diff --git a/CHANGES b/CHANGES index c32f768f..20e170c4 100644 --- a/CHANGES +++ b/CHANGES @@ -9,6 +9,33 @@ Changes between 1.1.1 and 3.0.0 [xx XXX xxxx] + *) Added functionality to create an EVP_PKEY context based on data + for methods from providers. This takes an algorithm name and a + property query string and simply stores them, with the intent + that any operation that uses this context will use those strings + to fetch the needed methods implicitly, thereby making the port + of application written for pre-3.0 OpenSSL easier. + [Richard Levitte] + + *) The undocumented function NCONF_WIN32() has been deprecated; for + conversion details see the HISTORY section of doc/man5/config.pod + [Rich Salz] + + *) Introduced the new functions EVP_DigestSignInit_ex() and + EVP_DigestVerifyInit_ex(). The macros EVP_DigestSignUpdate() and + EVP_DigestVerifyUpdate() have been converted to functions. See the man + pages for further details. + [Matt Caswell] + + *) Over two thousand fixes were made to the documentation, including: + adding missing command flags, better style conformance, documentation + of internals, etc. + [Rich Salz, Richard Levitte] + + *) s390x assembly pack: add hardware-support for P-256, P-384, P-521, + X25519, X448, Ed25519 and Ed448. + [Patrick Steuer] + *) Print all values for a PKCS#12 attribute with 'openssl pkcs12', not just the first value. [Jon Spillett] diff --git a/Configurations/10-main.conf b/Configurations/10-main.conf index 9b08cf4f..e00e1c06 100644 --- a/Configurations/10-main.conf +++ b/Configurations/10-main.conf @@ -450,7 +450,7 @@ my %targets = ( # 32-bit message digests. (For the moment of this writing) HP C # doesn't seem to "digest" too many local variables (they make "him" # chew forever:-). For more details look-up MD32_XARRAY comment in -# crypto/sha/sha_lcl.h. +# crypto/sha/sha_local.h. # - originally there were 32-bit hpux-parisc2-* targets. They were # scrapped, because a) they were not interchangeable with other 32-bit # targets; b) performance-critical 32-bit assembly modules implement diff --git a/Configurations/common.tmpl b/Configurations/common.tmpl index 62b1102c..a2591da7 100644 --- a/Configurations/common.tmpl +++ b/Configurations/common.tmpl @@ -2,37 +2,99 @@ use File::Basename; + my $debug_resolvedepends = $ENV{BUILDFILE_DEBUG_DEPENDS}; + my $debug_rules = $ENV{BUILDFILE_DEBUG_RULES}; + # A cache of objects for which a recipe has already been generated my %cache; - # resolvedepends and reducedepends work in tandem to make sure - # there are no duplicate dependencies and that they are in the - # right order. This is especially used to sort the list of - # libraries that a build depends on. + # collectdepends, expanddepends and reducedepends work together to make + # sure there are no duplicate or weak dependencies and that they are in + # the right order. This is used to sort the list of libraries that a + # build depends on. sub extensionlesslib { my @result = map { $_ =~ /(\.a)?$/; $` } @_; return @result if wantarray; return $result[0]; } - sub resolvedepends { + + # collectdepends dives into the tree of dependencies and returns + # a list of all the non-weak ones. + sub collectdepends { + return () unless @_; + my $thing = shift; my $extensionlessthing = extensionlesslib($thing); my @listsofar = @_; # to check if we're looping my @list = @{$unified_info{depends}->{$thing} // $unified_info{depends}->{$extensionlessthing}}; my @newlist = (); - if (scalar @list) { - foreach my $item (@list) { - my $extensionlessitem = extensionlesslib($item); - # It's time to break off when the dependency list starts looping - next if grep { extensionlesslib($_) eq $extensionlessitem } @listsofar; - push @newlist, $item, resolvedepends($item, @listsofar, $item); - } + + print STDERR "DEBUG[collectdepends] $thing > ", join(' ', @listsofar), "\n" + if $debug_resolvedepends; + foreach my $item (@list) { + my $extensionlessitem = extensionlesslib($item); + # It's time to break off when the dependency list starts looping + next if grep { extensionlesslib($_) eq $extensionlessitem } @listsofar; + # Don't add anything here if the dependency is weak + next if defined $unified_info{attributes}->{depends}->{$thing}->{$item}->{'weak'}; + my @resolved = collectdepends($item, @listsofar, $item); + push @newlist, $item, @resolved; } + print STDERR "DEBUG[collectdepends] $thing < ", join(' ', @newlist), "\n" + if $debug_resolvedepends; @newlist; } + + # expanddepends goes through a list of stuff, checks if they have any + # dependencies, and adds them at the end of the current position if + # they aren't already present later on. + sub expanddepends { + my @after = ( @_ ); + print STDERR "DEBUG[expanddepends]> ", join(' ', @after), "\n" + if $debug_resolvedepends; + my @before = (); + while (@after) { + my $item = shift @after; + print STDERR "DEBUG[expanddepends]\\ ", join(' ', @before), "\n" + if $debug_resolvedepends; + print STDERR "DEBUG[expanddepends] - ", $item, "\n" + if $debug_resolvedepends; + my @middle = ( + $item, + map { + my $x = $_; + my $extlessx = extensionlesslib($x); + if (grep { $extlessx eq extensionlesslib($_) } @before + and + !grep { $extlessx eq extensionlesslib($_) } @after) { + print STDERR "DEBUG[expanddepends] + ", $x, "\n" + if $debug_resolvedepends; + ( $x ) + } else { + print STDERR "DEBUG[expanddepends] ! ", $x, "\n" + if $debug_resolvedepends; + () + } + } @{$unified_info{depends}->{$item} // []} + ); + print STDERR "DEBUG[expanddepends] = ", join(' ', @middle), "\n" + if $debug_resolvedepends; + print STDERR "DEBUG[expanddepends]/ ", join(' ', @after), "\n" + if $debug_resolvedepends; + push @before, @middle; + } + print STDERR "DEBUG[expanddepends]< ", join(' ', @before), "\n" + if $debug_resolvedepends; + @before; + } + + # reducedepends looks through a list, and checks if each item is + # repeated later on. If it is, the earlier copy is dropped. sub reducedepends { my @list = @_; + print STDERR "DEBUG[reducedepends]> ", join(' ', @list), "\n" + if $debug_resolvedepends; my @newlist = (); my %replace = (); while (@list) { @@ -49,7 +111,25 @@ push @newlist, $item; } } - map { $replace{$_} // $_; } @newlist; + @newlist = map { $replace{$_} // $_; } @newlist; + print STDERR "DEBUG[reducedepends]< ", join(' ', @newlist), "\n" + if $debug_resolvedepends; + @newlist; + } + + # Do it all + # This takes multiple inputs and combine them into a single list of + # interdependent things. The returned value will include all the input. + # Callers are responsible for taking away the things they are building. + sub resolvedepends { + print STDERR "DEBUG[resolvedepends] START (", join(', ', @_), ")\n" + if $debug_resolvedepends; + my @all = + reducedepends(expanddepends(map { ( $_, collectdepends($_) ) } @_)); + print STDERR "DEBUG[resolvedepends] END (", join(', ', @_), ") : ", + join(',', map { "\n $_" } @all), "\n" + if $debug_resolvedepends; + @all; } # dogenerate is responsible for producing all the recipes that build @@ -91,14 +171,30 @@ my $bin = shift; my %opts = @_; if (@{$unified_info{sources}->{$obj}}) { - $OUT .= src2obj(obj => $obj, - product => $bin, - srcs => $unified_info{sources}->{$obj}, - deps => $unified_info{depends}->{$obj}, - incs => [ @{$unified_info{includes}->{$obj}}, - @{$unified_info{includes}->{$bin}} ], - defs => [ @{$unified_info{defines}->{$obj}}, - @{$unified_info{defines}->{$bin}} ], + my @srcs = @{$unified_info{sources}->{$obj}}; + my @deps = @{$unified_info{depends}->{$obj}}; + my @incs = ( @{$unified_info{includes}->{$obj}}, + @{$unified_info{includes}->{$bin}} ); + my @defs = ( @{$unified_info{defines}->{$obj}}, + @{$unified_info{defines}->{$bin}} ); + print STDERR "DEBUG[doobj] \@srcs for $obj ($bin) : ", + join(",", map { "\n $_" } @srcs), "\n" + if $debug_rules; + print STDERR "DEBUG[doobj] \@deps for $obj ($bin) : ", + join(",", map { "\n $_" } @deps), "\n" + if $debug_rules; + print STDERR "DEBUG[doobj] \@incs for $obj ($bin) : ", + join(",", map { "\n $_" } @incs), "\n" + if $debug_rules; + print STDERR "DEBUG[doobj] \@defs for $obj ($bin) : ", + join(",", map { "\n $_" } @defs), "\n" + if $debug_rules; + print STDERR "DEBUG[doobj] \%opts for $obj ($bin) : ", , + join(",", map { "\n $_ = $opts{$_}" } sort keys %opts), "\n" + if $debug_rules; + $OUT .= src2obj(obj => $obj, product => $bin, + srcs => [ @srcs ], deps => [ @deps ], + incs => [ @incs ], defs => [ @defs ], %opts); foreach ((@{$unified_info{sources}->{$obj}}, @{$unified_info{depends}->{$obj}})) { @@ -108,37 +204,152 @@ $cache{$obj} = 1; } + # Helper functions to grab all applicable intermediary files. + # This is particularly useful when a library is given as source + # rather than a dependency. In that case, we consider it to be a + # container with object file references, or possibly references + # to further libraries to pilfer in the same way. + sub getsrclibs { + my $section = shift; + + # For all input, see if it sources static libraries. If it does, + # return them together with the result of a recursive call. + map { ( $_, getsrclibs($section, $_) ) } + grep { $_ =~ m|\.a$| } + map { @{$unified_info{$section}->{$_} // []} } + @_; + } + + sub getlibobjs { + my $section = shift; + + # For all input, see if it's an intermediary file (library or object). + # If it is, collect the result of a recursive call, or if that returns + # an empty list, the element itself. Return the result. + map { + my @x = getlibobjs($section, @{$unified_info{$section}->{$_}}); + @x ? @x : ( $_ ); + } + grep { defined $unified_info{$section}->{$_} } + @_; + } + # dolib is responsible for building libraries. It will call - # obj2shlib is shared libraries are produced, and obj2lib in all + # obj2shlib if shared libraries are produced, and obj2lib in all # cases. It also makes sure all object files for the library are # built. sub dolib { my $lib = shift; return "" if $cache{$lib}; + + my %attrs = %{$unified_info{attributes}->{libraries}->{$lib}}; + + my @deps = ( resolvedepends(getsrclibs('sources', $lib)) ); + + # We support two types of objs, those who are specific to this library + # (they end up in @objs) and those that we get indirectly, via other + # libraries (they end up in @foreign_objs). We get the latter any time + # someone has done something like this in build.info: + # SOURCE[libfoo.a]=libbar.a + # The indirect object files must be kept in a separate array so they + # don't get rebuilt unnecessarily (and with incorrect auxiliary + # information). + # + # Object files can't be collected commonly for shared and static + # libraries, because we contain their respective object files in + # {shared_sources} and {sources}, and because the implications are + # slightly different for each library form. + # + # We grab all these "foreign" object files recursively with getlibobjs(). + unless ($disabled{shared} || $lib =~ /\.a$/) { my $obj2shlib = defined &obj2shlib ? \&obj2shlib : \&libobj2shlib; + # If this library sources other static libraries and those + # libraries are marked {noinst}, there's no need to include + # all of their object files. Instead, we treat those static + # libraries as dependents alongside any other library this + # one depends on, and let symbol resolution do its job. + my @sourced_libs = (); + my @objs = (); + my @foreign_objs = (); + my @deps = (); + foreach (@{$unified_info{shared_sources}->{$lib}}) { + if ($_ !~ m|\.a$|) { + push @objs, $_; + } elsif ($unified_info{attributes}->{libraries}->{$_}->{noinst}) { + push @deps, $_; + } else { + push @deps, getsrclibs('sources', $_); + push @foreign_objs, getlibobjs('sources', $_); + } + } + @deps = ( grep { $_ ne $lib } resolvedepends($lib, @deps) ); + print STDERR "DEBUG[dolib:shlib] \%attrs for $lib : ", , + join(",", map { "\n $_ = $attrs{$_}" } sort keys %attrs), "\n" + if %attrs && $debug_rules; + print STDERR "DEBUG[dolib:shlib] \@deps for $lib : ", + join(",", map { "\n $_" } @deps), "\n" + if @deps && $debug_rules; + print STDERR "DEBUG[dolib:shlib] \@objs for $lib : ", + join(",", map { "\n $_" } @objs), "\n" + if @objs && $debug_rules; + print STDERR "DEBUG[dolib:shlib] \@foreign_objs for $lib : ", + join(",", map { "\n $_" } @foreign_objs), "\n" + if @foreign_objs && $debug_rules; $OUT .= $obj2shlib->(lib => $lib, - attrs => $unified_info{attributes}->{$lib}, - objs => $unified_info{shared_sources}->{$lib}, - deps => [ reducedepends(resolvedepends($lib)) ]); - foreach ((@{$unified_info{shared_sources}->{$lib}}, - @{$unified_info{sources}->{$lib}})) { + attrs => { %attrs }, + objs => [ @objs, @foreign_objs ], + deps => [ @deps ]); + foreach (@objs) { # If this is somehow a compiled object, take care of it that way # Otherwise, it might simply be generated if (defined $unified_info{sources}->{$_}) { - doobj($_, $lib, intent => "shlib", - attrs => $unified_info{attributes}->{$lib}); + if($_ =~ /\.a$/) { + dolib($_); + } else { + doobj($_, $lib, intent => "shlib", attrs => { %attrs }); + } } else { dogenerate($_, undef, undef, intent => "lib"); } } } - $OUT .= obj2lib(lib => $lib, - attrs => $unified_info{attributes}->{$lib}, - objs => [ @{$unified_info{sources}->{$lib}} ]); - foreach (@{$unified_info{sources}->{$lib}}) { - doobj($_, $lib, intent => "lib", - attrs => $unified_info{attributes}->{$lib}); + { + # When putting static libraries together, we cannot rely on any + # symbol resolution, so for all static libraries used as source for + # this one, as well as other libraries they depend on, we simply + # grab all their object files unconditionally, + # Symbol resolution will happen when any program, module or shared + # library is linked with this one. + my @objs = (); + my @sourcedeps = (); + my @foreign_objs = (); + foreach (@{$unified_info{sources}->{$lib}}) { + if ($_ !~ m|\.a$|) { + push @objs, $_; + } else { + push @sourcedeps, $_; + } + } + @sourcedeps = ( grep { $_ ne $lib } resolvedepends(@sourcedeps) ); + print STDERR "DEBUG[dolib:lib] : \@sourcedeps for $_ : ", + join(",", map { "\n $_" } @sourcedeps), "\n" + if @sourcedeps && $debug_rules; + @foreign_objs = getlibobjs('sources', @sourcedeps); + print STDERR "DEBUG[dolib:lib] \%attrs for $lib : ", , + join(",", map { "\n $_ = $attrs{$_}" } sort keys %attrs), "\n" + if %attrs && $debug_rules; + print STDERR "DEBUG[dolib:lib] \@objs for $lib : ", + join(",", map { "\n $_" } @objs), "\n" + if @objs && $debug_rules; + print STDERR "DEBUG[dolib:lib] \@foreign_objs for $lib : ", + join(",", map { "\n $_" } @foreign_objs), "\n" + if @foreign_objs && $debug_rules; + $OUT .= obj2lib(lib => $lib, attrs => { %attrs }, + objs => [ @objs, @foreign_objs ]); + foreach (@objs) { + doobj($_, $lib, intent => "lib", attrs => { %attrs }); + } } $cache{$lib} = 1; } @@ -147,23 +358,35 @@ # obj2dso, and also makes sure all object files for the library # are built. sub domodule { - my $lib = shift; - return "" if $cache{$lib}; - $OUT .= obj2dso(lib => $lib, - attrs => $unified_info{attributes}->{$lib}, - objs => $unified_info{sources}->{$lib}, - deps => [ resolvedepends($lib) ]); - foreach (@{$unified_info{sources}->{$lib}}) { + my $module = shift; + return "" if $cache{$module}; + my %attrs = %{$unified_info{attributes}->{modules}->{$module}}; + my @objs = @{$unified_info{sources}->{$module}}; + my @deps = ( grep { $_ ne $module } + resolvedepends($module) ); + print STDERR "DEBUG[domodule] \%attrs for $module :", + join(",", map { "\n $_ = $attrs{$_}" } sort keys %attrs), "\n" + if $debug_rules; + print STDERR "DEBUG[domodule] \@objs for $module : ", + join(",", map { "\n $_" } @objs), "\n" + if $debug_rules; + print STDERR "DEBUG[domodule] \@deps for $module : ", + join(",", map { "\n $_" } @deps), "\n" + if $debug_rules; + $OUT .= obj2dso(module => $module, + attrs => { %attrs }, + objs => [ @objs ], + deps => [ @deps ]); + foreach (@{$unified_info{sources}->{$module}}) { # If this is somehow a compiled object, take care of it that way # Otherwise, it might simply be generated if (defined $unified_info{sources}->{$_}) { - doobj($_, $lib, intent => "dso", - attrs => $unified_info{attributes}->{$lib}); + doobj($_, $module, intent => "dso", attrs => { %attrs }); } else { - dogenerate($_, undef, $lib, intent => "dso"); + dogenerate($_, undef, $module, intent => "dso"); } } - $cache{$lib} = 1; + $cache{$module} = 1; } # dobin is responsible for building programs. It will call obj2bin, @@ -171,14 +394,24 @@ sub dobin { my $bin = shift; return "" if $cache{$bin}; - my $deps = [ reducedepends(resolvedepends($bin)) ]; + my %attrs = %{$unified_info{attributes}->{programs}->{$bin}}; + my @objs = @{$unified_info{sources}->{$bin}}; + my @deps = ( grep { $_ ne $bin } resolvedepends($bin) ); + print STDERR "DEBUG[dobin] \%attrs for $bin : ", + join(",", map { "\n $_ = $attrs{$_}" } sort keys %attrs), "\n" + if %attrs && $debug_rules; + print STDERR "DEBUG[dobin] \@objs for $bin : ", + join(",", map { "\n $_" } @objs), "\n" + if @objs && $debug_rules; + print STDERR "DEBUG[dobin] \@deps for $bin : ", + join(",", map { "\n $_" } @deps), "\n" + if @deps && $debug_rules; $OUT .= obj2bin(bin => $bin, - attrs => $unified_info{attributes}->{$bin}, - objs => [ @{$unified_info{sources}->{$bin}} ], - deps => $deps); - foreach (@{$unified_info{sources}->{$bin}}) { - doobj($_, $bin, intent => "bin", - attrs => $unified_info{attributes}->{$bin}); + attrs => { %attrs }, + objs => [ @objs ], + deps => [ @deps ]); + foreach (@objs) { + doobj($_, $bin, intent => "bin", attrs => { %attrs }); } $cache{$bin} = 1; } diff --git a/Configurations/descrip.mms.tmpl b/Configurations/descrip.mms.tmpl index 892102dd..28e7663a 100644 --- a/Configurations/descrip.mms.tmpl +++ b/Configurations/descrip.mms.tmpl @@ -48,26 +48,26 @@ @{$unified_info{libraries}}; our @install_libs = map { platform->staticname($_) } - grep { !$unified_info{attributes}->{$_}->{noinst} } + grep { !$unified_info{attributes}->{libraries}->{$_}->{noinst} } @{$unified_info{libraries}}; our @install_shlibs = map { platform->sharedname($_) // () } - grep { !$unified_info{attributes}->{$_}->{noinst} } + grep { !$unified_info{attributes}->{libraries}->{$_}->{noinst} } @{$unified_info{libraries}}; our @install_engines = - grep { !$unified_info{attributes}->{$_}->{noinst} - && $unified_info{attributes}->{$_}->{engine} } + grep { !$unified_info{attributes}->{modules}->{$_}->{noinst} + && $unified_info{attributes}->{modules}->{$_}->{engine} } @{$unified_info{modules}}; our @install_programs = - grep { !$unified_info{attributes}->{$_}->{noinst} } + grep { !$unified_info{attributes}->{programs}->{$_}->{noinst} } @{$unified_info{programs}}; our @install_bin_scripts = - grep { !$unified_info{attributes}->{$_}->{noinst} - && !$unified_info{attributes}->{$_}->{misc} } + grep { !$unified_info{attributes}->{scripts}->{$_}->{noinst} + && !$unified_info{attributes}->{scripts}->{$_}->{misc} } @{$unified_info{scripts}}; our @install_misc_scripts = - grep { !$unified_info{attributes}->{$_}->{noinst} - && $unified_info{attributes}->{$_}->{misc} } + grep { !$unified_info{attributes}->{scripts}->{$_}->{noinst} + && $unified_info{attributes}->{scripts}->{$_}->{misc} } @{$unified_info{scripts}}; # This is a horrible hack, but is needed because recursive inclusion of files @@ -704,7 +704,7 @@ reconfigure reconf : # On Unix platforms, we depend on {shlibname}.so return map { { lib => platform->sharedlib($_) // platform->staticlib($_), - attrs => $unified_info{attributes}->{$_} } + attrs => $unified_info{attributes}->{libraries}->{$_} } } @_; } @@ -775,10 +775,14 @@ EOF my $dofile = abs2rel(rel2abs(catfile($config{sourcedir}, "util", "dofile.pl")), rel2abs($config{builddir})); + my @modules = ( 'configdata.pm', + grep { $_ =~ m|\.pm$| } @{$args{deps}} ); + my %moduleincs = map { '"-I'.dirname($_).'"' => 1 } @modules; + @modules = map { '"-M'.basename($_, '.pm').'"' } @modules; + my $modules = join(' ', '', sort keys %moduleincs, @modules); return <<"EOF"; $target : $args{generator}->[0] $deps - \$(PERL) "-I\$(BLDDIR)" "-Mconfigdata" $dofile \\ - "-o$target{build_file}" $generator > \$\@ + \$(PERL)$modules $dofile "-o$target{build_file}" $generator > \$\@ EOF } else { return <<"EOF"; @@ -1014,8 +1018,8 @@ EOF } sub obj2dso { my %args = @_; - my $dsoname = platform->dsoname($args{lib}); - my $dso = platform->dso($args{lib}); + my $dsoname = platform->dsoname($args{module}); + my $dso = platform->dso($args{module}); my @objs = map { platform->convertext($_) } grep { platform->isobj($_) } @{$args{objs}}; diff --git a/Configurations/platform/BASE.pm b/Configurations/platform/BASE.pm index fcd7b70c..1ab4bf18 100644 --- a/Configurations/platform/BASE.pm +++ b/Configurations/platform/BASE.pm @@ -52,11 +52,13 @@ sub isdef { return $_[1] =~ m|\.ld$|; } sub isobj { return $_[1] =~ m|\.o$|; } sub isres { return $_[1] =~ m|\.res$|; } sub isasm { return $_[1] =~ m|\.[Ss]$|; } +sub isstaticlib { return $_[1] =~ m|\.a$|; } sub convertext { - if ($_[0]->isdef($_[1])) { return $_[0]->def($_[1]); } - if ($_[0]->isobj($_[1])) { return $_[0]->obj($_[1]); } - if ($_[0]->isres($_[1])) { return $_[0]->res($_[1]); } - if ($_[0]->isasm($_[1])) { return $_[0]->asm($_[1]); } + if ($_[0]->isdef($_[1])) { return $_[0]->def($_[1]); } + if ($_[0]->isobj($_[1])) { return $_[0]->obj($_[1]); } + if ($_[0]->isres($_[1])) { return $_[0]->res($_[1]); } + if ($_[0]->isasm($_[1])) { return $_[0]->asm($_[1]); } + if ($_[0]->isstaticlib($_[1])) { return $_[0]->staticlib($_[1]); } return $_[1]; } diff --git a/Configurations/platform/mingw.pm b/Configurations/platform/mingw.pm index 5788a36e..7dacb32a 100644 --- a/Configurations/platform/mingw.pm +++ b/Configurations/platform/mingw.pm @@ -17,6 +17,9 @@ sub objext { '.obj' } sub libext { '.a' } sub dsoext { '.dll' } sub defext { '.def' } + +# Other extra that aren't defined in platform::BASE +sub resext { '.res.obj' } sub shlibext { '.dll' } sub shlibextimport { $target{shared_import_extension} || '.dll.a' } sub shlibextsimple { undef } diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl index 1267a2a9..d5deb87e 100644 --- a/Configurations/unix-Makefile.tmpl +++ b/Configurations/unix-Makefile.tmpl @@ -20,6 +20,40 @@ return "$target: build_generated\n\t\$(MAKE) depend && \$(MAKE) _$target\n_$target"; } + + our $COLUMNS = $ENV{COLUMNS}; + if ($COLUMNS =~ /^\d+$/) { + $COLUMNS = int($COLUMNS) - 2; # 2 to leave space for ending ' \' + } else { + $COLUMNS = 76; + } + + sub fill_lines { + my $item_sep = shift; # string + my $line_length = shift; # number of chars + + my @result = (); + my $resultpos = 0; + + foreach (@_) { + my $fill_line = $result[$resultpos] // ''; + my $newline = + ($fill_line eq '' ? '' : $fill_line . $item_sep) . $_; + + if (length($newline) > $line_length) { + # If this is a single item and the intended result line + # is empty, we put it there anyway + if ($fill_line eq '') { + $result[$resultpos++] = $newline; + } else { + $result[++$resultpos] = $_; + } + } else { + $result[$resultpos] = $newline; + } + } + return @result; + } ''; -} PLATFORM={- $config{target} -} @@ -34,65 +68,99 @@ MINOR={- $config{minor} -} SHLIB_VERSION_NUMBER={- $config{shlib_version} -} SHLIB_TARGET={- $target{shared_target} -} -LIBS={- join(" ", map { platform->staticlib($_) // () } @{$unified_info{libraries}}) -} -SHLIBS={- join(" ", map { platform->sharedlib($_) // () } @{$unified_info{libraries}}) -} -SHLIB_INFO={- join(" ", map { my $x = platform->sharedlib($_); - my $y = platform->sharedlib_simple($_); - $x ? "\"$x;$y\"" : () } - @{$unified_info{libraries}}) -} -MODULES={- join(" ", map { platform->dso($_) } @{$unified_info{modules}}) -} -PROGRAMS={- join(" ", map { platform->bin($_) } @{$unified_info{programs}}) -} -SCRIPTS={- join(" ", @{$unified_info{scripts}}) -} +LIBS={- join(" \\\n" . ' ' x 5, + fill_lines(" ", $COLUMNS - 5, + map { platform->staticlib($_) // () } + @{$unified_info{libraries}})) -} +SHLIBS={- join(" \\\n" . ' ' x 7, + fill_lines(" ", $COLUMNS - 7, + map { platform->sharedlib($_) // () } + @{$unified_info{libraries}})) -} +SHLIB_INFO={- join(" \\\n" . ' ' x 11, + fill_lines(" ", $COLUMNS - 11, + map { my $x = platform->sharedlib($_); + my $y = platform->sharedlib_simple($_); + $x ? "\"$x;$y\"" : () } + @{$unified_info{libraries}})) -} +MODULES={- join(" \\\n" . ' ' x 8, + fill_lines(" ", $COLUMNS - 8, + map { platform->dso($_) } + @{$unified_info{modules}})) -} +PROGRAMS={- join(" \\\n" . ' ' x 9, + fill_lines(" ", $COLUMNS - 9, + map { platform->bin($_) } + @{$unified_info{programs}})) -} +SCRIPTS={- join(" \\\n" . ' ' x 8, + fill_lines(" ", $COLUMNS - 8, @{$unified_info{scripts}})) -} {- output_off() if $disabled{makedepend}; "" -} -DEPS={- join(" ", map { platform->isobj($_) ? platform->dep($_) : () } - grep { $unified_info{sources}->{$_}->[0] =~ /\.c$/ } - keys %{$unified_info{sources}}); -} +DEPS={- join(" \\\n" . ' ' x 5, + fill_lines(" ", $COLUMNS - 5, + map { platform->isobj($_) ? platform->dep($_) : () } + grep { $unified_info{sources}->{$_}->[0] =~ /\.c$/ } + keys %{$unified_info{sources}})); -} {- output_on() if $disabled{makedepend}; "" -} -GENERATED_MANDATORY={- join(" ", @{$unified_info{depends}->{""}}) -} +GENERATED_MANDATORY={- join(" \\\n" . ' ' x 20, + fill_lines(" ", $COLUMNS - 20, + @{$unified_info{depends}->{""}})) -} GENERATED={- # common0.tmpl provides @generated - join(" ", map { platform->convertext($_) } @generated ) -} + join(" \\\n" . ' ' x 5, + fill_lines(" ", $COLUMNS - 5, + map { platform->convertext($_) } @generated )) -} INSTALL_LIBS={- - join(" ", map { platform->staticlib($_) // () } - grep { !$unified_info{attributes}->{$_}->{noinst} } - @{$unified_info{libraries}}) + join(" \\\n" . ' ' x 13, + fill_lines(" ", $COLUMNS - 13, + map { platform->staticlib($_) // () } + grep { !$unified_info{attributes}->{libraries}->{$_}->{noinst} } + @{$unified_info{libraries}})) -} INSTALL_SHLIBS={- - join(" ", map { platform->sharedlib($_) // () } - grep { !$unified_info{attributes}->{$_}->{noinst} } - @{$unified_info{libraries}}) + join(" \\\n" . ' ' x 15, + fill_lines(" ", $COLUMNS - 15, + map { platform->sharedlib($_) // () } + grep { !$unified_info{attributes}->{libraries}->{$_}->{noinst} } + @{$unified_info{libraries}})) -} INSTALL_SHLIB_INFO={- - join(" ", map { my $x = platform->sharedlib($_); - my $y = platform->sharedlib_simple($_); - $x ? "\"$x;$y\"" : () } - grep { !$unified_info{attributes}->{$_}->{noinst} } - @{$unified_info{libraries}}) + join(" \\\n" . ' ' x 19, + fill_lines(" ", $COLUMNS - 19, + map { my $x = platform->sharedlib($_); + my $y = platform->sharedlib_simple($_); + $x ? "\"$x;$y\"" : () } + grep { !$unified_info{attributes}->{libraries}->{$_}->{noinst} } + @{$unified_info{libraries}})) -} INSTALL_ENGINES={- - join(" ", map { platform->dso($_) } - grep { !$unified_info{attributes}->{$_}->{noinst} - && $unified_info{attributes}->{$_}->{engine} } - @{$unified_info{modules}}) + join(" \\\n" . ' ' x 16, + fill_lines(" ", $COLUMNS - 16, + map { platform->dso($_) } + grep { !$unified_info{attributes}->{modules}->{$_}->{noinst} + && $unified_info{attributes}->{modules}->{$_}->{engine} } + @{$unified_info{modules}})) -} INSTALL_PROGRAMS={- - join(" ", map { platform->bin($_) } - grep { !$unified_info{attributes}->{$_}->{noinst} } - @{$unified_info{programs}}) + join(" \\\n" . ' ' x 16, + fill_lines(" ", $COLUMNS - 16, map { platform->bin($_) } + grep { !$unified_info{attributes}->{programs}->{$_}->{noinst} } + @{$unified_info{programs}})) -} BIN_SCRIPTS={- - join(" ", map { my $x = $unified_info{attributes}->{$_}->{linkname}; - $x ? "$_:$x" : $_ } - grep { !$unified_info{attributes}->{$_}->{noinst} - && !$unified_info{attributes}->{$_}->{misc} } - @{$unified_info{scripts}}) + join(" \\\n" . ' ' x 12, + fill_lines(" ", $COLUMNS - 12, + map { my $x = $unified_info{attributes}->{scripts}->{$_}->{linkname}; + $x ? "$_:$x" : $_ } + grep { !$unified_info{attributes}->{scripts}->{$_}->{noinst} + && !$unified_info{attributes}->{scripts}->{$_}->{misc} } + @{$unified_info{scripts}})) -} MISC_SCRIPTS={- - join(" ", map { my $x = $unified_info{attributes}->{$_}->{linkname}; - $x ? "$_:$x" : $_ } - grep { !$unified_info{attributes}->{$_}->{noinst} - && $unified_info{attributes}->{$_}->{misc} } - @{$unified_info{scripts}}) + join(" \\\n" . ' ' x 13, + fill_lines(" ", $COLUMNS - 13, + map { my $x = $unified_info{attributes}->{scripts}->{$_}->{linkname}; + $x ? "$_:$x" : $_ } + grep { !$unified_info{attributes}->{scripts}->{$_}->{noinst} + && $unified_info{attributes}->{scripts}->{$_}->{misc} } + @{$unified_info{scripts}})) -} APPS_OPENSSL={- use File::Spec::Functions; @@ -729,7 +797,7 @@ generate: generate_apps generate_crypto_bn generate_crypto_objects \ .PHONY: doc-nits doc-nits: build_generated - (cd $(SRCDIR); $(PERL) util/find-doc-nits -n -p -s ) + (cd $(SRCDIR); $(PERL) util/find-doc-nits -n -e ) # Test coverage is a good idea for the future #coverage: $(PROGRAMS) $(TESTPROGRAMS) @@ -823,8 +891,10 @@ errors: } ""; -} -CRYPTOHEADERS={- join(" \\\n\t", sort @cryptoheaders) -} -SSLHEADERS={- join(" \\\n\t", sort @sslheaders) -} +CRYPTOHEADERS={- join(" \\\n" . ' ' x 14, + fill_lines(" ", $COLUMNS - 14, sort @cryptoheaders)) -} +SSLHEADERS={- join(" \\\n" . ' ' x 11, + fill_lines(" ", $COLUMNS - 11, sort @sslheaders)) -} ordinals: ( cd $(SRCDIR); \ $(PERL) util/mknum.pl --version $(VERSION) --no-warnings \ @@ -918,7 +988,12 @@ openssl.pc: echo 'Version: '$(VERSION); \ echo 'Requires: libssl libcrypto' ) > openssl.pc -configdata.pm: $(SRCDIR)/Configure $(SRCDIR)/config {- join(" ", @{$config{build_file_templates}}, @{$config{build_infos}}, @{$config{conf_files}}) -} +configdata.pm: $(SRCDIR)/Configure $(SRCDIR)/config \ + {- join(" \\\n" . ' ' x 15, + fill_lines(" ", $COLUMNS - 15, + @{$config{build_file_templates}}, + @{$config{build_infos}}, + @{$config{conf_files}})) -} @echo "Detected changed: $?" $(PERL) configdata.pm -r @echo "**************************************************" @@ -966,10 +1041,14 @@ EOF my $dofile = abs2rel(rel2abs(catfile($config{sourcedir}, "util", "dofile.pl")), rel2abs($config{builddir})); + my @modules = ( 'configdata.pm', + grep { $_ =~ m|\.pm$| } @{$args{deps}} ); + my %moduleincs = map { '"-I'.dirname($_).'"' => 1 } @modules; + @modules = map { "-M".basename($_, '.pm') } @modules; + my $modules = join(' ', '', sort keys %moduleincs, @modules); return <<"EOF"; -$args{src}: $args{generator}->[0] $deps - \$(PERL) "-I\$(BLDDIR)" -Mconfigdata "$dofile" \\ - "-o$target{build_file}" $generator > \$@ +$args{src}: $args{generator}->[0] $deps \$(BLDDIR)/configdata.pm + \$(PERL)$modules "$dofile" "-o$target{build_file}" $generator > \$@ EOF } else { return <<"EOF"; @@ -1015,7 +1094,7 @@ EOF # last in the line. We may therefore need to put back a line ending. sub src2obj { my %args = @_; - my $obj = platform->obj($args{obj}); + my $obj = platform->convertext($args{obj}); my $dep = platform->dep($args{obj}); my @srcs = @{$args{srcs}}; my $srcs = join(" ", @srcs); @@ -1095,15 +1174,22 @@ EOF sub obj2shlib { my %args = @_; my @linkdirs = (); - foreach (@{args{deps}}) { - my $d = dirname($_); - push @linkdirs, $d unless grep { $d eq $_ } @linkdirs; + my @linklibs = (); + foreach (@{$args{deps}}) { + if (platform->isstaticlib($_)) { + push @linklibs, platform->convertext($_); + } else { + my $d = "-L" . dirname($_); + my $l = basename($_); + $l =~ s/^lib//; + $l = "-l" . $l; + push @linklibs, $l; + push @linkdirs, $d unless grep { $d eq $_ } @linkdirs; + } } - my $linkflags = join("", map { "-L$_ " } @linkdirs); - my $linklibs = join("", map { my $f = basename($_); - (my $l = $f) =~ s/^lib//; - " -l$l" } @{$args{deps}}); - my @objs = map { platform->obj($_) } + my $linkflags = join("", map { $_." " } @linkdirs); + my $linklibs = join("", map { $_." " } @linklibs); + my @objs = map { platform->convertext($_) } grep { !platform->isdef($_) } @{$args{objs}}; my @defs = map { platform->def($_) } @@ -1111,8 +1197,7 @@ EOF @{$args{objs}}; my @deps = compute_lib_depends(@{$args{deps}}); die "More than one exported symbol map" if scalar @defs > 1; - my $objs = join(" ", @objs); - my $deps = join(" ", @objs, @defs, @deps); + my $simple = platform->sharedlib_simple($args{lib}); my $full = platform->sharedlib($args{lib}); my $shared_soname = ""; @@ -1122,6 +1207,12 @@ EOF $shared_imp .= ' '.$target{shared_impflag}.basename($simple) if defined $target{shared_impflag}; my $shared_def = join("", map { ' '.$target{shared_defflag}.$_ } @defs); + + my $objs = join(" \\\n\t\t", fill_lines(' ', $COLUMNS - 16, @objs)); + my $deps = join(" \\\n" . ' ' x (length($full) + 2), + fill_lines(' ', $COLUMNS - length($full) - 2, + @objs, @defs, @deps)); + my $recipe = <<"EOF"; $simple: $full EOF @@ -1139,8 +1230,9 @@ EOF $recipe .= <<"EOF"; $full: $deps \$(CC) \$(LIB_CFLAGS) $linkflags\$(LIB_LDFLAGS)$shared_soname$shared_imp \\ - -o $full$shared_def $objs \\ - $linklibs \$(LIB_EX_LIBS) + -o $full$shared_def \\ + $objs \\ + $linklibs \$(LIB_EX_LIBS) EOF if (windowsdll()) { $recipe .= <<"EOF"; @@ -1156,38 +1248,52 @@ EOF } sub obj2dso { my %args = @_; - my $dso = platform->dso($args{lib}); + my $dso = platform->dso($args{module}); my @linkdirs = (); - foreach (@{args{deps}}) { - my $d = dirname($_); - push @linkdirs, $d unless grep { $d eq $_ } @linkdirs; + my @linklibs = (); + foreach (@{$args{deps}}) { + next unless defined $_; + if (platform->isstaticlib($_)) { + push @linklibs, platform->convertext($_); + } else { + my $d = "-L" . dirname($_); + my $l = basename($_); + $l =~ s/^lib//; + $l = "-l" . $l; + push @linklibs, $l; + push @linkdirs, $d unless grep { $d eq $_ } @linkdirs; + } } - my $linkflags = join("", map { "-L$_ " } @linkdirs); - my $linklibs = join("", map { my $f = basename($_); - (my $l = $f) =~ s/^lib//; - " -l$l" } @{$args{deps}}); - my @objs = map { platform->obj($_) } + my $linkflags = join("", map { $_." " } @linkdirs); + my $linklibs = join("", map { $_." " } @linklibs); + my @objs = map { platform->convertext($_) } grep { !platform->isdef($_) } @{$args{objs}}; my @defs = map { platform->def($_) } grep { platform->isdef($_) } @{$args{objs}}; my @deps = compute_lib_depends(@{$args{deps}}); - my $objs = join(" ", @objs); - my $deps = join(" ", @objs, @defs, @deps); my $shared_def = join("", map { ' '.$target{shared_defflag}.$_ } @defs); + + my $objs = join(" \\\n\t\t", fill_lines(' ', $COLUMNS - 16, @objs)); + my $deps = join(" \\\n" . ' ' x (length($dso) + 2), + fill_lines(' ', $COLUMNS - length($dso) - 2, + @objs, @defs, @deps)); + return <<"EOF"; $dso: $deps \$(CC) \$(DSO_CFLAGS) $linkflags\$(DSO_LDFLAGS) \\ - -o $dso$shared_def $objs \\ - $linklibs \$(DSO_EX_LIBS) + -o $dso$shared_def \\ + $objs \\ + $linklibs\$(DSO_EX_LIBS) EOF } sub obj2lib { my %args = @_; my $lib = platform->staticlib($args{lib}); my @objs = map { platform->obj($_) } @{$args{objs}}; - my $objs = join(" ", @objs); + my $objs = join(" \\\n" . ' ' x (length($lib) + 2), + fill_lines(' ', $COLUMNS - length($lib) - 2, @objs)); return <<"EOF"; $lib: $objs \$(AR) \$(ARFLAGS) \$\@ \$\? @@ -1197,35 +1303,46 @@ EOF sub obj2bin { my %args = @_; my $bin = platform->bin($args{bin}); - my $objs = join(" ", map { platform->obj($_) } @{$args{objs}}); - my $deps = join(" ", compute_lib_depends(@{$args{deps}})); + my @objs = map { platform->obj($_) } @{$args{objs}}; + my @deps = compute_lib_depends(@{$args{deps}}); + my $objs = join(" \\\n" . ' ' x (length($bin) + 2), + fill_lines(' ', $COLUMNS - length($bin) - 2, @objs)); my @linkdirs = (); - foreach (@{args{deps}}) { - next if $_ =~ /\.a$/; - my $d = dirname($_); - push @linkdirs, $d unless grep { $d eq $_ } @linkdirs; + my @linklibs = (); + foreach (@{$args{deps}}) { + next unless defined $_; + if (platform->isstaticlib($_)) { + push @linklibs, platform->convertext($_); + } else { + my $d = "-L" . dirname($_); + my $l = basename($_); + $l =~ s/^lib//; + $l = "-l" . $l; + push @linklibs, $l; + push @linkdirs, $d unless grep { $d eq $_ } @linkdirs; + } } - my $linkflags = join("", map { "-L$_ " } @linkdirs); - my $linklibs = join("", map { if ($_ =~ m/\.a$/) { - " ".platform->staticlib($_); - } else { - my $f = basename($_); - (my $l = $f) =~ s/^lib//; - " -l$l" - } - } @{$args{deps}}); + my $linkflags = join("", map { $_." " } @linkdirs); + my $linklibs = join("", map { $_." " } @linklibs); my $cmd = '$(CC)'; my $cmdflags = '$(BIN_CFLAGS)'; if (grep /_cc\.o$/, @{$args{objs}}) { $cmd = '$(CXX)'; $cmdflags = '$(BIN_CXXFLAGS)'; } + + my $objs = join(" \\\n\t\t", fill_lines(' ', $COLUMNS - 16, @objs)); + my $deps = join(" \\\n" . ' ' x (length($bin) + 2), + fill_lines(' ', $COLUMNS - length($bin) - 2, + @objs, @deps)); + return <<"EOF"; -$bin: $objs $deps +$bin: $deps rm -f $bin \$\${LDCMD:-$cmd} $cmdflags $linkflags\$(BIN_LDFLAGS) \\ - -o $bin $objs \\ - $linklibs \$(BIN_EX_LIBS) + -o $bin \\ + $objs \\ + $linklibs\$(BIN_EX_LIBS) EOF } sub in2script { @@ -1246,7 +1363,7 @@ EOF my %args = @_; my $dir = $args{dir}; my @deps = map { platform->convertext($_) } @{$args{deps}}; - my @actions = (); + my @comments = (); my %extinfo = ( dso => platform->dsoext(), lib => platform->libext(), bin => platform->binext() ); @@ -1266,16 +1383,19 @@ EOF if (dirname($prod) eq $dir) { push @deps, $prod.$extinfo{$type}; } else { - push @actions, "\t@ : No support to produce $type ".join(", ", @{$unified_info{dirinfo}->{$dir}->{products}->{$type}}); + push @comments, "# No support to produce $type ".join(", ", @{$unified_info{dirinfo}->{$dir}->{products}->{$type}}); } } } } - my $deps = join(" ", @deps); - my $actions = join("\n", "", @actions); + my $target = "$dir $dir/"; + my $deps = join(" \\\n\t", + fill_lines(' ', $COLUMNS - 8, @deps)); + my $comments = join("\n", "", @comments); return <<"EOF"; -$dir $dir/: $deps$actions +$target: \\ + $deps$comments EOF } "" # Important! This becomes part of the template result. diff --git a/Configurations/windows-makefile.tmpl b/Configurations/windows-makefile.tmpl index bfe88f6c..19e3f4e0 100644 --- a/Configurations/windows-makefile.tmpl +++ b/Configurations/windows-makefile.tmpl @@ -62,53 +62,53 @@ GENERATED={- # common0.tmpl provides @generated INSTALL_LIBS={- join(" ", map { quotify1(platform->sharedlib_import($_) // platform->staticlib($_)) } - grep { !$unified_info{attributes}->{$_}->{noinst} } + grep { !$unified_info{attributes}->{libraries}->{$_}->{noinst} } @{$unified_info{libraries}}) -} INSTALL_SHLIBS={- join(" ", map { my $x = platform->sharedlib($_); $x ? quotify_l($x) : () } - grep { !$unified_info{attributes}->{$_}->{noinst} } + grep { !$unified_info{attributes}->{libraries}->{$_}->{noinst} } @{$unified_info{libraries}}) -} INSTALL_SHLIBPDBS={- join(" ", map { my $x = platform->sharedlibpdb($_); $x ? quotify_l($x) : () } - grep { !$unified_info{attributes}->{$_}->{noinst} } + grep { !$unified_info{attributes}->{libraries}->{$_}->{noinst} } @{$unified_info{libraries}}) -} INSTALL_ENGINES={- join(" ", map { quotify1(platform->dso($_)) } - grep { !$unified_info{attributes}->{$_}->{noinst} - && $unified_info{attributes}->{$_}->{engine} } + grep { !$unified_info{attributes}->{modules}->{$_}->{noinst} + && $unified_info{attributes}->{modules}->{$_}->{engine} } @{$unified_info{modules}}) -} INSTALL_ENGINEPDBS={- join(" ", map { quotify1(platform->dsopdb($_)) } - grep { !$unified_info{attributes}->{$_}->{noinst} - && $unified_info{attributes}->{$_}->{engine} } + grep { !$unified_info{attributes}->{modules}->{$_}->{noinst} + && $unified_info{attributes}->{modules}->{$_}->{engine} } @{$unified_info{modules}}) -} INSTALL_PROGRAMS={- join(" ", map { quotify1(platform->bin($_)) } - grep { !$unified_info{attributes}->{$_}->{noinst} } + grep { !$unified_info{attributes}->{programs}->{$_}->{noinst} } @{$unified_info{programs}}) -} INSTALL_PROGRAMPDBS={- join(" ", map { quotify1(platform->binpdb($_)) } - grep { !$unified_info{attributes}->{$_}->{noinst} } + grep { !$unified_info{attributes}->{programs}->{$_}->{noinst} } @{$unified_info{programs}}) -} BIN_SCRIPTS={- join(" ", map { quotify1($_) } - grep { !$unified_info{attributes}->{$_}->{noinst} - && !$unified_info{attributes}->{$_}->{misc} } + grep { !$unified_info{attributes}->{scripts}->{$_}->{noinst} + && !$unified_info{attributes}->{scripts}->{$_}->{misc} } @{$unified_info{scripts}}) -} MISC_SCRIPTS={- join(" ", map { quotify1($_) } - grep { !$unified_info{attributes}->{$_}->{noinst} - && $unified_info{attributes}->{$_}->{misc} } + grep { !$unified_info{attributes}->{scripts}->{$_}->{noinst} + && $unified_info{attributes}->{scripts}->{$_}->{misc} } @{$unified_info{scripts}}) -} @@ -558,10 +558,14 @@ EOF my $dofile = abs2rel(rel2abs(catfile($config{sourcedir}, "util", "dofile.pl")), rel2abs($config{builddir})); + my @modules = ( 'configdata.pm', + grep { $_ =~ m|\.pm$| } @{$args{deps}} ); + my %moduleincs = map { '"-I'.dirname($_).'"' => 1 } @modules; + @modules = map { "-M".basename($_, '.pm') } @modules; + my $modules = join(' ', '', sort keys %moduleincs, @modules); return <<"EOF"; $target: "$args{generator}->[0]" $deps - "\$(PERL)" "-I\$(BLDDIR)" -Mconfigdata "$dofile" \\ - "-o$target{build_file}" $generator > \$@ + "\$(PERL)"$modules "$dofile" "-o$target{build_file}" $generator > \$@ EOF } else { return <<"EOF"; @@ -714,8 +718,8 @@ EOF } sub obj2dso { my %args = @_; - my $dso = platform->dso($args{lib}); - my $dso_n = platform->dsoname($args{lib}); + my $dso = platform->dso($args{module}); + my $dso_n = platform->dsoname($args{module}); my @objs = map { platform->convertext($_) } grep { platform->isobj($_) || platform->isres($_) } @{$args{objs}}; diff --git a/Configure b/Configure index 4415e1d6..3df3e0c9 100755 --- a/Configure +++ b/Configure @@ -73,7 +73,15 @@ my $usage="Usage: Configure [no- ...] [enable- ...] [-Dxxx] [-lx # no-sse2 disables IA-32 SSE2 code in assembly modules, the above # mentioned '386' option implies this one # no- build without specified algorithm (rsa, idea, rc5, ...) -# - + compiler options are passed through +# - + All options which are unknown to the 'Configure' script are +# / passed through to the compiler. Unix-style options beginning +# with a '-' or '+' are recognized, as well as Windows-style +# options beginning with a '/'. If the option contains arguments +# separated by spaces, then the URL-style notation %20 can be +# used for the space character in order to avoid having to quote +# the option. For example, -opt%20arg gets expanded to -opt arg. +# In fact, any ASCII character can be encoded as %xx using its +# hexadecimal encoding. # -static while -static is also a pass-through compiler option (and # as such is limited to environments where it's actually # meaningful), it triggers a number configuration options, @@ -518,7 +526,7 @@ my @disable_cascades = ( # or modules. "pic" => [ "shared", "module" ], - "module" => [ "fips", "legacy" ], + "module" => [ "fips" ], "engine" => [ grep /eng$/, @disablables ], "hw" => [ "padlockeng" ], @@ -821,7 +829,7 @@ while (@argvcopy) { die "FIPS mode not supported\n"; } - elsif (/^[-+]/) + elsif (m|^[-+/]|) { if (/^--prefix=(.*)$/) { @@ -898,11 +906,11 @@ while (@argvcopy) { push @{$useradd{LDFLAGS}}, $_; } - elsif (/^-D(.*)$/) + elsif (m|^[-/]D(.*)$|) { push @{$useradd{CPPDEFINES}}, $1; } - elsif (/^-I(.*)$/) + elsif (m|^[-/]I(.*)$|) { push @{$useradd{CPPINCLUDES}}, $1; } @@ -912,11 +920,23 @@ while (@argvcopy) } else # common if (/^[-+]/), just pass down... { + # Treat %xx as an ASCII code (e.g. replace %20 by a space character). + # This provides a simple way to pass options with arguments separated + # by spaces without quoting (e.g. -opt%20arg translates to -opt arg). $_ =~ s/%([0-9a-f]{1,2})/chr(hex($1))/gei; push @{$useradd{CFLAGS}}, $_; push @{$useradd{CXXFLAGS}}, $_; } } + elsif (m|^/|) + { + # Treat %xx as an ASCII code (e.g. replace %20 by a space character). + # This provides a simple way to pass options with arguments separated + # by spaces without quoting (e.g. /opt%20arg translates to /opt arg). + $_ =~ s/%([0-9a-f]{1,2})/chr(hex($1))/gei; + push @{$useradd{CFLAGS}}, $_; + push @{$useradd{CXXFLAGS}}, $_; + } else { die "target already defined - $target (offending arg: $_)\n" if ($target ne ""); @@ -1724,7 +1744,6 @@ if ($builder eq "unified") { my @modules = (); my @scripts = (); - my %attributes = (); my %sources = (); my %shared_sources = (); my %includes = (); @@ -1737,19 +1756,56 @@ if ($builder eq "unified") { # contains a dollar sign, it had better be escaped, or it will be # taken for a variable name prefix. my %variables = (); - my $variable_re = qr/\$([[:alpha:]][[:alnum:]_]*)/; + my $variable_re = qr/\$(?P[[:alpha:]][[:alnum:]_]*)/; my $expand_variables = sub { my $value = ''; my $value_rest = shift; + if ($ENV{CONFIGURE_DEBUG_VARIABLE_EXPAND}) { + print STDERR + "DEBUG[\$expand_variables] Parsed '$value_rest' into:\n" + } while ($value_rest =~ /(?{$g}->{$ak} = $av; + } else { + delete $$ref->{$g}->{$ak}; + } + } + } + }; + # We want to detect configdata.pm in the source tree, so we # don't use it if the build tree is different. my $src_configdata = cleanfile($srcdir, "configdata.pm", $blddir); @@ -1779,148 +1835,129 @@ if ($builder eq "unified") { # 1 last was positive (don't skip lines until next ELSE, ELSIF or ENDIF) # 2 positive ELSE (following ELSIF should fail) my @skip = (); + + # A few useful generic regexps + my $index_re = qr/\[\s*(?P(?:\\.|.)*?)\s*\]/; + my $cond_re = qr/\[\s*(?P(?:\\.|.)*?)\s*\]/; + my $attribs_re = qr/(?:\{\s*(?P(?:\\.|.)*?)\s*\})?/; + my $value_re = qr/\s*(?P.*?)\s*/; collect_information( collect_from_array([ @text ], qr/\\$/ => sub { my $l1 = shift; my $l2 = shift; $l1 =~ s/\\$//; $l1.$l2 }), # Info we're looking for - qr/^\s*IF\[((?:\\.|[^\\\]])*)\]\s*$/ + qr/^\s* IF ${cond_re} \s*$/x => sub { if (! @skip || $skip[$#skip] > 0) { - push @skip, !! $expand_variables->($1); + push @skip, !! $expand_variables->($+{COND}); } else { push @skip, -1; } }, - qr/^\s*ELSIF\[((?:\\.|[^\\\]])*)\]\s*$/ + qr/^\s* ELSIF ${cond_re} \s*$/x => sub { die "ELSIF out of scope" if ! @skip; die "ELSIF following ELSE" if abs($skip[$#skip]) == 2; $skip[$#skip] = -1 if $skip[$#skip] != 0; - $skip[$#skip] = !! $expand_variables->($1) + $skip[$#skip] = !! $expand_variables->($+{COND}) if $skip[$#skip] == 0; }, - qr/^\s*ELSE\s*$/ + qr/^\s* ELSE \s*$/x => sub { die "ELSE out of scope" if ! @skip; $skip[$#skip] = -2 if $skip[$#skip] != 0; $skip[$#skip] = 2 if $skip[$#skip] == 0; }, - qr/^\s*ENDIF\s*$/ + qr/^\s* ENDIF \s*$/x => sub { die "ENDIF out of scope" if ! @skip; pop @skip; }, - qr/^\s*${variable_re}\s*=\s*(.*?)\s*$/ + qr/^\s* ${variable_re} \s* = ${value_re} $/x => sub { if (!@skip || $skip[$#skip] > 0) { - my $n = $1; - my $v = $2; - $variables{$n} = $expand_variables->($v); + $variables{$+{VARIABLE}} = $expand_variables->($+{VALUE}); } }, - qr/^\s*SUBDIRS\s*=\s*(.*)\s*$/ + qr/^\s* SUBDIRS \s* = ${value_re} $/x => sub { if (!@skip || $skip[$#skip] > 0) { - foreach (tokenize($expand_variables->($1))) { + foreach (tokenize($expand_variables->($+{VALUE}))) { push @build_dirs, [ @curd, splitdir($_, 1) ]; } } }, - qr/^\s*PROGRAMS(?:{([\w=]+(?:\s*,\s*[\w=]+)*)})?\s*=\s*(.*)\s*$/ + qr/^\s* PROGRAMS ${attribs_re} \s* = ${value_re} $/x => sub { if (!@skip || $skip[$#skip] > 0) { - my @a = tokenize($1, qr|\s*,\s*|); - my @p = tokenize($expand_variables->($2)); + my @p = tokenize($expand_variables->($+{VALUE})); push @programs, @p; - foreach my $a (@a) { - my $ak = $a; - my $av = 1; - if ($a =~ m|^(.*?)\s*=\s*(.*?)$|) { - $ak = $1; - $av = $2; - } - foreach my $p (@p) { - $attributes{$p}->{$ak} = $av; - } - } + $handle_attributes->($+{ATTRIBS}, + \$attributes{programs}, + @p); } }, - qr/^\s*LIBS(?:{([\w=]+(?:\s*,\s*[\w=]+)*)})?\s*=\s*(.*)\s*$/ + qr/^\s* LIBS ${attribs_re} \s* = ${value_re} $/x => sub { if (!@skip || $skip[$#skip] > 0) { - my @a = tokenize($1, qr|\s*,\s*|); - my @l = tokenize($expand_variables->($2)); + my @l = tokenize($expand_variables->($+{VALUE})); push @libraries, @l; - foreach my $a (@a) { - my $ak = $a; - my $av = 1; - if ($a =~ m|^(.*?)\s*=\s*(.*?)$|) { - $ak = $1; - $av = $2; - } - foreach my $l (@l) { - $attributes{$l}->{$ak} = $av; - } - } + $handle_attributes->($+{ATTRIBS}, + \$attributes{libraries}, + @l); } }, - qr/^\s*MODULES(?:{([\w=]+(?:\s*,\s*[\w=]+)*)})?\s*=\s*(.*)\s*$/ + qr/^\s* MODULES ${attribs_re} \s* = ${value_re} $/x => sub { if (!@skip || $skip[$#skip] > 0) { - my @a = tokenize($1, qr|\s*,\s*|); - my @m = tokenize($expand_variables->($2)); + my @m = tokenize($expand_variables->($+{VALUE})); push @modules, @m; - foreach my $a (@a) { - my $ak = $a; - my $av = 1; - if ($a =~ m|^(.*?)\s*=\s*(.*?)$|) { - $ak = $1; - $av = $2; - } - foreach my $m (@m) { - $attributes{$m}->{$ak} = $av; - } - } + $handle_attributes->($+{ATTRIBS}, + \$attributes{modules}, + @m); } }, - qr/^\s*SCRIPTS(?:{([\w=]+(?:\s*,\s*[\w=]+)*)})?\s*=\s*(.*)\s*$/ + qr/^\s* SCRIPTS ${attribs_re} \s* = ${value_re} $/x => sub { if (!@skip || $skip[$#skip] > 0) { - my @a = tokenize($1, qr|\s*,\s*|); - my @s = tokenize($expand_variables->($2)); + my @s = tokenize($expand_variables->($+{VALUE})); push @scripts, @s; - foreach my $a (@a) { - my $ak = $a; - my $av = 1; - if ($a =~ m|^(.*?)\s*=\s*(.*?)$|) { - $ak = $1; - $av = $2; - } - foreach my $s (@s) { - $attributes{$s}->{$ak} = $av; - } - } + $handle_attributes->($+{ATTRIBS}, + \$attributes{scripts}, + @s); } }, - qr/^\s*ORDINALS\[((?:\\.|[^\\\]])+)\]\s*=\s*(.*)\s*$/, - => sub { push @{$ordinals{$1}}, tokenize($expand_variables->($2)) + qr/^\s* ORDINALS ${index_re} = ${value_re} $/x + => sub { push @{$ordinals{$expand_variables->($+{INDEX})}}, + tokenize($expand_variables->($+{VALUE})) if !@skip || $skip[$#skip] > 0 }, - qr/^\s*SOURCE\[((?:\\.|[^\\\]])+)\]\s*=\s*(.*)\s*$/ - => sub { push @{$sources{$1}}, tokenize($expand_variables->($2)) + qr/^\s* SOURCE ${index_re} = ${value_re} $/x + => sub { push @{$sources{$expand_variables->($+{INDEX})}}, + tokenize($expand_variables->($+{VALUE})) if !@skip || $skip[$#skip] > 0 }, - qr/^\s*SHARED_SOURCE\[((?:\\.|[^\\\]])+)\]\s*=\s*(.*)\s*$/ - => sub { push @{$shared_sources{$1}}, - tokenize($expand_variables->($2)) + qr/^\s* SHARED_SOURCE ${index_re} = ${value_re} $/x + => sub { push @{$shared_sources{$expand_variables->($+{INDEX})}}, + tokenize($expand_variables->($+{VALUE})) if !@skip || $skip[$#skip] > 0 }, - qr/^\s*INCLUDE\[((?:\\.|[^\\\]])+)\]\s*=\s*(.*)\s*$/ - => sub { push @{$includes{$1}}, tokenize($expand_variables->($2)) + qr/^\s* INCLUDE ${index_re} = ${value_re} $/x + => sub { push @{$includes{$expand_variables->($+{INDEX})}}, + tokenize($expand_variables->($+{VALUE})) if !@skip || $skip[$#skip] > 0 }, - qr/^\s*DEFINE\[((?:\\.|[^\\\]])*)\]\s*=\s*(.*)\s*$/ - => sub { push @{$defines{$1}}, tokenize($expand_variables->($2)) + qr/^\s* DEFINE ${index_re} = ${value_re} $/x + => sub { push @{$defines{$expand_variables->($+{INDEX})}}, + tokenize($expand_variables->($+{VALUE})) if !@skip || $skip[$#skip] > 0 }, - qr/^\s*DEPEND\[((?:\\.|[^\\\]])*)\]\s*=\s*(.*)\s*$/ - => sub { push @{$depends{$1}}, tokenize($expand_variables->($2)) + qr/^\s* DEPEND ${index_re} ${attribs_re} = ${value_re} $/x + => sub { + if (!@skip || $skip[$#skip] > 0) { + my $i = $expand_variables->($+{INDEX}); + my @d = tokenize($expand_variables->($+{VALUE})); + push @{$depends{$i}}, @d; + $handle_attributes->($+{ATTRIBS}, + \$attributes{depends}->{$i}, + @d); + } + }, + qr/^\s* GENERATE ${index_re} = ${value_re} $/x + => sub { push @{$generate{$expand_variables->($+{INDEX})}}, + $+{VALUE} if !@skip || $skip[$#skip] > 0 }, - qr/^\s*GENERATE\[((?:\\.|[^\\\]])+)\]\s*=\s*(.*)\s*$/ - => sub { push @{$generate{$1}}, $2 - if !@skip || $skip[$#skip] > 0 }, - qr/^\s*(?:#.*)?$/ => sub { }, + qr/^\s* (?:\#.*)? $/x => sub { }, "OTHERWISE" => sub { die "Something wrong with this line:\n$_\nat $sourced/$f" }, "BEFORE" => sub { if ($buildinfo_debug) { @@ -1936,7 +1973,7 @@ if ($builder eq "unified") { ); die "runaway IF?" if (@skip); - if (grep { defined $attributes{$_}->{engine} } keys %attributes + if (grep { defined $attributes{modules}->{$_}->{engine} } keys %attributes and !$config{dynamic_engines}) { die <<"EOF" ENGINES can only be used if configured with 'dynamic-engine'. @@ -1944,15 +1981,6 @@ This is usually a fault in a build.info file. EOF } - foreach (keys %attributes) { - my $dest = $_; - my $ddest = cleanfile($buildd, $_, $blddir); - foreach (keys %{$attributes{$dest} // {}}) { - $unified_info{attributes}->{$ddest}->{$_} = - $attributes{$dest}->{$_}; - } - } - { my %infos = ( programs => [ @programs ], libraries => [ @libraries ], @@ -1962,6 +1990,11 @@ EOF foreach (@{$infos{$k}}) { my $item = cleanfile($buildd, $_, $blddir); $unified_info{$k}->{$item} = 1; + + # Fix up associated attributes + $unified_info{attributes}->{$k}->{$item} = + $attributes{$k}->{$_} + if defined $attributes{$k}->{$_}; } } } @@ -2090,6 +2123,11 @@ EOF my $e = $1 // ""; $d = $`.$e; $unified_info{depends}->{$ddest}->{$d} = 1; + + # Fix up associated attributes + $unified_info{attributes}->{depends}->{$ddest}->{$d} = + $attributes{depends}->{$dest}->{$_} + if defined $attributes{depends}->{$dest}->{$_}; } } diff --git a/INSTALL b/INSTALL index d576548c..c818ed72 100644 --- a/INSTALL +++ b/INSTALL @@ -641,10 +641,19 @@ Take note of the VAR=value documentation below and how these flags interact with those variables. - -xxx, +xxx + -xxx, +xxx, /xxx Additional options that are not otherwise recognised are - passed through as they are to the compiler as well. Again, - consult your compiler documentation. + passed through as they are to the compiler as well. + Unix-style options beginning with a '-' or '+' and + Windows-style options beginning with a '/' are recognized. + Again, consult your compiler documentation. + + If the option contains arguments separated by spaces, + then the URL-style notation %20 can be used for the space + character in order to avoid having to quote the option. + For example, -opt%20arg gets expanded to -opt arg. + In fact, any ASCII character can be encoded as %xx using its + hexadecimal encoding. Take note of the VAR=value documentation below and how these flags interact with those variables. diff --git a/apps/cms.c b/apps/cms.c index 9c9f01d3..0e0df5e0 100644 --- a/apps/cms.c +++ b/apps/cms.c @@ -104,20 +104,29 @@ const OPTIONS cms_options[] = { {"resign", OPT_RESIGN, '-', "Resign a signed message"}, {"cades", OPT_CADES, '-', "Include signer certificate digest"}, {"verify", OPT_VERIFY, '-', "Verify signed message"}, - {"verify_retcode", OPT_VERIFY_RETCODE, '-'}, - {"verify_receipt", OPT_VERIFY_RECEIPT, '<'}, + {"verify_retcode", OPT_VERIFY_RETCODE, '-', + "Exit non-zero on verification failure"}, + {"verify_receipt", OPT_VERIFY_RECEIPT, '<', + "Verify receipts; exit if receipt signatures do not verify"}, {"cmsout", OPT_CMSOUT, '-', "Output CMS structure"}, - {"data_out", OPT_DATA_OUT, '-'}, - {"data_create", OPT_DATA_CREATE, '-'}, - {"digest_verify", OPT_DIGEST_VERIFY, '-'}, - {"digest_create", OPT_DIGEST_CREATE, '-'}, - {"compress", OPT_COMPRESS, '-'}, - {"uncompress", OPT_UNCOMPRESS, '-'}, - {"EncryptedData_decrypt", OPT_ED_DECRYPT, '-'}, - {"EncryptedData_encrypt", OPT_ED_ENCRYPT, '-'}, - {"debug_decrypt", OPT_DEBUG_DECRYPT, '-'}, + {"data_out", OPT_DATA_OUT, '-', "Copy CMS \"Data\" object to output"}, + {"data_create", OPT_DATA_CREATE, '-', "Create a CMS \"Data\" object"}, + {"digest_verify", OPT_DIGEST_VERIFY, '-', + "Verify a CMS \"DigestedData\" object and output it"}, + {"digest_create", OPT_DIGEST_CREATE, '-', + "Create a CMS \"DigestedData\" object"}, + {"compress", OPT_COMPRESS, '-', "Create a CMS \"CompressedData\" object"}, + {"uncompress", OPT_UNCOMPRESS, '-', "Uncompress a CMS \"CompressedData\" object"}, + {"EncryptedData_decrypt", OPT_ED_DECRYPT, '-', + "Decrypt CMS \"EncryptedData\" object using symmetric key"}, + {"EncryptedData_encrypt", OPT_ED_ENCRYPT, '-', + "Create CMS \"EncryptedData\" object using symmetric key"}, + {"debug_decrypt", OPT_DEBUG_DECRYPT, '-', + "Disable MMA protection and return an error if no recipient found" + " (see documentation)"}, {"text", OPT_TEXT, '-', "Include or delete text MIME headers"}, - {"asciicrlf", OPT_ASCIICRLF, '-'}, + {"asciicrlf", OPT_ASCIICRLF, '-', + "Perform CRLF canonicalisation when signing"}, {"nointern", OPT_NOINTERN, '-', "Don't search certificates in message for signer"}, {"noverify", OPT_NOVERIFY, '-', "Don't verify signers certificate"}, @@ -129,16 +138,20 @@ const OPTIONS cms_options[] = { {"binary", OPT_BINARY, '-', "Don't translate message to text"}, {"keyid", OPT_KEYID, '-', "Use subject key identifier"}, {"nosigs", OPT_NOSIGS, '-', "Don't verify message signature"}, - {"no_content_verify", OPT_NO_CONTENT_VERIFY, '-'}, - {"no_attr_verify", OPT_NO_ATTR_VERIFY, '-'}, + {"no_content_verify", OPT_NO_CONTENT_VERIFY, '-', + "Do not verify signed content signatures"}, + {"no_attr_verify", OPT_NO_ATTR_VERIFY, '-', + "Do not verify signed attribute signatures"}, {"stream", OPT_INDEF, '-', "Enable CMS streaming"}, {"indef", OPT_INDEF, '-', "Same as -stream"}, {"noindef", OPT_NOINDEF, '-', "Disable CMS streaming"}, {"crlfeol", OPT_CRLFEOL, '-', "Use CRLF as EOL termination instead of CR only" }, {"noout", OPT_NOOUT, '-', "For the -cmsout operation do not output the parsed CMS structure"}, {"receipt_request_print", OPT_RR_PRINT, '-', "Print CMS Receipt Request" }, - {"receipt_request_all", OPT_RR_ALL, '-'}, - {"receipt_request_first", OPT_RR_FIRST, '-'}, + {"receipt_request_all", OPT_RR_ALL, '-', + "When signing, create a receipt request for all recipients"}, + {"receipt_request_first", OPT_RR_FIRST, '-', + "When signing, create a receipt request for first recipient"}, {"rctform", OPT_RCTFORM, 'F', "Receipt file format"}, {"certfile", OPT_CERTFILE, '<', "Other certificates file"}, {"CAfile", OPT_CAFILE, '<', "Trusted certificates file"}, @@ -151,10 +164,13 @@ const OPTIONS cms_options[] = { "Supply or override content for detached signature"}, {"print", OPT_PRINT, '-', "For the -cmsout operation print out all fields of the CMS structure"}, - {"secretkey", OPT_SECRETKEY, 's'}, - {"secretkeyid", OPT_SECRETKEYID, 's'}, - {"pwri_password", OPT_PWRI_PASSWORD, 's'}, - {"econtent_type", OPT_ECONTENT_TYPE, 's'}, + {"secretkey", OPT_SECRETKEY, 's', + "Use specified hex-encoded key to decrypt/encrypt recipients or content"}, + {"secretkeyid", OPT_SECRETKEYID, 's', + "Identity of the -secretkey for CMS \"KEKRecipientInfo\" object"}, + {"pwri_password", OPT_PWRI_PASSWORD, 's', + "Specific password for recipient"}, + {"econtent_type", OPT_ECONTENT_TYPE, 's', "OID for external content"}, {"passin", OPT_PASSIN, 's', "Input file pass phrase source"}, {"to", OPT_TO, 's', "To address"}, {"from", OPT_FROM, 's', "From address"}, @@ -167,8 +183,10 @@ const OPTIONS cms_options[] = { "Input private key (if not signer or recipient)"}, {"keyform", OPT_KEYFORM, 'f', "Input private key format (PEM or ENGINE)"}, {"keyopt", OPT_KEYOPT, 's', "Set public key parameters as n:v pairs"}, - {"receipt_request_from", OPT_RR_FROM, 's'}, - {"receipt_request_to", OPT_RR_TO, 's'}, + {"receipt_request_from", OPT_RR_FROM, 's', + "Create signed receipt request with specified email address"}, + {"receipt_request_to", OPT_RR_TO, 's', + "Create signed receipt targeted to specified address"}, {"", OPT_CIPHER, '-', "Any supported cipher"}, OPT_R_OPTIONS, OPT_V_OPTIONS, diff --git a/apps/crl.c b/apps/crl.c index 49ad97b7..d36b93ba 100644 --- a/apps/crl.c +++ b/apps/crl.c @@ -204,7 +204,7 @@ int crl_main(int argc, char **argv) } pkey = X509_get_pubkey(X509_OBJECT_get0_X509(xobj)); X509_OBJECT_free(xobj); - if (!pkey) { + if (pkey == NULL) { BIO_printf(bio_err, "Error getting CRL issuer public key\n"); goto end; } @@ -228,7 +228,7 @@ int crl_main(int argc, char **argv) if (!newcrl) goto end; pkey = load_key(keyfile, keyformat, 0, NULL, NULL, "CRL signing key"); - if (!pkey) { + if (pkey == NULL) { X509_CRL_free(newcrl); goto end; } diff --git a/apps/fipsinstall.c b/apps/fipsinstall.c index 78200c58..fd28b484 100644 --- a/apps/fipsinstall.c +++ b/apps/fipsinstall.c @@ -341,7 +341,7 @@ opthelp: if (opts != NULL) { int ok = 1; OSSL_PARAM *params = - app_params_new_from_opts(opts, EVP_MAC_CTX_settable_params(mac)); + app_params_new_from_opts(opts, EVP_MAC_settable_ctx_params(mac)); if (params == NULL) goto end; diff --git a/apps/genpkey.c b/apps/genpkey.c index f8faf3ba..afae4b65 100644 --- a/apps/genpkey.c +++ b/apps/genpkey.c @@ -217,7 +217,7 @@ static int init_keygen_file(EVP_PKEY_CTX **pctx, const char *file, ENGINE *e) } pbio = BIO_new_file(file, "r"); - if (!pbio) { + if (pbio == NULL) { BIO_printf(bio_err, "Can't open parameter file %s\n", file); return 0; } @@ -225,7 +225,7 @@ static int init_keygen_file(EVP_PKEY_CTX **pctx, const char *file, ENGINE *e) pkey = PEM_read_bio_Parameters(pbio, NULL); BIO_free(pbio); - if (!pkey) { + if (pkey == NULL) { BIO_printf(bio_err, "Error reading parameter file %s\n", file); return 0; } diff --git a/apps/include/apps.h b/apps/include/apps.h index 8b28d749..41db8074 100644 --- a/apps/include/apps.h +++ b/apps/include/apps.h @@ -7,8 +7,8 @@ * https://www.openssl.org/source/license.html */ -#ifndef HEADER_APPS_H -# define HEADER_APPS_H +#ifndef OSSL_APPS_H +# define OSSL_APPS_H # include "e_os.h" /* struct timeval for DTLS */ # include "internal/nelem.h" @@ -21,7 +21,7 @@ # endif # include -# include +# include # include # include # include diff --git a/apps/include/apps_ui.h b/apps/include/apps_ui.h index 36e0864a..55a6b510 100644 --- a/apps/include/apps_ui.h +++ b/apps/include/apps_ui.h @@ -7,8 +7,8 @@ * https://www.openssl.org/source/license.html */ -#ifndef HEADER_APPS_UI_H -# define HEADER_APPS_UI_H +#ifndef OSSL_APPS_UI_H +# define OSSL_APPS_UI_H # define PW_MIN_LENGTH 4 diff --git a/apps/include/fmt.h b/apps/include/fmt.h index e3da9a44..01acf866 100644 --- a/apps/include/fmt.h +++ b/apps/include/fmt.h @@ -14,8 +14,8 @@ * shared fields have been moved into this file. */ -#ifndef HEADER_FMT_H -#define HEADER_FMT_H +#ifndef OSSL_APPS_FMT_H +#define OSSL_APPS_FMT_H /* On some platforms, it's important to distinguish between text and binary * files. On some, there might even be specific file formats for different @@ -41,4 +41,4 @@ int FMT_istext(int format); -#endif /* HEADER_FMT_H_ */ +#endif /* OSSL_APPS_FMT_H_ */ diff --git a/apps/include/function.h b/apps/include/function.h index 41259793..1911a649 100644 --- a/apps/include/function.h +++ b/apps/include/function.h @@ -7,8 +7,8 @@ * https://www.openssl.org/source/license.html */ -#ifndef APPS_FUNCTION_H -# define APPS_FUNCTION_H +#ifndef OSSL_APPS_FUNCTION_H +# define OSSL_APPS_FUNCTION_H # include # include "opt.h" diff --git a/apps/include/names.h b/apps/include/names.h new file mode 100644 index 00000000..f4d6f6a9 --- /dev/null +++ b/apps/include/names.h @@ -0,0 +1,17 @@ +/* + * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include + +/* Standard comparing function for names */ +int name_cmp(const char * const *a, const char * const *b); +/* collect_names is meant to be used with EVP_{type}_doall_names */ +void collect_names(const char *name, void *vdata); +/* Sorts and prints a stack of names to |out| */ +void print_names(BIO *out, STACK_OF(OPENSSL_CSTRING) *names); diff --git a/apps/include/opt.h b/apps/include/opt.h index 92a7fd1d..54935630 100644 --- a/apps/include/opt.h +++ b/apps/include/opt.h @@ -6,12 +6,12 @@ * in the file LICENSE in the source distribution or at * https://www.openssl.org/source/license.html */ -#ifndef HEADER_OPT_H -#define HEADER_OPT_H +#ifndef OSSL_APPS_OPT_H +#define OSSL_APPS_OPT_H #include #include -#include +#include #include /* @@ -347,4 +347,4 @@ int opt_format_error(const char *s, unsigned long flags); int opt_isdir(const char *name); int opt_printf_stderr(const char *fmt, ...); -#endif /* HEADER_OPT_H */ +#endif /* OSSL_APPS_OPT_H */ diff --git a/apps/include/platform.h b/apps/include/platform.h index 49276b6f..491559df 100644 --- a/apps/include/platform.h +++ b/apps/include/platform.h @@ -7,8 +7,8 @@ * https://www.openssl.org/source/license.html */ -#ifndef HEADER_PLATFORM_H -# define HEADER_PLATFORM_H +#ifndef OSSL_APPS_PLATFORM_H +# define OSSL_APPS_PLATFORM_H # include diff --git a/apps/include/vms_term_sock.h b/apps/include/vms_term_sock.h index d4c7c3d1..eae37b1a 100644 --- a/apps/include/vms_term_sock.h +++ b/apps/include/vms_term_sock.h @@ -8,8 +8,8 @@ * https://www.openssl.org/source/license.html */ -#ifndef TERM_SOCK_H -# define TERM_SOCK_H +#ifndef OSSL_APPS_VMS_TERM_SOCK_H +# define OSSL_APPS_VMS_TERM_SOCK_H /* ** Terminal Socket Function Codes diff --git a/apps/kdf.c b/apps/kdf.c index c2304306..35cc0db2 100644 --- a/apps/kdf.c +++ b/apps/kdf.c @@ -96,7 +96,7 @@ opthelp: if (opts != NULL) { int ok = 1; OSSL_PARAM *params = - app_params_new_from_opts(opts, EVP_KDF_CTX_settable_params(kdf)); + app_params_new_from_opts(opts, EVP_KDF_settable_ctx_params(kdf)); if (params == NULL) goto err; diff --git a/apps/lib/apps.c b/apps/lib/apps.c index 50388177..73483d99 100644 --- a/apps/lib/apps.c +++ b/apps/lib/apps.c @@ -85,7 +85,7 @@ int chopup_args(ARGS *arg, char *buf) /* Skip whitespace. */ while (*p && isspace(_UC(*p))) p++; - if (!*p) + if (*p == '\0') break; /* The start of something good :-) */ @@ -258,7 +258,7 @@ static char *app_get_pass(const char *arg, int keepbio) #endif } else if (strcmp(arg, "stdin") == 0) { pwdbio = dup_bio_in(FORMAT_TEXT); - if (!pwdbio) { + if (pwdbio == NULL) { BIO_printf(bio_err, "Can't open BIO for stdin\n"); return NULL; } @@ -407,7 +407,7 @@ static int load_pkcs12(BIO *in, const char *desc, if (PKCS12_verify_mac(p12, "", 0) || PKCS12_verify_mac(p12, NULL, 0)) { pass = ""; } else { - if (!pem_cb) + if (pem_cb == NULL) pem_cb = (pem_password_cb *)password_callback; len = pem_cb(tpass, PEM_BUFSIZE, 0, cb_data); if (len < 0) { @@ -1809,26 +1809,46 @@ unsigned char *next_protos_parse(size_t *outlen, const char *in) size_t len; unsigned char *out; size_t i, start = 0; + size_t skipped = 0; len = strlen(in); - if (len >= 65535) + if (len == 0 || len >= 65535) return NULL; - out = app_malloc(strlen(in) + 1, "NPN buffer"); + out = app_malloc(len + 1, "NPN buffer"); for (i = 0; i <= len; ++i) { if (i == len || in[i] == ',') { + /* + * Zero-length ALPN elements are invalid on the wire, we could be + * strict and reject the entire string, but just ignoring extra + * commas seems harmless and more friendly. + * + * Every comma we skip in this way puts the input buffer another + * byte ahead of the output buffer, so all stores into the output + * buffer need to be decremented by the number commas skipped. + */ + if (i == start) { + ++start; + ++skipped; + continue; + } if (i - start > 255) { OPENSSL_free(out); return NULL; } - out[start] = (unsigned char)(i - start); + out[start-skipped] = (unsigned char)(i - start); start = i + 1; } else { - out[i + 1] = in[i]; + out[i + 1 - skipped] = in[i]; } } - *outlen = len + 1; + if (len <= skipped) { + OPENSSL_free(out); + return NULL; + } + + *outlen = len + 1 - skipped; return out; } diff --git a/apps/lib/build.info b/apps/lib/build.info index f92d4daf..0c24d76d 100644 --- a/apps/lib/build.info +++ b/apps/lib/build.info @@ -9,7 +9,7 @@ ENDIF # Source for libapps $LIBAPPSSRC=apps.c apps_ui.c opt.c fmt.c s_cb.c s_socket.c app_rand.c \ - bf_prefix.c columns.c app_params.c + bf_prefix.c columns.c app_params.c names.c IF[{- !$disabled{apps} -}] LIBS{noinst}=../libapps.a diff --git a/apps/lib/names.c b/apps/lib/names.c new file mode 100644 index 00000000..09ee16fd --- /dev/null +++ b/apps/lib/names.c @@ -0,0 +1,48 @@ +/* + * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include +#include +#include +#include "names.h" + +#ifdef _WIN32 +# define strcasecmp _stricmp +#endif + +int name_cmp(const char * const *a, const char * const *b) +{ + return strcasecmp(*a, *b); +} + +void collect_names(const char *name, void *vdata) +{ + STACK_OF(OPENSSL_CSTRING) *names = vdata; + + sk_OPENSSL_CSTRING_push(names, name); +} + +void print_names(BIO *out, STACK_OF(OPENSSL_CSTRING) *names) +{ + int i = sk_OPENSSL_CSTRING_num(names); + int j; + + sk_OPENSSL_CSTRING_sort(names); + if (i > 1) + BIO_printf(out, "{ "); + for (j = 0; j < i; j++) { + const char *name = sk_OPENSSL_CSTRING_value(names, j); + + if (j > 0) + BIO_printf(out, ", "); + BIO_printf(out, "%s", name); + } + if (i > 1) + BIO_printf(out, " }"); +} diff --git a/apps/list.c b/apps/list.c index 2b44cac7..2e8867df 100644 --- a/apps/list.c +++ b/apps/list.c @@ -17,6 +17,7 @@ #include "app_params.h" #include "progs.h" #include "opt.h" +#include "names.h" static int verbose = 0; @@ -38,7 +39,7 @@ DEFINE_STACK_OF(EVP_CIPHER) static int cipher_cmp(const EVP_CIPHER * const *a, const EVP_CIPHER * const *b) { - int ret = strcasecmp(EVP_CIPHER_name(*a), EVP_CIPHER_name(*b)); + int ret = EVP_CIPHER_number(*a) - EVP_CIPHER_number(*b); if (ret == 0) ret = strcmp(OSSL_PROVIDER_name(EVP_CIPHER_provider(*a)), @@ -64,21 +65,29 @@ static void list_ciphers(void) EVP_CIPHER_do_all_sorted(legacy_cipher_fn, bio_out); BIO_printf(bio_out, "Provided:\n"); - EVP_CIPHER_do_all_ex(NULL, collect_ciphers, ciphers); + EVP_CIPHER_do_all_provided(NULL, collect_ciphers, ciphers); sk_EVP_CIPHER_sort(ciphers); for (i = 0; i < sk_EVP_CIPHER_num(ciphers); i++) { const EVP_CIPHER *c = sk_EVP_CIPHER_value(ciphers, i); + STACK_OF(OPENSSL_CSTRING) *names = + sk_OPENSSL_CSTRING_new(name_cmp); - BIO_printf(bio_out, " %s", EVP_CIPHER_name(c)); + EVP_CIPHER_names_do_all(c, collect_names, names); + + BIO_printf(bio_out, " "); + print_names(bio_out, names); BIO_printf(bio_out, " @ %s\n", OSSL_PROVIDER_name(EVP_CIPHER_provider(c))); + + sk_OPENSSL_CSTRING_free(names); + if (verbose) { print_param_types("retrievable algorithm parameters", EVP_CIPHER_gettable_params(c), 4); print_param_types("retrievable operation parameters", - EVP_CIPHER_CTX_gettable_params(c), 4); + EVP_CIPHER_gettable_ctx_params(c), 4); print_param_types("settable operation parameters", - EVP_CIPHER_CTX_settable_params(c), 4); + EVP_CIPHER_settable_ctx_params(c), 4); } } sk_EVP_CIPHER_pop_free(ciphers, EVP_CIPHER_free); @@ -101,7 +110,7 @@ static void list_md_fn(const EVP_MD *m, DEFINE_STACK_OF(EVP_MD) static int md_cmp(const EVP_MD * const *a, const EVP_MD * const *b) { - int ret = strcasecmp(EVP_MD_name(*a), EVP_MD_name(*b)); + int ret = EVP_MD_number(*a) - EVP_MD_number(*b); if (ret == 0) ret = strcmp(OSSL_PROVIDER_name(EVP_MD_provider(*a)), @@ -127,21 +136,29 @@ static void list_digests(void) EVP_MD_do_all_sorted(list_md_fn, bio_out); BIO_printf(bio_out, "Provided:\n"); - EVP_MD_do_all_ex(NULL, collect_digests, digests); + EVP_MD_do_all_provided(NULL, collect_digests, digests); sk_EVP_MD_sort(digests); for (i = 0; i < sk_EVP_MD_num(digests); i++) { const EVP_MD *m = sk_EVP_MD_value(digests, i); + STACK_OF(OPENSSL_CSTRING) *names = + sk_OPENSSL_CSTRING_new(name_cmp); - BIO_printf(bio_out, " %s", EVP_MD_name(m)); + EVP_MD_names_do_all(m, collect_names, names); + + BIO_printf(bio_out, " "); + print_names(bio_out, names); BIO_printf(bio_out, " @ %s\n", OSSL_PROVIDER_name(EVP_MD_provider(m))); + + sk_OPENSSL_CSTRING_free(names); + if (verbose) { print_param_types("retrievable algorithm parameters", EVP_MD_gettable_params(m), 4); print_param_types("retrievable operation parameters", - EVP_MD_CTX_gettable_params(m), 4); + EVP_MD_gettable_ctx_params(m), 4); print_param_types("settable operation parameters", - EVP_MD_CTX_settable_params(m), 4); + EVP_MD_settable_ctx_params(m), 4); } } sk_EVP_MD_pop_free(digests, EVP_MD_free); @@ -150,7 +167,7 @@ static void list_digests(void) DEFINE_STACK_OF(EVP_MAC) static int mac_cmp(const EVP_MAC * const *a, const EVP_MAC * const *b) { - int ret = strcasecmp(EVP_MAC_name(*a), EVP_MAC_name(*b)); + int ret = EVP_MAC_number(*a) - EVP_MAC_number(*b); if (ret == 0) ret = strcmp(OSSL_PROVIDER_name(EVP_MAC_provider(*a)), @@ -173,22 +190,29 @@ static void list_macs(void) int i; BIO_printf(bio_out, "Provided MACs:\n"); - EVP_MAC_do_all_ex(NULL, collect_macs, macs); + EVP_MAC_do_all_provided(NULL, collect_macs, macs); sk_EVP_MAC_sort(macs); for (i = 0; i < sk_EVP_MAC_num(macs); i++) { const EVP_MAC *m = sk_EVP_MAC_value(macs, i); + STACK_OF(OPENSSL_CSTRING) *names = + sk_OPENSSL_CSTRING_new(name_cmp); - BIO_printf(bio_out, " %s", EVP_MAC_name(m)); + EVP_MAC_names_do_all(m, collect_names, names); + + BIO_printf(bio_out, " "); + print_names(bio_out, names); BIO_printf(bio_out, " @ %s\n", OSSL_PROVIDER_name(EVP_MAC_provider(m))); + sk_OPENSSL_CSTRING_free(names); + if (verbose) { print_param_types("retrievable algorithm parameters", EVP_MAC_gettable_params(m), 4); print_param_types("retrievable operation parameters", - EVP_MAC_CTX_gettable_params(m), 4); + EVP_MAC_gettable_ctx_params(m), 4); print_param_types("settable operation parameters", - EVP_MAC_CTX_settable_params(m), 4); + EVP_MAC_settable_ctx_params(m), 4); } } sk_EVP_MAC_pop_free(macs, EVP_MAC_free); @@ -200,7 +224,7 @@ static void list_macs(void) DEFINE_STACK_OF(EVP_KDF) static int kdf_cmp(const EVP_KDF * const *a, const EVP_KDF * const *b) { - int ret = strcasecmp(EVP_KDF_name(*a), EVP_KDF_name(*b)); + int ret = EVP_KDF_number(*a) - EVP_KDF_number(*b); if (ret == 0) ret = strcmp(OSSL_PROVIDER_name(EVP_KDF_provider(*a)), @@ -223,22 +247,29 @@ static void list_kdfs(void) int i; BIO_printf(bio_out, "Provided KDFs and PDFs:\n"); - EVP_KDF_do_all_ex(NULL, collect_kdfs, kdfs); + EVP_KDF_do_all_provided(NULL, collect_kdfs, kdfs); sk_EVP_KDF_sort(kdfs); for (i = 0; i < sk_EVP_KDF_num(kdfs); i++) { - const EVP_KDF *m = sk_EVP_KDF_value(kdfs, i); + const EVP_KDF *k = sk_EVP_KDF_value(kdfs, i); + STACK_OF(OPENSSL_CSTRING) *names = + sk_OPENSSL_CSTRING_new(name_cmp); - BIO_printf(bio_out, " %s", EVP_KDF_name(m)); + EVP_KDF_names_do_all(k, collect_names, names); + + BIO_printf(bio_out, " "); + print_names(bio_out, names); BIO_printf(bio_out, " @ %s\n", - OSSL_PROVIDER_name(EVP_KDF_provider(m))); + OSSL_PROVIDER_name(EVP_KDF_provider(k))); + + sk_OPENSSL_CSTRING_free(names); if (verbose) { print_param_types("retrievable algorithm parameters", - EVP_KDF_gettable_params(m), 4); + EVP_KDF_gettable_params(k), 4); print_param_types("retrievable operation parameters", - EVP_KDF_CTX_gettable_params(m), 4); + EVP_KDF_gettable_ctx_params(k), 4); print_param_types("settable operation parameters", - EVP_KDF_CTX_settable_params(m), 4); + EVP_KDF_settable_ctx_params(k), 4); } } sk_EVP_KDF_pop_free(kdfs, EVP_KDF_free); @@ -331,12 +362,16 @@ static void list_options_for_command(const char *command) return; for ( ; o->name != NULL; o++) { + char c = o->valtype; + if (o->name == OPT_HELP_STR || o->name == OPT_MORE_STR || o->name[0] == '\0') continue; - BIO_printf(bio_out, "%s %c\n", o->name, o->valtype); + BIO_printf(bio_out, "%s %c\n", o->name, c == '\0' ? '-' : c); } + /* Always output the -- marker since it is sometimes documented. */ + BIO_printf(bio_out, "- -\n"); } static void list_type(FUNC_TYPE ft, int one) diff --git a/apps/mac.c b/apps/mac.c index 205d82f7..8383d0d7 100644 --- a/apps/mac.c +++ b/apps/mac.c @@ -105,7 +105,7 @@ opthelp: if (opts != NULL) { int ok = 1; OSSL_PARAM *params = - app_params_new_from_opts(opts, EVP_MAC_CTX_settable_params(mac)); + app_params_new_from_opts(opts, EVP_MAC_settable_ctx_params(mac)); if (params == NULL) goto err; diff --git a/apps/pkcs12.c b/apps/pkcs12.c index 902b7502..a708064d 100644 --- a/apps/pkcs12.c +++ b/apps/pkcs12.c @@ -465,7 +465,7 @@ int pkcs12_main(int argc, char **argv) p12 = PKCS12_create(cpass, name, key, ucert, certs, key_pbe, cert_pbe, iter, -1, keytype); - if (!p12) { + if (p12 == NULL) { ERR_print_errors(bio_err); goto export_end; } diff --git a/apps/prime.c b/apps/prime.c index e00a3084..55cdad81 100644 --- a/apps/prime.c +++ b/apps/prime.c @@ -35,7 +35,7 @@ const OPTIONS prime_options[] = { int prime_main(int argc, char **argv) { BIGNUM *bn = NULL; - int hex = 0, checks = 20, generate = 0, bits = 0, safe = 0, ret = 1; + int hex = 0, generate = 0, bits = 0, safe = 0, ret = 1; char *prog; OPTION_CHOICE o; @@ -64,7 +64,8 @@ opthelp: safe = 1; break; case OPT_CHECKS: - checks = atoi(opt_arg()); + /* ignore parameter and argument */ + opt_arg(); break; } } @@ -121,7 +122,7 @@ opthelp: BN_print(bio_out, bn); BIO_printf(bio_out, " (%s) %s prime\n", argv[0], - BN_is_prime_ex(bn, checks, NULL, NULL) + BN_check_prime(bn, NULL, NULL) ? "is" : "is not"); } } diff --git a/apps/provider.c b/apps/provider.c index fe5ca1d1..325a7424 100644 --- a/apps/provider.c +++ b/apps/provider.c @@ -12,6 +12,7 @@ #include "apps.h" #include "app_params.h" #include "progs.h" +#include "names.h" #include #include #include @@ -40,7 +41,7 @@ typedef struct info_st INFO; typedef struct meta_st META; struct info_st { - const char *name; + void (*collect_names_fn)(void *method, STACK_OF(OPENSSL_CSTRING) *names); void *method; const OSSL_PARAM *gettable_params; const OSSL_PARAM *gettable_ctx_params; @@ -58,11 +59,58 @@ struct meta_st { void (*fn)(META *meta, INFO *info); }; +static void collect_cipher_names(void *method, + STACK_OF(OPENSSL_CSTRING) *names) +{ + EVP_CIPHER_names_do_all(method, collect_names, names); +} + +static void collect_digest_names(void *method, + STACK_OF(OPENSSL_CSTRING) *names) +{ + EVP_MD_names_do_all(method, collect_names, names); +} + +static void collect_mac_names(void *method, + STACK_OF(OPENSSL_CSTRING) *names) +{ + EVP_MAC_names_do_all(method, collect_names, names); +} + +static void collect_keymgmt_names(void *method, + STACK_OF(OPENSSL_CSTRING) *names) +{ + EVP_KEYMGMT_names_do_all(method, collect_names, names); +} + +static void collect_keyexch_names(void *method, + STACK_OF(OPENSSL_CSTRING) *names) +{ + EVP_KEYEXCH_names_do_all(method, collect_names, names); +} + +static void collect_signature_names(void *method, + STACK_OF(OPENSSL_CSTRING) *names) +{ + EVP_SIGNATURE_names_do_all(method, collect_names, names); +} + +static void print_method_names(BIO *out, INFO *info) +{ + STACK_OF(OPENSSL_CSTRING) *names = sk_OPENSSL_CSTRING_new(name_cmp); + + info->collect_names_fn(info->method, names); + print_names(out, names); + sk_OPENSSL_CSTRING_free(names); +} + static void print_caps(META *meta, INFO *info) { switch (meta->verbose) { case 1: - BIO_printf(bio_out, meta->first ? "%s" : " %s", info->name); + if (!meta->first) + BIO_printf(bio_out, "; "); + print_method_names(bio_out, info); break; case 2: if (meta->first) { @@ -70,12 +118,14 @@ static void print_caps(META *meta, INFO *info) BIO_printf(bio_out, "\n"); BIO_printf(bio_out, "%*s%ss:", meta->indent, "", meta->label); } - BIO_printf(bio_out, " %s", info->name); + BIO_printf(bio_out, " "); + print_method_names(bio_out, info); break; case 3: default: - BIO_printf(bio_out, "%*s%s %s\n", meta->indent, "", meta->label, - info->name); + BIO_printf(bio_out, "%*s%s ", meta->indent, "", meta->label); + print_method_names(bio_out, info); + BIO_printf(bio_out, "\n"); print_param_types("retrievable algorithm parameters", info->gettable_params, meta->subindent); print_param_types("retrievable operation parameters", @@ -87,7 +137,9 @@ static void print_caps(META *meta, INFO *info) meta->first = 0; } -static void do_method(void *method, const char *name, +static void do_method(void *method, + void (*collect_names_fn)(void *method, + STACK_OF(OPENSSL_CSTRING) *names), const OSSL_PARAM *gettable_params, const OSSL_PARAM *gettable_ctx_params, const OSSL_PARAM *settable_ctx_params, @@ -95,7 +147,7 @@ static void do_method(void *method, const char *name, { INFO info; - info.name = name; + info.collect_names_fn = collect_names_fn; info.method = method; info.gettable_params = gettable_params; info.gettable_ctx_params = gettable_ctx_params; @@ -106,53 +158,78 @@ static void do_method(void *method, const char *name, static void do_cipher(EVP_CIPHER *cipher, void *meta) { - do_method(cipher, EVP_CIPHER_name(cipher), + do_method(cipher, collect_cipher_names, EVP_CIPHER_gettable_params(cipher), - EVP_CIPHER_CTX_gettable_params(cipher), - EVP_CIPHER_CTX_settable_params(cipher), + EVP_CIPHER_gettable_ctx_params(cipher), + EVP_CIPHER_settable_ctx_params(cipher), meta); } static void do_digest(EVP_MD *digest, void *meta) { - do_method(digest, EVP_MD_name(digest), + do_method(digest, collect_digest_names, EVP_MD_gettable_params(digest), - EVP_MD_CTX_gettable_params(digest), - EVP_MD_CTX_settable_params(digest), + EVP_MD_gettable_ctx_params(digest), + EVP_MD_settable_ctx_params(digest), meta); } static void do_mac(EVP_MAC *mac, void *meta) { - do_method(mac, EVP_MAC_name(mac), + do_method(mac, collect_mac_names, EVP_MAC_gettable_params(mac), - EVP_MAC_CTX_gettable_params(mac), - EVP_MAC_CTX_settable_params(mac), + EVP_MAC_gettable_ctx_params(mac), + EVP_MAC_settable_ctx_params(mac), meta); } +static void do_keymgmt(EVP_KEYMGMT *keymgmt, void *meta) +{ + do_method(keymgmt, collect_keymgmt_names, /* * TODO(3.0) Enable when KEYMGMT and KEYEXCH have gettables and settables */ #if 0 -static void do_keymgmt(EVP_KEYMGMT *keymgmt, void *meta) -{ - do_method(keymgmt, EVP_KEYMGMT_name(keymgmt), EVP_KEYMGMT_gettable_params(keymgmt), EVP_KEYMGMT_gettable_ctx_params(keymgmt), EVP_KEYMGMT_settable_ctx_params(keymgmt), +#else + NULL, NULL, NULL, +#endif meta); } static void do_keyexch(EVP_KEYEXCH *keyexch, void *meta) { - do_method(keyexch, EVP_KEYEXCH_name(keyexch), + do_method(keyexch, collect_keyexch_names, +/* + * TODO(3.0) Enable when KEYMGMT and KEYEXCH have gettables and settables + */ +#if 0 EVP_KEYEXCH_gettable_params(keyexch), EVP_KEYEXCH_gettable_ctx_params(keyexch), EVP_KEYEXCH_settable_ctx_params(keyexch), +#else + NULL, NULL, NULL, +#endif meta); } + +static void do_signature(EVP_SIGNATURE *signature, void *meta) +{ + do_method(signature, collect_signature_names, +/* + * TODO(3.0) Enable when KEYMGMT and SIGNATURE have gettables and settables + */ +#if 0 + EVP_SIGNATURE_gettable_params(signature), + EVP_SIGNATURE_gettable_ctx_params(signature), + EVP_SIGNATURE_settable_ctx_params(signature), +#else + NULL, NULL, NULL, #endif + meta); +} int provider_main(int argc, char **argv) { @@ -231,33 +308,33 @@ int provider_main(int argc, char **argv) data.first = 1; data.label = "Cipher"; } - EVP_CIPHER_do_all_ex(NULL, do_cipher, &data); + EVP_CIPHER_do_all_provided(NULL, do_cipher, &data); if (verbose > 1) { data.first = 1; data.label = "Digest"; } - EVP_MD_do_all_ex(NULL, do_digest, &data); + EVP_MD_do_all_provided(NULL, do_digest, &data); if (verbose > 1) { data.first = 1; data.label = "MAC"; } - EVP_MAC_do_all_ex(NULL, do_mac, &data); + EVP_MAC_do_all_provided(NULL, do_mac, &data); -/* - * TODO(3.0) Enable when KEYMGMT and KEYEXCH have do_all_ex functions - */ -#if 0 if (verbose > 1) { data.first = 1; data.label = "Key manager"; } - EVP_KEYMGMT_do_all_ex(NULL, do_keymgmt, &data); + EVP_KEYMGMT_do_all_provided(NULL, do_keymgmt, &data); if (verbose > 1) { data.first = 1; data.label = "Key exchange"; } - EVP_KEYEXCH_do_all_ex(NULL, do_keyexch, &data); -#endif + EVP_KEYEXCH_do_all_provided(NULL, do_keyexch, &data); + if (verbose > 1) { + data.first = 1; + data.label = "Signature"; + } + EVP_SIGNATURE_do_all_provided(NULL, do_signature, &data); switch (verbose) { default: diff --git a/apps/req.c b/apps/req.c index f11d341c..70b4f0d6 100644 --- a/apps/req.c +++ b/apps/req.c @@ -325,9 +325,10 @@ int req_main(int argc, char **argv) newreq = 1; break; case OPT_PKEYOPT: - if (!pkeyopts) + if (pkeyopts == NULL) pkeyopts = sk_OPENSSL_STRING_new_null(); - if (!pkeyopts || !sk_OPENSSL_STRING_push(pkeyopts, opt_arg())) + if (pkeyopts == NULL + || !sk_OPENSSL_STRING_push(pkeyopts, opt_arg())) goto opthelp; break; case OPT_SIGOPT: @@ -1751,15 +1752,19 @@ int do_X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md, #endif rv = do_sign_init(mctx, pkey, md, sigopts); - if (rv > 0) + if (rv > 0) { rv = X509_sign_ctx(x, mctx); #ifndef OPENSSL_NO_SM2 - /* only in SM2 case we need to free the pctx explicitly */ - if (ec_pkey_is_sm2(pkey)) { - pctx = EVP_MD_CTX_pkey_ctx(mctx); - EVP_PKEY_CTX_free(pctx); - } + /* + * only in SM2 case we need to free the pctx explicitly + * if do_sign_init() fails, pctx is already freed in it + */ + if (ec_pkey_is_sm2(pkey)) { + pctx = EVP_MD_CTX_pkey_ctx(mctx); + EVP_PKEY_CTX_free(pctx); + } #endif + } EVP_MD_CTX_free(mctx); return rv > 0 ? 1 : 0; } @@ -1774,15 +1779,19 @@ int do_X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md, #endif rv = do_sign_init(mctx, pkey, md, sigopts); - if (rv > 0) + if (rv > 0) { rv = X509_REQ_sign_ctx(x, mctx); #ifndef OPENSSL_NO_SM2 - /* only in SM2 case we need to free the pctx explicitly */ - if (ec_pkey_is_sm2(pkey)) { - pctx = EVP_MD_CTX_pkey_ctx(mctx); - EVP_PKEY_CTX_free(pctx); - } + /* + * only in SM2 case we need to free the pctx explicitly + * if do_sign_init() fails, pctx is already freed in it + */ + if (ec_pkey_is_sm2(pkey)) { + pctx = EVP_MD_CTX_pkey_ctx(mctx); + EVP_PKEY_CTX_free(pctx); + } #endif + } EVP_MD_CTX_free(mctx); return rv > 0 ? 1 : 0; } @@ -1797,15 +1806,19 @@ int do_X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md, #endif rv = do_sign_init(mctx, pkey, md, sigopts); - if (rv > 0) + if (rv > 0) { rv = X509_CRL_sign_ctx(x, mctx); #ifndef OPENSSL_NO_SM2 - /* only in SM2 case we need to free the pctx explicitly */ - if (ec_pkey_is_sm2(pkey)) { - pctx = EVP_MD_CTX_pkey_ctx(mctx); - EVP_PKEY_CTX_free(pctx); - } + /* + * only in SM2 case we need to free the pctx explicitly + * if do_sign_init() fails, no need to double free pctx + */ + if (ec_pkey_is_sm2(pkey)) { + pctx = EVP_MD_CTX_pkey_ctx(mctx); + EVP_PKEY_CTX_free(pctx); + } #endif + } EVP_MD_CTX_free(mctx); return rv > 0 ? 1 : 0; } diff --git a/apps/s_client.c b/apps/s_client.c index 016df7c6..392ab022 100644 --- a/apps/s_client.c +++ b/apps/s_client.c @@ -272,8 +272,6 @@ typedef struct srp_arg_st { int strength; /* minimal size for N */ } SRP_ARG; -# define SRP_NUMBER_ITERATIONS_FOR_PRIME 64 - static int srp_Verify_N_and_g(const BIGNUM *N, const BIGNUM *g) { BN_CTX *bn_ctx = BN_CTX_new(); @@ -281,10 +279,10 @@ static int srp_Verify_N_and_g(const BIGNUM *N, const BIGNUM *g) BIGNUM *r = BN_new(); int ret = g != NULL && N != NULL && bn_ctx != NULL && BN_is_odd(N) && - BN_is_prime_ex(N, SRP_NUMBER_ITERATIONS_FOR_PRIME, bn_ctx, NULL) == 1 && + BN_check_prime(N, bn_ctx, NULL) == 1 && p != NULL && BN_rshift1(p, N) && /* p = (N-1)/2 */ - BN_is_prime_ex(p, SRP_NUMBER_ITERATIONS_FOR_PRIME, bn_ctx, NULL) == 1 && + BN_check_prime(p, bn_ctx, NULL) == 1 && r != NULL && /* verify g^((N-1)/2) == -1 (mod N) */ BN_mod_exp(r, g, p, N, bn_ctx) && diff --git a/apps/speed.c b/apps/speed.c index 59594f0e..9d7bff0c 100644 --- a/apps/speed.c +++ b/apps/speed.c @@ -15,6 +15,7 @@ #define ECDSA_SECONDS 10 #define ECDH_SECONDS 10 #define EdDSA_SECONDS 10 +#define SM2_SECONDS 10 #include #include @@ -127,6 +128,7 @@ typedef struct openssl_speed_sec_st { int ecdsa; int ecdh; int eddsa; + int sm2; } openssl_speed_sec_t; static volatile int run = 0; @@ -191,6 +193,10 @@ static int ECDSA_sign_loop(void *args); static int ECDSA_verify_loop(void *args); static int EdDSA_sign_loop(void *args); static int EdDSA_verify_loop(void *args); +# ifndef OPENSSL_NO_SM2 +static int SM2_sign_loop(void *args); +static int SM2_verify_loop(void *args); +# endif #endif static double Time_F(int s); @@ -604,6 +610,18 @@ static OPT_PAIR eddsa_choices[] = { # define EdDSA_NUM OSSL_NELEM(eddsa_choices) static double eddsa_results[EdDSA_NUM][2]; /* 2 ops: sign then verify */ + +# ifndef OPENSSL_NO_SM2 +# define R_EC_CURVESM2 0 +static OPT_PAIR sm2_choices[] = { + {"curveSM2", R_EC_CURVESM2} +}; +# define SM2_ID "TLSv1.3+GM+Cipher+Suite" +# define SM2_ID_LEN sizeof("TLSv1.3+GM+Cipher+Suite") - 1 +# define SM2_NUM OSSL_NELEM(sm2_choices) + +static double sm2_results[SM2_NUM][2]; /* 2 ops: sign then verify */ +# endif /* OPENSSL_NO_SM2 */ #endif /* OPENSSL_NO_EC */ #ifndef SIGALRM @@ -634,6 +652,11 @@ typedef struct loopargs_st { EC_KEY *ecdsa[ECDSA_NUM]; EVP_PKEY_CTX *ecdh_ctx[EC_NUM]; EVP_MD_CTX *eddsa_ctx[EdDSA_NUM]; +# ifndef OPENSSL_NO_SM2 + EVP_MD_CTX *sm2_ctx[SM2_NUM]; + EVP_MD_CTX *sm2_vfy_ctx[SM2_NUM]; + EVP_PKEY *sm2_pkey[SM2_NUM]; +# endif unsigned char *secret_a; unsigned char *secret_b; size_t outlen[EC_NUM]; @@ -1296,6 +1319,74 @@ static int EdDSA_verify_loop(void *args) } return count; } + +# ifndef OPENSSL_NO_SM2 +static long sm2_c[SM2_NUM][2]; +static int SM2_sign_loop(void *args) +{ + loopargs_t *tempargs = *(loopargs_t **) args; + unsigned char *buf = tempargs->buf; + EVP_MD_CTX **sm2ctx = tempargs->sm2_ctx; + unsigned char *sm2sig = tempargs->buf2; + size_t sm2sigsize = tempargs->sigsize; + const size_t max_size = tempargs->sigsize; + int ret, count; + EVP_PKEY **sm2_pkey = tempargs->sm2_pkey; + + for (count = 0; COND(sm2_c[testnum][0]); count++) { + if (!EVP_DigestSignInit(sm2ctx[testnum], NULL, EVP_sm3(), + NULL, sm2_pkey[testnum])) { + BIO_printf(bio_err, "SM2 init sign failure\n"); + ERR_print_errors(bio_err); + count = -1; + break; + } + ret = EVP_DigestSign(sm2ctx[testnum], sm2sig, &sm2sigsize, + buf, 20); + if (ret == 0) { + BIO_printf(bio_err, "SM2 sign failure\n"); + ERR_print_errors(bio_err); + count = -1; + break; + } + /* update the latest returned size and always use the fixed buffer size */ + tempargs->sigsize = sm2sigsize; + sm2sigsize = max_size; + } + + return count; +} + +static int SM2_verify_loop(void *args) +{ + loopargs_t *tempargs = *(loopargs_t **) args; + unsigned char *buf = tempargs->buf; + EVP_MD_CTX **sm2ctx = tempargs->sm2_vfy_ctx; + unsigned char *sm2sig = tempargs->buf2; + size_t sm2sigsize = tempargs->sigsize; + int ret, count; + EVP_PKEY **sm2_pkey = tempargs->sm2_pkey; + + for (count = 0; COND(sm2_c[testnum][1]); count++) { + if (!EVP_DigestVerifyInit(sm2ctx[testnum], NULL, EVP_sm3(), + NULL, sm2_pkey[testnum])) { + BIO_printf(bio_err, "SM2 verify init failure\n"); + ERR_print_errors(bio_err); + count = -1; + break; + } + ret = EVP_DigestVerify(sm2ctx[testnum], sm2sig, sm2sigsize, + buf, 20); + if (ret != 1) { + BIO_printf(bio_err, "SM2 verify failure\n"); + ERR_print_errors(bio_err); + count = -1; + break; + } + } + return count; +} +# endif /* OPENSSL_NO_SM2 */ #endif /* OPENSSL_NO_EC */ static int run_benchmark(int async_jobs, @@ -1477,7 +1568,7 @@ int speed_main(int argc, char **argv) #endif openssl_speed_sec_t seconds = { SECONDS, RSA_SECONDS, DSA_SECONDS, ECDSA_SECONDS, ECDH_SECONDS, - EdDSA_SECONDS }; + EdDSA_SECONDS, SM2_SECONDS }; /* What follows are the buffers and key material. */ #ifndef OPENSSL_NO_RC5 @@ -1609,11 +1700,23 @@ int speed_main(int argc, char **argv) {"Ed25519", NID_ED25519, 253, 64}, {"Ed448", NID_ED448, 456, 114} }; +# ifndef OPENSSL_NO_SM2 + static const struct { + const char *name; + unsigned int nid; + unsigned int bits; + } test_sm2_curves[] = { + /* SM2 */ + {"CurveSM2", NID_sm2, 256} + }; +# endif int ecdsa_doit[ECDSA_NUM] = { 0 }; int ecdh_doit[EC_NUM] = { 0 }; int eddsa_doit[EdDSA_NUM] = { 0 }; + int sm2_doit[SM2_NUM] = { 0 }; OPENSSL_assert(OSSL_NELEM(test_curves) >= EC_NUM); OPENSSL_assert(OSSL_NELEM(test_ed_curves) >= EdDSA_NUM); + OPENSSL_assert(OSSL_NELEM(test_sm2_curves) >= SM2_NUM); #endif /* ndef OPENSSL_NO_EC */ prog = opt_init(argc, argv, speed_options); @@ -1726,7 +1829,8 @@ int speed_main(int argc, char **argv) break; case OPT_SECONDS: seconds.sym = seconds.rsa = seconds.dsa = seconds.ecdsa - = seconds.ecdh = seconds.eddsa = atoi(opt_arg()); + = seconds.ecdh = seconds.eddsa + = seconds.sm2 = atoi(opt_arg()); break; case OPT_BYTES: lengths_single = atoi(opt_arg()); @@ -1819,6 +1923,17 @@ int speed_main(int argc, char **argv) eddsa_doit[i] = 2; continue; } +# ifndef OPENSSL_NO_SM2 + if (strcmp(*argv, "sm2") == 0) { + for (loop = 0; loop < OSSL_NELEM(sm2_doit); loop++) + sm2_doit[loop] = 1; + continue; + } + if (found(*argv, sm2_choices, &i)) { + sm2_doit[i] = 2; + continue; + } +# endif #endif BIO_printf(bio_err, "%s: Unknown algorithm %s\n", prog, *argv); goto end; @@ -1921,6 +2036,10 @@ int speed_main(int argc, char **argv) ecdh_doit[loop] = 1; for (loop = 0; loop < OSSL_NELEM(eddsa_doit); loop++) eddsa_doit[loop] = 1; +# ifndef OPENSSL_NO_SM2 + for (loop = 0; loop < OSSL_NELEM(sm2_doit); loop++) + sm2_doit[loop] = 1; +# endif #endif } for (i = 0; i < ALGOR_NUM; i++) @@ -2226,6 +2345,10 @@ int speed_main(int argc, char **argv) eddsa_c[R_EC_Ed25519][0] = count / 1800; eddsa_c[R_EC_Ed448][0] = count / 7200; + +# ifndef OPENSSL_NO_SM2 + sm2_c[R_EC_SM2P256][0] = count / 1800; +# endif # endif # else @@ -3149,7 +3272,7 @@ int speed_main(int argc, char **argv) pctx = NULL; } if (kctx == NULL || /* keygen ctx is not null */ - !EVP_PKEY_keygen_init(kctx) /* init keygen ctx */ ) { + EVP_PKEY_keygen_init(kctx) <= 0/* init keygen ctx */ ) { ecdh_checks = 0; BIO_printf(bio_err, "ECDH keygen failure.\n"); ERR_print_errors(bio_err); @@ -3157,12 +3280,12 @@ int speed_main(int argc, char **argv) break; } - if (!EVP_PKEY_keygen(kctx, &key_A) || /* generate secret key A */ - !EVP_PKEY_keygen(kctx, &key_B) || /* generate secret key B */ + if (EVP_PKEY_keygen(kctx, &key_A) <= 0 || /* generate secret key A */ + EVP_PKEY_keygen(kctx, &key_B) <= 0 || /* generate secret key B */ !(ctx = EVP_PKEY_CTX_new(key_A, NULL)) || /* derivation ctx from skeyA */ - !EVP_PKEY_derive_init(ctx) || /* init derivation ctx */ - !EVP_PKEY_derive_set_peer(ctx, key_B) || /* set peer pubkey in ctx */ - !EVP_PKEY_derive(ctx, NULL, &outlen) || /* determine max length */ + EVP_PKEY_derive_init(ctx) <= 0 || /* init derivation ctx */ + EVP_PKEY_derive_set_peer(ctx, key_B) <= 0 || /* set peer pubkey in ctx */ + EVP_PKEY_derive(ctx, NULL, &outlen) <= 0 || /* determine max length */ outlen == 0 || /* ensure outlen is a valid size */ outlen > MAX_ECDH_SIZE /* avoid buffer overflow */ ) { ecdh_checks = 0; @@ -3249,8 +3372,8 @@ int speed_main(int argc, char **argv) if ((ed_pctx = EVP_PKEY_CTX_new_id(test_ed_curves[testnum].nid, NULL)) == NULL - || !EVP_PKEY_keygen_init(ed_pctx) - || !EVP_PKEY_keygen(ed_pctx, &ed_pkey)) { + || EVP_PKEY_keygen_init(ed_pctx) <= 0 + || EVP_PKEY_keygen(ed_pctx, &ed_pkey) <= 0) { st = 0; EVP_PKEY_CTX_free(ed_pctx); break; @@ -3337,6 +3460,175 @@ int speed_main(int argc, char **argv) } } +# ifndef OPENSSL_NO_SM2 + for (testnum = 0; testnum < SM2_NUM; testnum++) { + int st = 1; + EVP_PKEY *sm2_pkey = NULL; + EVP_PKEY_CTX *pctx = NULL; + EVP_PKEY_CTX *sm2_pctx = NULL; + EVP_PKEY_CTX *sm2_vfy_pctx = NULL; + size_t sm2_sigsize = 0; + + if (!sm2_doit[testnum]) + continue; /* Ignore Curve */ + /* Init signing and verification */ + for (i = 0; i < loopargs_len; i++) { + loopargs[i].sm2_ctx[testnum] = EVP_MD_CTX_new(); + if (loopargs[i].sm2_ctx[testnum] == NULL) { + st = 0; + break; + } + loopargs[i].sm2_vfy_ctx[testnum] = EVP_MD_CTX_new(); + if (loopargs[i].sm2_vfy_ctx[testnum] == NULL) { + st = 0; + break; + } + + /* SM2 keys are generated as normal EC keys with a special curve */ + if ((pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL)) == NULL + || EVP_PKEY_keygen_init(pctx) <= 0 + || EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, + test_sm2_curves[testnum].nid) <= 0 + || EVP_PKEY_keygen(pctx, &sm2_pkey) <= 0) { + st = 0; + EVP_PKEY_CTX_free(pctx); + break; + } + /* free previous one and alloc a new one */ + EVP_PKEY_CTX_free(pctx); + + loopargs[i].sigsize = sm2_sigsize + = ECDSA_size(EVP_PKEY_get0_EC_KEY(sm2_pkey)); + + if (!EVP_PKEY_set_alias_type(sm2_pkey, EVP_PKEY_SM2)) { + st = 0; + EVP_PKEY_free(sm2_pkey); + break; + } + + sm2_pctx = EVP_PKEY_CTX_new(sm2_pkey, NULL); + if (sm2_pctx == NULL) { + st = 0; + EVP_PKEY_free(sm2_pkey); + break; + } + sm2_vfy_pctx = EVP_PKEY_CTX_new(sm2_pkey, NULL); + if (sm2_vfy_pctx == NULL) { + st = 0; + EVP_PKEY_CTX_free(sm2_pctx); + EVP_PKEY_free(sm2_pkey); + break; + } + /* + * No need to allow user to set an explicit ID here, just use + * the one defined in the 'draft-yang-tls-tl13-sm-suites' I-D. + */ + if (EVP_PKEY_CTX_set1_id(sm2_pctx, SM2_ID, SM2_ID_LEN) != 1) { + st = 0; + EVP_PKEY_CTX_free(sm2_pctx); + EVP_PKEY_CTX_free(sm2_vfy_pctx); + EVP_PKEY_free(sm2_pkey); + break; + } + + if (EVP_PKEY_CTX_set1_id(sm2_vfy_pctx, SM2_ID, SM2_ID_LEN) != 1) { + st = 0; + EVP_PKEY_CTX_free(sm2_pctx); + EVP_PKEY_CTX_free(sm2_vfy_pctx); + EVP_PKEY_free(sm2_pkey); + break; + } + + EVP_MD_CTX_set_pkey_ctx(loopargs[i].sm2_ctx[testnum], sm2_pctx); + EVP_MD_CTX_set_pkey_ctx(loopargs[i].sm2_vfy_ctx[testnum], sm2_vfy_pctx); + + if (!EVP_DigestSignInit(loopargs[i].sm2_ctx[testnum], NULL, + EVP_sm3(), NULL, sm2_pkey)) { + st = 0; + EVP_PKEY_free(sm2_pkey); + break; + } + if (!EVP_DigestVerifyInit(loopargs[i].sm2_vfy_ctx[testnum], NULL, + EVP_sm3(), NULL, sm2_pkey)) { + st = 0; + EVP_PKEY_free(sm2_pkey); + break; + } + loopargs[i].sm2_pkey[testnum] = sm2_pkey; + } + if (st == 0) { + BIO_printf(bio_err, "SM2 failure.\n"); + ERR_print_errors(bio_err); + rsa_count = 1; + } else { + for (i = 0; i < loopargs_len; i++) { + sm2_sigsize = loopargs[i].sigsize; + /* Perform SM2 signature test */ + st = EVP_DigestSign(loopargs[i].sm2_ctx[testnum], + loopargs[i].buf2, &sm2_sigsize, + loopargs[i].buf, 20); + if (st == 0) + break; + } + if (st == 0) { + BIO_printf(bio_err, + "SM2 sign failure. No SM2 sign will be done.\n"); + ERR_print_errors(bio_err); + rsa_count = 1; + } else { + pkey_print_message("sign", test_sm2_curves[testnum].name, + sm2_c[testnum][0], + test_sm2_curves[testnum].bits, seconds.sm2); + Time_F(START); + count = run_benchmark(async_jobs, SM2_sign_loop, loopargs); + d = Time_F(STOP); + + BIO_printf(bio_err, + mr ? "+R8:%ld:%u:%s:%.2f\n" : + "%ld %u bits %s signs in %.2fs \n", + count, test_sm2_curves[testnum].bits, + test_sm2_curves[testnum].name, d); + sm2_results[testnum][0] = (double)count / d; + rsa_count = count; + } + + /* Perform SM2 verification test */ + for (i = 0; i < loopargs_len; i++) { + st = EVP_DigestVerify(loopargs[i].sm2_vfy_ctx[testnum], + loopargs[i].buf2, loopargs[i].sigsize, + loopargs[i].buf, 20); + if (st != 1) + break; + } + if (st != 1) { + BIO_printf(bio_err, + "SM2 verify failure. No SM2 verify will be done.\n"); + ERR_print_errors(bio_err); + sm2_doit[testnum] = 0; + } else { + pkey_print_message("verify", test_sm2_curves[testnum].name, + sm2_c[testnum][1], + test_sm2_curves[testnum].bits, seconds.sm2); + Time_F(START); + count = run_benchmark(async_jobs, SM2_verify_loop, loopargs); + d = Time_F(STOP); + BIO_printf(bio_err, + mr ? "+R9:%ld:%u:%s:%.2f\n" + : "%ld %u bits %s verify in %.2fs\n", + count, test_sm2_curves[testnum].bits, + test_sm2_curves[testnum].name, d); + sm2_results[testnum][1] = (double)count / d; + } + + if (rsa_count <= 1) { + /* if longer than 10s, don't do any more */ + for (testnum++; testnum < SM2_NUM; testnum++) + sm2_doit[testnum] = 0; + } + } + } +# endif /* OPENSSL_NO_SM2 */ + #endif /* OPENSSL_NO_EC */ #ifndef NO_FORK show_res: @@ -3489,6 +3781,28 @@ int speed_main(int argc, char **argv) 1.0 / eddsa_results[k][0], 1.0 / eddsa_results[k][1], eddsa_results[k][0], eddsa_results[k][1]); } + +# ifndef OPENSSL_NO_SM2 + testnum = 1; + for (k = 0; k < OSSL_NELEM(sm2_doit); k++) { + if (!sm2_doit[k]) + continue; + if (testnum && !mr) { + printf("%30ssign verify sign/s verify/s\n", " "); + testnum = 0; + } + + if (mr) + printf("+F6:%u:%u:%s:%f:%f\n", + k, test_sm2_curves[k].bits, test_sm2_curves[k].name, + sm2_results[k][0], sm2_results[k][1]); + else + printf("%4u bits SM2 (%s) %8.4fs %8.4fs %8.1f %8.1f\n", + test_sm2_curves[k].bits, test_sm2_curves[k].name, + 1.0 / sm2_results[k][0], 1.0 / sm2_results[k][1], + sm2_results[k][0], sm2_results[k][1]); + } +# endif #endif ret = 0; @@ -3514,6 +3828,24 @@ int speed_main(int argc, char **argv) EVP_PKEY_CTX_free(loopargs[i].ecdh_ctx[k]); for (k = 0; k < EdDSA_NUM; k++) EVP_MD_CTX_free(loopargs[i].eddsa_ctx[k]); +# ifndef OPENSSL_NO_SM2 + for (k = 0; k < SM2_NUM; k++) { + EVP_PKEY_CTX *pctx = NULL; + + /* free signing ctx */ + if (loopargs[i].sm2_ctx[k] != NULL + && (pctx = EVP_MD_CTX_pkey_ctx(loopargs[i].sm2_ctx[k])) != NULL) + EVP_PKEY_CTX_free(pctx); + EVP_MD_CTX_free(loopargs[i].sm2_ctx[k]); + /* free verification ctx */ + if (loopargs[i].sm2_vfy_ctx[k] != NULL + && (pctx = EVP_MD_CTX_pkey_ctx(loopargs[i].sm2_vfy_ctx[k])) != NULL) + EVP_PKEY_CTX_free(pctx); + EVP_MD_CTX_free(loopargs[i].sm2_vfy_ctx[k]); + /* free pkey */ + EVP_PKEY_free(loopargs[i].sm2_pkey[k]); + } +# endif OPENSSL_free(loopargs[i].secret_a); OPENSSL_free(loopargs[i].secret_b); #endif @@ -3739,6 +4071,22 @@ static int do_multi(int multi, int size_num) d = atof(sstrsep(&p, sep)); eddsa_results[k][1] += d; } +# ifndef OPENSSL_NO_SM2 + else if (strncmp(buf, "+F7:", 4) == 0) { + int k; + double d; + + p = buf + 4; + k = atoi(sstrsep(&p, sep)); + sstrsep(&p, sep); + + d = atof(sstrsep(&p, sep)); + sm2_results[k][0] += d; + + d = atof(sstrsep(&p, sep)); + sm2_results[k][1] += d; + } +# endif /* OPENSSL_NO_SM2 */ # endif else if (strncmp(buf, "+H:", 3) == 0) { diff --git a/apps/timeouts.h b/apps/timeouts.h index 932be1cc..00285272 100644 --- a/apps/timeouts.h +++ b/apps/timeouts.h @@ -7,11 +7,11 @@ * https://www.openssl.org/source/license.html */ -#ifndef INCLUDED_TIMEOUTS_H -# define INCLUDED_TIMEOUTS_H +#ifndef OSSL_APPS_TIMEOUTS_H +# define OSSL_APPS_TIMEOUTS_H /* numbers in us */ # define DGRAM_RCV_TIMEOUT 250000 # define DGRAM_SND_TIMEOUT 250000 -#endif /* ! INCLUDED_TIMEOUTS_H */ +#endif /* ! OSSL_APPS_TIMEOUTS_H */ diff --git a/apps/ts.c b/apps/ts.c index 4ef8a72e..b45c2627 100644 --- a/apps/ts.c +++ b/apps/ts.c @@ -507,8 +507,9 @@ static int create_digest(BIO *input, const char *digest, const EVP_MD *md, md_value_len = EVP_MD_size(md); } else { long digest_len; + *md_value = OPENSSL_hexstr2buf(digest, &digest_len); - if (!*md_value || md_value_len != digest_len) { + if (*md_value == NULL || md_value_len != digest_len) { OPENSSL_free(*md_value); *md_value = NULL; BIO_printf(bio_err, "bad digest, %d bytes " @@ -920,7 +921,7 @@ static TS_VERIFY_CTX *create_verify_ctx(const char *data, const char *digest, /* Loading untrusted certificates. */ if (untrusted - && TS_VERIFY_CTS_set_certs(ctx, TS_CONF_load_certs(untrusted)) == NULL) + && TS_VERIFY_CTX_set_certs(ctx, TS_CONF_load_certs(untrusted)) == NULL) goto err; ret = 1; diff --git a/build.info b/build.info index a0ecb218..5e63b440 100644 --- a/build.info +++ b/build.info @@ -3,21 +3,17 @@ SUBDIRS=crypto ssl apps test util tools fuzz engines providers LIBS=libcrypto libssl -INCLUDE[libcrypto]=. crypto/include include +INCLUDE[libcrypto]=. include INCLUDE[libssl]=. include DEPEND[libssl]=libcrypto # Empty DEPEND "indices" means the dependencies are expected to be built # unconditionally before anything else. -DEPEND[]=include/openssl/opensslconf.h crypto/include/internal/bn_conf.h \ - crypto/include/internal/dso_conf.h doc/man7/openssl_user_macros.pod -DEPEND[include/openssl/opensslconf.h]=configdata.pm +DEPEND[]=include/openssl/opensslconf.h include/crypto/bn_conf.h \ + include/crypto/dso_conf.h doc/man7/openssl_user_macros.pod GENERATE[include/openssl/opensslconf.h]=include/openssl/opensslconf.h.in -DEPEND[crypto/include/internal/bn_conf.h]=configdata.pm -GENERATE[crypto/include/internal/bn_conf.h]=crypto/include/internal/bn_conf.h.in -DEPEND[crypto/include/internal/dso_conf.h]=configdata.pm -GENERATE[crypto/include/internal/dso_conf.h]=crypto/include/internal/dso_conf.h.in -DEPEND[doc/man7/openssl_user_macros.pod]=configdata.pm +GENERATE[include/crypto/bn_conf.h]=include/crypto/bn_conf.h.in +GENERATE[include/crypto/dso_conf.h]=include/crypto/dso_conf.h.in GENERATE[doc/man7/openssl_user_macros.pod]=doc/man7/openssl_user_macros.pod.in IF[{- defined $target{shared_defflag} -}] diff --git a/crypto/aes/aes_core.c b/crypto/aes/aes_core.c index 2f59c191..a094a9ad 100644 --- a/crypto/aes/aes_core.c +++ b/crypto/aes/aes_core.c @@ -41,7 +41,7 @@ #include #include #include -#include "aes_locl.h" +#include "aes_local.h" #ifndef AES_ASM /*- diff --git a/crypto/aes/aes_ecb.c b/crypto/aes/aes_ecb.c index f7f0f158..f4a75f13 100644 --- a/crypto/aes/aes_ecb.c +++ b/crypto/aes/aes_ecb.c @@ -10,7 +10,7 @@ #include #include -#include "aes_locl.h" +#include "aes_local.h" void AES_ecb_encrypt(const unsigned char *in, unsigned char *out, const AES_KEY *key, const int enc) diff --git a/crypto/aes/aes_ige.c b/crypto/aes/aes_ige.c index 351c1734..b95d3d4b 100644 --- a/crypto/aes/aes_ige.c +++ b/crypto/aes/aes_ige.c @@ -14,7 +14,7 @@ NON_EMPTY_TRANSLATION_UNIT #else #include -#include "aes_locl.h" +#include "aes_local.h" #define N_WORDS (AES_BLOCK_SIZE / sizeof(unsigned long)) typedef struct { diff --git a/crypto/aes/aes_locl.h b/crypto/aes/aes_local.h similarity index 90% rename from crypto/aes/aes_locl.h rename to crypto/aes/aes_local.h index 273c4fd2..b2019058 100644 --- a/crypto/aes/aes_locl.h +++ b/crypto/aes/aes_local.h @@ -7,8 +7,8 @@ * https://www.openssl.org/source/license.html */ -#ifndef HEADER_AES_LOCL_H -# define HEADER_AES_LOCL_H +#ifndef OSSL_CRYPTO_AES_LOCAL_H +# define OSSL_CRYPTO_AES_LOCAL_H # include # include @@ -39,4 +39,4 @@ typedef unsigned char u8; /* This controls loop-unrolling in aes_core.c */ # undef FULL_UNROLL -#endif /* !HEADER_AES_LOCL_H */ +#endif /* !OSSL_CRYPTO_AES_LOCAL_H */ diff --git a/crypto/aes/aes_misc.c b/crypto/aes/aes_misc.c index 0217dc3d..35be71d1 100644 --- a/crypto/aes/aes_misc.c +++ b/crypto/aes/aes_misc.c @@ -9,7 +9,7 @@ #include #include -#include "aes_locl.h" +#include "aes_local.h" const char *AES_options(void) { diff --git a/crypto/aes/aes_x86core.c b/crypto/aes/aes_x86core.c index 1661028b..da525b65 100644 --- a/crypto/aes/aes_x86core.c +++ b/crypto/aes/aes_x86core.c @@ -46,7 +46,7 @@ #include #include -#include "aes_locl.h" +#include "aes_local.h" /* * These two parameters control which table, 256-byte or 2KB, is diff --git a/crypto/aes/build.info b/crypto/aes/build.info index aac88012..291bf2af 100644 --- a/crypto/aes/build.info +++ b/crypto/aes/build.info @@ -61,8 +61,14 @@ ENDIF $COMMON=aes_misc.c aes_ecb.c $AESASM SOURCE[../../libcrypto]=$COMMON aes_cfb.c aes_ofb.c aes_ige.c aes_wrap.c +SOURCE[../../providers/libfips.a]=$COMMON + +# Implementations are now spread across several libraries, so the defines +# need to be applied to all affected libraries and modules. DEFINE[../../libcrypto]=$AESDEF -SOURCE[../../providers/fips]=$COMMON +DEFINE[../../providers/libfips.a]=$AESDEF +DEFINE[../../providers/libimplementations.a]=$AESDEF +# fipsprov.c needs access to AESNI. DEFINE[../../providers/fips]=$AESDEF GENERATE[aes-ia64.s]=asm/aes-ia64.S diff --git a/crypto/aria/aria.c b/crypto/aria/aria.c index 67bd8d95..c1b2254a 100644 --- a/crypto/aria/aria.c +++ b/crypto/aria/aria.c @@ -19,7 +19,7 @@ */ #include -#include "internal/aria.h" +#include "crypto/aria.h" #include #include diff --git a/crypto/arm_arch.h b/crypto/arm_arch.h index 5b156d3c..2d279d64 100644 --- a/crypto/arm_arch.h +++ b/crypto/arm_arch.h @@ -7,8 +7,8 @@ * https://www.openssl.org/source/license.html */ -#ifndef __ARM_ARCH_H__ -# define __ARM_ARCH_H__ +#ifndef OSSL_CRYPTO_ARM_ARCH_H +# define OSSL_CRYPTO_ARM_ARCH_H # if !defined(__ARM_ARCH__) # if defined(__CC_ARM) diff --git a/crypto/asn1/a_bitstr.c b/crypto/asn1/a_bitstr.c index f7db9a34..a1a82f2d 100644 --- a/crypto/asn1/a_bitstr.c +++ b/crypto/asn1/a_bitstr.c @@ -11,7 +11,7 @@ #include #include "internal/cryptlib.h" #include -#include "asn1_locl.h" +#include "asn1_local.h" int ASN1_BIT_STRING_set(ASN1_BIT_STRING *x, unsigned char *d, int len) { diff --git a/crypto/asn1/a_d2i_fp.c b/crypto/asn1/a_d2i_fp.c index a8d80090..186e7ec4 100644 --- a/crypto/asn1/a_d2i_fp.c +++ b/crypto/asn1/a_d2i_fp.c @@ -13,7 +13,7 @@ #include "internal/numbers.h" #include #include -#include "internal/asn1_int.h" +#include "crypto/asn1.h" #ifndef NO_OLD_ASN1 # ifndef OPENSSL_NO_STDIO diff --git a/crypto/asn1/a_gentm.c b/crypto/asn1/a_gentm.c index 2f4fbf66..d82126b0 100644 --- a/crypto/asn1/a_gentm.c +++ b/crypto/asn1/a_gentm.c @@ -15,7 +15,7 @@ #include #include "internal/cryptlib.h" #include -#include "asn1_locl.h" +#include "asn1_local.h" /* This is the primary function used to parse ASN1_GENERALIZEDTIME */ int asn1_generalizedtime_to_tm(struct tm *tm, const ASN1_GENERALIZEDTIME *d) diff --git a/crypto/asn1/a_int.c b/crypto/asn1/a_int.c index f6cc42e6..5676952b 100644 --- a/crypto/asn1/a_int.c +++ b/crypto/asn1/a_int.c @@ -13,7 +13,7 @@ #include #include #include -#include "asn1_locl.h" +#include "asn1_local.h" ASN1_INTEGER *ASN1_INTEGER_dup(const ASN1_INTEGER *x) { diff --git a/crypto/asn1/a_mbstr.c b/crypto/asn1/a_mbstr.c index ea08edc2..122cafd0 100644 --- a/crypto/asn1/a_mbstr.c +++ b/crypto/asn1/a_mbstr.c @@ -8,7 +8,7 @@ */ #include -#include "internal/ctype.h" +#include "crypto/ctype.h" #include "internal/cryptlib.h" #include diff --git a/crypto/asn1/a_object.c b/crypto/asn1/a_object.c index 913fa9a1..123f9300 100644 --- a/crypto/asn1/a_object.c +++ b/crypto/asn1/a_object.c @@ -9,14 +9,14 @@ #include #include -#include "internal/ctype.h" +#include "crypto/ctype.h" #include "internal/cryptlib.h" #include #include #include #include -#include "internal/asn1_int.h" -#include "asn1_locl.h" +#include "crypto/asn1.h" +#include "asn1_local.h" int i2d_ASN1_OBJECT(const ASN1_OBJECT *a, unsigned char **pp) { diff --git a/crypto/asn1/a_print.c b/crypto/asn1/a_print.c index 516f0919..328e0abc 100644 --- a/crypto/asn1/a_print.c +++ b/crypto/asn1/a_print.c @@ -8,7 +8,7 @@ */ #include -#include "internal/ctype.h" +#include "crypto/ctype.h" #include "internal/cryptlib.h" #include diff --git a/crypto/asn1/a_sign.c b/crypto/asn1/a_sign.c index e2ef60f7..fdf25b20 100644 --- a/crypto/asn1/a_sign.c +++ b/crypto/asn1/a_sign.c @@ -18,8 +18,8 @@ #include #include #include -#include "internal/asn1_int.h" -#include "internal/evp_int.h" +#include "crypto/asn1.h" +#include "crypto/evp.h" #ifndef NO_ASN1_OLD diff --git a/crypto/asn1/a_strex.c b/crypto/asn1/a_strex.c index 4f431480..91d78c66 100644 --- a/crypto/asn1/a_strex.c +++ b/crypto/asn1/a_strex.c @@ -10,7 +10,7 @@ #include #include #include "internal/cryptlib.h" -#include "internal/asn1_int.h" +#include "crypto/asn1.h" #include #include #include diff --git a/crypto/asn1/a_strnid.c b/crypto/asn1/a_strnid.c index 630ac192..ab547397 100644 --- a/crypto/asn1/a_strnid.c +++ b/crypto/asn1/a_strnid.c @@ -51,7 +51,7 @@ int ASN1_STRING_set_default_mask_asc(const char *p) char *end; if (strncmp(p, "MASK:", 5) == 0) { - if (!p[5]) + if (p[5] == '\0') return 0; mask = strtoul(p + 5, &end, 0); if (*end) diff --git a/crypto/asn1/a_time.c b/crypto/asn1/a_time.c index 16f0cc3f..c978248d 100644 --- a/crypto/asn1/a_time.c +++ b/crypto/asn1/a_time.c @@ -16,10 +16,10 @@ #include #include -#include "internal/ctype.h" +#include "crypto/ctype.h" #include "internal/cryptlib.h" #include -#include "asn1_locl.h" +#include "asn1_local.h" IMPLEMENT_ASN1_MSTRING(ASN1_TIME, B_ASN1_TIME) diff --git a/crypto/asn1/a_type.c b/crypto/asn1/a_type.c index 9b8810cd..3a75385a 100644 --- a/crypto/asn1/a_type.c +++ b/crypto/asn1/a_type.c @@ -11,7 +11,7 @@ #include "internal/cryptlib.h" #include #include -#include "asn1_locl.h" +#include "asn1_local.h" int ASN1_TYPE_get(const ASN1_TYPE *a) { diff --git a/crypto/asn1/a_utctm.c b/crypto/asn1/a_utctm.c index 000cd4bd..47eb93fe 100644 --- a/crypto/asn1/a_utctm.c +++ b/crypto/asn1/a_utctm.c @@ -11,7 +11,7 @@ #include #include "internal/cryptlib.h" #include -#include "asn1_locl.h" +#include "asn1_local.h" /* This is the primary function used to parse ASN1_UTCTIME */ int asn1_utctime_to_tm(struct tm *tm, const ASN1_UTCTIME *d) diff --git a/crypto/asn1/a_verify.c b/crypto/asn1/a_verify.c index d26c5236..92f94487 100644 --- a/crypto/asn1/a_verify.c +++ b/crypto/asn1/a_verify.c @@ -18,8 +18,8 @@ #include #include #include -#include "internal/asn1_int.h" -#include "internal/evp_int.h" +#include "crypto/asn1.h" +#include "crypto/evp.h" #ifndef NO_ASN1_OLD @@ -116,7 +116,7 @@ int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *a, goto err; } if (mdnid == NID_undef) { - if (!pkey->ameth || !pkey->ameth->item_verify) { + if (pkey->ameth == NULL || pkey->ameth->item_verify == NULL) { ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ASN1_R_UNKNOWN_SIGNATURE_ALGORITHM); goto err; diff --git a/crypto/asn1/ameth_lib.c b/crypto/asn1/ameth_lib.c index b2bcd5ac..9ea5b665 100644 --- a/crypto/asn1/ameth_lib.c +++ b/crypto/asn1/ameth_lib.c @@ -13,8 +13,8 @@ #include #include #include -#include "internal/asn1_int.h" -#include "internal/evp_int.h" +#include "crypto/asn1.h" +#include "crypto/evp.h" #include "standard_methods.h" @@ -56,6 +56,7 @@ static const EVP_PKEY_ASN1_METHOD *pkey_asn1_find(int type) { EVP_PKEY_ASN1_METHOD tmp; const EVP_PKEY_ASN1_METHOD *t = &tmp, **ret; + tmp.pkey_id = type; if (app_methods) { int idx; @@ -64,7 +65,7 @@ static const EVP_PKEY_ASN1_METHOD *pkey_asn1_find(int type) return sk_EVP_PKEY_ASN1_METHOD_value(app_methods, idx); } ret = OBJ_bsearch_ameth(&t, standard_methods, OSSL_NELEM(standard_methods)); - if (!ret || !*ret) + if (ret == NULL || *ret == NULL) return NULL; return *ret; } diff --git a/crypto/asn1/asn1_lib.c b/crypto/asn1/asn1_lib.c index 9a0ec68d..6399de7c 100644 --- a/crypto/asn1/asn1_lib.c +++ b/crypto/asn1/asn1_lib.c @@ -11,7 +11,7 @@ #include #include "internal/cryptlib.h" #include -#include "asn1_locl.h" +#include "asn1_local.h" static int asn1_get_length(const unsigned char **pp, int *inf, long *rl, long max); diff --git a/crypto/asn1/asn1_locl.h b/crypto/asn1/asn1_local.h similarity index 100% rename from crypto/asn1/asn1_locl.h rename to crypto/asn1/asn1_local.h diff --git a/crypto/asn1/asn_mime.c b/crypto/asn1/asn_mime.c index 5c349383..757fe9eb 100644 --- a/crypto/asn1/asn_mime.c +++ b/crypto/asn1/asn_mime.c @@ -8,15 +8,15 @@ */ #include -#include "internal/ctype.h" +#include "crypto/ctype.h" #include "internal/cryptlib.h" #include #include #include #include -#include "internal/evp_int.h" +#include "crypto/evp.h" #include "internal/bio.h" -#include "asn1_locl.h" +#include "asn1_local.h" /* * Generalised MIME like utilities for streaming ASN1. Although many have a @@ -399,7 +399,7 @@ ASN1_VALUE *SMIME_read_ASN1(BIO *bio, BIO **bcont, const ASN1_ITEM *it) if (strcmp(hdr->value, "multipart/signed") == 0) { /* Split into two parts */ prm = mime_param_find(hdr, "boundary"); - if (!prm || !prm->param_value) { + if (prm == NULL || prm->param_value == NULL) { sk_MIME_HEADER_pop_free(headers, mime_hdr_free); ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_NO_MULTIPART_BOUNDARY); return NULL; diff --git a/crypto/asn1/asn_moid.c b/crypto/asn1/asn_moid.c index 251a7efc..90f80760 100644 --- a/crypto/asn1/asn_moid.c +++ b/crypto/asn1/asn_moid.c @@ -8,13 +8,13 @@ */ #include -#include "internal/ctype.h" +#include "crypto/ctype.h" #include #include "internal/cryptlib.h" #include #include -#include "internal/asn1_int.h" -#include "internal/objects.h" +#include "crypto/asn1.h" +#include "crypto/objects.h" /* Simple ASN1 OID module: add all objects in a given section */ diff --git a/crypto/asn1/bio_ndef.c b/crypto/asn1/bio_ndef.c index db9bbba9..bc7b4499 100644 --- a/crypto/asn1/bio_ndef.c +++ b/crypto/asn1/bio_ndef.c @@ -108,7 +108,7 @@ static int ndef_prefix(BIO *b, unsigned char **pbuf, int *plen, void *parg) unsigned char *p; int derlen; - if (!parg) + if (parg == NULL) return 0; ndef_aux = *(NDEF_SUPPORT **)parg; @@ -123,7 +123,7 @@ static int ndef_prefix(BIO *b, unsigned char **pbuf, int *plen, void *parg) *pbuf = p; derlen = ASN1_item_ndef_i2d(ndef_aux->val, &p, ndef_aux->it); - if (!*ndef_aux->boundary) + if (*ndef_aux->boundary == NULL) return 0; *plen = *ndef_aux->boundary - *pbuf; @@ -136,7 +136,7 @@ static int ndef_prefix_free(BIO *b, unsigned char **pbuf, int *plen, { NDEF_SUPPORT *ndef_aux; - if (!parg) + if (parg == NULL) return 0; ndef_aux = *(NDEF_SUPPORT **)parg; @@ -168,7 +168,7 @@ static int ndef_suffix(BIO *b, unsigned char **pbuf, int *plen, void *parg) const ASN1_AUX *aux; ASN1_STREAM_ARG sarg; - if (!parg) + if (parg == NULL) return 0; ndef_aux = *(NDEF_SUPPORT **)parg; @@ -195,7 +195,7 @@ static int ndef_suffix(BIO *b, unsigned char **pbuf, int *plen, void *parg) *pbuf = p; derlen = ASN1_item_ndef_i2d(ndef_aux->val, &p, ndef_aux->it); - if (!*ndef_aux->boundary) + if (*ndef_aux->boundary == NULL) return 0; *pbuf = *ndef_aux->boundary; *plen = derlen - (*ndef_aux->boundary - ndef_aux->derbuf); diff --git a/crypto/asn1/d2i_param.c b/crypto/asn1/d2i_param.c index e852470a..c82b4a8f 100644 --- a/crypto/asn1/d2i_param.c +++ b/crypto/asn1/d2i_param.c @@ -11,8 +11,8 @@ #include "internal/cryptlib.h" #include #include -#include "internal/evp_int.h" -#include "internal/asn1_int.h" +#include "crypto/evp.h" +#include "crypto/asn1.h" EVP_PKEY *d2i_KeyParams(int type, EVP_PKEY **a, const unsigned char **pp, long length) diff --git a/crypto/asn1/d2i_pr.c b/crypto/asn1/d2i_pr.c index c683f62c..08101a82 100644 --- a/crypto/asn1/d2i_pr.c +++ b/crypto/asn1/d2i_pr.c @@ -15,8 +15,8 @@ #include #include #include -#include "internal/asn1_int.h" -#include "internal/evp_int.h" +#include "crypto/asn1.h" +#include "crypto/evp.h" EVP_PKEY *d2i_PrivateKey(int type, EVP_PKEY **a, const unsigned char **pp, long length) @@ -48,7 +48,7 @@ EVP_PKEY *d2i_PrivateKey(int type, EVP_PKEY **a, const unsigned char **pp, EVP_PKEY *tmp; PKCS8_PRIV_KEY_INFO *p8 = NULL; p8 = d2i_PKCS8_PRIV_KEY_INFO(NULL, &p, length); - if (!p8) + if (p8 == NULL) goto err; tmp = EVP_PKCS82PKEY(p8); PKCS8_PRIV_KEY_INFO_free(p8); @@ -104,7 +104,7 @@ EVP_PKEY *d2i_AutoPrivateKey(EVP_PKEY **a, const unsigned char **pp, EVP_PKEY *ret; sk_ASN1_TYPE_pop_free(inkey, ASN1_TYPE_free); - if (!p8) { + if (p8 == NULL) { ASN1err(ASN1_F_D2I_AUTOPRIVATEKEY, ASN1_R_UNSUPPORTED_PUBLIC_KEY_TYPE); return NULL; diff --git a/crypto/asn1/d2i_pu.c b/crypto/asn1/d2i_pu.c index 8876878f..4b26ec04 100644 --- a/crypto/asn1/d2i_pu.c +++ b/crypto/asn1/d2i_pu.c @@ -17,7 +17,7 @@ #include #include -#include "internal/evp_int.h" +#include "crypto/evp.h" EVP_PKEY *d2i_PublicKey(int type, EVP_PKEY **a, const unsigned char **pp, long length) diff --git a/crypto/asn1/f_int.c b/crypto/asn1/f_int.c index de7d9836..295ecb6f 100644 --- a/crypto/asn1/f_int.c +++ b/crypto/asn1/f_int.c @@ -8,7 +8,7 @@ */ #include -#include "internal/ctype.h" +#include "crypto/ctype.h" #include "internal/cryptlib.h" #include #include diff --git a/crypto/asn1/f_string.c b/crypto/asn1/f_string.c index dbca0c06..0b930dfd 100644 --- a/crypto/asn1/f_string.c +++ b/crypto/asn1/f_string.c @@ -8,7 +8,7 @@ */ #include -#include "internal/ctype.h" +#include "crypto/ctype.h" #include "internal/cryptlib.h" #include #include diff --git a/crypto/asn1/i2d_param.c b/crypto/asn1/i2d_param.c index 2e900089..1e1ebc95 100644 --- a/crypto/asn1/i2d_param.c +++ b/crypto/asn1/i2d_param.c @@ -12,8 +12,8 @@ #include #include #include -#include "internal/asn1_int.h" -#include "internal/evp_int.h" +#include "crypto/asn1.h" +#include "crypto/evp.h" int i2d_KeyParams(const EVP_PKEY *a, unsigned char **pp) { diff --git a/crypto/asn1/i2d_pr.c b/crypto/asn1/i2d_pr.c index 7133d3da..4decdb1d 100644 --- a/crypto/asn1/i2d_pr.c +++ b/crypto/asn1/i2d_pr.c @@ -11,8 +11,8 @@ #include "internal/cryptlib.h" #include #include -#include "internal/asn1_int.h" -#include "internal/evp_int.h" +#include "crypto/asn1.h" +#include "crypto/evp.h" int i2d_PrivateKey(const EVP_PKEY *a, unsigned char **pp) { diff --git a/crypto/asn1/p5_pbev2.c b/crypto/asn1/p5_pbev2.c index 49298f35..f7f5f465 100644 --- a/crypto/asn1/p5_pbev2.c +++ b/crypto/asn1/p5_pbev2.c @@ -107,7 +107,7 @@ X509_ALGOR *PKCS5_pbe2_set_iv(const EVP_CIPHER *cipher, int iter, pbe2->keyfunc = PKCS5_pbkdf2_set(iter, salt, saltlen, prf_nid, keylen); - if (!pbe2->keyfunc) + if (pbe2->keyfunc == NULL) goto merr; /* Now set up top level AlgorithmIdentifier */ diff --git a/crypto/asn1/p8_pkey.c b/crypto/asn1/p8_pkey.c index 94b32646..c55353ae 100644 --- a/crypto/asn1/p8_pkey.c +++ b/crypto/asn1/p8_pkey.c @@ -11,7 +11,7 @@ #include "internal/cryptlib.h" #include #include -#include "internal/x509_int.h" +#include "crypto/x509.h" /* Minor tweak to operation: zero private key data */ static int pkey_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it, diff --git a/crypto/asn1/t_pkey.c b/crypto/asn1/t_pkey.c index 483dd109..03579c87 100644 --- a/crypto/asn1/t_pkey.c +++ b/crypto/asn1/t_pkey.c @@ -11,7 +11,7 @@ #include "internal/cryptlib.h" #include #include -#include "internal/bn_int.h" +#include "crypto/bn.h" /* Number of octets per line */ #define ASN1_BUF_PRINT_WIDTH 15 diff --git a/crypto/asn1/t_spki.c b/crypto/asn1/t_spki.c index 5cbb13e3..b634808c 100644 --- a/crypto/asn1/t_spki.c +++ b/crypto/asn1/t_spki.c @@ -30,7 +30,7 @@ int NETSCAPE_SPKI_print(BIO *out, NETSCAPE_SPKI *spki) BIO_printf(out, " Public Key Algorithm: %s\n", (i == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(i)); pkey = X509_PUBKEY_get(spki->spkac->pubkey); - if (!pkey) + if (pkey == NULL) BIO_printf(out, " Unable to load public key\n"); else { EVP_PKEY_print_public(out, pkey, 4, NULL); diff --git a/crypto/asn1/tasn_dec.c b/crypto/asn1/tasn_dec.c index 87c01f0b..f720c602 100644 --- a/crypto/asn1/tasn_dec.c +++ b/crypto/asn1/tasn_dec.c @@ -15,7 +15,7 @@ #include #include #include "internal/numbers.h" -#include "asn1_locl.h" +#include "asn1_local.h" /* @@ -108,7 +108,8 @@ ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **pval, { ASN1_TLC c; ASN1_VALUE *ptmpval = NULL; - if (!pval) + + if (pval == NULL) pval = &ptmpval; asn1_tlc_clear_nc(&c); if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0) @@ -149,7 +150,8 @@ static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in, int otag; int ret = 0; ASN1_VALUE **pchptr; - if (!pval) + + if (pval == NULL) return 0; if (aux && aux->asn1_cb) asn1_cb = aux->asn1_cb; @@ -303,7 +305,7 @@ static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in, goto err; } - if (!*pval && !ASN1_item_ex_new(pval, it)) { + if (*pval == NULL && !ASN1_item_ex_new(pval, it)) { ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ERR_R_NESTED_ASN1_ERROR); goto err; } @@ -554,7 +556,7 @@ static int asn1_template_noexp_d2i(ASN1_VALUE **val, return 0; } else if (ret == -1) return -1; - if (!*val) + if (*val == NULL) *val = (ASN1_VALUE *)sk_ASN1_VALUE_new_null(); else { /* @@ -568,7 +570,7 @@ static int asn1_template_noexp_d2i(ASN1_VALUE **val, } } - if (!*val) { + if (*val == NULL) { ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I, ERR_R_MALLOC_FAILURE); goto err; } @@ -649,7 +651,8 @@ static int asn1_d2i_ex_primitive(ASN1_VALUE **pval, BUF_MEM buf = { 0, NULL, 0, 0 }; const unsigned char *cont = NULL; long len; - if (!pval) { + + if (pval == NULL) { ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ASN1_R_ILLEGAL_NULL); return 0; /* Should never happen */ } @@ -786,7 +789,7 @@ static int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len, return pf->prim_c2i(pval, cont, len, utype, free_cont, it); /* If ANY type clear type and set pointer to internal value */ if (it->utype == V_ASN1_ANY) { - if (!*pval) { + if (*pval == NULL) { typ = ASN1_TYPE_new(); if (typ == NULL) goto err; @@ -866,7 +869,7 @@ static int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len, goto err; } /* All based on ASN1_STRING and handled the same */ - if (!*pval) { + if (*pval == NULL) { stmp = ASN1_STRING_type_new(utype); if (stmp == NULL) { ASN1err(ASN1_F_ASN1_EX_C2I, ERR_R_MALLOC_FAILURE); @@ -1058,10 +1061,11 @@ static int collect_data(BUF_MEM *buf, const unsigned char **p, long plen) static int asn1_check_eoc(const unsigned char **in, long len) { const unsigned char *p; + if (len < 2) return 0; p = *in; - if (!p[0] && !p[1]) { + if (p[0] == '\0' && p[1] == '\0') { *in += 2; return 1; } diff --git a/crypto/asn1/tasn_enc.c b/crypto/asn1/tasn_enc.c index 8ab9c370..d8abd816 100644 --- a/crypto/asn1/tasn_enc.c +++ b/crypto/asn1/tasn_enc.c @@ -13,8 +13,8 @@ #include #include #include -#include "internal/asn1_int.h" -#include "asn1_locl.h" +#include "crypto/asn1.h" +#include "asn1_local.h" static int asn1_i2d_ex_primitive(const ASN1_VALUE **pval, unsigned char **out, const ASN1_ITEM *it, int tag, int aclass); @@ -55,7 +55,7 @@ int ASN1_item_i2d(const ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *i static int asn1_item_flags_i2d(const ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it, int flags) { - if (out && !*out) { + if (out != NULL && *out == NULL) { unsigned char *p, *buf; int len; @@ -89,7 +89,7 @@ int ASN1_item_ex_i2d(const ASN1_VALUE **pval, unsigned char **out, const ASN1_AUX *aux = it->funcs; ASN1_aux_const_cb *asn1_cb = NULL; - if ((it->itype != ASN1_ITYPE_PRIMITIVE) && !*pval) + if ((it->itype != ASN1_ITYPE_PRIMITIVE) && *pval == NULL) return 0; if (aux != NULL) { @@ -258,7 +258,7 @@ static int asn1_template_ex_i2d(const ASN1_VALUE **pval, unsigned char **out, int skcontlen, sklen; const ASN1_VALUE *skitem; - if (!*pval) + if (*pval == NULL) return 0; if (flags & ASN1_TFLG_SET_OF) { @@ -510,7 +510,7 @@ static int asn1_ex_i2c(const ASN1_VALUE **pval, unsigned char *cout, int *putype /* Should type be omitted? */ if ((it->itype != ASN1_ITYPE_PRIMITIVE) || (it->utype != V_ASN1_BOOLEAN)) { - if (!*pval) + if (*pval == NULL) return -1; } diff --git a/crypto/asn1/tasn_fre.c b/crypto/asn1/tasn_fre.c index bffa6f15..e8d57bda 100644 --- a/crypto/asn1/tasn_fre.c +++ b/crypto/asn1/tasn_fre.c @@ -11,7 +11,7 @@ #include #include #include -#include "asn1_locl.h" +#include "asn1_local.h" /* Free up an ASN1 structure */ @@ -33,9 +33,9 @@ void asn1_item_embed_free(ASN1_VALUE **pval, const ASN1_ITEM *it, int embed) ASN1_aux_cb *asn1_cb; int i; - if (!pval) + if (pval == NULL) return; - if ((it->itype != ASN1_ITYPE_PRIMITIVE) && !*pval) + if ((it->itype != ASN1_ITYPE_PRIMITIVE) && *pval == NULL) return; if (aux && aux->asn1_cb) asn1_cb = aux->asn1_cb; @@ -168,15 +168,15 @@ void asn1_primitive_free(ASN1_VALUE **pval, const ASN1_ITEM *it, int embed) utype = typ->type; pval = &typ->value.asn1_value; - if (!*pval) + if (*pval == NULL) return; } else if (it->itype == ASN1_ITYPE_MSTRING) { utype = -1; - if (!*pval) + if (*pval == NULL) return; } else { utype = it->utype; - if ((utype != V_ASN1_BOOLEAN) && !*pval) + if ((utype != V_ASN1_BOOLEAN) && *pval == NULL) return; } diff --git a/crypto/asn1/tasn_new.c b/crypto/asn1/tasn_new.c index f9b924c1..155080dd 100644 --- a/crypto/asn1/tasn_new.c +++ b/crypto/asn1/tasn_new.c @@ -13,7 +13,7 @@ #include #include #include -#include "asn1_locl.h" +#include "asn1_local.h" static int asn1_item_embed_new(ASN1_VALUE **pval, const ASN1_ITEM *it, int embed); diff --git a/crypto/asn1/tasn_prn.c b/crypto/asn1/tasn_prn.c index 0f56fb09..ff86400d 100644 --- a/crypto/asn1/tasn_prn.c +++ b/crypto/asn1/tasn_prn.c @@ -15,8 +15,8 @@ #include #include #include -#include "internal/asn1_int.h" -#include "asn1_locl.h" +#include "crypto/asn1.h" +#include "asn1_local.h" /* * Print routines. diff --git a/crypto/asn1/tasn_scn.c b/crypto/asn1/tasn_scn.c index d09cf57f..a8401c9d 100644 --- a/crypto/asn1/tasn_scn.c +++ b/crypto/asn1/tasn_scn.c @@ -15,7 +15,7 @@ #include #include #include -#include "asn1_locl.h" +#include "asn1_local.h" /* * General ASN1 structure recursive scanner: iterate through all fields diff --git a/crypto/asn1/tasn_utl.c b/crypto/asn1/tasn_utl.c index 53dad7af..a31c7c27 100644 --- a/crypto/asn1/tasn_utl.c +++ b/crypto/asn1/tasn_utl.c @@ -15,7 +15,7 @@ #include #include #include -#include "asn1_locl.h" +#include "asn1_local.h" /* Utility functions for manipulating fields and offsets */ diff --git a/crypto/asn1/x_algor.c b/crypto/asn1/x_algor.c index 77363fe7..94c2aa3a 100644 --- a/crypto/asn1/x_algor.c +++ b/crypto/asn1/x_algor.c @@ -11,7 +11,7 @@ #include #include #include -#include "internal/evp_int.h" +#include "crypto/evp.h" ASN1_SEQUENCE(X509_ALGOR) = { ASN1_SIMPLE(X509_ALGOR, algorithm, ASN1_OBJECT), diff --git a/crypto/asn1/x_bignum.c b/crypto/asn1/x_bignum.c index c5e89290..3ae58a49 100644 --- a/crypto/asn1/x_bignum.c +++ b/crypto/asn1/x_bignum.c @@ -82,7 +82,7 @@ static int bn_secure_new(ASN1_VALUE **pval, const ASN1_ITEM *it) static void bn_free(ASN1_VALUE **pval, const ASN1_ITEM *it) { - if (!*pval) + if (*pval == NULL) return; if (it->size & BN_SENSITIVE) BN_clear_free((BIGNUM *)*pval); @@ -96,7 +96,7 @@ static int bn_i2c(const ASN1_VALUE **pval, unsigned char *cont, int *putype, { BIGNUM *bn; int pad; - if (!*pval) + if (*pval == NULL) return -1; bn = (BIGNUM *)*pval; /* If MSB set in an octet we need a padding byte */ @@ -133,7 +133,7 @@ static int bn_secure_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len, int ret; BIGNUM *bn; - if (!*pval && !bn_secure_new(pval, it)) + if (*pval == NULL && !bn_secure_new(pval, it)) return 0; ret = bn_c2i(pval, cont, len, utype, free_cont, it); diff --git a/crypto/asn1/x_int64.c b/crypto/asn1/x_int64.c index 1b55f4f8..211cdc4e 100644 --- a/crypto/asn1/x_int64.c +++ b/crypto/asn1/x_int64.c @@ -12,7 +12,7 @@ #include "internal/numbers.h" #include #include -#include "asn1_locl.h" +#include "asn1_local.h" /* * Custom primitive types for handling int32_t, int64_t, uint32_t, uint64_t. diff --git a/crypto/asn1/x_sig.c b/crypto/asn1/x_sig.c index f8ca810f..759a9566 100644 --- a/crypto/asn1/x_sig.c +++ b/crypto/asn1/x_sig.c @@ -11,7 +11,7 @@ #include "internal/cryptlib.h" #include #include -#include "internal/x509_int.h" +#include "crypto/x509.h" ASN1_SEQUENCE(X509_SIG) = { ASN1_SIMPLE(X509_SIG, algor, X509_ALGOR), diff --git a/crypto/asn1_dsa.c b/crypto/asn1_dsa.c index 8423ff88..972a9eb9 100644 --- a/crypto/asn1_dsa.c +++ b/crypto/asn1_dsa.c @@ -23,7 +23,7 @@ #include #include -#include "internal/asn1_dsa.h" +#include "crypto/asn1_dsa.h" #include "internal/packet.h" #define ID_SEQUENCE 0x30 diff --git a/crypto/async/arch/async_null.c b/crypto/async/arch/async_null.c index 1ffc5d14..675c1d35 100644 --- a/crypto/async/arch/async_null.c +++ b/crypto/async/arch/async_null.c @@ -8,7 +8,7 @@ */ /* This must be the first #include file */ -#include "../async_locl.h" +#include "../async_local.h" #ifdef ASYNC_NULL int ASYNC_is_capable(void) diff --git a/crypto/async/arch/async_posix.c b/crypto/async/arch/async_posix.c index 2a1cdfcc..7476970e 100644 --- a/crypto/async/arch/async_posix.c +++ b/crypto/async/arch/async_posix.c @@ -8,7 +8,7 @@ */ /* This must be the first #include file */ -#include "../async_locl.h" +#include "../async_local.h" #ifdef ASYNC_POSIX diff --git a/crypto/async/arch/async_posix.h b/crypto/async/arch/async_posix.h index 528733e1..aba713e7 100644 --- a/crypto/async/arch/async_posix.h +++ b/crypto/async/arch/async_posix.h @@ -7,8 +7,8 @@ * https://www.openssl.org/source/license.html */ -#ifndef OPENSSL_ASYNC_ARCH_ASYNC_POSIX_H -#define OPENSSL_ASYNC_ARCH_ASYNC_POSIX_H +#ifndef OSSL_CRYPTO_ASYNC_POSIX_H +#define OSSL_CRYPTO_ASYNC_POSIX_H #include #if defined(OPENSSL_SYS_UNIX) \ @@ -55,4 +55,4 @@ void async_fibre_free(async_fibre *fibre); # endif #endif -#endif /* OPENSSL_ASYNC_ARCH_ASYNC_POSIX_H */ +#endif /* OSSL_CRYPTO_ASYNC_POSIX_H */ diff --git a/crypto/async/arch/async_win.c b/crypto/async/arch/async_win.c index 848f432b..0db9efe3 100644 --- a/crypto/async/arch/async_win.c +++ b/crypto/async/arch/async_win.c @@ -8,7 +8,7 @@ */ /* This must be the first #include file */ -#include "../async_locl.h" +#include "../async_local.h" #ifdef ASYNC_WIN diff --git a/crypto/async/async.c b/crypto/async/async.c index 43b16a7b..312f4732 100644 --- a/crypto/async/async.c +++ b/crypto/async/async.c @@ -16,10 +16,10 @@ #undef _FORTIFY_SOURCE /* This must be the first #include file */ -#include "async_locl.h" +#include "async_local.h" #include -#include "internal/cryptlib_int.h" +#include "crypto/cryptlib.h" #include #define ASYNC_JOB_RUNNING 0 @@ -287,7 +287,7 @@ static void async_empty_pool(async_pool *pool) { ASYNC_JOB *job; - if (!pool || !pool->jobs) + if (pool == NULL || pool->jobs == NULL) return; do { diff --git a/crypto/async/async_locl.h b/crypto/async/async_local.h similarity index 98% rename from crypto/async/async_locl.h rename to crypto/async/async_local.h index 85dfcfa6..549a27e6 100644 --- a/crypto/async/async_locl.h +++ b/crypto/async/async_local.h @@ -20,7 +20,7 @@ # include #endif -#include "internal/async.h" +#include "crypto/async.h" #include typedef struct async_ctx_st async_ctx; diff --git a/crypto/async/async_wait.c b/crypto/async/async_wait.c index 642b781f..87e480d9 100644 --- a/crypto/async/async_wait.c +++ b/crypto/async/async_wait.c @@ -8,7 +8,7 @@ */ /* This must be the first #include file */ -#include "async_locl.h" +#include "async_local.h" #include diff --git a/crypto/bf/bf_cfb64.c b/crypto/bf/bf_cfb64.c index ec1ec0d9..6f4fe33e 100644 --- a/crypto/bf/bf_cfb64.c +++ b/crypto/bf/bf_cfb64.c @@ -8,7 +8,7 @@ */ #include -#include "bf_locl.h" +#include "bf_local.h" /* * The input and output encrypted as though 64bit cfb mode is being used. diff --git a/crypto/bf/bf_ecb.c b/crypto/bf/bf_ecb.c index e07da392..512d7176 100644 --- a/crypto/bf/bf_ecb.c +++ b/crypto/bf/bf_ecb.c @@ -8,7 +8,7 @@ */ #include -#include "bf_locl.h" +#include "bf_local.h" #include /* diff --git a/crypto/bf/bf_enc.c b/crypto/bf/bf_enc.c index 216163ad..3f0c5b4e 100644 --- a/crypto/bf/bf_enc.c +++ b/crypto/bf/bf_enc.c @@ -8,7 +8,7 @@ */ #include -#include "bf_locl.h" +#include "bf_local.h" /* * Blowfish as implemented from 'Blowfish: Springer-Verlag paper' (From diff --git a/crypto/bf/bf_locl.h b/crypto/bf/bf_local.h similarity index 98% rename from crypto/bf/bf_locl.h rename to crypto/bf/bf_local.h index a59ceae8..080f37a5 100644 --- a/crypto/bf/bf_locl.h +++ b/crypto/bf/bf_local.h @@ -7,8 +7,8 @@ * https://www.openssl.org/source/license.html */ -#ifndef HEADER_BF_LOCL_H -# define HEADER_BF_LOCL_H +#ifndef OSSL_CRYPTO_BF_LOCAL_H +# define OSSL_CRYPTO_BF_LOCAL_H # include /* NOTE - c is not incremented as per n2l */ diff --git a/crypto/bf/bf_ofb64.c b/crypto/bf/bf_ofb64.c index 74038336..8df34aa1 100644 --- a/crypto/bf/bf_ofb64.c +++ b/crypto/bf/bf_ofb64.c @@ -8,7 +8,7 @@ */ #include -#include "bf_locl.h" +#include "bf_local.h" /* * The input and output encrypted as though 64bit ofb mode is being used. diff --git a/crypto/bf/bf_skey.c b/crypto/bf/bf_skey.c index 29d80443..e358b1de 100644 --- a/crypto/bf/bf_skey.c +++ b/crypto/bf/bf_skey.c @@ -10,7 +10,7 @@ #include #include #include -#include "bf_locl.h" +#include "bf_local.h" #include "bf_pi.h" void BF_set_key(BF_KEY *key, int len, const unsigned char *data) diff --git a/crypto/bio/b_addr.c b/crypto/bio/b_addr.c index ae82f098..46520031 100644 --- a/crypto/bio/b_addr.c +++ b/crypto/bio/b_addr.c @@ -10,7 +10,7 @@ #include #include -#include "bio_lcl.h" +#include "bio_local.h" #include #ifndef OPENSSL_NO_SOCK @@ -22,7 +22,7 @@ CRYPTO_RWLOCK *bio_lookup_lock; static CRYPTO_ONCE bio_lookup_init = CRYPTO_ONCE_STATIC_INIT; /* - * Throughout this file and bio_lcl.h, the existence of the macro + * Throughout this file and bio_local.h, the existence of the macro * AI_PASSIVE is used to detect the availability of struct addrinfo, * getnameinfo() and getaddrinfo(). If that macro doesn't exist, * we use our own implementation instead, using gethostbyname, @@ -695,9 +695,11 @@ int BIO_lookup_ex(const char *host, const char *service, int lookup_type, hints.ai_flags |= AI_PASSIVE; /* Note that |res| SHOULD be a 'struct addrinfo **' thanks to - * macro magic in bio_lcl.h + * macro magic in bio_local.h */ +# if defined(AI_ADDRCONFIG) && defined(AI_NUMERICHOST) retry: +# endif switch ((gai_ret = getaddrinfo(host, service, &hints, res))) { # ifdef EAI_SYSTEM case EAI_SYSTEM: diff --git a/crypto/bio/b_dump.c b/crypto/bio/b_dump.c index 018c4acb..b99ebc04 100644 --- a/crypto/bio/b_dump.c +++ b/crypto/bio/b_dump.c @@ -12,7 +12,7 @@ */ #include -#include "bio_lcl.h" +#include "bio_local.h" #define DUMP_WIDTH 16 #define DUMP_WIDTH_LESS_INDENT(i) (DUMP_WIDTH - ((i - (i > 6 ? 6 : i) + 3) / 4)) diff --git a/crypto/bio/b_print.c b/crypto/bio/b_print.c index 438cd0e6..0d6fafcc 100644 --- a/crypto/bio/b_print.c +++ b/crypto/bio/b_print.c @@ -10,7 +10,7 @@ #include #include #include "internal/cryptlib.h" -#include "internal/ctype.h" +#include "crypto/ctype.h" #include "internal/numbers.h" #include diff --git a/crypto/bio/b_sock.c b/crypto/bio/b_sock.c index 1747cce6..8e40d864 100644 --- a/crypto/bio/b_sock.c +++ b/crypto/bio/b_sock.c @@ -10,7 +10,7 @@ #include #include #include -#include "bio_lcl.h" +#include "bio_local.h" #ifndef OPENSSL_NO_SOCK # define SOCKET_PROTOCOL IPPROTO_TCP # ifdef SO_MAXCONN diff --git a/crypto/bio/b_sock2.c b/crypto/bio/b_sock2.c index abfd7047..942825a8 100644 --- a/crypto/bio/b_sock2.c +++ b/crypto/bio/b_sock2.c @@ -11,7 +11,7 @@ #include #include -#include "bio_lcl.h" +#include "bio_local.h" #include diff --git a/crypto/bio/bf_buff.c b/crypto/bio/bf_buff.c index f39f6f0a..80db0b57 100644 --- a/crypto/bio/bf_buff.c +++ b/crypto/bio/bf_buff.c @@ -9,7 +9,7 @@ #include #include -#include "bio_lcl.h" +#include "bio_local.h" #include "internal/cryptlib.h" static int buffer_write(BIO *h, const char *buf, int num); diff --git a/crypto/bio/bf_lbuf.c b/crypto/bio/bf_lbuf.c index edc72747..6b5a241a 100644 --- a/crypto/bio/bf_lbuf.c +++ b/crypto/bio/bf_lbuf.c @@ -9,7 +9,7 @@ #include #include -#include "bio_lcl.h" +#include "bio_local.h" #include "internal/cryptlib.h" #include diff --git a/crypto/bio/bf_nbio.c b/crypto/bio/bf_nbio.c index cbf14cff..6f6ccfb1 100644 --- a/crypto/bio/bf_nbio.c +++ b/crypto/bio/bf_nbio.c @@ -9,7 +9,7 @@ #include #include -#include "bio_lcl.h" +#include "bio_local.h" #include "internal/cryptlib.h" #include diff --git a/crypto/bio/bf_null.c b/crypto/bio/bf_null.c index 8e1a803d..e548bdc9 100644 --- a/crypto/bio/bf_null.c +++ b/crypto/bio/bf_null.c @@ -9,7 +9,7 @@ #include #include -#include "bio_lcl.h" +#include "bio_local.h" #include "internal/cryptlib.h" /* diff --git a/crypto/bio/bio_cb.c b/crypto/bio/bio_cb.c index 3ff6dfed..154fb5c9 100644 --- a/crypto/bio/bio_cb.c +++ b/crypto/bio/bio_cb.c @@ -10,7 +10,7 @@ #include #include #include -#include "bio_lcl.h" +#include "bio_local.h" #include "internal/cryptlib.h" #include diff --git a/crypto/bio/bio_lib.c b/crypto/bio/bio_lib.c index 9d63b491..b60568e0 100644 --- a/crypto/bio/bio_lib.c +++ b/crypto/bio/bio_lib.c @@ -10,7 +10,7 @@ #include #include #include -#include "bio_lcl.h" +#include "bio_local.h" #include "internal/cryptlib.h" diff --git a/crypto/bio/bio_lcl.h b/crypto/bio/bio_local.h similarity index 97% rename from crypto/bio/bio_lcl.h rename to crypto/bio/bio_local.h index 95f3a937..30e56cba 100644 --- a/crypto/bio/bio_lcl.h +++ b/crypto/bio/bio_local.h @@ -27,11 +27,11 @@ * For clarity, we check for internal/cryptlib.h since it's a common header * that also includes bio.h. */ -# ifdef HEADER_CRYPTLIB_H -# error internal/cryptlib.h included before bio_lcl.h +# ifdef OSSL_INTERNAL_CRYPTLIB_H +# error internal/cryptlib.h included before bio_local.h # endif -# ifdef HEADER_BIO_H -# error openssl/bio.h included before bio_lcl.h +# ifdef OPENSSL_BIO_H +# error openssl/bio.h included before bio_local.h # endif /* diff --git a/crypto/bio/bio_meth.c b/crypto/bio/bio_meth.c index c1b30480..d32aeadf 100644 --- a/crypto/bio/bio_meth.c +++ b/crypto/bio/bio_meth.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "bio_lcl.h" +#include "bio_local.h" #include "internal/thread_once.h" CRYPTO_RWLOCK *bio_type_lock = NULL; diff --git a/crypto/bio/bss_acpt.c b/crypto/bio/bss_acpt.c index 830c1b96..3c2b279b 100644 --- a/crypto/bio/bss_acpt.c +++ b/crypto/bio/bss_acpt.c @@ -9,7 +9,7 @@ #include #include -#include "bio_lcl.h" +#include "bio_local.h" #ifndef OPENSSL_NO_SOCK diff --git a/crypto/bio/bss_bio.c b/crypto/bio/bss_bio.c index 8a9d8590..268f010f 100644 --- a/crypto/bio/bss_bio.c +++ b/crypto/bio/bss_bio.c @@ -21,7 +21,7 @@ #include #include -#include "bio_lcl.h" +#include "bio_local.h" #include #include diff --git a/crypto/bio/bss_conn.c b/crypto/bio/bss_conn.c index 56fb392c..afcf4367 100644 --- a/crypto/bio/bss_conn.c +++ b/crypto/bio/bss_conn.c @@ -10,7 +10,7 @@ #include #include -#include "bio_lcl.h" +#include "bio_local.h" #ifndef OPENSSL_NO_SOCK diff --git a/crypto/bio/bss_dgram.c b/crypto/bio/bss_dgram.c index c52b0f04..ff961450 100644 --- a/crypto/bio/bss_dgram.c +++ b/crypto/bio/bss_dgram.c @@ -10,7 +10,7 @@ #include #include -#include "bio_lcl.h" +#include "bio_local.h" #ifndef OPENSSL_NO_DGRAM # ifndef OPENSSL_NO_SCTP diff --git a/crypto/bio/bss_fd.c b/crypto/bio/bss_fd.c index c599dada..9db3317e 100644 --- a/crypto/bio/bss_fd.c +++ b/crypto/bio/bss_fd.c @@ -10,7 +10,7 @@ #include #include -#include "bio_lcl.h" +#include "bio_local.h" #if defined(OPENSSL_NO_POSIX_IO) /* diff --git a/crypto/bio/bss_file.c b/crypto/bio/bss_file.c index c1acad98..a57bd973 100644 --- a/crypto/bio/bss_file.c +++ b/crypto/bio/bss_file.c @@ -27,7 +27,7 @@ #include #include -#include "bio_lcl.h" +#include "bio_local.h" #include #if !defined(OPENSSL_NO_STDIO) diff --git a/crypto/bio/bss_log.c b/crypto/bio/bss_log.c index 083f0041..274e5231 100644 --- a/crypto/bio/bss_log.c +++ b/crypto/bio/bss_log.c @@ -19,7 +19,7 @@ #include #include -#include "bio_lcl.h" +#include "bio_local.h" #include "internal/cryptlib.h" #if defined(OPENSSL_SYS_WINCE) diff --git a/crypto/bio/bss_mem.c b/crypto/bio/bss_mem.c index 19a3bd88..40430436 100644 --- a/crypto/bio/bss_mem.c +++ b/crypto/bio/bss_mem.c @@ -9,7 +9,7 @@ #include #include -#include "bio_lcl.h" +#include "bio_local.h" #include "internal/cryptlib.h" static int mem_write(BIO *h, const char *buf, int num); diff --git a/crypto/bio/bss_null.c b/crypto/bio/bss_null.c index 091f82f9..f677bbbb 100644 --- a/crypto/bio/bss_null.c +++ b/crypto/bio/bss_null.c @@ -9,7 +9,7 @@ #include #include -#include "bio_lcl.h" +#include "bio_local.h" #include "internal/cryptlib.h" static int null_write(BIO *h, const char *buf, int num); diff --git a/crypto/bio/bss_sock.c b/crypto/bio/bss_sock.c index 0c994593..ed513495 100644 --- a/crypto/bio/bss_sock.c +++ b/crypto/bio/bss_sock.c @@ -9,7 +9,7 @@ #include #include -#include "bio_lcl.h" +#include "bio_local.h" #include "internal/cryptlib.h" #include "internal/ktls.h" diff --git a/crypto/blake2/m_blake2b.c b/crypto/blake2/m_blake2b.c index b429d2d7..bb3f145a 100644 --- a/crypto/blake2/m_blake2b.c +++ b/crypto/blake2/m_blake2b.c @@ -11,8 +11,8 @@ # include # include -# include "internal/evp_int.h" -# include "internal/blake2.h" +# include "crypto/evp.h" +# include "prov/blake2.h" static int init(EVP_MD_CTX *ctx) { diff --git a/crypto/blake2/m_blake2s.c b/crypto/blake2/m_blake2s.c index dd4b68fa..b04d63ec 100644 --- a/crypto/blake2/m_blake2s.c +++ b/crypto/blake2/m_blake2s.c @@ -11,8 +11,8 @@ # include # include -# include "internal/evp_int.h" -# include "internal/blake2.h" +# include "crypto/evp.h" +# include "prov/blake2.h" static int init(EVP_MD_CTX *ctx) { diff --git a/crypto/bn/README.pod b/crypto/bn/README.pod index 237f2af3..1286fc0d 100644 --- a/crypto/bn/README.pod +++ b/crypto/bn/README.pod @@ -188,7 +188,7 @@ B and the 2*B word arrays B and B. The implementations use the following macros which, depending on the architecture, may use "long long" C operations or inline assembler. -They are defined in C. +They are defined in C. mul(B, B, B, B) computes B*B+B and places the low word of the result in B and the high word in B. diff --git a/crypto/bn/asm/x86_64-gcc.c b/crypto/bn/asm/x86_64-gcc.c index af32fcfc..68453b3d 100644 --- a/crypto/bn/asm/x86_64-gcc.c +++ b/crypto/bn/asm/x86_64-gcc.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "../bn_lcl.h" +#include "../bn_local.h" #if !(defined(__GNUC__) && __GNUC__>=2) # include "../bn_asm.c" /* kind of dirty hack for Sun Studio */ #else diff --git a/crypto/bn/bn_add.c b/crypto/bn/bn_add.c index f35a1a41..545e1038 100644 --- a/crypto/bn/bn_add.c +++ b/crypto/bn/bn_add.c @@ -8,7 +8,7 @@ */ #include "internal/cryptlib.h" -#include "bn_lcl.h" +#include "bn_local.h" /* signed add of b to a. */ int BN_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b) diff --git a/crypto/bn/bn_asm.c b/crypto/bn/bn_asm.c index 41d448b5..257701d9 100644 --- a/crypto/bn/bn_asm.c +++ b/crypto/bn/bn_asm.c @@ -10,7 +10,7 @@ #include #include #include "internal/cryptlib.h" -#include "bn_lcl.h" +#include "bn_local.h" #if defined(BN_LLONG) || defined(BN_UMULT_HIGH) diff --git a/crypto/bn/bn_blind.c b/crypto/bn/bn_blind.c index 826f3f06..c078d8dc 100644 --- a/crypto/bn/bn_blind.c +++ b/crypto/bn/bn_blind.c @@ -9,7 +9,7 @@ #include #include "internal/cryptlib.h" -#include "bn_lcl.h" +#include "bn_local.h" #define BN_BLINDING_COUNTER 32 diff --git a/crypto/bn/bn_conv.c b/crypto/bn/bn_conv.c index 9219fa4c..fd21464d 100644 --- a/crypto/bn/bn_conv.c +++ b/crypto/bn/bn_conv.c @@ -8,8 +8,8 @@ */ #include -#include "internal/ctype.h" -#include "bn_lcl.h" +#include "crypto/ctype.h" +#include "bn_local.h" static const char Hex[] = "0123456789ABCDEF"; diff --git a/crypto/bn/bn_ctx.c b/crypto/bn/bn_ctx.c index a60c7442..ecc0034b 100644 --- a/crypto/bn/bn_ctx.c +++ b/crypto/bn/bn_ctx.c @@ -9,7 +9,7 @@ #include #include "internal/cryptlib.h" -#include "bn_lcl.h" +#include "bn_local.h" /*- * TODO list diff --git a/crypto/bn/bn_depr.c b/crypto/bn/bn_depr.c index 2ff0eedd..4dbbdc38 100644 --- a/crypto/bn/bn_depr.c +++ b/crypto/bn/bn_depr.c @@ -20,7 +20,7 @@ NON_EMPTY_TRANSLATION_UNIT # include # include # include "internal/cryptlib.h" -# include "bn_lcl.h" +# include "bn_local.h" BIGNUM *BN_generate_prime(BIGNUM *ret, int bits, int safe, const BIGNUM *add, const BIGNUM *rem, @@ -52,7 +52,7 @@ int BN_is_prime(const BIGNUM *a, int checks, { BN_GENCB cb; BN_GENCB_set_old(&cb, callback, cb_arg); - return BN_is_prime_ex(a, checks, ctx_passed, &cb); + return bn_check_prime_int(a, checks, ctx_passed, 0, &cb); } int BN_is_prime_fasttest(const BIGNUM *a, int checks, @@ -62,7 +62,7 @@ int BN_is_prime_fasttest(const BIGNUM *a, int checks, { BN_GENCB cb; BN_GENCB_set_old(&cb, callback, cb_arg); - return BN_is_prime_fasttest_ex(a, checks, ctx_passed, - do_trial_division, &cb); + return bn_check_prime_int(a, checks, ctx_passed, do_trial_division, &cb); } + #endif diff --git a/crypto/bn/bn_dh.c b/crypto/bn/bn_dh.c index 668be57a..390f904d 100644 --- a/crypto/bn/bn_dh.c +++ b/crypto/bn/bn_dh.c @@ -7,12 +7,12 @@ * https://www.openssl.org/source/license.html */ -#include "bn_lcl.h" +#include "bn_local.h" #include "internal/nelem.h" #ifndef OPENSSL_NO_DH #include -#include "internal/bn_dh.h" +#include "crypto/bn_dh.h" /* DH parameters from RFC5114 */ # if BN_BITS2 == 64 diff --git a/crypto/bn/bn_div.c b/crypto/bn/bn_div.c index 88fcaf7f..42459706 100644 --- a/crypto/bn/bn_div.c +++ b/crypto/bn/bn_div.c @@ -10,7 +10,7 @@ #include #include #include "internal/cryptlib.h" -#include "bn_lcl.h" +#include "bn_local.h" /* The old slow way */ #if 0 diff --git a/crypto/bn/bn_exp.c b/crypto/bn/bn_exp.c index 9ea120be..50190b05 100644 --- a/crypto/bn/bn_exp.c +++ b/crypto/bn/bn_exp.c @@ -8,8 +8,8 @@ */ #include "internal/cryptlib.h" -#include "internal/constant_time_locl.h" -#include "bn_lcl.h" +#include "internal/constant_time.h" +#include "bn_local.h" #include #ifdef _WIN32 diff --git a/crypto/bn/bn_exp2.c b/crypto/bn/bn_exp2.c index 4157a962..99f843b9 100644 --- a/crypto/bn/bn_exp2.c +++ b/crypto/bn/bn_exp2.c @@ -9,7 +9,7 @@ #include #include "internal/cryptlib.h" -#include "bn_lcl.h" +#include "bn_local.h" #define TABLE_SIZE 32 diff --git a/crypto/bn/bn_gcd.c b/crypto/bn/bn_gcd.c index 9ee54407..fbefe4ab 100644 --- a/crypto/bn/bn_gcd.c +++ b/crypto/bn/bn_gcd.c @@ -8,113 +8,7 @@ */ #include "internal/cryptlib.h" -#include "bn_lcl.h" - -static BIGNUM *euclid(BIGNUM *a, BIGNUM *b); - -int BN_gcd(BIGNUM *r, const BIGNUM *in_a, const BIGNUM *in_b, BN_CTX *ctx) -{ - BIGNUM *a, *b, *t; - int ret = 0; - - bn_check_top(in_a); - bn_check_top(in_b); - - BN_CTX_start(ctx); - a = BN_CTX_get(ctx); - b = BN_CTX_get(ctx); - if (b == NULL) - goto err; - - if (BN_copy(a, in_a) == NULL) - goto err; - if (BN_copy(b, in_b) == NULL) - goto err; - a->neg = 0; - b->neg = 0; - - if (BN_cmp(a, b) < 0) { - t = a; - a = b; - b = t; - } - t = euclid(a, b); - if (t == NULL) - goto err; - - if (BN_copy(r, t) == NULL) - goto err; - ret = 1; - err: - BN_CTX_end(ctx); - bn_check_top(r); - return ret; -} - -static BIGNUM *euclid(BIGNUM *a, BIGNUM *b) -{ - BIGNUM *t; - int shifts = 0; - - bn_check_top(a); - bn_check_top(b); - - /* 0 <= b <= a */ - while (!BN_is_zero(b)) { - /* 0 < b <= a */ - - if (BN_is_odd(a)) { - if (BN_is_odd(b)) { - if (!BN_sub(a, a, b)) - goto err; - if (!BN_rshift1(a, a)) - goto err; - if (BN_cmp(a, b) < 0) { - t = a; - a = b; - b = t; - } - } else { /* a odd - b even */ - - if (!BN_rshift1(b, b)) - goto err; - if (BN_cmp(a, b) < 0) { - t = a; - a = b; - b = t; - } - } - } else { /* a is even */ - - if (BN_is_odd(b)) { - if (!BN_rshift1(a, a)) - goto err; - if (BN_cmp(a, b) < 0) { - t = a; - a = b; - b = t; - } - } else { /* a even - b even */ - - if (!BN_rshift1(a, a)) - goto err; - if (!BN_rshift1(b, b)) - goto err; - shifts++; - } - } - /* 0 <= b <= a */ - } - - if (shifts) { - if (!BN_lshift(a, a, shifts)) - goto err; - } - bn_check_top(a); - return a; - err: - return NULL; -} +#include "bn_local.h" /* solves ax == 1 (mod n) */ static BIGNUM *BN_mod_inverse_no_branch(BIGNUM *in, @@ -621,3 +515,110 @@ static BIGNUM *BN_mod_inverse_no_branch(BIGNUM *in, bn_check_top(ret); return ret; } + +/*- + * This function is based on the constant-time GCD work by Bernstein and Yang: + * https://eprint.iacr.org/2019/266 + * Generalized fast GCD function to allow even inputs. + * The algorithm first finds the shared powers of 2 between + * the inputs, and removes them, reducing at least one of the + * inputs to an odd value. Then it proceeds to calculate the GCD. + * Before returning the resulting GCD, we take care of adding + * back the powers of two removed at the beginning. + * Note 1: we assume the bit length of both inputs is public information, + * since access to top potentially leaks this information. + */ +int BN_gcd(BIGNUM *r, const BIGNUM *in_a, const BIGNUM *in_b, BN_CTX *ctx) +{ + BIGNUM *g, *temp = NULL; + BN_ULONG mask = 0; + int i, j, top, rlen, glen, m, bit = 1, delta = 1, cond = 0, shifts = 0, ret = 0; + + /* Note 2: zero input corner cases are not constant-time since they are + * handled immediately. An attacker can run an attack under this + * assumption without the need of side-channel information. */ + if (BN_is_zero(in_b)) { + ret = BN_copy(r, in_a) != NULL; + r->neg = 0; + return ret; + } + if (BN_is_zero(in_a)) { + ret = BN_copy(r, in_b) != NULL; + r->neg = 0; + return ret; + } + + bn_check_top(in_a); + bn_check_top(in_b); + + BN_CTX_start(ctx); + temp = BN_CTX_get(ctx); + g = BN_CTX_get(ctx); + + /* make r != 0, g != 0 even, so BN_rshift is not a potential nop */ + if (g == NULL + || !BN_lshift1(g, in_b) + || !BN_lshift1(r, in_a)) + goto err; + + /* find shared powers of two, i.e. "shifts" >= 1 */ + for (i = 0; i < r->dmax && i < g->dmax; i++) { + mask = ~(r->d[i] | g->d[i]); + for (j = 0; j < BN_BITS2; j++) { + bit &= mask; + shifts += bit; + mask >>= 1; + } + } + + /* subtract shared powers of two; shifts >= 1 */ + if (!BN_rshift(r, r, shifts) + || !BN_rshift(g, g, shifts)) + goto err; + + /* expand to biggest nword, with room for a possible extra word */ + top = 1 + ((r->top >= g->top) ? r->top : g->top); + if (bn_wexpand(r, top) == NULL + || bn_wexpand(g, top) == NULL + || bn_wexpand(temp, top) == NULL) + goto err; + + /* re arrange inputs s.t. r is odd */ + BN_consttime_swap((~r->d[0]) & 1, r, g, top); + + /* compute the number of iterations */ + rlen = BN_num_bits(r); + glen = BN_num_bits(g); + m = 4 + 3 * ((rlen >= glen) ? rlen : glen); + + for (i = 0; i < m; i++) { + /* conditionally flip signs if delta is positive and g is odd */ + cond = (-delta >> (8 * sizeof(delta) - 1)) & g->d[0] & 1; + delta = (-cond & -delta) | ((cond - 1) & delta); + r->neg ^= cond; + /* swap */ + BN_consttime_swap(cond, r, g, top); + + /* elimination step */ + delta++; + if (!BN_add(temp, g, r)) + goto err; + BN_consttime_swap(g->d[0] & 1, g, temp, top); + if (!BN_rshift1(g, g)) + goto err; + } + + /* remove possible negative sign */ + r->neg = 0; + /* add powers of 2 removed, then correct the artificial shift */ + if (!BN_lshift(r, r, shifts) + || !BN_rshift1(r, r)) + goto err; + + ret = 1; + + err: + BN_CTX_end(ctx); + bn_check_top(r); + return ret; +} diff --git a/crypto/bn/bn_gf2m.c b/crypto/bn/bn_gf2m.c index e025dae6..7a56745f 100644 --- a/crypto/bn/bn_gf2m.c +++ b/crypto/bn/bn_gf2m.c @@ -12,7 +12,7 @@ #include #include #include "internal/cryptlib.h" -#include "bn_lcl.h" +#include "bn_local.h" #ifndef OPENSSL_NO_EC2M @@ -297,7 +297,7 @@ int BN_GF2m_mod_arr(BIGNUM *r, const BIGNUM *a, const int p[]) bn_check_top(a); - if (!p[0]) { + if (p[0] == 0) { /* reduction mod 1 => return 0 */ BN_zero(r); return 1; @@ -929,7 +929,7 @@ int BN_GF2m_mod_sqrt_arr(BIGNUM *r, const BIGNUM *a, const int p[], bn_check_top(a); - if (!p[0]) { + if (p[0] == 0) { /* reduction mod 1 => return 0 */ BN_zero(r); return 1; @@ -988,7 +988,7 @@ int BN_GF2m_mod_solve_quad_arr(BIGNUM *r, const BIGNUM *a_, const int p[], bn_check_top(a_); - if (!p[0]) { + if (p[0] == 0) { /* reduction mod 1 => return 0 */ BN_zero(r); return 1; diff --git a/crypto/bn/bn_intern.c b/crypto/bn/bn_intern.c index f30e9b38..d9240360 100644 --- a/crypto/bn/bn_intern.c +++ b/crypto/bn/bn_intern.c @@ -8,7 +8,7 @@ */ #include "internal/cryptlib.h" -#include "bn_lcl.h" +#include "bn_local.h" /* * Determine the modified width-(w+1) Non-Adjacent Form (wNAF) of 'scalar'. diff --git a/crypto/bn/bn_kron.c b/crypto/bn/bn_kron.c index 2f8787ba..8258536d 100644 --- a/crypto/bn/bn_kron.c +++ b/crypto/bn/bn_kron.c @@ -8,7 +8,7 @@ */ #include "internal/cryptlib.h" -#include "bn_lcl.h" +#include "bn_local.h" /* least significant word */ #define BN_lsw(n) (((n)->top == 0) ? (BN_ULONG) 0 : (n)->d[0]) diff --git a/crypto/bn/bn_lib.c b/crypto/bn/bn_lib.c index 01c9da11..bdd4caa2 100644 --- a/crypto/bn/bn_lib.c +++ b/crypto/bn/bn_lib.c @@ -10,9 +10,9 @@ #include #include #include "internal/cryptlib.h" -#include "bn_lcl.h" +#include "bn_local.h" #include -#include "internal/constant_time_locl.h" +#include "internal/constant_time.h" /* This stuff appears to be completely unused, so is deprecated */ #if !OPENSSL_API_0_9_8 diff --git a/crypto/bn/bn_lcl.h b/crypto/bn/bn_local.h similarity index 99% rename from crypto/bn/bn_lcl.h rename to crypto/bn/bn_local.h index 38e66ab1..ec903385 100644 --- a/crypto/bn/bn_lcl.h +++ b/crypto/bn/bn_local.h @@ -7,8 +7,8 @@ * https://www.openssl.org/source/license.html */ -#ifndef HEADER_BN_LCL_H -# define HEADER_BN_LCL_H +#ifndef OSSL_CRYPTO_BN_LOCAL_H +# define OSSL_CRYPTO_BN_LOCAL_H /* * The EDK2 build doesn't use bn_conf.h; it sets THIRTY_TWO_BIT or @@ -18,10 +18,10 @@ # include # if !defined(OPENSSL_SYS_UEFI) -# include "internal/bn_conf.h" +# include "crypto/bn_conf.h" # endif -# include "internal/bn_int.h" +# include "crypto/bn.h" /* * These preprocessor symbols control various aspects of the bignum headers @@ -665,4 +665,7 @@ static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits) return bn_expand2((a),(bits+BN_BITS2-1)/BN_BITS2); } +int bn_check_prime_int(const BIGNUM *w, int checks, BN_CTX *ctx, + int do_trial_division, BN_GENCB *cb); + #endif diff --git a/crypto/bn/bn_mod.c b/crypto/bn/bn_mod.c index 20f643a1..18933d0e 100644 --- a/crypto/bn/bn_mod.c +++ b/crypto/bn/bn_mod.c @@ -8,7 +8,7 @@ */ #include "internal/cryptlib.h" -#include "bn_lcl.h" +#include "bn_local.h" int BN_nnmod(BIGNUM *r, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx) { diff --git a/crypto/bn/bn_mont.c b/crypto/bn/bn_mont.c index cb71417a..6e6848c6 100644 --- a/crypto/bn/bn_mont.c +++ b/crypto/bn/bn_mont.c @@ -15,7 +15,7 @@ */ #include "internal/cryptlib.h" -#include "bn_lcl.h" +#include "bn_local.h" #define MONT_WORD /* use the faster word-based algorithm */ diff --git a/crypto/bn/bn_mpi.c b/crypto/bn/bn_mpi.c index ff7eabf8..504cddff 100644 --- a/crypto/bn/bn_mpi.c +++ b/crypto/bn/bn_mpi.c @@ -9,7 +9,7 @@ #include #include "internal/cryptlib.h" -#include "bn_lcl.h" +#include "bn_local.h" int BN_bn2mpi(const BIGNUM *a, unsigned char *d) { diff --git a/crypto/bn/bn_mul.c b/crypto/bn/bn_mul.c index 4fc1e8ca..dc6b6f5a 100644 --- a/crypto/bn/bn_mul.c +++ b/crypto/bn/bn_mul.c @@ -9,7 +9,7 @@ #include #include "internal/cryptlib.h" -#include "bn_lcl.h" +#include "bn_local.h" #if defined(OPENSSL_NO_ASM) || !defined(OPENSSL_BN_ASM_PART_WORDS) /* diff --git a/crypto/bn/bn_nist.c b/crypto/bn/bn_nist.c index 18707088..17881233 100644 --- a/crypto/bn/bn_nist.c +++ b/crypto/bn/bn_nist.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "bn_lcl.h" +#include "bn_local.h" #include "internal/cryptlib.h" #define BN_NIST_192_TOP (192+BN_BITS2-1)/BN_BITS2 diff --git a/crypto/bn/bn_prime.c b/crypto/bn/bn_prime.c index 9e735b72..fd1c3c30 100644 --- a/crypto/bn/bn_prime.c +++ b/crypto/bn/bn_prime.c @@ -10,7 +10,7 @@ #include #include #include "internal/cryptlib.h" -#include "bn_lcl.h" +#include "bn_local.h" /* * The quick sieve algorithm approach to weeding out primes is Philip @@ -24,6 +24,8 @@ static int probable_prime(BIGNUM *rnd, int bits, int safe, prime_t *mods, static int probable_prime_dh(BIGNUM *rnd, int bits, int safe, prime_t *mods, const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx); +static int bn_is_prime_int(const BIGNUM *w, int checks, BN_CTX *ctx, + int do_trial_division, BN_GENCB *cb); #define square(x) ((BN_ULONG)(x) * (BN_ULONG)(x)) @@ -65,6 +67,37 @@ const BIGNUM *bn_get0_small_factors(void) return &_bignum_small_prime_factors; } +/* + * Calculate the number of trial divisions that gives the best speed in + * combination with Miller-Rabin prime test, based on the sized of the prime. + */ +static int calc_trial_divisions(int bits) +{ + if (bits <= 512) + return 64; + else if (bits <= 1024) + return 128; + else if (bits <= 2048) + return 384; + else if (bits <= 4096) + return 1024; + return NUMPRIMES; +} + +/* + * Use a minimum of 64 rounds of Miller-Rabin, which should give a false + * positive rate of 2^-128. If the size of the prime is larger than 2048 + * the user probably wants a higher security level than 128, so switch + * to 128 rounds giving a false positive rate of 2^-256. + * Returns the number of rounds. + */ +static int bn_mr_min_checks(int bits) +{ + if (bits > 2048) + return 128; + return 64; +} + int BN_GENCB_call(BN_GENCB *cb, int a, int b) { /* No callback means continue */ @@ -95,7 +128,7 @@ int BN_generate_prime_ex2(BIGNUM *ret, int bits, int safe, int found = 0; int i, j, c1 = 0; prime_t *mods = NULL; - int checks = BN_prime_checks_for_size(bits); + int checks = bn_mr_min_checks(bits); if (bits < 2) { /* There are no prime numbers this small. */ @@ -134,7 +167,7 @@ int BN_generate_prime_ex2(BIGNUM *ret, int bits, int safe, goto err; if (!safe) { - i = BN_is_prime_fasttest_ex(ret, checks, ctx, 0, cb); + i = bn_is_prime_int(ret, checks, ctx, 0, cb); if (i == -1) goto err; if (i == 0) @@ -148,13 +181,13 @@ int BN_generate_prime_ex2(BIGNUM *ret, int bits, int safe, goto err; for (i = 0; i < checks; i++) { - j = BN_is_prime_fasttest_ex(ret, 1, ctx, 0, cb); + j = bn_is_prime_int(ret, 1, ctx, 0, cb); if (j == -1) goto err; if (j == 0) goto loop; - j = BN_is_prime_fasttest_ex(t, 1, ctx, 0, cb); + j = bn_is_prime_int(t, 1, ctx, 0, cb); if (j == -1) goto err; if (j == 0) @@ -191,15 +224,45 @@ int BN_generate_prime_ex(BIGNUM *ret, int bits, int safe, } #endif +#if !OPENSSL_API_3 int BN_is_prime_ex(const BIGNUM *a, int checks, BN_CTX *ctx_passed, BN_GENCB *cb) { - return BN_is_prime_fasttest_ex(a, checks, ctx_passed, 0, cb); + return bn_check_prime_int(a, checks, ctx_passed, 0, cb); } -/* See FIPS 186-4 C.3.1 Miller Rabin Probabilistic Primality Test. */ int BN_is_prime_fasttest_ex(const BIGNUM *w, int checks, BN_CTX *ctx, int do_trial_division, BN_GENCB *cb) +{ + return bn_check_prime_int(w, checks, ctx, do_trial_division, cb); +} +#endif + +/* Wrapper around bn_is_prime_int that sets the minimum number of checks */ +int bn_check_prime_int(const BIGNUM *w, int checks, BN_CTX *ctx, + int do_trial_division, BN_GENCB *cb) +{ + int min_checks = bn_mr_min_checks(BN_num_bits(w)); + + if (checks < min_checks) + checks = min_checks; + + return bn_is_prime_int(w, checks, ctx, do_trial_division, cb); +} + +int BN_check_prime(const BIGNUM *p, BN_CTX *ctx, BN_GENCB *cb) +{ + return bn_check_prime_int(p, 0, ctx, 1, cb); +} + +/* + * Tests that |w| is probably prime + * See FIPS 186-4 C.3.1 Miller Rabin Probabilistic Primality Test. + * + * Returns 0 when composite, 1 when probable prime, -1 on error. + */ +static int bn_is_prime_int(const BIGNUM *w, int checks, BN_CTX *ctx, + int do_trial_division, BN_GENCB *cb) { int i, status, ret = -1; #ifndef FIPS_MODE @@ -226,7 +289,9 @@ int BN_is_prime_fasttest_ex(const BIGNUM *w, int checks, BN_CTX *ctx, /* first look for small factors */ if (do_trial_division) { - for (i = 1; i < NUMPRIMES; i++) { + int trial_divisions = calc_trial_divisions(BN_num_bits(w)); + + for (i = 1; i < trial_divisions; i++) { BN_ULONG mod = BN_mod_word(w, primes[i]); if (mod == (BN_ULONG)-1) return -1; @@ -313,8 +378,8 @@ int bn_miller_rabin_is_prime(const BIGNUM *w, int iterations, BN_CTX *ctx, if (mont == NULL || !BN_MONT_CTX_set(mont, w, ctx)) goto err; - if (iterations == BN_prime_checks) - iterations = BN_prime_checks_for_size(BN_num_bits(w)); + if (iterations == 0) + iterations = bn_mr_min_checks(BN_num_bits(w)); /* (Step 4) */ for (i = 0; i < iterations; ++i) { @@ -398,12 +463,22 @@ err: return ret; } +/* + * Generate a random number of |bits| bits that is probably prime by sieving. + * If |safe| != 0, it generates a safe prime. + * |mods| is a preallocated array that gets reused when called again. + * + * The probably prime is saved in |rnd|. + * + * Returns 1 on success and 0 on error. + */ static int probable_prime(BIGNUM *rnd, int bits, int safe, prime_t *mods, BN_CTX *ctx) { int i; BN_ULONG delta; - BN_ULONG maxdelta = BN_MASK2 - primes[NUMPRIMES - 1]; + int trial_divisions = calc_trial_divisions(bits); + BN_ULONG maxdelta = BN_MASK2 - primes[trial_divisions - 1]; again: /* TODO: Not all primes are private */ @@ -412,7 +487,7 @@ static int probable_prime(BIGNUM *rnd, int bits, int safe, prime_t *mods, if (safe && !BN_set_bit(rnd, 1)) return 0; /* we now have a random number 'rnd' to test. */ - for (i = 1; i < NUMPRIMES; i++) { + for (i = 1; i < trial_divisions; i++) { BN_ULONG mod = BN_mod_word(rnd, (BN_ULONG)primes[i]); if (mod == (BN_ULONG)-1) return 0; @@ -420,7 +495,7 @@ static int probable_prime(BIGNUM *rnd, int bits, int safe, prime_t *mods, } delta = 0; loop: - for (i = 1; i < NUMPRIMES; i++) { + for (i = 1; i < trial_divisions; i++) { /* * check that rnd is a prime and also that * gcd(rnd-1,primes) == 1 (except for 2) @@ -447,6 +522,14 @@ static int probable_prime(BIGNUM *rnd, int bits, int safe, prime_t *mods, return 1; } +/* + * Generate a random number |rnd| of |bits| bits that is probably prime + * and satisfies |rnd| % |add| == |rem| by sieving. + * If |safe| != 0, it generates a safe prime. + * |mods| is a preallocated array that gets reused when called again. + * + * Returns 1 on success and 0 on error. + */ static int probable_prime_dh(BIGNUM *rnd, int bits, int safe, prime_t *mods, const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx) @@ -454,7 +537,8 @@ static int probable_prime_dh(BIGNUM *rnd, int bits, int safe, prime_t *mods, int i, ret = 0; BIGNUM *t1; BN_ULONG delta; - BN_ULONG maxdelta = BN_MASK2 - primes[NUMPRIMES - 1]; + int trial_divisions = calc_trial_divisions(bits); + BN_ULONG maxdelta = BN_MASK2 - primes[trial_divisions - 1]; BN_CTX_start(ctx); if ((t1 = BN_CTX_get(ctx)) == NULL) @@ -488,7 +572,7 @@ static int probable_prime_dh(BIGNUM *rnd, int bits, int safe, prime_t *mods, } /* we now have a random number 'rnd' to test. */ - for (i = 1; i < NUMPRIMES; i++) { + for (i = 1; i < trial_divisions; i++) { BN_ULONG mod = BN_mod_word(rnd, (BN_ULONG)primes[i]); if (mod == (BN_ULONG)-1) goto err; @@ -496,7 +580,7 @@ static int probable_prime_dh(BIGNUM *rnd, int bits, int safe, prime_t *mods, } delta = 0; loop: - for (i = 1; i < NUMPRIMES; i++) { + for (i = 1; i < trial_divisions; i++) { /* check that rnd is a prime */ if (bits <= 31 && delta <= 0x7fffffff && square(primes[i]) > BN_get_word(rnd) + delta) diff --git a/crypto/bn/bn_print.c b/crypto/bn/bn_print.c index 2274b85c..ccc954c5 100644 --- a/crypto/bn/bn_print.c +++ b/crypto/bn/bn_print.c @@ -9,7 +9,7 @@ #include #include -#include "bn_lcl.h" +#include "bn_local.h" static const char Hex[] = "0123456789ABCDEF"; diff --git a/crypto/bn/bn_rand.c b/crypto/bn/bn_rand.c index 2b3e6f20..d61b08db 100644 --- a/crypto/bn/bn_rand.c +++ b/crypto/bn/bn_rand.c @@ -10,8 +10,8 @@ #include #include #include "internal/cryptlib.h" -#include "internal/rand_int.h" -#include "bn_lcl.h" +#include "crypto/rand.h" +#include "bn_local.h" #include #include #include diff --git a/crypto/bn/bn_recp.c b/crypto/bn/bn_recp.c index 7eda16de..2cfe3156 100644 --- a/crypto/bn/bn_recp.c +++ b/crypto/bn/bn_recp.c @@ -8,7 +8,7 @@ */ #include "internal/cryptlib.h" -#include "bn_lcl.h" +#include "bn_local.h" void BN_RECP_CTX_init(BN_RECP_CTX *recp) { diff --git a/crypto/bn/bn_rsa_fips186_4.c b/crypto/bn/bn_rsa_fips186_4.c index 9a3041e2..c31b43ba 100644 --- a/crypto/bn/bn_rsa_fips186_4.c +++ b/crypto/bn/bn_rsa_fips186_4.c @@ -29,8 +29,8 @@ */ #include #include -#include "bn_lcl.h" -#include "internal/bn_int.h" +#include "bn_local.h" +#include "crypto/bn.h" /* * FIPS 186-4 Table B.1. "Min length of auxiliary primes p1, p2, q1, q2". @@ -67,44 +67,6 @@ static int bn_rsa_fips186_4_aux_prime_max_sum_size_for_prob_primes(int nbits) return 0; } -/* - * FIPS 186-4 Table C.3 for error probability of 2^-100 - * Minimum number of Miller Rabin Rounds for p1, p2, q1 & q2. - * - * Params: - * aux_prime_bits The auxiliary prime size in bits. - * Returns: - * The minimum number of Miller Rabin Rounds for an auxiliary prime, or - * 0 if aux_prime_bits is invalid. - */ -static int bn_rsa_fips186_4_aux_prime_MR_min_checks(int aux_prime_bits) -{ - if (aux_prime_bits > 170) - return 27; - if (aux_prime_bits > 140) - return 32; - return 0; /* Error case */ -} - -/* - * FIPS 186-4 Table C.3 for error probability of 2^-100 - * Minimum number of Miller Rabin Rounds for p, q. - * - * Params: - * nbits The key size in bits. - * Returns: - * The minimum number of Miller Rabin Rounds required, - * or 0 if nbits is invalid. - */ -int bn_rsa_fips186_4_prime_MR_min_checks(int nbits) -{ - if (nbits >= 3072) /* > 170 */ - return 3; - if (nbits == 2048) /* > 140 */ - return 4; - return 0; /* Error case */ -} - /* * Find the first odd integer that is a probable prime. * @@ -123,9 +85,8 @@ static int bn_rsa_fips186_4_find_aux_prob_prime(const BIGNUM *Xp1, { int ret = 0; int i = 0; - int checks = bn_rsa_fips186_4_aux_prime_MR_min_checks(BN_num_bits(Xp1)); - if (checks == 0 || BN_copy(p1, Xp1) == NULL) + if (BN_copy(p1, Xp1) == NULL) return 0; /* Find the first odd number >= Xp1 that is probably prime */ @@ -133,7 +94,7 @@ static int bn_rsa_fips186_4_find_aux_prob_prime(const BIGNUM *Xp1, i++; BN_GENCB_call(cb, 0, i); /* MR test with trial division */ - if (BN_is_prime_fasttest_ex(p1, checks, ctx, 1, cb)) + if (BN_check_prime(p1, ctx, cb)) break; /* Get next odd number */ if (!BN_add_word(p1, 2)) @@ -259,11 +220,8 @@ int bn_rsa_fips186_4_derive_prime(BIGNUM *Y, BIGNUM *X, const BIGNUM *Xin, int ret = 0; int i, imax; int bits = nlen >> 1; - int checks = bn_rsa_fips186_4_prime_MR_min_checks(nlen); BIGNUM *tmp, *R, *r1r2x2, *y1, *r1x2; - if (checks == 0) - return 0; BN_CTX_start(ctx); R = BN_CTX_get(ctx); @@ -331,8 +289,7 @@ int bn_rsa_fips186_4_derive_prime(BIGNUM *Y, BIGNUM *X, const BIGNUM *Xin, || !BN_sub_word(y1, 1) || !BN_gcd(tmp, y1, e, ctx)) goto err; - if (BN_is_one(tmp) - && BN_is_prime_fasttest_ex(Y, checks, ctx, 1, cb)) + if (BN_is_one(tmp) && BN_check_prime(Y, ctx, cb)) goto end; /* (Step 8-10) */ if (++i >= imax || !BN_add(Y, Y, r1r2x2)) diff --git a/crypto/bn/bn_shift.c b/crypto/bn/bn_shift.c index 13a4337f..cdf66933 100644 --- a/crypto/bn/bn_shift.c +++ b/crypto/bn/bn_shift.c @@ -9,7 +9,7 @@ #include #include "internal/cryptlib.h" -#include "bn_lcl.h" +#include "bn_local.h" int BN_lshift1(BIGNUM *r, const BIGNUM *a) { @@ -152,57 +152,19 @@ int bn_lshift_fixed_top(BIGNUM *r, const BIGNUM *a, int n) int BN_rshift(BIGNUM *r, const BIGNUM *a, int n) { - int i, j, nw, lb, rb; - BN_ULONG *t, *f; - BN_ULONG l, tmp; - - bn_check_top(r); - bn_check_top(a); + int ret = 0; if (n < 0) { BNerr(BN_F_BN_RSHIFT, BN_R_INVALID_SHIFT); return 0; } - nw = n / BN_BITS2; - rb = n % BN_BITS2; - lb = BN_BITS2 - rb; - if (nw >= a->top || a->top == 0) { - BN_zero(r); - return 1; - } - i = (BN_num_bits(a) - n + (BN_BITS2 - 1)) / BN_BITS2; - if (r != a) { - if (bn_wexpand(r, i) == NULL) - return 0; - r->neg = a->neg; - } else { - if (n == 0) - return 1; /* or the copying loop will go berserk */ - } + ret = bn_rshift_fixed_top(r, a, n); - f = &(a->d[nw]); - t = r->d; - j = a->top - nw; - r->top = i; - - if (rb == 0) { - for (i = j; i != 0; i--) - *(t++) = *(f++); - } else { - l = *(f++); - for (i = j - 1; i != 0; i--) { - tmp = (l >> rb) & BN_MASK2; - l = *(f++); - *(t++) = (tmp | (l << lb)) & BN_MASK2; - } - if ((l = (l >> rb) & BN_MASK2)) - *(t) = l; - } - if (!r->top) - r->neg = 0; /* don't allow negative zero */ + bn_correct_top(r); bn_check_top(r); - return 1; + + return ret; } /* diff --git a/crypto/bn/bn_sqr.c b/crypto/bn/bn_sqr.c index 6e1aa99d..990bed90 100644 --- a/crypto/bn/bn_sqr.c +++ b/crypto/bn/bn_sqr.c @@ -8,7 +8,7 @@ */ #include "internal/cryptlib.h" -#include "bn_lcl.h" +#include "bn_local.h" /* r must not be a */ /* diff --git a/crypto/bn/bn_sqrt.c b/crypto/bn/bn_sqrt.c index 2107487b..d39f65f5 100644 --- a/crypto/bn/bn_sqrt.c +++ b/crypto/bn/bn_sqrt.c @@ -8,7 +8,7 @@ */ #include "internal/cryptlib.h" -#include "bn_lcl.h" +#include "bn_local.h" BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx) /* diff --git a/crypto/bn/bn_srp.c b/crypto/bn/bn_srp.c index d722f59e..34e11ce7 100644 --- a/crypto/bn/bn_srp.c +++ b/crypto/bn/bn_srp.c @@ -7,13 +7,13 @@ * https://www.openssl.org/source/license.html */ -#include "bn_lcl.h" +#include "bn_local.h" #include "internal/nelem.h" #ifndef OPENSSL_NO_SRP #include -#include "internal/bn_srp.h" +#include "crypto/bn_srp.h" # if (BN_BYTES == 8) # if (defined(_WIN32) || defined(_WIN64)) && !defined(__MINGW32__) diff --git a/crypto/bn/bn_word.c b/crypto/bn/bn_word.c index 1fb41e89..93c01479 100644 --- a/crypto/bn/bn_word.c +++ b/crypto/bn/bn_word.c @@ -8,7 +8,7 @@ */ #include "internal/cryptlib.h" -#include "bn_lcl.h" +#include "bn_local.h" BN_ULONG BN_mod_word(const BIGNUM *a, BN_ULONG w) { diff --git a/crypto/bn/bn_x931p.c b/crypto/bn/bn_x931p.c index c79e4278..1e4d4991 100644 --- a/crypto/bn/bn_x931p.c +++ b/crypto/bn/bn_x931p.c @@ -9,7 +9,7 @@ #include #include -#include "bn_lcl.h" +#include "bn_local.h" /* X9.31 routines for prime derivation */ @@ -30,7 +30,7 @@ static int bn_x931_derive_pi(BIGNUM *pi, const BIGNUM *Xpi, BN_CTX *ctx, i++; BN_GENCB_call(cb, 0, i); /* NB 27 MR is specified in X9.31 */ - is_prime = BN_is_prime_fasttest_ex(pi, 27, ctx, 1, cb); + is_prime = BN_check_prime(pi, ctx, cb); if (is_prime < 0) return 0; if (is_prime) @@ -131,7 +131,7 @@ int BN_X931_derive_prime_ex(BIGNUM *p, BIGNUM *p1, BIGNUM *p2, * offering similar or better guarantees 50 MR is considerably * better. */ - int r = BN_is_prime_fasttest_ex(p, 50, ctx, 1, cb); + int r = BN_check_prime(p, ctx, cb); if (r < 0) goto err; if (r) diff --git a/crypto/bn/build.info b/crypto/bn/build.info index 18b5950f..5ad8bf14 100644 --- a/crypto/bn/build.info +++ b/crypto/bn/build.info @@ -108,9 +108,12 @@ $COMMON=bn_add.c bn_div.c bn_exp.c bn_lib.c bn_ctx.c bn_mul.c \ bn_const.c bn_x931p.c bn_intern.c bn_dh.c \ bn_rsa_fips186_4.c $BNASM SOURCE[../../libcrypto]=$COMMON bn_print.c bn_err.c bn_depr.c bn_srp.c +SOURCE[../../providers/libfips.a]=$COMMON +# Implementations are now spread across several libraries, so the defines +# need to be applied to all affected libraries and modules. DEFINE[../../libcrypto]=$BNDEF -SOURCE[../../providers/fips]=$COMMON -DEFINE[../../providers/fips]=$BNDEF +DEFINE[../../providers/libfips.a]=$BNDEF +DEFINE[../../providers/libimplementations.a]=$BNDEF INCLUDE[../../libcrypto]=../../crypto/include diff --git a/crypto/bn/rsaz_exp.h b/crypto/bn/rsaz_exp.h index c92af6ff..c05a5d93 100644 --- a/crypto/bn/rsaz_exp.h +++ b/crypto/bn/rsaz_exp.h @@ -12,8 +12,8 @@ * (2) University of Haifa, Israel */ -#ifndef RSAZ_EXP_H -# define RSAZ_EXP_H +#ifndef OSSL_CRYPTO_BN_RSAZ_EXP_H +# define OSSL_CRYPTO_BN_RSAZ_EXP_H # undef RSAZ_ENABLED # if defined(OPENSSL_BN_ASM_MONT) && \ diff --git a/crypto/buffer/build.info b/crypto/buffer/build.info index 63de1a57..6f31397b 100644 --- a/crypto/buffer/build.info +++ b/crypto/buffer/build.info @@ -1,3 +1,3 @@ LIBS=../../libcrypto SOURCE[../../libcrypto]=buffer.c buf_err.c -SOURCE[../../providers/fips]=buffer.c +SOURCE[../../providers/libfips.a]=buffer.c diff --git a/crypto/build.info b/crypto/build.info index 5d3b123d..7d3eb295 100644 --- a/crypto/build.info +++ b/crypto/build.info @@ -63,7 +63,7 @@ $CORE_COMMON=provider_core.c provider_predefined.c \ core_fetch.c core_algorithm.c core_namemap.c SOURCE[../libcrypto]=$CORE_COMMON provider_conf.c -SOURCE[../providers/fips]=$CORE_COMMON +SOURCE[../providers/libfips.a]=$CORE_COMMON # Central utilities $UTIL_COMMON=\ @@ -77,10 +77,14 @@ SOURCE[../libcrypto]=$UTIL_COMMON \ cversion.c info.c cpt_err.c ebcdic.c uid.c o_time.c o_dir.c \ o_fopen.c getenv.c o_init.c o_fips.c init.c trace.c provider.c \ $UPLINKSRC -DEFINE[../libcrypto]=$UTIL_DEFINE $UPLINKDEF -SOURCE[../providers/fips]=$UTIL_COMMON -DEFINE[../providers/fips]=$UTIL_DEFINE +SOURCE[../providers/libfips.a]=$UTIL_COMMON +# Implementations are now spread across several libraries, so the defines +# need to be applied to all affected libraries and modules. +DEFINE[../libcrypto]=$UTIL_DEFINE $UPLINKDEF +DEFINE[../providers/libfips.a]=$UTIL_DEFINE +DEFINE[../providers/fips]=$UTIL_DEFINE +DEFINE[../providers/libimplementations.a]=$UTIL_DEFINE DEPEND[info.o]=buildinf.h DEPEND[cversion.o]=buildinf.h diff --git a/crypto/camellia/camellia.c b/crypto/camellia/camellia.c index 75080a11..cb285d05 100644 --- a/crypto/camellia/camellia.c +++ b/crypto/camellia/camellia.c @@ -40,7 +40,7 @@ */ #include -#include "cmll_locl.h" +#include "cmll_local.h" #include #include diff --git a/crypto/camellia/cmll_ecb.c b/crypto/camellia/cmll_ecb.c index 1385b2f5..6a2c7775 100644 --- a/crypto/camellia/cmll_ecb.c +++ b/crypto/camellia/cmll_ecb.c @@ -8,7 +8,7 @@ */ #include -#include "cmll_locl.h" +#include "cmll_local.h" void Camellia_ecb_encrypt(const unsigned char *in, unsigned char *out, const CAMELLIA_KEY *key, const int enc) diff --git a/crypto/camellia/cmll_locl.h b/crypto/camellia/cmll_local.h similarity index 91% rename from crypto/camellia/cmll_locl.h rename to crypto/camellia/cmll_local.h index cf3d38db..c1d940d3 100644 --- a/crypto/camellia/cmll_locl.h +++ b/crypto/camellia/cmll_local.h @@ -22,8 +22,8 @@ * to the OpenSSL project. */ -#ifndef HEADER_CAMELLIA_LOCL_H -# define HEADER_CAMELLIA_LOCL_H +#ifndef OSSL_CRYPTO_CAMELLIA_CMLL_LOCAL_H +# define OSSL_CRYPTO_CAMELLIA_CMLL_LOCAL_H typedef unsigned int u32; typedef unsigned char u8; @@ -40,4 +40,4 @@ void Camellia_EncryptBlock(int keyBitLength, const u8 plaintext[], const KEY_TABLE_TYPE keyTable, u8 ciphertext[]); void Camellia_DecryptBlock(int keyBitLength, const u8 ciphertext[], const KEY_TABLE_TYPE keyTable, u8 plaintext[]); -#endif /* #ifndef HEADER_CAMELLIA_LOCL_H */ +#endif /* #ifndef OSSL_CRYPTO_CAMELLIA_CMLL_LOCAL_H */ diff --git a/crypto/camellia/cmll_misc.c b/crypto/camellia/cmll_misc.c index 987bdb92..b38fcc04 100644 --- a/crypto/camellia/cmll_misc.c +++ b/crypto/camellia/cmll_misc.c @@ -9,7 +9,7 @@ #include #include -#include "cmll_locl.h" +#include "cmll_local.h" int Camellia_set_key(const unsigned char *userKey, const int bits, CAMELLIA_KEY *key) diff --git a/crypto/cast/c_cfb64.c b/crypto/cast/c_cfb64.c index 7bac5c72..1ae13bc3 100644 --- a/crypto/cast/c_cfb64.c +++ b/crypto/cast/c_cfb64.c @@ -8,7 +8,7 @@ */ #include -#include "cast_lcl.h" +#include "cast_local.h" /* * The input and output encrypted as though 64bit cfb mode is being used. diff --git a/crypto/cast/c_ecb.c b/crypto/cast/c_ecb.c index 50b225e3..2b841ac9 100644 --- a/crypto/cast/c_ecb.c +++ b/crypto/cast/c_ecb.c @@ -8,7 +8,7 @@ */ #include -#include "cast_lcl.h" +#include "cast_local.h" #include void CAST_ecb_encrypt(const unsigned char *in, unsigned char *out, diff --git a/crypto/cast/c_enc.c b/crypto/cast/c_enc.c index ad8a02a4..7e2461df 100644 --- a/crypto/cast/c_enc.c +++ b/crypto/cast/c_enc.c @@ -8,7 +8,7 @@ */ #include -#include "cast_lcl.h" +#include "cast_local.h" void CAST_encrypt(CAST_LONG *data, const CAST_KEY *key) { diff --git a/crypto/cast/c_ofb64.c b/crypto/cast/c_ofb64.c index 797917cf..bc598d4d 100644 --- a/crypto/cast/c_ofb64.c +++ b/crypto/cast/c_ofb64.c @@ -8,7 +8,7 @@ */ #include -#include "cast_lcl.h" +#include "cast_local.h" /* * The input and output encrypted as though 64bit ofb mode is being used. diff --git a/crypto/cast/c_skey.c b/crypto/cast/c_skey.c index 1f353a79..c21ecdf8 100644 --- a/crypto/cast/c_skey.c +++ b/crypto/cast/c_skey.c @@ -8,7 +8,7 @@ */ #include -#include "cast_lcl.h" +#include "cast_local.h" #include "cast_s.h" #define CAST_exp(l,A,a,n) \ diff --git a/crypto/cast/cast_lcl.h b/crypto/cast/cast_local.h similarity index 100% rename from crypto/cast/cast_lcl.h rename to crypto/cast/cast_local.h diff --git a/crypto/chacha/chacha_enc.c b/crypto/chacha/chacha_enc.c index e350c9b0..05a716b5 100644 --- a/crypto/chacha/chacha_enc.c +++ b/crypto/chacha/chacha_enc.c @@ -11,7 +11,7 @@ #include -#include "internal/chacha.h" +#include "crypto/chacha.h" typedef unsigned int u32; typedef unsigned char u8; diff --git a/crypto/cmac/build.info b/crypto/cmac/build.info index f6c8bfab..a2f6f218 100644 --- a/crypto/cmac/build.info +++ b/crypto/cmac/build.info @@ -3,4 +3,4 @@ LIBS=../../libcrypto $COMMON=cmac.c SOURCE[../../libcrypto]=$COMMON cm_ameth.c -SOURCE[../../providers/fips]=$COMMON +SOURCE[../../providers/libfips.a]=$COMMON diff --git a/crypto/cmac/cm_ameth.c b/crypto/cmac/cm_ameth.c index b1ee0d3d..9db25621 100644 --- a/crypto/cmac/cm_ameth.c +++ b/crypto/cmac/cm_ameth.c @@ -10,7 +10,7 @@ #include #include "internal/cryptlib.h" #include -#include "internal/asn1_int.h" +#include "crypto/asn1.h" /* * CMAC "ASN1" method. This is just here to indicate the maximum CMAC output diff --git a/crypto/cmac/cmac.c b/crypto/cmac/cmac.c index b1be991f..ec12970c 100644 --- a/crypto/cmac/cmac.c +++ b/crypto/cmac/cmac.c @@ -199,7 +199,8 @@ int CMAC_Final(CMAC_CTX *ctx, unsigned char *out, size_t *poutlen) return 0; if ((bl = EVP_CIPHER_CTX_block_size(ctx->cctx)) < 0) return 0; - *poutlen = (size_t)bl; + if (poutlen != NULL) + *poutlen = (size_t)bl; if (!out) return 1; lb = ctx->nlast_block; diff --git a/crypto/cmp/build.info b/crypto/cmp/build.info index 6b6ccaaf..d5ce60e0 100644 --- a/crypto/cmp/build.info +++ b/crypto/cmp/build.info @@ -1,2 +1,2 @@ LIBS=../../libcrypto -SOURCE[../../libcrypto]= cmp_asn.c cmp_err.c +SOURCE[../../libcrypto]= cmp_asn.c cmp_ctx.c cmp_err.c cmp_util.c diff --git a/crypto/cmp/cmp_asn.c b/crypto/cmp/cmp_asn.c index 8555586d..fa7c26d7 100644 --- a/crypto/cmp/cmp_asn.c +++ b/crypto/cmp/cmp_asn.c @@ -7,13 +7,11 @@ * this file except in compliance with the License. You can obtain a copy * in the file LICENSE in the source distribution or at * https://www.openssl.org/source/license.html - * - * CMP implementation by Martin Peylo, Miikka Viljanen, and David von Oheimb. */ #include -#include "cmp_int.h" +#include "cmp_local.h" /* explicit #includes not strictly needed since implied by the above: */ #include @@ -166,8 +164,10 @@ int OSSL_CMP_ITAV_push0_stack_item(STACK_OF(OSSL_CMP_ITAV) **itav_sk_p, { int created = 0; - if (itav_sk_p == NULL) + if (itav_sk_p == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); goto err; + } if (*itav_sk_p == NULL) { if ((*itav_sk_p = sk_OSSL_CMP_ITAV_new_null()) == NULL) @@ -187,6 +187,26 @@ int OSSL_CMP_ITAV_push0_stack_item(STACK_OF(OSSL_CMP_ITAV) **itav_sk_p, return 0; } +/* get ASN.1 encoded integer, return -1 on error */ +int ossl_cmp_asn1_get_int(const ASN1_INTEGER *a) +{ + int64_t res; + + if (!ASN1_INTEGER_get_int64(&res, a)) { + CMPerr(0, ASN1_R_INVALID_NUMBER); + return -1; + } + if (res < INT_MIN) { + CMPerr(0, ASN1_R_TOO_SMALL); + return -1; + } + if (res > INT_MAX) { + CMPerr(0, ASN1_R_TOO_LARGE); + return -1; + } + return (int)res; +} + ASN1_CHOICE(OSSL_CMP_CERTORENCCERT) = { /* OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly */ ASN1_EXP(OSSL_CMP_CERTORENCCERT, value.certificate, X509, 0), diff --git a/crypto/cmp/cmp_ctx.c b/crypto/cmp/cmp_ctx.c new file mode 100644 index 00000000..6ec23ad8 --- /dev/null +++ b/crypto/cmp/cmp_ctx.c @@ -0,0 +1,1086 @@ +/* + * Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved. + * Copyright Nokia 2007-2019 + * Copyright Siemens AG 2015-2019 + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include +#include +#include /* for OCSP_REVOKED_STATUS_* */ + +#include "cmp_local.h" + +/* explicit #includes not strictly needed since implied by the above: */ +#include +#include +#include + +/* + * Get current certificate store containing trusted root CA certs + */ +X509_STORE *OSSL_CMP_CTX_get0_trustedStore(const OSSL_CMP_CTX *ctx) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return NULL; + } + return ctx->trusted; +} + +/* + * Set certificate store containing trusted (root) CA certs and possibly CRLs + * and a cert verification callback function used for CMP server authentication. + * Any already existing store entry is freed. Given NULL, the entry is reset. + * returns 1 on success, 0 on error + */ +int OSSL_CMP_CTX_set0_trustedStore(OSSL_CMP_CTX *ctx, X509_STORE *store) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + X509_STORE_free(ctx->trusted); + ctx->trusted = store; + return 1; +} + +/* + * Get current list of non-trusted intermediate certs + */ +STACK_OF(X509) *OSSL_CMP_CTX_get0_untrusted_certs(const OSSL_CMP_CTX *ctx) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return NULL; + } + return ctx->untrusted_certs; +} + +/* + * Set untrusted certificates for path construction in authentication of + * the CMP server and potentially others (TLS server, newly enrolled cert). + * returns 1 on success, 0 on error + */ +int OSSL_CMP_CTX_set1_untrusted_certs(OSSL_CMP_CTX *ctx, STACK_OF(X509) *certs) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + sk_X509_pop_free(ctx->untrusted_certs, X509_free); + if ((ctx->untrusted_certs = sk_X509_new_null()) == NULL) + return 0; + return ossl_cmp_sk_X509_add1_certs(ctx->untrusted_certs, certs, 0, 1, 0); +} + +/* + * Allocates and initializes OSSL_CMP_CTX context structure with default values. + * Returns new context on success, NULL on error + */ +OSSL_CMP_CTX *OSSL_CMP_CTX_new(void) +{ + OSSL_CMP_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx)); + + if (ctx == NULL) + return NULL; + + ctx->log_verbosity = OSSL_CMP_LOG_INFO; + + ctx->status = -1; + ctx->failInfoCode = -1; + + ctx->serverPort = OSSL_CMP_DEFAULT_PORT; + ctx->proxyPort = OSSL_CMP_DEFAULT_PORT; + ctx->msgtimeout = 2 * 60; + + if ((ctx->untrusted_certs = sk_X509_new_null()) == NULL) + goto err; + + ctx->pbm_slen = 16; + ctx->pbm_owf = NID_sha256; + ctx->pbm_itercnt = 500; + ctx->pbm_mac = NID_hmac_sha1; + + ctx->digest = NID_sha256; + ctx->popoMethod = OSSL_CRMF_POPO_SIGNATURE; + ctx->revocationReason = CRL_REASON_NONE; + + /* all other elements are initialized to 0 or NULL, respectively */ + return ctx; + + err: + OSSL_CMP_CTX_free(ctx); + return NULL; +} + +/* + * Prepare the OSSL_CMP_CTX for next use, partly re-initializing OSSL_CMP_CTX + */ +int OSSL_CMP_CTX_reinit(OSSL_CMP_CTX *ctx) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + + ctx->status = -1; + ctx->failInfoCode = -1; + + return ossl_cmp_ctx_set0_statusString(ctx, NULL) + && ossl_cmp_ctx_set0_newCert(ctx, NULL) + && ossl_cmp_ctx_set1_caPubs(ctx, NULL) + && ossl_cmp_ctx_set1_extraCertsIn(ctx, NULL) + && ossl_cmp_ctx_set0_validatedSrvCert(ctx, NULL) + && OSSL_CMP_CTX_set1_transactionID(ctx, NULL) + && OSSL_CMP_CTX_set1_senderNonce(ctx, NULL) + && ossl_cmp_ctx_set1_recipNonce(ctx, NULL); +} + +/* + * Frees OSSL_CMP_CTX variables allocated in OSSL_CMP_CTX_new() + */ +void OSSL_CMP_CTX_free(OSSL_CMP_CTX *ctx) +{ + if (ctx == NULL) + return; + + OPENSSL_free(ctx->serverPath); + OPENSSL_free(ctx->serverName); + OPENSSL_free(ctx->proxyName); + + X509_free(ctx->srvCert); + X509_free(ctx->validatedSrvCert); + X509_NAME_free(ctx->expected_sender); + X509_STORE_free(ctx->trusted); + sk_X509_pop_free(ctx->untrusted_certs, X509_free); + + X509_free(ctx->clCert); + EVP_PKEY_free(ctx->pkey); + ASN1_OCTET_STRING_free(ctx->referenceValue); + if (ctx->secretValue != NULL) + OPENSSL_cleanse(ctx->secretValue->data, ctx->secretValue->length); + ASN1_OCTET_STRING_free(ctx->secretValue); + + X509_NAME_free(ctx->recipient); + ASN1_OCTET_STRING_free(ctx->transactionID); + ASN1_OCTET_STRING_free(ctx->senderNonce); + ASN1_OCTET_STRING_free(ctx->recipNonce); + sk_OSSL_CMP_ITAV_pop_free(ctx->geninfo_ITAVs, OSSL_CMP_ITAV_free); + sk_X509_pop_free(ctx->extraCertsOut, X509_free); + + EVP_PKEY_free(ctx->newPkey); + X509_NAME_free(ctx->issuer); + X509_NAME_free(ctx->subjectName); + sk_GENERAL_NAME_pop_free(ctx->subjectAltNames, GENERAL_NAME_free); + sk_X509_EXTENSION_pop_free(ctx->reqExtensions, X509_EXTENSION_free); + sk_POLICYINFO_pop_free(ctx->policies, POLICYINFO_free); + X509_free(ctx->oldCert); + X509_REQ_free(ctx->p10CSR); + + sk_OSSL_CMP_ITAV_pop_free(ctx->genm_ITAVs, OSSL_CMP_ITAV_free); + + sk_ASN1_UTF8STRING_pop_free(ctx->statusString, ASN1_UTF8STRING_free); + X509_free(ctx->newCert); + sk_X509_pop_free(ctx->caPubs, X509_free); + sk_X509_pop_free(ctx->extraCertsIn, X509_free); + + OPENSSL_free(ctx); +} + +int ossl_cmp_ctx_set_status(OSSL_CMP_CTX *ctx, int status) +{ + if (!ossl_assert(ctx != NULL)) + return 0; + ctx->status = status; + return 1; +} + +/* + * Returns the PKIStatus from the last CertRepMessage + * or Revocation Response or error message, -1 on error + */ +int OSSL_CMP_CTX_get_status(const OSSL_CMP_CTX *ctx) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return -1; + } + return ctx->status; +} + +/* + * Returns the statusString from the last CertRepMessage + * or Revocation Response or error message, NULL on error + */ +OSSL_CMP_PKIFREETEXT *OSSL_CMP_CTX_get0_statusString(const OSSL_CMP_CTX *ctx) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return NULL; + } + return ctx->statusString; +} + +int ossl_cmp_ctx_set0_statusString(OSSL_CMP_CTX *ctx, + OSSL_CMP_PKIFREETEXT *text) +{ + if (!ossl_assert(ctx != NULL)) + return 0; + sk_ASN1_UTF8STRING_pop_free(ctx->statusString, ASN1_UTF8STRING_free); + ctx->statusString = text; + return 1; +} + +int ossl_cmp_ctx_set0_validatedSrvCert(OSSL_CMP_CTX *ctx, X509 *cert) +{ + if (!ossl_assert(ctx != NULL)) + return 0; + X509_free(ctx->validatedSrvCert); + ctx->validatedSrvCert = cert; + return 1; +} + +/* + * Set callback function for checking if the cert is ok or should + * it be rejected. + * Returns 1 on success, 0 on error + */ +int OSSL_CMP_CTX_set_certConf_cb(OSSL_CMP_CTX *ctx, OSSL_cmp_certConf_cb_t cb) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + ctx->certConf_cb = cb; + return 1; +} + +/* + * Set argument, respectively a pointer to a structure containing arguments, + * optionally to be used by the certConf callback. + * Returns 1 on success, 0 on error + */ +int OSSL_CMP_CTX_set_certConf_cb_arg(OSSL_CMP_CTX *ctx, void *arg) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + ctx->certConf_cb_arg = arg; + return 1; +} + +/* + * Get argument, respectively the pointer to a structure containing arguments, + * optionally to be used by certConf callback. + * Returns callback argument set previously (NULL if not set or on error) + */ +void *OSSL_CMP_CTX_get_certConf_cb_arg(const OSSL_CMP_CTX *ctx) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return NULL; + } + return ctx->certConf_cb_arg; +} + +#ifndef OPENSSL_NO_TRACE +static size_t ossl_cmp_log_trace_cb(const char *buf, size_t cnt, + int category, int cmd, void *vdata) +{ + OSSL_CMP_CTX *ctx = vdata; + const char *prefix_msg; + OSSL_CMP_severity level = -1; + char *func = NULL; + char *file = NULL; + int line = 0; + + if (buf == NULL || cnt == 0 || cmd != OSSL_TRACE_CTRL_WRITE || ctx == NULL) + return 0; + if (ctx->log_cb == NULL) + return 1; /* silently drop message */ + + prefix_msg = ossl_cmp_log_parse_metadata(buf, &level, &func, &file, &line); + + if (level > ctx->log_verbosity) /* excludes the case level is unknown */ + goto end; /* suppress output since severity is not sufficient */ + + if (!ctx->log_cb(func != NULL ? func : "(no func)", + file != NULL ? file : "(no file)", + line, level, prefix_msg)) + cnt = 0; + + end: + OPENSSL_free(func); + OPENSSL_free(file); + return cnt; +} +#endif + +/* + * Set a callback function for error reporting and logging messages. + * Returns 1 on success, 0 on error + */ +int OSSL_CMP_CTX_set_log_cb(OSSL_CMP_CTX *ctx, OSSL_cmp_log_cb_t cb) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + ctx->log_cb = cb; + +#ifndef OPENSSL_NO_TRACE + /* do also in case cb == NULL, to switch off logging output: */ + if (!OSSL_trace_set_callback(OSSL_TRACE_CATEGORY_CMP, + ossl_cmp_log_trace_cb, ctx)) + return 0; +#endif + + return 1; +} + +/* Print OpenSSL and CMP errors via the log cb of the ctx or ERR_print_errors */ +void OSSL_CMP_CTX_print_errors(OSSL_CMP_CTX *ctx) +{ + OSSL_CMP_print_errors_cb(ctx == NULL ? NULL : ctx->log_cb); +} + +/* + * Set or clear the reference value to be used for identification + * (i.e., the user name) when using PBMAC. + * Returns 1 on success, 0 on error + */ +int OSSL_CMP_CTX_set1_referenceValue(OSSL_CMP_CTX *ctx, + const unsigned char *ref, int len) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + return ossl_cmp_asn1_octet_string_set1_bytes(&ctx->referenceValue, ref, + len); +} + +/* + * Set or clear the password to be used for protecting messages with PBMAC. + * Returns 1 on success, 0 on error + */ +int OSSL_CMP_CTX_set1_secretValue(OSSL_CMP_CTX *ctx, const unsigned char *sec, + const int len) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + if (ctx->secretValue != NULL) + OPENSSL_cleanse(ctx->secretValue->data, ctx->secretValue->length); + return ossl_cmp_asn1_octet_string_set1_bytes(&ctx->secretValue, sec, len); +} + +/* + * Returns the stack of certificates received in a response message. + * The stack is duplicated so the caller must handle freeing it! + * Returns pointer to created stack on success, NULL on error + */ +STACK_OF(X509) *OSSL_CMP_CTX_get1_extraCertsIn(const OSSL_CMP_CTX *ctx) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return NULL; + } + if (ctx->extraCertsIn == NULL) + return sk_X509_new_null(); + return X509_chain_up_ref(ctx->extraCertsIn); +} + +/* + * Copies any given stack of inbound X509 certificates to extraCertsIn + * of the OSSL_CMP_CTX structure so that they may be retrieved later. + * Returns 1 on success, 0 on error. + */ +int ossl_cmp_ctx_set1_extraCertsIn(OSSL_CMP_CTX *ctx, + STACK_OF(X509) *extraCertsIn) +{ + if (!ossl_assert(ctx != NULL)) + return 0; + + sk_X509_pop_free(ctx->extraCertsIn, X509_free); + ctx->extraCertsIn = NULL; + if (extraCertsIn == NULL) + return 1; + return (ctx->extraCertsIn = X509_chain_up_ref(extraCertsIn)) != NULL; +} + +/* + * Duplicate and set the given stack as the new stack of X509 + * certificates to send out in the extraCerts field. + * Returns 1 on success, 0 on error + */ +int OSSL_CMP_CTX_set1_extraCertsOut(OSSL_CMP_CTX *ctx, + STACK_OF(X509) *extraCertsOut) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + + sk_X509_pop_free(ctx->extraCertsOut, X509_free); + ctx->extraCertsOut = NULL; + if (extraCertsOut == NULL) + return 1; + return (ctx->extraCertsOut = X509_chain_up_ref(extraCertsOut)) != NULL; +} + +/* + * Add the given policy info object + * to the X509_EXTENSIONS of the requested certificate template. + * Returns 1 on success, 0 on error. + */ +int OSSL_CMP_CTX_push0_policy(OSSL_CMP_CTX *ctx, POLICYINFO *pinfo) +{ + if (ctx == NULL || pinfo == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + + if (ctx->policies == NULL + && (ctx->policies = CERTIFICATEPOLICIES_new()) == NULL) + return 0; + + return sk_POLICYINFO_push(ctx->policies, pinfo); +} + +/* + * Add an ITAV for geninfo of the PKI message header + */ +int OSSL_CMP_CTX_push0_geninfo_ITAV(OSSL_CMP_CTX *ctx, OSSL_CMP_ITAV *itav) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + return OSSL_CMP_ITAV_push0_stack_item(&ctx->geninfo_ITAVs, itav); +} + +/* + * Add an itav for the body of outgoing general messages + */ +int OSSL_CMP_CTX_push0_genm_ITAV(OSSL_CMP_CTX *ctx, OSSL_CMP_ITAV *itav) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + return OSSL_CMP_ITAV_push0_stack_item(&ctx->genm_ITAVs, itav); +} + +/* + * Returns a duplicate of the stack of X509 certificates that + * were received in the caPubs field of the last CertRepMessage. + * Returns NULL on error + */ +STACK_OF(X509) *OSSL_CMP_CTX_get1_caPubs(const OSSL_CMP_CTX *ctx) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return NULL; + } + if (ctx->caPubs == NULL) + return sk_X509_new_null(); + return X509_chain_up_ref(ctx->caPubs); +} + +/* + * Duplicate and copy the given stack of certificates to the given + * OSSL_CMP_CTX structure so that they may be retrieved later. + * Returns 1 on success, 0 on error + */ +int ossl_cmp_ctx_set1_caPubs(OSSL_CMP_CTX *ctx, STACK_OF(X509) *caPubs) +{ + if (!ossl_assert(ctx != NULL)) + return 0; + + sk_X509_pop_free(ctx->caPubs, X509_free); + ctx->caPubs = NULL; + if (caPubs == NULL) + return 1; + return (ctx->caPubs = X509_chain_up_ref(caPubs)) != NULL; +} + +#define char_dup OPENSSL_strdup +#define char_free OPENSSL_free +#define DEFINE_OSSL_CMP_CTX_set1(FIELD, TYPE) /* this uses _dup */ \ +int OSSL_CMP_CTX_set1_##FIELD(OSSL_CMP_CTX *ctx, const TYPE *val) \ +{ \ + TYPE *val_dup = NULL; \ + \ + if (ctx == NULL) { \ + CMPerr(0, CMP_R_NULL_ARGUMENT); \ + return 0; \ + } \ + \ + if (val != NULL && (val_dup = TYPE##_dup(val)) == NULL) \ + return 0; \ + TYPE##_free(ctx->FIELD); \ + ctx->FIELD = val_dup; \ + return 1; \ +} + +#define DEFINE_OSSL_CMP_CTX_set1_up_ref(FIELD, TYPE) \ +int OSSL_CMP_CTX_set1_##FIELD(OSSL_CMP_CTX *ctx, TYPE *val) \ +{ \ + if (ctx == NULL) { \ + CMPerr(0, CMP_R_NULL_ARGUMENT); \ + return 0; \ + } \ + \ + if (val != NULL && !TYPE##_up_ref(val)) \ + return 0; \ + TYPE##_free(ctx->FIELD); \ + ctx->FIELD = val; \ + return 1; \ +} + +/* + * Pins the server certificate to be directly trusted (even if it is expired) + * for verifying response messages. + * Cert pointer is not consumed. It may be NULL to clear the entry. + * Returns 1 on success, 0 on error + */ +DEFINE_OSSL_CMP_CTX_set1_up_ref(srvCert, X509) + +/* + * Set the X509 name of the recipient. Set in the PKIHeader. + * returns 1 on success, 0 on error + */ +DEFINE_OSSL_CMP_CTX_set1(recipient, X509_NAME) + +/* + * Store the X509 name of the expected sender in the PKIHeader of responses. + * Returns 1 on success, 0 on error + */ +DEFINE_OSSL_CMP_CTX_set1(expected_sender, X509_NAME) + +/* + * Set the X509 name of the issuer. Set in the PKIHeader. + * Returns 1 on success, 0 on error + */ +DEFINE_OSSL_CMP_CTX_set1(issuer, X509_NAME) + +/* + * Set the subject name that will be placed in the certificate + * request. This will be the subject name on the received certificate. + * Returns 1 on success, 0 on error + */ +DEFINE_OSSL_CMP_CTX_set1(subjectName, X509_NAME) + +/* + * Set the X.509v3 certificate request extensions to be used in IR/CR/KUR. + * Returns 1 on success, 0 on error + */ +int OSSL_CMP_CTX_set0_reqExtensions(OSSL_CMP_CTX *ctx, X509_EXTENSIONS *exts) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + + if (sk_GENERAL_NAME_num(ctx->subjectAltNames) > 0 && exts != NULL + && X509v3_get_ext_by_NID(exts, NID_subject_alt_name, -1) >= 0) { + CMPerr(0, CMP_R_MULTIPLE_SAN_SOURCES); + return 0; + } + sk_X509_EXTENSION_pop_free(ctx->reqExtensions, X509_EXTENSION_free); + ctx->reqExtensions = exts; + return 1; +} + +/* returns 1 if ctx contains a Subject Alternative Name extension, else 0 */ +int OSSL_CMP_CTX_reqExtensions_have_SAN(OSSL_CMP_CTX *ctx) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return -1; + } + /* if one of the following conditions 'fail' this is not an error */ + return ctx->reqExtensions != NULL + && X509v3_get_ext_by_NID(ctx->reqExtensions, + NID_subject_alt_name, -1) >= 0; +} + +/* + * Add a GENERAL_NAME structure that will be added to the CRMF + * request's extensions field to request subject alternative names. + * Returns 1 on success, 0 on error + */ +int OSSL_CMP_CTX_push1_subjectAltName(OSSL_CMP_CTX *ctx, + const GENERAL_NAME *name) +{ + GENERAL_NAME *name_dup; + + if (ctx == NULL || name == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + + if (OSSL_CMP_CTX_reqExtensions_have_SAN(ctx) == 1) { + CMPerr(0, CMP_R_MULTIPLE_SAN_SOURCES); + return 0; + } + + if (ctx->subjectAltNames == NULL + && (ctx->subjectAltNames = sk_GENERAL_NAME_new_null()) == NULL) + return 0; + if ((name_dup = GENERAL_NAME_dup(name)) == NULL) + return 0; + if (!sk_GENERAL_NAME_push(ctx->subjectAltNames, name_dup)) { + GENERAL_NAME_free(name_dup); + return 0; + } + return 1; +} + +/* + * Set our own client certificate, used for example in KUR and when + * doing the IR with existing certificate. + * Returns 1 on success, 0 on error + */ +DEFINE_OSSL_CMP_CTX_set1_up_ref(clCert, X509) + +/* + * Set the old certificate that we are updating in KUR + * or the certificate to be revoked in RR, respectively. + * Also used as reference cert (defaulting to clCert) for deriving subject DN + * and SANs. Its issuer is used as default recipient in the CMP message header. + * Returns 1 on success, 0 on error + */ +DEFINE_OSSL_CMP_CTX_set1_up_ref(oldCert, X509) + +/* + * Set the PKCS#10 CSR to be sent in P10CR. + * Returns 1 on success, 0 on error + */ +DEFINE_OSSL_CMP_CTX_set1(p10CSR, X509_REQ) + +/* + * Sets the (newly received in IP/KUP/CP) certificate in the context. + * Returns 1 on success, 0 on error + * TODO: this only permits for one cert to be enrolled at a time. + */ +int ossl_cmp_ctx_set0_newCert(OSSL_CMP_CTX *ctx, X509 *cert) +{ + if (!ossl_assert(ctx != NULL)) + return 0; + + X509_free(ctx->newCert); + ctx->newCert = cert; + return 1; +} + +/* + * Get the (newly received in IP/KUP/CP) client certificate from the context + * TODO: this only permits for one client cert to be received... + */ +X509 *OSSL_CMP_CTX_get0_newCert(const OSSL_CMP_CTX *ctx) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return NULL; + } + return ctx->newCert; +} + +/* + * Set the client's current private key. + * Returns 1 on success, 0 on error + */ +DEFINE_OSSL_CMP_CTX_set1_up_ref(pkey, EVP_PKEY) + +/* + * Set new key pair. Used e.g. when doing Key Update. + * Returns 1 on success, 0 on error + */ +int OSSL_CMP_CTX_set0_newPkey(OSSL_CMP_CTX *ctx, int priv, EVP_PKEY *pkey) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + + EVP_PKEY_free(ctx->newPkey); + ctx->newPkey = pkey; + ctx->newPkey_priv = priv; + return 1; +} + +/* + * gets the private/public key to use for certificate enrollment, NULL on error + */ +EVP_PKEY *OSSL_CMP_CTX_get0_newPkey(const OSSL_CMP_CTX *ctx, int priv) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return NULL; + } + + if (ctx->newPkey != NULL) + return priv && !ctx->newPkey_priv ? NULL : ctx->newPkey; + if (ctx->p10CSR != NULL) + return priv ? NULL : X509_REQ_get0_pubkey(ctx->p10CSR); + return ctx->pkey; /* may be NULL */ +} + +/* + * Sets the given transactionID to the context. + * Returns 1 on success, 0 on error + */ +int OSSL_CMP_CTX_set1_transactionID(OSSL_CMP_CTX *ctx, + const ASN1_OCTET_STRING *id) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + return ossl_cmp_asn1_octet_string_set1(&ctx->transactionID, id); +} + +/* + * sets the given nonce to be used for the recipNonce in the next message to be + * created. + * returns 1 on success, 0 on error + */ +int ossl_cmp_ctx_set1_recipNonce(OSSL_CMP_CTX *ctx, + const ASN1_OCTET_STRING *nonce) +{ + if (!ossl_assert(ctx != NULL)) + return 0; + return ossl_cmp_asn1_octet_string_set1(&ctx->recipNonce, nonce); +} + +/* + * Stores the given nonce as the last senderNonce sent out. + * Returns 1 on success, 0 on error + */ +int OSSL_CMP_CTX_set1_senderNonce(OSSL_CMP_CTX *ctx, + const ASN1_OCTET_STRING *nonce) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + return ossl_cmp_asn1_octet_string_set1(&ctx->senderNonce, nonce); +} + +/* + * Set the host name of the (HTTP) proxy server to use for all connections + * returns 1 on success, 0 on error + */ +DEFINE_OSSL_CMP_CTX_set1(proxyName, char) + +/* + * Set the (HTTP) host name of the CA server. + * Returns 1 on success, 0 on error + */ +DEFINE_OSSL_CMP_CTX_set1(serverName, char) + +/* + * Sets the (HTTP) proxy port to be used. + * Returns 1 on success, 0 on error + */ +int OSSL_CMP_CTX_set_proxyPort(OSSL_CMP_CTX *ctx, int port) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + ctx->proxyPort = port; + return 1; +} + +/* + * sets the http connect/disconnect callback function to be used for HTTP(S) + * returns 1 on success, 0 on error + */ +int OSSL_CMP_CTX_set_http_cb(OSSL_CMP_CTX *ctx, OSSL_cmp_http_cb_t cb) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + ctx->http_cb = cb; + return 1; +} + +/* + * Set argument optionally to be used by the http connect/disconnect callback. + * Returns 1 on success, 0 on error + */ +int OSSL_CMP_CTX_set_http_cb_arg(OSSL_CMP_CTX *ctx, void *arg) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + ctx->http_cb_arg = arg; + return 1; +} + +/* + * Get argument optionally to be used by the http connect/disconnect callback + * Returns callback argument set previously (NULL if not set or on error) + */ +void *OSSL_CMP_CTX_get_http_cb_arg(const OSSL_CMP_CTX *ctx) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return NULL; + } + return ctx->http_cb_arg; +} + +/* + * Set callback function for sending CMP request and receiving response. + * Returns 1 on success, 0 on error + */ +int OSSL_CMP_CTX_set_transfer_cb(OSSL_CMP_CTX *ctx, OSSL_cmp_transfer_cb_t cb) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + ctx->transfer_cb = cb; + return 1; +} + +/* + * Set argument optionally to be used by the transfer callback. + * Returns 1 on success, 0 on error + */ +int OSSL_CMP_CTX_set_transfer_cb_arg(OSSL_CMP_CTX *ctx, void *arg) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + ctx->transfer_cb_arg = arg; + return 1; +} + +/* + * Get argument optionally to be used by the transfer callback. + * Returns callback argument set previously (NULL if not set or on error) + */ +void *OSSL_CMP_CTX_get_transfer_cb_arg(const OSSL_CMP_CTX *ctx) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return NULL; + } + return ctx->transfer_cb_arg; +} + +/* + * Sets the (HTTP) server port to be used. + * Returns 1 on success, 0 on error + */ +int OSSL_CMP_CTX_set_serverPort(OSSL_CMP_CTX *ctx, int port) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + ctx->serverPort = port; + return 1; +} + +/* + * Sets the HTTP path to be used on the server (e.g "pkix/"). + * Returns 1 on success, 0 on error + */ +DEFINE_OSSL_CMP_CTX_set1(serverPath, char) + +/* + * Set the failInfo error code as bit encoding in OSSL_CMP_CTX. + * Returns 1 on success, 0 on error + */ +int ossl_cmp_ctx_set_failInfoCode(OSSL_CMP_CTX *ctx, int fail_info) +{ + if (!ossl_assert(ctx != NULL)) + return 0; + ctx->failInfoCode = fail_info; + return 1; +} + +/* + * Get the failInfo error code in OSSL_CMP_CTX as bit encoding. + * Returns bit string as integer on success, -1 on error + */ +int OSSL_CMP_CTX_get_failInfoCode(const OSSL_CMP_CTX *ctx) +{ + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return -1; + } + return ctx->failInfoCode; +} + +/* + * Sets a Boolean or integer option of the context to the "val" arg. + * Returns 1 on success, 0 on error + */ +int OSSL_CMP_CTX_set_option(OSSL_CMP_CTX *ctx, int opt, int val) { + int min_val; + + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + + switch (opt) { + case OSSL_CMP_OPT_REVOCATION_REASON: + min_val = OCSP_REVOKED_STATUS_NOSTATUS; + break; + case OSSL_CMP_OPT_POPOMETHOD: + min_val = OSSL_CRMF_POPO_NONE; + break; + default: + min_val = 0; + break; + } + if (val < min_val) { + CMPerr(0, CMP_R_INVALID_ARGS); + return 0; + } + + switch (opt) { + case OSSL_CMP_OPT_LOG_VERBOSITY: + if (val > OSSL_CMP_LOG_DEBUG) { + CMPerr(0, CMP_R_INVALID_ARGS); + return 0; + } + ctx->log_verbosity = val; + break; + case OSSL_CMP_OPT_IMPLICITCONFIRM: + ctx->implicitConfirm = val; + break; + case OSSL_CMP_OPT_DISABLECONFIRM: + ctx->disableConfirm = val; + break; + case OSSL_CMP_OPT_UNPROTECTED_SEND: + ctx->unprotectedSend = val; + break; + case OSSL_CMP_OPT_UNPROTECTED_ERRORS: + ctx->unprotectedErrors = val; + break; + case OSSL_CMP_OPT_VALIDITYDAYS: + ctx->days = val; + break; + case OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT: + ctx->SubjectAltName_nodefault = val; + break; + case OSSL_CMP_OPT_SUBJECTALTNAME_CRITICAL: + ctx->setSubjectAltNameCritical = val; + break; + case OSSL_CMP_OPT_POLICIES_CRITICAL: + ctx->setPoliciesCritical = val; + break; + case OSSL_CMP_OPT_IGNORE_KEYUSAGE: + ctx->ignore_keyusage = val; + break; + case OSSL_CMP_OPT_POPOMETHOD: + if (val > OSSL_CRMF_POPO_KEYAGREE) { + CMPerr(0, CMP_R_INVALID_ARGS); + return 0; + } + ctx->popoMethod = val; + break; + case OSSL_CMP_OPT_DIGEST_ALGNID: + ctx->digest = val; + break; + case OSSL_CMP_OPT_OWF_ALGNID: + ctx->pbm_owf = val; + break; + case OSSL_CMP_OPT_MAC_ALGNID: + ctx->pbm_mac = val; + break; + case OSSL_CMP_OPT_MSGTIMEOUT: + ctx->msgtimeout = val; + break; + case OSSL_CMP_OPT_TOTALTIMEOUT: + ctx->totaltimeout = val; + break; + case OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR: + ctx->permitTAInExtraCertsForIR = val; + break; + case OSSL_CMP_OPT_REVOCATION_REASON: + if (val > OCSP_REVOKED_STATUS_AACOMPROMISE) { + CMPerr(0, CMP_R_INVALID_ARGS); + return 0; + } + ctx->revocationReason = val; + break; + default: + CMPerr(0, CMP_R_INVALID_ARGS); + return 0; + } + + return 1; +} + +/* + * Reads a Boolean or integer option value from the context. + * Returns -1 on error (which is the default OSSL_CMP_OPT_REVOCATION_REASON) + */ +int OSSL_CMP_CTX_get_option(const OSSL_CMP_CTX *ctx, int opt) { + if (ctx == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return -1; + } + + switch (opt) { + case OSSL_CMP_OPT_LOG_VERBOSITY: + return ctx->log_verbosity; + case OSSL_CMP_OPT_IMPLICITCONFIRM: + return ctx->implicitConfirm; + case OSSL_CMP_OPT_DISABLECONFIRM: + return ctx->disableConfirm; + case OSSL_CMP_OPT_UNPROTECTED_SEND: + return ctx->unprotectedSend; + case OSSL_CMP_OPT_UNPROTECTED_ERRORS: + return ctx->unprotectedErrors; + case OSSL_CMP_OPT_VALIDITYDAYS: + return ctx->days; + case OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT: + return ctx->SubjectAltName_nodefault; + case OSSL_CMP_OPT_SUBJECTALTNAME_CRITICAL: + return ctx->setSubjectAltNameCritical; + case OSSL_CMP_OPT_POLICIES_CRITICAL: + return ctx->setPoliciesCritical; + case OSSL_CMP_OPT_IGNORE_KEYUSAGE: + return ctx->ignore_keyusage; + case OSSL_CMP_OPT_POPOMETHOD: + return ctx->popoMethod; + case OSSL_CMP_OPT_DIGEST_ALGNID: + return ctx->digest; + case OSSL_CMP_OPT_OWF_ALGNID: + return ctx->pbm_owf; + case OSSL_CMP_OPT_MAC_ALGNID: + return ctx->pbm_mac; + case OSSL_CMP_OPT_MSGTIMEOUT: + return ctx->msgtimeout; + case OSSL_CMP_OPT_TOTALTIMEOUT: + return ctx->totaltimeout; + case OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR: + return ctx->permitTAInExtraCertsForIR; + case OSSL_CMP_OPT_REVOCATION_REASON: + return ctx->revocationReason; + default: + CMPerr(0, CMP_R_INVALID_ARGS); + return -1; + } +} diff --git a/crypto/cmp/cmp_err.c b/crypto/cmp/cmp_err.c index 4e3a5c34..4086d522 100644 --- a/crypto/cmp/cmp_err.c +++ b/crypto/cmp/cmp_err.c @@ -1,6 +1,7 @@ /* - * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved. + * Copyright Nokia 2007-2019 + * Copyright Siemens AG 2015-2019 * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -14,6 +15,11 @@ #ifndef OPENSSL_NO_ERR static const ERR_STRING_DATA CMP_str_reasons[] = { + {ERR_PACK(ERR_LIB_CMP, 0, CMP_R_INVALID_ARGS), "invalid args"}, + {ERR_PACK(ERR_LIB_CMP, 0, CMP_R_MULTIPLE_SAN_SOURCES), + "multiple san sources"}, + {ERR_PACK(ERR_LIB_CMP, 0, CMP_R_NO_STDIO), "no stdio"}, + {ERR_PACK(ERR_LIB_CMP, 0, CMP_R_NULL_ARGUMENT), "null argument"}, {0, NULL} }; diff --git a/crypto/cmp/cmp_int.h b/crypto/cmp/cmp_local.h similarity index 73% rename from crypto/cmp/cmp_int.h rename to crypto/cmp/cmp_local.h index e78968aa..1a7dcca3 100644 --- a/crypto/cmp/cmp_int.h +++ b/crypto/cmp/cmp_local.h @@ -7,12 +7,10 @@ * this file except in compliance with the License. You can obtain a copy * in the file LICENSE in the source distribution or at * https://www.openssl.org/source/license.html - * - * CMP implementation by Martin Peylo, Miikka Viljanen, and David von Oheimb. */ -#ifndef OSSL_HEADER_CMP_INT_H -# define OSSL_HEADER_CMP_INT_H +#ifndef OSSL_CRYPTO_CMP_LOCAL_H +# define OSSL_CRYPTO_CMP_LOCAL_H # include "internal/cryptlib.h" @@ -21,11 +19,105 @@ /* explicit #includes not strictly needed since implied by the above: */ # include -# include +# include # include # include # include +/* + * this structure is used to store the context for CMP sessions + */ +struct ossl_cmp_ctx_st { + OSSL_cmp_log_cb_t log_cb; /* log callback for error/debug/etc. output */ + OSSL_CMP_severity log_verbosity; /* level of verbosity of log output */ + + /* message transfer */ + OSSL_cmp_transfer_cb_t transfer_cb; /* default: OSSL_CMP_MSG_http_perform */ + void *transfer_cb_arg; /* allows to store optional argument to cb */ + /* HTTP-based transfer */ + char *serverPath; + char *serverName; + int serverPort; + char *proxyName; + int proxyPort; + int msgtimeout; /* max seconds to wait for each CMP message round trip */ + int totaltimeout; /* maximum number seconds an enrollment may take, incl. */ + /* attempts polling for a response if a 'waiting' PKIStatus is received */ + time_t end_time; /* session start time + totaltimeout */ + OSSL_cmp_http_cb_t http_cb; + void *http_cb_arg; /* allows to store optional argument to cb */ + + /* server authentication */ + int unprotectedErrors; /* accept neg. response with no/invalid protection */ + /* to cope with broken server */ + X509 *srvCert; /* certificate used to identify the server */ + X509 *validatedSrvCert; /* caches any already validated server cert */ + X509_NAME *expected_sender; /* expected sender in pkiheader of response */ + X509_STORE *trusted; /* trust store maybe w CRLs and cert verify callback */ + STACK_OF(X509) *untrusted_certs; /* untrusted (intermediate) certs */ + int ignore_keyusage; /* ignore key usage entry when validating certs */ + int permitTAInExtraCertsForIR; /* allow use of root certs in extracerts */ + /* when validating message protection; used for 3GPP-style E.7 */ + + /* client authentication */ + int unprotectedSend; /* send unprotected PKI messages */ + X509 *clCert; /* client cert used to identify and sign for MSG_SIG_ALG */ + EVP_PKEY *pkey; /* the key pair corresponding to clCert */ + ASN1_OCTET_STRING *referenceValue; /* optional user name for MSG_MAC_ALG */ + ASN1_OCTET_STRING *secretValue; /* password/shared secret for MSG_MAC_ALG */ + /* PBMParameters for MSG_MAC_ALG */ + size_t pbm_slen; /* currently fixed to 16 */ + int pbm_owf; /* NID of one-way function (OWF), default: SHA256 */ + int pbm_itercnt; /* currently fixed to 500 */ + int pbm_mac; /* NID of MAC algorithm, default: HMAC-SHA1 as per RFC 4210 */ + + /* CMP message header and extra certificates */ + X509_NAME *recipient; /* to set in recipient in pkiheader */ + int digest; /* NID of digest used in MSG_SIG_ALG and POPO, default SHA256 */ + ASN1_OCTET_STRING *transactionID; /* the current transaction ID */ + ASN1_OCTET_STRING *senderNonce; /* last nonce sent */ + ASN1_OCTET_STRING *recipNonce; /* last nonce received */ + STACK_OF(OSSL_CMP_ITAV) *geninfo_ITAVs; + int implicitConfirm; /* set implicitConfirm in IR/KUR/CR messages */ + int disableConfirm; /* disable certConf in IR/KUR/CR for broken servers */ + STACK_OF(X509) *extraCertsOut; /* to be included in request messages */ + + /* certificate template */ + EVP_PKEY *newPkey; /* explicit new private/public key for cert enrollment */ + int newPkey_priv; /* flag indicating if newPkey contains private key */ + X509_NAME *issuer; /* issuer name to used in cert template */ + int days; /* Number of days new certificates are asked to be valid for */ + X509_NAME *subjectName; /* subject name to be used in the cert template */ + STACK_OF(GENERAL_NAME) *subjectAltNames; /* to add to the cert template */ + int SubjectAltName_nodefault; + int setSubjectAltNameCritical; + X509_EXTENSIONS *reqExtensions; /* exts to be added to cert template */ + CERTIFICATEPOLICIES *policies; /* policies to be included in extensions */ + int setPoliciesCritical; + int popoMethod; /* Proof-of-possession mechanism; default: signature */ + X509 *oldCert; /* cert to be updated (via KUR) or to be revoked (via RR) */ + X509_REQ *p10CSR; /* for P10CR: PKCS#10 CSR to be sent */ + + /* misc body contents */ + int revocationReason; /* revocation reason code to be included in RR */ + STACK_OF(OSSL_CMP_ITAV) *genm_ITAVs; /* content of general message */ + + /* result returned in responses */ + int status; /* PKIStatus of last received IP/CP/KUP/RP/error or -1 */ + /* TODO: this should be a stack since there could be more than one */ + OSSL_CMP_PKIFREETEXT *statusString; /* of last IP/CP/KUP/RP/error */ + int failInfoCode; /* failInfoCode of last received IP/CP/KUP/error, or -1 */ + /* TODO: this should be a stack since there could be more than one */ + X509 *newCert; /* newly enrolled cert received from the CA */ + /* TODO: this should be a stack since there could be more than one */ + STACK_OF(X509) *caPubs; /* CA certs received from server (in IP message) */ + STACK_OF(X509) *extraCertsIn; /* extraCerts received from server */ + + /* certificate confirmation */ + OSSL_cmp_certConf_cb_t certConf_cb; /* callback for app checking new cert */ + void *certConf_cb_arg; /* allows to store an argument individual to cb */ +} /* OSSL_CMP_CTX */; + /* * ########################################################################## * ASN.1 DECLARATIONS @@ -42,7 +134,7 @@ * -- extra CRL details (e.g., crl number, reason, location, etc.) * } */ -typedef struct OSSL_cmp_revanncontent_st { +typedef struct ossl_cmp_revanncontent_st { ASN1_INTEGER *status; OSSL_CRMF_CERTID *certId; ASN1_GENERALIZEDTIME *willBeRevokedAt; @@ -75,7 +167,7 @@ DECLARE_ASN1_FUNCTIONS(OSSL_CMP_REVANNCONTENT) * -- } * } */ -typedef struct OSSL_cmp_challenge_st { +typedef struct ossl_cmp_challenge_st { X509_ALGOR *owf; ASN1_OCTET_STRING *witness; ASN1_OCTET_STRING *challenge; @@ -89,7 +181,7 @@ DECLARE_ASN1_FUNCTIONS(OSSL_CMP_CHALLENGE) * newWithNew Certificate * } */ -typedef struct OSSL_cmp_cakeyupdanncontent_st { +typedef struct ossl_cmp_cakeyupdanncontent_st { X509 *oldWithNew; X509 *newWithOld; X509 *newWithNew; @@ -109,7 +201,7 @@ DECLARE_ASN1_FUNCTIONS(OSSL_CMP_MSGS) * infoValue ANY DEFINED BY infoType OPTIONAL * } */ -struct OSSL_cmp_itav_st { +struct ossl_cmp_itav_st { ASN1_OBJECT *infoType; union { char *ptr; @@ -148,8 +240,7 @@ struct OSSL_cmp_itav_st { DECLARE_ASN1_FUNCTIONS(OSSL_CMP_ITAV) DECLARE_ASN1_DUP_FUNCTION(OSSL_CMP_ITAV) - -typedef struct OSSL_cmp_certorenccert_st { +typedef struct ossl_cmp_certorenccert_st { int type; union { X509 *certificate; @@ -166,7 +257,7 @@ DECLARE_ASN1_FUNCTIONS(OSSL_CMP_CERTORENCCERT) * publicationInfo [1] PKIPublicationInfo OPTIONAL * } */ -typedef struct OSSL_cmp_certifiedkeypair_st { +typedef struct ossl_cmp_certifiedkeypair_st { OSSL_CMP_CERTORENCCERT *certOrEncCert; OSSL_CRMF_ENCRYPTEDVALUE *privateKey; OSSL_CRMF_PKIPUBLICATIONINFO *publicationInfo; @@ -180,7 +271,7 @@ DECLARE_ASN1_FUNCTIONS(OSSL_CMP_CERTIFIEDKEYPAIR) * failInfo PKIFailureInfo OPTIONAL * } */ -struct OSSL_cmp_pkisi_st { +struct ossl_cmp_pkisi_st { OSSL_CMP_PKISTATUS *status; OSSL_CMP_PKIFREETEXT *statusString; OSSL_CMP_PKIFAILUREINFO *failInfo; @@ -196,7 +287,7 @@ DECLARE_ASN1_DUP_FUNCTION(OSSL_CMP_PKISI) * crlEntryDetails Extensions OPTIONAL * } */ -typedef struct OSSL_cmp_revdetails_st { +typedef struct ossl_cmp_revdetails_st { OSSL_CRMF_CERTTEMPLATE *certDetails; X509_EXTENSIONS *crlEntryDetails; } OSSL_CMP_REVDETAILS; @@ -216,7 +307,7 @@ DEFINE_STACK_OF(OSSL_CMP_REVDETAILS) * -- the resulting CRLs (there may be more than one) * } */ -struct OSSL_cmp_revrepcontent_st { +struct ossl_cmp_revrepcontent_st { STACK_OF(OSSL_CMP_PKISI) *status; STACK_OF(OSSL_CRMF_CERTID) *revCerts; STACK_OF(X509_CRL) *crls; @@ -233,7 +324,7 @@ DECLARE_ASN1_FUNCTIONS(OSSL_CMP_REVREPCONTENT) * CertifiedKeyPair OPTIONAL * } */ -typedef struct OSSL_cmp_keyrecrepcontent_st { +typedef struct ossl_cmp_keyrecrepcontent_st { OSSL_CMP_PKISI *status; X509 *newSigCert; STACK_OF(X509) *caCerts; @@ -250,7 +341,7 @@ DECLARE_ASN1_FUNCTIONS(OSSL_CMP_KEYRECREPCONTENT) * -- implementation-specific error details * } */ -typedef struct OSSL_cmp_errormsgcontent_st { +typedef struct ossl_cmp_errormsgcontent_st { OSSL_CMP_PKISI *pKIStatusInfo; ASN1_INTEGER *errorCode; OSSL_CMP_PKIFREETEXT *errorDetails; @@ -269,7 +360,7 @@ DECLARE_ASN1_FUNCTIONS(OSSL_CMP_ERRORMSGCONTENT) * statusInfo PKIStatusInfo OPTIONAL * } */ -struct OSSL_cmp_certstatus_st { +struct ossl_cmp_certstatus_st { ASN1_OCTET_STRING *certHash; ASN1_INTEGER *certReqId; OSSL_CMP_PKISI *statusInfo; @@ -292,7 +383,7 @@ DECLARE_ASN1_FUNCTIONS(OSSL_CMP_CERTCONFIRMCONTENT) * -- for regInfo in CertReqMsg [CRMF] * } */ -struct OSSL_cmp_certresponse_st { +struct ossl_cmp_certresponse_st { ASN1_INTEGER *certReqId; OSSL_CMP_PKISI *status; OSSL_CMP_CERTIFIEDKEYPAIR *certifiedKeyPair; @@ -307,7 +398,7 @@ DECLARE_ASN1_FUNCTIONS(OSSL_CMP_CERTRESPONSE) * response SEQUENCE OF CertResponse * } */ -struct OSSL_cmp_certrepmessage_st { +struct ossl_cmp_certrepmessage_st { STACK_OF(X509) *caPubs; STACK_OF(OSSL_CMP_CERTRESPONSE) *response; } /* OSSL_CMP_CERTREPMESSAGE */; @@ -318,7 +409,7 @@ DECLARE_ASN1_FUNCTIONS(OSSL_CMP_CERTREPMESSAGE) * certReqId INTEGER * } */ -typedef struct OSSL_cmp_pollreq_st { +typedef struct ossl_cmp_pollreq_st { ASN1_INTEGER *certReqId; } OSSL_CMP_POLLREQ; DECLARE_ASN1_FUNCTIONS(OSSL_CMP_POLLREQ) @@ -333,7 +424,7 @@ DECLARE_ASN1_FUNCTIONS(OSSL_CMP_POLLREQCONTENT) * reason PKIFreeText OPTIONAL * } */ -struct OSSL_cmp_pollrep_st { +struct ossl_cmp_pollrep_st { ASN1_INTEGER *certReqId; ASN1_INTEGER *checkAfter; OSSL_CMP_PKIFREETEXT *reason; @@ -377,7 +468,7 @@ DECLARE_ASN1_FUNCTIONS(OSSL_CMP_POLLREPCONTENT) * -- (this field not primarily intended for human consumption) * } */ -struct OSSL_cmp_pkiheader_st { +struct ossl_cmp_pkiheader_st { ASN1_INTEGER *pvno; GENERAL_NAME *sender; GENERAL_NAME *recipient; @@ -435,7 +526,7 @@ DECLARE_ASN1_FUNCTIONS(OSSL_CMP_GENREPCONTENT) * pollReq [25] PollReqContent, --Polling request * pollRep [26] PollRepContent --Polling response */ -typedef struct OSSL_cmp_pkibody_st { +typedef struct ossl_cmp_pkibody_st { int type; union { OSSL_CRMF_MSGS *ir; /* 0 */ @@ -521,7 +612,7 @@ DECLARE_ASN1_FUNCTIONS(OSSL_CMP_PKIBODY) * OPTIONAL * } */ -struct OSSL_cmp_msg_st { +struct ossl_cmp_msg_st { OSSL_CMP_PKIHEADER *header; OSSL_CMP_PKIBODY *body; ASN1_BIT_STRING *protection; /* 0 */ @@ -529,6 +620,7 @@ struct OSSL_cmp_msg_st { STACK_OF(X509) *extraCerts; /* 1 */ } /* OSSL_CMP_MSG */; DECLARE_ASN1_FUNCTIONS(OSSL_CMP_MSG) +DECLARE_ASN1_DUP_FUNCTION(OSSL_CMP_MSG) /*- * ProtectedPart ::= SEQUENCE { @@ -586,4 +678,48 @@ DECLARE_ASN1_FUNCTIONS(CMP_PROTECTEDPART) * } */ -#endif /* !defined OSSL_HEADER_CMP_INT_H */ +/* + * functions + */ + +/* from cmp_asn.c */ +int ossl_cmp_asn1_get_int(const ASN1_INTEGER *a); + +/* from cmp_util.c */ +const char *ossl_cmp_log_parse_metadata(const char *buf, + OSSL_CMP_severity *level, char **func, + char **file, int *line); +/* workaround for 4096 bytes limitation of ERR_print_errors_cb() */ +void ossl_cmp_add_error_txt(const char *separator, const char *txt); +# define ossl_cmp_add_error_data(txt) ossl_cmp_add_error_txt(" : ", txt) +# define ossl_cmp_add_error_line(txt) ossl_cmp_add_error_txt("\n", txt) +/* functions manipulating lists of certificates etc could be generally useful */ +int ossl_cmp_sk_X509_add1_cert (STACK_OF(X509) *sk, X509 *cert, + int no_dup, int prepend); +int ossl_cmp_sk_X509_add1_certs(STACK_OF(X509) *sk, STACK_OF(X509) *certs, + int no_self_signed, int no_dups, int prepend); +int ossl_cmp_X509_STORE_add1_certs(X509_STORE *store, STACK_OF(X509) *certs, + int only_self_signed); +STACK_OF(X509) *ossl_cmp_X509_STORE_get1_certs(X509_STORE *store); +int ossl_cmp_asn1_octet_string_set1(ASN1_OCTET_STRING **tgt, + const ASN1_OCTET_STRING *src); +int ossl_cmp_asn1_octet_string_set1_bytes(ASN1_OCTET_STRING **tgt, + const unsigned char *bytes, int len); +STACK_OF(X509) *ossl_cmp_build_cert_chain(STACK_OF(X509) *certs, X509 *cert); + +/* from cmp_ctx.c */ +int ossl_cmp_ctx_set0_validatedSrvCert(OSSL_CMP_CTX *ctx, X509 *cert); +int ossl_cmp_ctx_set_status(OSSL_CMP_CTX *ctx, int status); +int ossl_cmp_ctx_set0_statusString(OSSL_CMP_CTX *ctx, + OSSL_CMP_PKIFREETEXT *text); +int ossl_cmp_ctx_set_failInfoCode(OSSL_CMP_CTX *ctx, int fail_info); +int ossl_cmp_ctx_set0_newCert(OSSL_CMP_CTX *ctx, X509 *cert); +int ossl_cmp_ctx_set1_caPubs(OSSL_CMP_CTX *ctx, STACK_OF(X509) *caPubs); +int ossl_cmp_ctx_set1_extraCertsIn(OSSL_CMP_CTX *ctx, + STACK_OF(X509) *extraCertsIn); +int ossl_cmp_ctx_set1_recipNonce(OSSL_CMP_CTX *ctx, + const ASN1_OCTET_STRING *nonce); + +# define OSSL_CMP_TRANSACTIONID_LENGTH 16 + +#endif /* !defined OSSL_CRYPTO_CMP_LOCAL_H */ diff --git a/crypto/cmp/cmp_util.c b/crypto/cmp/cmp_util.c new file mode 100644 index 00000000..9490496c --- /dev/null +++ b/crypto/cmp/cmp_util.c @@ -0,0 +1,449 @@ +/* + * Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved. + * Copyright Nokia 2007-2019 + * Copyright Siemens AG 2015-2019 + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include +#include +#include "cmp_local.h" /* just for decls of internal functions defined here */ +#include +#include /* should be implied by cmperr.h */ +#include + +/* + * use trace API for CMP-specific logging, prefixed by "CMP " and severity + */ + +int OSSL_CMP_log_open(void) /* is designed to be idempotent */ +{ +#ifndef OPENSSL_NO_STDIO + BIO *bio = BIO_new_fp(stdout, BIO_NOCLOSE); + + if (bio != NULL && OSSL_trace_set_channel(OSSL_TRACE_CATEGORY_CMP, bio)) + return 1; + BIO_free(bio); +#endif + CMPerr(0, CMP_R_NO_STDIO); + return 0; +} + +void OSSL_CMP_log_close(void) /* is designed to be idempotent */ +{ + (void)OSSL_trace_set_channel(OSSL_TRACE_CATEGORY_CMP, NULL); +} + +/* return >= 0 if level contains logging level, possibly preceded by "CMP " */ +#define max_level_len 5 /* = max length of the below strings, e.g., "EMERG" */ +static OSSL_CMP_severity parse_level(const char *level) +{ + const char *end_level = strchr(level, ':'); + int len; + char level_copy[max_level_len + 1]; + + if (end_level == NULL) + return -1; + + if (strncmp(level, OSSL_CMP_LOG_PREFIX, + strlen(OSSL_CMP_LOG_PREFIX)) == 0) + level += strlen(OSSL_CMP_LOG_PREFIX); + len = end_level - level; + if (len > max_level_len) + return -1; + OPENSSL_strlcpy(level_copy, level, len + 1); + return + strcmp(level_copy, "EMERG") == 0 ? OSSL_CMP_LOG_EMERG : + strcmp(level_copy, "ALERT") == 0 ? OSSL_CMP_LOG_ALERT : + strcmp(level_copy, "CRIT") == 0 ? OSSL_CMP_LOG_CRIT : + strcmp(level_copy, "ERROR") == 0 ? OSSL_CMP_LOG_ERR : + strcmp(level_copy, "WARN") == 0 ? OSSL_CMP_LOG_WARNING : + strcmp(level_copy, "NOTE") == 0 ? OSSL_CMP_LOG_NOTICE : + strcmp(level_copy, "INFO") == 0 ? OSSL_CMP_LOG_INFO : + strcmp(level_copy, "DEBUG") == 0 ? OSSL_CMP_LOG_DEBUG : + -1; +} + +const char *ossl_cmp_log_parse_metadata(const char *buf, + OSSL_CMP_severity *level, char **func, char **file, int *line) +{ + const char *p_func = buf; + const char *p_file = buf == NULL ? NULL : strchr(buf, ':'); + const char *p_level = buf; + const char *msg = buf; + + *level = -1; + *func = NULL; + *file = NULL; + *line = 0; + + if (p_file != NULL) { + const char *p_line = strchr(++p_file, ':'); + + if ((*level = parse_level(buf)) < 0 && p_line != NULL) { + /* check if buf contains location info and logging level */ + char *p_level_tmp = (char *)p_level; + const long line_number = strtol(++p_line, &p_level_tmp, 10); + + p_level = p_level_tmp; + if (p_level > p_line && *(p_level++) == ':') { + if ((*level = parse_level(p_level)) >= 0) { + *func = OPENSSL_strndup(p_func, p_file - 1 - p_func); + *file = OPENSSL_strndup(p_file, p_line - 1 - p_file); + /* no real problem if OPENSSL_strndup() returns NULL */ + *line = (int)line_number; + msg = strchr(p_level, ':') + 1; + if (*msg == ' ') + msg++; + } + } + } + } + return msg; +} + + +/* + * auxiliary function for incrementally reporting texts via the error queue + */ +static void put_error(int lib, const char *func, int reason, + const char *file, int line) +{ + ERR_new(); + ERR_set_debug(file, line, func); + ERR_set_error(lib, reason, NULL /* no data here, so fmt is NULL */); +} + +#define ERR_print_errors_cb_LIMIT 4096 /* size of char buf[] variable there */ +#define TYPICAL_MAX_OUTPUT_BEFORE_DATA 100 +#define MAX_DATA_LEN (ERR_print_errors_cb_LIMIT-TYPICAL_MAX_OUTPUT_BEFORE_DATA) +void ossl_cmp_add_error_txt(const char *separator, const char *txt) +{ + const char *file = NULL; + int line; + const char *func = NULL; + const char *data = NULL; + int flags; + unsigned long err = ERR_peek_last_error(); + + if (separator == NULL) + separator = ""; + if (err == 0) + put_error(ERR_LIB_CMP, NULL, 0, "", 0); + + do { + size_t available_len, data_len; + const char *curr = txt, *next = txt; + char *tmp; + + ERR_peek_last_error_all(&file, &line, &func, &data, &flags); + if ((flags & ERR_TXT_STRING) == 0) { + data = ""; + separator = ""; + } + data_len = strlen(data); + + /* workaround for limit of ERR_print_errors_cb() */ + if (data_len >= MAX_DATA_LEN + || strlen(separator) >= (size_t)(MAX_DATA_LEN - data_len)) + available_len = 0; + else + available_len = MAX_DATA_LEN - data_len - strlen(separator) - 1; + /* MAX_DATA_LEN > available_len >= 0 */ + + if (separator[0] == '\0') { + const size_t len_next = strlen(next); + + if (len_next <= available_len) { + next += len_next; + curr = NULL; /* no need to split */ + } + else { + next += available_len; + curr = next; /* will split at this point */ + } + } else { + while (*next != '\0' && (size_t)(next - txt) <= available_len) { + curr = next; + next = strstr(curr, separator); + if (next != NULL) + next += strlen(separator); + else + next = curr + strlen(curr); + } + if ((size_t)(next - txt) <= available_len) + curr = NULL; /* the above loop implies *next == '\0' */ + } + if (curr != NULL) { + /* split error msg at curr since error data would get too long */ + if (curr != txt) { + tmp = OPENSSL_strndup(txt, curr - txt); + if (tmp == NULL) + return; + ERR_add_error_data(2, separator, tmp); + OPENSSL_free(tmp); + } + put_error(ERR_LIB_CMP, func, err, file, line); + txt = curr; + } else { + ERR_add_error_data(2, separator, txt); + txt = next; /* finished */ + } + } while (*txt != '\0'); +} + +/* this is similar to ERR_print_errors_cb, but uses the CMP-specific cb type */ +void OSSL_CMP_print_errors_cb(OSSL_cmp_log_cb_t log_fn) +{ + unsigned long err; + char msg[ERR_print_errors_cb_LIMIT]; + const char *file = NULL, *func = NULL, *data = NULL; + int line, flags; + + if (log_fn == NULL) { +#ifndef OPENSSL_NO_STDIO + ERR_print_errors_fp(stderr); +#else + /* CMPerr(0, CMP_R_NO_STDIO) makes no sense during error printing */ +#endif + return; + } + + while ((err = ERR_get_error_all(&file, &line, &func, &data, &flags)) != 0) { + char component[128]; + const char *func_ = func != NULL && *func != '\0' ? func : ""; + + if (!(flags & ERR_TXT_STRING)) + data = NULL; +#ifdef OSSL_CMP_PRINT_LIBINFO + BIO_snprintf(component, sizeof(component), "OpenSSL:%s:%s", + ERR_lib_error_string(err), func_); +#else + BIO_snprintf(component, sizeof(component), "%s",func_); +#endif + BIO_snprintf(msg, sizeof(msg), "%s%s%s", ERR_reason_error_string(err), + data == NULL ? "" : " : ", data == NULL ? "" : data); + if (log_fn(component, file, line, OSSL_CMP_LOG_ERR, msg) <= 0) + break; /* abort outputting the error report */ + } +} + +/* + * functions manipulating lists of certificates etc. + * these functions could be generally useful. + */ + +int ossl_cmp_sk_X509_add1_cert(STACK_OF(X509) *sk, X509 *cert, + int no_dup, int prepend) +{ + if (sk == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + if (no_dup) { + /* + * not using sk_X509_set_cmp_func() and sk_X509_find() + * because this re-orders the certs on the stack + */ + int i; + + for (i = 0; i < sk_X509_num(sk); i++) { + if (X509_cmp(sk_X509_value(sk, i), cert) == 0) + return 1; + } + } + if (!X509_up_ref(cert)) + return 0; + if (!sk_X509_insert(sk, cert, prepend ? 0 : -1)) { + X509_free(cert); + return 0; + } + return 1; +} + +int ossl_cmp_sk_X509_add1_certs(STACK_OF(X509) *sk, STACK_OF(X509) *certs, + int no_self_signed, int no_dups, int prepend) +/* compiler would allow 'const' for the list of certs, yet they are up-ref'ed */ +{ + int i; + + if (sk == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + for (i = 0; i < sk_X509_num(certs); i++) { /* certs may be NULL */ + X509 *cert = sk_X509_value(certs, i); + + if (!no_self_signed || X509_check_issued(cert, cert) != X509_V_OK) { + if (!ossl_cmp_sk_X509_add1_cert(sk, cert, no_dups, prepend)) + return 0; + } + } + return 1; +} + +int ossl_cmp_X509_STORE_add1_certs(X509_STORE *store, STACK_OF(X509) *certs, + int only_self_signed) +{ + int i; + + if (store == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + if (certs == NULL) + return 1; + for (i = 0; i < sk_X509_num(certs); i++) { + X509 *cert = sk_X509_value(certs, i); + + if (!only_self_signed || X509_check_issued(cert, cert) == X509_V_OK) + if (!X509_STORE_add_cert(store, cert)) /* ups cert ref counter */ + return 0; + } + return 1; +} + +STACK_OF(X509) *ossl_cmp_X509_STORE_get1_certs(X509_STORE *store) +{ + int i; + STACK_OF(X509) *sk; + STACK_OF(X509_OBJECT) *objs; + + if (store == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + if ((sk = sk_X509_new_null()) == NULL) + return NULL; + objs = X509_STORE_get0_objects(store); + for (i = 0; i < sk_X509_OBJECT_num(objs); i++) { + X509 *cert = X509_OBJECT_get0_X509(sk_X509_OBJECT_value(objs, i)); + + if (cert != NULL) { + if (!sk_X509_push(sk, cert)) + goto err; + if (!X509_up_ref(cert)) { + (void)sk_X509_pop(sk); + goto err; + } + } + } + return sk; + + err: + sk_X509_pop_free(sk, X509_free); + return NULL; +} + +/*- + * Builds up the certificate chain of certs as high up as possible using + * the given list of certs containing all possible intermediate certificates and + * optionally the (possible) trust anchor(s). See also ssl_add_cert_chain(). + * + * Intended use of this function is to find all the certificates above the trust + * anchor needed to verify an EE's own certificate. Those are supposed to be + * included in the ExtraCerts field of every first sent message of a transaction + * when MSG_SIG_ALG is utilized. + * + * NOTE: This allocates a stack and increments the reference count of each cert, + * so when not needed any more the stack and all its elements should be freed. + * NOTE: in case there is more than one possibility for the chain, + * OpenSSL seems to take the first one, check X509_verify_cert() for details. + * + * returns a pointer to a stack of (up_ref'ed) X509 certificates containing: + * - the EE certificate given in the function arguments (cert) + * - all intermediate certificates up the chain toward the trust anchor + * whereas the (self-signed) trust anchor is not included + * returns NULL on error + */ +STACK_OF(X509) *ossl_cmp_build_cert_chain(STACK_OF(X509) *certs, X509 *cert) +{ + STACK_OF(X509) *chain = NULL, *result = NULL; + X509_STORE *store = X509_STORE_new(); + X509_STORE_CTX *csc = NULL; + + if (certs == NULL || cert == NULL || store == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + goto err; + } + + csc = X509_STORE_CTX_new(); + if (csc == NULL) + goto err; + + if (!ossl_cmp_X509_STORE_add1_certs(store, certs, 0) + || !X509_STORE_CTX_init(csc, store, cert, NULL)) + goto err; + + (void)ERR_set_mark(); + /* + * ignore return value as it would fail without trust anchor given in store + */ + (void)X509_verify_cert(csc); + + /* don't leave any new errors in the queue */ + (void)ERR_pop_to_mark(); + + chain = X509_STORE_CTX_get0_chain(csc); + + /* result list to store the up_ref'ed not self-signed certificates */ + if ((result = sk_X509_new_null()) == NULL) + goto err; + if (!ossl_cmp_sk_X509_add1_certs(result, chain, 1 /* no self-signed */, + 1 /* no duplicates */, 0)) { + sk_X509_free(result); + result = NULL; + } + + err: + X509_STORE_free(store); + X509_STORE_CTX_free(csc); + return result; +} + +int ossl_cmp_asn1_octet_string_set1(ASN1_OCTET_STRING **tgt, + const ASN1_OCTET_STRING *src) +{ + if (tgt == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + if (*tgt == src) /* self-assignment */ + return 1; + ASN1_OCTET_STRING_free(*tgt); + + if (src != NULL) { + if ((*tgt = ASN1_OCTET_STRING_dup(src)) == NULL) + return 0; + } else { + *tgt = NULL; + } + + return 1; +} + +int ossl_cmp_asn1_octet_string_set1_bytes(ASN1_OCTET_STRING **tgt, + const unsigned char *bytes, int len) +{ + ASN1_OCTET_STRING *new = NULL; + + if (tgt == NULL) { + CMPerr(0, CMP_R_NULL_ARGUMENT); + return 0; + } + if (bytes != NULL) { + if ((new = ASN1_OCTET_STRING_new()) == NULL + || !(ASN1_OCTET_STRING_set(new, bytes, len))) { + ASN1_OCTET_STRING_free(new); + return 0; + } + } + + ASN1_OCTET_STRING_free(*tgt); + *tgt = new; + return 1; +} diff --git a/crypto/cms/cms_asn1.c b/crypto/cms/cms_asn1.c index 64d5d3b1..082885dc 100644 --- a/crypto/cms/cms_asn1.c +++ b/crypto/cms/cms_asn1.c @@ -11,7 +11,7 @@ #include #include #include -#include "cms_lcl.h" +#include "cms_local.h" ASN1_SEQUENCE(CMS_IssuerAndSerialNumber) = { diff --git a/crypto/cms/cms_att.c b/crypto/cms/cms_att.c index e5481805..2c8138f1 100644 --- a/crypto/cms/cms_att.c +++ b/crypto/cms/cms_att.c @@ -12,7 +12,7 @@ #include #include #include -#include "cms_lcl.h" +#include "cms_local.h" #include "internal/nelem.h" /*- diff --git a/crypto/cms/cms_cd.c b/crypto/cms/cms_cd.c index 5a11928e..ac40275b 100644 --- a/crypto/cms/cms_cd.c +++ b/crypto/cms/cms_cd.c @@ -15,7 +15,7 @@ #include #include #include -#include "cms_lcl.h" +#include "cms_local.h" #ifdef ZLIB diff --git a/crypto/cms/cms_dd.c b/crypto/cms/cms_dd.c index 8bdbdfde..9da26476 100644 --- a/crypto/cms/cms_dd.c +++ b/crypto/cms/cms_dd.c @@ -13,7 +13,7 @@ #include #include #include -#include "cms_lcl.h" +#include "cms_local.h" /* CMS DigestedData Utilities */ diff --git a/crypto/cms/cms_enc.c b/crypto/cms/cms_enc.c index d3a087b3..3a17a279 100644 --- a/crypto/cms/cms_enc.c +++ b/crypto/cms/cms_enc.c @@ -14,7 +14,7 @@ #include #include #include -#include "cms_lcl.h" +#include "cms_local.h" /* CMS EncryptedData Utilities */ diff --git a/crypto/cms/cms_env.c b/crypto/cms/cms_env.c index 27e98ce0..ecece987 100644 --- a/crypto/cms/cms_env.c +++ b/crypto/cms/cms_env.c @@ -14,9 +14,9 @@ #include #include #include -#include "cms_lcl.h" -#include "internal/asn1_int.h" -#include "internal/evp_int.h" +#include "cms_local.h" +#include "crypto/asn1.h" +#include "crypto/evp.h" /* CMS EnvelopedData Utilities */ @@ -56,14 +56,15 @@ int cms_env_asn1_ctrl(CMS_RecipientInfo *ri, int cmd) pkey = ri->d.ktri->pkey; else if (ri->type == CMS_RECIPINFO_AGREE) { EVP_PKEY_CTX *pctx = ri->d.kari->pctx; - if (!pctx) + + if (pctx == NULL) return 0; pkey = EVP_PKEY_CTX_get0_pkey(pctx); - if (!pkey) + if (pkey == NULL) return 0; } else return 0; - if (!pkey->ameth || !pkey->ameth->pkey_ctrl) + if (pkey->ameth == NULL || pkey->ameth->pkey_ctrl == NULL) return 1; i = pkey->ameth->pkey_ctrl(pkey, ASN1_PKEY_CTRL_CMS_ENVELOPE, cmd, ri); if (i == -2) { @@ -191,7 +192,7 @@ CMS_RecipientInfo *CMS_add1_recipient_cert(CMS_ContentInfo *cms, goto merr; pk = X509_get0_pubkey(recip); - if (!pk) { + if (pk == NULL) { CMSerr(CMS_F_CMS_ADD1_RECIPIENT_CERT, CMS_R_ERROR_GETTING_PUBLIC_KEY); goto err; } diff --git a/crypto/cms/cms_ess.c b/crypto/cms/cms_ess.c index 8f80f6ba..00a08aaf 100644 --- a/crypto/cms/cms_ess.c +++ b/crypto/cms/cms_ess.c @@ -15,9 +15,9 @@ #include #include #include -#include "cms_lcl.h" -#include "internal/ess_int.h" -#include "internal/cms_int.h" +#include "cms_local.h" +#include "crypto/ess.h" +#include "crypto/cms.h" IMPLEMENT_ASN1_FUNCTIONS(CMS_ReceiptRequest) @@ -202,7 +202,7 @@ int cms_Receipt_verify(CMS_ContentInfo *cms, CMS_ContentInfo *req_cms) /* Extract and decode receipt content */ pcont = CMS_get0_content(cms); - if (!pcont || !*pcont) { + if (pcont == NULL || *pcont == NULL) { CMSerr(CMS_F_CMS_RECEIPT_VERIFY, CMS_R_NO_CONTENT); goto err; } diff --git a/crypto/cms/cms_io.c b/crypto/cms/cms_io.c index f3b58740..06c5a1bb 100644 --- a/crypto/cms/cms_io.c +++ b/crypto/cms/cms_io.c @@ -12,7 +12,7 @@ #include #include #include -#include "cms_lcl.h" +#include "cms_local.h" /* unfortunately cannot constify BIO_new_NDEF() due to this and PKCS7_stream() */ int CMS_stream(unsigned char ***boundary, CMS_ContentInfo *cms) diff --git a/crypto/cms/cms_kari.c b/crypto/cms/cms_kari.c index 866749a1..6b0a59eb 100644 --- a/crypto/cms/cms_kari.c +++ b/crypto/cms/cms_kari.c @@ -14,8 +14,8 @@ #include #include #include -#include "cms_lcl.h" -#include "internal/asn1_int.h" +#include "cms_local.h" +#include "crypto/asn1.h" /* Key Agreement Recipient Info (KARI) routines */ @@ -159,10 +159,10 @@ int CMS_RecipientInfo_kari_set0_pkey(CMS_RecipientInfo *ri, EVP_PKEY *pk) EVP_PKEY_CTX_free(kari->pctx); kari->pctx = NULL; - if (!pk) + if (pk == NULL) return 1; pctx = EVP_PKEY_CTX_new(pk, NULL); - if (!pctx || !EVP_PKEY_derive_init(pctx)) + if (pctx == NULL || EVP_PKEY_derive_init(pctx) <= 0) goto err; kari->pctx = pctx; return 1; @@ -260,8 +260,9 @@ static int cms_kari_create_ephemeral_key(CMS_KeyAgreeRecipientInfo *kari, EVP_PKEY_CTX *pctx = NULL; EVP_PKEY *ekey = NULL; int rv = 0; + pctx = EVP_PKEY_CTX_new(pk, NULL); - if (!pctx) + if (pctx == NULL) goto err; if (EVP_PKEY_keygen_init(pctx) <= 0) goto err; @@ -269,7 +270,7 @@ static int cms_kari_create_ephemeral_key(CMS_KeyAgreeRecipientInfo *kari, goto err; EVP_PKEY_CTX_free(pctx); pctx = EVP_PKEY_CTX_new(ekey, NULL); - if (!pctx) + if (pctx == NULL) goto err; if (EVP_PKEY_derive_init(pctx) <= 0) goto err; diff --git a/crypto/cms/cms_lib.c b/crypto/cms/cms_lib.c index 29eacce2..245544e3 100644 --- a/crypto/cms/cms_lib.c +++ b/crypto/cms/cms_lib.c @@ -14,7 +14,7 @@ #include #include #include -#include "cms_lcl.h" +#include "cms_local.h" IMPLEMENT_ASN1_FUNCTIONS(CMS_ContentInfo) IMPLEMENT_ASN1_PRINT_FUNCTION(CMS_ContentInfo) @@ -39,15 +39,16 @@ CMS_ContentInfo *cms_Data_create(void) BIO *cms_content_bio(CMS_ContentInfo *cms) { ASN1_OCTET_STRING **pos = CMS_get0_content(cms); - if (!pos) + + if (pos == NULL) return NULL; /* If content detached data goes nowhere: create NULL BIO */ - if (!*pos) + if (*pos == NULL) return BIO_new(BIO_s_null()); /* * If content not detached and created return memory BIO */ - if (!*pos || ((*pos)->flags == ASN1_STRING_FLAG_CONT)) + if (*pos == NULL || ((*pos)->flags == ASN1_STRING_FLAG_CONT)) return BIO_new(BIO_s_mem()); /* Else content was read in: return read only BIO for it */ return BIO_new_mem_buf((*pos)->data, (*pos)->length); @@ -108,7 +109,8 @@ BIO *CMS_dataInit(CMS_ContentInfo *cms, BIO *icont) int CMS_dataFinal(CMS_ContentInfo *cms, BIO *cmsbio) { ASN1_OCTET_STRING **pos = CMS_get0_content(cms); - if (!pos) + + if (pos == NULL) return 0; /* If embedded content find memory BIO and set content */ if (*pos && ((*pos)->flags & ASN1_STRING_FLAG_CONT)) { @@ -234,13 +236,14 @@ const ASN1_OBJECT *CMS_get0_eContentType(CMS_ContentInfo *cms) int CMS_set1_eContentType(CMS_ContentInfo *cms, const ASN1_OBJECT *oid) { ASN1_OBJECT **petype, *etype; + petype = cms_get0_econtent_type(cms); - if (!petype) + if (petype == NULL) return 0; - if (!oid) + if (oid == NULL) return 1; etype = OBJ_dup(oid); - if (!etype) + if (etype == NULL) return 0; ASN1_OBJECT_free(*petype); *petype = etype; @@ -250,10 +253,11 @@ int CMS_set1_eContentType(CMS_ContentInfo *cms, const ASN1_OBJECT *oid) int CMS_is_detached(CMS_ContentInfo *cms) { ASN1_OCTET_STRING **pos; + pos = CMS_get0_content(cms); - if (!pos) + if (pos == NULL) return -1; - if (*pos) + if (*pos != NULL) return 0; return 1; } @@ -261,8 +265,9 @@ int CMS_is_detached(CMS_ContentInfo *cms) int CMS_set_detached(CMS_ContentInfo *cms, int detached) { ASN1_OCTET_STRING **pos; + pos = CMS_get0_content(cms); - if (!pos) + if (pos == NULL) return 0; if (detached) { ASN1_OCTET_STRING_free(*pos); @@ -362,12 +367,13 @@ CMS_CertificateChoices *CMS_add0_CertificateChoices(CMS_ContentInfo *cms) { STACK_OF(CMS_CertificateChoices) **pcerts; CMS_CertificateChoices *cch; + pcerts = cms_get0_certificate_choices(cms); - if (!pcerts) + if (pcerts == NULL) return NULL; - if (!*pcerts) + if (*pcerts == NULL) *pcerts = sk_CMS_CertificateChoices_new_null(); - if (!*pcerts) + if (*pcerts == NULL) return NULL; cch = M_ASN1_new_of(CMS_CertificateChoices); if (!cch) @@ -384,8 +390,9 @@ int CMS_add0_cert(CMS_ContentInfo *cms, X509 *cert) CMS_CertificateChoices *cch; STACK_OF(CMS_CertificateChoices) **pcerts; int i; + pcerts = cms_get0_certificate_choices(cms); - if (!pcerts) + if (pcerts == NULL) return 0; for (i = 0; i < sk_CMS_CertificateChoices_num(*pcerts); i++) { cch = sk_CMS_CertificateChoices_value(*pcerts, i); @@ -439,15 +446,16 @@ CMS_RevocationInfoChoice *CMS_add0_RevocationInfoChoice(CMS_ContentInfo *cms) { STACK_OF(CMS_RevocationInfoChoice) **pcrls; CMS_RevocationInfoChoice *rch; + pcrls = cms_get0_revocation_choices(cms); - if (!pcrls) + if (pcrls == NULL) return NULL; - if (!*pcrls) + if (*pcrls == NULL) *pcrls = sk_CMS_RevocationInfoChoice_new_null(); - if (!*pcrls) + if (*pcrls == NULL) return NULL; rch = M_ASN1_new_of(CMS_RevocationInfoChoice); - if (!rch) + if (rch == NULL) return NULL; if (!sk_CMS_RevocationInfoChoice_push(*pcrls, rch)) { M_ASN1_free_of(rch, CMS_RevocationInfoChoice); @@ -482,8 +490,9 @@ STACK_OF(X509) *CMS_get1_certs(CMS_ContentInfo *cms) CMS_CertificateChoices *cch; STACK_OF(CMS_CertificateChoices) **pcerts; int i; + pcerts = cms_get0_certificate_choices(cms); - if (!pcerts) + if (pcerts == NULL) return NULL; for (i = 0; i < sk_CMS_CertificateChoices_num(*pcerts); i++) { cch = sk_CMS_CertificateChoices_value(*pcerts, i); @@ -510,8 +519,9 @@ STACK_OF(X509_CRL) *CMS_get1_crls(CMS_ContentInfo *cms) STACK_OF(CMS_RevocationInfoChoice) **pcrls; CMS_RevocationInfoChoice *rch; int i; + pcrls = cms_get0_revocation_choices(cms); - if (!pcrls) + if (pcrls == NULL) return NULL; for (i = 0; i < sk_CMS_RevocationInfoChoice_num(*pcrls); i++) { rch = sk_CMS_RevocationInfoChoice_value(*pcrls, i); diff --git a/crypto/cms/cms_lcl.h b/crypto/cms/cms_local.h similarity index 99% rename from crypto/cms/cms_lcl.h rename to crypto/cms/cms_local.h index 40d9c4bb..6cb31955 100644 --- a/crypto/cms/cms_lcl.h +++ b/crypto/cms/cms_local.h @@ -7,8 +7,8 @@ * https://www.openssl.org/source/license.html */ -#ifndef HEADER_CMS_LCL_H -# define HEADER_CMS_LCL_H +#ifndef OSSL_CRYPTO_CMS_LOCAL_H +# define OSSL_CRYPTO_CMS_LOCAL_H # include diff --git a/crypto/cms/cms_pwri.c b/crypto/cms/cms_pwri.c index f0502a45..a4c32dcd 100644 --- a/crypto/cms/cms_pwri.c +++ b/crypto/cms/cms_pwri.c @@ -15,8 +15,8 @@ #include #include #include -#include "cms_lcl.h" -#include "internal/asn1_int.h" +#include "cms_local.h" +#include "crypto/asn1.h" int CMS_RecipientInfo_set0_password(CMS_RecipientInfo *ri, unsigned char *pass, ossl_ssize_t passlen) @@ -146,7 +146,7 @@ CMS_RecipientInfo *CMS_add0_recipient_password(CMS_ContentInfo *cms, pwri->keyDerivationAlgorithm = PKCS5_pbkdf2_set(iter, NULL, 0, -1, -1); - if (!pwri->keyDerivationAlgorithm) + if (pwri->keyDerivationAlgorithm == NULL) goto err; CMS_RecipientInfo_set0_password(ri, pass, passlen); @@ -289,7 +289,7 @@ int cms_RecipientInfo_pwri_crypt(const CMS_ContentInfo *cms, CMS_RecipientInfo * pwri = ri->d.pwri; - if (!pwri->pass) { + if (pwri->pass == NULL) { CMSerr(CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT, CMS_R_NO_PASSWORD); return 0; } diff --git a/crypto/cms/cms_sd.c b/crypto/cms/cms_sd.c index 6715e84d..4a40226c 100644 --- a/crypto/cms/cms_sd.c +++ b/crypto/cms/cms_sd.c @@ -15,11 +15,11 @@ #include #include #include -#include "cms_lcl.h" -#include "internal/asn1_int.h" -#include "internal/evp_int.h" -#include "internal/cms_int.h" -#include "internal/ess_int.h" +#include "cms_local.h" +#include "crypto/asn1.h" +#include "crypto/evp.h" +#include "crypto/cms.h" +#include "crypto/ess.h" /* CMS SignedData Utilities */ @@ -227,7 +227,7 @@ static int cms_sd_asn1_ctrl(CMS_SignerInfo *si, int cmd) { EVP_PKEY *pkey = si->pkey; int i; - if (!pkey->ameth || !pkey->ameth->pkey_ctrl) + if (pkey->ameth == NULL || pkey->ameth->pkey_ctrl == NULL) return 1; i = pkey->ameth->pkey_ctrl(pkey, ASN1_PKEY_CTRL_CMS_SIGN, cmd, si); if (i == -2) { diff --git a/crypto/cms/cms_smime.c b/crypto/cms/cms_smime.c index ae95ff2d..4ae85c03 100644 --- a/crypto/cms/cms_smime.c +++ b/crypto/cms/cms_smime.c @@ -13,8 +13,8 @@ #include #include #include -#include "cms_lcl.h" -#include "internal/asn1_int.h" +#include "cms_local.h" +#include "crypto/asn1.h" static BIO *cms_get_text_bio(BIO *out, unsigned int flags) { @@ -78,7 +78,8 @@ static int cms_copy_content(BIO *out, BIO *in, unsigned int flags) static int check_content(CMS_ContentInfo *cms) { ASN1_OCTET_STRING **pos = CMS_get0_content(cms); - if (!pos || !*pos) { + + if (pos == NULL || *pos == NULL) { CMSerr(CMS_F_CHECK_CONTENT, CMS_R_NO_CONTENT); return 0; } @@ -87,14 +88,13 @@ static int check_content(CMS_ContentInfo *cms) static void do_free_upto(BIO *f, BIO *upto) { - if (upto) { + if (upto != NULL) { BIO *tbio; do { tbio = BIO_pop(f); BIO_free(f); f = tbio; - } - while (f && f != upto); + } while (f != NULL && f != upto); } else BIO_free_all(f); } @@ -488,7 +488,7 @@ CMS_ContentInfo *CMS_sign_receipt(CMS_SignerInfo *si, flags &= ~(CMS_STREAM | CMS_TEXT); /* Not really detached but avoids content being allocated */ flags |= CMS_PARTIAL | CMS_BINARY | CMS_DETACHED; - if (!pkey || !signcert) { + if (pkey == NULL || signcert == NULL) { CMSerr(CMS_F_CMS_SIGN_RECEIPT, CMS_R_NO_KEY_OR_CERT); return NULL; } @@ -733,6 +733,7 @@ int CMS_decrypt(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert, { int r; BIO *cont; + if (OBJ_obj2nid(CMS_get0_type(cms)) != NID_pkcs7_enveloped) { CMSerr(CMS_F_CMS_DECRYPT, CMS_R_TYPE_NOT_ENVELOPED_DATA); return 0; @@ -747,12 +748,12 @@ int CMS_decrypt(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert, cms->d.envelopedData->encryptedContentInfo->havenocert = 1; else cms->d.envelopedData->encryptedContentInfo->havenocert = 0; - if (!pk && !cert && !dcont && !out) + if (pk == NULL && cert == NULL && dcont == NULL && out == NULL) return 1; - if (pk && !CMS_decrypt_set1_pkey(cms, pk, cert)) + if (pk != NULL && !CMS_decrypt_set1_pkey(cms, pk, cert)) return 0; cont = CMS_dataInit(cms, dcont); - if (!cont) + if (cont == NULL) return 0; r = cms_copy_content(out, cont, flags); do_free_upto(cont, dcont); diff --git a/crypto/comp/c_zlib.c b/crypto/comp/c_zlib.c index 1dd7d679..0d84a527 100644 --- a/crypto/comp/c_zlib.c +++ b/crypto/comp/c_zlib.c @@ -13,9 +13,9 @@ #include #include "internal/comp.h" #include -#include "internal/cryptlib_int.h" +#include "crypto/cryptlib.h" #include "internal/bio.h" -#include "comp_lcl.h" +#include "comp_local.h" COMP_METHOD *COMP_zlib(void); diff --git a/crypto/comp/comp_lib.c b/crypto/comp/comp_lib.c index 44f0478e..49195de3 100644 --- a/crypto/comp/comp_lib.c +++ b/crypto/comp/comp_lib.c @@ -13,7 +13,7 @@ #include #include #include -#include "comp_lcl.h" +#include "comp_local.h" COMP_CTX *COMP_CTX_new(COMP_METHOD *meth) { diff --git a/crypto/comp/comp_lcl.h b/crypto/comp/comp_local.h similarity index 100% rename from crypto/comp/comp_lcl.h rename to crypto/comp/comp_local.h diff --git a/crypto/conf/conf_def.c b/crypto/conf/conf_def.c index ff4c43fc..a43225ec 100644 --- a/crypto/conf/conf_def.c +++ b/crypto/conf/conf_def.c @@ -54,7 +54,9 @@ static BIO *get_next_file(const char *path, OPENSSL_DIR_CTX **dirctx); static CONF *def_create(CONF_METHOD *meth); static int def_init_default(CONF *conf); +#if !OPENSSL_API_3 static int def_init_WIN32(CONF *conf); +#endif static int def_destroy(CONF *conf); static int def_destroy_data(CONF *conf); static int def_load(CONF *conf, const char *name, long *eline); @@ -76,6 +78,12 @@ static CONF_METHOD default_method = { def_load }; +CONF_METHOD *NCONF_default(void) +{ + return &default_method; +} + +#if ! OPENSSL_API_3 static CONF_METHOD WIN32_method = { "WIN32", def_create, @@ -89,15 +97,11 @@ static CONF_METHOD WIN32_method = { def_load }; -CONF_METHOD *NCONF_default(void) -{ - return &default_method; -} - CONF_METHOD *NCONF_WIN32(void) { return &WIN32_method; } +#endif static CONF *def_create(CONF_METHOD *meth) { @@ -124,6 +128,7 @@ static int def_init_default(CONF *conf) return 1; } +#if ! OPENSSL_API_3 static int def_init_WIN32(CONF *conf) { if (conf == NULL) @@ -135,6 +140,7 @@ static int def_init_WIN32(CONF *conf) return 1; } +#endif static int def_destroy(CONF *conf) { diff --git a/crypto/conf/conf_def.h b/crypto/conf/conf_def.h index 9b2a3c1b..725c430c 100644 --- a/crypto/conf/conf_def.h +++ b/crypto/conf/conf_def.h @@ -56,6 +56,7 @@ static const unsigned short CONF_type_default[128] = { 0x0004, 0x0004, 0x0004, 0x0000, 0x0200, 0x0000, 0x0200, 0x0000, }; +#if ! OPENSSL_API_3 static const unsigned short CONF_type_win32[128] = { 0x0008, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0010, 0x0010, 0x0000, 0x0000, 0x0010, 0x0000, 0x0000, @@ -74,3 +75,4 @@ static const unsigned short CONF_type_win32[128] = { 0x0004, 0x0004, 0x0004, 0x0004, 0x0004, 0x0004, 0x0004, 0x0004, 0x0004, 0x0004, 0x0004, 0x0000, 0x0200, 0x0000, 0x0200, 0x0000, }; +#endif diff --git a/crypto/conf/conf_lib.c b/crypto/conf/conf_lib.c index 13d061b2..833b7a65 100644 --- a/crypto/conf/conf_lib.c +++ b/crypto/conf/conf_lib.c @@ -11,7 +11,7 @@ #include #include #include "internal/conf.h" -#include "internal/ctype.h" +#include "crypto/ctype.h" #include #include #include diff --git a/crypto/conf/conf_lcl.h b/crypto/conf/conf_local.h similarity index 100% rename from crypto/conf/conf_lcl.h rename to crypto/conf/conf_local.h diff --git a/crypto/conf/conf_mall.c b/crypto/conf/conf_mall.c index 28003a8f..033c1ada 100644 --- a/crypto/conf/conf_mall.c +++ b/crypto/conf/conf_mall.c @@ -15,7 +15,7 @@ #include #include #include "internal/provider.h" -#include "conf_lcl.h" +#include "conf_local.h" /* Load all OpenSSL builtin modules */ diff --git a/crypto/conf/conf_mod.c b/crypto/conf/conf_mod.c index 56b19467..86924c1b 100644 --- a/crypto/conf/conf_mod.c +++ b/crypto/conf/conf_mod.c @@ -198,19 +198,20 @@ static CONF_MODULE *module_load_dso(const CONF *cnf, const char *path = NULL; int errcode = 0; CONF_MODULE *md; + /* Look for alternative path in module section */ path = NCONF_get_string(cnf, value, "path"); - if (!path) { + if (path == NULL) { ERR_clear_error(); path = name; } dso = DSO_load(NULL, path, NULL, 0); - if (!dso) { + if (dso == NULL) { errcode = CONF_R_ERROR_LOADING_DSO; goto err; } ifunc = (conf_init_func *)DSO_bind_func(dso, DSO_mod_init_name); - if (!ifunc) { + if (ifunc == NULL) { errcode = CONF_R_MISSING_INIT_FUNCTION; goto err; } @@ -218,7 +219,7 @@ static CONF_MODULE *module_load_dso(const CONF *cnf, /* All OK, add module */ md = module_add(dso, name, ifunc, ffunc); - if (!md) + if (md == NULL) goto err; return md; @@ -533,7 +534,7 @@ int CONF_parse_list(const char *list_, int sep, int nospc, lstart++; } p = strchr(lstart, sep); - if (p == lstart || !*lstart) + if (p == lstart || *lstart == '\0') ret = list_cb(NULL, 0, arg); else { if (p) diff --git a/crypto/conf/conf_ssl.c b/crypto/conf/conf_ssl.c index d703f736..5855c50c 100644 --- a/crypto/conf/conf_ssl.c +++ b/crypto/conf/conf_ssl.c @@ -12,7 +12,7 @@ #include #include #include "internal/sslconf.h" -#include "conf_lcl.h" +#include "conf_local.h" /* * SSL library configuration module placeholder. We load it here but defer diff --git a/crypto/conf/keysets.pl b/crypto/conf/keysets.pl index 68addbfe..05b086f7 100644 --- a/crypto/conf/keysets.pl +++ b/crypto/conf/keysets.pl @@ -108,9 +108,11 @@ for ($i = 0; $i < 128; $i++) { } print "\n};\n\n"; +print "#if ! OPENSSL_API_3\n"; print "static const unsigned short CONF_type_win32[128] = {"; for ($i = 0; $i < 128; $i++) { print "\n " if ($i % 8) == 0; printf " 0x%04X,", $V_w32[$i]; } print "\n};\n"; +print "#endif\n"; diff --git a/crypto/context.c b/crypto/context.c index a2e19bac..02fecf9f 100644 --- a/crypto/context.c +++ b/crypto/context.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "internal/cryptlib_int.h" +#include "crypto/cryptlib.h" #include "internal/thread_once.h" #include "internal/property.h" diff --git a/crypto/core_algorithm.c b/crypto/core_algorithm.c index f88a0458..2973b376 100644 --- a/crypto/core_algorithm.c +++ b/crypto/core_algorithm.c @@ -44,7 +44,7 @@ static int algorithm_do_this(OSSL_PROVIDER *provider, void *cbdata) break; ok = 1; /* As long as we've found *something* */ - while (map->algorithm_name != NULL) { + while (map->algorithm_names != NULL) { const OSSL_ALGORITHM *thismap = map++; data->fn(provider, thismap, no_store, data->data); diff --git a/crypto/core_fetch.c b/crypto/core_fetch.c index 1e0d82fb..ed50bb87 100644 --- a/crypto/core_fetch.c +++ b/crypto/core_fetch.c @@ -31,7 +31,7 @@ static void ossl_method_construct_this(OSSL_PROVIDER *provider, struct construct_data_st *data = cbdata; void *method = NULL; - if ((method = data->mcm->construct(algo->algorithm_name, + if ((method = data->mcm->construct(algo->algorithm_names, algo->implementation, provider, data->mcm_data)) == NULL) return; @@ -53,12 +53,12 @@ static void ossl_method_construct_this(OSSL_PROVIDER *provider, * add to the global store */ data->mcm->put(data->libctx, NULL, method, provider, - data->operation_id, algo->algorithm_name, + data->operation_id, algo->algorithm_names, algo->property_definition, data->mcm_data); } data->mcm->put(data->libctx, data->store, method, provider, - data->operation_id, algo->algorithm_name, + data->operation_id, algo->algorithm_names, algo->property_definition, data->mcm_data); /* refcnt-- because we're dropping the reference */ diff --git a/crypto/core_namemap.c b/crypto/core_namemap.c index cf5f1e54..71b70ff5 100644 --- a/crypto/core_namemap.c +++ b/crypto/core_namemap.c @@ -10,7 +10,7 @@ #include "e_os.h" /* strcasecmp */ #include "internal/namemap.h" #include -#include "internal/lhash.h" /* openssl_lh_strcasehash */ +#include "crypto/lhash.h" /* openssl_lh_strcasehash */ /*- * The namenum entry @@ -148,7 +148,8 @@ void ossl_namemap_doall_names(const OSSL_NAMEMAP *namemap, int number, CRYPTO_THREAD_unlock(namemap->lock); } -int ossl_namemap_name2num(const OSSL_NAMEMAP *namemap, const char *name) +int ossl_namemap_name2num_n(const OSSL_NAMEMAP *namemap, + const char *name, size_t name_len) { NAMENUM_ENTRY *namenum_entry, namenum_tmpl; int number = 0; @@ -161,7 +162,8 @@ int ossl_namemap_name2num(const OSSL_NAMEMAP *namemap, const char *name) if (namemap == NULL) return 0; - namenum_tmpl.name = (char *)name; + if ((namenum_tmpl.name = OPENSSL_strndup(name, name_len)) == NULL) + return 0; namenum_tmpl.number = 0; CRYPTO_THREAD_read_lock(namemap->lock); namenum_entry = @@ -169,10 +171,19 @@ int ossl_namemap_name2num(const OSSL_NAMEMAP *namemap, const char *name) if (namenum_entry != NULL) number = namenum_entry->number; CRYPTO_THREAD_unlock(namemap->lock); + OPENSSL_free(namenum_tmpl.name); return number; } +int ossl_namemap_name2num(const OSSL_NAMEMAP *namemap, const char *name) +{ + if (name == NULL) + return 0; + + return ossl_namemap_name2num_n(namemap, name, strlen(name)); +} + struct num2name_data_st { size_t idx; /* Countdown */ const char *name; /* Result */ @@ -199,7 +210,8 @@ const char *ossl_namemap_num2name(const OSSL_NAMEMAP *namemap, int number, return data.name; } -int ossl_namemap_add(OSSL_NAMEMAP *namemap, int number, const char *name) +int ossl_namemap_add_n(OSSL_NAMEMAP *namemap, int number, + const char *name, size_t name_len) { NAMENUM_ENTRY *namenum = NULL; int tmp_number; @@ -209,16 +221,16 @@ int ossl_namemap_add(OSSL_NAMEMAP *namemap, int number, const char *name) namemap = ossl_namemap_stored(NULL); #endif - if (name == NULL || namemap == NULL) + if (name == NULL || name_len == 0 || namemap == NULL) return 0; - if ((tmp_number = ossl_namemap_name2num(namemap, name)) != 0) + if ((tmp_number = ossl_namemap_name2num_n(namemap, name, name_len)) != 0) return tmp_number; /* Pretend success */ CRYPTO_THREAD_write_lock(namemap->lock); if ((namenum = OPENSSL_zalloc(sizeof(*namenum))) == NULL - || (namenum->name = OPENSSL_strdup(name)) == NULL) + || (namenum->name = OPENSSL_strndup(name, name_len)) == NULL) goto err; namenum->number = tmp_number = @@ -238,3 +250,11 @@ int ossl_namemap_add(OSSL_NAMEMAP *namemap, int number, const char *name) CRYPTO_THREAD_unlock(namemap->lock); return 0; } + +int ossl_namemap_add(OSSL_NAMEMAP *namemap, int number, const char *name) +{ + if (name == NULL) + return 0; + + return ossl_namemap_add_n(namemap, number, name, strlen(name)); +} diff --git a/crypto/crmf/crmf_asn.c b/crypto/crmf/crmf_asn.c index 05442c2c..43801567 100644 --- a/crypto/crmf/crmf_asn.c +++ b/crypto/crmf/crmf_asn.c @@ -13,7 +13,7 @@ #include -#include "crmf_int.h" +#include "crmf_local.h" /* explicit #includes not strictly needed since implied by the above: */ #include diff --git a/crypto/crmf/crmf_lib.c b/crypto/crmf/crmf_lib.c index 29743414..6ba3f7ab 100644 --- a/crypto/crmf/crmf_lib.c +++ b/crypto/crmf/crmf_lib.c @@ -28,8 +28,8 @@ #include -#include "crmf_int.h" -#include "internal/constant_time_locl.h" +#include "crmf_local.h" +#include "internal/constant_time.h" /* explicit #includes not strictly needed since implied by the above: */ #include @@ -82,16 +82,14 @@ static int OSSL_CRMF_MSG_push0_regCtrl(OSSL_CRMF_MSG *crm, if (crm->certReq->controls == NULL) { crm->certReq->controls = sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_new_null(); if (crm->certReq->controls == NULL) - goto oom; + goto err; new = 1; } if (!sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_push(crm->certReq->controls, ctrl)) - goto oom; + goto err; return 1; - oom: - CRMFerr(CRMF_F_OSSL_CRMF_MSG_PUSH0_REGCTRL, ERR_R_MALLOC_FAILURE); - + err: if (new != 0) { sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_free(crm->certReq->controls); crm->certReq->controls = NULL; @@ -136,16 +134,9 @@ int OSSL_CRMF_MSG_PKIPublicationInfo_push0_SinglePubInfo( if (pi->pubInfos == NULL) pi->pubInfos = sk_OSSL_CRMF_SINGLEPUBINFO_new_null(); if (pi->pubInfos == NULL) - goto oom; + return 0; - if (!sk_OSSL_CRMF_SINGLEPUBINFO_push(pi->pubInfos, spi)) - goto oom; - return 1; - - oom: - CRMFerr(CRMF_F_OSSL_CRMF_MSG_PKIPUBLICATIONINFO_PUSH0_SINGLEPUBINFO, - ERR_R_MALLOC_FAILURE); - return 0; + return sk_OSSL_CRMF_SINGLEPUBINFO_push(pi->pubInfos, spi); } int OSSL_CRMF_MSG_set_PKIPublicationInfo_action( @@ -180,20 +171,19 @@ OSSL_CRMF_CERTID *OSSL_CRMF_CERTID_gen(const X509_NAME *issuer, } if ((cid = OSSL_CRMF_CERTID_new()) == NULL) - goto oom; + goto err; if (!X509_NAME_set(&cid->issuer->d.directoryName, issuer)) - goto oom; + goto err; cid->issuer->type = GEN_DIRNAME; ASN1_INTEGER_free(cid->serialNumber); if ((cid->serialNumber = ASN1_INTEGER_dup(serial)) == NULL) - goto oom; + goto err; return cid; - oom: - CRMFerr(CRMF_F_OSSL_CRMF_CERTID_GEN, ERR_R_MALLOC_FAILURE); + err: OSSL_CRMF_CERTID_free(cid); return NULL; } @@ -222,13 +212,12 @@ static int OSSL_CRMF_MSG_push0_regInfo(OSSL_CRMF_MSG *crm, if (crm->regInfo == NULL) crm->regInfo = info = sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_new_null(); if (crm->regInfo == NULL) - goto oom; + goto err; if (!sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_push(crm->regInfo, ri)) - goto oom; + goto err; return 1; - oom: - CRMFerr(CRMF_F_OSSL_CRMF_MSG_PUSH0_REGINFO, ERR_R_MALLOC_FAILURE); + err: if (info != NULL) crm->regInfo = NULL; sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_free(info); @@ -266,11 +255,11 @@ int OSSL_CRMF_MSG_set_validity(OSSL_CRMF_MSG *crm, time_t from, time_t to) } if (from != 0 && ((from_asn = ASN1_TIME_set(NULL, from)) == NULL)) - goto oom; + goto err; if (to != 0 && ((to_asn = ASN1_TIME_set(NULL, to)) == NULL)) - goto oom; + goto err; if ((vld = OSSL_CRMF_OPTIONALVALIDITY_new()) == NULL) - goto oom; + goto err; vld->notBefore = from_asn; vld->notAfter = to_asn; @@ -278,8 +267,7 @@ int OSSL_CRMF_MSG_set_validity(OSSL_CRMF_MSG *crm, time_t from, time_t to) tmpl->validity = vld; return 1; - oom: - CRMFerr(CRMF_F_OSSL_CRMF_MSG_SET_VALIDITY, ERR_R_MALLOC_FAILURE); + err: ASN1_TIME_free(from_asn); ASN1_TIME_free(to_asn); return 0; @@ -348,7 +336,7 @@ int OSSL_CRMF_MSG_set0_extensions(OSSL_CRMF_MSG *crm, int OSSL_CRMF_MSG_push0_extension(OSSL_CRMF_MSG *crm, - const X509_EXTENSION *ext) + X509_EXTENSION *ext) { int new = 0; OSSL_CRMF_CERTTEMPLATE *tmpl = OSSL_CRMF_MSG_get0_tmpl(crm); @@ -360,16 +348,14 @@ int OSSL_CRMF_MSG_push0_extension(OSSL_CRMF_MSG *crm, if (tmpl->extensions == NULL) { if ((tmpl->extensions = sk_X509_EXTENSION_new_null()) == NULL) - goto oom; + goto err; new = 1; } - if (!sk_X509_EXTENSION_push(tmpl->extensions, (X509_EXTENSION *)ext)) - goto oom; + if (!sk_X509_EXTENSION_push(tmpl->extensions, ext)) + goto err; return 1; - oom: - CRMFerr(CRMF_F_OSSL_CRMF_MSG_PUSH0_EXTENSION, ERR_R_MALLOC_FAILURE); - + err: if (new != 0) { sk_X509_EXTENSION_free(tmpl->extensions); tmpl->extensions = NULL; @@ -428,10 +414,8 @@ static int CRMF_poposigningkey_init(OSSL_CRMF_POPOSIGNINGKEY *ps, CRMFerr(CRMF_F_CRMF_POPOSIGNINGKEY_INIT, CRMF_R_ERROR); goto err; } - if ((sig = OPENSSL_malloc(siglen)) == NULL) { - CRMFerr(CRMF_F_CRMF_POPOSIGNINGKEY_INIT, ERR_R_MALLOC_FAILURE); + if ((sig = OPENSSL_malloc(siglen)) == NULL) goto err; - } if (EVP_DigestSignFinal(ctx, sig, &siglen) <= 0 || !ASN1_BIT_STRING_set(ps->signature, sig, siglen)) { CRMFerr(CRMF_F_CRMF_POPOSIGNINGKEY_INIT, CRMF_R_ERROR); @@ -461,13 +445,13 @@ int OSSL_CRMF_MSG_create_popo(OSSL_CRMF_MSG *crm, EVP_PKEY *pkey, if (ppmtd == OSSL_CRMF_POPO_NONE) goto end; if ((pp = OSSL_CRMF_POPO_new()) == NULL) - goto oom; + goto err; pp->type = ppmtd; switch (ppmtd) { case OSSL_CRMF_POPO_RAVERIFIED: if ((pp->value.raVerified = ASN1_NULL_new()) == NULL) - goto oom; + goto err; break; case OSSL_CRMF_POPO_SIGNATURE: @@ -484,14 +468,14 @@ int OSSL_CRMF_MSG_create_popo(OSSL_CRMF_MSG *crm, EVP_PKEY *pkey, case OSSL_CRMF_POPO_KEYENC: if ((pp->value.keyEncipherment = OSSL_CRMF_POPOPRIVKEY_new()) == NULL) - goto oom; + goto err; tag = ASN1_INTEGER_new(); pp->value.keyEncipherment->type = OSSL_CRMF_POPOPRIVKEY_SUBSEQUENTMESSAGE; pp->value.keyEncipherment->value.subsequentMessage = tag; if (tag == NULL || !ASN1_INTEGER_set(tag, OSSL_CRMF_SUBSEQUENTMESSAGE_ENCRCERT)) - goto oom; + goto err; break; default: @@ -505,8 +489,6 @@ int OSSL_CRMF_MSG_create_popo(OSSL_CRMF_MSG *crm, EVP_PKEY *pkey, crm->popo = pp; return 1; - oom: - CRMFerr(CRMF_F_OSSL_CRMF_MSG_CREATE_POPO, ERR_R_MALLOC_FAILURE); err: OSSL_CRMF_POPO_free(pp); return 0; @@ -609,7 +591,20 @@ X509_NAME *OSSL_CRMF_CERTTEMPLATE_get0_issuer(OSSL_CRMF_CERTTEMPLATE *tmpl) return tmpl != NULL ? tmpl->issuer : NULL; } -/* +/* retrieves the issuer name of the given CertId or NULL on error */ +X509_NAME *OSSL_CRMF_CERTID_get0_issuer(const OSSL_CRMF_CERTID *cid) +{ + return cid != NULL && cid->issuer->type == GEN_DIRNAME ? + cid->issuer->d.directoryName : NULL; +} + +/* retrieves the serialNumber of the given CertId or NULL on error */ +ASN1_INTEGER *OSSL_CRMF_CERTID_get0_serialNumber(const OSSL_CRMF_CERTID *cid) +{ + return cid != NULL ? cid->serialNumber : NULL; +} + +/*- * fill in certificate template. * Any value argument that is NULL will leave the respective field unchanged. */ @@ -624,27 +619,23 @@ int OSSL_CRMF_CERTTEMPLATE_fill(OSSL_CRMF_CERTTEMPLATE *tmpl, return 0; } if (subject != NULL && !X509_NAME_set(&tmpl->subject, subject)) - goto oom; + return 0; if (issuer != NULL && !X509_NAME_set(&tmpl->issuer, issuer)) - goto oom; + return 0; if (serial != NULL) { ASN1_INTEGER_free(tmpl->serialNumber); if ((tmpl->serialNumber = ASN1_INTEGER_dup(serial)) == NULL) - goto oom; + return 0; } if (pubkey != NULL && !X509_PUBKEY_set(&tmpl->publicKey, pubkey)) - goto oom; + return 0; return 1; - - oom: - CRMFerr(CRMF_F_OSSL_CRMF_CERTTEMPLATE_FILL, ERR_R_MALLOC_FAILURE); - return 0; } /*- - * Decrypts the certificate in the given encryptedValue - * this is needed for the indirect PoP method as in RFC 4210 section 5.2.8.2 + * Decrypts the certificate in the given encryptedValue using private key pkey. + * This is needed for the indirect PoP method as in RFC 4210 section 5.2.8.2. * * returns a pointer to the decrypted certificate * returns NULL on error or if no certificate available @@ -693,7 +684,7 @@ X509 *OSSL_CRMF_ENCRYPTEDVALUE_get1_encCert(OSSL_CRMF_ENCRYPTEDVALUE *ecert, if (EVP_PKEY_decrypt(pkctx, NULL, &eksize, encKey->data, encKey->length) <= 0 || (ek = OPENSSL_malloc(eksize)) == NULL) - goto oom; + goto end; retval = EVP_PKEY_decrypt(pkctx, ek, &eksize, encKey->data, encKey->length); ERR_clear_error(); /* error state may have sensitive information */ @@ -706,10 +697,10 @@ X509 *OSSL_CRMF_ENCRYPTEDVALUE_get1_encCert(OSSL_CRMF_ENCRYPTEDVALUE *ecert, goto end; } } else { - goto oom; + goto end; } if ((iv = OPENSSL_malloc(EVP_CIPHER_iv_length(cipher))) == NULL) - goto oom; + goto end; if (ASN1_TYPE_get_octetstring(ecert->symmAlg->parameter, iv, EVP_CIPHER_iv_length(cipher)) != EVP_CIPHER_iv_length(cipher)) { @@ -725,7 +716,7 @@ X509 *OSSL_CRMF_ENCRYPTEDVALUE_get1_encCert(OSSL_CRMF_ENCRYPTEDVALUE *ecert, if ((p = outbuf = OPENSSL_malloc(ecert->encValue->length + EVP_CIPHER_block_size(cipher))) == NULL || (evp_ctx = EVP_CIPHER_CTX_new()) == NULL) - goto oom; + goto end; EVP_CIPHER_CTX_set_padding(evp_ctx, 0); if (!EVP_DecryptInit(evp_ctx, cipher, ek, iv) @@ -744,10 +735,6 @@ X509 *OSSL_CRMF_ENCRYPTEDVALUE_get1_encCert(OSSL_CRMF_ENCRYPTEDVALUE *ecert, CRMFerr(CRMF_F_OSSL_CRMF_ENCRYPTEDVALUE_GET1_ENCCERT, CRMF_R_ERROR_DECODING_CERTIFICATE); } - goto end; - - oom: - CRMFerr(CRMF_F_OSSL_CRMF_ENCRYPTEDVALUE_GET1_ENCCERT, ERR_R_MALLOC_FAILURE); end: EVP_PKEY_CTX_free(pkctx); OPENSSL_free(outbuf); diff --git a/crypto/crmf/crmf_int.h b/crypto/crmf/crmf_local.h similarity index 93% rename from crypto/crmf/crmf_int.h rename to crypto/crmf/crmf_local.h index b7620578..577187f5 100644 --- a/crypto/crmf/crmf_int.h +++ b/crypto/crmf/crmf_local.h @@ -11,14 +11,14 @@ * CRMF implementation by Martin Peylo, Miikka Viljanen, and David von Oheimb. */ -#ifndef OSSL_HEADER_CRMF_INT_H -# define OSSL_HEADER_CRMF_INT_H +#ifndef OSSL_CRYPTO_CRMF_LOCAL_H +# define OSSL_CRYPTO_CRMF_LOCAL_H # include # include /* explicit #includes not strictly needed since implied by the above: */ -# include +# include # include # include # include @@ -42,7 +42,7 @@ * -- the encrypted value itself * } */ -struct OSSL_crmf_encryptedvalue_st { +struct ossl_crmf_encryptedvalue_st { X509_ALGOR *intendedAlg; /* 0 */ X509_ALGOR *symmAlg; /* 1 */ ASN1_BIT_STRING *encSymmKey; /* 2 */ @@ -62,7 +62,7 @@ struct OSSL_crmf_encryptedvalue_st { * attributes [0] IMPLICIT Attributes OPTIONAL * } */ -typedef struct OSSL_crmf_privatekeyinfo_st { +typedef struct ossl_crmf_privatekeyinfo_st { ASN1_INTEGER *version; X509_ALGOR *privateKeyAlgorithm; ASN1_OCTET_STRING *privateKey; @@ -82,7 +82,7 @@ DECLARE_ASN1_FUNCTIONS(OSSL_CRMF_PRIVATEKEYINFO) * } OPTIONAL * } */ -typedef struct OSSL_crmf_enckeywithid_identifier_st { +typedef struct ossl_crmf_enckeywithid_identifier_st { int type; union { ASN1_UTF8STRING *string; @@ -91,7 +91,7 @@ typedef struct OSSL_crmf_enckeywithid_identifier_st { } OSSL_CRMF_ENCKEYWITHID_IDENTIFIER; DECLARE_ASN1_FUNCTIONS(OSSL_CRMF_ENCKEYWITHID_IDENTIFIER) -typedef struct OSSL_crmf_enckeywithid_st { +typedef struct ossl_crmf_enckeywithid_st { OSSL_CRMF_PRIVATEKEYINFO *privateKey; /* [0] */ OSSL_CRMF_ENCKEYWITHID_IDENTIFIER *identifier; @@ -104,7 +104,7 @@ DECLARE_ASN1_FUNCTIONS(OSSL_CRMF_ENCKEYWITHID) * serialNumber INTEGER * } */ -struct OSSL_crmf_certid_st { +struct ossl_crmf_certid_st { GENERAL_NAME *issuer; ASN1_INTEGER *serialNumber; } /* OSSL_CRMF_CERTID */; @@ -120,7 +120,7 @@ DECLARE_ASN1_DUP_FUNCTION(OSSL_CRMF_CERTID) * pubLocation GeneralName OPTIONAL * } */ -struct OSSL_crmf_singlepubinfo_st { +struct ossl_crmf_singlepubinfo_st { ASN1_INTEGER *pubMethod; GENERAL_NAME *pubLocation; } /* OSSL_CRMF_SINGLEPUBINFO */; @@ -139,7 +139,7 @@ typedef STACK_OF(OSSL_CRMF_SINGLEPUBINFO) OSSL_CRMF_PUBINFOS; * -- "dontCare" is assumed) * } */ -struct OSSL_crmf_pkipublicationinfo_st { +struct ossl_crmf_pkipublicationinfo_st { ASN1_INTEGER *action; OSSL_CRMF_PUBINFOS *pubInfos; } /* OSSL_CRMF_PKIPUBLICATIONINFO */; @@ -153,7 +153,7 @@ DECLARE_ASN1_DUP_FUNCTION(OSSL_CRMF_PKIPUBLICATIONINFO) * value BIT STRING * } */ -typedef struct OSSL_crmf_pkmacvalue_st { +typedef struct ossl_crmf_pkmacvalue_st { X509_ALGOR *algId; ASN1_BIT_STRING *value; } OSSL_CRMF_PKMACVALUE; @@ -182,7 +182,7 @@ DECLARE_ASN1_FUNCTIONS(OSSL_CRMF_PKMACVALUE) * } */ -typedef struct OSSL_crmf_popoprivkey_st { +typedef struct ossl_crmf_popoprivkey_st { int type; union { ASN1_BIT_STRING *thisMessage; /* 0 */ /* Deprecated */ @@ -211,7 +211,7 @@ DECLARE_ASN1_FUNCTIONS(OSSL_CRMF_POPOPRIVKEY) * -- or HMAC [HMAC, RFC2202]) * } */ -struct OSSL_crmf_pbmparameter_st { +struct ossl_crmf_pbmparameter_st { ASN1_OCTET_STRING *salt; X509_ALGOR *owf; ASN1_INTEGER *iterationCount; @@ -233,7 +233,7 @@ struct OSSL_crmf_pbmparameter_st { * publicKey SubjectPublicKeyInfo -- from CertTemplate * } */ -typedef struct OSSL_crmf_poposigningkeyinput_authinfo_st { +typedef struct ossl_crmf_poposigningkeyinput_authinfo_st { int type; union { /* 0 */ GENERAL_NAME *sender; @@ -242,7 +242,7 @@ typedef struct OSSL_crmf_poposigningkeyinput_authinfo_st { } OSSL_CRMF_POPOSIGNINGKEYINPUT_AUTHINFO; DECLARE_ASN1_FUNCTIONS(OSSL_CRMF_POPOSIGNINGKEYINPUT_AUTHINFO) -typedef struct OSSL_crmf_poposigningkeyinput_st { +typedef struct ossl_crmf_poposigningkeyinput_st { OSSL_CRMF_POPOSIGNINGKEYINPUT_AUTHINFO *authInfo; X509_PUBKEY *publicKey; } OSSL_CRMF_POPOSIGNINGKEYINPUT; @@ -255,7 +255,7 @@ DECLARE_ASN1_FUNCTIONS(OSSL_CRMF_POPOSIGNINGKEYINPUT) * signature BIT STRING * } */ -struct OSSL_crmf_poposigningkey_st { +struct ossl_crmf_poposigningkey_st { OSSL_CRMF_POPOSIGNINGKEYINPUT *poposkInput; X509_ALGOR *algorithmIdentifier; ASN1_BIT_STRING *signature; @@ -272,7 +272,7 @@ DECLARE_ASN1_FUNCTIONS(OSSL_CRMF_POPOSIGNINGKEY) * keyAgreement [3] POPOPrivKey * } */ -typedef struct OSSL_crmf_popo_st { +typedef struct ossl_crmf_popo_st { int type; union { ASN1_NULL *raVerified; /* 0 */ @@ -289,7 +289,7 @@ DECLARE_ASN1_FUNCTIONS(OSSL_CRMF_POPO) * notAfter [1] Time OPTIONAL -- at least one MUST be present * } */ -struct OSSL_crmf_optionalvalidity_st { +struct ossl_crmf_optionalvalidity_st { /* 0 */ ASN1_TIME *notBefore; /* 1 */ ASN1_TIME *notAfter; } /* OSSL_CRMF_OPTIONALVALIDITY */; @@ -309,7 +309,7 @@ DECLARE_ASN1_FUNCTIONS(OSSL_CRMF_OPTIONALVALIDITY) * extensions [9] Extensions OPTIONAL * } */ -struct OSSL_crmf_certtemplate_st { +struct ossl_crmf_certtemplate_st { ASN1_INTEGER *version; /* 0 */ ASN1_INTEGER *serialNumber; /* 1 */ /* serialNumber MUST be omitted */ /* This field is assigned by the CA during certificate creation */ @@ -333,7 +333,7 @@ struct OSSL_crmf_certtemplate_st { * controls Controls OPTIONAL -- Attributes affecting issuance * } */ -struct OSSL_crmf_certrequest_st { +struct ossl_crmf_certrequest_st { ASN1_INTEGER *certReqId; OSSL_CRMF_CERTTEMPLATE *certTemplate; /* TODO: make OSSL_CRMF_CONTROLS out of that - but only cosmetical */ @@ -343,7 +343,7 @@ DECLARE_ASN1_FUNCTIONS(OSSL_CRMF_CERTREQUEST) DECLARE_ASN1_DUP_FUNCTION(OSSL_CRMF_CERTREQUEST) /* TODO: isn't there a better way to have this for ANY type? */ -struct OSSL_crmf_attributetypeandvalue_st { +struct ossl_crmf_attributetypeandvalue_st { ASN1_OBJECT *type; union { /* NID_id_regCtrl_regToken */ @@ -383,7 +383,7 @@ DECLARE_ASN1_DUP_FUNCTION(OSSL_CRMF_ATTRIBUTETYPEANDVALUE) * regInfo SEQUENCE SIZE(1..MAX) OF AttributeTypeAndValue OPTIONAL * } */ -struct OSSL_crmf_msg_st { +struct ossl_crmf_msg_st { OSSL_CRMF_CERTREQUEST *certReq; /* 0 */ OSSL_CRMF_POPO *popo; diff --git a/crypto/crmf/crmf_pbm.c b/crypto/crmf/crmf_pbm.c index a3ac4555..c5e08c47 100644 --- a/crypto/crmf/crmf_pbm.c +++ b/crypto/crmf/crmf_pbm.c @@ -17,7 +17,7 @@ #include #include -#include "crmf_int.h" +#include "crmf_local.h" /* explicit #includes not strictly needed since implied by the above: */ #include @@ -41,20 +41,16 @@ OSSL_CRMF_PBMPARAMETER *OSSL_CRMF_pbmp_new(size_t slen, int owfnid, OSSL_CRMF_PBMPARAMETER *pbm = NULL; unsigned char *salt = NULL; - if ((pbm = OSSL_CRMF_PBMPARAMETER_new()) == NULL) { - CRMFerr(CRMF_F_OSSL_CRMF_PBMP_NEW, ERR_R_MALLOC_FAILURE); + if ((pbm = OSSL_CRMF_PBMPARAMETER_new()) == NULL) goto err; - } /* * salt contains a randomly generated value used in computing the key * of the MAC process. The salt SHOULD be at least 8 octets (64 * bits) long. */ - if ((salt = OPENSSL_malloc(slen)) == NULL) { - CRMFerr(CRMF_F_OSSL_CRMF_PBMP_NEW, ERR_R_MALLOC_FAILURE); + if ((salt = OPENSSL_malloc(slen)) == NULL) goto err; - } if (RAND_bytes(salt, (int)slen) <= 0) { CRMFerr(CRMF_F_OSSL_CRMF_PBMP_NEW, CRMF_R_FAILURE_OBTAINING_RANDOM); goto err; @@ -145,10 +141,8 @@ int OSSL_CRMF_pbm_new(const OSSL_CRMF_PBMPARAMETER *pbmp, CRMFerr(CRMF_F_OSSL_CRMF_PBM_NEW, CRMF_R_NULL_ARGUMENT); goto err; } - if ((mac_res = OPENSSL_malloc(EVP_MAX_MD_SIZE)) == NULL) { - CRMFerr(CRMF_F_OSSL_CRMF_PBM_NEW, ERR_R_MALLOC_FAILURE); + if ((mac_res = OPENSSL_malloc(EVP_MAX_MD_SIZE)) == NULL) goto err; - } /* * owf identifies the hash algorithm and associated parameters used to @@ -160,10 +154,8 @@ int OSSL_CRMF_pbm_new(const OSSL_CRMF_PBMPARAMETER *pbmp, goto err; } - if ((ctx = EVP_MD_CTX_new()) == NULL) { - CRMFerr(CRMF_F_OSSL_CRMF_PBM_NEW, ERR_R_MALLOC_FAILURE); + if ((ctx = EVP_MD_CTX_new()) == NULL) goto err; - } /* compute the basekey of the salted secret */ if (!EVP_DigestInit_ex(ctx, m, NULL)) diff --git a/crypto/cryptlib.c b/crypto/cryptlib.c index 7e89bbd6..bc29a3b5 100644 --- a/crypto/cryptlib.c +++ b/crypto/cryptlib.c @@ -9,7 +9,7 @@ */ #include "e_os.h" -#include "internal/cryptlib_int.h" +#include "crypto/cryptlib.h" #include #if defined(__i386) || defined(__i386__) || defined(_M_IX86) || \ @@ -49,7 +49,7 @@ typedef char variant_char; # define ossl_getenv getenv # endif -# include "internal/ctype.h" +# include "crypto/ctype.h" static int todigit(variant_char c) { diff --git a/crypto/ct/ct_b64.c b/crypto/ct/ct_b64.c index cacec2fd..f0800882 100644 --- a/crypto/ct/ct_b64.c +++ b/crypto/ct/ct_b64.c @@ -14,7 +14,7 @@ #include #include -#include "ct_locl.h" +#include "ct_local.h" /* * Decodes the base64 string |in| into |out|. diff --git a/crypto/ct/ct_locl.h b/crypto/ct/ct_local.h similarity index 100% rename from crypto/ct/ct_locl.h rename to crypto/ct/ct_local.h diff --git a/crypto/ct/ct_oct.c b/crypto/ct/ct_oct.c index 76fc2222..cdab02fd 100644 --- a/crypto/ct/ct_oct.c +++ b/crypto/ct/ct_oct.c @@ -19,7 +19,7 @@ #include #include -#include "ct_locl.h" +#include "ct_local.h" int o2i_SCT_signature(SCT *sct, const unsigned char **in, size_t len) { diff --git a/crypto/ct/ct_policy.c b/crypto/ct/ct_policy.c index 93311475..0305970a 100644 --- a/crypto/ct/ct_policy.c +++ b/crypto/ct/ct_policy.c @@ -15,7 +15,7 @@ #include #include -#include "ct_locl.h" +#include "ct_local.h" /* * Number of seconds in the future that an SCT timestamp can be, by default, diff --git a/crypto/ct/ct_prn.c b/crypto/ct/ct_prn.c index 62d01238..4c5760d6 100644 --- a/crypto/ct/ct_prn.c +++ b/crypto/ct/ct_prn.c @@ -14,7 +14,7 @@ #include #include -#include "ct_locl.h" +#include "ct_local.h" static void SCT_signature_algorithms_print(const SCT *sct, BIO *out) { diff --git a/crypto/ct/ct_sct.c b/crypto/ct/ct_sct.c index ce2f8145..bd510d9e 100644 --- a/crypto/ct/ct_sct.c +++ b/crypto/ct/ct_sct.c @@ -17,7 +17,7 @@ #include #include -#include "ct_locl.h" +#include "ct_local.h" SCT *SCT_new(void) { diff --git a/crypto/ct/ct_sct_ctx.c b/crypto/ct/ct_sct_ctx.c index 64d97b61..aa9d2d75 100644 --- a/crypto/ct/ct_sct_ctx.c +++ b/crypto/ct/ct_sct_ctx.c @@ -18,7 +18,7 @@ #include #include -#include "ct_locl.h" +#include "ct_local.h" SCT_CTX *SCT_CTX_new(void) { diff --git a/crypto/ct/ct_vfy.c b/crypto/ct/ct_vfy.c index c686de6f..f206edd0 100644 --- a/crypto/ct/ct_vfy.c +++ b/crypto/ct/ct_vfy.c @@ -14,7 +14,7 @@ #include #include -#include "ct_locl.h" +#include "ct_local.h" typedef enum sct_signature_type_t { SIGNATURE_TYPE_NOT_SET = -1, diff --git a/crypto/ct/ct_x509v3.c b/crypto/ct/ct_x509v3.c index 92d088a7..1665b985 100644 --- a/crypto/ct/ct_x509v3.c +++ b/crypto/ct/ct_x509v3.c @@ -11,7 +11,7 @@ # error "CT is disabled" #endif -#include "ct_locl.h" +#include "ct_local.h" static char *i2s_poison(const X509V3_EXT_METHOD *method, void *val) { diff --git a/crypto/ctype.c b/crypto/ctype.c index e7bc25b9..dbd78913 100644 --- a/crypto/ctype.c +++ b/crypto/ctype.c @@ -9,7 +9,7 @@ #include #include -#include "internal/ctype.h" +#include "crypto/ctype.h" #include "openssl/ebcdic.h" /* diff --git a/crypto/des/build.info b/crypto/des/build.info index 774bad75..b1c1e624 100644 --- a/crypto/des/build.info +++ b/crypto/des/build.info @@ -20,7 +20,7 @@ SOURCE[../../libcrypto]=$COMMON\ ofb64ede.c ofb64enc.c ofb_enc.c \ str2key.c pcbc_enc.c qud_cksm.c rand_key.c \ fcrypt.c xcbc_enc.c cbc_cksm.c -SOURCE[../../providers/fips]=$COMMON +SOURCE[../../providers/libfips.a]=$COMMON GENERATE[des_enc-sparc.S]=asm/des_enc.m4 GENERATE[dest4-sparcv9.S]=asm/dest4-sparcv9.pl diff --git a/crypto/des/cbc_cksm.c b/crypto/des/cbc_cksm.c index 707841ba..1fb76b55 100644 --- a/crypto/des/cbc_cksm.c +++ b/crypto/des/cbc_cksm.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "des_locl.h" +#include "des_local.h" DES_LONG DES_cbc_cksum(const unsigned char *in, DES_cblock *output, long length, DES_key_schedule *schedule, diff --git a/crypto/des/cfb64ede.c b/crypto/des/cfb64ede.c index 82e9a378..cb5dad2c 100644 --- a/crypto/des/cfb64ede.c +++ b/crypto/des/cfb64ede.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "des_locl.h" +#include "des_local.h" /* * The input and output encrypted as though 64bit cfb mode is being used. diff --git a/crypto/des/cfb64enc.c b/crypto/des/cfb64enc.c index 8a75626d..7c44f2ac 100644 --- a/crypto/des/cfb64enc.c +++ b/crypto/des/cfb64enc.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "des_locl.h" +#include "des_local.h" /* * The input and output encrypted as though 64bit cfb mode is being used. diff --git a/crypto/des/cfb_enc.c b/crypto/des/cfb_enc.c index 6d3155ed..8630cc42 100644 --- a/crypto/des/cfb_enc.c +++ b/crypto/des/cfb_enc.c @@ -8,7 +8,7 @@ */ #include "e_os.h" -#include "des_locl.h" +#include "des_local.h" #include /* diff --git a/crypto/des/des_enc.c b/crypto/des/des_enc.c index bb740f72..5666c6e3 100644 --- a/crypto/des/des_enc.c +++ b/crypto/des/des_enc.c @@ -8,7 +8,7 @@ */ #include -#include "des_locl.h" +#include "des_local.h" #include "spr.h" void DES_encrypt1(DES_LONG *data, DES_key_schedule *ks, int enc) diff --git a/crypto/des/des_locl.h b/crypto/des/des_local.h similarity index 99% rename from crypto/des/des_locl.h rename to crypto/des/des_local.h index 230a30f1..f888cb80 100644 --- a/crypto/des/des_locl.h +++ b/crypto/des/des_local.h @@ -7,8 +7,8 @@ * https://www.openssl.org/source/license.html */ -#ifndef HEADER_DES_LOCL_H -# define HEADER_DES_LOCL_H +#ifndef OSSL_CRYPTO_DES_LOCAL_H +# define OSSL_CRYPTO_DES_LOCAL_H # include diff --git a/crypto/des/ecb3_enc.c b/crypto/des/ecb3_enc.c index dbd0b5f3..7244b7b5 100644 --- a/crypto/des/ecb3_enc.c +++ b/crypto/des/ecb3_enc.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "des_locl.h" +#include "des_local.h" void DES_ecb3_encrypt(const_DES_cblock *input, DES_cblock *output, DES_key_schedule *ks1, DES_key_schedule *ks2, diff --git a/crypto/des/ecb_enc.c b/crypto/des/ecb_enc.c index 6e0b33d4..39b8237c 100644 --- a/crypto/des/ecb_enc.c +++ b/crypto/des/ecb_enc.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "des_locl.h" +#include "des_local.h" #include #include diff --git a/crypto/des/fcrypt.c b/crypto/des/fcrypt.c index 91f59cca..9aebf284 100644 --- a/crypto/des/fcrypt.c +++ b/crypto/des/fcrypt.c @@ -19,7 +19,7 @@ #endif #include -#include "des_locl.h" +#include "des_local.h" /* * Added more values to handle illegal salt values the way normal crypt() diff --git a/crypto/des/fcrypt_b.c b/crypto/des/fcrypt_b.c index c522ddd1..87ad1b30 100644 --- a/crypto/des/fcrypt_b.c +++ b/crypto/des/fcrypt_b.c @@ -10,7 +10,7 @@ #include #define DES_FCRYPT -#include "des_locl.h" +#include "des_local.h" #undef DES_FCRYPT #undef PERM_OP diff --git a/crypto/des/ncbc_enc.c b/crypto/des/ncbc_enc.c index 1b73d824..e8decf1f 100644 --- a/crypto/des/ncbc_enc.c +++ b/crypto/des/ncbc_enc.c @@ -13,7 +13,7 @@ * des_enc.c (DES_ncbc_encrypt) */ -#include "des_locl.h" +#include "des_local.h" #ifdef CBC_ENC_C__DONT_UPDATE_IV void DES_cbc_encrypt(const unsigned char *in, unsigned char *out, long length, diff --git a/crypto/des/ofb64ede.c b/crypto/des/ofb64ede.c index 8e916e7c..284224df 100644 --- a/crypto/des/ofb64ede.c +++ b/crypto/des/ofb64ede.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "des_locl.h" +#include "des_local.h" /* * The input and output encrypted as though 64bit ofb mode is being used. diff --git a/crypto/des/ofb64enc.c b/crypto/des/ofb64enc.c index 519e1636..eec46ae7 100644 --- a/crypto/des/ofb64enc.c +++ b/crypto/des/ofb64enc.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "des_locl.h" +#include "des_local.h" /* * The input and output encrypted as though 64bit ofb mode is being used. diff --git a/crypto/des/ofb_enc.c b/crypto/des/ofb_enc.c index 96fbec97..75100005 100644 --- a/crypto/des/ofb_enc.c +++ b/crypto/des/ofb_enc.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "des_locl.h" +#include "des_local.h" /* * The input and output are loaded in multiples of 8 bits. What this means is diff --git a/crypto/des/pcbc_enc.c b/crypto/des/pcbc_enc.c index c7c11c22..13df9421 100644 --- a/crypto/des/pcbc_enc.c +++ b/crypto/des/pcbc_enc.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "des_locl.h" +#include "des_local.h" void DES_pcbc_encrypt(const unsigned char *input, unsigned char *output, long length, DES_key_schedule *schedule, diff --git a/crypto/des/qud_cksm.c b/crypto/des/qud_cksm.c index b6ce887c..51239148 100644 --- a/crypto/des/qud_cksm.c +++ b/crypto/des/qud_cksm.c @@ -13,7 +13,7 @@ * only based on the code in this paper and is almost definitely not the same * as the MIT implementation. */ -#include "des_locl.h" +#include "des_local.h" #define Q_B0(a) (((DES_LONG)(a))) #define Q_B1(a) (((DES_LONG)(a))<<8) diff --git a/crypto/des/set_key.c b/crypto/des/set_key.c index d42cebda..7972d84a 100644 --- a/crypto/des/set_key.c +++ b/crypto/des/set_key.c @@ -16,7 +16,7 @@ * 1.0 First working version */ #include -#include "des_locl.h" +#include "des_local.h" static const unsigned char odd_parity[256] = { 1, 1, 2, 2, 4, 4, 7, 7, 8, 8, 11, 11, 13, 13, 14, 14, diff --git a/crypto/des/str2key.c b/crypto/des/str2key.c index 81416ebb..d348c06d 100644 --- a/crypto/des/str2key.c +++ b/crypto/des/str2key.c @@ -8,7 +8,7 @@ */ #include -#include "des_locl.h" +#include "des_local.h" void DES_string_to_key(const char *str, DES_cblock *key) { diff --git a/crypto/des/xcbc_enc.c b/crypto/des/xcbc_enc.c index 7fdce590..8a952f63 100644 --- a/crypto/des/xcbc_enc.c +++ b/crypto/des/xcbc_enc.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "des_locl.h" +#include "des_local.h" /* RSA's DESX */ diff --git a/crypto/dh/dh_ameth.c b/crypto/dh/dh_ameth.c index 84f1f8b9..abb9bfdc 100644 --- a/crypto/dh/dh_ameth.c +++ b/crypto/dh/dh_ameth.c @@ -11,10 +11,10 @@ #include "internal/cryptlib.h" #include #include -#include "dh_locl.h" +#include "dh_local.h" #include -#include "internal/asn1_int.h" -#include "internal/evp_int.h" +#include "crypto/asn1.h" +#include "crypto/evp.h" #include #include #include "internal/param_build.h" @@ -120,7 +120,7 @@ static int dh_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey) ptype = V_ASN1_SEQUENCE; pub_key = BN_to_ASN1_INTEGER(dh->pub_key, NULL); - if (!pub_key) + if (pub_key == NULL) goto err; penclen = i2d_ASN1_INTEGER(pub_key, &penc); @@ -158,7 +158,6 @@ static int dh_priv_decode(EVP_PKEY *pkey, const PKCS8_PRIV_KEY_INFO *p8) const ASN1_STRING *pstr; const X509_ALGOR *palg; ASN1_INTEGER *privkey = NULL; - DH *dh = NULL; if (!PKCS8_pkey_get0(NULL, &p, &pklen, &palg, p8)) @@ -225,7 +224,7 @@ static int dh_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey) /* Get private key into integer */ prkey = BN_to_ASN1_INTEGER(pkey->pkey.dh->priv_key, NULL); - if (!prkey) { + if (prkey == NULL) { DHerr(DH_F_DH_PRIV_ENCODE, DH_R_BN_ERROR); goto err; } @@ -549,7 +548,8 @@ static size_t dh_pkey_dirty_cnt(const EVP_PKEY *pkey) return pkey->pkey.dh->dirty_cnt; } -static void *dh_pkey_export_to(const EVP_PKEY *pk, EVP_KEYMGMT *keymgmt) +static void *dh_pkey_export_to(const EVP_PKEY *pk, EVP_KEYMGMT *keymgmt, + int want_domainparams) { DH *dh = pk->pkey.dh; OSSL_PARAM_BLD tmpl; @@ -557,7 +557,7 @@ static void *dh_pkey_export_to(const EVP_PKEY *pk, EVP_KEYMGMT *keymgmt) const BIGNUM *pub_key = DH_get0_pub_key(dh); const BIGNUM *priv_key = DH_get0_priv_key(dh); OSSL_PARAM *params; - void *provkey = NULL; + void *provdata = NULL; if (p == NULL || g == NULL) return NULL; @@ -566,19 +566,15 @@ static void *dh_pkey_export_to(const EVP_PKEY *pk, EVP_KEYMGMT *keymgmt) if (!ossl_param_bld_push_BN(&tmpl, OSSL_PKEY_PARAM_FFC_P, p) || !ossl_param_bld_push_BN(&tmpl, OSSL_PKEY_PARAM_FFC_G, g)) return NULL; - if (q != NULL) { if (!ossl_param_bld_push_BN(&tmpl, OSSL_PKEY_PARAM_FFC_Q, q)) return NULL; } - /* - * This may be used to pass domain parameters only without any key data - - * so "pub_key" is optional. We can never have a "priv_key" without a - * corresponding "pub_key" though. - */ - if (pub_key != NULL) { - if (!ossl_param_bld_push_BN(&tmpl, OSSL_PKEY_PARAM_DH_PUB_KEY, pub_key)) + if (!want_domainparams) { + /* A key must at least have a public part. */ + if (!ossl_param_bld_push_BN(&tmpl, OSSL_PKEY_PARAM_DH_PUB_KEY, + pub_key)) return NULL; if (priv_key != NULL) { @@ -591,10 +587,12 @@ static void *dh_pkey_export_to(const EVP_PKEY *pk, EVP_KEYMGMT *keymgmt) params = ossl_param_bld_to_param(&tmpl); /* We export, the provider imports */ - provkey = evp_keymgmt_importkey(keymgmt, params); + provdata = want_domainparams + ? evp_keymgmt_importdomparams(keymgmt, params) + : evp_keymgmt_importkey(keymgmt, params); ossl_param_bld_free(params); - return provkey; + return provdata; } const EVP_PKEY_ASN1_METHOD dh_asn1_meth = { @@ -703,7 +701,7 @@ static int dh_cms_set_peerkey(EVP_PKEY_CTX *pctx, goto err; pk = EVP_PKEY_CTX_get0_pkey(pctx); - if (!pk) + if (pk == NULL) goto err; if (pk->type != EVP_PKEY_DHX) goto err; @@ -712,7 +710,7 @@ static int dh_cms_set_peerkey(EVP_PKEY_CTX *pctx, /* We have parameters now set public key */ plen = ASN1_STRING_length(pubkey); p = ASN1_STRING_get0_data(pubkey); - if (!p || !plen) + if (p == NULL || plen == 0) goto err; if ((public_key = d2i_ASN1_INTEGER(NULL, &p, plen)) == NULL) { @@ -821,7 +819,8 @@ static int dh_cms_decrypt(CMS_RecipientInfo *ri) { EVP_PKEY_CTX *pctx; pctx = CMS_RecipientInfo_get0_pkey_ctx(ri); - if (!pctx) + + if (pctx == NULL) return 0; /* See if we need to set peer key */ if (!EVP_PKEY_CTX_get0_peerkey(pctx)) { @@ -862,8 +861,9 @@ static int dh_cms_encrypt(CMS_RecipientInfo *ri) int rv = 0; int kdf_type, wrap_nid; const EVP_MD *kdf_md; + pctx = CMS_RecipientInfo_get0_pkey_ctx(ri); - if (!pctx) + if (pctx == NULL) return 0; /* Get ephemeral key */ pkey = EVP_PKEY_CTX_get0_pkey(pctx); @@ -874,7 +874,8 @@ static int dh_cms_encrypt(CMS_RecipientInfo *ri) /* Is everything uninitialised? */ if (aoid == OBJ_nid2obj(NID_undef)) { ASN1_INTEGER *pubk = BN_to_ASN1_INTEGER(pkey->pkey.dh->pub_key, NULL); - if (!pubk) + + if (pubk == NULL) goto err; /* Set the key */ @@ -960,7 +961,7 @@ static int dh_cms_encrypt(CMS_RecipientInfo *ri) */ penc = NULL; penclen = i2d_X509_ALGOR(wrap_alg, &penc); - if (!penc || !penclen) + if (penc == NULL || penclen == 0) goto err; wrap_str = ASN1_STRING_new(); if (wrap_str == NULL) diff --git a/crypto/dh/dh_asn1.c b/crypto/dh/dh_asn1.c index 71379d73..2708a81c 100644 --- a/crypto/dh/dh_asn1.c +++ b/crypto/dh/dh_asn1.c @@ -10,7 +10,7 @@ #include #include "internal/cryptlib.h" #include -#include "dh_locl.h" +#include "dh_local.h" #include #include diff --git a/crypto/dh/dh_check.c b/crypto/dh/dh_check.c index 2d19a8f1..70f08360 100644 --- a/crypto/dh/dh_check.c +++ b/crypto/dh/dh_check.c @@ -10,9 +10,7 @@ #include #include "internal/cryptlib.h" #include -#include "dh_locl.h" - -# define DH_NUMBER_ITERATIONS_FOR_PRIME 64 +#include "dh_local.h" /*- * Check that p and g are suitable enough @@ -137,7 +135,7 @@ int DH_check(const DH *dh, int *ret) if (!BN_is_one(t1)) *ret |= DH_NOT_SUITABLE_GENERATOR; } - r = BN_is_prime_ex(dh->q, DH_NUMBER_ITERATIONS_FOR_PRIME, ctx, NULL); + r = BN_check_prime(dh->q, ctx, NULL); if (r < 0) goto err; if (!r) @@ -151,7 +149,7 @@ int DH_check(const DH *dh, int *ret) *ret |= DH_CHECK_INVALID_J_VALUE; } - r = BN_is_prime_ex(dh->p, DH_NUMBER_ITERATIONS_FOR_PRIME, ctx, NULL); + r = BN_check_prime(dh->p, ctx, NULL); if (r < 0) goto err; if (!r) @@ -159,7 +157,7 @@ int DH_check(const DH *dh, int *ret) else if (!dh->q) { if (!BN_rshift1(t1, dh->p)) goto err; - r = BN_is_prime_ex(t1, DH_NUMBER_ITERATIONS_FOR_PRIME, ctx, NULL); + r = BN_check_prime(t1, ctx, NULL); if (r < 0) goto err; if (!r) diff --git a/crypto/dh/dh_gen.c b/crypto/dh/dh_gen.c index 76d6ad01..0506bbe2 100644 --- a/crypto/dh/dh_gen.c +++ b/crypto/dh/dh_gen.c @@ -15,7 +15,7 @@ #include #include "internal/cryptlib.h" #include -#include "dh_locl.h" +#include "dh_local.h" static int dh_builtin_genparams(DH *ret, int prime_len, int generator, BN_GENCB *cb); diff --git a/crypto/dh/dh_key.c b/crypto/dh/dh_key.c index 8731cc2c..a8a9dbe7 100644 --- a/crypto/dh/dh_key.c +++ b/crypto/dh/dh_key.c @@ -9,8 +9,8 @@ #include #include "internal/cryptlib.h" -#include "dh_locl.h" -#include "internal/bn_int.h" +#include "dh_local.h" +#include "crypto/bn.h" static int generate_key(DH *dh); static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh); diff --git a/crypto/dh/dh_lib.c b/crypto/dh/dh_lib.c index 0382e442..670ba1f7 100644 --- a/crypto/dh/dh_lib.c +++ b/crypto/dh/dh_lib.c @@ -11,7 +11,7 @@ #include "internal/cryptlib.h" #include "internal/refcount.h" #include -#include "dh_locl.h" +#include "dh_local.h" #include int DH_set_method(DH *dh, const DH_METHOD *meth) diff --git a/crypto/dh/dh_locl.h b/crypto/dh/dh_local.h similarity index 100% rename from crypto/dh/dh_locl.h rename to crypto/dh/dh_local.h diff --git a/crypto/dh/dh_meth.c b/crypto/dh/dh_meth.c index 8cdb61f3..be04b76a 100644 --- a/crypto/dh/dh_meth.c +++ b/crypto/dh/dh_meth.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "dh_locl.h" +#include "dh_local.h" #include #include diff --git a/crypto/dh/dh_pmeth.c b/crypto/dh/dh_pmeth.c index f630fd3e..55d11d63 100644 --- a/crypto/dh/dh_pmeth.c +++ b/crypto/dh/dh_pmeth.c @@ -12,11 +12,11 @@ #include #include #include -#include "dh_locl.h" +#include "dh_local.h" #include #include #include -#include "internal/evp_int.h" +#include "crypto/evp.h" /* DH pkey context structure */ @@ -80,6 +80,7 @@ static void pkey_dh_cleanup(EVP_PKEY_CTX *ctx) static int pkey_dh_copy(EVP_PKEY_CTX *dst, const EVP_PKEY_CTX *src) { DH_PKEY_CTX *dctx, *sctx; + if (!pkey_dh_init(dst)) return 0; sctx = src->data; @@ -478,7 +479,7 @@ static int pkey_dh_derive(EVP_PKEY_CTX *ctx, unsigned char *key, return 0; } -const EVP_PKEY_METHOD dh_pkey_meth = { +static const EVP_PKEY_METHOD dh_pkey_meth = { EVP_PKEY_DH, 0, pkey_dh_init, @@ -512,7 +513,12 @@ const EVP_PKEY_METHOD dh_pkey_meth = { pkey_dh_ctrl_str }; -const EVP_PKEY_METHOD dhx_pkey_meth = { +const EVP_PKEY_METHOD *dh_pkey_method(void) +{ + return &dh_pkey_meth; +} + +static const EVP_PKEY_METHOD dhx_pkey_meth = { EVP_PKEY_DHX, 0, pkey_dh_init, @@ -545,3 +551,8 @@ const EVP_PKEY_METHOD dhx_pkey_meth = { pkey_dh_ctrl, pkey_dh_ctrl_str }; + +const EVP_PKEY_METHOD *dhx_pkey_method(void) +{ + return &dhx_pkey_meth; +} diff --git a/crypto/dh/dh_rfc5114.c b/crypto/dh/dh_rfc5114.c index 1cc32383..823f6d92 100644 --- a/crypto/dh/dh_rfc5114.c +++ b/crypto/dh/dh_rfc5114.c @@ -9,9 +9,9 @@ #include #include "internal/cryptlib.h" -#include "dh_locl.h" +#include "dh_local.h" #include -#include "internal/bn_dh.h" +#include "crypto/bn_dh.h" /* * Macro to make a DH structure from BIGNUM data. NB: although just copying diff --git a/crypto/dh/dh_rfc7919.c b/crypto/dh/dh_rfc7919.c index 4e676fd3..e36712fa 100644 --- a/crypto/dh/dh_rfc7919.c +++ b/crypto/dh/dh_rfc7919.c @@ -9,10 +9,10 @@ #include #include "internal/cryptlib.h" -#include "dh_locl.h" +#include "dh_local.h" #include #include -#include "internal/bn_dh.h" +#include "crypto/bn_dh.h" static DH *dh_param_init(const BIGNUM *p, int32_t nbits) { diff --git a/crypto/dllmain.c b/crypto/dllmain.c index 6f12741f..48c0cd31 100644 --- a/crypto/dllmain.c +++ b/crypto/dllmain.c @@ -8,7 +8,7 @@ */ #include "e_os.h" -#include "internal/cryptlib_int.h" +#include "crypto/cryptlib.h" #if defined(_WIN32) || defined(__CYGWIN__) # ifdef __CYGWIN__ diff --git a/crypto/dsa/dsa_ameth.c b/crypto/dsa/dsa_ameth.c index f3aab348..ddd262bd 100644 --- a/crypto/dsa/dsa_ameth.c +++ b/crypto/dsa/dsa_ameth.c @@ -14,10 +14,10 @@ #include #include #include "internal/cryptlib.h" -#include "internal/asn1_int.h" -#include "internal/evp_int.h" +#include "crypto/asn1.h" +#include "crypto/evp.h" #include "internal/param_build.h" -#include "dsa_locl.h" +#include "dsa_local.h" static int dsa_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey) { @@ -211,7 +211,7 @@ static int dsa_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey) unsigned char *dp = NULL; int dplen; - if (!pkey->pkey.dsa || !pkey->pkey.dsa->priv_key) { + if (pkey->pkey.dsa == NULL|| pkey->pkey.dsa->priv_key == NULL) { DSAerr(DSA_F_DSA_PRIV_ENCODE, DSA_R_MISSING_PARAMETERS); goto err; } @@ -233,7 +233,7 @@ static int dsa_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey) /* Get private key into integer */ prkey = BN_to_ASN1_INTEGER(pkey->pkey.dsa->priv_key, NULL); - if (!prkey) { + if (prkey == NULL) { DSAerr(DSA_F_DSA_PRIV_ENCODE, DSA_R_BN_ERROR); goto err; } @@ -533,7 +533,8 @@ static size_t dsa_pkey_dirty_cnt(const EVP_PKEY *pkey) return pkey->pkey.dsa->dirty_cnt; } -static void *dsa_pkey_export_to(const EVP_PKEY *pk, EVP_KEYMGMT *keymgmt) +static void *dsa_pkey_export_to(const EVP_PKEY *pk, EVP_KEYMGMT *keymgmt, + int want_domainparams) { DSA *dsa = pk->pkey.dsa; OSSL_PARAM_BLD tmpl; @@ -541,7 +542,7 @@ static void *dsa_pkey_export_to(const EVP_PKEY *pk, EVP_KEYMGMT *keymgmt) const BIGNUM *q = DSA_get0_q(dsa), *pub_key = DSA_get0_pub_key(dsa); const BIGNUM *priv_key = DSA_get0_priv_key(dsa); OSSL_PARAM *params; - void *provkey = NULL; + void *provdata = NULL; if (p == NULL || q == NULL || g == NULL) return NULL; @@ -552,12 +553,8 @@ static void *dsa_pkey_export_to(const EVP_PKEY *pk, EVP_KEYMGMT *keymgmt) || !ossl_param_bld_push_BN(&tmpl, OSSL_PKEY_PARAM_FFC_G, g)) return NULL; - /* - * This may be used to pass domain parameters only without any key data - - * so "pub_key" is optional. We can never have a "priv_key" without a - * corresponding "pub_key" though. - */ - if (pub_key != NULL) { + if (!want_domainparams) { + /* A key must at least have a public part. */ if (!ossl_param_bld_push_BN(&tmpl, OSSL_PKEY_PARAM_DSA_PUB_KEY, pub_key)) return NULL; @@ -572,10 +569,12 @@ static void *dsa_pkey_export_to(const EVP_PKEY *pk, EVP_KEYMGMT *keymgmt) params = ossl_param_bld_to_param(&tmpl); /* We export, the provider imports */ - provkey = evp_keymgmt_importkey(keymgmt, params); + provdata = want_domainparams + ? evp_keymgmt_importdomparams(keymgmt, params) + : evp_keymgmt_importkey(keymgmt, params); ossl_param_bld_free(params); - return provkey; + return provdata; } /* NB these are sorted in pkey_id order, lowest first */ diff --git a/crypto/dsa/dsa_asn1.c b/crypto/dsa/dsa_asn1.c index eddcc118..bf16e282 100644 --- a/crypto/dsa/dsa_asn1.c +++ b/crypto/dsa/dsa_asn1.c @@ -9,11 +9,11 @@ #include #include "internal/cryptlib.h" -#include "dsa_locl.h" +#include "dsa_local.h" #include #include #include -#include "internal/asn1_dsa.h" +#include "crypto/asn1_dsa.h" DSA_SIG *DSA_SIG_new(void) { diff --git a/crypto/dsa/dsa_gen.c b/crypto/dsa/dsa_gen.c index 14cb8e9f..67551e54 100644 --- a/crypto/dsa/dsa_gen.c +++ b/crypto/dsa/dsa_gen.c @@ -21,7 +21,7 @@ #include #include #include -#include "dsa_locl.h" +#include "dsa_local.h" int DSA_generate_parameters_ex(DSA *ret, int bits, const unsigned char *seed_in, int seed_len, @@ -154,8 +154,7 @@ int dsa_builtin_paramgen(DSA *ret, size_t bits, size_t qbits, goto err; /* step 4 */ - r = BN_is_prime_fasttest_ex(q, DSS_prime_checks, ctx, - use_random_seed, cb); + r = BN_check_prime(q, ctx, cb); if (r > 0) break; if (r != 0) @@ -226,7 +225,7 @@ int dsa_builtin_paramgen(DSA *ret, size_t bits, size_t qbits, /* step 10 */ if (BN_cmp(p, test) >= 0) { /* step 11 */ - r = BN_is_prime_fasttest_ex(p, DSS_prime_checks, ctx, 1, cb); + r = BN_check_prime(p, ctx, cb); if (r > 0) goto end; /* found it */ if (r != 0) @@ -425,8 +424,7 @@ int dsa_builtin_paramgen2(DSA *ret, size_t L, size_t N, goto err; /* step 4 */ - r = BN_is_prime_fasttest_ex(q, DSS_prime_checks, ctx, - seed_in ? 1 : 0, cb); + r = BN_check_prime(q, ctx, cb); if (r > 0) break; if (r != 0) @@ -506,7 +504,7 @@ int dsa_builtin_paramgen2(DSA *ret, size_t L, size_t N, /* step 10 */ if (BN_cmp(p, test) >= 0) { /* step 11 */ - r = BN_is_prime_fasttest_ex(p, DSS_prime_checks, ctx, 1, cb); + r = BN_check_prime(p, ctx, cb); if (r > 0) goto end; /* found it */ if (r != 0) diff --git a/crypto/dsa/dsa_key.c b/crypto/dsa/dsa_key.c index 86f79b80..6e5039a6 100644 --- a/crypto/dsa/dsa_key.c +++ b/crypto/dsa/dsa_key.c @@ -11,7 +11,7 @@ #include #include "internal/cryptlib.h" #include -#include "dsa_locl.h" +#include "dsa_local.h" static int dsa_builtin_keygen(DSA *dsa); diff --git a/crypto/dsa/dsa_lib.c b/crypto/dsa/dsa_lib.c index 034300fc..4670c433 100644 --- a/crypto/dsa/dsa_lib.c +++ b/crypto/dsa/dsa_lib.c @@ -11,7 +11,7 @@ #include "internal/cryptlib.h" #include "internal/refcount.h" #include -#include "dsa_locl.h" +#include "dsa_local.h" #include #include #include diff --git a/crypto/dsa/dsa_locl.h b/crypto/dsa/dsa_local.h similarity index 100% rename from crypto/dsa/dsa_locl.h rename to crypto/dsa/dsa_local.h diff --git a/crypto/dsa/dsa_meth.c b/crypto/dsa/dsa_meth.c index 2202260c..226ea340 100644 --- a/crypto/dsa/dsa_meth.c +++ b/crypto/dsa/dsa_meth.c @@ -15,7 +15,7 @@ * or in the file LICENSE in the source distribution. */ -#include "dsa_locl.h" +#include "dsa_local.h" #include #include diff --git a/crypto/dsa/dsa_ossl.c b/crypto/dsa/dsa_ossl.c index 08f2e9f0..5e34fc55 100644 --- a/crypto/dsa/dsa_ossl.c +++ b/crypto/dsa/dsa_ossl.c @@ -9,10 +9,10 @@ #include #include "internal/cryptlib.h" -#include "internal/bn_int.h" +#include "crypto/bn.h" #include #include -#include "dsa_locl.h" +#include "dsa_local.h" #include static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa); diff --git a/crypto/dsa/dsa_pmeth.c b/crypto/dsa/dsa_pmeth.c index a21e0101..24d5dbd3 100644 --- a/crypto/dsa/dsa_pmeth.c +++ b/crypto/dsa/dsa_pmeth.c @@ -13,8 +13,8 @@ #include #include #include -#include "internal/evp_int.h" -#include "dsa_locl.h" +#include "crypto/evp.h" +#include "dsa_local.h" /* DSA pkey context structure */ @@ -239,7 +239,7 @@ static int pkey_dsa_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey) return DSA_generate_key(pkey->pkey.dsa); } -const EVP_PKEY_METHOD dsa_pkey_meth = { +static const EVP_PKEY_METHOD dsa_pkey_meth = { EVP_PKEY_DSA, EVP_PKEY_FLAG_AUTOARGLEN, pkey_dsa_init, @@ -271,3 +271,8 @@ const EVP_PKEY_METHOD dsa_pkey_meth = { pkey_dsa_ctrl, pkey_dsa_ctrl_str }; + +const EVP_PKEY_METHOD *dsa_pkey_method(void) +{ + return &dsa_pkey_meth; +} diff --git a/crypto/dsa/dsa_sign.c b/crypto/dsa/dsa_sign.c index 19582a07..68501efa 100644 --- a/crypto/dsa/dsa_sign.c +++ b/crypto/dsa/dsa_sign.c @@ -8,7 +8,7 @@ */ #include "internal/cryptlib.h" -#include "dsa_locl.h" +#include "dsa_local.h" #include DSA_SIG *DSA_do_sign(const unsigned char *dgst, int dlen, DSA *dsa) diff --git a/crypto/dsa/dsa_vrf.c b/crypto/dsa/dsa_vrf.c index 4066aa66..cf4412b5 100644 --- a/crypto/dsa/dsa_vrf.c +++ b/crypto/dsa/dsa_vrf.c @@ -8,7 +8,7 @@ */ #include "internal/cryptlib.h" -#include "dsa_locl.h" +#include "dsa_local.h" int DSA_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig, DSA *dsa) diff --git a/crypto/dso/dso_dl.c b/crypto/dso/dso_dl.c index 1ce3ac6a..54697893 100644 --- a/crypto/dso/dso_dl.c +++ b/crypto/dso/dso_dl.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "dso_locl.h" +#include "dso_local.h" #ifdef DSO_DL diff --git a/crypto/dso/dso_dlfcn.c b/crypto/dso/dso_dlfcn.c index d076c7eb..b01c2f6a 100644 --- a/crypto/dso/dso_dlfcn.c +++ b/crypto/dso/dso_dlfcn.c @@ -16,7 +16,7 @@ # define _GNU_SOURCE /* make sure dladdr is declared */ #endif -#include "dso_locl.h" +#include "dso_local.h" #include "e_os.h" #ifdef DSO_DLFCN diff --git a/crypto/dso/dso_lib.c b/crypto/dso/dso_lib.c index f1b193bb..a464c391 100644 --- a/crypto/dso/dso_lib.c +++ b/crypto/dso/dso_lib.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "dso_locl.h" +#include "dso_local.h" #include "internal/refcount.h" static DSO_METHOD *default_DSO_meth = NULL; diff --git a/crypto/dso/dso_locl.h b/crypto/dso/dso_local.h similarity index 99% rename from crypto/dso/dso_locl.h rename to crypto/dso/dso_local.h index 5d365aab..8aa29c18 100644 --- a/crypto/dso/dso_locl.h +++ b/crypto/dso/dso_local.h @@ -10,7 +10,7 @@ #include #include "internal/cryptlib.h" #include "internal/dso.h" -#include "internal/dso_conf.h" +#include "crypto/dso_conf.h" #include "internal/refcount.h" /**********************************************************************/ diff --git a/crypto/dso/dso_openssl.c b/crypto/dso/dso_openssl.c index 0e244380..3f264a6c 100644 --- a/crypto/dso/dso_openssl.c +++ b/crypto/dso/dso_openssl.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "dso_locl.h" +#include "dso_local.h" #ifdef DSO_NONE diff --git a/crypto/dso/dso_vms.c b/crypto/dso/dso_vms.c index 8b0af2e6..d1993ceb 100644 --- a/crypto/dso/dso_vms.c +++ b/crypto/dso/dso_vms.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "dso_locl.h" +#include "dso_local.h" #ifdef OPENSSL_SYS_VMS diff --git a/crypto/dso/dso_win32.c b/crypto/dso/dso_win32.c index 9c779921..adf2e636 100644 --- a/crypto/dso/dso_win32.c +++ b/crypto/dso/dso_win32.c @@ -8,7 +8,7 @@ */ #include "e_os.h" -#include "dso_locl.h" +#include "dso_local.h" #if defined(DSO_WIN32) diff --git a/crypto/ec/build.info b/crypto/ec/build.info index 2befa3e7..90aea66a 100644 --- a/crypto/ec/build.info +++ b/crypto/ec/build.info @@ -19,7 +19,7 @@ IF[{- !$disabled{asm} -}] $ECASM_mips64= $ECASM_s390x=ecp_s390x_nistp.c - $ECDEF_s390x=S390X_NISTP_ASM + $ECDEF_s390x=S390X_EC_ASM $ECASM_armv4=ecp_nistz256.c ecp_nistz256-armv4.S $ECDEF_armv4=ECP_NISTZ256_ASM @@ -56,9 +56,13 @@ $COMMON=ec_lib.c ecp_smpl.c ecp_mont.c ecp_nist.c ec_cvt.c ec_mult.c \ $ECASM SOURCE[../../libcrypto]=$COMMON ec_ameth.c ec_pmeth.c ecx_meth.c ec_err.c \ ecdh_kdf.c eck_prn.c +SOURCE[../../providers/libfips.a]=$COMMON + +# Implementations are now spread across several libraries, so the defines +# need to be applied to all affected libraries and modules. DEFINE[../../libcrypto]=$ECDEF -SOURCE[../../providers/fips]=$COMMON -DEFINE[../../providers/fips]=$ECDEF +DEFINE[../../providers/libfips.a]=$ECDEF +DEFINE[../../providers/libimplementations.a]=$ECDEF GENERATE[ecp_nistz256-x86.s]=asm/ecp_nistz256-x86.pl diff --git a/crypto/ec/curve25519.c b/crypto/ec/curve25519.c index ca2b6cc5..89b1e3c2 100644 --- a/crypto/ec/curve25519.c +++ b/crypto/ec/curve25519.c @@ -8,7 +8,7 @@ */ #include -#include "ec_lcl.h" +#include "ec_local.h" #include #if defined(X25519_ASM) && (defined(__x86_64) || defined(__x86_64__) || \ diff --git a/crypto/ec/curve448/arch_32/arch_intrinsics.h b/crypto/ec/curve448/arch_32/arch_intrinsics.h index 5db66f4a..7a54903a 100644 --- a/crypto/ec/curve448/arch_32/arch_intrinsics.h +++ b/crypto/ec/curve448/arch_32/arch_intrinsics.h @@ -10,10 +10,10 @@ * Originally written by Mike Hamburg */ -#ifndef HEADER_ARCH_32_ARCH_INTRINSICS_H -# define HEADER_ARCH_32_ARCH_INTRINSICS_H +#ifndef OSSL_CRYPTO_EC_CURVE448_ARCH_32_INTRINSICS_H +# define OSSL_CRYPTO_EC_CURVE448_ARCH_32_INTRINSICS_H -#include "internal/constant_time_locl.h" +#include "internal/constant_time.h" # define ARCH_WORD_BITS 32 @@ -24,4 +24,4 @@ static ossl_inline uint64_t widemul(uint32_t a, uint32_t b) return ((uint64_t)a) * b; } -#endif /* HEADER_ARCH_32_ARCH_INTRINSICS_H */ +#endif /* OSSL_CRYPTO_EC_CURVE448_ARCH_32_INTRINSICS_H */ diff --git a/crypto/ec/curve448/arch_32/f_impl.h b/crypto/ec/curve448/arch_32/f_impl.h index 4ca283fe..5cd25c04 100644 --- a/crypto/ec/curve448/arch_32/f_impl.h +++ b/crypto/ec/curve448/arch_32/f_impl.h @@ -10,8 +10,8 @@ * Originally written by Mike Hamburg */ -#ifndef HEADER_ARCH_32_F_IMPL_H -# define HEADER_ARCH_32_F_IMPL_H +#ifndef OSSL_CRYPTO_EC_CURVE448_ARCH_32_F_IMPL_H +# define OSSL_CRYPTO_EC_CURVE448_ARCH_32_F_IMPL_H # define GF_HEADROOM 2 # define LIMB(x) ((x) & ((1 << 28) - 1)), ((x) >> 28) @@ -57,4 +57,4 @@ void gf_weak_reduce(gf a) a->limb[0] = (a->limb[0] & mask) + tmp; } -#endif /* HEADER_ARCH_32_F_IMPL_H */ +#endif /* OSSL_CRYPTO_EC_CURVE448_ARCH_32_F_IMPL_H */ diff --git a/crypto/ec/curve448/curve448.c b/crypto/ec/curve448/curve448.c index 59f44795..e3dffd09 100644 --- a/crypto/ec/curve448/curve448.c +++ b/crypto/ec/curve448/curve448.c @@ -15,7 +15,7 @@ #include "point_448.h" #include "ed448.h" -#include "curve448_lcl.h" +#include "curve448_local.h" #define COFACTOR 4 diff --git a/crypto/ec/curve448/curve448_lcl.h b/crypto/ec/curve448/curve448_local.h similarity index 92% rename from crypto/ec/curve448/curve448_lcl.h rename to crypto/ec/curve448/curve448_local.h index 9459f002..197627f6 100644 --- a/crypto/ec/curve448/curve448_lcl.h +++ b/crypto/ec/curve448/curve448_local.h @@ -6,8 +6,8 @@ * in the file LICENSE in the source distribution or at * https://www.openssl.org/source/license.html */ -#ifndef HEADER_CURVE448_LCL_H -# define HEADER_CURVE448_LCL_H +#ifndef OSSL_CRYPTO_EC_CURVE448_LOCAL_H +# define OSSL_CRYPTO_EC_CURVE448_LOCAL_H # include "curve448utils.h" int X448(uint8_t out_shared_key[56], const uint8_t private_key[56], @@ -36,4 +36,4 @@ int ED448ph_verify(OPENSSL_CTX *ctx, const uint8_t hash[64], int ED448_public_from_private(OPENSSL_CTX *ctx, uint8_t out_public_key[57], const uint8_t private_key[57]); -#endif /* HEADER_CURVE448_LCL_H */ +#endif /* OSSL_CRYPTO_EC_CURVE448_LOCAL_H */ diff --git a/crypto/ec/curve448/curve448utils.h b/crypto/ec/curve448/curve448utils.h index 0ac69a66..fa06cb02 100644 --- a/crypto/ec/curve448/curve448utils.h +++ b/crypto/ec/curve448/curve448utils.h @@ -10,8 +10,8 @@ * Originally written by Mike Hamburg */ -#ifndef HEADER_CURVE448UTILS_H -# define HEADER_CURVE448UTILS_H +#ifndef OSSL_CRYPTO_EC_CURVE448UTILS_H +# define OSSL_CRYPTO_EC_CURVE448UTILS_H # include diff --git a/crypto/ec/curve448/ed448.h b/crypto/ec/curve448/ed448.h index b198f36e..4f99fe69 100644 --- a/crypto/ec/curve448/ed448.h +++ b/crypto/ec/curve448/ed448.h @@ -10,8 +10,8 @@ * Originally written by Mike Hamburg */ -#ifndef HEADER_ED448_H -# define HEADER_ED448_H +#ifndef OSSL_CRYPTO_EC_CURVE448_ED448_H +# define OSSL_CRYPTO_EC_CURVE448_ED448_H # include "point_448.h" @@ -198,4 +198,4 @@ c448_error_t c448_ed448_convert_private_key_to_x448( uint8_t x[X448_PRIVATE_BYTES], const uint8_t ed[EDDSA_448_PRIVATE_BYTES]); -#endif /* HEADER_ED448_H */ +#endif /* OSSL_CRYPTO_EC_CURVE448_ED448_H */ diff --git a/crypto/ec/curve448/eddsa.c b/crypto/ec/curve448/eddsa.c index 45b6c4ab..95fd6657 100644 --- a/crypto/ec/curve448/eddsa.c +++ b/crypto/ec/curve448/eddsa.c @@ -12,7 +12,7 @@ #include #include #include -#include "curve448_lcl.h" +#include "curve448_local.h" #include "word.h" #include "ed448.h" #include "internal/numbers.h" diff --git a/crypto/ec/curve448/field.h b/crypto/ec/curve448/field.h index 4e46d3ea..9d6ee1ca 100644 --- a/crypto/ec/curve448/field.h +++ b/crypto/ec/curve448/field.h @@ -10,10 +10,10 @@ * Originally written by Mike Hamburg */ -#ifndef HEADER_FIELD_H -# define HEADER_FIELD_H +#ifndef OSSL_CRYPTO_EC_CURVE448_FIELD_H +# define OSSL_CRYPTO_EC_CURVE448_FIELD_H -# include "internal/constant_time_locl.h" +# include "internal/constant_time.h" # include # include # include "word.h" @@ -165,4 +165,4 @@ static ossl_inline void gf_cond_swap(gf x, gf_s * RESTRICT y, mask_t swap) } } -#endif /* HEADER_FIELD_H */ +#endif /* OSSL_CRYPTO_EC_CURVE448_FIELD_H */ diff --git a/crypto/ec/curve448/point_448.h b/crypto/ec/curve448/point_448.h index 1708b57f..9f09aea1 100644 --- a/crypto/ec/curve448/point_448.h +++ b/crypto/ec/curve448/point_448.h @@ -10,8 +10,8 @@ * Originally written by Mike Hamburg */ -#ifndef HEADER_POINT_448_H -# define HEADER_POINT_448_H +#ifndef OSSL_CRYPTO_EC_CURVE448_POINT_448_H +# define OSSL_CRYPTO_EC_CURVE448_POINT_448_H # include "curve448utils.h" # include "field.h" @@ -298,4 +298,4 @@ void curve448_scalar_destroy(curve448_scalar_t scalar); /* Overwrite point with zeros. */ void curve448_point_destroy(curve448_point_t point); -#endif /* HEADER_POINT_448_H */ +#endif /* OSSL_CRYPTO_EC_CURVE448_POINT_448_H */ diff --git a/crypto/ec/curve448/word.h b/crypto/ec/curve448/word.h index 250720be..d3e6ff86 100644 --- a/crypto/ec/curve448/word.h +++ b/crypto/ec/curve448/word.h @@ -10,8 +10,8 @@ * Originally written by Mike Hamburg */ -#ifndef HEADER_WORD_H -# define HEADER_WORD_H +#ifndef OSSL_CRYPTO_EC_CURVE448_WORD_H +# define OSSL_CRYPTO_EC_CURVE448_WORD_H # include # include @@ -78,4 +78,4 @@ static ossl_inline mask_t bool_to_mask(c448_bool_t m) return ret; } -#endif /* HEADER_WORD_H */ +#endif /* OSSL_CRYPTO_EC_CURVE448_WORD_H */ diff --git a/crypto/ec/ec2_oct.c b/crypto/ec/ec2_oct.c index f9ee3be9..1f92680f 100644 --- a/crypto/ec/ec2_oct.c +++ b/crypto/ec/ec2_oct.c @@ -10,7 +10,7 @@ #include -#include "ec_lcl.h" +#include "ec_local.h" #ifndef OPENSSL_NO_EC2M diff --git a/crypto/ec/ec2_smpl.c b/crypto/ec/ec2_smpl.c index f377b1f1..21ce6e12 100644 --- a/crypto/ec/ec2_smpl.c +++ b/crypto/ec/ec2_smpl.c @@ -10,8 +10,8 @@ #include -#include "internal/bn_int.h" -#include "ec_lcl.h" +#include "crypto/bn.h" +#include "ec_local.h" #ifndef OPENSSL_NO_EC2M diff --git a/crypto/ec/ec_ameth.c b/crypto/ec/ec_ameth.c index 2beeb827..6105e6b0 100644 --- a/crypto/ec/ec_ameth.c +++ b/crypto/ec/ec_ameth.c @@ -14,9 +14,9 @@ #include #include #include -#include "internal/asn1_int.h" -#include "internal/evp_int.h" -#include "ec_lcl.h" +#include "crypto/asn1.h" +#include "crypto/evp.h" +#include "ec_local.h" #ifndef OPENSSL_NO_CMS static int ecdh_cms_decrypt(CMS_RecipientInfo *ri); @@ -196,7 +196,7 @@ static int eckey_priv_decode(EVP_PKEY *pkey, const PKCS8_PRIV_KEY_INFO *p8) eckey = eckey_type2param(ptype, pval); - if (!eckey) + if (eckey == NULL) goto ecliberr; /* We have parameters now set private key */ @@ -650,7 +650,7 @@ static int ecdh_cms_set_peerkey(EVP_PKEY_CTX *pctx, const EC_GROUP *grp; EVP_PKEY *pk; pk = EVP_PKEY_CTX_get0_pkey(pctx); - if (!pk) + if (pk == NULL) goto err; grp = EC_KEY_get0_group(pk->pkey.ec); ecpeer = EC_KEY_new(); @@ -666,7 +666,7 @@ static int ecdh_cms_set_peerkey(EVP_PKEY_CTX *pctx, /* We have parameters now set public key */ plen = ASN1_STRING_length(pubkey); p = ASN1_STRING_get0_data(pubkey); - if (!p || !plen) + if (p == NULL || plen == 0) goto err; if (!o2i_ECPublicKey(&ecpeer, &p, plen)) goto err; diff --git a/crypto/ec/ec_asn1.c b/crypto/ec/ec_asn1.c index 2726f5d1..c993821b 100644 --- a/crypto/ec/ec_asn1.c +++ b/crypto/ec/ec_asn1.c @@ -8,12 +8,12 @@ */ #include -#include "ec_lcl.h" +#include "ec_local.h" #include #include #include #include "internal/nelem.h" -#include "internal/asn1_dsa.h" +#include "crypto/asn1_dsa.h" #ifndef FIPS_MODE @@ -581,8 +581,9 @@ EC_GROUP *EC_GROUP_new_from_ecparameters(const ECPARAMETERS *params) int curve_name = NID_undef; BN_CTX *ctx = NULL; - if (!params->fieldID || !params->fieldID->fieldType || - !params->fieldID->p.ptr) { + if (params->fieldID == NULL + || params->fieldID->fieldType == NULL + || params->fieldID->p.ptr == NULL) { ECerr(EC_F_EC_GROUP_NEW_FROM_ECPARAMETERS, EC_R_ASN1_ERROR); goto err; } @@ -593,9 +594,9 @@ EC_GROUP *EC_GROUP_new_from_ecparameters(const ECPARAMETERS *params) * encoded them incorrectly, so we must accept any length for backwards * compatibility. */ - if (!params->curve || !params->curve->a || - !params->curve->a->data || !params->curve->b || - !params->curve->b->data) { + if (params->curve == NULL + || params->curve->a == NULL || params->curve->a->data == NULL + || params->curve->b == NULL || params->curve->b->data == NULL) { ECerr(EC_F_EC_GROUP_NEW_FROM_ECPARAMETERS, EC_R_ASN1_ERROR); goto err; } @@ -665,7 +666,7 @@ EC_GROUP *EC_GROUP_new_from_ecparameters(const ECPARAMETERS *params) X9_62_PENTANOMIAL *penta; penta = char_two->p.ppBasis; - if (!penta) { + if (penta == NULL) { ECerr(EC_F_EC_GROUP_NEW_FROM_ECPARAMETERS, EC_R_ASN1_ERROR); goto err; } @@ -705,7 +706,7 @@ EC_GROUP *EC_GROUP_new_from_ecparameters(const ECPARAMETERS *params) else if (tmp == NID_X9_62_prime_field) { /* we have a curve over a prime field */ /* extract the prime number */ - if (!params->fieldID->p.prime) { + if (params->fieldID->p.prime == NULL) { ECerr(EC_F_EC_GROUP_NEW_FROM_ECPARAMETERS, EC_R_ASN1_ERROR); goto err; } @@ -750,7 +751,9 @@ EC_GROUP *EC_GROUP_new_from_ecparameters(const ECPARAMETERS *params) ret->seed_len = params->curve->seed->length; } - if (!params->order || !params->base || !params->base->data) { + if (params->order == NULL + || params->base == NULL + || params->base->data == NULL) { ECerr(EC_F_EC_GROUP_NEW_FROM_ECPARAMETERS, EC_R_ASN1_ERROR); goto err; } @@ -852,6 +855,20 @@ EC_GROUP *EC_GROUP_new_from_ecparameters(const ECPARAMETERS *params) * serialized using explicit parameters by default. */ EC_GROUP_set_asn1_flag(ret, OPENSSL_EC_EXPLICIT_CURVE); + + /* + * If the input params do not contain the optional seed field we make + * sure it is not added to the returned group. + * + * The seed field is not really used inside libcrypto anyway, and + * adding it to parsed explicit parameter keys would alter their DER + * encoding output (because of the extra field) which could impact + * applications fingerprinting keys by their DER encoding. + */ + if (params->curve->seed == NULL) { + if (EC_GROUP_set_seed(ret, NULL, 0) != 1) + goto err; + } } ok = 1; diff --git a/crypto/ec/ec_check.c b/crypto/ec/ec_check.c index 974fcb24..f8723aab 100644 --- a/crypto/ec/ec_check.c +++ b/crypto/ec/ec_check.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "ec_lcl.h" +#include "ec_local.h" #include int EC_GROUP_check_named_curve(const EC_GROUP *group, int nist_only, diff --git a/crypto/ec/ec_curve.c b/crypto/ec/ec_curve.c index f3a526f1..2639b1b5 100644 --- a/crypto/ec/ec_curve.c +++ b/crypto/ec/ec_curve.c @@ -9,7 +9,7 @@ */ #include -#include "ec_lcl.h" +#include "ec_local.h" #include #include #include @@ -2829,7 +2829,7 @@ static const ec_list_element curve_list[] = { # endif /* SECG secp256r1 is the same as X9.62 prime256v1 and hence omitted */ {NID_secp384r1, &_EC_NIST_PRIME_384.h, -# if defined(S390X_NISTP_ASM) +# if defined(S390X_EC_ASM) EC_GFp_s390x_nistp384_method, # else 0, @@ -2837,7 +2837,7 @@ static const ec_list_element curve_list[] = { "NIST/SECG curve over a 384 bit prime field"}, {NID_secp521r1, &_EC_NIST_PRIME_521.h, -# if defined(S390X_NISTP_ASM) +# if defined(S390X_EC_ASM) EC_GFp_s390x_nistp521_method, # elif !defined(OPENSSL_NO_EC_NISTP_64_GCC_128) EC_GFp_nistp521_method, @@ -2852,7 +2852,7 @@ static const ec_list_element curve_list[] = { {NID_X9_62_prime256v1, &_EC_X9_62_PRIME_256V1.h, # if defined(ECP_NISTZ256_ASM) EC_GFp_nistz256_method, -# elif defined(S390X_NISTP_ASM) +# elif defined(S390X_EC_ASM) EC_GFp_s390x_nistp256_method, # elif !defined(OPENSSL_NO_EC_NISTP_64_GCC_128) EC_GFp_nistp256_method, @@ -2922,14 +2922,14 @@ static const ec_list_element curve_list[] = { "SECG curve over a 256 bit prime field"}, /* SECG secp256r1 is the same as X9.62 prime256v1 and hence omitted */ {NID_secp384r1, &_EC_NIST_PRIME_384.h, -# if defined(S390X_NISTP_ASM) +# if defined(S390X_EC_ASM) EC_GFp_s390x_nistp384_method, # else 0, # endif "NIST/SECG curve over a 384 bit prime field"}, {NID_secp521r1, &_EC_NIST_PRIME_521.h, -# if defined(S390X_NISTP_ASM) +# if defined(S390X_EC_ASM) EC_GFp_s390x_nistp521_method, # elif !defined(OPENSSL_NO_EC_NISTP_64_GCC_128) EC_GFp_nistp521_method, @@ -2953,7 +2953,7 @@ static const ec_list_element curve_list[] = { {NID_X9_62_prime256v1, &_EC_X9_62_PRIME_256V1.h, # if defined(ECP_NISTZ256_ASM) EC_GFp_nistz256_method, -# elif defined(S390X_NISTP_ASM) +# elif defined(S390X_EC_ASM) EC_GFp_s390x_nistp256_method, # elif !defined(OPENSSL_NO_EC_NISTP_64_GCC_128) EC_GFp_nistp256_method, diff --git a/crypto/ec/ec_cvt.c b/crypto/ec/ec_cvt.c index 9b3087ed..ec8989f6 100644 --- a/crypto/ec/ec_cvt.c +++ b/crypto/ec/ec_cvt.c @@ -9,8 +9,8 @@ */ #include -#include "internal/bn_int.h" -#include "ec_lcl.h" +#include "crypto/bn.h" +#include "ec_local.h" EC_GROUP *EC_GROUP_new_curve_GFp(const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) diff --git a/crypto/ec/ec_key.c b/crypto/ec/ec_key.c index 6a02a3bc..2ae5a654 100644 --- a/crypto/ec/ec_key.c +++ b/crypto/ec/ec_key.c @@ -10,7 +10,7 @@ #include "internal/cryptlib.h" #include -#include "ec_lcl.h" +#include "ec_local.h" #include "internal/refcount.h" #include #include diff --git a/crypto/ec/ec_kmeth.c b/crypto/ec/ec_kmeth.c index 036fec87..9556a942 100644 --- a/crypto/ec/ec_kmeth.c +++ b/crypto/ec/ec_kmeth.c @@ -11,7 +11,7 @@ #include #include #include -#include "ec_lcl.h" +#include "ec_local.h" static const EC_KEY_METHOD openssl_ec_key_method = { diff --git a/crypto/ec/ec_lib.c b/crypto/ec/ec_lib.c index bc52e634..69b3c7fc 100644 --- a/crypto/ec/ec_lib.c +++ b/crypto/ec/ec_lib.c @@ -13,7 +13,7 @@ #include #include -#include "ec_lcl.h" +#include "ec_local.h" /* functions for EC_GROUP objects */ @@ -710,7 +710,7 @@ EC_POINT *EC_POINT_new(const EC_GROUP *group) void EC_POINT_free(EC_POINT *point) { - if (!point) + if (point == NULL) return; if (point->meth->point_finish != 0) @@ -720,7 +720,7 @@ void EC_POINT_free(EC_POINT *point) void EC_POINT_clear_free(EC_POINT *point) { - if (!point) + if (point == NULL) return; if (point->meth->point_clear_finish != 0) diff --git a/crypto/ec/ec_lcl.h b/crypto/ec/ec_local.h similarity index 99% rename from crypto/ec/ec_lcl.h rename to crypto/ec/ec_local.h index 5dd4d031..a523ab64 100644 --- a/crypto/ec/ec_lcl.h +++ b/crypto/ec/ec_local.h @@ -14,7 +14,7 @@ #include #include #include "internal/refcount.h" -#include "internal/ec_int.h" +#include "crypto/ec.h" #if defined(__SUNPRO_C) # if __SUNPRO_C >= 0x520 @@ -597,7 +597,7 @@ int ec_group_simple_order_bits(const EC_GROUP *group); */ const EC_METHOD *EC_GFp_nistz256_method(void); #endif -#ifdef S390X_NISTP_ASM +#ifdef S390X_EC_ASM const EC_METHOD *EC_GFp_s390x_nistp256_method(void); const EC_METHOD *EC_GFp_s390x_nistp384_method(void); const EC_METHOD *EC_GFp_s390x_nistp521_method(void); diff --git a/crypto/ec/ec_mult.c b/crypto/ec/ec_mult.c index be4f2306..2f2e66c6 100644 --- a/crypto/ec/ec_mult.c +++ b/crypto/ec/ec_mult.c @@ -12,8 +12,8 @@ #include #include "internal/cryptlib.h" -#include "internal/bn_int.h" -#include "ec_lcl.h" +#include "crypto/bn.h" +#include "ec_local.h" #include "internal/refcount.h" /* diff --git a/crypto/ec/ec_oct.c b/crypto/ec/ec_oct.c index 8783b592..e9b1b87a 100644 --- a/crypto/ec/ec_oct.c +++ b/crypto/ec/ec_oct.c @@ -13,7 +13,7 @@ #include #include -#include "ec_lcl.h" +#include "ec_local.h" int EC_POINT_set_compressed_coordinates(const EC_GROUP *group, EC_POINT *point, const BIGNUM *x, int y_bit, BN_CTX *ctx) diff --git a/crypto/ec/ec_pmeth.c b/crypto/ec/ec_pmeth.c index e581741f..1750e43d 100644 --- a/crypto/ec/ec_pmeth.c +++ b/crypto/ec/ec_pmeth.c @@ -12,9 +12,9 @@ #include #include #include -#include "ec_lcl.h" +#include "ec_local.h" #include -#include "internal/evp_int.h" +#include "crypto/evp.h" /* EC pkey context structure */ @@ -437,7 +437,7 @@ static int pkey_ec_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey) return ret ? EC_KEY_generate_key(ec) : 0; } -const EVP_PKEY_METHOD ec_pkey_meth = { +static const EVP_PKEY_METHOD ec_pkey_meth = { EVP_PKEY_EC, 0, pkey_ec_init, @@ -475,3 +475,8 @@ const EVP_PKEY_METHOD ec_pkey_meth = { pkey_ec_ctrl, pkey_ec_ctrl_str }; + +const EVP_PKEY_METHOD *ec_pkey_method(void) +{ + return &ec_pkey_meth; +} diff --git a/crypto/ec/ec_print.c b/crypto/ec/ec_print.c index 0315b7a7..bb372d86 100644 --- a/crypto/ec/ec_print.c +++ b/crypto/ec/ec_print.c @@ -9,7 +9,7 @@ #include #include -#include "ec_lcl.h" +#include "ec_local.h" BIGNUM *EC_POINT_point2bn(const EC_GROUP *group, const EC_POINT *point, diff --git a/crypto/ec/ecdh_kdf.c b/crypto/ec/ecdh_kdf.c index a1908094..8c4d530b 100644 --- a/crypto/ec/ecdh_kdf.c +++ b/crypto/ec/ecdh_kdf.c @@ -12,7 +12,7 @@ #include #include #include -#include "ec_lcl.h" +#include "ec_local.h" /* Key derivation function from X9.63/SECG */ int ecdh_KDF_X9_63(unsigned char *out, size_t outlen, diff --git a/crypto/ec/ecdh_ossl.c b/crypto/ec/ecdh_ossl.c index b3fb8792..5c64ce1a 100644 --- a/crypto/ec/ecdh_ossl.c +++ b/crypto/ec/ecdh_ossl.c @@ -17,7 +17,7 @@ #include #include #include -#include "ec_lcl.h" +#include "ec_local.h" int ossl_ecdh_compute_key(unsigned char **psec, size_t *pseclen, const EC_POINT *pub_key, const EC_KEY *ecdh) diff --git a/crypto/ec/ecdsa_ossl.c b/crypto/ec/ecdsa_ossl.c index afa65233..5593d5d6 100644 --- a/crypto/ec/ecdsa_ossl.c +++ b/crypto/ec/ecdsa_ossl.c @@ -11,8 +11,8 @@ #include #include #include -#include "internal/bn_int.h" -#include "ec_lcl.h" +#include "crypto/bn.h" +#include "ec_local.h" int ossl_ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp) diff --git a/crypto/ec/ecdsa_sign.c b/crypto/ec/ecdsa_sign.c index 01b3a6fb..7d0215b3 100644 --- a/crypto/ec/ecdsa_sign.c +++ b/crypto/ec/ecdsa_sign.c @@ -8,7 +8,7 @@ */ #include -#include "ec_lcl.h" +#include "ec_local.h" #include ECDSA_SIG *ECDSA_do_sign(const unsigned char *dgst, int dlen, EC_KEY *eckey) diff --git a/crypto/ec/ecdsa_vrf.c b/crypto/ec/ecdsa_vrf.c index 7773dff5..75dfe5b9 100644 --- a/crypto/ec/ecdsa_vrf.c +++ b/crypto/ec/ecdsa_vrf.c @@ -8,7 +8,7 @@ */ #include -#include "ec_lcl.h" +#include "ec_local.h" #include /*- diff --git a/crypto/ec/ecp_mont.c b/crypto/ec/ecp_mont.c index 61a203c1..44b66353 100644 --- a/crypto/ec/ecp_mont.c +++ b/crypto/ec/ecp_mont.c @@ -10,7 +10,7 @@ #include -#include "ec_lcl.h" +#include "ec_local.h" const EC_METHOD *EC_GFp_mont_method(void) { diff --git a/crypto/ec/ecp_nist.c b/crypto/ec/ecp_nist.c index 99cc74b6..3b5666d1 100644 --- a/crypto/ec/ecp_nist.c +++ b/crypto/ec/ecp_nist.c @@ -12,7 +12,7 @@ #include #include -#include "ec_lcl.h" +#include "ec_local.h" const EC_METHOD *EC_GFp_nist_method(void) { diff --git a/crypto/ec/ecp_nistp224.c b/crypto/ec/ecp_nistp224.c index 8922a47b..a726f8e2 100644 --- a/crypto/ec/ecp_nistp224.c +++ b/crypto/ec/ecp_nistp224.c @@ -38,7 +38,7 @@ NON_EMPTY_TRANSLATION_UNIT # include # include # include -# include "ec_lcl.h" +# include "ec_local.h" # if defined(__SIZEOF_INT128__) && __SIZEOF_INT128__==16 /* even with gcc, the typedef won't work for 32-bit platforms */ diff --git a/crypto/ec/ecp_nistp256.c b/crypto/ec/ecp_nistp256.c index 4d284fa3..4cbac522 100644 --- a/crypto/ec/ecp_nistp256.c +++ b/crypto/ec/ecp_nistp256.c @@ -39,7 +39,7 @@ NON_EMPTY_TRANSLATION_UNIT # include # include # include -# include "ec_lcl.h" +# include "ec_local.h" # if defined(__SIZEOF_INT128__) && __SIZEOF_INT128__==16 /* even with gcc, the typedef won't work for 32-bit platforms */ diff --git a/crypto/ec/ecp_nistp521.c b/crypto/ec/ecp_nistp521.c index 7b134bb7..6b5dc8eb 100644 --- a/crypto/ec/ecp_nistp521.c +++ b/crypto/ec/ecp_nistp521.c @@ -38,7 +38,7 @@ NON_EMPTY_TRANSLATION_UNIT # include # include -# include "ec_lcl.h" +# include "ec_local.h" # if defined(__SIZEOF_INT128__) && __SIZEOF_INT128__==16 /* even with gcc, the typedef won't work for 32-bit platforms */ diff --git a/crypto/ec/ecp_nistputil.c b/crypto/ec/ecp_nistputil.c index 0715370b..98e0b72d 100644 --- a/crypto/ec/ecp_nistputil.c +++ b/crypto/ec/ecp_nistputil.c @@ -33,7 +33,7 @@ NON_EMPTY_TRANSLATION_UNIT */ # include -# include "ec_lcl.h" +# include "ec_local.h" /* * Convert an array of points into affine coordinates. (If the point at diff --git a/crypto/ec/ecp_nistz256.c b/crypto/ec/ecp_nistz256.c index a09e9c5d..603557ce 100644 --- a/crypto/ec/ecp_nistz256.c +++ b/crypto/ec/ecp_nistz256.c @@ -21,8 +21,8 @@ #include #include "internal/cryptlib.h" -#include "internal/bn_int.h" -#include "ec_lcl.h" +#include "crypto/bn.h" +#include "ec_local.h" #include "internal/refcount.h" #if BN_BITS2 != 64 diff --git a/crypto/ec/ecp_oct.c b/crypto/ec/ecp_oct.c index a00eac35..e6bc153f 100644 --- a/crypto/ec/ecp_oct.c +++ b/crypto/ec/ecp_oct.c @@ -11,7 +11,7 @@ #include #include -#include "ec_lcl.h" +#include "ec_local.h" int ec_GFp_simple_set_compressed_coordinates(const EC_GROUP *group, EC_POINT *point, diff --git a/crypto/ec/ecp_s390x_nistp.c b/crypto/ec/ecp_s390x_nistp.c index be81f0b8..a7cb5d31 100644 --- a/crypto/ec/ecp_s390x_nistp.c +++ b/crypto/ec/ecp_s390x_nistp.c @@ -11,7 +11,7 @@ #include #include #include -#include "ec_lcl.h" +#include "ec_local.h" #include "s390x_arch.h" /* Size of parameter blocks */ @@ -110,7 +110,7 @@ ret: /* Otherwise use default. */ if (rc == -1) rc = ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx); - OPENSSL_cleanse(param, sizeof(param)); + OPENSSL_cleanse(param + S390X_OFF_SCALAR(len), len); BN_CTX_end(ctx); BN_CTX_free(new_ctx); return rc; @@ -203,7 +203,7 @@ static ECDSA_SIG *ecdsa_s390x_nistp_sign_sig(const unsigned char *dgst, ok = 1; ret: - OPENSSL_cleanse(param, sizeof(param)); + OPENSSL_cleanse(param + S390X_OFF_K(len), 2 * len); if (ok != 1) { ECDSA_SIG_free(sig); sig = NULL; diff --git a/crypto/ec/ecp_smpl.c b/crypto/ec/ecp_smpl.c index bf7aeb10..e06177ee 100644 --- a/crypto/ec/ecp_smpl.c +++ b/crypto/ec/ecp_smpl.c @@ -11,7 +11,7 @@ #include #include -#include "ec_lcl.h" +#include "ec_local.h" const EC_METHOD *EC_GFp_simple_method(void) { diff --git a/crypto/ec/ecx_meth.c b/crypto/ec/ecx_meth.c index b8813921..eace1a88 100644 --- a/crypto/ec/ecx_meth.c +++ b/crypto/ec/ecx_meth.c @@ -12,10 +12,10 @@ #include #include #include -#include "internal/asn1_int.h" -#include "internal/evp_int.h" -#include "ec_lcl.h" -#include "curve448/curve448_lcl.h" +#include "crypto/asn1.h" +#include "crypto/evp.h" +#include "ec_local.h" +#include "curve448/curve448_local.h" #define X25519_BITS 253 #define X25519_SECURITY_BITS 128 @@ -719,7 +719,7 @@ static int pkey_ecx_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) return -2; } -const EVP_PKEY_METHOD ecx25519_pkey_meth = { +static const EVP_PKEY_METHOD ecx25519_pkey_meth = { EVP_PKEY_X25519, 0, 0, 0, 0, 0, 0, 0, pkey_ecx_keygen, @@ -729,7 +729,7 @@ const EVP_PKEY_METHOD ecx25519_pkey_meth = { 0 }; -const EVP_PKEY_METHOD ecx448_pkey_meth = { +static const EVP_PKEY_METHOD ecx448_pkey_meth = { EVP_PKEY_X448, 0, 0, 0, 0, 0, 0, 0, pkey_ecx_keygen, @@ -830,7 +830,7 @@ static int pkey_ecd_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) return -2; } -const EVP_PKEY_METHOD ed25519_pkey_meth = { +static const EVP_PKEY_METHOD ed25519_pkey_meth = { EVP_PKEY_ED25519, EVP_PKEY_FLAG_SIGCTX_CUSTOM, 0, 0, 0, 0, 0, 0, pkey_ecx_keygen, @@ -841,7 +841,7 @@ const EVP_PKEY_METHOD ed25519_pkey_meth = { pkey_ecd_digestverify25519 }; -const EVP_PKEY_METHOD ed448_pkey_meth = { +static const EVP_PKEY_METHOD ed448_pkey_meth = { EVP_PKEY_ED448, EVP_PKEY_FLAG_SIGCTX_CUSTOM, 0, 0, 0, 0, 0, 0, pkey_ecx_keygen, @@ -851,3 +851,667 @@ const EVP_PKEY_METHOD ed448_pkey_meth = { pkey_ecd_digestsign448, pkey_ecd_digestverify448 }; + +#ifdef S390X_EC_ASM +# include "s390x_arch.h" + +static void s390x_x25519_mod_p(unsigned char u[32]) +{ + unsigned char u_red[32]; + unsigned int c = 0; + int i; + + memcpy(u_red, u, sizeof(u_red)); + + c += (unsigned int)u_red[31] + 19; + u_red[31] = (unsigned char)c; + c >>= 8; + + for (i = 30; c > 0 && i >= 0; i--) { + c += (unsigned int)u_red[i]; + u_red[i] = (unsigned char)c; + c >>= 8; + } + + if (u_red[0] & 0x80) { + u_red[0] &= 0x7f; + memcpy(u, u_red, sizeof(u_red)); + } +} + +static void s390x_x448_mod_p(unsigned char u[56]) +{ + unsigned char u_red[56]; + unsigned int c = 0; + int i; + + memcpy(u_red, u, sizeof(u_red)); + + c += (unsigned int)u_red[55] + 1; + u_red[55] = (unsigned char)c; + c >>= 8; + + for (i = 54; i >= 28; i--) { + c += (unsigned int)u_red[i]; + u_red[i] = (unsigned char)c; + c >>= 8; + } + + c += (unsigned int)u_red[27] + 1; + u_red[27] = (unsigned char)c; + c >>= 8; + + for (i = 26; c > 0 && i >= 0; i--) { + c += (unsigned int)u_red[i]; + u_red[i] = (unsigned char)c; + c >>= 8; + } + + if (u_red[0] & 0x80) { + u_red[0] &= 0x7f; + memcpy(u, u_red, sizeof(u_red)); + } +} + +static int s390x_x25519_mul(unsigned char u_dst[32], + const unsigned char u_src[32], + const unsigned char d_src[32]) +{ + union { + struct { + unsigned char u_dst[32]; + unsigned char u_src[32]; + unsigned char d_src[32]; + } x25519; + unsigned long long buff[512]; + } param; + int rc; + + memset(¶m, 0, sizeof(param)); + + s390x_flip_endian32(param.x25519.u_src, u_src); + param.x25519.u_src[0] &= 0x7f; + s390x_x25519_mod_p(param.x25519.u_src); + + s390x_flip_endian32(param.x25519.d_src, d_src); + param.x25519.d_src[31] &= 248; + param.x25519.d_src[0] &= 127; + param.x25519.d_src[0] |= 64; + + rc = s390x_pcc(S390X_SCALAR_MULTIPLY_X25519, ¶m.x25519) ? 0 : 1; + if (rc == 1) + s390x_flip_endian32(u_dst, param.x25519.u_dst); + + OPENSSL_cleanse(param.x25519.d_src, sizeof(param.x25519.d_src)); + return rc; +} + +static int s390x_x448_mul(unsigned char u_dst[56], + const unsigned char u_src[56], + const unsigned char d_src[56]) +{ + union { + struct { + unsigned char u_dst[64]; + unsigned char u_src[64]; + unsigned char d_src[64]; + } x448; + unsigned long long buff[512]; + } param; + int rc; + + memset(¶m, 0, sizeof(param)); + + memcpy(param.x448.u_src, u_src, 56); + memcpy(param.x448.d_src, d_src, 56); + + s390x_flip_endian64(param.x448.u_src, param.x448.u_src); + s390x_x448_mod_p(param.x448.u_src); + + s390x_flip_endian64(param.x448.d_src, param.x448.d_src); + param.x448.d_src[63] &= 252; + param.x448.d_src[8] |= 128; + + rc = s390x_pcc(S390X_SCALAR_MULTIPLY_X448, ¶m.x448) ? 0 : 1; + if (rc == 1) { + s390x_flip_endian64(param.x448.u_dst, param.x448.u_dst); + memcpy(u_dst, param.x448.u_dst, 56); + } + + OPENSSL_cleanse(param.x448.d_src, sizeof(param.x448.d_src)); + return rc; +} + +static int s390x_ed25519_mul(unsigned char x_dst[32], + unsigned char y_dst[32], + const unsigned char x_src[32], + const unsigned char y_src[32], + const unsigned char d_src[32]) +{ + union { + struct { + unsigned char x_dst[32]; + unsigned char y_dst[32]; + unsigned char x_src[32]; + unsigned char y_src[32]; + unsigned char d_src[32]; + } ed25519; + unsigned long long buff[512]; + } param; + int rc; + + memset(¶m, 0, sizeof(param)); + + s390x_flip_endian32(param.ed25519.x_src, x_src); + s390x_flip_endian32(param.ed25519.y_src, y_src); + s390x_flip_endian32(param.ed25519.d_src, d_src); + + rc = s390x_pcc(S390X_SCALAR_MULTIPLY_ED25519, ¶m.ed25519) ? 0 : 1; + if (rc == 1) { + s390x_flip_endian32(x_dst, param.ed25519.x_dst); + s390x_flip_endian32(y_dst, param.ed25519.y_dst); + } + + OPENSSL_cleanse(param.ed25519.d_src, sizeof(param.ed25519.d_src)); + return rc; +} + +static int s390x_ed448_mul(unsigned char x_dst[57], + unsigned char y_dst[57], + const unsigned char x_src[57], + const unsigned char y_src[57], + const unsigned char d_src[57]) +{ + union { + struct { + unsigned char x_dst[64]; + unsigned char y_dst[64]; + unsigned char x_src[64]; + unsigned char y_src[64]; + unsigned char d_src[64]; + } ed448; + unsigned long long buff[512]; + } param; + int rc; + + memset(¶m, 0, sizeof(param)); + + memcpy(param.ed448.x_src, x_src, 57); + memcpy(param.ed448.y_src, y_src, 57); + memcpy(param.ed448.d_src, d_src, 57); + s390x_flip_endian64(param.ed448.x_src, param.ed448.x_src); + s390x_flip_endian64(param.ed448.y_src, param.ed448.y_src); + s390x_flip_endian64(param.ed448.d_src, param.ed448.d_src); + + rc = s390x_pcc(S390X_SCALAR_MULTIPLY_ED448, ¶m.ed448) ? 0 : 1; + if (rc == 1) { + s390x_flip_endian64(param.ed448.x_dst, param.ed448.x_dst); + s390x_flip_endian64(param.ed448.y_dst, param.ed448.y_dst); + memcpy(x_dst, param.ed448.x_dst, 57); + memcpy(y_dst, param.ed448.y_dst, 57); + } + + OPENSSL_cleanse(param.ed448.d_src, sizeof(param.ed448.d_src)); + return rc; +} + +static int s390x_pkey_ecx_keygen25519(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey) +{ + static const unsigned char generator[] = { + 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 + }; + ECX_KEY *key; + unsigned char *privkey = NULL, *pubkey; + + key = OPENSSL_zalloc(sizeof(*key)); + if (key == NULL) { + ECerr(EC_F_S390X_PKEY_ECX_KEYGEN25519, ERR_R_MALLOC_FAILURE); + goto err; + } + + pubkey = key->pubkey; + + privkey = key->privkey = OPENSSL_secure_malloc(X25519_KEYLEN); + if (privkey == NULL) { + ECerr(EC_F_S390X_PKEY_ECX_KEYGEN25519, ERR_R_MALLOC_FAILURE); + goto err; + } + + if (RAND_priv_bytes(privkey, X25519_KEYLEN) <= 0) + goto err; + + privkey[0] &= 248; + privkey[31] &= 127; + privkey[31] |= 64; + + if (s390x_x25519_mul(pubkey, generator, privkey) != 1) + goto err; + + EVP_PKEY_assign(pkey, ctx->pmeth->pkey_id, key); + return 1; + err: + OPENSSL_secure_clear_free(privkey, X25519_KEYLEN); + key->privkey = NULL; + OPENSSL_free(key); + return 0; +} + +static int s390x_pkey_ecx_keygen448(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey) +{ + static const unsigned char generator[] = { + 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 + }; + ECX_KEY *key; + unsigned char *privkey = NULL, *pubkey; + + key = OPENSSL_zalloc(sizeof(*key)); + if (key == NULL) { + ECerr(EC_F_S390X_PKEY_ECX_KEYGEN448, ERR_R_MALLOC_FAILURE); + goto err; + } + + pubkey = key->pubkey; + + privkey = key->privkey = OPENSSL_secure_malloc(X448_KEYLEN); + if (privkey == NULL) { + ECerr(EC_F_S390X_PKEY_ECX_KEYGEN448, ERR_R_MALLOC_FAILURE); + goto err; + } + + if (RAND_priv_bytes(privkey, X448_KEYLEN) <= 0) + goto err; + + privkey[0] &= 252; + privkey[55] |= 128; + + if (s390x_x448_mul(pubkey, generator, privkey) != 1) + goto err; + + EVP_PKEY_assign(pkey, ctx->pmeth->pkey_id, key); + return 1; + err: + OPENSSL_secure_clear_free(privkey, X448_KEYLEN); + key->privkey = NULL; + OPENSSL_free(key); + return 0; +} + +static int s390x_pkey_ecd_keygen25519(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey) +{ + static const unsigned char generator_x[] = { + 0x1a, 0xd5, 0x25, 0x8f, 0x60, 0x2d, 0x56, 0xc9, 0xb2, 0xa7, 0x25, 0x95, + 0x60, 0xc7, 0x2c, 0x69, 0x5c, 0xdc, 0xd6, 0xfd, 0x31, 0xe2, 0xa4, 0xc0, + 0xfe, 0x53, 0x6e, 0xcd, 0xd3, 0x36, 0x69, 0x21 + }; + static const unsigned char generator_y[] = { + 0x58, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, + 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, + 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, + }; + unsigned char x_dst[32], buff[SHA512_DIGEST_LENGTH]; + ECX_KEY *key; + unsigned char *privkey = NULL, *pubkey; + + key = OPENSSL_zalloc(sizeof(*key)); + if (key == NULL) { + ECerr(EC_F_S390X_PKEY_ECD_KEYGEN25519, ERR_R_MALLOC_FAILURE); + goto err; + } + + pubkey = key->pubkey; + + privkey = key->privkey = OPENSSL_secure_malloc(ED25519_KEYLEN); + if (privkey == NULL) { + ECerr(EC_F_S390X_PKEY_ECD_KEYGEN25519, ERR_R_MALLOC_FAILURE); + goto err; + } + + if (RAND_priv_bytes(privkey, ED25519_KEYLEN) <= 0) + goto err; + + SHA512(privkey, 32, buff); + buff[0] &= 248; + buff[31] &= 63; + buff[31] |= 64; + + if (s390x_ed25519_mul(x_dst, pubkey, + generator_x, generator_y, buff) != 1) + goto err; + + pubkey[31] |= ((x_dst[0] & 0x01) << 7); + + EVP_PKEY_assign(pkey, ctx->pmeth->pkey_id, key); + return 1; + err: + OPENSSL_secure_clear_free(privkey, ED25519_KEYLEN); + key->privkey = NULL; + OPENSSL_free(key); + return 0; +} + +static int s390x_pkey_ecd_keygen448(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey) +{ + static const unsigned char generator_x[] = { + 0x5e, 0xc0, 0x0c, 0xc7, 0x2b, 0xa8, 0x26, 0x26, 0x8e, 0x93, 0x00, 0x8b, + 0xe1, 0x80, 0x3b, 0x43, 0x11, 0x65, 0xb6, 0x2a, 0xf7, 0x1a, 0xae, 0x12, + 0x64, 0xa4, 0xd3, 0xa3, 0x24, 0xe3, 0x6d, 0xea, 0x67, 0x17, 0x0f, 0x47, + 0x70, 0x65, 0x14, 0x9e, 0xda, 0x36, 0xbf, 0x22, 0xa6, 0x15, 0x1d, 0x22, + 0xed, 0x0d, 0xed, 0x6b, 0xc6, 0x70, 0x19, 0x4f, 0x00 + }; + static const unsigned char generator_y[] = { + 0x14, 0xfa, 0x30, 0xf2, 0x5b, 0x79, 0x08, 0x98, 0xad, 0xc8, 0xd7, 0x4e, + 0x2c, 0x13, 0xbd, 0xfd, 0xc4, 0x39, 0x7c, 0xe6, 0x1c, 0xff, 0xd3, 0x3a, + 0xd7, 0xc2, 0xa0, 0x05, 0x1e, 0x9c, 0x78, 0x87, 0x40, 0x98, 0xa3, 0x6c, + 0x73, 0x73, 0xea, 0x4b, 0x62, 0xc7, 0xc9, 0x56, 0x37, 0x20, 0x76, 0x88, + 0x24, 0xbc, 0xb6, 0x6e, 0x71, 0x46, 0x3f, 0x69, 0x00 + }; + unsigned char x_dst[57], buff[114]; + ECX_KEY *key; + unsigned char *privkey = NULL, *pubkey; + EVP_MD_CTX *hashctx = NULL; + + key = OPENSSL_zalloc(sizeof(*key)); + if (key == NULL) { + ECerr(EC_F_S390X_PKEY_ECD_KEYGEN448, ERR_R_MALLOC_FAILURE); + goto err; + } + + pubkey = key->pubkey; + + privkey = key->privkey = OPENSSL_secure_malloc(ED448_KEYLEN); + if (privkey == NULL) { + ECerr(EC_F_S390X_PKEY_ECD_KEYGEN448, ERR_R_MALLOC_FAILURE); + goto err; + } + + if (RAND_priv_bytes(privkey, ED448_KEYLEN) <= 0) + goto err; + + hashctx = EVP_MD_CTX_new(); + if (hashctx == NULL) + goto err; + if (EVP_DigestInit_ex(hashctx, EVP_shake256(), NULL) != 1) + goto err; + if (EVP_DigestUpdate(hashctx, privkey, 57) != 1) + goto err; + if (EVP_DigestFinalXOF(hashctx, buff, sizeof(buff)) != 1) + goto err; + + buff[0] &= -4; + buff[55] |= 0x80; + buff[56] = 0; + + if (s390x_ed448_mul(x_dst, pubkey, + generator_x, generator_y, buff) != 1) + goto err; + + pubkey[56] |= ((x_dst[0] & 0x01) << 7); + + EVP_PKEY_assign(pkey, ctx->pmeth->pkey_id, key); + EVP_MD_CTX_free(hashctx); + return 1; + err: + OPENSSL_secure_clear_free(privkey, ED448_KEYLEN); + key->privkey = NULL; + OPENSSL_free(key); + EVP_MD_CTX_free(hashctx); + return 0; +} + +static int s390x_pkey_ecx_derive25519(EVP_PKEY_CTX *ctx, unsigned char *key, + size_t *keylen) +{ + const unsigned char *privkey, *pubkey; + + if (!validate_ecx_derive(ctx, key, keylen, &privkey, &pubkey)) + return 0; + + if (key != NULL) + return s390x_x25519_mul(key, pubkey, privkey); + + *keylen = X25519_KEYLEN; + return 1; +} + +static int s390x_pkey_ecx_derive448(EVP_PKEY_CTX *ctx, unsigned char *key, + size_t *keylen) +{ + const unsigned char *privkey, *pubkey; + + if (!validate_ecx_derive(ctx, key, keylen, &privkey, &pubkey)) + return 0; + + if (key != NULL) + return s390x_x448_mul(key, pubkey, privkey); + + *keylen = X448_KEYLEN; + return 1; +} + +static int s390x_pkey_ecd_digestsign25519(EVP_MD_CTX *ctx, + unsigned char *sig, size_t *siglen, + const unsigned char *tbs, + size_t tbslen) +{ + union { + struct { + unsigned char sig[64]; + unsigned char priv[32]; + } ed25519; + unsigned long long buff[512]; + } param; + const ECX_KEY *edkey = EVP_MD_CTX_pkey_ctx(ctx)->pkey->pkey.ecx; + int rc; + + if (sig == NULL) { + *siglen = ED25519_SIGSIZE; + return 1; + } + + if (*siglen < ED25519_SIGSIZE) { + ECerr(EC_F_S390X_PKEY_ECD_DIGESTSIGN25519, EC_R_BUFFER_TOO_SMALL); + return 0; + } + + memset(¶m, 0, sizeof(param)); + memcpy(param.ed25519.priv, edkey->privkey, sizeof(param.ed25519.priv)); + + rc = s390x_kdsa(S390X_EDDSA_SIGN_ED25519, ¶m.ed25519, tbs, tbslen); + OPENSSL_cleanse(param.ed25519.priv, sizeof(param.ed25519.priv)); + if (rc != 0) + return 0; + + s390x_flip_endian32(sig, param.ed25519.sig); + s390x_flip_endian32(sig + 32, param.ed25519.sig + 32); + + *siglen = ED25519_SIGSIZE; + return 1; +} + +static int s390x_pkey_ecd_digestsign448(EVP_MD_CTX *ctx, + unsigned char *sig, size_t *siglen, + const unsigned char *tbs, + size_t tbslen) +{ + union { + struct { + unsigned char sig[128]; + unsigned char priv[64]; + } ed448; + unsigned long long buff[512]; + } param; + const ECX_KEY *edkey = EVP_MD_CTX_pkey_ctx(ctx)->pkey->pkey.ecx; + int rc; + + if (sig == NULL) { + *siglen = ED448_SIGSIZE; + return 1; + } + + if (*siglen < ED448_SIGSIZE) { + ECerr(EC_F_S390X_PKEY_ECD_DIGESTSIGN448, EC_R_BUFFER_TOO_SMALL); + return 0; + } + + memset(¶m, 0, sizeof(param)); + memcpy(param.ed448.priv + 64 - 57, edkey->privkey, 57); + + rc = s390x_kdsa(S390X_EDDSA_SIGN_ED448, ¶m.ed448, tbs, tbslen); + OPENSSL_cleanse(param.ed448.priv, sizeof(param.ed448.priv)); + if (rc != 0) + return 0; + + s390x_flip_endian64(param.ed448.sig, param.ed448.sig); + s390x_flip_endian64(param.ed448.sig + 64, param.ed448.sig + 64); + memcpy(sig, param.ed448.sig, 57); + memcpy(sig + 57, param.ed448.sig + 64, 57); + + *siglen = ED448_SIGSIZE; + return 1; +} + +static int s390x_pkey_ecd_digestverify25519(EVP_MD_CTX *ctx, + const unsigned char *sig, + size_t siglen, + const unsigned char *tbs, + size_t tbslen) +{ + union { + struct { + unsigned char sig[64]; + unsigned char pub[32]; + } ed25519; + unsigned long long buff[512]; + } param; + const ECX_KEY *edkey = EVP_MD_CTX_pkey_ctx(ctx)->pkey->pkey.ecx; + + if (siglen != ED25519_SIGSIZE) + return 0; + + memset(¶m, 0, sizeof(param)); + s390x_flip_endian32(param.ed25519.sig, sig); + s390x_flip_endian32(param.ed25519.sig + 32, sig + 32); + s390x_flip_endian32(param.ed25519.pub, edkey->pubkey); + + return s390x_kdsa(S390X_EDDSA_VERIFY_ED25519, + ¶m.ed25519, tbs, tbslen) == 0 ? 1 : 0; +} + +static int s390x_pkey_ecd_digestverify448(EVP_MD_CTX *ctx, + const unsigned char *sig, + size_t siglen, + const unsigned char *tbs, + size_t tbslen) +{ + union { + struct { + unsigned char sig[128]; + unsigned char pub[64]; + } ed448; + unsigned long long buff[512]; + } param; + const ECX_KEY *edkey = EVP_MD_CTX_pkey_ctx(ctx)->pkey->pkey.ecx; + + if (siglen != ED448_SIGSIZE) + return 0; + + memset(¶m, 0, sizeof(param)); + memcpy(param.ed448.sig, sig, 57); + s390x_flip_endian64(param.ed448.sig, param.ed448.sig); + memcpy(param.ed448.sig + 64, sig + 57, 57); + s390x_flip_endian64(param.ed448.sig + 64, param.ed448.sig + 64); + memcpy(param.ed448.pub, edkey->pubkey, 57); + s390x_flip_endian64(param.ed448.pub, param.ed448.pub); + + return s390x_kdsa(S390X_EDDSA_VERIFY_ED448, + ¶m.ed448, tbs, tbslen) == 0 ? 1 : 0; +} + +static const EVP_PKEY_METHOD ecx25519_s390x_pkey_meth = { + EVP_PKEY_X25519, + 0, 0, 0, 0, 0, 0, 0, + s390x_pkey_ecx_keygen25519, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + s390x_pkey_ecx_derive25519, + pkey_ecx_ctrl, + 0 +}; + +static const EVP_PKEY_METHOD ecx448_s390x_pkey_meth = { + EVP_PKEY_X448, + 0, 0, 0, 0, 0, 0, 0, + s390x_pkey_ecx_keygen448, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + s390x_pkey_ecx_derive448, + pkey_ecx_ctrl, + 0 +}; +static const EVP_PKEY_METHOD ed25519_s390x_pkey_meth = { + EVP_PKEY_ED25519, EVP_PKEY_FLAG_SIGCTX_CUSTOM, + 0, 0, 0, 0, 0, 0, + s390x_pkey_ecd_keygen25519, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + pkey_ecd_ctrl, + 0, + s390x_pkey_ecd_digestsign25519, + s390x_pkey_ecd_digestverify25519 +}; + +static const EVP_PKEY_METHOD ed448_s390x_pkey_meth = { + EVP_PKEY_ED448, EVP_PKEY_FLAG_SIGCTX_CUSTOM, + 0, 0, 0, 0, 0, 0, + s390x_pkey_ecd_keygen448, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + pkey_ecd_ctrl, + 0, + s390x_pkey_ecd_digestsign448, + s390x_pkey_ecd_digestverify448 +}; +#endif + +const EVP_PKEY_METHOD *ecx25519_pkey_method(void) +{ +#ifdef S390X_EC_ASM + if (OPENSSL_s390xcap_P.pcc[1] & S390X_CAPBIT(S390X_SCALAR_MULTIPLY_X25519)) + return &ecx25519_s390x_pkey_meth; +#endif + return &ecx25519_pkey_meth; +} + +const EVP_PKEY_METHOD *ecx448_pkey_method(void) +{ +#ifdef S390X_EC_ASM + if (OPENSSL_s390xcap_P.pcc[1] & S390X_CAPBIT(S390X_SCALAR_MULTIPLY_X448)) + return &ecx448_s390x_pkey_meth; +#endif + return &ecx448_pkey_meth; +} + +const EVP_PKEY_METHOD *ed25519_pkey_method(void) +{ +#ifdef S390X_EC_ASM + if (OPENSSL_s390xcap_P.pcc[1] & S390X_CAPBIT(S390X_SCALAR_MULTIPLY_ED25519) + && OPENSSL_s390xcap_P.kdsa[0] & S390X_CAPBIT(S390X_EDDSA_SIGN_ED25519) + && OPENSSL_s390xcap_P.kdsa[0] + & S390X_CAPBIT(S390X_EDDSA_VERIFY_ED25519)) + return &ed25519_s390x_pkey_meth; +#endif + return &ed25519_pkey_meth; +} + +const EVP_PKEY_METHOD *ed448_pkey_method(void) +{ +#ifdef S390X_EC_ASM + if (OPENSSL_s390xcap_P.pcc[1] & S390X_CAPBIT(S390X_SCALAR_MULTIPLY_ED448) + && OPENSSL_s390xcap_P.kdsa[0] & S390X_CAPBIT(S390X_EDDSA_SIGN_ED448) + && OPENSSL_s390xcap_P.kdsa[0] & S390X_CAPBIT(S390X_EDDSA_VERIFY_ED448)) + return &ed448_s390x_pkey_meth; +#endif + return &ed448_pkey_meth; +} diff --git a/crypto/engine/README b/crypto/engine/README index c7a5696c..0f8a8fbd 100644 --- a/crypto/engine/README +++ b/crypto/engine/README @@ -9,7 +9,7 @@ for masochists" document *and* a rather extensive commit log message. (I'd get lynched for sticking all this in CHANGES or the commit mails :-). ENGINE_TABLE underlies this restructuring, as described in the internal header -"eng_int.h", implemented in eng_table.c, and used in each of the "class" files; +"eng_local.h", implemented in eng_table.c, and used in each of the "class" files; tb_rsa.c, tb_dsa.c, etc. However, "EVP_CIPHER" underlies the motivation and design of ENGINE_TABLE so diff --git a/crypto/engine/eng_all.c b/crypto/engine/eng_all.c index e1f09acd..0c5e4bdf 100644 --- a/crypto/engine/eng_all.c +++ b/crypto/engine/eng_all.c @@ -8,7 +8,7 @@ */ #include "internal/cryptlib.h" -#include "eng_int.h" +#include "eng_local.h" void ENGINE_load_builtin_engines(void) { diff --git a/crypto/engine/eng_cnf.c b/crypto/engine/eng_cnf.c index 9f647c4a..22198194 100644 --- a/crypto/engine/eng_cnf.c +++ b/crypto/engine/eng_cnf.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "eng_int.h" +#include "eng_local.h" #include #include diff --git a/crypto/engine/eng_ctrl.c b/crypto/engine/eng_ctrl.c index d036f80e..39cfb170 100644 --- a/crypto/engine/eng_ctrl.c +++ b/crypto/engine/eng_ctrl.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "eng_int.h" +#include "eng_local.h" /* * When querying a ENGINE-specific control command's 'description', this diff --git a/crypto/engine/eng_dyn.c b/crypto/engine/eng_dyn.c index bde76025..15504410 100644 --- a/crypto/engine/eng_dyn.c +++ b/crypto/engine/eng_dyn.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "eng_int.h" +#include "eng_local.h" #include "internal/dso.h" #include @@ -343,7 +343,7 @@ static int dynamic_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f) (void)) return 1; case DYNAMIC_CMD_DIR_ADD: /* a NULL 'p' or a string of zero-length is the same thing */ - if (!p || (strlen((const char *)p) < 1)) { + if (p == NULL || (strlen((const char *)p) < 1)) { ENGINEerr(ENGINE_F_DYNAMIC_CTRL, ENGINE_R_INVALID_ARGUMENT); return 0; } diff --git a/crypto/engine/eng_fat.c b/crypto/engine/eng_fat.c index e6938a41..428e6673 100644 --- a/crypto/engine/eng_fat.c +++ b/crypto/engine/eng_fat.c @@ -8,7 +8,7 @@ * https://www.openssl.org/source/license.html */ -#include "eng_int.h" +#include "eng_local.h" #include int ENGINE_set_default(ENGINE *e, unsigned int flags) diff --git a/crypto/engine/eng_init.c b/crypto/engine/eng_init.c index 6d74a2dd..34f01388 100644 --- a/crypto/engine/eng_init.c +++ b/crypto/engine/eng_init.c @@ -8,7 +8,7 @@ */ #include "e_os.h" -#include "eng_int.h" +#include "eng_local.h" /* * Initialise a engine type for use (or up its functional reference count if diff --git a/crypto/engine/eng_lib.c b/crypto/engine/eng_lib.c index be893fe5..4ba235ca 100644 --- a/crypto/engine/eng_lib.c +++ b/crypto/engine/eng_lib.c @@ -8,7 +8,7 @@ */ #include "e_os.h" -#include "eng_int.h" +#include "eng_local.h" #include #include "internal/refcount.h" diff --git a/crypto/engine/eng_list.c b/crypto/engine/eng_list.c index a0c56c50..7659231e 100644 --- a/crypto/engine/eng_list.c +++ b/crypto/engine/eng_list.c @@ -8,7 +8,7 @@ * https://www.openssl.org/source/license.html */ -#include "eng_int.h" +#include "eng_local.h" /* * The linked-list of pointers to engine types. engine_list_head incorporates diff --git a/crypto/engine/eng_int.h b/crypto/engine/eng_local.h similarity index 97% rename from crypto/engine/eng_int.h rename to crypto/engine/eng_local.h index d4561756..18629201 100644 --- a/crypto/engine/eng_int.h +++ b/crypto/engine/eng_local.h @@ -8,12 +8,12 @@ * https://www.openssl.org/source/license.html */ -#ifndef HEADER_ENGINE_INT_H -# define HEADER_ENGINE_INT_H +#ifndef OSSL_CRYPTO_ENGINE_ENG_LOCAL_H +# define OSSL_CRYPTO_ENGINE_ENG_LOCAL_H # include # include "internal/cryptlib.h" -# include "internal/engine.h" +# include "crypto/engine.h" # include "internal/thread_once.h" # include "internal/refcount.h" @@ -151,4 +151,4 @@ typedef struct st_engine_pile ENGINE_PILE; DEFINE_LHASH_OF(ENGINE_PILE); -#endif /* HEADER_ENGINE_INT_H */ +#endif /* OSSL_CRYPTO_ENGINE_ENG_LOCAL_H */ diff --git a/crypto/engine/eng_openssl.c b/crypto/engine/eng_openssl.c index debbb16a..b5c08783 100644 --- a/crypto/engine/eng_openssl.c +++ b/crypto/engine/eng_openssl.c @@ -11,7 +11,7 @@ #include #include #include "internal/cryptlib.h" -#include "internal/engine.h" +#include "crypto/engine.h" #include #include #include @@ -625,7 +625,8 @@ static int ossl_pkey_meths(ENGINE *e, EVP_PKEY_METHOD **pmeth, EVP_PKEY_HMAC, 0 }; - if (!pmeth) { + + if (pmeth == NULL) { *nids = ossl_pkey_nids; return 1; } diff --git a/crypto/engine/eng_pkey.c b/crypto/engine/eng_pkey.c index 7282d5dd..b8853df1 100644 --- a/crypto/engine/eng_pkey.c +++ b/crypto/engine/eng_pkey.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "eng_int.h" +#include "eng_local.h" /* Basic get/set stuff */ @@ -73,7 +73,7 @@ EVP_PKEY *ENGINE_load_private_key(ENGINE *e, const char *key_id, return 0; } pkey = e->load_privkey(e, key_id, ui_method, callback_data); - if (!pkey) { + if (pkey == NULL) { ENGINEerr(ENGINE_F_ENGINE_LOAD_PRIVATE_KEY, ENGINE_R_FAILED_LOADING_PRIVATE_KEY); return 0; @@ -103,7 +103,7 @@ EVP_PKEY *ENGINE_load_public_key(ENGINE *e, const char *key_id, return 0; } pkey = e->load_pubkey(e, key_id, ui_method, callback_data); - if (!pkey) { + if (pkey == NULL) { ENGINEerr(ENGINE_F_ENGINE_LOAD_PUBLIC_KEY, ENGINE_R_FAILED_LOADING_PUBLIC_KEY); return 0; diff --git a/crypto/engine/eng_rdrand.c b/crypto/engine/eng_rdrand.c index 7dd3b9fd..b6d1988d 100644 --- a/crypto/engine/eng_rdrand.c +++ b/crypto/engine/eng_rdrand.c @@ -11,7 +11,7 @@ #include #include -#include "internal/engine.h" +#include "crypto/engine.h" #include "internal/cryptlib.h" #include #include diff --git a/crypto/engine/eng_table.c b/crypto/engine/eng_table.c index 62e94168..dc85cdf5 100644 --- a/crypto/engine/eng_table.c +++ b/crypto/engine/eng_table.c @@ -11,7 +11,7 @@ #include #include #include -#include "eng_int.h" +#include "eng_local.h" /* The type of the items in the table */ struct st_engine_pile { @@ -27,7 +27,7 @@ struct st_engine_pile { int uptodate; }; -/* The type exposed in eng_int.h */ +/* The type exposed in eng_local.h */ struct st_engine_table { LHASH_OF(ENGINE_PILE) piles; }; /* ENGINE_TABLE */ @@ -77,7 +77,7 @@ static int int_table_check(ENGINE_TABLE **t, int create) } /* - * Privately exposed (via eng_int.h) functions for adding and/or removing + * Privately exposed (via eng_local.h) functions for adding and/or removing * ENGINEs from the implementation table */ int engine_table_register(ENGINE_TABLE **table, ENGINE_CLEANUP_CB *cleanup, @@ -170,7 +170,7 @@ void engine_table_unregister(ENGINE_TABLE **table, ENGINE *e) static void int_cleanup_cb_doall(ENGINE_PILE *p) { - if (!p) + if (p == NULL) return; sk_ENGINE_free(p->sk); if (p->funct) diff --git a/crypto/engine/tb_asnmth.c b/crypto/engine/tb_asnmth.c index 2f167c84..5e356312 100644 --- a/crypto/engine/tb_asnmth.c +++ b/crypto/engine/tb_asnmth.c @@ -8,9 +8,9 @@ */ #include "e_os.h" -#include "eng_int.h" +#include "eng_local.h" #include -#include "internal/asn1_int.h" +#include "crypto/asn1.h" /* * If this symbol is defined then ENGINE_get_pkey_asn1_meth_engine(), the diff --git a/crypto/engine/tb_cipher.c b/crypto/engine/tb_cipher.c index 8aa3be7e..c669907a 100644 --- a/crypto/engine/tb_cipher.c +++ b/crypto/engine/tb_cipher.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "eng_int.h" +#include "eng_local.h" static ENGINE_TABLE *cipher_table = NULL; diff --git a/crypto/engine/tb_dh.c b/crypto/engine/tb_dh.c index 5e2824ae..e877fce2 100644 --- a/crypto/engine/tb_dh.c +++ b/crypto/engine/tb_dh.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "eng_int.h" +#include "eng_local.h" static ENGINE_TABLE *dh_table = NULL; static const int dummy_nid = 1; diff --git a/crypto/engine/tb_digest.c b/crypto/engine/tb_digest.c index 4221f6d8..8a5a8332 100644 --- a/crypto/engine/tb_digest.c +++ b/crypto/engine/tb_digest.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "eng_int.h" +#include "eng_local.h" static ENGINE_TABLE *digest_table = NULL; diff --git a/crypto/engine/tb_dsa.c b/crypto/engine/tb_dsa.c index 15492d56..a22e8f69 100644 --- a/crypto/engine/tb_dsa.c +++ b/crypto/engine/tb_dsa.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "eng_int.h" +#include "eng_local.h" static ENGINE_TABLE *dsa_table = NULL; static const int dummy_nid = 1; diff --git a/crypto/engine/tb_eckey.c b/crypto/engine/tb_eckey.c index 8c662e7e..397dad88 100644 --- a/crypto/engine/tb_eckey.c +++ b/crypto/engine/tb_eckey.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "eng_int.h" +#include "eng_local.h" static ENGINE_TABLE *dh_table = NULL; static const int dummy_nid = 1; diff --git a/crypto/engine/tb_pkmeth.c b/crypto/engine/tb_pkmeth.c index 4dab5d59..beb4fd73 100644 --- a/crypto/engine/tb_pkmeth.c +++ b/crypto/engine/tb_pkmeth.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "eng_int.h" +#include "eng_local.h" #include static ENGINE_TABLE *pkey_meth_table = NULL; diff --git a/crypto/engine/tb_rand.c b/crypto/engine/tb_rand.c index 3b1b4751..d7c7ef48 100644 --- a/crypto/engine/tb_rand.c +++ b/crypto/engine/tb_rand.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "eng_int.h" +#include "eng_local.h" static ENGINE_TABLE *rand_table = NULL; static const int dummy_nid = 1; diff --git a/crypto/engine/tb_rsa.c b/crypto/engine/tb_rsa.c index 02c309a3..5b7d6717 100644 --- a/crypto/engine/tb_rsa.c +++ b/crypto/engine/tb_rsa.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "eng_int.h" +#include "eng_local.h" static ENGINE_TABLE *rsa_table = NULL; static const int dummy_nid = 1; diff --git a/crypto/err/err.c b/crypto/err/err.c index 6ad995d6..b636473b 100644 --- a/crypto/err/err.c +++ b/crypto/err/err.c @@ -13,19 +13,19 @@ #include #include #include -#include "internal/cryptlib_int.h" +#include "crypto/cryptlib.h" #include "internal/err.h" -#include "internal/err_int.h" +#include "crypto/err.h" #include #include #include #include #include #include "internal/thread_once.h" -#include "internal/ctype.h" -#include "internal/constant_time_locl.h" +#include "crypto/ctype.h" +#include "internal/constant_time.h" #include "e_os.h" -#include "err_locl.h" +#include "err_local.h" /* Forward declaration in case it's not published because of configuration */ ERR_STATE *ERR_get_state(void); @@ -533,35 +533,30 @@ static unsigned long get_error_values(ERR_GET_ACTION g, es->err_buffer[i] = 0; } - if (file != NULL && line != NULL) { - if (es->err_file[i] == NULL) { - *file = "NA"; - *line = 0; - } else { - *file = es->err_file[i]; - *line = es->err_line[i]; - } + if (file != NULL) { + *file = es->err_file[i]; + if (*file == NULL) + *file = ""; } - + if (line != NULL) + *line = es->err_line[i]; if (func != NULL) { *func = es->err_func[i]; if (*func == NULL) - *func = "N/A"; + *func = ""; } - + if (flags != NULL) + *flags = es->err_data_flags[i]; if (data == NULL) { if (g == EV_POP) { err_clear_data(es, i, 0); } } else { - if (es->err_data[i] == NULL) { + *data = es->err_data[i]; + if (*data == NULL) { *data = ""; if (flags != NULL) *flags = 0; - } else { - *data = es->err_data[i]; - if (flags != NULL) - *flags = es->err_data_flags[i]; } } return ret; @@ -646,7 +641,7 @@ const char *ERR_reason_error_string(unsigned long e) r = ERR_GET_REASON(e); d.error = ERR_PACK(l, 0, r); p = int_err_get_item(&d); - if (!p) { + if (p == NULL) { d.error = ERR_PACK(0, 0, r); p = int_err_get_item(&d); } diff --git a/crypto/err/err_all.c b/crypto/err/err_all.c index 972421f4..13bef4a7 100644 --- a/crypto/err/err_all.c +++ b/crypto/err/err_all.c @@ -8,7 +8,7 @@ */ #include -#include "internal/err_int.h" +#include "crypto/err.h" #include #include #include @@ -41,7 +41,7 @@ #include #include #include "internal/propertyerr.h" -#include "internal/providercommonerr.h" +#include "prov/providercommonerr.h" int err_load_crypto_strings_int(void) { diff --git a/crypto/err/err_blocks.c b/crypto/err/err_blocks.c index e50f580b..20888e95 100644 --- a/crypto/err/err_blocks.c +++ b/crypto/err/err_blocks.c @@ -12,7 +12,7 @@ #include #include -#include "err_locl.h" +#include "err_local.h" void ERR_new(void) { diff --git a/crypto/err/err_locl.h b/crypto/err/err_local.h similarity index 100% rename from crypto/err/err_locl.h rename to crypto/err/err_local.h diff --git a/crypto/err/err_prn.c b/crypto/err/err_prn.c index 1e1531b9..27e987e0 100644 --- a/crypto/err/err_prn.c +++ b/crypto/err/err_prn.c @@ -15,7 +15,7 @@ #include #include #include -#include "err_locl.h" +#include "err_local.h" void ERR_print_errors_cb(int (*cb) (const char *str, size_t len, void *u), void *u) diff --git a/crypto/err/openssl.ec b/crypto/err/openssl.ec index 925ed65b..65633717 100644 --- a/crypto/err/openssl.ec +++ b/crypto/err/openssl.ec @@ -35,18 +35,18 @@ L CMP include/openssl/cmp.h crypto/cmp/cmp_err.c L CT include/openssl/ct.h crypto/ct/ct_err.c L ASYNC include/openssl/async.h crypto/async/async_err.c L KDF include/openssl/kdf.h crypto/kdf/kdf_err.c -L SM2 crypto/include/internal/sm2.h crypto/sm2/sm2_err.c +L SM2 include/crypto/sm2.h crypto/sm2/sm2_err.c L OSSL_STORE include/openssl/store.h crypto/store/store_err.c L ESS include/openssl/ess.h crypto/ess/ess_err.c L PROP include/internal/property.h crypto/property/property_err.c -L PROV providers/common/include/internal/providercommon.h providers/common/provider_err.c +L PROV providers/common/include/prov/providercommon.h providers/common/provider_err.c # additional header files to be scanned for function names L NONE include/openssl/x509_vfy.h NONE -L NONE crypto/ec/ec_lcl.h NONE -L NONE crypto/cms/cms_lcl.h NONE -L NONE crypto/ct/ct_locl.h NONE -L NONE ssl/ssl_locl.h NONE +L NONE crypto/ec/ec_local.h NONE +L NONE crypto/cms/cms_local.h NONE +L NONE crypto/ct/ct_local.h NONE +L NONE ssl/ssl_local.h NONE # SSL/TLS alerts R SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE 1010 diff --git a/crypto/err/openssl.txt b/crypto/err/openssl.txt index fc9001fb..004bc7f2 100644 --- a/crypto/err/openssl.txt +++ b/crypto/err/openssl.txt @@ -737,6 +737,12 @@ EC_F_PKEY_EC_KDF_DERIVE:283:pkey_ec_kdf_derive EC_F_PKEY_EC_KEYGEN:199:pkey_ec_keygen EC_F_PKEY_EC_PARAMGEN:219:pkey_ec_paramgen EC_F_PKEY_EC_SIGN:218:pkey_ec_sign +EC_F_S390X_PKEY_ECD_DIGESTSIGN25519:303:s390x_pkey_ecd_digestsign25519 +EC_F_S390X_PKEY_ECD_DIGESTSIGN448:304:s390x_pkey_ecd_digestsign448 +EC_F_S390X_PKEY_ECD_KEYGEN25519:305:s390x_pkey_ecd_keygen25519 +EC_F_S390X_PKEY_ECD_KEYGEN448:306:s390x_pkey_ecd_keygen448 +EC_F_S390X_PKEY_ECX_KEYGEN25519:307:s390x_pkey_ecx_keygen25519 +EC_F_S390X_PKEY_ECX_KEYGEN448:308:s390x_pkey_ecx_keygen448 EC_F_VALIDATE_ECX_DERIVE:278:validate_ecx_derive ENGINE_F_DIGEST_UPDATE:198:digest_update ENGINE_F_DYNAMIC_CTRL:180:dynamic_ctrl @@ -2057,6 +2063,10 @@ BN_R_PRIVATE_KEY_TOO_LARGE:117:private key too large BN_R_P_IS_NOT_PRIME:112:p is not prime BN_R_TOO_MANY_ITERATIONS:113:too many iterations BN_R_TOO_MANY_TEMPORARY_VARIABLES:109:too many temporary variables +CMP_R_INVALID_ARGS:100:invalid args +CMP_R_MULTIPLE_SAN_SOURCES:102:multiple san sources +CMP_R_NO_STDIO:194:no stdio +CMP_R_NULL_ARGUMENT:103:null argument CMS_R_ADD_SIGNER_ERROR:99:add signer error CMS_R_ATTRIBUTE_ERROR:161:attribute error CMS_R_CERTIFICATE_ALREADY_PRESENT:175:certificate already present @@ -2384,6 +2394,7 @@ ESS_R_ESS_SIGNING_CERT_ADD_ERROR:100:ess signing cert add error ESS_R_ESS_SIGNING_CERT_V2_ADD_ERROR:101:ess signing cert v2 add error EVP_R_AES_KEY_SETUP_FAILED:143:aes key setup failed EVP_R_ARIA_KEY_SETUP_FAILED:176:aria key setup failed +EVP_R_BAD_ALGORITHM_NAME:200:bad algorithm name EVP_R_BAD_DECRYPT:100:bad decrypt EVP_R_BAD_KEY_LENGTH:195:bad key length EVP_R_BUFFER_TOO_SMALL:155:buffer too small @@ -2393,6 +2404,7 @@ EVP_R_CANNOT_SET_PARAMETERS:198:cannot set parameters EVP_R_CIPHER_NOT_GCM_MODE:184:cipher not gcm mode EVP_R_CIPHER_PARAMETER_ERROR:122:cipher parameter error EVP_R_COMMAND_NOT_SUPPORTED:147:command not supported +EVP_R_CONFLICTING_ALGORITHM_NAME:201:conflicting algorithm name EVP_R_COPY_ERROR:173:copy error EVP_R_CTRL_NOT_IMPLEMENTED:132:ctrl not implemented EVP_R_CTRL_OPERATION_NOT_IMPLEMENTED:133:ctrl operation not implemented @@ -2678,13 +2690,16 @@ PROV_R_INVALID_IV_LENGTH:109:invalid iv length PROV_R_INVALID_KEYLEN:117:invalid keylen PROV_R_INVALID_KEY_LEN:124:invalid key len PROV_R_INVALID_KEY_LENGTH:105:invalid key length +PROV_R_INVALID_MAC:151:invalid mac PROV_R_INVALID_MODE:125:invalid mode PROV_R_INVALID_MODE_INT:126:invalid mode int PROV_R_INVALID_SALT_LENGTH:112:invalid salt length +PROV_R_INVALID_SEED_LENGTH:154:invalid seed length PROV_R_INVALID_TAG:110:invalid tag PROV_R_INVALID_TAGLEN:118:invalid taglen PROV_R_MISSING_CEK_ALG:144:missing cek alg PROV_R_MISSING_KEY:128:missing key +PROV_R_MISSING_MAC:150:missing mac PROV_R_MISSING_MESSAGE_DIGEST:129:missing message digest PROV_R_MISSING_PASS:130:missing pass PROV_R_MISSING_SALT:131:missing salt @@ -2702,7 +2717,9 @@ PROV_R_TAG_NOT_NEEDED:120:tag not needed PROV_R_UNABLE_TO_LOAD_SHA1:143:unable to load sha1 PROV_R_UNABLE_TO_LOAD_SHA256:147:unable to load sha256 PROV_R_UNSUPPORTED_CEK_ALG:145:unsupported cek alg +PROV_R_UNSUPPORTED_KEY_SIZE:153:unsupported key size PROV_R_UNSUPPORTED_MAC_TYPE:137:unsupported mac type +PROV_R_UNSUPPORTED_NUMBER_OF_ROUNDS:152:unsupported number of rounds PROV_R_VALUE_ERROR:138:value error PROV_R_WRONG_FINAL_BLOCK_LENGTH:107:wrong final block length PROV_R_WRONG_OUTPUT_BUFFER_SIZE:139:wrong output buffer size diff --git a/crypto/err/openssl.txt.old b/crypto/err/openssl.txt.old index 700f1da2..46d2eaa2 100644 --- a/crypto/err/openssl.txt.old +++ b/crypto/err/openssl.txt.old @@ -737,6 +737,12 @@ EC_F_PKEY_EC_KDF_DERIVE:283:pkey_ec_kdf_derive EC_F_PKEY_EC_KEYGEN:199:pkey_ec_keygen EC_F_PKEY_EC_PARAMGEN:219:pkey_ec_paramgen EC_F_PKEY_EC_SIGN:218:pkey_ec_sign +EC_F_S390X_PKEY_ECD_DIGESTSIGN25519:303:s390x_pkey_ecd_digestsign25519 +EC_F_S390X_PKEY_ECD_DIGESTSIGN448:304:s390x_pkey_ecd_digestsign448 +EC_F_S390X_PKEY_ECD_KEYGEN25519:305:s390x_pkey_ecd_keygen25519 +EC_F_S390X_PKEY_ECD_KEYGEN448:306:s390x_pkey_ecd_keygen448 +EC_F_S390X_PKEY_ECX_KEYGEN25519:307:s390x_pkey_ecx_keygen25519 +EC_F_S390X_PKEY_ECX_KEYGEN448:308:s390x_pkey_ecx_keygen448 EC_F_VALIDATE_ECX_DERIVE:278:validate_ecx_derive ENGINE_F_DIGEST_UPDATE:198:digest_update ENGINE_F_DYNAMIC_CTRL:180:dynamic_ctrl @@ -2057,6 +2063,10 @@ BN_R_PRIVATE_KEY_TOO_LARGE:117:private key too large BN_R_P_IS_NOT_PRIME:112:p is not prime BN_R_TOO_MANY_ITERATIONS:113:too many iterations BN_R_TOO_MANY_TEMPORARY_VARIABLES:109:too many temporary variables +CMP_R_INVALID_ARGS:100:invalid args +CMP_R_MULTIPLE_SAN_SOURCES:102:multiple san sources +CMP_R_NO_STDIO:194:no stdio +CMP_R_NULL_ARGUMENT:103:null argument CMS_R_ADD_SIGNER_ERROR:99:add signer error CMS_R_ATTRIBUTE_ERROR:161:attribute error CMS_R_CERTIFICATE_ALREADY_PRESENT:175:certificate already present @@ -2384,6 +2394,7 @@ ESS_R_ESS_SIGNING_CERT_ADD_ERROR:100:ess signing cert add error ESS_R_ESS_SIGNING_CERT_V2_ADD_ERROR:101:ess signing cert v2 add error EVP_R_AES_KEY_SETUP_FAILED:143:aes key setup failed EVP_R_ARIA_KEY_SETUP_FAILED:176:aria key setup failed +EVP_R_BAD_ALGORITHM_NAME:200:bad algorithm name EVP_R_BAD_DECRYPT:100:bad decrypt EVP_R_BAD_KEY_LENGTH:195:bad key length EVP_R_BUFFER_TOO_SMALL:155:buffer too small @@ -2393,6 +2404,7 @@ EVP_R_CANNOT_SET_PARAMETERS:198:cannot set parameters EVP_R_CIPHER_NOT_GCM_MODE:184:cipher not gcm mode EVP_R_CIPHER_PARAMETER_ERROR:122:cipher parameter error EVP_R_COMMAND_NOT_SUPPORTED:147:command not supported +EVP_R_CONFLICTING_ALGORITHM_NAME:201:conflicting algorithm name EVP_R_COPY_ERROR:173:copy error EVP_R_CTRL_NOT_IMPLEMENTED:132:ctrl not implemented EVP_R_CTRL_OPERATION_NOT_IMPLEMENTED:133:ctrl operation not implemented @@ -2678,13 +2690,16 @@ PROV_R_INVALID_IV_LENGTH:109:invalid iv length PROV_R_INVALID_KEYLEN:117:invalid keylen PROV_R_INVALID_KEY_LEN:124:invalid key len PROV_R_INVALID_KEY_LENGTH:105:invalid key length +PROV_R_INVALID_MAC:151:invalid mac PROV_R_INVALID_MODE:125:invalid mode PROV_R_INVALID_MODE_INT:126:invalid mode int PROV_R_INVALID_SALT_LENGTH:112:invalid salt length +PROV_R_INVALID_SEED_LENGTH:154:invalid seed length PROV_R_INVALID_TAG:110:invalid tag PROV_R_INVALID_TAGLEN:118:invalid taglen PROV_R_MISSING_CEK_ALG:144:missing cek alg PROV_R_MISSING_KEY:128:missing key +PROV_R_MISSING_MAC:150:missing mac PROV_R_MISSING_MESSAGE_DIGEST:129:missing message digest PROV_R_MISSING_PASS:130:missing pass PROV_R_MISSING_SALT:131:missing salt @@ -2702,7 +2717,9 @@ PROV_R_TAG_NOT_NEEDED:120:tag not needed PROV_R_UNABLE_TO_LOAD_SHA1:143:unable to load sha1 PROV_R_UNABLE_TO_LOAD_SHA256:147:unable to load sha256 PROV_R_UNSUPPORTED_CEK_ALG:145:unsupported cek alg +PROV_R_UNSUPPORTED_KEY_SIZE:153:unsupported key size PROV_R_UNSUPPORTED_MAC_TYPE:137:unsupported mac type +PROV_R_UNSUPPORTED_NUMBER_OF_ROUNDS:152:unsupported number of rounds PROV_R_VALUE_ERROR:138:value error PROV_R_WRONG_FINAL_BLOCK_LENGTH:107:wrong final block length PROV_R_WRONG_OUTPUT_BUFFER_SIZE:139:wrong output buffer size diff --git a/crypto/ess/ess_asn1.c b/crypto/ess/ess_asn1.c index 0ea08e86..19589d97 100644 --- a/crypto/ess/ess_asn1.c +++ b/crypto/ess/ess_asn1.c @@ -11,7 +11,7 @@ #include #include #include -#include "internal/ess_int.h" +#include "crypto/ess.h" /* ASN1 stuff for ESS Structure */ diff --git a/crypto/ess/ess_lib.c b/crypto/ess/ess_lib.c index fa9cff18..17c0ea56 100644 --- a/crypto/ess/ess_lib.c +++ b/crypto/ess/ess_lib.c @@ -11,7 +11,7 @@ #include #include #include -#include "internal/ess_int.h" +#include "crypto/ess.h" static ESS_CERT_ID *ESS_CERT_ID_new_init(X509 *cert, int issuer_needed); static ESS_CERT_ID_V2 *ESS_CERT_ID_V2_new_init(const EVP_MD *hash_alg, diff --git a/crypto/evp/bio_md.c b/crypto/evp/bio_md.c index 9dd3ac42..aca177e9 100644 --- a/crypto/evp/bio_md.c +++ b/crypto/evp/bio_md.c @@ -9,11 +9,8 @@ #include #include -#include "internal/cryptlib.h" #include #include -#include "internal/evp_int.h" -#include "evp_locl.h" #include "internal/bio.h" /* @@ -148,7 +145,7 @@ static long md_ctrl(BIO *b, int cmd, long num, void *ptr) switch (cmd) { case BIO_CTRL_RESET: if (BIO_get_init(b)) - ret = EVP_DigestInit_ex(ctx, ctx->digest, NULL); + ret = EVP_DigestInit_ex(ctx, EVP_MD_CTX_md(ctx), NULL); else ret = 0; if (ret > 0) @@ -157,7 +154,7 @@ static long md_ctrl(BIO *b, int cmd, long num, void *ptr) case BIO_C_GET_MD: if (BIO_get_init(b)) { ppmd = ptr; - *ppmd = ctx->digest; + *ppmd = EVP_MD_CTX_md(ctx); } else ret = 0; break; @@ -223,7 +220,7 @@ static int md_gets(BIO *bp, char *buf, int size) ctx = BIO_get_data(bp); - if (size < ctx->digest->md_size) + if (size < EVP_MD_CTX_size(ctx)) return 0; if (EVP_DigestFinal_ex(ctx, (unsigned char *)buf, &ret) <= 0) diff --git a/crypto/evp/bio_ok.c b/crypto/evp/bio_ok.c index 7f99f325..f9488282 100644 --- a/crypto/evp/bio_ok.c +++ b/crypto/evp/bio_ok.c @@ -76,7 +76,7 @@ #include "internal/bio.h" #include #include -#include "internal/evp_int.h" +#include "crypto/evp.h" static int ok_write(BIO *h, const char *buf, int num); static int ok_read(BIO *h, char *buf, int size); diff --git a/crypto/evp/build.info b/crypto/evp/build.info index d9df7195..f2c798b7 100644 --- a/crypto/evp/build.info +++ b/crypto/evp/build.info @@ -1,23 +1,38 @@ LIBS=../../libcrypto $COMMON=digest.c evp_enc.c evp_lib.c evp_fetch.c cmeth_lib.c evp_utils.c \ - mac_lib.c mac_meth.c keymgmt_meth.c keymgmt_lib.c kdf_lib.c kdf_meth.c + mac_lib.c mac_meth.c keymgmt_meth.c keymgmt_lib.c kdf_lib.c kdf_meth.c \ + m_sigver.c SOURCE[../../libcrypto]=$COMMON\ encode.c evp_key.c evp_cnf.c \ e_des.c e_bf.c e_idea.c e_des3.c e_camellia.c\ e_rc4.c e_aes.c names.c e_seed.c e_aria.c e_sm4.c \ e_xcbc_d.c e_rc2.c e_cast.c e_rc5.c \ - m_null.c m_md2.c m_md4.c m_md5.c m_sha1.c m_wp.c \ - m_md5_sha1.c m_mdc2.c m_ripemd.c m_sha3.c \ + m_null.c m_wp.c m_ripemd.c \ p_open.c p_seal.c p_sign.c p_verify.c p_lib.c p_enc.c p_dec.c \ bio_md.c bio_b64.c bio_enc.c evp_err.c e_null.c \ c_allc.c c_alld.c bio_ok.c \ evp_pkey.c evp_pbe.c p5_crpt.c p5_crpt2.c pbe_scrypt.c \ pkey_kdf.c \ - e_old.c pmeth_lib.c pmeth_fn.c pmeth_gn.c m_sigver.c \ + e_old.c pmeth_lib.c pmeth_fn.c pmeth_gn.c \ e_aes_cbc_hmac_sha1.c e_aes_cbc_hmac_sha256.c e_rc4_hmac_md5.c \ e_chacha20_poly1305.c \ - pkey_mac.c exchange.c -SOURCE[../../providers/fips]=$COMMON + pkey_mac.c exchange.c \ + legacy_sha.c legacy_md5_sha1.c + +IF[{- !$disabled{md2} -}] + SOURCE[../../libcrypto]=legacy_md2.c +ENDIF +IF[{- !$disabled{md4} -}] + SOURCE[../../libcrypto]=legacy_md4.c +ENDIF +IF[{- !$disabled{md5} -}] + SOURCE[../../libcrypto]=legacy_md5.c +ENDIF +IF[{- !$disabled{mdc2} -}] + SOURCE[../../libcrypto]=legacy_mdc2.c +ENDIF + +SOURCE[../../providers/libfips.a]=$COMMON INCLUDE[e_aes.o]=.. ../modes INCLUDE[e_aes_cbc_hmac_sha1.o]=../modes @@ -27,4 +42,3 @@ INCLUDE[e_camellia.o]=.. ../modes INCLUDE[e_sm4.o]=.. ../modes INCLUDE[e_des.o]=.. INCLUDE[e_des3.o]=.. -INCLUDE[m_sha3.o]=.. diff --git a/crypto/evp/c_allc.c b/crypto/evp/c_allc.c index 24112723..81bab72b 100644 --- a/crypto/evp/c_allc.c +++ b/crypto/evp/c_allc.c @@ -10,7 +10,7 @@ #include #include "internal/cryptlib.h" #include -#include "internal/evp_int.h" +#include "crypto/evp.h" #include #include diff --git a/crypto/evp/c_alld.c b/crypto/evp/c_alld.c index a0b2500d..f7d62bd2 100644 --- a/crypto/evp/c_alld.c +++ b/crypto/evp/c_alld.c @@ -10,7 +10,7 @@ #include #include "internal/cryptlib.h" #include -#include "internal/evp_int.h" +#include "crypto/evp.h" #include #include diff --git a/crypto/evp/cmeth_lib.c b/crypto/evp/cmeth_lib.c index ba61c525..37cca7a2 100644 --- a/crypto/evp/cmeth_lib.c +++ b/crypto/evp/cmeth_lib.c @@ -10,9 +10,9 @@ #include #include -#include "internal/evp_int.h" +#include "crypto/evp.h" #include "internal/provider.h" -#include "evp_locl.h" +#include "evp_local.h" EVP_CIPHER *EVP_CIPHER_meth_new(int cipher_type, int block_size, int key_len) { diff --git a/crypto/evp/digest.c b/crypto/evp/digest.c index 92012f91..11c334cc 100644 --- a/crypto/evp/digest.c +++ b/crypto/evp/digest.c @@ -14,9 +14,9 @@ #include #include #include "internal/cryptlib.h" -#include "internal/evp_int.h" +#include "crypto/evp.h" #include "internal/provider.h" -#include "evp_locl.h" +#include "evp_local.h" /* This call frees resources associated with the context */ int EVP_MD_CTX_reset(EVP_MD_CTX *ctx) @@ -24,8 +24,19 @@ int EVP_MD_CTX_reset(EVP_MD_CTX *ctx) if (ctx == NULL) return 1; - if (ctx->digest == NULL || ctx->digest->prov == NULL) - goto legacy; +#ifndef FIPS_MODE + /* TODO(3.0): Temporarily no support for EVP_DigestSign* in FIPS module */ + /* + * pctx should be freed by the user of EVP_MD_CTX + * if EVP_MD_CTX_FLAG_KEEP_PKEY_CTX is set + */ + if (!EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_KEEP_PKEY_CTX)) + EVP_PKEY_CTX_free(ctx->pctx); +#endif + + EVP_MD_free(ctx->fetched_digest); + ctx->fetched_digest = NULL; + ctx->reqdigest = NULL; if (ctx->provctx != NULL) { if (ctx->digest->freectx != NULL) @@ -34,13 +45,7 @@ int EVP_MD_CTX_reset(EVP_MD_CTX *ctx) EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_CLEANED); } - if (ctx->pctx != NULL) - goto legacy; - - return 1; - /* TODO(3.0): Remove legacy code below */ - legacy: /* * Don't assume ctx->md_data was cleaned in EVP_Digest_Final, because @@ -53,19 +58,13 @@ int EVP_MD_CTX_reset(EVP_MD_CTX *ctx) && !EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_REUSE)) { OPENSSL_clear_free(ctx->md_data, ctx->digest->ctx_size); } - /* - * pctx should be freed by the user of EVP_MD_CTX - * if EVP_MD_CTX_FLAG_KEEP_PKEY_CTX is set - */ -#ifndef FIPS_MODE - /* TODO(3.0): Temporarily no support for EVP_DigestSign* in FIPS module */ - if (!EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_KEEP_PKEY_CTX)) - EVP_PKEY_CTX_free(ctx->pctx); -# ifndef OPENSSL_NO_ENGINE +#if !defined(FIPS_MODE) && !defined(OPENSSL_NO_ENGINE) ENGINE_finish(ctx->engine); -# endif #endif + + /* TODO(3.0): End of legacy code */ + OPENSSL_cleanse(ctx, sizeof(*ctx)); return 1; @@ -81,23 +80,10 @@ void EVP_MD_CTX_free(EVP_MD_CTX *ctx) if (ctx == NULL) return; - if (ctx->digest == NULL || ctx->digest->prov == NULL) - goto legacy; - EVP_MD_CTX_reset(ctx); - EVP_MD_free(ctx->fetched_digest); - ctx->fetched_digest = NULL; - ctx->digest = NULL; - ctx->reqdigest = NULL; - OPENSSL_free(ctx); return; - - /* TODO(3.0): Remove legacy code below */ - legacy: - EVP_MD_CTX_reset(ctx); - OPENSSL_free(ctx); } int EVP_DigestInit(EVP_MD_CTX *ctx, const EVP_MD *type) @@ -114,6 +100,16 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl) EVP_MD_CTX_clear_flags(ctx, EVP_MD_CTX_FLAG_CLEANED); + if (ctx->provctx != NULL) { + if (!ossl_assert(ctx->digest != NULL)) { + EVPerr(EVP_F_EVP_DIGESTINIT_EX, EVP_R_INITIALIZATION_ERROR); + return 0; + } + if (ctx->digest->freectx != NULL) + ctx->digest->freectx(ctx->provctx); + ctx->provctx = NULL; + } + if (type != NULL) ctx->reqdigest = type; @@ -144,15 +140,14 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl) #endif /* - * If there are engines involved or if we're being used as part of - * EVP_DigestSignInit then we should use legacy handling for now. + * If there are engines involved or EVP_MD_CTX_FLAG_NO_INIT is set then we + * should use legacy handling for now. */ if (ctx->engine != NULL || impl != NULL #if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE) || tmpimpl != NULL #endif - || ctx->pctx != NULL || (ctx->flags & EVP_MD_CTX_FLAG_NO_INIT) != 0) { if (ctx->digest == ctx->fetched_digest) ctx->digest = NULL; @@ -290,6 +285,24 @@ int EVP_DigestUpdate(EVP_MD_CTX *ctx, const void *data, size_t count) if (count == 0) return 1; + if (ctx->pctx != NULL + && EVP_PKEY_CTX_IS_SIGNATURE_OP(ctx->pctx) + && ctx->pctx->op.sig.sigprovctx != NULL) { + /* + * Prior to OpenSSL 3.0 EVP_DigestSignUpdate() and + * EVP_DigestVerifyUpdate() were just macros for EVP_DigestUpdate(). + * Some code calls EVP_DigestUpdate() directly even when initialised + * with EVP_DigestSignInit_ex() or EVP_DigestVerifyInit_ex(), so we + * detect that and redirect to the correct EVP_Digest*Update() function + */ + if (ctx->pctx->operation == EVP_PKEY_OP_SIGNCTX) + return EVP_DigestSignUpdate(ctx, data, count); + if (ctx->pctx->operation == EVP_PKEY_OP_VERIFYCTX) + return EVP_DigestVerifyUpdate(ctx, data, count); + EVPerr(EVP_F_EVP_DIGESTUPDATE, EVP_R_UPDATE_ERROR); + return 0; + } + if (ctx->digest == NULL || ctx->digest->prov == NULL) goto legacy; @@ -339,7 +352,6 @@ int EVP_DigestFinal_ex(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *isize) } } - EVP_MD_CTX_reset(ctx); return ret; /* TODO(3.0): Remove legacy code below */ @@ -545,29 +557,92 @@ const OSSL_PARAM *EVP_MD_gettable_params(const EVP_MD *digest) int EVP_MD_CTX_set_params(EVP_MD_CTX *ctx, const OSSL_PARAM params[]) { + EVP_PKEY_CTX *pctx = ctx->pctx; + if (ctx->digest != NULL && ctx->digest->set_ctx_params != NULL) return ctx->digest->set_ctx_params(ctx->provctx, params); + + if (pctx != NULL + && (pctx->operation == EVP_PKEY_OP_VERIFYCTX + || pctx->operation == EVP_PKEY_OP_SIGNCTX) + && pctx->op.sig.sigprovctx != NULL + && pctx->op.sig.signature->set_ctx_md_params != NULL) + return pctx->op.sig.signature->set_ctx_md_params(pctx->op.sig.sigprovctx, + params); return 0; } -const OSSL_PARAM *EVP_MD_CTX_settable_params(const EVP_MD *digest) +const OSSL_PARAM *EVP_MD_settable_ctx_params(const EVP_MD *md) { - if (digest != NULL && digest->settable_ctx_params != NULL) - return digest->settable_ctx_params(); + if (md != NULL && md->settable_ctx_params != NULL) + return md->settable_ctx_params(); + return NULL; +} + +const OSSL_PARAM *EVP_MD_CTX_settable_params(EVP_MD_CTX *ctx) +{ + EVP_PKEY_CTX *pctx; + + if (ctx != NULL + && ctx->digest != NULL + && ctx->digest->settable_ctx_params != NULL) + return ctx->digest->settable_ctx_params(); + + pctx = ctx->pctx; + if (pctx != NULL + && (pctx->operation == EVP_PKEY_OP_VERIFYCTX + || pctx->operation == EVP_PKEY_OP_SIGNCTX) + && pctx->op.sig.sigprovctx != NULL + && pctx->op.sig.signature->settable_ctx_md_params != NULL) + return pctx->op.sig.signature->settable_ctx_md_params( + pctx->op.sig.sigprovctx); + return NULL; } int EVP_MD_CTX_get_params(EVP_MD_CTX *ctx, OSSL_PARAM params[]) { + EVP_PKEY_CTX *pctx = ctx->pctx; + if (ctx->digest != NULL && ctx->digest->get_params != NULL) return ctx->digest->get_ctx_params(ctx->provctx, params); + + if (pctx != NULL + && (pctx->operation == EVP_PKEY_OP_VERIFYCTX + || pctx->operation == EVP_PKEY_OP_SIGNCTX) + && pctx->op.sig.sigprovctx != NULL + && pctx->op.sig.signature->get_ctx_md_params != NULL) + return pctx->op.sig.signature->get_ctx_md_params(pctx->op.sig.sigprovctx, + params); + return 0; } -const OSSL_PARAM *EVP_MD_CTX_gettable_params(const EVP_MD *digest) +const OSSL_PARAM *EVP_MD_gettable_ctx_params(const EVP_MD *md) { - if (digest != NULL && digest->gettable_ctx_params != NULL) - return digest->gettable_ctx_params(); + if (md != NULL && md->gettable_ctx_params != NULL) + return md->gettable_ctx_params(); + return NULL; +} + +const OSSL_PARAM *EVP_MD_CTX_gettable_params(EVP_MD_CTX *ctx) +{ + EVP_PKEY_CTX *pctx; + + if (ctx != NULL + && ctx->digest != NULL + && ctx->digest->gettable_ctx_params != NULL) + return ctx->digest->gettable_ctx_params(); + + pctx = ctx->pctx; + if (pctx != NULL + && (pctx->operation == EVP_PKEY_OP_VERIFYCTX + || pctx->operation == EVP_PKEY_OP_SIGNCTX) + && pctx->op.sig.sigprovctx != NULL + && pctx->op.sig.signature->gettable_ctx_md_params != NULL) + return pctx->op.sig.signature->gettable_ctx_md_params( + pctx->op.sig.sigprovctx); + return NULL; } @@ -584,7 +659,10 @@ int EVP_MD_CTX_ctrl(EVP_MD_CTX *ctx, int cmd, int p1, void *p2) return 0; } - if (ctx->digest->prov == NULL) + if (ctx->digest->prov == NULL + && (ctx->pctx == NULL + || (ctx->pctx->operation != EVP_PKEY_OP_VERIFYCTX + && ctx->pctx->operation != EVP_PKEY_OP_SIGNCTX))) goto legacy; switch (cmd) { @@ -597,15 +675,19 @@ int EVP_MD_CTX_ctrl(EVP_MD_CTX *ctx, int cmd, int p1, void *p2) params[0] = OSSL_PARAM_construct_utf8_string(OSSL_DIGEST_PARAM_MICALG, p2, p1 ? p1 : 9999); break; + case EVP_CTRL_SSL3_MASTER_SECRET: + params[0] = OSSL_PARAM_construct_octet_string(OSSL_DIGEST_PARAM_SSL3_MS, + p2, p1); + break; default: - return EVP_CTRL_RET_UNSUPPORTED; + goto conclude; } if (set_params) - ret = evp_do_md_ctx_setparams(ctx->digest, ctx->provctx, params); + ret = EVP_MD_CTX_set_params(ctx, params); else - ret = evp_do_md_ctx_getparams(ctx->digest, ctx->provctx, params); - return ret; + ret = EVP_MD_CTX_get_params(ctx, params); + goto conclude; /* TODO(3.0): Remove legacy code below */ @@ -616,6 +698,7 @@ int EVP_MD_CTX_ctrl(EVP_MD_CTX *ctx, int cmd, int p1, void *p2) } ret = ctx->digest->md_ctrl(ctx, cmd, p1, p2); + conclude: if (ret <= 0) return 0; return ret; @@ -677,7 +760,7 @@ static void *evp_md_from_dispatch(int name_id, #ifndef FIPS_MODE /* TODO(3.x) get rid of the need for legacy NIDs */ md->type = NID_undef; - evp_doall_names(prov, name_id, set_legacy_nid, &md->type); + evp_names_do_all(prov, name_id, set_legacy_nid, &md->type); if (md->type == -1) { ERR_raise(ERR_LIB_EVP, ERR_R_INTERNAL_ERROR); EVP_MD_free(md); @@ -819,9 +902,9 @@ void EVP_MD_free(EVP_MD *md) OPENSSL_free(md); } -void EVP_MD_do_all_ex(OPENSSL_CTX *libctx, - void (*fn)(EVP_MD *mac, void *arg), - void *arg) +void EVP_MD_do_all_provided(OPENSSL_CTX *libctx, + void (*fn)(EVP_MD *mac, void *arg), + void *arg) { evp_generic_do_all(libctx, OSSL_OP_DIGEST, (void (*)(void *, void *))fn, arg, diff --git a/crypto/evp/e_aes.c b/crypto/evp/e_aes.c index 39ed5280..42c2e5eb 100644 --- a/crypto/evp/e_aes.c +++ b/crypto/evp/e_aes.c @@ -16,12 +16,12 @@ #include #include #include -#include "internal/evp_int.h" +#include "crypto/evp.h" #include "internal/cryptlib.h" -#include "internal/modes_int.h" -#include "internal/siv_int.h" -#include "internal/ciphermode_platform.h" -#include "evp_locl.h" +#include "crypto/modes.h" +#include "crypto/siv.h" +#include "crypto/ciphermode_platform.h" +#include "evp_local.h" typedef struct { union { @@ -3744,7 +3744,7 @@ static int aes_ocb_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr) return 1; case EVP_CTRL_AEAD_SET_TAG: - if (!ptr) { + if (ptr == NULL) { /* Tag len must be 0 to 16 */ if (arg < 0 || arg > 16) return 0; diff --git a/crypto/evp/e_aes_cbc_hmac_sha1.c b/crypto/evp/e_aes_cbc_hmac_sha1.c index 9e393f0b..6b9362a1 100644 --- a/crypto/evp/e_aes_cbc_hmac_sha1.c +++ b/crypto/evp/e_aes_cbc_hmac_sha1.c @@ -16,9 +16,9 @@ #include #include #include "internal/cryptlib.h" -#include "internal/modes_int.h" -#include "internal/evp_int.h" -#include "internal/constant_time_locl.h" +#include "crypto/modes.h" +#include "crypto/evp.h" +#include "internal/constant_time.h" typedef struct { AES_KEY ks; diff --git a/crypto/evp/e_aes_cbc_hmac_sha256.c b/crypto/evp/e_aes_cbc_hmac_sha256.c index e434ec00..771ef1d6 100644 --- a/crypto/evp/e_aes_cbc_hmac_sha256.c +++ b/crypto/evp/e_aes_cbc_hmac_sha256.c @@ -16,9 +16,9 @@ #include #include #include "internal/cryptlib.h" -#include "internal/modes_int.h" -#include "internal/constant_time_locl.h" -#include "internal/evp_int.h" +#include "crypto/modes.h" +#include "internal/constant_time.h" +#include "crypto/evp.h" typedef struct { AES_KEY ks; diff --git a/crypto/evp/e_aria.c b/crypto/evp/e_aria.c index 84b14826..a8c4fc32 100644 --- a/crypto/evp/e_aria.c +++ b/crypto/evp/e_aria.c @@ -14,10 +14,10 @@ # include # include # include -# include "internal/aria.h" -# include "internal/evp_int.h" -# include "internal/modes_int.h" -# include "evp_locl.h" +# include "crypto/aria.h" +# include "crypto/evp.h" +# include "crypto/modes.h" +# include "evp_local.h" /* ARIA subkey Structure */ typedef struct { diff --git a/crypto/evp/e_bf.c b/crypto/evp/e_bf.c index 71cc990b..0ac49fe1 100644 --- a/crypto/evp/e_bf.c +++ b/crypto/evp/e_bf.c @@ -11,7 +11,7 @@ #include "internal/cryptlib.h" #ifndef OPENSSL_NO_BF # include -# include "internal/evp_int.h" +# include "crypto/evp.h" # include # include diff --git a/crypto/evp/e_camellia.c b/crypto/evp/e_camellia.c index 5e661014..50febca9 100644 --- a/crypto/evp/e_camellia.c +++ b/crypto/evp/e_camellia.c @@ -17,9 +17,9 @@ NON_EMPTY_TRANSLATION_UNIT # include # include # include -# include "internal/evp_int.h" -# include "internal/modes_int.h" -# include "internal/ciphermode_platform.h" +# include "crypto/evp.h" +# include "crypto/modes.h" +# include "crypto/ciphermode_platform.h" static int camellia_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, const unsigned char *iv, int enc); diff --git a/crypto/evp/e_cast.c b/crypto/evp/e_cast.c index 8906bd47..4b06717b 100644 --- a/crypto/evp/e_cast.c +++ b/crypto/evp/e_cast.c @@ -13,7 +13,7 @@ #ifndef OPENSSL_NO_CAST # include # include -# include "internal/evp_int.h" +# include "crypto/evp.h" # include static int cast_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, diff --git a/crypto/evp/e_chacha20_poly1305.c b/crypto/evp/e_chacha20_poly1305.c index 46eb3391..4080db75 100644 --- a/crypto/evp/e_chacha20_poly1305.c +++ b/crypto/evp/e_chacha20_poly1305.c @@ -14,9 +14,9 @@ # include # include -# include "internal/evp_int.h" -# include "evp_locl.h" -# include "internal/chacha.h" +# include "crypto/evp.h" +# include "evp_local.h" +# include "crypto/chacha.h" typedef struct { union { @@ -146,7 +146,7 @@ const EVP_CIPHER *EVP_chacha20(void) } # ifndef OPENSSL_NO_POLY1305 -# include "internal/poly1305.h" +# include "crypto/poly1305.h" typedef struct { EVP_CHACHA_KEY key; diff --git a/crypto/evp/e_des.c b/crypto/evp/e_des.c index 0d8e90cf..e5791f34 100644 --- a/crypto/evp/e_des.c +++ b/crypto/evp/e_des.c @@ -12,7 +12,7 @@ #ifndef OPENSSL_NO_DES # include # include -# include "internal/evp_int.h" +# include "crypto/evp.h" # include # include diff --git a/crypto/evp/e_des3.c b/crypto/evp/e_des3.c index 52fde95f..8f9eab42 100644 --- a/crypto/evp/e_des3.c +++ b/crypto/evp/e_des3.c @@ -12,10 +12,10 @@ #ifndef OPENSSL_NO_DES # include # include -# include "internal/evp_int.h" +# include "crypto/evp.h" # include # include -# include "evp_locl.h" +# include "evp_local.h" typedef struct { union { diff --git a/crypto/evp/e_idea.c b/crypto/evp/e_idea.c index 0f7f4dd5..8c3a5541 100644 --- a/crypto/evp/e_idea.c +++ b/crypto/evp/e_idea.c @@ -13,7 +13,7 @@ #ifndef OPENSSL_NO_IDEA # include # include -# include "internal/evp_int.h" +# include "crypto/evp.h" # include /* Can't use IMPLEMENT_BLOCK_CIPHER because IDEA_ecb_encrypt is different */ diff --git a/crypto/evp/e_null.c b/crypto/evp/e_null.c index 2f3fcc88..2c8d27e3 100644 --- a/crypto/evp/e_null.c +++ b/crypto/evp/e_null.c @@ -11,7 +11,7 @@ #include "internal/cryptlib.h" #include #include -#include "internal/evp_int.h" +#include "crypto/evp.h" static int null_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, const unsigned char *iv, int enc); diff --git a/crypto/evp/e_rc2.c b/crypto/evp/e_rc2.c index 375714a6..d2201b00 100644 --- a/crypto/evp/e_rc2.c +++ b/crypto/evp/e_rc2.c @@ -14,7 +14,7 @@ # include # include -# include "internal/evp_int.h" +# include "crypto/evp.h" # include static int rc2_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, diff --git a/crypto/evp/e_rc4.c b/crypto/evp/e_rc4.c index a1664b59..092d6cf1 100644 --- a/crypto/evp/e_rc4.c +++ b/crypto/evp/e_rc4.c @@ -16,7 +16,7 @@ # include # include -# include "internal/evp_int.h" +# include "crypto/evp.h" typedef struct { RC4_KEY ks; /* working key */ diff --git a/crypto/evp/e_rc4_hmac_md5.c b/crypto/evp/e_rc4_hmac_md5.c index 4d61faff..fc519d90 100644 --- a/crypto/evp/e_rc4_hmac_md5.c +++ b/crypto/evp/e_rc4_hmac_md5.c @@ -19,7 +19,7 @@ # include # include # include -# include "internal/evp_int.h" +# include "crypto/evp.h" typedef struct { RC4_KEY ks; diff --git a/crypto/evp/e_rc5.c b/crypto/evp/e_rc5.c index 95a626bd..4783cc31 100644 --- a/crypto/evp/e_rc5.c +++ b/crypto/evp/e_rc5.c @@ -13,9 +13,9 @@ #ifndef OPENSSL_NO_RC5 # include -# include "internal/evp_int.h" +# include "crypto/evp.h" # include -# include "evp_locl.h" +# include "evp_local.h" # include static int r_32_12_16_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, diff --git a/crypto/evp/e_seed.c b/crypto/evp/e_seed.c index 0861ee8b..9a9938de 100644 --- a/crypto/evp/e_seed.c +++ b/crypto/evp/e_seed.c @@ -16,7 +16,7 @@ NON_EMPTY_TRANSLATION_UNIT # include # include # include -# include "internal/evp_int.h" +# include "crypto/evp.h" static int seed_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, const unsigned char *iv, int enc); diff --git a/crypto/evp/e_sm4.c b/crypto/evp/e_sm4.c index 02292fa6..4653c10a 100644 --- a/crypto/evp/e_sm4.c +++ b/crypto/evp/e_sm4.c @@ -13,8 +13,8 @@ #ifndef OPENSSL_NO_SM4 # include # include -# include "internal/sm4.h" -# include "internal/evp_int.h" +# include "crypto/sm4.h" +# include "crypto/evp.h" typedef struct { SM4_KEY ks; diff --git a/crypto/evp/e_xcbc_d.c b/crypto/evp/e_xcbc_d.c index 285001c3..d402606b 100644 --- a/crypto/evp/e_xcbc_d.c +++ b/crypto/evp/e_xcbc_d.c @@ -14,7 +14,7 @@ # include # include -# include "internal/evp_int.h" +# include "crypto/evp.h" # include static int desx_cbc_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, diff --git a/crypto/evp/encode.c b/crypto/evp/encode.c index ab80267c..fb657d14 100644 --- a/crypto/evp/encode.c +++ b/crypto/evp/encode.c @@ -11,8 +11,8 @@ #include #include "internal/cryptlib.h" #include -#include "internal/evp_int.h" -#include "evp_locl.h" +#include "crypto/evp.h" +#include "evp_local.h" static unsigned char conv_ascii2bin(unsigned char a, const unsigned char *table); diff --git a/crypto/evp/evp_enc.c b/crypto/evp/evp_enc.c index 4e61d75b..efcb7e50 100644 --- a/crypto/evp/evp_enc.c +++ b/crypto/evp/evp_enc.c @@ -17,9 +17,9 @@ #include #include #include -#include "internal/evp_int.h" +#include "crypto/evp.h" #include "internal/provider.h" -#include "evp_locl.h" +#include "evp_local.h" int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *ctx) { @@ -267,6 +267,19 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, case NID_sm4_ctr: case NID_sm4_cfb128: case NID_sm4_ofb128: + case NID_rc4: + case NID_rc4_40: + case NID_rc5_cbc: + case NID_rc5_ecb: + case NID_rc5_cfb64: + case NID_rc5_ofb64: + case NID_rc2_cbc: + case NID_rc2_40_cbc: + case NID_rc2_64_cbc: + case NID_rc2_cfb64: + case NID_rc2_ofb64: + case NID_chacha20: + case NID_chacha20_poly1305: break; default: goto legacy; @@ -335,19 +348,6 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, return 0; } - switch (EVP_CIPHER_mode(ctx->cipher)) { - case EVP_CIPH_CFB_MODE: - case EVP_CIPH_OFB_MODE: - case EVP_CIPH_CBC_MODE: - /* For these modes we remember the original IV for later use */ - if (!ossl_assert(EVP_CIPHER_CTX_iv_length(ctx) <= (int)sizeof(ctx->oiv))) { - EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_INITIALIZATION_ERROR); - return 0; - } - if (iv != NULL) - memcpy(ctx->oiv, iv, EVP_CIPHER_CTX_iv_length(ctx)); - } - if (enc) { if (ctx->cipher->einit == NULL) { EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_INITIALIZATION_ERROR); @@ -1067,6 +1067,7 @@ int EVP_CIPHER_CTX_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr) int ret = EVP_CTRL_RET_UNSUPPORTED; int set_params = 1; size_t sz = arg; + unsigned int i; OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END }; if (ctx == NULL || ctx->cipher == NULL) { @@ -1088,10 +1089,18 @@ int EVP_CIPHER_CTX_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr) ptr, sz); break; + case EVP_CTRL_INIT: + /* + * TODO(3.0) EVP_CTRL_INIT is purely legacy, no provider counterpart + * As a matter of fact, this should be dead code, but some caller + * might still do a direct control call with this command, so... + * Legacy methods return 1 except for exceptional circumstances, so + * we do the same here to not be disruptive. + */ + return 1; case EVP_CTRL_SET_PIPELINE_OUTPUT_BUFS: /* Used by DASYNC */ - case EVP_CTRL_INIT: /* TODO(3.0) Purely legacy, no provider counterpart */ default: - return EVP_CTRL_RET_UNSUPPORTED; + goto end; case EVP_CTRL_GET_IV: set_params = 0; params[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_IV, @@ -1107,12 +1116,25 @@ int EVP_CIPHER_CTX_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr) OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TLS1_IV_FIXED, ptr, sz); break; + case EVP_CTRL_GET_RC5_ROUNDS: + set_params = 0; /* Fall thru */ + case EVP_CTRL_SET_RC5_ROUNDS: + if (arg < 0) + return 0; + i = (unsigned int)arg; + params[0] = OSSL_PARAM_construct_uint(OSSL_CIPHER_PARAM_ROUNDS, &i); + break; case EVP_CTRL_AEAD_GET_TAG: set_params = 0; /* Fall thru */ case EVP_CTRL_AEAD_SET_TAG: params[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, ptr, sz); break; + case EVP_CTRL_AEAD_SET_MAC_KEY: + params[0] = + OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_MAC_KEY, + ptr, sz); + break; case EVP_CTRL_AEAD_TLS1_AAD: /* This one does a set and a get - since it returns a padding size */ params[0] = @@ -1120,20 +1142,27 @@ int EVP_CIPHER_CTX_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr) ptr, sz); ret = evp_do_ciph_ctx_setparams(ctx->cipher, ctx->provctx, params); if (ret <= 0) - return ret; + goto end; params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_AEAD_TLS1_AAD_PAD, &sz); ret = evp_do_ciph_ctx_getparams(ctx->cipher, ctx->provctx, params); if (ret <= 0) - return 0; + goto end; return sz; +#ifndef OPENSSL_NO_RC2 + case EVP_CTRL_GET_RC2_KEY_BITS: + set_params = 0; /* Fall thru */ + case EVP_CTRL_SET_RC2_KEY_BITS: + params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_RC2_KEYBITS, &sz); + break; +#endif /* OPENSSL_NO_RC2 */ } if (set_params) ret = evp_do_ciph_ctx_setparams(ctx->cipher, ctx->provctx, params); else ret = evp_do_ciph_ctx_getparams(ctx->cipher, ctx->provctx, params); - return ret; + goto end; /* TODO(3.0): Remove legacy code below */ legacy: @@ -1143,6 +1172,8 @@ legacy: } ret = ctx->cipher->ctrl(ctx, type, arg, ptr); + + end: if (ret == EVP_CTRL_RET_UNSUPPORTED) { EVPerr(EVP_F_EVP_CIPHER_CTX_CTRL, EVP_R_CTRL_OPERATION_NOT_IMPLEMENTED); @@ -1179,14 +1210,14 @@ const OSSL_PARAM *EVP_CIPHER_gettable_params(const EVP_CIPHER *cipher) return NULL; } -const OSSL_PARAM *EVP_CIPHER_CTX_settable_params(const EVP_CIPHER *cipher) +const OSSL_PARAM *EVP_CIPHER_settable_ctx_params(const EVP_CIPHER *cipher) { if (cipher != NULL && cipher->settable_ctx_params != NULL) return cipher->settable_ctx_params(); return NULL; } -const OSSL_PARAM *EVP_CIPHER_CTX_gettable_params(const EVP_CIPHER *cipher) +const OSSL_PARAM *EVP_CIPHER_gettable_ctx_params(const EVP_CIPHER *cipher) { if (cipher != NULL && cipher->gettable_ctx_params != NULL) return cipher->gettable_ctx_params(); @@ -1334,7 +1365,7 @@ static void *evp_cipher_from_dispatch(const int name_id, #ifndef FIPS_MODE /* TODO(3.x) get rid of the need for legacy NIDs */ cipher->nid = NID_undef; - evp_doall_names(prov, name_id, set_legacy_nid, &cipher->nid); + evp_names_do_all(prov, name_id, set_legacy_nid, &cipher->nid); if (cipher->nid == -1) { ERR_raise(ERR_LIB_EVP, ERR_R_INTERNAL_ERROR); EVP_CIPHER_free(cipher); @@ -1490,9 +1521,9 @@ void EVP_CIPHER_free(EVP_CIPHER *cipher) OPENSSL_free(cipher); } -void EVP_CIPHER_do_all_ex(OPENSSL_CTX *libctx, - void (*fn)(EVP_CIPHER *mac, void *arg), - void *arg) +void EVP_CIPHER_do_all_provided(OPENSSL_CTX *libctx, + void (*fn)(EVP_CIPHER *mac, void *arg), + void *arg) { evp_generic_do_all(libctx, OSSL_OP_CIPHER, (void (*)(void *, void *))fn, arg, diff --git a/crypto/evp/evp_err.c b/crypto/evp/evp_err.c index b74b87e4..62ca87c6 100644 --- a/crypto/evp/evp_err.c +++ b/crypto/evp/evp_err.c @@ -18,6 +18,7 @@ static const ERR_STRING_DATA EVP_str_reasons[] = { "aes key setup failed"}, {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_ARIA_KEY_SETUP_FAILED), "aria key setup failed"}, + {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_BAD_ALGORITHM_NAME), "bad algorithm name"}, {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_BAD_DECRYPT), "bad decrypt"}, {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_BAD_KEY_LENGTH), "bad key length"}, {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_BUFFER_TOO_SMALL), "buffer too small"}, @@ -33,6 +34,8 @@ static const ERR_STRING_DATA EVP_str_reasons[] = { "cipher parameter error"}, {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_COMMAND_NOT_SUPPORTED), "command not supported"}, + {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_CONFLICTING_ALGORITHM_NAME), + "conflicting algorithm name"}, {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_COPY_ERROR), "copy error"}, {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_CTRL_NOT_IMPLEMENTED), "ctrl not implemented"}, diff --git a/crypto/evp/evp_fetch.c b/crypto/evp/evp_fetch.c index cd2bacea..907091fc 100644 --- a/crypto/evp/evp_fetch.c +++ b/crypto/evp/evp_fetch.c @@ -8,7 +8,7 @@ */ #include -#include +#include #include #include #include "internal/cryptlib.h" @@ -17,8 +17,10 @@ #include "internal/core.h" #include "internal/provider.h" #include "internal/namemap.h" -#include "internal/evp_int.h" /* evp_locl.h needs it */ -#include "evp_locl.h" +#include "crypto/evp.h" /* evp_local.h needs it */ +#include "evp_local.h" + +#define NAME_SEPARATOR ':' static void default_method_store_free(void *vstore) { @@ -42,7 +44,7 @@ struct method_data_st { OSSL_METHOD_CONSTRUCT_METHOD *mcm; int operation_id; /* For get_method_from_store() */ int name_id; /* For get_method_from_store() */ - const char *name; /* For get_method_from_store() */ + const char *names; /* For get_method_from_store() */ const char *propquery; /* For get_method_from_store() */ void *(*method_from_dispatch)(int name_id, const OSSL_DISPATCH *, OSSL_PROVIDER *, void *); @@ -51,6 +53,69 @@ struct method_data_st { void (*destruct_method)(void *method); }; +static int add_names_to_namemap(OSSL_NAMEMAP *namemap, + const char *names) +{ + const char *p, *q; + size_t l; + int id = 0; + + /* Check that we have a namemap and that there is at least one name */ + if (namemap == NULL) { + ERR_raise(ERR_LIB_EVP, ERR_R_PASSED_NULL_PARAMETER); + return 0; + } + + /* + * Check that no name is an empty string, and that all names have at + * most one numeric identity together. + */ + for (p = names; *p != '\0'; p = (q == NULL ? p + l : q + 1)) { + int this_id; + + if ((q = strchr(p, NAME_SEPARATOR)) == NULL) + l = strlen(p); /* offset to \0 */ + else + l = q - p; /* offset to the next separator */ + + this_id = ossl_namemap_name2num_n(namemap, p, l); + + if (*p == '\0' || *p == NAME_SEPARATOR) { + ERR_raise(ERR_LIB_EVP, EVP_R_BAD_ALGORITHM_NAME); + return 0; + } + if (id == 0) + id = this_id; + else if (this_id != 0 && this_id != id) { + ERR_raise_data(ERR_LIB_EVP, EVP_R_CONFLICTING_ALGORITHM_NAME, + "\"%.*s\" has an existing different identity %d (from \"%s\")", + l, p, this_id, names); + return 0; + } + } + + /* Now that we have checked, register all names */ + for (p = names; *p != '\0'; p = (q == NULL ? p + l : q + 1)) { + int this_id; + + if ((q = strchr(p, NAME_SEPARATOR)) == NULL) + l = strlen(p); /* offset to \0 */ + else + l = q - p; /* offset to the next separator */ + + this_id = ossl_namemap_add_n(namemap, id, p, l); + if (id == 0) + id = this_id; + else if (this_id != id) { + ERR_raise_data(ERR_LIB_EVP, ERR_R_INTERNAL_ERROR, + "Got id %d when expecting %d", this_id, id); + return 0; + } + } + + return id; +} + /* * Generic routines to fetch / create EVP methods with ossl_method_construct() */ @@ -105,10 +170,13 @@ static void *get_method_from_store(OPENSSL_CTX *libctx, void *store, */ if ((name_id = methdata->name_id) == 0) { OSSL_NAMEMAP *namemap = ossl_namemap_stored(libctx); + const char *names = methdata->names; + const char *q = strchr(names, NAME_SEPARATOR); + size_t l = (q == NULL ? strlen(names) : (size_t)(q - names)); if (namemap == 0) return NULL; - name_id = ossl_namemap_name2num(namemap, methdata->name); + name_id = ossl_namemap_name2num_n(namemap, names, l); } if (name_id == 0 @@ -131,21 +199,30 @@ static void *get_method_from_store(OPENSSL_CTX *libctx, void *store, static int put_method_in_store(OPENSSL_CTX *libctx, void *store, void *method, const OSSL_PROVIDER *prov, - int operation_id, const char *name, + int operation_id, const char *names, const char *propdef, void *data) { struct method_data_st *methdata = data; OSSL_NAMEMAP *namemap; int name_id; uint32_t meth_id; + size_t l = 0; /* * put_method_in_store() is only called with a method that was * successfully created by construct_method() below, which means - * the name should already be stored in the namemap, so just use it. + * that all the names should already be stored in the namemap with + * the same numeric identity, so just use the first to get that + * identity. */ + if (names != NULL) { + const char *q = strchr(names, NAME_SEPARATOR); + + l = (q == NULL ? strlen(names) : (size_t)(q - names)); + } + if ((namemap = ossl_namemap_stored(libctx)) == NULL - || (name_id = ossl_namemap_name2num(namemap, name)) == 0 + || (name_id = ossl_namemap_name2num_n(namemap, names, l)) == 0 || (meth_id = method_id(operation_id, name_id)) == 0) return 0; @@ -162,7 +239,7 @@ static int put_method_in_store(OPENSSL_CTX *libctx, void *store, * The core fetching functionality passes the name of the implementation. * This function is responsible to getting an identity number for it. */ -static void *construct_method(const char *name, const OSSL_DISPATCH *fns, +static void *construct_method(const char *names, const OSSL_DISPATCH *fns, OSSL_PROVIDER *prov, void *data) { /* @@ -170,17 +247,14 @@ static void *construct_method(const char *name, const OSSL_DISPATCH *fns, * NULL, so it's safe to say that of all the spots to create a new * namemap entry, this is it. Should the name already exist there, we * know that ossl_namemap_add() will return its corresponding number. - * - * TODO(3.0): If this function gets an array of names instead of just - * one, we need to check through all the names to see if at least one - * of them has an associated number, and use that. If several names - * have associated numbers that differ from each other, it's an error. */ struct method_data_st *methdata = data; OPENSSL_CTX *libctx = ossl_provider_library_context(prov); OSSL_NAMEMAP *namemap = ossl_namemap_stored(libctx); - int name_id = ossl_namemap_add(namemap, 0, name); + int name_id = add_names_to_namemap(namemap, names); + if (name_id == 0) + return NULL; return methdata->method_from_dispatch(name_id, fns, prov, methdata->method_data); } @@ -255,7 +329,7 @@ static void *inner_generic_fetch(OPENSSL_CTX *libctx, int operation_id, mcmdata.libctx = libctx; mcmdata.operation_id = operation_id; mcmdata.name_id = name_id; - mcmdata.name = name; + mcmdata.names = name; mcmdata.propquery = properties; mcmdata.method_from_dispatch = new_method; mcmdata.destruct_method = free_method; @@ -337,6 +411,7 @@ struct do_all_data_st { void *user_arg; void *(*new_method)(const int name_id, const OSSL_DISPATCH *fns, OSSL_PROVIDER *prov, void *method_data); + void *method_data; void (*free_method)(void *); }; @@ -346,12 +421,12 @@ static void do_one(OSSL_PROVIDER *provider, const OSSL_ALGORITHM *algo, struct do_all_data_st *data = vdata; OPENSSL_CTX *libctx = ossl_provider_library_context(provider); OSSL_NAMEMAP *namemap = ossl_namemap_stored(libctx); - int name_id = ossl_namemap_add(namemap, 0, algo->algorithm_name); + int name_id = add_names_to_namemap(namemap, algo->algorithm_names); void *method = NULL; if (name_id != 0) method = data->new_method(name_id, algo->implementation, provider, - NULL); + data->method_data); if (method != NULL) { data->user_fn(method, data->user_arg); @@ -372,10 +447,11 @@ void evp_generic_do_all(OPENSSL_CTX *libctx, int operation_id, struct do_all_data_st data; data.new_method = new_method; + data.method_data = method_data; data.free_method = free_method; data.user_fn = user_fn; data.user_arg = user_arg; - ossl_algorithm_do_all(libctx, operation_id, method_data, do_one, &data); + ossl_algorithm_do_all(libctx, operation_id, NULL, do_one, &data); } const char *evp_first_name(OSSL_PROVIDER *prov, int name_id) @@ -394,9 +470,9 @@ int evp_is_a(OSSL_PROVIDER *prov, int number, const char *name) return ossl_namemap_name2num(namemap, name) == number; } -void evp_doall_names(OSSL_PROVIDER *prov, int number, - void (*fn)(const char *name, void *data), - void *data) +void evp_names_do_all(OSSL_PROVIDER *prov, int number, + void (*fn)(const char *name, void *data), + void *data) { OPENSSL_CTX *libctx = ossl_provider_library_context(prov); OSSL_NAMEMAP *namemap = ossl_namemap_stored(libctx); diff --git a/crypto/evp/evp_lib.c b/crypto/evp/evp_lib.c index 4ec880fd..c25c40dd 100644 --- a/crypto/evp/evp_lib.c +++ b/crypto/evp/evp_lib.c @@ -14,36 +14,38 @@ #include #include #include -#include "internal/evp_int.h" +#include "crypto/evp.h" #include "internal/provider.h" -#include "evp_locl.h" +#include "evp_local.h" #if !defined(FIPS_MODE) int EVP_CIPHER_param_to_asn1(EVP_CIPHER_CTX *c, ASN1_TYPE *type) { - int ret; + int ret = -1; /* Assume the worst */ const EVP_CIPHER *cipher = c->cipher; - if (cipher->prov != NULL) { - /* - * The cipher has come from a provider and won't have the default flags. - * Find the implicit form so we can check the flags. - * TODO(3.0): This won't work for 3rd party ciphers we know nothing about - * We'll need to think of something else for those. - */ - cipher = EVP_get_cipherbynid(cipher->nid); - if (cipher == NULL) { - EVPerr(EVP_F_EVP_CIPHER_PARAM_TO_ASN1, ASN1_R_UNSUPPORTED_CIPHER); - return -1; - } - } - - if (cipher->set_asn1_parameters != NULL) + /* + * For legacy implementations, we detect custom AlgorithmIdentifier + * parameter handling by checking if the function pointer + * cipher->set_asn1_parameters is set. We know that this pointer + * is NULL for provided implementations. + * + * Otherwise, for any implementation, we check the flag + * EVP_CIPH_FLAG_CUSTOM_ASN1. If it isn't set, we apply + * default AI parameter extraction. + * + * Otherwise, for provided implementations, we convert |type| to + * a DER encoded blob and pass to the implementation in OSSL_PARAM + * form. + * + * If none of the above applies, this operation is unsupported. + */ + if (cipher->set_asn1_parameters != NULL) { ret = cipher->set_asn1_parameters(c, type); - else if (cipher->flags & EVP_CIPH_FLAG_DEFAULT_ASN1) { + } else if ((EVP_CIPHER_flags(cipher) & EVP_CIPH_FLAG_CUSTOM_ASN1) == 0) { switch (EVP_CIPHER_mode(cipher)) { case EVP_CIPH_WRAP_MODE: - if (EVP_CIPHER_nid(cipher) == NID_id_smime_alg_CMS3DESwrap) + if (EVP_CIPHER_is_a(cipher, SN_id_smime_alg_CMS3DESwrap)) ASN1_TYPE_set(type, V_ASN1_NULL, NULL); ret = 1; break; @@ -58,8 +60,40 @@ int EVP_CIPHER_param_to_asn1(EVP_CIPHER_CTX *c, ASN1_TYPE *type) default: ret = EVP_CIPHER_set_asn1_iv(c, type); } - } else - ret = -1; + } else if (cipher->prov != NULL) { + OSSL_PARAM params[3], *p = params; + unsigned char *der = NULL, *derp; + + /* + * We make two passes, the first to get the appropriate buffer size, + * and the second to get the actual value. + */ + *p++ = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_ALG_ID, + NULL, 0); + *p = OSSL_PARAM_construct_end(); + + if (!EVP_CIPHER_CTX_get_params(c, params)) + goto err; + + /* ... but, we should get a return size too! */ + if (params[0].return_size != 0 + && (der = OPENSSL_malloc(params[0].return_size)) != NULL) { + params[0].data = der; + params[0].data_size = params[0].return_size; + params[0].return_size = 0; + derp = der; + if (EVP_CIPHER_CTX_get_params(c, params) + && d2i_ASN1_TYPE(&type, (const unsigned char **)&derp, + params[0].return_size) != NULL) { + ret = 1; + } + OPENSSL_free(der); + } + } else { + ret = -2; + } + + err: if (ret == -2) EVPerr(EVP_F_EVP_CIPHER_PARAM_TO_ASN1, ASN1_R_UNSUPPORTED_CIPHER); else if (ret <= 0) @@ -71,24 +105,29 @@ int EVP_CIPHER_param_to_asn1(EVP_CIPHER_CTX *c, ASN1_TYPE *type) int EVP_CIPHER_asn1_to_param(EVP_CIPHER_CTX *c, ASN1_TYPE *type) { - int ret; + int ret = -1; /* Assume the worst */ const EVP_CIPHER *cipher = c->cipher; - if (cipher->prov != NULL) { - /* - * The cipher has come from a provider and won't have the default flags. - * Find the implicit form so we can check the flags. - */ - cipher = EVP_get_cipherbynid(cipher->nid); - if (cipher == NULL) - return -1; - } - - if (cipher->get_asn1_parameters != NULL) + /* + * For legacy implementations, we detect custom AlgorithmIdentifier + * parameter handling by checking if there the function pointer + * cipher->get_asn1_parameters is set. We know that this pointer + * is NULL for provided implementations. + * + * Otherwise, for any implementation, we check the flag + * EVP_CIPH_FLAG_CUSTOM_ASN1. If it isn't set, we apply + * default AI parameter creation. + * + * Otherwise, for provided implementations, we get the AI parameter + * in DER encoded form from the implementation by requesting the + * appropriate OSSL_PARAM and converting the result to a ASN1_TYPE. + * + * If none of the above applies, this operation is unsupported. + */ + if (cipher->get_asn1_parameters != NULL) { ret = cipher->get_asn1_parameters(c, type); - else if (cipher->flags & EVP_CIPH_FLAG_DEFAULT_ASN1) { + } else if ((EVP_CIPHER_flags(cipher) & EVP_CIPH_FLAG_CUSTOM_ASN1) == 0) { switch (EVP_CIPHER_mode(cipher)) { - case EVP_CIPH_WRAP_MODE: ret = 1; break; @@ -102,10 +141,25 @@ int EVP_CIPHER_asn1_to_param(EVP_CIPHER_CTX *c, ASN1_TYPE *type) default: ret = EVP_CIPHER_get_asn1_iv(c, type); - break; } - } else - ret = -1; + } else if (cipher->prov != NULL) { + OSSL_PARAM params[3], *p = params; + unsigned char *der = NULL; + int derl = -1; + + if ((derl = i2d_ASN1_TYPE(type, &der)) >= 0) { + *p++ = + OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_ALG_ID, + der, (size_t)derl); + *p = OSSL_PARAM_construct_end(); + if (EVP_CIPHER_CTX_set_params(c, params)) + ret = 1; + OPENSSL_free(der); + } + } else { + ret = -2; + } + if (ret == -2) EVPerr(EVP_F_EVP_CIPHER_ASN1_TO_PARAM, EVP_R_UNSUPPORTED_CIPHER); else if (ret <= 0) @@ -140,11 +194,13 @@ int EVP_CIPHER_set_asn1_iv(EVP_CIPHER_CTX *c, ASN1_TYPE *type) { int i = 0; unsigned int j; + unsigned char *oiv = NULL; if (type != NULL) { + oiv = (unsigned char *)EVP_CIPHER_CTX_original_iv(c); j = EVP_CIPHER_CTX_iv_length(c); OPENSSL_assert(j <= sizeof(c->iv)); - i = ASN1_TYPE_set_octetstring(type, c->oiv, j); + i = ASN1_TYPE_set_octetstring(type, oiv, j); } return i; } @@ -242,15 +298,31 @@ int EVP_Cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in, unsigned int inl) { if (ctx->cipher->prov != NULL) { - size_t outl = 0; /* ignored */ - int blocksize = EVP_CIPHER_CTX_block_size(ctx); + /* + * If the provided implementation has a ccipher function, we use it, + * and translate its return value like this: 0 => -1, 1 => outlen + * + * Otherwise, we call the cupdate function if in != NULL, or cfinal + * if in == NULL. Regardless of which, we return what we got. + */ + int ret = -1; + size_t outl = 0; + size_t blocksize = EVP_CIPHER_CTX_block_size(ctx); if (ctx->cipher->ccipher != NULL) - return - ctx->cipher->ccipher(ctx->provctx, out, &outl, - inl + (blocksize == 1 ? 0 : blocksize), - in, (size_t)inl); - return 0; + ret = ctx->cipher->ccipher(ctx->provctx, out, &outl, + inl + (blocksize == 1 ? 0 : blocksize), + in, (size_t)inl) + ? (int)outl : -1; + else if (in != NULL) + ret = ctx->cipher->cupdate(ctx->provctx, out, &outl, + inl + (blocksize == 1 ? 0 : blocksize), + in, (size_t)inl); + else + ret = ctx->cipher->cfinal(ctx->provctx, out, &outl, + blocksize == 1 ? 0 : blocksize); + + return ret; } return ctx->cipher->do_cipher(ctx, out, in, inl); @@ -275,6 +347,10 @@ unsigned long EVP_CIPHER_flags(const EVP_CIPHER *cipher) params[0] = OSSL_PARAM_construct_ulong(OSSL_CIPHER_PARAM_FLAGS, &v); ok = evp_do_ciph_getparams(cipher, params); + /* Provided implementations may have a custom cipher_cipher */ + if (cipher->prov != NULL && cipher->ccipher != NULL) + v |= EVP_CIPH_FLAG_CUSTOM_CIPHER; + return ok != 0 ? v : 0; } @@ -349,7 +425,16 @@ int EVP_CIPHER_CTX_tag_length(const EVP_CIPHER_CTX *ctx) const unsigned char *EVP_CIPHER_CTX_original_iv(const EVP_CIPHER_CTX *ctx) { - return ctx->oiv; + int ok; + const unsigned char *v = ctx->oiv; + OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END }; + + params[0] = + OSSL_PARAM_construct_octet_ptr(OSSL_CIPHER_PARAM_IV, + (void **)&v, sizeof(ctx->oiv)); + ok = evp_do_ciph_ctx_getparams(ctx->cipher, ctx->provctx, params); + + return ok != 0 ? v : NULL; } /* @@ -450,9 +535,21 @@ int EVP_CIPHER_CTX_nid(const EVP_CIPHER_CTX *ctx) int EVP_CIPHER_is_a(const EVP_CIPHER *cipher, const char *name) { +#ifndef FIPS_MODE + if (cipher->prov == NULL) { + int nid = EVP_CIPHER_nid(cipher); + + return nid == OBJ_sn2nid(name) || nid == OBJ_ln2nid(name); + } +#endif return evp_is_a(cipher->prov, cipher->name_id, name); } +int EVP_CIPHER_number(const EVP_CIPHER *cipher) +{ + return cipher->name_id; +} + const char *EVP_CIPHER_name(const EVP_CIPHER *cipher) { if (cipher->prov != NULL) @@ -464,6 +561,14 @@ const char *EVP_CIPHER_name(const EVP_CIPHER *cipher) #endif } +void EVP_CIPHER_names_do_all(const EVP_CIPHER *cipher, + void (*fn)(const char *name, void *data), + void *data) +{ + if (cipher->prov != NULL) + evp_names_do_all(cipher->prov, cipher->name_id, fn, data); +} + const OSSL_PROVIDER *EVP_CIPHER_provider(const EVP_CIPHER *cipher) { return cipher->prov; @@ -481,6 +586,16 @@ int EVP_CIPHER_mode(const EVP_CIPHER *cipher) return ok != 0 ? (int)v : 0; } +int EVP_MD_is_a(const EVP_MD *md, const char *name) +{ + return evp_is_a(md->prov, md->name_id, name); +} + +int EVP_MD_number(const EVP_MD *md) +{ + return md->name_id; +} + const char *EVP_MD_name(const EVP_MD *md) { if (md->prov != NULL) @@ -492,6 +607,14 @@ const char *EVP_MD_name(const EVP_MD *md) #endif } +void EVP_MD_names_do_all(const EVP_MD *md, + void (*fn)(const char *name, void *data), + void *data) +{ + if (md->prov != NULL) + evp_names_do_all(md->prov, md->name_id, fn, data); +} + const OSSL_PROVIDER *EVP_MD_provider(const EVP_MD *md) { return md->prov; diff --git a/crypto/evp/evp_locl.h b/crypto/evp/evp_local.h similarity index 92% rename from crypto/evp/evp_locl.h rename to crypto/evp/evp_local.h index 116c8e6c..9b208190 100644 --- a/crypto/evp/evp_locl.h +++ b/crypto/evp/evp_local.h @@ -129,12 +129,22 @@ struct evp_signature_st { OSSL_OP_signature_verify_fn *verify; OSSL_OP_signature_verify_recover_init_fn *verify_recover_init; OSSL_OP_signature_verify_recover_fn *verify_recover; + OSSL_OP_signature_digest_sign_init_fn *digest_sign_init; + OSSL_OP_signature_digest_sign_update_fn *digest_sign_update; + OSSL_OP_signature_digest_sign_final_fn *digest_sign_final; + OSSL_OP_signature_digest_verify_init_fn *digest_verify_init; + OSSL_OP_signature_digest_verify_update_fn *digest_verify_update; + OSSL_OP_signature_digest_verify_final_fn *digest_verify_final; OSSL_OP_signature_freectx_fn *freectx; OSSL_OP_signature_dupctx_fn *dupctx; OSSL_OP_signature_get_ctx_params_fn *get_ctx_params; OSSL_OP_signature_gettable_ctx_params_fn *gettable_ctx_params; OSSL_OP_signature_set_ctx_params_fn *set_ctx_params; OSSL_OP_signature_settable_ctx_params_fn *settable_ctx_params; + OSSL_OP_signature_get_ctx_md_params_fn *get_ctx_md_params; + OSSL_OP_signature_gettable_ctx_md_params_fn *gettable_ctx_md_params; + OSSL_OP_signature_set_ctx_md_params_fn *set_ctx_md_params; + OSSL_OP_signature_settable_ctx_md_params_fn *settable_ctx_md_params; } /* EVP_SIGNATURE */; int PKCS5_v2_PBKDF2_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, @@ -163,7 +173,7 @@ DEFINE_STACK_OF(EVP_PBE_CTL) int is_partially_overlapping(const void *ptr1, const void *ptr2, int len); -#include +#include #include void *evp_generic_fetch(OPENSSL_CTX *ctx, int operation_id, @@ -251,6 +261,6 @@ void evp_pkey_ctx_free_old_ops(EVP_PKEY_CTX *ctx); /* OSSL_PROVIDER * is only used to get the library context */ const char *evp_first_name(OSSL_PROVIDER *prov, int name_id); int evp_is_a(OSSL_PROVIDER *prov, int number, const char *name); -void evp_doall_names(OSSL_PROVIDER *prov, int number, - void (*fn)(const char *name, void *data), - void *data); +void evp_names_do_all(OSSL_PROVIDER *prov, int number, + void (*fn)(const char *name, void *data), + void *data); diff --git a/crypto/evp/evp_pbe.c b/crypto/evp/evp_pbe.c index 8162a5e4..a9f94bd5 100644 --- a/crypto/evp/evp_pbe.c +++ b/crypto/evp/evp_pbe.c @@ -12,8 +12,8 @@ #include #include #include -#include "internal/evp_int.h" -#include "evp_locl.h" +#include "crypto/evp.h" +#include "evp_local.h" /* Password based encryption (PBE) functions */ @@ -93,8 +93,9 @@ int EVP_PBE_CipherInit(ASN1_OBJECT *pbe_obj, const char *pass, int passlen, if (!EVP_PBE_find(EVP_PBE_TYPE_OUTER, OBJ_obj2nid(pbe_obj), &cipher_nid, &md_nid, &keygen)) { char obj_tmp[80]; + EVPerr(EVP_F_EVP_PBE_CIPHERINIT, EVP_R_UNKNOWN_PBE_ALGORITHM); - if (!pbe_obj) + if (pbe_obj == NULL) OPENSSL_strlcpy(obj_tmp, "NULL", sizeof(obj_tmp)); else i2t_ASN1_OBJECT(obj_tmp, sizeof(obj_tmp), pbe_obj); @@ -102,7 +103,7 @@ int EVP_PBE_CipherInit(ASN1_OBJECT *pbe_obj, const char *pass, int passlen, return 0; } - if (!pass) + if (pass == NULL) passlen = 0; else if (passlen == -1) passlen = strlen(pass); diff --git a/crypto/evp/evp_pkey.c b/crypto/evp/evp_pkey.c index bffe2b38..a11b856c 100644 --- a/crypto/evp/evp_pkey.c +++ b/crypto/evp/evp_pkey.c @@ -12,9 +12,9 @@ #include "internal/cryptlib.h" #include #include -#include "internal/asn1_int.h" -#include "internal/evp_int.h" -#include "internal/x509_int.h" +#include "crypto/asn1.h" +#include "crypto/evp.h" +#include "crypto/x509.h" /* Extract a private key from a PKCS8 structure */ diff --git a/crypto/evp/evp_utils.c b/crypto/evp/evp_utils.c index 3da208a6..77622616 100644 --- a/crypto/evp/evp_utils.c +++ b/crypto/evp/evp_utils.c @@ -12,10 +12,10 @@ #include #include #include -#include /* evp_locl.h needs it */ -#include /* evp_locl.h needs it */ -#include "internal/evp_int.h" /* evp_locl.h needs it */ -#include "evp_locl.h" +#include /* evp_local.h needs it */ +#include /* evp_local.h needs it */ +#include "crypto/evp.h" /* evp_local.h needs it */ +#include "evp_local.h" /* * EVP_CTRL_RET_UNSUPPORTED = -1 is the returned value from any ctrl function diff --git a/crypto/evp/exchange.c b/crypto/evp/exchange.c index 53a25a42..dfc309ec 100644 --- a/crypto/evp/exchange.c +++ b/crypto/evp/exchange.c @@ -11,10 +11,10 @@ #include #include #include "internal/refcount.h" -#include "internal/evp_int.h" +#include "crypto/evp.h" #include "internal/provider.h" #include "internal/numbers.h" /* includes SIZE_MAX */ -#include "evp_locl.h" +#include "evp_local.h" static EVP_KEYEXCH *evp_keyexch_new(OSSL_PROVIDER *prov) { @@ -224,7 +224,8 @@ int EVP_PKEY_derive_init_ex(EVP_PKEY_CTX *ctx, EVP_KEYEXCH *exchange) ctx->op.kex.exchange = exchange; if (ctx->pkey != NULL) { - provkey = evp_keymgmt_export_to_provider(ctx->pkey, exchange->keymgmt); + provkey = + evp_keymgmt_export_to_provider(ctx->pkey, exchange->keymgmt, 0); if (provkey == NULL) { EVPerr(EVP_F_EVP_PKEY_DERIVE_INIT_EX, EVP_R_INITIALIZATION_ERROR); goto err; @@ -283,8 +284,8 @@ int EVP_PKEY_derive_set_peer(EVP_PKEY_CTX *ctx, EVP_PKEY *peer) return -2; } - provkey = evp_keymgmt_export_to_provider(peer, - ctx->op.kex.exchange->keymgmt); + provkey = + evp_keymgmt_export_to_provider(peer, ctx->op.kex.exchange->keymgmt, 0); if (provkey == NULL) { EVPerr(EVP_F_EVP_PKEY_DERIVE_SET_PEER, ERR_R_INTERNAL_ERROR); return 0; @@ -386,3 +387,35 @@ int EVP_PKEY_derive(EVP_PKEY_CTX *ctx, unsigned char *key, size_t *pkeylen) M_check_autoarg(ctx, key, pkeylen, EVP_F_EVP_PKEY_DERIVE) return ctx->pmeth->derive(ctx, key, pkeylen); } + +int EVP_KEYEXCH_number(const EVP_KEYEXCH *keyexch) +{ + return keyexch->name_id; +} + +int EVP_KEYEXCH_is_a(const EVP_KEYEXCH *keyexch, const char *name) +{ + return evp_is_a(keyexch->prov, keyexch->name_id, name); +} + +void EVP_KEYEXCH_do_all_provided(OPENSSL_CTX *libctx, + void (*fn)(EVP_KEYEXCH *keyexch, void *arg), + void *arg) +{ + struct keymgmt_data_st keymgmt_data; + + keymgmt_data.ctx = libctx; + keymgmt_data.properties = NULL; + evp_generic_do_all(libctx, OSSL_OP_KEYEXCH, + (void (*)(void *, void *))fn, arg, + evp_keyexch_from_dispatch, &keymgmt_data, + (void (*)(void *))EVP_KEYEXCH_free); +} + +void EVP_KEYEXCH_names_do_all(const EVP_KEYEXCH *keyexch, + void (*fn)(const char *name, void *data), + void *data) +{ + if (keyexch->prov != NULL) + evp_names_do_all(keyexch->prov, keyexch->name_id, fn, data); +} diff --git a/crypto/evp/kdf_lib.c b/crypto/evp/kdf_lib.c index 5c57cc36..5ddf8560 100644 --- a/crypto/evp/kdf_lib.c +++ b/crypto/evp/kdf_lib.c @@ -17,11 +17,11 @@ #include #include #include -#include "internal/asn1_int.h" -#include "internal/evp_int.h" +#include "crypto/asn1.h" +#include "crypto/evp.h" #include "internal/numbers.h" #include "internal/provider.h" -#include "evp_locl.h" +#include "evp_local.h" EVP_KDF_CTX *EVP_KDF_CTX_new(EVP_KDF *kdf) { @@ -83,9 +83,14 @@ EVP_KDF_CTX *EVP_KDF_CTX_dup(const EVP_KDF_CTX *src) return dst; } -const char *EVP_KDF_name(const EVP_KDF *kdf) +int EVP_KDF_number(const EVP_KDF *kdf) { - return evp_first_name(kdf->prov, kdf->name_id); + return kdf->name_id; +} + +int EVP_KDF_is_a(const EVP_KDF *kdf, const char *name) +{ + return evp_is_a(kdf->prov, kdf->name_id, name); } const OSSL_PROVIDER *EVP_KDF_provider(const EVP_KDF *kdf) @@ -159,3 +164,11 @@ int EVP_KDF_CTX_set_params(EVP_KDF_CTX *ctx, const OSSL_PARAM params[]) return ctx->meth->set_ctx_params(ctx->data, params); return 1; } + +void EVP_KDF_names_do_all(const EVP_KDF *kdf, + void (*fn)(const char *name, void *data), + void *data) +{ + if (kdf->prov != NULL) + evp_names_do_all(kdf->prov, kdf->name_id, fn, data); +} diff --git a/crypto/evp/kdf_meth.c b/crypto/evp/kdf_meth.c index 7bcdcc7d..576dde68 100644 --- a/crypto/evp/kdf_meth.c +++ b/crypto/evp/kdf_meth.c @@ -12,9 +12,9 @@ #include #include #include -#include "internal/evp_int.h" +#include "crypto/evp.h" #include "internal/provider.h" -#include "evp_locl.h" +#include "evp_local.h" static int evp_kdf_up_ref(void *vkdf) { @@ -173,23 +173,23 @@ const OSSL_PARAM *EVP_KDF_gettable_params(const EVP_KDF *kdf) return kdf->gettable_params(); } -const OSSL_PARAM *EVP_KDF_CTX_gettable_params(const EVP_KDF *kdf) +const OSSL_PARAM *EVP_KDF_gettable_ctx_params(const EVP_KDF *kdf) { if (kdf->gettable_ctx_params == NULL) return NULL; return kdf->gettable_ctx_params(); } -const OSSL_PARAM *EVP_KDF_CTX_settable_params(const EVP_KDF *kdf) +const OSSL_PARAM *EVP_KDF_settable_ctx_params(const EVP_KDF *kdf) { if (kdf->settable_ctx_params == NULL) return NULL; return kdf->settable_ctx_params(); } -void EVP_KDF_do_all_ex(OPENSSL_CTX *libctx, - void (*fn)(EVP_KDF *kdf, void *arg), - void *arg) +void EVP_KDF_do_all_provided(OPENSSL_CTX *libctx, + void (*fn)(EVP_KDF *kdf, void *arg), + void *arg) { evp_generic_do_all(libctx, OSSL_OP_KDF, (void (*)(void *, void *))fn, arg, diff --git a/crypto/evp/keymgmt_lib.c b/crypto/evp/keymgmt_lib.c index 8ee28fbe..87629157 100644 --- a/crypto/evp/keymgmt_lib.c +++ b/crypto/evp/keymgmt_lib.c @@ -9,10 +9,10 @@ #include "internal/cryptlib.h" #include "internal/nelem.h" -#include "internal/evp_int.h" -#include "internal/asn1_int.h" +#include "crypto/evp.h" +#include "crypto/asn1.h" #include "internal/provider.h" -#include "evp_locl.h" +#include "evp_local.h" static OSSL_PARAM *paramdefs_to_params(const OSSL_PARAM *paramdefs) { @@ -52,6 +52,9 @@ static void *allocate_params_space(OSSL_PARAM *params) for (space = 0, p = params; p->key != NULL; p++) space += ((p->return_size + ALIGN_SIZE - 1) / ALIGN_SIZE) * ALIGN_SIZE; + if (space == 0) + return NULL; + data = OPENSSL_zalloc(space); for (space = 0, p = params; p->key != NULL; p++) { @@ -62,9 +65,10 @@ static void *allocate_params_space(OSSL_PARAM *params) return data; } -void *evp_keymgmt_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt) +void *evp_keymgmt_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt, + int want_domainparams) { - void *provkey = NULL; + void *provdata = NULL; size_t i, j; /* @@ -90,8 +94,9 @@ void *evp_keymgmt_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt) for (i = 0; i < OSSL_NELEM(pk->pkeys) && pk->pkeys[i].keymgmt != NULL; i++) { - if (keymgmt == pk->pkeys[i].keymgmt) - return pk->pkeys[i].provkey; + if (keymgmt == pk->pkeys[i].keymgmt + && want_domainparams == pk->pkeys[i].domainparams) + return pk->pkeys[i].provdata; } if (pk->pkey.ptr != NULL) { @@ -101,11 +106,11 @@ void *evp_keymgmt_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt) if (pk->ameth->export_to == NULL) return NULL; - /* Otherwise, simply use it */ - provkey = pk->ameth->export_to(pk, keymgmt); + /* Otherwise, simply use it. */ + provdata = pk->ameth->export_to(pk, keymgmt, want_domainparams); /* Synchronize the dirty count, but only if we exported successfully */ - if (provkey != NULL) + if (provdata != NULL) pk->dirty_cnt_copy = pk->ameth->dirty_cnt(pk); } else { @@ -116,10 +121,13 @@ void *evp_keymgmt_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt) * the new provider. */ + void *(*importfn)(void *provctx, const OSSL_PARAM params[]) = + want_domainparams ? keymgmt->importdomparams : keymgmt->importkey; + /* * If the given keymgmt doesn't have an import function, give up */ - if (keymgmt->importkey == NULL) + if (importfn == NULL) return NULL; for (j = 0; j < i && pk->pkeys[j].keymgmt != NULL; j++) { @@ -129,6 +137,14 @@ void *evp_keymgmt_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt) void *data = NULL; void *provctx = ossl_provider_ctx(EVP_KEYMGMT_provider(keymgmt)); + int (*exportfn)(void *provctx, OSSL_PARAM params[]) = NULL; + + if (pk->pkeys[j].domainparams != want_domainparams) + continue; + + exportfn = want_domainparams + ? pk->pkeys[j].keymgmt->exportdomparams + : pk->pkeys[j].keymgmt->exportkey; paramdefs = pk->pkeys[j].keymgmt->exportkey_types(); /* @@ -138,29 +154,35 @@ void *evp_keymgmt_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt) */ params = paramdefs_to_params(paramdefs); /* Get 'return_size' filled */ - pk->pkeys[j].keymgmt->exportkey(pk->pkeys[j].provkey, params); + exportfn(pk->pkeys[j].provdata, params); /* * Allocate space and assign 'data' to point into the - * data block + * data block. + * If something goes wrong, go to the next cached key. */ - data = allocate_params_space(params); + if ((data = allocate_params_space(params)) == NULL) + goto cont; /* * Call the exportkey function a second time, to get - * the data filled + * the data filled. + * If something goes wrong, go to the next cached key. */ - pk->pkeys[j].keymgmt->exportkey(pk->pkeys[j].provkey, params); + if (!exportfn(pk->pkeys[j].provdata, params)) + goto cont; /* * We should have all the data at this point, so import * into the new provider and hope to get a key back. */ - provkey = keymgmt->importkey(provctx, params); + provdata = importfn(provctx, params); + + cont: OPENSSL_free(params); OPENSSL_free(data); - if (provkey != NULL) + if (provdata != NULL) break; } } @@ -173,12 +195,14 @@ void *evp_keymgmt_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt) */ j = ossl_assert(i < OSSL_NELEM(pk->pkeys)); - if (provkey != NULL) { + if (provdata != NULL) { EVP_KEYMGMT_up_ref(keymgmt); pk->pkeys[i].keymgmt = keymgmt; - pk->pkeys[i].provkey = provkey; + pk->pkeys[i].provdata = provdata; + pk->pkeys[i].domainparams = want_domainparams; } - return provkey; + + return provdata; } void evp_keymgmt_clear_pkey_cache(EVP_PKEY *pk) @@ -190,11 +214,14 @@ void evp_keymgmt_clear_pkey_cache(EVP_PKEY *pk) i < OSSL_NELEM(pk->pkeys) && pk->pkeys[i].keymgmt != NULL; i++) { EVP_KEYMGMT *keymgmt = pk->pkeys[i].keymgmt; - void *provkey = pk->pkeys[i].provkey; + void *provdata = pk->pkeys[i].provdata; pk->pkeys[i].keymgmt = NULL; - pk->pkeys[i].provkey = NULL; - keymgmt->freekey(provkey); + pk->pkeys[i].provdata = NULL; + if (pk->pkeys[i].domainparams) + keymgmt->freedomparams(provdata); + else + keymgmt->freekey(provdata); EVP_KEYMGMT_free(keymgmt); } } diff --git a/crypto/evp/keymgmt_meth.c b/crypto/evp/keymgmt_meth.c index c170bd67..9c8d482b 100644 --- a/crypto/evp/keymgmt_meth.c +++ b/crypto/evp/keymgmt_meth.c @@ -13,8 +13,8 @@ #include #include "internal/provider.h" #include "internal/refcount.h" -#include "internal/evp_int.h" -#include "evp_locl.h" +#include "crypto/evp.h" +#include "evp_local.h" static void *keymgmt_new(void) @@ -200,3 +200,30 @@ const OSSL_PROVIDER *EVP_KEYMGMT_provider(const EVP_KEYMGMT *keymgmt) return keymgmt->prov; } +int EVP_KEYMGMT_number(const EVP_KEYMGMT *keymgmt) +{ + return keymgmt->name_id; +} + +int EVP_KEYMGMT_is_a(const EVP_KEYMGMT *keymgmt, const char *name) +{ + return evp_is_a(keymgmt->prov, keymgmt->name_id, name); +} + +void EVP_KEYMGMT_do_all_provided(OPENSSL_CTX *libctx, + void (*fn)(EVP_KEYMGMT *keymgmt, void *arg), + void *arg) +{ + evp_generic_do_all(libctx, OSSL_OP_KEYMGMT, + (void (*)(void *, void *))fn, arg, + keymgmt_from_dispatch, NULL, + (void (*)(void *))EVP_KEYMGMT_free); +} + +void EVP_KEYMGMT_names_do_all(const EVP_KEYMGMT *keymgmt, + void (*fn)(const char *name, void *data), + void *data) +{ + if (keymgmt->prov != NULL) + evp_names_do_all(keymgmt->prov, keymgmt->name_id, fn, data); +} diff --git a/crypto/evp/legacy_md2.c b/crypto/evp/legacy_md2.c new file mode 100644 index 00000000..d399095f --- /dev/null +++ b/crypto/evp/legacy_md2.c @@ -0,0 +1,35 @@ +/* + * Copyright 2015-2019 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include + +#ifndef OPENSSL_NO_MD2 + +# include +# include "crypto/evp.h" + +static const EVP_MD md2_md = { + NID_md2, + NID_md2WithRSAEncryption, + MD2_DIGEST_LENGTH, + 0, + NULL, + NULL, + NULL, + NULL, + NULL, + MD2_BLOCK, +}; + +const EVP_MD *EVP_md2(void) +{ + return &md2_md; +} + +#endif /* OPENSSL_NO_MD2 */ diff --git a/crypto/evp/legacy_md4.c b/crypto/evp/legacy_md4.c new file mode 100644 index 00000000..fa57e98b --- /dev/null +++ b/crypto/evp/legacy_md4.c @@ -0,0 +1,35 @@ +/* + * Copyright 2015-2019 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include + +#ifndef OPENSSL_NO_MD4 + +# include +# include "crypto/evp.h" + +static const EVP_MD md4_md = { + NID_md4, + NID_md4WithRSAEncryption, + MD4_DIGEST_LENGTH, + 0, + NULL, + NULL, + NULL, + NULL, + NULL, + MD4_CBLOCK, +}; + +const EVP_MD *EVP_md4(void) +{ + return &md4_md; +} + +#endif /* OPENSSL_NO_MD4 */ diff --git a/crypto/evp/legacy_md5.c b/crypto/evp/legacy_md5.c new file mode 100644 index 00000000..f125b33f --- /dev/null +++ b/crypto/evp/legacy_md5.c @@ -0,0 +1,35 @@ +/* + * Copyright 2015-2019 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include + +#ifndef OPENSSL_NO_MD5 + +# include +# include "crypto/evp.h" + +static const EVP_MD md5_md = { + NID_md5, + NID_md5WithRSAEncryption, + MD5_DIGEST_LENGTH, + 0, + NULL, + NULL, + NULL, + NULL, + NULL, + MD5_CBLOCK, +}; + +const EVP_MD *EVP_md5(void) +{ + return &md5_md; +} + +#endif /* OPENSSL_NO_MD5 */ diff --git a/crypto/evp/legacy_md5_sha1.c b/crypto/evp/legacy_md5_sha1.c new file mode 100644 index 00000000..a23febfd --- /dev/null +++ b/crypto/evp/legacy_md5_sha1.c @@ -0,0 +1,37 @@ +/* + * Copyright 2015-2019 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include + +#include "prov/md5_sha1.h" /* diverse MD5_SHA1 macros */ + +#ifndef OPENSSL_NO_MD5 + +# include +# include "crypto/evp.h" + +static const EVP_MD md5_sha1_md = { + NID_md5_sha1, + NID_md5_sha1, + MD5_SHA1_DIGEST_LENGTH, + 0, + NULL, + NULL, + NULL, + NULL, + NULL, + MD5_SHA1_CBLOCK, +}; + +const EVP_MD *EVP_md5_sha1(void) +{ + return &md5_sha1_md; +} + +#endif /* OPENSSL_NO_MD5 */ diff --git a/crypto/evp/legacy_mdc2.c b/crypto/evp/legacy_mdc2.c new file mode 100644 index 00000000..5b51b015 --- /dev/null +++ b/crypto/evp/legacy_mdc2.c @@ -0,0 +1,35 @@ +/* + * Copyright 2015-2019 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include + +#ifndef OPENSSL_NO_MDC2 + +# include +# include "crypto/evp.h" + +static const EVP_MD mdc2_md = { + NID_mdc2, + NID_mdc2WithRSA, + MDC2_DIGEST_LENGTH, + 0, + NULL, + NULL, + NULL, + NULL, + NULL, + MDC2_BLOCK, +}; + +const EVP_MD *EVP_mdc2(void) +{ + return &mdc2_md; +} + +#endif /* OPENSSL_NO_MDC2 */ diff --git a/crypto/evp/legacy_sha.c b/crypto/evp/legacy_sha.c new file mode 100644 index 00000000..859c129a --- /dev/null +++ b/crypto/evp/legacy_sha.c @@ -0,0 +1,184 @@ +/* + * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include + +#include +#include /* diverse SHA macros */ +#include "internal/sha3.h" /* KECCAK1600_WIDTH */ +#include "crypto/evp.h" + +static const EVP_MD sha1_md = { + NID_sha1, + NID_sha1WithRSAEncryption, + SHA_DIGEST_LENGTH, + EVP_MD_FLAG_DIGALGID_ABSENT, + NULL, + NULL, + NULL, + NULL, + NULL, + SHA_CBLOCK, +}; + +const EVP_MD *EVP_sha1(void) +{ + return &sha1_md; +} + +static const EVP_MD sha224_md = { + NID_sha224, + NID_sha224WithRSAEncryption, + SHA224_DIGEST_LENGTH, + EVP_MD_FLAG_DIGALGID_ABSENT, + NULL, + NULL, + NULL, + NULL, + NULL, + SHA256_CBLOCK, +}; + +const EVP_MD *EVP_sha224(void) +{ + return &sha224_md; +} + +static const EVP_MD sha256_md = { + NID_sha256, + NID_sha256WithRSAEncryption, + SHA256_DIGEST_LENGTH, + EVP_MD_FLAG_DIGALGID_ABSENT, + NULL, + NULL, + NULL, + NULL, + NULL, + SHA256_CBLOCK, +}; + +const EVP_MD *EVP_sha256(void) +{ + return &sha256_md; +} + +static const EVP_MD sha512_224_md = { + NID_sha512_224, + NID_sha512_224WithRSAEncryption, + SHA224_DIGEST_LENGTH, + EVP_MD_FLAG_DIGALGID_ABSENT, + NULL, + NULL, + NULL, + NULL, + NULL, + SHA512_CBLOCK, +}; + +const EVP_MD *EVP_sha512_224(void) +{ + return &sha512_224_md; +} + +static const EVP_MD sha512_256_md = { + NID_sha512_256, + NID_sha512_256WithRSAEncryption, + SHA256_DIGEST_LENGTH, + EVP_MD_FLAG_DIGALGID_ABSENT, + NULL, + NULL, + NULL, + NULL, + NULL, + SHA512_CBLOCK, +}; + +const EVP_MD *EVP_sha512_256(void) +{ + return &sha512_256_md; +} + +static const EVP_MD sha384_md = { + NID_sha384, + NID_sha384WithRSAEncryption, + SHA384_DIGEST_LENGTH, + EVP_MD_FLAG_DIGALGID_ABSENT, + NULL, + NULL, + NULL, + NULL, + NULL, + SHA512_CBLOCK, +}; + +const EVP_MD *EVP_sha384(void) +{ + return &sha384_md; +} + +static const EVP_MD sha512_md = { + NID_sha512, + NID_sha512WithRSAEncryption, + SHA512_DIGEST_LENGTH, + EVP_MD_FLAG_DIGALGID_ABSENT, + NULL, + NULL, + NULL, + NULL, + NULL, + SHA512_CBLOCK, +}; + +const EVP_MD *EVP_sha512(void) +{ + return &sha512_md; +} + +# define EVP_MD_SHA3(bitlen) \ + const EVP_MD *EVP_sha3_##bitlen(void) \ + { \ + static const EVP_MD sha3_##bitlen##_md = { \ + NID_sha3_##bitlen, \ + NID_RSA_SHA3_##bitlen, \ + bitlen / 8, \ + EVP_MD_FLAG_DIGALGID_ABSENT, \ + NULL, \ + NULL, \ + NULL, \ + NULL, \ + NULL, \ + (KECCAK1600_WIDTH - bitlen * 2) / 8, \ + }; \ + return &sha3_##bitlen##_md; \ + } +# define EVP_MD_SHAKE(bitlen) \ + const EVP_MD *EVP_shake##bitlen(void) \ + { \ + static const EVP_MD shake##bitlen##_md = { \ + NID_shake##bitlen, \ + 0, \ + bitlen / 8, \ + EVP_MD_FLAG_XOF, \ + NULL, \ + NULL, \ + NULL, \ + NULL, \ + NULL, \ + (KECCAK1600_WIDTH - bitlen * 2) / 8, \ + }; \ + return &shake##bitlen##_md; \ + } + +EVP_MD_SHA3(224) +EVP_MD_SHA3(256) +EVP_MD_SHA3(384) +EVP_MD_SHA3(512) + +EVP_MD_SHAKE(128) +EVP_MD_SHAKE(256) diff --git a/crypto/evp/m_md2.c b/crypto/evp/m_md2.c deleted file mode 100644 index d7738472..00000000 --- a/crypto/evp/m_md2.c +++ /dev/null @@ -1,56 +0,0 @@ -/* - * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#include -#include "internal/cryptlib.h" - -#ifndef OPENSSL_NO_MD2 - -# include -# include -# include -# include -# include - -#include "internal/evp_int.h" - -static int init(EVP_MD_CTX *ctx) -{ - return MD2_Init(EVP_MD_CTX_md_data(ctx)); -} - -static int update(EVP_MD_CTX *ctx, const void *data, size_t count) -{ - return MD2_Update(EVP_MD_CTX_md_data(ctx), data, count); -} - -static int final(EVP_MD_CTX *ctx, unsigned char *md) -{ - return MD2_Final(md, EVP_MD_CTX_md_data(ctx)); -} - -static const EVP_MD md2_md = { - NID_md2, - NID_md2WithRSAEncryption, - MD2_DIGEST_LENGTH, - 0, - init, - update, - final, - NULL, - NULL, - MD2_BLOCK, - sizeof(EVP_MD *) + sizeof(MD2_CTX), -}; - -const EVP_MD *EVP_md2(void) -{ - return &md2_md; -} -#endif diff --git a/crypto/evp/m_md4.c b/crypto/evp/m_md4.c deleted file mode 100644 index 1dc3cdee..00000000 --- a/crypto/evp/m_md4.c +++ /dev/null @@ -1,55 +0,0 @@ -/* - * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#include -#include "internal/cryptlib.h" - -#ifndef OPENSSL_NO_MD4 - -# include -# include -# include -# include -# include -# include "internal/evp_int.h" - -static int init(EVP_MD_CTX *ctx) -{ - return MD4_Init(EVP_MD_CTX_md_data(ctx)); -} - -static int update(EVP_MD_CTX *ctx, const void *data, size_t count) -{ - return MD4_Update(EVP_MD_CTX_md_data(ctx), data, count); -} - -static int final(EVP_MD_CTX *ctx, unsigned char *md) -{ - return MD4_Final(md, EVP_MD_CTX_md_data(ctx)); -} - -static const EVP_MD md4_md = { - NID_md4, - NID_md4WithRSAEncryption, - MD4_DIGEST_LENGTH, - 0, - init, - update, - final, - NULL, - NULL, - MD4_CBLOCK, - sizeof(EVP_MD *) + sizeof(MD4_CTX), -}; - -const EVP_MD *EVP_md4(void) -{ - return &md4_md; -} -#endif diff --git a/crypto/evp/m_md5.c b/crypto/evp/m_md5.c deleted file mode 100644 index 539ab764..00000000 --- a/crypto/evp/m_md5.c +++ /dev/null @@ -1,55 +0,0 @@ -/* - * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#include -#include "internal/cryptlib.h" - -#ifndef OPENSSL_NO_MD5 - -# include -# include -# include -# include -# include -# include "internal/evp_int.h" - -static int init(EVP_MD_CTX *ctx) -{ - return MD5_Init(EVP_MD_CTX_md_data(ctx)); -} - -static int update(EVP_MD_CTX *ctx, const void *data, size_t count) -{ - return MD5_Update(EVP_MD_CTX_md_data(ctx), data, count); -} - -static int final(EVP_MD_CTX *ctx, unsigned char *md) -{ - return MD5_Final(md, EVP_MD_CTX_md_data(ctx)); -} - -static const EVP_MD md5_md = { - NID_md5, - NID_md5WithRSAEncryption, - MD5_DIGEST_LENGTH, - 0, - init, - update, - final, - NULL, - NULL, - MD5_CBLOCK, - sizeof(EVP_MD *) + sizeof(MD5_CTX), -}; - -const EVP_MD *EVP_md5(void) -{ - return &md5_md; -} -#endif diff --git a/crypto/evp/m_md5_sha1.c b/crypto/evp/m_md5_sha1.c deleted file mode 100644 index af8ae31e..00000000 --- a/crypto/evp/m_md5_sha1.c +++ /dev/null @@ -1,58 +0,0 @@ -/* - * Copyright 2015-2019 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#ifndef OPENSSL_NO_MD5 - -# include -# include -# include -# include "internal/evp_int.h" -# include "internal/md5_sha1.h" - -static int init(EVP_MD_CTX *ctx) -{ - return md5_sha1_init(EVP_MD_CTX_md_data(ctx)); -} - -static int update(EVP_MD_CTX *ctx, const void *data, size_t count) -{ - return md5_sha1_update(EVP_MD_CTX_md_data(ctx), data, count); -} - -static int final(EVP_MD_CTX *ctx, unsigned char *md) -{ - return md5_sha1_final(md, EVP_MD_CTX_md_data(ctx)); -} - -static int ctrl(EVP_MD_CTX *ctx, int cmd, int mslen, void *ms) -{ - return md5_sha1_ctrl(EVP_MD_CTX_md_data(ctx), cmd, mslen, ms); -} - -static const EVP_MD md5_sha1_md = { - NID_md5_sha1, - NID_md5_sha1, - MD5_SHA1_DIGEST_LENGTH, - 0, - init, - update, - final, - NULL, - NULL, - MD5_SHA1_CBLOCK, - sizeof(EVP_MD *) + sizeof(MD5_SHA1_CTX), - ctrl -}; - -const EVP_MD *EVP_md5_sha1(void) -{ - return &md5_sha1_md; -} - -#endif /* OPENSSL_NO_MD5 */ diff --git a/crypto/evp/m_mdc2.c b/crypto/evp/m_mdc2.c deleted file mode 100644 index 145d9550..00000000 --- a/crypto/evp/m_mdc2.c +++ /dev/null @@ -1,55 +0,0 @@ -/* - * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#include -#include "internal/cryptlib.h" - -#ifndef OPENSSL_NO_MDC2 - -# include -# include -# include -# include -# include -# include "internal/evp_int.h" - -static int init(EVP_MD_CTX *ctx) -{ - return MDC2_Init(EVP_MD_CTX_md_data(ctx)); -} - -static int update(EVP_MD_CTX *ctx, const void *data, size_t count) -{ - return MDC2_Update(EVP_MD_CTX_md_data(ctx), data, count); -} - -static int final(EVP_MD_CTX *ctx, unsigned char *md) -{ - return MDC2_Final(md, EVP_MD_CTX_md_data(ctx)); -} - -static const EVP_MD mdc2_md = { - NID_mdc2, - NID_mdc2WithRSA, - MDC2_DIGEST_LENGTH, - 0, - init, - update, - final, - NULL, - NULL, - MDC2_BLOCK, - sizeof(EVP_MD *) + sizeof(MDC2_CTX), -}; - -const EVP_MD *EVP_mdc2(void) -{ - return &mdc2_md; -} -#endif diff --git a/crypto/evp/m_null.c b/crypto/evp/m_null.c index 5dcb250f..51c93c0d 100644 --- a/crypto/evp/m_null.c +++ b/crypto/evp/m_null.c @@ -12,7 +12,7 @@ #include #include #include -#include "internal/evp_int.h" +#include "crypto/evp.h" static int init(EVP_MD_CTX *ctx) { diff --git a/crypto/evp/m_ripemd.c b/crypto/evp/m_ripemd.c index d821a584..4e05d18b 100644 --- a/crypto/evp/m_ripemd.c +++ b/crypto/evp/m_ripemd.c @@ -17,7 +17,7 @@ # include # include # include -# include "internal/evp_int.h" +# include "crypto/evp.h" static int init(EVP_MD_CTX *ctx) { diff --git a/crypto/evp/m_sha1.c b/crypto/evp/m_sha1.c deleted file mode 100644 index 1258ea03..00000000 --- a/crypto/evp/m_sha1.c +++ /dev/null @@ -1,243 +0,0 @@ -/* - * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#include -#include "internal/cryptlib.h" - -#include -#include -#include -#include -#include "internal/evp_int.h" -#include "internal/sha.h" - -static int init(EVP_MD_CTX *ctx) -{ - return SHA1_Init(EVP_MD_CTX_md_data(ctx)); -} - -static int update(EVP_MD_CTX *ctx, const void *data, size_t count) -{ - return SHA1_Update(EVP_MD_CTX_md_data(ctx), data, count); -} - -static int final(EVP_MD_CTX *ctx, unsigned char *md) -{ - return SHA1_Final(md, EVP_MD_CTX_md_data(ctx)); -} - -static int ctrl(EVP_MD_CTX *ctx, int cmd, int p1, void *p2) -{ - return sha1_ctrl(ctx != NULL ? EVP_MD_CTX_md_data(ctx) : NULL, cmd, p1, p2); -} - -static const EVP_MD sha1_md = { - NID_sha1, - NID_sha1WithRSAEncryption, - SHA_DIGEST_LENGTH, - EVP_MD_FLAG_DIGALGID_ABSENT, - init, - update, - final, - NULL, - NULL, - SHA_CBLOCK, - sizeof(EVP_MD *) + sizeof(SHA_CTX), - ctrl -}; - -const EVP_MD *EVP_sha1(void) -{ - return &sha1_md; -} - -static int init224(EVP_MD_CTX *ctx) -{ - return SHA224_Init(EVP_MD_CTX_md_data(ctx)); -} - -static int update224(EVP_MD_CTX *ctx, const void *data, size_t count) -{ - return SHA224_Update(EVP_MD_CTX_md_data(ctx), data, count); -} - -static int final224(EVP_MD_CTX *ctx, unsigned char *md) -{ - return SHA224_Final(md, EVP_MD_CTX_md_data(ctx)); -} - -static int init256(EVP_MD_CTX *ctx) -{ - return SHA256_Init(EVP_MD_CTX_md_data(ctx)); -} - -static int update256(EVP_MD_CTX *ctx, const void *data, size_t count) -{ - return SHA256_Update(EVP_MD_CTX_md_data(ctx), data, count); -} - -static int final256(EVP_MD_CTX *ctx, unsigned char *md) -{ - return SHA256_Final(md, EVP_MD_CTX_md_data(ctx)); -} - -static const EVP_MD sha224_md = { - NID_sha224, - NID_sha224WithRSAEncryption, - SHA224_DIGEST_LENGTH, - EVP_MD_FLAG_DIGALGID_ABSENT, - init224, - update224, - final224, - NULL, - NULL, - SHA256_CBLOCK, - sizeof(EVP_MD *) + sizeof(SHA256_CTX), -}; - -const EVP_MD *EVP_sha224(void) -{ - return &sha224_md; -} - -static const EVP_MD sha256_md = { - NID_sha256, - NID_sha256WithRSAEncryption, - SHA256_DIGEST_LENGTH, - EVP_MD_FLAG_DIGALGID_ABSENT, - init256, - update256, - final256, - NULL, - NULL, - SHA256_CBLOCK, - sizeof(EVP_MD *) + sizeof(SHA256_CTX), -}; - -const EVP_MD *EVP_sha256(void) -{ - return &sha256_md; -} - -static int init512_224(EVP_MD_CTX *ctx) -{ - return sha512_224_init(EVP_MD_CTX_md_data(ctx)); -} - -static int init512_256(EVP_MD_CTX *ctx) -{ - return sha512_256_init(EVP_MD_CTX_md_data(ctx)); -} - -static int init384(EVP_MD_CTX *ctx) -{ - return SHA384_Init(EVP_MD_CTX_md_data(ctx)); -} - -static int update384(EVP_MD_CTX *ctx, const void *data, size_t count) -{ - return SHA384_Update(EVP_MD_CTX_md_data(ctx), data, count); -} - -static int final384(EVP_MD_CTX *ctx, unsigned char *md) -{ - return SHA384_Final(md, EVP_MD_CTX_md_data(ctx)); -} - -static int init512(EVP_MD_CTX *ctx) -{ - return SHA512_Init(EVP_MD_CTX_md_data(ctx)); -} - -/* See comment in SHA224/256 section */ -static int update512(EVP_MD_CTX *ctx, const void *data, size_t count) -{ - return SHA512_Update(EVP_MD_CTX_md_data(ctx), data, count); -} - -static int final512(EVP_MD_CTX *ctx, unsigned char *md) -{ - return SHA512_Final(md, EVP_MD_CTX_md_data(ctx)); -} - -static const EVP_MD sha512_224_md = { - NID_sha512_224, - NID_sha512_224WithRSAEncryption, - SHA224_DIGEST_LENGTH, - EVP_MD_FLAG_DIGALGID_ABSENT, - init512_224, - update512, - final512, - NULL, - NULL, - SHA512_CBLOCK, - sizeof(EVP_MD *) + sizeof(SHA512_CTX), -}; - -const EVP_MD *EVP_sha512_224(void) -{ - return &sha512_224_md; -} - -static const EVP_MD sha512_256_md = { - NID_sha512_256, - NID_sha512_256WithRSAEncryption, - SHA256_DIGEST_LENGTH, - EVP_MD_FLAG_DIGALGID_ABSENT, - init512_256, - update512, - final512, - NULL, - NULL, - SHA512_CBLOCK, - sizeof(EVP_MD *) + sizeof(SHA512_CTX), -}; - -const EVP_MD *EVP_sha512_256(void) -{ - return &sha512_256_md; -} - -static const EVP_MD sha384_md = { - NID_sha384, - NID_sha384WithRSAEncryption, - SHA384_DIGEST_LENGTH, - EVP_MD_FLAG_DIGALGID_ABSENT, - init384, - update384, - final384, - NULL, - NULL, - SHA512_CBLOCK, - sizeof(EVP_MD *) + sizeof(SHA512_CTX), -}; - -const EVP_MD *EVP_sha384(void) -{ - return &sha384_md; -} - -static const EVP_MD sha512_md = { - NID_sha512, - NID_sha512WithRSAEncryption, - SHA512_DIGEST_LENGTH, - EVP_MD_FLAG_DIGALGID_ABSENT, - init512, - update512, - final512, - NULL, - NULL, - SHA512_CBLOCK, - sizeof(EVP_MD *) + sizeof(SHA512_CTX), -}; - -const EVP_MD *EVP_sha512(void) -{ - return &sha512_md; -} diff --git a/crypto/evp/m_sha3.c b/crypto/evp/m_sha3.c deleted file mode 100644 index 1e71eed9..00000000 --- a/crypto/evp/m_sha3.c +++ /dev/null @@ -1,319 +0,0 @@ -/* - * Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#include -#include - -#include -#include -#include "internal/evp_int.h" -#include "internal/sha3.h" -#include "evp_locl.h" - -static int init(EVP_MD_CTX *ctx) -{ - return sha3_init(EVP_MD_CTX_md_data(ctx), '\x06', ctx->digest->md_size * 8); -} - -static int update(EVP_MD_CTX *ctx, const void *_inp, size_t len) -{ - return sha3_update(EVP_MD_CTX_md_data(ctx), _inp, len); -} - -static int final(EVP_MD_CTX *ctx, unsigned char *md) -{ - return sha3_final(md, EVP_MD_CTX_md_data(ctx)); -} - -static int shake_init(EVP_MD_CTX *ctx) -{ - return sha3_init(EVP_MD_CTX_md_data(ctx), '\x1f', ctx->digest->md_size * 8); -} - -static int shake_ctrl(EVP_MD_CTX *evp_ctx, int cmd, int p1, void *p2) -{ - KECCAK1600_CTX *ctx = evp_ctx->md_data; - - switch (cmd) { - case EVP_MD_CTRL_XOF_LEN: - ctx->md_size = p1; - return 1; - default: - return 0; - } -} - -#if defined(OPENSSL_CPUID_OBJ) && defined(__s390__) && defined(KECCAK1600_ASM) -/* - * IBM S390X support - */ -# include "s390x_arch.h" - -# define S390X_SHA3_FC(ctx) ((ctx)->pad) - -# define S390X_sha3_224_CAPABLE ((OPENSSL_s390xcap_P.kimd[0] & \ - S390X_CAPBIT(S390X_SHA3_224)) && \ - (OPENSSL_s390xcap_P.klmd[0] & \ - S390X_CAPBIT(S390X_SHA3_224))) -# define S390X_sha3_256_CAPABLE ((OPENSSL_s390xcap_P.kimd[0] & \ - S390X_CAPBIT(S390X_SHA3_256)) && \ - (OPENSSL_s390xcap_P.klmd[0] & \ - S390X_CAPBIT(S390X_SHA3_256))) -# define S390X_sha3_384_CAPABLE ((OPENSSL_s390xcap_P.kimd[0] & \ - S390X_CAPBIT(S390X_SHA3_384)) && \ - (OPENSSL_s390xcap_P.klmd[0] & \ - S390X_CAPBIT(S390X_SHA3_384))) -# define S390X_sha3_512_CAPABLE ((OPENSSL_s390xcap_P.kimd[0] & \ - S390X_CAPBIT(S390X_SHA3_512)) && \ - (OPENSSL_s390xcap_P.klmd[0] & \ - S390X_CAPBIT(S390X_SHA3_512))) -# define S390X_shake128_CAPABLE ((OPENSSL_s390xcap_P.kimd[0] & \ - S390X_CAPBIT(S390X_SHAKE_128)) && \ - (OPENSSL_s390xcap_P.klmd[0] & \ - S390X_CAPBIT(S390X_SHAKE_128))) -# define S390X_shake256_CAPABLE ((OPENSSL_s390xcap_P.kimd[0] & \ - S390X_CAPBIT(S390X_SHAKE_256)) && \ - (OPENSSL_s390xcap_P.klmd[0] & \ - S390X_CAPBIT(S390X_SHAKE_256))) - -/* Convert md-size to block-size. */ -# define S390X_KECCAK1600_BSZ(n) ((KECCAK1600_WIDTH - ((n) << 1)) >> 3) - -static int s390x_sha3_init(EVP_MD_CTX *evp_ctx) -{ - KECCAK1600_CTX *ctx = evp_ctx->md_data; - const size_t bsz = evp_ctx->digest->block_size; - - /*- - * KECCAK1600_CTX structure's pad field is used to store the KIMD/KLMD - * function code. - */ - switch (bsz) { - case S390X_KECCAK1600_BSZ(224): - ctx->pad = S390X_SHA3_224; - break; - case S390X_KECCAK1600_BSZ(256): - ctx->pad = S390X_SHA3_256; - break; - case S390X_KECCAK1600_BSZ(384): - ctx->pad = S390X_SHA3_384; - break; - case S390X_KECCAK1600_BSZ(512): - ctx->pad = S390X_SHA3_512; - break; - default: - return 0; - } - - memset(ctx->A, 0, sizeof(ctx->A)); - ctx->bufsz = 0; - ctx->block_size = bsz; - ctx->md_size = evp_ctx->digest->md_size; - return 1; -} - -static int s390x_shake_init(EVP_MD_CTX *evp_ctx) -{ - KECCAK1600_CTX *ctx = evp_ctx->md_data; - const size_t bsz = evp_ctx->digest->block_size; - - /*- - * KECCAK1600_CTX structure's pad field is used to store the KIMD/KLMD - * function code. - */ - switch (bsz) { - case S390X_KECCAK1600_BSZ(128): - ctx->pad = S390X_SHAKE_128; - break; - case S390X_KECCAK1600_BSZ(256): - ctx->pad = S390X_SHAKE_256; - break; - default: - return 0; - } - - memset(ctx->A, 0, sizeof(ctx->A)); - ctx->bufsz = 0; - ctx->block_size = bsz; - ctx->md_size = evp_ctx->digest->md_size; - return 1; -} - -static int s390x_sha3_update(EVP_MD_CTX *evp_ctx, const void *_inp, size_t len) -{ - KECCAK1600_CTX *ctx = evp_ctx->md_data; - const unsigned char *inp = _inp; - const size_t bsz = ctx->block_size; - size_t num, rem; - - if (len == 0) - return 1; - - if ((num = ctx->bufsz) != 0) { - rem = bsz - num; - - if (len < rem) { - memcpy(ctx->buf + num, inp, len); - ctx->bufsz += len; - return 1; - } - memcpy(ctx->buf + num, inp, rem); - inp += rem; - len -= rem; - s390x_kimd(ctx->buf, bsz, ctx->pad, ctx->A); - ctx->bufsz = 0; - } - rem = len % bsz; - - s390x_kimd(inp, len - rem, ctx->pad, ctx->A); - - if (rem) { - memcpy(ctx->buf, inp + len - rem, rem); - ctx->bufsz = rem; - } - return 1; -} - -static int s390x_sha3_final(EVP_MD_CTX *evp_ctx, unsigned char *md) -{ - KECCAK1600_CTX *ctx = evp_ctx->md_data; - - s390x_klmd(ctx->buf, ctx->bufsz, NULL, 0, ctx->pad, ctx->A); - memcpy(md, ctx->A, ctx->md_size); - return 1; -} - -static int s390x_shake_final(EVP_MD_CTX *evp_ctx, unsigned char *md) -{ - KECCAK1600_CTX *ctx = evp_ctx->md_data; - - s390x_klmd(ctx->buf, ctx->bufsz, md, ctx->md_size, ctx->pad, ctx->A); - return 1; -} - -# define EVP_MD_SHA3(bitlen) \ -const EVP_MD *EVP_sha3_##bitlen(void) \ -{ \ - static const EVP_MD s390x_sha3_##bitlen##_md = { \ - NID_sha3_##bitlen, \ - NID_RSA_SHA3_##bitlen, \ - bitlen / 8, \ - EVP_MD_FLAG_DIGALGID_ABSENT, \ - s390x_sha3_init, \ - s390x_sha3_update, \ - s390x_sha3_final, \ - NULL, \ - NULL, \ - (KECCAK1600_WIDTH - bitlen * 2) / 8, \ - sizeof(KECCAK1600_CTX), \ - }; \ - static const EVP_MD sha3_##bitlen##_md = { \ - NID_sha3_##bitlen, \ - NID_RSA_SHA3_##bitlen, \ - bitlen / 8, \ - EVP_MD_FLAG_DIGALGID_ABSENT, \ - init, \ - update, \ - final, \ - NULL, \ - NULL, \ - (KECCAK1600_WIDTH - bitlen * 2) / 8, \ - sizeof(KECCAK1600_CTX), \ - }; \ - return S390X_sha3_##bitlen##_CAPABLE ? \ - &s390x_sha3_##bitlen##_md : \ - &sha3_##bitlen##_md; \ -} - -# define EVP_MD_SHAKE(bitlen) \ -const EVP_MD *EVP_shake##bitlen(void) \ -{ \ - static const EVP_MD s390x_shake##bitlen##_md = { \ - NID_shake##bitlen, \ - 0, \ - bitlen / 8, \ - EVP_MD_FLAG_XOF, \ - s390x_shake_init, \ - s390x_sha3_update, \ - s390x_shake_final, \ - NULL, \ - NULL, \ - (KECCAK1600_WIDTH - bitlen * 2) / 8, \ - sizeof(KECCAK1600_CTX), \ - shake_ctrl \ - }; \ - static const EVP_MD shake##bitlen##_md = { \ - NID_shake##bitlen, \ - 0, \ - bitlen / 8, \ - EVP_MD_FLAG_XOF, \ - shake_init, \ - update, \ - final, \ - NULL, \ - NULL, \ - (KECCAK1600_WIDTH - bitlen * 2) / 8, \ - sizeof(KECCAK1600_CTX), \ - shake_ctrl \ - }; \ - return S390X_shake##bitlen##_CAPABLE ? \ - &s390x_shake##bitlen##_md : \ - &shake##bitlen##_md; \ -} - -#else - -# define EVP_MD_SHA3(bitlen) \ -const EVP_MD *EVP_sha3_##bitlen(void) \ -{ \ - static const EVP_MD sha3_##bitlen##_md = { \ - NID_sha3_##bitlen, \ - NID_RSA_SHA3_##bitlen, \ - bitlen / 8, \ - EVP_MD_FLAG_DIGALGID_ABSENT, \ - init, \ - update, \ - final, \ - NULL, \ - NULL, \ - (KECCAK1600_WIDTH - bitlen * 2) / 8, \ - sizeof(KECCAK1600_CTX), \ - }; \ - return &sha3_##bitlen##_md; \ -} - -# define EVP_MD_SHAKE(bitlen) \ -const EVP_MD *EVP_shake##bitlen(void) \ -{ \ - static const EVP_MD shake##bitlen##_md = { \ - NID_shake##bitlen, \ - 0, \ - bitlen / 8, \ - EVP_MD_FLAG_XOF, \ - shake_init, \ - update, \ - final, \ - NULL, \ - NULL, \ - (KECCAK1600_WIDTH - bitlen * 2) / 8, \ - sizeof(KECCAK1600_CTX), \ - shake_ctrl \ - }; \ - return &shake##bitlen##_md; \ -} - -#endif - -EVP_MD_SHA3(224) -EVP_MD_SHA3(256) -EVP_MD_SHA3(384) -EVP_MD_SHA3(512) - -EVP_MD_SHAKE(128) -EVP_MD_SHAKE(256) diff --git a/crypto/evp/m_sigver.c b/crypto/evp/m_sigver.c index 987b35b7..c02325cf 100644 --- a/crypto/evp/m_sigver.c +++ b/crypto/evp/m_sigver.c @@ -12,8 +12,11 @@ #include #include #include -#include "internal/evp_int.h" -#include "evp_locl.h" +#include "crypto/evp.h" +#include "internal/provider.h" +#include "evp_local.h" + +#ifndef FIPS_MODE static int update(EVP_MD_CTX *ctx, const void *data, size_t datalen) { @@ -22,14 +25,122 @@ static int update(EVP_MD_CTX *ctx, const void *data, size_t datalen) } static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, - const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey, - int ver) + const EVP_MD *type, const char *mdname, + const char *props, ENGINE *e, EVP_PKEY *pkey, + EVP_SIGNATURE *signature, int ver) { - if (ctx->pctx == NULL) - ctx->pctx = EVP_PKEY_CTX_new(pkey, e); - if (ctx->pctx == NULL) - return 0; + EVP_PKEY_CTX *locpctx = NULL; + void *provkey = NULL; + int ret; + if (ctx->provctx != NULL) { + if (!ossl_assert(ctx->digest != NULL)) { + ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR); + return 0; + } + if (ctx->digest->freectx != NULL) + ctx->digest->freectx(ctx->provctx); + ctx->provctx = NULL; + } + + if (ctx->pctx == NULL) { + ctx->pctx = EVP_PKEY_CTX_new(pkey, e); + if (ctx->pctx == NULL) + return 0; + } else if (pkey != NULL) { + if (!EVP_PKEY_up_ref(pkey)) + return 0; + EVP_PKEY_free(ctx->pctx->pkey); + ctx->pctx->pkey = pkey; + } + locpctx = ctx->pctx; + evp_pkey_ctx_free_old_ops(locpctx); + if (locpctx->pkey == NULL) + goto legacy; + + if (e != NULL || locpctx->engine != NULL) + goto legacy; + + if (signature != NULL) { + if (!EVP_SIGNATURE_up_ref(signature)) + goto err; + } else { + /* + * TODO(3.0): Check for legacy handling. Remove this once all all + * algorithms are moved to providers. + */ + switch (locpctx->pkey->type) { + case NID_dsa: + break; + default: + goto legacy; + } + signature + = EVP_SIGNATURE_fetch(NULL, OBJ_nid2sn(locpctx->pkey->type), NULL); + + if (signature == NULL) { + ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR); + goto err; + } + } + locpctx->operation = ver ? EVP_PKEY_OP_VERIFYCTX + : EVP_PKEY_OP_SIGNCTX; + + locpctx->op.sig.signature = signature; + + locpctx->op.sig.sigprovctx + = signature->newctx(ossl_provider_ctx(signature->prov)); + if (locpctx->op.sig.sigprovctx == NULL) { + ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR); + goto err; + } + provkey = + evp_keymgmt_export_to_provider(locpctx->pkey, signature->keymgmt, 0); + if (provkey == NULL) { + ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR); + goto err; + } + + if (mdname == NULL) { + mdname = EVP_MD_name(type); + ctx->reqdigest = type; + } else { + /* + * This might be requested by a later call to EVP_MD_CTX_md(). In that + * case the "explicit fetch" rules apply for that function (as per + * man pages), i.e. the ref count is not updated so the EVP_MD should + * not be used beyound the lifetime of the EVP_MD_CTX. + */ + ctx->reqdigest + = ctx->fetched_digest + = EVP_MD_fetch( + ossl_provider_library_context(EVP_SIGNATURE_provider(signature)), + mdname, props); + } + + if (ver) { + if (signature->digest_verify_init == NULL) { + ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR); + goto err; + } + ret = signature->digest_verify_init(locpctx->op.sig.sigprovctx, mdname, + props, provkey); + } else { + if (signature->digest_sign_init == NULL) { + ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR); + goto err; + } + ret = signature->digest_sign_init(locpctx->op.sig.sigprovctx, mdname, + props, provkey); + } + + return ret ? 1 : 0; + err: + evp_pkey_ctx_free_old_ops(locpctx); + locpctx->operation = EVP_PKEY_OP_UNDEFINED; + return 0; + + legacy: if (!(ctx->pctx->pmeth->flags & EVP_PKEY_FLAG_SIGCTX_CUSTOM)) { if (type == NULL) { @@ -85,23 +196,86 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, return 1; } +int EVP_DigestSignInit_ex(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, + const char *mdname, const char *props, EVP_PKEY *pkey, + EVP_SIGNATURE *signature) +{ + return do_sigver_init(ctx, pctx, NULL, mdname, props, NULL, pkey, signature, + 0); +} + int EVP_DigestSignInit(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey) { - return do_sigver_init(ctx, pctx, type, e, pkey, 0); + return do_sigver_init(ctx, pctx, type, NULL, NULL, e, pkey, NULL, 0); +} + +int EVP_DigestVerifyInit_ex(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, + const char *mdname, const char *props, + EVP_PKEY *pkey, EVP_SIGNATURE *signature) +{ + return do_sigver_init(ctx, pctx, NULL, mdname, props, NULL, pkey, signature, + 1); } int EVP_DigestVerifyInit(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey) { - return do_sigver_init(ctx, pctx, type, e, pkey, 1); + return do_sigver_init(ctx, pctx, type, NULL, NULL, e, pkey, NULL, 1); +} +#endif /* FIPS_MDOE */ + +int EVP_DigestSignUpdate(EVP_MD_CTX *ctx, const void *data, size_t dsize) +{ + EVP_PKEY_CTX *pctx = ctx->pctx; + + if (pctx == NULL + || pctx->operation != EVP_PKEY_OP_SIGNCTX + || pctx->op.sig.sigprovctx == NULL + || pctx->op.sig.signature == NULL) + goto legacy; + + return pctx->op.sig.signature->digest_sign_update(pctx->op.sig.sigprovctx, + data, dsize); + + legacy: + return EVP_DigestUpdate(ctx, data, dsize); } +int EVP_DigestVerifyUpdate(EVP_MD_CTX *ctx, const void *data, size_t dsize) +{ + EVP_PKEY_CTX *pctx = ctx->pctx; + + if (pctx == NULL + || pctx->operation != EVP_PKEY_OP_VERIFYCTX + || pctx->op.sig.sigprovctx == NULL + || pctx->op.sig.signature == NULL) + goto legacy; + + return pctx->op.sig.signature->digest_verify_update(pctx->op.sig.sigprovctx, + data, dsize); + + legacy: + return EVP_DigestUpdate(ctx, data, dsize); +} + +#ifndef FIPS_MODE int EVP_DigestSignFinal(EVP_MD_CTX *ctx, unsigned char *sigret, size_t *siglen) { int sctx = 0, r = 0; EVP_PKEY_CTX *pctx = ctx->pctx; + + if (pctx == NULL + || pctx->operation != EVP_PKEY_OP_SIGNCTX + || pctx->op.sig.sigprovctx == NULL + || pctx->op.sig.signature == NULL) + goto legacy; + + return pctx->op.sig.signature->digest_sign_final(pctx->op.sig.sigprovctx, + sigret, siglen, SIZE_MAX); + + legacy: if (pctx->pmeth->flags & EVP_PKEY_FLAG_SIGCTX_CUSTOM) { if (!sigret) return pctx->pmeth->signctx(pctx, sigret, siglen, ctx); @@ -177,7 +351,18 @@ int EVP_DigestVerifyFinal(EVP_MD_CTX *ctx, const unsigned char *sig, int r = 0; unsigned int mdlen = 0; int vctx = 0; + EVP_PKEY_CTX *pctx = ctx->pctx; + if (pctx == NULL + || pctx->operation != EVP_PKEY_OP_VERIFYCTX + || pctx->op.sig.sigprovctx == NULL + || pctx->op.sig.signature == NULL) + goto legacy; + + return pctx->op.sig.signature->digest_verify_final(pctx->op.sig.sigprovctx, + sig, siglen); + + legacy: if (ctx->pctx->pmeth->verifyctx) vctx = 1; else @@ -216,3 +401,4 @@ int EVP_DigestVerify(EVP_MD_CTX *ctx, const unsigned char *sigret, return -1; return EVP_DigestVerifyFinal(ctx, sigret, siglen); } +#endif /* FIPS_MODE */ diff --git a/crypto/evp/m_wp.c b/crypto/evp/m_wp.c index 10c07ff5..ee69df56 100644 --- a/crypto/evp/m_wp.c +++ b/crypto/evp/m_wp.c @@ -16,7 +16,7 @@ # include # include # include -# include "internal/evp_int.h" +# include "crypto/evp.h" static int init(EVP_MD_CTX *ctx) { diff --git a/crypto/evp/mac_lib.c b/crypto/evp/mac_lib.c index cf704ba4..07ed1c87 100644 --- a/crypto/evp/mac_lib.c +++ b/crypto/evp/mac_lib.c @@ -13,11 +13,11 @@ #include #include #include -#include +#include #include "internal/nelem.h" -#include "internal/evp_int.h" +#include "crypto/evp.h" #include "internal/provider.h" -#include "evp_locl.h" +#include "evp_local.h" EVP_MAC_CTX *EVP_MAC_CTX_new(EVP_MAC *mac) { @@ -157,3 +157,21 @@ int EVP_MAC_CTX_set_params(EVP_MAC_CTX *ctx, const OSSL_PARAM params[]) return ctx->meth->set_ctx_params(ctx->data, params); return 1; } + +int EVP_MAC_number(const EVP_MAC *mac) +{ + return mac->name_id; +} + +int EVP_MAC_is_a(const EVP_MAC *mac, const char *name) +{ + return evp_is_a(mac->prov, mac->name_id, name); +} + +void EVP_MAC_names_do_all(const EVP_MAC *mac, + void (*fn)(const char *name, void *data), + void *data) +{ + if (mac->prov != NULL) + evp_names_do_all(mac->prov, mac->name_id, fn, data); +} diff --git a/crypto/evp/mac_meth.c b/crypto/evp/mac_meth.c index 8c47a6c6..2c124aef 100644 --- a/crypto/evp/mac_meth.c +++ b/crypto/evp/mac_meth.c @@ -2,9 +2,9 @@ #include #include #include -#include "internal/evp_int.h" +#include "crypto/evp.h" #include "internal/provider.h" -#include "evp_locl.h" +#include "evp_local.h" static int evp_mac_up_ref(void *vmac) { @@ -168,16 +168,6 @@ void EVP_MAC_free(EVP_MAC *mac) evp_mac_free(mac); } -int EVP_MAC_is_a(const EVP_MAC *mac, const char *name) -{ - return evp_is_a(mac->prov, mac->name_id, name); -} - -const char *EVP_MAC_name(const EVP_MAC *mac) -{ - return evp_first_name(mac->prov, mac->name_id); -} - const OSSL_PROVIDER *EVP_MAC_provider(const EVP_MAC *mac) { return mac->prov; @@ -190,23 +180,23 @@ const OSSL_PARAM *EVP_MAC_gettable_params(const EVP_MAC *mac) return mac->gettable_params(); } -const OSSL_PARAM *EVP_MAC_CTX_gettable_params(const EVP_MAC *mac) +const OSSL_PARAM *EVP_MAC_gettable_ctx_params(const EVP_MAC *mac) { if (mac->gettable_ctx_params == NULL) return NULL; return mac->gettable_ctx_params(); } -const OSSL_PARAM *EVP_MAC_CTX_settable_params(const EVP_MAC *mac) +const OSSL_PARAM *EVP_MAC_settable_ctx_params(const EVP_MAC *mac) { if (mac->settable_ctx_params == NULL) return NULL; return mac->settable_ctx_params(); } -void EVP_MAC_do_all_ex(OPENSSL_CTX *libctx, - void (*fn)(EVP_MAC *mac, void *arg), - void *arg) +void EVP_MAC_do_all_provided(OPENSSL_CTX *libctx, + void (*fn)(EVP_MAC *mac, void *arg), + void *arg) { evp_generic_do_all(libctx, OSSL_OP_MAC, (void (*)(void *, void *))fn, arg, diff --git a/crypto/evp/names.c b/crypto/evp/names.c index 7c2f4f06..901899ad 100644 --- a/crypto/evp/names.c +++ b/crypto/evp/names.c @@ -11,9 +11,9 @@ #include "internal/cryptlib.h" #include #include -#include "internal/objects.h" +#include "crypto/objects.h" #include -#include "internal/evp_int.h" +#include "crypto/evp.h" int EVP_add_cipher(const EVP_CIPHER *c) { diff --git a/crypto/evp/p5_crpt.c b/crypto/evp/p5_crpt.c index 0f5158e4..272643cf 100644 --- a/crypto/evp/p5_crpt.c +++ b/crypto/evp/p5_crpt.c @@ -59,14 +59,14 @@ int PKCS5_PBE_keyivgen(EVP_CIPHER_CTX *cctx, const char *pass, int passlen, return 0; } - if (!pbe->iter) + if (pbe->iter == NULL) iter = 1; else iter = ASN1_INTEGER_get(pbe->iter); salt = pbe->salt->data; saltlen = pbe->salt->length; - if (!pass) + if (pass == NULL) passlen = 0; else if (passlen == -1) passlen = strlen(pass); diff --git a/crypto/evp/p5_crpt2.c b/crypto/evp/p5_crpt2.c index 96a72730..2a27f530 100644 --- a/crypto/evp/p5_crpt2.c +++ b/crypto/evp/p5_crpt2.c @@ -16,8 +16,8 @@ #include #include #include -#include "internal/evp_int.h" -#include "evp_locl.h" +#include "crypto/evp.h" +#include "evp_local.h" int PKCS5_PBKDF2_HMAC(const char *pass, int passlen, const unsigned char *salt, int saltlen, int iter, diff --git a/crypto/evp/p_lib.c b/crypto/evp/p_lib.c index 5ec519d2..04530063 100644 --- a/crypto/evp/p_lib.c +++ b/crypto/evp/p_lib.c @@ -23,8 +23,8 @@ #include #include -#include "internal/asn1_int.h" -#include "internal/evp_int.h" +#include "crypto/asn1.h" +#include "crypto/evp.h" #include "internal/provider.h" static void EVP_PKEY_free_it(EVP_PKEY *x); @@ -40,7 +40,7 @@ int EVP_PKEY_security_bits(const EVP_PKEY *pkey) { if (pkey == NULL) return 0; - if (!pkey->ameth || !pkey->ameth->pkey_security_bits) + if (pkey->ameth == NULL || pkey->ameth->pkey_security_bits == NULL) return -2; return pkey->ameth->pkey_security_bits(pkey); } @@ -344,8 +344,7 @@ EVP_PKEY *EVP_PKEY_new_CMAC_key(ENGINE *e, const unsigned char *priv, # ifndef OPENSSL_NO_ENGINE if (engine_id != NULL) params[paramsn++] = - OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_ENGINE, - (char *)engine_id, 0); + OSSL_PARAM_construct_utf8_string("engine", (char *)engine_id, 0); # endif params[paramsn++] = diff --git a/crypto/evp/p_open.c b/crypto/evp/p_open.c index a141eb4d..8cc72ebb 100644 --- a/crypto/evp/p_open.c +++ b/crypto/evp/p_open.c @@ -31,7 +31,7 @@ int EVP_OpenInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type, return 0; } - if (!priv) + if (priv == NULL) return 1; if (EVP_PKEY_id(priv) != EVP_PKEY_RSA) { diff --git a/crypto/evp/p_sign.c b/crypto/evp/p_sign.c index c1b0d3ac..44a69083 100644 --- a/crypto/evp/p_sign.c +++ b/crypto/evp/p_sign.c @@ -12,7 +12,7 @@ #include #include #include -#include "internal/evp_int.h" +#include "crypto/evp.h" int EVP_SignFinal(EVP_MD_CTX *ctx, unsigned char *sigret, unsigned int *siglen, EVP_PKEY *pkey) diff --git a/crypto/evp/p_verify.c b/crypto/evp/p_verify.c index 956b0895..fe4b7b56 100644 --- a/crypto/evp/p_verify.c +++ b/crypto/evp/p_verify.c @@ -12,7 +12,7 @@ #include #include #include -#include "internal/evp_int.h" +#include "crypto/evp.h" int EVP_VerifyFinal(EVP_MD_CTX *ctx, const unsigned char *sigbuf, unsigned int siglen, EVP_PKEY *pkey) diff --git a/crypto/evp/pkey_kdf.c b/crypto/evp/pkey_kdf.c index f32d2131..b1337f51 100644 --- a/crypto/evp/pkey_kdf.c +++ b/crypto/evp/pkey_kdf.c @@ -17,7 +17,7 @@ #include #include #include "internal/numbers.h" -#include "internal/evp_int.h" +#include "crypto/evp.h" #define MAX_PARAM 20 @@ -213,7 +213,7 @@ static int pkey_kdf_ctrl_str(EVP_PKEY_CTX *ctx, const char *type, EVP_KDF_CTX *kctx = pkctx->kctx; const EVP_KDF *kdf = EVP_KDF_CTX_kdf(kctx); BUF_MEM **collector = NULL; - const OSSL_PARAM *defs = EVP_KDF_CTX_settable_params(kdf); + const OSSL_PARAM *defs = EVP_KDF_settable_ctx_params(kdf); OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END }; int ok = 0; @@ -307,7 +307,7 @@ static int pkey_kdf_derive(EVP_PKEY_CTX *ctx, unsigned char *key, } #ifndef OPENSSL_NO_SCRYPT -const EVP_PKEY_METHOD scrypt_pkey_meth = { +static const EVP_PKEY_METHOD scrypt_pkey_meth = { EVP_PKEY_SCRYPT, 0, pkey_kdf_init, @@ -336,9 +336,14 @@ const EVP_PKEY_METHOD scrypt_pkey_meth = { pkey_kdf_ctrl, pkey_kdf_ctrl_str }; + +const EVP_PKEY_METHOD *scrypt_pkey_method(void) +{ + return &scrypt_pkey_meth; +} #endif -const EVP_PKEY_METHOD tls1_prf_pkey_meth = { +static const EVP_PKEY_METHOD tls1_prf_pkey_meth = { EVP_PKEY_TLS1_PRF, 0, pkey_kdf_init, @@ -368,7 +373,12 @@ const EVP_PKEY_METHOD tls1_prf_pkey_meth = { pkey_kdf_ctrl_str }; -const EVP_PKEY_METHOD hkdf_pkey_meth = { +const EVP_PKEY_METHOD *tls1_prf_pkey_method(void) +{ + return &tls1_prf_pkey_meth; +} + +static const EVP_PKEY_METHOD hkdf_pkey_meth = { EVP_PKEY_HKDF, 0, pkey_kdf_init, @@ -398,3 +408,7 @@ const EVP_PKEY_METHOD hkdf_pkey_meth = { pkey_kdf_ctrl_str }; +const EVP_PKEY_METHOD *hkdf_pkey_method(void) +{ + return &hkdf_pkey_meth; +} diff --git a/crypto/evp/pkey_mac.c b/crypto/evp/pkey_mac.c index 1343e19e..1c8f8785 100644 --- a/crypto/evp/pkey_mac.c +++ b/crypto/evp/pkey_mac.c @@ -13,8 +13,8 @@ #include #include #include -#include "internal/evp_int.h" -#include "evp_locl.h" +#include "crypto/evp.h" +#include "evp_local.h" /* MAC PKEY context structure */ @@ -278,8 +278,7 @@ static int pkey_mac_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) char *engineid = (char *)ENGINE_get_id(ctx->engine); params[params_n++] = - OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_ENGINE, - engineid, 0); + OSSL_PARAM_construct_utf8_string("engine", engineid, 0); #endif params[params_n++] = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_CIPHER, @@ -400,11 +399,9 @@ static int pkey_mac_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) char *engineid = ctx->engine == NULL ? NULL : (char *)ENGINE_get_id(ctx->engine); - if (engineid != NULL) { + if (engineid != NULL) params[params_n++] = - OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_ENGINE, - engineid, 0); - } + OSSL_PARAM_construct_utf8_string("engine", engineid, 0); #endif params[params_n++] = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST, @@ -455,7 +452,7 @@ static int pkey_mac_ctrl_str(EVP_PKEY_CTX *ctx, type = OSSL_MAC_PARAM_SIZE; if (!OSSL_PARAM_allocate_from_text(¶ms[0], - EVP_MAC_CTX_settable_params(mac), + EVP_MAC_settable_ctx_params(mac), type, value, strlen(value) + 1)) return 0; params[1] = OSSL_PARAM_construct_end(); @@ -464,7 +461,7 @@ static int pkey_mac_ctrl_str(EVP_PKEY_CTX *ctx, return ok; } -const EVP_PKEY_METHOD cmac_pkey_meth = { +static const EVP_PKEY_METHOD cmac_pkey_meth = { EVP_PKEY_CMAC, EVP_PKEY_FLAG_SIGCTX_CUSTOM, pkey_mac_init, @@ -497,7 +494,12 @@ const EVP_PKEY_METHOD cmac_pkey_meth = { pkey_mac_ctrl_str }; -const EVP_PKEY_METHOD hmac_pkey_meth = { +const EVP_PKEY_METHOD *cmac_pkey_method(void) +{ + return &cmac_pkey_meth; +} + +static const EVP_PKEY_METHOD hmac_pkey_meth = { EVP_PKEY_HMAC, 0, pkey_mac_init, @@ -530,7 +532,12 @@ const EVP_PKEY_METHOD hmac_pkey_meth = { pkey_mac_ctrl_str }; -const EVP_PKEY_METHOD siphash_pkey_meth = { +const EVP_PKEY_METHOD *hmac_pkey_method(void) +{ + return &hmac_pkey_meth; +} + +static const EVP_PKEY_METHOD siphash_pkey_meth = { EVP_PKEY_SIPHASH, EVP_PKEY_FLAG_SIGCTX_CUSTOM, pkey_mac_init, @@ -563,7 +570,12 @@ const EVP_PKEY_METHOD siphash_pkey_meth = { pkey_mac_ctrl_str }; -const EVP_PKEY_METHOD poly1305_pkey_meth = { +const EVP_PKEY_METHOD *siphash_pkey_method(void) +{ + return &siphash_pkey_meth; +} + +static const EVP_PKEY_METHOD poly1305_pkey_meth = { EVP_PKEY_POLY1305, EVP_PKEY_FLAG_SIGCTX_CUSTOM, pkey_mac_init, @@ -595,3 +607,8 @@ const EVP_PKEY_METHOD poly1305_pkey_meth = { pkey_mac_ctrl, pkey_mac_ctrl_str }; + +const EVP_PKEY_METHOD *poly1305_pkey_method(void) +{ + return &poly1305_pkey_meth; +} diff --git a/crypto/evp/pmeth_fn.c b/crypto/evp/pmeth_fn.c index 34db4863..d06edb21 100644 --- a/crypto/evp/pmeth_fn.c +++ b/crypto/evp/pmeth_fn.c @@ -12,9 +12,9 @@ #include #include #include "internal/cryptlib.h" -#include "internal/evp_int.h" +#include "crypto/evp.h" #include "internal/provider.h" -#include "evp_locl.h" +#include "evp_local.h" static EVP_SIGNATURE *evp_signature_new(OSSL_PROVIDER *prov) { @@ -52,7 +52,8 @@ static void *evp_signature_from_dispatch(int name_id, keymgmt_data->properties); EVP_SIGNATURE *signature = NULL; int ctxfncnt = 0, signfncnt = 0, verifyfncnt = 0, verifyrecfncnt = 0; - int gparamfncnt = 0, sparamfncnt = 0; + int digsignfncnt = 0, digverifyfncnt = 0; + int gparamfncnt = 0, sparamfncnt = 0, gmdparamfncnt = 0, smdparamfncnt = 0; if (keymgmt == NULL || EVP_KEYMGMT_provider(keymgmt) != prov) { ERR_raise(ERR_LIB_EVP, EVP_R_NO_KEYMGMT_AVAILABLE); @@ -114,6 +115,48 @@ static void *evp_signature_from_dispatch(int name_id, = OSSL_get_OP_signature_verify_recover(fns); verifyrecfncnt++; break; + case OSSL_FUNC_SIGNATURE_DIGEST_SIGN_INIT: + if (signature->digest_sign_init != NULL) + break; + signature->digest_sign_init + = OSSL_get_OP_signature_digest_sign_init(fns); + digsignfncnt++; + break; + case OSSL_FUNC_SIGNATURE_DIGEST_SIGN_UPDATE: + if (signature->digest_sign_update != NULL) + break; + signature->digest_sign_update + = OSSL_get_OP_signature_digest_sign_update(fns); + digsignfncnt++; + break; + case OSSL_FUNC_SIGNATURE_DIGEST_SIGN_FINAL: + if (signature->digest_sign_final != NULL) + break; + signature->digest_sign_final + = OSSL_get_OP_signature_digest_sign_final(fns); + digsignfncnt++; + break; + case OSSL_FUNC_SIGNATURE_DIGEST_VERIFY_INIT: + if (signature->digest_verify_init != NULL) + break; + signature->digest_verify_init + = OSSL_get_OP_signature_digest_verify_init(fns); + digverifyfncnt++; + break; + case OSSL_FUNC_SIGNATURE_DIGEST_VERIFY_UPDATE: + if (signature->digest_verify_update != NULL) + break; + signature->digest_verify_update + = OSSL_get_OP_signature_digest_verify_update(fns); + digverifyfncnt++; + break; + case OSSL_FUNC_SIGNATURE_DIGEST_VERIFY_FINAL: + if (signature->digest_verify_final != NULL) + break; + signature->digest_verify_final + = OSSL_get_OP_signature_digest_verify_final(fns); + digverifyfncnt++; + break; case OSSL_FUNC_SIGNATURE_FREECTX: if (signature->freectx != NULL) break; @@ -153,21 +196,65 @@ static void *evp_signature_from_dispatch(int name_id, = OSSL_get_OP_signature_settable_ctx_params(fns); sparamfncnt++; break; + case OSSL_FUNC_SIGNATURE_GET_CTX_MD_PARAMS: + if (signature->get_ctx_md_params != NULL) + break; + signature->get_ctx_md_params + = OSSL_get_OP_signature_get_ctx_md_params(fns); + gmdparamfncnt++; + break; + case OSSL_FUNC_SIGNATURE_GETTABLE_CTX_MD_PARAMS: + if (signature->gettable_ctx_md_params != NULL) + break; + signature->gettable_ctx_md_params + = OSSL_get_OP_signature_gettable_ctx_md_params(fns); + gmdparamfncnt++; + break; + case OSSL_FUNC_SIGNATURE_SET_CTX_MD_PARAMS: + if (signature->set_ctx_md_params != NULL) + break; + signature->set_ctx_md_params + = OSSL_get_OP_signature_set_ctx_md_params(fns); + smdparamfncnt++; + break; + case OSSL_FUNC_SIGNATURE_SETTABLE_CTX_MD_PARAMS: + if (signature->settable_ctx_md_params != NULL) + break; + signature->settable_ctx_md_params + = OSSL_get_OP_signature_settable_ctx_md_params(fns); + smdparamfncnt++; + break; } } if (ctxfncnt != 2 - || (signfncnt != 2 && verifyfncnt != 2 && verifyrecfncnt != 2) + || (signfncnt == 0 + && verifyfncnt == 0 + && verifyrecfncnt == 0 + && digsignfncnt == 0 + && digverifyfncnt == 0) + || (signfncnt != 0 && signfncnt != 2) + || (verifyfncnt != 0 && verifyfncnt != 2) + || (verifyrecfncnt != 0 && verifyrecfncnt != 2) + || (digsignfncnt != 0 && digsignfncnt != 3) + || (digverifyfncnt != 0 && digverifyfncnt != 3) || (gparamfncnt != 0 && gparamfncnt != 2) - || (sparamfncnt != 0 && sparamfncnt != 2)) { + || (sparamfncnt != 0 && sparamfncnt != 2) + || (gmdparamfncnt != 0 && gmdparamfncnt != 2) + || (smdparamfncnt != 0 && smdparamfncnt != 2)) { /* * In order to be a consistent set of functions we must have at least - * a set of context functions (newctx and freectx) as well as a pair of - * "signature" functions: (sign_init, sign) or (verify_init verify) or - * (verify_recover_init, verify_recover). set_ctx_params and - * settable_ctx_params are optional, but if one of them is present then - * the other one must also be present. The same applies to - * get_ctx_params and gettable_ctx_params. The dupctx function is - * optional. + * a set of context functions (newctx and freectx) as well as a set of + * "signature" functions: + * (sign_init, sign) or + * (verify_init verify) or + * (verify_recover_init, verify_recover) or + * (digest_sign_init, digest_sign_update, digest_sign_final) or + * (digest_verify_init, digest_verify_update, digest_verify_final). + * + * set_ctx_params and settable_ctx_params are optional, but if one of + * them is present then the other one must also be present. The same + * applies to get_ctx_params and gettable_ctx_params. The same rules + * apply to the "md_params" functions. The dupctx function is optional. */ ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_PROVIDER_FUNCTIONS); goto err; @@ -225,6 +312,40 @@ EVP_SIGNATURE *EVP_SIGNATURE_fetch(OPENSSL_CTX *ctx, const char *algorithm, (void (*)(void *))EVP_SIGNATURE_free); } +int EVP_SIGNATURE_is_a(const EVP_SIGNATURE *signature, const char *name) +{ + return evp_is_a(signature->prov, signature->name_id, name); +} + +int EVP_SIGNATURE_number(const EVP_SIGNATURE *signature) +{ + return signature->name_id; +} + +void EVP_SIGNATURE_do_all_provided(OPENSSL_CTX *libctx, + void (*fn)(EVP_SIGNATURE *signature, + void *arg), + void *arg) +{ + struct keymgmt_data_st keymgmt_data; + + keymgmt_data.ctx = libctx; + keymgmt_data.properties = NULL; + evp_generic_do_all(libctx, OSSL_OP_SIGNATURE, + (void (*)(void *, void *))fn, arg, + evp_signature_from_dispatch, &keymgmt_data, + (void (*)(void *))EVP_SIGNATURE_free); +} + + +void EVP_SIGNATURE_names_do_all(const EVP_SIGNATURE *signature, + void (*fn)(const char *name, void *data), + void *data) +{ + if (signature->prov != NULL) + evp_names_do_all(signature->prov, signature->name_id, fn, data); +} + static int evp_pkey_signature_init(EVP_PKEY_CTX *ctx, EVP_SIGNATURE *signature, int operation) { @@ -272,7 +393,8 @@ static int evp_pkey_signature_init(EVP_PKEY_CTX *ctx, EVP_SIGNATURE *signature, ctx->op.sig.signature = signature; if (ctx->pkey != NULL) { - provkey = evp_keymgmt_export_to_provider(ctx->pkey, signature->keymgmt); + provkey = + evp_keymgmt_export_to_provider(ctx->pkey, signature->keymgmt, 0); if (provkey == NULL) { EVPerr(0, EVP_R_INITIALIZATION_ERROR); goto err; diff --git a/crypto/evp/pmeth_gn.c b/crypto/evp/pmeth_gn.c index c81f5a1a..2564bbd0 100644 --- a/crypto/evp/pmeth_gn.c +++ b/crypto/evp/pmeth_gn.c @@ -12,9 +12,9 @@ #include "internal/cryptlib.h" #include #include -#include "internal/bn_int.h" -#include "internal/asn1_int.h" -#include "internal/evp_int.h" +#include "crypto/bn.h" +#include "crypto/asn1.h" +#include "crypto/evp.h" int EVP_PKEY_paramgen_init(EVP_PKEY_CTX *ctx) { diff --git a/crypto/evp/pmeth_lib.c b/crypto/evp/pmeth_lib.c index 2be51f15..c840a12b 100644 --- a/crypto/evp/pmeth_lib.c +++ b/crypto/evp/pmeth_lib.c @@ -16,66 +16,73 @@ #include #include #include "internal/cryptlib.h" -#include "internal/asn1_int.h" -#include "internal/evp_int.h" +#include "crypto/asn1.h" +#include "crypto/evp.h" #include "internal/numbers.h" #include "internal/provider.h" -#include "evp_locl.h" +#include "evp_local.h" +typedef const EVP_PKEY_METHOD *(*pmeth_fn)(void); typedef int sk_cmp_fn_type(const char *const *a, const char *const *b); static STACK_OF(EVP_PKEY_METHOD) *app_pkey_methods = NULL; /* This array needs to be in order of NIDs */ -static const EVP_PKEY_METHOD *standard_methods[] = { +static pmeth_fn standard_methods[] = { #ifndef OPENSSL_NO_RSA - &rsa_pkey_meth, + rsa_pkey_method, #endif #ifndef OPENSSL_NO_DH - &dh_pkey_meth, + dh_pkey_method, #endif #ifndef OPENSSL_NO_DSA - &dsa_pkey_meth, + dsa_pkey_method, #endif #ifndef OPENSSL_NO_EC - &ec_pkey_meth, + ec_pkey_method, #endif - &hmac_pkey_meth, + hmac_pkey_method, #ifndef OPENSSL_NO_CMAC - &cmac_pkey_meth, + cmac_pkey_method, #endif #ifndef OPENSSL_NO_RSA - &rsa_pss_pkey_meth, + rsa_pss_pkey_method, #endif #ifndef OPENSSL_NO_DH - &dhx_pkey_meth, + dhx_pkey_method, #endif #ifndef OPENSSL_NO_SCRYPT - &scrypt_pkey_meth, + scrypt_pkey_method, #endif - &tls1_prf_pkey_meth, + tls1_prf_pkey_method, #ifndef OPENSSL_NO_EC - &ecx25519_pkey_meth, - &ecx448_pkey_meth, + ecx25519_pkey_method, + ecx448_pkey_method, #endif - &hkdf_pkey_meth, + hkdf_pkey_method, #ifndef OPENSSL_NO_POLY1305 - &poly1305_pkey_meth, + poly1305_pkey_method, #endif #ifndef OPENSSL_NO_SIPHASH - &siphash_pkey_meth, + siphash_pkey_method, #endif #ifndef OPENSSL_NO_EC - &ed25519_pkey_meth, - &ed448_pkey_meth, + ed25519_pkey_method, + ed448_pkey_method, #endif #ifndef OPENSSL_NO_SM2 - &sm2_pkey_meth, + sm2_pkey_method, #endif }; -DECLARE_OBJ_BSEARCH_CMP_FN(const EVP_PKEY_METHOD *, const EVP_PKEY_METHOD *, - pmeth); +DECLARE_OBJ_BSEARCH_CMP_FN(const EVP_PKEY_METHOD *, pmeth_fn, pmeth_func); + +static int pmeth_func_cmp(const EVP_PKEY_METHOD *const *a, pmeth_fn const *b) +{ + return ((*a)->pkey_id - ((**b)())->pkey_id); +} + +IMPLEMENT_OBJ_BSEARCH_CMP_FN(const EVP_PKEY_METHOD *, pmeth_fn, pmeth_func); static int pmeth_cmp(const EVP_PKEY_METHOD *const *a, const EVP_PKEY_METHOD *const *b) @@ -83,13 +90,12 @@ static int pmeth_cmp(const EVP_PKEY_METHOD *const *a, return ((*a)->pkey_id - (*b)->pkey_id); } -IMPLEMENT_OBJ_BSEARCH_CMP_FN(const EVP_PKEY_METHOD *, const EVP_PKEY_METHOD *, - pmeth); - const EVP_PKEY_METHOD *EVP_PKEY_meth_find(int type) { + pmeth_fn *ret; EVP_PKEY_METHOD tmp; - const EVP_PKEY_METHOD *t = &tmp, **ret; + const EVP_PKEY_METHOD *t = &tmp; + tmp.pkey_id = type; if (app_pkey_methods) { int idx; @@ -97,15 +103,17 @@ const EVP_PKEY_METHOD *EVP_PKEY_meth_find(int type) if (idx >= 0) return sk_EVP_PKEY_METHOD_value(app_pkey_methods, idx); } - ret = OBJ_bsearch_pmeth(&t, standard_methods, - sizeof(standard_methods) / - sizeof(EVP_PKEY_METHOD *)); - if (!ret || !*ret) + ret = OBJ_bsearch_pmeth_func(&t, standard_methods, + sizeof(standard_methods) / + sizeof(pmeth_fn)); + if (ret == NULL || *ret == NULL) return NULL; - return *ret; + return (**ret)(); } -static EVP_PKEY_CTX *int_ctx_new(EVP_PKEY *pkey, ENGINE *e, int id) +static EVP_PKEY_CTX *int_ctx_new(EVP_PKEY *pkey, ENGINE *e, + const char *name, const char *propquery, + int id) { EVP_PKEY_CTX *ret; const EVP_PKEY_METHOD *pmeth = NULL; @@ -124,6 +132,8 @@ static EVP_PKEY_CTX *int_ctx_new(EVP_PKEY *pkey, ENGINE *e, int id) return 0; id = pkey->type; } + name = OBJ_nid2sn(id); + propquery = NULL; #ifndef OPENSSL_NO_ENGINE if (e == NULL && pkey != NULL) e = pkey->pmeth_engine != NULL ? pkey->pmeth_engine : pkey->engine; @@ -165,6 +175,8 @@ static EVP_PKEY_CTX *int_ctx_new(EVP_PKEY *pkey, ENGINE *e, int id) EVPerr(EVP_F_INT_CTX_NEW, ERR_R_MALLOC_FAILURE); return NULL; } + ret->algorithm = name; + ret->propquery = propquery; ret->engine = e; ret->pmeth = pmeth; ret->operation = EVP_PKEY_OP_UNDEFINED; @@ -271,12 +283,18 @@ void EVP_PKEY_meth_free(EVP_PKEY_METHOD *pmeth) EVP_PKEY_CTX *EVP_PKEY_CTX_new(EVP_PKEY *pkey, ENGINE *e) { - return int_ctx_new(pkey, e, -1); + return int_ctx_new(pkey, e, NULL, NULL, -1); } EVP_PKEY_CTX *EVP_PKEY_CTX_new_id(int id, ENGINE *e) { - return int_ctx_new(NULL, e, id); + return int_ctx_new(NULL, e, NULL, NULL, id); +} + +EVP_PKEY_CTX *EVP_PKEY_CTX_new_provided(const char *name, + const char *propquery) +{ + return int_ctx_new(NULL, NULL, name, propquery, -1); } EVP_PKEY_CTX *EVP_PKEY_CTX_dup(const EVP_PKEY_CTX *pctx) @@ -306,6 +324,8 @@ EVP_PKEY_CTX *EVP_PKEY_CTX_dup(const EVP_PKEY_CTX *pctx) EVP_PKEY_up_ref(pctx->pkey); rctx->pkey = pctx->pkey; rctx->operation = pctx->operation; + rctx->algorithm = pctx->algorithm; + rctx->propquery = pctx->propquery; if (EVP_PKEY_CTX_IS_DERIVE_OP(pctx)) { if (pctx->op.kex.exchange != NULL) { @@ -411,7 +431,7 @@ size_t EVP_PKEY_meth_get_count(void) const EVP_PKEY_METHOD *EVP_PKEY_meth_get0(size_t idx) { if (idx < OSSL_NELEM(standard_methods)) - return standard_methods[idx]; + return (standard_methods[idx])(); if (app_pkey_methods == NULL) return NULL; idx -= OSSL_NELEM(standard_methods); diff --git a/crypto/ex_data.c b/crypto/ex_data.c index cd8e6958..9f08606d 100644 --- a/crypto/ex_data.c +++ b/crypto/ex_data.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "internal/cryptlib_int.h" +#include "crypto/cryptlib.h" #include "internal/thread_once.h" int do_ex_data_init(OPENSSL_CTX *ctx) diff --git a/crypto/hmac/build.info b/crypto/hmac/build.info index 56ad67ef..4ed90c09 100644 --- a/crypto/hmac/build.info +++ b/crypto/hmac/build.info @@ -3,4 +3,4 @@ LIBS=../../libcrypto $COMMON=hmac.c SOURCE[../../libcrypto]=$COMMON hm_ameth.c -SOURCE[../../providers/fips]=$COMMON +SOURCE[../../providers/libfips.a]=$COMMON diff --git a/crypto/hmac/hm_ameth.c b/crypto/hmac/hm_ameth.c index f0a5bc9a..9ecb7861 100644 --- a/crypto/hmac/hm_ameth.c +++ b/crypto/hmac/hm_ameth.c @@ -10,8 +10,8 @@ #include #include "internal/cryptlib.h" #include -#include "internal/asn1_int.h" -#include "internal/evp_int.h" +#include "crypto/asn1.h" +#include "crypto/evp.h" /* * HMAC "ASN1" method. This is just here to indicate the maximum HMAC output diff --git a/crypto/hmac/hmac.c b/crypto/hmac/hmac.c index d392753c..17cc5871 100644 --- a/crypto/hmac/hmac.c +++ b/crypto/hmac/hmac.c @@ -13,7 +13,7 @@ #include "internal/cryptlib.h" #include #include -#include "hmac_lcl.h" +#include "hmac_local.h" int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len, const EVP_MD *md, ENGINE *impl) diff --git a/crypto/hmac/hmac_lcl.h b/crypto/hmac/hmac_local.h similarity index 90% rename from crypto/hmac/hmac_lcl.h rename to crypto/hmac/hmac_local.h index 4d8ef6f6..788721ef 100644 --- a/crypto/hmac/hmac_lcl.h +++ b/crypto/hmac/hmac_local.h @@ -7,8 +7,8 @@ * https://www.openssl.org/source/license.html */ -#ifndef HEADER_HMAC_LCL_H -# define HEADER_HMAC_LCL_H +#ifndef OSSL_CRYPTO_HMAC_LOCAL_H +# define OSSL_CRYPTO_HMAC_LOCAL_H /* The current largest case is for SHA3-224 */ #define HMAC_MAX_MD_CBLOCK_SIZE 144 diff --git a/crypto/idea/i_cbc.c b/crypto/idea/i_cbc.c index b6d236c4..a78841fc 100644 --- a/crypto/idea/i_cbc.c +++ b/crypto/idea/i_cbc.c @@ -8,7 +8,7 @@ */ #include -#include "idea_lcl.h" +#include "idea_local.h" void IDEA_cbc_encrypt(const unsigned char *in, unsigned char *out, long length, IDEA_KEY_SCHEDULE *ks, unsigned char *iv, diff --git a/crypto/idea/i_cfb64.c b/crypto/idea/i_cfb64.c index 3b867127..45c15b94 100644 --- a/crypto/idea/i_cfb64.c +++ b/crypto/idea/i_cfb64.c @@ -8,7 +8,7 @@ */ #include -#include "idea_lcl.h" +#include "idea_local.h" /* * The input and output encrypted as though 64bit cfb mode is being used. diff --git a/crypto/idea/i_ecb.c b/crypto/idea/i_ecb.c index 4a721a28..9fee1218 100644 --- a/crypto/idea/i_ecb.c +++ b/crypto/idea/i_ecb.c @@ -8,7 +8,7 @@ */ #include -#include "idea_lcl.h" +#include "idea_local.h" #include const char *IDEA_options(void) diff --git a/crypto/idea/i_ofb64.c b/crypto/idea/i_ofb64.c index 6c553215..517ded7b 100644 --- a/crypto/idea/i_ofb64.c +++ b/crypto/idea/i_ofb64.c @@ -8,7 +8,7 @@ */ #include -#include "idea_lcl.h" +#include "idea_local.h" /* * The input and output encrypted as though 64bit ofb mode is being used. diff --git a/crypto/idea/i_skey.c b/crypto/idea/i_skey.c index a0197bf7..0b0221bd 100644 --- a/crypto/idea/i_skey.c +++ b/crypto/idea/i_skey.c @@ -8,7 +8,7 @@ */ #include -#include "idea_lcl.h" +#include "idea_local.h" static IDEA_INT inverse(unsigned int xin); void IDEA_set_encrypt_key(const unsigned char *key, IDEA_KEY_SCHEDULE *ks) diff --git a/crypto/idea/idea_lcl.h b/crypto/idea/idea_local.h similarity index 100% rename from crypto/idea/idea_lcl.h rename to crypto/idea/idea_local.h diff --git a/crypto/include/internal/poly1305.h b/crypto/include/internal/poly1305.h deleted file mode 100644 index 46f834e2..00000000 --- a/crypto/include/internal/poly1305.h +++ /dev/null @@ -1,21 +0,0 @@ -/* - * Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#include - -#define POLY1305_BLOCK_SIZE 16 -#define POLY1305_DIGEST_SIZE 16 -#define POLY1305_KEY_SIZE 32 - -typedef struct poly1305_context POLY1305; - -size_t Poly1305_ctx_size(void); -void Poly1305_Init(POLY1305 *ctx, const unsigned char key[32]); -void Poly1305_Update(POLY1305 *ctx, const unsigned char *inp, size_t len); -void Poly1305_Final(POLY1305 *ctx, unsigned char mac[16]); diff --git a/crypto/info.c b/crypto/info.c index 355827c4..613ddc7d 100644 --- a/crypto/info.c +++ b/crypto/info.c @@ -8,7 +8,7 @@ */ #include -#include "internal/dso_conf.h" +#include "crypto/dso_conf.h" #include "internal/thread_once.h" #include "internal/cryptlib.h" #include "e_os.h" diff --git a/crypto/init.c b/crypto/init.c index 6536bd52..4aa3fc83 100644 --- a/crypto/init.c +++ b/crypto/init.c @@ -8,25 +8,26 @@ */ #include "e_os.h" -#include "internal/cryptlib_int.h" +#include "crypto/cryptlib.h" #include -#include "internal/rand_int.h" +#include "crypto/rand.h" #include "internal/bio.h" #include -#include "internal/evp_int.h" +#include "crypto/evp.h" #include "internal/conf.h" -#include "internal/async.h" -#include "internal/engine.h" +#include "crypto/async.h" +#include "crypto/engine.h" #include "internal/comp.h" #include "internal/err.h" -#include "internal/err_int.h" -#include "internal/objects.h" +#include "crypto/err.h" +#include "crypto/objects.h" #include #include #include "internal/thread_once.h" -#include "internal/dso_conf.h" +#include "crypto/dso_conf.h" #include "internal/dso.h" -#include "internal/store.h" +#include "crypto/store.h" +#include /* for OSSL_CMP_log_close() */ #include static int stopped = 0; @@ -431,6 +432,11 @@ void OPENSSL_cleanup(void) OSSL_TRACE(INIT, "OPENSSL_cleanup: CRYPTO_secure_malloc_done()\n"); CRYPTO_secure_malloc_done(); +#ifndef OPENSSL_NO_CMP + OSSL_TRACE(INIT, "OPENSSL_cleanup: OSSL_CMP_log_close()\n"); + OSSL_CMP_log_close(); +#endif + OSSL_TRACE(INIT, "OPENSSL_cleanup: ossl_trace_cleanup()\n"); ossl_trace_cleanup(); diff --git a/crypto/initthread.c b/crypto/initthread.c index 7de8a369..da30d59f 100644 --- a/crypto/initthread.c +++ b/crypto/initthread.c @@ -9,8 +9,8 @@ #include #include -#include "internal/cryptlib_int.h" -#include "internal/providercommon.h" +#include "crypto/cryptlib.h" +#include "prov/providercommon.h" #include "internal/thread_once.h" #ifdef FIPS_MODE diff --git a/crypto/lhash/build.info b/crypto/lhash/build.info index 0aa12a1e..b3176b83 100644 --- a/crypto/lhash/build.info +++ b/crypto/lhash/build.info @@ -1,5 +1,5 @@ LIBS=../../libcrypto SOURCE[../../libcrypto]=\ lhash.c lh_stats.c -SOURCE[../../providers/fips]=\ +SOURCE[../../providers/libfips.a]=\ lhash.c diff --git a/crypto/lhash/lh_stats.c b/crypto/lhash/lh_stats.c index 1b32b5db..5e38c425 100644 --- a/crypto/lhash/lh_stats.c +++ b/crypto/lhash/lh_stats.c @@ -18,7 +18,7 @@ #include #include -#include "lhash_lcl.h" +#include "lhash_local.h" # ifndef OPENSSL_NO_STDIO void OPENSSL_LH_stats(const OPENSSL_LHASH *lh, FILE *fp) diff --git a/crypto/lhash/lhash.c b/crypto/lhash/lhash.c index f91a56a7..76379a93 100644 --- a/crypto/lhash/lhash.c +++ b/crypto/lhash/lhash.c @@ -13,9 +13,9 @@ #include #include #include -#include "internal/ctype.h" -#include "internal/lhash.h" -#include "lhash_lcl.h" +#include "crypto/ctype.h" +#include "crypto/lhash.h" +#include "lhash_local.h" /* * A hashing implementation that appears to be based on the linear hashing diff --git a/crypto/lhash/lhash_lcl.h b/crypto/lhash/lhash_local.h similarity index 100% rename from crypto/lhash/lhash_lcl.h rename to crypto/lhash/lhash_local.h diff --git a/crypto/md4/md4_dgst.c b/crypto/md4/md4_dgst.c index 2ce66b6e..cf95fbe6 100644 --- a/crypto/md4/md4_dgst.c +++ b/crypto/md4/md4_dgst.c @@ -9,7 +9,7 @@ #include #include -#include "md4_locl.h" +#include "md4_local.h" /* * Implemented from RFC1186 The MD4 Message-Digest Algorithm @@ -39,7 +39,7 @@ void md4_block_data_order(MD4_CTX *c, const void *data_, size_t num) const unsigned char *data = data_; register unsigned MD32_REG_T A, B, C, D, l; # ifndef MD32_XARRAY - /* See comment in crypto/sha/sha_locl.h for details. */ + /* See comment in crypto/sha/sha_local.h for details. */ unsigned MD32_REG_T XX0, XX1, XX2, XX3, XX4, XX5, XX6, XX7, XX8, XX9, XX10, XX11, XX12, XX13, XX14, XX15; # define X(i) XX##i diff --git a/crypto/md4/md4_locl.h b/crypto/md4/md4_local.h similarity index 98% rename from crypto/md4/md4_locl.h rename to crypto/md4/md4_local.h index 74e53507..58c23e1a 100644 --- a/crypto/md4/md4_locl.h +++ b/crypto/md4/md4_local.h @@ -31,7 +31,7 @@ void md4_block_data_order(MD4_CTX *c, const void *p, size_t num); } while (0) #define HASH_BLOCK_DATA_ORDER md4_block_data_order -#include "internal/md32_common.h" +#include "crypto/md32_common.h" /*- #define F(x,y,z) (((x) & (y)) | ((~(x)) & (z))) diff --git a/crypto/md5/build.info b/crypto/md5/build.info index 081e0b08..d4494b27 100644 --- a/crypto/md5/build.info +++ b/crypto/md5/build.info @@ -15,7 +15,11 @@ IF[{- !$disabled{asm} -}] ENDIF SOURCE[../../libcrypto]=md5_dgst.c md5_one.c md5_sha1.c $MD5ASM + +# Implementations are now spread across several libraries, so the defines +# need to be applied to all affected libraries and modules. DEFINE[../../libcrypto]=$MD5DEF +DEFINE[../../providers/libimplementations.a]=$MD5DEF GENERATE[md5-586.s]=asm/md5-586.pl diff --git a/crypto/md5/md5_dgst.c b/crypto/md5/md5_dgst.c index 1c673e34..b594652f 100644 --- a/crypto/md5/md5_dgst.c +++ b/crypto/md5/md5_dgst.c @@ -8,7 +8,7 @@ */ #include -#include "md5_locl.h" +#include "md5_local.h" #include /* @@ -39,7 +39,7 @@ void md5_block_data_order(MD5_CTX *c, const void *data_, size_t num) const unsigned char *data = data_; register unsigned MD32_REG_T A, B, C, D, l; # ifndef MD32_XARRAY - /* See comment in crypto/sha/sha_locl.h for details. */ + /* See comment in crypto/sha/sha_local.h for details. */ unsigned MD32_REG_T XX0, XX1, XX2, XX3, XX4, XX5, XX6, XX7, XX8, XX9, XX10, XX11, XX12, XX13, XX14, XX15; # define X(i) XX##i diff --git a/crypto/md5/md5_locl.h b/crypto/md5/md5_local.h similarity index 98% rename from crypto/md5/md5_locl.h rename to crypto/md5/md5_local.h index 73ba4d6c..8571e484 100644 --- a/crypto/md5/md5_locl.h +++ b/crypto/md5/md5_local.h @@ -42,7 +42,7 @@ void md5_block_data_order(MD5_CTX *c, const void *p, size_t num); } while (0) #define HASH_BLOCK_DATA_ORDER md5_block_data_order -#include "internal/md32_common.h" +#include "crypto/md32_common.h" /*- #define F(x,y,z) (((x) & (y)) | ((~(x)) & (z))) diff --git a/crypto/md5/md5_sha1.c b/crypto/md5/md5_sha1.c index 5d5fac95..32bf9a13 100644 --- a/crypto/md5/md5_sha1.c +++ b/crypto/md5/md5_sha1.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ #include -#include "internal/md5_sha1.h" +#include "prov/md5_sha1.h" #include int md5_sha1_init(MD5_SHA1_CTX *mctx) diff --git a/crypto/mem.c b/crypto/mem.c index 562d6b51..d3cac29b 100644 --- a/crypto/mem.c +++ b/crypto/mem.c @@ -9,7 +9,7 @@ #include "e_os.h" #include "internal/cryptlib.h" -#include "internal/cryptlib_int.h" +#include "crypto/cryptlib.h" #include #include #include diff --git a/crypto/mips_arch.h b/crypto/mips_arch.h index df4ff7ae..12a27615 100644 --- a/crypto/mips_arch.h +++ b/crypto/mips_arch.h @@ -7,8 +7,8 @@ * https://www.openssl.org/source/license.html */ -#ifndef __MIPS_ARCH_H__ -# define __MIPS_ARCH_H__ +#ifndef OSSL_CRYPTO_MIPS_ARCH_H +# define OSSL_CRYPTO_MIPS_ARCH_H # if (defined(__mips_smartmips) || defined(_MIPS_ARCH_MIPS32R3) || \ defined(_MIPS_ARCH_MIPS32R5) || defined(_MIPS_ARCH_MIPS32R6)) \ diff --git a/crypto/modes/build.info b/crypto/modes/build.info index 8a8aead6..b741be82 100644 --- a/crypto/modes/build.info +++ b/crypto/modes/build.info @@ -52,10 +52,14 @@ $COMMON=cbc128.c ctr128.c cfb128.c ofb128.c gcm128.c ccm128.c xts128.c \ wrap128.c $MODESASM SOURCE[../../libcrypto]=$COMMON \ cts128.c ocb128.c siv128.c +SOURCE[../../providers/libfips.a]=$COMMON +# Implementations are now spread across several libraries, so the defines +# need to be applied to all affected libraries and modules. DEFINE[../../libcrypto]=$MODESDEF -SOURCE[../../providers/fips]=$COMMON -DEFINE[../../providers/fips]=$MODESDEF +DEFINE[../../providers/libfips.a]=$MODESDEF +DEFINE[../../providers/libimplementations.a]=$MODESDEF + INCLUDE[gcm128.o]=.. diff --git a/crypto/modes/cbc128.c b/crypto/modes/cbc128.c index eb8e06c1..eec44bd9 100644 --- a/crypto/modes/cbc128.c +++ b/crypto/modes/cbc128.c @@ -9,7 +9,7 @@ #include #include -#include "internal/modes_int.h" +#include "crypto/modes.h" #if !defined(STRICT_ALIGNMENT) && !defined(PEDANTIC) # define STRICT_ALIGNMENT 0 diff --git a/crypto/modes/ccm128.c b/crypto/modes/ccm128.c index e97158a1..1ffd6df4 100644 --- a/crypto/modes/ccm128.c +++ b/crypto/modes/ccm128.c @@ -9,7 +9,7 @@ #include #include -#include "internal/modes_int.h" +#include "crypto/modes.h" /* * First you setup M and L parameters and pass the key schedule. This is diff --git a/crypto/modes/cfb128.c b/crypto/modes/cfb128.c index 39644a23..e9ce4df3 100644 --- a/crypto/modes/cfb128.c +++ b/crypto/modes/cfb128.c @@ -9,7 +9,7 @@ #include #include -#include "internal/modes_int.h" +#include "crypto/modes.h" /* * The input and output encrypted as though 128bit cfb mode is being used. diff --git a/crypto/modes/ctr128.c b/crypto/modes/ctr128.c index 1755b850..ff7499b3 100644 --- a/crypto/modes/ctr128.c +++ b/crypto/modes/ctr128.c @@ -9,7 +9,7 @@ #include #include -#include "internal/modes_int.h" +#include "crypto/modes.h" /* * NOTE: the IV/counter CTR mode is big-endian. The code itself is diff --git a/crypto/modes/cts128.c b/crypto/modes/cts128.c index b4f2f377..5600d9c5 100644 --- a/crypto/modes/cts128.c +++ b/crypto/modes/cts128.c @@ -9,7 +9,7 @@ #include #include -#include "internal/modes_int.h" +#include "crypto/modes.h" /* * Trouble with Ciphertext Stealing, CTS, mode is that there is no diff --git a/crypto/modes/gcm128.c b/crypto/modes/gcm128.c index f37653be..d2f2da61 100644 --- a/crypto/modes/gcm128.c +++ b/crypto/modes/gcm128.c @@ -10,7 +10,7 @@ #include #include #include "internal/cryptlib.h" -#include "internal/modes_int.h" +#include "crypto/modes.h" #if defined(BSWAP4) && defined(STRICT_ALIGNMENT) /* redefine, because alignment is ensured */ diff --git a/crypto/modes/ocb128.c b/crypto/modes/ocb128.c index 9e7af607..78867005 100644 --- a/crypto/modes/ocb128.c +++ b/crypto/modes/ocb128.c @@ -10,7 +10,7 @@ #include #include #include -#include "internal/modes_int.h" +#include "crypto/modes.h" #ifndef OPENSSL_NO_OCB diff --git a/crypto/modes/ofb128.c b/crypto/modes/ofb128.c index b894cbb5..2eca09bc 100644 --- a/crypto/modes/ofb128.c +++ b/crypto/modes/ofb128.c @@ -9,7 +9,7 @@ #include #include -#include "internal/modes_int.h" +#include "crypto/modes.h" /* * The input and output encrypted as though 128bit ofb mode is being used. diff --git a/crypto/modes/siv128.c b/crypto/modes/siv128.c index 1d91ee78..71214103 100644 --- a/crypto/modes/siv128.c +++ b/crypto/modes/siv128.c @@ -13,8 +13,8 @@ #include #include #include -#include "internal/modes_int.h" -#include "internal/siv_int.h" +#include "crypto/modes.h" +#include "crypto/siv.h" #ifndef OPENSSL_NO_SIV diff --git a/crypto/modes/xts128.c b/crypto/modes/xts128.c index 03b83aa0..9d9b65ca 100644 --- a/crypto/modes/xts128.c +++ b/crypto/modes/xts128.c @@ -9,7 +9,7 @@ #include #include -#include "internal/modes_int.h" +#include "crypto/modes.h" int CRYPTO_xts128_encrypt(const XTS128_CONTEXT *ctx, const unsigned char iv[16], diff --git a/crypto/objects/o_names.c b/crypto/objects/o_names.c index 3ad905c9..52956ebc 100644 --- a/crypto/objects/o_names.c +++ b/crypto/objects/o_names.c @@ -17,8 +17,8 @@ #include #include #include "internal/thread_once.h" -#include "internal/lhash.h" -#include "obj_lcl.h" +#include "crypto/lhash.h" +#include "obj_local.h" #include "e_os.h" /* diff --git a/crypto/objects/obj_dat.c b/crypto/objects/obj_dat.c index c4155a3d..0c4ec985 100644 --- a/crypto/objects/obj_dat.c +++ b/crypto/objects/obj_dat.c @@ -8,15 +8,15 @@ */ #include -#include "internal/ctype.h" +#include "crypto/ctype.h" #include #include "internal/cryptlib.h" #include #include -#include "internal/objects.h" +#include "crypto/objects.h" #include -#include "internal/asn1_int.h" -#include "obj_lcl.h" +#include "crypto/asn1.h" +#include "obj_local.h" /* obj_dat.h is generated from objects.h by obj_dat.pl */ #include "obj_dat.h" diff --git a/crypto/objects/obj_dat.h b/crypto/objects/obj_dat.h index b3e65483..fa1690cc 100644 --- a/crypto/objects/obj_dat.h +++ b/crypto/objects/obj_dat.h @@ -1737,8 +1737,8 @@ static const ASN1_OBJECT nid_objs[NUM_NID] = { {"ITU-T", "itu-t", NID_itu_t}, {"JOINT-ISO-ITU-T", "joint-iso-itu-t", NID_joint_iso_itu_t}, {"international-organizations", "International Organizations", NID_international_organizations, 1, &so[4439]}, - {"msSmartcardLogin", "Microsoft Smartcardlogin", NID_ms_smartcard_login, 10, &so[4440]}, - {"msUPN", "Microsoft Universal Principal Name", NID_ms_upn, 10, &so[4450]}, + {"msSmartcardLogin", "Microsoft Smartcard Login", NID_ms_smartcard_login, 10, &so[4440]}, + {"msUPN", "Microsoft User Principal Name", NID_ms_upn, 10, &so[4450]}, {"AES-128-CFB1", "aes-128-cfb1", NID_aes_128_cfb1}, {"AES-192-CFB1", "aes-192-cfb1", NID_aes_192_cfb1}, {"AES-256-CFB1", "aes-256-cfb1", NID_aes_256_cfb1}, @@ -3621,9 +3621,9 @@ static const unsigned int ln_objs[NUM_LN] = { 134, /* "Microsoft Individual Code Signing" */ 856, /* "Microsoft Local Key set" */ 137, /* "Microsoft Server Gated Crypto" */ - 648, /* "Microsoft Smartcardlogin" */ + 648, /* "Microsoft Smartcard Login" */ 136, /* "Microsoft Trust List Signing" */ - 649, /* "Microsoft Universal Principal Name" */ + 649, /* "Microsoft User Principal Name" */ 393, /* "NULL" */ 404, /* "NULL" */ 72, /* "Netscape Base Url" */ diff --git a/crypto/objects/obj_lib.c b/crypto/objects/obj_lib.c index 5dfe7c5b..08266141 100644 --- a/crypto/objects/obj_lib.c +++ b/crypto/objects/obj_lib.c @@ -11,7 +11,7 @@ #include "internal/cryptlib.h" #include #include -#include "internal/asn1_int.h" +#include "crypto/asn1.h" ASN1_OBJECT *OBJ_dup(const ASN1_OBJECT *o) { diff --git a/crypto/objects/obj_lcl.h b/crypto/objects/obj_local.h similarity index 100% rename from crypto/objects/obj_lcl.h rename to crypto/objects/obj_local.h diff --git a/crypto/objects/objects.txt b/crypto/objects/objects.txt index 6f29a5a5..340c0e67 100644 --- a/crypto/objects/objects.txt +++ b/crypto/objects/objects.txt @@ -431,9 +431,9 @@ rsadsi 3 8 : RC5-CBC : rc5-cbc !Cname ms-efs 1 3 6 1 4 1 311 10 3 4 : msEFS : Microsoft Encrypted File System !Cname ms-smartcard-login -1 3 6 1 4 1 311 20 2 2 : msSmartcardLogin : Microsoft Smartcardlogin +1 3 6 1 4 1 311 20 2 2 : msSmartcardLogin : Microsoft Smartcard Login !Cname ms-upn -1 3 6 1 4 1 311 20 2 3 : msUPN : Microsoft Universal Principal Name +1 3 6 1 4 1 311 20 2 3 : msUPN : Microsoft User Principal Name 1 3 6 1 4 1 188 7 1 1 2 : IDEA-CBC : idea-cbc : IDEA-ECB : idea-ecb diff --git a/crypto/objects/objects.txt.orig b/crypto/objects/objects.txt.orig index bff6714f..8833acd5 100644 --- a/crypto/objects/objects.txt.orig +++ b/crypto/objects/objects.txt.orig @@ -431,9 +431,9 @@ rsadsi 3 8 : RC5-CBC : rc5-cbc !Cname ms-efs 1 3 6 1 4 1 311 10 3 4 : msEFS : Microsoft Encrypted File System !Cname ms-smartcard-login -1 3 6 1 4 1 311 20 2 2 : msSmartcardLogin : Microsoft Smartcardlogin +1 3 6 1 4 1 311 20 2 2 : msSmartcardLogin : Microsoft Smartcard Login !Cname ms-upn -1 3 6 1 4 1 311 20 2 3 : msUPN : Microsoft Universal Principal Name +1 3 6 1 4 1 311 20 2 3 : msUPN : Microsoft User Principal Name 1 3 6 1 4 1 188 7 1 1 2 : IDEA-CBC : idea-cbc : IDEA-ECB : idea-ecb diff --git a/crypto/ocsp/ocsp_asn.c b/crypto/ocsp/ocsp_asn.c index 04752e96..4b434282 100644 --- a/crypto/ocsp/ocsp_asn.c +++ b/crypto/ocsp/ocsp_asn.c @@ -10,7 +10,7 @@ #include #include #include -#include "ocsp_lcl.h" +#include "ocsp_local.h" ASN1_SEQUENCE(OCSP_SIGNATURE) = { ASN1_EMBED(OCSP_SIGNATURE, signatureAlgorithm, X509_ALGOR), diff --git a/crypto/ocsp/ocsp_cl.c b/crypto/ocsp/ocsp_cl.c index 4ce7f035..8bd55038 100644 --- a/crypto/ocsp/ocsp_cl.c +++ b/crypto/ocsp/ocsp_cl.c @@ -16,7 +16,7 @@ #include #include #include -#include "ocsp_lcl.h" +#include "ocsp_local.h" /* * Utility functions related to sending OCSP requests and extracting relevant diff --git a/crypto/ocsp/ocsp_ext.c b/crypto/ocsp/ocsp_ext.c index c5cf2791..bffcf09d 100644 --- a/crypto/ocsp/ocsp_ext.c +++ b/crypto/ocsp/ocsp_ext.c @@ -12,7 +12,7 @@ #include #include #include -#include "ocsp_lcl.h" +#include "ocsp_local.h" #include #include diff --git a/crypto/ocsp/ocsp_ht.c b/crypto/ocsp/ocsp_ht.c index 17f792c2..fa147f3b 100644 --- a/crypto/ocsp/ocsp_ht.c +++ b/crypto/ocsp/ocsp_ht.c @@ -10,7 +10,7 @@ #include "e_os.h" #include #include -#include "internal/ctype.h" +#include "crypto/ctype.h" #include #include #include @@ -142,7 +142,7 @@ int OCSP_REQ_CTX_http(OCSP_REQ_CTX *rctx, const char *op, const char *path) { static const char http_hdr[] = "%s %s HTTP/1.0\r\n"; - if (!path) + if (path == NULL) path = "/"; if (BIO_printf(rctx->mem, http_hdr, op, path) <= 0) @@ -211,7 +211,7 @@ static int parse_http_line1(char *line) for (p = line; *p && !ossl_isspace(*p); p++) continue; - if (!*p) { + if (*p == '\0') { OCSPerr(OCSP_F_PARSE_HTTP_LINE1, OCSP_R_SERVER_RESPONSE_PARSE_ERROR); return 0; } @@ -220,7 +220,7 @@ static int parse_http_line1(char *line) while (*p && ossl_isspace(*p)) p++; - if (!*p) { + if (*p == '\0') { OCSPerr(OCSP_F_PARSE_HTTP_LINE1, OCSP_R_SERVER_RESPONSE_PARSE_ERROR); return 0; } @@ -229,7 +229,7 @@ static int parse_http_line1(char *line) for (q = p; *q && !ossl_isspace(*q); q++) continue; - if (!*q) { + if (*q == '\0') { OCSPerr(OCSP_F_PARSE_HTTP_LINE1, OCSP_R_SERVER_RESPONSE_PARSE_ERROR); return 0; } @@ -258,7 +258,7 @@ static int parse_http_line1(char *line) } if (retcode != 200) { OCSPerr(OCSP_F_PARSE_HTTP_LINE1, OCSP_R_SERVER_RESPONSE_ERROR); - if (!*q) + if (*q == '\0') ERR_add_error_data(2, "Code=", p); else ERR_add_error_data(4, "Code=", p, ",Reason=", q); diff --git a/crypto/ocsp/ocsp_lib.c b/crypto/ocsp/ocsp_lib.c index e68513e1..a027062c 100644 --- a/crypto/ocsp/ocsp_lib.c +++ b/crypto/ocsp/ocsp_lib.c @@ -14,7 +14,7 @@ #include #include #include -#include "ocsp_lcl.h" +#include "ocsp_local.h" #include /* Convert a certificate and its issuer to an OCSP_CERTID */ @@ -132,8 +132,7 @@ int OCSP_parse_url(const char *url, char **phost, char **pport, char **ppath, /* Check for initial colon */ p = strchr(buf, ':'); - - if (!p) + if (p == NULL) goto parse_err; *(p++) = '\0'; @@ -156,10 +155,8 @@ int OCSP_parse_url(const char *url, char **phost, char **pport, char **ppath, host = p; /* Check for trailing part of path */ - p = strchr(p, '/'); - - if (!p) + if (p == NULL) *ppath = OPENSSL_strdup("/"); else { *ppath = OPENSSL_strdup(p); @@ -167,7 +164,7 @@ int OCSP_parse_url(const char *url, char **phost, char **pport, char **ppath, *p = '\0'; } - if (!*ppath) + if (*ppath == NULL) goto mem_err; p = host; @@ -175,7 +172,7 @@ int OCSP_parse_url(const char *url, char **phost, char **pport, char **ppath, /* ipv6 literal */ host++; p = strchr(host, ']'); - if (!p) + if (p == NULL) goto parse_err; *p = '\0'; p++; @@ -188,12 +185,12 @@ int OCSP_parse_url(const char *url, char **phost, char **pport, char **ppath, } *pport = OPENSSL_strdup(port); - if (!*pport) + if (*pport == NULL) goto mem_err; *phost = OPENSSL_strdup(host); - if (!*phost) + if (*phost == NULL) goto mem_err; OPENSSL_free(buf); diff --git a/crypto/ocsp/ocsp_lcl.h b/crypto/ocsp/ocsp_local.h similarity index 100% rename from crypto/ocsp/ocsp_lcl.h rename to crypto/ocsp/ocsp_local.h diff --git a/crypto/ocsp/ocsp_prn.c b/crypto/ocsp/ocsp_prn.c index 73764acb..6d527dfc 100644 --- a/crypto/ocsp/ocsp_prn.c +++ b/crypto/ocsp/ocsp_prn.c @@ -10,7 +10,7 @@ #include #include #include -#include "ocsp_lcl.h" +#include "ocsp_local.h" #include "internal/cryptlib.h" #include diff --git a/crypto/ocsp/ocsp_srv.c b/crypto/ocsp/ocsp_srv.c index 20a1b2c2..7e0aca16 100644 --- a/crypto/ocsp/ocsp_srv.c +++ b/crypto/ocsp/ocsp_srv.c @@ -14,7 +14,7 @@ #include #include #include -#include "ocsp_lcl.h" +#include "ocsp_local.h" /* * Utility functions related to sending OCSP responses and extracting diff --git a/crypto/ocsp/ocsp_vfy.c b/crypto/ocsp/ocsp_vfy.c index 4e6c378e..a364c8a2 100644 --- a/crypto/ocsp/ocsp_vfy.c +++ b/crypto/ocsp/ocsp_vfy.c @@ -8,7 +8,7 @@ */ #include -#include "ocsp_lcl.h" +#include "ocsp_local.h" #include #include diff --git a/crypto/ocsp/v3_ocsp.c b/crypto/ocsp/v3_ocsp.c index 2e4503ee..9648ba94 100644 --- a/crypto/ocsp/v3_ocsp.c +++ b/crypto/ocsp/v3_ocsp.c @@ -12,7 +12,7 @@ # include # include # include -# include "ocsp_lcl.h" +# include "ocsp_local.h" # include # include "../x509/ext_dat.h" diff --git a/crypto/params.c b/crypto/params.c index 20082ad9..b2ceb132 100644 --- a/crypto/params.c +++ b/crypto/params.c @@ -211,6 +211,8 @@ int OSSL_PARAM_set_int32(OSSL_PARAM *p, int32_t val) p->return_size = 0; if (p->data_type == OSSL_PARAM_INTEGER) { p->return_size = sizeof(int32_t); /* Minimum expected size */ + if (p->data == NULL) + return 1; switch (p->data_size) { case sizeof(int32_t): *(int32_t *)p->data = val; @@ -222,6 +224,8 @@ int OSSL_PARAM_set_int32(OSSL_PARAM *p, int32_t val) } } else if (p->data_type == OSSL_PARAM_UNSIGNED_INTEGER && val >= 0) { p->return_size = sizeof(uint32_t); /* Minimum expected size */ + if (p->data == NULL) + return 1; switch (p->data_size) { case sizeof(uint32_t): *(uint32_t *)p->data = (uint32_t)val; @@ -233,6 +237,8 @@ int OSSL_PARAM_set_int32(OSSL_PARAM *p, int32_t val) } } else if (p->data_type == OSSL_PARAM_REAL) { p->return_size = sizeof(double); + if (p->data == NULL) + return 1; switch (p->data_size) { case sizeof(double): *(double *)p->data = (double)val; @@ -310,6 +316,8 @@ int OSSL_PARAM_set_uint32(OSSL_PARAM *p, uint32_t val) if (p->data_type == OSSL_PARAM_UNSIGNED_INTEGER) { p->return_size = sizeof(uint32_t); /* Minimum expected size */ + if (p->data == NULL) + return 1; switch (p->data_size) { case sizeof(uint32_t): *(uint32_t *)p->data = val; @@ -321,6 +329,8 @@ int OSSL_PARAM_set_uint32(OSSL_PARAM *p, uint32_t val) } } else if (p->data_type == OSSL_PARAM_INTEGER) { p->return_size = sizeof(int32_t); /* Minimum expected size */ + if (p->data == NULL) + return 1; switch (p->data_size) { case sizeof(int32_t): if (val <= INT32_MAX) { @@ -335,6 +345,8 @@ int OSSL_PARAM_set_uint32(OSSL_PARAM *p, uint32_t val) } } else if (p->data_type == OSSL_PARAM_REAL) { p->return_size = sizeof(double); + if (p->data == NULL) + return 1; switch (p->data_size) { case sizeof(double): *(double *)p->data = (double)val; @@ -403,6 +415,8 @@ int OSSL_PARAM_set_int64(OSSL_PARAM *p, int64_t val) p->return_size = 0; if (p->data_type == OSSL_PARAM_INTEGER) { p->return_size = sizeof(int64_t); /* Expected size */ + if (p->data == NULL) + return 1; switch (p->data_size) { case sizeof(int32_t): if (val >= INT32_MIN && val <= INT32_MAX) { @@ -417,6 +431,8 @@ int OSSL_PARAM_set_int64(OSSL_PARAM *p, int64_t val) } } else if (p->data_type == OSSL_PARAM_UNSIGNED_INTEGER && val >= 0) { p->return_size = sizeof(uint64_t); /* Expected size */ + if (p->data == NULL) + return 1; switch (p->data_size) { case sizeof(uint32_t): if (val <= UINT32_MAX) { @@ -431,6 +447,8 @@ int OSSL_PARAM_set_int64(OSSL_PARAM *p, int64_t val) } } else if (p->data_type == OSSL_PARAM_REAL) { p->return_size = sizeof(double); + if (p->data == NULL) + return 1; switch (p->data_size) { case sizeof(double): u64 = val < 0 ? -val : val; @@ -506,6 +524,8 @@ int OSSL_PARAM_set_uint64(OSSL_PARAM *p, uint64_t val) if (p->data_type == OSSL_PARAM_UNSIGNED_INTEGER) { p->return_size = sizeof(uint64_t); /* Expected size */ + if (p->data == NULL) + return 1; switch (p->data_size) { case sizeof(uint32_t): if (val <= UINT32_MAX) { @@ -520,6 +540,8 @@ int OSSL_PARAM_set_uint64(OSSL_PARAM *p, uint64_t val) } } else if (p->data_type == OSSL_PARAM_INTEGER) { p->return_size = sizeof(int64_t); /* Expected size */ + if (p->data == NULL) + return 1; switch (p->data_size) { case sizeof(int32_t): if (val <= INT32_MAX) { @@ -616,6 +638,8 @@ int OSSL_PARAM_set_BN(OSSL_PARAM *p, const BIGNUM *val) bytes = (size_t)BN_num_bytes(val); p->return_size = bytes; + if (p->data == NULL) + return 1; return p->data_size >= bytes && BN_bn2nativepad(val, p->data, bytes) >= 0; } @@ -680,6 +704,8 @@ int OSSL_PARAM_set_double(OSSL_PARAM *p, double val) if (p->data_type == OSSL_PARAM_REAL) { p->return_size = sizeof(double); + if (p->data == NULL) + return 1; switch (p->data_size) { case sizeof(double): *(double *)p->data = val; @@ -688,6 +714,8 @@ int OSSL_PARAM_set_double(OSSL_PARAM *p, double val) } else if (p->data_type == OSSL_PARAM_UNSIGNED_INTEGER && val == (ossl_uintmax_t)val) { p->return_size = sizeof(double); + if (p->data == NULL) + return 1; switch (p->data_size) { case sizeof(uint32_t): if (val >= 0 && val <= UINT32_MAX) { @@ -705,6 +733,8 @@ int OSSL_PARAM_set_double(OSSL_PARAM *p, double val) break; } } else if (p->data_type == OSSL_PARAM_INTEGER && val == (ossl_intmax_t)val) { p->return_size = sizeof(double); + if (p->data == NULL) + return 1; switch (p->data_size) { case sizeof(int32_t): if (val >= INT32_MIN && val <= INT32_MAX) { @@ -775,6 +805,8 @@ static int set_string_internal(OSSL_PARAM *p, const void *val, size_t len, unsigned int type) { p->return_size = len; + if (p->data == NULL) + return 1; if (p->data_type != type || p->data_size < len) return 0; @@ -847,7 +879,8 @@ static int set_ptr_internal(OSSL_PARAM *p, const void *val, p->return_size = len; if (p->data_type != type) return 0; - *(const void **)p->data = val; + if (p->data != NULL) + *(const void **)p->data = val; return 1; } diff --git a/crypto/pem/pem_lib.c b/crypto/pem/pem_lib.c index b33ab162..eb07c884 100644 --- a/crypto/pem/pem_lib.c +++ b/crypto/pem/pem_lib.c @@ -8,7 +8,7 @@ */ #include -#include "internal/ctype.h" +#include "crypto/ctype.h" #include #include "internal/cryptlib.h" #include @@ -18,7 +18,7 @@ #include #include #include -#include "internal/asn1_int.h" +#include "crypto/asn1.h" #include #include diff --git a/crypto/pem/pem_pk8.c b/crypto/pem/pem_pk8.c index d8bb9bbf..642d4f6e 100644 --- a/crypto/pem/pem_pk8.c +++ b/crypto/pem/pem_pk8.c @@ -117,10 +117,11 @@ EVP_PKEY *d2i_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY **x, pem_password_cb *cb, int klen; EVP_PKEY *ret; char psbuf[PEM_BUFSIZE]; + p8 = d2i_PKCS8_bio(bp, NULL); - if (!p8) + if (p8 == NULL) return NULL; - if (cb) + if (cb != NULL) klen = cb(psbuf, PEM_BUFSIZE, 0, u); else klen = PEM_def_callback(psbuf, PEM_BUFSIZE, 0, u); @@ -132,13 +133,13 @@ EVP_PKEY *d2i_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY **x, pem_password_cb *cb, p8inf = PKCS8_decrypt(p8, psbuf, klen); X509_SIG_free(p8); OPENSSL_cleanse(psbuf, klen); - if (!p8inf) + if (p8inf == NULL) return NULL; ret = EVP_PKCS82PKEY(p8inf); PKCS8_PRIV_KEY_INFO_free(p8inf); if (!ret) return NULL; - if (x) { + if (x != NULL) { EVP_PKEY_free(*x); *x = ret; } diff --git a/crypto/pem/pem_pkey.c b/crypto/pem/pem_pkey.c index ffcec127..7132a7ad 100644 --- a/crypto/pem/pem_pkey.c +++ b/crypto/pem/pem_pkey.c @@ -17,8 +17,8 @@ #include #include #include -#include "internal/asn1_int.h" -#include "internal/evp_int.h" +#include "crypto/asn1.h" +#include "crypto/evp.h" int pem_check_suffix(const char *pem_str, const char *suffix); @@ -40,10 +40,10 @@ EVP_PKEY *PEM_read_bio_PrivateKey(BIO *bp, EVP_PKEY **x, pem_password_cb *cb, if (strcmp(nm, PEM_STRING_PKCS8INF) == 0) { PKCS8_PRIV_KEY_INFO *p8inf; p8inf = d2i_PKCS8_PRIV_KEY_INFO(NULL, &p, len); - if (!p8inf) + if (p8inf == NULL) goto p8err; ret = EVP_PKCS82PKEY(p8inf); - if (x) { + if (x != NULL) { EVP_PKEY_free((EVP_PKEY *)*x); *x = ret; } @@ -54,7 +54,7 @@ EVP_PKEY *PEM_read_bio_PrivateKey(BIO *bp, EVP_PKEY **x, pem_password_cb *cb, int klen; char psbuf[PEM_BUFSIZE]; p8 = d2i_X509_SIG(NULL, &p, len); - if (!p8) + if (p8 == NULL) goto p8err; if (cb) klen = cb(psbuf, PEM_BUFSIZE, 0, u); @@ -68,7 +68,7 @@ EVP_PKEY *PEM_read_bio_PrivateKey(BIO *bp, EVP_PKEY **x, pem_password_cb *cb, p8inf = PKCS8_decrypt(p8, psbuf, klen); X509_SIG_free(p8); OPENSSL_cleanse(psbuf, klen); - if (!p8inf) + if (p8inf == NULL) goto p8err; ret = EVP_PKCS82PKEY(p8inf); if (x) { diff --git a/crypto/pem/pvkfmt.c b/crypto/pem/pvkfmt.c index adf29144..6bcde93d 100644 --- a/crypto/pem/pvkfmt.c +++ b/crypto/pem/pvkfmt.c @@ -617,6 +617,7 @@ static int do_PVK_header(const unsigned char **in, unsigned int length, { const unsigned char *p = *in; unsigned int pvk_magic, is_encrypted; + if (skip_magic) { if (length < 20) { PEMerr(PEM_F_DO_PVK_HEADER, PEM_R_PVK_TOO_SHORT); @@ -645,7 +646,7 @@ static int do_PVK_header(const unsigned char **in, unsigned int length, if (*pkeylen > PVK_MAX_KEYLEN || *psaltlen > PVK_MAX_SALTLEN) return 0; - if (is_encrypted && !*psaltlen) { + if (is_encrypted && *psaltlen == 0) { PEMerr(PEM_F_DO_PVK_HEADER, PEM_R_INCONSISTENT_HEADER); return 0; } diff --git a/crypto/pkcs12/p12_add.c b/crypto/pkcs12/p12_add.c index 1f915d13..06837f53 100644 --- a/crypto/pkcs12/p12_add.c +++ b/crypto/pkcs12/p12_add.c @@ -10,7 +10,7 @@ #include #include "internal/cryptlib.h" #include -#include "p12_lcl.h" +#include "p12_local.h" /* Pack an object into an OCTET STRING and turn into a safebag */ @@ -106,7 +106,7 @@ PKCS7 *PKCS12_pack_p7encdata(int pbe_nid, const char *pass, int passlen, else pbe = PKCS5_pbe_set(pbe_nid, iter, salt, saltlen); - if (!pbe) { + if (pbe == NULL) { PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE); goto err; } diff --git a/crypto/pkcs12/p12_asn.c b/crypto/pkcs12/p12_asn.c index f27d1d44..aabbd38e 100644 --- a/crypto/pkcs12/p12_asn.c +++ b/crypto/pkcs12/p12_asn.c @@ -11,7 +11,7 @@ #include "internal/cryptlib.h" #include #include -#include "p12_lcl.h" +#include "p12_local.h" /* PKCS#12 ASN1 module */ diff --git a/crypto/pkcs12/p12_attr.c b/crypto/pkcs12/p12_attr.c index 2ee65a98..e2ca95bc 100644 --- a/crypto/pkcs12/p12_attr.c +++ b/crypto/pkcs12/p12_attr.c @@ -10,7 +10,7 @@ #include #include "internal/cryptlib.h" #include -#include "p12_lcl.h" +#include "p12_local.h" /* Add a local keyid to a safebag */ diff --git a/crypto/pkcs12/p12_crpt.c b/crypto/pkcs12/p12_crpt.c index b832e1a8..937bfea0 100644 --- a/crypto/pkcs12/p12_crpt.c +++ b/crypto/pkcs12/p12_crpt.c @@ -44,7 +44,7 @@ int PKCS12_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen, return 0; } - if (!pbe->iter) + if (pbe->iter == NULL) iter = 1; else iter = ASN1_INTEGER_get(pbe->iter); diff --git a/crypto/pkcs12/p12_crt.c b/crypto/pkcs12/p12_crt.c index b6e52e23..94bd3e16 100644 --- a/crypto/pkcs12/p12_crt.c +++ b/crypto/pkcs12/p12_crt.c @@ -10,7 +10,7 @@ #include #include "internal/cryptlib.h" #include -#include "p12_lcl.h" +#include "p12_local.h" static int pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG) **pbags, PKCS12_SAFEBAG *bag); @@ -54,7 +54,7 @@ PKCS12 *PKCS12_create(const char *pass, const char *name, EVP_PKEY *pkey, X509 * if (!mac_iter) mac_iter = 1; - if (!pkey && !cert && !ca) { + if (pkey == NULL && cert == NULL && ca == NULL) { PKCS12err(PKCS12_F_PKCS12_CREATE, PKCS12_R_INVALID_NULL_ARGUMENT); return NULL; } @@ -110,7 +110,7 @@ PKCS12 *PKCS12_create(const char *pass, const char *name, EVP_PKEY *pkey, X509 * p12 = PKCS12_add_safes(safes, 0); - if (!p12) + if (p12 == NULL) goto err; sk_PKCS7_pop_free(safes, PKCS7_free); @@ -208,13 +208,12 @@ int PKCS12_add_safe(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags, PKCS7 *p7 = NULL; int free_safes = 0; - if (!*psafes) { + if (*psafes == NULL) { *psafes = sk_PKCS7_new_null(); - if (!*psafes) + if (*psafes == NULL) return 0; free_safes = 1; - } else - free_safes = 0; + } if (nid_safe == 0) #ifdef OPENSSL_NO_RC2 @@ -227,7 +226,7 @@ int PKCS12_add_safe(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags, p7 = PKCS12_pack_p7data(bags); else p7 = PKCS12_pack_p7encdata(nid_safe, pass, -1, NULL, 0, iter, bags); - if (!p7) + if (p7 == NULL) goto err; if (!sk_PKCS7_push(*psafes, p7)) @@ -248,16 +247,16 @@ int PKCS12_add_safe(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags, static int pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG) **pbags, PKCS12_SAFEBAG *bag) { - int free_bags; - if (!pbags) + int free_bags = 0; + + if (pbags == NULL) return 1; - if (!*pbags) { + if (*pbags == NULL) { *pbags = sk_PKCS12_SAFEBAG_new_null(); - if (!*pbags) + if (*pbags == NULL) return 0; free_bags = 1; - } else - free_bags = 0; + } if (!sk_PKCS12_SAFEBAG_push(*pbags, bag)) { if (free_bags) { @@ -274,11 +273,11 @@ static int pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG) **pbags, PKCS12 *PKCS12_add_safes(STACK_OF(PKCS7) *safes, int nid_p7) { PKCS12 *p12; + if (nid_p7 <= 0) nid_p7 = NID_pkcs7_data; p12 = PKCS12_init(nid_p7); - - if (!p12) + if (p12 == NULL) return NULL; if (!PKCS12_pack_authsafes(p12, safes)) { diff --git a/crypto/pkcs12/p12_init.c b/crypto/pkcs12/p12_init.c index 8b684c27..00c8d4f5 100644 --- a/crypto/pkcs12/p12_init.c +++ b/crypto/pkcs12/p12_init.c @@ -10,7 +10,7 @@ #include #include "internal/cryptlib.h" #include -#include "p12_lcl.h" +#include "p12_local.h" /* Initialise a PKCS12 structure to take data */ diff --git a/crypto/pkcs12/p12_key.c b/crypto/pkcs12/p12_key.c index 3580754a..4849cbd5 100644 --- a/crypto/pkcs12/p12_key.c +++ b/crypto/pkcs12/p12_key.c @@ -26,7 +26,7 @@ int PKCS12_key_gen_asc(const char *pass, int passlen, unsigned char *salt, unsigned char *unipass; int uniplen; - if (!pass) { + if (pass == NULL) { unipass = NULL; uniplen = 0; } else if (!OPENSSL_asc2uni(pass, passlen, &unipass, &uniplen)) { @@ -49,7 +49,7 @@ int PKCS12_key_gen_utf8(const char *pass, int passlen, unsigned char *salt, unsigned char *unipass; int uniplen; - if (!pass) { + if (pass == NULL) { unipass = NULL; uniplen = 0; } else if (!OPENSSL_utf82uni(pass, passlen, &unipass, &uniplen)) { diff --git a/crypto/pkcs12/p12_kiss.c b/crypto/pkcs12/p12_kiss.c index 7fa74882..a9a3ff54 100644 --- a/crypto/pkcs12/p12_kiss.c +++ b/crypto/pkcs12/p12_kiss.c @@ -42,7 +42,7 @@ int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert, /* Check for NULL PKCS12 structure */ - if (!p12) { + if (p12 == NULL) { PKCS12err(PKCS12_F_PKCS12_PARSE, PKCS12_R_INVALID_NULL_PKCS12_POINTER); return 0; @@ -57,7 +57,7 @@ int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert, * password are two different things... */ - if (!pass || !*pass) { + if (pass == NULL || *pass == '\0') { if (PKCS12_verify_mac(p12, NULL, 0)) pass = NULL; else if (PKCS12_verify_mac(p12, "", 0)) @@ -85,7 +85,8 @@ int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert, } while ((x = sk_X509_pop(ocerts))) { - if (pkey && *pkey && cert && !*cert) { + if (pkey != NULL && *pkey != NULL + && cert != NULL && *cert == NULL) { ERR_set_mark(); if (X509_check_private_key(x, *pkey)) { *cert = x; @@ -95,9 +96,9 @@ int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert, } if (ca && x) { - if (!*ca) + if (*ca == NULL) *ca = sk_X509_new_null(); - if (!*ca) + if (*ca == NULL) goto err; if (!sk_X509_push(*ca, x)) goto err; @@ -191,7 +192,7 @@ static int parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen, switch (PKCS12_SAFEBAG_get_nid(bag)) { case NID_keyBag: - if (!pkey || *pkey) + if (pkey == NULL || *pkey != NULL) return 1; *pkey = EVP_PKCS82PKEY(PKCS12_SAFEBAG_get0_p8inf(bag)); if (*pkey == NULL) @@ -199,7 +200,7 @@ static int parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen, break; case NID_pkcs8ShroudedKeyBag: - if (!pkey || *pkey) + if (pkey == NULL || *pkey != NULL) return 1; if ((p8 = PKCS12_decrypt_skey(bag, pass, passlen)) == NULL) return 0; diff --git a/crypto/pkcs12/p12_lcl.h b/crypto/pkcs12/p12_local.h similarity index 100% rename from crypto/pkcs12/p12_lcl.h rename to crypto/pkcs12/p12_local.h diff --git a/crypto/pkcs12/p12_mutl.c b/crypto/pkcs12/p12_mutl.c index bcefa057..10e1c5b0 100644 --- a/crypto/pkcs12/p12_mutl.c +++ b/crypto/pkcs12/p12_mutl.c @@ -13,7 +13,7 @@ #include #include #include -#include "p12_lcl.h" +#include "p12_local.h" int PKCS12_mac_present(const PKCS12 *p12) { @@ -95,7 +95,7 @@ static int pkcs12_gen_mac(PKCS12 *p12, const char *pass, int passlen, salt = p12->mac->salt->data; saltlen = p12->mac->salt->length; - if (!p12->mac->iter) + if (p12->mac->iter == NULL) iter = 1; else iter = ASN1_INTEGER_get(p12->mac->iter); diff --git a/crypto/pkcs12/p12_npas.c b/crypto/pkcs12/p12_npas.c index 2bb69a26..7c916d46 100644 --- a/crypto/pkcs12/p12_npas.c +++ b/crypto/pkcs12/p12_npas.c @@ -13,7 +13,7 @@ #include #include #include -#include "p12_lcl.h" +#include "p12_local.h" /* PKCS#12 password change routine */ @@ -33,7 +33,7 @@ int PKCS12_newpass(PKCS12 *p12, const char *oldpass, const char *newpass) { /* Check for NULL PKCS12 structure */ - if (!p12) { + if (p12 == NULL) { PKCS12err(PKCS12_F_PKCS12_NEWPASS, PKCS12_R_INVALID_NULL_PKCS12_POINTER); return 0; @@ -94,7 +94,7 @@ static int newpass_p12(PKCS12 *p12, const char *oldpass, const char *newpass) else p7new = PKCS12_pack_p7encdata(pbe_nid, newpass, -1, NULL, pbe_saltlen, pbe_iter, bags); - if (!p7new || !sk_PKCS7_push(newsafes, p7new)) + if (p7new == NULL || !sk_PKCS7_push(newsafes, p7new)) goto err; sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free); bags = NULL; @@ -173,8 +173,9 @@ static int alg_get(const X509_ALGOR *alg, int *pnid, int *piter, int *psaltlen) { PBEPARAM *pbe; + pbe = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(PBEPARAM), alg->parameter); - if (!pbe) + if (pbe == NULL) return 0; *pnid = OBJ_obj2nid(alg->algorithm); *piter = ASN1_INTEGER_get(pbe->iter); diff --git a/crypto/pkcs12/p12_p8e.c b/crypto/pkcs12/p12_p8e.c index 3b7a8436..14df4fde 100644 --- a/crypto/pkcs12/p12_p8e.c +++ b/crypto/pkcs12/p12_p8e.c @@ -10,7 +10,7 @@ #include #include "internal/cryptlib.h" #include -#include "internal/x509_int.h" +#include "crypto/x509.h" X509_SIG *PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher, const char *pass, int passlen, @@ -28,7 +28,7 @@ X509_SIG *PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher, ERR_clear_error(); pbe = PKCS5_pbe_set(pbe_nid, iter, salt, saltlen); } - if (!pbe) { + if (pbe == NULL) { PKCS12err(PKCS12_F_PKCS8_ENCRYPT, ERR_R_ASN1_LIB); return NULL; } diff --git a/crypto/pkcs12/p12_sbag.c b/crypto/pkcs12/p12_sbag.c index a3024ef1..2b4ca653 100644 --- a/crypto/pkcs12/p12_sbag.c +++ b/crypto/pkcs12/p12_sbag.c @@ -10,7 +10,7 @@ #include #include "internal/cryptlib.h" #include -#include "p12_lcl.h" +#include "p12_local.h" #if !OPENSSL_API_1_1_0 ASN1_TYPE *PKCS12_get_attr(const PKCS12_SAFEBAG *bag, int attr_nid) diff --git a/crypto/pkcs7/pk7_doit.c b/crypto/pkcs7/pk7_doit.c index 030718a1..2cf62b62 100644 --- a/crypto/pkcs7/pk7_doit.c +++ b/crypto/pkcs7/pk7_doit.c @@ -94,12 +94,11 @@ static int pkcs7_encode_rinfo(PKCS7_RECIP_INFO *ri, size_t eklen; pkey = X509_get0_pubkey(ri->cert); - - if (!pkey) + if (pkey == NULL) return 0; pctx = EVP_PKEY_CTX_new(pkey, NULL); - if (!pctx) + if (pctx == NULL) return 0; if (EVP_PKEY_encrypt_init(pctx) <= 0) @@ -143,11 +142,10 @@ static int pkcs7_decrypt_rinfo(unsigned char **pek, int *peklen, EVP_PKEY_CTX *pctx = NULL; unsigned char *ek = NULL; size_t eklen; - int ret = -1; pctx = EVP_PKEY_CTX_new(pkey, NULL); - if (!pctx) + if (pctx == NULL) return -1; if (EVP_PKEY_decrypt_init(pctx) <= 0) @@ -1067,7 +1065,7 @@ int PKCS7_signatureVerify(BIO *bio, PKCS7 *p7, PKCS7_SIGNER_INFO *si, os = si->enc_digest; pkey = X509_get0_pubkey(x509); - if (!pkey) { + if (pkey == NULL) { ret = -1; goto err; } diff --git a/crypto/pkcs7/pk7_lib.c b/crypto/pkcs7/pk7_lib.c index 181fb5a5..ca039656 100644 --- a/crypto/pkcs7/pk7_lib.c +++ b/crypto/pkcs7/pk7_lib.c @@ -11,8 +11,8 @@ #include "internal/cryptlib.h" #include #include -#include "internal/asn1_int.h" -#include "internal/evp_int.h" +#include "crypto/asn1.h" +#include "crypto/evp.h" long PKCS7_ctrl(PKCS7 *p7, int cmd, long larg, char *parg) { @@ -40,7 +40,7 @@ long PKCS7_ctrl(PKCS7 *p7, int cmd, long larg, char *parg) break; case PKCS7_OP_GET_DETACHED_SIGNATURE: if (nid == NID_pkcs7_signed) { - if (!p7->d.sign || !p7->d.sign->contents->d.ptr) + if (p7->d.sign == NULL || p7->d.sign->contents->d.ptr == NULL) ret = 1; else ret = 0; diff --git a/crypto/pkcs7/pk7_smime.c b/crypto/pkcs7/pk7_smime.c index 6012e37e..43ad266a 100644 --- a/crypto/pkcs7/pk7_smime.c +++ b/crypto/pkcs7/pk7_smime.c @@ -214,7 +214,7 @@ int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store, BIO *p7bio = NULL; BIO *tmpin = NULL, *tmpout = NULL; - if (!p7) { + if (p7 == NULL) { PKCS7err(PKCS7_F_PKCS7_VERIFY, PKCS7_R_INVALID_NULL_POINTER); return 0; } @@ -379,7 +379,7 @@ STACK_OF(X509) *PKCS7_get0_signers(PKCS7 *p7, STACK_OF(X509) *certs, X509 *signer; int i; - if (!p7) { + if (p7 == NULL) { PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS, PKCS7_R_INVALID_NULL_POINTER); return NULL; } @@ -480,7 +480,7 @@ int PKCS7_decrypt(PKCS7 *p7, EVP_PKEY *pkey, X509 *cert, BIO *data, int flags) int ret = 0, i; char *buf = NULL; - if (!p7) { + if (p7 == NULL) { PKCS7err(PKCS7_F_PKCS7_DECRYPT, PKCS7_R_INVALID_NULL_POINTER); return 0; } diff --git a/crypto/poly1305/build.info b/crypto/poly1305/build.info index 29cdf4c8..6425a015 100644 --- a/crypto/poly1305/build.info +++ b/crypto/poly1305/build.info @@ -30,7 +30,11 @@ IF[{- !$disabled{asm} -}] ENDIF SOURCE[../../libcrypto]=poly1305_ameth.c poly1305.c $POLY1305ASM + +# Implementations are now spread across several libraries, so the defines +# need to be applied to all affected libraries and modules. DEFINE[../../libcrypto]=$POLY1305DEF +DEFINE[../providers/libimplementations.a]=$POLY1305DEF GENERATE[poly1305-sparcv9.S]=asm/poly1305-sparcv9.pl INCLUDE[poly1305-sparcv9.o]=.. diff --git a/crypto/poly1305/poly1305.c b/crypto/poly1305/poly1305.c index b83a4fc1..127ce7da 100644 --- a/crypto/poly1305/poly1305.c +++ b/crypto/poly1305/poly1305.c @@ -11,8 +11,7 @@ #include #include -#include "internal/poly1305.h" -#include "poly1305_local.h" +#include "crypto/poly1305.h" size_t Poly1305_ctx_size(void) { @@ -89,7 +88,7 @@ static void poly1305_blocks(void *ctx, const unsigned char *inp, size_t len, u32 padbit); /* - * Type-agnostic "rip-off" from constant_time_locl.h + * Type-agnostic "rip-off" from constant_time.h */ # define CONSTANT_TIME_CARRY(a,b) ( \ (a ^ ((a ^ b) | ((a - b) ^ b))) >> (sizeof(a) * 8 - 1) \ diff --git a/crypto/poly1305/poly1305_ameth.c b/crypto/poly1305/poly1305_ameth.c index 73903635..2feec9cc 100644 --- a/crypto/poly1305/poly1305_ameth.c +++ b/crypto/poly1305/poly1305_ameth.c @@ -10,10 +10,9 @@ #include #include "internal/cryptlib.h" #include -#include "internal/asn1_int.h" -#include "internal/poly1305.h" -#include "poly1305_local.h" -#include "internal/evp_int.h" +#include "crypto/asn1.h" +#include "crypto/poly1305.h" +#include "crypto/evp.h" /* * POLY1305 "ASN1" method. This is just here to indicate the maximum diff --git a/crypto/ppc_arch.h b/crypto/ppc_arch.h index ce98f5b7..0241878e 100644 --- a/crypto/ppc_arch.h +++ b/crypto/ppc_arch.h @@ -7,8 +7,8 @@ * https://www.openssl.org/source/license.html */ -#ifndef HEADER_PPC_ARCH_H -# define HEADER_PPC_ARCH_H +#ifndef OSSL_CRYPTO_PPC_ARCH_H +# define OSSL_CRYPTO_PPC_ARCH_H extern unsigned int OPENSSL_ppccap_P; diff --git a/crypto/ppccap.c b/crypto/ppccap.c index e540db14..0b2cc78d 100644 --- a/crypto/ppccap.c +++ b/crypto/ppccap.c @@ -29,8 +29,8 @@ #include #include #include -#include -#include "bn/bn_lcl.h" +#include +#include "bn/bn_local.h" #include "ppc_arch.h" diff --git a/crypto/property/build.info b/crypto/property/build.info index db3c9444..bfa1f060 100644 --- a/crypto/property/build.info +++ b/crypto/property/build.info @@ -1,4 +1,4 @@ LIBS=../../libcrypto $COMMON=property_string.c property_parse.c property.c defn_cache.c SOURCE[../../libcrypto]=$COMMON property_err.c -SOURCE[../../providers/fips]=$COMMON +SOURCE[../../providers/libfips.a]=$COMMON diff --git a/crypto/property/defn_cache.c b/crypto/property/defn_cache.c index aec05c1a..9bfbd131 100644 --- a/crypto/property/defn_cache.c +++ b/crypto/property/defn_cache.c @@ -13,7 +13,7 @@ #include #include "internal/propertyerr.h" #include "internal/property.h" -#include "property_lcl.h" +#include "property_local.h" /* * Implement a property definition cache. diff --git a/crypto/property/property.c b/crypto/property/property.c index e94c5de8..2089e21d 100644 --- a/crypto/property/property.c +++ b/crypto/property/property.c @@ -13,13 +13,13 @@ #include #include #include "internal/property.h" -#include "internal/ctype.h" +#include "crypto/ctype.h" #include #include #include "internal/thread_once.h" -#include "internal/lhash.h" -#include "internal/sparse_array.h" -#include "property_lcl.h" +#include "crypto/lhash.h" +#include "crypto/sparse_array.h" +#include "property_local.h" /* The number of elements in the query cache before we initiate a flush */ #define IMPL_CACHE_FLUSH_THRESHOLD 500 @@ -53,8 +53,6 @@ struct ossl_method_store_st { SPARSE_ARRAY_OF(ALGORITHM) *algs; OSSL_PROPERTY_LIST *global_properties; int need_flush; - unsigned int nbits; - unsigned char rand_bits[(IMPL_CACHE_FLUSH_THRESHOLD + 7) / 8]; CRYPTO_RWLOCK *lock; }; diff --git a/crypto/property/property_lcl.h b/crypto/property/property_local.h similarity index 100% rename from crypto/property/property_lcl.h rename to crypto/property/property_local.h diff --git a/crypto/property/property_parse.c b/crypto/property/property_parse.c index c17b0dde..a16bcd6d 100644 --- a/crypto/property/property_parse.c +++ b/crypto/property/property_parse.c @@ -14,9 +14,9 @@ #include #include "internal/propertyerr.h" #include "internal/property.h" -#include "internal/ctype.h" +#include "crypto/ctype.h" #include "internal/nelem.h" -#include "property_lcl.h" +#include "property_local.h" #include "e_os.h" typedef enum { diff --git a/crypto/property/property_string.c b/crypto/property/property_string.c index dcf5dcc2..55d34688 100644 --- a/crypto/property/property_string.c +++ b/crypto/property/property_string.c @@ -11,8 +11,8 @@ #include #include #include -#include "internal/lhash.h" -#include "property_lcl.h" +#include "crypto/lhash.h" +#include "property_local.h" /* * Property strings are a consolidation of all strings seen by the property diff --git a/crypto/provider_core.c b/crypto/provider_core.c index f8a002aa..4f3123d6 100644 --- a/crypto/provider_core.c +++ b/crypto/provider_core.c @@ -12,7 +12,7 @@ #include #include #include -#include "internal/cryptlib_int.h" +#include "crypto/cryptlib.h" #include "internal/nelem.h" #include "internal/thread_once.h" #include "internal/provider.h" diff --git a/crypto/provider_predefined.c b/crypto/provider_predefined.c index d1423b1c..e65f4610 100644 --- a/crypto/provider_predefined.c +++ b/crypto/provider_predefined.c @@ -12,12 +12,17 @@ OSSL_provider_init_fn ossl_default_provider_init; OSSL_provider_init_fn fips_intern_provider_init; - +#ifdef STATIC_LEGACY +OSSL_provider_init_fn ossl_legacy_provider_init; +#endif const struct predefined_providers_st predefined_providers[] = { #ifdef FIPS_MODE { "fips", fips_intern_provider_init, 1 }, #else { "default", ossl_default_provider_init, 1 }, +# ifdef STATIC_LEGACY + { "legacy", ossl_legacy_provider_init, 0 }, +# endif #endif { NULL, NULL, 0 } }; diff --git a/crypto/rand/build.info b/crypto/rand/build.info index 3e0a9c74..0925c4b2 100644 --- a/crypto/rand/build.info +++ b/crypto/rand/build.info @@ -4,4 +4,4 @@ $COMMON=rand_lib.c rand_crng_test.c rand_win.c rand_unix.c rand_vms.c \ drbg_lib.c drbg_ctr.c rand_vxworks.c drbg_hash.c drbg_hmac.c SOURCE[../../libcrypto]=$COMMON randfile.c rand_err.c rand_egd.c -SOURCE[../../providers/fips]=$COMMON +SOURCE[../../providers/libfips.a]=$COMMON diff --git a/crypto/rand/drbg_ctr.c b/crypto/rand/drbg_ctr.c index 28db4eed..30420ae5 100644 --- a/crypto/rand/drbg_ctr.c +++ b/crypto/rand/drbg_ctr.c @@ -13,7 +13,7 @@ #include #include #include "internal/thread_once.h" -#include "rand_lcl.h" +#include "rand_local.h" /* * Implementation of NIST SP 800-90A CTR DRBG. diff --git a/crypto/rand/drbg_hash.c b/crypto/rand/drbg_hash.c index 6bef917e..72068c67 100644 --- a/crypto/rand/drbg_hash.c +++ b/crypto/rand/drbg_hash.c @@ -14,8 +14,8 @@ #include #include #include "internal/thread_once.h" -#include "internal/providercommon.h" -#include "rand_lcl.h" +#include "prov/providercommon.h" +#include "rand_local.h" /* 440 bits from SP800-90Ar1 10.1 table 2 */ #define HASH_PRNG_SMALL_SEEDLEN (440/8) diff --git a/crypto/rand/drbg_hmac.c b/crypto/rand/drbg_hmac.c index 14c4570b..0289070f 100644 --- a/crypto/rand/drbg_hmac.c +++ b/crypto/rand/drbg_hmac.c @@ -13,8 +13,8 @@ #include #include #include "internal/thread_once.h" -#include "internal/providercommon.h" -#include "rand_lcl.h" +#include "prov/providercommon.h" +#include "rand_local.h" /* * Called twice by SP800-90Ar1 10.1.2.2 HMAC_DRBG_Update_Process. diff --git a/crypto/rand/drbg_lib.c b/crypto/rand/drbg_lib.c index bce2f74e..90e37786 100644 --- a/crypto/rand/drbg_lib.c +++ b/crypto/rand/drbg_lib.c @@ -11,10 +11,10 @@ #include #include #include -#include "rand_lcl.h" +#include "rand_local.h" #include "internal/thread_once.h" -#include "internal/rand_int.h" -#include "internal/cryptlib_int.h" +#include "crypto/rand.h" +#include "crypto/cryptlib.h" /* * Support framework for NIST SP 800-90A DRBG diff --git a/crypto/rand/rand_crng_test.c b/crypto/rand/rand_crng_test.c index 0ba0986b..950cc629 100644 --- a/crypto/rand/rand_crng_test.c +++ b/crypto/rand/rand_crng_test.c @@ -14,10 +14,10 @@ #include #include -#include "internal/rand_int.h" +#include "crypto/rand.h" #include "internal/thread_once.h" #include "internal/cryptlib.h" -#include "rand_lcl.h" +#include "rand_local.h" typedef struct crng_test_global_st { unsigned char crngt_prev[EVP_MAX_MD_SIZE]; diff --git a/crypto/rand/rand_lib.c b/crypto/rand/rand_lib.c index b70b60a6..3508cfb2 100644 --- a/crypto/rand/rand_lib.c +++ b/crypto/rand/rand_lib.c @@ -11,10 +11,10 @@ #include #include "internal/cryptlib.h" #include -#include "internal/rand_int.h" +#include "crypto/rand.h" #include #include "internal/thread_once.h" -#include "rand_lcl.h" +#include "rand_local.h" #include "e_os.h" #ifndef FIPS_MODE diff --git a/crypto/rand/rand_lcl.h b/crypto/rand/rand_local.h similarity index 99% rename from crypto/rand/rand_lcl.h rename to crypto/rand/rand_local.h index 0c92d756..7817df80 100644 --- a/crypto/rand/rand_lcl.h +++ b/crypto/rand/rand_local.h @@ -7,8 +7,8 @@ * https://www.openssl.org/source/license.html */ -#ifndef HEADER_RAND_LCL_H -# define HEADER_RAND_LCL_H +#ifndef OSSL_CRYPTO_RAND_LOCAL_H +# define OSSL_CRYPTO_RAND_LOCAL_H # include # include @@ -17,7 +17,7 @@ # include # include # include "internal/tsan_assist.h" -# include "internal/rand_int.h" +# include "crypto/rand.h" # include "internal/numbers.h" diff --git a/crypto/rand/rand_unix.c b/crypto/rand/rand_unix.c index 8641badb..7f3ea30e 100644 --- a/crypto/rand/rand_unix.c +++ b/crypto/rand/rand_unix.c @@ -15,8 +15,8 @@ #include "internal/cryptlib.h" #include #include -#include "rand_lcl.h" -#include "internal/rand_int.h" +#include "rand_local.h" +#include "crypto/rand.h" #include #include "internal/dso.h" #ifdef __linux @@ -261,12 +261,58 @@ static ssize_t sysctl_random(char *buf, size_t buflen) # if defined(OPENSSL_RAND_SEED_GETRANDOM) # if defined(__linux) && !defined(__NR_getrandom) -# if defined(__arm__) && defined(__NR_SYSCALL_BASE) +# if defined(__arm__) # define __NR_getrandom (__NR_SYSCALL_BASE+384) # elif defined(__i386__) # define __NR_getrandom 355 -# elif defined(__x86_64__) && !defined(__ILP32__) -# define __NR_getrandom 318 +# elif defined(__x86_64__) +# if defined(__ILP32__) +# define __NR_getrandom (__X32_SYSCALL_BIT + 318) +# else +# define __NR_getrandom 318 +# endif +# elif defined(__xtensa__) +# define __NR_getrandom 338 +# elif defined(__s390__) || defined(__s390x__) +# define __NR_getrandom 349 +# elif defined(__bfin__) +# define __NR_getrandom 389 +# elif defined(__powerpc__) +# define __NR_getrandom 359 +# elif defined(__mips__) || defined(__mips64) +# if _MIPS_SIM == _MIPS_SIM_ABI32 +# define __NR_getrandom (__NR_Linux + 353) +# elif _MIPS_SIM == _MIPS_SIM_ABI64 +# define __NR_getrandom (__NR_Linux + 313) +# elif _MIPS_SIM == _MIPS_SIM_NABI32 +# define __NR_getrandom (__NR_Linux + 317) +# endif +# elif defined(__hppa__) +# define __NR_getrandom (__NR_Linux + 339) +# elif defined(__sparc__) +# define __NR_getrandom 347 +# elif defined(__ia64__) +# define __NR_getrandom 1339 +# elif defined(__alpha__) +# define __NR_getrandom 511 +# elif defined(__sh__) +# if defined(__SH5__) +# define __NR_getrandom 373 +# else +# define __NR_getrandom 384 +# endif +# elif defined(__avr32__) +# define __NR_getrandom 317 +# elif defined(__microblaze__) +# define __NR_getrandom 385 +# elif defined(__m68k__) +# define __NR_getrandom 352 +# elif defined(__cris__) +# define __NR_getrandom 356 +# elif defined(__aarch64__) +# define __NR_getrandom 278 +# else /* generic */ +# define __NR_getrandom 278 # endif # endif diff --git a/crypto/rand/rand_vms.c b/crypto/rand/rand_vms.c index 3f13529d..fa74e744 100644 --- a/crypto/rand/rand_vms.c +++ b/crypto/rand/rand_vms.c @@ -14,8 +14,8 @@ # include # include "internal/cryptlib.h" # include -# include "internal/rand_int.h" -# include "rand_lcl.h" +# include "crypto/rand.h" +# include "rand_local.h" # include # include # include diff --git a/crypto/rand/rand_vxworks.c b/crypto/rand/rand_vxworks.c index 81774e09..d6746989 100644 --- a/crypto/rand/rand_vxworks.c +++ b/crypto/rand/rand_vxworks.c @@ -13,8 +13,8 @@ NON_EMPTY_TRANSLATION_UNIT #else # include -# include "rand_lcl.h" -# include "internal/rand_int.h" +# include "rand_local.h" +# include "crypto/rand.h" # include "internal/cryptlib.h" # include # include diff --git a/crypto/rand/rand_win.c b/crypto/rand/rand_win.c index 38852dc7..5f67c87c 100644 --- a/crypto/rand/rand_win.c +++ b/crypto/rand/rand_win.c @@ -9,8 +9,8 @@ #include "internal/cryptlib.h" #include -#include "rand_lcl.h" -#include "internal/rand_int.h" +#include "rand_local.h" +#include "crypto/rand.h" #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_WIN32) # ifndef OPENSSL_RAND_SEED_OS diff --git a/crypto/rc2/rc2_cbc.c b/crypto/rc2/rc2_cbc.c index 75459364..58a4b3e6 100644 --- a/crypto/rc2/rc2_cbc.c +++ b/crypto/rc2/rc2_cbc.c @@ -8,7 +8,7 @@ */ #include -#include "rc2_locl.h" +#include "rc2_local.h" void RC2_cbc_encrypt(const unsigned char *in, unsigned char *out, long length, RC2_KEY *ks, unsigned char *iv, int encrypt) diff --git a/crypto/rc2/rc2_ecb.c b/crypto/rc2/rc2_ecb.c index 9a0d23e5..fec2c101 100644 --- a/crypto/rc2/rc2_ecb.c +++ b/crypto/rc2/rc2_ecb.c @@ -8,7 +8,7 @@ */ #include -#include "rc2_locl.h" +#include "rc2_local.h" #include /*- diff --git a/crypto/rc2/rc2_locl.h b/crypto/rc2/rc2_local.h similarity index 100% rename from crypto/rc2/rc2_locl.h rename to crypto/rc2/rc2_local.h diff --git a/crypto/rc2/rc2_skey.c b/crypto/rc2/rc2_skey.c index a453366b..33068d48 100644 --- a/crypto/rc2/rc2_skey.c +++ b/crypto/rc2/rc2_skey.c @@ -8,7 +8,7 @@ */ #include -#include "rc2_locl.h" +#include "rc2_local.h" static const unsigned char key_table[256] = { 0xd9, 0x78, 0xf9, 0xc4, 0x19, 0xdd, 0xb5, 0xed, 0x28, 0xe9, 0xfd, 0x79, diff --git a/crypto/rc2/rc2cfb64.c b/crypto/rc2/rc2cfb64.c index d7521ef1..9b85368d 100644 --- a/crypto/rc2/rc2cfb64.c +++ b/crypto/rc2/rc2cfb64.c @@ -8,7 +8,7 @@ */ #include -#include "rc2_locl.h" +#include "rc2_local.h" /* * The input and output encrypted as though 64bit cfb mode is being used. diff --git a/crypto/rc2/rc2ofb64.c b/crypto/rc2/rc2ofb64.c index e1be066b..4270009e 100644 --- a/crypto/rc2/rc2ofb64.c +++ b/crypto/rc2/rc2ofb64.c @@ -8,7 +8,7 @@ */ #include -#include "rc2_locl.h" +#include "rc2_local.h" /* * The input and output encrypted as though 64bit ofb mode is being used. diff --git a/crypto/rc4/rc4_enc.c b/crypto/rc4/rc4_enc.c index 26326604..c4753d93 100644 --- a/crypto/rc4/rc4_enc.c +++ b/crypto/rc4/rc4_enc.c @@ -8,7 +8,7 @@ */ #include -#include "rc4_locl.h" +#include "rc4_local.h" /*- * RC4 as implemented from a posting from diff --git a/crypto/rc4/rc4_locl.h b/crypto/rc4/rc4_local.h similarity index 86% rename from crypto/rc4/rc4_locl.h rename to crypto/rc4/rc4_local.h index 20afa133..f8cf9a89 100644 --- a/crypto/rc4/rc4_locl.h +++ b/crypto/rc4/rc4_local.h @@ -7,8 +7,8 @@ * https://www.openssl.org/source/license.html */ -#ifndef HEADER_RC4_LOCL_H -# define HEADER_RC4_LOCL_H +#ifndef OSSL_CRYPTO_RC4_LOCAL_H +# define OSSL_CRYPTO_RC4_LOCAL_H # include # include "internal/cryptlib.h" diff --git a/crypto/rc4/rc4_skey.c b/crypto/rc4/rc4_skey.c index e2325e91..42c4a208 100644 --- a/crypto/rc4/rc4_skey.c +++ b/crypto/rc4/rc4_skey.c @@ -8,7 +8,7 @@ */ #include -#include "rc4_locl.h" +#include "rc4_local.h" #include const char *RC4_options(void) diff --git a/crypto/rc5/rc5_ecb.c b/crypto/rc5/rc5_ecb.c index 61770b6f..51c14fd5 100644 --- a/crypto/rc5/rc5_ecb.c +++ b/crypto/rc5/rc5_ecb.c @@ -8,7 +8,7 @@ */ #include -#include "rc5_locl.h" +#include "rc5_local.h" #include void RC5_32_ecb_encrypt(const unsigned char *in, unsigned char *out, diff --git a/crypto/rc5/rc5_enc.c b/crypto/rc5/rc5_enc.c index e1b71971..c91fa99c 100644 --- a/crypto/rc5/rc5_enc.c +++ b/crypto/rc5/rc5_enc.c @@ -9,7 +9,7 @@ #include #include -#include "rc5_locl.h" +#include "rc5_local.h" void RC5_32_cbc_encrypt(const unsigned char *in, unsigned char *out, long length, RC5_32_KEY *ks, unsigned char *iv, diff --git a/crypto/rc5/rc5_locl.h b/crypto/rc5/rc5_local.h similarity index 100% rename from crypto/rc5/rc5_locl.h rename to crypto/rc5/rc5_local.h diff --git a/crypto/rc5/rc5_skey.c b/crypto/rc5/rc5_skey.c index 43dc9320..22a5df14 100644 --- a/crypto/rc5/rc5_skey.c +++ b/crypto/rc5/rc5_skey.c @@ -8,7 +8,7 @@ */ #include -#include "rc5_locl.h" +#include "rc5_local.h" int RC5_32_set_key(RC5_32_KEY *key, int len, const unsigned char *data, int rounds) diff --git a/crypto/rc5/rc5cfb64.c b/crypto/rc5/rc5cfb64.c index ed0641b7..001e1240 100644 --- a/crypto/rc5/rc5cfb64.c +++ b/crypto/rc5/rc5cfb64.c @@ -8,7 +8,7 @@ */ #include -#include "rc5_locl.h" +#include "rc5_local.h" /* * The input and output encrypted as though 64bit cfb mode is being used. diff --git a/crypto/rc5/rc5ofb64.c b/crypto/rc5/rc5ofb64.c index 30cc0e4f..c3ae5d8c 100644 --- a/crypto/rc5/rc5ofb64.c +++ b/crypto/rc5/rc5ofb64.c @@ -8,7 +8,7 @@ */ #include -#include "rc5_locl.h" +#include "rc5_local.h" /* * The input and output encrypted as though 64bit ofb mode is being used. diff --git a/crypto/ripemd/build.info b/crypto/ripemd/build.info index c4baf631..a0a45b0e 100644 --- a/crypto/ripemd/build.info +++ b/crypto/ripemd/build.info @@ -13,7 +13,11 @@ IF[{- !$disabled{asm} -}] ENDIF SOURCE[../../libcrypto]=rmd_dgst.c rmd_one.c $RMD160ASM + +# Implementations are now spread across several libraries, so the defines +# need to be applied to all affected libraries and modules DEFINE[../../libcrypto]=$RMD160DEF +DEFINE[../providers/libimplementations.a]=$RMD160DEF GENERATE[rmd-586.s]=asm/rmd-586.pl DEPEND[rmd-586.s]=../perlasm/x86asm.pl diff --git a/crypto/ripemd/rmd_dgst.c b/crypto/ripemd/rmd_dgst.c index b66da1c1..f4a69c88 100644 --- a/crypto/ripemd/rmd_dgst.c +++ b/crypto/ripemd/rmd_dgst.c @@ -8,7 +8,7 @@ */ #include -#include "rmd_locl.h" +#include "rmd_local.h" #include #ifdef RMD160_ASM @@ -39,7 +39,7 @@ void ripemd160_block_data_order(RIPEMD160_CTX *ctx, const void *p, size_t num) register unsigned MD32_REG_T A, B, C, D, E; unsigned MD32_REG_T a, b, c, d, e, l; # ifndef MD32_XARRAY - /* See comment in crypto/sha/sha_locl.h for details. */ + /* See comment in crypto/sha/sha_local.h for details. */ unsigned MD32_REG_T XX0, XX1, XX2, XX3, XX4, XX5, XX6, XX7, XX8, XX9, XX10, XX11, XX12, XX13, XX14, XX15; # define X(i) XX##i diff --git a/crypto/ripemd/rmd_locl.h b/crypto/ripemd/rmd_local.h similarity index 96% rename from crypto/ripemd/rmd_locl.h rename to crypto/ripemd/rmd_local.h index 361e21b9..325cb98c 100644 --- a/crypto/ripemd/rmd_locl.h +++ b/crypto/ripemd/rmd_local.h @@ -13,7 +13,7 @@ #include /* - * DO EXAMINE COMMENTS IN crypto/md5/md5_locl.h & crypto/md5/md5_dgst.c + * DO EXAMINE COMMENTS IN crypto/md5/md5_local.h & crypto/md5/md5_dgst.c * FOR EXPLANATIONS ON FOLLOWING "CODE." */ #ifdef RMD160_ASM @@ -42,7 +42,7 @@ void ripemd160_block_data_order(RIPEMD160_CTX *c, const void *p, size_t num); } while (0) #define HASH_BLOCK_DATA_ORDER ripemd160_block_data_order -#include "internal/md32_common.h" +#include "crypto/md32_common.h" /* * Transformed F2 and F4 are courtesy of Wei Dai diff --git a/crypto/rsa/rsa_ameth.c b/crypto/rsa/rsa_ameth.c index bf56039b..69e7c5ea 100644 --- a/crypto/rsa/rsa_ameth.c +++ b/crypto/rsa/rsa_ameth.c @@ -13,9 +13,9 @@ #include #include #include -#include "internal/asn1_int.h" -#include "internal/evp_int.h" -#include "rsa_locl.h" +#include "crypto/asn1.h" +#include "crypto/evp.h" +#include "rsa_local.h" #ifndef OPENSSL_NO_CMS static int rsa_cms_sign(CMS_SignerInfo *si); diff --git a/crypto/rsa/rsa_asn1.c b/crypto/rsa/rsa_asn1.c index ad9d8b35..e6b81253 100644 --- a/crypto/rsa/rsa_asn1.c +++ b/crypto/rsa/rsa_asn1.c @@ -12,7 +12,7 @@ #include #include #include -#include "rsa_locl.h" +#include "rsa_local.h" /* * Override the default free and new methods, diff --git a/crypto/rsa/rsa_chk.c b/crypto/rsa/rsa_chk.c index 96a13b33..9d804913 100644 --- a/crypto/rsa/rsa_chk.c +++ b/crypto/rsa/rsa_chk.c @@ -9,7 +9,7 @@ #include #include -#include "rsa_locl.h" +#include "rsa_local.h" int RSA_check_key(const RSA *key) { @@ -73,13 +73,13 @@ int RSA_check_key_ex(const RSA *key, BN_GENCB *cb) } /* p prime? */ - if (BN_is_prime_ex(key->p, BN_prime_checks, NULL, cb) != 1) { + if (BN_check_prime(key->p, NULL, cb) != 1) { ret = 0; RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_P_NOT_PRIME); } /* q prime? */ - if (BN_is_prime_ex(key->q, BN_prime_checks, NULL, cb) != 1) { + if (BN_check_prime(key->q, NULL, cb) != 1) { ret = 0; RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_Q_NOT_PRIME); } @@ -87,7 +87,7 @@ int RSA_check_key_ex(const RSA *key, BN_GENCB *cb) /* r_i prime? */ for (idx = 0; idx < ex_primes; idx++) { pinfo = sk_RSA_PRIME_INFO_value(key->prime_infos, idx); - if (BN_is_prime_ex(pinfo->r, BN_prime_checks, NULL, cb) != 1) { + if (BN_check_prime(pinfo->r, NULL, cb) != 1) { ret = 0; RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_MP_R_NOT_PRIME); } diff --git a/crypto/rsa/rsa_crpt.c b/crypto/rsa/rsa_crpt.c index c35ad9f5..6a408e90 100644 --- a/crypto/rsa/rsa_crpt.c +++ b/crypto/rsa/rsa_crpt.c @@ -10,9 +10,9 @@ #include #include #include "internal/cryptlib.h" -#include "internal/bn_int.h" +#include "crypto/bn.h" #include -#include "rsa_locl.h" +#include "rsa_local.h" int RSA_bits(const RSA *r) { diff --git a/crypto/rsa/rsa_gen.c b/crypto/rsa/rsa_gen.c index dfbb79f9..c87b7097 100644 --- a/crypto/rsa/rsa_gen.c +++ b/crypto/rsa/rsa_gen.c @@ -17,7 +17,7 @@ #include #include "internal/cryptlib.h" #include -#include "rsa_locl.h" +#include "rsa_local.h" static int rsa_builtin_keygen(RSA *rsa, int bits, int primes, BIGNUM *e_value, BN_GENCB *cb); diff --git a/crypto/rsa/rsa_lib.c b/crypto/rsa/rsa_lib.c index c6e57008..abdabfb4 100644 --- a/crypto/rsa/rsa_lib.c +++ b/crypto/rsa/rsa_lib.c @@ -11,11 +11,11 @@ #include #include "internal/cryptlib.h" #include "internal/refcount.h" -#include "internal/bn_int.h" +#include "crypto/bn.h" #include #include -#include "internal/evp_int.h" -#include "rsa_locl.h" +#include "crypto/evp.h" +#include "rsa_local.h" RSA *RSA_new(void) { diff --git a/crypto/rsa/rsa_locl.h b/crypto/rsa/rsa_local.h similarity index 98% rename from crypto/rsa/rsa_locl.h rename to crypto/rsa/rsa_local.h index 5dcd6eab..204fde29 100644 --- a/crypto/rsa/rsa_locl.h +++ b/crypto/rsa/rsa_local.h @@ -7,8 +7,8 @@ * https://www.openssl.org/source/license.html */ -#ifndef RSA_LOCAL_HEADER_H -#define RSA_LOCAL_HEADER_H +#ifndef OSSL_CRYPTO_RSA_LOCAL_H +#define OSSL_CRYPTO_RSA_LOCAL_H #include #include "internal/refcount.h" @@ -167,4 +167,4 @@ int rsa_fips186_4_gen_prob_primes(RSA *rsa, BIGNUM *p1, BIGNUM *p2, const BIGNUM *Xq2, int nbits, const BIGNUM *e, BN_CTX *ctx, BN_GENCB *cb); -#endif /* RSA_LOCAL_HEADER_H */ +#endif /* OSSL_CRYPTO_RSA_LOCAL_H */ diff --git a/crypto/rsa/rsa_meth.c b/crypto/rsa/rsa_meth.c index 0306519c..a2a0426e 100644 --- a/crypto/rsa/rsa_meth.c +++ b/crypto/rsa/rsa_meth.c @@ -8,7 +8,7 @@ */ #include -#include "rsa_locl.h" +#include "rsa_local.h" #include RSA_METHOD *RSA_meth_new(const char *name, int flags) diff --git a/crypto/rsa/rsa_mp.c b/crypto/rsa/rsa_mp.c index d2e00f6e..6a16ffd5 100644 --- a/crypto/rsa/rsa_mp.c +++ b/crypto/rsa/rsa_mp.c @@ -10,7 +10,7 @@ #include #include -#include "rsa_locl.h" +#include "rsa_local.h" void rsa_multip_info_free_ex(RSA_PRIME_INFO *pinfo) { diff --git a/crypto/rsa/rsa_oaep.c b/crypto/rsa/rsa_oaep.c index 0945d4f6..1ae7ed28 100644 --- a/crypto/rsa/rsa_oaep.c +++ b/crypto/rsa/rsa_oaep.c @@ -20,7 +20,7 @@ * one-wayness. For the RSA function, this is an equivalent notion. */ -#include "internal/constant_time_locl.h" +#include "internal/constant_time.h" #include #include "internal/cryptlib.h" @@ -28,7 +28,7 @@ #include #include #include -#include "rsa_locl.h" +#include "rsa_local.h" int RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen, const unsigned char *from, int flen, diff --git a/crypto/rsa/rsa_ossl.c b/crypto/rsa/rsa_ossl.c index 5d5efdbd..39d17cf3 100644 --- a/crypto/rsa/rsa_ossl.c +++ b/crypto/rsa/rsa_ossl.c @@ -8,9 +8,9 @@ */ #include "internal/cryptlib.h" -#include "internal/bn_int.h" -#include "rsa_locl.h" -#include "internal/constant_time_locl.h" +#include "crypto/bn.h" +#include "rsa_local.h" +#include "internal/constant_time.h" static int rsa_ossl_public_encrypt(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, int padding); diff --git a/crypto/rsa/rsa_pk1.c b/crypto/rsa/rsa_pk1.c index ff1ca021..0c774224 100644 --- a/crypto/rsa/rsa_pk1.c +++ b/crypto/rsa/rsa_pk1.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "internal/constant_time_locl.h" +#include "internal/constant_time.h" #include #include "internal/cryptlib.h" @@ -57,7 +57,7 @@ int RSA_padding_check_PKCS1_type_1(unsigned char *to, int tlen, * D - data. */ - if (num < 11) + if (num < RSA_PKCS1_PADDING_SIZE) return -1; /* Accept inputs with and without the leading 0-byte. */ @@ -120,7 +120,7 @@ int RSA_padding_add_PKCS1_type_2(unsigned char *to, int tlen, int i, j; unsigned char *p; - if (flen > (tlen - 11)) { + if (flen > (tlen - RSA_PKCS1_PADDING_SIZE)) { RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_2, RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE); return 0; @@ -169,7 +169,7 @@ int RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen, * section 7.2.2. */ - if (flen > num || num < 11) { + if (flen > num || num < RSA_PKCS1_PADDING_SIZE) { RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2, RSA_R_PKCS_DECODING_ERROR); return -1; @@ -226,8 +226,8 @@ int RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen, good &= constant_time_ge(tlen, mlen); /* - * Move the result in-place by |num|-11-|mlen| bytes to the left. - * Then if |good| move |mlen| bytes from |em|+11 to |to|. + * Move the result in-place by |num|-RSA_PKCS1_PADDING_SIZE-|mlen| bytes to the left. + * Then if |good| move |mlen| bytes from |em|+RSA_PKCS1_PADDING_SIZE to |to|. * Otherwise leave |to| unchanged. * Copy the memory back in a way that does not reveal the size of * the data being copied via a timing side channel. This requires copying @@ -235,16 +235,16 @@ int RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen, * length. Clear bits do a non-copy with identical access pattern. * The loop below has overall complexity of O(N*log(N)). */ - tlen = constant_time_select_int(constant_time_lt(num - 11, tlen), - num - 11, tlen); - for (msg_index = 1; msg_index < num - 11; msg_index <<= 1) { - mask = ~constant_time_eq(msg_index & (num - 11 - mlen), 0); - for (i = 11; i < num - msg_index; i++) + tlen = constant_time_select_int(constant_time_lt(num - RSA_PKCS1_PADDING_SIZE, tlen), + num - RSA_PKCS1_PADDING_SIZE, tlen); + for (msg_index = 1; msg_index < num - RSA_PKCS1_PADDING_SIZE; msg_index <<= 1) { + mask = ~constant_time_eq(msg_index & (num - RSA_PKCS1_PADDING_SIZE - mlen), 0); + for (i = RSA_PKCS1_PADDING_SIZE; i < num - msg_index; i++) em[i] = constant_time_select_8(mask, em[i + msg_index], em[i]); } for (i = 0; i < tlen; i++) { mask = good & constant_time_lt(i, mlen); - to[i] = constant_time_select_8(mask, em[i + 11], to[i]); + to[i] = constant_time_select_8(mask, em[i + RSA_PKCS1_PADDING_SIZE], to[i]); } OPENSSL_clear_free(em, num); diff --git a/crypto/rsa/rsa_pmeth.c b/crypto/rsa/rsa_pmeth.c index bd0870b4..390188d1 100644 --- a/crypto/rsa/rsa_pmeth.c +++ b/crypto/rsa/rsa_pmeth.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "internal/constant_time_locl.h" +#include "internal/constant_time.h" #include #include "internal/cryptlib.h" @@ -18,8 +18,8 @@ #include #include #include -#include "internal/evp_int.h" -#include "rsa_locl.h" +#include "crypto/evp.h" +#include "rsa_local.h" /* RSA pkey context structure */ @@ -755,7 +755,7 @@ static int pkey_rsa_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey) return ret; } -const EVP_PKEY_METHOD rsa_pkey_meth = { +static const EVP_PKEY_METHOD rsa_pkey_meth = { EVP_PKEY_RSA, EVP_PKEY_FLAG_AUTOARGLEN, pkey_rsa_init, @@ -790,6 +790,11 @@ const EVP_PKEY_METHOD rsa_pkey_meth = { pkey_rsa_ctrl_str }; +const EVP_PKEY_METHOD *rsa_pkey_method(void) +{ + return &rsa_pkey_meth; +} + /* * Called for PSS sign or verify initialisation: checks PSS parameter * sanity and sets any restrictions on key usage. @@ -837,7 +842,7 @@ static int pkey_pss_init(EVP_PKEY_CTX *ctx) return 1; } -const EVP_PKEY_METHOD rsa_pss_pkey_meth = { +static const EVP_PKEY_METHOD rsa_pss_pkey_meth = { EVP_PKEY_RSA_PSS, EVP_PKEY_FLAG_AUTOARGLEN, pkey_rsa_init, @@ -860,3 +865,8 @@ const EVP_PKEY_METHOD rsa_pss_pkey_meth = { pkey_rsa_ctrl, pkey_rsa_ctrl_str }; + +const EVP_PKEY_METHOD *rsa_pss_pkey_method(void) +{ + return &rsa_pss_pkey_meth; +} diff --git a/crypto/rsa/rsa_pss.c b/crypto/rsa/rsa_pss.c index 51c03c73..15014ef4 100644 --- a/crypto/rsa/rsa_pss.c +++ b/crypto/rsa/rsa_pss.c @@ -14,7 +14,7 @@ #include #include #include -#include "rsa_locl.h" +#include "rsa_local.h" static const unsigned char zeroes[] = { 0, 0, 0, 0, 0, 0, 0, 0 }; diff --git a/crypto/rsa/rsa_sign.c b/crypto/rsa/rsa_sign.c index 73811e7b..0ed9acf4 100644 --- a/crypto/rsa/rsa_sign.c +++ b/crypto/rsa/rsa_sign.c @@ -13,8 +13,8 @@ #include #include #include -#include "internal/x509_int.h" -#include "rsa_locl.h" +#include "crypto/x509.h" +#include "rsa_local.h" /* Size of an SSL signature: MD5+SHA1 */ #define SSL_SIG_LENGTH 36 diff --git a/crypto/rsa/rsa_sp800_56b_check.c b/crypto/rsa/rsa_sp800_56b_check.c index 10e264e5..d614504b 100644 --- a/crypto/rsa/rsa_sp800_56b_check.c +++ b/crypto/rsa/rsa_sp800_56b_check.c @@ -10,8 +10,8 @@ #include #include -#include "internal/bn_int.h" -#include "rsa_locl.h" +#include "crypto/bn.h" +#include "rsa_local.h" /* * Part of the RSA keypair test. @@ -119,16 +119,15 @@ err: * Check the prime factor (for either p or q) * i.e: p is prime AND GCD(p - 1, e) = 1 * - * See SP800-5bBr1 6.4.1.2.3 Step 5 (a to d) & (e to h). + * See SP800-56Br1 6.4.1.2.3 Step 5 (a to d) & (e to h). */ int rsa_check_prime_factor(BIGNUM *p, BIGNUM *e, int nbits, BN_CTX *ctx) { - int checks = bn_rsa_fips186_4_prime_MR_min_checks(nbits); int ret = 0; BIGNUM *p1 = NULL, *gcd = NULL; /* (Steps 5 a-b) prime test */ - if (BN_is_prime_fasttest_ex(p, checks, ctx, 1, NULL) != 1 + if (BN_check_prime(p, ctx, NULL) != 1 /* (Step 5c) (√2)(2^(nbits/2 - 1) <= p <= 2^(nbits/2 - 1) */ || rsa_check_prime_factor_range(p, nbits, ctx) != 1) return 0; @@ -235,7 +234,7 @@ int rsa_get_lcm(BN_CTX *ctx, const BIGNUM *p, const BIGNUM *q, */ int rsa_sp800_56b_check_public(const RSA *rsa) { - int ret = 0, nbits, iterations, status; + int ret = 0, nbits, status; BN_CTX *ctx = NULL; BIGNUM *gcd = NULL; @@ -268,7 +267,6 @@ int rsa_sp800_56b_check_public(const RSA *rsa) if (ctx == NULL || gcd == NULL) goto err; - iterations = bn_rsa_fips186_4_prime_MR_min_checks(nbits); /* (Steps d-f): * The modulus is composite, but not a power of a prime. * The modulus has no factors smaller than 752. @@ -278,7 +276,7 @@ int rsa_sp800_56b_check_public(const RSA *rsa) goto err; } - ret = bn_miller_rabin_is_prime(rsa->n, iterations, ctx, NULL, 1, &status); + ret = bn_miller_rabin_is_prime(rsa->n, 0, ctx, NULL, 1, &status); if (ret != 1 || status != BN_PRIMETEST_COMPOSITE_NOT_POWER_OF_PRIME) { RSAerr(RSA_F_RSA_SP800_56B_CHECK_PUBLIC, RSA_R_INVALID_MODULUS); ret = 0; diff --git a/crypto/rsa/rsa_sp800_56b_gen.c b/crypto/rsa/rsa_sp800_56b_gen.c index 50c5bf14..c22b10cf 100644 --- a/crypto/rsa/rsa_sp800_56b_gen.c +++ b/crypto/rsa/rsa_sp800_56b_gen.c @@ -10,8 +10,8 @@ #include #include -#include "internal/bn_int.h" -#include "rsa_locl.h" +#include "crypto/bn.h" +#include "rsa_local.h" #define RSA_FIPS1864_MIN_KEYGEN_KEYSIZE 2048 #define RSA_FIPS1864_MIN_KEYGEN_STRENGTH 112 diff --git a/crypto/rsa/rsa_ssl.c b/crypto/rsa/rsa_ssl.c index 16bfe00d..99e54188 100644 --- a/crypto/rsa/rsa_ssl.c +++ b/crypto/rsa/rsa_ssl.c @@ -12,7 +12,7 @@ #include #include #include -#include "internal/constant_time_locl.h" +#include "internal/constant_time.h" int RSA_padding_add_SSLv23(unsigned char *to, int tlen, const unsigned char *from, int flen) @@ -20,7 +20,7 @@ int RSA_padding_add_SSLv23(unsigned char *to, int tlen, int i, j; unsigned char *p; - if (flen > (tlen - 11)) { + if (flen > (tlen - RSA_PKCS1_PADDING_SIZE)) { RSAerr(RSA_F_RSA_PADDING_ADD_SSLV23, RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE); return 0; @@ -70,7 +70,7 @@ int RSA_padding_check_SSLv23(unsigned char *to, int tlen, if (tlen <= 0 || flen <= 0) return -1; - if (flen > num || num < 11) { + if (flen > num || num < RSA_PKCS1_PADDING_SIZE) { RSAerr(RSA_F_RSA_PADDING_CHECK_SSLV23, RSA_R_DATA_TOO_SMALL); return -1; } @@ -141,8 +141,8 @@ int RSA_padding_check_SSLv23(unsigned char *to, int tlen, err = constant_time_select_int(mask | good, err, RSA_R_DATA_TOO_LARGE); /* - * Move the result in-place by |num|-11-|mlen| bytes to the left. - * Then if |good| move |mlen| bytes from |em|+11 to |to|. + * Move the result in-place by |num|-RSA_PKCS1_PADDING_SIZE-|mlen| bytes to the left. + * Then if |good| move |mlen| bytes from |em|+RSA_PKCS1_PADDING_SIZE to |to|. * Otherwise leave |to| unchanged. * Copy the memory back in a way that does not reveal the size of * the data being copied via a timing side channel. This requires copying @@ -150,16 +150,16 @@ int RSA_padding_check_SSLv23(unsigned char *to, int tlen, * length. Clear bits do a non-copy with identical access pattern. * The loop below has overall complexity of O(N*log(N)). */ - tlen = constant_time_select_int(constant_time_lt(num - 11, tlen), - num - 11, tlen); - for (msg_index = 1; msg_index < num - 11; msg_index <<= 1) { - mask = ~constant_time_eq(msg_index & (num - 11 - mlen), 0); - for (i = 11; i < num - msg_index; i++) + tlen = constant_time_select_int(constant_time_lt(num - RSA_PKCS1_PADDING_SIZE, tlen), + num - RSA_PKCS1_PADDING_SIZE, tlen); + for (msg_index = 1; msg_index < num - RSA_PKCS1_PADDING_SIZE; msg_index <<= 1) { + mask = ~constant_time_eq(msg_index & (num - RSA_PKCS1_PADDING_SIZE - mlen), 0); + for (i = RSA_PKCS1_PADDING_SIZE; i < num - msg_index; i++) em[i] = constant_time_select_8(mask, em[i + msg_index], em[i]); } for (i = 0; i < tlen; i++) { mask = good & constant_time_lt(i, mlen); - to[i] = constant_time_select_8(mask, em[i + 11], to[i]); + to[i] = constant_time_select_8(mask, em[i + RSA_PKCS1_PADDING_SIZE], to[i]); } OPENSSL_clear_free(em, num); diff --git a/crypto/rsa/rsa_x931g.c b/crypto/rsa/rsa_x931g.c index 7a52083f..3798d02b 100644 --- a/crypto/rsa/rsa_x931g.c +++ b/crypto/rsa/rsa_x931g.c @@ -12,7 +12,7 @@ #include #include #include -#include "rsa_locl.h" +#include "rsa_local.h" /* X9.31 RSA key derivation and generation */ diff --git a/crypto/s390x_arch.h b/crypto/s390x_arch.h index bb69ed02..0123de94 100644 --- a/crypto/s390x_arch.h +++ b/crypto/s390x_arch.h @@ -7,8 +7,8 @@ * https://www.openssl.org/source/license.html */ -#ifndef S390X_ARCH_H -# define S390X_ARCH_H +#ifndef OSSL_CRYPTO_S390X_ARCH_H +# define OSSL_CRYPTO_S390X_ARCH_H # ifndef __ASSEMBLER__ @@ -30,6 +30,9 @@ int s390x_pcc(unsigned int fc, void *param); int s390x_kdsa(unsigned int fc, void *param, const unsigned char *in, size_t len); +void s390x_flip_endian32(unsigned char dst[32], const unsigned char src[32]); +void s390x_flip_endian64(unsigned char dst[64], const unsigned char src[64]); + /* * The field elements of OPENSSL_s390xcap_P are the 64-bit words returned by * the STFLE instruction followed by the 64-bit word pairs returned by @@ -123,6 +126,10 @@ extern struct OPENSSL_s390xcap_st OPENSSL_s390xcap_P; # define S390X_SCALAR_MULTIPLY_P256 64 # define S390X_SCALAR_MULTIPLY_P384 65 # define S390X_SCALAR_MULTIPLY_P521 66 +# define S390X_SCALAR_MULTIPLY_ED25519 72 +# define S390X_SCALAR_MULTIPLY_ED448 73 +# define S390X_SCALAR_MULTIPLY_X25519 80 +# define S390X_SCALAR_MULTIPLY_X448 81 /* kdsa */ # define S390X_ECDSA_VERIFY_P256 1 @@ -131,6 +138,10 @@ extern struct OPENSSL_s390xcap_st OPENSSL_s390xcap_P; # define S390X_ECDSA_SIGN_P256 9 # define S390X_ECDSA_SIGN_P384 10 # define S390X_ECDSA_SIGN_P521 11 +# define S390X_EDDSA_VERIFY_ED25519 32 +# define S390X_EDDSA_VERIFY_ED448 36 +# define S390X_EDDSA_SIGN_ED25519 40 +# define S390X_EDDSA_SIGN_ED448 44 /* Register 0 Flags */ # define S390X_DECRYPT 0x80 diff --git a/crypto/s390xcap.c b/crypto/s390xcap.c index 5123e14f..eb00a4a7 100644 --- a/crypto/s390xcap.c +++ b/crypto/s390xcap.c @@ -13,7 +13,7 @@ #include #include #include "internal/cryptlib.h" -#include "internal/ctype.h" +#include "crypto/ctype.h" #include "s390x_arch.h" #if defined(__GLIBC__) && defined(__GLIBC_PREREQ) @@ -578,7 +578,8 @@ static int parse_env(struct OPENSSL_s390xcap_st *cap) S390X_CAPBIT(S390X_VX) | S390X_CAPBIT(S390X_VXD) | S390X_CAPBIT(S390X_VXE) - | S390X_CAPBIT(S390X_MSA8), + | S390X_CAPBIT(S390X_MSA8) + | S390X_CAPBIT(S390X_MSA9), 0ULL}, /*.kimd = */{S390X_CAPBIT(S390X_QUERY) | S390X_CAPBIT(S390X_SHA_1) @@ -642,18 +643,25 @@ static int parse_env(struct OPENSSL_s390xcap_st *cap) | S390X_CAPBIT(S390X_AES_192) | S390X_CAPBIT(S390X_AES_256), 0ULL}, - /*.pcc = */{S390X_CAPBIT(S390X_QUERY) - | S390X_CAPBIT(S390X_SCALAR_MULTIPLY_P256) + /*.pcc = */{S390X_CAPBIT(S390X_QUERY), + S390X_CAPBIT(S390X_SCALAR_MULTIPLY_P256) | S390X_CAPBIT(S390X_SCALAR_MULTIPLY_P384) - | S390X_CAPBIT(S390X_SCALAR_MULTIPLY_P521), - 0ULL}, + | S390X_CAPBIT(S390X_SCALAR_MULTIPLY_P521) + | S390X_CAPBIT(S390X_SCALAR_MULTIPLY_ED25519) + | S390X_CAPBIT(S390X_SCALAR_MULTIPLY_ED448) + | S390X_CAPBIT(S390X_SCALAR_MULTIPLY_X25519) + | S390X_CAPBIT(S390X_SCALAR_MULTIPLY_X448)}, /*.kdsa = */{S390X_CAPBIT(S390X_QUERY) | S390X_CAPBIT(S390X_ECDSA_VERIFY_P256) | S390X_CAPBIT(S390X_ECDSA_VERIFY_P384) | S390X_CAPBIT(S390X_ECDSA_VERIFY_P521) | S390X_CAPBIT(S390X_ECDSA_SIGN_P256) | S390X_CAPBIT(S390X_ECDSA_SIGN_P384) - | S390X_CAPBIT(S390X_ECDSA_SIGN_P521), + | S390X_CAPBIT(S390X_ECDSA_SIGN_P521) + | S390X_CAPBIT(S390X_EDDSA_VERIFY_ED25519) + | S390X_CAPBIT(S390X_EDDSA_VERIFY_ED448) + | S390X_CAPBIT(S390X_EDDSA_SIGN_ED25519) + | S390X_CAPBIT(S390X_EDDSA_SIGN_ED448), 0ULL}, }; diff --git a/crypto/s390xcpuid.pl b/crypto/s390xcpuid.pl index 36f74206..0f63f7ed 100755 --- a/crypto/s390xcpuid.pl +++ b/crypto/s390xcpuid.pl @@ -109,7 +109,7 @@ OPENSSL_s390x_functions: la %r1,S390X_KMAC(%r4) .long 0xb91e0042 # kmac %r4,%r2 - tmhh %r3,0x0003 # check for message-security-assist-3 + tmhh %r3,0x0008 # check for message-security-assist-3 jz .Lret lghi %r0,S390X_QUERY # query pcc capability vector @@ -495,6 +495,62 @@ s390x_kdsa: ___ } +################ +# void s390x_flip_endian32(unsigned char dst[32], const unsigned char src[32]) +{ +my ($dst,$src) = map("%r$_",(2..3)); +$code.=<<___; +.globl s390x_flip_endian32 +.type s390x_flip_endian32,\@function +.align 16 +s390x_flip_endian32: + lrvg %r0,0(%r0,$src) + lrvg %r1,8(%r0,$src) + lrvg %r4,16(%r0,$src) + lrvg %r5,24(%r0,$src) + stg %r0,24(%r0,$dst) + stg %r1,16(%r0,$dst) + stg %r4,8(%r0,$dst) + stg %r5,0(%r0,$dst) + br $ra +.size s390x_flip_endian32,.-s390x_flip_endian32 +___ +} + +################ +# void s390x_flip_endian64(unsigned char dst[64], const unsigned char src[64]) +{ +my ($dst,$src) = map("%r$_",(2..3)); +$code.=<<___; +.globl s390x_flip_endian64 +.type s390x_flip_endian64,\@function +.align 16 +s390x_flip_endian64: + stmg %r6,%r9,6*$SIZE_T($sp) + + lrvg %r0,0(%r0,$src) + lrvg %r1,8(%r0,$src) + lrvg %r4,16(%r0,$src) + lrvg %r5,24(%r0,$src) + lrvg %r6,32(%r0,$src) + lrvg %r7,40(%r0,$src) + lrvg %r8,48(%r0,$src) + lrvg %r9,56(%r0,$src) + stg %r0,56(%r0,$dst) + stg %r1,48(%r0,$dst) + stg %r4,40(%r0,$dst) + stg %r5,32(%r0,$dst) + stg %r6,24(%r0,$dst) + stg %r7,16(%r0,$dst) + stg %r8,8(%r0,$dst) + stg %r9,0(%r0,$dst) + + lmg %r6,%r9,6*$SIZE_T($sp) + br $ra +.size s390x_flip_endian64,.-s390x_flip_endian64 +___ +} + $code.=<<___; .section .init brasl $ra,OPENSSL_cpuid_setup diff --git a/crypto/seed/seed.c b/crypto/seed/seed.c index a73ec44d..224fb1f8 100644 --- a/crypto/seed/seed.c +++ b/crypto/seed/seed.c @@ -42,7 +42,7 @@ # endif # include -# include "seed_locl.h" +# include "seed_local.h" # ifdef SS /* can get defined on Solaris by inclusion of * */ diff --git a/crypto/seed/seed_locl.h b/crypto/seed/seed_local.h similarity index 97% rename from crypto/seed/seed_locl.h rename to crypto/seed/seed_local.h index 9be89b21..ed3cebc6 100644 --- a/crypto/seed/seed_locl.h +++ b/crypto/seed/seed_local.h @@ -32,8 +32,8 @@ * SUCH DAMAGE. * */ -#ifndef HEADER_SEED_LOCL_H -# define HEADER_SEED_LOCL_H +#ifndef OSSL_CRYPTO_SEED_LOCAL_H +# define OSSL_CRYPTO_SEED_LOCAL_H # include "openssl/e_os2.h" # include @@ -109,4 +109,4 @@ typedef unsigned int seed_word; (X1) ^= (T0); \ (X2) ^= (T1) -#endif /* HEADER_SEED_LOCL_H */ +#endif /* OSSL_CRYPTO_SEED_LOCAL_H */ diff --git a/crypto/sha/build.info b/crypto/sha/build.info index 67d9fd47..dd10c5cd 100644 --- a/crypto/sha/build.info +++ b/crypto/sha/build.info @@ -75,9 +75,13 @@ ENDIF $COMMON=sha1dgst.c sha256.c sha512.c sha3.c $SHA1ASM $KECCAK1600ASM SOURCE[../../libcrypto]=$COMMON sha1_one.c +SOURCE[../../providers/libfips.a]= $COMMON + +# Implementations are now spread across several libraries, so the defines +# need to be applied to all affected libraries and modules. DEFINE[../../libcrypto]=$SHA1DEF $KECCAK1600DEF -SOURCE[../../providers/fips]= $COMMON -DEFINE[../../providers/fips]= $SHA1DEF $KECCAK1600DEF +DEFINE[../../providers/libfips.a]=$SHA1DEF $KECCAK1600DEF +DEFINE[../../providers/libimplementations.a]=$SHA1DEF $KECCAK1600DEF GENERATE[sha1-586.s]=asm/sha1-586.pl DEPEND[sha1-586.s]=../perlasm/x86asm.pl diff --git a/crypto/sha/sha1dgst.c b/crypto/sha/sha1dgst.c index 4881bcb1..68c0a967 100644 --- a/crypto/sha/sha1dgst.c +++ b/crypto/sha/sha1dgst.c @@ -16,8 +16,8 @@ /* The implementation is in ../md32_common.h */ -#include "sha_locl.h" -#include "internal/sha.h" +#include "sha_local.h" +#include "crypto/sha.h" int sha1_ctrl(SHA_CTX *sha1, int cmd, int mslen, void *ms) { diff --git a/crypto/sha/sha256.c b/crypto/sha/sha256.c index 328c0f17..99833924 100644 --- a/crypto/sha/sha256.c +++ b/crypto/sha/sha256.c @@ -128,7 +128,7 @@ static #endif void sha256_block_data_order(SHA256_CTX *ctx, const void *in, size_t num); -#include "internal/md32_common.h" +#include "crypto/md32_common.h" #ifndef SHA256_ASM static const SHA_LONG K256[64] = { diff --git a/crypto/sha/sha512.c b/crypto/sha/sha512.c index 7b6d7496..03189a9d 100644 --- a/crypto/sha/sha512.c +++ b/crypto/sha/sha512.c @@ -50,7 +50,7 @@ #include #include "internal/cryptlib.h" -#include "internal/sha.h" +#include "crypto/sha.h" #if defined(__i386) || defined(__i386__) || defined(_M_IX86) || \ defined(__x86_64) || defined(_M_AMD64) || defined(_M_X64) || \ diff --git a/crypto/sha/sha_locl.h b/crypto/sha/sha_local.h similarity index 99% rename from crypto/sha/sha_locl.h rename to crypto/sha/sha_local.h index d615e584..f7c0ac70 100644 --- a/crypto/sha/sha_locl.h +++ b/crypto/sha/sha_local.h @@ -42,7 +42,7 @@ static void sha1_block_data_order(SHA_CTX *c, const void *p, size_t num); void sha1_block_data_order(SHA_CTX *c, const void *p, size_t num); #endif -#include "internal/md32_common.h" +#include "crypto/md32_common.h" #define INIT_DATA_h0 0x67452301UL #define INIT_DATA_h1 0xefcdab89UL diff --git a/crypto/siphash/siphash.c b/crypto/siphash/siphash.c index 9d911784..03f9b498 100644 --- a/crypto/siphash/siphash.c +++ b/crypto/siphash/siphash.c @@ -27,7 +27,7 @@ #include #include -#include "internal/siphash.h" +#include "crypto/siphash.h" #include "siphash_local.h" /* default: SipHash-2-4 */ diff --git a/crypto/siphash/siphash_ameth.c b/crypto/siphash/siphash_ameth.c index ba7679db..5aa4d889 100644 --- a/crypto/siphash/siphash_ameth.c +++ b/crypto/siphash/siphash_ameth.c @@ -10,10 +10,10 @@ #include #include "internal/cryptlib.h" #include -#include "internal/asn1_int.h" -#include "internal/siphash.h" +#include "crypto/asn1.h" +#include "crypto/siphash.h" #include "siphash_local.h" -#include "internal/evp_int.h" +#include "crypto/evp.h" /* * SIPHASH "ASN1" method. This is just here to indicate the maximum diff --git a/crypto/sm2/sm2_crypt.c b/crypto/sm2/sm2_crypt.c index d5442107..102f0265 100644 --- a/crypto/sm2/sm2_crypt.c +++ b/crypto/sm2/sm2_crypt.c @@ -9,9 +9,9 @@ * https://www.openssl.org/source/license.html */ -#include "internal/sm2.h" -#include "internal/sm2err.h" -#include "internal/ec_int.h" /* ecdh_KDF_X9_63() */ +#include "crypto/sm2.h" +#include "crypto/sm2err.h" +#include "crypto/ec.h" /* ecdh_KDF_X9_63() */ #include #include #include diff --git a/crypto/sm2/sm2_err.c b/crypto/sm2/sm2_err.c index d8e11790..93ee9f7d 100644 --- a/crypto/sm2/sm2_err.c +++ b/crypto/sm2/sm2_err.c @@ -9,7 +9,7 @@ */ #include -#include "internal/sm2err.h" +#include "crypto/sm2err.h" #ifndef OPENSSL_NO_ERR diff --git a/crypto/sm2/sm2_pmeth.c b/crypto/sm2/sm2_pmeth.c index 56e015d9..27bec2cb 100644 --- a/crypto/sm2/sm2_pmeth.c +++ b/crypto/sm2/sm2_pmeth.c @@ -11,9 +11,9 @@ #include #include #include -#include "internal/evp_int.h" -#include "internal/sm2.h" -#include "internal/sm2err.h" +#include "crypto/evp.h" +#include "crypto/sm2.h" +#include "crypto/sm2err.h" /* EC pkey context structure */ @@ -309,7 +309,7 @@ static int pkey_sm2_digest_custom(EVP_PKEY_CTX *ctx, EVP_MD_CTX *mctx) return EVP_DigestUpdate(mctx, z, (size_t)mdlen); } -const EVP_PKEY_METHOD sm2_pkey_meth = { +static const EVP_PKEY_METHOD sm2_pkey_meth = { EVP_PKEY_SM2, 0, pkey_sm2_init, @@ -349,3 +349,8 @@ const EVP_PKEY_METHOD sm2_pkey_meth = { pkey_sm2_digest_custom }; + +const EVP_PKEY_METHOD *sm2_pkey_method(void) +{ + return &sm2_pkey_meth; +} diff --git a/crypto/sm2/sm2_sign.c b/crypto/sm2/sm2_sign.c index 38e55624..318e9818 100644 --- a/crypto/sm2/sm2_sign.c +++ b/crypto/sm2/sm2_sign.c @@ -9,9 +9,9 @@ * https://www.openssl.org/source/license.html */ -#include "internal/sm2.h" -#include "internal/sm2err.h" -#include "internal/ec_int.h" /* ec_group_do_inverse_ord() */ +#include "crypto/sm2.h" +#include "crypto/sm2err.h" +#include "crypto/ec.h" /* ec_group_do_inverse_ord() */ #include "internal/numbers.h" #include #include diff --git a/crypto/sm3/m_sm3.c b/crypto/sm3/m_sm3.c index 38ddbfe3..4bccaaf1 100644 --- a/crypto/sm3/m_sm3.c +++ b/crypto/sm3/m_sm3.c @@ -13,7 +13,7 @@ #ifndef OPENSSL_NO_SM3 # include # include "internal/sm3.h" -# include "internal/evp_int.h" +# include "crypto/evp.h" static int init(EVP_MD_CTX *ctx) { diff --git a/crypto/sm3/sm3.c b/crypto/sm3/sm3.c index f5d6a861..ef03150c 100644 --- a/crypto/sm3/sm3.c +++ b/crypto/sm3/sm3.c @@ -10,7 +10,7 @@ */ #include -#include "sm3_locl.h" +#include "sm3_local.h" int sm3_init(SM3_CTX *c) { diff --git a/crypto/sm3/sm3_locl.h b/crypto/sm3/sm3_local.h similarity index 98% rename from crypto/sm3/sm3_locl.h rename to crypto/sm3/sm3_local.h index a5b79623..07def19c 100644 --- a/crypto/sm3/sm3_locl.h +++ b/crypto/sm3/sm3_local.h @@ -37,7 +37,7 @@ void sm3_block_data_order(SM3_CTX *c, const void *p, size_t num); void sm3_transform(SM3_CTX *c, const unsigned char *data); -#include "internal/md32_common.h" +#include "crypto/md32_common.h" #define P0(X) (X ^ ROTATE(X, 9) ^ ROTATE(X, 17)) #define P1(X) (X ^ ROTATE(X, 15) ^ ROTATE(X, 23)) diff --git a/crypto/sm4/sm4.c b/crypto/sm4/sm4.c index c0454d13..a62993c2 100644 --- a/crypto/sm4/sm4.c +++ b/crypto/sm4/sm4.c @@ -10,7 +10,7 @@ */ #include -#include "internal/sm4.h" +#include "crypto/sm4.h" static const uint8_t SM4_S[256] = { 0xD6, 0x90, 0xE9, 0xFE, 0xCC, 0xE1, 0x3D, 0xB7, 0x16, 0xB6, 0x14, 0xC2, diff --git a/crypto/sparc_arch.h b/crypto/sparc_arch.h index 4207afea..f57f0e14 100644 --- a/crypto/sparc_arch.h +++ b/crypto/sparc_arch.h @@ -7,8 +7,8 @@ * https://www.openssl.org/source/license.html */ -#ifndef __SPARC_ARCH_H__ -# define __SPARC_ARCH_H__ +#ifndef OSSL_CRYPTO_SPARC_ARCH_H +# define OSSL_CRYPTO_SPARC_ARCH_H # define SPARCV9_TICK_PRIVILEGED (1<<0) # define SPARCV9_PREFER_FPU (1<<1) @@ -115,4 +115,4 @@ mov tmp, %o7; # endif -#endif /* __SPARC_ARCH_H__ */ +#endif /* OSSL_CRYPTO_SPARC_ARCH_H */ diff --git a/crypto/sparse_array.c b/crypto/sparse_array.c index a74db5d2..9d444739 100644 --- a/crypto/sparse_array.c +++ b/crypto/sparse_array.c @@ -10,7 +10,7 @@ #include #include -#include "internal/sparse_array.h" +#include "crypto/sparse_array.h" /* * How many bits are used to index each level in the tree structure? diff --git a/crypto/srp/srp_lib.c b/crypto/srp/srp_lib.c index 8cba189e..99511954 100644 --- a/crypto/srp/srp_lib.c +++ b/crypto/srp/srp_lib.c @@ -16,7 +16,7 @@ # include # include # include -# include "internal/bn_srp.h" +# include "crypto/bn_srp.h" /* calculate = SHA1(PAD(x) || PAD(y)) */ diff --git a/crypto/srp/srp_vfy.c b/crypto/srp/srp_vfy.c index 79e76c9a..c4dd5153 100644 --- a/crypto/srp/srp_vfy.c +++ b/crypto/srp/srp_vfy.c @@ -13,7 +13,7 @@ #ifndef OPENSSL_NO_SRP # include "internal/cryptlib.h" -# include "internal/evp_int.h" +# include "crypto/evp.h" # include # include # include diff --git a/crypto/stack/build.info b/crypto/stack/build.info index e4183e08..23d83a6f 100644 --- a/crypto/stack/build.info +++ b/crypto/stack/build.info @@ -1,3 +1,3 @@ LIBS=../../libcrypto SOURCE[../../libcrypto]=stack.c -SOURCE[../../providers/fips]=stack.c +SOURCE[../../providers/libfips.a]=stack.c diff --git a/crypto/store/loader_file.c b/crypto/store/loader_file.c index 206af12a..078c7c25 100644 --- a/crypto/store/loader_file.c +++ b/crypto/store/loader_file.c @@ -24,12 +24,12 @@ #include #include #include /* For the PKCS8 stuff o.O */ -#include "internal/asn1_int.h" -#include "internal/ctype.h" +#include "crypto/asn1.h" +#include "crypto/ctype.h" #include "internal/o_dir.h" #include "internal/cryptlib.h" -#include "internal/store_int.h" -#include "store_locl.h" +#include "crypto/store.h" +#include "store_local.h" #ifdef _WIN32 # define stat _stat diff --git a/crypto/store/store_init.c b/crypto/store/store_init.c index db050c07..e1b953fb 100644 --- a/crypto/store/store_init.c +++ b/crypto/store/store_init.c @@ -8,8 +8,8 @@ */ #include -#include "internal/store.h" -#include "store_locl.h" +#include "crypto/store.h" +#include "store_local.h" static CRYPTO_ONCE store_init = CRYPTO_ONCE_STATIC_INIT; DEFINE_RUN_ONCE_STATIC(do_store_init) diff --git a/crypto/store/store_lib.c b/crypto/store/store_lib.c index 8c55c431..92b957c7 100644 --- a/crypto/store/store_lib.c +++ b/crypto/store/store_lib.c @@ -18,8 +18,8 @@ #include #include #include "internal/thread_once.h" -#include "internal/store_int.h" -#include "store_locl.h" +#include "crypto/store.h" +#include "store_local.h" struct ossl_store_ctx_st { const OSSL_STORE_LOADER *loader; diff --git a/crypto/store/store_locl.h b/crypto/store/store_local.h similarity index 100% rename from crypto/store/store_locl.h rename to crypto/store/store_local.h diff --git a/crypto/store/store_register.c b/crypto/store/store_register.c index 3022e368..399ec8c6 100644 --- a/crypto/store/store_register.c +++ b/crypto/store/store_register.c @@ -8,12 +8,12 @@ */ #include -#include "internal/ctype.h" +#include "crypto/ctype.h" #include #include #include -#include "store_locl.h" +#include "store_local.h" static CRYPTO_RWLOCK *registry_lock; static CRYPTO_ONCE registry_init = CRYPTO_ONCE_STATIC_INIT; diff --git a/crypto/trace.c b/crypto/trace.c index cc99fff3..7ff6af88 100755 --- a/crypto/trace.c +++ b/crypto/trace.c @@ -16,7 +16,7 @@ #include #include "internal/bio.h" #include "internal/nelem.h" -#include "internal/cryptlib_int.h" +#include "crypto/cryptlib.h" #include "e_os.h" /* strcasecmp for Windows */ diff --git a/crypto/ts/ts_asn1.c b/crypto/ts/ts_asn1.c index 52ac2aaa..49f92b22 100644 --- a/crypto/ts/ts_asn1.c +++ b/crypto/ts/ts_asn1.c @@ -10,7 +10,7 @@ #include #include #include -#include "ts_lcl.h" +#include "ts_local.h" ASN1_SEQUENCE(TS_MSG_IMPRINT) = { ASN1_SIMPLE(TS_MSG_IMPRINT, hash_algo, X509_ALGOR), diff --git a/crypto/ts/ts_conf.c b/crypto/ts/ts_conf.c index 403e098d..4117ccdd 100644 --- a/crypto/ts/ts_conf.c +++ b/crypto/ts/ts_conf.c @@ -283,9 +283,10 @@ int TS_CONF_set_def_policy(CONF *conf, const char *section, { int ret = 0; ASN1_OBJECT *policy_obj = NULL; - if (!policy) + + if (policy == NULL) policy = NCONF_get_string(conf, section, ENV_DEFAULT_POLICY); - if (!policy) { + if (policy == NULL) { ts_CONF_lookup_fail(section, ENV_DEFAULT_POLICY); goto err; } diff --git a/crypto/ts/ts_lib.c b/crypto/ts/ts_lib.c index 5c1e15ab..5a99c9df 100644 --- a/crypto/ts/ts_lib.c +++ b/crypto/ts/ts_lib.c @@ -14,7 +14,7 @@ #include #include #include -#include "ts_lcl.h" +#include "ts_local.h" int TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num) { diff --git a/crypto/ts/ts_lcl.h b/crypto/ts/ts_local.h similarity index 100% rename from crypto/ts/ts_lcl.h rename to crypto/ts/ts_local.h diff --git a/crypto/ts/ts_req_print.c b/crypto/ts/ts_req_print.c index d1c4e6a4..968816ae 100644 --- a/crypto/ts/ts_req_print.c +++ b/crypto/ts/ts_req_print.c @@ -13,7 +13,7 @@ #include #include #include -#include "ts_lcl.h" +#include "ts_local.h" int TS_REQ_print_bio(BIO *bio, TS_REQ *a) { diff --git a/crypto/ts/ts_req_utils.c b/crypto/ts/ts_req_utils.c index 6e90a598..8b950979 100644 --- a/crypto/ts/ts_req_utils.c +++ b/crypto/ts/ts_req_utils.c @@ -12,7 +12,7 @@ #include #include #include -#include "ts_lcl.h" +#include "ts_local.h" int TS_REQ_set_version(TS_REQ *a, long version) { diff --git a/crypto/ts/ts_rsp_print.c b/crypto/ts/ts_rsp_print.c index 9827c206..8593e2d9 100644 --- a/crypto/ts/ts_rsp_print.c +++ b/crypto/ts/ts_rsp_print.c @@ -13,7 +13,7 @@ #include #include #include -#include "ts_lcl.h" +#include "ts_local.h" struct status_map_st { int bit; diff --git a/crypto/ts/ts_rsp_sign.c b/crypto/ts/ts_rsp_sign.c index 7791fc73..ed0979e5 100644 --- a/crypto/ts/ts_rsp_sign.c +++ b/crypto/ts/ts_rsp_sign.c @@ -14,8 +14,8 @@ #include #include #include -#include "ts_lcl.h" -#include "internal/ess_int.h" +#include "ts_local.h" +#include "crypto/ess.h" static ASN1_INTEGER *def_serial_cb(struct TS_resp_ctx *, void *); static int def_time_cb(struct TS_resp_ctx *, void *, long *sec, long *usec); @@ -505,7 +505,7 @@ static ASN1_OBJECT *ts_RESP_get_policy(TS_RESP_CTX *ctx) if (!OBJ_cmp(requested, current)) policy = current; } - if (!policy) { + if (policy == NULL) { TSerr(TS_F_TS_RESP_GET_POLICY, TS_R_UNACCEPTABLE_POLICY); TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, "Requested policy is not " "supported."); diff --git a/crypto/ts/ts_rsp_utils.c b/crypto/ts/ts_rsp_utils.c index 8e4bed2d..6017e8d1 100644 --- a/crypto/ts/ts_rsp_utils.c +++ b/crypto/ts/ts_rsp_utils.c @@ -12,7 +12,7 @@ #include #include #include -#include "ts_lcl.h" +#include "ts_local.h" int TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *status_info) { diff --git a/crypto/ts/ts_rsp_verify.c b/crypto/ts/ts_rsp_verify.c index e658354e..7d2161f2 100644 --- a/crypto/ts/ts_rsp_verify.c +++ b/crypto/ts/ts_rsp_verify.c @@ -12,8 +12,8 @@ #include #include #include -#include "ts_lcl.h" -#include "internal/ess_int.h" +#include "ts_local.h" +#include "crypto/ess.h" static int ts_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted, X509 *signer, STACK_OF(X509) **chain); diff --git a/crypto/ts/ts_verify_ctx.c b/crypto/ts/ts_verify_ctx.c index 9ff91da2..3c834013 100644 --- a/crypto/ts/ts_verify_ctx.c +++ b/crypto/ts/ts_verify_ctx.c @@ -10,7 +10,7 @@ #include "internal/cryptlib.h" #include #include -#include "ts_lcl.h" +#include "ts_local.h" TS_VERIFY_CTX *TS_VERIFY_CTX_new(void) { @@ -60,7 +60,7 @@ X509_STORE *TS_VERIFY_CTX_set_store(TS_VERIFY_CTX *ctx, X509_STORE *s) return ctx->store; } -STACK_OF(X509) *TS_VERIFY_CTS_set_certs(TS_VERIFY_CTX *ctx, +STACK_OF(X509) *TS_VERIFY_CTX_set_certs(TS_VERIFY_CTX *ctx, STACK_OF(X509) *certs) { ctx->certs = certs; diff --git a/crypto/ui/ui_lib.c b/crypto/ui/ui_lib.c index d0393511..ab51a24a 100644 --- a/crypto/ui/ui_lib.c +++ b/crypto/ui/ui_lib.c @@ -13,7 +13,7 @@ #include #include #include -#include "ui_locl.h" +#include "ui_local.h" UI *UI_new(void) { diff --git a/crypto/ui/ui_locl.h b/crypto/ui/ui_local.h similarity index 98% rename from crypto/ui/ui_locl.h rename to crypto/ui/ui_local.h index 6506cba5..36b3e619 100644 --- a/crypto/ui/ui_locl.h +++ b/crypto/ui/ui_local.h @@ -7,8 +7,8 @@ * https://www.openssl.org/source/license.html */ -#ifndef HEADER_UI_LOCL_H -# define HEADER_UI_LOCL_H +#ifndef OSSL_CRYPTO_UI_LOCAL_H +# define OSSL_CRYPTO_UI_LOCAL_H # include # include diff --git a/crypto/ui/ui_null.c b/crypto/ui/ui_null.c index 8e500ccc..f002448d 100644 --- a/crypto/ui/ui_null.c +++ b/crypto/ui/ui_null.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -#include "ui_locl.h" +#include "ui_local.h" static const UI_METHOD ui_null = { "OpenSSL NULL UI", diff --git a/crypto/ui/ui_openssl.c b/crypto/ui/ui_openssl.c index 52c675a1..cf873431 100644 --- a/crypto/ui/ui_openssl.c +++ b/crypto/ui/ui_openssl.c @@ -49,7 +49,7 @@ # endif # endif -# include "ui_locl.h" +# include "ui_local.h" # include "internal/cryptlib.h" # ifdef OPENSSL_SYS_VMS /* prototypes for sys$whatever */ diff --git a/crypto/ui/ui_util.c b/crypto/ui/ui_util.c index c49fb726..b28c1332 100644 --- a/crypto/ui/ui_util.c +++ b/crypto/ui/ui_util.c @@ -9,7 +9,7 @@ #include #include "internal/thread_once.h" -#include "ui_locl.h" +#include "ui_local.h" #ifndef BUFSIZ #define BUFSIZ 256 diff --git a/crypto/whrlpool/build.info b/crypto/whrlpool/build.info index 3276bd12..6630a779 100644 --- a/crypto/whrlpool/build.info +++ b/crypto/whrlpool/build.info @@ -18,7 +18,11 @@ IF[{- !$disabled{asm} -}] ENDIF SOURCE[../../libcrypto]=wp_dgst.c $WPASM + +# Implementations are now spread across several libraries, so the defines +# need to be applied to all affected libraries and modules. DEFINE[../../libcrypto]=$WPDEF +DEFINE[../../providers/libimplementations.a]=$WPDEF GENERATE[wp-mmx.s]=asm/wp-mmx.pl DEPEND[wp-mmx.s]=../perlasm/x86asm.pl diff --git a/crypto/whrlpool/wp_block.c b/crypto/whrlpool/wp_block.c index c2c0b726..c24f6733 100644 --- a/crypto/whrlpool/wp_block.c +++ b/crypto/whrlpool/wp_block.c @@ -37,7 +37,7 @@ */ #include "internal/cryptlib.h" -#include "wp_locl.h" +#include "wp_local.h" #include typedef unsigned char u8; diff --git a/crypto/whrlpool/wp_dgst.c b/crypto/whrlpool/wp_dgst.c index 49696304..3a4a8093 100644 --- a/crypto/whrlpool/wp_dgst.c +++ b/crypto/whrlpool/wp_dgst.c @@ -53,7 +53,7 @@ */ #include -#include "wp_locl.h" +#include "wp_local.h" #include int WHIRLPOOL_Init(WHIRLPOOL_CTX *c) diff --git a/crypto/whrlpool/wp_locl.h b/crypto/whrlpool/wp_local.h similarity index 100% rename from crypto/whrlpool/wp_locl.h rename to crypto/whrlpool/wp_local.h diff --git a/crypto/x509/by_dir.c b/crypto/x509/by_dir.c index e53b9b44..69950b7d 100644 --- a/crypto/x509/by_dir.c +++ b/crypto/x509/by_dir.c @@ -19,8 +19,8 @@ #endif #include -#include "internal/x509_int.h" -#include "x509_lcl.h" +#include "crypto/x509.h" +#include "x509_local.h" struct lookup_dir_hashes_st { unsigned long hash; @@ -156,7 +156,7 @@ static int add_cert_dir(BY_DIR *ctx, const char *dir, int type) size_t len; const char *s, *ss, *p; - if (dir == NULL || !*dir) { + if (dir == NULL || *dir == '\0') { X509err(X509_F_ADD_CERT_DIR, X509_R_INVALID_DIRECTORY); return 0; } diff --git a/crypto/x509/by_file.c b/crypto/x509/by_file.c index 35d716b9..93a1af87 100644 --- a/crypto/x509/by_file.c +++ b/crypto/x509/by_file.c @@ -15,7 +15,7 @@ #include #include #include -#include "x509_lcl.h" +#include "x509_local.h" static int by_file_ctrl(X509_LOOKUP *ctx, int cmd, const char *argc, long argl, char **ret); diff --git a/crypto/x509/ext_dat.h b/crypto/x509/ext_dat.h index aa6fa797..f48fa1d3 100644 --- a/crypto/x509/ext_dat.h +++ b/crypto/x509/ext_dat.h @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -int name_cmp(const char *name, const char *cmp); +int v3_name_cmp(const char *name, const char *cmp); extern const X509V3_EXT_METHOD v3_bcons, v3_nscert, v3_key_usage, v3_ext_ku; extern const X509V3_EXT_METHOD v3_pkey_usage_period, v3_sxnet, v3_info, v3_sinfo; diff --git a/crypto/x509/pcy_cache.c b/crypto/x509/pcy_cache.c index 21a89e62..e65931e4 100644 --- a/crypto/x509/pcy_cache.c +++ b/crypto/x509/pcy_cache.c @@ -10,9 +10,9 @@ #include "internal/cryptlib.h" #include #include -#include "internal/x509_int.h" +#include "crypto/x509.h" -#include "pcy_int.h" +#include "pcy_local.h" static int policy_data_cmp(const X509_POLICY_DATA *const *a, const X509_POLICY_DATA *const *b); diff --git a/crypto/x509/pcy_data.c b/crypto/x509/pcy_data.c index c1d56bdc..cc3fc201 100644 --- a/crypto/x509/pcy_data.c +++ b/crypto/x509/pcy_data.c @@ -11,7 +11,7 @@ #include #include -#include "pcy_int.h" +#include "pcy_local.h" /* Policy Node routines */ diff --git a/crypto/x509/pcy_lib.c b/crypto/x509/pcy_lib.c index deee8f6c..b392f13b 100644 --- a/crypto/x509/pcy_lib.c +++ b/crypto/x509/pcy_lib.c @@ -11,7 +11,7 @@ #include #include -#include "pcy_int.h" +#include "pcy_local.h" /* accessor functions */ diff --git a/crypto/x509/pcy_int.h b/crypto/x509/pcy_local.h similarity index 100% rename from crypto/x509/pcy_int.h rename to crypto/x509/pcy_local.h diff --git a/crypto/x509/pcy_map.c b/crypto/x509/pcy_map.c index 243d6e2b..258792be 100644 --- a/crypto/x509/pcy_map.c +++ b/crypto/x509/pcy_map.c @@ -10,9 +10,9 @@ #include "internal/cryptlib.h" #include #include -#include "internal/x509_int.h" +#include "crypto/x509.h" -#include "pcy_int.h" +#include "pcy_local.h" /* * Set policy mapping entries in cache. Note: this modifies the passed diff --git a/crypto/x509/pcy_node.c b/crypto/x509/pcy_node.c index 005d1de7..fc06a31c 100644 --- a/crypto/x509/pcy_node.c +++ b/crypto/x509/pcy_node.c @@ -12,7 +12,7 @@ #include #include -#include "pcy_int.h" +#include "pcy_local.h" static int node_cmp(const X509_POLICY_NODE *const *a, const X509_POLICY_NODE *const *b) diff --git a/crypto/x509/pcy_tree.c b/crypto/x509/pcy_tree.c index 5d4c6bd8..8ab09143 100644 --- a/crypto/x509/pcy_tree.c +++ b/crypto/x509/pcy_tree.c @@ -12,7 +12,7 @@ #include #include -#include "pcy_int.h" +#include "pcy_local.h" static void expected_print(BIO *channel, X509_POLICY_LEVEL *lev, X509_POLICY_NODE *node, diff --git a/crypto/x509/t_x509.c b/crypto/x509/t_x509.c index 33672288..4969bb34 100644 --- a/crypto/x509/t_x509.c +++ b/crypto/x509/t_x509.c @@ -14,7 +14,7 @@ #include #include #include -#include "internal/asn1_int.h" +#include "crypto/asn1.h" #ifndef OPENSSL_NO_STDIO int X509_print_fp(FILE *fp, X509 *x) diff --git a/crypto/x509/v3_addr.c b/crypto/x509/v3_addr.c index 9e6bffed..766c5bc1 100644 --- a/crypto/x509/v3_addr.c +++ b/crypto/x509/v3_addr.c @@ -20,7 +20,7 @@ #include #include #include -#include "internal/x509_int.h" +#include "crypto/x509.h" #include "ext_dat.h" #ifndef OPENSSL_NO_RFC3779 @@ -906,14 +906,14 @@ static void *v2i_IPAddrBlocks(const struct v3_ext_method *method, const char *addr_chars = NULL; int prefixlen, i1, i2, delim, length; - if (!name_cmp(val->name, "IPv4")) { + if (!v3_name_cmp(val->name, "IPv4")) { afi = IANA_AFI_IPV4; - } else if (!name_cmp(val->name, "IPv6")) { + } else if (!v3_name_cmp(val->name, "IPv6")) { afi = IANA_AFI_IPV6; - } else if (!name_cmp(val->name, "IPv4-SAFI")) { + } else if (!v3_name_cmp(val->name, "IPv4-SAFI")) { afi = IANA_AFI_IPV4; safi = &safi_; - } else if (!name_cmp(val->name, "IPv6-SAFI")) { + } else if (!v3_name_cmp(val->name, "IPv6-SAFI")) { afi = IANA_AFI_IPV6; safi = &safi_; } else { diff --git a/crypto/x509/v3_admis.c b/crypto/x509/v3_admis.c index d6e4bc41..104b58f2 100644 --- a/crypto/x509/v3_admis.c +++ b/crypto/x509/v3_admis.c @@ -9,7 +9,7 @@ #include #include "internal/cryptlib.h" #include -#include +#include #include #include diff --git a/crypto/x509/v3_admis.h b/crypto/x509/v3_admis.h index 9d1535c3..1e82c0f4 100644 --- a/crypto/x509/v3_admis.h +++ b/crypto/x509/v3_admis.h @@ -7,8 +7,8 @@ * https://www.openssl.org/source/license.html */ -#ifndef HEADER_V3_ADMISSION_H -# define HEADER_V3_ADMISSION_H +#ifndef OSSL_CRYPTO_X509_V3_ADMIS_H +# define OSSL_CRYPTO_X509_V3_ADMIS_H struct NamingAuthority_st { ASN1_OBJECT* namingAuthorityId; diff --git a/crypto/x509/v3_alt.c b/crypto/x509/v3_alt.c index af1cd61a..5d1ece71 100644 --- a/crypto/x509/v3_alt.c +++ b/crypto/x509/v3_alt.c @@ -252,7 +252,7 @@ static GENERAL_NAMES *v2i_issuer_alt(X509V3_EXT_METHOD *method, for (i = 0; i < num; i++) { CONF_VALUE *cnf = sk_CONF_VALUE_value(nval, i); - if (!name_cmp(cnf->name, "issuer") + if (!v3_name_cmp(cnf->name, "issuer") && cnf->value && strcmp(cnf->value, "copy") == 0) { if (!copy_issuer(ctx, gens)) goto err; @@ -331,11 +331,11 @@ static GENERAL_NAMES *v2i_subject_alt(X509V3_EXT_METHOD *method, for (i = 0; i < num; i++) { cnf = sk_CONF_VALUE_value(nval, i); - if (!name_cmp(cnf->name, "email") + if (!v3_name_cmp(cnf->name, "email") && cnf->value && strcmp(cnf->value, "copy") == 0) { if (!copy_email(ctx, gens, 0)) goto err; - } else if (!name_cmp(cnf->name, "email") + } else if (!v3_name_cmp(cnf->name, "email") && cnf->value && strcmp(cnf->value, "move") == 0) { if (!copy_email(ctx, gens, 1)) goto err; @@ -551,19 +551,19 @@ GENERAL_NAME *v2i_GENERAL_NAME_ex(GENERAL_NAME *out, return NULL; } - if (!name_cmp(name, "email")) + if (!v3_name_cmp(name, "email")) type = GEN_EMAIL; - else if (!name_cmp(name, "URI")) + else if (!v3_name_cmp(name, "URI")) type = GEN_URI; - else if (!name_cmp(name, "DNS")) + else if (!v3_name_cmp(name, "DNS")) type = GEN_DNS; - else if (!name_cmp(name, "RID")) + else if (!v3_name_cmp(name, "RID")) type = GEN_RID; - else if (!name_cmp(name, "IP")) + else if (!v3_name_cmp(name, "IP")) type = GEN_IPADD; - else if (!name_cmp(name, "dirName")) + else if (!v3_name_cmp(name, "dirName")) type = GEN_DIRNAME; - else if (!name_cmp(name, "otherName")) + else if (!v3_name_cmp(name, "otherName")) type = GEN_OTHERNAME; else { X509V3err(X509V3_F_V2I_GENERAL_NAME_EX, X509V3_R_UNSUPPORTED_OPTION); diff --git a/crypto/x509/v3_asid.c b/crypto/x509/v3_asid.c index 22876750..6cb5cd55 100644 --- a/crypto/x509/v3_asid.c +++ b/crypto/x509/v3_asid.c @@ -20,7 +20,7 @@ #include #include #include -#include "internal/x509_int.h" +#include "crypto/x509.h" #include #include "ext_dat.h" @@ -534,9 +534,9 @@ static void *v2i_ASIdentifiers(const struct v3_ext_method *method, /* * Figure out whether this is an AS or an RDI. */ - if (!name_cmp(val->name, "AS")) { + if (!v3_name_cmp(val->name, "AS")) { which = V3_ASID_ASNUM; - } else if (!name_cmp(val->name, "RDI")) { + } else if (!v3_name_cmp(val->name, "RDI")) { which = V3_ASID_RDI; } else { X509V3err(X509V3_F_V2I_ASIDENTIFIERS, diff --git a/crypto/x509/v3_conf.c b/crypto/x509/v3_conf.c index b7b74c4f..47b1cfc9 100644 --- a/crypto/x509/v3_conf.c +++ b/crypto/x509/v3_conf.c @@ -10,11 +10,11 @@ /* extension creation utilities */ #include -#include "internal/ctype.h" +#include "crypto/ctype.h" #include "internal/cryptlib.h" #include #include -#include "internal/x509_int.h" +#include "crypto/x509.h" #include static int v3_check_critical(const char **value); diff --git a/crypto/x509/v3_cpols.c b/crypto/x509/v3_cpols.c index 595de623..470088c9 100644 --- a/crypto/x509/v3_cpols.c +++ b/crypto/x509/v3_cpols.c @@ -14,7 +14,7 @@ #include #include -#include "pcy_int.h" +#include "pcy_local.h" #include "ext_dat.h" /* Certificate policies extension support: this one is a bit complex... */ @@ -124,8 +124,9 @@ static STACK_OF(POLICYINFO) *r2i_certpol(X509V3_EXT_METHOD *method, continue; } else if (*pstr == '@') { STACK_OF(CONF_VALUE) *polsect; + polsect = X509V3_get_section(ctx, pstr + 1); - if (!polsect) { + if (polsect == NULL) { X509V3err(X509V3_F_R2I_CERTPOL, X509V3_R_INVALID_SECTION); X509V3_conf_err(cnf); @@ -186,7 +187,7 @@ static POLICYINFO *policy_section(X509V3_CTX *ctx, } pol->policyid = pobj; - } else if (!name_cmp(cnf->name, "CPS")) { + } else if (!v3_name_cmp(cnf->name, "CPS")) { if (pol->qualifiers == NULL) pol->qualifiers = sk_POLICYQUALINFO_new_null(); if ((qual = POLICYQUALINFO_new()) == NULL) @@ -202,7 +203,7 @@ static POLICYINFO *policy_section(X509V3_CTX *ctx, if (!ASN1_STRING_set(qual->d.cpsuri, cnf->value, strlen(cnf->value))) goto merr; - } else if (!name_cmp(cnf->name, "userNotice")) { + } else if (!v3_name_cmp(cnf->name, "userNotice")) { STACK_OF(CONF_VALUE) *unot; if (*cnf->value != '@') { X509V3err(X509V3_F_POLICY_SECTION, @@ -221,7 +222,7 @@ static POLICYINFO *policy_section(X509V3_CTX *ctx, X509V3_section_free(ctx, unot); if (!qual) goto err; - if (!pol->qualifiers) + if (pol->qualifiers == NULL) pol->qualifiers = sk_POLICYQUALINFO_new_null(); if (!sk_POLICYQUALINFO_push(pol->qualifiers, qual)) goto merr; @@ -232,7 +233,7 @@ static POLICYINFO *policy_section(X509V3_CTX *ctx, goto err; } } - if (!pol->policyid) { + if (pol->policyid == NULL) { X509V3err(X509V3_F_POLICY_SECTION, X509V3_R_NO_POLICY_IDENTIFIER); goto err; } diff --git a/crypto/x509/v3_crld.c b/crypto/x509/v3_crld.c index 766bf0e5..4b60752a 100644 --- a/crypto/x509/v3_crld.c +++ b/crypto/x509/v3_crld.c @@ -14,7 +14,7 @@ #include #include -#include "internal/x509_int.h" +#include "crypto/x509.h" #include "ext_dat.h" static void *v2i_crld(const X509V3_EXT_METHOD *method, @@ -168,7 +168,7 @@ static int set_reasons(ASN1_BIT_STRING **preas, char *value) break; } } - if (!pbn->lname) + if (pbn->lname == NULL) goto err; } ret = 1; @@ -222,7 +222,7 @@ static DIST_POINT *crldp_from_section(X509V3_CTX *ctx, goto err; } else if (strcmp(cnf->name, "CRLissuer") == 0) { point->CRLissuer = gnames_from_sectname(ctx, cnf->value); - if (!point->CRLissuer) + if (point->CRLissuer == NULL) goto err; } } @@ -258,7 +258,7 @@ static void *v2i_crld(const X509V3_EXT_METHOD *method, goto err; point = crldp_from_section(ctx, dpsect); X509V3_section_free(ctx, dpsect); - if (!point) + if (point == NULL) goto err; sk_DIST_POINT_push(crld, point); /* no failure as it was reserved */ } else { diff --git a/crypto/x509/v3_info.c b/crypto/x509/v3_info.c index 0b97c966..c50cfd1f 100644 --- a/crypto/x509/v3_info.c +++ b/crypto/x509/v3_info.c @@ -123,7 +123,7 @@ static AUTHORITY_INFO_ACCESS *v2i_AUTHORITY_INFO_ACCESS(X509V3_EXT_METHOD } sk_ACCESS_DESCRIPTION_push(ainfo, acc); /* Cannot fail due to reserve */ ptmp = strchr(cnf->name, ';'); - if (!ptmp) { + if (ptmp == NULL) { X509V3err(X509V3_F_V2I_AUTHORITY_INFO_ACCESS, X509V3_R_INVALID_SYNTAX); goto err; diff --git a/crypto/x509/v3_ncons.c b/crypto/x509/v3_ncons.c index 9a8ca166..927aa8f9 100644 --- a/crypto/x509/v3_ncons.c +++ b/crypto/x509/v3_ncons.c @@ -10,13 +10,13 @@ #include "internal/cryptlib.h" #include "internal/numbers.h" #include -#include "internal/asn1_int.h" +#include "crypto/asn1.h" #include #include #include #include -#include "internal/x509_int.h" +#include "crypto/x509.h" #include "ext_dat.h" static void *v2i_NAME_CONSTRAINTS(const X509V3_EXT_METHOD *method, @@ -561,8 +561,9 @@ static int nc_dns(ASN1_IA5STRING *dns, ASN1_IA5STRING *base) { char *baseptr = (char *)base->data; char *dnsptr = (char *)dns->data; + /* Empty matches everything */ - if (!*baseptr) + if (*baseptr == '\0') return X509_V_OK; /* * Otherwise can add zero or more components on the left so compare RHS @@ -628,8 +629,9 @@ static int nc_uri(ASN1_IA5STRING *uri, ASN1_IA5STRING *base) const char *hostptr = (char *)uri->data; const char *p = strchr(hostptr, ':'); int hostlen; + /* Check for foo:// and skip past it */ - if (!p || (p[1] != '/') || (p[2] != '/')) + if (p == NULL || p[1] != '/' || p[2] != '/') return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX; hostptr = p + 3; @@ -639,10 +641,10 @@ static int nc_uri(ASN1_IA5STRING *uri, ASN1_IA5STRING *base) p = strchr(hostptr, ':'); /* Otherwise look for trailing slash */ - if (!p) + if (p == NULL) p = strchr(hostptr, '/'); - if (!p) + if (p == NULL) hostlen = strlen(hostptr); else hostlen = p - hostptr; diff --git a/crypto/x509/v3_pci.c b/crypto/x509/v3_pci.c index 856b70d9..fb5f35a5 100644 --- a/crypto/x509/v3_pci.c +++ b/crypto/x509/v3_pci.c @@ -116,7 +116,8 @@ static int process_pci_value(CONF_VALUE *val, } else if (strcmp(val->name, "policy") == 0) { unsigned char *tmp_data = NULL; long val_len; - if (!*policy) { + + if (*policy == NULL) { *policy = ASN1_OCTET_STRING_new(); if (*policy == NULL) { X509V3err(X509V3_F_PROCESS_PCI_VALUE, ERR_R_MALLOC_FAILURE); diff --git a/crypto/x509/v3_pcons.c b/crypto/x509/v3_pcons.c index e6d50a6f..33c08cfd 100644 --- a/crypto/x509/v3_pcons.c +++ b/crypto/x509/v3_pcons.c @@ -78,7 +78,8 @@ static void *v2i_POLICY_CONSTRAINTS(const X509V3_EXT_METHOD *method, goto err; } } - if (!pcons->inhibitPolicyMapping && !pcons->requireExplicitPolicy) { + if (pcons->inhibitPolicyMapping == NULL + && pcons->requireExplicitPolicy == NULL) { X509V3err(X509V3_F_V2I_POLICY_CONSTRAINTS, X509V3_R_ILLEGAL_EMPTY_EXTENSION); goto err; diff --git a/crypto/x509/v3_purp.c b/crypto/x509/v3_purp.c index 40f976bd..10fd0f73 100644 --- a/crypto/x509/v3_purp.c +++ b/crypto/x509/v3_purp.c @@ -12,7 +12,7 @@ #include "internal/numbers.h" #include #include -#include "internal/x509_int.h" +#include "crypto/x509.h" #include "internal/tsan_assist.h" static void x509v3_cache_extensions(X509 *x); @@ -178,7 +178,7 @@ int X509_PURPOSE_add(int id, int trust, int flags, /* dup supplied name */ ptmp->name = OPENSSL_strdup(name); ptmp->sname = OPENSSL_strdup(sname); - if (!ptmp->name || !ptmp->sname) { + if (ptmp->name == NULL|| ptmp->sname == NULL) { X509V3err(X509V3_F_X509_PURPOSE_ADD, ERR_R_MALLOC_FAILURE); goto err; } @@ -216,7 +216,7 @@ int X509_PURPOSE_add(int id, int trust, int flags, static void xptable_free(X509_PURPOSE *p) { - if (!p) + if (p == NULL) return; if (p->flags & X509_PURPOSE_DYNAMIC) { if (p->flags & X509_PURPOSE_DYNAMIC_NAME) { diff --git a/crypto/x509/v3_skey.c b/crypto/x509/v3_skey.c index f8a780d9..c69975f6 100644 --- a/crypto/x509/v3_skey.c +++ b/crypto/x509/v3_skey.c @@ -10,7 +10,7 @@ #include #include "internal/cryptlib.h" #include -#include "internal/x509_int.h" +#include "crypto/x509.h" #include "ext_dat.h" static ASN1_OCTET_STRING *s2i_skey_id(X509V3_EXT_METHOD *method, diff --git a/crypto/x509/v3_sxnet.c b/crypto/x509/v3_sxnet.c index ddb2a031..072b8efe 100644 --- a/crypto/x509/v3_sxnet.c +++ b/crypto/x509/v3_sxnet.c @@ -139,7 +139,8 @@ int SXNET_add_id_INTEGER(SXNET **psx, ASN1_INTEGER *zone, const char *user, { SXNET *sx = NULL; SXNETID *id = NULL; - if (!psx || !zone || !user) { + + if (psx == NULL || zone == NULL || user == NULL) { X509V3err(X509V3_F_SXNET_ADD_ID_INTEGER, X509V3_R_INVALID_NULL_ARGUMENT); return 0; diff --git a/crypto/x509/v3_utl.c b/crypto/x509/v3_utl.c index 24f50a13..19b552c3 100644 --- a/crypto/x509/v3_utl.c +++ b/crypto/x509/v3_utl.c @@ -12,11 +12,11 @@ #include "e_os.h" #include "internal/cryptlib.h" #include -#include "internal/ctype.h" +#include "crypto/ctype.h" #include #include #include -#include "internal/x509_int.h" +#include "crypto/x509.h" #include #include "ext_dat.h" @@ -380,14 +380,14 @@ static char *strip_spaces(char *name) p = name; while (*p && ossl_isspace(*p)) p++; - if (!*p) + if (*p == '\0') return NULL; q = p + strlen(p) - 1; while ((q != p) && ossl_isspace(*q)) q--; if (p != q) q[1] = 0; - if (!*p) + if (*p == '\0') return NULL; return p; } @@ -397,7 +397,7 @@ static char *strip_spaces(char *name) * V2I name comparison function: returns zero if 'name' matches cmp or cmp.* */ -int name_cmp(const char *name, const char *cmp) +int v3_name_cmp(const char *name, const char *cmp) { int len, ret; char c; @@ -989,11 +989,12 @@ ASN1_OCTET_STRING *a2i_IPADDRESS_NC(const char *ipasc) unsigned char ipout[32]; char *iptmp = NULL, *p; int iplen1, iplen2; + p = strchr(ipasc, '/'); - if (!p) + if (p == NULL) return NULL; iptmp = OPENSSL_strdup(ipasc); - if (!iptmp) + if (iptmp == NULL) return NULL; p = iptmp + (p - ipasc); *p++ = 0; diff --git a/crypto/x509/x509_att.c b/crypto/x509/x509_att.c index 317a45a4..c8b2d0f8 100644 --- a/crypto/x509/x509_att.c +++ b/crypto/x509/x509_att.c @@ -15,7 +15,7 @@ #include #include #include -#include "x509_lcl.h" +#include "x509_local.h" int X509at_get_attr_count(const STACK_OF(X509_ATTRIBUTE) *x) { diff --git a/crypto/x509/x509_cmp.c b/crypto/x509/x509_cmp.c index d7bbbc19..b8a61ffe 100644 --- a/crypto/x509/x509_cmp.c +++ b/crypto/x509/x509_cmp.c @@ -13,7 +13,8 @@ #include #include #include -#include "internal/x509_int.h" +#include +#include "crypto/x509.h" int X509_issuer_and_serial_cmp(const X509 *a, const X509 *b) { @@ -205,23 +206,26 @@ unsigned long X509_NAME_hash(X509_NAME *x) unsigned long X509_NAME_hash_old(X509_NAME *x) { + EVP_MD *md5 = EVP_MD_fetch(NULL, OSSL_DIGEST_NAME_MD5, "-fips"); EVP_MD_CTX *md_ctx = EVP_MD_CTX_new(); unsigned long ret = 0; unsigned char md[16]; - if (md_ctx == NULL) - return ret; + if (md5 == NULL || md_ctx == NULL) + goto end; /* Make sure X509_NAME structure contains valid cached encoding */ i2d_X509_NAME(x, NULL); - EVP_MD_CTX_set_flags(md_ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW); - if (EVP_DigestInit_ex(md_ctx, EVP_md5(), NULL) + if (EVP_DigestInit_ex(md_ctx, md5, NULL) && EVP_DigestUpdate(md_ctx, x->bytes->data, x->bytes->length) && EVP_DigestFinal_ex(md_ctx, md, NULL)) ret = (((unsigned long)md[0]) | ((unsigned long)md[1] << 8L) | ((unsigned long)md[2] << 16L) | ((unsigned long)md[3] << 24L) ) & 0xffffffffL; + + end: EVP_MD_CTX_free(md_ctx); + EVP_MD_free(md5); return ret; } diff --git a/crypto/x509/x509_ext.c b/crypto/x509/x509_ext.c index e13be607..a7b85857 100644 --- a/crypto/x509/x509_ext.c +++ b/crypto/x509/x509_ext.c @@ -13,7 +13,7 @@ #include #include #include -#include "internal/x509_int.h" +#include "crypto/x509.h" #include int X509_CRL_get_ext_count(const X509_CRL *x) diff --git a/crypto/x509/x509_lcl.h b/crypto/x509/x509_local.h similarity index 100% rename from crypto/x509/x509_lcl.h rename to crypto/x509/x509_local.h diff --git a/crypto/x509/x509_lu.c b/crypto/x509/x509_lu.c index c81a00e0..016b4b30 100644 --- a/crypto/x509/x509_lu.c +++ b/crypto/x509/x509_lu.c @@ -11,9 +11,9 @@ #include "internal/cryptlib.h" #include "internal/refcount.h" #include -#include "internal/x509_int.h" +#include "crypto/x509.h" #include -#include "x509_lcl.h" +#include "x509_local.h" X509_LOOKUP *X509_LOOKUP_new(X509_LOOKUP_METHOD *method) { diff --git a/crypto/x509/x509_meth.c b/crypto/x509/x509_meth.c index 631cc8f0..05e7f7e2 100644 --- a/crypto/x509/x509_meth.c +++ b/crypto/x509/x509_meth.c @@ -14,8 +14,8 @@ #include "internal/cryptlib.h" #include #include -#include -#include "x509_lcl.h" +#include +#include "x509_local.h" X509_LOOKUP_METHOD *X509_LOOKUP_meth_new(const char *name) { diff --git a/crypto/x509/x509_obj.c b/crypto/x509/x509_obj.c index cb16de1f..9d8f48d2 100644 --- a/crypto/x509/x509_obj.c +++ b/crypto/x509/x509_obj.c @@ -12,7 +12,7 @@ #include #include #include -#include "internal/x509_int.h" +#include "crypto/x509.h" /* * Limit to ensure we don't overflow: much greater than diff --git a/crypto/x509/x509_r2x.c b/crypto/x509/x509_r2x.c index c45043a7..d7dd3754 100644 --- a/crypto/x509/x509_r2x.c +++ b/crypto/x509/x509_r2x.c @@ -13,7 +13,7 @@ #include #include #include -#include "internal/x509_int.h" +#include "crypto/x509.h" #include #include diff --git a/crypto/x509/x509_req.c b/crypto/x509/x509_req.c index b0176bc9..9382f37a 100644 --- a/crypto/x509/x509_req.c +++ b/crypto/x509/x509_req.c @@ -14,7 +14,7 @@ #include #include #include -#include "internal/x509_int.h" +#include "crypto/x509.h" #include #include #include diff --git a/crypto/x509/x509_set.c b/crypto/x509/x509_set.c index 3dfe6644..e325a57b 100644 --- a/crypto/x509/x509_set.c +++ b/crypto/x509/x509_set.c @@ -15,9 +15,9 @@ #include #include #include -#include "internal/asn1_int.h" -#include "internal/x509_int.h" -#include "x509_lcl.h" +#include "crypto/asn1.h" +#include "crypto/x509.h" +#include "x509_local.h" int X509_set_version(X509 *x, long version) { diff --git a/crypto/x509/x509_trs.c b/crypto/x509/x509_trs.c index 2347e559..b077ba58 100644 --- a/crypto/x509/x509_trs.c +++ b/crypto/x509/x509_trs.c @@ -10,7 +10,7 @@ #include #include "internal/cryptlib.h" #include -#include "internal/x509_int.h" +#include "crypto/x509.h" static int tr_cmp(const X509_TRUST *const *a, const X509_TRUST *const *b); static void trtable_free(X509_TRUST *p); @@ -184,7 +184,7 @@ int X509_TRUST_add(int id, int flags, int (*ck) (X509_TRUST *, X509 *, int), static void trtable_free(X509_TRUST *p) { - if (!p) + if (p == NULL) return; if (p->flags & X509_TRUST_DYNAMIC) { if (p->flags & X509_TRUST_DYNAMIC_NAME) diff --git a/crypto/x509/x509_v3.c b/crypto/x509/x509_v3.c index 68da09b8..715c3594 100644 --- a/crypto/x509/x509_v3.c +++ b/crypto/x509/x509_v3.c @@ -15,7 +15,7 @@ #include #include #include -#include "x509_lcl.h" +#include "x509_local.h" int X509v3_get_ext_count(const STACK_OF(X509_EXTENSION) *x) { diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index f337cd14..1e2e4cd5 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -12,7 +12,7 @@ #include #include -#include "internal/ctype.h" +#include "crypto/ctype.h" #include "internal/cryptlib.h" #include #include @@ -22,8 +22,8 @@ #include #include #include "internal/dane.h" -#include "internal/x509_int.h" -#include "x509_lcl.h" +#include "crypto/x509.h" +#include "x509_local.h" /* CRL score values */ @@ -2134,10 +2134,10 @@ int X509_STORE_CTX_purpose_inherit(X509_STORE_CTX *ctx, int def_purpose, { int idx; /* If purpose not set use default */ - if (!purpose) + if (purpose == 0) purpose = def_purpose; /* If we have a purpose then check it is valid */ - if (purpose) { + if (purpose != 0) { X509_PURPOSE *ptmp; idx = X509_PURPOSE_get_by_id(purpose); if (idx == -1) { @@ -2502,8 +2502,9 @@ int X509_STORE_CTX_get_num_untrusted(X509_STORE_CTX *ctx) int X509_STORE_CTX_set_default(X509_STORE_CTX *ctx, const char *name) { const X509_VERIFY_PARAM *param; + param = X509_VERIFY_PARAM_lookup(name); - if (!param) + if (param == NULL) return 0; return X509_VERIFY_PARAM_inherit(ctx->param, param); } diff --git a/crypto/x509/x509_vpm.c b/crypto/x509/x509_vpm.c index 5fe0754e..782fa136 100644 --- a/crypto/x509/x509_vpm.c +++ b/crypto/x509/x509_vpm.c @@ -14,9 +14,9 @@ #include #include #include -#include "internal/x509_int.h" +#include "crypto/x509.h" -#include "x509_lcl.h" +#include "x509_local.h" /* X509_VERIFY_PARAM functions */ @@ -332,9 +332,9 @@ void X509_VERIFY_PARAM_set_time(X509_VERIFY_PARAM *param, time_t t) int X509_VERIFY_PARAM_add0_policy(X509_VERIFY_PARAM *param, ASN1_OBJECT *policy) { - if (!param->policies) { + if (param->policies == NULL) { param->policies = sk_ASN1_OBJECT_new_null(); - if (!param->policies) + if (param->policies == NULL) return 0; } if (!sk_ASN1_OBJECT_push(param->policies, policy)) @@ -348,17 +348,17 @@ int X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *param, int i; ASN1_OBJECT *oid, *doid; - if (!param) + if (param == NULL) return 0; sk_ASN1_OBJECT_pop_free(param->policies, ASN1_OBJECT_free); - if (!policies) { + if (policies == NULL) { param->policies = NULL; return 1; } param->policies = sk_ASN1_OBJECT_new_null(); - if (!param->policies) + if (param->policies == NULL) return 0; for (i = 0; i < sk_ASN1_OBJECT_num(policies); i++) { diff --git a/crypto/x509/x509cset.c b/crypto/x509/x509cset.c index ae447aa9..f1992ddc 100644 --- a/crypto/x509/x509cset.c +++ b/crypto/x509/x509cset.c @@ -14,7 +14,7 @@ #include #include #include -#include "internal/x509_int.h" +#include "crypto/x509.h" int X509_CRL_set_version(X509_CRL *x, long version) { diff --git a/crypto/x509/x509name.c b/crypto/x509/x509name.c index bf01450a..443ab42b 100644 --- a/crypto/x509/x509name.c +++ b/crypto/x509/x509name.c @@ -14,7 +14,7 @@ #include #include #include -#include "internal/x509_int.h" +#include "crypto/x509.h" int X509_NAME_get_text_by_NID(X509_NAME *name, int nid, char *buf, int len) { diff --git a/crypto/x509/x509rset.c b/crypto/x509/x509rset.c index 59246631..3256ec23 100644 --- a/crypto/x509/x509rset.c +++ b/crypto/x509/x509rset.c @@ -13,7 +13,7 @@ #include #include #include -#include "internal/x509_int.h" +#include "crypto/x509.h" int X509_REQ_set_version(X509_REQ *x, long version) { diff --git a/crypto/x509/x_all.c b/crypto/x509/x_all.c index 392f47e8..9517169b 100644 --- a/crypto/x509/x_all.c +++ b/crypto/x509/x_all.c @@ -13,7 +13,7 @@ #include #include #include -#include "internal/x509_int.h" +#include "crypto/x509.h" #include #include #include @@ -21,8 +21,8 @@ #ifndef OPENSSL_NO_SM2 -# include "internal/asn1_int.h" -# include "internal/evp_int.h" +# include "crypto/asn1.h" +# include "crypto/evp.h" static int common_verify_sm2(void *data, EVP_PKEY *pkey, int mdnid, int pknid, int req) @@ -607,8 +607,9 @@ int i2d_PKCS8PrivateKeyInfo_fp(FILE *fp, const EVP_PKEY *key) { PKCS8_PRIV_KEY_INFO *p8inf; int ret; + p8inf = EVP_PKEY2PKCS8(key); - if (!p8inf) + if (p8inf == NULL) return 0; ret = i2d_PKCS8_PRIV_KEY_INFO_fp(fp, p8inf); PKCS8_PRIV_KEY_INFO_free(p8inf); @@ -654,8 +655,9 @@ int i2d_PKCS8PrivateKeyInfo_bio(BIO *bp, const EVP_PKEY *key) { PKCS8_PRIV_KEY_INFO *p8inf; int ret; + p8inf = EVP_PKEY2PKCS8(key); - if (!p8inf) + if (p8inf == NULL) return 0; ret = i2d_PKCS8_PRIV_KEY_INFO_bio(bp, p8inf); PKCS8_PRIV_KEY_INFO_free(p8inf); diff --git a/crypto/x509/x_attrib.c b/crypto/x509/x_attrib.c index e39429f2..b3023411 100644 --- a/crypto/x509/x_attrib.c +++ b/crypto/x509/x_attrib.c @@ -12,7 +12,7 @@ #include #include #include -#include "x509_lcl.h" +#include "x509_local.h" /*- * X509_ATTRIBUTE: this has the following form: diff --git a/crypto/x509/x_crl.c b/crypto/x509/x_crl.c index 3984f014..fdc05912 100644 --- a/crypto/x509/x_crl.c +++ b/crypto/x509/x_crl.c @@ -11,9 +11,9 @@ #include "internal/cryptlib.h" #include #include -#include "internal/x509_int.h" +#include "crypto/x509.h" #include -#include "x509_lcl.h" +#include "x509_local.h" static int X509_REVOKED_cmp(const X509_REVOKED *const *a, const X509_REVOKED *const *b); diff --git a/crypto/x509/x_exten.c b/crypto/x509/x_exten.c index 6ed363d3..4e63b50c 100644 --- a/crypto/x509/x_exten.c +++ b/crypto/x509/x_exten.c @@ -11,7 +11,7 @@ #include #include #include -#include "x509_lcl.h" +#include "x509_local.h" ASN1_SEQUENCE(X509_EXTENSION) = { ASN1_SIMPLE(X509_EXTENSION, object, ASN1_OBJECT), diff --git a/crypto/x509/x_name.c b/crypto/x509/x_name.c index 8fd6566b..59d6531b 100644 --- a/crypto/x509/x_name.c +++ b/crypto/x509/x_name.c @@ -8,13 +8,13 @@ */ #include -#include "internal/ctype.h" +#include "crypto/ctype.h" #include "internal/cryptlib.h" #include #include -#include "internal/x509_int.h" -#include "internal/asn1_int.h" -#include "x509_lcl.h" +#include "crypto/x509.h" +#include "crypto/asn1.h" +#include "x509_local.h" /* * Maximum length of X509_NAME: much larger than anything we should @@ -114,7 +114,7 @@ static void x509_name_ex_free(ASN1_VALUE **pval, const ASN1_ITEM *it) { X509_NAME *a; - if (!pval || !*pval) + if (pval == NULL || *pval == NULL) return; a = (X509_NAME *)*pval; @@ -503,9 +503,9 @@ int X509_NAME_print(BIO *bp, const X509_NAME *name, int obase) l = 80 - 2 - obase; b = X509_NAME_oneline(name, NULL, 0); - if (!b) + if (b == NULL) return 0; - if (!*b) { + if (*b == '\0') { OPENSSL_free(b); return 1; } diff --git a/crypto/x509/x_pubkey.c b/crypto/x509/x_pubkey.c index d81f5384..44b08e8b 100644 --- a/crypto/x509/x_pubkey.c +++ b/crypto/x509/x_pubkey.c @@ -11,9 +11,9 @@ #include "internal/cryptlib.h" #include #include -#include "internal/asn1_int.h" -#include "internal/evp_int.h" -#include "internal/x509_int.h" +#include "crypto/asn1.h" +#include "crypto/evp.h" +#include "crypto/x509.h" #include #include @@ -185,16 +185,17 @@ EVP_PKEY *d2i_PUBKEY(EVP_PKEY **a, const unsigned char **pp, long length) X509_PUBKEY *xpk; EVP_PKEY *pktmp; const unsigned char *q; + q = *pp; xpk = d2i_X509_PUBKEY(NULL, &q, length); - if (!xpk) + if (xpk == NULL) return NULL; pktmp = X509_PUBKEY_get(xpk); X509_PUBKEY_free(xpk); - if (!pktmp) + if (pktmp == NULL) return NULL; *pp = q; - if (a) { + if (a != NULL) { EVP_PKEY_free(*a); *a = pktmp; } @@ -230,16 +231,17 @@ RSA *d2i_RSA_PUBKEY(RSA **a, const unsigned char **pp, long length) EVP_PKEY *pkey; RSA *key; const unsigned char *q; + q = *pp; pkey = d2i_PUBKEY(NULL, &q, length); - if (!pkey) + if (pkey == NULL) return NULL; key = EVP_PKEY_get1_RSA(pkey); EVP_PKEY_free(pkey); - if (!key) + if (key == NULL) return NULL; *pp = q; - if (a) { + if (a != NULL) { RSA_free(*a); *a = key; } @@ -271,16 +273,17 @@ DSA *d2i_DSA_PUBKEY(DSA **a, const unsigned char **pp, long length) EVP_PKEY *pkey; DSA *key; const unsigned char *q; + q = *pp; pkey = d2i_PUBKEY(NULL, &q, length); - if (!pkey) + if (pkey == NULL) return NULL; key = EVP_PKEY_get1_DSA(pkey); EVP_PKEY_free(pkey); - if (!key) + if (key == NULL) return NULL; *pp = q; - if (a) { + if (a != NULL) { DSA_free(*a); *a = key; } @@ -312,16 +315,17 @@ EC_KEY *d2i_EC_PUBKEY(EC_KEY **a, const unsigned char **pp, long length) EVP_PKEY *pkey; EC_KEY *key; const unsigned char *q; + q = *pp; pkey = d2i_PUBKEY(NULL, &q, length); - if (!pkey) + if (pkey == NULL) return NULL; key = EVP_PKEY_get1_EC_KEY(pkey); EVP_PKEY_free(pkey); - if (!key) + if (key == NULL) return NULL; *pp = q; - if (a) { + if (a != NULL) { EC_KEY_free(*a); *a = key; } @@ -332,7 +336,8 @@ int i2d_EC_PUBKEY(const EC_KEY *a, unsigned char **pp) { EVP_PKEY *pktmp; int ret; - if (!a) + + if (a == NULL) return 0; if ((pktmp = EVP_PKEY_new()) == NULL) { ASN1err(ASN1_F_I2D_EC_PUBKEY, ERR_R_MALLOC_FAILURE); diff --git a/crypto/x509/x_req.c b/crypto/x509/x_req.c index 5bda794a..e9cc9ba4 100644 --- a/crypto/x509/x_req.c +++ b/crypto/x509/x_req.c @@ -11,7 +11,7 @@ #include "internal/cryptlib.h" #include #include -#include "internal/x509_int.h" +#include "crypto/x509.h" /*- * X509_REQ_INFO is handled in an unusual way to get round diff --git a/crypto/x509/x_x509.c b/crypto/x509/x_x509.c index d91c2d24..7b41ce07 100644 --- a/crypto/x509/x_x509.c +++ b/crypto/x509/x_x509.c @@ -13,7 +13,7 @@ #include #include #include -#include "internal/x509_int.h" +#include "crypto/x509.h" ASN1_SEQUENCE_enc(X509_CINF, enc, 0) = { ASN1_EXP_OPT(X509_CINF, version, ASN1_INTEGER, 0), diff --git a/crypto/x509/x_x509a.c b/crypto/x509/x_x509a.c index a29d3dfc..18d09e30 100644 --- a/crypto/x509/x_x509a.c +++ b/crypto/x509/x_x509a.c @@ -12,7 +12,7 @@ #include #include #include -#include "internal/x509_int.h" +#include "crypto/x509.h" /* * X509_CERT_AUX routines. These are used to encode additional user diff --git a/doc/HOWTO/proxy_certificates.txt b/doc/HOWTO/proxy_certificates.txt index 3c423492..f6f754cc 100644 --- a/doc/HOWTO/proxy_certificates.txt +++ b/doc/HOWTO/proxy_certificates.txt @@ -108,7 +108,7 @@ recognised: superfluous, and was removed. file indicates that the text of the policy should really be taken from a - file. The string is then really a file name. This is useful for + file. The string is then really a filename. This is useful for policies that are large (more than a few lines, e.g. XML documents). The 'policy' setting can be split up in multiple lines like this: diff --git a/doc/internal/man3/DEFINE_SPARSE_ARRAY_OF.pod b/doc/internal/man3/DEFINE_SPARSE_ARRAY_OF.pod index b36084dc..a78193c2 100644 --- a/doc/internal/man3/DEFINE_SPARSE_ARRAY_OF.pod +++ b/doc/internal/man3/DEFINE_SPARSE_ARRAY_OF.pod @@ -9,9 +9,9 @@ ossl_sa_TYPE_doall_arg, ossl_sa_TYPE_get, ossl_sa_TYPE_set =head1 SYNOPSIS -=for comment generic +=for openssl generic - #include "internal/sparse_array.h" + #include "crypto/sparse_array.h" typedef struct sparse_array_st OPENSSL_SA; @@ -33,42 +33,51 @@ ossl_sa_TYPE_doall_arg, ossl_sa_TYPE_get, ossl_sa_TYPE_set =head1 DESCRIPTION +=begin comment + +POD is pretty good at recognising function names and making them appropriately +bold... however, when part of the function name is variable, we have to help +the processor along + +=end comment + SPARSE_ARRAY_OF() returns the name for a sparse array of the specified -B. DEFINE_STACK_OF() creates set of functions for a sparse array of -B. This will mean that a pointer to type B is stored in each -element of a sparse array, the type is referenced by SPARSE_ARRAY_OF(TYPE) and -each function name begins with I. For example: +B>. DEFINE_STACK_OF() creates set of functions for a sparse +array of B>. This will mean that a pointer to type B> +is stored in each element of a sparse array, the type is referenced by +B(B>) and each function name begins with +B_>. For example: TYPE *ossl_sa_TYPE_get(SPARSE_ARRAY_OF(TYPE) *sa, ossl_uintmax_t idx); -ossl_sa_TYPE_num() returns the number of elements in B or 0 if B is -B. +B_num>() returns the number of elements in I or 0 if I +is NULL. -ossl_sa_TYPE_get() returns element B in B, where B starts at -zero. If B refers to a value that has not been set then B is +B_get>() returns element I in I, where I starts +at zero. If I refers to a value that has not been set then NULL is returned. -ossl_sa_TYPE_set() sets element B in B to B, where B +B_set>() sets element I in I to I, where I starts at zero. The sparse array will be resized as required. -ossl_sa_TYPE_new() allocates a new empty sparse array. +B_new>() allocates a new empty sparse array. -ossl_sa_TYPE_free() frees up the B structure. It does B free up any -elements of B. After this call B is no longer valid. +B_free>() frees up the I structure. It does I free up any +elements of I. After this call I is no longer valid. -ossl_sa_TYPE_free_leaves() frees up the B structure and all of its -elements. After this call B is no longer valid. +B_free_leaves>() frees up the I structure and all of its +elements. After this call I is no longer valid. -ossl_sa_TYPE_doall() calls the function B for each element in B +B_doall>() calls the function I for each element in I in ascending index order. The index position, within the sparse array, of each item is passed as the first argument to the leaf function and a pointer to the associated value is is passed as the second argument. -ossl_sa_TYPE_doall_arg() calls the function B for each element in -B in ascending index order. The index position, within the sparse +B_doall_arg>() calls the function I for each element in +I in ascending index order. The index position, within the sparse array, of each item is passed as the first argument to the leaf function, a pointer to the associated value is passed as the second argument and -the third argument is the user supplied B. +the third argument is the user supplied I. =head1 NOTES @@ -77,9 +86,9 @@ Sparse arrays are an internal data structure and should B be used by user applications. Care should be taken when accessing sparse arrays in multi-threaded -environments. The ossl_sa_TYPE_set operation can cause the internal structure -of the sparse array to change which causes race conditions if the sparse array -is accessed in a different thread. +environments. The B_set>() operation can cause the internal +structure of the sparse array to change which causes race conditions if the +sparse array is accessed in a different thread. SPARSE_ARRAY_OF() and DEFINE_SPARSE_ARRAY_OF() are implemented as macros. @@ -90,21 +99,22 @@ OPENSSL_SA_num and OPENSSL_SA_set. =head1 RETURN VALUES -ossl_sa_TYPE_num() returns the number of elements in the sparse array or B<0> -if the passed sparse array is B. +B_num>() returns the number of elements in the sparse array or +B<0> if the passed sparse array is NULL. -ossl_sa_TYPE_get() returns a pointer to a sparse array element or B if +B_get>() returns a pointer to a sparse array element or NULL if the element has not be set. -ossl_sa_TYPE_set() return B<1> on success and B<0> on error. In the latter +B_set>() return B<1> on success and B<0> on error. In the latter case, the elements of the sparse array remain unchanged, although the internal structures might have. -ossl_sa_TYPE_new() returns an empty sparse array or B if an error +B_new>() returns an empty sparse array or NULL if an error occurs. -ossl_sa_TYPE_doall, ossl_sa_TYPE_doall_arg, ossl_sa_TYPE_free() and -ossl_sa_TYPE_free_leaves() do not return values. +B_doall>(), B_doall_arg>(), +B_free>() and B_free_leaves>() +do not return values. =head1 HISTORY diff --git a/doc/internal/man3/OSSL_METHOD_STORE.pod b/doc/internal/man3/OSSL_METHOD_STORE.pod index f178a0ee..2ffe8201 100644 --- a/doc/internal/man3/OSSL_METHOD_STORE.pod +++ b/doc/internal/man3/OSSL_METHOD_STORE.pod @@ -53,52 +53,52 @@ separately (see L below). =head2 Store Functions ossl_method_store_init() initialises the method store subsystem in the scope of -the library context B. +the library context I. ossl_method_store_cleanup() cleans up and shuts down the implementation method -store subsystem in the scope of the library context B. +store subsystem in the scope of the library context I. ossl_method_store_new() create a new empty method store using the supplied -B to allow access to the required underlying property data. +I to allow access to the required underlying property data. -ossl_method_store_free() frees resources allocated to B. +ossl_method_store_free() frees resources allocated to I. -ossl_method_store_add() adds the B constructed from an implementation in -the provider B to the B as an instance of an algorithm indicated by -B and the property definition B, unless the B already -has a method from the same provider with the same B and B. -If the B function is given, it's called to increment the +ossl_method_store_add() adds the I constructed from an implementation in +the provider I to the I as an instance of an algorithm indicated by +I and the property definition I, unless the I already +has a method from the same provider with the same I and I. +If the I function is given, it's called to increment the reference count of the method. -If the B function is given, it's called when this function +If the I function is given, it's called when this function fails to add the method to the store, or later on when it is being released from -the B. +the I. -ossl_method_store_remove() removes the B identified by B from the -B. +ossl_method_store_remove() removes the I identified by I from the +I. -ossl_method_store_fetch() queries B for a method identified by B -that matches the property query B. -The result, if any, is returned in B. +ossl_method_store_fetch() queries I for a method identified by I +that matches the property query I. +The result, if any, is returned in I. -ossl_method_store_set_global_properties() sets method B wide query -properties to B. +ossl_method_store_set_global_properties() sets method I wide query +properties to I. All subsequent fetches will need to meet both these global query properties and the ones passed to the ossl_method_store_free(). =head2 Cache Functions -ossl_method_store_cache_get() queries the cache associated with the B -for a method identified by B that matches the property query -B. -The result, if any, is returned in B. +ossl_method_store_cache_get() queries the cache associated with the I +for a method identified by I that matches the property query +I. +The result, if any, is returned in I. -ossl_method_store_cache_set() sets a cache entry identified by B with the -property query B in the B. -Future calls to ossl_method_store_cache_get() will return the specified B. +ossl_method_store_cache_set() sets a cache entry identified by I with the +property query I in the I. +Future calls to ossl_method_store_cache_get() will return the specified I. =head1 RETURN VALUES -ossl_method_store_new() returns a new method store object or B on failure. +ossl_method_store_new() returns a new method store object or NULL on failure. ossl_method_store_free(), ossl_method_store_add(), ossl_method_store_remove(), ossl_method_store_fetch(), diff --git a/doc/internal/man3/cms_add1_signing_cert.pod b/doc/internal/man3/cms_add1_signing_cert.pod index a825c071..ac7f813e 100644 --- a/doc/internal/man3/cms_add1_signing_cert.pod +++ b/doc/internal/man3/cms_add1_signing_cert.pod @@ -16,10 +16,10 @@ CMS_SignerInfo data structure =head1 DESCRIPTION -cms_add1_signing_cert() adds an ESS Signing Certificate B (version 1) signed -attribute to the CMS_SignerInfo B. -cms_add1_signing_cert_v2() adds an ESS Signing Certificate B (version 2) signed -attribute to the CMS_SignerInfo B. +cms_add1_signing_cert() adds an ESS Signing Certificate I (version 1) signed +attribute to the CMS_SignerInfo I. +cms_add1_signing_cert_v2() adds an ESS Signing Certificate I (version 2) signed +attribute to the CMS_SignerInfo I. The ESS Signing Certificate attributes version 1 and 2 are defined in RFC 5035 which updates Section 5.4 of RFC 2634. diff --git a/doc/internal/man3/evp_generic_fetch.pod b/doc/internal/man3/evp_generic_fetch.pod index 6fe7bccb..c4734394 100644 --- a/doc/internal/man3/evp_generic_fetch.pod +++ b/doc/internal/man3/evp_generic_fetch.pod @@ -8,7 +8,7 @@ evp_generic_fetch, evp_generic_fetch_by_number =head1 SYNOPSIS /* Only for EVP source */ - #include "evp_locl.h" + #include "evp_local.h" void *evp_generic_fetch(OPENSSL_CTX *libctx, int operation_id, const char *name, const char *properties, @@ -39,7 +39,7 @@ I, I, and I. evp_generic_fetch_by_number() does the same thing as evp_generic_fetch(), but takes a I instead of a number. -I must always be non-zero; as a matter of fact, it being zero +I must always be nonzero; as a matter of fact, it being zero is considered a programming error. This is meant to be used when one method needs to fetch an associated other method, and is typically called from inside the given function @@ -70,7 +70,7 @@ frees the given method. =head1 RETURN VALUES -evp_generic_fetch() returns a method on success, or B on error. +evp_generic_fetch() returns a method on success, or NULL on error. =head1 EXAMPLES diff --git a/doc/internal/man3/evp_keymgmt_export_to_provider.pod b/doc/internal/man3/evp_keymgmt_export_to_provider.pod index 72b766fb..2cb40940 100644 --- a/doc/internal/man3/evp_keymgmt_export_to_provider.pod +++ b/doc/internal/man3/evp_keymgmt_export_to_provider.pod @@ -8,7 +8,7 @@ evp_keymgmt_clear_pkey_cache =head1 SYNOPSIS - #include "internal/evp_int.h" + #include "crypto/evp.h" void *evp_keymgmt_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt); void evp_keymgmt_clear_pkey_cache(EVP_PKEY *pk); diff --git a/doc/internal/man3/evp_keymgmt_freekey.pod b/doc/internal/man3/evp_keymgmt_freekey.pod index 597c34b6..8be73aee 100644 --- a/doc/internal/man3/evp_keymgmt_freekey.pod +++ b/doc/internal/man3/evp_keymgmt_freekey.pod @@ -14,7 +14,7 @@ evp_keymgmt_importkey_types, evp_keymgmt_exportkey_types =head1 SYNOPSIS - #include "internal/evp_int.h" + #include "crypto/evp.h" void *evp_keymgmt_importdomparams(const EVP_KEYMGMT *keymgmt, const OSSL_PARAM params[]); diff --git a/doc/internal/man3/openssl_ctx_get_data.pod b/doc/internal/man3/openssl_ctx_get_data.pod index 3d821b5f..6fd7c633 100644 --- a/doc/internal/man3/openssl_ctx_get_data.pod +++ b/doc/internal/man3/openssl_ctx_get_data.pod @@ -7,7 +7,7 @@ openssl_ctx_get_data, openssl_ctx_run_once, openssl_ctx_onfree =head1 SYNOPSIS - #include + #include #include "internal/cryptlib.h" typedef struct openssl_ctx_method { @@ -24,8 +24,8 @@ openssl_ctx_get_data, openssl_ctx_run_once, openssl_ctx_onfree =head1 DESCRIPTION -Internally, the OpenSSL library context C is implemented -as a C, which allows data from diverse parts of the +Internally, the OpenSSL library context B is implemented +as a B, which allows data from diverse parts of the library to be added and removed dynamically. Each such data item must have a corresponding CRYPTO_EX_DATA index associated with it. Unlike normal CRYPTO_EX_DATA objects we use static indexes @@ -34,8 +34,8 @@ indexes internally to the implementation. See the example further down to see how that's done. openssl_ctx_get_data() is used to retrieve a pointer to the data in -the library context C associated with the given C. An -OPENSSL_CTX_METHOD must be defined and given in the C parameter. The index +the library context I associated with the given I. An +OPENSSL_CTX_METHOD must be defined and given in the I parameter. The index for it should be defined in cryptlib.h. The functions through the method are used to create or free items that are stored at that index whenever a library context is created or freed, meaning that the code that use a data item of that @@ -44,18 +44,18 @@ index doesn't have to worry about that, just use the data available. Deallocation of an index happens automatically when the library context is freed. -openssl_ctx_run_once is used to run some initialisation routine C -exactly once per library context C object. Each initialisation routine +openssl_ctx_run_once is used to run some initialisation routine I +exactly once per library context I object. Each initialisation routine should be allocate a unique run once index in cryptlib.h. Any resources allocated via a run once initialisation routine can be cleaned up -using openssl_ctx_onfree. This associates an "on free" routine C with -the library context C. When C is freed all associated "on free" +using openssl_ctx_onfree. This associates an "on free" routine I with +the library context I. When I is freed all associated "on free" routines are called. =head1 RETURN VALUES -openssl_ctx_get_data() returns a pointer on success, or C on +openssl_ctx_get_data() returns a pointer on success, or NULL on failure. =head1 EXAMPLES diff --git a/doc/internal/man3/ossl_cmp_asn1_octet_string_set1.pod b/doc/internal/man3/ossl_cmp_asn1_octet_string_set1.pod new file mode 100644 index 00000000..08941362 --- /dev/null +++ b/doc/internal/man3/ossl_cmp_asn1_octet_string_set1.pod @@ -0,0 +1,101 @@ +=pod + +=head1 NAME + +ossl_cmp_log_parse_metadata, +ossl_cmp_add_error_txt, +ossl_cmp_add_error_data, +ossl_cmp_add_error_line, +ossl_cmp_asn1_octet_string_set1, +ossl_cmp_asn1_octet_string_set1_bytes, +ossl_cmp_build_cert_chain +- misc internal utility functions + +=head1 SYNOPSIS + + #include "cmp_local.h" + + const char *ossl_cmp_log_parse_metadata(const char *buf, + OSSL_CMP_severity *level, char **func, + char **file, int *line); + + void ossl_cmp_add_error_txt(const char *separator, const char *txt); + #define ossl_cmp_add_error_data(txt) + #define ossl_cmp_add_error_line(txt) + + int ossl_cmp_asn1_octet_string_set1(ASN1_OCTET_STRING **tgt, + const ASN1_OCTET_STRING *src); + int ossl_cmp_asn1_octet_string_set1_bytes(ASN1_OCTET_STRING **tgt, + const unsigned char *bytes, int len); + + STACK_OF(X509) *ossl_cmp_build_cert_chain(STACK_OF(X509) *certs, X509 *cert); + +=head1 DESCRIPTION + +ossl_cmp_log_parse_metadata() parses the given message buffer I populated +by L etc. +according to the pattern OSSL_CMP_LOG_START#level ": %s\n", filling in +the variable pointed to by I with the severity level or -1, +the variable pointed to by I with the function name string or NULL, +the variable pointed to by I with the filename string or NULL, and +the variable pointed to by I with the line number or -1. +Any string returned via I<*func> and I<*file> must be freeed by the caller. + +ossl_cmp_add_error_txt() appends text to the extra data field of the last +error message in the OpenSSL error queue, after adding the optional separator +unless data has been empty so far. The text can be of arbitrary length, +which is not possible when using L in conjunction with +L. + +ossl_cmp_add_error_data() is a macro calling +ossl_cmp_add_error_txt() with the separator being ":". + +ossl_cmp_add_error_line() is a macro calling +ossl_cmp_add_error_txt() with the separator being "\n". + +ossl_cmp_asn1_octet_string_set1() frees any previous value of the variable +referenced via the I argument and assigns either a copy of +the ASN1_OCTET_STRING given as the I argument or NULL. +It returns 1 on success, 0 on error. + +ossl_cmp_asn1_octet_string_set1_bytes() frees any previous value of the variable +referenced via the I argument and assigns either a copy of the given byte +string (with the given length) or NULL. It returns 1 on success, 0 on error. + +ossl_cmp_build_cert_chain() builds up the certificate chain of cert as high up +as possible using the given X509_STORE containing all possible intermediate +certificates and optionally the (possible) trust anchor(s). + +=head1 RETURN VALUES + +ossl_cmp_log_parse_metadata() returns the pointer to the actual message text +after the OSSL_CMP_LOG_PREFIX and level and ':' if found in the buffer, +else the beginning of the buffer. + +ossl_cmp_add_error_txt() +ossl_cmp_add_error_data(), and +ossl_cmp_add_error_line() +do not return anything. + +ossl_cmp_build_cert_chain() +returns NULL on error, else a pointer to a stack of (up_ref'ed) certificates +containing the EE certificate given in the function arguments (cert) +and all intermediate certificates up the chain toward the trust anchor. +The (self-signed) trust anchor is not included. + +All other functions return 1 on success, 0 on error. + +=head1 HISTORY + +The OpenSSL CMP support was added in OpenSSL 3.0. + +=head1 COPYRIGHT + +Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved. + +Licensed under the Apache License 2.0 (the "License"). You may not use +this file except in compliance with the License. You can obtain a copy +in the file LICENSE in the source distribution or at +L. + +=cut diff --git a/doc/internal/man3/ossl_cmp_ctx_set1_caPubs.pod b/doc/internal/man3/ossl_cmp_ctx_set1_caPubs.pod new file mode 100644 index 00000000..f3c45ed5 --- /dev/null +++ b/doc/internal/man3/ossl_cmp_ctx_set1_caPubs.pod @@ -0,0 +1,76 @@ +=pod + +=head1 NAME + +ossl_cmp_ctx_set1_caPubs, +ossl_cmp_ctx_set0_validatedSrvCert, +ossl_cmp_ctx_set_status, +ossl_cmp_ctx_set0_statusString, +ossl_cmp_ctx_set_failInfoCode, +ossl_cmp_ctx_set0_newCert, +ossl_cmp_ctx_set1_extraCertsIn, +ossl_cmp_ctx_set1_recipNonce +- internal functions for managing the CMP client context datastructure + +=head1 SYNOPSIS + + #include + + int ossl_cmp_ctx_set1_caPubs(OSSL_CMP_CTX *ctx, STACK_OF(X509) *caPubs); + int ossl_cmp_ctx_set0_validatedSrvCert(OSSL_CMP_CTX *ctx, X509 *cert); + int ossl_cmp_ctx_set_status(OSSL_CMP_CTX *ctx, int status); + int ossl_cmp_ctx_set0_statusString(OSSL_CMP_CTX *ctx, + OSSL_CMP_PKIFREETEXT *text); + int ossl_cmp_ctx_set_failInfoCode(OSSL_CMP_CTX *ctx, int fail_info); + int ossl_cmp_ctx_set0_newCert(OSSL_CMP_CTX *ctx, X509 *cert); + int ossl_cmp_ctx_set1_extraCertsIn(OSSL_CMP_CTX *ctx, + STACK_OF(X509) *extraCertsIn); + int ossl_cmp_ctx_set1_recipNonce(OSSL_CMP_CTX *ctx, + const ASN1_OCTET_STRING *nonce); + +=head1 DESCRIPTION + +ossl_cmp_ctx_set1_caPubs() copies the given stack of CA certificates +to the caPubs field of the context. +The reference counts of those certificates handled successfully are increased. + +ossl_cmp_ctx_set0_validatedSrvCert() sets the validatedSrvCert of the context, +which caches any already validated server cert, or NULL if not available. + +ossl_cmp_ctx_set_status() sets the status field of the context. + +ossl_cmp_ctx_set0_statusString() sets the statusString field of the context. + +ossl_cmp_ctx_set_failInfoCode() sets the error code bits in the failInfoCode +field of the context based on the given OSSL_CMP_PKIFAILUREINFO structure. + +ossl_cmp_ctx_set0_newCert() sets the given (newly enrolled) certificate +in the context. + +ossl_cmp_ctx_set1_extraCertsIn() sets the extraCertsIn field of the context. +The reference counts of those certificates handled successfully are increased. + +ossl_cmp_ctx_set1_recipNonce() sets the given recipient nonce in the context. + +=head1 NOTES + +CMP is defined in RFC 4210 (and CRMF in RFC 4211). + +=head1 RETURN VALUES + +All functions return 1 on success, 0 on error. + +=head1 HISTORY + +The OpenSSL CMP support was added in OpenSSL 3.0. + +=head1 COPYRIGHT + +Copyright 2007-2018 The OpenSSL Project Authors. All Rights Reserved. + +Licensed under the Apache License 2.0 (the "License"). You may not use +this file except in compliance with the License. You can obtain a copy +in the file LICENSE in the source distribution or at +L. + +=cut diff --git a/doc/internal/man3/ossl_cmp_sk_X509_add1_cert.pod b/doc/internal/man3/ossl_cmp_sk_X509_add1_cert.pod new file mode 100644 index 00000000..cb36855a --- /dev/null +++ b/doc/internal/man3/ossl_cmp_sk_X509_add1_cert.pod @@ -0,0 +1,60 @@ +=pod + +=head1 NAME + +ossl_cmp_sk_X509_add1_cert, +ossl_cmp_sk_X509_add1_certs, +ossl_cmp_X509_STORE_add1_certs, +ossl_cmp_X509_STORE_get1_certs +- functions manipulating lists of certificates + +=head1 SYNOPSIS + + #include + + int ossl_cmp_sk_X509_add1_cert(STACK_OF(X509) *sk, X509 *cert, + int no_dup, int prepend); + int ossl_cmp_sk_X509_add1_certs(STACK_OF(X509) *sk, STACK_OF(X509) *certs, + int no_self_signed, int no_dups, int prepend); + int ossl_cmp_X509_STORE_add1_certs(X509_STORE *store, STACK_OF(X509) *certs, + int only_self_signed); + STACK_OF(X509) *ossl_cmp_X509_STORE_get1_certs(X509_STORE *store); + +=head1 DESCRIPTION + +ossl_cmp_sk_X509_add1_cert() appends or prepends (depending on the I +argument) a certificate to the given list, +optionally only if it is not already contained. +On success the reference count of the certificate is increased. + +ossl_cmp_sk_X509_add1_certs() appends or prepends (depending on the I +argument) a list of certificates to the given list, +optionally only if not self-signed and optionally only if not already contained. +The reference counts of those certificates appended successfully are increased. + +ossl_cmp_X509_STORE_add1_certs() adds all or only self-signed certificates from +the given stack to given store. The I parameter may be NULL. + +ossl_cmp_X509_STORE_get1_certs() retrieves a copy of all certificates in the +given store. + +=head1 RETURN VALUES + +ossl_cmp_X509_STORE_get1_certs() returns a list of certificates, NULL on error. + +All other functions return 1 on success, 0 on error. + +=head1 HISTORY + +The OpenSSL CMP support was added in OpenSSL 3.0. + +=head1 COPYRIGHT + +Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved. + +Licensed under the Apache License 2.0 (the "License"). You may not use +this file except in compliance with the License. You can obtain a copy +in the file LICENSE in the source distribution or at +L. + +=cut diff --git a/doc/internal/man3/ossl_init_thread_deregister.pod b/doc/internal/man3/ossl_init_thread_deregister.pod index 4d4c7166..923b5254 100644 --- a/doc/internal/man3/ossl_init_thread_deregister.pod +++ b/doc/internal/man3/ossl_init_thread_deregister.pod @@ -9,7 +9,7 @@ ossl_init_thread_deregister =head1 SYNOPSIS - #include "internal/cryptlib_int.h" + #include "crypto/cryptlib.h" #include typedef void (*OSSL_thread_stop_handler_fn)(void *arg); @@ -33,17 +33,17 @@ stopping the stop handler is called (while on that thread) and the code can clean up the value stored in the thread local variable. A new stop handler is registerd using the function ossl_init_thread_start(). -The B parameter should be a unique value that can be used to identify a +The I parameter should be a unique value that can be used to identify a set of common stop handlers and is passed in a later call to ossl_init_thread_deregister. If no later call to ossl_init_thread_deregister is -made then NULL can be passed for this parameter. The B parameter is passed +made then NULL can be passed for this parameter. The I parameter is passed back as an argument to the stop handler when it is later invoked. Finally the -B is a function pointer to the stop handler itself. +I is a function pointer to the stop handler itself. In the event that previously registered stop handlers need to be deregistered then this can be done using the function ossl_init_thread_deregister(). This will deregister all stop handlers (no matter which thread they were -registered for) which the same B value. +registered for) which the same I value. =head1 RETURN VALUES diff --git a/doc/internal/man3/ossl_method_construct.pod b/doc/internal/man3/ossl_method_construct.pod index a25ca4cd..f3d7a64d 100644 --- a/doc/internal/man3/ossl_method_construct.pod +++ b/doc/internal/man3/ossl_method_construct.pod @@ -90,7 +90,7 @@ Remove a temporary store. Look up an already existing method from a store by name. The store may be given with I. -B is a valid value and means that a sub-system default store +NULL is a valid value and means that a sub-system default store must be used. This default store should be stored in the library context I. @@ -107,7 +107,7 @@ Places the I created by the construct() function (see below) in a store. The store may be given with I. -B is a valid value and means that a sub-system default store +NULL is a valid value and means that a sub-system default store must be used. This default store should be stored in the library context I. @@ -141,7 +141,7 @@ the reference count reaches zero. =head1 RETURN VALUES ossl_method_construct() returns a constructed method on success, or -B on error. +NULL on error. =head1 HISTORY diff --git a/doc/internal/man3/ossl_namemap_new.pod b/doc/internal/man3/ossl_namemap_new.pod index 8699b861..2bcf2138 100644 --- a/doc/internal/man3/ossl_namemap_new.pod +++ b/doc/internal/man3/ossl_namemap_new.pod @@ -3,7 +3,9 @@ =head1 NAME ossl_namemap_new, ossl_namemap_free, ossl_namemap_stored, -ossl_namemap_add, ossl_namemap_name2num, ossl_namemap_doall_names +ossl_namemap_add, ossl_namemap_add_n, +ossl_namemap_name2num, ossl_namemap_name2num_n, +ossl_namemap_doall_names - internal number E-E name map =head1 SYNOPSIS @@ -16,8 +18,12 @@ ossl_namemap_add, ossl_namemap_name2num, ossl_namemap_doall_names void ossl_namemap_free(OSSL_NAMEMAP *namemap); int ossl_namemap_add(OSSL_NAMEMAP *namemap, int number, const char *name); + int ossl_namemap_add_n(OSSL_NAMEMAP *namemap, int number, + const char *name, size_t name_len); int ossl_namemap_name2num(const OSSL_NAMEMAP *namemap, const char *name); + int ossl_namemap_name2num_n(const OSSL_NAMEMAP *namemap, + const char *name, size_t name_len); void ossl_namemap_doall_names(const OSSL_NAMEMAP *namemap, int number, void (*fn)(const char *name, void *data), void *data); @@ -43,12 +49,18 @@ ossl_namemap_add() adds a new name to the namemap if it's not already present. If the given I is zero, a new number will be allocated to identify this I. -If the given I is non-zero, the I is added to the set of +If the given I is nonzero, the I is added to the set of names already associated with that number. ossl_namemap_name2num() finds the number corresponding to the given I. +ossl_namemap_add_n() and ossl_namemap_name2num_n() do the same thing +as ossl_namemap_add() and ossl_namemap_name2num(), but take a string +length I as well, allowing the caller to use a fragment of +a string as a name. + + ossl_namemap_doall_names() walks through all names associated with I in the given I and calls the function I for each of them. @@ -60,15 +72,16 @@ pass extra data for that function to use. ossl_namemap_new() and ossl_namemap_stored() return the pointer to a B, or NULL on error. -ossl_namemap_add() returns the number associated with the added -string, or zero on error. +ossl_namemap_add() and ossl_namemap_add_n() return the number associated +with the added string, or zero on error. ossl_namemap_num2names() returns a pointer to a NULL-terminated list of pointers to the names corresponding to the given number, or NULL if it's undefined in the given B. -ossl_namemap_name2num() returns the number corresponding to the given -name, or 0 if it's undefined in the given B. +ossl_namemap_name2num() and ossl_namemap_name2num_n() return the number +corresponding to the given name, or 0 if it's undefined in the given +B. =head1 NOTES diff --git a/doc/internal/man3/ossl_param_bld_init.pod b/doc/internal/man3/ossl_param_bld_init.pod index 4acd8ebf..062e2c29 100644 --- a/doc/internal/man3/ossl_param_bld_init.pod +++ b/doc/internal/man3/ossl_param_bld_init.pod @@ -15,7 +15,7 @@ ossl_param_bld_push_octet_ptr =head1 SYNOPSIS -=for comment generic +=for openssl generic #include "internal/params_build.h" @@ -48,14 +48,14 @@ ossl_param_bld_push_octet_ptr =head1 DESCRIPTION A collection of utility functions that simplify the creation of OSSL_PARAM -arrays. The B names are as per L. +arrays. The B> names are as per L. ossl_param_bld_init() initialises the OSSL_PARAM_BLD structure so that values can be added. Any existing values are cleared. ossl_param_bld_to_param() converts a built up OSSL_PARAM_BLD structure -B into an allocated OSSL_PARAM array. +I into an allocated OSSL_PARAM array. The OSSL_PARAM array and all associated storage must be freed by calling ossl_param_bld_free() with the functions return value. @@ -64,44 +64,52 @@ ossl_param_bld_to_param(). ossl_param_bld_to_param_ex() behaves like ossl_param_bld_to_param(), except that no additional memory is allocated. -An OSSL_PARAM array of at least B elements is passed in as B. +An OSSL_PARAM array of at least I elements is passed in as I. The auxiliary storage for the parameters is a block of memory pointed to -by B of at least B bytes in size. +by I of at least I bytes in size. If required, secure memory for private BIGNUMs should be pointed to by -B of at least B bytes in size. +I of at least I bytes in size. -ossl_param_bld_push_TYPE() are a series of functions which will create -OSSL_PARAM objects of the specified size and correct type for the B +=begin comment + +POD is pretty good at recognising function names and making them appropriately +bold... however, when part of the function name is variable, we have to help +the processor along + +=end comment + +B>() are a series of functions which will create +OSSL_PARAM objects of the specified size and correct type for the I argument. -B is stored by value and an expression or auto variable can be used. +I is stored by value and an expression or auto variable can be used. ossl_param_bld_push_BN() is a function that will create an OSSL_PARAM object -that holds the specified BIGNUM B. -If B is marked as being securely allocated, it's OSSL_PARAM representation +that holds the specified BIGNUM I. +If I is marked as being securely allocated, it's OSSL_PARAM representation will also be securely allocated. -The B argument is stored by reference and the underlying BIGNUM object +The I argument is stored by reference and the underlying BIGNUM object must exist until after ossl_param_bld_to_param() has been called. ossl_param_bld_push_utf8_string() is a function that will create an OSSL_PARAM -object that references the UTF8 string specified by B. -If the length of the string, B, is zero then it will be calculated. -The string that B points to is stored by reference and must remain in +object that references the UTF8 string specified by I. +If the length of the string, I, is zero then it will be calculated. +The string that I points to is stored by reference and must remain in scope until after ossl_param_bld_to_param() has been called. ossl_param_bld_push_octet_string() is a function that will create an OSSL_PARAM -object that references the octet string specified by B and . -The memory that B points to is stored by reference and must remain in +object that references the octet string specified by I and . +The memory that I points to is stored by reference and must remain in scope until after ossl_param_bld_to_param() has been called. ossl_param_bld_push_utf8_ptr() is a function that will create an OSSL_PARAM -object that references the UTF8 string specified by B. -If the length of the string, B, is zero then it will be calculated. -The string B points to is stored by reference and must remain in +object that references the UTF8 string specified by I. +If the length of the string, I, is zero then it will be calculated. +The string I points to is stored by reference and must remain in scope until the OSSL_PARAM array is freed. ossl_param_bld_push_octet_ptr() is a function that will create an OSSL_PARAM -object that references the octet string specified by B. -The memory B points to is stored by reference and must remain in +object that references the octet string specified by I. +The memory I points to is stored by reference and must remain in scope until the OSSL_PARAM array is freed. =head1 RETURN VALUES diff --git a/doc/internal/man3/ossl_prov_util_nid_to_name.pod b/doc/internal/man3/ossl_prov_util_nid_to_name.pod index 56a16d34..31eec076 100644 --- a/doc/internal/man3/ossl_prov_util_nid_to_name.pod +++ b/doc/internal/man3/ossl_prov_util_nid_to_name.pod @@ -7,14 +7,14 @@ ossl_prov_util_nid_to_name =head1 SYNOPSIS - #include "internal/providercommon.h" + #include "prov/providercommon.h" const char *ossl_prov_util_nid_to_name(int nid); =head1 DESCRIPTION The ossl_prov_util_nid_to_name() returns the name of an algorithm given a NID -in the B parameter. For the default and legacy providers it is equivalent +in the I parameter. For the default and legacy providers it is equivalent to calling OBJ_nid2sn(). The FIPS provider does not have the object database code available to it (because that code relies on the ASN.1 code), so this function is a static lookup of all known FIPS algorithm NIDs. diff --git a/doc/internal/man3/ossl_provider_new.pod b/doc/internal/man3/ossl_provider_new.pod index 7154d5f3..39c3cba0 100644 --- a/doc/internal/man3/ossl_provider_new.pod +++ b/doc/internal/man3/ossl_provider_new.pod @@ -184,7 +184,7 @@ ossl_provider_new(). ossl_provider_dso() returns a reference to the module, for providers that come in the form of loadable modules. -ossl_provider_module_name() returns the file name of the module, for +ossl_provider_module_name() returns the filename of the module, for providers that come in the form of loadable modules. ossl_provider_module_path() returns the full path of the module file, diff --git a/doc/internal/man3/rand_bytes_ex.pod b/doc/internal/man3/rand_bytes_ex.pod index 74060731..e1bb0f04 100644 --- a/doc/internal/man3/rand_bytes_ex.pod +++ b/doc/internal/man3/rand_bytes_ex.pod @@ -7,7 +7,7 @@ rand_bytes_ex, rand_priv_bytes_ex =head1 SYNOPSIS - #include "internal/rand_int.h" + #include "crypto/rand.h" int rand_bytes_ex(OPENSSL_CTX *ctx, unsigned char *buf, int num); int rand_priv_bytes_ex(OPENSSL_CTX *ctx, unsigned char *buf, int num); @@ -16,9 +16,9 @@ rand_bytes_ex, rand_priv_bytes_ex rand_bytes_ex() and rand_priv_bytes_ex() are the equivalent of RAND_bytes() and RAND_priv_bytes() in the public API except that they both take an additional -B parameter. +I parameter. The DRBG used for the operation is the public or private DRBG associated with -the specified B. The parameter can be NULL, in which case +the specified I. The parameter can be NULL, in which case the default library ctx is used. If the default RAND_METHOD has been changed then for compatibility reasons the RAND_METHOD will be used in preference and the DRBG of the library context diff --git a/doc/internal/man7/build.info.pod b/doc/internal/man7/build.info.pod new file mode 100644 index 00000000..742f78ce --- /dev/null +++ b/doc/internal/man7/build.info.pod @@ -0,0 +1,602 @@ +=pod + +=head1 NAME + +build.info - Building information files + +=head1 SYNOPSIS + +B0|1B<]> + +B0|1B<]> + +B + +B + +B I ... + +B I ... + +B I ... + +B I ... + +B I ... + +BIB<]=> I ... + +BIB<]=> I I ... + +BIB<]=> I ... + +BIB<]=> I ... + +BIB<]=> I[B<=>I] ... + +BIB<]=> I ... + +B<$>IB<=>I + +=head1 DESCRIPTION + +OpenSSL's build system revolves around three questions: + +=over 4 + +=item What to build for? + +This is about choice of platform (combination of hardware, operating +system, and toolchain). + +=item What to build? + +This is about having all the information on what needs to be built and +from what. + +=item How to build it? + +This is about build file generation. + +=back + +This document is all about the second item, "What to build?", and most +of all, how to specify that information. + +For some terms used in this document, please see the L at +the end. + +=head2 F files + +F files are meta data files for OpenSSL's built file +generators, and are used to specify exactly what end product files +(programs, libraries, modules or scripts) are to be produced, and from +what sources. + +Intermediate files, such as object files, are seldom refered to at +all. They sometimes can be, if there's a need, but this should happen +very rarely, and support for that sort of thing is added on as-needed +basis. + +Any time a directory or file is expected in a statement value, Unix +syntax must be used, which means that the slash C must be used as +the directory separator. + +=head2 General syntax + +=head3 Comments + +Comments are any line that start with a hash sign (C<#>). The hash +sign may be preceded by any number of horizontal spaces. + +=head3 Filenames + +F files are platform agnostic. This means that there is +some information in them that is representative rather than specific. + +This is particularly visible with end product names, they work more +like a tag than as the actual filename that's going to be produced. +This is because different platforms have different decorations on +different types of files. + +For example, if we say that we want to produce a program C, it +would look like this: + + PROGRAM=foo + +However, the program filename may end up being just C (typical +for Unix), or C (typical for Windows), or even C +(possible on VMS, depending on policy). + +These platform specific decorations are not the concern of +F files. The build file generators are responsible for +transforming these platform agnostic names to their platform specific +counterparts. + +=head3 Statements + +With the exception of variables and conditions, the general statement +syntax is one of: + +=over 4 + +=item B> B<=> I ... + +=item B[>IB<]> B<=> I ... + +=back + +Every B> represents some particular type of information. + +The first form (sometimes called "plain statement") is used to specify +information on what end products need to be built, for example: + + PROGRAMS=foo bar + LIBS=libpoly libcookie + MODULES=awesome-plugin + SCRIPTS=tool1 tool2 + SUBDIRS=dir1 dir2 + +This says that we want to build programs C and C, the +libraries C and C, an awesome plugin module +C, a couple of scripts C and C, and +finally that there are more F files in subdirectories +C and C. + +The second form (sometimes called "indexed statement") is used to +specify further details for existing items, for example: + + SOURCE[foo]=foo.c details.c + DEPEND[foo]=libcookie + +This says that the program C is built from the source files +F and F, and that it depends on the library +C (in other words, the library will be included when +linking that program together). + +For any indexed statement for which the item hasn't been specified +through any plain statement, or where the item exists but the indexed +statement does not apply, the value is simply ignored by the build +file generators. + +=head3 Statement attributes + +Some statements can have attributes added to them, to allow for +variations on how they are treated. + +=over 4 + +=item B{> I | IB<=>I [,...]B<}> +B<=> I ... + +=item B[>IB<]{> I | IB<=>I +[,...]B<}> B<=> I ... + +=back + +Attributes are passed as they are to the build file generators, and +the exact interpretation of those attributes is entirely up to them +(see L below for details). + +A current example: + + LIBS{noinst,has_main}=libtestutil.a + +This says that the static library C should not be +installed (C), and that it includes an object file that has +the C
symbol (C). Most platforms don't need to know +the latter, but there are some where the program linker will not look +for C
in libraries unless it's explicitly told so, so this is +way to tell the build file generator to emit the necessary command +options to make that happen. + +Attributes are accumulated globally. This means that a library could +be given like this in different places: + + # Location 1 + LIBS=libwhatever + + # Location 2 + LIBS{noinst}=libwhatever + + # Location 3 + LIBS{has_main}=libwhatever + +The end result is that the library C will have the +attributes C and C attached to it. + +=head3 Quoting and tokens + +Statement values are normally split into a list of tokens, separated +by spaces. + +To avoid having a value split up into several tokens, they may be +quoted with double (C<">) or single (C<'>) quotes. + +For example: + + PROGRAMS=foo "space cadet" bar + +This says that we sant to build three programs, C, C +and C. + +=head3 Conditionals + +F files include a very simple condition system, involving +the following keywords: + +=over 4 + +=item B0|1B<]> + +=item B0|1B<]> + +=item B + +=item B + +=back + +This works like any condition system with similar syntax, and the +condition value in B and B can really be any literal value +that perl can interpret as true or false. + +Conditional statements are nesting. + +In itself, this is not very powerful, but together with L, +it can be. + +=head3 Variables + +F handles simple variables. They are defined by +assignment: + +=over 4 + +=item B<$>I B<=> I + +=back + +These variables can then be used as part of any statement value or +indexed statement item. This should be used with some care, as +I. + +I + +=head2 Scope + +Most of the statement values are accumulated globally from all the +F files that are digested. There are two exceptions, +F variables and B statement, for which the scope +is the F file they are in. + +=head2 Perl nuggets + +Whenever a F file is read, it is passed through the Perl +template processor L, which is a small extension of +L. + +Perl nuggets are anything between C<{-> and C<-}>, and whatever the +result from such a nugget is, that value will replace the nugget in +text form. This is useful to get dynamically generated F +statements, and is most often seen used together with the B and +B conditional statements. + +For example: + + IF[{- $disabled{something} -}] + # do whatever's needed when "something" is disabled + ELSIF[{- $somethingelse eq 'blah' -}] + # do whatever's needed to satisfy this condition + ELSE + # fallback + ENDIF + +Normal Perl scope applies, so it's possible to have an initial perl +nugget that sets diverse global variables that are used in later +nuggets. Each nugget is a Perl block of its own, so B definitions +are only in scope within the same nugget, while B definitions are +in scope within the whole F file. + +=head1 REFERENCE + +=head2 Conditionals + +=over 4 + +=item B0|1B<]> + +If the condition is true (represented as C<1> here), everything +between this B and the next corresponding B or B +applies, and the rest until the corresponding B is skipped +over. + +If the condition is false (represented as C<0> here), everything +from this B is skipped over until the next corresponding B +or B, at which point processing continues. + +=item B + +If F statements have been skipped over to this point since +the corresponding B or B, F processing starts +again following this line. + +=item B0|1B<]> + +This is B and B combined. + +=item B + +Marks the end of a conditional. + +=back + +=head2 Plain statements + +=over 4 + +=item B I ... + +This instructs the F reader to also read the F +file in every specified directory. All directories should be given +relative to the location of the current F file. + +=item B I ... + +Collects names of programs that should be built. + +B statements may have attributes, which apply to all the +programs given in such a statement. For example: + + PROGRAMS=foo + PROGRAMS{noinst}=bar + +With those two lines, the program C will not have the attribute +C, while the program C will. + +=item B I ... + +Collects names of libraries that should be built. + +The normal case is that libraries are built in both static and shared +form. However, if a name ends with C<.a>, only the static form will +be produced. + +Similarly, libraries may be referred in indexed statements as just the +plain name, or the name including the ending C<.a>. If given without +the ending C<.a>, any form available will be used, but if given with +the ending C<.a>, the static library form is used unconditionally. + +B statements may have attributes, which apply to all the +libraries given in such a statement. For example: + + LIBS=libfoo + LIBS{noinst}=libbar + +With those two lines, the library C will not have the +attribute C, while the library C will. + +=item B I + +Collects names of dynamically loadable modules that should be built. + +B statements may have attributes, which apply to all the +modules given in such a statement. For example: + + MODULES=foo + MODULES{noinst}=bar + +With those two lines, the module C will not have the attribute +C, while the module C will. + +=item B I + +Collects names of scripts that should be built, or that just exist. +That is how they differ from programs, as programs are always expected +to be compiled from multiple sources. + +B statements may have attributes, which apply to all the +scripts given in such a statement. For example: + + SCRIPTS=foo + SCRIPTS{noinst}=bar + +With those two lines, the script C will not have the attribute +C, while the script C will. + +=back + +=head2 Indexed statements + +=over 4 + +=item BIB<]> B<=> I ... + +Collects dependencies, where I depends on the given Is. + +As a special case, the I may be empty, for which the build file +generators should make the whole build depend on the given Is, +rather than some specific I. + +The I may be any program, library, module, script, or any +filename used as a value anywhere. + +B statements may have attributes, which apply to each +individual dependency in such a statement. For example: + + DEPEND[libfoo.a]=libmandatory.a + DEPEND[libfoo.a]{weak}=libbar.a libcookie.a + +With those statements, the dependency between C and +C is strong, while the dependency between C +and C and C is weak. See the description of +B in L for more information. + +=item BIB<]> B<=> I I ... + +This specifies that the I is generated using the I +with the Is as arguments, plus the name of the output +file as last argument. + +For Is where this is applicable, any B statement +for the same I will be given to the I as its +inclusion directories. Likewise, any B statement for the same +I will be given to the I as an extra file or module +to load, where this is applicable. + +The build file generators must be able to recognise the I. +Currently, they at least recognise files ending in C<.pl>, and will +execute them to generate the I, and files ending in C<.in>, +which will be used as input for L to generate +I (in other words, we use the exact same style of +L mechanism that is used to read F files). + +=item BIB<]> B<=> I ... + +Collects filenames that will be used as source files for I. + +The I must be a singular item, and may be any program, library, +module or script given with B, B, B and +B. + +Static libraries may be sources. In that case, its object files are +used directly when building I instead of relying on library +dependency and symbol resolution (through B statements). + +=item BIB<]> B<=> I ... + +Collects filenames that will be used as source files for I. + +The I must be a singular item, and may be any library or module +given with B or B. For libraries, the given filenames +are only used for their shared form, so if the item is a library name +ending with C<.a>, the filenames will be ignored. + +=item BIB<]> B<=> I[B<=>I] ... + +Collects I / I pairs (or just I with no defined +value if no I is given) associated with I. + +The build file generators will decide what to do with them. For +example, these pairs should become C macro definitions whenever a +C<.c> file is built into an object file. + +=item BIB<]> B<=> I ... + +Collects inclusion directories that will be used when building the +I components (object files and whatever else). This is used at +the discretion of the build file generators. + +=back + +=head2 Known attributes + +Note: this will never be a complete list of attributes. + +=over 4 + +=item B + +This is used to specify that the end products this is set for should +not be installed, that they are only internal. This is applicable on +internal static libraries, or on test programs. + +=item B + +This is used with B, to specify that some scripts should be +installed in the "misc" directory rather than the normal program +directory. + +=item B + +This is used with B, to specify what modules are engines and +should be installed in the engines directory instead of the modules +directory. + +=item B + +This is used with B where libraries are involved, to specify +that the dependency between two libraries is weak and is only there to +infer order. + +Without this attribute, a dependency between two libraries, expressed +like this, means that if C appears in a linking command +line, so will C: + + DEPEND[libfoo.a]=libmandatory.a + +With this attribute, a dependency between two libraries, expressed +like this, means that if I C and C +appear in a linking command line (because of recursive dependencies +through other libraries), they will be ordered in such a way that this +dependency is maintained: + + DEPEND[libfoo.a]{weak}=libfoo.a libcookie.a + +This is useful in complex dependecy trees where two libraries can be +used as alternatives for each other. In this example, C and +C have alternative implementations of the same thing, and +C has unresolved references to that same thing, and is +therefore depending on either of them, but not both at the same time: + + DEPEND[program1]=libmandatory.a lib1.a + DEPEND[program2]=libmandatory.a lib2.a + DEPEND[libmandatory]{weak}=lib1.a lib2.a + +=back + +=head1 GLOSSARY + +=over 4 + +=item "build file" + +This is any platform specific file that describes the complete build, +with platform specific commands. On Unix, this is typically +F; on VMS, this is typically F. + +=item "build file generator" + +Perl code that generates build files, given configuration data and +data collected from F files. + +=item "plain statement" + +Any F statement of the form B>=I, with +the exception of conditional statements and variable assignments. + +=item "indexed statement" + +Any F statement of the form B[>IB<]=>I, +with the exception of conditional statements. + +=item "intermediate file" + +Any file that's an intermediate between a source file and an end +product. + +=item "end product" + +Any file that is mentioned in the B, B, B or +B. + +=back + +=head1 SEE ALSO + +For OpenSSL::Template documentation, +C + +L + +=head1 COPYRIGHT + +Copyright 2019 The OpenSSL Project Authors. All Rights Reserved. + +Licensed under the Apache License 2.0 (the "License"). You may not use this +file except in compliance with the License. You can obtain a copy in the file +LICENSE in the source distribution or at +L. + +=cut diff --git a/doc/man1/CA.pl.pod b/doc/man1/CA.pl.pod index b055622b..db444d56 100644 --- a/doc/man1/CA.pl.pod +++ b/doc/man1/CA.pl.pod @@ -21,18 +21,18 @@ B<-signCA> | B<-signcert> | B<-crl> | B<-newca> -[B<-extra-cmd> extra-params] +[B<-extra-cmd> I] -B B<-pkcs12> [B<-extra-pkcs12> extra-params] [B] +B B<-pkcs12> [B<-extra-pkcs12> I] [I] -B B<-verify> [B<-extra-verify> extra-params] B... +B B<-verify> [B<-extra-verify> I] I ... -B B<-revoke> [B<-extra-ca> extra-params] B [B] +B B<-revoke> [B<-extra-ca> I] I [I] =head1 DESCRIPTION The B script is a perl script that supplies the relevant command line -arguments to the B command for some common certificate operations. +arguments to the L command for some common certificate operations. It is intended to simplify the process of certificate creation and management by the use of some simple options. @@ -47,19 +47,19 @@ Prints a usage message. =item B<-newcert> Creates a new self signed certificate. The private key is written to the file -"newkey.pem" and the request written to the file "newreq.pem". -This argument invokes B command. +F and the request written to the file F. +Invokes L. =item B<-newreq> Creates a new certificate request. The private key is written to the file -"newkey.pem" and the request written to the file "newreq.pem". -Executes B command below the hood. +F and the request written to the file F. +Executes L under the hood. =item B<-newreq-nodes> Is like B<-newreq> except that the private key will not be encrypted. -Uses B command. +Uses L. =item B<-newca> @@ -67,68 +67,66 @@ Creates a new CA hierarchy for use with the B program (or the B<-signcert> and B<-xsign> options). The user is prompted to enter the filename of the CA certificates (which should also contain the private key) or by hitting ENTER details of the CA will be prompted for. The relevant files and directories -are created in a directory called "demoCA" in the current directory. -B and B commands are get invoked. +are created in a directory called F in the current directory. +Uses L and L. =item B<-pkcs12> Create a PKCS#12 file containing the user certificate, private key and CA certificate. It expects the user certificate and private key to be in the -file "newcert.pem" and the CA certificate to be in the file demoCA/cacert.pem, -it creates a file "newcert.p12". This command can thus be called after the +file F and the CA certificate to be in the file F, +it creates a file F. This command can thus be called after the B<-sign> option. The PKCS#12 file can be imported directly into a browser. If there is an additional argument on the command line it will be used as the "friendly name" for the certificate (which is typically displayed in the browser list box), otherwise the name "My Certificate" is used. -Delegates work to B command. +Delegates work to L. =item B<-sign>, B<-signcert>, B<-xsign> -Calls the B program to sign a certificate request. It expects the request -to be in the file "newreq.pem". The new certificate is written to the file -"newcert.pem" except in the case of the B<-xsign> option when it is written -to standard output. Leverages B command. +Calls the L command to sign a certificate request. It expects the +request to be in the file F. The new certificate is written to the +file F except in the case of the B<-xsign> option when it is +written to standard output. =item B<-signCA> This option is the same as the B<-signreq> option except it uses the configuration file section B and so makes the signed request a valid CA certificate. This is useful when creating intermediate CA from -a root CA. Extra params are passed on to B command. +a root CA. Extra params are passed to L. =item B<-signcert> This option is the same as B<-sign> except it expects a self signed certificate -to be present in the file "newreq.pem". -Extra params are passed on to B and B commands. +to be present in the file F. +Extra params are passed to L and L. =item B<-crl> -Generate a CRL. Executes B command. +Generate a CRL. Executes L. -=item B<-revoke certfile [reason]> +=item B<-revoke> I [I] Revoke the certificate contained in the specified B. An optional reason may be specified, and must be one of: B, B, B, B, B, B, B, or B. -Leverages B command. +Leverages L. =item B<-verify> -Verifies certificates against the CA certificate for "demoCA". If no +Verifies certificates against the CA certificate for F. If no certificates are specified on the command line it tries to verify the file -"newcert.pem". Invokes B command. +F. Invokes L. -=item B<-extra-req> | B<-extra-ca> | B<-extra-pkcs12> | B<-extra-x509> | B<-extra-verify> +=item B<-extra-req> | B<-extra-ca> | B<-extra-pkcs12> | B<-extra-x509> | B<-extra-verify> I -The purpose of these parameters is to allow optional parameters to be supplied -to B that this command executes. The B<-extra-cmd> are specific to the -option being used and the B command getting invoked. For example -when this command invokes B extra parameters can be passed on -with the B<-extra-req> parameter. The -B commands being invoked per option are documented below. -Users should consult B command documentation for more information. +For each option B>, pass I to the L +sub-command with the same name as I, if that sub-command is invoked. +For example, if L is invoked, the I given with +B<-extra-req> will be passed to it. +Users should consult L command documentation for more information. =back @@ -149,7 +147,7 @@ the request and finally create a PKCS#12 file containing it. =head1 DSA CERTIFICATES Although the B creates RSA CAs and requests it is still possible to -use it with DSA certificates and requests using the L command +use it with DSA certificates and requests using the L command directly. The following example shows the steps that would typically be taken. Create some DSA parameters: @@ -164,7 +162,8 @@ Create the CA directories and files: CA.pl -newca -enter cacert.pem when prompted for the CA file name. +enter a filename (for example, F) when prompted for the CA file +name. Create a DSA certificate request and private key (a different set of parameters can optionally be created first): @@ -193,9 +192,10 @@ be wrong. In this case the command: can be used and the B environment variable changed to point to the correct path of the configuration file. -The script is intended as a simple front end for the B program for use -by a beginner. Its behaviour isn't always what is wanted. For more control over the -behaviour of the certificate commands call the B command directly. +The script is intended as a simple front end for the L program for +use by a beginner. Its behaviour isn't always what is wanted. For more control +over the behaviour of the certificate commands call the L command +directly. =head1 SEE ALSO diff --git a/doc/man1/openssl-asn1parse.pod b/doc/man1/openssl-asn1parse.pod index ccb2f034..5e755596 100644 --- a/doc/man1/openssl-asn1parse.pod +++ b/doc/man1/openssl-asn1parse.pod @@ -8,26 +8,26 @@ openssl-asn1parse - ASN.1 parsing tool B B [B<-help>] -[B<-inform PEM|DER>] -[B<-in filename>] -[B<-out filename>] +[B<-inform> B|B] +[B<-in> I] +[B<-out> I] [B<-noout>] -[B<-offset number>] -[B<-length number>] +[B<-offset> I] +[B<-length> I] [B<-i>] -[B<-oid filename>] +[B<-oid> I] [B<-dump>] -[B<-dlimit num>] -[B<-strparse offset>] -[B<-genstr string>] -[B<-genconf file>] +[B<-dlimit> I] +[B<-strparse> I] +[B<-genstr> I] +[B<-genconf> I] [B<-strictpem>] -[B<-item name>] +[B<-item> I] =head1 DESCRIPTION -The B command is a diagnostic utility that can parse ASN.1 -structures. It can also be used to extract data from ASN.1 formatted data. +This command is a diagnostic utility that can parse ASN.1 structures. +It can also be used to extract data from ASN.1 formatted data. =head1 OPTIONS @@ -37,16 +37,16 @@ structures. It can also be used to extract data from ASN.1 formatted data. Print out a usage message. -=item B<-inform> B +=item B<-inform> B|B The input format. B is binary format and B (the default) is base64 encoded. -=item B<-in filename> +=item B<-in> I The input file, default is standard input. -=item B<-out filename> +=item B<-out> I Output file to place the DER encoded data into. If this option is not present then no data will be output. This is most useful when @@ -56,11 +56,11 @@ combined with the B<-strparse> option. Don't output the parsed version of the input file. -=item B<-offset number> +=item B<-offset> I Starting offset to begin parsing, default is start of file. -=item B<-length number> +=item B<-length> I Number of bytes to parse, default is until end of file. @@ -68,7 +68,7 @@ Number of bytes to parse, default is until end of file. Indents the output according to the "depth" of the structures. -=item B<-oid filename> +=item B<-oid> I A file containing additional OBJECT IDENTIFIERs (OIDs). The format of this file is described in the NOTES section below. @@ -77,23 +77,23 @@ file is described in the NOTES section below. Dump unknown data in hex format. -=item B<-dlimit num> +=item B<-dlimit> I Like B<-dump>, but only the first B bytes are output. -=item B<-strparse offset> +=item B<-strparse> I Parse the contents octets of the ASN.1 object starting at B. This option can be used multiple times to "drill down" into a nested structure. -=item B<-genstr string>, B<-genconf file> +=item B<-genstr> I, B<-genconf> I -Generate encoded data based on B, B or both using -L format. If B only is +Generate encoded data based on I, I or both using +L format. If I only is present then the string is obtained from the default section using the name B. The encoded data is passed through the ASN1 parser and printed out as though it came from a file, the contents can thus be examined and written to a -file using the B option. +file using the B<-out> option. =item B<-strictpem> @@ -103,10 +103,11 @@ processed whether it has the normal PEM BEGIN and END markers or not. This option will ignore any data prior to the start of the BEGIN marker, or after an END marker in a PEM file. -=item B<-item name> +=item B<-item> I -Attempt to decode and print the data as B. This can be used to -print out the fields of any supported ASN.1 structure if the type is known. +Attempt to decode and print the data as an B I. This can be +used to print out the fields of any supported ASN.1 structure if the type is +known. =back @@ -132,9 +133,9 @@ The output will typically contain lines like this: ..... This example is part of a self-signed certificate. Each line starts with the -offset in decimal. B specifies the current depth. The depth is increased -within the scope of any SET or SEQUENCE. B gives the header length -(tag and length octets) of the current type. B gives the length of +offset in decimal. C specifies the current depth. The depth is increased +within the scope of any SET or SEQUENCE. C gives the header length +(tag and length octets) of the current type. C gives the length of the contents octets. The B<-i> option can be used to make the output more readable. @@ -143,7 +144,7 @@ Some knowledge of the ASN.1 structure is needed to interpret the output. In this example the BIT STRING at offset 229 is the certificate public key. The contents octets of this will contain the public key information. This can -be examined using the option B<-strparse 229> to yield: +be examined using the option C<-strparse 229> to yield: 0:d=0 hl=3 l= 137 cons: SEQUENCE 3:d=1 hl=3 l= 129 prim: INTEGER :E5D21E1F5C8D208EA7A2166C7FAF9F6BDF2059669C60876DDB70840F1A5AAFA59699FE471F379F1DD6A487E7D5409AB6A88D4A9746E24B91D8CF55DB3521015460C8EDE44EE8A4189F7A7BE77D6CD3A9AF2696F486855CF58BF0EDF2B4068058C7A947F52548DDF7E15E96B385F86422BEA9064A3EE9E1158A56E4A6F47E5897 @@ -157,10 +158,13 @@ allows additional OIDs to be included. Each line consists of three columns, the first column is the OID in numerical format and should be followed by white space. The second column is the "short name" which is a single word followed by white space. The final column is the rest of the line and is the -"long name". B displays the long name. Example: +"long name". Example: C<1.2.3.4 shortName A long name> +For any OID with an associated short and long name, this command will display +the long name. + =head1 EXAMPLES Parse a file: diff --git a/doc/man1/openssl-ca.pod b/doc/man1/openssl-ca.pod index 9826fbfc..5ff5fd95 100644 --- a/doc/man1/openssl-ca.pod +++ b/doc/man1/openssl-ca.pod @@ -9,59 +9,61 @@ openssl-ca - sample minimal CA application B B [B<-help>] [B<-verbose>] -[B<-config filename>] -[B<-name section>] +[B<-config> I] +[B<-name> I
] [B<-gencrl>] -[B<-revoke file>] -[B<-valid file>] -[B<-status serial>] +[B<-revoke> I] +[B<-valid> I] +[B<-status> I] [B<-updatedb>] -[B<-crl_reason reason>] -[B<-crl_hold instruction>] -[B<-crl_compromise time>] -[B<-crl_CA_compromise time>] -[B<-crldays days>] -[B<-crlhours hours>] -[B<-crlexts section>] -[B<-startdate date>] -[B<-enddate date>] -[B<-days arg>] -[B<-md arg>] -[B<-policy arg>] -[B<-keyfile arg>] -[B<-keyform PEM|DER>] -[B<-key arg>] -[B<-passin arg>] -[B<-cert file>] +[B<-crl_reason> I] +[B<-crl_hold> I] +[B<-crl_compromise> I
] +[B<-startdate> I] +[B<-enddate> I] +[B<-days> I] +[B<-md> I] +[B<-policy> I] +[B<-keyfile> I] +[B<-keyform> B|B] +[B<-key> I] +[B<-passin> I] +[B<-cert> I] [B<-selfsign>] -[B<-in file>] -[B<-out file>] +[B<-in> I] +[B<-out> I] [B<-notext>] -[B<-outdir dir>] +[B<-outdir> I] [B<-infiles>] -[B<-spkac file>] -[B<-ss_cert file>] +[B<-spkac> I] +[B<-ss_cert> I] [B<-preserveDN>] [B<-noemailDN>] [B<-batch>] [B<-msie_hack>] -[B<-extensions section>] -[B<-extfile section>] -[B<-engine id>] -[B<-subj arg>] +[B<-extensions> I
] +[B<-extfile> I
] +[B<-engine> I] +[B<-subj> I] [B<-utf8>] -[B<-sigopt nm:v>] +[B<-sigopt> I:I] [B<-create_serial>] [B<-rand_serial>] [B<-multivalue-rdn>] -[B<-rand file...>] -[B<-writerand file>] -[B<-sm2-id string>] -[B<-sm2-hex-id hex-string>] +[B<-rand> I] +[B<-writerand> I] +[B<-sm2-id> I] +[B<-sm2-hex-id> I] + +=for openssl ifdef engine sm2-id sm2-hex-id =head1 DESCRIPTION -The B command is a minimal CA application. It can be used +This command is a minimal CA application. It can be used to sign certificate requests in a variety of forms and generate CRLs it also maintains a text database of issued certificates and their status. @@ -80,27 +82,27 @@ Print out a usage message. This prints extra details about the operations being performed. -=item B<-config filename> +=item B<-config> I Specifies the configuration file to use. Optional; for a description of the default value, see L. -=item B<-name section> +=item B<-name> I
Specifies the configuration file section to use (overrides B in the B section). -=item B<-in filename> +=item B<-in> I An input filename containing a single certificate request to be signed by the CA. -=item B<-ss_cert filename> +=item B<-ss_cert> I A single self-signed certificate to be signed by the CA. -=item B<-spkac filename> +=item B<-spkac> I A file containing a single Netscape signed public key and challenge and additional field values to be signed by the CA. See the B @@ -111,41 +113,41 @@ section for information on the required input and output format. If present this should be the last option, all subsequent arguments are taken as the names of files containing certificate requests. -=item B<-out filename> +=item B<-out> I The output file to output certificates to. The default is standard output. The certificate details will also be printed out to this file in PEM format (except that B<-spkac> outputs DER format). -=item B<-outdir directory> +=item B<-outdir> I The directory to output certificates to. The certificate will be written to a filename consisting of the serial number in hex with -".pem" appended. +F<.pem> appended. =item B<-cert> The CA certificate file. -=item B<-keyfile filename> +=item B<-keyfile> I The private key to sign requests with. -=item B<-keyform PEM|DER> +=item B<-keyform> B|B The format of the data in the private key file. The default is PEM. -=item B<-sigopt nm:v> +=item B<-sigopt> I:I Pass options to the signature algorithm during sign or verify operations. Names and values of these options are algorithm-specific. -=item B<-key password> +=item B<-key> I The password used to encrypt the private key. Since on some systems the command line arguments are visible (e.g. Unix with -the 'ps' utility) this option should be used with caution. +the L utility) this option should be used with caution. =item B<-selfsign> @@ -161,41 +163,41 @@ certificate appears among the entries in the certificate database serial number counter as all other certificates sign with the self-signed certificate. -=item B<-passin arg> +=item B<-passin> I The key password source. For more information about the format of B -see the B section in L. +see L. =item B<-notext> Don't output the text form of a certificate to the output file. -=item B<-startdate date> +=item B<-startdate> I This allows the start date to be explicitly set. The format of the date is YYMMDDHHMMSSZ (the same as an ASN1 UTCTime structure), or YYYYMMDDHHMMSSZ (the same as an ASN1 GeneralizedTime structure). In both formats, seconds SS and timezone Z must be present. -=item B<-enddate date> +=item B<-enddate> I This allows the expiry date to be explicitly set. The format of the date is YYMMDDHHMMSSZ (the same as an ASN1 UTCTime structure), or YYYYMMDDHHMMSSZ (the same as an ASN1 GeneralizedTime structure). In both formats, seconds SS and timezone Z must be present. -=item B<-days arg> +=item B<-days> I The number of days to certify the certificate for. -=item B<-md alg> +=item B<-md> I The message digest to use. -Any digest supported by the OpenSSL B command can be used. For signing +Any digest supported by the L command can be used. For signing algorithms that do not support a digest (i.e. Ed25519 and Ed448) any message digest that is set is ignored. This option also applies to CRLs. -=item B<-policy arg> +=item B<-policy> I This option defines the CA "policy" to use. This is a section in the configuration file which decides which fields should be mandatory @@ -204,8 +206,8 @@ for more information. =item B<-msie_hack> -This is a deprecated option to make B work with very old versions of -the IE certificate enrollment control "certenr3". It used UniversalStrings +This is a deprecated option to make this command work with very old versions +of the IE certificate enrollment control "certenr3". It used UniversalStrings for almost everything. Since the old control has various security bugs its use is strongly discouraged. @@ -231,7 +233,7 @@ used in the configuration file to enable this behaviour. This sets the batch mode. In this mode no questions will be asked and all certificates will be certified automatically. -=item B<-extensions section> +=item B<-extensions> I
The section of the configuration file containing certificate extensions to be added when a certificate is issued (defaults to B @@ -241,24 +243,25 @@ is present (even if it is empty), then a V3 certificate is created. See the L manual page for details of the extension section format. -=item B<-extfile file> +=item B<-extfile> I An additional configuration file to read certificate extensions from (using the default section unless the B<-extensions> option is also used). -=item B<-engine id> +=item B<-engine> I -Specifying an engine (by its unique B string) will cause B +Specifying an engine (by its unique I string) will cause B to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default for all available algorithms. -=item B<-subj arg> +=item B<-subj> I Supersedes subject name given in the request. -The arg must be formatted as I. -Keyword characters may be escaped by \ (backslash), and whitespace is retained. +The arg must be formatted as C. +Keyword characters may be escaped by C<\> (backslash), and whitespace is +retained. Empty values are permitted, but the corresponding type will not be included in the resulting certificate. @@ -287,29 +290,20 @@ This overrides any option or configuration to use a serial number file. This option causes the -subj argument to be interpreted with full support for multivalued RDNs. Example: -I +C -If -multi-rdn is not used then the UID value is I<123456+CN=John Doe>. +If B<-multi-rdn> is not used then the UID value is C<123456+CN=John Doe>. -=item B<-rand file...> +=item B<-rand> I, B<-writerand> I -A file or files containing random data used to seed the random number -generator. -Multiple files can be specified separated by an OS-dependent character. -The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for -all others. +See L for more information. -=item [B<-writerand file>] - -Writes random data to the specified I upon exit. -This can be used with a subsequent B<-rand> flag. - -=item B<-sm2-id> +=item B<-sm2-id> I Specify the ID string to use when verifying an SM2 certificate. The ID string is required by the SM2 signature algorithm for signing and verification. -=item B<-sm2-hex-id> +=item B<-sm2-hex-id> I Specify a binary ID string to use when signing or verifying using an SM2 certificate. The argument for this option is string of hexadecimal digits. @@ -324,24 +318,24 @@ certificate. The argument for this option is string of hexadecimal digits. This option generates a CRL based on information in the index file. -=item B<-crldays num> +=item B<-crldays> I The number of days before the next CRL is due. That is the days from now to place in the CRL nextUpdate field. -=item B<-crlhours num> +=item B<-crlhours> I The number of hours before the next CRL is due. -=item B<-revoke filename> +=item B<-revoke> I A filename containing a certificate to revoke. -=item B<-valid filename> +=item B<-valid> I A filename containing a certificate to add a Valid certificate entry. -=item B<-status serial> +=item B<-status> I Displays the revocation status of the certificate with the specified serial number and exits. @@ -350,34 +344,34 @@ serial number and exits. Updates the database index to purge expired certificates. -=item B<-crl_reason reason> +=item B<-crl_reason> I -Revocation reason, where B is one of: B, B, +Revocation reason, where I is one of: B, B, B, B, B, B, -B or B. The matching of B is case +B or B. The matching of I is case insensitive. Setting any revocation reason will make the CRL v2. In practice B is not particularly useful because it is only used in delta CRLs which are not currently implemented. -=item B<-crl_hold instruction> +=item B<-crl_hold> I This sets the CRL revocation reason code to B and the hold -instruction to B which must be an OID. Although any OID can be +instruction to I which must be an OID. Although any OID can be used only B (the use of which is discouraged by RFC2459) B or B will normally be used. -=item B<-crl_compromise time> +=item B<-crl_compromise> I