Source-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[src/trunk]: src/crypto/external/bsd/openssl/dist Import 1.1.1c:
details: https://anonhg.NetBSD.org/src/rev/498aef506d24
branches: trunk
changeset: 451873:498aef506d24
user: christos <christos%NetBSD.org@localhost>
date: Sun Jun 09 17:47:39 2019 +0000
description:
Import 1.1.1c:
Changes between 1.1.1b and 1.1.1c [28 May 2019]
*) Add build tests for C++. These are generated files that only do one
thing, to include one public OpenSSL head file each. This tests that
the public header files can be usefully included in a C++ application.
This test isn't enabled by default. It can be enabled with the option
'enable-buildtest-c++'.
[Richard Levitte]
*) Enable SHA3 pre-hashing for ECDSA and DSA.
[Patrick Steuer]
*) Change the default RSA, DSA and DH size to 2048 bit instead of 1024.
This changes the size when using the genpkey app when no size is given. It
fixes an omission in earlier changes that changed all RSA, DSA and DH
generation apps to use 2048 bits by default.
[Kurt Roeckx]
*) Reorganize the manual pages to consistently have RETURN VALUES,
EXAMPLES, SEE ALSO and HISTORY come in that order, and adjust
util/fix-doc-nits accordingly.
[Paul Yang, Joshua Lock]
*) Add the missing accessor EVP_PKEY_get0_engine()
[Matt Caswell]
*) Have apps like 's_client' and 's_server' output the signature scheme
along with other cipher suite parameters when debugging.
[Lorinczy Zsigmond]
*) Make OPENSSL_config() error agnostic again.
[Richard Levitte]
*) Do the error handling in RSA decryption constant time.
[Bernd Edlinger]
*) Prevent over long nonces in ChaCha20-Poly1305.
ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input
for every encryption operation. RFC 7539 specifies that the nonce value
(IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length
and front pads the nonce with 0 bytes if it is less than 12
bytes. However it also incorrectly allows a nonce to be set of up to 16
bytes. In this case only the last 12 bytes are significant and any
additional leading bytes are ignored.
It is a requirement of using this cipher that nonce values are
unique. Messages encrypted using a reused nonce value are susceptible to
serious confidentiality and integrity attacks. If an application changes
the default nonce length to be longer than 12 bytes and then makes a
change to the leading bytes of the nonce expecting the new value to be a
new unique nonce then such an application could inadvertently encrypt
messages with a reused nonce.
Additionally the ignored bytes in a long nonce are not covered by the
integrity guarantee of this cipher. Any application that relies on the
integrity of these ignored leading bytes of a long nonce may be further
affected. Any OpenSSL internal use of this cipher, including in SSL/TLS,
is safe because no such use sets such a long nonce value. However user
applications that use this cipher directly and set a non-default nonce
length to be longer than 12 bytes may be vulnerable.
This issue was reported to OpenSSL on 16th of March 2019 by Joran Dirk
Greef of Ronomon.
(CVE-2019-1543)
[Matt Caswell]
*) Ensure that SM2 only uses SM3 as digest algorithm
[Paul Yang]
diffstat:
crypto/external/bsd/openssl/dist/Configurations/unix-Makefile.tmpl | 8 +-
crypto/external/bsd/openssl/dist/Configurations/windows-makefile.tmpl | 3 +-
crypto/external/bsd/openssl/dist/INSTALL | 21 +-
crypto/external/bsd/openssl/dist/NOTES.PERL | 2 +-
crypto/external/bsd/openssl/dist/apps/asn1pars.c | 14 +-
crypto/external/bsd/openssl/dist/apps/cms.c | 3 +-
crypto/external/bsd/openssl/dist/apps/enc.c | 4 +-
crypto/external/bsd/openssl/dist/apps/s_cb.c | 108 +-
crypto/external/bsd/openssl/dist/crypto/aes/asm/aesp8-ppc.pl | 6 +-
crypto/external/bsd/openssl/dist/crypto/bio/b_addr.c | 6 +
crypto/external/bsd/openssl/dist/crypto/bio/bss_mem.c | 41 +-
crypto/external/bsd/openssl/dist/crypto/blake2/blake2b.c | 10 +-
crypto/external/bsd/openssl/dist/crypto/bn/asm/ppc.pl | 3 +-
crypto/external/bsd/openssl/dist/crypto/bn/bn_ctx.c | 2 +
crypto/external/bsd/openssl/dist/crypto/bn/bn_prime.c | 5 +-
crypto/external/bsd/openssl/dist/crypto/chacha/build.info | 2 +
crypto/external/bsd/openssl/dist/crypto/conf/conf_sap.c | 1 +
crypto/external/bsd/openssl/dist/crypto/dh/dh_check.c | 28 +-
crypto/external/bsd/openssl/dist/crypto/dh/dh_gen.c | 8 +-
crypto/external/bsd/openssl/dist/crypto/dh/dh_key.c | 8 +-
crypto/external/bsd/openssl/dist/crypto/dh/dh_pmeth.c | 4 +-
crypto/external/bsd/openssl/dist/crypto/dsa/dsa_gen.c | 8 +-
crypto/external/bsd/openssl/dist/crypto/dsa/dsa_ossl.c | 8 +-
crypto/external/bsd/openssl/dist/crypto/dsa/dsa_pmeth.c | 16 +-
crypto/external/bsd/openssl/dist/crypto/dso/dso_openssl.c | 4 +-
crypto/external/bsd/openssl/dist/crypto/dso/dso_win32.c | 110 +-
crypto/external/bsd/openssl/dist/crypto/ec/curve25519.c | 3 +-
crypto/external/bsd/openssl/dist/crypto/ec/curve448/curve448.c | 6 +-
crypto/external/bsd/openssl/dist/crypto/ec/curve448/curve448_tables.c | 1682 +-
crypto/external/bsd/openssl/dist/crypto/ec/curve448/curve448utils.h | 6 +-
crypto/external/bsd/openssl/dist/crypto/ec/curve448/f_generic.c | 8 +-
crypto/external/bsd/openssl/dist/crypto/ec/curve448/scalar.c | 20 +-
crypto/external/bsd/openssl/dist/crypto/ec/ec2_oct.c | 11 +-
crypto/external/bsd/openssl/dist/crypto/ec/ec_mult.c | 11 +-
crypto/external/bsd/openssl/dist/crypto/ec/ec_pmeth.c | 8 +-
crypto/external/bsd/openssl/dist/crypto/ec/ecdh_ossl.c | 7 +-
crypto/external/bsd/openssl/dist/crypto/ec/ecp_nistp521.c | 11 +-
crypto/external/bsd/openssl/dist/crypto/ec/ecp_nistz256.c | 3 +-
crypto/external/bsd/openssl/dist/crypto/err/err.c | 49 +-
crypto/external/bsd/openssl/dist/crypto/evp/digest.c | 5 +-
crypto/external/bsd/openssl/dist/crypto/evp/e_aria.c | 16 +-
crypto/external/bsd/openssl/dist/crypto/evp/e_chacha20_poly1305.c | 6 +-
crypto/external/bsd/openssl/dist/crypto/evp/p_lib.c | 7 +-
crypto/external/bsd/openssl/dist/crypto/evp/p_open.c | 4 +-
crypto/external/bsd/openssl/dist/crypto/include/internal/dso_conf.h.in | 7 +-
crypto/external/bsd/openssl/dist/crypto/init.c | 16 +-
crypto/external/bsd/openssl/dist/crypto/mips_arch.h | 4 +-
crypto/external/bsd/openssl/dist/crypto/modes/asm/ghash-x86_64.pl | 2 +
crypto/external/bsd/openssl/dist/crypto/modes/ccm128.c | 4 +-
crypto/external/bsd/openssl/dist/crypto/o_str.c | 27 +-
crypto/external/bsd/openssl/dist/crypto/objects/obj_dat.h | 4 +-
crypto/external/bsd/openssl/dist/crypto/objects/objects.txt | 2 +-
crypto/external/bsd/openssl/dist/crypto/ocsp/ocsp_ext.c | 6 +-
crypto/external/bsd/openssl/dist/crypto/ocsp/ocsp_lib.c | 6 +-
crypto/external/bsd/openssl/dist/crypto/pem/pem_sign.c | 4 +-
crypto/external/bsd/openssl/dist/crypto/poly1305/build.info | 1 +
crypto/external/bsd/openssl/dist/crypto/rand/drbg_lib.c | 6 +-
crypto/external/bsd/openssl/dist/crypto/rand/rand_lib.c | 12 +-
crypto/external/bsd/openssl/dist/crypto/rand/rand_vms.c | 6 +-
crypto/external/bsd/openssl/dist/crypto/rand/rand_win.c | 6 +-
crypto/external/bsd/openssl/dist/crypto/rc4/build.info | 2 +
crypto/external/bsd/openssl/dist/crypto/rsa/rsa_ameth.c | 6 +-
crypto/external/bsd/openssl/dist/crypto/rsa/rsa_ossl.c | 16 +-
crypto/external/bsd/openssl/dist/crypto/rsa/rsa_pmeth.c | 13 +-
crypto/external/bsd/openssl/dist/crypto/rsa/rsa_ssl.c | 57 +-
crypto/external/bsd/openssl/dist/crypto/rsa/rsa_x931g.c | 8 +-
crypto/external/bsd/openssl/dist/crypto/sha/keccak1600.c | 50 +-
crypto/external/bsd/openssl/dist/crypto/threads_win.c | 6 +-
crypto/external/bsd/openssl/dist/crypto/x509/x509_lu.c | 5 +-
crypto/external/bsd/openssl/dist/crypto/x509v3/v3_genn.c | 6 +-
crypto/external/bsd/openssl/dist/demos/pkcs12/pkread.c | 48 +-
crypto/external/bsd/openssl/dist/doc/man1/genpkey.pod | 10 +-
crypto/external/bsd/openssl/dist/doc/man1/pkeyutl.pod | 13 +-
crypto/external/bsd/openssl/dist/doc/man1/s_client.pod | 4 +-
crypto/external/bsd/openssl/dist/doc/man1/s_server.pod | 2 +-
crypto/external/bsd/openssl/dist/doc/man1/s_time.pod | 4 +-
crypto/external/bsd/openssl/dist/doc/man1/ts.pod | 7 +-
crypto/external/bsd/openssl/dist/doc/man3/ASN1_TIME_set.pod | 66 +-
crypto/external/bsd/openssl/dist/doc/man3/ASN1_generate_nconf.pod | 16 +-
crypto/external/bsd/openssl/dist/doc/man3/BIO_connect.pod | 14 +-
crypto/external/bsd/openssl/dist/doc/man3/BIO_push.pod | 16 +-
crypto/external/bsd/openssl/dist/doc/man3/BIO_s_file.pod | 38 +-
crypto/external/bsd/openssl/dist/doc/man3/BIO_s_mem.pod | 18 +-
crypto/external/bsd/openssl/dist/doc/man3/BN_CTX_start.pod | 3 +-
crypto/external/bsd/openssl/dist/doc/man3/BN_new.pod | 3 +-
crypto/external/bsd/openssl/dist/doc/man3/BN_rand.pod | 20 +-
crypto/external/bsd/openssl/dist/doc/man3/BN_security_bits.pod | 10 +-
crypto/external/bsd/openssl/dist/doc/man3/CMS_verify.pod | 4 +-
crypto/external/bsd/openssl/dist/doc/man3/CONF_modules_load_file.pod | 12 +-
crypto/external/bsd/openssl/dist/doc/man3/DES_random_key.pod | 12 +-
crypto/external/bsd/openssl/dist/doc/man3/ECDSA_SIG_new.pod | 4 +-
crypto/external/bsd/openssl/dist/doc/man3/EVP_DigestVerifyInit.pod | 6 +-
crypto/external/bsd/openssl/dist/doc/man3/EVP_EncryptInit.pod | 10 +-
crypto/external/bsd/openssl/dist/doc/man3/EVP_PKEY_meth_new.pod | 10 +-
crypto/external/bsd/openssl/dist/doc/man3/EVP_PKEY_set1_RSA.pod | 21 +-
crypto/external/bsd/openssl/dist/doc/man3/EVP_chacha20.pod | 12 +-
crypto/external/bsd/openssl/dist/doc/man3/HMAC.pod | 4 +-
crypto/external/bsd/openssl/dist/doc/man3/OBJ_nid2obj.pod | 24 +-
crypto/external/bsd/openssl/dist/doc/man3/OCSP_cert_to_id.pod | 6 +-
crypto/external/bsd/openssl/dist/doc/man3/PEM_read_bio_PrivateKey.pod | 142 +-
crypto/external/bsd/openssl/dist/doc/man3/RAND_DRBG_generate.pod | 10 +-
crypto/external/bsd/openssl/dist/doc/man3/RAND_DRBG_get0_master.pod | 11 +-
crypto/external/bsd/openssl/dist/doc/man3/RAND_DRBG_new.pod | 10 +-
crypto/external/bsd/openssl/dist/doc/man3/RAND_DRBG_reseed.pod | 17 +-
crypto/external/bsd/openssl/dist/doc/man3/RAND_DRBG_set_callbacks.pod | 11 +-
crypto/external/bsd/openssl/dist/doc/man3/RAND_add.pod | 12 +-
crypto/external/bsd/openssl/dist/doc/man3/RAND_bytes.pod | 20 +-
crypto/external/bsd/openssl/dist/doc/man3/RAND_cleanup.pod | 10 +-
crypto/external/bsd/openssl/dist/doc/man3/RSA_padding_add_PKCS1_type_1.pod | 60 +-
crypto/external/bsd/openssl/dist/doc/man3/RSA_public_encrypt.pod | 38 +-
crypto/external/bsd/openssl/dist/doc/man3/SSL_CIPHER_get_name.pod | 17 +-
crypto/external/bsd/openssl/dist/doc/man3/SSL_CONF_cmd.pod | 34 +-
crypto/external/bsd/openssl/dist/doc/man3/SSL_CTX_load_verify_locations.pod | 36 +-
crypto/external/bsd/openssl/dist/doc/man3/SSL_CTX_new.pod | 14 +-
crypto/external/bsd/openssl/dist/doc/man3/SSL_CTX_set1_sigalgs.pod | 10 +-
crypto/external/bsd/openssl/dist/doc/man3/SSL_CTX_set_client_hello_cb.pod | 4 +-
crypto/external/bsd/openssl/dist/doc/man3/SSL_CTX_set_default_passwd_cb.pod | 12 +-
crypto/external/bsd/openssl/dist/doc/man3/SSL_CTX_set_generate_session_id.pod | 18 +-
crypto/external/bsd/openssl/dist/doc/man3/SSL_CTX_set_min_proto_version.pod | 10 +-
crypto/external/bsd/openssl/dist/doc/man3/SSL_CTX_set_read_ahead.pod | 4 +-
crypto/external/bsd/openssl/dist/doc/man3/SSL_CTX_set_split_send_fragment.pod | 10 +-
crypto/external/bsd/openssl/dist/doc/man3/SSL_CTX_set_tlsext_ticket_key_cb.pod | 10 +-
crypto/external/bsd/openssl/dist/doc/man3/SSL_CTX_set_tmp_dh_callback.pod | 18 +-
crypto/external/bsd/openssl/dist/doc/man3/SSL_get_error.pod | 2 +-
crypto/external/bsd/openssl/dist/doc/man3/SSL_load_client_CA_file.pod | 32 +-
crypto/external/bsd/openssl/dist/doc/man3/SSL_read.pod | 10 +-
crypto/external/bsd/openssl/dist/doc/man3/SSL_session_reused.pod | 4 +-
crypto/external/bsd/openssl/dist/doc/man3/SSL_shutdown.pod | 2 +-
crypto/external/bsd/openssl/dist/doc/man3/SSL_write.pod | 10 +-
crypto/external/bsd/openssl/dist/doc/man3/X509_LOOKUP_meth_new.pod | 20 +-
crypto/external/bsd/openssl/dist/doc/man3/X509_NAME_add_entry_by_txt.pod | 20 +-
crypto/external/bsd/openssl/dist/doc/man3/X509_NAME_get_index_by_NID.pod | 26 +-
crypto/external/bsd/openssl/dist/doc/man3/X509_get_subject_name.pod | 18 +-
crypto/external/bsd/openssl/dist/doc/man3/d2i_X509.pod | 28 +-
crypto/external/bsd/openssl/dist/fuzz/oids.txt | 2 +-
crypto/external/bsd/openssl/dist/include/internal/dsoerr.h | 9 +-
crypto/external/bsd/openssl/dist/include/openssl/err.h | 3 +-
crypto/external/bsd/openssl/dist/include/openssl/evp.h | 1 +
crypto/external/bsd/openssl/dist/include/openssl/obj_mac.h | 2 +-
crypto/external/bsd/openssl/dist/include/openssl/ocsp.h | 6 +-
crypto/external/bsd/openssl/dist/include/openssl/opensslv.h | 6 +-
crypto/external/bsd/openssl/dist/include/openssl/ssl.h | 2 +-
crypto/external/bsd/openssl/dist/include/openssl/x509v3.h | 6 +-
crypto/external/bsd/openssl/dist/ssl/statem/extensions.c | 2 -
crypto/external/bsd/openssl/dist/ssl/statem/extensions_clnt.c | 38 +-
crypto/external/bsd/openssl/dist/ssl/statem/extensions_srvr.c | 6 +-
crypto/external/bsd/openssl/dist/ssl/statem/statem_clnt.c | 5 +-
crypto/external/bsd/openssl/dist/ssl/statem/statem_srvr.c | 4 +
crypto/external/bsd/openssl/dist/test/asn1_encode_test.c | 6 +-
crypto/external/bsd/openssl/dist/test/bio_memleak_test.c | 162 +-
crypto/external/bsd/openssl/dist/test/bioprinttest.c | 10 +-
crypto/external/bsd/openssl/dist/test/build.info | 16 +-
crypto/external/bsd/openssl/dist/test/ct_test.c | 6 +-
crypto/external/bsd/openssl/dist/test/ecdsatest.h | 10214 ++++
crypto/external/bsd/openssl/dist/test/ocspapitest.c | 84 +-
crypto/external/bsd/openssl/dist/test/recipes/15-test_rsapss.t | 10 +-
crypto/external/bsd/openssl/dist/test/recipes/30-test_evp.t | 4 +-
crypto/external/bsd/openssl/dist/test/recipes/30-test_evp_data/evpccmcavs.txt | 23927 ++++++++++
crypto/external/bsd/openssl/dist/test/recipes/30-test_evp_data/evpciph.txt | 85 +-
crypto/external/bsd/openssl/dist/test/recipes/30-test_evp_data/evpmac.txt | 10 +-
crypto/external/bsd/openssl/dist/test/recipes/80-test_cms.t | 10 +-
crypto/external/bsd/openssl/dist/util/cavs-to-evptest.pl | 121 +
crypto/external/bsd/openssl/dist/util/find-doc-nits | 23 +-
crypto/external/bsd/openssl/dist/util/libcrypto.num | 1 +
164 files changed, 37241 insertions(+), 1245 deletions(-)
diffs (truncated from 42044 to 300 lines):
diff -r 31b554faddf1 -r 498aef506d24 crypto/external/bsd/openssl/dist/Configurations/unix-Makefile.tmpl
--- a/crypto/external/bsd/openssl/dist/Configurations/unix-Makefile.tmpl Sun Jun 09 16:14:53 2019 +0000
+++ b/crypto/external/bsd/openssl/dist/Configurations/unix-Makefile.tmpl Sun Jun 09 17:47:39 2019 +0000
@@ -260,8 +260,8 @@
join(' ', $target{lib_cppflags} || (),
$target{shared_cppflag} || (),
(map { '-D'.$_ }
- @{$config{lib_defines}},
- @{$config{shared_defines}}),
+ @{$config{lib_defines} || ()},
+ @{$config{shared_defines} || ()}),
@{$config{lib_cppflags}},
@{$config{shared_cppflag}});
join(' ', $lib_cppflags,
@@ -285,6 +285,9 @@
LIB_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS)
DSO_CPPFLAGS={- join(' ', $target{dso_cppflags} || (),
$target{module_cppflags} || (),
+ (map { '-D'.$_ }
+ @{$config{dso_defines} || ()},
+ @{$config{module_defines} || ()}),
@{$config{dso_cppflags}},
@{$config{module_cppflags}},
'$(CNF_CPPFLAGS)', '$(CPPFLAGS)') -}
@@ -305,6 +308,7 @@
'$(CNF_LDFLAGS)', '$(LDFLAGS)') -}
DSO_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS)
BIN_CPPFLAGS={- join(' ', $target{bin_cppflags} || (),
+ (map { '-D'.$_ } @{$config{bin_defines} || ()}),
@{$config{bin_cppflags}},
'$(CNF_CPPFLAGS)', '$(CPPFLAGS)') -}
BIN_CFLAGS={- join(' ', $target{bin_cflags} || (),
diff -r 31b554faddf1 -r 498aef506d24 crypto/external/bsd/openssl/dist/Configurations/windows-makefile.tmpl
--- a/crypto/external/bsd/openssl/dist/Configurations/windows-makefile.tmpl Sun Jun 09 16:14:53 2019 +0000
+++ b/crypto/external/bsd/openssl/dist/Configurations/windows-makefile.tmpl Sun Jun 09 17:47:39 2019 +0000
@@ -187,6 +187,7 @@
ASFLAGS={- join(' ', @{$config{ASFLAGS}}) -}
RC={- $config{RC} -}
+RCFLAGS={- join(' ', @{$config{RCFLAGS}}) -}
ECHO="$(PERL)" "$(SRCDIR)\util\echo.pl"
@@ -586,7 +587,7 @@
if ($srcs[0] =~ /\.rc$/) {
return <<"EOF";
$args{obj}: $deps
- \$(RC) \$(RCOUTFLAG)\$\@ $srcs
+ \$(RC) \$(RCFLAGS) \$(RCOUTFLAG)\$\@ $srcs
EOF
}
(my $obj = $args{obj}) =~ s|\.o$||;
diff -r 31b554faddf1 -r 498aef506d24 crypto/external/bsd/openssl/dist/INSTALL
--- a/crypto/external/bsd/openssl/dist/INSTALL Sun Jun 09 16:14:53 2019 +0000
+++ b/crypto/external/bsd/openssl/dist/INSTALL Sun Jun 09 17:47:39 2019 +0000
@@ -287,6 +287,19 @@
Typically OpenSSL will automatically load a system config
file which configures default ssl options.
+ enable-buildtest-c++
+ While testing, generate C++ buildtest files that
+ simply check that the public OpenSSL header files
+ are usable standalone with C++.
+
+ Enabling this option demands extra care. For any
+ compiler flag given directly as configuration
+ option, you must ensure that it's valid for both
+ the C and the C++ compiler. If not, the C++ build
+ test will most likely break. As an alternative,
+ you can use the language specific variables, CFLAGS
+ and CXXFLAGS.
+
no-capieng
Don't build the CAPI engine. This option will be forced if
on a platform that does not support CAPI.
@@ -331,9 +344,6 @@
on BSD implementations, in which case it can be disabled with
no-devcryptoeng.
- no-dso
- Don't build support for loading Dynamic Shared Objects.
-
no-dynamic-engine
Don't build the dynamically loaded engines. This only has an
effect in a "shared" build
@@ -665,6 +675,11 @@
CC=gcc CROSS_COMPILE=x86_64-w64-mingw32- \
./config -DCOOKIE
+ If CC is set, it is advisable to also set CXX to ensure
+ both C and C++ compilers are in the same "family". This
+ becomes relevant with 'enable-external-tests' and
+ 'enable-buildtest-c++'.
+
reconf
reconfigure
Reconfigure from earlier data. This fetches the previous
diff -r 31b554faddf1 -r 498aef506d24 crypto/external/bsd/openssl/dist/NOTES.PERL
--- a/crypto/external/bsd/openssl/dist/NOTES.PERL Sun Jun 09 16:14:53 2019 +0000
+++ b/crypto/external/bsd/openssl/dist/NOTES.PERL Sun Jun 09 17:47:39 2019 +0000
@@ -78,7 +78,7 @@
---------------------------------
There are a number of ways to install a perl module. In all
- descriptions below, Text::Template will server as an example.
+ descriptions below, Text::Template will serve as an example.
1. for Linux users, the easiest is to install with the use of your
favorite package manager. Usually, all you need to do is search
diff -r 31b554faddf1 -r 498aef506d24 crypto/external/bsd/openssl/dist/apps/asn1pars.c
--- a/crypto/external/bsd/openssl/dist/apps/asn1pars.c Sun Jun 09 16:14:53 2019 +0000
+++ b/crypto/external/bsd/openssl/dist/apps/asn1pars.c Sun Jun 09 17:47:39 2019 +0000
@@ -1,5 +1,5 @@
/*
- * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -170,17 +170,17 @@
if (derfile && (derout = bio_open_default(derfile, 'w', FORMAT_ASN1)) == NULL)
goto end;
+ if ((buf = BUF_MEM_new()) == NULL)
+ goto end;
if (strictpem) {
- if (PEM_read_bio(in, &name, &header, &str, &num) !=
- 1) {
+ if (PEM_read_bio(in, &name, &header, &str, &num) != 1) {
BIO_printf(bio_err, "Error reading PEM file\n");
ERR_print_errors(bio_err);
goto end;
}
+ buf->data = (char *)str;
+ buf->length = buf->max = num;
} else {
-
- if ((buf = BUF_MEM_new()) == NULL)
- goto end;
if (!BUF_MEM_grow(buf, BUFSIZ * 8))
goto end; /* Pre-allocate :-) */
@@ -303,8 +303,6 @@
BUF_MEM_free(buf);
OPENSSL_free(name);
OPENSSL_free(header);
- if (strictpem)
- OPENSSL_free(str);
ASN1_TYPE_free(at);
sk_OPENSSL_STRING_free(osk);
return ret;
diff -r 31b554faddf1 -r 498aef506d24 crypto/external/bsd/openssl/dist/apps/cms.c
--- a/crypto/external/bsd/openssl/dist/apps/cms.c Sun Jun 09 16:14:53 2019 +0000
+++ b/crypto/external/bsd/openssl/dist/apps/cms.c Sun Jun 09 17:47:39 2019 +0000
@@ -1,5 +1,5 @@
/*
- * Copyright 2008-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2008-2019 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -636,6 +636,7 @@
goto opthelp;
}
} else if (!operation) {
+ BIO_printf(bio_err, "No operation option (-encrypt|-decrypt|-sign|-verify|...) specified.\n");
goto opthelp;
}
diff -r 31b554faddf1 -r 498aef506d24 crypto/external/bsd/openssl/dist/apps/enc.c
--- a/crypto/external/bsd/openssl/dist/apps/enc.c Sun Jun 09 16:14:53 2019 +0000
+++ b/crypto/external/bsd/openssl/dist/apps/enc.c Sun Jun 09 17:47:39 2019 +0000
@@ -1,5 +1,5 @@
/*
- * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -500,7 +500,7 @@
if (hiv != NULL) {
int siz = EVP_CIPHER_iv_length(cipher);
if (siz == 0) {
- BIO_printf(bio_err, "warning: iv not use by this cipher\n");
+ BIO_printf(bio_err, "warning: iv not used by this cipher\n");
} else if (!set_hex(hiv, iv, siz)) {
BIO_printf(bio_err, "invalid hex iv value\n");
goto end;
diff -r 31b554faddf1 -r 498aef506d24 crypto/external/bsd/openssl/dist/apps/s_cb.c
--- a/crypto/external/bsd/openssl/dist/apps/s_cb.c Sun Jun 09 16:14:53 2019 +0000
+++ b/crypto/external/bsd/openssl/dist/apps/s_cb.c Sun Jun 09 17:47:39 2019 +0000
@@ -683,6 +683,53 @@
{NULL}
};
+/* from rfc8446 4.2.3. + gost (https://tools.ietf.org/id/draft-smyshlyaev-tls12-gost-suites-04.html) */
+static STRINT_PAIR signature_tls13_scheme_list[] = {
+ {"rsa_pkcs1_sha1", 0x0201 /* TLSEXT_SIGALG_rsa_pkcs1_sha1 */},
+ {"ecdsa_sha1", 0x0203 /* TLSEXT_SIGALG_ecdsa_sha1 */},
+/* {"rsa_pkcs1_sha224", 0x0301 TLSEXT_SIGALG_rsa_pkcs1_sha224}, not in rfc8446 */
+/* {"ecdsa_sha224", 0x0303 TLSEXT_SIGALG_ecdsa_sha224} not in rfc8446 */
+ {"rsa_pkcs1_sha256", 0x0401 /* TLSEXT_SIGALG_rsa_pkcs1_sha256 */},
+ {"ecdsa_secp256r1_sha256", 0x0403 /* TLSEXT_SIGALG_ecdsa_secp256r1_sha256 */},
+ {"rsa_pkcs1_sha384", 0x0501 /* TLSEXT_SIGALG_rsa_pkcs1_sha384 */},
+ {"ecdsa_secp384r1_sha384", 0x0503 /* TLSEXT_SIGALG_ecdsa_secp384r1_sha384 */},
+ {"rsa_pkcs1_sha512", 0x0601 /* TLSEXT_SIGALG_rsa_pkcs1_sha512 */},
+ {"ecdsa_secp521r1_sha512", 0x0603 /* TLSEXT_SIGALG_ecdsa_secp521r1_sha512 */},
+ {"rsa_pss_rsae_sha256", 0x0804 /* TLSEXT_SIGALG_rsa_pss_rsae_sha256 */},
+ {"rsa_pss_rsae_sha384", 0x0805 /* TLSEXT_SIGALG_rsa_pss_rsae_sha384 */},
+ {"rsa_pss_rsae_sha512", 0x0806 /* TLSEXT_SIGALG_rsa_pss_rsae_sha512 */},
+ {"ed25519", 0x0807 /* TLSEXT_SIGALG_ed25519 */},
+ {"ed448", 0x0808 /* TLSEXT_SIGALG_ed448 */},
+ {"rsa_pss_pss_sha256", 0x0809 /* TLSEXT_SIGALG_rsa_pss_pss_sha256 */},
+ {"rsa_pss_pss_sha384", 0x080a /* TLSEXT_SIGALG_rsa_pss_pss_sha384 */},
+ {"rsa_pss_pss_sha512", 0x080b /* TLSEXT_SIGALG_rsa_pss_pss_sha512 */},
+ {"gostr34102001", 0xeded /* TLSEXT_SIGALG_gostr34102001_gostr3411 */},
+ {"gostr34102012_256", 0xeeee /* TLSEXT_SIGALG_gostr34102012_256_gostr34112012_256 */},
+ {"gostr34102012_512", 0xefef /* TLSEXT_SIGALG_gostr34102012_512_gostr34112012_512 */},
+ {NULL}
+};
+
+/* from rfc5246 7.4.1.4.1. */
+static STRINT_PAIR signature_tls12_alg_list[] = {
+ {"anonymous", TLSEXT_signature_anonymous /* 0 */},
+ {"RSA", TLSEXT_signature_rsa /* 1 */},
+ {"DSA", TLSEXT_signature_dsa /* 2 */},
+ {"ECDSA", TLSEXT_signature_ecdsa /* 3 */},
+ {NULL}
+};
+
+/* from rfc5246 7.4.1.4.1. */
+static STRINT_PAIR signature_tls12_hash_list[] = {
+ {"none", TLSEXT_hash_none /* 0 */},
+ {"MD5", TLSEXT_hash_md5 /* 1 */},
+ {"SHA1", TLSEXT_hash_sha1 /* 2 */},
+ {"SHA224", TLSEXT_hash_sha224 /* 3 */},
+ {"SHA256", TLSEXT_hash_sha256 /* 4 */},
+ {"SHA384", TLSEXT_hash_sha384 /* 5 */},
+ {"SHA512", TLSEXT_hash_sha512 /* 6 */},
+ {NULL}
+};
+
void tlsext_cb(SSL *s, int client_server, int type,
const unsigned char *data, int len, void *arg)
{
@@ -1282,9 +1329,9 @@
{"Supported Curve", SSL_SECOP_CURVE_SUPPORTED},
{"Shared Curve", SSL_SECOP_CURVE_SHARED},
{"Check Curve", SSL_SECOP_CURVE_CHECK},
- {"Supported Signature Algorithm digest", SSL_SECOP_SIGALG_SUPPORTED},
- {"Shared Signature Algorithm digest", SSL_SECOP_SIGALG_SHARED},
- {"Check Signature Algorithm digest", SSL_SECOP_SIGALG_CHECK},
+ {"Supported Signature Algorithm", SSL_SECOP_SIGALG_SUPPORTED},
+ {"Shared Signature Algorithm", SSL_SECOP_SIGALG_SHARED},
+ {"Check Signature Algorithm", SSL_SECOP_SIGALG_CHECK},
{"Signature Algorithm mask", SSL_SECOP_SIGALG_MASK},
{"Certificate chain EE key", SSL_SECOP_EE_KEY},
{"Certificate chain CA key", SSL_SECOP_CA_KEY},
@@ -1304,29 +1351,37 @@
security_debug_ex *sdb = ex;
int rv, show_bits = 1, cert_md = 0;
const char *nm;
+ int show_nm;
rv = sdb->old_cb(s, ctx, op, bits, nid, other, ex);
if (rv == 1 && sdb->verbose < 2)
return 1;
BIO_puts(sdb->out, "Security callback: ");
nm = lookup(op, callback_types, NULL);
+ show_nm = nm != NULL;
switch (op) {
case SSL_SECOP_TICKET:
case SSL_SECOP_COMPRESSION:
show_bits = 0;
- nm = NULL;
+ show_nm = 0;
break;
case SSL_SECOP_VERSION:
BIO_printf(sdb->out, "Version=%s", lookup(nid, ssl_versions, "???"));
show_bits = 0;
- nm = NULL;
+ show_nm = 0;
break;
case SSL_SECOP_CA_MD:
case SSL_SECOP_PEER_CA_MD:
cert_md = 1;
break;
+ case SSL_SECOP_SIGALG_SUPPORTED:
+ case SSL_SECOP_SIGALG_SHARED:
+ case SSL_SECOP_SIGALG_CHECK:
+ case SSL_SECOP_SIGALG_MASK:
+ show_nm = 0;
+ break;
}
- if (nm != NULL)
+ if (show_nm)
BIO_printf(sdb->out, "%s=", nm);
switch (op & SSL_SECOP_OTHER_TYPE) {
@@ -1373,27 +1428,28 @@
Home |
Main Index |
Thread Index |
Old Index