Compare commits
11
Commits
9dfeec3942
..
master
| Author | SHA1 | Date | |
|---|---|---|---|
 Hakase
|
e85ee33eee
|
||
|
Hakase
|
3a6d64bb68
|
||
|
Hakase
|
ad9fce94c2
|
||
|
Hakase
|
5dc84c29bf
|
||
|
Hakase
|
8c362f8c50
|
||
|
Hakase
|
2fe8309780
|
||
|
Hakase
|
80ef640063
|
||
|
Hakase
|
2015c00c43
|
||
|
Hakase
|
be29e7bcc6
|
||
|
Hakase
|
b412d79e8b
|
||
|
Hakase
|
f85de4da03
|
+8
-41
@@ -26,43 +26,7 @@
|
||||
/include/openssl/opensslv.h
|
||||
|
||||
# Auto generated doc files
|
||||
# Keep this in sync with doc/man1/build.info
|
||||
doc/man1/openssl-ca.pod
|
||||
doc/man1/openssl-cms.pod
|
||||
doc/man1/openssl-crl.pod
|
||||
doc/man1/openssl-dgst.pod
|
||||
doc/man1/openssl-dhparam.pod
|
||||
doc/man1/openssl-dsa.pod
|
||||
doc/man1/openssl-dsaparam.pod
|
||||
doc/man1/openssl-ec.pod
|
||||
doc/man1/openssl-ecparam.pod
|
||||
doc/man1/openssl-enc.pod
|
||||
doc/man1/openssl-gendsa.pod
|
||||
doc/man1/openssl-genpkey.pod
|
||||
doc/man1/openssl-genrsa.pod
|
||||
doc/man1/openssl-ocsp.pod
|
||||
doc/man1/openssl-passwd.pod
|
||||
doc/man1/openssl-pkcs12.pod
|
||||
doc/man1/openssl-pkcs7.pod
|
||||
doc/man1/openssl-pkcs8.pod
|
||||
doc/man1/openssl-pkey.pod
|
||||
doc/man1/openssl-pkeyparam.pod
|
||||
doc/man1/openssl-pkeyutl.pod
|
||||
doc/man1/openssl-rand.pod
|
||||
doc/man1/openssl-req.pod
|
||||
doc/man1/openssl-rsa.pod
|
||||
doc/man1/openssl-rsautl.pod
|
||||
doc/man1/openssl-s_client.pod
|
||||
doc/man1/openssl-s_server.pod
|
||||
doc/man1/openssl-s_time.pod
|
||||
doc/man1/openssl-smime.pod
|
||||
doc/man1/openssl-speed.pod
|
||||
doc/man1/openssl-spkac.pod
|
||||
doc/man1/openssl-srp.pod
|
||||
doc/man1/openssl-storeutl.pod
|
||||
doc/man1/openssl-ts.pod
|
||||
doc/man1/openssl-verify.pod
|
||||
doc/man1/openssl-x509.pod
|
||||
doc/man1/openssl-*.pod
|
||||
|
||||
# error code files
|
||||
/crypto/err/openssl.txt.old
|
||||
@@ -96,12 +60,12 @@ doc/man1/openssl-x509.pod
|
||||
/test/confdump
|
||||
/test/bio_prefix_text
|
||||
# Other generated files in test/
|
||||
/test/provider_internal_test.conf
|
||||
/test/fipsinstall.conf
|
||||
/providers/fipsinstall.conf
|
||||
/test/provider_internal_test.cnf
|
||||
/test/fipsinstall.cnf
|
||||
/providers/fipsinstall.cnf
|
||||
|
||||
# Certain files that get created by tests on the fly
|
||||
/test/test-runs
|
||||
/test-runs
|
||||
/test/buildtest_*
|
||||
|
||||
# Fuzz stuff.
|
||||
@@ -123,6 +87,8 @@ doc/man1/openssl-x509.pod
|
||||
/TAGS
|
||||
*.map
|
||||
*.ld
|
||||
/apps/progs.c
|
||||
/apps/progs.h
|
||||
|
||||
# Windows (legacy)
|
||||
/tmp32
|
||||
@@ -220,6 +186,7 @@ Makefile.save
|
||||
*.bak
|
||||
cscope.*
|
||||
*.d
|
||||
*.d.tmp
|
||||
pod2htmd.tmp
|
||||
|
||||
# Windows manifest files
|
||||
|
||||
@@ -1,2 +0,0 @@
|
||||
Please https://www.openssl.org/community/thanks.html for the current
|
||||
acknowledgements.
|
||||
@@ -0,0 +1,7 @@
|
||||
Acknowlegements
|
||||
===============
|
||||
|
||||
Please see our [Thanks!][] page for the current acknowledgements.
|
||||
|
||||
[Thanks!]: https://www.openssl.org/community/thanks.html
|
||||
|
||||
@@ -1,35 +0,0 @@
|
||||
# This is the list of OpenSSL authors for copyright purposes.
|
||||
#
|
||||
# This does not necessarily list everyone who has contributed code, since in
|
||||
# some cases, their employer may be the copyright holder. To see the full list
|
||||
# of contributors, see the revision history in source control.
|
||||
OpenSSL Software Services, Inc.
|
||||
OpenSSL Software Foundation, Inc.
|
||||
|
||||
# Individuals
|
||||
Andy Polyakov
|
||||
Ben Laurie
|
||||
Ben Kaduk
|
||||
Bernd Edlinger
|
||||
Bodo Möller
|
||||
David Benjamin
|
||||
Emilia Käsper
|
||||
Eric Young
|
||||
Geoff Thorpe
|
||||
Holger Reif
|
||||
Kurt Roeckx
|
||||
Lutz Jänicke
|
||||
Mark J. Cox
|
||||
Matt Caswell
|
||||
Matthias St. Pierre
|
||||
Nils Larsch
|
||||
Paul Dale
|
||||
Paul C. Sutton
|
||||
Ralf S. Engelschall
|
||||
Rich Salz
|
||||
Richard Levitte
|
||||
Stephen Henson
|
||||
Steve Marquess
|
||||
Tim Hudson
|
||||
Ulf Möller
|
||||
Viktor Dukhovni
|
||||
+44
@@ -0,0 +1,44 @@
|
||||
Authors
|
||||
=======
|
||||
|
||||
This is the list of OpenSSL authors for copyright purposes.
|
||||
It does not necessarily list everyone who has contributed code,
|
||||
since in some cases, their employer may be the copyright holder.
|
||||
To see the full list of contributors, see the revision history in
|
||||
source control.
|
||||
|
||||
Groups
|
||||
------
|
||||
|
||||
* OpenSSL Software Services, Inc.
|
||||
* OpenSSL Software Foundation, Inc.
|
||||
|
||||
Individuals
|
||||
-----------
|
||||
|
||||
* Andy Polyakov
|
||||
* Ben Laurie
|
||||
* Ben Kaduk
|
||||
* Bernd Edlinger
|
||||
* Bodo Möller
|
||||
* David Benjamin
|
||||
* Emilia Käsper
|
||||
* Eric Young
|
||||
* Geoff Thorpe
|
||||
* Holger Reif
|
||||
* Kurt Roeckx
|
||||
* Lutz Jänicke
|
||||
* Mark J. Cox
|
||||
* Matt Caswell
|
||||
* Matthias St. Pierre
|
||||
* Nils Larsch
|
||||
* Paul Dale
|
||||
* Paul C. Sutton
|
||||
* Ralf S. Engelschall
|
||||
* Rich Salz
|
||||
* Richard Levitte
|
||||
* Stephen Henson
|
||||
* Steve Marquess
|
||||
* Tim Hudson
|
||||
* Ulf Möller
|
||||
* Viktor Dukhovni
|
||||
+18470
File diff suppressed because it is too large
Load Diff
@@ -1,10 +1,13 @@
|
||||
HOW TO CONTRIBUTE TO OpenSSL
|
||||
----------------------------
|
||||
============================
|
||||
|
||||
(Please visit https://www.openssl.org/community/getting-started.html for
|
||||
other ideas about how to contribute.)
|
||||
Please visit our [Getting Started][gs] page for other ideas about how to contribute.
|
||||
|
||||
Development is done on GitHub, https://github.com/openssl/openssl.
|
||||
[gs]: https://www.openssl.org/community/getting-started.html
|
||||
|
||||
Development is done on GitHub in the [openssl/openssl][gh] repository.
|
||||
|
||||
[gh]: https://github.com/openssl/openssl
|
||||
|
||||
To request new features or report bugs, please open an issue on GitHub
|
||||
|
||||
@@ -16,65 +19,73 @@ the same thing or there may be reasons why that feature isn't implemented.
|
||||
To make it easier to review and accept your pull request, please follow these
|
||||
guidelines:
|
||||
|
||||
1. Anything other than a trivial contribution requires a Contributor
|
||||
License Agreement (CLA), giving us permission to use your code. See
|
||||
https://www.openssl.org/policies/cla.html for details. If your
|
||||
contribution is too small to require a CLA (e.g. fixing a spelling
|
||||
mistake), place the text "CLA: trivial" on a line by itself separated by
|
||||
1. Anything other than a trivial contribution requires a [Contributor
|
||||
License Agreement][CLA] (CLA), giving us permission to use your code.
|
||||
If your contribution is too small to require a CLA (e.g. fixing a spelling
|
||||
mistake), place the text "`CLA: trivial`" on a line by itself separated by
|
||||
an empty line from the rest of the commit message. It is not sufficient to
|
||||
only place the text in the GitHub pull request description.
|
||||
|
||||
To amend a missing "CLA: trivial" line after submission, do the following:
|
||||
[CLA]: https://www.openssl.org/policies/cla.html
|
||||
|
||||
To amend a missing "`CLA: trivial`" line after submission, do the following:
|
||||
|
||||
```
|
||||
git commit --amend
|
||||
[add the line, save and quit the editor]
|
||||
git push -f
|
||||
```
|
||||
|
||||
2. All source files should start with the following text (with
|
||||
2. All source files should start with the following text (with
|
||||
appropriate comment characters at the start of each line and the
|
||||
year(s) updated):
|
||||
|
||||
```
|
||||
Copyright 20xx-20yy The OpenSSL Project Authors. All Rights Reserved.
|
||||
|
||||
Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
this file except in compliance with the License. You can obtain a copy
|
||||
in the file LICENSE in the source distribution or at
|
||||
https://www.openssl.org/source/license.html
|
||||
```
|
||||
|
||||
3. Patches should be as current as possible; expect to have to rebase
|
||||
3. Patches should be as current as possible; expect to have to rebase
|
||||
often. We do not accept merge commits, you will have to remove them
|
||||
(usually by rebasing) before it will be acceptable.
|
||||
|
||||
4. Patches should follow our coding style (see
|
||||
https://www.openssl.org/policies/codingstyle.html) and compile
|
||||
without warnings. Where gcc or clang is available you should use the
|
||||
4. Patches should follow our [coding style][] and compile without warnings.
|
||||
Where gcc or clang is available you should use the
|
||||
--strict-warnings Configure option. OpenSSL compiles on many varied
|
||||
platforms: try to ensure you only use portable features. Clean builds
|
||||
via Travis and AppVeyor are required, and they are started automatically
|
||||
whenever a PR is created or updated.
|
||||
|
||||
5. When at all possible, patches should include tests. These can
|
||||
[coding style]: https://www.openssl.org/policies/codingstyle.html
|
||||
|
||||
5. When at all possible, patches should include tests. These can
|
||||
either be added to an existing test, or completely new. Please see
|
||||
test/README for information on the test framework.
|
||||
|
||||
6. New features or changed functionality must include
|
||||
6. New features or changed functionality must include
|
||||
documentation. Please look at the "pod" files in doc/man[1357] for
|
||||
examples of our style. Run "make doc-nits" to make sure that your
|
||||
documentation changes are clean.
|
||||
|
||||
7. For user visible changes (API changes, behaviour changes, ...),
|
||||
consider adding a note in CHANGES. This could be a summarising
|
||||
description of the change, and could explain the grander details.
|
||||
7. For user visible changes (API changes, behaviour changes, ...),
|
||||
consider adding a note in [CHANGES.md](CHANGES.md).
|
||||
This could be a summarising description of the change, and could
|
||||
explain the grander details.
|
||||
Have a look through existing entries for inspiration.
|
||||
Please note that this is NOT simply a copy of git-log one-liners.
|
||||
Also note that security fixes get an entry in CHANGES.
|
||||
Also note that security fixes get an entry in CHANGES.md.
|
||||
This file helps users get more in depth information of what comes
|
||||
with a specific release without having to sift through the higher
|
||||
noise ratio in git-log.
|
||||
|
||||
8. For larger or more important user visible changes, as well as
|
||||
security fixes, please add a line in NEWS. On exception, it might be
|
||||
worth adding a multi-line entry (such as the entry that announces all
|
||||
the types that became opaque with OpenSSL 1.1.0).
|
||||
8. For larger or more important user visible changes, as well as
|
||||
security fixes, please add a line in [NEWS.md](NEWS.md).
|
||||
On exception, it might be worth adding a multi-line entry (such as
|
||||
the entry that announces all the types that became opaque with
|
||||
OpenSSL 1.1.0).
|
||||
This file helps users get a very quick summary of what comes with a
|
||||
specific release, to see if an upgrade is worth the effort.
|
||||
@@ -10,7 +10,7 @@ my %targets=(
|
||||
includes => [],
|
||||
lib_cflags => "",
|
||||
lib_cppflags => "",
|
||||
lib_defines => [ 'OPENSSL_BUILDING_OPENSSL' ],
|
||||
lib_defines => [],
|
||||
thread_scheme => "(unknown)", # Assume we don't know
|
||||
thread_defines => [],
|
||||
|
||||
@@ -47,7 +47,7 @@ my %targets=(
|
||||
|
||||
defines =>
|
||||
sub {
|
||||
my @defs = ();
|
||||
my @defs = ( 'OPENSSL_BUILDING_OPENSSL' );
|
||||
push @defs, "ZLIB" unless $disabled{zlib};
|
||||
push @defs, "ZLIB_SHARED" unless $disabled{"zlib-dynamic"};
|
||||
return [ @defs ];
|
||||
|
||||
@@ -790,7 +790,7 @@ my %targets = (
|
||||
inherit_from => [ "linux-generic32" ],
|
||||
cflags => add("-mabi=n32"),
|
||||
cxxflags => add("-mabi=n32"),
|
||||
bn_ops => "SIXTY_FOUR_BIT RC4_CHAR",
|
||||
bn_ops => "RC4_CHAR",
|
||||
asm_arch => 'mips64',
|
||||
perlasm_scheme => "n32",
|
||||
multilib => "32",
|
||||
@@ -1004,7 +1004,6 @@ my %targets = (
|
||||
CFLAGS => add(picker(release => "-fomit-frame-pointer")),
|
||||
lib_cppflags => add("-DL_ENDIAN"),
|
||||
bn_ops => "BN_LLONG",
|
||||
shared_target => "bsd-shared",
|
||||
asm_arch => 'x86',
|
||||
perlasm_scheme => "a.out",
|
||||
},
|
||||
@@ -1483,6 +1482,16 @@ my %targets = (
|
||||
lib_cppflags => "-DL_ENDIAN",
|
||||
sys_id => "UEFI",
|
||||
},
|
||||
"UEFI-x86" => {
|
||||
inherit_from => [ "UEFI" ],
|
||||
asm_arch => 'x86',
|
||||
perlasm_scheme => "win32n",
|
||||
},
|
||||
"UEFI-x86_64" => {
|
||||
inherit_from => [ "UEFI" ],
|
||||
asm_arch => 'x86_64',
|
||||
perlasm_scheme => "nasm",
|
||||
},
|
||||
|
||||
#### UWIN
|
||||
"UWIN" => {
|
||||
|
||||
@@ -24,17 +24,17 @@
|
||||
|
||||
my $ndk_var;
|
||||
my $ndk;
|
||||
foreach (qw(ANDROID_NDK_HOME ANDROID_NDK)) {
|
||||
foreach (qw(ANDROID_NDK_ROOT ANDROID_NDK)) {
|
||||
$ndk_var = $_;
|
||||
$ndk = $ENV{$ndk_var};
|
||||
last if defined $ndk;
|
||||
}
|
||||
die "\$ANDROID_NDK_HOME is not defined" if (!$ndk);
|
||||
die "\$ANDROID_NDK_ROOT is not defined" if (!$ndk);
|
||||
if (!-d "$ndk/platforms" && !-f "$ndk/AndroidVersion.txt") {
|
||||
# $ndk/platforms is traditional "all-inclusive" NDK, while
|
||||
# $ndk/AndroidVersion.txt is so-called standalone toolchain
|
||||
# tailored for specific target down to API level.
|
||||
die "\$ANDROID_NDK_HOME=$ndk is invalid";
|
||||
die "\$ANDROID_NDK_ROOT=$ndk is invalid";
|
||||
}
|
||||
$ndk = canonpath($ndk);
|
||||
|
||||
@@ -168,7 +168,8 @@ my %targets = (
|
||||
cppflags => add(sub { android_ndk()->{cppflags} }),
|
||||
cxxflags => add(sub { android_ndk()->{cflags} }),
|
||||
bn_ops => sub { android_ndk()->{bn_ops} },
|
||||
bin_cflags => "-pie",
|
||||
bin_cflags => "-fPIE",
|
||||
bin_lflags => "-pie",
|
||||
enable => [ ],
|
||||
},
|
||||
"android-arm" => {
|
||||
|
||||
@@ -28,14 +28,6 @@
|
||||
(my $x = shift) =~ s|\]$|...]|;
|
||||
$x
|
||||
}
|
||||
sub move {
|
||||
my $f = catdir(@_);
|
||||
my $b = abs2rel(rel2abs("."),rel2abs($f));
|
||||
$sourcedir = catdir($b,$sourcedir)
|
||||
if !file_name_is_absolute($sourcedir);
|
||||
$builddir = catdir($b,$builddir)
|
||||
if !file_name_is_absolute($builddir);
|
||||
"";
|
||||
}
|
||||
|
||||
# Because we need to make two computations of these data,
|
||||
@@ -58,6 +50,10 @@
|
||||
grep { !$unified_info{attributes}->{modules}->{$_}->{noinst}
|
||||
&& $unified_info{attributes}->{modules}->{$_}->{engine} }
|
||||
@{$unified_info{modules}};
|
||||
our @install_modules =
|
||||
grep { !$unified_info{attributes}->{modules}->{$_}->{noinst}
|
||||
&& !$unified_info{attributes}->{modules}->{$_}->{engine} }
|
||||
@{$unified_info{modules}};
|
||||
our @install_programs =
|
||||
grep { !$unified_info{attributes}->{programs}->{$_}->{noinst} }
|
||||
@{$unified_info{programs}};
|
||||
@@ -140,6 +136,7 @@ GENERATED={- # common0.tmpl provides @generated
|
||||
INSTALL_LIBS={- join(", ", map { "-\n\t".$_.".OLB" } @install_libs) -}
|
||||
INSTALL_SHLIBS={- join(", ", map { "-\n\t".$_.".EXE" } @install_shlibs) -}
|
||||
INSTALL_ENGINES={- join(", ", map { "-\n\t".$_.".EXE" } @install_engines) -}
|
||||
INSTALL_MODULES={- join(", ", map { "-\n\t".$_.".EXE" } @install_modules) -}
|
||||
INSTALL_PROGRAMS={- join(", ", map { "-\n\t".$_.".EXE" } @install_programs) -}
|
||||
BIN_SCRIPTS={- join(", ", @install_bin_scripts) -}
|
||||
MISC_SCRIPTS={- join(", ", @install_misc_scripts) -}
|
||||
@@ -148,8 +145,8 @@ HTMLDOCS3={- join(", ", map { "-\n\t".$_ } @{$unified_info{htmldocs}->{man3}}) -
|
||||
HTMLDOCS5={- join(", ", map { "-\n\t".$_ } @{$unified_info{htmldocs}->{man5}}) -}
|
||||
HTMLDOCS7={- join(", ", map { "-\n\t".$_ } @{$unified_info{htmldocs}->{man7}}) -}
|
||||
|
||||
APPS_OPENSSL={- use File::Spec::Functions;
|
||||
catfile("apps","openssl") -}
|
||||
APPS_OPENSSL="{- use File::Spec::Functions;
|
||||
catfile("apps","openssl") -}"
|
||||
|
||||
# DESTDIR is for package builders so that they can configure for, say,
|
||||
# SYS$COMMON:[OPENSSL] and yet have everything installed in STAGING:[USER].
|
||||
@@ -359,6 +356,9 @@ CPPFLAGS_Q={- (my $c = $lib_cppflags.$cppflags2.$cppflags1) =~ s|"|""|g;
|
||||
# given with /INCLUDE is a fantasy, unfortunately.
|
||||
NODEBUG=@
|
||||
.FIRST :
|
||||
$(NODEBUG) sourcetop = F$PARSE("$(SRCDIR)","[]A.;",,"SYNTAX_ONLY,NO_CONCEAL") - ".][000000" - "[000000." - "][" - "]A.;" + ".]"
|
||||
$(NODEBUG) DEFINE ossl_sourceroot 'sourcetop'
|
||||
$(NODEBUG) !
|
||||
$(NODEBUG) openssl_inc1 = F$PARSE("[.include.openssl]","A.;",,,"syntax_only") - "A.;"
|
||||
$(NODEBUG) openssl_inc2 = F$PARSE("{- catdir($config{sourcedir},"[.include.openssl]") -}","A.;",,,"SYNTAX_ONLY") - "A.;"
|
||||
$(NODEBUG) internal_inc1 = F$PARSE("[.crypto.include.internal]","A.;",,,"SYNTAX_ONLY") - "A.;"
|
||||
@@ -409,7 +409,7 @@ NODEBUG=@
|
||||
|
||||
# The main targets ###################################################
|
||||
|
||||
{- dependmagic('build_sw'); -} : build_libs_nodep, build_modules_nodep, build_programs_nodep
|
||||
{- dependmagic('build_sw'); -} : build_libs_nodep, build_modules_nodep, build_programs_nodep copy-utils
|
||||
{- dependmagic('build_libs'); -} : build_libs_nodep
|
||||
{- dependmagic('build_modules'); -} : build_modules_nodep
|
||||
{- dependmagic('build_programs'); -} : build_programs_nodep
|
||||
@@ -437,22 +437,14 @@ build_all_generated : $(GENERATED_MANDATORY) $(GENERATED) build_docs
|
||||
all : build_sw build_docs
|
||||
|
||||
test : tests
|
||||
{- dependmagic('tests'); -} : build_programs_nodep, build_modules_nodep
|
||||
{- dependmagic('tests'); -} : build_programs_nodep, build_modules_nodep copy-utils
|
||||
@ ! {- output_off() if $disabled{tests}; "" -}
|
||||
SET DEFAULT [.test]{- move("test") -}
|
||||
CREATE/DIR [.test-runs]
|
||||
DEFINE SRCTOP {- sourcedir() -}
|
||||
DEFINE BLDTOP {- builddir() -}
|
||||
DEFINE RESULT_D {- builddir(qw(test test-runs)) -}
|
||||
DEFINE OPENSSL_ENGINES {- builddir("engines") -}
|
||||
DEFINE OPENSSL_MODULES {- builddir("providers") -}
|
||||
IF "$(VERBOSE)" .NES. "" THEN DEFINE VERBOSE "$(VERBOSE)"
|
||||
$(PERL) {- sourcefile("test", "run_tests.pl") -} $(TESTS)
|
||||
DEASSIGN OPENSSL_MODULES
|
||||
DEASSIGN OPENSSL_ENGINES
|
||||
DEASSIGN BLDTOP
|
||||
DEASSIGN SRCTOP
|
||||
SET DEFAULT [-]{- move("..") -}
|
||||
@ ! {- if ($disabled{tests}) { output_on(); } else { output_off(); } "" -}
|
||||
@ WRITE SYS$OUTPUT "Tests are not supported with your chosen Configure options"
|
||||
@ ! {- output_on() if !$disabled{tests}; "" -}
|
||||
@@ -534,11 +526,11 @@ descrip.mms : FORCE
|
||||
|
||||
# Install helper targets #############################################
|
||||
|
||||
install_sw : install_dev install_engines install_runtime -
|
||||
install_startup install_ivp
|
||||
install_sw : install_dev install_engines install_modules -
|
||||
install_runtime install_startup install_ivp
|
||||
|
||||
uninstall_sw : uninstall_dev uninstall_engines uninstall_runtime -
|
||||
uninstall_startup uninstall_ivp
|
||||
uninstall_sw : uninstall_dev uninstall_modules uninstall_engines -
|
||||
uninstall_runtime uninstall_startup uninstall_ivp
|
||||
|
||||
install_docs : install_html_docs
|
||||
|
||||
@@ -579,13 +571,22 @@ install_dev : check_INSTALLTOP install_runtime_libs
|
||||
|
||||
install_engines : check_INSTALLTOP install_runtime_libs build_modules
|
||||
@ {- output_off() unless scalar @install_engines; "" -} !
|
||||
@ WRITE SYS$OUTPUT "*** Installing ENGINE modules"
|
||||
@ WRITE SYS$OUTPUT "*** Installing engines"
|
||||
- CREATE/DIR ossl_installroot:[ENGINES{- $sover_dirname.$target{pointer_size} -}.'arch']
|
||||
{- join("\n ",
|
||||
map { "COPY/PROT=W:RE $_.EXE ossl_installroot:[ENGINES$sover_dirname$target{pointer_size}.'arch']" }
|
||||
@install_engines) -}
|
||||
@ {- output_on() unless scalar @install_engines; "" -} !
|
||||
|
||||
install_modules : check_INSTALLTOP install_runtime_libs build_modules
|
||||
@ {- output_off() unless scalar @install_modules; "" -} !
|
||||
@ WRITE SYS$OUTPUT "*** Installing modules"
|
||||
- CREATE/DIR ossl_installroot:[MODULES{- $sover_dirname.$target{pointer_size} -}.'arch']
|
||||
{- join("\n ",
|
||||
map { "COPY/PROT=W:RE $_.EXE ossl_installroot:[MODULES$sover_dirname$target{pointer_size}.'arch']" }
|
||||
@install_modules) -}
|
||||
@ {- output_on() unless scalar @install_modules; "" -} !
|
||||
|
||||
install_runtime : install_programs
|
||||
|
||||
install_runtime_libs : check_INSTALLTOP build_libs
|
||||
@@ -696,6 +697,14 @@ check_INSTALLTOP :
|
||||
|
||||
# Helper targets #####################################################
|
||||
|
||||
copy-utils : [.util]wrap.pl
|
||||
|
||||
[.util]wrap.pl : configdata.pm
|
||||
@ IF "$(SRCDIR)" .NES. "$(BLDDIR)" THEN -
|
||||
CREATE/DIR/LOG [.util]
|
||||
@ IF "$(SRCDIR)" .NES. "$(BLDDIR)" THEN -
|
||||
COPY/LOG ossl_sourceroot:[util]wrap.pl [.util]
|
||||
|
||||
# Developer targets ##################################################
|
||||
|
||||
debug_logicals :
|
||||
@@ -782,13 +791,10 @@ reconfigure reconf :
|
||||
if ($args{src} =~ /\.html$/) {
|
||||
my $title = basename($args{src}, ".html");
|
||||
my $pod = $args{generator}->[0];
|
||||
my $mkpod2html = sourcefile('util', 'mkpod2html.pl');
|
||||
return <<"EOF";
|
||||
$args{src}: $pod
|
||||
pipe pod2html "--podroot=\$(SRCDIR)/doc" --htmldir=.. -
|
||||
--podpath=man1:man3:man5:man7 "--infile=$pod" -
|
||||
"--title=$title" -
|
||||
| \$(PERL) -pe "s|href=""http://man\\.he\\.net/(man\d/[^""]+)(?:\\.html)?""|href=""../\$1.html|g;" -
|
||||
> \$\@
|
||||
\$(PERL) $mkpod2html -i $pod -o \$\@ -t "$title" -r "\$(SRCDIR)/doc"
|
||||
EOF
|
||||
} elsif (platform->isdef($args{src})) {
|
||||
my $target = platform->def($args{src});
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#! /usr/bin/env perl
|
||||
# -*- mode: perl; -*-
|
||||
# Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
# Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
#
|
||||
# Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
# this file except in compliance with the License. You can obtain a copy
|
||||
@@ -36,16 +36,10 @@ my %shared_info;
|
||||
(grep /(?:^|\s)-fsanitize/,
|
||||
@{$config{CFLAGS}}, @{$config{cflags}})
|
||||
? ''
|
||||
: '-z defs',
|
||||
: '-Wl,-z,defs',
|
||||
};
|
||||
},
|
||||
'bsd-gcc-shared' => sub { return $shared_info{'linux-shared'}; },
|
||||
'bsd-shared' => sub {
|
||||
return $shared_info{'gnu-shared'} if detect_gnu_ld();
|
||||
return {
|
||||
shared_ldflag => '-shared -nostdlib',
|
||||
};
|
||||
},
|
||||
'darwin-shared' => {
|
||||
module_ldflags => '-bundle',
|
||||
shared_ldflag => '-dynamiclib -current_version $(SHLIB_VERSION_NUMBER) -compatibility_version $(SHLIB_VERSION_NUMBER)',
|
||||
|
||||
@@ -138,6 +138,14 @@ INSTALL_ENGINES={-
|
||||
&& $unified_info{attributes}->{modules}->{$_}->{engine} }
|
||||
@{$unified_info{modules}}))
|
||||
-}
|
||||
INSTALL_MODULES={-
|
||||
join(" \\\n" . ' ' x 16,
|
||||
fill_lines(" ", $COLUMNS - 16,
|
||||
map { platform->dso($_) }
|
||||
grep { !$unified_info{attributes}->{modules}->{$_}->{noinst}
|
||||
&& !$unified_info{attributes}->{modules}->{$_}->{engine} }
|
||||
@{$unified_info{modules}}))
|
||||
-}
|
||||
INSTALL_PROGRAMS={-
|
||||
join(" \\\n" . ' ' x 16,
|
||||
fill_lines(" ", $COLUMNS - 16, map { platform->bin($_) }
|
||||
@@ -195,8 +203,8 @@ MANDOCS7={-
|
||||
fill_lines(" ", $COLUMNS - 9, map { platform->bin($_) }
|
||||
@{$unified_info{mandocs}->{man7}})) -}
|
||||
|
||||
APPS_OPENSSL={- use File::Spec::Functions;
|
||||
catfile("apps","openssl") -}
|
||||
APPS_OPENSSL="{- use File::Spec::Functions;
|
||||
catfile("apps","openssl") -}"
|
||||
|
||||
# DESTDIR is for package builders so that they can configure for, say,
|
||||
# /usr/ and yet have everything installed to /tmp/somedir/usr/.
|
||||
@@ -464,16 +472,11 @@ all: build_sw build_docs
|
||||
test: tests
|
||||
{- dependmagic('tests'); -}: build_programs_nodep build_modules_nodep link-utils
|
||||
@ : {- output_off() if $disabled{tests}; "" -}
|
||||
( cd test; \
|
||||
mkdir -p test-runs; \
|
||||
SRCTOP=../$(SRCDIR) \
|
||||
BLDTOP=../$(BLDDIR) \
|
||||
RESULT_D=test-runs \
|
||||
( SRCTOP=$(SRCDIR) \
|
||||
BLDTOP=$(BLDDIR) \
|
||||
PERL="$(PERL)" \
|
||||
EXE_EXT={- platform->binext() -} \
|
||||
OPENSSL_ENGINES=`cd ../$(BLDDIR)/engines 2>/dev/null && pwd` \
|
||||
OPENSSL_MODULES=`cd ../$(BLDDIR)/providers 2>/dev/null && pwd` \
|
||||
$(PERL) ../$(SRCDIR)/test/run_tests.pl $(TESTS) )
|
||||
$(PERL) $(SRCDIR)/test/run_tests.pl $(TESTS) )
|
||||
@ : {- if ($disabled{tests}) { output_on(); } else { output_off(); } "" -}
|
||||
@echo "Tests are not supported with your chosen Configure options"
|
||||
@ : {- output_on() if !$disabled{tests}; "" -}
|
||||
@@ -516,7 +519,7 @@ clean: libclean
|
||||
-$(RM) `find . -name '*{- platform->depext() -}' \! -name '.*' \! -type d -print`
|
||||
-$(RM) `find . -name '*{- platform->objext() -}' \! -name '.*' \! -type d -print`
|
||||
$(RM) core
|
||||
$(RM) tags TAGS doc-nits cmd-nits
|
||||
$(RM) tags TAGS doc-nits cmd-nits md-nits
|
||||
$(RM) -r test/test-runs
|
||||
$(RM) openssl.pc libcrypto.pc libssl.pc
|
||||
-$(RM) `find . -type l \! -name '.*' -print`
|
||||
@@ -537,9 +540,9 @@ depend:
|
||||
|
||||
# Install helper targets #############################################
|
||||
|
||||
install_sw: install_dev install_engines install_runtime
|
||||
install_sw: install_dev install_engines install_modules install_runtime
|
||||
|
||||
uninstall_sw: uninstall_runtime uninstall_engines uninstall_dev
|
||||
uninstall_sw: uninstall_runtime uninstall_modules uninstall_engines uninstall_dev
|
||||
|
||||
install_docs: install_man_docs install_html_docs
|
||||
|
||||
@@ -707,10 +710,12 @@ uninstall_dev: uninstall_runtime_libs
|
||||
-$(RMDIR) $(DESTDIR)$(libdir)/pkgconfig
|
||||
-$(RMDIR) $(DESTDIR)$(libdir)
|
||||
|
||||
install_engines: install_runtime_libs build_modules
|
||||
_install_modules_deps: install_runtime_libs build_modules
|
||||
|
||||
install_engines: _install_modules_deps
|
||||
@[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1)
|
||||
@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(ENGINESDIR)/
|
||||
@$(ECHO) "*** Installing ENGINE modules"
|
||||
@$(ECHO) "*** Installing engines"
|
||||
@set -e; for e in dummy $(INSTALL_ENGINES); do \
|
||||
if [ "$$e" = "dummy" ]; then continue; fi; \
|
||||
fn=`basename $$e`; \
|
||||
@@ -722,7 +727,7 @@ install_engines: install_runtime_libs build_modules
|
||||
done
|
||||
|
||||
uninstall_engines:
|
||||
@$(ECHO) "*** Uninstalling ENGINE modules"
|
||||
@$(ECHO) "*** Uninstalling engines"
|
||||
@set -e; for e in dummy $(INSTALL_ENGINES); do \
|
||||
if [ "$$e" = "dummy" ]; then continue; fi; \
|
||||
fn=`basename $$e`; \
|
||||
@@ -734,6 +739,33 @@ uninstall_engines:
|
||||
done
|
||||
-$(RMDIR) $(DESTDIR)$(ENGINESDIR)
|
||||
|
||||
install_modules: _install_modules_deps
|
||||
@[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1)
|
||||
@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(MODULESDIR)/
|
||||
@$(ECHO) "*** Installing modules"
|
||||
@set -e; for e in dummy $(INSTALL_MODULES); do \
|
||||
if [ "$$e" = "dummy" ]; then continue; fi; \
|
||||
fn=`basename $$e`; \
|
||||
$(ECHO) "install $$e -> $(DESTDIR)$(MODULESDIR)/$$fn"; \
|
||||
cp $$e $(DESTDIR)$(MODULESDIR)/$$fn.new; \
|
||||
chmod 755 $(DESTDIR)$(MODULESDIR)/$$fn.new; \
|
||||
mv -f $(DESTDIR)$(MODULESDIR)/$$fn.new \
|
||||
$(DESTDIR)$(MODULESDIR)/$$fn; \
|
||||
done
|
||||
|
||||
uninstall_modules:
|
||||
@$(ECHO) "*** Uninstalling modules"
|
||||
@set -e; for e in dummy $(INSTALL_MODULES); do \
|
||||
if [ "$$e" = "dummy" ]; then continue; fi; \
|
||||
fn=`basename $$e`; \
|
||||
if [ "$$fn" = '{- platform->dso("ossltest") -}' ]; then \
|
||||
continue; \
|
||||
fi; \
|
||||
$(ECHO) "$(RM) $(DESTDIR)$(MODULESDIR)/$$fn"; \
|
||||
$(RM) $(DESTDIR)$(MODULESDIR)/$$fn; \
|
||||
done
|
||||
-$(RMDIR) $(DESTDIR)$(MODULESDIR)
|
||||
|
||||
install_runtime: install_programs
|
||||
|
||||
install_runtime_libs: build_libs
|
||||
@@ -827,30 +859,30 @@ install_man_docs: build_man_docs
|
||||
@set -e; for x in dummy $(MANDOCS1); do \
|
||||
if [ "$$x" = "dummy" ]; then continue; fi; \
|
||||
fn=`basename $$x`; \
|
||||
$(ECHO) "install $$x -> $(DESTDIR)$(MANDIR)/man1/$$fn"; \
|
||||
cp $$x $(DESTDIR)$(MANDIR)/man1/$$fn$(MANSUFFIX); \
|
||||
chmod 755 $(DESTDIR)$(MANDIR)/man1/$$fn$(MANSUFFIX); \
|
||||
$(ECHO) "install $$x -> $(DESTDIR)$(MANDIR)/man1/$${fn}$(MANSUFFIX)"; \
|
||||
cp $$x $(DESTDIR)$(MANDIR)/man1/$${fn}$(MANSUFFIX); \
|
||||
chmod 755 $(DESTDIR)$(MANDIR)/man1/$${fn}$(MANSUFFIX); \
|
||||
done
|
||||
@set -e; for x in dummy $(MANDOCS3); do \
|
||||
if [ "$$x" = "dummy" ]; then continue; fi; \
|
||||
fn=`basename $$x`; \
|
||||
$(ECHO) "install $$x -> $(DESTDIR)$(MANDIR)/man3/$$fn"; \
|
||||
cp $$x $(DESTDIR)$(MANDIR)/man3/$$fn$(MANSUFFIX); \
|
||||
chmod 755 $(DESTDIR)$(MANDIR)/man3/$$fn$(MANSUFFIX); \
|
||||
$(ECHO) "install $$x -> $(DESTDIR)$(MANDIR)/man3/$${fn}$(MANSUFFIX)"; \
|
||||
cp $$x $(DESTDIR)$(MANDIR)/man3/$${fn}$(MANSUFFIX); \
|
||||
chmod 755 $(DESTDIR)$(MANDIR)/man3/$${fn}$(MANSUFFIX); \
|
||||
done
|
||||
@set -e; for x in dummy $(MANDOCS5); do \
|
||||
if [ "$$x" = "dummy" ]; then continue; fi; \
|
||||
fn=`basename $$x`; \
|
||||
$(ECHO) "install $$x -> $(DESTDIR)$(MANDIR)/man5/$$fn"; \
|
||||
cp $$x $(DESTDIR)$(MANDIR)/man5/$$fn$(MANSUFFIX); \
|
||||
chmod 755 $(DESTDIR)$(MANDIR)/man5/$$fn$(MANSUFFIX); \
|
||||
$(ECHO) "install $$x -> $(DESTDIR)$(MANDIR)/man5/$${fn}$(MANSUFFIX)"; \
|
||||
cp $$x $(DESTDIR)$(MANDIR)/man5/$${fn}$(MANSUFFIX); \
|
||||
chmod 755 $(DESTDIR)$(MANDIR)/man5/$${fn}$(MANSUFFIX); \
|
||||
done
|
||||
@set -e; for x in dummy $(MANDOCS7); do \
|
||||
if [ "$$x" = "dummy" ]; then continue; fi; \
|
||||
fn=`basename $$x`; \
|
||||
$(ECHO) "install $$x -> $(DESTDIR)$(MANDIR)/man7/$$fn"; \
|
||||
cp $$x $(DESTDIR)$(MANDIR)/man7/$$fn$(MANSUFFIX); \
|
||||
chmod 755 $(DESTDIR)$(MANDIR)/man7/$$fn$(MANSUFFIX); \
|
||||
$(ECHO) "install $$x -> $(DESTDIR)$(MANDIR)/man7/$${fn}$(MANSUFFIX)"; \
|
||||
cp $$x $(DESTDIR)$(MANDIR)/man7/$${fn}$(MANSUFFIX); \
|
||||
chmod 755 $(DESTDIR)$(MANDIR)/man7/$${fn}$(MANSUFFIX); \
|
||||
done
|
||||
|
||||
uninstall_man_docs:
|
||||
@@ -858,26 +890,26 @@ uninstall_man_docs:
|
||||
@set -e; for x in dummy $(MANDOCS1); do \
|
||||
if [ "$$x" = "dummy" ]; then continue; fi; \
|
||||
fn=`basename $$x`; \
|
||||
$(ECHO) "$(RM) $(DESTDIR)$(MANDIR)/man1/$$fn"; \
|
||||
$(RM) $(DESTDIR)$(MANDIR)/man1/$$fn$(MANSUFFIX); \
|
||||
$(ECHO) "$(RM) $(DESTDIR)$(MANDIR)/man1/$${fn}$(MANSUFFIX)"; \
|
||||
$(RM) $(DESTDIR)$(MANDIR)/man1/$${fn}$(MANSUFFIX); \
|
||||
done
|
||||
@set -e; for x in dummy $(MANDOCS3); do \
|
||||
if [ "$$x" = "dummy" ]; then continue; fi; \
|
||||
fn=`basename $$x`; \
|
||||
$(ECHO) "$(RM) $(DESTDIR)$(MANDIR)/man3/$$fn"; \
|
||||
$(RM) $(DESTDIR)$(MANDIR)/man3/$$fn$(MANSUFFIX); \
|
||||
$(ECHO) "$(RM) $(DESTDIR)$(MANDIR)/man3/$${fn}$(MANSUFFIX)"; \
|
||||
$(RM) $(DESTDIR)$(MANDIR)/man3/$${fn}$(MANSUFFIX); \
|
||||
done
|
||||
@set -e; for x in dummy $(MANDOCS5); do \
|
||||
if [ "$$x" = "dummy" ]; then continue; fi; \
|
||||
fn=`basename $$x`; \
|
||||
$(ECHO) "$(RM) $(DESTDIR)$(MANDIR)/man5/$$fn"; \
|
||||
$(RM) $(DESTDIR)$(MANDIR)/man5/$$fn$(MANSUFFIX); \
|
||||
$(ECHO) "$(RM) $(DESTDIR)$(MANDIR)/man5/$${fn}$(MANSUFFIX)"; \
|
||||
$(RM) $(DESTDIR)$(MANDIR)/man5/$${fn}$(MANSUFFIX); \
|
||||
done
|
||||
@set -e; for x in dummy $(MANDOCS7); do \
|
||||
if [ "$$x" = "dummy" ]; then continue; fi; \
|
||||
fn=`basename $$x`; \
|
||||
$(ECHO) "$(RM) $(DESTDIR)$(MANDIR)/man7/$$fn"; \
|
||||
$(RM) $(DESTDIR)$(MANDIR)/man7/$$fn$(MANSUFFIX); \
|
||||
$(ECHO) "$(RM) $(DESTDIR)$(MANDIR)/man7/$${fn}$(MANSUFFIX)"; \
|
||||
$(RM) $(DESTDIR)$(MANDIR)/man7/$${fn}$(MANSUFFIX); \
|
||||
done
|
||||
|
||||
install_html_docs: build_html_docs
|
||||
@@ -950,12 +982,21 @@ update: generate errors ordinals
|
||||
generate: generate_apps generate_crypto_bn generate_crypto_objects \
|
||||
generate_crypto_conf generate_crypto_asn1 generate_fuzz_oids
|
||||
|
||||
.PHONY: doc-nits cmd-nits
|
||||
.PHONY: doc-nits cmd-nits md-nits
|
||||
doc-nits: build_generated
|
||||
(cd $(SRCDIR); $(PERL) util/find-doc-nits -n -l -e )
|
||||
$(PERL) $(SRCDIR)/util/find-doc-nits -n -l -e
|
||||
|
||||
cmd-nits: build_generated apps/openssl
|
||||
(cd $(SRCDIR); $(PERL) util/find-doc-nits -c )
|
||||
$(PERL) $(SRCDIR)/util/find-doc-nits -c
|
||||
|
||||
# This uses "mdl", the markdownlint application, which is written in ruby.
|
||||
# The source is at https://github.com/markdownlint/markdownlint
|
||||
# If you have ruby installed, "gem install mdl" should work.
|
||||
# Another option is at https://snapcraft.io/install/mdl/debian
|
||||
# Finally, there's a Node.js version, which we haven't tried, that
|
||||
# can be found at https://github.com/DavidAnson/markdownlint
|
||||
md-nits:
|
||||
mdl -s util/markdownlint.rb .
|
||||
|
||||
# Test coverage is a good idea for the future
|
||||
#coverage: $(PROGRAMS) $(TESTPROGRAMS)
|
||||
@@ -967,12 +1008,6 @@ lint:
|
||||
generate_apps:
|
||||
( cd $(SRCDIR); $(PERL) VMS/VMSify-conf.pl \
|
||||
< apps/openssl.cnf > apps/openssl-vms.cnf )
|
||||
@ : {- output_off() if $disabled{apps}; "" -}
|
||||
( b=`pwd`; cd $(SRCDIR); \
|
||||
$(PERL) -I$$b apps/progs.pl -H $(APPS_OPENSSL) > apps/progs.h )
|
||||
( b=`pwd`; cd $(SRCDIR); \
|
||||
$(PERL) -I$$b apps/progs.pl -C $(APPS_OPENSSL) > apps/progs.c )
|
||||
@ : {- output_on() if $disabled{apps}; "" -}
|
||||
|
||||
generate_crypto_bn:
|
||||
( cd $(SRCDIR); $(PERL) crypto/bn/bn_prime.pl > crypto/bn/bn_prime.h )
|
||||
@@ -994,6 +1029,7 @@ generate_crypto_objects:
|
||||
crypto/objects/obj_mac.num \
|
||||
crypto/objects/obj_xref.txt \
|
||||
> crypto/objects/obj_xref.h )
|
||||
( cd $(SRCDIR); cat crypto/objects/obj_compat.h >> include/openssl/obj_mac.h )
|
||||
|
||||
generate_crypto_conf:
|
||||
( cd $(SRCDIR); $(PERL) crypto/conf/keysets.pl \
|
||||
@@ -1036,6 +1072,7 @@ errors:
|
||||
qw( include/internal/dso.h
|
||||
include/internal/o_dir.h
|
||||
include/internal/err.h
|
||||
include/internal/evp.h
|
||||
include/internal/sslconf.h );
|
||||
our @cryptoskipheaders = ( @sslheaders,
|
||||
qw( include/openssl/conf_api.h
|
||||
@@ -1083,12 +1120,12 @@ tar:
|
||||
|
||||
# Helper targets #####################################################
|
||||
|
||||
link-utils: $(BLDDIR)/util/opensslwrap.sh
|
||||
link-utils: $(BLDDIR)/util/opensslwrap.sh $(BLDDIR)/util/wrap.pl
|
||||
|
||||
$(BLDDIR)/util/opensslwrap.sh: configdata.pm
|
||||
$(BLDDIR)/util/opensslwrap.sh $(BLDDIR)/util/wrap.pl: configdata.pm
|
||||
@if [ "$(SRCDIR)" != "$(BLDDIR)" ]; then \
|
||||
mkdir -p "$(BLDDIR)/util"; \
|
||||
ln -sf "../$(SRCDIR)/util/opensslwrap.sh" "$(BLDDIR)/util"; \
|
||||
ln -sf "../$(SRCDIR)/util/`basename "$@"`" "$(BLDDIR)/util"; \
|
||||
fi
|
||||
|
||||
FORCE:
|
||||
@@ -1190,10 +1227,7 @@ reconfigure reconf:
|
||||
my $pod = $args{generator}->[0];
|
||||
return <<"EOF";
|
||||
$args{src}: $pod
|
||||
pod2html "--podroot=\$(SRCDIR)/doc" --htmldir=.. \\
|
||||
--podpath=man1:man3:man5:man7 --infile=$pod "--title=$title" \\
|
||||
| \$(PERL) -pe 's|href="http://man\\.he\\.net/(man\\d/[^"]+)(?:\\.html)?"|href="../\$1.html|g;' \\
|
||||
> \$\@
|
||||
\$(PERL) \$(SRCDIR)/util/mkpod2html.pl -i "$pod" -o \$\@ -t "$title" -r "\$(SRCDIR)/doc"
|
||||
EOF
|
||||
} elsif ($args{src} =~ /\.(\d)$/) {
|
||||
my $section = $1;
|
||||
@@ -1202,8 +1236,7 @@ EOF
|
||||
return <<"EOF";
|
||||
$args{src}: $pod
|
||||
pod2man --name=$name --section=$section --center=OpenSSL \\
|
||||
--release=\$(VERSION) $pod \\
|
||||
> \$\@
|
||||
--release=\$(VERSION) $pod >\$\@
|
||||
EOF
|
||||
} elsif (platform->isdef($args{src})) {
|
||||
my $target = platform->def($args{src});
|
||||
@@ -1244,7 +1277,7 @@ EOF
|
||||
|
||||
if ($args{generator}->[0] =~ /\.pl$/) {
|
||||
$generator = 'CC="$(CC)" $(PERL)'.$generator_incs.' '.$generator
|
||||
.' "$(PERLASM_SCHEME)"'.$incs.' '.$cppflags.$defs.' $(PROCESSSOR)';
|
||||
.' "$(PERLASM_SCHEME)"'.$incs.' '.$cppflags.$defs.' $(PROCESSOR)';
|
||||
} elsif ($args{generator}->[0] =~ /\.m4$/) {
|
||||
$generator = 'm4 -B 8192'.$generator_incs.' '.$generator.' >'
|
||||
} elsif ($args{generator}->[0] =~ /\.S$/) {
|
||||
|
||||
@@ -47,19 +47,22 @@ SHLIB_VERSION_NUMBER={- $config{shlib_version} -}
|
||||
LIBS={- join(" ", map { ( platform->sharedlib_import($_), platform->staticlib($_) ) } @{$unified_info{libraries}}) -}
|
||||
SHLIBS={- join(" ", map { platform->sharedlib($_) // () } @{$unified_info{libraries}}) -}
|
||||
SHLIBPDBS={- join(" ", map { platform->sharedlibpdb($_) // () } @{$unified_info{libraries}}) -}
|
||||
MODULES={- join(" ", map { platform->dso($_) } @{$unified_info{modules}}) -}
|
||||
MODULES={- our @MODULES = map { platform->dso($_) } @{$unified_info{modules}};
|
||||
join(" ", @MODULES) -}
|
||||
MODULEPDBS={- join(" ", map { platform->dsopdb($_) } @{$unified_info{modules}}) -}
|
||||
PROGRAMS={- our @PROGRAMS = map { platform->bin($_) } @{$unified_info{programs}}; join(" ", @PROGRAMS) -}
|
||||
PROGRAMPDBS={- join(" ", map { $_.".pdb" } @{$unified_info{programs}}) -}
|
||||
SCRIPTS={- join(" ", @{$unified_info{scripts}}) -}
|
||||
SCRIPTS={- our @SCRIPTS = @{$unified_info{scripts}}; join(" ", @SCRIPTS) -}
|
||||
{- output_off() if $disabled{makedepend}; "" -}
|
||||
DEPS={- join(" ", map { platform->isobj($_) ? platform->dep($_) : () }
|
||||
grep { $unified_info{sources}->{$_}->[0] =~ /\.c$/ }
|
||||
keys %{$unified_info{sources}}); -}
|
||||
{- output_on() if $disabled{makedepend}; "" -}
|
||||
GENERATED_MANDATORY={- join(" ", @{$unified_info{depends}->{""}} ) -}
|
||||
GENERATED_MANDATORY={- our @GENERATED_MANDATORY = @{$unified_info{depends}->{""}};
|
||||
join(" ", @GENERATED_MANDATORY) -}
|
||||
GENERATED={- # common0.tmpl provides @generated
|
||||
join(" ", map { platform->convertext($_) } @generated) -}
|
||||
our @GENERATED = map { platform->convertext($_) } @generated;
|
||||
join(" ", @GENERATED) -}
|
||||
|
||||
INSTALL_LIBS={-
|
||||
join(" ", map { quotify1(platform->sharedlib_import($_)
|
||||
@@ -91,6 +94,18 @@ INSTALL_ENGINEPDBS={-
|
||||
&& $unified_info{attributes}->{modules}->{$_}->{engine} }
|
||||
@{$unified_info{modules}})
|
||||
-}
|
||||
INSTALL_MODULES={-
|
||||
join(" ", map { platform->dso($_) }
|
||||
grep { !$unified_info{attributes}->{modules}->{$_}->{noinst}
|
||||
&& !$unified_info{attributes}->{modules}->{$_}->{engine} }
|
||||
@{$unified_info{modules}})
|
||||
-}
|
||||
INSTALL_MODULEPDBS={-
|
||||
join(" ", map { quotify1(platform->dsopdb($_)) }
|
||||
grep { !$unified_info{attributes}->{modules}->{$_}->{noinst}
|
||||
&& !$unified_info{attributes}->{modules}->{$_}->{engine} }
|
||||
@{$unified_info{modules}})
|
||||
-}
|
||||
INSTALL_PROGRAMS={-
|
||||
join(" ", map { quotify1(platform->bin($_)) }
|
||||
grep { !$unified_info{attributes}->{programs}->{$_}->{noinst} }
|
||||
@@ -130,8 +145,8 @@ HTMLDOCS5_BLDDIRS={- my %dirs = map { dirname($_) => 1 } @HTMLDOCS5;
|
||||
HTMLDOCS7_BLDDIRS={- my %dirs = map { dirname($_) => 1 } @HTMLDOCS7;
|
||||
join(' ', sort keys %dirs) -}
|
||||
|
||||
APPS_OPENSSL={- use File::Spec::Functions;
|
||||
"\"".catfile("apps","openssl")."\"" -}
|
||||
APPS_OPENSSL="{- use File::Spec::Functions;
|
||||
catfile("apps","openssl") -}"
|
||||
|
||||
# Do not edit these manually. Use Configure with --prefix or --openssldir
|
||||
# to change this! Short explanation in the top comment in Configure
|
||||
@@ -357,7 +372,7 @@ PROCESSOR= {- $config{processor} -}
|
||||
|
||||
# The main targets ###################################################
|
||||
|
||||
{- dependmagic('build_sw'); -}: build_libs_nodep build_modules_nodep build_programs_nodep
|
||||
{- dependmagic('build_sw'); -}: build_libs_nodep build_modules_nodep build_programs_nodep copy-utils
|
||||
{- dependmagic('build_libs'); -}: build_libs_nodep
|
||||
{- dependmagic('build_modules'); -}: build_modules_nodep
|
||||
{- dependmagic('build_programs'); -}: build_programs_nodep
|
||||
@@ -385,15 +400,11 @@ build_all_generated: $(GENERATED_MANDATORY) $(GENERATED) build_docs
|
||||
all: build_sw build_docs
|
||||
|
||||
test: tests
|
||||
{- dependmagic('tests'); -}: build_programs_nodep build_modules_nodep
|
||||
{- dependmagic('tests'); -}: build_programs_nodep build_modules_nodep copy-utils
|
||||
@{- output_off() if $disabled{tests}; "" -}
|
||||
-mkdir $(BLDDIR)\test\test-runs
|
||||
set SRCTOP=$(SRCDIR)
|
||||
set BLDTOP=$(BLDDIR)
|
||||
set RESULT_D=$(BLDDIR)\test\test-runs
|
||||
set PERL=$(PERL)
|
||||
set OPENSSL_ENGINES=$(MAKEDIR)\engines
|
||||
set OPENSSL_MODULES=$(MAKEDIR)\providers
|
||||
"$(PERL)" "$(SRCDIR)\test\run_tests.pl" $(TESTS)
|
||||
@{- if ($disabled{tests}) { output_on(); } else { output_off(); } "" -}
|
||||
@$(ECHO) "Tests are not supported with your chosen Configure options"
|
||||
@@ -421,10 +432,10 @@ clean: libclean
|
||||
-rmdir /Q /S $(HTMLDOCS5_BLDDIRS)
|
||||
-rmdir /Q /S $(HTMLDOCS7_BLDDIRS)
|
||||
{- join("\n\t", map { "-del /Q /F $_" } @PROGRAMS) -}
|
||||
-del /Q /F $(MODULES)
|
||||
-del /Q /F $(SCRIPTS)
|
||||
-del /Q /F $(GENERATED_MANDATORY)
|
||||
-del /Q /F $(GENERATED)
|
||||
{- join("\n\t", map { "-del /Q /F $_" } @MODULES) -}
|
||||
{- join("\n\t", map { "-del /Q /F $_" } @SCRIPTS) -}
|
||||
{- join("\n\t", map { "-del /Q /F $_" } @GENERATED_MANDATORY) -}
|
||||
{- join("\n\t", map { "-del /Q /F $_" } @GENERATED) -}
|
||||
-del /Q /S /F *.d *.obj *.pdb *.ilk *.manifest
|
||||
-del /Q /S /F engines\*.lib engines\*.exp
|
||||
-del /Q /S /F apps\*.lib apps\*.rc apps\*.res apps\*.exp
|
||||
@@ -442,9 +453,9 @@ depend:
|
||||
|
||||
# Install helper targets #############################################
|
||||
|
||||
install_sw: install_dev install_engines install_runtime
|
||||
install_sw: install_dev install_engines install_modules install_runtime
|
||||
|
||||
uninstall_sw: uninstall_runtime uninstall_engines uninstall_dev
|
||||
uninstall_sw: uninstall_runtime uninstall_modules uninstall_engines uninstall_dev
|
||||
|
||||
install_docs: install_html_docs
|
||||
|
||||
@@ -488,9 +499,11 @@ install_dev: install_runtime_libs
|
||||
|
||||
uninstall_dev:
|
||||
|
||||
install_engines: install_runtime_libs build_modules
|
||||
_install_modules_deps: install_runtime_libs build_modules
|
||||
|
||||
install_engines: _install_modules_deps
|
||||
@if "$(INSTALLTOP)"=="" ( $(ECHO) "INSTALLTOP should not be empty" & exit 1 )
|
||||
@$(ECHO) "*** Installing ENGINE modules"
|
||||
@$(ECHO) "*** Installing engines"
|
||||
@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(ENGINESDIR)"
|
||||
@if not "$(INSTALL_ENGINES)"=="" \
|
||||
"$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_ENGINES) "$(ENGINESDIR)"
|
||||
@@ -499,6 +512,17 @@ install_engines: install_runtime_libs build_modules
|
||||
|
||||
uninstall_engines:
|
||||
|
||||
install_modules: _install_modules_deps
|
||||
@if "$(INSTALLTOP)"=="" ( $(ECHO) "INSTALLTOP should not be empty" & exit 1 )
|
||||
@$(ECHO) "*** Installing modules"
|
||||
@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(MODULESDIR)"
|
||||
@if not "$(INSTALL_MODULES)"=="" \
|
||||
"$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_MODULES) "$(MODULESDIR)"
|
||||
@if not "$(INSTALL_MODULES)"=="" \
|
||||
"$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_MODULEPDBS) "$(MODULESDIR)"
|
||||
|
||||
uninstall_modules:
|
||||
|
||||
install_runtime: install_programs
|
||||
|
||||
install_runtime_libs: build_libs
|
||||
@@ -546,6 +570,14 @@ install_html_docs: build_html_docs
|
||||
|
||||
uninstall_html_docs:
|
||||
|
||||
# Helper targets #####################################################
|
||||
|
||||
copy-utils: $(BLDDIR)\util\wrap.pl
|
||||
|
||||
$(BLDDIR)\util\wrap.pl: configdata.pm
|
||||
@if NOT EXIST "$(BLDDIR)\util" mkdir "$(BLDDIR)\util"
|
||||
@if NOT "$(SRCDIR)"=="$(BLDDIR)" copy "$(SRCDIR)\util\$(@F)" "$(BLDDIR)\util"
|
||||
|
||||
# Building targets ###################################################
|
||||
|
||||
configdata.pm: "$(SRCDIR)\Configure" {- join(" ", map { '"'.$_.'"' } @{$config{build_file_templates}}, @{$config{build_infos}}, @{$config{conf_files}}) -}
|
||||
@@ -589,10 +621,7 @@ reconfigure reconf:
|
||||
my $pod = $args{generator}->[0];
|
||||
return <<"EOF";
|
||||
$args{src}: "$pod"
|
||||
pod2html "--podroot=\$(SRCDIR)/doc" --htmldir=.. \\
|
||||
--podpath=man1:man3:man5:man7 "--infile=$pod" "--title=$title" \\
|
||||
| \$(PERL) -pe ^"s^|href=\\^"http://man\\.he\\.net/^(man\\d/[^^\\^"]+^)^(?:\.html^)?^"^|href=\\^"../\$\$1.html^|g;^" \\
|
||||
> \$\@
|
||||
\$(PERL) \$(SRCDIR)/util/mkpod2html.pl -i "$pod" -o \$\@ -t "$title" -r "\$(SRCDIR)/doc"
|
||||
EOF
|
||||
} elsif (platform->isdef($args{src})) {
|
||||
my $target = platform->def($args{src});
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#! /usr/bin/env perl
|
||||
# -*- mode: perl; -*-
|
||||
# Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
# Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
#
|
||||
# Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
# this file except in compliance with the License. You can obtain a copy
|
||||
@@ -21,7 +21,7 @@ use OpenSSL::fallback "$FindBin::Bin/external/perl/MODULES.txt";
|
||||
use OpenSSL::Glob;
|
||||
use OpenSSL::Template;
|
||||
|
||||
# see INSTALL for instructions.
|
||||
# see INSTALL.md for instructions.
|
||||
|
||||
my $orig_death_handler = $SIG{__DIE__};
|
||||
$SIG{__DIE__} = \&death_handler;
|
||||
@@ -265,6 +265,19 @@ if (grep /^reconf(igure)?$/, @argvcopy) {
|
||||
|
||||
$config{perlargv} = [ @argvcopy ];
|
||||
|
||||
# Historical: if known directories in crypto/ have been removed, it means
|
||||
# that those sub-systems are disabled.
|
||||
# (the other option would be to removed them from the SUBDIRS statement in
|
||||
# crypto/build.info)
|
||||
# We reverse the input list for cosmetic purely reasons, to compensate that
|
||||
# 'unshift' adds at the front of the list (i.e. in reverse input order).
|
||||
foreach ( reverse sort( 'aes', 'aria', 'bf', 'camellia', 'cast', 'des', 'dh',
|
||||
'dsa', 'ec', 'hmac', 'idea', 'md2', 'md5', 'mdc2',
|
||||
'rc2', 'rc4', 'rc5', 'ripemd', 'rsa', 'seed', 'sha',
|
||||
'sm2', 'sm3', 'sm4') ) {
|
||||
unshift @argvcopy, "no-$_" if ! -d catdir($srcdir, 'crypto', $_);
|
||||
}
|
||||
|
||||
# Collect version numbers
|
||||
my %version = ();
|
||||
|
||||
@@ -273,7 +286,13 @@ collect_information(
|
||||
qr/\s*(\w+)\s*=\s*(.*?)\s*$/ =>
|
||||
sub {
|
||||
# Only define it if there is a value at all
|
||||
$version{uc $1} = $2 if $2 ne '';
|
||||
if ($2 ne '') {
|
||||
my $k = $1;
|
||||
my $v = $2;
|
||||
# Some values are quoted. Trim the quotes
|
||||
$v = $1 if $v =~ /^"(.*)"$/;
|
||||
$version{uc $k} = $v;
|
||||
}
|
||||
},
|
||||
"OTHERWISE" =>
|
||||
sub { die "Something wrong with this line:\n$_\nin $srcdir/VERSION" },
|
||||
@@ -404,6 +423,7 @@ my @disablables = (
|
||||
"poly1305",
|
||||
"posix-io",
|
||||
"psk",
|
||||
"quic",
|
||||
"rc2",
|
||||
"rc4",
|
||||
"rc5",
|
||||
@@ -412,6 +432,7 @@ my @disablables = (
|
||||
"rmd160",
|
||||
"scrypt",
|
||||
"sctp",
|
||||
"secure-memory",
|
||||
"seed",
|
||||
"shared",
|
||||
"siphash",
|
||||
@@ -504,7 +525,7 @@ my @disable_cascades = (
|
||||
"ssl3-method" => [ "ssl3" ],
|
||||
"zlib" => [ "zlib-dynamic" ],
|
||||
"des" => [ "mdc2" ],
|
||||
"ec" => [ "ecdsa", "ecdh", "sm2" ],
|
||||
"ec" => [ "ecdsa", "ecdh", "sm2", "gost" ],
|
||||
sub { $disabled{"ec"} && $disabled{"dh"} }
|
||||
=> [ "tls1_3" ],
|
||||
"dgram" => [ "dtls", "sctp" ],
|
||||
@@ -559,6 +580,7 @@ my @disable_cascades = (
|
||||
"legacy" => [ "md2" ],
|
||||
|
||||
"cmp" => [ "crmf" ],
|
||||
"tls1_3" => [ "quic" ],
|
||||
|
||||
# Padlock engine uses low-level AES APIs which are deprecated
|
||||
sub { $disabled{"deprecated-3.0"} }
|
||||
@@ -1104,6 +1126,9 @@ if (scalar(@seed_sources) == 0) {
|
||||
print "Using os-specific seed configuration\n";
|
||||
push @seed_sources, 'os';
|
||||
}
|
||||
if (scalar(grep { $_ eq 'egd' } @seed_sources) > 0) {
|
||||
delete $disabled{'egd'};
|
||||
}
|
||||
if (scalar(grep { $_ eq 'none' } @seed_sources) > 0) {
|
||||
die "Cannot seed with none and anything else" if scalar(@seed_sources) > 1;
|
||||
warn <<_____ if scalar(@seed_sources) == 1;
|
||||
@@ -1116,7 +1141,8 @@ will not work unless the random generator is seeded manually by the
|
||||
application.
|
||||
|
||||
Please read the 'Note on random number generation' section in the
|
||||
INSTALL instructions and the RAND_DRBG(7) manual page for more details.
|
||||
INSTALL.md instructions and the RAND_DRBG(7) manual page for more
|
||||
details.
|
||||
============================== WARNING ===============================
|
||||
|
||||
_____
|
||||
@@ -1806,23 +1832,56 @@ if ($builder eq "unified") {
|
||||
# contains a dollar sign, it had better be escaped, or it will be
|
||||
# taken for a variable name prefix.
|
||||
my %variables = ();
|
||||
my $variable_re = qr/\$(?P<VARIABLE>[[:alpha:]][[:alnum:]_]*)/;
|
||||
# Variable name syntax
|
||||
my $variable_name_re = qr/(?P<VARIABLE>[[:alpha:]][[:alnum:]_]*)/;
|
||||
# Value modifier syntaxes
|
||||
my $variable_subst_re = qr/\/(?P<RE>(?:\\\/|.)*?)\/(?P<SUBST>.*?)/;
|
||||
# Variable reference
|
||||
my $variable_simple_re = qr/(?<!\\)\$${variable_name_re}/;
|
||||
my $variable_w_mod_re =
|
||||
qr/(?<!\\)\$\{${variable_name_re}(?P<MOD>(?:\\\/|.)*?)\}/;
|
||||
# Tie it all together
|
||||
my $variable_re = qr/${variable_simple_re}|${variable_w_mod_re}/;
|
||||
|
||||
my $expand_variables = sub {
|
||||
my $value = '';
|
||||
my $value_rest = shift;
|
||||
|
||||
if ($ENV{CONFIGURE_DEBUG_VARIABLE_EXPAND}) {
|
||||
print STDERR
|
||||
"DEBUG[\$expand_variables] Parsed '$value_rest' into:\n"
|
||||
"DEBUG[\$expand_variables] Parsed '$value_rest' ...\n"
|
||||
}
|
||||
while ($value_rest =~ /(?<!\\)${variable_re}/) {
|
||||
$value .= $`;
|
||||
$value .= $variables{$+{VARIABLE}};
|
||||
|
||||
while ($value_rest =~ /${variable_re}/) {
|
||||
# We must save important regexp values, because the next
|
||||
# regexp clears them
|
||||
my $mod = $+{MOD};
|
||||
my $variable_value = $variables{$+{VARIABLE}};
|
||||
|
||||
$value_rest = $';
|
||||
$value .= $`;
|
||||
|
||||
# Process modifier expressions, if present
|
||||
if (defined $mod) {
|
||||
if ($mod =~ /^${variable_subst_re}$/) {
|
||||
my $re = $+{RE};
|
||||
my $subst = $+{SUBST};
|
||||
|
||||
$variable_value =~ s/\Q$re\E/$subst/g;
|
||||
|
||||
if ($ENV{CONFIGURE_DEBUG_VARIABLE_EXPAND}) {
|
||||
print STDERR
|
||||
"DEBUG[\$expand_variables] ... and substituted ",
|
||||
"'$re' with '$subst'\n";
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
$value .= $variable_value;
|
||||
}
|
||||
if ($ENV{CONFIGURE_DEBUG_VARIABLE_EXPAND}) {
|
||||
print STDERR
|
||||
"DEBUG[\$expand_variables] ... '$value$value_rest'\n";
|
||||
"DEBUG[\$expand_variables] ... into: '$value$value_rest'\n";
|
||||
}
|
||||
return $value . $value_rest;
|
||||
};
|
||||
@@ -1856,6 +1915,34 @@ if ($builder eq "unified") {
|
||||
}
|
||||
};
|
||||
|
||||
# Support for pushing values on multiple indexes of a given hash
|
||||
# array.
|
||||
my $push_to = sub {
|
||||
my $valueref = shift;
|
||||
my $index_str = shift; # May be undef or empty
|
||||
my $attrref = shift; # May be undef
|
||||
my $attr_str = shift;
|
||||
my @values = @_;
|
||||
|
||||
if (defined $index_str) {
|
||||
my @indexes = ( '' );
|
||||
if ($index_str !~ m|^\s*$|) {
|
||||
@indexes = tokenize($index_str);
|
||||
}
|
||||
foreach (@indexes) {
|
||||
push @{$valueref->{$_}}, @values;
|
||||
if (defined $attrref) {
|
||||
$handle_attributes->($attr_str, \$$attrref->{$_},
|
||||
@values);
|
||||
}
|
||||
}
|
||||
} else {
|
||||
push @$valueref, @values;
|
||||
$handle_attributes->($attr_str, $attrref, @values)
|
||||
if defined $attrref;
|
||||
}
|
||||
};
|
||||
|
||||
# We want to detect configdata.pm in the source tree, so we
|
||||
# don't use it if the build tree is different.
|
||||
my $src_configdata = cleanfile($srcdir, "configdata.pm", $blddir);
|
||||
@@ -1936,88 +2023,64 @@ if ($builder eq "unified") {
|
||||
}
|
||||
},
|
||||
qr/^\s* PROGRAMS ${attribs_re} \s* = ${value_re} $/x
|
||||
=> sub {
|
||||
if (!@skip || $skip[$#skip] > 0) {
|
||||
my @p = tokenize($expand_variables->($+{VALUE}));
|
||||
push @programs, @p;
|
||||
$handle_attributes->($+{ATTRIBS},
|
||||
\$attributes{programs},
|
||||
@p);
|
||||
}
|
||||
},
|
||||
=> sub { $push_to->(\@programs, undef,
|
||||
\$attributes{programs}, $+{ATTRIBS},
|
||||
tokenize($expand_variables->($+{VALUE})))
|
||||
if !@skip || $skip[$#skip] > 0; },
|
||||
qr/^\s* LIBS ${attribs_re} \s* = ${value_re} $/x
|
||||
=> sub {
|
||||
if (!@skip || $skip[$#skip] > 0) {
|
||||
my @l = tokenize($expand_variables->($+{VALUE}));
|
||||
push @libraries, @l;
|
||||
$handle_attributes->($+{ATTRIBS},
|
||||
\$attributes{libraries},
|
||||
@l);
|
||||
}
|
||||
},
|
||||
=> sub { $push_to->(\@libraries, undef,
|
||||
\$attributes{libraries}, $+{ATTRIBS},
|
||||
tokenize($expand_variables->($+{VALUE})))
|
||||
if !@skip || $skip[$#skip] > 0; },
|
||||
qr/^\s* MODULES ${attribs_re} \s* = ${value_re} $/x
|
||||
=> sub {
|
||||
if (!@skip || $skip[$#skip] > 0) {
|
||||
my @m = tokenize($expand_variables->($+{VALUE}));
|
||||
push @modules, @m;
|
||||
$handle_attributes->($+{ATTRIBS},
|
||||
\$attributes{modules},
|
||||
@m);
|
||||
}
|
||||
},
|
||||
=> sub { $push_to->(\@modules, undef,
|
||||
\$attributes{modules}, $+{ATTRIBS},
|
||||
tokenize($expand_variables->($+{VALUE})))
|
||||
if !@skip || $skip[$#skip] > 0; },
|
||||
qr/^\s* SCRIPTS ${attribs_re} \s* = ${value_re} $/x
|
||||
=> sub {
|
||||
if (!@skip || $skip[$#skip] > 0) {
|
||||
my @s = tokenize($expand_variables->($+{VALUE}));
|
||||
push @scripts, @s;
|
||||
$handle_attributes->($+{ATTRIBS},
|
||||
\$attributes{scripts},
|
||||
@s);
|
||||
}
|
||||
},
|
||||
=> sub { $push_to->(\@scripts, undef,
|
||||
\$attributes{scripts}, $+{ATTRIBS},
|
||||
tokenize($expand_variables->($+{VALUE})))
|
||||
if !@skip || $skip[$#skip] > 0; },
|
||||
qr/^\s* HTMLDOCS ${index_re} = ${value_re} $/x
|
||||
=> sub { push @{$htmldocs{$expand_variables->($+{INDEX})}},
|
||||
tokenize($expand_variables->($+{VALUE}))
|
||||
if !@skip || $skip[$#skip] > 0 },
|
||||
=> sub { $push_to->(\%htmldocs, $expand_variables->($+{INDEX}),
|
||||
undef, undef,
|
||||
tokenize($expand_variables->($+{VALUE})))
|
||||
if !@skip || $skip[$#skip] > 0; },
|
||||
qr/^\s* MANDOCS ${index_re} = ${value_re} $/x
|
||||
=> sub { push @{$mandocs{$expand_variables->($+{INDEX})}},
|
||||
tokenize($expand_variables->($+{VALUE}))
|
||||
if !@skip || $skip[$#skip] > 0 },
|
||||
qr/^\s* ORDINALS ${index_re} = ${value_re} $/x
|
||||
=> sub { push @{$ordinals{$expand_variables->($+{INDEX})}},
|
||||
tokenize($expand_variables->($+{VALUE}))
|
||||
if !@skip || $skip[$#skip] > 0 },
|
||||
=> sub { $push_to->(\%mandocs, $expand_variables->($+{INDEX}),
|
||||
undef, undef,
|
||||
tokenize($expand_variables->($+{VALUE})))
|
||||
if !@skip || $skip[$#skip] > 0; },
|
||||
qr/^\s* SOURCE ${index_re} = ${value_re} $/x
|
||||
=> sub { push @{$sources{$expand_variables->($+{INDEX})}},
|
||||
tokenize($expand_variables->($+{VALUE}))
|
||||
if !@skip || $skip[$#skip] > 0 },
|
||||
=> sub { $push_to->(\%sources, $expand_variables->($+{INDEX}),
|
||||
undef, undef,
|
||||
tokenize($expand_variables->($+{VALUE})))
|
||||
if !@skip || $skip[$#skip] > 0; },
|
||||
qr/^\s* SHARED_SOURCE ${index_re} = ${value_re} $/x
|
||||
=> sub { push @{$shared_sources{$expand_variables->($+{INDEX})}},
|
||||
tokenize($expand_variables->($+{VALUE}))
|
||||
if !@skip || $skip[$#skip] > 0 },
|
||||
=> sub { $push_to->(\%shared_sources, $expand_variables->($+{INDEX}),
|
||||
undef, undef,
|
||||
tokenize($expand_variables->($+{VALUE})))
|
||||
if !@skip || $skip[$#skip] > 0; },
|
||||
qr/^\s* INCLUDE ${index_re} = ${value_re} $/x
|
||||
=> sub { push @{$includes{$expand_variables->($+{INDEX})}},
|
||||
tokenize($expand_variables->($+{VALUE}))
|
||||
if !@skip || $skip[$#skip] > 0 },
|
||||
=> sub { $push_to->(\%includes, $expand_variables->($+{INDEX}),
|
||||
undef, undef,
|
||||
tokenize($expand_variables->($+{VALUE})))
|
||||
if !@skip || $skip[$#skip] > 0; },
|
||||
qr/^\s* DEFINE ${index_re} = ${value_re} $/x
|
||||
=> sub { push @{$defines{$expand_variables->($+{INDEX})}},
|
||||
tokenize($expand_variables->($+{VALUE}))
|
||||
if !@skip || $skip[$#skip] > 0 },
|
||||
=> sub { $push_to->(\%defines, $expand_variables->($+{INDEX}),
|
||||
undef, undef,
|
||||
tokenize($expand_variables->($+{VALUE})))
|
||||
if !@skip || $skip[$#skip] > 0; },
|
||||
qr/^\s* DEPEND ${index_re} ${attribs_re} = ${value_re} $/x
|
||||
=> sub {
|
||||
if (!@skip || $skip[$#skip] > 0) {
|
||||
my $i = $expand_variables->($+{INDEX});
|
||||
my @d = tokenize($expand_variables->($+{VALUE}));
|
||||
push @{$depends{$i}}, @d;
|
||||
$handle_attributes->($+{ATTRIBS},
|
||||
\$attributes{depends}->{$i},
|
||||
@d);
|
||||
}
|
||||
},
|
||||
=> sub { $push_to->(\%depends, $expand_variables->($+{INDEX}),
|
||||
\$attributes{depends}, $+{ATTRIBS},
|
||||
tokenize($expand_variables->($+{VALUE})))
|
||||
if !@skip || $skip[$#skip] > 0; },
|
||||
qr/^\s* GENERATE ${index_re} = ${value_re} $/x
|
||||
=> sub { push @{$generate{$expand_variables->($+{INDEX})}},
|
||||
$+{VALUE}
|
||||
if !@skip || $skip[$#skip] > 0 },
|
||||
=> sub { $push_to->(\%generate, $expand_variables->($+{INDEX}),
|
||||
undef, undef, $+{VALUE})
|
||||
if !@skip || $skip[$#skip] > 0; },
|
||||
qr/^\s* (?:\#.*)? $/x => sub { },
|
||||
"OTHERWISE" => sub { die "Something wrong with this line:\n$_\nat $sourced/$f" },
|
||||
"BEFORE" => sub {
|
||||
@@ -2077,9 +2140,9 @@ EOF
|
||||
foreach (@{$sources{$dest}}) {
|
||||
my $s = cleanfile($sourced, $_, $blddir);
|
||||
|
||||
# If it isn't in the source tree, we assume it's generated
|
||||
# in the build tree
|
||||
if ($s eq $src_configdata || ! -f $s || $generate{$_}) {
|
||||
# If it's generated or we simply don't find it in the source
|
||||
# tree, we assume it's in the build tree.
|
||||
if ($s eq $src_configdata || $generate{$_} || ! -f $s) {
|
||||
$s = cleanfile($buildd, $_, $blddir);
|
||||
}
|
||||
# We recognise C++, C and asm files
|
||||
@@ -2109,9 +2172,9 @@ EOF
|
||||
foreach (@{$shared_sources{$dest}}) {
|
||||
my $s = cleanfile($sourced, $_, $blddir);
|
||||
|
||||
# If it isn't in the source tree, we assume it's generated
|
||||
# in the build tree
|
||||
if ($s eq $src_configdata || ! -f $s || $generate{$_}) {
|
||||
# If it's generated or we simply don't find it in the source
|
||||
# tree, we assume it's in the build tree.
|
||||
if ($s eq $src_configdata || $generate{$_} || ! -f $s) {
|
||||
$s = cleanfile($buildd, $_, $blddir);
|
||||
}
|
||||
|
||||
@@ -2151,8 +2214,7 @@ EOF
|
||||
my $gen = $generator[0];
|
||||
$generator[0] = cleanfile($sourced, $gen, $blddir);
|
||||
|
||||
# If the generator isn't in the source tree, we assume it's
|
||||
# generated in the build tree
|
||||
# If the generator is itself generated, it's in the build tree
|
||||
if ($generate{$gen}) {
|
||||
$generator[0] = cleanfile($buildd, $gen, $blddir);
|
||||
}
|
||||
@@ -2174,23 +2236,14 @@ EOF
|
||||
|
||||
# If we know it's generated, or assume it is because we can't
|
||||
# find it in the source tree, we set file we depend on to be
|
||||
# in the build tree rather than the source tree, and assume
|
||||
# and that there are lines to build it in a BEGINRAW..ENDRAW
|
||||
# section or in the Makefile template.
|
||||
# in the build tree rather than the source tree.
|
||||
if ($d eq $src_configdata
|
||||
|| ! -f $d
|
||||
|| (grep { $d eq $_ }
|
||||
map { cleanfile($srcdir, $_, $blddir) }
|
||||
grep { /\.h$/ } keys %{$unified_info{generate}})) {
|
||||
grep { /\.h$/ } keys %{$unified_info{generate}})
|
||||
|| ! -f $d) {
|
||||
$d = cleanfile($buildd, $_, $blddir);
|
||||
}
|
||||
# Take note if the file to depend on is being renamed
|
||||
# Take extra care with files ending with .a, they should
|
||||
# be treated without that extension, and the extension
|
||||
# should be added back after treatment.
|
||||
$d =~ /(\.a)?$/;
|
||||
my $e = $1 // "";
|
||||
$d = $`.$e;
|
||||
$unified_info{depends}->{$ddest}->{$d} = 1;
|
||||
|
||||
# Fix up associated attributes
|
||||
@@ -2229,9 +2282,6 @@ EOF
|
||||
# be a generated file in the build tree.
|
||||
if (! -f $ddest) {
|
||||
$ddest = cleanfile($buildd, $dest, $blddir);
|
||||
if ($unified_info{rename}->{$ddest}) {
|
||||
$ddest = $unified_info{rename}->{$ddest};
|
||||
}
|
||||
}
|
||||
}
|
||||
foreach my $v (@{$defines{$dest}}) {
|
||||
@@ -2566,7 +2616,7 @@ print <<"EOF" if ($disabled{threads} eq "unavailable");
|
||||
|
||||
The library could not be configured for supporting multi-threaded
|
||||
applications as the compiler options required on this system are not known.
|
||||
See file INSTALL for details if you need multi-threading.
|
||||
See file INSTALL.md for details if you need multi-threading.
|
||||
EOF
|
||||
|
||||
print <<"EOF" if ($no_shared_warn);
|
||||
@@ -2591,7 +2641,7 @@ print <<"EOF";
|
||||
*** perl configdata.pm --dump ***
|
||||
*** ***
|
||||
*** (If you are new to OpenSSL, you might want to consult the ***
|
||||
*** 'Troubleshooting' section in the INSTALL file first) ***
|
||||
*** 'Troubleshooting' section in the INSTALL.md file first) ***
|
||||
*** ***
|
||||
**********************************************************************
|
||||
EOF
|
||||
@@ -2611,8 +2661,8 @@ sub death_handler {
|
||||
my @message = ( <<"_____", @_ );
|
||||
|
||||
Failure! $build_file wasn't produced.
|
||||
Please read INSTALL and associated NOTES files. You may also have to look over
|
||||
your available compiler tool chain or change your configuration.
|
||||
Please read INSTALL.md and associated NOTES files. You may also have to
|
||||
look over your available compiler tool chain or change your configuration.
|
||||
|
||||
_____
|
||||
|
||||
|
||||
@@ -1,2 +0,0 @@
|
||||
The FAQ is now maintained on the web:
|
||||
https://www.openssl.org/docs/faq.html
|
||||
@@ -0,0 +1,6 @@
|
||||
Frequently Asked Questions (FAQ)
|
||||
================================
|
||||
|
||||
The [Frequently Asked Questions][FAQ] are now maintained on the OpenSSL homepage.
|
||||
|
||||
[FAQ]: https://www.openssl.org/docs/faq.html
|
||||
@@ -1,1339 +0,0 @@
|
||||
OPENSSL INSTALLATION
|
||||
--------------------
|
||||
|
||||
This document describes installation on all supported operating
|
||||
systems (the Unix/Linux family (which includes Mac OS/X), OpenVMS,
|
||||
and Windows).
|
||||
|
||||
To install OpenSSL, you will need:
|
||||
|
||||
* A make implementation
|
||||
* Perl 5 with core modules (please read NOTES.PERL)
|
||||
* The perl module Text::Template (please read NOTES.PERL)
|
||||
* an ANSI C compiler
|
||||
* a development environment in the form of development libraries and C
|
||||
header files
|
||||
* a supported operating system
|
||||
|
||||
For additional platform specific requirements, solutions to specific
|
||||
issues and other details, please read one of these:
|
||||
|
||||
* NOTES.UNIX (any supported Unix like system)
|
||||
* NOTES.VMS (OpenVMS)
|
||||
* NOTES.WIN (any supported Windows)
|
||||
* NOTES.DJGPP (DOS platform with DJGPP)
|
||||
* NOTES.ANDROID (obviously Android [NDK])
|
||||
* NOTES.VALGRIND (testing with Valgrind)
|
||||
|
||||
Notational conventions in this document
|
||||
---------------------------------------
|
||||
|
||||
Throughout this document, we use the following conventions in command
|
||||
examples:
|
||||
|
||||
$ command Any line starting with a dollar sign
|
||||
($) is a command line.
|
||||
|
||||
{ word1 | word2 | word3 } This denotes a mandatory choice, to be
|
||||
replaced with one of the given words.
|
||||
A simple example would be this:
|
||||
|
||||
$ echo { FOO | BAR | COOKIE }
|
||||
|
||||
which is to be understood as one of
|
||||
these:
|
||||
|
||||
$ echo FOO
|
||||
- or -
|
||||
$ echo BAR
|
||||
- or -
|
||||
$ echo COOKIE
|
||||
|
||||
[ word1 | word2 | word3 ] Similar to { word1 | word2 | word3 }
|
||||
except it's optional to give any of
|
||||
those. In addition to the examples
|
||||
above, this would also be valid:
|
||||
|
||||
$ echo
|
||||
|
||||
{{ target }} This denotes a mandatory word or
|
||||
sequence of words of some sort. A
|
||||
simple example would be this:
|
||||
|
||||
$ type {{ filename }}
|
||||
|
||||
which is to be understood to use the
|
||||
command 'type' on some file name
|
||||
determined by the user.
|
||||
|
||||
[[ options ]] Similar to {{ target }}, but is
|
||||
optional.
|
||||
|
||||
Note that the notation assumes spaces around {, }, [, ], {{, }} and
|
||||
[[, ]]. This is to differentiate from OpenVMS directory
|
||||
specifications, which also use [ and ], but without spaces.
|
||||
|
||||
Quick Start
|
||||
-----------
|
||||
|
||||
If you want to just get on with it, do:
|
||||
|
||||
on Unix (again, this includes Mac OS/X):
|
||||
|
||||
$ ./config
|
||||
$ make
|
||||
$ make test
|
||||
$ make install
|
||||
|
||||
on OpenVMS:
|
||||
|
||||
$ @config
|
||||
$ mms
|
||||
$ mms test
|
||||
$ mms install
|
||||
|
||||
on Windows (only pick one of the targets for configuration):
|
||||
|
||||
$ perl Configure { VC-WIN32 | VC-WIN64A | VC-WIN64I | VC-CE }
|
||||
$ nmake
|
||||
$ nmake test
|
||||
$ nmake install
|
||||
|
||||
Note that in order to perform the install step above you need to have
|
||||
appropriate permissions to write to the installation directory.
|
||||
|
||||
If any of these steps fails, see section Installation in Detail below.
|
||||
|
||||
This will build and install OpenSSL in the default location, which is:
|
||||
|
||||
Unix: normal installation directories under /usr/local
|
||||
OpenVMS: SYS$COMMON:[OPENSSL-'version'...], where 'version' is the
|
||||
OpenSSL version number with underscores instead of periods.
|
||||
Windows: C:\Program Files\OpenSSL or C:\Program Files (x86)\OpenSSL
|
||||
|
||||
The installation directory should be appropriately protected to ensure
|
||||
unprivileged users cannot make changes to OpenSSL binaries or files, or install
|
||||
engines. If you already have a pre-installed version of OpenSSL as part of
|
||||
your Operating System it is recommended that you do not overwrite the system
|
||||
version and instead install to somewhere else.
|
||||
|
||||
If you want to install it anywhere else, run config like this:
|
||||
|
||||
On Unix:
|
||||
|
||||
$ ./config --prefix=/opt/openssl --openssldir=/usr/local/ssl
|
||||
|
||||
On OpenVMS:
|
||||
|
||||
$ @config --prefix=PROGRAM:[INSTALLS] --openssldir=SYS$MANAGER:[OPENSSL]
|
||||
|
||||
(Note: if you do add options to the configuration command, please make sure
|
||||
you've read more than just this Quick Start, such as relevant NOTES.* files,
|
||||
the options outline below, as configuration options may change the outcome
|
||||
in otherwise unexpected ways)
|
||||
|
||||
|
||||
Configuration Options
|
||||
---------------------
|
||||
|
||||
There are several options to ./config (or ./Configure) to customize
|
||||
the build (note that for Windows, the defaults for --prefix and
|
||||
--openssldir depend in what configuration is used and what Windows
|
||||
implementation OpenSSL is built on. More notes on this in NOTES.WIN):
|
||||
|
||||
--api=x.y[.z]
|
||||
Build the OpenSSL libraries to support the API for
|
||||
the specified version. If "no-deprecated" is also
|
||||
given, don't build with support for deprecated APIs
|
||||
in or below the specified version number. For example
|
||||
"--api=1.1.0" with "no-deprecated" will remove
|
||||
support for all APIS that were deprecated in
|
||||
OpenSSL version 1.1.0 or below.
|
||||
This is a rather specialized option for developers.
|
||||
If you just intend to remove all deprecated APIs
|
||||
entirely (up to the current version), only specify
|
||||
"-no-deprecated" (see below).
|
||||
If "--api" isn't given, it defaults to the current
|
||||
OpenSSL minor version.
|
||||
|
||||
--cross-compile-prefix=PREFIX
|
||||
The PREFIX to include in front of commands for your
|
||||
toolchain. It's likely to have to end with dash, e.g.
|
||||
a-b-c- would invoke GNU compiler as a-b-c-gcc, etc.
|
||||
Unfortunately cross-compiling is too case-specific to
|
||||
put together one-size-fits-all instructions. You might
|
||||
have to pass more flags or set up environment variables
|
||||
to actually make it work. Android and iOS cases are
|
||||
discussed in corresponding Configurations/15-*.conf
|
||||
files. But there are cases when this option alone is
|
||||
sufficient. For example to build the mingw64 target on
|
||||
Linux "--cross-compile-prefix=x86_64-w64-mingw32-"
|
||||
works. Naturally provided that mingw packages are
|
||||
installed. Today Debian and Ubuntu users have option to
|
||||
install a number of prepackaged cross-compilers along
|
||||
with corresponding run-time and development packages for
|
||||
"alien" hardware. To give another example
|
||||
"--cross-compile-prefix=mipsel-linux-gnu-" suffices
|
||||
in such case. Needless to mention that you have to
|
||||
invoke ./Configure, not ./config, and pass your target
|
||||
name explicitly. Also, note that --openssldir refers
|
||||
to target's file system, not one you are building on.
|
||||
|
||||
--debug
|
||||
Build OpenSSL with debugging symbols and zero optimization
|
||||
level.
|
||||
|
||||
--libdir=DIR
|
||||
The name of the directory under the top of the installation
|
||||
directory tree (see the --prefix option) where libraries will
|
||||
be installed. By default this is "lib". Note that on Windows
|
||||
only ".lib" files will be stored in this location. dll files
|
||||
will always be installed to the "bin" directory.
|
||||
|
||||
--openssldir=DIR
|
||||
Directory for OpenSSL configuration files, and also the
|
||||
default certificate and key store. Defaults are:
|
||||
|
||||
Unix: /usr/local/ssl
|
||||
Windows: C:\Program Files\Common Files\SSL
|
||||
or C:\Program Files (x86)\Common Files\SSL
|
||||
OpenVMS: SYS$COMMON:[OPENSSL-COMMON]
|
||||
|
||||
--prefix=DIR
|
||||
The top of the installation directory tree. Defaults are:
|
||||
|
||||
Unix: /usr/local
|
||||
Windows: C:\Program Files\OpenSSL
|
||||
or C:\Program Files (x86)\OpenSSL
|
||||
OpenVMS: SYS$COMMON:[OPENSSL-'version']
|
||||
|
||||
--release
|
||||
Build OpenSSL without debugging symbols. This is the default.
|
||||
|
||||
--strict-warnings
|
||||
This is a developer flag that switches on various compiler
|
||||
options recommended for OpenSSL development. It only works
|
||||
when using gcc or clang as the compiler. If you are
|
||||
developing a patch for OpenSSL then it is recommended that
|
||||
you use this option where possible.
|
||||
|
||||
--with-zlib-include=DIR
|
||||
The directory for the location of the zlib include file. This
|
||||
option is only necessary if enable-zlib (see below) is used
|
||||
and the include file is not already on the system include
|
||||
path.
|
||||
|
||||
--with-zlib-lib=LIB
|
||||
On Unix: this is the directory containing the zlib library.
|
||||
If not provided the system library path will be used.
|
||||
On Windows: this is the filename of the zlib library (with or
|
||||
without a path). This flag must be provided if the
|
||||
zlib-dynamic option is not also used. If zlib-dynamic is used
|
||||
then this flag is optional and a default value ("ZLIB1") is
|
||||
used if not provided.
|
||||
On VMS: this is the filename of the zlib library (with or
|
||||
without a path). This flag is optional and if not provided
|
||||
then "GNV$LIBZSHR", "GNV$LIBZSHR32" or "GNV$LIBZSHR64" is
|
||||
used by default depending on the pointer size chosen.
|
||||
|
||||
|
||||
--with-rand-seed=seed1[,seed2,...]
|
||||
A comma separated list of seeding methods which will be tried
|
||||
by OpenSSL in order to obtain random input (a.k.a "entropy")
|
||||
for seeding its cryptographically secure random number
|
||||
generator (CSPRNG). The current seeding methods are:
|
||||
|
||||
os: Use a trusted operating system entropy source.
|
||||
This is the default method if such an entropy
|
||||
source exists.
|
||||
getrandom: Use the L<getrandom(2)> or equivalent system
|
||||
call.
|
||||
devrandom: Use the first device from the DEVRANDOM list
|
||||
which can be opened to read random bytes. The
|
||||
DEVRANDOM preprocessor constant expands to
|
||||
"/dev/urandom","/dev/random","/dev/srandom" on
|
||||
most unix-ish operating systems.
|
||||
egd: Check for an entropy generating daemon.
|
||||
rdcpu: Use the RDSEED or RDRAND command if provided by
|
||||
the CPU.
|
||||
librandom: Use librandom (not implemented yet).
|
||||
none: Disable automatic seeding. This is the default
|
||||
on some operating systems where no suitable
|
||||
entropy source exists, or no support for it is
|
||||
implemented yet.
|
||||
|
||||
For more information, see the section 'Note on random number
|
||||
generation' at the end of this document.
|
||||
|
||||
no-afalgeng
|
||||
Don't build the AFALG engine. This option will be forced if
|
||||
on a platform that does not support AFALG.
|
||||
|
||||
enable-ktls
|
||||
Build with Kernel TLS support. This option will enable the
|
||||
use of the Kernel TLS data-path, which can improve
|
||||
performance and allow for the use of sendfile and splice
|
||||
system calls on TLS sockets. The Kernel may use TLS
|
||||
accelerators if any are available on the system.
|
||||
This option will be forced off on systems that do not support
|
||||
the Kernel TLS data-path.
|
||||
|
||||
enable-asan
|
||||
Build with the Address sanitiser. This is a developer option
|
||||
only. It may not work on all platforms and should never be
|
||||
used in production environments. It will only work when used
|
||||
with gcc or clang and should be used in conjunction with the
|
||||
no-shared option.
|
||||
|
||||
no-asm
|
||||
Do not use assembler code. This should be viewed as
|
||||
debugging/trouble-shooting option rather than production.
|
||||
On some platforms a small amount of assembler code may
|
||||
still be used even with this option.
|
||||
|
||||
no-async
|
||||
Do not build support for async operations.
|
||||
|
||||
no-autoalginit
|
||||
Don't automatically load all supported ciphers and digests.
|
||||
Typically OpenSSL will make available all of its supported
|
||||
ciphers and digests. For a statically linked application this
|
||||
may be undesirable if small executable size is an objective.
|
||||
This only affects libcrypto. Ciphers and digests will have to
|
||||
be loaded manually using EVP_add_cipher() and
|
||||
EVP_add_digest() if this option is used. This option will
|
||||
force a non-shared build.
|
||||
|
||||
no-autoerrinit
|
||||
Don't automatically load all libcrypto/libssl error strings.
|
||||
Typically OpenSSL will automatically load human readable
|
||||
error strings. For a statically linked application this may
|
||||
be undesirable if small executable size is an objective.
|
||||
|
||||
no-autoload-config
|
||||
Don't automatically load the default openssl.cnf file.
|
||||
Typically OpenSSL will automatically load a system config
|
||||
file which configures default ssl options.
|
||||
|
||||
enable-buildtest-c++
|
||||
While testing, generate C++ buildtest files that
|
||||
simply check that the public OpenSSL header files
|
||||
are usable standalone with C++.
|
||||
|
||||
Enabling this option demands extra care. For any
|
||||
compiler flag given directly as configuration
|
||||
option, you must ensure that it's valid for both
|
||||
the C and the C++ compiler. If not, the C++ build
|
||||
test will most likely break. As an alternative,
|
||||
you can use the language specific variables, CFLAGS
|
||||
and CXXFLAGS.
|
||||
|
||||
no-capieng
|
||||
Don't build the CAPI engine. This option will be forced if
|
||||
on a platform that does not support CAPI.
|
||||
|
||||
no-cmp
|
||||
Don't build support for CMP features
|
||||
|
||||
no-cms
|
||||
Don't build support for CMS features
|
||||
|
||||
no-comp
|
||||
Don't build support for SSL/TLS compression. If this option
|
||||
is left enabled (the default), then compression will only
|
||||
work if the zlib or zlib-dynamic options are also chosen.
|
||||
|
||||
enable-crypto-mdebug
|
||||
This now only enables the failed-malloc feature.
|
||||
|
||||
enable-crypto-mdebug-backtrace
|
||||
This is a no-op; the project uses the compiler's
|
||||
address/leak sanitizer instead.
|
||||
|
||||
no-ct
|
||||
Don't build support for Certificate Transparency.
|
||||
|
||||
no-deprecated
|
||||
Don't build with support for deprecated APIs up
|
||||
until and including the version given with
|
||||
"--api" (or the current version of "--api" wasn't
|
||||
given).
|
||||
|
||||
no-dgram
|
||||
Don't build support for datagram based BIOs. Selecting this
|
||||
option will also force the disabling of DTLS.
|
||||
|
||||
no-dso
|
||||
Don't build support for loading Dynamic Shared Objects.
|
||||
|
||||
enable-devcryptoeng
|
||||
Build the /dev/crypto engine. It is automatically selected
|
||||
on BSD implementations, in which case it can be disabled with
|
||||
no-devcryptoeng.
|
||||
|
||||
no-dynamic-engine
|
||||
Don't build the dynamically loaded engines. This only has an
|
||||
effect in a "shared" build
|
||||
|
||||
no-ec
|
||||
Don't build support for Elliptic Curves.
|
||||
|
||||
no-ec2m
|
||||
Don't build support for binary Elliptic Curves
|
||||
|
||||
enable-ec_nistp_64_gcc_128
|
||||
Enable support for optimised implementations of some commonly
|
||||
used NIST elliptic curves.
|
||||
This is only supported on platforms:
|
||||
- with little-endian storage of non-byte types
|
||||
- that tolerate misaligned memory references
|
||||
- where the compiler:
|
||||
- supports the non-standard type __uint128_t
|
||||
- defines the built-in macro __SIZEOF_INT128__
|
||||
|
||||
enable-egd
|
||||
Build support for gathering entropy from EGD (Entropy
|
||||
Gathering Daemon).
|
||||
|
||||
no-engine
|
||||
Don't build support for loading engines.
|
||||
|
||||
no-err
|
||||
Don't compile in any error strings.
|
||||
|
||||
enable-external-tests
|
||||
Enable building of integration with external test suites.
|
||||
This is a developer option and may not work on all platforms.
|
||||
The only supported external test suite at the current time is
|
||||
the BoringSSL test suite. See the file test/README.external
|
||||
for further details.
|
||||
|
||||
no-filenames
|
||||
Don't compile in filename and line number information (e.g.
|
||||
for errors and memory allocation).
|
||||
|
||||
no-fips
|
||||
Don't compile the FIPS module
|
||||
|
||||
enable-fuzz-libfuzzer, enable-fuzz-afl
|
||||
Build with support for fuzzing using either libfuzzer or AFL.
|
||||
These are developer options only. They may not work on all
|
||||
platforms and should never be used in production environments.
|
||||
See the file fuzz/README.md for further details.
|
||||
|
||||
no-gost
|
||||
Don't build support for GOST based ciphersuites. Note that
|
||||
if this feature is enabled then GOST ciphersuites are only
|
||||
available if the GOST algorithms are also available through
|
||||
loading an externally supplied engine.
|
||||
|
||||
no-legacy
|
||||
Don't build the legacy provider. Disabling this also disables
|
||||
the legacy algorithms: MD2 (already disabled by default).
|
||||
|
||||
no-makedepend
|
||||
Don't generate dependencies.
|
||||
|
||||
no-module
|
||||
Don't build any dynamically loadable engines. This also
|
||||
implies 'no-dynamic-engine'.
|
||||
|
||||
no-multiblock
|
||||
Don't build support for writing multiple records in one
|
||||
go in libssl (Note: this is a different capability to the
|
||||
pipelining functionality).
|
||||
|
||||
no-nextprotoneg
|
||||
Don't build support for the NPN TLS extension.
|
||||
|
||||
no-ocsp
|
||||
Don't build support for OCSP.
|
||||
|
||||
no-padlockeng
|
||||
no-hw-padlock
|
||||
Don't build the padlock engine.
|
||||
('no-hw-padlock' is deprecated and should not be used)
|
||||
|
||||
no-pic
|
||||
Don't build with support for Position Independent Code.
|
||||
|
||||
no-pinshared By default OpenSSL will attempt to stay in memory until the
|
||||
process exits. This is so that libcrypto and libssl can be
|
||||
properly cleaned up automatically via an "atexit()" handler.
|
||||
The handler is registered by libcrypto and cleans up both
|
||||
libraries. On some platforms the atexit() handler will run on
|
||||
unload of libcrypto (if it has been dynamically loaded)
|
||||
rather than at process exit. This option can be used to stop
|
||||
OpenSSL from attempting to stay in memory until the process
|
||||
exits. This could lead to crashes if either libcrypto or
|
||||
libssl have already been unloaded at the point
|
||||
that the atexit handler is invoked, e.g. on a platform which
|
||||
calls atexit() on unload of the library, and libssl is
|
||||
unloaded before libcrypto then a crash is likely to happen.
|
||||
Applications can suppress running of the atexit() handler at
|
||||
run time by using the OPENSSL_INIT_NO_ATEXIT option to
|
||||
OPENSSL_init_crypto(). See the man page for it for further
|
||||
details.
|
||||
|
||||
no-posix-io
|
||||
Don't use POSIX IO capabilities.
|
||||
|
||||
no-psk
|
||||
Don't build support for Pre-Shared Key based ciphersuites.
|
||||
|
||||
no-rdrand
|
||||
Don't use hardware RDRAND capabilities.
|
||||
|
||||
no-rfc3779
|
||||
Don't build support for RFC3779 ("X.509 Extensions for IP
|
||||
Addresses and AS Identifiers")
|
||||
|
||||
sctp
|
||||
Build support for SCTP
|
||||
|
||||
no-shared
|
||||
Do not create shared libraries, only static ones. See "Note
|
||||
on shared libraries" below.
|
||||
|
||||
no-sock
|
||||
Don't build support for socket BIOs
|
||||
|
||||
no-srp
|
||||
Don't build support for SRP or SRP based ciphersuites.
|
||||
|
||||
no-srtp
|
||||
Don't build SRTP support
|
||||
|
||||
no-sse2
|
||||
Exclude SSE2 code paths from 32-bit x86 assembly modules.
|
||||
Normally SSE2 extension is detected at run-time, but the
|
||||
decision whether or not the machine code will be executed
|
||||
is taken solely on CPU capability vector. This means that
|
||||
if you happen to run OS kernel which does not support SSE2
|
||||
extension on Intel P4 processor, then your application
|
||||
might be exposed to "illegal instruction" exception.
|
||||
There might be a way to enable support in kernel, e.g.
|
||||
FreeBSD kernel can be compiled with CPU_ENABLE_SSE, and
|
||||
there is a way to disengage SSE2 code paths upon application
|
||||
start-up, but if you aim for wider "audience" running
|
||||
such kernel, consider no-sse2. Both the 386 and
|
||||
no-asm options imply no-sse2.
|
||||
|
||||
enable-ssl-trace
|
||||
Build with the SSL Trace capabilities (adds the "-trace"
|
||||
option to s_client and s_server).
|
||||
|
||||
no-static-engine
|
||||
Don't build the statically linked engines. This only
|
||||
has an impact when not built "shared".
|
||||
|
||||
no-stdio
|
||||
Don't use anything from the C header file "stdio.h" that
|
||||
makes use of the "FILE" type. Only libcrypto and libssl can
|
||||
be built in this way. Using this option will suppress
|
||||
building the command line applications. Additionally since
|
||||
the OpenSSL tests also use the command line applications the
|
||||
tests will also be skipped.
|
||||
|
||||
no-tests
|
||||
Don't build test programs or run any test.
|
||||
|
||||
no-threads
|
||||
Don't try to build with support for multi-threaded
|
||||
applications.
|
||||
|
||||
threads
|
||||
Build with support for multi-threaded applications. Most
|
||||
platforms will enable this by default. However if on a
|
||||
platform where this is not the case then this will usually
|
||||
require additional system-dependent options! See "Note on
|
||||
multi-threading" below.
|
||||
|
||||
enable-trace
|
||||
Build with support for the integrated tracing api. See manual pages
|
||||
OSSL_trace_set_channel(3) and OSSL_trace_enabled(3) for details.
|
||||
|
||||
no-ts
|
||||
Don't build Time Stamping Authority support.
|
||||
|
||||
enable-ubsan
|
||||
Build with the Undefined Behaviour sanitiser. This is a
|
||||
developer option only. It may not work on all platforms and
|
||||
should never be used in production environments. It will only
|
||||
work when used with gcc or clang and should be used in
|
||||
conjunction with the "-DPEDANTIC" option (or the
|
||||
--strict-warnings option).
|
||||
|
||||
no-ui
|
||||
Don't build with the "UI" capability (i.e. the set of
|
||||
features enabling text based prompts).
|
||||
|
||||
enable-unit-test
|
||||
Enable additional unit test APIs. This should not typically
|
||||
be used in production deployments.
|
||||
|
||||
no-uplink
|
||||
Don't build support for UPLINK interface.
|
||||
|
||||
enable-weak-ssl-ciphers
|
||||
Build support for SSL/TLS ciphers that are considered "weak"
|
||||
(e.g. RC4 based ciphersuites).
|
||||
|
||||
zlib
|
||||
Build with support for zlib compression/decompression.
|
||||
|
||||
zlib-dynamic
|
||||
Like "zlib", but has OpenSSL load the zlib library
|
||||
dynamically when needed. This is only supported on systems
|
||||
where loading of shared libraries is supported.
|
||||
|
||||
386
|
||||
In 32-bit x86 builds, when generating assembly modules,
|
||||
use the 80386 instruction set only (the default x86 code
|
||||
is more efficient, but requires at least a 486). Note:
|
||||
This doesn't affect code generated by compiler, you're
|
||||
likely to complement configuration command line with
|
||||
suitable compiler-specific option.
|
||||
|
||||
no-<prot>
|
||||
Don't build support for negotiating the specified SSL/TLS
|
||||
protocol (one of ssl, ssl3, tls, tls1, tls1_1, tls1_2,
|
||||
tls1_3, dtls, dtls1 or dtls1_2). If "no-tls" is selected then
|
||||
all of tls1, tls1_1, tls1_2 and tls1_3 are disabled.
|
||||
Similarly "no-dtls" will disable dtls1 and dtls1_2. The
|
||||
"no-ssl" option is synonymous with "no-ssl3". Note this only
|
||||
affects version negotiation. OpenSSL will still provide the
|
||||
methods for applications to explicitly select the individual
|
||||
protocol versions.
|
||||
|
||||
no-<prot>-method
|
||||
As for no-<prot> but in addition do not build the methods for
|
||||
applications to explicitly select individual protocol
|
||||
versions. Note that there is no "no-tls1_3-method" option
|
||||
because there is no application method for TLSv1.3. Using
|
||||
individual protocol methods directly is deprecated.
|
||||
Applications should use TLS_method() instead.
|
||||
|
||||
enable-<alg>
|
||||
Build with support for the specified algorithm, where <alg>
|
||||
is one of: md2 or rc5.
|
||||
|
||||
no-<alg>
|
||||
Build without support for the specified algorithm, where
|
||||
<alg> is one of: aria, bf, blake2, camellia, cast, chacha,
|
||||
cmac, des, dh, dsa, ecdh, ecdsa, idea, md4, mdc2, ocb,
|
||||
poly1305, rc2, rc4, rmd160, scrypt, seed, siphash, siv, sm2,
|
||||
sm3, sm4 or whirlpool. The "ripemd" algorithm is deprecated
|
||||
and if used is synonymous with rmd160.
|
||||
|
||||
-Dxxx, -Ixxx, -Wp, -lxxx, -Lxxx, -Wl, -rpath, -R, -framework, -static
|
||||
These system specific options will be recognised and
|
||||
passed through to the compiler to allow you to define
|
||||
preprocessor symbols, specify additional libraries, library
|
||||
directories or other compiler options. It might be worth
|
||||
noting that some compilers generate code specifically for
|
||||
processor the compiler currently executes on. This is not
|
||||
necessarily what you might have in mind, since it might be
|
||||
unsuitable for execution on other, typically older,
|
||||
processor. Consult your compiler documentation.
|
||||
|
||||
Take note of the VAR=value documentation below and how
|
||||
these flags interact with those variables.
|
||||
|
||||
-xxx, +xxx, /xxx
|
||||
Additional options that are not otherwise recognised are
|
||||
passed through as they are to the compiler as well.
|
||||
Unix-style options beginning with a '-' or '+' and
|
||||
Windows-style options beginning with a '/' are recognized.
|
||||
Again, consult your compiler documentation.
|
||||
|
||||
If the option contains arguments separated by spaces,
|
||||
then the URL-style notation %20 can be used for the space
|
||||
character in order to avoid having to quote the option.
|
||||
For example, -opt%20arg gets expanded to -opt arg.
|
||||
In fact, any ASCII character can be encoded as %xx using its
|
||||
hexadecimal encoding.
|
||||
|
||||
Take note of the VAR=value documentation below and how
|
||||
these flags interact with those variables.
|
||||
|
||||
VAR=value
|
||||
Assignment of environment variable for Configure. These
|
||||
work just like normal environment variable assignments,
|
||||
but are supported on all platforms and are confined to
|
||||
the configuration scripts only. These assignments override
|
||||
the corresponding value in the inherited environment, if
|
||||
there is one.
|
||||
|
||||
The following variables are used as "make variables" and
|
||||
can be used as an alternative to giving preprocessor,
|
||||
compiler and linker options directly as configuration.
|
||||
The following variables are supported:
|
||||
|
||||
AR The static library archiver.
|
||||
ARFLAGS Flags for the static library archiver.
|
||||
AS The assembler compiler.
|
||||
ASFLAGS Flags for the assembler compiler.
|
||||
CC The C compiler.
|
||||
CFLAGS Flags for the C compiler.
|
||||
CXX The C++ compiler.
|
||||
CXXFLAGS Flags for the C++ compiler.
|
||||
CPP The C/C++ preprocessor.
|
||||
CPPFLAGS Flags for the C/C++ preprocessor.
|
||||
CPPDEFINES List of CPP macro definitions, separated
|
||||
by a platform specific character (':' or
|
||||
space for Unix, ';' for Windows, ',' for
|
||||
VMS). This can be used instead of using
|
||||
-D (or what corresponds to that on your
|
||||
compiler) in CPPFLAGS.
|
||||
CPPINCLUDES List of CPP inclusion directories, separated
|
||||
the same way as for CPPDEFINES. This can
|
||||
be used instead of -I (or what corresponds
|
||||
to that on your compiler) in CPPFLAGS.
|
||||
HASHBANGPERL Perl invocation to be inserted after '#!'
|
||||
in public perl scripts (only relevant on
|
||||
Unix).
|
||||
LD The program linker (not used on Unix, $(CC)
|
||||
is used there).
|
||||
LDFLAGS Flags for the shared library, DSO and
|
||||
program linker.
|
||||
LDLIBS Extra libraries to use when linking.
|
||||
Takes the form of a space separated list
|
||||
of library specifications on Unix and
|
||||
Windows, and as a comma separated list of
|
||||
libraries on VMS.
|
||||
RANLIB The library archive indexer.
|
||||
RC The Windows resource compiler.
|
||||
RCFLAGS Flags for the Windows resource compiler.
|
||||
RM The command to remove files and directories.
|
||||
|
||||
These cannot be mixed with compiling / linking flags given
|
||||
on the command line. In other words, something like this
|
||||
isn't permitted.
|
||||
|
||||
./config -DFOO CPPFLAGS=-DBAR -DCOOKIE
|
||||
|
||||
Backward compatibility note:
|
||||
|
||||
To be compatible with older configuration scripts, the
|
||||
environment variables are ignored if compiling / linking
|
||||
flags are given on the command line, except for these:
|
||||
|
||||
AR, CC, CXX, CROSS_COMPILE, HASHBANGPERL, PERL, RANLIB, RC
|
||||
and WINDRES
|
||||
|
||||
For example, the following command will not see -DBAR:
|
||||
|
||||
CPPFLAGS=-DBAR ./config -DCOOKIE
|
||||
|
||||
However, the following will see both set variables:
|
||||
|
||||
CC=gcc CROSS_COMPILE=x86_64-w64-mingw32- \
|
||||
./config -DCOOKIE
|
||||
|
||||
If CC is set, it is advisable to also set CXX to ensure
|
||||
both C and C++ compilers are in the same "family". This
|
||||
becomes relevant with 'enable-external-tests' and
|
||||
'enable-buildtest-c++'.
|
||||
|
||||
reconf
|
||||
reconfigure
|
||||
Reconfigure from earlier data. This fetches the previous
|
||||
command line options and environment from data saved in
|
||||
"configdata.pm", and runs the configuration process again,
|
||||
using these options and environment.
|
||||
Note: NO other option is permitted together with "reconf".
|
||||
This means that you also MUST use "./Configure" (or
|
||||
what corresponds to that on non-Unix platforms) directly
|
||||
to invoke this option.
|
||||
Note: The original configuration saves away values for ALL
|
||||
environment variables that were used, and if they weren't
|
||||
defined, they are still saved away with information that
|
||||
they weren't originally defined. This information takes
|
||||
precedence over environment variables that are defined
|
||||
when reconfiguring.
|
||||
|
||||
Displaying configuration data
|
||||
-----------------------------
|
||||
|
||||
The configuration script itself will say very little, and finishes by
|
||||
creating "configdata.pm". This perl module can be loaded by other scripts
|
||||
to find all the configuration data, and it can also be used as a script to
|
||||
display all sorts of configuration data in a human readable form.
|
||||
|
||||
For more information, please do:
|
||||
|
||||
$ ./configdata.pm --help # Unix
|
||||
|
||||
or
|
||||
|
||||
$ perl configdata.pm --help # Windows and VMS
|
||||
|
||||
Installation in Detail
|
||||
----------------------
|
||||
|
||||
1a. Configure OpenSSL for your operation system automatically:
|
||||
|
||||
NOTE: This is not available on Windows.
|
||||
|
||||
$ ./config [[ options ]] # Unix
|
||||
|
||||
or
|
||||
|
||||
$ @config [[ options ]] ! OpenVMS
|
||||
|
||||
For the remainder of this text, the Unix form will be used in all
|
||||
examples, please use the appropriate form for your platform.
|
||||
|
||||
This guesses at your operating system (and compiler, if necessary) and
|
||||
configures OpenSSL based on this guess. Run ./config -t to see
|
||||
if it guessed correctly. If you want to use a different compiler, you
|
||||
are cross-compiling for another platform, or the ./config guess was
|
||||
wrong for other reasons, go to step 1b. Otherwise go to step 2.
|
||||
|
||||
On some systems, you can include debugging information as follows:
|
||||
|
||||
$ ./config -d [[ options ]]
|
||||
|
||||
1b. Configure OpenSSL for your operating system manually
|
||||
|
||||
OpenSSL knows about a range of different operating system, hardware and
|
||||
compiler combinations. To see the ones it knows about, run
|
||||
|
||||
$ ./Configure # Unix
|
||||
|
||||
or
|
||||
|
||||
$ perl Configure # All other platforms
|
||||
|
||||
For the remainder of this text, the Unix form will be used in all
|
||||
examples, please use the appropriate form for your platform.
|
||||
|
||||
Pick a suitable name from the list that matches your system. For most
|
||||
operating systems there is a choice between using "cc" or "gcc". When
|
||||
you have identified your system (and if necessary compiler) use this name
|
||||
as the argument to Configure. For example, a "linux-elf" user would
|
||||
run:
|
||||
|
||||
$ ./Configure linux-elf [[ options ]]
|
||||
|
||||
If your system isn't listed, you will have to create a configuration
|
||||
file named Configurations/{{ something }}.conf and add the correct
|
||||
configuration for your system. See the available configs as examples
|
||||
and read Configurations/README and Configurations/README.design for
|
||||
more information.
|
||||
|
||||
The generic configurations "cc" or "gcc" should usually work on 32 bit
|
||||
Unix-like systems.
|
||||
|
||||
Configure creates a build file ("Makefile" on Unix, "makefile" on Windows
|
||||
and "descrip.mms" on OpenVMS) from a suitable template in Configurations,
|
||||
and defines various macros in include/openssl/configuration.h (generated
|
||||
from include/openssl/configuration.h.in).
|
||||
|
||||
1c. Configure OpenSSL for building outside of the source tree.
|
||||
|
||||
OpenSSL can be configured to build in a build directory separate from
|
||||
the directory with the source code. It's done by placing yourself in
|
||||
some other directory and invoking the configuration commands from
|
||||
there.
|
||||
|
||||
Unix example:
|
||||
|
||||
$ mkdir /var/tmp/openssl-build
|
||||
$ cd /var/tmp/openssl-build
|
||||
$ /PATH/TO/OPENSSL/SOURCE/config [[ options ]]
|
||||
|
||||
or
|
||||
|
||||
$ /PATH/TO/OPENSSL/SOURCE/Configure {{ target }} [[ options ]]
|
||||
|
||||
OpenVMS example:
|
||||
|
||||
$ set default sys$login:
|
||||
$ create/dir [.tmp.openssl-build]
|
||||
$ set default [.tmp.openssl-build]
|
||||
$ @[PATH.TO.OPENSSL.SOURCE]config [[ options ]]
|
||||
|
||||
or
|
||||
|
||||
$ @[PATH.TO.OPENSSL.SOURCE]Configure {{ target }} [[ options ]]
|
||||
|
||||
Windows example:
|
||||
|
||||
$ C:
|
||||
$ mkdir \temp-openssl
|
||||
$ cd \temp-openssl
|
||||
$ perl d:\PATH\TO\OPENSSL\SOURCE\Configure {{ target }} [[ options ]]
|
||||
|
||||
Paths can be relative just as well as absolute. Configure will
|
||||
do its best to translate them to relative paths whenever possible.
|
||||
|
||||
2. Build OpenSSL by running:
|
||||
|
||||
$ make # Unix
|
||||
$ mms ! (or mmk) OpenVMS
|
||||
$ nmake # Windows
|
||||
|
||||
This will build the OpenSSL libraries (libcrypto.a and libssl.a on
|
||||
Unix, corresponding on other platforms) and the OpenSSL binary
|
||||
("openssl"). The libraries will be built in the top-level directory,
|
||||
and the binary will be in the "apps" subdirectory.
|
||||
|
||||
Troubleshooting:
|
||||
|
||||
If the build fails, look at the output. There may be reasons
|
||||
for the failure that aren't problems in OpenSSL itself (like
|
||||
missing standard headers).
|
||||
|
||||
If the build succeeded previously, but fails after a source or
|
||||
configuration change, it might be helpful to clean the build tree
|
||||
before attempting another build. Use this command:
|
||||
|
||||
$ make clean # Unix
|
||||
$ mms clean ! (or mmk) OpenVMS
|
||||
$ nmake clean # Windows
|
||||
|
||||
Assembler error messages can sometimes be sidestepped by using the
|
||||
"no-asm" configuration option.
|
||||
|
||||
Compiling parts of OpenSSL with gcc and others with the system
|
||||
compiler will result in unresolved symbols on some systems.
|
||||
|
||||
If you are still having problems you can get help by sending an email
|
||||
to the openssl-users email list (see
|
||||
https://www.openssl.org/community/mailinglists.html for details). If
|
||||
it is a bug with OpenSSL itself, please open an issue on GitHub, at
|
||||
https://github.com/openssl/openssl/issues. Please review the existing
|
||||
ones first; maybe the bug was already reported or has already been
|
||||
fixed.
|
||||
|
||||
3. After a successful build, the libraries should be tested. Run:
|
||||
|
||||
$ make test # Unix
|
||||
$ mms test ! OpenVMS
|
||||
$ nmake test # Windows
|
||||
|
||||
NOTE: you MUST run the tests from an unprivileged account (or
|
||||
disable your privileges temporarily if your platform allows it).
|
||||
|
||||
If some tests fail, look at the output. There may be reasons for
|
||||
the failure that isn't a problem in OpenSSL itself (like a
|
||||
malfunction with Perl). You may want increased verbosity, that
|
||||
can be accomplished like this:
|
||||
|
||||
Verbosity on failure only (make macro VERBOSE_FAILURE or VF):
|
||||
|
||||
$ make VF=1 test # Unix
|
||||
$ mms /macro=(VF=1) test ! OpenVMS
|
||||
$ nmake VF=1 test # Windows
|
||||
|
||||
Full verbosity (make macro VERBOSE or V):
|
||||
|
||||
$ make V=1 test # Unix
|
||||
$ mms /macro=(V=1) test ! OpenVMS
|
||||
$ nmake V=1 test # Windows
|
||||
|
||||
If you want to run just one or a few specific tests, you can use
|
||||
the make variable TESTS to specify them, like this:
|
||||
|
||||
$ make TESTS='test_rsa test_dsa' test # Unix
|
||||
$ mms/macro="TESTS=test_rsa test_dsa" test ! OpenVMS
|
||||
$ nmake TESTS='test_rsa test_dsa' test # Windows
|
||||
|
||||
And of course, you can combine (Unix example shown):
|
||||
|
||||
$ make VF=1 TESTS='test_rsa test_dsa' test
|
||||
|
||||
You can find the list of available tests like this:
|
||||
|
||||
$ make list-tests # Unix
|
||||
$ mms list-tests ! OpenVMS
|
||||
$ nmake list-tests # Windows
|
||||
|
||||
Have a look at the manual for the perl module Test::Harness to
|
||||
see what other HARNESS_* variables there are.
|
||||
|
||||
If you find a problem with OpenSSL itself, try removing any
|
||||
compiler optimization flags from the CFLAGS line in Makefile and
|
||||
run "make clean; make" or corresponding.
|
||||
|
||||
To report a bug please open an issue on GitHub, at
|
||||
https://github.com/openssl/openssl/issues.
|
||||
|
||||
For more details on how the make variables TESTS can be used,
|
||||
see section TESTS in Detail below.
|
||||
|
||||
4. If everything tests ok, install OpenSSL with
|
||||
|
||||
$ make install # Unix
|
||||
$ mms install ! OpenVMS
|
||||
$ nmake install # Windows
|
||||
|
||||
Note that in order to perform the install step above you need to have
|
||||
appropriate permissions to write to the installation directory.
|
||||
|
||||
The above commands will install all the software components in this
|
||||
directory tree under PREFIX (the directory given with --prefix or its
|
||||
default):
|
||||
|
||||
Unix:
|
||||
|
||||
bin/ Contains the openssl binary and a few other
|
||||
utility scripts.
|
||||
include/openssl
|
||||
Contains the header files needed if you want
|
||||
to build your own programs that use libcrypto
|
||||
or libssl.
|
||||
lib Contains the OpenSSL library files.
|
||||
lib/engines Contains the OpenSSL dynamically loadable engines.
|
||||
|
||||
share/man/man1 Contains the OpenSSL command line man-pages.
|
||||
share/man/man3 Contains the OpenSSL library calls man-pages.
|
||||
share/man/man5 Contains the OpenSSL configuration format man-pages.
|
||||
share/man/man7 Contains the OpenSSL other misc man-pages.
|
||||
|
||||
share/doc/openssl/html/man1
|
||||
share/doc/openssl/html/man3
|
||||
share/doc/openssl/html/man5
|
||||
share/doc/openssl/html/man7
|
||||
Contains the HTML rendition of the man-pages.
|
||||
|
||||
OpenVMS ('arch' is replaced with the architecture name, "Alpha"
|
||||
or "ia64", 'sover' is replaced with the shared library version
|
||||
(0101 for 1.1), and 'pz' is replaced with the pointer size
|
||||
OpenSSL was built with):
|
||||
|
||||
[.EXE.'arch'] Contains the openssl binary.
|
||||
[.EXE] Contains a few utility scripts.
|
||||
[.include.openssl]
|
||||
Contains the header files needed if you want
|
||||
to build your own programs that use libcrypto
|
||||
or libssl.
|
||||
[.LIB.'arch'] Contains the OpenSSL library files.
|
||||
[.ENGINES'sover''pz'.'arch']
|
||||
Contains the OpenSSL dynamically loadable engines.
|
||||
[.SYS$STARTUP] Contains startup, login and shutdown scripts.
|
||||
These define appropriate logical names and
|
||||
command symbols.
|
||||
[.SYSTEST] Contains the installation verification procedure.
|
||||
[.HTML] Contains the HTML rendition of the manual pages.
|
||||
|
||||
|
||||
Additionally, install will add the following directories under
|
||||
OPENSSLDIR (the directory given with --openssldir or its default)
|
||||
for you convenience:
|
||||
|
||||
certs Initially empty, this is the default location
|
||||
for certificate files.
|
||||
private Initially empty, this is the default location
|
||||
for private key files.
|
||||
misc Various scripts.
|
||||
|
||||
The installation directory should be appropriately protected to ensure
|
||||
unprivileged users cannot make changes to OpenSSL binaries or files, or
|
||||
install engines. If you already have a pre-installed version of OpenSSL as
|
||||
part of your Operating System it is recommended that you do not overwrite
|
||||
the system version and instead install to somewhere else.
|
||||
|
||||
Package builders who want to configure the library for standard
|
||||
locations, but have the package installed somewhere else so that
|
||||
it can easily be packaged, can use
|
||||
|
||||
$ make DESTDIR=/tmp/package-root install # Unix
|
||||
$ mms/macro="DESTDIR=TMP:[PACKAGE-ROOT]" install ! OpenVMS
|
||||
|
||||
The specified destination directory will be prepended to all
|
||||
installation target paths.
|
||||
|
||||
Compatibility issues with previous OpenSSL versions:
|
||||
|
||||
* COMPILING existing applications
|
||||
|
||||
Starting with version 1.1.0, OpenSSL hides a number of structures
|
||||
that were previously open. This includes all internal libssl
|
||||
structures and a number of EVP types. Accessor functions have
|
||||
been added to allow controlled access to the structures' data.
|
||||
|
||||
This means that some software needs to be rewritten to adapt to
|
||||
the new ways of doing things. This often amounts to allocating
|
||||
an instance of a structure explicitly where you could previously
|
||||
allocate them on the stack as automatic variables, and using the
|
||||
provided accessor functions where you would previously access a
|
||||
structure's field directly.
|
||||
|
||||
Some APIs have changed as well. However, older APIs have been
|
||||
preserved when possible.
|
||||
|
||||
Environment Variables
|
||||
---------------------
|
||||
|
||||
A number of environment variables can be used to provide additional control
|
||||
over the build process. Typically these should be defined prior to running
|
||||
config or Configure. Not all environment variables are relevant to all
|
||||
platforms.
|
||||
|
||||
AR
|
||||
The name of the ar executable to use.
|
||||
|
||||
BUILDFILE
|
||||
Use a different build file name than the platform default
|
||||
("Makefile" on Unix-like platforms, "makefile" on native Windows,
|
||||
"descrip.mms" on OpenVMS). This requires that there is a
|
||||
corresponding build file template. See Configurations/README
|
||||
for further information.
|
||||
|
||||
CC
|
||||
The compiler to use. Configure will attempt to pick a default
|
||||
compiler for your platform but this choice can be overridden
|
||||
using this variable. Set it to the compiler executable you wish
|
||||
to use, e.g. "gcc" or "clang".
|
||||
|
||||
CROSS_COMPILE
|
||||
This environment variable has the same meaning as for the
|
||||
"--cross-compile-prefix" Configure flag described above. If both
|
||||
are set then the Configure flag takes precedence.
|
||||
|
||||
NM
|
||||
The name of the nm executable to use.
|
||||
|
||||
OPENSSL_LOCAL_CONFIG_DIR
|
||||
OpenSSL comes with a database of information about how it
|
||||
should be built on different platforms as well as build file
|
||||
templates for those platforms. The database is comprised of
|
||||
".conf" files in the Configurations directory. The build
|
||||
file templates reside there as well as ".tmpl" files. See the
|
||||
file Configurations/README for further information about the
|
||||
format of ".conf" files as well as information on the ".tmpl"
|
||||
files.
|
||||
In addition to the standard ".conf" and ".tmpl" files, it is
|
||||
possible to create your own ".conf" and ".tmpl" files and store
|
||||
them locally, outside the OpenSSL source tree. This environment
|
||||
variable can be set to the directory where these files are held
|
||||
and will be considered by Configure before it looks in the
|
||||
standard directories.
|
||||
|
||||
PERL
|
||||
The name of the Perl executable to use when building OpenSSL.
|
||||
This variable is used in config script only. Configure on the
|
||||
other hand imposes the interpreter by which it itself was
|
||||
executed on the whole build procedure.
|
||||
|
||||
HASHBANGPERL
|
||||
The command string for the Perl executable to insert in the
|
||||
#! line of perl scripts that will be publicly installed.
|
||||
Default: /usr/bin/env perl
|
||||
Note: the value of this variable is added to the same scripts
|
||||
on all platforms, but it's only relevant on Unix-like platforms.
|
||||
|
||||
RC
|
||||
The name of the rc executable to use. The default will be as
|
||||
defined for the target platform in the ".conf" file. If not
|
||||
defined then "windres" will be used. The WINDRES environment
|
||||
variable is synonymous to this. If both are defined then RC
|
||||
takes precedence.
|
||||
|
||||
RANLIB
|
||||
The name of the ranlib executable to use.
|
||||
|
||||
WINDRES
|
||||
See RC.
|
||||
|
||||
Makefile targets
|
||||
----------------
|
||||
|
||||
The Configure script generates a Makefile in a format relevant to the specific
|
||||
platform. The Makefiles provide a number of targets that can be used. Not all
|
||||
targets may be available on all platforms. Only the most common targets are
|
||||
described here. Examine the Makefiles themselves for the full list.
|
||||
|
||||
all
|
||||
The target to build all the software components and
|
||||
documentation.
|
||||
|
||||
build_sw
|
||||
Build all the software components.
|
||||
THIS IS THE DEFAULT TARGET.
|
||||
|
||||
build_docs
|
||||
Build all documentation components.
|
||||
|
||||
clean
|
||||
Remove all build artefacts and return the directory to a "clean"
|
||||
state.
|
||||
|
||||
depend
|
||||
Rebuild the dependencies in the Makefiles. This is a legacy
|
||||
option that no longer needs to be used since OpenSSL 1.1.0.
|
||||
|
||||
install
|
||||
Install all OpenSSL components.
|
||||
|
||||
install_sw
|
||||
Only install the OpenSSL software components.
|
||||
|
||||
install_docs
|
||||
Only install the OpenSSL documentation components.
|
||||
|
||||
install_man_docs
|
||||
Only install the OpenSSL man pages (Unix only).
|
||||
|
||||
install_html_docs
|
||||
Only install the OpenSSL html documentation.
|
||||
|
||||
list-tests
|
||||
Prints a list of all the self test names.
|
||||
|
||||
test
|
||||
Build and run the OpenSSL self tests.
|
||||
|
||||
uninstall
|
||||
Uninstall all OpenSSL components.
|
||||
|
||||
reconfigure
|
||||
reconf
|
||||
Re-run the configuration process, as exactly as the last time
|
||||
as possible.
|
||||
|
||||
update
|
||||
This is a developer option. If you are developing a patch for
|
||||
OpenSSL you may need to use this if you want to update
|
||||
automatically generated files; add new error codes or add new
|
||||
(or change the visibility of) public API functions. (Unix only).
|
||||
|
||||
TESTS in Detail
|
||||
---------------
|
||||
|
||||
The make variable TESTS supports a versatile set of space separated tokens
|
||||
with which you can specify a set of tests to be performed. With a "current
|
||||
set of tests" in mind, initially being empty, here are the possible tokens:
|
||||
|
||||
alltests The current set of tests becomes the whole set of available
|
||||
tests (as listed when you do 'make list-tests' or similar).
|
||||
xxx Adds the test 'xxx' to the current set of tests.
|
||||
-xxx Removes 'xxx' from the current set of tests. If this is the
|
||||
first token in the list, the current set of tests is first
|
||||
assigned the whole set of available tests, effectively making
|
||||
this token equivalent to TESTS="alltests -xxx".
|
||||
nn Adds the test group 'nn' (which is a number) to the current
|
||||
set of tests.
|
||||
-nn Removes the test group 'nn' from the current set of tests.
|
||||
If this is the first token in the list, the current set of
|
||||
tests is first assigned the whole set of available tests,
|
||||
effectively making this token equivalent to
|
||||
TESTS="alltests -xxx".
|
||||
|
||||
Also, all tokens except for "alltests" may have wildcards, such as *.
|
||||
(on Unix and Windows, BSD style wildcards are supported, while on VMS,
|
||||
it's VMS style wildcards)
|
||||
|
||||
Example: All tests except for the fuzz tests:
|
||||
|
||||
$ make TESTS=-test_fuzz test
|
||||
|
||||
or (if you want to be explicit)
|
||||
|
||||
$ make TESTS='alltests -test_fuzz' test
|
||||
|
||||
Example: All tests that have a name starting with "test_ssl" but not those
|
||||
starting with "test_ssl_":
|
||||
|
||||
$ make TESTS='test_ssl* -test_ssl_*' test
|
||||
|
||||
Example: Only test group 10:
|
||||
|
||||
$ make TESTS='10'
|
||||
|
||||
Example: All tests except the slow group (group 99):
|
||||
|
||||
$ make TESTS='-99'
|
||||
|
||||
Example: All tests in test groups 80 to 99 except for tests in group 90:
|
||||
|
||||
$ make TESTS='[89]? -90'
|
||||
|
||||
To stochastically verify that the algorithm that produces uniformly distributed
|
||||
random numbers is operating correctly (with a false positive rate of 0.01%):
|
||||
|
||||
$ ./util/shlib_wrap.sh test/bntest -stochastic
|
||||
|
||||
Note on multi-threading
|
||||
-----------------------
|
||||
|
||||
For some systems, the OpenSSL Configure script knows what compiler options
|
||||
are needed to generate a library that is suitable for multi-threaded
|
||||
applications. On these systems, support for multi-threading is enabled
|
||||
by default; use the "no-threads" option to disable (this should never be
|
||||
necessary).
|
||||
|
||||
On other systems, to enable support for multi-threading, you will have
|
||||
to specify at least two options: "threads", and a system-dependent option.
|
||||
(The latter is "-D_REENTRANT" on various systems.) The default in this
|
||||
case, obviously, is not to include support for multi-threading (but
|
||||
you can still use "no-threads" to suppress an annoying warning message
|
||||
from the Configure script.)
|
||||
|
||||
OpenSSL provides built-in support for two threading models: pthreads (found on
|
||||
most UNIX/Linux systems), and Windows threads. No other threading models are
|
||||
supported. If your platform does not provide pthreads or Windows threads then
|
||||
you should Configure with the "no-threads" option.
|
||||
|
||||
Notes on shared libraries
|
||||
-------------------------
|
||||
|
||||
For most systems the OpenSSL Configure script knows what is needed to
|
||||
build shared libraries for libcrypto and libssl. On these systems
|
||||
the shared libraries will be created by default. This can be suppressed and
|
||||
only static libraries created by using the "no-shared" option. On systems
|
||||
where OpenSSL does not know how to build shared libraries the "no-shared"
|
||||
option will be forced and only static libraries will be created.
|
||||
|
||||
Shared libraries are named a little differently on different platforms.
|
||||
One way or another, they all have the major OpenSSL version number as
|
||||
part of the file name, i.e. for OpenSSL 1.1.x, 1.1 is somehow part of
|
||||
the name.
|
||||
|
||||
On most POSIX platforms, shared libraries are named libcrypto.so.1.1
|
||||
and libssl.so.1.1.
|
||||
|
||||
on Cygwin, shared libraries are named cygcrypto-1.1.dll and cygssl-1.1.dll
|
||||
with import libraries libcrypto.dll.a and libssl.dll.a.
|
||||
|
||||
On Windows build with MSVC or using MingW, shared libraries are named
|
||||
libcrypto-1_1.dll and libssl-1_1.dll for 32-bit Windows, libcrypto-1_1-x64.dll
|
||||
and libssl-1_1-x64.dll for 64-bit x86_64 Windows, and libcrypto-1_1-ia64.dll
|
||||
and libssl-1_1-ia64.dll for IA64 Windows. With MSVC, the import libraries
|
||||
are named libcrypto.lib and libssl.lib, while with MingW, they are named
|
||||
libcrypto.dll.a and libssl.dll.a.
|
||||
|
||||
On VMS, shareable images (VMS speak for shared libraries) are named
|
||||
ossl$libcrypto0101_shr.exe and ossl$libssl0101_shr.exe. However, when
|
||||
OpenSSL is specifically built for 32-bit pointers, the shareable images
|
||||
are named ossl$libcrypto0101_shr32.exe and ossl$libssl0101_shr32.exe
|
||||
instead, and when built for 64-bit pointers, they are named
|
||||
ossl$libcrypto0101_shr64.exe and ossl$libssl0101_shr64.exe.
|
||||
|
||||
Note on random number generation
|
||||
--------------------------------
|
||||
|
||||
Availability of cryptographically secure random numbers is required for
|
||||
secret key generation. OpenSSL provides several options to seed the
|
||||
internal CSPRNG. If not properly seeded, the internal CSPRNG will refuse
|
||||
to deliver random bytes and a "PRNG not seeded error" will occur.
|
||||
|
||||
The seeding method can be configured using the --with-rand-seed option,
|
||||
which can be used to specify a comma separated list of seed methods.
|
||||
However in most cases OpenSSL will choose a suitable default method,
|
||||
so it is not necessary to explicitly provide this option. Note also
|
||||
that not all methods are available on all platforms.
|
||||
|
||||
I) On operating systems which provide a suitable randomness source (in
|
||||
form of a system call or system device), OpenSSL will use the optimal
|
||||
available method to seed the CSPRNG from the operating system's
|
||||
randomness sources. This corresponds to the option --with-rand-seed=os.
|
||||
|
||||
II) On systems without such a suitable randomness source, automatic seeding
|
||||
and reseeding is disabled (--with-rand-seed=none) and it may be necessary
|
||||
to install additional support software to obtain a random seed and reseed
|
||||
the CSPRNG manually. Please check out the manual pages for RAND_add(),
|
||||
RAND_bytes(), RAND_egd(), and the FAQ for more information.
|
||||
+1795
@@ -0,0 +1,1795 @@
|
||||
Build and Install
|
||||
=================
|
||||
|
||||
This document describes installation on all supported operating
|
||||
systems (the Unix/Linux family, including macOS), OpenVMS,
|
||||
and Windows).
|
||||
|
||||
Table of Contents
|
||||
=================
|
||||
|
||||
- [Prerequisites](#prerequisites)
|
||||
- [Notational Conventions](#notational-conventions)
|
||||
- [Quick Installation Guide](#quick-installation-guide)
|
||||
- [Building OpenSSL](#building-openssl)
|
||||
- [Installing OpenSSL](#installing-openssl)
|
||||
- [Configuration Options](#configuration-options)
|
||||
- [API Level](#api-level)
|
||||
- [Cross Compile Prefix](#cross-compile-prefix)
|
||||
- [Build Type](#build-type)
|
||||
- [Directories](#directories)
|
||||
- [Compiler Warnings](#compiler-warnings)
|
||||
- [ZLib Flags](#zlib-flags)
|
||||
- [Seeding the Random Generator](#seeding-the-random-generator)
|
||||
- [Enable and Disable Features](#enable-and-disable-features)
|
||||
- [Displaying configuration data](#displaying-configuration-data)
|
||||
- [Installation Steps in Detail](#installation-steps-in-detail)
|
||||
- [Configure](#configure-openssl)
|
||||
- [Build](#build-openssl)
|
||||
- [Test](#test-openssl)
|
||||
- [Install](#install-openssl)
|
||||
- [Advanced Build Options](#advanced-build-options)
|
||||
- [Environment Variables](#environment-variables)
|
||||
- [Makefile Targets](#makefile-targets)
|
||||
- [Running Selected Tests](#running-selected-tests)
|
||||
- [Troubleshooting](#troubleshooting)
|
||||
- [Configuration Problems](#configuration-problems)
|
||||
- [Build Failures](#build-failures)
|
||||
- [Test Failures](#test-failures)
|
||||
- [Notes](#notes)
|
||||
- [Notes on multi-threading](#notes-on-multi-threading)
|
||||
- [Notes on shared libraries](#notes-on-shared-libraries)
|
||||
- [Notes on random number generation](#notes-on-random-number-generation)
|
||||
|
||||
Prerequisites
|
||||
=============
|
||||
|
||||
To install OpenSSL, you will need:
|
||||
|
||||
* A make implementation
|
||||
* Perl 5 with core modules (please read [NOTES.PERL](NOTES.PERL))
|
||||
* The Perl module Text::Template (please read [NOTES.PERL](NOTES.PERL))
|
||||
* an ANSI C compiler
|
||||
* a development environment in the form of development libraries and C
|
||||
header files
|
||||
* a supported operating system
|
||||
|
||||
For additional platform specific requirements, solutions to specific
|
||||
issues and other details, please read one of these:
|
||||
|
||||
* [NOTES.UNIX](NOTES.UNIX) - notes for Unix like systems
|
||||
* [NOTES.VMS](NOTES.VMS) - notes related to OpenVMS
|
||||
* [NOTES.WIN](NOTES.WIN) - notes related to the Windows platform
|
||||
* [NOTES.DJGPP](NOTES.DJGPP) - building for DOS with DJGPP
|
||||
* [NOTES.ANDROID](NOTES.ANDROID) - building for Android platforms (using NDK)
|
||||
* [NOTES.VALGRIND](NOTES.VALGRIND) - testing with Valgrind
|
||||
* [NOTES.PERL](NOTES.PERL) - some notes on Perl
|
||||
|
||||
Notational conventions
|
||||
======================
|
||||
|
||||
Throughout this document, we use the following conventions.
|
||||
|
||||
Commands
|
||||
--------
|
||||
|
||||
Any line starting with a dollar sign is a command line.
|
||||
|
||||
$ command
|
||||
|
||||
The dollar sign indicates the shell prompt and is not to be entered as
|
||||
part of the command.
|
||||
|
||||
Choices
|
||||
-------
|
||||
|
||||
Several words in curly braces separated by pipe characters indicate a
|
||||
**mandatory choice**, to be replaced with one of the given words.
|
||||
For example, the line
|
||||
|
||||
$ echo { WORD1 | WORD2 | WORD3 }
|
||||
|
||||
represents one of the following three commands
|
||||
|
||||
$ echo WORD1
|
||||
- or -
|
||||
$ echo WORD2
|
||||
- or -
|
||||
$ echo WORD3
|
||||
|
||||
One or several words in square brackets separated by pipe characters
|
||||
denote an **optional choice**. It is similar to the mandatory choice,
|
||||
but it can also be omitted entirely.
|
||||
|
||||
So the line
|
||||
|
||||
$ echo [ WORD1 | WORD2 | WORD3 ]
|
||||
|
||||
represents one of the four commands
|
||||
|
||||
$ echo WORD1
|
||||
- or -
|
||||
$ echo WORD2
|
||||
- or -
|
||||
$ echo WORD3
|
||||
- or -
|
||||
$ echo
|
||||
|
||||
Arguments
|
||||
---------
|
||||
|
||||
**Mandatory arguments** are enclosed in double curly braces.
|
||||
A simple example would be
|
||||
|
||||
$ type {{ filename }}
|
||||
|
||||
which is to be understood to use the command `type` on some file name
|
||||
determined by the user.
|
||||
|
||||
**Optional Arguments** are enclosed in double square brackets.
|
||||
|
||||
[[ options ]]
|
||||
|
||||
Note that the notation assumes spaces around {, }, [, ], {{, }} and
|
||||
[[, ]]. This is to differentiate from OpenVMS directory
|
||||
specifications, which also use [ and ], but without spaces.
|
||||
|
||||
Quick Installation Guide
|
||||
========================
|
||||
|
||||
If you just want to get OpenSSL installed without bothering too much
|
||||
about the details, here is the short version of how to build and install
|
||||
OpenSSL. If any of the following steps fails, please consult the
|
||||
[Installation in Detail](#installation-in-detail) section below.
|
||||
|
||||
Building OpenSSL
|
||||
----------------
|
||||
|
||||
Use the following commands to configure, build and test OpenSSL.
|
||||
The testing is optional, but recommended if you intend to install
|
||||
OpenSSL for production use.
|
||||
|
||||
### Unix / Linux / macOS
|
||||
|
||||
$ ./config
|
||||
$ make
|
||||
$ make test
|
||||
|
||||
### OpenVMS
|
||||
|
||||
Use the following commands to build OpenSSL:
|
||||
|
||||
$ @config
|
||||
$ mms
|
||||
$ mms test
|
||||
|
||||
### Windows
|
||||
|
||||
If you are using Visual Studio, open a Developer Command Prompt and
|
||||
and issue the following commands to build OpenSSL.
|
||||
|
||||
$ perl Configure { VC-WIN32 | VC-WIN64A | VC-WIN64I | VC-CE }
|
||||
$ nmake
|
||||
$ nmake test
|
||||
|
||||
As mentioned in the [Choices](#choices) section, you need to pick one
|
||||
of the four Configure targets in the first command.
|
||||
|
||||
Most likely you will be using the VC-WIN64A target for 64bit Windows
|
||||
binaries (AMD64) or VC-WIN32 for 32bit Windows binaries (X86).
|
||||
The other two options are VC_WIN64I (Intel IA64, Itanium) and
|
||||
VC-CE (Windows CE) are rather uncommon nowadays.
|
||||
|
||||
Installing OpenSSL
|
||||
------------------
|
||||
|
||||
The following commands will install OpenSSL to a default system location.
|
||||
|
||||
**Danger Zone:** even if you are impatient, please read the following two
|
||||
paragraphs carefully before you install OpenSSL.
|
||||
|
||||
For security reasons the default system location is by default not writable
|
||||
for unprivileged users. So for the final installation step administrative
|
||||
privileges are required. The default system location and the procedure to
|
||||
obtain administrative privileges depends on the operating sytem.
|
||||
It is recommended to compile and test OpenSSL with normal user privileges
|
||||
and use administrative privileges only for the final installation step.
|
||||
|
||||
On some platforms OpenSSL is preinstalled as part of the Operating System.
|
||||
In this case it is highly recommended not to overwrite the system versions,
|
||||
because other applications or libraries might depend on it.
|
||||
To avoid breaking other applications, install your copy of OpenSSL to a
|
||||
[different location](#installing-to-a-different-location) which is not in
|
||||
the global search path for system libraries.
|
||||
|
||||
Finally, if you plan on using the FIPS module, you need to read the
|
||||
[Post-installation Notes](#post-installation-notes) further down.
|
||||
|
||||
### Unix / Linux / macOS
|
||||
|
||||
Depending on your distribution, you need to run the following command as
|
||||
root user or prepend `sudo` to the command:
|
||||
|
||||
$ make install
|
||||
|
||||
By default, OpenSSL will be installed to
|
||||
|
||||
/usr/local
|
||||
|
||||
More precisely, the files will be installed into the subdirectories
|
||||
|
||||
/usr/local/bin
|
||||
/usr/local/lib
|
||||
/usr/local/include
|
||||
...
|
||||
|
||||
depending on the file type, as it is custom on Unix-like operating systems.
|
||||
|
||||
### OpenVMS
|
||||
|
||||
Use the following command to install OpenSSL.
|
||||
|
||||
$ mms install
|
||||
|
||||
By default, OpenSSL will be installed to
|
||||
|
||||
SYS$COMMON:[OPENSSL-'version'...]
|
||||
|
||||
where 'version' is the OpenSSL version number with underscores instead
|
||||
of periods.
|
||||
|
||||
### Windows
|
||||
|
||||
If you are using Visual Studio, open the Developer Command Prompt _elevated_
|
||||
and issue the following command.
|
||||
|
||||
$ nmake install
|
||||
|
||||
The easiest way to elevate the Command Prompt is to press and hold down
|
||||
the both the `<CTRL>` and `<SHIFT>` key while clicking the menu item in the
|
||||
task menu.
|
||||
|
||||
The default installation location is
|
||||
|
||||
C:\Program Files\OpenSSL
|
||||
|
||||
for native binaries, or
|
||||
|
||||
C:\Program Files (x86)\OpenSSL
|
||||
|
||||
for 32bit binaries on 64bit Windows (WOW64).
|
||||
|
||||
#### Installing to a different location
|
||||
|
||||
To install OpenSSL to a different location (for example into your home
|
||||
directory for testing purposes) run config as shown in the following
|
||||
examples.
|
||||
|
||||
On Unix:
|
||||
|
||||
$ ./config --prefix=/opt/openssl --openssldir=/usr/local/ssl
|
||||
|
||||
On OpenVMS:
|
||||
|
||||
$ @config --prefix=PROGRAM:[INSTALLS] --openssldir=SYS$MANAGER:[OPENSSL]
|
||||
|
||||
Note: if you do add options to the configuration command, please make sure
|
||||
you've read more than just this Quick Start, such as relevant `NOTES.*` files,
|
||||
the options outline below, as configuration options may change the outcome
|
||||
in otherwise unexpected ways.
|
||||
|
||||
Configuration Options
|
||||
=====================
|
||||
|
||||
There are several options to ./config (or ./Configure) to customize
|
||||
the build (note that for Windows, the defaults for `--prefix` and
|
||||
`--openssldir` depend in what configuration is used and what Windows
|
||||
implementation OpenSSL is built on. More notes on this in NOTES.WIN):
|
||||
|
||||
API Level
|
||||
---------
|
||||
|
||||
--api=x.y[.z]
|
||||
|
||||
Build the OpenSSL libraries to support the API for the specified version.
|
||||
If [no-deprecated](#no-deprecated) is also given, don't build with support
|
||||
for deprecated APIs in or below the specified version number. For example,
|
||||
addding
|
||||
|
||||
--api=1.1.0 no-deprecated
|
||||
|
||||
will remove support for all APIs that were deprecated in OpenSSL version
|
||||
1.1.0 or below. This is a rather specialized option for developers.
|
||||
If you just intend to remove all deprecated APIs up to the current version
|
||||
entirely, just specify [no-deprecated](#no-deprecated).
|
||||
If `--api` isn't given, it defaults to the current (minor) OpenSSL version.
|
||||
|
||||
Cross Compile Prefix
|
||||
--------------------
|
||||
|
||||
--cross-compile-prefix=PREFIX
|
||||
|
||||
The PREFIX to include in front of commands for your toolchain.
|
||||
|
||||
It is likely to have to end with dash, e.g. a-b-c- would invoke GNU compiler as
|
||||
a-b-c-gcc, etc. Unfortunately cross-compiling is too case-specific to put
|
||||
together one-size-fits-all instructions. You might have to pass more flags or
|
||||
set up environment variables to actually make it work. Android and iOS cases are
|
||||
discussed in corresponding `Configurations/15-*.conf` files. But there are cases
|
||||
when this option alone is sufficient. For example to build the mingw64 target on
|
||||
Linux `--cross-compile-prefix=x86_64-w64-mingw32-` works. Naturally provided
|
||||
that mingw packages are installed. Today Debian and Ubuntu users have option to
|
||||
install a number of prepackaged cross-compilers along with corresponding
|
||||
run-time and development packages for "alien" hardware. To give another example
|
||||
`--cross-compile-prefix=mipsel-linux-gnu-` suffices in such case. Needless to
|
||||
mention that you have to invoke `./Configure`, not `./config`, and pass your target
|
||||
name explicitly. Also, note that `--openssldir` refers to target's file system,
|
||||
not one you are building on.
|
||||
|
||||
Build Type
|
||||
----------
|
||||
|
||||
--debug
|
||||
|
||||
Build OpenSSL with debugging symbols and zero optimization level.
|
||||
|
||||
--release
|
||||
|
||||
Build OpenSSL without debugging symbols. This is the default.
|
||||
|
||||
Directories
|
||||
-----------
|
||||
|
||||
### libdir
|
||||
|
||||
--libdir=DIR
|
||||
|
||||
The name of the directory under the top of the installation directory tree
|
||||
(see the `--prefix` option) where libraries will be installed. By default
|
||||
this is "lib". Note that on Windows only static libraries (`*.lib`) will
|
||||
be stored in this location. Shared libraries (`*.dll`) will always be
|
||||
installed to the "bin" directory.
|
||||
|
||||
### openssldir
|
||||
|
||||
--openssldir=DIR
|
||||
|
||||
Directory for OpenSSL configuration files, and also the default certificate
|
||||
and key store. Defaults are:
|
||||
|
||||
Unix: /usr/local/ssl
|
||||
Windows: C:\Program Files\Common Files\SSL
|
||||
OpenVMS: SYS$COMMON:[OPENSSL-COMMON]
|
||||
|
||||
For 32bit Windows applications on Windows 64bit (WOW64), always replace
|
||||
`C:\Program Files` by `C:\Program Files (x86)`.
|
||||
|
||||
### prefix
|
||||
|
||||
--prefix=DIR
|
||||
|
||||
The top of the installation directory tree. Defaults are:
|
||||
|
||||
Unix: /usr/local
|
||||
Windows: C:\Program Files\OpenSSL
|
||||
OpenVMS: SYS$COMMON:[OPENSSL-'version']
|
||||
|
||||
Compiler Warnings
|
||||
-----------------
|
||||
|
||||
--strict-warnings
|
||||
|
||||
This is a developer flag that switches on various compiler options recommended
|
||||
for OpenSSL development. It only works when using gcc or clang as the compiler.
|
||||
If you are developing a patch for OpenSSL then it is recommended that you use
|
||||
this option where possible.
|
||||
|
||||
ZLib Flags
|
||||
----------
|
||||
|
||||
### with-zlib-include
|
||||
|
||||
--with-zlib-include=DIR
|
||||
|
||||
The directory for the location of the zlib include file. This option is only
|
||||
necessary if [enable-zlib](#enable-zlib) is used and the include file is not
|
||||
already on the system include path.
|
||||
|
||||
### with-zlib-lib
|
||||
|
||||
--with-zlib-lib=LIB
|
||||
|
||||
**On Unix**: this is the directory containing the zlib library.
|
||||
If not provided the system library path will be used.
|
||||
|
||||
**On Windows:** this is the filename of the zlib library (with or
|
||||
without a path). This flag must be provided if the
|
||||
[zlib-dynamic](#zlib-dynamic) option is not also used. If zlib-dynamic is used
|
||||
then this flag is optional and defaults to "ZLIB1" if not provided.
|
||||
|
||||
**On VMS:** this is the filename of the zlib library (with or without a path).
|
||||
This flag is optional and if not provided then "GNV$LIBZSHR", "GNV$LIBZSHR32"
|
||||
or "GNV$LIBZSHR64" is used by default depending on the pointer size chosen.
|
||||
|
||||
Seeding the Random Generator
|
||||
----------------------------
|
||||
|
||||
--with-rand-seed=seed1[,seed2,...]
|
||||
|
||||
A comma separated list of seeding methods which will be tried by OpenSSL
|
||||
in order to obtain random input (a.k.a "entropy") for seeding its
|
||||
cryptographically secure random number generator (CSPRNG).
|
||||
The current seeding methods are:
|
||||
|
||||
### os
|
||||
|
||||
Use a trusted operating system entropy source.
|
||||
This is the default method if such an entropy source exists.
|
||||
|
||||
### getrandom
|
||||
|
||||
Use the [getrandom(2)][man-getrandom] or equivalent system call.
|
||||
|
||||
[man-getrandom]: http://man7.org/linux/man-pages/man2/getrandom.2.html
|
||||
|
||||
### devrandom
|
||||
|
||||
Use the first device from the DEVRANDOM list which can be opened to read
|
||||
random bytes. The DEVRANDOM preprocessor constant expands to
|
||||
|
||||
"/dev/urandom","/dev/random","/dev/srandom"
|
||||
|
||||
on most unix-ish operating systems.
|
||||
|
||||
### egd
|
||||
|
||||
Check for an entropy generating daemon.
|
||||
|
||||
### rdcpu
|
||||
|
||||
Use the RDSEED or RDRAND command if provided by the CPU.
|
||||
|
||||
### librandom
|
||||
|
||||
Use librandom (not implemented yet).
|
||||
|
||||
### none
|
||||
|
||||
Disable automatic seeding. This is the default on some operating systems where
|
||||
no suitable entropy source exists, or no support for it is implemented yet.
|
||||
|
||||
For more information, see the section [Notes on random number generation][rng]
|
||||
at the end of this document.
|
||||
|
||||
[rng]: #notes-on-random-number-generation
|
||||
|
||||
Enable and Disable Features
|
||||
---------------------------
|
||||
|
||||
Feature options always come in pairs, an option to enable feature xxxx, and
|
||||
and option to disable it:
|
||||
|
||||
[ enable-xxxx | no-xxxx ]
|
||||
|
||||
Whether a feature is enabled or disabled by default, depends on the feature.
|
||||
In the following list, always the non-default variant is documented: if
|
||||
feature xxxx is disabled by default then enable-xxxx is documented and
|
||||
if feature xxxx is enabled by default then no-xxxx is documented.
|
||||
|
||||
### no-afalgeng
|
||||
|
||||
Don't build the AFALG engine.
|
||||
|
||||
This option will be forced on a platform that does not support AFALG.
|
||||
|
||||
### enable-ktls
|
||||
|
||||
Build with Kernel TLS support.
|
||||
|
||||
This option will enable the use of the Kernel TLS data-path, which can improve
|
||||
performance and allow for the use of sendfile and splice system calls on
|
||||
TLS sockets. The Kernel may use TLS accelerators if any are available on the
|
||||
system. This option will be forced off on systems that do not support the
|
||||
Kernel TLS data-path.
|
||||
|
||||
### enable-asan
|
||||
|
||||
Build with the Address sanitiser.
|
||||
|
||||
This is a developer option only. It may not work on all platforms and should
|
||||
never be used in production environments. It will only work when used with
|
||||
gcc or clang and should be used in conjunction with the [no-shared](#no-shared)
|
||||
option.
|
||||
|
||||
### no-asm
|
||||
|
||||
Do not use assembler code.
|
||||
|
||||
This should be viewed as debugging/troubleshooting option rather than for
|
||||
production use. On some platforms a small amount of assembler code may still
|
||||
be used even with this option.
|
||||
|
||||
### no-async
|
||||
|
||||
Do not build support for async operations.
|
||||
|
||||
### no-autoalginit
|
||||
|
||||
Don't automatically load all supported ciphers and digests.
|
||||
|
||||
Typically OpenSSL will make available all of its supported ciphers and digests.
|
||||
For a statically linked application this may be undesirable if small executable
|
||||
size is an objective. This only affects libcrypto. Ciphers and digests will
|
||||
have to be loaded manually using EVP_add_cipher() and EVP_add_digest() if this
|
||||
option is used. This option will force a non-shared build.
|
||||
|
||||
### no-autoerrinit
|
||||
|
||||
Don't automatically load all libcrypto/libssl error strings.
|
||||
|
||||
Typically OpenSSL will automatically load human readable error strings. For a
|
||||
statically linked application this may be undesirable if small executable size
|
||||
is an objective.
|
||||
|
||||
### no-autoload-config
|
||||
|
||||
Don't automatically load the default openssl.cnf file.
|
||||
|
||||
Typically OpenSSL will automatically load a system config file which configures
|
||||
default SSL options.
|
||||
|
||||
### enable-buildtest-c++
|
||||
|
||||
While testing, generate C++ buildtest files that simply check that the public
|
||||
OpenSSL header files are usable standalone with C++.
|
||||
|
||||
Enabling this option demands extra care. For any compiler flag given directly
|
||||
as configuration option, you must ensure that it's valid for both the C and
|
||||
the C++ compiler. If not, the C++ build test will most likely break. As an
|
||||
alternative, you can use the language specific variables, CFLAGS and CXXFLAGS.
|
||||
|
||||
### no-capieng
|
||||
|
||||
Don't build the CAPI engine.
|
||||
|
||||
This option will be forced if on a platform that does not support CAPI.
|
||||
|
||||
### no-cmp
|
||||
|
||||
Don't build support for Certificate Management Protocol (CMP).
|
||||
|
||||
### no-cms
|
||||
|
||||
Don't build support for Cryptographic Message Syntax (CMS).
|
||||
|
||||
### no-comp
|
||||
|
||||
Don't build support for SSL/TLS compression.
|
||||
|
||||
If this option is enabled (the default), then compression will only work if
|
||||
the zlib or zlib-dynamic options are also chosen.
|
||||
|
||||
### enable-crypto-mdebug
|
||||
|
||||
This now only enables the failed-malloc feature.
|
||||
|
||||
### enable-crypto-mdebug-backtrace
|
||||
|
||||
This is a no-op; the project uses the compiler's address/leak sanitizer instead.
|
||||
|
||||
### no-ct
|
||||
|
||||
Don't build support for Certificate Transparency (CT).
|
||||
|
||||
### no-deprecated
|
||||
|
||||
Don't build with support for deprecated APIs up until and including the version
|
||||
given with `--api` (or the current version, if `--api` wasn't specified).
|
||||
|
||||
### no-dgram
|
||||
|
||||
Don't build support for datagram based BIOs.
|
||||
|
||||
Selecting this option will also force the disabling of DTLS.
|
||||
|
||||
### no-dso
|
||||
|
||||
Don't build support for loading Dynamic Shared Objects (DSO)
|
||||
|
||||
### enable-devcryptoeng
|
||||
|
||||
Build the `/dev/crypto` engine.
|
||||
|
||||
This option is automatically selected on the BSD platform, in which case it can
|
||||
be disabled with no-devcryptoeng.
|
||||
|
||||
### no-dynamic-engine
|
||||
|
||||
Don't build the dynamically loaded engines.
|
||||
|
||||
This only has an effect in a shared build.
|
||||
|
||||
### no-ec
|
||||
|
||||
Don't build support for Elliptic Curves.
|
||||
|
||||
### no-ec2m
|
||||
|
||||
Don't build support for binary Elliptic Curves
|
||||
|
||||
### enable-ec_nistp_64_gcc_128
|
||||
|
||||
Enable support for optimised implementations of some commonly used NIST
|
||||
elliptic curves.
|
||||
|
||||
This option is only supported on platforms:
|
||||
|
||||
- with little-endian storage of non-byte types
|
||||
- that tolerate misaligned memory references
|
||||
- where the compiler:
|
||||
- supports the non-standard type `__uint128_t`
|
||||
- defines the built-in macro `__SIZEOF_INT128__`
|
||||
|
||||
### enable-egd
|
||||
|
||||
Build support for gathering entropy from the Entropy Gathering Daemon (EGD).
|
||||
|
||||
### no-engine
|
||||
|
||||
Don't build support for loading engines.
|
||||
|
||||
### no-err
|
||||
|
||||
Don't compile in any error strings.
|
||||
|
||||
### enable-external-tests
|
||||
|
||||
Enable building of integration with external test suites.
|
||||
|
||||
This is a developer option and may not work on all platforms. The following
|
||||
external test suites are currently supported:
|
||||
|
||||
- BoringSSL test suite
|
||||
- Python PYCA/Cryptography test suite
|
||||
- krb5 test suite
|
||||
|
||||
See the file [test/README.external]/(test/README.external) for further details.
|
||||
|
||||
### no-filenames
|
||||
|
||||
Don't compile in filename and line number information (e.g. for errors and
|
||||
memory allocation).
|
||||
|
||||
### no-fips
|
||||
|
||||
Don't compile the FIPS provider
|
||||
|
||||
### enable-fuzz-libfuzzer, enable-fuzz-afl
|
||||
|
||||
Build with support for fuzzing using either libfuzzer or AFL.
|
||||
|
||||
These are developer options only. They may not work on all platforms and
|
||||
should never be used in production environments.
|
||||
|
||||
See the file [fuzz/README.md](fuzz/README.md) for further details.
|
||||
|
||||
### no-gost
|
||||
|
||||
Don't build support for GOST based ciphersuites.
|
||||
|
||||
Note that if this feature is enabled then GOST ciphersuites are only available
|
||||
if the GOST algorithms are also available through loading an externally supplied
|
||||
engine.
|
||||
|
||||
### no-legacy
|
||||
|
||||
Don't build the legacy provider.
|
||||
|
||||
Disabling this also disables the legacy algorithms: MD2 (already disabled by default).
|
||||
|
||||
### no-makedepend
|
||||
|
||||
Don't generate dependencies.
|
||||
|
||||
### no-module
|
||||
|
||||
Don't build any dynamically loadable engines.
|
||||
|
||||
This also implies 'no-dynamic-engine'.
|
||||
|
||||
### no-multiblock
|
||||
|
||||
Don't build support for writing multiple records in one go in libssl
|
||||
|
||||
Note: this is a different capability to the pipelining functionality.
|
||||
|
||||
### no-nextprotoneg
|
||||
|
||||
Don't build support for the Next Protocol Negotiation (NPN) TLS extension.
|
||||
|
||||
### no-ocsp
|
||||
|
||||
Don't build support for Online Certificate Status Protocol (OCSP).
|
||||
|
||||
### no-padlockeng
|
||||
|
||||
Don't build the padlock engine.
|
||||
|
||||
### no-hw-padlock
|
||||
|
||||
As synonyme for no-padlockeng. Deprecated and should not be used.
|
||||
|
||||
### no-pic
|
||||
|
||||
Don't build with support for Position Independent Code.
|
||||
|
||||
### no-pinshared
|
||||
|
||||
Don't pin the shared libraries.
|
||||
|
||||
By default OpenSSL will attempt to stay in memory until the process exits.
|
||||
This is so that libcrypto and libssl can be properly cleaned up automatically
|
||||
via an atexit() handler. The handler is registered by libcrypto and cleans
|
||||
up both libraries. On some platforms the atexit() handler will run on unload of
|
||||
libcrypto (if it has been dynamically loaded) rather than at process exit. This
|
||||
option can be used to stop OpenSSL from attempting to stay in memory until the
|
||||
process exits. This could lead to crashes if either libcrypto or libssl have
|
||||
already been unloaded at the point that the atexit handler is invoked, e.g. on a
|
||||
platform which calls atexit() on unload of the library, and libssl is unloaded
|
||||
before libcrypto then a crash is likely to happen. Applications can suppress
|
||||
running of the atexit() handler at run time by using the OPENSSL_INIT_NO_ATEXIT
|
||||
option to OPENSSL_init_crypto(). See the man page for it for further details.
|
||||
|
||||
### no-posix-io
|
||||
|
||||
Don't use POSIX IO capabilities.
|
||||
|
||||
### no-psk
|
||||
|
||||
Don't build support for Pre-Shared Key based ciphersuites.
|
||||
|
||||
### no-rdrand
|
||||
|
||||
Don't use hardware RDRAND capabilities.
|
||||
|
||||
### no-rfc3779
|
||||
|
||||
Don't build support for RFC3779, "X.509 Extensions for IP Addresses and
|
||||
AS Identifiers".
|
||||
|
||||
### sctp
|
||||
|
||||
Build support for Stream Control Transmission Protocol (SCTP).
|
||||
|
||||
### no-shared
|
||||
|
||||
Do not create shared libraries, only static ones.
|
||||
|
||||
See [Notes on shared libraries](#notes-on-shared-libraries) below.
|
||||
|
||||
### no-sock
|
||||
|
||||
Don't build support for socket BIOs.
|
||||
|
||||
### no-srp
|
||||
|
||||
Don't build support for Secure Remote Password (SRP) protocol or
|
||||
SRP based ciphersuites.
|
||||
|
||||
### no-srtp
|
||||
|
||||
Don't build Secure Real-Time Transport Protocol (SRTP) support.
|
||||
|
||||
### no-sse2
|
||||
|
||||
Exclude SSE2 code paths from 32-bit x86 assembly modules.
|
||||
|
||||
Normally SSE2 extension is detected at run-time, but the decision whether or not
|
||||
the machine code will be executed is taken solely on CPU capability vector. This
|
||||
means that if you happen to run OS kernel which does not support SSE2 extension
|
||||
on Intel P4 processor, then your application might be exposed to "illegal
|
||||
instruction" exception. There might be a way to enable support in kernel, e.g.
|
||||
FreeBSD kernel can be compiled with CPU_ENABLE_SSE, and there is a way to
|
||||
disengage SSE2 code paths upon application start-up, but if you aim for wider
|
||||
"audience" running such kernel, consider no-sse2. Both the 386 and no-asm
|
||||
options imply no-sse2.
|
||||
|
||||
### enable-ssl-trace
|
||||
|
||||
Build with the SSL Trace capabilities.
|
||||
|
||||
This adds the "-trace" option to s_client and s_server.
|
||||
|
||||
### no-static-engine
|
||||
|
||||
Don't build the statically linked engines.
|
||||
|
||||
This only has an impact when not built "shared".
|
||||
|
||||
### no-stdio
|
||||
|
||||
Don't use anything from the C header file "stdio.h" that makes use of the "FILE"
|
||||
type. Only libcrypto and libssl can be built in this way. Using this option will
|
||||
suppress building the command line applications. Additionally, since the OpenSSL
|
||||
tests also use the command line applications, the tests will also be skipped.
|
||||
|
||||
### no-tests
|
||||
|
||||
Don't build test programs or run any tests.
|
||||
|
||||
### no-threads
|
||||
|
||||
Don't build with support for multi-threaded applications.
|
||||
|
||||
### threads
|
||||
|
||||
Build with support for multi-threaded applications. Most platforms will enable
|
||||
this by default. However if on a platform where this is not the case then this
|
||||
will usually require additional system-dependent options!
|
||||
|
||||
See [Notes on multi-threading](#notes-on-multi-threading) below.
|
||||
|
||||
### enable-trace
|
||||
|
||||
Build with support for the integrated tracing api.
|
||||
|
||||
See manual pages OSSL_trace_set_channel(3) and OSSL_trace_enabled(3) for details.
|
||||
|
||||
### no-ts
|
||||
|
||||
Don't build Time Stamping (TS) Authority support.
|
||||
|
||||
### enable-ubsan
|
||||
|
||||
Build with the Undefined Behaviour sanitiser (UBSAN).
|
||||
|
||||
This is a developer option only. It may not work on all platforms and should
|
||||
never be used in production environments. It will only work when used with gcc
|
||||
or clang and should be used in conjunction with the `-DPEDANTIC` option
|
||||
(or the `--strict-warnings` option).
|
||||
|
||||
### no-ui-console
|
||||
|
||||
Don't build with the User Interface (UI) console method
|
||||
|
||||
The User Interface console method enables text based console prompts.
|
||||
|
||||
### enable-unit-test
|
||||
|
||||
Enable additional unit test APIs.
|
||||
|
||||
This should not typically be used in production deployments.
|
||||
|
||||
### no-uplink
|
||||
|
||||
Don't build support for UPLINK interface.
|
||||
|
||||
### enable-weak-ssl-ciphers
|
||||
|
||||
Build support for SSL/TLS ciphers that are considered "weak"
|
||||
|
||||
Enabling this includes for example the RC4 based ciphersuites.
|
||||
|
||||
### zlib
|
||||
|
||||
Build with support for zlib compression/decompression.
|
||||
|
||||
### zlib-dynamic
|
||||
|
||||
Like the zlib option, but has OpenSSL load the zlib library dynamically
|
||||
when needed.
|
||||
|
||||
This is only supported on systems where loading of shared libraries is supported.
|
||||
|
||||
### 386
|
||||
|
||||
In 32-bit x86 builds, use the 80386 instruction set only in assembly modules
|
||||
|
||||
The default x86 code is more efficient, but requires at least an 486 processor.
|
||||
Note: This doesn't affect compiler generated code, so this option needs to be
|
||||
accompanied by a corresponding compiler-specific option.
|
||||
|
||||
### no-{protocol}
|
||||
|
||||
no-{ssl|ssl3|tls|tls1|tls1_1|tls1_2|tls1_3|dtls|dtls1|dtls1_2}
|
||||
|
||||
Don't build support for negotiating the specified SSL/TLS protocol.
|
||||
|
||||
If "no-tls" is selected then all of tls1, tls1_1, tls1_2 and tls1_3 are disabled.
|
||||
Similarly "no-dtls" will disable dtls1 and dtls1_2. The "no-ssl" option is
|
||||
synonymous with "no-ssl3". Note this only affects version negotiation.
|
||||
OpenSSL will still provide the methods for applications to explicitly select
|
||||
the individual protocol versions.
|
||||
|
||||
### no-{protocol}-method
|
||||
|
||||
no-{ssl|ssl3|tls|tls1|tls1_1|tls1_2|tls1_3|dtls|dtls1|dtls1_2}-method
|
||||
|
||||
Analogous to no-{protocol} but in addition do not build the methods for
|
||||
applications to explicitly select individual protocol versions. Note that there
|
||||
is no "no-tls1_3-method" option because there is no application method for
|
||||
TLSv1.3.
|
||||
|
||||
Using individual protocol methods directly is deprecated. Applications should
|
||||
use TLS_method() instead.
|
||||
|
||||
### enable-{algorithm}
|
||||
|
||||
enable-{md2|rc5}
|
||||
|
||||
Build with support for the specified algorithm.
|
||||
|
||||
### no-{algorithm}
|
||||
|
||||
no-{aria|bf|blake2|camellia|cast|chacha|cmac|
|
||||
des|dh|dsa|ecdh|ecdsa|idea|md4|mdc2|ocb|
|
||||
poly1305|rc2|rc4|rmd160|scrypt|seed|
|
||||
siphash|siv|sm2|sm3|sm4|whirlpool}
|
||||
|
||||
Build without support for the specified algorithm.
|
||||
|
||||
The "ripemd" algorithm is deprecated and if used is synonymous with rmd160.
|
||||
|
||||
### Compiler-specific options
|
||||
|
||||
-Dxxx, -Ixxx, -Wp, -lxxx, -Lxxx, -Wl, -rpath, -R, -framework, -static
|
||||
|
||||
These system specific options will be recognised and passed through to the
|
||||
compiler to allow you to define preprocessor symbols, specify additional
|
||||
libraries, library directories or other compiler options. It might be worth
|
||||
noting that some compilers generate code specifically for processor the
|
||||
compiler currently executes on. This is not necessarily what you might have
|
||||
in mind, since it might be unsuitable for execution on other, typically older,
|
||||
processor. Consult your compiler documentation.
|
||||
|
||||
Take note of the [Environment Variables](#environment-variables) documentation
|
||||
below and how these flags interact with those variables.
|
||||
|
||||
-xxx, +xxx, /xxx
|
||||
|
||||
Additional options that are not otherwise recognised are passed through as
|
||||
they are to the compiler as well. Unix-style options beginning with a
|
||||
'-' or '+' and Windows-style options beginning with a '/' are recognized.
|
||||
Again, consult your compiler documentation.
|
||||
|
||||
If the option contains arguments separated by spaces, then the URL-style
|
||||
notation %20 can be used for the space character in order to avoid having
|
||||
to quote the option. For example, -opt%20arg gets expanded to -opt arg.
|
||||
In fact, any ASCII character can be encoded as %xx using its hexadecimal
|
||||
encoding.
|
||||
|
||||
Take note of the [Environment Variables](#environment-variables) documentation
|
||||
below and how these flags interact with those variables.
|
||||
|
||||
### Environment Variables
|
||||
|
||||
VAR=value
|
||||
|
||||
Assign the given value to the environment variable VAR for Configure.
|
||||
|
||||
These work just like normal environment variable assignments, but are supported
|
||||
on all platforms and are confined to the configuration scripts only.
|
||||
These assignments override the corresponding value in the inherited environment,
|
||||
if there is one.
|
||||
|
||||
The following variables are used as "make variables" and can be used as an
|
||||
alternative to giving preprocessor, compiler and linker options directly as
|
||||
configuration. The following variables are supported:
|
||||
|
||||
AR The static library archiver.
|
||||
ARFLAGS Flags for the static library archiver.
|
||||
AS The assembler compiler.
|
||||
ASFLAGS Flags for the assembler compiler.
|
||||
CC The C compiler.
|
||||
CFLAGS Flags for the C compiler.
|
||||
CXX The C++ compiler.
|
||||
CXXFLAGS Flags for the C++ compiler.
|
||||
CPP The C/C++ preprocessor.
|
||||
CPPFLAGS Flags for the C/C++ preprocessor.
|
||||
CPPDEFINES List of CPP macro definitions, separated
|
||||
by a platform specific character (':' or
|
||||
space for Unix, ';' for Windows, ',' for
|
||||
VMS). This can be used instead of using
|
||||
-D (or what corresponds to that on your
|
||||
compiler) in CPPFLAGS.
|
||||
CPPINCLUDES List of CPP inclusion directories, separated
|
||||
the same way as for CPPDEFINES. This can
|
||||
be used instead of -I (or what corresponds
|
||||
to that on your compiler) in CPPFLAGS.
|
||||
HASHBANGPERL Perl invocation to be inserted after '#!'
|
||||
in public perl scripts (only relevant on
|
||||
Unix).
|
||||
LD The program linker (not used on Unix, $(CC)
|
||||
is used there).
|
||||
LDFLAGS Flags for the shared library, DSO and
|
||||
program linker.
|
||||
LDLIBS Extra libraries to use when linking.
|
||||
Takes the form of a space separated list
|
||||
of library specifications on Unix and
|
||||
Windows, and as a comma separated list of
|
||||
libraries on VMS.
|
||||
RANLIB The library archive indexer.
|
||||
RC The Windows resource compiler.
|
||||
RCFLAGS Flags for the Windows resource compiler.
|
||||
RM The command to remove files and directories.
|
||||
|
||||
These cannot be mixed with compiling/linking flags given on the command line.
|
||||
In other words, something like this isn't permitted.
|
||||
|
||||
./config -DFOO CPPFLAGS=-DBAR -DCOOKIE
|
||||
|
||||
Backward compatibility note:
|
||||
|
||||
To be compatible with older configuration scripts, the environment variables
|
||||
are ignored if compiling/linking flags are given on the command line, except
|
||||
for the following:
|
||||
|
||||
AR, CC, CXX, CROSS_COMPILE, HASHBANGPERL, PERL, RANLIB, RC, and WINDRES
|
||||
|
||||
For example, the following command will not see -DBAR:
|
||||
|
||||
CPPFLAGS=-DBAR ./config -DCOOKIE
|
||||
|
||||
However, the following will see both set variables:
|
||||
|
||||
CC=gcc CROSS_COMPILE=x86_64-w64-mingw32- ./config -DCOOKIE
|
||||
|
||||
If CC is set, it is advisable to also set CXX to ensure both the C and C++
|
||||
compiler are in the same "family". This becomes relevant with
|
||||
'enable-external-tests' and 'enable-buildtest-c++'.
|
||||
|
||||
### Reconfigure
|
||||
|
||||
reconf
|
||||
reconfigure
|
||||
|
||||
Reconfigure from earlier data.
|
||||
|
||||
This fetches the previous command line options and environment from data saved
|
||||
in "configdata.pm" and runs the configuration process again, using these
|
||||
options and environment. Note: NO other option is permitted together with
|
||||
"reconf". This means that you also MUST use "./Configure" (or what corresponds
|
||||
to that on non-Unix platforms) directly to invoke this option. Note: The
|
||||
original configuration saves away values for ALL environment variables that were
|
||||
used, and if they weren't defined, they are still saved away with information
|
||||
that they weren't originally defined. This information takes precedence over
|
||||
environment variables that are defined when reconfiguring.
|
||||
|
||||
Displaying configuration data
|
||||
-----------------------------
|
||||
|
||||
The configuration script itself will say very little, and finishes by
|
||||
creating "configdata.pm". This perl module can be loaded by other scripts
|
||||
to find all the configuration data, and it can also be used as a script to
|
||||
display all sorts of configuration data in a human readable form.
|
||||
|
||||
For more information, please do:
|
||||
|
||||
$ ./configdata.pm --help # Unix
|
||||
|
||||
or
|
||||
|
||||
$ perl configdata.pm --help # Windows and VMS
|
||||
|
||||
Installation Steps in Detail
|
||||
============================
|
||||
|
||||
Configure OpenSSL
|
||||
-----------------
|
||||
|
||||
### Automatic Configuration
|
||||
|
||||
On some platform a `config` script is available which attempts to guess
|
||||
your operating system (and compiler, if necessary) and calls the `Configure`
|
||||
Perl script with appropriate target based on its guess. Further options can
|
||||
be supplied to the `config` script, which will be passed on to the `Configure`
|
||||
script.
|
||||
|
||||
#### Unix / Linux / macOS
|
||||
|
||||
$ ./config [[ options ]]
|
||||
|
||||
#### OpenVMS
|
||||
|
||||
$ @config [[ options ]]
|
||||
|
||||
#### Windows
|
||||
|
||||
Automatic configuration is not available on Windows.
|
||||
|
||||
For the remainder of this text, the Unix form will be used in all examples,
|
||||
please use the appropriate form for your platform.
|
||||
|
||||
You can run
|
||||
|
||||
$ ./config -t
|
||||
|
||||
to see whether your target is guessed correctly. If you want to use a different
|
||||
compiler, you are cross-compiling for another platform, or the ./config guess
|
||||
was wrong for other reasons, see the [Manual Configuration](#manual-configuration)
|
||||
section. Oherwise continue with the [Build OpenSSL](#build-openssl) section below.
|
||||
|
||||
On some systems, you can include debugging information as follows:
|
||||
|
||||
$ ./config -d [[ options ]]
|
||||
|
||||
### Manual Configuration
|
||||
|
||||
OpenSSL knows about a range of different operating system, hardware and
|
||||
compiler combinations. To see the ones it knows about, run
|
||||
|
||||
$ ./Configure # Unix
|
||||
|
||||
or
|
||||
|
||||
$ perl Configure # All other platforms
|
||||
|
||||
For the remainder of this text, the Unix form will be used in all examples.
|
||||
Please use the appropriate form for your platform.
|
||||
|
||||
Pick a suitable name from the list that matches your system. For most
|
||||
operating systems there is a choice between using "cc" or "gcc".
|
||||
When you have identified your system (and if necessary compiler) use this
|
||||
name as the argument to Configure. For example, a "linux-elf" user would
|
||||
run:
|
||||
|
||||
$ ./Configure linux-elf [[ options ]]
|
||||
|
||||
### Creating your own Configuration
|
||||
|
||||
If your system isn't listed, you will have to create a configuration
|
||||
file named Configurations/{{ something }}.conf and add the correct
|
||||
configuration for your system. See the available configs as examples
|
||||
and read Configurations/README and Configurations/README.design for
|
||||
more information.
|
||||
|
||||
The generic configurations "cc" or "gcc" should usually work on 32 bit
|
||||
Unix-like systems.
|
||||
|
||||
Configure creates a build file ("Makefile" on Unix, "makefile" on Windows
|
||||
and "descrip.mms" on OpenVMS) from a suitable template in Configurations,
|
||||
and defines various macros in include/openssl/configuration.h (generated
|
||||
from include/openssl/configuration.h.in).
|
||||
|
||||
### Out of Tree Builds
|
||||
|
||||
OpenSSL can be configured to build in a build directory separate from the
|
||||
source code directory. It's done by placing yourself in some other
|
||||
directory and invoking the configuration commands from there.
|
||||
|
||||
#### Unix example
|
||||
|
||||
$ mkdir /var/tmp/openssl-build
|
||||
$ cd /var/tmp/openssl-build
|
||||
$ /PATH/TO/OPENSSL/SOURCE/config [[ options ]]
|
||||
|
||||
or
|
||||
|
||||
$ /PATH/TO/OPENSSL/SOURCE/Configure {{ target }} [[ options ]]
|
||||
|
||||
#### OpenVMS example
|
||||
|
||||
$ set default sys$login:
|
||||
$ create/dir [.tmp.openssl-build]
|
||||
$ set default [.tmp.openssl-build]
|
||||
$ @[PATH.TO.OPENSSL.SOURCE]config [[ options ]]
|
||||
|
||||
or
|
||||
|
||||
$ @[PATH.TO.OPENSSL.SOURCE]Configure {{ target }} [[ options ]]
|
||||
|
||||
#### Windows example
|
||||
|
||||
$ C:
|
||||
$ mkdir \temp-openssl
|
||||
$ cd \temp-openssl
|
||||
$ perl d:\PATH\TO\OPENSSL\SOURCE\Configure {{ target }} [[ options ]]
|
||||
|
||||
Paths can be relative just as well as absolute. Configure will do its best
|
||||
to translate them to relative paths whenever possible.
|
||||
|
||||
Build OpenSSL
|
||||
-------------
|
||||
|
||||
Build OpenSSL by running:
|
||||
|
||||
$ make # Unix
|
||||
$ mms ! (or mmk) OpenVMS
|
||||
$ nmake # Windows
|
||||
|
||||
This will build the OpenSSL libraries (libcrypto.a and libssl.a on
|
||||
Unix, corresponding on other platforms) and the OpenSSL binary
|
||||
("openssl"). The libraries will be built in the top-level directory,
|
||||
and the binary will be in the "apps" subdirectory.
|
||||
|
||||
If the build fails, take a look at the [Build Failures](#build-failures)
|
||||
subsection of the [Troubleshooting](#troubleshooting) section.
|
||||
|
||||
Test OpenSSL
|
||||
------------
|
||||
|
||||
After a successful build, and before installing, the libraries should
|
||||
be tested. Run:
|
||||
|
||||
$ make test # Unix
|
||||
$ mms test ! OpenVMS
|
||||
$ nmake test # Windows
|
||||
|
||||
**Warning:** you MUST run the tests from an unprivileged account (or disable
|
||||
your privileges temporarily if your platform allows it).
|
||||
|
||||
If some tests fail, take a look at the [Test Failures](#test-failures)
|
||||
subsection of the [Troubleshooting](#troubleshooting) section.
|
||||
|
||||
Install OpenSSL
|
||||
---------------
|
||||
|
||||
If everything tests ok, install OpenSSL with
|
||||
|
||||
$ make install # Unix
|
||||
$ mms install ! OpenVMS
|
||||
$ nmake install # Windows
|
||||
|
||||
Note that in order to perform the install step above you need to have
|
||||
appropriate permissions to write to the installation directory.
|
||||
|
||||
The above commands will install all the software components in this
|
||||
directory tree under PREFIX (the directory given with `--prefix` or
|
||||
its default):
|
||||
|
||||
### Unix / Linux / macOS
|
||||
|
||||
bin/ Contains the openssl binary and a few other
|
||||
utility scripts.
|
||||
include/openssl
|
||||
Contains the header files needed if you want
|
||||
to build your own programs that use libcrypto
|
||||
or libssl.
|
||||
lib Contains the OpenSSL library files.
|
||||
lib/engines Contains the OpenSSL dynamically loadable engines.
|
||||
|
||||
share/man/man1 Contains the OpenSSL command line man-pages.
|
||||
share/man/man3 Contains the OpenSSL library calls man-pages.
|
||||
share/man/man5 Contains the OpenSSL configuration format man-pages.
|
||||
share/man/man7 Contains the OpenSSL other misc man-pages.
|
||||
|
||||
share/doc/openssl/html/man1
|
||||
share/doc/openssl/html/man3
|
||||
share/doc/openssl/html/man5
|
||||
share/doc/openssl/html/man7
|
||||
Contains the HTML rendition of the man-pages.
|
||||
|
||||
### OpenVMS
|
||||
|
||||
'arch' is replaced with the architecture name, "Alpha" or "ia64",
|
||||
'sover' is replaced with the shared library version (0101 for 1.1), and
|
||||
'pz' is replaced with the pointer size OpenSSL was built with:
|
||||
|
||||
[.EXE.'arch'] Contains the openssl binary.
|
||||
[.EXE] Contains a few utility scripts.
|
||||
[.include.openssl]
|
||||
Contains the header files needed if you want
|
||||
to build your own programs that use libcrypto
|
||||
or libssl.
|
||||
[.LIB.'arch'] Contains the OpenSSL library files.
|
||||
[.ENGINES'sover''pz'.'arch']
|
||||
Contains the OpenSSL dynamically loadable engines.
|
||||
[.SYS$STARTUP] Contains startup, login and shutdown scripts.
|
||||
These define appropriate logical names and
|
||||
command symbols.
|
||||
[.SYSTEST] Contains the installation verification procedure.
|
||||
[.HTML] Contains the HTML rendition of the manual pages.
|
||||
|
||||
### Additional Directories
|
||||
|
||||
Additionally, install will add the following directories under
|
||||
OPENSSLDIR (the directory given with `--openssldir` or its default)
|
||||
for you convenience:
|
||||
|
||||
certs Initially empty, this is the default location
|
||||
for certificate files.
|
||||
private Initially empty, this is the default location
|
||||
for private key files.
|
||||
misc Various scripts.
|
||||
|
||||
The installation directory should be appropriately protected to ensure
|
||||
unprivileged users cannot make changes to OpenSSL binaries or files, or
|
||||
install engines. If you already have a pre-installed version of OpenSSL as
|
||||
part of your Operating System it is recommended that you do not overwrite
|
||||
the system version and instead install to somewhere else.
|
||||
|
||||
Package builders who want to configure the library for standard locations,
|
||||
but have the package installed somewhere else so that it can easily be
|
||||
packaged, can use
|
||||
|
||||
$ make DESTDIR=/tmp/package-root install # Unix
|
||||
$ mms/macro="DESTDIR=TMP:[PACKAGE-ROOT]" install ! OpenVMS
|
||||
|
||||
The specified destination directory will be prepended to all installation
|
||||
target paths.
|
||||
|
||||
Compatibility issues with previous OpenSSL versions
|
||||
---------------------------------------------------
|
||||
|
||||
### COMPILING existing applications
|
||||
|
||||
Starting with version 1.1.0, OpenSSL hides a number of structures that were
|
||||
previously open. This includes all internal libssl structures and a number
|
||||
of EVP types. Accessor functions have been added to allow controlled access
|
||||
to the structures' data.
|
||||
|
||||
This means that some software needs to be rewritten to adapt to the new ways
|
||||
of doing things. This often amounts to allocating an instance of a structure
|
||||
explicitly where you could previously allocate them on the stack as automatic
|
||||
variables, and using the provided accessor functions where you would previously
|
||||
access a structure's field directly.
|
||||
|
||||
Some APIs have changed as well. However, older APIs have been preserved when
|
||||
possible.
|
||||
|
||||
Post-installation Notes
|
||||
-----------------------
|
||||
|
||||
With the default OpenSSL installation comes a FIPS provider module, which
|
||||
needs some post-installation attention, without which it will not be usable.
|
||||
This involves using the following command:
|
||||
|
||||
openssl fipsinstall
|
||||
|
||||
See the openssl-fipsinstall(1) manual for details and examples.
|
||||
|
||||
Advanced Build Options
|
||||
======================
|
||||
|
||||
Environment Variables
|
||||
---------------------
|
||||
|
||||
A number of environment variables can be used to provide additional control
|
||||
over the build process. Typically these should be defined prior to running
|
||||
config or Configure. Not all environment variables are relevant to all
|
||||
platforms.
|
||||
|
||||
AR
|
||||
The name of the ar executable to use.
|
||||
|
||||
BUILDFILE
|
||||
Use a different build file name than the platform default
|
||||
("Makefile" on Unix-like platforms, "makefile" on native Windows,
|
||||
"descrip.mms" on OpenVMS). This requires that there is a
|
||||
corresponding build file template. See Configurations/README
|
||||
for further information.
|
||||
|
||||
CC
|
||||
The compiler to use. Configure will attempt to pick a default
|
||||
compiler for your platform but this choice can be overridden
|
||||
using this variable. Set it to the compiler executable you wish
|
||||
to use, e.g. "gcc" or "clang".
|
||||
|
||||
CROSS_COMPILE
|
||||
This environment variable has the same meaning as for the
|
||||
"--cross-compile-prefix" Configure flag described above. If both
|
||||
are set then the Configure flag takes precedence.
|
||||
|
||||
NM
|
||||
The name of the nm executable to use.
|
||||
|
||||
OPENSSL_LOCAL_CONFIG_DIR
|
||||
OpenSSL comes with a database of information about how it
|
||||
should be built on different platforms as well as build file
|
||||
templates for those platforms. The database is comprised of
|
||||
".conf" files in the Configurations directory. The build
|
||||
file templates reside there as well as ".tmpl" files. See the
|
||||
file Configurations/README for further information about the
|
||||
format of ".conf" files as well as information on the ".tmpl"
|
||||
files.
|
||||
In addition to the standard ".conf" and ".tmpl" files, it is
|
||||
possible to create your own ".conf" and ".tmpl" files and store
|
||||
them locally, outside the OpenSSL source tree. This environment
|
||||
variable can be set to the directory where these files are held
|
||||
and will be considered by Configure before it looks in the
|
||||
standard directories.
|
||||
|
||||
PERL
|
||||
The name of the Perl executable to use when building OpenSSL.
|
||||
This variable is used in config script only. Configure on the
|
||||
other hand imposes the interpreter by which it itself was
|
||||
executed on the whole build procedure.
|
||||
|
||||
HASHBANGPERL
|
||||
The command string for the Perl executable to insert in the
|
||||
#! line of perl scripts that will be publicly installed.
|
||||
Default: /usr/bin/env perl
|
||||
Note: the value of this variable is added to the same scripts
|
||||
on all platforms, but it's only relevant on Unix-like platforms.
|
||||
|
||||
RC
|
||||
The name of the rc executable to use. The default will be as
|
||||
defined for the target platform in the ".conf" file. If not
|
||||
defined then "windres" will be used. The WINDRES environment
|
||||
variable is synonymous to this. If both are defined then RC
|
||||
takes precedence.
|
||||
|
||||
RANLIB
|
||||
The name of the ranlib executable to use.
|
||||
|
||||
WINDRES
|
||||
See RC.
|
||||
|
||||
Makefile Targets
|
||||
----------------
|
||||
|
||||
The Configure script generates a Makefile in a format relevant to the specific
|
||||
platform. The Makefiles provide a number of targets that can be used. Not all
|
||||
targets may be available on all platforms. Only the most common targets are
|
||||
described here. Examine the Makefiles themselves for the full list.
|
||||
|
||||
all
|
||||
The target to build all the software components and
|
||||
documentation.
|
||||
|
||||
build_sw
|
||||
Build all the software components.
|
||||
THIS IS THE DEFAULT TARGET.
|
||||
|
||||
build_docs
|
||||
Build all documentation components.
|
||||
|
||||
clean
|
||||
Remove all build artefacts and return the directory to a "clean"
|
||||
state.
|
||||
|
||||
depend
|
||||
Rebuild the dependencies in the Makefiles. This is a legacy
|
||||
option that no longer needs to be used since OpenSSL 1.1.0.
|
||||
|
||||
install
|
||||
Install all OpenSSL components.
|
||||
|
||||
install_sw
|
||||
Only install the OpenSSL software components.
|
||||
|
||||
install_docs
|
||||
Only install the OpenSSL documentation components.
|
||||
|
||||
install_man_docs
|
||||
Only install the OpenSSL man pages (Unix only).
|
||||
|
||||
install_html_docs
|
||||
Only install the OpenSSL html documentation.
|
||||
|
||||
list-tests
|
||||
Prints a list of all the self test names.
|
||||
|
||||
test
|
||||
Build and run the OpenSSL self tests.
|
||||
|
||||
uninstall
|
||||
Uninstall all OpenSSL components.
|
||||
|
||||
reconfigure
|
||||
reconf
|
||||
Re-run the configuration process, as exactly as the last time
|
||||
as possible.
|
||||
|
||||
update
|
||||
This is a developer option. If you are developing a patch for
|
||||
OpenSSL you may need to use this if you want to update
|
||||
automatically generated files; add new error codes or add new
|
||||
(or change the visibility of) public API functions. (Unix only).
|
||||
|
||||
Running Selected Tests
|
||||
----------------------
|
||||
|
||||
The make variable TESTS supports a versatile set of space separated tokens
|
||||
with which you can specify a set of tests to be performed. With a "current
|
||||
set of tests" in mind, initially being empty, here are the possible tokens:
|
||||
|
||||
alltests The current set of tests becomes the whole set of available
|
||||
tests (as listed when you do 'make list-tests' or similar).
|
||||
|
||||
xxx Adds the test 'xxx' to the current set of tests.
|
||||
|
||||
-xxx Removes 'xxx' from the current set of tests. If this is the
|
||||
first token in the list, the current set of tests is first
|
||||
assigned the whole set of available tests, effectively making
|
||||
this token equivalent to TESTS="alltests -xxx".
|
||||
|
||||
nn Adds the test group 'nn' (which is a number) to the current
|
||||
set of tests.
|
||||
|
||||
-nn Removes the test group 'nn' from the current set of tests.
|
||||
If this is the first token in the list, the current set of
|
||||
tests is first assigned the whole set of available tests,
|
||||
effectively making this token equivalent to
|
||||
TESTS="alltests -xxx".
|
||||
|
||||
Also, all tokens except for "alltests" may have wildcards, such as *.
|
||||
(on Unix and Windows, BSD style wildcards are supported, while on VMS,
|
||||
it's VMS style wildcards)
|
||||
|
||||
### Examples
|
||||
|
||||
Run all tests except for the fuzz tests:
|
||||
|
||||
$ make TESTS=-test_fuzz test
|
||||
|
||||
or, if you want to be explicit:
|
||||
|
||||
$ make TESTS='alltests -test_fuzz' test
|
||||
|
||||
Run all tests that have a name starting with "test_ssl" but not those
|
||||
starting with "test_ssl_":
|
||||
|
||||
$ make TESTS='test_ssl* -test_ssl_*' test
|
||||
|
||||
Run only test group 10:
|
||||
|
||||
$ make TESTS='10'
|
||||
|
||||
Run all tests except the slow group (group 99):
|
||||
|
||||
$ make TESTS='-99'
|
||||
|
||||
Run all tests in test groups 80 to 99 except for tests in group 90:
|
||||
|
||||
$ make TESTS='[89]? -90'
|
||||
|
||||
To stochastically verify that the algorithm that produces uniformly distributed
|
||||
random numbers is operating correctly (with a false positive rate of 0.01%):
|
||||
|
||||
$ ./util/wrap.sh test/bntest -stochastic
|
||||
|
||||
Troubleshooting
|
||||
===============
|
||||
|
||||
Configuration Problems
|
||||
----------------------
|
||||
|
||||
### Selecting the correct target
|
||||
|
||||
The `./config` script tries hard to guess your operating system, but in some
|
||||
cases it does not succeed. You will see a message like the following:
|
||||
|
||||
$ ./config
|
||||
Operating system: x86-whatever-minix
|
||||
This system (minix) is not supported. See file INSTALL for details.
|
||||
|
||||
Even if the automatic target selection by the `./config` script fails, chances
|
||||
are that you still might find a suitable target in the Configurations directory,
|
||||
which you can supply to the `./Configure` command, possibly after some adjustment.
|
||||
|
||||
The Configurations directory contains a lot of examples of such targets.
|
||||
The main configuration file is [10-main.conf][], which contains all targets that
|
||||
are officially supported by the OpenSSL team. Other configuration files contain
|
||||
targets contributed by other OpenSSL users. The list of targets can be found in
|
||||
a Perl list `my %targets = ( ... )`.
|
||||
|
||||
my %targets = (
|
||||
...
|
||||
"target-name" => {
|
||||
inherit_from => [ "base-target" ],
|
||||
CC => "...",
|
||||
cflags => add("..."),
|
||||
asm_arch => '...',
|
||||
perlasm_scheme => "...",
|
||||
},
|
||||
...
|
||||
)
|
||||
|
||||
If you call `.\Configure` without arguments, it will give you a list of all
|
||||
known targets. Using `grep`, you can lookup the target definition in the
|
||||
Configurations directory. For example the "android-x86_64" can be found in
|
||||
Configurations/15-android.conf.
|
||||
|
||||
The directory contains two README files, which explain the general syntax and
|
||||
design of the configurations files.
|
||||
|
||||
- [Configurations/README](Configurations/README)
|
||||
- [Configurations/README.design](Configurations/README.design)
|
||||
|
||||
If you need further help, try to search the [openssl-users][] mailing list
|
||||
or the [GitHub Issues][] for existing solutions. If you don't find anything,
|
||||
you can [raise an issue][] to ask a question yourself.
|
||||
|
||||
More about our support resources can be found in the [SUPPORT][] file.
|
||||
|
||||
### Configuration Errors
|
||||
|
||||
If the `./config` or `./Configure` command fails with an error message,
|
||||
read the error message carefully and try to figure out whether you made
|
||||
a mistake (e.g., by providing a wrong option), or whether the script is
|
||||
working incorrectly. If you think you encountered a bug, please
|
||||
[raise an issue][] on GitHub to file a bug report.
|
||||
|
||||
Along with a short description of the bug, please provide the complete
|
||||
configure command line and the relevant output including the error message.
|
||||
|
||||
Note: To make the output readable, pleace add a 'code fence' (three backquotes
|
||||
` ``` ` on a separate line) before and after your output:
|
||||
|
||||
```
|
||||
$ ./Configure [your arguments...]
|
||||
|
||||
[output...]
|
||||
|
||||
```
|
||||
|
||||
Build Failures
|
||||
--------------
|
||||
|
||||
If the build fails, look carefully at the output. Try to locate and understand
|
||||
the error message. It might be that the compiler is already telling you
|
||||
exactly what you need to do to fix your problem.
|
||||
|
||||
There may be reasons for the failure that aren't problems in OpenSSL itself,
|
||||
for example if the compiler reports missing standard or third party headers.
|
||||
|
||||
If the build succeeded previously, but fails after a source or configuration
|
||||
change, it might be helpful to clean the build tree before attempting another
|
||||
build. Use this command:
|
||||
|
||||
$ make clean # Unix
|
||||
$ mms clean ! (or mmk) OpenVMS
|
||||
$ nmake clean # Windows
|
||||
|
||||
Assembler error messages can sometimes be sidestepped by using the
|
||||
"no-asm" configuration option.
|
||||
|
||||
Compiling parts of OpenSSL with gcc and others with the system compiler will
|
||||
result in unresolved symbols on some systems.
|
||||
|
||||
If you are still having problems, try to search the [openssl-users][] mailing
|
||||
list or the [GitHub Issues][] for existing solutions. If you think you
|
||||
encountered an OpenSSL bug, please [raise an issue][] to file a bug report.
|
||||
Please take the time to review the existing issues first; maybe the bug was
|
||||
already reported or has already been fixed.
|
||||
|
||||
Test Failures
|
||||
-------------
|
||||
|
||||
If some tests fail, look at the output. There may be reasons for the failure
|
||||
that isn't a problem in OpenSSL itself (like a malfunction with Perl).
|
||||
You may want increased verbosity, that can be accomplished like this:
|
||||
|
||||
Verbosity on failure only (make macro VERBOSE_FAILURE or VF):
|
||||
|
||||
$ make VF=1 test # Unix
|
||||
$ mms /macro=(VF=1) test ! OpenVMS
|
||||
$ nmake VF=1 test # Windows
|
||||
|
||||
Full verbosity (make macro VERBOSE or V):
|
||||
|
||||
$ make V=1 test # Unix
|
||||
$ mms /macro=(V=1) test ! OpenVMS
|
||||
$ nmake V=1 test # Windows
|
||||
|
||||
If you want to run just one or a few specific tests, you can use
|
||||
the make variable TESTS to specify them, like this:
|
||||
|
||||
$ make TESTS='test_rsa test_dsa' test # Unix
|
||||
$ mms/macro="TESTS=test_rsa test_dsa" test ! OpenVMS
|
||||
$ nmake TESTS='test_rsa test_dsa' test # Windows
|
||||
|
||||
And of course, you can combine (Unix example shown):
|
||||
|
||||
$ make VF=1 TESTS='test_rsa test_dsa' test
|
||||
|
||||
You can find the list of available tests like this:
|
||||
|
||||
$ make list-tests # Unix
|
||||
$ mms list-tests ! OpenVMS
|
||||
$ nmake list-tests # Windows
|
||||
|
||||
Have a look at the manual for the perl module Test::Harness to
|
||||
see what other HARNESS_* variables there are.
|
||||
|
||||
If you find a problem with OpenSSL itself, try removing any
|
||||
compiler optimization flags from the CFLAGS line in Makefile and
|
||||
run "make clean; make" or corresponding.
|
||||
|
||||
To report a bug please open an issue on GitHub, at
|
||||
<https://github.com/openssl/openssl/issues>.
|
||||
|
||||
For more details on how the make variables TESTS can be used,
|
||||
see section [Running Selected Tests](#running-selected-tests) below.
|
||||
|
||||
Notes
|
||||
=====
|
||||
|
||||
Notes on multi-threading
|
||||
------------------------
|
||||
|
||||
For some systems, the OpenSSL Configure script knows what compiler options
|
||||
are needed to generate a library that is suitable for multi-threaded
|
||||
applications. On these systems, support for multi-threading is enabled
|
||||
by default; use the "no-threads" option to disable (this should never be
|
||||
necessary).
|
||||
|
||||
On other systems, to enable support for multi-threading, you will have
|
||||
to specify at least two options: "threads", and a system-dependent option.
|
||||
(The latter is "-D_REENTRANT" on various systems.) The default in this
|
||||
case, obviously, is not to include support for multi-threading (but
|
||||
you can still use "no-threads" to suppress an annoying warning message
|
||||
from the Configure script.)
|
||||
|
||||
OpenSSL provides built-in support for two threading models: pthreads (found on
|
||||
most UNIX/Linux systems), and Windows threads. No other threading models are
|
||||
supported. If your platform does not provide pthreads or Windows threads then
|
||||
you should Configure with the "no-threads" option.
|
||||
|
||||
Notes on shared libraries
|
||||
-------------------------
|
||||
|
||||
For most systems the OpenSSL Configure script knows what is needed to
|
||||
build shared libraries for libcrypto and libssl. On these systems
|
||||
the shared libraries will be created by default. This can be suppressed and
|
||||
only static libraries created by using the "no-shared" option. On systems
|
||||
where OpenSSL does not know how to build shared libraries the "no-shared"
|
||||
option will be forced and only static libraries will be created.
|
||||
|
||||
Shared libraries are named a little differently on different platforms.
|
||||
One way or another, they all have the major OpenSSL version number as
|
||||
part of the file name, i.e. for OpenSSL 1.1.x, 1.1 is somehow part of
|
||||
the name.
|
||||
|
||||
On most POSIX platforms, shared libraries are named libcrypto.so.1.1
|
||||
and libssl.so.1.1.
|
||||
|
||||
on Cygwin, shared libraries are named cygcrypto-1.1.dll and cygssl-1.1.dll
|
||||
with import libraries libcrypto.dll.a and libssl.dll.a.
|
||||
|
||||
On Windows build with MSVC or using MingW, shared libraries are named
|
||||
libcrypto-1_1.dll and libssl-1_1.dll for 32-bit Windows, libcrypto-1_1-x64.dll
|
||||
and libssl-1_1-x64.dll for 64-bit x86_64 Windows, and libcrypto-1_1-ia64.dll
|
||||
and libssl-1_1-ia64.dll for IA64 Windows. With MSVC, the import libraries
|
||||
are named libcrypto.lib and libssl.lib, while with MingW, they are named
|
||||
libcrypto.dll.a and libssl.dll.a.
|
||||
|
||||
On VMS, shareable images (VMS speak for shared libraries) are named
|
||||
ossl$libcrypto0101_shr.exe and ossl$libssl0101_shr.exe. However, when
|
||||
OpenSSL is specifically built for 32-bit pointers, the shareable images
|
||||
are named ossl$libcrypto0101_shr32.exe and ossl$libssl0101_shr32.exe
|
||||
instead, and when built for 64-bit pointers, they are named
|
||||
ossl$libcrypto0101_shr64.exe and ossl$libssl0101_shr64.exe.
|
||||
|
||||
Notes on random number generation
|
||||
---------------------------------
|
||||
|
||||
Availability of cryptographically secure random numbers is required for
|
||||
secret key generation. OpenSSL provides several options to seed the
|
||||
internal CSPRNG. If not properly seeded, the internal CSPRNG will refuse
|
||||
to deliver random bytes and a "PRNG not seeded error" will occur.
|
||||
|
||||
The seeding method can be configured using the `--with-rand-seed` option,
|
||||
which can be used to specify a comma separated list of seed methods.
|
||||
However in most cases OpenSSL will choose a suitable default method,
|
||||
so it is not necessary to explicitly provide this option. Note also
|
||||
that not all methods are available on all platforms.
|
||||
|
||||
I) On operating systems which provide a suitable randomness source (in
|
||||
form of a system call or system device), OpenSSL will use the optimal
|
||||
available method to seed the CSPRNG from the operating system's
|
||||
randomness sources. This corresponds to the option `--with-rand-seed=os`.
|
||||
|
||||
II) On systems without such a suitable randomness source, automatic seeding
|
||||
and reseeding is disabled (--with-rand-seed=none) and it may be necessary
|
||||
to install additional support software to obtain a random seed and reseed
|
||||
the CSPRNG manually. Please check out the manual pages for RAND_add(),
|
||||
RAND_bytes(), RAND_egd(), and the FAQ for more information.
|
||||
|
||||
<!-- Links -->
|
||||
|
||||
[openssl-users]:
|
||||
<https://mta.openssl.org/mailman/listinfo/openssl-users>
|
||||
|
||||
[SUPPORT]:
|
||||
./SUPPORT.md
|
||||
|
||||
[GitHub Issues]:
|
||||
<https://github.com/openssl/openssl/issues>
|
||||
|
||||
[raise an issue]:
|
||||
<https://github.com/openssl/openssl/issues/new/choose>
|
||||
|
||||
[10-main.conf]:
|
||||
Configurations/10-main.conf
|
||||
@@ -1,955 +0,0 @@
|
||||
|
||||
NEWS
|
||||
====
|
||||
|
||||
This file gives a brief overview of the major changes between each OpenSSL
|
||||
release. For more details please read the CHANGES file.
|
||||
|
||||
Major changes between OpenSSL 1.1.1 and OpenSSL 3.0.0 [under development]
|
||||
|
||||
o X509 certificates signed using SHA1 are no longer allowed at security
|
||||
level 1 or higher. The default security level for TLS is 1, so
|
||||
certificates signed using SHA1 are by default no longer trusted to
|
||||
authenticate servers or clients.
|
||||
o enable-crypto-mdebug and enable-crypto-mdebug-backtrace were mostly
|
||||
disabled; the project uses address sanitize/leak-detect instead.
|
||||
o Added OSSL_SERIALIZER, a generic serializer API.
|
||||
o Added error raising macros, ERR_raise() and ERR_raise_data().
|
||||
o Deprecated ERR_put_error().
|
||||
o Added OSSL_PROVIDER_available(), to check provider availibility.
|
||||
o Added 'openssl mac' that uses the EVP_MAC API.
|
||||
o Added 'openssl kdf' that uses the EVP_KDF API.
|
||||
o Add OPENSSL_info() and 'openssl info' to get built-in data.
|
||||
o Add support for enabling instrumentation through trace and debug
|
||||
output.
|
||||
o Changed our version number scheme and set the next major release to
|
||||
3.0.0
|
||||
o Added EVP_MAC, an EVP layer MAC API, and a generic EVP_PKEY to EVP_MAC
|
||||
bridge.
|
||||
o Removed the heartbeat message in DTLS feature.
|
||||
o Added EVP_KDF, an EVP layer KDF API, and a generic EVP_PKEY to EVP_KDF
|
||||
bridge.
|
||||
o All of the low level MD2, MD4, MD5, MDC2, RIPEMD160, SHA1, SHA224,
|
||||
SHA256, SHA384, SHA512 and Whirlpool digest functions have been
|
||||
deprecated.
|
||||
o All of the low level AES, Blowfish, Camellia, CAST, DES, IDEA, RC2,
|
||||
RC4, RC5 and SEED cipher functions have been deprecated.
|
||||
|
||||
Major changes between OpenSSL 1.1.1 and OpenSSL 1.1.1a [20 Nov 2018]
|
||||
|
||||
o Timing vulnerability in DSA signature generation (CVE-2018-0734)
|
||||
o Timing vulnerability in ECDSA signature generation (CVE-2018-0735)
|
||||
|
||||
Major changes between OpenSSL 1.1.0i and OpenSSL 1.1.1 [11 Sep 2018]
|
||||
|
||||
o Support for TLSv1.3 added (see https://wiki.openssl.org/index.php/TLS1.3
|
||||
for further important information). The TLSv1.3 implementation includes:
|
||||
o Fully compliant implementation of RFC8446 (TLSv1.3) on by default
|
||||
o Early data (0-RTT)
|
||||
o Post-handshake authentication and key update
|
||||
o Middlebox Compatibility Mode
|
||||
o TLSv1.3 PSKs
|
||||
o Support for all five RFC8446 ciphersuites
|
||||
o RSA-PSS signature algorithms (backported to TLSv1.2)
|
||||
o Configurable session ticket support
|
||||
o Stateless server support
|
||||
o Rewrite of the packet construction code for "safer" packet handling
|
||||
o Rewrite of the extension handling code
|
||||
o Complete rewrite of the OpenSSL random number generator to introduce the
|
||||
following capabilities
|
||||
o The default RAND method now utilizes an AES-CTR DRBG according to
|
||||
NIST standard SP 800-90Ar1.
|
||||
o Support for multiple DRBG instances with seed chaining.
|
||||
o There is a public and private DRBG instance.
|
||||
o The DRBG instances are fork-safe.
|
||||
o Keep all global DRBG instances on the secure heap if it is enabled.
|
||||
o The public and private DRBG instance are per thread for lock free
|
||||
operation
|
||||
o Support for various new cryptographic algorithms including:
|
||||
o SHA3
|
||||
o SHA512/224 and SHA512/256
|
||||
o EdDSA (both Ed25519 and Ed448) including X509 and TLS support
|
||||
o X448 (adding to the existing X25519 support in 1.1.0)
|
||||
o Multi-prime RSA
|
||||
o SM2
|
||||
o SM3
|
||||
o SM4
|
||||
o SipHash
|
||||
o ARIA (including TLS support)
|
||||
o Significant Side-Channel attack security improvements
|
||||
o Add a new ClientHello callback to provide the ability to adjust the SSL
|
||||
object at an early stage.
|
||||
o Add 'Maximum Fragment Length' TLS extension negotiation and support
|
||||
o A new STORE module, which implements a uniform and URI based reader of
|
||||
stores that can contain keys, certificates, CRLs and numerous other
|
||||
objects.
|
||||
o Move the display of configuration data to configdata.pm.
|
||||
o Allow GNU style "make variables" to be used with Configure.
|
||||
o Claim the namespaces OSSL and OPENSSL, represented as symbol prefixes
|
||||
o Rewrite of devcrypto engine
|
||||
|
||||
Major changes between OpenSSL 1.1.0h and OpenSSL 1.1.0i [under development]
|
||||
|
||||
o Client DoS due to large DH parameter (CVE-2018-0732)
|
||||
o Cache timing vulnerability in RSA Key Generation (CVE-2018-0737)
|
||||
|
||||
Major changes between OpenSSL 1.1.0g and OpenSSL 1.1.0h [under development]
|
||||
|
||||
o Constructed ASN.1 types with a recursive definition could exceed the
|
||||
stack (CVE-2018-0739)
|
||||
o Incorrect CRYPTO_memcmp on HP-UX PA-RISC (CVE-2018-0733)
|
||||
o rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)
|
||||
|
||||
Major changes between OpenSSL 1.1.0f and OpenSSL 1.1.0g [2 Nov 2017]
|
||||
|
||||
o bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)
|
||||
o Malformed X.509 IPAddressFamily could cause OOB read (CVE-2017-3735)
|
||||
|
||||
Major changes between OpenSSL 1.1.0e and OpenSSL 1.1.0f [25 May 2017]
|
||||
|
||||
o config now recognises 64-bit mingw and chooses mingw64 instead of mingw
|
||||
|
||||
Major changes between OpenSSL 1.1.0d and OpenSSL 1.1.0e [16 Feb 2017]
|
||||
|
||||
o Encrypt-Then-Mac renegotiation crash (CVE-2017-3733)
|
||||
|
||||
Major changes between OpenSSL 1.1.0c and OpenSSL 1.1.0d [26 Jan 2017]
|
||||
|
||||
o Truncated packet could crash via OOB read (CVE-2017-3731)
|
||||
o Bad (EC)DHE parameters cause a client crash (CVE-2017-3730)
|
||||
o BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)
|
||||
|
||||
Major changes between OpenSSL 1.1.0b and OpenSSL 1.1.0c [10 Nov 2016]
|
||||
|
||||
o ChaCha20/Poly1305 heap-buffer-overflow (CVE-2016-7054)
|
||||
o CMS Null dereference (CVE-2016-7053)
|
||||
o Montgomery multiplication may produce incorrect results (CVE-2016-7055)
|
||||
|
||||
Major changes between OpenSSL 1.1.0a and OpenSSL 1.1.0b [26 Sep 2016]
|
||||
|
||||
o Fix Use After Free for large message sizes (CVE-2016-6309)
|
||||
|
||||
Major changes between OpenSSL 1.1.0 and OpenSSL 1.1.0a [22 Sep 2016]
|
||||
|
||||
o OCSP Status Request extension unbounded memory growth (CVE-2016-6304)
|
||||
o SSL_peek() hang on empty record (CVE-2016-6305)
|
||||
o Excessive allocation of memory in tls_get_message_header()
|
||||
(CVE-2016-6307)
|
||||
o Excessive allocation of memory in dtls1_preprocess_fragment()
|
||||
(CVE-2016-6308)
|
||||
|
||||
Major changes between OpenSSL 1.0.2h and OpenSSL 1.1.0 [25 Aug 2016]
|
||||
|
||||
o Copyright text was shrunk to a boilerplate that points to the license
|
||||
o "shared" builds are now the default when possible
|
||||
o Added support for "pipelining"
|
||||
o Added the AFALG engine
|
||||
o New threading API implemented
|
||||
o Support for ChaCha20 and Poly1305 added to libcrypto and libssl
|
||||
o Support for extended master secret
|
||||
o CCM ciphersuites
|
||||
o Reworked test suite, now based on perl, Test::Harness and Test::More
|
||||
o *Most* libcrypto and libssl public structures were made opaque,
|
||||
including:
|
||||
BIGNUM and associated types, EC_KEY and EC_KEY_METHOD,
|
||||
DH and DH_METHOD, DSA and DSA_METHOD, RSA and RSA_METHOD,
|
||||
BIO and BIO_METHOD, EVP_MD_CTX, EVP_MD, EVP_CIPHER_CTX,
|
||||
EVP_CIPHER, EVP_PKEY and associated types, HMAC_CTX,
|
||||
X509, X509_CRL, X509_OBJECT, X509_STORE_CTX, X509_STORE,
|
||||
X509_LOOKUP, X509_LOOKUP_METHOD
|
||||
o libssl internal structures made opaque
|
||||
o SSLv2 support removed
|
||||
o Kerberos ciphersuite support removed
|
||||
o RC4 removed from DEFAULT ciphersuites in libssl
|
||||
o 40 and 56 bit cipher support removed from libssl
|
||||
o All public header files moved to include/openssl, no more symlinking
|
||||
o SSL/TLS state machine, version negotiation and record layer rewritten
|
||||
o EC revision: now operations use new EC_KEY_METHOD.
|
||||
o Support for OCB mode added to libcrypto
|
||||
o Support for asynchronous crypto operations added to libcrypto and libssl
|
||||
o Deprecated interfaces can now be disabled at build time either
|
||||
relative to the latest release via the "no-deprecated" Configure
|
||||
argument, or via the "--api=1.1.0|1.0.0|0.9.8" option.
|
||||
o Application software can be compiled with -DOPENSSL_API_COMPAT=version
|
||||
to ensure that features deprecated in that version are not exposed.
|
||||
o Support for RFC6698/RFC7671 DANE TLSA peer authentication
|
||||
o Change of Configure to use --prefix as the main installation
|
||||
directory location rather than --openssldir. The latter becomes
|
||||
the directory for certs, private key and openssl.cnf exclusively.
|
||||
o Reworked BIO networking library, with full support for IPv6.
|
||||
o New "unified" build system
|
||||
o New security levels
|
||||
o Support for scrypt algorithm
|
||||
o Support for X25519
|
||||
o Extended SSL_CONF support using configuration files
|
||||
o KDF algorithm support. Implement TLS PRF as a KDF.
|
||||
o Support for Certificate Transparency
|
||||
o HKDF support.
|
||||
|
||||
Major changes between OpenSSL 1.0.2g and OpenSSL 1.0.2h [3 May 2016]
|
||||
|
||||
o Prevent padding oracle in AES-NI CBC MAC check (CVE-2016-2107)
|
||||
o Fix EVP_EncodeUpdate overflow (CVE-2016-2105)
|
||||
o Fix EVP_EncryptUpdate overflow (CVE-2016-2106)
|
||||
o Prevent ASN.1 BIO excessive memory allocation (CVE-2016-2109)
|
||||
o EBCDIC overread (CVE-2016-2176)
|
||||
o Modify behavior of ALPN to invoke callback after SNI/servername
|
||||
callback, such that updates to the SSL_CTX affect ALPN.
|
||||
o Remove LOW from the DEFAULT cipher list. This removes singles DES from
|
||||
the default.
|
||||
o Only remove the SSLv2 methods with the no-ssl2-method option.
|
||||
|
||||
Major changes between OpenSSL 1.0.2f and OpenSSL 1.0.2g [1 Mar 2016]
|
||||
|
||||
o Disable weak ciphers in SSLv3 and up in default builds of OpenSSL.
|
||||
o Disable SSLv2 default build, default negotiation and weak ciphers
|
||||
(CVE-2016-0800)
|
||||
o Fix a double-free in DSA code (CVE-2016-0705)
|
||||
o Disable SRP fake user seed to address a server memory leak
|
||||
(CVE-2016-0798)
|
||||
o Fix BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption
|
||||
(CVE-2016-0797)
|
||||
o Fix memory issues in BIO_*printf functions (CVE-2016-0799)
|
||||
o Fix side channel attack on modular exponentiation (CVE-2016-0702)
|
||||
|
||||
Major changes between OpenSSL 1.0.2e and OpenSSL 1.0.2f [28 Jan 2016]
|
||||
|
||||
o DH small subgroups (CVE-2016-0701)
|
||||
o SSLv2 doesn't block disabled ciphers (CVE-2015-3197)
|
||||
|
||||
Major changes between OpenSSL 1.0.2d and OpenSSL 1.0.2e [3 Dec 2015]
|
||||
|
||||
o BN_mod_exp may produce incorrect results on x86_64 (CVE-2015-3193)
|
||||
o Certificate verify crash with missing PSS parameter (CVE-2015-3194)
|
||||
o X509_ATTRIBUTE memory leak (CVE-2015-3195)
|
||||
o Rewrite EVP_DecodeUpdate (base64 decoding) to fix several bugs
|
||||
o In DSA_generate_parameters_ex, if the provided seed is too short,
|
||||
return an error
|
||||
|
||||
Major changes between OpenSSL 1.0.2c and OpenSSL 1.0.2d [9 Jul 2015]
|
||||
|
||||
o Alternate chains certificate forgery (CVE-2015-1793)
|
||||
o Race condition handling PSK identify hint (CVE-2015-3196)
|
||||
|
||||
Major changes between OpenSSL 1.0.2b and OpenSSL 1.0.2c [12 Jun 2015]
|
||||
|
||||
o Fix HMAC ABI incompatibility
|
||||
|
||||
Major changes between OpenSSL 1.0.2a and OpenSSL 1.0.2b [11 Jun 2015]
|
||||
|
||||
o Malformed ECParameters causes infinite loop (CVE-2015-1788)
|
||||
o Exploitable out-of-bounds read in X509_cmp_time (CVE-2015-1789)
|
||||
o PKCS7 crash with missing EnvelopedContent (CVE-2015-1790)
|
||||
o CMS verify infinite loop with unknown hash function (CVE-2015-1792)
|
||||
o Race condition handling NewSessionTicket (CVE-2015-1791)
|
||||
|
||||
Major changes between OpenSSL 1.0.2 and OpenSSL 1.0.2a [19 Mar 2015]
|
||||
|
||||
o OpenSSL 1.0.2 ClientHello sigalgs DoS fix (CVE-2015-0291)
|
||||
o Multiblock corrupted pointer fix (CVE-2015-0290)
|
||||
o Segmentation fault in DTLSv1_listen fix (CVE-2015-0207)
|
||||
o Segmentation fault in ASN1_TYPE_cmp fix (CVE-2015-0286)
|
||||
o Segmentation fault for invalid PSS parameters fix (CVE-2015-0208)
|
||||
o ASN.1 structure reuse memory corruption fix (CVE-2015-0287)
|
||||
o PKCS7 NULL pointer dereferences fix (CVE-2015-0289)
|
||||
o DoS via reachable assert in SSLv2 servers fix (CVE-2015-0293)
|
||||
o Empty CKE with client auth and DHE fix (CVE-2015-1787)
|
||||
o Handshake with unseeded PRNG fix (CVE-2015-0285)
|
||||
o Use After Free following d2i_ECPrivatekey error fix (CVE-2015-0209)
|
||||
o X509_to_X509_REQ NULL pointer deref fix (CVE-2015-0288)
|
||||
o Removed the export ciphers from the DEFAULT ciphers
|
||||
|
||||
Major changes between OpenSSL 1.0.1l and OpenSSL 1.0.2 [22 Jan 2015]:
|
||||
|
||||
o Suite B support for TLS 1.2 and DTLS 1.2
|
||||
o Support for DTLS 1.2
|
||||
o TLS automatic EC curve selection.
|
||||
o API to set TLS supported signature algorithms and curves
|
||||
o SSL_CONF configuration API.
|
||||
o TLS Brainpool support.
|
||||
o ALPN support.
|
||||
o CMS support for RSA-PSS, RSA-OAEP, ECDH and X9.42 DH.
|
||||
|
||||
Major changes between OpenSSL 1.0.1k and OpenSSL 1.0.1l [15 Jan 2015]
|
||||
|
||||
o Build fixes for the Windows and OpenVMS platforms
|
||||
|
||||
Major changes between OpenSSL 1.0.1j and OpenSSL 1.0.1k [8 Jan 2015]
|
||||
|
||||
o Fix for CVE-2014-3571
|
||||
o Fix for CVE-2015-0206
|
||||
o Fix for CVE-2014-3569
|
||||
o Fix for CVE-2014-3572
|
||||
o Fix for CVE-2015-0204
|
||||
o Fix for CVE-2015-0205
|
||||
o Fix for CVE-2014-8275
|
||||
o Fix for CVE-2014-3570
|
||||
|
||||
Major changes between OpenSSL 1.0.1i and OpenSSL 1.0.1j [15 Oct 2014]
|
||||
|
||||
o Fix for CVE-2014-3513
|
||||
o Fix for CVE-2014-3567
|
||||
o Mitigation for CVE-2014-3566 (SSL protocol vulnerability)
|
||||
o Fix for CVE-2014-3568
|
||||
|
||||
Major changes between OpenSSL 1.0.1h and OpenSSL 1.0.1i [6 Aug 2014]
|
||||
|
||||
o Fix for CVE-2014-3512
|
||||
o Fix for CVE-2014-3511
|
||||
o Fix for CVE-2014-3510
|
||||
o Fix for CVE-2014-3507
|
||||
o Fix for CVE-2014-3506
|
||||
o Fix for CVE-2014-3505
|
||||
o Fix for CVE-2014-3509
|
||||
o Fix for CVE-2014-5139
|
||||
o Fix for CVE-2014-3508
|
||||
|
||||
Major changes between OpenSSL 1.0.1g and OpenSSL 1.0.1h [5 Jun 2014]
|
||||
|
||||
o Fix for CVE-2014-0224
|
||||
o Fix for CVE-2014-0221
|
||||
o Fix for CVE-2014-0198
|
||||
o Fix for CVE-2014-0195
|
||||
o Fix for CVE-2014-3470
|
||||
o Fix for CVE-2010-5298
|
||||
|
||||
Major changes between OpenSSL 1.0.1f and OpenSSL 1.0.1g [7 Apr 2014]
|
||||
|
||||
o Fix for CVE-2014-0160
|
||||
o Add TLS padding extension workaround for broken servers.
|
||||
o Fix for CVE-2014-0076
|
||||
|
||||
Major changes between OpenSSL 1.0.1e and OpenSSL 1.0.1f [6 Jan 2014]
|
||||
|
||||
o Don't include gmt_unix_time in TLS server and client random values
|
||||
o Fix for TLS record tampering bug CVE-2013-4353
|
||||
o Fix for TLS version checking bug CVE-2013-6449
|
||||
o Fix for DTLS retransmission bug CVE-2013-6450
|
||||
|
||||
Major changes between OpenSSL 1.0.1d and OpenSSL 1.0.1e [11 Feb 2013]:
|
||||
|
||||
o Corrected fix for CVE-2013-0169
|
||||
|
||||
Major changes between OpenSSL 1.0.1c and OpenSSL 1.0.1d [4 Feb 2013]:
|
||||
|
||||
o Fix renegotiation in TLS 1.1, 1.2 by using the correct TLS version.
|
||||
o Include the fips configuration module.
|
||||
o Fix OCSP bad key DoS attack CVE-2013-0166
|
||||
o Fix for SSL/TLS/DTLS CBC plaintext recovery attack CVE-2013-0169
|
||||
o Fix for TLS AESNI record handling flaw CVE-2012-2686
|
||||
|
||||
Major changes between OpenSSL 1.0.1b and OpenSSL 1.0.1c [10 May 2012]:
|
||||
|
||||
o Fix TLS/DTLS record length checking bug CVE-2012-2333
|
||||
o Don't attempt to use non-FIPS composite ciphers in FIPS mode.
|
||||
|
||||
Major changes between OpenSSL 1.0.1a and OpenSSL 1.0.1b [26 Apr 2012]:
|
||||
|
||||
o Fix compilation error on non-x86 platforms.
|
||||
o Make FIPS capable OpenSSL ciphers work in non-FIPS mode.
|
||||
o Fix SSL_OP_NO_TLSv1_1 clash with SSL_OP_ALL in OpenSSL 1.0.0
|
||||
|
||||
Major changes between OpenSSL 1.0.1 and OpenSSL 1.0.1a [19 Apr 2012]:
|
||||
|
||||
o Fix for ASN1 overflow bug CVE-2012-2110
|
||||
o Workarounds for some servers that hang on long client hellos.
|
||||
o Fix SEGV in AES code.
|
||||
|
||||
Major changes between OpenSSL 1.0.0h and OpenSSL 1.0.1 [14 Mar 2012]:
|
||||
|
||||
o TLS/DTLS heartbeat support.
|
||||
o SCTP support.
|
||||
o RFC 5705 TLS key material exporter.
|
||||
o RFC 5764 DTLS-SRTP negotiation.
|
||||
o Next Protocol Negotiation.
|
||||
o PSS signatures in certificates, requests and CRLs.
|
||||
o Support for password based recipient info for CMS.
|
||||
o Support TLS v1.2 and TLS v1.1.
|
||||
o Preliminary FIPS capability for unvalidated 2.0 FIPS module.
|
||||
o SRP support.
|
||||
|
||||
Major changes between OpenSSL 1.0.0g and OpenSSL 1.0.0h [12 Mar 2012]:
|
||||
|
||||
o Fix for CMS/PKCS#7 MMA CVE-2012-0884
|
||||
o Corrected fix for CVE-2011-4619
|
||||
o Various DTLS fixes.
|
||||
|
||||
Major changes between OpenSSL 1.0.0f and OpenSSL 1.0.0g [18 Jan 2012]:
|
||||
|
||||
o Fix for DTLS DoS issue CVE-2012-0050
|
||||
|
||||
Major changes between OpenSSL 1.0.0e and OpenSSL 1.0.0f [4 Jan 2012]:
|
||||
|
||||
o Fix for DTLS plaintext recovery attack CVE-2011-4108
|
||||
o Clear block padding bytes of SSL 3.0 records CVE-2011-4576
|
||||
o Only allow one SGC handshake restart for SSL/TLS CVE-2011-4619
|
||||
o Check parameters are not NULL in GOST ENGINE CVE-2012-0027
|
||||
o Check for malformed RFC3779 data CVE-2011-4577
|
||||
|
||||
Major changes between OpenSSL 1.0.0d and OpenSSL 1.0.0e [6 Sep 2011]:
|
||||
|
||||
o Fix for CRL vulnerability issue CVE-2011-3207
|
||||
o Fix for ECDH crashes CVE-2011-3210
|
||||
o Protection against EC timing attacks.
|
||||
o Support ECDH ciphersuites for certificates using SHA2 algorithms.
|
||||
o Various DTLS fixes.
|
||||
|
||||
Major changes between OpenSSL 1.0.0c and OpenSSL 1.0.0d [8 Feb 2011]:
|
||||
|
||||
o Fix for security issue CVE-2011-0014
|
||||
|
||||
Major changes between OpenSSL 1.0.0b and OpenSSL 1.0.0c [2 Dec 2010]:
|
||||
|
||||
o Fix for security issue CVE-2010-4180
|
||||
o Fix for CVE-2010-4252
|
||||
o Fix mishandling of absent EC point format extension.
|
||||
o Fix various platform compilation issues.
|
||||
o Corrected fix for security issue CVE-2010-3864.
|
||||
|
||||
Major changes between OpenSSL 1.0.0a and OpenSSL 1.0.0b [16 Nov 2010]:
|
||||
|
||||
o Fix for security issue CVE-2010-3864.
|
||||
o Fix for CVE-2010-2939
|
||||
o Fix WIN32 build system for GOST ENGINE.
|
||||
|
||||
Major changes between OpenSSL 1.0.0 and OpenSSL 1.0.0a [1 Jun 2010]:
|
||||
|
||||
o Fix for security issue CVE-2010-1633.
|
||||
o GOST MAC and CFB fixes.
|
||||
|
||||
Major changes between OpenSSL 0.9.8n and OpenSSL 1.0.0 [29 Mar 2010]:
|
||||
|
||||
o RFC3280 path validation: sufficient to process PKITS tests.
|
||||
o Integrated support for PVK files and keyblobs.
|
||||
o Change default private key format to PKCS#8.
|
||||
o CMS support: able to process all examples in RFC4134
|
||||
o Streaming ASN1 encode support for PKCS#7 and CMS.
|
||||
o Multiple signer and signer add support for PKCS#7 and CMS.
|
||||
o ASN1 printing support.
|
||||
o Whirlpool hash algorithm added.
|
||||
o RFC3161 time stamp support.
|
||||
o New generalised public key API supporting ENGINE based algorithms.
|
||||
o New generalised public key API utilities.
|
||||
o New ENGINE supporting GOST algorithms.
|
||||
o SSL/TLS GOST ciphersuite support.
|
||||
o PKCS#7 and CMS GOST support.
|
||||
o RFC4279 PSK ciphersuite support.
|
||||
o Supported points format extension for ECC ciphersuites.
|
||||
o ecdsa-with-SHA224/256/384/512 signature types.
|
||||
o dsa-with-SHA224 and dsa-with-SHA256 signature types.
|
||||
o Opaque PRF Input TLS extension support.
|
||||
o Updated time routines to avoid OS limitations.
|
||||
|
||||
Major changes between OpenSSL 0.9.8m and OpenSSL 0.9.8n [24 Mar 2010]:
|
||||
|
||||
o CFB cipher definition fixes.
|
||||
o Fix security issues CVE-2010-0740 and CVE-2010-0433.
|
||||
|
||||
Major changes between OpenSSL 0.9.8l and OpenSSL 0.9.8m [25 Feb 2010]:
|
||||
|
||||
o Cipher definition fixes.
|
||||
o Workaround for slow RAND_poll() on some WIN32 versions.
|
||||
o Remove MD2 from algorithm tables.
|
||||
o SPKAC handling fixes.
|
||||
o Support for RFC5746 TLS renegotiation extension.
|
||||
o Compression memory leak fixed.
|
||||
o Compression session resumption fixed.
|
||||
o Ticket and SNI coexistence fixes.
|
||||
o Many fixes to DTLS handling.
|
||||
|
||||
Major changes between OpenSSL 0.9.8k and OpenSSL 0.9.8l [5 Nov 2009]:
|
||||
|
||||
o Temporary work around for CVE-2009-3555: disable renegotiation.
|
||||
|
||||
Major changes between OpenSSL 0.9.8j and OpenSSL 0.9.8k [25 Mar 2009]:
|
||||
|
||||
o Fix various build issues.
|
||||
o Fix security issues (CVE-2009-0590, CVE-2009-0591, CVE-2009-0789)
|
||||
|
||||
Major changes between OpenSSL 0.9.8i and OpenSSL 0.9.8j [7 Jan 2009]:
|
||||
|
||||
o Fix security issue (CVE-2008-5077)
|
||||
o Merge FIPS 140-2 branch code.
|
||||
|
||||
Major changes between OpenSSL 0.9.8g and OpenSSL 0.9.8h [28 May 2008]:
|
||||
|
||||
o CryptoAPI ENGINE support.
|
||||
o Various precautionary measures.
|
||||
o Fix for bugs affecting certificate request creation.
|
||||
o Support for local machine keyset attribute in PKCS#12 files.
|
||||
|
||||
Major changes between OpenSSL 0.9.8f and OpenSSL 0.9.8g [19 Oct 2007]:
|
||||
|
||||
o Backport of CMS functionality to 0.9.8.
|
||||
o Fixes for bugs introduced with 0.9.8f.
|
||||
|
||||
Major changes between OpenSSL 0.9.8e and OpenSSL 0.9.8f [11 Oct 2007]:
|
||||
|
||||
o Add gcc 4.2 support.
|
||||
o Add support for AES and SSE2 assembly language optimization
|
||||
for VC++ build.
|
||||
o Support for RFC4507bis and server name extensions if explicitly
|
||||
selected at compile time.
|
||||
o DTLS improvements.
|
||||
o RFC4507bis support.
|
||||
o TLS Extensions support.
|
||||
|
||||
Major changes between OpenSSL 0.9.8d and OpenSSL 0.9.8e [23 Feb 2007]:
|
||||
|
||||
o Various ciphersuite selection fixes.
|
||||
o RFC3779 support.
|
||||
|
||||
Major changes between OpenSSL 0.9.8c and OpenSSL 0.9.8d [28 Sep 2006]:
|
||||
|
||||
o Introduce limits to prevent malicious key DoS (CVE-2006-2940)
|
||||
o Fix security issues (CVE-2006-2937, CVE-2006-3737, CVE-2006-4343)
|
||||
o Changes to ciphersuite selection algorithm
|
||||
|
||||
Major changes between OpenSSL 0.9.8b and OpenSSL 0.9.8c [5 Sep 2006]:
|
||||
|
||||
o Fix Daniel Bleichenbacher forged signature attack, CVE-2006-4339
|
||||
o New cipher Camellia
|
||||
|
||||
Major changes between OpenSSL 0.9.8a and OpenSSL 0.9.8b [4 May 2006]:
|
||||
|
||||
o Cipher string fixes.
|
||||
o Fixes for VC++ 2005.
|
||||
o Updated ECC cipher suite support.
|
||||
o New functions EVP_CIPHER_CTX_new() and EVP_CIPHER_CTX_free().
|
||||
o Zlib compression usage fixes.
|
||||
o Built in dynamic engine compilation support on Win32.
|
||||
o Fixes auto dynamic engine loading in Win32.
|
||||
|
||||
Major changes between OpenSSL 0.9.8 and OpenSSL 0.9.8a [11 Oct 2005]:
|
||||
|
||||
o Fix potential SSL 2.0 rollback, CVE-2005-2969
|
||||
o Extended Windows CE support
|
||||
|
||||
Major changes between OpenSSL 0.9.7g and OpenSSL 0.9.8 [5 Jul 2005]:
|
||||
|
||||
o Major work on the BIGNUM library for higher efficiency and to
|
||||
make operations more streamlined and less contradictory. This
|
||||
is the result of a major audit of the BIGNUM library.
|
||||
o Addition of BIGNUM functions for fields GF(2^m) and NIST
|
||||
curves, to support the Elliptic Crypto functions.
|
||||
o Major work on Elliptic Crypto; ECDH and ECDSA added, including
|
||||
the use through EVP, X509 and ENGINE.
|
||||
o New ASN.1 mini-compiler that's usable through the OpenSSL
|
||||
configuration file.
|
||||
o Added support for ASN.1 indefinite length constructed encoding.
|
||||
o New PKCS#12 'medium level' API to manipulate PKCS#12 files.
|
||||
o Complete rework of shared library construction and linking
|
||||
programs with shared or static libraries, through a separate
|
||||
Makefile.shared.
|
||||
o Rework of the passing of parameters from one Makefile to another.
|
||||
o Changed ENGINE framework to load dynamic engine modules
|
||||
automatically from specifically given directories.
|
||||
o New structure and ASN.1 functions for CertificatePair.
|
||||
o Changed the ZLIB compression method to be stateful.
|
||||
o Changed the key-generation and primality testing "progress"
|
||||
mechanism to take a structure that contains the ticker
|
||||
function and an argument.
|
||||
o New engine module: GMP (performs private key exponentiation).
|
||||
o New engine module: VIA PadLOck ACE extension in VIA C3
|
||||
Nehemiah processors.
|
||||
o Added support for IPv6 addresses in certificate extensions.
|
||||
See RFC 1884, section 2.2.
|
||||
o Added support for certificate policy mappings, policy
|
||||
constraints and name constraints.
|
||||
o Added support for multi-valued AVAs in the OpenSSL
|
||||
configuration file.
|
||||
o Added support for multiple certificates with the same subject
|
||||
in the 'openssl ca' index file.
|
||||
o Make it possible to create self-signed certificates using
|
||||
'openssl ca -selfsign'.
|
||||
o Make it possible to generate a serial number file with
|
||||
'openssl ca -create_serial'.
|
||||
o New binary search functions with extended functionality.
|
||||
o New BUF functions.
|
||||
o New STORE structure and library to provide an interface to all
|
||||
sorts of data repositories. Supports storage of public and
|
||||
private keys, certificates, CRLs, numbers and arbitrary blobs.
|
||||
This library is unfortunately unfinished and unused within
|
||||
OpenSSL.
|
||||
o New control functions for the error stack.
|
||||
o Changed the PKCS#7 library to support one-pass S/MIME
|
||||
processing.
|
||||
o Added the possibility to compile without old deprecated
|
||||
functionality with the OPENSSL_NO_DEPRECATED macro or the
|
||||
'no-deprecated' argument to the config and Configure scripts.
|
||||
o Constification of all ASN.1 conversion functions, and other
|
||||
affected functions.
|
||||
o Improved platform support for PowerPC.
|
||||
o New FIPS 180-2 algorithms (SHA-224, -256, -384 and -512).
|
||||
o New X509_VERIFY_PARAM structure to support parameterisation
|
||||
of X.509 path validation.
|
||||
o Major overhaul of RC4 performance on Intel P4, IA-64 and
|
||||
AMD64.
|
||||
o Changed the Configure script to have some algorithms disabled
|
||||
by default. Those can be explicitly enabled with the new
|
||||
argument form 'enable-xxx'.
|
||||
o Change the default digest in 'openssl' commands from MD5 to
|
||||
SHA-1.
|
||||
o Added support for DTLS.
|
||||
o New BIGNUM blinding.
|
||||
o Added support for the RSA-PSS encryption scheme
|
||||
o Added support for the RSA X.931 padding.
|
||||
o Added support for BSD sockets on NetWare.
|
||||
o Added support for files larger than 2GB.
|
||||
o Added initial support for Win64.
|
||||
o Added alternate pkg-config files.
|
||||
|
||||
Major changes between OpenSSL 0.9.7l and OpenSSL 0.9.7m [23 Feb 2007]:
|
||||
|
||||
o FIPS 1.1.1 module linking.
|
||||
o Various ciphersuite selection fixes.
|
||||
|
||||
Major changes between OpenSSL 0.9.7k and OpenSSL 0.9.7l [28 Sep 2006]:
|
||||
|
||||
o Introduce limits to prevent malicious key DoS (CVE-2006-2940)
|
||||
o Fix security issues (CVE-2006-2937, CVE-2006-3737, CVE-2006-4343)
|
||||
|
||||
Major changes between OpenSSL 0.9.7j and OpenSSL 0.9.7k [5 Sep 2006]:
|
||||
|
||||
o Fix Daniel Bleichenbacher forged signature attack, CVE-2006-4339
|
||||
|
||||
Major changes between OpenSSL 0.9.7i and OpenSSL 0.9.7j [4 May 2006]:
|
||||
|
||||
o Visual C++ 2005 fixes.
|
||||
o Update Windows build system for FIPS.
|
||||
|
||||
Major changes between OpenSSL 0.9.7h and OpenSSL 0.9.7i [14 Oct 2005]:
|
||||
|
||||
o Give EVP_MAX_MD_SIZE its old value, except for a FIPS build.
|
||||
|
||||
Major changes between OpenSSL 0.9.7g and OpenSSL 0.9.7h [11 Oct 2005]:
|
||||
|
||||
o Fix SSL 2.0 Rollback, CVE-2005-2969
|
||||
o Allow use of fixed-length exponent on DSA signing
|
||||
o Default fixed-window RSA, DSA, DH private-key operations
|
||||
|
||||
Major changes between OpenSSL 0.9.7f and OpenSSL 0.9.7g [11 Apr 2005]:
|
||||
|
||||
o More compilation issues fixed.
|
||||
o Adaptation to more modern Kerberos API.
|
||||
o Enhanced or corrected configuration for Solaris64, Mingw and Cygwin.
|
||||
o Enhanced x86_64 assembler BIGNUM module.
|
||||
o More constification.
|
||||
o Added processing of proxy certificates (RFC 3820).
|
||||
|
||||
Major changes between OpenSSL 0.9.7e and OpenSSL 0.9.7f [22 Mar 2005]:
|
||||
|
||||
o Several compilation issues fixed.
|
||||
o Many memory allocation failure checks added.
|
||||
o Improved comparison of X509 Name type.
|
||||
o Mandatory basic checks on certificates.
|
||||
o Performance improvements.
|
||||
|
||||
Major changes between OpenSSL 0.9.7d and OpenSSL 0.9.7e [25 Oct 2004]:
|
||||
|
||||
o Fix race condition in CRL checking code.
|
||||
o Fixes to PKCS#7 (S/MIME) code.
|
||||
|
||||
Major changes between OpenSSL 0.9.7c and OpenSSL 0.9.7d [17 Mar 2004]:
|
||||
|
||||
o Security: Fix Kerberos ciphersuite SSL/TLS handshaking bug
|
||||
o Security: Fix null-pointer assignment in do_change_cipher_spec()
|
||||
o Allow multiple active certificates with same subject in CA index
|
||||
o Multiple X509 verification fixes
|
||||
o Speed up HMAC and other operations
|
||||
|
||||
Major changes between OpenSSL 0.9.7b and OpenSSL 0.9.7c [30 Sep 2003]:
|
||||
|
||||
o Security: fix various ASN1 parsing bugs.
|
||||
o New -ignore_err option to OCSP utility.
|
||||
o Various interop and bug fixes in S/MIME code.
|
||||
o SSL/TLS protocol fix for unrequested client certificates.
|
||||
|
||||
Major changes between OpenSSL 0.9.7a and OpenSSL 0.9.7b [10 Apr 2003]:
|
||||
|
||||
o Security: counter the Klima-Pokorny-Rosa extension of
|
||||
Bleichbacher's attack
|
||||
o Security: make RSA blinding default.
|
||||
o Configuration: Irix fixes, AIX fixes, better mingw support.
|
||||
o Support for new platforms: linux-ia64-ecc.
|
||||
o Build: shared library support fixes.
|
||||
o ASN.1: treat domainComponent correctly.
|
||||
o Documentation: fixes and additions.
|
||||
|
||||
Major changes between OpenSSL 0.9.7 and OpenSSL 0.9.7a [19 Feb 2003]:
|
||||
|
||||
o Security: Important security related bugfixes.
|
||||
o Enhanced compatibility with MIT Kerberos.
|
||||
o Can be built without the ENGINE framework.
|
||||
o IA32 assembler enhancements.
|
||||
o Support for new platforms: FreeBSD/IA64 and FreeBSD/Sparc64.
|
||||
o Configuration: the no-err option now works properly.
|
||||
o SSL/TLS: now handles manual certificate chain building.
|
||||
o SSL/TLS: certain session ID malfunctions corrected.
|
||||
|
||||
Major changes between OpenSSL 0.9.6 and OpenSSL 0.9.7 [30 Dec 2002]:
|
||||
|
||||
o New library section OCSP.
|
||||
o Complete rewrite of ASN1 code.
|
||||
o CRL checking in verify code and openssl utility.
|
||||
o Extension copying in 'ca' utility.
|
||||
o Flexible display options in 'ca' utility.
|
||||
o Provisional support for international characters with UTF8.
|
||||
o Support for external crypto devices ('engine') is no longer
|
||||
a separate distribution.
|
||||
o New elliptic curve library section.
|
||||
o New AES (Rijndael) library section.
|
||||
o Support for new platforms: Windows CE, Tandem OSS, A/UX, AIX 64-bit,
|
||||
Linux x86_64, Linux 64-bit on Sparc v9
|
||||
o Extended support for some platforms: VxWorks
|
||||
o Enhanced support for shared libraries.
|
||||
o Now only builds PIC code when shared library support is requested.
|
||||
o Support for pkg-config.
|
||||
o Lots of new manuals.
|
||||
o Makes symbolic links to or copies of manuals to cover all described
|
||||
functions.
|
||||
o Change DES API to clean up the namespace (some applications link also
|
||||
against libdes providing similar functions having the same name).
|
||||
Provide macros for backward compatibility (will be removed in the
|
||||
future).
|
||||
o Unify handling of cryptographic algorithms (software and engine)
|
||||
to be available via EVP routines for asymmetric and symmetric ciphers.
|
||||
o NCONF: new configuration handling routines.
|
||||
o Change API to use more 'const' modifiers to improve error checking
|
||||
and help optimizers.
|
||||
o Finally remove references to RSAref.
|
||||
o Reworked parts of the BIGNUM code.
|
||||
o Support for new engines: Broadcom ubsec, Accelerated Encryption
|
||||
Processing, IBM 4758.
|
||||
o A few new engines added in the demos area.
|
||||
o Extended and corrected OID (object identifier) table.
|
||||
o PRNG: query at more locations for a random device, automatic query for
|
||||
EGD style random sources at several locations.
|
||||
o SSL/TLS: allow optional cipher choice according to server's preference.
|
||||
o SSL/TLS: allow server to explicitly set new session ids.
|
||||
o SSL/TLS: support Kerberos cipher suites (RFC2712).
|
||||
Only supports MIT Kerberos for now.
|
||||
o SSL/TLS: allow more precise control of renegotiations and sessions.
|
||||
o SSL/TLS: add callback to retrieve SSL/TLS messages.
|
||||
o SSL/TLS: support AES cipher suites (RFC3268).
|
||||
|
||||
Major changes between OpenSSL 0.9.6j and OpenSSL 0.9.6k [30 Sep 2003]:
|
||||
|
||||
o Security: fix various ASN1 parsing bugs.
|
||||
o SSL/TLS protocol fix for unrequested client certificates.
|
||||
|
||||
Major changes between OpenSSL 0.9.6i and OpenSSL 0.9.6j [10 Apr 2003]:
|
||||
|
||||
o Security: counter the Klima-Pokorny-Rosa extension of
|
||||
Bleichbacher's attack
|
||||
o Security: make RSA blinding default.
|
||||
o Build: shared library support fixes.
|
||||
|
||||
Major changes between OpenSSL 0.9.6h and OpenSSL 0.9.6i [19 Feb 2003]:
|
||||
|
||||
o Important security related bugfixes.
|
||||
|
||||
Major changes between OpenSSL 0.9.6g and OpenSSL 0.9.6h [5 Dec 2002]:
|
||||
|
||||
o New configuration targets for Tandem OSS and A/UX.
|
||||
o New OIDs for Microsoft attributes.
|
||||
o Better handling of SSL session caching.
|
||||
o Better comparison of distinguished names.
|
||||
o Better handling of shared libraries in a mixed GNU/non-GNU environment.
|
||||
o Support assembler code with Borland C.
|
||||
o Fixes for length problems.
|
||||
o Fixes for uninitialised variables.
|
||||
o Fixes for memory leaks, some unusual crashes and some race conditions.
|
||||
o Fixes for smaller building problems.
|
||||
o Updates of manuals, FAQ and other instructive documents.
|
||||
|
||||
Major changes between OpenSSL 0.9.6f and OpenSSL 0.9.6g [9 Aug 2002]:
|
||||
|
||||
o Important building fixes on Unix.
|
||||
|
||||
Major changes between OpenSSL 0.9.6e and OpenSSL 0.9.6f [8 Aug 2002]:
|
||||
|
||||
o Various important bugfixes.
|
||||
|
||||
Major changes between OpenSSL 0.9.6d and OpenSSL 0.9.6e [30 Jul 2002]:
|
||||
|
||||
o Important security related bugfixes.
|
||||
o Various SSL/TLS library bugfixes.
|
||||
|
||||
Major changes between OpenSSL 0.9.6c and OpenSSL 0.9.6d [9 May 2002]:
|
||||
|
||||
o Various SSL/TLS library bugfixes.
|
||||
o Fix DH parameter generation for 'non-standard' generators.
|
||||
|
||||
Major changes between OpenSSL 0.9.6b and OpenSSL 0.9.6c [21 Dec 2001]:
|
||||
|
||||
o Various SSL/TLS library bugfixes.
|
||||
o BIGNUM library fixes.
|
||||
o RSA OAEP and random number generation fixes.
|
||||
o Object identifiers corrected and added.
|
||||
o Add assembler BN routines for IA64.
|
||||
o Add support for OS/390 Unix, UnixWare with gcc, OpenUNIX 8,
|
||||
MIPS Linux; shared library support for Irix, HP-UX.
|
||||
o Add crypto accelerator support for AEP, Baltimore SureWare,
|
||||
Broadcom and Cryptographic Appliance's keyserver
|
||||
[in 0.9.6c-engine release].
|
||||
|
||||
Major changes between OpenSSL 0.9.6a and OpenSSL 0.9.6b [9 Jul 2001]:
|
||||
|
||||
o Security fix: PRNG improvements.
|
||||
o Security fix: RSA OAEP check.
|
||||
o Security fix: Reinsert and fix countermeasure to Bleichbacher's
|
||||
attack.
|
||||
o MIPS bug fix in BIGNUM.
|
||||
o Bug fix in "openssl enc".
|
||||
o Bug fix in X.509 printing routine.
|
||||
o Bug fix in DSA verification routine and DSA S/MIME verification.
|
||||
o Bug fix to make PRNG thread-safe.
|
||||
o Bug fix in RAND_file_name().
|
||||
o Bug fix in compatibility mode trust settings.
|
||||
o Bug fix in blowfish EVP.
|
||||
o Increase default size for BIO buffering filter.
|
||||
o Compatibility fixes in some scripts.
|
||||
|
||||
Major changes between OpenSSL 0.9.6 and OpenSSL 0.9.6a [5 Apr 2001]:
|
||||
|
||||
o Security fix: change behavior of OpenSSL to avoid using
|
||||
environment variables when running as root.
|
||||
o Security fix: check the result of RSA-CRT to reduce the
|
||||
possibility of deducing the private key from an incorrectly
|
||||
calculated signature.
|
||||
o Security fix: prevent Bleichenbacher's DSA attack.
|
||||
o Security fix: Zero the premaster secret after deriving the
|
||||
master secret in DH ciphersuites.
|
||||
o Reimplement SSL_peek(), which had various problems.
|
||||
o Compatibility fix: the function des_encrypt() renamed to
|
||||
des_encrypt1() to avoid clashes with some Unixen libc.
|
||||
o Bug fixes for Win32, HP/UX and Irix.
|
||||
o Bug fixes in BIGNUM, SSL, PKCS#7, PKCS#12, X.509, CONF and
|
||||
memory checking routines.
|
||||
o Bug fixes for RSA operations in threaded environments.
|
||||
o Bug fixes in misc. openssl applications.
|
||||
o Remove a few potential memory leaks.
|
||||
o Add tighter checks of BIGNUM routines.
|
||||
o Shared library support has been reworked for generality.
|
||||
o More documentation.
|
||||
o New function BN_rand_range().
|
||||
o Add "-rand" option to openssl s_client and s_server.
|
||||
|
||||
Major changes between OpenSSL 0.9.5a and OpenSSL 0.9.6 [10 Oct 2000]:
|
||||
|
||||
o Some documentation for BIO and SSL libraries.
|
||||
o Enhanced chain verification using key identifiers.
|
||||
o New sign and verify options to 'dgst' application.
|
||||
o Support for DER and PEM encoded messages in 'smime' application.
|
||||
o New 'rsautl' application, low level RSA utility.
|
||||
o MD4 now included.
|
||||
o Bugfix for SSL rollback padding check.
|
||||
o Support for external crypto devices [1].
|
||||
o Enhanced EVP interface.
|
||||
|
||||
[1] The support for external crypto devices is currently a separate
|
||||
distribution. See the file README.ENGINE.
|
||||
|
||||
Major changes between OpenSSL 0.9.5 and OpenSSL 0.9.5a [1 Apr 2000]:
|
||||
|
||||
o Bug fixes for Win32, SuSE Linux, NeXTSTEP and FreeBSD 2.2.8
|
||||
o Shared library support for HPUX and Solaris-gcc
|
||||
o Support of Linux/IA64
|
||||
o Assembler support for Mingw32
|
||||
o New 'rand' application
|
||||
o New way to check for existence of algorithms from scripts
|
||||
|
||||
Major changes between OpenSSL 0.9.4 and OpenSSL 0.9.5 [25 May 2000]:
|
||||
|
||||
o S/MIME support in new 'smime' command
|
||||
o Documentation for the OpenSSL command line application
|
||||
o Automation of 'req' application
|
||||
o Fixes to make s_client, s_server work under Windows
|
||||
o Support for multiple fieldnames in SPKACs
|
||||
o New SPKAC command line utility and associated library functions
|
||||
o Options to allow passwords to be obtained from various sources
|
||||
o New public key PEM format and options to handle it
|
||||
o Many other fixes and enhancements to command line utilities
|
||||
o Usable certificate chain verification
|
||||
o Certificate purpose checking
|
||||
o Certificate trust settings
|
||||
o Support of authority information access extension
|
||||
o Extensions in certificate requests
|
||||
o Simplified X509 name and attribute routines
|
||||
o Initial (incomplete) support for international character sets
|
||||
o New DH_METHOD, DSA_METHOD and enhanced RSA_METHOD
|
||||
o Read only memory BIOs and simplified creation function
|
||||
o TLS/SSL protocol bugfixes: Accept TLS 'client hello' in SSL 3.0
|
||||
record; allow fragmentation and interleaving of handshake and other
|
||||
data
|
||||
o TLS/SSL code now "tolerates" MS SGC
|
||||
o Work around for Netscape client certificate hang bug
|
||||
o RSA_NULL option that removes RSA patent code but keeps other
|
||||
RSA functionality
|
||||
o Memory leak detection now allows applications to add extra information
|
||||
via a per-thread stack
|
||||
o PRNG robustness improved
|
||||
o EGD support
|
||||
o BIGNUM library bug fixes
|
||||
o Faster DSA parameter generation
|
||||
o Enhanced support for Alpha Linux
|
||||
o Experimental MacOS support
|
||||
|
||||
Major changes between OpenSSL 0.9.3 and OpenSSL 0.9.4 [9 Aug 1999]:
|
||||
|
||||
o Transparent support for PKCS#8 format private keys: these are used
|
||||
by several software packages and are more secure than the standard
|
||||
form
|
||||
o PKCS#5 v2.0 implementation
|
||||
o Password callbacks have a new void * argument for application data
|
||||
o Avoid various memory leaks
|
||||
o New pipe-like BIO that allows using the SSL library when actual I/O
|
||||
must be handled by the application (BIO pair)
|
||||
|
||||
Major changes between OpenSSL 0.9.2b and OpenSSL 0.9.3 [24 May 1999]:
|
||||
o Lots of enhancements and cleanups to the Configuration mechanism
|
||||
o RSA OEAP related fixes
|
||||
o Added `openssl ca -revoke' option for revoking a certificate
|
||||
o Source cleanups: const correctness, type-safe stacks and ASN.1 SETs
|
||||
o Source tree cleanups: removed lots of obsolete files
|
||||
o Thawte SXNet, certificate policies and CRL distribution points
|
||||
extension support
|
||||
o Preliminary (experimental) S/MIME support
|
||||
o Support for ASN.1 UTF8String and VisibleString
|
||||
o Full integration of PKCS#12 code
|
||||
o Sparc assembler bignum implementation, optimized hash functions
|
||||
o Option to disable selected ciphers
|
||||
|
||||
Major changes between OpenSSL 0.9.1c and OpenSSL 0.9.2b [22 Mar 1999]:
|
||||
o Fixed a security hole related to session resumption
|
||||
o Fixed RSA encryption routines for the p < q case
|
||||
o "ALL" in cipher lists now means "everything except NULL ciphers"
|
||||
o Support for Triple-DES CBCM cipher
|
||||
o Support of Optimal Asymmetric Encryption Padding (OAEP) for RSA
|
||||
o First support for new TLSv1 ciphers
|
||||
o Added a few new BIOs (syslog BIO, reliable BIO)
|
||||
o Extended support for DSA certificate/keys.
|
||||
o Extended support for Certificate Signing Requests (CSR)
|
||||
o Initial support for X.509v3 extensions
|
||||
o Extended support for compression inside the SSL record layer
|
||||
o Overhauled Win32 builds
|
||||
o Cleanups and fixes to the Big Number (BN) library
|
||||
o Support for ASN.1 GeneralizedTime
|
||||
o Splitted ASN.1 SETs from SEQUENCEs
|
||||
o ASN1 and PEM support for Netscape Certificate Sequences
|
||||
o Overhauled Perl interface
|
||||
o Lots of source tree cleanups.
|
||||
o Lots of memory leak fixes.
|
||||
o Lots of bug fixes.
|
||||
|
||||
Major changes between SSLeay 0.9.0b and OpenSSL 0.9.1c [23 Dec 1998]:
|
||||
o Integration of the popular NO_RSA/NO_DSA patches
|
||||
o Initial support for compression inside the SSL record layer
|
||||
o Added BIO proxy and filtering functionality
|
||||
o Extended Big Number (BN) library
|
||||
o Added RIPE MD160 message digest
|
||||
o Added support for RC2/64bit cipher
|
||||
o Extended ASN.1 parser routines
|
||||
o Adjustments of the source tree for CVS
|
||||
o Support for various new platforms
|
||||
@@ -0,0 +1,1447 @@
|
||||
NEWS
|
||||
====
|
||||
|
||||
This file gives a brief overview of the major changes between each OpenSSL
|
||||
release. For more details please read the CHANGES file.
|
||||
|
||||
OpenSSL Releases
|
||||
----------------
|
||||
|
||||
- [OpenSSL 3.0](#openssl-30)
|
||||
- [OpenSSL 1.1.1](#openssl-111)
|
||||
- [OpenSSL 1.1.0](#openssl-110)
|
||||
- [OpenSSL 1.0.2](#openssl-102)
|
||||
- [OpenSSL 1.0.1](#openssl-101)
|
||||
- [OpenSSL 1.0.0](#openssl-100)
|
||||
- [OpenSSL 0.9.x](#openssl-09x)
|
||||
|
||||
OpenSSL 3.0
|
||||
-----------
|
||||
|
||||
### Major changes between OpenSSL 1.1.1 and OpenSSL 3.0 [under development]
|
||||
|
||||
* Interactive mode is removed from the 'openssl' program.
|
||||
* The X25519, X448, Ed25519, Ed448 and SHAKE256 algorithms are included in
|
||||
the FIPS provider. None have the "fips=yes" property set and, as such,
|
||||
will not be accidentially used.
|
||||
* The algorithm specific public key command line applications have
|
||||
been deprecated. These include dhparam, gendsa and others. The pkey
|
||||
alternatives should be used intead: pkey, pkeyparam and genpkey.
|
||||
* X509 certificates signed using SHA1 are no longer allowed at security
|
||||
level 1 or higher. The default security level for TLS is 1, so
|
||||
certificates signed using SHA1 are by default no longer trusted to
|
||||
authenticate servers or clients.
|
||||
* enable-crypto-mdebug and enable-crypto-mdebug-backtrace were mostly
|
||||
disabled; the project uses address sanitize/leak-detect instead.
|
||||
* Added a Certificate Management Protocol (CMP, RFC 4210) implementation
|
||||
also covering CRMF (RFC 4211) and HTTP transfer (RFC 6712).
|
||||
It is part of the crypto lib and adds a 'cmp' app with a demo configuration.
|
||||
All widely used CMP features are supported for both clients and servers.
|
||||
* Added a proper HTTP(S) client to libcrypto supporting GET and POST,
|
||||
redirection, plain and ASN.1-encoded contents, proxies, and timeouts.
|
||||
* Added OSSL_SERIALIZER, a generic serializer API.
|
||||
* Added OSSL_PARAM_BLD, an easier to use API to OSSL_PARAM.
|
||||
* Added error raising macros, ERR_raise() and ERR_raise_data().
|
||||
* Deprecated ERR_put_error().
|
||||
* Added OSSL_PROVIDER_available(), to check provider availibility.
|
||||
* Added 'openssl mac' that uses the EVP_MAC API.
|
||||
* Added 'openssl kdf' that uses the EVP_KDF API.
|
||||
* Add OPENSSL_info() and 'openssl info' to get built-in data.
|
||||
* Add support for enabling instrumentation through trace and debug
|
||||
output.
|
||||
* Changed our version number scheme and set the next major release to
|
||||
3.0.0
|
||||
* Added EVP_MAC, an EVP layer MAC API, and a generic EVP_PKEY to EVP_MAC
|
||||
bridge.
|
||||
* Removed the heartbeat message in DTLS feature.
|
||||
* Added EVP_KDF, an EVP layer KDF API, and a generic EVP_PKEY to EVP_KDF
|
||||
bridge.
|
||||
* All of the low level MD2, MD4, MD5, MDC2, RIPEMD160, SHA1, SHA224,
|
||||
SHA256, SHA384, SHA512 and Whirlpool digest functions have been
|
||||
deprecated.
|
||||
* All of the low level AES, Blowfish, Camellia, CAST, DES, IDEA, RC2,
|
||||
RC4, RC5 and SEED cipher functions have been deprecated.
|
||||
* All of the low level DH, DSA, ECDH, ECDSA and RSA public key functions
|
||||
have been deprecated.
|
||||
|
||||
OpenSSL 1.1.1
|
||||
-------------
|
||||
|
||||
### Major changes between OpenSSL 1.1.1e and OpenSSL 1.1.1f [under development]
|
||||
|
||||
*
|
||||
|
||||
### Major changes between OpenSSL 1.1.1d and OpenSSL 1.1.1e [17 Mar 2020]
|
||||
|
||||
* Fixed an overflow bug in the x64_64 Montgomery squaring procedure
|
||||
used in exponentiation with 512-bit moduli ([CVE-2019-1551][])
|
||||
|
||||
### Major changes between OpenSSL 1.1.1c and OpenSSL 1.1.1d [10 Sep 2019]
|
||||
|
||||
* Fixed a fork protection issue ([CVE-2019-1549][])
|
||||
* Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey
|
||||
([CVE-2019-1563][])
|
||||
* For built-in EC curves, ensure an EC_GROUP built from the curve name is
|
||||
used even when parsing explicit parameters
|
||||
* Compute ECC cofactors if not provided during EC_GROUP construction
|
||||
([CVE-2019-1547][])
|
||||
* Early start up entropy quality from the DEVRANDOM seed source has been
|
||||
improved for older Linux systems
|
||||
* Correct the extended master secret constant on EBCDIC systems
|
||||
* Use Windows installation paths in the mingw builds ([CVE-2019-1552][])
|
||||
* Changed DH_check to accept parameters with order q and 2q subgroups
|
||||
* Significantly reduce secure memory usage by the randomness pools
|
||||
* Revert the DEVRANDOM_WAIT feature for Linux systems
|
||||
|
||||
### Major changes between OpenSSL 1.1.1b and OpenSSL 1.1.1c [28 May 2019]
|
||||
|
||||
* Prevent over long nonces in ChaCha20-Poly1305 ([CVE-2019-1543][])
|
||||
|
||||
### Major changes between OpenSSL 1.1.1a and OpenSSL 1.1.1b [26 Feb 2019]
|
||||
|
||||
* Change the info callback signals for the start and end of a post-handshake
|
||||
message exchange in TLSv1.3.
|
||||
* Fix a bug in DTLS over SCTP. This breaks interoperability with older
|
||||
versions of OpenSSL like OpenSSL 1.1.0 and OpenSSL 1.0.2.
|
||||
|
||||
### Major changes between OpenSSL 1.1.1 and OpenSSL 1.1.1a [20 Nov 2018]
|
||||
|
||||
* Timing vulnerability in DSA signature generation ([CVE-2018-0734][])
|
||||
* Timing vulnerability in ECDSA signature generation ([CVE-2018-0735][])
|
||||
|
||||
### Major changes between OpenSSL 1.1.0i and OpenSSL 1.1.1 [11 Sep 2018]
|
||||
|
||||
* Support for TLSv1.3 added. The TLSv1.3 implementation includes:
|
||||
* Fully compliant implementation of RFC8446 (TLSv1.3) on by default
|
||||
* Early data (0-RTT)
|
||||
* Post-handshake authentication and key update
|
||||
* Middlebox Compatibility Mode
|
||||
* TLSv1.3 PSKs
|
||||
* Support for all five RFC8446 ciphersuites
|
||||
* RSA-PSS signature algorithms (backported to TLSv1.2)
|
||||
* Configurable session ticket support
|
||||
* Stateless server support
|
||||
* Rewrite of the packet construction code for "safer" packet handling
|
||||
* Rewrite of the extension handling code
|
||||
For further important information, see the [TLS1.3 page](
|
||||
https://wiki.openssl.org/index.php/TLS1.3) in the OpenSSL Wiki.
|
||||
|
||||
* Complete rewrite of the OpenSSL random number generator to introduce the
|
||||
following capabilities
|
||||
* The default RAND method now utilizes an AES-CTR DRBG according to
|
||||
NIST standard SP 800-90Ar1.
|
||||
* Support for multiple DRBG instances with seed chaining.
|
||||
* There is a public and private DRBG instance.
|
||||
* The DRBG instances are fork-safe.
|
||||
* Keep all global DRBG instances on the secure heap if it is enabled.
|
||||
* The public and private DRBG instance are per thread for lock free
|
||||
operation
|
||||
* Support for various new cryptographic algorithms including:
|
||||
* SHA3
|
||||
* SHA512/224 and SHA512/256
|
||||
* EdDSA (both Ed25519 and Ed448) including X509 and TLS support
|
||||
* X448 (adding to the existing X25519 support in 1.1.0)
|
||||
* Multi-prime RSA
|
||||
* SM2
|
||||
* SM3
|
||||
* SM4
|
||||
* SipHash
|
||||
* ARIA (including TLS support)
|
||||
* Significant Side-Channel attack security improvements
|
||||
* Add a new ClientHello callback to provide the ability to adjust the SSL
|
||||
object at an early stage.
|
||||
* Add 'Maximum Fragment Length' TLS extension negotiation and support
|
||||
* A new STORE module, which implements a uniform and URI based reader of
|
||||
stores that can contain keys, certificates, CRLs and numerous other
|
||||
objects.
|
||||
* Move the display of configuration data to configdata.pm.
|
||||
* Allow GNU style "make variables" to be used with Configure.
|
||||
* Claim the namespaces OSSL and OPENSSL, represented as symbol prefixes
|
||||
* Rewrite of devcrypto engine
|
||||
|
||||
OpenSSL 1.1.0
|
||||
-------------
|
||||
|
||||
### Major changes between OpenSSL 1.1.0k and OpenSSL 1.1.0l [10 Sep 2019]
|
||||
|
||||
* Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey
|
||||
([CVE-2019-1563][])
|
||||
* For built-in EC curves, ensure an EC_GROUP built from the curve name is
|
||||
used even when parsing explicit parameters
|
||||
* Compute ECC cofactors if not provided during EC_GROUP construction
|
||||
([CVE-2019-1547][])
|
||||
* Use Windows installation paths in the mingw builds ([CVE-2019-1552][])
|
||||
|
||||
### Major changes between OpenSSL 1.1.0j and OpenSSL 1.1.0k [28 May 2019]
|
||||
|
||||
* Prevent over long nonces in ChaCha20-Poly1305 ([CVE-2019-1543][])
|
||||
|
||||
### Major changes between OpenSSL 1.1.0i and OpenSSL 1.1.0j [20 Nov 2018]
|
||||
|
||||
* Timing vulnerability in DSA signature generation ([CVE-2018-0734][])
|
||||
* Timing vulnerability in ECDSA signature generation ([CVE-2018-0735][])
|
||||
|
||||
### Major changes between OpenSSL 1.1.0h and OpenSSL 1.1.0i [14 Aug 2018]
|
||||
|
||||
* Client DoS due to large DH parameter ([CVE-2018-0732][])
|
||||
* Cache timing vulnerability in RSA Key Generation ([CVE-2018-0737][])
|
||||
|
||||
### Major changes between OpenSSL 1.1.0g and OpenSSL 1.1.0h [27 Mar 2018]
|
||||
|
||||
* Constructed ASN.1 types with a recursive definition could exceed the
|
||||
stack ([CVE-2018-0739][])
|
||||
* Incorrect CRYPTO_memcmp on HP-UX PA-RISC ([CVE-2018-0733][])
|
||||
* rsaz_1024_mul_avx2 overflow bug on x86_64 ([CVE-2017-3738][])
|
||||
|
||||
### Major changes between OpenSSL 1.1.0f and OpenSSL 1.1.0g [2 Nov 2017]
|
||||
|
||||
* bn_sqrx8x_internal carry bug on x86_64 ([CVE-2017-3736][])
|
||||
* Malformed X.509 IPAddressFamily could cause OOB read ([CVE-2017-3735][])
|
||||
|
||||
### Major changes between OpenSSL 1.1.0e and OpenSSL 1.1.0f [25 May 2017]
|
||||
|
||||
* config now recognises 64-bit mingw and chooses mingw64 instead of mingw
|
||||
|
||||
### Major changes between OpenSSL 1.1.0d and OpenSSL 1.1.0e [16 Feb 2017]
|
||||
|
||||
* Encrypt-Then-Mac renegotiation crash ([CVE-2017-3733][])
|
||||
|
||||
### Major changes between OpenSSL 1.1.0c and OpenSSL 1.1.0d [26 Jan 2017]
|
||||
|
||||
* Truncated packet could crash via OOB read ([CVE-2017-3731][])
|
||||
* Bad (EC)DHE parameters cause a client crash ([CVE-2017-3730][])
|
||||
* BN_mod_exp may produce incorrect results on x86_64 ([CVE-2017-3732][])
|
||||
|
||||
### Major changes between OpenSSL 1.1.0b and OpenSSL 1.1.0c [10 Nov 2016]
|
||||
|
||||
* ChaCha20/Poly1305 heap-buffer-overflow ([CVE-2016-7054][])
|
||||
* CMS Null dereference ([CVE-2016-7053][])
|
||||
* Montgomery multiplication may produce incorrect results ([CVE-2016-7055][])
|
||||
|
||||
### Major changes between OpenSSL 1.1.0a and OpenSSL 1.1.0b [26 Sep 2016]
|
||||
|
||||
* Fix Use After Free for large message sizes ([CVE-2016-6309][])
|
||||
|
||||
### Major changes between OpenSSL 1.1.0 and OpenSSL 1.1.0a [22 Sep 2016]
|
||||
|
||||
* OCSP Status Request extension unbounded memory growth ([CVE-2016-6304][])
|
||||
* SSL_peek() hang on empty record ([CVE-2016-6305][])
|
||||
* Excessive allocation of memory in tls_get_message_header()
|
||||
([CVE-2016-6307][])
|
||||
* Excessive allocation of memory in dtls1_preprocess_fragment()
|
||||
([CVE-2016-6308][])
|
||||
|
||||
### Major changes between OpenSSL 1.0.2h and OpenSSL 1.1.0 [25 Aug 2016]
|
||||
|
||||
* Copyright text was shrunk to a boilerplate that points to the license
|
||||
* "shared" builds are now the default when possible
|
||||
* Added support for "pipelining"
|
||||
* Added the AFALG engine
|
||||
* New threading API implemented
|
||||
* Support for ChaCha20 and Poly1305 added to libcrypto and libssl
|
||||
* Support for extended master secret
|
||||
* CCM ciphersuites
|
||||
* Reworked test suite, now based on perl, Test::Harness and Test::More
|
||||
* *Most* libcrypto and libssl public structures were made opaque,
|
||||
including:
|
||||
BIGNUM and associated types, EC_KEY and EC_KEY_METHOD,
|
||||
DH and DH_METHOD, DSA and DSA_METHOD, RSA and RSA_METHOD,
|
||||
BIO and BIO_METHOD, EVP_MD_CTX, EVP_MD, EVP_CIPHER_CTX,
|
||||
EVP_CIPHER, EVP_PKEY and associated types, HMAC_CTX,
|
||||
X509, X509_CRL, X509_OBJECT, X509_STORE_CTX, X509_STORE,
|
||||
X509_LOOKUP, X509_LOOKUP_METHOD
|
||||
* libssl internal structures made opaque
|
||||
* SSLv2 support removed
|
||||
* Kerberos ciphersuite support removed
|
||||
* RC4 removed from DEFAULT ciphersuites in libssl
|
||||
* 40 and 56 bit cipher support removed from libssl
|
||||
* All public header files moved to include/openssl, no more symlinking
|
||||
* SSL/TLS state machine, version negotiation and record layer rewritten
|
||||
* EC revision: now operations use new EC_KEY_METHOD.
|
||||
* Support for OCB mode added to libcrypto
|
||||
* Support for asynchronous crypto operations added to libcrypto and libssl
|
||||
* Deprecated interfaces can now be disabled at build time either
|
||||
relative to the latest release via the "no-deprecated" Configure
|
||||
argument, or via the "--api=1.1.0|1.0.0|0.9.8" option.
|
||||
* Application software can be compiled with -DOPENSSL_API_COMPAT=version
|
||||
to ensure that features deprecated in that version are not exposed.
|
||||
* Support for RFC6698/RFC7671 DANE TLSA peer authentication
|
||||
* Change of Configure to use --prefix as the main installation
|
||||
directory location rather than --openssldir. The latter becomes
|
||||
the directory for certs, private key and openssl.cnf exclusively.
|
||||
* Reworked BIO networking library, with full support for IPv6.
|
||||
* New "unified" build system
|
||||
* New security levels
|
||||
* Support for scrypt algorithm
|
||||
* Support for X25519
|
||||
* Extended SSL_CONF support using configuration files
|
||||
* KDF algorithm support. Implement TLS PRF as a KDF.
|
||||
* Support for Certificate Transparency
|
||||
* HKDF support.
|
||||
|
||||
OpenSSL 1.0.2
|
||||
-------------
|
||||
|
||||
### Major changes between OpenSSL 1.0.2s and OpenSSL 1.0.2t [10 Sep 2019]
|
||||
|
||||
* Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey
|
||||
([CVE-2019-1563][])
|
||||
* For built-in EC curves, ensure an EC_GROUP built from the curve name is
|
||||
used even when parsing explicit parameters
|
||||
* Compute ECC cofactors if not provided during EC_GROUP construction
|
||||
([CVE-2019-1547][])
|
||||
* Document issue with installation paths in diverse Windows builds
|
||||
([CVE-2019-1552][])
|
||||
|
||||
### Major changes between OpenSSL 1.0.2r and OpenSSL 1.0.2s [28 May 2019]
|
||||
|
||||
* None
|
||||
|
||||
### Major changes between OpenSSL 1.0.2q and OpenSSL 1.0.2r [26 Feb 2019]
|
||||
|
||||
* 0-byte record padding oracle ([CVE-2019-1559][])
|
||||
|
||||
### Major changes between OpenSSL 1.0.2p and OpenSSL 1.0.2q [20 Nov 2018]
|
||||
|
||||
* Microarchitecture timing vulnerability in ECC scalar multiplication ([CVE-2018-5407][])
|
||||
* Timing vulnerability in DSA signature generation ([CVE-2018-0734][])
|
||||
|
||||
### Major changes between OpenSSL 1.0.2o and OpenSSL 1.0.2p [14 Aug 2018]
|
||||
|
||||
* Client DoS due to large DH parameter ([CVE-2018-0732][])
|
||||
* Cache timing vulnerability in RSA Key Generation ([CVE-2018-0737][])
|
||||
|
||||
### Major changes between OpenSSL 1.0.2n and OpenSSL 1.0.2o [27 Mar 2018]
|
||||
|
||||
* Constructed ASN.1 types with a recursive definition could exceed the
|
||||
stack ([CVE-2018-0739][])
|
||||
|
||||
### Major changes between OpenSSL 1.0.2m and OpenSSL 1.0.2n [7 Dec 2017]
|
||||
|
||||
* Read/write after SSL object in error state ([CVE-2017-3737][])
|
||||
* rsaz_1024_mul_avx2 overflow bug on x86_64 ([CVE-2017-3738][])
|
||||
|
||||
### Major changes between OpenSSL 1.0.2l and OpenSSL 1.0.2m [2 Nov 2017]
|
||||
|
||||
* bn_sqrx8x_internal carry bug on x86_64 ([CVE-2017-3736][])
|
||||
* Malformed X.509 IPAddressFamily could cause OOB read ([CVE-2017-3735][])
|
||||
|
||||
### Major changes between OpenSSL 1.0.2k and OpenSSL 1.0.2l [25 May 2017]
|
||||
|
||||
* config now recognises 64-bit mingw and chooses mingw64 instead of mingw
|
||||
|
||||
### Major changes between OpenSSL 1.0.2j and OpenSSL 1.0.2k [26 Jan 2017]
|
||||
|
||||
* Truncated packet could crash via OOB read ([CVE-2017-3731][])
|
||||
* BN_mod_exp may produce incorrect results on x86_64 ([CVE-2017-3732][])
|
||||
* Montgomery multiplication may produce incorrect results ([CVE-2016-7055][])
|
||||
|
||||
### Major changes between OpenSSL 1.0.2i and OpenSSL 1.0.2j [26 Sep 2016]
|
||||
|
||||
* Missing CRL sanity check ([CVE-2016-7052][])
|
||||
|
||||
### Major changes between OpenSSL 1.0.2h and OpenSSL 1.0.2i [22 Sep 2016]
|
||||
|
||||
* OCSP Status Request extension unbounded memory growth ([CVE-2016-6304][])
|
||||
* SWEET32 Mitigation ([CVE-2016-2183][])
|
||||
* OOB write in MDC2_Update() ([CVE-2016-6303][])
|
||||
* Malformed SHA512 ticket DoS ([CVE-2016-6302][])
|
||||
* OOB write in BN_bn2dec() ([CVE-2016-2182][])
|
||||
* OOB read in TS_OBJ_print_bio() ([CVE-2016-2180][])
|
||||
* Pointer arithmetic undefined behaviour ([CVE-2016-2177][])
|
||||
* Constant time flag not preserved in DSA signing ([CVE-2016-2178][])
|
||||
* DTLS buffered message DoS ([CVE-2016-2179][])
|
||||
* DTLS replay protection DoS ([CVE-2016-2181][])
|
||||
* Certificate message OOB reads ([CVE-2016-6306][])
|
||||
|
||||
### Major changes between OpenSSL 1.0.2g and OpenSSL 1.0.2h [3 May 2016]
|
||||
|
||||
* Prevent padding oracle in AES-NI CBC MAC check ([CVE-2016-2107][])
|
||||
* Fix EVP_EncodeUpdate overflow ([CVE-2016-2105][])
|
||||
* Fix EVP_EncryptUpdate overflow ([CVE-2016-2106][])
|
||||
* Prevent ASN.1 BIO excessive memory allocation ([CVE-2016-2109][])
|
||||
* EBCDIC overread ([CVE-2016-2176][])
|
||||
* Modify behavior of ALPN to invoke callback after SNI/servername
|
||||
callback, such that updates to the SSL_CTX affect ALPN.
|
||||
* Remove LOW from the DEFAULT cipher list. This removes singles DES from
|
||||
the default.
|
||||
* Only remove the SSLv2 methods with the no-ssl2-method option.
|
||||
|
||||
### Major changes between OpenSSL 1.0.2f and OpenSSL 1.0.2g [1 Mar 2016]
|
||||
|
||||
* Disable weak ciphers in SSLv3 and up in default builds of OpenSSL.
|
||||
* Disable SSLv2 default build, default negotiation and weak ciphers
|
||||
([CVE-2016-0800][])
|
||||
* Fix a double-free in DSA code ([CVE-2016-0705][])
|
||||
* Disable SRP fake user seed to address a server memory leak
|
||||
([CVE-2016-0798][])
|
||||
* Fix BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption
|
||||
([CVE-2016-0797][])
|
||||
* Fix memory issues in BIO_*printf functions ([CVE-2016-0799][])
|
||||
* Fix side channel attack on modular exponentiation ([CVE-2016-0702][])
|
||||
|
||||
### Major changes between OpenSSL 1.0.2e and OpenSSL 1.0.2f [28 Jan 2016]
|
||||
|
||||
* DH small subgroups ([CVE-2016-0701][])
|
||||
* SSLv2 doesn't block disabled ciphers ([CVE-2015-3197][])
|
||||
|
||||
### Major changes between OpenSSL 1.0.2d and OpenSSL 1.0.2e [3 Dec 2015]
|
||||
|
||||
* BN_mod_exp may produce incorrect results on x86_64 ([CVE-2015-3193][])
|
||||
* Certificate verify crash with missing PSS parameter ([CVE-2015-3194][])
|
||||
* X509_ATTRIBUTE memory leak ([CVE-2015-3195][])
|
||||
* Rewrite EVP_DecodeUpdate (base64 decoding) to fix several bugs
|
||||
* In DSA_generate_parameters_ex, if the provided seed is too short,
|
||||
return an error
|
||||
|
||||
### Major changes between OpenSSL 1.0.2c and OpenSSL 1.0.2d [9 Jul 2015]
|
||||
|
||||
* Alternate chains certificate forgery ([CVE-2015-1793][])
|
||||
* Race condition handling PSK identify hint ([CVE-2015-3196][])
|
||||
|
||||
### Major changes between OpenSSL 1.0.2b and OpenSSL 1.0.2c [12 Jun 2015]
|
||||
|
||||
* Fix HMAC ABI incompatibility
|
||||
|
||||
### Major changes between OpenSSL 1.0.2a and OpenSSL 1.0.2b [11 Jun 2015]
|
||||
|
||||
* Malformed ECParameters causes infinite loop ([CVE-2015-1788][])
|
||||
* Exploitable out-of-bounds read in X509_cmp_time ([CVE-2015-1789][])
|
||||
* PKCS7 crash with missing EnvelopedContent ([CVE-2015-1790][])
|
||||
* CMS verify infinite loop with unknown hash function ([CVE-2015-1792][])
|
||||
* Race condition handling NewSessionTicket ([CVE-2015-1791][])
|
||||
|
||||
### Major changes between OpenSSL 1.0.2 and OpenSSL 1.0.2a [19 Mar 2015]
|
||||
|
||||
* OpenSSL 1.0.2 ClientHello sigalgs DoS fix ([CVE-2015-0291][])
|
||||
* Multiblock corrupted pointer fix ([CVE-2015-0290][])
|
||||
* Segmentation fault in DTLSv1_listen fix ([CVE-2015-0207][])
|
||||
* Segmentation fault in ASN1_TYPE_cmp fix ([CVE-2015-0286][])
|
||||
* Segmentation fault for invalid PSS parameters fix ([CVE-2015-0208][])
|
||||
* ASN.1 structure reuse memory corruption fix ([CVE-2015-0287][])
|
||||
* PKCS7 NULL pointer dereferences fix ([CVE-2015-0289][])
|
||||
* DoS via reachable assert in SSLv2 servers fix ([CVE-2015-0293][])
|
||||
* Empty CKE with client auth and DHE fix ([CVE-2015-1787][])
|
||||
* Handshake with unseeded PRNG fix ([CVE-2015-0285][])
|
||||
* Use After Free following d2i_ECPrivatekey error fix ([CVE-2015-0209][])
|
||||
* X509_to_X509_REQ NULL pointer deref fix ([CVE-2015-0288][])
|
||||
* Removed the export ciphers from the DEFAULT ciphers
|
||||
|
||||
### Major changes between OpenSSL 1.0.1l and OpenSSL 1.0.2 [22 Jan 2015]
|
||||
|
||||
* Suite B support for TLS 1.2 and DTLS 1.2
|
||||
* Support for DTLS 1.2
|
||||
* TLS automatic EC curve selection.
|
||||
* API to set TLS supported signature algorithms and curves
|
||||
* SSL_CONF configuration API.
|
||||
* TLS Brainpool support.
|
||||
* ALPN support.
|
||||
* CMS support for RSA-PSS, RSA-OAEP, ECDH and X9.42 DH.
|
||||
|
||||
OpenSSL 1.0.1
|
||||
-------------
|
||||
|
||||
### Major changes between OpenSSL 1.0.1t and OpenSSL 1.0.1u [22 Sep 2016]
|
||||
|
||||
* OCSP Status Request extension unbounded memory growth ([CVE-2016-6304][])
|
||||
* SWEET32 Mitigation ([CVE-2016-2183][])
|
||||
* OOB write in MDC2_Update() ([CVE-2016-6303][])
|
||||
* Malformed SHA512 ticket DoS ([CVE-2016-6302][])
|
||||
* OOB write in BN_bn2dec() ([CVE-2016-2182][])
|
||||
* OOB read in TS_OBJ_print_bio() ([CVE-2016-2180][])
|
||||
* Pointer arithmetic undefined behaviour ([CVE-2016-2177][])
|
||||
* Constant time flag not preserved in DSA signing ([CVE-2016-2178][])
|
||||
* DTLS buffered message DoS ([CVE-2016-2179][])
|
||||
* DTLS replay protection DoS ([CVE-2016-2181][])
|
||||
* Certificate message OOB reads ([CVE-2016-6306][])
|
||||
|
||||
### Major changes between OpenSSL 1.0.1s and OpenSSL 1.0.1t [3 May 2016]
|
||||
|
||||
* Prevent padding oracle in AES-NI CBC MAC check ([CVE-2016-2107][])
|
||||
* Fix EVP_EncodeUpdate overflow ([CVE-2016-2105][])
|
||||
* Fix EVP_EncryptUpdate overflow ([CVE-2016-2106][])
|
||||
* Prevent ASN.1 BIO excessive memory allocation ([CVE-2016-2109][])
|
||||
* EBCDIC overread ([CVE-2016-2176][])
|
||||
* Modify behavior of ALPN to invoke callback after SNI/servername
|
||||
callback, such that updates to the SSL_CTX affect ALPN.
|
||||
* Remove LOW from the DEFAULT cipher list. This removes singles DES from
|
||||
the default.
|
||||
* Only remove the SSLv2 methods with the no-ssl2-method option.
|
||||
|
||||
### Major changes between OpenSSL 1.0.1r and OpenSSL 1.0.1s [1 Mar 2016]
|
||||
|
||||
* Disable weak ciphers in SSLv3 and up in default builds of OpenSSL.
|
||||
* Disable SSLv2 default build, default negotiation and weak ciphers
|
||||
([CVE-2016-0800][])
|
||||
* Fix a double-free in DSA code ([CVE-2016-0705][])
|
||||
* Disable SRP fake user seed to address a server memory leak
|
||||
([CVE-2016-0798][])
|
||||
* Fix BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption
|
||||
([CVE-2016-0797][])
|
||||
* Fix memory issues in BIO_*printf functions ([CVE-2016-0799][])
|
||||
* Fix side channel attack on modular exponentiation ([CVE-2016-0702][])
|
||||
|
||||
### Major changes between OpenSSL 1.0.1q and OpenSSL 1.0.1r [28 Jan 2016]
|
||||
|
||||
* Protection for DH small subgroup attacks
|
||||
* SSLv2 doesn't block disabled ciphers ([CVE-2015-3197][])
|
||||
|
||||
### Major changes between OpenSSL 1.0.1p and OpenSSL 1.0.1q [3 Dec 2015]
|
||||
|
||||
* Certificate verify crash with missing PSS parameter ([CVE-2015-3194][])
|
||||
* X509_ATTRIBUTE memory leak ([CVE-2015-3195][])
|
||||
* Rewrite EVP_DecodeUpdate (base64 decoding) to fix several bugs
|
||||
* In DSA_generate_parameters_ex, if the provided seed is too short,
|
||||
return an error
|
||||
|
||||
### Major changes between OpenSSL 1.0.1o and OpenSSL 1.0.1p [9 Jul 2015]
|
||||
|
||||
* Alternate chains certificate forgery ([CVE-2015-1793][])
|
||||
* Race condition handling PSK identify hint ([CVE-2015-3196][])
|
||||
|
||||
### Major changes between OpenSSL 1.0.1n and OpenSSL 1.0.1o [12 Jun 2015]
|
||||
|
||||
* Fix HMAC ABI incompatibility
|
||||
|
||||
### Major changes between OpenSSL 1.0.1m and OpenSSL 1.0.1n [11 Jun 2015]
|
||||
|
||||
* Malformed ECParameters causes infinite loop ([CVE-2015-1788][])
|
||||
* Exploitable out-of-bounds read in X509_cmp_time ([CVE-2015-1789][])
|
||||
* PKCS7 crash with missing EnvelopedContent ([CVE-2015-1790][])
|
||||
* CMS verify infinite loop with unknown hash function ([CVE-2015-1792][])
|
||||
* Race condition handling NewSessionTicket ([CVE-2015-1791][])
|
||||
|
||||
### Major changes between OpenSSL 1.0.1l and OpenSSL 1.0.1m [19 Mar 2015]
|
||||
|
||||
* Segmentation fault in ASN1_TYPE_cmp fix ([CVE-2015-0286][])
|
||||
* ASN.1 structure reuse memory corruption fix ([CVE-2015-0287][])
|
||||
* PKCS7 NULL pointer dereferences fix ([CVE-2015-0289][])
|
||||
* DoS via reachable assert in SSLv2 servers fix ([CVE-2015-0293][])
|
||||
* Use After Free following d2i_ECPrivatekey error fix ([CVE-2015-0209][])
|
||||
* X509_to_X509_REQ NULL pointer deref fix ([CVE-2015-0288][])
|
||||
* Removed the export ciphers from the DEFAULT ciphers
|
||||
|
||||
### Major changes between OpenSSL 1.0.1k and OpenSSL 1.0.1l [15 Jan 2015]
|
||||
|
||||
* Build fixes for the Windows and OpenVMS platforms
|
||||
|
||||
### Major changes between OpenSSL 1.0.1j and OpenSSL 1.0.1k [8 Jan 2015]
|
||||
|
||||
* Fix for [CVE-2014-3571][]
|
||||
* Fix for [CVE-2015-0206][]
|
||||
* Fix for [CVE-2014-3569][]
|
||||
* Fix for [CVE-2014-3572][]
|
||||
* Fix for [CVE-2015-0204][]
|
||||
* Fix for [CVE-2015-0205][]
|
||||
* Fix for [CVE-2014-8275][]
|
||||
* Fix for [CVE-2014-3570][]
|
||||
|
||||
### Major changes between OpenSSL 1.0.1i and OpenSSL 1.0.1j [15 Oct 2014]
|
||||
|
||||
* Fix for [CVE-2014-3513][]
|
||||
* Fix for [CVE-2014-3567][]
|
||||
* Mitigation for [CVE-2014-3566][] (SSL protocol vulnerability)
|
||||
* Fix for [CVE-2014-3568][]
|
||||
|
||||
### Major changes between OpenSSL 1.0.1h and OpenSSL 1.0.1i [6 Aug 2014]
|
||||
|
||||
* Fix for [CVE-2014-3512][]
|
||||
* Fix for [CVE-2014-3511][]
|
||||
* Fix for [CVE-2014-3510][]
|
||||
* Fix for [CVE-2014-3507][]
|
||||
* Fix for [CVE-2014-3506][]
|
||||
* Fix for [CVE-2014-3505][]
|
||||
* Fix for [CVE-2014-3509][]
|
||||
* Fix for [CVE-2014-5139][]
|
||||
* Fix for [CVE-2014-3508][]
|
||||
|
||||
### Major changes between OpenSSL 1.0.1g and OpenSSL 1.0.1h [5 Jun 2014]
|
||||
|
||||
* Fix for [CVE-2014-0224][]
|
||||
* Fix for [CVE-2014-0221][]
|
||||
* Fix for [CVE-2014-0198][]
|
||||
* Fix for [CVE-2014-0195][]
|
||||
* Fix for [CVE-2014-3470][]
|
||||
* Fix for [CVE-2010-5298][]
|
||||
|
||||
### Major changes between OpenSSL 1.0.1f and OpenSSL 1.0.1g [7 Apr 2014]
|
||||
|
||||
* Fix for [CVE-2014-0160][]
|
||||
* Add TLS padding extension workaround for broken servers.
|
||||
* Fix for [CVE-2014-0076][]
|
||||
|
||||
### Major changes between OpenSSL 1.0.1e and OpenSSL 1.0.1f [6 Jan 2014]
|
||||
|
||||
* Don't include gmt_unix_time in TLS server and client random values
|
||||
* Fix for TLS record tampering bug [CVE-2013-4353][]
|
||||
* Fix for TLS version checking bug [CVE-2013-6449][]
|
||||
* Fix for DTLS retransmission bug [CVE-2013-6450][]
|
||||
|
||||
### Major changes between OpenSSL 1.0.1d and OpenSSL 1.0.1e [11 Feb 2013]
|
||||
|
||||
* Corrected fix for [CVE-2013-0169][]
|
||||
|
||||
### Major changes between OpenSSL 1.0.1c and OpenSSL 1.0.1d [4 Feb 2013]
|
||||
|
||||
* Fix renegotiation in TLS 1.1, 1.2 by using the correct TLS version.
|
||||
* Include the fips configuration module.
|
||||
* Fix OCSP bad key DoS attack [CVE-2013-0166][]
|
||||
* Fix for SSL/TLS/DTLS CBC plaintext recovery attack [CVE-2013-0169][]
|
||||
* Fix for TLS AESNI record handling flaw [CVE-2012-2686][]
|
||||
|
||||
### Major changes between OpenSSL 1.0.1b and OpenSSL 1.0.1c [10 May 2012]
|
||||
|
||||
* Fix TLS/DTLS record length checking bug [CVE-2012-2333][]
|
||||
* Don't attempt to use non-FIPS composite ciphers in FIPS mode.
|
||||
|
||||
### Major changes between OpenSSL 1.0.1a and OpenSSL 1.0.1b [26 Apr 2012]
|
||||
|
||||
* Fix compilation error on non-x86 platforms.
|
||||
* Make FIPS capable OpenSSL ciphers work in non-FIPS mode.
|
||||
* Fix SSL_OP_NO_TLSv1_1 clash with SSL_OP_ALL in OpenSSL 1.0.0
|
||||
|
||||
### Major changes between OpenSSL 1.0.1 and OpenSSL 1.0.1a [19 Apr 2012]
|
||||
|
||||
* Fix for ASN1 overflow bug [CVE-2012-2110][]
|
||||
* Workarounds for some servers that hang on long client hellos.
|
||||
* Fix SEGV in AES code.
|
||||
|
||||
### Major changes between OpenSSL 1.0.0h and OpenSSL 1.0.1 [14 Mar 2012]
|
||||
|
||||
* TLS/DTLS heartbeat support.
|
||||
* SCTP support.
|
||||
* RFC 5705 TLS key material exporter.
|
||||
* RFC 5764 DTLS-SRTP negotiation.
|
||||
* Next Protocol Negotiation.
|
||||
* PSS signatures in certificates, requests and CRLs.
|
||||
* Support for password based recipient info for CMS.
|
||||
* Support TLS v1.2 and TLS v1.1.
|
||||
* Preliminary FIPS capability for unvalidated 2.0 FIPS module.
|
||||
* SRP support.
|
||||
|
||||
OpenSSL 1.0.0
|
||||
-------------
|
||||
|
||||
### Major changes between OpenSSL 1.0.0s and OpenSSL 1.0.0t [3 Dec 2015]
|
||||
|
||||
* X509_ATTRIBUTE memory leak ([CVE-2015-3195][])
|
||||
* Race condition handling PSK identify hint ([CVE-2015-3196][])
|
||||
|
||||
### Major changes between OpenSSL 1.0.0r and OpenSSL 1.0.0s [11 Jun 2015]
|
||||
|
||||
* Malformed ECParameters causes infinite loop ([CVE-2015-1788][])
|
||||
* Exploitable out-of-bounds read in X509_cmp_time ([CVE-2015-1789][])
|
||||
* PKCS7 crash with missing EnvelopedContent ([CVE-2015-1790][])
|
||||
* CMS verify infinite loop with unknown hash function ([CVE-2015-1792][])
|
||||
* Race condition handling NewSessionTicket ([CVE-2015-1791][])
|
||||
|
||||
### Major changes between OpenSSL 1.0.0q and OpenSSL 1.0.0r [19 Mar 2015]
|
||||
|
||||
* Segmentation fault in ASN1_TYPE_cmp fix ([CVE-2015-0286][])
|
||||
* ASN.1 structure reuse memory corruption fix ([CVE-2015-0287][])
|
||||
* PKCS7 NULL pointer dereferences fix ([CVE-2015-0289][])
|
||||
* DoS via reachable assert in SSLv2 servers fix ([CVE-2015-0293][])
|
||||
* Use After Free following d2i_ECPrivatekey error fix ([CVE-2015-0209][])
|
||||
* X509_to_X509_REQ NULL pointer deref fix ([CVE-2015-0288][])
|
||||
* Removed the export ciphers from the DEFAULT ciphers
|
||||
|
||||
### Major changes between OpenSSL 1.0.0p and OpenSSL 1.0.0q [15 Jan 2015]
|
||||
|
||||
* Build fixes for the Windows and OpenVMS platforms
|
||||
|
||||
### Major changes between OpenSSL 1.0.0o and OpenSSL 1.0.0p [8 Jan 2015]
|
||||
|
||||
* Fix for [CVE-2014-3571][]
|
||||
* Fix for [CVE-2015-0206][]
|
||||
* Fix for [CVE-2014-3569][]
|
||||
* Fix for [CVE-2014-3572][]
|
||||
* Fix for [CVE-2015-0204][]
|
||||
* Fix for [CVE-2015-0205][]
|
||||
* Fix for [CVE-2014-8275][]
|
||||
* Fix for [CVE-2014-3570][]
|
||||
|
||||
### Major changes between OpenSSL 1.0.0n and OpenSSL 1.0.0o [15 Oct 2014]
|
||||
|
||||
* Fix for [CVE-2014-3513][]
|
||||
* Fix for [CVE-2014-3567][]
|
||||
* Mitigation for [CVE-2014-3566][] (SSL protocol vulnerability)
|
||||
* Fix for [CVE-2014-3568][]
|
||||
|
||||
### Major changes between OpenSSL 1.0.0m and OpenSSL 1.0.0n [6 Aug 2014]
|
||||
|
||||
* Fix for [CVE-2014-3510][]
|
||||
* Fix for [CVE-2014-3507][]
|
||||
* Fix for [CVE-2014-3506][]
|
||||
* Fix for [CVE-2014-3505][]
|
||||
* Fix for [CVE-2014-3509][]
|
||||
* Fix for [CVE-2014-3508][]
|
||||
|
||||
Known issues in OpenSSL 1.0.0m:
|
||||
|
||||
* EAP-FAST and other applications using tls_session_secret_cb
|
||||
wont resume sessions. Fixed in 1.0.0n-dev
|
||||
* Compilation failure of s3_pkt.c on some platforms due to missing
|
||||
`<limits.h>` include. Fixed in 1.0.0n-dev
|
||||
|
||||
### Major changes between OpenSSL 1.0.0l and OpenSSL 1.0.0m [5 Jun 2014]
|
||||
|
||||
* Fix for [CVE-2014-0224][]
|
||||
* Fix for [CVE-2014-0221][]
|
||||
* Fix for [CVE-2014-0198][]
|
||||
* Fix for [CVE-2014-0195][]
|
||||
* Fix for [CVE-2014-3470][]
|
||||
* Fix for [CVE-2014-0076][]
|
||||
* Fix for [CVE-2010-5298][]
|
||||
|
||||
### Major changes between OpenSSL 1.0.0k and OpenSSL 1.0.0l [6 Jan 2014]
|
||||
|
||||
* Fix for DTLS retransmission bug [CVE-2013-6450][]
|
||||
|
||||
### Major changes between OpenSSL 1.0.0j and OpenSSL 1.0.0k [5 Feb 2013]
|
||||
|
||||
* Fix for SSL/TLS/DTLS CBC plaintext recovery attack [CVE-2013-0169][]
|
||||
* Fix OCSP bad key DoS attack [CVE-2013-0166][]
|
||||
|
||||
### Major changes between OpenSSL 1.0.0i and OpenSSL 1.0.0j [10 May 2012]
|
||||
|
||||
* Fix DTLS record length checking bug [CVE-2012-2333][]
|
||||
|
||||
### Major changes between OpenSSL 1.0.0h and OpenSSL 1.0.0i [19 Apr 2012]
|
||||
|
||||
* Fix for ASN1 overflow bug [CVE-2012-2110][]
|
||||
|
||||
### Major changes between OpenSSL 1.0.0g and OpenSSL 1.0.0h [12 Mar 2012]
|
||||
|
||||
* Fix for CMS/PKCS#7 MMA [CVE-2012-0884][]
|
||||
* Corrected fix for [CVE-2011-4619][]
|
||||
* Various DTLS fixes.
|
||||
|
||||
### Major changes between OpenSSL 1.0.0f and OpenSSL 1.0.0g [18 Jan 2012]
|
||||
|
||||
* Fix for DTLS DoS issue [CVE-2012-0050][]
|
||||
|
||||
### Major changes between OpenSSL 1.0.0e and OpenSSL 1.0.0f [4 Jan 2012]
|
||||
|
||||
* Fix for DTLS plaintext recovery attack [CVE-2011-4108][]
|
||||
* Clear block padding bytes of SSL 3.0 records [CVE-2011-4576][]
|
||||
* Only allow one SGC handshake restart for SSL/TLS [CVE-2011-4619][]
|
||||
* Check parameters are not NULL in GOST ENGINE [CVE-2012-0027][]
|
||||
* Check for malformed RFC3779 data [CVE-2011-4577][]
|
||||
|
||||
### Major changes between OpenSSL 1.0.0d and OpenSSL 1.0.0e [6 Sep 2011]
|
||||
|
||||
* Fix for CRL vulnerability issue [CVE-2011-3207][]
|
||||
* Fix for ECDH crashes [CVE-2011-3210][]
|
||||
* Protection against EC timing attacks.
|
||||
* Support ECDH ciphersuites for certificates using SHA2 algorithms.
|
||||
* Various DTLS fixes.
|
||||
|
||||
### Major changes between OpenSSL 1.0.0c and OpenSSL 1.0.0d [8 Feb 2011]
|
||||
|
||||
* Fix for security issue [CVE-2011-0014][]
|
||||
|
||||
### Major changes between OpenSSL 1.0.0b and OpenSSL 1.0.0c [2 Dec 2010]
|
||||
|
||||
* Fix for security issue [CVE-2010-4180][]
|
||||
* Fix for [CVE-2010-4252][]
|
||||
* Fix mishandling of absent EC point format extension.
|
||||
* Fix various platform compilation issues.
|
||||
* Corrected fix for security issue [CVE-2010-3864][].
|
||||
|
||||
### Major changes between OpenSSL 1.0.0a and OpenSSL 1.0.0b [16 Nov 2010]
|
||||
|
||||
* Fix for security issue [CVE-2010-3864][].
|
||||
* Fix for [CVE-2010-2939][]
|
||||
* Fix WIN32 build system for GOST ENGINE.
|
||||
|
||||
### Major changes between OpenSSL 1.0.0 and OpenSSL 1.0.0a [1 Jun 2010]
|
||||
|
||||
* Fix for security issue [CVE-2010-1633][].
|
||||
* GOST MAC and CFB fixes.
|
||||
|
||||
### Major changes between OpenSSL 0.9.8n and OpenSSL 1.0.0 [29 Mar 2010]
|
||||
|
||||
* RFC3280 path validation: sufficient to process PKITS tests.
|
||||
* Integrated support for PVK files and keyblobs.
|
||||
* Change default private key format to PKCS#8.
|
||||
* CMS support: able to process all examples in RFC4134
|
||||
* Streaming ASN1 encode support for PKCS#7 and CMS.
|
||||
* Multiple signer and signer add support for PKCS#7 and CMS.
|
||||
* ASN1 printing support.
|
||||
* Whirlpool hash algorithm added.
|
||||
* RFC3161 time stamp support.
|
||||
* New generalised public key API supporting ENGINE based algorithms.
|
||||
* New generalised public key API utilities.
|
||||
* New ENGINE supporting GOST algorithms.
|
||||
* SSL/TLS GOST ciphersuite support.
|
||||
* PKCS#7 and CMS GOST support.
|
||||
* RFC4279 PSK ciphersuite support.
|
||||
* Supported points format extension for ECC ciphersuites.
|
||||
* ecdsa-with-SHA224/256/384/512 signature types.
|
||||
* dsa-with-SHA224 and dsa-with-SHA256 signature types.
|
||||
* Opaque PRF Input TLS extension support.
|
||||
* Updated time routines to avoid OS limitations.
|
||||
|
||||
OpenSSL 0.9.x
|
||||
-------------
|
||||
|
||||
### Major changes between OpenSSL 0.9.8m and OpenSSL 0.9.8n [24 Mar 2010]
|
||||
|
||||
* CFB cipher definition fixes.
|
||||
* Fix security issues [CVE-2010-0740][] and [CVE-2010-0433][].
|
||||
|
||||
### Major changes between OpenSSL 0.9.8l and OpenSSL 0.9.8m [25 Feb 2010]
|
||||
|
||||
* Cipher definition fixes.
|
||||
* Workaround for slow RAND_poll() on some WIN32 versions.
|
||||
* Remove MD2 from algorithm tables.
|
||||
* SPKAC handling fixes.
|
||||
* Support for RFC5746 TLS renegotiation extension.
|
||||
* Compression memory leak fixed.
|
||||
* Compression session resumption fixed.
|
||||
* Ticket and SNI coexistence fixes.
|
||||
* Many fixes to DTLS handling.
|
||||
|
||||
### Major changes between OpenSSL 0.9.8k and OpenSSL 0.9.8l [5 Nov 2009]
|
||||
|
||||
* Temporary work around for [CVE-2009-3555][]: disable renegotiation.
|
||||
|
||||
### Major changes between OpenSSL 0.9.8j and OpenSSL 0.9.8k [25 Mar 2009]
|
||||
|
||||
* Fix various build issues.
|
||||
* Fix security issues ([CVE-2009-0590][], [CVE-2009-0591][], [CVE-2009-0789][])
|
||||
|
||||
### Major changes between OpenSSL 0.9.8i and OpenSSL 0.9.8j [7 Jan 2009]
|
||||
|
||||
* Fix security issue ([CVE-2008-5077][])
|
||||
* Merge FIPS 140-2 branch code.
|
||||
|
||||
### Major changes between OpenSSL 0.9.8g and OpenSSL 0.9.8h [28 May 2008]
|
||||
|
||||
* CryptoAPI ENGINE support.
|
||||
* Various precautionary measures.
|
||||
* Fix for bugs affecting certificate request creation.
|
||||
* Support for local machine keyset attribute in PKCS#12 files.
|
||||
|
||||
### Major changes between OpenSSL 0.9.8f and OpenSSL 0.9.8g [19 Oct 2007]
|
||||
|
||||
* Backport of CMS functionality to 0.9.8.
|
||||
* Fixes for bugs introduced with 0.9.8f.
|
||||
|
||||
### Major changes between OpenSSL 0.9.8e and OpenSSL 0.9.8f [11 Oct 2007]
|
||||
|
||||
* Add gcc 4.2 support.
|
||||
* Add support for AES and SSE2 assembly language optimization
|
||||
for VC++ build.
|
||||
* Support for RFC4507bis and server name extensions if explicitly
|
||||
selected at compile time.
|
||||
* DTLS improvements.
|
||||
* RFC4507bis support.
|
||||
* TLS Extensions support.
|
||||
|
||||
### Major changes between OpenSSL 0.9.8d and OpenSSL 0.9.8e [23 Feb 2007]
|
||||
|
||||
* Various ciphersuite selection fixes.
|
||||
* RFC3779 support.
|
||||
|
||||
### Major changes between OpenSSL 0.9.8c and OpenSSL 0.9.8d [28 Sep 2006]
|
||||
|
||||
* Introduce limits to prevent malicious key DoS ([CVE-2006-2940][])
|
||||
* Fix security issues ([CVE-2006-2937][], [CVE-2006-3737][], [CVE-2006-4343][])
|
||||
* Changes to ciphersuite selection algorithm
|
||||
|
||||
### Major changes between OpenSSL 0.9.8b and OpenSSL 0.9.8c [5 Sep 2006]
|
||||
|
||||
* Fix Daniel Bleichenbacher forged signature attack, [CVE-2006-4339][]
|
||||
* New cipher Camellia
|
||||
|
||||
### Major changes between OpenSSL 0.9.8a and OpenSSL 0.9.8b [4 May 2006]
|
||||
|
||||
* Cipher string fixes.
|
||||
* Fixes for VC++ 2005.
|
||||
* Updated ECC cipher suite support.
|
||||
* New functions EVP_CIPHER_CTX_new() and EVP_CIPHER_CTX_free().
|
||||
* Zlib compression usage fixes.
|
||||
* Built in dynamic engine compilation support on Win32.
|
||||
* Fixes auto dynamic engine loading in Win32.
|
||||
|
||||
### Major changes between OpenSSL 0.9.8 and OpenSSL 0.9.8a [11 Oct 2005]
|
||||
|
||||
* Fix potential SSL 2.0 rollback, [CVE-2005-2969][]
|
||||
* Extended Windows CE support
|
||||
|
||||
### Major changes between OpenSSL 0.9.7g and OpenSSL 0.9.8 [5 Jul 2005]
|
||||
|
||||
* Major work on the BIGNUM library for higher efficiency and to
|
||||
make operations more streamlined and less contradictory. This
|
||||
is the result of a major audit of the BIGNUM library.
|
||||
* Addition of BIGNUM functions for fields GF(2^m) and NIST
|
||||
curves, to support the Elliptic Crypto functions.
|
||||
* Major work on Elliptic Crypto; ECDH and ECDSA added, including
|
||||
the use through EVP, X509 and ENGINE.
|
||||
* New ASN.1 mini-compiler that's usable through the OpenSSL
|
||||
configuration file.
|
||||
* Added support for ASN.1 indefinite length constructed encoding.
|
||||
* New PKCS#12 'medium level' API to manipulate PKCS#12 files.
|
||||
* Complete rework of shared library construction and linking
|
||||
programs with shared or static libraries, through a separate
|
||||
Makefile.shared.
|
||||
* Rework of the passing of parameters from one Makefile to another.
|
||||
* Changed ENGINE framework to load dynamic engine modules
|
||||
automatically from specifically given directories.
|
||||
* New structure and ASN.1 functions for CertificatePair.
|
||||
* Changed the ZLIB compression method to be stateful.
|
||||
* Changed the key-generation and primality testing "progress"
|
||||
mechanism to take a structure that contains the ticker
|
||||
function and an argument.
|
||||
* New engine module: GMP (performs private key exponentiation).
|
||||
* New engine module: VIA PadLOck ACE extension in VIA C3
|
||||
Nehemiah processors.
|
||||
* Added support for IPv6 addresses in certificate extensions.
|
||||
See RFC 1884, section 2.2.
|
||||
* Added support for certificate policy mappings, policy
|
||||
constraints and name constraints.
|
||||
* Added support for multi-valued AVAs in the OpenSSL
|
||||
configuration file.
|
||||
* Added support for multiple certificates with the same subject
|
||||
in the 'openssl ca' index file.
|
||||
* Make it possible to create self-signed certificates using
|
||||
'openssl ca -selfsign'.
|
||||
* Make it possible to generate a serial number file with
|
||||
'openssl ca -create_serial'.
|
||||
* New binary search functions with extended functionality.
|
||||
* New BUF functions.
|
||||
* New STORE structure and library to provide an interface to all
|
||||
sorts of data repositories. Supports storage of public and
|
||||
private keys, certificates, CRLs, numbers and arbitrary blobs.
|
||||
This library is unfortunately unfinished and unused within
|
||||
OpenSSL.
|
||||
* New control functions for the error stack.
|
||||
* Changed the PKCS#7 library to support one-pass S/MIME
|
||||
processing.
|
||||
* Added the possibility to compile without old deprecated
|
||||
functionality with the OPENSSL_NO_DEPRECATED macro or the
|
||||
'no-deprecated' argument to the config and Configure scripts.
|
||||
* Constification of all ASN.1 conversion functions, and other
|
||||
affected functions.
|
||||
* Improved platform support for PowerPC.
|
||||
* New FIPS 180-2 algorithms (SHA-224, -256, -384 and -512).
|
||||
* New X509_VERIFY_PARAM structure to support parameterisation
|
||||
of X.509 path validation.
|
||||
* Major overhaul of RC4 performance on Intel P4, IA-64 and
|
||||
AMD64.
|
||||
* Changed the Configure script to have some algorithms disabled
|
||||
by default. Those can be explicitly enabled with the new
|
||||
argument form 'enable-xxx'.
|
||||
* Change the default digest in 'openssl' commands from MD5 to
|
||||
SHA-1.
|
||||
* Added support for DTLS.
|
||||
* New BIGNUM blinding.
|
||||
* Added support for the RSA-PSS encryption scheme
|
||||
* Added support for the RSA X.931 padding.
|
||||
* Added support for BSD sockets on NetWare.
|
||||
* Added support for files larger than 2GB.
|
||||
* Added initial support for Win64.
|
||||
* Added alternate pkg-config files.
|
||||
|
||||
### Major changes between OpenSSL 0.9.7l and OpenSSL 0.9.7m [23 Feb 2007]
|
||||
|
||||
* FIPS 1.1.1 module linking.
|
||||
* Various ciphersuite selection fixes.
|
||||
|
||||
### Major changes between OpenSSL 0.9.7k and OpenSSL 0.9.7l [28 Sep 2006]
|
||||
|
||||
* Introduce limits to prevent malicious key DoS ([CVE-2006-2940][])
|
||||
* Fix security issues ([CVE-2006-2937][], [CVE-2006-3737][], [CVE-2006-4343][])
|
||||
|
||||
### Major changes between OpenSSL 0.9.7j and OpenSSL 0.9.7k [5 Sep 2006]
|
||||
|
||||
* Fix Daniel Bleichenbacher forged signature attack, [CVE-2006-4339][]
|
||||
|
||||
### Major changes between OpenSSL 0.9.7i and OpenSSL 0.9.7j [4 May 2006]
|
||||
|
||||
* Visual C++ 2005 fixes.
|
||||
* Update Windows build system for FIPS.
|
||||
|
||||
### Major changes between OpenSSL 0.9.7h and OpenSSL 0.9.7i [14 Oct 2005]
|
||||
|
||||
* Give EVP_MAX_MD_SIZE its old value, except for a FIPS build.
|
||||
|
||||
### Major changes between OpenSSL 0.9.7g and OpenSSL 0.9.7h [11 Oct 2005]
|
||||
|
||||
* Fix SSL 2.0 Rollback, [CVE-2005-2969][]
|
||||
* Allow use of fixed-length exponent on DSA signing
|
||||
* Default fixed-window RSA, DSA, DH private-key operations
|
||||
|
||||
### Major changes between OpenSSL 0.9.7f and OpenSSL 0.9.7g [11 Apr 2005]
|
||||
|
||||
* More compilation issues fixed.
|
||||
* Adaptation to more modern Kerberos API.
|
||||
* Enhanced or corrected configuration for Solaris64, Mingw and Cygwin.
|
||||
* Enhanced x86_64 assembler BIGNUM module.
|
||||
* More constification.
|
||||
* Added processing of proxy certificates (RFC 3820).
|
||||
|
||||
### Major changes between OpenSSL 0.9.7e and OpenSSL 0.9.7f [22 Mar 2005]
|
||||
|
||||
* Several compilation issues fixed.
|
||||
* Many memory allocation failure checks added.
|
||||
* Improved comparison of X509 Name type.
|
||||
* Mandatory basic checks on certificates.
|
||||
* Performance improvements.
|
||||
|
||||
### Major changes between OpenSSL 0.9.7d and OpenSSL 0.9.7e [25 Oct 2004]
|
||||
|
||||
* Fix race condition in CRL checking code.
|
||||
* Fixes to PKCS#7 (S/MIME) code.
|
||||
|
||||
### Major changes between OpenSSL 0.9.7c and OpenSSL 0.9.7d [17 Mar 2004]
|
||||
|
||||
* Security: Fix Kerberos ciphersuite SSL/TLS handshaking bug
|
||||
* Security: Fix null-pointer assignment in do_change_cipher_spec()
|
||||
* Allow multiple active certificates with same subject in CA index
|
||||
* Multiple X509 verification fixes
|
||||
* Speed up HMAC and other operations
|
||||
|
||||
### Major changes between OpenSSL 0.9.7b and OpenSSL 0.9.7c [30 Sep 2003]
|
||||
|
||||
* Security: fix various ASN1 parsing bugs.
|
||||
* New -ignore_err option to OCSP utility.
|
||||
* Various interop and bug fixes in S/MIME code.
|
||||
* SSL/TLS protocol fix for unrequested client certificates.
|
||||
|
||||
### Major changes between OpenSSL 0.9.7a and OpenSSL 0.9.7b [10 Apr 2003]
|
||||
|
||||
* Security: counter the Klima-Pokorny-Rosa extension of
|
||||
Bleichbacher's attack
|
||||
* Security: make RSA blinding default.
|
||||
* Configuration: Irix fixes, AIX fixes, better mingw support.
|
||||
* Support for new platforms: linux-ia64-ecc.
|
||||
* Build: shared library support fixes.
|
||||
* ASN.1: treat domainComponent correctly.
|
||||
* Documentation: fixes and additions.
|
||||
|
||||
### Major changes between OpenSSL 0.9.7 and OpenSSL 0.9.7a [19 Feb 2003]
|
||||
|
||||
* Security: Important security related bugfixes.
|
||||
* Enhanced compatibility with MIT Kerberos.
|
||||
* Can be built without the ENGINE framework.
|
||||
* IA32 assembler enhancements.
|
||||
* Support for new platforms: FreeBSD/IA64 and FreeBSD/Sparc64.
|
||||
* Configuration: the no-err option now works properly.
|
||||
* SSL/TLS: now handles manual certificate chain building.
|
||||
* SSL/TLS: certain session ID malfunctions corrected.
|
||||
|
||||
### Major changes between OpenSSL 0.9.6 and OpenSSL 0.9.7 [30 Dec 2002]
|
||||
|
||||
* New library section OCSP.
|
||||
* Complete rewrite of ASN1 code.
|
||||
* CRL checking in verify code and openssl utility.
|
||||
* Extension copying in 'ca' utility.
|
||||
* Flexible display options in 'ca' utility.
|
||||
* Provisional support for international characters with UTF8.
|
||||
* Support for external crypto devices ('engine') is no longer
|
||||
a separate distribution.
|
||||
* New elliptic curve library section.
|
||||
* New AES (Rijndael) library section.
|
||||
* Support for new platforms: Windows CE, Tandem OSS, A/UX, AIX 64-bit,
|
||||
Linux x86_64, Linux 64-bit on Sparc v9
|
||||
* Extended support for some platforms: VxWorks
|
||||
* Enhanced support for shared libraries.
|
||||
* Now only builds PIC code when shared library support is requested.
|
||||
* Support for pkg-config.
|
||||
* Lots of new manuals.
|
||||
* Makes symbolic links to or copies of manuals to cover all described
|
||||
functions.
|
||||
* Change DES API to clean up the namespace (some applications link also
|
||||
against libdes providing similar functions having the same name).
|
||||
Provide macros for backward compatibility (will be removed in the
|
||||
future).
|
||||
* Unify handling of cryptographic algorithms (software and engine)
|
||||
to be available via EVP routines for asymmetric and symmetric ciphers.
|
||||
* NCONF: new configuration handling routines.
|
||||
* Change API to use more 'const' modifiers to improve error checking
|
||||
and help optimizers.
|
||||
* Finally remove references to RSAref.
|
||||
* Reworked parts of the BIGNUM code.
|
||||
* Support for new engines: Broadcom ubsec, Accelerated Encryption
|
||||
Processing, IBM 4758.
|
||||
* A few new engines added in the demos area.
|
||||
* Extended and corrected OID (object identifier) table.
|
||||
* PRNG: query at more locations for a random device, automatic query for
|
||||
EGD style random sources at several locations.
|
||||
* SSL/TLS: allow optional cipher choice according to server's preference.
|
||||
* SSL/TLS: allow server to explicitly set new session ids.
|
||||
* SSL/TLS: support Kerberos cipher suites (RFC2712).
|
||||
Only supports MIT Kerberos for now.
|
||||
* SSL/TLS: allow more precise control of renegotiations and sessions.
|
||||
* SSL/TLS: add callback to retrieve SSL/TLS messages.
|
||||
* SSL/TLS: support AES cipher suites (RFC3268).
|
||||
|
||||
### Major changes between OpenSSL 0.9.6j and OpenSSL 0.9.6k [30 Sep 2003]
|
||||
|
||||
* Security: fix various ASN1 parsing bugs.
|
||||
* SSL/TLS protocol fix for unrequested client certificates.
|
||||
|
||||
### Major changes between OpenSSL 0.9.6i and OpenSSL 0.9.6j [10 Apr 2003]
|
||||
|
||||
* Security: counter the Klima-Pokorny-Rosa extension of
|
||||
Bleichbacher's attack
|
||||
* Security: make RSA blinding default.
|
||||
* Build: shared library support fixes.
|
||||
|
||||
### Major changes between OpenSSL 0.9.6h and OpenSSL 0.9.6i [19 Feb 2003]
|
||||
|
||||
* Important security related bugfixes.
|
||||
|
||||
### Major changes between OpenSSL 0.9.6g and OpenSSL 0.9.6h [5 Dec 2002]
|
||||
|
||||
* New configuration targets for Tandem OSS and A/UX.
|
||||
* New OIDs for Microsoft attributes.
|
||||
* Better handling of SSL session caching.
|
||||
* Better comparison of distinguished names.
|
||||
* Better handling of shared libraries in a mixed GNU/non-GNU environment.
|
||||
* Support assembler code with Borland C.
|
||||
* Fixes for length problems.
|
||||
* Fixes for uninitialised variables.
|
||||
* Fixes for memory leaks, some unusual crashes and some race conditions.
|
||||
* Fixes for smaller building problems.
|
||||
* Updates of manuals, FAQ and other instructive documents.
|
||||
|
||||
### Major changes between OpenSSL 0.9.6f and OpenSSL 0.9.6g [9 Aug 2002]
|
||||
|
||||
* Important building fixes on Unix.
|
||||
|
||||
### Major changes between OpenSSL 0.9.6e and OpenSSL 0.9.6f [8 Aug 2002]
|
||||
|
||||
* Various important bugfixes.
|
||||
|
||||
### Major changes between OpenSSL 0.9.6d and OpenSSL 0.9.6e [30 Jul 2002]
|
||||
|
||||
* Important security related bugfixes.
|
||||
* Various SSL/TLS library bugfixes.
|
||||
|
||||
### Major changes between OpenSSL 0.9.6c and OpenSSL 0.9.6d [9 May 2002]
|
||||
|
||||
* Various SSL/TLS library bugfixes.
|
||||
* Fix DH parameter generation for 'non-standard' generators.
|
||||
|
||||
### Major changes between OpenSSL 0.9.6b and OpenSSL 0.9.6c [21 Dec 2001]
|
||||
|
||||
* Various SSL/TLS library bugfixes.
|
||||
* BIGNUM library fixes.
|
||||
* RSA OAEP and random number generation fixes.
|
||||
* Object identifiers corrected and added.
|
||||
* Add assembler BN routines for IA64.
|
||||
* Add support for OS/390 Unix, UnixWare with gcc, OpenUNIX 8,
|
||||
MIPS Linux; shared library support for Irix, HP-UX.
|
||||
* Add crypto accelerator support for AEP, Baltimore SureWare,
|
||||
Broadcom and Cryptographic Appliance's keyserver
|
||||
[in 0.9.6c-engine release].
|
||||
|
||||
### Major changes between OpenSSL 0.9.6a and OpenSSL 0.9.6b [9 Jul 2001]
|
||||
|
||||
* Security fix: PRNG improvements.
|
||||
* Security fix: RSA OAEP check.
|
||||
* Security fix: Reinsert and fix countermeasure to Bleichbacher's
|
||||
attack.
|
||||
* MIPS bug fix in BIGNUM.
|
||||
* Bug fix in "openssl enc".
|
||||
* Bug fix in X.509 printing routine.
|
||||
* Bug fix in DSA verification routine and DSA S/MIME verification.
|
||||
* Bug fix to make PRNG thread-safe.
|
||||
* Bug fix in RAND_file_name().
|
||||
* Bug fix in compatibility mode trust settings.
|
||||
* Bug fix in blowfish EVP.
|
||||
* Increase default size for BIO buffering filter.
|
||||
* Compatibility fixes in some scripts.
|
||||
|
||||
### Major changes between OpenSSL 0.9.6 and OpenSSL 0.9.6a [5 Apr 2001]
|
||||
|
||||
* Security fix: change behavior of OpenSSL to avoid using
|
||||
environment variables when running as root.
|
||||
* Security fix: check the result of RSA-CRT to reduce the
|
||||
possibility of deducing the private key from an incorrectly
|
||||
calculated signature.
|
||||
* Security fix: prevent Bleichenbacher's DSA attack.
|
||||
* Security fix: Zero the premaster secret after deriving the
|
||||
master secret in DH ciphersuites.
|
||||
* Reimplement SSL_peek(), which had various problems.
|
||||
* Compatibility fix: the function des_encrypt() renamed to
|
||||
des_encrypt1() to avoid clashes with some Unixen libc.
|
||||
* Bug fixes for Win32, HP/UX and Irix.
|
||||
* Bug fixes in BIGNUM, SSL, PKCS#7, PKCS#12, X.509, CONF and
|
||||
memory checking routines.
|
||||
* Bug fixes for RSA operations in threaded environments.
|
||||
* Bug fixes in misc. openssl applications.
|
||||
* Remove a few potential memory leaks.
|
||||
* Add tighter checks of BIGNUM routines.
|
||||
* Shared library support has been reworked for generality.
|
||||
* More documentation.
|
||||
* New function BN_rand_range().
|
||||
* Add "-rand" option to openssl s_client and s_server.
|
||||
|
||||
### Major changes between OpenSSL 0.9.5a and OpenSSL 0.9.6 [10 Oct 2000]
|
||||
|
||||
* Some documentation for BIO and SSL libraries.
|
||||
* Enhanced chain verification using key identifiers.
|
||||
* New sign and verify options to 'dgst' application.
|
||||
* Support for DER and PEM encoded messages in 'smime' application.
|
||||
* New 'rsautl' application, low level RSA utility.
|
||||
* MD4 now included.
|
||||
* Bugfix for SSL rollback padding check.
|
||||
* Support for external crypto devices [1].
|
||||
* Enhanced EVP interface.
|
||||
|
||||
[1] The support for external crypto devices is currently a separate
|
||||
distribution. See the file README.ENGINE.
|
||||
|
||||
### Major changes between OpenSSL 0.9.5 and OpenSSL 0.9.5a [1 Apr 2000]
|
||||
|
||||
* Bug fixes for Win32, SuSE Linux, NeXTSTEP and FreeBSD 2.2.8
|
||||
* Shared library support for HPUX and Solaris-gcc
|
||||
* Support of Linux/IA64
|
||||
* Assembler support for Mingw32
|
||||
* New 'rand' application
|
||||
* New way to check for existence of algorithms from scripts
|
||||
|
||||
### Major changes between OpenSSL 0.9.4 and OpenSSL 0.9.5 [25 May 2000]
|
||||
|
||||
* S/MIME support in new 'smime' command
|
||||
* Documentation for the OpenSSL command line application
|
||||
* Automation of 'req' application
|
||||
* Fixes to make s_client, s_server work under Windows
|
||||
* Support for multiple fieldnames in SPKACs
|
||||
* New SPKAC command line utility and associated library functions
|
||||
* Options to allow passwords to be obtained from various sources
|
||||
* New public key PEM format and options to handle it
|
||||
* Many other fixes and enhancements to command line utilities
|
||||
* Usable certificate chain verification
|
||||
* Certificate purpose checking
|
||||
* Certificate trust settings
|
||||
* Support of authority information access extension
|
||||
* Extensions in certificate requests
|
||||
* Simplified X509 name and attribute routines
|
||||
* Initial (incomplete) support for international character sets
|
||||
* New DH_METHOD, DSA_METHOD and enhanced RSA_METHOD
|
||||
* Read only memory BIOs and simplified creation function
|
||||
* TLS/SSL protocol bugfixes: Accept TLS 'client hello' in SSL 3.0
|
||||
record; allow fragmentation and interleaving of handshake and other
|
||||
data
|
||||
* TLS/SSL code now "tolerates" MS SGC
|
||||
* Work around for Netscape client certificate hang bug
|
||||
* RSA_NULL option that removes RSA patent code but keeps other
|
||||
RSA functionality
|
||||
* Memory leak detection now allows applications to add extra information
|
||||
via a per-thread stack
|
||||
* PRNG robustness improved
|
||||
* EGD support
|
||||
* BIGNUM library bug fixes
|
||||
* Faster DSA parameter generation
|
||||
* Enhanced support for Alpha Linux
|
||||
* Experimental MacOS support
|
||||
|
||||
### Major changes between OpenSSL 0.9.3 and OpenSSL 0.9.4 [9 Aug 1999]
|
||||
|
||||
* Transparent support for PKCS#8 format private keys: these are used
|
||||
by several software packages and are more secure than the standard
|
||||
form
|
||||
* PKCS#5 v2.0 implementation
|
||||
* Password callbacks have a new void * argument for application data
|
||||
* Avoid various memory leaks
|
||||
* New pipe-like BIO that allows using the SSL library when actual I/O
|
||||
must be handled by the application (BIO pair)
|
||||
|
||||
### Major changes between OpenSSL 0.9.2b and OpenSSL 0.9.3 [24 May 1999]
|
||||
|
||||
* Lots of enhancements and cleanups to the Configuration mechanism
|
||||
* RSA OEAP related fixes
|
||||
* Added "openssl ca -revoke" option for revoking a certificate
|
||||
* Source cleanups: const correctness, type-safe stacks and ASN.1 SETs
|
||||
* Source tree cleanups: removed lots of obsolete files
|
||||
* Thawte SXNet, certificate policies and CRL distribution points
|
||||
extension support
|
||||
* Preliminary (experimental) S/MIME support
|
||||
* Support for ASN.1 UTF8String and VisibleString
|
||||
* Full integration of PKCS#12 code
|
||||
* Sparc assembler bignum implementation, optimized hash functions
|
||||
* Option to disable selected ciphers
|
||||
|
||||
### Major changes between OpenSSL 0.9.1c and OpenSSL 0.9.2b [22 Mar 1999]
|
||||
|
||||
* Fixed a security hole related to session resumption
|
||||
* Fixed RSA encryption routines for the p < q case
|
||||
* "ALL" in cipher lists now means "everything except NULL ciphers"
|
||||
* Support for Triple-DES CBCM cipher
|
||||
* Support of Optimal Asymmetric Encryption Padding (OAEP) for RSA
|
||||
* First support for new TLSv1 ciphers
|
||||
* Added a few new BIOs (syslog BIO, reliable BIO)
|
||||
* Extended support for DSA certificate/keys.
|
||||
* Extended support for Certificate Signing Requests (CSR)
|
||||
* Initial support for X.509v3 extensions
|
||||
* Extended support for compression inside the SSL record layer
|
||||
* Overhauled Win32 builds
|
||||
* Cleanups and fixes to the Big Number (BN) library
|
||||
* Support for ASN.1 GeneralizedTime
|
||||
* Splitted ASN.1 SETs from SEQUENCEs
|
||||
* ASN1 and PEM support for Netscape Certificate Sequences
|
||||
* Overhauled Perl interface
|
||||
* Lots of source tree cleanups.
|
||||
* Lots of memory leak fixes.
|
||||
* Lots of bug fixes.
|
||||
|
||||
### Major changes between SSLeay 0.9.0b and OpenSSL 0.9.1c [23 Dec 1998]
|
||||
|
||||
* Integration of the popular NO_RSA/NO_DSA patches
|
||||
* Initial support for compression inside the SSL record layer
|
||||
* Added BIO proxy and filtering functionality
|
||||
* Extended Big Number (BN) library
|
||||
* Added RIPE MD160 message digest
|
||||
* Added support for RC2/64bit cipher
|
||||
* Extended ASN.1 parser routines
|
||||
* Adjustments of the source tree for CVS
|
||||
* Support for various new platforms
|
||||
|
||||
<!-- Links -->
|
||||
|
||||
[CVE-2019-1563]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1563
|
||||
[CVE-2019-1559]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1559
|
||||
[CVE-2019-1552]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1552
|
||||
[CVE-2019-1551]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1551
|
||||
[CVE-2019-1549]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1549
|
||||
[CVE-2019-1547]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1547
|
||||
[CVE-2019-1543]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1543
|
||||
[CVE-2018-5407]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-5407
|
||||
[CVE-2018-0739]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-0739
|
||||
[CVE-2018-0737]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-0737
|
||||
[CVE-2018-0735]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-0735
|
||||
[CVE-2018-0734]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-0734
|
||||
[CVE-2018-0733]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-0733
|
||||
[CVE-2018-0732]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-0732
|
||||
[CVE-2017-3738]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3738
|
||||
[CVE-2017-3737]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3737
|
||||
[CVE-2017-3736]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3736
|
||||
[CVE-2017-3735]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3735
|
||||
[CVE-2017-3733]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3733
|
||||
[CVE-2017-3732]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3732
|
||||
[CVE-2017-3731]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3731
|
||||
[CVE-2017-3730]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3730
|
||||
[CVE-2016-7055]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-7055
|
||||
[CVE-2016-7054]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-7054
|
||||
[CVE-2016-7053]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-7053
|
||||
[CVE-2016-7052]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-7052
|
||||
[CVE-2016-6309]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6309
|
||||
[CVE-2016-6308]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6308
|
||||
[CVE-2016-6307]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6307
|
||||
[CVE-2016-6306]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6306
|
||||
[CVE-2016-6305]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6305
|
||||
[CVE-2016-6304]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6304
|
||||
[CVE-2016-6303]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6303
|
||||
[CVE-2016-6302]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6302
|
||||
[CVE-2016-2183]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2183
|
||||
[CVE-2016-2182]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2182
|
||||
[CVE-2016-2181]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2181
|
||||
[CVE-2016-2180]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2180
|
||||
[CVE-2016-2179]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2179
|
||||
[CVE-2016-2178]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2178
|
||||
[CVE-2016-2177]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2177
|
||||
[CVE-2016-2176]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2176
|
||||
[CVE-2016-2109]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2109
|
||||
[CVE-2016-2107]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2107
|
||||
[CVE-2016-2106]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2106
|
||||
[CVE-2016-2105]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2105
|
||||
[CVE-2016-0800]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0800
|
||||
[CVE-2016-0799]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0799
|
||||
[CVE-2016-0798]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0798
|
||||
[CVE-2016-0797]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0797
|
||||
[CVE-2016-0705]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0705
|
||||
[CVE-2016-0702]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0702
|
||||
[CVE-2016-0701]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0701
|
||||
[CVE-2015-3197]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-3197
|
||||
[CVE-2015-3196]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-3196
|
||||
[CVE-2015-3195]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-3195
|
||||
[CVE-2015-3194]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-3194
|
||||
[CVE-2015-3193]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-3193
|
||||
[CVE-2015-1793]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1793
|
||||
[CVE-2015-1792]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1792
|
||||
[CVE-2015-1791]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1791
|
||||
[CVE-2015-1790]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1790
|
||||
[CVE-2015-1789]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1789
|
||||
[CVE-2015-1788]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1788
|
||||
[CVE-2015-1787]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1787
|
||||
[CVE-2015-0293]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0293
|
||||
[CVE-2015-0291]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0291
|
||||
[CVE-2015-0290]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0290
|
||||
[CVE-2015-0289]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0289
|
||||
[CVE-2015-0288]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0288
|
||||
[CVE-2015-0287]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0287
|
||||
[CVE-2015-0286]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0286
|
||||
[CVE-2015-0285]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0285
|
||||
[CVE-2015-0209]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0209
|
||||
[CVE-2015-0208]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0208
|
||||
[CVE-2015-0207]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0207
|
||||
[CVE-2015-0206]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0206
|
||||
[CVE-2015-0205]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0205
|
||||
[CVE-2015-0204]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0204
|
||||
[CVE-2014-8275]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-8275
|
||||
[CVE-2014-5139]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-5139
|
||||
[CVE-2014-3572]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3572
|
||||
[CVE-2014-3571]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3571
|
||||
[CVE-2014-3570]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3570
|
||||
[CVE-2014-3569]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3569
|
||||
[CVE-2014-3568]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3568
|
||||
[CVE-2014-3567]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3567
|
||||
[CVE-2014-3566]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3566
|
||||
[CVE-2014-3513]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3513
|
||||
[CVE-2014-3512]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3512
|
||||
[CVE-2014-3511]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3511
|
||||
[CVE-2014-3510]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3510
|
||||
[CVE-2014-3509]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3509
|
||||
[CVE-2014-3508]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3508
|
||||
[CVE-2014-3507]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3507
|
||||
[CVE-2014-3506]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3506
|
||||
[CVE-2014-3505]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3505
|
||||
[CVE-2014-3470]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3470
|
||||
[CVE-2014-0224]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-0224
|
||||
[CVE-2014-0221]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-0221
|
||||
[CVE-2014-0198]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-0198
|
||||
[CVE-2014-0195]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-0195
|
||||
[CVE-2014-0160]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-0160
|
||||
[CVE-2014-0076]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-0076
|
||||
[CVE-2013-6450]: https://www.openssl.org/news/vulnerabilities.html#CVE-2013-6450
|
||||
[CVE-2013-6449]: https://www.openssl.org/news/vulnerabilities.html#CVE-2013-6449
|
||||
[CVE-2013-4353]: https://www.openssl.org/news/vulnerabilities.html#CVE-2013-4353
|
||||
[CVE-2013-0169]: https://www.openssl.org/news/vulnerabilities.html#CVE-2013-0169
|
||||
[CVE-2013-0166]: https://www.openssl.org/news/vulnerabilities.html#CVE-2013-0166
|
||||
[CVE-2012-2686]: https://www.openssl.org/news/vulnerabilities.html#CVE-2012-2686
|
||||
[CVE-2012-2333]: https://www.openssl.org/news/vulnerabilities.html#CVE-2012-2333
|
||||
[CVE-2012-2110]: https://www.openssl.org/news/vulnerabilities.html#CVE-2012-2110
|
||||
[CVE-2012-0884]: https://www.openssl.org/news/vulnerabilities.html#CVE-2012-0884
|
||||
[CVE-2012-0050]: https://www.openssl.org/news/vulnerabilities.html#CVE-2012-0050
|
||||
[CVE-2012-0027]: https://www.openssl.org/news/vulnerabilities.html#CVE-2012-0027
|
||||
[CVE-2011-4619]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-4619
|
||||
[CVE-2011-4577]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-4577
|
||||
[CVE-2011-4576]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-4576
|
||||
[CVE-2011-4108]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-4108
|
||||
[CVE-2011-3210]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-3210
|
||||
[CVE-2011-3207]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-3207
|
||||
[CVE-2011-0014]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-0014
|
||||
[CVE-2010-5298]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-5298
|
||||
[CVE-2010-4252]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-4252
|
||||
[CVE-2010-4180]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-4180
|
||||
[CVE-2010-3864]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-3864
|
||||
[CVE-2010-2939]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-2939
|
||||
[CVE-2010-1633]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-1633
|
||||
[CVE-2010-0740]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-0740
|
||||
[CVE-2010-0433]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-0433
|
||||
[CVE-2009-3555]: https://www.openssl.org/news/vulnerabilities.html#CVE-2009-3555
|
||||
[CVE-2009-0789]: https://www.openssl.org/news/vulnerabilities.html#CVE-2009-0789
|
||||
[CVE-2009-0591]: https://www.openssl.org/news/vulnerabilities.html#CVE-2009-0591
|
||||
[CVE-2009-0590]: https://www.openssl.org/news/vulnerabilities.html#CVE-2009-0590
|
||||
[CVE-2008-5077]: https://www.openssl.org/news/vulnerabilities.html#CVE-2008-5077
|
||||
[CVE-2006-4343]: https://www.openssl.org/news/vulnerabilities.html#CVE-2006-4343
|
||||
[CVE-2006-4339]: https://www.openssl.org/news/vulnerabilities.html#CVE-2006-4339
|
||||
[CVE-2006-3737]: https://www.openssl.org/news/vulnerabilities.html#CVE-2006-3737
|
||||
[CVE-2006-2940]: https://www.openssl.org/news/vulnerabilities.html#CVE-2006-2940
|
||||
[CVE-2006-2937]: https://www.openssl.org/news/vulnerabilities.html#CVE-2006-2937
|
||||
[CVE-2005-2969]: https://www.openssl.org/news/vulnerabilities.html#CVE-2005-2969
|
||||
+8
-8
@@ -24,7 +24,7 @@
|
||||
need to know the prefix to extend your PATH, in order to invoke
|
||||
$(CROSS_COMPILE)clang [*gcc on NDK 19 and lower] and company. (Configure
|
||||
will fail and give you a hint if you get it wrong.) Apart from PATH
|
||||
adjustment you need to set ANDROID_NDK_HOME environment to point at the
|
||||
adjustment you need to set ANDROID_NDK_ROOT environment to point at the
|
||||
NDK directory. If you're using a side-by-side NDK the path will look
|
||||
something like /some/where/android-sdk/ndk/<ver>, and for a standalone
|
||||
NDK the path will be something like /some/where/android-ndk-<ver>.
|
||||
@@ -35,21 +35,21 @@
|
||||
with N being the numerical value of the target platform version. For example,
|
||||
to compile for Android 10 arm64 with a side-by-side NDK r20.0.5594570
|
||||
|
||||
export ANDROID_NDK_HOME=/home/whoever/Android/android-sdk/ndk/20.0.5594570
|
||||
PATH=$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin:$ANDROID_NDK_HOME/toolchains/arm-linux-androideabi-4.9/prebuilt/linux-x86_64/bin:$PATH
|
||||
export ANDROID_NDK_ROOT=/home/whoever/Android/android-sdk/ndk/20.0.5594570
|
||||
PATH=$ANDROID_NDK_ROOT/toolchains/llvm/prebuilt/linux-x86_64/bin:$ANDROID_NDK_ROOT/toolchains/arm-linux-androideabi-4.9/prebuilt/linux-x86_64/bin:$PATH
|
||||
./Configure android-arm64 -D__ANDROID_API__=29
|
||||
make
|
||||
|
||||
Older versions of the NDK have GCC under their common prebuilt tools directory, so the bin path
|
||||
will be slightly different. EG: to compile for ICS on ARM with NDK 10d:
|
||||
|
||||
export ANDROID_NDK_HOME=/some/where/android-ndk-10d
|
||||
PATH=$ANDROID_NDK_HOME/toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86_64/bin:$PATH
|
||||
export ANDROID_NDK_ROOT=/some/where/android-ndk-10d
|
||||
PATH=$ANDROID_NDK_ROOT/toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86_64/bin:$PATH
|
||||
./Configure android-arm -D__ANDROID_API__=14
|
||||
make
|
||||
|
||||
Caveat lector! Earlier OpenSSL versions relied on additional CROSS_SYSROOT
|
||||
variable set to $ANDROID_NDK_HOME/platforms/android-<api>/arch-<arch> to
|
||||
variable set to $ANDROID_NDK_ROOT/platforms/android-<api>/arch-<arch> to
|
||||
appoint headers-n-libraries' location. It's still recognized in order
|
||||
to facilitate migration from older projects. However, since API level
|
||||
appears in CROSS_SYSROOT value, passing -D__ANDROID_API__=N can be in
|
||||
@@ -64,9 +64,9 @@
|
||||
|
||||
Another option is to create so called "standalone toolchain" tailored
|
||||
for single specific platform including Android API level, and assign its
|
||||
location to ANDROID_NDK_HOME. In such case you have to pass matching
|
||||
location to ANDROID_NDK_ROOT. In such case you have to pass matching
|
||||
target name to Configure and shouldn't use -D__ANDROID_API__=N. PATH
|
||||
adjustment becomes simpler, $ANDROID_NDK_HOME/bin:$PATH suffices.
|
||||
adjustment becomes simpler, $ANDROID_NDK_ROOT/bin:$PATH suffices.
|
||||
|
||||
Running tests (on Linux)
|
||||
------------------------
|
||||
|
||||
+5
-3
@@ -35,9 +35,11 @@
|
||||
MinGW and Cygwin. The key recommendation is to use "matching" Perl,
|
||||
one that matches build environment. For example, if you will build
|
||||
on Cygwin be sure to use the Cygwin package manager to install Perl.
|
||||
For MSYS builds use the MSYS provided Perl. For VC-* builds we
|
||||
recommend ActiveState Perl, available from
|
||||
http://www.activestate.com/ActivePerl.
|
||||
For MSYS builds use the MSYS provided Perl.
|
||||
For VC-* builds we recommend Strawberry Perl, from http://strawberryperl.com.
|
||||
An alternative is ActiveState Perl, from http://www.activestate.com/ActivePerl
|
||||
for which you may need to explicitly select the Perl module Win32/Console.pm
|
||||
available via https://platform.activestate.com/ActiveState.
|
||||
|
||||
Notes on Perl on VMS
|
||||
--------------------
|
||||
|
||||
+6
-6
@@ -28,11 +28,11 @@ Test behavior can be modified by adjusting environment variables.
|
||||
EXE_SHELL
|
||||
|
||||
This variable is used to specify the shell used to execute OpenSSL test
|
||||
programs. The default program (util/shlib_wrap.sh) initializes the
|
||||
environment to allow programs to find shared libraries. The variable can
|
||||
be modified to specify a different executable environment.
|
||||
programs. The default wrapper (util/wrap.pl) initializes the environment
|
||||
to allow programs to find shared libraries. The variable can be modified
|
||||
to specify a different executable environment.
|
||||
|
||||
EXE_SHELL="`/bin/pwd`/util/shlib_wrap.sh valgrind --error-exitcode=1 --leak-check=full -q"
|
||||
EXE_SHELL="`/bin/pwd`/util/wrap.pl valgrind --error-exitcode=1 --leak-check=full -q"
|
||||
|
||||
This will start up Valgrind with the default checker (memcheck).
|
||||
The --error-exitcode=1 option specifies that Valgrind should exit with an
|
||||
@@ -62,9 +62,9 @@ INSTALL file in the root of the OpenSSL source tree.
|
||||
|
||||
Example command line:
|
||||
|
||||
make test EXE_SHELL="`/bin/pwd`/util/shlib_wrap.sh valgrind --error-exitcode=1 --leak-check=full -q" OPENSSL_ia32cap=":0"
|
||||
make test EXE_SHELL="`/bin/pwd`/util/wrap.pl valgrind --error-exitcode=1 --leak-check=full -q" OPENSSL_ia32cap=":0"
|
||||
|
||||
If an error occurs, you can then run the specific test via the TESTS
|
||||
variable with the VERBOSE option to gather additional information.
|
||||
|
||||
make test VERBOSE=1 TESTS=test_test EXE_SHELL="`/bin/pwd`/util/shlib_wrap.sh valgrind --error-exitcode=1 --leak-check=full -q" OPENSSL_ia32cap=":0"
|
||||
make test VERBOSE=1 TESTS=test_test EXE_SHELL="`/bin/pwd`/util/wrap.pl valgrind --error-exitcode=1 --leak-check=full -q" OPENSSL_ia32cap=":0"
|
||||
@@ -1,58 +1,74 @@
|
||||
|
||||
NOTES FOR THE WINDOWS PLATFORMS
|
||||
===============================
|
||||
NOTES FOR WINDOWS PLATFORMS
|
||||
===========================
|
||||
|
||||
Windows targets can be classified as "native", ones that use Windows API
|
||||
directly, and "hosted" which rely on POSIX-compatible layer. "Native"
|
||||
targets are VC-* (where "VC" stems from abbreviating Microsoft Visual C
|
||||
compiler) and mingw[64]. "Hosted" platforms are Cygwin and MSYS[2]. Even
|
||||
though the latter is not directly supported by OpenSSL Team, it's #1
|
||||
popular choice for building MinGW targets. In the nutshell MinGW builds
|
||||
are always cross-compiled. On Linux and Cygwin they look exactly as such
|
||||
and require --cross-compile-prefix option. While on MSYS[2] it's solved
|
||||
rather by placing gcc that produces "MinGW binary" code 1st on $PATH.
|
||||
This is customarily source of confusion. "Hosted" applications "live" in
|
||||
emulated file system name space with POSIX-y root, mount points, /dev
|
||||
and even /proc. Confusion is intensified by the fact that MSYS2 shell
|
||||
(or rather emulated execve(2) call) examines the binary it's about to
|
||||
start, and if it's found *not* to be linked with MSYS2 POSIX-y thing,
|
||||
command line arguments that look like file names get translated from
|
||||
emulated name space to "native". For example '/c/some/where' becomes
|
||||
'c:\some\where', '/dev/null' - 'nul'. This creates an illusion that
|
||||
there is no difference between MSYS2 shell and "MinGW binary", but
|
||||
there is. Just keep in mind that "MinGW binary" "experiences" Windows
|
||||
system in exactly same way as one produced by VC, and in its essence
|
||||
is indistinguishable from the latter. (Which by the way is why
|
||||
it's referred to in quotes here, as "MinGW binary", it's just as
|
||||
"native" as it can get.)
|
||||
There are various options to build and run OpenSSL on the Windows platforms.
|
||||
|
||||
Visual C++ builds, a.k.a. VC-*
|
||||
==============================
|
||||
"Native" OpenSSL uses the Windows APIs directly at run time.
|
||||
To build a native OpenSSL you can either use:
|
||||
|
||||
Microsoft Visual C++ (MSVC) C compiler on the command line
|
||||
or
|
||||
MinGW cross compiler
|
||||
run on the GNU-like development environment MSYS2
|
||||
or run on Linux or Cygwin
|
||||
|
||||
"Hosted" OpenSSL relies on an external POSIX compatibility layer
|
||||
for building (using GNU/Unix shell, compiler, and tools) and at run time.
|
||||
For this option you can use Cygwin.
|
||||
|
||||
|
||||
Visual C++ native builds, a.k.a. VC-*
|
||||
=====================================
|
||||
|
||||
Requirement details
|
||||
-------------------
|
||||
|
||||
In addition to the requirements and instructions listed in INSTALL,
|
||||
In addition to the requirements and instructions listed in INSTALL.md,
|
||||
these are required as well:
|
||||
|
||||
- Perl. We recommend ActiveState Perl, available from
|
||||
https://www.activestate.com/ActivePerl. Another viable alternative
|
||||
appears to be Strawberry Perl, http://strawberryperl.com.
|
||||
You also need the perl module Text::Template, available on CPAN.
|
||||
Please read NOTES.PERL for more information.
|
||||
- Perl.
|
||||
We recommend Strawberry Perl, available from http://strawberryperl.com/
|
||||
Please read NOTES.PERL for more information, including the use of CPAN.
|
||||
An alternative is ActiveState Perl, https://www.activestate.com/ActivePerl
|
||||
for which you may need to explicitly build the Perl module Win32/Console.pm
|
||||
via https://platform.activestate.com/ActiveState and then download it.
|
||||
|
||||
- Microsoft Visual C compiler. Since we can't test them all, there is
|
||||
unavoidable uncertainty about which versions are supported. Latest
|
||||
version along with couple of previous are certainly supported. On
|
||||
the other hand oldest one is known not to work. Everything between
|
||||
falls into best-effort category.
|
||||
- Microsoft Visual C compiler.
|
||||
Since these are proprietary and ever-changing we cannot test them all.
|
||||
Older versions may not work. Use a recent version wherever possible.
|
||||
|
||||
- Netwide Assembler, a.k.a. NASM, available from https://www.nasm.us,
|
||||
is required. Note that NASM is the only supported assembler. Even
|
||||
though Microsoft provided assembler is NOT supported, contemporary
|
||||
64-bit version is exercised through continuous integration of
|
||||
VC-WIN64A-masm target.
|
||||
- Netwide Assembler (NASM), available from https://www.nasm.us
|
||||
Note that NASM is the only supported assembler.
|
||||
|
||||
Quick start
|
||||
-----------
|
||||
|
||||
1. Install Perl
|
||||
|
||||
2. Install NASM
|
||||
|
||||
3. Make sure both Perl and NASM are on your %PATH%
|
||||
|
||||
4. Use Visual Studio Developer Command Prompt with administrative privileges,
|
||||
choosing one of its variants depending on the intended architecture.
|
||||
Or run "cmd" and execute "vcvarsall.bat" with one of the options x86,
|
||||
x86_amd64, x86_arm, x86_arm64, amd64, amd64_x86, amd64_arm, or amd64_arm64.
|
||||
This sets up the environment variables needed for nmake.exe, cl.exe, etc.
|
||||
See also https://docs.microsoft.com/cpp/build/building-on-the-command-line
|
||||
|
||||
5. From the root of the OpenSSL source directory enter
|
||||
perl Configure VC-WIN32 if you want 32-bit OpenSSL or
|
||||
perl Configure VC-WIN64A if you want 64-bit OpenSSL
|
||||
|
||||
6. nmake
|
||||
|
||||
7. nmake test
|
||||
|
||||
8. nmake install
|
||||
|
||||
For the full installation instructions, or if anything goes wrong at any stage,
|
||||
check the INSTALL.md file.
|
||||
|
||||
Installation directories
|
||||
------------------------
|
||||
@@ -83,7 +99,6 @@
|
||||
is, of course, to choose a different set of directories by using
|
||||
--prefix and --openssldir when configuring.
|
||||
|
||||
|
||||
Special notes for Universal Windows Platform builds, a.k.a. VC-*-UWP
|
||||
--------------------------------------------------------------------
|
||||
|
||||
@@ -91,33 +106,56 @@
|
||||
|
||||
- You should define the platform type to "uwp" and the target arch via
|
||||
"vcvarsall.bat" before you compile. For example, if you want to build
|
||||
"arm64" builds, you should type "vcvarsall.bat x86_arm64 uwp".
|
||||
"arm64" builds, you should run "vcvarsall.bat x86_arm64 uwp".
|
||||
|
||||
mingw and mingw64
|
||||
=================
|
||||
|
||||
* MSYS2 shell and development environment installation:
|
||||
Native OpenSSL built using MinGW
|
||||
================================
|
||||
|
||||
Download MSYS2 from https://msys2.github.io/ and follow installation
|
||||
instructions. Once up and running install even make, perl, (git if
|
||||
needed,) mingw-w64-i686-gcc and/or mingw-w64-x86_64-gcc. You should
|
||||
have corresponding MinGW items on your start menu, use *them*, not
|
||||
generic MSYS2. As implied in opening note, difference between them
|
||||
is which compiler is found 1st on $PATH. At this point ./config
|
||||
should recognize correct target, roll as if it was Unix...
|
||||
MinGW offers an alternative way to build native OpenSSL, by cross compilation.
|
||||
|
||||
* It is also possible to build mingw[64] on Linux or Cygwin by
|
||||
configuring with corresponding --cross-compile-prefix= option. For
|
||||
example
|
||||
* Usually the build is done on Windows in a GNU-like environment called MSYS2.
|
||||
|
||||
MSYS2 provides GNU tools, a Unix-like command prompt,
|
||||
and a UNIX compatibility layer for applications.
|
||||
However in this context it is only used for building OpenSSL.
|
||||
The resulting OpenSSL does not rely on MSYS2 to run and is fully native.
|
||||
|
||||
Requirement details
|
||||
|
||||
- MSYS2 shell, from https://www.msys2.org/
|
||||
|
||||
- Perl, at least version 5.10.0, which usually comes pre-installed with MSYS2
|
||||
|
||||
- make, installed using "pacman -S make" into the MSYS2 environment
|
||||
|
||||
- MinGW[64] compiler: mingw-w64-i686-gcc and/or mingw-w64-x86_64-gcc.
|
||||
These compilers must be on your MSYS2 $PATH.
|
||||
A common error is to not have these on your $PATH.
|
||||
The MSYS2 version of gcc will not work correctly here.
|
||||
|
||||
In the MSYS2 shell do the configuration depending on the target architecture:
|
||||
|
||||
./Configure mingw ...
|
||||
or
|
||||
./Configure mingw64 ...
|
||||
or
|
||||
./config ...
|
||||
for the default architecture.
|
||||
|
||||
Apart from that, follow the Unix / Linux instructions in INSTALL.md.
|
||||
|
||||
* It is also possible to build mingw[64] on Linux or Cygwin.
|
||||
|
||||
In this case configure with the corresponding --cross-compile-prefix= option.
|
||||
For example
|
||||
|
||||
./Configure mingw --cross-compile-prefix=i686-w64-mingw32- ...
|
||||
|
||||
or
|
||||
|
||||
./Configure mingw64 --cross-compile-prefix=x86_64-w64-mingw32- ...
|
||||
|
||||
This naturally implies that you've installed corresponding add-on
|
||||
packages.
|
||||
This requires that you've installed the necessary add-on packages for
|
||||
mingw[64] cross compilation.
|
||||
|
||||
Linking your application
|
||||
========================
|
||||
@@ -146,28 +184,29 @@
|
||||
}
|
||||
|
||||
If you link with OpenSSL .DLLs, then you're expected to include into
|
||||
your application code small "shim" snippet, which provides glue between
|
||||
OpenSSL BIO layer and your compiler run-time. See the OPENSSL_Applink
|
||||
manual page for further details.
|
||||
your application code a small "shim" snippet, which provides
|
||||
the glue between the OpenSSL BIO layer and your compiler run-time.
|
||||
See also the OPENSSL_Applink manual page.
|
||||
|
||||
Cygwin, "hosted" environment
|
||||
============================
|
||||
|
||||
Cygwin implements a Posix/Unix runtime system (cygwin1.dll) on top of the
|
||||
Windows subsystem and provides a bash shell and GNU tools environment.
|
||||
Consequently, a make of OpenSSL with Cygwin is virtually identical to the
|
||||
Hosted OpenSSL built using Cygwin
|
||||
=================================
|
||||
|
||||
Cygwin implements a POSIX/Unix runtime system (cygwin1.dll) on top of the
|
||||
Windows subsystem and provides a Bash shell and GNU tools environment.
|
||||
Consequently, a build of OpenSSL with Cygwin is virtually identical to the
|
||||
Unix procedure.
|
||||
|
||||
To build OpenSSL using Cygwin, you need to:
|
||||
|
||||
* Install Cygwin (see https://cygwin.com/)
|
||||
* Install Cygwin, see https://cygwin.com/
|
||||
|
||||
* Install Cygwin Perl and ensure it is in the path. Recall that
|
||||
as least 5.10.0 is required.
|
||||
* Install Cygwin Perl, at least version 5.10.0
|
||||
and ensure it is in the $PATH
|
||||
|
||||
* Run the Cygwin bash shell
|
||||
* Run the Cygwin Bash shell
|
||||
|
||||
Apart from that, follow the Unix instructions in INSTALL.
|
||||
Apart from that, follow the Unix / Linux instructions in INSTALL.md.
|
||||
|
||||
NOTE: "make test" and normal file operations may fail in directories
|
||||
mounted as text (i.e. mount -t c:\somewhere /home) due to Cygwin
|
||||
|
||||
@@ -1,92 +0,0 @@
|
||||
|
||||
Copyright (c) 1998-2018 The OpenSSL Project
|
||||
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
|
||||
All rights reserved.
|
||||
|
||||
DESCRIPTION
|
||||
-----------
|
||||
|
||||
The OpenSSL Project is a collaborative effort to develop a robust,
|
||||
commercial-grade, fully featured, and Open Source toolkit implementing the
|
||||
Transport Layer Security (TLS) protocols (including SSLv3) as well as a
|
||||
full-strength general purpose cryptographic library.
|
||||
|
||||
OpenSSL is descended from the SSLeay library developed by Eric A. Young
|
||||
and Tim J. Hudson.
|
||||
|
||||
The OpenSSL toolkit is licensed under the Apache License 2.0, which means
|
||||
that you are free to get and use it for commercial and non-commercial
|
||||
purposes as long as you fulfill its conditions.
|
||||
|
||||
OVERVIEW
|
||||
--------
|
||||
|
||||
The OpenSSL toolkit includes:
|
||||
|
||||
libssl (with platform specific naming):
|
||||
Provides the client and server-side implementations for SSLv3 and TLS.
|
||||
|
||||
libcrypto (with platform specific naming):
|
||||
Provides general cryptographic and X.509 support needed by SSL/TLS but
|
||||
not logically part of it.
|
||||
|
||||
openssl:
|
||||
A command line tool that can be used for:
|
||||
Creation of key parameters
|
||||
Creation of X.509 certificates, CSRs and CRLs
|
||||
Calculation of message digests
|
||||
Encryption and decryption
|
||||
SSL/TLS client and server tests
|
||||
Handling of S/MIME signed or encrypted mail
|
||||
And more...
|
||||
|
||||
INSTALLATION
|
||||
------------
|
||||
|
||||
See the appropriate file:
|
||||
INSTALL Linux, Unix, Windows, OpenVMS, ...
|
||||
NOTES.* INSTALL addendums for different platforms
|
||||
|
||||
SUPPORT
|
||||
-------
|
||||
|
||||
See the OpenSSL website www.openssl.org for details on how to obtain
|
||||
commercial technical support. Free community support is available through the
|
||||
openssl-users email list (see
|
||||
https://www.openssl.org/community/mailinglists.html for further details).
|
||||
|
||||
If you have any problems with OpenSSL then please take the following steps
|
||||
first:
|
||||
|
||||
- Download the latest version from the repository
|
||||
to see if the problem has already been addressed
|
||||
- Configure with no-asm
|
||||
- Remove compiler optimization flags
|
||||
|
||||
If you wish to report a bug then please include the following information
|
||||
and create an issue on GitHub:
|
||||
|
||||
- OpenSSL version: output of 'openssl version -a'
|
||||
- Configuration data: output of 'perl configdata.pm --dump'
|
||||
- OS Name, Version, Hardware platform
|
||||
- Compiler Details (name, version)
|
||||
- Application Details (name, version)
|
||||
- Problem Description (steps that will reproduce the problem, if known)
|
||||
- Stack Traceback (if the application dumps core)
|
||||
|
||||
Just because something doesn't work the way you expect does not mean it
|
||||
is necessarily a bug in OpenSSL. Use the openssl-users email list for this type
|
||||
of query.
|
||||
|
||||
HOW TO CONTRIBUTE TO OpenSSL
|
||||
----------------------------
|
||||
|
||||
See CONTRIBUTING
|
||||
|
||||
LEGALITIES
|
||||
----------
|
||||
|
||||
A number of nations restrict the use or export of cryptography. If you
|
||||
are potentially subject to such restrictions you should seek competent
|
||||
professional legal advice before attempting to develop or distribute
|
||||
cryptographic code.
|
||||
@@ -0,0 +1,236 @@
|
||||
Welcome to the OpenSSL Project
|
||||
==============================
|
||||
|
||||
[![openssl logo][]][www.openssl.org]
|
||||
|
||||
[![travis badge][]][travis jobs]
|
||||
[![appveyor badge][]][appveyor jobs]
|
||||
|
||||
OpenSSL is a robust, commercial-grade, full-featured Open Source Toolkit
|
||||
for the Transport Layer Security (TLS) protocol formerly known as the
|
||||
Secure Sockets Layer (SSL) protocol. The protocol implementation is based
|
||||
on a full-strength general purpose cryptographic library, which can also
|
||||
be used stand-alone.
|
||||
|
||||
OpenSSL is descended from the SSLeay library developed by Eric A. Young
|
||||
and Tim J. Hudson.
|
||||
|
||||
The official Home Page of the OpenSSL Project is [www.openssl.org][].
|
||||
|
||||
Table of Contents
|
||||
=================
|
||||
|
||||
- [Overview](#overview)
|
||||
- [Download](#download)
|
||||
- [Build and Install](#build-and-install)
|
||||
- [Documentation](#documentation)
|
||||
- [License](#license)
|
||||
- [Support](#support)
|
||||
- [Contributing](#contributing)
|
||||
- [Legalities](#legalities)
|
||||
|
||||
Overview
|
||||
========
|
||||
|
||||
The OpenSSL toolkit includes:
|
||||
|
||||
- **libssl**
|
||||
an implementation of all TLS protocol versions up to TLSv1.3 ([RFC 8446][]).
|
||||
|
||||
- **libcrypto**
|
||||
a full-strength general purpose cryptographic library. It constitutes the
|
||||
basis of the TLS implementation, but can also be used independently.
|
||||
|
||||
- **openssl**
|
||||
the OpenSSL command line tool, a swiss army knife for cryptographic tasks,
|
||||
testing and analyzing. It can be used for
|
||||
- creation of key parameters
|
||||
- creation of X.509 certificates, CSRs and CRLs
|
||||
- calculation of message digests
|
||||
- encryption and decryption
|
||||
- SSL/TLS client and server tests
|
||||
- handling of S/MIME signed or encrypted mail
|
||||
- and more...
|
||||
|
||||
Download
|
||||
========
|
||||
|
||||
For Production Use
|
||||
------------------
|
||||
|
||||
Source code tarballs of the official releases can be downloaded from
|
||||
[www.openssl.org/source](https://www.openssl.org/source).
|
||||
The OpenSSL project does not distribute the toolkit in binary form.
|
||||
|
||||
However, for a large variety of operating systems precompiled versions
|
||||
of the OpenSSL toolkit are available. In particular on Linux and other
|
||||
Unix operating systems it is normally recommended to link against the
|
||||
precompiled shared libraries provided by the distributor or vendor.
|
||||
|
||||
For Testing and Development
|
||||
---------------------------
|
||||
|
||||
Although testing and development could in theory also be done using
|
||||
the source tarballs, having a local copy of the git repository with
|
||||
the entire project history gives you much more insight into the
|
||||
code base.
|
||||
|
||||
The official OpenSSL Git Repository is located at [git.openssl.org][].
|
||||
There is a GitHub mirror of the repository at [github.com/openssl/openssl][],
|
||||
which is updated automatically from the former on every commit.
|
||||
|
||||
A local copy of the Git Repository can be obtained by cloning it from
|
||||
the original OpenSSL repository using
|
||||
|
||||
git clone git://git.openssl.org/openssl.git
|
||||
|
||||
or from the GitHub mirror using
|
||||
|
||||
git clone https://github.com/openssl/openssl.git
|
||||
|
||||
If you intend to contribute to OpenSSL, either to fix bugs or contribute
|
||||
new features, you need to fork the OpenSSL repository openssl/openssl on
|
||||
GitHub and clone your public fork instead.
|
||||
|
||||
git clone https://github.com/yourname/openssl.git
|
||||
|
||||
This is necessary, because all development of OpenSSL nowadays is done via
|
||||
GitHub pull requests. For more details, see [Contributing](#contributing).
|
||||
|
||||
Build and Install
|
||||
=================
|
||||
|
||||
After obtaining the Source, have a look at the [INSTALL](INSTALL.md) file for
|
||||
detailed instructions about building and installing OpenSSL. For some
|
||||
platforms, the installation instructions are amended by a platform specific
|
||||
document.
|
||||
|
||||
* [NOTES.ANDROID](NOTES.ANDROID)
|
||||
* [NOTES.DJGPP](NOTES.DJGPP)
|
||||
* [NOTES.PERL](NOTES.PERL)
|
||||
* [NOTES.UNIX](NOTES.UNIX)
|
||||
* [NOTES.VALGRIND](NOTES.VALGRIND)
|
||||
* [NOTES.VMS](NOTES.VMS)
|
||||
* [NOTES.WIN](NOTES.WIN)
|
||||
|
||||
Specific notes on upgrading to OpenSSL 3.0 from previous versions, as well as
|
||||
known issues are available on the OpenSSL
|
||||
[wiki](https://wiki.openssl.org/index.php/OpenSSL_3.0).
|
||||
|
||||
Documentation
|
||||
=============
|
||||
|
||||
Manual Pages
|
||||
------------
|
||||
|
||||
The manual pages for the master branch and all current stable releases are
|
||||
available online.
|
||||
|
||||
- [OpenSSL master](https://www.openssl.org/docs/manmaster)
|
||||
- [OpenSSL 1.1.1](https://www.openssl.org/docs/man1.1.1)
|
||||
|
||||
Wiki
|
||||
----
|
||||
|
||||
There is a Wiki at [wiki.openssl.org][] which is currently not very active.
|
||||
It contains a lot of useful information, not all of which is up to date.
|
||||
|
||||
License
|
||||
=======
|
||||
|
||||
OpenSSL is licensed under the Apache License 2.0, which means that
|
||||
you are free to get and use it for commercial and non-commercial
|
||||
purposes as long as you fulfill its conditions.
|
||||
|
||||
See the [LICENSE](LICENSE) file for more details.
|
||||
|
||||
Support
|
||||
=======
|
||||
|
||||
There are various ways to get in touch. The correct channel depends on
|
||||
your requirement. see the [SUPPORT](SUPPORT.md) file for more details.
|
||||
|
||||
Contributing
|
||||
============
|
||||
|
||||
If you are interested and willing to contribute to the OpenSSL project,
|
||||
please take a look at the [CONTRIBUTING](CONTRIBUTING.md) file.
|
||||
|
||||
Since 2016, development takes place in public on the GitHub open source
|
||||
platform. The OpenSSL Project Pages at [openssl.github.io][] are a
|
||||
valuable source of information if you want to get familiar with our
|
||||
development process on GitHub.
|
||||
|
||||
Legalities
|
||||
==========
|
||||
|
||||
A number of nations restrict the use or export of cryptography. If you are
|
||||
potentially subject to such restrictions you should seek legal advice before
|
||||
attempting to develop or distribute cryptographic code.
|
||||
|
||||
Copyright
|
||||
=========
|
||||
|
||||
Copyright (c) 1998-2020 The OpenSSL Project
|
||||
|
||||
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
|
||||
|
||||
All rights reserved.
|
||||
|
||||
<!-- Links -->
|
||||
|
||||
[www.openssl.org]:
|
||||
<https://www.openssl.org>
|
||||
"OpenSSL Homepage"
|
||||
|
||||
[git.openssl.org]:
|
||||
<https://git.openssl.org>
|
||||
"OpenSSL Git Repository"
|
||||
|
||||
[git.openssl.org]:
|
||||
<https://git.openssl.org>
|
||||
"OpenSSL Git Repository"
|
||||
|
||||
[github.com/openssl/openssl]:
|
||||
<https://github.com/openssl/openssl>
|
||||
"OpenSSL GitHub Mirror"
|
||||
|
||||
[openssl.github.io]:
|
||||
<https://mspncp.github.io>
|
||||
"OpenSSL Project Pages"
|
||||
|
||||
[wiki.openssl.org]:
|
||||
<https://wiki.openssl.org>
|
||||
"OpenSSL Wiki"
|
||||
|
||||
[RFC 8446]:
|
||||
<https://tools.ietf.org/html/rfc8446>
|
||||
|
||||
<!-- Logos and Badges -->
|
||||
<!--
|
||||
Note: The security token for the appveyor badge (the random number in
|
||||
the URL below) was obtained for the mspncp/openssl project.
|
||||
It needs to be replaced by the correct token by some core member
|
||||
(@levitte, @mattcaswell?). It can be obtained for project members at
|
||||
https://ci.appveyor.com/project/openssl/openssl/settings/badges.
|
||||
-->
|
||||
|
||||
[openssl logo]:
|
||||
doc/images/openssl.svg
|
||||
"OpenSSL Logo"
|
||||
|
||||
[travis badge]:
|
||||
<https://travis-ci.org/openssl/openssl.svg?branch=master>
|
||||
"Travis Build Status"
|
||||
|
||||
[travis jobs]:
|
||||
<https://travis-ci.org/openssl/openssl>
|
||||
"Travis Jobs"
|
||||
|
||||
[appveyor badge]:
|
||||
<https://ci.appveyor.com/api/projects/status/ikn2l4u1xsume63u/branch/master?svg=true>
|
||||
"AppVeyor Build Status"
|
||||
|
||||
[appveyor jobs]:
|
||||
<https://ci.appveyor.com/project/openssl/openssl/branch/master>
|
||||
"AppVeyor Jobs"
|
||||
+120
@@ -0,0 +1,120 @@
|
||||
OpenSSL User Support resources
|
||||
==============================
|
||||
|
||||
_Under Construction; not more than a collection of text fragments yet._
|
||||
|
||||
See the OpenSSL website www.openssl.org for details on how to obtain
|
||||
commercial technical support. Free community support is available through the
|
||||
openssl-users email list (see
|
||||
<https://www.openssl.org/community/mailinglists.html for> further details).
|
||||
|
||||
If you have any problems with OpenSSL then please take the following steps
|
||||
first:
|
||||
|
||||
- Download the latest version from the repository
|
||||
to see if the problem has already been addressed
|
||||
- Configure with no-asm
|
||||
- Remove compiler optimization flags
|
||||
|
||||
If you wish to report a bug then please include the following information
|
||||
and create an issue on GitHub:
|
||||
|
||||
- OpenSSL version: output of 'openssl version -a'
|
||||
- Configuration data: output of 'perl configdata.pm ==dump'
|
||||
- OS Name, Version, Hardware platform
|
||||
- Compiler Details (name, version)
|
||||
- Application Details (name, version)
|
||||
- Problem Description (steps that will reproduce the problem, if known)
|
||||
- Stack Traceback (if the application dumps core)
|
||||
|
||||
Just because something doesn't work the way you expect does not mean it
|
||||
is necessarily a bug in OpenSSL. Use the openssl-users email list for this type
|
||||
of query.
|
||||
|
||||
For *questions* on how to use OpenSSL or what went wrong when you
|
||||
tried something, our primary resource is the mailing list
|
||||
openssl-users@openssl.org, where you can get help from others in the
|
||||
OpenSSL community (which includes the developers as time permits).
|
||||
|
||||
Only subscribers can post to openssl-users@openssl.org (although the
|
||||
archives are public).
|
||||
For more information, see <https://www.openssl.org/community/mailinglists.html>
|
||||
|
||||
You have general questions about using OpenSSL
|
||||
----------------------------------------------
|
||||
|
||||
In this case the [openssl-users][] mailing list is the right place for you.
|
||||
The list is not only watched by the OpenSSL team members, but also by many
|
||||
other OpenSSL users. Here you will most likely get the answer to your questions.
|
||||
An overview over the [mailing lists](#mailing-lists) can be found below.
|
||||
|
||||
You found a Bug
|
||||
---------------
|
||||
|
||||
If you have any problems with OpenSSL then please take the following steps first:
|
||||
|
||||
- Search the mailing lists and/or the GitHub issues to find out whether
|
||||
the problem has already been reported.
|
||||
- Download the latest version from the repository to see if the problem
|
||||
has already been addressed.
|
||||
- Configure without assembler support (`no-asm`) and check whether the
|
||||
problem persists.
|
||||
- Remove compiler optimization flags.
|
||||
|
||||
Please keep in mind: Just because something doesn't work the way you expect
|
||||
does not mean it is necessarily a bug in OpenSSL. If you are not sure,
|
||||
consider searching the mail archives and posting a question to the
|
||||
[openssl-users][] mailing list first.
|
||||
|
||||
### Open an Issue
|
||||
|
||||
If you wish to report a bug, please open an [issue][github-issues] on GitHub
|
||||
and include the following information:
|
||||
|
||||
- OpenSSL version: output of `openssl version -a`
|
||||
- Configuration data: output of `perl configdata.pm --dump`
|
||||
- OS Name, Version, Hardware platform
|
||||
- Compiler Details (name, version)
|
||||
- Application Details (name, version)
|
||||
- Problem Description (steps that will reproduce the problem, if known)
|
||||
- Stack Traceback (if the application dumps core)
|
||||
|
||||
Not only errors in the software, also errors in the documentation, in
|
||||
particular the manual pages, can be reported as issues.
|
||||
|
||||
### Submit a Pull Request
|
||||
|
||||
The fastest way to get a bug fixed is to fix it yourself ;-). If you are
|
||||
experienced in programming and know how to fix the bug, you can open a
|
||||
pull request. The details are covered in the [Contributing](#contributing) section.
|
||||
|
||||
Don't hesitate to open a pull request, even if it's only a small change
|
||||
like a grammatical or typographical error in the documentation.
|
||||
|
||||
Mailing Lists
|
||||
=============
|
||||
|
||||
The OpenSSL maintains a number of [mailing lists][] for various purposes.
|
||||
The most important lists are:
|
||||
|
||||
- [openssl-users][] for general questions about using the OpenSSL software
|
||||
and discussions between OpenSSL users.
|
||||
|
||||
- [openssl-announce][] for official announcements to the OpenSSL community.
|
||||
|
||||
- [openssl-project][] for discussion about the development roadmap
|
||||
and governance.
|
||||
|
||||
- [openssl-dev][] for discussion about development of OpenSSL.
|
||||
|
||||
The openssl-dev list has been discontinued since development is now taking
|
||||
place in form of GitHub pull requests. Although not active anymore, the
|
||||
searchable archive may still contain useful information.
|
||||
|
||||
<!-- Links -->
|
||||
|
||||
[mailing lists]: https://www.openssl.org/community/mailinglists.html
|
||||
[openssl-users]: https://mta.openssl.org/mailman/listinfo/openssl-users
|
||||
[openssl-announce]: https://mta.openssl.org/mailman/listinfo/openssl-announce
|
||||
[openssl-project]: https://mta.openssl.org/mailman/listinfo/openssl-project
|
||||
[openssl-dev]: https://mta.openssl.org/mailman/listinfo/openssl-dev
|
||||
@@ -1,7 +1,7 @@
|
||||
MAJOR=3
|
||||
MINOR=0
|
||||
PATCH=0
|
||||
PRE_RELEASE_TAG=dev
|
||||
PRE_RELEASE_TAG=alpha4-dev
|
||||
BUILD_METADATA=
|
||||
RELEASE_DATE=
|
||||
RELEASE_DATE=""
|
||||
SHLIB_VERSION=3
|
||||
+76
-56
@@ -1,5 +1,5 @@
|
||||
#!{- $config{HASHBANGPERL} -}
|
||||
# Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
# Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
#
|
||||
# Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
# this file except in compliance with the License. You can obtain a copy
|
||||
@@ -14,57 +14,63 @@
|
||||
use strict;
|
||||
use warnings;
|
||||
|
||||
my $openssl = "openssl";
|
||||
if(defined $ENV{'OPENSSL'}) {
|
||||
$openssl = $ENV{'OPENSSL'};
|
||||
} else {
|
||||
$ENV{'OPENSSL'} = $openssl;
|
||||
}
|
||||
|
||||
my $verbose = 1;
|
||||
my @OPENSSL_CMDS = ("req", "ca", "pkcs12", "x509", "verify");
|
||||
|
||||
my $OPENSSL_CONFIG = $ENV{"OPENSSL_CONFIG"} || "";
|
||||
my $DAYS = "-days 365";
|
||||
my $CADAYS = "-days 1095"; # 3 years
|
||||
my $openssl = $ENV{'OPENSSL'} // "openssl";
|
||||
$ENV{'OPENSSL'} = $openssl;
|
||||
my $OPENSSL_CONFIG = $ENV{"OPENSSL_CONFIG"} // "";
|
||||
|
||||
# Command invocations.
|
||||
my $REQ = "$openssl req $OPENSSL_CONFIG";
|
||||
my $CA = "$openssl ca $OPENSSL_CONFIG";
|
||||
my $VERIFY = "$openssl verify";
|
||||
my $X509 = "$openssl x509";
|
||||
my $PKCS12 = "$openssl pkcs12";
|
||||
|
||||
# default openssl.cnf file has setup as per the following
|
||||
# Default values for various configuration settings.
|
||||
my $CATOP = "./demoCA";
|
||||
my $CAKEY = "cakey.pem";
|
||||
my $CAREQ = "careq.pem";
|
||||
my $CACERT = "cacert.pem";
|
||||
my $CACRL = "crl.pem";
|
||||
my $DIRMODE = 0777;
|
||||
|
||||
my $DAYS = "-days 365";
|
||||
my $CADAYS = "-days 1095"; # 3 years
|
||||
my $NEWKEY = "newkey.pem";
|
||||
my $NEWREQ = "newreq.pem";
|
||||
my $NEWCERT = "newcert.pem";
|
||||
my $NEWP12 = "newcert.p12";
|
||||
my $RET = 0;
|
||||
my $WHAT = shift @ARGV || "";
|
||||
my @OPENSSL_CMDS = ("req", "ca", "pkcs12", "x509", "verify");
|
||||
my %EXTRA = extra_args(\@ARGV, "-extra-");
|
||||
my $FILE;
|
||||
|
||||
sub extra_args {
|
||||
my ($args_ref, $arg_prefix) = @_;
|
||||
my %eargs = map {
|
||||
if ($_ < $#$args_ref) {
|
||||
my ($arg, $value) = splice(@$args_ref, $_, 2);
|
||||
$arg =~ s/$arg_prefix//;
|
||||
($arg, $value);
|
||||
} else {
|
||||
();
|
||||
}
|
||||
} reverse grep($$args_ref[$_] =~ /$arg_prefix/, 0..$#$args_ref);
|
||||
my %empty = map { ($_, "") } @OPENSSL_CMDS;
|
||||
return (%empty, %eargs);
|
||||
# Commandline parsing
|
||||
my %EXTRA;
|
||||
my $WHAT = shift @ARGV || "";
|
||||
@ARGV = parse_extra(@ARGV);
|
||||
my $RET = 0;
|
||||
|
||||
# Split out "-extra-CMD value", and return new |@ARGV|. Fill in
|
||||
# |EXTRA{CMD}| with list of values.
|
||||
sub parse_extra
|
||||
{
|
||||
foreach ( @OPENSSL_CMDS ) {
|
||||
$EXTRA{$_} = '';
|
||||
}
|
||||
|
||||
my @result;
|
||||
while ( scalar(@_) > 0 ) {
|
||||
my $arg = shift;
|
||||
if ( $arg !~ m/-extra-([a-z0-9]+)/ ) {
|
||||
push @result, $arg;
|
||||
next;
|
||||
}
|
||||
$arg =~ s/-extra-//;
|
||||
die("Unknown \"-${arg}-extra\" option, exiting")
|
||||
unless scalar grep { $arg eq $_ } @OPENSSL_CMDS;
|
||||
$EXTRA{$arg} .= " " . shift;
|
||||
}
|
||||
return @result;
|
||||
}
|
||||
|
||||
|
||||
# See if reason for a CRL entry is valid; exit if not.
|
||||
sub crl_reason_ok
|
||||
{
|
||||
@@ -113,19 +119,25 @@ sub run
|
||||
|
||||
|
||||
if ( $WHAT =~ /^(-\?|-h|-help)$/ ) {
|
||||
print STDERR "usage: CA.pl -newcert | -newreq | -newreq-nodes | -xsign | -sign | -signCA | -signcert | -crl | -newca [-extra-cmd extra-params]\n";
|
||||
print STDERR " CA.pl -pkcs12 [-extra-pkcs12 extra-params] [certname]\n";
|
||||
print STDERR " CA.pl -verify [-extra-verify extra-params] certfile ...\n";
|
||||
print STDERR " CA.pl -revoke [-extra-ca extra-params] certfile [reason]\n";
|
||||
print STDERR <<EOF;
|
||||
Usage:
|
||||
CA.pl -newcert | -newreq | -newreq-nodes | -xsign | -sign | -signCA | -signcert | -crl | -newca [-extra-cmd parameter]
|
||||
CA.pl -pkcs12 [-extra-pkcs12 parameter] [certname]
|
||||
CA.pl -verify [-extra-verify parameter] certfile ...
|
||||
CA.pl -revoke [-extra-ca parameter] certfile [reason]
|
||||
EOF
|
||||
exit 0;
|
||||
}
|
||||
|
||||
if ($WHAT eq '-newcert' ) {
|
||||
# create a certificate
|
||||
$RET = run("$REQ -new -x509 -keyout $NEWKEY -out $NEWCERT $DAYS $EXTRA{req}");
|
||||
$RET = run("$REQ -new -x509 -keyout $NEWKEY -out $NEWCERT $DAYS"
|
||||
. " $EXTRA{req}");
|
||||
print "Cert is in $NEWCERT, private key is in $NEWKEY\n" if $RET == 0;
|
||||
} elsif ($WHAT eq '-precert' ) {
|
||||
# create a pre-certificate
|
||||
$RET = run("$REQ -x509 -precert -keyout $NEWKEY -out $NEWCERT $DAYS");
|
||||
$RET = run("$REQ -x509 -precert -keyout $NEWKEY -out $NEWCERT $DAYS"
|
||||
. " $EXTRA{req}");
|
||||
print "Pre-cert is in $NEWCERT, private key is in $NEWKEY\n" if $RET == 0;
|
||||
} elsif ($WHAT =~ /^\-newreq(\-nodes)?$/ ) {
|
||||
# create a certificate request
|
||||
@@ -133,11 +145,20 @@ if ($WHAT eq '-newcert' ) {
|
||||
print "Request is in $NEWREQ, private key is in $NEWKEY\n" if $RET == 0;
|
||||
} elsif ($WHAT eq '-newca' ) {
|
||||
# create the directory hierarchy
|
||||
mkdir ${CATOP}, $DIRMODE;
|
||||
mkdir "${CATOP}/certs", $DIRMODE;
|
||||
mkdir "${CATOP}/crl", $DIRMODE ;
|
||||
mkdir "${CATOP}/newcerts", $DIRMODE;
|
||||
mkdir "${CATOP}/private", $DIRMODE;
|
||||
my @dirs = ( "${CATOP}", "${CATOP}/certs", "${CATOP}/crl",
|
||||
"${CATOP}/newcerts", "${CATOP}/private" );
|
||||
die "${CATOP}/index.txt exists.\nRemove old sub-tree to proceed,"
|
||||
if -f "${CATOP}/index.txt";
|
||||
die "${CATOP}/serial exists.\nRemove old sub-tree to proceed,"
|
||||
if -f "${CATOP}/serial";
|
||||
foreach my $d ( @dirs ) {
|
||||
if ( -d $d ) {
|
||||
warn "Directory $d exists" if -d $d;
|
||||
} else {
|
||||
mkdir $d or die "Can't mkdir $d, $!";
|
||||
}
|
||||
}
|
||||
|
||||
open OUT, ">${CATOP}/index.txt";
|
||||
close OUT;
|
||||
open OUT, ">${CATOP}/crlnumber";
|
||||
@@ -145,6 +166,7 @@ if ($WHAT eq '-newcert' ) {
|
||||
close OUT;
|
||||
# ask user for existing CA certificate
|
||||
print "CA certificate filename (or enter to create)\n";
|
||||
my $FILE;
|
||||
$FILE = "" unless defined($FILE = <STDIN>);
|
||||
$FILE =~ s{\R$}{};
|
||||
if ($FILE ne "") {
|
||||
@@ -152,44 +174,42 @@ if ($WHAT eq '-newcert' ) {
|
||||
copy_pemfile($FILE,"${CATOP}/$CACERT", "CERTIFICATE");
|
||||
} else {
|
||||
print "Making CA certificate ...\n";
|
||||
$RET = run("$REQ -new -keyout"
|
||||
. " ${CATOP}/private/$CAKEY"
|
||||
$RET = run("$REQ -new -keyout ${CATOP}/private/$CAKEY"
|
||||
. " -out ${CATOP}/$CAREQ $EXTRA{req}");
|
||||
$RET = run("$CA -create_serial"
|
||||
. " -out ${CATOP}/$CACERT $CADAYS -batch"
|
||||
. " -keyfile ${CATOP}/private/$CAKEY -selfsign"
|
||||
. " -extensions v3_ca $EXTRA{ca}"
|
||||
. " -infiles ${CATOP}/$CAREQ") if $RET == 0;
|
||||
. " -extensions v3_ca"
|
||||
. " -infiles ${CATOP}/$CAREQ $EXTRA{ca}") if $RET == 0;
|
||||
print "CA certificate is in ${CATOP}/$CACERT\n" if $RET == 0;
|
||||
}
|
||||
} elsif ($WHAT eq '-pkcs12' ) {
|
||||
my $cname = $ARGV[0];
|
||||
$cname = "My Certificate" unless defined $cname;
|
||||
$RET = run("$PKCS12 -in $NEWCERT -inkey $NEWKEY"
|
||||
. " -certfile ${CATOP}/$CACERT"
|
||||
. " -out $NEWP12"
|
||||
. " -certfile ${CATOP}/$CACERT -out $NEWP12"
|
||||
. " -export -name \"$cname\" $EXTRA{pkcs12}");
|
||||
print "PKCS #12 file is in $NEWP12\n" if $RET == 0;
|
||||
} elsif ($WHAT eq '-xsign' ) {
|
||||
$RET = run("$CA -policy policy_anything $EXTRA{ca} -infiles $NEWREQ");
|
||||
$RET = run("$CA -policy policy_anything -infiles $NEWREQ $EXTRA{ca}");
|
||||
} elsif ($WHAT eq '-sign' ) {
|
||||
$RET = run("$CA -policy policy_anything -out $NEWCERT $EXTRA{ca} -infiles $NEWREQ");
|
||||
$RET = run("$CA -policy policy_anything -out $NEWCERT"
|
||||
. " -infiles $NEWREQ $EXTRA{ca}");
|
||||
print "Signed certificate is in $NEWCERT\n" if $RET == 0;
|
||||
} elsif ($WHAT eq '-signCA' ) {
|
||||
$RET = run("$CA -policy policy_anything -out $NEWCERT"
|
||||
. " -extensions v3_ca $EXTRA{ca} -infiles $NEWREQ");
|
||||
. " -extensions v3_ca -infiles $NEWREQ $EXTRA{ca}");
|
||||
print "Signed CA certificate is in $NEWCERT\n" if $RET == 0;
|
||||
} elsif ($WHAT eq '-signcert' ) {
|
||||
$RET = run("$X509 -x509toreq -in $NEWREQ -signkey $NEWREQ"
|
||||
. " -out tmp.pem $EXTRA{x509}");
|
||||
$RET = run("$CA -policy policy_anything -out $NEWCERT"
|
||||
. "$EXTRA{ca} -infiles tmp.pem") if $RET == 0;
|
||||
. "-infiles tmp.pem $EXTRA{ca}") if $RET == 0;
|
||||
print "Signed certificate is in $NEWCERT\n" if $RET == 0;
|
||||
} elsif ($WHAT eq '-verify' ) {
|
||||
my @files = @ARGV ? @ARGV : ( $NEWCERT );
|
||||
my $file;
|
||||
foreach $file (@files) {
|
||||
my $status = run("$VERIFY \"-CAfile\" ${CATOP}/$CACERT $file $EXTRA{verify}");
|
||||
foreach my $file (@files) {
|
||||
my $status = run("$VERIFY -CAfile ${CATOP}/$CACERT $file $EXTRA{verify}");
|
||||
$RET = $status if $status != 0;
|
||||
}
|
||||
} elsif ($WHAT eq '-crl' ) {
|
||||
|
||||
+4
-1
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -18,6 +18,9 @@
|
||||
#include <openssl/pem.h>
|
||||
#include <openssl/asn1t.h>
|
||||
|
||||
DEFINE_STACK_OF(ASN1_OBJECT)
|
||||
DEFINE_STACK_OF_STRING()
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_INFORM, OPT_IN, OPT_OUT, OPT_INDENT, OPT_NOOUT,
|
||||
|
||||
+45
-5
@@ -12,13 +12,43 @@ ENDIF
|
||||
# Source for the 'openssl' program
|
||||
$OPENSSLSRC=\
|
||||
openssl.c progs.c \
|
||||
asn1pars.c ca.c ciphers.c cms.c crl.c crl2p7.c dgst.c dhparam.c \
|
||||
dsa.c dsaparam.c ec.c ecparam.c enc.c engine.c errstr.c gendsa.c \
|
||||
genpkey.c genrsa.c kdf.c mac.c nseq.c ocsp.c passwd.c pkcs12.c pkcs7.c \
|
||||
pkcs8.c pkey.c pkeyparam.c pkeyutl.c prime.c rand.c req.c rsa.c \
|
||||
asn1pars.c ca.c ciphers.c cms.c crl.c crl2p7.c dgst.c \
|
||||
enc.c errstr.c \
|
||||
genpkey.c kdf.c mac.c nseq.c passwd.c pkcs7.c \
|
||||
pkcs8.c pkey.c pkeyparam.c pkeyutl.c prime.c rand.c req.c \
|
||||
rsautl.c s_client.c s_server.c s_time.c sess_id.c smime.c speed.c \
|
||||
spkac.c srp.c ts.c verify.c version.c x509.c rehash.c storeutl.c \
|
||||
spkac.c verify.c version.c x509.c rehash.c storeutl.c \
|
||||
list.c info.c provider.c fipsinstall.c
|
||||
IF[{- !$disabled{'des'} -}]
|
||||
$OPENSSLSRC=$OPENSSLSRC pkcs12.c
|
||||
ENDIF
|
||||
IF[{- !$disabled{'ec'} -}]
|
||||
$OPENSSLSRC=$OPENSSLSRC ec.c ecparam.c
|
||||
ENDIF
|
||||
IF[{- !$disabled{'ocsp'} -}]
|
||||
$OPENSSLSRC=$OPENSSLSRC ocsp.c
|
||||
ENDIF
|
||||
IF[{- !$disabled{'srp'} -}]
|
||||
$OPENSSLSRC=$OPENSSLSRC srp.c
|
||||
ENDIF
|
||||
IF[{- !$disabled{'ts'} -}]
|
||||
$OPENSSLSRC=$OPENSSLSRC ts.c
|
||||
ENDIF
|
||||
IF[{- !$disabled{'dh'} -}]
|
||||
$OPENSSLSRC=$OPENSSLSRC dhparam.c
|
||||
ENDIF
|
||||
IF[{- !$disabled{'dsa'} -}]
|
||||
$OPENSSLSRC=$OPENSSLSRC dsa.c dsaparam.c gendsa.c
|
||||
ENDIF
|
||||
IF[{- !$disabled{'engine'} -}]
|
||||
$OPENSSLSRC=$OPENSSLSRC engine.c
|
||||
ENDIF
|
||||
IF[{- !$disabled{'rsa'} -}]
|
||||
$OPENSSLSRC=$OPENSSLSRC rsa.c genrsa.c
|
||||
ENDIF
|
||||
IF[{- !$disabled{'cmp'} -}]
|
||||
$OPENSSLSRC=$OPENSSLSRC cmp.c cmp_mock_srv.c
|
||||
ENDIF
|
||||
|
||||
IF[{- !$disabled{apps} -}]
|
||||
PROGRAMS=openssl
|
||||
@@ -26,6 +56,16 @@ IF[{- !$disabled{apps} -}]
|
||||
INCLUDE[openssl]=.. ../include include
|
||||
DEPEND[openssl]=libapps.a ../libssl
|
||||
|
||||
DEPEND[${OPENSSLSRC/.c/.o}]=progs.h
|
||||
GENERATE[progs.c]=progs.pl -C $(APPS_OPENSSL)
|
||||
GENERATE[progs.h]=progs.pl -H $(APPS_OPENSSL)
|
||||
# progs.pl tries to read all 'openssl' sources, including progs.c, so we make
|
||||
# sure things are generated in the correct order.
|
||||
DEPEND[progs.h]=progs.c
|
||||
# Because the files to look through may change (depends on $OPENSSLSRC),
|
||||
# always depend on a changed configuration.
|
||||
DEPEND[progs.c]=../configdata.pm
|
||||
|
||||
IF[{- $config{target} =~ /^(?:Cygwin|mingw|VC-)/ -}]
|
||||
GENERATE[openssl.rc]=../util/mkrc.pl openssl
|
||||
SOURCE[openssl]=openssl.rc
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -34,6 +34,11 @@
|
||||
#include "apps.h"
|
||||
#include "progs.h"
|
||||
|
||||
DEFINE_STACK_OF(X509)
|
||||
DEFINE_STACK_OF(X509_EXTENSION)
|
||||
DEFINE_STACK_OF(CONF_VALUE)
|
||||
DEFINE_STACK_OF_STRING()
|
||||
|
||||
#ifndef W_OK
|
||||
# define F_OK 0
|
||||
# define W_OK 2
|
||||
@@ -88,18 +93,23 @@ typedef enum {
|
||||
|
||||
static char *lookup_conf(const CONF *conf, const char *group, const char *tag);
|
||||
|
||||
static int certify(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509,
|
||||
const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
|
||||
static int certify(X509 **xret, const char *infile, int informat,
|
||||
EVP_PKEY *pkey, X509 *x509,
|
||||
const EVP_MD *dgst,
|
||||
STACK_OF(OPENSSL_STRING) *sigopts,
|
||||
STACK_OF(OPENSSL_STRING) *vfyopts,
|
||||
STACK_OF(CONF_VALUE) *policy, CA_DB *db,
|
||||
BIGNUM *serial, const char *subj, unsigned long chtype,
|
||||
int multirdn, int email_dn, const char *startdate,
|
||||
const char *enddate,
|
||||
long days, int batch, const char *ext_sect, CONF *conf,
|
||||
int verbose, unsigned long certopt, unsigned long nameopt,
|
||||
int default_op, int ext_copy, int selfsign,
|
||||
unsigned char *sm2_id, size_t sm2idlen);
|
||||
static int certify_cert(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509,
|
||||
const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
|
||||
int default_op, int ext_copy, int selfsign);
|
||||
static int certify_cert(X509 **xret, const char *infile, int informat,
|
||||
EVP_PKEY *pkey, X509 *x509,
|
||||
const EVP_MD *dgst,
|
||||
STACK_OF(OPENSSL_STRING) *sigopts,
|
||||
STACK_OF(OPENSSL_STRING) *vfyopts,
|
||||
STACK_OF(CONF_VALUE) *policy, CA_DB *db,
|
||||
BIGNUM *serial, const char *subj, unsigned long chtype,
|
||||
int multirdn, int email_dn, const char *startdate,
|
||||
@@ -142,13 +152,14 @@ typedef enum OPTION_choice {
|
||||
OPT_ENGINE, OPT_VERBOSE, OPT_CONFIG, OPT_NAME, OPT_SUBJ, OPT_UTF8,
|
||||
OPT_CREATE_SERIAL, OPT_MULTIVALUE_RDN, OPT_STARTDATE, OPT_ENDDATE,
|
||||
OPT_DAYS, OPT_MD, OPT_POLICY, OPT_KEYFILE, OPT_KEYFORM, OPT_PASSIN,
|
||||
OPT_KEY, OPT_CERT, OPT_SELFSIGN, OPT_IN, OPT_OUT, OPT_OUTDIR,
|
||||
OPT_KEY, OPT_CERT, OPT_CERTFORM, OPT_SELFSIGN,
|
||||
OPT_IN, OPT_INFORM, OPT_OUT, OPT_OUTDIR, OPT_VFYOPT,
|
||||
OPT_SIGOPT, OPT_NOTEXT, OPT_BATCH, OPT_PRESERVEDN, OPT_NOEMAILDN,
|
||||
OPT_GENCRL, OPT_MSIE_HACK, OPT_CRLDAYS, OPT_CRLHOURS, OPT_CRLSEC,
|
||||
OPT_INFILES, OPT_SS_CERT, OPT_SPKAC, OPT_REVOKE, OPT_VALID,
|
||||
OPT_EXTENSIONS, OPT_EXTFILE, OPT_STATUS, OPT_UPDATEDB, OPT_CRLEXTS,
|
||||
OPT_RAND_SERIAL,
|
||||
OPT_R_ENUM, OPT_SM2ID, OPT_SM2HEXID,
|
||||
OPT_R_ENUM, OPT_PROV_ENUM,
|
||||
/* Do not change the order here; see related case statements below */
|
||||
OPT_CRL_REASON, OPT_CRL_HOLD, OPT_CRL_COMPROMISE, OPT_CRL_CA_COMPROMISE
|
||||
} OPTION_CHOICE;
|
||||
@@ -160,7 +171,8 @@ const OPTIONS ca_options[] = {
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"verbose", OPT_VERBOSE, '-', "Verbose output during processing"},
|
||||
{"outdir", OPT_OUTDIR, '/', "Where to put output cert"},
|
||||
{"in", OPT_IN, '<', "The input PEM encoded cert request(s)"},
|
||||
{"in", OPT_IN, '<', "The input cert request(s)"},
|
||||
{"inform", OPT_INFORM, 'F', "CSR input format (DER or PEM); default PEM"},
|
||||
{"infiles", OPT_INFILES, '-', "The last argument, requests to process"},
|
||||
{"out", OPT_OUT, '>', "Where to put the output file(s)"},
|
||||
{"notext", OPT_NOTEXT, '-', "Do not print the generated certificate"},
|
||||
@@ -177,11 +189,12 @@ const OPTIONS ca_options[] = {
|
||||
OPT_SECTION("Configuration"),
|
||||
{"config", OPT_CONFIG, 's', "A config file"},
|
||||
{"name", OPT_NAME, 's', "The particular CA definition to use"},
|
||||
{"section", OPT_NAME, 's', "An alias for -name"},
|
||||
{"policy", OPT_POLICY, 's', "The CA 'policy' to support"},
|
||||
|
||||
OPT_SECTION("Certificate"),
|
||||
{"subj", OPT_SUBJ, 's', "Use arg instead of request's subject"},
|
||||
{"utf8", OPT_UTF8, '-', "Input characters are UTF8 (default ASCII)"},
|
||||
{"utf8", OPT_UTF8, '-', "Input characters are UTF8; default ASCII"},
|
||||
{"create_serial", OPT_CREATE_SERIAL, '-',
|
||||
"If reading serial fails, create a new random serial"},
|
||||
{"rand_serial", OPT_RAND_SERIAL, '-',
|
||||
@@ -196,25 +209,22 @@ const OPTIONS ca_options[] = {
|
||||
"Extension section (override value in config file)"},
|
||||
{"extfile", OPT_EXTFILE, '<',
|
||||
"Configuration file with X509v3 extensions to add"},
|
||||
#ifndef OPENSSL_NO_SM2
|
||||
{"sm2-id", OPT_SM2ID, 's',
|
||||
"Specify an ID string to verify an SM2 certificate request"},
|
||||
{"sm2-hex-id", OPT_SM2HEXID, 's',
|
||||
"Specify a hex ID string to verify an SM2 certificate request"},
|
||||
#endif
|
||||
{"preserveDN", OPT_PRESERVEDN, '-', "Don't re-order the DN"},
|
||||
{"noemailDN", OPT_NOEMAILDN, '-', "Don't add the EMAIL field to the DN"},
|
||||
|
||||
OPT_SECTION("Signing"),
|
||||
{"md", OPT_MD, 's', "md to use; one of md2, md5, sha or sha1"},
|
||||
{"keyfile", OPT_KEYFILE, 's', "Private key"},
|
||||
{"keyform", OPT_KEYFORM, 'f', "Private key file format (PEM or ENGINE)"},
|
||||
{"keyform", OPT_KEYFORM, 'f', "Private key file format (ENGINE, other values ignored)"},
|
||||
{"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
|
||||
{"key", OPT_KEY, 's', "Key to decode the private key if it is encrypted"},
|
||||
{"cert", OPT_CERT, '<', "The CA cert"},
|
||||
{"certform", OPT_CERTFORM, 'F',
|
||||
"certificate input format (DER/PEM/P12); has no effect"},
|
||||
{"selfsign", OPT_SELFSIGN, '-',
|
||||
"Sign a cert with the key associated with it"},
|
||||
{"sigopt", OPT_SIGOPT, 's', "Signature parameter in n:v form"},
|
||||
{"vfyopt", OPT_SIGOPT, 's', "Verification parameter in n:v form"},
|
||||
|
||||
OPT_SECTION("Revocation"),
|
||||
{"gencrl", OPT_GENCRL, '-', "Generate a new CRL"},
|
||||
@@ -237,6 +247,7 @@ const OPTIONS ca_options[] = {
|
||||
{"revoke", OPT_REVOKE, '<', "Revoke a cert (given in file)"},
|
||||
|
||||
OPT_R_OPTIONS,
|
||||
OPT_PROV_OPTIONS,
|
||||
|
||||
OPT_PARAMETERS(),
|
||||
{"certreq", 0, 0, "Certificate requests to be signed (optional)"},
|
||||
@@ -255,13 +266,14 @@ int ca_main(int argc, char **argv)
|
||||
CA_DB *db = NULL;
|
||||
DB_ATTR db_attr;
|
||||
STACK_OF(CONF_VALUE) *attribs = NULL;
|
||||
STACK_OF(OPENSSL_STRING) *sigopts = NULL;
|
||||
STACK_OF(OPENSSL_STRING) *sigopts = NULL, *vfyopts = NULL;
|
||||
STACK_OF(X509) *cert_sk = NULL;
|
||||
X509_CRL *crl = NULL;
|
||||
const EVP_MD *dgst = NULL;
|
||||
char *configfile = default_config_file, *section = NULL;
|
||||
char *md = NULL, *policy = NULL, *keyfile = NULL;
|
||||
char *certfile = NULL, *crl_ext = NULL, *crlnumberfile = NULL, *key = NULL;
|
||||
int certformat = FORMAT_PEM, informat = FORMAT_PEM;
|
||||
const char *infile = NULL, *spkac_file = NULL, *ss_cert_file = NULL;
|
||||
const char *extensions = NULL, *extfile = NULL, *passinarg = NULL;
|
||||
char *outdir = NULL, *outfile = NULL, *rev_arg = NULL, *ser_status = NULL;
|
||||
@@ -284,9 +296,6 @@ int ca_main(int argc, char **argv)
|
||||
REVINFO_TYPE rev_type = REV_NONE;
|
||||
X509_REVOKED *r = NULL;
|
||||
OPTION_CHOICE o;
|
||||
unsigned char *sm2_id = NULL;
|
||||
size_t sm2_idlen = 0;
|
||||
int sm2_free = 0;
|
||||
|
||||
prog = opt_init(argc, argv, ca_options);
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
@@ -304,6 +313,10 @@ opthelp:
|
||||
req = 1;
|
||||
infile = opt_arg();
|
||||
break;
|
||||
case OPT_INFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &informat))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_OUT:
|
||||
outfile = opt_arg();
|
||||
break;
|
||||
@@ -361,12 +374,20 @@ opthelp:
|
||||
if (!opt_rand(o))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_KEY:
|
||||
key = opt_arg();
|
||||
break;
|
||||
case OPT_CERT:
|
||||
certfile = opt_arg();
|
||||
break;
|
||||
case OPT_CERTFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_ANY, &certformat))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_SELFSIGN:
|
||||
selfsign = 1;
|
||||
break;
|
||||
@@ -379,6 +400,12 @@ opthelp:
|
||||
if (sigopts == NULL || !sk_OPENSSL_STRING_push(sigopts, opt_arg()))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_VFYOPT:
|
||||
if (vfyopts == NULL)
|
||||
vfyopts = sk_OPENSSL_STRING_new_null();
|
||||
if (vfyopts == NULL || !sk_OPENSSL_STRING_push(vfyopts, opt_arg()))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_NOTEXT:
|
||||
notext = 1;
|
||||
break;
|
||||
@@ -450,30 +477,6 @@ opthelp:
|
||||
case OPT_ENGINE:
|
||||
e = setup_engine(opt_arg(), 0);
|
||||
break;
|
||||
case OPT_SM2ID:
|
||||
/* we assume the input is not a hex string */
|
||||
if (sm2_id != NULL) {
|
||||
BIO_printf(bio_err,
|
||||
"Use one of the options 'sm2-hex-id' or 'sm2-id'\n");
|
||||
goto end;
|
||||
}
|
||||
sm2_id = (unsigned char *)opt_arg();
|
||||
sm2_idlen = strlen((const char *)sm2_id);
|
||||
break;
|
||||
case OPT_SM2HEXID:
|
||||
/* try to parse the input as hex string first */
|
||||
if (sm2_id != NULL) {
|
||||
BIO_printf(bio_err,
|
||||
"Use one of the options 'sm2-hex-id' or 'sm2-id'\n");
|
||||
goto end;
|
||||
}
|
||||
sm2_free = 1;
|
||||
sm2_id = OPENSSL_hexstr2buf(opt_arg(), (long *)&sm2_idlen);
|
||||
if (sm2_id == NULL) {
|
||||
BIO_printf(bio_err, "Invalid hex string input\n");
|
||||
goto end;
|
||||
}
|
||||
break;
|
||||
}
|
||||
}
|
||||
end_of_options:
|
||||
@@ -570,8 +573,7 @@ end_of_options:
|
||||
}
|
||||
}
|
||||
pkey = load_key(keyfile, keyformat, 0, key, e, "CA private key");
|
||||
if (key != NULL)
|
||||
OPENSSL_cleanse(key, strlen(key));
|
||||
cleanse(key);
|
||||
if (pkey == NULL)
|
||||
/* load_key() has already printed an appropriate message */
|
||||
goto end;
|
||||
@@ -583,7 +585,7 @@ end_of_options:
|
||||
&& (certfile = lookup_conf(conf, section, ENV_CERTIFICATE)) == NULL)
|
||||
goto end;
|
||||
|
||||
x509 = load_cert(certfile, FORMAT_PEM, "CA certificate");
|
||||
x509 = load_cert(certfile, certformat, "CA certificate");
|
||||
if (x509 == NULL)
|
||||
goto end;
|
||||
|
||||
@@ -938,8 +940,8 @@ end_of_options:
|
||||
}
|
||||
if (ss_cert_file != NULL) {
|
||||
total++;
|
||||
j = certify_cert(&x, ss_cert_file, pkey, x509, dgst, sigopts,
|
||||
attribs,
|
||||
j = certify_cert(&x, ss_cert_file, certformat, pkey, x509, dgst,
|
||||
sigopts, vfyopts, attribs,
|
||||
db, serial, subj, chtype, multirdn, email_dn,
|
||||
startdate, enddate, days, batch, extensions,
|
||||
conf, verbose, certopt, get_nameopt(), default_op,
|
||||
@@ -959,11 +961,11 @@ end_of_options:
|
||||
}
|
||||
if (infile != NULL) {
|
||||
total++;
|
||||
j = certify(&x, infile, pkey, x509p, dgst, sigopts, attribs, db,
|
||||
j = certify(&x, infile, informat, pkey, x509p, dgst,
|
||||
sigopts, vfyopts, attribs, db,
|
||||
serial, subj, chtype, multirdn, email_dn, startdate,
|
||||
enddate, days, batch, extensions, conf, verbose,
|
||||
certopt, get_nameopt(), default_op, ext_copy, selfsign,
|
||||
sm2_id, sm2_idlen);
|
||||
certopt, get_nameopt(), default_op, ext_copy, selfsign);
|
||||
if (j < 0)
|
||||
goto end;
|
||||
if (j > 0) {
|
||||
@@ -979,11 +981,12 @@ end_of_options:
|
||||
}
|
||||
for (i = 0; i < argc; i++) {
|
||||
total++;
|
||||
j = certify(&x, argv[i], pkey, x509p, dgst, sigopts, attribs, db,
|
||||
j = certify(&x, argv[i], informat, pkey, x509p, dgst,
|
||||
sigopts, vfyopts,
|
||||
attribs, db,
|
||||
serial, subj, chtype, multirdn, email_dn, startdate,
|
||||
enddate, days, batch, extensions, conf, verbose,
|
||||
certopt, get_nameopt(), default_op, ext_copy, selfsign,
|
||||
sm2_id, sm2_idlen);
|
||||
certopt, get_nameopt(), default_op, ext_copy, selfsign);
|
||||
if (j < 0)
|
||||
goto end;
|
||||
if (j > 0) {
|
||||
@@ -1259,7 +1262,7 @@ end_of_options:
|
||||
goto end;
|
||||
} else {
|
||||
X509 *revcert;
|
||||
revcert = load_cert(infile, FORMAT_PEM, infile);
|
||||
revcert = load_cert(infile, certformat, infile);
|
||||
if (revcert == NULL)
|
||||
goto end;
|
||||
if (dorevoke == 2)
|
||||
@@ -1281,8 +1284,6 @@ end_of_options:
|
||||
ret = 0;
|
||||
|
||||
end:
|
||||
if (sm2_free)
|
||||
OPENSSL_free(sm2_id);
|
||||
if (ret)
|
||||
ERR_print_errors(bio_err);
|
||||
BIO_free_all(Sout);
|
||||
@@ -1296,6 +1297,7 @@ end_of_options:
|
||||
BN_free(crlnumber);
|
||||
free_index(db);
|
||||
sk_OPENSSL_STRING_free(sigopts);
|
||||
sk_OPENSSL_STRING_free(vfyopts);
|
||||
EVP_PKEY_free(pkey);
|
||||
X509_free(x509);
|
||||
X509_CRL_free(crl);
|
||||
@@ -1313,32 +1315,26 @@ static char *lookup_conf(const CONF *conf, const char *section, const char *tag)
|
||||
return entry;
|
||||
}
|
||||
|
||||
static int certify(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509,
|
||||
const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
|
||||
static int certify(X509 **xret, const char *infile, int informat,
|
||||
EVP_PKEY *pkey, X509 *x509,
|
||||
const EVP_MD *dgst,
|
||||
STACK_OF(OPENSSL_STRING) *sigopts,
|
||||
STACK_OF(OPENSSL_STRING) *vfyopts,
|
||||
STACK_OF(CONF_VALUE) *policy, CA_DB *db,
|
||||
BIGNUM *serial, const char *subj, unsigned long chtype,
|
||||
int multirdn, int email_dn, const char *startdate,
|
||||
const char *enddate,
|
||||
long days, int batch, const char *ext_sect, CONF *lconf,
|
||||
int verbose, unsigned long certopt, unsigned long nameopt,
|
||||
int default_op, int ext_copy, int selfsign,
|
||||
unsigned char *sm2id, size_t sm2idlen)
|
||||
int default_op, int ext_copy, int selfsign)
|
||||
{
|
||||
X509_REQ *req = NULL;
|
||||
BIO *in = NULL;
|
||||
EVP_PKEY *pktmp = NULL;
|
||||
int ok = -1, i;
|
||||
|
||||
in = BIO_new_file(infile, "r");
|
||||
if (in == NULL) {
|
||||
ERR_print_errors(bio_err);
|
||||
req = load_csr(infile, informat, "certificate request");
|
||||
if (req == NULL)
|
||||
goto end;
|
||||
}
|
||||
if ((req = PEM_read_bio_X509_REQ(in, NULL, NULL, NULL)) == NULL) {
|
||||
BIO_printf(bio_err, "Error reading certificate request in %s\n",
|
||||
infile);
|
||||
goto end;
|
||||
}
|
||||
if (verbose)
|
||||
X509_REQ_print_ex(bio_err, req, nameopt, X509_FLAG_COMPAT);
|
||||
|
||||
@@ -1354,26 +1350,7 @@ static int certify(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509,
|
||||
BIO_printf(bio_err, "error unpacking public key\n");
|
||||
goto end;
|
||||
}
|
||||
if (sm2id != NULL) {
|
||||
#ifndef OPENSSL_NO_SM2
|
||||
ASN1_OCTET_STRING *v;
|
||||
|
||||
v = ASN1_OCTET_STRING_new();
|
||||
if (v == NULL) {
|
||||
BIO_printf(bio_err, "error: SM2 ID allocation failed\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (!ASN1_OCTET_STRING_set(v, sm2id, sm2idlen)) {
|
||||
BIO_printf(bio_err, "error: setting SM2 ID failed\n");
|
||||
ASN1_OCTET_STRING_free(v);
|
||||
goto end;
|
||||
}
|
||||
|
||||
X509_REQ_set0_sm2_id(req, v);
|
||||
#endif
|
||||
}
|
||||
i = X509_REQ_verify(req, pktmp);
|
||||
i = do_X509_REQ_verify(req, pktmp, vfyopts);
|
||||
pktmp = NULL;
|
||||
if (i < 0) {
|
||||
ok = 0;
|
||||
@@ -1398,12 +1375,14 @@ static int certify(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509,
|
||||
|
||||
end:
|
||||
X509_REQ_free(req);
|
||||
BIO_free(in);
|
||||
return ok;
|
||||
}
|
||||
|
||||
static int certify_cert(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509,
|
||||
const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
|
||||
static int certify_cert(X509 **xret, const char *infile, int certformat,
|
||||
EVP_PKEY *pkey, X509 *x509,
|
||||
const EVP_MD *dgst,
|
||||
STACK_OF(OPENSSL_STRING) *sigopts,
|
||||
STACK_OF(OPENSSL_STRING) *vfyopts,
|
||||
STACK_OF(CONF_VALUE) *policy, CA_DB *db,
|
||||
BIGNUM *serial, const char *subj, unsigned long chtype,
|
||||
int multirdn, int email_dn, const char *startdate,
|
||||
@@ -1416,7 +1395,7 @@ static int certify_cert(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x
|
||||
EVP_PKEY *pktmp = NULL;
|
||||
int ok = -1, i;
|
||||
|
||||
if ((req = load_cert(infile, FORMAT_PEM, infile)) == NULL)
|
||||
if ((req = load_cert(infile, certformat, infile)) == NULL)
|
||||
goto end;
|
||||
if (verbose)
|
||||
X509_print(bio_err, req);
|
||||
@@ -1427,7 +1406,7 @@ static int certify_cert(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x
|
||||
BIO_printf(bio_err, "error unpacking public key\n");
|
||||
goto end;
|
||||
}
|
||||
i = X509_verify(req, pktmp);
|
||||
i = do_X509_verify(req, pktmp, vfyopts);
|
||||
if (i < 0) {
|
||||
ok = 0;
|
||||
BIO_printf(bio_err, "Signature verification problems....\n");
|
||||
@@ -1464,7 +1443,8 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
|
||||
CONF *lconf, unsigned long certopt, unsigned long nameopt,
|
||||
int default_op, int ext_copy, int selfsign)
|
||||
{
|
||||
X509_NAME *name = NULL, *CAname = NULL, *subject = NULL;
|
||||
const X509_NAME *name = NULL;
|
||||
X509_NAME *CAname = NULL, *subject = NULL;
|
||||
const ASN1_TIME *tm;
|
||||
ASN1_STRING *str, *str2;
|
||||
ASN1_OBJECT *obj;
|
||||
|
||||
+9
-2
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -15,6 +15,8 @@
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/ssl.h>
|
||||
|
||||
DEFINE_STACK_OF_CONST(SSL_CIPHER)
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_STDNAME,
|
||||
@@ -27,7 +29,7 @@ typedef enum OPTION_choice {
|
||||
OPT_PSK,
|
||||
OPT_SRP,
|
||||
OPT_CIPHERSUITES,
|
||||
OPT_V, OPT_UPPER_V, OPT_S
|
||||
OPT_V, OPT_UPPER_V, OPT_S, OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS ciphers_options[] = {
|
||||
@@ -67,6 +69,7 @@ const OPTIONS ciphers_options[] = {
|
||||
#endif
|
||||
{"ciphersuites", OPT_CIPHERSUITES, 's',
|
||||
"Configure the TLSv1.3 ciphersuites to use"},
|
||||
OPT_PROV_OPTIONS,
|
||||
|
||||
OPT_PARAMETERS(),
|
||||
{"cipher", 0, 0, "Cipher string to decode (optional)"},
|
||||
@@ -169,6 +172,10 @@ int ciphers_main(int argc, char **argv)
|
||||
case OPT_CIPHERSUITES:
|
||||
ciphersuites = opt_arg();
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argv = opt_rest();
|
||||
|
||||
+3192
@@ -0,0 +1,3192 @@
|
||||
/*
|
||||
* Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright Nokia 2007-2019
|
||||
* Copyright Siemens AG 2015-2019
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include <string.h>
|
||||
#include <ctype.h>
|
||||
|
||||
#include "apps.h"
|
||||
#include "http_server.h"
|
||||
#include "s_apps.h"
|
||||
#include "progs.h"
|
||||
|
||||
#include "cmp_mock_srv.h"
|
||||
|
||||
/* tweaks needed due to missing unistd.h on Windows */
|
||||
#ifdef _WIN32
|
||||
# define access _access
|
||||
#endif
|
||||
#ifndef F_OK
|
||||
# define F_OK 0
|
||||
#endif
|
||||
|
||||
#include <openssl/ui.h>
|
||||
#include <openssl/pkcs12.h>
|
||||
#include <openssl/ssl.h>
|
||||
|
||||
/* explicit #includes not strictly needed since implied by the above: */
|
||||
#include <stdlib.h>
|
||||
#include <openssl/cmp.h>
|
||||
#include <openssl/cmp_util.h>
|
||||
#include <openssl/crmf.h>
|
||||
#include <openssl/crypto.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/store.h>
|
||||
#include <openssl/objects.h>
|
||||
#include <openssl/x509.h>
|
||||
|
||||
DEFINE_STACK_OF(X509)
|
||||
DEFINE_STACK_OF(X509_EXTENSION)
|
||||
DEFINE_STACK_OF(OSSL_CMP_ITAV)
|
||||
|
||||
static char *opt_config = NULL;
|
||||
#define CMP_SECTION "cmp"
|
||||
#define SECTION_NAME_MAX 40 /* max length of section name */
|
||||
#define DEFAULT_SECTION "default"
|
||||
static char *opt_section = CMP_SECTION;
|
||||
|
||||
#undef PROG
|
||||
#define PROG cmp_main
|
||||
static char *prog = "cmp";
|
||||
|
||||
static int read_config(void);
|
||||
|
||||
static CONF *conf = NULL; /* OpenSSL config file context structure */
|
||||
static OSSL_CMP_CTX *cmp_ctx = NULL; /* the client-side CMP context */
|
||||
|
||||
/* the type of cmp command we want to send */
|
||||
typedef enum {
|
||||
CMP_IR,
|
||||
CMP_KUR,
|
||||
CMP_CR,
|
||||
CMP_P10CR,
|
||||
CMP_RR,
|
||||
CMP_GENM
|
||||
} cmp_cmd_t;
|
||||
|
||||
/* message transfer */
|
||||
static char *opt_server = NULL;
|
||||
static char server_port_s[32] = { '\0' };
|
||||
static int server_port = 0;
|
||||
static char *opt_proxy = NULL;
|
||||
static char *opt_no_proxy = NULL;
|
||||
static char *opt_path = "/";
|
||||
static int opt_msg_timeout = -1;
|
||||
static int opt_total_timeout = -1;
|
||||
|
||||
/* server authentication */
|
||||
static char *opt_trusted = NULL;
|
||||
static char *opt_untrusted = NULL;
|
||||
static char *opt_srvcert = NULL;
|
||||
static char *opt_recipient = NULL;
|
||||
static char *opt_expect_sender = NULL;
|
||||
static int opt_ignore_keyusage = 0;
|
||||
static int opt_unprotected_errors = 0;
|
||||
static char *opt_extracertsout = NULL;
|
||||
static char *opt_cacertsout = NULL;
|
||||
|
||||
/* client authentication */
|
||||
static char *opt_ref = NULL;
|
||||
static char *opt_secret = NULL;
|
||||
static char *opt_cert = NULL;
|
||||
static char *opt_key = NULL;
|
||||
static char *opt_keypass = NULL;
|
||||
static char *opt_digest = NULL;
|
||||
static char *opt_mac = NULL;
|
||||
static char *opt_extracerts = NULL;
|
||||
static int opt_unprotected_requests = 0;
|
||||
|
||||
/* generic message */
|
||||
static char *opt_cmd_s = NULL;
|
||||
static int opt_cmd = -1;
|
||||
static char *opt_geninfo = NULL;
|
||||
static char *opt_infotype_s = NULL;
|
||||
static int opt_infotype = NID_undef;
|
||||
|
||||
/* certificate enrollment */
|
||||
static char *opt_newkey = NULL;
|
||||
static char *opt_newkeypass = NULL;
|
||||
static char *opt_subject = NULL;
|
||||
static char *opt_issuer = NULL;
|
||||
static int opt_days = 0;
|
||||
static char *opt_reqexts = NULL;
|
||||
static char *opt_sans = NULL;
|
||||
static int opt_san_nodefault = 0;
|
||||
static char *opt_policies = NULL;
|
||||
static char *opt_policy_oids = NULL;
|
||||
static int opt_policy_oids_critical = 0;
|
||||
static int opt_popo = OSSL_CRMF_POPO_NONE - 1;
|
||||
static char *opt_csr = NULL;
|
||||
static char *opt_out_trusted = NULL;
|
||||
static int opt_implicit_confirm = 0;
|
||||
static int opt_disable_confirm = 0;
|
||||
static char *opt_certout = NULL;
|
||||
|
||||
/* certificate enrollment and revocation */
|
||||
static char *opt_oldcert = NULL;
|
||||
static int opt_revreason = CRL_REASON_NONE;
|
||||
|
||||
/* credentials format */
|
||||
static char *opt_certform_s = "PEM";
|
||||
static int opt_certform = FORMAT_PEM;
|
||||
static char *opt_keyform_s = "PEM";
|
||||
static int opt_keyform = FORMAT_PEM;
|
||||
static char *opt_certsform_s = "PEM";
|
||||
static int opt_certsform = FORMAT_PEM;
|
||||
static char *opt_otherpass = NULL;
|
||||
static char *opt_engine = NULL;
|
||||
|
||||
/* TLS connection */
|
||||
static int opt_tls_used = 0;
|
||||
static char *opt_tls_cert = NULL;
|
||||
static char *opt_tls_key = NULL;
|
||||
static char *opt_tls_keypass = NULL;
|
||||
static char *opt_tls_extra = NULL;
|
||||
static char *opt_tls_trusted = NULL;
|
||||
static char *opt_tls_host = NULL;
|
||||
|
||||
/* client-side debugging */
|
||||
static int opt_batch = 0;
|
||||
static int opt_repeat = 1;
|
||||
static char *opt_reqin = NULL;
|
||||
static int opt_reqin_new_tid = 0;
|
||||
static char *opt_reqout = NULL;
|
||||
static char *opt_rspin = NULL;
|
||||
static char *opt_rspout = NULL;
|
||||
static int opt_use_mock_srv = 0;
|
||||
|
||||
/* server-side debugging */
|
||||
static char *opt_port = NULL;
|
||||
static int opt_max_msgs = 0;
|
||||
|
||||
static char *opt_srv_ref = NULL;
|
||||
static char *opt_srv_secret = NULL;
|
||||
static char *opt_srv_cert = NULL;
|
||||
static char *opt_srv_key = NULL;
|
||||
static char *opt_srv_keypass = NULL;
|
||||
|
||||
static char *opt_srv_trusted = NULL;
|
||||
static char *opt_srv_untrusted = NULL;
|
||||
static char *opt_rsp_cert = NULL;
|
||||
static char *opt_rsp_extracerts = NULL;
|
||||
static char *opt_rsp_capubs = NULL;
|
||||
static int opt_poll_count = 0;
|
||||
static int opt_check_after = 1;
|
||||
static int opt_grant_implicitconf = 0;
|
||||
|
||||
static int opt_pkistatus = OSSL_CMP_PKISTATUS_accepted;
|
||||
static int opt_failure = INT_MIN;
|
||||
static int opt_failurebits = 0;
|
||||
static char *opt_statusstring = NULL;
|
||||
static int opt_send_error = 0;
|
||||
static int opt_send_unprotected = 0;
|
||||
static int opt_send_unprot_err = 0;
|
||||
static int opt_accept_unprotected = 0;
|
||||
static int opt_accept_unprot_err = 0;
|
||||
static int opt_accept_raverified = 0;
|
||||
|
||||
static X509_VERIFY_PARAM *vpm = NULL;
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_CONFIG, OPT_SECTION,
|
||||
|
||||
OPT_CMD, OPT_INFOTYPE, OPT_GENINFO,
|
||||
|
||||
OPT_NEWKEY, OPT_NEWKEYPASS, OPT_SUBJECT, OPT_ISSUER,
|
||||
OPT_DAYS, OPT_REQEXTS,
|
||||
OPT_SANS, OPT_SAN_NODEFAULT,
|
||||
OPT_POLICIES, OPT_POLICY_OIDS, OPT_POLICY_OIDS_CRITICAL,
|
||||
OPT_POPO, OPT_CSR,
|
||||
OPT_OUT_TRUSTED, OPT_IMPLICIT_CONFIRM, OPT_DISABLE_CONFIRM,
|
||||
OPT_CERTOUT,
|
||||
|
||||
OPT_OLDCERT, OPT_REVREASON,
|
||||
|
||||
OPT_SERVER, OPT_PROXY, OPT_NO_PROXY, OPT_PATH,
|
||||
OPT_MSG_TIMEOUT, OPT_TOTAL_TIMEOUT,
|
||||
|
||||
OPT_TRUSTED, OPT_UNTRUSTED, OPT_SRVCERT,
|
||||
OPT_RECIPIENT, OPT_EXPECT_SENDER,
|
||||
OPT_IGNORE_KEYUSAGE, OPT_UNPROTECTED_ERRORS,
|
||||
OPT_EXTRACERTSOUT, OPT_CACERTSOUT,
|
||||
|
||||
OPT_REF, OPT_SECRET, OPT_CERT, OPT_KEY, OPT_KEYPASS,
|
||||
OPT_DIGEST, OPT_MAC, OPT_EXTRACERTS,
|
||||
OPT_UNPROTECTED_REQUESTS,
|
||||
|
||||
OPT_CERTFORM, OPT_KEYFORM, OPT_CERTSFORM,
|
||||
OPT_OTHERPASS,
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
OPT_ENGINE,
|
||||
#endif
|
||||
OPT_PROV_ENUM,
|
||||
|
||||
OPT_TLS_USED, OPT_TLS_CERT, OPT_TLS_KEY,
|
||||
OPT_TLS_KEYPASS,
|
||||
OPT_TLS_EXTRA, OPT_TLS_TRUSTED, OPT_TLS_HOST,
|
||||
|
||||
OPT_BATCH, OPT_REPEAT,
|
||||
OPT_REQIN, OPT_REQIN_NEW_TID, OPT_REQOUT, OPT_RSPIN, OPT_RSPOUT,
|
||||
|
||||
OPT_USE_MOCK_SRV, OPT_PORT, OPT_MAX_MSGS,
|
||||
OPT_SRV_REF, OPT_SRV_SECRET,
|
||||
OPT_SRV_CERT, OPT_SRV_KEY, OPT_SRV_KEYPASS,
|
||||
OPT_SRV_TRUSTED, OPT_SRV_UNTRUSTED,
|
||||
OPT_RSP_CERT, OPT_RSP_EXTRACERTS, OPT_RSP_CAPUBS,
|
||||
OPT_POLL_COUNT, OPT_CHECK_AFTER,
|
||||
OPT_GRANT_IMPLICITCONF,
|
||||
OPT_PKISTATUS, OPT_FAILURE,
|
||||
OPT_FAILUREBITS, OPT_STATUSSTRING,
|
||||
OPT_SEND_ERROR, OPT_SEND_UNPROTECTED,
|
||||
OPT_SEND_UNPROT_ERR, OPT_ACCEPT_UNPROTECTED,
|
||||
OPT_ACCEPT_UNPROT_ERR, OPT_ACCEPT_RAVERIFIED,
|
||||
|
||||
OPT_V_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS cmp_options[] = {
|
||||
/* entries must be in the same order as enumerated above!! */
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"config", OPT_CONFIG, 's',
|
||||
"Configuration file to use. \"\" = none. Default from env variable OPENSSL_CONF"},
|
||||
{"section", OPT_SECTION, 's',
|
||||
"Section(s) in config file to get options from. \"\" = 'default'. Default 'cmp'"},
|
||||
|
||||
OPT_SECTION("Generic message"),
|
||||
{"cmd", OPT_CMD, 's', "CMP request to send: ir/cr/kur/p10cr/rr/genm"},
|
||||
{"infotype", OPT_INFOTYPE, 's',
|
||||
"InfoType name for requesting specific info in genm, e.g. 'signKeyPairTypes'"},
|
||||
{"geninfo", OPT_GENINFO, 's',
|
||||
"generalInfo integer values to place in request PKIHeader with given OID"},
|
||||
{OPT_MORE_STR, 0, 0,
|
||||
"specified in the form <OID>:int:<n>, e.g. \"1.2.3:int:987\""},
|
||||
|
||||
OPT_SECTION("Certificate enrollment"),
|
||||
{"newkey", OPT_NEWKEY, 's',
|
||||
"Private or public key for the requested cert. Default: CSR key or client key"},
|
||||
{"newkeypass", OPT_NEWKEYPASS, 's', "New private key pass phrase source"},
|
||||
{"subject", OPT_SUBJECT, 's',
|
||||
"Distinguished Name (DN) of subject to use in the requested cert template"},
|
||||
{OPT_MORE_STR, 0, 0,
|
||||
"For kur, default is the subject DN of the reference cert (see -oldcert);"},
|
||||
{OPT_MORE_STR, 0, 0,
|
||||
"this default is used for ir and cr only if no Subject Alt Names are set"},
|
||||
{"issuer", OPT_ISSUER, 's',
|
||||
"DN of the issuer to place in the requested certificate template"},
|
||||
{OPT_MORE_STR, 0, 0,
|
||||
"also used as recipient if neither -recipient nor -srvcert are given"},
|
||||
{"days", OPT_DAYS, 'n',
|
||||
"Requested validity time of the new certificate in number of days"},
|
||||
{"reqexts", OPT_REQEXTS, 's',
|
||||
"Name of config file section defining certificate request extensions"},
|
||||
{"sans", OPT_SANS, 's',
|
||||
"Subject Alt Names (IPADDR/DNS/URI) to add as (critical) cert req extension"},
|
||||
{"san_nodefault", OPT_SAN_NODEFAULT, '-',
|
||||
"Do not take default SANs from reference certificate (see -oldcert)"},
|
||||
{"policies", OPT_POLICIES, 's',
|
||||
"Name of config file section defining policies certificate request extension"},
|
||||
{"policy_oids", OPT_POLICY_OIDS, 's',
|
||||
"Policy OID(s) to add as policies certificate request extension"},
|
||||
{"policy_oids_critical", OPT_POLICY_OIDS_CRITICAL, '-',
|
||||
"Flag the policy OID(s) given with -policy_oids as critical"},
|
||||
{"popo", OPT_POPO, 'n',
|
||||
"Proof-of-Possession (POPO) method to use for ir/cr/kur where"},
|
||||
{OPT_MORE_STR, 0, 0,
|
||||
"-1 = NONE, 0 = RAVERIFIED, 1 = SIGNATURE (default), 2 = KEYENC"},
|
||||
{"csr", OPT_CSR, 's',
|
||||
"CSR file in PKCS#10 format to use in p10cr for legacy support"},
|
||||
{"out_trusted", OPT_OUT_TRUSTED, 's',
|
||||
"Certificates to trust when verifying newly enrolled certificates"},
|
||||
{"implicit_confirm", OPT_IMPLICIT_CONFIRM, '-',
|
||||
"Request implicit confirmation of newly enrolled certificates"},
|
||||
{"disable_confirm", OPT_DISABLE_CONFIRM, '-',
|
||||
"Do not confirm newly enrolled certificate w/o requesting implicit"},
|
||||
{OPT_MORE_STR, 0, 0,
|
||||
"confirmation. WARNING: This leads to behavior violating RFC 4210"},
|
||||
{"certout", OPT_CERTOUT, 's',
|
||||
"File to save newly enrolled certificate"},
|
||||
|
||||
OPT_SECTION("Certificate enrollment and revocation"),
|
||||
|
||||
{"oldcert", OPT_OLDCERT, 's',
|
||||
"Certificate to be updated (defaulting to -cert) or to be revoked in rr;"},
|
||||
{OPT_MORE_STR, 0, 0,
|
||||
"also used as reference (defaulting to -cert) for subject DN and SANs."},
|
||||
{OPT_MORE_STR, 0, 0,
|
||||
"Its issuer is used as recipient unless -srvcert, -recipient or -issuer given"},
|
||||
{"revreason", OPT_REVREASON, 'n',
|
||||
"Reason code to include in revocation request (rr); possible values:"},
|
||||
{OPT_MORE_STR, 0, 0,
|
||||
"0..6, 8..10 (see RFC5280, 5.3.1) or -1. Default -1 = none included"},
|
||||
|
||||
OPT_SECTION("Message transfer"),
|
||||
{"server", OPT_SERVER, 's',
|
||||
"[http[s]://]address[:port] of CMP server. Default port 80 or 443."},
|
||||
{OPT_MORE_STR, 0, 0,
|
||||
"The address may be a DNS name or an IP address"},
|
||||
{"proxy", OPT_PROXY, 's',
|
||||
"[http[s]://]address[:port][/path] of HTTP(S) proxy to use; path is ignored"},
|
||||
{"no_proxy", OPT_NO_PROXY, 's',
|
||||
"List of addresses of servers not to use HTTP(S) proxy for"},
|
||||
{OPT_MORE_STR, 0, 0,
|
||||
"Default from environment variable 'no_proxy', else 'NO_PROXY', else none"},
|
||||
{"path", OPT_PATH, 's',
|
||||
"HTTP path (aka CMP alias) at the CMP server. Default \"/\""},
|
||||
{"msg_timeout", OPT_MSG_TIMEOUT, 'n',
|
||||
"Timeout per CMP message round trip (or 0 for none). Default 120 seconds"},
|
||||
{"total_timeout", OPT_TOTAL_TIMEOUT, 'n',
|
||||
"Overall time an enrollment incl. polling may take. Default 0 = infinite"},
|
||||
|
||||
OPT_SECTION("Server authentication"),
|
||||
{"trusted", OPT_TRUSTED, 's',
|
||||
"Certificates to trust as chain roots when verifying signed CMP responses"},
|
||||
{OPT_MORE_STR, 0, 0, "unless -srvcert is given"},
|
||||
{"untrusted", OPT_UNTRUSTED, 's',
|
||||
"Intermediate CA certs for chain construction for CMP/TLS/enrolled certs"},
|
||||
{"srvcert", OPT_SRVCERT, 's',
|
||||
"Server cert to pin and trust directly when verifying signed CMP responses"},
|
||||
{"recipient", OPT_RECIPIENT, 's',
|
||||
"Distinguished Name (DN) to use as msg recipient; see man page for defaults"},
|
||||
{"expect_sender", OPT_EXPECT_SENDER, 's',
|
||||
"DN of expected sender of responses. Defaults to subject of -srvcert, if any"},
|
||||
{"ignore_keyusage", OPT_IGNORE_KEYUSAGE, '-',
|
||||
"Ignore CMP signer cert key usage, else 'digitalSignature' must be allowed"},
|
||||
{"unprotected_errors", OPT_UNPROTECTED_ERRORS, '-',
|
||||
"Accept missing or invalid protection of regular error messages and negative"},
|
||||
{OPT_MORE_STR, 0, 0,
|
||||
"certificate responses (ip/cp/kup), revocation responses (rp), and PKIConf"},
|
||||
{OPT_MORE_STR, 0, 0,
|
||||
"WARNING: This setting leads to behavior allowing violation of RFC 4210"},
|
||||
{"extracertsout", OPT_EXTRACERTSOUT, 's',
|
||||
"File to save extra certificates received in the extraCerts field"},
|
||||
{"cacertsout", OPT_CACERTSOUT, 's',
|
||||
"File to save CA certificates received in the caPubs field of 'ip' messages"},
|
||||
|
||||
OPT_SECTION("Client authentication"),
|
||||
{"ref", OPT_REF, 's',
|
||||
"Reference value to use as senderKID in case no -cert is given"},
|
||||
{"secret", OPT_SECRET, 's',
|
||||
"Password source for client authentication with a pre-shared key (secret)"},
|
||||
{"cert", OPT_CERT, 's',
|
||||
"Client's current certificate (needed unless using -secret for PBM);"},
|
||||
{OPT_MORE_STR, 0, 0,
|
||||
"any further certs included are appended in extraCerts field"},
|
||||
{"key", OPT_KEY, 's', "Private key for the client's current certificate"},
|
||||
{"keypass", OPT_KEYPASS, 's',
|
||||
"Client private key (and cert and old cert file) pass phrase source"},
|
||||
{"digest", OPT_DIGEST, 's',
|
||||
"Digest to use in message protection and POPO signatures. Default \"sha256\""},
|
||||
{"mac", OPT_MAC, 's',
|
||||
"MAC algorithm to use in PBM-based message protection. Default \"hmac-sha1\""},
|
||||
{"extracerts", OPT_EXTRACERTS, 's',
|
||||
"Certificates to append in extraCerts field of outgoing messages"},
|
||||
{"unprotected_requests", OPT_UNPROTECTED_REQUESTS, '-',
|
||||
"Send messages without CMP-level protection"},
|
||||
|
||||
OPT_SECTION("Credentials format"),
|
||||
{"certform", OPT_CERTFORM, 's',
|
||||
"Format (PEM or DER) to use when saving a certificate to a file. Default PEM"},
|
||||
{OPT_MORE_STR, 0, 0,
|
||||
"This also determines format to use for writing (not supported for P12)"},
|
||||
{"keyform", OPT_KEYFORM, 's',
|
||||
"Format to assume when reading key files. Default PEM"},
|
||||
{"certsform", OPT_CERTSFORM, 's',
|
||||
"Format (PEM/DER/P12) to try first reading multiple certs. Default PEM"},
|
||||
{"otherpass", OPT_OTHERPASS, 's',
|
||||
"Pass phrase source potentially needed for loading certificates of others"},
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
{"engine", OPT_ENGINE, 's',
|
||||
"Use crypto engine with given identifier, possibly a hardware device."},
|
||||
{OPT_MORE_STR, 0, 0,
|
||||
"Engines may be defined in OpenSSL config file engine section."},
|
||||
{OPT_MORE_STR, 0, 0,
|
||||
"Options like -key specifying keys held in the engine can give key IDs"},
|
||||
{OPT_MORE_STR, 0, 0,
|
||||
"prefixed by 'engine:', e.g. '-key engine:pkcs11:object=mykey;pin-value=1234'"},
|
||||
#endif
|
||||
OPT_PROV_OPTIONS,
|
||||
|
||||
OPT_SECTION("TLS connection"),
|
||||
{"tls_used", OPT_TLS_USED, '-',
|
||||
"Enable using TLS (also when other TLS options are not set)"},
|
||||
{"tls_cert", OPT_TLS_CERT, 's',
|
||||
"Client's TLS certificate. May include chain to be provided to TLS server"},
|
||||
{"tls_key", OPT_TLS_KEY, 's',
|
||||
"Private key for the client's TLS certificate"},
|
||||
{"tls_keypass", OPT_TLS_KEYPASS, 's',
|
||||
"Pass phrase source for the client's private TLS key (and TLS cert file)"},
|
||||
{"tls_extra", OPT_TLS_EXTRA, 's',
|
||||
"Extra certificates to provide to TLS server during TLS handshake"},
|
||||
{"tls_trusted", OPT_TLS_TRUSTED, 's',
|
||||
"Trusted certificates to use for verifying the TLS server certificate;"},
|
||||
{OPT_MORE_STR, 0, 0, "this implies host name validation"},
|
||||
{"tls_host", OPT_TLS_HOST, 's',
|
||||
"Address to be checked (rather than -server) during TLS host name validation"},
|
||||
|
||||
OPT_SECTION("Client-side debugging"),
|
||||
{"batch", OPT_BATCH, '-',
|
||||
"Do not interactively prompt for input when a password is required etc."},
|
||||
{"repeat", OPT_REPEAT, 'n',
|
||||
"Invoke the transaction the given number of times. Default 1"},
|
||||
{"reqin", OPT_REQIN, 's', "Take sequence of CMP requests from file(s)"},
|
||||
{"reqin_new_tid", OPT_REQIN_NEW_TID, '-',
|
||||
"Use fresh transactionID for CMP requests read from -reqin"},
|
||||
{"reqout", OPT_REQOUT, 's', "Save sequence of CMP requests to file(s)"},
|
||||
{"rspin", OPT_RSPIN, 's',
|
||||
"Process sequence of CMP responses provided in file(s), skipping server"},
|
||||
{"rspout", OPT_RSPOUT, 's', "Save sequence of CMP responses to file(s)"},
|
||||
|
||||
{"use_mock_srv", OPT_USE_MOCK_SRV, '-', "Use mock server at API level, bypassing HTTP"},
|
||||
|
||||
OPT_SECTION("Mock server"),
|
||||
{"port", OPT_PORT, 's', "Act as HTTP mock server listening on given port"},
|
||||
{"max_msgs", OPT_MAX_MSGS, 'n',
|
||||
"max number of messages handled by HTTP mock server. Default: 0 = unlimited"},
|
||||
|
||||
{"srv_ref", OPT_SRV_REF, 's',
|
||||
"Reference value to use as senderKID of server in case no -srv_cert is given"},
|
||||
{"srv_secret", OPT_SRV_SECRET, 's',
|
||||
"Password source for server authentication with a pre-shared key (secret)"},
|
||||
{"srv_cert", OPT_SRV_CERT, 's', "Certificate of the server"},
|
||||
{"srv_key", OPT_SRV_KEY, 's',
|
||||
"Private key used by the server for signing messages"},
|
||||
{"srv_keypass", OPT_SRV_KEYPASS, 's',
|
||||
"Server private key (and cert) file pass phrase source"},
|
||||
|
||||
{"srv_trusted", OPT_SRV_TRUSTED, 's',
|
||||
"Trusted certificates for client authentication"},
|
||||
{"srv_untrusted", OPT_SRV_UNTRUSTED, 's',
|
||||
"Intermediate certs that may be useful for verifying CMP protection"},
|
||||
{"rsp_cert", OPT_RSP_CERT, 's',
|
||||
"Certificate to be returned as mock enrollment result"},
|
||||
{"rsp_extracerts", OPT_RSP_EXTRACERTS, 's',
|
||||
"Extra certificates to be included in mock certification responses"},
|
||||
{"rsp_capubs", OPT_RSP_CAPUBS, 's',
|
||||
"CA certificates to be included in mock ip response"},
|
||||
{"poll_count", OPT_POLL_COUNT, 'n',
|
||||
"Number of times the client must poll before receiving a certificate"},
|
||||
{"check_after", OPT_CHECK_AFTER, 'n',
|
||||
"The check_after value (time to wait) to include in poll response"},
|
||||
{"grant_implicitconf", OPT_GRANT_IMPLICITCONF, '-',
|
||||
"Grant implicit confirmation of newly enrolled certificate"},
|
||||
|
||||
{"pkistatus", OPT_PKISTATUS, 'n',
|
||||
"PKIStatus to be included in server response. Possible values: 0..6"},
|
||||
{"failure", OPT_FAILURE, 'n',
|
||||
"A single failure info bit number to include in server response, 0..26"},
|
||||
{"failurebits", OPT_FAILUREBITS, 'n',
|
||||
"Number representing failure bits to include in server response, 0..2^27 - 1"},
|
||||
{"statusstring", OPT_STATUSSTRING, 's',
|
||||
"Status string to be included in server response"},
|
||||
{"send_error", OPT_SEND_ERROR, '-',
|
||||
"Force server to reply with error message"},
|
||||
{"send_unprotected", OPT_SEND_UNPROTECTED, '-',
|
||||
"Send response messages without CMP-level protection"},
|
||||
{"send_unprot_err", OPT_SEND_UNPROT_ERR, '-',
|
||||
"In case of negative responses, server shall send unprotected error messages,"},
|
||||
{OPT_MORE_STR, 0, 0,
|
||||
"certificate responses (ip/cp/kup), and revocation responses (rp)."},
|
||||
{OPT_MORE_STR, 0, 0,
|
||||
"WARNING: This setting leads to behavior violating RFC 4210"},
|
||||
{"accept_unprotected", OPT_ACCEPT_UNPROTECTED, '-',
|
||||
"Accept missing or invalid protection of requests"},
|
||||
{"accept_unprot_err", OPT_ACCEPT_UNPROT_ERR, '-',
|
||||
"Accept unprotected error messages from client"},
|
||||
{"accept_raverified", OPT_ACCEPT_RAVERIFIED, '-',
|
||||
"Accept RAVERIFIED as proof-of-possession (POPO)"},
|
||||
|
||||
OPT_V_OPTIONS,
|
||||
{NULL}
|
||||
};
|
||||
|
||||
typedef union {
|
||||
char **txt;
|
||||
int *num;
|
||||
long *num_long;
|
||||
} varref;
|
||||
static varref cmp_vars[] = { /* must be in same order as enumerated above! */
|
||||
{&opt_config}, {&opt_section},
|
||||
|
||||
{&opt_cmd_s}, {&opt_infotype_s}, {&opt_geninfo},
|
||||
|
||||
{&opt_newkey}, {&opt_newkeypass}, {&opt_subject}, {&opt_issuer},
|
||||
{(char **)&opt_days}, {&opt_reqexts},
|
||||
{&opt_sans}, {(char **)&opt_san_nodefault},
|
||||
{&opt_policies}, {&opt_policy_oids}, {(char **)&opt_policy_oids_critical},
|
||||
{(char **)&opt_popo}, {&opt_csr},
|
||||
{&opt_out_trusted},
|
||||
{(char **)&opt_implicit_confirm}, {(char **)&opt_disable_confirm},
|
||||
{&opt_certout},
|
||||
|
||||
{&opt_oldcert}, {(char **)&opt_revreason},
|
||||
|
||||
{&opt_server}, {&opt_proxy}, {&opt_no_proxy}, {&opt_path},
|
||||
{(char **)&opt_msg_timeout}, {(char **)&opt_total_timeout},
|
||||
|
||||
{&opt_trusted}, {&opt_untrusted}, {&opt_srvcert},
|
||||
{&opt_recipient}, {&opt_expect_sender},
|
||||
{(char **)&opt_ignore_keyusage}, {(char **)&opt_unprotected_errors},
|
||||
{&opt_extracertsout}, {&opt_cacertsout},
|
||||
|
||||
{&opt_ref}, {&opt_secret}, {&opt_cert}, {&opt_key}, {&opt_keypass},
|
||||
{&opt_digest}, {&opt_mac}, {&opt_extracerts},
|
||||
{(char **)&opt_unprotected_requests},
|
||||
|
||||
{&opt_certform_s}, {&opt_keyform_s}, {&opt_certsform_s},
|
||||
{&opt_otherpass},
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
{&opt_engine},
|
||||
#endif
|
||||
|
||||
{(char **)&opt_tls_used}, {&opt_tls_cert}, {&opt_tls_key},
|
||||
{&opt_tls_keypass},
|
||||
{&opt_tls_extra}, {&opt_tls_trusted}, {&opt_tls_host},
|
||||
|
||||
{(char **)&opt_batch}, {(char **)&opt_repeat},
|
||||
{&opt_reqin}, {(char **)&opt_reqin_new_tid},
|
||||
{&opt_reqout}, {&opt_rspin}, {&opt_rspout},
|
||||
|
||||
{(char **)&opt_use_mock_srv}, {&opt_port}, {(char **)&opt_max_msgs},
|
||||
{&opt_srv_ref}, {&opt_srv_secret},
|
||||
{&opt_srv_cert}, {&opt_srv_key}, {&opt_srv_keypass},
|
||||
{&opt_srv_trusted}, {&opt_srv_untrusted},
|
||||
{&opt_rsp_cert}, {&opt_rsp_extracerts}, {&opt_rsp_capubs},
|
||||
{(char **)&opt_poll_count}, {(char **)&opt_check_after},
|
||||
{(char **)&opt_grant_implicitconf},
|
||||
{(char **)&opt_pkistatus}, {(char **)&opt_failure},
|
||||
{(char **)&opt_failurebits}, {&opt_statusstring},
|
||||
{(char **)&opt_send_error}, {(char **)&opt_send_unprotected},
|
||||
{(char **)&opt_send_unprot_err}, {(char **)&opt_accept_unprotected},
|
||||
{(char **)&opt_accept_unprot_err}, {(char **)&opt_accept_raverified},
|
||||
|
||||
{NULL}
|
||||
};
|
||||
|
||||
#ifndef NDEBUG
|
||||
# define FUNC (strcmp(OPENSSL_FUNC, "(unknown function)") == 0 \
|
||||
? "CMP" : "OPENSSL_FUNC")
|
||||
# define PRINT_LOCATION(bio) BIO_printf(bio, "%s:%s:%d:", \
|
||||
FUNC, OPENSSL_FILE, OPENSSL_LINE)
|
||||
#else
|
||||
# define PRINT_LOCATION(bio) ((void)0)
|
||||
#endif
|
||||
#define CMP_print(bio, prefix, msg, a1, a2, a3) \
|
||||
(PRINT_LOCATION(bio), \
|
||||
BIO_printf(bio, "CMP %s: " msg "\n", prefix, a1, a2, a3))
|
||||
#define CMP_INFO(msg, a1, a2, a3) CMP_print(bio_out, "info", msg, a1, a2, a3)
|
||||
#define CMP_info(msg) CMP_INFO(msg"%s%s%s", "", "", "")
|
||||
#define CMP_info1(msg, a1) CMP_INFO(msg"%s%s", a1, "", "")
|
||||
#define CMP_info2(msg, a1, a2) CMP_INFO(msg"%s", a1, a2, "")
|
||||
#define CMP_info3(msg, a1, a2, a3) CMP_INFO(msg, a1, a2, a3)
|
||||
#define CMP_WARN(m, a1, a2, a3) CMP_print(bio_out, "warning", m, a1, a2, a3)
|
||||
#define CMP_warn(msg) CMP_WARN(msg"%s%s%s", "", "", "")
|
||||
#define CMP_warn1(msg, a1) CMP_WARN(msg"%s%s", a1, "", "")
|
||||
#define CMP_warn2(msg, a1, a2) CMP_WARN(msg"%s", a1, a2, "")
|
||||
#define CMP_warn3(msg, a1, a2, a3) CMP_WARN(msg, a1, a2, a3)
|
||||
#define CMP_ERR(msg, a1, a2, a3) CMP_print(bio_err, "error", msg, a1, a2, a3)
|
||||
#define CMP_err(msg) CMP_ERR(msg"%s%s%s", "", "", "")
|
||||
#define CMP_err1(msg, a1) CMP_ERR(msg"%s%s", a1, "", "")
|
||||
#define CMP_err2(msg, a1, a2) CMP_ERR(msg"%s", a1, a2, "")
|
||||
#define CMP_err3(msg, a1, a2, a3) CMP_ERR(msg, a1, a2, a3)
|
||||
|
||||
static int print_to_bio_out(const char *func, const char *file, int line,
|
||||
OSSL_CMP_severity level, const char *msg)
|
||||
{
|
||||
return OSSL_CMP_print_to_bio(bio_out, func, file, line, level, msg);
|
||||
}
|
||||
|
||||
/* code duplicated from crypto/cmp/cmp_util.c */
|
||||
static int sk_X509_add1_cert(STACK_OF(X509) *sk, X509 *cert,
|
||||
int no_dup, int prepend)
|
||||
{
|
||||
if (no_dup) {
|
||||
/*
|
||||
* not using sk_X509_set_cmp_func() and sk_X509_find()
|
||||
* because this re-orders the certs on the stack
|
||||
*/
|
||||
int i;
|
||||
|
||||
for (i = 0; i < sk_X509_num(sk); i++) {
|
||||
if (X509_cmp(sk_X509_value(sk, i), cert) == 0)
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
if (!X509_up_ref(cert))
|
||||
return 0;
|
||||
if (!sk_X509_insert(sk, cert, prepend ? 0 : -1)) {
|
||||
X509_free(cert);
|
||||
return 0;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* code duplicated from crypto/cmp/cmp_util.c */
|
||||
static int sk_X509_add1_certs(STACK_OF(X509) *sk, STACK_OF(X509) *certs,
|
||||
int no_self_signed, int no_dups, int prepend)
|
||||
/* compiler would allow 'const' for the list of certs, yet they are up-ref'ed */
|
||||
{
|
||||
int i;
|
||||
|
||||
if (sk == NULL)
|
||||
return 0;
|
||||
if (certs == NULL)
|
||||
return 1;
|
||||
for (i = 0; i < sk_X509_num(certs); i++) {
|
||||
X509 *cert = sk_X509_value(certs, i);
|
||||
|
||||
if (!no_self_signed || X509_check_issued(cert, cert) != X509_V_OK) {
|
||||
if (!sk_X509_add1_cert(sk, cert, no_dups, prepend))
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* TODO potentially move to apps/lib/apps.c */
|
||||
static char *next_item(char *opt) /* in list separated by comma and/or space */
|
||||
{
|
||||
/* advance to separator (comma or whitespace), if any */
|
||||
while (*opt != ',' && !isspace(*opt) && *opt != '\0') {
|
||||
if (*opt == '\\' && opt[1] != '\0')
|
||||
/* skip and unescape '\' escaped char */
|
||||
memmove(opt, opt + 1, strlen(opt));
|
||||
opt++;
|
||||
}
|
||||
if (*opt != '\0') {
|
||||
/* terminate current item */
|
||||
*opt++ = '\0';
|
||||
/* skip over any whitespace after separator */
|
||||
while (isspace(*opt))
|
||||
opt++;
|
||||
}
|
||||
return *opt == '\0' ? NULL : opt; /* NULL indicates end of input */
|
||||
}
|
||||
|
||||
static EVP_PKEY *load_key_pwd(const char *uri, int format,
|
||||
const char *pass, ENGINE *e, const char *desc)
|
||||
{
|
||||
char *pass_string = get_passwd(pass, desc);
|
||||
EVP_PKEY *pkey = load_key(uri, format, 0, pass_string, e, desc);
|
||||
|
||||
clear_free(pass_string);
|
||||
return pkey;
|
||||
}
|
||||
|
||||
static X509 *load_cert_pwd(const char *uri, const char *pass, const char *desc)
|
||||
{
|
||||
X509 *cert;
|
||||
char *pass_string = get_passwd(pass, desc);
|
||||
|
||||
cert = load_cert_pass(uri, 0, pass_string, desc);
|
||||
clear_free(pass_string);
|
||||
return cert;
|
||||
}
|
||||
|
||||
/* TODO remove when PR #4930 is merged */
|
||||
static int load_pkcs12(BIO *in, const char *desc,
|
||||
pem_password_cb *pem_cb, void *cb_data,
|
||||
EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca)
|
||||
{
|
||||
const char *pass;
|
||||
char tpass[PEM_BUFSIZE];
|
||||
int len;
|
||||
int ret = 0;
|
||||
PKCS12 *p12 = d2i_PKCS12_bio(in, NULL);
|
||||
|
||||
if (desc == NULL)
|
||||
desc = "PKCS12 input";
|
||||
if (p12 == NULL) {
|
||||
BIO_printf(bio_err, "error loading PKCS12 file for %s\n", desc);
|
||||
goto die;
|
||||
}
|
||||
|
||||
/* See if an empty password will do */
|
||||
if (PKCS12_verify_mac(p12, "", 0) || PKCS12_verify_mac(p12, NULL, 0)) {
|
||||
pass = "";
|
||||
} else {
|
||||
if (pem_cb == NULL)
|
||||
pem_cb = wrap_password_callback;
|
||||
len = pem_cb(tpass, PEM_BUFSIZE, 0, cb_data);
|
||||
if (len < 0) {
|
||||
BIO_printf(bio_err, "passphrase callback error for %s\n", desc);
|
||||
goto die;
|
||||
}
|
||||
if (len < PEM_BUFSIZE)
|
||||
tpass[len] = 0;
|
||||
if (!PKCS12_verify_mac(p12, tpass, len)) {
|
||||
BIO_printf(bio_err,
|
||||
"mac verify error (wrong password?) in PKCS12 file for %s\n",
|
||||
desc);
|
||||
goto die;
|
||||
}
|
||||
pass = tpass;
|
||||
}
|
||||
ret = PKCS12_parse(p12, pass, pkey, cert, ca);
|
||||
die:
|
||||
PKCS12_free(p12);
|
||||
return ret;
|
||||
}
|
||||
|
||||
/* TODO potentially move this and related functions to apps/lib/apps.c */
|
||||
static int adjust_format(const char **infile, int format, int engine_ok)
|
||||
{
|
||||
if (!strncasecmp(*infile, "http://", 7)
|
||||
|| !strncasecmp(*infile, "https://", 8)) {
|
||||
format = FORMAT_HTTP;
|
||||
} else if (engine_ok && strncasecmp(*infile, "engine:", 7) == 0) {
|
||||
*infile += 7;
|
||||
format = FORMAT_ENGINE;
|
||||
} else {
|
||||
if (strncasecmp(*infile, "file:", 5) == 0)
|
||||
*infile += 5;
|
||||
/*
|
||||
* the following is a heuristic whether first to try PEM or DER
|
||||
* or PKCS12 as the input format for files
|
||||
*/
|
||||
if (strlen(*infile) >= 4) {
|
||||
const char *extension = *infile + strlen(*infile) - 4;
|
||||
|
||||
if (strncasecmp(extension, ".crt", 4) == 0
|
||||
|| strncasecmp(extension, ".pem", 4) == 0)
|
||||
/* weak recognition of PEM format */
|
||||
format = FORMAT_PEM;
|
||||
else if (strncasecmp(extension, ".cer", 4) == 0
|
||||
|| strncasecmp(extension, ".der", 4) == 0)
|
||||
/* weak recognition of DER format */
|
||||
format = FORMAT_ASN1;
|
||||
else if (strncasecmp(extension, ".p12", 4) == 0)
|
||||
/* weak recognition of PKCS#12 format */
|
||||
format = FORMAT_PKCS12;
|
||||
/* else retain given format */
|
||||
}
|
||||
}
|
||||
return format;
|
||||
}
|
||||
|
||||
/*
|
||||
* TODO potentially move this and related functions to apps/lib/
|
||||
* or even better extend OSSL_STORE with type OSSL_STORE_INFO_CRL
|
||||
*/
|
||||
static X509_REQ *load_csr_autofmt(const char *infile, const char *desc)
|
||||
{
|
||||
X509_REQ *csr;
|
||||
BIO *bio_bak = bio_err;
|
||||
int can_retry;
|
||||
int format = adjust_format(&infile, FORMAT_PEM, 0);
|
||||
|
||||
can_retry = format == FORMAT_PEM || format == FORMAT_ASN1;
|
||||
if (can_retry)
|
||||
bio_err = NULL; /* do not show errors on more than one try */
|
||||
csr = load_csr(infile, format, desc);
|
||||
bio_err = bio_bak;
|
||||
if (csr == NULL && can_retry) {
|
||||
ERR_clear_error();
|
||||
format = (format == FORMAT_PEM ? FORMAT_ASN1 : FORMAT_PEM);
|
||||
csr = load_csr(infile, format, desc);
|
||||
}
|
||||
if (csr == NULL) {
|
||||
ERR_print_errors(bio_err);
|
||||
BIO_printf(bio_err, "error: unable to load %s from file '%s'\n", desc,
|
||||
infile);
|
||||
}
|
||||
return csr;
|
||||
}
|
||||
|
||||
/* TODO replace by calling generalized load_certs() when PR #4930 is merged */
|
||||
static int load_certs_preliminary(const char *file, STACK_OF(X509) **certs,
|
||||
int format, const char *pass,
|
||||
const char *desc)
|
||||
{
|
||||
X509 *cert = NULL;
|
||||
int ret = 0;
|
||||
|
||||
if (format == FORMAT_PKCS12) {
|
||||
BIO *bio = bio_open_default(file, 'r', format);
|
||||
|
||||
if (bio != NULL) {
|
||||
EVP_PKEY *pkey = NULL; /* pkey is needed until PR #4930 is merged */
|
||||
PW_CB_DATA cb_data;
|
||||
|
||||
cb_data.password = pass;
|
||||
cb_data.prompt_info = file;
|
||||
ret = load_pkcs12(bio, desc, wrap_password_callback,
|
||||
&cb_data, &pkey, &cert, certs);
|
||||
EVP_PKEY_free(pkey);
|
||||
BIO_free(bio);
|
||||
}
|
||||
} else if (format == FORMAT_ASN1) { /* load only one cert in this case */
|
||||
CMP_warn1("can load only one certificate in DER format from %s", file);
|
||||
cert = load_cert_pass(file, 0, pass, desc);
|
||||
}
|
||||
if (format == FORMAT_PKCS12 || format == FORMAT_ASN1) {
|
||||
if (cert) {
|
||||
if (*certs == NULL)
|
||||
*certs = sk_X509_new_null();
|
||||
if (*certs != NULL)
|
||||
ret = sk_X509_insert(*certs, cert, 0);
|
||||
else
|
||||
X509_free(cert);
|
||||
}
|
||||
} else {
|
||||
ret = load_certs(file, certs, format, pass, desc);
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
|
||||
static void warn_certs_expired(const char *file, STACK_OF(X509) **certs)
|
||||
{
|
||||
int i, res;
|
||||
X509 *cert;
|
||||
char *subj;
|
||||
|
||||
for (i = 0; i < sk_X509_num(*certs); i++) {
|
||||
cert = sk_X509_value(*certs, i);
|
||||
res = X509_cmp_timeframe(vpm, X509_get0_notBefore(cert),
|
||||
X509_get0_notAfter(cert));
|
||||
if (res != 0) {
|
||||
subj = X509_NAME_oneline(X509_get_subject_name(cert), NULL, 0);
|
||||
CMP_warn3("certificate from '%s' with subject '%s' %s", file, subj,
|
||||
res > 0 ? "has expired" : "not yet valid");
|
||||
OPENSSL_free(subj);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* TODO potentially move this and related functions to apps/lib/
|
||||
* or even better extend OSSL_STORE with type OSSL_STORE_INFO_CERTS
|
||||
*/
|
||||
static int load_certs_autofmt(const char *infile, STACK_OF(X509) **certs,
|
||||
int exclude_http, const char *pass,
|
||||
const char *desc)
|
||||
{
|
||||
int ret = 0;
|
||||
char *pass_string;
|
||||
BIO *bio_bak = bio_err;
|
||||
int format = adjust_format(&infile, opt_certsform, 0);
|
||||
|
||||
if (exclude_http && format == FORMAT_HTTP) {
|
||||
BIO_printf(bio_err, "error: HTTP retrieval not allowed for %s\n", desc);
|
||||
return ret;
|
||||
}
|
||||
pass_string = get_passwd(pass, desc);
|
||||
if (format != FORMAT_HTTP)
|
||||
bio_err = NULL; /* do not show errors on more than one try */
|
||||
ret = load_certs_preliminary(infile, certs, format, pass_string, desc);
|
||||
bio_err = bio_bak;
|
||||
if (!ret && format != FORMAT_HTTP) {
|
||||
int format2 = format == FORMAT_PEM ? FORMAT_ASN1 : FORMAT_PEM;
|
||||
|
||||
ERR_clear_error();
|
||||
ret = load_certs_preliminary(infile, certs, format2, pass_string, desc);
|
||||
}
|
||||
clear_free(pass_string);
|
||||
|
||||
if (ret)
|
||||
warn_certs_expired(infile, certs);
|
||||
return ret;
|
||||
}
|
||||
|
||||
/* set expected host name/IP addr and clears the email addr in the given ts */
|
||||
static int truststore_set_host_etc(X509_STORE *ts, char *host)
|
||||
{
|
||||
X509_VERIFY_PARAM *ts_vpm = X509_STORE_get0_param(ts);
|
||||
|
||||
/* first clear any host names, IP, and email addresses */
|
||||
if (!X509_VERIFY_PARAM_set1_host(ts_vpm, NULL, 0)
|
||||
|| !X509_VERIFY_PARAM_set1_ip(ts_vpm, NULL, 0)
|
||||
|| !X509_VERIFY_PARAM_set1_email(ts_vpm, NULL, 0))
|
||||
return 0;
|
||||
X509_VERIFY_PARAM_set_hostflags(ts_vpm,
|
||||
X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT |
|
||||
X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
|
||||
return (host != NULL && X509_VERIFY_PARAM_set1_ip_asc(ts_vpm, host))
|
||||
|| X509_VERIFY_PARAM_set1_host(ts_vpm, host, 0);
|
||||
}
|
||||
|
||||
static X509_STORE *sk_X509_to_store(X509_STORE *store /* may be NULL */,
|
||||
const STACK_OF(X509) *certs /* may NULL */)
|
||||
{
|
||||
int i;
|
||||
|
||||
if (store == NULL)
|
||||
store = X509_STORE_new();
|
||||
if (store == NULL)
|
||||
return NULL;
|
||||
for (i = 0; i < sk_X509_num(certs); i++) {
|
||||
if (!X509_STORE_add_cert(store, sk_X509_value(certs, i))) {
|
||||
X509_STORE_free(store);
|
||||
return NULL;
|
||||
}
|
||||
}
|
||||
return store;
|
||||
}
|
||||
|
||||
/* write OSSL_CMP_MSG DER-encoded to the specified file name item */
|
||||
static int write_PKIMESSAGE(const OSSL_CMP_MSG *msg, char **filenames)
|
||||
{
|
||||
char *file;
|
||||
BIO *bio;
|
||||
|
||||
if (msg == NULL || filenames == NULL) {
|
||||
CMP_err("NULL arg to write_PKIMESSAGE");
|
||||
return 0;
|
||||
}
|
||||
if (*filenames == NULL) {
|
||||
CMP_err("Not enough file names provided for writing PKIMessage");
|
||||
return 0;
|
||||
}
|
||||
|
||||
file = *filenames;
|
||||
*filenames = next_item(file);
|
||||
bio = BIO_new_file(file, "wb");
|
||||
if (bio == NULL) {
|
||||
CMP_err1("Cannot open file '%s' for writing", file);
|
||||
return 0;
|
||||
}
|
||||
if (i2d_OSSL_CMP_MSG_bio(bio, msg) < 0) {
|
||||
CMP_err1("Cannot write PKIMessage to file '%s'", file);
|
||||
BIO_free(bio);
|
||||
return 0;
|
||||
}
|
||||
BIO_free(bio);
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* read DER-encoded OSSL_CMP_MSG from the specified file name item */
|
||||
static OSSL_CMP_MSG *read_PKIMESSAGE(char **filenames)
|
||||
{
|
||||
char *file;
|
||||
BIO *bio;
|
||||
OSSL_CMP_MSG *ret;
|
||||
|
||||
if (filenames == NULL) {
|
||||
CMP_err("NULL arg to read_PKIMESSAGE");
|
||||
return NULL;
|
||||
}
|
||||
if (*filenames == NULL) {
|
||||
CMP_err("Not enough file names provided for reading PKIMessage");
|
||||
return NULL;
|
||||
}
|
||||
|
||||
file = *filenames;
|
||||
*filenames = next_item(file);
|
||||
bio = BIO_new_file(file, "rb");
|
||||
if (bio == NULL) {
|
||||
CMP_err1("Cannot open file '%s' for reading", file);
|
||||
return NULL;
|
||||
}
|
||||
ret = d2i_OSSL_CMP_MSG_bio(bio, NULL);
|
||||
if (ret == NULL)
|
||||
CMP_err1("Cannot read PKIMessage from file '%s'", file);
|
||||
BIO_free(bio);
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*-
|
||||
* Sends the PKIMessage req and on success place the response in *res
|
||||
* basically like OSSL_CMP_MSG_http_perform(), but in addition allows
|
||||
* to dump the sequence of requests and responses to files and/or
|
||||
* to take the sequence of requests and responses from files.
|
||||
*/
|
||||
static OSSL_CMP_MSG *read_write_req_resp(OSSL_CMP_CTX *ctx,
|
||||
const OSSL_CMP_MSG *req)
|
||||
{
|
||||
OSSL_CMP_MSG *req_new = NULL;
|
||||
OSSL_CMP_MSG *res = NULL;
|
||||
OSSL_CMP_PKIHEADER *hdr;
|
||||
|
||||
if (req != NULL && opt_reqout != NULL
|
||||
&& !write_PKIMESSAGE(req, &opt_reqout))
|
||||
goto err;
|
||||
if (opt_reqin != NULL && opt_rspin == NULL) {
|
||||
if ((req_new = read_PKIMESSAGE(&opt_reqin)) == NULL)
|
||||
goto err;
|
||||
/*-
|
||||
* The transaction ID in req_new read from opt_reqin may not be fresh.
|
||||
* In this case the server may complain "Transaction id already in use."
|
||||
* The following workaround unfortunately requires re-protection.
|
||||
*/
|
||||
if (opt_reqin_new_tid
|
||||
&& !OSSL_CMP_MSG_update_transactionID(ctx, req_new))
|
||||
goto err;
|
||||
}
|
||||
|
||||
if (opt_rspin != NULL) {
|
||||
res = read_PKIMESSAGE(&opt_rspin);
|
||||
} else {
|
||||
const OSSL_CMP_MSG *actual_req = opt_reqin != NULL ? req_new : req;
|
||||
|
||||
res = opt_use_mock_srv
|
||||
? OSSL_CMP_CTX_server_perform(ctx, actual_req)
|
||||
: OSSL_CMP_MSG_http_perform(ctx, actual_req);
|
||||
}
|
||||
if (res == NULL)
|
||||
goto err;
|
||||
|
||||
if (opt_reqin != NULL || opt_rspin != NULL) {
|
||||
/* need to satisfy nonce and transactionID checks */
|
||||
ASN1_OCTET_STRING *nonce;
|
||||
ASN1_OCTET_STRING *tid;
|
||||
|
||||
hdr = OSSL_CMP_MSG_get0_header(res);
|
||||
nonce = OSSL_CMP_HDR_get0_recipNonce(hdr);
|
||||
tid = OSSL_CMP_HDR_get0_transactionID(hdr);
|
||||
if (!OSSL_CMP_CTX_set1_senderNonce(ctx, nonce)
|
||||
|| !OSSL_CMP_CTX_set1_transactionID(ctx, tid)) {
|
||||
OSSL_CMP_MSG_free(res);
|
||||
res = NULL;
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
|
||||
if (opt_rspout != NULL && !write_PKIMESSAGE(res, &opt_rspout)) {
|
||||
OSSL_CMP_MSG_free(res);
|
||||
res = NULL;
|
||||
}
|
||||
|
||||
err:
|
||||
OSSL_CMP_MSG_free(req_new);
|
||||
return res;
|
||||
}
|
||||
|
||||
/*
|
||||
* parse string as integer value, not allowing trailing garbage, see also
|
||||
* https://www.gnu.org/software/libc/manual/html_node/Parsing-of-Integers.html
|
||||
*
|
||||
* returns integer value, or INT_MIN on error
|
||||
*/
|
||||
static int atoint(const char *str)
|
||||
{
|
||||
char *tailptr;
|
||||
long res = strtol(str, &tailptr, 10);
|
||||
|
||||
if ((*tailptr != '\0') || (res < INT_MIN) || (res > INT_MAX))
|
||||
return INT_MIN;
|
||||
else
|
||||
return (int)res;
|
||||
}
|
||||
|
||||
static int parse_addr(char **opt_string, int port, const char *name)
|
||||
{
|
||||
char *port_string;
|
||||
|
||||
if (strncasecmp(*opt_string, OSSL_HTTP_PREFIX,
|
||||
strlen(OSSL_HTTP_PREFIX)) == 0) {
|
||||
*opt_string += strlen(OSSL_HTTP_PREFIX);
|
||||
} else if (strncasecmp(*opt_string, OSSL_HTTPS_PREFIX,
|
||||
strlen(OSSL_HTTPS_PREFIX)) == 0) {
|
||||
*opt_string += strlen(OSSL_HTTPS_PREFIX);
|
||||
if (port == 0)
|
||||
port = 443; /* == integer value of OSSL_HTTPS_PORT */
|
||||
}
|
||||
|
||||
if ((port_string = strrchr(*opt_string, ':')) == NULL)
|
||||
return port; /* using default */
|
||||
*(port_string++) = '\0';
|
||||
port = atoint(port_string);
|
||||
if ((port <= 0) || (port > 65535)) {
|
||||
CMP_err2("invalid %s port '%s' given, sane range 1-65535",
|
||||
name, port_string);
|
||||
return -1;
|
||||
}
|
||||
return port;
|
||||
}
|
||||
|
||||
static int set1_store_parameters(X509_STORE *ts)
|
||||
{
|
||||
if (ts == NULL)
|
||||
return 0;
|
||||
|
||||
/* copy vpm to store */
|
||||
if (!X509_STORE_set1_param(ts, vpm /* may be NULL */)) {
|
||||
BIO_printf(bio_err, "error setting verification parameters\n");
|
||||
OSSL_CMP_CTX_print_errors(cmp_ctx);
|
||||
return 0;
|
||||
}
|
||||
|
||||
X509_STORE_set_verify_cb(ts, X509_STORE_CTX_print_verify_cb);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int set_name(const char *str,
|
||||
int (*set_fn) (OSSL_CMP_CTX *ctx, const X509_NAME *name),
|
||||
OSSL_CMP_CTX *ctx, const char *desc)
|
||||
{
|
||||
if (str != NULL) {
|
||||
X509_NAME *n = parse_name(str, MBSTRING_ASC, 0);
|
||||
|
||||
if (n == NULL) {
|
||||
CMP_err2("cannot parse %s DN '%s'", desc, str);
|
||||
return 0;
|
||||
}
|
||||
if (!(*set_fn) (ctx, n)) {
|
||||
X509_NAME_free(n);
|
||||
CMP_err("out of memory");
|
||||
return 0;
|
||||
}
|
||||
X509_NAME_free(n);
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int set_gennames(OSSL_CMP_CTX *ctx, char *names, const char *desc)
|
||||
{
|
||||
char *next;
|
||||
|
||||
for (; names != NULL; names = next) {
|
||||
GENERAL_NAME *n;
|
||||
|
||||
next = next_item(names);
|
||||
if (strcmp(names, "critical") == 0) {
|
||||
(void)OSSL_CMP_CTX_set_option(ctx,
|
||||
OSSL_CMP_OPT_SUBJECTALTNAME_CRITICAL,
|
||||
1);
|
||||
continue;
|
||||
}
|
||||
|
||||
/* try IP address first, then URI or domain name */
|
||||
(void)ERR_set_mark();
|
||||
n = a2i_GENERAL_NAME(NULL, NULL, NULL, GEN_IPADD, names, 0);
|
||||
if (n == NULL)
|
||||
n = a2i_GENERAL_NAME(NULL, NULL, NULL,
|
||||
strchr(names, ':') != NULL ? GEN_URI : GEN_DNS,
|
||||
names, 0);
|
||||
(void)ERR_pop_to_mark();
|
||||
|
||||
if (n == NULL) {
|
||||
CMP_err2("bad syntax of %s '%s'", desc, names);
|
||||
return 0;
|
||||
}
|
||||
if (!OSSL_CMP_CTX_push1_subjectAltName(ctx, n)) {
|
||||
GENERAL_NAME_free(n);
|
||||
CMP_err("out of memory");
|
||||
return 0;
|
||||
}
|
||||
GENERAL_NAME_free(n);
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* TODO potentially move to apps/lib/apps.c */
|
||||
/*
|
||||
* create cert store structure with certificates read from given file(s)
|
||||
* returns pointer to created X509_STORE on success, NULL on error
|
||||
*/
|
||||
static X509_STORE *load_certstore(char *input, const char *desc)
|
||||
{
|
||||
X509_STORE *store = NULL;
|
||||
STACK_OF(X509) *certs = NULL;
|
||||
|
||||
if (input == NULL)
|
||||
goto err;
|
||||
|
||||
while (input != NULL) {
|
||||
char *next = next_item(input); \
|
||||
|
||||
if (!load_certs_autofmt(input, &certs, 1, opt_otherpass, desc)
|
||||
|| !(store = sk_X509_to_store(store, certs))) {
|
||||
/* CMP_err("out of memory"); */
|
||||
X509_STORE_free(store);
|
||||
store = NULL;
|
||||
goto err;
|
||||
}
|
||||
sk_X509_pop_free(certs, X509_free);
|
||||
certs = NULL;
|
||||
input = next;
|
||||
}
|
||||
err:
|
||||
sk_X509_pop_free(certs, X509_free);
|
||||
return store;
|
||||
}
|
||||
|
||||
/* TODO potentially move to apps/lib/apps.c */
|
||||
static STACK_OF(X509) *load_certs_multifile(char *files,
|
||||
const char *pass, const char *desc)
|
||||
{
|
||||
STACK_OF(X509) *certs = NULL;
|
||||
STACK_OF(X509) *result = sk_X509_new_null();
|
||||
|
||||
if (files == NULL)
|
||||
goto err;
|
||||
if (result == NULL)
|
||||
goto oom;
|
||||
|
||||
while (files != NULL) {
|
||||
char *next = next_item(files);
|
||||
|
||||
if (!load_certs_autofmt(files, &certs, 0, pass, desc))
|
||||
goto err;
|
||||
if (!sk_X509_add1_certs(result, certs, 0, 1 /* no dups */, 0))
|
||||
goto oom;
|
||||
sk_X509_pop_free(certs, X509_free);
|
||||
certs = NULL;
|
||||
files = next;
|
||||
}
|
||||
return result;
|
||||
|
||||
oom:
|
||||
BIO_printf(bio_err, "out of memory\n");
|
||||
err:
|
||||
sk_X509_pop_free(certs, X509_free);
|
||||
sk_X509_pop_free(result, X509_free);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
typedef int (*add_X509_stack_fn_t)(void *ctx, const STACK_OF(X509) *certs);
|
||||
typedef int (*add_X509_fn_t)(void *ctx, const X509 *cert);
|
||||
|
||||
static int setup_certs(char *files, const char *desc, void *ctx,
|
||||
add_X509_stack_fn_t addn_fn, add_X509_fn_t add1_fn)
|
||||
{
|
||||
int ret = 1;
|
||||
|
||||
if (files != NULL) {
|
||||
STACK_OF(X509) *certs = load_certs_multifile(files, opt_otherpass,
|
||||
desc);
|
||||
if (certs == NULL) {
|
||||
ret = 0;
|
||||
} else {
|
||||
if (addn_fn != NULL) {
|
||||
ret = (*addn_fn)(ctx, certs);
|
||||
} else {
|
||||
int i;
|
||||
|
||||
for (i = 0; i < sk_X509_num(certs /* may be NULL */); i++)
|
||||
ret &= (*add1_fn)(ctx, sk_X509_value(certs, i));
|
||||
}
|
||||
sk_X509_pop_free(certs, X509_free);
|
||||
}
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
||||
/*
|
||||
* parse and transform some options, checking their syntax.
|
||||
* Returns 1 on success, 0 on error
|
||||
*/
|
||||
static int transform_opts(void)
|
||||
{
|
||||
if (opt_cmd_s != NULL) {
|
||||
if (!strcmp(opt_cmd_s, "ir")) {
|
||||
opt_cmd = CMP_IR;
|
||||
} else if (!strcmp(opt_cmd_s, "kur")) {
|
||||
opt_cmd = CMP_KUR;
|
||||
} else if (!strcmp(opt_cmd_s, "cr")) {
|
||||
opt_cmd = CMP_CR;
|
||||
} else if (!strcmp(opt_cmd_s, "p10cr")) {
|
||||
opt_cmd = CMP_P10CR;
|
||||
} else if (!strcmp(opt_cmd_s, "rr")) {
|
||||
opt_cmd = CMP_RR;
|
||||
} else if (!strcmp(opt_cmd_s, "genm")) {
|
||||
opt_cmd = CMP_GENM;
|
||||
} else {
|
||||
CMP_err1("unknown cmp command '%s'", opt_cmd_s);
|
||||
return 0;
|
||||
}
|
||||
} else {
|
||||
CMP_err("no cmp command to execute");
|
||||
return 0;
|
||||
}
|
||||
|
||||
#ifdef OPENSSL_NO_ENGINE
|
||||
# define FORMAT_OPTIONS (OPT_FMT_PEMDER | OPT_FMT_PKCS12 | OPT_FMT_ENGINE)
|
||||
#else
|
||||
# define FORMAT_OPTIONS (OPT_FMT_PEMDER | OPT_FMT_PKCS12)
|
||||
#endif
|
||||
|
||||
if (opt_keyform_s != NULL
|
||||
&& !opt_format(opt_keyform_s, FORMAT_OPTIONS, &opt_keyform)) {
|
||||
CMP_err("unknown option given for key loading format");
|
||||
return 0;
|
||||
}
|
||||
|
||||
#undef FORMAT_OPTIONS
|
||||
|
||||
if (opt_certform_s != NULL
|
||||
&& !opt_format(opt_certform_s, OPT_FMT_PEMDER, &opt_certform)) {
|
||||
CMP_err("unknown option given for certificate storing format");
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (opt_certsform_s != NULL
|
||||
&& !opt_format(opt_certsform_s, OPT_FMT_PEMDER | OPT_FMT_PKCS12,
|
||||
&opt_certsform)) {
|
||||
CMP_err("unknown option given for certificate list loading format");
|
||||
return 0;
|
||||
}
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static OSSL_CMP_SRV_CTX *setup_srv_ctx(ENGINE *e)
|
||||
{
|
||||
OSSL_CMP_CTX *ctx; /* extra CMP (client) ctx partly used by server */
|
||||
OSSL_CMP_SRV_CTX *srv_ctx = ossl_cmp_mock_srv_new();
|
||||
|
||||
if (srv_ctx == NULL)
|
||||
return NULL;
|
||||
ctx = OSSL_CMP_SRV_CTX_get0_cmp_ctx(srv_ctx);
|
||||
|
||||
if (opt_srv_ref == NULL) {
|
||||
if (opt_srv_cert == NULL) {
|
||||
/* opt_srv_cert should determine the sender */
|
||||
CMP_err("must give -srv_ref for server if no -srv_cert given");
|
||||
goto err;
|
||||
}
|
||||
} else {
|
||||
if (!OSSL_CMP_CTX_set1_referenceValue(ctx, (unsigned char *)opt_srv_ref,
|
||||
strlen(opt_srv_ref)))
|
||||
goto err;
|
||||
}
|
||||
|
||||
if (opt_srv_secret != NULL) {
|
||||
int res;
|
||||
char *pass_str = get_passwd(opt_srv_secret, "PBMAC secret of server");
|
||||
|
||||
if (pass_str != NULL) {
|
||||
cleanse(opt_srv_secret);
|
||||
res = OSSL_CMP_CTX_set1_secretValue(ctx, (unsigned char *)pass_str,
|
||||
strlen(pass_str));
|
||||
clear_free(pass_str);
|
||||
if (res == 0)
|
||||
goto err;
|
||||
}
|
||||
} else if (opt_srv_cert == NULL) {
|
||||
CMP_err("server credentials must be given if -use_mock_srv or -port is used");
|
||||
goto err;
|
||||
} else {
|
||||
CMP_warn("server will not be able to handle PBM-protected requests since -srv_secret is not given");
|
||||
}
|
||||
|
||||
if (opt_srv_secret == NULL
|
||||
&& ((opt_srv_cert == NULL) != (opt_srv_key == NULL))) {
|
||||
CMP_err("must give both -srv_cert and -srv_key options or neither");
|
||||
goto err;
|
||||
}
|
||||
if (opt_srv_cert != NULL) {
|
||||
X509 *srv_cert = load_cert_pwd(opt_srv_cert, opt_srv_keypass,
|
||||
"certificate of the server");
|
||||
|
||||
if (srv_cert == NULL || !OSSL_CMP_CTX_set1_cert(ctx, srv_cert)) {
|
||||
X509_free(srv_cert);
|
||||
goto err;
|
||||
}
|
||||
X509_free(srv_cert);
|
||||
}
|
||||
if (opt_srv_key != NULL) {
|
||||
EVP_PKEY *pkey = load_key_pwd(opt_srv_key, opt_keyform,
|
||||
opt_srv_keypass,
|
||||
e, "private key for server cert");
|
||||
|
||||
if (pkey == NULL || !OSSL_CMP_CTX_set1_pkey(ctx, pkey)) {
|
||||
EVP_PKEY_free(pkey);
|
||||
goto err;
|
||||
}
|
||||
EVP_PKEY_free(pkey);
|
||||
}
|
||||
cleanse(opt_srv_keypass);
|
||||
|
||||
if (opt_srv_trusted != NULL) {
|
||||
X509_STORE *ts =
|
||||
load_certstore(opt_srv_trusted, "certificates trusted by server");
|
||||
|
||||
if (ts == NULL)
|
||||
goto err;
|
||||
if (!set1_store_parameters(ts)
|
||||
|| !truststore_set_host_etc(ts, NULL)
|
||||
|| !OSSL_CMP_CTX_set0_trustedStore(ctx, ts)) {
|
||||
X509_STORE_free(ts);
|
||||
goto err;
|
||||
}
|
||||
} else {
|
||||
CMP_warn("server will not be able to handle signature-protected requests since -srv_trusted is not given");
|
||||
}
|
||||
if (!setup_certs(opt_srv_untrusted, "untrusted certificates", ctx,
|
||||
(add_X509_stack_fn_t)OSSL_CMP_CTX_set1_untrusted_certs,
|
||||
NULL))
|
||||
goto err;
|
||||
|
||||
if (opt_rsp_cert == NULL) {
|
||||
CMP_err("must give -rsp_cert for mock server");
|
||||
goto err;
|
||||
} else {
|
||||
X509 *cert = load_cert_pwd(opt_rsp_cert, opt_keypass,
|
||||
"cert to be returned by the mock server");
|
||||
|
||||
if (cert == NULL)
|
||||
goto err;
|
||||
/* from server perspective the server is the client */
|
||||
if (!ossl_cmp_mock_srv_set1_certOut(srv_ctx, cert)) {
|
||||
X509_free(cert);
|
||||
goto err;
|
||||
}
|
||||
X509_free(cert);
|
||||
}
|
||||
/* TODO find a cleaner solution not requiring type casts */
|
||||
if (!setup_certs(opt_rsp_extracerts,
|
||||
"CMP extra certificates for mock server", srv_ctx,
|
||||
(add_X509_stack_fn_t)ossl_cmp_mock_srv_set1_chainOut,
|
||||
NULL))
|
||||
goto err;
|
||||
if (!setup_certs(opt_rsp_capubs, "caPubs for mock server", srv_ctx,
|
||||
(add_X509_stack_fn_t)ossl_cmp_mock_srv_set1_caPubsOut,
|
||||
NULL))
|
||||
goto err;
|
||||
(void)ossl_cmp_mock_srv_set_pollCount(srv_ctx, opt_poll_count);
|
||||
(void)ossl_cmp_mock_srv_set_checkAfterTime(srv_ctx, opt_check_after);
|
||||
if (opt_grant_implicitconf)
|
||||
(void)OSSL_CMP_SRV_CTX_set_grant_implicit_confirm(srv_ctx, 1);
|
||||
|
||||
if (opt_failure != INT_MIN) { /* option has been set explicity */
|
||||
if (opt_failure < 0 || OSSL_CMP_PKIFAILUREINFO_MAX < opt_failure) {
|
||||
CMP_err1("-failure out of range, should be >= 0 and <= %d",
|
||||
OSSL_CMP_PKIFAILUREINFO_MAX);
|
||||
goto err;
|
||||
}
|
||||
if (opt_failurebits != 0)
|
||||
CMP_warn("-failurebits overrides -failure");
|
||||
else
|
||||
opt_failurebits = 1 << opt_failure;
|
||||
}
|
||||
if ((unsigned)opt_failurebits > OSSL_CMP_PKIFAILUREINFO_MAX_BIT_PATTERN) {
|
||||
CMP_err("-failurebits out of range");
|
||||
goto err;
|
||||
}
|
||||
if (!ossl_cmp_mock_srv_set_statusInfo(srv_ctx, opt_pkistatus,
|
||||
opt_failurebits, opt_statusstring))
|
||||
goto err;
|
||||
|
||||
if (opt_send_error)
|
||||
(void)ossl_cmp_mock_srv_set_send_error(srv_ctx, 1);
|
||||
|
||||
if (opt_send_unprotected)
|
||||
(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_UNPROTECTED_SEND, 1);
|
||||
if (opt_send_unprot_err)
|
||||
(void)OSSL_CMP_SRV_CTX_set_send_unprotected_errors(srv_ctx, 1);
|
||||
if (opt_accept_unprotected)
|
||||
(void)OSSL_CMP_SRV_CTX_set_accept_unprotected(srv_ctx, 1);
|
||||
if (opt_accept_unprot_err)
|
||||
(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_UNPROTECTED_ERRORS, 1);
|
||||
if (opt_accept_raverified)
|
||||
(void)OSSL_CMP_SRV_CTX_set_accept_raverified(srv_ctx, 1);
|
||||
|
||||
return srv_ctx;
|
||||
|
||||
err:
|
||||
ossl_cmp_mock_srv_free(srv_ctx);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/*
|
||||
* set up verification aspects of OSSL_CMP_CTX w.r.t. opts from config file/CLI.
|
||||
* Returns pointer on success, NULL on error
|
||||
*/
|
||||
static int setup_verification_ctx(OSSL_CMP_CTX *ctx)
|
||||
{
|
||||
if (!setup_certs(opt_untrusted, "untrusted certificates", ctx,
|
||||
(add_X509_stack_fn_t)OSSL_CMP_CTX_set1_untrusted_certs,
|
||||
NULL))
|
||||
goto err;
|
||||
|
||||
if (opt_srvcert != NULL || opt_trusted != NULL) {
|
||||
X509_STORE *ts = NULL;
|
||||
|
||||
if (opt_srvcert != NULL) {
|
||||
X509 *srvcert;
|
||||
|
||||
if (opt_trusted != NULL) {
|
||||
CMP_warn("-trusted option is ignored since -srvcert option is present");
|
||||
opt_trusted = NULL;
|
||||
}
|
||||
if (opt_recipient != NULL) {
|
||||
CMP_warn("-recipient option is ignored since -srvcert option is present");
|
||||
opt_recipient = NULL;
|
||||
}
|
||||
srvcert = load_cert_pwd(opt_srvcert, opt_otherpass,
|
||||
"directly trusted CMP server certificate");
|
||||
if (srvcert == NULL)
|
||||
/*
|
||||
* opt_otherpass is needed in case
|
||||
* opt_srvcert is an encrypted PKCS#12 file
|
||||
*/
|
||||
goto err;
|
||||
if (!OSSL_CMP_CTX_set1_srvCert(ctx, srvcert)) {
|
||||
X509_free(srvcert);
|
||||
goto oom;
|
||||
}
|
||||
X509_free(srvcert);
|
||||
if ((ts = X509_STORE_new()) == NULL)
|
||||
goto oom;
|
||||
}
|
||||
if (opt_trusted != NULL
|
||||
&& (ts = load_certstore(opt_trusted, "trusted certificates"))
|
||||
== NULL)
|
||||
goto err;
|
||||
if (!set1_store_parameters(ts) /* also copies vpm */
|
||||
/*
|
||||
* clear any expected host/ip/email address;
|
||||
* opt_expect_sender is used instead
|
||||
*/
|
||||
|| !truststore_set_host_etc(ts, NULL)
|
||||
|| !OSSL_CMP_CTX_set0_trustedStore(ctx, ts)) {
|
||||
X509_STORE_free(ts);
|
||||
goto oom;
|
||||
}
|
||||
}
|
||||
|
||||
if (opt_ignore_keyusage)
|
||||
(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_IGNORE_KEYUSAGE, 1);
|
||||
|
||||
if (opt_unprotected_errors)
|
||||
(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_UNPROTECTED_ERRORS, 1);
|
||||
|
||||
if (opt_out_trusted != NULL) { /* for use in OSSL_CMP_certConf_cb() */
|
||||
X509_VERIFY_PARAM *out_vpm = NULL;
|
||||
X509_STORE *out_trusted =
|
||||
load_certstore(opt_out_trusted,
|
||||
"trusted certs for verifying newly enrolled cert");
|
||||
|
||||
if (out_trusted == NULL)
|
||||
goto err;
|
||||
/* any -verify_hostname, -verify_ip, and -verify_email apply here */
|
||||
if (!set1_store_parameters(out_trusted))
|
||||
goto oom;
|
||||
/* ignore any -attime here, new certs are current anyway */
|
||||
out_vpm = X509_STORE_get0_param(out_trusted);
|
||||
X509_VERIFY_PARAM_clear_flags(out_vpm, X509_V_FLAG_USE_CHECK_TIME);
|
||||
|
||||
(void)OSSL_CMP_CTX_set_certConf_cb_arg(ctx, out_trusted);
|
||||
}
|
||||
|
||||
if (opt_disable_confirm)
|
||||
(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_DISABLE_CONFIRM, 1);
|
||||
|
||||
if (opt_implicit_confirm)
|
||||
(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_IMPLICIT_CONFIRM, 1);
|
||||
|
||||
(void)OSSL_CMP_CTX_set_certConf_cb(ctx, OSSL_CMP_certConf_cb);
|
||||
|
||||
return 1;
|
||||
|
||||
oom:
|
||||
CMP_err("out of memory");
|
||||
err:
|
||||
return 0;
|
||||
}
|
||||
|
||||
#ifndef OPENSSL_NO_SOCK
|
||||
/*
|
||||
* set up ssl_ctx for the OSSL_CMP_CTX based on options from config file/CLI.
|
||||
* Returns pointer on success, NULL on error
|
||||
*/
|
||||
static SSL_CTX *setup_ssl_ctx(OSSL_CMP_CTX *ctx, ENGINE *e)
|
||||
{
|
||||
STACK_OF(X509) *untrusted_certs = OSSL_CMP_CTX_get0_untrusted_certs(ctx);
|
||||
EVP_PKEY *pkey = NULL;
|
||||
X509_STORE *trust_store = NULL;
|
||||
SSL_CTX *ssl_ctx;
|
||||
int i;
|
||||
|
||||
ssl_ctx = SSL_CTX_new(TLS_client_method());
|
||||
if (ssl_ctx == NULL)
|
||||
return NULL;
|
||||
|
||||
SSL_CTX_set_mode(ssl_ctx, SSL_MODE_AUTO_RETRY);
|
||||
|
||||
if (opt_tls_trusted != NULL) {
|
||||
if ((trust_store = load_certstore(opt_tls_trusted,
|
||||
"trusted TLS certificates")) == NULL)
|
||||
goto err;
|
||||
SSL_CTX_set_cert_store(ssl_ctx, trust_store);
|
||||
/* for improved diagnostics on SSL_CTX_build_cert_chain() errors: */
|
||||
X509_STORE_set_verify_cb(trust_store, X509_STORE_CTX_print_verify_cb);
|
||||
}
|
||||
|
||||
if (opt_tls_cert != NULL && opt_tls_key != NULL) {
|
||||
X509 *cert;
|
||||
STACK_OF(X509) *certs = NULL;
|
||||
|
||||
if (!load_certs_autofmt(opt_tls_cert, &certs, 0, opt_tls_keypass,
|
||||
"TLS client certificate (optionally with chain)"))
|
||||
/*
|
||||
* opt_tls_keypass is needed in case opt_tls_cert is an encrypted
|
||||
* PKCS#12 file
|
||||
*/
|
||||
goto err;
|
||||
|
||||
cert = sk_X509_delete(certs, 0);
|
||||
if (cert == NULL || SSL_CTX_use_certificate(ssl_ctx, cert) <= 0) {
|
||||
CMP_err1("unable to use client TLS certificate file '%s'",
|
||||
opt_tls_cert);
|
||||
X509_free(cert);
|
||||
sk_X509_pop_free(certs, X509_free);
|
||||
goto err;
|
||||
}
|
||||
X509_free(cert); /* we do not need the handle any more */
|
||||
|
||||
/*
|
||||
* Any further certs and any untrusted certs are used for constructing
|
||||
* the chain to be provided with the TLS client cert to the TLS server.
|
||||
*/
|
||||
if (!SSL_CTX_set0_chain(ssl_ctx, certs)) {
|
||||
CMP_err("could not set TLS client cert chain");
|
||||
sk_X509_pop_free(certs, X509_free);
|
||||
goto err;
|
||||
}
|
||||
for (i = 0; i < sk_X509_num(untrusted_certs); i++) {
|
||||
cert = sk_X509_value(untrusted_certs, i);
|
||||
if (!SSL_CTX_add1_chain_cert(ssl_ctx, cert)) {
|
||||
CMP_err("could not add untrusted cert to TLS client cert chain");
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
if (!SSL_CTX_build_cert_chain(ssl_ctx,
|
||||
SSL_BUILD_CHAIN_FLAG_UNTRUSTED |
|
||||
SSL_BUILD_CHAIN_FLAG_NO_ROOT)) {
|
||||
CMP_warn("could not build cert chain for own TLS cert");
|
||||
OSSL_CMP_CTX_print_errors(ctx);
|
||||
}
|
||||
|
||||
/* If present we append to the list also the certs from opt_tls_extra */
|
||||
if (opt_tls_extra != NULL) {
|
||||
STACK_OF(X509) *tls_extra = load_certs_multifile(opt_tls_extra,
|
||||
opt_otherpass,
|
||||
"extra certificates for TLS");
|
||||
int res = 1;
|
||||
|
||||
if (tls_extra == NULL)
|
||||
goto err;
|
||||
for (i = 0; i < sk_X509_num(tls_extra); i++) {
|
||||
cert = sk_X509_value(tls_extra, i);
|
||||
if (res != 0)
|
||||
res = SSL_CTX_add_extra_chain_cert(ssl_ctx, cert);
|
||||
if (res == 0)
|
||||
X509_free(cert);
|
||||
}
|
||||
sk_X509_free(tls_extra);
|
||||
if (res == 0) {
|
||||
BIO_printf(bio_err, "error: unable to add TLS extra certs\n");
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
|
||||
pkey = load_key_pwd(opt_tls_key, opt_keyform, opt_tls_keypass,
|
||||
e, "TLS client private key");
|
||||
cleanse(opt_tls_keypass);
|
||||
if (pkey == NULL)
|
||||
goto err;
|
||||
/*
|
||||
* verify the key matches the cert,
|
||||
* not using SSL_CTX_check_private_key(ssl_ctx)
|
||||
* because it gives poor and sometimes misleading diagnostics
|
||||
*/
|
||||
if (!X509_check_private_key(SSL_CTX_get0_certificate(ssl_ctx),
|
||||
pkey)) {
|
||||
CMP_err2("TLS private key '%s' does not match the TLS certificate '%s'\n",
|
||||
opt_tls_key, opt_tls_cert);
|
||||
EVP_PKEY_free(pkey);
|
||||
pkey = NULL; /* otherwise, for some reason double free! */
|
||||
goto err;
|
||||
}
|
||||
if (SSL_CTX_use_PrivateKey(ssl_ctx, pkey) <= 0) {
|
||||
CMP_err1("unable to use TLS client private key '%s'", opt_tls_key);
|
||||
EVP_PKEY_free(pkey);
|
||||
pkey = NULL; /* otherwise, for some reason double free! */
|
||||
goto err;
|
||||
}
|
||||
EVP_PKEY_free(pkey); /* we do not need the handle any more */
|
||||
}
|
||||
if (opt_tls_trusted != NULL) {
|
||||
/* enable and parameterize server hostname/IP address check */
|
||||
if (!truststore_set_host_etc(trust_store,
|
||||
opt_tls_host != NULL ?
|
||||
opt_tls_host : opt_server))
|
||||
/* TODO: is the server host name correct for TLS via proxy? */
|
||||
goto err;
|
||||
SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER, NULL);
|
||||
}
|
||||
return ssl_ctx;
|
||||
err:
|
||||
SSL_CTX_free(ssl_ctx);
|
||||
return NULL;
|
||||
}
|
||||
#endif
|
||||
|
||||
/*
|
||||
* set up protection aspects of OSSL_CMP_CTX based on options from config
|
||||
* file/CLI while parsing options and checking their consistency.
|
||||
* Returns 1 on success, 0 on error
|
||||
*/
|
||||
static int setup_protection_ctx(OSSL_CMP_CTX *ctx, ENGINE *e)
|
||||
{
|
||||
if (!opt_unprotected_requests && opt_secret == NULL && opt_cert == NULL) {
|
||||
CMP_err("must give client credentials unless -unprotected_requests is set");
|
||||
goto err;
|
||||
}
|
||||
|
||||
if (opt_ref == NULL && opt_cert == NULL && opt_subject == NULL) {
|
||||
/* cert or subject should determine the sender */
|
||||
CMP_err("must give -ref if no -cert and no -subject given");
|
||||
goto err;
|
||||
}
|
||||
if (!opt_secret && ((opt_cert == NULL) != (opt_key == NULL))) {
|
||||
CMP_err("must give both -cert and -key options or neither");
|
||||
goto err;
|
||||
}
|
||||
if (opt_secret != NULL) {
|
||||
char *pass_string = get_passwd(opt_secret, "PBMAC");
|
||||
int res;
|
||||
|
||||
if (pass_string != NULL) {
|
||||
cleanse(opt_secret);
|
||||
res = OSSL_CMP_CTX_set1_secretValue(ctx,
|
||||
(unsigned char *)pass_string,
|
||||
strlen(pass_string));
|
||||
clear_free(pass_string);
|
||||
if (res == 0)
|
||||
goto err;
|
||||
}
|
||||
if (opt_cert != NULL || opt_key != NULL)
|
||||
CMP_warn("no signature-based protection used since -secret is given");
|
||||
}
|
||||
if (opt_ref != NULL
|
||||
&& !OSSL_CMP_CTX_set1_referenceValue(ctx, (unsigned char *)opt_ref,
|
||||
strlen(opt_ref)))
|
||||
goto err;
|
||||
|
||||
if (opt_key != NULL) {
|
||||
EVP_PKEY *pkey = load_key_pwd(opt_key, opt_keyform, opt_keypass, e,
|
||||
"private key for CMP client certificate");
|
||||
|
||||
if (pkey == NULL || !OSSL_CMP_CTX_set1_pkey(ctx, pkey)) {
|
||||
EVP_PKEY_free(pkey);
|
||||
goto err;
|
||||
}
|
||||
EVP_PKEY_free(pkey);
|
||||
}
|
||||
if (opt_secret == NULL && opt_srvcert == NULL && opt_trusted == NULL) {
|
||||
CMP_err("missing -secret or -srvcert or -trusted");
|
||||
goto err;
|
||||
}
|
||||
|
||||
if (opt_cert != NULL) {
|
||||
X509 *cert;
|
||||
STACK_OF(X509) *certs = NULL;
|
||||
int ok;
|
||||
|
||||
if (!load_certs_autofmt(opt_cert, &certs, 0, opt_keypass,
|
||||
"CMP client certificate (and optionally extra certs)"))
|
||||
/* opt_keypass is needed if opt_cert is an encrypted PKCS#12 file */
|
||||
goto err;
|
||||
|
||||
cert = sk_X509_delete(certs, 0);
|
||||
if (cert == NULL) {
|
||||
CMP_err("no client certificate found");
|
||||
sk_X509_pop_free(certs, X509_free);
|
||||
goto err;
|
||||
}
|
||||
ok = OSSL_CMP_CTX_set1_cert(ctx, cert);
|
||||
X509_free(cert);
|
||||
|
||||
if (ok) {
|
||||
/* add any remaining certs to the list of untrusted certs */
|
||||
STACK_OF(X509) *untrusted = OSSL_CMP_CTX_get0_untrusted_certs(ctx);
|
||||
ok = untrusted != NULL ?
|
||||
sk_X509_add1_certs(untrusted, certs, 0, 1 /* no dups */, 0) :
|
||||
OSSL_CMP_CTX_set1_untrusted_certs(ctx, certs);
|
||||
}
|
||||
sk_X509_pop_free(certs, X509_free);
|
||||
if (!ok)
|
||||
goto oom;
|
||||
}
|
||||
|
||||
if (!setup_certs(opt_extracerts, "extra certificates for CMP", ctx,
|
||||
(add_X509_stack_fn_t)OSSL_CMP_CTX_set1_extraCertsOut,
|
||||
NULL))
|
||||
goto err;
|
||||
cleanse(opt_otherpass);
|
||||
|
||||
if (opt_unprotected_requests)
|
||||
(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_UNPROTECTED_SEND, 1);
|
||||
|
||||
if (opt_digest != NULL) {
|
||||
int digest = OBJ_ln2nid(opt_digest);
|
||||
|
||||
if (digest == NID_undef) {
|
||||
CMP_err1("digest algorithm name not recognized: '%s'", opt_digest);
|
||||
goto err;
|
||||
}
|
||||
(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_DIGEST_ALGNID, digest);
|
||||
(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_OWF_ALGNID, digest);
|
||||
}
|
||||
|
||||
if (opt_mac != NULL) {
|
||||
int mac = OBJ_ln2nid(opt_mac);
|
||||
if (mac == NID_undef) {
|
||||
CMP_err1("MAC algorithm name not recognized: '%s'", opt_mac);
|
||||
goto err;
|
||||
}
|
||||
(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_MAC_ALGNID, mac);
|
||||
}
|
||||
return 1;
|
||||
|
||||
oom:
|
||||
CMP_err("out of memory");
|
||||
err:
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* set up IR/CR/KUR/CertConf/RR specific parts of the OSSL_CMP_CTX
|
||||
* based on options from config file/CLI.
|
||||
* Returns pointer on success, NULL on error
|
||||
*/
|
||||
static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *e)
|
||||
{
|
||||
if (opt_subject == NULL && opt_oldcert == NULL && opt_cert == NULL)
|
||||
CMP_warn("no -subject given, neither -oldcert nor -cert available as default");
|
||||
if (!set_name(opt_subject, OSSL_CMP_CTX_set1_subjectName, ctx, "subject")
|
||||
|| !set_name(opt_issuer, OSSL_CMP_CTX_set1_issuer, ctx, "issuer"))
|
||||
goto err;
|
||||
|
||||
if (opt_newkey != NULL) {
|
||||
const char *file = opt_newkey;
|
||||
const int format = opt_keyform;
|
||||
const char *pass = opt_newkeypass;
|
||||
const char *desc = "new private or public key for cert to be enrolled";
|
||||
EVP_PKEY *pkey = load_key_pwd(file, format, pass, e, NULL);
|
||||
int priv = 1;
|
||||
|
||||
if (pkey == NULL) {
|
||||
ERR_clear_error();
|
||||
pkey = load_pubkey(file, format, 0, pass, e, desc);
|
||||
priv = 0;
|
||||
}
|
||||
cleanse(opt_newkeypass);
|
||||
if (pkey == NULL || !OSSL_CMP_CTX_set0_newPkey(ctx, priv, pkey)) {
|
||||
EVP_PKEY_free(pkey);
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
|
||||
if (opt_days > 0)
|
||||
(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_VALIDITY_DAYS,
|
||||
opt_days);
|
||||
|
||||
if (opt_policies != NULL && opt_policy_oids != NULL) {
|
||||
CMP_err("cannot have policies both via -policies and via -policy_oids");
|
||||
goto err;
|
||||
}
|
||||
|
||||
if (opt_reqexts != NULL || opt_policies != NULL) {
|
||||
X509V3_CTX ext_ctx;
|
||||
X509_EXTENSIONS *exts = sk_X509_EXTENSION_new_null();
|
||||
|
||||
if (exts == NULL)
|
||||
goto err;
|
||||
X509V3_set_ctx(&ext_ctx, NULL, NULL, NULL, NULL, 0);
|
||||
X509V3_set_nconf(&ext_ctx, conf);
|
||||
if (opt_reqexts != NULL
|
||||
&& !X509V3_EXT_add_nconf_sk(conf, &ext_ctx, opt_reqexts, &exts)) {
|
||||
CMP_err1("cannot load certificate request extension section '%s'",
|
||||
opt_reqexts);
|
||||
sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
|
||||
goto err;
|
||||
}
|
||||
if (opt_policies != NULL
|
||||
&& !X509V3_EXT_add_nconf_sk(conf, &ext_ctx, opt_policies, &exts)) {
|
||||
CMP_err1("cannot load policy cert request extension section '%s'",
|
||||
opt_policies);
|
||||
sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
|
||||
goto err;
|
||||
}
|
||||
OSSL_CMP_CTX_set0_reqExtensions(ctx, exts);
|
||||
}
|
||||
if (OSSL_CMP_CTX_reqExtensions_have_SAN(ctx) && opt_sans != NULL) {
|
||||
CMP_err("cannot have Subject Alternative Names both via -reqexts and via -sans");
|
||||
goto err;
|
||||
}
|
||||
|
||||
if (!set_gennames(ctx, opt_sans, "Subject Alternative Name"))
|
||||
goto err;
|
||||
|
||||
if (opt_san_nodefault) {
|
||||
if (opt_sans != NULL)
|
||||
CMP_warn("-opt_san_nodefault has no effect when -sans is used");
|
||||
(void)OSSL_CMP_CTX_set_option(ctx,
|
||||
OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT, 1);
|
||||
}
|
||||
|
||||
if (opt_policy_oids_critical) {
|
||||
if (opt_policy_oids == NULL)
|
||||
CMP_warn("-opt_policy_oids_critical has no effect unless -policy_oids is given");
|
||||
(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_POLICIES_CRITICAL, 1);
|
||||
}
|
||||
|
||||
while (opt_policy_oids != NULL) {
|
||||
ASN1_OBJECT *policy;
|
||||
POLICYINFO *pinfo;
|
||||
char *next = next_item(opt_policy_oids);
|
||||
|
||||
if ((policy = OBJ_txt2obj(opt_policy_oids, 1)) == 0) {
|
||||
CMP_err1("unknown policy OID '%s'", opt_policy_oids);
|
||||
goto err;
|
||||
}
|
||||
|
||||
if ((pinfo = POLICYINFO_new()) == NULL) {
|
||||
ASN1_OBJECT_free(policy);
|
||||
goto err;
|
||||
}
|
||||
pinfo->policyid = policy;
|
||||
|
||||
if (!OSSL_CMP_CTX_push0_policy(ctx, pinfo)) {
|
||||
CMP_err1("cannot add policy with OID '%s'", opt_policy_oids);
|
||||
POLICYINFO_free(pinfo);
|
||||
goto err;
|
||||
}
|
||||
opt_policy_oids = next;
|
||||
}
|
||||
|
||||
if (opt_popo >= OSSL_CRMF_POPO_NONE)
|
||||
(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_POPO_METHOD, opt_popo);
|
||||
|
||||
if (opt_csr != NULL) {
|
||||
if (opt_cmd != CMP_P10CR) {
|
||||
CMP_warn("-csr option is ignored for command other than p10cr");
|
||||
} else {
|
||||
X509_REQ *csr =
|
||||
load_csr_autofmt(opt_csr, "PKCS#10 CSR for p10cr");
|
||||
|
||||
if (csr == NULL)
|
||||
goto err;
|
||||
if (!OSSL_CMP_CTX_set1_p10CSR(ctx, csr)) {
|
||||
X509_REQ_free(csr);
|
||||
goto oom;
|
||||
}
|
||||
X509_REQ_free(csr);
|
||||
}
|
||||
}
|
||||
|
||||
if (opt_oldcert != NULL) {
|
||||
X509 *oldcert = load_cert_pwd(opt_oldcert, opt_keypass,
|
||||
"certificate to be updated/revoked");
|
||||
/* opt_keypass is needed if opt_oldcert is an encrypted PKCS#12 file */
|
||||
|
||||
if (oldcert == NULL)
|
||||
goto err;
|
||||
if (!OSSL_CMP_CTX_set1_oldCert(ctx, oldcert)) {
|
||||
X509_free(oldcert);
|
||||
goto oom;
|
||||
}
|
||||
X509_free(oldcert);
|
||||
}
|
||||
cleanse(opt_keypass);
|
||||
if (opt_revreason > CRL_REASON_NONE)
|
||||
(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_REVOCATION_REASON,
|
||||
opt_revreason);
|
||||
|
||||
return 1;
|
||||
|
||||
oom:
|
||||
CMP_err("out of memory");
|
||||
err:
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int handle_opt_geninfo(OSSL_CMP_CTX *ctx)
|
||||
{
|
||||
long value;
|
||||
ASN1_OBJECT *type;
|
||||
ASN1_INTEGER *aint;
|
||||
ASN1_TYPE *val;
|
||||
OSSL_CMP_ITAV *itav;
|
||||
char *endstr;
|
||||
char *valptr = strchr(opt_geninfo, ':');
|
||||
|
||||
if (valptr == NULL) {
|
||||
CMP_err("missing ':' in -geninfo option");
|
||||
return 0;
|
||||
}
|
||||
valptr[0] = '\0';
|
||||
valptr++;
|
||||
|
||||
if (strncasecmp(valptr, "int:", 4) != 0) {
|
||||
CMP_err("missing 'int:' in -geninfo option");
|
||||
return 0;
|
||||
}
|
||||
valptr += 4;
|
||||
|
||||
value = strtol(valptr, &endstr, 10);
|
||||
if (endstr == valptr || *endstr != '\0') {
|
||||
CMP_err("cannot parse int in -geninfo option");
|
||||
return 0;
|
||||
}
|
||||
|
||||
type = OBJ_txt2obj(opt_geninfo, 1);
|
||||
if (type == NULL) {
|
||||
CMP_err("cannot parse OID in -geninfo option");
|
||||
return 0;
|
||||
}
|
||||
|
||||
aint = ASN1_INTEGER_new();
|
||||
if (aint == NULL || !ASN1_INTEGER_set(aint, value))
|
||||
goto oom;
|
||||
|
||||
val = ASN1_TYPE_new();
|
||||
if (val == NULL) {
|
||||
ASN1_INTEGER_free(aint);
|
||||
goto oom;
|
||||
}
|
||||
ASN1_TYPE_set(val, V_ASN1_INTEGER, aint);
|
||||
itav = OSSL_CMP_ITAV_create(type, val);
|
||||
if (itav == NULL) {
|
||||
ASN1_TYPE_free(val);
|
||||
goto oom;
|
||||
}
|
||||
|
||||
if (!OSSL_CMP_CTX_push0_geninfo_ITAV(ctx, itav)) {
|
||||
OSSL_CMP_ITAV_free(itav);
|
||||
return 0;
|
||||
}
|
||||
return 1;
|
||||
|
||||
oom:
|
||||
CMP_err("out of memory");
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
/*
|
||||
* set up the client-side OSSL_CMP_CTX based on options from config file/CLI
|
||||
* while parsing options and checking their consistency.
|
||||
* Prints reason for error to bio_err.
|
||||
* Returns 1 on success, 0 on error
|
||||
*/
|
||||
static int setup_client_ctx(OSSL_CMP_CTX *ctx, ENGINE *e)
|
||||
{
|
||||
int ret = 0;
|
||||
char server_buf[200] = { '\0' };
|
||||
char proxy_buf[200] = { '\0' };
|
||||
char *proxy_host = NULL;
|
||||
char *proxy_port_str = NULL;
|
||||
|
||||
if (opt_server == NULL) {
|
||||
CMP_err("missing server address[:port]");
|
||||
goto err;
|
||||
} else if ((server_port =
|
||||
parse_addr(&opt_server, server_port, "server")) < 0) {
|
||||
goto err;
|
||||
}
|
||||
if (server_port != 0)
|
||||
BIO_snprintf(server_port_s, sizeof(server_port_s), "%d", server_port);
|
||||
if (!OSSL_CMP_CTX_set1_server(ctx, opt_server)
|
||||
|| !OSSL_CMP_CTX_set_serverPort(ctx, server_port)
|
||||
|| !OSSL_CMP_CTX_set1_serverPath(ctx, opt_path))
|
||||
goto oom;
|
||||
if (opt_proxy != NULL && !OSSL_CMP_CTX_set1_proxy(ctx, opt_proxy))
|
||||
goto oom;
|
||||
if (opt_no_proxy != NULL && !OSSL_CMP_CTX_set1_no_proxy(ctx, opt_no_proxy))
|
||||
goto oom;
|
||||
(void)BIO_snprintf(server_buf, sizeof(server_buf), "http%s://%s%s%s/%s",
|
||||
opt_tls_used ? "s" : "", opt_server,
|
||||
server_port == 0 ? "" : ":", server_port_s,
|
||||
opt_path == NULL ? "" :
|
||||
opt_path[0] == '/' ? opt_path + 1 : opt_path);
|
||||
|
||||
if (opt_proxy != NULL)
|
||||
(void)BIO_snprintf(proxy_buf, sizeof(proxy_buf), " via %s", opt_proxy);
|
||||
CMP_info2("will contact %s%s", server_buf, proxy_buf);
|
||||
|
||||
if (!transform_opts())
|
||||
goto err;
|
||||
|
||||
if (opt_cmd == CMP_IR || opt_cmd == CMP_CR || opt_cmd == CMP_KUR) {
|
||||
if (opt_newkey == NULL && opt_key == NULL && opt_csr == NULL) {
|
||||
CMP_err("missing -newkey (or -key) to be certified");
|
||||
goto err;
|
||||
}
|
||||
if (opt_certout == NULL) {
|
||||
CMP_err("-certout not given, nowhere to save certificate");
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
if (opt_cmd == CMP_KUR) {
|
||||
char *ref_cert = opt_oldcert != NULL ? opt_oldcert : opt_cert;
|
||||
|
||||
if (ref_cert == NULL) {
|
||||
CMP_err("missing -oldcert option for certificate to be updated");
|
||||
goto err;
|
||||
}
|
||||
if (opt_subject != NULL)
|
||||
CMP_warn2("-subject '%s' given, which overrides the subject of '%s' in KUR",
|
||||
opt_subject, ref_cert);
|
||||
}
|
||||
if (opt_cmd == CMP_RR && opt_oldcert == NULL) {
|
||||
CMP_err("missing certificate to be revoked");
|
||||
goto err;
|
||||
}
|
||||
if (opt_cmd == CMP_P10CR && opt_csr == NULL) {
|
||||
CMP_err("missing PKCS#10 CSR for p10cr");
|
||||
goto err;
|
||||
}
|
||||
|
||||
if (opt_recipient == NULL && opt_srvcert == NULL && opt_issuer == NULL
|
||||
&& opt_oldcert == NULL && opt_cert == NULL)
|
||||
CMP_warn("missing -recipient, -srvcert, -issuer, -oldcert or -cert; recipient will be set to \"NULL-DN\"");
|
||||
|
||||
if (opt_infotype_s != NULL) {
|
||||
char id_buf[100] = "id-it-";
|
||||
|
||||
strncat(id_buf, opt_infotype_s, sizeof(id_buf) - strlen(id_buf) - 1);
|
||||
if ((opt_infotype = OBJ_sn2nid(id_buf)) == NID_undef) {
|
||||
CMP_err("unknown OID name in -infotype option");
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
|
||||
if (!setup_verification_ctx(ctx))
|
||||
goto err;
|
||||
|
||||
if (opt_msg_timeout >= 0) /* must do this before setup_ssl_ctx() */
|
||||
(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_MSG_TIMEOUT,
|
||||
opt_msg_timeout);
|
||||
if (opt_total_timeout >= 0)
|
||||
(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_TOTAL_TIMEOUT,
|
||||
opt_total_timeout);
|
||||
|
||||
if (opt_reqin != NULL && opt_rspin != NULL)
|
||||
CMP_warn("-reqin is ignored since -rspin is present");
|
||||
if (opt_reqin_new_tid && opt_reqin == NULL)
|
||||
CMP_warn("-reqin_new_tid is ignored since -reqin is not present");
|
||||
if (opt_reqin != NULL || opt_reqout != NULL
|
||||
|| opt_rspin != NULL || opt_rspout != NULL || opt_use_mock_srv)
|
||||
(void)OSSL_CMP_CTX_set_transfer_cb(ctx, read_write_req_resp);
|
||||
|
||||
if ((opt_tls_cert != NULL || opt_tls_key != NULL
|
||||
|| opt_tls_keypass != NULL || opt_tls_extra != NULL
|
||||
|| opt_tls_trusted != NULL || opt_tls_host != NULL)
|
||||
&& !opt_tls_used)
|
||||
CMP_warn("TLS options(s) given but not -tls_used");
|
||||
if (opt_tls_used) {
|
||||
#ifdef OPENSSL_NO_SOCK
|
||||
BIO_printf(bio_err, "Cannot use TLS - sockets not supported\n");
|
||||
goto err;
|
||||
#else
|
||||
APP_HTTP_TLS_INFO *info;
|
||||
|
||||
if (opt_tls_cert != NULL
|
||||
|| opt_tls_key != NULL || opt_tls_keypass != NULL) {
|
||||
if (opt_tls_key == NULL) {
|
||||
CMP_err("missing -tls_key option");
|
||||
goto err;
|
||||
} else if (opt_tls_cert == NULL) {
|
||||
CMP_err("missing -tls_cert option");
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
if (opt_use_mock_srv) {
|
||||
CMP_err("cannot use TLS options together with -use_mock_srv");
|
||||
goto err;
|
||||
}
|
||||
if ((info = OPENSSL_zalloc(sizeof(*info))) == NULL)
|
||||
goto err;
|
||||
(void)OSSL_CMP_CTX_set_http_cb_arg(ctx, info);
|
||||
/* info will be freed along with CMP ctx */
|
||||
info->server = opt_server;
|
||||
info->port = server_port_s;
|
||||
info->use_proxy = opt_proxy != NULL;
|
||||
info->timeout = OSSL_CMP_CTX_get_option(ctx, OSSL_CMP_OPT_MSG_TIMEOUT);
|
||||
info->ssl_ctx = setup_ssl_ctx(ctx, e);
|
||||
if (info->ssl_ctx == NULL)
|
||||
goto err;
|
||||
(void)OSSL_CMP_CTX_set_http_cb(ctx, app_http_tls_cb);
|
||||
#endif
|
||||
}
|
||||
|
||||
if (!setup_protection_ctx(ctx, e))
|
||||
goto err;
|
||||
|
||||
if (!setup_request_ctx(ctx, e))
|
||||
goto err;
|
||||
|
||||
if (!set_name(opt_recipient, OSSL_CMP_CTX_set1_recipient, ctx, "recipient")
|
||||
|| !set_name(opt_expect_sender, OSSL_CMP_CTX_set1_expected_sender,
|
||||
ctx, "expected sender"))
|
||||
goto err;
|
||||
|
||||
if (opt_geninfo != NULL && !handle_opt_geninfo(ctx))
|
||||
goto err;
|
||||
|
||||
ret = 1;
|
||||
|
||||
err:
|
||||
OPENSSL_free(proxy_host);
|
||||
OPENSSL_free(proxy_port_str);
|
||||
return ret;
|
||||
oom:
|
||||
CMP_err("out of memory");
|
||||
goto err;
|
||||
}
|
||||
|
||||
/*
|
||||
* write out the given certificate to the output specified by bio.
|
||||
* Depending on options use either PEM or DER format.
|
||||
* Returns 1 on success, 0 on error
|
||||
*/
|
||||
static int write_cert(BIO *bio, X509 *cert)
|
||||
{
|
||||
if ((opt_certform == FORMAT_PEM && PEM_write_bio_X509(bio, cert))
|
||||
|| (opt_certform == FORMAT_ASN1 && i2d_X509_bio(bio, cert)))
|
||||
return 1;
|
||||
if (opt_certform != FORMAT_PEM && opt_certform != FORMAT_ASN1)
|
||||
BIO_printf(bio_err,
|
||||
"error: unsupported type '%s' for writing certificates\n",
|
||||
opt_certform_s);
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* writes out a stack of certs to the given file.
|
||||
* Depending on options use either PEM or DER format,
|
||||
* where DER does not make much sense for writing more than one cert!
|
||||
* Returns number of written certificates on success, 0 on error.
|
||||
*/
|
||||
static int save_certs(OSSL_CMP_CTX *ctx,
|
||||
STACK_OF(X509) *certs, char *destFile, char *desc)
|
||||
{
|
||||
BIO *bio = NULL;
|
||||
int i;
|
||||
int n = sk_X509_num(certs);
|
||||
|
||||
CMP_info3("received %d %s certificate(s), saving to file '%s'",
|
||||
n, desc, destFile);
|
||||
if (n > 1 && opt_certform != FORMAT_PEM)
|
||||
CMP_warn("saving more than one certificate in non-PEM format");
|
||||
|
||||
if (destFile == NULL || (bio = BIO_new(BIO_s_file())) == NULL
|
||||
|| !BIO_write_filename(bio, (char *)destFile)) {
|
||||
CMP_err1("could not open file '%s' for writing", destFile);
|
||||
n = -1;
|
||||
goto err;
|
||||
}
|
||||
|
||||
for (i = 0; i < n; i++) {
|
||||
if (!write_cert(bio, sk_X509_value(certs, i))) {
|
||||
CMP_err1("cannot write certificate to file '%s'", destFile);
|
||||
n = -1;
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
|
||||
err:
|
||||
BIO_free(bio);
|
||||
return n;
|
||||
}
|
||||
|
||||
static void print_itavs(STACK_OF(OSSL_CMP_ITAV) *itavs)
|
||||
{
|
||||
OSSL_CMP_ITAV *itav = NULL;
|
||||
char buf[128];
|
||||
int i;
|
||||
int n = sk_OSSL_CMP_ITAV_num(itavs); /* itavs == NULL leads to 0 */
|
||||
|
||||
if (n == 0) {
|
||||
CMP_info("genp contains no ITAV");
|
||||
return;
|
||||
}
|
||||
|
||||
for (i = 0; i < n; i++) {
|
||||
itav = sk_OSSL_CMP_ITAV_value(itavs, i);
|
||||
OBJ_obj2txt(buf, 128, OSSL_CMP_ITAV_get0_type(itav), 0);
|
||||
CMP_info1("genp contains ITAV of type: %s", buf);
|
||||
}
|
||||
}
|
||||
|
||||
static char opt_item[SECTION_NAME_MAX + 1];
|
||||
/* get previous name from a comma-separated list of names */
|
||||
static const char *prev_item(const char *opt, const char *end)
|
||||
{
|
||||
const char *beg;
|
||||
size_t len;
|
||||
|
||||
if (end == opt)
|
||||
return NULL;
|
||||
beg = end;
|
||||
while (beg != opt && beg[-1] != ',' && !isspace(beg[-1]))
|
||||
beg--;
|
||||
len = end - beg;
|
||||
if (len > SECTION_NAME_MAX)
|
||||
len = SECTION_NAME_MAX;
|
||||
strncpy(opt_item, beg, len);
|
||||
opt_item[SECTION_NAME_MAX] = '\0'; /* avoid gcc v8 O3 stringop-truncation */
|
||||
opt_item[len] = '\0';
|
||||
if (len > SECTION_NAME_MAX)
|
||||
CMP_warn2("using only first %d characters of section name starting with \"%s\"",
|
||||
SECTION_NAME_MAX, opt_item);
|
||||
while (beg != opt && (beg[-1] == ',' || isspace(beg[-1])))
|
||||
beg--;
|
||||
return beg;
|
||||
}
|
||||
|
||||
/* get str value for name from a comma-separated hierarchy of config sections */
|
||||
static char *conf_get_string(const CONF *src_conf, const char *groups,
|
||||
const char *name)
|
||||
{
|
||||
char *res = NULL;
|
||||
const char *end = groups + strlen(groups);
|
||||
|
||||
while ((end = prev_item(groups, end)) != NULL) {
|
||||
if ((res = NCONF_get_string(src_conf, opt_item, name)) != NULL)
|
||||
return res;
|
||||
}
|
||||
return res;
|
||||
}
|
||||
|
||||
/* get long val for name from a comma-separated hierarchy of config sections */
|
||||
static int conf_get_number_e(const CONF *conf_, const char *groups,
|
||||
const char *name, long *result)
|
||||
{
|
||||
char *str = conf_get_string(conf_, groups, name);
|
||||
char *tailptr;
|
||||
long res;
|
||||
|
||||
if (str == NULL || *str == '\0')
|
||||
return 0;
|
||||
|
||||
res = strtol(str, &tailptr, 10);
|
||||
if (res == LONG_MIN || res == LONG_MAX || *tailptr != '\0')
|
||||
return 0;
|
||||
|
||||
*result = res;
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*
|
||||
* use the command line option table to read values from the CMP section
|
||||
* of openssl.cnf. Defaults are taken from the config file, they can be
|
||||
* overwritten on the command line.
|
||||
*/
|
||||
static int read_config(void)
|
||||
{
|
||||
unsigned int i;
|
||||
long num = 0;
|
||||
char *txt = NULL;
|
||||
const OPTIONS *opt;
|
||||
int provider_option;
|
||||
int verification_option;
|
||||
|
||||
/*
|
||||
* starting with offset OPT_SECTION because OPT_CONFIG and OPT_SECTION would
|
||||
* not make sense within the config file. They have already been handled.
|
||||
*/
|
||||
for (i = OPT_SECTION - OPT_HELP, opt = &cmp_options[OPT_SECTION];
|
||||
opt->name; i++, opt++) {
|
||||
if (!strcmp(opt->name, OPT_SECTION_STR)
|
||||
|| !strcmp(opt->name, OPT_MORE_STR)) {
|
||||
i--;
|
||||
continue;
|
||||
}
|
||||
provider_option = (OPT_PROV__FIRST <= opt->retval
|
||||
&& opt->retval < OPT_PROV__LAST);
|
||||
verification_option = (OPT_V__FIRST <= opt->retval
|
||||
&& opt->retval < OPT_V__LAST);
|
||||
if (provider_option || verification_option)
|
||||
i--;
|
||||
if (cmp_vars[i].txt == NULL) {
|
||||
CMP_err1("internal: cmp_vars array too short, i=%d", i);
|
||||
return 0;
|
||||
}
|
||||
switch (opt->valtype) {
|
||||
case '-':
|
||||
case 'n':
|
||||
case 'l':
|
||||
if (!conf_get_number_e(conf, opt_section, opt->name, &num)) {
|
||||
ERR_clear_error();
|
||||
continue; /* option not provided */
|
||||
}
|
||||
break;
|
||||
/*
|
||||
* do not use '<' in cmp_options. Incorrect treatment
|
||||
* somewhere in args_verify() can wrongly set badarg = 1
|
||||
*/
|
||||
case '<':
|
||||
case 's':
|
||||
case 'M':
|
||||
txt = conf_get_string(conf, opt_section, opt->name);
|
||||
if (txt == NULL) {
|
||||
ERR_clear_error();
|
||||
continue; /* option not provided */
|
||||
}
|
||||
break;
|
||||
default:
|
||||
CMP_err2("internal: unsupported type '%c' for option '%s'",
|
||||
opt->valtype, opt->name);
|
||||
return 0;
|
||||
break;
|
||||
}
|
||||
if (provider_option || verification_option) {
|
||||
int conf_argc = 1;
|
||||
char *conf_argv[3];
|
||||
char arg1[82];
|
||||
|
||||
BIO_snprintf(arg1, 81, "-%s", (char *)opt->name);
|
||||
conf_argv[0] = prog;
|
||||
conf_argv[1] = arg1;
|
||||
if (opt->valtype == '-') {
|
||||
if (num != 0)
|
||||
conf_argc = 2;
|
||||
} else {
|
||||
conf_argc = 3;
|
||||
conf_argv[2] = conf_get_string(conf, opt_section, opt->name);
|
||||
/* not NULL */
|
||||
}
|
||||
if (conf_argc > 1) {
|
||||
(void)opt_init(conf_argc, conf_argv, cmp_options);
|
||||
|
||||
if (provider_option
|
||||
? !opt_provider(opt_next())
|
||||
: !opt_verify(opt_next(), vpm)) {
|
||||
CMP_err2("for option '%s' in config file section '%s'",
|
||||
opt->name, opt_section);
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
switch (opt->valtype) {
|
||||
case '-':
|
||||
case 'n':
|
||||
if (num < INT_MIN || INT_MAX < num) {
|
||||
BIO_printf(bio_err,
|
||||
"integer value out of range for option '%s'\n",
|
||||
opt->name);
|
||||
return 0;
|
||||
}
|
||||
*cmp_vars[i].num = (int)num;
|
||||
break;
|
||||
case 'l':
|
||||
*cmp_vars[i].num_long = num;
|
||||
break;
|
||||
default:
|
||||
if (txt != NULL && txt[0] == '\0')
|
||||
txt = NULL; /* reset option on empty string input */
|
||||
*cmp_vars[i].txt = txt;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static char *opt_str(char *opt)
|
||||
{
|
||||
char *arg = opt_arg();
|
||||
|
||||
if (arg[0] == '\0') {
|
||||
CMP_warn1("argument of -%s option is empty string, resetting option",
|
||||
opt);
|
||||
arg = NULL;
|
||||
} else if (arg[0] == '-') {
|
||||
CMP_warn1("argument of -%s option starts with hyphen", opt);
|
||||
}
|
||||
return arg;
|
||||
}
|
||||
|
||||
static int opt_nat(void)
|
||||
{
|
||||
int result = -1;
|
||||
|
||||
if (opt_int(opt_arg(), &result) && result < 0)
|
||||
BIO_printf(bio_err, "error: argument '%s' must not be negative\n",
|
||||
opt_arg());
|
||||
return result;
|
||||
}
|
||||
|
||||
/* returns 1 on success, 0 on error, -1 on -help (i.e., stop with success) */
|
||||
static int get_opts(int argc, char **argv)
|
||||
{
|
||||
OPTION_CHOICE o;
|
||||
|
||||
prog = opt_init(argc, argv, cmp_options);
|
||||
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
switch (o) {
|
||||
case OPT_EOF:
|
||||
case OPT_ERR:
|
||||
goto opt_err;
|
||||
case OPT_HELP:
|
||||
opt_help(cmp_options);
|
||||
return -1;
|
||||
case OPT_CONFIG: /* has already been handled */
|
||||
break;
|
||||
case OPT_SECTION: /* has already been handled */
|
||||
break;
|
||||
case OPT_SERVER:
|
||||
opt_server = opt_str("server");
|
||||
break;
|
||||
case OPT_PROXY:
|
||||
opt_proxy = opt_str("proxy");
|
||||
break;
|
||||
case OPT_NO_PROXY:
|
||||
opt_no_proxy = opt_str("no_proxy");
|
||||
break;
|
||||
case OPT_PATH:
|
||||
opt_path = opt_str("path");
|
||||
break;
|
||||
case OPT_MSG_TIMEOUT:
|
||||
if ((opt_msg_timeout = opt_nat()) < 0)
|
||||
goto opt_err;
|
||||
break;
|
||||
case OPT_TOTAL_TIMEOUT:
|
||||
if ((opt_total_timeout = opt_nat()) < 0)
|
||||
goto opt_err;
|
||||
break;
|
||||
case OPT_TLS_USED:
|
||||
opt_tls_used = 1;
|
||||
break;
|
||||
case OPT_TLS_CERT:
|
||||
opt_tls_cert = opt_str("tls_cert");
|
||||
break;
|
||||
case OPT_TLS_KEY:
|
||||
opt_tls_key = opt_str("tls_key");
|
||||
break;
|
||||
case OPT_TLS_KEYPASS:
|
||||
opt_tls_keypass = opt_str("tls_keypass");
|
||||
break;
|
||||
case OPT_TLS_EXTRA:
|
||||
opt_tls_extra = opt_str("tls_extra");
|
||||
break;
|
||||
case OPT_TLS_TRUSTED:
|
||||
opt_tls_trusted = opt_str("tls_trusted");
|
||||
break;
|
||||
case OPT_TLS_HOST:
|
||||
opt_tls_host = opt_str("tls_host");
|
||||
break;
|
||||
case OPT_REF:
|
||||
opt_ref = opt_str("ref");
|
||||
break;
|
||||
case OPT_SECRET:
|
||||
opt_secret = opt_str("secret");
|
||||
break;
|
||||
case OPT_CERT:
|
||||
opt_cert = opt_str("cert");
|
||||
break;
|
||||
case OPT_KEY:
|
||||
opt_key = opt_str("key");
|
||||
break;
|
||||
case OPT_KEYPASS:
|
||||
opt_keypass = opt_str("keypass");
|
||||
break;
|
||||
case OPT_DIGEST:
|
||||
opt_digest = opt_str("digest");
|
||||
break;
|
||||
case OPT_MAC:
|
||||
opt_mac = opt_str("mac");
|
||||
break;
|
||||
case OPT_EXTRACERTS:
|
||||
opt_extracerts = opt_str("extracerts");
|
||||
break;
|
||||
case OPT_UNPROTECTED_REQUESTS:
|
||||
opt_unprotected_requests = 1;
|
||||
break;
|
||||
|
||||
case OPT_TRUSTED:
|
||||
opt_trusted = opt_str("trusted");
|
||||
break;
|
||||
case OPT_UNTRUSTED:
|
||||
opt_untrusted = opt_str("untrusted");
|
||||
break;
|
||||
case OPT_SRVCERT:
|
||||
opt_srvcert = opt_str("srvcert");
|
||||
break;
|
||||
case OPT_RECIPIENT:
|
||||
opt_recipient = opt_str("recipient");
|
||||
break;
|
||||
case OPT_EXPECT_SENDER:
|
||||
opt_expect_sender = opt_str("expect_sender");
|
||||
break;
|
||||
case OPT_IGNORE_KEYUSAGE:
|
||||
opt_ignore_keyusage = 1;
|
||||
break;
|
||||
case OPT_UNPROTECTED_ERRORS:
|
||||
opt_unprotected_errors = 1;
|
||||
break;
|
||||
case OPT_EXTRACERTSOUT:
|
||||
opt_extracertsout = opt_str("extracertsout");
|
||||
break;
|
||||
case OPT_CACERTSOUT:
|
||||
opt_cacertsout = opt_str("cacertsout");
|
||||
break;
|
||||
|
||||
case OPT_V_CASES:
|
||||
if (!opt_verify(o, vpm))
|
||||
goto opt_err;
|
||||
break;
|
||||
case OPT_CMD:
|
||||
opt_cmd_s = opt_str("cmd");
|
||||
break;
|
||||
case OPT_INFOTYPE:
|
||||
opt_infotype_s = opt_str("infotype");
|
||||
break;
|
||||
case OPT_GENINFO:
|
||||
opt_geninfo = opt_str("geninfo");
|
||||
break;
|
||||
|
||||
case OPT_NEWKEY:
|
||||
opt_newkey = opt_str("newkey");
|
||||
break;
|
||||
case OPT_NEWKEYPASS:
|
||||
opt_newkeypass = opt_str("newkeypass");
|
||||
break;
|
||||
case OPT_SUBJECT:
|
||||
opt_subject = opt_str("subject");
|
||||
break;
|
||||
case OPT_ISSUER:
|
||||
opt_issuer = opt_str("issuer");
|
||||
break;
|
||||
case OPT_DAYS:
|
||||
if ((opt_days = opt_nat()) < 0)
|
||||
goto opt_err;
|
||||
break;
|
||||
case OPT_REQEXTS:
|
||||
opt_reqexts = opt_str("reqexts");
|
||||
break;
|
||||
case OPT_SANS:
|
||||
opt_sans = opt_str("sans");
|
||||
break;
|
||||
case OPT_SAN_NODEFAULT:
|
||||
opt_san_nodefault = 1;
|
||||
break;
|
||||
case OPT_POLICIES:
|
||||
opt_policies = opt_str("policies");
|
||||
break;
|
||||
case OPT_POLICY_OIDS:
|
||||
opt_policy_oids = opt_str("policy_oids");
|
||||
break;
|
||||
case OPT_POLICY_OIDS_CRITICAL:
|
||||
opt_policy_oids_critical = 1;
|
||||
break;
|
||||
case OPT_POPO:
|
||||
if (!opt_int(opt_arg(), &opt_popo)
|
||||
|| opt_popo < OSSL_CRMF_POPO_NONE
|
||||
|| opt_popo > OSSL_CRMF_POPO_KEYENC) {
|
||||
CMP_err("invalid popo spec. Valid values are -1 .. 2");
|
||||
goto opt_err;
|
||||
}
|
||||
break;
|
||||
case OPT_CSR:
|
||||
opt_csr = opt_arg();
|
||||
break;
|
||||
case OPT_OUT_TRUSTED:
|
||||
opt_out_trusted = opt_str("out_trusted");
|
||||
break;
|
||||
case OPT_IMPLICIT_CONFIRM:
|
||||
opt_implicit_confirm = 1;
|
||||
break;
|
||||
case OPT_DISABLE_CONFIRM:
|
||||
opt_disable_confirm = 1;
|
||||
break;
|
||||
case OPT_CERTOUT:
|
||||
opt_certout = opt_str("certout");
|
||||
break;
|
||||
case OPT_OLDCERT:
|
||||
opt_oldcert = opt_str("oldcert");
|
||||
break;
|
||||
case OPT_REVREASON:
|
||||
if (!opt_int(opt_arg(), &opt_revreason)
|
||||
|| opt_revreason < CRL_REASON_NONE
|
||||
|| opt_revreason > CRL_REASON_AA_COMPROMISE
|
||||
|| opt_revreason == 7) {
|
||||
CMP_err("invalid revreason. Valid values are -1 .. 6, 8 .. 10");
|
||||
goto opt_err;
|
||||
}
|
||||
break;
|
||||
case OPT_CERTFORM:
|
||||
opt_certform_s = opt_str("certform");
|
||||
break;
|
||||
case OPT_KEYFORM:
|
||||
opt_keyform_s = opt_str("keyform");
|
||||
break;
|
||||
case OPT_CERTSFORM:
|
||||
opt_certsform_s = opt_str("certsform");
|
||||
break;
|
||||
case OPT_OTHERPASS:
|
||||
opt_otherpass = opt_str("otherpass");
|
||||
break;
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
case OPT_ENGINE:
|
||||
opt_engine = opt_str("engine");
|
||||
break;
|
||||
#endif
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto opt_err;
|
||||
break;
|
||||
|
||||
case OPT_BATCH:
|
||||
opt_batch = 1;
|
||||
break;
|
||||
case OPT_REPEAT:
|
||||
opt_repeat = opt_nat();
|
||||
break;
|
||||
case OPT_REQIN:
|
||||
opt_reqin = opt_str("reqin");
|
||||
break;
|
||||
case OPT_REQIN_NEW_TID:
|
||||
opt_reqin_new_tid = 1;
|
||||
break;
|
||||
case OPT_REQOUT:
|
||||
opt_reqout = opt_str("reqout");
|
||||
break;
|
||||
case OPT_RSPIN:
|
||||
opt_rspin = opt_str("rspin");
|
||||
break;
|
||||
case OPT_RSPOUT:
|
||||
opt_rspout = opt_str("rspout");
|
||||
break;
|
||||
case OPT_USE_MOCK_SRV:
|
||||
opt_use_mock_srv = 1;
|
||||
break;
|
||||
case OPT_PORT:
|
||||
opt_port = opt_str("port");
|
||||
break;
|
||||
case OPT_MAX_MSGS:
|
||||
if ((opt_max_msgs = opt_nat()) < 0)
|
||||
goto opt_err;
|
||||
break;
|
||||
case OPT_SRV_REF:
|
||||
opt_srv_ref = opt_str("srv_ref");
|
||||
break;
|
||||
case OPT_SRV_SECRET:
|
||||
opt_srv_secret = opt_str("srv_secret");
|
||||
break;
|
||||
case OPT_SRV_CERT:
|
||||
opt_srv_cert = opt_str("srv_cert");
|
||||
break;
|
||||
case OPT_SRV_KEY:
|
||||
opt_srv_key = opt_str("srv_key");
|
||||
break;
|
||||
case OPT_SRV_KEYPASS:
|
||||
opt_srv_keypass = opt_str("srv_keypass");
|
||||
break;
|
||||
case OPT_SRV_TRUSTED:
|
||||
opt_srv_trusted = opt_str("srv_trusted");
|
||||
break;
|
||||
case OPT_SRV_UNTRUSTED:
|
||||
opt_srv_untrusted = opt_str("srv_untrusted");
|
||||
break;
|
||||
case OPT_RSP_CERT:
|
||||
opt_rsp_cert = opt_str("rsp_cert");
|
||||
break;
|
||||
case OPT_RSP_EXTRACERTS:
|
||||
opt_rsp_extracerts = opt_str("rsp_extracerts");
|
||||
break;
|
||||
case OPT_RSP_CAPUBS:
|
||||
opt_rsp_capubs = opt_str("rsp_capubs");
|
||||
break;
|
||||
case OPT_POLL_COUNT:
|
||||
opt_poll_count = opt_nat();
|
||||
break;
|
||||
case OPT_CHECK_AFTER:
|
||||
opt_check_after = opt_nat();
|
||||
break;
|
||||
case OPT_GRANT_IMPLICITCONF:
|
||||
opt_grant_implicitconf = 1;
|
||||
break;
|
||||
case OPT_PKISTATUS:
|
||||
opt_pkistatus = opt_nat();
|
||||
break;
|
||||
case OPT_FAILURE:
|
||||
opt_failure = opt_nat();
|
||||
break;
|
||||
case OPT_FAILUREBITS:
|
||||
opt_failurebits = opt_nat();
|
||||
break;
|
||||
case OPT_STATUSSTRING:
|
||||
opt_statusstring = opt_str("statusstring");
|
||||
break;
|
||||
case OPT_SEND_ERROR:
|
||||
opt_send_error = 1;
|
||||
break;
|
||||
case OPT_SEND_UNPROTECTED:
|
||||
opt_send_unprotected = 1;
|
||||
break;
|
||||
case OPT_SEND_UNPROT_ERR:
|
||||
opt_send_unprot_err = 1;
|
||||
break;
|
||||
case OPT_ACCEPT_UNPROTECTED:
|
||||
opt_accept_unprotected = 1;
|
||||
break;
|
||||
case OPT_ACCEPT_UNPROT_ERR:
|
||||
opt_accept_unprot_err = 1;
|
||||
break;
|
||||
case OPT_ACCEPT_RAVERIFIED:
|
||||
opt_accept_raverified = 1;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
argv = opt_rest();
|
||||
if (argc != 0) {
|
||||
CMP_err1("unknown parameter %s", argv[0]);
|
||||
goto opt_err;
|
||||
}
|
||||
return 1;
|
||||
|
||||
opt_err:
|
||||
CMP_err1("use -help for summary of '%s' options", prog);
|
||||
return 0;
|
||||
}
|
||||
|
||||
int cmp_main(int argc, char **argv)
|
||||
{
|
||||
char *configfile = NULL;
|
||||
int i;
|
||||
X509 *newcert = NULL;
|
||||
ENGINE *e = NULL;
|
||||
char mock_server[] = "mock server:1";
|
||||
int ret = 0; /* default: failure */
|
||||
|
||||
if (argc <= 1) {
|
||||
opt_help(cmp_options);
|
||||
goto err;
|
||||
}
|
||||
|
||||
/*
|
||||
* handle OPT_CONFIG and OPT_SECTION upfront to take effect for other opts
|
||||
*/
|
||||
for (i = 1; i < argc - 1; i++) {
|
||||
if (*argv[i] == '-') {
|
||||
if (!strcmp(argv[i] + 1, cmp_options[OPT_CONFIG - OPT_HELP].name))
|
||||
opt_config = argv[i + 1];
|
||||
else if (!strcmp(argv[i] + 1,
|
||||
cmp_options[OPT_SECTION - OPT_HELP].name))
|
||||
opt_section = argv[i + 1];
|
||||
}
|
||||
}
|
||||
if (opt_section[0] == '\0') /* empty string */
|
||||
opt_section = DEFAULT_SECTION;
|
||||
|
||||
vpm = X509_VERIFY_PARAM_new();
|
||||
if (vpm == NULL) {
|
||||
CMP_err("out of memory");
|
||||
goto err;
|
||||
}
|
||||
|
||||
/* read default values for options from config file */
|
||||
configfile = opt_config != NULL ? opt_config : default_config_file;
|
||||
if (configfile && configfile[0] != '\0' /* non-empty string */
|
||||
&& (configfile != default_config_file
|
||||
|| access(configfile, F_OK) != -1)) {
|
||||
CMP_info1("using OpenSSL configuration file '%s'", configfile);
|
||||
conf = app_load_config(configfile);
|
||||
if (conf == NULL) {
|
||||
goto err;
|
||||
} else {
|
||||
if (strcmp(opt_section, CMP_SECTION) == 0) { /* default */
|
||||
if (!NCONF_get_section(conf, opt_section))
|
||||
CMP_info2("no [%s] section found in config file '%s';"
|
||||
" will thus use just [default] and unnamed section if present",
|
||||
opt_section, configfile);
|
||||
} else {
|
||||
const char *end = opt_section + strlen(opt_section);
|
||||
while ((end = prev_item(opt_section, end)) != NULL) {
|
||||
if (!NCONF_get_section(conf, opt_item)) {
|
||||
CMP_err2("no [%s] section found in config file '%s'",
|
||||
opt_item, configfile);
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
}
|
||||
if (!read_config())
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
(void)BIO_flush(bio_err); /* prevent interference with opt_help() */
|
||||
|
||||
ret = get_opts(argc, argv);
|
||||
if (ret <= 0)
|
||||
goto err;
|
||||
ret = 0;
|
||||
|
||||
if (opt_batch) {
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
UI_METHOD *ui_fallback_method;
|
||||
# ifndef OPENSSL_NO_UI_CONSOLE
|
||||
ui_fallback_method = UI_OpenSSL();
|
||||
# else
|
||||
ui_fallback_method = (UI_METHOD *)UI_null();
|
||||
# endif
|
||||
UI_method_set_reader(ui_fallback_method, NULL);
|
||||
#endif
|
||||
}
|
||||
|
||||
if (opt_engine != NULL)
|
||||
e = setup_engine_methods(opt_engine, 0 /* not: ENGINE_METHOD_ALL */, 0);
|
||||
|
||||
if (opt_port != NULL) {
|
||||
if (opt_use_mock_srv) {
|
||||
CMP_err("cannot use both -port and -use_mock_srv options");
|
||||
goto err;
|
||||
}
|
||||
if (opt_server != NULL) {
|
||||
CMP_err("cannot use both -port and -server options");
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
|
||||
if ((cmp_ctx = OSSL_CMP_CTX_new()) == NULL) {
|
||||
CMP_err("out of memory");
|
||||
goto err;
|
||||
}
|
||||
if (!OSSL_CMP_CTX_set_log_cb(cmp_ctx, print_to_bio_out)) {
|
||||
CMP_err1("cannot set up error reporting and logging for %s", prog);
|
||||
goto err;
|
||||
}
|
||||
if ((opt_use_mock_srv || opt_port != NULL)) {
|
||||
OSSL_CMP_SRV_CTX *srv_ctx;
|
||||
|
||||
if ((srv_ctx = setup_srv_ctx(e)) == NULL)
|
||||
goto err;
|
||||
OSSL_CMP_CTX_set_transfer_cb_arg(cmp_ctx, srv_ctx);
|
||||
if (!OSSL_CMP_CTX_set_log_cb(OSSL_CMP_SRV_CTX_get0_cmp_ctx(srv_ctx),
|
||||
print_to_bio_out)) {
|
||||
CMP_err1("cannot set up error reporting and logging for %s", prog);
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
if (opt_port != NULL) { /* act as very basic CMP HTTP server */
|
||||
#ifdef OPENSSL_NO_SOCK
|
||||
BIO_printf(bio_err, "Cannot act as server - sockets not supported\n");
|
||||
#else
|
||||
BIO *acbio;
|
||||
BIO *cbio = NULL;
|
||||
int msgs = 0;
|
||||
|
||||
if ((acbio = http_server_init_bio(prog, opt_port)) == NULL)
|
||||
goto err;
|
||||
while (opt_max_msgs <= 0 || msgs < opt_max_msgs) {
|
||||
char *path = NULL;
|
||||
OSSL_CMP_MSG *req = NULL;
|
||||
OSSL_CMP_MSG *resp = NULL;
|
||||
|
||||
ret = http_server_get_asn1_req(ASN1_ITEM_rptr(OSSL_CMP_MSG),
|
||||
(ASN1_VALUE **)&req, &path,
|
||||
&cbio, acbio, prog, 0, 0);
|
||||
if (ret == 0)
|
||||
continue;
|
||||
if (ret++ == -1)
|
||||
break; /* fatal error */
|
||||
|
||||
ret = 0;
|
||||
msgs++;
|
||||
if (req != NULL) {
|
||||
if (strcmp(path, "") != 0 && strcmp(path, "pkix/") != 0) {
|
||||
(void)http_server_send_status(cbio, 404, "Not Found");
|
||||
CMP_err1("Expecting empty path or 'pkix/' but got '%s'",
|
||||
path);
|
||||
OPENSSL_free(path);
|
||||
OSSL_CMP_MSG_free(req);
|
||||
goto cont;
|
||||
}
|
||||
OPENSSL_free(path);
|
||||
resp = OSSL_CMP_CTX_server_perform(cmp_ctx, req);
|
||||
OSSL_CMP_MSG_free(req);
|
||||
if (resp == NULL) {
|
||||
(void)http_server_send_status(cbio,
|
||||
500, "Internal Server Error");
|
||||
break; /* treated as fatal error */
|
||||
}
|
||||
ret = http_server_send_asn1_resp(cbio, "application/pkixcmp",
|
||||
ASN1_ITEM_rptr(OSSL_CMP_MSG),
|
||||
(const ASN1_VALUE *)resp);
|
||||
OSSL_CMP_MSG_free(resp);
|
||||
if (!ret)
|
||||
break; /* treated as fatal error */
|
||||
} else {
|
||||
(void)http_server_send_status(cbio, 400, "Bad Request");
|
||||
}
|
||||
cont:
|
||||
BIO_free_all(cbio);
|
||||
cbio = NULL;
|
||||
}
|
||||
BIO_free_all(cbio);
|
||||
BIO_free_all(acbio);
|
||||
#endif
|
||||
goto err;
|
||||
}
|
||||
/* else act as CMP client */
|
||||
|
||||
if (opt_use_mock_srv) {
|
||||
if (opt_server != NULL) {
|
||||
CMP_err("cannot use both -use_mock_srv and -server options");
|
||||
goto err;
|
||||
}
|
||||
if (opt_proxy != NULL) {
|
||||
CMP_err("cannot use both -use_mock_srv and -proxy options");
|
||||
goto err;
|
||||
}
|
||||
opt_server = mock_server;
|
||||
opt_proxy = "API";
|
||||
} else {
|
||||
if (opt_server == NULL) {
|
||||
CMP_err("missing -server option");
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
|
||||
if (!setup_client_ctx(cmp_ctx, e)) {
|
||||
CMP_err("cannot set up CMP context");
|
||||
goto err;
|
||||
}
|
||||
for (i = 0; i < opt_repeat; i++) {
|
||||
/* everything is ready, now connect and perform the command! */
|
||||
switch (opt_cmd) {
|
||||
case CMP_IR:
|
||||
newcert = OSSL_CMP_exec_IR_ses(cmp_ctx);
|
||||
if (newcert == NULL)
|
||||
goto err;
|
||||
break;
|
||||
case CMP_KUR:
|
||||
newcert = OSSL_CMP_exec_KUR_ses(cmp_ctx);
|
||||
if (newcert == NULL)
|
||||
goto err;
|
||||
break;
|
||||
case CMP_CR:
|
||||
newcert = OSSL_CMP_exec_CR_ses(cmp_ctx);
|
||||
if (newcert == NULL)
|
||||
goto err;
|
||||
break;
|
||||
case CMP_P10CR:
|
||||
newcert = OSSL_CMP_exec_P10CR_ses(cmp_ctx);
|
||||
if (newcert == NULL)
|
||||
goto err;
|
||||
break;
|
||||
case CMP_RR:
|
||||
if (OSSL_CMP_exec_RR_ses(cmp_ctx) == NULL)
|
||||
goto err;
|
||||
break;
|
||||
case CMP_GENM:
|
||||
{
|
||||
STACK_OF(OSSL_CMP_ITAV) *itavs;
|
||||
|
||||
if (opt_infotype != NID_undef) {
|
||||
OSSL_CMP_ITAV *itav =
|
||||
OSSL_CMP_ITAV_create(OBJ_nid2obj(opt_infotype), NULL);
|
||||
if (itav == NULL)
|
||||
goto err;
|
||||
OSSL_CMP_CTX_push0_genm_ITAV(cmp_ctx, itav);
|
||||
}
|
||||
|
||||
if ((itavs = OSSL_CMP_exec_GENM_ses(cmp_ctx)) == NULL)
|
||||
goto err;
|
||||
print_itavs(itavs);
|
||||
sk_OSSL_CMP_ITAV_pop_free(itavs, OSSL_CMP_ITAV_free);
|
||||
break;
|
||||
}
|
||||
default:
|
||||
break;
|
||||
}
|
||||
|
||||
{
|
||||
/* print PKIStatusInfo (this is in case there has been no error) */
|
||||
int status = OSSL_CMP_CTX_get_status(cmp_ctx);
|
||||
char *buf = app_malloc(OSSL_CMP_PKISI_BUFLEN, "PKIStatusInfo buf");
|
||||
const char *string =
|
||||
OSSL_CMP_CTX_snprint_PKIStatus(cmp_ctx, buf,
|
||||
OSSL_CMP_PKISI_BUFLEN);
|
||||
|
||||
CMP_print(bio_err,
|
||||
status == OSSL_CMP_PKISTATUS_accepted ? "info" :
|
||||
status == OSSL_CMP_PKISTATUS_rejection ? "server error" :
|
||||
status == OSSL_CMP_PKISTATUS_waiting ? "internal error"
|
||||
: "warning",
|
||||
"received from %s %s %s", opt_server,
|
||||
string != NULL ? string : "<unknown PKIStatus>", "");
|
||||
OPENSSL_free(buf);
|
||||
}
|
||||
|
||||
if (opt_cacertsout != NULL) {
|
||||
STACK_OF(X509) *certs = OSSL_CMP_CTX_get1_caPubs(cmp_ctx);
|
||||
|
||||
if (sk_X509_num(certs) > 0
|
||||
&& save_certs(cmp_ctx, certs, opt_cacertsout, "CA") < 0) {
|
||||
sk_X509_pop_free(certs, X509_free);
|
||||
goto err;
|
||||
}
|
||||
sk_X509_pop_free(certs, X509_free);
|
||||
}
|
||||
|
||||
if (opt_extracertsout != NULL) {
|
||||
STACK_OF(X509) *certs = OSSL_CMP_CTX_get1_extraCertsIn(cmp_ctx);
|
||||
if (sk_X509_num(certs) > 0
|
||||
&& save_certs(cmp_ctx, certs, opt_extracertsout,
|
||||
"extra") < 0) {
|
||||
sk_X509_pop_free(certs, X509_free);
|
||||
goto err;
|
||||
}
|
||||
sk_X509_pop_free(certs, X509_free);
|
||||
}
|
||||
|
||||
if (opt_certout != NULL && newcert != NULL) {
|
||||
STACK_OF(X509) *certs = sk_X509_new_null();
|
||||
|
||||
if (certs == NULL || !sk_X509_push(certs, newcert)
|
||||
|| save_certs(cmp_ctx, certs, opt_certout,
|
||||
"enrolled") < 0) {
|
||||
sk_X509_free(certs);
|
||||
goto err;
|
||||
}
|
||||
sk_X509_free(certs);
|
||||
}
|
||||
if (!OSSL_CMP_CTX_reinit(cmp_ctx))
|
||||
goto err;
|
||||
}
|
||||
ret = 1;
|
||||
|
||||
err:
|
||||
/* in case we ended up here on error without proper cleaning */
|
||||
cleanse(opt_keypass);
|
||||
cleanse(opt_newkeypass);
|
||||
cleanse(opt_otherpass);
|
||||
cleanse(opt_tls_keypass);
|
||||
cleanse(opt_secret);
|
||||
cleanse(opt_srv_keypass);
|
||||
cleanse(opt_srv_secret);
|
||||
|
||||
if (ret != 1)
|
||||
OSSL_CMP_CTX_print_errors(cmp_ctx);
|
||||
|
||||
ossl_cmp_mock_srv_free(OSSL_CMP_CTX_get_transfer_cb_arg(cmp_ctx));
|
||||
{
|
||||
APP_HTTP_TLS_INFO *http_tls_info =
|
||||
OSSL_CMP_CTX_get_http_cb_arg(cmp_ctx);
|
||||
|
||||
if (http_tls_info != NULL) {
|
||||
SSL_CTX_free(http_tls_info->ssl_ctx);
|
||||
OPENSSL_free(http_tls_info);
|
||||
}
|
||||
}
|
||||
X509_STORE_free(OSSL_CMP_CTX_get_certConf_cb_arg(cmp_ctx));
|
||||
OSSL_CMP_CTX_free(cmp_ctx);
|
||||
X509_VERIFY_PARAM_free(vpm);
|
||||
release_engine(e);
|
||||
|
||||
NCONF_free(conf); /* must not do as long as opt_... variables are used */
|
||||
OSSL_CMP_log_close();
|
||||
|
||||
return ret == 0 ? EXIT_FAILURE : EXIT_SUCCESS;
|
||||
}
|
||||
@@ -0,0 +1,412 @@
|
||||
/*
|
||||
* Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright Siemens AG 2018-2020
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or atf
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include "apps.h"
|
||||
#include "cmp_mock_srv.h"
|
||||
|
||||
#include <openssl/cmp.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/cmperr.h>
|
||||
|
||||
DEFINE_STACK_OF(X509)
|
||||
DEFINE_STACK_OF(OSSL_CMP_ITAV)
|
||||
DEFINE_STACK_OF(ASN1_UTF8STRING)
|
||||
|
||||
/* the context for the CMP mock server */
|
||||
typedef struct
|
||||
{
|
||||
X509 *certOut; /* certificate to be returned in cp/ip/kup msg */
|
||||
STACK_OF(X509) *chainOut; /* chain of certOut to add to extraCerts field */
|
||||
STACK_OF(X509) *caPubsOut; /* certs to return in caPubs field of ip msg */
|
||||
OSSL_CMP_PKISI *statusOut; /* status for ip/cp/kup/rp msg unless polling */
|
||||
int sendError; /* send error response also on valid requests */
|
||||
OSSL_CMP_MSG *certReq; /* ir/cr/p10cr/kur remembered while polling */
|
||||
int certReqId; /* id of last ir/cr/kur, used for polling */
|
||||
int pollCount; /* number of polls before actual cert response */
|
||||
int checkAfterTime; /* time the client should wait between polling */
|
||||
} mock_srv_ctx;
|
||||
|
||||
|
||||
static void mock_srv_ctx_free(mock_srv_ctx *ctx)
|
||||
{
|
||||
if (ctx == NULL)
|
||||
return;
|
||||
|
||||
OSSL_CMP_PKISI_free(ctx->statusOut);
|
||||
X509_free(ctx->certOut);
|
||||
sk_X509_pop_free(ctx->chainOut, X509_free);
|
||||
sk_X509_pop_free(ctx->caPubsOut, X509_free);
|
||||
OSSL_CMP_MSG_free(ctx->certReq);
|
||||
OPENSSL_free(ctx);
|
||||
}
|
||||
|
||||
static mock_srv_ctx *mock_srv_ctx_new(void)
|
||||
{
|
||||
mock_srv_ctx *ctx = OPENSSL_zalloc(sizeof(mock_srv_ctx));
|
||||
|
||||
if (ctx == NULL)
|
||||
goto err;
|
||||
|
||||
if ((ctx->statusOut = OSSL_CMP_PKISI_new()) == NULL)
|
||||
goto err;
|
||||
|
||||
ctx->certReqId = -1;
|
||||
|
||||
/* all other elements are initialized to 0 or NULL, respectively */
|
||||
return ctx;
|
||||
err:
|
||||
mock_srv_ctx_free(ctx);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
int ossl_cmp_mock_srv_set1_certOut(OSSL_CMP_SRV_CTX *srv_ctx, X509 *cert)
|
||||
{
|
||||
mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
|
||||
|
||||
if (ctx == NULL) {
|
||||
CMPerr(0, CMP_R_NULL_ARGUMENT);
|
||||
return 0;
|
||||
}
|
||||
if (cert == NULL || X509_up_ref(cert)) {
|
||||
X509_free(ctx->certOut);
|
||||
ctx->certOut = cert;
|
||||
return 1;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
int ossl_cmp_mock_srv_set1_chainOut(OSSL_CMP_SRV_CTX *srv_ctx,
|
||||
STACK_OF(X509) *chain)
|
||||
{
|
||||
mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
|
||||
STACK_OF(X509) *chain_copy = NULL;
|
||||
|
||||
if (ctx == NULL) {
|
||||
CMPerr(0, CMP_R_NULL_ARGUMENT);
|
||||
return 0;
|
||||
}
|
||||
if (chain != NULL && (chain_copy = X509_chain_up_ref(chain)) == NULL)
|
||||
return 0;
|
||||
sk_X509_pop_free(ctx->chainOut, X509_free);
|
||||
ctx->chainOut = chain_copy;
|
||||
return 1;
|
||||
}
|
||||
|
||||
int ossl_cmp_mock_srv_set1_caPubsOut(OSSL_CMP_SRV_CTX *srv_ctx,
|
||||
STACK_OF(X509) *caPubs)
|
||||
{
|
||||
mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
|
||||
STACK_OF(X509) *caPubs_copy = NULL;
|
||||
|
||||
if (ctx == NULL) {
|
||||
CMPerr(0, CMP_R_NULL_ARGUMENT);
|
||||
return 0;
|
||||
}
|
||||
if (caPubs != NULL && (caPubs_copy = X509_chain_up_ref(caPubs)) == NULL)
|
||||
return 0;
|
||||
sk_X509_pop_free(ctx->caPubsOut, X509_free);
|
||||
ctx->caPubsOut = caPubs_copy;
|
||||
return 1;
|
||||
}
|
||||
|
||||
int ossl_cmp_mock_srv_set_statusInfo(OSSL_CMP_SRV_CTX *srv_ctx, int status,
|
||||
int fail_info, const char *text)
|
||||
{
|
||||
mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
|
||||
OSSL_CMP_PKISI *si;
|
||||
|
||||
if (ctx == NULL) {
|
||||
CMPerr(0, CMP_R_NULL_ARGUMENT);
|
||||
return 0;
|
||||
}
|
||||
if ((si = OSSL_CMP_STATUSINFO_new(status, fail_info, text)) == NULL)
|
||||
return 0;
|
||||
OSSL_CMP_PKISI_free(ctx->statusOut);
|
||||
ctx->statusOut = si;
|
||||
return 1;
|
||||
}
|
||||
|
||||
int ossl_cmp_mock_srv_set_send_error(OSSL_CMP_SRV_CTX *srv_ctx, int val)
|
||||
{
|
||||
mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
|
||||
|
||||
if (ctx == NULL) {
|
||||
CMPerr(0, CMP_R_NULL_ARGUMENT);
|
||||
return 0;
|
||||
}
|
||||
ctx->sendError = val != 0;
|
||||
return 1;
|
||||
}
|
||||
|
||||
int ossl_cmp_mock_srv_set_pollCount(OSSL_CMP_SRV_CTX *srv_ctx, int count)
|
||||
{
|
||||
mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
|
||||
|
||||
if (ctx == NULL) {
|
||||
CMPerr(0, CMP_R_NULL_ARGUMENT);
|
||||
return 0;
|
||||
}
|
||||
if (count < 0) {
|
||||
CMPerr(0, CMP_R_INVALID_ARGS);
|
||||
return 0;
|
||||
}
|
||||
ctx->pollCount = count;
|
||||
return 1;
|
||||
}
|
||||
|
||||
int ossl_cmp_mock_srv_set_checkAfterTime(OSSL_CMP_SRV_CTX *srv_ctx, int sec)
|
||||
{
|
||||
mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
|
||||
|
||||
if (ctx == NULL) {
|
||||
CMPerr(0, CMP_R_NULL_ARGUMENT);
|
||||
return 0;
|
||||
}
|
||||
ctx->checkAfterTime = sec;
|
||||
return 1;
|
||||
}
|
||||
|
||||
static OSSL_CMP_PKISI *process_cert_request(OSSL_CMP_SRV_CTX *srv_ctx,
|
||||
const OSSL_CMP_MSG *cert_req,
|
||||
int certReqId,
|
||||
const OSSL_CRMF_MSG *crm,
|
||||
const X509_REQ *p10cr,
|
||||
X509 **certOut,
|
||||
STACK_OF(X509) **chainOut,
|
||||
STACK_OF(X509) **caPubs)
|
||||
{
|
||||
mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
|
||||
OSSL_CMP_PKISI *si = NULL;
|
||||
|
||||
if (ctx == NULL || cert_req == NULL
|
||||
|| certOut == NULL || chainOut == NULL || caPubs == NULL) {
|
||||
CMPerr(0, CMP_R_NULL_ARGUMENT);
|
||||
return NULL;
|
||||
}
|
||||
if (ctx->sendError) {
|
||||
CMPerr(0, CMP_R_ERROR_PROCESSING_MESSAGE);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
*certOut = NULL;
|
||||
*chainOut = NULL;
|
||||
*caPubs = NULL;
|
||||
ctx->certReqId = certReqId;
|
||||
if (ctx->pollCount > 0) {
|
||||
ctx->pollCount--;
|
||||
OSSL_CMP_MSG_free(ctx->certReq);
|
||||
if ((ctx->certReq = OSSL_CMP_MSG_dup(cert_req)) == NULL)
|
||||
return NULL;
|
||||
return OSSL_CMP_STATUSINFO_new(OSSL_CMP_PKISTATUS_waiting, 0, NULL);
|
||||
}
|
||||
if (ctx->certOut != NULL
|
||||
&& (*certOut = X509_dup(ctx->certOut)) == NULL)
|
||||
/* TODO better return a cert produced from data in request template */
|
||||
goto err;
|
||||
if (ctx->chainOut != NULL
|
||||
&& (*chainOut = X509_chain_up_ref(ctx->chainOut)) == NULL)
|
||||
goto err;
|
||||
if (ctx->caPubsOut != NULL
|
||||
&& (*caPubs = X509_chain_up_ref(ctx->caPubsOut)) == NULL)
|
||||
goto err;
|
||||
if (ctx->statusOut != NULL
|
||||
&& (si = OSSL_CMP_PKISI_dup(ctx->statusOut)) == NULL)
|
||||
goto err;
|
||||
return si;
|
||||
|
||||
err:
|
||||
X509_free(*certOut);
|
||||
*certOut = NULL;
|
||||
sk_X509_pop_free(*chainOut, X509_free);
|
||||
*chainOut = NULL;
|
||||
sk_X509_pop_free(*caPubs, X509_free);
|
||||
*caPubs = NULL;
|
||||
return NULL;
|
||||
}
|
||||
|
||||
static OSSL_CMP_PKISI *process_rr(OSSL_CMP_SRV_CTX *srv_ctx,
|
||||
const OSSL_CMP_MSG *rr,
|
||||
const X509_NAME *issuer,
|
||||
const ASN1_INTEGER *serial)
|
||||
{
|
||||
mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
|
||||
|
||||
if (ctx == NULL || rr == NULL || issuer == NULL || serial == NULL) {
|
||||
CMPerr(0, CMP_R_NULL_ARGUMENT);
|
||||
return NULL;
|
||||
}
|
||||
if (ctx->sendError || ctx->certOut == NULL) {
|
||||
CMPerr(0, CMP_R_ERROR_PROCESSING_MESSAGE);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/* accept revocation only for the certificate we sent in ir/cr/kur */
|
||||
if (X509_NAME_cmp(issuer, X509_get_issuer_name(ctx->certOut)) != 0
|
||||
|| ASN1_INTEGER_cmp(serial,
|
||||
X509_get0_serialNumber(ctx->certOut)) != 0) {
|
||||
CMPerr(0, CMP_R_REQUEST_NOT_ACCEPTED);
|
||||
return NULL;
|
||||
}
|
||||
return OSSL_CMP_PKISI_dup(ctx->statusOut);
|
||||
}
|
||||
|
||||
static int process_genm(OSSL_CMP_SRV_CTX *srv_ctx,
|
||||
const OSSL_CMP_MSG *genm,
|
||||
const STACK_OF(OSSL_CMP_ITAV) *in,
|
||||
STACK_OF(OSSL_CMP_ITAV) **out)
|
||||
{
|
||||
mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
|
||||
|
||||
if (ctx == NULL || genm == NULL || in == NULL || out == NULL) {
|
||||
CMPerr(0, CMP_R_NULL_ARGUMENT);
|
||||
return 0;
|
||||
}
|
||||
if (ctx->sendError) {
|
||||
CMPerr(0, CMP_R_ERROR_PROCESSING_MESSAGE);
|
||||
return 0;
|
||||
}
|
||||
|
||||
*out = sk_OSSL_CMP_ITAV_deep_copy(in, OSSL_CMP_ITAV_dup,
|
||||
OSSL_CMP_ITAV_free);
|
||||
return *out != NULL;
|
||||
}
|
||||
|
||||
static void process_error(OSSL_CMP_SRV_CTX *srv_ctx, const OSSL_CMP_MSG *error,
|
||||
const OSSL_CMP_PKISI *statusInfo,
|
||||
const ASN1_INTEGER *errorCode,
|
||||
const OSSL_CMP_PKIFREETEXT *errorDetails)
|
||||
{
|
||||
mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
|
||||
char buf[OSSL_CMP_PKISI_BUFLEN];
|
||||
char *sibuf;
|
||||
int i;
|
||||
|
||||
if (ctx == NULL || error == NULL) {
|
||||
CMPerr(0, CMP_R_NULL_ARGUMENT);
|
||||
return;
|
||||
}
|
||||
|
||||
BIO_printf(bio_err, "mock server received error:\n");
|
||||
|
||||
if (statusInfo == NULL) {
|
||||
BIO_printf(bio_err, "pkiStatusInfo absent\n");
|
||||
} else {
|
||||
sibuf = OSSL_CMP_snprint_PKIStatusInfo(statusInfo, buf, sizeof(buf));
|
||||
BIO_printf(bio_err, "pkiStatusInfo: %s\n",
|
||||
sibuf != NULL ? sibuf: "<invalid>");
|
||||
}
|
||||
|
||||
if (errorCode == NULL)
|
||||
BIO_printf(bio_err, "errorCode absent\n");
|
||||
else
|
||||
BIO_printf(bio_err, "errorCode: %ld\n", ASN1_INTEGER_get(errorCode));
|
||||
|
||||
if (sk_ASN1_UTF8STRING_num(errorDetails) <= 0) {
|
||||
BIO_printf(bio_err, "errorDetails absent\n");
|
||||
} else {
|
||||
/* TODO could use sk_ASN1_UTF8STRING2text() if exported */
|
||||
BIO_printf(bio_err, "errorDetails: ");
|
||||
for (i = 0; i < sk_ASN1_UTF8STRING_num(errorDetails); i++) {
|
||||
if (i > 0)
|
||||
BIO_printf(bio_err, ", ");
|
||||
BIO_printf(bio_err, "\"");
|
||||
ASN1_STRING_print(bio_err,
|
||||
sk_ASN1_UTF8STRING_value(errorDetails, i));
|
||||
BIO_printf(bio_err, "\"");
|
||||
}
|
||||
BIO_printf(bio_err, "\n");
|
||||
}
|
||||
}
|
||||
|
||||
static int process_certConf(OSSL_CMP_SRV_CTX *srv_ctx,
|
||||
const OSSL_CMP_MSG *certConf, int certReqId,
|
||||
const ASN1_OCTET_STRING *certHash,
|
||||
const OSSL_CMP_PKISI *si)
|
||||
{
|
||||
mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
|
||||
ASN1_OCTET_STRING *digest;
|
||||
|
||||
if (ctx == NULL || certConf == NULL || certHash == NULL) {
|
||||
CMPerr(0, CMP_R_NULL_ARGUMENT);
|
||||
return 0;
|
||||
}
|
||||
if (ctx->sendError || ctx->certOut == NULL) {
|
||||
CMPerr(0, CMP_R_ERROR_PROCESSING_MESSAGE);
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (certReqId != ctx->certReqId) {
|
||||
/* in case of error, invalid reqId -1 */
|
||||
CMPerr(0, CMP_R_BAD_REQUEST_ID);
|
||||
return 0;
|
||||
}
|
||||
|
||||
if ((digest = X509_digest_sig(ctx->certOut)) == NULL)
|
||||
return 0;
|
||||
if (ASN1_OCTET_STRING_cmp(certHash, digest) != 0) {
|
||||
ASN1_OCTET_STRING_free(digest);
|
||||
CMPerr(0, CMP_R_CERTHASH_UNMATCHED);
|
||||
return 0;
|
||||
}
|
||||
ASN1_OCTET_STRING_free(digest);
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int process_pollReq(OSSL_CMP_SRV_CTX *srv_ctx,
|
||||
const OSSL_CMP_MSG *pollReq, int certReqId,
|
||||
OSSL_CMP_MSG **certReq, int64_t *check_after)
|
||||
{
|
||||
mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
|
||||
|
||||
if (ctx == NULL || pollReq == NULL
|
||||
|| certReq == NULL || check_after == NULL) {
|
||||
CMPerr(0, CMP_R_NULL_ARGUMENT);
|
||||
return 0;
|
||||
}
|
||||
if (ctx->sendError || ctx->certReq == NULL) {
|
||||
*certReq = NULL;
|
||||
CMPerr(0, CMP_R_ERROR_PROCESSING_MESSAGE);
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (ctx->pollCount == 0) {
|
||||
*certReq = ctx->certReq;
|
||||
ctx->certReq = NULL;
|
||||
*check_after = 0;
|
||||
} else {
|
||||
ctx->pollCount--;
|
||||
*certReq = NULL;
|
||||
*check_after = ctx->checkAfterTime;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
OSSL_CMP_SRV_CTX *ossl_cmp_mock_srv_new(void)
|
||||
{
|
||||
OSSL_CMP_SRV_CTX *srv_ctx = OSSL_CMP_SRV_CTX_new();
|
||||
mock_srv_ctx *ctx = mock_srv_ctx_new();
|
||||
|
||||
if (srv_ctx != NULL && ctx != NULL
|
||||
&& OSSL_CMP_SRV_CTX_init(srv_ctx, ctx, process_cert_request,
|
||||
process_rr, process_genm, process_error,
|
||||
process_certConf, process_pollReq))
|
||||
return srv_ctx;
|
||||
|
||||
mock_srv_ctx_free(ctx);
|
||||
OSSL_CMP_SRV_CTX_free(srv_ctx);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
void ossl_cmp_mock_srv_free(OSSL_CMP_SRV_CTX *srv_ctx)
|
||||
{
|
||||
if (srv_ctx != NULL)
|
||||
mock_srv_ctx_free(OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx));
|
||||
OSSL_CMP_SRV_CTX_free(srv_ctx);
|
||||
}
|
||||
@@ -0,0 +1,34 @@
|
||||
/*
|
||||
* Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright Siemens AG 2018-2020
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#ifndef OSSL_APPS_CMP_MOCK_SRV_H
|
||||
# define OSSL_APPS_CMP_MOCK_SRV_H
|
||||
|
||||
# include <openssl/opensslconf.h>
|
||||
# ifndef OPENSSL_NO_CMP
|
||||
|
||||
# include <openssl/cmp.h>
|
||||
|
||||
OSSL_CMP_SRV_CTX *ossl_cmp_mock_srv_new(void);
|
||||
void ossl_cmp_mock_srv_free(OSSL_CMP_SRV_CTX *srv_ctx);
|
||||
|
||||
int ossl_cmp_mock_srv_set1_certOut(OSSL_CMP_SRV_CTX *srv_ctx, X509 *cert);
|
||||
int ossl_cmp_mock_srv_set1_chainOut(OSSL_CMP_SRV_CTX *srv_ctx,
|
||||
STACK_OF(X509) *chain);
|
||||
int ossl_cmp_mock_srv_set1_caPubsOut(OSSL_CMP_SRV_CTX *srv_ctx,
|
||||
STACK_OF(X509) *caPubs);
|
||||
int ossl_cmp_mock_srv_set_statusInfo(OSSL_CMP_SRV_CTX *srv_ctx, int status,
|
||||
int fail_info, const char *text);
|
||||
int ossl_cmp_mock_srv_set_send_error(OSSL_CMP_SRV_CTX *srv_ctx, int val);
|
||||
int ossl_cmp_mock_srv_set_pollCount(OSSL_CMP_SRV_CTX *srv_ctx, int count);
|
||||
int ossl_cmp_mock_srv_set_checkAfterTime(OSSL_CMP_SRV_CTX *srv_ctx, int sec);
|
||||
|
||||
# endif /* !defined(OPENSSL_NO_CMP) */
|
||||
#endif /* !defined(OSSL_APPS_CMP_MOCK_SRV_H) */
|
||||
+68
-21
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 2008-2019 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2008-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -23,6 +23,12 @@
|
||||
# include <openssl/x509v3.h>
|
||||
# include <openssl/cms.h>
|
||||
|
||||
DEFINE_STACK_OF(X509)
|
||||
DEFINE_STACK_OF(CMS_SignerInfo)
|
||||
DEFINE_STACK_OF(GENERAL_NAME)
|
||||
DEFINE_STACK_OF(GENERAL_NAMES)
|
||||
DEFINE_STACK_OF_STRING()
|
||||
|
||||
static int save_certs(char *signerfile, STACK_OF(X509) *signers);
|
||||
static int cms_cb(int ok, X509_STORE_CTX *ctx);
|
||||
static void receipt_request_print(CMS_ContentInfo *cms);
|
||||
@@ -81,10 +87,12 @@ typedef enum OPTION_choice {
|
||||
OPT_PASSIN, OPT_TO, OPT_FROM, OPT_SUBJECT, OPT_SIGNER, OPT_RECIP,
|
||||
OPT_CERTSOUT, OPT_MD, OPT_INKEY, OPT_KEYFORM, OPT_KEYOPT, OPT_RR_FROM,
|
||||
OPT_RR_TO, OPT_AES128_WRAP, OPT_AES192_WRAP, OPT_AES256_WRAP,
|
||||
OPT_3DES_WRAP, OPT_ENGINE,
|
||||
OPT_3DES_WRAP, OPT_WRAP, OPT_ENGINE,
|
||||
OPT_R_ENUM,
|
||||
OPT_PROV_ENUM,
|
||||
OPT_V_ENUM,
|
||||
OPT_CIPHER
|
||||
OPT_CIPHER,
|
||||
OPT_ORIGINATOR
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS cms_options[] = {
|
||||
@@ -188,7 +196,7 @@ const OPTIONS cms_options[] = {
|
||||
{"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
|
||||
{"inkey", OPT_INKEY, 's',
|
||||
"Input private key (if not signer or recipient)"},
|
||||
{"keyform", OPT_KEYFORM, 'f', "Input private key format (PEM or ENGINE)"},
|
||||
{"keyform", OPT_KEYFORM, 'f', "Input private key format (ENGINE, other values ignored)"},
|
||||
{"keyopt", OPT_KEYOPT, 's', "Set public key parameters as n:v pairs"},
|
||||
|
||||
OPT_SECTION("Mail header"),
|
||||
@@ -197,6 +205,7 @@ const OPTIONS cms_options[] = {
|
||||
{"from", OPT_FROM, 's', "From address"},
|
||||
{"subject", OPT_SUBJECT, 's', "Subject"},
|
||||
{"signer", OPT_SIGNER, 's', "Signer certificate file"},
|
||||
{"originator", OPT_ORIGINATOR, 's', "Originator certificate file"},
|
||||
{"recip", OPT_RECIP, '<', "Recipient cert file for decryption"},
|
||||
{"receipt_request_from", OPT_RR_FROM, 's',
|
||||
"Create signed receipt request with specified email address"},
|
||||
@@ -214,9 +223,11 @@ const OPTIONS cms_options[] = {
|
||||
# ifndef OPENSSL_NO_DES
|
||||
{"des3-wrap", OPT_3DES_WRAP, '-', "Use 3DES-EDE to wrap key"},
|
||||
# endif
|
||||
{"wrap", OPT_WRAP, 's', "Any wrap cipher to wrap key"},
|
||||
|
||||
OPT_R_OPTIONS,
|
||||
OPT_V_OPTIONS,
|
||||
OPT_PROV_OPTIONS,
|
||||
|
||||
OPT_PARAMETERS(),
|
||||
{"cert", 0, 0, "Recipient certs (optional; used only when encrypting)"},
|
||||
@@ -236,7 +247,7 @@ int cms_main(int argc, char **argv)
|
||||
STACK_OF(OPENSSL_STRING) *rr_to = NULL, *rr_from = NULL;
|
||||
STACK_OF(OPENSSL_STRING) *sksigners = NULL, *skkeys = NULL;
|
||||
STACK_OF(X509) *encerts = NULL, *other = NULL;
|
||||
X509 *cert = NULL, *recip = NULL, *signer = NULL;
|
||||
X509 *cert = NULL, *recip = NULL, *signer = NULL, *originator = NULL;
|
||||
X509_STORE *store = NULL;
|
||||
X509_VERIFY_PARAM *vpm = NULL;
|
||||
char *certfile = NULL, *keyfile = NULL, *contfile = NULL;
|
||||
@@ -244,7 +255,7 @@ int cms_main(int argc, char **argv)
|
||||
char *certsoutfile = NULL;
|
||||
int noCAfile = 0, noCApath = 0, noCAstore = 0;
|
||||
char *infile = NULL, *outfile = NULL, *rctfile = NULL;
|
||||
char *passinarg = NULL, *passin = NULL, *signerfile = NULL, *recipfile = NULL;
|
||||
char *passinarg = NULL, *passin = NULL, *signerfile = NULL, *originatorfile = NULL, *recipfile = NULL;
|
||||
char *to = NULL, *from = NULL, *subject = NULL, *prog;
|
||||
cms_key_param *key_first = NULL, *key_param = NULL;
|
||||
int flags = CMS_DETACHED, noout = 0, print = 0, keyidx = -1, vpmtouched = 0;
|
||||
@@ -535,6 +546,9 @@ int cms_main(int argc, char **argv)
|
||||
}
|
||||
signerfile = opt_arg();
|
||||
break;
|
||||
case OPT_ORIGINATOR:
|
||||
originatorfile = opt_arg();
|
||||
break;
|
||||
case OPT_INKEY:
|
||||
/* If previous -inkey argument add signer to list */
|
||||
if (keyfile != NULL) {
|
||||
@@ -562,7 +576,7 @@ int cms_main(int argc, char **argv)
|
||||
if (operation == SMIME_ENCRYPT) {
|
||||
if (encerts == NULL && (encerts = sk_X509_new_null()) == NULL)
|
||||
goto end;
|
||||
cert = load_cert(opt_arg(), FORMAT_PEM,
|
||||
cert = load_cert(opt_arg(), FORMAT_UNDEF,
|
||||
"recipient certificate file");
|
||||
if (cert == NULL)
|
||||
goto end;
|
||||
@@ -615,6 +629,10 @@ int cms_main(int argc, char **argv)
|
||||
if (!opt_rand(o))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_3DES_WRAP:
|
||||
# ifndef OPENSSL_NO_DES
|
||||
wrap_cipher = EVP_des_ede3_wrap();
|
||||
@@ -629,6 +647,10 @@ int cms_main(int argc, char **argv)
|
||||
case OPT_AES256_WRAP:
|
||||
wrap_cipher = EVP_aes_256_wrap();
|
||||
break;
|
||||
case OPT_WRAP:
|
||||
if (!opt_cipher(opt_unknown(), &wrap_cipher))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
@@ -648,12 +670,18 @@ int cms_main(int argc, char **argv)
|
||||
goto opthelp;
|
||||
}
|
||||
|
||||
if (flags & CMS_CADES) {
|
||||
if (flags & CMS_NOATTR) {
|
||||
if ((flags & CMS_CADES) != 0) {
|
||||
if ((flags & CMS_NOATTR) != 0) {
|
||||
BIO_puts(bio_err, "Incompatible options: "
|
||||
"CAdES required signed attributes\n");
|
||||
goto opthelp;
|
||||
}
|
||||
if (operation == SMIME_VERIFY
|
||||
&& (flags & (CMS_NO_SIGNER_CERT_VERIFY | CMS_NO_ATTR_VERIFY)) != 0) {
|
||||
BIO_puts(bio_err, "Incompatible options: CAdES validation require"
|
||||
" certs and signed attributes validations\n");
|
||||
goto opthelp;
|
||||
}
|
||||
}
|
||||
|
||||
if (operation & SMIME_SIGNERS) {
|
||||
@@ -734,7 +762,7 @@ int cms_main(int argc, char **argv)
|
||||
if ((encerts = sk_X509_new_null()) == NULL)
|
||||
goto end;
|
||||
while (*argv) {
|
||||
if ((cert = load_cert(*argv, FORMAT_PEM,
|
||||
if ((cert = load_cert(*argv, FORMAT_UNDEF,
|
||||
"recipient certificate file")) == NULL)
|
||||
goto end;
|
||||
sk_X509_push(encerts, cert);
|
||||
@@ -752,22 +780,30 @@ int cms_main(int argc, char **argv)
|
||||
}
|
||||
|
||||
if (recipfile != NULL && (operation == SMIME_DECRYPT)) {
|
||||
if ((recip = load_cert(recipfile, FORMAT_PEM,
|
||||
if ((recip = load_cert(recipfile, FORMAT_UNDEF,
|
||||
"recipient certificate file")) == NULL) {
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
if (originatorfile != NULL) {
|
||||
if ((originator = load_cert(originatorfile, FORMAT_UNDEF,
|
||||
"originator certificate file")) == NULL) {
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
if (operation == SMIME_SIGN_RECEIPT) {
|
||||
if ((signer = load_cert(signerfile, FORMAT_PEM,
|
||||
if ((signer = load_cert(signerfile, FORMAT_UNDEF,
|
||||
"receipt signer certificate file")) == NULL) {
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
if (operation == SMIME_DECRYPT) {
|
||||
if ((operation == SMIME_DECRYPT) || (operation == SMIME_ENCRYPT)) {
|
||||
if (keyfile == NULL)
|
||||
keyfile = recipfile;
|
||||
} else if ((operation == SMIME_SIGN) || (operation == SMIME_SIGN_RECEIPT)) {
|
||||
@@ -877,23 +913,32 @@ int cms_main(int argc, char **argv)
|
||||
for (i = 0; i < sk_X509_num(encerts); i++) {
|
||||
CMS_RecipientInfo *ri;
|
||||
cms_key_param *kparam;
|
||||
int tflags = flags;
|
||||
int tflags = flags | CMS_KEY_PARAM; /* This flag enforces allocating the EVP_PKEY_CTX for the recipient here */
|
||||
EVP_PKEY_CTX *pctx;
|
||||
X509 *x = sk_X509_value(encerts, i);
|
||||
int res;
|
||||
|
||||
for (kparam = key_first; kparam; kparam = kparam->next) {
|
||||
if (kparam->idx == i) {
|
||||
tflags |= CMS_KEY_PARAM;
|
||||
break;
|
||||
}
|
||||
}
|
||||
ri = CMS_add1_recipient_cert(cms, x, tflags);
|
||||
ri = CMS_add1_recipient(cms, x, key, originator, tflags);
|
||||
if (ri == NULL)
|
||||
goto end;
|
||||
|
||||
pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
|
||||
if (kparam != NULL) {
|
||||
EVP_PKEY_CTX *pctx;
|
||||
pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
|
||||
if (!cms_set_pkey_param(pctx, kparam->param))
|
||||
goto end;
|
||||
}
|
||||
|
||||
res = EVP_PKEY_CTX_ctrl(pctx, -1, -1,
|
||||
EVP_PKEY_CTRL_CIPHER,
|
||||
EVP_CIPHER_nid(cipher), NULL);
|
||||
if (res <= 0 && res != -2)
|
||||
goto end;
|
||||
|
||||
if (CMS_RecipientInfo_type(ri) == CMS_RECIPINFO_AGREE
|
||||
&& wrap_cipher) {
|
||||
EVP_CIPHER_CTX *wctx;
|
||||
@@ -980,7 +1025,8 @@ int cms_main(int argc, char **argv)
|
||||
signerfile = sk_OPENSSL_STRING_value(sksigners, i);
|
||||
keyfile = sk_OPENSSL_STRING_value(skkeys, i);
|
||||
|
||||
signer = load_cert(signerfile, FORMAT_PEM, "signer certificate");
|
||||
signer = load_cert(signerfile, FORMAT_UNDEF,
|
||||
"signer certificate");
|
||||
if (signer == NULL) {
|
||||
ret = 2;
|
||||
goto end;
|
||||
@@ -1039,7 +1085,7 @@ int cms_main(int argc, char **argv)
|
||||
}
|
||||
|
||||
if (key != NULL) {
|
||||
if (!CMS_decrypt_set1_pkey(cms, key, recip)) {
|
||||
if (!CMS_decrypt_set1_pkey_and_peer(cms, key, recip, originator)) {
|
||||
BIO_puts(bio_err, "Error decrypting CMS using private key\n");
|
||||
goto end;
|
||||
}
|
||||
@@ -1075,7 +1121,8 @@ int cms_main(int argc, char **argv)
|
||||
goto end;
|
||||
} else if (operation == SMIME_VERIFY) {
|
||||
if (CMS_verify(cms, other, store, indata, out, flags) > 0) {
|
||||
BIO_printf(bio_err, "Verification successful\n");
|
||||
BIO_printf(bio_err, "%s Verification successful\n",
|
||||
(flags & CMS_CADES) ? "CAdES" : "CMS");
|
||||
} else {
|
||||
BIO_printf(bio_err, "Verification failure\n");
|
||||
if (verify_retcode)
|
||||
|
||||
+14
-8
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -24,7 +24,7 @@ typedef enum OPTION_choice {
|
||||
OPT_ISSUER, OPT_LASTUPDATE, OPT_NEXTUPDATE, OPT_FINGERPRINT,
|
||||
OPT_CRLNUMBER, OPT_BADSIG, OPT_GENDELTA, OPT_CAPATH, OPT_CAFILE, OPT_CASTORE,
|
||||
OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE, OPT_VERIFY, OPT_TEXT, OPT_HASH,
|
||||
OPT_HASH_OLD, OPT_NOOUT, OPT_NAMEOPT, OPT_MD
|
||||
OPT_HASH_OLD, OPT_NOOUT, OPT_NAMEOPT, OPT_MD, OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS crl_options[] = {
|
||||
@@ -34,9 +34,9 @@ const OPTIONS crl_options[] = {
|
||||
|
||||
OPT_SECTION("Input"),
|
||||
{"in", OPT_IN, '<', "Input file - default stdin"},
|
||||
{"inform", OPT_INFORM, 'F', "Input format; default PEM"},
|
||||
{"inform", OPT_INFORM, 'F', "CRL input format (DER or PEM); has no effect"},
|
||||
{"key", OPT_KEY, '<', "CRL signing Private key to use"},
|
||||
{"keyform", OPT_KEYFORM, 'F', "Private key file format (PEM or ENGINE)"},
|
||||
{"keyform", OPT_KEYFORM, 'F', "Private key file format (DER/PEM/P12); has no effect"},
|
||||
|
||||
OPT_SECTION("Output"),
|
||||
{"out", OPT_OUT, '>', "output file - default stdout"},
|
||||
@@ -46,7 +46,7 @@ const OPTIONS crl_options[] = {
|
||||
#ifndef OPENSSL_NO_MD5
|
||||
{"hash_old", OPT_HASH_OLD, '-', "Print old-style (MD5) hash value"},
|
||||
#endif
|
||||
{"nameopt", OPT_NAMEOPT, 's', "Various certificate name options"},
|
||||
{"nameopt", OPT_NAMEOPT, 's', "Certificate subject/issuer name printing options"},
|
||||
{"", OPT_MD, '-', "Any supported digest"},
|
||||
|
||||
OPT_SECTION("CRL"),
|
||||
@@ -69,6 +69,7 @@ const OPTIONS crl_options[] = {
|
||||
"Do not load certificates from the default certificates directory"},
|
||||
{"no-CAstore", OPT_NOCASTORE, '-',
|
||||
"Do not load certificates from the default certificates store"},
|
||||
OPT_PROV_OPTIONS,
|
||||
{NULL}
|
||||
};
|
||||
|
||||
@@ -121,7 +122,7 @@ int crl_main(int argc, char **argv)
|
||||
outfile = opt_arg();
|
||||
break;
|
||||
case OPT_KEYFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &keyformat))
|
||||
if (!opt_format(opt_arg(), OPT_FMT_ANY, &keyformat))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_KEY:
|
||||
@@ -193,13 +194,18 @@ int crl_main(int argc, char **argv)
|
||||
case OPT_MD:
|
||||
if (!opt_md(opt_unknown(), &digest))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
if (argc != 0)
|
||||
goto opthelp;
|
||||
|
||||
x = load_crl(infile, informat);
|
||||
x = load_crl(infile, informat, "CRL");
|
||||
if (x == NULL)
|
||||
goto end;
|
||||
|
||||
@@ -244,7 +250,7 @@ int crl_main(int argc, char **argv)
|
||||
BIO_puts(bio_err, "Missing CRL signing key\n");
|
||||
goto end;
|
||||
}
|
||||
newcrl = load_crl(crldiff, informat);
|
||||
newcrl = load_crl(crldiff, informat, "other CRL");
|
||||
if (!newcrl)
|
||||
goto end;
|
||||
pkey = load_key(keyfile, keyformat, 0, NULL, NULL, "CRL signing key");
|
||||
|
||||
+14
-2
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -19,11 +19,17 @@
|
||||
#include <openssl/pem.h>
|
||||
#include <openssl/objects.h>
|
||||
|
||||
DEFINE_STACK_OF(X509_CRL)
|
||||
DEFINE_STACK_OF(X509)
|
||||
DEFINE_STACK_OF(X509_INFO)
|
||||
DEFINE_STACK_OF_STRING()
|
||||
|
||||
static int add_certs_from_file(STACK_OF(X509) *stack, char *certfile);
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_NOCRL, OPT_CERTFILE
|
||||
OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_NOCRL, OPT_CERTFILE,
|
||||
OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS crl2pkcs7_options[] = {
|
||||
@@ -40,6 +46,8 @@ const OPTIONS crl2pkcs7_options[] = {
|
||||
OPT_SECTION("Output"),
|
||||
{"out", OPT_OUT, '>', "Output file"},
|
||||
{"outform", OPT_OUTFORM, 'F', "Output format - DER or PEM"},
|
||||
|
||||
OPT_PROV_OPTIONS,
|
||||
{NULL}
|
||||
};
|
||||
|
||||
@@ -93,6 +101,10 @@ int crl2pkcs7_main(int argc, char **argv)
|
||||
if (!sk_OPENSSL_STRING_push(certflst, opt_arg()))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
|
||||
+10
-3
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -21,6 +21,8 @@
|
||||
#include <openssl/hmac.h>
|
||||
#include <ctype.h>
|
||||
|
||||
DEFINE_STACK_OF_STRING()
|
||||
|
||||
#undef BUFSIZE
|
||||
#define BUFSIZE 1024*8
|
||||
|
||||
@@ -42,7 +44,7 @@ typedef enum OPTION_choice {
|
||||
OPT_HEX, OPT_BINARY, OPT_DEBUG, OPT_FIPS_FINGERPRINT,
|
||||
OPT_HMAC, OPT_MAC, OPT_SIGOPT, OPT_MACOPT,
|
||||
OPT_DIGEST,
|
||||
OPT_R_ENUM
|
||||
OPT_R_ENUM, OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS dgst_options[] = {
|
||||
@@ -62,7 +64,7 @@ const OPTIONS dgst_options[] = {
|
||||
{"c", OPT_C, '-', "Print the digest with separating colons"},
|
||||
{"r", OPT_R, '-', "Print the digest in coreutils format"},
|
||||
{"out", OPT_OUT, '>', "Output to filename rather than stdout"},
|
||||
{"keyform", OPT_KEYFORM, 'f', "Key file format (PEM or ENGINE)"},
|
||||
{"keyform", OPT_KEYFORM, 'f', "Key file format (ENGINE, other values ignored)"},
|
||||
{"hex", OPT_HEX, '-', "Print as hex dump"},
|
||||
{"binary", OPT_BINARY, '-', "Print in binary form"},
|
||||
{"d", OPT_DEBUG, '-', "Print debug info"},
|
||||
@@ -82,6 +84,7 @@ const OPTIONS dgst_options[] = {
|
||||
"Compute HMAC with the key used in OpenSSL-FIPS fingerprint"},
|
||||
|
||||
OPT_R_OPTIONS,
|
||||
OPT_PROV_OPTIONS,
|
||||
|
||||
OPT_PARAMETERS(),
|
||||
{"file", 0, 0, "Files to digest (optional; default is stdin)"},
|
||||
@@ -208,6 +211,10 @@ int dgst_main(int argc, char **argv)
|
||||
goto opthelp;
|
||||
md = m;
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
|
||||
@@ -1,10 +0,0 @@
|
||||
-----BEGIN DH PARAMETERS-----
|
||||
MIGHAoGBAP//////////yQ/aoiFowjTExmKLgNwc0SkCTgiKZ8x0Agu+pjsTmyJR
|
||||
Sgh5jjQE3e+VGbPNOkMbMCsKbfJfFDdP4TVtbVHCReSFtXZiXn7G9ExC6aY37WsL
|
||||
/1y29Aa37e44a/taiZ+lrp8kEXxLH+ZJKGZR7OZTgf//////////AgEC
|
||||
-----END DH PARAMETERS-----
|
||||
|
||||
These are the 1024-bit DH parameters from "Internet Key Exchange
|
||||
Protocol Version 2 (IKEv2)": https://tools.ietf.org/html/rfc5996
|
||||
|
||||
See https://tools.ietf.org/html/rfc2412 for how they were generated.
|
||||
@@ -1,14 +0,0 @@
|
||||
-----BEGIN DH PARAMETERS-----
|
||||
MIIBCAKCAQEA///////////JD9qiIWjCNMTGYouA3BzRKQJOCIpnzHQCC76mOxOb
|
||||
IlFKCHmONATd75UZs806QxswKwpt8l8UN0/hNW1tUcJF5IW1dmJefsb0TELppjft
|
||||
awv/XLb0Brft7jhr+1qJn6WunyQRfEsf5kkoZlHs5Fs9wgB8uKFjvwWY2kg2HFXT
|
||||
mmkWP6j9JM9fg2VdI9yjrZYcYvNWIIVSu57VKQdwlpZtZww1Tkq8mATxdGwIyhgh
|
||||
fDKQXkYuNs474553LBgOhgObJ4Oi7Aeij7XFXfBvTFLJ3ivL9pVYFxg5lUl86pVq
|
||||
5RXSJhiY+gUQFXKOWoqsqmj//////////wIBAg==
|
||||
-----END DH PARAMETERS-----
|
||||
|
||||
These are the 2048-bit DH parameters from "More Modular Exponential
|
||||
(MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)":
|
||||
https://tools.ietf.org/html/rfc3526
|
||||
|
||||
See https://tools.ietf.org/html/rfc2412 for how they were generated.
|
||||
@@ -1,19 +0,0 @@
|
||||
-----BEGIN DH PARAMETERS-----
|
||||
MIICCAKCAgEA///////////JD9qiIWjCNMTGYouA3BzRKQJOCIpnzHQCC76mOxOb
|
||||
IlFKCHmONATd75UZs806QxswKwpt8l8UN0/hNW1tUcJF5IW1dmJefsb0TELppjft
|
||||
awv/XLb0Brft7jhr+1qJn6WunyQRfEsf5kkoZlHs5Fs9wgB8uKFjvwWY2kg2HFXT
|
||||
mmkWP6j9JM9fg2VdI9yjrZYcYvNWIIVSu57VKQdwlpZtZww1Tkq8mATxdGwIyhgh
|
||||
fDKQXkYuNs474553LBgOhgObJ4Oi7Aeij7XFXfBvTFLJ3ivL9pVYFxg5lUl86pVq
|
||||
5RXSJhiY+gUQFXKOWoqqxC2tMxcNBFB6M6hVIavfHLpk7PuFBFjb7wqK6nFXXQYM
|
||||
fbOXD4Wm4eTHq/WujNsJM9cejJTgSiVhnc7j0iYa0u5r8S/6BtmKCGTYdgJzPshq
|
||||
ZFIfKxgXeyAMu+EXV3phXWx3CYjAutlG4gjiT6B05asxQ9tb/OD9EI5LgtEgqSEI
|
||||
ARpyPBKnh+bXiHGaEL26WyaZwycYavTiPBqUaDS2FQvaJYPpyirUTOjbu8LbBN6O
|
||||
+S6O/BQfvsqmKHxZR05rwF2ZspZPoJDDoiM7oYZRW+ftH2EpcM7i16+4G912IXBI
|
||||
HNAGkSfVsFqpk7TqmI2P3cGG/7fckKbAj030Nck0BjGZ//////////8CAQI=
|
||||
-----END DH PARAMETERS-----
|
||||
|
||||
These are the 4096-bit DH parameters from "More Modular Exponential
|
||||
(MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)":
|
||||
https://tools.ietf.org/html/rfc3526
|
||||
|
||||
See https://tools.ietf.org/html/rfc2412 for how they were generated.
|
||||
+121
-102
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -7,38 +7,42 @@
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#ifndef OPENSSL_NO_DEPRECATED_3_0
|
||||
/* We need to use some deprecated APIs */
|
||||
# define OPENSSL_SUPPRESS_DEPRECATED
|
||||
#endif
|
||||
#include <openssl/opensslconf.h>
|
||||
#ifdef OPENSSL_NO_DH
|
||||
NON_EMPTY_TRANSLATION_UNIT
|
||||
#else
|
||||
|
||||
# include <stdio.h>
|
||||
# include <stdlib.h>
|
||||
# include <time.h>
|
||||
# include <string.h>
|
||||
# include "apps.h"
|
||||
# include "progs.h"
|
||||
# include <openssl/bio.h>
|
||||
# include <openssl/err.h>
|
||||
# include <openssl/bn.h>
|
||||
# include <openssl/dh.h>
|
||||
# include <openssl/x509.h>
|
||||
# include <openssl/pem.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <time.h>
|
||||
#include <string.h>
|
||||
#include "apps.h"
|
||||
#include "progs.h"
|
||||
#include <openssl/bio.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/bn.h>
|
||||
#include <openssl/dh.h>
|
||||
#include <openssl/x509.h>
|
||||
#include <openssl/pem.h>
|
||||
|
||||
# ifndef OPENSSL_NO_DSA
|
||||
# include <openssl/dsa.h>
|
||||
# endif
|
||||
#if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
|
||||
# include <openssl/dsa.h>
|
||||
#endif
|
||||
|
||||
# define DEFBITS 2048
|
||||
#define DEFBITS 2048
|
||||
|
||||
#if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
|
||||
static int dh_cb(int p, int n, BN_GENCB *cb);
|
||||
#endif
|
||||
static int gendh_cb(EVP_PKEY_CTX *ctx);
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT,
|
||||
OPT_ENGINE, OPT_CHECK, OPT_TEXT, OPT_NOOUT,
|
||||
OPT_DSAPARAM, OPT_C, OPT_2, OPT_3, OPT_5,
|
||||
OPT_R_ENUM
|
||||
OPT_R_ENUM, OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS dhparam_options[] = {
|
||||
@@ -47,13 +51,13 @@ const OPTIONS dhparam_options[] = {
|
||||
OPT_SECTION("General"),
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"check", OPT_CHECK, '-', "Check the DH parameters"},
|
||||
# ifndef OPENSSL_NO_DSA
|
||||
#ifndef OPENSSL_NO_DSA
|
||||
{"dsaparam", OPT_DSAPARAM, '-',
|
||||
"Read or generate DSA parameters, convert to DH"},
|
||||
# endif
|
||||
# ifndef OPENSSL_NO_ENGINE
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
{"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
|
||||
# endif
|
||||
#endif
|
||||
|
||||
OPT_SECTION("Input"),
|
||||
{"in", OPT_IN, '<', "Input file"},
|
||||
@@ -70,6 +74,7 @@ const OPTIONS dhparam_options[] = {
|
||||
{"5", OPT_5, '-', "Generate parameters using 5 as the generator value"},
|
||||
|
||||
OPT_R_OPTIONS,
|
||||
OPT_PROV_OPTIONS,
|
||||
|
||||
OPT_PARAMETERS(),
|
||||
{"numbits", 0, 0, "Number of bits if generating parameters (optional)"},
|
||||
@@ -79,10 +84,12 @@ const OPTIONS dhparam_options[] = {
|
||||
int dhparam_main(int argc, char **argv)
|
||||
{
|
||||
BIO *in = NULL, *out = NULL;
|
||||
DH *dh = NULL;
|
||||
DH *dh = NULL, *alloc_dh = NULL;
|
||||
EVP_PKEY *pkey = NULL;
|
||||
EVP_PKEY_CTX *ctx = NULL;
|
||||
char *infile = NULL, *outfile = NULL, *prog;
|
||||
ENGINE *e = NULL;
|
||||
#ifndef OPENSSL_NO_DSA
|
||||
#if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
|
||||
int dsaparam = 0;
|
||||
#endif
|
||||
int i, text = 0, C = 0, ret = 1, num = 0, g = 0;
|
||||
@@ -126,7 +133,11 @@ int dhparam_main(int argc, char **argv)
|
||||
break;
|
||||
case OPT_DSAPARAM:
|
||||
#ifndef OPENSSL_NO_DSA
|
||||
# ifdef OPENSSL_NO_DEPRECATED_3_0
|
||||
BIO_printf(bio_err, "The dsaparam option is deprecated.\n");
|
||||
# else
|
||||
dsaparam = 1;
|
||||
# endif
|
||||
#endif
|
||||
break;
|
||||
case OPT_C:
|
||||
@@ -148,6 +159,10 @@ int dhparam_main(int argc, char **argv)
|
||||
if (!opt_rand(o))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
@@ -159,13 +174,13 @@ int dhparam_main(int argc, char **argv)
|
||||
if (g && !num)
|
||||
num = DEFBITS;
|
||||
|
||||
# ifndef OPENSSL_NO_DSA
|
||||
#if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
|
||||
if (dsaparam && g) {
|
||||
BIO_printf(bio_err,
|
||||
"generator may not be chosen for DSA parameters\n");
|
||||
"Error, generator may not be chosen for DSA parameters\n");
|
||||
goto end;
|
||||
}
|
||||
# endif
|
||||
#endif
|
||||
|
||||
out = bio_open_default(outfile, 'w', outformat);
|
||||
if (out == NULL)
|
||||
@@ -177,18 +192,16 @@ int dhparam_main(int argc, char **argv)
|
||||
|
||||
if (num) {
|
||||
|
||||
BN_GENCB *cb;
|
||||
cb = BN_GENCB_new();
|
||||
if (cb == NULL) {
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
|
||||
BN_GENCB_set(cb, dh_cb, bio_err);
|
||||
|
||||
# ifndef OPENSSL_NO_DSA
|
||||
#if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
|
||||
if (dsaparam) {
|
||||
DSA *dsa = DSA_new();
|
||||
BN_GENCB *cb = BN_GENCB_new();
|
||||
|
||||
if (cb == NULL)
|
||||
goto end;
|
||||
|
||||
BN_GENCB_set(cb, dh_cb, bio_err);
|
||||
|
||||
BIO_printf(bio_err,
|
||||
"Generating DSA parameters, %d bit long prime\n", num);
|
||||
@@ -197,40 +210,52 @@ int dhparam_main(int argc, char **argv)
|
||||
cb)) {
|
||||
DSA_free(dsa);
|
||||
BN_GENCB_free(cb);
|
||||
ERR_print_errors(bio_err);
|
||||
BIO_printf(bio_err, "Error, unable to generate DSA parameters\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
dh = DSA_dup_DH(dsa);
|
||||
dh = alloc_dh = DSA_dup_DH(dsa);
|
||||
DSA_free(dsa);
|
||||
if (dh == NULL) {
|
||||
BN_GENCB_free(cb);
|
||||
ERR_print_errors(bio_err);
|
||||
BN_GENCB_free(cb);
|
||||
if (dh == NULL)
|
||||
goto end;
|
||||
} else
|
||||
#endif
|
||||
{
|
||||
ctx = EVP_PKEY_CTX_new_from_name(NULL, "DH", NULL);
|
||||
if (ctx == NULL) {
|
||||
BIO_printf(bio_err,
|
||||
"Error, DH key generation context allocation failed\n");
|
||||
goto end;
|
||||
}
|
||||
} else
|
||||
# endif
|
||||
{
|
||||
dh = DH_new();
|
||||
EVP_PKEY_CTX_set_cb(ctx, gendh_cb);
|
||||
EVP_PKEY_CTX_set_app_data(ctx, bio_err);
|
||||
BIO_printf(bio_err,
|
||||
"Generating DH parameters, %d bit long safe prime, generator %d\n",
|
||||
num, g);
|
||||
BIO_printf(bio_err, "This is going to take a long time\n");
|
||||
if (dh == NULL || !DH_generate_parameters_ex(dh, num, g, cb)) {
|
||||
BN_GENCB_free(cb);
|
||||
ERR_print_errors(bio_err);
|
||||
if (!EVP_PKEY_paramgen_init(ctx)) {
|
||||
BIO_printf(bio_err,
|
||||
"Error, unable to initialise DH param generation\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (!EVP_PKEY_CTX_set_dh_paramgen_prime_len(ctx, num)) {
|
||||
BIO_printf(bio_err, "Error, unable to set DH prime length\n");
|
||||
goto end;
|
||||
}
|
||||
if (!EVP_PKEY_paramgen(ctx, &pkey)) {
|
||||
BIO_printf(bio_err, "Error, DH generation failed\n");
|
||||
goto end;
|
||||
}
|
||||
dh = EVP_PKEY_get0_DH(pkey);
|
||||
}
|
||||
|
||||
BN_GENCB_free(cb);
|
||||
} else {
|
||||
|
||||
in = bio_open_default(infile, 'r', informat);
|
||||
if (in == NULL)
|
||||
goto end;
|
||||
|
||||
# ifndef OPENSSL_NO_DSA
|
||||
#if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
|
||||
if (dsaparam) {
|
||||
DSA *dsa;
|
||||
|
||||
@@ -240,76 +265,54 @@ int dhparam_main(int argc, char **argv)
|
||||
dsa = PEM_read_bio_DSAparams(in, NULL, NULL, NULL);
|
||||
|
||||
if (dsa == NULL) {
|
||||
BIO_printf(bio_err, "unable to load DSA parameters\n");
|
||||
ERR_print_errors(bio_err);
|
||||
BIO_printf(bio_err, "Error, unable to load DSA parameters\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
dh = DSA_dup_DH(dsa);
|
||||
dh = alloc_dh = DSA_dup_DH(dsa);
|
||||
DSA_free(dsa);
|
||||
if (dh == NULL) {
|
||||
ERR_print_errors(bio_err);
|
||||
if (dh == NULL)
|
||||
goto end;
|
||||
}
|
||||
} else
|
||||
# endif
|
||||
#endif
|
||||
{
|
||||
if (informat == FORMAT_ASN1) {
|
||||
/*
|
||||
* We have no PEM header to determine what type of DH params it
|
||||
* is. We'll just try both.
|
||||
*/
|
||||
dh = d2i_DHparams_bio(in, NULL);
|
||||
dh = alloc_dh = ASN1_d2i_bio_of(DH, DH_new, d2i_DHparams, in, NULL);
|
||||
/* BIO_reset() returns 0 for success for file BIOs only!!! */
|
||||
if (dh == NULL && BIO_reset(in) == 0)
|
||||
dh = d2i_DHxparams_bio(in, NULL);
|
||||
dh = alloc_dh = ASN1_d2i_bio_of(DH, DH_new, d2i_DHxparams, in, NULL);
|
||||
} else {
|
||||
/* informat == FORMAT_PEM */
|
||||
dh = PEM_read_bio_DHparams(in, NULL, NULL, NULL);
|
||||
dh = alloc_dh = PEM_read_bio_DHparams(in, NULL, NULL, NULL);
|
||||
}
|
||||
|
||||
if (dh == NULL) {
|
||||
BIO_printf(bio_err, "unable to load DH parameters\n");
|
||||
ERR_print_errors(bio_err);
|
||||
BIO_printf(bio_err, "Error, unable to load DH parameters\n");
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
/* dh != NULL */
|
||||
}
|
||||
|
||||
if (text) {
|
||||
DHparams_print(out, dh);
|
||||
}
|
||||
if (text)
|
||||
EVP_PKEY_print_params(out, pkey, 4, NULL);
|
||||
|
||||
if (check) {
|
||||
if (!DH_check(dh, &i)) {
|
||||
ERR_print_errors(bio_err);
|
||||
if (!EVP_PKEY_param_check(ctx) /* DH_check(dh, &i) */) {
|
||||
BIO_printf(bio_err, "Error, invalid parameters generated\n");
|
||||
goto end;
|
||||
}
|
||||
if (i & DH_CHECK_P_NOT_PRIME)
|
||||
BIO_printf(bio_err, "WARNING: p value is not prime\n");
|
||||
if (i & DH_CHECK_P_NOT_SAFE_PRIME)
|
||||
BIO_printf(bio_err, "WARNING: p value is not a safe prime\n");
|
||||
if (i & DH_CHECK_Q_NOT_PRIME)
|
||||
BIO_printf(bio_err, "WARNING: q value is not a prime\n");
|
||||
if (i & DH_CHECK_INVALID_Q_VALUE)
|
||||
BIO_printf(bio_err, "WARNING: q value is invalid\n");
|
||||
if (i & DH_CHECK_INVALID_J_VALUE)
|
||||
BIO_printf(bio_err, "WARNING: j value is invalid\n");
|
||||
if (i & DH_UNABLE_TO_CHECK_GENERATOR)
|
||||
BIO_printf(bio_err,
|
||||
"WARNING: unable to check the generator value\n");
|
||||
if (i & DH_NOT_SUITABLE_GENERATOR)
|
||||
BIO_printf(bio_err, "WARNING: the g value is not a generator\n");
|
||||
if (i == 0)
|
||||
BIO_printf(bio_err, "DH parameters appear to be ok.\n");
|
||||
if (num != 0 && i != 0) {
|
||||
BIO_printf(bio_err, "DH parameters appear to be ok.\n");
|
||||
if (num != 0) {
|
||||
/*
|
||||
* We have generated parameters but DH_check() indicates they are
|
||||
* invalid! This should never happen!
|
||||
*/
|
||||
BIO_printf(bio_err, "ERROR: Invalid parameters generated\n");
|
||||
BIO_printf(bio_err, "Error, invalid parameters generated\n");
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
@@ -318,8 +321,9 @@ int dhparam_main(int argc, char **argv)
|
||||
int len, bits;
|
||||
const BIGNUM *pbn, *gbn;
|
||||
|
||||
len = DH_size(dh);
|
||||
bits = DH_bits(dh);
|
||||
dh = EVP_PKEY_get0_DH(pkey);
|
||||
len = EVP_PKEY_size(pkey);
|
||||
bits = EVP_PKEY_size(pkey);
|
||||
DH_get0_pqg(dh, &pbn, NULL, &gbn);
|
||||
data = app_malloc(len, "print a BN");
|
||||
|
||||
@@ -357,36 +361,51 @@ int dhparam_main(int argc, char **argv)
|
||||
DH_get0_pqg(dh, NULL, &q, NULL);
|
||||
if (outformat == FORMAT_ASN1) {
|
||||
if (q != NULL)
|
||||
i = i2d_DHxparams_bio(out, dh);
|
||||
i = ASN1_i2d_bio_of(DH, i2d_DHxparams, out, dh);
|
||||
else
|
||||
i = i2d_DHparams_bio(out, dh);
|
||||
i = ASN1_i2d_bio_of(DH, i2d_DHparams, out, dh);
|
||||
} else if (q != NULL) {
|
||||
i = PEM_write_bio_DHxparams(out, dh);
|
||||
} else {
|
||||
i = PEM_write_bio_DHparams(out, dh);
|
||||
}
|
||||
if (!i) {
|
||||
BIO_printf(bio_err, "unable to write DH parameters\n");
|
||||
ERR_print_errors(bio_err);
|
||||
BIO_printf(bio_err, "Error, unable to write DH parameters\n");
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
ret = 0;
|
||||
end:
|
||||
if (ret != 0)
|
||||
ERR_print_errors(bio_err);
|
||||
DH_free(alloc_dh);
|
||||
BIO_free(in);
|
||||
BIO_free_all(out);
|
||||
DH_free(dh);
|
||||
EVP_PKEY_free(pkey);
|
||||
EVP_PKEY_CTX_free(ctx);
|
||||
release_engine(e);
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int dh_cb(int p, int n, BN_GENCB *cb)
|
||||
static int common_dh_cb(int p, BIO *b)
|
||||
{
|
||||
static const char symbols[] = ".+*\n";
|
||||
char c = (p >= 0 && (size_t)p < sizeof(symbols) - 1) ? symbols[p] : '?';
|
||||
|
||||
BIO_write(BN_GENCB_get_arg(cb), &c, 1);
|
||||
(void)BIO_flush(BN_GENCB_get_arg(cb));
|
||||
BIO_write(b, &c, 1);
|
||||
(void)BIO_flush(b);
|
||||
return 1;
|
||||
}
|
||||
|
||||
#if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
|
||||
static int dh_cb(int p, int n, BN_GENCB *cb)
|
||||
{
|
||||
return common_dh_cb(p, BN_GENCB_get_arg(cb));
|
||||
}
|
||||
#endif
|
||||
|
||||
static int gendh_cb(EVP_PKEY_CTX *ctx)
|
||||
{
|
||||
return common_dh_cb(EVP_PKEY_CTX_get_keygen_info(ctx, 0),
|
||||
EVP_PKEY_CTX_get_app_data(ctx));
|
||||
}
|
||||
+43
-43
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -8,23 +8,20 @@
|
||||
*/
|
||||
|
||||
#include <openssl/opensslconf.h>
|
||||
#ifdef OPENSSL_NO_DSA
|
||||
NON_EMPTY_TRANSLATION_UNIT
|
||||
#else
|
||||
|
||||
# include <stdio.h>
|
||||
# include <stdlib.h>
|
||||
# include <string.h>
|
||||
# include <time.h>
|
||||
# include "apps.h"
|
||||
# include "progs.h"
|
||||
# include <openssl/bio.h>
|
||||
# include <openssl/err.h>
|
||||
# include <openssl/dsa.h>
|
||||
# include <openssl/evp.h>
|
||||
# include <openssl/x509.h>
|
||||
# include <openssl/pem.h>
|
||||
# include <openssl/bn.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <time.h>
|
||||
#include "apps.h"
|
||||
#include "progs.h"
|
||||
#include <openssl/bio.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/dsa.h>
|
||||
#include <openssl/evp.h>
|
||||
#include <openssl/x509.h>
|
||||
#include <openssl/pem.h>
|
||||
#include <openssl/bn.h>
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
@@ -32,25 +29,26 @@ typedef enum OPTION_choice {
|
||||
/* Do not change the order here; see case statements below */
|
||||
OPT_PVK_NONE, OPT_PVK_WEAK, OPT_PVK_STRONG,
|
||||
OPT_NOOUT, OPT_TEXT, OPT_MODULUS, OPT_PUBIN,
|
||||
OPT_PUBOUT, OPT_CIPHER, OPT_PASSIN, OPT_PASSOUT
|
||||
OPT_PUBOUT, OPT_CIPHER, OPT_PASSIN, OPT_PASSOUT,
|
||||
OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS dsa_options[] = {
|
||||
OPT_SECTION("General"),
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"", OPT_CIPHER, '-', "Any supported cipher"},
|
||||
# ifndef OPENSSL_NO_RC4
|
||||
#ifndef OPENSSL_NO_RC4
|
||||
{"pvk-strong", OPT_PVK_STRONG, '-', "Enable 'Strong' PVK encoding level (default)"},
|
||||
{"pvk-weak", OPT_PVK_WEAK, '-', "Enable 'Weak' PVK encoding level"},
|
||||
{"pvk-none", OPT_PVK_NONE, '-', "Don't enforce PVK encoding"},
|
||||
# endif
|
||||
# ifndef OPENSSL_NO_ENGINE
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
{"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
|
||||
# endif
|
||||
#endif
|
||||
|
||||
OPT_SECTION("Input"),
|
||||
{"in", OPT_IN, 's', "Input key"},
|
||||
{"inform", OPT_INFORM, 'f', "Input format, DER PEM PVK"},
|
||||
{"inform", OPT_INFORM, 'f', "Input format (DER/PEM/PVK); has no effect"},
|
||||
{"pubin", OPT_PUBIN, '-', "Expect a public key in input file"},
|
||||
{"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
|
||||
|
||||
@@ -63,6 +61,7 @@ const OPTIONS dsa_options[] = {
|
||||
{"pubout", OPT_PUBOUT, '-', "Output public key, not private"},
|
||||
{"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
|
||||
|
||||
OPT_PROV_OPTIONS,
|
||||
{NULL}
|
||||
};
|
||||
|
||||
@@ -71,15 +70,16 @@ int dsa_main(int argc, char **argv)
|
||||
BIO *out = NULL;
|
||||
DSA *dsa = NULL;
|
||||
ENGINE *e = NULL;
|
||||
EVP_PKEY *pkey = NULL;
|
||||
const EVP_CIPHER *enc = NULL;
|
||||
char *infile = NULL, *outfile = NULL, *prog;
|
||||
char *passin = NULL, *passout = NULL, *passinarg = NULL, *passoutarg = NULL;
|
||||
OPTION_CHOICE o;
|
||||
int informat = FORMAT_PEM, outformat = FORMAT_PEM, text = 0, noout = 0;
|
||||
int i, modulus = 0, pubin = 0, pubout = 0, ret = 1;
|
||||
# ifndef OPENSSL_NO_RC4
|
||||
#ifndef OPENSSL_NO_RC4
|
||||
int pvk_encr = 2;
|
||||
# endif
|
||||
#endif
|
||||
int private = 0;
|
||||
|
||||
prog = opt_init(argc, argv, dsa_options);
|
||||
@@ -144,6 +144,10 @@ int dsa_main(int argc, char **argv)
|
||||
if (!opt_cipher(opt_unknown(), &enc))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
@@ -160,19 +164,14 @@ int dsa_main(int argc, char **argv)
|
||||
}
|
||||
|
||||
BIO_printf(bio_err, "read DSA key\n");
|
||||
{
|
||||
EVP_PKEY *pkey;
|
||||
if (pubin)
|
||||
pkey = load_pubkey(infile, informat, 1, passin, e, "Public Key");
|
||||
else
|
||||
pkey = load_key(infile, informat, 1, passin, e, "Private Key");
|
||||
|
||||
if (pubin)
|
||||
pkey = load_pubkey(infile, informat, 1, passin, e, "Public Key");
|
||||
else
|
||||
pkey = load_key(infile, informat, 1, passin, e, "Private Key");
|
||||
if (pkey != NULL)
|
||||
dsa = EVP_PKEY_get1_DSA(pkey);
|
||||
|
||||
if (pkey != NULL) {
|
||||
dsa = EVP_PKEY_get1_DSA(pkey);
|
||||
EVP_PKEY_free(pkey);
|
||||
}
|
||||
}
|
||||
if (dsa == NULL) {
|
||||
BIO_printf(bio_err, "unable to load Key\n");
|
||||
ERR_print_errors(bio_err);
|
||||
@@ -185,7 +184,8 @@ int dsa_main(int argc, char **argv)
|
||||
|
||||
if (text) {
|
||||
assert(pubin || private);
|
||||
if (!DSA_print(out, dsa, 0)) {
|
||||
if ((pubin && EVP_PKEY_print_public(out, pkey, 0, NULL) <= 0)
|
||||
|| (!pubin && EVP_PKEY_print_private(out, pkey, 0, NULL) <= 0)) {
|
||||
perror(outfile);
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
@@ -220,7 +220,7 @@ int dsa_main(int argc, char **argv)
|
||||
i = PEM_write_bio_DSAPrivateKey(out, dsa, enc,
|
||||
NULL, 0, NULL, passout);
|
||||
}
|
||||
# ifndef OPENSSL_NO_RSA
|
||||
#ifndef OPENSSL_NO_RSA
|
||||
} else if (outformat == FORMAT_MSBLOB || outformat == FORMAT_PVK) {
|
||||
EVP_PKEY *pk;
|
||||
pk = EVP_PKEY_new();
|
||||
@@ -235,13 +235,13 @@ int dsa_main(int argc, char **argv)
|
||||
goto end;
|
||||
}
|
||||
assert(private);
|
||||
# ifdef OPENSSL_NO_RC4
|
||||
# ifdef OPENSSL_NO_RC4
|
||||
BIO_printf(bio_err, "PVK format not supported\n");
|
||||
EVP_PKEY_free(pk);
|
||||
goto end;
|
||||
# else
|
||||
# else
|
||||
i = i2b_PVK_bio(out, pk, pvk_encr, 0, passout);
|
||||
# endif
|
||||
# endif
|
||||
} else if (pubin || pubout) {
|
||||
i = i2b_PublicKey_bio(out, pk);
|
||||
} else {
|
||||
@@ -249,7 +249,7 @@ int dsa_main(int argc, char **argv)
|
||||
i = i2b_PrivateKey_bio(out, pk);
|
||||
}
|
||||
EVP_PKEY_free(pk);
|
||||
# endif
|
||||
#endif
|
||||
} else {
|
||||
BIO_printf(bio_err, "bad output format specified for outfile\n");
|
||||
goto end;
|
||||
@@ -262,10 +262,10 @@ int dsa_main(int argc, char **argv)
|
||||
ret = 0;
|
||||
end:
|
||||
BIO_free_all(out);
|
||||
EVP_PKEY_free(pkey);
|
||||
DSA_free(dsa);
|
||||
release_engine(e);
|
||||
OPENSSL_free(passin);
|
||||
OPENSSL_free(passout);
|
||||
return ret;
|
||||
}
|
||||
#endif
|
||||
+85
-64
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -8,32 +8,29 @@
|
||||
*/
|
||||
|
||||
#include <openssl/opensslconf.h>
|
||||
#ifdef OPENSSL_NO_DSA
|
||||
NON_EMPTY_TRANSLATION_UNIT
|
||||
#else
|
||||
|
||||
# include <stdio.h>
|
||||
# include <stdlib.h>
|
||||
# include <time.h>
|
||||
# include <string.h>
|
||||
# include "apps.h"
|
||||
# include "progs.h"
|
||||
# include <openssl/bio.h>
|
||||
# include <openssl/err.h>
|
||||
# include <openssl/bn.h>
|
||||
# include <openssl/dsa.h>
|
||||
# include <openssl/x509.h>
|
||||
# include <openssl/pem.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <time.h>
|
||||
#include <string.h>
|
||||
#include "apps.h"
|
||||
#include "progs.h"
|
||||
#include <openssl/bio.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/bn.h>
|
||||
#include <openssl/dsa.h>
|
||||
#include <openssl/x509.h>
|
||||
#include <openssl/pem.h>
|
||||
|
||||
static int verbose = 0;
|
||||
|
||||
static int dsa_cb(int p, int n, BN_GENCB *cb);
|
||||
static int gendsa_cb(EVP_PKEY_CTX *ctx);
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_TEXT, OPT_C,
|
||||
OPT_NOOUT, OPT_GENKEY, OPT_ENGINE, OPT_VERBOSE,
|
||||
OPT_R_ENUM
|
||||
OPT_R_ENUM, OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS dsaparam_options[] = {
|
||||
@@ -41,9 +38,9 @@ const OPTIONS dsaparam_options[] = {
|
||||
|
||||
OPT_SECTION("General"),
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
# ifndef OPENSSL_NO_ENGINE
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
{"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
|
||||
# endif
|
||||
#endif
|
||||
|
||||
OPT_SECTION("Input"),
|
||||
{"in", OPT_IN, '<', "Input file"},
|
||||
@@ -59,6 +56,7 @@ const OPTIONS dsaparam_options[] = {
|
||||
{"genkey", OPT_GENKEY, '-', "Generate a DSA key"},
|
||||
|
||||
OPT_R_OPTIONS,
|
||||
OPT_PROV_OPTIONS,
|
||||
|
||||
OPT_PARAMETERS(),
|
||||
{"numbits", 0, 0, "Number of bits if generating parameters (optional)"},
|
||||
@@ -68,9 +66,9 @@ const OPTIONS dsaparam_options[] = {
|
||||
int dsaparam_main(int argc, char **argv)
|
||||
{
|
||||
ENGINE *e = NULL;
|
||||
DSA *dsa = NULL;
|
||||
BIO *in = NULL, *out = NULL;
|
||||
BN_GENCB *cb = NULL;
|
||||
EVP_PKEY *params = NULL, *pkey = NULL;
|
||||
EVP_PKEY_CTX *ctx = NULL;
|
||||
int numbits = -1, num = 0, genkey = 0;
|
||||
int informat = FORMAT_PEM, outformat = FORMAT_PEM, noout = 0, C = 0;
|
||||
int ret = 1, i, text = 0, private = 0;
|
||||
@@ -119,6 +117,10 @@ int dsaparam_main(int argc, char **argv)
|
||||
if (!opt_rand(o))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_NOOUT:
|
||||
noout = 1;
|
||||
break;
|
||||
@@ -145,6 +147,12 @@ int dsaparam_main(int argc, char **argv)
|
||||
if (out == NULL)
|
||||
goto end;
|
||||
|
||||
ctx = EVP_PKEY_CTX_new_from_name(NULL, "DSA", NULL);
|
||||
if (ctx == NULL) {
|
||||
BIO_printf(bio_err,
|
||||
"Error, DSA parameter generation context allocation failed\n");
|
||||
goto end;
|
||||
}
|
||||
if (numbits > 0) {
|
||||
if (numbits > OPENSSL_DSA_MAX_MODULUS_BITS)
|
||||
BIO_printf(bio_err,
|
||||
@@ -152,48 +160,49 @@ int dsaparam_main(int argc, char **argv)
|
||||
" Your key size is %d! Larger key size may behave not as expected.\n",
|
||||
OPENSSL_DSA_MAX_MODULUS_BITS, numbits);
|
||||
|
||||
cb = BN_GENCB_new();
|
||||
if (cb == NULL) {
|
||||
BIO_printf(bio_err, "Error allocating BN_GENCB object\n");
|
||||
goto end;
|
||||
}
|
||||
BN_GENCB_set(cb, dsa_cb, bio_err);
|
||||
dsa = DSA_new();
|
||||
if (dsa == NULL) {
|
||||
BIO_printf(bio_err, "Error allocating DSA object\n");
|
||||
goto end;
|
||||
}
|
||||
EVP_PKEY_CTX_set_cb(ctx, gendsa_cb);
|
||||
EVP_PKEY_CTX_set_app_data(ctx, bio_err);
|
||||
if (verbose) {
|
||||
BIO_printf(bio_err, "Generating DSA parameters, %d bit long prime\n",
|
||||
num);
|
||||
BIO_printf(bio_err, "This could take some time\n");
|
||||
}
|
||||
if (!DSA_generate_parameters_ex(dsa, num, NULL, 0, NULL, NULL, cb)) {
|
||||
ERR_print_errors(bio_err);
|
||||
if (EVP_PKEY_paramgen_init(ctx) <= 0) {
|
||||
BIO_printf(bio_err,
|
||||
"Error, DSA key generation paramgen init failed\n");
|
||||
goto end;
|
||||
}
|
||||
if (!EVP_PKEY_CTX_set_dsa_paramgen_bits(ctx, num)) {
|
||||
BIO_printf(bio_err,
|
||||
"Error, DSA key generation setting bit length failed\n");
|
||||
goto end;
|
||||
}
|
||||
if (EVP_PKEY_paramgen(ctx, ¶ms) <= 0) {
|
||||
BIO_printf(bio_err, "Error, DSA key generation failed\n");
|
||||
goto end;
|
||||
}
|
||||
} else if (informat == FORMAT_ASN1) {
|
||||
dsa = d2i_DSAparams_bio(in, NULL);
|
||||
params = d2i_KeyParams_bio(EVP_PKEY_DSA, NULL, in);
|
||||
} else {
|
||||
dsa = PEM_read_bio_DSAparams(in, NULL, NULL, NULL);
|
||||
params = PEM_read_bio_Parameters(in, NULL);
|
||||
}
|
||||
if (dsa == NULL) {
|
||||
BIO_printf(bio_err, "unable to load DSA parameters\n");
|
||||
ERR_print_errors(bio_err);
|
||||
if (params == NULL) {
|
||||
BIO_printf(bio_err, "Error, unable to load DSA parameters\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (text) {
|
||||
DSAparams_print(out, dsa);
|
||||
EVP_PKEY_print_params(out, params, 0, NULL);
|
||||
}
|
||||
|
||||
if (C) {
|
||||
const BIGNUM *p = NULL, *q = NULL, *g = NULL;
|
||||
BIGNUM *p = NULL, *q = NULL, *g = NULL;
|
||||
unsigned char *data;
|
||||
int len, bits_p;
|
||||
|
||||
DSA_get0_pqg(dsa, &p, &q, &g);
|
||||
EVP_PKEY_get_bn_param(params, "p", &p);
|
||||
EVP_PKEY_get_bn_param(params, "q", &q);
|
||||
EVP_PKEY_get_bn_param(params, "g", &g);
|
||||
len = BN_num_bytes(p);
|
||||
bits_p = BN_num_bits(p);
|
||||
|
||||
@@ -229,53 +238,65 @@ int dsaparam_main(int argc, char **argv)
|
||||
|
||||
if (!noout) {
|
||||
if (outformat == FORMAT_ASN1)
|
||||
i = i2d_DSAparams_bio(out, dsa);
|
||||
i = i2d_KeyParams_bio(out, params);
|
||||
else
|
||||
i = PEM_write_bio_DSAparams(out, dsa);
|
||||
i = PEM_write_bio_Parameters(out, params);
|
||||
if (!i) {
|
||||
BIO_printf(bio_err, "unable to write DSA parameters\n");
|
||||
ERR_print_errors(bio_err);
|
||||
BIO_printf(bio_err, "Error, unable to write DSA parameters\n");
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
if (genkey) {
|
||||
DSA *dsakey;
|
||||
|
||||
if ((dsakey = DSAparams_dup(dsa)) == NULL)
|
||||
EVP_PKEY_CTX_free(ctx);
|
||||
ctx = EVP_PKEY_CTX_new(params, NULL);
|
||||
if (ctx == NULL) {
|
||||
BIO_printf(bio_err,
|
||||
"Error, DSA key generation context allocation failed\n");
|
||||
goto end;
|
||||
if (!DSA_generate_key(dsakey)) {
|
||||
ERR_print_errors(bio_err);
|
||||
DSA_free(dsakey);
|
||||
}
|
||||
if (!EVP_PKEY_keygen_init(ctx)) {
|
||||
BIO_printf(bio_err,
|
||||
"Error, unable to initialise for key generation\n");
|
||||
goto end;
|
||||
}
|
||||
if (!EVP_PKEY_keygen(ctx, &pkey)) {
|
||||
BIO_printf(bio_err, "Error, unable to generate key\n");
|
||||
goto end;
|
||||
}
|
||||
assert(private);
|
||||
if (outformat == FORMAT_ASN1)
|
||||
i = i2d_DSAPrivateKey_bio(out, dsakey);
|
||||
i = i2d_PrivateKey_bio(out, pkey);
|
||||
else
|
||||
i = PEM_write_bio_DSAPrivateKey(out, dsakey, NULL, NULL, 0, NULL,
|
||||
NULL);
|
||||
DSA_free(dsakey);
|
||||
i = PEM_write_bio_PrivateKey(out, pkey, NULL, NULL, 0, NULL, NULL);
|
||||
}
|
||||
ret = 0;
|
||||
end:
|
||||
BN_GENCB_free(cb);
|
||||
if (ret != 0)
|
||||
ERR_print_errors(bio_err);
|
||||
BIO_free(in);
|
||||
BIO_free_all(out);
|
||||
DSA_free(dsa);
|
||||
EVP_PKEY_CTX_free(ctx);
|
||||
EVP_PKEY_free(pkey);
|
||||
EVP_PKEY_free(params);
|
||||
release_engine(e);
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int dsa_cb(int p, int n, BN_GENCB *cb)
|
||||
static int gendsa_cb(EVP_PKEY_CTX *ctx)
|
||||
{
|
||||
static const char symbols[] = ".+*\n";
|
||||
char c = (p >= 0 && (size_t)p < sizeof(symbols) - 1) ? symbols[p] : '?';
|
||||
int p;
|
||||
char c;
|
||||
BIO *b;
|
||||
|
||||
if (!verbose)
|
||||
return 1;
|
||||
|
||||
BIO_write(BN_GENCB_get_arg(cb), &c, 1);
|
||||
(void)BIO_flush(BN_GENCB_get_arg(cb));
|
||||
b = EVP_PKEY_CTX_get_app_data(ctx);
|
||||
p = EVP_PKEY_CTX_get_keygen_info(ctx, 0);
|
||||
c = (p >= 0 && (size_t)p < sizeof(symbols) - 1) ? symbols[p] : '?';
|
||||
|
||||
BIO_write(b, &c, 1);
|
||||
(void)BIO_flush(b);
|
||||
return 1;
|
||||
}
|
||||
#endif
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 2002-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2002-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -8,19 +8,16 @@
|
||||
*/
|
||||
|
||||
#include <openssl/opensslconf.h>
|
||||
#ifdef OPENSSL_NO_EC
|
||||
NON_EMPTY_TRANSLATION_UNIT
|
||||
#else
|
||||
|
||||
# include <stdio.h>
|
||||
# include <stdlib.h>
|
||||
# include <string.h>
|
||||
# include "apps.h"
|
||||
# include "progs.h"
|
||||
# include <openssl/bio.h>
|
||||
# include <openssl/err.h>
|
||||
# include <openssl/evp.h>
|
||||
# include <openssl/pem.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include "apps.h"
|
||||
#include "progs.h"
|
||||
#include <openssl/bio.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/evp.h>
|
||||
#include <openssl/pem.h>
|
||||
|
||||
static OPT_PAIR conv_forms[] = {
|
||||
{"compressed", POINT_CONVERSION_COMPRESSED},
|
||||
@@ -40,19 +37,19 @@ typedef enum OPTION_choice {
|
||||
OPT_INFORM, OPT_OUTFORM, OPT_ENGINE, OPT_IN, OPT_OUT,
|
||||
OPT_NOOUT, OPT_TEXT, OPT_PARAM_OUT, OPT_PUBIN, OPT_PUBOUT,
|
||||
OPT_PASSIN, OPT_PASSOUT, OPT_PARAM_ENC, OPT_CONV_FORM, OPT_CIPHER,
|
||||
OPT_NO_PUBLIC, OPT_CHECK
|
||||
OPT_NO_PUBLIC, OPT_CHECK, OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS ec_options[] = {
|
||||
OPT_SECTION("General"),
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
# ifndef OPENSSL_NO_ENGINE
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
{"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
|
||||
# endif
|
||||
#endif
|
||||
|
||||
OPT_SECTION("Input"),
|
||||
{"in", OPT_IN, 's', "Input file"},
|
||||
{"inform", OPT_INFORM, 'f', "Input format - DER or PEM"},
|
||||
{"inform", OPT_INFORM, 'f', "Input format (DER/PEM/P12/ENGINE)"},
|
||||
{"pubin", OPT_PUBIN, '-', "Expect a public key in input file"},
|
||||
{"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
|
||||
{"check", OPT_CHECK, '-', "check key consistency"},
|
||||
@@ -70,6 +67,8 @@ const OPTIONS ec_options[] = {
|
||||
{"pubout", OPT_PUBOUT, '-', "Output public key, not private"},
|
||||
{"no_public", OPT_NO_PUBLIC, '-', "exclude public key from private key"},
|
||||
{"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
|
||||
|
||||
OPT_PROV_OPTIONS,
|
||||
{NULL}
|
||||
};
|
||||
|
||||
@@ -161,6 +160,10 @@ int ec_main(int argc, char **argv)
|
||||
case OPT_CHECK:
|
||||
check = 1;
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
@@ -285,4 +288,3 @@ int ec_main(int argc, char **argv)
|
||||
OPENSSL_free(passout);
|
||||
return ret;
|
||||
}
|
||||
#endif
|
||||
+22
-23
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 2002-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2002-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
@@ -9,29 +9,26 @@
|
||||
*/
|
||||
|
||||
#include <openssl/opensslconf.h>
|
||||
#ifdef OPENSSL_NO_EC
|
||||
NON_EMPTY_TRANSLATION_UNIT
|
||||
#else
|
||||
|
||||
# include <stdio.h>
|
||||
# include <stdlib.h>
|
||||
# include <time.h>
|
||||
# include <string.h>
|
||||
# include "apps.h"
|
||||
# include "progs.h"
|
||||
# include <openssl/bio.h>
|
||||
# include <openssl/err.h>
|
||||
# include <openssl/bn.h>
|
||||
# include <openssl/ec.h>
|
||||
# include <openssl/x509.h>
|
||||
# include <openssl/pem.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <time.h>
|
||||
#include <string.h>
|
||||
#include "apps.h"
|
||||
#include "progs.h"
|
||||
#include <openssl/bio.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/bn.h>
|
||||
#include <openssl/ec.h>
|
||||
#include <openssl/x509.h>
|
||||
#include <openssl/pem.h>
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_TEXT, OPT_C,
|
||||
OPT_CHECK, OPT_LIST_CURVES, OPT_NO_SEED, OPT_NOOUT, OPT_NAME,
|
||||
OPT_CONV_FORM, OPT_PARAM_ENC, OPT_GENKEY, OPT_ENGINE, OPT_CHECK_NAMED,
|
||||
OPT_R_ENUM
|
||||
OPT_R_ENUM, OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS ecparam_options[] = {
|
||||
@@ -39,9 +36,9 @@ const OPTIONS ecparam_options[] = {
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"list_curves", OPT_LIST_CURVES, '-',
|
||||
"Prints a list of all curve 'short names'"},
|
||||
# ifndef OPENSSL_NO_ENGINE
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
{"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
|
||||
# endif
|
||||
#endif
|
||||
|
||||
{"genkey", OPT_GENKEY, '-', "Generate ec key"},
|
||||
{"in", OPT_IN, '<', "Input file - default stdin"},
|
||||
@@ -67,6 +64,7 @@ const OPTIONS ecparam_options[] = {
|
||||
{"conv_form", OPT_CONV_FORM, 's', "Specifies the point conversion form "},
|
||||
|
||||
OPT_R_OPTIONS,
|
||||
OPT_PROV_OPTIONS,
|
||||
{NULL}
|
||||
};
|
||||
|
||||
@@ -169,6 +167,10 @@ int ecparam_main(int argc, char **argv)
|
||||
if (!opt_rand(o))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_ENGINE:
|
||||
e = setup_engine(opt_arg(), 0);
|
||||
break;
|
||||
@@ -303,7 +305,6 @@ int ecparam_main(int argc, char **argv)
|
||||
size_t buf_len = 0, tmp_len = 0;
|
||||
const EC_POINT *point;
|
||||
int is_prime, len = 0;
|
||||
const EC_METHOD *meth = EC_GROUP_method_of(group);
|
||||
|
||||
if ((ec_p = BN_new()) == NULL
|
||||
|| (ec_a = BN_new()) == NULL
|
||||
@@ -315,7 +316,7 @@ int ecparam_main(int argc, char **argv)
|
||||
goto end;
|
||||
}
|
||||
|
||||
is_prime = (EC_METHOD_get_field_type(meth) == NID_X9_62_prime_field);
|
||||
is_prime = (EC_GROUP_get_field_type(group) == NID_X9_62_prime_field);
|
||||
if (!is_prime) {
|
||||
BIO_printf(bio_err, "Can only handle X9.62 prime fields\n");
|
||||
goto end;
|
||||
@@ -468,5 +469,3 @@ int ecparam_main(int argc, char **argv)
|
||||
BIO_free_all(out);
|
||||
return ret;
|
||||
}
|
||||
|
||||
#endif
|
||||
+8
-3
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -45,7 +45,7 @@ typedef enum OPTION_choice {
|
||||
OPT_NOPAD, OPT_SALT, OPT_NOSALT, OPT_DEBUG, OPT_UPPER_P, OPT_UPPER_A,
|
||||
OPT_A, OPT_Z, OPT_BUFSIZE, OPT_K, OPT_KFILE, OPT_UPPER_K, OPT_NONE,
|
||||
OPT_UPPER_S, OPT_IV, OPT_MD, OPT_ITER, OPT_PBKDF2, OPT_CIPHER,
|
||||
OPT_R_ENUM
|
||||
OPT_R_ENUM, OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS enc_options[] = {
|
||||
@@ -97,6 +97,7 @@ const OPTIONS enc_options[] = {
|
||||
{"", OPT_CIPHER, '-', "Any supported cipher"},
|
||||
|
||||
OPT_R_OPTIONS,
|
||||
OPT_PROV_OPTIONS,
|
||||
{NULL}
|
||||
};
|
||||
|
||||
@@ -288,6 +289,10 @@ int enc_main(int argc, char **argv)
|
||||
if (!opt_rand(o))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (opt_num_rest() != 0) {
|
||||
@@ -533,7 +538,7 @@ int enc_main(int argc, char **argv)
|
||||
goto end;
|
||||
}
|
||||
/* wiping secret data as we no longer need it */
|
||||
OPENSSL_cleanse(hkey, strlen(hkey));
|
||||
cleanse(hkey);
|
||||
}
|
||||
|
||||
if ((benc = BIO_new(BIO_f_cipher())) == NULL)
|
||||
|
||||
+13
-14
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -8,19 +8,19 @@
|
||||
*/
|
||||
|
||||
#include <openssl/opensslconf.h>
|
||||
#ifdef OPENSSL_NO_ENGINE
|
||||
NON_EMPTY_TRANSLATION_UNIT
|
||||
#else
|
||||
|
||||
# include "apps.h"
|
||||
# include "progs.h"
|
||||
# include <stdio.h>
|
||||
# include <stdlib.h>
|
||||
# include <string.h>
|
||||
# include <openssl/err.h>
|
||||
# include <openssl/engine.h>
|
||||
# include <openssl/ssl.h>
|
||||
# include <openssl/store.h>
|
||||
#include "apps.h"
|
||||
#include "progs.h"
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/engine.h>
|
||||
#include <openssl/ssl.h>
|
||||
#include <openssl/store.h>
|
||||
|
||||
DEFINE_STACK_OF_STRING()
|
||||
DEFINE_STACK_OF_CSTRING()
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
@@ -491,4 +491,3 @@ int engine_main(int argc, char **argv)
|
||||
BIO_free_all(out);
|
||||
return ret;
|
||||
}
|
||||
#endif
|
||||
+22
-11
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -18,6 +18,8 @@
|
||||
#include "apps.h"
|
||||
#include "progs.h"
|
||||
|
||||
DEFINE_STACK_OF_STRING()
|
||||
|
||||
#define BUFSIZE 4096
|
||||
#define DEFAULT_MAC_NAME "HMAC"
|
||||
#define DEFAULT_FIPS_SECTION "fips_check_section"
|
||||
@@ -31,12 +33,13 @@ static OSSL_CALLBACK self_test_events;
|
||||
static char *self_test_corrupt_desc = NULL;
|
||||
static char *self_test_corrupt_type = NULL;
|
||||
static int self_test_log = 1;
|
||||
static int quiet = 0;
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_IN, OPT_OUT, OPT_MODULE,
|
||||
OPT_PROV_NAME, OPT_SECTION_NAME, OPT_MAC_NAME, OPT_MACOPT, OPT_VERIFY,
|
||||
OPT_NO_LOG, OPT_CORRUPT_DESC, OPT_CORRUPT_TYPE
|
||||
OPT_NO_LOG, OPT_CORRUPT_DESC, OPT_CORRUPT_TYPE, OPT_QUIET
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS fipsinstall_options[] = {
|
||||
@@ -60,6 +63,7 @@ const OPTIONS fipsinstall_options[] = {
|
||||
{"noout", OPT_NO_LOG, '-', "Disable logging of self test events"},
|
||||
{"corrupt_desc", OPT_CORRUPT_DESC, 's', "Corrupt a self test by description"},
|
||||
{"corrupt_type", OPT_CORRUPT_TYPE, 's', "Corrupt a self test by type"},
|
||||
{"quiet", OPT_QUIET, '-', "No messages, just exit status"},
|
||||
{NULL}
|
||||
};
|
||||
|
||||
@@ -287,7 +291,7 @@ int fipsinstall_main(int argc, char **argv)
|
||||
case OPT_ERR:
|
||||
opthelp:
|
||||
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
||||
goto end;
|
||||
goto cleanup;
|
||||
case OPT_HELP:
|
||||
opt_help(fipsinstall_options);
|
||||
ret = 0;
|
||||
@@ -298,6 +302,9 @@ opthelp:
|
||||
case OPT_OUT:
|
||||
out_fname = opt_arg();
|
||||
break;
|
||||
case OPT_QUIET:
|
||||
quiet = 1;
|
||||
/* FALLTHROUGH */
|
||||
case OPT_NO_LOG:
|
||||
self_test_log = 0;
|
||||
break;
|
||||
@@ -359,7 +366,7 @@ opthelp:
|
||||
goto end;
|
||||
}
|
||||
|
||||
ctx = EVP_MAC_CTX_new(mac);
|
||||
ctx = EVP_MAC_new_ctx(mac);
|
||||
if (ctx == NULL) {
|
||||
BIO_printf(bio_err, "Unable to create MAC CTX for module check\n");
|
||||
goto end;
|
||||
@@ -373,7 +380,7 @@ opthelp:
|
||||
if (params == NULL)
|
||||
goto end;
|
||||
|
||||
if (!EVP_MAC_CTX_set_params(ctx, params)) {
|
||||
if (!EVP_MAC_set_ctx_params(ctx, params)) {
|
||||
BIO_printf(bio_err, "MAC parameter error\n");
|
||||
ERR_print_errors(bio_err);
|
||||
ok = 0;
|
||||
@@ -383,7 +390,7 @@ opthelp:
|
||||
goto end;
|
||||
}
|
||||
|
||||
ctx2 = EVP_MAC_CTX_dup(ctx);
|
||||
ctx2 = EVP_MAC_dup_ctx(ctx);
|
||||
if (ctx2 == NULL) {
|
||||
BIO_printf(bio_err, "Unable to create MAC CTX for install indicator\n");
|
||||
goto end;
|
||||
@@ -405,7 +412,8 @@ opthelp:
|
||||
if (!verify_config(in_fname, section_name, module_mac, module_mac_len,
|
||||
install_mac, install_mac_len))
|
||||
goto end;
|
||||
BIO_printf(bio_out, "VERIFY PASSED\n");
|
||||
if (!quiet)
|
||||
BIO_printf(bio_out, "VERIFY PASSED\n");
|
||||
} else {
|
||||
|
||||
conf = generate_config_and_load(prov_name, section_name, module_mac,
|
||||
@@ -424,23 +432,26 @@ opthelp:
|
||||
module_mac_len, install_mac,
|
||||
install_mac_len))
|
||||
goto end;
|
||||
BIO_printf(bio_out, "INSTALL PASSED\n");
|
||||
if (!quiet)
|
||||
BIO_printf(bio_out, "INSTALL PASSED\n");
|
||||
}
|
||||
|
||||
ret = 0;
|
||||
end:
|
||||
if (ret == 1) {
|
||||
BIO_printf(bio_err, "%s FAILED\n", verify ? "VERIFY" : "INSTALL");
|
||||
if (!quiet)
|
||||
BIO_printf(bio_err, "%s FAILED\n", verify ? "VERIFY" : "INSTALL");
|
||||
ERR_print_errors(bio_err);
|
||||
}
|
||||
|
||||
cleanup:
|
||||
BIO_free(fout);
|
||||
BIO_free(mem_bio);
|
||||
BIO_free(module_bio);
|
||||
sk_OPENSSL_STRING_free(opts);
|
||||
EVP_MAC_free(mac);
|
||||
EVP_MAC_CTX_free(ctx2);
|
||||
EVP_MAC_CTX_free(ctx);
|
||||
EVP_MAC_free_ctx(ctx2);
|
||||
EVP_MAC_free_ctx(ctx);
|
||||
OPENSSL_free(read_buffer);
|
||||
free_config_and_unload(conf);
|
||||
return ret;
|
||||
|
||||
+51
-22
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -8,27 +8,24 @@
|
||||
*/
|
||||
|
||||
#include <openssl/opensslconf.h>
|
||||
#ifdef OPENSSL_NO_DSA
|
||||
NON_EMPTY_TRANSLATION_UNIT
|
||||
#else
|
||||
|
||||
# include <stdio.h>
|
||||
# include <string.h>
|
||||
# include <sys/types.h>
|
||||
# include <sys/stat.h>
|
||||
# include "apps.h"
|
||||
# include "progs.h"
|
||||
# include <openssl/bio.h>
|
||||
# include <openssl/err.h>
|
||||
# include <openssl/bn.h>
|
||||
# include <openssl/dsa.h>
|
||||
# include <openssl/x509.h>
|
||||
# include <openssl/pem.h>
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/stat.h>
|
||||
#include "apps.h"
|
||||
#include "progs.h"
|
||||
#include <openssl/bio.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/bn.h>
|
||||
#include <openssl/dsa.h>
|
||||
#include <openssl/x509.h>
|
||||
#include <openssl/pem.h>
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_OUT, OPT_PASSOUT, OPT_ENGINE, OPT_CIPHER, OPT_VERBOSE,
|
||||
OPT_R_ENUM
|
||||
OPT_R_ENUM, OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS gendsa_options[] = {
|
||||
@@ -36,14 +33,15 @@ const OPTIONS gendsa_options[] = {
|
||||
|
||||
OPT_SECTION("General"),
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
# ifndef OPENSSL_NO_ENGINE
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
{"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
|
||||
# endif
|
||||
#endif
|
||||
|
||||
OPT_SECTION("Output"),
|
||||
{"out", OPT_OUT, '>', "Output the key to the specified file"},
|
||||
{"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
|
||||
OPT_R_OPTIONS,
|
||||
OPT_PROV_OPTIONS,
|
||||
{"", OPT_CIPHER, '-', "Encrypt the output with any supported cipher"},
|
||||
{"verbose", OPT_VERBOSE, '-', "Verbose output"},
|
||||
|
||||
@@ -57,6 +55,8 @@ int gendsa_main(int argc, char **argv)
|
||||
ENGINE *e = NULL;
|
||||
BIO *out = NULL, *in = NULL;
|
||||
DSA *dsa = NULL;
|
||||
EVP_PKEY *pkey = NULL;
|
||||
EVP_PKEY_CTX *ctx = NULL;
|
||||
const EVP_CIPHER *enc = NULL;
|
||||
char *dsaparams = NULL;
|
||||
char *outfile = NULL, *passoutarg = NULL, *passout = NULL, *prog;
|
||||
@@ -89,6 +89,10 @@ int gendsa_main(int argc, char **argv)
|
||||
if (!opt_rand(o))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_CIPHER:
|
||||
if (!opt_cipher(opt_unknown(), &enc))
|
||||
goto end;
|
||||
@@ -134,14 +138,38 @@ int gendsa_main(int argc, char **argv)
|
||||
" Your key size is %d! Larger key size may behave not as expected.\n",
|
||||
OPENSSL_DSA_MAX_MODULUS_BITS, BN_num_bits(p));
|
||||
|
||||
pkey = EVP_PKEY_new();
|
||||
if (pkey == NULL) {
|
||||
BIO_printf(bio_err, "unable to allocate PKEY\n");
|
||||
goto end;
|
||||
}
|
||||
if (!EVP_PKEY_set1_DSA(pkey, dsa)) {
|
||||
BIO_printf(bio_err, "unable to associate DSA parameters with PKEY\n");
|
||||
goto end;
|
||||
}
|
||||
ctx = EVP_PKEY_CTX_new(pkey, NULL);
|
||||
if (ctx == NULL) {
|
||||
BIO_printf(bio_err, "unable to create PKEY context\n");
|
||||
goto end;
|
||||
}
|
||||
EVP_PKEY_free(pkey);
|
||||
pkey = NULL;
|
||||
if (EVP_PKEY_keygen_init(ctx) <= 0) {
|
||||
BIO_printf(bio_err, "unable to set up for key generation\n");
|
||||
goto end;
|
||||
}
|
||||
if (verbose)
|
||||
BIO_printf(bio_err, "Generating DSA key, %d bits\n", BN_num_bits(p));
|
||||
if (!DSA_generate_key(dsa))
|
||||
if (EVP_PKEY_keygen(ctx, &pkey) <= 0) {
|
||||
BIO_printf(bio_err, "unable to generate key\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
assert(private);
|
||||
if (!PEM_write_bio_DSAPrivateKey(out, dsa, enc, NULL, 0, NULL, passout))
|
||||
if (!PEM_write_bio_PrivateKey(out, pkey, enc, NULL, 0, NULL, passout)) {
|
||||
BIO_printf(bio_err, "unable to output generated key\n");
|
||||
goto end;
|
||||
}
|
||||
ret = 0;
|
||||
end:
|
||||
if (ret != 0)
|
||||
@@ -150,8 +178,9 @@ int gendsa_main(int argc, char **argv)
|
||||
BIO_free(in);
|
||||
BIO_free_all(out);
|
||||
DSA_free(dsa);
|
||||
EVP_PKEY_free(pkey);
|
||||
EVP_PKEY_CTX_free(ctx);
|
||||
release_engine(e);
|
||||
OPENSSL_free(passout);
|
||||
return ret;
|
||||
}
|
||||
#endif
|
||||
+10
-2
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -24,7 +24,8 @@ static int genpkey_cb(EVP_PKEY_CTX *ctx);
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_ENGINE, OPT_OUTFORM, OPT_OUT, OPT_PASS, OPT_PARAMFILE,
|
||||
OPT_ALGORITHM, OPT_PKEYOPT, OPT_GENPARAM, OPT_TEXT, OPT_CIPHER
|
||||
OPT_ALGORITHM, OPT_PKEYOPT, OPT_GENPARAM, OPT_TEXT, OPT_CIPHER,
|
||||
OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS genpkey_options[] = {
|
||||
@@ -46,6 +47,8 @@ const OPTIONS genpkey_options[] = {
|
||||
{"text", OPT_TEXT, '-', "Print the in text"},
|
||||
{"", OPT_CIPHER, '-', "Cipher to use to encrypt the key"},
|
||||
|
||||
OPT_PROV_OPTIONS,
|
||||
|
||||
/* This is deliberately last. */
|
||||
{OPT_HELP_STR, 1, 1,
|
||||
"Order of options may be important! See the documentation.\n"},
|
||||
@@ -131,6 +134,11 @@ int genpkey_main(int argc, char **argv)
|
||||
BIO_printf(bio_err, "%s: cipher mode not supported\n", prog);
|
||||
goto end;
|
||||
}
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
|
||||
+36
-28
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -8,27 +8,24 @@
|
||||
*/
|
||||
|
||||
#include <openssl/opensslconf.h>
|
||||
#ifdef OPENSSL_NO_RSA
|
||||
NON_EMPTY_TRANSLATION_UNIT
|
||||
#else
|
||||
|
||||
# include <stdio.h>
|
||||
# include <string.h>
|
||||
# include <sys/types.h>
|
||||
# include <sys/stat.h>
|
||||
# include "apps.h"
|
||||
# include "progs.h"
|
||||
# include <openssl/bio.h>
|
||||
# include <openssl/err.h>
|
||||
# include <openssl/bn.h>
|
||||
# include <openssl/rsa.h>
|
||||
# include <openssl/evp.h>
|
||||
# include <openssl/x509.h>
|
||||
# include <openssl/pem.h>
|
||||
# include <openssl/rand.h>
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/stat.h>
|
||||
#include "apps.h"
|
||||
#include "progs.h"
|
||||
#include <openssl/bio.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/bn.h>
|
||||
#include <openssl/rsa.h>
|
||||
#include <openssl/evp.h>
|
||||
#include <openssl/x509.h>
|
||||
#include <openssl/pem.h>
|
||||
#include <openssl/rand.h>
|
||||
|
||||
# define DEFBITS 2048
|
||||
# define DEFPRIMES 2
|
||||
#define DEFBITS 2048
|
||||
#define DEFPRIMES 2
|
||||
|
||||
static int verbose = 0;
|
||||
|
||||
@@ -36,9 +33,12 @@ static int genrsa_cb(int p, int n, BN_GENCB *cb);
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_3, OPT_F4, OPT_ENGINE,
|
||||
#ifndef OPENSSL_NO_DEPRECATED_3_0
|
||||
OPT_3,
|
||||
#endif
|
||||
OPT_F4, OPT_ENGINE,
|
||||
OPT_OUT, OPT_PASSOUT, OPT_CIPHER, OPT_PRIMES, OPT_VERBOSE,
|
||||
OPT_R_ENUM
|
||||
OPT_R_ENUM, OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS genrsa_options[] = {
|
||||
@@ -46,14 +46,16 @@ const OPTIONS genrsa_options[] = {
|
||||
|
||||
OPT_SECTION("General"),
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
# ifndef OPENSSL_NO_ENGINE
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
{"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
|
||||
# endif
|
||||
#endif
|
||||
|
||||
OPT_SECTION("Input"),
|
||||
{"3", OPT_3, '-', "Use 3 for the E value"},
|
||||
{"F4", OPT_F4, '-', "Use F4 (0x10001) for the E value"},
|
||||
{"f4", OPT_F4, '-', "Use F4 (0x10001) for the E value"},
|
||||
#ifndef OPENSSL_NO_DEPRECATED_3_0
|
||||
{"3", OPT_3, '-', "(deprecated) Use 3 for the E value"},
|
||||
#endif
|
||||
{"F4", OPT_F4, '-', "Use the Fermat number F4 (0x10001) for the E value"},
|
||||
{"f4", OPT_F4, '-', "Use the Fermat number F4 (0x10001) for the E value"},
|
||||
|
||||
OPT_SECTION("Output"),
|
||||
{"out", OPT_OUT, '>', "Output the key to specified file"},
|
||||
@@ -63,6 +65,7 @@ const OPTIONS genrsa_options[] = {
|
||||
{"", OPT_CIPHER, '-', "Encrypt the output with any supported cipher"},
|
||||
|
||||
OPT_R_OPTIONS,
|
||||
OPT_PROV_OPTIONS,
|
||||
|
||||
OPT_PARAMETERS(),
|
||||
{"numbits", 0, 0, "Size of key in bits"},
|
||||
@@ -102,9 +105,11 @@ opthelp:
|
||||
ret = 0;
|
||||
opt_help(genrsa_options);
|
||||
goto end;
|
||||
#ifndef OPENSSL_NO_DEPRECATED_3_0
|
||||
case OPT_3:
|
||||
f4 = 3;
|
||||
break;
|
||||
#endif
|
||||
case OPT_F4:
|
||||
f4 = RSA_F4;
|
||||
break;
|
||||
@@ -118,6 +123,10 @@ opthelp:
|
||||
if (!opt_rand(o))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_PASSOUT:
|
||||
passoutarg = opt_arg();
|
||||
break;
|
||||
@@ -219,4 +228,3 @@ static int genrsa_cb(int p, int n, BN_GENCB *cb)
|
||||
(void)BIO_flush(BN_GENCB_get_arg(cb));
|
||||
return 1;
|
||||
}
|
||||
#endif
|
||||
+34
-46
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -12,8 +12,10 @@
|
||||
|
||||
# include "e_os.h" /* struct timeval for DTLS */
|
||||
# include "internal/nelem.h"
|
||||
# include "internal/sockets.h" /* for openssl_fdset() */
|
||||
# include <assert.h>
|
||||
|
||||
# include <stdarg.h>
|
||||
# include <sys/types.h>
|
||||
# ifndef OPENSSL_NO_POSIX_IO
|
||||
# include <sys/stat.h>
|
||||
@@ -28,26 +30,18 @@
|
||||
# include <openssl/txt_db.h>
|
||||
# include <openssl/engine.h>
|
||||
# include <openssl/ocsp.h>
|
||||
# include <openssl/http.h>
|
||||
# include <signal.h>
|
||||
# include "apps_ui.h"
|
||||
# include "opt.h"
|
||||
# include "fmt.h"
|
||||
# include "platform.h"
|
||||
|
||||
/* also in include/internal/sockets.h */
|
||||
# if defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_WINCE)
|
||||
# define openssl_fdset(a,b) FD_SET((unsigned int)a, b)
|
||||
# else
|
||||
# define openssl_fdset(a,b) FD_SET(a, b)
|
||||
# endif
|
||||
|
||||
/*
|
||||
* quick macro when you need to pass an unsigned char instead of a char.
|
||||
* this is true for some implementations of the is*() functions, for
|
||||
* example.
|
||||
*/
|
||||
#define _UC(c) ((unsigned char)(c))
|
||||
# define _UC(c) ((unsigned char)(c))
|
||||
|
||||
void app_RAND_load_conf(CONF *c, const char *section);
|
||||
void app_RAND_write(void);
|
||||
@@ -91,7 +85,7 @@ int wrap_password_callback(char *buf, int bufsiz, int verify, void *cb_data);
|
||||
|
||||
int chopup_args(ARGS *arg, char *buf);
|
||||
int dump_cert_text(BIO *out, X509 *x);
|
||||
void print_name(BIO *out, const char *title, X509_NAME *nm,
|
||||
void print_name(BIO *out, const char *title, const X509_NAME *nm,
|
||||
unsigned long lflags);
|
||||
void print_bignum_var(BIO *, const BIGNUM *, const char*,
|
||||
int, unsigned char *);
|
||||
@@ -102,18 +96,28 @@ int set_cert_ex(unsigned long *flags, const char *arg);
|
||||
int set_name_ex(unsigned long *flags, const char *arg);
|
||||
int set_ext_copy(int *copy_type, const char *arg);
|
||||
int copy_extensions(X509 *x, X509_REQ *req, int copy_type);
|
||||
char *get_passwd(const char *pass, const char *desc);
|
||||
int app_passwd(const char *arg1, const char *arg2, char **pass1, char **pass2);
|
||||
int add_oid_section(CONF *conf);
|
||||
X509 *load_cert(const char *file, int format, const char *cert_descrip);
|
||||
X509_CRL *load_crl(const char *infile, int format);
|
||||
EVP_PKEY *load_key(const char *file, int format, int maybe_stdin,
|
||||
const char *pass, ENGINE *e, const char *key_descrip);
|
||||
EVP_PKEY *load_pubkey(const char *file, int format, int maybe_stdin,
|
||||
const char *pass, ENGINE *e, const char *key_descrip);
|
||||
X509_REQ *load_csr(const char *file, int format, const char *desc);
|
||||
X509 *load_cert_pass(const char *uri, int maybe_stdin,
|
||||
const char *pass, const char *desc);
|
||||
/* the format parameter is meanwhile not needed anymore and thus ignored */
|
||||
X509 *load_cert(const char *uri, int format, const char *desc);
|
||||
X509_CRL *load_crl(const char *uri, int format, const char *desc);
|
||||
void cleanse(char *str);
|
||||
void clear_free(char *str);
|
||||
EVP_PKEY *load_key(const char *uri, int format, int maybe_stdin,
|
||||
const char *pass, ENGINE *e, const char *desc);
|
||||
EVP_PKEY *load_pubkey(const char *uri, int format, int maybe_stdin,
|
||||
const char *pass, ENGINE *e, const char *desc);
|
||||
int load_certs(const char *file, STACK_OF(X509) **certs, int format,
|
||||
const char *pass, const char *cert_descrip);
|
||||
const char *pass, const char *desc);
|
||||
int load_crls(const char *file, STACK_OF(X509_CRL) **crls, int format,
|
||||
const char *pass, const char *cert_descrip);
|
||||
const char *pass, const char *desc);
|
||||
int load_key_cert_crl(const char *uri, int maybe_stdin,
|
||||
const char *pass, const char *desc,
|
||||
EVP_PKEY **ppkey, X509 **pcert, X509_CRL **pcrl);
|
||||
X509_STORE *setup_verify(const char *CAfile, int noCAfile,
|
||||
const char *CApath, int noCApath,
|
||||
const char *CAstore, int noCAstore);
|
||||
@@ -122,7 +126,7 @@ __owur int ctx_set_verify_locations(SSL_CTX *ctx,
|
||||
const char *CApath, int noCApath,
|
||||
const char *CAstore, int noCAstore);
|
||||
|
||||
#ifndef OPENSSL_NO_CT
|
||||
# ifndef OPENSSL_NO_CT
|
||||
|
||||
/*
|
||||
* Sets the file to load the Certificate Transparency log list from.
|
||||
@@ -131,9 +135,10 @@ __owur int ctx_set_verify_locations(SSL_CTX *ctx,
|
||||
*/
|
||||
__owur int ctx_set_ctlog_list_file(SSL_CTX *ctx, const char *path);
|
||||
|
||||
#endif
|
||||
# endif
|
||||
|
||||
ENGINE *setup_engine(const char *engine, int debug);
|
||||
ENGINE *setup_engine_methods(const char *id, unsigned int methods, int debug);
|
||||
# define setup_engine(e, debug) setup_engine_methods(e, (unsigned int)-1, debug)
|
||||
void release_engine(ENGINE *e);
|
||||
|
||||
# ifndef OPENSSL_NO_OCSP
|
||||
@@ -174,6 +179,7 @@ typedef struct ca_db_st {
|
||||
# endif
|
||||
} CA_DB;
|
||||
|
||||
void app_bail_out(char *fmt, ...);
|
||||
void* app_malloc(int sz, const char *what);
|
||||
BIGNUM *load_serial(const char *serialfile, int create, ASN1_INTEGER **retai);
|
||||
int save_serial(const char *serialfile, const char *suffix, const BIGNUM *serial,
|
||||
@@ -197,12 +203,17 @@ X509_NAME *parse_name(const char *str, long chtype, int multirdn);
|
||||
void policies_print(X509_STORE_CTX *ctx);
|
||||
int bio_to_mem(unsigned char **out, int maxlen, BIO *in);
|
||||
int pkey_ctrl_string(EVP_PKEY_CTX *ctx, const char *value);
|
||||
int x509_ctrl_string(X509 *x, const char *value);
|
||||
int x509_req_ctrl_string(X509_REQ *x, const char *value);
|
||||
int init_gen_str(EVP_PKEY_CTX **pctx,
|
||||
const char *algname, ENGINE *e, int do_param);
|
||||
int do_X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md,
|
||||
STACK_OF(OPENSSL_STRING) *sigopts);
|
||||
int do_X509_verify(X509 *x, EVP_PKEY *pkey, STACK_OF(OPENSSL_STRING) *vfyopts);
|
||||
int do_X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md,
|
||||
STACK_OF(OPENSSL_STRING) *sigopts);
|
||||
int do_X509_REQ_verify(X509_REQ *x, EVP_PKEY *pkey,
|
||||
STACK_OF(OPENSSL_STRING) *vfyopts);
|
||||
int do_X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md,
|
||||
STACK_OF(OPENSSL_STRING) *sigopts);
|
||||
|
||||
@@ -217,30 +228,6 @@ void print_cert_checks(BIO *bio, X509 *x,
|
||||
|
||||
void store_setup_crl_download(X509_STORE *st);
|
||||
|
||||
typedef struct app_http_tls_info_st {
|
||||
const char *server;
|
||||
const char *port;
|
||||
int use_proxy;
|
||||
long timeout;
|
||||
SSL_CTX *ssl_ctx;
|
||||
} APP_HTTP_TLS_INFO;
|
||||
BIO *app_http_tls_cb(BIO *hbio, /* APP_HTTP_TLS_INFO */ void *arg,
|
||||
int connect, int detail);
|
||||
# ifndef OPENSSL_NO_SOCK
|
||||
ASN1_VALUE *app_http_get_asn1(const char *url, const char *proxy,
|
||||
const char *proxy_port, SSL_CTX *ssl_ctx,
|
||||
const STACK_OF(CONF_VALUE) *headers,
|
||||
long timeout, const char *expected_content_type,
|
||||
const ASN1_ITEM *it);
|
||||
ASN1_VALUE *app_http_post_asn1(const char *host, const char *port,
|
||||
const char *path, const char *proxy,
|
||||
const char *proxy_port, SSL_CTX *ctx,
|
||||
const STACK_OF(CONF_VALUE) *headers,
|
||||
const char *content_type,
|
||||
ASN1_VALUE *req, const ASN1_ITEM *req_it,
|
||||
long timeout, const ASN1_ITEM *rsp_it);
|
||||
# endif
|
||||
|
||||
# define EXT_COPY_NONE 0
|
||||
# define EXT_COPY_ADD 1
|
||||
# define EXT_COPY_ALL 2
|
||||
@@ -281,5 +268,6 @@ extern VERIFY_CB_ARGS verify_args;
|
||||
OSSL_PARAM *app_params_new_from_opts(STACK_OF(OPENSSL_STRING) *opts,
|
||||
const OSSL_PARAM *paramdefs);
|
||||
void app_params_free(OSSL_PARAM *params);
|
||||
void app_providers_cleanup(void);
|
||||
|
||||
#endif
|
||||
@@ -1,7 +1,7 @@
|
||||
/*
|
||||
* Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
|
||||
+2
-2
@@ -1,7 +1,7 @@
|
||||
/*
|
||||
* Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -13,6 +13,8 @@
|
||||
# include <openssl/lhash.h>
|
||||
# include "opt.h"
|
||||
|
||||
#define DEPRECATED_NO_ALTERNATIVE "unknown"
|
||||
|
||||
typedef enum FUNC_TYPE {
|
||||
FT_none, FT_general, FT_md, FT_cipher, FT_pkey,
|
||||
FT_md_alg, FT_cipher_alg
|
||||
@@ -23,6 +25,8 @@ typedef struct function_st {
|
||||
const char *name;
|
||||
int (*func)(int argc, char *argv[]);
|
||||
const OPTIONS *help;
|
||||
const char *deprecated_alternative;
|
||||
const char *deprecated_version;
|
||||
} FUNCTION;
|
||||
|
||||
DEFINE_LHASH_OF(FUNCTION);
|
||||
|
||||
@@ -0,0 +1,118 @@
|
||||
/*
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#ifndef OSSL_HTTP_SERVER_H
|
||||
# define OSSL_HTTP_SERVER_H
|
||||
|
||||
# include "apps.h"
|
||||
|
||||
# ifndef HAVE_FORK
|
||||
# if defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_WINDOWS)
|
||||
# define HAVE_FORK 0
|
||||
# else
|
||||
# define HAVE_FORK 1
|
||||
# endif
|
||||
# endif
|
||||
|
||||
# if HAVE_FORK
|
||||
# undef NO_FORK
|
||||
# else
|
||||
# define NO_FORK
|
||||
# endif
|
||||
|
||||
# if !defined(NO_FORK) && !defined(OPENSSL_NO_SOCK) \
|
||||
&& !defined(OPENSSL_NO_POSIX_IO)
|
||||
# define HTTP_DAEMON
|
||||
# include <sys/types.h>
|
||||
# include <sys/wait.h>
|
||||
# include <syslog.h>
|
||||
# include <signal.h>
|
||||
# define MAXERRLEN 1000 /* limit error text sent to syslog to 1000 bytes */
|
||||
# else
|
||||
# undef LOG_INFO
|
||||
# undef LOG_WARNING
|
||||
# undef LOG_ERR
|
||||
# define LOG_INFO 0
|
||||
# define LOG_WARNING 1
|
||||
# define LOG_ERR 2
|
||||
# endif
|
||||
|
||||
/*-
|
||||
* Log a message to syslog if multi-threaded HTTP_DAEMON, else to bio_err
|
||||
* prog: the name of the current app
|
||||
* level: the severity of the message, e.g., LOG_ERR
|
||||
* fmt: message with potential extra parameters like with printf()
|
||||
* returns nothing
|
||||
*/
|
||||
void log_message(const char *prog, int level, const char *fmt, ...);
|
||||
|
||||
# ifndef OPENSSL_NO_SOCK
|
||||
/*-
|
||||
* Initialize an HTTP server by setting up its listening BIO
|
||||
* prog: the name of the current app
|
||||
* port: the port to listen on
|
||||
* returns a BIO for accepting requests, NULL on error
|
||||
*/
|
||||
BIO *http_server_init_bio(const char *prog, const char *port);
|
||||
|
||||
/*-
|
||||
* Accept an ASN.1-formatted HTTP request
|
||||
* it: the expected request ASN.1 type
|
||||
* preq: pointer to variable where to place the parsed request
|
||||
* pcbio: pointer to variable where to place the BIO for sending the response to
|
||||
* ppath: pointer to variable where to place the request path, or NULL
|
||||
* acbio: the listening bio (typically as returned by http_server_init_bio())
|
||||
* prog: the name of the current app
|
||||
* accept_get: whether to accept GET requests (in addition to POST requests)
|
||||
* timeout: connection timeout (in seconds), or 0 for none/infinite
|
||||
* returns 0 in case caller should retry, then *preq == *ppath == *pcbio == NULL
|
||||
* returns -1 on fatal error; also then holds *preq == *ppath == *pcbio == NULL
|
||||
* returns 1 otherwise. In this case it is guaranteed that *pcbio != NULL while
|
||||
* *ppath == NULL and *preq == NULL if and only if the request is invalid,
|
||||
* On return value 1 the caller is responsible for sending an HTTP response,
|
||||
* using http_server_send_asn1_resp() or http_server_send_status().
|
||||
* The caller must free any non-NULL *preq, *ppath, and *pcbio pointers.
|
||||
*/
|
||||
int http_server_get_asn1_req(const ASN1_ITEM *it, ASN1_VALUE **preq,
|
||||
char **ppath, BIO **pcbio, BIO *acbio,
|
||||
const char *prog, int accept_get, int timeout);
|
||||
|
||||
/*-
|
||||
* Send an ASN.1-formatted HTTP response
|
||||
* cbio: destination BIO (typically as returned by http_server_get_asn1_req())
|
||||
* note: cbio should not do an encoding that changes the output length
|
||||
* content_type: string identifying the type of the response
|
||||
* it: the response ASN.1 type
|
||||
* valit: the response ASN.1 type
|
||||
* resp: the response to send
|
||||
* returns 1 on success, 0 on failure
|
||||
*/
|
||||
int http_server_send_asn1_resp(BIO *cbio, const char *content_type,
|
||||
const ASN1_ITEM *it, const ASN1_VALUE *resp);
|
||||
|
||||
/*-
|
||||
* Send a trivial HTTP response, typically to report an error or OK
|
||||
* cbio: destination BIO (typically as returned by http_server_get_asn1_req())
|
||||
* status: the status code to send
|
||||
* reason: the corresponding human-readable string
|
||||
* returns 1 on success, 0 on failure
|
||||
*/
|
||||
int http_server_send_status(BIO *cbio, int status, const char *reason);
|
||||
|
||||
# endif
|
||||
|
||||
# ifdef HTTP_DAEMON
|
||||
extern int multi;
|
||||
extern int acfd;
|
||||
|
||||
void socket_timeout(int signum);
|
||||
void spawn_loop(const char *prog);
|
||||
# endif
|
||||
|
||||
#endif
|
||||
+25
-4
@@ -1,7 +1,7 @@
|
||||
/*
|
||||
* Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
@@ -132,9 +132,9 @@
|
||||
{ "xchain_build", OPT_X_CHAIN_BUILD, '-', \
|
||||
"build certificate chain for the extended certificates"}, \
|
||||
{ "xcertform", OPT_X_CERTFORM, 'F', \
|
||||
"format of Extended certificate (PEM or DER) PEM default " }, \
|
||||
"format of Extended certificate (PEM/DER/P12); has no effect" }, \
|
||||
{ "xkeyform", OPT_X_KEYFORM, 'F', \
|
||||
"format of Extended certificate's key (PEM or DER) PEM default"}
|
||||
"format of Extended certificate's key (DER/PEM/P12); has no effect"}
|
||||
|
||||
# define OPT_X_CASES \
|
||||
OPT_X__FIRST: case OPT_X__LAST: break; \
|
||||
@@ -265,6 +265,24 @@
|
||||
OPT_R__FIRST: case OPT_R__LAST: break; \
|
||||
case OPT_R_RAND: case OPT_R_WRITERAND
|
||||
|
||||
/*
|
||||
* Provider options.
|
||||
*/
|
||||
# define OPT_PROV_ENUM \
|
||||
OPT_PROV__FIRST=1600, \
|
||||
OPT_PROV_PROVIDER, OPT_PROV_PROVIDER_PATH, \
|
||||
OPT_PROV__LAST
|
||||
|
||||
# define OPT_PROV_OPTIONS \
|
||||
OPT_SECTION("Provider"), \
|
||||
{ "provider_path", OPT_PROV_PROVIDER_PATH, 's', "Provider load path (must be before 'provider' argument if required)" }, \
|
||||
{ "provider", OPT_PROV_PROVIDER, 's', "Provider to load (can be specified multiple times)" }
|
||||
|
||||
# define OPT_PROV_CASES \
|
||||
OPT_PROV__FIRST: case OPT_PROV__LAST: break; \
|
||||
case OPT_PROV_PROVIDER: \
|
||||
case OPT_PROV_PROVIDER_PATH
|
||||
|
||||
/*
|
||||
* Option parsing.
|
||||
*/
|
||||
@@ -324,6 +342,7 @@ char *opt_init(int ac, char **av, const OPTIONS * o);
|
||||
int opt_next(void);
|
||||
void opt_begin(void);
|
||||
int opt_format(const char *s, unsigned long flags, int *result);
|
||||
const char *format2str(int format);
|
||||
int opt_int(const char *arg, int *result);
|
||||
int opt_ulong(const char *arg, unsigned long *result);
|
||||
int opt_long(const char *arg, long *result);
|
||||
@@ -348,9 +367,11 @@ char **opt_rest(void);
|
||||
int opt_num_rest(void);
|
||||
int opt_verify(int i, X509_VERIFY_PARAM *vpm);
|
||||
int opt_rand(int i);
|
||||
int opt_provider(int i);
|
||||
void opt_help(const OPTIONS * list);
|
||||
void opt_print(const OPTIONS * opt, int doingparams, int width);
|
||||
int opt_format_error(const char *s, unsigned long flags);
|
||||
void print_format_error(int format, unsigned long flags);
|
||||
int opt_isdir(const char *name);
|
||||
int opt_printf_stderr(const char *fmt, ...);
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -32,6 +32,7 @@ int init_client(int *sock, const char *host, const char *port,
|
||||
const char *bindhost, const char *bindport,
|
||||
int family, int type, int protocol);
|
||||
int should_retry(int i);
|
||||
void do_ssl_shutdown(SSL *ssl);
|
||||
|
||||
long bio_dump_callback(BIO *bio, int cmd, const char *argp,
|
||||
int argi, long argl, long ret);
|
||||
|
||||
+15
-6
@@ -1,7 +1,7 @@
|
||||
/*
|
||||
* Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
@@ -17,9 +17,12 @@
|
||||
#include <openssl/kdf.h>
|
||||
#include <openssl/params.h>
|
||||
|
||||
DEFINE_STACK_OF_STRING()
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_KDFOPT, OPT_BIN, OPT_KEYLEN, OPT_OUT
|
||||
OPT_KDFOPT, OPT_BIN, OPT_KEYLEN, OPT_OUT,
|
||||
OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS kdf_options[] = {
|
||||
@@ -36,6 +39,8 @@ const OPTIONS kdf_options[] = {
|
||||
{"binary", OPT_BIN, '-',
|
||||
"Output in binary format (default is hexadecimal)"},
|
||||
|
||||
OPT_PROV_OPTIONS,
|
||||
|
||||
OPT_PARAMETERS(),
|
||||
{"kdf_name", 0, 0, "Name of the KDF algorithm"},
|
||||
{NULL}
|
||||
@@ -80,6 +85,10 @@ opthelp:
|
||||
if (opts == NULL || !sk_OPENSSL_STRING_push(opts, opt_arg()))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto err;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
@@ -95,7 +104,7 @@ opthelp:
|
||||
goto opthelp;
|
||||
}
|
||||
|
||||
ctx = EVP_KDF_CTX_new(kdf);
|
||||
ctx = EVP_KDF_new_ctx(kdf);
|
||||
if (ctx == NULL)
|
||||
goto err;
|
||||
|
||||
@@ -107,7 +116,7 @@ opthelp:
|
||||
if (params == NULL)
|
||||
goto err;
|
||||
|
||||
if (!EVP_KDF_CTX_set_params(ctx, params)) {
|
||||
if (!EVP_KDF_set_ctx_params(ctx, params)) {
|
||||
BIO_printf(bio_err, "KDF parameter error\n");
|
||||
ERR_print_errors(bio_err);
|
||||
ok = 0;
|
||||
@@ -152,7 +161,7 @@ err:
|
||||
OPENSSL_clear_free(dkm_bytes, dkm_len);
|
||||
sk_OPENSSL_STRING_free(opts);
|
||||
EVP_KDF_free(kdf);
|
||||
EVP_KDF_CTX_free(ctx);
|
||||
EVP_KDF_free_ctx(ctx);
|
||||
BIO_free(out);
|
||||
OPENSSL_free(hexout);
|
||||
return ret;
|
||||
|
||||
@@ -0,0 +1,74 @@
|
||||
/*
|
||||
* Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include "apps.h"
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/provider.h>
|
||||
#include <openssl/safestack.h>
|
||||
|
||||
DEFINE_STACK_OF(OSSL_PROVIDER)
|
||||
|
||||
/*
|
||||
* See comments in opt_verify for explanation of this.
|
||||
*/
|
||||
enum prov_range { OPT_PROV_ENUM };
|
||||
|
||||
static STACK_OF(OSSL_PROVIDER) *app_providers = NULL;
|
||||
|
||||
static int opt_provider_load(const char *provider)
|
||||
{
|
||||
OSSL_PROVIDER *prov;
|
||||
|
||||
prov = OSSL_PROVIDER_load(NULL, provider);
|
||||
if (prov == NULL) {
|
||||
opt_printf_stderr("%s: unable to load provider %s\n",
|
||||
opt_getprog(), provider);
|
||||
return 0;
|
||||
}
|
||||
if (app_providers == NULL)
|
||||
app_providers = sk_OSSL_PROVIDER_new_null();
|
||||
if (app_providers == NULL
|
||||
|| !sk_OSSL_PROVIDER_push(app_providers, prov)) {
|
||||
app_providers_cleanup();
|
||||
return 0;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
static void provider_free(OSSL_PROVIDER *prov)
|
||||
{
|
||||
OSSL_PROVIDER_unload(prov);
|
||||
}
|
||||
|
||||
void app_providers_cleanup(void)
|
||||
{
|
||||
sk_OSSL_PROVIDER_pop_free(app_providers, provider_free);
|
||||
app_providers = NULL;
|
||||
}
|
||||
|
||||
static int opt_provider_path(const char *path)
|
||||
{
|
||||
if (path != NULL && *path == '\0')
|
||||
path = NULL;
|
||||
return OSSL_PROVIDER_set_default_search_path(NULL, path);
|
||||
}
|
||||
|
||||
int opt_provider(int opt)
|
||||
{
|
||||
switch ((enum prov_range)opt) {
|
||||
case OPT_PROV__FIRST:
|
||||
case OPT_PROV__LAST:
|
||||
return 1;
|
||||
case OPT_PROV_PROVIDER:
|
||||
return opt_provider_load(opt_arg());
|
||||
case OPT_PROV_PROVIDER_PATH:
|
||||
return opt_provider_path(opt_arg());
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,137 @@
|
||||
/*
|
||||
* Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include <string.h>
|
||||
#include "apps.h"
|
||||
|
||||
/*
|
||||
* X509_ctrl_str() is sorely lacking in libcrypto, but is still needed to
|
||||
* allow the application to process verification options in a manner similar
|
||||
* to signature or other options that pass through EVP_PKEY_CTX_ctrl_str(),
|
||||
* for uniformity.
|
||||
*
|
||||
* As soon as more stuff is added, the code will need serious rework. For
|
||||
* the moment, it only handles the FIPS 196 / SM2 distinguishing ID.
|
||||
*/
|
||||
#ifdef EVP_PKEY_CTRL_SET1_ID
|
||||
static ASN1_OCTET_STRING *mk_octet_string(void *value, size_t value_n)
|
||||
{
|
||||
ASN1_OCTET_STRING *v = ASN1_OCTET_STRING_new();
|
||||
|
||||
if (v == NULL) {
|
||||
BIO_printf(bio_err, "error: allocation failed\n");
|
||||
} else if (!ASN1_OCTET_STRING_set(v, value, value_n)) {
|
||||
ASN1_OCTET_STRING_free(v);
|
||||
v = NULL;
|
||||
}
|
||||
return v;
|
||||
}
|
||||
#endif
|
||||
|
||||
static int x509_ctrl(void *object, int cmd, void *value, size_t value_n)
|
||||
{
|
||||
switch (cmd) {
|
||||
#ifdef EVP_PKEY_CTRL_SET1_ID
|
||||
case EVP_PKEY_CTRL_SET1_ID:
|
||||
{
|
||||
ASN1_OCTET_STRING *v = mk_octet_string(value, value_n);
|
||||
|
||||
if (v == NULL) {
|
||||
BIO_printf(bio_err,
|
||||
"error: setting distinguishing ID in certificate failed\n");
|
||||
return 0;
|
||||
}
|
||||
|
||||
X509_set0_distinguishing_id(object, v);
|
||||
return 1;
|
||||
}
|
||||
#endif
|
||||
default:
|
||||
break;
|
||||
}
|
||||
return -2; /* typical EVP_PKEY return for "unsupported" */
|
||||
}
|
||||
|
||||
static int x509_req_ctrl(void *object, int cmd, void *value, size_t value_n)
|
||||
{
|
||||
switch (cmd) {
|
||||
#ifdef EVP_PKEY_CTRL_SET1_ID
|
||||
case EVP_PKEY_CTRL_SET1_ID:
|
||||
{
|
||||
ASN1_OCTET_STRING *v = mk_octet_string(value, value_n);
|
||||
|
||||
if (v == NULL) {
|
||||
BIO_printf(bio_err,
|
||||
"error: setting distinguishing ID in certificate signing request failed\n");
|
||||
return 0;
|
||||
}
|
||||
|
||||
X509_REQ_set0_distinguishing_id(object, v);
|
||||
return 1;
|
||||
}
|
||||
#endif
|
||||
default:
|
||||
break;
|
||||
}
|
||||
return -2; /* typical EVP_PKEY return for "unsupported" */
|
||||
}
|
||||
|
||||
static int do_x509_ctrl_string(int (*ctrl)(void *object, int cmd,
|
||||
void *value, size_t value_n),
|
||||
void *object, const char *value)
|
||||
{
|
||||
int rv = 0;
|
||||
char *stmp, *vtmp = NULL;
|
||||
size_t vtmp_len = 0;
|
||||
int cmd = 0; /* Will get command values that make sense somehow */
|
||||
|
||||
stmp = OPENSSL_strdup(value);
|
||||
if (stmp == NULL)
|
||||
return -1;
|
||||
vtmp = strchr(stmp, ':');
|
||||
if (vtmp != NULL) {
|
||||
*vtmp = 0;
|
||||
vtmp++;
|
||||
vtmp_len = strlen(vtmp);
|
||||
}
|
||||
|
||||
if (strcmp(stmp, "distid") == 0) {
|
||||
#ifdef EVP_PKEY_CTRL_SET1_ID
|
||||
cmd = EVP_PKEY_CTRL_SET1_ID; /* ... except we put it in X509 */
|
||||
#endif
|
||||
} else if (strcmp(stmp, "hexdistid") == 0) {
|
||||
if (vtmp != NULL) {
|
||||
void *hexid;
|
||||
long hexid_len = 0;
|
||||
|
||||
hexid = OPENSSL_hexstr2buf((const char *)vtmp, &hexid_len);
|
||||
OPENSSL_free(stmp);
|
||||
stmp = vtmp = hexid;
|
||||
vtmp_len = (size_t)hexid_len;
|
||||
}
|
||||
#ifdef EVP_PKEY_CTRL_SET1_ID
|
||||
cmd = EVP_PKEY_CTRL_SET1_ID; /* ... except we put it in X509 */
|
||||
#endif
|
||||
}
|
||||
|
||||
rv = ctrl(object, cmd, vtmp, vtmp_len);
|
||||
|
||||
OPENSSL_free(stmp);
|
||||
return rv;
|
||||
}
|
||||
|
||||
int x509_ctrl_string(X509 *x, const char *value)
|
||||
{
|
||||
return do_x509_ctrl_string(x509_ctrl, x, value);
|
||||
}
|
||||
|
||||
int x509_req_ctrl_string(X509_REQ *x, const char *value)
|
||||
{
|
||||
return do_x509_ctrl_string(x509_req_ctrl, x, value);
|
||||
}
|
||||
+296
-438
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -29,6 +29,7 @@
|
||||
#include <openssl/x509.h>
|
||||
#include <openssl/x509v3.h>
|
||||
#include <openssl/pem.h>
|
||||
#include <openssl/store.h>
|
||||
#include <openssl/pkcs12.h>
|
||||
#include <openssl/ui.h>
|
||||
#include <openssl/safestack.h>
|
||||
@@ -57,6 +58,17 @@ static int WIN32_rename(const char *from, const char *to);
|
||||
|
||||
#define PASS_SOURCE_SIZE_MAX 4
|
||||
|
||||
DEFINE_STACK_OF(CONF)
|
||||
DEFINE_STACK_OF(CONF_VALUE)
|
||||
DEFINE_STACK_OF(X509)
|
||||
DEFINE_STACK_OF(X509_CRL)
|
||||
DEFINE_STACK_OF(X509_INFO)
|
||||
DEFINE_STACK_OF(X509_EXTENSION)
|
||||
DEFINE_STACK_OF(X509_POLICY_NODE)
|
||||
DEFINE_STACK_OF(GENERAL_NAME)
|
||||
DEFINE_STACK_OF(DIST_POINT)
|
||||
DEFINE_STACK_OF_STRING()
|
||||
|
||||
typedef struct {
|
||||
const char *name;
|
||||
unsigned long flag;
|
||||
@@ -198,6 +210,24 @@ int wrap_password_callback(char *buf, int bufsiz, int verify, void *userdata)
|
||||
|
||||
static char *app_get_pass(const char *arg, int keepbio);
|
||||
|
||||
char *get_passwd(const char *pass, const char *desc)
|
||||
{
|
||||
char *result = NULL;
|
||||
|
||||
if (desc == NULL)
|
||||
desc = "<unknown>";
|
||||
if (!app_passwd(pass, NULL, &result, NULL))
|
||||
BIO_printf(bio_err, "Error getting password for %s\n", desc);
|
||||
if (pass != NULL && result == NULL) {
|
||||
BIO_printf(bio_err,
|
||||
"Trying plain input string (better precede with 'pass:')\n");
|
||||
result = OPENSSL_strdup(pass);
|
||||
if (result == NULL)
|
||||
BIO_printf(bio_err, "Out of memory getting password for %s\n", desc);
|
||||
}
|
||||
return result;
|
||||
}
|
||||
|
||||
int app_passwd(const char *arg1, const char *arg2, char **pass1, char **pass2)
|
||||
{
|
||||
int same = arg1 != NULL && arg2 != NULL && strcmp(arg1, arg2) == 0;
|
||||
@@ -401,276 +431,158 @@ int add_oid_section(CONF *conf)
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int load_pkcs12(BIO *in, const char *desc,
|
||||
pem_password_cb *pem_cb, PW_CB_DATA *cb_data,
|
||||
EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca)
|
||||
X509 *load_cert_pass(const char *uri, int maybe_stdin,
|
||||
const char *pass, const char *desc)
|
||||
{
|
||||
const char *pass;
|
||||
char tpass[PEM_BUFSIZE];
|
||||
int len, ret = 0;
|
||||
PKCS12 *p12;
|
||||
p12 = d2i_PKCS12_bio(in, NULL);
|
||||
if (p12 == NULL) {
|
||||
BIO_printf(bio_err, "Error loading PKCS12 file for %s\n", desc);
|
||||
goto die;
|
||||
}
|
||||
/* See if an empty password will do */
|
||||
if (PKCS12_verify_mac(p12, "", 0) || PKCS12_verify_mac(p12, NULL, 0)) {
|
||||
pass = "";
|
||||
} else {
|
||||
if (pem_cb == NULL)
|
||||
pem_cb = (pem_password_cb *)password_callback;
|
||||
len = pem_cb(tpass, PEM_BUFSIZE, 0, cb_data);
|
||||
if (len < 0) {
|
||||
BIO_printf(bio_err, "Passphrase callback error for %s\n", desc);
|
||||
goto die;
|
||||
}
|
||||
if (len < PEM_BUFSIZE)
|
||||
tpass[len] = 0;
|
||||
if (!PKCS12_verify_mac(p12, tpass, len)) {
|
||||
BIO_printf(bio_err,
|
||||
"Mac verify error (wrong password?) in PKCS12 file for %s\n",
|
||||
desc);
|
||||
goto die;
|
||||
}
|
||||
pass = tpass;
|
||||
}
|
||||
ret = PKCS12_parse(p12, pass, pkey, cert, ca);
|
||||
die:
|
||||
PKCS12_free(p12);
|
||||
return ret;
|
||||
}
|
||||
X509 *cert = NULL;
|
||||
|
||||
X509 *load_cert(const char *file, int format, const char *cert_descrip)
|
||||
{
|
||||
X509 *x = NULL;
|
||||
BIO *cert;
|
||||
|
||||
if (format == FORMAT_HTTP) {
|
||||
#if !defined(OPENSSL_NO_SOCK)
|
||||
x = X509_load_http(file, NULL, NULL, 0 /* timeout */);
|
||||
#endif
|
||||
return x;
|
||||
}
|
||||
|
||||
if (file == NULL) {
|
||||
unbuffer(stdin);
|
||||
cert = dup_bio_in(format);
|
||||
} else {
|
||||
cert = bio_open_default(file, 'r', format);
|
||||
}
|
||||
if (cert == NULL)
|
||||
goto end;
|
||||
|
||||
if (format == FORMAT_ASN1) {
|
||||
x = d2i_X509_bio(cert, NULL);
|
||||
} else if (format == FORMAT_PEM) {
|
||||
x = PEM_read_bio_X509_AUX(cert, NULL,
|
||||
(pem_password_cb *)password_callback, NULL);
|
||||
} else if (format == FORMAT_PKCS12) {
|
||||
if (!load_pkcs12(cert, cert_descrip, NULL, NULL, NULL, &x, NULL))
|
||||
goto end;
|
||||
} else {
|
||||
BIO_printf(bio_err, "bad input format specified for %s\n", cert_descrip);
|
||||
goto end;
|
||||
}
|
||||
end:
|
||||
if (x == NULL) {
|
||||
BIO_printf(bio_err, "unable to load certificate\n");
|
||||
if (desc == NULL)
|
||||
desc = "certificate";
|
||||
(void)load_key_cert_crl(uri, maybe_stdin, pass, desc, NULL, &cert, NULL);
|
||||
if (cert == NULL) {
|
||||
BIO_printf(bio_err, "Unable to load %s\n", desc);
|
||||
ERR_print_errors(bio_err);
|
||||
}
|
||||
BIO_free(cert);
|
||||
return x;
|
||||
return cert;
|
||||
}
|
||||
|
||||
X509_CRL *load_crl(const char *infile, int format)
|
||||
/* the format parameter is meanwhile not needed anymore and thus ignored */
|
||||
X509 *load_cert(const char *uri, int format, const char *desc)
|
||||
{
|
||||
X509_CRL *x = NULL;
|
||||
BIO *in = NULL;
|
||||
return load_cert_pass(uri, 1, NULL, desc);
|
||||
}
|
||||
|
||||
if (format == FORMAT_HTTP) {
|
||||
#if !defined(OPENSSL_NO_SOCK)
|
||||
x = X509_CRL_load_http(infile, NULL, NULL, 0 /* timeout */);
|
||||
#endif
|
||||
return x;
|
||||
/* the format parameter is meanwhile not needed anymore and thus ignored */
|
||||
X509_CRL *load_crl(const char *uri, int format, const char *desc)
|
||||
{
|
||||
X509_CRL *crl = NULL;
|
||||
|
||||
if (desc == NULL)
|
||||
desc = "CRL";
|
||||
(void)load_key_cert_crl(uri, 0, NULL, desc, NULL, NULL, &crl);
|
||||
if (crl == NULL) {
|
||||
BIO_printf(bio_err, "Unable to load %s\n", desc);
|
||||
ERR_print_errors(bio_err);
|
||||
}
|
||||
return crl;
|
||||
}
|
||||
|
||||
in = bio_open_default(infile, 'r', format);
|
||||
X509_REQ *load_csr(const char *file, int format, const char *desc)
|
||||
{
|
||||
X509_REQ *req = NULL;
|
||||
BIO *in;
|
||||
|
||||
if (desc == NULL)
|
||||
desc = "CSR";
|
||||
in = bio_open_default(file, 'r', format);
|
||||
if (in == NULL)
|
||||
goto end;
|
||||
if (format == FORMAT_ASN1) {
|
||||
x = d2i_X509_CRL_bio(in, NULL);
|
||||
} else if (format == FORMAT_PEM) {
|
||||
x = PEM_read_bio_X509_CRL(in, NULL, NULL, NULL);
|
||||
} else {
|
||||
BIO_printf(bio_err, "bad input format specified for input crl\n");
|
||||
goto end;
|
||||
}
|
||||
if (x == NULL) {
|
||||
BIO_printf(bio_err, "unable to load CRL\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (format == FORMAT_ASN1)
|
||||
req = d2i_X509_REQ_bio(in, NULL);
|
||||
else if (format == FORMAT_PEM)
|
||||
req = PEM_read_bio_X509_REQ(in, NULL, NULL, NULL);
|
||||
else
|
||||
print_format_error(format, OPT_FMT_PEMDER);
|
||||
|
||||
end:
|
||||
if (req == NULL) {
|
||||
BIO_printf(bio_err, "Unable to load %s\n", desc);
|
||||
ERR_print_errors(bio_err);
|
||||
}
|
||||
BIO_free(in);
|
||||
return x;
|
||||
return req;
|
||||
}
|
||||
|
||||
EVP_PKEY *load_key(const char *file, int format, int maybe_stdin,
|
||||
const char *pass, ENGINE *e, const char *key_descrip)
|
||||
void cleanse(char *str)
|
||||
{
|
||||
if (str != NULL)
|
||||
OPENSSL_cleanse(str, strlen(str));
|
||||
}
|
||||
|
||||
void clear_free(char *str)
|
||||
{
|
||||
if (str != NULL)
|
||||
OPENSSL_clear_free(str, strlen(str));
|
||||
}
|
||||
|
||||
EVP_PKEY *load_key(const char *uri, int format, int may_stdin,
|
||||
const char *pass, ENGINE *e, const char *desc)
|
||||
{
|
||||
BIO *key = NULL;
|
||||
EVP_PKEY *pkey = NULL;
|
||||
PW_CB_DATA cb_data;
|
||||
|
||||
cb_data.password = pass;
|
||||
cb_data.prompt_info = file;
|
||||
if (desc == NULL)
|
||||
desc = "private key";
|
||||
|
||||
if (file == NULL && (!maybe_stdin || format == FORMAT_ENGINE)) {
|
||||
BIO_printf(bio_err, "no keyfile specified\n");
|
||||
goto end;
|
||||
}
|
||||
if (format == FORMAT_ENGINE) {
|
||||
if (e == NULL) {
|
||||
BIO_printf(bio_err, "no engine specified\n");
|
||||
BIO_printf(bio_err, "No engine specified for loading %s\n", desc);
|
||||
} else {
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
PW_CB_DATA cb_data;
|
||||
|
||||
cb_data.password = pass;
|
||||
cb_data.prompt_info = uri;
|
||||
if (ENGINE_init(e)) {
|
||||
pkey = ENGINE_load_private_key(e, file,
|
||||
pkey = ENGINE_load_private_key(e, uri,
|
||||
(UI_METHOD *)get_ui_method(),
|
||||
&cb_data);
|
||||
ENGINE_finish(e);
|
||||
}
|
||||
if (pkey == NULL) {
|
||||
BIO_printf(bio_err, "cannot load %s from engine\n", key_descrip);
|
||||
BIO_printf(bio_err, "Cannot load %s from engine\n", desc);
|
||||
ERR_print_errors(bio_err);
|
||||
}
|
||||
#else
|
||||
BIO_printf(bio_err, "engines not supported\n");
|
||||
BIO_printf(bio_err, "Engines not supported for loading %s\n", desc);
|
||||
#endif
|
||||
}
|
||||
goto end;
|
||||
}
|
||||
if (file == NULL && maybe_stdin) {
|
||||
unbuffer(stdin);
|
||||
key = dup_bio_in(format);
|
||||
} else {
|
||||
key = bio_open_default(file, 'r', format);
|
||||
(void)load_key_cert_crl(uri, may_stdin, pass, desc, &pkey, NULL, NULL);
|
||||
}
|
||||
if (key == NULL)
|
||||
goto end;
|
||||
if (format == FORMAT_ASN1) {
|
||||
pkey = d2i_PrivateKey_bio(key, NULL);
|
||||
} else if (format == FORMAT_PEM) {
|
||||
pkey = PEM_read_bio_PrivateKey(key, NULL, wrap_password_callback, &cb_data);
|
||||
} else if (format == FORMAT_PKCS12) {
|
||||
if (!load_pkcs12(key, key_descrip, wrap_password_callback, &cb_data,
|
||||
&pkey, NULL, NULL))
|
||||
goto end;
|
||||
#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DSA) && !defined (OPENSSL_NO_RC4)
|
||||
} else if (format == FORMAT_MSBLOB) {
|
||||
pkey = b2i_PrivateKey_bio(key);
|
||||
} else if (format == FORMAT_PVK) {
|
||||
pkey = b2i_PVK_bio(key, wrap_password_callback, &cb_data);
|
||||
#endif
|
||||
} else {
|
||||
BIO_printf(bio_err, "bad input format specified for key file\n");
|
||||
goto end;
|
||||
}
|
||||
end:
|
||||
BIO_free(key);
|
||||
|
||||
if (pkey == NULL) {
|
||||
BIO_printf(bio_err, "unable to load %s\n", key_descrip);
|
||||
BIO_printf(bio_err, "Unable to load %s\n", desc);
|
||||
ERR_print_errors(bio_err);
|
||||
}
|
||||
return pkey;
|
||||
}
|
||||
|
||||
EVP_PKEY *load_pubkey(const char *file, int format, int maybe_stdin,
|
||||
const char *pass, ENGINE *e, const char *key_descrip)
|
||||
EVP_PKEY *load_pubkey(const char *uri, int format, int maybe_stdin,
|
||||
const char *pass, ENGINE *e, const char *desc)
|
||||
{
|
||||
BIO *key = NULL;
|
||||
EVP_PKEY *pkey = NULL;
|
||||
PW_CB_DATA cb_data;
|
||||
|
||||
cb_data.password = pass;
|
||||
cb_data.prompt_info = file;
|
||||
if (desc == NULL)
|
||||
desc = "public key";
|
||||
|
||||
if (file == NULL && (!maybe_stdin || format == FORMAT_ENGINE)) {
|
||||
BIO_printf(bio_err, "no keyfile specified\n");
|
||||
goto end;
|
||||
}
|
||||
if (format == FORMAT_ENGINE) {
|
||||
if (e == NULL) {
|
||||
BIO_printf(bio_err, "no engine specified\n");
|
||||
BIO_printf(bio_err, "No engine specified for loading %s\n", desc);
|
||||
} else {
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
pkey = ENGINE_load_public_key(e, file, (UI_METHOD *)get_ui_method(),
|
||||
PW_CB_DATA cb_data;
|
||||
|
||||
cb_data.password = pass;
|
||||
cb_data.prompt_info = uri;
|
||||
pkey = ENGINE_load_public_key(e, uri, (UI_METHOD *)get_ui_method(),
|
||||
&cb_data);
|
||||
if (pkey == NULL) {
|
||||
BIO_printf(bio_err, "cannot load %s from engine\n", key_descrip);
|
||||
BIO_printf(bio_err, "Cannot load %s from engine\n", desc);
|
||||
ERR_print_errors(bio_err);
|
||||
}
|
||||
#else
|
||||
BIO_printf(bio_err, "engines not supported\n");
|
||||
BIO_printf(bio_err, "Engines not supported for loading %s\n", desc);
|
||||
#endif
|
||||
}
|
||||
goto end;
|
||||
}
|
||||
if (file == NULL && maybe_stdin) {
|
||||
unbuffer(stdin);
|
||||
key = dup_bio_in(format);
|
||||
} else {
|
||||
key = bio_open_default(file, 'r', format);
|
||||
(void)load_key_cert_crl(uri, maybe_stdin, pass, desc, &pkey,
|
||||
NULL, NULL);
|
||||
}
|
||||
if (key == NULL)
|
||||
goto end;
|
||||
if (format == FORMAT_ASN1) {
|
||||
pkey = d2i_PUBKEY_bio(key, NULL);
|
||||
} else if (format == FORMAT_ASN1RSA) {
|
||||
#ifndef OPENSSL_NO_RSA
|
||||
RSA *rsa;
|
||||
rsa = d2i_RSAPublicKey_bio(key, NULL);
|
||||
if (rsa) {
|
||||
pkey = EVP_PKEY_new();
|
||||
if (pkey != NULL)
|
||||
EVP_PKEY_set1_RSA(pkey, rsa);
|
||||
RSA_free(rsa);
|
||||
} else
|
||||
#else
|
||||
BIO_printf(bio_err, "RSA keys not supported\n");
|
||||
#endif
|
||||
pkey = NULL;
|
||||
} else if (format == FORMAT_PEMRSA) {
|
||||
#ifndef OPENSSL_NO_RSA
|
||||
RSA *rsa;
|
||||
rsa = PEM_read_bio_RSAPublicKey(key, NULL,
|
||||
(pem_password_cb *)password_callback,
|
||||
&cb_data);
|
||||
if (rsa != NULL) {
|
||||
pkey = EVP_PKEY_new();
|
||||
if (pkey != NULL)
|
||||
EVP_PKEY_set1_RSA(pkey, rsa);
|
||||
RSA_free(rsa);
|
||||
} else
|
||||
#else
|
||||
BIO_printf(bio_err, "RSA keys not supported\n");
|
||||
#endif
|
||||
pkey = NULL;
|
||||
} else if (format == FORMAT_PEM) {
|
||||
pkey = PEM_read_bio_PUBKEY(key, NULL,
|
||||
(pem_password_cb *)password_callback,
|
||||
&cb_data);
|
||||
#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DSA)
|
||||
} else if (format == FORMAT_MSBLOB) {
|
||||
pkey = b2i_PublicKey_bio(key);
|
||||
#endif
|
||||
if (pkey == NULL) {
|
||||
BIO_printf(bio_err, "Unable to load %s\n", desc);
|
||||
ERR_print_errors(bio_err);
|
||||
}
|
||||
end:
|
||||
BIO_free(key);
|
||||
if (pkey == NULL)
|
||||
BIO_printf(bio_err, "unable to load %s\n", key_descrip);
|
||||
return pkey;
|
||||
}
|
||||
|
||||
@@ -690,7 +602,7 @@ static int load_certs_crls(const char *file, int format,
|
||||
cb_data.prompt_info = file;
|
||||
|
||||
if (format != FORMAT_PEM) {
|
||||
BIO_printf(bio_err, "bad input format specified for %s\n", desc);
|
||||
BIO_printf(bio_err, "Bad input format specified for %s\n", desc);
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -749,23 +661,30 @@ static int load_certs_crls(const char *file, int format,
|
||||
sk_X509_CRL_pop_free(*pcrls, X509_CRL_free);
|
||||
*pcrls = NULL;
|
||||
}
|
||||
BIO_printf(bio_err, "unable to load %s\n",
|
||||
pcerts ? "certificates" : "CRLs");
|
||||
ERR_print_errors(bio_err);
|
||||
BIO_printf(bio_err, "Unable to load %s\n", desc != NULL ? desc :
|
||||
pcerts != NULL ? "certificates" : "CRLs");
|
||||
}
|
||||
return rv;
|
||||
}
|
||||
|
||||
void app_bail_out(char *fmt, ...)
|
||||
{
|
||||
va_list args;
|
||||
|
||||
va_start(args, fmt);
|
||||
BIO_vprintf(bio_err, fmt, args);
|
||||
va_end(args);
|
||||
ERR_print_errors(bio_err);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
void* app_malloc(int sz, const char *what)
|
||||
{
|
||||
void *vp = OPENSSL_malloc(sz);
|
||||
|
||||
if (vp == NULL) {
|
||||
BIO_printf(bio_err, "%s: Could not allocate %d bytes for %s\n",
|
||||
opt_getprog(), sz, what);
|
||||
ERR_print_errors(bio_err);
|
||||
exit(1);
|
||||
}
|
||||
if (vp == NULL)
|
||||
app_bail_out("%s: Could not allocate %d bytes for %s\n",
|
||||
opt_getprog(), sz, what);
|
||||
return vp;
|
||||
}
|
||||
|
||||
@@ -787,6 +706,102 @@ int load_crls(const char *file, STACK_OF(X509_CRL) **crls, int format,
|
||||
return load_certs_crls(file, format, pass, desc, NULL, crls);
|
||||
}
|
||||
|
||||
/*
|
||||
* Load those types of credentials for which the result pointer is not NULL.
|
||||
* Reads from stdio if uri is NULL and maybe_stdin is nonzero.
|
||||
* For each type the first credential found in the store is loaded.
|
||||
* May yield partial result even if rv == 0.
|
||||
*/
|
||||
int load_key_cert_crl(const char *uri, int maybe_stdin,
|
||||
const char *pass, const char *desc,
|
||||
EVP_PKEY **ppkey, X509 **pcert, X509_CRL **pcrl)
|
||||
{
|
||||
PW_CB_DATA uidata;
|
||||
OSSL_STORE_CTX *ctx = NULL;
|
||||
int ret = 0;
|
||||
/* TODO make use of the engine reference 'eng' when loading pkeys */
|
||||
|
||||
if (ppkey != NULL)
|
||||
*ppkey = NULL;
|
||||
if (pcert != NULL)
|
||||
*pcert = NULL;
|
||||
if (pcrl != NULL)
|
||||
*pcrl = NULL;
|
||||
|
||||
if (desc == NULL)
|
||||
desc = "key/certificate/CRL";
|
||||
uidata.password = pass;
|
||||
uidata.prompt_info = uri;
|
||||
|
||||
if (uri == NULL) {
|
||||
BIO *bio;
|
||||
|
||||
if (!maybe_stdin) {
|
||||
BIO_printf(bio_err, "No filename or uri specified for loading %s\n",
|
||||
desc);
|
||||
goto end;
|
||||
}
|
||||
unbuffer(stdin);
|
||||
bio = BIO_new_fp(stdin, 0);
|
||||
if (bio != NULL)
|
||||
ctx = OSSL_STORE_attach(bio, NULL, "file", NULL,
|
||||
get_ui_method(), &uidata, NULL, NULL);
|
||||
uri = "<stdin>";
|
||||
} else {
|
||||
ctx = OSSL_STORE_open(uri, get_ui_method(), &uidata, NULL, NULL);
|
||||
}
|
||||
if (ctx == NULL) {
|
||||
BIO_printf(bio_err, "Could not open file or uri %s for loading %s\n",
|
||||
uri, desc);
|
||||
goto end;
|
||||
}
|
||||
|
||||
for (;;) {
|
||||
OSSL_STORE_INFO *info = OSSL_STORE_load(ctx);
|
||||
int type = info == NULL ? 0 : OSSL_STORE_INFO_get_type(info);
|
||||
const char *infostr =
|
||||
info == NULL ? NULL : OSSL_STORE_INFO_type_string(type);
|
||||
int err = 0;
|
||||
|
||||
if (info == NULL) {
|
||||
if (OSSL_STORE_eof(ctx))
|
||||
ret = 1;
|
||||
break;
|
||||
}
|
||||
|
||||
switch (type) {
|
||||
case OSSL_STORE_INFO_PKEY:
|
||||
if (ppkey != NULL && *ppkey == NULL)
|
||||
err = ((*ppkey = OSSL_STORE_INFO_get1_PKEY(info)) == NULL);
|
||||
break;
|
||||
case OSSL_STORE_INFO_CERT:
|
||||
if (pcert != NULL && *pcert == NULL)
|
||||
err = ((*pcert = OSSL_STORE_INFO_get1_CERT(info)) == NULL);
|
||||
break;
|
||||
case OSSL_STORE_INFO_CRL:
|
||||
if (pcrl != NULL && *pcrl == NULL)
|
||||
err = ((*pcrl = OSSL_STORE_INFO_get1_CRL(info)) == NULL);
|
||||
break;
|
||||
default:
|
||||
/* skip any other type */
|
||||
break;
|
||||
}
|
||||
OSSL_STORE_INFO_free(info);
|
||||
if (err) {
|
||||
BIO_printf(bio_err, "Could not read %s of %s from %s\n",
|
||||
infostr, desc, uri);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
end:
|
||||
OSSL_STORE_close(ctx);
|
||||
if (!ret)
|
||||
ERR_print_errors(bio_err);
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
||||
#define X509V3_EXT_UNKNOWN_MASK (0xfL << 16)
|
||||
/* Return error for unknown extensions */
|
||||
#define X509V3_EXT_DEFAULT 0
|
||||
@@ -968,7 +983,7 @@ static int set_table_opts(unsigned long *flags, const char *arg,
|
||||
return 0;
|
||||
}
|
||||
|
||||
void print_name(BIO *out, const char *title, X509_NAME *nm,
|
||||
void print_name(BIO *out, const char *title, const X509_NAME *nm,
|
||||
unsigned long lflags)
|
||||
{
|
||||
char *buf;
|
||||
@@ -1083,6 +1098,7 @@ X509_STORE *setup_verify(const char *CAfile, int noCAfile,
|
||||
ERR_clear_error();
|
||||
return store;
|
||||
end:
|
||||
ERR_print_errors(bio_err);
|
||||
X509_STORE_free(store);
|
||||
return NULL;
|
||||
}
|
||||
@@ -1103,36 +1119,35 @@ static ENGINE *try_load_engine(const char *engine)
|
||||
}
|
||||
#endif
|
||||
|
||||
ENGINE *setup_engine(const char *engine, int debug)
|
||||
ENGINE *setup_engine_methods(const char *id, unsigned int methods, int debug)
|
||||
{
|
||||
ENGINE *e = NULL;
|
||||
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
if (engine != NULL) {
|
||||
if (strcmp(engine, "auto") == 0) {
|
||||
BIO_printf(bio_err, "enabling auto ENGINE support\n");
|
||||
if (id != NULL) {
|
||||
if (strcmp(id, "auto") == 0) {
|
||||
BIO_printf(bio_err, "Enabling auto ENGINE support\n");
|
||||
ENGINE_register_all_complete();
|
||||
return NULL;
|
||||
}
|
||||
if ((e = ENGINE_by_id(engine)) == NULL
|
||||
&& (e = try_load_engine(engine)) == NULL) {
|
||||
BIO_printf(bio_err, "invalid engine \"%s\"\n", engine);
|
||||
if ((e = ENGINE_by_id(id)) == NULL
|
||||
&& (e = try_load_engine(id)) == NULL) {
|
||||
BIO_printf(bio_err, "Invalid engine \"%s\"\n", id);
|
||||
ERR_print_errors(bio_err);
|
||||
return NULL;
|
||||
}
|
||||
if (debug) {
|
||||
ENGINE_ctrl(e, ENGINE_CTRL_SET_LOGSTREAM, 0, bio_err, 0);
|
||||
}
|
||||
ENGINE_ctrl_cmd(e, "SET_USER_INTERFACE", 0, (void *)get_ui_method(),
|
||||
0, 1);
|
||||
if (!ENGINE_set_default(e, ENGINE_METHOD_ALL)) {
|
||||
BIO_printf(bio_err, "can't use that engine\n");
|
||||
if (debug)
|
||||
(void)ENGINE_ctrl(e, ENGINE_CTRL_SET_LOGSTREAM, 0, bio_err, 0);
|
||||
if (!ENGINE_ctrl_cmd(e, "SET_USER_INTERFACE", 0,
|
||||
(void *)get_ui_method(), 0, 1)
|
||||
|| !ENGINE_set_default(e, methods)) {
|
||||
BIO_printf(bio_err, "Cannot use engine \"%s\"\n", ENGINE_get_id(e));
|
||||
ERR_print_errors(bio_err);
|
||||
ENGINE_free(e);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
BIO_printf(bio_err, "engine \"%s\" set.\n", ENGINE_get_id(e));
|
||||
BIO_printf(bio_err, "Engine \"%s\" set.\n", ENGINE_get_id(e));
|
||||
}
|
||||
#endif
|
||||
return e;
|
||||
@@ -1211,14 +1226,13 @@ BIGNUM *load_serial(const char *serialfile, int create, ASN1_INTEGER **retai)
|
||||
BIO_printf(bio_err, "Out of memory\n");
|
||||
} else {
|
||||
if (!a2i_ASN1_INTEGER(in, ai, buf, 1024)) {
|
||||
BIO_printf(bio_err, "unable to load number from %s\n",
|
||||
BIO_printf(bio_err, "Unable to load number from %s\n",
|
||||
serialfile);
|
||||
goto err;
|
||||
}
|
||||
ret = ASN1_INTEGER_to_BN(ai, NULL);
|
||||
if (ret == NULL) {
|
||||
BIO_printf(bio_err,
|
||||
"error converting number from bin to BIGNUM\n");
|
||||
BIO_printf(bio_err, "Error converting number from bin to BIGNUM\n");
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
@@ -1228,6 +1242,7 @@ BIGNUM *load_serial(const char *serialfile, int create, ASN1_INTEGER **retai)
|
||||
ai = NULL;
|
||||
}
|
||||
err:
|
||||
ERR_print_errors(bio_err);
|
||||
BIO_free(in);
|
||||
ASN1_INTEGER_free(ai);
|
||||
return ret;
|
||||
@@ -1247,7 +1262,7 @@ int save_serial(const char *serialfile, const char *suffix, const BIGNUM *serial
|
||||
else
|
||||
j = strlen(serialfile) + strlen(suffix) + 1;
|
||||
if (j >= BSIZE) {
|
||||
BIO_printf(bio_err, "file name too long\n");
|
||||
BIO_printf(bio_err, "File name too long\n");
|
||||
goto err;
|
||||
}
|
||||
|
||||
@@ -1262,7 +1277,6 @@ int save_serial(const char *serialfile, const char *suffix, const BIGNUM *serial
|
||||
}
|
||||
out = BIO_new_file(buf[0], "w");
|
||||
if (out == NULL) {
|
||||
ERR_print_errors(bio_err);
|
||||
goto err;
|
||||
}
|
||||
|
||||
@@ -1278,6 +1292,8 @@ int save_serial(const char *serialfile, const char *suffix, const BIGNUM *serial
|
||||
ai = NULL;
|
||||
}
|
||||
err:
|
||||
if (!ret)
|
||||
ERR_print_errors(bio_err);
|
||||
BIO_free_all(out);
|
||||
ASN1_INTEGER_free(ai);
|
||||
return ret;
|
||||
@@ -1294,7 +1310,7 @@ int rotate_serial(const char *serialfile, const char *new_suffix,
|
||||
if (i > j)
|
||||
j = i;
|
||||
if (j + 1 >= BSIZE) {
|
||||
BIO_printf(bio_err, "file name too long\n");
|
||||
BIO_printf(bio_err, "File name too long\n");
|
||||
goto err;
|
||||
}
|
||||
#ifndef OPENSSL_SYS_VMS
|
||||
@@ -1310,19 +1326,20 @@ int rotate_serial(const char *serialfile, const char *new_suffix,
|
||||
#endif
|
||||
) {
|
||||
BIO_printf(bio_err,
|
||||
"unable to rename %s to %s\n", serialfile, buf[1]);
|
||||
"Unable to rename %s to %s\n", serialfile, buf[1]);
|
||||
perror("reason");
|
||||
goto err;
|
||||
}
|
||||
if (rename(buf[0], serialfile) < 0) {
|
||||
BIO_printf(bio_err,
|
||||
"unable to rename %s to %s\n", buf[0], serialfile);
|
||||
"Unable to rename %s to %s\n", buf[0], serialfile);
|
||||
perror("reason");
|
||||
rename(buf[1], serialfile);
|
||||
goto err;
|
||||
}
|
||||
return 1;
|
||||
err:
|
||||
ERR_print_errors(bio_err);
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -1363,17 +1380,14 @@ CA_DB *load_index(const char *dbfile, DB_ATTR *db_attr)
|
||||
#endif
|
||||
|
||||
in = BIO_new_file(dbfile, "r");
|
||||
if (in == NULL) {
|
||||
ERR_print_errors(bio_err);
|
||||
if (in == NULL)
|
||||
goto err;
|
||||
}
|
||||
|
||||
#ifndef OPENSSL_NO_POSIX_IO
|
||||
BIO_get_fp(in, &dbfp);
|
||||
if (fstat(fileno(dbfp), &dbst) == -1) {
|
||||
ERR_raise_data(ERR_LIB_SYS, errno,
|
||||
"calling fstat(%s)", dbfile);
|
||||
ERR_print_errors(bio_err);
|
||||
goto err;
|
||||
}
|
||||
#endif
|
||||
@@ -1410,6 +1424,7 @@ CA_DB *load_index(const char *dbfile, DB_ATTR *db_attr)
|
||||
#endif
|
||||
|
||||
err:
|
||||
ERR_print_errors(bio_err);
|
||||
NCONF_free(dbattr_conf);
|
||||
TXT_DB_free(tmpdb);
|
||||
BIO_free_all(in);
|
||||
@@ -1425,20 +1440,23 @@ int index_index(CA_DB *db)
|
||||
LHASH_HASH_FN(index_serial),
|
||||
LHASH_COMP_FN(index_serial))) {
|
||||
BIO_printf(bio_err,
|
||||
"error creating serial number index:(%ld,%ld,%ld)\n",
|
||||
"Error creating serial number index:(%ld,%ld,%ld)\n",
|
||||
db->db->error, db->db->arg1, db->db->arg2);
|
||||
return 0;
|
||||
goto err;
|
||||
}
|
||||
|
||||
if (db->attributes.unique_subject
|
||||
&& !TXT_DB_create_index(db->db, DB_name, index_name_qual,
|
||||
LHASH_HASH_FN(index_name),
|
||||
LHASH_COMP_FN(index_name))) {
|
||||
BIO_printf(bio_err, "error creating name index:(%ld,%ld,%ld)\n",
|
||||
BIO_printf(bio_err, "Error creating name index:(%ld,%ld,%ld)\n",
|
||||
db->db->error, db->db->arg1, db->db->arg2);
|
||||
return 0;
|
||||
goto err;
|
||||
}
|
||||
return 1;
|
||||
err:
|
||||
ERR_print_errors(bio_err);
|
||||
return 0;
|
||||
}
|
||||
|
||||
int save_index(const char *dbfile, const char *suffix, CA_DB *db)
|
||||
@@ -1449,7 +1467,7 @@ int save_index(const char *dbfile, const char *suffix, CA_DB *db)
|
||||
|
||||
j = strlen(dbfile) + strlen(suffix);
|
||||
if (j + 6 >= BSIZE) {
|
||||
BIO_printf(bio_err, "file name too long\n");
|
||||
BIO_printf(bio_err, "File name too long\n");
|
||||
goto err;
|
||||
}
|
||||
#ifndef OPENSSL_SYS_VMS
|
||||
@@ -1464,7 +1482,7 @@ int save_index(const char *dbfile, const char *suffix, CA_DB *db)
|
||||
out = BIO_new_file(buf[0], "w");
|
||||
if (out == NULL) {
|
||||
perror(dbfile);
|
||||
BIO_printf(bio_err, "unable to open '%s'\n", dbfile);
|
||||
BIO_printf(bio_err, "Unable to open '%s'\n", dbfile);
|
||||
goto err;
|
||||
}
|
||||
j = TXT_DB_write(out, db->db);
|
||||
@@ -1475,7 +1493,7 @@ int save_index(const char *dbfile, const char *suffix, CA_DB *db)
|
||||
out = BIO_new_file(buf[1], "w");
|
||||
if (out == NULL) {
|
||||
perror(buf[2]);
|
||||
BIO_printf(bio_err, "unable to open '%s'\n", buf[2]);
|
||||
BIO_printf(bio_err, "Unable to open '%s'\n", buf[2]);
|
||||
goto err;
|
||||
}
|
||||
BIO_printf(out, "unique_subject = %s\n",
|
||||
@@ -1484,6 +1502,7 @@ int save_index(const char *dbfile, const char *suffix, CA_DB *db)
|
||||
|
||||
return 1;
|
||||
err:
|
||||
ERR_print_errors(bio_err);
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -1498,7 +1517,7 @@ int rotate_index(const char *dbfile, const char *new_suffix,
|
||||
if (i > j)
|
||||
j = i;
|
||||
if (j + 6 >= BSIZE) {
|
||||
BIO_printf(bio_err, "file name too long\n");
|
||||
BIO_printf(bio_err, "File name too long\n");
|
||||
goto err;
|
||||
}
|
||||
#ifndef OPENSSL_SYS_VMS
|
||||
@@ -1519,12 +1538,12 @@ int rotate_index(const char *dbfile, const char *new_suffix,
|
||||
&& errno != ENOTDIR
|
||||
#endif
|
||||
) {
|
||||
BIO_printf(bio_err, "unable to rename %s to %s\n", dbfile, buf[1]);
|
||||
BIO_printf(bio_err, "Unable to rename %s to %s\n", dbfile, buf[1]);
|
||||
perror("reason");
|
||||
goto err;
|
||||
}
|
||||
if (rename(buf[0], dbfile) < 0) {
|
||||
BIO_printf(bio_err, "unable to rename %s to %s\n", buf[0], dbfile);
|
||||
BIO_printf(bio_err, "Unable to rename %s to %s\n", buf[0], dbfile);
|
||||
perror("reason");
|
||||
rename(buf[1], dbfile);
|
||||
goto err;
|
||||
@@ -1534,14 +1553,14 @@ int rotate_index(const char *dbfile, const char *new_suffix,
|
||||
&& errno != ENOTDIR
|
||||
#endif
|
||||
) {
|
||||
BIO_printf(bio_err, "unable to rename %s to %s\n", buf[4], buf[3]);
|
||||
BIO_printf(bio_err, "Unable to rename %s to %s\n", buf[4], buf[3]);
|
||||
perror("reason");
|
||||
rename(dbfile, buf[0]);
|
||||
rename(buf[1], dbfile);
|
||||
goto err;
|
||||
}
|
||||
if (rename(buf[2], buf[4]) < 0) {
|
||||
BIO_printf(bio_err, "unable to rename %s to %s\n", buf[2], buf[4]);
|
||||
BIO_printf(bio_err, "Unable to rename %s to %s\n", buf[2], buf[4]);
|
||||
perror("reason");
|
||||
rename(buf[3], buf[4]);
|
||||
rename(dbfile, buf[0]);
|
||||
@@ -1550,6 +1569,7 @@ int rotate_index(const char *dbfile, const char *new_suffix,
|
||||
}
|
||||
return 1;
|
||||
err:
|
||||
ERR_print_errors(bio_err);
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -1611,7 +1631,7 @@ X509_NAME *parse_name(const char *cp, long chtype, int canmulti)
|
||||
goto err;
|
||||
}
|
||||
|
||||
while (*cp) {
|
||||
while (*cp != '\0') {
|
||||
char *bp = work;
|
||||
char *typestr = bp;
|
||||
unsigned char *valstr;
|
||||
@@ -1620,12 +1640,12 @@ X509_NAME *parse_name(const char *cp, long chtype, int canmulti)
|
||||
nextismulti = 0;
|
||||
|
||||
/* Collect the type */
|
||||
while (*cp && *cp != '=')
|
||||
while (*cp != '\0' && *cp != '=')
|
||||
*bp++ = *cp++;
|
||||
if (*cp == '\0') {
|
||||
BIO_printf(bio_err,
|
||||
"%s: Hit end of string before finding the '='\n",
|
||||
opt_getprog());
|
||||
"%s: Hit end of string before finding the '='\n",
|
||||
opt_getprog());
|
||||
goto err;
|
||||
}
|
||||
*bp++ = '\0';
|
||||
@@ -1633,14 +1653,14 @@ X509_NAME *parse_name(const char *cp, long chtype, int canmulti)
|
||||
|
||||
/* Collect the value. */
|
||||
valstr = (unsigned char *)bp;
|
||||
for (; *cp && *cp != '/'; *bp++ = *cp++) {
|
||||
for (; *cp != '\0' && *cp != '/'; *bp++ = *cp++) {
|
||||
if (canmulti && *cp == '+') {
|
||||
nextismulti = 1;
|
||||
break;
|
||||
}
|
||||
if (*cp == '\\' && *++cp == '\0') {
|
||||
BIO_printf(bio_err,
|
||||
"%s: escape character at end of string\n",
|
||||
"%s: Escape character at end of string\n",
|
||||
opt_getprog());
|
||||
goto err;
|
||||
}
|
||||
@@ -1648,7 +1668,7 @@ X509_NAME *parse_name(const char *cp, long chtype, int canmulti)
|
||||
*bp++ = '\0';
|
||||
|
||||
/* If not at EOS (must be + or /), move forward. */
|
||||
if (*cp)
|
||||
if (*cp != '\0')
|
||||
++cp;
|
||||
|
||||
/* Parse */
|
||||
@@ -1667,6 +1687,7 @@ X509_NAME *parse_name(const char *cp, long chtype, int canmulti)
|
||||
if (!X509_NAME_add_entry_by_NID(n, nid, chtype,
|
||||
valstr, strlen((char *)valstr),
|
||||
-1, ismulti ? -1 : 0)) {
|
||||
ERR_print_errors(bio_err);
|
||||
BIO_printf(bio_err, "%s: Error adding name attribute \"/%s=%s\"\n",
|
||||
opt_getprog(), typestr ,valstr);
|
||||
goto err;
|
||||
@@ -1889,18 +1910,18 @@ static X509_CRL *load_crl_crldp(STACK_OF(DIST_POINT) *crldp)
|
||||
DIST_POINT *dp = sk_DIST_POINT_value(crldp, i);
|
||||
urlptr = get_dp_url(dp);
|
||||
if (urlptr)
|
||||
return load_crl(urlptr, FORMAT_HTTP);
|
||||
return load_crl(urlptr, FORMAT_HTTP, "CRL via CDP");
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/*
|
||||
* Example of downloading CRLs from CRLDP: not usable for real world as it
|
||||
* always downloads, doesn't support non-blocking I/O and doesn't cache
|
||||
* anything.
|
||||
* Example of downloading CRLs from CRLDP:
|
||||
* not usable for real world as it always downloads and doesn't cache anything.
|
||||
*/
|
||||
|
||||
static STACK_OF(X509_CRL) *crls_http_cb(X509_STORE_CTX *ctx, X509_NAME *nm)
|
||||
static STACK_OF(X509_CRL) *crls_http_cb(const X509_STORE_CTX *ctx,
|
||||
const X509_NAME *nm)
|
||||
{
|
||||
X509 *x;
|
||||
STACK_OF(X509_CRL) *crls = NULL;
|
||||
@@ -1933,137 +1954,6 @@ void store_setup_crl_download(X509_STORE *st)
|
||||
X509_STORE_set_lookup_crls_cb(st, crls_http_cb);
|
||||
}
|
||||
|
||||
#ifndef OPENSSL_NO_SOCK
|
||||
static const char *tls_error_hint(void)
|
||||
{
|
||||
unsigned long err = ERR_peek_error();
|
||||
|
||||
if (ERR_GET_LIB(err) != ERR_LIB_SSL)
|
||||
err = ERR_peek_last_error();
|
||||
if (ERR_GET_LIB(err) != ERR_LIB_SSL)
|
||||
return NULL;
|
||||
|
||||
switch (ERR_GET_REASON(err)) {
|
||||
case SSL_R_WRONG_VERSION_NUMBER:
|
||||
return "The server does not support (a suitable version of) TLS";
|
||||
case SSL_R_UNKNOWN_PROTOCOL:
|
||||
return "The server does not support HTTPS";
|
||||
case SSL_R_CERTIFICATE_VERIFY_FAILED:
|
||||
return "Cannot authenticate server via its TLS certificate, likely due to mismatch with our trusted TLS certs or missing revocation status";
|
||||
case SSL_AD_REASON_OFFSET + TLS1_AD_UNKNOWN_CA:
|
||||
return "Server did not accept our TLS certificate, likely due to mismatch with server's trust anchor or missing revocation status";
|
||||
case SSL_AD_REASON_OFFSET + SSL3_AD_HANDSHAKE_FAILURE:
|
||||
return "TLS handshake failure. Possibly the server requires our TLS certificate but did not receive it";
|
||||
default: /* no error or no hint available for error */
|
||||
return NULL;
|
||||
}
|
||||
}
|
||||
|
||||
/* HTTP callback function that supports TLS connection also via HTTPS proxy */
|
||||
BIO *app_http_tls_cb(BIO *hbio, void *arg, int connect, int detail)
|
||||
{
|
||||
APP_HTTP_TLS_INFO *info = (APP_HTTP_TLS_INFO *)arg;
|
||||
SSL_CTX *ssl_ctx = info->ssl_ctx;
|
||||
SSL *ssl;
|
||||
BIO *sbio = NULL;
|
||||
|
||||
if (connect && detail) { /* connecting with TLS */
|
||||
if ((info->use_proxy
|
||||
&& !OSSL_HTTP_proxy_connect(hbio, info->server, info->port,
|
||||
NULL, NULL, /* no proxy credentials */
|
||||
info->timeout, bio_err, opt_getprog()))
|
||||
|| (sbio = BIO_new(BIO_f_ssl())) == NULL) {
|
||||
return NULL;
|
||||
}
|
||||
if (ssl_ctx == NULL || (ssl = SSL_new(ssl_ctx)) == NULL) {
|
||||
BIO_free(sbio);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
SSL_set_tlsext_host_name(ssl, info->server);
|
||||
|
||||
SSL_set_connect_state(ssl);
|
||||
BIO_set_ssl(sbio, ssl, BIO_CLOSE);
|
||||
|
||||
hbio = BIO_push(sbio, hbio);
|
||||
} else if (!connect && !detail) { /* disconnecting after error */
|
||||
const char *hint = tls_error_hint();
|
||||
if (hint != NULL)
|
||||
ERR_add_error_data(1, hint);
|
||||
/*
|
||||
* If we pop sbio and BIO_free() it this may lead to libssl double free.
|
||||
* Rely on BIO_free_all() done by OSSL_HTTP_transfer() in http_client.c
|
||||
*/
|
||||
}
|
||||
return hbio;
|
||||
}
|
||||
|
||||
ASN1_VALUE *app_http_get_asn1(const char *url, const char *proxy,
|
||||
const char *proxy_port, SSL_CTX *ssl_ctx,
|
||||
const STACK_OF(CONF_VALUE) *headers,
|
||||
long timeout, const char *expected_content_type,
|
||||
const ASN1_ITEM *it)
|
||||
{
|
||||
APP_HTTP_TLS_INFO info;
|
||||
char *server;
|
||||
char *port;
|
||||
int use_ssl;
|
||||
ASN1_VALUE *resp = NULL;
|
||||
|
||||
if (url == NULL || it == NULL) {
|
||||
HTTPerr(0, ERR_R_PASSED_NULL_PARAMETER);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
if (!OSSL_HTTP_parse_url(url, &server, &port, NULL /* ppath */, &use_ssl))
|
||||
return NULL;
|
||||
if (use_ssl && ssl_ctx == NULL) {
|
||||
HTTPerr(0, ERR_R_PASSED_NULL_PARAMETER);
|
||||
ERR_add_error_data(1, "missing SSL_CTX");
|
||||
goto end;
|
||||
}
|
||||
|
||||
info.server = server;
|
||||
info.port = port;
|
||||
info.use_proxy = proxy != NULL;
|
||||
info.timeout = timeout;
|
||||
info.ssl_ctx = ssl_ctx;
|
||||
resp = OSSL_HTTP_get_asn1(url, proxy, proxy_port,
|
||||
NULL, NULL, app_http_tls_cb, &info,
|
||||
headers, 0 /* maxline */, 0 /* max_resp_len */,
|
||||
timeout, expected_content_type, it);
|
||||
end:
|
||||
OPENSSL_free(server);
|
||||
OPENSSL_free(port);
|
||||
return resp;
|
||||
|
||||
}
|
||||
|
||||
ASN1_VALUE *app_http_post_asn1(const char *host, const char *port,
|
||||
const char *path, const char *proxy,
|
||||
const char *proxy_port, SSL_CTX *ssl_ctx,
|
||||
const STACK_OF(CONF_VALUE) *headers,
|
||||
const char *content_type,
|
||||
ASN1_VALUE *req, const ASN1_ITEM *req_it,
|
||||
long timeout, const ASN1_ITEM *rsp_it)
|
||||
{
|
||||
APP_HTTP_TLS_INFO info;
|
||||
|
||||
info.server = host;
|
||||
info.port = port;
|
||||
info.use_proxy = proxy != NULL;
|
||||
info.timeout = timeout;
|
||||
info.ssl_ctx = ssl_ctx;
|
||||
return OSSL_HTTP_post_asn1(host, port, path, ssl_ctx != NULL,
|
||||
proxy, proxy_port,
|
||||
NULL, NULL, app_http_tls_cb, &info,
|
||||
headers, content_type, req, req_it,
|
||||
0 /* maxline */,
|
||||
0 /* max_resp_len */, timeout, NULL, rsp_it);
|
||||
}
|
||||
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Platform-specific sections
|
||||
*/
|
||||
@@ -2214,40 +2104,6 @@ double app_tminterval(int stop, int usertime)
|
||||
return ret;
|
||||
}
|
||||
|
||||
#elif defined(OPENSSL_SYSTEM_VMS)
|
||||
# include <time.h>
|
||||
# include <times.h>
|
||||
|
||||
double app_tminterval(int stop, int usertime)
|
||||
{
|
||||
static clock_t tmstart;
|
||||
double ret = 0;
|
||||
clock_t now;
|
||||
# ifdef __TMS
|
||||
struct tms rus;
|
||||
|
||||
now = times(&rus);
|
||||
if (usertime)
|
||||
now = rus.tms_utime;
|
||||
# else
|
||||
if (usertime)
|
||||
now = clock(); /* sum of user and kernel times */
|
||||
else {
|
||||
struct timeval tv;
|
||||
gettimeofday(&tv, NULL);
|
||||
now = (clock_t)((unsigned long long)tv.tv_sec * CLK_TCK +
|
||||
(unsigned long long)tv.tv_usec * (1000000 / CLK_TCK)
|
||||
);
|
||||
}
|
||||
# endif
|
||||
if (stop == TM_START)
|
||||
tmstart = now;
|
||||
else
|
||||
ret = (now - tmstart) / (double)(CLK_TCK);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
#elif defined(_SC_CLK_TCK) /* by means of unistd.h */
|
||||
# include <sys/times.h>
|
||||
|
||||
@@ -2690,6 +2546,7 @@ OSSL_PARAM *app_params_new_from_opts(STACK_OF(OPENSSL_STRING) *opts,
|
||||
size_t sz = (size_t)sk_OPENSSL_STRING_num(opts);
|
||||
size_t params_n;
|
||||
char *opt = "", *stmp, *vtmp = NULL;
|
||||
int found = 1;
|
||||
|
||||
if (opts == NULL)
|
||||
return NULL;
|
||||
@@ -2708,7 +2565,7 @@ OSSL_PARAM *app_params_new_from_opts(STACK_OF(OPENSSL_STRING) *opts,
|
||||
/* Skip over the separator so that vmtp points to the value */
|
||||
vtmp++;
|
||||
if (!OSSL_PARAM_allocate_from_text(¶ms[params_n], paramdefs,
|
||||
stmp, vtmp, strlen(vtmp)))
|
||||
stmp, vtmp, strlen(vtmp), &found))
|
||||
goto err;
|
||||
OPENSSL_free(stmp);
|
||||
}
|
||||
@@ -2716,7 +2573,8 @@ OSSL_PARAM *app_params_new_from_opts(STACK_OF(OPENSSL_STRING) *opts,
|
||||
return params;
|
||||
err:
|
||||
OPENSSL_free(stmp);
|
||||
BIO_printf(bio_err, "Parameter error '%s'\n", opt);
|
||||
BIO_printf(bio_err, "Parameter %s '%s'\n", found ? "error" : "unknown",
|
||||
opt);
|
||||
ERR_print_errors(bio_err);
|
||||
app_params_free(params);
|
||||
return NULL;
|
||||
|
||||
+2
-2
@@ -1,7 +1,7 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
|
||||
+1
-1
@@ -9,7 +9,7 @@ ENDIF
|
||||
|
||||
# Source for libapps
|
||||
$LIBAPPSSRC=apps.c apps_ui.c opt.c fmt.c s_cb.c s_socket.c app_rand.c \
|
||||
columns.c app_params.c names.c
|
||||
columns.c app_params.c names.c app_provider.c app_x509.c http_server.c
|
||||
|
||||
IF[{- !$disabled{apps} -}]
|
||||
LIBS{noinst}=../libapps.a
|
||||
|
||||
+2
-2
@@ -1,7 +1,7 @@
|
||||
/*
|
||||
* Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
|
||||
@@ -0,0 +1,448 @@
|
||||
/*
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
/* Very basic HTTP server */
|
||||
|
||||
#if !defined(_POSIX_C_SOURCE) && defined(OPENSSL_SYS_VMS)
|
||||
/*
|
||||
* On VMS, you need to define this to get the declaration of fileno(). The
|
||||
* value 2 is to make sure no function defined in POSIX-2 is left undefined.
|
||||
*/
|
||||
# define _POSIX_C_SOURCE 2
|
||||
#endif
|
||||
|
||||
#include <string.h>
|
||||
#include <ctype.h>
|
||||
#include "http_server.h"
|
||||
#include "internal/sockets.h"
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/rand.h>
|
||||
|
||||
int multi = 0; /* run multiple responder processes */
|
||||
|
||||
#ifdef HTTP_DAEMON
|
||||
int acfd = (int) INVALID_SOCKET;
|
||||
#endif
|
||||
|
||||
#ifdef HTTP_DAEMON
|
||||
static int print_syslog(const char *str, size_t len, void *levPtr)
|
||||
{
|
||||
int level = *(int *)levPtr;
|
||||
int ilen = len > MAXERRLEN ? MAXERRLEN : len;
|
||||
|
||||
syslog(level, "%.*s", ilen, str);
|
||||
|
||||
return ilen;
|
||||
}
|
||||
#endif
|
||||
|
||||
void log_message(const char *prog, int level, const char *fmt, ...)
|
||||
{
|
||||
va_list ap;
|
||||
|
||||
va_start(ap, fmt);
|
||||
#ifdef HTTP_DAEMON
|
||||
if (multi) {
|
||||
char buf[1024];
|
||||
|
||||
if (vsnprintf(buf, sizeof(buf), fmt, ap) > 0)
|
||||
syslog(level, "%s", buf);
|
||||
if (level >= LOG_ERR)
|
||||
ERR_print_errors_cb(print_syslog, &level);
|
||||
}
|
||||
#endif
|
||||
if (!multi) {
|
||||
BIO_printf(bio_err, "%s: ", prog);
|
||||
BIO_vprintf(bio_err, fmt, ap);
|
||||
BIO_printf(bio_err, "\n");
|
||||
}
|
||||
va_end(ap);
|
||||
}
|
||||
|
||||
#ifdef HTTP_DAEMON
|
||||
void socket_timeout(int signum)
|
||||
{
|
||||
if (acfd != (int)INVALID_SOCKET)
|
||||
(void)shutdown(acfd, SHUT_RD);
|
||||
}
|
||||
|
||||
static void killall(int ret, pid_t *kidpids)
|
||||
{
|
||||
int i;
|
||||
|
||||
for (i = 0; i < multi; ++i)
|
||||
if (kidpids[i] != 0)
|
||||
(void)kill(kidpids[i], SIGTERM);
|
||||
OPENSSL_free(kidpids);
|
||||
sleep(1);
|
||||
exit(ret);
|
||||
}
|
||||
|
||||
static int termsig = 0;
|
||||
|
||||
static void noteterm(int sig)
|
||||
{
|
||||
termsig = sig;
|
||||
}
|
||||
|
||||
/*
|
||||
* Loop spawning up to `multi` child processes, only child processes return
|
||||
* from this function. The parent process loops until receiving a termination
|
||||
* signal, kills extant children and exits without returning.
|
||||
*/
|
||||
void spawn_loop(const char *prog)
|
||||
{
|
||||
pid_t *kidpids = NULL;
|
||||
int status;
|
||||
int procs = 0;
|
||||
int i;
|
||||
|
||||
openlog(prog, LOG_PID, LOG_DAEMON);
|
||||
|
||||
if (setpgid(0, 0)) {
|
||||
syslog(LOG_ERR, "fatal: error detaching from parent process group: %s",
|
||||
strerror(errno));
|
||||
exit(1);
|
||||
}
|
||||
kidpids = app_malloc(multi * sizeof(*kidpids), "child PID array");
|
||||
for (i = 0; i < multi; ++i)
|
||||
kidpids[i] = 0;
|
||||
|
||||
signal(SIGINT, noteterm);
|
||||
signal(SIGTERM, noteterm);
|
||||
|
||||
while (termsig == 0) {
|
||||
pid_t fpid;
|
||||
|
||||
/*
|
||||
* Wait for a child to replace when we're at the limit.
|
||||
* Slow down if a child exited abnormally or waitpid() < 0
|
||||
*/
|
||||
while (termsig == 0 && procs >= multi) {
|
||||
if ((fpid = waitpid(-1, &status, 0)) > 0) {
|
||||
for (i = 0; i < procs; ++i) {
|
||||
if (kidpids[i] == fpid) {
|
||||
kidpids[i] = 0;
|
||||
--procs;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (i >= multi) {
|
||||
syslog(LOG_ERR, "fatal: internal error: "
|
||||
"no matching child slot for pid: %ld",
|
||||
(long) fpid);
|
||||
killall(1, kidpids);
|
||||
}
|
||||
if (status != 0) {
|
||||
if (WIFEXITED(status))
|
||||
syslog(LOG_WARNING, "child process: %ld, exit status: %d",
|
||||
(long)fpid, WEXITSTATUS(status));
|
||||
else if (WIFSIGNALED(status))
|
||||
syslog(LOG_WARNING, "child process: %ld, term signal %d%s",
|
||||
(long)fpid, WTERMSIG(status),
|
||||
# ifdef WCOREDUMP
|
||||
WCOREDUMP(status) ? " (core dumped)" :
|
||||
# endif
|
||||
"");
|
||||
sleep(1);
|
||||
}
|
||||
break;
|
||||
} else if (errno != EINTR) {
|
||||
syslog(LOG_ERR, "fatal: waitpid(): %s", strerror(errno));
|
||||
killall(1, kidpids);
|
||||
}
|
||||
}
|
||||
if (termsig)
|
||||
break;
|
||||
|
||||
switch (fpid = fork()) {
|
||||
case -1: /* error */
|
||||
/* System critically low on memory, pause and try again later */
|
||||
sleep(30);
|
||||
break;
|
||||
case 0: /* child */
|
||||
OPENSSL_free(kidpids);
|
||||
signal(SIGINT, SIG_DFL);
|
||||
signal(SIGTERM, SIG_DFL);
|
||||
if (termsig)
|
||||
_exit(0);
|
||||
if (RAND_poll() <= 0) {
|
||||
syslog(LOG_ERR, "fatal: RAND_poll() failed");
|
||||
_exit(1);
|
||||
}
|
||||
return;
|
||||
default: /* parent */
|
||||
for (i = 0; i < multi; ++i) {
|
||||
if (kidpids[i] == 0) {
|
||||
kidpids[i] = fpid;
|
||||
procs++;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (i >= multi) {
|
||||
syslog(LOG_ERR, "fatal: internal error: no free child slots");
|
||||
killall(1, kidpids);
|
||||
}
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
/* The loop above can only break on termsig */
|
||||
syslog(LOG_INFO, "terminating on signal: %d", termsig);
|
||||
killall(0, kidpids);
|
||||
}
|
||||
#endif
|
||||
|
||||
#ifndef OPENSSL_NO_SOCK
|
||||
BIO *http_server_init_bio(const char *prog, const char *port)
|
||||
{
|
||||
BIO *acbio = NULL, *bufbio;
|
||||
|
||||
bufbio = BIO_new(BIO_f_buffer());
|
||||
if (bufbio == NULL)
|
||||
goto err;
|
||||
acbio = BIO_new(BIO_s_accept());
|
||||
if (acbio == NULL
|
||||
|| BIO_set_bind_mode(acbio, BIO_BIND_REUSEADDR) < 0
|
||||
|| BIO_set_accept_port(acbio, port) < 0) {
|
||||
log_message(prog, LOG_ERR, "Error setting up accept BIO");
|
||||
goto err;
|
||||
}
|
||||
|
||||
BIO_set_accept_bios(acbio, bufbio);
|
||||
bufbio = NULL;
|
||||
if (BIO_do_accept(acbio) <= 0) {
|
||||
log_message(prog, LOG_ERR, "Error starting accept");
|
||||
goto err;
|
||||
}
|
||||
|
||||
return acbio;
|
||||
|
||||
err:
|
||||
BIO_free_all(acbio);
|
||||
BIO_free(bufbio);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/*
|
||||
* Decode %xx URL-decoding in-place. Ignores malformed sequences.
|
||||
*/
|
||||
static int urldecode(char *p)
|
||||
{
|
||||
unsigned char *out = (unsigned char *)p;
|
||||
unsigned char *save = out;
|
||||
|
||||
for (; *p; p++) {
|
||||
if (*p != '%') {
|
||||
*out++ = *p;
|
||||
} else if (isxdigit(_UC(p[1])) && isxdigit(_UC(p[2]))) {
|
||||
/* Don't check, can't fail because of ixdigit() call. */
|
||||
*out++ = (OPENSSL_hexchar2int(p[1]) << 4)
|
||||
| OPENSSL_hexchar2int(p[2]);
|
||||
p += 2;
|
||||
} else {
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
*out = '\0';
|
||||
return (int)(out - save);
|
||||
}
|
||||
|
||||
int http_server_get_asn1_req(const ASN1_ITEM *it, ASN1_VALUE **preq,
|
||||
char **ppath, BIO **pcbio, BIO *acbio,
|
||||
const char *prog, int accept_get, int timeout)
|
||||
{
|
||||
BIO *cbio = NULL, *getbio = NULL, *b64 = NULL;
|
||||
int len;
|
||||
char reqbuf[2048], inbuf[2048];
|
||||
char *meth, *url, *end;
|
||||
ASN1_VALUE *req;
|
||||
int ret = 1;
|
||||
|
||||
*preq = NULL;
|
||||
if (ppath != NULL)
|
||||
*ppath = NULL;
|
||||
*pcbio = NULL;
|
||||
|
||||
/* Connection loss before accept() is routine, ignore silently */
|
||||
if (BIO_do_accept(acbio) <= 0)
|
||||
return 0;
|
||||
|
||||
cbio = BIO_pop(acbio);
|
||||
*pcbio = cbio;
|
||||
if (cbio == NULL) {
|
||||
/* Cannot call http_server_send_status(cbio, ...) */
|
||||
ret = -1;
|
||||
goto out;
|
||||
}
|
||||
|
||||
# ifdef HTTP_DAEMON
|
||||
if (timeout > 0) {
|
||||
(void)BIO_get_fd(cbio, &acfd);
|
||||
alarm(timeout);
|
||||
}
|
||||
# endif
|
||||
|
||||
/* Read the request line. */
|
||||
len = BIO_gets(cbio, reqbuf, sizeof(reqbuf));
|
||||
if (len <= 0) {
|
||||
log_message(prog, LOG_INFO,
|
||||
"Request line read error or empty request");
|
||||
(void)http_server_send_status(cbio, 400, "Bad Request");
|
||||
goto out;
|
||||
}
|
||||
|
||||
meth = reqbuf;
|
||||
url = meth + 3;
|
||||
if ((accept_get && strncmp(meth, "GET ", 4) == 0)
|
||||
|| (url++, strncmp(meth, "POST ", 5) == 0)) {
|
||||
/* Expecting (GET|POST) {sp} /URL {sp} HTTP/1.x */
|
||||
*(url++) = '\0';
|
||||
while (*url == ' ')
|
||||
url++;
|
||||
if (*url != '/') {
|
||||
log_message(prog, LOG_INFO,
|
||||
"Invalid %s -- URL does not begin with '/': %s",
|
||||
meth, url);
|
||||
(void)http_server_send_status(cbio, 400, "Bad Request");
|
||||
goto out;
|
||||
}
|
||||
url++;
|
||||
|
||||
/* Splice off the HTTP version identifier. */
|
||||
for (end = url; *end != '\0'; end++)
|
||||
if (*end == ' ')
|
||||
break;
|
||||
if (strncmp(end, " HTTP/1.", 7) != 0) {
|
||||
log_message(prog, LOG_INFO,
|
||||
"Invalid %s -- bad HTTP/version string: %s",
|
||||
meth, end + 1);
|
||||
(void)http_server_send_status(cbio, 400, "Bad Request");
|
||||
goto out;
|
||||
}
|
||||
*end = '\0';
|
||||
|
||||
/*-
|
||||
* Skip "GET / HTTP..." requests often used by load-balancers.
|
||||
* 'url' was incremented above to point to the first byte *after*
|
||||
* the leading slash, so in case 'GET / ' it is now an empty string.
|
||||
*/
|
||||
if (strlen(meth) == 3 && url[0] == '\0') {
|
||||
(void)http_server_send_status(cbio, 200, "OK");
|
||||
goto out;
|
||||
}
|
||||
|
||||
len = urldecode(url);
|
||||
if (len < 0) {
|
||||
log_message(prog, LOG_INFO,
|
||||
"Invalid %s request -- bad URL encoding: %s",
|
||||
meth, url);
|
||||
(void)http_server_send_status(cbio, 400, "Bad Request");
|
||||
goto out;
|
||||
}
|
||||
if (strlen(meth) == 3) { /* GET */
|
||||
if ((getbio = BIO_new_mem_buf(url, len)) == NULL
|
||||
|| (b64 = BIO_new(BIO_f_base64())) == NULL) {
|
||||
log_message(prog, LOG_ERR,
|
||||
"Could not allocate base64 bio with size = %d",
|
||||
len);
|
||||
goto fatal;
|
||||
}
|
||||
BIO_set_flags(b64, BIO_FLAGS_BASE64_NO_NL);
|
||||
getbio = BIO_push(b64, getbio);
|
||||
}
|
||||
} else {
|
||||
log_message(prog, LOG_INFO,
|
||||
"HTTP request does not start with GET/POST: %s", reqbuf);
|
||||
/* TODO provide better diagnosis in case client tries TLS */
|
||||
(void)http_server_send_status(cbio, 400, "Bad Request");
|
||||
goto out;
|
||||
}
|
||||
|
||||
/* chop any further/duplicate leading or trailing '/' */
|
||||
while (*url == '/')
|
||||
url++;
|
||||
while (end >= url + 2 && end[-2] == '/' && end[-1] == '/')
|
||||
end--;
|
||||
*end = '\0';
|
||||
|
||||
/* Read and skip past the headers. */
|
||||
for (;;) {
|
||||
len = BIO_gets(cbio, inbuf, sizeof(inbuf));
|
||||
if (len <= 0) {
|
||||
log_message(prog, LOG_ERR,
|
||||
"Error skipping remaining HTTP headers");
|
||||
(void)http_server_send_status(cbio, 400, "Bad Request");
|
||||
goto out;
|
||||
}
|
||||
if ((inbuf[0] == '\r') || (inbuf[0] == '\n'))
|
||||
break;
|
||||
}
|
||||
|
||||
# ifdef HTTP_DAEMON
|
||||
/* Clear alarm before we close the client socket */
|
||||
alarm(0);
|
||||
timeout = 0;
|
||||
# endif
|
||||
|
||||
/* Try to read and parse request */
|
||||
req = ASN1_item_d2i_bio(it, getbio != NULL ? getbio : cbio, NULL);
|
||||
if (req == NULL) {
|
||||
log_message(prog, LOG_ERR, "Error parsing request");
|
||||
} else if (ppath != NULL && (*ppath = OPENSSL_strdup(url)) == NULL) {
|
||||
log_message(prog, LOG_ERR,
|
||||
"Out of memory allocating %d bytes", strlen(url) + 1);
|
||||
ASN1_item_free(req, it);
|
||||
goto fatal;
|
||||
}
|
||||
|
||||
*preq = req;
|
||||
|
||||
out:
|
||||
BIO_free_all(getbio);
|
||||
# ifdef HTTP_DAEMON
|
||||
if (timeout > 0)
|
||||
alarm(0);
|
||||
acfd = (int)INVALID_SOCKET;
|
||||
# endif
|
||||
return ret;
|
||||
|
||||
fatal:
|
||||
(void)http_server_send_status(cbio, 500, "Internal Server Error");
|
||||
if (ppath != NULL) {
|
||||
OPENSSL_free(*ppath);
|
||||
*ppath = NULL;
|
||||
}
|
||||
BIO_free_all(cbio);
|
||||
*pcbio = NULL;
|
||||
ret = -1;
|
||||
goto out;
|
||||
}
|
||||
|
||||
/* assumes that cbio does not do an encoding that changes the output length */
|
||||
int http_server_send_asn1_resp(BIO *cbio, const char *content_type,
|
||||
const ASN1_ITEM *it, const ASN1_VALUE *resp)
|
||||
{
|
||||
int ret = BIO_printf(cbio, "HTTP/1.0 200 OK\r\nContent-type: %s\r\n"
|
||||
"Content-Length: %d\r\n\r\n", content_type,
|
||||
ASN1_item_i2d(resp, NULL, it)) > 0
|
||||
&& ASN1_item_i2d_bio(it, cbio, resp) > 0;
|
||||
|
||||
(void)BIO_flush(cbio);
|
||||
return ret;
|
||||
}
|
||||
|
||||
int http_server_send_status(BIO *cbio, int status, const char *reason)
|
||||
{
|
||||
int ret = BIO_printf(cbio, "HTTP/1.0 %d %s\r\n\r\n", status, reason) > 0;
|
||||
|
||||
(void)BIO_flush(cbio);
|
||||
return ret;
|
||||
}
|
||||
#endif
|
||||
+3
-1
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -12,6 +12,8 @@
|
||||
#include <openssl/safestack.h>
|
||||
#include "names.h"
|
||||
|
||||
DEFINE_STACK_OF_CSTRING()
|
||||
|
||||
#ifdef _WIN32
|
||||
# define strcasecmp _stricmp
|
||||
#endif
|
||||
|
||||
+45
-19
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -209,6 +209,7 @@ int opt_format(const char *s, unsigned long flags, int *result)
|
||||
{
|
||||
switch (*s) {
|
||||
default:
|
||||
opt_printf_stderr("%s: Bad format \"%s\"\n", prog, s);
|
||||
return 0;
|
||||
case 'D':
|
||||
case 'd':
|
||||
@@ -275,6 +276,7 @@ int opt_format(const char *s, unsigned long flags, int *result)
|
||||
return opt_format_error(s, flags);
|
||||
*result = FORMAT_PKCS12;
|
||||
} else {
|
||||
opt_printf_stderr("%s: Bad format \"%s\"\n", prog, s);
|
||||
return 0;
|
||||
}
|
||||
break;
|
||||
@@ -282,6 +284,41 @@ int opt_format(const char *s, unsigned long flags, int *result)
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* Return string representing the given format. */
|
||||
const char *format2str(int format)
|
||||
{
|
||||
switch (format) {
|
||||
default:
|
||||
return "(undefined)";
|
||||
case FORMAT_PEM:
|
||||
return "PEM";
|
||||
case FORMAT_ASN1:
|
||||
return "DER";
|
||||
case FORMAT_TEXT:
|
||||
return "TEXT";
|
||||
case FORMAT_NSS:
|
||||
return "NSS";
|
||||
case FORMAT_SMIME:
|
||||
return "SMIME";
|
||||
case FORMAT_MSBLOB:
|
||||
return "MSBLOB";
|
||||
case FORMAT_ENGINE:
|
||||
return "ENGINE";
|
||||
case FORMAT_HTTP:
|
||||
return "HTTP";
|
||||
case FORMAT_PKCS12:
|
||||
return "P12";
|
||||
case FORMAT_PVK:
|
||||
return "PVK";
|
||||
}
|
||||
}
|
||||
|
||||
/* Print an error message about unsuitable/unsupported format requested. */
|
||||
void print_format_error(int format, unsigned long flags)
|
||||
{
|
||||
(void)opt_format_error(format2str(format), flags);
|
||||
}
|
||||
|
||||
/* Parse a cipher name, put it in *EVP_CIPHER; return 0 on failure, else 1. */
|
||||
int opt_cipher(const char *name, const EVP_CIPHER **cipherp)
|
||||
{
|
||||
@@ -705,40 +742,29 @@ int opt_next(void)
|
||||
break;
|
||||
case 'p':
|
||||
case 'n':
|
||||
if (!opt_int(arg, &ival)
|
||||
|| (o->valtype == 'p' && ival <= 0)) {
|
||||
if (!opt_int(arg, &ival))
|
||||
return -1;
|
||||
if (o->valtype == 'p' && ival <= 0) {
|
||||
opt_printf_stderr("%s: Non-positive number \"%s\" for -%s\n",
|
||||
prog, arg, o->name);
|
||||
return -1;
|
||||
}
|
||||
break;
|
||||
case 'M':
|
||||
if (!opt_imax(arg, &imval)) {
|
||||
opt_printf_stderr("%s: Invalid number \"%s\" for -%s\n",
|
||||
prog, arg, o->name);
|
||||
if (!opt_imax(arg, &imval))
|
||||
return -1;
|
||||
}
|
||||
break;
|
||||
case 'U':
|
||||
if (!opt_umax(arg, &umval)) {
|
||||
opt_printf_stderr("%s: Invalid number \"%s\" for -%s\n",
|
||||
prog, arg, o->name);
|
||||
if (!opt_umax(arg, &umval))
|
||||
return -1;
|
||||
}
|
||||
break;
|
||||
case 'l':
|
||||
if (!opt_long(arg, &lval)) {
|
||||
opt_printf_stderr("%s: Invalid number \"%s\" for -%s\n",
|
||||
prog, arg, o->name);
|
||||
if (!opt_long(arg, &lval))
|
||||
return -1;
|
||||
}
|
||||
break;
|
||||
case 'u':
|
||||
if (!opt_ulong(arg, &ulval)) {
|
||||
opt_printf_stderr("%s: Invalid number \"%s\" for -%s\n",
|
||||
prog, arg, o->name);
|
||||
if (!opt_ulong(arg, &ulval))
|
||||
return -1;
|
||||
}
|
||||
break;
|
||||
case 'c':
|
||||
case 'E':
|
||||
|
||||
+25
-6
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -26,6 +26,11 @@
|
||||
|
||||
#define COOKIE_SECRET_LENGTH 16
|
||||
|
||||
DEFINE_STACK_OF(X509)
|
||||
DEFINE_STACK_OF(X509_CRL)
|
||||
DEFINE_STACK_OF(X509_NAME)
|
||||
DEFINE_STACK_OF_STRING()
|
||||
|
||||
VERIFY_CB_ARGS verify_args = { -1, 0, X509_V_OK, 0 };
|
||||
|
||||
#ifndef OPENSSL_NO_SOCK
|
||||
@@ -190,6 +195,7 @@ static STRINT_PAIR cert_type_list[] = {
|
||||
{"RSA fixed ECDH", TLS_CT_RSA_FIXED_ECDH},
|
||||
{"ECDSA fixed ECDH", TLS_CT_ECDSA_FIXED_ECDH},
|
||||
{"GOST01 Sign", TLS_CT_GOST01_SIGN},
|
||||
{"GOST12 Sign", TLS_CT_GOST12_IANA_SIGN},
|
||||
{NULL}
|
||||
};
|
||||
|
||||
@@ -781,7 +787,7 @@ int generate_cookie_callback(SSL *ssl, unsigned char *cookie,
|
||||
BIO_printf(bio_err, "HMAC not found\n");
|
||||
goto end;
|
||||
}
|
||||
ctx = EVP_MAC_CTX_new(hmac);
|
||||
ctx = EVP_MAC_new_ctx(hmac);
|
||||
if (ctx == NULL) {
|
||||
BIO_printf(bio_err, "HMAC context allocation failed\n");
|
||||
goto end;
|
||||
@@ -790,7 +796,7 @@ int generate_cookie_callback(SSL *ssl, unsigned char *cookie,
|
||||
*p++ = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY, cookie_secret,
|
||||
COOKIE_SECRET_LENGTH);
|
||||
*p = OSSL_PARAM_construct_end();
|
||||
if (!EVP_MAC_CTX_set_params(ctx, params)) {
|
||||
if (!EVP_MAC_set_ctx_params(ctx, params)) {
|
||||
BIO_printf(bio_err, "HMAC context parameter setting failed\n");
|
||||
goto end;
|
||||
}
|
||||
@@ -1088,11 +1094,11 @@ int args_excert(int opt, SSL_EXCERT **pexc)
|
||||
exc->build_chain = 1;
|
||||
break;
|
||||
case OPT_X_CERTFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &exc->certform))
|
||||
if (!opt_format(opt_arg(), OPT_FMT_ANY, &exc->certform))
|
||||
return 0;
|
||||
break;
|
||||
case OPT_X_KEYFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &exc->keyform))
|
||||
if (!opt_format(opt_arg(), OPT_FMT_ANY, &exc->keyform))
|
||||
return 0;
|
||||
break;
|
||||
}
|
||||
@@ -1433,7 +1439,20 @@ static int security_callback_debug(const SSL *s, const SSL_CTX *ctx,
|
||||
case SSL_SECOP_OTHER_DH:
|
||||
{
|
||||
DH *dh = other;
|
||||
BIO_printf(sdb->out, "%d", DH_bits(dh));
|
||||
EVP_PKEY *pkey = EVP_PKEY_new();
|
||||
int fail = 1;
|
||||
|
||||
if (pkey != NULL) {
|
||||
if (EVP_PKEY_set1_DH(pkey, dh)) {
|
||||
BIO_printf(sdb->out, "%d", EVP_PKEY_bits(pkey));
|
||||
fail = 0;
|
||||
}
|
||||
|
||||
EVP_PKEY_free(pkey);
|
||||
}
|
||||
if (fail)
|
||||
BIO_printf(sdb->out, "s_cb.c:security_callback_debug op=0x%x",
|
||||
op);
|
||||
break;
|
||||
}
|
||||
#endif
|
||||
|
||||
+22
-1
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -392,4 +392,25 @@ int do_server(int *accept_sock, const char *host, const char *port,
|
||||
return ret;
|
||||
}
|
||||
|
||||
void do_ssl_shutdown(SSL *ssl)
|
||||
{
|
||||
int ret;
|
||||
|
||||
do {
|
||||
/* We only do unidirectional shutdown */
|
||||
ret = SSL_shutdown(ssl);
|
||||
if (ret < 0) {
|
||||
switch (SSL_get_error(ssl, ret)) {
|
||||
case SSL_ERROR_WANT_READ:
|
||||
case SSL_ERROR_WANT_WRITE:
|
||||
case SSL_ERROR_WANT_ASYNC:
|
||||
case SSL_ERROR_WANT_ASYNC_JOB:
|
||||
/* We just do busy waiting. Nothing clever */
|
||||
continue;
|
||||
}
|
||||
ret = 0;
|
||||
}
|
||||
} while (ret < 0);
|
||||
}
|
||||
|
||||
#endif /* OPENSSL_NO_SOCK */
|
||||
+11
-2
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -19,6 +19,8 @@
|
||||
#include "opt.h"
|
||||
#include "names.h"
|
||||
|
||||
DEFINE_STACK_OF_CSTRING()
|
||||
|
||||
static int verbose = 0;
|
||||
|
||||
static void legacy_cipher_fn(const EVP_CIPHER *c,
|
||||
@@ -617,7 +619,8 @@ typedef enum HELPLIST_CHOICE {
|
||||
OPT_COMMANDS, OPT_DIGEST_COMMANDS, OPT_MAC_ALGORITHMS, OPT_OPTIONS,
|
||||
OPT_DIGEST_ALGORITHMS, OPT_CIPHER_COMMANDS, OPT_CIPHER_ALGORITHMS,
|
||||
OPT_PK_ALGORITHMS, OPT_PK_METHOD, OPT_ENGINES, OPT_DISABLED,
|
||||
OPT_KDF_ALGORITHMS, OPT_MISSING_HELP, OPT_OBJECTS
|
||||
OPT_KDF_ALGORITHMS, OPT_MISSING_HELP, OPT_OBJECTS,
|
||||
OPT_PROV_ENUM
|
||||
} HELPLIST_CHOICE;
|
||||
|
||||
const OPTIONS list_options[] = {
|
||||
@@ -655,6 +658,8 @@ const OPTIONS list_options[] = {
|
||||
"List options for specified command"},
|
||||
{"objects", OPT_OBJECTS, '-',
|
||||
"List built in objects (OID<->name mappings)"},
|
||||
|
||||
OPT_PROV_OPTIONS,
|
||||
{NULL}
|
||||
};
|
||||
|
||||
@@ -741,6 +746,10 @@ opthelp:
|
||||
case OPT_VERBOSE:
|
||||
verbose = 1;
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
return 1;
|
||||
break;
|
||||
}
|
||||
done = 1;
|
||||
}
|
||||
|
||||
+15
-6
@@ -1,7 +1,7 @@
|
||||
/*
|
||||
* Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
@@ -16,12 +16,15 @@
|
||||
#include <openssl/evp.h>
|
||||
#include <openssl/params.h>
|
||||
|
||||
DEFINE_STACK_OF_STRING()
|
||||
|
||||
#undef BUFSIZE
|
||||
#define BUFSIZE 1024*8
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_MACOPT, OPT_BIN, OPT_IN, OPT_OUT
|
||||
OPT_MACOPT, OPT_BIN, OPT_IN, OPT_OUT,
|
||||
OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS mac_options[] = {
|
||||
@@ -40,6 +43,8 @@ const OPTIONS mac_options[] = {
|
||||
{"binary", OPT_BIN, '-',
|
||||
"Output in binary format (default is hexadecimal)"},
|
||||
|
||||
OPT_PROV_OPTIONS,
|
||||
|
||||
OPT_PARAMETERS(),
|
||||
{"mac_name", 0, 0, "MAC algorithm"},
|
||||
{NULL}
|
||||
@@ -89,6 +94,10 @@ opthelp:
|
||||
if (opts == NULL || !sk_OPENSSL_STRING_push(opts, opt_arg()))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto err;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
@@ -105,7 +114,7 @@ opthelp:
|
||||
goto opthelp;
|
||||
}
|
||||
|
||||
ctx = EVP_MAC_CTX_new(mac);
|
||||
ctx = EVP_MAC_new_ctx(mac);
|
||||
if (ctx == NULL)
|
||||
goto err;
|
||||
|
||||
@@ -117,7 +126,7 @@ opthelp:
|
||||
if (params == NULL)
|
||||
goto err;
|
||||
|
||||
if (!EVP_MAC_CTX_set_params(ctx, params)) {
|
||||
if (!EVP_MAC_set_ctx_params(ctx, params)) {
|
||||
BIO_printf(bio_err, "MAC parameter error\n");
|
||||
ERR_print_errors(bio_err);
|
||||
ok = 0;
|
||||
@@ -190,7 +199,7 @@ err:
|
||||
sk_OPENSSL_STRING_free(opts);
|
||||
BIO_free(in);
|
||||
BIO_free(out);
|
||||
EVP_MAC_CTX_free(ctx);
|
||||
EVP_MAC_free_ctx(ctx);
|
||||
EVP_MAC_free(mac);
|
||||
return ret;
|
||||
}
|
||||
+11
-2
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1999-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1999-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -14,9 +14,12 @@
|
||||
#include <openssl/pem.h>
|
||||
#include <openssl/err.h>
|
||||
|
||||
DEFINE_STACK_OF(X509)
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_TOSEQ, OPT_IN, OPT_OUT
|
||||
OPT_TOSEQ, OPT_IN, OPT_OUT,
|
||||
OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS nseq_options[] = {
|
||||
@@ -29,6 +32,8 @@ const OPTIONS nseq_options[] = {
|
||||
OPT_SECTION("Output"),
|
||||
{"toseq", OPT_TOSEQ, '-', "Output NS Sequence file"},
|
||||
{"out", OPT_OUT, '>', "Output file"},
|
||||
|
||||
OPT_PROV_OPTIONS,
|
||||
{NULL}
|
||||
};
|
||||
|
||||
@@ -62,6 +67,10 @@ int nseq_main(int argc, char **argv)
|
||||
case OPT_OUT:
|
||||
outfile = opt_arg();
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
|
||||
+210
-463
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 2001-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2001-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -9,65 +9,36 @@
|
||||
|
||||
#include <openssl/opensslconf.h>
|
||||
|
||||
#ifdef OPENSSL_NO_OCSP
|
||||
NON_EMPTY_TRANSLATION_UNIT
|
||||
#else
|
||||
# ifdef OPENSSL_SYS_VMS
|
||||
# define _XOPEN_SOURCE_EXTENDED/* So fd_set and friends get properly defined
|
||||
* on OpenVMS */
|
||||
# endif
|
||||
#ifdef OPENSSL_SYS_VMS
|
||||
/* So fd_set and friends get properly defined on OpenVMS */
|
||||
# define _XOPEN_SOURCE_EXTENDED
|
||||
#endif
|
||||
|
||||
# include <stdio.h>
|
||||
# include <stdlib.h>
|
||||
# include <string.h>
|
||||
# include <time.h>
|
||||
# include <ctype.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <time.h>
|
||||
#include <ctype.h>
|
||||
|
||||
/* Needs to be included before the openssl headers */
|
||||
# include "apps.h"
|
||||
# include "progs.h"
|
||||
# include "internal/sockets.h"
|
||||
# include <openssl/e_os2.h>
|
||||
# include <openssl/crypto.h>
|
||||
# include <openssl/err.h>
|
||||
# include <openssl/ssl.h>
|
||||
# include <openssl/evp.h>
|
||||
# include <openssl/bn.h>
|
||||
# include <openssl/x509v3.h>
|
||||
# include <openssl/rand.h>
|
||||
#include "apps.h"
|
||||
#include "http_server.h"
|
||||
#include "progs.h"
|
||||
#include "internal/sockets.h"
|
||||
#include <openssl/e_os2.h>
|
||||
#include <openssl/crypto.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/ssl.h>
|
||||
#include <openssl/evp.h>
|
||||
#include <openssl/bn.h>
|
||||
#include <openssl/x509v3.h>
|
||||
|
||||
#ifndef HAVE_FORK
|
||||
# if defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_WINDOWS)
|
||||
# define HAVE_FORK 0
|
||||
# else
|
||||
# define HAVE_FORK 1
|
||||
# endif
|
||||
#endif
|
||||
DEFINE_STACK_OF(OCSP_CERTID)
|
||||
DEFINE_STACK_OF(CONF_VALUE)
|
||||
DEFINE_STACK_OF(X509)
|
||||
DEFINE_STACK_OF_STRING()
|
||||
|
||||
#if HAVE_FORK
|
||||
# undef NO_FORK
|
||||
#else
|
||||
# define NO_FORK
|
||||
#endif
|
||||
|
||||
# if !defined(NO_FORK) && !defined(OPENSSL_NO_SOCK) \
|
||||
&& !defined(OPENSSL_NO_POSIX_IO)
|
||||
# define OCSP_DAEMON
|
||||
# include <sys/types.h>
|
||||
# include <sys/wait.h>
|
||||
# include <syslog.h>
|
||||
# include <signal.h>
|
||||
# define MAXERRLEN 1000 /* limit error text sent to syslog to 1000 bytes */
|
||||
# else
|
||||
# undef LOG_INFO
|
||||
# undef LOG_WARNING
|
||||
# undef LOG_ERR
|
||||
# define LOG_INFO 0
|
||||
# define LOG_WARNING 1
|
||||
# define LOG_ERR 2
|
||||
# endif
|
||||
|
||||
# if defined(OPENSSL_SYS_VXWORKS)
|
||||
#if defined(OPENSSL_SYS_VXWORKS)
|
||||
/* not supported */
|
||||
int setpgid(pid_t pid, pid_t pgid)
|
||||
{
|
||||
@@ -80,9 +51,9 @@ pid_t fork(void)
|
||||
errno = ENOSYS;
|
||||
return (pid_t) -1;
|
||||
}
|
||||
# endif
|
||||
#endif
|
||||
/* Maximum leeway in validity period: default 5 minutes */
|
||||
# define MAX_VALIDITY_PERIOD (5 * 60)
|
||||
#define MAX_VALIDITY_PERIOD (5 * 60)
|
||||
|
||||
static int add_ocsp_cert(OCSP_REQUEST **req, X509 *cert,
|
||||
const EVP_MD *cert_id_md, X509 *issuer,
|
||||
@@ -103,20 +74,21 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req
|
||||
const EVP_MD *resp_md);
|
||||
|
||||
static char **lookup_serial(CA_DB *db, ASN1_INTEGER *ser);
|
||||
static BIO *init_responder(const char *port);
|
||||
static int do_responder(OCSP_REQUEST **preq, BIO **pcbio, BIO *acbio, int timeout);
|
||||
static int send_ocsp_response(BIO *cbio, OCSP_RESPONSE *resp);
|
||||
static void log_message(int level, const char *fmt, ...);
|
||||
static int do_responder(OCSP_REQUEST **preq, BIO **pcbio, BIO *acbio,
|
||||
int timeout);
|
||||
static int send_ocsp_response(BIO *cbio, const OCSP_RESPONSE *resp);
|
||||
static char *prog;
|
||||
static int multi = 0;
|
||||
|
||||
# ifdef OCSP_DAEMON
|
||||
static int acfd = (int) INVALID_SOCKET;
|
||||
#ifdef HTTP_DAEMON
|
||||
static int index_changed(CA_DB *);
|
||||
static void spawn_loop(void);
|
||||
static int print_syslog(const char *str, size_t len, void *levPtr);
|
||||
static void socket_timeout(int signum);
|
||||
# endif
|
||||
#endif
|
||||
|
||||
#ifndef OPENSSL_NO_SOCK
|
||||
static OCSP_RESPONSE *query_responder(BIO *cbio, const char *host,
|
||||
const char *path,
|
||||
const STACK_OF(CONF_VALUE) *headers,
|
||||
OCSP_REQUEST *req, int req_timeout);
|
||||
#endif
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
@@ -137,7 +109,7 @@ typedef enum OPTION_choice {
|
||||
OPT_RCID,
|
||||
OPT_V_ENUM,
|
||||
OPT_MD,
|
||||
OPT_MULTI
|
||||
OPT_MULTI, OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS ocsp_options[] = {
|
||||
@@ -160,9 +132,9 @@ const OPTIONS ocsp_options[] = {
|
||||
"Connection timeout (in seconds) to the OCSP responder"},
|
||||
{"resp_no_certs", OPT_RESP_NO_CERTS, '-',
|
||||
"Don't include any certificates in response"},
|
||||
# ifdef OCSP_DAEMON
|
||||
#ifdef HTTP_DAEMON
|
||||
{"multi", OPT_MULTI, 'p', "run multiple responder processes"},
|
||||
# endif
|
||||
#endif
|
||||
{"no_certs", OPT_NO_CERTS, '-',
|
||||
"Don't include any certificates in signed request"},
|
||||
{"badsig", OPT_BADSIG, '-',
|
||||
@@ -230,6 +202,7 @@ const OPTIONS ocsp_options[] = {
|
||||
{"status_age", OPT_STATUS_AGE, 'p', "Maximum status age in seconds"},
|
||||
|
||||
OPT_V_OPTIONS,
|
||||
OPT_PROV_OPTIONS,
|
||||
{NULL}
|
||||
};
|
||||
|
||||
@@ -268,7 +241,7 @@ int ocsp_main(int argc, char **argv)
|
||||
int noCAfile = 0, noCApath = 0, noCAstore = 0;
|
||||
int accept_count = -1, add_nonce = 1, noverify = 0, use_ssl = -1;
|
||||
int vpmtouched = 0, badsig = 0, i, ignore_err = 0, nmin = 0, ndays = -1;
|
||||
int req_text = 0, resp_text = 0, ret = 1;
|
||||
int req_text = 0, resp_text = 0, res, ret = 1;
|
||||
int req_timeout = -1;
|
||||
long nsec = MAX_VALIDITY_PERIOD, maxage = -1;
|
||||
unsigned long sign_flags = 0, verify_flags = 0, rflags = 0;
|
||||
@@ -308,8 +281,7 @@ int ocsp_main(int argc, char **argv)
|
||||
OPENSSL_free(tport);
|
||||
OPENSSL_free(tpath);
|
||||
thost = tport = tpath = NULL;
|
||||
if (!OSSL_HTTP_parse_url(opt_arg(),
|
||||
&host, &port, &path, &use_ssl)) {
|
||||
if (!OCSP_parse_url(opt_arg(), &host, &port, &path, &use_ssl)) {
|
||||
BIO_printf(bio_err, "%s Error parsing URL\n", prog);
|
||||
goto end;
|
||||
}
|
||||
@@ -438,7 +410,8 @@ int ocsp_main(int argc, char **argv)
|
||||
path = opt_arg();
|
||||
break;
|
||||
case OPT_ISSUER:
|
||||
issuer = load_cert(opt_arg(), FORMAT_PEM, "issuer certificate");
|
||||
issuer = load_cert(opt_arg(), FORMAT_UNDEF,
|
||||
"issuer certificate");
|
||||
if (issuer == NULL)
|
||||
goto end;
|
||||
if (issuers == NULL) {
|
||||
@@ -450,7 +423,7 @@ int ocsp_main(int argc, char **argv)
|
||||
break;
|
||||
case OPT_CERT:
|
||||
X509_free(cert);
|
||||
cert = load_cert(opt_arg(), FORMAT_PEM, "certificate");
|
||||
cert = load_cert(opt_arg(), FORMAT_UNDEF, "certificate");
|
||||
if (cert == NULL)
|
||||
goto end;
|
||||
if (cert_id_md == NULL)
|
||||
@@ -537,9 +510,13 @@ int ocsp_main(int argc, char **argv)
|
||||
trailing_md = 1;
|
||||
break;
|
||||
case OPT_MULTI:
|
||||
# ifdef OCSP_DAEMON
|
||||
#ifdef HTTP_DAEMON
|
||||
multi = atoi(opt_arg());
|
||||
# endif
|
||||
#endif
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
@@ -577,15 +554,21 @@ int ocsp_main(int argc, char **argv)
|
||||
}
|
||||
|
||||
if (req == NULL && port != NULL) {
|
||||
acbio = init_responder(port);
|
||||
#ifndef OPENSSL_NO_SOCK
|
||||
acbio = http_server_init_bio(prog, port);
|
||||
if (acbio == NULL)
|
||||
goto end;
|
||||
#else
|
||||
BIO_printf(bio_err, "Cannot act as server - sockets not supported\n");
|
||||
goto end;
|
||||
#endif
|
||||
}
|
||||
|
||||
if (rsignfile != NULL) {
|
||||
if (rkeyfile == NULL)
|
||||
rkeyfile = rsignfile;
|
||||
rsigner = load_cert(rsignfile, FORMAT_PEM, "responder certificate");
|
||||
rsigner = load_cert(rsignfile, FORMAT_UNDEF,
|
||||
"responder certificate");
|
||||
if (rsigner == NULL) {
|
||||
BIO_printf(bio_err, "Error loading responder certificate\n");
|
||||
goto end;
|
||||
@@ -623,20 +606,20 @@ int ocsp_main(int argc, char **argv)
|
||||
}
|
||||
}
|
||||
|
||||
# ifdef OCSP_DAEMON
|
||||
#ifdef HTTP_DAEMON
|
||||
if (multi && acbio != NULL)
|
||||
spawn_loop();
|
||||
spawn_loop(prog);
|
||||
if (acbio != NULL && req_timeout > 0)
|
||||
signal(SIGALRM, socket_timeout);
|
||||
#endif
|
||||
|
||||
if (acbio != NULL)
|
||||
log_message(LOG_INFO, "waiting for OCSP client connections...");
|
||||
log_message(prog, LOG_INFO, "waiting for OCSP client connections...");
|
||||
|
||||
redo_accept:
|
||||
|
||||
if (acbio != NULL) {
|
||||
# ifdef OCSP_DAEMON
|
||||
#ifdef HTTP_DAEMON
|
||||
if (index_changed(rdb)) {
|
||||
CA_DB *newrdb = load_index(ridx_filename, NULL);
|
||||
|
||||
@@ -645,21 +628,24 @@ redo_accept:
|
||||
rdb = newrdb;
|
||||
} else {
|
||||
free_index(newrdb);
|
||||
log_message(LOG_ERR, "error reloading updated index: %s",
|
||||
log_message(prog, LOG_ERR, "error reloading updated index: %s",
|
||||
ridx_filename);
|
||||
}
|
||||
}
|
||||
# endif
|
||||
#endif
|
||||
|
||||
req = NULL;
|
||||
if (!do_responder(&req, &cbio, acbio, req_timeout))
|
||||
res = do_responder(&req, &cbio, acbio, req_timeout);
|
||||
if (res == 0)
|
||||
goto redo_accept;
|
||||
|
||||
if (req == NULL) {
|
||||
resp =
|
||||
OCSP_response_create(OCSP_RESPONSE_STATUS_MALFORMEDREQUEST,
|
||||
NULL);
|
||||
send_ocsp_response(cbio, resp);
|
||||
if (res == 1) {
|
||||
resp =
|
||||
OCSP_response_create(OCSP_RESPONSE_STATUS_MALFORMEDREQUEST,
|
||||
NULL);
|
||||
send_ocsp_response(cbio, resp);
|
||||
}
|
||||
goto done_resp;
|
||||
}
|
||||
}
|
||||
@@ -679,7 +665,7 @@ redo_accept:
|
||||
if (signfile != NULL) {
|
||||
if (keyfile == NULL)
|
||||
keyfile = signfile;
|
||||
signer = load_cert(signfile, FORMAT_PEM, "signer certificate");
|
||||
signer = load_cert(signfile, FORMAT_UNDEF, "signer certificate");
|
||||
if (signer == NULL) {
|
||||
BIO_printf(bio_err, "Error loading signer certificate\n");
|
||||
goto end;
|
||||
@@ -719,16 +705,16 @@ redo_accept:
|
||||
if (cbio != NULL)
|
||||
send_ocsp_response(cbio, resp);
|
||||
} else if (host != NULL) {
|
||||
# ifndef OPENSSL_NO_SOCK
|
||||
#ifndef OPENSSL_NO_SOCK
|
||||
resp = process_responder(req, host, path,
|
||||
port, use_ssl, headers, req_timeout);
|
||||
if (resp == NULL)
|
||||
goto end;
|
||||
# else
|
||||
#else
|
||||
BIO_printf(bio_err,
|
||||
"Error creating connect BIO - sockets not supported.\n");
|
||||
"Error creating connect BIO - sockets not supported\n");
|
||||
goto end;
|
||||
# endif
|
||||
#endif
|
||||
} else if (respin != NULL) {
|
||||
derbio = bio_open_default(respin, 'r', FORMAT_ASN1);
|
||||
if (derbio == NULL)
|
||||
@@ -866,41 +852,7 @@ redo_accept:
|
||||
return ret;
|
||||
}
|
||||
|
||||
static void
|
||||
log_message(int level, const char *fmt, ...)
|
||||
{
|
||||
va_list ap;
|
||||
|
||||
va_start(ap, fmt);
|
||||
# ifdef OCSP_DAEMON
|
||||
if (multi) {
|
||||
char buf[1024];
|
||||
if (vsnprintf(buf, sizeof(buf), fmt, ap) > 0) {
|
||||
syslog(level, "%s", buf);
|
||||
}
|
||||
if (level >= LOG_ERR)
|
||||
ERR_print_errors_cb(print_syslog, &level);
|
||||
}
|
||||
# endif
|
||||
if (!multi) {
|
||||
BIO_printf(bio_err, "%s: ", prog);
|
||||
BIO_vprintf(bio_err, fmt, ap);
|
||||
BIO_printf(bio_err, "\n");
|
||||
}
|
||||
va_end(ap);
|
||||
}
|
||||
|
||||
# ifdef OCSP_DAEMON
|
||||
|
||||
static int print_syslog(const char *str, size_t len, void *levPtr)
|
||||
{
|
||||
int level = *(int *)levPtr;
|
||||
int ilen = (len > MAXERRLEN) ? MAXERRLEN : len;
|
||||
|
||||
syslog(level, "%.*s", ilen, str);
|
||||
|
||||
return ilen;
|
||||
}
|
||||
#ifdef HTTP_DAEMON
|
||||
|
||||
static int index_changed(CA_DB *rdb)
|
||||
{
|
||||
@@ -918,132 +870,7 @@ static int index_changed(CA_DB *rdb)
|
||||
return 0;
|
||||
}
|
||||
|
||||
static void killall(int ret, pid_t *kidpids)
|
||||
{
|
||||
int i;
|
||||
|
||||
for (i = 0; i < multi; ++i)
|
||||
if (kidpids[i] != 0)
|
||||
(void)kill(kidpids[i], SIGTERM);
|
||||
OPENSSL_free(kidpids);
|
||||
sleep(1);
|
||||
exit(ret);
|
||||
}
|
||||
|
||||
static int termsig = 0;
|
||||
|
||||
static void noteterm (int sig)
|
||||
{
|
||||
termsig = sig;
|
||||
}
|
||||
|
||||
/*
|
||||
* Loop spawning up to `multi` child processes, only child processes return
|
||||
* from this function. The parent process loops until receiving a termination
|
||||
* signal, kills extant children and exits without returning.
|
||||
*/
|
||||
static void spawn_loop(void)
|
||||
{
|
||||
pid_t *kidpids = NULL;
|
||||
int status;
|
||||
int procs = 0;
|
||||
int i;
|
||||
|
||||
openlog(prog, LOG_PID, LOG_DAEMON);
|
||||
|
||||
if (setpgid(0, 0)) {
|
||||
syslog(LOG_ERR, "fatal: error detaching from parent process group: %s",
|
||||
strerror(errno));
|
||||
exit(1);
|
||||
}
|
||||
kidpids = app_malloc(multi * sizeof(*kidpids), "child PID array");
|
||||
for (i = 0; i < multi; ++i)
|
||||
kidpids[i] = 0;
|
||||
|
||||
signal(SIGINT, noteterm);
|
||||
signal(SIGTERM, noteterm);
|
||||
|
||||
while (termsig == 0) {
|
||||
pid_t fpid;
|
||||
|
||||
/*
|
||||
* Wait for a child to replace when we're at the limit.
|
||||
* Slow down if a child exited abnormally or waitpid() < 0
|
||||
*/
|
||||
while (termsig == 0 && procs >= multi) {
|
||||
if ((fpid = waitpid(-1, &status, 0)) > 0) {
|
||||
for (i = 0; i < procs; ++i) {
|
||||
if (kidpids[i] == fpid) {
|
||||
kidpids[i] = 0;
|
||||
--procs;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (i >= multi) {
|
||||
syslog(LOG_ERR, "fatal: internal error: "
|
||||
"no matching child slot for pid: %ld",
|
||||
(long) fpid);
|
||||
killall(1, kidpids);
|
||||
}
|
||||
if (status != 0) {
|
||||
if (WIFEXITED(status))
|
||||
syslog(LOG_WARNING, "child process: %ld, exit status: %d",
|
||||
(long)fpid, WEXITSTATUS(status));
|
||||
else if (WIFSIGNALED(status))
|
||||
syslog(LOG_WARNING, "child process: %ld, term signal %d%s",
|
||||
(long)fpid, WTERMSIG(status),
|
||||
#ifdef WCOREDUMP
|
||||
WCOREDUMP(status) ? " (core dumped)" :
|
||||
#endif
|
||||
"");
|
||||
sleep(1);
|
||||
}
|
||||
break;
|
||||
} else if (errno != EINTR) {
|
||||
syslog(LOG_ERR, "fatal: waitpid(): %s", strerror(errno));
|
||||
killall(1, kidpids);
|
||||
}
|
||||
}
|
||||
if (termsig)
|
||||
break;
|
||||
|
||||
switch(fpid = fork()) {
|
||||
case -1: /* error */
|
||||
/* System critically low on memory, pause and try again later */
|
||||
sleep(30);
|
||||
break;
|
||||
case 0: /* child */
|
||||
OPENSSL_free(kidpids);
|
||||
signal(SIGINT, SIG_DFL);
|
||||
signal(SIGTERM, SIG_DFL);
|
||||
if (termsig)
|
||||
_exit(0);
|
||||
if (RAND_poll() <= 0) {
|
||||
syslog(LOG_ERR, "fatal: RAND_poll() failed");
|
||||
_exit(1);
|
||||
}
|
||||
return;
|
||||
default: /* parent */
|
||||
for (i = 0; i < multi; ++i) {
|
||||
if (kidpids[i] == 0) {
|
||||
kidpids[i] = fpid;
|
||||
procs++;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (i >= multi) {
|
||||
syslog(LOG_ERR, "fatal: internal error: no free child slots");
|
||||
killall(1, kidpids);
|
||||
}
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
/* The loop above can only break on termsig */
|
||||
syslog(LOG_INFO, "terminating on signal: %d", termsig);
|
||||
killall(0, kidpids);
|
||||
}
|
||||
# endif
|
||||
|
||||
static int add_ocsp_cert(OCSP_REQUEST **req, X509 *cert,
|
||||
const EVP_MD *cert_id_md, X509 *issuer,
|
||||
@@ -1076,7 +903,7 @@ static int add_ocsp_serial(OCSP_REQUEST **req, char *serial,
|
||||
STACK_OF(OCSP_CERTID) *ids)
|
||||
{
|
||||
OCSP_CERTID *id;
|
||||
X509_NAME *iname;
|
||||
const X509_NAME *iname;
|
||||
ASN1_BIT_STRING *ikey;
|
||||
ASN1_INTEGER *sno;
|
||||
|
||||
@@ -1329,243 +1156,163 @@ static char **lookup_serial(CA_DB *db, ASN1_INTEGER *ser)
|
||||
return rrow;
|
||||
}
|
||||
|
||||
/* Quick and dirty OCSP server: read in and parse input request */
|
||||
|
||||
static BIO *init_responder(const char *port)
|
||||
{
|
||||
# ifdef OPENSSL_NO_SOCK
|
||||
BIO_printf(bio_err,
|
||||
"Error setting up accept BIO - sockets not supported.\n");
|
||||
return NULL;
|
||||
# else
|
||||
BIO *acbio = NULL, *bufbio = NULL;
|
||||
|
||||
bufbio = BIO_new(BIO_f_buffer());
|
||||
if (bufbio == NULL)
|
||||
goto err;
|
||||
acbio = BIO_new(BIO_s_accept());
|
||||
if (acbio == NULL
|
||||
|| BIO_set_bind_mode(acbio, BIO_BIND_REUSEADDR) < 0
|
||||
|| BIO_set_accept_port(acbio, port) < 0) {
|
||||
log_message(LOG_ERR, "Error setting up accept BIO");
|
||||
goto err;
|
||||
}
|
||||
|
||||
BIO_set_accept_bios(acbio, bufbio);
|
||||
bufbio = NULL;
|
||||
if (BIO_do_accept(acbio) <= 0) {
|
||||
log_message(LOG_ERR, "Error starting accept");
|
||||
goto err;
|
||||
}
|
||||
|
||||
return acbio;
|
||||
|
||||
err:
|
||||
BIO_free_all(acbio);
|
||||
BIO_free(bufbio);
|
||||
return NULL;
|
||||
# endif
|
||||
}
|
||||
|
||||
# ifndef OPENSSL_NO_SOCK
|
||||
/*
|
||||
* Decode %xx URL-decoding in-place. Ignores mal-formed sequences.
|
||||
*/
|
||||
static int urldecode(char *p)
|
||||
{
|
||||
unsigned char *out = (unsigned char *)p;
|
||||
unsigned char *save = out;
|
||||
|
||||
for (; *p; p++) {
|
||||
if (*p != '%')
|
||||
*out++ = *p;
|
||||
else if (isxdigit(_UC(p[1])) && isxdigit(_UC(p[2]))) {
|
||||
/* Don't check, can't fail because of ixdigit() call. */
|
||||
*out++ = (OPENSSL_hexchar2int(p[1]) << 4)
|
||||
| OPENSSL_hexchar2int(p[2]);
|
||||
p += 2;
|
||||
}
|
||||
else
|
||||
return -1;
|
||||
}
|
||||
*out = '\0';
|
||||
return (int)(out - save);
|
||||
}
|
||||
# endif
|
||||
|
||||
# ifdef OCSP_DAEMON
|
||||
static void socket_timeout(int signum)
|
||||
{
|
||||
if (acfd != (int)INVALID_SOCKET)
|
||||
(void)shutdown(acfd, SHUT_RD);
|
||||
}
|
||||
# endif
|
||||
|
||||
static int do_responder(OCSP_REQUEST **preq, BIO **pcbio, BIO *acbio,
|
||||
int timeout)
|
||||
{
|
||||
# ifdef OPENSSL_NO_SOCK
|
||||
return 0;
|
||||
# else
|
||||
int len;
|
||||
OCSP_REQUEST *req = NULL;
|
||||
char inbuf[2048], reqbuf[2048];
|
||||
char *p, *q;
|
||||
BIO *cbio = NULL, *getbio = NULL, *b64 = NULL;
|
||||
const char *client;
|
||||
|
||||
#ifndef OPENSSL_NO_SOCK
|
||||
return http_server_get_asn1_req(ASN1_ITEM_rptr(OCSP_RESPONSE),
|
||||
(ASN1_VALUE **)preq, NULL, pcbio, acbio,
|
||||
prog, 1 /* accept_get */, timeout);
|
||||
#else
|
||||
BIO_printf(bio_err,
|
||||
"Error getting OCSP request - sockets not supported\n");
|
||||
*preq = NULL;
|
||||
|
||||
/* Connection loss before accept() is routine, ignore silently */
|
||||
if (BIO_do_accept(acbio) <= 0)
|
||||
return 0;
|
||||
|
||||
cbio = BIO_pop(acbio);
|
||||
*pcbio = cbio;
|
||||
client = BIO_get_peer_name(cbio);
|
||||
|
||||
# ifdef OCSP_DAEMON
|
||||
if (timeout > 0) {
|
||||
(void) BIO_get_fd(cbio, &acfd);
|
||||
alarm(timeout);
|
||||
}
|
||||
# endif
|
||||
|
||||
/* Read the request line. */
|
||||
len = BIO_gets(cbio, reqbuf, sizeof(reqbuf));
|
||||
if (len <= 0)
|
||||
goto out;
|
||||
|
||||
if (strncmp(reqbuf, "GET ", 4) == 0) {
|
||||
/* Expecting GET {sp} /URL {sp} HTTP/1.x */
|
||||
for (p = reqbuf + 4; *p == ' '; ++p)
|
||||
continue;
|
||||
if (*p != '/') {
|
||||
log_message(LOG_INFO, "Invalid request -- bad URL: %s", client);
|
||||
goto out;
|
||||
}
|
||||
p++;
|
||||
|
||||
/* Splice off the HTTP version identifier. */
|
||||
for (q = p; *q; q++)
|
||||
if (*q == ' ')
|
||||
break;
|
||||
if (strncmp(q, " HTTP/1.", 8) != 0) {
|
||||
log_message(LOG_INFO,
|
||||
"Invalid request -- bad HTTP version: %s", client);
|
||||
goto out;
|
||||
}
|
||||
*q = '\0';
|
||||
|
||||
/*
|
||||
* Skip "GET / HTTP..." requests often used by load-balancers. Note:
|
||||
* 'p' was incremented above to point to the first byte *after* the
|
||||
* leading slash, so with 'GET / ' it is now an empty string.
|
||||
*/
|
||||
if (p[0] == '\0')
|
||||
goto out;
|
||||
|
||||
len = urldecode(p);
|
||||
if (len <= 0) {
|
||||
log_message(LOG_INFO,
|
||||
"Invalid request -- bad URL encoding: %s", client);
|
||||
goto out;
|
||||
}
|
||||
if ((getbio = BIO_new_mem_buf(p, len)) == NULL
|
||||
|| (b64 = BIO_new(BIO_f_base64())) == NULL) {
|
||||
log_message(LOG_ERR, "Could not allocate base64 bio: %s", client);
|
||||
goto out;
|
||||
}
|
||||
BIO_set_flags(b64, BIO_FLAGS_BASE64_NO_NL);
|
||||
getbio = BIO_push(b64, getbio);
|
||||
} else if (strncmp(reqbuf, "POST ", 5) != 0) {
|
||||
log_message(LOG_INFO, "Invalid request -- bad HTTP verb: %s", client);
|
||||
goto out;
|
||||
}
|
||||
|
||||
/* Read and skip past the headers. */
|
||||
for (;;) {
|
||||
len = BIO_gets(cbio, inbuf, sizeof(inbuf));
|
||||
if (len <= 0)
|
||||
goto out;
|
||||
if ((inbuf[0] == '\r') || (inbuf[0] == '\n'))
|
||||
break;
|
||||
}
|
||||
|
||||
# ifdef OCSP_DAEMON
|
||||
/* Clear alarm before we close the client socket */
|
||||
alarm(0);
|
||||
timeout = 0;
|
||||
# endif
|
||||
|
||||
/* Try to read OCSP request */
|
||||
if (getbio != NULL) {
|
||||
req = d2i_OCSP_REQUEST_bio(getbio, NULL);
|
||||
BIO_free_all(getbio);
|
||||
} else {
|
||||
req = d2i_OCSP_REQUEST_bio(cbio, NULL);
|
||||
}
|
||||
|
||||
if (req == NULL)
|
||||
log_message(LOG_ERR, "Error parsing OCSP request");
|
||||
|
||||
*preq = req;
|
||||
|
||||
out:
|
||||
# ifdef OCSP_DAEMON
|
||||
if (timeout > 0)
|
||||
alarm(0);
|
||||
acfd = (int)INVALID_SOCKET;
|
||||
# endif
|
||||
return 1;
|
||||
# endif
|
||||
return 0;
|
||||
#endif
|
||||
}
|
||||
|
||||
static int send_ocsp_response(BIO *cbio, OCSP_RESPONSE *resp)
|
||||
static int send_ocsp_response(BIO *cbio, const OCSP_RESPONSE *resp)
|
||||
{
|
||||
char http_resp[] =
|
||||
"HTTP/1.0 200 OK\r\nContent-type: application/ocsp-response\r\n"
|
||||
"Content-Length: %d\r\n\r\n";
|
||||
if (cbio == NULL)
|
||||
return 0;
|
||||
BIO_printf(cbio, http_resp, i2d_OCSP_RESPONSE(resp, NULL));
|
||||
i2d_OCSP_RESPONSE_bio(cbio, resp);
|
||||
(void)BIO_flush(cbio);
|
||||
return 1;
|
||||
#ifndef OPENSSL_NO_SOCK
|
||||
return http_server_send_asn1_resp(cbio, "application/ocsp-response",
|
||||
ASN1_ITEM_rptr(OCSP_RESPONSE),
|
||||
(const ASN1_VALUE *)resp);
|
||||
#else
|
||||
BIO_printf(bio_err,
|
||||
"Error sending OCSP response - sockets not supported\n");
|
||||
return 0;
|
||||
#endif
|
||||
}
|
||||
|
||||
#ifndef OPENSSL_NO_SOCK
|
||||
static OCSP_RESPONSE *query_responder(BIO *cbio, const char *host,
|
||||
const char *path,
|
||||
const STACK_OF(CONF_VALUE) *headers,
|
||||
OCSP_REQUEST *req, int req_timeout)
|
||||
{
|
||||
int fd;
|
||||
int rv;
|
||||
int i;
|
||||
int add_host = 1;
|
||||
OCSP_REQ_CTX *ctx = NULL;
|
||||
OCSP_RESPONSE *rsp = NULL;
|
||||
fd_set confds;
|
||||
struct timeval tv;
|
||||
|
||||
if (req_timeout != -1)
|
||||
BIO_set_nbio(cbio, 1);
|
||||
|
||||
rv = BIO_do_connect(cbio);
|
||||
|
||||
if ((rv <= 0) && ((req_timeout == -1) || !BIO_should_retry(cbio))) {
|
||||
BIO_puts(bio_err, "Error connecting BIO\n");
|
||||
return NULL;
|
||||
}
|
||||
|
||||
if (BIO_get_fd(cbio, &fd) < 0) {
|
||||
BIO_puts(bio_err, "Can't get connection fd\n");
|
||||
goto err;
|
||||
}
|
||||
|
||||
if (req_timeout != -1 && rv <= 0) {
|
||||
FD_ZERO(&confds);
|
||||
openssl_fdset(fd, &confds);
|
||||
tv.tv_usec = 0;
|
||||
tv.tv_sec = req_timeout;
|
||||
rv = select(fd + 1, NULL, (void *)&confds, NULL, &tv);
|
||||
if (rv == 0) {
|
||||
BIO_puts(bio_err, "Timeout on connect\n");
|
||||
return NULL;
|
||||
}
|
||||
}
|
||||
|
||||
ctx = OCSP_sendreq_new(cbio, path, NULL, -1);
|
||||
if (ctx == NULL)
|
||||
return NULL;
|
||||
|
||||
for (i = 0; i < sk_CONF_VALUE_num(headers); i++) {
|
||||
CONF_VALUE *hdr = sk_CONF_VALUE_value(headers, i);
|
||||
if (add_host == 1 && strcasecmp("host", hdr->name) == 0)
|
||||
add_host = 0;
|
||||
if (!OCSP_REQ_CTX_add1_header(ctx, hdr->name, hdr->value))
|
||||
goto err;
|
||||
}
|
||||
|
||||
if (add_host == 1 && OCSP_REQ_CTX_add1_header(ctx, "Host", host) == 0)
|
||||
goto err;
|
||||
|
||||
if (!OCSP_REQ_CTX_set1_req(ctx, req))
|
||||
goto err;
|
||||
|
||||
for (;;) {
|
||||
rv = OCSP_sendreq_nbio(&rsp, ctx);
|
||||
if (rv != -1)
|
||||
break;
|
||||
if (req_timeout == -1)
|
||||
continue;
|
||||
FD_ZERO(&confds);
|
||||
openssl_fdset(fd, &confds);
|
||||
tv.tv_usec = 0;
|
||||
tv.tv_sec = req_timeout;
|
||||
if (BIO_should_read(cbio)) {
|
||||
rv = select(fd + 1, (void *)&confds, NULL, NULL, &tv);
|
||||
} else if (BIO_should_write(cbio)) {
|
||||
rv = select(fd + 1, NULL, (void *)&confds, NULL, &tv);
|
||||
} else {
|
||||
BIO_puts(bio_err, "Unexpected retry condition\n");
|
||||
goto err;
|
||||
}
|
||||
if (rv == 0) {
|
||||
BIO_puts(bio_err, "Timeout on request\n");
|
||||
break;
|
||||
}
|
||||
if (rv == -1) {
|
||||
BIO_puts(bio_err, "Select error\n");
|
||||
break;
|
||||
}
|
||||
|
||||
}
|
||||
err:
|
||||
OCSP_REQ_CTX_free(ctx);
|
||||
|
||||
return rsp;
|
||||
}
|
||||
|
||||
# ifndef OPENSSL_NO_SOCK
|
||||
OCSP_RESPONSE *process_responder(OCSP_REQUEST *req,
|
||||
const char *host, const char *path,
|
||||
const char *port, int use_ssl,
|
||||
STACK_OF(CONF_VALUE) *headers,
|
||||
int req_timeout)
|
||||
{
|
||||
BIO *cbio = NULL;
|
||||
SSL_CTX *ctx = NULL;
|
||||
OCSP_RESPONSE *resp = NULL;
|
||||
|
||||
cbio = BIO_new_connect(host);
|
||||
if (cbio == NULL) {
|
||||
BIO_printf(bio_err, "Error creating connect BIO\n");
|
||||
goto end;
|
||||
}
|
||||
if (port != NULL)
|
||||
BIO_set_conn_port(cbio, port);
|
||||
if (use_ssl == 1) {
|
||||
BIO *sbio;
|
||||
ctx = SSL_CTX_new(TLS_client_method());
|
||||
if (ctx == NULL) {
|
||||
BIO_printf(bio_err, "Error creating SSL context.\n");
|
||||
goto end;
|
||||
}
|
||||
SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
|
||||
sbio = BIO_new_ssl(ctx, 1);
|
||||
cbio = BIO_push(sbio, cbio);
|
||||
}
|
||||
|
||||
resp = (OCSP_RESPONSE *)
|
||||
app_http_post_asn1(host, port, path, NULL, NULL /* no proxy used */,
|
||||
ctx, headers, "application/ocsp-request",
|
||||
(ASN1_VALUE *)req, ASN1_ITEM_rptr(OCSP_REQUEST),
|
||||
req_timeout, ASN1_ITEM_rptr(OCSP_RESPONSE));
|
||||
|
||||
resp = query_responder(cbio, host, path, headers, req, req_timeout);
|
||||
if (resp == NULL)
|
||||
BIO_printf(bio_err, "Error querying OCSP responder\n");
|
||||
|
||||
end:
|
||||
BIO_free_all(cbio);
|
||||
SSL_CTX_free(ctx);
|
||||
return resp;
|
||||
}
|
||||
# endif
|
||||
|
||||
#endif
|
||||
+56
-53
@@ -171,27 +171,9 @@ unstructuredName = An optional company name
|
||||
|
||||
basicConstraints=CA:FALSE
|
||||
|
||||
# Here are some examples of the usage of nsCertType. If it is omitted
|
||||
# the certificate can be used for anything *except* object signing.
|
||||
|
||||
# This is OK for an SSL server.
|
||||
# nsCertType = server
|
||||
|
||||
# For an object signing certificate this would be used.
|
||||
# nsCertType = objsign
|
||||
|
||||
# For normal client use this is typical
|
||||
# nsCertType = client, email
|
||||
|
||||
# and for everything including object signing:
|
||||
# nsCertType = client, email, objsign
|
||||
|
||||
# This is typical in keyUsage for a client certificate.
|
||||
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
# This will be displayed in Netscape's comment listbox.
|
||||
nsComment = "OpenSSL Generated Certificate"
|
||||
|
||||
# PKIX recommendations harmless if included in all certificates.
|
||||
subjectKeyIdentifier=hash
|
||||
authorityKeyIdentifier=keyid,issuer
|
||||
@@ -206,13 +188,6 @@ authorityKeyIdentifier=keyid,issuer
|
||||
# Copy subject details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
|
||||
#nsBaseUrl
|
||||
#nsRevocationUrl
|
||||
#nsRenewalUrl
|
||||
#nsCaPolicyUrl
|
||||
#nsSslServerName
|
||||
|
||||
# This is required for TSA certificates.
|
||||
# extendedKeyUsage = critical,timeStamping
|
||||
|
||||
@@ -242,9 +217,6 @@ basicConstraints = critical,CA:true
|
||||
# left out by default.
|
||||
# keyUsage = cRLSign, keyCertSign
|
||||
|
||||
# Some might want this also
|
||||
# nsCertType = sslCA, emailCA
|
||||
|
||||
# Include email address in subject alt name: another PKIX recommendation
|
||||
# subjectAltName=email:copy
|
||||
# Copy issuer details
|
||||
@@ -272,27 +244,9 @@ authorityKeyIdentifier=keyid:always
|
||||
|
||||
basicConstraints=CA:FALSE
|
||||
|
||||
# Here are some examples of the usage of nsCertType. If it is omitted
|
||||
# the certificate can be used for anything *except* object signing.
|
||||
|
||||
# This is OK for an SSL server.
|
||||
# nsCertType = server
|
||||
|
||||
# For an object signing certificate this would be used.
|
||||
# nsCertType = objsign
|
||||
|
||||
# For normal client use this is typical
|
||||
# nsCertType = client, email
|
||||
|
||||
# and for everything including object signing:
|
||||
# nsCertType = client, email, objsign
|
||||
|
||||
# This is typical in keyUsage for a client certificate.
|
||||
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
# This will be displayed in Netscape's comment listbox.
|
||||
nsComment = "OpenSSL Generated Certificate"
|
||||
|
||||
# PKIX recommendations harmless if included in all certificates.
|
||||
subjectKeyIdentifier=hash
|
||||
authorityKeyIdentifier=keyid,issuer
|
||||
@@ -307,13 +261,6 @@ authorityKeyIdentifier=keyid,issuer
|
||||
# Copy subject details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
|
||||
#nsBaseUrl
|
||||
#nsRevocationUrl
|
||||
#nsRenewalUrl
|
||||
#nsCaPolicyUrl
|
||||
#nsSslServerName
|
||||
|
||||
# This really needs to be in place for it to be a proxy certificate.
|
||||
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
|
||||
|
||||
@@ -348,3 +295,59 @@ ess_cert_id_chain = no # Must the ESS cert id chain be included?
|
||||
# (optional, default: no)
|
||||
ess_cert_id_alg = sha1 # algorithm to compute certificate
|
||||
# identifier (optional, default: sha1)
|
||||
|
||||
[insta] # CMP using Insta Demo CA
|
||||
# Message transfer
|
||||
server = pki.certificate.fi:8700
|
||||
# proxy = # set this as far as needed, e.g., http://192.168.1.1:8080
|
||||
# tls_use = 0
|
||||
path = pkix/
|
||||
|
||||
# Server authentication
|
||||
recipient = "/C=FI/O=Insta Demo/CN=Insta Demo CA" # or set srvcert or issuer
|
||||
ignore_keyusage = 1 # potentially needed quirk
|
||||
unprotected_errors = 1 # potentially needed quirk
|
||||
extracertsout = insta.extracerts.pem
|
||||
|
||||
# Client authentication
|
||||
ref = 3078 # user identification
|
||||
secret = pass:insta # can be used for both client and server side
|
||||
|
||||
# Generic message options
|
||||
cmd = ir # default operation, can be overridden on cmd line with, e.g., kur
|
||||
|
||||
# Certificate enrollment
|
||||
subject = "/CN=openssl-cmp-test"
|
||||
newkey = insta.priv.pem
|
||||
out_trusted = insta.ca.crt
|
||||
certout = insta.cert.pem
|
||||
|
||||
[pbm] # Password-based protection for Insta CA
|
||||
# Server and client authentication
|
||||
ref = $insta::ref # 3078
|
||||
secret = $insta::secret # pass:insta
|
||||
|
||||
[signature] # Signature-based protection for Insta CA
|
||||
# Server authentication
|
||||
trusted = insta.ca.crt # does not include keyUsage digitalSignature
|
||||
|
||||
# Client authentication
|
||||
secret = # disable PBM
|
||||
key = $insta::newkey # insta.priv.pem
|
||||
cert = $insta::certout # insta.cert.pem
|
||||
|
||||
[ir]
|
||||
cmd = ir
|
||||
|
||||
[cr]
|
||||
cmd = cr
|
||||
|
||||
[kur]
|
||||
# Certificate update
|
||||
cmd = kur
|
||||
oldcert = $insta::certout # insta.cert.pem
|
||||
|
||||
[rr]
|
||||
# Certificate revocation
|
||||
cmd = rr
|
||||
oldcert = $insta::certout # insta.cert.pem
|
||||
+28
-115
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -30,9 +30,6 @@
|
||||
#include "apps.h"
|
||||
#include "progs.h"
|
||||
|
||||
/* Special sentinel to exit the program. */
|
||||
#define EXIT_THE_PROGRAM (-1)
|
||||
|
||||
/*
|
||||
* The LHASH callbacks ("hash" & "cmp") have been replaced by functions with
|
||||
* the base prototypes (we cast each variable inside the function to the
|
||||
@@ -47,6 +44,18 @@ BIO *bio_in = NULL;
|
||||
BIO *bio_out = NULL;
|
||||
BIO *bio_err = NULL;
|
||||
|
||||
static void warn_deprecated(const FUNCTION *fp)
|
||||
{
|
||||
if (fp->deprecated_version != NULL)
|
||||
BIO_printf(bio_err, "The command %s was deprecated in version %s.",
|
||||
fp->name, fp->deprecated_version);
|
||||
else
|
||||
BIO_printf(bio_err, "The command %s is deprecated.", fp->name);
|
||||
if (strcmp(fp->deprecated_alternative, DEPRECATED_NO_ALTERNATIVE) != 0)
|
||||
BIO_printf(bio_err, " Use '%s' instead.", fp->deprecated_alternative);
|
||||
BIO_printf(bio_err, "\n");
|
||||
}
|
||||
|
||||
static int apps_startup(void)
|
||||
{
|
||||
#ifdef SIGPIPE
|
||||
@@ -68,27 +77,6 @@ static void apps_shutdown(void)
|
||||
destroy_ui_method();
|
||||
}
|
||||
|
||||
static char *make_config_name(void)
|
||||
{
|
||||
const char *t;
|
||||
size_t len;
|
||||
char *p;
|
||||
|
||||
if ((t = getenv("OPENSSL_CONF")) != NULL)
|
||||
return OPENSSL_strdup(t);
|
||||
|
||||
t = X509_get_default_cert_area();
|
||||
len = strlen(t) + 1 + strlen(OPENSSL_CONF) + 1;
|
||||
p = app_malloc(len, "config filename buffer");
|
||||
strcpy(p, t);
|
||||
#ifndef OPENSSL_SYS_VMS
|
||||
strcat(p, "/");
|
||||
#endif
|
||||
strcat(p, OPENSSL_CONF);
|
||||
|
||||
return p;
|
||||
}
|
||||
|
||||
|
||||
#ifndef OPENSSL_NO_TRACE
|
||||
typedef struct tracedata_st {
|
||||
@@ -221,17 +209,14 @@ int main(int argc, char *argv[])
|
||||
{
|
||||
FUNCTION f, *fp;
|
||||
LHASH_OF(FUNCTION) *prog = NULL;
|
||||
char *p, *pname;
|
||||
char buf[1024];
|
||||
const char *prompt;
|
||||
char *pname;
|
||||
ARGS arg;
|
||||
int first, n, i, ret = 0;
|
||||
int ret = 0;
|
||||
|
||||
arg.argv = NULL;
|
||||
arg.size = 0;
|
||||
|
||||
/* Set up some of the environment. */
|
||||
default_config_file = make_config_name();
|
||||
bio_in = dup_bio_in(FORMAT_TEXT);
|
||||
bio_out = dup_bio_out(FORMAT_TEXT);
|
||||
bio_err = dup_bio_err(FORMAT_TEXT);
|
||||
@@ -249,11 +234,6 @@ int main(int argc, char *argv[])
|
||||
setup_trace(getenv("OPENSSL_TRACE"));
|
||||
#endif
|
||||
|
||||
if (getenv("OPENSSL_FIPS")) {
|
||||
BIO_printf(bio_err, "FIPS mode not supported.\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
if (!apps_startup()) {
|
||||
BIO_printf(bio_err,
|
||||
"FATAL: Startup failure (dev note: apps_startup() failed)\n");
|
||||
@@ -272,91 +252,26 @@ int main(int argc, char *argv[])
|
||||
}
|
||||
pname = opt_progname(argv[0]);
|
||||
|
||||
default_config_file = CONF_get1_default_config_file();
|
||||
if (default_config_file == NULL)
|
||||
app_bail_out("%s: could not get default config file\n", pname);
|
||||
|
||||
/* first check the program name */
|
||||
f.name = pname;
|
||||
fp = lh_FUNCTION_retrieve(prog, &f);
|
||||
if (fp != NULL) {
|
||||
argv[0] = pname;
|
||||
ret = fp->func(argc, argv);
|
||||
goto end;
|
||||
}
|
||||
|
||||
/* If there is stuff on the command line, run with that. */
|
||||
if (argc != 1) {
|
||||
if (fp == NULL) {
|
||||
/* We assume we've been called as 'openssl cmd' */
|
||||
argc--;
|
||||
argv++;
|
||||
ret = do_cmd(prog, argc, argv);
|
||||
if (ret < 0)
|
||||
ret = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
/* ok, lets enter interactive mode */
|
||||
for (;;) {
|
||||
ret = 0;
|
||||
/* Read a line, continue reading if line ends with \ */
|
||||
for (p = buf, n = sizeof(buf), i = 0, first = 1; n > 0; first = 0) {
|
||||
prompt = first ? "OpenSSL> " : "> ";
|
||||
p[0] = '\0';
|
||||
#ifndef READLINE
|
||||
fputs(prompt, stdout);
|
||||
fflush(stdout);
|
||||
if (!fgets(p, n, stdin))
|
||||
goto end;
|
||||
if (p[0] == '\0')
|
||||
goto end;
|
||||
i = strlen(p);
|
||||
if (i <= 1)
|
||||
break;
|
||||
if (p[i - 2] != '\\')
|
||||
break;
|
||||
i -= 2;
|
||||
p += i;
|
||||
n -= i;
|
||||
#else
|
||||
{
|
||||
extern char *readline(const char *);
|
||||
extern void add_history(const char *cp);
|
||||
char *text;
|
||||
/* If there's a command, run with that, otherwise "help". */
|
||||
ret = argc > 0
|
||||
? do_cmd(prog, argc, argv)
|
||||
: help_main(argc, argv);
|
||||
|
||||
text = readline(prompt);
|
||||
if (text == NULL)
|
||||
goto end;
|
||||
i = strlen(text);
|
||||
if (i == 0 || i > n)
|
||||
break;
|
||||
if (text[i - 1] != '\\') {
|
||||
p += strlen(strcpy(p, text));
|
||||
free(text);
|
||||
add_history(buf);
|
||||
break;
|
||||
}
|
||||
|
||||
text[i - 1] = '\0';
|
||||
p += strlen(strcpy(p, text));
|
||||
free(text);
|
||||
n -= i;
|
||||
}
|
||||
#endif
|
||||
}
|
||||
|
||||
if (!chopup_args(&arg, buf)) {
|
||||
BIO_printf(bio_err, "Can't parse (no memory?)\n");
|
||||
break;
|
||||
}
|
||||
|
||||
ret = do_cmd(prog, arg.argc, arg.argv);
|
||||
if (ret == EXIT_THE_PROGRAM) {
|
||||
ret = 0;
|
||||
goto end;
|
||||
}
|
||||
if (ret != 0)
|
||||
BIO_printf(bio_err, "error in %s\n", arg.argv[0]);
|
||||
(void)BIO_flush(bio_out);
|
||||
(void)BIO_flush(bio_err);
|
||||
}
|
||||
ret = 1;
|
||||
end:
|
||||
app_providers_cleanup();
|
||||
OPENSSL_free(default_config_file);
|
||||
lh_FUNCTION_free(prog);
|
||||
OPENSSL_free(arg.argv);
|
||||
@@ -470,6 +385,8 @@ static int do_cmd(LHASH_OF(FUNCTION) *prog, int argc, char *argv[])
|
||||
}
|
||||
}
|
||||
if (fp != NULL) {
|
||||
if (fp->deprecated_alternative != NULL)
|
||||
warn_deprecated(fp);
|
||||
return fp->func(argc, argv);
|
||||
}
|
||||
if ((strncmp(argv[0], "no-", 3)) == 0) {
|
||||
@@ -485,10 +402,6 @@ static int do_cmd(LHASH_OF(FUNCTION) *prog, int argc, char *argv[])
|
||||
BIO_printf(bio_out, "%s\n", argv[0] + 3);
|
||||
return 1;
|
||||
}
|
||||
if (strcmp(argv[0], "quit") == 0 || strcmp(argv[0], "q") == 0 ||
|
||||
strcmp(argv[0], "exit") == 0 || strcmp(argv[0], "bye") == 0)
|
||||
/* Special value to mean "exit the program. */
|
||||
return EXIT_THE_PROGRAM;
|
||||
|
||||
BIO_printf(bio_err, "Invalid command '%s'; type \"help\" for a list.\n",
|
||||
argv[0]);
|
||||
|
||||
+56
-53
@@ -171,27 +171,9 @@ unstructuredName = An optional company name
|
||||
|
||||
basicConstraints=CA:FALSE
|
||||
|
||||
# Here are some examples of the usage of nsCertType. If it is omitted
|
||||
# the certificate can be used for anything *except* object signing.
|
||||
|
||||
# This is OK for an SSL server.
|
||||
# nsCertType = server
|
||||
|
||||
# For an object signing certificate this would be used.
|
||||
# nsCertType = objsign
|
||||
|
||||
# For normal client use this is typical
|
||||
# nsCertType = client, email
|
||||
|
||||
# and for everything including object signing:
|
||||
# nsCertType = client, email, objsign
|
||||
|
||||
# This is typical in keyUsage for a client certificate.
|
||||
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
# This will be displayed in Netscape's comment listbox.
|
||||
nsComment = "OpenSSL Generated Certificate"
|
||||
|
||||
# PKIX recommendations harmless if included in all certificates.
|
||||
subjectKeyIdentifier=hash
|
||||
authorityKeyIdentifier=keyid,issuer
|
||||
@@ -206,13 +188,6 @@ authorityKeyIdentifier=keyid,issuer
|
||||
# Copy subject details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
|
||||
#nsBaseUrl
|
||||
#nsRevocationUrl
|
||||
#nsRenewalUrl
|
||||
#nsCaPolicyUrl
|
||||
#nsSslServerName
|
||||
|
||||
# This is required for TSA certificates.
|
||||
# extendedKeyUsage = critical,timeStamping
|
||||
|
||||
@@ -242,9 +217,6 @@ basicConstraints = critical,CA:true
|
||||
# left out by default.
|
||||
# keyUsage = cRLSign, keyCertSign
|
||||
|
||||
# Some might want this also
|
||||
# nsCertType = sslCA, emailCA
|
||||
|
||||
# Include email address in subject alt name: another PKIX recommendation
|
||||
# subjectAltName=email:copy
|
||||
# Copy issuer details
|
||||
@@ -272,27 +244,9 @@ authorityKeyIdentifier=keyid:always
|
||||
|
||||
basicConstraints=CA:FALSE
|
||||
|
||||
# Here are some examples of the usage of nsCertType. If it is omitted
|
||||
# the certificate can be used for anything *except* object signing.
|
||||
|
||||
# This is OK for an SSL server.
|
||||
# nsCertType = server
|
||||
|
||||
# For an object signing certificate this would be used.
|
||||
# nsCertType = objsign
|
||||
|
||||
# For normal client use this is typical
|
||||
# nsCertType = client, email
|
||||
|
||||
# and for everything including object signing:
|
||||
# nsCertType = client, email, objsign
|
||||
|
||||
# This is typical in keyUsage for a client certificate.
|
||||
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
# This will be displayed in Netscape's comment listbox.
|
||||
nsComment = "OpenSSL Generated Certificate"
|
||||
|
||||
# PKIX recommendations harmless if included in all certificates.
|
||||
subjectKeyIdentifier=hash
|
||||
authorityKeyIdentifier=keyid,issuer
|
||||
@@ -307,13 +261,6 @@ authorityKeyIdentifier=keyid,issuer
|
||||
# Copy subject details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
|
||||
#nsBaseUrl
|
||||
#nsRevocationUrl
|
||||
#nsRenewalUrl
|
||||
#nsCaPolicyUrl
|
||||
#nsSslServerName
|
||||
|
||||
# This really needs to be in place for it to be a proxy certificate.
|
||||
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
|
||||
|
||||
@@ -348,3 +295,59 @@ ess_cert_id_chain = no # Must the ESS cert id chain be included?
|
||||
# (optional, default: no)
|
||||
ess_cert_id_alg = sha1 # algorithm to compute certificate
|
||||
# identifier (optional, default: sha1)
|
||||
|
||||
[insta] # CMP using Insta Demo CA
|
||||
# Message transfer
|
||||
server = pki.certificate.fi:8700
|
||||
# proxy = # set this as far as needed, e.g., http://192.168.1.1:8080
|
||||
# tls_use = 0
|
||||
path = pkix/
|
||||
|
||||
# Server authentication
|
||||
recipient = "/C=FI/O=Insta Demo/CN=Insta Demo CA" # or set srvcert or issuer
|
||||
ignore_keyusage = 1 # potentially needed quirk
|
||||
unprotected_errors = 1 # potentially needed quirk
|
||||
extracertsout = insta.extracerts.pem
|
||||
|
||||
# Client authentication
|
||||
ref = 3078 # user identification
|
||||
secret = pass:insta # can be used for both client and server side
|
||||
|
||||
# Generic message options
|
||||
cmd = ir # default operation, can be overridden on cmd line with, e.g., kur
|
||||
|
||||
# Certificate enrollment
|
||||
subject = "/CN=openssl-cmp-test"
|
||||
newkey = insta.priv.pem
|
||||
out_trusted = insta.ca.crt
|
||||
certout = insta.cert.pem
|
||||
|
||||
[pbm] # Password-based protection for Insta CA
|
||||
# Server and client authentication
|
||||
ref = $insta::ref # 3078
|
||||
secret = $insta::secret # pass:insta
|
||||
|
||||
[signature] # Signature-based protection for Insta CA
|
||||
# Server authentication
|
||||
trusted = insta.ca.crt # does not include keyUsage digitalSignature
|
||||
|
||||
# Client authentication
|
||||
secret = # disable PBM
|
||||
key = $insta::newkey # insta.priv.pem
|
||||
cert = $insta::certout # insta.cert.pem
|
||||
|
||||
[ir]
|
||||
cmd = ir
|
||||
|
||||
[cr]
|
||||
cmd = cr
|
||||
|
||||
[kur]
|
||||
# Certificate update
|
||||
cmd = kur
|
||||
oldcert = $insta::certout # insta.cert.pem
|
||||
|
||||
[rr]
|
||||
# Certificate revocation
|
||||
cmd = rr
|
||||
oldcert = $insta::certout # insta.cert.pem
|
||||
+7
-2
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -58,7 +58,7 @@ typedef enum OPTION_choice {
|
||||
OPT_IN,
|
||||
OPT_NOVERIFY, OPT_QUIET, OPT_TABLE, OPT_REVERSE, OPT_APR1,
|
||||
OPT_1, OPT_5, OPT_6, OPT_CRYPT, OPT_AIXMD5, OPT_SALT, OPT_STDIN,
|
||||
OPT_R_ENUM
|
||||
OPT_R_ENUM, OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS passwd_options[] = {
|
||||
@@ -90,6 +90,7 @@ const OPTIONS passwd_options[] = {
|
||||
#endif
|
||||
|
||||
OPT_R_OPTIONS,
|
||||
OPT_PROV_OPTIONS,
|
||||
|
||||
OPT_PARAMETERS(),
|
||||
{"password", 0, 0, "Password text to digest (optional)"},
|
||||
@@ -191,6 +192,10 @@ int passwd_main(int argc, char **argv)
|
||||
if (!opt_rand(o))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
|
||||
+35
-29
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1999-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1999-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -8,25 +8,28 @@
|
||||
*/
|
||||
|
||||
#include <openssl/opensslconf.h>
|
||||
#if defined(OPENSSL_NO_DES)
|
||||
NON_EMPTY_TRANSLATION_UNIT
|
||||
#else
|
||||
|
||||
# include <stdio.h>
|
||||
# include <stdlib.h>
|
||||
# include <string.h>
|
||||
# include "apps.h"
|
||||
# include "progs.h"
|
||||
# include <openssl/crypto.h>
|
||||
# include <openssl/err.h>
|
||||
# include <openssl/pem.h>
|
||||
# include <openssl/pkcs12.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include "apps.h"
|
||||
#include "progs.h"
|
||||
#include <openssl/crypto.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/pem.h>
|
||||
#include <openssl/pkcs12.h>
|
||||
|
||||
# define NOKEYS 0x1
|
||||
# define NOCERTS 0x2
|
||||
# define INFO 0x4
|
||||
# define CLCERTS 0x8
|
||||
# define CACERTS 0x10
|
||||
DEFINE_STACK_OF(X509)
|
||||
DEFINE_STACK_OF(PKCS7)
|
||||
DEFINE_STACK_OF(PKCS12_SAFEBAG)
|
||||
DEFINE_STACK_OF(X509_ATTRIBUTE)
|
||||
DEFINE_STACK_OF_STRING()
|
||||
|
||||
#define NOKEYS 0x1
|
||||
#define NOCERTS 0x2
|
||||
#define INFO 0x4
|
||||
#define CLCERTS 0x8
|
||||
#define CACERTS 0x10
|
||||
|
||||
#define PASSWD_BUF_SIZE 2048
|
||||
|
||||
@@ -58,15 +61,15 @@ typedef enum OPTION_choice {
|
||||
OPT_INKEY, OPT_CERTFILE, OPT_NAME, OPT_CSP, OPT_CANAME,
|
||||
OPT_IN, OPT_OUT, OPT_PASSIN, OPT_PASSOUT, OPT_PASSWORD, OPT_CAPATH,
|
||||
OPT_CAFILE, OPT_CASTORE, OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE, OPT_ENGINE,
|
||||
OPT_R_ENUM
|
||||
OPT_R_ENUM, OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS pkcs12_options[] = {
|
||||
OPT_SECTION("General"),
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
# ifndef OPENSSL_NO_ENGINE
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
{"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
|
||||
# endif
|
||||
#endif
|
||||
|
||||
OPT_SECTION("CA"),
|
||||
{"CApath", OPT_CAPATH, '/', "PEM-format directory of CA's"},
|
||||
@@ -112,15 +115,15 @@ const OPTIONS pkcs12_options[] = {
|
||||
{"keysig", OPT_KEYSIG, '-', "Set MS key signature type"},
|
||||
|
||||
OPT_SECTION("Encryption"),
|
||||
# ifndef OPENSSL_NO_RC2
|
||||
#ifndef OPENSSL_NO_RC2
|
||||
{"descert", OPT_DESCERT, '-',
|
||||
"Encrypt output with 3DES (default RC2-40)"},
|
||||
{"certpbe", OPT_CERTPBE, 's',
|
||||
"Certificate PBE algorithm (default RC2-40)"},
|
||||
# else
|
||||
#else
|
||||
{"descert", OPT_DESCERT, '-', "Encrypt output with 3DES (the default)"},
|
||||
{"certpbe", OPT_CERTPBE, 's', "Certificate PBE algorithm (default 3DES)"},
|
||||
# endif
|
||||
#endif
|
||||
{"iter", OPT_ITER, 'p', "Specify the iteration count for encryption key and MAC"},
|
||||
{"noiter", OPT_NOITER, '-', "Don't use encryption key iteration"},
|
||||
{"maciter", OPT_MACITER, '-', "Unused, kept for backwards compatibility"},
|
||||
@@ -130,6 +133,7 @@ const OPTIONS pkcs12_options[] = {
|
||||
{"", OPT_CIPHER, '-', "Any supported cipher"},
|
||||
|
||||
OPT_R_OPTIONS,
|
||||
OPT_PROV_OPTIONS,
|
||||
{NULL}
|
||||
};
|
||||
|
||||
@@ -140,11 +144,11 @@ int pkcs12_main(int argc, char **argv)
|
||||
char pass[PASSWD_BUF_SIZE] = "", macpass[PASSWD_BUF_SIZE] = "";
|
||||
int export_cert = 0, options = 0, chain = 0, twopass = 0, keytype = 0;
|
||||
int iter = PKCS12_DEFAULT_ITER, maciter = PKCS12_DEFAULT_ITER;
|
||||
# ifndef OPENSSL_NO_RC2
|
||||
#ifndef OPENSSL_NO_RC2
|
||||
int cert_pbe = NID_pbe_WithSHA1And40BitRC2_CBC;
|
||||
# else
|
||||
#else
|
||||
int cert_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
|
||||
# endif
|
||||
#endif
|
||||
int key_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
|
||||
int ret = 1, macver = 1, add_lmk = 0, private = 0;
|
||||
int noprompt = 0;
|
||||
@@ -307,6 +311,10 @@ int pkcs12_main(int argc, char **argv)
|
||||
case OPT_ENGINE:
|
||||
e = setup_engine(opt_arg(), 0);
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
@@ -1003,5 +1011,3 @@ static int set_pbe(int *ppbe, const char *str)
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
#endif
|
||||
+12
-2
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -20,10 +20,14 @@
|
||||
#include <openssl/pkcs7.h>
|
||||
#include <openssl/pem.h>
|
||||
|
||||
DEFINE_STACK_OF(X509)
|
||||
DEFINE_STACK_OF(X509_CRL)
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_NOOUT,
|
||||
OPT_TEXT, OPT_PRINT, OPT_PRINT_CERTS, OPT_ENGINE
|
||||
OPT_TEXT, OPT_PRINT, OPT_PRINT_CERTS, OPT_ENGINE,
|
||||
OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS pkcs7_options[] = {
|
||||
@@ -45,6 +49,8 @@ const OPTIONS pkcs7_options[] = {
|
||||
{"print", OPT_PRINT, '-', "Print out all fields of the PKCS7 structure"},
|
||||
{"print_certs", OPT_PRINT_CERTS, '-',
|
||||
"Print_certs print any certs or crl in the input"},
|
||||
|
||||
OPT_PROV_OPTIONS,
|
||||
{NULL}
|
||||
};
|
||||
|
||||
@@ -99,6 +105,10 @@ int pkcs7_main(int argc, char **argv)
|
||||
case OPT_ENGINE:
|
||||
e = setup_engine(opt_arg(), 0);
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
|
||||
+7
-2
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1999-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1999-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -26,7 +26,7 @@ typedef enum OPTION_choice {
|
||||
#endif
|
||||
OPT_V2, OPT_V1, OPT_V2PRF, OPT_ITER, OPT_PASSIN, OPT_PASSOUT,
|
||||
OPT_TRADITIONAL,
|
||||
OPT_R_ENUM
|
||||
OPT_R_ENUM, OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS pkcs8_options[] = {
|
||||
@@ -63,6 +63,7 @@ const OPTIONS pkcs8_options[] = {
|
||||
#endif
|
||||
|
||||
OPT_R_OPTIONS,
|
||||
OPT_PROV_OPTIONS,
|
||||
{NULL}
|
||||
};
|
||||
|
||||
@@ -127,6 +128,10 @@ int pkcs8_main(int argc, char **argv)
|
||||
if (!opt_rand(o))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_TRADITIONAL:
|
||||
traditional = 1;
|
||||
break;
|
||||
|
||||
+76
-3
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -15,11 +15,30 @@
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/evp.h>
|
||||
|
||||
#ifndef OPENSSL_NO_EC
|
||||
# include <openssl/ec.h>
|
||||
|
||||
static OPT_PAIR ec_conv_forms[] = {
|
||||
{"compressed", POINT_CONVERSION_COMPRESSED},
|
||||
{"uncompressed", POINT_CONVERSION_UNCOMPRESSED},
|
||||
{"hybrid", POINT_CONVERSION_HYBRID},
|
||||
{NULL}
|
||||
};
|
||||
|
||||
static OPT_PAIR ec_param_enc[] = {
|
||||
{"named_curve", OPENSSL_EC_NAMED_CURVE},
|
||||
{"explicit", 0},
|
||||
{NULL}
|
||||
};
|
||||
#endif
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_INFORM, OPT_OUTFORM, OPT_PASSIN, OPT_PASSOUT, OPT_ENGINE,
|
||||
OPT_IN, OPT_OUT, OPT_PUBIN, OPT_PUBOUT, OPT_TEXT_PUB,
|
||||
OPT_TEXT, OPT_NOOUT, OPT_MD, OPT_TRADITIONAL, OPT_CHECK, OPT_PUB_CHECK
|
||||
OPT_TEXT, OPT_NOOUT, OPT_MD, OPT_TRADITIONAL, OPT_CHECK, OPT_PUB_CHECK,
|
||||
OPT_EC_PARAM_ENC, OPT_EC_CONV_FORM,
|
||||
OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS pkey_options[] = {
|
||||
@@ -31,10 +50,14 @@ const OPTIONS pkey_options[] = {
|
||||
{"check", OPT_CHECK, '-', "Check key consistency"},
|
||||
{"pubcheck", OPT_PUB_CHECK, '-', "Check public key consistency"},
|
||||
{"", OPT_MD, '-', "Any supported cipher"},
|
||||
{"ec_param_enc", OPT_EC_PARAM_ENC, 's',
|
||||
"Specifies the way the ec parameters are encoded"},
|
||||
{"ec_conv_form", OPT_EC_CONV_FORM, 's',
|
||||
"Specifies the point conversion form "},
|
||||
|
||||
OPT_SECTION("Input"),
|
||||
{"in", OPT_IN, 's', "Input key"},
|
||||
{"inform", OPT_INFORM, 'f', "Input format (DER or PEM)"},
|
||||
{"inform", OPT_INFORM, 'f', "Input format (DER/PEM/P12/ENGINE)"},
|
||||
{"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
|
||||
{"pubin", OPT_PUBIN, '-',
|
||||
"Read public key from input (default is private key)"},
|
||||
@@ -50,6 +73,7 @@ const OPTIONS pkey_options[] = {
|
||||
{"text", OPT_TEXT, '-', "Output in plaintext as well"},
|
||||
{"noout", OPT_NOOUT, '-', "Don't output the key"},
|
||||
|
||||
OPT_PROV_OPTIONS,
|
||||
{NULL}
|
||||
};
|
||||
|
||||
@@ -65,6 +89,12 @@ int pkey_main(int argc, char **argv)
|
||||
int informat = FORMAT_PEM, outformat = FORMAT_PEM;
|
||||
int pubin = 0, pubout = 0, pubtext = 0, text = 0, noout = 0, ret = 1;
|
||||
int private = 0, traditional = 0, check = 0, pub_check = 0;
|
||||
#ifndef OPENSSL_NO_EC
|
||||
EC_KEY *eckey;
|
||||
int ec_asn1_flag = OPENSSL_EC_NAMED_CURVE, new_ec_asn1_flag = 0;
|
||||
int i, new_ec_form = 0;
|
||||
point_conversion_form_t ec_form = POINT_CONVERSION_UNCOMPRESSED;
|
||||
#endif
|
||||
|
||||
prog = opt_init(argc, argv, pkey_options);
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
@@ -128,6 +158,31 @@ int pkey_main(int argc, char **argv)
|
||||
case OPT_MD:
|
||||
if (!opt_cipher(opt_unknown(), &cipher))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_EC_CONV_FORM:
|
||||
#ifdef OPENSSL_NO_EC
|
||||
goto opthelp;
|
||||
#else
|
||||
if (!opt_pair(opt_arg(), ec_conv_forms, &i))
|
||||
goto opthelp;
|
||||
new_ec_form = 1;
|
||||
ec_form = i;
|
||||
break;
|
||||
#endif
|
||||
case OPT_EC_PARAM_ENC:
|
||||
#ifdef OPENSSL_NO_EC
|
||||
goto opthelp;
|
||||
#else
|
||||
if (!opt_pair(opt_arg(), ec_param_enc, &i))
|
||||
goto opthelp;
|
||||
new_ec_asn1_flag = 1;
|
||||
ec_asn1_flag = i;
|
||||
break;
|
||||
#endif
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
@@ -154,6 +209,24 @@ int pkey_main(int argc, char **argv)
|
||||
if (pkey == NULL)
|
||||
goto end;
|
||||
|
||||
#ifndef OPENSSL_NO_EC
|
||||
/*
|
||||
* TODO: remove this and use a set params call with a 'pkeyopt' command
|
||||
* line option instead.
|
||||
*/
|
||||
if (new_ec_form || new_ec_asn1_flag) {
|
||||
if ((eckey = EVP_PKEY_get0_EC_KEY(pkey)) == NULL) {
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
if (new_ec_form)
|
||||
EC_KEY_set_conv_form(eckey, ec_form);
|
||||
|
||||
if (new_ec_asn1_flag)
|
||||
EC_KEY_set_asn1_flag(eckey, ec_asn1_flag);
|
||||
}
|
||||
#endif
|
||||
|
||||
if (check || pub_check) {
|
||||
int r;
|
||||
EVP_PKEY_CTX *ctx;
|
||||
|
||||
+16
-10
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -9,6 +9,7 @@
|
||||
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
#include "apps.h"
|
||||
#include "progs.h"
|
||||
#include <openssl/pem.h>
|
||||
@@ -18,7 +19,8 @@
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_IN, OPT_OUT, OPT_TEXT, OPT_NOOUT,
|
||||
OPT_ENGINE, OPT_CHECK
|
||||
OPT_ENGINE, OPT_CHECK,
|
||||
OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS pkeyparam_options[] = {
|
||||
@@ -36,6 +38,8 @@ const OPTIONS pkeyparam_options[] = {
|
||||
{"out", OPT_OUT, '>', "Output file"},
|
||||
{"text", OPT_TEXT, '-', "Print parameters as text"},
|
||||
{"noout", OPT_NOOUT, '-', "Don't output encoded parameters"},
|
||||
|
||||
OPT_PROV_OPTIONS,
|
||||
{NULL}
|
||||
};
|
||||
|
||||
@@ -44,9 +48,11 @@ int pkeyparam_main(int argc, char **argv)
|
||||
ENGINE *e = NULL;
|
||||
BIO *in = NULL, *out = NULL;
|
||||
EVP_PKEY *pkey = NULL;
|
||||
int text = 0, noout = 0, ret = 1, check = 0;
|
||||
EVP_PKEY_CTX *ctx = NULL;
|
||||
int text = 0, noout = 0, ret = EXIT_FAILURE, check = 0, r;
|
||||
OPTION_CHOICE o;
|
||||
char *infile = NULL, *outfile = NULL, *prog;
|
||||
unsigned long err;
|
||||
|
||||
prog = opt_init(argc, argv, pkeyparam_options);
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
@@ -78,6 +84,10 @@ int pkeyparam_main(int argc, char **argv)
|
||||
case OPT_CHECK:
|
||||
check = 1;
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
@@ -98,9 +108,6 @@ int pkeyparam_main(int argc, char **argv)
|
||||
}
|
||||
|
||||
if (check) {
|
||||
int r;
|
||||
EVP_PKEY_CTX *ctx;
|
||||
|
||||
ctx = EVP_PKEY_CTX_new(pkey, e);
|
||||
if (ctx == NULL) {
|
||||
ERR_print_errors(bio_err);
|
||||
@@ -116,8 +123,6 @@ int pkeyparam_main(int argc, char **argv)
|
||||
* Note: at least for RSA keys if this function returns
|
||||
* -1, there will be no error reasons.
|
||||
*/
|
||||
unsigned long err;
|
||||
|
||||
BIO_printf(out, "Parameters are invalid\n");
|
||||
|
||||
while ((err = ERR_peek_error()) != 0) {
|
||||
@@ -125,8 +130,8 @@ int pkeyparam_main(int argc, char **argv)
|
||||
ERR_reason_error_string(err));
|
||||
ERR_get_error(); /* remove err from error stack */
|
||||
}
|
||||
goto end;
|
||||
}
|
||||
EVP_PKEY_CTX_free(ctx);
|
||||
}
|
||||
|
||||
if (!noout)
|
||||
@@ -135,9 +140,10 @@ int pkeyparam_main(int argc, char **argv)
|
||||
if (text)
|
||||
EVP_PKEY_print_params(out, pkey, 0, NULL);
|
||||
|
||||
ret = 0;
|
||||
ret = EXIT_SUCCESS;
|
||||
|
||||
end:
|
||||
EVP_PKEY_CTX_free(ctx);
|
||||
EVP_PKEY_free(pkey);
|
||||
release_engine(e);
|
||||
BIO_free_all(out);
|
||||
|
||||
+14
-22
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -15,6 +15,8 @@
|
||||
#include <openssl/evp.h>
|
||||
#include <sys/stat.h>
|
||||
|
||||
DEFINE_STACK_OF_STRING()
|
||||
|
||||
#define KEY_NONE 0
|
||||
#define KEY_PRIVKEY 1
|
||||
#define KEY_PUBKEY 2
|
||||
@@ -44,7 +46,7 @@ typedef enum OPTION_choice {
|
||||
OPT_VERIFY, OPT_VERIFYRECOVER, OPT_REV, OPT_ENCRYPT, OPT_DECRYPT,
|
||||
OPT_DERIVE, OPT_SIGFILE, OPT_INKEY, OPT_PEERKEY, OPT_PASSIN,
|
||||
OPT_PEERFORM, OPT_KEYFORM, OPT_PKEYOPT, OPT_PKEYOPT_PASSIN, OPT_KDF,
|
||||
OPT_KDFLEN, OPT_R_ENUM,
|
||||
OPT_KDFLEN, OPT_R_ENUM, OPT_PROV_ENUM,
|
||||
OPT_RAWIN, OPT_DIGEST
|
||||
} OPTION_CHOICE;
|
||||
|
||||
@@ -69,11 +71,11 @@ const OPTIONS pkeyutl_options[] = {
|
||||
{"inkey", OPT_INKEY, 's', "Input private key file"},
|
||||
{"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
|
||||
{"peerkey", OPT_PEERKEY, 's', "Peer key file used in key derivation"},
|
||||
{"peerform", OPT_PEERFORM, 'E', "Peer key format - default PEM"},
|
||||
{"peerform", OPT_PEERFORM, 'E', "Peer key format (DER/PEM/P12/ENGINE)"},
|
||||
{"certin", OPT_CERTIN, '-', "Input is a cert with a public key"},
|
||||
{"rev", OPT_REV, '-', "Reverse the order of the input buffer"},
|
||||
{"sigfile", OPT_SIGFILE, '<', "Signature file (verify operation only)"},
|
||||
{"keyform", OPT_KEYFORM, 'E', "Private key format - default PEM"},
|
||||
{"keyform", OPT_KEYFORM, 'E', "Private key format (ENGINE, other values ignored)"},
|
||||
|
||||
OPT_SECTION("Output"),
|
||||
{"out", OPT_OUT, '>', "Output file - default stdout"},
|
||||
@@ -92,6 +94,7 @@ const OPTIONS pkeyutl_options[] = {
|
||||
{"kdflen", OPT_KDFLEN, 'p', "KDF algorithm output length"},
|
||||
|
||||
OPT_R_OPTIONS,
|
||||
OPT_PROV_OPTIONS,
|
||||
{NULL}
|
||||
};
|
||||
|
||||
@@ -154,17 +157,21 @@ int pkeyutl_main(int argc, char **argv)
|
||||
passinarg = opt_arg();
|
||||
break;
|
||||
case OPT_PEERFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_PDE, &peerform))
|
||||
if (!opt_format(opt_arg(), OPT_FMT_ANY, &peerform))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_KEYFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_PDE, &keyform))
|
||||
if (!opt_format(opt_arg(), OPT_FMT_ANY, &keyform))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_R_CASES:
|
||||
if (!opt_rand(o))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_ENGINE:
|
||||
e = setup_engine(opt_arg(), 0);
|
||||
break;
|
||||
@@ -512,7 +519,7 @@ static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
|
||||
break;
|
||||
|
||||
case KEY_CERT:
|
||||
x = load_cert(keyfile, keyform, "Certificate");
|
||||
x = load_cert(keyfile, FORMAT_UNDEF, "Certificate");
|
||||
if (x) {
|
||||
pkey = X509_get_pubkey(x);
|
||||
X509_free(x);
|
||||
@@ -545,21 +552,6 @@ static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
|
||||
if (pkey == NULL)
|
||||
goto end;
|
||||
|
||||
#ifndef OPENSSL_NO_EC
|
||||
/* SM2 needs a special treatment */
|
||||
if (EVP_PKEY_id(pkey) == EVP_PKEY_EC) {
|
||||
EC_KEY *eckey = NULL;
|
||||
const EC_GROUP *group = NULL;
|
||||
int nid;
|
||||
|
||||
if ((eckey = EVP_PKEY_get0_EC_KEY(pkey)) == NULL
|
||||
|| (group = EC_KEY_get0_group(eckey)) == NULL
|
||||
|| (nid = EC_GROUP_get_curve_name(group)) == 0)
|
||||
goto end;
|
||||
if (nid == NID_sm2)
|
||||
EVP_PKEY_set_alias_type(pkey, EVP_PKEY_SM2);
|
||||
}
|
||||
#endif
|
||||
*pkeysize = EVP_PKEY_size(pkey);
|
||||
ctx = EVP_PKEY_CTX_new(pkey, impl);
|
||||
if (ppkey != NULL)
|
||||
|
||||
+9
-2
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 2004-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2004-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -15,7 +15,8 @@
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_HEX, OPT_GENERATE, OPT_BITS, OPT_SAFE, OPT_CHECKS
|
||||
OPT_HEX, OPT_GENERATE, OPT_BITS, OPT_SAFE, OPT_CHECKS,
|
||||
OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS prime_options[] = {
|
||||
@@ -32,6 +33,8 @@ const OPTIONS prime_options[] = {
|
||||
{"safe", OPT_SAFE, '-',
|
||||
"When used with -generate, generate a safe prime"},
|
||||
|
||||
OPT_PROV_OPTIONS,
|
||||
|
||||
OPT_PARAMETERS(),
|
||||
{"number", 0, 0, "Number(s) to check for primality if not generating"},
|
||||
{NULL}
|
||||
@@ -72,6 +75,10 @@ opthelp:
|
||||
/* ignore parameter and argument */
|
||||
opt_arg();
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
|
||||
-400
@@ -1,400 +0,0 @@
|
||||
/*
|
||||
* WARNING: do not edit!
|
||||
* Generated by apps/progs.pl
|
||||
*
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include "progs.h"
|
||||
|
||||
FUNCTION functions[] = {
|
||||
{FT_general, "asn1parse", asn1parse_main, asn1parse_options},
|
||||
{FT_general, "ca", ca_main, ca_options},
|
||||
#ifndef OPENSSL_NO_SOCK
|
||||
{FT_general, "ciphers", ciphers_main, ciphers_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_CMS
|
||||
{FT_general, "cms", cms_main, cms_options},
|
||||
#endif
|
||||
{FT_general, "crl", crl_main, crl_options},
|
||||
{FT_general, "crl2pkcs7", crl2pkcs7_main, crl2pkcs7_options},
|
||||
{FT_general, "dgst", dgst_main, dgst_options},
|
||||
#ifndef OPENSSL_NO_DH
|
||||
{FT_general, "dhparam", dhparam_main, dhparam_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_DSA
|
||||
{FT_general, "dsa", dsa_main, dsa_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_DSA
|
||||
{FT_general, "dsaparam", dsaparam_main, dsaparam_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_EC
|
||||
{FT_general, "ec", ec_main, ec_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_EC
|
||||
{FT_general, "ecparam", ecparam_main, ecparam_options},
|
||||
#endif
|
||||
{FT_general, "enc", enc_main, enc_options},
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
{FT_general, "engine", engine_main, engine_options},
|
||||
#endif
|
||||
{FT_general, "errstr", errstr_main, errstr_options},
|
||||
{FT_general, "fipsinstall", fipsinstall_main, fipsinstall_options},
|
||||
#ifndef OPENSSL_NO_DSA
|
||||
{FT_general, "gendsa", gendsa_main, gendsa_options},
|
||||
#endif
|
||||
{FT_general, "genpkey", genpkey_main, genpkey_options},
|
||||
#ifndef OPENSSL_NO_RSA
|
||||
{FT_general, "genrsa", genrsa_main, genrsa_options},
|
||||
#endif
|
||||
{FT_general, "help", help_main, help_options},
|
||||
{FT_general, "info", info_main, info_options},
|
||||
{FT_general, "kdf", kdf_main, kdf_options},
|
||||
{FT_general, "list", list_main, list_options},
|
||||
{FT_general, "mac", mac_main, mac_options},
|
||||
{FT_general, "nseq", nseq_main, nseq_options},
|
||||
#ifndef OPENSSL_NO_OCSP
|
||||
{FT_general, "ocsp", ocsp_main, ocsp_options},
|
||||
#endif
|
||||
{FT_general, "passwd", passwd_main, passwd_options},
|
||||
#ifndef OPENSSL_NO_DES
|
||||
{FT_general, "pkcs12", pkcs12_main, pkcs12_options},
|
||||
#endif
|
||||
{FT_general, "pkcs7", pkcs7_main, pkcs7_options},
|
||||
{FT_general, "pkcs8", pkcs8_main, pkcs8_options},
|
||||
{FT_general, "pkey", pkey_main, pkey_options},
|
||||
{FT_general, "pkeyparam", pkeyparam_main, pkeyparam_options},
|
||||
{FT_general, "pkeyutl", pkeyutl_main, pkeyutl_options},
|
||||
{FT_general, "prime", prime_main, prime_options},
|
||||
{FT_general, "provider", provider_main, provider_options},
|
||||
{FT_general, "rand", rand_main, rand_options},
|
||||
{FT_general, "rehash", rehash_main, rehash_options},
|
||||
{FT_general, "req", req_main, req_options},
|
||||
{FT_general, "rsa", rsa_main, rsa_options},
|
||||
#ifndef OPENSSL_NO_RSA
|
||||
{FT_general, "rsautl", rsautl_main, rsautl_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_SOCK
|
||||
{FT_general, "s_client", s_client_main, s_client_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_SOCK
|
||||
{FT_general, "s_server", s_server_main, s_server_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_SOCK
|
||||
{FT_general, "s_time", s_time_main, s_time_options},
|
||||
#endif
|
||||
{FT_general, "sess_id", sess_id_main, sess_id_options},
|
||||
{FT_general, "smime", smime_main, smime_options},
|
||||
{FT_general, "speed", speed_main, speed_options},
|
||||
{FT_general, "spkac", spkac_main, spkac_options},
|
||||
#ifndef OPENSSL_NO_SRP
|
||||
{FT_general, "srp", srp_main, srp_options},
|
||||
#endif
|
||||
{FT_general, "storeutl", storeutl_main, storeutl_options},
|
||||
#ifndef OPENSSL_NO_TS
|
||||
{FT_general, "ts", ts_main, ts_options},
|
||||
#endif
|
||||
{FT_general, "verify", verify_main, verify_options},
|
||||
{FT_general, "version", version_main, version_options},
|
||||
{FT_general, "x509", x509_main, x509_options},
|
||||
#ifndef OPENSSL_NO_MD2
|
||||
{FT_md, "md2", dgst_main},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_MD4
|
||||
{FT_md, "md4", dgst_main},
|
||||
#endif
|
||||
{FT_md, "md5", dgst_main},
|
||||
#ifndef OPENSSL_NO_GOST
|
||||
{FT_md, "gost", dgst_main},
|
||||
#endif
|
||||
{FT_md, "sha1", dgst_main},
|
||||
{FT_md, "sha224", dgst_main},
|
||||
{FT_md, "sha256", dgst_main},
|
||||
{FT_md, "sha384", dgst_main},
|
||||
{FT_md, "sha512", dgst_main},
|
||||
{FT_md, "sha512-224", dgst_main},
|
||||
{FT_md, "sha512-256", dgst_main},
|
||||
{FT_md, "sha3-224", dgst_main},
|
||||
{FT_md, "sha3-256", dgst_main},
|
||||
{FT_md, "sha3-384", dgst_main},
|
||||
{FT_md, "sha3-512", dgst_main},
|
||||
{FT_md, "shake128", dgst_main},
|
||||
{FT_md, "shake256", dgst_main},
|
||||
#ifndef OPENSSL_NO_MDC2
|
||||
{FT_md, "mdc2", dgst_main},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_RMD160
|
||||
{FT_md, "rmd160", dgst_main},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_BLAKE2
|
||||
{FT_md, "blake2b512", dgst_main},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_BLAKE2
|
||||
{FT_md, "blake2s256", dgst_main},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_SM3
|
||||
{FT_md, "sm3", dgst_main},
|
||||
#endif
|
||||
{FT_cipher, "aes-128-cbc", enc_main, enc_options},
|
||||
{FT_cipher, "aes-128-ecb", enc_main, enc_options},
|
||||
{FT_cipher, "aes-192-cbc", enc_main, enc_options},
|
||||
{FT_cipher, "aes-192-ecb", enc_main, enc_options},
|
||||
{FT_cipher, "aes-256-cbc", enc_main, enc_options},
|
||||
{FT_cipher, "aes-256-ecb", enc_main, enc_options},
|
||||
#ifndef OPENSSL_NO_ARIA
|
||||
{FT_cipher, "aria-128-cbc", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_ARIA
|
||||
{FT_cipher, "aria-128-cfb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_ARIA
|
||||
{FT_cipher, "aria-128-ctr", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_ARIA
|
||||
{FT_cipher, "aria-128-ecb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_ARIA
|
||||
{FT_cipher, "aria-128-ofb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_ARIA
|
||||
{FT_cipher, "aria-128-cfb1", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_ARIA
|
||||
{FT_cipher, "aria-128-cfb8", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_ARIA
|
||||
{FT_cipher, "aria-192-cbc", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_ARIA
|
||||
{FT_cipher, "aria-192-cfb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_ARIA
|
||||
{FT_cipher, "aria-192-ctr", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_ARIA
|
||||
{FT_cipher, "aria-192-ecb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_ARIA
|
||||
{FT_cipher, "aria-192-ofb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_ARIA
|
||||
{FT_cipher, "aria-192-cfb1", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_ARIA
|
||||
{FT_cipher, "aria-192-cfb8", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_ARIA
|
||||
{FT_cipher, "aria-256-cbc", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_ARIA
|
||||
{FT_cipher, "aria-256-cfb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_ARIA
|
||||
{FT_cipher, "aria-256-ctr", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_ARIA
|
||||
{FT_cipher, "aria-256-ecb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_ARIA
|
||||
{FT_cipher, "aria-256-ofb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_ARIA
|
||||
{FT_cipher, "aria-256-cfb1", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_ARIA
|
||||
{FT_cipher, "aria-256-cfb8", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_CAMELLIA
|
||||
{FT_cipher, "camellia-128-cbc", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_CAMELLIA
|
||||
{FT_cipher, "camellia-128-ecb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_CAMELLIA
|
||||
{FT_cipher, "camellia-192-cbc", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_CAMELLIA
|
||||
{FT_cipher, "camellia-192-ecb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_CAMELLIA
|
||||
{FT_cipher, "camellia-256-cbc", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_CAMELLIA
|
||||
{FT_cipher, "camellia-256-ecb", enc_main, enc_options},
|
||||
#endif
|
||||
{FT_cipher, "base64", enc_main, enc_options},
|
||||
#ifdef ZLIB
|
||||
{FT_cipher, "zlib", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_DES
|
||||
{FT_cipher, "des", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_DES
|
||||
{FT_cipher, "des3", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_DES
|
||||
{FT_cipher, "desx", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_IDEA
|
||||
{FT_cipher, "idea", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_SEED
|
||||
{FT_cipher, "seed", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_RC4
|
||||
{FT_cipher, "rc4", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_RC4
|
||||
{FT_cipher, "rc4-40", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_RC2
|
||||
{FT_cipher, "rc2", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_BF
|
||||
{FT_cipher, "bf", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_CAST
|
||||
{FT_cipher, "cast", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_RC5
|
||||
{FT_cipher, "rc5", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_DES
|
||||
{FT_cipher, "des-ecb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_DES
|
||||
{FT_cipher, "des-ede", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_DES
|
||||
{FT_cipher, "des-ede3", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_DES
|
||||
{FT_cipher, "des-cbc", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_DES
|
||||
{FT_cipher, "des-ede-cbc", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_DES
|
||||
{FT_cipher, "des-ede3-cbc", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_DES
|
||||
{FT_cipher, "des-cfb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_DES
|
||||
{FT_cipher, "des-ede-cfb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_DES
|
||||
{FT_cipher, "des-ede3-cfb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_DES
|
||||
{FT_cipher, "des-ofb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_DES
|
||||
{FT_cipher, "des-ede-ofb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_DES
|
||||
{FT_cipher, "des-ede3-ofb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_IDEA
|
||||
{FT_cipher, "idea-cbc", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_IDEA
|
||||
{FT_cipher, "idea-ecb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_IDEA
|
||||
{FT_cipher, "idea-cfb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_IDEA
|
||||
{FT_cipher, "idea-ofb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_SEED
|
||||
{FT_cipher, "seed-cbc", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_SEED
|
||||
{FT_cipher, "seed-ecb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_SEED
|
||||
{FT_cipher, "seed-cfb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_SEED
|
||||
{FT_cipher, "seed-ofb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_RC2
|
||||
{FT_cipher, "rc2-cbc", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_RC2
|
||||
{FT_cipher, "rc2-ecb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_RC2
|
||||
{FT_cipher, "rc2-cfb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_RC2
|
||||
{FT_cipher, "rc2-ofb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_RC2
|
||||
{FT_cipher, "rc2-64-cbc", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_RC2
|
||||
{FT_cipher, "rc2-40-cbc", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_BF
|
||||
{FT_cipher, "bf-cbc", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_BF
|
||||
{FT_cipher, "bf-ecb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_BF
|
||||
{FT_cipher, "bf-cfb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_BF
|
||||
{FT_cipher, "bf-ofb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_CAST
|
||||
{FT_cipher, "cast5-cbc", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_CAST
|
||||
{FT_cipher, "cast5-ecb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_CAST
|
||||
{FT_cipher, "cast5-cfb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_CAST
|
||||
{FT_cipher, "cast5-ofb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_CAST
|
||||
{FT_cipher, "cast-cbc", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_RC5
|
||||
{FT_cipher, "rc5-cbc", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_RC5
|
||||
{FT_cipher, "rc5-ecb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_RC5
|
||||
{FT_cipher, "rc5-cfb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_RC5
|
||||
{FT_cipher, "rc5-ofb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_SM4
|
||||
{FT_cipher, "sm4-cbc", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_SM4
|
||||
{FT_cipher, "sm4-ecb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_SM4
|
||||
{FT_cipher, "sm4-cfb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_SM4
|
||||
{FT_cipher, "sm4-ofb", enc_main, enc_options},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_SM4
|
||||
{FT_cipher, "sm4-ctr", enc_main, enc_options},
|
||||
#endif
|
||||
{0, NULL, NULL}
|
||||
};
|
||||
-123
@@ -1,123 +0,0 @@
|
||||
/*
|
||||
* WARNING: do not edit!
|
||||
* Generated by apps/progs.pl
|
||||
*
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include "function.h"
|
||||
|
||||
extern int asn1parse_main(int argc, char *argv[]);
|
||||
extern int ca_main(int argc, char *argv[]);
|
||||
extern int ciphers_main(int argc, char *argv[]);
|
||||
extern int cms_main(int argc, char *argv[]);
|
||||
extern int crl_main(int argc, char *argv[]);
|
||||
extern int crl2pkcs7_main(int argc, char *argv[]);
|
||||
extern int dgst_main(int argc, char *argv[]);
|
||||
extern int dhparam_main(int argc, char *argv[]);
|
||||
extern int dsa_main(int argc, char *argv[]);
|
||||
extern int dsaparam_main(int argc, char *argv[]);
|
||||
extern int ec_main(int argc, char *argv[]);
|
||||
extern int ecparam_main(int argc, char *argv[]);
|
||||
extern int enc_main(int argc, char *argv[]);
|
||||
extern int engine_main(int argc, char *argv[]);
|
||||
extern int errstr_main(int argc, char *argv[]);
|
||||
extern int fipsinstall_main(int argc, char *argv[]);
|
||||
extern int gendsa_main(int argc, char *argv[]);
|
||||
extern int genpkey_main(int argc, char *argv[]);
|
||||
extern int genrsa_main(int argc, char *argv[]);
|
||||
extern int help_main(int argc, char *argv[]);
|
||||
extern int info_main(int argc, char *argv[]);
|
||||
extern int kdf_main(int argc, char *argv[]);
|
||||
extern int list_main(int argc, char *argv[]);
|
||||
extern int mac_main(int argc, char *argv[]);
|
||||
extern int nseq_main(int argc, char *argv[]);
|
||||
extern int ocsp_main(int argc, char *argv[]);
|
||||
extern int passwd_main(int argc, char *argv[]);
|
||||
extern int pkcs12_main(int argc, char *argv[]);
|
||||
extern int pkcs7_main(int argc, char *argv[]);
|
||||
extern int pkcs8_main(int argc, char *argv[]);
|
||||
extern int pkey_main(int argc, char *argv[]);
|
||||
extern int pkeyparam_main(int argc, char *argv[]);
|
||||
extern int pkeyutl_main(int argc, char *argv[]);
|
||||
extern int prime_main(int argc, char *argv[]);
|
||||
extern int provider_main(int argc, char *argv[]);
|
||||
extern int rand_main(int argc, char *argv[]);
|
||||
extern int rehash_main(int argc, char *argv[]);
|
||||
extern int req_main(int argc, char *argv[]);
|
||||
extern int rsa_main(int argc, char *argv[]);
|
||||
extern int rsautl_main(int argc, char *argv[]);
|
||||
extern int s_client_main(int argc, char *argv[]);
|
||||
extern int s_server_main(int argc, char *argv[]);
|
||||
extern int s_time_main(int argc, char *argv[]);
|
||||
extern int sess_id_main(int argc, char *argv[]);
|
||||
extern int smime_main(int argc, char *argv[]);
|
||||
extern int speed_main(int argc, char *argv[]);
|
||||
extern int spkac_main(int argc, char *argv[]);
|
||||
extern int srp_main(int argc, char *argv[]);
|
||||
extern int storeutl_main(int argc, char *argv[]);
|
||||
extern int ts_main(int argc, char *argv[]);
|
||||
extern int verify_main(int argc, char *argv[]);
|
||||
extern int version_main(int argc, char *argv[]);
|
||||
extern int x509_main(int argc, char *argv[]);
|
||||
|
||||
extern const OPTIONS asn1parse_options[];
|
||||
extern const OPTIONS ca_options[];
|
||||
extern const OPTIONS ciphers_options[];
|
||||
extern const OPTIONS cms_options[];
|
||||
extern const OPTIONS crl_options[];
|
||||
extern const OPTIONS crl2pkcs7_options[];
|
||||
extern const OPTIONS dgst_options[];
|
||||
extern const OPTIONS dhparam_options[];
|
||||
extern const OPTIONS dsa_options[];
|
||||
extern const OPTIONS dsaparam_options[];
|
||||
extern const OPTIONS ec_options[];
|
||||
extern const OPTIONS ecparam_options[];
|
||||
extern const OPTIONS enc_options[];
|
||||
extern const OPTIONS engine_options[];
|
||||
extern const OPTIONS errstr_options[];
|
||||
extern const OPTIONS fipsinstall_options[];
|
||||
extern const OPTIONS gendsa_options[];
|
||||
extern const OPTIONS genpkey_options[];
|
||||
extern const OPTIONS genrsa_options[];
|
||||
extern const OPTIONS help_options[];
|
||||
extern const OPTIONS info_options[];
|
||||
extern const OPTIONS kdf_options[];
|
||||
extern const OPTIONS list_options[];
|
||||
extern const OPTIONS mac_options[];
|
||||
extern const OPTIONS nseq_options[];
|
||||
extern const OPTIONS ocsp_options[];
|
||||
extern const OPTIONS passwd_options[];
|
||||
extern const OPTIONS pkcs12_options[];
|
||||
extern const OPTIONS pkcs7_options[];
|
||||
extern const OPTIONS pkcs8_options[];
|
||||
extern const OPTIONS pkey_options[];
|
||||
extern const OPTIONS pkeyparam_options[];
|
||||
extern const OPTIONS pkeyutl_options[];
|
||||
extern const OPTIONS prime_options[];
|
||||
extern const OPTIONS provider_options[];
|
||||
extern const OPTIONS rand_options[];
|
||||
extern const OPTIONS rehash_options[];
|
||||
extern const OPTIONS req_options[];
|
||||
extern const OPTIONS rsa_options[];
|
||||
extern const OPTIONS rsautl_options[];
|
||||
extern const OPTIONS s_client_options[];
|
||||
extern const OPTIONS s_server_options[];
|
||||
extern const OPTIONS s_time_options[];
|
||||
extern const OPTIONS sess_id_options[];
|
||||
extern const OPTIONS smime_options[];
|
||||
extern const OPTIONS speed_options[];
|
||||
extern const OPTIONS spkac_options[];
|
||||
extern const OPTIONS srp_options[];
|
||||
extern const OPTIONS storeutl_options[];
|
||||
extern const OPTIONS ts_options[];
|
||||
extern const OPTIONS verify_options[];
|
||||
extern const OPTIONS version_options[];
|
||||
extern const OPTIONS x509_options[];
|
||||
|
||||
extern FUNCTION functions[];
|
||||
+33
-6
@@ -1,5 +1,5 @@
|
||||
#! /usr/bin/env perl
|
||||
# Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
# Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
#
|
||||
# Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
# this file except in compliance with the License. You can obtain a copy
|
||||
@@ -93,7 +93,6 @@ EOF
|
||||
my %cmd_disabler = (
|
||||
ciphers => "sock",
|
||||
genrsa => "rsa",
|
||||
rsautl => "rsa",
|
||||
gendsa => "dsa",
|
||||
dsaparam => "dsa",
|
||||
gendh => "dh",
|
||||
@@ -101,13 +100,41 @@ EOF
|
||||
ecparam => "ec",
|
||||
pkcs12 => "des",
|
||||
);
|
||||
my %cmd_deprecated = (
|
||||
# The format of this table is:
|
||||
# [0] = alternative command to use instead
|
||||
# [1] = deprecented in this version
|
||||
# [2] = preprocessor conditional for exclusing irrespective of deprecation
|
||||
# rsa => [ "pkey", "3_0", "rsa" ],
|
||||
# genrsa => [ "genpkey", "3_0", "rsa" ],
|
||||
rsautl => [ "pkeyutl", "3_0", "rsa" ],
|
||||
# dhparam => [ "pkeyparam", "3_0", "dh" ],
|
||||
# dsaparam => [ "pkeyparam", "3_0", "dsa" ],
|
||||
# dsa => [ "pkey", "3_0", "dsa" ],
|
||||
# gendsa => [ "genpkey", "3_0", "dsa" ],
|
||||
# ec => [ "pkey", "3_0", "ec" ],
|
||||
# ecparam => [ "pkeyparam", "3_0", "ec" ],
|
||||
);
|
||||
|
||||
print "FUNCTION functions[] = {\n";
|
||||
foreach my $cmd ( @ARGV ) {
|
||||
my $str =
|
||||
" {FT_general, \"$cmd\", ${cmd}_main, ${cmd}_options},\n";
|
||||
" {FT_general, \"$cmd\", ${cmd}_main, ${cmd}_options, NULL, NULL},\n";
|
||||
if ($cmd =~ /^s_/) {
|
||||
print "#ifndef OPENSSL_NO_SOCK\n${str}#endif\n";
|
||||
} elsif (my $deprecated = $cmd_deprecated{$cmd}) {
|
||||
my @dep = @{$deprecated};
|
||||
my $daltprg = $dep[0];
|
||||
my $dver = $dep[1];
|
||||
my $dsys = $dep[2];
|
||||
print "#if !defined(OPENSSL_NO_DEPRECATED_" . $dver . ")";
|
||||
if ($dsys) {
|
||||
print " && !defined(OPENSSL_NO_" . uc($dsys) . ")";
|
||||
}
|
||||
$dver =~ s/_/./g;
|
||||
my $dalt = "\"" . $daltprg . "\", \"" . $dver . "\"";
|
||||
$str =~ s/NULL, NULL/$dalt/;
|
||||
print "\n${str}#endif\n";
|
||||
} elsif (grep { $cmd eq $_ } @disablables) {
|
||||
print "#ifndef OPENSSL_NO_" . uc($cmd) . "\n${str}#endif\n";
|
||||
} elsif (my $disabler = $cmd_disabler{$cmd}) {
|
||||
@@ -131,7 +158,7 @@ EOF
|
||||
"mdc2", "rmd160", "blake2b512", "blake2s256",
|
||||
"sm3"
|
||||
) {
|
||||
my $str = " {FT_md, \"$cmd\", dgst_main},\n";
|
||||
my $str = " {FT_md, \"$cmd\", dgst_main, NULL, NULL},\n";
|
||||
if (grep { $cmd eq $_ } @disablables) {
|
||||
print "#ifndef OPENSSL_NO_" . uc($cmd) . "\n${str}#endif\n";
|
||||
} elsif (my $disabler = $md_disabler{$cmd}) {
|
||||
@@ -177,7 +204,7 @@ EOF
|
||||
"cast-cbc", "rc5-cbc", "rc5-ecb", "rc5-cfb", "rc5-ofb",
|
||||
"sm4-cbc", "sm4-ecb", "sm4-cfb", "sm4-ofb", "sm4-ctr"
|
||||
) {
|
||||
my $str = " {FT_cipher, \"$cmd\", enc_main, enc_options},\n";
|
||||
my $str = " {FT_cipher, \"$cmd\", enc_main, enc_options, NULL},\n";
|
||||
(my $algo = $cmd) =~ s/-.*//g;
|
||||
if ($cmd eq "zlib") {
|
||||
print "#ifdef ZLIB\n${str}#endif\n";
|
||||
@@ -190,5 +217,5 @@ EOF
|
||||
}
|
||||
}
|
||||
|
||||
print " {0, NULL, NULL}\n};\n";
|
||||
print " {0, NULL, NULL, NULL, NULL}\n};\n";
|
||||
}
|
||||
+3
-1
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -20,6 +20,8 @@
|
||||
#include <openssl/core.h>
|
||||
#include <openssl/core_numbers.h>
|
||||
|
||||
DEFINE_STACK_OF_CSTRING()
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_V = 100, OPT_VV, OPT_VVV
|
||||
|
||||
+7
-2
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1998-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1998-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -21,7 +21,7 @@
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_OUT, OPT_ENGINE, OPT_BASE64, OPT_HEX,
|
||||
OPT_R_ENUM
|
||||
OPT_R_ENUM, OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS rand_options[] = {
|
||||
@@ -39,6 +39,7 @@ const OPTIONS rand_options[] = {
|
||||
{"hex", OPT_HEX, '-', "Hex encode output"},
|
||||
|
||||
OPT_R_OPTIONS,
|
||||
OPT_PROV_OPTIONS,
|
||||
|
||||
OPT_PARAMETERS(),
|
||||
{"num", 0, 0, "Number of bytes to generate"},
|
||||
@@ -81,6 +82,10 @@ int rand_main(int argc, char **argv)
|
||||
case OPT_HEX:
|
||||
format = FORMAT_TEXT;
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
|
||||
+22
-5
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright (c) 2013-2014 Timo Teräs <timo.teras@gmail.com>
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
@@ -42,6 +42,8 @@
|
||||
# include <openssl/pem.h>
|
||||
# include <openssl/x509.h>
|
||||
|
||||
DEFINE_STACK_OF(X509_INFO)
|
||||
DEFINE_STACK_OF_STRING()
|
||||
|
||||
# ifndef PATH_MAX
|
||||
# define PATH_MAX 4096
|
||||
@@ -233,7 +235,7 @@ static int do_file(const char *filename, const char *fullpath, enum Hash h)
|
||||
{
|
||||
STACK_OF (X509_INFO) *inf = NULL;
|
||||
X509_INFO *x;
|
||||
X509_NAME *name = NULL;
|
||||
const X509_NAME *name = NULL;
|
||||
BIO *b;
|
||||
const char *ext;
|
||||
unsigned char digest[EVP_MAX_MD_SIZE];
|
||||
@@ -274,11 +276,19 @@ static int do_file(const char *filename, const char *fullpath, enum Hash h)
|
||||
if (x->x509 != NULL) {
|
||||
type = TYPE_CERT;
|
||||
name = X509_get_subject_name(x->x509);
|
||||
X509_digest(x->x509, evpmd, digest, NULL);
|
||||
if (!X509_digest(x->x509, evpmd, digest, NULL)) {
|
||||
BIO_printf(bio_err, "out of memory\n");
|
||||
++errs;
|
||||
goto end;
|
||||
}
|
||||
} else if (x->crl != NULL) {
|
||||
type = TYPE_CRL;
|
||||
name = X509_CRL_get_issuer(x->crl);
|
||||
X509_CRL_digest(x->crl, evpmd, digest, NULL);
|
||||
if (!X509_CRL_digest(x->crl, evpmd, digest, NULL)) {
|
||||
BIO_printf(bio_err, "out of memory\n");
|
||||
++errs;
|
||||
goto end;
|
||||
}
|
||||
} else {
|
||||
++errs;
|
||||
goto end;
|
||||
@@ -447,7 +457,8 @@ static int do_dir(const char *dirname, enum Hash h)
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_COMPAT, OPT_OLD, OPT_N, OPT_VERBOSE
|
||||
OPT_COMPAT, OPT_OLD, OPT_N, OPT_VERBOSE,
|
||||
OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS rehash_options[] = {
|
||||
@@ -463,6 +474,8 @@ const OPTIONS rehash_options[] = {
|
||||
OPT_SECTION("Output"),
|
||||
{"v", OPT_VERBOSE, '-', "Verbose output"},
|
||||
|
||||
OPT_PROV_OPTIONS,
|
||||
|
||||
OPT_PARAMETERS(),
|
||||
{"directory", 0, 0, "One or more directories to process (optional)"},
|
||||
{NULL}
|
||||
@@ -499,6 +512,10 @@ int rehash_main(int argc, char **argv)
|
||||
case OPT_VERBOSE:
|
||||
verbose = 1;
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
|
||||
+136
-160
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -32,7 +32,8 @@
|
||||
# include <openssl/dsa.h>
|
||||
#endif
|
||||
|
||||
#define SECTION "req"
|
||||
DEFINE_STACK_OF(CONF_VALUE)
|
||||
DEFINE_STACK_OF_STRING()
|
||||
|
||||
#define BITS "default_bits"
|
||||
#define KEYFILE "default_keyfile"
|
||||
@@ -77,6 +78,8 @@ static int join(char buf[], size_t buf_size, const char *name,
|
||||
static EVP_PKEY_CTX *set_keygen_ctx(const char *gstr,
|
||||
int *pkey_type, long *pkeylen,
|
||||
char **palgnam, ENGINE *keygen_engine);
|
||||
|
||||
static const char *section = "req";
|
||||
static CONF *req_conf = NULL;
|
||||
static CONF *addext_conf = NULL;
|
||||
static int batch = 0;
|
||||
@@ -86,12 +89,13 @@ typedef enum OPTION_choice {
|
||||
OPT_INFORM, OPT_OUTFORM, OPT_ENGINE, OPT_KEYGEN_ENGINE, OPT_KEY,
|
||||
OPT_PUBKEY, OPT_NEW, OPT_CONFIG, OPT_KEYFORM, OPT_IN, OPT_OUT,
|
||||
OPT_KEYOUT, OPT_PASSIN, OPT_PASSOUT, OPT_NEWKEY,
|
||||
OPT_PKEYOPT, OPT_SIGOPT, OPT_BATCH, OPT_NEWHDR, OPT_MODULUS,
|
||||
OPT_PKEYOPT, OPT_SIGOPT, OPT_VFYOPT, OPT_BATCH, OPT_NEWHDR, OPT_MODULUS,
|
||||
OPT_VERIFY, OPT_NODES, OPT_NOOUT, OPT_VERBOSE, OPT_UTF8,
|
||||
OPT_NAMEOPT, OPT_REQOPT, OPT_SUBJ, OPT_SUBJECT, OPT_TEXT, OPT_X509,
|
||||
OPT_MULTIVALUE_RDN, OPT_DAYS, OPT_SET_SERIAL, OPT_ADDEXT, OPT_EXTENSIONS,
|
||||
OPT_REQEXTS, OPT_PRECERT, OPT_MD, OPT_SM2ID, OPT_SM2HEXID,
|
||||
OPT_R_ENUM
|
||||
OPT_REQEXTS, OPT_PRECERT, OPT_MD,
|
||||
OPT_SECTION,
|
||||
OPT_R_ENUM, OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS req_options[] = {
|
||||
@@ -109,8 +113,9 @@ const OPTIONS req_options[] = {
|
||||
OPT_SECTION("Certificate"),
|
||||
{"new", OPT_NEW, '-', "New request"},
|
||||
{"config", OPT_CONFIG, '<', "Request template file"},
|
||||
{"section", OPT_SECTION, 's', "Config section to use (default \"req\")"},
|
||||
{"utf8", OPT_UTF8, '-', "Input characters are UTF8 (default ASCII)"},
|
||||
{"nameopt", OPT_NAMEOPT, 's', "Various certificate name options"},
|
||||
{"nameopt", OPT_NAMEOPT, 's', "Certificate subject/issuer name printing options"},
|
||||
{"reqopt", OPT_REQOPT, 's', "Various request text options"},
|
||||
{"text", OPT_TEXT, '-', "Text form of request"},
|
||||
{"x509", OPT_X509, '-',
|
||||
@@ -132,7 +137,7 @@ const OPTIONS req_options[] = {
|
||||
|
||||
OPT_SECTION("Keys and Signing"),
|
||||
{"key", OPT_KEY, 's', "Private key to use"},
|
||||
{"keyform", OPT_KEYFORM, 'f', "Key file format"},
|
||||
{"keyform", OPT_KEYFORM, 'f', "Key file format (ENGINE, other values ignored)"},
|
||||
{"pubkey", OPT_PUBKEY, '-', "Output public key"},
|
||||
{"keyout", OPT_KEYOUT, '>', "File to send the key to"},
|
||||
{"passin", OPT_PASSIN, 's', "Private key password source"},
|
||||
@@ -140,13 +145,8 @@ const OPTIONS req_options[] = {
|
||||
{"newkey", OPT_NEWKEY, 's', "Specify as type:bits"},
|
||||
{"pkeyopt", OPT_PKEYOPT, 's', "Public key options as opt:value"},
|
||||
{"sigopt", OPT_SIGOPT, 's', "Signature parameter in n:v form"},
|
||||
{"vfyopt", OPT_VFYOPT, 's', "Verification parameter in n:v form"},
|
||||
{"", OPT_MD, '-', "Any supported digest"},
|
||||
#ifndef OPENSSL_NO_SM2
|
||||
{"sm2-id", OPT_SM2ID, 's',
|
||||
"Specify an ID string to verify an SM2 certificate request"},
|
||||
{"sm2-hex-id", OPT_SM2HEXID, 's',
|
||||
"Specify a hex ID string to verify an SM2 certificate request"},
|
||||
#endif
|
||||
|
||||
OPT_SECTION("Output"),
|
||||
{"out", OPT_OUT, '>', "Output file"},
|
||||
@@ -160,6 +160,7 @@ const OPTIONS req_options[] = {
|
||||
{"modulus", OPT_MODULUS, '-', "RSA modulus"},
|
||||
|
||||
OPT_R_OPTIONS,
|
||||
OPT_PROV_OPTIONS,
|
||||
{NULL}
|
||||
};
|
||||
|
||||
@@ -229,11 +230,11 @@ static int duplicated(LHASH_OF(OPENSSL_STRING) *addexts, char *kv)
|
||||
int req_main(int argc, char **argv)
|
||||
{
|
||||
ASN1_INTEGER *serial = NULL;
|
||||
BIO *in = NULL, *out = NULL;
|
||||
BIO *out = NULL;
|
||||
ENGINE *e = NULL, *gen_eng = NULL;
|
||||
EVP_PKEY *pkey = NULL;
|
||||
EVP_PKEY_CTX *genctx = NULL;
|
||||
STACK_OF(OPENSSL_STRING) *pkeyopts = NULL, *sigopts = NULL;
|
||||
STACK_OF(OPENSSL_STRING) *pkeyopts = NULL, *sigopts = NULL, *vfyopts = NULL;
|
||||
LHASH_OF(OPENSSL_STRING) *addexts = NULL;
|
||||
X509 *x509ss = NULL;
|
||||
X509_REQ *req = NULL;
|
||||
@@ -256,9 +257,6 @@ int req_main(int argc, char **argv)
|
||||
int nodes = 0, newhdr = 0, subject = 0, pubkey = 0, precert = 0;
|
||||
long newkey = -1;
|
||||
unsigned long chtype = MBSTRING_ASC, reqflag = 0;
|
||||
unsigned char *sm2_id = NULL;
|
||||
size_t sm2_idlen = 0;
|
||||
int sm2_free = 0;
|
||||
|
||||
#ifndef OPENSSL_NO_DES
|
||||
cipher = EVP_des_ede3_cbc();
|
||||
@@ -308,6 +306,9 @@ int req_main(int argc, char **argv)
|
||||
case OPT_CONFIG:
|
||||
template = opt_arg();
|
||||
break;
|
||||
case OPT_SECTION:
|
||||
section = opt_arg();
|
||||
break;
|
||||
case OPT_KEYFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_ANY, &keyform))
|
||||
goto opthelp;
|
||||
@@ -331,6 +332,10 @@ int req_main(int argc, char **argv)
|
||||
if (!opt_rand(o))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_NEWKEY:
|
||||
keyalg = opt_arg();
|
||||
newreq = 1;
|
||||
@@ -348,6 +353,12 @@ int req_main(int argc, char **argv)
|
||||
if (!sigopts || !sk_OPENSSL_STRING_push(sigopts, opt_arg()))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_VFYOPT:
|
||||
if (!vfyopts)
|
||||
vfyopts = sk_OPENSSL_STRING_new_null();
|
||||
if (!vfyopts || !sk_OPENSSL_STRING_push(vfyopts, opt_arg()))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_BATCH:
|
||||
batch = 1;
|
||||
break;
|
||||
@@ -435,29 +446,6 @@ int req_main(int argc, char **argv)
|
||||
goto opthelp;
|
||||
digest = md_alg;
|
||||
break;
|
||||
case OPT_SM2ID:
|
||||
if (sm2_id != NULL) {
|
||||
BIO_printf(bio_err,
|
||||
"Use one of the options 'sm2-hex-id' or 'sm2-id'\n");
|
||||
goto end;
|
||||
}
|
||||
sm2_id = (unsigned char *)opt_arg();
|
||||
sm2_idlen = strlen((const char *)sm2_id);
|
||||
break;
|
||||
case OPT_SM2HEXID:
|
||||
if (sm2_id != NULL) {
|
||||
BIO_printf(bio_err,
|
||||
"Use one of the options 'sm2-hex-id' or 'sm2-id'\n");
|
||||
goto end;
|
||||
}
|
||||
/* try to parse the input as hex string first */
|
||||
sm2_free = 1;
|
||||
sm2_id = OPENSSL_hexstr2buf(opt_arg(), (long *)&sm2_idlen);
|
||||
if (sm2_id == NULL) {
|
||||
BIO_printf(bio_err, "Invalid hex string input\n");
|
||||
goto end;
|
||||
}
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
@@ -481,7 +469,7 @@ int req_main(int argc, char **argv)
|
||||
BIO_printf(bio_err, "Using configuration from %s\n", template);
|
||||
if ((req_conf = app_load_config(template)) == NULL)
|
||||
goto end;
|
||||
if (addext_bio) {
|
||||
if (addext_bio != NULL) {
|
||||
if (verbose)
|
||||
BIO_printf(bio_err,
|
||||
"Using additional configuration from command line\n");
|
||||
@@ -514,7 +502,7 @@ int req_main(int argc, char **argv)
|
||||
goto end;
|
||||
|
||||
if (md_alg == NULL) {
|
||||
p = NCONF_get_string(req_conf, SECTION, "default_md");
|
||||
p = NCONF_get_string(req_conf, section, "default_md");
|
||||
if (p == NULL) {
|
||||
ERR_clear_error();
|
||||
} else {
|
||||
@@ -525,7 +513,7 @@ int req_main(int argc, char **argv)
|
||||
}
|
||||
|
||||
if (extensions == NULL) {
|
||||
extensions = NCONF_get_string(req_conf, SECTION, V3_EXTENSIONS);
|
||||
extensions = NCONF_get_string(req_conf, section, V3_EXTENSIONS);
|
||||
if (extensions == NULL)
|
||||
ERR_clear_error();
|
||||
}
|
||||
@@ -553,19 +541,19 @@ int req_main(int argc, char **argv)
|
||||
|
||||
if (passin == NULL) {
|
||||
passin = nofree_passin =
|
||||
NCONF_get_string(req_conf, SECTION, "input_password");
|
||||
NCONF_get_string(req_conf, section, "input_password");
|
||||
if (passin == NULL)
|
||||
ERR_clear_error();
|
||||
}
|
||||
|
||||
if (passout == NULL) {
|
||||
passout = nofree_passout =
|
||||
NCONF_get_string(req_conf, SECTION, "output_password");
|
||||
NCONF_get_string(req_conf, section, "output_password");
|
||||
if (passout == NULL)
|
||||
ERR_clear_error();
|
||||
}
|
||||
|
||||
p = NCONF_get_string(req_conf, SECTION, STRING_MASK);
|
||||
p = NCONF_get_string(req_conf, section, STRING_MASK);
|
||||
if (p == NULL)
|
||||
ERR_clear_error();
|
||||
|
||||
@@ -575,7 +563,7 @@ int req_main(int argc, char **argv)
|
||||
}
|
||||
|
||||
if (chtype != MBSTRING_UTF8) {
|
||||
p = NCONF_get_string(req_conf, SECTION, UTF8_IN);
|
||||
p = NCONF_get_string(req_conf, section, UTF8_IN);
|
||||
if (p == NULL)
|
||||
ERR_clear_error();
|
||||
else if (strcmp(p, "yes") == 0)
|
||||
@@ -583,7 +571,7 @@ int req_main(int argc, char **argv)
|
||||
}
|
||||
|
||||
if (req_exts == NULL) {
|
||||
req_exts = NCONF_get_string(req_conf, SECTION, REQ_EXTENSIONS);
|
||||
req_exts = NCONF_get_string(req_conf, section, REQ_EXTENSIONS);
|
||||
if (req_exts == NULL)
|
||||
ERR_clear_error();
|
||||
}
|
||||
@@ -602,18 +590,15 @@ int req_main(int argc, char **argv)
|
||||
|
||||
if (keyfile != NULL) {
|
||||
pkey = load_key(keyfile, keyform, 0, passin, e, "Private Key");
|
||||
if (pkey == NULL) {
|
||||
/* load_key() has already printed an appropriate message */
|
||||
if (pkey == NULL)
|
||||
goto end;
|
||||
} else {
|
||||
app_RAND_load_conf(req_conf, SECTION);
|
||||
}
|
||||
app_RAND_load_conf(req_conf, section);
|
||||
}
|
||||
|
||||
if (newreq && (pkey == NULL)) {
|
||||
app_RAND_load_conf(req_conf, SECTION);
|
||||
app_RAND_load_conf(req_conf, section);
|
||||
|
||||
if (!NCONF_get_number(req_conf, SECTION, BITS, &newkey)) {
|
||||
if (!NCONF_get_number(req_conf, section, BITS, &newkey)) {
|
||||
newkey = DEFAULT_KEY_LENGTH;
|
||||
}
|
||||
|
||||
@@ -683,7 +668,7 @@ int req_main(int argc, char **argv)
|
||||
genctx = NULL;
|
||||
|
||||
if (keyout == NULL) {
|
||||
keyout = NCONF_get_string(req_conf, SECTION, KEYFILE);
|
||||
keyout = NCONF_get_string(req_conf, section, KEYFILE);
|
||||
if (keyout == NULL)
|
||||
ERR_clear_error();
|
||||
}
|
||||
@@ -696,10 +681,10 @@ int req_main(int argc, char **argv)
|
||||
if (out == NULL)
|
||||
goto end;
|
||||
|
||||
p = NCONF_get_string(req_conf, SECTION, "encrypt_rsa_key");
|
||||
p = NCONF_get_string(req_conf, section, "encrypt_rsa_key");
|
||||
if (p == NULL) {
|
||||
ERR_clear_error();
|
||||
p = NCONF_get_string(req_conf, SECTION, "encrypt_key");
|
||||
p = NCONF_get_string(req_conf, section, "encrypt_key");
|
||||
if (p == NULL)
|
||||
ERR_clear_error();
|
||||
}
|
||||
@@ -727,18 +712,9 @@ int req_main(int argc, char **argv)
|
||||
}
|
||||
|
||||
if (!newreq) {
|
||||
in = bio_open_default(infile, 'r', informat);
|
||||
if (in == NULL)
|
||||
req = load_csr(infile, informat, "X509 request");
|
||||
if (req == NULL)
|
||||
goto end;
|
||||
|
||||
if (informat == FORMAT_ASN1)
|
||||
req = d2i_X509_REQ_bio(in, NULL);
|
||||
else
|
||||
req = PEM_read_bio_X509_REQ(in, NULL, NULL, NULL);
|
||||
if (req == NULL) {
|
||||
BIO_printf(bio_err, "unable to load X509 request\n");
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
if (newreq || x509) {
|
||||
@@ -890,27 +866,7 @@ int req_main(int argc, char **argv)
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (sm2_id != NULL) {
|
||||
#ifndef OPENSSL_NO_SM2
|
||||
ASN1_OCTET_STRING *v;
|
||||
|
||||
v = ASN1_OCTET_STRING_new();
|
||||
if (v == NULL) {
|
||||
BIO_printf(bio_err, "error: SM2 ID allocation failed\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (!ASN1_OCTET_STRING_set(v, sm2_id, sm2_idlen)) {
|
||||
BIO_printf(bio_err, "error: setting SM2 ID failed\n");
|
||||
ASN1_OCTET_STRING_free(v);
|
||||
goto end;
|
||||
}
|
||||
|
||||
X509_REQ_set0_sm2_id(req, v);
|
||||
#endif
|
||||
}
|
||||
|
||||
i = X509_REQ_verify(req, tpubkey);
|
||||
i = do_X509_REQ_verify(req, tpubkey, vfyopts);
|
||||
|
||||
if (i < 0) {
|
||||
goto end;
|
||||
@@ -1018,20 +974,18 @@ int req_main(int argc, char **argv)
|
||||
}
|
||||
ret = 0;
|
||||
end:
|
||||
if (sm2_free)
|
||||
OPENSSL_free(sm2_id);
|
||||
if (ret) {
|
||||
ERR_print_errors(bio_err);
|
||||
}
|
||||
NCONF_free(req_conf);
|
||||
NCONF_free(addext_conf);
|
||||
BIO_free(addext_bio);
|
||||
BIO_free(in);
|
||||
BIO_free_all(out);
|
||||
EVP_PKEY_free(pkey);
|
||||
EVP_PKEY_CTX_free(genctx);
|
||||
sk_OPENSSL_STRING_free(pkeyopts);
|
||||
sk_OPENSSL_STRING_free(sigopts);
|
||||
sk_OPENSSL_STRING_free(vfyopts);
|
||||
lh_OPENSSL_STRING_doall(addexts, exts_cleanup);
|
||||
lh_OPENSSL_STRING_free(addexts);
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
@@ -1057,13 +1011,13 @@ static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, char *subj, int multirdn,
|
||||
STACK_OF(CONF_VALUE) *dn_sk, *attr_sk = NULL;
|
||||
char *tmp, *dn_sect, *attr_sect;
|
||||
|
||||
tmp = NCONF_get_string(req_conf, SECTION, PROMPT);
|
||||
tmp = NCONF_get_string(req_conf, section, PROMPT);
|
||||
if (tmp == NULL)
|
||||
ERR_clear_error();
|
||||
if ((tmp != NULL) && strcmp(tmp, "no") == 0)
|
||||
no_prompt = 1;
|
||||
|
||||
dn_sect = NCONF_get_string(req_conf, SECTION, DISTINGUISHED_NAME);
|
||||
dn_sect = NCONF_get_string(req_conf, section, DISTINGUISHED_NAME);
|
||||
if (dn_sect == NULL) {
|
||||
BIO_printf(bio_err, "unable to find '%s' in config\n",
|
||||
DISTINGUISHED_NAME);
|
||||
@@ -1075,7 +1029,7 @@ static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, char *subj, int multirdn,
|
||||
goto err;
|
||||
}
|
||||
|
||||
attr_sect = NCONF_get_string(req_conf, SECTION, ATTRIBUTES);
|
||||
attr_sect = NCONF_get_string(req_conf, section, ATTRIBUTES);
|
||||
if (attr_sect == NULL) {
|
||||
ERR_clear_error();
|
||||
attr_sk = NULL;
|
||||
@@ -1142,8 +1096,7 @@ static int prompt_info(X509_REQ *req,
|
||||
char *type, *value;
|
||||
const char *def;
|
||||
CONF_VALUE *v;
|
||||
X509_NAME *subj;
|
||||
subj = X509_REQ_get_subject_name(req);
|
||||
X509_NAME *subj = X509_REQ_get_subject_name(req);
|
||||
|
||||
if (!batch) {
|
||||
BIO_printf(bio_err,
|
||||
@@ -1228,8 +1181,7 @@ static int prompt_info(X509_REQ *req,
|
||||
return 0;
|
||||
}
|
||||
if (X509_NAME_entry_count(subj) == 0) {
|
||||
BIO_printf(bio_err,
|
||||
"error, no objects specified in config file\n");
|
||||
BIO_printf(bio_err, "error, no objects specified in config file\n");
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -1674,32 +1626,71 @@ static int genpkey_cb(EVP_PKEY_CTX *ctx)
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int do_pkey_ctx_init(EVP_PKEY_CTX *pkctx, STACK_OF(OPENSSL_STRING) *opts)
|
||||
{
|
||||
int i;
|
||||
|
||||
if (opts == NULL)
|
||||
return 1;
|
||||
|
||||
for (i = 0; i < sk_OPENSSL_STRING_num(opts); i++) {
|
||||
char *opt = sk_OPENSSL_STRING_value(opts, i);
|
||||
if (pkey_ctrl_string(pkctx, opt) <= 0) {
|
||||
BIO_printf(bio_err, "parameter error \"%s\"\n", opt);
|
||||
ERR_print_errors(bio_err);
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int do_x509_init(X509 *x, STACK_OF(OPENSSL_STRING) *opts)
|
||||
{
|
||||
int i;
|
||||
|
||||
if (opts == NULL)
|
||||
return 1;
|
||||
|
||||
for (i = 0; i < sk_OPENSSL_STRING_num(opts); i++) {
|
||||
char *opt = sk_OPENSSL_STRING_value(opts, i);
|
||||
if (x509_ctrl_string(x, opt) <= 0) {
|
||||
BIO_printf(bio_err, "parameter error \"%s\"\n", opt);
|
||||
ERR_print_errors(bio_err);
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int do_x509_req_init(X509_REQ *x, STACK_OF(OPENSSL_STRING) *opts)
|
||||
{
|
||||
int i;
|
||||
|
||||
if (opts == NULL)
|
||||
return 1;
|
||||
|
||||
for (i = 0; i < sk_OPENSSL_STRING_num(opts); i++) {
|
||||
char *opt = sk_OPENSSL_STRING_value(opts, i);
|
||||
if (x509_req_ctrl_string(x, opt) <= 0) {
|
||||
BIO_printf(bio_err, "parameter error \"%s\"\n", opt);
|
||||
ERR_print_errors(bio_err);
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int do_sign_init(EVP_MD_CTX *ctx, EVP_PKEY *pkey,
|
||||
const EVP_MD *md, STACK_OF(OPENSSL_STRING) *sigopts)
|
||||
{
|
||||
EVP_PKEY_CTX *pkctx = NULL;
|
||||
EVP_PKEY_CTX *pctx = NULL;
|
||||
int i, def_nid, ret = 0;
|
||||
int def_nid;
|
||||
|
||||
if (ctx == NULL)
|
||||
goto err;
|
||||
if (EVP_PKEY_id(pkey) == EVP_PKEY_SM2) {
|
||||
pctx = EVP_PKEY_CTX_new(pkey, NULL);
|
||||
if (pctx == NULL) {
|
||||
BIO_printf(bio_err, "memory allocation failure.\n");
|
||||
goto err;
|
||||
}
|
||||
/* set SM2 ID from sig options before calling the real init routine */
|
||||
for (i = 0; i < sk_OPENSSL_STRING_num(sigopts); i++) {
|
||||
char *sigopt = sk_OPENSSL_STRING_value(sigopts, i);
|
||||
if (pkey_ctrl_string(pctx, sigopt) <= 0) {
|
||||
BIO_printf(bio_err, "parameter error \"%s\"\n", sigopt);
|
||||
ERR_print_errors(bio_err);
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
EVP_MD_CTX_set_pkey_ctx(ctx, pctx);
|
||||
}
|
||||
return 0;
|
||||
/*
|
||||
* EVP_PKEY_get_default_digest_nid() returns 2 if the digest is mandatory
|
||||
* for this algorithm.
|
||||
@@ -1709,36 +1700,8 @@ static int do_sign_init(EVP_MD_CTX *ctx, EVP_PKEY *pkey,
|
||||
/* The signing algorithm requires there to be no digest */
|
||||
md = NULL;
|
||||
}
|
||||
if (!EVP_DigestSignInit(ctx, &pkctx, md, NULL, pkey))
|
||||
goto err;
|
||||
for (i = 0; i < sk_OPENSSL_STRING_num(sigopts); i++) {
|
||||
char *sigopt = sk_OPENSSL_STRING_value(sigopts, i);
|
||||
if (pkey_ctrl_string(pkctx, sigopt) <= 0) {
|
||||
BIO_printf(bio_err, "parameter error \"%s\"\n", sigopt);
|
||||
ERR_print_errors(bio_err);
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
|
||||
ret = 1;
|
||||
err:
|
||||
if (!ret)
|
||||
EVP_PKEY_CTX_free(pctx);
|
||||
return ret;
|
||||
}
|
||||
|
||||
static void do_sign_cleanup(EVP_MD_CTX *ctx, EVP_PKEY *pkey)
|
||||
{
|
||||
/*
|
||||
* With SM2, do_sign_init() attached an EVP_PKEY_CTX to the EVP_MD_CTX,
|
||||
* and we have to free it explicitly.
|
||||
*/
|
||||
if (EVP_PKEY_id(pkey) == EVP_PKEY_SM2) {
|
||||
EVP_PKEY_CTX *pctx = EVP_MD_CTX_pkey_ctx(ctx);
|
||||
|
||||
EVP_MD_CTX_set_pkey_ctx(ctx, NULL);
|
||||
EVP_PKEY_CTX_free(pctx);
|
||||
}
|
||||
return EVP_DigestSignInit(ctx, &pkctx, md, NULL, pkey)
|
||||
&& do_pkey_ctx_init(pkctx, sigopts);
|
||||
}
|
||||
|
||||
int do_X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md,
|
||||
@@ -1747,10 +1710,8 @@ int do_X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md,
|
||||
int rv = 0;
|
||||
EVP_MD_CTX *mctx = EVP_MD_CTX_new();
|
||||
|
||||
if (do_sign_init(mctx, pkey, md, sigopts) > 0) {
|
||||
if (do_sign_init(mctx, pkey, md, sigopts) > 0)
|
||||
rv = (X509_sign_ctx(x, mctx) > 0);
|
||||
do_sign_cleanup(mctx, pkey);
|
||||
}
|
||||
EVP_MD_CTX_free(mctx);
|
||||
return rv;
|
||||
}
|
||||
@@ -1761,24 +1722,39 @@ int do_X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md,
|
||||
int rv = 0;
|
||||
EVP_MD_CTX *mctx = EVP_MD_CTX_new();
|
||||
|
||||
if (do_sign_init(mctx, pkey, md, sigopts) > 0) {
|
||||
if (do_sign_init(mctx, pkey, md, sigopts) > 0)
|
||||
rv = (X509_REQ_sign_ctx(x, mctx) > 0);
|
||||
do_sign_cleanup(mctx, pkey);
|
||||
}
|
||||
EVP_MD_CTX_free(mctx);
|
||||
return rv;
|
||||
}
|
||||
|
||||
int do_X509_verify(X509 *x, EVP_PKEY *pkey, STACK_OF(OPENSSL_STRING) *vfyopts)
|
||||
{
|
||||
int rv = 0;
|
||||
|
||||
if (do_x509_init(x, vfyopts) > 0)
|
||||
rv = (X509_verify(x, pkey) > 0);
|
||||
return rv;
|
||||
}
|
||||
|
||||
int do_X509_REQ_verify(X509_REQ *x, EVP_PKEY *pkey,
|
||||
STACK_OF(OPENSSL_STRING) *vfyopts)
|
||||
{
|
||||
int rv = 0;
|
||||
|
||||
if (do_x509_req_init(x, vfyopts) > 0)
|
||||
rv = (X509_REQ_verify(x, pkey) > 0);
|
||||
return rv;
|
||||
}
|
||||
|
||||
int do_X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md,
|
||||
STACK_OF(OPENSSL_STRING) *sigopts)
|
||||
{
|
||||
int rv = 0;
|
||||
EVP_MD_CTX *mctx = EVP_MD_CTX_new();
|
||||
|
||||
if (do_sign_init(mctx, pkey, md, sigopts) > 0) {
|
||||
if (do_sign_init(mctx, pkey, md, sigopts) > 0)
|
||||
rv = (X509_CRL_sign_ctx(x, mctx) > 0);
|
||||
do_sign_cleanup(mctx, pkey);
|
||||
}
|
||||
EVP_MD_CTX_free(mctx);
|
||||
return rv;
|
||||
}
|
||||
+65
-53
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -8,23 +8,20 @@
|
||||
*/
|
||||
|
||||
#include <openssl/opensslconf.h>
|
||||
#ifdef OPENSSL_NO_RSA
|
||||
NON_EMPTY_TRANSLATION_UNIT
|
||||
#else
|
||||
|
||||
# include <stdio.h>
|
||||
# include <stdlib.h>
|
||||
# include <string.h>
|
||||
# include <time.h>
|
||||
# include "apps.h"
|
||||
# include "progs.h"
|
||||
# include <openssl/bio.h>
|
||||
# include <openssl/err.h>
|
||||
# include <openssl/rsa.h>
|
||||
# include <openssl/evp.h>
|
||||
# include <openssl/x509.h>
|
||||
# include <openssl/pem.h>
|
||||
# include <openssl/bn.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <time.h>
|
||||
#include "apps.h"
|
||||
#include "progs.h"
|
||||
#include <openssl/bio.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/rsa.h>
|
||||
#include <openssl/evp.h>
|
||||
#include <openssl/x509.h>
|
||||
#include <openssl/pem.h>
|
||||
#include <openssl/bn.h>
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
@@ -33,7 +30,8 @@ typedef enum OPTION_choice {
|
||||
OPT_RSAPUBKEY_IN, OPT_RSAPUBKEY_OUT,
|
||||
/* Do not change the order here; see case statements below */
|
||||
OPT_PVK_NONE, OPT_PVK_WEAK, OPT_PVK_STRONG,
|
||||
OPT_NOOUT, OPT_TEXT, OPT_MODULUS, OPT_CHECK, OPT_CIPHER
|
||||
OPT_NOOUT, OPT_TEXT, OPT_MODULUS, OPT_CHECK, OPT_CIPHER,
|
||||
OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS rsa_options[] = {
|
||||
@@ -41,13 +39,13 @@ const OPTIONS rsa_options[] = {
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"check", OPT_CHECK, '-', "Verify key consistency"},
|
||||
{"", OPT_CIPHER, '-', "Any supported cipher"},
|
||||
# ifndef OPENSSL_NO_ENGINE
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
{"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
|
||||
# endif
|
||||
#endif
|
||||
|
||||
OPT_SECTION("Input"),
|
||||
{"in", OPT_IN, 's', "Input file"},
|
||||
{"inform", OPT_INFORM, 'f', "Input format, one of DER PEM"},
|
||||
{"inform", OPT_INFORM, 'f', "Input format (DER/PEM/P12/ENGINE"},
|
||||
{"pubin", OPT_PUBIN, '-', "Expect a public key in input file"},
|
||||
{"RSAPublicKey_in", OPT_RSAPUBKEY_IN, '-', "Input is an RSAPublicKey"},
|
||||
{"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
|
||||
@@ -62,12 +60,14 @@ const OPTIONS rsa_options[] = {
|
||||
{"text", OPT_TEXT, '-', "Print the key in text"},
|
||||
{"modulus", OPT_MODULUS, '-', "Print the RSA key modulus"},
|
||||
|
||||
# if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_RC4)
|
||||
#if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_RC4)
|
||||
OPT_SECTION("PVK"),
|
||||
{"pvk-strong", OPT_PVK_STRONG, '-', "Enable 'Strong' PVK encoding level (default)"},
|
||||
{"pvk-weak", OPT_PVK_WEAK, '-', "Enable 'Weak' PVK encoding level"},
|
||||
{"pvk-none", OPT_PVK_NONE, '-', "Don't enforce PVK encoding"},
|
||||
# endif
|
||||
#endif
|
||||
|
||||
OPT_PROV_OPTIONS,
|
||||
{NULL}
|
||||
};
|
||||
|
||||
@@ -76,15 +76,17 @@ int rsa_main(int argc, char **argv)
|
||||
ENGINE *e = NULL;
|
||||
BIO *out = NULL;
|
||||
RSA *rsa = NULL;
|
||||
EVP_PKEY *pkey = NULL;
|
||||
EVP_PKEY_CTX *pctx;
|
||||
const EVP_CIPHER *enc = NULL;
|
||||
char *infile = NULL, *outfile = NULL, *prog;
|
||||
char *passin = NULL, *passout = NULL, *passinarg = NULL, *passoutarg = NULL;
|
||||
int i, private = 0;
|
||||
int informat = FORMAT_PEM, outformat = FORMAT_PEM, text = 0, check = 0;
|
||||
int noout = 0, modulus = 0, pubin = 0, pubout = 0, ret = 1;
|
||||
# if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_RC4)
|
||||
#if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_RC4)
|
||||
int pvk_encr = 2;
|
||||
# endif
|
||||
#endif
|
||||
OPTION_CHOICE o;
|
||||
|
||||
prog = opt_init(argc, argv, rsa_options);
|
||||
@@ -137,9 +139,9 @@ int rsa_main(int argc, char **argv)
|
||||
case OPT_PVK_STRONG: /* pvk_encr:= 2 */
|
||||
case OPT_PVK_WEAK: /* pvk_encr:= 1 */
|
||||
case OPT_PVK_NONE: /* pvk_encr:= 0 */
|
||||
# if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_RC4)
|
||||
#if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_RC4)
|
||||
pvk_encr = (o - OPT_PVK_NONE);
|
||||
# endif
|
||||
#endif
|
||||
break;
|
||||
case OPT_NOOUT:
|
||||
noout = 1;
|
||||
@@ -157,6 +159,10 @@ int rsa_main(int argc, char **argv)
|
||||
if (!opt_cipher(opt_unknown(), &enc))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
@@ -174,30 +180,26 @@ int rsa_main(int argc, char **argv)
|
||||
goto end;
|
||||
}
|
||||
|
||||
{
|
||||
EVP_PKEY *pkey;
|
||||
if (pubin) {
|
||||
int tmpformat = -1;
|
||||
|
||||
if (pubin) {
|
||||
int tmpformat = -1;
|
||||
if (pubin == 2) {
|
||||
if (informat == FORMAT_PEM)
|
||||
tmpformat = FORMAT_PEMRSA;
|
||||
else if (informat == FORMAT_ASN1)
|
||||
tmpformat = FORMAT_ASN1RSA;
|
||||
} else {
|
||||
tmpformat = informat;
|
||||
}
|
||||
|
||||
pkey = load_pubkey(infile, tmpformat, 1, passin, e, "Public Key");
|
||||
if (pubin == 2) {
|
||||
if (informat == FORMAT_PEM)
|
||||
tmpformat = FORMAT_PEMRSA;
|
||||
else if (informat == FORMAT_ASN1)
|
||||
tmpformat = FORMAT_ASN1RSA;
|
||||
} else {
|
||||
pkey = load_key(infile, informat, 1, passin, e, "Private Key");
|
||||
tmpformat = informat;
|
||||
}
|
||||
|
||||
if (pkey != NULL)
|
||||
rsa = EVP_PKEY_get1_RSA(pkey);
|
||||
EVP_PKEY_free(pkey);
|
||||
pkey = load_pubkey(infile, tmpformat, 1, passin, e, "Public Key");
|
||||
} else {
|
||||
pkey = load_key(infile, informat, 1, passin, e, "Private Key");
|
||||
}
|
||||
|
||||
if (pkey != NULL)
|
||||
rsa = EVP_PKEY_get1_RSA(pkey);
|
||||
|
||||
if (rsa == NULL) {
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
@@ -209,7 +211,8 @@ int rsa_main(int argc, char **argv)
|
||||
|
||||
if (text) {
|
||||
assert(pubin || private);
|
||||
if (!RSA_print(out, rsa, 0)) {
|
||||
if ((pubin && EVP_PKEY_print_public(out, pkey, 0, NULL) <= 0)
|
||||
|| (!pubin && EVP_PKEY_print_private(out, pkey, 0, NULL) <= 0)) {
|
||||
perror(outfile);
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
@@ -225,7 +228,16 @@ int rsa_main(int argc, char **argv)
|
||||
}
|
||||
|
||||
if (check) {
|
||||
int r = RSA_check_key_ex(rsa, NULL);
|
||||
int r;
|
||||
|
||||
pctx = EVP_PKEY_CTX_new_from_pkey(NULL, pkey, NULL);
|
||||
if (pctx == NULL) {
|
||||
BIO_printf(out, "RSA unable to create PKEY context\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
r = EVP_PKEY_check(pctx);
|
||||
EVP_PKEY_CTX_free(pctx);
|
||||
|
||||
if (r == 1) {
|
||||
BIO_printf(out, "RSA key ok\n");
|
||||
@@ -271,7 +283,7 @@ int rsa_main(int argc, char **argv)
|
||||
i = PEM_write_bio_RSAPrivateKey(out, rsa,
|
||||
enc, NULL, 0, NULL, passout);
|
||||
}
|
||||
# ifndef OPENSSL_NO_DSA
|
||||
#ifndef OPENSSL_NO_DSA
|
||||
} else if (outformat == FORMAT_MSBLOB || outformat == FORMAT_PVK) {
|
||||
EVP_PKEY *pk;
|
||||
pk = EVP_PKEY_new();
|
||||
@@ -286,13 +298,13 @@ int rsa_main(int argc, char **argv)
|
||||
goto end;
|
||||
}
|
||||
assert(private);
|
||||
# ifdef OPENSSL_NO_RC4
|
||||
# ifdef OPENSSL_NO_RC4
|
||||
BIO_printf(bio_err, "PVK format not supported\n");
|
||||
EVP_PKEY_free(pk);
|
||||
goto end;
|
||||
# else
|
||||
# else
|
||||
i = i2b_PVK_bio(out, pk, pvk_encr, 0, passout);
|
||||
# endif
|
||||
# endif
|
||||
} else if (pubin || pubout) {
|
||||
i = i2b_PublicKey_bio(out, pk);
|
||||
} else {
|
||||
@@ -300,7 +312,7 @@ int rsa_main(int argc, char **argv)
|
||||
i = i2b_PrivateKey_bio(out, pk);
|
||||
}
|
||||
EVP_PKEY_free(pk);
|
||||
# endif
|
||||
#endif
|
||||
} else {
|
||||
BIO_printf(bio_err, "bad output format specified for outfile\n");
|
||||
goto end;
|
||||
@@ -314,9 +326,9 @@ int rsa_main(int argc, char **argv)
|
||||
end:
|
||||
release_engine(e);
|
||||
BIO_free_all(out);
|
||||
EVP_PKEY_free(pkey);
|
||||
RSA_free(rsa);
|
||||
OPENSSL_free(passin);
|
||||
OPENSSL_free(passout);
|
||||
return ret;
|
||||
}
|
||||
#endif
|
||||
+1
-3
@@ -1,5 +1,4 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
|
||||
MIISKAIBAAKCBAEAiQ2f1X6Bte1DKD0OoCBKEikzPW+5w3oXk3WwnE97Wxzy6wJZ
|
||||
ebbZC3CZKKBnJeBMrysPf+lK+9+fP6Vm8bp1wvbcSIA59BDrX6irFSuM/bdnkbuF
|
||||
MFlDjt+uVrxwoyqfPi2IPot1HQg3l5mdyBqcTWvbOnU2L9HZxJfPUCjfzdTMPrMY
|
||||
@@ -62,7 +61,7 @@ JH1/Qx7C/mTAMRsN5SkOthnGq0djCNWfPv/3JV0H67Uf5krFlnwLebrgfTYoPPdo
|
||||
yO7iBUNJzv6Qh22malLp4P8gzACkD7DGlSTnoB5cLwcjmDGg+i9WrUBbOiVTeQfZ
|
||||
kOj1o+Tz35ndpq/DDUVlqliB9krcxva+QHeJPH53EGI+YVg1nD+s/vUDZ3mQMGX9
|
||||
DQou2L8uU6RnWNv/BihGcL8QvS4Ty6QyPOUPpD3zc70JQAEcQk9BxQNaELgJX0IN
|
||||
22cYn22tYvElew9G41OpDqzBRcfbdJmKXQ2HcroShutYJQRGUpAXHk24fy6JVkIU
|
||||
2cYUn22tYvElew9G41OpDqzBRcfbdJmKXQ2HcroShutYJQRGUpAXHk24fy6JVkIU
|
||||
ojF5U6cwextMja1ZIIZgh9eugIRUeIE7319nQNDzuXWjRCcoBLA25P7wnpHWDRpz
|
||||
D9ovXCIvdja74lL5psqobV6L5+fbLPkSgXoImKR0LQKCAgAIC9Jk8kxumCyIVGCP
|
||||
PeM5Uby9M3GMuKrfYsn0Y5e97+kSJF1dpojTodBgR2KQar6eVrvXt+8uZCcIjfx8
|
||||
@@ -98,4 +97,3 @@ TwEgE67iOb2iIoUpon/NyP4LesMzvdpsu2JFlfz13PmmQ34mFI7tWvOb3NA5DP3c
|
||||
rMlMLtKfp2w8HlMZpsUlToNCx6CI+tJrohzcs3BAVAbjFAXRKWGijB1rxwyDdHPv
|
||||
I+/wJTNaRNPQ1M0SwtEL/zJd21y3KSPn4eL+GP3efhlDSjtlDvZqkdAUsU8=
|
||||
-----END RSA PRIVATE KEY-----
|
||||
|
||||
+25
-24
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -8,25 +8,22 @@
|
||||
*/
|
||||
|
||||
#include <openssl/opensslconf.h>
|
||||
#ifdef OPENSSL_NO_RSA
|
||||
NON_EMPTY_TRANSLATION_UNIT
|
||||
#else
|
||||
|
||||
# include "apps.h"
|
||||
# include "progs.h"
|
||||
# include <string.h>
|
||||
# include <openssl/err.h>
|
||||
# include <openssl/pem.h>
|
||||
# include <openssl/rsa.h>
|
||||
#include "apps.h"
|
||||
#include "progs.h"
|
||||
#include <string.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/pem.h>
|
||||
#include <openssl/rsa.h>
|
||||
|
||||
# define RSA_SIGN 1
|
||||
# define RSA_VERIFY 2
|
||||
# define RSA_ENCRYPT 3
|
||||
# define RSA_DECRYPT 4
|
||||
#define RSA_SIGN 1
|
||||
#define RSA_VERIFY 2
|
||||
#define RSA_ENCRYPT 3
|
||||
#define RSA_DECRYPT 4
|
||||
|
||||
# define KEY_PRIVKEY 1
|
||||
# define KEY_PUBKEY 2
|
||||
# define KEY_CERT 3
|
||||
#define KEY_PRIVKEY 1
|
||||
#define KEY_PUBKEY 2
|
||||
#define KEY_CERT 3
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
@@ -34,7 +31,7 @@ typedef enum OPTION_choice {
|
||||
OPT_RSA_RAW, OPT_OAEP, OPT_SSL, OPT_PKCS, OPT_X931,
|
||||
OPT_SIGN, OPT_VERIFY, OPT_REV, OPT_ENCRYPT, OPT_DECRYPT,
|
||||
OPT_PUBIN, OPT_CERTIN, OPT_INKEY, OPT_PASSIN, OPT_KEYFORM,
|
||||
OPT_R_ENUM
|
||||
OPT_R_ENUM, OPT_PROV_ENUM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS rsautl_options[] = {
|
||||
@@ -44,14 +41,14 @@ const OPTIONS rsautl_options[] = {
|
||||
{"verify", OPT_VERIFY, '-', "Verify with public key"},
|
||||
{"encrypt", OPT_ENCRYPT, '-', "Encrypt with public key"},
|
||||
{"decrypt", OPT_DECRYPT, '-', "Decrypt with private key"},
|
||||
# ifndef OPENSSL_NO_ENGINE
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
{"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
|
||||
# endif
|
||||
#endif
|
||||
|
||||
OPT_SECTION("Input"),
|
||||
{"in", OPT_IN, '<', "Input file"},
|
||||
{"inkey", OPT_INKEY, 's', "Input key"},
|
||||
{"keyform", OPT_KEYFORM, 'E', "Private key format - default PEM"},
|
||||
{"keyform", OPT_KEYFORM, 'E', "Private key format (ENGINE, other values ignored)"},
|
||||
{"pubin", OPT_PUBIN, '-', "Input is an RSA public"},
|
||||
{"certin", OPT_CERTIN, '-', "Input is a cert carrying an RSA public key"},
|
||||
{"rev", OPT_REV, '-', "Reverse the order of the input buffer"},
|
||||
@@ -69,6 +66,7 @@ const OPTIONS rsautl_options[] = {
|
||||
{"hexdump", OPT_HEXDUMP, '-', "Hex dump output"},
|
||||
|
||||
OPT_R_OPTIONS,
|
||||
OPT_PROV_OPTIONS,
|
||||
{NULL}
|
||||
};
|
||||
|
||||
@@ -100,7 +98,7 @@ int rsautl_main(int argc, char **argv)
|
||||
ret = 0;
|
||||
goto end;
|
||||
case OPT_KEYFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_PDE, &keyformat))
|
||||
if (!opt_format(opt_arg(), OPT_FMT_ANY, &keyformat))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_IN:
|
||||
@@ -166,6 +164,10 @@ int rsautl_main(int argc, char **argv)
|
||||
if (!opt_rand(o))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_PROV_CASES:
|
||||
if (!opt_provider(o))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
@@ -192,7 +194,7 @@ int rsautl_main(int argc, char **argv)
|
||||
break;
|
||||
|
||||
case KEY_CERT:
|
||||
x = load_cert(keyfile, keyformat, "Certificate");
|
||||
x = load_cert(keyfile, FORMAT_UNDEF, "Certificate");
|
||||
if (x) {
|
||||
pkey = X509_get_pubkey(x);
|
||||
X509_free(x);
|
||||
@@ -285,4 +287,3 @@ int rsautl_main(int argc, char **argv)
|
||||
OPENSSL_free(passin);
|
||||
return ret;
|
||||
}
|
||||
#endif
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user