Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update - OpenSSL 1.1.1-pre7-dev

Browse Source
This commit is contained in:
Hakase
2018-05-23 23:52:41 +09:00
parent e8a0afd4a0
commit ef253190c7
624 changed files with 189420 additions and 8064 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/CA.pl.in
+1 -1
View File
@@ -1,5 +1,5 @@
#!{- $config{HASHBANGPERL} -}
# Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
apps/apps.c
+4 -117
View File
@@ -25,12 +25,6 @@
#endif
#include <ctype.h>
#include <errno.h>
#ifdef __VMS
# include <descrip.h>
# include <iledef.h>
# include <fscndef.h>
# include <starlet.h>
#endif
#include <openssl/err.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
@@ -1597,6 +1591,9 @@ CA_DB *load_index(const char *dbfile, DB_ATTR *db_attr)
return retdb;
}
/*
* Returns > 0 on success, <= 0 on error
*/
int index_index(CA_DB *db)
{
if (!TXT_DB_create_index(db->db, DB_serial, NULL,
@@ -2367,116 +2364,6 @@ int app_isdir(const char *name)
}
#endif
/* app_dirname section */
/*
* This exactly follows what POSIX's
* dirname does, but is implemented
* in a more platform independent way.
*
* path dirname
* /usr/lib /usr
* /usr/ /
* usr .
* / /
* . .
* .. .
* "" .
*
* Note: this function also keeps the
* possibility of modifying the 'path'
* string same as POSIX dirname.
*/
static char *posix_dirname(char *path)
{
size_t l;
char *ret = ".";
l = strlen(path);
if (l == 0)
goto out;
if (strcmp(path, ".") == 0)
goto out;
if (strcmp(path, "..") == 0)
goto out;
if (strcmp(path, "/") == 0) {
ret = "/";
goto out;
}
if (path[l - 1] == '/') {
/* /usr/ */
path[l - 1] = '\0';
}
if ((ret = strrchr(path, '/')) == NULL) {
/* usr */
ret = ".";
} else if (ret == path) {
/* /usr */
*++ret = '\0';
ret = path;
} else {
/* /usr/lib */
*ret = '\0';
ret = path;
}
out:
return ret;
}
/*
* TODO: implement app_dirname for Windows.
*/
#if !defined(_WIN32)
char *app_dirname(char *path)
{
return posix_dirname(path);
}
#elif defined(__VMS)
/*
* sys$filescan fills the given item list with pointers into the original
* path string, so all we need to do is to find the file name and simply
* put a NUL byte wherever the FSCN$_NAME pointer points. If there is no
* file name part and the path string isn't the empty string, we know for
* a fact that the whole string is a directory spec and return it as is.
* Otherwise or if that pointer is the starting address of the original
* path string, we know to return "sys$disk:[]", which corresponds to the
* Unixly ".".
*
* If sys$filescan returns an error status, we know that this is not
* parsable as a VMS file spec, and then use the fallback, in case we
* have a Unix type path.
*/
char *app_dirname(char *path)
{
char *ret = "sys$disk:[]";
struct dsc$descriptor_s dsc_path = { 0 };
ile2 itemlist[] = {
{0, FSCN$_NAME, 0},
{0, 0, 0}
};
int fields;
int status;
dsc_path.dsc$a_pointer = path;
dsc_path.dsc$w_length = strlen(path);
status = sys$filescan(&dsc_path, itemlist, &fields, 0, 0);
if (!(status & 1))
return posix_dirname(path);
if ((fields & (1 << FSCN$_NAME)) == 0) {
if (dsc_path.dsc$w_length != 0)
ret = path;
} else if (itemlist[0].ile2$ps_bufaddr != path) {
if (itemlist[0].ile2$ps_bufaddr != path) {
*itemlist[0].ile2$ps_bufaddr = '\0';
ret = path;
}
}
return ret;
}
#endif
/* raw_read|write section */
#if defined(__VMS)
# include "vms_term_sock.h"
@@ -2599,7 +2486,7 @@ BIO *dup_bio_err(int format)
return b;
}
void destroy_prefix_method()
void destroy_prefix_method(void)
{
BIO_meth_free(prefix_method);
prefix_method = NULL;
apps/apps.h
+11 -5
View File
@@ -229,8 +229,9 @@ int set_cert_times(X509 *x, const char *startdate, const char *enddate,
OPT_S_ONRESUMP, OPT_S_NOLEGACYCONN, OPT_S_ALLOW_NO_DHE_KEX, \
OPT_S_PRIORITIZE_CHACHA, \
OPT_S_STRICT, OPT_S_SIGALGS, OPT_S_CLIENTSIGALGS, OPT_S_GROUPS, \
OPT_S_CURVES, OPT_S_NAMEDCURVE, OPT_S_CIPHER, \
OPT_S_CURVES, OPT_S_NAMEDCURVE, OPT_S_CIPHER, OPT_S_CIPHERSUITES, \
OPT_S_RECORD_PADDING, OPT_S_DEBUGBROKE, OPT_S_COMP, \
OPT_S_MINPROTO, OPT_S_MAXPROTO, \
OPT_S_NO_RENEGOTIATION, OPT_S_NO_MIDDLEBOX, OPT_S__LAST
# define OPT_S_OPTIONS \
@@ -272,13 +273,16 @@ int set_cert_times(X509 *x, const char *startdate, const char *enddate,
"Groups to advertise (colon-separated list)" }, \
{"named_curve", OPT_S_NAMEDCURVE, 's', \
"Elliptic curve used for ECDHE (server-side only)" }, \
{"cipher", OPT_S_CIPHER, 's', "Specify cipher list to be used"}, \
{"cipher", OPT_S_CIPHER, 's', "Specify TLSv1.2 and below cipher list to be used"}, \
{"ciphersuites", OPT_S_CIPHERSUITES, 's', "Specify TLSv1.3 ciphersuites to be used"}, \
{"min_protocol", OPT_S_MINPROTO, 's', "Specify the minimum protocol version to be used"}, \
{"max_protocol", OPT_S_MAXPROTO, 's', "Specify the maximum protocol version to be used"}, \
{"record_padding", OPT_S_RECORD_PADDING, 's', \
"Block size to pad TLS 1.3 records to."}, \
{"debug_broken_protocol", OPT_S_DEBUGBROKE, '-', \
"Perform all sorts of protocol violations for testing purposes"}, \
{"no_middlebox", OPT_S_NO_MIDDLEBOX, '-', "Disable TLSv1.3 middlebox compat mode" }
{"no_middlebox", OPT_S_NO_MIDDLEBOX, '-', \
"Disable TLSv1.3 middlebox compat mode" }
# define OPT_S_CASES \
OPT_S__FIRST: case OPT_S__LAST: break; \
@@ -305,8 +309,11 @@ int set_cert_times(X509 *x, const char *startdate, const char *enddate,
case OPT_S_CURVES: \
case OPT_S_NAMEDCURVE: \
case OPT_S_CIPHER: \
case OPT_S_CIPHERSUITES: \
case OPT_S_RECORD_PADDING: \
case OPT_S_NO_RENEGOTIATION: \
case OPT_S_MINPROTO: \
case OPT_S_MAXPROTO: \
case OPT_S_DEBUGBROKE: \
case OPT_S_NO_MIDDLEBOX
@@ -604,7 +611,6 @@ void store_setup_crl_download(X509_STORE *st);
int app_isdir(const char *);
int app_access(const char *, int flag);
char *app_dirname(char *path);
int fileno_stdin(void);
int fileno_stdout(void);
int raw_read_stdin(void *, int);
apps/asn1pars.c
+10 -10
View File
@@ -39,7 +39,7 @@ const OPTIONS asn1parse_options[] = {
{"dump", OPT_DUMP, 0, "unknown data in hex form"},
{"dlimit", OPT_DLIMIT, 'p',
"dump the first arg bytes of unknown data in hex form"},
{"strparse", OPT_STRPARSE, 's',
{"strparse", OPT_STRPARSE, 'p',
"offset; a series of these can be used to 'dig'"},
{OPT_MORE_STR, 0, 0, "into multiple ASN1 blob wrappings"},
{"genstr", OPT_GENSTR, 's', "string to generate ASN1 structure from"},
@@ -113,13 +113,13 @@ int asn1parse_main(int argc, char **argv)
offset = strtol(opt_arg(), NULL, 0);
break;
case OPT_LENGTH:
length = atoi(opt_arg());
length = strtol(opt_arg(), NULL, 0);
break;
case OPT_DUMP:
dump = -1;
break;
case OPT_DLIMIT:
dump = atoi(opt_arg());
dump = strtol(opt_arg(), NULL, 0);
break;
case OPT_STRPARSE:
sk_OPENSSL_STRING_push(osk, opt_arg());
@@ -205,7 +205,7 @@ int asn1parse_main(int argc, char **argv)
num = 0;
for (;;) {
if (!BUF_MEM_grow(buf, (int)num + BUFSIZ))
if (!BUF_MEM_grow(buf, num + BUFSIZ))
goto end;
i = BIO_read(in, &(buf->data[num]), BUFSIZ);
if (i <= 0)
@@ -225,9 +225,9 @@ int asn1parse_main(int argc, char **argv)
for (i = 0; i < sk_OPENSSL_STRING_num(osk); i++) {
ASN1_TYPE *atmp;
int typ;
j = atoi(sk_OPENSSL_STRING_value(osk, i));
if (j == 0) {
BIO_printf(bio_err, "'%s' is an invalid number\n",
j = strtol(sk_OPENSSL_STRING_value(osk, i), NULL, 0);
if (j <= 0 || j >= tmplen) {
BIO_printf(bio_err, "'%s' is out of range\n",
sk_OPENSSL_STRING_value(osk, i));
continue;
}
@@ -258,14 +258,14 @@ int asn1parse_main(int argc, char **argv)
num = tmplen;
}
if (offset >= num) {
BIO_printf(bio_err, "Error: offset too large\n");
if (offset < 0 || offset >= num) {
BIO_printf(bio_err, "Error: offset out of range\n");
goto end;
}
num -= offset;
if ((length == 0) || ((long)length > num))
if (length == 0 || length > (unsigned int)num)
length = (unsigned int)num;
if (derout != NULL) {
if (BIO_write(derout, str + offset, length) != (int)length) {
apps/build.info
+5
View File
@@ -23,6 +23,11 @@ IF[{- !$disabled{apps} -}]
INCLUDE[openssl]=.. ../include
DEPEND[openssl]=libapps.a ../libssl
IF[{- $config{target} =~ /^(?:Cygwin|mingw|VC-)/ -}]
GENERATE[openssl.rc]=../util/mkrc.pl openssl
SOURCE[openssl]=openssl.rc
ENDIF
{- join("\n ", map { (my $x = $_) =~ s|\.c$|.o|; "DEPEND[$x]=progs.h" }
@apps_openssl_src) -}
GENERATE[progs.h]=progs.pl $(APPS_OPENSSL)
apps/ca.c
+149 -139
View File
@@ -498,7 +498,7 @@ end_of_options:
if (db == NULL)
goto end;
if (!index_index(db))
if (index_index(db) <= 0)
goto end;
if (get_certificate_status(ser_status, db) != 1)
@@ -664,10 +664,6 @@ end_of_options:
goto end;
}
}
if (pp[DB_name][0] == '\0') {
BIO_printf(bio_err, "entry %d: bad Subject\n", i + 1);
goto end;
}
}
if (verbose) {
TXT_DB_write(bio_out, db->db);
@@ -676,7 +672,7 @@ end_of_options:
BIO_printf(bio_err, "generating index\n");
}
if (!index_index(db))
if (index_index(db) <= 0)
goto end;
/*****************************************************************/
@@ -726,8 +722,12 @@ end_of_options:
/*****************************************************************/
if (req || gencrl) {
/* FIXME: Is it really always text? */
Sout = bio_open_default(outfile, 'w', FORMAT_TEXT);
if (spkac_file != NULL) {
output_der = 1;
batch = 1;
}
Sout = bio_open_default(outfile, 'w',
output_der ? FORMAT_ASN1 : FORMAT_TEXT);
if (Sout == NULL)
goto end;
}
@@ -735,17 +735,21 @@ end_of_options:
if (md == NULL && (md = lookup_conf(conf, section, ENV_DEFAULT_MD)) == NULL)
goto end;
if (strcmp(md, "default") == 0) {
int def_nid;
if (EVP_PKEY_get_default_digest_nid(pkey, &def_nid) <= 0) {
BIO_puts(bio_err, "no default digest\n");
if (strcmp(md, "null") == 0) {
dgst = EVP_md_null();
} else {
if (strcmp(md, "default") == 0) {
int def_nid;
if (EVP_PKEY_get_default_digest_nid(pkey, &def_nid) <= 0) {
BIO_puts(bio_err, "no default digest\n");
goto end;
}
md = (char *)OBJ_nid2sn(def_nid);
}
if (!opt_md(md, &dgst)) {
goto end;
}
md = (char *)OBJ_nid2sn(def_nid);
}
if (!opt_md(md, &dgst)) {
goto end;
}
if (req) {
@@ -881,10 +885,6 @@ end_of_options:
BIO_printf(bio_err, "Memory allocation failure\n");
goto end;
}
if (outfile) {
output_der = 1;
batch = 1;
}
}
}
if (ss_cert_file != NULL) {
@@ -938,10 +938,13 @@ end_of_options:
if (j > 0) {
total_done++;
BIO_printf(bio_err, "\n");
if (!BN_add_word(serial, 1))
if (!BN_add_word(serial, 1)) {
X509_free(x);
goto end;
}
if (!sk_X509_push(cert_sk, x)) {
BIO_printf(bio_err, "Memory allocation failure\n");
X509_free(x);
goto end;
}
}
@@ -1375,7 +1378,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
CONF *lconf, unsigned long certopt, unsigned long nameopt,
int default_op, int ext_copy, int selfsign)
{
X509_NAME *name = NULL, *CAname = NULL, *subject = NULL, *dn_subject = NULL;
X509_NAME *name = NULL, *CAname = NULL, *subject = NULL;
const ASN1_TIME *tm;
ASN1_STRING *str, *str2;
ASN1_OBJECT *obj;
@@ -1408,10 +1411,6 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
BIO_printf(bio_err, "The Subject's Distinguished Name is as follows\n");
name = X509_REQ_get_subject_name(req);
if (X509_NAME_entry_count(name) == 0) {
BIO_printf(bio_err, "Error: The supplied Subject is empty\n");
goto end;
}
for (i = 0; i < X509_NAME_entry_count(name); i++) {
ne = X509_NAME_get_entry(name, i);
str = X509_NAME_ENTRY_get_data(ne);
@@ -1573,109 +1572,6 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
goto end;
}
if (X509_NAME_entry_count(subject) == 0) {
BIO_printf(bio_err,
"Error: After applying policy the Subject is empty\n");
goto end;
}
if (verbose)
BIO_printf(bio_err,
"The subject name appears to be ok, checking data base for clashes\n");
/*
* Build the correct Subject if no e-mail is wanted in the subject.
* And add it later on because of the method extensions are added (altName)
*/
if (email_dn) {
dn_subject = subject;
} else {
X509_NAME_ENTRY *tmpne;
/*
* Its best to dup the subject DN and then delete any email addresses
* because this retains its structure.
*/
if ((dn_subject = X509_NAME_dup(subject)) == NULL) {
BIO_printf(bio_err, "Memory allocation failure\n");
goto end;
}
while ((i = X509_NAME_get_index_by_NID(dn_subject,
NID_pkcs9_emailAddress,
-1)) >= 0) {
tmpne = X509_NAME_get_entry(dn_subject, i);
X509_NAME_delete_entry(dn_subject, i);
X509_NAME_ENTRY_free(tmpne);
}
}
if (BN_is_zero(serial))
row[DB_serial] = OPENSSL_strdup("00");
else
row[DB_serial] = BN_bn2hex(serial);
if (row[DB_serial] == NULL) {
BIO_printf(bio_err, "Memory allocation failure\n");
goto end;
}
if (db->attributes.unique_subject) {
OPENSSL_STRING *crow = row;
rrow = TXT_DB_get_by_index(db->db, DB_name, crow);
if (rrow != NULL) {
BIO_printf(bio_err,
"ERROR:There is already a certificate for %s\n",
row[DB_name]);
}
}
if (rrow == NULL) {
rrow = TXT_DB_get_by_index(db->db, DB_serial, row);
if (rrow != NULL) {
BIO_printf(bio_err,
"ERROR:Serial number %s has already been issued,\n",
row[DB_serial]);
BIO_printf(bio_err,
" check the database/serial_file for corruption\n");
}
}
if (rrow != NULL) {
BIO_printf(bio_err, "The matching entry has the following details\n");
if (rrow[DB_type][0] == DB_TYPE_EXP)
p = "Expired";
else if (rrow[DB_type][0] == DB_TYPE_REV)
p = "Revoked";
else if (rrow[DB_type][0] == DB_TYPE_VAL)
p = "Valid";
else
p = "\ninvalid type, Data base error\n";
BIO_printf(bio_err, "Type :%s\n", p);;
if (rrow[DB_type][0] == DB_TYPE_REV) {
p = rrow[DB_exp_date];
if (p == NULL)
p = "undef";
BIO_printf(bio_err, "Was revoked on:%s\n", p);
}
p = rrow[DB_exp_date];
if (p == NULL)
p = "undef";
BIO_printf(bio_err, "Expires on :%s\n", p);
p = rrow[DB_serial];
if (p == NULL)
p = "undef";
BIO_printf(bio_err, "Serial Number :%s\n", p);
p = rrow[DB_file];
if (p == NULL)
p = "undef";
BIO_printf(bio_err, "File name :%s\n", p);
p = rrow[DB_name];
if (p == NULL)
p = "undef";
BIO_printf(bio_err, "Subject Name :%s\n", p);
ok = -1; /* This is now a 'bad' error. */
goto end;
}
/* We are now totally happy, lets make and sign the certificate */
if (verbose)
BIO_printf(bio_err,
@@ -1785,10 +1681,123 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
goto end;
}
/* Set the right value for the noemailDN option */
if (email_dn == 0) {
if (!X509_set_subject_name(ret, dn_subject))
if (verbose)
BIO_printf(bio_err,
"The subject name appears to be ok, checking data base for clashes\n");
/* Build the correct Subject if no e-mail is wanted in the subject. */
if (!email_dn) {
X509_NAME_ENTRY *tmpne;
X509_NAME *dn_subject;
/*
* Its best to dup the subject DN and then delete any email addresses
* because this retains its structure.
*/
if ((dn_subject = X509_NAME_dup(subject)) == NULL) {
BIO_printf(bio_err, "Memory allocation failure\n");
goto end;
}
while ((i = X509_NAME_get_index_by_NID(dn_subject,
NID_pkcs9_emailAddress,
-1)) >= 0) {
tmpne = X509_NAME_get_entry(dn_subject, i);
X509_NAME_delete_entry(dn_subject, i);
X509_NAME_ENTRY_free(tmpne);
}
if (!X509_set_subject_name(ret, dn_subject)) {
X509_NAME_free(dn_subject);
goto end;
}
X509_NAME_free(dn_subject);
}
row[DB_name] = X509_NAME_oneline(X509_get_subject_name(ret), NULL, 0);
if (row[DB_name] == NULL) {
BIO_printf(bio_err, "Memory allocation failure\n");
goto end;
}
if (BN_is_zero(serial))
row[DB_serial] = OPENSSL_strdup("00");
else
row[DB_serial] = BN_bn2hex(serial);
if (row[DB_serial] == NULL) {
BIO_printf(bio_err, "Memory allocation failure\n");
goto end;
}
if (row[DB_name][0] == '\0') {
/*
* An empty subject! We'll use the serial number instead. If
* unique_subject is in use then we don't want different entries with
* empty subjects matching each other.
*/
OPENSSL_free(row[DB_name]);
row[DB_name] = OPENSSL_strdup(row[DB_serial]);
if (row[DB_name] == NULL) {
BIO_printf(bio_err, "Memory allocation failure\n");
goto end;
}
}
if (db->attributes.unique_subject) {
OPENSSL_STRING *crow = row;
rrow = TXT_DB_get_by_index(db->db, DB_name, crow);
if (rrow != NULL) {
BIO_printf(bio_err,
"ERROR:There is already a certificate for %s\n",
row[DB_name]);
}
}
if (rrow == NULL) {
rrow = TXT_DB_get_by_index(db->db, DB_serial, row);
if (rrow != NULL) {
BIO_printf(bio_err,
"ERROR:Serial number %s has already been issued,\n",
row[DB_serial]);
BIO_printf(bio_err,
" check the database/serial_file for corruption\n");
}
}
if (rrow != NULL) {
BIO_printf(bio_err, "The matching entry has the following details\n");
if (rrow[DB_type][0] == DB_TYPE_EXP)
p = "Expired";
else if (rrow[DB_type][0] == DB_TYPE_REV)
p = "Revoked";
else if (rrow[DB_type][0] == DB_TYPE_VAL)
p = "Valid";
else
p = "\ninvalid type, Data base error\n";
BIO_printf(bio_err, "Type :%s\n", p);;
if (rrow[DB_type][0] == DB_TYPE_REV) {
p = rrow[DB_exp_date];
if (p == NULL)
p = "undef";
BIO_printf(bio_err, "Was revoked on:%s\n", p);
}
p = rrow[DB_exp_date];
if (p == NULL)
p = "undef";
BIO_printf(bio_err, "Expires on :%s\n", p);
p = rrow[DB_serial];
if (p == NULL)
p = "undef";
BIO_printf(bio_err, "Serial Number :%s\n", p);
p = rrow[DB_file];
if (p == NULL)
p = "undef";
BIO_printf(bio_err, "File name :%s\n", p);
p = rrow[DB_name];
if (p == NULL)
p = "undef";
BIO_printf(bio_err, "Subject Name :%s\n", p);
ok = -1; /* This is now a 'bad' error. */
goto end;
}
if (!default_op) {
@@ -1840,8 +1849,6 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
row[DB_exp_date][tm->length] = '\0';
row[DB_rev_date] = NULL;
row[DB_file] = OPENSSL_strdup("unknown");
row[DB_name] = X509_NAME_oneline(X509_get_subject_name(ret), NULL, 0);
if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
(row[DB_file] == NULL) || (row[DB_name] == NULL)) {
BIO_printf(bio_err, "Memory allocation failure\n");
@@ -1861,16 +1868,14 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
irow = NULL;
ok = 1;
end:
if (irow != NULL) {
if (ok != 1) {
for (i = 0; i < DB_NUMBER; i++)
OPENSSL_free(row[i]);
OPENSSL_free(irow);
}
OPENSSL_free(irow);
X509_NAME_free(CAname);
X509_NAME_free(subject);
if (dn_subject != subject)
X509_NAME_free(dn_subject);
if (ok <= 0)
X509_free(ret);
else
@@ -2050,6 +2055,11 @@ static int do_revoke(X509 *x509, CA_DB *db, REVINFO_TYPE rev_type,
else
row[DB_serial] = BN_bn2hex(bn);
BN_free(bn);
if (row[DB_name] != NULL && row[DB_name][0] == '\0') {
/* Entries with empty Subjects actually use the serial number instead */
OPENSSL_free(row[DB_name]);
row[DB_name] = OPENSSL_strdup(row[DB_serial]);
}
if ((row[DB_name] == NULL) || (row[DB_serial] == NULL)) {
BIO_printf(bio_err, "Memory allocation failure\n");
goto end;
apps/ciphers.c
+13 -1
View File
@@ -26,6 +26,7 @@ typedef enum OPTION_choice {
OPT_TLS1_3,
OPT_PSK,
OPT_SRP,
OPT_CIPHERSUITES,
OPT_V, OPT_UPPER_V, OPT_S
} OPTION_CHOICE;
@@ -57,6 +58,8 @@ const OPTIONS ciphers_options[] = {
{"srp", OPT_SRP, '-', "include ciphersuites requiring SRP"},
#endif
{"convert", OPT_CONVERT, 's', "Convert standard name into OpenSSL name"},
{"ciphersuites", OPT_CIPHERSUITES, 's',
"Configure the TLSv1.3 ciphersuites to use"},
{NULL}
};
@@ -91,7 +94,7 @@ int ciphers_main(int argc, char **argv)
int srp = 0;
#endif
const char *p;
char *ciphers = NULL, *prog, *convert = NULL;
char *ciphers = NULL, *prog, *convert = NULL, *ciphersuites = NULL;
char buf[512];
OPTION_CHOICE o;
int min_version = 0, max_version = 0;
@@ -153,6 +156,9 @@ int ciphers_main(int argc, char **argv)
srp = 1;
#endif
break;
case OPT_CIPHERSUITES:
ciphersuites = opt_arg();
break;
}
}
argv = opt_rest();
@@ -185,6 +191,12 @@ int ciphers_main(int argc, char **argv)
if (srp)
SSL_CTX_set_srp_client_pwd_callback(ctx, dummy_srp);
#endif
if (ciphersuites != NULL && !SSL_CTX_set_ciphersuites(ctx, ciphersuites)) {
BIO_printf(bio_err, "Error setting TLSv1.3 ciphersuites\n");
goto err;
}
if (ciphers != NULL) {
if (!SSL_CTX_set_cipher_list(ctx, ciphers)) {
BIO_printf(bio_err, "Error in cipher list\n");
apps/dgst.c
+13 -2
View File
@@ -235,6 +235,8 @@ int dgst_main(int argc, char **argv)
}
if (keyfile != NULL) {
int type;
if (want_pub)
sigkey = load_pubkey(keyfile, keyform, 0, NULL, e, "key file");
else
@@ -245,6 +247,15 @@ int dgst_main(int argc, char **argv)
*/
goto end;
}
type = EVP_PKEY_id(sigkey);
if (type == EVP_PKEY_ED25519 || type == EVP_PKEY_ED448) {
/*
* We implement PureEdDSA for these which doesn't have a separate
* digest, and only supports one shot.
*/
BIO_printf(bio_err, "Key type not supported for this operation\n");
goto end;
}
}
if (mac_name != NULL) {
@@ -277,8 +288,8 @@ int dgst_main(int argc, char **argv)
}
if (hmac_key != NULL) {
sigkey = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, impl,
(unsigned char *)hmac_key, -1);
sigkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, impl,
(unsigned char *)hmac_key, -1);
if (sigkey == NULL)
goto end;
}
apps/dhparam.c
+5 -4
View File
@@ -153,6 +153,11 @@ int dhparam_main(int argc, char **argv)
goto end;
}
# endif
out = bio_open_default(outfile, 'w', outformat);
if (out == NULL)
goto end;
/* DH parameters */
if (num && !g)
g = 2;
@@ -260,10 +265,6 @@ int dhparam_main(int argc, char **argv)
/* dh != NULL */
}
out = bio_open_default(outfile, 'w', outformat);
if (out == NULL)
goto end;
if (text) {
DHparams_print(out, dh);
}
apps/dsaparam.c
+3
View File
@@ -195,6 +195,9 @@ int dsaparam_main(int argc, char **argv)
OPENSSL_free(data);
}
if (outformat == FORMAT_ASN1 && genkey)
noout = 1;
if (!noout) {
if (outformat == FORMAT_ASN1)
i = i2d_DSAparams_bio(out, dsa);
apps/ecparam.c
+6
View File
@@ -384,6 +384,9 @@ int ecparam_main(int argc, char **argv)
"}\n");
}
if (outformat == FORMAT_ASN1 && genkey)
noout = 1;
if (!noout) {
if (outformat == FORMAT_ASN1)
i = i2d_ECPKParameters_bio(out, group);
@@ -410,6 +413,9 @@ int ecparam_main(int argc, char **argv)
goto end;
}
if (new_form)
EC_KEY_set_conv_form(eckey, form);
if (!EC_KEY_generate_key(eckey)) {
BIO_printf(bio_err, "unable to generate key\n");
EC_KEY_free(eckey);
apps/ocsp.c
+16 -13
View File
@@ -36,7 +36,8 @@ NON_EMPTY_TRANSLATION_UNIT
# include <openssl/x509v3.h>
# include <openssl/rand.h>
# if defined(OPENSSL_SYS_UNIX) && !defined(OPENSSL_NO_SOCK)
# if defined(OPENSSL_SYS_UNIX) && !defined(OPENSSL_NO_SOCK) \
&& !defined(OPENSSL_NO_POSIX_IO)
# define OCSP_DAEMON
# include <sys/types.h>
# include <sys/wait.h>
@@ -550,7 +551,7 @@ int ocsp_main(int argc, char **argv)
}
if (ridx_filename != NULL
&& (rkey != NULL || rsigner != NULL || rca_cert != NULL)) {
&& (rkey == NULL || rsigner == NULL || rca_cert == NULL)) {
BIO_printf(bio_err,
"Responder mode requires certificate, key, and CA.\n");
goto end;
@@ -558,7 +559,7 @@ int ocsp_main(int argc, char **argv)
if (ridx_filename != NULL) {
rdb = load_index(ridx_filename, NULL);
if (rdb == NULL || !index_index(rdb)) {
if (rdb == NULL || index_index(rdb) <= 0) {
ret = 1;
goto end;
}
@@ -581,10 +582,11 @@ redo_accept:
if (index_changed(rdb)) {
CA_DB *newrdb = load_index(ridx_filename, NULL);
if (newrdb != NULL) {
if (newrdb != NULL && index_index(newrdb) > 0) {
free_index(rdb);
rdb = newrdb;
} else {
free_index(newrdb);
log_message(LOG_ERR, "error reloading updated index: %s",
ridx_filename);
}
@@ -695,10 +697,8 @@ redo_accept:
if (i != OCSP_RESPONSE_STATUS_SUCCESSFUL) {
BIO_printf(out, "Responder Error: %s (%d)\n",
OCSP_response_status_str(i), i);
if (!ignore_err) {
ret = 0;
if (!ignore_err)
goto end;
}
}
if (resp_text)
@@ -812,7 +812,10 @@ log_message(int level, const char *fmt, ...)
va_start(ap, fmt);
# ifdef OCSP_DAEMON
if (multi) {
vsyslog(level, fmt, ap);
char buf[1024];
if (vsnprintf(buf, sizeof(buf), fmt, ap) > 0) {
syslog(level, "%s", buf);
}
if (level >= LOG_ERR)
ERR_print_errors_cb(print_syslog, &level);
}
@@ -878,7 +881,6 @@ static void noteterm (int sig)
*/
static void spawn_loop(void)
{
const char *signame;
pid_t *kidpids = NULL;
int status;
int procs = 0;
@@ -927,7 +929,10 @@ static void spawn_loop(void)
else if (WIFSIGNALED(status))
syslog(LOG_WARNING, "child process: %ld, term signal %d%s",
(long)fpid, WTERMSIG(status),
WCOREDUMP(status) ? " (core dumped)" : "");
#ifdef WCOREDUMP
WCOREDUMP(status) ? " (core dumped)" :
#endif
"");
sleep(1);
}
break;
@@ -971,9 +976,7 @@ static void spawn_loop(void)
}
/* The loop above can only break on termsig */
signame = strsignal(termsig);
syslog(LOG_INFO, "terminating on signal: %s(%d)",
signame ? signame : "", termsig);
syslog(LOG_INFO, "terminating on signal: %d", termsig);
killall(0, kidpids);
}
# endif
apps/openssl.c
+6 -3
View File
@@ -74,7 +74,7 @@ static void calculate_columns(DISPLAY_COLUMNS *dc)
dc->columns = (80 - 1) / dc->width;
}
static int apps_startup()
static int apps_startup(void)
{
#ifdef SIGPIPE
signal(SIGPIPE, SIG_IGN);
@@ -90,13 +90,13 @@ static int apps_startup()
return 1;
}
static void apps_shutdown()
static void apps_shutdown(void)
{
destroy_ui_method();
destroy_prefix_method();
}
static char *make_config_name()
static char *make_config_name(void)
{
const char *t;
size_t len;
@@ -762,6 +762,9 @@ static void list_disabled(void)
#ifdef OPENSSL_NO_SEED
BIO_puts(bio_out, "SEED\n");
#endif
#ifdef OPENSSL_NO_SM2
BIO_puts(bio_out, "SM2\n");
#endif
#ifdef OPENSSL_NO_SM3
BIO_puts(bio_out, "SM3\n");
#endif
apps/opt.c
+3 -44
View File
@@ -613,17 +613,13 @@ int opt_verify(int opt, X509_VERIFY_PARAM *vpm)
*/
int opt_next(void)
{
char *p, *estr;
char *p;
const OPTIONS *o;
int ival;
long lval;
unsigned long ulval;
ossl_intmax_t imval;
ossl_uintmax_t umval;
#if !defined(_WIN32)
char *c;
int oerrno;
#endif
/* Look at current arg; at end of the list? */
arg = NULL;
@@ -686,47 +682,10 @@ int opt_next(void)
return -1;
case '<':
/* Input file. */
if (strcmp(arg, "-") == 0 || app_access(arg, R_OK) == 0)
break;
BIO_printf(bio_err,
"%s: Cannot open input file %s, %s\n",
prog, arg, strerror(errno));
return -1;
break;
case '>':
/* Output file. */
#if !defined(_WIN32)
c = OPENSSL_strdup(arg);
if (c == NULL) {
BIO_printf(bio_err,
"%s: Memory allocation failure\n", prog);
return -1;
}
oerrno = errno;
errno = 0;
if (strcmp(arg, "-") == 0
|| (app_access(app_dirname(c), W_OK) == 0
&& app_isdir(arg) <= 0
&& (app_access(arg, W_OK) == 0 || errno == ENOENT))) {
OPENSSL_free(c);
break;
}
OPENSSL_free(c);
if (errno == 0)
/* only possible if 'arg' is a directory */
estr = "is a directory";
else
estr = strerror(errno);
errno = oerrno;
#else
if (strcmp(arg, "-") == 0 || app_access(arg, W_OK) == 0
|| errno == ENOENT)
break;
estr = strerror(errno);
#endif
BIO_printf(bio_err,
"%s: Cannot open output file %s, %s\n",
prog, arg, estr);
return -1;
break;
case 'p':
case 'n':
if (!opt_int(arg, &ival)
apps/pkeyutl.c
+25 -10
View File
@@ -84,8 +84,7 @@ int pkeyutl_main(int argc, char **argv)
char hexdump = 0, asn1parse = 0, rev = 0, *prog;
unsigned char *buf_in = NULL, *buf_out = NULL, *sig = NULL;
OPTION_CHOICE o;
int buf_inlen = 0, siglen = -1, keyform = FORMAT_PEM, peerform =
FORMAT_PEM;
int buf_inlen = 0, siglen = -1, keyform = FORMAT_PEM, peerform = FORMAT_PEM;
int keysize = -1, pkey_op = EVP_PKEY_OP_SIGN, key_type = KEY_PRIVKEY;
int engine_impl = 0;
int ret = 1, rv = -1;
@@ -200,10 +199,18 @@ int pkeyutl_main(int argc, char **argv)
goto opthelp;
if (kdfalg != NULL) {
if (kdflen == 0)
if (kdflen == 0) {
BIO_printf(bio_err,
"%s: no KDF length given (-kdflen parameter).\n", prog);
goto opthelp;
} else if ((inkey == NULL)
|| (peerkey != NULL && pkey_op != EVP_PKEY_OP_DERIVE)) {
}
} else if (inkey == NULL) {
BIO_printf(bio_err,
"%s: no private key given (-inkey parameter).\n", prog);
goto opthelp;
} else if (peerkey != NULL && pkey_op != EVP_PKEY_OP_DERIVE) {
BIO_printf(bio_err,
"%s: no peer key given (-peerkey parameter).\n", prog);
goto opthelp;
}
ctx = init_ctx(kdfalg, &keysize, inkey, keyform, key_type,
@@ -226,7 +233,8 @@ int pkeyutl_main(int argc, char **argv)
const char *opt = sk_OPENSSL_STRING_value(pkeyopts, i);
if (pkey_ctrl_string(ctx, opt) <= 0) {
BIO_printf(bio_err, "%s: Can't set parameter:\n", prog);
BIO_printf(bio_err, "%s: Can't set parameter \"%s\":\n",
prog, opt);
ERR_print_errors(bio_err);
goto end;
}
@@ -313,7 +321,11 @@ int pkeyutl_main(int argc, char **argv)
buf_in, (size_t)buf_inlen);
}
if (rv <= 0) {
BIO_puts(bio_err, "Public Key operation error\n");
if (pkey_op != EVP_PKEY_OP_DERIVE) {
BIO_puts(bio_err, "Public Key operation error\n");
} else {
BIO_puts(bio_err, "Key derivation failed\n");
}
ERR_print_errors(bio_err);
goto end;
}
@@ -393,8 +405,11 @@ static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
if (kdfnid == NID_undef) {
kdfnid = OBJ_ln2nid(kdfalg);
if (kdfnid == NID_undef)
if (kdfnid == NID_undef) {
BIO_printf(bio_err, "The given KDF \"%s\" is unknown.\n",
kdfalg);
goto end;
}
}
ctx = EVP_PKEY_CTX_new_id(kdfnid, impl);
} else {
@@ -446,10 +461,10 @@ static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
}
static int setup_peer(EVP_PKEY_CTX *ctx, int peerform, const char *file,
ENGINE* e)
ENGINE *e)
{
EVP_PKEY *peer = NULL;
ENGINE* engine = NULL;
ENGINE *engine = NULL;
int ret;
if (peerform == FORMAT_ENGINE)
apps/progs.pl
+8 -3
View File
@@ -17,12 +17,14 @@ use configdata qw/@disablables %unified_info/;
my %commands = ();
my $cmdre = qr/^\s*int\s+([a-z_][a-z0-9_]*)_main\(\s*int\s+argc\s*,/;
my $apps_openssl = shift @ARGV;
my $YEAR = [localtime()]->[5] + 1900;
# because the program apps/openssl has object files as sources, and
# they then have the corresponding C files as source, we need to chain
# the lookups in %unified_info
my @openssl_source =
map { @{$unified_info{sources}->{$_}} }
grep { /\.o$/ }
@{$unified_info{sources}->{$apps_openssl}};
foreach my $filename (@openssl_source) {
@@ -36,12 +38,12 @@ foreach my $filename (@openssl_source) {
@ARGV = sort keys %commands;
print <<'EOF';
print <<"EOF";
/*
* WARNING: do not edit!
* Generated by apps/progs.pl
*
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-$YEAR The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -109,7 +111,10 @@ my %md_disabler = (
foreach my $cmd (
"md2", "md4", "md5",
"gost",
"sha1", "sha224", "sha256", "sha384", "sha512",
"sha1", "sha224", "sha256", "sha384",
"sha512", "sha512-224", "sha512-256",
"sha3-224", "sha3-256", "sha3-384", "sha3-512",
"shake128", "shake256",
"mdc2", "rmd160", "blake2b512", "blake2s256",
"sm3"
) {
apps/rehash.c
+10 -8
View File
@@ -126,9 +126,10 @@ static int add_entry(enum Type type, unsigned int hash, const char *filename,
for (ep = bp->first_entry; ep; ep = ep->next) {
if (digest && memcmp(digest, ep->digest, evpmdsize) == 0) {
BIO_printf(bio_err,
"%s: skipping duplicate %s in %s\n", opt_getprog(),
"%s: warning: skipping duplicate %s in %s\n",
opt_getprog(),
type == TYPE_CERT ? "certificate" : "CRL", filename);
return 1;
return 0;
}
if (strcmp(filename, ep->filename) == 0) {
found = ep;
@@ -140,7 +141,7 @@ static int add_entry(enum Type type, unsigned int hash, const char *filename,
if (ep == NULL) {
if (bp->num_needed >= MAX_COLLISIONS) {
BIO_printf(bio_err,
"%s: hash table overflow for %s\n",
"%s: error: hash table overflow for %s\n",
opt_getprog(), filename);
return 1;
}
@@ -231,7 +232,7 @@ static int do_file(const char *filename, const char *fullpath, enum Hash h)
/* Does it have X.509 data in it? */
if ((b = BIO_new_file(fullpath, "r")) == NULL) {
BIO_printf(bio_err, "%s: skipping %s, cannot open file\n",
BIO_printf(bio_err, "%s: error: skipping %s, cannot open file\n",
opt_getprog(), filename);
errs++;
goto end;
@@ -243,7 +244,7 @@ static int do_file(const char *filename, const char *fullpath, enum Hash h)
if (sk_X509_INFO_num(inf) != 1) {
BIO_printf(bio_err,
"%s: skipping %s,"
"%s: warning: skipping %s,"
"it does not contain exactly one certificate or CRL\n",
opt_getprog(), filename);
/* This is not an error. */
@@ -479,13 +480,14 @@ int rehash_main(int argc, char **argv)
if (*argv != NULL) {
while (*argv != NULL)
errs += do_dir(*argv++, h);
} else if ((env = getenv("SSL_CERT_DIR")) != NULL) {
} else if ((env = getenv(X509_get_default_cert_dir_env())) != NULL) {
char lsc[2] = { LIST_SEPARATOR_CHAR, '\0' };
m = OPENSSL_strdup(env);
for (e = strtok(m, ":"); e != NULL; e = strtok(NULL, ":"))
for (e = strtok(m, lsc); e != NULL; e = strtok(NULL, lsc))
errs += do_dir(e, h);
OPENSSL_free(m);
} else {
errs += do_dir("/etc/ssl/certs", h);
errs += do_dir(X509_get_default_cert_dir(), h);
}
end:
apps/req.c
+44 -64
View File
@@ -63,6 +63,11 @@ static int add_DN_object(X509_NAME *n, char *text, const char *def,
char *value, int nid, int n_min, int n_max,
unsigned long chtype, int mval);
static int genpkey_cb(EVP_PKEY_CTX *ctx);
static int build_data(char *text, const char *def,
char *value, int n_min, int n_max,
char *buf, const int buf_size,
const char *desc1, const char *desc2
);
static int req_check_len(int len, int n_min, int n_max);
static int check_end(const char *str, const char *end);
static int join(char buf[], size_t buf_size, const char *name,
@@ -365,7 +370,7 @@ int req_main(int argc, char **argv)
if (addext_bio) {
if (verbose)
BIO_printf(bio_err,
"Using additional configuraton from command line\n");
"Using additional configuration from command line\n");
addext_conf = app_load_config_bio(addext_bio, NULL);
}
if (template != default_config_file && !app_load_modules(req_conf))
@@ -1202,58 +1207,19 @@ static int add_DN_object(X509_NAME *n, char *text, const char *def,
char *value, int nid, int n_min, int n_max,
unsigned long chtype, int mval)
{
int i, ret = 0;
int ret = 0;
char buf[1024];
start:
if (!batch)
BIO_printf(bio_err, "%s [%s]:", text, def);
(void)BIO_flush(bio_err);
if (value != NULL) {
if (!join(buf, sizeof(buf), value, "\n", "DN value"))
return 0;
BIO_printf(bio_err, "%s\n", value);
} else {
buf[0] = '\0';
if (!batch) {
if (!fgets(buf, sizeof(buf), stdin))
return 0;
} else {
buf[0] = '\n';
buf[1] = '\0';
}
}
if (buf[0] == '\0')
return 0;
if (buf[0] == '\n') {
if ((def == NULL) || (def[0] == '\0'))
return 1;
if (!join(buf, sizeof(buf), def, "\n", "DN default"))
return 0;
} else if ((buf[0] == '.') && (buf[1] == '\n')) {
return 1;
}
i = strlen(buf);
if (buf[i - 1] != '\n') {
BIO_printf(bio_err, "weird input :-(\n");
return 0;
}
buf[--i] = '\0';
#ifdef CHARSET_EBCDIC
ebcdic2ascii(buf, buf, i);
#endif
if (!req_check_len(i, n_min, n_max)) {
if (batch || value)
return 0;
goto start;
}
ret = build_data(text, def, value, n_min, n_max, buf, sizeof(buf),
"DN value", "DN default");
if ((ret == 0) || (ret == 1))
return ret;
ret = 1;
if (!X509_NAME_add_entry_by_NID(n, nid, chtype,
(unsigned char *)buf, -1, -1, mval))
goto err;
ret = 1;
err:
ret = 0;
return ret;
}
@@ -1261,21 +1227,45 @@ static int add_attribute_object(X509_REQ *req, char *text, const char *def,
char *value, int nid, int n_min,
int n_max, unsigned long chtype)
{
int i;
static char buf[1024];
int ret = 0;
char buf[1024];
ret = build_data(text, def, value, n_min, n_max, buf, sizeof(buf),
"Attribute value", "Attribute default");
if ((ret == 0) || (ret == 1))
return ret;
ret = 1;
if (!X509_REQ_add1_attr_by_NID(req, nid, chtype,
(unsigned char *)buf, -1)) {
BIO_printf(bio_err, "Error adding attribute\n");
ERR_print_errors(bio_err);
ret = 0;
}
return ret;
}
static int build_data(char *text, const char *def,
char *value, int n_min, int n_max,
char *buf, const int buf_size,
const char *desc1, const char *desc2
)
{
int i;
start:
if (!batch)
BIO_printf(bio_err, "%s [%s]:", text, def);
(void)BIO_flush(bio_err);
if (value != NULL) {
if (!join(buf, sizeof(buf), value, "\n", "Attribute value"))
if (!join(buf, buf_size, value, "\n", desc1))
return 0;
BIO_printf(bio_err, "%s\n", value);
} else {
buf[0] = '\0';
if (!batch) {
if (!fgets(buf, sizeof(buf), stdin))
if (!fgets(buf, buf_size, stdin))
return 0;
} else {
buf[0] = '\n';
@@ -1288,7 +1278,7 @@ static int add_attribute_object(X509_REQ *req, char *text, const char *def,
if (buf[0] == '\n') {
if ((def == NULL) || (def[0] == '\0'))
return 1;
if (!join(buf, sizeof(buf), def, "\n", "Attribute default"))
if (!join(buf, buf_size, def, "\n", desc2))
return 0;
} else if ((buf[0] == '.') && (buf[1] == '\n')) {
return 1;
@@ -1308,17 +1298,7 @@ static int add_attribute_object(X509_REQ *req, char *text, const char *def,
return 0;
goto start;
}
if (!X509_REQ_add1_attr_by_NID(req, nid, chtype,
(unsigned char *)buf, -1)) {
BIO_printf(bio_err, "Error adding attribute\n");
ERR_print_errors(bio_err);
goto err;
}
return 1;
err:
return 0;
return 2;
}
static int req_check_len(int len, int n_min, int n_max)
apps/s_apps.h
+7 -3
View File
@@ -22,9 +22,8 @@
typedef int (*do_server_cb)(int s, int stype, int prot, unsigned char *context);
int do_server(int *accept_sock, const char *host, const char *port,
int family, int type, int protocol,
do_server_cb cb,
unsigned char *context, int naccept);
int family, int type, int protocol, do_server_cb cb,
unsigned char *context, int naccept, BIO *bio_s_out);
#ifdef HEADER_X509_H
int verify_callback(int ok, X509_STORE_CTX *ctx);
#endif
@@ -58,6 +57,11 @@ int generate_cookie_callback(SSL *ssl, unsigned char *cookie,
int verify_cookie_callback(SSL *ssl, const unsigned char *cookie,
unsigned int cookie_len);
#ifdef __VMS /* 31 char symbol name limit */
# define generate_stateless_cookie_callback generate_stateless_cookie_cb
# define verify_stateless_cookie_callback verify_stateless_cookie_cb
#endif
int generate_stateless_cookie_callback(SSL *ssl, unsigned char *cookie,
size_t *cookie_len);
int verify_stateless_cookie_callback(SSL *ssl, const unsigned char *cookie,
apps/s_client.c
+33 -26
View File
@@ -367,8 +367,6 @@ static char *ssl_give_srp_client_pwd_cb(SSL *s, void *arg)
#endif
static char *srtp_profiles = NULL;
#ifndef OPENSSL_NO_NEXTPROTONEG
/* This the context that we pass to next_proto_cb */
typedef struct tlsextnextprotoctx_st {
@@ -639,7 +637,8 @@ const OPTIONS s_client_options[] = {
"Disable name checks when matching DANE-EE(3) TLSA records"},
{"reconnect", OPT_RECONNECT, '-',
"Drop and re-make the connection with the same Session-ID"},
{"showcerts", OPT_SHOWCERTS, '-', "Show all certificates in the chain"},
{"showcerts", OPT_SHOWCERTS, '-',
"Show all certificates sent by the server"},
{"debug", OPT_DEBUG, '-', "Extra output"},
{"msg", OPT_MSG, '-', "Show protocol messages"},
{"msgfile", OPT_MSGFILE, '>',
@@ -657,8 +656,10 @@ const OPTIONS s_client_options[] = {
OPT_R_OPTIONS,
{"sess_out", OPT_SESS_OUT, '>', "File to write SSL session to"},
{"sess_in", OPT_SESS_IN, '<', "File to read SSL session from"},
#ifndef OPENSSL_NO_SRTP
{"use_srtp", OPT_USE_SRTP, 's',
"Offer SRTP key management with a colon-separated profile list"},
#endif
{"keymatexport", OPT_KEYMATEXPORT, 's',
"Export keying material using label"},
{"keymatexportlen", OPT_KEYMATEXPORTLEN, 'p',
@@ -934,6 +935,9 @@ int s_client_main(int argc, char **argv)
int srp_lateuser = 0;
SRP_ARG srp_arg = { NULL, NULL, 0, 0, 0, 1024 };
#endif
#ifndef OPENSSL_NO_SRTP
char *srtp_profiles = NULL;
#endif
#ifndef OPENSSL_NO_CT
char *ctlog_file = NULL;
int ct_validation = 0;
@@ -1420,7 +1424,9 @@ int s_client_main(int argc, char **argv)
noservername = 1;
break;
case OPT_USE_SRTP:
#ifndef OPENSSL_NO_SRTP
srtp_profiles = opt_arg();
#endif
break;
case OPT_KEYMATEXPORT:
keymatexportlabel = opt_arg();
@@ -1669,9 +1675,14 @@ int s_client_main(int argc, char **argv)
goto end;
}
SSL_CTX_clear_mode(ctx, SSL_MODE_AUTO_RETRY);
if (sdebug)
ssl_ctx_security_debug(ctx, sdebug);
if (!config_ctx(cctx, ssl_args, ctx))
goto end;
if (ssl_config != NULL) {
if (SSL_CTX_config(ctx, ssl_config) == 0) {
BIO_printf(bio_err, "Error using configuration \"%s\"\n",
@@ -1681,9 +1692,11 @@ int s_client_main(int argc, char **argv)
}
}
if (SSL_CTX_set_min_proto_version(ctx, min_version) == 0)
if (min_version != 0
&& SSL_CTX_set_min_proto_version(ctx, min_version) == 0)
goto end;
if (SSL_CTX_set_max_proto_version(ctx, max_version) == 0)
if (max_version != 0
&& SSL_CTX_set_max_proto_version(ctx, max_version) == 0)
goto end;
if (vpmtouched && !SSL_CTX_set1_param(ctx, vpm)) {
@@ -1729,9 +1742,6 @@ int s_client_main(int argc, char **argv)
goto end;
}
if (!config_ctx(cctx, ssl_args, ctx))
goto end;
if (!ssl_load_stores(ctx, vfyCApath, vfyCAfile, chCApath, chCAfile,
crls, crl_download)) {
BIO_printf(bio_err, "Error loading store locations\n");
@@ -2699,8 +2709,7 @@ int s_client_main(int argc, char **argv)
FD_ZERO(&readfds);
FD_ZERO(&writefds);
if ((SSL_version(con) == DTLS1_VERSION) &&
DTLSv1_get_timeout(con, &timeout))
if (SSL_is_dtls(con) && DTLSv1_get_timeout(con, &timeout))
timeoutp = &timeout;
else
timeoutp = NULL;
@@ -2811,10 +2820,8 @@ int s_client_main(int argc, char **argv)
}
}
if ((SSL_version(con) == DTLS1_VERSION)
&& DTLSv1_handle_timeout(con) > 0) {
if (SSL_is_dtls(con) && DTLSv1_handle_timeout(con) > 0)
BIO_printf(bio_err, "TIMEOUT occurred\n");
}
if (!ssl_pending && FD_ISSET(SSL_get_fd(con), &writefds)) {
k = SSL_write(con, &(cbuf[cbuf_off]), (unsigned int)cbuf_len);
@@ -3047,19 +3054,6 @@ int s_client_main(int argc, char **argv)
print_stuff(bio_c_out, con, full_log);
do_ssl_shutdown(con);
/*
* Give the socket time to send its last data before we close it.
* No amount of setting SO_LINGER etc on the socket seems to persuade
* Windows to send the data before closing the socket...but sleeping
* for a short time seems to do it (units in ms)
* TODO: Find a better way to do this
*/
#if defined(OPENSSL_SYS_WINDOWS)
Sleep(50);
#elif defined(OPENSSL_SYS_CYGWIN)
usleep(50000);
#endif
/*
* If we ended with an alert being sent, but still with data in the
* network buffer to be read, then calling BIO_closesocket() will
@@ -3071,6 +3065,19 @@ int s_client_main(int argc, char **argv)
* TCP-RST. This seems to allow the peer to read the alert data.
*/
shutdown(SSL_get_fd(con), 1); /* SHUT_WR */
/*
* We just said we have nothing else to say, but it doesn't mean that
* the other side has nothing. It's even recommended to consume incoming
* data. [In testing context this ensures that alerts are passed on...]
*/
timeout.tv_sec = 0;
timeout.tv_usec = 500000; /* some extreme round-trip */
do {
FD_ZERO(&readfds);
openssl_fdset(s, &readfds);
} while (select(s + 1, &readfds, NULL, NULL, &timeout) > 0
&& BIO_read(sbio, sbuf, BUFSIZZ) > 0);
BIO_closesocket(SSL_get_fd(con));
end:
if (con != NULL) {
apps/s_server.c
+26 -31
View File
@@ -236,6 +236,7 @@ typedef struct srpsrvparm_st {
SRP_VBASE *vb;
SRP_user_pwd *user;
} srpsrvparm;
static srpsrvparm srp_callback_parm;
/*
* This callback pretends to require some asynchronous logic in order to
@@ -722,13 +723,6 @@ static int not_resumable_sess_cb(SSL *s, int is_forward_secure)
return is_forward_secure;
}
#ifndef OPENSSL_NO_SRP
static srpsrvparm srp_callback_parm;
#endif
#ifndef OPENSSL_NO_SRTP
static char *srtp_profiles = NULL;
#endif
typedef enum OPTION_choice {
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, OPT_ENGINE,
OPT_4, OPT_6, OPT_ACCEPT, OPT_PORT, OPT_UNIX, OPT_UNLINK, OPT_NACCEPT,
@@ -753,7 +747,7 @@ typedef enum OPTION_choice {
OPT_ID_PREFIX, OPT_SERVERNAME, OPT_SERVERNAME_FATAL,
OPT_CERT2, OPT_KEY2, OPT_NEXTPROTONEG, OPT_ALPN,
OPT_SRTP_PROFILES, OPT_KEYMATEXPORT, OPT_KEYMATEXPORTLEN,
OPT_KEYLOG_FILE, OPT_MAX_EARLY, OPT_EARLY_DATA,
OPT_KEYLOG_FILE, OPT_MAX_EARLY, OPT_EARLY_DATA, OPT_S_NUM_TICKETS,
OPT_R_ENUM,
OPT_S_ENUM,
OPT_V_ENUM,
@@ -961,6 +955,8 @@ const OPTIONS s_server_options[] = {
{"max_early_data", OPT_MAX_EARLY, 'n',
"The maximum number of bytes of early data"},
{"early_data", OPT_EARLY_DATA, '-', "Attempt to read early data"},
{"num_tickets", OPT_S_NUM_TICKETS, 'n',
"The number of TLSv1.3 session tickets that a server will automatically issue" },
{NULL, OPT_EOF, 0, NULL}
};
@@ -1023,6 +1019,9 @@ int s_server_main(int argc, char *argv[])
#ifndef OPENSSL_NO_SRP
char *srpuserseed = NULL;
char *srp_verifier_file = NULL;
#endif
#ifndef OPENSSL_NO_SRTP
char *srtp_profiles = NULL;
#endif
int min_version = 0, max_version = 0, prot_opt = 0, no_prot_opt = 0;
int s_server_verify = SSL_VERIFY_NONE;
@@ -1257,6 +1256,7 @@ int s_server_main(int argc, char *argv[])
goto opthelp;
break;
case OPT_S_CASES:
case OPT_S_NUM_TICKETS:
if (ssl_args == NULL)
ssl_args = sk_OPENSSL_STRING_new_null();
if (ssl_args == NULL
@@ -1753,8 +1753,15 @@ int s_server_main(int argc, char *argv[])
ERR_print_errors(bio_err);
goto end;
}
SSL_CTX_clear_mode(ctx, SSL_MODE_AUTO_RETRY);
if (sdebug)
ssl_ctx_security_debug(ctx, sdebug);
if (!config_ctx(cctx, ssl_args, ctx))
goto end;
if (ssl_config) {
if (SSL_CTX_config(ctx, ssl_config) == 0) {
BIO_printf(bio_err, "Error using configuration \"%s\"\n",
@@ -1763,9 +1770,11 @@ int s_server_main(int argc, char *argv[])
goto end;
}
}
if (SSL_CTX_set_min_proto_version(ctx, min_version) == 0)
if (min_version != 0
&& SSL_CTX_set_min_proto_version(ctx, min_version) == 0)
goto end;
if (SSL_CTX_set_max_proto_version(ctx, max_version) == 0)
if (max_version != 0
&& SSL_CTX_set_max_proto_version(ctx, max_version) == 0)
goto end;
if (session_id_prefix) {
@@ -1841,8 +1850,6 @@ int s_server_main(int argc, char *argv[])
}
ssl_ctx_add_crls(ctx, crls, 0);
if (!config_ctx(cctx, ssl_args, ctx))
goto end;
if (!ssl_load_stores(ctx, vfyCApath, vfyCAfile, chCApath, chCAfile,
crls, crl_download)) {
@@ -2098,8 +2105,6 @@ int s_server_main(int argc, char *argv[])
if (max_early_data >= 0)
SSL_CTX_set_max_early_data(ctx, max_early_data);
BIO_printf(bio_s_out, "ACCEPT\n");
(void)BIO_flush(bio_s_out);
if (rev)
server_cb = rev_body;
else if (www)
@@ -2112,7 +2117,7 @@ int s_server_main(int argc, char *argv[])
unlink(host);
#endif
do_server(&accept_socket, host, port, socket_family, socket_type, protocol,
server_cb, context, naccept);
server_cb, context, naccept, bio_s_out);
print_stats(bio_s_out, ctx);
ret = 0;
end:
@@ -2194,9 +2199,7 @@ static int sv_body(int s, int stype, int prot, unsigned char *context)
SSL *con = NULL;
BIO *sbio;
struct timeval timeout;
#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS)
struct timeval tv;
#else
#if !(defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS))
struct timeval *timeoutp;
#endif
#ifndef OPENSSL_NO_DTLS
@@ -2397,26 +2400,23 @@ static int sv_body(int s, int stype, int prot, unsigned char *context)
* second and check for any keypress. In a proper Windows
* application we wouldn't do this because it is inefficient.
*/
tv.tv_sec = 1;
tv.tv_usec = 0;
i = select(width, (void *)&readfds, NULL, NULL, &tv);
timeout.tv_sec = 1;
timeout.tv_usec = 0;
i = select(width, (void *)&readfds, NULL, NULL, &timeout);
if (has_stdin_waiting())
read_from_terminal = 1;
if ((i < 0) || (!i && !read_from_terminal))
continue;
#else
if ((SSL_version(con) == DTLS1_VERSION) &&
DTLSv1_get_timeout(con, &timeout))
if (SSL_is_dtls(con) && DTLSv1_get_timeout(con, &timeout))
timeoutp = &timeout;
else
timeoutp = NULL;
i = select(width, (void *)&readfds, NULL, NULL, timeoutp);
if ((SSL_version(con) == DTLS1_VERSION)
&& DTLSv1_handle_timeout(con) > 0) {
if ((SSL_is_dtls(con)) && DTLSv1_handle_timeout(con) > 0)
BIO_printf(bio_err, "TIMEOUT occurred\n");
}
if (i <= 0)
continue;
@@ -2676,9 +2676,6 @@ static int sv_body(int s, int stype, int prot, unsigned char *context)
}
BIO_printf(bio_s_out, "CONNECTION CLOSED\n");
OPENSSL_clear_free(buf, bufsize);
if (ret >= 0)
BIO_printf(bio_s_out, "ACCEPT\n");
(void)BIO_flush(bio_s_out);
return ret;
}
@@ -3287,8 +3284,6 @@ static int www_body(int s, int stype, int prot, unsigned char *context)
SSL_set_shutdown(con, SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN);
err:
if (ret >= 0)
BIO_printf(bio_s_out, "ACCEPT\n");
OPENSSL_free(buf);
BIO_free_all(io);
return ret;
apps/s_socket.c
+57 -16
View File
@@ -146,7 +146,8 @@ int init_client(int *sock, const char *host, const char *port,
}
#endif
if (!BIO_connect(*sock, BIO_ADDRINFO_address(ai), 0)) {
if (!BIO_connect(*sock, BIO_ADDRINFO_address(ai),
type == SOCK_STREAM ? BIO_SOCK_NODELAY : 0)) {
BIO_closesocket(*sock);
*sock = INVALID_SOCKET;
continue;
@@ -204,14 +205,14 @@ out:
*/
int do_server(int *accept_sock, const char *host, const char *port,
int family, int type, int protocol, do_server_cb cb,
unsigned char *context, int naccept)
unsigned char *context, int naccept, BIO *bio_s_out)
{
int asock = 0;
int sock;
int i;
BIO_ADDRINFO *res = NULL;
const BIO_ADDRINFO *next;
int sock_family, sock_type, sock_protocol;
int sock_family, sock_type, sock_protocol, sock_port;
const BIO_ADDR *sock_address;
int sock_options = BIO_SOCK_REUSEADDR;
int ret = 0;
@@ -280,12 +281,50 @@ int do_server(int *accept_sock, const char *host, const char *port,
}
#endif
sock_port = BIO_ADDR_rawport(sock_address);
BIO_ADDRINFO_free(res);
res = NULL;
if (sock_port == 0) {
/* dynamically allocated port, report which one */
union BIO_sock_info_u info;
char *hostname = NULL;
char *service = NULL;
int success = 0;
if ((info.addr = BIO_ADDR_new()) != NULL
&& BIO_sock_info(asock, BIO_SOCK_INFO_ADDRESS, &info)
&& (hostname = BIO_ADDR_hostname_string(info.addr, 1)) != NULL
&& (service = BIO_ADDR_service_string(info.addr, 1)) != NULL
&& BIO_printf(bio_s_out,
strchr(hostname, ':') == NULL
? /* IPv4 */ "ACCEPT %s:%s\n"
: /* IPv6 */ "ACCEPT [%s]:%s\n",
hostname, service) > 0)
success = 1;
(void)BIO_flush(bio_s_out);
OPENSSL_free(hostname);
OPENSSL_free(service);
BIO_ADDR_free(info.addr);
if (!success) {
BIO_closesocket(asock);
ERR_print_errors(bio_err);
goto end;
}
} else {
(void)BIO_printf(bio_s_out, "ACCEPT\n");
(void)BIO_flush(bio_s_out);
}
if (accept_sock != NULL)
*accept_sock = asock;
for (;;) {
char sink[64];
struct timeval timeout;
fd_set readfds;
if (type == SOCK_STREAM) {
BIO_ADDR_free(ourpeer);
ourpeer = BIO_ADDR_new();
@@ -302,21 +341,9 @@ int do_server(int *accept_sock, const char *host, const char *port,
BIO_closesocket(asock);
break;
}
BIO_set_tcp_ndelay(sock, 1);
i = (*cb)(sock, type, protocol, context);
/*
* Give the socket time to send its last data before we close it.
* No amount of setting SO_LINGER etc on the socket seems to
* persuade Windows to send the data before closing the socket...
* but sleeping for a short time seems to do it (units in ms)
* TODO: Find a better way to do this
*/
#if defined(OPENSSL_SYS_WINDOWS)
Sleep(50);
#elif defined(OPENSSL_SYS_CYGWIN)
usleep(50000);
#endif
/*
* If we ended with an alert being sent, but still with data in the
* network buffer to be read, then calling BIO_closesocket() will
@@ -328,6 +355,20 @@ int do_server(int *accept_sock, const char *host, const char *port,
* TCP-RST. This seems to allow the peer to read the alert data.
*/
shutdown(sock, 1); /* SHUT_WR */
/*
* We just said we have nothing else to say, but it doesn't mean
* that the other side has nothing. It's even recommended to
* consume incoming data. [In testing context this ensures that
* alerts are passed on...]
*/
timeout.tv_sec = 0;
timeout.tv_usec = 500000; /* some extreme round-trip */
do {
FD_ZERO(&readfds);
openssl_fdset(sock, &readfds);
} while (select(sock + 1, &readfds, NULL, NULL, &timeout) > 0
&& readsocket(sock, sink, sizeof(sink)) > 0);
BIO_closesocket(sock);
} else {
i = (*cb)(asock, type, protocol, context);
apps/s_time.c
+35 -71
View File
@@ -7,8 +7,6 @@
* https://www.openssl.org/source/license.html
*/
#define NO_SHUTDOWN
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
@@ -24,26 +22,13 @@
#include <openssl/pem.h>
#include "s_apps.h"
#include <openssl/err.h>
#include <internal/sockets.h>
#if !defined(OPENSSL_SYS_MSDOS)
# include OPENSSL_UNISTD
#endif
#undef ioctl
#define ioctl ioctlsocket
#define SSL_CONNECT_NAME "localhost:4433"
/* no default cert. */
/*
* #define TEST_CERT "client.pem"
*/
#undef min
#undef max
#define min(a,b) (((a) < (b)) ? (a) : (b))
#define max(a,b) (((a) > (b)) ? (a) : (b))
#undef SECONDS
#define SECONDS 30
#define SECONDSSTR "30"
@@ -59,9 +44,9 @@ static const size_t fmt_http_get_cmd_size = sizeof(fmt_http_get_cmd) - 2;
typedef enum OPTION_choice {
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
OPT_CONNECT, OPT_CIPHER, OPT_CERT, OPT_NAMEOPT, OPT_KEY, OPT_CAPATH,
OPT_CAFILE, OPT_NOCAPATH, OPT_NOCAFILE, OPT_NEW, OPT_REUSE, OPT_BUGS,
OPT_VERIFY, OPT_TIME, OPT_SSL3,
OPT_CONNECT, OPT_CIPHER, OPT_CIPHERSUITES, OPT_CERT, OPT_NAMEOPT, OPT_KEY,
OPT_CAPATH, OPT_CAFILE, OPT_NOCAPATH, OPT_NOCAFILE, OPT_NEW, OPT_REUSE,
OPT_BUGS, OPT_VERIFY, OPT_TIME, OPT_SSL3,
OPT_WWW
} OPTION_CHOICE;
@@ -69,7 +54,9 @@ const OPTIONS s_time_options[] = {
{"help", OPT_HELP, '-', "Display this summary"},
{"connect", OPT_CONNECT, 's',
"Where to connect as post:port (default is " SSL_CONNECT_NAME ")"},
{"cipher", OPT_CIPHER, 's', "Cipher to use, see 'openssl ciphers'"},
{"cipher", OPT_CIPHER, 's', "TLSv1.2 and below cipher list to be used"},
{"ciphersuites", OPT_CIPHERSUITES, 's',
"Specify TLSv1.3 ciphersuites to be used"},
{"cert", OPT_CERT, '<', "Cert file to use, PEM format assumed"},
{"nameopt", OPT_NAMEOPT, 's', "Various certificate name options"},
{"key", OPT_KEY, '<', "File with key, PEM; default is -cert file"},
@@ -106,7 +93,8 @@ int s_time_main(int argc, char **argv)
SSL *scon = NULL;
SSL_CTX *ctx = NULL;
const SSL_METHOD *meth = NULL;
char *CApath = NULL, *CAfile = NULL, *cipher = NULL, *www_path = NULL;
char *CApath = NULL, *CAfile = NULL, *cipher = NULL, *ciphersuites = NULL;
char *www_path = NULL;
char *host = SSL_CONNECT_NAME, *certfile = NULL, *keyfile = NULL, *prog;
double totalTime = 0.0;
int noCApath = 0, noCAfile = 0;
@@ -170,6 +158,9 @@ int s_time_main(int argc, char **argv)
case OPT_CIPHER:
cipher = opt_arg();
break;
case OPT_CIPHERSUITES:
ciphersuites = opt_arg();
break;
case OPT_BUGS:
st_bugs = 1;
break;
@@ -196,21 +187,20 @@ int s_time_main(int argc, char **argv)
if (cipher == NULL)
cipher = getenv("SSL_CIPHER");
if (cipher == NULL) {
BIO_printf(bio_err, "No CIPHER specified\n");
goto end;
}
if ((ctx = SSL_CTX_new(meth)) == NULL)
goto end;
SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
SSL_CTX_set_quiet_shutdown(ctx, 1);
if (SSL_CTX_set_max_proto_version(ctx, max_version) == 0)
goto end;
if (st_bugs)
SSL_CTX_set_options(ctx, SSL_OP_ALL);
if (!SSL_CTX_set_cipher_list(ctx, cipher))
if (cipher != NULL && !SSL_CTX_set_cipher_list(ctx, cipher))
goto end;
if (ciphersuites != NULL && !SSL_CTX_set_ciphersuites(ctx, ciphersuites))
goto end;
if (!set_cert_stuff(ctx, certfile, keyfile))
goto end;
@@ -240,16 +230,10 @@ int s_time_main(int argc, char **argv)
www_path);
if (buf_len <= 0 || SSL_write(scon, buf, buf_len) <= 0)
goto end;
while ((i = SSL_read(scon, buf, sizeof(buf))) > 0 ||
SSL_get_error(scon, i) == SSL_ERROR_WANT_READ ||
SSL_get_error(scon, i) == SSL_ERROR_WANT_WRITE)
if (i > 0) bytes_read += i;
while ((i = SSL_read(scon, buf, sizeof(buf))) > 0)
bytes_read += i;
}
#ifdef NO_SHUTDOWN
SSL_set_shutdown(scon, SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN);
#else
SSL_shutdown(scon);
#endif
BIO_closesocket(SSL_get_fd(scon));
nConn += 1;
@@ -299,16 +283,10 @@ int s_time_main(int argc, char **argv)
buf_len = BIO_snprintf(buf, sizeof(buf), fmt_http_get_cmd, www_path);
if (buf_len <= 0 || SSL_write(scon, buf, buf_len) <= 0)
goto end;
while ((i = SSL_read(scon, buf, sizeof(buf))) > 0 ||
SSL_get_error(scon, i) == SSL_ERROR_WANT_READ ||
SSL_get_error(scon, i) == SSL_ERROR_WANT_WRITE)
while ((i = SSL_read(scon, buf, sizeof(buf))) > 0)
continue;
}
#ifdef NO_SHUTDOWN
SSL_set_shutdown(scon, SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN);
#else
SSL_shutdown(scon);
#endif
BIO_closesocket(SSL_get_fd(scon));
nConn = 0;
@@ -332,16 +310,10 @@ int s_time_main(int argc, char **argv)
www_path);
if (buf_len <= 0 || SSL_write(scon, buf, buf_len) <= 0)
goto end;
while ((i = SSL_read(scon, buf, sizeof(buf))) > 0 ||
SSL_get_error(scon, i) == SSL_ERROR_WANT_READ ||
SSL_get_error(scon, i) == SSL_ERROR_WANT_WRITE)
if (i > 0) bytes_read += i;
while ((i = SSL_read(scon, buf, sizeof(buf))) > 0)
bytes_read += i;
}
#ifdef NO_SHUTDOWN
SSL_set_shutdown(scon, SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN);
#else
SSL_shutdown(scon);
#endif
BIO_closesocket(SSL_get_fd(scon));
nConn += 1;
@@ -383,13 +355,13 @@ static SSL *doConnection(SSL *scon, const char *host, SSL_CTX *ctx)
{
BIO *conn;
SSL *serverCon;
int width, i;
fd_set readfds;
int i;
if ((conn = BIO_new(BIO_s_connect())) == NULL)
return NULL;
BIO_set_conn_hostname(conn, host);
BIO_set_conn_mode(conn, BIO_SOCK_NODELAY);
if (scon == NULL)
serverCon = SSL_new(ctx);
@@ -401,26 +373,7 @@ static SSL *doConnection(SSL *scon, const char *host, SSL_CTX *ctx)
SSL_set_bio(serverCon, conn, conn);
/* ok, lets connect */
for (;;) {
i = SSL_connect(serverCon);
if (BIO_sock_should_retry(i)) {
BIO_printf(bio_err, "DELAY\n");
i = SSL_get_fd(serverCon);
width = i + 1;
FD_ZERO(&readfds);
openssl_fdset(i, &readfds);
/*
* Note: under VMS with SOCKETSHR the 2nd parameter is currently
* of type (int *) whereas under other systems it is (void *) if
* you don't have a cast it will choke the compiler: if you do
* have a cast then you can either go for (int *) or (void *).
*/
select(width, (void *)&readfds, NULL, NULL, NULL);
continue;
}
break;
}
i = SSL_connect(serverCon);
if (i <= 0) {
BIO_printf(bio_err, "ERROR\n");
if (verify_args.error != X509_V_OK)
@@ -433,6 +386,17 @@ static SSL *doConnection(SSL *scon, const char *host, SSL_CTX *ctx)
return NULL;
}
#if defined(SOL_SOCKET) && defined(SO_LINGER)
{
struct linger no_linger;
no_linger.l_onoff = 1;
no_linger.l_linger = 0;
(void) setsockopt(SSL_get_fd(serverCon), SOL_SOCKET, SO_LINGER,
(char*)&no_linger, sizeof(no_linger));
}
#endif
return serverCon;
}
#endif /* OPENSSL_NO_SOCK */
apps/speed.c
+216 -188
View File
@@ -113,12 +113,6 @@
#endif
#define MAX_MISALIGNMENT 63
#define ALGOR_NUM 31
#define RSA_NUM 7
#define DSA_NUM 3
#define EC_NUM 18
#define MAX_ECDH_SIZE 256
#define MISALIGN 64
@@ -135,33 +129,6 @@ static volatile int run = 0;
static int mr = 0;
static int usertime = 1;
typedef struct loopargs_st {
ASYNC_JOB *inprogress_job;
ASYNC_WAIT_CTX *wait_ctx;
unsigned char *buf;
unsigned char *buf2;
unsigned char *buf_malloc;
unsigned char *buf2_malloc;
unsigned char *key;
unsigned int siglen;
#ifndef OPENSSL_NO_RSA
RSA *rsa_key[RSA_NUM];
#endif
#ifndef OPENSSL_NO_DSA
DSA *dsa_key[DSA_NUM];
#endif
#ifndef OPENSSL_NO_EC
EC_KEY *ecdsa[EC_NUM];
EVP_PKEY_CTX *ecdh_ctx[EC_NUM];
unsigned char *secret_a;
unsigned char *secret_b;
size_t outlen[EC_NUM];
#endif
EVP_CIPHER_CTX *ctx;
HMAC_CTX *hctx;
GCM128_CONTEXT *gcm_ctx;
} loopargs_t;
#ifndef OPENSSL_NO_MD2
static int EVP_Digest_MD2_loop(void *args);
#endif
@@ -215,13 +182,11 @@ static int DSA_verify_loop(void *args);
static int ECDSA_sign_loop(void *args);
static int ECDSA_verify_loop(void *args);
#endif
static int run_benchmark(int async_jobs, int (*loop_function) (void *),
loopargs_t * loopargs);
static double Time_F(int s);
static void print_message(const char *s, long num, int length, int tm);
static void pkey_print_message(const char *str, const char *str2,
long num, int bits, int sec);
long num, unsigned int bits, int sec);
static void print_result(int alg, int run_no, int count, double time_used);
#ifndef NO_FORK
static int do_multi(int multi, int size_num);
@@ -230,34 +195,8 @@ static int do_multi(int multi, int size_num);
static const int lengths_list[] = {
16, 64, 256, 1024, 8 * 1024, 16 * 1024
};
static int lengths_single = 0;
static const int *lengths = lengths_list;
static const char *names[ALGOR_NUM] = {
"md2", "mdc2", "md4", "md5", "hmac(md5)", "sha1", "rmd160", "rc4",
"des cbc", "des ede3", "idea cbc", "seed cbc",
"rc2 cbc", "rc5-32/12 cbc", "blowfish cbc", "cast cbc",
"aes-128 cbc", "aes-192 cbc", "aes-256 cbc",
"camellia-128 cbc", "camellia-192 cbc", "camellia-256 cbc",
"evp", "sha256", "sha512", "whirlpool",
"aes-128 ige", "aes-192 ige", "aes-256 ige", "ghash",
"rand"
};
static double results[ALGOR_NUM][OSSL_NELEM(lengths_list)];
#ifndef OPENSSL_NO_RSA
static double rsa_results[RSA_NUM][2];
#endif
#ifndef OPENSSL_NO_DSA
static double dsa_results[DSA_NUM][2];
#endif
#ifndef OPENSSL_NO_EC
static double ecdsa_results[EC_NUM][2];
static double ecdh_results[EC_NUM][1];
#endif
#ifdef SIGALRM
# if defined(__STDC__) || defined(sgi) || defined(_AIX)
# define SIGRETTYPE void
@@ -334,12 +273,17 @@ static double Time_F(int s)
}
#endif
static void multiblock_speed(const EVP_CIPHER *evp_cipher,
static void multiblock_speed(const EVP_CIPHER *evp_cipher, int lengths_single,
const openssl_speed_sec_t *seconds);
static int found(const char *name, const OPT_PAIR *pairs, int *result)
#define found(value, pairs, result)\
opt_found(value, result, pairs, OSSL_NELEM(pairs))
static int opt_found(const char *name, unsigned int *result,
const OPT_PAIR pairs[], unsigned int nbelem)
{
for (; pairs->name; pairs++)
unsigned int idx;
for (idx = 0; idx < nbelem; ++idx, pairs++)
if (strcmp(name, pairs->name) == 0) {
*result = pairs->retval;
return 1;
@@ -383,7 +327,7 @@ const OPTIONS speed_options[] = {
"Run benchmarks for pnum seconds"},
{"bytes", OPT_BYTES, 'p',
"Run cipher, digest and rand benchmarks on pnum bytes"},
{NULL},
{NULL}
};
#define D_MD2 0
@@ -417,7 +361,21 @@ const OPTIONS speed_options[] = {
#define D_IGE_256_AES 28
#define D_GHASH 29
#define D_RAND 30
static OPT_PAIR doit_choices[] = {
/* name of algorithms to test */
static const char *names[] = {
"md2", "mdc2", "md4", "md5", "hmac(md5)", "sha1", "rmd160", "rc4",
"des cbc", "des ede3", "idea cbc", "seed cbc",
"rc2 cbc", "rc5-32/12 cbc", "blowfish cbc", "cast cbc",
"aes-128 cbc", "aes-192 cbc", "aes-256 cbc",
"camellia-128 cbc", "camellia-192 cbc", "camellia-256 cbc",
"evp", "sha256", "sha512", "whirlpool",
"aes-128 ige", "aes-192 ige", "aes-256 ige", "ghash",
"rand"
};
#define ALGOR_NUM OSSL_NELEM(names)
/* list of configured algorithm (remaining) */
static const OPT_PAIR doit_choices[] = {
#ifndef OPENSSL_NO_MD2
{"md2", D_MD2},
#endif
@@ -482,21 +440,24 @@ static OPT_PAIR doit_choices[] = {
{"cast5", D_CBC_CAST},
#endif
{"ghash", D_GHASH},
{"rand", D_RAND},
{NULL}
{"rand", D_RAND}
};
static double results[ALGOR_NUM][OSSL_NELEM(lengths_list)];
#ifndef OPENSSL_NO_DSA
# define R_DSA_512 0
# define R_DSA_1024 1
# define R_DSA_2048 2
static OPT_PAIR dsa_choices[] = {
static const OPT_PAIR dsa_choices[] = {
{"dsa512", R_DSA_512},
{"dsa1024", R_DSA_1024},
{"dsa2048", R_DSA_2048},
{NULL},
{"dsa2048", R_DSA_2048}
};
#endif
# define DSA_NUM OSSL_NELEM(dsa_choices)
static double dsa_results[DSA_NUM][2]; /* 2 ops: sign then verify */
#endif /* OPENSSL_NO_DSA */
#define R_RSA_512 0
#define R_RSA_1024 1
@@ -505,16 +466,20 @@ static OPT_PAIR dsa_choices[] = {
#define R_RSA_4096 4
#define R_RSA_7680 5
#define R_RSA_15360 6
static OPT_PAIR rsa_choices[] = {
#ifndef OPENSSL_NO_RSA
static const OPT_PAIR rsa_choices[] = {
{"rsa512", R_RSA_512},
{"rsa1024", R_RSA_1024},
{"rsa2048", R_RSA_2048},
{"rsa3072", R_RSA_3072},
{"rsa4096", R_RSA_4096},
{"rsa7680", R_RSA_7680},
{"rsa15360", R_RSA_15360},
{NULL}
{"rsa15360", R_RSA_15360}
};
# define RSA_NUM OSSL_NELEM(rsa_choices)
static double rsa_results[RSA_NUM][2]; /* 2 ops: sign then verify */
#endif /* OPENSSL_NO_RSA */
#define R_EC_P160 0
#define R_EC_P192 1
@@ -532,8 +497,14 @@ static OPT_PAIR rsa_choices[] = {
#define R_EC_B283 13
#define R_EC_B409 14
#define R_EC_B571 15
#define R_EC_X25519 16
#define R_EC_X448 17
#define R_EC_BRP256R1 16
#define R_EC_BRP256T1 17
#define R_EC_BRP384R1 18
#define R_EC_BRP384T1 19
#define R_EC_BRP512R1 20
#define R_EC_BRP512T1 21
#define R_EC_X25519 22
#define R_EC_X448 23
#ifndef OPENSSL_NO_EC
static OPT_PAIR ecdsa_choices[] = {
{"ecdsap160", R_EC_P160},
@@ -552,10 +523,18 @@ static OPT_PAIR ecdsa_choices[] = {
{"ecdsab283", R_EC_B283},
{"ecdsab409", R_EC_B409},
{"ecdsab571", R_EC_B571},
{NULL}
{"ecdsabrp256r1", R_EC_BRP256R1},
{"ecdsabrp256t1", R_EC_BRP256T1},
{"ecdsabrp384r1", R_EC_BRP384R1},
{"ecdsabrp384t1", R_EC_BRP384T1},
{"ecdsabrp512r1", R_EC_BRP512R1},
{"ecdsabrp512t1", R_EC_BRP512T1}
};
# define ECDSA_NUM OSSL_NELEM(ecdsa_choices)
static OPT_PAIR ecdh_choices[] = {
static double ecdsa_results[ECDSA_NUM][2]; /* 2 ops: sign then verify */
static const OPT_PAIR ecdh_choices[] = {
{"ecdhp160", R_EC_P160},
{"ecdhp192", R_EC_P192},
{"ecdhp224", R_EC_P224},
@@ -572,11 +551,19 @@ static OPT_PAIR ecdh_choices[] = {
{"ecdhb283", R_EC_B283},
{"ecdhb409", R_EC_B409},
{"ecdhb571", R_EC_B571},
{"ecdhbrp256r1", R_EC_BRP256R1},
{"ecdhbrp256t1", R_EC_BRP256T1},
{"ecdhbrp384r1", R_EC_BRP384R1},
{"ecdhbrp384t1", R_EC_BRP384T1},
{"ecdhbrp512r1", R_EC_BRP512R1},
{"ecdhbrp512t1", R_EC_BRP512T1},
{"ecdhx25519", R_EC_X25519},
{"ecdhx448", R_EC_X448},
{NULL}
{"ecdhx448", R_EC_X448}
};
#endif
# define EC_NUM OSSL_NELEM(ecdh_choices)
static double ecdh_results[EC_NUM][1]; /* 1 op: derivation */
#endif /* OPENSSL_NO_EC */
#ifndef SIGALRM
# define COND(d) (count < (d))
@@ -586,7 +573,36 @@ static OPT_PAIR ecdh_choices[] = {
# define COUNT(d) (count)
#endif /* SIGALRM */
static int testnum;
typedef struct loopargs_st {
ASYNC_JOB *inprogress_job;
ASYNC_WAIT_CTX *wait_ctx;
unsigned char *buf;
unsigned char *buf2;
unsigned char *buf_malloc;
unsigned char *buf2_malloc;
unsigned char *key;
unsigned int siglen;
#ifndef OPENSSL_NO_RSA
RSA *rsa_key[RSA_NUM];
#endif
#ifndef OPENSSL_NO_DSA
DSA *dsa_key[DSA_NUM];
#endif
#ifndef OPENSSL_NO_EC
EC_KEY *ecdsa[ECDSA_NUM];
EVP_PKEY_CTX *ecdh_ctx[EC_NUM];
unsigned char *secret_a;
unsigned char *secret_b;
size_t outlen[EC_NUM];
#endif
EVP_CIPHER_CTX *ctx;
HMAC_CTX *hctx;
GCM128_CONTEXT *gcm_ctx;
} loopargs_t;
static int run_benchmark(int async_jobs, int (*loop_function) (void *),
loopargs_t * loopargs);
static unsigned int testnum;
/* Nb of iterations to do per algorithm and key-size */
static long c[ALGOR_NUM][OSSL_NELEM(lengths_list)];
@@ -1040,7 +1056,7 @@ static int DSA_verify_loop(void *args)
#endif
#ifndef OPENSSL_NO_EC
static long ecdsa_c[EC_NUM][2];
static long ecdsa_c[ECDSA_NUM][2];
static int ECDSA_sign_loop(void *args)
{
loopargs_t *tempargs = *(loopargs_t **) args;
@@ -1258,31 +1274,28 @@ int speed_main(int argc, char **argv)
ENGINE *e = NULL;
int (*loopfunc)(void *args);
loopargs_t *loopargs = NULL;
int async_init = 0;
int loopargs_len = 0;
char *prog;
const char *prog;
const char *engine_id = NULL;
const EVP_CIPHER *evp_cipher = NULL;
double d = 0.0;
OPTION_CHOICE o;
int multiblock = 0, pr_header = 0;
int async_init = 0, multiblock = 0, pr_header = 0;
int doit[ALGOR_NUM] = { 0 };
int ret = 1, i, k, misalign = 0;
int ret = 1, misalign = 0, lengths_single = 0;
long count = 0;
int size_num = OSSL_NELEM(lengths_list);
unsigned int size_num = OSSL_NELEM(lengths_list);
unsigned int i, k, loop, loopargs_len = 0, async_jobs = 0;
int keylen;
int buflen;
#ifndef NO_FORK
int multi = 0;
#endif
unsigned int async_jobs = 0;
#if !defined(OPENSSL_NO_RSA) || !defined(OPENSSL_NO_DSA) \
|| !defined(OPENSSL_NO_EC)
long rsa_count = 1;
#endif
#ifndef OPENSSL_NO_EC
size_t loop;
#endif
openssl_speed_sec_t seconds = { SECONDS, RSA_SECONDS, DSA_SECONDS,
ECDSA_SECONDS, ECDH_SECONDS };
/* What follows are the buffers and key material. */
#ifndef OPENSSL_NO_RC5
@@ -1367,48 +1380,46 @@ int speed_main(int argc, char **argv)
/*
* We only test over the following curves as they are representative, To
* add tests over more curves, simply add the curve NID and curve name to
* the following arrays and increase the EC_NUM value accordingly.
* the following arrays and increase the |ecdh_choices| list accordingly.
*/
static const unsigned int test_curves[EC_NUM] = {
static const struct {
const char *name;
unsigned int nid;
unsigned int bits;
} test_curves[] = {
/* Prime Curves */
NID_secp160r1, NID_X9_62_prime192v1, NID_secp224r1,
NID_X9_62_prime256v1, NID_secp384r1, NID_secp521r1,
{"secp160r1", NID_secp160r1, 160},
{"nistp192", NID_X9_62_prime192v1, 192},
{"nistp224", NID_secp224r1, 224},
{"nistp256", NID_X9_62_prime256v1, 256},
{"nistp384", NID_secp384r1, 384},
{"nistp521", NID_secp521r1, 521},
/* Binary Curves */
NID_sect163k1, NID_sect233k1, NID_sect283k1,
NID_sect409k1, NID_sect571k1, NID_sect163r2,
NID_sect233r1, NID_sect283r1, NID_sect409r1,
NID_sect571r1,
/* Other */
NID_X25519, NID_X448
{"nistk163", NID_sect163k1, 163},
{"nistk233", NID_sect233k1, 233},
{"nistk283", NID_sect283k1, 283},
{"nistk409", NID_sect409k1, 409},
{"nistk571", NID_sect571k1, 571},
{"nistb163", NID_sect163r2, 163},
{"nistb233", NID_sect233r1, 233},
{"nistb283", NID_sect283r1, 283},
{"nistb409", NID_sect409r1, 409},
{"nistb571", NID_sect571r1, 571},
{"brainpoolP256r1", NID_brainpoolP256r1, 256},
{"brainpoolP256t1", NID_brainpoolP256t1, 256},
{"brainpoolP384r1", NID_brainpoolP384r1, 384},
{"brainpoolP384t1", NID_brainpoolP384t1, 384},
{"brainpoolP512r1", NID_brainpoolP512r1, 512},
{"brainpoolP512t1", NID_brainpoolP512t1, 512},
/* Other and ECDH only ones */
{"X25519", NID_X25519, 253},
{"X448", NID_X448, 448}
};
static const char *test_curves_names[EC_NUM] = {
/* Prime Curves */
"secp160r1", "nistp192", "nistp224",
"nistp256", "nistp384", "nistp521",
/* Binary Curves */
"nistk163", "nistk233", "nistk283",
"nistk409", "nistk571", "nistb163",
"nistb233", "nistb283", "nistb409",
"nistb571",
/* Other */
"X25519", "X448"
};
static const int test_curves_bits[EC_NUM] = {
160, 192, 224,
256, 384, 521,
163, 233, 283,
409, 571, 163,
233, 283, 409,
571, 253, 448
};
int ecdsa_doit[EC_NUM] = { 0 };
int ecdsa_doit[ECDSA_NUM] = { 0 };
int ecdh_doit[EC_NUM] = { 0 };
OPENSSL_assert(OSSL_NELEM(test_curves) >= EC_NUM);
#endif /* ndef OPENSSL_NO_EC */
openssl_speed_sec_t seconds = { SECONDS, RSA_SECONDS, DSA_SECONDS,
ECDSA_SECONDS, ECDH_SECONDS };
prog = opt_init(argc, argv, speed_options);
while ((o = opt_next()) != OPT_EOF) {
switch (o) {
@@ -1463,9 +1474,7 @@ int speed_main(int argc, char **argv)
goto opterr;
}
if (async_jobs > 99999) {
BIO_printf(bio_err,
"%s: too many async_jobs\n",
prog);
BIO_printf(bio_err, "%s: too many async_jobs\n", prog);
goto opterr;
}
#endif
@@ -1533,10 +1542,8 @@ int speed_main(int argc, char **argv)
if (strcmp(*argv, "openssl") == 0)
continue;
if (strcmp(*argv, "rsa") == 0) {
rsa_doit[R_RSA_512] = rsa_doit[R_RSA_1024] =
rsa_doit[R_RSA_2048] = rsa_doit[R_RSA_3072] =
rsa_doit[R_RSA_4096] = rsa_doit[R_RSA_7680] =
rsa_doit[R_RSA_15360] = 1;
for (loop = 0; loop < OSSL_NELEM(rsa_doit); loop++)
rsa_doit[loop] = 1;
continue;
}
if (found(*argv, rsa_choices, &i)) {
@@ -1567,8 +1574,8 @@ int speed_main(int argc, char **argv)
#endif
#ifndef OPENSSL_NO_EC
if (strcmp(*argv, "ecdsa") == 0) {
for (loop = 0; loop < OSSL_NELEM(ecdsa_choices); loop++)
ecdsa_doit[ecdsa_choices[loop].retval] = 1;
for (loop = 0; loop < OSSL_NELEM(ecdsa_doit); loop++)
ecdsa_doit[loop] = 1;
continue;
}
if (found(*argv, ecdsa_choices, &i)) {
@@ -1576,8 +1583,8 @@ int speed_main(int argc, char **argv)
continue;
}
if (strcmp(*argv, "ecdh") == 0) {
for (loop = 0; loop < OSSL_NELEM(ecdh_choices); loop++)
ecdh_doit[ecdh_choices[loop].retval] = 1;
for (loop = 0; loop < OSSL_NELEM(ecdh_doit); loop++)
ecdh_doit[loop] = 1;
continue;
}
if (found(*argv, ecdh_choices, &i)) {
@@ -1649,10 +1656,10 @@ int speed_main(int argc, char **argv)
dsa_doit[i] = 1;
#endif
#ifndef OPENSSL_NO_EC
for (loop = 0; loop < OSSL_NELEM(ecdsa_choices); loop++)
ecdsa_doit[ecdsa_choices[loop].retval] = 1;
for (loop = 0; loop < OSSL_NELEM(ecdh_choices); loop++)
ecdh_doit[ecdh_choices[loop].retval] = 1;
for (loop = 0; loop < OSSL_NELEM(ecdsa_doit); loop++)
ecdsa_doit[loop] = 1;
for (loop = 0; loop < OSSL_NELEM(ecdh_doit); loop++)
ecdh_doit[loop] = 1;
#endif
}
for (i = 0; i < ALGOR_NUM; i++)
@@ -1922,6 +1929,32 @@ int speed_main(int argc, char **argv)
}
}
}
/* repeated code good to factorize */
ecdh_c[R_EC_BRP256R1][0] = count / 1000;
for (i = R_EC_BRP384R1; i <= R_EC_BRP512R1; i += 2) {
ecdh_c[i][0] = ecdh_c[i - 2][0] / 2;
if (ecdh_doit[i] <= 1 && ecdh_c[i][0] == 0)
ecdh_doit[i] = 0;
else {
if (ecdh_c[i][0] == 0) {
ecdh_c[i][0] = 1;
}
}
}
ecdh_c[R_EC_BRP256T1][0] = count / 1000;
for (i = R_EC_BRP384T1; i <= R_EC_BRP512T1; i += 2) {
ecdh_c[i][0] = ecdh_c[i - 2][0] / 2;
if (ecdh_doit[i] <= 1 && ecdh_c[i][0] == 0)
ecdh_doit[i] = 0;
else {
if (ecdh_c[i][0] == 0) {
ecdh_c[i][0] = 1;
}
}
}
/* default iteration count for the last two EC Curves */
ecdh_c[R_EC_X25519][0] = count / 1800;
ecdh_c[R_EC_X448][0] = count / 7200;
# endif
# else
@@ -2399,7 +2432,7 @@ int speed_main(int argc, char **argv)
BIO_printf(bio_err, "Async mode is not supported, exiting...");
exit(1);
}
multiblock_speed(evp_cipher, &seconds);
multiblock_speed(evp_cipher, lengths_single, &seconds);
ret = 0;
goto end;
}
@@ -2512,7 +2545,7 @@ int speed_main(int argc, char **argv)
d = Time_F(STOP);
BIO_printf(bio_err,
mr ? "+R1:%ld:%d:%.2f\n"
: "%ld %d bit private RSA's in %.2fs\n",
: "%ld %u bits private RSA's in %.2fs\n",
count, rsa_bits[testnum], d);
rsa_results[testnum][0] = (double)count / d;
rsa_count = count;
@@ -2538,7 +2571,7 @@ int speed_main(int argc, char **argv)
d = Time_F(STOP);
BIO_printf(bio_err,
mr ? "+R2:%ld:%d:%.2f\n"
: "%ld %d bit public RSA's in %.2fs\n",
: "%ld %u bits public RSA's in %.2fs\n",
count, rsa_bits[testnum], d);
rsa_results[testnum][1] = (double)count / d;
}
@@ -2581,8 +2614,8 @@ int speed_main(int argc, char **argv)
count = run_benchmark(async_jobs, DSA_sign_loop, loopargs);
d = Time_F(STOP);
BIO_printf(bio_err,
mr ? "+R3:%ld:%d:%.2f\n"
: "%ld %d bit DSA signs in %.2fs\n",
mr ? "+R3:%ld:%u:%.2f\n"
: "%ld %u bits DSA signs in %.2fs\n",
count, dsa_bits[testnum], d);
dsa_results[testnum][0] = (double)count / d;
rsa_count = count;
@@ -2607,8 +2640,8 @@ int speed_main(int argc, char **argv)
count = run_benchmark(async_jobs, DSA_verify_loop, loopargs);
d = Time_F(STOP);
BIO_printf(bio_err,
mr ? "+R4:%ld:%d:%.2f\n"
: "%ld %d bit DSA verify in %.2fs\n",
mr ? "+R4:%ld:%u:%.2f\n"
: "%ld %u bits DSA verify in %.2fs\n",
count, dsa_bits[testnum], d);
dsa_results[testnum][1] = (double)count / d;
}
@@ -2622,14 +2655,14 @@ int speed_main(int argc, char **argv)
#endif /* OPENSSL_NO_DSA */
#ifndef OPENSSL_NO_EC
for (testnum = 0; testnum < EC_NUM; testnum++) {
for (testnum = 0; testnum < ECDSA_NUM; testnum++) {
int st = 1;
if (!ecdsa_doit[testnum])
continue; /* Ignore Curve */
for (i = 0; i < loopargs_len; i++) {
loopargs[i].ecdsa[testnum] =
EC_KEY_new_by_curve_name(test_curves[testnum]);
EC_KEY_new_by_curve_name(test_curves[testnum].nid);
if (loopargs[i].ecdsa[testnum] == NULL) {
st = 0;
break;
@@ -2658,16 +2691,15 @@ int speed_main(int argc, char **argv)
} else {
pkey_print_message("sign", "ecdsa",
ecdsa_c[testnum][0],
test_curves_bits[testnum],
seconds.ecdsa);
test_curves[testnum].bits, seconds.ecdsa);
Time_F(START);
count = run_benchmark(async_jobs, ECDSA_sign_loop, loopargs);
d = Time_F(STOP);
BIO_printf(bio_err,
mr ? "+R5:%ld:%d:%.2f\n" :
"%ld %d bit ECDSA signs in %.2fs \n",
count, test_curves_bits[testnum], d);
mr ? "+R5:%ld:%u:%.2f\n" :
"%ld %u bits ECDSA signs in %.2fs \n",
count, test_curves[testnum].bits, d);
ecdsa_results[testnum][0] = (double)count / d;
rsa_count = count;
}
@@ -2688,15 +2720,14 @@ int speed_main(int argc, char **argv)
} else {
pkey_print_message("verify", "ecdsa",
ecdsa_c[testnum][1],
test_curves_bits[testnum],
seconds.ecdsa);
test_curves[testnum].bits, seconds.ecdsa);
Time_F(START);
count = run_benchmark(async_jobs, ECDSA_verify_loop, loopargs);
d = Time_F(STOP);
BIO_printf(bio_err,
mr ? "+R6:%ld:%d:%.2f\n"
: "%ld %d bit ECDSA verify in %.2fs\n",
count, test_curves_bits[testnum], d);
mr ? "+R6:%ld:%u:%.2f\n"
: "%ld %u bits ECDSA verify in %.2fs\n",
count, test_curves[testnum].bits, d);
ecdsa_results[testnum][1] = (double)count / d;
}
@@ -2736,7 +2767,7 @@ int speed_main(int argc, char **argv)
* If this fails we try creating a EVP_PKEY_EC generic param ctx,
* then we set the curve by NID before deriving the actual keygen
* ctx for that specific curve. */
kctx = EVP_PKEY_CTX_new_id(test_curves[testnum], NULL); /* keygen ctx from NID */
kctx = EVP_PKEY_CTX_new_id(test_curves[testnum].nid, NULL); /* keygen ctx from NID */
if (!kctx) {
EVP_PKEY_CTX *pctx = NULL;
EVP_PKEY *params = NULL;
@@ -2767,7 +2798,7 @@ int speed_main(int argc, char **argv)
/* Set the curve by NID */
!EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx,
test_curves
[testnum]) ||
[testnum].nid) ||
/* Create the parameter object params */
!EVP_PKEY_paramgen(pctx, &params)) {
ecdh_checks = 0;
@@ -2849,23 +2880,22 @@ int speed_main(int argc, char **argv)
if (ecdh_checks != 0) {
pkey_print_message("", "ecdh",
ecdh_c[testnum][0],
test_curves_bits[testnum],
seconds.ecdh);
test_curves[testnum].bits, seconds.ecdh);
Time_F(START);
count =
run_benchmark(async_jobs, ECDH_EVP_derive_key_loop, loopargs);
d = Time_F(STOP);
BIO_printf(bio_err,
mr ? "+R7:%ld:%d:%.2f\n" :
"%ld %d-bit ECDH ops in %.2fs\n", count,
test_curves_bits[testnum], d);
"%ld %u-bits ECDH ops in %.2fs\n", count,
test_curves[testnum].bits, d);
ecdh_results[testnum][0] = (double)count / d;
rsa_count = count;
}
if (rsa_count <= 1) {
/* if longer than 10s, don't do any more */
for (testnum++; testnum < EC_NUM; testnum++)
for (testnum++; testnum < OSSL_NELEM(ecdh_doit); testnum++)
ecdh_doit[testnum] = 0;
}
}
@@ -2914,7 +2944,7 @@ int speed_main(int argc, char **argv)
if (!doit[k])
continue;
if (mr)
printf("+F:%d:%s", k, names[k]);
printf("+F:%u:%s", k, names[k]);
else
printf("%-13s", names[k]);
for (testnum = 0; testnum < size_num; testnum++) {
@@ -2963,7 +2993,7 @@ int speed_main(int argc, char **argv)
#endif
#ifndef OPENSSL_NO_EC
testnum = 1;
for (k = 0; k < EC_NUM; k++) {
for (k = 0; k < OSSL_NELEM(ecdsa_doit); k++) {
if (!ecdsa_doit[k])
continue;
if (testnum && !mr) {
@@ -2973,12 +3003,11 @@ int speed_main(int argc, char **argv)
if (mr)
printf("+F4:%u:%u:%f:%f\n",
k, test_curves_bits[k],
k, test_curves[k].bits,
ecdsa_results[k][0], ecdsa_results[k][1]);
else
printf("%4u bit ecdsa (%s) %8.4fs %8.4fs %8.1f %8.1f\n",
test_curves_bits[k],
test_curves_names[k],
printf("%4u bits ecdsa (%s) %8.4fs %8.4fs %8.1f %8.1f\n",
test_curves[k].bits, test_curves[k].name,
1.0 / ecdsa_results[k][0], 1.0 / ecdsa_results[k][1],
ecdsa_results[k][0], ecdsa_results[k][1]);
}
@@ -2993,13 +3022,12 @@ int speed_main(int argc, char **argv)
}
if (mr)
printf("+F5:%u:%u:%f:%f\n",
k, test_curves_bits[k],
k, test_curves[k].bits,
ecdh_results[k][0], 1.0 / ecdh_results[k][0]);
else
printf("%4u bit ecdh (%s) %8.4fs %8.1f\n",
test_curves_bits[k],
test_curves_names[k],
printf("%4u bits ecdh (%s) %8.4fs %8.1f\n",
test_curves[k].bits, test_curves[k].name,
1.0 / ecdh_results[k][0], ecdh_results[k][0]);
}
#endif
@@ -3021,10 +3049,10 @@ int speed_main(int argc, char **argv)
DSA_free(loopargs[i].dsa_key[k]);
#endif
#ifndef OPENSSL_NO_EC
for (k = 0; k < EC_NUM; k++) {
for (k = 0; k < ECDSA_NUM; k++)
EC_KEY_free(loopargs[i].ecdsa[k]);
for (k = 0; k < EC_NUM; k++)
EVP_PKEY_CTX_free(loopargs[i].ecdh_ctx[k]);
}
OPENSSL_free(loopargs[i].secret_a);
OPENSSL_free(loopargs[i].secret_b);
#endif
@@ -3060,18 +3088,18 @@ static void print_message(const char *s, long num, int length, int tm)
}
static void pkey_print_message(const char *str, const char *str2, long num,
int bits, int tm)
unsigned int bits, int tm)
{
#ifdef SIGALRM
BIO_printf(bio_err,
mr ? "+DTP:%d:%s:%s:%d\n"
: "Doing %d bit %s %s's for %ds: ", bits, str, str2, tm);
: "Doing %u bits %s %s's for %ds: ", bits, str, str2, tm);
(void)BIO_flush(bio_err);
alarm(tm);
#else
BIO_printf(bio_err,
mr ? "+DNP:%ld:%d:%s:%s\n"
: "Doing %ld %d bit %s %s's: ", num, bits, str, str2);
: "Doing %ld %u bits %s %s's: ", num, bits, str, str2);
(void)BIO_flush(bio_err);
#endif
}
@@ -3124,7 +3152,7 @@ static int do_multi(int multi, int size_num)
int *fds;
static char sep[] = ":";
fds = malloc(sizeof(*fds) * multi);
fds = app_malloc(sizeof(*fds) * multi, "fd buffer for do_multi");
for (n = 0; n < multi; ++n) {
if (pipe(fd) == -1) {
BIO_printf(bio_err, "pipe failure\n");
@@ -3249,7 +3277,7 @@ static int do_multi(int multi, int size_num)
}
#endif
static void multiblock_speed(const EVP_CIPHER *evp_cipher,
static void multiblock_speed(const EVP_CIPHER *evp_cipher, int lengths_single,
const openssl_speed_sec_t *seconds)
{
static const int mblengths_list[] =
apps/spkac.c
+1 -1
View File
@@ -98,7 +98,7 @@ int spkac_main(int argc, char **argv)
case OPT_KEYFORM:
if (!opt_format(opt_arg(), OPT_FMT_ANY, &keyformat))
goto opthelp;
break;
break;
case OPT_CHALLENGE:
challenge = opt_arg();
break;
apps/tsget.in
+1 -1
View File
@@ -1,5 +1,5 @@
#!{- $config{HASHBANGPERL} -}
# Copyright 2002-2016 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2002-2018 The OpenSSL Project Authors. All Rights Reserved.
# Copyright (c) 2002 The OpenTSA Project. All rights reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
apps/verify.c
+1
View File
@@ -225,6 +225,7 @@ static int check(X509_STORE *ctx, const char *file,
X509_STORE_set_flags(ctx, vflags);
if (!X509_STORE_CTX_init(csc, ctx, x, uchain)) {
X509_STORE_CTX_free(csc);
printf("error %s: X.509 store context initialization failed\n",
(file == NULL) ? "stdin" : file);
goto end;
apps/x509.c
+5 -7
View File
@@ -467,10 +467,6 @@ int x509_main(int argc, char **argv)
goto opthelp;
}
out = bio_open_default(outfile, 'w', outformat);
if (out == NULL)
goto end;
if (!app_passwd(passinarg, NULL, &passin, NULL)) {
BIO_printf(bio_err, "Error getting password\n");
goto end;
@@ -596,10 +592,12 @@ int x509_main(int argc, char **argv)
goto end;
}
if (!noout || text || next_serial) {
OBJ_create("2.99999.3", "SET.ex3", "SET x509v3 extension 3");
out = bio_open_default(outfile, 'w', outformat);
if (out == NULL)
goto end;
}
if (!noout || text || next_serial)
OBJ_create("2.99999.3", "SET.ex3", "SET x509v3 extension 3");
if (alias)
X509_alias_set1(x, (unsigned char *)alias, -1);