Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update

Browse Source
This commit is contained in:
Hakase
2018-11-11 15:42:06 +09:00
parent 89e3b2d5aa
commit d9b6665b74
41 changed files with 414 additions and 209 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGES
+4
View File
@@ -9,6 +9,10 @@
Changes between 1.1.1 and 1.1.2 [xx XXX xxxx]
*) Recreate the OS390-Unix config target. It no longer relies on a
special script like it did for OpenSSL pre-1.1.0.
[Richard Levitte]
*) Instead of having the source directories listed in Configure, add
a 'build.info' keyword SUBDIRS to indicate what sub-directories to
look into.
Configurations/50-os390.conf
+11
View File
@@ -0,0 +1,11 @@
## -*- mode: perl; -*-
(
# OS/390 Unix an EBCDIC-based Unix system on IBM mainframe
"OS390-Unix" => {
inherit_from => [ "BASE_unix" ],
cc => "cc",
cflags => "-O -DB_ENDIAN -DCHARSET_EBCDIC",
bn_ops => "THIRTY_TWO_BIT RC4_CHAR",
thread_scheme => "(unknown)",
}
);
Configurations/descrip.mms.tmpl
+29 -32
View File
@@ -198,9 +198,9 @@ ASOUTFLAG={- $target{asoutflag} -}$(OSSL_EMPTY)
CNF_ASFLAGS={- join('', $target{asflags} || (),
@{$config{asflags}}) -}
CNF_DEFINES={- our $defines2 = join('', map { ",$_" } @{$target{defines}},
@{$config{defines}},
"'extradefines'") -}
CNF_DEFINES={- our $defines2 = join('', (map { ",$_" } @{$target{defines}},
@{$config{defines}}),
"'extradefines'") -}
CNF_INCLUDES={- our $includes2 = join(',', @{$target{includes}},
@{$config{includes}}) -}
CNF_CPPFLAGS={- our $cppflags2 = join('', $target{cppflags} || (),
@@ -519,12 +519,10 @@ descrip.mms : FORCE
# Install helper targets #############################################
install_sw : all install_shared _install_dev_ns -
install_engines _install_runtime_ns -
install_sw : install_dev install_engines install_runtime -
install_startup install_ivp
uninstall_sw : uninstall_shared _uninstall_dev_ns -
uninstall_engines _uninstall_runtime_ns -
uninstall_sw : uninstall_dev uninstall_engines uninstall_runtime -
uninstall_startup uninstall_ivp
install_docs : install_html_docs
@@ -553,17 +551,7 @@ install_ssldirs : check_INSTALLTOP
COPY/PROT=W:R {- sourcefile("apps", "ct_log_list.cnf") -} -
ossl_dataroot:[000000]ct_log_list.cnf
install_shared : check_INSTALLTOP
@ {- output_off() if $disabled{shared}; "" -} !
@ WRITE SYS$OUTPUT "*** Installing shareable images"
@ ! Install shared (runtime) libraries
- CREATE/DIR ossl_installroot:[LIB.'arch']
{- join("\n ",
map { "COPY/PROT=W:R $_.EXE ossl_installroot:[LIB.'arch']" }
@install_shlibs) -}
@ {- output_on() if $disabled{shared}; "" -} !
_install_dev_ns : check_INSTALLTOP
install_dev : check_INSTALLTOP install_runtime_libs
@ WRITE SYS$OUTPUT "*** Installing development files"
@ ! Install header files
- CREATE/DIR ossl_installroot:[include.openssl]
@@ -574,20 +562,7 @@ _install_dev_ns : check_INSTALLTOP
map { "COPY/PROT=W:R $_.OLB ossl_installroot:[LIB.'arch']" }
@install_libs) -}
install_dev : install_shared _install_dev_ns
_install_runtime_ns : check_INSTALLTOP
@ ! Install the main program
- CREATE/DIR ossl_installroot:[EXE.'arch']
COPY/PROT=W:RE [.APPS]openssl.EXE -
ossl_installroot:[EXE.'arch']openssl{- $osslver -}.EXE
@ ! Install scripts
COPY/PROT=W:RE $(BIN_SCRIPTS) ossl_installroot:[EXE]
@ ! {- output_on() if $disabled{apps}; "" -}
install_runtime : install_shared _install_runtime_ns
install_engines : check_INSTALLTOP
install_engines : check_INSTALLTOP install_runtime_libs build_engines
@ {- output_off() unless scalar @{$unified_info{engines}}; "" -} !
@ WRITE SYS$OUTPUT "*** Installing engines"
- CREATE/DIR ossl_installroot:[ENGINES{- $sover_dirname.$target{pointer_size} -}.'arch']
@@ -596,6 +571,28 @@ install_engines : check_INSTALLTOP
@{$unified_info{install}->{engines}}) -}
@ {- output_on() unless scalar @{$unified_info{engines}}; "" -} !
install_runtime : install_programs
install_runtime_libs : check_INSTALLTOP build_libs
@ {- output_off() if $disabled{shared}; "" -} !
@ WRITE SYS$OUTPUT "*** Installing shareable images"
@ ! Install shared (runtime) libraries
- CREATE/DIR ossl_installroot:[LIB.'arch']
{- join("\n ",
map { "COPY/PROT=W:R $_.EXE ossl_installroot:[LIB.'arch']" }
@install_shlibs) -}
@ {- output_on() if $disabled{shared}; "" -} !
install_programs : check_INSTALLTOP install_runtime_libs build_programs
@ {- output_off() if $disabled{apps}; "" -} !
@ ! Install the main program
- CREATE/DIR ossl_installroot:[EXE.'arch']
COPY/PROT=W:RE [.APPS]openssl.EXE -
ossl_installroot:[EXE.'arch']openssl{- $osslver -}.EXE
@ ! Install scripts
COPY/PROT=W:RE $(BIN_SCRIPTS) ossl_installroot:[EXE]
@ ! {- output_on() if $disabled{apps}; "" -}
install_startup : [.VMS]openssl_startup.com [.VMS]openssl_shutdown.com -
[.VMS]openssl_utils.com, check_INSTALLTOP
- CREATE/DIR ossl_installroot:[SYS$STARTUP]
Configurations/unix-Makefile.tmpl
+21 -15
View File
@@ -441,7 +441,7 @@ depend:
# Install helper targets #############################################
install_sw: all install_dev install_engines install_runtime
install_sw: install_dev install_engines install_runtime
uninstall_sw: uninstall_runtime uninstall_engines uninstall_dev
@@ -495,7 +495,7 @@ install_ssldirs:
chmod 644 $(DESTDIR)$(OPENSSLDIR)/ct_log_list.cnf; \
fi
install_dev:
install_dev: install_runtime_libs
@[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1)
@$(ECHO) "*** Installing development files"
@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(INSTALLTOP)/include/openssl
@@ -528,11 +528,6 @@ install_dev:
fn1=`basename $$s1`; \
fn2=`basename $$s2`; \
: {- output_off(); output_on() unless windowsdll() or sharedaix(); "" -}; \
$(ECHO) "install $$s1 -> $(DESTDIR)$(libdir)/$$fn1"; \
cp $$s1 $(DESTDIR)$(libdir)/$$fn1.new; \
chmod 755 $(DESTDIR)$(libdir)/$$fn1.new; \
mv -f $(DESTDIR)$(libdir)/$$fn1.new \
$(DESTDIR)$(libdir)/$$fn1; \
if [ "$$fn1" != "$$fn2" ]; then \
$(ECHO) "link $(DESTDIR)$(libdir)/$$fn2 -> $(DESTDIR)$(libdir)/$$fn1"; \
ln -sf $$fn1 $(DESTDIR)$(libdir)/$$fn2; \
@@ -572,7 +567,7 @@ install_dev:
@cp openssl.pc $(DESTDIR)$(libdir)/pkgconfig
@chmod 644 $(DESTDIR)$(libdir)/pkgconfig/openssl.pc
uninstall_dev:
uninstall_dev: uninstall_runtime_libs
@$(ECHO) "*** Uninstalling development files"
@ : {- output_off() unless grep { $_ eq "OPENSSL_USE_APPLINK" } (@{$target{defines}}, @{$config{defines}}); "" -}
@$(ECHO) "$(RM) $(DESTDIR)$(INSTALLTOP)/include/openssl/applink.c"
@@ -616,7 +611,7 @@ uninstall_dev:
-$(RMDIR) $(DESTDIR)$(libdir)/pkgconfig
-$(RMDIR) $(DESTDIR)$(libdir)
install_engines:
install_engines: install_runtime_libs build_engines
@[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1)
@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(ENGINESDIR)/
@$(ECHO) "*** Installing engines"
@@ -643,13 +638,14 @@ uninstall_engines:
done
-$(RMDIR) $(DESTDIR)$(ENGINESDIR)
install_runtime:
install_runtime: install_programs
install_runtime_libs: build_libs
@[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1)
@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(INSTALLTOP)/bin
@ : {- output_off() if windowsdll(); "" -}
@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(libdir)
@ : {- output_on() if windowsdll(); "" -}
@$(ECHO) "*** Installing runtime files"
@$(ECHO) "*** Installing runtime libraries"
@set -e; for s in dummy $(INSTALL_SHLIBS); do \
if [ "$$s" = "dummy" ]; then continue; fi; \
fn=`basename $$s`; \
@@ -667,6 +663,11 @@ install_runtime:
$(DESTDIR)$(libdir)/$$fn; \
: {- output_on() if windowsdll(); "" -}; \
done
install_programs: install_runtime_libs build_programs
@[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1)
@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(INSTALLTOP)/bin
@$(ECHO) "*** Installing runtime programs"
@set -e; for x in dummy $(INSTALL_PROGRAMS); do \
if [ "$$x" = "dummy" ]; then continue; fi; \
fn=`basename $$x`; \
@@ -686,8 +687,10 @@ install_runtime:
$(DESTDIR)$(INSTALLTOP)/bin/$$fn; \
done
uninstall_runtime:
@$(ECHO) "*** Uninstalling runtime files"
uninstall_runtime: uninstall_programs uninstall_runtime_libs
uninstall_programs:
@$(ECHO) "*** Uninstalling runtime programs"
@set -e; for x in dummy $(INSTALL_PROGRAMS); \
do \
if [ "$$x" = "dummy" ]; then continue; fi; \
@@ -702,6 +705,10 @@ uninstall_runtime:
$(ECHO) "$(RM) $(DESTDIR)$(INSTALLTOP)/bin/$$fn"; \
$(RM) $(DESTDIR)$(INSTALLTOP)/bin/$$fn; \
done
-$(RMDIR) $(DESTDIR)$(INSTALLTOP)/bin
uninstall_runtime_libs:
@$(ECHO) "*** Uninstalling runtime libraries"
@ : {- output_off() unless windowsdll(); "" -}
@set -e; for s in dummy $(INSTALL_SHLIBS); do \
if [ "$$s" = "dummy" ]; then continue; fi; \
@@ -710,7 +717,6 @@ uninstall_runtime:
$(RM) $(DESTDIR)$(INSTALLTOP)/bin/$$fn; \
done
@ : {- output_on() unless windowsdll(); "" -}
-$(RMDIR) $(DESTDIR)$(INSTALLTOP)/bin
install_man_docs:
Configurations/windows-makefile.tmpl
+12 -5
View File
@@ -387,7 +387,7 @@ depend:
# Install helper targets #############################################
install_sw: all install_dev install_engines install_runtime
install_sw: install_dev install_engines install_runtime
uninstall_sw: uninstall_runtime uninstall_engines uninstall_dev
@@ -412,7 +412,7 @@ install_ssldirs:
"$(PERL)" "$(SRCDIR)\util\copy.pl" "$(SRCDIR)\apps\ct_log_list.cnf" \
"$(OPENSSLDIR)\ct_log_list.cnf"
install_dev:
install_dev: install_runtime_libs
@if "$(INSTALLTOP)"=="" ( $(ECHO) "INSTALLTOP should not be empty" & exit 1 )
@$(ECHO) "*** Installing development files"
@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(INSTALLTOP)\include\openssl"
@@ -432,7 +432,7 @@ install_dev:
uninstall_dev:
install_engines:
install_engines: install_runtime_libs build_engines
@if "$(INSTALLTOP)"=="" ( $(ECHO) "INSTALLTOP should not be empty" & exit 1 )
@$(ECHO) "*** Installing engines"
@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(ENGINESDIR)"
@@ -443,15 +443,22 @@ install_engines:
uninstall_engines:
install_runtime:
install_runtime: install_programs
install_runtime_libs: build_libs
@if "$(INSTALLTOP)"=="" ( $(ECHO) "INSTALLTOP should not be empty" & exit 1 )
@$(ECHO) "*** Installing runtime files"
@$(ECHO) "*** Installing runtime libraries"
@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(INSTALLTOP)\bin"
@if not "$(SHLIBS)"=="" \
"$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_SHLIBS) "$(INSTALLTOP)\bin"
@if not "$(SHLIBS)"=="" \
"$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_SHLIBPDBS) \
"$(INSTALLTOP)\bin"
install_programs: install_runtime_libs build_programs
@if "$(INSTALLTOP)"=="" ( $(ECHO) "INSTALLTOP should not be empty" & exit 1 )
@$(ECHO) "*** Installing runtime programs"
@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(INSTALLTOP)\bin"
@"$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_PROGRAMS) \
"$(INSTALLTOP)\bin"
@"$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_PROGRAMPDBS) \
apps/rsa.c
+3
View File
@@ -269,6 +269,9 @@ int rsa_main(int argc, char **argv)
} else if (outformat == FORMAT_MSBLOB || outformat == FORMAT_PVK) {
EVP_PKEY *pk;
pk = EVP_PKEY_new();
if (pk == NULL)
goto end;
EVP_PKEY_set1_RSA(pk, rsa);
if (outformat == FORMAT_PVK) {
if (pubin) {
crypto/bn/bn_lib.c
+23 -19
View File
@@ -767,26 +767,30 @@ void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)
b->neg ^= t;
/*-
* Idea behind BN_FLG_STATIC_DATA is actually to
* indicate that data may not be written to.
* Intention is actually to treat it as it's
* read-only data, and some (if not most) of it does
* reside in read-only segment. In other words
* observation of BN_FLG_STATIC_DATA in
* BN_consttime_swap should be treated as fatal
* condition. It would either cause SEGV or
* effectively cause data corruption.
* BN_FLG_MALLOCED refers to BN structure itself,
* and hence must be preserved. Remaining flags are
* BN_FLG_CONSTIME and BN_FLG_SECURE. Latter must be
* preserved, because it determines how x->d was
* allocated and hence how to free it. This leaves
* BN_FLG_CONSTTIME that one can do something about.
* To summarize it's sufficient to mask and swap
* BN_FLG_CONSTTIME alone. BN_FLG_STATIC_DATA should
* be treated as fatal.
* BN_FLG_STATIC_DATA: indicates that data may not be written to. Intention
* is actually to treat it as it's read-only data, and some (if not most)
* of it does reside in read-only segment. In other words observation of
* BN_FLG_STATIC_DATA in BN_consttime_swap should be treated as fatal
* condition. It would either cause SEGV or effectively cause data
* corruption.
*
* BN_FLG_MALLOCED: refers to BN structure itself, and hence must be
* preserved.
*
* BN_FLG_SECURE: must be preserved, because it determines how x->d was
* allocated and hence how to free it.
*
* BN_FLG_CONSTTIME: sufficient to mask and swap
*
* BN_FLG_FIXED_TOP: indicates that we haven't called bn_correct_top() on
* the data, so the d array may be padded with additional 0 values (i.e.
* top could be greater than the minimal value that it could be). We should
* be swapping it
*/
t = ((a->flags ^ b->flags) & BN_FLG_CONSTTIME) & condition;
#define BN_CONSTTIME_SWAP_FLAGS (BN_FLG_CONSTTIME | BN_FLG_FIXED_TOP)
t = ((a->flags ^ b->flags) & BN_CONSTTIME_SWAP_FLAGS) & condition;
a->flags ^= t;
b->flags ^= t;
crypto/ec/ec_ameth.c
+1 -1
View File
@@ -505,7 +505,7 @@ static int ec_pkey_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
case ASN1_PKEY_CTRL_DEFAULT_MD_NID:
*(int *)arg2 = NID_sha256;
return 2;
return 1;
case ASN1_PKEY_CTRL_SET1_TLS_ENCPT:
return EC_KEY_oct2key(EVP_PKEY_get0_EC_KEY(pkey), arg2, arg1, NULL);
crypto/evp/p_lib.c
+20
View File
@@ -667,6 +667,26 @@ int EVP_PKEY_get_default_digest_nid(EVP_PKEY *pkey, int *pnid)
return evp_pkey_asn1_ctrl(pkey, ASN1_PKEY_CTRL_DEFAULT_MD_NID, 0, pnid);
}
int EVP_PKEY_supports_digest_nid(EVP_PKEY *pkey, int nid)
{
int rv, default_nid;
rv = evp_pkey_asn1_ctrl(pkey, ASN1_PKEY_CTRL_SUPPORTS_MD_NID, nid, NULL);
if (rv == -2) {
/*
* If there is a mandatory default digest and this isn't it, then
* the answer is 'no'.
*/
rv = EVP_PKEY_get_default_digest_nid(pkey, &default_nid);
if (rv == 2)
return (nid == default_nid);
/* zero is an error from EVP_PKEY_get_default_digest_nid() */
if (rv == 0)
return -1;
}
return rv;
}
int EVP_PKEY_set1_tls_encodedpoint(EVP_PKEY *pkey,
const unsigned char *pt, size_t ptlen)
{
crypto/rand/drbg_lib.c
+8 -12
View File
@@ -557,11 +557,11 @@ int rand_drbg_restart(RAND_DRBG *drbg,
const unsigned char *adin = NULL;
size_t adinlen = 0;
if (drbg->pool != NULL) {
if (drbg->seed_pool != NULL) {
RANDerr(RAND_F_RAND_DRBG_RESTART, ERR_R_INTERNAL_ERROR);
drbg->state = DRBG_ERROR;
rand_pool_free(drbg->pool);
drbg->pool = NULL;
rand_pool_free(drbg->seed_pool);
drbg->seed_pool = NULL;
return 0;
}
@@ -581,8 +581,8 @@ int rand_drbg_restart(RAND_DRBG *drbg,
}
/* will be picked up by the rand_drbg_get_entropy() callback */
drbg->pool = rand_pool_attach(buffer, len, entropy);
if (drbg->pool == NULL)
drbg->seed_pool = rand_pool_attach(buffer, len, entropy);
if (drbg->seed_pool == NULL)
return 0;
} else {
if (drbg->max_adinlen < len) {
@@ -628,8 +628,8 @@ int rand_drbg_restart(RAND_DRBG *drbg,
}
}
rand_pool_free(drbg->pool);
drbg->pool = NULL;
rand_pool_free(drbg->seed_pool);
drbg->seed_pool = NULL;
return drbg->state == DRBG_READY;
}
@@ -1045,12 +1045,8 @@ static int drbg_bytes(unsigned char *out, int count)
* Calculates the minimum length of a full entropy buffer
* which is necessary to seed (i.e. instantiate) the DRBG
* successfully.
*
* NOTE: There is a copy of this function in drbgtest.c.
* If you change anything here, you need to update
* the copy accordingly.
*/
static size_t rand_drbg_seedlen(RAND_DRBG *drbg)
size_t rand_drbg_seedlen(RAND_DRBG *drbg)
{
/*
* If no os entropy source is available then RAND_seed(buffer, bufsize)
crypto/rand/rand_lcl.h
+2 -2
View File
@@ -203,7 +203,7 @@ struct rand_drbg_st {
* with respect to how randomness is added to the RNG during reseeding
* (see PR #4328).
*/
struct rand_pool_st *pool;
struct rand_pool_st *seed_pool;
/*
* Auxiliary pool for additional data.
@@ -309,7 +309,7 @@ extern int rand_fork_count;
/* DRBG helpers */
int rand_drbg_restart(RAND_DRBG *drbg,
const unsigned char *buffer, size_t len, size_t entropy);
size_t rand_drbg_seedlen(RAND_DRBG *drbg);
/* locking api */
int rand_drbg_lock(RAND_DRBG *drbg);
int rand_drbg_unlock(RAND_DRBG *drbg);
crypto/rand/rand_lib.c
+14 -9
View File
@@ -31,7 +31,7 @@ int rand_fork_count;
static CRYPTO_RWLOCK *rand_nonce_lock;
static int rand_nonce_count;
static int rand_cleaning_up = 0;
static int rand_inited = 0;
#ifdef OPENSSL_RAND_SEED_RDTSC
/*
@@ -146,8 +146,8 @@ size_t rand_drbg_get_entropy(RAND_DRBG *drbg,
return 0;
}
if (drbg->pool != NULL) {
pool = drbg->pool;
if (drbg->seed_pool != NULL) {
pool = drbg->seed_pool;
pool->entropy_requested = entropy;
} else {
pool = rand_pool_new(entropy, min_len, max_len);
@@ -204,7 +204,7 @@ size_t rand_drbg_get_entropy(RAND_DRBG *drbg,
}
err:
if (drbg->pool == NULL)
if (drbg->seed_pool == NULL)
rand_pool_free(pool);
return ret;
}
@@ -216,7 +216,7 @@ size_t rand_drbg_get_entropy(RAND_DRBG *drbg,
void rand_drbg_cleanup_entropy(RAND_DRBG *drbg,
unsigned char *out, size_t outlen)
{
if (drbg->pool == NULL)
if (drbg->seed_pool == NULL)
OPENSSL_secure_clear_free(out, outlen);
}
@@ -319,13 +319,15 @@ DEFINE_RUN_ONCE_STATIC(do_rand_init)
if (rand_nonce_lock == NULL)
goto err2;
if (!rand_cleaning_up && !rand_pool_init())
if (!rand_pool_init())
goto err3;
rand_inited = 1;
return 1;
err3:
rand_pool_cleanup();
CRYPTO_THREAD_lock_free(rand_nonce_lock);
rand_nonce_lock = NULL;
err2:
CRYPTO_THREAD_lock_free(rand_meth_lock);
rand_meth_lock = NULL;
@@ -341,7 +343,8 @@ void rand_cleanup_int(void)
{
const RAND_METHOD *meth = default_RAND_meth;
rand_cleaning_up = 1;
if (!rand_inited)
return;
if (meth != NULL && meth->cleanup != NULL)
meth->cleanup();
@@ -355,6 +358,7 @@ void rand_cleanup_int(void)
rand_meth_lock = NULL;
CRYPTO_THREAD_lock_free(rand_nonce_lock);
rand_nonce_lock = NULL;
rand_inited = 0;
}
/*
@@ -363,7 +367,8 @@ void rand_cleanup_int(void)
*/
void RAND_keep_random_devices_open(int keep)
{
rand_pool_keep_random_devices_open(keep);
if (RUN_ONCE(&rand_init, do_rand_init))
rand_pool_keep_random_devices_open(keep);
}
/*
crypto/rand/rand_unix.c
+3 -12
View File
@@ -386,21 +386,13 @@ static void close_random_device(size_t n)
rd->fd = -1;
}
static void open_random_devices(void)
{
size_t i;
for (i = 0; i < OSSL_NELEM(random_devices); i++)
(void)get_random_device(i);
}
int rand_pool_init(void)
{
size_t i;
for (i = 0; i < OSSL_NELEM(random_devices); i++)
random_devices[i].fd = -1;
open_random_devices();
return 1;
}
@@ -414,10 +406,9 @@ void rand_pool_cleanup(void)
void rand_pool_keep_random_devices_open(int keep)
{
if (keep)
open_random_devices();
else
if (!keep)
rand_pool_cleanup();
keep_random_devices_open = keep;
}
doc/man3/EVP_PKEY_ASN1_METHOD.pod
+1
View File
@@ -257,6 +257,7 @@ L<EVP_PKEY_set_type_str(3)>, and L<EVP_PKEY_assign(3)>.
The pkey_ctrl() method adds extra algorithm specific control.
It's called by L<EVP_PKEY_get_default_digest_nid(3)>,
L<EVP_PKEY_supports_digest_nid(3)>,
L<EVP_PKEY_set1_tls_encodedpoint(3)>,
L<EVP_PKEY_get1_tls_encodedpoint(3)>, L<PKCS7_SIGNER_INFO_set(3)>,
L<PKCS7_RECIP_INFO_set(3)>, ...
doc/man3/EVP_PKEY_get_default_digest_nid.pod
+2 -1
View File
@@ -18,7 +18,7 @@ a digest during signing. In this case B<pnid> will be set to NID_undef.
=head1 NOTES
For all current standard OpenSSL public key algorithms SHA1 is returned.
For all current standard OpenSSL public key algorithms SHA256 is returned.
=head1 RETURN VALUES
@@ -32,6 +32,7 @@ public key algorithm.
L<EVP_PKEY_CTX_new(3)>,
L<EVP_PKEY_sign(3)>,
L<EVP_PKEY_supports_digest_nid(3)>,
L<EVP_PKEY_verify(3)>,
L<EVP_PKEY_verify_recover(3)>,
doc/man3/EVP_PKEY_supports_digest_nid.pod
+53
View File
@@ -0,0 +1,53 @@
=pod
=head1 NAME
EVP_PKEY_supports_digest_nid - indicate support for signature digest
=head1 SYNOPSIS
#include <openssl/evp.h>
int EVP_PKEY_supports_digest_nid(EVP_PKEY *pkey, int nid);
=head1 DESCRIPTION
The EVP_PKEY_supports_digest_nid() function queries whether the message digest
NID B<nid> is supported for public key signature operations associated with key
B<pkey>.
=head1 NOTES
If the EVP_PKEY implementation does not explicitly support this method, but
L<EVP_PKEY_get_default_digest_nid(3)> returns a mandatory digest result, then
only that mandatory digest will be supported.
=head1 RETURN VALUES
The EVP_PKEY_supports_digest_nid() function returns 1 if the message digest
algorithm identified by B<nid> can be used for public key signature operations
associated with key B<pkey> and 0 if it cannot be used. It returns a negative
value for failure. In particular a return value of -2 indicates the query
operation is not supported by the public key algorithm.
=head1 SEE ALSO
L<EVP_PKEY_CTX_new(3)>,
L<EVP_PKEY_get_default_digest_nid(3)>,
L<EVP_PKEY_sign(3)>,
L<EVP_PKEY_verify(3)>,
L<EVP_PKEY_verify_recover(3)>,
=head1 HISTORY
This function was first added to OpenSSL 1.1.2.
=head1 COPYRIGHT
Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man3/SSL_CTX_set1_curves.pod
+3
View File
@@ -32,6 +32,9 @@ SSL_set1_curves_list, SSL_get1_curves, SSL_get_shared_curve
=head1 DESCRIPTION
For all of the functions below that set the supported groups there must be at
least one group in the list.
SSL_CTX_set1_groups() sets the supported groups for B<ctx> to B<glistlen>
groups in the array B<glist>. The array consist of all NIDs of groups in
preference order. For a TLS client the groups are used directly in the
include/openssl/evp.h
+2
View File
@@ -1112,6 +1112,7 @@ int EVP_PKEY_print_params(BIO *out, const EVP_PKEY *pkey,
int indent, ASN1_PCTX *pctx);
int EVP_PKEY_get_default_digest_nid(EVP_PKEY *pkey, int *pnid);
int EVP_PKEY_supports_digest_nid(EVP_PKEY *pkey, int nid);
int EVP_PKEY_set1_tls_encodedpoint(EVP_PKEY *pkey,
const unsigned char *pt, size_t ptlen);
@@ -1188,6 +1189,7 @@ int EVP_PBE_get(int *ptype, int *ppbe_nid, size_t num);
# define ASN1_PKEY_CTRL_SET1_TLS_ENCPT 0x9
# define ASN1_PKEY_CTRL_GET1_TLS_ENCPT 0xa
# define ASN1_PKEY_CTRL_SUPPORTS_MD_NID 0xb
int EVP_PKEY_asn1_get_count(void);
const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_get0(int idx);
ssl/ssl_cert.c
+2 -2
View File
@@ -951,8 +951,8 @@ static int ssl_security_default_callback(const SSL *s, const SSL_CTX *ctx,
if (level >= 2 && c->algorithm_enc == SSL_RC4)
return 0;
/* Level 3: forward secure ciphersuites only */
if (level >= 3 && (c->min_tls != TLS1_3_VERSION ||
!(c->algorithm_mkey & (SSL_kEDH | SSL_kEECDH))))
if (level >= 3 && c->min_tls != TLS1_3_VERSION &&
!(c->algorithm_mkey & (SSL_kEDH | SSL_kEECDH)))
return 0;
break;
}
ssl/statem/extensions_clnt.c
+8 -5
View File
@@ -115,7 +115,7 @@ EXT_RETURN tls_construct_ctos_srp(SSL *s, WPACKET *pkt, unsigned int context,
#ifndef OPENSSL_NO_EC
static int use_ecc(SSL *s)
{
int i, end;
int i, end, ret = 0;
unsigned long alg_k, alg_a;
STACK_OF(SSL_CIPHER) *cipher_stack = NULL;
@@ -123,7 +123,7 @@ static int use_ecc(SSL *s)
if (s->version == SSL3_VERSION)
return 0;
cipher_stack = SSL_get_ciphers(s);
cipher_stack = SSL_get1_supported_ciphers(s);
end = sk_SSL_CIPHER_num(cipher_stack);
for (i = 0; i < end; i++) {
const SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
@@ -132,11 +132,14 @@ static int use_ecc(SSL *s)
alg_a = c->algorithm_auth;
if ((alg_k & (SSL_kECDHE | SSL_kECDHEPSK))
|| (alg_a & SSL_aECDSA)
|| c->min_tls >= TLS1_3_VERSION)
return 1;
|| c->min_tls >= TLS1_3_VERSION) {
ret = 1;
break;
}
}
return 0;
sk_SSL_CIPHER_free(cipher_stack);
return ret;
}
EXT_RETURN tls_construct_ctos_ec_pt_formats(SSL *s, WPACKET *pkt,
ssl/t1_lib.c
+34 -10
View File
@@ -343,6 +343,10 @@ int tls1_set_groups(uint16_t **pext, size_t *pextlen,
*/
unsigned long dup_list = 0;
if (ngroups == 0) {
SSLerr(SSL_F_TLS1_SET_GROUPS, SSL_R_BAD_LENGTH);
return 0;
}
if ((glist = OPENSSL_malloc(ngroups * sizeof(*glist))) == NULL) {
SSLerr(SSL_F_TLS1_SET_GROUPS, ERR_R_MALLOC_FAILURE);
return 0;
@@ -2492,7 +2496,7 @@ static int tls12_get_cert_sigalg_idx(const SSL *s, const SIGALG_LOOKUP *lu)
static int has_usable_cert(SSL *s, const SIGALG_LOOKUP *sig, int idx)
{
const SIGALG_LOOKUP *lu;
int mdnid, pknid;
int mdnid, pknid, supported;
size_t i;
/* TLS 1.2 callers can override lu->sig_idx, but not TLS 1.3 callers. */
@@ -2505,19 +2509,39 @@ static int has_usable_cert(SSL *s, const SIGALG_LOOKUP *sig, int idx)
lu = tls1_lookup_sigalg(s->s3->tmp.peer_cert_sigalgs[i]);
if (lu == NULL
|| !X509_get_signature_info(s->cert->pkeys[idx].x509, &mdnid,
&pknid, NULL, NULL))
&pknid, NULL, NULL)
/*
* TODO this does not differentiate between the
* rsa_pss_pss_* and rsa_pss_rsae_* schemes since we do not
* have a chain here that lets us look at the key OID in the
* signing certificate.
*/
|| mdnid != lu->hash
|| pknid != lu->sig)
continue;
/*
* TODO this does not differentiate between the
* rsa_pss_pss_* and rsa_pss_rsae_* schemes since we do not
* have a chain here that lets us look at the key OID in the
* signing certificate.
*/
if (mdnid == lu->hash && pknid == lu->sig)
return 1;
ERR_set_mark();
supported = EVP_PKEY_supports_digest_nid(s->cert->pkeys[idx].privatekey,
mdnid);
if (supported == 0)
continue;
else if (supported < 0)
{
/* If it didn't report a mandatory NID, for whatever reasons,
* just clear the error and allow all hashes to be used. */
ERR_pop_to_mark();
}
return 1;
}
return 0;
}
supported = EVP_PKEY_supports_digest_nid(s->cert->pkeys[idx].privatekey,
sig->hash);
if (supported == 0)
return 0;
else if (supported < 0)
ERR_clear_error();
return 1;
}
test/build.info
+1 -1
View File
@@ -342,7 +342,7 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=main
SOURCE[drbgtest]=drbgtest.c
INCLUDE[drbgtest]=../include
DEPEND[drbgtest]=../libcrypto libtestutil.a
DEPEND[drbgtest]=../libcrypto.a libtestutil.a
SOURCE[drbg_cavs_test]=drbg_cavs_test.c drbg_cavs_data_ctr.c \
drbg_cavs_data_hash.c drbg_cavs_data_hmac.c
test/drbgtest.c
-40
View File
@@ -901,46 +901,6 @@ static int test_multi_thread(void)
}
#endif
#ifdef OPENSSL_RAND_SEED_NONE
/*
* Calculates the minimum buffer length which needs to be
* provided to RAND_seed() in order to successfully
* instantiate the DRBG.
*
* Copied from rand_drbg_seedlen() in rand_drbg.c
*/
static size_t rand_drbg_seedlen(RAND_DRBG *drbg)
{
/*
* If no os entropy source is available then RAND_seed(buffer, bufsize)
* is expected to succeed if and only if the buffer length satisfies
* the following requirements, which follow from the calculations
* in RAND_DRBG_instantiate().
*/
size_t min_entropy = drbg->strength;
size_t min_entropylen = drbg->min_entropylen;
/*
* Extra entropy for the random nonce in the absence of a
* get_nonce callback, see comment in RAND_DRBG_instantiate().
*/
if (drbg->min_noncelen > 0 && drbg->get_nonce == NULL) {
min_entropy += drbg->strength / 2;
min_entropylen += drbg->min_noncelen;
}
/*
* Convert entropy requirement from bits to bytes
* (dividing by 8 without rounding upwards, because
* all entropy requirements are divisible by 8).
*/
min_entropy >>= 3;
/* Return a value that satisfies both requirements */
return min_entropy > min_entropylen ? min_entropy : min_entropylen;
}
#endif /*OPENSSL_RAND_SEED_NONE*/
/*
* Test that instantiation with RAND_seed() works as expected
*
test/recipes/02-test_internal_ctype.t
-3
View File
@@ -14,7 +14,4 @@ use OpenSSL::Test::Utils;
setup("test_internal_ctype");
plan skip_all => "This test is unsupported in a shared library build on Windows"
if $^O eq 'MSWin32' && !disabled("shared");
simple_test("test_internal_ctype", "ctype_internal_test");
test/recipes/03-test_internal_asn1.t
-3
View File
@@ -13,7 +13,4 @@ use OpenSSL::Test::Utils;
setup("test_internal_asn1");
plan skip_all => "This test is unsupported in a shared library build on Windows"
if $^O eq 'MSWin32' && !disabled("shared");
simple_test("test_internal_asn1", "asn1_internal_test");
test/recipes/03-test_internal_chacha.t
-3
View File
@@ -13,7 +13,4 @@ use OpenSSL::Test::Utils;
setup("test_internal_chacha");
plan skip_all => "This test is unsupported in a shared library build on Windows"
if $^O eq 'MSWin32' && !disabled("shared");
simple_test("test_internal_chacha", "chacha_internal_test", "chacha");
test/recipes/03-test_internal_curve448.t
-3
View File
@@ -13,9 +13,6 @@ use OpenSSL::Test::Utils;
setup("test_internal_curve448");
plan skip_all => "This test is unsupported in a shared library build on Windows"
if $^O eq 'MSWin32' && !disabled("shared");
plan skip_all => "This test is unsupported in a no-ec build"
if disabled("ec");
test/recipes/03-test_internal_modes.t
-3
View File
@@ -13,7 +13,4 @@ use OpenSSL::Test::Utils;
setup("test_internal_modes");
plan skip_all => "This test is unsupported in a shared library build on Windows"
if $^O eq 'MSWin32' && !disabled("shared");
simple_test("test_internal_modes", "modes_internal_test");
test/recipes/03-test_internal_poly1305.t
-3
View File
@@ -13,7 +13,4 @@ use OpenSSL::Test::Utils;
setup("test_internal_poly1305");
plan skip_all => "This test is unsupported in a shared library build on Windows"
if $^O eq 'MSWin32' && !disabled("shared");
simple_test("test_internal_poly1305", "poly1305_internal_test", "poly1305");
test/recipes/03-test_internal_siphash.t
-3
View File
@@ -13,7 +13,4 @@ use OpenSSL::Test::Utils;
setup("test_internal_siphash");
plan skip_all => "This test is unsupported in a shared library build on Windows"
if $^O eq 'MSWin32' && !disabled("shared");
simple_test("test_internal_siphash", "siphash_internal_test", "siphash");
test/recipes/03-test_internal_sm2.t
-3
View File
@@ -13,7 +13,4 @@ use OpenSSL::Test::Utils;
setup("test_internal_sm2");
plan skip_all => "This test is unsupported in a shared library build on Windows"
if $^O eq 'MSWin32' && !disabled("shared");
simple_test("test_internal_sm2", "sm2_internal_test", "sm2");
test/recipes/03-test_internal_sm4.t
-3
View File
@@ -14,7 +14,4 @@ use OpenSSL::Test::Utils;
setup("test_internal_sm4");
plan skip_all => "This test is unsupported in a shared library build on Windows"
if $^O eq 'MSWin32' && !disabled("shared");
simple_test("test_internal_sm4", "sm4_internal_test", "sm4");
test/recipes/03-test_internal_ssl_cert_table.t
-3
View File
@@ -13,7 +13,4 @@ use OpenSSL::Test::Utils;
setup("test_internal_ssl_cert_table");
plan skip_all => "This test is unsupported in a shared library build on Windows"
if $^O eq 'MSWin32' && !disabled("shared");
simple_test("test_internal_ssl_cert_table", "ssl_cert_table_internal_test");
test/recipes/03-test_internal_x509.t
-3
View File
@@ -13,7 +13,4 @@ use OpenSSL::Test::Utils;
setup("test_internal_x509");
plan skip_all => "This test is unsupported in a shared library build on Windows"
if $^O eq 'MSWin32' && !disabled("shared");
simple_test("test_internal_x509", "x509_internal_test");
test/recipes/06-test-rdrand.t
-3
View File
@@ -15,9 +15,6 @@ use OpenSSL::Test::Utils;
setup("test_rdrand_sanity");
plan skip_all => "This test is unsupported in a shared library build on Windows"
if $^O eq 'MSWin32' && !disabled("shared");
# We also need static builds to be enabled even on linux
plan skip_all => "This test is unsupported if static builds are not enabled"
if disabled("static");
test/recipes/80-test_ssl_new.t
+1 -1
View File
@@ -28,7 +28,7 @@ map { s/\^// } @conf_files if $^O eq "VMS";
# We hard-code the number of tests to double-check that the globbing above
# finds all files as expected.
plan tests => 27; # = scalar @conf_srcs
plan tests => 28; # = scalar @conf_srcs
# Some test results depend on the configuration of enabled protocols. We only
# verify generated sources in the default configuration.
test/recipes/90-test_tls13encryption.t
-3
View File
@@ -15,9 +15,6 @@ setup($test_name);
plan skip_all => "$test_name is not supported in this build"
if disabled("tls1_3");
plan skip_all => "This test is unsupported in a shared library build on Windows"
if $^O eq 'MSWin32' && !disabled("shared");
plan tests => 1;
ok(run(test(["tls13encryptiontest"])), "running tls13encryptiontest");
test/ssl-tests/28-seclevel.conf
+102
View File
@@ -0,0 +1,102 @@
# Generated with generate_ssl_tests.pl
num_tests = 4
test-0 = 0-SECLEVEL 3 with default key
test-1 = 1-SECLEVEL 3 with ED448 key
test-2 = 2-SECLEVEL 3 with ED448 key, TLSv1.2
test-3 = 3-SECLEVEL 3 with P-384 key, X25519 ECDHE
# ===========================================================
[0-SECLEVEL 3 with default key]
ssl_conf = 0-SECLEVEL 3 with default key-ssl
[0-SECLEVEL 3 with default key-ssl]
server = 0-SECLEVEL 3 with default key-server
client = 0-SECLEVEL 3 with default key-client
[0-SECLEVEL 3 with default key-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT:@SECLEVEL=3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[0-SECLEVEL 3 with default key-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-0]
ExpectedResult = ServerFail
# ===========================================================
[1-SECLEVEL 3 with ED448 key]
ssl_conf = 1-SECLEVEL 3 with ED448 key-ssl
[1-SECLEVEL 3 with ED448 key-ssl]
server = 1-SECLEVEL 3 with ED448 key-server
client = 1-SECLEVEL 3 with ED448 key-client
[1-SECLEVEL 3 with ED448 key-server]
Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
CipherString = DEFAULT:@SECLEVEL=3
PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
[1-SECLEVEL 3 with ED448 key-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-1]
ExpectedResult = Success
# ===========================================================
[2-SECLEVEL 3 with ED448 key, TLSv1.2]
ssl_conf = 2-SECLEVEL 3 with ED448 key, TLSv1.2-ssl
[2-SECLEVEL 3 with ED448 key, TLSv1.2-ssl]
server = 2-SECLEVEL 3 with ED448 key, TLSv1.2-server
client = 2-SECLEVEL 3 with ED448 key, TLSv1.2-client
[2-SECLEVEL 3 with ED448 key, TLSv1.2-server]
Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
CipherString = DEFAULT:@SECLEVEL=3
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
[2-SECLEVEL 3 with ED448 key, TLSv1.2-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-2]
ExpectedResult = Success
# ===========================================================
[3-SECLEVEL 3 with P-384 key, X25519 ECDHE]
ssl_conf = 3-SECLEVEL 3 with P-384 key, X25519 ECDHE-ssl
[3-SECLEVEL 3 with P-384 key, X25519 ECDHE-ssl]
server = 3-SECLEVEL 3 with P-384 key, X25519 ECDHE-server
client = 3-SECLEVEL 3 with P-384 key, X25519 ECDHE-client
[3-SECLEVEL 3 with P-384 key, X25519 ECDHE-server]
Certificate = ${ENV::TEST_CERTS_DIR}/p384-server-cert.pem
CipherString = DEFAULT:@SECLEVEL=3
Groups = X25519
PrivateKey = ${ENV::TEST_CERTS_DIR}/p384-server-key.pem
[3-SECLEVEL 3 with P-384 key, X25519 ECDHE-client]
CipherString = ECDHE:@SECLEVEL=3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/p384-root.pem
VerifyMode = Peer
[test-3]
ExpectedResult = Success
test/ssl-tests/28-seclevel.conf.in
+48
View File
@@ -0,0 +1,48 @@
# -*- mode: perl; -*-
# Copyright 2016-2016 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html
## SSL test configurations
package ssltests;
our @tests = (
{
name => "SECLEVEL 3 with default key",
server => { "CipherString" => "DEFAULT:\@SECLEVEL=3" },
client => { },
test => { "ExpectedResult" => "ServerFail" },
},
{
name => "SECLEVEL 3 with ED448 key",
server => { "CipherString" => "DEFAULT:\@SECLEVEL=3",
"Certificate" => test_pem("server-ed448-cert.pem"),
"PrivateKey" => test_pem("server-ed448-key.pem") },
client => { },
test => { "ExpectedResult" => "Success" },
},
{
name => "SECLEVEL 3 with ED448 key, TLSv1.2",
server => { "CipherString" => "DEFAULT:\@SECLEVEL=3",
"Certificate" => test_pem("server-ed448-cert.pem"),
"PrivateKey" => test_pem("server-ed448-key.pem"),
"MaxProtocol" => "TLSv1.2" },
client => { },
test => { "ExpectedResult" => "Success" },
},
{
name => "SECLEVEL 3 with P-384 key, X25519 ECDHE",
server => { "CipherString" => "DEFAULT:\@SECLEVEL=3",
"Certificate" => test_pem("p384-server-cert.pem"),
"PrivateKey" => test_pem("p384-server-key.pem"),
"Groups" => "X25519" },
client => { "CipherString" => "ECDHE:\@SECLEVEL=3",
"VerifyCAFile" => test_pem("p384-root.pem") },
test => { "ExpectedResult" => "Success" },
},
);
util/add-depends.pl
+4 -2
View File
@@ -36,8 +36,10 @@ my @depfiles =
scalar @st > 0; # Determines the grep result
}
map { (my $x = $_) =~ s|\.o$|$depext|; $x; }
grep { $unified_info{sources}->{$_}->[0] =~ /\.cc?$/ }
keys %{$unified_info{sources}};
( ( grep { $unified_info{sources}->{$_}->[0] =~ /\.cc?$/ }
keys %{$unified_info{sources}} ),
( grep { $unified_info{shared_sources}->{$_}->[0] =~ /\.cc?$/ }
keys %{$unified_info{shared_sources}} ) );
exit 0 unless $rebuild;
util/libcrypto.num
+2 -1
View File
@@ -4597,4 +4597,5 @@ EVP_MAC_do_all 4550 1_1_2 EXIST::FUNCTION:
EVP_MAC_do_all_sorted 4551 1_1_2 EXIST::FUNCTION:
EVP_str2ctrl 4552 1_1_2 EXIST::FUNCTION:
EVP_hex2ctrl 4553 1_1_2 EXIST::FUNCTION:
EVP_chacha20_poly1305_draft 4554 1_1_0 EXIST::FUNCTION:CHACHA,POLY1305_DRAFT
EVP_PKEY_supports_digest_nid 4554 1_1_2 EXIST::FUNCTION:
EVP_chacha20_poly1305_draft 4555 1_1_0 EXIST::FUNCTION:CHACHA,POLY1305_DRAFT