Upstream changelog:
Changes between 1.0.1h and 1.0.1i [6 Aug 2014] *) Fix SRP buffer overrun vulnerability. Invalid parameters passed to the SRP code can be overrun an internal buffer. Add sanity check that g, A, B < N to SRP code. Thanks to Sean Devlin and Watson Ladd of Cryptography Services, NCC Group for discovering this issue. (CVE-2014-3512) [Steve Henson] *) A flaw in the OpenSSL SSL/TLS server code causes the server to negotiate TLS 1.0 instead of higher protocol versions when the ClientHello message is badly fragmented. This allows a man-in-the-middle attacker to force a downgrade to TLS 1.0 even if both the server and the client support a higher protocol version, by modifying the client's TLS records. Thanks to David Benjamin and Adam Langley (Google) for discovering and researching this issue. (CVE-2014-3511) [David Benjamin] *) OpenSSL DTLS clients enabling anonymous (EC)DH ciphersuites are subject to a denial of service attack. A malicious server can crash the client with a null pointer dereference (read) by specifying an anonymous (EC)DH ciphersuite and sending carefully crafted handshake messages. Thanks to Felix Gröbert (Google) for discovering and researching this issue. (CVE-2014-3510) [Emilia Käsper] *) By sending carefully crafted DTLS packets an attacker could cause openssl to leak memory. This can be exploited through a Denial of Service attack. Thanks to Adam Langley for discovering and researching this issue. (CVE-2014-3507) [Adam Langley] *) An attacker can force openssl to consume large amounts of memory whilst processing DTLS handshake messages. This can be exploited through a Denial of Service attack. Thanks to Adam Langley for discovering and researching this issue. (CVE-2014-3506) [Adam Langley] *) An attacker can force an error condition which causes openssl to crash whilst processing DTLS packets due to memory being freed twice. This can be exploited through a Denial of Service attack. Thanks to Adam Langley and Wan-Teh Chang for discovering and researching this issue. (CVE-2014-3505) [Adam Langley] *) If a multithreaded client connects to a malicious server using a resumed session and the server sends an ec point format extension it could write up to 255 bytes to freed memory. Thanks to Gabor Tyukasz (LogMeIn Inc) for discovering and researching this issue. (CVE-2014-3509) [Gabor Tyukasz] *) A malicious server can crash an OpenSSL client with a null pointer dereference (read) by specifying an SRP ciphersuite even though it was not properly negotiated with the client. This can be exploited through a Denial of Service attack. Thanks to Joonas Kuorilehto and Riku Hietamäki (Codenomicon) for discovering and researching this issue. (CVE-2014-5139) [Steve Henson] *) A flaw in OBJ_obj2txt may cause pretty printing functions such as X509_name_oneline, X509_name_print_ex et al. to leak some information from the stack. Applications may be affected if they echo pretty printing output to the attacker. Thanks to Ivan Fratric (Google) for discovering this issue. (CVE-2014-3508) [Emilia Käsper, and Steve Henson] *) Fix ec_GFp_simple_points_make_affine (thus, EC_POINTs_mul etc.) for corner cases. (Certain input points at infinity could lead to bogus results, with non-infinity inputs mapped to infinity too.) [Bodo Moeller]
This commit is contained in:
parent
7f1933c65c
commit
0e7489c7c7
|
@ -2,6 +2,92 @@
|
|||
OpenSSL CHANGES
|
||||
_______________
|
||||
|
||||
Changes between 1.0.1h and 1.0.1i [6 Aug 2014]
|
||||
|
||||
*) Fix SRP buffer overrun vulnerability. Invalid parameters passed to the
|
||||
SRP code can be overrun an internal buffer. Add sanity check that
|
||||
g, A, B < N to SRP code.
|
||||
|
||||
Thanks to Sean Devlin and Watson Ladd of Cryptography Services, NCC
|
||||
Group for discovering this issue.
|
||||
(CVE-2014-3512)
|
||||
[Steve Henson]
|
||||
|
||||
*) A flaw in the OpenSSL SSL/TLS server code causes the server to negotiate
|
||||
TLS 1.0 instead of higher protocol versions when the ClientHello message
|
||||
is badly fragmented. This allows a man-in-the-middle attacker to force a
|
||||
downgrade to TLS 1.0 even if both the server and the client support a
|
||||
higher protocol version, by modifying the client's TLS records.
|
||||
|
||||
Thanks to David Benjamin and Adam Langley (Google) for discovering and
|
||||
researching this issue.
|
||||
(CVE-2014-3511)
|
||||
[David Benjamin]
|
||||
|
||||
*) OpenSSL DTLS clients enabling anonymous (EC)DH ciphersuites are subject
|
||||
to a denial of service attack. A malicious server can crash the client
|
||||
with a null pointer dereference (read) by specifying an anonymous (EC)DH
|
||||
ciphersuite and sending carefully crafted handshake messages.
|
||||
|
||||
Thanks to Felix Gröbert (Google) for discovering and researching this
|
||||
issue.
|
||||
(CVE-2014-3510)
|
||||
[Emilia Käsper]
|
||||
|
||||
*) By sending carefully crafted DTLS packets an attacker could cause openssl
|
||||
to leak memory. This can be exploited through a Denial of Service attack.
|
||||
Thanks to Adam Langley for discovering and researching this issue.
|
||||
(CVE-2014-3507)
|
||||
[Adam Langley]
|
||||
|
||||
*) An attacker can force openssl to consume large amounts of memory whilst
|
||||
processing DTLS handshake messages. This can be exploited through a
|
||||
Denial of Service attack.
|
||||
Thanks to Adam Langley for discovering and researching this issue.
|
||||
(CVE-2014-3506)
|
||||
[Adam Langley]
|
||||
|
||||
*) An attacker can force an error condition which causes openssl to crash
|
||||
whilst processing DTLS packets due to memory being freed twice. This
|
||||
can be exploited through a Denial of Service attack.
|
||||
Thanks to Adam Langley and Wan-Teh Chang for discovering and researching
|
||||
this issue.
|
||||
(CVE-2014-3505)
|
||||
[Adam Langley]
|
||||
|
||||
*) If a multithreaded client connects to a malicious server using a resumed
|
||||
session and the server sends an ec point format extension it could write
|
||||
up to 255 bytes to freed memory.
|
||||
|
||||
Thanks to Gabor Tyukasz (LogMeIn Inc) for discovering and researching this
|
||||
issue.
|
||||
(CVE-2014-3509)
|
||||
[Gabor Tyukasz]
|
||||
|
||||
*) A malicious server can crash an OpenSSL client with a null pointer
|
||||
dereference (read) by specifying an SRP ciphersuite even though it was not
|
||||
properly negotiated with the client. This can be exploited through a
|
||||
Denial of Service attack.
|
||||
|
||||
Thanks to Joonas Kuorilehto and Riku Hietamäki (Codenomicon) for
|
||||
discovering and researching this issue.
|
||||
(CVE-2014-5139)
|
||||
[Steve Henson]
|
||||
|
||||
*) A flaw in OBJ_obj2txt may cause pretty printing functions such as
|
||||
X509_name_oneline, X509_name_print_ex et al. to leak some information
|
||||
from the stack. Applications may be affected if they echo pretty printing
|
||||
output to the attacker.
|
||||
|
||||
Thanks to Ivan Fratric (Google) for discovering this issue.
|
||||
(CVE-2014-3508)
|
||||
[Emilia Käsper, and Steve Henson]
|
||||
|
||||
*) Fix ec_GFp_simple_points_make_affine (thus, EC_POINTs_mul etc.)
|
||||
for corner cases. (Certain input points at infinity could lead to
|
||||
bogus results, with non-infinity inputs mapped to infinity too.)
|
||||
[Bodo Moeller]
|
||||
|
||||
Changes between 1.0.1g and 1.0.1h [5 Jun 2014]
|
||||
|
||||
*) Fix for SSL/TLS MITM flaw. An attacker using a carefully crafted
|
||||
|
|
|
@ -720,6 +720,7 @@ my %disabled = ( # "what" => "comment" [or special keyword "experimental
|
|||
"sctp" => "default",
|
||||
"shared" => "default",
|
||||
"store" => "experimental",
|
||||
"unit-test" => "default",
|
||||
"zlib" => "default",
|
||||
"zlib-dynamic" => "default"
|
||||
);
|
||||
|
@ -727,7 +728,7 @@ my @experimental = ();
|
|||
|
||||
# This is what $depflags will look like with the above defaults
|
||||
# (we need this to see if we should advise the user to run "make depend"):
|
||||
my $default_depflags = " -DOPENSSL_NO_EC_NISTP_64_GCC_128 -DOPENSSL_NO_GMP -DOPENSSL_NO_JPAKE -DOPENSSL_NO_MD2 -DOPENSSL_NO_RC5 -DOPENSSL_NO_RFC3779 -DOPENSSL_NO_SCTP -DOPENSSL_NO_STORE";
|
||||
my $default_depflags = " -DOPENSSL_NO_EC_NISTP_64_GCC_128 -DOPENSSL_NO_GMP -DOPENSSL_NO_JPAKE -DOPENSSL_NO_MD2 -DOPENSSL_NO_RC5 -DOPENSSL_NO_RFC3779 -DOPENSSL_NO_SCTP -DOPENSSL_NO_STORE -DOPENSSL_NO_UNIT_TEST";
|
||||
|
||||
# Explicit "no-..." options will be collected in %disabled along with the defaults.
|
||||
# To remove something from %disabled, use "enable-foo" (unless it's experimental).
|
||||
|
|
|
@ -113,11 +113,6 @@ that came with the version of OpenSSL you are using. The pod format
|
|||
documentation is included in each OpenSSL distribution under the docs
|
||||
directory.
|
||||
|
||||
For information on parts of libcrypto that are not yet documented, you
|
||||
might want to read Ariel Glenn's documentation on SSLeay 0.9, OpenSSL's
|
||||
predecessor, at <URL: http://www.columbia.edu/~ariel/ssleay/>. Much
|
||||
of this still applies to OpenSSL.
|
||||
|
||||
There is some documentation about certificate extensions and PKCS#12
|
||||
in doc/openssl.txt
|
||||
|
||||
|
|
|
@ -4,7 +4,7 @@
|
|||
## Makefile for OpenSSL
|
||||
##
|
||||
|
||||
VERSION=1.0.1h
|
||||
VERSION=1.0.1i
|
||||
MAJOR=1
|
||||
MINOR=0.1
|
||||
SHLIB_VERSION_NUMBER=1.0.0
|
||||
|
@ -13,7 +13,7 @@ SHLIB_MAJOR=1
|
|||
SHLIB_MINOR=0.0
|
||||
SHLIB_EXT=
|
||||
PLATFORM=dist
|
||||
OPTIONS= no-ec_nistp_64_gcc_128 no-gmp no-jpake no-krb5 no-md2 no-rc5 no-rfc3779 no-sctp no-shared no-store no-zlib no-zlib-dynamic static-engine
|
||||
OPTIONS= no-ec_nistp_64_gcc_128 no-gmp no-jpake no-krb5 no-md2 no-rc5 no-rfc3779 no-sctp no-shared no-store no-unit-test no-zlib no-zlib-dynamic static-engine
|
||||
CONFIGURE_ARGS=dist
|
||||
SHLIB_TARGET=
|
||||
|
||||
|
@ -61,7 +61,7 @@ OPENSSLDIR=/usr/local/ssl
|
|||
|
||||
CC= cc
|
||||
CFLAG= -O
|
||||
DEPFLAG= -DOPENSSL_NO_EC_NISTP_64_GCC_128 -DOPENSSL_NO_GMP -DOPENSSL_NO_JPAKE -DOPENSSL_NO_MD2 -DOPENSSL_NO_RC5 -DOPENSSL_NO_RFC3779 -DOPENSSL_NO_SCTP -DOPENSSL_NO_STORE
|
||||
DEPFLAG= -DOPENSSL_NO_EC_NISTP_64_GCC_128 -DOPENSSL_NO_GMP -DOPENSSL_NO_JPAKE -DOPENSSL_NO_MD2 -DOPENSSL_NO_RC5 -DOPENSSL_NO_RFC3779 -DOPENSSL_NO_SCTP -DOPENSSL_NO_STORE -DOPENSSL_NO_UNIT_TEST
|
||||
PEX_LIBS=
|
||||
EX_LIBS=
|
||||
EXE_EXT=
|
||||
|
|
|
@ -5,10 +5,23 @@
|
|||
This file gives a brief overview of the major changes between each OpenSSL
|
||||
release. For more details please read the CHANGES file.
|
||||
|
||||
Major changes between OpenSSL 1.0.1h and OpenSSL 1.0.1i [6 Aug 2014]
|
||||
|
||||
o Fix for CVE-2014-3512
|
||||
o Fix for CVE-2014-3511
|
||||
o Fix for CVE-2014-3510
|
||||
o Fix for CVE-2014-3507
|
||||
o Fix for CVE-2014-3506
|
||||
o Fix for CVE-2014-3505
|
||||
o Fix for CVE-2014-3509
|
||||
o Fix for CVE-2014-5139
|
||||
o Fix for CVE-2014-3508
|
||||
|
||||
Major changes between OpenSSL 1.0.1g and OpenSSL 1.0.1h [5 Jun 2014]
|
||||
|
||||
o Fix for CVE-2014-0224
|
||||
o Fix for CVE-2014-0221
|
||||
o Fix for CVE-2014-0198
|
||||
o Fix for CVE-2014-0195
|
||||
o Fix for CVE-2014-3470
|
||||
o Fix for CVE-2010-5298
|
||||
|
|
|
@ -1,5 +1,5 @@
|
|||
|
||||
OpenSSL 1.0.1h 5 Jun 2014
|
||||
OpenSSL 1.0.1i 6 Aug 2014
|
||||
|
||||
Copyright (c) 1998-2011 The OpenSSL Project
|
||||
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
|
||||
|
|
|
@ -390,6 +390,8 @@ int chopup_args(ARGS *arg, char *buf, int *argc, char **argv[])
|
|||
{
|
||||
arg->count=20;
|
||||
arg->data=(char **)OPENSSL_malloc(sizeof(char *)*arg->count);
|
||||
if (arg->data == NULL)
|
||||
return 0;
|
||||
}
|
||||
for (i=0; i<arg->count; i++)
|
||||
arg->data[i]=NULL;
|
||||
|
@ -1542,6 +1544,8 @@ char *make_config_name()
|
|||
|
||||
len=strlen(t)+strlen(OPENSSL_CONF)+2;
|
||||
p=OPENSSL_malloc(len);
|
||||
if (p == NULL)
|
||||
return NULL;
|
||||
BUF_strlcpy(p,t,len);
|
||||
#ifndef OPENSSL_SYS_VMS
|
||||
BUF_strlcat(p,"/",len);
|
||||
|
|
|
@ -1620,12 +1620,14 @@ static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
|
|||
{
|
||||
ok=0;
|
||||
BIO_printf(bio_err,"Signature verification problems....\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto err;
|
||||
}
|
||||
if (i == 0)
|
||||
{
|
||||
ok=0;
|
||||
BIO_printf(bio_err,"Signature did not match the certificate request\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto err;
|
||||
}
|
||||
else
|
||||
|
@ -2777,6 +2779,9 @@ char *make_revocation_str(int rev_type, char *rev_arg)
|
|||
|
||||
revtm = X509_gmtime_adj(NULL, 0);
|
||||
|
||||
if (!revtm)
|
||||
return NULL;
|
||||
|
||||
i = revtm->length + 1;
|
||||
|
||||
if (reason) i += strlen(reason) + 1;
|
||||
|
|
|
@ -96,13 +96,7 @@ int MAIN(int argc, char **argv)
|
|||
char buf[512];
|
||||
BIO *STDout=NULL;
|
||||
|
||||
#if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
|
||||
meth=SSLv23_server_method();
|
||||
#elif !defined(OPENSSL_NO_SSL3)
|
||||
meth=SSLv3_server_method();
|
||||
#elif !defined(OPENSSL_NO_SSL2)
|
||||
meth=SSLv2_server_method();
|
||||
#endif
|
||||
|
||||
apps_startup();
|
||||
|
||||
|
|
|
@ -141,7 +141,13 @@ int MAIN(int argc, char **argv)
|
|||
{
|
||||
if (--argc < 1) goto bad;
|
||||
if(!certflst) certflst = sk_OPENSSL_STRING_new_null();
|
||||
sk_OPENSSL_STRING_push(certflst,*(++argv));
|
||||
if (!certflst)
|
||||
goto end;
|
||||
if (!sk_OPENSSL_STRING_push(certflst,*(++argv)))
|
||||
{
|
||||
sk_OPENSSL_STRING_free(certflst);
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
|
|
|
@ -67,7 +67,9 @@
|
|||
#include <openssl/x509.h>
|
||||
#include <openssl/rand.h>
|
||||
#include <openssl/pem.h>
|
||||
#ifndef OPENSSL_NO_COMP
|
||||
#include <openssl/comp.h>
|
||||
#endif
|
||||
#include <ctype.h>
|
||||
|
||||
int set_hex(char *in,unsigned char *out,int size);
|
||||
|
@ -337,6 +339,12 @@ bad:
|
|||
goto end;
|
||||
}
|
||||
|
||||
if (cipher && (EVP_CIPHER_mode(cipher) == EVP_CIPH_XTS_MODE))
|
||||
{
|
||||
BIO_printf(bio_err, "Ciphers in XTS mode are not supported by the enc utility\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (md && (dgst=EVP_get_digestbyname(md)) == NULL)
|
||||
{
|
||||
BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
|
||||
|
|
|
@ -1419,7 +1419,7 @@ OCSP_RESPONSE *process_responder(BIO *err, OCSP_REQUEST *req,
|
|||
}
|
||||
resp = query_responder(err, cbio, path, headers, req, req_timeout);
|
||||
if (!resp)
|
||||
BIO_printf(bio_err, "Error querying OCSP responsder\n");
|
||||
BIO_printf(bio_err, "Error querying OCSP responder\n");
|
||||
end:
|
||||
if (cbio)
|
||||
BIO_free_all(cbio);
|
||||
|
|
|
@ -107,16 +107,16 @@ FUNCTION functions[] = {
|
|||
{FUNC_TYPE_GENERAL,"gendsa",gendsa_main},
|
||||
#endif
|
||||
{FUNC_TYPE_GENERAL,"genpkey",genpkey_main},
|
||||
#if !defined(OPENSSL_NO_SOCK) && !(defined(OPENSSL_NO_SSL2) && defined(OPENSSL_NO_SSL3))
|
||||
#if !defined(OPENSSL_NO_SOCK)
|
||||
{FUNC_TYPE_GENERAL,"s_server",s_server_main},
|
||||
#endif
|
||||
#if !defined(OPENSSL_NO_SOCK) && !(defined(OPENSSL_NO_SSL2) && defined(OPENSSL_NO_SSL3))
|
||||
#if !defined(OPENSSL_NO_SOCK)
|
||||
{FUNC_TYPE_GENERAL,"s_client",s_client_main},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_SPEED
|
||||
{FUNC_TYPE_GENERAL,"speed",speed_main},
|
||||
#endif
|
||||
#if !defined(OPENSSL_NO_SOCK) && !(defined(OPENSSL_NO_SSL2) && defined(OPENSSL_NO_SSL3))
|
||||
#if !defined(OPENSSL_NO_SOCK)
|
||||
{FUNC_TYPE_GENERAL,"s_time",s_time_main},
|
||||
#endif
|
||||
{FUNC_TYPE_GENERAL,"version",version_main},
|
||||
|
@ -126,7 +126,7 @@ FUNCTION functions[] = {
|
|||
#endif
|
||||
{FUNC_TYPE_GENERAL,"crl2pkcs7",crl2pkcs7_main},
|
||||
{FUNC_TYPE_GENERAL,"sess_id",sess_id_main},
|
||||
#if !defined(OPENSSL_NO_SOCK) && !(defined(OPENSSL_NO_SSL2) && defined(OPENSSL_NO_SSL3))
|
||||
#if !defined(OPENSSL_NO_SOCK)
|
||||
{FUNC_TYPE_GENERAL,"ciphers",ciphers_main},
|
||||
#endif
|
||||
{FUNC_TYPE_GENERAL,"nseq",nseq_main},
|
||||
|
|
|
@ -32,7 +32,7 @@ foreach (@ARGV)
|
|||
push(@files,$_);
|
||||
$str="\t{FUNC_TYPE_GENERAL,\"$_\",${_}_main},\n";
|
||||
if (($_ =~ /^s_/) || ($_ =~ /^ciphers$/))
|
||||
{ print "#if !defined(OPENSSL_NO_SOCK) && !(defined(OPENSSL_NO_SSL2) && defined(OPENSSL_NO_SSL3))\n${str}#endif\n"; }
|
||||
{ print "#if !defined(OPENSSL_NO_SOCK)\n${str}#endif\n"; }
|
||||
elsif ( ($_ =~ /^speed$/))
|
||||
{ print "#ifndef OPENSSL_NO_SPEED\n${str}#endif\n"; }
|
||||
elsif ( ($_ =~ /^engine$/))
|
||||
|
|
|
@ -290,6 +290,7 @@ static void sc_usage(void)
|
|||
BIO_printf(bio_err," -connect host:port - who to connect to (default is %s:%s)\n",SSL_HOST_NAME,PORT_STR);
|
||||
|
||||
BIO_printf(bio_err," -verify arg - turn on peer certificate verification\n");
|
||||
BIO_printf(bio_err," -verify_return_error - return verification errors\n");
|
||||
BIO_printf(bio_err," -cert arg - certificate file to use, PEM format assumed\n");
|
||||
BIO_printf(bio_err," -certform arg - certificate format (PEM or DER) PEM default\n");
|
||||
BIO_printf(bio_err," -key arg - Private key file to use, in cert file if\n");
|
||||
|
@ -300,6 +301,7 @@ static void sc_usage(void)
|
|||
BIO_printf(bio_err," -CAfile arg - PEM format file of CA's\n");
|
||||
BIO_printf(bio_err," -reconnect - Drop and re-make the connection with the same Session-ID\n");
|
||||
BIO_printf(bio_err," -pause - sleep(1) after each read(2) and write(2) system call\n");
|
||||
BIO_printf(bio_err," -prexit - print session information even on connection failure\n");
|
||||
BIO_printf(bio_err," -showcerts - show all certificates in the chain\n");
|
||||
BIO_printf(bio_err," -debug - extra output\n");
|
||||
#ifdef WATT32
|
||||
|
|
|
@ -463,6 +463,7 @@ static void sv_usage(void)
|
|||
BIO_printf(bio_err," -context arg - set session ID context\n");
|
||||
BIO_printf(bio_err," -verify arg - turn on peer certificate verification\n");
|
||||
BIO_printf(bio_err," -Verify arg - turn on peer certificate verification, must have a cert.\n");
|
||||
BIO_printf(bio_err," -verify_return_error - return verification errors\n");
|
||||
BIO_printf(bio_err," -cert arg - certificate file to use\n");
|
||||
BIO_printf(bio_err," (default is %s)\n",TEST_CERT);
|
||||
BIO_printf(bio_err," -crl_check - check the peer certificate has not been revoked by its CA.\n" \
|
||||
|
@ -534,6 +535,7 @@ static void sv_usage(void)
|
|||
BIO_printf(bio_err," -no_ecdhe - Disable ephemeral ECDH\n");
|
||||
#endif
|
||||
BIO_printf(bio_err," -bugs - Turn on SSL bug compatibility\n");
|
||||
BIO_printf(bio_err," -hack - workaround for early Netscape code\n");
|
||||
BIO_printf(bio_err," -www - Respond to a 'GET /' with a status page\n");
|
||||
BIO_printf(bio_err," -WWW - Respond to a 'GET /<path> HTTP/1.0' with file ./<path>\n");
|
||||
BIO_printf(bio_err," -HTTP - Respond to a 'GET /<path> HTTP/1.0' with file ./<path>\n");
|
||||
|
@ -562,6 +564,10 @@ static void sv_usage(void)
|
|||
#endif
|
||||
BIO_printf(bio_err," -keymatexport label - Export keying material using label\n");
|
||||
BIO_printf(bio_err," -keymatexportlen len - Export len bytes of keying material (default 20)\n");
|
||||
BIO_printf(bio_err," -status - respond to certificate status requests\n");
|
||||
BIO_printf(bio_err," -status_verbose - enable status request verbose printout\n");
|
||||
BIO_printf(bio_err," -status_timeout n - status request responder timeout\n");
|
||||
BIO_printf(bio_err," -status_url URL - status request fallback URL\n");
|
||||
}
|
||||
|
||||
static int local_argc=0;
|
||||
|
@ -739,7 +745,7 @@ static int MS_CALLBACK ssl_servername_cb(SSL *s, int *ad, void *arg)
|
|||
|
||||
if (servername)
|
||||
{
|
||||
if (strcmp(servername,p->servername))
|
||||
if (strcasecmp(servername,p->servername))
|
||||
return p->extension_error;
|
||||
if (ctx2)
|
||||
{
|
||||
|
@ -1356,6 +1362,14 @@ bad:
|
|||
sv_usage();
|
||||
goto end;
|
||||
}
|
||||
#ifndef OPENSSL_NO_DTLS1
|
||||
if (www && socket_type == SOCK_DGRAM)
|
||||
{
|
||||
BIO_printf(bio_err,
|
||||
"Can't use -HTTP, -www or -WWW with DTLS\n");
|
||||
goto end;
|
||||
}
|
||||
#endif
|
||||
|
||||
#if !defined(OPENSSL_NO_JPAKE) && !defined(OPENSSL_NO_PSK)
|
||||
if (jpake_secret)
|
||||
|
|
|
@ -283,17 +283,29 @@ err:
|
|||
ASN1err(ASN1_F_D2I_ASN1_OBJECT,i);
|
||||
return(NULL);
|
||||
}
|
||||
|
||||
ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
|
||||
long len)
|
||||
{
|
||||
ASN1_OBJECT *ret=NULL;
|
||||
const unsigned char *p;
|
||||
unsigned char *data;
|
||||
int i;
|
||||
/* Sanity check OID encoding: can't have leading 0x80 in
|
||||
* subidentifiers, see: X.690 8.19.2
|
||||
int i, length;
|
||||
|
||||
/* Sanity check OID encoding.
|
||||
* Need at least one content octet.
|
||||
* MSB must be clear in the last octet.
|
||||
* can't have leading 0x80 in subidentifiers, see: X.690 8.19.2
|
||||
*/
|
||||
for (i = 0, p = *pp; i < len; i++, p++)
|
||||
if (len <= 0 || len > INT_MAX || pp == NULL || (p = *pp) == NULL ||
|
||||
p[len - 1] & 0x80)
|
||||
{
|
||||
ASN1err(ASN1_F_C2I_ASN1_OBJECT,ASN1_R_INVALID_OBJECT_ENCODING);
|
||||
return NULL;
|
||||
}
|
||||
/* Now 0 < len <= INT_MAX, so the cast is safe. */
|
||||
length = (int)len;
|
||||
for (i = 0; i < length; i++, p++)
|
||||
{
|
||||
if (*p == 0x80 && (!i || !(p[-1] & 0x80)))
|
||||
{
|
||||
|
@ -316,23 +328,23 @@ ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
|
|||
data = (unsigned char *)ret->data;
|
||||
ret->data = NULL;
|
||||
/* once detached we can change it */
|
||||
if ((data == NULL) || (ret->length < len))
|
||||
if ((data == NULL) || (ret->length < length))
|
||||
{
|
||||
ret->length=0;
|
||||
if (data != NULL) OPENSSL_free(data);
|
||||
data=(unsigned char *)OPENSSL_malloc(len ? (int)len : 1);
|
||||
data=(unsigned char *)OPENSSL_malloc(length);
|
||||
if (data == NULL)
|
||||
{ i=ERR_R_MALLOC_FAILURE; goto err; }
|
||||
ret->flags|=ASN1_OBJECT_FLAG_DYNAMIC_DATA;
|
||||
}
|
||||
memcpy(data,p,(int)len);
|
||||
memcpy(data,p,length);
|
||||
/* reattach data to object, after which it remains const */
|
||||
ret->data =data;
|
||||
ret->length=(int)len;
|
||||
ret->length=length;
|
||||
ret->sn=NULL;
|
||||
ret->ln=NULL;
|
||||
/* ret->flags=ASN1_OBJECT_FLAG_DYNAMIC; we know it is dynamic */
|
||||
p+=len;
|
||||
p+=length;
|
||||
|
||||
if (a != NULL) (*a)=ret;
|
||||
*pp=p;
|
||||
|
|
|
@ -196,24 +196,29 @@ ASN1_UTCTIME *ASN1_UTCTIME_adj(ASN1_UTCTIME *s, time_t t,
|
|||
struct tm *ts;
|
||||
struct tm data;
|
||||
size_t len = 20;
|
||||
int free_s = 0;
|
||||
|
||||
if (s == NULL)
|
||||
{
|
||||
free_s = 1;
|
||||
s=M_ASN1_UTCTIME_new();
|
||||
}
|
||||
if (s == NULL)
|
||||
return(NULL);
|
||||
goto err;
|
||||
|
||||
|
||||
ts=OPENSSL_gmtime(&t, &data);
|
||||
if (ts == NULL)
|
||||
return(NULL);
|
||||
goto err;
|
||||
|
||||
if (offset_day || offset_sec)
|
||||
{
|
||||
if (!OPENSSL_gmtime_adj(ts, offset_day, offset_sec))
|
||||
return NULL;
|
||||
goto err;
|
||||
}
|
||||
|
||||
if((ts->tm_year < 50) || (ts->tm_year >= 150))
|
||||
return NULL;
|
||||
goto err;
|
||||
|
||||
p=(char *)s->data;
|
||||
if ((p == NULL) || ((size_t)s->length < len))
|
||||
|
@ -222,7 +227,7 @@ ASN1_UTCTIME *ASN1_UTCTIME_adj(ASN1_UTCTIME *s, time_t t,
|
|||
if (p == NULL)
|
||||
{
|
||||
ASN1err(ASN1_F_ASN1_UTCTIME_ADJ,ERR_R_MALLOC_FAILURE);
|
||||
return(NULL);
|
||||
goto err;
|
||||
}
|
||||
if (s->data != NULL)
|
||||
OPENSSL_free(s->data);
|
||||
|
@ -237,6 +242,10 @@ ASN1_UTCTIME *ASN1_UTCTIME_adj(ASN1_UTCTIME *s, time_t t,
|
|||
ebcdic2ascii(s->data, s->data, s->length);
|
||||
#endif
|
||||
return(s);
|
||||
err:
|
||||
if (free_s && s)
|
||||
M_ASN1_UTCTIME_free(s);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
|
||||
|
@ -261,6 +270,11 @@ int ASN1_UTCTIME_cmp_time_t(const ASN1_UTCTIME *s, time_t t)
|
|||
t -= offset*60; /* FIXME: may overflow in extreme cases */
|
||||
|
||||
tm = OPENSSL_gmtime(&t, &data);
|
||||
/* NB: -1, 0, 1 already valid return values so use -2 to
|
||||
* indicate error.
|
||||
*/
|
||||
if (tm == NULL)
|
||||
return -2;
|
||||
|
||||
#define return_cmp(a,b) if ((a)<(b)) return -1; else if ((a)>(b)) return 1
|
||||
year = g2(s->data);
|
||||
|
|
|
@ -258,7 +258,12 @@ int EVP_PKEY_asn1_add_alias(int to, int from)
|
|||
if (!ameth)
|
||||
return 0;
|
||||
ameth->pkey_base_id = to;
|
||||
return EVP_PKEY_asn1_add0(ameth);
|
||||
if (!EVP_PKEY_asn1_add0(ameth))
|
||||
{
|
||||
EVP_PKEY_asn1_free(ameth);
|
||||
return 0;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
int EVP_PKEY_asn1_get0_info(int *ppkey_id, int *ppkey_base_id, int *ppkey_flags,
|
||||
|
|
|
@ -131,6 +131,9 @@ int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
|
|||
*pclass=xclass;
|
||||
if (!asn1_get_length(&p,&inf,plength,(int)max)) goto err;
|
||||
|
||||
if (inf && !(ret & V_ASN1_CONSTRUCTED))
|
||||
goto err;
|
||||
|
||||
#if 0
|
||||
fprintf(stderr,"p=%d + *plength=%ld > omax=%ld + *pp=%d (%d > %d)\n",
|
||||
(int)p,*plength,omax,(int)*pp,(int)(p+ *plength),
|
||||
|
|
|
@ -667,6 +667,8 @@ static STACK_OF(MIME_HEADER) *mime_parse_hdr(BIO *bio)
|
|||
int len, state, save_state = 0;
|
||||
|
||||
headers = sk_MIME_HEADER_new(mime_hdr_cmp);
|
||||
if (!headers)
|
||||
return NULL;
|
||||
while ((len = BIO_gets(bio, linebuf, MAX_SMLEN)) > 0) {
|
||||
/* If whitespace at line start then continuation line */
|
||||
if(mhdr && isspace((unsigned char)linebuf[0])) state = MIME_NAME;
|
||||
|
|
|
@ -134,15 +134,23 @@ ASN1_STRING *ASN1_pack_string(void *obj, i2d_of_void *i2d, ASN1_STRING **oct)
|
|||
|
||||
if (!(octmp->length = i2d(obj, NULL))) {
|
||||
ASN1err(ASN1_F_ASN1_PACK_STRING,ASN1_R_ENCODE_ERROR);
|
||||
return NULL;
|
||||
goto err;
|
||||
}
|
||||
if (!(p = OPENSSL_malloc (octmp->length))) {
|
||||
ASN1err(ASN1_F_ASN1_PACK_STRING,ERR_R_MALLOC_FAILURE);
|
||||
return NULL;
|
||||
goto err;
|
||||
}
|
||||
octmp->data = p;
|
||||
i2d (obj, &p);
|
||||
return octmp;
|
||||
err:
|
||||
if (!oct || !*oct)
|
||||
{
|
||||
ASN1_STRING_free(octmp);
|
||||
if (oct)
|
||||
*oct = NULL;
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
|
||||
#endif
|
||||
|
|
|
@ -154,7 +154,10 @@ static int asn1_bio_new(BIO *b)
|
|||
if (!ctx)
|
||||
return 0;
|
||||
if (!asn1_bio_init(ctx, DEFAULT_ASN1_BUF_SIZE))
|
||||
{
|
||||
OPENSSL_free(ctx);
|
||||
return 0;
|
||||
}
|
||||
b->init = 1;
|
||||
b->ptr = (char *)ctx;
|
||||
b->flags = 0;
|
||||
|
|
|
@ -1,5 +1,8 @@
|
|||
#!/usr/local/bin/perl -w
|
||||
|
||||
# Written by Dr Stephen N Henson (steve@openssl.org).
|
||||
# Licensed under the terms of the OpenSSL license.
|
||||
|
||||
use strict;
|
||||
|
||||
my ($i, @arr);
|
||||
|
|
|
@ -66,7 +66,11 @@ int ASN1_TYPE_set_octetstring(ASN1_TYPE *a, unsigned char *data, int len)
|
|||
ASN1_STRING *os;
|
||||
|
||||
if ((os=M_ASN1_OCTET_STRING_new()) == NULL) return(0);
|
||||
if (!M_ASN1_OCTET_STRING_set(os,data,len)) return(0);
|
||||
if (!M_ASN1_OCTET_STRING_set(os,data,len))
|
||||
{
|
||||
M_ASN1_OCTET_STRING_free(os);
|
||||
return 0;
|
||||
}
|
||||
ASN1_TYPE_set(a,V_ASN1_OCTET_STRING,os);
|
||||
return(1);
|
||||
}
|
||||
|
|
|
@ -475,6 +475,8 @@ int X509_NAME_print(BIO *bp, X509_NAME *name, int obase)
|
|||
l=80-2-obase;
|
||||
|
||||
b=X509_NAME_oneline(name,NULL,0);
|
||||
if (!b)
|
||||
return 0;
|
||||
if (!*b)
|
||||
{
|
||||
OPENSSL_free(b);
|
||||
|
|
|
@ -453,9 +453,14 @@ static int asn1_set_seq_out(STACK_OF(ASN1_VALUE) *sk, unsigned char **out,
|
|||
{
|
||||
derlst = OPENSSL_malloc(sk_ASN1_VALUE_num(sk)
|
||||
* sizeof(*derlst));
|
||||
tmpdat = OPENSSL_malloc(skcontlen);
|
||||
if (!derlst || !tmpdat)
|
||||
if (!derlst)
|
||||
return 0;
|
||||
tmpdat = OPENSSL_malloc(skcontlen);
|
||||
if (!tmpdat)
|
||||
{
|
||||
OPENSSL_free(derlst);
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
}
|
||||
/* If not sorting just output each item */
|
||||
|
|
|
@ -270,6 +270,7 @@ static int crl_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
|
|||
{
|
||||
/* We handle IDP and deltas */
|
||||
if ((nid == NID_issuing_distribution_point)
|
||||
|| (nid == NID_authority_key_identifier)
|
||||
|| (nid == NID_delta_crl))
|
||||
break;;
|
||||
crl->flags |= EXFLAG_CRITICAL;
|
||||
|
|
|
@ -132,8 +132,8 @@ int BIO_free(BIO *a)
|
|||
|
||||
CRYPTO_free_ex_data(CRYPTO_EX_INDEX_BIO, a, &a->ex_data);
|
||||
|
||||
if ((a->method == NULL) || (a->method->destroy == NULL)) return(1);
|
||||
a->method->destroy(a);
|
||||
if ((a->method != NULL) && (a->method->destroy != NULL))
|
||||
a->method->destroy(a);
|
||||
OPENSSL_free(a);
|
||||
return(1);
|
||||
}
|
||||
|
|
|
@ -680,7 +680,7 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
|
|||
|
||||
/* Dedicated window==4 case improves 512-bit RSA sign by ~15%, but as
|
||||
* 512-bit RSA is hardly relevant, we omit it to spare size... */
|
||||
if (window==5)
|
||||
if (window==5 && top>1)
|
||||
{
|
||||
void bn_mul_mont_gather5(BN_ULONG *rp,const BN_ULONG *ap,
|
||||
const void *table,const BN_ULONG *np,
|
||||
|
|
|
@ -320,6 +320,15 @@ static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
|
|||
BNerr(BN_F_BN_EXPAND_INTERNAL,ERR_R_MALLOC_FAILURE);
|
||||
return(NULL);
|
||||
}
|
||||
#ifdef PURIFY
|
||||
/* Valgrind complains in BN_consttime_swap because we process the whole
|
||||
* array even if it's not initialised yet. This doesn't matter in that
|
||||
* function - what's important is constant time operation (we're not
|
||||
* actually going to use the data)
|
||||
*/
|
||||
memset(a, 0, sizeof(BN_ULONG)*words);
|
||||
#endif
|
||||
|
||||
#if 1
|
||||
B=b->d;
|
||||
/* Check if the previous number needs to be copied */
|
||||
|
|
|
@ -77,6 +77,7 @@ int BN_sqr(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)
|
|||
if (al <= 0)
|
||||
{
|
||||
r->top=0;
|
||||
r->neg = 0;
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
|
|
@ -93,9 +93,10 @@ CMS_RecipientInfo *CMS_add0_recipient_password(CMS_ContentInfo *cms,
|
|||
X509_ALGOR *encalg = NULL;
|
||||
unsigned char iv[EVP_MAX_IV_LENGTH];
|
||||
int ivlen;
|
||||
|
||||
env = cms_get0_enveloped(cms);
|
||||
if (!env)
|
||||
goto err;
|
||||
return NULL;
|
||||
|
||||
if (wrap_nid <= 0)
|
||||
wrap_nid = NID_id_alg_PWRI_KEK;
|
||||
|
|
|
@ -321,7 +321,7 @@ again:
|
|||
p=eat_ws(conf, end);
|
||||
if (*p != ']')
|
||||
{
|
||||
if (*p != '\0')
|
||||
if (*p != '\0' && ss != p)
|
||||
{
|
||||
ss=p;
|
||||
goto again;
|
||||
|
|
|
@ -942,7 +942,7 @@ int EC_POINT_dbl(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a, BN_CTX *
|
|||
|
||||
int EC_POINT_invert(const EC_GROUP *group, EC_POINT *a, BN_CTX *ctx)
|
||||
{
|
||||
if (group->meth->dbl == 0)
|
||||
if (group->meth->invert == 0)
|
||||
{
|
||||
ECerr(EC_F_EC_POINT_INVERT, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
|
||||
return 0;
|
||||
|
|
|
@ -1181,9 +1181,8 @@ int ec_GFp_simple_make_affine(const EC_GROUP *group, EC_POINT *point, BN_CTX *ct
|
|||
int ec_GFp_simple_points_make_affine(const EC_GROUP *group, size_t num, EC_POINT *points[], BN_CTX *ctx)
|
||||
{
|
||||
BN_CTX *new_ctx = NULL;
|
||||
BIGNUM *tmp0, *tmp1;
|
||||
size_t pow2 = 0;
|
||||
BIGNUM **heap = NULL;
|
||||
BIGNUM *tmp, *tmp_Z;
|
||||
BIGNUM **prod_Z = NULL;
|
||||
size_t i;
|
||||
int ret = 0;
|
||||
|
||||
|
@ -1198,124 +1197,104 @@ int ec_GFp_simple_points_make_affine(const EC_GROUP *group, size_t num, EC_POINT
|
|||
}
|
||||
|
||||
BN_CTX_start(ctx);
|
||||
tmp0 = BN_CTX_get(ctx);
|
||||
tmp1 = BN_CTX_get(ctx);
|
||||
if (tmp0 == NULL || tmp1 == NULL) goto err;
|
||||
tmp = BN_CTX_get(ctx);
|
||||
tmp_Z = BN_CTX_get(ctx);
|
||||
if (tmp == NULL || tmp_Z == NULL) goto err;
|
||||
|
||||
/* Before converting the individual points, compute inverses of all Z values.
|
||||
* Modular inversion is rather slow, but luckily we can do with a single
|
||||
* explicit inversion, plus about 3 multiplications per input value.
|
||||
*/
|
||||
|
||||
pow2 = 1;
|
||||
while (num > pow2)
|
||||
pow2 <<= 1;
|
||||
/* Now pow2 is the smallest power of 2 satifsying pow2 >= num.
|
||||
* We need twice that. */
|
||||
pow2 <<= 1;
|
||||
|
||||
heap = OPENSSL_malloc(pow2 * sizeof heap[0]);
|
||||
if (heap == NULL) goto err;
|
||||
|
||||
/* The array is used as a binary tree, exactly as in heapsort:
|
||||
*
|
||||
* heap[1]
|
||||
* heap[2] heap[3]
|
||||
* heap[4] heap[5] heap[6] heap[7]
|
||||
* heap[8]heap[9] heap[10]heap[11] heap[12]heap[13] heap[14] heap[15]
|
||||
*
|
||||
* We put the Z's in the last line;
|
||||
* then we set each other node to the product of its two child-nodes (where
|
||||
* empty or 0 entries are treated as ones);
|
||||
* then we invert heap[1];
|
||||
* then we invert each other node by replacing it by the product of its
|
||||
* parent (after inversion) and its sibling (before inversion).
|
||||
*/
|
||||
heap[0] = NULL;
|
||||
for (i = pow2/2 - 1; i > 0; i--)
|
||||
heap[i] = NULL;
|
||||
prod_Z = OPENSSL_malloc(num * sizeof prod_Z[0]);
|
||||
if (prod_Z == NULL) goto err;
|
||||
for (i = 0; i < num; i++)
|
||||
heap[pow2/2 + i] = &points[i]->Z;
|
||||
for (i = pow2/2 + num; i < pow2; i++)
|
||||
heap[i] = NULL;
|
||||
|
||||
/* set each node to the product of its children */
|
||||
for (i = pow2/2 - 1; i > 0; i--)
|
||||
{
|
||||
heap[i] = BN_new();
|
||||
if (heap[i] == NULL) goto err;
|
||||
|
||||
if (heap[2*i] != NULL)
|
||||
{
|
||||
if ((heap[2*i + 1] == NULL) || BN_is_zero(heap[2*i + 1]))
|
||||
{
|
||||
if (!BN_copy(heap[i], heap[2*i])) goto err;
|
||||
}
|
||||
else
|
||||
{
|
||||
if (BN_is_zero(heap[2*i]))
|
||||
{
|
||||
if (!BN_copy(heap[i], heap[2*i + 1])) goto err;
|
||||
}
|
||||
else
|
||||
{
|
||||
if (!group->meth->field_mul(group, heap[i],
|
||||
heap[2*i], heap[2*i + 1], ctx)) goto err;
|
||||
}
|
||||
}
|
||||
}
|
||||
prod_Z[i] = BN_new();
|
||||
if (prod_Z[i] == NULL) goto err;
|
||||
}
|
||||
|
||||
/* invert heap[1] */
|
||||
if (!BN_is_zero(heap[1]))
|
||||
{
|
||||
if (!BN_mod_inverse(heap[1], heap[1], &group->field, ctx))
|
||||
{
|
||||
ECerr(EC_F_EC_GFP_SIMPLE_POINTS_MAKE_AFFINE, ERR_R_BN_LIB);
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
if (group->meth->field_encode != 0)
|
||||
{
|
||||
/* in the Montgomery case, we just turned R*H (representing H)
|
||||
* into 1/(R*H), but we need R*(1/H) (representing 1/H);
|
||||
* i.e. we have need to multiply by the Montgomery factor twice */
|
||||
if (!group->meth->field_encode(group, heap[1], heap[1], ctx)) goto err;
|
||||
if (!group->meth->field_encode(group, heap[1], heap[1], ctx)) goto err;
|
||||
}
|
||||
/* Set each prod_Z[i] to the product of points[0]->Z .. points[i]->Z,
|
||||
* skipping any zero-valued inputs (pretend that they're 1). */
|
||||
|
||||
/* set other heap[i]'s to their inverses */
|
||||
for (i = 2; i < pow2/2 + num; i += 2)
|
||||
if (!BN_is_zero(&points[0]->Z))
|
||||
{
|
||||
/* i is even */
|
||||
if ((heap[i + 1] != NULL) && !BN_is_zero(heap[i + 1]))
|
||||
if (!BN_copy(prod_Z[0], &points[0]->Z)) goto err;
|
||||
}
|
||||
else
|
||||
{
|
||||
if (group->meth->field_set_to_one != 0)
|
||||
{
|
||||
if (!group->meth->field_mul(group, tmp0, heap[i/2], heap[i + 1], ctx)) goto err;
|
||||
if (!group->meth->field_mul(group, tmp1, heap[i/2], heap[i], ctx)) goto err;
|
||||
if (!BN_copy(heap[i], tmp0)) goto err;
|
||||
if (!BN_copy(heap[i + 1], tmp1)) goto err;
|
||||
if (!group->meth->field_set_to_one(group, prod_Z[0], ctx)) goto err;
|
||||
}
|
||||
else
|
||||
{
|
||||
if (!BN_copy(heap[i], heap[i/2])) goto err;
|
||||
if (!BN_one(prod_Z[0])) goto err;
|
||||
}
|
||||
}
|
||||
|
||||
/* we have replaced all non-zero Z's by their inverses, now fix up all the points */
|
||||
for (i = 1; i < num; i++)
|
||||
{
|
||||
if (!BN_is_zero(&points[i]->Z))
|
||||
{
|
||||
if (!group->meth->field_mul(group, prod_Z[i], prod_Z[i - 1], &points[i]->Z, ctx)) goto err;
|
||||
}
|
||||
else
|
||||
{
|
||||
if (!BN_copy(prod_Z[i], prod_Z[i - 1])) goto err;
|
||||
}
|
||||
}
|
||||
|
||||
/* Now use a single explicit inversion to replace every
|
||||
* non-zero points[i]->Z by its inverse. */
|
||||
|
||||
if (!BN_mod_inverse(tmp, prod_Z[num - 1], &group->field, ctx))
|
||||
{
|
||||
ECerr(EC_F_EC_GFP_SIMPLE_POINTS_MAKE_AFFINE, ERR_R_BN_LIB);
|
||||
goto err;
|
||||
}
|
||||
if (group->meth->field_encode != 0)
|
||||
{
|
||||
/* In the Montgomery case, we just turned R*H (representing H)
|
||||
* into 1/(R*H), but we need R*(1/H) (representing 1/H);
|
||||
* i.e. we need to multiply by the Montgomery factor twice. */
|
||||
if (!group->meth->field_encode(group, tmp, tmp, ctx)) goto err;
|
||||
if (!group->meth->field_encode(group, tmp, tmp, ctx)) goto err;
|
||||
}
|
||||
|
||||
for (i = num - 1; i > 0; --i)
|
||||
{
|
||||
/* Loop invariant: tmp is the product of the inverses of
|
||||
* points[0]->Z .. points[i]->Z (zero-valued inputs skipped). */
|
||||
if (!BN_is_zero(&points[i]->Z))
|
||||
{
|
||||
/* Set tmp_Z to the inverse of points[i]->Z (as product
|
||||
* of Z inverses 0 .. i, Z values 0 .. i - 1). */
|
||||
if (!group->meth->field_mul(group, tmp_Z, prod_Z[i - 1], tmp, ctx)) goto err;
|
||||
/* Update tmp to satisfy the loop invariant for i - 1. */
|
||||
if (!group->meth->field_mul(group, tmp, tmp, &points[i]->Z, ctx)) goto err;
|
||||
/* Replace points[i]->Z by its inverse. */
|
||||
if (!BN_copy(&points[i]->Z, tmp_Z)) goto err;
|
||||
}
|
||||
}
|
||||
|
||||
if (!BN_is_zero(&points[0]->Z))
|
||||
{
|
||||
/* Replace points[0]->Z by its inverse. */
|
||||
if (!BN_copy(&points[0]->Z, tmp)) goto err;
|
||||
}
|
||||
|
||||
/* Finally, fix up the X and Y coordinates for all points. */
|
||||
|
||||
for (i = 0; i < num; i++)
|
||||
{
|
||||
EC_POINT *p = points[i];
|
||||
|
||||
|
||||
if (!BN_is_zero(&p->Z))
|
||||
{
|
||||
/* turn (X, Y, 1/Z) into (X/Z^2, Y/Z^3, 1) */
|
||||
|
||||
if (!group->meth->field_sqr(group, tmp1, &p->Z, ctx)) goto err;
|
||||
if (!group->meth->field_mul(group, &p->X, &p->X, tmp1, ctx)) goto err;
|
||||
if (!group->meth->field_sqr(group, tmp, &p->Z, ctx)) goto err;
|
||||
if (!group->meth->field_mul(group, &p->X, &p->X, tmp, ctx)) goto err;
|
||||
|
||||
if (!group->meth->field_mul(group, tmp, tmp, &p->Z, ctx)) goto err;
|
||||
if (!group->meth->field_mul(group, &p->Y, &p->Y, tmp, ctx)) goto err;
|
||||
|
||||
if (!group->meth->field_mul(group, tmp1, tmp1, &p->Z, ctx)) goto err;
|
||||
if (!group->meth->field_mul(group, &p->Y, &p->Y, tmp1, ctx)) goto err;
|
||||
|
||||
if (group->meth->field_set_to_one != 0)
|
||||
{
|
||||
if (!group->meth->field_set_to_one(group, &p->Z, ctx)) goto err;
|
||||
|
@ -1329,20 +1308,19 @@ int ec_GFp_simple_points_make_affine(const EC_GROUP *group, size_t num, EC_POINT
|
|||
}
|
||||
|
||||
ret = 1;
|
||||
|
||||
|
||||
err:
|
||||
BN_CTX_end(ctx);
|
||||
if (new_ctx != NULL)
|
||||
BN_CTX_free(new_ctx);
|
||||
if (heap != NULL)
|
||||
if (prod_Z != NULL)
|
||||
{
|
||||
/* heap[pow2/2] .. heap[pow2-1] have not been allocated locally! */
|
||||
for (i = pow2/2 - 1; i > 0; i--)
|
||||
for (i = 0; i < num; i++)
|
||||
{
|
||||
if (heap[i] != NULL)
|
||||
BN_clear_free(heap[i]);
|
||||
if (prod_Z[i] != NULL)
|
||||
BN_clear_free(prod_Z[i]);
|
||||
}
|
||||
OPENSSL_free(heap);
|
||||
OPENSSL_free(prod_Z);
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
|
|
|
@ -199,6 +199,7 @@ static void group_order_tests(EC_GROUP *group)
|
|||
EC_POINT *P = EC_POINT_new(group);
|
||||
EC_POINT *Q = EC_POINT_new(group);
|
||||
BN_CTX *ctx = BN_CTX_new();
|
||||
int i;
|
||||
|
||||
n1 = BN_new(); n2 = BN_new(); order = BN_new();
|
||||
fprintf(stdout, "verify group order ...");
|
||||
|
@ -212,21 +213,55 @@ static void group_order_tests(EC_GROUP *group)
|
|||
if (!EC_POINT_mul(group, Q, order, NULL, NULL, ctx)) ABORT;
|
||||
if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
|
||||
fprintf(stdout, " ok\n");
|
||||
fprintf(stdout, "long/negative scalar tests ... ");
|
||||
if (!BN_one(n1)) ABORT;
|
||||
/* n1 = 1 - order */
|
||||
if (!BN_sub(n1, n1, order)) ABORT;
|
||||
if(!EC_POINT_mul(group, Q, NULL, P, n1, ctx)) ABORT;
|
||||
if (0 != EC_POINT_cmp(group, Q, P, ctx)) ABORT;
|
||||
/* n2 = 1 + order */
|
||||
if (!BN_add(n2, order, BN_value_one())) ABORT;
|
||||
if(!EC_POINT_mul(group, Q, NULL, P, n2, ctx)) ABORT;
|
||||
if (0 != EC_POINT_cmp(group, Q, P, ctx)) ABORT;
|
||||
/* n2 = (1 - order) * (1 + order) */
|
||||
if (!BN_mul(n2, n1, n2, ctx)) ABORT;
|
||||
if(!EC_POINT_mul(group, Q, NULL, P, n2, ctx)) ABORT;
|
||||
if (0 != EC_POINT_cmp(group, Q, P, ctx)) ABORT;
|
||||
fprintf(stdout, "long/negative scalar tests ");
|
||||
for (i = 1; i <= 2; i++)
|
||||
{
|
||||
const BIGNUM *scalars[6];
|
||||
const EC_POINT *points[6];
|
||||
|
||||
fprintf(stdout, i == 1 ?
|
||||
"allowing precomputation ... " :
|
||||
"without precomputation ... ");
|
||||
if (!BN_set_word(n1, i)) ABORT;
|
||||
/* If i == 1, P will be the predefined generator for which
|
||||
* EC_GROUP_precompute_mult has set up precomputation. */
|
||||
if (!EC_POINT_mul(group, P, n1, NULL, NULL, ctx)) ABORT;
|
||||
|
||||
if (!BN_one(n1)) ABORT;
|
||||
/* n1 = 1 - order */
|
||||
if (!BN_sub(n1, n1, order)) ABORT;
|
||||
if (!EC_POINT_mul(group, Q, NULL, P, n1, ctx)) ABORT;
|
||||
if (0 != EC_POINT_cmp(group, Q, P, ctx)) ABORT;
|
||||
|
||||
/* n2 = 1 + order */
|
||||
if (!BN_add(n2, order, BN_value_one())) ABORT;
|
||||
if (!EC_POINT_mul(group, Q, NULL, P, n2, ctx)) ABORT;
|
||||
if (0 != EC_POINT_cmp(group, Q, P, ctx)) ABORT;
|
||||
|
||||
/* n2 = (1 - order) * (1 + order) = 1 - order^2 */
|
||||
if (!BN_mul(n2, n1, n2, ctx)) ABORT;
|
||||
if (!EC_POINT_mul(group, Q, NULL, P, n2, ctx)) ABORT;
|
||||
if (0 != EC_POINT_cmp(group, Q, P, ctx)) ABORT;
|
||||
|
||||
/* n2 = order^2 - 1 */
|
||||
BN_set_negative(n2, 0);
|
||||
if (!EC_POINT_mul(group, Q, NULL, P, n2, ctx)) ABORT;
|
||||
/* Add P to verify the result. */
|
||||
if (!EC_POINT_add(group, Q, Q, P, ctx)) ABORT;
|
||||
if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
|
||||
|
||||
/* Exercise EC_POINTs_mul, including corner cases. */
|
||||
scalars[0] = n1; points[0] = Q; /* => infinity */
|
||||
scalars[1] = n2; points[1] = P; /* => -P */
|
||||
scalars[2] = n1; points[2] = Q; /* => infinity */
|
||||
scalars[3] = n2; points[3] = Q; /* => infinity */
|
||||
scalars[4] = n1; points[4] = P; /* => P */
|
||||
scalars[5] = n2; points[5] = Q; /* => infinity */
|
||||
if (!EC_POINTs_mul(group, Q, NULL, 5, points, scalars, ctx)) ABORT;
|
||||
if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
|
||||
}
|
||||
fprintf(stdout, "ok\n");
|
||||
|
||||
EC_POINT_free(P);
|
||||
EC_POINT_free(Q);
|
||||
BN_free(n1);
|
||||
|
|
|
@ -808,6 +808,28 @@ static int aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
|
|||
/* Extra padding: tag appended to record */
|
||||
return EVP_GCM_TLS_TAG_LEN;
|
||||
|
||||
case EVP_CTRL_COPY:
|
||||
{
|
||||
EVP_CIPHER_CTX *out = ptr;
|
||||
EVP_AES_GCM_CTX *gctx_out = out->cipher_data;
|
||||
if (gctx->gcm.key)
|
||||
{
|
||||
if (gctx->gcm.key != &gctx->ks)
|
||||
return 0;
|
||||
gctx_out->gcm.key = &gctx_out->ks;
|
||||
}
|
||||
if (gctx->iv == c->iv)
|
||||
gctx_out->iv = out->iv;
|
||||
else
|
||||
{
|
||||
gctx_out->iv = OPENSSL_malloc(gctx->ivlen);
|
||||
if (!gctx_out->iv)
|
||||
return 0;
|
||||
memcpy(gctx_out->iv, gctx->iv, gctx->ivlen);
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
default:
|
||||
return -1;
|
||||
|
||||
|
@ -1032,7 +1054,8 @@ static int aes_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
|
|||
|
||||
#define CUSTOM_FLAGS (EVP_CIPH_FLAG_DEFAULT_ASN1 \
|
||||
| EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER \
|
||||
| EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT)
|
||||
| EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT \
|
||||
| EVP_CIPH_CUSTOM_COPY)
|
||||
|
||||
BLOCK_CIPHER_custom(NID_aes,128,1,12,gcm,GCM,
|
||||
EVP_CIPH_FLAG_FIPS|EVP_CIPH_FLAG_AEAD_CIPHER|CUSTOM_FLAGS)
|
||||
|
@ -1044,7 +1067,25 @@ BLOCK_CIPHER_custom(NID_aes,256,1,12,gcm,GCM,
|
|||
static int aes_xts_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
|
||||
{
|
||||
EVP_AES_XTS_CTX *xctx = c->cipher_data;
|
||||
if (type != EVP_CTRL_INIT)
|
||||
if (type == EVP_CTRL_COPY)
|
||||
{
|
||||
EVP_CIPHER_CTX *out = ptr;
|
||||
EVP_AES_XTS_CTX *xctx_out = out->cipher_data;
|
||||
if (xctx->xts.key1)
|
||||
{
|
||||
if (xctx->xts.key1 != &xctx->ks1)
|
||||
return 0;
|
||||
xctx_out->xts.key1 = &xctx_out->ks1;
|
||||
}
|
||||
if (xctx->xts.key2)
|
||||
{
|
||||
if (xctx->xts.key2 != &xctx->ks2)
|
||||
return 0;
|
||||
xctx_out->xts.key2 = &xctx_out->ks2;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
else if (type != EVP_CTRL_INIT)
|
||||
return -1;
|
||||
/* key1 and key2 are used as an indicator both key and IV are set */
|
||||
xctx->xts.key1 = NULL;
|
||||
|
@ -1153,7 +1194,8 @@ static int aes_xts_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
|
|||
#define aes_xts_cleanup NULL
|
||||
|
||||
#define XTS_FLAGS (EVP_CIPH_FLAG_DEFAULT_ASN1 | EVP_CIPH_CUSTOM_IV \
|
||||
| EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT)
|
||||
| EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT \
|
||||
| EVP_CIPH_CUSTOM_COPY)
|
||||
|
||||
BLOCK_CIPHER_custom(NID_aes,128,1,16,xts,XTS,EVP_CIPH_FLAG_FIPS|XTS_FLAGS)
|
||||
BLOCK_CIPHER_custom(NID_aes,256,1,16,xts,XTS,EVP_CIPH_FLAG_FIPS|XTS_FLAGS)
|
||||
|
@ -1203,6 +1245,19 @@ static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
|
|||
cctx->len_set = 0;
|
||||
return 1;
|
||||
|
||||
case EVP_CTRL_COPY:
|
||||
{
|
||||
EVP_CIPHER_CTX *out = ptr;
|
||||
EVP_AES_CCM_CTX *cctx_out = out->cipher_data;
|
||||
if (cctx->ccm.key)
|
||||
{
|
||||
if (cctx->ccm.key != &cctx->ks)
|
||||
return 0;
|
||||
cctx_out->ccm.key = &cctx_out->ks;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
default:
|
||||
return -1;
|
||||
|
||||
|
|
|
@ -259,7 +259,7 @@ int EVP_PBE_alg_add(int nid, const EVP_CIPHER *cipher, const EVP_MD *md,
|
|||
{
|
||||
int cipher_nid, md_nid;
|
||||
if (cipher)
|
||||
cipher_nid = EVP_CIPHER_type(cipher);
|
||||
cipher_nid = EVP_CIPHER_nid(cipher);
|
||||
else
|
||||
cipher_nid = -1;
|
||||
if (md)
|
||||
|
|
|
@ -199,10 +199,10 @@ static int cfb64_test(unsigned char *cfb_cipher)
|
|||
}
|
||||
memcpy(cfb_tmp,cfb_iv,8);
|
||||
n=0;
|
||||
idea_cfb64_encrypt(cfb_buf1,cfb_buf2,(long)17,&eks,
|
||||
idea_cfb64_encrypt(cfb_buf1,cfb_buf2,(long)13,&eks,
|
||||
cfb_tmp,&n,IDEA_DECRYPT);
|
||||
idea_cfb64_encrypt(&(cfb_buf1[17]),&(cfb_buf2[17]),
|
||||
(long)CFB_TEST_SIZE-17,&dks,
|
||||
idea_cfb64_encrypt(&(cfb_buf1[13]),&(cfb_buf2[13]),
|
||||
(long)CFB_TEST_SIZE-13,&eks,
|
||||
cfb_tmp,&n,IDEA_DECRYPT);
|
||||
if (memcmp(plain,cfb_buf2,CFB_TEST_SIZE) != 0)
|
||||
{
|
||||
|
|
|
@ -471,11 +471,12 @@ int OBJ_obj2txt(char *buf, int buf_len, const ASN1_OBJECT *a, int no_name)
|
|||
const unsigned char *p;
|
||||
char tbuf[DECIMAL_SIZE(i)+DECIMAL_SIZE(l)+2];
|
||||
|
||||
if ((a == NULL) || (a->data == NULL)) {
|
||||
buf[0]='\0';
|
||||
return(0);
|
||||
}
|
||||
/* Ensure that, at every state, |buf| is NUL-terminated. */
|
||||
if (buf && buf_len > 0)
|
||||
buf[0] = '\0';
|
||||
|
||||
if ((a == NULL) || (a->data == NULL))
|
||||
return(0);
|
||||
|
||||
if (!no_name && (nid=OBJ_obj2nid(a)) != NID_undef)
|
||||
{
|
||||
|
@ -554,9 +555,10 @@ int OBJ_obj2txt(char *buf, int buf_len, const ASN1_OBJECT *a, int no_name)
|
|||
i=(int)(l/40);
|
||||
l-=(long)(i*40);
|
||||
}
|
||||
if (buf && (buf_len > 0))
|
||||
if (buf && (buf_len > 1))
|
||||
{
|
||||
*buf++ = i + '0';
|
||||
*buf = '\0';
|
||||
buf_len--;
|
||||
}
|
||||
n++;
|
||||
|
@ -571,9 +573,10 @@ int OBJ_obj2txt(char *buf, int buf_len, const ASN1_OBJECT *a, int no_name)
|
|||
i = strlen(bndec);
|
||||
if (buf)
|
||||
{
|
||||
if (buf_len > 0)
|
||||
if (buf_len > 1)
|
||||
{
|
||||
*buf++ = '.';
|
||||
*buf = '\0';
|
||||
buf_len--;
|
||||
}
|
||||
BUF_strlcpy(buf,bndec,buf_len);
|
||||
|
@ -807,4 +810,3 @@ err:
|
|||
OPENSSL_free(buf);
|
||||
return(ok);
|
||||
}
|
||||
|
||||
|
|
File diff suppressed because it is too large
Load Diff
|
@ -115,7 +115,7 @@ for ($i=0; $i<$n; $i++)
|
|||
$out.="\"$sn\"";
|
||||
$out.=","."\"$ln\"";
|
||||
$out.=",NID_$nid{$i},";
|
||||
if (defined($obj{$nid{$i}}))
|
||||
if (defined($obj{$nid{$i}}) && $objd{$obj{$nid{$i}}} =~ /,/)
|
||||
{
|
||||
$v=$objd{$obj{$nid{$i}}};
|
||||
$v =~ s/L//g;
|
||||
|
|
|
@ -158,6 +158,8 @@ OCSP_REQ_CTX *OCSP_sendreq_new(BIO *io, char *path, OCSP_REQUEST *req,
|
|||
|
||||
OCSP_REQ_CTX *rctx;
|
||||
rctx = OPENSSL_malloc(sizeof(OCSP_REQ_CTX));
|
||||
if (!rctx)
|
||||
return NULL;
|
||||
rctx->state = OHS_ERROR;
|
||||
rctx->mem = BIO_new(BIO_s_mem());
|
||||
rctx->io = io;
|
||||
|
@ -167,18 +169,21 @@ OCSP_REQ_CTX *OCSP_sendreq_new(BIO *io, char *path, OCSP_REQUEST *req,
|
|||
else
|
||||
rctx->iobuflen = OCSP_MAX_LINE_LEN;
|
||||
rctx->iobuf = OPENSSL_malloc(rctx->iobuflen);
|
||||
if (!rctx->iobuf)
|
||||
return 0;
|
||||
if (!rctx->mem || !rctx->iobuf)
|
||||
goto err;
|
||||
if (!path)
|
||||
path = "/";
|
||||
|
||||
if (BIO_printf(rctx->mem, post_hdr, path) <= 0)
|
||||
return 0;
|
||||
goto err;
|
||||
|
||||
if (req && !OCSP_REQ_CTX_set1_req(rctx, req))
|
||||
return 0;
|
||||
goto err;
|
||||
|
||||
return rctx;
|
||||
err:
|
||||
OCSP_REQ_CTX_free(rctx);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/* Parse the HTTP response. This will look like this:
|
||||
|
@ -490,6 +495,9 @@ OCSP_RESPONSE *OCSP_sendreq_bio(BIO *b, char *path, OCSP_REQUEST *req)
|
|||
|
||||
ctx = OCSP_sendreq_new(b, path, req, -1);
|
||||
|
||||
if (!ctx)
|
||||
return NULL;
|
||||
|
||||
do
|
||||
{
|
||||
rv = OCSP_sendreq_nbio(&resp, ctx);
|
||||
|
|
|
@ -222,8 +222,19 @@ int OCSP_parse_url(char *url, char **phost, char **pport, char **ppath, int *pss
|
|||
|
||||
if (!*ppath) goto mem_err;
|
||||
|
||||
p = host;
|
||||
if(host[0] == '[')
|
||||
{
|
||||
/* ipv6 literal */
|
||||
host++;
|
||||
p = strchr(host, ']');
|
||||
if(!p) goto parse_err;
|
||||
*p = '\0';
|
||||
p++;
|
||||
}
|
||||
|
||||
/* Look for optional ':' for port number */
|
||||
if ((p = strchr(host, ':')))
|
||||
if ((p = strchr(p, ':')))
|
||||
{
|
||||
*p = 0;
|
||||
port = p + 1;
|
||||
|
|
|
@ -32,6 +32,9 @@
|
|||
#ifndef OPENSSL_NO_STORE
|
||||
# define OPENSSL_NO_STORE
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_UNIT_TEST
|
||||
# define OPENSSL_NO_UNIT_TEST
|
||||
#endif
|
||||
|
||||
#endif /* OPENSSL_DOING_MAKEDEPEND */
|
||||
|
||||
|
@ -71,6 +74,9 @@
|
|||
# if defined(OPENSSL_NO_STORE) && !defined(NO_STORE)
|
||||
# define NO_STORE
|
||||
# endif
|
||||
# if defined(OPENSSL_NO_UNIT_TEST) && !defined(NO_UNIT_TEST)
|
||||
# define NO_UNIT_TEST
|
||||
# endif
|
||||
#endif
|
||||
|
||||
/* crypto/opensslconf.h.in */
|
||||
|
|
|
@ -25,11 +25,11 @@
|
|||
* (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
|
||||
* major minor fix final patch/beta)
|
||||
*/
|
||||
#define OPENSSL_VERSION_NUMBER 0x1000108fL
|
||||
#define OPENSSL_VERSION_NUMBER 0x1000109fL
|
||||
#ifdef OPENSSL_FIPS
|
||||
#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1h-fips 5 Jun 2014"
|
||||
#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1i-fips 6 Aug 2014"
|
||||
#else
|
||||
#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1h 5 Jun 2014"
|
||||
#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1i 6 Aug 2014"
|
||||
#endif
|
||||
#define OPENSSL_VERSION_PTEXT " part of " OPENSSL_VERSION_TEXT
|
||||
|
||||
|
|
|
@ -759,6 +759,11 @@ static EVP_PKEY *do_PVK_body(const unsigned char **in,
|
|||
/* Copy BLOBHEADER across, decrypt rest */
|
||||
memcpy(enctmp, p, 8);
|
||||
p += 8;
|
||||
if (keylen < 8)
|
||||
{
|
||||
PEMerr(PEM_F_DO_PVK_BODY, PEM_R_PVK_TOO_SHORT);
|
||||
return NULL;
|
||||
}
|
||||
inlen = keylen - 8;
|
||||
q = enctmp + 8;
|
||||
if (!EVP_DecryptInit_ex(&cctx, EVP_rc4(), NULL, keybuf, NULL))
|
||||
|
|
|
@ -39,20 +39,6 @@ test:
|
|||
|
||||
all: lib
|
||||
|
||||
testapps: enc dec sign verify
|
||||
|
||||
enc: enc.o lib
|
||||
$(CC) $(CFLAGS) -o enc enc.o $(PEX_LIBS) $(LIB) $(EX_LIBS)
|
||||
|
||||
dec: dec.o lib
|
||||
$(CC) $(CFLAGS) -o dec dec.o $(PEX_LIBS) $(LIB) $(EX_LIBS)
|
||||
|
||||
sign: sign.o lib
|
||||
$(CC) $(CFLAGS) -o sign sign.o $(PEX_LIBS) $(LIB) $(EX_LIBS)
|
||||
|
||||
verify: verify.o example.o lib
|
||||
$(CC) $(CFLAGS) -o verify verify.o $(PEX_LIBS) example.o $(LIB) $(EX_LIBS)
|
||||
|
||||
lib: $(LIBOBJ)
|
||||
$(AR) $(LIB) $(LIBOBJ)
|
||||
$(RANLIB) $(LIB) || echo Never mind.
|
||||
|
|
|
@ -159,7 +159,6 @@ const char RAND_version[]="RAND" OPENSSL_VERSION_PTEXT;
|
|||
static void ssleay_rand_cleanup(void);
|
||||
static void ssleay_rand_seed(const void *buf, int num);
|
||||
static void ssleay_rand_add(const void *buf, int num, double add_entropy);
|
||||
static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo);
|
||||
static int ssleay_rand_nopseudo_bytes(unsigned char *buf, int num);
|
||||
static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num);
|
||||
static int ssleay_rand_status(void);
|
||||
|
@ -334,7 +333,7 @@ static void ssleay_rand_seed(const void *buf, int num)
|
|||
ssleay_rand_add(buf, num, (double)num);
|
||||
}
|
||||
|
||||
static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo)
|
||||
int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo, int lock)
|
||||
{
|
||||
static volatile int stirred_pool = 0;
|
||||
int i,j,k,st_num,st_idx;
|
||||
|
@ -383,10 +382,7 @@ static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo)
|
|||
* are fed into the hash function and the results are kept in the
|
||||
* global 'md'.
|
||||
*/
|
||||
#ifdef OPENSSL_FIPS
|
||||
/* NB: in FIPS mode we are already under a lock */
|
||||
if (!FIPS_mode())
|
||||
#endif
|
||||
if (lock)
|
||||
CRYPTO_w_lock(CRYPTO_LOCK_RAND);
|
||||
|
||||
/* prevent ssleay_rand_bytes() from trying to obtain the lock again */
|
||||
|
@ -466,9 +462,7 @@ static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo)
|
|||
|
||||
/* before unlocking, we must clear 'crypto_lock_rand' */
|
||||
crypto_lock_rand = 0;
|
||||
#ifdef OPENSSL_FIPS
|
||||
if (!FIPS_mode())
|
||||
#endif
|
||||
if (lock)
|
||||
CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
|
||||
|
||||
while (num > 0)
|
||||
|
@ -521,15 +515,11 @@ static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo)
|
|||
MD_Init(&m);
|
||||
MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c));
|
||||
MD_Update(&m,local_md,MD_DIGEST_LENGTH);
|
||||
#ifdef OPENSSL_FIPS
|
||||
if (!FIPS_mode())
|
||||
#endif
|
||||
if (lock)
|
||||
CRYPTO_w_lock(CRYPTO_LOCK_RAND);
|
||||
MD_Update(&m,md,MD_DIGEST_LENGTH);
|
||||
MD_Final(&m,md);
|
||||
#ifdef OPENSSL_FIPS
|
||||
if (!FIPS_mode())
|
||||
#endif
|
||||
if (lock)
|
||||
CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
|
||||
|
||||
EVP_MD_CTX_cleanup(&m);
|
||||
|
@ -548,14 +538,14 @@ static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo)
|
|||
|
||||
static int ssleay_rand_nopseudo_bytes(unsigned char *buf, int num)
|
||||
{
|
||||
return ssleay_rand_bytes(buf, num, 0);
|
||||
return ssleay_rand_bytes(buf, num, 0, 1);
|
||||
}
|
||||
|
||||
/* pseudo-random bytes that are guaranteed to be unique but not
|
||||
unpredictable */
|
||||
static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num)
|
||||
{
|
||||
return ssleay_rand_bytes(buf, num, 1);
|
||||
return ssleay_rand_bytes(buf, num, 1, 1);
|
||||
}
|
||||
|
||||
static int ssleay_rand_status(void)
|
||||
|
|
|
@ -154,5 +154,6 @@
|
|||
#define MD(a,b,c) EVP_Digest(a,b,c,NULL,EVP_md2(), NULL)
|
||||
#endif
|
||||
|
||||
int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo, int lock);
|
||||
|
||||
#endif
|
||||
|
|
|
@ -68,6 +68,7 @@
|
|||
#ifdef OPENSSL_FIPS
|
||||
#include <openssl/fips.h>
|
||||
#include <openssl/fips_rand.h>
|
||||
#include "rand_lcl.h"
|
||||
#endif
|
||||
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
|
@ -199,7 +200,7 @@ static size_t drbg_get_entropy(DRBG_CTX *ctx, unsigned char **pout,
|
|||
*pout = OPENSSL_malloc(min_len);
|
||||
if (!*pout)
|
||||
return 0;
|
||||
if (RAND_SSLeay()->bytes(*pout, min_len) <= 0)
|
||||
if (ssleay_rand_bytes(*pout, min_len, 0, 0) <= 0)
|
||||
{
|
||||
OPENSSL_free(*pout);
|
||||
*pout = NULL;
|
||||
|
|
|
@ -79,6 +79,7 @@
|
|||
#endif
|
||||
#ifndef OPENSSL_NO_POSIX_IO
|
||||
# include <sys/stat.h>
|
||||
# include <fcntl.h>
|
||||
#endif
|
||||
|
||||
#ifdef _WIN32
|
||||
|
|
|
@ -459,7 +459,7 @@ static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
|
|||
if (padding == RSA_X931_PADDING)
|
||||
{
|
||||
BN_sub(f, rsa->n, ret);
|
||||
if (BN_cmp(ret, f))
|
||||
if (BN_cmp(ret, f) > 0)
|
||||
res = f;
|
||||
else
|
||||
res = ret;
|
||||
|
|
|
@ -89,6 +89,9 @@ static BIGNUM *srp_Calc_k(BIGNUM *N, BIGNUM *g)
|
|||
int longg ;
|
||||
int longN = BN_num_bytes(N);
|
||||
|
||||
if (BN_ucmp(g, N) >= 0)
|
||||
return NULL;
|
||||
|
||||
if ((tmp = OPENSSL_malloc(longN)) == NULL)
|
||||
return NULL;
|
||||
BN_bn2bin(N,tmp) ;
|
||||
|
@ -121,6 +124,9 @@ BIGNUM *SRP_Calc_u(BIGNUM *A, BIGNUM *B, BIGNUM *N)
|
|||
if ((A == NULL) ||(B == NULL) || (N == NULL))
|
||||
return NULL;
|
||||
|
||||
if (BN_ucmp(A, N) >= 0 || BN_ucmp(B, N) >= 0)
|
||||
return NULL;
|
||||
|
||||
longN= BN_num_bytes(N);
|
||||
|
||||
if ((cAB = OPENSSL_malloc(2*longN)) == NULL)
|
||||
|
|
|
@ -916,9 +916,9 @@ int UI_set_result(UI *ui, UI_STRING *uis, const char *result)
|
|||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
default:
|
||||
break;
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
|
|
@ -15,6 +15,8 @@ B<openssl> B<asn1parse>
|
|||
[B<-length number>]
|
||||
[B<-i>]
|
||||
[B<-oid filename>]
|
||||
[B<-dump>]
|
||||
[B<-dlimit num>]
|
||||
[B<-strparse offset>]
|
||||
[B<-genstr string>]
|
||||
[B<-genconf file>]
|
||||
|
@ -64,6 +66,14 @@ indents the output according to the "depth" of the structures.
|
|||
a file containing additional OBJECT IDENTIFIERs (OIDs). The format of this
|
||||
file is described in the NOTES section below.
|
||||
|
||||
=item B<-dump>
|
||||
|
||||
dump unknown data in hex format.
|
||||
|
||||
=item B<-dlimit num>
|
||||
|
||||
like B<-dump>, but only the first B<num> bytes are output.
|
||||
|
||||
=item B<-strparse offset>
|
||||
|
||||
parse the contents octets of the ASN.1 object starting at B<offset>. This
|
||||
|
|
|
@ -13,6 +13,8 @@ B<openssl> B<ca>
|
|||
[B<-name section>]
|
||||
[B<-gencrl>]
|
||||
[B<-revoke file>]
|
||||
[B<-status serial>]
|
||||
[B<-updatedb>]
|
||||
[B<-crl_reason reason>]
|
||||
[B<-crl_hold instruction>]
|
||||
[B<-crl_compromise time>]
|
||||
|
@ -26,6 +28,7 @@ B<openssl> B<ca>
|
|||
[B<-md arg>]
|
||||
[B<-policy arg>]
|
||||
[B<-keyfile arg>]
|
||||
[B<-keyform PEM|DER>]
|
||||
[B<-key arg>]
|
||||
[B<-passin arg>]
|
||||
[B<-cert file>]
|
||||
|
@ -83,7 +86,7 @@ a single self signed certificate to be signed by the CA.
|
|||
|
||||
a file containing a single Netscape signed public key and challenge
|
||||
and additional field values to be signed by the CA. See the B<SPKAC FORMAT>
|
||||
section for information on the required format.
|
||||
section for information on the required input and output format.
|
||||
|
||||
=item B<-infiles>
|
||||
|
||||
|
@ -94,7 +97,7 @@ are assumed to the the names of files containing certificate requests.
|
|||
|
||||
the output file to output certificates to. The default is standard
|
||||
output. The certificate details will also be printed out to this
|
||||
file.
|
||||
file in PEM format (except that B<-spkac> outputs DER format).
|
||||
|
||||
=item B<-outdir directory>
|
||||
|
||||
|
@ -110,6 +113,11 @@ the CA certificate file.
|
|||
|
||||
the private key to sign requests with.
|
||||
|
||||
=item B<-keyform PEM|DER>
|
||||
|
||||
the format of the data in the private key file.
|
||||
The default is PEM.
|
||||
|
||||
=item B<-key password>
|
||||
|
||||
the password used to encrypt the private key. Since on some
|
||||
|
@ -267,6 +275,15 @@ the number of hours before the next CRL is due.
|
|||
|
||||
a filename containing a certificate to revoke.
|
||||
|
||||
=item B<-status serial>
|
||||
|
||||
displays the revocation status of the certificate with the specified
|
||||
serial number and exits.
|
||||
|
||||
=item B<-updatedb>
|
||||
|
||||
Updates the database index to purge expired certificates.
|
||||
|
||||
=item B<-crl_reason reason>
|
||||
|
||||
revocation reason, where B<reason> is one of: B<unspecified>, B<keyCompromise>,
|
||||
|
@ -499,6 +516,10 @@ the SPKAC and also the required DN components as name value pairs.
|
|||
If you need to include the same component twice then it can be
|
||||
preceded by a number and a '.'.
|
||||
|
||||
When processing SPKAC format, the output is DER if the B<-out>
|
||||
flag is used, but PEM format if sending to stdout or the B<-outdir>
|
||||
flag is used.
|
||||
|
||||
=head1 EXAMPLES
|
||||
|
||||
Note: these examples assume that the B<ca> directory structure is
|
||||
|
|
|
@ -36,7 +36,7 @@ SSL v2 and for SSL v3/TLS v1.
|
|||
|
||||
=item B<-V>
|
||||
|
||||
Like B<-V>, but include cipher suite codes in output (hex format).
|
||||
Like B<-v>, but include cipher suite codes in output (hex format).
|
||||
|
||||
=item B<-ssl3>
|
||||
|
||||
|
@ -116,8 +116,8 @@ specified.
|
|||
=item B<COMPLEMENTOFDEFAULT>
|
||||
|
||||
the ciphers included in B<ALL>, but not enabled by default. Currently
|
||||
this is B<ADH>. Note that this rule does not cover B<eNULL>, which is
|
||||
not included by B<ALL> (use B<COMPLEMENTOFALL> if necessary).
|
||||
this is B<ADH> and B<AECDH>. Note that this rule does not cover B<eNULL>,
|
||||
which is not included by B<ALL> (use B<COMPLEMENTOFALL> if necessary).
|
||||
|
||||
=item B<ALL>
|
||||
|
||||
|
@ -165,21 +165,58 @@ included.
|
|||
=item B<aNULL>
|
||||
|
||||
the cipher suites offering no authentication. This is currently the anonymous
|
||||
DH algorithms. These cipher suites are vulnerable to a "man in the middle"
|
||||
attack and so their use is normally discouraged.
|
||||
DH algorithms and anonymous ECDH algorithms. These cipher suites are vulnerable
|
||||
to a "man in the middle" attack and so their use is normally discouraged.
|
||||
|
||||
=item B<kRSA>, B<RSA>
|
||||
|
||||
cipher suites using RSA key exchange.
|
||||
|
||||
=item B<kEDH>
|
||||
|
||||
cipher suites using ephemeral DH key agreement.
|
||||
|
||||
=item B<kDHr>, B<kDHd>
|
||||
=item B<kDHr>, B<kDHd>, B<kDH>
|
||||
|
||||
cipher suites using DH key agreement and DH certificates signed by CAs with RSA
|
||||
and DSS keys respectively. Not implemented.
|
||||
and DSS keys or either respectively. Not implemented.
|
||||
|
||||
=item B<kEDH>
|
||||
|
||||
cipher suites using ephemeral DH key agreement, including anonymous cipher
|
||||
suites.
|
||||
|
||||
=item B<EDH>
|
||||
|
||||
cipher suites using authenticated ephemeral DH key agreement.
|
||||
|
||||
=item B<ADH>
|
||||
|
||||
anonymous DH cipher suites, note that this does not include anonymous Elliptic
|
||||
Curve DH (ECDH) cipher suites.
|
||||
|
||||
=item B<DH>
|
||||
|
||||
cipher suites using DH, including anonymous DH, ephemeral DH and fixed DH.
|
||||
|
||||
=item B<kECDHr>, B<kECDHe>, B<kECDH>
|
||||
|
||||
cipher suites using fixed ECDH key agreement signed by CAs with RSA and ECDSA
|
||||
keys or either respectively.
|
||||
|
||||
=item B<kEECDH>
|
||||
|
||||
cipher suites using ephemeral ECDH key agreement, including anonymous
|
||||
cipher suites.
|
||||
|
||||
=item B<EECDHE>
|
||||
|
||||
cipher suites using authenticated ephemeral ECDH key agreement.
|
||||
|
||||
=item B<AECDH>
|
||||
|
||||
anonymous Elliptic Curve Diffie Hellman cipher suites.
|
||||
|
||||
=item B<ECDH>
|
||||
|
||||
cipher suites using ECDH key exchange, including anonymous, ephemeral and
|
||||
fixed ECDH.
|
||||
|
||||
=item B<aRSA>
|
||||
|
||||
|
@ -194,30 +231,39 @@ cipher suites using DSS authentication, i.e. the certificates carry DSS keys.
|
|||
cipher suites effectively using DH authentication, i.e. the certificates carry
|
||||
DH keys. Not implemented.
|
||||
|
||||
=item B<aECDH>
|
||||
|
||||
cipher suites effectively using ECDH authentication, i.e. the certificates
|
||||
carry ECDH keys.
|
||||
|
||||
=item B<aECDSA>, B<ECDSA>
|
||||
|
||||
cipher suites using ECDSA authentication, i.e. the certificates carry ECDSA
|
||||
keys.
|
||||
|
||||
=item B<kFZA>, B<aFZA>, B<eFZA>, B<FZA>
|
||||
|
||||
ciphers suites using FORTEZZA key exchange, authentication, encryption or all
|
||||
FORTEZZA algorithms. Not implemented.
|
||||
|
||||
=item B<TLSv1>, B<SSLv3>, B<SSLv2>
|
||||
=item B<TLSv1.2>, B<TLSv1>, B<SSLv3>, B<SSLv2>
|
||||
|
||||
TLS v1.0, SSL v3.0 or SSL v2.0 cipher suites respectively.
|
||||
TLS v1.2, TLS v1.0, SSL v3.0 or SSL v2.0 cipher suites respectively. Note:
|
||||
there are no ciphersuites specific to TLS v1.1.
|
||||
|
||||
=item B<DH>
|
||||
=item B<AES128>, B<AES256>, B<AES>
|
||||
|
||||
cipher suites using DH, including anonymous DH.
|
||||
cipher suites using 128 bit AES, 256 bit AES or either 128 or 256 bit AES.
|
||||
|
||||
=item B<ADH>
|
||||
=item B<AESGCM>
|
||||
|
||||
anonymous DH cipher suites.
|
||||
AES in Galois Counter Mode (GCM): these ciphersuites are only supported
|
||||
in TLS v1.2.
|
||||
|
||||
=item B<AES>
|
||||
=item B<CAMELLIA128>, B<CAMELLIA256>, B<CAMELLIA>
|
||||
|
||||
cipher suites using AES.
|
||||
|
||||
=item B<CAMELLIA>
|
||||
|
||||
cipher suites using Camellia.
|
||||
cipher suites using 128 bit CAMELLIA, 256 bit CAMELLIA or either 128 or 256 bit
|
||||
CAMELLIA.
|
||||
|
||||
=item B<3DES>
|
||||
|
||||
|
@ -251,6 +297,10 @@ cipher suites using MD5.
|
|||
|
||||
cipher suites using SHA1.
|
||||
|
||||
=item B<SHA256>, B<SHA384>
|
||||
|
||||
ciphersuites using SHA256 or SHA384.
|
||||
|
||||
=item B<aGOST>
|
||||
|
||||
cipher suites using GOST R 34.10 (either 2001 or 94) for authenticaction
|
||||
|
@ -277,6 +327,9 @@ cipher suites, using HMAC based on GOST R 34.11-94.
|
|||
|
||||
cipher suites using GOST 28147-89 MAC B<instead of> HMAC.
|
||||
|
||||
=item B<PSK>
|
||||
|
||||
cipher suites using pre-shared keys (PSK).
|
||||
|
||||
=back
|
||||
|
||||
|
@ -423,7 +476,100 @@ Note: these ciphers can also be used in SSL v3.
|
|||
TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA EXP1024-DHE-DSS-RC4-SHA
|
||||
TLS_DHE_DSS_WITH_RC4_128_SHA DHE-DSS-RC4-SHA
|
||||
|
||||
=head2 SSL v2.0 cipher suites.
|
||||
=head2 Elliptic curve cipher suites.
|
||||
|
||||
TLS_ECDH_RSA_WITH_NULL_SHA ECDH-RSA-NULL-SHA
|
||||
TLS_ECDH_RSA_WITH_RC4_128_SHA ECDH-RSA-RC4-SHA
|
||||
TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA ECDH-RSA-DES-CBC3-SHA
|
||||
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA ECDH-RSA-AES128-SHA
|
||||
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA ECDH-RSA-AES256-SHA
|
||||
|
||||
TLS_ECDH_ECDSA_WITH_NULL_SHA ECDH-ECDSA-NULL-SHA
|
||||
TLS_ECDH_ECDSA_WITH_RC4_128_SHA ECDH-ECDSA-RC4-SHA
|
||||
TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA ECDH-ECDSA-DES-CBC3-SHA
|
||||
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA ECDH-ECDSA-AES128-SHA
|
||||
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA ECDH-ECDSA-AES256-SHA
|
||||
|
||||
TLS_ECDHE_RSA_WITH_NULL_SHA ECDHE-RSA-NULL-SHA
|
||||
TLS_ECDHE_RSA_WITH_RC4_128_SHA ECDHE-RSA-RC4-SHA
|
||||
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA ECDHE-RSA-DES-CBC3-SHA
|
||||
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA ECDHE-RSA-AES128-SHA
|
||||
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA ECDHE-RSA-AES256-SHA
|
||||
|
||||
TLS_ECDHE_ECDSA_WITH_NULL_SHA ECDHE-ECDSA-NULL-SHA
|
||||
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA ECDHE-ECDSA-RC4-SHA
|
||||
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA ECDHE-ECDSA-DES-CBC3-SHA
|
||||
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA ECDHE-ECDSA-AES128-SHA
|
||||
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA ECDHE-ECDSA-AES256-SHA
|
||||
|
||||
TLS_ECDH_anon_WITH_NULL_SHA AECDH-NULL-SHA
|
||||
TLS_ECDH_anon_WITH_RC4_128_SHA AECDH-RC4-SHA
|
||||
TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA AECDH-DES-CBC3-SHA
|
||||
TLS_ECDH_anon_WITH_AES_128_CBC_SHA AECDH-AES128-SHA
|
||||
TLS_ECDH_anon_WITH_AES_256_CBC_SHA AECDH-AES256-SHA
|
||||
|
||||
=head2 TLS v1.2 cipher suites
|
||||
|
||||
TLS_RSA_WITH_NULL_SHA256 NULL-SHA256
|
||||
|
||||
TLS_RSA_WITH_AES_128_CBC_SHA256 AES128-SHA256
|
||||
TLS_RSA_WITH_AES_256_CBC_SHA256 AES256-SHA256
|
||||
TLS_RSA_WITH_AES_128_GCM_SHA256 AES128-GCM-SHA256
|
||||
TLS_RSA_WITH_AES_256_GCM_SHA384 AES256-GCM-SHA384
|
||||
|
||||
TLS_DH_RSA_WITH_AES_128_CBC_SHA256 Not implemented.
|
||||
TLS_DH_RSA_WITH_AES_256_CBC_SHA256 Not implemented.
|
||||
TLS_DH_RSA_WITH_AES_128_GCM_SHA256 Not implemented.
|
||||
TLS_DH_RSA_WITH_AES_256_GCM_SHA384 Not implemented.
|
||||
|
||||
TLS_DH_DSS_WITH_AES_128_CBC_SHA256 Not implemented.
|
||||
TLS_DH_DSS_WITH_AES_256_CBC_SHA256 Not implemented.
|
||||
TLS_DH_DSS_WITH_AES_128_GCM_SHA256 Not implemented.
|
||||
TLS_DH_DSS_WITH_AES_256_GCM_SHA384 Not implemented.
|
||||
|
||||
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 DHE-RSA-AES128-SHA256
|
||||
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 DHE-RSA-AES256-SHA256
|
||||
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 DHE-RSA-AES128-GCM-SHA256
|
||||
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 DHE-RSA-AES256-GCM-SHA384
|
||||
|
||||
TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 DHE-DSS-AES128-SHA256
|
||||
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 DHE-DSS-AES256-SHA256
|
||||
TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 DHE-DSS-AES128-GCM-SHA256
|
||||
TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 DHE-DSS-AES256-GCM-SHA384
|
||||
|
||||
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 ECDH-RSA-AES128-SHA256
|
||||
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 ECDH-RSA-AES256-SHA384
|
||||
TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 ECDH-RSA-AES128-GCM-SHA256
|
||||
TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 ECDH-RSA-AES256-GCM-SHA384
|
||||
|
||||
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 ECDH-ECDSA-AES128-SHA256
|
||||
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 ECDH-ECDSA-AES256-SHA384
|
||||
TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 ECDH-ECDSA-AES128-GCM-SHA256
|
||||
TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 ECDH-ECDSA-AES256-GCM-SHA384
|
||||
|
||||
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 ECDHE-RSA-AES128-SHA256
|
||||
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 ECDHE-RSA-AES256-SHA384
|
||||
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256
|
||||
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ECDHE-RSA-AES256-GCM-SHA384
|
||||
|
||||
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 ECDHE-ECDSA-AES128-SHA256
|
||||
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 ECDHE-ECDSA-AES256-SHA384
|
||||
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ECDHE-ECDSA-AES128-GCM-SHA256
|
||||
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 ECDHE-ECDSA-AES256-GCM-SHA384
|
||||
|
||||
TLS_DH_anon_WITH_AES_128_CBC_SHA256 ADH-AES128-SHA256
|
||||
TLS_DH_anon_WITH_AES_256_CBC_SHA256 ADH-AES256-SHA256
|
||||
TLS_DH_anon_WITH_AES_128_GCM_SHA256 ADH-AES128-GCM-SHA256
|
||||
TLS_DH_anon_WITH_AES_256_GCM_SHA384 ADH-AES256-GCM-SHA384
|
||||
|
||||
=head2 Pre shared keying (PSK) cipheruites
|
||||
|
||||
TLS_PSK_WITH_RC4_128_SHA PSK-RC4-SHA
|
||||
TLS_PSK_WITH_3DES_EDE_CBC_SHA PSK-3DES-EDE-CBC-SHA
|
||||
TLS_PSK_WITH_AES_128_CBC_SHA PSK-AES128-CBC-SHA
|
||||
TLS_PSK_WITH_AES_256_CBC_SHA PSK-AES256-CBC-SHA
|
||||
|
||||
=head2 Deprecated SSL v2.0 cipher suites.
|
||||
|
||||
SSL_CK_RC4_128_WITH_MD5 RC4-MD5
|
||||
SSL_CK_RC4_128_EXPORT40_WITH_MD5 EXP-RC4-MD5
|
||||
|
@ -452,6 +598,11 @@ strength:
|
|||
|
||||
openssl ciphers -v 'ALL:!ADH:@STRENGTH'
|
||||
|
||||
Include all ciphers except ones with no encryption (eNULL) or no
|
||||
authentication (aNULL):
|
||||
|
||||
openssl ciphers -v 'ALL:!aNULL'
|
||||
|
||||
Include only 3DES ciphers and then place RSA ciphers last:
|
||||
|
||||
openssl ciphers -v '3DES:+RSA'
|
||||
|
|
|
@ -143,7 +143,7 @@ output an error.
|
|||
|
||||
=item B<-EncryptedData_encrypt>
|
||||
|
||||
Encrypt suppled content using supplied symmetric key and algorithm using a CMS
|
||||
Encrypt content using supplied symmetric key and algorithm using a CMS
|
||||
B<EncrytedData> type and output the content.
|
||||
|
||||
=item B<-sign_receipt>
|
||||
|
|
|
@ -12,6 +12,7 @@ B<openssl> B<crl>
|
|||
[B<-text>]
|
||||
[B<-in filename>]
|
||||
[B<-out filename>]
|
||||
[B<-nameopt option>]
|
||||
[B<-noout>]
|
||||
[B<-hash>]
|
||||
[B<-issuer>]
|
||||
|
@ -53,6 +54,11 @@ default.
|
|||
|
||||
print out the CRL in text form.
|
||||
|
||||
=item B<-nameopt option>
|
||||
|
||||
option which determines how the subject or issuer names are displayed. See
|
||||
the description of B<-nameopt> in L<x509(1)|x509(1)>.
|
||||
|
||||
=item B<-noout>
|
||||
|
||||
don't output the encoded version of the CRL.
|
||||
|
|
|
@ -12,6 +12,7 @@ B<openssl dhparam>
|
|||
[B<-in> I<filename>]
|
||||
[B<-out> I<filename>]
|
||||
[B<-dsaparam>]
|
||||
[B<-check>]
|
||||
[B<-noout>]
|
||||
[B<-text>]
|
||||
[B<-C>]
|
||||
|
@ -64,6 +65,10 @@ exchange more efficient. Beware that with such DSA-style DH
|
|||
parameters, a fresh DH key should be created for each use to
|
||||
avoid small-subgroup attacks that may be possible otherwise.
|
||||
|
||||
=item B<-check>
|
||||
|
||||
check if the parameters are valid primes and generator.
|
||||
|
||||
=item B<-2>, B<-5>
|
||||
|
||||
The generator to use, either 2 or 5. 2 is the default. If present then the
|
||||
|
|
|
@ -13,6 +13,12 @@ B<openssl> B<dsa>
|
|||
[B<-passin arg>]
|
||||
[B<-out filename>]
|
||||
[B<-passout arg>]
|
||||
[B<-aes128>]
|
||||
[B<-aes192>]
|
||||
[B<-aes256>]
|
||||
[B<-camellia128>]
|
||||
[B<-camellia192>]
|
||||
[B<-camellia256>]
|
||||
[B<-des>]
|
||||
[B<-des3>]
|
||||
[B<-idea>]
|
||||
|
@ -74,10 +80,10 @@ filename.
|
|||
the output file password source. For more information about the format of B<arg>
|
||||
see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
|
||||
|
||||
=item B<-des|-des3|-idea>
|
||||
=item B<-aes128|-aes192|-aes256|-camellia128|-camellia192|-camellia256|-des|-des3|-idea>
|
||||
|
||||
These options encrypt the private key with the DES, triple DES, or the
|
||||
IDEA ciphers respectively before outputting it. A pass phrase is prompted for.
|
||||
These options encrypt the private key with the specified
|
||||
cipher before outputting it. A pass phrase is prompted for.
|
||||
If none of these options is specified the key is written in plain text. This
|
||||
means that using the B<dsa> utility to read in an encrypted key with no
|
||||
encryption option can be used to remove the pass phrase from a key, or by
|
||||
|
|
|
@ -16,7 +16,7 @@ B<openssl ecparam>
|
|||
[B<-C>]
|
||||
[B<-check>]
|
||||
[B<-name arg>]
|
||||
[B<-list_curve>]
|
||||
[B<-list_curves>]
|
||||
[B<-conv_form arg>]
|
||||
[B<-param_enc arg>]
|
||||
[B<-no_seed>]
|
||||
|
|
|
@ -8,6 +8,12 @@ gendsa - generate a DSA private key from a set of parameters
|
|||
|
||||
B<openssl> B<gendsa>
|
||||
[B<-out filename>]
|
||||
[B<-aes128>]
|
||||
[B<-aes192>]
|
||||
[B<-aes256>]
|
||||
[B<-camellia128>]
|
||||
[B<-camellia192>]
|
||||
[B<-camellia256>]
|
||||
[B<-des>]
|
||||
[B<-des3>]
|
||||
[B<-idea>]
|
||||
|
@ -24,10 +30,10 @@ The B<gendsa> command generates a DSA private key from a DSA parameter file
|
|||
|
||||
=over 4
|
||||
|
||||
=item B<-des|-des3|-idea>
|
||||
=item B<-aes128|-aes192|-aes256|-camellia128|-camellia192|-camellia256|-des|-des3|-idea>
|
||||
|
||||
These options encrypt the private key with the DES, triple DES, or the
|
||||
IDEA ciphers respectively before outputting it. A pass phrase is prompted for.
|
||||
These options encrypt the private key with specified
|
||||
cipher before outputting it. A pass phrase is prompted for.
|
||||
If none of these options is specified no encryption is used.
|
||||
|
||||
=item B<-rand file(s)>
|
||||
|
|
|
@ -9,6 +9,18 @@ genrsa - generate an RSA private key
|
|||
B<openssl> B<genrsa>
|
||||
[B<-out filename>]
|
||||
[B<-passout arg>]
|
||||
[B<-aes128>]
|
||||
[B<-aes128>]
|
||||
[B<-aes192>]
|
||||
[B<-aes256>]
|
||||
[B<-camellia128>]
|
||||
[B<-camellia192>]
|
||||
[B<-camellia256>]
|
||||
[B<-aes192>]
|
||||
[B<-aes256>]
|
||||
[B<-camellia128>]
|
||||
[B<-camellia192>]
|
||||
[B<-camellia256>]
|
||||
[B<-des>]
|
||||
[B<-des3>]
|
||||
[B<-idea>]
|
||||
|
@ -36,10 +48,10 @@ used.
|
|||
the output file password source. For more information about the format of B<arg>
|
||||
see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
|
||||
|
||||
=item B<-des|-des3|-idea>
|
||||
=item B<-aes128|-aes192|-aes256|-camellia128|-camellia192|-camellia256|-des|-des3|-idea>
|
||||
|
||||
These options encrypt the private key with the DES, triple DES, or the
|
||||
IDEA ciphers respectively before outputting it. If none of these options is
|
||||
These options encrypt the private key with specified
|
||||
cipher before outputting it. If none of these options is
|
||||
specified no encryption is used. If encryption is used a pass phrase is prompted
|
||||
for if it is not supplied via the B<-passout> argument.
|
||||
|
||||
|
|
|
@ -15,6 +15,12 @@ B<openssl> B<rsa>
|
|||
[B<-out filename>]
|
||||
[B<-passout arg>]
|
||||
[B<-sgckey>]
|
||||
[B<-aes128>]
|
||||
[B<-aes192>]
|
||||
[B<-aes256>]
|
||||
[B<-camellia128>]
|
||||
[B<-camellia192>]
|
||||
[B<-camellia256>]
|
||||
[B<-des>]
|
||||
[B<-des3>]
|
||||
[B<-idea>]
|
||||
|
@ -82,10 +88,10 @@ see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
|
|||
use the modified NET algorithm used with some versions of Microsoft IIS and SGC
|
||||
keys.
|
||||
|
||||
=item B<-des|-des3|-idea>
|
||||
=item B<-aes128|-aes192|-aes256|-camellia128|-camellia192|-camellia256|-des|-des3|-idea>
|
||||
|
||||
These options encrypt the private key with the DES, triple DES, or the
|
||||
IDEA ciphers respectively before outputting it. A pass phrase is prompted for.
|
||||
These options encrypt the private key with the specified
|
||||
cipher before outputting it. A pass phrase is prompted for.
|
||||
If none of these options is specified the key is written in plain text. This
|
||||
means that using the B<rsa> utility to read in an encrypted key with no
|
||||
encryption option can be used to remove the pass phrase from a key, or by
|
||||
|
|
|
@ -9,6 +9,7 @@ s_client - SSL/TLS client program
|
|||
|
||||
B<openssl> B<s_client>
|
||||
[B<-connect host:port>]
|
||||
[B<-servername name>]
|
||||
[B<-verify depth>]
|
||||
[B<-verify_return_error>]
|
||||
[B<-cert filename>]
|
||||
|
@ -28,6 +29,7 @@ B<openssl> B<s_client>
|
|||
[B<-nbio>]
|
||||
[B<-crlf>]
|
||||
[B<-ign_eof>]
|
||||
[B<-no_ign_eof>]
|
||||
[B<-quiet>]
|
||||
[B<-ssl2>]
|
||||
[B<-ssl3>]
|
||||
|
@ -37,6 +39,7 @@ B<openssl> B<s_client>
|
|||
[B<-no_tls1>]
|
||||
[B<-bugs>]
|
||||
[B<-cipher cipherlist>]
|
||||
[B<-serverpref>]
|
||||
[B<-starttls protocol>]
|
||||
[B<-engine id>]
|
||||
[B<-tlsextdebug>]
|
||||
|
@ -44,6 +47,8 @@ B<openssl> B<s_client>
|
|||
[B<-sess_out filename>]
|
||||
[B<-sess_in filename>]
|
||||
[B<-rand file(s)>]
|
||||
[B<-status>]
|
||||
[B<-nextprotoneg protocols>]
|
||||
|
||||
=head1 DESCRIPTION
|
||||
|
||||
|
@ -60,6 +65,10 @@ SSL servers.
|
|||
This specifies the host and optional port to connect to. If not specified
|
||||
then an attempt is made to connect to the local host on port 4433.
|
||||
|
||||
=item B<-servername name>
|
||||
|
||||
Set the TLS SNI (Server Name Indication) extension in the ClientHello message.
|
||||
|
||||
=item B<-cert certname>
|
||||
|
||||
The certificate to use, if one is requested by the server. The default is
|
||||
|
@ -172,6 +181,11 @@ input.
|
|||
inhibit printing of session and certificate information. This implicitly
|
||||
turns on B<-ign_eof> as well.
|
||||
|
||||
=item B<-no_ign_eof>
|
||||
|
||||
shut down the connection when end of file is reached in the input.
|
||||
Can be used to override the implicit B<-ign_eof> after B<-quiet>.
|
||||
|
||||
=item B<-psk_identity identity>
|
||||
|
||||
Use the PSK identity B<identity> when using a PSK cipher suite.
|
||||
|
@ -205,6 +219,10 @@ the server determines which cipher suite is used it should take the first
|
|||
supported cipher in the list sent by the client. See the B<ciphers>
|
||||
command for more information.
|
||||
|
||||
=item B<-serverpref>
|
||||
|
||||
use the server's cipher preferences; only used for SSLV2.
|
||||
|
||||
=item B<-starttls protocol>
|
||||
|
||||
send the protocol-specific message(s) to switch to TLS for communication.
|
||||
|
@ -243,6 +261,22 @@ Multiple files can be specified separated by a OS-dependent character.
|
|||
The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for
|
||||
all others.
|
||||
|
||||
=item B<-status>
|
||||
|
||||
sends a certificate status request to the server (OCSP stapling). The server
|
||||
response (if any) is printed out.
|
||||
|
||||
=item B<-nextprotoneg protocols>
|
||||
|
||||
enable Next Protocol Negotiation TLS extension and provide a list of
|
||||
comma-separated protocol names that the client should advertise
|
||||
support for. The list should contain most wanted protocols first.
|
||||
Protocol names are printable ASCII strings, for example "http/1.1" or
|
||||
"spdy/3".
|
||||
Empty list of protocols is treated specially and will cause the client to
|
||||
advertise support for the TLS extension but disconnect just after
|
||||
reciving ServerHello with a list of server supported protocols.
|
||||
|
||||
=back
|
||||
|
||||
=head1 CONNECTED COMMANDS
|
||||
|
|
|
@ -35,6 +35,7 @@ B<openssl> B<s_server>
|
|||
[B<-CAfile filename>]
|
||||
[B<-nocert>]
|
||||
[B<-cipher cipherlist>]
|
||||
[B<-serverpref>]
|
||||
[B<-quiet>]
|
||||
[B<-no_tmp_rsa>]
|
||||
[B<-ssl2>]
|
||||
|
@ -55,6 +56,11 @@ B<openssl> B<s_server>
|
|||
[B<-no_ticket>]
|
||||
[B<-id_prefix arg>]
|
||||
[B<-rand file(s)>]
|
||||
[B<-status>]
|
||||
[B<-status_verbose>]
|
||||
[B<-status_timeout nsec>]
|
||||
[B<-status_url url>]
|
||||
[B<-nextprotoneg protocols>]
|
||||
|
||||
=head1 DESCRIPTION
|
||||
|
||||
|
@ -150,6 +156,9 @@ the client. With the B<-verify> option a certificate is requested but the
|
|||
client does not have to send one, with the B<-Verify> option the client
|
||||
must supply a certificate or an error occurs.
|
||||
|
||||
If the ciphersuite cannot request a client certificate (for example an
|
||||
anonymous ciphersuite or PSK) this option has no effect.
|
||||
|
||||
=item B<-crl_check>, B<-crl_check_all>
|
||||
|
||||
Check the peer certificate has not been revoked by its CA.
|
||||
|
@ -231,6 +240,10 @@ also included in the server list is used. Because the client specifies
|
|||
the preference order, the order of the server cipherlist irrelevant. See
|
||||
the B<ciphers> command for more information.
|
||||
|
||||
=item B<-serverpref>
|
||||
|
||||
use the server's cipher preferences, rather than the client's preferences.
|
||||
|
||||
=item B<-tlsextdebug>
|
||||
|
||||
print out a hex dump of any TLS extensions received from the server.
|
||||
|
@ -282,6 +295,33 @@ Multiple files can be specified separated by a OS-dependent character.
|
|||
The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for
|
||||
all others.
|
||||
|
||||
=item B<-status>
|
||||
|
||||
enables certificate status request support (aka OCSP stapling).
|
||||
|
||||
=item B<-status_verbose>
|
||||
|
||||
enables certificate status request support (aka OCSP stapling) and gives
|
||||
a verbose printout of the OCSP response.
|
||||
|
||||
=item B<-status_timeout nsec>
|
||||
|
||||
sets the timeout for OCSP response to B<nsec> seconds.
|
||||
|
||||
=item B<-status_url url>
|
||||
|
||||
sets a fallback responder URL to use if no responder URL is present in the
|
||||
server certificate. Without this option an error is returned if the server
|
||||
certificate does not contain a responder address.
|
||||
|
||||
=item B<-nextprotoneg protocols>
|
||||
|
||||
enable Next Protocol Negotiation TLS extension and provide a
|
||||
comma-separated list of supported protocol names.
|
||||
The list should contain most wanted protocols first.
|
||||
Protocol names are printable ASCII strings, for example "http/1.1" or
|
||||
"spdy/3".
|
||||
|
||||
=back
|
||||
|
||||
=head1 CONNECTED COMMANDS
|
||||
|
|
|
@ -48,7 +48,6 @@ of the B<x509> utility). Under Unix the B<c_rehash> script will automatically
|
|||
create symbolic links to a directory of certificates.
|
||||
|
||||
=item B<-CAfile file>
|
||||
|
||||
A file of trusted certificates. The file should contain multiple certificates
|
||||
in PEM format concatenated together.
|
||||
|
||||
|
|
|
@ -19,6 +19,7 @@ B<openssl> B<x509>
|
|||
[B<-hash>]
|
||||
[B<-subject_hash>]
|
||||
[B<-issuer_hash>]
|
||||
[B<-ocspid>]
|
||||
[B<-subject>]
|
||||
[B<-issuer>]
|
||||
[B<-nameopt option>]
|
||||
|
@ -28,6 +29,7 @@ B<openssl> B<x509>
|
|||
[B<-enddate>]
|
||||
[B<-purpose>]
|
||||
[B<-dates>]
|
||||
[B<-checkend num>]
|
||||
[B<-modulus>]
|
||||
[B<-pubkey>]
|
||||
[B<-fingerprint>]
|
||||
|
@ -42,6 +44,7 @@ B<openssl> B<x509>
|
|||
[B<-days arg>]
|
||||
[B<-set_serial n>]
|
||||
[B<-signkey filename>]
|
||||
[B<-passin arg>]
|
||||
[B<-x509toreq>]
|
||||
[B<-req>]
|
||||
[B<-CA filename>]
|
||||
|
@ -49,6 +52,7 @@ B<openssl> B<x509>
|
|||
[B<-CAcreateserial>]
|
||||
[B<-CAserial filename>]
|
||||
[B<-text>]
|
||||
[B<-certopt option>]
|
||||
[B<-C>]
|
||||
[B<-md2|-md5|-sha1|-mdc2>]
|
||||
[B<-clrext>]
|
||||
|
@ -159,6 +163,10 @@ name.
|
|||
|
||||
outputs the "hash" of the certificate issuer name.
|
||||
|
||||
=item B<-ocspid>
|
||||
|
||||
outputs the OCSP hash values for the subject name and public key.
|
||||
|
||||
=item B<-hash>
|
||||
|
||||
synonym for "-subject_hash" for backward compatibility reasons.
|
||||
|
@ -208,6 +216,11 @@ prints out the expiry date of the certificate, that is the notAfter date.
|
|||
|
||||
prints out the start and expiry dates of a certificate.
|
||||
|
||||
=item B<-checkend arg>
|
||||
|
||||
checks if the certificate expires within the next B<arg> seconds and exits
|
||||
non-zero if yes it will expire or zero if not.
|
||||
|
||||
=item B<-fingerprint>
|
||||
|
||||
prints out the digest of the DER encoded version of the whole certificate
|
||||
|
@ -313,6 +326,11 @@ If the input is a certificate request then a self signed certificate
|
|||
is created using the supplied private key using the subject name in
|
||||
the request.
|
||||
|
||||
=item B<-passin arg>
|
||||
|
||||
the key password source. For more information about the format of B<arg>
|
||||
see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
|
||||
|
||||
=item B<-clrext>
|
||||
|
||||
delete any extensions from a certificate. This option is used when a
|
||||
|
@ -468,7 +486,7 @@ using the format \UXXXX for 16 bits and \WXXXXXXXX for 32 bits.
|
|||
Also if this option is off any UTF8Strings will be converted to their
|
||||
character form first.
|
||||
|
||||
=item B<no_type>
|
||||
=item B<ignore_type>
|
||||
|
||||
this option does not attempt to interpret multibyte characters in any
|
||||
way. That is their content octets are merely dumped as though one octet
|
||||
|
|
|
@ -174,7 +174,7 @@ The IP address used in the B<IP> options can be in either IPv4 or IPv6 format.
|
|||
|
||||
The value of B<dirName> should point to a section containing the distinguished
|
||||
name to use as a set of name value pairs. Multi values AVAs can be formed by
|
||||
preceeding the name with a B<+> character.
|
||||
prefacing the name with a B<+> character.
|
||||
|
||||
otherName can include arbitrary data associated with an OID: the value
|
||||
should be the OID followed by a semicolon and the content in standard
|
||||
|
|
|
@ -61,7 +61,7 @@ Encode the B<NULL> type, the B<value> string must not be present.
|
|||
=item B<INTEGER>, B<INT>
|
||||
|
||||
Encodes an ASN1 B<INTEGER> type. The B<value> string represents
|
||||
the value of the integer, it can be preceeded by a minus sign and
|
||||
the value of the integer, it can be prefaced by a minus sign and
|
||||
is normally interpreted as a decimal value unless the prefix B<0x>
|
||||
is included.
|
||||
|
||||
|
|
|
@ -46,11 +46,11 @@ to standard output:
|
|||
|
||||
b64 = BIO_new(BIO_f_base64());
|
||||
bio = BIO_new_fp(stdout, BIO_NOCLOSE);
|
||||
bio = BIO_push(b64, bio);
|
||||
BIO_write(bio, message, strlen(message));
|
||||
BIO_flush(bio);
|
||||
BIO_push(b64, bio);
|
||||
BIO_write(b64, message, strlen(message));
|
||||
BIO_flush(b64);
|
||||
|
||||
BIO_free_all(bio);
|
||||
BIO_free_all(b64);
|
||||
|
||||
Read Base64 encoded data from standard input and write the decoded
|
||||
data to standard output:
|
||||
|
@ -62,11 +62,12 @@ data to standard output:
|
|||
b64 = BIO_new(BIO_f_base64());
|
||||
bio = BIO_new_fp(stdin, BIO_NOCLOSE);
|
||||
bio_out = BIO_new_fp(stdout, BIO_NOCLOSE);
|
||||
bio = BIO_push(b64, bio);
|
||||
while((inlen = BIO_read(bio, inbuf, 512)) > 0)
|
||||
BIO_push(b64, bio);
|
||||
while((inlen = BIO_read(b64, inbuf, 512)) > 0)
|
||||
BIO_write(bio_out, inbuf, inlen);
|
||||
|
||||
BIO_free_all(bio);
|
||||
BIO_flush(bio_out);
|
||||
BIO_free_all(b64);
|
||||
|
||||
=head1 BUGS
|
||||
|
||||
|
|
|
@ -40,7 +40,7 @@ If the call:
|
|||
|
||||
BIO_push(b64, f);
|
||||
|
||||
is made then the new chain will be B<b64-chain>. After making the calls
|
||||
is made then the new chain will be B<b64-f>. After making the calls
|
||||
|
||||
BIO_push(md2, b64);
|
||||
BIO_push(md1, md2);
|
||||
|
|
|
@ -49,10 +49,10 @@ additionally store the file name and line number where
|
|||
the error occurred in *B<file> and *B<line>, unless these are B<NULL>.
|
||||
|
||||
ERR_get_error_line_data(), ERR_peek_error_line_data() and
|
||||
ERR_get_last_error_line_data() store additional data and flags
|
||||
ERR_peek_last_error_line_data() store additional data and flags
|
||||
associated with the error code in *B<data>
|
||||
and *B<flags>, unless these are B<NULL>. *B<data> contains a string
|
||||
if *B<flags>&B<ERR_TXT_STRING> is true.
|
||||
if *B<flags>&B<ERR_TXT_STRING> is true.
|
||||
|
||||
An application B<MUST NOT> free the *B<data> pointer (or any other pointers
|
||||
returned by these functions) with OPENSSL_free() as freeing is handled
|
||||
|
|
|
@ -161,9 +161,8 @@ EVP_MD_CTX_copy_ex() returns 1 if successful or 0 for failure.
|
|||
EVP_MD_type(), EVP_MD_pkey_type() and EVP_MD_type() return the NID of the
|
||||
corresponding OBJECT IDENTIFIER or NID_undef if none exists.
|
||||
|
||||
EVP_MD_size(), EVP_MD_block_size(), EVP_MD_CTX_size(e), EVP_MD_size(),
|
||||
EVP_MD_CTX_block_size() and EVP_MD_block_size() return the digest or block
|
||||
size in bytes.
|
||||
EVP_MD_size(), EVP_MD_block_size(), EVP_MD_CTX_size() and
|
||||
EVP_MD_CTX_block_size() return the digest or block size in bytes.
|
||||
|
||||
EVP_md_null(), EVP_md2(), EVP_md5(), EVP_sha(), EVP_sha1(), EVP_dss(),
|
||||
EVP_dss1(), EVP_mdc2() and EVP_ripemd160() return pointers to the
|
||||
|
|
|
@ -344,7 +344,10 @@ bits and 12 rounds.
|
|||
|
||||
Where possible the B<EVP> interface to symmetric ciphers should be used in
|
||||
preference to the low level interfaces. This is because the code then becomes
|
||||
transparent to the cipher used and much more flexible.
|
||||
transparent to the cipher used and much more flexible. Additionally, the
|
||||
B<EVP> interface will ensure the use of platform specific cryptographic
|
||||
acceleration such as AES-NI (the low level interfaces do not provide the
|
||||
guarantee).
|
||||
|
||||
PKCS padding works by adding B<n> padding bytes of value B<n> to make the total
|
||||
length of the encrypted data a multiple of the block size. Padding is always
|
||||
|
|
|
@ -30,9 +30,11 @@ signature context B<ctx>. This function can be called several times on the
|
|||
same B<ctx> to include additional data.
|
||||
|
||||
EVP_SignFinal() signs the data in B<ctx> using the private key B<pkey> and
|
||||
places the signature in B<sig>. The number of bytes of data written (i.e. the
|
||||
length of the signature) will be written to the integer at B<s>, at most
|
||||
EVP_PKEY_size(pkey) bytes will be written.
|
||||
places the signature in B<sig>. B<sig> must be at least EVP_PKEY_size(pkey)
|
||||
bytes in size. B<s> is an OUT paramter, and not used as an IN parameter.
|
||||
The number of bytes of data written (i.e. the length of the signature)
|
||||
will be written to the integer at B<s>, at most EVP_PKEY_size(pkey) bytes
|
||||
will be written.
|
||||
|
||||
EVP_SignInit() initializes a signing context B<ctx> to use the default
|
||||
implementation of digest B<type>.
|
||||
|
|
|
@ -125,14 +125,18 @@ the default method is used.
|
|||
/* sign. For backward compatibility, this is used only
|
||||
* if (flags & RSA_FLAG_SIGN_VER)
|
||||
*/
|
||||
int (*rsa_sign)(int type, unsigned char *m, unsigned int m_len,
|
||||
unsigned char *sigret, unsigned int *siglen, RSA *rsa);
|
||||
|
||||
int (*rsa_sign)(int type,
|
||||
const unsigned char *m, unsigned int m_length,
|
||||
unsigned char *sigret, unsigned int *siglen, const RSA *rsa);
|
||||
/* verify. For backward compatibility, this is used only
|
||||
* if (flags & RSA_FLAG_SIGN_VER)
|
||||
*/
|
||||
int (*rsa_verify)(int type, unsigned char *m, unsigned int m_len,
|
||||
unsigned char *sigbuf, unsigned int siglen, RSA *rsa);
|
||||
int (*rsa_verify)(int dtype,
|
||||
const unsigned char *m, unsigned int m_length,
|
||||
const unsigned char *sigbuf, unsigned int siglen,
|
||||
const RSA *rsa);
|
||||
/* keygen. If NULL builtin RSA key generation will be used */
|
||||
int (*rsa_keygen)(RSA *rsa, int bits, BIGNUM *e, BN_GENCB *cb);
|
||||
|
||||
} RSA_METHOD;
|
||||
|
||||
|
|
|
@ -20,6 +20,10 @@ RSA_sign() signs the message digest B<m> of size B<m_len> using the
|
|||
private key B<rsa> as specified in PKCS #1 v2.0. It stores the
|
||||
signature in B<sigret> and the signature size in B<siglen>. B<sigret>
|
||||
must point to RSA_size(B<rsa>) bytes of memory.
|
||||
Note that PKCS #1 adds meta-data, placing limits on the size of the
|
||||
key that can be used.
|
||||
See L<RSA_private_encrypt(3)|RSA_private_encrypt(3)> for lower-level
|
||||
operations.
|
||||
|
||||
B<type> denotes the message digest algorithm that was used to generate
|
||||
B<m>. It usually is one of B<NID_sha1>, B<NID_ripemd160> and B<NID_md5>;
|
||||
|
|
|
@ -135,9 +135,8 @@ depend on a global variable.
|
|||
|
||||
DES_set_odd_parity() sets the parity of the passed I<key> to odd.
|
||||
|
||||
DES_is_weak_key() returns 1 is the passed key is a weak key, 0 if it
|
||||
is ok. The probability that a randomly generated key is weak is
|
||||
1/2^52, so it is not really worth checking for them.
|
||||
DES_is_weak_key() returns 1 if the passed key is a weak key, 0 if it
|
||||
is ok.
|
||||
|
||||
The following routines mostly operate on an input and output stream of
|
||||
I<DES_cblock>s.
|
||||
|
@ -181,7 +180,7 @@ of 24 bytes. This is much better than CBC DES.
|
|||
|
||||
DES_ede3_cbc_encrypt() implements outer triple CBC DES encryption with
|
||||
three keys. This means that each DES operation inside the CBC mode is
|
||||
really an C<C=E(ks3,D(ks2,E(ks1,M)))>. This mode is used by SSL.
|
||||
an C<C=E(ks3,D(ks2,E(ks1,M)))>. This mode is used by SSL.
|
||||
|
||||
The DES_ede2_cbc_encrypt() macro implements two-key Triple-DES by
|
||||
reusing I<ks1> for the final encryption. C<C=E(ks1,D(ks2,E(ks1,M)))>.
|
||||
|
|
|
@ -171,7 +171,6 @@ ERR_get_string_table(void) respectively.
|
|||
|
||||
=head1 SEE ALSO
|
||||
|
||||
L<CRYPTO_set_id_callback(3)|CRYPTO_set_id_callback(3)>,
|
||||
L<CRYPTO_set_locking_callback(3)|CRYPTO_set_locking_callback(3)>,
|
||||
L<ERR_get_error(3)|ERR_get_error(3)>,
|
||||
L<ERR_GET_LIB(3)|ERR_GET_LIB(3)>,
|
||||
|
|
|
@ -450,9 +450,9 @@ byte B<salt> encoded as a set of hexadecimal digits.
|
|||
|
||||
After this is the base64 encoded encrypted data.
|
||||
|
||||
The encryption key is determined using EVP_bytestokey(), using B<salt> and an
|
||||
The encryption key is determined using EVP_BytesToKey(), using B<salt> and an
|
||||
iteration count of 1. The IV used is the value of B<salt> and *not* the IV
|
||||
returned by EVP_bytestokey().
|
||||
returned by EVP_BytesToKey().
|
||||
|
||||
=head1 BUGS
|
||||
|
||||
|
@ -474,3 +474,7 @@ The read routines return either a pointer to the structure read or NULL
|
|||
if an error occurred.
|
||||
|
||||
The write routines return 1 for success or 0 for failure.
|
||||
|
||||
=head1 SEE ALSO
|
||||
|
||||
L<EVP_get_cipherbyname(3)|EVP_get_cipherbyname>, L<EVP_BytesToKey(3)|EVP_BytesToKey(3)>
|
||||
|
|
|
@ -119,7 +119,7 @@ verification will fail.
|
|||
UI_add_input_boolean() adds a prompt to the UI that's supposed to be answered
|
||||
in a boolean way, with a single character for yes and a different character
|
||||
for no. A set of characters that can be used to cancel the prompt is given
|
||||
as well. The prompt itself is really divided in two, one part being the
|
||||
as well. The prompt itself is divided in two, one part being the
|
||||
descriptive text (given through the I<prompt> argument) and one describing
|
||||
the possible answers (given through the I<action_desc> argument).
|
||||
|
||||
|
|
|
@ -4,12 +4,11 @@ OpenSSL releases are signed with PGP/GnuPG keys. You can find the
|
|||
signatures in separate files in the same location you find the
|
||||
distributions themselves. The normal file name is the same as the
|
||||
distribution file, with '.asc' added. For example, the signature for
|
||||
the distribution of OpenSSL 0.9.7f, openssl-0.9.7f.tar.gz, is found in
|
||||
the file openssl-0.9.7f.tar.gz.asc.
|
||||
the distribution of OpenSSL 1.0.1h, openssl-1.0.1h.tar.gz, is found in
|
||||
the file openssl-1.0.1h.tar.gz.asc.
|
||||
|
||||
The following is the list of fingerprints for the keys that are
|
||||
currently in use (have been used since summer 2004) to sign OpenSSL
|
||||
distributions:
|
||||
currently in use to sign OpenSSL distributions:
|
||||
|
||||
pub 1024D/F709453B 2003-10-20
|
||||
Key fingerprint = C4CA B749 C34F 7F4C C04F DAC9 A7AF 9E78 F709 453B
|
||||
|
@ -34,10 +33,6 @@ uid Mark Cox <mjc@redhat.com>
|
|||
uid Mark Cox <mark@awe.com>
|
||||
uid Mark Cox <mjc@apache.org>
|
||||
|
||||
pub 1024R/26BB437D 1997-04-28
|
||||
Key fingerprint = 00 C9 21 8E D1 AB 70 37 DD 67 A2 3A 0A 6F 8D A5
|
||||
uid Ralf S. Engelschall <rse@engelschall.com>
|
||||
|
||||
pub 1024R/9C58A66D 1997-04-03
|
||||
Key fingerprint = 13 D0 B8 9D 37 30 C3 ED AC 9C 24 7D 45 8C 17 67
|
||||
uid jaenicke@openssl.org
|
||||
|
@ -62,3 +57,7 @@ uid Bodo Moeller <3moeller@informatik.uni-hamburg.de>
|
|||
uid Bodo Moeller <Bodo_Moeller@public.uni-hamburg.de>
|
||||
uid Bodo Moeller <3moeller@rzdspc5.informatik.uni-hamburg.de>
|
||||
|
||||
pub 2048R/0E604491 2013-04-30
|
||||
Key fingerprint = 8657 ABB2 60F0 56B1 E519 0839 D9C4 D26D 0E60 4491
|
||||
uid Matt Caswell <frodo@baggins.org>
|
||||
|
||||
|
|
|
@ -23,8 +23,12 @@ SSL_CIPHER_get_bits() returns the number of secret bits used for B<cipher>. If
|
|||
B<alg_bits> is not NULL, it contains the number of bits processed by the
|
||||
chosen algorithm. If B<cipher> is NULL, 0 is returned.
|
||||
|
||||
SSL_CIPHER_get_version() returns the protocol version for B<cipher>, currently
|
||||
"SSLv2", "SSLv3", or "TLSv1". If B<cipher> is NULL, "(NONE)" is returned.
|
||||
SSL_CIPHER_get_version() returns string which indicates the SSL/TLS protocol
|
||||
version that first defined the cipher.
|
||||
This is currently B<SSLv2> or B<TLSv1/SSLv3>.
|
||||
In some cases it should possibly return "TLSv1.2" but does not;
|
||||
use SSL_CIPHER_description() instead.
|
||||
If B<cipher> is NULL, "(NONE)" is returned.
|
||||
|
||||
SSL_CIPHER_description() returns a textual description of the cipher used
|
||||
into the buffer B<buf> of length B<len> provided. B<len> must be at least
|
||||
|
@ -52,7 +56,8 @@ Textual representation of the cipher name.
|
|||
|
||||
=item <protocol version>
|
||||
|
||||
Protocol version: B<SSLv2>, B<SSLv3>. The TLSv1 ciphers are flagged with SSLv3.
|
||||
Protocol version: B<SSLv2>, B<SSLv3>, B<TLSv1.2>. The TLSv1.0 ciphers are
|
||||
flagged with SSLv3. No new ciphers were added by TLSv1.1.
|
||||
|
||||
=item Kx=<key exchange>
|
||||
|
||||
|
@ -91,6 +96,10 @@ Some examples for the output of SSL_CIPHER_description():
|
|||
RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
|
||||
EXP-RC4-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export
|
||||
|
||||
A comp[lete list can be retrieved by invoking the following command:
|
||||
|
||||
openssl ciphers -v ALL
|
||||
|
||||
=head1 BUGS
|
||||
|
||||
If SSL_CIPHER_description() is called with B<cipher> being NULL, the
|
||||
|
|
|
@ -24,6 +24,16 @@ the library will try to complete the chain from the available CA
|
|||
certificates in the trusted CA storage, see
|
||||
L<SSL_CTX_load_verify_locations(3)|SSL_CTX_load_verify_locations(3)>.
|
||||
|
||||
The B<x509> certificate provided to SSL_CTX_add_extra_chain_cert() will be freed by the library when the B<SSL_CTX> is destroyed. An application B<should not> free the B<x509> object.
|
||||
|
||||
=head1 RESTRICTIONS
|
||||
|
||||
Only one set of extra chain certificates can be specified per SSL_CTX
|
||||
structure. Different chains for different certificates (for example if both
|
||||
RSA and DSA certificates are specified by the same server) or different SSL
|
||||
structures with the same parent SSL_CTX cannot be specified using this
|
||||
function.
|
||||
|
||||
=head1 RETURN VALUES
|
||||
|
||||
SSL_CTX_add_extra_chain_cert() returns 1 on success. Check out the
|
||||
|
|
|
@ -41,7 +41,7 @@ If a server SSL_CTX is configured with the SSL_SESS_CACHE_NO_INTERNAL_STORE
|
|||
flag then the internal cache will not be populated automatically by new
|
||||
sessions negotiated by the SSL/TLS implementation, even though the internal
|
||||
cache will be searched automatically for session-resume requests (the
|
||||
latter can be surpressed by SSL_SESS_CACHE_NO_INTERNAL_LOOKUP). So the
|
||||
latter can be suppressed by SSL_SESS_CACHE_NO_INTERNAL_LOOKUP). So the
|
||||
application can use SSL_CTX_add_session() directly to have full control
|
||||
over the sessions that can be resumed if desired.
|
||||
|
||||
|
|
|
@ -51,22 +51,36 @@ SSLv3 client hello messages.
|
|||
|
||||
=item SSLv23_method(void), SSLv23_server_method(void), SSLv23_client_method(void)
|
||||
|
||||
A TLS/SSL connection established with these methods will understand the SSLv2,
|
||||
SSLv3, and TLSv1 protocol. A client will send out SSLv2 client hello messages
|
||||
and will indicate that it also understands SSLv3 and TLSv1. A server will
|
||||
understand SSLv2, SSLv3, and TLSv1 client hello messages. This is the best
|
||||
choice when compatibility is a concern.
|
||||
A TLS/SSL connection established with these methods may understand the SSLv2,
|
||||
SSLv3, TLSv1, TLSv1.1 and TLSv1.2 protocols.
|
||||
|
||||
If the cipher list does not contain any SSLv2 ciphersuites (the default
|
||||
cipher list does not) or extensions are required (for example server name)
|
||||
a client will send out TLSv1 client hello messages including extensions and
|
||||
will indicate that it also understands TLSv1.1, TLSv1.2 and permits a
|
||||
fallback to SSLv3. A server will support SSLv3, TLSv1, TLSv1.1 and TLSv1.2
|
||||
protocols. This is the best choice when compatibility is a concern.
|
||||
|
||||
If any SSLv2 ciphersuites are included in the cipher list and no extensions
|
||||
are required then SSLv2 compatible client hellos will be used by clients and
|
||||
SSLv2 will be accepted by servers. This is B<not> recommended due to the
|
||||
insecurity of SSLv2 and the limited nature of the SSLv2 client hello
|
||||
prohibiting the use of extensions.
|
||||
|
||||
=back
|
||||
|
||||
The list of protocols available can later be limited using the SSL_OP_NO_SSLv2,
|
||||
SSL_OP_NO_SSLv3, SSL_OP_NO_TLSv1 options of the B<SSL_CTX_set_options()> or
|
||||
B<SSL_set_options()> functions. Using these options it is possible to choose
|
||||
e.g. SSLv23_server_method() and be able to negotiate with all possible
|
||||
clients, but to only allow newer protocols like SSLv3 or TLSv1.
|
||||
SSL_OP_NO_SSLv3, SSL_OP_NO_TLSv1, SSL_OP_NO_TLSv1_1 and SSL_OP_NO_TLSv1_2
|
||||
options of the SSL_CTX_set_options() or SSL_set_options() functions.
|
||||
Using these options it is possible to choose e.g. SSLv23_server_method() and
|
||||
be able to negotiate with all possible clients, but to only allow newer
|
||||
protocols like TLSv1, TLSv1.1 or TLS v1.2.
|
||||
|
||||
Applications which never want to support SSLv2 (even is the cipher string
|
||||
is configured to use SSLv2 ciphersuites) can set SSL_OP_NO_SSLv2.
|
||||
|
||||
SSL_CTX_new() initializes the list of ciphers, the session cache setting,
|
||||
the callbacks, the keys and certificates, and the options to its default
|
||||
the callbacks, the keys and certificates and the options to its default
|
||||
values.
|
||||
|
||||
=head1 RETURN VALUES
|
||||
|
|
|
@ -54,6 +54,10 @@ of 512 bits and the server is not configured to use temporary RSA
|
|||
keys), the "no shared cipher" (SSL_R_NO_SHARED_CIPHER) error is generated
|
||||
and the handshake will fail.
|
||||
|
||||
If the cipher list does not contain any SSLv2 cipher suites (this is the
|
||||
default) then SSLv2 is effectively disabled and neither clients nor servers
|
||||
will attempt to use SSLv2.
|
||||
|
||||
=head1 RETURN VALUES
|
||||
|
||||
SSL_CTX_set_cipher_list() and SSL_set_cipher_list() return 1 if any cipher
|
||||
|
|
|
@ -35,7 +35,7 @@ the chosen B<ssl>, overriding the setting valid for B<ssl>'s SSL_CTX object.
|
|||
=head1 NOTES
|
||||
|
||||
When a TLS/SSL server requests a client certificate (see
|
||||
B<SSL_CTX_set_verify_options()>), it sends a list of CAs, for which
|
||||
B<SSL_CTX_set_verify(3)>), it sends a list of CAs, for which
|
||||
it will accept certificates, to the client.
|
||||
|
||||
This list must explicitly be set using SSL_CTX_set_client_CA_list() for
|
||||
|
|
|
@ -29,7 +29,7 @@ using the B<x509> and B<pkey> arguments and "1" must be returned. The
|
|||
certificate will be installed into B<ssl>, see the NOTES and BUGS sections.
|
||||
If no certificate should be set, "0" has to be returned and no certificate
|
||||
will be sent. A negative return value will suspend the handshake and the
|
||||
handshake function will return immediatly. L<SSL_get_error(3)|SSL_get_error(3)>
|
||||
handshake function will return immediately. L<SSL_get_error(3)|SSL_get_error(3)>
|
||||
will return SSL_ERROR_WANT_X509_LOOKUP to indicate, that the handshake was
|
||||
suspended. The next call to the handshake function will again lead to the call
|
||||
of client_cert_cb(). It is the job of the client_cert_cb() to store information
|
||||
|
|
|
@ -256,7 +256,7 @@ Connections and renegotiation are always permitted by OpenSSL implementations.
|
|||
|
||||
=head2 Unpatched client and patched OpenSSL server
|
||||
|
||||
The initial connection suceeds but client renegotiation is denied by the
|
||||
The initial connection succeeds but client renegotiation is denied by the
|
||||
server with a B<no_renegotiation> warning alert if TLS v1.0 is used or a fatal
|
||||
B<handshake_failure> alert in SSL v3.0.
|
||||
|
||||
|
|
195
crypto/external/bsd/openssl/dist/doc/ssl/SSL_CTX_set_tlsext_ticket_key_cb.pod
vendored
Normal file
195
crypto/external/bsd/openssl/dist/doc/ssl/SSL_CTX_set_tlsext_ticket_key_cb.pod
vendored
Normal file
|
@ -0,0 +1,195 @@
|
|||
=pod
|
||||
|
||||
=head1 NAME
|
||||
|
||||
SSL_CTX_set_tlsext_ticket_key_cb - set a callback for session ticket processing
|
||||
|
||||
=head1 SYNOPSIS
|
||||
|
||||
#include <openssl/tls1.h>
|
||||
|
||||
long SSL_CTX_set_tlsext_ticket_key_cb(SSL_CTX sslctx,
|
||||
int (*cb)(SSL *s, unsigned char key_name[16],
|
||||
unsigned char iv[EVP_MAX_IV_LENGTH],
|
||||
EVP_CIPHER_CTX *ctx, HMAC_CTX *hctx, int enc));
|
||||
|
||||
=head1 DESCRIPTION
|
||||
|
||||
SSL_CTX_set_tlsext_ticket_key_cb() sets a callback fuction I<cb> for handling
|
||||
session tickets for the ssl context I<sslctx>. Session tickets, defined in
|
||||
RFC5077 provide an enhanced session resumption capability where the server
|
||||
implementation is not required to maintain per session state. It only applies
|
||||
to TLS and there is no SSLv3 implementation.
|
||||
|
||||
The callback is available when the OpenSSL library was built without
|
||||
I<OPENSSL_NO_TLSEXT> being defined.
|
||||
|
||||
The callback function I<cb> will be called for every client instigated TLS
|
||||
session when session ticket extension is presented in the TLS hello
|
||||
message. It is the responsibility of this function to create or retrieve the
|
||||
cryptographic parameters and to maintain their state.
|
||||
|
||||
The OpenSSL library uses your callback function to help implement a common TLS
|
||||
ticket construction state according to RFC5077 Section 4 such that per session
|
||||
state is unnecessary and a small set of cryptographic variables needs to be
|
||||
maintained by the callback function implementation.
|
||||
|
||||
In order to reuse a session, a TLS client must send the a session ticket
|
||||
extension to the server. The client can only send exactly one session ticket.
|
||||
The server, through the callback function, either agrees to reuse the session
|
||||
ticket information or it starts a full TLS handshake to create a new session
|
||||
ticket.
|
||||
|
||||
Before the callback function is started I<ctx> and I<hctx> have been
|
||||
initialised with EVP_CIPHER_CTX_init and HMAC_CTX_init respectively.
|
||||
|
||||
For new sessions tickets, when the client doesn't present a session ticket, or
|
||||
an attempted retreival of the ticket failed, or a renew option was indicated,
|
||||
the callback function will be called with I<enc> equal to 1. The OpenSSL
|
||||
library expects that the function will set an arbitary I<name>, initialize
|
||||
I<iv>, and set the cipher context I<ctx> and the hash context I<hctx>.
|
||||
|
||||
The I<name> is 16 characters long and is used as a key identifier.
|
||||
|
||||
The I<iv> length is the length of the IV of the corresponding cipher. The
|
||||
maximum IV length is L<EVP_MAX_IV_LENGTH> bytes defined in B<evp.h>.
|
||||
|
||||
The initialization vector I<iv> should be a random value. The cipher context
|
||||
I<ctx> should use the initialisation vector I<iv>. The cipher context can be
|
||||
set using L<EVP_EncryptInit_ex>. The hmac context can be set using L<HMAC_Init_ex>.
|
||||
|
||||
When the client presents a session ticket, the callback function with be called
|
||||
with I<enc> set to 0 indicating that the I<cb> function should retreive a set
|
||||
of parameters. In this case I<name> and I<iv> have already been parsed out of
|
||||
the session ticket. The OpenSSL library expects that the I<name> will be used
|
||||
to retrieve a cryptographic parameters and that the cryptographic context
|
||||
I<ctx> will be set with the retreived parameters and the initialization vector
|
||||
I<iv>. using a function like L<EVP_DecryptInit_ex>. The I<hctx> needs to be set
|
||||
using L<HMAC_Init_ex>.
|
||||
|
||||
If the I<name> is still valid but a renewal of the ticket is required the
|
||||
callback function should return 2. The library will call the callback again
|
||||
with an arguement of enc equal to 1 to set the new ticket.
|
||||
|
||||
The return value of the I<cb> function is used by OpenSSL to determine what
|
||||
further processing will occur. The following return values have meaning:
|
||||
|
||||
=over 4
|
||||
|
||||
=item Z<>2
|
||||
|
||||
This indicates that the I<ctx> and I<hctx> have been set and the session can
|
||||
continue on those parameters. Additionally it indicates that the session
|
||||
ticket is in a renewal period and should be replaced. The OpenSSL library will
|
||||
call I<cb> again with an enc argument of 1 to set the new ticket (see RFC5077
|
||||
3.3 paragraph 2).
|
||||
|
||||
=item Z<>1
|
||||
|
||||
This indicates that the I<ctx> and I<hctx> have been set and the session can
|
||||
continue on those parameters.
|
||||
|
||||
=item Z<>0
|
||||
|
||||
This indicates that it was not possible to set/retrieve a session ticket and
|
||||
the SSL/TLS session will continue by by negiotationing a set of cryptographic
|
||||
parameters or using the alternate SSL/TLS resumption mechanism, session ids.
|
||||
|
||||
If called with enc equal to 0 the library will call the I<cb> again to get
|
||||
a new set of parameters.
|
||||
|
||||
=item less than 0
|
||||
|
||||
This indicates an error.
|
||||
|
||||
=back
|
||||
|
||||
=head1 NOTES
|
||||
|
||||
Session resumption shortcuts the TLS so that the client certificate
|
||||
negiotation don't occur. It makes up for this by storing client certificate
|
||||
an all other negotiated state information encrypted within the ticket. In a
|
||||
resumed session the applications will have all this state information available
|
||||
exactly as if a full negiotation had occured.
|
||||
|
||||
If an attacker can obtain the key used to encrypt a session ticket, they can
|
||||
obtain the master secret for any ticket using that key and decrypt any traffic
|
||||
using that session: even if the ciphersuite supports forward secrecy. As
|
||||
a result applications may wish to use multiple keys and avoid using long term
|
||||
keys stored in files.
|
||||
|
||||
Applications can use longer keys to maintain a consistent level of security.
|
||||
For example if a ciphersuite uses 256 bit ciphers but only a 128 bit ticket key
|
||||
the overall security is only 128 bits because breaking the ticket key will
|
||||
enable an attacker to obtain the session keys.
|
||||
|
||||
=head1 EXAMPLES
|
||||
|
||||
Reference Implemention:
|
||||
SSL_CTX_set_tlsext_ticket_key_cb(SSL,ssl_tlsext_ticket_key_cb);
|
||||
....
|
||||
|
||||
static int ssl_tlsext_ticket_key_cb(SSL *s, unsigned char key_name[16], unsigned char *iv, EVP_CIPHER_CTX *ctx, HMAC_CTX *hctx, int enc)
|
||||
{
|
||||
if (enc) { /* create new session */
|
||||
if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) ) {
|
||||
return -1; /* insufficient random */
|
||||
}
|
||||
|
||||
key = currentkey(); /* something that you need to implement */
|
||||
if ( !key ) {
|
||||
/* current key doesn't exist or isn't valid */
|
||||
key = createkey(); /* something that you need to implement.
|
||||
* createkey needs to initialise, a name,
|
||||
* an aes_key, a hmac_key and optionally
|
||||
* an expire time. */
|
||||
if ( !key ) { /* key couldn't be created */
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
memcpy(key_name, key->name, 16);
|
||||
|
||||
EVP_EncryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL, key->aes_key, iv);
|
||||
HMAC_Init_ex(&hctx, key->hmac_key, 16, EVP_sha256(), NULL);
|
||||
|
||||
return 1;
|
||||
|
||||
} else { /* retrieve session */
|
||||
key = findkey(name);
|
||||
|
||||
if (!key || key->expire < now() ) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
HMAC_Init_ex(&hctx, key->hmac_key, 16, EVP_sha256(), NULL);
|
||||
EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL, key->aes_key, iv );
|
||||
|
||||
if (key->expire < ( now() - RENEW_TIME ) ) {
|
||||
/* return 2 - this session will get a new ticket even though the current is still valid */
|
||||
return 2;
|
||||
}
|
||||
return 1;
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
=head1 RETURN VALUES
|
||||
|
||||
returns 0 to indicate the callback function was set.
|
||||
|
||||
=head1 SEE ALSO
|
||||
|
||||
L<ssl(3)|ssl(3)>, L<SSL_set_session(3)|SSL_set_session(3)>,
|
||||
L<SSL_session_reused(3)|SSL_session_reused(3)>,
|
||||
L<SSL_CTX_add_session(3)|SSL_CTX_add_session(3)>,
|
||||
L<SSL_CTX_sess_number(3)|SSL_CTX_sess_number(3)>,
|
||||
L<SSL_CTX_sess_set_get_cb(3)|SSL_CTX_sess_set_get_cb(3)>,
|
||||
L<SSL_CTX_set_session_id_context(3)|SSL_CTX_set_session_id_context(3)>,
|
||||
|
||||
=head1 HISTORY
|
||||
|
||||
This function was introduced in OpenSSL 0.9.8h
|
||||
|
||||
=cut
|
|
@ -12,12 +12,10 @@ SSL_CTX_set_tmp_dh_callback, SSL_CTX_set_tmp_dh, SSL_set_tmp_dh_callback, SSL_se
|
|||
DH *(*tmp_dh_callback)(SSL *ssl, int is_export, int keylength));
|
||||
long SSL_CTX_set_tmp_dh(SSL_CTX *ctx, DH *dh);
|
||||
|
||||
void SSL_set_tmp_dh_callback(SSL_CTX *ctx,
|
||||
void SSL_set_tmp_dh_callback(SSL *ctx,
|
||||
DH *(*tmp_dh_callback)(SSL *ssl, int is_export, int keylength));
|
||||
long SSL_set_tmp_dh(SSL *ssl, DH *dh)
|
||||
|
||||
DH *(*tmp_dh_callback)(SSL *ssl, int is_export, int keylength));
|
||||
|
||||
=head1 DESCRIPTION
|
||||
|
||||
SSL_CTX_set_tmp_dh_callback() sets the callback function for B<ctx> to be
|
||||
|
@ -81,7 +79,7 @@ instead (see L<dhparam(1)|dhparam(1)>), but in this case SSL_OP_SINGLE_DH_USE
|
|||
is mandatory.
|
||||
|
||||
Application authors may compile in DH parameters. Files dh512.pem,
|
||||
dh1024.pem, dh2048.pem, and dh4096 in the 'apps' directory of current
|
||||
dh1024.pem, dh2048.pem, and dh4096.pem in the 'apps' directory of current
|
||||
version of the OpenSSL distribution contain the 'SKIP' DH parameters,
|
||||
which use safe primes and were generated verifiably pseudo-randomly.
|
||||
These files can be converted into C code using the B<-C> option of the
|
||||
|
|
|
@ -109,8 +109,8 @@ certificates would not be present, most likely a
|
|||
X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY will be issued.
|
||||
The depth count is "level 0:peer certificate", "level 1: CA certificate",
|
||||
"level 2: higher level CA certificate", and so on. Setting the maximum
|
||||
depth to 2 allows the levels 0, 1, and 2. The default depth limit is 9,
|
||||
allowing for the peer certificate and additional 9 CA certificates.
|
||||
depth to 2 allows the levels 0, 1, and 2. The default depth limit is 100,
|
||||
allowing for the peer certificate and additional 100 CA certificates.
|
||||
|
||||
The B<verify_callback> function is used to control the behaviour when the
|
||||
SSL_VERIFY_PEER flag is set. It must be supplied by the application and
|
||||
|
|
|
@ -12,12 +12,12 @@ SSL_get_version - get the protocol version of a connection.
|
|||
|
||||
=head1 DESCRIPTION
|
||||
|
||||
SSL_get_cipher_version() returns the name of the protocol used for the
|
||||
SSL_get_version() returns the name of the protocol used for the
|
||||
connection B<ssl>.
|
||||
|
||||
=head1 RETURN VALUES
|
||||
|
||||
The following strings can occur:
|
||||
The following strings can be returned:
|
||||
|
||||
=over 4
|
||||
|
||||
|
@ -31,7 +31,15 @@ The connection uses the SSLv3 protocol.
|
|||
|
||||
=item TLSv1
|
||||
|
||||
The connection uses the TLSv1 protocol.
|
||||
The connection uses the TLSv1.0 protocol.
|
||||
|
||||
=item TLSv1.1
|
||||
|
||||
The connection uses the TLSv1.1 protocol.
|
||||
|
||||
=item TLSv1.2
|
||||
|
||||
The connection uses the TLSv1.2 protocol.
|
||||
|
||||
=item unknown
|
||||
|
||||
|
|
|
@ -48,6 +48,16 @@ known limit on the size of the created ASN1 representation, so the necessary
|
|||
amount of space should be obtained by first calling i2d_SSL_SESSION() with
|
||||
B<pp=NULL>, and obtain the size needed, then allocate the memory and
|
||||
call i2d_SSL_SESSION() again.
|
||||
Note that this will advance the value contained in B<*pp> so it is necessary
|
||||
to save a copy of the original allocation.
|
||||
For example:
|
||||
int i,j;
|
||||
char *p, *temp;
|
||||
i = i2d_SSL_SESSION(sess, NULL);
|
||||
p = temp = malloc(i);
|
||||
j = i2d_SSL_SESSION(sess, &temp);
|
||||
assert(i == j);
|
||||
assert(p+i == temp);
|
||||
|
||||
=head1 RETURN VALUES
|
||||
|
||||
|
|
|
@ -7,7 +7,7 @@ Release: 1
|
|||
Summary: Secure Sockets Layer and cryptography libraries and tools
|
||||
Name: openssl
|
||||
#Version: %{libmaj}.%{libmin}.%{librel}
|
||||
Version: 1.0.1h
|
||||
Version: 1.0.1i
|
||||
Source0: ftp://ftp.openssl.org/source/%{name}-%{version}.tar.gz
|
||||
License: OpenSSL
|
||||
Group: System Environment/Libraries
|
||||
|
|
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue