From f12926b9437742c1f3275d384273ddb8004550fb Mon Sep 17 00:00:00 2001 From: Hakase Date: Thu, 13 Sep 2018 11:56:57 +0900 Subject: [PATCH] Latest update --- CHANGES | 5 + Configurations/README | 58 ++++++------ Configurations/README.design | 95 +++++++++---------- Configurations/common.tmpl | 22 ++--- Configurations/descrip.mms.tmpl | 25 +++-- Configurations/unix-Makefile.tmpl | 5 +- Configurations/windows-makefile.tmpl | 12 ++- Configure | 136 ++++++++++++++++++++++----- crypto/bio/b_sock2.c | 2 + crypto/cryptlib.c | 2 +- crypto/err/openssl.txt | 3 + crypto/evp/e_aes.c | 27 ++++++ crypto/evp/evp_err.c | 4 + crypto/rand/drbg_lib.c | 6 +- crypto/sm2/sm2_sign.c | 1 + fuzz/README.md | 2 +- include/openssl/evperr.h | 3 + include/openssl/rand_drbg.h | 15 ++- ssl/statem/statem.c | 5 +- util/mkrc.pl | 2 +- 20 files changed, 290 insertions(+), 140 deletions(-) diff --git a/CHANGES b/CHANGES index 657f0cfb..fab0af4b 100644 --- a/CHANGES +++ b/CHANGES @@ -16,6 +16,11 @@ http://web.cs.ucdavis.edu/%7Erogaway/papers/offsets.pdf [Paul Dale] + *) Rename the object files, i.e. give them other names than in previous + versions. Their names now include the name of the final product, as + well as its type mnemonic (bin, lib, shlib). + [Richard Levitte] + Changes between 1.1.0i and 1.1.1 [11 Sep 2018] *) Add a new ClientHello callback. Provides a callback interface that gives diff --git a/Configurations/README b/Configurations/README index 4457b947..6ae981f9 100644 --- a/Configurations/README +++ b/Configurations/README @@ -636,8 +636,9 @@ They are all expected to return a string with the lines they produce. incs => [ "INCL/PATH", ... ] intent => one of "lib", "dso", "bin" ); - 'obj' has the intended object file *without* - extension, src2obj() is expected to add that. + 'obj' has the intended object file with '.o' + extension, src2obj() is expected to change it to + something more suitable for the platform. 'srcs' has the list of source files to build the object file, with the first item being the source file that directly corresponds to the object file. @@ -657,33 +658,36 @@ They are all expected to return a string with the lines they produce. 'lib' has the intended library file name *without* extension, obj2lib is expected to add that. 'objs' - has the list of object files (also *without* - extension) to build this library. + has the list of object files to build this library. - libobj2shlib - function that produces build file lines to build a + libobj2shlib - backward compatibility function that's used the + same way as obj2shlib (described next), and was + expected to build the shared library from the + corresponding static library when that was suitable. + NOTE: building a shared library from a static + library is now DEPRECATED, as they no longer share + object files. Attempting to do this will fail. + + obj2shlib - function that produces build file lines to build a shareable object library file ("libfoo.so" in Unix - terms) from the corresponding static library file - or object files. + terms) from the corresponding object files. called like this: - libobj2shlib(shlib => "PATH/TO/shlibfile", - lib => "PATH/TO/libfile", - objs => [ "PATH/TO/objectfile", ... ], - deps => [ "PATH/TO/otherlibfile", ... ]); + obj2shlib(shlib => "PATH/TO/shlibfile", + lib => "PATH/TO/libfile", + objs => [ "PATH/TO/objectfile", ... ], + deps => [ "PATH/TO/otherlibfile", ... ]); - 'lib' has the intended library file name *without* - extension, libobj2shlib is expected to add that. + 'lib' has the base (static) library ffile name + *without* extension. This is useful in case + supporting files are needed (such as import + libraries on Windows). 'shlib' has the corresponding shared library name *without* extension. 'deps' has the list of other libraries (also *without* extension) this library needs to be linked with. 'objs' has the list of - object files (also *without* extension) to build - this library. - - This function has a choice; it can use the - corresponding static library as input to make the - shared library, or the list of object files. + object files to build this library. obj2dso - function that produces build file lines to build a dynamic shared object file from object files. @@ -695,12 +699,9 @@ They are all expected to return a string with the lines they produce. deps => [ "PATH/TO/otherlibfile", ... ]); - This is almost the same as libobj2shlib, but the + This is almost the same as obj2shlib, but the intent is to build a shareable library that can be - loaded in runtime (a "plugin"...). The differences - are subtle, one of the most visible ones is that the - resulting shareable library is produced from object - files only. + loaded in runtime (a "plugin"...). obj2bin - function that produces build file lines to build an executable file from object files. @@ -713,11 +714,10 @@ They are all expected to return a string with the lines they produce. 'bin' has the intended executable file name *without* extension, obj2bin is expected to add - that. 'objs' has the list of object files (also - *without* extension) to build this library. 'deps' - has the list of library files (also *without* - extension) that the programs needs to be linked - with. + that. 'objs' has the list of object files to build + this library. 'deps' has the list of library files + (also *without* extension) that the programs needs + to be linked with. in2script - function that produces build file lines to build a script file from some input. diff --git a/Configurations/README.design b/Configurations/README.design index cae08fc2..8c50a92b 100644 --- a/Configurations/README.design +++ b/Configurations/README.design @@ -471,8 +471,9 @@ etc. incs => [ "INCL/PATH", ... ] intent => one of "lib", "dso", "bin" ); - 'obj' has the intended object file *without* - extension, src2obj() is expected to add that. + 'obj' has the intended object file with '.o' + extension, src2obj() is expected to change it to + something more suitable for the platform. 'srcs' has the list of source files to build the object file, with the first item being the source file that directly corresponds to the object file. @@ -492,51 +493,50 @@ etc. 'lib' has the intended library file name *without* extension, obj2lib is expected to add that. 'objs' - has the list of object files (also *without* - extension) to build this library. + has the list of object files to build this library. - libobj2shlib - function that produces build file lines to build a + libobj2shlib - backward compatibility function that's used the + same way as obj2shlib (described next), and was + expected to build the shared library from the + corresponding static library when that was suitable. + NOTE: building a shared library from a static + library is now DEPRECATED, as they no longer share + object files. Attempting to do this will fail. + + obj2shlib - function that produces build file lines to build a shareable object library file ("libfoo.so" in Unix - terms) from the corresponding static library file - or object files. + terms) from the corresponding object files. called like this: - libobj2shlib(shlib => "PATH/TO/shlibfile", - lib => "PATH/TO/libfile", - objs => [ "PATH/TO/objectfile", ... ], - deps => [ "PATH/TO/otherlibfile", ... ]); + obj2shlib(shlib => "PATH/TO/shlibfile", + lib => "PATH/TO/libfile", + objs => [ "PATH/TO/objectfile", ... ], + deps => [ "PATH/TO/otherlibfile", ... ]); - 'lib' has the intended library file name *without* - extension, libobj2shlib is expected to add that. + 'lib' has the base (static) library file name + *without* extension. This is useful in case + supporting files are needed (such as import + libraries on Windows). 'shlib' has the corresponding shared library name *without* extension. 'deps' has the list of other libraries (also *without* extension) this library needs to be linked with. 'objs' has the list of - object files (also *without* extension) to build - this library. + object files to build this library. - This function has a choice; it can use the - corresponding static library as input to make the - shared library, or the list of object files. - - obj2dynlib - function that produces build file lines to build a - dynamically loadable library file ("libfoo.so" on - Unix) from object files. + obj2dso - function that produces build file lines to build a + dynamic shared object file from object files. called like this: - obj2dynlib(lib => "PATH/TO/libfile", - objs => [ "PATH/TO/objectfile", ... ], - deps => [ "PATH/TO/otherlibfile", - ... ]); + obj2dso(lib => "PATH/TO/libfile", + objs => [ "PATH/TO/objectfile", ... ], + deps => [ "PATH/TO/otherlibfile", + ... ]); - This is almost the same as libobj2shlib, but the + This is almost the same as obj2shlib, but the intent is to build a shareable library that can be - loaded in runtime (a "plugin"...). The differences - are subtle, one of the most visible ones is that the - resulting shareable library is produced from object - files only. + loaded in runtime (a "plugin"...). obj2bin - function that produces build file lines to build an executable file from object files. @@ -549,11 +549,10 @@ etc. 'bin' has the intended executable file name *without* extension, obj2bin is expected to add - that. 'objs' has the list of object files (also - *without* extension) to build this library. 'deps' - has the list of library files (also *without* - extension) that the programs needs to be linked - with. + that. 'objs' has the list of object files to build + this library. 'deps' has the list of library files + (also *without* extension) that the programs needs + to be linked with. in2script - function that produces build file lines to build a script file from some input. @@ -577,34 +576,30 @@ As an example with the smaller build.info set we've seen as an example, producing the rules to build 'libcrypto' would result in the following calls: - # Note: libobj2shlib will only be called if shared libraries are + # Note: obj2shlib will only be called if shared libraries are # to be produced. - # Note 2: libobj2shlib gets both the name of the static library - # and the names of all the object files that go into it. It's up - # to the implementation to decide which to use as input. - # Note 3: common.tmpl peals off the ".o" extension from all object - # files, as the platform at hand may have a different one. - libobj2shlib(shlib => "libcrypto", - lib => "libcrypto", - objs => [ "crypto/aes", "crypto/evp", "crypto/cversion" ], - deps => [ ]); + # Note 2: obj2shlib must convert the '.o' extension to whatever + # is suitable on the local platform. + obj2shlib(shlib => "libcrypto", + objs => [ "crypto/aes.o", "crypto/evp.o", "crypto/cversion.o" ], + deps => [ ]); obj2lib(lib => "libcrypto" - objs => [ "crypto/aes", "crypto/evp", "crypto/cversion" ]); + objs => [ "crypto/aes.o", "crypto/evp.o", "crypto/cversion.o" ]); - src2obj(obj => "crypto/aes" + src2obj(obj => "crypto/aes.o" srcs => [ "crypto/aes.c" ], deps => [ ], incs => [ "include" ], intent => "lib"); - src2obj(obj => "crypto/evp" + src2obj(obj => "crypto/evp.o" srcs => [ "crypto/evp.c" ], deps => [ ], incs => [ "include" ], intent => "lib"); - src2obj(obj => "crypto/cversion" + src2obj(obj => "crypto/cversion.o" srcs => [ "crypto/cversion.c" ], deps => [ "crypto/buildinf.h" ], incs => [ "include" ], diff --git a/Configurations/common.tmpl b/Configurations/common.tmpl index 180621e7..dffa513f 100644 --- a/Configurations/common.tmpl +++ b/Configurations/common.tmpl @@ -82,7 +82,8 @@ generator_incs => $unified_info{includes}->{$script}, generator_deps => $unified_info{depends}->{$script}, deps => $unified_info{depends}->{$src}, - incs => $unified_info{includes}->{$obj}, + incs => [ @{$unified_info{includes}->{$obj}}, + @{$unified_info{includes}->{$bin}} ], %opts); foreach (@{$unified_info{depends}->{$src}}) { dogenerate($_, $obj, $bin, %opts); @@ -103,7 +104,8 @@ product => $bin, srcs => $unified_info{sources}->{$obj}, deps => $unified_info{depends}->{$obj}, - incs => $unified_info{includes}->{$obj}, + incs => [ @{$unified_info{includes}->{$obj}}, + @{$unified_info{includes}->{$bin}} ], %opts); foreach ((@{$unified_info{sources}->{$obj}}, @{$unified_info{depends}->{$obj}})) { @@ -114,17 +116,17 @@ } # dolib is responsible for building libraries. It will call - # libobj2shlib is shared libraries are produced, and obj2lib in all + # obj2shlib is shared libraries are produced, and obj2lib in all # cases. It also makes sure all object files for the library are # built. sub dolib { my $lib = shift; return "" if $cache{$lib}; unless ($disabled{shared} || $lib =~ /\.a$/) { - $OUT .= libobj2shlib(shlib => $unified_info{sharednames}->{$lib}, + my $obj2shlib = defined &obj2shlib ? \&obj2shlib : \&libobj2shlib; + $OUT .= $obj2shlib->(shlib => $unified_info{sharednames}->{$lib}, lib => $lib, - objs => [ @{$unified_info{shared_sources}->{$lib}}, - @{$unified_info{sources}->{$lib}} ], + objs => $unified_info{shared_sources}->{$lib}, deps => [ reducedepends(resolvedepends($lib)) ], installed => is_installed($lib)); foreach ((@{$unified_info{shared_sources}->{$lib}}, @@ -132,7 +134,7 @@ # If this is somehow a compiled object, take care of it that way # Otherwise, it might simply be generated if (defined $unified_info{sources}->{$_}) { - doobj($_, $lib, intent => "lib", installed => is_installed($lib)); + doobj($_, $lib, intent => "shlib", installed => is_installed($lib)); } else { dogenerate($_, undef, undef, intent => "lib"); } @@ -153,12 +155,10 @@ my $lib = shift; return "" if $cache{$lib}; $OUT .= obj2dso(lib => $lib, - objs => [ @{$unified_info{sources}->{$lib}}, - @{$unified_info{shared_sources}->{$lib}} ], + objs => $unified_info{shared_sources}->{$lib}, deps => [ resolvedepends($lib) ], installed => is_installed($lib)); - foreach ((@{$unified_info{sources}->{$lib}}, - @{$unified_info{shared_sources}->{$lib}})) { + foreach (@{$unified_info{shared_sources}->{$lib}}) { doobj($_, $lib, intent => "dso", installed => is_installed($lib)); } $cache{$lib} = 1; diff --git a/Configurations/descrip.mms.tmpl b/Configurations/descrip.mms.tmpl index 0c2695d2..95fa521b 100644 --- a/Configurations/descrip.mms.tmpl +++ b/Configurations/descrip.mms.tmpl @@ -777,11 +777,13 @@ EOF } my $cppflags = { + shlib => '$(LIB_CFLAGS) $(LIB_CPPFLAGS)', lib => '$(LIB_CFLAGS) $(LIB_CPPFLAGS)', dso => '$(DSO_CFLAGS) $(DSO_CPPFLAGS)', bin => '$(BIN_CFLAGS) $(BIN_CPPFLAGS)' } -> {$args{intent}}; - my @incs_cmds = includes({ lib => '$(LIB_INCLUDES)', + my @incs_cmds = includes({ shlib => '$(LIB_INCLUDES)', + lib => '$(LIB_INCLUDES)', dso => '$(DSO_INCLUDES)', bin => '$(BIN_INCLUDES)' } -> {$args{intent}}, '$(CNF_INCLUDES)', @@ -844,7 +846,8 @@ EOF my $after = $unified_info{after}->{$obj.".OBJ"} || "\@ !"; if ($srcs[0] =~ /\.asm$/) { - my $asflags = { lib => ' $(LIB_ASFLAGS)', + my $asflags = { shlib => ' $(LIB_ASFLAGS)', + lib => ' $(LIB_ASFLAGS)', dso => ' $(DSO_ASFLAGS)', bin => ' $(BIN_ASFLAGS)' } -> {$args{intent}}; return <<"EOF"; @@ -858,19 +861,23 @@ EOF my $cflags; if ($args{installed}) { - $cflags = { lib => '$(LIB_CFLAGS)', + $cflags = { shlib => '$(LIB_CFLAGS)', + lib => '$(LIB_CFLAGS)', dso => '$(DSO_CFLAGS)', bin => '$(BIN_CFLAGS)' } -> {$args{intent}}; } else { - $cflags = { lib => '$(NO_INST_LIB_CFLAGS)', + $cflags = { shlib => '$(NO_INST_LIB_CFLAGS)', + lib => '$(NO_INST_LIB_CFLAGS)', dso => '$(NO_INST_DSO_CFLAGS)', bin => '$(NO_INST_BIN_CFLAGS)' } -> {$args{intent}}; } - $cflags .= { lib => '$(LIB_CPPFLAGS)', + $cflags .= { shlib => '$(LIB_CPPFLAGS)', + lib => '$(LIB_CPPFLAGS)', dso => '$(DSO_CPPFLAGS)', bin => '$(BIN_CPPFLAGS)' } -> {$args{intent}}; - my @incs_cmds = includes({ lib => '$(LIB_INCLUDES)', + my @incs_cmds = includes({ shlib => '$(LIB_INCLUDES)', + lib => '$(LIB_INCLUDES)', dso => '$(DSO_INCLUDES)', bin => '$(BIN_INCLUDES)' } -> {$args{intent}}, '$(INCLUDES)', @@ -895,7 +902,7 @@ $obj.OBJ : $deps - PURGE $obj.OBJ EOF } - sub libobj2shlib { + sub obj2shlib { my %args = @_; my $lib = $args{lib}; my $shlib = $args{shlib}; @@ -907,7 +914,7 @@ EOF my @defs = grep { $_ =~ /\.opt$/ } @{$args{objs}}; my @deps = compute_lib_depends(@{$args{deps}}); die "More than one symbol vector" if scalar @defs > 1; - my $deps = join(", -\n\t\t", @defs, @deps); + my $deps = join(", -\n\t\t", @objs, @defs, @deps); my $shlib_target = $disabled{shared} ? "" : $target{shared_target}; my $translatesyms_pl = abs2rel(rel2abs(catfile($config{sourcedir}, "VMS", "translatesyms.pl")), @@ -927,7 +934,7 @@ EOF "WRITE OPT_FILE \"$x\"" } @deps) || "\@ !"; return <<"EOF" -$shlib.EXE : $lib.OLB $deps +$shlib.EXE : $deps \$(PERL) $translatesyms_pl \$(BLDDIR)CXX\$DEMANGLER_DB. < $defs[0] > $defs[0]-translated OPEN/WRITE/SHARE=READ OPT_FILE $lib-components.OPT $write_opt1 diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl index 16af4d20..17f76a56 100644 --- a/Configurations/unix-Makefile.tmpl +++ b/Configurations/unix-Makefile.tmpl @@ -984,6 +984,7 @@ EOF } my $cppflags = { + shlib => '$(LIB_CFLAGS) $(LIB_CPPFLAGS)', lib => '$(LIB_CFLAGS) $(LIB_CPPFLAGS)', dso => '$(DSO_CFLAGS) $(DSO_CPPFLAGS)', bin => '$(BIN_CFLAGS) $(BIN_CPPFLAGS)' @@ -1023,6 +1024,7 @@ EOF $cmd = '$(CXX)'; $cmdcompile = ' -c'; $cmdflags = { + shlib => '$(LIB_CXXFLAGS) $(LIB_CPPFLAGS)', lib => '$(LIB_CXXFLAGS) $(LIB_CPPFLAGS)', dso => '$(DSO_CXXFLAGS) $(DSO_CPPFLAGS)', bin => '$(BIN_CXXFLAGS) $(BIN_CPPFLAGS)' @@ -1031,6 +1033,7 @@ EOF $cmd = '$(CC)'; $cmdcompile = ' -c'; $cmdflags = { + shlib => '$(LIB_CFLAGS) $(LIB_CPPFLAGS)', lib => '$(LIB_CFLAGS) $(LIB_CPPFLAGS)', dso => '$(DSO_CFLAGS) $(DSO_CPPFLAGS)', bin => '$(BIN_CFLAGS) $(BIN_CPPFLAGS)' @@ -1082,7 +1085,7 @@ EOF # On Unix, we build shlibs from static libs, so we're ignoring the # object file array. We *know* this routine is only called when we've # configure 'shared'. - sub libobj2shlib { + sub obj2shlib { my %args = @_; my $lib = $args{lib}; my $shlib = $args{shlib}; diff --git a/Configurations/windows-makefile.tmpl b/Configurations/windows-makefile.tmpl index f7d8e273..148ddf4c 100644 --- a/Configurations/windows-makefile.tmpl +++ b/Configurations/windows-makefile.tmpl @@ -531,6 +531,7 @@ EOF my $cppflags = $incs; $cppflags .= { + shlib => ' $(LIB_CFLAGS) $(LIB_CPPFLAGS)', lib => ' $(LIB_CFLAGS) $(LIB_CPPFLAGS)', dso => ' $(DSO_CFLAGS) $(DSO_CPPFLAGS)', bin => ' $(BIN_CFLAGS) $(BIN_CPPFLAGS)' @@ -568,14 +569,17 @@ EOF my $srcs = '"'.join('" "', @srcs).'"'; my $deps = '"'.join('" "', @srcs, @{$args{deps}}).'"'; my $incs = join("", map { ' /I "'.$_.'"' } @{$args{incs}}); - my $cflags = { lib => ' $(LIB_CFLAGS)', + my $cflags = { shlib => ' $(LIB_CFLAGS)', + lib => ' $(LIB_CFLAGS)', dso => ' $(DSO_CFLAGS)', bin => ' $(BIN_CFLAGS)' } -> {$args{intent}}; $cflags .= $incs; - $cflags .= { lib => ' $(LIB_CPPFLAGS)', + $cflags .= { shlib => ' $(LIB_CPPFLAGS)', + lib => ' $(LIB_CPPFLAGS)', dso => ' $(DSO_CPPFLAGS)', bin => ' $(BIN_CPPFLAGS)' } -> {$args{intent}}; - my $asflags = { lib => ' $(LIB_ASFLAGS)', + my $asflags = { shlib => ' $(LIB_ASFLAGS)', + lib => ' $(LIB_ASFLAGS)', dso => ' $(DSO_ASFLAGS)', bin => ' $(BIN_ASFLAGS)' } -> {$args{intent}}; my $makedepprog = $config{makedepprog}; @@ -612,7 +616,7 @@ EOF # On Unix, we build shlibs from static libs, so we're ignoring the # object file array. We *know* this routine is only called when we've # configure 'shared'. - sub libobj2shlib { + sub obj2shlib { my %args = @_; my $lib = $args{lib}; my $shlib = $args{shlib}; diff --git a/Configure b/Configure index 3baa8ce0..a1db916b 100755 --- a/Configure +++ b/Configure @@ -2029,15 +2029,15 @@ EOF $o =~ s/\.[csS]$/.o/; # C and assembler $o =~ s/\.(cc|cpp)$/_cc.o/; # C++ $o = cleanfile($buildd, $o, $blddir); - $unified_info{sources}->{$ddest}->{$o} = 1; - $unified_info{sources}->{$o}->{$s} = 1; + $unified_info{sources}->{$ddest}->{$o} = -1; + $unified_info{sources}->{$o}->{$s} = -1; } elsif ($s =~ /\.rc$/) { # We also recognise resource files my $o = $_; $o =~ s/\.rc$/.res/; # Resource configuration my $o = cleanfile($buildd, $o, $blddir); - $unified_info{sources}->{$ddest}->{$o} = 1; - $unified_info{sources}->{$o}->{$s} = 1; + $unified_info{sources}->{$ddest}->{$o} = -1; + $unified_info{sources}->{$o}->{$s} = -1; } else { $unified_info{sources}->{$ddest}->{$s} = 1; } @@ -2065,15 +2065,15 @@ EOF $o =~ s/\.[csS]$/.o/; # C and assembler $o =~ s/\.(cc|cpp)$/_cc.o/; # C++ $o = cleanfile($buildd, $o, $blddir); - $unified_info{shared_sources}->{$ddest}->{$o} = 1; - $unified_info{sources}->{$o}->{$s} = 1; + $unified_info{shared_sources}->{$ddest}->{$o} = -1; + $unified_info{sources}->{$o}->{$s} = -1; } elsif ($s =~ /\.rc$/) { # We also recognise resource files my $o = $_; $o =~ s/\.rc$/.res/; # Resource configuration my $o = cleanfile($buildd, $o, $blddir); - $unified_info{shared_sources}->{$ddest}->{$o} = 1; - $unified_info{sources}->{$o}->{$s} = 1; + $unified_info{shared_sources}->{$ddest}->{$o} = -1; + $unified_info{sources}->{$o}->{$s} = -1; } elsif ($s =~ /\.(def|map|opt)$/) { # We also recognise .def / .map / .opt files # We know they are generated files @@ -2189,25 +2189,100 @@ EOF } } - # Trickle down includes placed on libraries, engines and programs to - # their sources (i.e. object files) - foreach my $dest (keys %{$unified_info{engines}}, - keys %{$unified_info{libraries}}, - keys %{$unified_info{programs}}) { - foreach my $k (("source", "build")) { - next unless defined($unified_info{includes}->{$dest}->{$k}); - my @incs = reverse @{$unified_info{includes}->{$dest}->{$k}}; - foreach my $obj (grep /\.o$/, - (keys %{$unified_info{sources}->{$dest}}, - keys %{$unified_info{shared_sources}->{$dest}})) { - foreach my $inc (@incs) { - unshift @{$unified_info{includes}->{$obj}->{$k}}, $inc - unless grep { $_ eq $inc } @{$unified_info{includes}->{$obj}->{$k}}; + # Go through all object files and change their names to something that + # reflects what they will be built for. Note that for some source files, + # this leads to duplicate object files because they are used multiple times. + # the goal is to rename all object files according to this scheme: + # {productname}-{midfix}-{origobjname}.[o|res] + # the {midfix} is a keyword indicating the type of product, which is mostly + # valuable for libraries since they come in two forms. + # + # This also reorganises the {sources} and {shared_sources} so that the + # former only contains ALL object files that are supposed to end up in + # static libraries and programs, while the latter contains ALL object files + # that are supposed to end up in shared libraries and DSOs. + # The main reason for having two different source structures is to allow + # the same name to be used for the static and the shared variants of a + # library. + { + # Take copies so we don't get interference from added stuff + my %unified_copy = (); + foreach (('sources', 'shared_sources')) { + $unified_copy{$_} = { %{$unified_info{$_}} } + if defined($unified_info{$_}); + delete $unified_info{$_}; + } + foreach my $prodtype (('programs', 'libraries', 'engines', 'scripts')) { + # $intent serves multi purposes: + # - give a prefix for the new object files names + # - in the case of libraries, rearrange the object files so static + # libraries use the 'sources' structure exclusively, while shared + # libraries use the 'shared_sources' structure exclusively. + my $intent = { + programs => { bin => { src => [ 'sources' ], + dst => 'sources' } }, + libraries => { lib => { src => [ 'sources' ], + dst => 'sources' }, + shlib => { prodselect => + sub { grep !/\.a$/, @_ }, + src => [ 'sources', + 'shared_sources' ], + dst => 'shared_sources' } }, + engines => { dso => { src => [ 'sources', + 'shared_sources' ], + dst => 'shared_sources' } }, + scripts => { script => { src => [ 'sources' ], + dst => 'sources' } } + } -> {$prodtype}; + foreach my $kind (keys %$intent) { + my @src = @{$intent->{$kind}->{src}}; + my $dst = $intent->{$kind}->{dst}; + my $prodselect = $intent->{$kind}->{prodselect} // sub { @_ }; + foreach my $prod ($prodselect->(keys %{$unified_info{$prodtype}})) { + # %prod_sources has all applicable objects as keys, and + # their corresponding sources as values + my %prod_sources = + map { $_ => [ keys %{$unified_copy{sources}->{$_}} ] } + map { keys %{$unified_copy{$_}->{$prod}} } + @src; + foreach (keys %prod_sources) { + # Only affect object or resource files, the others + # simply get a new value (+1 instead of -1) + if ($_ =~ /\.(o|res)$/) { + (my $prodname = $prod) =~ s|\.a$||; + my $newobj = + catfile(dirname($_), + basename($prodname) + . '-' . $kind + . '-' . basename($_)); + $unified_info{$dst}->{$prod}->{$newobj} = 1; + foreach my $src (@{$prod_sources{$_}}) { + $unified_info{sources}->{$newobj}->{$src} = 1; + } + # Adjust dependencies + foreach my $deps (keys %{$unified_info{depends}->{$_}}) { + $unified_info{depends}->{$_}->{$deps} = -1; + $unified_info{depends}->{$newobj}->{$deps} = 1; + } + # Adjust includes + foreach my $k (('source', 'build')) { + next unless + defined($unified_info{includes}->{$_}->{$k}); + my @incs = @{$unified_info{includes}->{$_}->{$k}}; + $unified_info{includes}->{$newobj}->{$k} = [ @incs ]; + } + } else { + $unified_info{$dst}->{$prod}->{$_} = 1; + } + } } } } - delete $unified_info{includes}->{$dest}; } + # At this point, we have a number of sources with the value -1. They + # aren't part of the local build and are probably meant for a different + # platform, and can therefore be cleaned away. That happens when making + # %unified_info more efficient below. ### Make unified_info a bit more efficient # One level structures @@ -2217,8 +2292,15 @@ EOF # Two level structures foreach my $l1 (("install", "sources", "shared_sources", "ldadd", "depends")) { foreach my $l2 (sort keys %{$unified_info{$l1}}) { - $unified_info{$l1}->{$l2} = - [ sort keys %{$unified_info{$l1}->{$l2}} ]; + my @items = + sort + grep { $unified_info{$l1}->{$l2}->{$_} > 0 } + keys %{$unified_info{$l1}->{$l2}}; + if (@items) { + $unified_info{$l1}->{$l2} = [ @items ]; + } else { + delete $unified_info{$l1}->{$l2}; + } } } # Includes @@ -2233,9 +2315,11 @@ EOF push @{$unified_info{includes}->{$dest}}, $inc unless grep { $_ eq $inc } @{$unified_info{includes}->{$dest}}; } - } else { + } elsif (defined($unified_info{includes}->{$dest}->{source})) { $unified_info{includes}->{$dest} = [ @{$unified_info{includes}->{$dest}->{source}} ]; + } else { + delete $unified_info{includes}->{$dest}; } } } diff --git a/crypto/bio/b_sock2.c b/crypto/bio/b_sock2.c index 823732d6..5d82ab22 100644 --- a/crypto/bio/b_sock2.c +++ b/crypto/bio/b_sock2.c @@ -133,7 +133,9 @@ int BIO_connect(int sock, const BIO_ADDR *addr, int options) */ int BIO_bind(int sock, const BIO_ADDR *addr, int options) { +# ifndef OPENSSL_SYS_WINDOWS int on = 1; +# endif if (sock == -1) { BIOerr(BIO_F_BIO_BIND, BIO_R_INVALID_SOCKET); diff --git a/crypto/cryptlib.c b/crypto/cryptlib.c index b1e535a6..1cd77c96 100644 --- a/crypto/cryptlib.c +++ b/crypto/cryptlib.c @@ -204,7 +204,7 @@ int OPENSSL_isservice(void) if (_OPENSSL_isservice.p == NULL) { HANDLE mod = GetModuleHandle(NULL); - FARPROC f; + FARPROC f = NULL; if (mod != NULL) f = GetProcAddress(mod, "_OPENSSL_isservice"); diff --git a/crypto/err/openssl.txt b/crypto/err/openssl.txt index 2c8572ba..84e63930 100644 --- a/crypto/err/openssl.txt +++ b/crypto/err/openssl.txt @@ -711,6 +711,7 @@ ENGINE_F_INT_ENGINE_MODULE_INIT:187:int_engine_module_init ENGINE_F_OSSL_HMAC_INIT:200:ossl_hmac_init EVP_F_AESNI_INIT_KEY:165:aesni_init_key EVP_F_AES_GCM_CTRL:196:aes_gcm_ctrl +EVP_F_AES_GCM_TLS_CIPHER:207:aes_gcm_tls_cipher EVP_F_AES_INIT_KEY:133:aes_init_key EVP_F_AES_OCB_CIPHER:169:aes_ocb_cipher EVP_F_AES_T4_INIT_KEY:178:aes_t4_init_key @@ -805,6 +806,7 @@ EVP_F_PKEY_SET_TYPE:158:pkey_set_type EVP_F_RC2_MAGIC_TO_METH:109:rc2_magic_to_meth EVP_F_RC5_CTRL:125:rc5_ctrl EVP_F_S390X_AES_GCM_CTRL:201:s390x_aes_gcm_ctrl +EVP_F_S390X_AES_GCM_TLS_CIPHER:208:s390x_aes_gcm_tls_cipher EVP_F_UPDATE:173:update KDF_F_PKEY_HKDF_CTRL_STR:103:pkey_hkdf_ctrl_str KDF_F_PKEY_HKDF_DERIVE:102:pkey_hkdf_derive @@ -2265,6 +2267,7 @@ EVP_R_PKEY_APPLICATION_ASN1_METHOD_ALREADY_REGISTERED:179:\ EVP_R_PRIVATE_KEY_DECODE_ERROR:145:private key decode error EVP_R_PRIVATE_KEY_ENCODE_ERROR:146:private key encode error EVP_R_PUBLIC_KEY_NOT_RSA:106:public key not rsa +EVP_R_TOO_MANY_RECORDS:183:too many records EVP_R_UNKNOWN_CIPHER:160:unknown cipher EVP_R_UNKNOWN_DIGEST:161:unknown digest EVP_R_UNKNOWN_OPTION:169:unknown option diff --git a/crypto/evp/e_aes.c b/crypto/evp/e_aes.c index 61d37a89..f81ad660 100644 --- a/crypto/evp/e_aes.c +++ b/crypto/evp/e_aes.c @@ -44,6 +44,7 @@ typedef struct { int taglen; int iv_gen; /* It is OK to generate IVs */ int tls_aad_len; /* TLS AAD length */ + uint64_t tls_enc_records; /* Number of TLS records encrypted */ ctr128_f ctr; } EVP_AES_GCM_CTX; @@ -1069,6 +1070,7 @@ typedef struct { int kreslen; int tls_aad_len; + uint64_t tls_enc_records; /* Number of TLS records encrypted */ } S390X_AES_GCM_CTX; typedef struct { @@ -1692,6 +1694,7 @@ static int s390x_aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr) buf = EVP_CIPHER_CTX_buf_noconst(c); memcpy(buf, ptr, arg); gctx->tls_aad_len = arg; + gctx->tls_enc_records = 0; len = buf[arg - 2] << 8 | buf[arg - 1]; /* Correct length for explicit iv. */ @@ -1791,6 +1794,17 @@ static int s390x_aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, if (out != in || len < (EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN)) return -1; + /* + * Check for too many keys as per FIPS 140-2 IG A.5 "Key/IV Pair Uniqueness + * Requirements from SP 800-38D". The requirements is for one party to the + * communication to fail after 2^64 - 1 keys. We do this on the encrypting + * side only. + */ + if (ctx->encrypt && ++gctx->tls_enc_records == 0) { + EVPerr(EVP_F_S390X_AES_GCM_TLS_CIPHER, EVP_R_TOO_MANY_RECORDS); + goto err; + } + if (EVP_CIPHER_CTX_ctrl(ctx, enc ? EVP_CTRL_GCM_IV_GEN : EVP_CTRL_GCM_SET_IV_INV, EVP_GCM_TLS_EXPLICIT_IV_LEN, out) <= 0) @@ -2901,6 +2915,7 @@ static int aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr) return 0; memcpy(c->buf, ptr, arg); gctx->tls_aad_len = arg; + gctx->tls_enc_records = 0; { unsigned int len = c->buf[arg - 2] << 8 | c->buf[arg - 1]; /* Correct length for explicit IV */ @@ -3035,6 +3050,18 @@ static int aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, if (out != in || len < (EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN)) return -1; + + /* + * Check for too many keys as per FIPS 140-2 IG A.5 "Key/IV Pair Uniqueness + * Requirements from SP 800-38D". The requirements is for one party to the + * communication to fail after 2^64 - 1 keys. We do this on the encrypting + * side only. + */ + if (ctx->encrypt && ++gctx->tls_enc_records == 0) { + EVPerr(EVP_F_AES_GCM_TLS_CIPHER, EVP_R_TOO_MANY_RECORDS); + goto err; + } + /* * Set IV from start of buffer or generate IV and write to start of * buffer. diff --git a/crypto/evp/evp_err.c b/crypto/evp/evp_err.c index 3e14a7b5..ec6efb6e 100644 --- a/crypto/evp/evp_err.c +++ b/crypto/evp/evp_err.c @@ -16,6 +16,7 @@ static const ERR_STRING_DATA EVP_str_functs[] = { {ERR_PACK(ERR_LIB_EVP, EVP_F_AESNI_INIT_KEY, 0), "aesni_init_key"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_AES_GCM_CTRL, 0), "aes_gcm_ctrl"}, + {ERR_PACK(ERR_LIB_EVP, EVP_F_AES_GCM_TLS_CIPHER, 0), "aes_gcm_tls_cipher"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_AES_INIT_KEY, 0), "aes_init_key"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_AES_OCB_CIPHER, 0), "aes_ocb_cipher"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_AES_T4_INIT_KEY, 0), "aes_t4_init_key"}, @@ -148,6 +149,8 @@ static const ERR_STRING_DATA EVP_str_functs[] = { {ERR_PACK(ERR_LIB_EVP, EVP_F_RC2_MAGIC_TO_METH, 0), "rc2_magic_to_meth"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_RC5_CTRL, 0), "rc5_ctrl"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_S390X_AES_GCM_CTRL, 0), "s390x_aes_gcm_ctrl"}, + {ERR_PACK(ERR_LIB_EVP, EVP_F_S390X_AES_GCM_TLS_CIPHER, 0), + "s390x_aes_gcm_tls_cipher"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_UPDATE, 0), "update"}, {0, NULL} }; @@ -239,6 +242,7 @@ static const ERR_STRING_DATA EVP_str_reasons[] = { {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_PRIVATE_KEY_ENCODE_ERROR), "private key encode error"}, {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_PUBLIC_KEY_NOT_RSA), "public key not rsa"}, + {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_TOO_MANY_RECORDS), "too many records"}, {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_UNKNOWN_CIPHER), "unknown cipher"}, {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_UNKNOWN_DIGEST), "unknown digest"}, {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_UNKNOWN_OPTION), "unknown option"}, diff --git a/crypto/rand/drbg_lib.c b/crypto/rand/drbg_lib.c index 729b49c9..9c315ed6 100644 --- a/crypto/rand/drbg_lib.c +++ b/crypto/rand/drbg_lib.c @@ -82,6 +82,10 @@ static unsigned int slave_reseed_interval = SLAVE_RESEED_INTERVAL; static time_t master_reseed_time_interval = MASTER_RESEED_TIME_INTERVAL; static time_t slave_reseed_time_interval = SLAVE_RESEED_TIME_INTERVAL; +/* A logical OR of all used DRBG flag bits (currently there is only one) */ +static const unsigned int rand_drbg_used_flags = + RAND_DRBG_FLAG_CTR_NO_DF; + static RAND_DRBG *drbg_setup(RAND_DRBG *parent); static RAND_DRBG *rand_drbg_new(int secure, @@ -147,7 +151,7 @@ int RAND_DRBG_set_defaults(int type, unsigned int flags) break; } - if ((flags & ~RAND_DRBG_USED_FLAGS) != 0) { + if ((flags & ~rand_drbg_used_flags) != 0) { RANDerr(RAND_F_RAND_DRBG_SET_DEFAULTS, RAND_R_UNSUPPORTED_DRBG_FLAGS); return 0; } diff --git a/crypto/sm2/sm2_sign.c b/crypto/sm2/sm2_sign.c index e594ffd1..0f9c14cb 100644 --- a/crypto/sm2/sm2_sign.c +++ b/crypto/sm2/sm2_sign.c @@ -12,6 +12,7 @@ #include "internal/sm2.h" #include "internal/sm2err.h" #include "internal/ec_int.h" /* ec_group_do_inverse_ord() */ +#include "internal/numbers.h" #include #include #include diff --git a/fuzz/README.md b/fuzz/README.md index 8536566e..44c73f85 100644 --- a/fuzz/README.md +++ b/fuzz/README.md @@ -37,7 +37,7 @@ Configure for fuzzing: $ CC=clang ./config enable-fuzz-libfuzzer \ --with-fuzzer-include=../../svn-work/Fuzzer \ - --with-fuzzer-lib=../../svn-work/Fuzzer/libFuzzer \ + --with-fuzzer-lib=../../svn-work/Fuzzer/libFuzzer.a \ -DPEDANTIC enable-asan enable-ubsan no-shared \ -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION \ -fsanitize-coverage=trace-pc-guard,indirect-calls,trace-cmp \ diff --git a/include/openssl/evperr.h b/include/openssl/evperr.h index 3484fa84..d2d44c24 100644 --- a/include/openssl/evperr.h +++ b/include/openssl/evperr.h @@ -21,6 +21,7 @@ int ERR_load_EVP_strings(void); */ # define EVP_F_AESNI_INIT_KEY 165 # define EVP_F_AES_GCM_CTRL 196 +# define EVP_F_AES_GCM_TLS_CIPHER 207 # define EVP_F_AES_INIT_KEY 133 # define EVP_F_AES_OCB_CIPHER 169 # define EVP_F_AES_T4_INIT_KEY 178 @@ -115,6 +116,7 @@ int ERR_load_EVP_strings(void); # define EVP_F_RC2_MAGIC_TO_METH 109 # define EVP_F_RC5_CTRL 125 # define EVP_F_S390X_AES_GCM_CTRL 201 +# define EVP_F_S390X_AES_GCM_TLS_CIPHER 208 # define EVP_F_UPDATE 173 /* @@ -174,6 +176,7 @@ int ERR_load_EVP_strings(void); # define EVP_R_PRIVATE_KEY_DECODE_ERROR 145 # define EVP_R_PRIVATE_KEY_ENCODE_ERROR 146 # define EVP_R_PUBLIC_KEY_NOT_RSA 106 +# define EVP_R_TOO_MANY_RECORDS 183 # define EVP_R_UNKNOWN_CIPHER 160 # define EVP_R_UNKNOWN_DIGEST 161 # define EVP_R_UNKNOWN_OPTION 169 diff --git a/include/openssl/rand_drbg.h b/include/openssl/rand_drbg.h index 282356e1..cfc7fb7e 100644 --- a/include/openssl/rand_drbg.h +++ b/include/openssl/rand_drbg.h @@ -13,14 +13,21 @@ # include # include +/* + * RAND_DRBG flags + * + * Note: if new flags are added, the constant `rand_drbg_used_flags` + * in drbg_lib.c needs to be updated accordingly. + */ /* In CTR mode, disable derivation function ctr_df */ # define RAND_DRBG_FLAG_CTR_NO_DF 0x1 -/* A logical OR of all used flag bits (currently there is only one) */ -# define RAND_DRBG_USED_FLAGS ( \ - RAND_DRBG_FLAG_CTR_NO_DF \ - ) + +# if OPENSSL_API_COMPAT < 0x10200000L +/* This #define was replaced by an internal constant and should not be used. */ +# define RAND_DRBG_USED_FLAGS (RAND_DRBG_FLAG_CTR_NO_DF) +# endif /* * Default security strength (in the sense of [NIST SP 800-90Ar1]) diff --git a/ssl/statem/statem.c b/ssl/statem/statem.c index d75f9ea0..f76c0e48 100644 --- a/ssl/statem/statem.c +++ b/ssl/statem/statem.c @@ -118,11 +118,12 @@ void ossl_statem_set_renegotiate(SSL *s) void ossl_statem_fatal(SSL *s, int al, int func, int reason, const char *file, int line) { + ERR_put_error(ERR_LIB_SSL, func, reason, file, line); /* We shouldn't call SSLfatal() twice. Once is enough */ - assert(s->statem.state != MSG_FLOW_ERROR); + if (s->statem.in_init && s->statem.state == MSG_FLOW_ERROR) + return; s->statem.in_init = 1; s->statem.state = MSG_FLOW_ERROR; - ERR_put_error(ERR_LIB_SSL, func, reason, file, line); if (al != SSL_AD_NO_ALERT && s->statem.enc_write_state != ENC_WRITE_STATE_INVALID) ssl3_send_alert(s, SSL3_AL_FATAL, al); diff --git a/util/mkrc.pl b/util/mkrc.pl index a221d517..6762bc4a 100755 --- a/util/mkrc.pl +++ b/util/mkrc.pl @@ -70,7 +70,7 @@ BEGIN BLOCK "040904b0" BEGIN // Required: - VALUE "CompanyName", "The OpenSSL Project, http://www.openssl.org/\\0" + VALUE "CompanyName", "The OpenSSL Project, https://www.openssl.org/\\0" VALUE "FileDescription", "$description\\0" VALUE "FileVersion", "$version\\0" VALUE "InternalName", "$filename\\0"