id.pod \
openssl-smime.pod \
openssl-speed.pod \
openssl-spkac.pod \
openssl-srp.pod \
openssl-s_server.pod \
openssl-s_time.pod \
openssl-storeutl.pod \
openssl-ts.pod \
openssl-verify.pod \
openssl-version.pod \
openssl-x509.pod
DEPEND[openssl-asn1parse.pod]=../perlvars.pm
DEPEND[openssl-ca.pod]=../perlvars.pm
DEPEND[openssl-ciphers.pod]=../perlvars.pm
DEPEND[openssl-cmds.pod]=../perlvars.pm
DEPEND[openssl-cms.pod]=../perlvars.pm
DEPEND[openssl-crl2pkcs7.pod]=../perlvars.pm
DEPEND[openssl-crl.pod]=../perlvars.pm
DEPEND[openssl-dgst.pod]=../perlvars.pm
DEPEND[openssl-dhparam.pod]=../perlvars.pm
DEPEND[openssl-dsa.pod]=../perlvars.pm
DEPEND[openssl-dsaparam.pod]=../perlvars.pm
DEPEND[openssl-ec.pod]=../perlvars.pm
DEPEND[openssl-dsa.pod]=../perlvars.pm
DEPEND[openssl-ecparam.pod]=../perlvars.pm
DEPEND[openssl-ec.pod]=../perlvars.pm
DEPEND[openssl-enc.pod]=../perlvars.pm
DEPEND[openssl-engine.pod]=../perlvars.pm
DEPEND[openssl-errstr.pod]=../perlvars.pm
DEPEND[openssl-fipsinstall.pod]=../perlvars.pm
DEPEND[openssl-gendsa.pod]=../perlvars.pm
DEPEND[openssl-genpkey.pod]=../perlvars.pm
DEPEND[openssl-genrsa.pod]=../perlvars.pm
DEPEND[openssl-info.pod]=../perlvars.pm
DEPEND[openssl-kdf.pod]=../perlvars.pm
DEPEND[openssl-list.pod]=../perlvars.pm
DEPEND[openssl-mac.pod]=../perlvars.pm
DEPEND[openssl-nseq.pod]=../perlvars.pm
DEPEND[openssl-ocsp.pod]=../perlvars.pm
DEPEND[openssl-passwd.pod]=../perlvars.pm
DEPEND[openssl-pkcs12.pod]=../perlvars.pm
DEPEND[openssl-pkcs7.pod]=../perlvars.pm
DEPEND[openssl-pkcs8.pod]=../perlvars.pm
DEPEND[openssl-pkey.pod]=../perlvars.pm
DEPEND[openssl-pkeyparam.pod]=../perlvars.pm
DEPEND[openssl-pkey.pod]=../perlvars.pm
DEPEND[openssl-pkeyutl.pod]=../perlvars.pm
DEPEND[openssl-prime.pod]=../perlvars.pm
DEPEND[openssl-provider.pod]=../perlvars.pm
DEPEND[openssl-rand.pod]=../perlvars.pm
DEPEND[openssl-rehash.pod]=../perlvars.pm
DEPEND[openssl-req.pod]=../perlvars.pm
DEPEND[openssl-rsa.pod]=../perlvars.pm
DEPEND[openssl-rsautl.pod]=../perlvars.pm
DEPEND[openssl-s_client.pod]=../perlvars.pm
DEPEND[openssl-s_server.pod]=../perlvars.pm
DEPEND[openssl-s_time.pod]=../perlvars.pm
DEPEND[openssl-sess_id.pod]=../perlvars.pm
DEPEND[openssl-smime.pod]=../perlvars.pm
DEPEND[openssl-speed.pod]=../perlvars.pm
DEPEND[openssl-spkac.pod]=../perlvars.pm
DEPEND[openssl-srp.pod]=../perlvars.pm
DEPEND[openssl-s_server.pod]=../perlvars.pm
DEPEND[openssl-s_time.pod]=../perlvars.pm
DEPEND[openssl-storeutl.pod]=../perlvars.pm
DEPEND[openssl-ts.pod]=../perlvars.pm
DEPEND[openssl-verify.pod]=../perlvars.pm
DEPEND[openssl-version.pod]=../perlvars.pm
DEPEND[openssl-x509.pod]=../perlvars.pm
GENERATE[openssl-asn1parse.pod]=openssl-asn1parse.pod.in
GENERATE[openssl-ca.pod]=openssl-ca.pod.in
GENERATE[openssl-ciphers.pod]=openssl-ciphers.pod.in
GENERATE[openssl-cmds.pod]=openssl-cmds.pod.in
GENERATE[openssl-cms.pod]=openssl-cms.pod.in
GENERATE[openssl-crl2pkcs7.pod]=openssl-crl2pkcs7.pod.in
GENERATE[openssl-crl.pod]=openssl-crl.pod.in
GENERATE[openssl-dgst.pod]=openssl-dgst.pod.in
GENERATE[openssl-dhparam.pod]=openssl-dhparam.pod.in
GENERATE[openssl-dsa.pod]=openssl-dsa.pod.in
GENERATE[openssl-dsaparam.pod]=openssl-dsaparam.pod.in
GENERATE[openssl-ec.pod]=openssl-ec.pod.in
GENERATE[openssl-dsa.pod]=openssl-dsa.pod.in
GENERATE[openssl-ecparam.pod]=openssl-ecparam.pod.in
GENERATE[openssl-ec.pod]=openssl-ec.pod.in
GENERATE[openssl-enc.pod]=openssl-enc.pod.in
GENERATE[openssl-engine.pod]=openssl-engine.pod.in
GENERATE[openssl-errstr.pod]=openssl-errstr.pod.in
GENERATE[openssl-fipsinstall.pod]=openssl-fipsinstall.pod.in
GENERATE[openssl-gendsa.pod]=openssl-gendsa.pod.in
GENERATE[openssl-genpkey.pod]=openssl-genpkey.pod.in
GENERATE[openssl-genrsa.pod]=openssl-genrsa.pod.in
GENERATE[openssl-info.pod]=openssl-info.pod.in
GENERATE[openssl-kdf.pod]=openssl-kdf.pod.in
GENERATE[openssl-list.pod]=openssl-list.pod.in
GENERATE[openssl-mac.pod]=openssl-mac.pod.in
GENERATE[openssl-nseq.pod]=openssl-nseq.pod.in
GENERATE[openssl-ocsp.pod]=openssl-ocsp.pod.in
GENERATE[openssl-passwd.pod]=openssl-passwd.pod.in
GENERATE[openssl-pkcs12.pod]=openssl-pkcs12.pod.in
GENERATE[openssl-pkcs7.pod]=openssl-pkcs7.pod.in
GENERATE[openssl-pkcs8.pod]=openssl-pkcs8.pod.in
GENERATE[openssl-pkey.pod]=openssl-pkey.pod.in
GENERATE[openssl-pkeyparam.pod]=openssl-pkeyparam.pod.in
GENERATE[openssl-pkey.pod]=openssl-pkey.pod.in
GENERATE[openssl-pkeyutl.pod]=openssl-pkeyutl.pod.in
GENERATE[openssl-prime.pod]=openssl-prime.pod.in
GENERATE[openssl-provider.pod]=openssl-provider.pod.in
GENERATE[openssl-rand.pod]=openssl-rand.pod.in
GENERATE[openssl-rehash.pod]=openssl-rehash.pod.in
GENERATE[openssl-req.pod]=openssl-req.pod.in
GENERATE[openssl-rsa.pod]=openssl-rsa.pod.in
GENERATE[openssl-rsautl.pod]=openssl-rsautl.pod.in
GENERATE[openssl-s_client.pod]=openssl-s_client.pod.in
GENERATE[openssl-s_server.pod]=openssl-s_server.pod.in
GENERATE[openssl-s_time.pod]=openssl-s_time.pod.in
GENERATE[openssl-sess_id.pod]=openssl-sess_id.pod.in
GENERATE[openssl-smime.pod]=openssl-smime.pod.in
GENERATE[openssl-speed.pod]=openssl-speed.pod.in
GENERATE[openssl-spkac.pod]=openssl-spkac.pod.in
GENERATE[openssl-srp.pod]=openssl-srp.pod.in
GENERATE[openssl-s_server.pod]=openssl-s_server.pod.in
GENERATE[openssl-s_time.pod]=openssl-s_time.pod.in
GENERATE[openssl-storeutl.pod]=openssl-storeutl.pod.in
GENERATE[openssl-ts.pod]=openssl-ts.pod.in
GENERATE[openssl-verify.pod]=openssl-verify.pod.in
GENERATE[openssl-version.pod]=openssl-version.pod.in
GENERATE[openssl-x509.pod]=openssl-x509.pod.in
doc/man1/openssl-asn1parse.pod → doc/man1/openssl-asn1parse.pod.in
+1
View File
@@ -1,4 +1,5 @@
=pod
{- OpenSSL::safe::output_do_not_edit_headers(); -}
=head1 NAME
doc/man1/openssl-ca.pod.in
+7 -1
View File
@@ -12,6 +12,7 @@ B<openssl> B<ca>
[B<-verbose>]
[B<-config> I<filename>]
[B<-name> I<section>]
[B<-section> I<section>]
[B<-gencrl>]
[B<-revoke> I<file>]
[B<-valid> I<file>]
@@ -59,6 +60,7 @@ B<openssl> B<ca>
[B<-sm2-hex-id> I<hex-string>]
{- $OpenSSL::safe::opt_r_synopsis -}
{- $OpenSSL::safe::opt_engine_synopsis -}
{- $OpenSSL::safe::opt_provider_synopsis -}
[I<certreq>...]
=for openssl ifdef engine sm2-id sm2-hex-id
@@ -93,7 +95,7 @@ Specifies the configuration file to use.
Optional; for a description of the default value,
see L<openssl(1)/COMMAND SUMMARY>.
=item B<-name> I<section>
=item B<-name> I<section>, B<-section> I<section>
Specifies the configuration file section to use (overrides
B<default_ca> in the B<ca> section).
@@ -308,6 +310,8 @@ certificate. The argument for this option is string of hexadecimal digits.
{- $OpenSSL::safe::opt_engine_item -}
{- $OpenSSL::safe::opt_provider_item -}
=back
=head1 CRL OPTIONS
@@ -769,6 +773,8 @@ seeding mechanism. The new seeding mechanism makes it unnecessary to
define a RANDFILE for saving and restoring randomness. This option is
retained mainly for compatibility reasons.
The B<-section> option was added in OpenSSL 3.0.0.
=head1 SEE ALSO
L<openssl(1)>,
doc/man1/openssl-ciphers.pod → doc/man1/openssl-ciphers.pod.in
+4
View File
@@ -1,4 +1,5 @@
=pod
{- OpenSSL::safe::output_do_not_edit_headers(); -}
=head1 NAME
@@ -22,6 +23,7 @@ B<openssl> B<ciphers>
[B<-stdname>]
[B<-convert> I<name>]
[B<-ciphersuites> I<val>]
{- $OpenSSL::safe::opt_provider_synopsis -}
[I<cipherlist>]
=for openssl ifdef ssl3 tls1 tls1_1 tls1_2 tls1_3 psk srp
@@ -40,6 +42,8 @@ determine the appropriate cipherlist.
Print a usage message.
{- $OpenSSL::safe::opt_provider_item -}
=item B<-s>
Only list supported ciphers: those consistent with the security level, and
doc/man1/openssl-cmds.pod → doc/man1/openssl-cmds.pod.in
+1
View File
@@ -1,4 +1,5 @@
=pod
{- OpenSSL::safe::output_do_not_edit_headers(); -}
=head1 NAME
doc/man1/openssl-cms.pod.in
+16
View File
@@ -46,6 +46,7 @@ B<openssl> B<cms>
[B<-print>]
[B<-md> I<digest>]
[B<-I<cipher>>]
[B<-wrap> I<cipher>]
[B<-nointern>]
[B<-noverify>]
[B<-nocerts>]
@@ -58,6 +59,7 @@ B<openssl> B<cms>
[B<-certfile> I<file>]
[B<-certsout> I<file>]
[B<-signer> I<file>]
[B<-originator> I<file>]
[B<-recip> I<file>]
[B<-keyid>]
[B<-receipt_request_all>]
@@ -79,6 +81,7 @@ B<openssl> B<cms>
{- $OpenSSL::safe::opt_trust_synopsis -}
{- $OpenSSL::safe::opt_r_synopsis -}
{- $OpenSSL::safe::opt_engine_synopsis -}
{- $OpenSSL::safe::opt_provider_synopsis -}
[I<cert.pem> ...]
=for openssl ifdef des-wrap engine
@@ -300,6 +303,12 @@ supported by your version of OpenSSL.
If not specified triple DES is used. Only used with B<-encrypt> and
B<-EncryptedData_create> commands.
=item B<-wrap> I<cipher>
Cipher algorithm to use for key wrap when encrypting the message using Key
Agreement for key transport. The algorithm specified should be suitable for key
wrap.
=item B<-nointern>
When verifying a message normally certificates (if any) included in
@@ -374,6 +383,11 @@ used multiple times if more than one signer is required. If a message is being
verified then the signers certificates will be written to this file if the
verification was successful.
=item B<-originator> I<file>
A certificate of the originator of the encrypted message. Necessary for
decryption when Key Agreement is in use for a shared key.
=item B<-recip> I<file>
When decrypting a message this specifies the recipients certificate. The
@@ -477,6 +491,8 @@ Any verification errors cause the command to exit.
{- $OpenSSL::safe::opt_engine_item -}
{- $OpenSSL::safe::opt_provider_item -}
=item I<cert.pem> ...
One or more certificates of message recipients: used when encrypting
doc/man1/openssl-crl.pod.in
+3
View File
@@ -29,6 +29,7 @@ B<openssl> B<crl>
[B<-nextupdate>]
{- $OpenSSL::safe::opt_name_synopsis -}
{- $OpenSSL::safe::opt_trust_synopsis -}
{- $OpenSSL::safe::opt_provider_synopsis -}
=for openssl ifdef hash_old
@@ -123,6 +124,8 @@ Output the nextUpdate field.
{- $OpenSSL::safe::opt_trust_item -}
{- $OpenSSL::safe::opt_provider_item -}
=back
=head1 EXAMPLES
doc/man1/openssl-crl2pkcs7.pod → doc/man1/openssl-crl2pkcs7.pod.in
+4
View File
@@ -1,4 +1,5 @@
=pod
{- OpenSSL::safe::output_do_not_edit_headers(); -}
=head1 NAME
@@ -14,6 +15,7 @@ B<openssl> B<crl2pkcs7>
[B<-out> I<filename>]
[B<-certfile> I<filename>]
[B<-nocrl>]
{- $OpenSSL::safe::opt_provider_synopsis -}
=head1 DESCRIPTION
@@ -61,6 +63,8 @@ files.
Normally a CRL is included in the output file. With this option no CRL is
included in the output file and a CRL is not read from the input file.
{- $OpenSSL::safe::opt_provider_item -}
=back
=head1 EXAMPLES
doc/man1/openssl-dgst.pod.in
+3
View File
@@ -32,6 +32,7 @@ B<openssl> B<dgst>|I<digest>
{- $OpenSSL::safe::opt_engine_synopsis -}
[B<-engine_impl> I<id>]
{- $OpenSSL::safe::opt_r_synopsis -}
{- $OpenSSL::safe::opt_provider_synopsis -}
[I<file> ...]
=head1 DESCRIPTION
@@ -184,6 +185,8 @@ used or it is configured to do so, see L<config(5)/Engine Configuration Module>.
When used with the B<-engine> option, it specifies to also use
engine I<id> for digest operations.
{- $OpenSSL::safe::opt_provider_item -}
=item I<file> ...
File or files to digest. If no files are specified then standard input is
doc/man1/openssl-dhparam.pod.in
+3
View File
@@ -23,6 +23,7 @@ B<openssl dhparam>
[B<-5>]
{- $OpenSSL::safe::opt_engine_synopsis -}
{- $OpenSSL::safe::opt_r_synopsis -}
{- $OpenSSL::safe::opt_provider_synopsis -}
[I<numbits>]
=for openssl ifdef dsaparam engine
@@ -109,6 +110,8 @@ be loaded by calling the get_dhNNNN() function.
{- $OpenSSL::safe::opt_r_item -}
{- $OpenSSL::safe::opt_provider_item -}
=back
=head1 NOTES
doc/man1/openssl-dsa.pod.in
+3
View File
@@ -37,6 +37,7 @@ B<openssl> B<dsa>
[B<-pubin>]
[B<-pubout>]
{- $OpenSSL::safe::opt_engine_synopsis -}
{- $OpenSSL::safe::opt_provider_synopsis -}
=for openssl ifdef pvk-string pvk-weak pvk-none engine
@@ -123,6 +124,8 @@ a public key.
{- $OpenSSL::safe::opt_engine_item -}
{- $OpenSSL::safe::opt_provider_item -}
=back
=head1 EXAMPLES
doc/man1/openssl-dsaparam.pod.in
+3
View File
@@ -20,6 +20,7 @@ B<openssl dsaparam>
[B<-verbose>]
{- $OpenSSL::safe::opt_r_synopsis -}
{- $OpenSSL::safe::opt_engine_synopsis -}
{- $OpenSSL::safe::opt_provider_synopsis -}
[I<numbits>]
=head1 DESCRIPTION
@@ -93,6 +94,8 @@ This option specifies that a parameter set should be generated of size
I<numbits>. It must be the last option. If this option is included then
the input file (if any) is ignored.
{- $OpenSSL::safe::opt_provider_item -}
=back
=head1 SEE ALSO
doc/man1/openssl-ec.pod.in
+3
View File
@@ -32,6 +32,7 @@ B<openssl> B<ec>
[B<-no_public>]
[B<-check>]
{- $OpenSSL::safe::opt_engine_synopsis -}
{- $OpenSSL::safe::opt_provider_synopsis -}
=for openssl ifdef engine
@@ -141,6 +142,8 @@ This option checks the consistency of an EC private or public key.
{- $OpenSSL::safe::opt_engine_item -}
{- $OpenSSL::safe::opt_provider_item -}
=back
=head1 EXAMPLES
doc/man1/openssl-ecparam.pod.in
+3
View File
@@ -26,6 +26,7 @@ B<openssl ecparam>
[B<-genkey>]
{- $OpenSSL::safe::opt_engine_synopsis -}
{- $OpenSSL::safe::opt_r_synopsis -}
{- $OpenSSL::safe::opt_provider_synopsis -}
=for openssl ifdef engine
@@ -130,6 +131,8 @@ This option will generate an EC private key using the specified parameters.
{- $OpenSSL::safe::opt_r_item -}
{- $OpenSSL::safe::opt_provider_item -}
=back
=head1 EXAMPLES
doc/man1/openssl-enc.pod.in
+3
View File
@@ -40,6 +40,7 @@ B<openssl> B<enc>|I<cipher>
[B<-none>]
{- $OpenSSL::safe::opt_engine_synopsis -}
{- $OpenSSL::safe::opt_r_synopsis -}
{- $OpenSSL::safe::opt_provider_synopsis -}
=for openssl ifdef z engine ciphers
@@ -197,6 +198,8 @@ Use NULL cipher (no encryption or decryption of input).
{- $OpenSSL::safe::opt_r_item -}
{- $OpenSSL::safe::opt_provider_item -}
{- $OpenSSL::safe::opt_engine_item -}
=back
doc/man1/openssl-engine.pod → doc/man1/openssl-engine.pod.in
+1
View File
@@ -1,4 +1,5 @@
=pod
{- OpenSSL::safe::output_do_not_edit_headers(); -}
=head1 NAME
doc/man1/openssl-errstr.pod → doc/man1/openssl-errstr.pod.in
+1
View File
@@ -1,4 +1,5 @@
=pod
{- OpenSSL::safe::output_do_not_edit_headers(); -}
=head1 NAME
doc/man1/openssl-fipsinstall.pod → doc/man1/openssl-fipsinstall.pod.in
+6 -5
View File
@@ -1,4 +1,5 @@
=pod
{- OpenSSL::safe::output_do_not_edit_headers(); -}
=head1 NAME
@@ -128,21 +129,21 @@ values that can be used.
=head1 EXAMPLES
Calculate the mac of a FIPS module F<fips.so> and run a FIPS self test
for the module, and save the F<fips.conf> configuration file:
for the module, and save the F<fips.cnf> configuration file:
openssl fipsinstall -module ./fips.so -out fips.conf -provider_name fips \
openssl fipsinstall -module ./fips.so -out fips.cnf -provider_name fips \
-section_name fipsinstall -mac_name HMAC -macopt digest:SHA256 \
-macopt hexkey:000102030405060708090A0B0C0D0E0F10111213
Verify that the configuration file F<fips.conf> contains the correct info:
Verify that the configuration file F<fips.cnf> contains the correct info:
openssl fipsinstall -module ./fips.so -in fips.conf -provider_name fips \
openssl fipsinstall -module ./fips.so -in fips.cnf -provider_name fips \
-section_name fips_install -mac_name HMAC -macopt digest:SHA256 \
-macopt hexkey:000102030405060708090A0B0C0D0E0F10111213 -verify
Corrupt any self tests which have the description 'SHA1':
openssl fipsinstall -module ./fips.so -out fips.conf -provider_name fips \
openssl fipsinstall -module ./fips.so -out fips.cnf -provider_name fips \
-section_name fipsinstall -mac_name HMAC -macopt digest:SHA256 \
-macopt hexkey:000102030405060708090A0B0C0D0E0F10111213 \
-corrupt_desc', 'SHA1'
doc/man1/openssl-gendsa.pod.in
+3
View File
@@ -26,6 +26,7 @@ B<openssl> B<gendsa>
[B<-verbose>]
{- $OpenSSL::safe::opt_r_synopsis -}
{- $OpenSSL::safe::opt_engine_synopsis -}
{- $OpenSSL::safe::opt_provider_synopsis -}
[I<paramfile>]
=for openssl ifdef engine
@@ -76,6 +77,8 @@ The DSA parameter file to use. The parameters in this file determine
the size of the private key. DSA parameters can be generated and
examined using the L<openssl-dsaparam(1)> command.
{- $OpenSSL::safe::opt_provider_item -}
=back
=head1 NOTES
doc/man1/openssl-genpkey.pod.in
+3
View File
@@ -23,6 +23,7 @@ B<openssl> B<genpkey>
[B<-genparam>]
[B<-text>]
{- $OpenSSL::safe::opt_engine_synopsis -}
{- $OpenSSL::safe::opt_provider_synopsis -}
=for openssl ifdef engine
@@ -104,6 +105,8 @@ parameters along with the PEM or DER structure.
{- $OpenSSL::safe::opt_engine_item -}
{- $OpenSSL::safe::opt_provider_item -}
=back
=head1 KEY GENERATION OPTIONS
doc/man1/openssl-genrsa.pod.in
+3
View File
@@ -30,6 +30,7 @@ B<openssl> B<genrsa>
[B<-verbose>]
{- $OpenSSL::safe::opt_r_synopsis -}
{- $OpenSSL::safe::opt_engine_synopsis -}
{- $OpenSSL::safe::opt_provider_synopsis -}
[B<numbits>]
=for openssl ifdef engine
@@ -85,6 +86,8 @@ Print extra details about the operations being performed.
{- $OpenSSL::safe::opt_engine_item -}
{- $OpenSSL::safe::opt_provider_item -}
=item B<numbits>
The size of the private key to generate in bits. This must be the last option
doc/man1/openssl-info.pod → doc/man1/openssl-info.pod.in
+1
View File
@@ -1,4 +1,5 @@
=pod
{- OpenSSL::safe::output_do_not_edit_headers(); -}
=head1 NAME
doc/man1/openssl-kdf.pod → doc/man1/openssl-kdf.pod.in
+4
View File
@@ -1,4 +1,5 @@
=pod
{- OpenSSL::safe::output_do_not_edit_headers(); -}
=head1 NAME
@@ -12,6 +13,7 @@ B<openssl kdf>
[B<-keylen> I<num>]
[B<-out> I<filename>]
[B<-binary>]
{- $OpenSSL::safe::opt_provider_synopsis -}
I<kdf_name>
=head1 DESCRIPTION
@@ -79,6 +81,8 @@ To see the list of supported digests, use the command I<list -digest-commands>.
=back
{- $OpenSSL::safe::opt_provider_item -}
=item I<kdf_name>
Specifies the name of a supported KDF algorithm which will be used.
doc/man1/openssl-list.pod → doc/man1/openssl-list.pod.in
+4
View File
@@ -1,4 +1,5 @@
=pod
{- OpenSSL::safe::output_do_not_edit_headers(); -}
=head1 NAME
@@ -23,6 +24,7 @@ B<openssl list>
[B<-disabled>]
[B<-objects>]
[B<-options> I<command>]
{- $OpenSSL::safe::opt_provider_synopsis -}
=head1 DESCRIPTION
@@ -102,6 +104,8 @@ of what type of parameter it takes, if any.
This is an internal option, used for checking that the documentation
is complete.
{- $OpenSSL::safe::opt_provider_item -}
=back
=head2 Display of algorithm names
doc/man1/openssl-mac.pod → doc/man1/openssl-mac.pod.in
+4
View File
@@ -1,4 +1,5 @@
=pod
{- OpenSSL::safe::output_do_not_edit_headers(); -}
=head1 NAME
@@ -12,6 +13,7 @@ B<openssl mac>
[B<-in> I<filename>]
[B<-out> I<filename>]
[B<-binary>]
{- $OpenSSL::safe::opt_provider_synopsis -}
I<mac_name>
=head1 DESCRIPTION
@@ -99,6 +101,8 @@ The default is the empty string "".
=back
{- $OpenSSL::safe::opt_provider_item -}
=item I<mac_name>
Specifies the name of a supported MAC algorithm which will be used.

Some files were not shown because too many files have changed in this diff Show More