Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update

Browse Source
This commit is contained in:
Hakase
2018-11-11 15:42:06 +09:00
parent 89e3b2d5aa
commit d9b6665b74
41 changed files with 414 additions and 209 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crypto/bn/bn_lib.c
+23 -19
View File
@@ -767,26 +767,30 @@ void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)
b->neg ^= t;
/*-
* Idea behind BN_FLG_STATIC_DATA is actually to
* indicate that data may not be written to.
* Intention is actually to treat it as it's
* read-only data, and some (if not most) of it does
* reside in read-only segment. In other words
* observation of BN_FLG_STATIC_DATA in
* BN_consttime_swap should be treated as fatal
* condition. It would either cause SEGV or
* effectively cause data corruption.
* BN_FLG_MALLOCED refers to BN structure itself,
* and hence must be preserved. Remaining flags are
* BN_FLG_CONSTIME and BN_FLG_SECURE. Latter must be
* preserved, because it determines how x->d was
* allocated and hence how to free it. This leaves
* BN_FLG_CONSTTIME that one can do something about.
* To summarize it's sufficient to mask and swap
* BN_FLG_CONSTTIME alone. BN_FLG_STATIC_DATA should
* be treated as fatal.
* BN_FLG_STATIC_DATA: indicates that data may not be written to. Intention
* is actually to treat it as it's read-only data, and some (if not most)
* of it does reside in read-only segment. In other words observation of
* BN_FLG_STATIC_DATA in BN_consttime_swap should be treated as fatal
* condition. It would either cause SEGV or effectively cause data
* corruption.
*
* BN_FLG_MALLOCED: refers to BN structure itself, and hence must be
* preserved.
*
* BN_FLG_SECURE: must be preserved, because it determines how x->d was
* allocated and hence how to free it.
*
* BN_FLG_CONSTTIME: sufficient to mask and swap
*
* BN_FLG_FIXED_TOP: indicates that we haven't called bn_correct_top() on
* the data, so the d array may be padded with additional 0 values (i.e.
* top could be greater than the minimal value that it could be). We should
* be swapping it
*/
t = ((a->flags ^ b->flags) & BN_FLG_CONSTTIME) & condition;
#define BN_CONSTTIME_SWAP_FLAGS (BN_FLG_CONSTTIME | BN_FLG_FIXED_TOP)
t = ((a->flags ^ b->flags) & BN_CONSTTIME_SWAP_FLAGS) & condition;
a->flags ^= t;
b->flags ^= t;
crypto/ec/ec_ameth.c
+1 -1
View File
@@ -505,7 +505,7 @@ static int ec_pkey_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
case ASN1_PKEY_CTRL_DEFAULT_MD_NID:
*(int *)arg2 = NID_sha256;
return 2;
return 1;
case ASN1_PKEY_CTRL_SET1_TLS_ENCPT:
return EC_KEY_oct2key(EVP_PKEY_get0_EC_KEY(pkey), arg2, arg1, NULL);
crypto/evp/p_lib.c
+20
View File
@@ -667,6 +667,26 @@ int EVP_PKEY_get_default_digest_nid(EVP_PKEY *pkey, int *pnid)
return evp_pkey_asn1_ctrl(pkey, ASN1_PKEY_CTRL_DEFAULT_MD_NID, 0, pnid);
}
int EVP_PKEY_supports_digest_nid(EVP_PKEY *pkey, int nid)
{
int rv, default_nid;
rv = evp_pkey_asn1_ctrl(pkey, ASN1_PKEY_CTRL_SUPPORTS_MD_NID, nid, NULL);
if (rv == -2) {
/*
* If there is a mandatory default digest and this isn't it, then
* the answer is 'no'.
*/
rv = EVP_PKEY_get_default_digest_nid(pkey, &default_nid);
if (rv == 2)
return (nid == default_nid);
/* zero is an error from EVP_PKEY_get_default_digest_nid() */
if (rv == 0)
return -1;
}
return rv;
}
int EVP_PKEY_set1_tls_encodedpoint(EVP_PKEY *pkey,
const unsigned char *pt, size_t ptlen)
{
crypto/rand/drbg_lib.c
+8 -12
View File
@@ -557,11 +557,11 @@ int rand_drbg_restart(RAND_DRBG *drbg,
const unsigned char *adin = NULL;
size_t adinlen = 0;
if (drbg->pool != NULL) {
if (drbg->seed_pool != NULL) {
RANDerr(RAND_F_RAND_DRBG_RESTART, ERR_R_INTERNAL_ERROR);
drbg->state = DRBG_ERROR;
rand_pool_free(drbg->pool);
drbg->pool = NULL;
rand_pool_free(drbg->seed_pool);
drbg->seed_pool = NULL;
return 0;
}
@@ -581,8 +581,8 @@ int rand_drbg_restart(RAND_DRBG *drbg,
}
/* will be picked up by the rand_drbg_get_entropy() callback */
drbg->pool = rand_pool_attach(buffer, len, entropy);
if (drbg->pool == NULL)
drbg->seed_pool = rand_pool_attach(buffer, len, entropy);
if (drbg->seed_pool == NULL)
return 0;
} else {
if (drbg->max_adinlen < len) {
@@ -628,8 +628,8 @@ int rand_drbg_restart(RAND_DRBG *drbg,
}
}
rand_pool_free(drbg->pool);
drbg->pool = NULL;
rand_pool_free(drbg->seed_pool);
drbg->seed_pool = NULL;
return drbg->state == DRBG_READY;
}
@@ -1045,12 +1045,8 @@ static int drbg_bytes(unsigned char *out, int count)
* Calculates the minimum length of a full entropy buffer
* which is necessary to seed (i.e. instantiate) the DRBG
* successfully.
*
* NOTE: There is a copy of this function in drbgtest.c.
* If you change anything here, you need to update
* the copy accordingly.
*/
static size_t rand_drbg_seedlen(RAND_DRBG *drbg)
size_t rand_drbg_seedlen(RAND_DRBG *drbg)
{
/*
* If no os entropy source is available then RAND_seed(buffer, bufsize)
crypto/rand/rand_lcl.h
+2 -2
View File
@@ -203,7 +203,7 @@ struct rand_drbg_st {
* with respect to how randomness is added to the RNG during reseeding
* (see PR #4328).
*/
struct rand_pool_st *pool;
struct rand_pool_st *seed_pool;
/*
* Auxiliary pool for additional data.
@@ -309,7 +309,7 @@ extern int rand_fork_count;
/* DRBG helpers */
int rand_drbg_restart(RAND_DRBG *drbg,
const unsigned char *buffer, size_t len, size_t entropy);
size_t rand_drbg_seedlen(RAND_DRBG *drbg);
/* locking api */
int rand_drbg_lock(RAND_DRBG *drbg);
int rand_drbg_unlock(RAND_DRBG *drbg);
crypto/rand/rand_lib.c
+14 -9
View File
@@ -31,7 +31,7 @@ int rand_fork_count;
static CRYPTO_RWLOCK *rand_nonce_lock;
static int rand_nonce_count;
static int rand_cleaning_up = 0;
static int rand_inited = 0;
#ifdef OPENSSL_RAND_SEED_RDTSC
/*
@@ -146,8 +146,8 @@ size_t rand_drbg_get_entropy(RAND_DRBG *drbg,
return 0;
}
if (drbg->pool != NULL) {
pool = drbg->pool;
if (drbg->seed_pool != NULL) {
pool = drbg->seed_pool;
pool->entropy_requested = entropy;
} else {
pool = rand_pool_new(entropy, min_len, max_len);
@@ -204,7 +204,7 @@ size_t rand_drbg_get_entropy(RAND_DRBG *drbg,
}
err:
if (drbg->pool == NULL)
if (drbg->seed_pool == NULL)
rand_pool_free(pool);
return ret;
}
@@ -216,7 +216,7 @@ size_t rand_drbg_get_entropy(RAND_DRBG *drbg,
void rand_drbg_cleanup_entropy(RAND_DRBG *drbg,
unsigned char *out, size_t outlen)
{
if (drbg->pool == NULL)
if (drbg->seed_pool == NULL)
OPENSSL_secure_clear_free(out, outlen);
}
@@ -319,13 +319,15 @@ DEFINE_RUN_ONCE_STATIC(do_rand_init)
if (rand_nonce_lock == NULL)
goto err2;
if (!rand_cleaning_up && !rand_pool_init())
if (!rand_pool_init())
goto err3;
rand_inited = 1;
return 1;
err3:
rand_pool_cleanup();
CRYPTO_THREAD_lock_free(rand_nonce_lock);
rand_nonce_lock = NULL;
err2:
CRYPTO_THREAD_lock_free(rand_meth_lock);
rand_meth_lock = NULL;
@@ -341,7 +343,8 @@ void rand_cleanup_int(void)
{
const RAND_METHOD *meth = default_RAND_meth;
rand_cleaning_up = 1;
if (!rand_inited)
return;
if (meth != NULL && meth->cleanup != NULL)
meth->cleanup();
@@ -355,6 +358,7 @@ void rand_cleanup_int(void)
rand_meth_lock = NULL;
CRYPTO_THREAD_lock_free(rand_nonce_lock);
rand_nonce_lock = NULL;
rand_inited = 0;
}
/*
@@ -363,7 +367,8 @@ void rand_cleanup_int(void)
*/
void RAND_keep_random_devices_open(int keep)
{
rand_pool_keep_random_devices_open(keep);
if (RUN_ONCE(&rand_init, do_rand_init))
rand_pool_keep_random_devices_open(keep);
}
/*
crypto/rand/rand_unix.c
+3 -12
View File
@@ -386,21 +386,13 @@ static void close_random_device(size_t n)
rd->fd = -1;
}
static void open_random_devices(void)
{
size_t i;
for (i = 0; i < OSSL_NELEM(random_devices); i++)
(void)get_random_device(i);
}
int rand_pool_init(void)
{
size_t i;
for (i = 0; i < OSSL_NELEM(random_devices); i++)
random_devices[i].fd = -1;
open_random_devices();
return 1;
}
@@ -414,10 +406,9 @@ void rand_pool_cleanup(void)
void rand_pool_keep_random_devices_open(int keep)
{
if (keep)
open_random_devices();
else
if (!keep)
rand_pool_cleanup();
keep_random_devices_open = keep;
}