Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update.

Browse Source
This commit is contained in:
Hakase
2019-10-17 23:54:38 +09:00
parent 41a23ae6f6
commit ee84d0dd84
1357 changed files with 41111 additions and 9603 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/cms.c
+40 -22
View File
@@ -104,20 +104,29 @@ const OPTIONS cms_options[] = {
{"resign", OPT_RESIGN, '-', "Resign a signed message"},
{"cades", OPT_CADES, '-', "Include signer certificate digest"},
{"verify", OPT_VERIFY, '-', "Verify signed message"},
{"verify_retcode", OPT_VERIFY_RETCODE, '-'},
{"verify_receipt", OPT_VERIFY_RECEIPT, '<'},
{"verify_retcode", OPT_VERIFY_RETCODE, '-',
"Exit non-zero on verification failure"},
{"verify_receipt", OPT_VERIFY_RECEIPT, '<',
"Verify receipts; exit if receipt signatures do not verify"},
{"cmsout", OPT_CMSOUT, '-', "Output CMS structure"},
{"data_out", OPT_DATA_OUT, '-'},
{"data_create", OPT_DATA_CREATE, '-'},
{"digest_verify", OPT_DIGEST_VERIFY, '-'},
{"digest_create", OPT_DIGEST_CREATE, '-'},
{"compress", OPT_COMPRESS, '-'},
{"uncompress", OPT_UNCOMPRESS, '-'},
{"EncryptedData_decrypt", OPT_ED_DECRYPT, '-'},
{"EncryptedData_encrypt", OPT_ED_ENCRYPT, '-'},
{"debug_decrypt", OPT_DEBUG_DECRYPT, '-'},
{"data_out", OPT_DATA_OUT, '-', "Copy CMS \"Data\" object to output"},
{"data_create", OPT_DATA_CREATE, '-', "Create a CMS \"Data\" object"},
{"digest_verify", OPT_DIGEST_VERIFY, '-',
"Verify a CMS \"DigestedData\" object and output it"},
{"digest_create", OPT_DIGEST_CREATE, '-',
"Create a CMS \"DigestedData\" object"},
{"compress", OPT_COMPRESS, '-', "Create a CMS \"CompressedData\" object"},
{"uncompress", OPT_UNCOMPRESS, '-', "Uncompress a CMS \"CompressedData\" object"},
{"EncryptedData_decrypt", OPT_ED_DECRYPT, '-',
"Decrypt CMS \"EncryptedData\" object using symmetric key"},
{"EncryptedData_encrypt", OPT_ED_ENCRYPT, '-',
"Create CMS \"EncryptedData\" object using symmetric key"},
{"debug_decrypt", OPT_DEBUG_DECRYPT, '-',
"Disable MMA protection and return an error if no recipient found"
" (see documentation)"},
{"text", OPT_TEXT, '-', "Include or delete text MIME headers"},
{"asciicrlf", OPT_ASCIICRLF, '-'},
{"asciicrlf", OPT_ASCIICRLF, '-',
"Perform CRLF canonicalisation when signing"},
{"nointern", OPT_NOINTERN, '-',
"Don't search certificates in message for signer"},
{"noverify", OPT_NOVERIFY, '-', "Don't verify signers certificate"},
@@ -129,16 +138,20 @@ const OPTIONS cms_options[] = {
{"binary", OPT_BINARY, '-', "Don't translate message to text"},
{"keyid", OPT_KEYID, '-', "Use subject key identifier"},
{"nosigs", OPT_NOSIGS, '-', "Don't verify message signature"},
{"no_content_verify", OPT_NO_CONTENT_VERIFY, '-'},
{"no_attr_verify", OPT_NO_ATTR_VERIFY, '-'},
{"no_content_verify", OPT_NO_CONTENT_VERIFY, '-',
"Do not verify signed content signatures"},
{"no_attr_verify", OPT_NO_ATTR_VERIFY, '-',
"Do not verify signed attribute signatures"},
{"stream", OPT_INDEF, '-', "Enable CMS streaming"},
{"indef", OPT_INDEF, '-', "Same as -stream"},
{"noindef", OPT_NOINDEF, '-', "Disable CMS streaming"},
{"crlfeol", OPT_CRLFEOL, '-', "Use CRLF as EOL termination instead of CR only" },
{"noout", OPT_NOOUT, '-', "For the -cmsout operation do not output the parsed CMS structure"},
{"receipt_request_print", OPT_RR_PRINT, '-', "Print CMS Receipt Request" },
{"receipt_request_all", OPT_RR_ALL, '-'},
{"receipt_request_first", OPT_RR_FIRST, '-'},
{"receipt_request_all", OPT_RR_ALL, '-',
"When signing, create a receipt request for all recipients"},
{"receipt_request_first", OPT_RR_FIRST, '-',
"When signing, create a receipt request for first recipient"},
{"rctform", OPT_RCTFORM, 'F', "Receipt file format"},
{"certfile", OPT_CERTFILE, '<', "Other certificates file"},
{"CAfile", OPT_CAFILE, '<', "Trusted certificates file"},
@@ -151,10 +164,13 @@ const OPTIONS cms_options[] = {
"Supply or override content for detached signature"},
{"print", OPT_PRINT, '-',
"For the -cmsout operation print out all fields of the CMS structure"},
{"secretkey", OPT_SECRETKEY, 's'},
{"secretkeyid", OPT_SECRETKEYID, 's'},
{"pwri_password", OPT_PWRI_PASSWORD, 's'},
{"econtent_type", OPT_ECONTENT_TYPE, 's'},
{"secretkey", OPT_SECRETKEY, 's',
"Use specified hex-encoded key to decrypt/encrypt recipients or content"},
{"secretkeyid", OPT_SECRETKEYID, 's',
"Identity of the -secretkey for CMS \"KEKRecipientInfo\" object"},
{"pwri_password", OPT_PWRI_PASSWORD, 's',
"Specific password for recipient"},
{"econtent_type", OPT_ECONTENT_TYPE, 's', "OID for external content"},
{"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
{"to", OPT_TO, 's', "To address"},
{"from", OPT_FROM, 's', "From address"},
@@ -167,8 +183,10 @@ const OPTIONS cms_options[] = {
"Input private key (if not signer or recipient)"},
{"keyform", OPT_KEYFORM, 'f', "Input private key format (PEM or ENGINE)"},
{"keyopt", OPT_KEYOPT, 's', "Set public key parameters as n:v pairs"},
{"receipt_request_from", OPT_RR_FROM, 's'},
{"receipt_request_to", OPT_RR_TO, 's'},
{"receipt_request_from", OPT_RR_FROM, 's',
"Create signed receipt request with specified email address"},
{"receipt_request_to", OPT_RR_TO, 's',
"Create signed receipt targeted to specified address"},
{"", OPT_CIPHER, '-', "Any supported cipher"},
OPT_R_OPTIONS,
OPT_V_OPTIONS,
apps/crl.c
+2 -2
View File
@@ -204,7 +204,7 @@ int crl_main(int argc, char **argv)
}
pkey = X509_get_pubkey(X509_OBJECT_get0_X509(xobj));
X509_OBJECT_free(xobj);
if (!pkey) {
if (pkey == NULL) {
BIO_printf(bio_err, "Error getting CRL issuer public key\n");
goto end;
}
@@ -228,7 +228,7 @@ int crl_main(int argc, char **argv)
if (!newcrl)
goto end;
pkey = load_key(keyfile, keyformat, 0, NULL, NULL, "CRL signing key");
if (!pkey) {
if (pkey == NULL) {
X509_CRL_free(newcrl);
goto end;
}
apps/fipsinstall.c
+1 -1
View File
@@ -341,7 +341,7 @@ opthelp:
if (opts != NULL) {
int ok = 1;
OSSL_PARAM *params =
app_params_new_from_opts(opts, EVP_MAC_CTX_settable_params(mac));
app_params_new_from_opts(opts, EVP_MAC_settable_ctx_params(mac));
if (params == NULL)
goto end;
apps/genpkey.c
+2 -2
View File
@@ -217,7 +217,7 @@ static int init_keygen_file(EVP_PKEY_CTX **pctx, const char *file, ENGINE *e)
}
pbio = BIO_new_file(file, "r");
if (!pbio) {
if (pbio == NULL) {
BIO_printf(bio_err, "Can't open parameter file %s\n", file);
return 0;
}
@@ -225,7 +225,7 @@ static int init_keygen_file(EVP_PKEY_CTX **pctx, const char *file, ENGINE *e)
pkey = PEM_read_bio_Parameters(pbio, NULL);
BIO_free(pbio);
if (!pkey) {
if (pkey == NULL) {
BIO_printf(bio_err, "Error reading parameter file %s\n", file);
return 0;
}
apps/include/apps.h
+3 -3
View File
@@ -7,8 +7,8 @@
* https://www.openssl.org/source/license.html
*/
#ifndef HEADER_APPS_H
# define HEADER_APPS_H
#ifndef OSSL_APPS_H
# define OSSL_APPS_H
# include "e_os.h" /* struct timeval for DTLS */
# include "internal/nelem.h"
@@ -21,7 +21,7 @@
# endif
# include <openssl/e_os2.h>
# include <openssl/ossl_typ.h>
# include <openssl/types.h>
# include <openssl/bio.h>
# include <openssl/x509.h>
# include <openssl/conf.h>
apps/include/apps_ui.h
+2 -2
View File
@@ -7,8 +7,8 @@
* https://www.openssl.org/source/license.html
*/
#ifndef HEADER_APPS_UI_H
# define HEADER_APPS_UI_H
#ifndef OSSL_APPS_UI_H
# define OSSL_APPS_UI_H
# define PW_MIN_LENGTH 4
apps/include/fmt.h
+3 -3
View File
@@ -14,8 +14,8 @@
* shared fields have been moved into this file.
*/
#ifndef HEADER_FMT_H
#define HEADER_FMT_H
#ifndef OSSL_APPS_FMT_H
#define OSSL_APPS_FMT_H
/* On some platforms, it's important to distinguish between text and binary
* files. On some, there might even be specific file formats for different
@@ -41,4 +41,4 @@
int FMT_istext(int format);
#endif /* HEADER_FMT_H_ */
#endif /* OSSL_APPS_FMT_H_ */
apps/include/function.h
+2 -2
View File
@@ -7,8 +7,8 @@
* https://www.openssl.org/source/license.html
*/
#ifndef APPS_FUNCTION_H
# define APPS_FUNCTION_H
#ifndef OSSL_APPS_FUNCTION_H
# define OSSL_APPS_FUNCTION_H
# include <openssl/lhash.h>
# include "opt.h"
apps/include/names.h
+17
View File
@@ -0,0 +1,17 @@
/*
* Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <openssl/safestack.h>
/* Standard comparing function for names */
int name_cmp(const char * const *a, const char * const *b);
/* collect_names is meant to be used with EVP_{type}_doall_names */
void collect_names(const char *name, void *vdata);
/* Sorts and prints a stack of names to |out| */
void print_names(BIO *out, STACK_OF(OPENSSL_CSTRING) *names);
apps/include/opt.h
+4 -4
View File
@@ -6,12 +6,12 @@
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#ifndef HEADER_OPT_H
#define HEADER_OPT_H
#ifndef OSSL_APPS_OPT_H
#define OSSL_APPS_OPT_H
#include <sys/types.h>
#include <openssl/e_os2.h>
#include <openssl/ossl_typ.h>
#include <openssl/types.h>
#include <stdarg.h>
/*
@@ -347,4 +347,4 @@ int opt_format_error(const char *s, unsigned long flags);
int opt_isdir(const char *name);
int opt_printf_stderr(const char *fmt, ...);
#endif /* HEADER_OPT_H */
#endif /* OSSL_APPS_OPT_H */
apps/include/platform.h
+2 -2
View File
@@ -7,8 +7,8 @@
* https://www.openssl.org/source/license.html
*/
#ifndef HEADER_PLATFORM_H
# define HEADER_PLATFORM_H
#ifndef OSSL_APPS_PLATFORM_H
# define OSSL_APPS_PLATFORM_H
# include <openssl/e_os2.h>
apps/include/vms_term_sock.h
+2 -2
View File
@@ -8,8 +8,8 @@
* https://www.openssl.org/source/license.html
*/
#ifndef TERM_SOCK_H
# define TERM_SOCK_H
#ifndef OSSL_APPS_VMS_TERM_SOCK_H
# define OSSL_APPS_VMS_TERM_SOCK_H
/*
** Terminal Socket Function Codes
apps/kdf.c
+1 -1
View File
@@ -96,7 +96,7 @@ opthelp:
if (opts != NULL) {
int ok = 1;
OSSL_PARAM *params =
app_params_new_from_opts(opts, EVP_KDF_CTX_settable_params(kdf));
app_params_new_from_opts(opts, EVP_KDF_settable_ctx_params(kdf));
if (params == NULL)
goto err;
apps/lib/apps.c
+28 -8
View File
@@ -85,7 +85,7 @@ int chopup_args(ARGS *arg, char *buf)
/* Skip whitespace. */
while (*p && isspace(_UC(*p)))
p++;
if (!*p)
if (*p == '\0')
break;
/* The start of something good :-) */
@@ -258,7 +258,7 @@ static char *app_get_pass(const char *arg, int keepbio)
#endif
} else if (strcmp(arg, "stdin") == 0) {
pwdbio = dup_bio_in(FORMAT_TEXT);
if (!pwdbio) {
if (pwdbio == NULL) {
BIO_printf(bio_err, "Can't open BIO for stdin\n");
return NULL;
}
@@ -407,7 +407,7 @@ static int load_pkcs12(BIO *in, const char *desc,
if (PKCS12_verify_mac(p12, "", 0) || PKCS12_verify_mac(p12, NULL, 0)) {
pass = "";
} else {
if (!pem_cb)
if (pem_cb == NULL)
pem_cb = (pem_password_cb *)password_callback;
len = pem_cb(tpass, PEM_BUFSIZE, 0, cb_data);
if (len < 0) {
@@ -1809,26 +1809,46 @@ unsigned char *next_protos_parse(size_t *outlen, const char *in)
size_t len;
unsigned char *out;
size_t i, start = 0;
size_t skipped = 0;
len = strlen(in);
if (len >= 65535)
if (len == 0 || len >= 65535)
return NULL;
out = app_malloc(strlen(in) + 1, "NPN buffer");
out = app_malloc(len + 1, "NPN buffer");
for (i = 0; i <= len; ++i) {
if (i == len || in[i] == ',') {
/*
* Zero-length ALPN elements are invalid on the wire, we could be
* strict and reject the entire string, but just ignoring extra
* commas seems harmless and more friendly.
*
* Every comma we skip in this way puts the input buffer another
* byte ahead of the output buffer, so all stores into the output
* buffer need to be decremented by the number commas skipped.
*/
if (i == start) {
++start;
++skipped;
continue;
}
if (i - start > 255) {
OPENSSL_free(out);
return NULL;
}
out[start] = (unsigned char)(i - start);
out[start-skipped] = (unsigned char)(i - start);
start = i + 1;
} else {
out[i + 1] = in[i];
out[i + 1 - skipped] = in[i];
}
}
*outlen = len + 1;
if (len <= skipped) {
OPENSSL_free(out);
return NULL;
}
*outlen = len + 1 - skipped;
return out;
}
apps/lib/build.info
+1 -1
View File
@@ -9,7 +9,7 @@ ENDIF
# Source for libapps
$LIBAPPSSRC=apps.c apps_ui.c opt.c fmt.c s_cb.c s_socket.c app_rand.c \
bf_prefix.c columns.c app_params.c
bf_prefix.c columns.c app_params.c names.c
IF[{- !$disabled{apps} -}]
LIBS{noinst}=../libapps.a
apps/lib/names.c
+48
View File
@@ -0,0 +1,48 @@
/*
* Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <string.h>
#include <openssl/bio.h>
#include <openssl/safestack.h>
#include "names.h"
#ifdef _WIN32
# define strcasecmp _stricmp
#endif
int name_cmp(const char * const *a, const char * const *b)
{
return strcasecmp(*a, *b);
}
void collect_names(const char *name, void *vdata)
{
STACK_OF(OPENSSL_CSTRING) *names = vdata;
sk_OPENSSL_CSTRING_push(names, name);
}
void print_names(BIO *out, STACK_OF(OPENSSL_CSTRING) *names)
{
int i = sk_OPENSSL_CSTRING_num(names);
int j;
sk_OPENSSL_CSTRING_sort(names);
if (i > 1)
BIO_printf(out, "{ ");
for (j = 0; j < i; j++) {
const char *name = sk_OPENSSL_CSTRING_value(names, j);
if (j > 0)
BIO_printf(out, ", ");
BIO_printf(out, "%s", name);
}
if (i > 1)
BIO_printf(out, " }");
}
apps/list.c
+59 -24
View File
@@ -17,6 +17,7 @@
#include "app_params.h"
#include "progs.h"
#include "opt.h"
#include "names.h"
static int verbose = 0;
@@ -38,7 +39,7 @@ DEFINE_STACK_OF(EVP_CIPHER)
static int cipher_cmp(const EVP_CIPHER * const *a,
const EVP_CIPHER * const *b)
{
int ret = strcasecmp(EVP_CIPHER_name(*a), EVP_CIPHER_name(*b));
int ret = EVP_CIPHER_number(*a) - EVP_CIPHER_number(*b);
if (ret == 0)
ret = strcmp(OSSL_PROVIDER_name(EVP_CIPHER_provider(*a)),
@@ -64,21 +65,29 @@ static void list_ciphers(void)
EVP_CIPHER_do_all_sorted(legacy_cipher_fn, bio_out);
BIO_printf(bio_out, "Provided:\n");
EVP_CIPHER_do_all_ex(NULL, collect_ciphers, ciphers);
EVP_CIPHER_do_all_provided(NULL, collect_ciphers, ciphers);
sk_EVP_CIPHER_sort(ciphers);
for (i = 0; i < sk_EVP_CIPHER_num(ciphers); i++) {
const EVP_CIPHER *c = sk_EVP_CIPHER_value(ciphers, i);
STACK_OF(OPENSSL_CSTRING) *names =
sk_OPENSSL_CSTRING_new(name_cmp);
BIO_printf(bio_out, " %s", EVP_CIPHER_name(c));
EVP_CIPHER_names_do_all(c, collect_names, names);
BIO_printf(bio_out, " ");
print_names(bio_out, names);
BIO_printf(bio_out, " @ %s\n",
OSSL_PROVIDER_name(EVP_CIPHER_provider(c)));
sk_OPENSSL_CSTRING_free(names);
if (verbose) {
print_param_types("retrievable algorithm parameters",
EVP_CIPHER_gettable_params(c), 4);
print_param_types("retrievable operation parameters",
EVP_CIPHER_CTX_gettable_params(c), 4);
EVP_CIPHER_gettable_ctx_params(c), 4);
print_param_types("settable operation parameters",
EVP_CIPHER_CTX_settable_params(c), 4);
EVP_CIPHER_settable_ctx_params(c), 4);
}
}
sk_EVP_CIPHER_pop_free(ciphers, EVP_CIPHER_free);
@@ -101,7 +110,7 @@ static void list_md_fn(const EVP_MD *m,
DEFINE_STACK_OF(EVP_MD)
static int md_cmp(const EVP_MD * const *a, const EVP_MD * const *b)
{
int ret = strcasecmp(EVP_MD_name(*a), EVP_MD_name(*b));
int ret = EVP_MD_number(*a) - EVP_MD_number(*b);
if (ret == 0)
ret = strcmp(OSSL_PROVIDER_name(EVP_MD_provider(*a)),
@@ -127,21 +136,29 @@ static void list_digests(void)
EVP_MD_do_all_sorted(list_md_fn, bio_out);
BIO_printf(bio_out, "Provided:\n");
EVP_MD_do_all_ex(NULL, collect_digests, digests);
EVP_MD_do_all_provided(NULL, collect_digests, digests);
sk_EVP_MD_sort(digests);
for (i = 0; i < sk_EVP_MD_num(digests); i++) {
const EVP_MD *m = sk_EVP_MD_value(digests, i);
STACK_OF(OPENSSL_CSTRING) *names =
sk_OPENSSL_CSTRING_new(name_cmp);
BIO_printf(bio_out, " %s", EVP_MD_name(m));
EVP_MD_names_do_all(m, collect_names, names);
BIO_printf(bio_out, " ");
print_names(bio_out, names);
BIO_printf(bio_out, " @ %s\n",
OSSL_PROVIDER_name(EVP_MD_provider(m)));
sk_OPENSSL_CSTRING_free(names);
if (verbose) {
print_param_types("retrievable algorithm parameters",
EVP_MD_gettable_params(m), 4);
print_param_types("retrievable operation parameters",
EVP_MD_CTX_gettable_params(m), 4);
EVP_MD_gettable_ctx_params(m), 4);
print_param_types("settable operation parameters",
EVP_MD_CTX_settable_params(m), 4);
EVP_MD_settable_ctx_params(m), 4);
}
}
sk_EVP_MD_pop_free(digests, EVP_MD_free);
@@ -150,7 +167,7 @@ static void list_digests(void)
DEFINE_STACK_OF(EVP_MAC)
static int mac_cmp(const EVP_MAC * const *a, const EVP_MAC * const *b)
{
int ret = strcasecmp(EVP_MAC_name(*a), EVP_MAC_name(*b));
int ret = EVP_MAC_number(*a) - EVP_MAC_number(*b);
if (ret == 0)
ret = strcmp(OSSL_PROVIDER_name(EVP_MAC_provider(*a)),
@@ -173,22 +190,29 @@ static void list_macs(void)
int i;
BIO_printf(bio_out, "Provided MACs:\n");
EVP_MAC_do_all_ex(NULL, collect_macs, macs);
EVP_MAC_do_all_provided(NULL, collect_macs, macs);
sk_EVP_MAC_sort(macs);
for (i = 0; i < sk_EVP_MAC_num(macs); i++) {
const EVP_MAC *m = sk_EVP_MAC_value(macs, i);
STACK_OF(OPENSSL_CSTRING) *names =
sk_OPENSSL_CSTRING_new(name_cmp);
BIO_printf(bio_out, " %s", EVP_MAC_name(m));
EVP_MAC_names_do_all(m, collect_names, names);
BIO_printf(bio_out, " ");
print_names(bio_out, names);
BIO_printf(bio_out, " @ %s\n",
OSSL_PROVIDER_name(EVP_MAC_provider(m)));
sk_OPENSSL_CSTRING_free(names);
if (verbose) {
print_param_types("retrievable algorithm parameters",
EVP_MAC_gettable_params(m), 4);
print_param_types("retrievable operation parameters",
EVP_MAC_CTX_gettable_params(m), 4);
EVP_MAC_gettable_ctx_params(m), 4);
print_param_types("settable operation parameters",
EVP_MAC_CTX_settable_params(m), 4);
EVP_MAC_settable_ctx_params(m), 4);
}
}
sk_EVP_MAC_pop_free(macs, EVP_MAC_free);
@@ -200,7 +224,7 @@ static void list_macs(void)
DEFINE_STACK_OF(EVP_KDF)
static int kdf_cmp(const EVP_KDF * const *a, const EVP_KDF * const *b)
{
int ret = strcasecmp(EVP_KDF_name(*a), EVP_KDF_name(*b));
int ret = EVP_KDF_number(*a) - EVP_KDF_number(*b);
if (ret == 0)
ret = strcmp(OSSL_PROVIDER_name(EVP_KDF_provider(*a)),
@@ -223,22 +247,29 @@ static void list_kdfs(void)
int i;
BIO_printf(bio_out, "Provided KDFs and PDFs:\n");
EVP_KDF_do_all_ex(NULL, collect_kdfs, kdfs);
EVP_KDF_do_all_provided(NULL, collect_kdfs, kdfs);
sk_EVP_KDF_sort(kdfs);
for (i = 0; i < sk_EVP_KDF_num(kdfs); i++) {
const EVP_KDF *m = sk_EVP_KDF_value(kdfs, i);
const EVP_KDF *k = sk_EVP_KDF_value(kdfs, i);
STACK_OF(OPENSSL_CSTRING) *names =
sk_OPENSSL_CSTRING_new(name_cmp);
BIO_printf(bio_out, " %s", EVP_KDF_name(m));
EVP_KDF_names_do_all(k, collect_names, names);
BIO_printf(bio_out, " ");
print_names(bio_out, names);
BIO_printf(bio_out, " @ %s\n",
OSSL_PROVIDER_name(EVP_KDF_provider(m)));
OSSL_PROVIDER_name(EVP_KDF_provider(k)));
sk_OPENSSL_CSTRING_free(names);
if (verbose) {
print_param_types("retrievable algorithm parameters",
EVP_KDF_gettable_params(m), 4);
EVP_KDF_gettable_params(k), 4);
print_param_types("retrievable operation parameters",
EVP_KDF_CTX_gettable_params(m), 4);
EVP_KDF_gettable_ctx_params(k), 4);
print_param_types("settable operation parameters",
EVP_KDF_CTX_settable_params(m), 4);
EVP_KDF_settable_ctx_params(k), 4);
}
}
sk_EVP_KDF_pop_free(kdfs, EVP_KDF_free);
@@ -331,12 +362,16 @@ static void list_options_for_command(const char *command)
return;
for ( ; o->name != NULL; o++) {
char c = o->valtype;
if (o->name == OPT_HELP_STR
|| o->name == OPT_MORE_STR
|| o->name[0] == '\0')
continue;
BIO_printf(bio_out, "%s %c\n", o->name, o->valtype);
BIO_printf(bio_out, "%s %c\n", o->name, c == '\0' ? '-' : c);
}
/* Always output the -- marker since it is sometimes documented. */
BIO_printf(bio_out, "- -\n");
}
static void list_type(FUNC_TYPE ft, int one)
apps/mac.c
+1 -1
View File
@@ -105,7 +105,7 @@ opthelp:
if (opts != NULL) {
int ok = 1;
OSSL_PARAM *params =
app_params_new_from_opts(opts, EVP_MAC_CTX_settable_params(mac));
app_params_new_from_opts(opts, EVP_MAC_settable_ctx_params(mac));
if (params == NULL)
goto err;
apps/pkcs12.c
+1 -1
View File
@@ -465,7 +465,7 @@ int pkcs12_main(int argc, char **argv)
p12 = PKCS12_create(cpass, name, key, ucert, certs,
key_pbe, cert_pbe, iter, -1, keytype);
if (!p12) {
if (p12 == NULL) {
ERR_print_errors(bio_err);
goto export_end;
}
apps/prime.c
+4 -3
View File
@@ -35,7 +35,7 @@ const OPTIONS prime_options[] = {
int prime_main(int argc, char **argv)
{
BIGNUM *bn = NULL;
int hex = 0, checks = 20, generate = 0, bits = 0, safe = 0, ret = 1;
int hex = 0, generate = 0, bits = 0, safe = 0, ret = 1;
char *prog;
OPTION_CHOICE o;
@@ -64,7 +64,8 @@ opthelp:
safe = 1;
break;
case OPT_CHECKS:
checks = atoi(opt_arg());
/* ignore parameter and argument */
opt_arg();
break;
}
}
@@ -121,7 +122,7 @@ opthelp:
BN_print(bio_out, bn);
BIO_printf(bio_out, " (%s) %s prime\n",
argv[0],
BN_is_prime_ex(bn, checks, NULL, NULL)
BN_check_prime(bn, NULL, NULL)
? "is" : "is not");
}
}
apps/provider.c
+107 -30
View File
@@ -12,6 +12,7 @@
#include "apps.h"
#include "app_params.h"
#include "progs.h"
#include "names.h"
#include <openssl/err.h>
#include <openssl/evp.h>
#include <openssl/safestack.h>
@@ -40,7 +41,7 @@ typedef struct info_st INFO;
typedef struct meta_st META;
struct info_st {
const char *name;
void (*collect_names_fn)(void *method, STACK_OF(OPENSSL_CSTRING) *names);
void *method;
const OSSL_PARAM *gettable_params;
const OSSL_PARAM *gettable_ctx_params;
@@ -58,11 +59,58 @@ struct meta_st {
void (*fn)(META *meta, INFO *info);
};
static void collect_cipher_names(void *method,
STACK_OF(OPENSSL_CSTRING) *names)
{
EVP_CIPHER_names_do_all(method, collect_names, names);
}
static void collect_digest_names(void *method,
STACK_OF(OPENSSL_CSTRING) *names)
{
EVP_MD_names_do_all(method, collect_names, names);
}
static void collect_mac_names(void *method,
STACK_OF(OPENSSL_CSTRING) *names)
{
EVP_MAC_names_do_all(method, collect_names, names);
}
static void collect_keymgmt_names(void *method,
STACK_OF(OPENSSL_CSTRING) *names)
{
EVP_KEYMGMT_names_do_all(method, collect_names, names);
}
static void collect_keyexch_names(void *method,
STACK_OF(OPENSSL_CSTRING) *names)
{
EVP_KEYEXCH_names_do_all(method, collect_names, names);
}
static void collect_signature_names(void *method,
STACK_OF(OPENSSL_CSTRING) *names)
{
EVP_SIGNATURE_names_do_all(method, collect_names, names);
}
static void print_method_names(BIO *out, INFO *info)
{
STACK_OF(OPENSSL_CSTRING) *names = sk_OPENSSL_CSTRING_new(name_cmp);
info->collect_names_fn(info->method, names);
print_names(out, names);
sk_OPENSSL_CSTRING_free(names);
}
static void print_caps(META *meta, INFO *info)
{
switch (meta->verbose) {
case 1:
BIO_printf(bio_out, meta->first ? "%s" : " %s", info->name);
if (!meta->first)
BIO_printf(bio_out, "; ");
print_method_names(bio_out, info);
break;
case 2:
if (meta->first) {
@@ -70,12 +118,14 @@ static void print_caps(META *meta, INFO *info)
BIO_printf(bio_out, "\n");
BIO_printf(bio_out, "%*s%ss:", meta->indent, "", meta->label);
}
BIO_printf(bio_out, " %s", info->name);
BIO_printf(bio_out, " ");
print_method_names(bio_out, info);
break;
case 3:
default:
BIO_printf(bio_out, "%*s%s %s\n", meta->indent, "", meta->label,
info->name);
BIO_printf(bio_out, "%*s%s ", meta->indent, "", meta->label);
print_method_names(bio_out, info);
BIO_printf(bio_out, "\n");
print_param_types("retrievable algorithm parameters",
info->gettable_params, meta->subindent);
print_param_types("retrievable operation parameters",
@@ -87,7 +137,9 @@ static void print_caps(META *meta, INFO *info)
meta->first = 0;
}
static void do_method(void *method, const char *name,
static void do_method(void *method,
void (*collect_names_fn)(void *method,
STACK_OF(OPENSSL_CSTRING) *names),
const OSSL_PARAM *gettable_params,
const OSSL_PARAM *gettable_ctx_params,
const OSSL_PARAM *settable_ctx_params,
@@ -95,7 +147,7 @@ static void do_method(void *method, const char *name,
{
INFO info;
info.name = name;
info.collect_names_fn = collect_names_fn;
info.method = method;
info.gettable_params = gettable_params;
info.gettable_ctx_params = gettable_ctx_params;
@@ -106,53 +158,78 @@ static void do_method(void *method, const char *name,
static void do_cipher(EVP_CIPHER *cipher, void *meta)
{
do_method(cipher, EVP_CIPHER_name(cipher),
do_method(cipher, collect_cipher_names,
EVP_CIPHER_gettable_params(cipher),
EVP_CIPHER_CTX_gettable_params(cipher),
EVP_CIPHER_CTX_settable_params(cipher),
EVP_CIPHER_gettable_ctx_params(cipher),
EVP_CIPHER_settable_ctx_params(cipher),
meta);
}
static void do_digest(EVP_MD *digest, void *meta)
{
do_method(digest, EVP_MD_name(digest),
do_method(digest, collect_digest_names,
EVP_MD_gettable_params(digest),
EVP_MD_CTX_gettable_params(digest),
EVP_MD_CTX_settable_params(digest),
EVP_MD_gettable_ctx_params(digest),
EVP_MD_settable_ctx_params(digest),
meta);
}
static void do_mac(EVP_MAC *mac, void *meta)
{
do_method(mac, EVP_MAC_name(mac),
do_method(mac, collect_mac_names,
EVP_MAC_gettable_params(mac),
EVP_MAC_CTX_gettable_params(mac),
EVP_MAC_CTX_settable_params(mac),
EVP_MAC_gettable_ctx_params(mac),
EVP_MAC_settable_ctx_params(mac),
meta);
}
static void do_keymgmt(EVP_KEYMGMT *keymgmt, void *meta)
{
do_method(keymgmt, collect_keymgmt_names,
/*
* TODO(3.0) Enable when KEYMGMT and KEYEXCH have gettables and settables
*/
#if 0
static void do_keymgmt(EVP_KEYMGMT *keymgmt, void *meta)
{
do_method(keymgmt, EVP_KEYMGMT_name(keymgmt),
EVP_KEYMGMT_gettable_params(keymgmt),
EVP_KEYMGMT_gettable_ctx_params(keymgmt),
EVP_KEYMGMT_settable_ctx_params(keymgmt),
#else
NULL, NULL, NULL,
#endif
meta);
}
static void do_keyexch(EVP_KEYEXCH *keyexch, void *meta)
{
do_method(keyexch, EVP_KEYEXCH_name(keyexch),
do_method(keyexch, collect_keyexch_names,
/*
* TODO(3.0) Enable when KEYMGMT and KEYEXCH have gettables and settables
*/
#if 0
EVP_KEYEXCH_gettable_params(keyexch),
EVP_KEYEXCH_gettable_ctx_params(keyexch),
EVP_KEYEXCH_settable_ctx_params(keyexch),
#else
NULL, NULL, NULL,
#endif
meta);
}
static void do_signature(EVP_SIGNATURE *signature, void *meta)
{
do_method(signature, collect_signature_names,
/*
* TODO(3.0) Enable when KEYMGMT and SIGNATURE have gettables and settables
*/
#if 0
EVP_SIGNATURE_gettable_params(signature),
EVP_SIGNATURE_gettable_ctx_params(signature),
EVP_SIGNATURE_settable_ctx_params(signature),
#else
NULL, NULL, NULL,
#endif
meta);
}
int provider_main(int argc, char **argv)
{
@@ -231,33 +308,33 @@ int provider_main(int argc, char **argv)
data.first = 1;
data.label = "Cipher";
}
EVP_CIPHER_do_all_ex(NULL, do_cipher, &data);
EVP_CIPHER_do_all_provided(NULL, do_cipher, &data);
if (verbose > 1) {
data.first = 1;
data.label = "Digest";
}
EVP_MD_do_all_ex(NULL, do_digest, &data);
EVP_MD_do_all_provided(NULL, do_digest, &data);
if (verbose > 1) {
data.first = 1;
data.label = "MAC";
}
EVP_MAC_do_all_ex(NULL, do_mac, &data);
EVP_MAC_do_all_provided(NULL, do_mac, &data);
/*
* TODO(3.0) Enable when KEYMGMT and KEYEXCH have do_all_ex functions
*/
#if 0
if (verbose > 1) {
data.first = 1;
data.label = "Key manager";
}
EVP_KEYMGMT_do_all_ex(NULL, do_keymgmt, &data);
EVP_KEYMGMT_do_all_provided(NULL, do_keymgmt, &data);
if (verbose > 1) {
data.first = 1;
data.label = "Key exchange";
}
EVP_KEYEXCH_do_all_ex(NULL, do_keyexch, &data);
#endif
EVP_KEYEXCH_do_all_provided(NULL, do_keyexch, &data);
if (verbose > 1) {
data.first = 1;
data.label = "Signature";
}
EVP_SIGNATURE_do_all_provided(NULL, do_signature, &data);
switch (verbose) {
default:
apps/req.c
+33 -20
View File
@@ -325,9 +325,10 @@ int req_main(int argc, char **argv)
newreq = 1;
break;
case OPT_PKEYOPT:
if (!pkeyopts)
if (pkeyopts == NULL)
pkeyopts = sk_OPENSSL_STRING_new_null();
if (!pkeyopts || !sk_OPENSSL_STRING_push(pkeyopts, opt_arg()))
if (pkeyopts == NULL
|| !sk_OPENSSL_STRING_push(pkeyopts, opt_arg()))
goto opthelp;
break;
case OPT_SIGOPT:
@@ -1751,15 +1752,19 @@ int do_X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md,
#endif
rv = do_sign_init(mctx, pkey, md, sigopts);
if (rv > 0)
if (rv > 0) {
rv = X509_sign_ctx(x, mctx);
#ifndef OPENSSL_NO_SM2
/* only in SM2 case we need to free the pctx explicitly */
if (ec_pkey_is_sm2(pkey)) {
pctx = EVP_MD_CTX_pkey_ctx(mctx);
EVP_PKEY_CTX_free(pctx);
}
/*
* only in SM2 case we need to free the pctx explicitly
* if do_sign_init() fails, pctx is already freed in it
*/
if (ec_pkey_is_sm2(pkey)) {
pctx = EVP_MD_CTX_pkey_ctx(mctx);
EVP_PKEY_CTX_free(pctx);
}
#endif
}
EVP_MD_CTX_free(mctx);
return rv > 0 ? 1 : 0;
}
@@ -1774,15 +1779,19 @@ int do_X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md,
#endif
rv = do_sign_init(mctx, pkey, md, sigopts);
if (rv > 0)
if (rv > 0) {
rv = X509_REQ_sign_ctx(x, mctx);
#ifndef OPENSSL_NO_SM2
/* only in SM2 case we need to free the pctx explicitly */
if (ec_pkey_is_sm2(pkey)) {
pctx = EVP_MD_CTX_pkey_ctx(mctx);
EVP_PKEY_CTX_free(pctx);
}
/*
* only in SM2 case we need to free the pctx explicitly
* if do_sign_init() fails, pctx is already freed in it
*/
if (ec_pkey_is_sm2(pkey)) {
pctx = EVP_MD_CTX_pkey_ctx(mctx);
EVP_PKEY_CTX_free(pctx);
}
#endif
}
EVP_MD_CTX_free(mctx);
return rv > 0 ? 1 : 0;
}
@@ -1797,15 +1806,19 @@ int do_X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md,
#endif
rv = do_sign_init(mctx, pkey, md, sigopts);
if (rv > 0)
if (rv > 0) {
rv = X509_CRL_sign_ctx(x, mctx);
#ifndef OPENSSL_NO_SM2
/* only in SM2 case we need to free the pctx explicitly */
if (ec_pkey_is_sm2(pkey)) {
pctx = EVP_MD_CTX_pkey_ctx(mctx);
EVP_PKEY_CTX_free(pctx);
}
/*
* only in SM2 case we need to free the pctx explicitly
* if do_sign_init() fails, no need to double free pctx
*/
if (ec_pkey_is_sm2(pkey)) {
pctx = EVP_MD_CTX_pkey_ctx(mctx);
EVP_PKEY_CTX_free(pctx);
}
#endif
}
EVP_MD_CTX_free(mctx);
return rv > 0 ? 1 : 0;
}
apps/s_client.c
+2 -4
View File
@@ -272,8 +272,6 @@ typedef struct srp_arg_st {
int strength; /* minimal size for N */
} SRP_ARG;
# define SRP_NUMBER_ITERATIONS_FOR_PRIME 64
static int srp_Verify_N_and_g(const BIGNUM *N, const BIGNUM *g)
{
BN_CTX *bn_ctx = BN_CTX_new();
@@ -281,10 +279,10 @@ static int srp_Verify_N_and_g(const BIGNUM *N, const BIGNUM *g)
BIGNUM *r = BN_new();
int ret =
g != NULL && N != NULL && bn_ctx != NULL && BN_is_odd(N) &&
BN_is_prime_ex(N, SRP_NUMBER_ITERATIONS_FOR_PRIME, bn_ctx, NULL) == 1 &&
BN_check_prime(N, bn_ctx, NULL) == 1 &&
p != NULL && BN_rshift1(p, N) &&
/* p = (N-1)/2 */
BN_is_prime_ex(p, SRP_NUMBER_ITERATIONS_FOR_PRIME, bn_ctx, NULL) == 1 &&
BN_check_prime(p, bn_ctx, NULL) == 1 &&
r != NULL &&
/* verify g^((N-1)/2) == -1 (mod N) */
BN_mod_exp(r, g, p, N, bn_ctx) &&
apps/speed.c
+358 -10
View File
@@ -15,6 +15,7 @@
#define ECDSA_SECONDS 10
#define ECDH_SECONDS 10
#define EdDSA_SECONDS 10
#define SM2_SECONDS 10
#include <stdio.h>
#include <stdlib.h>
@@ -127,6 +128,7 @@ typedef struct openssl_speed_sec_st {
int ecdsa;
int ecdh;
int eddsa;
int sm2;
} openssl_speed_sec_t;
static volatile int run = 0;
@@ -191,6 +193,10 @@ static int ECDSA_sign_loop(void *args);
static int ECDSA_verify_loop(void *args);
static int EdDSA_sign_loop(void *args);
static int EdDSA_verify_loop(void *args);
# ifndef OPENSSL_NO_SM2
static int SM2_sign_loop(void *args);
static int SM2_verify_loop(void *args);
# endif
#endif
static double Time_F(int s);
@@ -604,6 +610,18 @@ static OPT_PAIR eddsa_choices[] = {
# define EdDSA_NUM OSSL_NELEM(eddsa_choices)
static double eddsa_results[EdDSA_NUM][2]; /* 2 ops: sign then verify */
# ifndef OPENSSL_NO_SM2
# define R_EC_CURVESM2 0
static OPT_PAIR sm2_choices[] = {
{"curveSM2", R_EC_CURVESM2}
};
# define SM2_ID "TLSv1.3+GM+Cipher+Suite"
# define SM2_ID_LEN sizeof("TLSv1.3+GM+Cipher+Suite") - 1
# define SM2_NUM OSSL_NELEM(sm2_choices)
static double sm2_results[SM2_NUM][2]; /* 2 ops: sign then verify */
# endif /* OPENSSL_NO_SM2 */
#endif /* OPENSSL_NO_EC */
#ifndef SIGALRM
@@ -634,6 +652,11 @@ typedef struct loopargs_st {
EC_KEY *ecdsa[ECDSA_NUM];
EVP_PKEY_CTX *ecdh_ctx[EC_NUM];
EVP_MD_CTX *eddsa_ctx[EdDSA_NUM];
# ifndef OPENSSL_NO_SM2
EVP_MD_CTX *sm2_ctx[SM2_NUM];
EVP_MD_CTX *sm2_vfy_ctx[SM2_NUM];
EVP_PKEY *sm2_pkey[SM2_NUM];
# endif
unsigned char *secret_a;
unsigned char *secret_b;
size_t outlen[EC_NUM];
@@ -1296,6 +1319,74 @@ static int EdDSA_verify_loop(void *args)
}
return count;
}
# ifndef OPENSSL_NO_SM2
static long sm2_c[SM2_NUM][2];
static int SM2_sign_loop(void *args)
{
loopargs_t *tempargs = *(loopargs_t **) args;
unsigned char *buf = tempargs->buf;
EVP_MD_CTX **sm2ctx = tempargs->sm2_ctx;
unsigned char *sm2sig = tempargs->buf2;
size_t sm2sigsize = tempargs->sigsize;
const size_t max_size = tempargs->sigsize;
int ret, count;
EVP_PKEY **sm2_pkey = tempargs->sm2_pkey;
for (count = 0; COND(sm2_c[testnum][0]); count++) {
if (!EVP_DigestSignInit(sm2ctx[testnum], NULL, EVP_sm3(),
NULL, sm2_pkey[testnum])) {
BIO_printf(bio_err, "SM2 init sign failure\n");
ERR_print_errors(bio_err);
count = -1;
break;
}
ret = EVP_DigestSign(sm2ctx[testnum], sm2sig, &sm2sigsize,
buf, 20);
if (ret == 0) {
BIO_printf(bio_err, "SM2 sign failure\n");
ERR_print_errors(bio_err);
count = -1;
break;
}
/* update the latest returned size and always use the fixed buffer size */
tempargs->sigsize = sm2sigsize;
sm2sigsize = max_size;
}
return count;
}
static int SM2_verify_loop(void *args)
{
loopargs_t *tempargs = *(loopargs_t **) args;
unsigned char *buf = tempargs->buf;
EVP_MD_CTX **sm2ctx = tempargs->sm2_vfy_ctx;
unsigned char *sm2sig = tempargs->buf2;
size_t sm2sigsize = tempargs->sigsize;
int ret, count;
EVP_PKEY **sm2_pkey = tempargs->sm2_pkey;
for (count = 0; COND(sm2_c[testnum][1]); count++) {
if (!EVP_DigestVerifyInit(sm2ctx[testnum], NULL, EVP_sm3(),
NULL, sm2_pkey[testnum])) {
BIO_printf(bio_err, "SM2 verify init failure\n");
ERR_print_errors(bio_err);
count = -1;
break;
}
ret = EVP_DigestVerify(sm2ctx[testnum], sm2sig, sm2sigsize,
buf, 20);
if (ret != 1) {
BIO_printf(bio_err, "SM2 verify failure\n");
ERR_print_errors(bio_err);
count = -1;
break;
}
}
return count;
}
# endif /* OPENSSL_NO_SM2 */
#endif /* OPENSSL_NO_EC */
static int run_benchmark(int async_jobs,
@@ -1477,7 +1568,7 @@ int speed_main(int argc, char **argv)
#endif
openssl_speed_sec_t seconds = { SECONDS, RSA_SECONDS, DSA_SECONDS,
ECDSA_SECONDS, ECDH_SECONDS,
EdDSA_SECONDS };
EdDSA_SECONDS, SM2_SECONDS };
/* What follows are the buffers and key material. */
#ifndef OPENSSL_NO_RC5
@@ -1609,11 +1700,23 @@ int speed_main(int argc, char **argv)
{"Ed25519", NID_ED25519, 253, 64},
{"Ed448", NID_ED448, 456, 114}
};
# ifndef OPENSSL_NO_SM2
static const struct {
const char *name;
unsigned int nid;
unsigned int bits;
} test_sm2_curves[] = {
/* SM2 */
{"CurveSM2", NID_sm2, 256}
};
# endif
int ecdsa_doit[ECDSA_NUM] = { 0 };
int ecdh_doit[EC_NUM] = { 0 };
int eddsa_doit[EdDSA_NUM] = { 0 };
int sm2_doit[SM2_NUM] = { 0 };
OPENSSL_assert(OSSL_NELEM(test_curves) >= EC_NUM);
OPENSSL_assert(OSSL_NELEM(test_ed_curves) >= EdDSA_NUM);
OPENSSL_assert(OSSL_NELEM(test_sm2_curves) >= SM2_NUM);
#endif /* ndef OPENSSL_NO_EC */
prog = opt_init(argc, argv, speed_options);
@@ -1726,7 +1829,8 @@ int speed_main(int argc, char **argv)
break;
case OPT_SECONDS:
seconds.sym = seconds.rsa = seconds.dsa = seconds.ecdsa
= seconds.ecdh = seconds.eddsa = atoi(opt_arg());
= seconds.ecdh = seconds.eddsa
= seconds.sm2 = atoi(opt_arg());
break;
case OPT_BYTES:
lengths_single = atoi(opt_arg());
@@ -1819,6 +1923,17 @@ int speed_main(int argc, char **argv)
eddsa_doit[i] = 2;
continue;
}
# ifndef OPENSSL_NO_SM2
if (strcmp(*argv, "sm2") == 0) {
for (loop = 0; loop < OSSL_NELEM(sm2_doit); loop++)
sm2_doit[loop] = 1;
continue;
}
if (found(*argv, sm2_choices, &i)) {
sm2_doit[i] = 2;
continue;
}
# endif
#endif
BIO_printf(bio_err, "%s: Unknown algorithm %s\n", prog, *argv);
goto end;
@@ -1921,6 +2036,10 @@ int speed_main(int argc, char **argv)
ecdh_doit[loop] = 1;
for (loop = 0; loop < OSSL_NELEM(eddsa_doit); loop++)
eddsa_doit[loop] = 1;
# ifndef OPENSSL_NO_SM2
for (loop = 0; loop < OSSL_NELEM(sm2_doit); loop++)
sm2_doit[loop] = 1;
# endif
#endif
}
for (i = 0; i < ALGOR_NUM; i++)
@@ -2226,6 +2345,10 @@ int speed_main(int argc, char **argv)
eddsa_c[R_EC_Ed25519][0] = count / 1800;
eddsa_c[R_EC_Ed448][0] = count / 7200;
# ifndef OPENSSL_NO_SM2
sm2_c[R_EC_SM2P256][0] = count / 1800;
# endif
# endif
# else
@@ -3149,7 +3272,7 @@ int speed_main(int argc, char **argv)
pctx = NULL;
}
if (kctx == NULL || /* keygen ctx is not null */
!EVP_PKEY_keygen_init(kctx) /* init keygen ctx */ ) {
EVP_PKEY_keygen_init(kctx) <= 0/* init keygen ctx */ ) {
ecdh_checks = 0;
BIO_printf(bio_err, "ECDH keygen failure.\n");
ERR_print_errors(bio_err);
@@ -3157,12 +3280,12 @@ int speed_main(int argc, char **argv)
break;
}
if (!EVP_PKEY_keygen(kctx, &key_A) || /* generate secret key A */
!EVP_PKEY_keygen(kctx, &key_B) || /* generate secret key B */
if (EVP_PKEY_keygen(kctx, &key_A) <= 0 || /* generate secret key A */
EVP_PKEY_keygen(kctx, &key_B) <= 0 || /* generate secret key B */
!(ctx = EVP_PKEY_CTX_new(key_A, NULL)) || /* derivation ctx from skeyA */
!EVP_PKEY_derive_init(ctx) || /* init derivation ctx */
!EVP_PKEY_derive_set_peer(ctx, key_B) || /* set peer pubkey in ctx */
!EVP_PKEY_derive(ctx, NULL, &outlen) || /* determine max length */
EVP_PKEY_derive_init(ctx) <= 0 || /* init derivation ctx */
EVP_PKEY_derive_set_peer(ctx, key_B) <= 0 || /* set peer pubkey in ctx */
EVP_PKEY_derive(ctx, NULL, &outlen) <= 0 || /* determine max length */
outlen == 0 || /* ensure outlen is a valid size */
outlen > MAX_ECDH_SIZE /* avoid buffer overflow */ ) {
ecdh_checks = 0;
@@ -3249,8 +3372,8 @@ int speed_main(int argc, char **argv)
if ((ed_pctx = EVP_PKEY_CTX_new_id(test_ed_curves[testnum].nid, NULL))
== NULL
|| !EVP_PKEY_keygen_init(ed_pctx)
|| !EVP_PKEY_keygen(ed_pctx, &ed_pkey)) {
|| EVP_PKEY_keygen_init(ed_pctx) <= 0
|| EVP_PKEY_keygen(ed_pctx, &ed_pkey) <= 0) {
st = 0;
EVP_PKEY_CTX_free(ed_pctx);
break;
@@ -3337,6 +3460,175 @@ int speed_main(int argc, char **argv)
}
}
# ifndef OPENSSL_NO_SM2
for (testnum = 0; testnum < SM2_NUM; testnum++) {
int st = 1;
EVP_PKEY *sm2_pkey = NULL;
EVP_PKEY_CTX *pctx = NULL;
EVP_PKEY_CTX *sm2_pctx = NULL;
EVP_PKEY_CTX *sm2_vfy_pctx = NULL;
size_t sm2_sigsize = 0;
if (!sm2_doit[testnum])
continue; /* Ignore Curve */
/* Init signing and verification */
for (i = 0; i < loopargs_len; i++) {
loopargs[i].sm2_ctx[testnum] = EVP_MD_CTX_new();
if (loopargs[i].sm2_ctx[testnum] == NULL) {
st = 0;
break;
}
loopargs[i].sm2_vfy_ctx[testnum] = EVP_MD_CTX_new();
if (loopargs[i].sm2_vfy_ctx[testnum] == NULL) {
st = 0;
break;
}
/* SM2 keys are generated as normal EC keys with a special curve */
if ((pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL)) == NULL
|| EVP_PKEY_keygen_init(pctx) <= 0
|| EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx,
test_sm2_curves[testnum].nid) <= 0
|| EVP_PKEY_keygen(pctx, &sm2_pkey) <= 0) {
st = 0;
EVP_PKEY_CTX_free(pctx);
break;
}
/* free previous one and alloc a new one */
EVP_PKEY_CTX_free(pctx);
loopargs[i].sigsize = sm2_sigsize
= ECDSA_size(EVP_PKEY_get0_EC_KEY(sm2_pkey));
if (!EVP_PKEY_set_alias_type(sm2_pkey, EVP_PKEY_SM2)) {
st = 0;
EVP_PKEY_free(sm2_pkey);
break;
}
sm2_pctx = EVP_PKEY_CTX_new(sm2_pkey, NULL);
if (sm2_pctx == NULL) {
st = 0;
EVP_PKEY_free(sm2_pkey);
break;
}
sm2_vfy_pctx = EVP_PKEY_CTX_new(sm2_pkey, NULL);
if (sm2_vfy_pctx == NULL) {
st = 0;
EVP_PKEY_CTX_free(sm2_pctx);
EVP_PKEY_free(sm2_pkey);
break;
}
/*
* No need to allow user to set an explicit ID here, just use
* the one defined in the 'draft-yang-tls-tl13-sm-suites' I-D.
*/
if (EVP_PKEY_CTX_set1_id(sm2_pctx, SM2_ID, SM2_ID_LEN) != 1) {
st = 0;
EVP_PKEY_CTX_free(sm2_pctx);
EVP_PKEY_CTX_free(sm2_vfy_pctx);
EVP_PKEY_free(sm2_pkey);
break;
}
if (EVP_PKEY_CTX_set1_id(sm2_vfy_pctx, SM2_ID, SM2_ID_LEN) != 1) {
st = 0;
EVP_PKEY_CTX_free(sm2_pctx);
EVP_PKEY_CTX_free(sm2_vfy_pctx);
EVP_PKEY_free(sm2_pkey);
break;
}
EVP_MD_CTX_set_pkey_ctx(loopargs[i].sm2_ctx[testnum], sm2_pctx);
EVP_MD_CTX_set_pkey_ctx(loopargs[i].sm2_vfy_ctx[testnum], sm2_vfy_pctx);
if (!EVP_DigestSignInit(loopargs[i].sm2_ctx[testnum], NULL,
EVP_sm3(), NULL, sm2_pkey)) {
st = 0;
EVP_PKEY_free(sm2_pkey);
break;
}
if (!EVP_DigestVerifyInit(loopargs[i].sm2_vfy_ctx[testnum], NULL,
EVP_sm3(), NULL, sm2_pkey)) {
st = 0;
EVP_PKEY_free(sm2_pkey);
break;
}
loopargs[i].sm2_pkey[testnum] = sm2_pkey;
}
if (st == 0) {
BIO_printf(bio_err, "SM2 failure.\n");
ERR_print_errors(bio_err);
rsa_count = 1;
} else {
for (i = 0; i < loopargs_len; i++) {
sm2_sigsize = loopargs[i].sigsize;
/* Perform SM2 signature test */
st = EVP_DigestSign(loopargs[i].sm2_ctx[testnum],
loopargs[i].buf2, &sm2_sigsize,
loopargs[i].buf, 20);
if (st == 0)
break;
}
if (st == 0) {
BIO_printf(bio_err,
"SM2 sign failure. No SM2 sign will be done.\n");
ERR_print_errors(bio_err);
rsa_count = 1;
} else {
pkey_print_message("sign", test_sm2_curves[testnum].name,
sm2_c[testnum][0],
test_sm2_curves[testnum].bits, seconds.sm2);
Time_F(START);
count = run_benchmark(async_jobs, SM2_sign_loop, loopargs);
d = Time_F(STOP);
BIO_printf(bio_err,
mr ? "+R8:%ld:%u:%s:%.2f\n" :
"%ld %u bits %s signs in %.2fs \n",
count, test_sm2_curves[testnum].bits,
test_sm2_curves[testnum].name, d);
sm2_results[testnum][0] = (double)count / d;
rsa_count = count;
}
/* Perform SM2 verification test */
for (i = 0; i < loopargs_len; i++) {
st = EVP_DigestVerify(loopargs[i].sm2_vfy_ctx[testnum],
loopargs[i].buf2, loopargs[i].sigsize,
loopargs[i].buf, 20);
if (st != 1)
break;
}
if (st != 1) {
BIO_printf(bio_err,
"SM2 verify failure. No SM2 verify will be done.\n");
ERR_print_errors(bio_err);
sm2_doit[testnum] = 0;
} else {
pkey_print_message("verify", test_sm2_curves[testnum].name,
sm2_c[testnum][1],
test_sm2_curves[testnum].bits, seconds.sm2);
Time_F(START);
count = run_benchmark(async_jobs, SM2_verify_loop, loopargs);
d = Time_F(STOP);
BIO_printf(bio_err,
mr ? "+R9:%ld:%u:%s:%.2f\n"
: "%ld %u bits %s verify in %.2fs\n",
count, test_sm2_curves[testnum].bits,
test_sm2_curves[testnum].name, d);
sm2_results[testnum][1] = (double)count / d;
}
if (rsa_count <= 1) {
/* if longer than 10s, don't do any more */
for (testnum++; testnum < SM2_NUM; testnum++)
sm2_doit[testnum] = 0;
}
}
}
# endif /* OPENSSL_NO_SM2 */
#endif /* OPENSSL_NO_EC */
#ifndef NO_FORK
show_res:
@@ -3489,6 +3781,28 @@ int speed_main(int argc, char **argv)
1.0 / eddsa_results[k][0], 1.0 / eddsa_results[k][1],
eddsa_results[k][0], eddsa_results[k][1]);
}
# ifndef OPENSSL_NO_SM2
testnum = 1;
for (k = 0; k < OSSL_NELEM(sm2_doit); k++) {
if (!sm2_doit[k])
continue;
if (testnum && !mr) {
printf("%30ssign verify sign/s verify/s\n", " ");
testnum = 0;
}
if (mr)
printf("+F6:%u:%u:%s:%f:%f\n",
k, test_sm2_curves[k].bits, test_sm2_curves[k].name,
sm2_results[k][0], sm2_results[k][1]);
else
printf("%4u bits SM2 (%s) %8.4fs %8.4fs %8.1f %8.1f\n",
test_sm2_curves[k].bits, test_sm2_curves[k].name,
1.0 / sm2_results[k][0], 1.0 / sm2_results[k][1],
sm2_results[k][0], sm2_results[k][1]);
}
# endif
#endif
ret = 0;
@@ -3514,6 +3828,24 @@ int speed_main(int argc, char **argv)
EVP_PKEY_CTX_free(loopargs[i].ecdh_ctx[k]);
for (k = 0; k < EdDSA_NUM; k++)
EVP_MD_CTX_free(loopargs[i].eddsa_ctx[k]);
# ifndef OPENSSL_NO_SM2
for (k = 0; k < SM2_NUM; k++) {
EVP_PKEY_CTX *pctx = NULL;
/* free signing ctx */
if (loopargs[i].sm2_ctx[k] != NULL
&& (pctx = EVP_MD_CTX_pkey_ctx(loopargs[i].sm2_ctx[k])) != NULL)
EVP_PKEY_CTX_free(pctx);
EVP_MD_CTX_free(loopargs[i].sm2_ctx[k]);
/* free verification ctx */
if (loopargs[i].sm2_vfy_ctx[k] != NULL
&& (pctx = EVP_MD_CTX_pkey_ctx(loopargs[i].sm2_vfy_ctx[k])) != NULL)
EVP_PKEY_CTX_free(pctx);
EVP_MD_CTX_free(loopargs[i].sm2_vfy_ctx[k]);
/* free pkey */
EVP_PKEY_free(loopargs[i].sm2_pkey[k]);
}
# endif
OPENSSL_free(loopargs[i].secret_a);
OPENSSL_free(loopargs[i].secret_b);
#endif
@@ -3739,6 +4071,22 @@ static int do_multi(int multi, int size_num)
d = atof(sstrsep(&p, sep));
eddsa_results[k][1] += d;
}
# ifndef OPENSSL_NO_SM2
else if (strncmp(buf, "+F7:", 4) == 0) {
int k;
double d;
p = buf + 4;
k = atoi(sstrsep(&p, sep));
sstrsep(&p, sep);
d = atof(sstrsep(&p, sep));
sm2_results[k][0] += d;
d = atof(sstrsep(&p, sep));
sm2_results[k][1] += d;
}
# endif /* OPENSSL_NO_SM2 */
# endif
else if (strncmp(buf, "+H:", 3) == 0) {
apps/timeouts.h
+3 -3
View File
@@ -7,11 +7,11 @@
* https://www.openssl.org/source/license.html
*/
#ifndef INCLUDED_TIMEOUTS_H
# define INCLUDED_TIMEOUTS_H
#ifndef OSSL_APPS_TIMEOUTS_H
# define OSSL_APPS_TIMEOUTS_H
/* numbers in us */
# define DGRAM_RCV_TIMEOUT 250000
# define DGRAM_SND_TIMEOUT 250000
#endif /* ! INCLUDED_TIMEOUTS_H */
#endif /* ! OSSL_APPS_TIMEOUTS_H */
apps/ts.c
+3 -2
View File
@@ -507,8 +507,9 @@ static int create_digest(BIO *input, const char *digest, const EVP_MD *md,
md_value_len = EVP_MD_size(md);
} else {
long digest_len;
*md_value = OPENSSL_hexstr2buf(digest, &digest_len);
if (!*md_value || md_value_len != digest_len) {
if (*md_value == NULL || md_value_len != digest_len) {
OPENSSL_free(*md_value);
*md_value = NULL;
BIO_printf(bio_err, "bad digest, %d bytes "
@@ -920,7 +921,7 @@ static TS_VERIFY_CTX *create_verify_ctx(const char *data, const char *digest,
/* Loading untrusted certificates. */
if (untrusted
&& TS_VERIFY_CTS_set_certs(ctx, TS_CONF_load_certs(untrusted)) == NULL)
&& TS_VERIFY_CTX_set_certs(ctx, TS_CONF_load_certs(untrusted)) == NULL)
goto err;
ret = 1;