forked from rpms/openssl
import openssl-1.1.1k-4.el8
This commit is contained in:
parent
8a0a42455c
commit
656994e381
2
.gitignore
vendored
2
.gitignore
vendored
@ -1 +1 @@
|
|||||||
SOURCES/openssl-1.1.1g-hobbled.tar.xz
|
SOURCES/openssl-1.1.1k-hobbled.tar.xz
|
||||||
|
@ -1 +1 @@
|
|||||||
b55517bdc9aa61627a9896c1a3a156d5f6a4348f SOURCES/openssl-1.1.1g-hobbled.tar.xz
|
6fde639a66329f2cd9135eb192f2228f2a402c0e SOURCES/openssl-1.1.1k-hobbled.tar.xz
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
/*
|
/*
|
||||||
* Copyright 2001-2019 The OpenSSL Project Authors. All Rights Reserved.
|
* Copyright 2001-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||||
* Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
|
* Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
|
||||||
*
|
*
|
||||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||||
@ -1425,6 +1425,87 @@ static int ec_point_hex2point_test(int id)
|
|||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* check the EC_METHOD respects the supplied EC_GROUP_set_generator G
|
||||||
|
*/
|
||||||
|
static int custom_generator_test(int id)
|
||||||
|
{
|
||||||
|
int ret = 0, nid, bsize;
|
||||||
|
EC_GROUP *group = NULL;
|
||||||
|
EC_POINT *G2 = NULL, *Q1 = NULL, *Q2 = NULL;
|
||||||
|
BN_CTX *ctx = NULL;
|
||||||
|
BIGNUM *k = NULL;
|
||||||
|
unsigned char *b1 = NULL, *b2 = NULL;
|
||||||
|
|
||||||
|
/* Do some setup */
|
||||||
|
nid = curves[id].nid;
|
||||||
|
TEST_note("Curve %s", OBJ_nid2sn(nid));
|
||||||
|
if (!TEST_ptr(ctx = BN_CTX_new()))
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
BN_CTX_start(ctx);
|
||||||
|
|
||||||
|
if (!TEST_ptr(group = EC_GROUP_new_by_curve_name(nid)))
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
/* expected byte length of encoded points */
|
||||||
|
bsize = (EC_GROUP_get_degree(group) + 7) / 8;
|
||||||
|
bsize = 2 * bsize + 1;
|
||||||
|
|
||||||
|
if (!TEST_ptr(k = BN_CTX_get(ctx))
|
||||||
|
/* fetch a testing scalar k != 0,1 */
|
||||||
|
|| !TEST_true(BN_rand(k, EC_GROUP_order_bits(group) - 1,
|
||||||
|
BN_RAND_TOP_ONE, BN_RAND_BOTTOM_ANY))
|
||||||
|
/* make k even */
|
||||||
|
|| !TEST_true(BN_clear_bit(k, 0))
|
||||||
|
|| !TEST_ptr(G2 = EC_POINT_new(group))
|
||||||
|
|| !TEST_ptr(Q1 = EC_POINT_new(group))
|
||||||
|
/* Q1 := kG */
|
||||||
|
|| !TEST_true(EC_POINT_mul(group, Q1, k, NULL, NULL, ctx))
|
||||||
|
/* pull out the bytes of that */
|
||||||
|
|| !TEST_int_eq(EC_POINT_point2oct(group, Q1,
|
||||||
|
POINT_CONVERSION_UNCOMPRESSED, NULL,
|
||||||
|
0, ctx), bsize)
|
||||||
|
|| !TEST_ptr(b1 = OPENSSL_malloc(bsize))
|
||||||
|
|| !TEST_int_eq(EC_POINT_point2oct(group, Q1,
|
||||||
|
POINT_CONVERSION_UNCOMPRESSED, b1,
|
||||||
|
bsize, ctx), bsize)
|
||||||
|
/* new generator is G2 := 2G */
|
||||||
|
|| !TEST_true(EC_POINT_dbl(group, G2, EC_GROUP_get0_generator(group),
|
||||||
|
ctx))
|
||||||
|
|| !TEST_true(EC_GROUP_set_generator(group, G2,
|
||||||
|
EC_GROUP_get0_order(group),
|
||||||
|
EC_GROUP_get0_cofactor(group)))
|
||||||
|
|| !TEST_ptr(Q2 = EC_POINT_new(group))
|
||||||
|
|| !TEST_true(BN_rshift1(k, k))
|
||||||
|
/* Q2 := k/2 G2 */
|
||||||
|
|| !TEST_true(EC_POINT_mul(group, Q2, k, NULL, NULL, ctx))
|
||||||
|
|| !TEST_int_eq(EC_POINT_point2oct(group, Q2,
|
||||||
|
POINT_CONVERSION_UNCOMPRESSED, NULL,
|
||||||
|
0, ctx), bsize)
|
||||||
|
|| !TEST_ptr(b2 = OPENSSL_malloc(bsize))
|
||||||
|
|| !TEST_int_eq(EC_POINT_point2oct(group, Q2,
|
||||||
|
POINT_CONVERSION_UNCOMPRESSED, b2,
|
||||||
|
bsize, ctx), bsize)
|
||||||
|
/* Q1 = kG = k/2 G2 = Q2 should hold */
|
||||||
|
|| !TEST_int_eq(CRYPTO_memcmp(b1, b2, bsize), 0))
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
ret = 1;
|
||||||
|
|
||||||
|
err:
|
||||||
|
BN_CTX_end(ctx);
|
||||||
|
EC_POINT_free(Q1);
|
||||||
|
EC_POINT_free(Q2);
|
||||||
|
EC_POINT_free(G2);
|
||||||
|
EC_GROUP_free(group);
|
||||||
|
BN_CTX_free(ctx);
|
||||||
|
OPENSSL_free(b1);
|
||||||
|
OPENSSL_free(b2);
|
||||||
|
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
|
||||||
#endif /* OPENSSL_NO_EC */
|
#endif /* OPENSSL_NO_EC */
|
||||||
|
|
||||||
int setup_tests(void)
|
int setup_tests(void)
|
||||||
@ -1452,6 +1533,7 @@ int setup_tests(void)
|
|||||||
|
|
||||||
ADD_ALL_TESTS(check_named_curve_from_ecparameters, crv_len);
|
ADD_ALL_TESTS(check_named_curve_from_ecparameters, crv_len);
|
||||||
ADD_ALL_TESTS(ec_point_hex2point_test, crv_len);
|
ADD_ALL_TESTS(ec_point_hex2point_test, crv_len);
|
||||||
|
ADD_ALL_TESTS(custom_generator_test, crv_len);
|
||||||
#endif /* OPENSSL_NO_EC */
|
#endif /* OPENSSL_NO_EC */
|
||||||
return 1;
|
return 1;
|
||||||
}
|
}
|
||||||
|
@ -1,11 +0,0 @@
|
|||||||
diff -up openssl-1.1.0-pre5/crypto/x509/x509_cmp.c.issuer-hash openssl-1.1.0-pre5/crypto/x509/x509_cmp.c
|
|
||||||
--- openssl-1.1.0-pre5/crypto/x509/x509_cmp.c.issuer-hash 2016-07-18 15:16:32.788881100 +0200
|
|
||||||
+++ openssl-1.1.0-pre5/crypto/x509/x509_cmp.c 2016-07-18 15:17:16.671871840 +0200
|
|
||||||
@@ -87,6 +87,7 @@ unsigned long X509_issuer_and_serial_has
|
|
||||||
|
|
||||||
if (ctx == NULL)
|
|
||||||
goto err;
|
|
||||||
+ EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
|
|
||||||
f = X509_NAME_oneline(a->cert_info.issuer, NULL, 0);
|
|
||||||
if (!EVP_DigestInit_ex(ctx, EVP_md5(), NULL))
|
|
||||||
goto err;
|
|
@ -1,713 +0,0 @@
|
|||||||
diff --git a/crypto/asn1/asn1_err.c b/crypto/asn1/asn1_err.c
|
|
||||||
index 613f9ae713..cc0a59ca4c 100644
|
|
||||||
--- a/crypto/asn1/asn1_err.c
|
|
||||||
+++ b/crypto/asn1/asn1_err.c
|
|
||||||
@@ -1,6 +1,6 @@
|
|
||||||
/*
|
|
||||||
* Generated by util/mkerr.pl DO NOT EDIT
|
|
||||||
- * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
|
||||||
+ * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
|
||||||
*
|
|
||||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
|
||||||
* this file except in compliance with the License. You can obtain a copy
|
|
||||||
@@ -49,6 +49,7 @@ static const ERR_STRING_DATA ASN1_str_functs[] = {
|
|
||||||
"asn1_item_embed_d2i"},
|
|
||||||
{ERR_PACK(ERR_LIB_ASN1, ASN1_F_ASN1_ITEM_EMBED_NEW, 0),
|
|
||||||
"asn1_item_embed_new"},
|
|
||||||
+ {ERR_PACK(ERR_LIB_ASN1, ASN1_F_ASN1_ITEM_EX_I2D, 0), "ASN1_item_ex_i2d"},
|
|
||||||
{ERR_PACK(ERR_LIB_ASN1, ASN1_F_ASN1_ITEM_FLAGS_I2D, 0),
|
|
||||||
"asn1_item_flags_i2d"},
|
|
||||||
{ERR_PACK(ERR_LIB_ASN1, ASN1_F_ASN1_ITEM_I2D_BIO, 0), "ASN1_item_i2d_bio"},
|
|
||||||
@@ -160,6 +161,7 @@ static const ERR_STRING_DATA ASN1_str_reasons[] = {
|
|
||||||
"asn1 sig parse error"},
|
|
||||||
{ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_AUX_ERROR), "aux error"},
|
|
||||||
{ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_BAD_OBJECT_HEADER), "bad object header"},
|
|
||||||
+ {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_BAD_TEMPLATE), "bad template"},
|
|
||||||
{ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_BMPSTRING_IS_WRONG_LENGTH),
|
|
||||||
"bmpstring is wrong length"},
|
|
||||||
{ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_BN_LIB), "bn lib"},
|
|
||||||
diff --git a/crypto/asn1/tasn_dec.c b/crypto/asn1/tasn_dec.c
|
|
||||||
index 2332b204ed..1021705f43 100644
|
|
||||||
--- a/crypto/asn1/tasn_dec.c
|
|
||||||
+++ b/crypto/asn1/tasn_dec.c
|
|
||||||
@@ -182,6 +182,15 @@ static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
|
|
||||||
tag, aclass, opt, ctx);
|
|
||||||
|
|
||||||
case ASN1_ITYPE_MSTRING:
|
|
||||||
+ /*
|
|
||||||
+ * It never makes sense for multi-strings to have implicit tagging, so
|
|
||||||
+ * if tag != -1, then this looks like an error in the template.
|
|
||||||
+ */
|
|
||||||
+ if (tag != -1) {
|
|
||||||
+ ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_BAD_TEMPLATE);
|
|
||||||
+ goto err;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
p = *in;
|
|
||||||
/* Just read in tag and class */
|
|
||||||
ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,
|
|
||||||
@@ -199,6 +208,7 @@ static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
|
|
||||||
ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_MSTRING_NOT_UNIVERSAL);
|
|
||||||
goto err;
|
|
||||||
}
|
|
||||||
+
|
|
||||||
/* Check tag matches bit map */
|
|
||||||
if (!(ASN1_tag2bit(otag) & it->utype)) {
|
|
||||||
/* If OPTIONAL, assume this is OK */
|
|
||||||
@@ -215,6 +225,15 @@ static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
|
|
||||||
return ef->asn1_ex_d2i(pval, in, len, it, tag, aclass, opt, ctx);
|
|
||||||
|
|
||||||
case ASN1_ITYPE_CHOICE:
|
|
||||||
+ /*
|
|
||||||
+ * It never makes sense for CHOICE types to have implicit tagging, so
|
|
||||||
+ * if tag != -1, then this looks like an error in the template.
|
|
||||||
+ */
|
|
||||||
+ if (tag != -1) {
|
|
||||||
+ ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_BAD_TEMPLATE);
|
|
||||||
+ goto err;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it, NULL))
|
|
||||||
goto auxerr;
|
|
||||||
if (*pval) {
|
|
||||||
diff --git a/crypto/asn1/tasn_enc.c b/crypto/asn1/tasn_enc.c
|
|
||||||
index d600c7a538..52a051d5b1 100644
|
|
||||||
--- a/crypto/asn1/tasn_enc.c
|
|
||||||
+++ b/crypto/asn1/tasn_enc.c
|
|
||||||
@@ -103,9 +103,25 @@ int ASN1_item_ex_i2d(ASN1_VALUE **pval, unsigned char **out,
|
|
||||||
return asn1_i2d_ex_primitive(pval, out, it, tag, aclass);
|
|
||||||
|
|
||||||
case ASN1_ITYPE_MSTRING:
|
|
||||||
+ /*
|
|
||||||
+ * It never makes sense for multi-strings to have implicit tagging, so
|
|
||||||
+ * if tag != -1, then this looks like an error in the template.
|
|
||||||
+ */
|
|
||||||
+ if (tag != -1) {
|
|
||||||
+ ASN1err(ASN1_F_ASN1_ITEM_EX_I2D, ASN1_R_BAD_TEMPLATE);
|
|
||||||
+ return -1;
|
|
||||||
+ }
|
|
||||||
return asn1_i2d_ex_primitive(pval, out, it, -1, aclass);
|
|
||||||
|
|
||||||
case ASN1_ITYPE_CHOICE:
|
|
||||||
+ /*
|
|
||||||
+ * It never makes sense for CHOICE types to have implicit tagging, so
|
|
||||||
+ * if tag != -1, then this looks like an error in the template.
|
|
||||||
+ */
|
|
||||||
+ if (tag != -1) {
|
|
||||||
+ ASN1err(ASN1_F_ASN1_ITEM_EX_I2D, ASN1_R_BAD_TEMPLATE);
|
|
||||||
+ return -1;
|
|
||||||
+ }
|
|
||||||
if (asn1_cb && !asn1_cb(ASN1_OP_I2D_PRE, pval, it, NULL))
|
|
||||||
return 0;
|
|
||||||
i = asn1_get_choice_selector(pval, it);
|
|
||||||
diff --git a/crypto/err/openssl.txt b/crypto/err/openssl.txt
|
|
||||||
index 0b5873ebbc..815460b24f 100644
|
|
||||||
--- a/crypto/err/openssl.txt
|
|
||||||
+++ b/crypto/err/openssl.txt
|
|
||||||
@@ -36,6 +36,7 @@ ASN1_F_ASN1_ITEM_D2I_FP:206:ASN1_item_d2i_fp
|
|
||||||
ASN1_F_ASN1_ITEM_DUP:191:ASN1_item_dup
|
|
||||||
ASN1_F_ASN1_ITEM_EMBED_D2I:120:asn1_item_embed_d2i
|
|
||||||
ASN1_F_ASN1_ITEM_EMBED_NEW:121:asn1_item_embed_new
|
|
||||||
+ASN1_F_ASN1_ITEM_EX_I2D:144:ASN1_item_ex_i2d
|
|
||||||
ASN1_F_ASN1_ITEM_FLAGS_I2D:118:asn1_item_flags_i2d
|
|
||||||
ASN1_F_ASN1_ITEM_I2D_BIO:192:ASN1_item_i2d_bio
|
|
||||||
ASN1_F_ASN1_ITEM_I2D_FP:193:ASN1_item_i2d_fp
|
|
||||||
@@ -1771,6 +1772,7 @@ ASN1_R_ASN1_PARSE_ERROR:203:asn1 parse error
|
|
||||||
ASN1_R_ASN1_SIG_PARSE_ERROR:204:asn1 sig parse error
|
|
||||||
ASN1_R_AUX_ERROR:100:aux error
|
|
||||||
ASN1_R_BAD_OBJECT_HEADER:102:bad object header
|
|
||||||
+ASN1_R_BAD_TEMPLATE:230:bad template
|
|
||||||
ASN1_R_BMPSTRING_IS_WRONG_LENGTH:214:bmpstring is wrong length
|
|
||||||
ASN1_R_BN_LIB:105:bn lib
|
|
||||||
ASN1_R_BOOLEAN_IS_WRONG_LENGTH:106:boolean is wrong length
|
|
||||||
diff --git a/crypto/x509v3/v3_genn.c b/crypto/x509v3/v3_genn.c
|
|
||||||
index 23e3bc4565..6f0a347cce 100644
|
|
||||||
--- a/crypto/x509v3/v3_genn.c
|
|
||||||
+++ b/crypto/x509v3/v3_genn.c
|
|
||||||
@@ -22,8 +22,9 @@ ASN1_SEQUENCE(OTHERNAME) = {
|
|
||||||
IMPLEMENT_ASN1_FUNCTIONS(OTHERNAME)
|
|
||||||
|
|
||||||
ASN1_SEQUENCE(EDIPARTYNAME) = {
|
|
||||||
- ASN1_IMP_OPT(EDIPARTYNAME, nameAssigner, DIRECTORYSTRING, 0),
|
|
||||||
- ASN1_IMP_OPT(EDIPARTYNAME, partyName, DIRECTORYSTRING, 1)
|
|
||||||
+ /* DirectoryString is a CHOICE type so use explicit tagging */
|
|
||||||
+ ASN1_EXP_OPT(EDIPARTYNAME, nameAssigner, DIRECTORYSTRING, 0),
|
|
||||||
+ ASN1_EXP(EDIPARTYNAME, partyName, DIRECTORYSTRING, 1)
|
|
||||||
} ASN1_SEQUENCE_END(EDIPARTYNAME)
|
|
||||||
|
|
||||||
IMPLEMENT_ASN1_FUNCTIONS(EDIPARTYNAME)
|
|
||||||
@@ -57,6 +58,37 @@ GENERAL_NAME *GENERAL_NAME_dup(GENERAL_NAME *a)
|
|
||||||
(char *)a);
|
|
||||||
}
|
|
||||||
|
|
||||||
+static int edipartyname_cmp(const EDIPARTYNAME *a, const EDIPARTYNAME *b)
|
|
||||||
+{
|
|
||||||
+ int res;
|
|
||||||
+
|
|
||||||
+ if (a == NULL || b == NULL) {
|
|
||||||
+ /*
|
|
||||||
+ * Shouldn't be possible in a valid GENERAL_NAME, but we handle it
|
|
||||||
+ * anyway. OTHERNAME_cmp treats NULL != NULL so we do the same here
|
|
||||||
+ */
|
|
||||||
+ return -1;
|
|
||||||
+ }
|
|
||||||
+ if (a->nameAssigner == NULL && b->nameAssigner != NULL)
|
|
||||||
+ return -1;
|
|
||||||
+ if (a->nameAssigner != NULL && b->nameAssigner == NULL)
|
|
||||||
+ return 1;
|
|
||||||
+ /* If we get here then both have nameAssigner set, or both unset */
|
|
||||||
+ if (a->nameAssigner != NULL) {
|
|
||||||
+ res = ASN1_STRING_cmp(a->nameAssigner, b->nameAssigner);
|
|
||||||
+ if (res != 0)
|
|
||||||
+ return res;
|
|
||||||
+ }
|
|
||||||
+ /*
|
|
||||||
+ * partyName is required, so these should never be NULL. We treat it in
|
|
||||||
+ * the same way as the a == NULL || b == NULL case above
|
|
||||||
+ */
|
|
||||||
+ if (a->partyName == NULL || b->partyName == NULL)
|
|
||||||
+ return -1;
|
|
||||||
+
|
|
||||||
+ return ASN1_STRING_cmp(a->partyName, b->partyName);
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
/* Returns 0 if they are equal, != 0 otherwise. */
|
|
||||||
int GENERAL_NAME_cmp(GENERAL_NAME *a, GENERAL_NAME *b)
|
|
||||||
{
|
|
||||||
@@ -66,8 +98,11 @@ int GENERAL_NAME_cmp(GENERAL_NAME *a, GENERAL_NAME *b)
|
|
||||||
return -1;
|
|
||||||
switch (a->type) {
|
|
||||||
case GEN_X400:
|
|
||||||
+ result = ASN1_TYPE_cmp(a->d.x400Address, b->d.x400Address);
|
|
||||||
+ break;
|
|
||||||
+
|
|
||||||
case GEN_EDIPARTY:
|
|
||||||
- result = ASN1_TYPE_cmp(a->d.other, b->d.other);
|
|
||||||
+ result = edipartyname_cmp(a->d.ediPartyName, b->d.ediPartyName);
|
|
||||||
break;
|
|
||||||
|
|
||||||
case GEN_OTHERNAME:
|
|
||||||
@@ -114,8 +149,11 @@ void GENERAL_NAME_set0_value(GENERAL_NAME *a, int type, void *value)
|
|
||||||
{
|
|
||||||
switch (type) {
|
|
||||||
case GEN_X400:
|
|
||||||
+ a->d.x400Address = value;
|
|
||||||
+ break;
|
|
||||||
+
|
|
||||||
case GEN_EDIPARTY:
|
|
||||||
- a->d.other = value;
|
|
||||||
+ a->d.ediPartyName = value;
|
|
||||||
break;
|
|
||||||
|
|
||||||
case GEN_OTHERNAME:
|
|
||||||
@@ -149,8 +187,10 @@ void *GENERAL_NAME_get0_value(const GENERAL_NAME *a, int *ptype)
|
|
||||||
*ptype = a->type;
|
|
||||||
switch (a->type) {
|
|
||||||
case GEN_X400:
|
|
||||||
+ return a->d.x400Address;
|
|
||||||
+
|
|
||||||
case GEN_EDIPARTY:
|
|
||||||
- return a->d.other;
|
|
||||||
+ return a->d.ediPartyName;
|
|
||||||
|
|
||||||
case GEN_OTHERNAME:
|
|
||||||
return a->d.otherName;
|
|
||||||
diff --git a/include/openssl/asn1err.h b/include/openssl/asn1err.h
|
|
||||||
index faed5a5518..e1ad1fefec 100644
|
|
||||||
--- a/include/openssl/asn1err.h
|
|
||||||
+++ b/include/openssl/asn1err.h
|
|
||||||
@@ -1,6 +1,6 @@
|
|
||||||
/*
|
|
||||||
* Generated by util/mkerr.pl DO NOT EDIT
|
|
||||||
- * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
|
|
||||||
+ * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
|
|
||||||
*
|
|
||||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
|
||||||
* this file except in compliance with the License. You can obtain a copy
|
|
||||||
@@ -11,9 +11,7 @@
|
|
||||||
#ifndef HEADER_ASN1ERR_H
|
|
||||||
# define HEADER_ASN1ERR_H
|
|
||||||
|
|
||||||
-# ifndef HEADER_SYMHACKS_H
|
|
||||||
-# include <openssl/symhacks.h>
|
|
||||||
-# endif
|
|
||||||
+# include <openssl/symhacks.h>
|
|
||||||
|
|
||||||
# ifdef __cplusplus
|
|
||||||
extern "C"
|
|
||||||
@@ -53,6 +51,7 @@ int ERR_load_ASN1_strings(void);
|
|
||||||
# define ASN1_F_ASN1_ITEM_DUP 191
|
|
||||||
# define ASN1_F_ASN1_ITEM_EMBED_D2I 120
|
|
||||||
# define ASN1_F_ASN1_ITEM_EMBED_NEW 121
|
|
||||||
+# define ASN1_F_ASN1_ITEM_EX_I2D 144
|
|
||||||
# define ASN1_F_ASN1_ITEM_FLAGS_I2D 118
|
|
||||||
# define ASN1_F_ASN1_ITEM_I2D_BIO 192
|
|
||||||
# define ASN1_F_ASN1_ITEM_I2D_FP 193
|
|
||||||
@@ -145,6 +144,7 @@ int ERR_load_ASN1_strings(void);
|
|
||||||
# define ASN1_R_ASN1_SIG_PARSE_ERROR 204
|
|
||||||
# define ASN1_R_AUX_ERROR 100
|
|
||||||
# define ASN1_R_BAD_OBJECT_HEADER 102
|
|
||||||
+# define ASN1_R_BAD_TEMPLATE 230
|
|
||||||
# define ASN1_R_BMPSTRING_IS_WRONG_LENGTH 214
|
|
||||||
# define ASN1_R_BN_LIB 105
|
|
||||||
# define ASN1_R_BOOLEAN_IS_WRONG_LENGTH 106
|
|
||||||
diff --git a/test/asn1_decode_test.c b/test/asn1_decode_test.c
|
|
||||||
index 369023d5f1..94a22c6682 100644
|
|
||||||
--- a/test/asn1_decode_test.c
|
|
||||||
+++ b/test/asn1_decode_test.c
|
|
||||||
@@ -160,6 +160,41 @@ static int test_uint64(void)
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
+typedef struct {
|
|
||||||
+ ASN1_STRING *invalidDirString;
|
|
||||||
+} INVALIDTEMPLATE;
|
|
||||||
+
|
|
||||||
+ASN1_SEQUENCE(INVALIDTEMPLATE) = {
|
|
||||||
+ /*
|
|
||||||
+ * DirectoryString is a CHOICE type so it must use explicit tagging -
|
|
||||||
+ * but we deliberately use implicit here, which makes this template invalid.
|
|
||||||
+ */
|
|
||||||
+ ASN1_IMP(INVALIDTEMPLATE, invalidDirString, DIRECTORYSTRING, 12)
|
|
||||||
+} static_ASN1_SEQUENCE_END(INVALIDTEMPLATE)
|
|
||||||
+
|
|
||||||
+IMPLEMENT_STATIC_ASN1_ENCODE_FUNCTIONS(INVALIDTEMPLATE)
|
|
||||||
+IMPLEMENT_STATIC_ASN1_ALLOC_FUNCTIONS(INVALIDTEMPLATE)
|
|
||||||
+
|
|
||||||
+/* Empty sequence for invalid template test */
|
|
||||||
+static unsigned char t_invalid_template[] = {
|
|
||||||
+ 0x30, 0x03, /* SEQUENCE tag + length */
|
|
||||||
+ 0x0c, 0x01, 0x41 /* UTF8String, length 1, "A" */
|
|
||||||
+};
|
|
||||||
+
|
|
||||||
+static int test_invalid_template(void)
|
|
||||||
+{
|
|
||||||
+ const unsigned char *p = t_invalid_template;
|
|
||||||
+ INVALIDTEMPLATE *tmp = d2i_INVALIDTEMPLATE(NULL, &p,
|
|
||||||
+ sizeof(t_invalid_template));
|
|
||||||
+
|
|
||||||
+ /* We expect a NULL pointer return */
|
|
||||||
+ if (TEST_ptr_null(tmp))
|
|
||||||
+ return 1;
|
|
||||||
+
|
|
||||||
+ INVALIDTEMPLATE_free(tmp);
|
|
||||||
+ return 0;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
int setup_tests(void)
|
|
||||||
{
|
|
||||||
#if OPENSSL_API_COMPAT < 0x10200000L
|
|
||||||
@@ -169,5 +204,6 @@ int setup_tests(void)
|
|
||||||
ADD_TEST(test_uint32);
|
|
||||||
ADD_TEST(test_int64);
|
|
||||||
ADD_TEST(test_uint64);
|
|
||||||
+ ADD_TEST(test_invalid_template);
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
diff --git a/test/asn1_encode_test.c b/test/asn1_encode_test.c
|
|
||||||
index ed920a4d66..afbd18be6f 100644
|
|
||||||
--- a/test/asn1_encode_test.c
|
|
||||||
+++ b/test/asn1_encode_test.c
|
|
||||||
@@ -856,6 +856,38 @@ static int test_uint64(void)
|
|
||||||
return test_intern(&uint64_test_package);
|
|
||||||
}
|
|
||||||
|
|
||||||
+typedef struct {
|
|
||||||
+ ASN1_STRING *invalidDirString;
|
|
||||||
+} INVALIDTEMPLATE;
|
|
||||||
+
|
|
||||||
+ASN1_SEQUENCE(INVALIDTEMPLATE) = {
|
|
||||||
+ /*
|
|
||||||
+ * DirectoryString is a CHOICE type so it must use explicit tagging -
|
|
||||||
+ * but we deliberately use implicit here, which makes this template invalid.
|
|
||||||
+ */
|
|
||||||
+ ASN1_IMP(INVALIDTEMPLATE, invalidDirString, DIRECTORYSTRING, 12)
|
|
||||||
+} static_ASN1_SEQUENCE_END(INVALIDTEMPLATE)
|
|
||||||
+
|
|
||||||
+IMPLEMENT_STATIC_ASN1_ENCODE_FUNCTIONS(INVALIDTEMPLATE)
|
|
||||||
+IMPLEMENT_STATIC_ASN1_ALLOC_FUNCTIONS(INVALIDTEMPLATE)
|
|
||||||
+
|
|
||||||
+static int test_invalid_template(void)
|
|
||||||
+{
|
|
||||||
+ INVALIDTEMPLATE *temp = INVALIDTEMPLATE_new();
|
|
||||||
+ int ret;
|
|
||||||
+
|
|
||||||
+ if (!TEST_ptr(temp))
|
|
||||||
+ return 0;
|
|
||||||
+
|
|
||||||
+ ret = i2d_INVALIDTEMPLATE(temp, NULL);
|
|
||||||
+
|
|
||||||
+ INVALIDTEMPLATE_free(temp);
|
|
||||||
+
|
|
||||||
+ /* We expect the i2d operation to fail */
|
|
||||||
+ return ret < 0;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+
|
|
||||||
int setup_tests(void)
|
|
||||||
{
|
|
||||||
#if OPENSSL_API_COMPAT < 0x10200000L
|
|
||||||
@@ -866,5 +898,6 @@ int setup_tests(void)
|
|
||||||
ADD_TEST(test_uint32);
|
|
||||||
ADD_TEST(test_int64);
|
|
||||||
ADD_TEST(test_uint64);
|
|
||||||
+ ADD_TEST(test_invalid_template);
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
diff --git a/test/v3nametest.c b/test/v3nametest.c
|
|
||||||
index 86f3829aed..4c8af92ce9 100644
|
|
||||||
--- a/test/v3nametest.c
|
|
||||||
+++ b/test/v3nametest.c
|
|
||||||
@@ -359,8 +359,352 @@ static int call_run_cert(int i)
|
|
||||||
return failed == 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
+struct gennamedata {
|
|
||||||
+ const unsigned char der[22];
|
|
||||||
+ size_t derlen;
|
|
||||||
+} gennames[] = {
|
|
||||||
+ {
|
|
||||||
+ /*
|
|
||||||
+ * [0] {
|
|
||||||
+ * OBJECT_IDENTIFIER { 1.2.840.113554.4.1.72585.2.1 }
|
|
||||||
+ * [0] {
|
|
||||||
+ * SEQUENCE {}
|
|
||||||
+ * }
|
|
||||||
+ * }
|
|
||||||
+ */
|
|
||||||
+ {
|
|
||||||
+ 0xa0, 0x13, 0x06, 0x0d, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12, 0x04,
|
|
||||||
+ 0x01, 0x84, 0xb7, 0x09, 0x02, 0x01, 0xa0, 0x02, 0x30, 0x00
|
|
||||||
+ },
|
|
||||||
+ 21
|
|
||||||
+ }, {
|
|
||||||
+ /*
|
|
||||||
+ * [0] {
|
|
||||||
+ * OBJECT_IDENTIFIER { 1.2.840.113554.4.1.72585.2.1 }
|
|
||||||
+ * [0] {
|
|
||||||
+ * [APPLICATION 0] {}
|
|
||||||
+ * }
|
|
||||||
+ * }
|
|
||||||
+ */
|
|
||||||
+ {
|
|
||||||
+ 0xa0, 0x13, 0x06, 0x0d, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12, 0x04,
|
|
||||||
+ 0x01, 0x84, 0xb7, 0x09, 0x02, 0x01, 0xa0, 0x02, 0x60, 0x00
|
|
||||||
+ },
|
|
||||||
+ 21
|
|
||||||
+ }, {
|
|
||||||
+ /*
|
|
||||||
+ * [0] {
|
|
||||||
+ * OBJECT_IDENTIFIER { 1.2.840.113554.4.1.72585.2.1 }
|
|
||||||
+ * [0] {
|
|
||||||
+ * UTF8String { "a" }
|
|
||||||
+ * }
|
|
||||||
+ * }
|
|
||||||
+ */
|
|
||||||
+ {
|
|
||||||
+ 0xa0, 0x14, 0x06, 0x0d, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12, 0x04,
|
|
||||||
+ 0x01, 0x84, 0xb7, 0x09, 0x02, 0x01, 0xa0, 0x03, 0x0c, 0x01, 0x61
|
|
||||||
+ },
|
|
||||||
+ 22
|
|
||||||
+ }, {
|
|
||||||
+ /*
|
|
||||||
+ * [0] {
|
|
||||||
+ * OBJECT_IDENTIFIER { 1.2.840.113554.4.1.72585.2.2 }
|
|
||||||
+ * [0] {
|
|
||||||
+ * UTF8String { "a" }
|
|
||||||
+ * }
|
|
||||||
+ * }
|
|
||||||
+ */
|
|
||||||
+ {
|
|
||||||
+ 0xa0, 0x14, 0x06, 0x0d, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12, 0x04,
|
|
||||||
+ 0x01, 0x84, 0xb7, 0x09, 0x02, 0x02, 0xa0, 0x03, 0x0c, 0x01, 0x61
|
|
||||||
+ },
|
|
||||||
+ 22
|
|
||||||
+ }, {
|
|
||||||
+ /*
|
|
||||||
+ * [0] {
|
|
||||||
+ * OBJECT_IDENTIFIER { 1.2.840.113554.4.1.72585.2.1 }
|
|
||||||
+ * [0] {
|
|
||||||
+ * UTF8String { "b" }
|
|
||||||
+ * }
|
|
||||||
+ * }
|
|
||||||
+ */
|
|
||||||
+ {
|
|
||||||
+ 0xa0, 0x14, 0x06, 0x0d, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12, 0x04,
|
|
||||||
+ 0x01, 0x84, 0xb7, 0x09, 0x02, 0x01, 0xa0, 0x03, 0x0c, 0x01, 0x62
|
|
||||||
+ },
|
|
||||||
+ 22
|
|
||||||
+ }, {
|
|
||||||
+ /*
|
|
||||||
+ * [0] {
|
|
||||||
+ * OBJECT_IDENTIFIER { 1.2.840.113554.4.1.72585.2.1 }
|
|
||||||
+ * [0] {
|
|
||||||
+ * BOOLEAN { TRUE }
|
|
||||||
+ * }
|
|
||||||
+ * }
|
|
||||||
+ */
|
|
||||||
+ {
|
|
||||||
+ 0xa0, 0x14, 0x06, 0x0d, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12, 0x04,
|
|
||||||
+ 0x01, 0x84, 0xb7, 0x09, 0x02, 0x01, 0xa0, 0x03, 0x01, 0x01, 0xff
|
|
||||||
+ },
|
|
||||||
+ 22
|
|
||||||
+ }, {
|
|
||||||
+ /*
|
|
||||||
+ * [0] {
|
|
||||||
+ * OBJECT_IDENTIFIER { 1.2.840.113554.4.1.72585.2.1 }
|
|
||||||
+ * [0] {
|
|
||||||
+ * BOOLEAN { FALSE }
|
|
||||||
+ * }
|
|
||||||
+ * }
|
|
||||||
+ */
|
|
||||||
+ {
|
|
||||||
+ 0xa0, 0x14, 0x06, 0x0d, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12, 0x04,
|
|
||||||
+ 0x01, 0x84, 0xb7, 0x09, 0x02, 0x01, 0xa0, 0x03, 0x01, 0x01, 0x00
|
|
||||||
+ },
|
|
||||||
+ 22
|
|
||||||
+ }, {
|
|
||||||
+ /* [1 PRIMITIVE] { "a" } */
|
|
||||||
+ {
|
|
||||||
+ 0x81, 0x01, 0x61
|
|
||||||
+ },
|
|
||||||
+ 3
|
|
||||||
+ }, {
|
|
||||||
+ /* [1 PRIMITIVE] { "b" } */
|
|
||||||
+ {
|
|
||||||
+ 0x81, 0x01, 0x62
|
|
||||||
+ },
|
|
||||||
+ 3
|
|
||||||
+ }, {
|
|
||||||
+ /* [2 PRIMITIVE] { "a" } */
|
|
||||||
+ {
|
|
||||||
+ 0x82, 0x01, 0x61
|
|
||||||
+ },
|
|
||||||
+ 3
|
|
||||||
+ }, {
|
|
||||||
+ /* [2 PRIMITIVE] { "b" } */
|
|
||||||
+ {
|
|
||||||
+ 0x82, 0x01, 0x62
|
|
||||||
+ },
|
|
||||||
+ 3
|
|
||||||
+ }, {
|
|
||||||
+ /*
|
|
||||||
+ * [4] {
|
|
||||||
+ * SEQUENCE {
|
|
||||||
+ * SET {
|
|
||||||
+ * SEQUENCE {
|
|
||||||
+ * # commonName
|
|
||||||
+ * OBJECT_IDENTIFIER { 2.5.4.3 }
|
|
||||||
+ * UTF8String { "a" }
|
|
||||||
+ * }
|
|
||||||
+ * }
|
|
||||||
+ * }
|
|
||||||
+ * }
|
|
||||||
+ */
|
|
||||||
+ {
|
|
||||||
+ 0xa4, 0x0e, 0x30, 0x0c, 0x31, 0x0a, 0x30, 0x08, 0x06, 0x03, 0x55,
|
|
||||||
+ 0x04, 0x03, 0x0c, 0x01, 0x61
|
|
||||||
+ },
|
|
||||||
+ 16
|
|
||||||
+ }, {
|
|
||||||
+ /*
|
|
||||||
+ * [4] {
|
|
||||||
+ * SEQUENCE {
|
|
||||||
+ * SET {
|
|
||||||
+ * SEQUENCE {
|
|
||||||
+ * # commonName
|
|
||||||
+ * OBJECT_IDENTIFIER { 2.5.4.3 }
|
|
||||||
+ * UTF8String { "b" }
|
|
||||||
+ * }
|
|
||||||
+ * }
|
|
||||||
+ * }
|
|
||||||
+ * }
|
|
||||||
+ */
|
|
||||||
+ {
|
|
||||||
+ 0xa4, 0x0e, 0x30, 0x0c, 0x31, 0x0a, 0x30, 0x08, 0x06, 0x03, 0x55,
|
|
||||||
+ 0x04, 0x03, 0x0c, 0x01, 0x62
|
|
||||||
+ },
|
|
||||||
+ 16
|
|
||||||
+ }, {
|
|
||||||
+ /*
|
|
||||||
+ * [5] {
|
|
||||||
+ * [1] {
|
|
||||||
+ * UTF8String { "a" }
|
|
||||||
+ * }
|
|
||||||
+ * }
|
|
||||||
+ */
|
|
||||||
+ {
|
|
||||||
+ 0xa5, 0x05, 0xa1, 0x03, 0x0c, 0x01, 0x61
|
|
||||||
+ },
|
|
||||||
+ 7
|
|
||||||
+ }, {
|
|
||||||
+ /*
|
|
||||||
+ * [5] {
|
|
||||||
+ * [1] {
|
|
||||||
+ * UTF8String { "b" }
|
|
||||||
+ * }
|
|
||||||
+ * }
|
|
||||||
+ */
|
|
||||||
+ {
|
|
||||||
+ 0xa5, 0x05, 0xa1, 0x03, 0x0c, 0x01, 0x62
|
|
||||||
+ },
|
|
||||||
+ 7
|
|
||||||
+ }, {
|
|
||||||
+ /*
|
|
||||||
+ * [5] {
|
|
||||||
+ * [0] {
|
|
||||||
+ * UTF8String {}
|
|
||||||
+ * }
|
|
||||||
+ * [1] {
|
|
||||||
+ * UTF8String { "a" }
|
|
||||||
+ * }
|
|
||||||
+ * }
|
|
||||||
+ */
|
|
||||||
+ {
|
|
||||||
+ 0xa5, 0x09, 0xa0, 0x02, 0x0c, 0x00, 0xa1, 0x03, 0x0c, 0x01, 0x61
|
|
||||||
+ },
|
|
||||||
+ 11
|
|
||||||
+ }, {
|
|
||||||
+ /*
|
|
||||||
+ * [5] {
|
|
||||||
+ * [0] {
|
|
||||||
+ * UTF8String { "a" }
|
|
||||||
+ * }
|
|
||||||
+ * [1] {
|
|
||||||
+ * UTF8String { "a" }
|
|
||||||
+ * }
|
|
||||||
+ * }
|
|
||||||
+ */
|
|
||||||
+ {
|
|
||||||
+ 0xa5, 0x0a, 0xa0, 0x03, 0x0c, 0x01, 0x61, 0xa1, 0x03, 0x0c, 0x01,
|
|
||||||
+ 0x61
|
|
||||||
+ },
|
|
||||||
+ 12
|
|
||||||
+ }, {
|
|
||||||
+ /*
|
|
||||||
+ * [5] {
|
|
||||||
+ * [0] {
|
|
||||||
+ * UTF8String { "b" }
|
|
||||||
+ * }
|
|
||||||
+ * [1] {
|
|
||||||
+ * UTF8String { "a" }
|
|
||||||
+ * }
|
|
||||||
+ * }
|
|
||||||
+ */
|
|
||||||
+ {
|
|
||||||
+ 0xa5, 0x0a, 0xa0, 0x03, 0x0c, 0x01, 0x62, 0xa1, 0x03, 0x0c, 0x01,
|
|
||||||
+ 0x61
|
|
||||||
+ },
|
|
||||||
+ 12
|
|
||||||
+ }, {
|
|
||||||
+ /* [6 PRIMITIVE] { "a" } */
|
|
||||||
+ {
|
|
||||||
+ 0x86, 0x01, 0x61
|
|
||||||
+ },
|
|
||||||
+ 3
|
|
||||||
+ }, {
|
|
||||||
+ /* [6 PRIMITIVE] { "b" } */
|
|
||||||
+ {
|
|
||||||
+ 0x86, 0x01, 0x62
|
|
||||||
+ },
|
|
||||||
+ 3
|
|
||||||
+ }, {
|
|
||||||
+ /* [7 PRIMITIVE] { `11111111` } */
|
|
||||||
+ {
|
|
||||||
+ 0x87, 0x04, 0x11, 0x11, 0x11, 0x11
|
|
||||||
+ },
|
|
||||||
+ 6
|
|
||||||
+ }, {
|
|
||||||
+ /* [7 PRIMITIVE] { `22222222`} */
|
|
||||||
+ {
|
|
||||||
+ 0x87, 0x04, 0x22, 0x22, 0x22, 0x22
|
|
||||||
+ },
|
|
||||||
+ 6
|
|
||||||
+ }, {
|
|
||||||
+ /* [7 PRIMITIVE] { `11111111111111111111111111111111` } */
|
|
||||||
+ {
|
|
||||||
+ 0x87, 0x10, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11,
|
|
||||||
+ 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11
|
|
||||||
+ },
|
|
||||||
+ 18
|
|
||||||
+ }, {
|
|
||||||
+ /* [7 PRIMITIVE] { `22222222222222222222222222222222` } */
|
|
||||||
+ {
|
|
||||||
+ 0x87, 0x10, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22,
|
|
||||||
+ 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22
|
|
||||||
+ },
|
|
||||||
+ 18
|
|
||||||
+ }, {
|
|
||||||
+ /* [8 PRIMITIVE] { 1.2.840.113554.4.1.72585.2.1 } */
|
|
||||||
+ {
|
|
||||||
+ 0x88, 0x0d, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12, 0x04, 0x01, 0x84,
|
|
||||||
+ 0xb7, 0x09, 0x02, 0x01
|
|
||||||
+ },
|
|
||||||
+ 15
|
|
||||||
+ }, {
|
|
||||||
+ /* [8 PRIMITIVE] { 1.2.840.113554.4.1.72585.2.2 } */
|
|
||||||
+ {
|
|
||||||
+ 0x88, 0x0d, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12, 0x04, 0x01, 0x84,
|
|
||||||
+ 0xb7, 0x09, 0x02, 0x02
|
|
||||||
+ },
|
|
||||||
+ 15
|
|
||||||
+ }
|
|
||||||
+};
|
|
||||||
+
|
|
||||||
+static int test_GENERAL_NAME_cmp(void)
|
|
||||||
+{
|
|
||||||
+ size_t i, j;
|
|
||||||
+ GENERAL_NAME **namesa = OPENSSL_malloc(sizeof(*namesa)
|
|
||||||
+ * OSSL_NELEM(gennames));
|
|
||||||
+ GENERAL_NAME **namesb = OPENSSL_malloc(sizeof(*namesb)
|
|
||||||
+ * OSSL_NELEM(gennames));
|
|
||||||
+ int testresult = 0;
|
|
||||||
+
|
|
||||||
+ if (!TEST_ptr(namesa) || !TEST_ptr(namesb))
|
|
||||||
+ goto end;
|
|
||||||
+
|
|
||||||
+ for (i = 0; i < OSSL_NELEM(gennames); i++) {
|
|
||||||
+ const unsigned char *derp = gennames[i].der;
|
|
||||||
+
|
|
||||||
+ /*
|
|
||||||
+ * We create two versions of each GENERAL_NAME so that we ensure when
|
|
||||||
+ * we compare them they are always different pointers.
|
|
||||||
+ */
|
|
||||||
+ namesa[i] = d2i_GENERAL_NAME(NULL, &derp, gennames[i].derlen);
|
|
||||||
+ derp = gennames[i].der;
|
|
||||||
+ namesb[i] = d2i_GENERAL_NAME(NULL, &derp, gennames[i].derlen);
|
|
||||||
+ if (!TEST_ptr(namesa[i]) || !TEST_ptr(namesb[i]))
|
|
||||||
+ goto end;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ /* Every name should be equal to itself and not equal to any others. */
|
|
||||||
+ for (i = 0; i < OSSL_NELEM(gennames); i++) {
|
|
||||||
+ for (j = 0; j < OSSL_NELEM(gennames); j++) {
|
|
||||||
+ if (i == j) {
|
|
||||||
+ if (!TEST_int_eq(GENERAL_NAME_cmp(namesa[i], namesb[j]), 0))
|
|
||||||
+ goto end;
|
|
||||||
+ } else {
|
|
||||||
+ if (!TEST_int_ne(GENERAL_NAME_cmp(namesa[i], namesb[j]), 0))
|
|
||||||
+ goto end;
|
|
||||||
+ }
|
|
||||||
+ }
|
|
||||||
+ }
|
|
||||||
+ testresult = 1;
|
|
||||||
+
|
|
||||||
+ end:
|
|
||||||
+ for (i = 0; i < OSSL_NELEM(gennames); i++) {
|
|
||||||
+ if (namesa != NULL)
|
|
||||||
+ GENERAL_NAME_free(namesa[i]);
|
|
||||||
+ if (namesb != NULL)
|
|
||||||
+ GENERAL_NAME_free(namesb[i]);
|
|
||||||
+ }
|
|
||||||
+ OPENSSL_free(namesa);
|
|
||||||
+ OPENSSL_free(namesb);
|
|
||||||
+
|
|
||||||
+ return testresult;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
int setup_tests(void)
|
|
||||||
{
|
|
||||||
ADD_ALL_TESTS(call_run_cert, OSSL_NELEM(name_fns));
|
|
||||||
+ ADD_TEST(test_GENERAL_NAME_cmp);
|
|
||||||
return 1;
|
|
||||||
}
|
|
31
SOURCES/openssl-1.1.1-addrconfig.patch
Normal file
31
SOURCES/openssl-1.1.1-addrconfig.patch
Normal file
@ -0,0 +1,31 @@
|
|||||||
|
From a3f4cd5019b60649f6eb216ebe99caa43cd96f8e Mon Sep 17 00:00:00 2001
|
||||||
|
From: Daiki Ueno <dueno@redhat.com>
|
||||||
|
Date: Mon, 26 Apr 2021 14:40:17 +0200
|
||||||
|
Subject: [PATCH] BIO_lookup_ex: use AI_ADDRCONFIG only if explicit host name
|
||||||
|
is given
|
||||||
|
|
||||||
|
The flag only affects which record types are queried (A or AAAA, or
|
||||||
|
both), and when node is NULL, it prevents getaddrinfo returning the
|
||||||
|
right address associated with the loopback interface.
|
||||||
|
|
||||||
|
Signed-off-by: Daiki Ueno <dueno@redhat.com>
|
||||||
|
---
|
||||||
|
crypto/bio/b_addr.c | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/crypto/bio/b_addr.c b/crypto/bio/b_addr.c
|
||||||
|
index b023bbda40..ea15601f3d 100644
|
||||||
|
--- a/crypto/bio/b_addr.c
|
||||||
|
+++ b/crypto/bio/b_addr.c
|
||||||
|
@@ -689,7 +689,7 @@ int BIO_lookup_ex(const char *host, const char *service, int lookup_type,
|
||||||
|
hints.ai_protocol = protocol;
|
||||||
|
# ifdef AI_ADDRCONFIG
|
||||||
|
# ifdef AF_UNSPEC
|
||||||
|
- if (family == AF_UNSPEC)
|
||||||
|
+ if (host != NULL && family == AF_UNSPEC)
|
||||||
|
# endif
|
||||||
|
hints.ai_flags |= AI_ADDRCONFIG;
|
||||||
|
# endif
|
||||||
|
--
|
||||||
|
2.30.2
|
||||||
|
|
File diff suppressed because it is too large
Load Diff
36
SOURCES/openssl-1.1.1-cleanup-peer-point-reneg.patch
Normal file
36
SOURCES/openssl-1.1.1-cleanup-peer-point-reneg.patch
Normal file
@ -0,0 +1,36 @@
|
|||||||
|
diff -up openssl-1.1.1k/ssl/statem/extensions.c.cleanup-reneg openssl-1.1.1k/ssl/statem/extensions.c
|
||||||
|
--- openssl-1.1.1k/ssl/statem/extensions.c.cleanup-reneg 2021-03-25 14:28:38.000000000 +0100
|
||||||
|
+++ openssl-1.1.1k/ssl/statem/extensions.c 2021-06-24 16:16:19.526181743 +0200
|
||||||
|
@@ -42,6 +42,7 @@ static int tls_parse_certificate_authori
|
||||||
|
#ifndef OPENSSL_NO_SRP
|
||||||
|
static int init_srp(SSL *s, unsigned int context);
|
||||||
|
#endif
|
||||||
|
+static int init_ec_point_formats(SSL *s, unsigned int context);
|
||||||
|
static int init_etm(SSL *s, unsigned int context);
|
||||||
|
static int init_ems(SSL *s, unsigned int context);
|
||||||
|
static int final_ems(SSL *s, unsigned int context, int sent);
|
||||||
|
@@ -158,7 +159,7 @@ static const EXTENSION_DEFINITION ext_de
|
||||||
|
TLSEXT_TYPE_ec_point_formats,
|
||||||
|
SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
|
||||||
|
| SSL_EXT_TLS1_2_AND_BELOW_ONLY,
|
||||||
|
- NULL, tls_parse_ctos_ec_pt_formats, tls_parse_stoc_ec_pt_formats,
|
||||||
|
+ init_ec_point_formats, tls_parse_ctos_ec_pt_formats, tls_parse_stoc_ec_pt_formats,
|
||||||
|
tls_construct_stoc_ec_pt_formats, tls_construct_ctos_ec_pt_formats,
|
||||||
|
final_ec_pt_formats
|
||||||
|
},
|
||||||
|
@@ -1164,6 +1165,15 @@ static int init_srp(SSL *s, unsigned int
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
|
||||||
|
+static int init_ec_point_formats(SSL *s, unsigned int context)
|
||||||
|
+{
|
||||||
|
+ OPENSSL_free(s->ext.peer_ecpointformats);
|
||||||
|
+ s->ext.peer_ecpointformats = NULL;
|
||||||
|
+ s->ext.peer_ecpointformats_len = 0;
|
||||||
|
+
|
||||||
|
+ return 1;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
static int init_etm(SSL *s, unsigned int context)
|
||||||
|
{
|
||||||
|
s->ext.use_etm = 0;
|
34
SOURCES/openssl-1.1.1-detected-addr-ipv6.patch
Normal file
34
SOURCES/openssl-1.1.1-detected-addr-ipv6.patch
Normal file
@ -0,0 +1,34 @@
|
|||||||
|
diff -up openssl-1.1.1k/apps/s_socket.c.addr-ipv6 openssl-1.1.1k/apps/s_socket.c
|
||||||
|
--- openssl-1.1.1k/apps/s_socket.c.addr-ipv6 2021-07-16 15:14:08.491986682 +0200
|
||||||
|
+++ openssl-1.1.1k/apps/s_socket.c 2021-07-16 15:23:21.271329197 +0200
|
||||||
|
@@ -214,6 +214,8 @@ int do_server(int *accept_sock, const ch
|
||||||
|
const BIO_ADDRINFO *next;
|
||||||
|
int sock_family, sock_type, sock_protocol, sock_port;
|
||||||
|
const BIO_ADDR *sock_address;
|
||||||
|
+ int sock_family_fallback = AF_UNSPEC;
|
||||||
|
+ const BIO_ADDR *sock_address_fallback = NULL;
|
||||||
|
int sock_options = BIO_SOCK_REUSEADDR;
|
||||||
|
int ret = 0;
|
||||||
|
|
||||||
|
@@ -244,6 +246,10 @@ int do_server(int *accept_sock, const ch
|
||||||
|
&& BIO_ADDRINFO_protocol(next) == sock_protocol) {
|
||||||
|
if (sock_family == AF_INET
|
||||||
|
&& BIO_ADDRINFO_family(next) == AF_INET6) {
|
||||||
|
+ /* In case AF_INET6 is returned but not supported by the
|
||||||
|
+ * kernel, retry with the first detected address family */
|
||||||
|
+ sock_family_fallback = sock_family;
|
||||||
|
+ sock_address_fallback = sock_address;
|
||||||
|
sock_family = AF_INET6;
|
||||||
|
sock_address = BIO_ADDRINFO_address(next);
|
||||||
|
} else if (sock_family == AF_INET6
|
||||||
|
@@ -253,6 +259,10 @@ int do_server(int *accept_sock, const ch
|
||||||
|
}
|
||||||
|
|
||||||
|
asock = BIO_socket(sock_family, sock_type, sock_protocol, 0);
|
||||||
|
+ if (asock == INVALID_SOCKET && sock_family_fallback != AF_UNSPEC) {
|
||||||
|
+ asock = BIO_socket(sock_family_fallback, sock_type, sock_protocol, 0);
|
||||||
|
+ sock_address = sock_address_fallback;
|
||||||
|
+ }
|
||||||
|
if (asock == INVALID_SOCKET
|
||||||
|
|| !BIO_listen(asock, sock_address, sock_options)) {
|
||||||
|
BIO_ADDRINFO_free(res);
|
@ -1,6 +1,6 @@
|
|||||||
diff -up openssl-1.1.1c/apps/speed.c.curves openssl-1.1.1c/apps/speed.c
|
diff -up openssl-1.1.1h/apps/speed.c.curves openssl-1.1.1h/apps/speed.c
|
||||||
--- openssl-1.1.1c/apps/speed.c.curves 2019-05-28 15:12:21.000000000 +0200
|
--- openssl-1.1.1h/apps/speed.c.curves 2020-09-22 14:55:07.000000000 +0200
|
||||||
+++ openssl-1.1.1c/apps/speed.c 2019-05-29 15:36:53.332224470 +0200
|
+++ openssl-1.1.1h/apps/speed.c 2020-11-06 13:27:15.659288431 +0100
|
||||||
@@ -490,90 +490,30 @@ static double rsa_results[RSA_NUM][2];
|
@@ -490,90 +490,30 @@ static double rsa_results[RSA_NUM][2];
|
||||||
#endif /* OPENSSL_NO_RSA */
|
#endif /* OPENSSL_NO_RSA */
|
||||||
|
|
||||||
@ -92,7 +92,7 @@ diff -up openssl-1.1.1c/apps/speed.c.curves openssl-1.1.1c/apps/speed.c
|
|||||||
{"ecdhx25519", R_EC_X25519},
|
{"ecdhx25519", R_EC_X25519},
|
||||||
{"ecdhx448", R_EC_X448}
|
{"ecdhx448", R_EC_X448}
|
||||||
};
|
};
|
||||||
@@ -1504,31 +1444,10 @@ int speed_main(int argc, char **argv)
|
@@ -1502,31 +1442,10 @@ int speed_main(int argc, char **argv)
|
||||||
unsigned int bits;
|
unsigned int bits;
|
||||||
} test_curves[] = {
|
} test_curves[] = {
|
||||||
/* Prime Curves */
|
/* Prime Curves */
|
||||||
@ -124,7 +124,7 @@ diff -up openssl-1.1.1c/apps/speed.c.curves openssl-1.1.1c/apps/speed.c
|
|||||||
/* Other and ECDH only ones */
|
/* Other and ECDH only ones */
|
||||||
{"X25519", NID_X25519, 253},
|
{"X25519", NID_X25519, 253},
|
||||||
{"X448", NID_X448, 448}
|
{"X448", NID_X448, 448}
|
||||||
@@ -2028,9 +1947,9 @@ int speed_main(int argc, char **argv)
|
@@ -2026,9 +1945,9 @@ int speed_main(int argc, char **argv)
|
||||||
# endif
|
# endif
|
||||||
|
|
||||||
# ifndef OPENSSL_NO_EC
|
# ifndef OPENSSL_NO_EC
|
||||||
@ -137,7 +137,7 @@ diff -up openssl-1.1.1c/apps/speed.c.curves openssl-1.1.1c/apps/speed.c
|
|||||||
ecdsa_c[i][0] = ecdsa_c[i - 1][0] / 2;
|
ecdsa_c[i][0] = ecdsa_c[i - 1][0] / 2;
|
||||||
ecdsa_c[i][1] = ecdsa_c[i - 1][1] / 2;
|
ecdsa_c[i][1] = ecdsa_c[i - 1][1] / 2;
|
||||||
if (ecdsa_doit[i] <= 1 && ecdsa_c[i][0] == 0)
|
if (ecdsa_doit[i] <= 1 && ecdsa_c[i][0] == 0)
|
||||||
@@ -2042,7 +1961,7 @@ int speed_main(int argc, char **argv)
|
@@ -2040,7 +1959,7 @@ int speed_main(int argc, char **argv)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@ -146,7 +146,7 @@ diff -up openssl-1.1.1c/apps/speed.c.curves openssl-1.1.1c/apps/speed.c
|
|||||||
ecdsa_c[R_EC_K163][0] = count / 1000;
|
ecdsa_c[R_EC_K163][0] = count / 1000;
|
||||||
ecdsa_c[R_EC_K163][1] = count / 1000 / 2;
|
ecdsa_c[R_EC_K163][1] = count / 1000 / 2;
|
||||||
for (i = R_EC_K233; i <= R_EC_K571; i++) {
|
for (i = R_EC_K233; i <= R_EC_K571; i++) {
|
||||||
@@ -2073,8 +1992,8 @@ int speed_main(int argc, char **argv)
|
@@ -2071,8 +1990,8 @@ int speed_main(int argc, char **argv)
|
||||||
}
|
}
|
||||||
# endif
|
# endif
|
||||||
|
|
||||||
@ -157,7 +157,7 @@ diff -up openssl-1.1.1c/apps/speed.c.curves openssl-1.1.1c/apps/speed.c
|
|||||||
ecdh_c[i][0] = ecdh_c[i - 1][0] / 2;
|
ecdh_c[i][0] = ecdh_c[i - 1][0] / 2;
|
||||||
if (ecdh_doit[i] <= 1 && ecdh_c[i][0] == 0)
|
if (ecdh_doit[i] <= 1 && ecdh_c[i][0] == 0)
|
||||||
ecdh_doit[i] = 0;
|
ecdh_doit[i] = 0;
|
||||||
@@ -2084,7 +2003,7 @@ int speed_main(int argc, char **argv)
|
@@ -2082,7 +2001,7 @@ int speed_main(int argc, char **argv)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@ -166,9 +166,9 @@ diff -up openssl-1.1.1c/apps/speed.c.curves openssl-1.1.1c/apps/speed.c
|
|||||||
ecdh_c[R_EC_K163][0] = count / 1000;
|
ecdh_c[R_EC_K163][0] = count / 1000;
|
||||||
for (i = R_EC_K233; i <= R_EC_K571; i++) {
|
for (i = R_EC_K233; i <= R_EC_K571; i++) {
|
||||||
ecdh_c[i][0] = ecdh_c[i - 1][0] / 2;
|
ecdh_c[i][0] = ecdh_c[i - 1][0] / 2;
|
||||||
diff -up openssl-1.1.1c/crypto/ec/ecp_smpl.c.curves openssl-1.1.1c/crypto/ec/ecp_smpl.c
|
diff -up openssl-1.1.1h/crypto/ec/ecp_smpl.c.curves openssl-1.1.1h/crypto/ec/ecp_smpl.c
|
||||||
--- openssl-1.1.1c/crypto/ec/ecp_smpl.c.curves 2019-05-28 15:12:21.000000000 +0200
|
--- openssl-1.1.1h/crypto/ec/ecp_smpl.c.curves 2020-09-22 14:55:07.000000000 +0200
|
||||||
+++ openssl-1.1.1c/crypto/ec/ecp_smpl.c 2019-05-29 15:30:09.071349520 +0200
|
+++ openssl-1.1.1h/crypto/ec/ecp_smpl.c 2020-11-06 13:27:15.659288431 +0100
|
||||||
@@ -145,6 +145,11 @@ int ec_GFp_simple_group_set_curve(EC_GRO
|
@@ -145,6 +145,11 @@ int ec_GFp_simple_group_set_curve(EC_GRO
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
@ -181,9 +181,9 @@ diff -up openssl-1.1.1c/crypto/ec/ecp_smpl.c.curves openssl-1.1.1c/crypto/ec/ecp
|
|||||||
if (ctx == NULL) {
|
if (ctx == NULL) {
|
||||||
ctx = new_ctx = BN_CTX_new();
|
ctx = new_ctx = BN_CTX_new();
|
||||||
if (ctx == NULL)
|
if (ctx == NULL)
|
||||||
diff -up openssl-1.1.1c/test/ecdsatest.h.curves openssl-1.1.1c/test/ecdsatest.h
|
diff -up openssl-1.1.1h/test/ecdsatest.h.curves openssl-1.1.1h/test/ecdsatest.h
|
||||||
--- openssl-1.1.1c/test/ecdsatest.h.curves 2019-05-29 15:30:09.010350595 +0200
|
--- openssl-1.1.1h/test/ecdsatest.h.curves 2020-11-06 13:27:15.627288114 +0100
|
||||||
+++ openssl-1.1.1c/test/ecdsatest.h 2019-05-29 15:41:24.586444294 +0200
|
+++ openssl-1.1.1h/test/ecdsatest.h 2020-11-06 13:27:15.660288441 +0100
|
||||||
@@ -32,23 +32,6 @@ typedef struct {
|
@@ -32,23 +32,6 @@ typedef struct {
|
||||||
} ecdsa_cavs_kat_t;
|
} ecdsa_cavs_kat_t;
|
||||||
|
|
||||||
@ -208,3 +208,59 @@ diff -up openssl-1.1.1c/test/ecdsatest.h.curves openssl-1.1.1c/test/ecdsatest.h
|
|||||||
/* prime KATs from NIST CAVP */
|
/* prime KATs from NIST CAVP */
|
||||||
{NID_secp224r1, NID_sha224,
|
{NID_secp224r1, NID_sha224,
|
||||||
"699325d6fc8fbbb4981a6ded3c3a54ad2e4e3db8a5669201912064c64e700c139248cdc1"
|
"699325d6fc8fbbb4981a6ded3c3a54ad2e4e3db8a5669201912064c64e700c139248cdc1"
|
||||||
|
--- openssl-1.1.1h/test/recipes/15-test_genec.t.ec-curves 2020-11-06 13:58:36.402895540 +0100
|
||||||
|
+++ openssl-1.1.1h/test/recipes/15-test_genec.t 2020-11-06 13:59:38.508484498 +0100
|
||||||
|
@@ -20,45 +20,11 @@ plan skip_all => "This test is unsupport
|
||||||
|
if disabled("ec");
|
||||||
|
|
||||||
|
my @prime_curves = qw(
|
||||||
|
- secp112r1
|
||||||
|
- secp112r2
|
||||||
|
- secp128r1
|
||||||
|
- secp128r2
|
||||||
|
- secp160k1
|
||||||
|
- secp160r1
|
||||||
|
- secp160r2
|
||||||
|
- secp192k1
|
||||||
|
- secp224k1
|
||||||
|
secp224r1
|
||||||
|
secp256k1
|
||||||
|
secp384r1
|
||||||
|
secp521r1
|
||||||
|
- prime192v1
|
||||||
|
- prime192v2
|
||||||
|
- prime192v3
|
||||||
|
- prime239v1
|
||||||
|
- prime239v2
|
||||||
|
- prime239v3
|
||||||
|
prime256v1
|
||||||
|
- wap-wsg-idm-ecid-wtls6
|
||||||
|
- wap-wsg-idm-ecid-wtls7
|
||||||
|
- wap-wsg-idm-ecid-wtls8
|
||||||
|
- wap-wsg-idm-ecid-wtls9
|
||||||
|
- wap-wsg-idm-ecid-wtls12
|
||||||
|
- brainpoolP160r1
|
||||||
|
- brainpoolP160t1
|
||||||
|
- brainpoolP192r1
|
||||||
|
- brainpoolP192t1
|
||||||
|
- brainpoolP224r1
|
||||||
|
- brainpoolP224t1
|
||||||
|
- brainpoolP256r1
|
||||||
|
- brainpoolP256t1
|
||||||
|
- brainpoolP320r1
|
||||||
|
- brainpoolP320t1
|
||||||
|
- brainpoolP384r1
|
||||||
|
- brainpoolP384t1
|
||||||
|
- brainpoolP512r1
|
||||||
|
- brainpoolP512t1
|
||||||
|
);
|
||||||
|
|
||||||
|
my @binary_curves = qw(
|
||||||
|
@@ -115,7 +81,6 @@ push(@other_curves, 'SM2')
|
||||||
|
if !disabled("sm2");
|
||||||
|
|
||||||
|
my @curve_aliases = qw(
|
||||||
|
- P-192
|
||||||
|
P-224
|
||||||
|
P-256
|
||||||
|
P-384
|
||||||
|
@ -1,7 +1,7 @@
|
|||||||
diff -up openssl-1.1.1e/crypto/err/openssl.txt.evp-kdf openssl-1.1.1e/crypto/err/openssl.txt
|
diff -up openssl-1.1.1j/crypto/err/openssl.txt.evp-kdf openssl-1.1.1j/crypto/err/openssl.txt
|
||||||
--- openssl-1.1.1e/crypto/err/openssl.txt.evp-kdf 2020-03-17 15:31:17.000000000 +0100
|
--- openssl-1.1.1j/crypto/err/openssl.txt.evp-kdf 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1e/crypto/err/openssl.txt 2020-03-19 16:04:11.299063517 +0100
|
+++ openssl-1.1.1j/crypto/err/openssl.txt 2021-03-03 14:10:13.729466935 +0100
|
||||||
@@ -747,6 +747,9 @@ EVP_F_EVP_DIGESTINIT_EX:128:EVP_DigestIn
|
@@ -748,6 +748,9 @@ EVP_F_EVP_DIGESTINIT_EX:128:EVP_DigestIn
|
||||||
EVP_F_EVP_ENCRYPTDECRYPTUPDATE:219:evp_EncryptDecryptUpdate
|
EVP_F_EVP_ENCRYPTDECRYPTUPDATE:219:evp_EncryptDecryptUpdate
|
||||||
EVP_F_EVP_ENCRYPTFINAL_EX:127:EVP_EncryptFinal_ex
|
EVP_F_EVP_ENCRYPTFINAL_EX:127:EVP_EncryptFinal_ex
|
||||||
EVP_F_EVP_ENCRYPTUPDATE:167:EVP_EncryptUpdate
|
EVP_F_EVP_ENCRYPTUPDATE:167:EVP_EncryptUpdate
|
||||||
@ -11,7 +11,7 @@ diff -up openssl-1.1.1e/crypto/err/openssl.txt.evp-kdf openssl-1.1.1e/crypto/err
|
|||||||
EVP_F_EVP_MD_CTX_COPY_EX:110:EVP_MD_CTX_copy_ex
|
EVP_F_EVP_MD_CTX_COPY_EX:110:EVP_MD_CTX_copy_ex
|
||||||
EVP_F_EVP_MD_SIZE:162:EVP_MD_size
|
EVP_F_EVP_MD_SIZE:162:EVP_MD_size
|
||||||
EVP_F_EVP_OPENINIT:102:EVP_OpenInit
|
EVP_F_EVP_OPENINIT:102:EVP_OpenInit
|
||||||
@@ -809,12 +812,31 @@ EVP_F_PKCS5_PBE_KEYIVGEN:117:PKCS5_PBE_k
|
@@ -810,12 +813,31 @@ EVP_F_PKCS5_PBE_KEYIVGEN:117:PKCS5_PBE_k
|
||||||
EVP_F_PKCS5_V2_PBE_KEYIVGEN:118:PKCS5_v2_PBE_keyivgen
|
EVP_F_PKCS5_V2_PBE_KEYIVGEN:118:PKCS5_v2_PBE_keyivgen
|
||||||
EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN:164:PKCS5_v2_PBKDF2_keyivgen
|
EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN:164:PKCS5_v2_PBKDF2_keyivgen
|
||||||
EVP_F_PKCS5_V2_SCRYPT_KEYIVGEN:180:PKCS5_v2_scrypt_keyivgen
|
EVP_F_PKCS5_V2_SCRYPT_KEYIVGEN:180:PKCS5_v2_scrypt_keyivgen
|
||||||
@ -43,7 +43,7 @@ diff -up openssl-1.1.1e/crypto/err/openssl.txt.evp-kdf openssl-1.1.1e/crypto/err
|
|||||||
KDF_F_PKEY_HKDF_CTRL_STR:103:pkey_hkdf_ctrl_str
|
KDF_F_PKEY_HKDF_CTRL_STR:103:pkey_hkdf_ctrl_str
|
||||||
KDF_F_PKEY_HKDF_DERIVE:102:pkey_hkdf_derive
|
KDF_F_PKEY_HKDF_DERIVE:102:pkey_hkdf_derive
|
||||||
KDF_F_PKEY_HKDF_INIT:108:pkey_hkdf_init
|
KDF_F_PKEY_HKDF_INIT:108:pkey_hkdf_init
|
||||||
@@ -826,6 +848,7 @@ KDF_F_PKEY_SCRYPT_SET_MEMBUF:107:pkey_sc
|
@@ -827,6 +849,7 @@ KDF_F_PKEY_SCRYPT_SET_MEMBUF:107:pkey_sc
|
||||||
KDF_F_PKEY_TLS1_PRF_CTRL_STR:100:pkey_tls1_prf_ctrl_str
|
KDF_F_PKEY_TLS1_PRF_CTRL_STR:100:pkey_tls1_prf_ctrl_str
|
||||||
KDF_F_PKEY_TLS1_PRF_DERIVE:101:pkey_tls1_prf_derive
|
KDF_F_PKEY_TLS1_PRF_DERIVE:101:pkey_tls1_prf_derive
|
||||||
KDF_F_PKEY_TLS1_PRF_INIT:110:pkey_tls1_prf_init
|
KDF_F_PKEY_TLS1_PRF_INIT:110:pkey_tls1_prf_init
|
||||||
@ -51,15 +51,15 @@ diff -up openssl-1.1.1e/crypto/err/openssl.txt.evp-kdf openssl-1.1.1e/crypto/err
|
|||||||
KDF_F_TLS1_PRF_ALG:111:tls1_prf_alg
|
KDF_F_TLS1_PRF_ALG:111:tls1_prf_alg
|
||||||
OBJ_F_OBJ_ADD_OBJECT:105:OBJ_add_object
|
OBJ_F_OBJ_ADD_OBJECT:105:OBJ_add_object
|
||||||
OBJ_F_OBJ_ADD_SIGID:107:OBJ_add_sigid
|
OBJ_F_OBJ_ADD_SIGID:107:OBJ_add_sigid
|
||||||
@@ -2277,6 +2300,7 @@ EVP_R_ONLY_ONESHOT_SUPPORTED:177:only on
|
@@ -2284,6 +2307,7 @@ EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_K
|
||||||
EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE:150:\
|
|
||||||
operation not supported for this keytype
|
operation not supported for this keytype
|
||||||
EVP_R_OPERATON_NOT_INITIALIZED:151:operaton not initialized
|
EVP_R_OPERATON_NOT_INITIALIZED:151:operaton not initialized
|
||||||
|
EVP_R_OUTPUT_WOULD_OVERFLOW:184:output would overflow
|
||||||
+EVP_R_PARAMETER_TOO_LARGE:187:parameter too large
|
+EVP_R_PARAMETER_TOO_LARGE:187:parameter too large
|
||||||
EVP_R_PARTIALLY_OVERLAPPING:162:partially overlapping buffers
|
EVP_R_PARTIALLY_OVERLAPPING:162:partially overlapping buffers
|
||||||
EVP_R_PBKDF2_ERROR:181:pbkdf2 error
|
EVP_R_PBKDF2_ERROR:181:pbkdf2 error
|
||||||
EVP_R_PKEY_APPLICATION_ASN1_METHOD_ALREADY_REGISTERED:179:\
|
EVP_R_PKEY_APPLICATION_ASN1_METHOD_ALREADY_REGISTERED:179:\
|
||||||
@@ -2313,6 +2337,7 @@ KDF_R_MISSING_SEED:106:missing seed
|
@@ -2320,6 +2344,7 @@ KDF_R_MISSING_SEED:106:missing seed
|
||||||
KDF_R_UNKNOWN_PARAMETER_TYPE:103:unknown parameter type
|
KDF_R_UNKNOWN_PARAMETER_TYPE:103:unknown parameter type
|
||||||
KDF_R_VALUE_ERROR:108:value error
|
KDF_R_VALUE_ERROR:108:value error
|
||||||
KDF_R_VALUE_MISSING:102:value missing
|
KDF_R_VALUE_MISSING:102:value missing
|
||||||
@ -67,9 +67,9 @@ diff -up openssl-1.1.1e/crypto/err/openssl.txt.evp-kdf openssl-1.1.1e/crypto/err
|
|||||||
OBJ_R_OID_EXISTS:102:oid exists
|
OBJ_R_OID_EXISTS:102:oid exists
|
||||||
OBJ_R_UNKNOWN_NID:101:unknown nid
|
OBJ_R_UNKNOWN_NID:101:unknown nid
|
||||||
OCSP_R_CERTIFICATE_VERIFY_ERROR:101:certificate verify error
|
OCSP_R_CERTIFICATE_VERIFY_ERROR:101:certificate verify error
|
||||||
diff -up openssl-1.1.1e/crypto/evp/build.info.evp-kdf openssl-1.1.1e/crypto/evp/build.info
|
diff -up openssl-1.1.1j/crypto/evp/build.info.evp-kdf openssl-1.1.1j/crypto/evp/build.info
|
||||||
--- openssl-1.1.1e/crypto/evp/build.info.evp-kdf 2020-03-17 15:31:17.000000000 +0100
|
--- openssl-1.1.1j/crypto/evp/build.info.evp-kdf 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1e/crypto/evp/build.info 2020-03-19 16:04:11.300063500 +0100
|
+++ openssl-1.1.1j/crypto/evp/build.info 2021-03-03 14:08:02.490294839 +0100
|
||||||
@@ -9,7 +9,8 @@ SOURCE[../../libcrypto]=\
|
@@ -9,7 +9,8 @@ SOURCE[../../libcrypto]=\
|
||||||
p_open.c p_seal.c p_sign.c p_verify.c p_lib.c p_enc.c p_dec.c \
|
p_open.c p_seal.c p_sign.c p_verify.c p_lib.c p_enc.c p_dec.c \
|
||||||
bio_md.c bio_b64.c bio_enc.c evp_err.c e_null.c \
|
bio_md.c bio_b64.c bio_enc.c evp_err.c e_null.c \
|
||||||
@ -80,9 +80,9 @@ diff -up openssl-1.1.1e/crypto/evp/build.info.evp-kdf openssl-1.1.1e/crypto/evp/
|
|||||||
e_old.c pmeth_lib.c pmeth_fn.c pmeth_gn.c m_sigver.c \
|
e_old.c pmeth_lib.c pmeth_fn.c pmeth_gn.c m_sigver.c \
|
||||||
e_aes_cbc_hmac_sha1.c e_aes_cbc_hmac_sha256.c e_rc4_hmac_md5.c \
|
e_aes_cbc_hmac_sha1.c e_aes_cbc_hmac_sha256.c e_rc4_hmac_md5.c \
|
||||||
e_chacha20_poly1305.c cmeth_lib.c
|
e_chacha20_poly1305.c cmeth_lib.c
|
||||||
diff -up openssl-1.1.1e/crypto/evp/e_chacha20_poly1305.c.evp-kdf openssl-1.1.1e/crypto/evp/e_chacha20_poly1305.c
|
diff -up openssl-1.1.1j/crypto/evp/e_chacha20_poly1305.c.evp-kdf openssl-1.1.1j/crypto/evp/e_chacha20_poly1305.c
|
||||||
--- openssl-1.1.1e/crypto/evp/e_chacha20_poly1305.c.evp-kdf 2020-03-19 16:04:11.300063500 +0100
|
--- openssl-1.1.1j/crypto/evp/e_chacha20_poly1305.c.evp-kdf 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1e/crypto/evp/e_chacha20_poly1305.c 2020-03-19 16:16:46.497967633 +0100
|
+++ openssl-1.1.1j/crypto/evp/e_chacha20_poly1305.c 2021-03-03 14:08:02.490294839 +0100
|
||||||
@@ -14,9 +14,9 @@
|
@@ -14,9 +14,9 @@
|
||||||
|
|
||||||
# include <openssl/evp.h>
|
# include <openssl/evp.h>
|
||||||
@ -94,9 +94,9 @@ diff -up openssl-1.1.1e/crypto/evp/e_chacha20_poly1305.c.evp-kdf openssl-1.1.1e/
|
|||||||
|
|
||||||
typedef struct {
|
typedef struct {
|
||||||
union {
|
union {
|
||||||
diff -up openssl-1.1.1e/crypto/evp/encode.c.evp-kdf openssl-1.1.1e/crypto/evp/encode.c
|
diff -up openssl-1.1.1j/crypto/evp/encode.c.evp-kdf openssl-1.1.1j/crypto/evp/encode.c
|
||||||
--- openssl-1.1.1e/crypto/evp/encode.c.evp-kdf 2020-03-19 16:04:11.301063483 +0100
|
--- openssl-1.1.1j/crypto/evp/encode.c.evp-kdf 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1e/crypto/evp/encode.c 2020-03-19 16:14:13.147628683 +0100
|
+++ openssl-1.1.1j/crypto/evp/encode.c 2021-03-03 14:08:02.491294847 +0100
|
||||||
@@ -11,8 +11,8 @@
|
@@ -11,8 +11,8 @@
|
||||||
#include <limits.h>
|
#include <limits.h>
|
||||||
#include "internal/cryptlib.h"
|
#include "internal/cryptlib.h"
|
||||||
@ -107,9 +107,9 @@ diff -up openssl-1.1.1e/crypto/evp/encode.c.evp-kdf openssl-1.1.1e/crypto/evp/en
|
|||||||
|
|
||||||
static unsigned char conv_ascii2bin(unsigned char a,
|
static unsigned char conv_ascii2bin(unsigned char a,
|
||||||
const unsigned char *table);
|
const unsigned char *table);
|
||||||
diff -up openssl-1.1.1e/crypto/evp/evp_err.c.evp-kdf openssl-1.1.1e/crypto/evp/evp_err.c
|
diff -up openssl-1.1.1j/crypto/evp/evp_err.c.evp-kdf openssl-1.1.1j/crypto/evp/evp_err.c
|
||||||
--- openssl-1.1.1e/crypto/evp/evp_err.c.evp-kdf 2020-03-19 16:04:11.218064919 +0100
|
--- openssl-1.1.1j/crypto/evp/evp_err.c.evp-kdf 2021-03-03 14:08:02.469294651 +0100
|
||||||
+++ openssl-1.1.1e/crypto/evp/evp_err.c 2020-03-19 16:04:11.302063465 +0100
|
+++ openssl-1.1.1j/crypto/evp/evp_err.c 2021-03-03 14:12:08.272351600 +0100
|
||||||
@@ -60,6 +60,9 @@ static const ERR_STRING_DATA EVP_str_fun
|
@@ -60,6 +60,9 @@ static const ERR_STRING_DATA EVP_str_fun
|
||||||
{ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_ENCRYPTFINAL_EX, 0),
|
{ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_ENCRYPTFINAL_EX, 0),
|
||||||
"EVP_EncryptFinal_ex"},
|
"EVP_EncryptFinal_ex"},
|
||||||
@ -135,18 +135,18 @@ diff -up openssl-1.1.1e/crypto/evp/evp_err.c.evp-kdf openssl-1.1.1e/crypto/evp/e
|
|||||||
{ERR_PACK(ERR_LIB_EVP, EVP_F_UPDATE, 0), "update"},
|
{ERR_PACK(ERR_LIB_EVP, EVP_F_UPDATE, 0), "update"},
|
||||||
{0, NULL}
|
{0, NULL}
|
||||||
};
|
};
|
||||||
@@ -241,6 +246,8 @@ static const ERR_STRING_DATA EVP_str_rea
|
@@ -243,6 +248,8 @@ static const ERR_STRING_DATA EVP_str_rea
|
||||||
"operation not supported for this keytype"},
|
|
||||||
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_OPERATON_NOT_INITIALIZED),
|
|
||||||
"operaton not initialized"},
|
"operaton not initialized"},
|
||||||
|
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_OUTPUT_WOULD_OVERFLOW),
|
||||||
|
"output would overflow"},
|
||||||
+ {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_PARAMETER_TOO_LARGE),
|
+ {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_PARAMETER_TOO_LARGE),
|
||||||
+ "parameter too large"},
|
+ "parameter too large"},
|
||||||
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_PARTIALLY_OVERLAPPING),
|
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_PARTIALLY_OVERLAPPING),
|
||||||
"partially overlapping buffers"},
|
"partially overlapping buffers"},
|
||||||
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_PBKDF2_ERROR), "pbkdf2 error"},
|
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_PBKDF2_ERROR), "pbkdf2 error"},
|
||||||
diff -up openssl-1.1.1e/crypto/evp/evp_local.h.evp-kdf openssl-1.1.1e/crypto/evp/evp_local.h
|
diff -up openssl-1.1.1j/crypto/evp/evp_local.h.evp-kdf openssl-1.1.1j/crypto/evp/evp_local.h
|
||||||
--- openssl-1.1.1e/crypto/evp/evp_local.h.evp-kdf 2020-03-19 16:04:10.657074629 +0100
|
--- openssl-1.1.1j/crypto/evp/evp_local.h.evp-kdf 2021-03-03 14:08:02.362293695 +0100
|
||||||
+++ openssl-1.1.1e/crypto/evp/evp_local.h 2020-03-19 16:04:20.722900404 +0100
|
+++ openssl-1.1.1j/crypto/evp/evp_local.h 2021-03-03 14:08:02.491294847 +0100
|
||||||
@@ -41,6 +41,11 @@ struct evp_cipher_ctx_st {
|
@@ -41,6 +41,11 @@ struct evp_cipher_ctx_st {
|
||||||
unsigned char final[EVP_MAX_BLOCK_LENGTH]; /* possible final block */
|
unsigned char final[EVP_MAX_BLOCK_LENGTH]; /* possible final block */
|
||||||
} /* EVP_CIPHER_CTX */ ;
|
} /* EVP_CIPHER_CTX */ ;
|
||||||
@ -159,9 +159,9 @@ diff -up openssl-1.1.1e/crypto/evp/evp_local.h.evp-kdf openssl-1.1.1e/crypto/evp
|
|||||||
int PKCS5_v2_PBKDF2_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass,
|
int PKCS5_v2_PBKDF2_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass,
|
||||||
int passlen, ASN1_TYPE *param,
|
int passlen, ASN1_TYPE *param,
|
||||||
const EVP_CIPHER *c, const EVP_MD *md,
|
const EVP_CIPHER *c, const EVP_MD *md,
|
||||||
diff -up openssl-1.1.1e/crypto/evp/evp_pbe.c.evp-kdf openssl-1.1.1e/crypto/evp/evp_pbe.c
|
diff -up openssl-1.1.1j/crypto/evp/evp_pbe.c.evp-kdf openssl-1.1.1j/crypto/evp/evp_pbe.c
|
||||||
--- openssl-1.1.1e/crypto/evp/evp_pbe.c.evp-kdf 2020-03-19 16:04:20.723900386 +0100
|
--- openssl-1.1.1j/crypto/evp/evp_pbe.c.evp-kdf 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1e/crypto/evp/evp_pbe.c 2020-03-19 16:11:56.425001210 +0100
|
+++ openssl-1.1.1j/crypto/evp/evp_pbe.c 2021-03-03 14:08:02.491294847 +0100
|
||||||
@@ -12,6 +12,7 @@
|
@@ -12,6 +12,7 @@
|
||||||
#include <openssl/evp.h>
|
#include <openssl/evp.h>
|
||||||
#include <openssl/pkcs12.h>
|
#include <openssl/pkcs12.h>
|
||||||
@ -170,9 +170,9 @@ diff -up openssl-1.1.1e/crypto/evp/evp_pbe.c.evp-kdf openssl-1.1.1e/crypto/evp/e
|
|||||||
#include "evp_local.h"
|
#include "evp_local.h"
|
||||||
|
|
||||||
/* Password based encryption (PBE) functions */
|
/* Password based encryption (PBE) functions */
|
||||||
diff -up openssl-1.1.1e/crypto/evp/kdf_lib.c.evp-kdf openssl-1.1.1e/crypto/evp/kdf_lib.c
|
diff -up openssl-1.1.1j/crypto/evp/kdf_lib.c.evp-kdf openssl-1.1.1j/crypto/evp/kdf_lib.c
|
||||||
--- openssl-1.1.1e/crypto/evp/kdf_lib.c.evp-kdf 2020-03-19 16:04:20.723900386 +0100
|
--- openssl-1.1.1j/crypto/evp/kdf_lib.c.evp-kdf 2021-03-03 14:08:02.491294847 +0100
|
||||||
+++ openssl-1.1.1e/crypto/evp/kdf_lib.c 2020-03-19 16:04:20.723900386 +0100
|
+++ openssl-1.1.1j/crypto/evp/kdf_lib.c 2021-03-03 14:08:02.491294847 +0100
|
||||||
@@ -0,0 +1,165 @@
|
@@ -0,0 +1,165 @@
|
||||||
+/*
|
+/*
|
||||||
+ * Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
|
+ * Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||||
@ -339,9 +339,9 @@ diff -up openssl-1.1.1e/crypto/evp/kdf_lib.c.evp-kdf openssl-1.1.1e/crypto/evp/k
|
|||||||
+ return ctx->kmeth->derive(ctx->impl, key, keylen);
|
+ return ctx->kmeth->derive(ctx->impl, key, keylen);
|
||||||
+}
|
+}
|
||||||
+
|
+
|
||||||
diff -up openssl-1.1.1e/crypto/evp/p5_crpt2.c.evp-kdf openssl-1.1.1e/crypto/evp/p5_crpt2.c
|
diff -up openssl-1.1.1j/crypto/evp/p5_crpt2.c.evp-kdf openssl-1.1.1j/crypto/evp/p5_crpt2.c
|
||||||
--- openssl-1.1.1e/crypto/evp/p5_crpt2.c.evp-kdf 2020-03-17 15:31:17.000000000 +0100
|
--- openssl-1.1.1j/crypto/evp/p5_crpt2.c.evp-kdf 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1e/crypto/evp/p5_crpt2.c 2020-03-19 16:17:48.822886126 +0100
|
+++ openssl-1.1.1j/crypto/evp/p5_crpt2.c 2021-03-03 14:08:02.491294847 +0100
|
||||||
@@ -1,5 +1,5 @@
|
@@ -1,5 +1,5 @@
|
||||||
/*
|
/*
|
||||||
- * Copyright 1999-2016 The OpenSSL Project Authors. All Rights Reserved.
|
- * Copyright 1999-2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||||
@ -490,9 +490,9 @@ diff -up openssl-1.1.1e/crypto/evp/p5_crpt2.c.evp-kdf openssl-1.1.1e/crypto/evp/
|
|||||||
}
|
}
|
||||||
|
|
||||||
int PKCS5_PBKDF2_HMAC_SHA1(const char *pass, int passlen,
|
int PKCS5_PBKDF2_HMAC_SHA1(const char *pass, int passlen,
|
||||||
diff -up openssl-1.1.1e/crypto/evp/pbe_scrypt.c.evp-kdf openssl-1.1.1e/crypto/evp/pbe_scrypt.c
|
diff -up openssl-1.1.1j/crypto/evp/pbe_scrypt.c.evp-kdf openssl-1.1.1j/crypto/evp/pbe_scrypt.c
|
||||||
--- openssl-1.1.1e/crypto/evp/pbe_scrypt.c.evp-kdf 2020-03-17 15:31:17.000000000 +0100
|
--- openssl-1.1.1j/crypto/evp/pbe_scrypt.c.evp-kdf 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1e/crypto/evp/pbe_scrypt.c 2020-03-19 16:04:20.725900352 +0100
|
+++ openssl-1.1.1j/crypto/evp/pbe_scrypt.c 2021-03-03 14:08:02.491294847 +0100
|
||||||
@@ -7,135 +7,12 @@
|
@@ -7,135 +7,12 @@
|
||||||
* https://www.openssl.org/source/license.html
|
* https://www.openssl.org/source/license.html
|
||||||
*/
|
*/
|
||||||
@ -763,9 +763,9 @@ diff -up openssl-1.1.1e/crypto/evp/pbe_scrypt.c.evp-kdf openssl-1.1.1e/crypto/ev
|
|||||||
}
|
}
|
||||||
+
|
+
|
||||||
#endif
|
#endif
|
||||||
diff -up openssl-1.1.1e/crypto/evp/pkey_kdf.c.evp-kdf openssl-1.1.1e/crypto/evp/pkey_kdf.c
|
diff -up openssl-1.1.1j/crypto/evp/pkey_kdf.c.evp-kdf openssl-1.1.1j/crypto/evp/pkey_kdf.c
|
||||||
--- openssl-1.1.1e/crypto/evp/pkey_kdf.c.evp-kdf 2020-03-19 16:04:20.726900334 +0100
|
--- openssl-1.1.1j/crypto/evp/pkey_kdf.c.evp-kdf 2021-03-03 14:08:02.491294847 +0100
|
||||||
+++ openssl-1.1.1e/crypto/evp/pkey_kdf.c 2020-03-19 16:04:20.725900352 +0100
|
+++ openssl-1.1.1j/crypto/evp/pkey_kdf.c 2021-03-03 14:08:02.491294847 +0100
|
||||||
@@ -0,0 +1,255 @@
|
@@ -0,0 +1,255 @@
|
||||||
+/*
|
+/*
|
||||||
+ * Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
|
+ * Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||||
@ -1022,17 +1022,17 @@ diff -up openssl-1.1.1e/crypto/evp/pkey_kdf.c.evp-kdf openssl-1.1.1e/crypto/evp/
|
|||||||
+ pkey_kdf_ctrl_str
|
+ pkey_kdf_ctrl_str
|
||||||
+};
|
+};
|
||||||
+
|
+
|
||||||
diff -up openssl-1.1.1e/crypto/kdf/build.info.evp-kdf openssl-1.1.1e/crypto/kdf/build.info
|
diff -up openssl-1.1.1j/crypto/kdf/build.info.evp-kdf openssl-1.1.1j/crypto/kdf/build.info
|
||||||
--- openssl-1.1.1e/crypto/kdf/build.info.evp-kdf 2020-03-17 15:31:17.000000000 +0100
|
--- openssl-1.1.1j/crypto/kdf/build.info.evp-kdf 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1e/crypto/kdf/build.info 2020-03-19 16:04:32.347699194 +0100
|
+++ openssl-1.1.1j/crypto/kdf/build.info 2021-03-03 14:08:02.491294847 +0100
|
||||||
@@ -1,3 +1,3 @@
|
@@ -1,3 +1,3 @@
|
||||||
LIBS=../../libcrypto
|
LIBS=../../libcrypto
|
||||||
SOURCE[../../libcrypto]=\
|
SOURCE[../../libcrypto]=\
|
||||||
- tls1_prf.c kdf_err.c hkdf.c scrypt.c
|
- tls1_prf.c kdf_err.c hkdf.c scrypt.c
|
||||||
+ tls1_prf.c kdf_err.c kdf_util.c hkdf.c scrypt.c pbkdf2.c
|
+ tls1_prf.c kdf_err.c kdf_util.c hkdf.c scrypt.c pbkdf2.c
|
||||||
diff -up openssl-1.1.1e/crypto/kdf/hkdf.c.evp-kdf openssl-1.1.1e/crypto/kdf/hkdf.c
|
diff -up openssl-1.1.1j/crypto/kdf/hkdf.c.evp-kdf openssl-1.1.1j/crypto/kdf/hkdf.c
|
||||||
--- openssl-1.1.1e/crypto/kdf/hkdf.c.evp-kdf 2020-03-17 15:31:17.000000000 +0100
|
--- openssl-1.1.1j/crypto/kdf/hkdf.c.evp-kdf 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1e/crypto/kdf/hkdf.c 2020-03-19 16:06:59.757147720 +0100
|
+++ openssl-1.1.1j/crypto/kdf/hkdf.c 2021-03-03 14:08:02.492294856 +0100
|
||||||
@@ -8,32 +8,33 @@
|
@@ -8,32 +8,33 @@
|
||||||
*/
|
*/
|
||||||
|
|
||||||
@ -1498,9 +1498,9 @@ diff -up openssl-1.1.1e/crypto/kdf/hkdf.c.evp-kdf openssl-1.1.1e/crypto/kdf/hkdf
|
|||||||
|
|
||||||
err:
|
err:
|
||||||
OPENSSL_cleanse(prev, sizeof(prev));
|
OPENSSL_cleanse(prev, sizeof(prev));
|
||||||
diff -up openssl-1.1.1e/crypto/kdf/kdf_err.c.evp-kdf openssl-1.1.1e/crypto/kdf/kdf_err.c
|
diff -up openssl-1.1.1j/crypto/kdf/kdf_err.c.evp-kdf openssl-1.1.1j/crypto/kdf/kdf_err.c
|
||||||
--- openssl-1.1.1e/crypto/kdf/kdf_err.c.evp-kdf 2020-03-17 15:31:17.000000000 +0100
|
--- openssl-1.1.1j/crypto/kdf/kdf_err.c.evp-kdf 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1e/crypto/kdf/kdf_err.c 2020-03-19 16:04:32.349699159 +0100
|
+++ openssl-1.1.1j/crypto/kdf/kdf_err.c 2021-03-03 14:08:02.492294856 +0100
|
||||||
@@ -1,6 +1,6 @@
|
@@ -1,6 +1,6 @@
|
||||||
/*
|
/*
|
||||||
* Generated by util/mkerr.pl DO NOT EDIT
|
* Generated by util/mkerr.pl DO NOT EDIT
|
||||||
@ -1556,9 +1556,9 @@ diff -up openssl-1.1.1e/crypto/kdf/kdf_err.c.evp-kdf openssl-1.1.1e/crypto/kdf/k
|
|||||||
{0, NULL}
|
{0, NULL}
|
||||||
};
|
};
|
||||||
|
|
||||||
diff -up openssl-1.1.1e/crypto/kdf/kdf_local.h.evp-kdf openssl-1.1.1e/crypto/kdf/kdf_local.h
|
diff -up openssl-1.1.1j/crypto/kdf/kdf_local.h.evp-kdf openssl-1.1.1j/crypto/kdf/kdf_local.h
|
||||||
--- openssl-1.1.1e/crypto/kdf/kdf_local.h.evp-kdf 2020-03-19 16:04:32.349699159 +0100
|
--- openssl-1.1.1j/crypto/kdf/kdf_local.h.evp-kdf 2021-03-03 14:08:02.492294856 +0100
|
||||||
+++ openssl-1.1.1e/crypto/kdf/kdf_local.h 2020-03-19 16:04:32.349699159 +0100
|
+++ openssl-1.1.1j/crypto/kdf/kdf_local.h 2021-03-03 14:08:02.492294856 +0100
|
||||||
@@ -0,0 +1,22 @@
|
@@ -0,0 +1,22 @@
|
||||||
+/*
|
+/*
|
||||||
+ * Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
|
+ * Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||||
@ -1582,9 +1582,9 @@ diff -up openssl-1.1.1e/crypto/kdf/kdf_local.h.evp-kdf openssl-1.1.1e/crypto/kdf
|
|||||||
+ int (*ctrl)(EVP_KDF_IMPL *impl, int cmd, va_list args),
|
+ int (*ctrl)(EVP_KDF_IMPL *impl, int cmd, va_list args),
|
||||||
+ int cmd, const char *md_name);
|
+ int cmd, const char *md_name);
|
||||||
+
|
+
|
||||||
diff -up openssl-1.1.1e/crypto/kdf/kdf_util.c.evp-kdf openssl-1.1.1e/crypto/kdf/kdf_util.c
|
diff -up openssl-1.1.1j/crypto/kdf/kdf_util.c.evp-kdf openssl-1.1.1j/crypto/kdf/kdf_util.c
|
||||||
--- openssl-1.1.1e/crypto/kdf/kdf_util.c.evp-kdf 2020-03-19 16:04:32.350699142 +0100
|
--- openssl-1.1.1j/crypto/kdf/kdf_util.c.evp-kdf 2021-03-03 14:08:02.492294856 +0100
|
||||||
+++ openssl-1.1.1e/crypto/kdf/kdf_util.c 2020-03-19 16:04:32.350699142 +0100
|
+++ openssl-1.1.1j/crypto/kdf/kdf_util.c 2021-03-03 14:08:02.492294856 +0100
|
||||||
@@ -0,0 +1,73 @@
|
@@ -0,0 +1,73 @@
|
||||||
+/*
|
+/*
|
||||||
+ * Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
|
+ * Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||||
@ -1659,9 +1659,9 @@ diff -up openssl-1.1.1e/crypto/kdf/kdf_util.c.evp-kdf openssl-1.1.1e/crypto/kdf/
|
|||||||
+ return call_ctrl(ctrl, impl, cmd, md);
|
+ return call_ctrl(ctrl, impl, cmd, md);
|
||||||
+}
|
+}
|
||||||
+
|
+
|
||||||
diff -up openssl-1.1.1e/crypto/kdf/pbkdf2.c.evp-kdf openssl-1.1.1e/crypto/kdf/pbkdf2.c
|
diff -up openssl-1.1.1j/crypto/kdf/pbkdf2.c.evp-kdf openssl-1.1.1j/crypto/kdf/pbkdf2.c
|
||||||
--- openssl-1.1.1e/crypto/kdf/pbkdf2.c.evp-kdf 2020-03-19 16:04:32.374698727 +0100
|
--- openssl-1.1.1j/crypto/kdf/pbkdf2.c.evp-kdf 2021-03-03 14:08:02.492294856 +0100
|
||||||
+++ openssl-1.1.1e/crypto/kdf/pbkdf2.c 2020-03-19 16:04:32.374698727 +0100
|
+++ openssl-1.1.1j/crypto/kdf/pbkdf2.c 2021-03-03 14:08:02.492294856 +0100
|
||||||
@@ -0,0 +1,264 @@
|
@@ -0,0 +1,264 @@
|
||||||
+/*
|
+/*
|
||||||
+ * Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
|
+ * Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||||
@ -1927,9 +1927,9 @@ diff -up openssl-1.1.1e/crypto/kdf/pbkdf2.c.evp-kdf openssl-1.1.1e/crypto/kdf/pb
|
|||||||
+ HMAC_CTX_free(hctx_tpl);
|
+ HMAC_CTX_free(hctx_tpl);
|
||||||
+ return ret;
|
+ return ret;
|
||||||
+}
|
+}
|
||||||
diff -up openssl-1.1.1e/crypto/kdf/scrypt.c.evp-kdf openssl-1.1.1e/crypto/kdf/scrypt.c
|
diff -up openssl-1.1.1j/crypto/kdf/scrypt.c.evp-kdf openssl-1.1.1j/crypto/kdf/scrypt.c
|
||||||
--- openssl-1.1.1e/crypto/kdf/scrypt.c.evp-kdf 2020-03-17 15:31:17.000000000 +0100
|
--- openssl-1.1.1j/crypto/kdf/scrypt.c.evp-kdf 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1e/crypto/kdf/scrypt.c 2020-03-19 16:11:06.215872475 +0100
|
+++ openssl-1.1.1j/crypto/kdf/scrypt.c 2021-03-03 14:08:02.492294856 +0100
|
||||||
@@ -8,25 +8,35 @@
|
@@ -8,25 +8,35 @@
|
||||||
*/
|
*/
|
||||||
|
|
||||||
@ -2517,9 +2517,9 @@ diff -up openssl-1.1.1e/crypto/kdf/scrypt.c.evp-kdf openssl-1.1.1e/crypto/kdf/sc
|
|||||||
+}
|
+}
|
||||||
|
|
||||||
#endif
|
#endif
|
||||||
diff -up openssl-1.1.1e/crypto/kdf/tls1_prf.c.evp-kdf openssl-1.1.1e/crypto/kdf/tls1_prf.c
|
diff -up openssl-1.1.1j/crypto/kdf/tls1_prf.c.evp-kdf openssl-1.1.1j/crypto/kdf/tls1_prf.c
|
||||||
--- openssl-1.1.1e/crypto/kdf/tls1_prf.c.evp-kdf 2020-03-17 15:31:17.000000000 +0100
|
--- openssl-1.1.1j/crypto/kdf/tls1_prf.c.evp-kdf 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1e/crypto/kdf/tls1_prf.c 2020-03-19 16:10:32.317460707 +0100
|
+++ openssl-1.1.1j/crypto/kdf/tls1_prf.c 2021-03-03 14:08:02.492294856 +0100
|
||||||
@@ -8,11 +8,15 @@
|
@@ -8,11 +8,15 @@
|
||||||
*/
|
*/
|
||||||
|
|
||||||
@ -2802,9 +2802,9 @@ diff -up openssl-1.1.1e/crypto/kdf/tls1_prf.c.evp-kdf openssl-1.1.1e/crypto/kdf/
|
|||||||
OPENSSL_clear_free(tmp, olen);
|
OPENSSL_clear_free(tmp, olen);
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
diff -up openssl-1.1.1e/doc/man3/EVP_KDF_CTX.pod.evp-kdf openssl-1.1.1e/doc/man3/EVP_KDF_CTX.pod
|
diff -up openssl-1.1.1j/doc/man3/EVP_KDF_CTX.pod.evp-kdf openssl-1.1.1j/doc/man3/EVP_KDF_CTX.pod
|
||||||
--- openssl-1.1.1e/doc/man3/EVP_KDF_CTX.pod.evp-kdf 2020-03-19 16:04:32.377698675 +0100
|
--- openssl-1.1.1j/doc/man3/EVP_KDF_CTX.pod.evp-kdf 2021-03-03 14:08:02.492294856 +0100
|
||||||
+++ openssl-1.1.1e/doc/man3/EVP_KDF_CTX.pod 2020-03-19 16:04:32.377698675 +0100
|
+++ openssl-1.1.1j/doc/man3/EVP_KDF_CTX.pod 2021-03-03 14:08:02.492294856 +0100
|
||||||
@@ -0,0 +1,217 @@
|
@@ -0,0 +1,217 @@
|
||||||
+=pod
|
+=pod
|
||||||
+
|
+
|
||||||
@ -3023,9 +3023,9 @@ diff -up openssl-1.1.1e/doc/man3/EVP_KDF_CTX.pod.evp-kdf openssl-1.1.1e/doc/man3
|
|||||||
+L<https://www.openssl.org/source/license.html>.
|
+L<https://www.openssl.org/source/license.html>.
|
||||||
+
|
+
|
||||||
+=cut
|
+=cut
|
||||||
diff -up openssl-1.1.1e/doc/man7/EVP_KDF_HKDF.pod.evp-kdf openssl-1.1.1e/doc/man7/EVP_KDF_HKDF.pod
|
diff -up openssl-1.1.1j/doc/man7/EVP_KDF_HKDF.pod.evp-kdf openssl-1.1.1j/doc/man7/EVP_KDF_HKDF.pod
|
||||||
--- openssl-1.1.1e/doc/man7/EVP_KDF_HKDF.pod.evp-kdf 2020-03-19 16:04:32.377698675 +0100
|
--- openssl-1.1.1j/doc/man7/EVP_KDF_HKDF.pod.evp-kdf 2021-03-03 14:08:02.493294865 +0100
|
||||||
+++ openssl-1.1.1e/doc/man7/EVP_KDF_HKDF.pod 2020-03-19 16:04:32.377698675 +0100
|
+++ openssl-1.1.1j/doc/man7/EVP_KDF_HKDF.pod 2021-03-03 14:08:02.493294865 +0100
|
||||||
@@ -0,0 +1,180 @@
|
@@ -0,0 +1,180 @@
|
||||||
+=pod
|
+=pod
|
||||||
+
|
+
|
||||||
@ -3207,9 +3207,9 @@ diff -up openssl-1.1.1e/doc/man7/EVP_KDF_HKDF.pod.evp-kdf openssl-1.1.1e/doc/man
|
|||||||
+L<https://www.openssl.org/source/license.html>.
|
+L<https://www.openssl.org/source/license.html>.
|
||||||
+
|
+
|
||||||
+=cut
|
+=cut
|
||||||
diff -up openssl-1.1.1e/doc/man7/EVP_KDF_PBKDF2.pod.evp-kdf openssl-1.1.1e/doc/man7/EVP_KDF_PBKDF2.pod
|
diff -up openssl-1.1.1j/doc/man7/EVP_KDF_PBKDF2.pod.evp-kdf openssl-1.1.1j/doc/man7/EVP_KDF_PBKDF2.pod
|
||||||
--- openssl-1.1.1e/doc/man7/EVP_KDF_PBKDF2.pod.evp-kdf 2020-03-19 16:04:32.378698658 +0100
|
--- openssl-1.1.1j/doc/man7/EVP_KDF_PBKDF2.pod.evp-kdf 2021-03-03 14:08:02.493294865 +0100
|
||||||
+++ openssl-1.1.1e/doc/man7/EVP_KDF_PBKDF2.pod 2020-03-19 16:04:32.378698658 +0100
|
+++ openssl-1.1.1j/doc/man7/EVP_KDF_PBKDF2.pod 2021-03-03 14:08:02.493294865 +0100
|
||||||
@@ -0,0 +1,78 @@
|
@@ -0,0 +1,78 @@
|
||||||
+=pod
|
+=pod
|
||||||
+
|
+
|
||||||
@ -3289,9 +3289,9 @@ diff -up openssl-1.1.1e/doc/man7/EVP_KDF_PBKDF2.pod.evp-kdf openssl-1.1.1e/doc/m
|
|||||||
+L<https://www.openssl.org/source/license.html>.
|
+L<https://www.openssl.org/source/license.html>.
|
||||||
+
|
+
|
||||||
+=cut
|
+=cut
|
||||||
diff -up openssl-1.1.1e/doc/man7/EVP_KDF_SCRYPT.pod.evp-kdf openssl-1.1.1e/doc/man7/EVP_KDF_SCRYPT.pod
|
diff -up openssl-1.1.1j/doc/man7/EVP_KDF_SCRYPT.pod.evp-kdf openssl-1.1.1j/doc/man7/EVP_KDF_SCRYPT.pod
|
||||||
--- openssl-1.1.1e/doc/man7/EVP_KDF_SCRYPT.pod.evp-kdf 2020-03-19 16:04:32.378698658 +0100
|
--- openssl-1.1.1j/doc/man7/EVP_KDF_SCRYPT.pod.evp-kdf 2021-03-03 14:08:02.493294865 +0100
|
||||||
+++ openssl-1.1.1e/doc/man7/EVP_KDF_SCRYPT.pod 2020-03-19 16:04:32.378698658 +0100
|
+++ openssl-1.1.1j/doc/man7/EVP_KDF_SCRYPT.pod 2021-03-03 14:08:02.493294865 +0100
|
||||||
@@ -0,0 +1,149 @@
|
@@ -0,0 +1,149 @@
|
||||||
+=pod
|
+=pod
|
||||||
+
|
+
|
||||||
@ -3442,9 +3442,9 @@ diff -up openssl-1.1.1e/doc/man7/EVP_KDF_SCRYPT.pod.evp-kdf openssl-1.1.1e/doc/m
|
|||||||
+L<https://www.openssl.org/source/license.html>.
|
+L<https://www.openssl.org/source/license.html>.
|
||||||
+
|
+
|
||||||
+=cut
|
+=cut
|
||||||
diff -up openssl-1.1.1e/doc/man7/EVP_KDF_TLS1_PRF.pod.evp-kdf openssl-1.1.1e/doc/man7/EVP_KDF_TLS1_PRF.pod
|
diff -up openssl-1.1.1j/doc/man7/EVP_KDF_TLS1_PRF.pod.evp-kdf openssl-1.1.1j/doc/man7/EVP_KDF_TLS1_PRF.pod
|
||||||
--- openssl-1.1.1e/doc/man7/EVP_KDF_TLS1_PRF.pod.evp-kdf 2020-03-19 16:04:32.378698658 +0100
|
--- openssl-1.1.1j/doc/man7/EVP_KDF_TLS1_PRF.pod.evp-kdf 2021-03-03 14:08:02.493294865 +0100
|
||||||
+++ openssl-1.1.1e/doc/man7/EVP_KDF_TLS1_PRF.pod 2020-03-19 16:04:32.378698658 +0100
|
+++ openssl-1.1.1j/doc/man7/EVP_KDF_TLS1_PRF.pod 2021-03-03 14:08:02.493294865 +0100
|
||||||
@@ -0,0 +1,142 @@
|
@@ -0,0 +1,142 @@
|
||||||
+=pod
|
+=pod
|
||||||
+
|
+
|
||||||
@ -3588,9 +3588,9 @@ diff -up openssl-1.1.1e/doc/man7/EVP_KDF_TLS1_PRF.pod.evp-kdf openssl-1.1.1e/doc
|
|||||||
+L<https://www.openssl.org/source/license.html>.
|
+L<https://www.openssl.org/source/license.html>.
|
||||||
+
|
+
|
||||||
+=cut
|
+=cut
|
||||||
diff -up openssl-1.1.1e/include/crypto/evp.h.evp-kdf openssl-1.1.1e/include/crypto/evp.h
|
diff -up openssl-1.1.1j/include/crypto/evp.h.evp-kdf openssl-1.1.1j/include/crypto/evp.h
|
||||||
--- openssl-1.1.1e/include/crypto/evp.h.evp-kdf 2020-03-17 15:31:17.000000000 +0100
|
--- openssl-1.1.1j/include/crypto/evp.h.evp-kdf 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1e/include/crypto/evp.h 2020-03-19 16:04:32.347699194 +0100
|
+++ openssl-1.1.1j/include/crypto/evp.h 2021-03-03 14:08:02.493294865 +0100
|
||||||
@@ -112,6 +112,24 @@ extern const EVP_PKEY_METHOD hkdf_pkey_m
|
@@ -112,6 +112,24 @@ extern const EVP_PKEY_METHOD hkdf_pkey_m
|
||||||
extern const EVP_PKEY_METHOD poly1305_pkey_meth;
|
extern const EVP_PKEY_METHOD poly1305_pkey_meth;
|
||||||
extern const EVP_PKEY_METHOD siphash_pkey_meth;
|
extern const EVP_PKEY_METHOD siphash_pkey_meth;
|
||||||
@ -3616,10 +3616,10 @@ diff -up openssl-1.1.1e/include/crypto/evp.h.evp-kdf openssl-1.1.1e/include/cryp
|
|||||||
struct evp_md_st {
|
struct evp_md_st {
|
||||||
int type;
|
int type;
|
||||||
int pkey_type;
|
int pkey_type;
|
||||||
diff -up openssl-1.1.1e/include/openssl/evperr.h.evp-kdf openssl-1.1.1e/include/openssl/evperr.h
|
diff -up openssl-1.1.1j/include/openssl/evperr.h.evp-kdf openssl-1.1.1j/include/openssl/evperr.h
|
||||||
--- openssl-1.1.1e/include/openssl/evperr.h.evp-kdf 2020-03-19 16:04:11.250064365 +0100
|
--- openssl-1.1.1j/include/openssl/evperr.h.evp-kdf 2021-03-03 14:08:02.477294722 +0100
|
||||||
+++ openssl-1.1.1e/include/openssl/evperr.h 2020-03-19 16:04:32.379698640 +0100
|
+++ openssl-1.1.1j/include/openssl/evperr.h 2021-03-03 14:13:37.587003722 +0100
|
||||||
@@ -58,6 +58,9 @@ int ERR_load_EVP_strings(void);
|
@@ -56,6 +56,9 @@ int ERR_load_EVP_strings(void);
|
||||||
# define EVP_F_EVP_ENCRYPTDECRYPTUPDATE 219
|
# define EVP_F_EVP_ENCRYPTDECRYPTUPDATE 219
|
||||||
# define EVP_F_EVP_ENCRYPTFINAL_EX 127
|
# define EVP_F_EVP_ENCRYPTFINAL_EX 127
|
||||||
# define EVP_F_EVP_ENCRYPTUPDATE 167
|
# define EVP_F_EVP_ENCRYPTUPDATE 167
|
||||||
@ -3629,7 +3629,7 @@ diff -up openssl-1.1.1e/include/openssl/evperr.h.evp-kdf openssl-1.1.1e/include/
|
|||||||
# define EVP_F_EVP_MD_CTX_COPY_EX 110
|
# define EVP_F_EVP_MD_CTX_COPY_EX 110
|
||||||
# define EVP_F_EVP_MD_SIZE 162
|
# define EVP_F_EVP_MD_SIZE 162
|
||||||
# define EVP_F_EVP_OPENINIT 102
|
# define EVP_F_EVP_OPENINIT 102
|
||||||
@@ -120,11 +123,13 @@ int ERR_load_EVP_strings(void);
|
@@ -118,11 +121,13 @@ int ERR_load_EVP_strings(void);
|
||||||
# define EVP_F_PKCS5_V2_PBE_KEYIVGEN 118
|
# define EVP_F_PKCS5_V2_PBE_KEYIVGEN 118
|
||||||
# define EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN 164
|
# define EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN 164
|
||||||
# define EVP_F_PKCS5_V2_SCRYPT_KEYIVGEN 180
|
# define EVP_F_PKCS5_V2_SCRYPT_KEYIVGEN 180
|
||||||
@ -3643,17 +3643,17 @@ diff -up openssl-1.1.1e/include/openssl/evperr.h.evp-kdf openssl-1.1.1e/include/
|
|||||||
# define EVP_F_UPDATE 173
|
# define EVP_F_UPDATE 173
|
||||||
|
|
||||||
/*
|
/*
|
||||||
@@ -181,6 +186,7 @@ int ERR_load_EVP_strings(void);
|
@@ -179,6 +184,7 @@ int ERR_load_EVP_strings(void);
|
||||||
# define EVP_R_ONLY_ONESHOT_SUPPORTED 177
|
# define EVP_R_ONLY_ONESHOT_SUPPORTED 177
|
||||||
# define EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE 150
|
# define EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE 150
|
||||||
# define EVP_R_OPERATON_NOT_INITIALIZED 151
|
# define EVP_R_OPERATON_NOT_INITIALIZED 151
|
||||||
+# define EVP_R_PARAMETER_TOO_LARGE 187
|
+# define EVP_R_PARAMETER_TOO_LARGE 187
|
||||||
|
# define EVP_R_OUTPUT_WOULD_OVERFLOW 184
|
||||||
# define EVP_R_PARTIALLY_OVERLAPPING 162
|
# define EVP_R_PARTIALLY_OVERLAPPING 162
|
||||||
# define EVP_R_PBKDF2_ERROR 181
|
# define EVP_R_PBKDF2_ERROR 181
|
||||||
# define EVP_R_PKEY_APPLICATION_ASN1_METHOD_ALREADY_REGISTERED 179
|
diff -up openssl-1.1.1j/include/openssl/kdferr.h.evp-kdf openssl-1.1.1j/include/openssl/kdferr.h
|
||||||
diff -up openssl-1.1.1e/include/openssl/kdferr.h.evp-kdf openssl-1.1.1e/include/openssl/kdferr.h
|
--- openssl-1.1.1j/include/openssl/kdferr.h.evp-kdf 2021-02-16 16:24:01.000000000 +0100
|
||||||
--- openssl-1.1.1e/include/openssl/kdferr.h.evp-kdf 2020-03-17 15:31:17.000000000 +0100
|
+++ openssl-1.1.1j/include/openssl/kdferr.h 2021-03-03 14:08:02.493294865 +0100
|
||||||
+++ openssl-1.1.1e/include/openssl/kdferr.h 2020-03-19 16:04:32.379698640 +0100
|
|
||||||
@@ -23,6 +23,23 @@ int ERR_load_KDF_strings(void);
|
@@ -23,6 +23,23 @@ int ERR_load_KDF_strings(void);
|
||||||
/*
|
/*
|
||||||
* KDF function codes.
|
* KDF function codes.
|
||||||
@ -3693,9 +3693,9 @@ diff -up openssl-1.1.1e/include/openssl/kdferr.h.evp-kdf openssl-1.1.1e/include/
|
|||||||
+# define KDF_R_WRONG_OUTPUT_BUFFER_SIZE 112
|
+# define KDF_R_WRONG_OUTPUT_BUFFER_SIZE 112
|
||||||
|
|
||||||
#endif
|
#endif
|
||||||
diff -up openssl-1.1.1e/include/openssl/kdf.h.evp-kdf openssl-1.1.1e/include/openssl/kdf.h
|
diff -up openssl-1.1.1j/include/openssl/kdf.h.evp-kdf openssl-1.1.1j/include/openssl/kdf.h
|
||||||
--- openssl-1.1.1e/include/openssl/kdf.h.evp-kdf 2020-03-17 15:31:17.000000000 +0100
|
--- openssl-1.1.1j/include/openssl/kdf.h.evp-kdf 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1e/include/openssl/kdf.h 2020-03-19 16:04:32.380698623 +0100
|
+++ openssl-1.1.1j/include/openssl/kdf.h 2021-03-03 14:08:02.493294865 +0100
|
||||||
@@ -10,10 +10,50 @@
|
@@ -10,10 +10,50 @@
|
||||||
#ifndef HEADER_KDF_H
|
#ifndef HEADER_KDF_H
|
||||||
# define HEADER_KDF_H
|
# define HEADER_KDF_H
|
||||||
@ -3774,9 +3774,9 @@ diff -up openssl-1.1.1e/include/openssl/kdf.h.evp-kdf openssl-1.1.1e/include/ope
|
|||||||
}
|
}
|
||||||
# endif
|
# endif
|
||||||
#endif
|
#endif
|
||||||
diff -up openssl-1.1.1e/include/openssl/ossl_typ.h.evp-kdf openssl-1.1.1e/include/openssl/ossl_typ.h
|
diff -up openssl-1.1.1j/include/openssl/ossl_typ.h.evp-kdf openssl-1.1.1j/include/openssl/ossl_typ.h
|
||||||
--- openssl-1.1.1e/include/openssl/ossl_typ.h.evp-kdf 2020-03-17 15:31:17.000000000 +0100
|
--- openssl-1.1.1j/include/openssl/ossl_typ.h.evp-kdf 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1e/include/openssl/ossl_typ.h 2020-03-19 16:04:32.381698606 +0100
|
+++ openssl-1.1.1j/include/openssl/ossl_typ.h 2021-03-03 14:08:02.493294865 +0100
|
||||||
@@ -97,6 +97,8 @@ typedef struct evp_pkey_asn1_method_st E
|
@@ -97,6 +97,8 @@ typedef struct evp_pkey_asn1_method_st E
|
||||||
typedef struct evp_pkey_method_st EVP_PKEY_METHOD;
|
typedef struct evp_pkey_method_st EVP_PKEY_METHOD;
|
||||||
typedef struct evp_pkey_ctx_st EVP_PKEY_CTX;
|
typedef struct evp_pkey_ctx_st EVP_PKEY_CTX;
|
||||||
@ -3786,9 +3786,9 @@ diff -up openssl-1.1.1e/include/openssl/ossl_typ.h.evp-kdf openssl-1.1.1e/includ
|
|||||||
typedef struct evp_Encode_Ctx_st EVP_ENCODE_CTX;
|
typedef struct evp_Encode_Ctx_st EVP_ENCODE_CTX;
|
||||||
|
|
||||||
typedef struct hmac_ctx_st HMAC_CTX;
|
typedef struct hmac_ctx_st HMAC_CTX;
|
||||||
diff -up openssl-1.1.1e/test/build.info.evp-kdf openssl-1.1.1e/test/build.info
|
diff -up openssl-1.1.1j/test/build.info.evp-kdf openssl-1.1.1j/test/build.info
|
||||||
--- openssl-1.1.1e/test/build.info.evp-kdf 2020-03-17 15:31:17.000000000 +0100
|
--- openssl-1.1.1j/test/build.info.evp-kdf 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1e/test/build.info 2020-03-19 16:04:32.381698606 +0100
|
+++ openssl-1.1.1j/test/build.info 2021-03-03 14:08:02.493294865 +0100
|
||||||
@@ -44,7 +44,8 @@ INCLUDE_MAIN___test_libtestutil_OLB = /I
|
@@ -44,7 +44,8 @@ INCLUDE_MAIN___test_libtestutil_OLB = /I
|
||||||
ssl_test_ctx_test ssl_test x509aux cipherlist_test asynciotest \
|
ssl_test_ctx_test ssl_test x509aux cipherlist_test asynciotest \
|
||||||
bio_callback_test bio_memleak_test \
|
bio_callback_test bio_memleak_test \
|
||||||
@ -3810,9 +3810,9 @@ diff -up openssl-1.1.1e/test/build.info.evp-kdf openssl-1.1.1e/test/build.info
|
|||||||
SOURCE[x509_time_test]=x509_time_test.c
|
SOURCE[x509_time_test]=x509_time_test.c
|
||||||
INCLUDE[x509_time_test]=../include
|
INCLUDE[x509_time_test]=../include
|
||||||
DEPEND[x509_time_test]=../libcrypto libtestutil.a
|
DEPEND[x509_time_test]=../libcrypto libtestutil.a
|
||||||
diff -up openssl-1.1.1e/test/evp_kdf_test.c.evp-kdf openssl-1.1.1e/test/evp_kdf_test.c
|
diff -up openssl-1.1.1j/test/evp_kdf_test.c.evp-kdf openssl-1.1.1j/test/evp_kdf_test.c
|
||||||
--- openssl-1.1.1e/test/evp_kdf_test.c.evp-kdf 2020-03-19 16:04:32.382698588 +0100
|
--- openssl-1.1.1j/test/evp_kdf_test.c.evp-kdf 2021-03-03 14:08:02.494294874 +0100
|
||||||
+++ openssl-1.1.1e/test/evp_kdf_test.c 2020-03-19 16:04:32.382698588 +0100
|
+++ openssl-1.1.1j/test/evp_kdf_test.c 2021-03-03 14:08:02.494294874 +0100
|
||||||
@@ -0,0 +1,237 @@
|
@@ -0,0 +1,237 @@
|
||||||
+/*
|
+/*
|
||||||
+ * Copyright 2018-2019 The OpenSSL Project Authors. All Rights Reserved.
|
+ * Copyright 2018-2019 The OpenSSL Project Authors. All Rights Reserved.
|
||||||
@ -4051,9 +4051,9 @@ diff -up openssl-1.1.1e/test/evp_kdf_test.c.evp-kdf openssl-1.1.1e/test/evp_kdf_
|
|||||||
+#endif
|
+#endif
|
||||||
+ return 1;
|
+ return 1;
|
||||||
+}
|
+}
|
||||||
diff -up openssl-1.1.1e/test/evp_test.c.evp-kdf openssl-1.1.1e/test/evp_test.c
|
diff -up openssl-1.1.1j/test/evp_test.c.evp-kdf openssl-1.1.1j/test/evp_test.c
|
||||||
--- openssl-1.1.1e/test/evp_test.c.evp-kdf 2020-03-17 15:31:17.000000000 +0100
|
--- openssl-1.1.1j/test/evp_test.c.evp-kdf 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1e/test/evp_test.c 2020-03-19 16:04:32.383698571 +0100
|
+++ openssl-1.1.1j/test/evp_test.c 2021-03-03 14:08:02.494294874 +0100
|
||||||
@@ -1705,13 +1705,14 @@ static const EVP_TEST_METHOD encode_test
|
@@ -1705,13 +1705,14 @@ static const EVP_TEST_METHOD encode_test
|
||||||
encode_test_run,
|
encode_test_run,
|
||||||
};
|
};
|
||||||
@ -4265,9 +4265,9 @@ diff -up openssl-1.1.1e/test/evp_test.c.evp-kdf openssl-1.1.1e/test/evp_test.c
|
|||||||
&keypair_test_method,
|
&keypair_test_method,
|
||||||
&keygen_test_method,
|
&keygen_test_method,
|
||||||
&mac_test_method,
|
&mac_test_method,
|
||||||
diff -up openssl-1.1.1e/test/pkey_meth_kdf_test.c.evp-kdf openssl-1.1.1e/test/pkey_meth_kdf_test.c
|
diff -up openssl-1.1.1j/test/pkey_meth_kdf_test.c.evp-kdf openssl-1.1.1j/test/pkey_meth_kdf_test.c
|
||||||
--- openssl-1.1.1e/test/pkey_meth_kdf_test.c.evp-kdf 2020-03-17 15:31:17.000000000 +0100
|
--- openssl-1.1.1j/test/pkey_meth_kdf_test.c.evp-kdf 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1e/test/pkey_meth_kdf_test.c 2020-03-19 16:04:32.386698519 +0100
|
+++ openssl-1.1.1j/test/pkey_meth_kdf_test.c 2021-03-03 14:08:02.494294874 +0100
|
||||||
@@ -1,5 +1,5 @@
|
@@ -1,5 +1,5 @@
|
||||||
/*
|
/*
|
||||||
- * Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
|
- * Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||||
@ -4471,9 +4471,9 @@ diff -up openssl-1.1.1e/test/pkey_meth_kdf_test.c.evp-kdf openssl-1.1.1e/test/pk
|
|||||||
}
|
}
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
diff -up openssl-1.1.1e/test/recipes/30-test_evp_data/evpkdf.txt.evp-kdf openssl-1.1.1e/test/recipes/30-test_evp_data/evpkdf.txt
|
diff -up openssl-1.1.1j/test/recipes/30-test_evp_data/evpkdf.txt.evp-kdf openssl-1.1.1j/test/recipes/30-test_evp_data/evpkdf.txt
|
||||||
--- openssl-1.1.1e/test/recipes/30-test_evp_data/evpkdf.txt.evp-kdf 2020-03-17 15:31:17.000000000 +0100
|
--- openssl-1.1.1j/test/recipes/30-test_evp_data/evpkdf.txt.evp-kdf 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1e/test/recipes/30-test_evp_data/evpkdf.txt 2020-03-19 16:04:32.388698484 +0100
|
+++ openssl-1.1.1j/test/recipes/30-test_evp_data/evpkdf.txt 2021-03-03 14:08:02.494294874 +0100
|
||||||
@@ -1,5 +1,5 @@
|
@@ -1,5 +1,5 @@
|
||||||
#
|
#
|
||||||
-# Copyright 2001-2017 The OpenSSL Project Authors. All Rights Reserved.
|
-# Copyright 2001-2017 The OpenSSL Project Authors. All Rights Reserved.
|
||||||
@ -4872,9 +4872,9 @@ diff -up openssl-1.1.1e/test/recipes/30-test_evp_data/evpkdf.txt.evp-kdf openssl
|
|||||||
+Ctrl.digest = digest:sha512
|
+Ctrl.digest = digest:sha512
|
||||||
+Output = 00ef42cdbfc98d29db20976608e455567fdddf14
|
+Output = 00ef42cdbfc98d29db20976608e455567fdddf14
|
||||||
+
|
+
|
||||||
diff -up openssl-1.1.1e/test/recipes/30-test_evp_data/evppkey_kdf.txt.evp-kdf openssl-1.1.1e/test/recipes/30-test_evp_data/evppkey_kdf.txt
|
diff -up openssl-1.1.1j/test/recipes/30-test_evp_data/evppkey_kdf.txt.evp-kdf openssl-1.1.1j/test/recipes/30-test_evp_data/evppkey_kdf.txt
|
||||||
--- openssl-1.1.1e/test/recipes/30-test_evp_data/evppkey_kdf.txt.evp-kdf 2020-03-19 16:04:32.389698467 +0100
|
--- openssl-1.1.1j/test/recipes/30-test_evp_data/evppkey_kdf.txt.evp-kdf 2021-03-03 14:08:02.494294874 +0100
|
||||||
+++ openssl-1.1.1e/test/recipes/30-test_evp_data/evppkey_kdf.txt 2020-03-19 16:04:32.389698467 +0100
|
+++ openssl-1.1.1j/test/recipes/30-test_evp_data/evppkey_kdf.txt 2021-03-03 14:08:02.494294874 +0100
|
||||||
@@ -0,0 +1,305 @@
|
@@ -0,0 +1,305 @@
|
||||||
+#
|
+#
|
||||||
+# Copyright 2001-2018 The OpenSSL Project Authors. All Rights Reserved.
|
+# Copyright 2001-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||||
@ -5181,9 +5181,9 @@ diff -up openssl-1.1.1e/test/recipes/30-test_evp_data/evppkey_kdf.txt.evp-kdf op
|
|||||||
+Ctrl.p = p:1
|
+Ctrl.p = p:1
|
||||||
+Result = INTERNAL_ERROR
|
+Result = INTERNAL_ERROR
|
||||||
+
|
+
|
||||||
diff -up openssl-1.1.1e/test/recipes/30-test_evp_kdf.t.evp-kdf openssl-1.1.1e/test/recipes/30-test_evp_kdf.t
|
diff -up openssl-1.1.1j/test/recipes/30-test_evp_kdf.t.evp-kdf openssl-1.1.1j/test/recipes/30-test_evp_kdf.t
|
||||||
--- openssl-1.1.1e/test/recipes/30-test_evp_kdf.t.evp-kdf 2020-03-19 16:04:32.390698450 +0100
|
--- openssl-1.1.1j/test/recipes/30-test_evp_kdf.t.evp-kdf 2021-03-03 14:08:02.494294874 +0100
|
||||||
+++ openssl-1.1.1e/test/recipes/30-test_evp_kdf.t 2020-03-19 16:04:32.390698450 +0100
|
+++ openssl-1.1.1j/test/recipes/30-test_evp_kdf.t 2021-03-03 14:08:02.494294874 +0100
|
||||||
@@ -0,0 +1,13 @@
|
@@ -0,0 +1,13 @@
|
||||||
+#! /usr/bin/env perl
|
+#! /usr/bin/env perl
|
||||||
+# Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
|
+# Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||||
@ -5198,9 +5198,9 @@ diff -up openssl-1.1.1e/test/recipes/30-test_evp_kdf.t.evp-kdf openssl-1.1.1e/te
|
|||||||
+use OpenSSL::Test::Simple;
|
+use OpenSSL::Test::Simple;
|
||||||
+
|
+
|
||||||
+simple_test("test_evp_kdf", "evp_kdf_test");
|
+simple_test("test_evp_kdf", "evp_kdf_test");
|
||||||
diff -up openssl-1.1.1e/test/recipes/30-test_evp.t.evp-kdf openssl-1.1.1e/test/recipes/30-test_evp.t
|
diff -up openssl-1.1.1j/test/recipes/30-test_evp.t.evp-kdf openssl-1.1.1j/test/recipes/30-test_evp.t
|
||||||
--- openssl-1.1.1e/test/recipes/30-test_evp.t.evp-kdf 2020-03-17 15:31:17.000000000 +0100
|
--- openssl-1.1.1j/test/recipes/30-test_evp.t.evp-kdf 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1e/test/recipes/30-test_evp.t 2020-03-19 16:04:32.390698450 +0100
|
+++ openssl-1.1.1j/test/recipes/30-test_evp.t 2021-03-03 14:08:02.495294883 +0100
|
||||||
@@ -15,7 +15,7 @@ use OpenSSL::Test qw/:DEFAULT data_file/
|
@@ -15,7 +15,7 @@ use OpenSSL::Test qw/:DEFAULT data_file/
|
||||||
setup("test_evp");
|
setup("test_evp");
|
||||||
|
|
||||||
@ -5210,10 +5210,10 @@ diff -up openssl-1.1.1e/test/recipes/30-test_evp.t.evp-kdf openssl-1.1.1e/test/r
|
|||||||
"evpcase.txt", "evpccmcavs.txt" );
|
"evpcase.txt", "evpccmcavs.txt" );
|
||||||
|
|
||||||
plan tests => scalar(@files);
|
plan tests => scalar(@files);
|
||||||
diff -up openssl-1.1.1e/util/libcrypto.num.evp-kdf openssl-1.1.1e/util/libcrypto.num
|
diff -up openssl-1.1.1j/util/libcrypto.num.evp-kdf openssl-1.1.1j/util/libcrypto.num
|
||||||
--- openssl-1.1.1e/util/libcrypto.num.evp-kdf 2020-03-19 16:04:11.263064140 +0100
|
--- openssl-1.1.1j/util/libcrypto.num.evp-kdf 2021-03-03 14:08:02.481294758 +0100
|
||||||
+++ openssl-1.1.1e/util/libcrypto.num 2020-03-19 16:04:32.392698415 +0100
|
+++ openssl-1.1.1j/util/libcrypto.num 2021-03-03 14:08:02.495294883 +0100
|
||||||
@@ -4622,3 +4622,11 @@ FIPS_drbg_get_strength
|
@@ -4626,3 +4626,11 @@ FIPS_drbg_get_strength
|
||||||
FIPS_rand_strength 6380 1_1_0g EXIST::FUNCTION:
|
FIPS_rand_strength 6380 1_1_0g EXIST::FUNCTION:
|
||||||
FIPS_drbg_get_blocklength 6381 1_1_0g EXIST::FUNCTION:
|
FIPS_drbg_get_blocklength 6381 1_1_0g EXIST::FUNCTION:
|
||||||
FIPS_drbg_init 6382 1_1_0g EXIST::FUNCTION:
|
FIPS_drbg_init 6382 1_1_0g EXIST::FUNCTION:
|
||||||
@ -5225,9 +5225,9 @@ diff -up openssl-1.1.1e/util/libcrypto.num.evp-kdf openssl-1.1.1e/util/libcrypto
|
|||||||
+EVP_KDF_ctrl_str 6595 1_1_1b EXIST::FUNCTION:
|
+EVP_KDF_ctrl_str 6595 1_1_1b EXIST::FUNCTION:
|
||||||
+EVP_KDF_size 6596 1_1_1b EXIST::FUNCTION:
|
+EVP_KDF_size 6596 1_1_1b EXIST::FUNCTION:
|
||||||
+EVP_KDF_derive 6597 1_1_1b EXIST::FUNCTION:
|
+EVP_KDF_derive 6597 1_1_1b EXIST::FUNCTION:
|
||||||
diff -up openssl-1.1.1e/util/private.num.evp-kdf openssl-1.1.1e/util/private.num
|
diff -up openssl-1.1.1j/util/private.num.evp-kdf openssl-1.1.1j/util/private.num
|
||||||
--- openssl-1.1.1e/util/private.num.evp-kdf 2020-03-17 15:31:17.000000000 +0100
|
--- openssl-1.1.1j/util/private.num.evp-kdf 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1e/util/private.num 2020-03-19 16:04:32.393698398 +0100
|
+++ openssl-1.1.1j/util/private.num 2021-03-03 14:08:02.495294883 +0100
|
||||||
@@ -21,6 +21,7 @@ CRYPTO_EX_dup
|
@@ -21,6 +21,7 @@ CRYPTO_EX_dup
|
||||||
CRYPTO_EX_free datatype
|
CRYPTO_EX_free datatype
|
||||||
CRYPTO_EX_new datatype
|
CRYPTO_EX_new datatype
|
||||||
|
@ -1,618 +0,0 @@
|
|||||||
diff -up openssl-1.1.1g/crypto/ec/ec_asn1.c.explicit-params openssl-1.1.1g/crypto/ec/ec_asn1.c
|
|
||||||
--- openssl-1.1.1g/crypto/ec/ec_asn1.c.explicit-params 2020-04-21 14:22:39.000000000 +0200
|
|
||||||
+++ openssl-1.1.1g/crypto/ec/ec_asn1.c 2020-10-23 15:27:31.304312344 +0200
|
|
||||||
@@ -137,6 +137,12 @@ struct ec_parameters_st {
|
|
||||||
ASN1_INTEGER *cofactor;
|
|
||||||
} /* ECPARAMETERS */ ;
|
|
||||||
|
|
||||||
+typedef enum {
|
|
||||||
+ ECPKPARAMETERS_TYPE_NAMED = 0,
|
|
||||||
+ ECPKPARAMETERS_TYPE_EXPLICIT,
|
|
||||||
+ ECPKPARAMETERS_TYPE_IMPLICIT
|
|
||||||
+} ecpk_parameters_type_t;
|
|
||||||
+
|
|
||||||
struct ecpk_parameters_st {
|
|
||||||
int type;
|
|
||||||
union {
|
|
||||||
@@ -535,9 +541,10 @@ ECPKPARAMETERS *EC_GROUP_get_ecpkparamet
|
|
||||||
return NULL;
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
- if (ret->type == 0)
|
|
||||||
+ if (ret->type == ECPKPARAMETERS_TYPE_NAMED)
|
|
||||||
ASN1_OBJECT_free(ret->value.named_curve);
|
|
||||||
- else if (ret->type == 1 && ret->value.parameters)
|
|
||||||
+ else if (ret->type == ECPKPARAMETERS_TYPE_EXPLICIT
|
|
||||||
+ && ret->value.parameters != NULL)
|
|
||||||
ECPARAMETERS_free(ret->value.parameters);
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -547,7 +554,7 @@ ECPKPARAMETERS *EC_GROUP_get_ecpkparamet
|
|
||||||
*/
|
|
||||||
tmp = EC_GROUP_get_curve_name(group);
|
|
||||||
if (tmp) {
|
|
||||||
- ret->type = 0;
|
|
||||||
+ ret->type = ECPKPARAMETERS_TYPE_NAMED;
|
|
||||||
if ((ret->value.named_curve = OBJ_nid2obj(tmp)) == NULL)
|
|
||||||
ok = 0;
|
|
||||||
} else
|
|
||||||
@@ -555,7 +562,7 @@ ECPKPARAMETERS *EC_GROUP_get_ecpkparamet
|
|
||||||
ok = 0;
|
|
||||||
} else {
|
|
||||||
/* use the ECPARAMETERS structure */
|
|
||||||
- ret->type = 1;
|
|
||||||
+ ret->type = ECPKPARAMETERS_TYPE_EXPLICIT;
|
|
||||||
if ((ret->value.parameters =
|
|
||||||
EC_GROUP_get_ecparameters(group, NULL)) == NULL)
|
|
||||||
ok = 0;
|
|
||||||
@@ -894,7 +901,8 @@ EC_GROUP *EC_GROUP_new_from_ecpkparamete
|
|
||||||
return NULL;
|
|
||||||
}
|
|
||||||
|
|
||||||
- if (params->type == 0) { /* the curve is given by an OID */
|
|
||||||
+ if (params->type == ECPKPARAMETERS_TYPE_NAMED) {
|
|
||||||
+ /* the curve is given by an OID */
|
|
||||||
tmp = OBJ_obj2nid(params->value.named_curve);
|
|
||||||
if ((ret = EC_GROUP_new_by_curve_name(tmp)) == NULL) {
|
|
||||||
ECerr(EC_F_EC_GROUP_NEW_FROM_ECPKPARAMETERS,
|
|
||||||
@@ -902,15 +910,16 @@ EC_GROUP *EC_GROUP_new_from_ecpkparamete
|
|
||||||
return NULL;
|
|
||||||
}
|
|
||||||
EC_GROUP_set_asn1_flag(ret, OPENSSL_EC_NAMED_CURVE);
|
|
||||||
- } else if (params->type == 1) { /* the parameters are given by a
|
|
||||||
- * ECPARAMETERS structure */
|
|
||||||
+ } else if (params->type == ECPKPARAMETERS_TYPE_EXPLICIT) {
|
|
||||||
+ /* the parameters are given by an ECPARAMETERS structure */
|
|
||||||
ret = EC_GROUP_new_from_ecparameters(params->value.parameters);
|
|
||||||
if (!ret) {
|
|
||||||
ECerr(EC_F_EC_GROUP_NEW_FROM_ECPKPARAMETERS, ERR_R_EC_LIB);
|
|
||||||
return NULL;
|
|
||||||
}
|
|
||||||
EC_GROUP_set_asn1_flag(ret, OPENSSL_EC_EXPLICIT_CURVE);
|
|
||||||
- } else if (params->type == 2) { /* implicitlyCA */
|
|
||||||
+ } else if (params->type == ECPKPARAMETERS_TYPE_IMPLICIT) {
|
|
||||||
+ /* implicit parameters inherited from CA - unsupported */
|
|
||||||
return NULL;
|
|
||||||
} else {
|
|
||||||
ECerr(EC_F_EC_GROUP_NEW_FROM_ECPKPARAMETERS, EC_R_ASN1_ERROR);
|
|
||||||
@@ -940,6 +949,9 @@ EC_GROUP *d2i_ECPKParameters(EC_GROUP **
|
|
||||||
return NULL;
|
|
||||||
}
|
|
||||||
|
|
||||||
+ if (params->type == ECPKPARAMETERS_TYPE_EXPLICIT)
|
|
||||||
+ group->decoded_from_explicit_params = 1;
|
|
||||||
+
|
|
||||||
if (a) {
|
|
||||||
EC_GROUP_free(*a);
|
|
||||||
*a = group;
|
|
||||||
@@ -991,6 +1003,9 @@ EC_KEY *d2i_ECPrivateKey(EC_KEY **a, con
|
|
||||||
if (priv_key->parameters) {
|
|
||||||
EC_GROUP_free(ret->group);
|
|
||||||
ret->group = EC_GROUP_new_from_ecpkparameters(priv_key->parameters);
|
|
||||||
+ if (ret->group != NULL
|
|
||||||
+ && priv_key->parameters->type == ECPKPARAMETERS_TYPE_EXPLICIT)
|
|
||||||
+ ret->group->decoded_from_explicit_params = 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (ret->group == NULL) {
|
|
||||||
diff -up openssl-1.1.1g/crypto/ec/ec_key.c.explicit-params openssl-1.1.1g/crypto/ec/ec_key.c
|
|
||||||
--- openssl-1.1.1g/crypto/ec/ec_key.c.explicit-params 2020-10-23 15:27:31.296312275 +0200
|
|
||||||
+++ openssl-1.1.1g/crypto/ec/ec_key.c 2020-10-23 15:27:31.304312344 +0200
|
|
||||||
@@ -566,6 +566,13 @@ void EC_KEY_clear_flags(EC_KEY *key, int
|
|
||||||
key->flags &= ~flags;
|
|
||||||
}
|
|
||||||
|
|
||||||
+int EC_KEY_decoded_from_explicit_params(const EC_KEY *key)
|
|
||||||
+{
|
|
||||||
+ if (key == NULL || key->group == NULL)
|
|
||||||
+ return -1;
|
|
||||||
+ return key->group->decoded_from_explicit_params;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
size_t EC_KEY_key2buf(const EC_KEY *key, point_conversion_form_t form,
|
|
||||||
unsigned char **pbuf, BN_CTX *ctx)
|
|
||||||
{
|
|
||||||
diff -up openssl-1.1.1g/crypto/ec/ec_lib.c.explicit-params openssl-1.1.1g/crypto/ec/ec_lib.c
|
|
||||||
--- openssl-1.1.1g/crypto/ec/ec_lib.c.explicit-params 2020-04-21 14:22:39.000000000 +0200
|
|
||||||
+++ openssl-1.1.1g/crypto/ec/ec_lib.c 2020-10-23 15:27:31.304312344 +0200
|
|
||||||
@@ -211,6 +211,7 @@ int EC_GROUP_copy(EC_GROUP *dest, const
|
|
||||||
|
|
||||||
dest->asn1_flag = src->asn1_flag;
|
|
||||||
dest->asn1_form = src->asn1_form;
|
|
||||||
+ dest->decoded_from_explicit_params = src->decoded_from_explicit_params;
|
|
||||||
|
|
||||||
if (src->seed) {
|
|
||||||
OPENSSL_free(dest->seed);
|
|
||||||
diff -up openssl-1.1.1g/crypto/ec/ec_local.h.explicit-params openssl-1.1.1g/crypto/ec/ec_local.h
|
|
||||||
--- openssl-1.1.1g/crypto/ec/ec_local.h.explicit-params 2020-10-23 15:27:31.281312147 +0200
|
|
||||||
+++ openssl-1.1.1g/crypto/ec/ec_local.h 2020-10-23 15:27:31.304312344 +0200
|
|
||||||
@@ -217,6 +217,8 @@ struct ec_group_st {
|
|
||||||
BIGNUM *order, *cofactor;
|
|
||||||
int curve_name; /* optional NID for named curve */
|
|
||||||
int asn1_flag; /* flag to control the asn1 encoding */
|
|
||||||
+ int decoded_from_explicit_params; /* set if decoded from explicit
|
|
||||||
+ * curve parameters encoding */
|
|
||||||
point_conversion_form_t asn1_form;
|
|
||||||
unsigned char *seed; /* optional seed for parameters (appears in
|
|
||||||
* ASN1) */
|
|
||||||
diff -up openssl-1.1.1g/crypto/x509/x509_txt.c.explicit-params openssl-1.1.1g/crypto/x509/x509_txt.c
|
|
||||||
--- openssl-1.1.1g/crypto/x509/x509_txt.c.explicit-params 2020-04-21 14:22:39.000000000 +0200
|
|
||||||
+++ openssl-1.1.1g/crypto/x509/x509_txt.c 2020-10-23 15:27:31.305312352 +0200
|
|
||||||
@@ -174,6 +174,8 @@ const char *X509_verify_cert_error_strin
|
|
||||||
return "OCSP verification failed";
|
|
||||||
case X509_V_ERR_OCSP_CERT_UNKNOWN:
|
|
||||||
return "OCSP unknown cert";
|
|
||||||
+ case X509_V_ERR_EC_KEY_EXPLICIT_PARAMS:
|
|
||||||
+ return "Certificate public key has explicit ECC parameters";
|
|
||||||
|
|
||||||
default:
|
|
||||||
/* Printing an error number into a static buffer is not thread-safe */
|
|
||||||
diff -up openssl-1.1.1g/crypto/x509/x509_vfy.c.explicit-params openssl-1.1.1g/crypto/x509/x509_vfy.c
|
|
||||||
--- openssl-1.1.1g/crypto/x509/x509_vfy.c.explicit-params 2020-10-23 15:27:31.252311900 +0200
|
|
||||||
+++ openssl-1.1.1g/crypto/x509/x509_vfy.c 2020-10-23 15:27:31.305312352 +0200
|
|
||||||
@@ -80,6 +80,7 @@ static int get_issuer_sk(X509 **issuer,
|
|
||||||
static int check_dane_issuer(X509_STORE_CTX *ctx, int depth);
|
|
||||||
static int check_key_level(X509_STORE_CTX *ctx, X509 *cert);
|
|
||||||
static int check_sig_level(X509_STORE_CTX *ctx, X509 *cert);
|
|
||||||
+static int check_curve(X509 *cert);
|
|
||||||
|
|
||||||
static int get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer,
|
|
||||||
unsigned int *preasons, X509_CRL *crl, X509 *x);
|
|
||||||
@@ -508,6 +509,14 @@ static int check_chain_extensions(X509_S
|
|
||||||
ret = 1;
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
+ if ((ctx->param->flags & X509_V_FLAG_X509_STRICT) && num > 1) {
|
|
||||||
+ /* Check for presence of explicit elliptic curve parameters */
|
|
||||||
+ ret = check_curve(x);
|
|
||||||
+ if (ret < 0)
|
|
||||||
+ ctx->error = X509_V_ERR_UNSPECIFIED;
|
|
||||||
+ else if (ret == 0)
|
|
||||||
+ ctx->error = X509_V_ERR_EC_KEY_EXPLICIT_PARAMS;
|
|
||||||
+ }
|
|
||||||
if ((x->ex_flags & EXFLAG_CA) == 0
|
|
||||||
&& x->ex_pathlen != -1
|
|
||||||
&& (ctx->param->flags & X509_V_FLAG_X509_STRICT)) {
|
|
||||||
@@ -3259,6 +3268,32 @@ static int check_key_level(X509_STORE_CT
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
+ * Check whether the public key of ``cert`` does not use explicit params
|
|
||||||
+ * for an elliptic curve.
|
|
||||||
+ *
|
|
||||||
+ * Returns 1 on success, 0 if check fails, -1 for other errors.
|
|
||||||
+ */
|
|
||||||
+static int check_curve(X509 *cert)
|
|
||||||
+{
|
|
||||||
+#ifndef OPENSSL_NO_EC
|
|
||||||
+ EVP_PKEY *pkey = X509_get0_pubkey(cert);
|
|
||||||
+
|
|
||||||
+ /* Unsupported or malformed key */
|
|
||||||
+ if (pkey == NULL)
|
|
||||||
+ return -1;
|
|
||||||
+
|
|
||||||
+ if (EVP_PKEY_id(pkey) == EVP_PKEY_EC) {
|
|
||||||
+ int ret;
|
|
||||||
+
|
|
||||||
+ ret = EC_KEY_decoded_from_explicit_params(EVP_PKEY_get0_EC_KEY(pkey));
|
|
||||||
+ return ret < 0 ? ret : !ret;
|
|
||||||
+ }
|
|
||||||
+#endif
|
|
||||||
+
|
|
||||||
+ return 1;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+/*
|
|
||||||
* Check whether the signature digest algorithm of ``cert`` meets the security
|
|
||||||
* level of ``ctx``. Should not be checked for trust anchors (whether
|
|
||||||
* self-signed or otherwise).
|
|
||||||
diff -up openssl-1.1.1g/doc/man3/EC_KEY_new.pod.explicit-params openssl-1.1.1g/doc/man3/EC_KEY_new.pod
|
|
||||||
--- openssl-1.1.1g/doc/man3/EC_KEY_new.pod.explicit-params 2020-04-21 14:22:39.000000000 +0200
|
|
||||||
+++ openssl-1.1.1g/doc/man3/EC_KEY_new.pod 2020-10-23 15:27:31.305312352 +0200
|
|
||||||
@@ -9,7 +9,8 @@ EC_KEY_get0_engine,
|
|
||||||
EC_KEY_get0_group, EC_KEY_set_group, EC_KEY_get0_private_key,
|
|
||||||
EC_KEY_set_private_key, EC_KEY_get0_public_key, EC_KEY_set_public_key,
|
|
||||||
EC_KEY_get_conv_form,
|
|
||||||
-EC_KEY_set_conv_form, EC_KEY_set_asn1_flag, EC_KEY_precompute_mult,
|
|
||||||
+EC_KEY_set_conv_form, EC_KEY_set_asn1_flag,
|
|
||||||
+EC_KEY_decoded_from_explicit_params, EC_KEY_precompute_mult,
|
|
||||||
EC_KEY_generate_key, EC_KEY_check_key, EC_KEY_set_public_key_affine_coordinates,
|
|
||||||
EC_KEY_oct2key, EC_KEY_key2buf, EC_KEY_oct2priv, EC_KEY_priv2oct,
|
|
||||||
EC_KEY_priv2buf - Functions for creating, destroying and manipulating
|
|
||||||
@@ -38,6 +39,7 @@ EC_KEY objects
|
|
||||||
point_conversion_form_t EC_KEY_get_conv_form(const EC_KEY *key);
|
|
||||||
void EC_KEY_set_conv_form(EC_KEY *eckey, point_conversion_form_t cform);
|
|
||||||
void EC_KEY_set_asn1_flag(EC_KEY *eckey, int asn1_flag);
|
|
||||||
+ int EC_KEY_decoded_from_explicit_params(const EC_KEY *key);
|
|
||||||
int EC_KEY_precompute_mult(EC_KEY *key, BN_CTX *ctx);
|
|
||||||
int EC_KEY_generate_key(EC_KEY *key);
|
|
||||||
int EC_KEY_check_key(const EC_KEY *key);
|
|
||||||
@@ -118,6 +120,10 @@ EC_KEY_set_asn1_flag() sets the asn1_fla
|
|
||||||
(if set). Refer to L<EC_GROUP_copy(3)> for further information on the
|
|
||||||
asn1_flag.
|
|
||||||
|
|
||||||
+EC_KEY_decoded_from_explicit_params() returns 1 if the group of the I<key> was
|
|
||||||
+decoded from data with explicitly encoded group parameters, -1 if the I<key>
|
|
||||||
+is NULL or the group parameters are missing, and 0 otherwise.
|
|
||||||
+
|
|
||||||
EC_KEY_precompute_mult() stores multiples of the underlying EC_GROUP generator
|
|
||||||
for faster point multiplication. See also L<EC_POINT_add(3)>.
|
|
||||||
|
|
||||||
diff -up openssl-1.1.1g/include/openssl/ec.h.explicit-params openssl-1.1.1g/include/openssl/ec.h
|
|
||||||
--- openssl-1.1.1g/include/openssl/ec.h.explicit-params 2020-04-21 14:22:39.000000000 +0200
|
|
||||||
+++ openssl-1.1.1g/include/openssl/ec.h 2020-10-23 15:27:31.305312352 +0200
|
|
||||||
@@ -829,6 +829,8 @@ void EC_KEY_set_flags(EC_KEY *key, int f
|
|
||||||
|
|
||||||
void EC_KEY_clear_flags(EC_KEY *key, int flags);
|
|
||||||
|
|
||||||
+int EC_KEY_decoded_from_explicit_params(const EC_KEY *key);
|
|
||||||
+
|
|
||||||
/** Creates a new EC_KEY object using a named curve as underlying
|
|
||||||
* EC_GROUP object.
|
|
||||||
* \param nid NID of the named curve.
|
|
||||||
diff -up openssl-1.1.1g/include/openssl/x509_vfy.h.explicit-params openssl-1.1.1g/include/openssl/x509_vfy.h
|
|
||||||
--- openssl-1.1.1g/include/openssl/x509_vfy.h.explicit-params 2020-04-21 14:22:39.000000000 +0200
|
|
||||||
+++ openssl-1.1.1g/include/openssl/x509_vfy.h 2020-10-23 15:27:31.305312352 +0200
|
|
||||||
@@ -184,6 +184,7 @@ void X509_STORE_CTX_set_depth(X509_STORE
|
|
||||||
# define X509_V_ERR_OCSP_VERIFY_NEEDED 73 /* Need OCSP verification */
|
|
||||||
# define X509_V_ERR_OCSP_VERIFY_FAILED 74 /* Couldn't verify cert through OCSP */
|
|
||||||
# define X509_V_ERR_OCSP_CERT_UNKNOWN 75 /* Certificate wasn't recognized by the OCSP responder */
|
|
||||||
+# define X509_V_ERR_EC_KEY_EXPLICIT_PARAMS 79
|
|
||||||
|
|
||||||
/* Certificate verify flags */
|
|
||||||
|
|
||||||
diff -up openssl-1.1.1g/ssl/statem/statem_lib.c.explicit-params openssl-1.1.1g/ssl/statem/statem_lib.c
|
|
||||||
--- openssl-1.1.1g/ssl/statem/statem_lib.c.explicit-params 2020-10-23 15:27:31.249311874 +0200
|
|
||||||
+++ openssl-1.1.1g/ssl/statem/statem_lib.c 2020-10-23 15:27:31.305312352 +0200
|
|
||||||
@@ -1341,6 +1341,7 @@ int tls_get_message_body(SSL *s, size_t
|
|
||||||
static const X509ERR2ALERT x509table[] = {
|
|
||||||
{X509_V_ERR_APPLICATION_VERIFICATION, SSL_AD_HANDSHAKE_FAILURE},
|
|
||||||
{X509_V_ERR_CA_KEY_TOO_SMALL, SSL_AD_BAD_CERTIFICATE},
|
|
||||||
+ {X509_V_ERR_EC_KEY_EXPLICIT_PARAMS, SSL_AD_BAD_CERTIFICATE},
|
|
||||||
{X509_V_ERR_CA_MD_TOO_WEAK, SSL_AD_BAD_CERTIFICATE},
|
|
||||||
{X509_V_ERR_CERT_CHAIN_TOO_LONG, SSL_AD_UNKNOWN_CA},
|
|
||||||
{X509_V_ERR_CERT_HAS_EXPIRED, SSL_AD_CERTIFICATE_EXPIRED},
|
|
||||||
diff -up openssl-1.1.1g/test/certs/ca-cert-ec-explicit.pem.explicit-params openssl-1.1.1g/test/certs/ca-cert-ec-explicit.pem
|
|
||||||
--- openssl-1.1.1g/test/certs/ca-cert-ec-explicit.pem.explicit-params 2020-10-23 15:27:31.306312361 +0200
|
|
||||||
+++ openssl-1.1.1g/test/certs/ca-cert-ec-explicit.pem 2020-10-23 15:27:31.305312352 +0200
|
|
||||||
@@ -0,0 +1,19 @@
|
|
||||||
+-----BEGIN CERTIFICATE-----
|
|
||||||
+MIIDGDCCAgCgAwIBAgIBAjANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdSb290
|
|
||||||
+IENBMCAXDTIwMDkxNTEzMDY0MVoYDzIxMjAwOTE2MTMwNjQxWjANMQswCQYDVQQD
|
|
||||||
+DAJDQTCCAUswggEDBgcqhkjOPQIBMIH3AgEBMCwGByqGSM49AQECIQD/////AAAA
|
|
||||||
+AQAAAAAAAAAAAAAAAP///////////////zBbBCD/////AAAAAQAAAAAAAAAAAAAA
|
|
||||||
+AP///////////////AQgWsY12Ko6k+ez671VdpiGvGUdBrDMU7D2O848PifSYEsD
|
|
||||||
+FQDEnTYIhucEk2pmeOETnSa3gZ9+kARBBGsX0fLhLEJH+Lzm5WOkQPJ3A32BLesz
|
|
||||||
+oPShOUXYmMKWT+NC4v4af5uO5+tKfA+eFivOM1drMV7Oy7ZAaDe/UfUCIQD/////
|
|
||||||
+AAAAAP//////////vOb6racXnoTzucrC/GMlUQIBAQNCAASlXna3kSD/Yol3RA5I
|
|
||||||
+icjIxYb9UJoCTzb/LsxjlOvIS5OqCTzpqP0p3JrnvLPsbzq7Cf/g0bNlxAGs1iVM
|
|
||||||
+5NDco1MwUTAdBgNVHQ4EFgQUFk6ucH6gMXeadmuV7a1iWEnU/CIwHwYDVR0jBBgw
|
|
||||||
+FoAUjvUlrx6ba4Q9fICayVOcTXL3o1IwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG
|
|
||||||
+9w0BAQsFAAOCAQEAdyUgfT0eAsZzoHFXoWN5uqi0MHuhLI37TEzkH5h7iTpDQJTQ
|
|
||||||
+F0SjbawfM/nxxUekRW3mjFu3lft+VA7yC0OTNBLffan/vTh+HGOvvYZSMJYgKrMG
|
|
||||||
+PRWgDId+n9RTcQCf+91cISvOazHixRiJG7JfRLdNZsAE+miw4HgPLFboTwpxtTDJ
|
|
||||||
+zJ4ssBC6P+5IHwBCtNMiilJMMMzuSaZa5iSo6M9AdXWfcQN3uhW1lgQOLOlKLcbo
|
|
||||||
+3UhW1GMMhTTeytM5aylbKhRsnL7ozmS44zsKZ25YaQxgjdKitFjVN6j7eyQ7C9J2
|
|
||||||
+bLXgl3APweLQbGGs0zv08Ad0SCCKYLHK6mMJqg==
|
|
||||||
+-----END CERTIFICATE-----
|
|
||||||
diff -up openssl-1.1.1g/test/certs/ca-cert-ec-named.pem.explicit-params openssl-1.1.1g/test/certs/ca-cert-ec-named.pem
|
|
||||||
--- openssl-1.1.1g/test/certs/ca-cert-ec-named.pem.explicit-params 2020-10-23 15:27:31.306312361 +0200
|
|
||||||
+++ openssl-1.1.1g/test/certs/ca-cert-ec-named.pem 2020-10-23 15:27:31.306312361 +0200
|
|
||||||
@@ -0,0 +1,14 @@
|
|
||||||
+-----BEGIN CERTIFICATE-----
|
|
||||||
+MIICJDCCAQygAwIBAgIBAjANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdSb290
|
|
||||||
+IENBMCAXDTIwMDkxNTEzMDY1MFoYDzIxMjAwOTE2MTMwNjUwWjANMQswCQYDVQQD
|
|
||||||
+DAJDQTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABPt+MXCi9+wztEvmdG2EVSk7
|
|
||||||
+bAiJMXJXW/u0NbcGCrrbhO1NJSHHV3Lks888sqeSPh/bif/ASJ0HX+VarMUoFIKj
|
|
||||||
+UzBRMB0GA1UdDgQWBBRjigU5REz8Lwf1iD6mALVhsHIanjAfBgNVHSMEGDAWgBSO
|
|
||||||
+9SWvHptrhD18gJrJU5xNcvejUjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEB
|
|
||||||
+CwUAA4IBAQCQs9wpblefb2C9a7usGL1DJjWJQIFHtUf+6p/KPgEV7LF138ECjL5s
|
|
||||||
+0AWRd8Q8SbsBH49j2r3LLLMkvFglyRaN+FF+TCC/UQtclTb4+HgLsUT2xSU8U2cY
|
|
||||||
+SOnzNB5AX/qAAsdOGqOjivPtGXcXFexDKPsw3n+3rJgymBP6hbLagb47IabNhot5
|
|
||||||
+bMM6S+bmfpMwfsm885zr5vG2Gg9FjjH94Vx4I7eRLkjCS88gkIR1J35ecHFteOdo
|
|
||||||
+idOaCHQddYiKukBzgdjtTxSDXKffkaybylrwOZ8VBlQd3zC7s02d+riHCnroLnnE
|
|
||||||
+cwYLlJ5z6jN7zoPZ55yX/EmA0RVny2le
|
|
||||||
+-----END CERTIFICATE-----
|
|
||||||
diff -up openssl-1.1.1g/test/certs/ca-key-ec-explicit.pem.explicit-params openssl-1.1.1g/test/certs/ca-key-ec-explicit.pem
|
|
||||||
--- openssl-1.1.1g/test/certs/ca-key-ec-explicit.pem.explicit-params 2020-10-23 15:27:31.306312361 +0200
|
|
||||||
+++ openssl-1.1.1g/test/certs/ca-key-ec-explicit.pem 2020-10-23 15:27:31.306312361 +0200
|
|
||||||
@@ -0,0 +1,10 @@
|
|
||||||
+-----BEGIN PRIVATE KEY-----
|
|
||||||
+MIIBeQIBADCCAQMGByqGSM49AgEwgfcCAQEwLAYHKoZIzj0BAQIhAP////8AAAAB
|
|
||||||
+AAAAAAAAAAAAAAAA////////////////MFsEIP////8AAAABAAAAAAAAAAAAAAAA
|
|
||||||
+///////////////8BCBaxjXYqjqT57PrvVV2mIa8ZR0GsMxTsPY7zjw+J9JgSwMV
|
|
||||||
+AMSdNgiG5wSTamZ44ROdJreBn36QBEEEaxfR8uEsQkf4vOblY6RA8ncDfYEt6zOg
|
|
||||||
+9KE5RdiYwpZP40Li/hp/m47n60p8D54WK84zV2sxXs7LtkBoN79R9QIhAP////8A
|
|
||||||
+AAAA//////////+85vqtpxeehPO5ysL8YyVRAgEBBG0wawIBAQQgdEf20fpuqEZU
|
|
||||||
+tZ4ORoq4vb5ETV4a6QOl/iGnDQt++/ihRANCAASlXna3kSD/Yol3RA5IicjIxYb9
|
|
||||||
+UJoCTzb/LsxjlOvIS5OqCTzpqP0p3JrnvLPsbzq7Cf/g0bNlxAGs1iVM5NDc
|
|
||||||
+-----END PRIVATE KEY-----
|
|
||||||
diff -up openssl-1.1.1g/test/certs/ca-key-ec-named.pem.explicit-params openssl-1.1.1g/test/certs/ca-key-ec-named.pem
|
|
||||||
--- openssl-1.1.1g/test/certs/ca-key-ec-named.pem.explicit-params 2020-10-23 15:27:31.306312361 +0200
|
|
||||||
+++ openssl-1.1.1g/test/certs/ca-key-ec-named.pem 2020-10-23 15:27:31.306312361 +0200
|
|
||||||
@@ -0,0 +1,5 @@
|
|
||||||
+-----BEGIN PRIVATE KEY-----
|
|
||||||
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgCTrYrMKcyV49+w4B
|
|
||||||
+TWr2WTZsMM4aFpaYulKAuhiuQ7mhRANCAAT7fjFwovfsM7RL5nRthFUpO2wIiTFy
|
|
||||||
+V1v7tDW3Bgq624TtTSUhx1dy5LPPPLKnkj4f24n/wEidB1/lWqzFKBSC
|
|
||||||
+-----END PRIVATE KEY-----
|
|
||||||
diff -up openssl-1.1.1g/test/certs/ee-cert-ec-explicit.pem.explicit-params openssl-1.1.1g/test/certs/ee-cert-ec-explicit.pem
|
|
||||||
--- openssl-1.1.1g/test/certs/ee-cert-ec-explicit.pem.explicit-params 2020-10-23 15:27:31.306312361 +0200
|
|
||||||
+++ openssl-1.1.1g/test/certs/ee-cert-ec-explicit.pem 2020-10-23 15:27:31.306312361 +0200
|
|
||||||
@@ -0,0 +1,16 @@
|
|
||||||
+-----BEGIN CERTIFICATE-----
|
|
||||||
+MIIChzCCAi6gAwIBAgIBAjAKBggqhkjOPQQDAjANMQswCQYDVQQDDAJDQTAgFw0y
|
|
||||||
+MDA5MTUxMzE0MzlaGA8yMTIwMDkxNjEzMTQzOVowGTEXMBUGA1UEAwwOc2VydmVy
|
|
||||||
+LmV4YW1wbGUwggFLMIIBAwYHKoZIzj0CATCB9wIBATAsBgcqhkjOPQEBAiEA////
|
|
||||||
+/wAAAAEAAAAAAAAAAAAAAAD///////////////8wWwQg/////wAAAAEAAAAAAAAA
|
|
||||||
+AAAAAAD///////////////wEIFrGNdiqOpPns+u9VXaYhrxlHQawzFOw9jvOPD4n
|
|
||||||
+0mBLAxUAxJ02CIbnBJNqZnjhE50mt4GffpAEQQRrF9Hy4SxCR/i85uVjpEDydwN9
|
|
||||||
+gS3rM6D0oTlF2JjClk/jQuL+Gn+bjufrSnwPnhYrzjNXazFezsu2QGg3v1H1AiEA
|
|
||||||
+/////wAAAAD//////////7zm+q2nF56E87nKwvxjJVECAQEDQgAE+7TDP7C9VqQP
|
|
||||||
+TnqoJc/Fvf/N45BX+lBfmfiGBeRKtSsvrERUlymzQ4/nxVtymozAgFxQ0my998HH
|
|
||||||
+TSVCj7Sq56N9MHswHQYDVR0OBBYEFKKwEfKYhNv6fbQf0Xd0te7J3GZdMB8GA1Ud
|
|
||||||
+IwQYMBaAFGOKBTlETPwvB/WIPqYAtWGwchqeMAkGA1UdEwQCMAAwEwYDVR0lBAww
|
|
||||||
+CgYIKwYBBQUHAwEwGQYDVR0RBBIwEIIOc2VydmVyLmV4YW1wbGUwCgYIKoZIzj0E
|
|
||||||
+AwIDRwAwRAIgb4UITAOFlATeaayWQX9r5gf61qcnzT7TjXCekf7ww9oCIBDltg/u
|
|
||||||
+ZvS9gqviMFuPjTuk/FhsCTAUzTT7WmgcWeH7
|
|
||||||
+-----END CERTIFICATE-----
|
|
||||||
diff -up openssl-1.1.1g/test/certs/ee-cert-ec-named-explicit.pem.explicit-params openssl-1.1.1g/test/certs/ee-cert-ec-named-explicit.pem
|
|
||||||
--- openssl-1.1.1g/test/certs/ee-cert-ec-named-explicit.pem.explicit-params 2020-10-23 15:27:31.306312361 +0200
|
|
||||||
+++ openssl-1.1.1g/test/certs/ee-cert-ec-named-explicit.pem 2020-10-23 15:27:31.306312361 +0200
|
|
||||||
@@ -0,0 +1,11 @@
|
|
||||||
+-----BEGIN CERTIFICATE-----
|
|
||||||
+MIIBlDCCATqgAwIBAgIBAjAKBggqhkjOPQQDAjANMQswCQYDVQQDDAJDQTAgFw0y
|
|
||||||
+MDA5MTUxMzE0NDVaGA8yMTIwMDkxNjEzMTQ0NVowGTEXMBUGA1UEAwwOc2VydmVy
|
|
||||||
+LmV4YW1wbGUwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQv5PnMStW/Wx9lpvjl
|
|
||||||
+JTsFIjc2wBv14sNuMh1hfNX8ZJcoCfAAKYu6ujxXt328GWBMaubRbBjOd/eqpEst
|
|
||||||
+tYKzo30wezAdBgNVHQ4EFgQUmb/qcE413hkpmtjEMyRZZFcN1TYwHwYDVR0jBBgw
|
|
||||||
+FoAUFk6ucH6gMXeadmuV7a1iWEnU/CIwCQYDVR0TBAIwADATBgNVHSUEDDAKBggr
|
|
||||||
+BgEFBQcDATAZBgNVHREEEjAQgg5zZXJ2ZXIuZXhhbXBsZTAKBggqhkjOPQQDAgNI
|
|
||||||
+ADBFAiEA9y6J8rdAbO0mDZscIb8rIn6HgxBW4WAqTlFeZeHjjOYCIAmt2ldyObOL
|
|
||||||
+tXaiaxYX3WAOR1vmfzsdrkCAOCfAkpbo
|
|
||||||
+-----END CERTIFICATE-----
|
|
||||||
diff -up openssl-1.1.1g/test/certs/ee-cert-ec-named-named.pem.explicit-params openssl-1.1.1g/test/certs/ee-cert-ec-named-named.pem
|
|
||||||
--- openssl-1.1.1g/test/certs/ee-cert-ec-named-named.pem.explicit-params 2020-10-23 15:27:31.306312361 +0200
|
|
||||||
+++ openssl-1.1.1g/test/certs/ee-cert-ec-named-named.pem 2020-10-23 15:27:31.306312361 +0200
|
|
||||||
@@ -0,0 +1,11 @@
|
|
||||||
+-----BEGIN CERTIFICATE-----
|
|
||||||
+MIIBkzCCATqgAwIBAgIBAjAKBggqhkjOPQQDAjANMQswCQYDVQQDDAJDQTAgFw0y
|
|
||||||
+MDA5MTUxNDEwNDhaGA8yMTIwMDkxNjE0MTA0OFowGTEXMBUGA1UEAwwOc2VydmVy
|
|
||||||
+LmV4YW1wbGUwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAS0YU57+RFRWxr/frnL
|
|
||||||
++vOYkY3h9roKnvxCG07wK5tevEYtSdKz0KsHvDBDatw1r3JNv+m2p54/3AqFPAZ3
|
|
||||||
+5b0Po30wezAdBgNVHQ4EFgQUypypuZrUl0BEmbuhfJpo3QFNIvUwHwYDVR0jBBgw
|
|
||||||
+FoAUY4oFOURM/C8H9Yg+pgC1YbByGp4wCQYDVR0TBAIwADATBgNVHSUEDDAKBggr
|
|
||||||
+BgEFBQcDATAZBgNVHREEEjAQgg5zZXJ2ZXIuZXhhbXBsZTAKBggqhkjOPQQDAgNH
|
|
||||||
+ADBEAiAEkKD7H5uxQ4YbQOiN4evbu5RCV5W7TVE80iBfcY5u4wIgGcwr++lVNX0Q
|
|
||||||
+CTT+M3ukDjOA8OEvKUz1TiDuRAQ29qU=
|
|
||||||
+-----END CERTIFICATE-----
|
|
||||||
diff -up openssl-1.1.1g/test/certs/ee-key-ec-explicit.pem.explicit-params openssl-1.1.1g/test/certs/ee-key-ec-explicit.pem
|
|
||||||
--- openssl-1.1.1g/test/certs/ee-key-ec-explicit.pem.explicit-params 2020-10-23 15:27:31.306312361 +0200
|
|
||||||
+++ openssl-1.1.1g/test/certs/ee-key-ec-explicit.pem 2020-10-23 15:27:31.306312361 +0200
|
|
||||||
@@ -0,0 +1,10 @@
|
|
||||||
+-----BEGIN PRIVATE KEY-----
|
|
||||||
+MIIBeQIBADCCAQMGByqGSM49AgEwgfcCAQEwLAYHKoZIzj0BAQIhAP////8AAAAB
|
|
||||||
+AAAAAAAAAAAAAAAA////////////////MFsEIP////8AAAABAAAAAAAAAAAAAAAA
|
|
||||||
+///////////////8BCBaxjXYqjqT57PrvVV2mIa8ZR0GsMxTsPY7zjw+J9JgSwMV
|
|
||||||
+AMSdNgiG5wSTamZ44ROdJreBn36QBEEEaxfR8uEsQkf4vOblY6RA8ncDfYEt6zOg
|
|
||||||
+9KE5RdiYwpZP40Li/hp/m47n60p8D54WK84zV2sxXs7LtkBoN79R9QIhAP////8A
|
|
||||||
+AAAA//////////+85vqtpxeehPO5ysL8YyVRAgEBBG0wawIBAQQg0cmpcTcEYG5G
|
|
||||||
+ZaVkGjtsBc3sLZn1EuV9qNK2qx6iNzmhRANCAAT7tMM/sL1WpA9Oeqglz8W9/83j
|
|
||||||
+kFf6UF+Z+IYF5Eq1Ky+sRFSXKbNDj+fFW3KajMCAXFDSbL33wcdNJUKPtKrn
|
|
||||||
+-----END PRIVATE KEY-----
|
|
||||||
diff -up openssl-1.1.1g/test/certs/ee-key-ec-named-explicit.pem.explicit-params openssl-1.1.1g/test/certs/ee-key-ec-named-explicit.pem
|
|
||||||
--- openssl-1.1.1g/test/certs/ee-key-ec-named-explicit.pem.explicit-params 2020-10-23 15:27:31.306312361 +0200
|
|
||||||
+++ openssl-1.1.1g/test/certs/ee-key-ec-named-explicit.pem 2020-10-23 15:27:31.306312361 +0200
|
|
||||||
@@ -0,0 +1,5 @@
|
|
||||||
+-----BEGIN PRIVATE KEY-----
|
|
||||||
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg2ue+X5ZFJPJPQG2E
|
|
||||||
+WQY4ALv2PkPp2Gy6KrMiokgmjkehRANCAAQv5PnMStW/Wx9lpvjlJTsFIjc2wBv1
|
|
||||||
+4sNuMh1hfNX8ZJcoCfAAKYu6ujxXt328GWBMaubRbBjOd/eqpEsttYKz
|
|
||||||
+-----END PRIVATE KEY-----
|
|
||||||
diff -up openssl-1.1.1g/test/certs/ee-key-ec-named-named.pem.explicit-params openssl-1.1.1g/test/certs/ee-key-ec-named-named.pem
|
|
||||||
--- openssl-1.1.1g/test/certs/ee-key-ec-named-named.pem.explicit-params 2020-10-23 15:27:31.306312361 +0200
|
|
||||||
+++ openssl-1.1.1g/test/certs/ee-key-ec-named-named.pem 2020-10-23 15:27:31.306312361 +0200
|
|
||||||
@@ -0,0 +1,5 @@
|
|
||||||
+-----BEGIN PRIVATE KEY-----
|
|
||||||
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgGSoneIKG3//ujXGu
|
|
||||||
+/EoJdNhpKZj026EF/YQ5FblUBWahRANCAAS0YU57+RFRWxr/frnL+vOYkY3h9roK
|
|
||||||
+nvxCG07wK5tevEYtSdKz0KsHvDBDatw1r3JNv+m2p54/3AqFPAZ35b0P
|
|
||||||
+-----END PRIVATE KEY-----
|
|
||||||
diff -up openssl-1.1.1g/test/certs/setup.sh.explicit-params openssl-1.1.1g/test/certs/setup.sh
|
|
||||||
--- openssl-1.1.1g/test/certs/setup.sh.explicit-params 2020-04-21 14:22:39.000000000 +0200
|
|
||||||
+++ openssl-1.1.1g/test/certs/setup.sh 2020-10-23 15:27:31.306312361 +0200
|
|
||||||
@@ -116,6 +116,10 @@ openssl x509 -in ca-cert-md5.pem -trusto
|
|
||||||
# CA has 768-bit key
|
|
||||||
OPENSSL_KEYBITS=768 \
|
|
||||||
./mkcert.sh genca "CA" ca-key-768 ca-cert-768 root-key root-cert
|
|
||||||
+# EC cert with explicit curve
|
|
||||||
+./mkcert.sh genca "CA" ca-key-ec-explicit ca-cert-ec-explicit root-key root-cert
|
|
||||||
+# EC cert with named curve
|
|
||||||
+./mkcert.sh genca "CA" ca-key-ec-named ca-cert-ec-named root-key root-cert
|
|
||||||
|
|
||||||
# client intermediate ca: cca-cert
|
|
||||||
# trust variants: +serverAuth, -serverAuth, +clientAuth, -clientAuth
|
|
||||||
@@ -184,6 +188,14 @@ OPENSSL_SIGALG=md5 \
|
|
||||||
# 768-bit leaf key
|
|
||||||
OPENSSL_KEYBITS=768 \
|
|
||||||
./mkcert.sh genee server.example ee-key-768 ee-cert-768 ca-key ca-cert
|
|
||||||
+# EC cert with explicit curve signed by named curve ca
|
|
||||||
+./mkcert.sh genee server.example ee-key-ec-explicit ee-cert-ec-explicit ca-key-ec-named ca-cert-ec-named
|
|
||||||
+# EC cert with named curve signed by explicit curve ca
|
|
||||||
+./mkcert.sh genee server.example ee-key-ec-named-explicit \
|
|
||||||
+ ee-cert-ec-named-explicit ca-key-ec-explicit ca-cert-ec-explicit
|
|
||||||
+# EC cert with named curve signed by named curve ca
|
|
||||||
+./mkcert.sh genee server.example ee-key-ec-named-named \
|
|
||||||
+ ee-cert-ec-named-named ca-key-ec-named ca-cert-ec-named
|
|
||||||
|
|
||||||
# Proxy certificates, off of ee-client
|
|
||||||
# Start with some good ones
|
|
||||||
diff -up openssl-1.1.1g/test/ec_internal_test.c.explicit-params openssl-1.1.1g/test/ec_internal_test.c
|
|
||||||
--- openssl-1.1.1g/test/ec_internal_test.c.explicit-params 2020-04-21 14:22:39.000000000 +0200
|
|
||||||
+++ openssl-1.1.1g/test/ec_internal_test.c 2020-10-23 15:27:31.306312361 +0200
|
|
||||||
@@ -183,6 +183,106 @@ static int field_tests_default(int n)
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
+/*
|
|
||||||
+ * Tests behavior of the decoded_from_explicit_params flag and API
|
|
||||||
+ */
|
|
||||||
+static int decoded_flag_test(void)
|
|
||||||
+{
|
|
||||||
+ EC_GROUP *grp;
|
|
||||||
+ EC_GROUP *grp_copy = NULL;
|
|
||||||
+ ECPARAMETERS *ecparams = NULL;
|
|
||||||
+ ECPKPARAMETERS *ecpkparams = NULL;
|
|
||||||
+ EC_KEY *key = NULL;
|
|
||||||
+ unsigned char *encodedparams = NULL;
|
|
||||||
+ const unsigned char *encp;
|
|
||||||
+ int encodedlen;
|
|
||||||
+ int testresult = 0;
|
|
||||||
+
|
|
||||||
+ /* Test EC_GROUP_new not setting the flag */
|
|
||||||
+ grp = EC_GROUP_new(EC_GFp_simple_method());
|
|
||||||
+ if (!TEST_ptr(grp)
|
|
||||||
+ || !TEST_int_eq(grp->decoded_from_explicit_params, 0))
|
|
||||||
+ goto err;
|
|
||||||
+ EC_GROUP_free(grp);
|
|
||||||
+
|
|
||||||
+ /* Test EC_GROUP_new_by_curve_name not setting the flag */
|
|
||||||
+ grp = EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1);
|
|
||||||
+ if (!TEST_ptr(grp)
|
|
||||||
+ || !TEST_int_eq(grp->decoded_from_explicit_params, 0))
|
|
||||||
+ goto err;
|
|
||||||
+
|
|
||||||
+ /* Test EC_GROUP_new_from_ecparameters not setting the flag */
|
|
||||||
+ if (!TEST_ptr(ecparams = EC_GROUP_get_ecparameters(grp, NULL))
|
|
||||||
+ || !TEST_ptr(grp_copy = EC_GROUP_new_from_ecparameters(ecparams))
|
|
||||||
+ || !TEST_int_eq(grp_copy->decoded_from_explicit_params, 0))
|
|
||||||
+ goto err;
|
|
||||||
+ EC_GROUP_free(grp_copy);
|
|
||||||
+ grp_copy = NULL;
|
|
||||||
+ ECPARAMETERS_free(ecparams);
|
|
||||||
+ ecparams = NULL;
|
|
||||||
+
|
|
||||||
+ /* Test EC_GROUP_new_from_ecpkparameters not setting the flag */
|
|
||||||
+ if (!TEST_int_eq(EC_GROUP_get_asn1_flag(grp), OPENSSL_EC_NAMED_CURVE)
|
|
||||||
+ || !TEST_ptr(ecpkparams = EC_GROUP_get_ecpkparameters(grp, NULL))
|
|
||||||
+ || !TEST_ptr(grp_copy = EC_GROUP_new_from_ecpkparameters(ecpkparams))
|
|
||||||
+ || !TEST_int_eq(grp_copy->decoded_from_explicit_params, 0)
|
|
||||||
+ || !TEST_ptr(key = EC_KEY_new())
|
|
||||||
+ /* Test EC_KEY_decoded_from_explicit_params on key without a group */
|
|
||||||
+ || !TEST_int_eq(EC_KEY_decoded_from_explicit_params(key), -1)
|
|
||||||
+ || !TEST_int_eq(EC_KEY_set_group(key, grp_copy), 1)
|
|
||||||
+ /* Test EC_KEY_decoded_from_explicit_params negative case */
|
|
||||||
+ || !TEST_int_eq(EC_KEY_decoded_from_explicit_params(key), 0))
|
|
||||||
+ goto err;
|
|
||||||
+ EC_GROUP_free(grp_copy);
|
|
||||||
+ grp_copy = NULL;
|
|
||||||
+ ECPKPARAMETERS_free(ecpkparams);
|
|
||||||
+ ecpkparams = NULL;
|
|
||||||
+
|
|
||||||
+ /* Test d2i_ECPKParameters with named params not setting the flag */
|
|
||||||
+ if (!TEST_int_gt(encodedlen = i2d_ECPKParameters(grp, &encodedparams), 0)
|
|
||||||
+ || !TEST_ptr(encp = encodedparams)
|
|
||||||
+ || !TEST_ptr(grp_copy = d2i_ECPKParameters(NULL, &encp, encodedlen))
|
|
||||||
+ || !TEST_int_eq(grp_copy->decoded_from_explicit_params, 0))
|
|
||||||
+ goto err;
|
|
||||||
+ EC_GROUP_free(grp_copy);
|
|
||||||
+ grp_copy = NULL;
|
|
||||||
+ OPENSSL_free(encodedparams);
|
|
||||||
+ encodedparams = NULL;
|
|
||||||
+
|
|
||||||
+ /* Asn1 flag stays set to explicit with EC_GROUP_new_from_ecpkparameters */
|
|
||||||
+ EC_GROUP_set_asn1_flag(grp, OPENSSL_EC_EXPLICIT_CURVE);
|
|
||||||
+ if (!TEST_ptr(ecpkparams = EC_GROUP_get_ecpkparameters(grp, NULL))
|
|
||||||
+ || !TEST_ptr(grp_copy = EC_GROUP_new_from_ecpkparameters(ecpkparams))
|
|
||||||
+ || !TEST_int_eq(EC_GROUP_get_asn1_flag(grp_copy), OPENSSL_EC_EXPLICIT_CURVE)
|
|
||||||
+ || !TEST_int_eq(grp_copy->decoded_from_explicit_params, 0))
|
|
||||||
+ goto err;
|
|
||||||
+ EC_GROUP_free(grp_copy);
|
|
||||||
+ grp_copy = NULL;
|
|
||||||
+
|
|
||||||
+ /* Test d2i_ECPKParameters with explicit params setting the flag */
|
|
||||||
+ if (!TEST_int_gt(encodedlen = i2d_ECPKParameters(grp, &encodedparams), 0)
|
|
||||||
+ || !TEST_ptr(encp = encodedparams)
|
|
||||||
+ || !TEST_ptr(grp_copy = d2i_ECPKParameters(NULL, &encp, encodedlen))
|
|
||||||
+ || !TEST_int_eq(EC_GROUP_get_asn1_flag(grp_copy), OPENSSL_EC_EXPLICIT_CURVE)
|
|
||||||
+ || !TEST_int_eq(grp_copy->decoded_from_explicit_params, 1)
|
|
||||||
+ || !TEST_int_eq(EC_KEY_set_group(key, grp_copy), 1)
|
|
||||||
+ /* Test EC_KEY_decoded_from_explicit_params positive case */
|
|
||||||
+ || !TEST_int_eq(EC_KEY_decoded_from_explicit_params(key), 1))
|
|
||||||
+ goto err;
|
|
||||||
+
|
|
||||||
+ testresult = 1;
|
|
||||||
+
|
|
||||||
+ err:
|
|
||||||
+ EC_KEY_free(key);
|
|
||||||
+ EC_GROUP_free(grp);
|
|
||||||
+ EC_GROUP_free(grp_copy);
|
|
||||||
+ ECPARAMETERS_free(ecparams);
|
|
||||||
+ ECPKPARAMETERS_free(ecpkparams);
|
|
||||||
+ OPENSSL_free(encodedparams);
|
|
||||||
+
|
|
||||||
+ return testresult;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
int setup_tests(void)
|
|
||||||
{
|
|
||||||
crv_len = EC_get_builtin_curves(NULL, 0);
|
|
||||||
@@ -196,6 +296,7 @@ int setup_tests(void)
|
|
||||||
ADD_TEST(field_tests_ec2_simple);
|
|
||||||
#endif
|
|
||||||
ADD_ALL_TESTS(field_tests_default, crv_len);
|
|
||||||
+ ADD_TEST(decoded_flag_test);
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
diff -up openssl-1.1.1g/test/recipes/25-test_verify.t.explicit-params openssl-1.1.1g/test/recipes/25-test_verify.t
|
|
||||||
--- openssl-1.1.1g/test/recipes/25-test_verify.t.explicit-params 2020-10-23 15:27:31.253311908 +0200
|
|
||||||
+++ openssl-1.1.1g/test/recipes/25-test_verify.t 2020-10-23 15:27:31.306312361 +0200
|
|
||||||
@@ -27,7 +27,7 @@ sub verify {
|
|
||||||
run(app([@args]));
|
|
||||||
}
|
|
||||||
|
|
||||||
-plan tests => 137;
|
|
||||||
+plan tests => 142;
|
|
||||||
|
|
||||||
# Canonical success
|
|
||||||
ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"]),
|
|
||||||
@@ -280,6 +280,27 @@ ok(verify("ee-cert-md5", "sslserver", ["
|
|
||||||
ok(!verify("ee-cert-md5", "sslserver", ["root-cert"], ["ca-cert"]),
|
|
||||||
"reject md5 leaf at auth level 1");
|
|
||||||
|
|
||||||
+# Explicit vs named curve tests
|
|
||||||
+SKIP: {
|
|
||||||
+ skip "EC is not supported by this OpenSSL build", 5
|
|
||||||
+ if disabled("ec");
|
|
||||||
+ ok(verify("ee-cert-ec-explicit", "sslserver", ["root-cert"],
|
|
||||||
+ ["ca-cert-ec-named"]),
|
|
||||||
+ "accept explicit curve leaf with named curve intermediate without strict");
|
|
||||||
+ ok(verify("ee-cert-ec-named-explicit", "sslserver", ["root-cert"],
|
|
||||||
+ ["ca-cert-ec-explicit"]),
|
|
||||||
+ "accept named curve leaf with explicit curve intermediate without strict");
|
|
||||||
+ ok(!verify("ee-cert-ec-explicit", "sslserver", ["root-cert"],
|
|
||||||
+ ["ca-cert-ec-named"], "-x509_strict"),
|
|
||||||
+ "reject explicit curve leaf with named curve intermediate with strict");
|
|
||||||
+ ok(!verify("ee-cert-ec-named-explicit", "sslserver", ["root-cert"],
|
|
||||||
+ ["ca-cert-ec-explicit"], "-x509_strict"),
|
|
||||||
+ "reject named curve leaf with explicit curve intermediate with strict");
|
|
||||||
+ ok(verify("ee-cert-ec-named-named", "sslserver", ["root-cert"],
|
|
||||||
+ ["ca-cert-ec-named"], "-x509_strict"),
|
|
||||||
+ "accept named curve leaf with named curve intermediate with strict");
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
# Depth tests, note the depth limit bounds the number of CA certificates
|
|
||||||
# between the trust-anchor and the leaf, so, for example, with a root->ca->leaf
|
|
||||||
# chain, depth = 1 is sufficient, but depth == 0 is not.
|
|
||||||
diff -up openssl-1.1.1g/util/libcrypto.num.explicit-params openssl-1.1.1g/util/libcrypto.num
|
|
||||||
--- openssl-1.1.1g/util/libcrypto.num.explicit-params 2020-10-23 15:27:31.265312011 +0200
|
|
||||||
+++ openssl-1.1.1g/util/libcrypto.num 2020-10-23 15:31:37.424413877 +0200
|
|
||||||
@@ -4587,6 +4587,7 @@ EVP_PKEY_meth_set_digestverify
|
|
||||||
EVP_PKEY_meth_get_digestverify 4541 1_1_1e EXIST::FUNCTION:
|
|
||||||
EVP_PKEY_meth_get_digestsign 4542 1_1_1e EXIST::FUNCTION:
|
|
||||||
RSA_get0_pss_params 4543 1_1_1e EXIST::FUNCTION:RSA
|
|
||||||
+EC_KEY_decoded_from_explicit_params 4547 1_1_1h EXIST::FUNCTION:EC
|
|
||||||
FIPS_drbg_reseed 6348 1_1_0g EXIST::FUNCTION:
|
|
||||||
FIPS_selftest_check 6349 1_1_0g EXIST::FUNCTION:
|
|
||||||
FIPS_rand_set_method 6350 1_1_0g EXIST::FUNCTION:
|
|
@ -1,6 +1,6 @@
|
|||||||
diff -up openssl-1.1.1g/crypto/bn/bn_const.c.fips-dh openssl-1.1.1g/crypto/bn/bn_const.c
|
diff -up openssl-1.1.1j/crypto/bn/bn_const.c.fips-dh openssl-1.1.1j/crypto/bn/bn_const.c
|
||||||
--- openssl-1.1.1g/crypto/bn/bn_const.c.fips-dh 2020-04-21 14:22:39.000000000 +0200
|
--- openssl-1.1.1j/crypto/bn/bn_const.c.fips-dh 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1g/crypto/bn/bn_const.c 2020-07-17 10:36:29.245788441 +0200
|
+++ openssl-1.1.1j/crypto/bn/bn_const.c 2021-03-03 14:23:27.403092418 +0100
|
||||||
@@ -1,13 +1,17 @@
|
@@ -1,13 +1,17 @@
|
||||||
/*
|
/*
|
||||||
- * Copyright 2005-2016 The OpenSSL Project Authors. All Rights Reserved.
|
- * Copyright 2005-2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||||
@ -477,9 +477,9 @@ diff -up openssl-1.1.1g/crypto/bn/bn_const.c.fips-dh openssl-1.1.1g/crypto/bn/bn
|
|||||||
- return BN_bin2bn(RFC3526_PRIME_8192, sizeof(RFC3526_PRIME_8192), bn);
|
- return BN_bin2bn(RFC3526_PRIME_8192, sizeof(RFC3526_PRIME_8192), bn);
|
||||||
+ return COPY_BN(bn, _bignum_modp_8192_p);
|
+ return COPY_BN(bn, _bignum_modp_8192_p);
|
||||||
}
|
}
|
||||||
diff -up openssl-1.1.1g/crypto/bn/bn_dh.c.fips-dh openssl-1.1.1g/crypto/bn/bn_dh.c
|
diff -up openssl-1.1.1j/crypto/bn/bn_dh.c.fips-dh openssl-1.1.1j/crypto/bn/bn_dh.c
|
||||||
--- openssl-1.1.1g/crypto/bn/bn_dh.c.fips-dh 2020-04-21 14:22:39.000000000 +0200
|
--- openssl-1.1.1j/crypto/bn/bn_dh.c.fips-dh 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1g/crypto/bn/bn_dh.c 2020-07-17 10:36:29.246788449 +0200
|
+++ openssl-1.1.1j/crypto/bn/bn_dh.c 2021-03-03 14:23:27.404092427 +0100
|
||||||
@@ -1,7 +1,7 @@
|
@@ -1,7 +1,7 @@
|
||||||
/*
|
/*
|
||||||
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
|
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
|
||||||
@ -1956,9 +1956,9 @@ diff -up openssl-1.1.1g/crypto/bn/bn_dh.c.fips-dh openssl-1.1.1g/crypto/bn/bn_dh
|
|||||||
|
|
||||||
-#endif
|
-#endif
|
||||||
+#endif /* OPENSSL_NO_DH */
|
+#endif /* OPENSSL_NO_DH */
|
||||||
diff -up openssl-1.1.1g/crypto/dh/dh_check.c.fips-dh openssl-1.1.1g/crypto/dh/dh_check.c
|
diff -up openssl-1.1.1j/crypto/dh/dh_check.c.fips-dh openssl-1.1.1j/crypto/dh/dh_check.c
|
||||||
--- openssl-1.1.1g/crypto/dh/dh_check.c.fips-dh 2020-04-21 14:22:39.000000000 +0200
|
--- openssl-1.1.1j/crypto/dh/dh_check.c.fips-dh 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1g/crypto/dh/dh_check.c 2020-07-17 10:36:29.246788449 +0200
|
+++ openssl-1.1.1j/crypto/dh/dh_check.c 2021-03-03 14:23:27.404092427 +0100
|
||||||
@@ -10,6 +10,7 @@
|
@@ -10,6 +10,7 @@
|
||||||
#include <stdio.h>
|
#include <stdio.h>
|
||||||
#include "internal/cryptlib.h"
|
#include "internal/cryptlib.h"
|
||||||
@ -2043,9 +2043,9 @@ diff -up openssl-1.1.1g/crypto/dh/dh_check.c.fips-dh openssl-1.1.1g/crypto/dh/dh
|
|||||||
+ return dh_check_pub_key_int(dh, q, pub_key, ret);
|
+ return dh_check_pub_key_int(dh, q, pub_key, ret);
|
||||||
+}
|
+}
|
||||||
+
|
+
|
||||||
diff -up openssl-1.1.1g/crypto/dh/dh_gen.c.fips-dh openssl-1.1.1g/crypto/dh/dh_gen.c
|
diff -up openssl-1.1.1j/crypto/dh/dh_gen.c.fips-dh openssl-1.1.1j/crypto/dh/dh_gen.c
|
||||||
--- openssl-1.1.1g/crypto/dh/dh_gen.c.fips-dh 2020-07-17 10:36:29.182787923 +0200
|
--- openssl-1.1.1j/crypto/dh/dh_gen.c.fips-dh 2021-03-03 14:23:27.338091859 +0100
|
||||||
+++ openssl-1.1.1g/crypto/dh/dh_gen.c 2020-07-17 10:36:29.246788449 +0200
|
+++ openssl-1.1.1j/crypto/dh/dh_gen.c 2021-03-03 14:23:27.404092427 +0100
|
||||||
@@ -27,8 +27,7 @@ int DH_generate_parameters_ex(DH *ret, i
|
@@ -27,8 +27,7 @@ int DH_generate_parameters_ex(DH *ret, i
|
||||||
BN_GENCB *cb)
|
BN_GENCB *cb)
|
||||||
{
|
{
|
||||||
@ -2075,10 +2075,10 @@ diff -up openssl-1.1.1g/crypto/dh/dh_gen.c.fips-dh openssl-1.1.1g/crypto/dh/dh_g
|
|||||||
ctx = BN_CTX_new();
|
ctx = BN_CTX_new();
|
||||||
if (ctx == NULL)
|
if (ctx == NULL)
|
||||||
goto err;
|
goto err;
|
||||||
diff -up openssl-1.1.1g/crypto/dh/dh_key.c.fips-dh openssl-1.1.1g/crypto/dh/dh_key.c
|
diff -up openssl-1.1.1j/crypto/dh/dh_key.c.fips-dh openssl-1.1.1j/crypto/dh/dh_key.c
|
||||||
--- openssl-1.1.1g/crypto/dh/dh_key.c.fips-dh 2020-07-17 10:36:29.182787923 +0200
|
--- openssl-1.1.1j/crypto/dh/dh_key.c.fips-dh 2021-03-03 14:23:27.338091859 +0100
|
||||||
+++ openssl-1.1.1g/crypto/dh/dh_key.c 2020-07-17 11:00:07.783777846 +0200
|
+++ openssl-1.1.1j/crypto/dh/dh_key.c 2021-03-03 14:51:36.235296236 +0100
|
||||||
@@ -100,10 +100,18 @@ static int generate_key(DH *dh)
|
@@ -120,10 +120,18 @@ static int generate_key(DH *dh)
|
||||||
BIGNUM *pub_key = NULL, *priv_key = NULL;
|
BIGNUM *pub_key = NULL, *priv_key = NULL;
|
||||||
|
|
||||||
#ifdef OPENSSL_FIPS
|
#ifdef OPENSSL_FIPS
|
||||||
@ -2101,7 +2101,7 @@ diff -up openssl-1.1.1g/crypto/dh/dh_key.c.fips-dh openssl-1.1.1g/crypto/dh/dh_k
|
|||||||
}
|
}
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
@@ -139,7 +147,15 @@ static int generate_key(DH *dh)
|
@@ -159,7 +167,15 @@ static int generate_key(DH *dh)
|
||||||
}
|
}
|
||||||
|
|
||||||
if (generate_new_key) {
|
if (generate_new_key) {
|
||||||
@ -2118,7 +2118,7 @@ diff -up openssl-1.1.1g/crypto/dh/dh_key.c.fips-dh openssl-1.1.1g/crypto/dh/dh_k
|
|||||||
do {
|
do {
|
||||||
if (!BN_priv_rand_range(priv_key, dh->q))
|
if (!BN_priv_rand_range(priv_key, dh->q))
|
||||||
goto err;
|
goto err;
|
||||||
@@ -175,6 +191,15 @@ static int generate_key(DH *dh)
|
@@ -195,6 +211,15 @@ static int generate_key(DH *dh)
|
||||||
}
|
}
|
||||||
/* We MUST free prk before any further use of priv_key */
|
/* We MUST free prk before any further use of priv_key */
|
||||||
BN_clear_free(prk);
|
BN_clear_free(prk);
|
||||||
@ -2134,7 +2134,7 @@ diff -up openssl-1.1.1g/crypto/dh/dh_key.c.fips-dh openssl-1.1.1g/crypto/dh/dh_k
|
|||||||
}
|
}
|
||||||
|
|
||||||
dh->pub_key = pub_key;
|
dh->pub_key = pub_key;
|
||||||
@@ -197,6 +222,7 @@ static int compute_key(unsigned char *ke
|
@@ -217,6 +242,7 @@ static int compute_key(unsigned char *ke
|
||||||
BN_CTX *ctx = NULL;
|
BN_CTX *ctx = NULL;
|
||||||
BN_MONT_CTX *mont = NULL;
|
BN_MONT_CTX *mont = NULL;
|
||||||
BIGNUM *tmp;
|
BIGNUM *tmp;
|
||||||
@ -2142,7 +2142,7 @@ diff -up openssl-1.1.1g/crypto/dh/dh_key.c.fips-dh openssl-1.1.1g/crypto/dh/dh_k
|
|||||||
int ret = -1;
|
int ret = -1;
|
||||||
int check_result;
|
int check_result;
|
||||||
|
|
||||||
@@ -243,6 +269,18 @@ static int compute_key(unsigned char *ke
|
@@ -263,6 +289,18 @@ static int compute_key(unsigned char *ke
|
||||||
DHerr(DH_F_COMPUTE_KEY, ERR_R_BN_LIB);
|
DHerr(DH_F_COMPUTE_KEY, ERR_R_BN_LIB);
|
||||||
goto err;
|
goto err;
|
||||||
}
|
}
|
||||||
@ -2159,11 +2159,11 @@ diff -up openssl-1.1.1g/crypto/dh/dh_key.c.fips-dh openssl-1.1.1g/crypto/dh/dh_k
|
|||||||
+ goto err;
|
+ goto err;
|
||||||
+ }
|
+ }
|
||||||
|
|
||||||
ret = BN_bn2bin(tmp, key);
|
ret = BN_bn2binpad(tmp, key, BN_num_bytes(dh->p));
|
||||||
err:
|
err:
|
||||||
diff -up openssl-1.1.1g/crypto/dh/dh_lib.c.fips-dh openssl-1.1.1g/crypto/dh/dh_lib.c
|
diff -up openssl-1.1.1j/crypto/dh/dh_lib.c.fips-dh openssl-1.1.1j/crypto/dh/dh_lib.c
|
||||||
--- openssl-1.1.1g/crypto/dh/dh_lib.c.fips-dh 2020-04-21 14:22:39.000000000 +0200
|
--- openssl-1.1.1j/crypto/dh/dh_lib.c.fips-dh 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1g/crypto/dh/dh_lib.c 2020-07-17 10:36:29.246788449 +0200
|
+++ openssl-1.1.1j/crypto/dh/dh_lib.c 2021-03-03 14:23:27.405092436 +0100
|
||||||
@@ -8,6 +8,7 @@
|
@@ -8,6 +8,7 @@
|
||||||
*/
|
*/
|
||||||
|
|
||||||
@ -2193,9 +2193,9 @@ diff -up openssl-1.1.1g/crypto/dh/dh_lib.c.fips-dh openssl-1.1.1g/crypto/dh/dh_l
|
|||||||
dh->length = BN_num_bits(q);
|
dh->length = BN_num_bits(q);
|
||||||
}
|
}
|
||||||
|
|
||||||
diff -up openssl-1.1.1g/crypto/dh/dh_local.h.fips-dh openssl-1.1.1g/crypto/dh/dh_local.h
|
diff -up openssl-1.1.1j/crypto/dh/dh_local.h.fips-dh openssl-1.1.1j/crypto/dh/dh_local.h
|
||||||
--- openssl-1.1.1g/crypto/dh/dh_local.h.fips-dh 2020-07-17 10:36:28.968786163 +0200
|
--- openssl-1.1.1j/crypto/dh/dh_local.h.fips-dh 2021-03-03 14:23:27.202090689 +0100
|
||||||
+++ openssl-1.1.1g/crypto/dh/dh_local.h 2020-07-17 10:36:29.246788449 +0200
|
+++ openssl-1.1.1j/crypto/dh/dh_local.h 2021-03-03 14:23:27.405092436 +0100
|
||||||
@@ -35,6 +35,7 @@ struct dh_st {
|
@@ -35,6 +35,7 @@ struct dh_st {
|
||||||
const DH_METHOD *meth;
|
const DH_METHOD *meth;
|
||||||
ENGINE *engine;
|
ENGINE *engine;
|
||||||
@ -2215,9 +2215,9 @@ diff -up openssl-1.1.1g/crypto/dh/dh_local.h.fips-dh openssl-1.1.1g/crypto/dh/dh
|
|||||||
+/* FIPS mode only check which requires nid set and looks up q based on it. */
|
+/* FIPS mode only check which requires nid set and looks up q based on it. */
|
||||||
+int dh_check_pub_key_full(const DH *dh, const BIGNUM *pub_key, int *ret);
|
+int dh_check_pub_key_full(const DH *dh, const BIGNUM *pub_key, int *ret);
|
||||||
+
|
+
|
||||||
diff -up openssl-1.1.1g/crypto/dh/dh_rfc7919.c.fips-dh openssl-1.1.1g/crypto/dh/dh_rfc7919.c
|
diff -up openssl-1.1.1j/crypto/dh/dh_rfc7919.c.fips-dh openssl-1.1.1j/crypto/dh/dh_rfc7919.c
|
||||||
--- openssl-1.1.1g/crypto/dh/dh_rfc7919.c.fips-dh 2020-04-21 14:22:39.000000000 +0200
|
--- openssl-1.1.1j/crypto/dh/dh_rfc7919.c.fips-dh 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1g/crypto/dh/dh_rfc7919.c 2020-07-17 10:36:29.246788449 +0200
|
+++ openssl-1.1.1j/crypto/dh/dh_rfc7919.c 2021-03-03 14:23:27.405092436 +0100
|
||||||
@@ -7,6 +7,8 @@
|
@@ -7,6 +7,8 @@
|
||||||
* https://www.openssl.org/source/license.html
|
* https://www.openssl.org/source/license.html
|
||||||
*/
|
*/
|
||||||
@ -2387,10 +2387,10 @@ diff -up openssl-1.1.1g/crypto/dh/dh_rfc7919.c.fips-dh openssl-1.1.1g/crypto/dh/
|
|||||||
+ return dh_match_group(dh, q, NULL) != NID_undef;
|
+ return dh_match_group(dh, q, NULL) != NID_undef;
|
||||||
+}
|
+}
|
||||||
+
|
+
|
||||||
diff -up openssl-1.1.1g/crypto/ec/ec_key.c.fips-dh openssl-1.1.1g/crypto/ec/ec_key.c
|
diff -up openssl-1.1.1j/crypto/ec/ec_key.c.fips-dh openssl-1.1.1j/crypto/ec/ec_key.c
|
||||||
--- openssl-1.1.1g/crypto/ec/ec_key.c.fips-dh 2020-07-17 11:00:53.958175227 +0200
|
--- openssl-1.1.1j/crypto/ec/ec_key.c.fips-dh 2021-03-03 14:23:27.339091868 +0100
|
||||||
+++ openssl-1.1.1g/crypto/ec/ec_key.c 2020-07-20 13:24:03.941107320 +0200
|
+++ openssl-1.1.1j/crypto/ec/ec_key.c 2021-03-03 14:23:27.405092436 +0100
|
||||||
@@ -280,9 +280,18 @@ int ec_key_simple_generate_key(EC_KEY *e
|
@@ -281,9 +281,18 @@ int ec_key_simple_generate_key(EC_KEY *e
|
||||||
if (!EC_POINT_mul(eckey->group, pub_key, priv_key, NULL, NULL, ctx))
|
if (!EC_POINT_mul(eckey->group, pub_key, priv_key, NULL, NULL, ctx))
|
||||||
goto err;
|
goto err;
|
||||||
|
|
||||||
@ -2410,7 +2410,7 @@ diff -up openssl-1.1.1g/crypto/ec/ec_key.c.fips-dh openssl-1.1.1g/crypto/ec/ec_k
|
|||||||
ok = 1;
|
ok = 1;
|
||||||
|
|
||||||
err:
|
err:
|
||||||
@@ -296,8 +305,23 @@ int ec_key_simple_generate_key(EC_KEY *e
|
@@ -297,8 +306,23 @@ int ec_key_simple_generate_key(EC_KEY *e
|
||||||
|
|
||||||
int ec_key_simple_generate_public_key(EC_KEY *eckey)
|
int ec_key_simple_generate_public_key(EC_KEY *eckey)
|
||||||
{
|
{
|
||||||
@ -2435,9 +2435,9 @@ diff -up openssl-1.1.1g/crypto/ec/ec_key.c.fips-dh openssl-1.1.1g/crypto/ec/ec_k
|
|||||||
}
|
}
|
||||||
|
|
||||||
int EC_KEY_check_key(const EC_KEY *eckey)
|
int EC_KEY_check_key(const EC_KEY *eckey)
|
||||||
diff -up openssl-1.1.1g/crypto/evp/p_lib.c.fips-dh openssl-1.1.1g/crypto/evp/p_lib.c
|
diff -up openssl-1.1.1j/crypto/evp/p_lib.c.fips-dh openssl-1.1.1j/crypto/evp/p_lib.c
|
||||||
--- openssl-1.1.1g/crypto/evp/p_lib.c.fips-dh 2020-04-21 14:22:39.000000000 +0200
|
--- openssl-1.1.1j/crypto/evp/p_lib.c.fips-dh 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1g/crypto/evp/p_lib.c 2020-07-17 10:36:29.247788458 +0200
|
+++ openssl-1.1.1j/crypto/evp/p_lib.c 2021-03-03 14:23:27.405092436 +0100
|
||||||
@@ -540,7 +540,8 @@ EC_KEY *EVP_PKEY_get1_EC_KEY(EVP_PKEY *p
|
@@ -540,7 +540,8 @@ EC_KEY *EVP_PKEY_get1_EC_KEY(EVP_PKEY *p
|
||||||
|
|
||||||
int EVP_PKEY_set1_DH(EVP_PKEY *pkey, DH *key)
|
int EVP_PKEY_set1_DH(EVP_PKEY *pkey, DH *key)
|
||||||
@ -2448,251 +2448,9 @@ diff -up openssl-1.1.1g/crypto/evp/p_lib.c.fips-dh openssl-1.1.1g/crypto/evp/p_l
|
|||||||
int ret = EVP_PKEY_assign(pkey, type, key);
|
int ret = EVP_PKEY_assign(pkey, type, key);
|
||||||
|
|
||||||
if (ret)
|
if (ret)
|
||||||
diff -up openssl-1.1.1g/crypto/fips/fips_dh_selftest.c.fips-dh openssl-1.1.1g/crypto/fips/fips_dh_selftest.c
|
diff -up openssl-1.1.1j/crypto/objects/obj_dat.h.fips-dh openssl-1.1.1j/crypto/objects/obj_dat.h
|
||||||
--- openssl-1.1.1g/crypto/fips/fips_dh_selftest.c.fips-dh 2020-09-17 14:38:55.074927727 +0200
|
--- openssl-1.1.1j/crypto/objects/obj_dat.h.fips-dh 2021-03-03 14:23:27.394092341 +0100
|
||||||
+++ openssl-1.1.1g/crypto/fips/fips_dh_selftest.c 2020-10-22 16:06:54.406229842 +0200
|
+++ openssl-1.1.1j/crypto/objects/obj_dat.h 2021-03-03 14:23:27.406092444 +0100
|
||||||
@@ -59,107 +59,141 @@
|
|
||||||
|
|
||||||
#ifdef OPENSSL_FIPS
|
|
||||||
|
|
||||||
-static const unsigned char dh_test_2048_p[] = {
|
|
||||||
- 0xAE, 0xEC, 0xEE, 0x22, 0xFA, 0x3A, 0xA5, 0x22, 0xC0, 0xDE, 0x0F, 0x09,
|
|
||||||
- 0x7E, 0x17, 0xC0, 0x05, 0xF9, 0xF1, 0xE7, 0xC6, 0x87, 0x14, 0x6D, 0x11,
|
|
||||||
- 0xE7, 0xAE, 0xED, 0x2F, 0x72, 0x59, 0xC5, 0xA9, 0x9B, 0xB8, 0x02, 0xA5,
|
|
||||||
- 0xF3, 0x69, 0x70, 0xD6, 0xDD, 0x90, 0xF9, 0x19, 0x79, 0xBE, 0x60, 0x8F,
|
|
||||||
- 0x25, 0x92, 0x30, 0x1C, 0x51, 0x51, 0x38, 0x26, 0x82, 0x25, 0xE6, 0xFC,
|
|
||||||
- 0xED, 0x65, 0x96, 0x8F, 0x57, 0xE5, 0x53, 0x8B, 0x38, 0x63, 0xC7, 0xCE,
|
|
||||||
- 0xBC, 0x1B, 0x4D, 0x18, 0x2A, 0x5B, 0x04, 0x3F, 0x6A, 0x3C, 0x94, 0x39,
|
|
||||||
- 0xAE, 0x36, 0xD6, 0x5E, 0x0F, 0xA2, 0xCC, 0xD0, 0xD4, 0xD5, 0xC6, 0x1E,
|
|
||||||
- 0xF6, 0xA0, 0xF5, 0x89, 0x4E, 0xB4, 0x0B, 0xA4, 0xB3, 0x2B, 0x3D, 0xE2,
|
|
||||||
- 0x4E, 0xE1, 0x49, 0x25, 0x99, 0x5F, 0x32, 0x16, 0x33, 0x32, 0x1B, 0x7A,
|
|
||||||
- 0xA5, 0x5C, 0x6B, 0x34, 0x0D, 0x39, 0x99, 0xDC, 0xF0, 0x76, 0xE5, 0x5A,
|
|
||||||
- 0xD4, 0x71, 0x00, 0xED, 0x5A, 0x73, 0xFB, 0xC8, 0x01, 0xAD, 0x99, 0xCF,
|
|
||||||
- 0x99, 0x52, 0x7C, 0x9C, 0x64, 0xC6, 0x76, 0x40, 0x57, 0xAF, 0x59, 0xD7,
|
|
||||||
- 0x38, 0x0B, 0x40, 0xDE, 0x33, 0x0D, 0xB8, 0x76, 0xEC, 0xA9, 0xD8, 0x73,
|
|
||||||
- 0xF8, 0xEF, 0x26, 0x66, 0x06, 0x27, 0xDD, 0x7C, 0xA4, 0x10, 0x9C, 0xA6,
|
|
||||||
- 0xAA, 0xF9, 0x53, 0x62, 0x73, 0x1D, 0xBA, 0x1C, 0xF1, 0x67, 0xF4, 0x35,
|
|
||||||
- 0xED, 0x6F, 0x37, 0x92, 0xE8, 0x4F, 0x6C, 0xBA, 0x52, 0x6E, 0xA1, 0xED,
|
|
||||||
- 0xDA, 0x9F, 0x85, 0x11, 0x82, 0x52, 0x62, 0x08, 0x44, 0xF1, 0x30, 0x03,
|
|
||||||
- 0xC3, 0x38, 0x2C, 0x79, 0xBD, 0xD4, 0x43, 0x45, 0xEE, 0x8E, 0x50, 0xFC,
|
|
||||||
- 0x29, 0x46, 0x9A, 0xFE, 0x54, 0x1A, 0x19, 0x8F, 0x4B, 0x84, 0x08, 0xDE,
|
|
||||||
- 0x20, 0x62, 0x73, 0xCC, 0xDD, 0x7E, 0xF0, 0xEF, 0xA2, 0xFD, 0x86, 0x58,
|
|
||||||
- 0x4B, 0xD8, 0x37, 0xEB
|
|
||||||
+static const unsigned char dh_test_2048_priv_key[] = {
|
|
||||||
+ 0x0C, 0x4B, 0x30, 0x89, 0xD1, 0xB8, 0x62, 0xCB,
|
|
||||||
+ 0x3C, 0x43, 0x64, 0x91, 0xF0, 0x91, 0x54, 0x70,
|
|
||||||
+ 0xC5, 0x27, 0x96, 0xE3, 0xAC, 0xBE, 0xE8, 0x00,
|
|
||||||
+ 0xEC, 0x55, 0xF6, 0xCC
|
|
||||||
};
|
|
||||||
|
|
||||||
-static const unsigned char dh_test_2048_g[] = {
|
|
||||||
- 0x02
|
|
||||||
+static const unsigned char dh_test_2048_pub_key[] = {
|
|
||||||
+ 0xE8, 0x8B, 0xEC, 0x36, 0x93, 0xB4, 0x94, 0x44,
|
|
||||||
+ 0xA3, 0x7D, 0x09, 0x5C, 0x0B, 0x60, 0x79, 0x4B,
|
|
||||||
+ 0x2B, 0xCA, 0xCF, 0xB7, 0x16, 0x30, 0x4A, 0xD0,
|
|
||||||
+ 0xEA, 0x23, 0x04, 0x24, 0x8C, 0x50, 0x82, 0x11,
|
|
||||||
+ 0x79, 0x4C, 0x57, 0x6F, 0x96, 0xAC, 0xF9, 0x78,
|
|
||||||
+ 0x38, 0x83, 0x03, 0x0B, 0x77, 0x47, 0xB7, 0x84,
|
|
||||||
+ 0xB9, 0x6F, 0xE6, 0xB9, 0xCC, 0xA7, 0x2B, 0x94,
|
|
||||||
+ 0xAE, 0x8A, 0xCA, 0x58, 0x15, 0x7B, 0xA0, 0x73,
|
|
||||||
+ 0x5D, 0xD4, 0xD7, 0xC6, 0xBA, 0xA6, 0x03, 0x30,
|
|
||||||
+ 0x6B, 0x52, 0x85, 0x94, 0x57, 0x11, 0xFB, 0xAA,
|
|
||||||
+ 0x83, 0x71, 0x5E, 0x0E, 0xC4, 0x86, 0x89, 0xF8,
|
|
||||||
+ 0x38, 0x5A, 0xAE, 0x66, 0xF2, 0xA1, 0x67, 0xE0,
|
|
||||||
+ 0xF5, 0x7A, 0x38, 0xE6, 0x21, 0x98, 0xF0, 0x33,
|
|
||||||
+ 0xD6, 0xD7, 0x27, 0x82, 0xED, 0xDE, 0x73, 0x52,
|
|
||||||
+ 0xD4, 0x2C, 0xCF, 0x0A, 0xB1, 0xA1, 0xA0, 0x5A,
|
|
||||||
+ 0xCE, 0x05, 0x40, 0xE7, 0xF7, 0x0C, 0xE2, 0x63,
|
|
||||||
+ 0x21, 0xA0, 0xF3, 0x26, 0x9B, 0xEC, 0x6B, 0x33,
|
|
||||||
+ 0x4D, 0x34, 0x9B, 0x8D, 0x86, 0x10, 0xB8, 0xE8,
|
|
||||||
+ 0x96, 0x84, 0x66, 0x49, 0x27, 0xED, 0x2B, 0x76,
|
|
||||||
+ 0x19, 0xF6, 0x9C, 0xCB, 0x71, 0x4F, 0xF9, 0x16,
|
|
||||||
+ 0xB4, 0xD0, 0xC6, 0x49, 0x7A, 0x53, 0xDD, 0x53,
|
|
||||||
+ 0xA1, 0x0E, 0x0B, 0xB6, 0x33, 0xC4, 0xE9, 0xCF,
|
|
||||||
+ 0x5A, 0x1E, 0x4D, 0xC8, 0xE3, 0x1F, 0x14, 0x9D,
|
|
||||||
+ 0xF0, 0x14, 0x70, 0x39, 0x50, 0x21, 0x8A, 0xEA,
|
|
||||||
+ 0x7C, 0x72, 0xA3, 0x3F, 0x67, 0x5C, 0x1E, 0x32,
|
|
||||||
+ 0xA7, 0x5D, 0x78, 0xCC, 0xE3, 0xA9, 0x03, 0x76,
|
|
||||||
+ 0x4A, 0xD4, 0x65, 0x0E, 0x11, 0xEF, 0x56, 0x25,
|
|
||||||
+ 0xE5, 0x78, 0x1A, 0xA8, 0x49, 0x8C, 0x14, 0x2E,
|
|
||||||
+ 0xF7, 0xFA, 0x70, 0x27, 0xB1, 0x89, 0x66, 0x8F,
|
|
||||||
+ 0xFA, 0xFC, 0xED, 0x15, 0x98, 0xE8, 0x0D, 0x72,
|
|
||||||
+ 0x17, 0x02, 0x67, 0x14, 0x55, 0x6C, 0x32, 0x98,
|
|
||||||
+ 0x59, 0xF3, 0x17, 0xBC, 0x55, 0xA1, 0x39, 0x69
|
|
||||||
};
|
|
||||||
|
|
||||||
-static const unsigned char dh_test_2048_pub_key[] = {
|
|
||||||
- 0xA0, 0x39, 0x11, 0x77, 0x9A, 0xC1, 0x30, 0x1F, 0xBE, 0x48, 0xA7, 0xAA,
|
|
||||||
- 0xA0, 0x84, 0x54, 0x64, 0xAD, 0x1B, 0x70, 0xFA, 0x13, 0x55, 0x63, 0xD2,
|
|
||||||
- 0x1F, 0x62, 0x32, 0x93, 0x8E, 0xC9, 0x3E, 0x09, 0xA7, 0x64, 0xE4, 0x12,
|
|
||||||
- 0x6E, 0x1B, 0xF2, 0x92, 0x3B, 0xB9, 0xCB, 0x56, 0xEA, 0x07, 0x88, 0xB5,
|
|
||||||
- 0xA6, 0xBC, 0x16, 0x1F, 0x27, 0xFE, 0xD8, 0xAA, 0x40, 0xB2, 0xB0, 0x2D,
|
|
||||||
- 0x37, 0x76, 0xA6, 0xA4, 0x82, 0x2C, 0x0E, 0x22, 0x64, 0x9D, 0xCB, 0xD1,
|
|
||||||
- 0x00, 0xB7, 0x89, 0x14, 0x72, 0x4E, 0xBE, 0x48, 0x41, 0xF8, 0xB2, 0x51,
|
|
||||||
- 0x11, 0x09, 0x4B, 0x22, 0x01, 0x23, 0x39, 0x96, 0xE0, 0x15, 0xD7, 0x9F,
|
|
||||||
- 0x60, 0xD1, 0xB7, 0xAE, 0xFE, 0x5F, 0xDB, 0xE7, 0x03, 0x17, 0x97, 0xA6,
|
|
||||||
- 0x16, 0x74, 0xBD, 0x53, 0x81, 0x19, 0xC5, 0x47, 0x5E, 0xCE, 0x8D, 0xED,
|
|
||||||
- 0x45, 0x5D, 0x3C, 0x00, 0xA0, 0x0A, 0x68, 0x6A, 0xE0, 0x8E, 0x06, 0x46,
|
|
||||||
- 0x6F, 0xD7, 0xF9, 0xDF, 0x31, 0x7E, 0x77, 0x44, 0x0D, 0x98, 0xE0, 0xCA,
|
|
||||||
- 0x98, 0x09, 0x52, 0x04, 0x90, 0xEA, 0x6D, 0xF4, 0x30, 0x69, 0x8F, 0xB1,
|
|
||||||
- 0x9B, 0xC1, 0x43, 0xDB, 0xD5, 0x8D, 0xC8, 0x8E, 0xB6, 0x0B, 0x05, 0xBE,
|
|
||||||
- 0x0E, 0xC5, 0x99, 0xC8, 0x6E, 0x4E, 0xF3, 0xCB, 0xC3, 0x5E, 0x9B, 0x53,
|
|
||||||
- 0xF7, 0x06, 0x1C, 0x4F, 0xC7, 0xB8, 0x6E, 0x30, 0x18, 0xCA, 0x9B, 0xB9,
|
|
||||||
- 0xBC, 0x5F, 0x17, 0x72, 0x29, 0x5A, 0xE5, 0xD9, 0x96, 0xB7, 0x0B, 0xF3,
|
|
||||||
- 0x2D, 0x8C, 0xF1, 0xE1, 0x0E, 0x0D, 0x74, 0xD5, 0x9D, 0xF0, 0x06, 0xA9,
|
|
||||||
- 0xB4, 0x95, 0x63, 0x76, 0x46, 0x55, 0x48, 0x82, 0x39, 0x90, 0xEF, 0x56,
|
|
||||||
- 0x75, 0x34, 0xB8, 0x34, 0xC3, 0x18, 0x6E, 0x1E, 0xAD, 0xE3, 0x48, 0x7E,
|
|
||||||
- 0x93, 0x2C, 0x23, 0xE7, 0xF8, 0x90, 0x73, 0xB1, 0x77, 0x80, 0x67, 0xA9,
|
|
||||||
- 0x36, 0x9E, 0xDA, 0xD2
|
|
||||||
+static const unsigned char dh_test_2048_peer_key[] = {
|
|
||||||
+ 0xD3, 0xAA, 0x26, 0x20, 0x2C, 0x02, 0x38, 0x0A,
|
|
||||||
+ 0x2E, 0x4D, 0xC0, 0x62, 0xCB, 0xD8, 0x7F, 0xF2,
|
|
||||||
+ 0x54, 0x23, 0xC3, 0x90, 0x33, 0xD8, 0xF7, 0x93,
|
|
||||||
+ 0xAD, 0x5F, 0xDA, 0xE6, 0xA4, 0xAB, 0x29, 0xE1,
|
|
||||||
+ 0x4B, 0x75, 0xE8, 0x3B, 0x4E, 0xC7, 0xB5, 0x43,
|
|
||||||
+ 0xCD, 0xF7, 0xB9, 0x0F, 0x43, 0x68, 0xED, 0xF7,
|
|
||||||
+ 0xD1, 0xFD, 0x13, 0x39, 0xCA, 0x39, 0x35, 0x39,
|
|
||||||
+ 0xB4, 0x5A, 0x12, 0x96, 0xC6, 0x85, 0xEC, 0x80,
|
|
||||||
+ 0xC0, 0x0D, 0xBC, 0xC6, 0x59, 0xC0, 0xAD, 0xB6,
|
|
||||||
+ 0xD8, 0x68, 0xD4, 0xE0, 0x2A, 0x8B, 0x21, 0x09,
|
|
||||||
+ 0xC0, 0xDB, 0xD9, 0xBA, 0x63, 0xC0, 0x11, 0x22,
|
|
||||||
+ 0xBB, 0xF2, 0x81, 0x35, 0x5C, 0xE0, 0xCE, 0xBE,
|
|
||||||
+ 0xAB, 0x2E, 0x83, 0x44, 0xCA, 0x05, 0x07, 0xDF,
|
|
||||||
+ 0xAD, 0x1D, 0xAD, 0x12, 0x15, 0xD3, 0x9C, 0x8C,
|
|
||||||
+ 0x92, 0xD3, 0xDE, 0x02, 0x00, 0x7B, 0x30, 0x97,
|
|
||||||
+ 0x07, 0xC0, 0x7C, 0x58, 0xF8, 0x98, 0xAE, 0xB9,
|
|
||||||
+ 0xE8, 0x82, 0x56, 0x0A, 0xEC, 0x4B, 0xF7, 0xEC,
|
|
||||||
+ 0x85, 0xBA, 0xDF, 0xD7, 0xEA, 0x9D, 0x68, 0xAE,
|
|
||||||
+ 0x1A, 0x2C, 0xEC, 0x25, 0x6A, 0x07, 0x2B, 0xFE,
|
|
||||||
+ 0x6D, 0x49, 0xD7, 0x8A, 0x1C, 0x5E, 0xC9, 0xA5,
|
|
||||||
+ 0x2C, 0xF2, 0xB5, 0x8A, 0x14, 0x91, 0x15, 0x6B,
|
|
||||||
+ 0x71, 0x2E, 0x6D, 0x31, 0x1F, 0xC8, 0x61, 0x46,
|
|
||||||
+ 0xF2, 0x0D, 0xCC, 0x10, 0xF7, 0x08, 0x9E, 0xBB,
|
|
||||||
+ 0x66, 0x0D, 0x0D, 0x6D, 0xE7, 0x82, 0x0E, 0x71,
|
|
||||||
+ 0xA4, 0x51, 0xC2, 0x63, 0xA5, 0xDC, 0xFA, 0xF1,
|
|
||||||
+ 0x04, 0xD8, 0xCF, 0x16, 0x9F, 0x7F, 0x73, 0xA2,
|
|
||||||
+ 0x3B, 0xF9, 0x0D, 0xC7, 0xDD, 0x9A, 0x3A, 0x2B,
|
|
||||||
+ 0x0F, 0xB0, 0xB3, 0x97, 0x9D, 0xF1, 0xF0, 0x73,
|
|
||||||
+ 0x7C, 0xFD, 0x76, 0x3A, 0xEB, 0x34, 0xDD, 0x87,
|
|
||||||
+ 0xE6, 0x52, 0x79, 0xDD, 0x53, 0x9A, 0xCB, 0x62,
|
|
||||||
+ 0xE4, 0xF1, 0xB2, 0xCA, 0x6B, 0xD8, 0xC2, 0x69,
|
|
||||||
+ 0xBD, 0xA9, 0xB8, 0xE8, 0x76, 0x88, 0x91, 0x6D
|
|
||||||
};
|
|
||||||
|
|
||||||
-static const unsigned char dh_test_2048_priv_key[] = {
|
|
||||||
- 0x0C, 0x4B, 0x30, 0x89, 0xD1, 0xB8, 0x62, 0xCB, 0x3C, 0x43, 0x64, 0x91,
|
|
||||||
- 0xF0, 0x91, 0x54, 0x70, 0xC5, 0x27, 0x96, 0xE3, 0xAC, 0xBE, 0xE8, 0x00,
|
|
||||||
- 0xEC, 0x55, 0xF6, 0xCC
|
|
||||||
+static const unsigned char dh_test_2048_expected_key[] = {
|
|
||||||
+ 0xB1, 0x26, 0x63, 0xAD, 0xB9, 0x4D, 0x9A, 0x38,
|
|
||||||
+ 0x14, 0x25, 0x16, 0x4D, 0x3A, 0x18, 0x36, 0x10,
|
|
||||||
+ 0xF8, 0xB1, 0x2C, 0x22, 0x4F, 0xD6, 0xA6, 0x2B,
|
|
||||||
+ 0xEB, 0xDF, 0x39, 0xAA, 0x31, 0x8E, 0x44, 0x40,
|
|
||||||
+ 0x09, 0xB6, 0x55, 0x7C, 0x95, 0x6E, 0x1F, 0x00,
|
|
||||||
+ 0x5B, 0xF8, 0x94, 0x1E, 0x5B, 0x69, 0x7A, 0x63,
|
|
||||||
+ 0x38, 0x12, 0x7B, 0xE6, 0xDD, 0x58, 0x08, 0x8E,
|
|
||||||
+ 0x88, 0xF7, 0x82, 0xA5, 0x5D, 0xED, 0x24, 0x10,
|
|
||||||
+ 0x0E, 0x87, 0x2E, 0x9A, 0x3A, 0xF0, 0xDB, 0xA5,
|
|
||||||
+ 0x0E, 0x85, 0xAE, 0xFC, 0xD0, 0x35, 0x30, 0x79,
|
|
||||||
+ 0xFE, 0x84, 0x84, 0xF1, 0x15, 0x14, 0x9C, 0x84,
|
|
||||||
+ 0x72, 0xA6, 0xB3, 0x7C, 0xB7, 0xEF, 0x38, 0xF5,
|
|
||||||
+ 0x2C, 0x90, 0x1B, 0xFC, 0x41, 0x85, 0x0A, 0xDE,
|
|
||||||
+ 0x1B, 0xD3, 0x7E, 0x93, 0xCB, 0x59, 0xE8, 0x7C,
|
|
||||||
+ 0xAB, 0x47, 0x3A, 0x02, 0x22, 0x4F, 0xAC, 0xAD,
|
|
||||||
+ 0xE9, 0x56, 0x32, 0xEB, 0x3D, 0x02, 0x9B, 0x1F,
|
|
||||||
+ 0x7C, 0x70, 0x0F, 0x83, 0xEF, 0x4D, 0x88, 0xE8,
|
|
||||||
+ 0x70, 0x91, 0x34, 0xDD, 0x1C, 0xEF, 0x56, 0x97,
|
|
||||||
+ 0xA3, 0x6E, 0xF6, 0x88, 0xAC, 0xF3, 0xA2, 0xBE,
|
|
||||||
+ 0x30, 0xBD, 0xE0, 0xC0, 0xCD, 0x01, 0x46, 0x5E,
|
|
||||||
+ 0x96, 0xC6, 0x14, 0x44, 0x60, 0xC0, 0x99, 0xFD,
|
|
||||||
+ 0xF0, 0x0A, 0xF6, 0x7D, 0x29, 0xD6, 0x0D, 0xEE,
|
|
||||||
+ 0x10, 0x91, 0x0F, 0x55, 0x71, 0x29, 0xA7, 0x6A,
|
|
||||||
+ 0xEB, 0x18, 0x9B, 0x40, 0xF7, 0x37, 0x50, 0x91,
|
|
||||||
+ 0xBC, 0x16, 0x5D, 0x29, 0x24, 0x63, 0xA2, 0x73,
|
|
||||||
+ 0x0F, 0xA7, 0xA4, 0x0D, 0x00, 0xD4, 0x5F, 0x61,
|
|
||||||
+ 0x74, 0x73, 0x99, 0x14, 0x73, 0xC7, 0x35, 0x2A,
|
|
||||||
+ 0xC0, 0xBA, 0x38, 0x9E, 0x05, 0x09, 0x81, 0xA5,
|
|
||||||
+ 0xDE, 0x8E, 0xB5, 0xE0, 0x77, 0xA7, 0x2F, 0x1A,
|
|
||||||
+ 0x47, 0xD2, 0x68, 0xD4, 0x3E, 0x9A, 0x02, 0xA0,
|
|
||||||
+ 0x5C, 0xC7, 0xFB, 0xE4, 0x2C, 0x7B, 0xC6, 0x26,
|
|
||||||
+ 0x35, 0x92, 0x12, 0x88, 0x62, 0x36, 0x98, 0xFE
|
|
||||||
};
|
|
||||||
|
|
||||||
int FIPS_selftest_dh()
|
|
||||||
{
|
|
||||||
DH *dh = NULL;
|
|
||||||
int ret = 0;
|
|
||||||
- void *pub_key_bin = NULL;
|
|
||||||
+ unsigned char shared_key[sizeof(dh_test_2048_expected_key)];
|
|
||||||
int len;
|
|
||||||
- BIGNUM *p = NULL, *g = NULL, *priv_key = NULL, *tmp_pub_key = NULL;
|
|
||||||
- const BIGNUM *pub_key;
|
|
||||||
+ BIGNUM *priv_key = NULL;
|
|
||||||
+ BIGNUM *pub_key = NULL;
|
|
||||||
+ BIGNUM *peer_key = NULL;
|
|
||||||
|
|
||||||
- fips_load_key_component(p, dh_test_2048);
|
|
||||||
- fips_load_key_component(g, dh_test_2048);
|
|
||||||
- /* note that the private key is much shorter than normally used
|
|
||||||
- * but still g ** priv_key > p
|
|
||||||
- */
|
|
||||||
fips_load_key_component(priv_key, dh_test_2048);
|
|
||||||
- if ((tmp_pub_key = BN_new()) == NULL)
|
|
||||||
- goto err;
|
|
||||||
-
|
|
||||||
- dh = DH_new();
|
|
||||||
+ fips_load_key_component(pub_key, dh_test_2048);
|
|
||||||
+ fips_load_key_component(peer_key, dh_test_2048);
|
|
||||||
|
|
||||||
- if (dh == NULL)
|
|
||||||
+ if ((dh = DH_new_by_nid(NID_ffdhe2048)) == NULL)
|
|
||||||
goto err;
|
|
||||||
|
|
||||||
- DH_set0_pqg(dh, p, NULL, g);
|
|
||||||
- DH_set0_key(dh, tmp_pub_key, priv_key);
|
|
||||||
+ DH_set0_key(dh, pub_key, priv_key);
|
|
||||||
|
|
||||||
- if (DH_generate_key(dh) <= 0)
|
|
||||||
- goto err;
|
|
||||||
-
|
|
||||||
- DH_get0_key(dh, &pub_key, NULL);
|
|
||||||
-
|
|
||||||
- if (pub_key == NULL)
|
|
||||||
- goto err;
|
|
||||||
+ len = DH_compute_key(shared_key, peer_key, dh);
|
|
||||||
|
|
||||||
- len = BN_num_bytes(pub_key);
|
|
||||||
- if ((pub_key_bin = OPENSSL_malloc(len)) == NULL)
|
|
||||||
- goto err;
|
|
||||||
- BN_bn2bin(pub_key, pub_key_bin);
|
|
||||||
-
|
|
||||||
- if (len != sizeof(dh_test_2048_pub_key) ||
|
|
||||||
- memcmp(pub_key_bin, dh_test_2048_pub_key, len) != 0)
|
|
||||||
+ if (len != sizeof(dh_test_2048_expected_key) ||
|
|
||||||
+ memcmp(shared_key, dh_test_2048_expected_key, len) != 0)
|
|
||||||
goto err;
|
|
||||||
|
|
||||||
ret = 1;
|
|
||||||
@@ -168,13 +202,10 @@ int FIPS_selftest_dh()
|
|
||||||
if (dh)
|
|
||||||
DH_free(dh);
|
|
||||||
else {
|
|
||||||
- BN_free(p);
|
|
||||||
- BN_free(g);
|
|
||||||
BN_free(priv_key);
|
|
||||||
- BN_free(tmp_pub_key);
|
|
||||||
+ BN_free(pub_key);
|
|
||||||
}
|
|
||||||
-
|
|
||||||
- OPENSSL_free(pub_key_bin);
|
|
||||||
+ BN_free(peer_key);
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
diff -up openssl-1.1.1g/crypto/objects/obj_dat.h.fips-dh openssl-1.1.1g/crypto/objects/obj_dat.h
|
|
||||||
--- openssl-1.1.1g/crypto/objects/obj_dat.h.fips-dh 2020-07-17 10:36:29.239788392 +0200
|
|
||||||
+++ openssl-1.1.1g/crypto/objects/obj_dat.h 2020-07-17 10:36:29.247788458 +0200
|
|
||||||
@@ -1078,7 +1078,7 @@ static const unsigned char so[7762] = {
|
@@ -1078,7 +1078,7 @@ static const unsigned char so[7762] = {
|
||||||
0x2A,0x86,0x48,0x86,0xF7,0x0D,0x02,0x0D, /* [ 7753] OBJ_hmacWithSHA512_256 */
|
0x2A,0x86,0x48,0x86,0xF7,0x0D,0x02,0x0D, /* [ 7753] OBJ_hmacWithSHA512_256 */
|
||||||
};
|
};
|
||||||
@ -2754,9 +2512,9 @@ diff -up openssl-1.1.1g/crypto/objects/obj_dat.h.fips-dh openssl-1.1.1g/crypto/o
|
|||||||
481, /* "nSRecord" */
|
481, /* "nSRecord" */
|
||||||
173, /* "name" */
|
173, /* "name" */
|
||||||
681, /* "onBasis" */
|
681, /* "onBasis" */
|
||||||
diff -up openssl-1.1.1g/crypto/objects/objects.txt.fips-dh openssl-1.1.1g/crypto/objects/objects.txt
|
diff -up openssl-1.1.1j/crypto/objects/objects.txt.fips-dh openssl-1.1.1j/crypto/objects/objects.txt
|
||||||
--- openssl-1.1.1g/crypto/objects/objects.txt.fips-dh 2020-07-17 10:36:29.239788392 +0200
|
--- openssl-1.1.1j/crypto/objects/objects.txt.fips-dh 2021-03-03 14:23:27.395092350 +0100
|
||||||
+++ openssl-1.1.1g/crypto/objects/objects.txt 2020-07-17 10:36:29.247788458 +0200
|
+++ openssl-1.1.1j/crypto/objects/objects.txt 2021-03-03 14:23:27.406092444 +0100
|
||||||
@@ -1657,6 +1657,13 @@ id-pkinit 5 : pkInit
|
@@ -1657,6 +1657,13 @@ id-pkinit 5 : pkInit
|
||||||
: ffdhe4096
|
: ffdhe4096
|
||||||
: ffdhe6144
|
: ffdhe6144
|
||||||
@ -2771,9 +2529,9 @@ diff -up openssl-1.1.1g/crypto/objects/objects.txt.fips-dh openssl-1.1.1g/crypto
|
|||||||
|
|
||||||
# OIDs for DSTU-4145/DSTU-7564 (http://zakon2.rada.gov.ua/laws/show/z0423-17)
|
# OIDs for DSTU-4145/DSTU-7564 (http://zakon2.rada.gov.ua/laws/show/z0423-17)
|
||||||
|
|
||||||
diff -up openssl-1.1.1g/crypto/objects/obj_mac.num.fips-dh openssl-1.1.1g/crypto/objects/obj_mac.num
|
diff -up openssl-1.1.1j/crypto/objects/obj_mac.num.fips-dh openssl-1.1.1j/crypto/objects/obj_mac.num
|
||||||
--- openssl-1.1.1g/crypto/objects/obj_mac.num.fips-dh 2020-07-17 10:36:29.239788392 +0200
|
--- openssl-1.1.1j/crypto/objects/obj_mac.num.fips-dh 2021-03-03 14:23:27.395092350 +0100
|
||||||
+++ openssl-1.1.1g/crypto/objects/obj_mac.num 2020-07-17 10:36:29.248788466 +0200
|
+++ openssl-1.1.1j/crypto/objects/obj_mac.num 2021-03-03 14:23:27.406092444 +0100
|
||||||
@@ -1196,3 +1196,9 @@ sshkdf 1195
|
@@ -1196,3 +1196,9 @@ sshkdf 1195
|
||||||
kbkdf 1196
|
kbkdf 1196
|
||||||
krb5kdf 1197
|
krb5kdf 1197
|
||||||
@ -2784,9 +2542,9 @@ diff -up openssl-1.1.1g/crypto/objects/obj_mac.num.fips-dh openssl-1.1.1g/crypto
|
|||||||
+modp_4096 1202
|
+modp_4096 1202
|
||||||
+modp_6144 1203
|
+modp_6144 1203
|
||||||
+modp_8192 1204
|
+modp_8192 1204
|
||||||
diff -up openssl-1.1.1g/doc/man3/DH_new_by_nid.pod.fips-dh openssl-1.1.1g/doc/man3/DH_new_by_nid.pod
|
diff -up openssl-1.1.1j/doc/man3/DH_new_by_nid.pod.fips-dh openssl-1.1.1j/doc/man3/DH_new_by_nid.pod
|
||||||
--- openssl-1.1.1g/doc/man3/DH_new_by_nid.pod.fips-dh 2020-04-21 14:22:39.000000000 +0200
|
--- openssl-1.1.1j/doc/man3/DH_new_by_nid.pod.fips-dh 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1g/doc/man3/DH_new_by_nid.pod 2020-07-17 10:36:29.248788466 +0200
|
+++ openssl-1.1.1j/doc/man3/DH_new_by_nid.pod 2021-03-03 14:23:27.406092444 +0100
|
||||||
@@ -8,13 +8,15 @@ DH_new_by_nid, DH_get_nid - get or find
|
@@ -8,13 +8,15 @@ DH_new_by_nid, DH_get_nid - get or find
|
||||||
|
|
||||||
#include <openssl/dh.h>
|
#include <openssl/dh.h>
|
||||||
@ -2805,9 +2563,9 @@ diff -up openssl-1.1.1g/doc/man3/DH_new_by_nid.pod.fips-dh openssl-1.1.1g/doc/ma
|
|||||||
|
|
||||||
DH_get_nid() determines if the parameters contained in B<dh> match
|
DH_get_nid() determines if the parameters contained in B<dh> match
|
||||||
any named set. It returns the NID corresponding to the matching parameters or
|
any named set. It returns the NID corresponding to the matching parameters or
|
||||||
diff -up openssl-1.1.1g/doc/man3/EVP_PKEY_CTX_ctrl.pod.fips-dh openssl-1.1.1g/doc/man3/EVP_PKEY_CTX_ctrl.pod
|
diff -up openssl-1.1.1j/doc/man3/EVP_PKEY_CTX_ctrl.pod.fips-dh openssl-1.1.1j/doc/man3/EVP_PKEY_CTX_ctrl.pod
|
||||||
--- openssl-1.1.1g/doc/man3/EVP_PKEY_CTX_ctrl.pod.fips-dh 2020-04-21 14:22:39.000000000 +0200
|
--- openssl-1.1.1j/doc/man3/EVP_PKEY_CTX_ctrl.pod.fips-dh 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1g/doc/man3/EVP_PKEY_CTX_ctrl.pod 2020-07-17 10:36:29.248788466 +0200
|
+++ openssl-1.1.1j/doc/man3/EVP_PKEY_CTX_ctrl.pod 2021-03-03 14:23:27.406092444 +0100
|
||||||
@@ -294,10 +294,11 @@ The EVP_PKEY_CTX_set_dh_pad() macro sets
|
@@ -294,10 +294,11 @@ The EVP_PKEY_CTX_set_dh_pad() macro sets
|
||||||
If B<pad> is zero (the default) then no padding is performed.
|
If B<pad> is zero (the default) then no padding is performed.
|
||||||
|
|
||||||
@ -2824,9 +2582,9 @@ diff -up openssl-1.1.1g/doc/man3/EVP_PKEY_CTX_ctrl.pod.fips-dh openssl-1.1.1g/do
|
|||||||
The nid parameter and the rfc5114 parameter are mutually exclusive.
|
The nid parameter and the rfc5114 parameter are mutually exclusive.
|
||||||
|
|
||||||
The EVP_PKEY_CTX_set_dh_rfc5114() and EVP_PKEY_CTX_set_dhx_rfc5114() macros are
|
The EVP_PKEY_CTX_set_dh_rfc5114() and EVP_PKEY_CTX_set_dhx_rfc5114() macros are
|
||||||
diff -up openssl-1.1.1g/include/crypto/bn_dh.h.fips-dh openssl-1.1.1g/include/crypto/bn_dh.h
|
diff -up openssl-1.1.1j/include/crypto/bn_dh.h.fips-dh openssl-1.1.1j/include/crypto/bn_dh.h
|
||||||
--- openssl-1.1.1g/include/crypto/bn_dh.h.fips-dh 2020-04-21 14:22:39.000000000 +0200
|
--- openssl-1.1.1j/include/crypto/bn_dh.h.fips-dh 2021-02-16 16:24:01.000000000 +0100
|
||||||
+++ openssl-1.1.1g/include/crypto/bn_dh.h 2020-07-17 10:36:29.248788466 +0200
|
+++ openssl-1.1.1j/include/crypto/bn_dh.h 2021-03-03 14:23:27.406092444 +0100
|
||||||
@@ -1,7 +1,7 @@
|
@@ -1,7 +1,7 @@
|
||||||
/*
|
/*
|
||||||
- * Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
|
- * Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||||
@ -2875,9 +2633,9 @@ diff -up openssl-1.1.1g/include/crypto/bn_dh.h.fips-dh openssl-1.1.1g/include/cr
|
|||||||
+extern const BIGNUM _bignum_modp_4096_q;
|
+extern const BIGNUM _bignum_modp_4096_q;
|
||||||
+extern const BIGNUM _bignum_modp_6144_q;
|
+extern const BIGNUM _bignum_modp_6144_q;
|
||||||
+extern const BIGNUM _bignum_modp_8192_q;
|
+extern const BIGNUM _bignum_modp_8192_q;
|
||||||
diff -up openssl-1.1.1g/include/openssl/obj_mac.h.fips-dh openssl-1.1.1g/include/openssl/obj_mac.h
|
diff -up openssl-1.1.1j/include/openssl/obj_mac.h.fips-dh openssl-1.1.1j/include/openssl/obj_mac.h
|
||||||
--- openssl-1.1.1g/include/openssl/obj_mac.h.fips-dh 2020-07-17 10:36:29.240788400 +0200
|
--- openssl-1.1.1j/include/openssl/obj_mac.h.fips-dh 2021-03-03 14:23:27.396092358 +0100
|
||||||
+++ openssl-1.1.1g/include/openssl/obj_mac.h 2020-07-17 10:36:29.248788466 +0200
|
+++ openssl-1.1.1j/include/openssl/obj_mac.h 2021-03-03 14:23:27.407092453 +0100
|
||||||
@@ -5115,6 +5115,24 @@
|
@@ -5115,6 +5115,24 @@
|
||||||
#define SN_ffdhe8192 "ffdhe8192"
|
#define SN_ffdhe8192 "ffdhe8192"
|
||||||
#define NID_ffdhe8192 1130
|
#define NID_ffdhe8192 1130
|
||||||
@ -2903,10 +2661,10 @@ diff -up openssl-1.1.1g/include/openssl/obj_mac.h.fips-dh openssl-1.1.1g/include
|
|||||||
#define SN_ISO_UA "ISO-UA"
|
#define SN_ISO_UA "ISO-UA"
|
||||||
#define NID_ISO_UA 1150
|
#define NID_ISO_UA 1150
|
||||||
#define OBJ_ISO_UA OBJ_member_body,804L
|
#define OBJ_ISO_UA OBJ_member_body,804L
|
||||||
diff -up openssl-1.1.1g/ssl/s3_lib.c.fips-dh openssl-1.1.1g/ssl/s3_lib.c
|
diff -up openssl-1.1.1j/ssl/s3_lib.c.fips-dh openssl-1.1.1j/ssl/s3_lib.c
|
||||||
--- openssl-1.1.1g/ssl/s3_lib.c.fips-dh 2020-07-17 10:36:29.199788063 +0200
|
--- openssl-1.1.1j/ssl/s3_lib.c.fips-dh 2021-03-03 14:23:27.354091997 +0100
|
||||||
+++ openssl-1.1.1g/ssl/s3_lib.c 2020-07-17 10:36:29.248788466 +0200
|
+++ openssl-1.1.1j/ssl/s3_lib.c 2021-03-03 14:23:27.407092453 +0100
|
||||||
@@ -4858,13 +4858,51 @@ int ssl_derive(SSL *s, EVP_PKEY *privkey
|
@@ -4849,13 +4849,51 @@ int ssl_derive(SSL *s, EVP_PKEY *privkey
|
||||||
EVP_PKEY *ssl_dh_to_pkey(DH *dh)
|
EVP_PKEY *ssl_dh_to_pkey(DH *dh)
|
||||||
{
|
{
|
||||||
EVP_PKEY *ret;
|
EVP_PKEY *ret;
|
||||||
@ -2958,91 +2716,15 @@ diff -up openssl-1.1.1g/ssl/s3_lib.c.fips-dh openssl-1.1.1g/ssl/s3_lib.c
|
|||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
#endif
|
#endif
|
||||||
diff -up openssl-1.1.1g/ssl/t1_lib.c.fips-dh openssl-1.1.1g/ssl/t1_lib.c
|
diff -up openssl-1.1.1j/ssl/t1_lib.c.fips-dh openssl-1.1.1j/ssl/t1_lib.c
|
||||||
--- openssl-1.1.1g/ssl/t1_lib.c.fips-dh 2020-07-17 10:36:29.243788425 +0200
|
--- openssl-1.1.1j/ssl/t1_lib.c.fips-dh 2021-03-03 14:23:27.401092401 +0100
|
||||||
+++ openssl-1.1.1g/ssl/t1_lib.c 2020-07-17 10:36:29.249788474 +0200
|
+++ openssl-1.1.1j/ssl/t1_lib.c 2021-03-03 14:23:27.407092453 +0100
|
||||||
@@ -2511,46 +2511,48 @@ int SSL_check_chain(SSL *s, X509 *x, EVP
|
@@ -2542,7 +2542,7 @@ DH *ssl_get_auto_dh(SSL *s)
|
||||||
#ifndef OPENSSL_NO_DH
|
p = BN_get_rfc3526_prime_4096(NULL);
|
||||||
DH *ssl_get_auto_dh(SSL *s)
|
else if (dh_secbits >= 128)
|
||||||
{
|
p = BN_get_rfc3526_prime_3072(NULL);
|
||||||
+ DH *dhp = NULL;
|
- else if (dh_secbits >= 112)
|
||||||
+ BIGNUM *p = NULL, *g = NULL;
|
|
||||||
int dh_secbits = 80;
|
|
||||||
- if (s->cert->dh_tmp_auto == 2)
|
|
||||||
- return DH_get_1024_160();
|
|
||||||
- if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {
|
|
||||||
- if (s->s3->tmp.new_cipher->strength_bits == 256)
|
|
||||||
- dh_secbits = 128;
|
|
||||||
- else
|
|
||||||
- dh_secbits = 80;
|
|
||||||
- } else {
|
|
||||||
- if (s->s3->tmp.cert == NULL)
|
|
||||||
- return NULL;
|
|
||||||
- dh_secbits = EVP_PKEY_security_bits(s->s3->tmp.cert->privatekey);
|
|
||||||
+ if (s->cert->dh_tmp_auto != 2) {
|
|
||||||
+ if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {
|
|
||||||
+ if (s->s3->tmp.new_cipher->strength_bits == 256)
|
|
||||||
+ dh_secbits = 128;
|
|
||||||
+ else
|
|
||||||
+ dh_secbits = 80;
|
|
||||||
+ } else {
|
|
||||||
+ if (s->s3->tmp.cert == NULL)
|
|
||||||
+ return NULL;
|
|
||||||
+ dh_secbits = EVP_PKEY_security_bits(s->s3->tmp.cert->privatekey);
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
|
|
||||||
- if (dh_secbits >= 128) {
|
|
||||||
- DH *dhp = DH_new();
|
|
||||||
- BIGNUM *p, *g;
|
|
||||||
- if (dhp == NULL)
|
|
||||||
- return NULL;
|
|
||||||
- g = BN_new();
|
|
||||||
- if (g == NULL || !BN_set_word(g, 2)) {
|
|
||||||
- DH_free(dhp);
|
|
||||||
- BN_free(g);
|
|
||||||
- return NULL;
|
|
||||||
- }
|
|
||||||
- if (dh_secbits >= 192)
|
|
||||||
- p = BN_get_rfc3526_prime_8192(NULL);
|
|
||||||
- else
|
|
||||||
- p = BN_get_rfc3526_prime_3072(NULL);
|
|
||||||
- if (p == NULL || !DH_set0_pqg(dhp, p, NULL, g)) {
|
|
||||||
- DH_free(dhp);
|
|
||||||
- BN_free(p);
|
|
||||||
- BN_free(g);
|
|
||||||
- return NULL;
|
|
||||||
- }
|
|
||||||
- return dhp;
|
|
||||||
+ dhp = DH_new();
|
|
||||||
+ if (dhp == NULL)
|
|
||||||
+ return NULL;
|
|
||||||
+ g = BN_new();
|
|
||||||
+ if (g == NULL || !BN_set_word(g, 2)) {
|
|
||||||
+ DH_free(dhp);
|
|
||||||
+ BN_free(g);
|
|
||||||
+ return NULL;
|
|
||||||
+ }
|
|
||||||
+ if (dh_secbits >= 192)
|
|
||||||
+ p = BN_get_rfc3526_prime_8192(NULL);
|
|
||||||
+ else if (dh_secbits >= 152)
|
|
||||||
+ p = BN_get_rfc3526_prime_4096(NULL);
|
|
||||||
+ else if (dh_secbits >= 128)
|
|
||||||
+ p = BN_get_rfc3526_prime_3072(NULL);
|
|
||||||
+ else if (dh_secbits >= 112 || FIPS_mode())
|
+ else if (dh_secbits >= 112 || FIPS_mode())
|
||||||
+ p = BN_get_rfc3526_prime_2048(NULL);
|
p = BN_get_rfc3526_prime_2048(NULL);
|
||||||
+ else
|
else
|
||||||
+ p = BN_get_rfc2409_prime_1024(NULL);
|
p = BN_get_rfc2409_prime_1024(NULL);
|
||||||
+ if (p == NULL || !DH_set0_pqg(dhp, p, NULL, g)) {
|
|
||||||
+ DH_free(dhp);
|
|
||||||
+ BN_free(p);
|
|
||||||
+ BN_free(g);
|
|
||||||
+ return NULL;
|
|
||||||
}
|
|
||||||
- if (dh_secbits >= 112)
|
|
||||||
- return DH_get_2048_224();
|
|
||||||
- return DH_get_1024_160();
|
|
||||||
+ return dhp;
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
|
|
||||||
|
@ -1,6 +1,6 @@
|
|||||||
diff -up openssl-1.1.1e/crypto/fips/fips.c.fips-post-rand openssl-1.1.1e/crypto/fips/fips.c
|
diff -up openssl-1.1.1i/crypto/fips/fips.c.fips-post-rand openssl-1.1.1i/crypto/fips/fips.c
|
||||||
--- openssl-1.1.1e/crypto/fips/fips.c.fips-post-rand 2020-03-17 18:06:16.822418854 +0100
|
--- openssl-1.1.1i/crypto/fips/fips.c.fips-post-rand 2020-12-09 10:26:41.634106328 +0100
|
||||||
+++ openssl-1.1.1e/crypto/fips/fips.c 2020-03-17 18:06:16.861418172 +0100
|
+++ openssl-1.1.1i/crypto/fips/fips.c 2020-12-09 10:26:41.652106475 +0100
|
||||||
@@ -68,6 +68,7 @@
|
@@ -68,6 +68,7 @@
|
||||||
|
|
||||||
# include <openssl/fips.h>
|
# include <openssl/fips.h>
|
||||||
@ -51,10 +51,10 @@ diff -up openssl-1.1.1e/crypto/fips/fips.c.fips-post-rand openssl-1.1.1e/crypto/
|
|||||||
ret = 1;
|
ret = 1;
|
||||||
goto end;
|
goto end;
|
||||||
}
|
}
|
||||||
diff -up openssl-1.1.1e/crypto/rand/drbg_lib.c.fips-post-rand openssl-1.1.1e/crypto/rand/drbg_lib.c
|
diff -up openssl-1.1.1i/crypto/rand/drbg_lib.c.fips-post-rand openssl-1.1.1i/crypto/rand/drbg_lib.c
|
||||||
--- openssl-1.1.1e/crypto/rand/drbg_lib.c.fips-post-rand 2020-03-17 15:31:17.000000000 +0100
|
--- openssl-1.1.1i/crypto/rand/drbg_lib.c.fips-post-rand 2020-12-08 14:20:59.000000000 +0100
|
||||||
+++ openssl-1.1.1e/crypto/rand/drbg_lib.c 2020-03-17 18:07:35.305045521 +0100
|
+++ openssl-1.1.1i/crypto/rand/drbg_lib.c 2020-12-09 10:26:41.652106475 +0100
|
||||||
@@ -1009,6 +1009,20 @@ size_t rand_drbg_seedlen(RAND_DRBG *drbg
|
@@ -1005,6 +1005,20 @@ size_t rand_drbg_seedlen(RAND_DRBG *drbg
|
||||||
return min_entropy > min_entropylen ? min_entropy : min_entropylen;
|
return min_entropy > min_entropylen ? min_entropy : min_entropylen;
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -75,9 +75,9 @@ diff -up openssl-1.1.1e/crypto/rand/drbg_lib.c.fips-post-rand openssl-1.1.1e/cry
|
|||||||
/* Implements the default OpenSSL RAND_add() method */
|
/* Implements the default OpenSSL RAND_add() method */
|
||||||
static int drbg_add(const void *buf, int num, double randomness)
|
static int drbg_add(const void *buf, int num, double randomness)
|
||||||
{
|
{
|
||||||
diff -up openssl-1.1.1e/crypto/rand/rand_unix.c.fips-post-rand openssl-1.1.1e/crypto/rand/rand_unix.c
|
diff -up openssl-1.1.1i/crypto/rand/rand_unix.c.fips-post-rand openssl-1.1.1i/crypto/rand/rand_unix.c
|
||||||
--- openssl-1.1.1e/crypto/rand/rand_unix.c.fips-post-rand 2020-03-17 15:31:17.000000000 +0100
|
--- openssl-1.1.1i/crypto/rand/rand_unix.c.fips-post-rand 2020-12-08 14:20:59.000000000 +0100
|
||||||
+++ openssl-1.1.1e/crypto/rand/rand_unix.c 2020-03-17 18:09:01.503537189 +0100
|
+++ openssl-1.1.1i/crypto/rand/rand_unix.c 2020-12-09 10:36:59.531221903 +0100
|
||||||
@@ -17,10 +17,12 @@
|
@@ -17,10 +17,12 @@
|
||||||
#include <openssl/crypto.h>
|
#include <openssl/crypto.h>
|
||||||
#include "rand_local.h"
|
#include "rand_local.h"
|
||||||
@ -91,7 +91,7 @@ diff -up openssl-1.1.1e/crypto/rand/rand_unix.c.fips-post-rand openssl-1.1.1e/cr
|
|||||||
# ifdef DEVRANDOM_WAIT
|
# ifdef DEVRANDOM_WAIT
|
||||||
# include <sys/shm.h>
|
# include <sys/shm.h>
|
||||||
# include <sys/utsname.h>
|
# include <sys/utsname.h>
|
||||||
@@ -342,7 +344,7 @@ static ssize_t sysctl_random(char *buf,
|
@@ -344,7 +346,7 @@ static ssize_t sysctl_random(char *buf,
|
||||||
* syscall_random(): Try to get random data using a system call
|
* syscall_random(): Try to get random data using a system call
|
||||||
* returns the number of bytes returned in buf, or < 0 on error.
|
* returns the number of bytes returned in buf, or < 0 on error.
|
||||||
*/
|
*/
|
||||||
@ -100,15 +100,15 @@ diff -up openssl-1.1.1e/crypto/rand/rand_unix.c.fips-post-rand openssl-1.1.1e/cr
|
|||||||
{
|
{
|
||||||
/*
|
/*
|
||||||
* Note: 'buflen' equals the size of the buffer which is used by the
|
* Note: 'buflen' equals the size of the buffer which is used by the
|
||||||
@@ -364,6 +366,7 @@ static ssize_t syscall_random(void *buf,
|
@@ -369,6 +371,7 @@ static ssize_t syscall_random(void *buf,
|
||||||
* - Linux since 3.17 with glibc 2.25
|
* Note: Sometimes getentropy() can be provided but not implemented
|
||||||
* - FreeBSD since 12.0 (1200061)
|
* internally. So we need to check errno for ENOSYS
|
||||||
*/
|
*/
|
||||||
+# if 0
|
+# if 0
|
||||||
# if defined(__GNUC__) && __GNUC__>=2 && defined(__ELF__) && !defined(__hpux)
|
# if defined(__GNUC__) && __GNUC__>=2 && defined(__ELF__) && !defined(__hpux)
|
||||||
extern int getentropy(void *buffer, size_t length) __attribute__((weak));
|
extern int getentropy(void *buffer, size_t length) __attribute__((weak));
|
||||||
|
|
||||||
@@ -385,10 +388,10 @@ static ssize_t syscall_random(void *buf,
|
@@ -394,10 +397,10 @@ static ssize_t syscall_random(void *buf,
|
||||||
if (p_getentropy.p != NULL)
|
if (p_getentropy.p != NULL)
|
||||||
return p_getentropy.f(buf, buflen) == 0 ? (ssize_t)buflen : -1;
|
return p_getentropy.f(buf, buflen) == 0 ? (ssize_t)buflen : -1;
|
||||||
# endif
|
# endif
|
||||||
@ -122,7 +122,7 @@ diff -up openssl-1.1.1e/crypto/rand/rand_unix.c.fips-post-rand openssl-1.1.1e/cr
|
|||||||
# elif (defined(__FreeBSD__) || defined(__NetBSD__)) && defined(KERN_ARND)
|
# elif (defined(__FreeBSD__) || defined(__NetBSD__)) && defined(KERN_ARND)
|
||||||
return sysctl_random(buf, buflen);
|
return sysctl_random(buf, buflen);
|
||||||
# else
|
# else
|
||||||
@@ -623,6 +626,9 @@ size_t rand_pool_acquire_entropy(RAND_PO
|
@@ -633,6 +636,9 @@ size_t rand_pool_acquire_entropy(RAND_PO
|
||||||
size_t entropy_available;
|
size_t entropy_available;
|
||||||
|
|
||||||
# if defined(OPENSSL_RAND_SEED_GETRANDOM)
|
# if defined(OPENSSL_RAND_SEED_GETRANDOM)
|
||||||
@ -132,7 +132,7 @@ diff -up openssl-1.1.1e/crypto/rand/rand_unix.c.fips-post-rand openssl-1.1.1e/cr
|
|||||||
{
|
{
|
||||||
size_t bytes_needed;
|
size_t bytes_needed;
|
||||||
unsigned char *buffer;
|
unsigned char *buffer;
|
||||||
@@ -633,7 +639,7 @@ size_t rand_pool_acquire_entropy(RAND_PO
|
@@ -643,7 +649,7 @@ size_t rand_pool_acquire_entropy(RAND_PO
|
||||||
bytes_needed = rand_pool_bytes_needed(pool, 1 /*entropy_factor*/);
|
bytes_needed = rand_pool_bytes_needed(pool, 1 /*entropy_factor*/);
|
||||||
while (bytes_needed != 0 && attempts-- > 0) {
|
while (bytes_needed != 0 && attempts-- > 0) {
|
||||||
buffer = rand_pool_add_begin(pool, bytes_needed);
|
buffer = rand_pool_add_begin(pool, bytes_needed);
|
||||||
@ -141,7 +141,7 @@ diff -up openssl-1.1.1e/crypto/rand/rand_unix.c.fips-post-rand openssl-1.1.1e/cr
|
|||||||
if (bytes > 0) {
|
if (bytes > 0) {
|
||||||
rand_pool_add_end(pool, bytes, 8 * bytes);
|
rand_pool_add_end(pool, bytes, 8 * bytes);
|
||||||
bytes_needed -= bytes;
|
bytes_needed -= bytes;
|
||||||
@@ -668,8 +674,10 @@ size_t rand_pool_acquire_entropy(RAND_PO
|
@@ -678,8 +684,10 @@ size_t rand_pool_acquire_entropy(RAND_PO
|
||||||
int attempts = 3;
|
int attempts = 3;
|
||||||
const int fd = get_random_device(i);
|
const int fd = get_random_device(i);
|
||||||
|
|
||||||
@ -153,7 +153,7 @@ diff -up openssl-1.1.1e/crypto/rand/rand_unix.c.fips-post-rand openssl-1.1.1e/cr
|
|||||||
|
|
||||||
while (bytes_needed != 0 && attempts-- > 0) {
|
while (bytes_needed != 0 && attempts-- > 0) {
|
||||||
buffer = rand_pool_add_begin(pool, bytes_needed);
|
buffer = rand_pool_add_begin(pool, bytes_needed);
|
||||||
@@ -732,7 +740,9 @@ size_t rand_pool_acquire_entropy(RAND_PO
|
@@ -742,7 +750,9 @@ size_t rand_pool_acquire_entropy(RAND_PO
|
||||||
return entropy_available;
|
return entropy_available;
|
||||||
}
|
}
|
||||||
# endif
|
# endif
|
||||||
@ -164,9 +164,9 @@ diff -up openssl-1.1.1e/crypto/rand/rand_unix.c.fips-post-rand openssl-1.1.1e/cr
|
|||||||
return rand_pool_entropy_available(pool);
|
return rand_pool_entropy_available(pool);
|
||||||
# endif
|
# endif
|
||||||
}
|
}
|
||||||
diff -up openssl-1.1.1e/include/crypto/fips.h.fips-post-rand openssl-1.1.1e/include/crypto/fips.h
|
diff -up openssl-1.1.1i/include/crypto/fips.h.fips-post-rand openssl-1.1.1i/include/crypto/fips.h
|
||||||
--- openssl-1.1.1e/include/crypto/fips.h.fips-post-rand 2020-03-17 18:06:16.831418696 +0100
|
--- openssl-1.1.1i/include/crypto/fips.h.fips-post-rand 2020-12-09 10:26:41.639106369 +0100
|
||||||
+++ openssl-1.1.1e/include/crypto/fips.h 2020-03-17 18:06:16.861418172 +0100
|
+++ openssl-1.1.1i/include/crypto/fips.h 2020-12-09 10:26:41.657106516 +0100
|
||||||
@@ -77,6 +77,8 @@ int FIPS_selftest_hmac(void);
|
@@ -77,6 +77,8 @@ int FIPS_selftest_hmac(void);
|
||||||
int FIPS_selftest_drbg(void);
|
int FIPS_selftest_drbg(void);
|
||||||
int FIPS_selftest_cmac(void);
|
int FIPS_selftest_cmac(void);
|
||||||
@ -176,9 +176,9 @@ diff -up openssl-1.1.1e/include/crypto/fips.h.fips-post-rand openssl-1.1.1e/incl
|
|||||||
int fips_pkey_signature_test(EVP_PKEY *pkey,
|
int fips_pkey_signature_test(EVP_PKEY *pkey,
|
||||||
const unsigned char *tbs, int tbslen,
|
const unsigned char *tbs, int tbslen,
|
||||||
const unsigned char *kat,
|
const unsigned char *kat,
|
||||||
diff -up openssl-1.1.1e/include/crypto/rand.h.fips-post-rand openssl-1.1.1e/include/crypto/rand.h
|
diff -up openssl-1.1.1i/include/crypto/rand.h.fips-post-rand openssl-1.1.1i/include/crypto/rand.h
|
||||||
--- openssl-1.1.1e/include/crypto/rand.h.fips-post-rand 2020-03-17 15:31:17.000000000 +0100
|
--- openssl-1.1.1i/include/crypto/rand.h.fips-post-rand 2020-12-08 14:20:59.000000000 +0100
|
||||||
+++ openssl-1.1.1e/include/crypto/rand.h 2020-03-17 18:07:35.303045555 +0100
|
+++ openssl-1.1.1i/include/crypto/rand.h 2020-12-09 10:26:41.657106516 +0100
|
||||||
@@ -24,6 +24,7 @@
|
@@ -24,6 +24,7 @@
|
||||||
typedef struct rand_pool_st RAND_POOL;
|
typedef struct rand_pool_st RAND_POOL;
|
||||||
|
|
||||||
|
File diff suppressed because it is too large
Load Diff
@ -1,14 +0,0 @@
|
|||||||
Do not return failure when setting version bound on fixed protocol
|
|
||||||
version method.
|
|
||||||
diff -up openssl-1.1.1-pre8/ssl/statem/statem_lib.c.ignore-bound openssl-1.1.1-pre8/ssl/statem/statem_lib.c
|
|
||||||
--- openssl-1.1.1-pre8/ssl/statem/statem_lib.c.ignore-bound 2018-06-20 16:48:13.000000000 +0200
|
|
||||||
+++ openssl-1.1.1-pre8/ssl/statem/statem_lib.c 2018-08-13 11:07:52.826304045 +0200
|
|
||||||
@@ -1595,7 +1595,7 @@ int ssl_set_version_bound(int method_ver
|
|
||||||
* methods are not subject to controls that disable individual protocol
|
|
||||||
* versions.
|
|
||||||
*/
|
|
||||||
- return 0;
|
|
||||||
+ return 1;
|
|
||||||
|
|
||||||
case TLS_ANY_VERSION:
|
|
||||||
if (version < SSL3_VERSION || version > TLS_MAX_VERSION)
|
|
@ -1,44 +0,0 @@
|
|||||||
diff -up openssl-1.1.1g/include/openssl/ssl3.h.reneg-no-extms openssl-1.1.1g/include/openssl/ssl3.h
|
|
||||||
--- openssl-1.1.1g/include/openssl/ssl3.h.reneg-no-extms 2020-04-21 14:22:39.000000000 +0200
|
|
||||||
+++ openssl-1.1.1g/include/openssl/ssl3.h 2020-06-05 15:20:22.090682776 +0200
|
|
||||||
@@ -292,6 +292,9 @@ extern "C" {
|
|
||||||
|
|
||||||
# define TLS1_FLAGS_STATELESS 0x0800
|
|
||||||
|
|
||||||
+/* Set if extended master secret extension required on renegotiation */
|
|
||||||
+# define TLS1_FLAGS_REQUIRED_EXTMS 0x1000
|
|
||||||
+
|
|
||||||
# define SSL3_MT_HELLO_REQUEST 0
|
|
||||||
# define SSL3_MT_CLIENT_HELLO 1
|
|
||||||
# define SSL3_MT_SERVER_HELLO 2
|
|
||||||
diff -up openssl-1.1.1g/ssl/statem/extensions.c.reneg-no-extms openssl-1.1.1g/ssl/statem/extensions.c
|
|
||||||
--- openssl-1.1.1g/ssl/statem/extensions.c.reneg-no-extms 2020-04-21 14:22:39.000000000 +0200
|
|
||||||
+++ openssl-1.1.1g/ssl/statem/extensions.c 2020-06-05 15:22:19.677653437 +0200
|
|
||||||
@@ -1168,14 +1168,26 @@ static int init_etm(SSL *s, unsigned int
|
|
||||||
|
|
||||||
static int init_ems(SSL *s, unsigned int context)
|
|
||||||
{
|
|
||||||
- if (!s->server)
|
|
||||||
+ if (s->s3->flags & TLS1_FLAGS_RECEIVED_EXTMS) {
|
|
||||||
s->s3->flags &= ~TLS1_FLAGS_RECEIVED_EXTMS;
|
|
||||||
+ s->s3->flags |= TLS1_FLAGS_REQUIRED_EXTMS;
|
|
||||||
+ }
|
|
||||||
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int final_ems(SSL *s, unsigned int context, int sent)
|
|
||||||
{
|
|
||||||
+ /*
|
|
||||||
+ * Check extended master secret extension is not dropped on
|
|
||||||
+ * renegotiation.
|
|
||||||
+ */
|
|
||||||
+ if (!(s->s3->flags & TLS1_FLAGS_RECEIVED_EXTMS)
|
|
||||||
+ && (s->s3->flags & TLS1_FLAGS_REQUIRED_EXTMS)) {
|
|
||||||
+ SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_FINAL_EMS,
|
|
||||||
+ SSL_R_INCONSISTENT_EXTMS);
|
|
||||||
+ return 0;
|
|
||||||
+ }
|
|
||||||
if (!s->server && s->hit) {
|
|
||||||
/*
|
|
||||||
* Check extended master secret extension is consistent with
|
|
497
SOURCES/openssl-1.1.1-s390x-aes-tests.patch
Normal file
497
SOURCES/openssl-1.1.1-s390x-aes-tests.patch
Normal file
@ -0,0 +1,497 @@
|
|||||||
|
diff -up openssl-1.1.1k/test/evp_extra_test.c.s390x-test-aes openssl-1.1.1k/test/evp_extra_test.c
|
||||||
|
--- openssl-1.1.1k/test/evp_extra_test.c.s390x-test-aes 2021-07-16 17:33:04.663181698 +0200
|
||||||
|
+++ openssl-1.1.1k/test/evp_extra_test.c 2021-07-16 17:49:27.780439742 +0200
|
||||||
|
@@ -320,6 +320,97 @@ static const unsigned char pExampleECPar
|
||||||
|
};
|
||||||
|
#endif
|
||||||
|
|
||||||
|
+static const unsigned char kCFBDefaultKey[] = {
|
||||||
|
+ 0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6, 0xAB, 0xF7, 0x15, 0x88,
|
||||||
|
+ 0x09, 0xCF, 0x4F, 0x3C
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+static const unsigned char kGCMDefaultKey[32] = { 0 };
|
||||||
|
+
|
||||||
|
+static const unsigned char kGCMResetKey[] = {
|
||||||
|
+ 0xfe, 0xff, 0xe9, 0x92, 0x86, 0x65, 0x73, 0x1c, 0x6d, 0x6a, 0x8f, 0x94,
|
||||||
|
+ 0x67, 0x30, 0x83, 0x08, 0xfe, 0xff, 0xe9, 0x92, 0x86, 0x65, 0x73, 0x1c,
|
||||||
|
+ 0x6d, 0x6a, 0x8f, 0x94, 0x67, 0x30, 0x83, 0x08
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+static const unsigned char iCFBIV[] = {
|
||||||
|
+ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B,
|
||||||
|
+ 0x0C, 0x0D, 0x0E, 0x0F
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+static const unsigned char iGCMDefaultIV[12] = { 0 };
|
||||||
|
+
|
||||||
|
+static const unsigned char iGCMResetIV1[] = {
|
||||||
|
+ 0xca, 0xfe, 0xba, 0xbe, 0xfa, 0xce, 0xdb, 0xad
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+static const unsigned char iGCMResetIV2[] = {
|
||||||
|
+ 0xca, 0xfe, 0xba, 0xbe, 0xfa, 0xce, 0xdb, 0xad, 0xde, 0xca, 0xf8, 0x88
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+static const unsigned char cfbPlaintext[] = {
|
||||||
|
+ 0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96, 0xE9, 0x3D, 0x7E, 0x11,
|
||||||
|
+ 0x73, 0x93, 0x17, 0x2A
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+static const unsigned char gcmDefaultPlaintext[16] = { 0 };
|
||||||
|
+
|
||||||
|
+static const unsigned char gcmResetPlaintext[] = {
|
||||||
|
+ 0xd9, 0x31, 0x32, 0x25, 0xf8, 0x84, 0x06, 0xe5, 0xa5, 0x59, 0x09, 0xc5,
|
||||||
|
+ 0xaf, 0xf5, 0x26, 0x9a, 0x86, 0xa7, 0xa9, 0x53, 0x15, 0x34, 0xf7, 0xda,
|
||||||
|
+ 0x2e, 0x4c, 0x30, 0x3d, 0x8a, 0x31, 0x8a, 0x72, 0x1c, 0x3c, 0x0c, 0x95,
|
||||||
|
+ 0x95, 0x68, 0x09, 0x53, 0x2f, 0xcf, 0x0e, 0x24, 0x49, 0xa6, 0xb5, 0x25,
|
||||||
|
+ 0xb1, 0x6a, 0xed, 0xf5, 0xaa, 0x0d, 0xe6, 0x57, 0xba, 0x63, 0x7b, 0x39
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+static const unsigned char cfbCiphertext[] = {
|
||||||
|
+ 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20, 0x33, 0x34, 0x49, 0xF8,
|
||||||
|
+ 0xE8, 0x3C, 0xFB, 0x4A
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+static const unsigned char gcmDefaultCiphertext[] = {
|
||||||
|
+ 0xce, 0xa7, 0x40, 0x3d, 0x4d, 0x60, 0x6b, 0x6e, 0x07, 0x4e, 0xc5, 0xd3,
|
||||||
|
+ 0xba, 0xf3, 0x9d, 0x18
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+static const unsigned char gcmResetCiphertext1[] = {
|
||||||
|
+ 0xc3, 0x76, 0x2d, 0xf1, 0xca, 0x78, 0x7d, 0x32, 0xae, 0x47, 0xc1, 0x3b,
|
||||||
|
+ 0xf1, 0x98, 0x44, 0xcb, 0xaf, 0x1a, 0xe1, 0x4d, 0x0b, 0x97, 0x6a, 0xfa,
|
||||||
|
+ 0xc5, 0x2f, 0xf7, 0xd7, 0x9b, 0xba, 0x9d, 0xe0, 0xfe, 0xb5, 0x82, 0xd3,
|
||||||
|
+ 0x39, 0x34, 0xa4, 0xf0, 0x95, 0x4c, 0xc2, 0x36, 0x3b, 0xc7, 0x3f, 0x78,
|
||||||
|
+ 0x62, 0xac, 0x43, 0x0e, 0x64, 0xab, 0xe4, 0x99, 0xf4, 0x7c, 0x9b, 0x1f
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+static const unsigned char gcmResetCiphertext2[] = {
|
||||||
|
+ 0x52, 0x2d, 0xc1, 0xf0, 0x99, 0x56, 0x7d, 0x07, 0xf4, 0x7f, 0x37, 0xa3,
|
||||||
|
+ 0x2a, 0x84, 0x42, 0x7d, 0x64, 0x3a, 0x8c, 0xdc, 0xbf, 0xe5, 0xc0, 0xc9,
|
||||||
|
+ 0x75, 0x98, 0xa2, 0xbd, 0x25, 0x55, 0xd1, 0xaa, 0x8c, 0xb0, 0x8e, 0x48,
|
||||||
|
+ 0x59, 0x0d, 0xbb, 0x3d, 0xa7, 0xb0, 0x8b, 0x10, 0x56, 0x82, 0x88, 0x38,
|
||||||
|
+ 0xc5, 0xf6, 0x1e, 0x63, 0x93, 0xba, 0x7a, 0x0a, 0xbc, 0xc9, 0xf6, 0x62
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+static const unsigned char gcmAAD[] = {
|
||||||
|
+ 0xfe, 0xed, 0xfa, 0xce, 0xde, 0xad, 0xbe, 0xef, 0xfe, 0xed, 0xfa, 0xce,
|
||||||
|
+ 0xde, 0xad, 0xbe, 0xef, 0xab, 0xad, 0xda, 0xd2
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+static const unsigned char gcmDefaultTag[] = {
|
||||||
|
+ 0xd0, 0xd1, 0xc8, 0xa7, 0x99, 0x99, 0x6b, 0xf0, 0x26, 0x5b, 0x98, 0xb5,
|
||||||
|
+ 0xd4, 0x8a, 0xb9, 0x19
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+static const unsigned char gcmResetTag1[] = {
|
||||||
|
+ 0x3a, 0x33, 0x7d, 0xbf, 0x46, 0xa7, 0x92, 0xc4, 0x5e, 0x45, 0x49, 0x13,
|
||||||
|
+ 0xfe, 0x2e, 0xa8, 0xf2
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+static const unsigned char gcmResetTag2[] = {
|
||||||
|
+ 0x76, 0xfc, 0x6e, 0xce, 0x0f, 0x4e, 0x17, 0x68, 0xcd, 0xdf, 0x88, 0x53,
|
||||||
|
+ 0xbb, 0x2d, 0x55, 0x1b
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+
|
||||||
|
+
|
||||||
|
typedef struct APK_DATA_st {
|
||||||
|
const unsigned char *kder;
|
||||||
|
size_t size;
|
||||||
|
@@ -330,6 +421,385 @@ typedef struct APK_DATA_st {
|
||||||
|
int type; /* 0 for private, 1 for public, 2 for params */
|
||||||
|
} APK_DATA;
|
||||||
|
|
||||||
|
+typedef struct {
|
||||||
|
+ const char *cipher;
|
||||||
|
+ const unsigned char *key;
|
||||||
|
+ const unsigned char *iv;
|
||||||
|
+ const unsigned char *input;
|
||||||
|
+ const unsigned char *expected;
|
||||||
|
+ const unsigned char *tag;
|
||||||
|
+ size_t ivlen; /* 0 if we do not need to set a specific IV len */
|
||||||
|
+ size_t inlen;
|
||||||
|
+ size_t expectedlen;
|
||||||
|
+ size_t taglen;
|
||||||
|
+ int keyfirst;
|
||||||
|
+ int initenc;
|
||||||
|
+ int finalenc;
|
||||||
|
+} EVP_INIT_TEST_st;
|
||||||
|
+
|
||||||
|
+static const EVP_INIT_TEST_st evp_init_tests[] = {
|
||||||
|
+ {
|
||||||
|
+ "aes-128-cfb", kCFBDefaultKey, iCFBIV, cfbPlaintext,
|
||||||
|
+ cfbCiphertext, NULL, 0, sizeof(cfbPlaintext), sizeof(cfbCiphertext),
|
||||||
|
+ 0, 1, 0, 1
|
||||||
|
+ },
|
||||||
|
+ {
|
||||||
|
+ "aes-256-gcm", kGCMDefaultKey, iGCMDefaultIV, gcmDefaultPlaintext,
|
||||||
|
+ gcmDefaultCiphertext, gcmDefaultTag, sizeof(iGCMDefaultIV),
|
||||||
|
+ sizeof(gcmDefaultPlaintext), sizeof(gcmDefaultCiphertext),
|
||||||
|
+ sizeof(gcmDefaultTag), 1, 0, 1
|
||||||
|
+ },
|
||||||
|
+ {
|
||||||
|
+ "aes-128-cfb", kCFBDefaultKey, iCFBIV, cfbPlaintext,
|
||||||
|
+ cfbCiphertext, NULL, 0, sizeof(cfbPlaintext), sizeof(cfbCiphertext),
|
||||||
|
+ 0, 0, 0, 1
|
||||||
|
+ },
|
||||||
|
+ {
|
||||||
|
+ "aes-256-gcm", kGCMDefaultKey, iGCMDefaultIV, gcmDefaultPlaintext,
|
||||||
|
+ gcmDefaultCiphertext, gcmDefaultTag, sizeof(iGCMDefaultIV),
|
||||||
|
+ sizeof(gcmDefaultPlaintext), sizeof(gcmDefaultCiphertext),
|
||||||
|
+ sizeof(gcmDefaultTag), 0, 0, 1
|
||||||
|
+ },
|
||||||
|
+ {
|
||||||
|
+ "aes-128-cfb", kCFBDefaultKey, iCFBIV, cfbCiphertext,
|
||||||
|
+ cfbPlaintext, NULL, 0, sizeof(cfbCiphertext), sizeof(cfbPlaintext),
|
||||||
|
+ 0, 1, 1, 0
|
||||||
|
+ },
|
||||||
|
+ {
|
||||||
|
+ "aes-256-gcm", kGCMDefaultKey, iGCMDefaultIV, gcmDefaultCiphertext,
|
||||||
|
+ gcmDefaultPlaintext, gcmDefaultTag, sizeof(iGCMDefaultIV),
|
||||||
|
+ sizeof(gcmDefaultCiphertext), sizeof(gcmDefaultPlaintext),
|
||||||
|
+ sizeof(gcmDefaultTag), 1, 1, 0
|
||||||
|
+ },
|
||||||
|
+ {
|
||||||
|
+ "aes-128-cfb", kCFBDefaultKey, iCFBIV, cfbCiphertext,
|
||||||
|
+ cfbPlaintext, NULL, 0, sizeof(cfbCiphertext), sizeof(cfbPlaintext),
|
||||||
|
+ 0, 0, 1, 0
|
||||||
|
+ },
|
||||||
|
+ {
|
||||||
|
+ "aes-256-gcm", kGCMDefaultKey, iGCMDefaultIV, gcmDefaultCiphertext,
|
||||||
|
+ gcmDefaultPlaintext, gcmDefaultTag, sizeof(iGCMDefaultIV),
|
||||||
|
+ sizeof(gcmDefaultCiphertext), sizeof(gcmDefaultPlaintext),
|
||||||
|
+ sizeof(gcmDefaultTag), 0, 1, 0
|
||||||
|
+ }
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+static int evp_init_seq_set_iv(EVP_CIPHER_CTX *ctx, const EVP_INIT_TEST_st *t)
|
||||||
|
+{
|
||||||
|
+ int res = 0;
|
||||||
|
+
|
||||||
|
+ if (t->ivlen != 0) {
|
||||||
|
+ if (!TEST_true(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, t->ivlen, NULL)))
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, NULL, t->iv, -1)))
|
||||||
|
+ goto err;
|
||||||
|
+ res = 1;
|
||||||
|
+ err:
|
||||||
|
+ return res;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+/*
|
||||||
|
+ * Test step-wise cipher initialization via EVP_CipherInit_ex where the
|
||||||
|
+ * arguments are given one at a time and a final adjustment to the enc
|
||||||
|
+ * parameter sets the correct operation.
|
||||||
|
+ */
|
||||||
|
+static int test_evp_init_seq(int idx)
|
||||||
|
+{
|
||||||
|
+ int outlen1, outlen2;
|
||||||
|
+ int testresult = 0;
|
||||||
|
+ unsigned char outbuf[1024];
|
||||||
|
+ unsigned char tag[16];
|
||||||
|
+ const EVP_INIT_TEST_st *t = &evp_init_tests[idx];
|
||||||
|
+ EVP_CIPHER_CTX *ctx = NULL;
|
||||||
|
+ const EVP_CIPHER *type = NULL;
|
||||||
|
+ size_t taglen = sizeof(tag);
|
||||||
|
+ char *errmsg = NULL;
|
||||||
|
+
|
||||||
|
+ ctx = EVP_CIPHER_CTX_new();
|
||||||
|
+ if (ctx == NULL) {
|
||||||
|
+ errmsg = "CTX_ALLOC";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_ptr(type = EVP_get_cipherbyname(t->cipher))) {
|
||||||
|
+ errmsg = "GET_CIPHERBYNAME";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_true(EVP_CipherInit_ex(ctx, type, NULL, NULL, NULL, t->initenc))) {
|
||||||
|
+ errmsg = "EMPTY_ENC_INIT";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_true(EVP_CIPHER_CTX_set_padding(ctx, 0))) {
|
||||||
|
+ errmsg = "PADDING";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (t->keyfirst && !TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, t->key, NULL, -1))) {
|
||||||
|
+ errmsg = "KEY_INIT (before iv)";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!evp_init_seq_set_iv(ctx, t)) {
|
||||||
|
+ errmsg = "IV_INIT";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (t->keyfirst == 0 && !TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, t->key, NULL, -1))) {
|
||||||
|
+ errmsg = "KEY_INIT (after iv)";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, NULL, NULL, t->finalenc))) {
|
||||||
|
+ errmsg = "FINAL_ENC_INIT";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen1, t->input, t->inlen))) {
|
||||||
|
+ errmsg = "CIPHER_UPDATE";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (t->finalenc == 0 && t->tag != NULL) {
|
||||||
|
+ /* Set expected tag */
|
||||||
|
+ if (!TEST_true(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
|
||||||
|
+ t->taglen, (void *)t->tag))) {
|
||||||
|
+ errmsg = "SET_TAG";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_true(EVP_CipherFinal_ex(ctx, outbuf + outlen1, &outlen2))) {
|
||||||
|
+ errmsg = "CIPHER_FINAL";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_mem_eq(t->expected, t->expectedlen, outbuf, outlen1 + outlen2)) {
|
||||||
|
+ errmsg = "WRONG_RESULT";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (t->finalenc != 0 && t->tag != NULL) {
|
||||||
|
+ if (!TEST_true(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, taglen, tag))) {
|
||||||
|
+ errmsg = "GET_TAG";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_mem_eq(t->tag, t->taglen, tag, taglen)) {
|
||||||
|
+ errmsg = "TAG_ERROR";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ testresult = 1;
|
||||||
|
+ err:
|
||||||
|
+ if (errmsg != NULL)
|
||||||
|
+ TEST_info("evp_init_test %d: %s", idx, errmsg);
|
||||||
|
+ EVP_CIPHER_CTX_free(ctx);
|
||||||
|
+ return testresult;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+typedef struct {
|
||||||
|
+ const unsigned char *input;
|
||||||
|
+ const unsigned char *expected;
|
||||||
|
+ size_t inlen;
|
||||||
|
+ size_t expectedlen;
|
||||||
|
+ int enc;
|
||||||
|
+} EVP_RESET_TEST_st;
|
||||||
|
+
|
||||||
|
+static const EVP_RESET_TEST_st evp_reset_tests[] = {
|
||||||
|
+ {
|
||||||
|
+ cfbPlaintext, cfbCiphertext,
|
||||||
|
+ sizeof(cfbPlaintext), sizeof(cfbCiphertext), 1
|
||||||
|
+ },
|
||||||
|
+ {
|
||||||
|
+ cfbCiphertext, cfbPlaintext,
|
||||||
|
+ sizeof(cfbCiphertext), sizeof(cfbPlaintext), 0
|
||||||
|
+ }
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+/*
|
||||||
|
+ * Test a reset of a cipher via EVP_CipherInit_ex after the cipher has already
|
||||||
|
+ * been used.
|
||||||
|
+ */
|
||||||
|
+static int test_evp_reset(int idx)
|
||||||
|
+{
|
||||||
|
+ const EVP_RESET_TEST_st *t = &evp_reset_tests[idx];
|
||||||
|
+ int outlen1, outlen2;
|
||||||
|
+ int testresult = 0;
|
||||||
|
+ unsigned char outbuf[1024];
|
||||||
|
+ EVP_CIPHER_CTX *ctx = NULL;
|
||||||
|
+ const EVP_CIPHER *type = NULL;
|
||||||
|
+ char *errmsg = NULL;
|
||||||
|
+
|
||||||
|
+ if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) {
|
||||||
|
+ errmsg = "CTX_ALLOC";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_ptr(type = EVP_get_cipherbyname("aes-128-cfb"))) {
|
||||||
|
+ errmsg = "GET_CIPHERBYNAME";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_true(EVP_CipherInit_ex(ctx, type, NULL, kCFBDefaultKey, iCFBIV, t->enc))) {
|
||||||
|
+ errmsg = "CIPHER_INIT";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_true(EVP_CIPHER_CTX_set_padding(ctx, 0))) {
|
||||||
|
+ errmsg = "PADDING";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen1, t->input, t->inlen))) {
|
||||||
|
+ errmsg = "CIPHER_UPDATE";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_true(EVP_CipherFinal_ex(ctx, outbuf + outlen1, &outlen2))) {
|
||||||
|
+ errmsg = "CIPHER_FINAL";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_mem_eq(t->expected, t->expectedlen, outbuf, outlen1 + outlen2)) {
|
||||||
|
+ errmsg = "WRONG_RESULT";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, NULL, NULL, -1))) {
|
||||||
|
+ errmsg = "CIPHER_REINIT";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen1, t->input, t->inlen))) {
|
||||||
|
+ errmsg = "CIPHER_UPDATE (reinit)";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_true(EVP_CipherFinal_ex(ctx, outbuf + outlen1, &outlen2))) {
|
||||||
|
+ errmsg = "CIPHER_FINAL (reinit)";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_mem_eq(t->expected, t->expectedlen, outbuf, outlen1 + outlen2)) {
|
||||||
|
+ errmsg = "WRONG_RESULT (reinit)";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ testresult = 1;
|
||||||
|
+ err:
|
||||||
|
+ if (errmsg != NULL)
|
||||||
|
+ TEST_info("test_evp_reset %d: %s", idx, errmsg);
|
||||||
|
+ EVP_CIPHER_CTX_free(ctx);
|
||||||
|
+ return testresult;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+typedef struct {
|
||||||
|
+ const unsigned char *iv1;
|
||||||
|
+ const unsigned char *iv2;
|
||||||
|
+ const unsigned char *expected1;
|
||||||
|
+ const unsigned char *expected2;
|
||||||
|
+ const unsigned char *tag1;
|
||||||
|
+ const unsigned char *tag2;
|
||||||
|
+ size_t ivlen1;
|
||||||
|
+ size_t ivlen2;
|
||||||
|
+ size_t expectedlen1;
|
||||||
|
+ size_t expectedlen2;
|
||||||
|
+} TEST_GCM_IV_REINIT_st;
|
||||||
|
+
|
||||||
|
+static const TEST_GCM_IV_REINIT_st gcm_reinit_tests[] = {
|
||||||
|
+ {
|
||||||
|
+ iGCMResetIV1, iGCMResetIV2, gcmResetCiphertext1, gcmResetCiphertext2,
|
||||||
|
+ gcmResetTag1, gcmResetTag2, sizeof(iGCMResetIV1), sizeof(iGCMResetIV2),
|
||||||
|
+ sizeof(gcmResetCiphertext1), sizeof(gcmResetCiphertext2)
|
||||||
|
+ },
|
||||||
|
+ {
|
||||||
|
+ iGCMResetIV2, iGCMResetIV1, gcmResetCiphertext2, gcmResetCiphertext1,
|
||||||
|
+ gcmResetTag2, gcmResetTag1, sizeof(iGCMResetIV2), sizeof(iGCMResetIV1),
|
||||||
|
+ sizeof(gcmResetCiphertext2), sizeof(gcmResetCiphertext1)
|
||||||
|
+ }
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+static int test_gcm_reinit(int idx)
|
||||||
|
+{
|
||||||
|
+ int outlen1, outlen2, outlen3;
|
||||||
|
+ int testresult = 0;
|
||||||
|
+ unsigned char outbuf[1024];
|
||||||
|
+ unsigned char tag[16];
|
||||||
|
+ const TEST_GCM_IV_REINIT_st *t = &gcm_reinit_tests[idx];
|
||||||
|
+ EVP_CIPHER_CTX *ctx = NULL;
|
||||||
|
+ const EVP_CIPHER *type = NULL;
|
||||||
|
+ size_t taglen = sizeof(tag);
|
||||||
|
+ char *errmsg = NULL;
|
||||||
|
+
|
||||||
|
+ if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) {
|
||||||
|
+ errmsg = "CTX_ALLOC";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_ptr(type = EVP_get_cipherbyname("aes-256-gcm"))) {
|
||||||
|
+ errmsg = "GET_CIPHERBYNAME";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_true(EVP_CipherInit_ex(ctx, type, NULL, NULL, NULL, 1))) {
|
||||||
|
+ errmsg = "ENC_INIT";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_true(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, t->ivlen1, NULL))) {
|
||||||
|
+ errmsg = "SET_IVLEN1";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, kGCMResetKey, t->iv1, 1))) {
|
||||||
|
+ errmsg = "SET_IV1";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_true(EVP_CipherUpdate(ctx, NULL, &outlen3, gcmAAD, sizeof(gcmAAD)))) {
|
||||||
|
+ errmsg = "AAD1";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ EVP_CIPHER_CTX_set_padding(ctx, 0);
|
||||||
|
+ if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen1, gcmResetPlaintext,
|
||||||
|
+ sizeof(gcmResetPlaintext)))) {
|
||||||
|
+ errmsg = "CIPHER_UPDATE1";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_true(EVP_CipherFinal_ex(ctx, outbuf + outlen1, &outlen2))) {
|
||||||
|
+ errmsg = "CIPHER_FINAL1";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_mem_eq(t->expected1, t->expectedlen1, outbuf, outlen1 + outlen2)) {
|
||||||
|
+ errmsg = "WRONG_RESULT1";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_true(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, taglen, tag))) {
|
||||||
|
+ errmsg = "GET_TAG1";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_mem_eq(t->tag1, taglen, tag, taglen)) {
|
||||||
|
+ errmsg = "TAG_ERROR1";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ /* Now reinit */
|
||||||
|
+ if (!TEST_true(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, t->ivlen2, NULL))) {
|
||||||
|
+ errmsg = "SET_IVLEN2";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, NULL, t->iv2, -1))) {
|
||||||
|
+ errmsg = "SET_IV2";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_true(EVP_CipherUpdate(ctx, NULL, &outlen3, gcmAAD, sizeof(gcmAAD)))) {
|
||||||
|
+ errmsg = "AAD2";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen1, gcmResetPlaintext,
|
||||||
|
+ sizeof(gcmResetPlaintext)))) {
|
||||||
|
+ errmsg = "CIPHER_UPDATE2";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_true(EVP_CipherFinal_ex(ctx, outbuf + outlen1, &outlen2))) {
|
||||||
|
+ errmsg = "CIPHER_FINAL2";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_mem_eq(t->expected2, t->expectedlen2, outbuf, outlen1 + outlen2)) {
|
||||||
|
+ errmsg = "WRONG_RESULT2";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_true(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, taglen, tag))) {
|
||||||
|
+ errmsg = "GET_TAG2";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (!TEST_mem_eq(t->tag2, taglen, tag, taglen)) {
|
||||||
|
+ errmsg = "TAG_ERROR2";
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ testresult = 1;
|
||||||
|
+ err:
|
||||||
|
+ if (errmsg != NULL)
|
||||||
|
+ TEST_info("evp_init_test %d: %s", idx, errmsg);
|
||||||
|
+ EVP_CIPHER_CTX_free(ctx);
|
||||||
|
+ return testresult;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+
|
||||||
|
+
|
||||||
|
static APK_DATA keydata[] = {
|
||||||
|
{kExampleRSAKeyDER, sizeof(kExampleRSAKeyDER), EVP_PKEY_RSA},
|
||||||
|
{kExampleRSAKeyPKCS8, sizeof(kExampleRSAKeyPKCS8), EVP_PKEY_RSA},
|
||||||
|
@@ -1208,6 +1678,8 @@ int setup_tests(void)
|
||||||
|
#ifndef OPENSSL_NO_DH
|
||||||
|
ADD_TEST(test_EVP_PKEY_set1_DH);
|
||||||
|
#endif
|
||||||
|
-
|
||||||
|
+ ADD_ALL_TESTS(test_evp_init_seq, OSSL_NELEM(evp_init_tests));
|
||||||
|
+ ADD_ALL_TESTS(test_evp_reset, OSSL_NELEM(evp_reset_tests));
|
||||||
|
+ ADD_ALL_TESTS(test_gcm_reinit, OSSL_NELEM(gcm_reinit_tests));
|
||||||
|
return 1;
|
||||||
|
}
|
381
SOURCES/openssl-1.1.1-s390x-aes.patch
Normal file
381
SOURCES/openssl-1.1.1-s390x-aes.patch
Normal file
@ -0,0 +1,381 @@
|
|||||||
|
diff -up openssl-1.1.1k/crypto/evp/e_aes.c.s390x-aes openssl-1.1.1k/crypto/evp/e_aes.c
|
||||||
|
--- openssl-1.1.1k/crypto/evp/e_aes.c.s390x-aes 2021-07-16 11:03:14.362127435 +0200
|
||||||
|
+++ openssl-1.1.1k/crypto/evp/e_aes.c 2021-07-16 15:00:42.531477251 +0200
|
||||||
|
@@ -1168,9 +1168,9 @@ typedef struct {
|
||||||
|
static int s390x_aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
|
||||||
|
const unsigned char *iv, int enc);
|
||||||
|
|
||||||
|
-# define S390X_aes_128_cbc_CAPABLE 1 /* checked by callee */
|
||||||
|
-# define S390X_aes_192_cbc_CAPABLE 1
|
||||||
|
-# define S390X_aes_256_cbc_CAPABLE 1
|
||||||
|
+# define S390X_aes_128_cbc_CAPABLE 0 /* checked by callee */
|
||||||
|
+# define S390X_aes_192_cbc_CAPABLE 0
|
||||||
|
+# define S390X_aes_256_cbc_CAPABLE 0
|
||||||
|
# define S390X_AES_CBC_CTX EVP_AES_KEY
|
||||||
|
|
||||||
|
# define s390x_aes_cbc_init_key aes_init_key
|
||||||
|
@@ -1190,11 +1190,10 @@ static int s390x_aes_ecb_init_key(EVP_CI
|
||||||
|
S390X_AES_ECB_CTX *cctx = EVP_C_DATA(S390X_AES_ECB_CTX, ctx);
|
||||||
|
const int keylen = EVP_CIPHER_CTX_key_length(ctx);
|
||||||
|
|
||||||
|
- cctx->fc = S390X_AES_FC(keylen);
|
||||||
|
- if (!enc)
|
||||||
|
- cctx->fc |= S390X_DECRYPT;
|
||||||
|
+ cctx->fc = S390X_AES_FC(keylen) | (enc ? 0 : S390X_DECRYPT);
|
||||||
|
|
||||||
|
- memcpy(cctx->km.param.k, key, keylen);
|
||||||
|
+ if (key != NULL)
|
||||||
|
+ memcpy(cctx->km.param.k, key, keylen);
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -1222,14 +1221,17 @@ static int s390x_aes_ofb_init_key(EVP_CI
|
||||||
|
const unsigned char *ivec, int enc)
|
||||||
|
{
|
||||||
|
S390X_AES_OFB_CTX *cctx = EVP_C_DATA(S390X_AES_OFB_CTX, ctx);
|
||||||
|
- const unsigned char *iv = EVP_CIPHER_CTX_original_iv(ctx);
|
||||||
|
+ const unsigned char *oiv = EVP_CIPHER_CTX_original_iv(ctx);
|
||||||
|
const int keylen = EVP_CIPHER_CTX_key_length(ctx);
|
||||||
|
const int ivlen = EVP_CIPHER_CTX_iv_length(ctx);
|
||||||
|
|
||||||
|
- memcpy(cctx->kmo.param.cv, iv, ivlen);
|
||||||
|
- memcpy(cctx->kmo.param.k, key, keylen);
|
||||||
|
cctx->fc = S390X_AES_FC(keylen);
|
||||||
|
+
|
||||||
|
+ if (key != NULL)
|
||||||
|
+ memcpy(cctx->kmo.param.k, key, keylen);
|
||||||
|
+
|
||||||
|
cctx->res = 0;
|
||||||
|
+ memcpy(cctx->kmo.param.cv, oiv, ivlen);
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -1287,18 +1289,18 @@ static int s390x_aes_cfb_init_key(EVP_CI
|
||||||
|
const unsigned char *ivec, int enc)
|
||||||
|
{
|
||||||
|
S390X_AES_CFB_CTX *cctx = EVP_C_DATA(S390X_AES_CFB_CTX, ctx);
|
||||||
|
- const unsigned char *iv = EVP_CIPHER_CTX_original_iv(ctx);
|
||||||
|
+ const unsigned char *oiv = EVP_CIPHER_CTX_original_iv(ctx);
|
||||||
|
const int keylen = EVP_CIPHER_CTX_key_length(ctx);
|
||||||
|
const int ivlen = EVP_CIPHER_CTX_iv_length(ctx);
|
||||||
|
|
||||||
|
- cctx->fc = S390X_AES_FC(keylen);
|
||||||
|
- cctx->fc |= 16 << 24; /* 16 bytes cipher feedback */
|
||||||
|
- if (!enc)
|
||||||
|
- cctx->fc |= S390X_DECRYPT;
|
||||||
|
+ cctx->fc = S390X_AES_FC(keylen)| (enc ? 0 : S390X_DECRYPT)
|
||||||
|
+ | (16 << 24); /* 16 bytes cipher feedback */
|
||||||
|
+
|
||||||
|
+ if (key != NULL)
|
||||||
|
+ memcpy(cctx->kmf.param.k, key, keylen);
|
||||||
|
|
||||||
|
cctx->res = 0;
|
||||||
|
- memcpy(cctx->kmf.param.cv, iv, ivlen);
|
||||||
|
- memcpy(cctx->kmf.param.k, key, keylen);
|
||||||
|
+ memcpy(cctx->kmf.param.cv, oiv, ivlen);
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -1360,17 +1362,18 @@ static int s390x_aes_cfb8_init_key(EVP_C
|
||||||
|
const unsigned char *ivec, int enc)
|
||||||
|
{
|
||||||
|
S390X_AES_CFB_CTX *cctx = EVP_C_DATA(S390X_AES_CFB_CTX, ctx);
|
||||||
|
- const unsigned char *iv = EVP_CIPHER_CTX_original_iv(ctx);
|
||||||
|
+ const unsigned char *oiv = EVP_CIPHER_CTX_original_iv(ctx);
|
||||||
|
const int keylen = EVP_CIPHER_CTX_key_length(ctx);
|
||||||
|
const int ivlen = EVP_CIPHER_CTX_iv_length(ctx);
|
||||||
|
|
||||||
|
- cctx->fc = S390X_AES_FC(keylen);
|
||||||
|
- cctx->fc |= 1 << 24; /* 1 byte cipher feedback */
|
||||||
|
- if (!enc)
|
||||||
|
- cctx->fc |= S390X_DECRYPT;
|
||||||
|
+ cctx->fc = S390X_AES_FC(keylen) | (enc ? 0 : S390X_DECRYPT)
|
||||||
|
+ | (1 << 24); /* 1 byte cipher feedback flag */
|
||||||
|
+
|
||||||
|
+ if (key != NULL)
|
||||||
|
+ memcpy(cctx->kmf.param.k, key, keylen);
|
||||||
|
|
||||||
|
- memcpy(cctx->kmf.param.cv, iv, ivlen);
|
||||||
|
- memcpy(cctx->kmf.param.k, key, keylen);
|
||||||
|
+ cctx->res = 0;
|
||||||
|
+ memcpy(cctx->kmf.param.cv, oiv, ivlen);
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -1393,9 +1396,9 @@ static int s390x_aes_cfb8_cipher(EVP_CIP
|
||||||
|
static int s390x_aes_cfb1_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
|
||||||
|
const unsigned char *in, size_t len);
|
||||||
|
|
||||||
|
-# define S390X_aes_128_ctr_CAPABLE 1 /* checked by callee */
|
||||||
|
-# define S390X_aes_192_ctr_CAPABLE 1
|
||||||
|
-# define S390X_aes_256_ctr_CAPABLE 1
|
||||||
|
+# define S390X_aes_128_ctr_CAPABLE 0 /* checked by callee */
|
||||||
|
+# define S390X_aes_192_ctr_CAPABLE 0
|
||||||
|
+# define S390X_aes_256_ctr_CAPABLE 0
|
||||||
|
# define S390X_AES_CTR_CTX EVP_AES_KEY
|
||||||
|
|
||||||
|
# define s390x_aes_ctr_init_key aes_init_key
|
||||||
|
@@ -1563,8 +1566,7 @@ static int s390x_aes_gcm(S390X_AES_GCM_C
|
||||||
|
/*-
|
||||||
|
* Initialize context structure. Code is big-endian.
|
||||||
|
*/
|
||||||
|
-static void s390x_aes_gcm_setiv(S390X_AES_GCM_CTX *ctx,
|
||||||
|
- const unsigned char *iv)
|
||||||
|
+static void s390x_aes_gcm_setiv(S390X_AES_GCM_CTX *ctx)
|
||||||
|
{
|
||||||
|
ctx->kma.param.t.g[0] = 0;
|
||||||
|
ctx->kma.param.t.g[1] = 0;
|
||||||
|
@@ -1575,12 +1577,11 @@ static void s390x_aes_gcm_setiv(S390X_AE
|
||||||
|
ctx->kreslen = 0;
|
||||||
|
|
||||||
|
if (ctx->ivlen == 12) {
|
||||||
|
- memcpy(&ctx->kma.param.j0, iv, ctx->ivlen);
|
||||||
|
+ memcpy(&ctx->kma.param.j0, ctx->iv, ctx->ivlen);
|
||||||
|
ctx->kma.param.j0.w[3] = 1;
|
||||||
|
ctx->kma.param.cv.w = 1;
|
||||||
|
} else {
|
||||||
|
/* ctx->iv has the right size and is already padded. */
|
||||||
|
- memcpy(ctx->iv, iv, ctx->ivlen);
|
||||||
|
s390x_kma(ctx->iv, S390X_gcm_ivpadlen(ctx->ivlen), NULL, 0, NULL,
|
||||||
|
ctx->fc, &ctx->kma.param);
|
||||||
|
ctx->fc |= S390X_KMA_HS;
|
||||||
|
@@ -1694,7 +1695,7 @@ static int s390x_aes_gcm_ctrl(EVP_CIPHER
|
||||||
|
if (gctx->iv_gen == 0 || gctx->key_set == 0)
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
- s390x_aes_gcm_setiv(gctx, gctx->iv);
|
||||||
|
+ s390x_aes_gcm_setiv(gctx);
|
||||||
|
|
||||||
|
if (arg <= 0 || arg > gctx->ivlen)
|
||||||
|
arg = gctx->ivlen;
|
||||||
|
@@ -1714,7 +1715,7 @@ static int s390x_aes_gcm_ctrl(EVP_CIPHER
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
memcpy(gctx->iv + gctx->ivlen - arg, ptr, arg);
|
||||||
|
- s390x_aes_gcm_setiv(gctx, gctx->iv);
|
||||||
|
+ s390x_aes_gcm_setiv(gctx);
|
||||||
|
gctx->iv_set = 1;
|
||||||
|
return 1;
|
||||||
|
|
||||||
|
@@ -1770,43 +1771,35 @@ static int s390x_aes_gcm_ctrl(EVP_CIPHER
|
||||||
|
}
|
||||||
|
|
||||||
|
/*-
|
||||||
|
- * Set key and/or iv. Returns 1 on success. Otherwise 0 is returned.
|
||||||
|
+ * Set key or iv or enc/dec. Returns 1 on success. Otherwise 0 is returned.
|
||||||
|
*/
|
||||||
|
static int s390x_aes_gcm_init_key(EVP_CIPHER_CTX *ctx,
|
||||||
|
const unsigned char *key,
|
||||||
|
const unsigned char *iv, int enc)
|
||||||
|
{
|
||||||
|
S390X_AES_GCM_CTX *gctx = EVP_C_DATA(S390X_AES_GCM_CTX, ctx);
|
||||||
|
- int keylen;
|
||||||
|
+ const int keylen = EVP_CIPHER_CTX_key_length(ctx);
|
||||||
|
|
||||||
|
- if (iv == NULL && key == NULL)
|
||||||
|
- return 1;
|
||||||
|
+ gctx->fc = S390X_AES_FC(keylen) | (enc ? 0 : S390X_DECRYPT);
|
||||||
|
|
||||||
|
if (key != NULL) {
|
||||||
|
- keylen = EVP_CIPHER_CTX_key_length(ctx);
|
||||||
|
+ gctx->fc &= ~S390X_KMA_HS;
|
||||||
|
memcpy(&gctx->kma.param.k, key, keylen);
|
||||||
|
-
|
||||||
|
- gctx->fc = S390X_AES_FC(keylen);
|
||||||
|
- if (!enc)
|
||||||
|
- gctx->fc |= S390X_DECRYPT;
|
||||||
|
-
|
||||||
|
- if (iv == NULL && gctx->iv_set)
|
||||||
|
- iv = gctx->iv;
|
||||||
|
-
|
||||||
|
- if (iv != NULL) {
|
||||||
|
- s390x_aes_gcm_setiv(gctx, iv);
|
||||||
|
- gctx->iv_set = 1;
|
||||||
|
- }
|
||||||
|
gctx->key_set = 1;
|
||||||
|
- } else {
|
||||||
|
- if (gctx->key_set)
|
||||||
|
- s390x_aes_gcm_setiv(gctx, iv);
|
||||||
|
- else
|
||||||
|
- memcpy(gctx->iv, iv, gctx->ivlen);
|
||||||
|
-
|
||||||
|
- gctx->iv_set = 1;
|
||||||
|
+ }
|
||||||
|
+ if (iv != NULL) {
|
||||||
|
+ memcpy(gctx->iv, iv, gctx->ivlen);
|
||||||
|
gctx->iv_gen = 0;
|
||||||
|
+ gctx->iv_set = 1;
|
||||||
|
}
|
||||||
|
+
|
||||||
|
+ if (gctx->key_set && gctx->iv_set)
|
||||||
|
+ s390x_aes_gcm_setiv(gctx);
|
||||||
|
+
|
||||||
|
+ gctx->fc &= ~(S390X_KMA_LPC | S390X_KMA_LAAD);
|
||||||
|
+ gctx->areslen = 0;
|
||||||
|
+ gctx->mreslen = 0;
|
||||||
|
+ gctx->kreslen = 0;
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -1895,7 +1888,6 @@ static int s390x_aes_gcm_cipher(EVP_CIPH
|
||||||
|
/* recall that we already did en-/decrypt gctx->mres
|
||||||
|
* and returned it to caller... */
|
||||||
|
OPENSSL_cleanse(tmp, gctx->mreslen);
|
||||||
|
- gctx->iv_set = 0;
|
||||||
|
|
||||||
|
enc = EVP_CIPHER_CTX_encrypting(ctx);
|
||||||
|
if (enc) {
|
||||||
|
@@ -1929,8 +1921,8 @@ static int s390x_aes_gcm_cleanup(EVP_CIP
|
||||||
|
}
|
||||||
|
|
||||||
|
# define S390X_AES_XTS_CTX EVP_AES_XTS_CTX
|
||||||
|
-# define S390X_aes_128_xts_CAPABLE 1 /* checked by callee */
|
||||||
|
-# define S390X_aes_256_xts_CAPABLE 1
|
||||||
|
+# define S390X_aes_128_xts_CAPABLE 0 /* checked by callee */
|
||||||
|
+# define S390X_aes_256_xts_CAPABLE 0
|
||||||
|
|
||||||
|
# define s390x_aes_xts_init_key aes_xts_init_key
|
||||||
|
static int s390x_aes_xts_init_key(EVP_CIPHER_CTX *ctx,
|
||||||
|
@@ -2134,9 +2126,10 @@ static int s390x_aes_ccm_tls_cipher(EVP_
|
||||||
|
const unsigned char *in, size_t len)
|
||||||
|
{
|
||||||
|
S390X_AES_CCM_CTX *cctx = EVP_C_DATA(S390X_AES_CCM_CTX, ctx);
|
||||||
|
- unsigned char *ivec = EVP_CIPHER_CTX_iv_noconst(ctx);
|
||||||
|
+ const unsigned char *ivec = EVP_CIPHER_CTX_iv(ctx);
|
||||||
|
unsigned char *buf = EVP_CIPHER_CTX_buf_noconst(ctx);
|
||||||
|
const int enc = EVP_CIPHER_CTX_encrypting(ctx);
|
||||||
|
+ unsigned char iv[EVP_MAX_IV_LENGTH];
|
||||||
|
|
||||||
|
if (out != in
|
||||||
|
|| len < (EVP_CCM_TLS_EXPLICIT_IV_LEN + (size_t)cctx->aes.ccm.m))
|
||||||
|
@@ -2152,8 +2145,9 @@ static int s390x_aes_ccm_tls_cipher(EVP_
|
||||||
|
* Get explicit iv (sequence number). We already have fixed iv
|
||||||
|
* (server/client_write_iv) here.
|
||||||
|
*/
|
||||||
|
- memcpy(ivec + EVP_CCM_TLS_FIXED_IV_LEN, in, EVP_CCM_TLS_EXPLICIT_IV_LEN);
|
||||||
|
- s390x_aes_ccm_setiv(cctx, ivec, len);
|
||||||
|
+ memcpy(iv, ivec, sizeof(iv));
|
||||||
|
+ memcpy(iv + EVP_CCM_TLS_FIXED_IV_LEN, in, EVP_CCM_TLS_EXPLICIT_IV_LEN);
|
||||||
|
+ s390x_aes_ccm_setiv(cctx, iv, len);
|
||||||
|
|
||||||
|
/* Process aad (sequence number|type|version|length) */
|
||||||
|
s390x_aes_ccm_aad(cctx, buf, cctx->aes.ccm.tls_aad_len);
|
||||||
|
@@ -2180,42 +2174,34 @@ static int s390x_aes_ccm_tls_cipher(EVP_
|
||||||
|
}
|
||||||
|
|
||||||
|
/*-
|
||||||
|
- * Set key and flag field and/or iv. Returns 1 if successful. Otherwise 0 is
|
||||||
|
- * returned.
|
||||||
|
+ * Set key or iv or enc/dec. Returns 1 if successful.
|
||||||
|
+ * Otherwise 0 is returned.
|
||||||
|
*/
|
||||||
|
static int s390x_aes_ccm_init_key(EVP_CIPHER_CTX *ctx,
|
||||||
|
const unsigned char *key,
|
||||||
|
const unsigned char *iv, int enc)
|
||||||
|
{
|
||||||
|
S390X_AES_CCM_CTX *cctx = EVP_C_DATA(S390X_AES_CCM_CTX, ctx);
|
||||||
|
- unsigned char *ivec;
|
||||||
|
- int keylen;
|
||||||
|
+ const int keylen = EVP_CIPHER_CTX_key_length(ctx);
|
||||||
|
+ unsigned char *ivec = EVP_CIPHER_CTX_iv_noconst(ctx);
|
||||||
|
|
||||||
|
- if (iv == NULL && key == NULL)
|
||||||
|
- return 1;
|
||||||
|
+ cctx->aes.ccm.fc = S390X_AES_FC(keylen);
|
||||||
|
|
||||||
|
if (key != NULL) {
|
||||||
|
- keylen = EVP_CIPHER_CTX_key_length(ctx);
|
||||||
|
- cctx->aes.ccm.fc = S390X_AES_FC(keylen);
|
||||||
|
memcpy(cctx->aes.ccm.kmac_param.k, key, keylen);
|
||||||
|
-
|
||||||
|
- /* Store encoded m and l. */
|
||||||
|
- cctx->aes.ccm.nonce.b[0] = ((cctx->aes.ccm.l - 1) & 0x7)
|
||||||
|
- | (((cctx->aes.ccm.m - 2) >> 1) & 0x7) << 3;
|
||||||
|
- memset(cctx->aes.ccm.nonce.b + 1, 0,
|
||||||
|
- sizeof(cctx->aes.ccm.nonce.b));
|
||||||
|
- cctx->aes.ccm.blocks = 0;
|
||||||
|
-
|
||||||
|
cctx->aes.ccm.key_set = 1;
|
||||||
|
}
|
||||||
|
-
|
||||||
|
if (iv != NULL) {
|
||||||
|
- ivec = EVP_CIPHER_CTX_iv_noconst(ctx);
|
||||||
|
memcpy(ivec, iv, 15 - cctx->aes.ccm.l);
|
||||||
|
-
|
||||||
|
cctx->aes.ccm.iv_set = 1;
|
||||||
|
}
|
||||||
|
+ /* Store encoded m and l. */
|
||||||
|
+ cctx->aes.ccm.nonce.b[0] = ((cctx->aes.ccm.l - 1) & 0x7)
|
||||||
|
+ | (((cctx->aes.ccm.m - 2) >> 1) & 0x7) << 3;
|
||||||
|
+ memset(cctx->aes.ccm.nonce.b + 1, 0, sizeof(cctx->aes.ccm.nonce.b) - 1);
|
||||||
|
|
||||||
|
+ cctx->aes.ccm.blocks = 0;
|
||||||
|
+ cctx->aes.ccm.len_set = 0;
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -2230,8 +2216,9 @@ static int s390x_aes_ccm_cipher(EVP_CIPH
|
||||||
|
{
|
||||||
|
S390X_AES_CCM_CTX *cctx = EVP_C_DATA(S390X_AES_CCM_CTX, ctx);
|
||||||
|
const int enc = EVP_CIPHER_CTX_encrypting(ctx);
|
||||||
|
+ const unsigned char *ivec = EVP_CIPHER_CTX_iv(ctx);
|
||||||
|
+ unsigned char *buf;
|
||||||
|
int rv;
|
||||||
|
- unsigned char *buf, *ivec;
|
||||||
|
|
||||||
|
if (!cctx->aes.ccm.key_set)
|
||||||
|
return -1;
|
||||||
|
@@ -2253,7 +2240,6 @@ static int s390x_aes_ccm_cipher(EVP_CIPH
|
||||||
|
if (out == NULL) {
|
||||||
|
/* Update(): Pass message length. */
|
||||||
|
if (in == NULL) {
|
||||||
|
- ivec = EVP_CIPHER_CTX_iv_noconst(ctx);
|
||||||
|
s390x_aes_ccm_setiv(cctx, ivec, len);
|
||||||
|
|
||||||
|
cctx->aes.ccm.len_set = 1;
|
||||||
|
@@ -2279,7 +2265,6 @@ static int s390x_aes_ccm_cipher(EVP_CIPH
|
||||||
|
* In case message length was not previously set explicitly via
|
||||||
|
* Update(), set it now.
|
||||||
|
*/
|
||||||
|
- ivec = EVP_CIPHER_CTX_iv_noconst(ctx);
|
||||||
|
s390x_aes_ccm_setiv(cctx, ivec, len);
|
||||||
|
|
||||||
|
cctx->aes.ccm.len_set = 1;
|
||||||
|
@@ -2304,9 +2289,6 @@ static int s390x_aes_ccm_cipher(EVP_CIPH
|
||||||
|
if (rv == -1)
|
||||||
|
OPENSSL_cleanse(out, len);
|
||||||
|
|
||||||
|
- cctx->aes.ccm.iv_set = 0;
|
||||||
|
- cctx->aes.ccm.tag_set = 0;
|
||||||
|
- cctx->aes.ccm.len_set = 0;
|
||||||
|
return rv;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
@@ -2414,9 +2396,6 @@ static int s390x_aes_ccm_ctrl(EVP_CIPHER
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
memcpy(ptr, cctx->aes.ccm.kmac_param.icv.b, cctx->aes.ccm.m);
|
||||||
|
- cctx->aes.ccm.tag_set = 0;
|
||||||
|
- cctx->aes.ccm.iv_set = 0;
|
||||||
|
- cctx->aes.ccm.len_set = 0;
|
||||||
|
return 1;
|
||||||
|
|
||||||
|
case EVP_CTRL_COPY:
|
||||||
|
@@ -2453,7 +2432,7 @@ static const EVP_CIPHER s390x_aes_##keyl
|
||||||
|
nid##_##keylen##_##nmode,blocksize, \
|
||||||
|
keylen / 8, \
|
||||||
|
ivlen, \
|
||||||
|
- flags | EVP_CIPH_##MODE##_MODE, \
|
||||||
|
+ flags | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_##MODE##_MODE, \
|
||||||
|
s390x_aes_##mode##_init_key, \
|
||||||
|
s390x_aes_##mode##_cipher, \
|
||||||
|
NULL, \
|
||||||
|
@@ -2490,7 +2469,7 @@ static const EVP_CIPHER s390x_aes_##keyl
|
||||||
|
blocksize, \
|
||||||
|
(EVP_CIPH_##MODE##_MODE == EVP_CIPH_XTS_MODE ? 2 : 1) * keylen / 8, \
|
||||||
|
ivlen, \
|
||||||
|
- flags | EVP_CIPH_##MODE##_MODE, \
|
||||||
|
+ flags | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_##MODE##_MODE, \
|
||||||
|
s390x_aes_##mode##_init_key, \
|
||||||
|
s390x_aes_##mode##_cipher, \
|
||||||
|
s390x_aes_##mode##_cleanup, \
|
108
SOURCES/openssl-1.1.1-servername-cb.patch
Normal file
108
SOURCES/openssl-1.1.1-servername-cb.patch
Normal file
@ -0,0 +1,108 @@
|
|||||||
|
diff -up openssl-1.1.1k/ssl/statem/statem_lib.c.servername-cb openssl-1.1.1k/ssl/statem/statem_lib.c
|
||||||
|
--- openssl-1.1.1k/ssl/statem/statem_lib.c.servername-cb 2021-07-16 16:03:04.200024170 +0200
|
||||||
|
+++ openssl-1.1.1k/ssl/statem/statem_lib.c 2021-07-16 16:08:04.076630415 +0200
|
||||||
|
@@ -1504,8 +1504,8 @@ static int ssl_method_error(const SSL *s
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Only called by servers. Returns 1 if the server has a TLSv1.3 capable
|
||||||
|
- * certificate type, or has PSK or a certificate callback configured, or has
|
||||||
|
- * a servername callback configured. Otherwise returns 0.
|
||||||
|
+ * certificate type, or has PSK or a certificate callback configured. Otherwise
|
||||||
|
+ * returns 0.
|
||||||
|
*/
|
||||||
|
static int is_tls13_capable(const SSL *s)
|
||||||
|
{
|
||||||
|
@@ -1515,17 +1515,6 @@ static int is_tls13_capable(const SSL *s
|
||||||
|
EC_KEY *eckey;
|
||||||
|
#endif
|
||||||
|
|
||||||
|
- if (!ossl_assert(s->ctx != NULL) || !ossl_assert(s->session_ctx != NULL))
|
||||||
|
- return 0;
|
||||||
|
-
|
||||||
|
- /*
|
||||||
|
- * A servername callback can change the available certs, so if a servername
|
||||||
|
- * cb is set then we just assume TLSv1.3 will be ok
|
||||||
|
- */
|
||||||
|
- if (s->ctx->ext.servername_cb != NULL
|
||||||
|
- || s->session_ctx->ext.servername_cb != NULL)
|
||||||
|
- return 1;
|
||||||
|
-
|
||||||
|
#ifndef OPENSSL_NO_PSK
|
||||||
|
if (s->psk_server_callback != NULL)
|
||||||
|
return 1;
|
||||||
|
diff -up openssl-1.1.1k/test/sslapitest.c.servername-cb openssl-1.1.1k/test/sslapitest.c
|
||||||
|
--- openssl-1.1.1k/test/sslapitest.c.servername-cb 2021-07-16 16:08:20.094823046 +0200
|
||||||
|
+++ openssl-1.1.1k/test/sslapitest.c 2021-07-16 16:09:25.708612095 +0200
|
||||||
|
@@ -6658,62 +6658,6 @@ static int test_ssl_dup(void)
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
|
||||||
|
-#ifndef OPENSSL_NO_TLS1_3
|
||||||
|
-/*
|
||||||
|
- * Test that setting an SNI callback works with TLSv1.3. Specifically we check
|
||||||
|
- * that it works even without a certificate configured for the original
|
||||||
|
- * SSL_CTX
|
||||||
|
- */
|
||||||
|
-static int test_sni_tls13(void)
|
||||||
|
-{
|
||||||
|
- SSL_CTX *cctx = NULL, *sctx = NULL, *sctx2 = NULL;
|
||||||
|
- SSL *clientssl = NULL, *serverssl = NULL;
|
||||||
|
- int testresult = 0;
|
||||||
|
-
|
||||||
|
- /* Reset callback counter */
|
||||||
|
- snicb = 0;
|
||||||
|
-
|
||||||
|
- /* Create an initial SSL_CTX with no certificate configured */
|
||||||
|
- sctx = SSL_CTX_new(TLS_server_method());
|
||||||
|
- if (!TEST_ptr(sctx))
|
||||||
|
- goto end;
|
||||||
|
- /* Require TLSv1.3 as a minimum */
|
||||||
|
- if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
|
||||||
|
- TLS1_3_VERSION, 0, &sctx2, &cctx, cert,
|
||||||
|
- privkey)))
|
||||||
|
- goto end;
|
||||||
|
-
|
||||||
|
- /* Set up SNI */
|
||||||
|
- if (!TEST_true(SSL_CTX_set_tlsext_servername_callback(sctx, sni_cb))
|
||||||
|
- || !TEST_true(SSL_CTX_set_tlsext_servername_arg(sctx, sctx2)))
|
||||||
|
- goto end;
|
||||||
|
-
|
||||||
|
- /*
|
||||||
|
- * Connection should still succeed because the final SSL_CTX has the right
|
||||||
|
- * certificates configured.
|
||||||
|
- */
|
||||||
|
- if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
|
||||||
|
- &clientssl, NULL, NULL))
|
||||||
|
- || !TEST_true(create_ssl_connection(serverssl, clientssl,
|
||||||
|
- SSL_ERROR_NONE)))
|
||||||
|
- goto end;
|
||||||
|
-
|
||||||
|
- /* We should have had the SNI callback called exactly once */
|
||||||
|
- if (!TEST_int_eq(snicb, 1))
|
||||||
|
- goto end;
|
||||||
|
-
|
||||||
|
- testresult = 1;
|
||||||
|
-
|
||||||
|
-end:
|
||||||
|
- SSL_free(serverssl);
|
||||||
|
- SSL_free(clientssl);
|
||||||
|
- SSL_CTX_free(sctx2);
|
||||||
|
- SSL_CTX_free(sctx);
|
||||||
|
- SSL_CTX_free(cctx);
|
||||||
|
- return testresult;
|
||||||
|
-}
|
||||||
|
-#endif
|
||||||
|
-
|
||||||
|
int setup_tests(void)
|
||||||
|
{
|
||||||
|
if (!TEST_ptr(certsdir = test_get_argument(0))
|
||||||
|
@@ -6837,9 +6781,6 @@ int setup_tests(void)
|
||||||
|
#ifndef OPENSSL_NO_TLS1_2
|
||||||
|
ADD_TEST(test_ssl_dup);
|
||||||
|
#endif
|
||||||
|
-#ifndef OPENSSL_NO_TLS1_3
|
||||||
|
- ADD_TEST(test_sni_tls13);
|
||||||
|
-#endif
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
43
SOURCES/openssl-1.1.1-tls13-curves.patch
Normal file
43
SOURCES/openssl-1.1.1-tls13-curves.patch
Normal file
@ -0,0 +1,43 @@
|
|||||||
|
diff -up openssl-1.1.1g/ssl/ssl_local.h.tls13-curves openssl-1.1.1g/ssl/ssl_local.h
|
||||||
|
--- openssl-1.1.1g/ssl/ssl_local.h.tls13-curves 2021-04-26 17:11:17.851072025 +0200
|
||||||
|
+++ openssl-1.1.1g/ssl/ssl_local.h 2021-04-26 17:12:11.551756124 +0200
|
||||||
|
@@ -1517,6 +1517,7 @@ typedef struct tls_group_info_st {
|
||||||
|
# define TLS_CURVE_CHAR2 0x1
|
||||||
|
# define TLS_CURVE_CUSTOM 0x2
|
||||||
|
# define TLS_CURVE_FIPS 0x80
|
||||||
|
+# define TLS_CURVE_TLS1_3 0x100
|
||||||
|
|
||||||
|
typedef struct cert_pkey_st CERT_PKEY;
|
||||||
|
|
||||||
|
diff -up openssl-1.1.1g/ssl/t1_lib.c.tls13-curves openssl-1.1.1g/ssl/t1_lib.c
|
||||||
|
--- openssl-1.1.1g/ssl/t1_lib.c.tls13-curves 2021-04-26 17:11:30.237999157 +0200
|
||||||
|
+++ openssl-1.1.1g/ssl/t1_lib.c 2021-04-26 17:13:51.161170191 +0200
|
||||||
|
@@ -161,14 +161,14 @@ static const TLS_GROUP_INFO nid_list[] =
|
||||||
|
{NID_secp224k1, 112, TLS_CURVE_PRIME}, /* secp224k1 (20) */
|
||||||
|
{NID_secp224r1, 112, TLS_CURVE_PRIME | TLS_CURVE_FIPS}, /* secp224r1 (21) */
|
||||||
|
{NID_secp256k1, 128, TLS_CURVE_PRIME}, /* secp256k1 (22) */
|
||||||
|
- {NID_X9_62_prime256v1, 128, TLS_CURVE_PRIME | TLS_CURVE_FIPS}, /* secp256r1 (23) */
|
||||||
|
- {NID_secp384r1, 192, TLS_CURVE_PRIME | TLS_CURVE_FIPS}, /* secp384r1 (24) */
|
||||||
|
- {NID_secp521r1, 256, TLS_CURVE_PRIME | TLS_CURVE_FIPS}, /* secp521r1 (25) */
|
||||||
|
+ {NID_X9_62_prime256v1, 128, TLS_CURVE_PRIME | TLS_CURVE_FIPS | TLS_CURVE_TLS1_3}, /* secp256r1 (23) */
|
||||||
|
+ {NID_secp384r1, 192, TLS_CURVE_PRIME | TLS_CURVE_FIPS | TLS_CURVE_TLS1_3}, /* secp384r1 (24) */
|
||||||
|
+ {NID_secp521r1, 256, TLS_CURVE_PRIME | TLS_CURVE_FIPS | TLS_CURVE_TLS1_3}, /* secp521r1 (25) */
|
||||||
|
{NID_brainpoolP256r1, 128, TLS_CURVE_PRIME}, /* brainpoolP256r1 (26) */
|
||||||
|
{NID_brainpoolP384r1, 192, TLS_CURVE_PRIME}, /* brainpoolP384r1 (27) */
|
||||||
|
{NID_brainpoolP512r1, 256, TLS_CURVE_PRIME}, /* brainpool512r1 (28) */
|
||||||
|
- {EVP_PKEY_X25519, 128, TLS_CURVE_CUSTOM}, /* X25519 (29) */
|
||||||
|
- {EVP_PKEY_X448, 224, TLS_CURVE_CUSTOM}, /* X448 (30) */
|
||||||
|
+ {EVP_PKEY_X25519, 128, TLS_CURVE_CUSTOM | TLS_CURVE_TLS1_3}, /* X25519 (29) */
|
||||||
|
+ {EVP_PKEY_X448, 224, TLS_CURVE_CUSTOM | TLS_CURVE_TLS1_3}, /* X448 (30) */
|
||||||
|
};
|
||||||
|
|
||||||
|
static const unsigned char ecformats_default[] = {
|
||||||
|
@@ -260,6 +260,8 @@ int tls_curve_allowed(SSL *s, uint16_t c
|
||||||
|
# endif
|
||||||
|
if (FIPS_mode() && !(cinfo->flags & TLS_CURVE_FIPS))
|
||||||
|
return 0;
|
||||||
|
+ if (s->version >= TLS1_3_VERSION && !(cinfo->flags & TLS_CURVE_TLS1_3))
|
||||||
|
+ return 0;
|
||||||
|
ctmp[0] = curve >> 8;
|
||||||
|
ctmp[1] = curve & 0xff;
|
||||||
|
return ssl_security(s, op, cinfo->secbits, cinfo->nid, (void *)ctmp);
|
@ -1,8 +1,17 @@
|
|||||||
diff --git a/apps/ts.c b/apps/ts.c
|
diff -up openssl-1.1.1h/apps/openssl.cnf.ts-sha256-default openssl-1.1.1h/apps/openssl.cnf
|
||||||
index 63c5210183..4ef8a72eef 100644
|
--- openssl-1.1.1h/apps/openssl.cnf.ts-sha256-default 2020-11-06 11:07:28.850100899 +0100
|
||||||
--- a/apps/ts.c
|
+++ openssl-1.1.1h/apps/openssl.cnf 2020-11-06 11:11:28.042913791 +0100
|
||||||
+++ b/apps/ts.c
|
@@ -364,5 +348,5 @@ tsa_name = yes # Must the TSA name be i
|
||||||
@@ -425,7 +425,7 @@ static TS_REQ *create_query(BIO *data_bio, const char *digest, const EVP_MD *md,
|
# (optional, default: no)
|
||||||
|
ess_cert_id_chain = no # Must the ESS cert id chain be included?
|
||||||
|
# (optional, default: no)
|
||||||
|
-ess_cert_id_alg = sha1 # algorithm to compute certificate
|
||||||
|
+ess_cert_id_alg = sha256 # algorithm to compute certificate
|
||||||
|
# identifier (optional, default: sha1)
|
||||||
|
diff -up openssl-1.1.1h/apps/ts.c.ts-sha256-default openssl-1.1.1h/apps/ts.c
|
||||||
|
--- openssl-1.1.1h/apps/ts.c.ts-sha256-default 2020-09-22 14:55:07.000000000 +0200
|
||||||
|
+++ openssl-1.1.1h/apps/ts.c 2020-11-06 11:07:28.883101220 +0100
|
||||||
|
@@ -423,7 +423,7 @@ static TS_REQ *create_query(BIO *data_bi
|
||||||
ASN1_OBJECT *policy_obj = NULL;
|
ASN1_OBJECT *policy_obj = NULL;
|
||||||
ASN1_INTEGER *nonce_asn1 = NULL;
|
ASN1_INTEGER *nonce_asn1 = NULL;
|
||||||
|
|
||||||
@ -11,11 +20,22 @@ index 63c5210183..4ef8a72eef 100644
|
|||||||
goto err;
|
goto err;
|
||||||
if ((ts_req = TS_REQ_new()) == NULL)
|
if ((ts_req = TS_REQ_new()) == NULL)
|
||||||
goto err;
|
goto err;
|
||||||
diff --git a/doc/man1/ts.pod b/doc/man1/ts.pod
|
diff -up openssl-1.1.1h/crypto/ts/ts_conf.c.ts-sha256-default openssl-1.1.1h/crypto/ts/ts_conf.c
|
||||||
index 078905a845..83b8fe4350 100644
|
--- openssl-1.1.1h/crypto/ts/ts_conf.c.ts-sha256-default 2020-11-06 12:03:51.226372867 +0100
|
||||||
--- a/doc/man1/ts.pod
|
+++ openssl-1.1.1h/crypto/ts/ts_conf.c 2020-11-06 12:04:01.713488990 +0100
|
||||||
+++ b/doc/man1/ts.pod
|
@@ -476,7 +476,7 @@ int TS_CONF_set_ess_cert_id_digest(CONF
|
||||||
@@ -517,7 +517,7 @@ included. Default is no. (Optional)
|
const char *md = NCONF_get_string(conf, section, ENV_ESS_CERT_ID_ALG);
|
||||||
|
|
||||||
|
if (md == NULL)
|
||||||
|
- md = "sha1";
|
||||||
|
+ md = "sha256";
|
||||||
|
|
||||||
|
cert_md = EVP_get_digestbyname(md);
|
||||||
|
if (cert_md == NULL) {
|
||||||
|
diff -up openssl-1.1.1h/doc/man1/ts.pod.ts-sha256-default openssl-1.1.1h/doc/man1/ts.pod
|
||||||
|
--- openssl-1.1.1h/doc/man1/ts.pod.ts-sha256-default 2020-09-22 14:55:07.000000000 +0200
|
||||||
|
+++ openssl-1.1.1h/doc/man1/ts.pod 2020-11-06 11:07:28.883101220 +0100
|
||||||
|
@@ -518,7 +518,7 @@ included. Default is no. (Optional)
|
||||||
=item B<ess_cert_id_alg>
|
=item B<ess_cert_id_alg>
|
||||||
|
|
||||||
This option specifies the hash function to be used to calculate the TSA's
|
This option specifies the hash function to be used to calculate the TSA's
|
||||||
@ -24,7 +44,7 @@ index 078905a845..83b8fe4350 100644
|
|||||||
|
|
||||||
=back
|
=back
|
||||||
|
|
||||||
@@ -529,7 +529,7 @@ openssl/apps/openssl.cnf will do.
|
@@ -530,7 +530,7 @@ openssl/apps/openssl.cnf will do.
|
||||||
|
|
||||||
=head2 Time Stamp Request
|
=head2 Time Stamp Request
|
||||||
|
|
||||||
@ -33,7 +53,7 @@ index 078905a845..83b8fe4350 100644
|
|||||||
without nonce and policy and no certificate is required in the response:
|
without nonce and policy and no certificate is required in the response:
|
||||||
|
|
||||||
openssl ts -query -data design1.txt -no_nonce \
|
openssl ts -query -data design1.txt -no_nonce \
|
||||||
@@ -545,12 +545,12 @@ To print the content of the previous request in human readable format:
|
@@ -546,12 +546,12 @@ To print the content of the previous req
|
||||||
|
|
||||||
openssl ts -query -in design1.tsq -text
|
openssl ts -query -in design1.tsq -text
|
||||||
|
|
||||||
|
@ -1,12 +1,12 @@
|
|||||||
diff -up openssl-1.1.1g/include/openssl/opensslv.h.version-override openssl-1.1.1g/include/openssl/opensslv.h
|
diff -up openssl-1.1.1i/include/openssl/opensslv.h.version-override openssl-1.1.1i/include/openssl/opensslv.h
|
||||||
--- openssl-1.1.1g/include/openssl/opensslv.h.version-override 2020-04-23 13:29:37.802673513 +0200
|
--- openssl-1.1.1i/include/openssl/opensslv.h.version-override 2020-12-09 10:25:12.042374409 +0100
|
||||||
+++ openssl-1.1.1g/include/openssl/opensslv.h 2020-04-23 13:30:13.064008458 +0200
|
+++ openssl-1.1.1i/include/openssl/opensslv.h 2020-12-09 10:26:00.362769170 +0100
|
||||||
@@ -40,7 +40,7 @@ extern "C" {
|
@@ -40,7 +40,7 @@ extern "C" {
|
||||||
* major minor fix final patch/beta)
|
* major minor fix final patch/beta)
|
||||||
*/
|
*/
|
||||||
# define OPENSSL_VERSION_NUMBER 0x1010107fL
|
# define OPENSSL_VERSION_NUMBER 0x101010bfL
|
||||||
-# define OPENSSL_VERSION_TEXT "OpenSSL 1.1.1g 21 Apr 2020"
|
-# define OPENSSL_VERSION_TEXT "OpenSSL 1.1.1k 25 Mar 2021"
|
||||||
+# define OPENSSL_VERSION_TEXT "OpenSSL 1.1.1g FIPS 21 Apr 2020"
|
+# define OPENSSL_VERSION_TEXT "OpenSSL 1.1.1k FIPS 25 Mar 2021"
|
||||||
|
|
||||||
/*-
|
/*-
|
||||||
* The macros below are to be used for shared library (.so, .dll, ...)
|
* The macros below are to be used for shared library (.so, .dll, ...)
|
||||||
|
@ -21,8 +21,8 @@
|
|||||||
|
|
||||||
Summary: Utilities from the general purpose cryptography library with TLS implementation
|
Summary: Utilities from the general purpose cryptography library with TLS implementation
|
||||||
Name: openssl
|
Name: openssl
|
||||||
Version: 1.1.1g
|
Version: 1.1.1k
|
||||||
Release: 12%{?dist}
|
Release: 4%{?dist}
|
||||||
Epoch: 1
|
Epoch: 1
|
||||||
# We have to remove certain patented algorithms from the openssl source
|
# We have to remove certain patented algorithms from the openssl source
|
||||||
# tarball with the hobble-openssl script which is included below.
|
# tarball with the hobble-openssl script which is included below.
|
||||||
@ -42,8 +42,7 @@ Patch1: openssl-1.1.1-build.patch
|
|||||||
Patch2: openssl-1.1.1-defaults.patch
|
Patch2: openssl-1.1.1-defaults.patch
|
||||||
Patch3: openssl-1.1.1-no-html.patch
|
Patch3: openssl-1.1.1-no-html.patch
|
||||||
Patch4: openssl-1.1.1-man-rename.patch
|
Patch4: openssl-1.1.1-man-rename.patch
|
||||||
# Bug fixes
|
|
||||||
Patch21: openssl-1.1.0-issuer-hash.patch
|
|
||||||
# Functionality changes
|
# Functionality changes
|
||||||
Patch31: openssl-1.1.1-conf-paths.patch
|
Patch31: openssl-1.1.1-conf-paths.patch
|
||||||
Patch32: openssl-1.1.1-version-add-engines.patch
|
Patch32: openssl-1.1.1-version-add-engines.patch
|
||||||
@ -54,7 +53,6 @@ Patch38: openssl-1.1.1-no-weak-verify.patch
|
|||||||
Patch40: openssl-1.1.1-sslv3-keep-abi.patch
|
Patch40: openssl-1.1.1-sslv3-keep-abi.patch
|
||||||
Patch41: openssl-1.1.1-system-cipherlist.patch
|
Patch41: openssl-1.1.1-system-cipherlist.patch
|
||||||
Patch42: openssl-1.1.1-fips.patch
|
Patch42: openssl-1.1.1-fips.patch
|
||||||
Patch43: openssl-1.1.1-ignore-bound.patch
|
|
||||||
Patch44: openssl-1.1.1-version-override.patch
|
Patch44: openssl-1.1.1-version-override.patch
|
||||||
Patch45: openssl-1.1.1-weak-ciphers.patch
|
Patch45: openssl-1.1.1-weak-ciphers.patch
|
||||||
Patch46: openssl-1.1.1-seclevel.patch
|
Patch46: openssl-1.1.1-seclevel.patch
|
||||||
@ -69,16 +67,20 @@ Patch62: openssl-1.1.1-fips-curves.patch
|
|||||||
Patch65: openssl-1.1.1-fips-drbg-selftest.patch
|
Patch65: openssl-1.1.1-fips-drbg-selftest.patch
|
||||||
Patch66: openssl-1.1.1-fips-dh.patch
|
Patch66: openssl-1.1.1-fips-dh.patch
|
||||||
Patch67: openssl-1.1.1-kdf-selftest.patch
|
Patch67: openssl-1.1.1-kdf-selftest.patch
|
||||||
Patch68: openssl-1.1.1-reneg-no-extms.patch
|
|
||||||
Patch69: openssl-1.1.1-alpn-cb.patch
|
Patch69: openssl-1.1.1-alpn-cb.patch
|
||||||
Patch70: openssl-1.1.1-rewire-fips-drbg.patch
|
Patch70: openssl-1.1.1-rewire-fips-drbg.patch
|
||||||
|
Patch76: openssl-1.1.1-cleanup-peer-point-reneg.patch
|
||||||
|
Patch77: openssl-1.1.1-s390x-aes.patch
|
||||||
|
Patch78: openssl-1.1.1-detected-addr-ipv6.patch
|
||||||
|
Patch79: openssl-1.1.1-servername-cb.patch
|
||||||
|
Patch80: openssl-1.1.1-s390x-aes-tests.patch
|
||||||
# Backported fixes including security fixes
|
# Backported fixes including security fixes
|
||||||
Patch52: openssl-1.1.1-s390x-update.patch
|
Patch52: openssl-1.1.1-s390x-update.patch
|
||||||
Patch53: openssl-1.1.1-fips-crng-test.patch
|
Patch53: openssl-1.1.1-fips-crng-test.patch
|
||||||
Patch55: openssl-1.1.1-arm-update.patch
|
Patch55: openssl-1.1.1-arm-update.patch
|
||||||
Patch56: openssl-1.1.1-s390x-ecc.patch
|
Patch56: openssl-1.1.1-s390x-ecc.patch
|
||||||
Patch57: openssl-1.1.1-explicit-params.patch
|
Patch74: openssl-1.1.1-addrconfig.patch
|
||||||
Patch71: openssl-1.1.1-CVE-2020-1971.patch
|
Patch75: openssl-1.1.1-tls13-curves.patch
|
||||||
|
|
||||||
License: OpenSSL and ASL 2.0
|
License: OpenSSL and ASL 2.0
|
||||||
URL: http://www.openssl.org/
|
URL: http://www.openssl.org/
|
||||||
@ -162,8 +164,6 @@ cp %{SOURCE13} test/
|
|||||||
%patch3 -p1 -b .no-html %{?_rawbuild}
|
%patch3 -p1 -b .no-html %{?_rawbuild}
|
||||||
%patch4 -p1 -b .man-rename
|
%patch4 -p1 -b .man-rename
|
||||||
|
|
||||||
%patch21 -p1 -b .issuer-hash
|
|
||||||
|
|
||||||
%patch31 -p1 -b .conf-paths
|
%patch31 -p1 -b .conf-paths
|
||||||
%patch32 -p1 -b .version-add-engines
|
%patch32 -p1 -b .version-add-engines
|
||||||
%patch33 -p1 -b .dgst
|
%patch33 -p1 -b .dgst
|
||||||
@ -173,7 +173,6 @@ cp %{SOURCE13} test/
|
|||||||
%patch40 -p1 -b .sslv3-abi
|
%patch40 -p1 -b .sslv3-abi
|
||||||
%patch41 -p1 -b .system-cipherlist
|
%patch41 -p1 -b .system-cipherlist
|
||||||
%patch42 -p1 -b .fips
|
%patch42 -p1 -b .fips
|
||||||
%patch43 -p1 -b .ignore-bound
|
|
||||||
%patch44 -p1 -b .version-override
|
%patch44 -p1 -b .version-override
|
||||||
%patch45 -p1 -b .weak-ciphers
|
%patch45 -p1 -b .weak-ciphers
|
||||||
%patch46 -p1 -b .seclevel
|
%patch46 -p1 -b .seclevel
|
||||||
@ -192,11 +191,15 @@ cp %{SOURCE13} test/
|
|||||||
%patch65 -p1 -b .drbg-selftest
|
%patch65 -p1 -b .drbg-selftest
|
||||||
%patch66 -p1 -b .fips-dh
|
%patch66 -p1 -b .fips-dh
|
||||||
%patch67 -p1 -b .kdf-selftest
|
%patch67 -p1 -b .kdf-selftest
|
||||||
%patch68 -p1 -b .reneg-no-extms
|
|
||||||
%patch69 -p1 -b .alpn-cb
|
%patch69 -p1 -b .alpn-cb
|
||||||
%patch70 -p1 -b .rewire-fips-drbg
|
%patch70 -p1 -b .rewire-fips-drbg
|
||||||
%patch57 -p1 -b .explicit-params
|
%patch74 -p1 -b .addrconfig
|
||||||
%patch71 -p1 -b .null-dereference
|
%patch75 -p1 -b .tls13-curves
|
||||||
|
%patch76 -p1 -b .cleanup-reneg
|
||||||
|
%patch77 -p1 -b .s390x-aes
|
||||||
|
%patch78 -p1 -b .addr-ipv6
|
||||||
|
%patch79 -p1 -b .servername-cb
|
||||||
|
%patch80 -p1 -b .s390x-test-aes
|
||||||
|
|
||||||
|
|
||||||
%build
|
%build
|
||||||
@ -481,10 +484,47 @@ export LD_LIBRARY_PATH
|
|||||||
%postun libs -p /sbin/ldconfig
|
%postun libs -p /sbin/ldconfig
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
* Fri Dec 4 2020 Sahana Prasad <sahana@redhat.com> 1.1.1g-12
|
* Fri Jul 16 2021 Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-4
|
||||||
|
- Fixes bugs in s390x AES code.
|
||||||
|
- Uses the first detected address family if IPv6 is not available
|
||||||
|
- Reverts the changes in https://github.com/openssl/openssl/pull/13305
|
||||||
|
as it introduces a regression if server has a DSA key pair, the handshake fails
|
||||||
|
when the protocol is not explicitly set to TLS 1.2. However, if the patch is reverted,
|
||||||
|
it has an effect on the "ssl_reject_handshake" feature in nginx. Although, this feature
|
||||||
|
will continue to work, TLS 1.3 protocol becomes unavailable/disabled. This is already
|
||||||
|
known - https://trac.nginx.org/nginx/ticket/2071#comment:1
|
||||||
|
As per https://github.com/openssl/openssl/issues/16075#issuecomment-879939938, nginx
|
||||||
|
could early callback instead of servername callback.
|
||||||
|
- Resolves: rhbz#1978214
|
||||||
|
- Related: rhbz#1934534
|
||||||
|
|
||||||
|
* Thu Jun 24 2021 Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-3
|
||||||
|
- Cleansup the peer point formats on renegotiation
|
||||||
|
- Resolves rhbz#1965362
|
||||||
|
|
||||||
|
* Wed Jun 23 2021 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-2
|
||||||
|
- Fixes FIPS_selftest to work in FIPS mode. Resolves: rhbz#1940085
|
||||||
|
- Using safe primes for FIPS DH self-test
|
||||||
|
|
||||||
|
* Mon May 24 2021 Sahana Prasad <sahana@redhat.com> 1.1.1k-1
|
||||||
|
- Update to version 1.1.1k
|
||||||
|
|
||||||
|
* Mon Apr 26 2021 Daiki Ueno <dueno@redhat.com> 1.1.1g-16
|
||||||
|
- Use AI_ADDRCONFIG only when explicit host name is given
|
||||||
|
- Allow only curves defined in RFC 8446 in TLS 1.3
|
||||||
|
|
||||||
|
* Fri Apr 16 2021 Dmitry Belyavski <dbelyavs@redhat.com> 1.1.1g-15
|
||||||
|
- Remove 2-key 3DES test from FIPS_selftest
|
||||||
|
|
||||||
|
* Mon Mar 29 2021 Sahana Prasad <sahana@redhat.com> 1.1.1g-14
|
||||||
|
- Fix CVE-2021-3450 openssl: CA certificate check bypass with
|
||||||
|
X509_V_FLAG_X509_STRICT
|
||||||
|
- Fix CVE-2021-3449 NULL pointer deref in signature_algorithms processing
|
||||||
|
|
||||||
|
* Fri Dec 4 2020 Sahana Prasad <sahana@redhat.com> 1.1.1g-13
|
||||||
- Fix CVE-2020-1971 ediparty null pointer dereference
|
- Fix CVE-2020-1971 ediparty null pointer dereference
|
||||||
|
|
||||||
* Mon Nov 2 2020 Tomáš Mráz <tmraz@redhat.com> 1.1.1g-11.1
|
* Fri Oct 23 2020 Tomáš Mráz <tmraz@redhat.com> 1.1.1g-12
|
||||||
- Implemented new FIPS requirements in regards to KDF and DH selftests
|
- Implemented new FIPS requirements in regards to KDF and DH selftests
|
||||||
- Disallow certificates with explicit EC parameters
|
- Disallow certificates with explicit EC parameters
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user