diff options
author | RafaelGSS <rafael.nunu@hotmail.com> | 2022-05-09 20:24:57 +0300 |
---|---|---|
committer | Beth Griggs <bgriggs@redhat.com> | 2022-05-16 13:12:12 +0300 |
commit | 6365bf808ef310494127f558bcb3949c1d6cf56d (patch) | |
tree | 1fe2a484a63762e6ad31f736b2519ad7930d6a2e /deps | |
parent | 330e267a5717b54d9040cbb442edcfdb6689bf16 (diff) |
deps: upgrade openssl sources to quictls/openssl-3.0.3
This updates all sources in deps/openssl/openssl by:
$ git clone git@github.com:quictls/openssl.git
$ cd openssl
$ git checkout openssl-3.0.3+quic
$ cd ../node/deps/openssl
$ rm -rf openssl
$ cp -R ../../../openssl openssl
$ rm -rf openssl/.git* openssl/.travis*
$ git add --all openssl
$ git commit openssl
PR-URL: https://github.com/nodejs/node/pull/43022
Refs: https://mta.openssl.org/pipermail/openssl-announce/2022-May/000223.html
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Beth Griggs <bgriggs@redhat.com>
Diffstat (limited to 'deps')
220 files changed, 2187 insertions, 913 deletions
diff --git a/deps/openssl/openssl/CHANGES.md b/deps/openssl/openssl/CHANGES.md index f6e519d9afd..db47eb4da2b 100644 --- a/deps/openssl/openssl/CHANGES.md +++ b/deps/openssl/openssl/CHANGES.md @@ -28,12 +28,120 @@ breaking changes, and mappings for the large list of deprecated functions. [Migration guide]: https://github.com/openssl/openssl/tree/master/doc/man7/migration_guide.pod -### Changes between 3.0.2 and 3.0.2+quic [15 Mar 2022] +### Changes between 3.0.3 and 3.0.3+quic [3 May 2022] * Add QUIC API support from BoringSSL. *Todd Short* +### Changes between 3.0.2 and 3.0.3 [3 May 2022] + + * Fixed a bug in the c_rehash script which was not properly sanitising shell + metacharacters to prevent command injection. This script is distributed by + some operating systems in a manner where it is automatically executed. On + such operating systems, an attacker could execute arbitrary commands with the + privileges of the script. + + Use of the c_rehash script is considered obsolete and should be replaced + by the OpenSSL rehash command line tool. + (CVE-2022-1292) + + *Tomáš Mráz* + + * Fixed a bug in the function `OCSP_basic_verify` that verifies the signer + certificate on an OCSP response. The bug caused the function in the case + where the (non-default) flag OCSP_NOCHECKS is used to return a postivie + response (meaning a successful verification) even in the case where the + response signing certificate fails to verify. + + It is anticipated that most users of `OCSP_basic_verify` will not use the + OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return + a negative value (indicating a fatal error) in the case of a certificate + verification failure. The normal expected return value in this case would be + 0. + + This issue also impacts the command line OpenSSL "ocsp" application. When + verifying an ocsp response with the "-no_cert_checks" option the command line + application will report that the verification is successful even though it + has in fact failed. In this case the incorrect successful response will also + be accompanied by error messages showing the failure and contradicting the + apparently successful result. + ([CVE-2022-1343]) + + *Matt Caswell* + + * Fixed a bug where the RC4-MD5 ciphersuite incorrectly used the + AAD data as the MAC key. This made the MAC key trivially predictable. + + An attacker could exploit this issue by performing a man-in-the-middle attack + to modify data being sent from one endpoint to an OpenSSL 3.0 recipient such + that the modified data would still pass the MAC integrity check. + + Note that data sent from an OpenSSL 3.0 endpoint to a non-OpenSSL 3.0 + endpoint will always be rejected by the recipient and the connection will + fail at that point. Many application protocols require data to be sent from + the client to the server first. Therefore, in such a case, only an OpenSSL + 3.0 server would be impacted when talking to a non-OpenSSL 3.0 client. + + If both endpoints are OpenSSL 3.0 then the attacker could modify data being + sent in both directions. In this case both clients and servers could be + affected, regardless of the application protocol. + + Note that in the absence of an attacker this bug means that an OpenSSL 3.0 + endpoint communicating with a non-OpenSSL 3.0 endpoint will fail to complete + the handshake when using this ciphersuite. + + The confidentiality of data is not impacted by this issue, i.e. an attacker + cannot decrypt data that has been encrypted using this ciphersuite - they can + only modify it. + + In order for this attack to work both endpoints must legitimately negotiate + the RC4-MD5 ciphersuite. This ciphersuite is not compiled by default in + OpenSSL 3.0, and is not available within the default provider or the default + ciphersuite list. This ciphersuite will never be used if TLSv1.3 has been + negotiated. In order for an OpenSSL 3.0 endpoint to use this ciphersuite the + following must have occurred: + + 1) OpenSSL must have been compiled with the (non-default) compile time option + enable-weak-ssl-ciphers + + 2) OpenSSL must have had the legacy provider explicitly loaded (either + through application code or via configuration) + + 3) The ciphersuite must have been explicitly added to the ciphersuite list + + 4) The libssl security level must have been set to 0 (default is 1) + + 5) A version of SSL/TLS below TLSv1.3 must have been negotiated + + 6) Both endpoints must negotiate the RC4-MD5 ciphersuite in preference to any + others that both endpoints have in common + (CVE-2022-1434) + + *Matt Caswell* + + * Fix a bug in the OPENSSL_LH_flush() function that breaks reuse of the memory + occuppied by the removed hash table entries. + + This function is used when decoding certificates or keys. If a long lived + process periodically decodes certificates or keys its memory usage will + expand without bounds and the process might be terminated by the operating + system causing a denial of service. Also traversing the empty hash table + entries will take increasingly more time. + + Typically such long lived processes might be TLS clients or TLS servers + configured to accept client certificate authentication. + (CVE-2022-1473) + + *Hugo Landau, Aliaksei Levin* + + * The functions `OPENSSL_LH_stats` and `OPENSSL_LH_stats_bio` now only report + the `num_items`, `num_nodes` and `num_alloc_nodes` statistics. All other + statistics are no longer supported. For compatibility, these statistics are + still listed in the output but are now always reported as zero. + + *Hugo Landau* + ### Changes between 3.0.1 and 3.0.2 [15 Mar 2022] * Fixed a bug in the BN_mod_sqrt() function that can cause it to loop forever diff --git a/deps/openssl/openssl/CONTRIBUTING.md b/deps/openssl/openssl/CONTRIBUTING.md index 4910bd673c7..efb4be87169 100644 --- a/deps/openssl/openssl/CONTRIBUTING.md +++ b/deps/openssl/openssl/CONTRIBUTING.md @@ -60,7 +60,7 @@ guidelines: GitHub Actions and AppVeyor are required, and they are started automatically whenever a PR is created or updated. - [coding style]: https://www.openssl.org/policies/codingstyle.html + [coding style]: https://www.openssl.org/policies/technical/coding-style.html 5. When at all possible, patches should include tests. These can either be added to an existing test, or completely new. Please see diff --git a/deps/openssl/openssl/Configurations/platform/AIX.pm b/deps/openssl/openssl/Configurations/platform/AIX.pm index e2409057cdf..c6c1437f962 100644 --- a/deps/openssl/openssl/Configurations/platform/AIX.pm +++ b/deps/openssl/openssl/Configurations/platform/AIX.pm @@ -25,5 +25,5 @@ sub staticname { return $in_libname if $unified_info{attributes}->{libraries}->{$_[1]}->{noinst}; - return platform::BASE->staticname($_[1]) . '_a'; + return platform::BASE->staticname($_[1]) . ($disabled{shared} ? '' : '_a'); } diff --git a/deps/openssl/openssl/NEWS.md b/deps/openssl/openssl/NEWS.md index b9bd0dcc762..f6903d20094 100644 --- a/deps/openssl/openssl/NEWS.md +++ b/deps/openssl/openssl/NEWS.md @@ -18,6 +18,17 @@ OpenSSL Releases OpenSSL 3.0 ----------- +### Major changes between OpenSSL 3.0.2 and OpenSSL 3.0.3 [3 May 2022] + + * Fixed a bug in the c_rehash script which was not properly sanitising shell + metacharacters to prevent command injection ([CVE-2022-1292]) + * Fixed a bug in the function `OCSP_basic_verify` that verifies the signer + certificate on an OCSP response ([CVE-2022-1343]) + * Fixed a bug where the RC4-MD5 ciphersuite incorrectly used the + AAD data as the MAC key ([CVE-2022-1434]) + * Fix a bug in the OPENSSL_LH_flush() function that breaks reuse of the memory + occuppied by the removed hash table entries ([CVE-2022-1473]) + ### Major changes between OpenSSL 3.0.1 and OpenSSL 3.0.2 [15 Mar 2022] * Fixed a bug in the BN_mod_sqrt() function that can cause it to loop forever diff --git a/deps/openssl/openssl/NOTES-WINDOWS.md b/deps/openssl/openssl/NOTES-WINDOWS.md index 40fd95cf672..b1d6c4fe13b 100644 --- a/deps/openssl/openssl/NOTES-WINDOWS.md +++ b/deps/openssl/openssl/NOTES-WINDOWS.md @@ -28,12 +28,12 @@ For this option you can use Cygwin. Native builds using Visual C++ ============================== -The native builds using Visual C++ have a VC-* prefix. +The native builds using Visual C++ have a `VC-*` prefix. Requirement details ------------------- -In addition to the requirements and instructions listed in INSTALL.md, +In addition to the requirements and instructions listed in `INSTALL.md`, these are required as well: ### Perl @@ -64,22 +64,26 @@ Quick start 4. Use Visual Studio Developer Command Prompt with administrative privileges, choosing one of its variants depending on the intended architecture. - Or run "cmd" and execute "vcvarsall.bat" with one of the options x86, - x86_amd64, x86_arm, x86_arm64, amd64, amd64_x86, amd64_arm, or amd64_arm64. - This sets up the environment variables needed for nmake.exe, cl.exe, etc. + Or run `cmd` and execute `vcvarsall.bat` with one of the options `x86`, + `x86_amd64`, `x86_arm`, `x86_arm64`, `amd64`, `amd64_x86`, `amd64_arm`, + or `amd64_arm64`. + This sets up the environment variables needed for `nmake.exe`, `cl.exe`, + etc. See also <https://docs.microsoft.com/cpp/build/building-on-the-command-line> 5. From the root of the OpenSSL source directory enter - perl Configure VC-WIN32 if you want 32-bit OpenSSL or - perl Configure VC-WIN64A if you want 64-bit OpenSSL or - perl Configure to let Configure figure out the platform + - `perl Configure VC-WIN32` if you want 32-bit OpenSSL or + - `perl Configure VC-WIN64A` if you want 64-bit OpenSSL or + - `perl Configure VC-WIN64-ARM` if you want Windows on Arm (win-arm64) + OpenSSL or + - `perl Configure` to let Configure figure out the platform - 6. nmake + 6. `nmake` - 7. nmake test + 7. `nmake test` - 8. nmake install + 8. `nmake install` For the full installation instructions, or if anything goes wrong at any stage, check the INSTALL.md file. @@ -109,25 +113,25 @@ installation for examples), these fallbacks are used: ALSO NOTE that those directories are usually write protected, even if your account is in the Administrators group. To work around that, start the command prompt by right-clicking on it and choosing "Run as -Administrator" before running 'nmake install'. The other solution +Administrator" before running `nmake install`. The other solution is, of course, to choose a different set of directories by using ---prefix and --openssldir when configuring. +`--prefix` and `--openssldir` when configuring. -Special notes for Universal Windows Platform builds, aka VC-*-UWP --------------------------------------------------------------------- +Special notes for Universal Windows Platform builds, aka `VC-*-UWP` +------------------------------------------------------------------- - UWP targets only support building the static and dynamic libraries. - - You should define the platform type to "uwp" and the target arch via - "vcvarsall.bat" before you compile. For example, if you want to build - "arm64" builds, you should run "vcvarsall.bat x86_arm64 uwp". + - You should define the platform type to `uwp` and the target arch via + `vcvarsall.bat` before you compile. For example, if you want to build + `arm64` builds, you should run `vcvarsall.bat x86_arm64 uwp`. Native builds using Embarcadero C++Builder ========================================= This toolchain (a descendant of Turbo/Borland C++) is an alternative to MSVC. OpenSSL currently includes an experimental 32-bit configuration targeting the -Clang-based compiler (bcc32c.exe) in v10.3.3 Community Edition. +Clang-based compiler (`bcc32c.exe`) in v10.3.3 Community Edition. <https://www.embarcadero.com/products/cbuilder/starter> 1. Install Perl. @@ -135,11 +139,11 @@ Clang-based compiler (bcc32c.exe) in v10.3.3 Community Edition. 2. Open the RAD Studio Command Prompt. 3. Go to the root of the OpenSSL source directory and run: - perl Configure BC-32 --prefix=%CD% + `perl Configure BC-32 --prefix=%CD%` - 4. make -N + 4. `make -N` - 5. make -N test + 5. `make -N test` 6. Build your program against this OpenSSL: * Set your include search path to the "include" subdirectory of OpenSSL. @@ -166,9 +170,9 @@ MinGW offers an alternative way to build native OpenSSL, by cross compilation. - Perl, at least version 5.10.0, which usually comes pre-installed with MSYS2 - - make, installed using "pacman -S make" into the MSYS2 environment + - make, installed using `pacman -S make` into the MSYS2 environment - - MinGW[64] compiler: mingw-w64-i686-gcc and/or mingw-w64-x86_64-gcc. + - MinGW[64] compiler: `mingw-w64-i686-gcc` and/or `mingw-w64-x86_64-gcc`. These compilers must be on your MSYS2 $PATH. A common error is to not have these on your $PATH. The MSYS2 version of gcc will not work correctly here. @@ -176,22 +180,28 @@ MinGW offers an alternative way to build native OpenSSL, by cross compilation. In the MSYS2 shell do the configuration depending on the target architecture: ./Configure mingw ... + or + ./Configure mingw64 ... + or + ./Configure ... for the default architecture. - Apart from that, follow the Unix / Linux instructions in INSTALL.md. + Apart from that, follow the Unix / Linux instructions in `INSTALL.md`. * It is also possible to build mingw[64] on Linux or Cygwin. - In this case configure with the corresponding --cross-compile-prefix= option. - For example + In this case configure with the corresponding `--cross-compile-prefix=` + option. For example ./Configure mingw --cross-compile-prefix=i686-w64-mingw32- ... + or + ./Configure mingw64 --cross-compile-prefix=x86_64-w64-mingw32- ... This requires that you've installed the necessary add-on packages for @@ -203,18 +213,18 @@ Linking native applications This section applies to all native builds. If you link with static OpenSSL libraries then you're expected to -additionally link your application with WS2_32.LIB, GDI32.LIB, -ADVAPI32.LIB, CRYPT32.LIB and USER32.LIB. Those developing +additionally link your application with `WS2_32.LIB`, `GDI32.LIB`, +`ADVAPI32.LIB`, `CRYPT32.LIB` and `USER32.LIB`. Those developing non-interactive service applications might feel concerned about -linking with GDI32.LIB and USER32.LIB, as they are justly associated +linking with `GDI32.LIB` and `USER32.LIB`, as they are justly associated with interactive desktop, which is not available to service processes. The toolkit is designed to detect in which context it's currently executed, GUI, console app or service, and act accordingly, namely whether or not to actually make GUI calls. Additionally those -who wish to /DELAYLOAD:GDI32.DLL and /DELAYLOAD:USER32.DLL and +who wish to `/DELAYLOAD:GDI32.DLL` and `/DELAYLOAD:USER32.DLL` and actually keep them off service process should consider implementing -and exporting from .exe image in question own _OPENSSL_isservice not -relying on USER32.DLL. E.g., on Windows Vista and later you could: +and exporting from .exe image in question own `_OPENSSL_isservice` not +relying on `USER32.DLL`. E.g., on Windows Vista and later you could: __declspec(dllexport) __cdecl BOOL _OPENSSL_isservice(void) { @@ -233,7 +243,7 @@ See also the OPENSSL_Applink manual page. Hosted builds using Cygwin ========================== -Cygwin implements a POSIX/Unix runtime system (cygwin1.dll) on top of the +Cygwin implements a POSIX/Unix runtime system (`cygwin1.dll`) on top of the Windows subsystem and provides a Bash shell and GNU tools environment. Consequently, a build of OpenSSL with Cygwin is virtually identical to the Unix procedure. @@ -249,7 +259,7 @@ To build OpenSSL using Cygwin, you need to: Apart from that, follow the Unix / Linux instructions in INSTALL.md. -NOTE: "make test" and normal file operations may fail in directories -mounted as text (i.e. mount -t c:\somewhere /home) due to Cygwin +NOTE: `make test` and normal file operations may fail in directories +mounted as text (i.e. `mount -t c:\somewhere /home`) due to Cygwin stripping of carriage returns. To avoid this ensure that a binary -mount is used, e.g. mount -b c:\somewhere /home. +mount is used, e.g. `mount -b c:\somewhere /home`. diff --git a/deps/openssl/openssl/README.md b/deps/openssl/openssl/README.md index a6534012f7f..9bb0f9726ff 100644 --- a/deps/openssl/openssl/README.md +++ b/deps/openssl/openssl/README.md @@ -4,7 +4,7 @@ What This Is This is a fork of [OpenSSL](https://www.openssl.org) to enable QUIC. In addition to the website, the official source distribution is at <https://github.com/openssl/openssl>. The OpenSSL `README` can be found at -[README-OpenSSL.md](https://github.com/quictls/openssl/blob/openssl-3.0.2%2Bquic/README-OpenSSL.md) +[README-OpenSSL.md](https://github.com/quictls/openssl/blob/openssl-3.0.3%2Bquic/README-OpenSSL.md) This fork adds APIs that can be used by QUIC implementations for connection handshakes. Quoting the IETF Working group diff --git a/deps/openssl/openssl/VERSION.dat b/deps/openssl/openssl/VERSION.dat index d577b940c4d..2fad6a14418 100644 --- a/deps/openssl/openssl/VERSION.dat +++ b/deps/openssl/openssl/VERSION.dat @@ -1,7 +1,7 @@ MAJOR=3 MINOR=0 -PATCH=2 +PATCH=3 PRE_RELEASE_TAG= BUILD_METADATA=quic -RELEASE_DATE="15 Mar 2022" +RELEASE_DATE="3 May 2022" SHLIB_VERSION=81.3 diff --git a/deps/openssl/openssl/apps/ca.c b/deps/openssl/openssl/apps/ca.c index 24883615ed6..bc4b9e6e661 100644 --- a/deps/openssl/openssl/apps/ca.c +++ b/deps/openssl/openssl/apps/ca.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -2367,7 +2367,7 @@ static char *make_revocation_str(REVINFO_TYPE rev_type, const char *rev_arg) case REV_CRL_REASON: for (i = 0; i < 8; i++) { - if (strcasecmp(rev_arg, crl_reasons[i]) == 0) { + if (OPENSSL_strcasecmp(rev_arg, crl_reasons[i]) == 0) { reason = crl_reasons[i]; break; } @@ -2584,7 +2584,7 @@ int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold, } if (reason_str) { for (i = 0; i < NUM_REASONS; i++) { - if (strcasecmp(reason_str, crl_reasons[i]) == 0) { + if (OPENSSL_strcasecmp(reason_str, crl_reasons[i]) == 0) { reason_code = i; break; } diff --git a/deps/openssl/openssl/apps/cmp.c b/deps/openssl/openssl/apps/cmp.c index 9ea5cee4124..5c6bcdad0a6 100644 --- a/deps/openssl/openssl/apps/cmp.c +++ b/deps/openssl/openssl/apps/cmp.c @@ -1745,7 +1745,7 @@ static int handle_opt_geninfo(OSSL_CMP_CTX *ctx) valptr[0] = '\0'; valptr++; - if (strncasecmp(valptr, "int:", 4) != 0) { + if (OPENSSL_strncasecmp(valptr, "int:", 4) != 0) { CMP_err("missing 'int:' in -geninfo option"); return 0; } diff --git a/deps/openssl/openssl/apps/ecparam.c b/deps/openssl/openssl/apps/ecparam.c index 12eed703de6..e93ecaea6a1 100644 --- a/deps/openssl/openssl/apps/ecparam.c +++ b/deps/openssl/openssl/apps/ecparam.c @@ -1,5 +1,5 @@ /* - * Copyright 2002-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2002-2022 The OpenSSL Project Authors. All Rights Reserved. * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved * * Licensed under the Apache License 2.0 (the "License"). You may not use @@ -229,7 +229,7 @@ int ecparam_main(int argc, char **argv) point_format, 0); *p = OSSL_PARAM_construct_end(); - if (strcasecmp(curve_name, "SM2") == 0) + if (OPENSSL_strcasecmp(curve_name, "SM2") == 0) gctx_params = EVP_PKEY_CTX_new_from_name(NULL, "sm2", NULL); else gctx_params = EVP_PKEY_CTX_new_from_name(NULL, "ec", NULL); diff --git a/deps/openssl/openssl/apps/lib/apps.c b/deps/openssl/openssl/apps/lib/apps.c index 30da6e8a8cb..227da4982d1 100644 --- a/deps/openssl/openssl/apps/lib/apps.c +++ b/deps/openssl/openssl/apps/lib/apps.c @@ -688,8 +688,8 @@ int load_cert_certs(const char *uri, int ret = 0; char *pass_string; - if (exclude_http && (strncasecmp(uri, "http://", 7) == 0 - || strncasecmp(uri, "https://", 8) == 0)) { + if (exclude_http && (OPENSSL_strncasecmp(uri, "http://", 7) == 0 + || OPENSSL_strncasecmp(uri, "https://", 8) == 0)) { BIO_printf(bio_err, "error: HTTP retrieval not allowed for %s\n", desc); return ret; } @@ -1182,20 +1182,20 @@ int set_name_ex(unsigned long *flags, const char *arg) int set_dateopt(unsigned long *dateopt, const char *arg) { - if (strcasecmp(arg, "rfc_822") == 0) + if (OPENSSL_strcasecmp(arg, "rfc_822") == 0) *dateopt = ASN1_DTFLGS_RFC822; - else if (strcasecmp(arg, "iso_8601") == 0) + else if (OPENSSL_strcasecmp(arg, "iso_8601") == 0) *dateopt = ASN1_DTFLGS_ISO8601; return 0; } int set_ext_copy(int *copy_type, const char *arg) { - if (strcasecmp(arg, "none") == 0) + if (OPENSSL_strcasecmp(arg, "none") == 0) *copy_type = EXT_COPY_NONE; - else if (strcasecmp(arg, "copy") == 0) + else if (OPENSSL_strcasecmp(arg, "copy") == 0) *copy_type = EXT_COPY_ADD; - else if (strcasecmp(arg, "copyall") == 0) + else if (OPENSSL_strcasecmp(arg, "copyall") == 0) *copy_type = EXT_COPY_ALL; else return 0; @@ -1275,7 +1275,7 @@ static int set_table_opts(unsigned long *flags, const char *arg, } for (ptbl = in_tbl; ptbl->name; ptbl++) { - if (strcasecmp(arg, ptbl->name) == 0) { + if (OPENSSL_strcasecmp(arg, ptbl->name) == 0) { *flags &= ~ptbl->mask; if (c) *flags |= ptbl->flag; diff --git a/deps/openssl/openssl/apps/lib/engine_loader.c b/deps/openssl/openssl/apps/lib/engine_loader.c index c093f31e1b3..42775a89f36 100644 --- a/deps/openssl/openssl/apps/lib/engine_loader.c +++ b/deps/openssl/openssl/apps/lib/engine_loader.c @@ -71,7 +71,7 @@ static OSSL_STORE_LOADER_CTX *engine_open(const OSSL_STORE_LOADER *loader, char *keyid = NULL; OSSL_STORE_LOADER_CTX *ctx = NULL; - if (strncasecmp(p, ENGINE_SCHEME_COLON, sizeof(ENGINE_SCHEME_COLON) - 1) + if (OPENSSL_strncasecmp(p, ENGINE_SCHEME_COLON, sizeof(ENGINE_SCHEME_COLON) - 1) != 0) return NULL; p += sizeof(ENGINE_SCHEME_COLON) - 1; diff --git a/deps/openssl/openssl/apps/lib/http_server.c b/deps/openssl/openssl/apps/lib/http_server.c index 03faac7707b..a7fe5e1a58b 100644 --- a/deps/openssl/openssl/apps/lib/http_server.c +++ b/deps/openssl/openssl/apps/lib/http_server.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -453,10 +453,11 @@ int http_server_get_asn1_req(const ASN1_ITEM *it, ASN1_VALUE **preq, } *line_end = '\0'; /* https://tools.ietf.org/html/rfc7230#section-6.3 Persistence */ - if (found_keep_alive != NULL && strcasecmp(key, "Connection") == 0) { - if (strcasecmp(value, "keep-alive") == 0) + if (found_keep_alive != NULL + && OPENSSL_strcasecmp(key, "Connection") == 0) { + if (OPENSSL_strcasecmp(value, "keep-alive") == 0) *found_keep_alive = 1; - else if (strcasecmp(value, "close") == 0) + else if (OPENSSL_strcasecmp(value, "close") == 0) *found_keep_alive = 0; } } diff --git a/deps/openssl/openssl/apps/lib/names.c b/deps/openssl/openssl/apps/lib/names.c index 5e2e7e147c7..4788ae84b91 100644 --- a/deps/openssl/openssl/apps/lib/names.c +++ b/deps/openssl/openssl/apps/lib/names.c @@ -1,5 +1,5 @@ /* - * Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -11,14 +11,11 @@ #include <openssl/bio.h> #include <openssl/safestack.h> #include "names.h" - -#ifdef _WIN32 -# define strcasecmp _stricmp -#endif +#include "openssl/crypto.h" int name_cmp(const char * const *a, const char * const *b) { - return strcasecmp(*a, *b); + return OPENSSL_strcasecmp(*a, *b); } void collect_names(const char *name, void *vdata) diff --git a/deps/openssl/openssl/apps/lib/vms_term_sock.c b/deps/openssl/openssl/apps/lib/vms_term_sock.c index 1b27699b9d4..97fb3943265 100644 --- a/deps/openssl/openssl/apps/lib/vms_term_sock.c +++ b/deps/openssl/openssl/apps/lib/vms_term_sock.c @@ -1,5 +1,5 @@ /* - * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved. * Copyright 2016 VMS Software, Inc. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use @@ -132,7 +132,7 @@ int main (int argc, char *argv[], char *envp[]) len; LogMessage ("Enter 'q' or 'Q' to quit ..."); - while (strcasecmp (TermBuff, "Q")) { + while (OPENSSL_strcasecmp (TermBuff, "Q")) { /* ** Create the terminal socket */ diff --git a/deps/openssl/openssl/apps/list.c b/deps/openssl/openssl/apps/list.c index 9732d6625a0..0d12bd6beca 100644 --- a/deps/openssl/openssl/apps/list.c +++ b/deps/openssl/openssl/apps/list.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -71,7 +71,7 @@ static void legacy_cipher_fn(const EVP_CIPHER *c, { if (select_name != NULL && (c == NULL - || strcasecmp(select_name, EVP_CIPHER_get0_name(c)) != 0)) + || OPENSSL_strcasecmp(select_name, EVP_CIPHER_get0_name(c)) != 0)) return; if (c != NULL) { BIO_printf(arg, " %s\n", EVP_CIPHER_get0_name(c)); @@ -370,7 +370,7 @@ DEFINE_STACK_OF(EVP_RAND) static int rand_cmp(const EVP_RAND * const *a, const EVP_RAND * const *b) { - int ret = strcasecmp(EVP_RAND_get0_name(*a), EVP_RAND_get0_name(*b)); + int ret = OPENSSL_strcasecmp(EVP_RAND_get0_name(*a), EVP_RAND_get0_name(*b)); if (ret == 0) ret = strcmp(OSSL_PROVIDER_get0_name(EVP_RAND_get0_provider(*a)), @@ -404,7 +404,7 @@ static void list_random_generators(void) const EVP_RAND *m = sk_EVP_RAND_value(rands, i); if (select_name != NULL - && strcasecmp(EVP_RAND_get0_name(m), select_name) != 0) + && OPENSSL_strcasecmp(EVP_RAND_get0_name(m), select_name) != 0) continue; BIO_printf(bio_out, " %s", EVP_RAND_get0_name(m)); BIO_printf(bio_out, " @ %s\n", @@ -463,7 +463,7 @@ static void display_random(const char *name, EVP_RAND_CTX *drbg) if (gettables != NULL) for (; gettables->key != NULL; gettables++) { /* State has been dealt with already, so ignore */ - if (strcasecmp(gettables->key, OSSL_RAND_PARAM_STATE) == 0) + if (OPENSSL_strcasecmp(gettables->key, OSSL_RAND_PARAM_STATE) == 0) continue; /* Outside of verbose mode, we skip non-string values */ if (gettables->data_type != OSSL_PARAM_UTF8_STRING diff --git a/deps/openssl/openssl/apps/ocsp.c b/deps/openssl/openssl/apps/ocsp.c index 05c68732384..7e2e89c387c 100644 --- a/deps/openssl/openssl/apps/ocsp.c +++ b/deps/openssl/openssl/apps/ocsp.c @@ -1115,6 +1115,11 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req single = OCSP_basic_add1_status(bs, cid, V_OCSP_CERTSTATUS_REVOKED, reason, revtm, thisupd, nextupd); + if (single == NULL) { + *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, + NULL); + goto end; + } if (invtm != NULL) OCSP_SINGLERESP_add1_ext_i2d(single, NID_invalidity_date, invtm, 0, 0); diff --git a/deps/openssl/openssl/apps/rehash.c b/deps/openssl/openssl/apps/rehash.c index fb6c08c420c..e4a4e14fd49 100644 --- a/deps/openssl/openssl/apps/rehash.c +++ b/deps/openssl/openssl/apps/rehash.c @@ -214,7 +214,7 @@ static int handle_symlink(const char *filename, const char *fullpath) return -1; for (type = OSSL_NELEM(suffixes) - 1; type > 0; type--) { const char *suffix = suffixes[type]; - if (strncasecmp(suffix, &filename[i], strlen(suffix)) == 0) + if (OPENSSL_strncasecmp(suffix, &filename[i], strlen(suffix)) == 0) break; } i += strlen(suffixes[type]); @@ -249,7 +249,7 @@ static int do_file(const char *filename, const char *fullpath, enum Hash h) if ((ext = strrchr(filename, '.')) == NULL) goto end; for (i = 0; i < OSSL_NELEM(extensions); i++) { - if (strcasecmp(extensions[i], ext + 1) == 0) + if (OPENSSL_strcasecmp(extensions[i], ext + 1) == 0) break; } if (i >= OSSL_NELEM(extensions)) diff --git a/deps/openssl/openssl/apps/req.c b/deps/openssl/openssl/apps/req.c index 71a5ab20cac..23757044ab7 100644 --- a/deps/openssl/openssl/apps/req.c +++ b/deps/openssl/openssl/apps/req.c @@ -992,7 +992,7 @@ int req_main(int argc, char **argv) goto end; } fprintf(stdout, "Modulus="); - if (EVP_PKEY_is_a(tpubkey, "RSA")) { + if (EVP_PKEY_is_a(tpubkey, "RSA") || EVP_PKEY_is_a(tpubkey, "RSA-PSS")) { BIGNUM *n = NULL; if (!EVP_PKEY_get_bn_param(tpubkey, "n", &n)) diff --git a/deps/openssl/openssl/apps/rsa.c b/deps/openssl/openssl/apps/rsa.c index 05a091ce4be..c702f03354b 100644 --- a/deps/openssl/openssl/apps/rsa.c +++ b/deps/openssl/openssl/apps/rsa.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -257,7 +257,7 @@ int rsa_main(int argc, char **argv) ERR_print_errors(bio_err); goto end; } - if (!EVP_PKEY_is_a(pkey, "RSA")) { + if (!EVP_PKEY_is_a(pkey, "RSA") && !EVP_PKEY_is_a(pkey, "RSA-PSS")) { BIO_printf(bio_err, "Not an RSA key\n"); goto end; } diff --git a/deps/openssl/openssl/apps/s_server.c b/deps/openssl/openssl/apps/s_server.c index ccaec3124bf..e93cfa1e2c7 100644 --- a/deps/openssl/openssl/apps/s_server.c +++ b/deps/openssl/openssl/apps/s_server.c @@ -432,7 +432,7 @@ static int ssl_servername_cb(SSL *s, int *ad, void *arg) return SSL_TLSEXT_ERR_NOACK; if (servername != NULL) { - if (strcasecmp(servername, p->servername)) + if (OPENSSL_strcasecmp(servername, p->servername)) return p->extension_error; if (ctx2 != NULL) { BIO_printf(p->biodebug, "Switching server context.\n"); diff --git a/deps/openssl/openssl/apps/ts.c b/deps/openssl/openssl/apps/ts.c index e65d223348d..266ed25f31f 100644 --- a/deps/openssl/openssl/apps/ts.c +++ b/deps/openssl/openssl/apps/ts.c @@ -1,5 +1,5 @@ /* - * Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2006-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -976,6 +976,10 @@ static X509_STORE *create_cert_store(const char *CApath, const char *CAfile, const char *propq = app_get0_propq(); cert_ctx = X509_STORE_new(); + if (cert_ctx == NULL) { + BIO_printf(bio_err, "memory allocation failure\n"); + return NULL; + } X509_STORE_set_verify_cb(cert_ctx, verify_cb); if (CApath != NULL) { lookup = X509_STORE_add_lookup(cert_ctx, X509_LOOKUP_hash_dir()); diff --git a/deps/openssl/openssl/apps/x509.c b/deps/openssl/openssl/apps/x509.c index f09f1d1b3ba..2b9a0b6cb40 100644 --- a/deps/openssl/openssl/apps/x509.c +++ b/deps/openssl/openssl/apps/x509.c @@ -954,7 +954,7 @@ int x509_main(int argc, char **argv) purpose_print(out, x, X509_PURPOSE_get0(j)); } else if (i == modulus) { BIO_printf(out, "Modulus="); - if (EVP_PKEY_is_a(pkey, "RSA")) { + if (EVP_PKEY_is_a(pkey, "RSA") || EVP_PKEY_is_a(pkey, "RSA-PSS")) { BIGNUM *n = NULL; /* Every RSA key has an 'n' */ diff --git a/deps/openssl/openssl/crypto/LPdir_unix.c b/deps/openssl/openssl/crypto/LPdir_unix.c index ddf68b576f8..bc0e924e46a 100644 --- a/deps/openssl/openssl/crypto/LPdir_unix.c +++ b/deps/openssl/openssl/crypto/LPdir_unix.c @@ -1,5 +1,5 @@ /* - * Copyright 2004-2018 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2004-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -141,7 +141,8 @@ const char *LP_find_file(LP_DIR_CTX **ctx, const char *directory) p--; if (p > (*ctx)->entry_name && p[-1] == ';') p[-1] = '\0'; - if (strcasecmp((*ctx)->entry_name, (*ctx)->previous_entry_name) == 0) + if (OPENSSL_strcasecmp((*ctx)->entry_name, + (*ctx)->previous_entry_name) == 0) goto again; } #endif diff --git a/deps/openssl/openssl/crypto/asn1/ameth_lib.c b/deps/openssl/openssl/crypto/asn1/ameth_lib.c index 031a6c936ad..8b15da3beed 100644 --- a/deps/openssl/openssl/crypto/asn1/ameth_lib.c +++ b/deps/openssl/openssl/crypto/asn1/ameth_lib.c @@ -1,5 +1,5 @@ /* - * Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2006-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -10,7 +10,6 @@ /* We need to use some engine deprecated APIs */ #define OPENSSL_SUPPRESS_DEPRECATED -#include "e_os.h" /* for strncasecmp */ #include "internal/cryptlib.h" #include <stdio.h> #include <openssl/asn1t.h> @@ -134,7 +133,7 @@ const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_find_str(ENGINE **pe, if (ameth->pkey_flags & ASN1_PKEY_ALIAS) continue; if ((int)strlen(ameth->pem_str) == len - && strncasecmp(ameth->pem_str, str, len) == 0) + && OPENSSL_strncasecmp(ameth->pem_str, str, len) == 0) return ameth; } return NULL; diff --git a/deps/openssl/openssl/crypto/asn1/asn1_gen.c b/deps/openssl/openssl/crypto/asn1/asn1_gen.c index ecff2be02e1..64620a4f28a 100644 --- a/deps/openssl/openssl/crypto/asn1/asn1_gen.c +++ b/deps/openssl/openssl/crypto/asn1/asn1_gen.c @@ -1,5 +1,5 @@ /* - * Copyright 2002-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2002-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -10,7 +10,6 @@ #include "internal/cryptlib.h" #include <openssl/asn1.h> #include <openssl/x509v3.h> -#include "e_os.h" /* strncasecmp() */ #define ASN1_GEN_FLAG 0x10000 #define ASN1_GEN_FLAG_IMP (ASN1_GEN_FLAG|1) @@ -565,7 +564,8 @@ static int asn1_str2tag(const char *tagstr, int len) tntmp = tnst; for (i = 0; i < OSSL_NELEM(tnst); i++, tntmp++) { - if ((len == tntmp->len) && (strncasecmp(tntmp->strnam, tagstr, len) == 0)) + if ((len == tntmp->len) + && (OPENSSL_strncasecmp(tntmp->strnam, tagstr, len) == 0)) return tntmp->tag; } diff --git a/deps/openssl/openssl/crypto/bn/bn_div.c b/deps/openssl/openssl/crypto/bn/bn_div.c index 25514c05f11..ff66baa48f2 100644 --- a/deps/openssl/openssl/crypto/bn/bn_div.c +++ b/deps/openssl/openssl/crypto/bn/bn_div.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -446,8 +446,10 @@ int bn_div_fixed_top(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, snum->neg = num_neg; snum->top = div_n; snum->flags |= BN_FLG_FIXED_TOP; - if (rm != NULL) - bn_rshift_fixed_top(rm, snum, norm_shift); + + if (rm != NULL && bn_rshift_fixed_top(rm, snum, norm_shift) == 0) + goto err; + BN_CTX_end(ctx); return 1; err: diff --git a/deps/openssl/openssl/crypto/bn/bn_exp.c b/deps/openssl/openssl/crypto/bn/bn_exp.c index 5329cd12a98..b97b5f4b56f 100644 --- a/deps/openssl/openssl/crypto/bn/bn_exp.c +++ b/deps/openssl/openssl/crypto/bn/bn_exp.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -187,13 +187,14 @@ int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, return ret; } + BN_RECP_CTX_init(&recp); + BN_CTX_start(ctx); aa = BN_CTX_get(ctx); val[0] = BN_CTX_get(ctx); if (val[0] == NULL) goto err; - BN_RECP_CTX_init(&recp); if (m->neg) { /* ignore sign of 'm' */ if (!BN_copy(aa, m)) diff --git a/deps/openssl/openssl/crypto/camellia/camellia.c b/deps/openssl/openssl/crypto/camellia/camellia.c index dcdff810e36..a4de9f891ab 100644 --- a/deps/openssl/openssl/crypto/camellia/camellia.c +++ b/deps/openssl/openssl/crypto/camellia/camellia.c @@ -1,5 +1,5 @@ /* - * Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2006-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -499,9 +499,9 @@ void Camellia_DecryptBlock_Rounds(int grandRounds, const u8 ciphertext[], PUTU32(plaintext + 12, s1); } -void Camellia_DecryptBlock(int keyBitLength, const u8 plaintext[], - const KEY_TABLE_TYPE keyTable, u8 ciphertext[]) +void Camellia_DecryptBlock(int keyBitLength, const u8 ciphertext[], + const KEY_TABLE_TYPE keyTable, u8 plaintext[]) { Camellia_DecryptBlock_Rounds(keyBitLength == 128 ? 3 : 4, - plaintext, keyTable, ciphertext); + ciphertext, keyTable, plaintext); } diff --git a/deps/openssl/openssl/crypto/chacha/build.info b/deps/openssl/openssl/crypto/chacha/build.info index c12cb9c201b..026b09de74c 100644 --- a/deps/openssl/openssl/crypto/chacha/build.info +++ b/deps/openssl/openssl/crypto/chacha/build.info @@ -5,7 +5,7 @@ IF[{- !$disabled{asm} -}] $CHACHAASM_x86=chacha-x86.s $CHACHAASM_x86_64=chacha-x86_64.s - $CHACHAASM_ia64=chacha-ia64.S + $CHACHAASM_ia64=chacha-ia64.s $CHACHAASM_s390x=chacha-s390x.S @@ -36,4 +36,4 @@ INCLUDE[chacha-armv8.o]=.. INCLUDE[chacha-s390x.o]=.. GENERATE[chacha-c64xplus.S]=asm/chacha-c64xplus.pl GENERATE[chacha-s390x.S]=asm/chacha-s390x.pl -GENERATE[chacha-ia64.S]=asm/chacha-ia64.pl +GENERATE[chacha-ia64.s]=asm/chacha-ia64.pl diff --git a/deps/openssl/openssl/crypto/cms/cms_io.c b/deps/openssl/openssl/crypto/cms/cms_io.c index 3768ea4db23..dab70af73c3 100644 --- a/deps/openssl/openssl/crypto/cms/cms_io.c +++ b/deps/openssl/openssl/crypto/cms/cms_io.c @@ -1,5 +1,5 @@ /* - * Copyright 2008-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2008-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -41,8 +41,11 @@ CMS_ContentInfo *d2i_CMS_bio(BIO *bp, CMS_ContentInfo **cms) ci = ASN1_item_d2i_bio_ex(ASN1_ITEM_rptr(CMS_ContentInfo), bp, cms, ossl_cms_ctx_get0_libctx(ctx), ossl_cms_ctx_get0_propq(ctx)); - if (ci != NULL) + if (ci != NULL) { + ERR_set_mark(); ossl_cms_resolve_libctx(ci); + ERR_pop_to_mark(); + } return ci; } @@ -104,8 +107,11 @@ CMS_ContentInfo *SMIME_read_CMS_ex(BIO *bio, int flags, BIO **bcont, (ASN1_VALUE **)cms, ossl_cms_ctx_get0_libctx(ctx), ossl_cms_ctx_get0_propq(ctx)); - if (ci != NULL) + if (ci != NULL) { + ERR_set_mark(); ossl_cms_resolve_libctx(ci); + ERR_pop_to_mark(); + } return ci; } diff --git a/deps/openssl/openssl/crypto/conf/conf_def.c b/deps/openssl/openssl/crypto/conf/conf_def.c index c05c3c6b109..b5d6668f427 100644 --- a/deps/openssl/openssl/crypto/conf/conf_def.c +++ b/deps/openssl/openssl/crypto/conf/conf_def.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -11,7 +11,7 @@ #include <stdio.h> #include <string.h> -#include "e_os.h" /* strcasecmp and struct stat */ +#include "e_os.h" /* struct stat */ #ifdef __TANDEM # include <sys/types.h> /* needed for stat.h */ # include <sys/stat.h> /* struct stat */ @@ -192,11 +192,11 @@ static int def_load(CONF *conf, const char *name, long *line) /* Parse a boolean value and fill in *flag. Return 0 on error. */ static int parsebool(const char *pval, int *flag) { - if (strcasecmp(pval, "on") == 0 - || strcasecmp(pval, "true") == 0) { + if (OPENSSL_strcasecmp(pval, "on") == 0 + || OPENSSL_strcasecmp(pval, "true") == 0) { *flag = 1; - } else if (strcasecmp(pval, "off") == 0 - || strcasecmp(pval, "false") == 0) { + } else if (OPENSSL_strcasecmp(pval, "off") == 0 + || OPENSSL_strcasecmp(pval, "false") == 0) { *flag = 0; } else { ERR_raise(ERR_LIB_CONF, CONF_R_INVALID_PRAGMA); @@ -839,8 +839,10 @@ static BIO *get_next_file(const char *path, OPENSSL_DIR_CTX **dirctx) namelen = strlen(filename); - if ((namelen > 5 && strcasecmp(filename + namelen - 5, ".conf") == 0) - || (namelen > 4 && strcasecmp(filename + namelen - 4, ".cnf") == 0)) { + if ((namelen > 5 + && OPENSSL_strcasecmp(filename + namelen - 5, ".conf") == 0) + || (namelen > 4 + && OPENSSL_strcasecmp(filename + namelen - 4, ".cnf") == 0)) { size_t newlen; char *newpath; BIO *bio; diff --git a/deps/openssl/openssl/crypto/context.c b/deps/openssl/openssl/crypto/context.c index 3333af4c534..4fef24cadd5 100644 --- a/deps/openssl/openssl/crypto/context.c +++ b/deps/openssl/openssl/crypto/context.c @@ -14,6 +14,7 @@ #include "internal/core.h" #include "internal/bio.h" #include "internal/provider.h" +#include "crypto/ctype.h" struct ossl_lib_ctx_onfree_list_st { ossl_lib_ctx_onfree_fn *fn; @@ -150,7 +151,8 @@ static CRYPTO_THREAD_LOCAL default_context_thread_local; DEFINE_RUN_ONCE_STATIC(default_context_do_init) { return CRYPTO_THREAD_init_local(&default_context_thread_local, NULL) - && context_init(&default_context_int); + && context_init(&default_context_int) + && ossl_init_casecmp(); } void ossl_lib_ctx_default_deinit(void) diff --git a/deps/openssl/openssl/crypto/core_namemap.c b/deps/openssl/openssl/crypto/core_namemap.c index 55248affc66..7e11ab1c884 100644 --- a/deps/openssl/openssl/crypto/core_namemap.c +++ b/deps/openssl/openssl/crypto/core_namemap.c @@ -7,7 +7,6 @@ * https://www.openssl.org/source/license.html */ -#include "e_os.h" /* strcasecmp */ #include "internal/namemap.h" #include <openssl/lhash.h> #include "crypto/lhash.h" /* ossl_lh_strcasehash */ @@ -49,7 +48,7 @@ static unsigned long namenum_hash(const NAMENUM_ENTRY *n) static int namenum_cmp(const NAMENUM_ENTRY *a, const NAMENUM_ENTRY *b) { - return strcasecmp(a->name, b->name); + return OPENSSL_strcasecmp(a->name, b->name); } static void namenum_free(NAMENUM_ENTRY *n) diff --git a/deps/openssl/openssl/crypto/ctype.c b/deps/openssl/openssl/crypto/ctype.c index 83c24a546f5..43b32f842e6 100644 --- a/deps/openssl/openssl/crypto/ctype.c +++ b/deps/openssl/openssl/crypto/ctype.c @@ -1,5 +1,5 @@ /* - * Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -12,6 +12,19 @@ #include "crypto/ctype.h" #include <openssl/ebcdic.h> +#include <openssl/crypto.h> +#include "internal/core.h" +#include "internal/thread_once.h" + +#ifndef OPENSSL_SYS_WINDOWS +#include <strings.h> +#endif +#include <locale.h> + +#ifdef OPENSSL_SYS_MACOSX +#include <xlocale.h> +#endif + /* * Define the character classes for each character in the seven bit ASCII * character set. This is independent of the host's character set, characters @@ -278,3 +291,90 @@ int ossl_ascii_isdigit(const char inchar) { return 1; return 0; } + +/* str[n]casecmp_l is defined in POSIX 2008-01. Value is taken accordingly + * https://www.gnu.org/software/libc/manual/html_node/Feature-Test-Macros.html */ + +#if (defined OPENSSL_SYS_WINDOWS) || (defined(_POSIX_C_SOURCE) && _POSIX_C_SOURCE >= 200809L) + +# if defined OPENSSL_SYS_WINDOWS +# define locale_t _locale_t +# define freelocale _free_locale +# define strcasecmp_l _stricmp_l +# define strncasecmp_l _strnicmp_l +# endif + +# ifndef FIPS_MODULE +static locale_t loc; + +static int locale_base_inited = 0; +static CRYPTO_ONCE locale_base = CRYPTO_ONCE_STATIC_INIT; +static CRYPTO_ONCE locale_base_deinit = CRYPTO_ONCE_STATIC_INIT; + +void *ossl_c_locale() { + return (void *)loc; +} + +DEFINE_RUN_ONCE_STATIC(ossl_init_locale_base) +{ +# ifdef OPENSSL_SYS_WINDOWS + loc = _create_locale(LC_COLLATE, "C"); +# else + loc = newlocale(LC_COLLATE_MASK, "C", (locale_t) 0); +# endif + locale_base_inited = 1; + return (loc == (locale_t) 0) ? 0 : 1; +} + +DEFINE_RUN_ONCE_STATIC(ossl_deinit_locale_base) +{ + if (locale_base_inited && loc) { + freelocale(loc); + loc = NULL; + } + return 1; +} + +int ossl_init_casecmp() +{ + return RUN_ONCE(&locale_base, ossl_init_locale_base); +} + +void ossl_deinit_casecmp() { + (void)RUN_ONCE(&locale_base_deinit, ossl_deinit_locale_base); +} +# endif + +int OPENSSL_strcasecmp(const char *s1, const char *s2) +{ + return strcasecmp_l(s1, s2, (locale_t)ossl_c_locale()); +} + +int OPENSSL_strncasecmp(const char *s1, const char *s2, size_t n) +{ + return strncasecmp_l(s1, s2, n, (locale_t)ossl_c_locale()); +} +#else +# ifndef FIPS_MODULE +void *ossl_c_locale() { + return NULL; +} +# endif + +int ossl_init_casecmp() { + return 1; +} + +void ossl_deinit_casecmp() { +} + +int OPENSSL_strcasecmp(const char *s1, const char *s2) +{ + return strcasecmp(s1, s2); +} + +int OPENSSL_strncasecmp(const char *s1, const char *s2, size_t n) +{ + return strncasecmp(s1, s2, n); +} +#endif diff --git a/deps/openssl/openssl/crypto/dh/dh_group_params.c b/deps/openssl/openssl/crypto/dh/dh_group_params.c index c71f4053da6..3f843fe9569 100644 --- a/deps/openssl/openssl/crypto/dh/dh_group_params.c +++ b/deps/openssl/openssl/crypto/dh/dh_group_params.c @@ -1,5 +1,5 @@ /* - * Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -23,7 +23,6 @@ #include <openssl/objects.h> #include "internal/nelem.h" #include "crypto/dh.h" -#include "e_os.h" /* strcasecmp */ static DH *dh_param_init(OSSL_LIB_CTX *libctx, const DH_NAMED_GROUP *group) { diff --git a/deps/openssl/openssl/crypto/dh/dh_kdf.c b/deps/openssl/openssl/crypto/dh/dh_kdf.c index 419e7711d36..6e99466e60b 100644 --- a/deps/openssl/openssl/crypto/dh/dh_kdf.c +++ b/deps/openssl/openssl/crypto/dh/dh_kdf.c @@ -1,5 +1,5 @@ /* - * Copyright 2013-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2013-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -39,6 +39,8 @@ int ossl_dh_kdf_X9_42_asn1(unsigned char *out, size_t outlen, const char *mdname = EVP_MD_get0_name(md); kdf = EVP_KDF_fetch(libctx, OSSL_KDF_NAME_X942KDF_ASN1, propq); + if (kdf == NULL) + return 0; kctx = EVP_KDF_CTX_new(kdf); if (kctx == NULL) goto err; diff --git a/deps/openssl/openssl/crypto/ec/curve448/curve448.c b/deps/openssl/openssl/crypto/ec/curve448/curve448.c index 9b9786da8fe..6928d9693ca 100644 --- a/deps/openssl/openssl/crypto/ec/curve448/curve448.c +++ b/deps/openssl/openssl/crypto/ec/curve448/curve448.c @@ -1,5 +1,5 @@ /* - * Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved. * Copyright 2015-2016 Cryptography Research, Inc. * * Licensed under the Apache License 2.0 (the "License"). You may not use @@ -586,6 +586,7 @@ static int recode_wnaf(struct smvt_control *control, int32_t delta = odd & mask; assert(position >= 0); + assert(pos < 32); /* can't fail since current & 0xFFFF != 0 */ if (odd & (1 << (table_bits + 1))) delta -= (1 << (table_bits + 1)); current -= delta * (1 << pos); diff --git a/deps/openssl/openssl/crypto/ec/ec_backend.c b/deps/openssl/openssl/crypto/ec/ec_backend.c index 381da71f33a..7abe26e2c48 100644 --- a/deps/openssl/openssl/crypto/ec/ec_backend.c +++ b/deps/openssl/openssl/crypto/ec/ec_backend.c @@ -1,5 +1,5 @@ /* - * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -54,7 +54,7 @@ int ossl_ec_encoding_name2id(const char *name) return OPENSSL_EC_NAMED_CURVE; for (i = 0, sz = OSSL_NELEM(encoding_nameid_map); i < sz; i++) { - if (strcasecmp(name, encoding_nameid_map[i].ptr) == 0) + if (OPENSSL_strcasecmp(name, encoding_nameid_map[i].ptr) == 0) return encoding_nameid_map[i].id; } return -1; @@ -91,7 +91,7 @@ static int ec_check_group_type_name2id(const char *name) return 0; for (i = 0, sz = OSSL_NELEM(check_group_type_nameid_map); i < sz; i++) { - if (strcasecmp(name, check_group_type_nameid_map[i].ptr) == 0) + if (OPENSSL_strcasecmp(name, check_group_type_nameid_map[i].ptr) == 0) return check_group_type_nameid_map[i].id; } return -1; @@ -136,7 +136,7 @@ int ossl_ec_pt_format_name2id(const char *name) return (int)POINT_CONVERSION_UNCOMPRESSED; for (i = 0, sz = OSSL_NELEM(format_nameid_map); i < sz; i++) { - if (strcasecmp(name, format_nameid_map[i].ptr) == 0) + if (OPENSSL_strcasecmp(name, format_nameid_map[i].ptr) == 0) return format_nameid_map[i].id; } return -1; diff --git a/deps/openssl/openssl/crypto/ec/ec_err.c b/deps/openssl/openssl/crypto/ec/ec_err.c index 9dc143c2ac6..4d6f2a76ad2 100644 --- a/deps/openssl/openssl/crypto/ec/ec_err.c +++ b/deps/openssl/openssl/crypto/ec/ec_err.c @@ -1,6 +1,6 @@ /* * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -35,6 +35,8 @@ static const ERR_STRING_DATA EC_str_reasons[] = { "discriminant is zero"}, {ERR_PACK(ERR_LIB_EC, 0, EC_R_EC_GROUP_NEW_BY_NAME_FAILURE), "ec group new by name failure"}, + {ERR_PACK(ERR_LIB_EC, 0, EC_R_EXPLICIT_PARAMS_NOT_SUPPORTED), + "explicit params not supported"}, {ERR_PACK(ERR_LIB_EC, 0, EC_R_FAILED_MAKING_PUBLIC_KEY), "failed making public key"}, {ERR_PACK(ERR_LIB_EC, 0, EC_R_FIELD_TOO_LARGE), "field too large"}, diff --git a/deps/openssl/openssl/crypto/ec/ec_lib.c b/deps/openssl/openssl/crypto/ec/ec_lib.c index 2ee8284eaff..6b0591c6c8c 100644 --- a/deps/openssl/openssl/crypto/ec/ec_lib.c +++ b/deps/openssl/openssl/crypto/ec/ec_lib.c @@ -22,7 +22,6 @@ #include "crypto/ec.h" #include "internal/nelem.h" #include "ec_local.h" -#include "e_os.h" /* strcasecmp */ /* functions for EC_GROUP objects */ @@ -1387,6 +1386,7 @@ int EC_GROUP_get_pentanomial_basis(const EC_GROUP *group, unsigned int *k1, } #endif +#ifndef FIPS_MODULE /* * Check if the explicit parameters group matches any built-in curves. * @@ -1424,7 +1424,7 @@ static EC_GROUP *ec_group_explicit_to_named(const EC_GROUP *group, * parameters with one created from a named group. */ -#ifndef OPENSSL_NO_EC_NISTP_64_GCC_128 +# ifndef OPENSSL_NO_EC_NISTP_64_GCC_128 /* * NID_wap_wsg_idm_ecid_wtls12 and NID_secp224r1 are both aliases for * the same curve, we prefer the SECP nid when matching explicit @@ -1432,7 +1432,7 @@ static EC_GROUP *ec_group_explicit_to_named(const EC_GROUP *group, */ if (curve_name_nid == NID_wap_wsg_idm_ecid_wtls12) curve_name_nid = NID_secp224r1; -#endif /* !def(OPENSSL_NO_EC_NISTP_64_GCC_128) */ +# endif /* !def(OPENSSL_NO_EC_NISTP_64_GCC_128) */ ret_group = EC_GROUP_new_by_curve_name_ex(libctx, propq, curve_name_nid); if (ret_group == NULL) @@ -1467,6 +1467,7 @@ err: EC_GROUP_free(ret_group); return NULL; } +#endif /* FIPS_MODULE */ static EC_GROUP *group_new_from_name(const OSSL_PARAM *p, OSSL_LIB_CTX *libctx, const char *propq) @@ -1536,9 +1537,13 @@ int ossl_ec_group_set_params(EC_GROUP *group, const OSSL_PARAM params[]) EC_GROUP *EC_GROUP_new_from_params(const OSSL_PARAM params[], OSSL_LIB_CTX *libctx, const char *propq) { - const OSSL_PARAM *ptmp, *pa, *pb; + const OSSL_PARAM *ptmp; + EC_GROUP *group = NULL; + +#ifndef FIPS_MODULE + const OSSL_PARAM *pa, *pb; int ok = 0; - EC_GROUP *group = NULL, *named_group = NULL; + EC_GROUP *named_group = NULL; BIGNUM *p = NULL, *a = NULL, *b = NULL, *order = NULL, *cofactor = NULL; EC_POINT *point = NULL; int field_bits = 0; @@ -1546,6 +1551,7 @@ EC_GROUP *EC_GROUP_new_from_params(const OSSL_PARAM params[], BN_CTX *bnctx = NULL; const unsigned char *buf = NULL; int encoding_flag = -1; +#endif /* This is the simple named group case */ ptmp = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_GROUP_NAME); @@ -1559,6 +1565,10 @@ EC_GROUP *EC_GROUP_new_from_params(const OSSL_PARAM params[], } return group; } +#ifdef FIPS_MODULE + ERR_raise(ERR_LIB_EC, EC_R_EXPLICIT_PARAMS_NOT_SUPPORTED); + return NULL; +#else /* If it gets here then we are trying explicit parameters */ bnctx = BN_CTX_new_ex(libctx); if (bnctx == NULL) { @@ -1581,9 +1591,10 @@ EC_GROUP *EC_GROUP_new_from_params(const OSSL_PARAM params[], ERR_raise(ERR_LIB_EC, EC_R_INVALID_FIELD); goto err; } - if (strcasecmp(ptmp->data, SN_X9_62_prime_field) == 0) { + if (OPENSSL_strcasecmp(ptmp->data, SN_X9_62_prime_field) == 0) { is_prime_field = 1; - } else if (strcasecmp(ptmp->data, SN_X9_62_characteristic_two_field) == 0) { + } else if (OPENSSL_strcasecmp(ptmp->data, + SN_X9_62_characteristic_two_field) == 0) { is_prime_field = 0; } else { /* Invalid field */ @@ -1623,10 +1634,10 @@ EC_GROUP *EC_GROUP_new_from_params(const OSSL_PARAM params[], /* create the EC_GROUP structure */ group = EC_GROUP_new_curve_GFp(p, a, b, bnctx); } else { -#ifdef OPENSSL_NO_EC2M +# ifdef OPENSSL_NO_EC2M ERR_raise(ERR_LIB_EC, EC_R_GF2M_NOT_SUPPORTED); goto err; -#else +# else /* create the EC_GROUP structure */ group = EC_GROUP_new_curve_GF2m(p, a, b, NULL); if (group != NULL) { @@ -1636,7 +1647,7 @@ EC_GROUP *EC_GROUP_new_from_params(const OSSL_PARAM params[], goto err; } } -#endif /* OPENSSL_NO_EC2M */ +# endif /* OPENSSL_NO_EC2M */ } if (group == NULL) { @@ -1733,4 +1744,5 @@ EC_GROUP *EC_GROUP_new_from_params(const OSSL_PARAM params[], BN_CTX_free(bnctx); return group; +#endif /* FIPS_MODULE */ } diff --git a/deps/openssl/openssl/crypto/ec/ecp_nistz256.c b/deps/openssl/openssl/crypto/ec/ecp_nistz256.c index a9982caef6c..d65f6984ded 100644 --- a/deps/openssl/openssl/crypto/ec/ecp_nistz256.c +++ b/deps/openssl/openssl/crypto/ec/ecp_nistz256.c @@ -1,5 +1,5 @@ /* - * Copyright 2014-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2014-2022 The OpenSSL Project Authors. All Rights Reserved. * Copyright (c) 2014, Intel Corporation. All Rights Reserved. * Copyright (c) 2015, CloudFlare, Inc. * @@ -978,6 +978,7 @@ __owur static int ecp_nistz256_points_mul(const EC_GROUP *group, return 0; } + memset(&p, 0, sizeof(p)); BN_CTX_start(ctx); if (scalar) { diff --git a/deps/openssl/openssl/crypto/encode_decode/decoder_lib.c b/deps/openssl/openssl/crypto/encode_decode/decoder_lib.c index 10a38b6f82a..334ff22ae71 100644 --- a/deps/openssl/openssl/crypto/encode_decode/decoder_lib.c +++ b/deps/openssl/openssl/crypto/encode_decode/decoder_lib.c @@ -1,5 +1,5 @@ /* - * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -789,7 +789,7 @@ static int decoder_process(const OSSL_PARAM params[], void *arg) */ trace_data_structure = data_structure; if (data_type != NULL && data_structure != NULL - && strcasecmp(data_structure, "type-specific") == 0) + && OPENSSL_strcasecmp(data_structure, "type-specific") == 0) data_structure = NULL; OSSL_TRACE_BEGIN(DECODER) { @@ -850,7 +850,7 @@ static int decoder_process(const OSSL_PARAM params[], void *arg) * that's the case, we do this extra check. */ if (decoder == NULL && ctx->start_input_type != NULL - && strcasecmp(ctx->start_input_type, new_input_type) != 0) { + && OPENSSL_strcasecmp(ctx->start_input_type, new_input_type) != 0) { OSSL_TRACE_BEGIN(DECODER) { BIO_printf(trc_out, "(ctx %p) %s [%u] the start input type '%s' doesn't match the input type of the considered decoder, skipping...\n", @@ -896,7 +896,8 @@ static int decoder_process(const OSSL_PARAM params[], void *arg) */ if (data_structure != NULL && (new_input_structure == NULL - || strcasecmp(data_structure, new_input_structure) != 0)) { + || OPENSSL_strcasecmp(data_structure, + new_input_structure) != 0)) { OSSL_TRACE_BEGIN(DECODER) { BIO_printf(trc_out, "(ctx %p) %s [%u] the previous decoder's data structure doesn't match the input structure of the considered decoder, skipping...\n", @@ -915,7 +916,8 @@ static int decoder_process(const OSSL_PARAM params[], void *arg) && ctx->input_structure != NULL && new_input_structure != NULL) { data->flag_input_structure_checked = 1; - if (strcasecmp(new_input_structure, ctx->input_structure) != 0) { + if (OPENSSL_strcasecmp(new_input_structure, + ctx->input_structure) != 0) { OSSL_TRACE_BEGIN(DECODER) { BIO_printf(trc_out, "(ctx %p) %s [%u] the previous decoder's data structure doesn't match the input structure given by the user, skipping...\n", diff --git a/deps/openssl/openssl/crypto/encode_decode/decoder_pkey.c b/deps/openssl/openssl/crypto/encode_decode/decoder_pkey.c index 475117a463a..ed10bb1cee0 100644 --- a/deps/openssl/openssl/crypto/encode_decode/decoder_pkey.c +++ b/deps/openssl/openssl/crypto/encode_decode/decoder_pkey.c @@ -1,5 +1,5 @@ /* - * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -18,7 +18,6 @@ #include "crypto/evp.h" #include "crypto/decoder.h" #include "encoder_local.h" -#include "e_os.h" /* strcasecmp on Windows */ int OSSL_DECODER_CTX_set_passphrase(OSSL_DECODER_CTX *ctx, const unsigned char *kstr, diff --git a/deps/openssl/openssl/crypto/encode_decode/encoder_lib.c b/deps/openssl/openssl/crypto/encode_decode/encoder_lib.c index cfd9275172f..7a55c7ab9a2 100644 --- a/deps/openssl/openssl/crypto/encode_decode/encoder_lib.c +++ b/deps/openssl/openssl/crypto/encode_decode/encoder_lib.c @@ -1,5 +1,5 @@ /* - * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -7,7 +7,6 @@ * https://www.openssl.org/source/license.html */ -#include "e_os.h" /* strcasecmp on Windows */ #include <openssl/core_names.h> #include <openssl/bio.h> #include <openssl/encoder.h> @@ -453,8 +452,8 @@ static int encoder_process(struct encoder_process_data_st *data) */ if (top) { if (data->ctx->output_type != NULL - && strcasecmp(current_output_type, - data->ctx->output_type) != 0) { + && OPENSSL_strcasecmp(current_output_type, + data->ctx->output_type) != 0) { OSSL_TRACE_BEGIN(ENCODER) { BIO_printf(trc_out, "[%d] Skipping because current encoder output type (%s) != desired output type (%s)\n", @@ -482,8 +481,8 @@ static int encoder_process(struct encoder_process_data_st *data) */ if (data->ctx->output_structure != NULL && current_output_structure != NULL) { - if (strcasecmp(data->ctx->output_structure, - current_output_structure) != 0) { + if (OPENSSL_strcasecmp(data->ctx->output_structure, + current_output_structure) != 0) { OSSL_TRACE_BEGIN(ENCODER) { BIO_printf(trc_out, "[%d] Skipping because current encoder output structure (%s) != ctx output structure (%s)\n", diff --git a/deps/openssl/openssl/crypto/encode_decode/encoder_pkey.c b/deps/openssl/openssl/crypto/encode_decode/encoder_pkey.c index c37edf966d7..3a24317cf4d 100644 --- a/deps/openssl/openssl/crypto/encode_decode/encoder_pkey.c +++ b/deps/openssl/openssl/crypto/encode_decode/encoder_pkey.c @@ -7,7 +7,6 @@ * https://www.openssl.org/source/license.html */ -#include "e_os.h" /* strcasecmp on Windows */ #include <openssl/err.h> #include <openssl/ui.h> #include <openssl/params.h> diff --git a/deps/openssl/openssl/crypto/engine/eng_dyn.c b/deps/openssl/openssl/crypto/engine/eng_dyn.c index 3c0f960fc52..6d402927c54 100644 --- a/deps/openssl/openssl/crypto/engine/eng_dyn.c +++ b/deps/openssl/openssl/crypto/engine/eng_dyn.c @@ -401,6 +401,26 @@ static int int_load(dynamic_data_ctx *ctx) return 0; } +/* + * Unfortunately the version checker does not distinguish between + * engines built for openssl 1.1.x and openssl 3.x, but loading + * an engine that is built for openssl 1.1.x will cause a fatal + * error. Detect such engines, since EVP_PKEY_base_id is exported + * as a function in openssl 1.1.x, while it is named EVP_PKEY_get_base_id + * in openssl 3.x. Therefore we take the presence of that symbol + * as an indication that the engine will be incompatible. + */ +static int using_libcrypto_11(dynamic_data_ctx *ctx) +{ + int ret; + + ERR_set_mark(); + ret = DSO_bind_func(ctx->dynamic_dso, "EVP_PKEY_base_id") != NULL; + ERR_pop_to_mark(); + + return ret; +} + static int dynamic_load(ENGINE *e, dynamic_data_ctx *ctx) { ENGINE cpy; @@ -450,18 +470,9 @@ static int dynamic_load(ENGINE *e, dynamic_data_ctx *ctx) /* * We fail if the version checker veto'd the load *or* if it is * deferring to us (by returning its version) and we think it is too - * old. - * Unfortunately the version checker does not distinguish between - * engines built for openssl 1.1.x and openssl 3.x, but loading - * an engine that is built for openssl 1.1.x will cause a fatal - * error. Detect such engines, since EVP_PKEY_base_id is exported - * as a function in openssl 1.1.x, while it is a macro in openssl 3.x, - * and therefore only the symbol EVP_PKEY_get_base_id is available - * in openssl 3.x. + * old. Also fail if this is engine for openssl 1.1.x. */ - if (vcheck_res < OSSL_DYNAMIC_OLDEST - || DSO_bind_func(ctx->dynamic_dso, - "EVP_PKEY_base_id") != NULL) { + if (vcheck_res < OSSL_DYNAMIC_OLDEST || using_libcrypto_11(ctx)) { /* Fail */ ctx->bind_engine = NULL; ctx->v_check = NULL; diff --git a/deps/openssl/openssl/crypto/engine/tb_asnmth.c b/deps/openssl/openssl/crypto/engine/tb_asnmth.c index e3a5c82e995..81f8e7add0e 100644 --- a/deps/openssl/openssl/crypto/engine/tb_asnmth.c +++ b/deps/openssl/openssl/crypto/engine/tb_asnmth.c @@ -1,5 +1,5 @@ /* - * Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2006-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -152,7 +152,7 @@ const EVP_PKEY_ASN1_METHOD *ENGINE_get_pkey_asn1_meth_str(ENGINE *e, e->pkey_asn1_meths(e, &ameth, NULL, nids[i]); if (ameth != NULL && ((int)strlen(ameth->pem_str) == len) - && strncasecmp(ameth->pem_str, str, len) == 0) + && OPENSSL_strncasecmp(ameth->pem_str, str, len) == 0) return ameth; } return NULL; @@ -177,7 +177,7 @@ static void look_str_cb(int nid, STACK_OF(ENGINE) *sk, ENGINE *def, void *arg) e->pkey_asn1_meths(e, &ameth, NULL, nid); if (ameth != NULL && ((int)strlen(ameth->pem_str) == lk->len) - && strncasecmp(ameth->pem_str, lk->str, lk->len) == 0) { + && OPENSSL_strncasecmp(ameth->pem_str, lk->str, lk->len) == 0) { lk->e = e; lk->ameth = ameth; return; diff --git a/deps/openssl/openssl/crypto/err/openssl.txt b/deps/openssl/openssl/crypto/err/openssl.txt index ce9d274e689..f6ad0dbf484 100644 --- a/deps/openssl/openssl/crypto/err/openssl.txt +++ b/deps/openssl/openssl/crypto/err/openssl.txt @@ -1,4 +1,4 @@ -# Copyright 1999-2021 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 1999-2022 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -537,6 +537,7 @@ EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING:159:curve does not support signing EC_R_DECODE_ERROR:142:decode error EC_R_DISCRIMINANT_IS_ZERO:118:discriminant is zero EC_R_EC_GROUP_NEW_BY_NAME_FAILURE:119:ec group new by name failure +EC_R_EXPLICIT_PARAMS_NOT_SUPPORTED:127:explicit params not supported EC_R_FAILED_MAKING_PUBLIC_KEY:166:failed making public key EC_R_FIELD_TOO_LARGE:143:field too large EC_R_GF2M_NOT_SUPPORTED:147:gf2m not supported diff --git a/deps/openssl/openssl/crypto/evp/ctrl_params_translate.c b/deps/openssl/openssl/crypto/evp/ctrl_params_translate.c index 961ca116b32..7d2f501dfb1 100644 --- a/deps/openssl/openssl/crypto/evp/ctrl_params_translate.c +++ b/deps/openssl/openssl/crypto/evp/ctrl_params_translate.c @@ -37,8 +37,6 @@ #include "crypto/dh.h" #include "crypto/ec.h" -#include "e_os.h" /* strcasecmp() for Windows */ - struct translation_ctx_st; /* Forwarding */ struct translation_st; /* Forwarding */ @@ -905,7 +903,7 @@ static int fix_kdf_type(enum state state, /* Convert KDF type strings to numbers */ for (; kdf_type_map->kdf_type_str != NULL; kdf_type_map++) - if (strcasecmp(ctx->p2, kdf_type_map->kdf_type_str) == 0) { + if (OPENSSL_strcasecmp(ctx->p2, kdf_type_map->kdf_type_str) == 0) { ctx->p1 = kdf_type_map->kdf_type_num; ret = 1; break; @@ -1074,7 +1072,11 @@ static int fix_dh_paramgen_type(enum state state, return 0; if (state == PRE_CTRL_STR_TO_PARAMS) { - ctx->p2 = (char *)ossl_dh_gen_type_id2name(atoi(ctx->p2)); + if ((ctx->p2 = (char *)ossl_dh_gen_type_id2name(atoi(ctx->p2))) + == NULL) { + ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_VALUE); + return 0; + } ctx->p1 = strlen(ctx->p2); } @@ -2469,10 +2471,11 @@ lookup_translation(struct translation_st *tmpl, * cmd name in the template. */ if (item->ctrl_str != NULL - && strcasecmp(tmpl->ctrl_str, item->ctrl_str) == 0) + && OPENSSL_strcasecmp(tmpl->ctrl_str, item->ctrl_str) == 0) ctrl_str = tmpl->ctrl_str; else if (item->ctrl_hexstr != NULL - && strcasecmp(tmpl->ctrl_hexstr, item->ctrl_hexstr) == 0) + && OPENSSL_strcasecmp(tmpl->ctrl_hexstr, + item->ctrl_hexstr) == 0) ctrl_hexstr = tmpl->ctrl_hexstr; else continue; @@ -2500,7 +2503,8 @@ lookup_translation(struct translation_st *tmpl, if ((item->action_type != NONE && tmpl->action_type != item->action_type) || (item->param_key != NULL - && strcasecmp(tmpl->param_key, item->param_key) != 0)) + && OPENSSL_strcasecmp(tmpl->param_key, + item->param_key) != 0)) continue; } else { return NULL; diff --git a/deps/openssl/openssl/crypto/evp/ec_support.c b/deps/openssl/openssl/crypto/evp/ec_support.c index 8550be65e78..1ec10143d2d 100644 --- a/deps/openssl/openssl/crypto/evp/ec_support.c +++ b/deps/openssl/openssl/crypto/evp/ec_support.c @@ -1,5 +1,5 @@ /* - * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -10,7 +10,7 @@ #include <string.h> #include <openssl/ec.h> #include "crypto/ec.h" -#include "e_os.h" /* strcasecmp required by windows */ +#include "internal/nelem.h" typedef struct ec_name2nid_st { const char *name; @@ -139,7 +139,7 @@ int ossl_ec_curve_name2nid(const char *name) return nid; for (i = 0; i < OSSL_NELEM(curve_list); i++) { - if (strcasecmp(curve_list[i].name, name) == 0) + if (OPENSSL_strcasecmp(curve_list[i].name, name) == 0) return curve_list[i].nid; } } diff --git a/deps/openssl/openssl/crypto/evp/evp_enc.c b/deps/openssl/openssl/crypto/evp/evp_enc.c index d0cf7d995fe..19a07debd94 100644 --- a/deps/openssl/openssl/crypto/evp/evp_enc.c +++ b/deps/openssl/openssl/crypto/evp/evp_enc.c @@ -344,8 +344,10 @@ static int evp_cipher_init_internal(EVP_CIPHER_CTX *ctx, case EVP_CIPH_CBC_MODE: n = EVP_CIPHER_CTX_get_iv_length(ctx); - if (!ossl_assert(n >= 0 && n <= (int)sizeof(ctx->iv))) - return 0; + if (n < 0 || n > (int)sizeof(ctx->iv)) { + ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_IV_LENGTH); + return 0; + } if (iv != NULL) memcpy(ctx->oiv, iv, n); memcpy(ctx->iv, ctx->oiv, n); @@ -355,8 +357,11 @@ static int evp_cipher_init_internal(EVP_CIPHER_CTX *ctx, ctx->num = 0; /* Don't reuse IV for CTR mode */ if (iv != NULL) { - if ((n = EVP_CIPHER_CTX_get_iv_length(ctx)) <= 0) + n = EVP_CIPHER_CTX_get_iv_length(ctx); + if (n <= 0 || n > (int)sizeof(ctx->iv)) { + ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_IV_LENGTH); return 0; + } memcpy(ctx->iv, iv, n); } break; diff --git a/deps/openssl/openssl/crypto/evp/evp_lib.c b/deps/openssl/openssl/crypto/evp/evp_lib.c index 24092cfd5be..3fe4743761c 100644 --- a/deps/openssl/openssl/crypto/evp/evp_lib.c +++ b/deps/openssl/openssl/crypto/evp/evp_lib.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -15,7 +15,6 @@ #include <stdio.h> #include <string.h> -#include "e_os.h" /* strcasecmp */ #include "internal/cryptlib.h" #include <openssl/evp.h> #include <openssl/objects.h> @@ -1170,17 +1169,17 @@ EVP_PKEY *EVP_PKEY_Q_keygen(OSSL_LIB_CTX *libctx, const char *propq, va_start(args, type); - if (strcasecmp(type, "RSA") == 0) { + if (OPENSSL_strcasecmp(type, "RSA") == 0) { bits = va_arg(args, size_t); params[0] = OSSL_PARAM_construct_size_t(OSSL_PKEY_PARAM_RSA_BITS, &bits); - } else if (strcasecmp(type, "EC") == 0) { + } else if (OPENSSL_strcasecmp(type, "EC") == 0) { name = va_arg(args, char *); params[0] = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_GROUP_NAME, name, 0); - } else if (strcasecmp(type, "ED25519") != 0 - && strcasecmp(type, "X25519") != 0 - && strcasecmp(type, "ED448") != 0 - && strcasecmp(type, "X448") != 0) { + } else if (OPENSSL_strcasecmp(type, "ED25519") != 0 + && OPENSSL_strcasecmp(type, "X25519") != 0 + && OPENSSL_strcasecmp(type, "ED448") != 0 + && OPENSSL_strcasecmp(type, "X448") != 0) { ERR_raise(ERR_LIB_EVP, ERR_R_PASSED_INVALID_ARGUMENT); goto end; } diff --git a/deps/openssl/openssl/crypto/evp/p5_crpt2.c b/deps/openssl/openssl/crypto/evp/p5_crpt2.c index 7088875fe1f..8e3fccb213f 100644 --- a/deps/openssl/openssl/crypto/evp/p5_crpt2.c +++ b/deps/openssl/openssl/crypto/evp/p5_crpt2.c @@ -1,5 +1,5 @@ /* - * Copyright 1999-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1999-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -42,6 +42,8 @@ int ossl_pkcs5_pbkdf2_hmac_ex(const char *pass, int passlen, salt = (unsigned char *)empty; kdf = EVP_KDF_fetch(libctx, OSSL_KDF_NAME_PBKDF2, propq); + if (kdf == NULL) + return 0; kctx = EVP_KDF_CTX_new(kdf); EVP_KDF_free(kdf); if (kctx == NULL) diff --git a/deps/openssl/openssl/crypto/evp/p_lib.c b/deps/openssl/openssl/crypto/evp/p_lib.c index 27138af5642..a4ad904f773 100644 --- a/deps/openssl/openssl/crypto/evp/p_lib.c +++ b/deps/openssl/openssl/crypto/evp/p_lib.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -50,8 +50,6 @@ #include "internal/provider.h" #include "evp_local.h" -#include "e_os.h" /* strcasecmp on Windows */ - static int pkey_set_type(EVP_PKEY *pkey, ENGINE *e, int type, const char *str, int len, EVP_KEYMGMT *keymgmt); static void evp_pkey_free_it(EVP_PKEY *key); @@ -1018,7 +1016,7 @@ int evp_pkey_name2type(const char *name) size_t i; for (i = 0; i < OSSL_NELEM(standard_name2type); i++) { - if (strcasecmp(name, standard_name2type[i].ptr) == 0) + if (OPENSSL_strcasecmp(name, standard_name2type[i].ptr) == 0) return (int)standard_name2type[i].id; } diff --git a/deps/openssl/openssl/crypto/evp/pmeth_lib.c b/deps/openssl/openssl/crypto/evp/pmeth_lib.c index 2b9c6c2351d..b5854105769 100644 --- a/deps/openssl/openssl/crypto/evp/pmeth_lib.c +++ b/deps/openssl/openssl/crypto/evp/pmeth_lib.c @@ -1,5 +1,5 @@ /* - * Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2006-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -27,6 +27,7 @@ #ifndef FIPS_MODULE # include "crypto/asn1.h" #endif +#include "crypto/ctype.h" #include "crypto/evp.h" #include "crypto/dh.h" #include "crypto/ec.h" @@ -199,6 +200,7 @@ static EVP_PKEY_CTX *int_ctx_new(OSSL_LIB_CTX *libctx, } #ifndef FIPS_MODULE if (keytype != NULL) { + ossl_init_casecmp(); id = evp_pkey_name2type(keytype); if (id == NID_undef) id = -1; diff --git a/deps/openssl/openssl/crypto/ffc/ffc_dh.c b/deps/openssl/openssl/crypto/ffc/ffc_dh.c index e9f597c46c0..9a7e99cff67 100644 --- a/deps/openssl/openssl/crypto/ffc/ffc_dh.c +++ b/deps/openssl/openssl/crypto/ffc/ffc_dh.c @@ -1,5 +1,5 @@ /* - * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -10,7 +10,6 @@ #include "internal/ffc.h" #include "internal/nelem.h" #include "crypto/bn_dh.h" -#include "e_os.h" /* strcasecmp */ #ifndef OPENSSL_NO_DH @@ -84,7 +83,7 @@ const DH_NAMED_GROUP *ossl_ffc_name_to_dh_named_group(const char *name) size_t i; for (i = 0; i < OSSL_NELEM(dh_named_groups); ++i) { - if (strcasecmp(dh_named_groups[i].name, name) == 0) + if (OPENSSL_strcasecmp(dh_named_groups[i].name, name) == 0) return &dh_named_groups[i]; } return NULL; diff --git a/deps/openssl/openssl/crypto/ffc/ffc_params.c b/deps/openssl/openssl/crypto/ffc/ffc_params.c index 6e025a06be6..073f661c7c4 100644 --- a/deps/openssl/openssl/crypto/ffc/ffc_params.c +++ b/deps/openssl/openssl/crypto/ffc/ffc_params.c @@ -1,5 +1,5 @@ /* - * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -12,7 +12,6 @@ #include "internal/ffc.h" #include "internal/param_build_set.h" #include "internal/nelem.h" -#include "e_os.h" /* strcasecmp */ #ifndef FIPS_MODULE # include <openssl/asn1.h> /* ossl_ffc_params_print */ diff --git a/deps/openssl/openssl/crypto/http/http_client.c b/deps/openssl/openssl/crypto/http/http_client.c index 33e7b82b9e8..59a34458131 100644 --- a/deps/openssl/openssl/crypto/http/http_client.c +++ b/deps/openssl/openssl/crypto/http/http_client.c @@ -322,7 +322,7 @@ static int add1_headers(OSSL_HTTP_REQ_CTX *rctx, for (i = 0; i < sk_CONF_VALUE_num(headers); i++) { hdr = sk_CONF_VALUE_value(headers, i); - if (add_host && strcasecmp("host", hdr->name) == 0) + if (add_host && OPENSSL_strcasecmp("host", hdr->name) == 0) add_host = 0; if (!OSSL_HTTP_REQ_CTX_add1_header(rctx, hdr->name, hdr->value)) return 0; @@ -666,13 +666,13 @@ int OSSL_HTTP_REQ_CTX_nbio(OSSL_HTTP_REQ_CTX *rctx) } if (value != NULL && line_end != NULL) { if (rctx->state == OHS_REDIRECT - && strcasecmp(key, "Location") == 0) { + && OPENSSL_strcasecmp(key, "Location") == 0) { rctx->redirection_url = value; return 0; } - if (rctx->expected_ct != NULL - && strcasecmp(key, "Content-Type") == 0) { - if (strcasecmp(rctx->expected_ct, value) != 0) { + if (rctx->state == OHS_HEADERS && rctx->expected_ct != NULL + && OPENSSL_strcasecmp(key, "Content-Type") == 0) { + if (OPENSSL_strcasecmp(rctx->expected_ct, value) != 0) { ERR_raise_data(ERR_LIB_HTTP, HTTP_R_UNEXPECTED_CONTENT_TYPE, "expected=%s, actual=%s", rctx->expected_ct, value); @@ -682,12 +682,12 @@ int OSSL_HTTP_REQ_CTX_nbio(OSSL_HTTP_REQ_CTX *rctx) } /* https://tools.ietf.org/html/rfc7230#section-6.3 Persistence */ - if (strcasecmp(key, "Connection") == 0) { - if (strcasecmp(value, "keep-alive") == 0) + if (OPENSSL_strcasecmp(key, "Connection") == 0) { + if (OPENSSL_strcasecmp(value, "keep-alive") == 0) found_keep_alive = 1; - else if (strcasecmp(value, "close") == 0) + else if (OPENSSL_strcasecmp(value, "close") == 0) found_keep_alive = 0; - } else if (strcasecmp(key, "Content-Length") == 0) { + } else if (OPENSSL_strcasecmp(key, "Content-Length") == 0) { resp_len = (size_t)strtoul(value, &line_end, 10); if (line_end == value || *line_end != '\0') { ERR_raise_data(ERR_LIB_HTTP, diff --git a/deps/openssl/openssl/crypto/init.c b/deps/openssl/openssl/crypto/init.c index 6a27d1a8e44..8d9ed7e9b2d 100644 --- a/deps/openssl/openssl/crypto/init.c +++ b/deps/openssl/openssl/crypto/init.c @@ -1,5 +1,5 @@ /* - * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -32,6 +32,7 @@ #include "crypto/store.h" #include <openssl/cmp_util.h> /* for OSSL_CMP_log_close() */ #include <openssl/trace.h> +#include "crypto/ctype.h" static int stopped = 0; static uint64_t optsdone = 0; @@ -447,6 +448,9 @@ void OPENSSL_cleanup(void) OSSL_TRACE(INIT, "OPENSSL_cleanup: ossl_trace_cleanup()\n"); ossl_trace_cleanup(); + OSSL_TRACE(INIT, "OPENSSL_cleanup: ossl_deinit_casecmp()\n"); + ossl_deinit_casecmp(); + base_inited = 0; } @@ -460,6 +464,9 @@ int OPENSSL_init_crypto(uint64_t opts, const OPENSSL_INIT_SETTINGS *settings) uint64_t tmp; int aloaddone = 0; + if (!ossl_init_casecmp()) + return 0; + /* Applications depend on 0 being returned when cleanup was already done */ if (stopped) { if (!(opts & OPENSSL_INIT_BASE_ONLY)) diff --git a/deps/openssl/openssl/crypto/lhash/lh_stats.c b/deps/openssl/openssl/crypto/lhash/lh_stats.c index 47c4e932e5e..ba4d4ea8970 100644 --- a/deps/openssl/openssl/crypto/lhash/lh_stats.c +++ b/deps/openssl/openssl/crypto/lhash/lh_stats.c @@ -61,37 +61,22 @@ void OPENSSL_LH_node_usage_stats(const OPENSSL_LHASH *lh, FILE *fp) void OPENSSL_LH_stats_bio(const OPENSSL_LHASH *lh, BIO *out) { - int omit_tsan = 0; - -#ifdef TSAN_REQUIRES_LOCKING - if (!CRYPTO_THREAD_read_lock(lh->tsan_lock)) { - BIO_printf(out, "unable to lock table, omitting TSAN counters\n"); - omit_tsan = 1; - } -#endif BIO_printf(out, "num_items = %lu\n", lh->num_items); BIO_printf(out, "num_nodes = %u\n", lh->num_nodes); BIO_printf(out, "num_alloc_nodes = %u\n", lh->num_alloc_nodes); - BIO_printf(out, "num_expands = %lu\n", lh->num_expands); - BIO_printf(out, "num_expand_reallocs = %lu\n", lh->num_expand_reallocs); - BIO_printf(out, "num_contracts = %lu\n", lh->num_contracts); - BIO_printf(out, "num_contract_reallocs = %lu\n", lh->num_contract_reallocs); - if (!omit_tsan) { - BIO_printf(out, "num_hash_calls = %lu\n", lh->num_hash_calls); - BIO_printf(out, "num_comp_calls = %lu\n", lh->num_comp_calls); - } - BIO_printf(out, "num_insert = %lu\n", lh->num_insert); - BIO_printf(out, "num_replace = %lu\n", lh->num_replace); - BIO_printf(out, "num_delete = %lu\n", lh->num_delete); - BIO_printf(out, "num_no_delete = %lu\n", lh->num_no_delete); - if (!omit_tsan) { - BIO_printf(out, "num_retrieve = %lu\n", lh->num_retrieve); - BIO_printf(out, "num_retrieve_miss = %lu\n", lh->num_retrieve_miss); - BIO_printf(out, "num_hash_comps = %lu\n", lh->num_hash_comps); -#ifdef TSAN_REQUIRES_LOCKING - CRYPTO_THREAD_unlock(lh->tsan_lock); -#endif - } + BIO_printf(out, "num_expands = 0\n"); + BIO_printf(out, "num_expand_reallocs = 0\n"); + BIO_printf(out, "num_contracts = 0\n"); + BIO_printf(out, "num_contract_reallocs = 0\n"); + BIO_printf(out, "num_hash_calls = 0\n"); + BIO_printf(out, "num_comp_calls = 0\n"); + BIO_printf(out, "num_insert = 0\n"); + BIO_printf(out, "num_replace = 0\n"); + BIO_printf(out, "num_delete = 0\n"); + BIO_printf(out, "num_no_delete = 0\n"); + BIO_printf(out, "num_retrieve = 0\n"); + BIO_printf(out, "num_retrieve_miss = 0\n"); + BIO_printf(out, "num_hash_comps = 0\n"); } void OPENSSL_LH_node_stats_bio(const OPENSSL_LHASH *lh, BIO *out) diff --git a/deps/openssl/openssl/crypto/lhash/lhash.c b/deps/openssl/openssl/crypto/lhash/lhash.c index 002cca07eae..1cd988f01fc 100644 --- a/deps/openssl/openssl/crypto/lhash/lhash.c +++ b/deps/openssl/openssl/crypto/lhash/lhash.c @@ -44,22 +44,6 @@ static int expand(OPENSSL_LHASH *lh); static void contract(OPENSSL_LHASH *lh); static OPENSSL_LH_NODE **getrn(OPENSSL_LHASH *lh, const void *data, unsigned long *rhash); -static ossl_inline int tsan_lock(const OPENSSL_LHASH *lh) -{ -#ifdef TSAN_REQUIRES_LOCKING - if (!CRYPTO_THREAD_write_lock(lh->tsan_lock)) - return 0; -#endif - return 1; -} - -static ossl_inline void tsan_unlock(const OPENSSL_LHASH *lh) -{ -#ifdef TSAN_REQUIRES_LOCKING - CRYPTO_THREAD_unlock(lh->tsan_lock); -#endif -} - OPENSSL_LHASH *OPENSSL_LH_new(OPENSSL_LH_HASHFUNC h, OPENSSL_LH_COMPFUNC c) { OPENSSL_LHASH *ret; @@ -74,10 +58,6 @@ OPENSSL_LHASH *OPENSSL_LH_new(OPENSSL_LH_HASHFUNC h, OPENSSL_LH_COMPFUNC c) } if ((ret->b = OPENSSL_zalloc(sizeof(*ret->b) * MIN_NODES)) == NULL) goto err; -#ifdef TSAN_REQUIRES_LOCKING - if ((ret->tsan_lock = CRYPTO_THREAD_lock_new()) == NULL) - goto err; -#endif ret->comp = ((c == NULL) ? (OPENSSL_LH_COMPFUNC)strcmp : c); ret->hash = ((h == NULL) ? (OPENSSL_LH_HASHFUNC)OPENSSL_LH_strhash : h); ret->num_nodes = MIN_NODES / 2; @@ -99,9 +79,6 @@ void OPENSSL_LH_free(OPENSSL_LHASH *lh) return; OPENSSL_LH_flush(lh); -#ifdef TSAN_REQUIRES_LOCKING - CRYPTO_THREAD_lock_free(lh->tsan_lock); -#endif OPENSSL_free(lh->b); OPENSSL_free(lh); } @@ -123,6 +100,8 @@ void OPENSSL_LH_flush(OPENSSL_LHASH *lh) } lh->b[i] = NULL; } + + lh->num_items = 0; } void *OPENSSL_LH_insert(OPENSSL_LHASH *lh, void *data) @@ -147,12 +126,10 @@ void *OPENSSL_LH_insert(OPENSSL_LHASH *lh, void *data) nn->hash = hash; *rn = nn; ret = NULL; - lh->num_insert++; lh->num_items++; } else { /* replace same key */ ret = (*rn)->data; (*rn)->data = data; - lh->num_replace++; } return ret; } @@ -167,14 +144,12 @@ void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data) rn = getrn(lh, data, &hash); if (*rn == NULL) { - lh->num_no_delete++; return NULL; } else { nn = *rn; *rn = nn->next; ret = nn->data; OPENSSL_free(nn); - lh->num_delete++; } lh->num_items--; @@ -190,18 +165,11 @@ void *OPENSSL_LH_retrieve(OPENSSL_LHASH *lh, const void *data) unsigned long hash; OPENSSL_LH_NODE **rn; - /*- - * This should be atomic without tsan. - * It's not clear why it was done this way and not elsewhere. - */ - tsan_store((TSAN_QUALIFIER int *)&lh->error, 0); + if (lh->error != 0) + lh->error = 0; rn = getrn(lh, data, &hash); - if (tsan_lock(lh)) { - tsan_counter(*rn == NULL ? &lh->num_retrieve_miss : &lh->num_retrieve); - tsan_unlock(lh); - } return *rn == NULL ? NULL : (*rn)->data; } @@ -262,14 +230,12 @@ static int expand(OPENSSL_LHASH *lh) memset(n + nni, 0, sizeof(*n) * (j - nni)); lh->pmax = nni; lh->num_alloc_nodes = j; - lh->num_expand_reallocs++; lh->p = 0; } else { lh->p++; } lh->num_nodes++; - lh->num_expands++; n1 = &(lh->b[p]); n2 = &(lh->b[p + pmax]); *n2 = NULL; @@ -302,7 +268,6 @@ static void contract(OPENSSL_LHASH *lh) lh->error++; return; } - lh->num_contract_reallocs++; lh->num_alloc_nodes /= 2; lh->pmax /= 2; lh->p = lh->pmax - 1; @@ -311,7 +276,6 @@ static void contract(OPENSSL_LHASH *lh) lh->p--; lh->num_nodes--; - lh->num_contracts++; n1 = lh->b[(int)lh->p]; if (n1 == NULL) @@ -329,14 +293,8 @@ static OPENSSL_LH_NODE **getrn(OPENSSL_LHASH *lh, OPENSSL_LH_NODE **ret, *n1; unsigned long hash, nn; OPENSSL_LH_COMPFUNC cf; - int do_tsan = 1; -#ifdef TSAN_REQUIRES_LOCKING - do_tsan = tsan_lock(lh); -#endif hash = (*(lh->hash)) (data); - if (do_tsan) - tsan_counter(&lh->num_hash_calls); *rhash = hash; nn = hash % lh->pmax; @@ -346,20 +304,14 @@ static OPENSSL_LH_NODE **getrn(OPENSSL_LHASH *lh, cf = lh->comp; ret = &(lh->b[(int)nn]); for (n1 = *ret; n1 != NULL; n1 = n1->next) { - if (do_tsan) - tsan_counter(&lh->num_hash_comps); if (n1->hash != hash) { ret = &(n1->next); continue; } - if (do_tsan) - tsan_counter(&lh->num_comp_calls); if (cf(n1->data, data) == 0) break; ret = &(n1->next); } - if (do_tsan) - tsan_unlock(lh); return ret; } diff --git a/deps/openssl/openssl/crypto/lhash/lhash_local.h b/deps/openssl/openssl/crypto/lhash/lhash_local.h index 61687c5ce2b..088ac94d2e6 100644 --- a/deps/openssl/openssl/crypto/lhash/lhash_local.h +++ b/deps/openssl/openssl/crypto/lhash/lhash_local.h @@ -27,21 +27,5 @@ struct lhash_st { unsigned long up_load; /* load times 256 */ unsigned long down_load; /* load times 256 */ unsigned long num_items; - unsigned long num_expands; - unsigned long num_expand_reallocs; - unsigned long num_contracts; - unsigned long num_contract_reallocs; - TSAN_QUALIFIER unsigned long num_hash_calls; - TSAN_QUALIFIER unsigned long num_comp_calls; - unsigned long num_insert; - unsigned long num_replace; - unsigned long num_delete; - unsigned long num_no_delete; - TSAN_QUALIFIER unsigned long num_retrieve; - TSAN_QUALIFIER unsigned long num_retrieve_miss; - TSAN_QUALIFIER unsigned long num_hash_comps; int error; -#ifdef TSAN_REQUIRES_LOCKING - CRYPTO_RWLOCK *tsan_lock; -#endif }; diff --git a/deps/openssl/openssl/crypto/objects/o_names.c b/deps/openssl/openssl/crypto/objects/o_names.c index 92152eeb667..791f2b011e3 100644 --- a/deps/openssl/openssl/crypto/objects/o_names.c +++ b/deps/openssl/openssl/crypto/objects/o_names.c @@ -1,5 +1,5 @@ /* - * Copyright 1998-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1998-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -22,23 +22,6 @@ #include "e_os.h" /* - * We define this wrapper for two reasons. Firstly, later versions of - * DEC C add linkage information to certain functions, which makes it - * tricky to use them as values to regular function pointers. - * Secondly, in the EDK2 build environment, the strcasecmp function is - * actually an external function with the Microsoft ABI, so we can't - * transparently assign function pointers to it. - */ -#if defined(OPENSSL_SYS_VMS_DECC) || defined(OPENSSL_SYS_UEFI) -static int obj_strcasecmp(const char *a, const char *b) -{ - return strcasecmp(a, b); -} -#else -#define obj_strcasecmp strcasecmp -#endif - -/* * I use the ex_data stuff to manage the identifiers for the obj_name_types * that applications may define. I only really use the free function field. */ @@ -111,7 +94,7 @@ int OBJ_NAME_new_index(unsigned long (*hash_func) (const char *), goto out; } name_funcs->hash_func = ossl_lh_strcasehash; - name_funcs->cmp_func = obj_strcasecmp; + name_funcs->cmp_func = OPENSSL_strcasecmp; push = sk_NAME_FUNCS_push(name_funcs_stack, name_funcs); if (!push) { @@ -145,7 +128,7 @@ static int obj_name_cmp(const OBJ_NAME *a, const OBJ_NAME *b) ret = sk_NAME_FUNCS_value(name_funcs_stack, a->type)->cmp_func(a->name, b->name); } else - ret = strcasecmp(a->name, b->name); + ret = OPENSSL_strcasecmp(a->name, b->name); } return ret; } diff --git a/deps/openssl/openssl/crypto/ocsp/ocsp_vfy.c b/deps/openssl/openssl/crypto/ocsp/ocsp_vfy.c index 7a4a45d537d..fa07539d7e8 100644 --- a/deps/openssl/openssl/crypto/ocsp/ocsp_vfy.c +++ b/deps/openssl/openssl/crypto/ocsp/ocsp_vfy.c @@ -1,5 +1,5 @@ /* - * Copyright 2001-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2001-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -59,9 +59,10 @@ static int ocsp_verify_signer(X509 *signer, int response, ret = X509_verify_cert(ctx); if (ret <= 0) { - ret = X509_STORE_CTX_get_error(ctx); + int err = X509_STORE_CTX_get_error(ctx); + ERR_raise_data(ERR_LIB_OCSP, OCSP_R_CERTIFICATE_VERIFY_ERROR, - "Verify error: %s", X509_verify_cert_error_string(ret)); + "Verify error: %s", X509_verify_cert_error_string(err)); goto end; } if (chain != NULL) diff --git a/deps/openssl/openssl/crypto/params_dup.c b/deps/openssl/openssl/crypto/params_dup.c index 6a58b52f65c..bc1546fc53c 100644 --- a/deps/openssl/openssl/crypto/params_dup.c +++ b/deps/openssl/openssl/crypto/params_dup.c @@ -1,5 +1,5 @@ /* - * Copyright 2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2021-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -11,7 +11,6 @@ #include <openssl/params.h> #include <openssl/param_build.h> #include "internal/param_build_set.h" -#include "e_os.h" /* strcasecmp */ #define OSSL_PARAM_ALLOCATED_END 127 #define OSSL_PARAM_MERGE_LIST_MAX 128 @@ -142,7 +141,7 @@ static int compare_params(const void *left, const void *right) const OSSL_PARAM *l = *(const OSSL_PARAM **)left; const OSSL_PARAM *r = *(const OSSL_PARAM **)right; - return strcasecmp(l->key, r->key); + return OPENSSL_strcasecmp(l->key, r->key); } OSSL_PARAM *OSSL_PARAM_merge(const OSSL_PARAM *p1, const OSSL_PARAM *p2) @@ -205,7 +204,7 @@ OSSL_PARAM *OSSL_PARAM_merge(const OSSL_PARAM *p1, const OSSL_PARAM *p2) break; } /* consume the list element with the smaller key */ - diff = strcasecmp((*p1cur)->key, (*p2cur)->key); + diff = OPENSSL_strcasecmp((*p1cur)->key, (*p2cur)->key); if (diff == 0) { /* If the keys are the same then throw away the list1 element */ *dst++ = **p2cur; diff --git a/deps/openssl/openssl/crypto/poly1305/asm/poly1305-ia64.S b/deps/openssl/openssl/crypto/poly1305/asm/poly1305-ia64.s index 54d6454f032..54d6454f032 100644 --- a/deps/openssl/openssl/crypto/poly1305/asm/poly1305-ia64.S +++ b/deps/openssl/openssl/crypto/poly1305/asm/poly1305-ia64.s diff --git a/deps/openssl/openssl/crypto/poly1305/build.info b/deps/openssl/openssl/crypto/poly1305/build.info index 7f13fdcf3b8..212ab8c36c7 100644 --- a/deps/openssl/openssl/crypto/poly1305/build.info +++ b/deps/openssl/openssl/crypto/poly1305/build.info @@ -5,7 +5,7 @@ IF[{- !$disabled{asm} -}] $POLY1305ASM_x86=poly1305-x86.s $POLY1305ASM_x86_64=poly1305-x86_64.s - $POLY1305ASM_ia64=asm/poly1305-ia64.S + $POLY1305ASM_ia64=asm/poly1305-ia64.s $POLY1305ASM_sparcv9=poly1305-sparcv9.S diff --git a/deps/openssl/openssl/crypto/property/property_parse.c b/deps/openssl/openssl/crypto/property/property_parse.c index 8954ec72461..8ea53f0d610 100644 --- a/deps/openssl/openssl/crypto/property/property_parse.c +++ b/deps/openssl/openssl/crypto/property/property_parse.c @@ -1,5 +1,5 @@ /* - * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved. * Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use @@ -45,7 +45,7 @@ static int match(const char *t[], const char m[], size_t m_len) { const char *s = *t; - if (strncasecmp(s, m, m_len) == 0) { + if (OPENSSL_strncasecmp(s, m, m_len) == 0) { *t = skip_space(s + m_len); return 1; } diff --git a/deps/openssl/openssl/crypto/rand/rand_lib.c b/deps/openssl/openssl/crypto/rand/rand_lib.c index afe3521186c..c453d322613 100644 --- a/deps/openssl/openssl/crypto/rand/rand_lib.c +++ b/deps/openssl/openssl/crypto/rand/rand_lib.c @@ -768,22 +768,22 @@ static int random_conf_init(CONF_IMODULE *md, const CONF *cnf) for (i = 0; i < sk_CONF_VALUE_num(elist); i++) { cval = sk_CONF_VALUE_value(elist, i); - if (strcasecmp(cval->name, "random") == 0) { + if (OPENSSL_strcasecmp(cval->name, "random") == 0) { if (!random_set_string(&dgbl->rng_name, cval->value)) return 0; - } else if (strcasecmp(cval->name, "cipher") == 0) { + } else if (OPENSSL_strcasecmp(cval->name, "cipher") == 0) { if (!random_set_string(&dgbl->rng_cipher, cval->value)) return 0; - } else if (strcasecmp(cval->name, "digest") == 0) { + } else if (OPENSSL_strcasecmp(cval->name, "digest") == 0) { if (!random_set_string(&dgbl->rng_digest, cval->value)) return 0; - } else if (strcasecmp(cval->name, "properties") == 0) { + } else if (OPENSSL_strcasecmp(cval->name, "properties") == 0) { if (!random_set_string(&dgbl->rng_propq, cval->value)) return 0; - } else if (strcasecmp(cval->name, "seed") == 0) { + } else if (OPENSSL_strcasecmp(cval->name, "seed") == 0) { if (!random_set_string(&dgbl->seed_name, cval->value)) return 0; - } else if (strcasecmp(cval->name, "seed_properties") == 0) { + } else if (OPENSSL_strcasecmp(cval->name, "seed_properties") == 0) { if (!random_set_string(&dgbl->seed_propq, cval->value)) return 0; } else { diff --git a/deps/openssl/openssl/crypto/rsa/rsa_backend.c b/deps/openssl/openssl/crypto/rsa/rsa_backend.c index ad1623dd144..254ebdb2428 100644 --- a/deps/openssl/openssl/crypto/rsa/rsa_backend.c +++ b/deps/openssl/openssl/crypto/rsa/rsa_backend.c @@ -27,8 +27,6 @@ #include "crypto/rsa.h" #include "rsa_local.h" -#include "e_os.h" /* strcasecmp for Windows() */ - /* * The intention with the "backend" source file is to offer backend support * for legacy backends (EVP_PKEY_ASN1_METHOD and EVP_PKEY_METHOD) and provider @@ -275,8 +273,8 @@ int ossl_rsa_pss_params_30_fromdata(RSA_PSS_PARAMS_30 *pss_params, else if (!OSSL_PARAM_get_utf8_ptr(param_mgf, &mgfname)) return 0; - if (strcasecmp(param_mgf->data, - ossl_rsa_mgf_nid2name(default_maskgenalg_nid)) != 0) + if (OPENSSL_strcasecmp(param_mgf->data, + ossl_rsa_mgf_nid2name(default_maskgenalg_nid)) != 0) return 0; } diff --git a/deps/openssl/openssl/crypto/s390x_arch.h b/deps/openssl/openssl/crypto/s390x_arch.h index 78fcd73af07..a7bde67d90f 100644 --- a/deps/openssl/openssl/crypto/s390x_arch.h +++ b/deps/openssl/openssl/crypto/s390x_arch.h @@ -1,5 +1,5 @@ /* - * Copyright 2017-2020 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -72,6 +72,9 @@ struct OPENSSL_s390xcap_st { unsigned long long kdsa[2]; }; +#if defined(__GNUC__) && defined(__linux) +__attribute__ ((visibility("hidden"))) +#endif extern struct OPENSSL_s390xcap_st OPENSSL_s390xcap_P; /* Max number of 64-bit words currently returned by STFLE */ diff --git a/deps/openssl/openssl/crypto/s390xcap.c b/deps/openssl/openssl/crypto/s390xcap.c index f8e0234968e..ea38ff8f085 100644 --- a/deps/openssl/openssl/crypto/s390xcap.c +++ b/deps/openssl/openssl/crypto/s390xcap.c @@ -1,5 +1,5 @@ /* - * Copyright 2010-2018 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2010-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -74,6 +74,9 @@ void OPENSSL_s390x_functions(void); struct OPENSSL_s390xcap_st OPENSSL_s390xcap_P; +#if defined(__GNUC__) && defined(__linux) +__attribute__ ((visibility("hidden"))) +#endif void OPENSSL_cpuid_setup(void) { struct OPENSSL_s390xcap_st cap; diff --git a/deps/openssl/openssl/crypto/siphash/siphash.c b/deps/openssl/openssl/crypto/siphash/siphash.c index 7584255709d..57f61c1db1a 100644 --- a/deps/openssl/openssl/crypto/siphash/siphash.c +++ b/deps/openssl/openssl/crypto/siphash/siphash.c @@ -1,5 +1,5 @@ /* - * Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -204,7 +204,7 @@ int SipHash_Final(SIPHASH *ctx, unsigned char *out, size_t outlen) uint64_t v2 = ctx->v2; uint64_t v3 = ctx->v3; - if (outlen != (size_t)ctx->hash_size) + if (ctx->crounds == 0 || outlen == 0 || outlen != (size_t)ctx->hash_size) return 0; switch (ctx->len) { diff --git a/deps/openssl/openssl/crypto/sparse_array.c b/deps/openssl/openssl/crypto/sparse_array.c index ac823d569ee..53e6e7d4607 100644 --- a/deps/openssl/openssl/crypto/sparse_array.c +++ b/deps/openssl/openssl/crypto/sparse_array.c @@ -1,5 +1,5 @@ /* - * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved. * Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use @@ -19,24 +19,19 @@ * depth of the tree but potentially wastes more memory. That is, this is a * direct space versus time tradeoff. * - * The large memory model uses twelve bits which means that the are 4096 - * pointers in each tree node. This is more than sufficient to hold the - * largest defined NID (as of Feb 2019). This means that using a NID to - * index a sparse array becomes a constant time single array look up. - * - * The small memory model uses four bits which means the tree nodes contain - * sixteen pointers. This reduces the amount of unused space significantly - * at a cost in time. + * The default is to use four bits which means that the are 16 + * pointers in each tree node. * * The library builder is also permitted to define other sizes in the closed - * interval [2, sizeof(ossl_uintmax_t) * 8]. + * interval [2, sizeof(ossl_uintmax_t) * 8]. Space use generally scales + * exponentially with the block size, although the implementation only + * creates enough blocks to support the largest used index. The depth is: + * ceil(log_2(largest index) / 2^{block size}) + * E.g. with a block size of 4, and a largest index of 1000, the depth + * will be three. */ #ifndef OPENSSL_SA_BLOCK_BITS -# ifdef OPENSSL_SMALL_FOOTPRINT -# define OPENSSL_SA_BLOCK_BITS 4 -# else -# define OPENSSL_SA_BLOCK_BITS 12 -# endif +# define OPENSSL_SA_BLOCK_BITS 4 #elif OPENSSL_SA_BLOCK_BITS < 2 || OPENSSL_SA_BLOCK_BITS > (BN_BITS2 - 1) # error OPENSSL_SA_BLOCK_BITS is out of range #endif diff --git a/deps/openssl/openssl/crypto/store/store_lib.c b/deps/openssl/openssl/crypto/store/store_lib.c index 7dcb939066f..5ff92786291 100644 --- a/deps/openssl/openssl/crypto/store/store_lib.c +++ b/deps/openssl/openssl/crypto/store/store_lib.c @@ -1,5 +1,5 @@ /* - * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -93,7 +93,7 @@ OSSL_STORE_open_ex(const char *uri, OSSL_LIB_CTX *libctx, const char *propq, OPENSSL_strlcpy(scheme_copy, uri, sizeof(scheme_copy)); if ((p = strchr(scheme_copy, ':')) != NULL) { *p++ = '\0'; - if (strcasecmp(scheme_copy, "file") != 0) { + if (OPENSSL_strcasecmp(scheme_copy, "file") != 0) { if (strncmp(p, "//", 2) == 0) schemes_n--; /* Invalidate the file scheme */ schemes[schemes_n++] = scheme_copy; diff --git a/deps/openssl/openssl/crypto/store/store_result.c b/deps/openssl/openssl/crypto/store/store_result.c index 1306b270bba..6f83da4beb0 100644 --- a/deps/openssl/openssl/crypto/store/store_result.c +++ b/deps/openssl/openssl/crypto/store/store_result.c @@ -457,7 +457,7 @@ static int try_cert(struct extracted_param_data_st *data, OSSL_STORE_INFO **v, /* If we have a data type, it should be a PEM name */ if (data->data_type != NULL - && (strcasecmp(data->data_type, PEM_STRING_X509_TRUSTED) == 0)) + && (OPENSSL_strcasecmp(data->data_type, PEM_STRING_X509_TRUSTED) == 0)) ignore_trusted = 0; if (d2i_X509_AUX(&cert, (const unsigned char **)&data->octet_data, diff --git a/deps/openssl/openssl/crypto/threads_pthread.c b/deps/openssl/openssl/crypto/threads_pthread.c index 64247d29ade..bfc05a4e878 100644 --- a/deps/openssl/openssl/crypto/threads_pthread.c +++ b/deps/openssl/openssl/crypto/threads_pthread.c @@ -17,6 +17,18 @@ # include <atomic.h> #endif +#if defined(__apple_build_version__) && __apple_build_version__ < 6000000 +/* + * OS/X 10.7 and 10.8 had a weird version of clang which has __ATOMIC_ACQUIRE and + * __ATOMIC_ACQ_REL but which expects only one parameter for __atomic_is_lock_free() + * rather than two which has signature __atomic_is_lock_free(sizeof(_Atomic(T))). + * All of this makes impossible to use __atomic_is_lock_free here. + * + * See: https://github.com/llvm/llvm-project/commit/a4c2602b714e6c6edb98164550a5ae829b2de760 + */ +#define BROKEN_CLANG_ATOMICS +#endif + #if defined(OPENSSL_THREADS) && !defined(CRYPTO_TDEBUG) && !defined(OPENSSL_SYS_WINDOWS) # if defined(OPENSSL_SYS_UNIX) @@ -188,7 +200,7 @@ int CRYPTO_THREAD_compare_id(CRYPTO_THREAD_ID a, CRYPTO_THREAD_ID b) int CRYPTO_atomic_add(int *val, int amount, int *ret, CRYPTO_RWLOCK *lock) { -# if defined(__GNUC__) && defined(__ATOMIC_ACQ_REL) +# if defined(__GNUC__) && defined(__ATOMIC_ACQ_REL) && !defined(BROKEN_CLANG_ATOMICS) if (__atomic_is_lock_free(sizeof(*val), val)) { *ret = __atomic_add_fetch(val, amount, __ATOMIC_ACQ_REL); return 1; @@ -215,7 +227,7 @@ int CRYPTO_atomic_add(int *val, int amount, int *ret, CRYPTO_RWLOCK *lock) int CRYPTO_atomic_or(uint64_t *val, uint64_t op, uint64_t *ret, CRYPTO_RWLOCK *lock) { -# if defined(__GNUC__) && defined(__ATOMIC_ACQ_REL) +# if defined(__GNUC__) && defined(__ATOMIC_ACQ_REL) && !defined(BROKEN_CLANG_ATOMICS) if (__atomic_is_lock_free(sizeof(*val), val)) { *ret = __atomic_or_fetch(val, op, __ATOMIC_ACQ_REL); return 1; @@ -240,7 +252,7 @@ int CRYPTO_atomic_or(uint64_t *val, uint64_t op, uint64_t *ret, int CRYPTO_atomic_load(uint64_t *val, uint64_t *ret, CRYPTO_RWLOCK *lock) { -# if defined(__GNUC__) && defined(__ATOMIC_ACQUIRE) +# if defined(__GNUC__) && defined(__ATOMIC_ACQUIRE) && !defined(BROKEN_CLANG_ATOMICS) if (__atomic_is_lock_free(sizeof(*val), val)) { __atomic_load(val, ret, __ATOMIC_ACQUIRE); return 1; diff --git a/deps/openssl/openssl/crypto/trace.c b/deps/openssl/openssl/crypto/trace.c index 40941990e67..d790409a2d6 100644 --- a/deps/openssl/openssl/crypto/trace.c +++ b/deps/openssl/openssl/crypto/trace.c @@ -19,8 +19,6 @@ #include "internal/refcount.h" #include "crypto/cryptlib.h" -#include "e_os.h" /* strcasecmp for Windows */ - #ifndef OPENSSL_NO_TRACE static CRYPTO_RWLOCK *trace_lock = NULL; @@ -158,7 +156,7 @@ int OSSL_trace_get_category_num(const char *name) size_t i; for (i = 0; i < OSSL_NELEM(trace_categories); i++) - if (strcasecmp(name, trace_categories[i].name) == 0) + if (OPENSSL_strcasecmp(name, trace_categories[i].name) == 0) return trace_categories[i].num; return -1; /* not found */ } diff --git a/deps/openssl/openssl/crypto/x509/v3_tlsf.c b/deps/openssl/openssl/crypto/x509/v3_tlsf.c index 6a613d64e6a..3a457fa57be 100644 --- a/deps/openssl/openssl/crypto/x509/v3_tlsf.c +++ b/deps/openssl/openssl/crypto/x509/v3_tlsf.c @@ -1,5 +1,5 @@ /* - * Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2015-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -108,7 +108,7 @@ static TLS_FEATURE *v2i_TLS_FEATURE(const X509V3_EXT_METHOD *method, extval = val->name; for (j = 0; j < OSSL_NELEM(tls_feature_tbl); j++) - if (strcasecmp(extval, tls_feature_tbl[j].name) == 0) + if (OPENSSL_strcasecmp(extval, tls_feature_tbl[j].name) == 0) break; if (j < OSSL_NELEM(tls_feature_tbl)) tlsextid = tls_feature_tbl[j].num; diff --git a/deps/openssl/openssl/crypto/x509/v3_utl.c b/deps/openssl/openssl/crypto/x509/v3_utl.c index 734e083a7a7..6e4ef26ed60 100644 --- a/deps/openssl/openssl/crypto/x509/v3_utl.c +++ b/deps/openssl/openssl/crypto/x509/v3_utl.c @@ -349,7 +349,9 @@ STACK_OF(CONF_VALUE) *X509V3_parse_list(const char *line) ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_EMPTY_NAME); goto err; } - X509V3_add_value(ntmp, NULL, &values); + if (!X509V3_add_value(ntmp, NULL, &values)) { + goto err; + } } break; @@ -362,7 +364,9 @@ STACK_OF(CONF_VALUE) *X509V3_parse_list(const char *line) ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_NULL_VALUE); goto err; } - X509V3_add_value(ntmp, vtmp, &values); + if (!X509V3_add_value(ntmp, vtmp, &values)) { + goto err; + } ntmp = NULL; q = p + 1; } @@ -376,14 +380,18 @@ STACK_OF(CONF_VALUE) *X509V3_parse_list(const char *line) ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_NULL_VALUE); goto err; } - X509V3_add_value(ntmp, vtmp, &values); + if (!X509V3_add_value(ntmp, vtmp, &values)) { + goto err; + } } else { ntmp = strip_spaces(q); if (!ntmp) { ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_EMPTY_NAME); goto err; } - X509V3_add_value(ntmp, NULL, &values); + if (!X509V3_add_value(ntmp, NULL, &values)) { + goto err; + } } OPENSSL_free(linebuf); return values; @@ -707,7 +715,7 @@ static int wildcard_match(const unsigned char *prefix, size_t prefix_len, } /* IDNA labels cannot match partial wildcards */ if (!allow_idna && - subject_len >= 4 && strncasecmp((char *)subject, "xn--", 4) == 0) + subject_len >= 4 && OPENSSL_strncasecmp((char *)subject, "xn--", 4) == 0) return 0; /* The wildcard may match a literal '*' */ if (wildcard_end == wildcard_start + 1 && *wildcard_start == '*') @@ -767,7 +775,7 @@ static const unsigned char *valid_star(const unsigned char *p, size_t len, || ('A' <= p[i] && p[i] <= 'Z') || ('0' <= p[i] && p[i] <= '9')) { if ((state & LABEL_START) != 0 - && len - i >= 4 && strncasecmp((char *)&p[i], "xn--", 4) == 0) + && len - i >= 4 && OPENSSL_strncasecmp((char *)&p[i], "xn--", 4) == 0) state |= LABEL_IDNA; state &= ~(LABEL_HYPHEN | LABEL_START); } else if (p[i] == '.') { diff --git a/deps/openssl/openssl/dev/release.sh b/deps/openssl/openssl/dev/release.sh index 94d9db0eeb8..e4f311fa5ae 100755 --- a/deps/openssl/openssl/dev/release.sh +++ b/deps/openssl/openssl/dev/release.sh @@ -337,7 +337,7 @@ make update-fips-checksums >&42 if [ -n "$(git status --porcelain)" ]; then $VERBOSE "== Committing updates" git add -u - git commit $git_quiet -m 'make update' + git commit $git_quiet -m $'make update\n\nRelease: yes' if [ -n "$reviewers" ]; then addrev --nopr $reviewers fi @@ -375,7 +375,7 @@ done $VERBOSE "== Comitting updates and tagging" git add -u -git commit $git_quiet -m "Prepare for release of $release_text" +git commit $git_quiet -m "Prepare for release of $release_text"$'\n\nRelease: yes' if [ -n "$reviewers" ]; then addrev --nopr $reviewers fi @@ -477,7 +477,7 @@ done $VERBOSE "== Committing updates" git add -u -git commit $git_quiet -m "Prepare for $release_text" +git commit $git_quiet -m "Prepare for $release_text"$'\n\nRelease: yes' if [ -n "$reviewers" ]; then addrev --nopr $reviewers fi @@ -508,7 +508,7 @@ if $do_branch; then $VERBOSE "== Committing updates" git add -u - git commit $git_quiet -m "Prepare for $release_text" + git commit $git_quiet -m "Prepare for $release_text"$'\n\nRelease: yes' if [ -n "$reviewers" ]; then addrev --nopr $reviewers fi diff --git a/deps/openssl/openssl/doc/build.info b/deps/openssl/openssl/doc/build.info index f8bca9d09f4..cf28a7a6a88 100644 --- a/deps/openssl/openssl/doc/build.info +++ b/deps/openssl/openssl/doc/build.info @@ -1531,6 +1531,10 @@ DEPEND[html/man3/OPENSSL_secure_malloc.html]=man3/OPENSSL_secure_malloc.pod GENERATE[html/man3/OPENSSL_secure_malloc.html]=man3/OPENSSL_secure_malloc.pod DEPEND[man/man3/OPENSSL_secure_malloc.3]=man3/OPENSSL_secure_malloc.pod GENERATE[man/man3/OPENSSL_secure_malloc.3]=man3/OPENSSL_secure_malloc.pod +DEPEND[html/man3/OPENSSL_strcasecmp.html]=man3/OPENSSL_strcasecmp.pod +GENERATE[html/man3/OPENSSL_strcasecmp.html]=man3/OPENSSL_strcasecmp.pod +DEPEND[man/man3/OPENSSL_strcasecmp.3]=man3/OPENSSL_strcasecmp.pod +GENERATE[man/man3/OPENSSL_strcasecmp.3]=man3/OPENSSL_strcasecmp.pod DEPEND[html/man3/OSSL_CMP_CTX_new.html]=man3/OSSL_CMP_CTX_new.pod GENERATE[html/man3/OSSL_CMP_CTX_new.html]=man3/OSSL_CMP_CTX_new.pod DEPEND[man/man3/OSSL_CMP_CTX_new.3]=man3/OSSL_CMP_CTX_new.pod @@ -3114,6 +3118,7 @@ html/man3/OPENSSL_load_builtin_modules.html \ html/man3/OPENSSL_malloc.html \ html/man3/OPENSSL_s390xcap.html \ html/man3/OPENSSL_secure_malloc.html \ +html/man3/OPENSSL_strcasecmp.html \ html/man3/OSSL_CMP_CTX_new.html \ html/man3/OSSL_CMP_HDR_get0_transactionID.html \ html/man3/OSSL_CMP_ITAV_set0.html \ @@ -3709,6 +3714,7 @@ man/man3/OPENSSL_load_builtin_modules.3 \ man/man3/OPENSSL_malloc.3 \ man/man3/OPENSSL_s390xcap.3 \ man/man3/OPENSSL_secure_malloc.3 \ +man/man3/OPENSSL_strcasecmp.3 \ man/man3/OSSL_CMP_CTX_new.3 \ man/man3/OSSL_CMP_HDR_get0_transactionID.3 \ man/man3/OSSL_CMP_ITAV_set0.3 \ diff --git a/deps/openssl/openssl/doc/fingerprints.txt b/deps/openssl/openssl/doc/fingerprints.txt index 4a8fc8e8d80..4f95f2beaec 100644 --- a/deps/openssl/openssl/doc/fingerprints.txt +++ b/deps/openssl/openssl/doc/fingerprints.txt @@ -19,4 +19,7 @@ Matt Caswell: 8657 ABB2 60F0 56B1 E519 0839 D9C4 D26D 0E60 4491 Paul Dale: -1B72 6772 1033 CC88 A531 5EF5 5359 C4D8 443B 383B +B7C1 C143 60F3 53A3 6862 E4D5 231C 84CD DCC6 9C45 + +Tomáš Mráz: +A21F AB74 B008 8AA3 6115 2586 B8EF 1A6B A9DA 2D5C diff --git a/deps/openssl/openssl/doc/man3/BIO_meth_new.pod b/deps/openssl/openssl/doc/man3/BIO_meth_new.pod index 15c369e7a98..86301b97189 100644 --- a/deps/openssl/openssl/doc/man3/BIO_meth_new.pod +++ b/deps/openssl/openssl/doc/man3/BIO_meth_new.pod @@ -118,7 +118,10 @@ for creating a new instance of the BIO respectively. This function will be called in response to the application calling BIO_new() and passing in a pointer to the current BIO_METHOD. The BIO_new() function will allocate the memory for the new BIO, and a pointer to this newly allocated structure will -be passed as a parameter to the function. +be passed as a parameter to the function. If a create function is set, +BIO_new() will not mark the BIO as initialised on allocation. +L<BIO_set_init(3)> must then be called either by the create function, or later, +by a BIO ctrl function, once BIO initialisation is complete. BIO_meth_get_destroy() and BIO_meth_set_destroy() get and set the function used for destroying an instance of a BIO respectively. This function will be @@ -154,7 +157,7 @@ The functions described here were added in OpenSSL 1.1.0. =head1 COPYRIGHT -Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/deps/openssl/openssl/doc/man3/EVP_blake2b512.pod b/deps/openssl/openssl/doc/man3/EVP_blake2b512.pod index ead4c8c7255..649a29c9871 100644 --- a/deps/openssl/openssl/doc/man3/EVP_blake2b512.pod +++ b/deps/openssl/openssl/doc/man3/EVP_blake2b512.pod @@ -34,7 +34,7 @@ The BLAKE2b algorithm that produces a 512-bit output from a given input. =head1 RETURN VALUES These functions return a B<EVP_MD> structure that contains the -implementation of the symmetric cipher. See L<EVP_MD_meth_new(3)> for +implementation of the message digest. See L<EVP_MD_meth_new(3)> for details of the B<EVP_MD> structure. =head1 CONFORMING TO @@ -54,7 +54,7 @@ L<EVP_DigestInit(3)> =head1 COPYRIGHT -Copyright 2017 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/deps/openssl/openssl/doc/man3/EVP_md2.pod b/deps/openssl/openssl/doc/man3/EVP_md2.pod index 9594f62e15a..420bb154531 100644 --- a/deps/openssl/openssl/doc/man3/EVP_md2.pod +++ b/deps/openssl/openssl/doc/man3/EVP_md2.pod @@ -28,7 +28,7 @@ The MD2 algorithm which produces a 128-bit output from a given input. =head1 RETURN VALUES These functions return a B<EVP_MD> structure that contains the -implementation of the symmetric cipher. See L<EVP_MD_meth_new(3)> for +implementation of the message digest. See L<EVP_MD_meth_new(3)> for details of the B<EVP_MD> structure. =head1 CONFORMING TO @@ -43,7 +43,7 @@ L<EVP_DigestInit(3)> =head1 COPYRIGHT -Copyright 2017-2020 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/deps/openssl/openssl/doc/man3/EVP_md4.pod b/deps/openssl/openssl/doc/man3/EVP_md4.pod index efc41fe8be1..a3d3beaaf83 100644 --- a/deps/openssl/openssl/doc/man3/EVP_md4.pod +++ b/deps/openssl/openssl/doc/man3/EVP_md4.pod @@ -29,7 +29,7 @@ The MD4 algorithm which produces a 128-bit output from a given input. =head1 RETURN VALUES These functions return a B<EVP_MD> structure that contains the -implementation of the symmetric cipher. See L<EVP_MD_meth_new(3)> for +implementation of the message digest. See L<EVP_MD_meth_new(3)> for details of the B<EVP_MD> structure. =head1 CONFORMING TO @@ -44,7 +44,7 @@ L<EVP_DigestInit(3)> =head1 COPYRIGHT -Copyright 2017-2020 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/deps/openssl/openssl/doc/man3/EVP_md5.pod b/deps/openssl/openssl/doc/man3/EVP_md5.pod index a0b127fe60b..9d729601a06 100644 --- a/deps/openssl/openssl/doc/man3/EVP_md5.pod +++ b/deps/openssl/openssl/doc/man3/EVP_md5.pod @@ -40,7 +40,7 @@ WARNING: this algorithm is not intended for non-SSL usage. =head1 RETURN VALUES These functions return a B<EVP_MD> structure that contains the -implementation of the symmetric cipher. See L<EVP_MD_meth_new(3)> for +implementation of the message digest. See L<EVP_MD_meth_new(3)> for details of the B<EVP_MD> structure. =head1 CONFORMING TO @@ -54,7 +54,7 @@ L<EVP_DigestInit(3)> =head1 COPYRIGHT -Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/deps/openssl/openssl/doc/man3/EVP_mdc2.pod b/deps/openssl/openssl/doc/man3/EVP_mdc2.pod index 38fb0e29409..7ebed04c700 100644 --- a/deps/openssl/openssl/doc/man3/EVP_mdc2.pod +++ b/deps/openssl/openssl/doc/man3/EVP_mdc2.pod @@ -29,7 +29,7 @@ The MDC-2DES algorithm of using MDC-2 with the DES block cipher. It produces a =head1 RETURN VALUES These functions return a B<EVP_MD> structure that contains the -implementation of the symmetric cipher. See L<EVP_MD_meth_new(3)> for +implementation of the message digest. See L<EVP_MD_meth_new(3)> for details of the B<EVP_MD> structure. =head1 CONFORMING TO @@ -44,7 +44,7 @@ L<EVP_DigestInit(3)> =head1 COPYRIGHT -Copyright 2017-2020 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/deps/openssl/openssl/doc/man3/EVP_ripemd160.pod b/deps/openssl/openssl/doc/man3/EVP_ripemd160.pod index 034ab811384..e559b034494 100644 --- a/deps/openssl/openssl/doc/man3/EVP_ripemd160.pod +++ b/deps/openssl/openssl/doc/man3/EVP_ripemd160.pod @@ -28,7 +28,7 @@ The RIPEMD-160 algorithm which produces a 160-bit output from a given input. =head1 RETURN VALUES These functions return a B<EVP_MD> structure that contains the -implementation of the symmetric cipher. See L<EVP_MD_meth_new(3)> for +implementation of the message digest. See L<EVP_MD_meth_new(3)> for details of the B<EVP_MD> structure. =head1 CONFORMING TO @@ -43,7 +43,7 @@ L<EVP_DigestInit(3)> =head1 COPYRIGHT -Copyright 2017-2020 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/deps/openssl/openssl/doc/man3/EVP_sha1.pod b/deps/openssl/openssl/doc/man3/EVP_sha1.pod index 6568ac81a4b..f3e9e8d4fa1 100644 --- a/deps/openssl/openssl/doc/man3/EVP_sha1.pod +++ b/deps/openssl/openssl/doc/man3/EVP_sha1.pod @@ -29,7 +29,7 @@ The SHA-1 algorithm which produces a 160-bit output from a given input. =head1 RETURN VALUES These functions return a B<EVP_MD> structure that contains the -implementation of the symmetric cipher. See L<EVP_MD_meth_new(3)> for +implementation of the message digest. See L<EVP_MD_meth_new(3)> for details of the B<EVP_MD> structure. =head1 CONFORMING TO @@ -43,7 +43,7 @@ L<EVP_DigestInit(3)> =head1 COPYRIGHT -Copyright 2017 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/deps/openssl/openssl/doc/man3/EVP_sha224.pod b/deps/openssl/openssl/doc/man3/EVP_sha224.pod index afcfc98034b..97881b54635 100644 --- a/deps/openssl/openssl/doc/man3/EVP_sha224.pod +++ b/deps/openssl/openssl/doc/man3/EVP_sha224.pod @@ -49,7 +49,7 @@ their outputs are of the same size. =head1 RETURN VALUES These functions return a B<EVP_MD> structure that contains the -implementation of the symmetric cipher. See L<EVP_MD_meth_new(3)> for +implementation of the message digest. See L<EVP_MD_meth_new(3)> for details of the B<EVP_MD> structure. =head1 CONFORMING TO @@ -63,7 +63,7 @@ L<EVP_DigestInit(3)> =head1 COPYRIGHT -Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/deps/openssl/openssl/doc/man3/EVP_sha3_224.pod b/deps/openssl/openssl/doc/man3/EVP_sha3_224.pod index ac19dc28530..4c349f55d32 100644 --- a/deps/openssl/openssl/doc/man3/EVP_sha3_224.pod +++ b/deps/openssl/openssl/doc/man3/EVP_sha3_224.pod @@ -54,7 +54,7 @@ B<EVP_shake256> provides that of 256 bits. =head1 RETURN VALUES These functions return a B<EVP_MD> structure that contains the -implementation of the symmetric cipher. See L<EVP_MD_meth_new(3)> for +implementation of the message digest. See L<EVP_MD_meth_new(3)> for details of the B<EVP_MD> structure. =head1 CONFORMING TO @@ -68,7 +68,7 @@ L<EVP_DigestInit(3)> =head1 COPYRIGHT -Copyright 2017 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/deps/openssl/openssl/doc/man3/EVP_sm3.pod b/deps/openssl/openssl/doc/man3/EVP_sm3.pod index a72b758bc17..96997b1128a 100644 --- a/deps/openssl/openssl/doc/man3/EVP_sm3.pod +++ b/deps/openssl/openssl/doc/man3/EVP_sm3.pod @@ -28,7 +28,7 @@ The SM3 hash function. =head1 RETURN VALUES These functions return a B<EVP_MD> structure that contains the -implementation of the symmetric cipher. See L<EVP_MD_meth_new(3)> for +implementation of the message digest. See L<EVP_MD_meth_new(3)> for details of the B<EVP_MD> structure. =head1 CONFORMING TO @@ -42,7 +42,7 @@ L<EVP_DigestInit(3)> =head1 COPYRIGHT -Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved. Copyright 2017 Ribose Inc. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use diff --git a/deps/openssl/openssl/doc/man3/EVP_whirlpool.pod b/deps/openssl/openssl/doc/man3/EVP_whirlpool.pod index 84f2411d604..3aaf1d50add 100644 --- a/deps/openssl/openssl/doc/man3/EVP_whirlpool.pod +++ b/deps/openssl/openssl/doc/man3/EVP_whirlpool.pod @@ -30,7 +30,7 @@ input. =head1 RETURN VALUES These functions return a B<EVP_MD> structure that contains the -implementation of the symmetric cipher. See L<EVP_MD_meth_new(3)> for +implementation of the message digest. See L<EVP_MD_meth_new(3)> for details of the B<EVP_MD> structure. =head1 CONFORMING TO @@ -45,7 +45,7 @@ L<EVP_DigestInit(3)> =head1 COPYRIGHT -Copyright 2017-2020 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/deps/openssl/openssl/doc/man3/OPENSSL_LH_stats.pod b/deps/openssl/openssl/doc/man3/OPENSSL_LH_stats.pod index a3f85700b46..b86de52cb58 100644 --- a/deps/openssl/openssl/doc/man3/OPENSSL_LH_stats.pod +++ b/deps/openssl/openssl/doc/man3/OPENSSL_LH_stats.pod @@ -23,9 +23,10 @@ OPENSSL_LH_node_stats_bio, OPENSSL_LH_node_usage_stats_bio - LHASH statistics The B<LHASH> structure records statistics about most aspects of accessing the hash table. -OPENSSL_LH_stats() prints out statistics on the size of the hash table, how -many entries are in it, and the number and result of calls to the -routines in this library. +OPENSSL_LH_stats() prints out statistics on the size of the hash table and how +many entries are in it. For historical reasons, this function also outputs a +number of additional statistics, but the tracking of these statistics is no +longer supported and these statistics are always reported as zero. OPENSSL_LH_node_stats() prints the number of entries for each 'bucket' in the hash table. @@ -58,7 +59,7 @@ L<bio(7)>, L<OPENSSL_LH_COMPFUNC(3)> =head1 COPYRIGHT -Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2000-2022 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/deps/openssl/openssl/doc/man3/OPENSSL_strcasecmp.pod b/deps/openssl/openssl/doc/man3/OPENSSL_strcasecmp.pod new file mode 100644 index 00000000000..1bb8b18c501 --- /dev/null +++ b/deps/openssl/openssl/doc/man3/OPENSSL_strcasecmp.pod @@ -0,0 +1,47 @@ +=pod + +=head1 NAME + +OPENSSL_strcasecmp, OPENSSL_strncasecmp - compare two strings ignoring case + +=head1 SYNOPSIS + + #include <openssl/crypto.h> + + int OPENSSL_strcasecmp(const char *s1, const char *s2); + int OPENSSL_strncasecmp(const char *s1, const char *s2, size_t n); + +=head1 DESCRIPTION + +The OPENSSL_strcasecmp function performs a byte-by-byte comparison of the strings +B<s1> and B<s2>, ignoring the case of the characters. + +The OPENSSL_strncasecmp function is similar, except that it compares no more than +B<n> bytes of B<s1> and B<s2>. + +In POSIX-compatible system and on Windows these functions use "C" locale for +case insensitive. Otherwise the comparison is done in current locale. + +=head1 RETURN VALUES + +Both functions return an integer less than, equal to, or greater than zero if +s1 is found, respectively, to be less than, to match, or be greater than s2. + +=head1 NOTES + +OpenSSL extensively uses case insensitive comparison of ASCII strings. Though +OpenSSL itself is locale-agnostic, the applications using OpenSSL libraries may +unpredictably suffer when they use localization (e.g. Turkish locale is +well-known with a specific I/i cases). These functions use C locale for string +comparison. + +=head1 COPYRIGHT + +Copyright 2022 The OpenSSL Project Authors. All Rights Reserved. + +Licensed under the Apache License 2.0 (the "License"). You may not use +this file except in compliance with the License. You can obtain a copy +in the file LICENSE in the source distribution or at +L<https://www.openssl.org/source/license.html>. + +=cut diff --git a/deps/openssl/openssl/doc/man3/OSSL_CMP_CTX_new.pod b/deps/openssl/openssl/doc/man3/OSSL_CMP_CTX_new.pod index 33c73170a07..8ac5b815be7 100644 --- a/deps/openssl/openssl/doc/man3/OSSL_CMP_CTX_new.pod +++ b/deps/openssl/openssl/doc/man3/OSSL_CMP_CTX_new.pod @@ -244,7 +244,7 @@ The following options can be set: ("indirect method") Note that a signature-based POPO can only be produced if a private key - is provided as the newPkey or client pkey component of the CMP context. + is provided as the newPkey or client's pkey component of the CMP context. =item B<OSSL_CMP_OPT_DIGEST_ALGNID> @@ -441,7 +441,7 @@ The reference counts of those certificates handled successfully are increased. OSSL_CMP_CTX_get0_untrusted(OSSL_CMP_CTX *ctx) returns a pointer to the list of untrusted certs, which may be empty if unset. -OSSL_CMP_CTX_set1_cert() sets the certificate related to the private key +OSSL_CMP_CTX_set1_cert() sets the certificate related to the client's private key used for CMP message protection. Therefore the public key of this I<cert> must correspond to the private key set before or thereafter via OSSL_CMP_CTX_set1_pkey(). @@ -468,7 +468,7 @@ Calling this function is optional; by default a chain construction is performed on demand that is equivalent to calling this function with the I<candidates> and I<own_trusted> arguments being NULL. -OSSL_CMP_CTX_set1_pkey() sets the private key corresponding to the +OSSL_CMP_CTX_set1_pkey() sets the client's private key corresponding to the CMP signer certificate set via OSSL_CMP_CTX_set1_cert(). This key is used create signature-based protection (protectionAlg = MSG_SIG_ALG) of outgoing messages @@ -519,7 +519,7 @@ The I<priv> parameter must be 0 if and only if the given key is a public key. OSSL_CMP_CTX_get0_newPkey() gives the key to use for certificate enrollment dependent on fields of the CMP context structure: the newPkey (which may be a private or public key) if present, -else the public key in the p10CSR if present, else the client private key. +else the public key in the p10CSR if present, else the client's private key. If the I<priv> parameter is not 0 and the selected key does not have a private component then NULL is returned. diff --git a/deps/openssl/openssl/doc/man3/OSSL_CMP_MSG_get0_header.pod b/deps/openssl/openssl/doc/man3/OSSL_CMP_MSG_get0_header.pod index cc211a3945f..76e24e1bad0 100644 --- a/deps/openssl/openssl/doc/man3/OSSL_CMP_MSG_get0_header.pod +++ b/deps/openssl/openssl/doc/man3/OSSL_CMP_MSG_get0_header.pod @@ -40,19 +40,35 @@ from various information provided in the CMP context argument I<ctx> for inclusion in a CMP request message based on details contained in I<ctx>. The I<rid> argument defines the request identifier to use, which typically is 0. -The subject DN to include in the certificate template is determined as follows. -If I<ctx> includes a subject name set via L<OSSL_CMP_CTX_set1_subjectName(3)>, -this name is used. -Otherwise, if a PKCS#10 CSR is given in I<ctx>, its subject is used. -Otherwise, if a reference certificate is given in I<ctx> -(see L<OSSL_CMP_CTX_set1_oldCert(3)>), its subject is used if I<for_KUR> -is nonzero or the I<ctx> does not include a Subject Alternative Name. - -The public key to include is taken from any value set via -L<OSSL_CMP_CTX_set0_newPkey(3)>, -otherwise the public key of any PKCS#10 CSR is given in I<ctx>, -otherwise the public key of any reference certificate given in I<ctx>, -otherwise it is derived from the client private key if given in I<ctx>. +The subject DN included in the certificate template is +the first available value of these: + +=over 4 + +=item any subject name in I<ctx> set via L<OSSL_CMP_CTX_set1_subjectName(3)>, + +=item the subject field of any PKCS#10 CSR is given in I<ctx>, or + +=item the subject field of any reference certificate given in I<ctx> +(see L<OSSL_CMP_CTX_set1_oldCert(3)>), if I<for_KUR> is nonzero +or the I<ctx> does not include a Subject Alternative Name. + +=back + +The public key included is the first available value of these: + +=over 4 + +=item the public key derived from any key set via L<OSSL_CMP_CTX_set0_newPkey(3)>, + +=item the public key of any PKCS#10 CSR is given in I<ctx>, + +=item the public key of any reference certificate given in I<ctx>, or + +=item the public key derived from any client's private key +set via L<OSSL_CMP_CTX_set1_pkey(3)>. + +=back The set of X.509 extensions to include is computed as follows. If a PKCS#10 CSR is present in I<ctx>, default extensions are taken from there, diff --git a/deps/openssl/openssl/doc/man3/PEM_read_bio_PrivateKey.pod b/deps/openssl/openssl/doc/man3/PEM_read_bio_PrivateKey.pod index d4878f67df4..ac93920adde 100644 --- a/deps/openssl/openssl/doc/man3/PEM_read_bio_PrivateKey.pod +++ b/deps/openssl/openssl/doc/man3/PEM_read_bio_PrivateKey.pod @@ -193,8 +193,8 @@ see L<openssl_user_macros(7)>: =head1 DESCRIPTION All of the functions described on this page that have a I<TYPE> of B<DH>, B<DSA> -and B<RSA> are deprecated. Applications should use OSSL_ENCODER_to_bio() and -OSSL_DECODER_from_bio() instead. +and B<RSA> are deprecated. Applications should use L<OSSL_ENCODER_to_bio(3)> and +L<OSSL_DECODER_from_bio(3)> instead. The PEM functions read or write structures in PEM format. In this sense PEM format is simply base64 encoded data surrounded diff --git a/deps/openssl/openssl/doc/man3/SSL_CONF_cmd.pod b/deps/openssl/openssl/doc/man3/SSL_CONF_cmd.pod index 9c703e0de1d..ae6ca432829 100644 --- a/deps/openssl/openssl/doc/man3/SSL_CONF_cmd.pod +++ b/deps/openssl/openssl/doc/man3/SSL_CONF_cmd.pod @@ -64,7 +64,7 @@ Allows servers to accept client-initiated renegotiation. Equivalent to setting B<SSL_OP_ALLOW_CLIENT_RENEGOTIATION>. Only used by servers. -=item B<-legacyrenegotiation> +=item B<-legacy_renegotiation> Permits the use of unsafe legacy renegotiation. Equivalent to setting B<SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION>. diff --git a/deps/openssl/openssl/doc/man3/SSL_CTX_get0_param.pod b/deps/openssl/openssl/doc/man3/SSL_CTX_get0_param.pod index 69855173662..d066e747c02 100644 --- a/deps/openssl/openssl/doc/man3/SSL_CTX_get0_param.pod +++ b/deps/openssl/openssl/doc/man3/SSL_CTX_get0_param.pod @@ -2,7 +2,8 @@ =head1 NAME -SSL_CTX_get0_param, SSL_get0_param, SSL_CTX_set1_param, SSL_set1_param - +SSL_CTX_get0_param, SSL_get0_param, SSL_CTX_set1_param, SSL_set1_param, +SSL_CTX_set_purpose, SSL_CTX_set_trust, SSL_set_purpose, SSL_set_trust - get and set verification parameters =head1 SYNOPSIS @@ -14,6 +15,12 @@ get and set verification parameters int SSL_CTX_set1_param(SSL_CTX *ctx, X509_VERIFY_PARAM *vpm); int SSL_set1_param(SSL *ssl, X509_VERIFY_PARAM *vpm); + int SSL_CTX_set_purpose(SSL_CTX *ctx, int purpose); + int SSL_set_purpose(SSL *ssl, int purpose); + + int SSL_CTX_set_trust(SSL_CTX *ctx, int trust); + int SSL_set_trust(SSL *ssl, int trust); + =head1 DESCRIPTION SSL_CTX_get0_param() and SSL_get0_param() retrieve an internal pointer to @@ -23,6 +30,14 @@ pointer must not be freed by the calling application. SSL_CTX_set1_param() and SSL_set1_param() set the verification parameters to B<vpm> for B<ctx> or B<ssl>. +The functions SSL_CTX_set_purpose() and SSL_set_purpose() are shorthands which +set the purpose parameter on the verification parameters object. These functions +are equivalent to calling X509_VERIFY_PARAM_set_purpose() directly. + +The functions SSL_CTX_set_trust() and SSL_set_trust() are similarly shorthands +which set the trust parameter on the verification parameters object. These +functions are equivalent to calling X509_VERIFY_PARAM_set_trust() directly. + =head1 NOTES Typically parameters are retrieved from an B<SSL_CTX> or B<SSL> structure @@ -34,8 +49,9 @@ them to suit its needs: for example to add a hostname check. SSL_CTX_get0_param() and SSL_get0_param() return a pointer to an B<X509_VERIFY_PARAM> structure. -SSL_CTX_set1_param() and SSL_set1_param() return 1 for success and 0 -for failure. +SSL_CTX_set1_param(), SSL_set1_param(), SSL_CTX_set_purpose(), +SSL_set_purpose(), SSL_CTX_set_trust() and SSL_set_trust() return 1 for success +and 0 for failure. =head1 EXAMPLES @@ -55,7 +71,7 @@ These functions were added in OpenSSL 1.0.2. =head1 COPYRIGHT -Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2015-2022 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/deps/openssl/openssl/doc/man3/SSL_CTX_set1_verify_cert_store.pod b/deps/openssl/openssl/doc/man3/SSL_CTX_set1_verify_cert_store.pod index 7c41d290b30..19ea92a905f 100644 --- a/deps/openssl/openssl/doc/man3/SSL_CTX_set1_verify_cert_store.pod +++ b/deps/openssl/openssl/doc/man3/SSL_CTX_set1_verify_cert_store.pod @@ -5,7 +5,9 @@ SSL_CTX_set0_verify_cert_store, SSL_CTX_set1_verify_cert_store, SSL_CTX_set0_chain_cert_store, SSL_CTX_set1_chain_cert_store, SSL_set0_verify_cert_store, SSL_set1_verify_cert_store, -SSL_set0_chain_cert_store, SSL_set1_chain_cert_store - set certificate +SSL_set0_chain_cert_store, SSL_set1_chain_cert_store, +SSL_CTX_get0_verify_cert_store, SSL_CTX_get0_chain_cert_store, +SSL_get0_verify_cert_store, SSL_get0_chain_cert_store - set certificate verification or chain store =head1 SYNOPSIS @@ -16,11 +18,15 @@ verification or chain store int SSL_CTX_set1_verify_cert_store(SSL_CTX *ctx, X509_STORE *st); int SSL_CTX_set0_chain_cert_store(SSL_CTX *ctx, X509_STORE *st); int SSL_CTX_set1_chain_cert_store(SSL_CTX *ctx, X509_STORE *st); + int SSL_CTX_get0_verify_cert_store(SSL_CTX *ctx, X509_STORE **st); + int SSL_CTX_get0_chain_cert_store(SSL_CTX *ctx, X509_STORE **st); int SSL_set0_verify_cert_store(SSL *ctx, X509_STORE *st); int SSL_set1_verify_cert_store(SSL *ctx, X509_STORE *st); int SSL_set0_chain_cert_store(SSL *ctx, X509_STORE *st); int SSL_set1_chain_cert_store(SSL *ctx, X509_STORE *st); + int SSL_get0_verify_cert_store(SSL *ctx, X509_STORE **st); + int SSL_get0_chain_cert_store(SSL *ctx, X509_STORE **st); =head1 DESCRIPTION @@ -34,6 +40,11 @@ SSL_set0_verify_cert_store(), SSL_set1_verify_cert_store(), SSL_set0_chain_cert_store() and SSL_set1_chain_cert_store() are similar except they apply to SSL structure B<ssl>. +SSL_CTX_get0_verify_chain_store(), SSL_get0_verify_chain_store(), +SSL_CTX_get0_chain_cert_store() and SSL_get0_chain_cert_store() retrieve the +objects previously set via the above calls. A pointer to the object (or NULL if +no such object has been set) is written to B<*st>. + All these functions are implemented as macros. Those containing a B<1> increment the reference count of the supplied store so it must be freed at some point after the operation. Those containing a B<0> do @@ -94,7 +105,7 @@ These functions were added in OpenSSL 1.0.2. =head1 COPYRIGHT -Copyright 2013-2021 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2013-2022 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/deps/openssl/openssl/doc/man3/SSL_CTX_set_ssl_version.pod b/deps/openssl/openssl/doc/man3/SSL_CTX_set_ssl_version.pod index ba2b816f384..10aa63f729c 100644 --- a/deps/openssl/openssl/doc/man3/SSL_CTX_set_ssl_version.pod +++ b/deps/openssl/openssl/doc/man3/SSL_CTX_set_ssl_version.pod @@ -2,7 +2,7 @@ =head1 NAME -SSL_CTX_set_ssl_version, SSL_set_ssl_method, SSL_get_ssl_method +SSL_CTX_set_ssl_version, SSL_CTX_get_ssl_method, SSL_set_ssl_method, SSL_get_ssl_method - choose a new TLS/SSL method =head1 SYNOPSIS @@ -10,6 +10,8 @@ SSL_CTX_set_ssl_version, SSL_set_ssl_method, SSL_get_ssl_method #include <openssl/ssl.h> int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *method); + const SSL_METHOD *SSL_CTX_get_ssl_method(const SSL_CTX *ctx); + int SSL_set_ssl_method(SSL *s, const SSL_METHOD *method); const SSL_METHOD *SSL_get_ssl_method(const SSL *ssl); @@ -22,10 +24,13 @@ which are reset to the default values. SSL objects already created from this SSL_CTX with L<SSL_new(3)> are not affected, except when L<SSL_clear(3)> is being called, as described below. +SSL_CTX_get_ssl_method() returns the SSL_METHOD which was used to construct the +SSL_CTX. + SSL_set_ssl_method() sets a new TLS/SSL B<method> for a particular B<ssl> object. It may be reset, when SSL_clear() is called. -SSL_get_ssl_method() returns a function pointer to the TLS/SSL method +SSL_get_ssl_method() returns a pointer to the TLS/SSL method set in B<ssl>. =head1 NOTES @@ -59,6 +64,9 @@ The operation succeeded. =back +SSL_CTX_get_ssl_method() and SSL_get_ssl_method() always return non-NULL +pointers. + =head1 SEE ALSO L<SSL_CTX_new(3)>, L<SSL_new(3)>, @@ -71,7 +79,7 @@ SSL_CTX_set_ssl_version() was deprecated in OpenSSL 3.0. =head1 COPYRIGHT -Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2000-2022 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/deps/openssl/openssl/doc/man3/SSL_CTX_set_timeout.pod b/deps/openssl/openssl/doc/man3/SSL_CTX_set_timeout.pod index 29ef1b8ce7c..9aca5374be0 100644 --- a/deps/openssl/openssl/doc/man3/SSL_CTX_set_timeout.pod +++ b/deps/openssl/openssl/doc/man3/SSL_CTX_set_timeout.pod @@ -42,6 +42,16 @@ basis, see L<SSL_get_default_timeout(3)>. All currently supported protocols have the same default timeout value of 300 seconds. +This timeout value is used as the ticket lifetime hint for stateless session +tickets. It is also used as the timeout value within the ticket itself. + +For TLSv1.3, RFC8446 limits transmission of this value to 1 week (604800 +seconds). + +For TLSv1.2, tickets generated during an initial handshake use the value +as specified. Tickets generated during a resumed handshake have a value +of 0 for the ticket lifetime hint. + =head1 RETURN VALUES SSL_CTX_set_timeout() returns the previously set timeout value. @@ -58,7 +68,7 @@ L<SSL_get_default_timeout(3)> =head1 COPYRIGHT -Copyright 2001-2016 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2001-2022 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/deps/openssl/openssl/doc/man3/SSL_CTX_set_verify.pod b/deps/openssl/openssl/doc/man3/SSL_CTX_set_verify.pod index abf1740e361..9d4abac30eb 100644 --- a/deps/openssl/openssl/doc/man3/SSL_CTX_set_verify.pod +++ b/deps/openssl/openssl/doc/man3/SSL_CTX_set_verify.pod @@ -53,11 +53,11 @@ This makes the handshake suspend and return control to the calling application with B<SSL_ERROR_WANT_RETRY_VERIFY>. The application can for instance fetch further certificates or cert status information needed for the verification. -Note that the handshake may still be aborted if a subsequent invocation of the -callback (e.g. at a lower depth, or for a separate error condition) returns 0. Calling L<SSL_connect(3)> again resumes the connection attempt by retrying the server certificate verification step. This process may even be repeated if need be. +Note that the handshake may still be aborted if a subsequent invocation of the +callback (e.g., at a lower depth, or for a separate error condition) returns 0. SSL_CTX_set_verify_depth() sets the maximum B<depth> for the certificate chain verification that shall be allowed for B<ctx>. diff --git a/deps/openssl/openssl/doc/man3/SSL_set_session.pod b/deps/openssl/openssl/doc/man3/SSL_set_session.pod index c3eca2565ad..5e86ce5f87b 100644 --- a/deps/openssl/openssl/doc/man3/SSL_set_session.pod +++ b/deps/openssl/openssl/doc/man3/SSL_set_session.pod @@ -21,7 +21,8 @@ with the L<SSL_session_reused(3)> call. If there is already a session set inside B<ssl> (because it was set with SSL_set_session() before or because the same B<ssl> was already used for -a connection), SSL_SESSION_free() will be called for that session. If that old +a connection), SSL_SESSION_free() will be called for that session. +This is also the case when B<session> is a NULL pointer. If that old session is still B<open>, it is considered bad and will be removed from the session cache (if used). A session is considered open, if L<SSL_shutdown(3)> was not called for the connection (or at least L<SSL_set_shutdown(3)> was used to @@ -60,7 +61,7 @@ L<SSL_CTX_set_session_cache_mode(3)> =head1 COPYRIGHT -Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2000-2022 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/deps/openssl/openssl/doc/man7/EVP_KDF-SSHKDF.pod b/deps/openssl/openssl/doc/man7/EVP_KDF-SSHKDF.pod index 08369abff15..2b3c556aab9 100644 --- a/deps/openssl/openssl/doc/man7/EVP_KDF-SSHKDF.pod +++ b/deps/openssl/openssl/doc/man7/EVP_KDF-SSHKDF.pod @@ -103,7 +103,7 @@ This example derives an 8 byte IV using SHA-256 with a 1K "key" and appropriate EVP_KDF *kdf; EVP_KDF_CTX *kctx; - const char type = EVP_KDF_SSHKDF_TYPE_INITIAL_IV_CLI_TO_SRV; + char type = EVP_KDF_SSHKDF_TYPE_INITIAL_IV_CLI_TO_SRV; unsigned char key[1024] = "01234..."; unsigned char xcghash[32] = "012345..."; unsigned char session_id[32] = "012345..."; @@ -126,7 +126,7 @@ This example derives an 8 byte IV using SHA-256 with a 1K "key" and appropriate *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_SSHKDF_TYPE, &type, sizeof(type)); *p = OSSL_PARAM_construct_end(); - if (EVP_KDF_derive(kctx, out, &outlen, params) <= 0) + if (EVP_KDF_derive(kctx, out, outlen, params) <= 0) /* Error */ @@ -146,7 +146,7 @@ L<EVP_KDF(3)/PARAMETERS> =head1 COPYRIGHT -Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/deps/openssl/openssl/doc/man7/provider-signature.pod b/deps/openssl/openssl/doc/man7/provider-signature.pod index 9d4df86fd65..30de3d86552 100644 --- a/deps/openssl/openssl/doc/man7/provider-signature.pod +++ b/deps/openssl/openssl/doc/man7/provider-signature.pod @@ -43,7 +43,7 @@ provider-signature - The signature library E<lt>-E<gt> provider functions /* Digest Sign */ int OSSL_FUNC_signature_digest_sign_init(void *ctx, const char *mdname, - const char *props, void *provkey, + void *provkey, const OSSL_PARAM params[]); int OSSL_FUNC_signature_digest_sign_update(void *ctx, const unsigned char *data, size_t datalen); @@ -56,7 +56,7 @@ provider-signature - The signature library E<lt>-E<gt> provider functions /* Digest Verify */ int OSSL_FUNC_signature_digest_verify_init(void *ctx, const char *mdname, - const char *props, void *provkey, + void *provkey, const OSSL_PARAM params[]); int OSSL_FUNC_signature_digest_verify_update(void *ctx, const unsigned char *data, @@ -266,9 +266,7 @@ OSSL_FUNC_signature_set_ctx_md_params(). The key object should have been previously generated, loaded or imported into the provider using the key management (OSSL_OP_KEYMGMT) operation (see provider-keymgmt(7)>. -The name of the digest to be used will be in the I<mdname> parameter. There may -also be properties to be used in fetching the digest in the I<props> parameter, -although this may be ignored by providers. +The name of the digest to be used will be in the I<mdname> parameter. OSSL_FUNC_signature_digest_sign_update() provides data to be signed in the I<data> parameter which should be of length I<datalen>. A previously initialised @@ -305,9 +303,7 @@ OSSL_FUNC_signature_set_ctx_md_params(). The key object should have been previously generated, loaded or imported into the provider using the key management (OSSL_OP_KEYMGMT) operation (see provider-keymgmt(7)>. -The name of the digest to be used will be in the I<mdname> parameter. There may -also be properties to be used in fetching the digest in the I<props> parameter, -although this may be ignored by providers. +The name of the digest to be used will be in the I<mdname> parameter. OSSL_FUNC_signature_digest_verify_update() provides data to be verified in the I<data> parameter which should be of length I<datalen>. A previously initialised @@ -435,7 +431,7 @@ The provider SIGNATURE interface was introduced in OpenSSL 3.0. =head1 COPYRIGHT -Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/deps/openssl/openssl/doc/man7/provider.pod b/deps/openssl/openssl/doc/man7/provider.pod index 7074a5cad1b..fb092931c92 100644 --- a/deps/openssl/openssl/doc/man7/provider.pod +++ b/deps/openssl/openssl/doc/man7/provider.pod @@ -115,7 +115,7 @@ In the OpenSSL libraries, the corresponding method object is B<EVP_MD>. The number for this operation is B<OSSL_OP_DIGEST>. The functions the provider can offer are described in -L<provider-digest(7)> +L<provider-digest(7)>. =item Symmetric ciphers @@ -123,7 +123,7 @@ In the OpenSSL libraries, the corresponding method object is B<EVP_CIPHER>. The number for this operation is B<OSSL_OP_CIPHER>. The functions the provider can offer are described in -L<provider-cipher(7)> +L<provider-cipher(7)>. =item Message Authentication Code (MAC) @@ -131,7 +131,7 @@ In the OpenSSL libraries, the corresponding method object is B<EVP_MAC>. The number for this operation is B<OSSL_OP_MAC>. The functions the provider can offer are described in -L<provider-mac(7)> +L<provider-mac(7)>. =item Key Derivation Function (KDF) @@ -139,7 +139,7 @@ In the OpenSSL libraries, the corresponding method object is B<EVP_KDF>. The number for this operation is B<OSSL_OP_KDF>. The functions the provider can offer are described in -L<provider-kdf(7)> +L<provider-kdf(7)>. =item Key Exchange @@ -147,7 +147,7 @@ In the OpenSSL libraries, the corresponding method object is B<EVP_KEYEXCH>. The number for this operation is B<OSSL_OP_KEYEXCH>. The functions the provider can offer are described in -L<provider-keyexch(7)> +L<provider-keyexch(7)>. =item Asymmetric Ciphers @@ -155,13 +155,13 @@ In the OpenSSL libraries, the corresponding method object is B<EVP_ASYM_CIPHER>. The number for this operation is B<OSSL_OP_ASYM_CIPHER>. The functions the provider can offer are described in -L<provider-asym_cipher(7)> +L<provider-asym_cipher(7)>. =item Asymmetric Key Encapsulation In the OpenSSL libraries, the corresponding method object is B<EVP_KEM>. The number for this operation is B<OSSL_OP_KEM>. -The functions the provider can offer are described in L<provider-kem(7)> +The functions the provider can offer are described in L<provider-kem(7)>. =item Encoding @@ -169,7 +169,39 @@ In the OpenSSL libraries, the corresponding method object is B<OSSL_ENCODER>. The number for this operation is B<OSSL_OP_ENCODER>. The functions the provider can offer are described in -L<provider-encoder(7)> +L<provider-encoder(7)>. + +=item Decoding + +In the OpenSSL libraries, the corresponding method object is +B<OSSL_DECODER>. +The number for this operation is B<OSSL_OP_DECODER>. +The functions the provider can offer are described in +L<provider-decoder(7)>. + +=item Random Number Generation + +The number for this operation is B<OSSL_OP_RAND>. +The functions the provider can offer for random number generation are described +in L<provider-rand(7)>. + +=item Key Management + +The number for this operation is B<OSSL_OP_KEYMGMT>. +The functions the provider can offer for key management are described in +L<provider-keymgmt(7)>. + +=item Signing and Signature Verification + +The number for this operation is B<OSSL_OP_SIGNATURE>. +The functions the provider can offer for digital signatures are described in +L<provider-signature(7)>. + +=item Store Management + +The number for this operation is B<OSSL_OP_STORE>. +The functions the provider can offer for store management are described in +L<provider-storemgmt(7)>. =back @@ -222,7 +254,7 @@ introduced in OpenSSL 3.0. =head1 COPYRIGHT -Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/deps/openssl/openssl/e_os.h b/deps/openssl/openssl/e_os.h index e1608ae55d7..514de967a95 100644 --- a/deps/openssl/openssl/e_os.h +++ b/deps/openssl/openssl/e_os.h @@ -1,5 +1,5 @@ /* - * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -249,8 +249,6 @@ FILE *__iob_func(); /***********************************************/ # if defined(OPENSSL_SYS_WINDOWS) -# define strcasecmp _stricmp -# define strncasecmp _strnicmp # if (_MSC_VER >= 1310) && !defined(_WIN32_WCE) # define open _open # define fdopen _fdopen diff --git a/deps/openssl/openssl/engines/e_devcrypto.c b/deps/openssl/openssl/engines/e_devcrypto.c index fa01317db5e..b4231752273 100644 --- a/deps/openssl/openssl/engines/e_devcrypto.c +++ b/deps/openssl/openssl/engines/e_devcrypto.c @@ -1,5 +1,5 @@ /* - * Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -1159,9 +1159,9 @@ static int devcrypto_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f) (void)) case DEVCRYPTO_CMD_CIPHERS: if (p == NULL) return 1; - if (strcasecmp((const char *)p, "ALL") == 0) { + if (OPENSSL_strcasecmp((const char *)p, "ALL") == 0) { devcrypto_select_all_ciphers(selected_ciphers); - } else if (strcasecmp((const char*)p, "NONE") == 0) { + } else if (OPENSSL_strcasecmp((const char*)p, "NONE") == 0) { memset(selected_ciphers, 0, sizeof(selected_ciphers)); } else { new_list=OPENSSL_zalloc(sizeof(selected_ciphers)); @@ -1179,9 +1179,9 @@ static int devcrypto_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f) (void)) case DEVCRYPTO_CMD_DIGESTS: if (p == NULL) return 1; - if (strcasecmp((const char *)p, "ALL") == 0) { + if (OPENSSL_strcasecmp((const char *)p, "ALL") == 0) { devcrypto_select_all_digests(selected_digests); - } else if (strcasecmp((const char*)p, "NONE") == 0) { + } else if (OPENSSL_strcasecmp((const char*)p, "NONE") == 0) { memset(selected_digests, 0, sizeof(selected_digests)); } else { new_list=OPENSSL_zalloc(sizeof(selected_digests)); diff --git a/deps/openssl/openssl/engines/e_loader_attic.c b/deps/openssl/openssl/engines/e_loader_attic.c index 391ed33d5e3..050593975d6 100644 --- a/deps/openssl/openssl/engines/e_loader_attic.c +++ b/deps/openssl/openssl/engines/e_loader_attic.c @@ -1,5 +1,5 @@ /* - * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -14,7 +14,6 @@ /* We need to use some engine deprecated APIs */ #define OPENSSL_SUPPRESS_DEPRECATED -/* #include "e_os.h" */ #include <string.h> #include <sys/stat.h> #include <ctype.h> @@ -44,7 +43,6 @@ DEFINE_STACK_OF(OSSL_STORE_INFO) #ifdef _WIN32 # define stat _stat -# define strncasecmp _strnicmp #endif #ifndef S_ISDIR @@ -971,12 +969,12 @@ static OSSL_STORE_LOADER_CTX *file_open_ex * There's a special case if the URI also contains an authority, then * the full URI shouldn't be used as a path anywhere. */ - if (strncasecmp(uri, "file:", 5) == 0) { + if (OPENSSL_strncasecmp(uri, "file:", 5) == 0) { const char *p = &uri[5]; if (strncmp(&uri[5], "//", 2) == 0) { path_data_n--; /* Invalidate using the full URI */ - if (strncasecmp(&uri[7], "localhost/", 10) == 0) { + if (OPENSSL_strncasecmp(&uri[7], "localhost/", 10) == 0) { p = &uri[16]; } else if (uri[7] == '/') { p = &uri[7]; @@ -1466,7 +1464,8 @@ static int file_name_check(OSSL_STORE_LOADER_CTX *ctx, const char *name) /* * First, check the basename */ - if (strncasecmp(name, ctx->_.dir.search_name, len) != 0 || name[len] != '.') + if (OPENSSL_strncasecmp(name, ctx->_.dir.search_name, len) != 0 + || name[len] != '.') return 0; p = &name[len + 1]; diff --git a/deps/openssl/openssl/engines/e_ossltest.c b/deps/openssl/openssl/engines/e_ossltest.c index 0506faa6285..c925d2c5a6a 100644 --- a/deps/openssl/openssl/engines/e_ossltest.c +++ b/deps/openssl/openssl/engines/e_ossltest.c @@ -1,5 +1,5 @@ /* - * Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2015-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -42,10 +42,6 @@ #include "e_ossltest_err.c" -#ifdef _WIN32 -# define strncasecmp _strnicmp -#endif - /* Engine Id and Name */ static const char *engine_ossltest_id = "ossltest"; static const char *engine_ossltest_name = "OpenSSL Test engine support"; @@ -383,7 +379,7 @@ static EVP_PKEY *load_key(ENGINE *eng, const char *key_id, int pub, BIO *in; EVP_PKEY *key; - if (strncasecmp(key_id, "ot:", 3) != 0) + if (OPENSSL_strncasecmp(key_id, "ot:", 3) != 0) return NULL; key_id += 3; diff --git a/deps/openssl/openssl/fuzz/client.c b/deps/openssl/openssl/fuzz/client.c index 698ff0f669d..1754add5096 100644 --- a/deps/openssl/openssl/fuzz/client.c +++ b/deps/openssl/openssl/fuzz/client.c @@ -1,5 +1,5 @@ /* - * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -55,7 +55,7 @@ int FuzzerInitialize(int *argc, char ***argv) int FuzzerTestOneInput(const uint8_t *buf, size_t len) { - SSL *client; + SSL *client = NULL; BIO *in; BIO *out; SSL_CTX *ctx; @@ -65,13 +65,23 @@ int FuzzerTestOneInput(const uint8_t *buf, size_t len) /* This only fuzzes the initial flow from the client so far. */ ctx = SSL_CTX_new(SSLv23_method()); + if (ctx == NULL) + goto end; client = SSL_new(ctx); + if (client == NULL) + goto end; OPENSSL_assert(SSL_set_min_proto_version(client, 0) == 1); OPENSSL_assert(SSL_set_cipher_list(client, "ALL:eNULL:@SECLEVEL=0") == 1); SSL_set_tlsext_host_name(client, "localhost"); in = BIO_new(BIO_s_mem()); + if (in == NULL) + goto end; out = BIO_new(BIO_s_mem()); + if (out == NULL) { + BIO_free(in); + goto end; + } SSL_set_bio(client, in, out); SSL_set_connect_state(client); OPENSSL_assert((size_t)BIO_write(in, buf, len) == len); @@ -84,6 +94,7 @@ int FuzzerTestOneInput(const uint8_t *buf, size_t len) } } } + end: SSL_free(client); ERR_clear_error(); SSL_CTX_free(ctx); diff --git a/deps/openssl/openssl/include/crypto/bn_conf.h b/deps/openssl/openssl/include/crypto/bn_conf.h deleted file mode 100644 index 79400c6472a..00000000000 --- a/deps/openssl/openssl/include/crypto/bn_conf.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/bn_conf.h" diff --git a/deps/openssl/openssl/include/crypto/ctype.h b/deps/openssl/openssl/include/crypto/ctype.h index a35c137e843..16f135df3b5 100644 --- a/deps/openssl/openssl/include/crypto/ctype.h +++ b/deps/openssl/openssl/include/crypto/ctype.h @@ -1,5 +1,5 @@ /* - * Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -80,4 +80,6 @@ int ossl_ascii_isdigit(const char inchar); # define ossl_isbase64(c) (ossl_ctype_check((c), CTYPE_MASK_base64)) # define ossl_isasn1print(c) (ossl_ctype_check((c), CTYPE_MASK_asn1print)) +int ossl_init_casecmp(void); +void ossl_deinit_casecmp(void); #endif diff --git a/deps/openssl/openssl/include/crypto/dso_conf.h b/deps/openssl/openssl/include/crypto/dso_conf.h deleted file mode 100644 index e7f2afa9872..00000000000 --- a/deps/openssl/openssl/include/crypto/dso_conf.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/dso_conf.h" diff --git a/deps/openssl/openssl/include/crypto/ecerr.h b/deps/openssl/openssl/include/crypto/ecerr.h index 07b6c7aa62d..4658ae8fb2c 100644 --- a/deps/openssl/openssl/include/crypto/ecerr.h +++ b/deps/openssl/openssl/include/crypto/ecerr.h @@ -1,6 +1,6 @@ /* * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy diff --git a/deps/openssl/openssl/include/internal/core.h b/deps/openssl/openssl/include/internal/core.h index d9dc424164c..274e368aaaa 100644 --- a/deps/openssl/openssl/include/internal/core.h +++ b/deps/openssl/openssl/include/internal/core.h @@ -1,5 +1,5 @@ /* - * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -63,4 +63,6 @@ __owur int ossl_lib_ctx_read_lock(OSSL_LIB_CTX *ctx); int ossl_lib_ctx_unlock(OSSL_LIB_CTX *ctx); int ossl_lib_ctx_is_child(OSSL_LIB_CTX *ctx); +void *ossl_c_locale(void); + #endif diff --git a/deps/openssl/openssl/include/openssl/asn1.h b/deps/openssl/openssl/include/openssl/asn1.h deleted file mode 100644 index cd9fc7cc706..00000000000 --- a/deps/openssl/openssl/include/openssl/asn1.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/asn1.h" diff --git a/deps/openssl/openssl/include/openssl/asn1t.h b/deps/openssl/openssl/include/openssl/asn1t.h deleted file mode 100644 index 6ff4f574949..00000000000 --- a/deps/openssl/openssl/include/openssl/asn1t.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/asn1t.h" diff --git a/deps/openssl/openssl/include/openssl/bio.h b/deps/openssl/openssl/include/openssl/bio.h deleted file mode 100644 index dcece3cb4d6..00000000000 --- a/deps/openssl/openssl/include/openssl/bio.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/bio.h" diff --git a/deps/openssl/openssl/include/openssl/cmp.h b/deps/openssl/openssl/include/openssl/cmp.h deleted file mode 100644 index 7c8a6dc96fc..00000000000 --- a/deps/openssl/openssl/include/openssl/cmp.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/cmp.h" diff --git a/deps/openssl/openssl/include/openssl/cms.h b/deps/openssl/openssl/include/openssl/cms.h deleted file mode 100644 index 33a00775c9f..00000000000 --- a/deps/openssl/openssl/include/openssl/cms.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/cms.h" diff --git a/deps/openssl/openssl/include/openssl/conf.h b/deps/openssl/openssl/include/openssl/conf.h deleted file mode 100644 index 2712886cafc..00000000000 --- a/deps/openssl/openssl/include/openssl/conf.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/conf.h" diff --git a/deps/openssl/openssl/include/openssl/configuration.h b/deps/openssl/openssl/include/openssl/configuration.h deleted file mode 100644 index 8ffad996047..00000000000 --- a/deps/openssl/openssl/include/openssl/configuration.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/configuration.h" diff --git a/deps/openssl/openssl/include/openssl/crmf.h b/deps/openssl/openssl/include/openssl/crmf.h deleted file mode 100644 index 4103852ecb2..00000000000 --- a/deps/openssl/openssl/include/openssl/crmf.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/crmf.h" diff --git a/deps/openssl/openssl/include/openssl/crypto.h b/deps/openssl/openssl/include/openssl/crypto.h deleted file mode 100644 index 6d0e701ebd3..00000000000 --- a/deps/openssl/openssl/include/openssl/crypto.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/crypto.h" diff --git a/deps/openssl/openssl/include/openssl/crypto.h.in b/deps/openssl/openssl/include/openssl/crypto.h.in index c56885d2d6f..7232f647e8a 100644 --- a/deps/openssl/openssl/include/openssl/crypto.h.in +++ b/deps/openssl/openssl/include/openssl/crypto.h.in @@ -133,6 +133,8 @@ int OPENSSL_hexstr2buf_ex(unsigned char *buf, size_t buf_n, size_t *buflen, const char *str, const char sep); unsigned char *OPENSSL_hexstr2buf(const char *str, long *buflen); int OPENSSL_hexchar2int(unsigned char c); +int OPENSSL_strcasecmp(const char *s1, const char *s2); +int OPENSSL_strncasecmp(const char *s1, const char *s2, size_t n); # define OPENSSL_MALLOC_MAX_NELEMS(type) (((1U<<(sizeof(int)*8-1))-1)/sizeof(type)) diff --git a/deps/openssl/openssl/include/openssl/ct.h b/deps/openssl/openssl/include/openssl/ct.h deleted file mode 100644 index 7ebb8438713..00000000000 --- a/deps/openssl/openssl/include/openssl/ct.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/ct.h" diff --git a/deps/openssl/openssl/include/openssl/ecerr.h b/deps/openssl/openssl/include/openssl/ecerr.h index 49088d208b2..46405ac62d9 100644 --- a/deps/openssl/openssl/include/openssl/ecerr.h +++ b/deps/openssl/openssl/include/openssl/ecerr.h @@ -1,6 +1,6 @@ /* * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -35,6 +35,7 @@ # define EC_R_DECODE_ERROR 142 # define EC_R_DISCRIMINANT_IS_ZERO 118 # define EC_R_EC_GROUP_NEW_BY_NAME_FAILURE 119 +# define EC_R_EXPLICIT_PARAMS_NOT_SUPPORTED 127 # define EC_R_FAILED_MAKING_PUBLIC_KEY 166 # define EC_R_FIELD_TOO_LARGE 143 # define EC_R_GF2M_NOT_SUPPORTED 147 diff --git a/deps/openssl/openssl/include/openssl/err.h b/deps/openssl/openssl/include/openssl/err.h deleted file mode 100644 index bf482070474..00000000000 --- a/deps/openssl/openssl/include/openssl/err.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/err.h" diff --git a/deps/openssl/openssl/include/openssl/ess.h b/deps/openssl/openssl/include/openssl/ess.h deleted file mode 100644 index 64cc0162251..00000000000 --- a/deps/openssl/openssl/include/openssl/ess.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/ess.h" diff --git a/deps/openssl/openssl/include/openssl/fipskey.h b/deps/openssl/openssl/include/openssl/fipskey.h deleted file mode 100644 index c012013d98d..00000000000 --- a/deps/openssl/openssl/include/openssl/fipskey.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/fipskey.h" diff --git a/deps/openssl/openssl/include/openssl/lhash.h b/deps/openssl/openssl/include/openssl/lhash.h deleted file mode 100644 index 8d824f5cfe6..00000000000 --- a/deps/openssl/openssl/include/openssl/lhash.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/lhash.h" diff --git a/deps/openssl/openssl/include/openssl/ocsp.h b/deps/openssl/openssl/include/openssl/ocsp.h deleted file mode 100644 index 5b13afedf36..00000000000 --- a/deps/openssl/openssl/include/openssl/ocsp.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/ocsp.h" diff --git a/deps/openssl/openssl/include/openssl/opensslv.h b/deps/openssl/openssl/include/openssl/opensslv.h deleted file mode 100644 index 078cfba40fb..00000000000 --- a/deps/openssl/openssl/include/openssl/opensslv.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/opensslv.h" diff --git a/deps/openssl/openssl/include/openssl/pkcs12.h b/deps/openssl/openssl/include/openssl/pkcs12.h deleted file mode 100644 index 2d7e2c08e99..00000000000 --- a/deps/openssl/openssl/include/openssl/pkcs12.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/pkcs12.h" diff --git a/deps/openssl/openssl/include/openssl/pkcs7.h b/deps/openssl/openssl/include/openssl/pkcs7.h deleted file mode 100644 index b553f9d0f05..00000000000 --- a/deps/openssl/openssl/include/openssl/pkcs7.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/pkcs7.h" diff --git a/deps/openssl/openssl/include/openssl/safestack.h b/deps/openssl/openssl/include/openssl/safestack.h deleted file mode 100644 index 989eafb3302..00000000000 --- a/deps/openssl/openssl/include/openssl/safestack.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/safestack.h" diff --git a/deps/openssl/openssl/include/openssl/srp.h b/deps/openssl/openssl/include/openssl/srp.h deleted file mode 100644 index 9df42dad4c3..00000000000 --- a/deps/openssl/openssl/include/openssl/srp.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/srp.h" diff --git a/deps/openssl/openssl/include/openssl/ssl.h b/deps/openssl/openssl/include/openssl/ssl.h deleted file mode 100644 index eb74ca98a97..00000000000 --- a/deps/openssl/openssl/include/openssl/ssl.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/ssl.h" diff --git a/deps/openssl/openssl/include/openssl/ssl.h.in b/deps/openssl/openssl/include/openssl/ssl.h.in index cd8ecac6235..677a20be15d 100644 --- a/deps/openssl/openssl/include/openssl/ssl.h.in +++ b/deps/openssl/openssl/include/openssl/ssl.h.in @@ -1309,6 +1309,8 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION) # define SSL_CTRL_GET_TMP_KEY 133 # define SSL_CTRL_GET_NEGOTIATED_GROUP 134 # define SSL_CTRL_SET_RETRY_VERIFY 136 +# define SSL_CTRL_GET_VERIFY_CERT_STORE 137 +# define SSL_CTRL_GET_CHAIN_CERT_STORE 138 # define SSL_CERT_SET_FIRST 1 # define SSL_CERT_SET_NEXT 2 # define SSL_CERT_SET_SERVER 3 @@ -1370,10 +1372,14 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION) SSL_CTX_ctrl(ctx,SSL_CTRL_SET_VERIFY_CERT_STORE,0,(char *)(st)) # define SSL_CTX_set1_verify_cert_store(ctx,st) \ SSL_CTX_ctrl(ctx,SSL_CTRL_SET_VERIFY_CERT_STORE,1,(char *)(st)) +# define SSL_CTX_get0_verify_cert_store(ctx,st) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_GET_VERIFY_CERT_STORE,0,(char *)(st)) # define SSL_CTX_set0_chain_cert_store(ctx,st) \ SSL_CTX_ctrl(ctx,SSL_CTRL_SET_CHAIN_CERT_STORE,0,(char *)(st)) # define SSL_CTX_set1_chain_cert_store(ctx,st) \ SSL_CTX_ctrl(ctx,SSL_CTRL_SET_CHAIN_CERT_STORE,1,(char *)(st)) +# define SSL_CTX_get0_chain_cert_store(ctx,st) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_GET_CHAIN_CERT_STORE,0,(char *)(st)) # define SSL_set0_chain(s,sk) \ SSL_ctrl(s,SSL_CTRL_CHAIN,0,(char *)(sk)) # define SSL_set1_chain(s,sk) \ @@ -1396,10 +1402,15 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION) SSL_ctrl(s,SSL_CTRL_SET_VERIFY_CERT_STORE,0,(char *)(st)) # define SSL_set1_verify_cert_store(s,st) \ SSL_ctrl(s,SSL_CTRL_SET_VERIFY_CERT_STORE,1,(char *)(st)) +#define SSL_get0_verify_cert_store(s,st) \ + SSL_ctrl(s,SSL_CTRL_GET_VERIFY_CERT_STORE,0,(char *)(st)) # define SSL_set0_chain_cert_store(s,st) \ SSL_ctrl(s,SSL_CTRL_SET_CHAIN_CERT_STORE,0,(char *)(st)) # define SSL_set1_chain_cert_store(s,st) \ SSL_ctrl(s,SSL_CTRL_SET_CHAIN_CERT_STORE,1,(char *)(st)) +#define SSL_get0_chain_cert_store(s,st) \ + SSL_ctrl(s,SSL_CTRL_GET_CHAIN_CERT_STORE,0,(char *)(st)) + # define SSL_get1_groups(s, glist) \ SSL_ctrl(s,SSL_CTRL_GET_GROUPS,0,(int*)(glist)) # define SSL_CTX_set1_groups(ctx, glist, glistlen) \ diff --git a/deps/openssl/openssl/include/openssl/ui.h b/deps/openssl/openssl/include/openssl/ui.h deleted file mode 100644 index f5edb766b4f..00000000000 --- a/deps/openssl/openssl/include/openssl/ui.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/ui.h" diff --git a/deps/openssl/openssl/include/openssl/x509.h b/deps/openssl/openssl/include/openssl/x509.h deleted file mode 100644 index ed28bd68cb2..00000000000 --- a/deps/openssl/openssl/include/openssl/x509.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/x509.h" diff --git a/deps/openssl/openssl/include/openssl/x509.h.in b/deps/openssl/openssl/include/openssl/x509.h.in index b4efbb55ddb..3ef741f603f 100644 --- a/deps/openssl/openssl/include/openssl/x509.h.in +++ b/deps/openssl/openssl/include/openssl/x509.h.in @@ -1,7 +1,7 @@ /* * {- join("\n * ", @autowarntext) -} * - * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved * * Licensed under the Apache License 2.0 (the "License"). You may not use @@ -358,11 +358,11 @@ int X509_NAME_digest(const X509_NAME *data, const EVP_MD *type, X509 *X509_load_http(const char *url, BIO *bio, BIO *rbio, int timeout); X509_CRL *X509_CRL_load_http(const char *url, BIO *bio, BIO *rbio, int timeout); # ifndef OPENSSL_NO_DEPRECATED_3_0 -# include <openssl/ocsp.h> /* OCSP_REQ_CTX_nbio_d2i */ +# include <openssl/http.h> /* OSSL_HTTP_REQ_CTX_nbio_d2i */ # define X509_http_nbio(rctx, pcert) \ - OCSP_REQ_CTX_nbio_d2i(rctx, pcert, ASN1_ITEM_rptr(X509)) + OSSL_HTTP_REQ_CTX_nbio_d2i(rctx, pcert, ASN1_ITEM_rptr(X509)) # define X509_CRL_http_nbio(rctx, pcrl) \ - OCSP_REQ_CTX_nbio_d2i(rctx, pcrl, ASN1_ITEM_rptr(X509_CRL)) + OSSL_HTTP_REQ_CTX_nbio_d2i(rctx, pcrl, ASN1_ITEM_rptr(X509_CRL)) # endif # ifndef OPENSSL_NO_STDIO diff --git a/deps/openssl/openssl/include/openssl/x509_vfy.h b/deps/openssl/openssl/include/openssl/x509_vfy.h deleted file mode 100644 index 9270a3ee097..00000000000 --- a/deps/openssl/openssl/include/openssl/x509_vfy.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/x509_vfy.h" diff --git a/deps/openssl/openssl/include/openssl/x509v3.h b/deps/openssl/openssl/include/openssl/x509v3.h deleted file mode 100644 index 5629ae9a3a9..00000000000 --- a/deps/openssl/openssl/include/openssl/x509v3.h +++ /dev/null @@ -1 +0,0 @@ -#include "../../../config/x509v3.h" diff --git a/deps/openssl/openssl/providers/common/capabilities.c b/deps/openssl/openssl/providers/common/capabilities.c index f6d95197f07..7223d55164c 100644 --- a/deps/openssl/openssl/providers/common/capabilities.c +++ b/deps/openssl/openssl/providers/common/capabilities.c @@ -1,5 +1,5 @@ /* - * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -217,7 +217,7 @@ static int tls_group_capability(OSSL_CALLBACK *cb, void *arg) int ossl_prov_get_capabilities(void *provctx, const char *capability, OSSL_CALLBACK *cb, void *arg) { - if (strcasecmp(capability, "TLS-GROUP") == 0) + if (OPENSSL_strcasecmp(capability, "TLS-GROUP") == 0) return tls_group_capability(cb, arg); /* We don't support this capability */ diff --git a/deps/openssl/openssl/providers/fips-sources.checksums b/deps/openssl/openssl/providers/fips-sources.checksums index 9b9fd1ff43c..90721f8041b 100644 --- a/deps/openssl/openssl/providers/fips-sources.checksums +++ b/deps/openssl/openssl/providers/fips-sources.checksums @@ -72,8 +72,8 @@ da7f7780d27eed164797e5334cd45b35d9c113e86afaca051463aef9a8fd787c crypto/bn/asm/ 58b587e20404efa408b31a88ba9c357059ced709bea78c07deb91df7b687db81 crypto/bn/bn_conv.c 2893b6d03d4850d09c15959941b0759bbb50d8c20e873bed088e7cde4e15a65a crypto/bn/bn_ctx.c d94295953ab91469fe2b9da2a542b8ea11ac38551ecde8f8202b7f645c2dea16 crypto/bn/bn_dh.c -a837ba52750ab30a57b6dd2fd4cf901e18a891a189b089f83add2f5dc8138eb7 crypto/bn/bn_div.c -160ea2c916774d6a7f8130e0a05cad7c0a954b4726c15017b3df67e3285231f3 crypto/bn/bn_exp.c +74b63a4515894592b7241fb30b91b21510beaa3d397809e3d74bc9a73e879d18 crypto/bn/bn_div.c +692e200e66389991eb2e6fe9d9a62eda5fe9005cda834b8af1a435a811b6b3c9 crypto/bn/bn_exp.c ec2b6e3af6df473a23e7f1a8522f2554cb0eb5d34e3282458c4a66d242278434 crypto/bn/bn_exp2.c b32d83cee8c00d837a7e4fb8af3f5cf17cb8d2419302e8f5fbcf62119092e874 crypto/bn/bn_gcd.c 4d6cc7ed36978247a191df1eea0120f8ee97b639ba228793dabe5a8355a1a609 crypto/bn/bn_gf2m.c @@ -101,13 +101,13 @@ affabb87861653b216e746d6c2fce5c2ac395b0ca570d439508e9f5e102ee340 crypto/bn/rsaz 834db8ff36006e5cb53e09ca6c44290124bd23692f4341ea6563b66fcade4cea crypto/bsearch.c c39334b70e1394e43f378ae8d31b6e6dc125e4d9181e6536d38e649c4eaadb75 crypto/buffer/buffer.c 23d46ae37a8d9452c0c88418d2cb8350153f8c2c6060234130a2e429da2370e0 crypto/cmac/cmac.c -7f24e4937e0af857e233afbb6a7f25b09b1e5674185242a5cc8f579a45bbf1da crypto/context.c +58068d6533fed9359b164ddc9711b2dd7b2a76f32ad94103d91dbe3462ac95d8 crypto/context.c 83b8912fb01bacfe0b5269c7afa69db7e1718530cce1ed27870abef1407951d6 crypto/core_algorithm.c 60321d1af7bf9697d969438f6b319fbcb4fdc1a47a0b056d02b971973a8550ca crypto/core_fetch.c -7d090f71175f28fdc400455fdbc68340a545556d16cb1f6251ac92ebb63a38c1 crypto/core_namemap.c +02670d631bf0f34cca1e3477079d7fe5de4e03c391cf3992986f44f55319597c crypto/core_namemap.c 469e2f53b5f76cd487a60d3d4c44c8fc3a6c4d08405597ba664661ba485508d3 crypto/cpuid.c 71f0fff881eb4c5505fb17662f0ea4bbff24c6858c045a013ad8f786b07da5c4 crypto/cryptlib.c -a3d146afa1d66cc3bbfdc7c106f262b679bb5aecce54e8dee732ae9b3e3333db crypto/ctype.c +7e8c8c0b43af045fb31c38a0eb643d5db1316fb832b3b0494809f7c288630ec8 crypto/ctype.c 8e61d79299003917ac409d129d291f0a63e4ed417811a8b21169b2b918355335 crypto/der_writer.c fea3ba4225df97aee90690adf387625b746d8edfdc5af2357ee65151a3d236ac crypto/des/des_enc.c 4971cdc016ee262d81e31f96c1617a33a63c0d90139e440c2ff32a368ee07bbd crypto/des/des_local.h @@ -119,8 +119,8 @@ eeef5722ad56bf1af2ff71681bcc8b8525bc7077e973c98cee920ce9bcc66c81 crypto/des/ecb 816472a54c273906d0a2b58650e0b9d28cc2c8023d120f0d77160f1fe34c4ca3 crypto/dh/dh_backend.c 832e5a1caf9cb0dacfd937fc59252aaac7c5c1bf0ae1a9ebf3c3af6e59dcf4c0 crypto/dh/dh_check.c 7838e9a35870b0fbcba0aff2f52a2439f64d026e9922bce6e5978c2f22c51120 crypto/dh/dh_gen.c -70f4cf3485a38cd7d22aa3e965bfe950905f8efec1622e832592a6728498fd78 crypto/dh/dh_group_params.c -7809cbfd5570db17dcb4bd8f0cf9c5f94337096d39da453d0624c08f071e809f crypto/dh/dh_kdf.c +129ee295875e68ad444070b0676f1021eb254cbd87ab22d6baaf7e4e6e59a40b crypto/dh/dh_group_params.c +a5cf5cb464b40f1bc5457dc2a6f2c5ec0f050196603cd2ba7037a23ab64adbf7 crypto/dh/dh_kdf.c 0afa7dd237f9b21b0cfb0de10505facd57eb07ded905d888d43a1de2356d4002 crypto/dh/dh_key.c b0046b2c4e1d74ff4e93f2486a00f63728909b8a75cbdd29b9100e607f97995c crypto/dh/dh_lib.c 8300775d88db0a1aa26a77eb49d6c4f7252e7fee69e1440de4c40edadc9da044 crypto/dh/dh_local.h @@ -147,7 +147,7 @@ ee897e230964511baa0d1bf95fb938312407a40a88ebe01476879c2763e5f732 crypto/ec/asm/ 063dac1e4a9573c47532123e9e03e3532a7473cc3e146521ba9ec6f486ddf3b1 crypto/ec/curve448/arch_64/arch_intrinsics.h 43423b7ee85a5c740c1d81499ee06f4a17732c7731a598e7429d5e402ee77cf4 crypto/ec/curve448/arch_64/f_impl.h 1689097ae10e4982a8cbe50c2f6eddb03c83436f331f0b67edb98d6b58adc962 crypto/ec/curve448/arch_64/f_impl64.c -b35976955a49414313e3823144a898bc58873b755f4e3a772d520cdd63099581 crypto/ec/curve448/curve448.c +9b408ec0d43f3b6d714ef5963147e2c2abaddc88633db7dd759193d3c56ed727 crypto/ec/curve448/curve448.c 3c12d90e3fdd59b5d32d63186f1a6f15c75eb73f5035b844a2054356a9459780 crypto/ec/curve448/curve448_local.h 178fb9863c33174b633c2e7607160b1bedb506d66cc06d53382d87431441f306 crypto/ec/curve448/curve448_tables.c f30e13bba5a136ab9ba5225c98b9b94c2cd73fb3aef60f9dcde3cd471cfa1ca4 crypto/ec/curve448/curve448utils.h @@ -161,13 +161,13 @@ f6447921a0031fa5beddedd298e82096fb3fdb189b712fab328b61f6beae0c23 crypto/ec/curv ae1637d89287c9d22a34bdc0d67f6e01262a2f8dcef9b61369dba8c334f5a80d crypto/ec/ec2_oct.c 6bbbf570ce31f5b579f7e03ec9f8a774663c7c1eb5e475bd31f8fee94a021ffc crypto/ec/ec2_smpl.c 2a71bd8dbe4f427c117d990581709a4ddce07fa8e530794b5a9574fef7c48a0c crypto/ec/ec_asn1.c -c07fa05c6885e59913e2ce345ff52ef9dfb0418842de3affa6163ad3e71f9c1b crypto/ec/ec_backend.c +88e19ca6b892a3afefb25dab0f9cf8796e2eb8504022dcc10b29d5d3923ce73d crypto/ec/ec_backend.c 86e2becf9b3870979e2abefa1bd318e1a31820d275e2b50e03b17fc287abb20a crypto/ec/ec_check.c 265f911b9d4aada326a2d52cd8a589b556935c8b641598dcd36c6f85d29ce655 crypto/ec/ec_curve.c 8cfd0dcfb5acbf6105691a2d5e2826dba1ff3906707bc9dd6ff9bffcc306468f crypto/ec/ec_cvt.c 28726bc957ea821639b1023e5bff0e77ced61bae31f96c165e33aadfe0bc5c9a crypto/ec/ec_key.c 7e40fc646863e0675bbb90f075b809f61bdf0600d8095c8366858d9533ab7700 crypto/ec/ec_kmeth.c -074a5345ea71ff3fdfb8e0be360391a7640719f1a8a4eae8580c8f02e57af880 crypto/ec/ec_lib.c +f520a41732e4ca96a74d047b6e8bdca8bdfdc4517c18d27410de33969646abef crypto/ec/ec_lib.c a8a4690e42b4af60aad822aa8b16196df337906af53ea4db926707f7b596ff27 crypto/ec/ec_local.h fa901b996eb0e460359cd470843bdb03af7a77a2f1136c5e1d30daef70f3e4d2 crypto/ec/ec_mult.c 129c6b42417bfcf582f4a959cfd65433e6f85b158274f4fa38f9c62615ac9166 crypto/ec/ec_oct.c @@ -178,7 +178,7 @@ b6baa42b16e8df69a12e0ab101033100cddc808ec2682ba1574373e6ec86ae93 crypto/ec/ecds f686cea8c8a3259d95c1e6142813d9da47b6d624c62f26c7e4a16d5607cddb35 crypto/ec/ecdsa_vrf.c 141cfc1459214555b623517a054a9e8d5e4065a11301237b7247be2c6f397a0a crypto/ec/ecp_mont.c 13b30f34aeeb0c98747239bfe91b5f0f14e91b2c1f11db62ebb5950c7219daa0 crypto/ec/ecp_nist.c -c016eb9412aad8cd1213a2f5b1083df1a1a9cb734dc6cc19d99e706935c81ef2 crypto/ec/ecp_nistz256.c +f288c23b6f83740956886b2303c64d5a3098c98b530859c3bb4b698c01c1643b crypto/ec/ecp_nistz256.c 51cb98e7e9c241e33261589f0d74103238baaa850e333c61ff1da360e127518a crypto/ec/ecp_oct.c b4b7c683279454ba41438f50a015cb63ef056ccb9be0168918dfbae00313dc68 crypto/ec/ecp_smpl.c 2096e13aa2fbcb0d4b10faca3e3f5359cf66098b0397a6d74c6fca14f5dee659 crypto/ec/ecx_backend.c @@ -187,10 +187,10 @@ b4b7c683279454ba41438f50a015cb63ef056ccb9be0168918dfbae00313dc68 crypto/ec/ecp_ 28abc295dad8888b5482eb61d31cd78dd80545ecb67dc6f9446a36deb8c40a5e crypto/evp/asymcipher.c 0e75a058dcbbb62cfe39fec6c4a85385dc1a8fce794e4278ce6cebb29763b82b crypto/evp/dh_support.c 7fca5ec7c5723b799a7d84d5803071b8f495511e1baf89d430e6800a5228cdad crypto/evp/digest.c -5e2c5d865029ae86855f15e162360d091f28ca0d4c67260700c90aa25faf308b crypto/evp/ec_support.c -2724dc804304135bc874bd305e14b811169a9e4a62176220a0d5e83f152c2546 crypto/evp/evp_enc.c +838277f228cd3025cf95a9cd435e5606ad1fb5d207bbb057aa29892e6a657c55 crypto/evp/ec_support.c +cfccc525e3806d0932254a94ca1a895fe086da84ae8ad2bf2972e96a12d649d2 crypto/evp/evp_enc.c 0cd2765bf33d998f96d6e8193b2bf27293bcc6a37b7bef7dfd6ec54952ad3c8f crypto/evp/evp_fetch.c -029df8bb80a2fb45c22765234b9041ffce82735108e0b11580fd3fbd805362dd crypto/evp/evp_lib.c +c9c399b7848f64832deb6e1704e957423ea93827edb4917fafbb0ff911892a2b crypto/evp/evp_lib.c 9ac3d97d756ec008db16dd1952115b551f32b2d0590d9a85e1c87d1c78620257 crypto/evp/evp_local.h e822c16fc4dc30f2c86e8598c721a9ddfe46d318ce78f4e8e883cdcf8b936221 crypto/evp/evp_rand.c 2a128617ec0178e9eeacbe41d75a5530755f41ea524cd124607543cf73456a0c crypto/evp/evp_utils.c @@ -203,24 +203,24 @@ a3164e3247e2a38f4f9a20db463779b5260e4e6639ac8eec6e960b265fc8cce5 crypto/evp/kdf e1a052839b8b70dca20dbac1282d61abd1c415bf4fb6afb56b811e8770d8a2e1 crypto/evp/m_sigver.c 5b8b0bcd4b720b66ce6bc54090ec333891126bb7f6cce4502daf2333668c3db9 crypto/evp/mac_lib.c e7e8eb5683cd3fbd409df888020dc353b65ac291361829cc4131d5bc86c9fcb3 crypto/evp/mac_meth.c -b976077a1f880768f2f0a1c996a53dfdd363605e4977c56fb37e9c1f84f35aa6 crypto/evp/p_lib.c +ee87cce7ee44b6f3121d21fd20f00d0c91c494a1a9804319981987f3d093923d crypto/evp/p_lib.c 3b4228b92eebd04616ecc3ee58684095313dd5ffd1b43cf698a7d6c202cb4622 crypto/evp/pmeth_check.c 1f0e9e94e9b0ad322956521b438b78d44cfcd8eb974e8921d05f9e21ba1c05cf crypto/evp/pmeth_gn.c -76511fba789089a50ef87774817a5482c33633a76a94ecf7b6e8eb915585575d crypto/evp/pmeth_lib.c +ef2f789091e4e3f77fea3b4643ff36d9659b18bf7a8c59929ce3305480a3baef crypto/evp/pmeth_lib.c f3a5cbbccb1078cf1fafd74c4caa9f30827081832fbe6dfa5579b17ef809776c crypto/evp/signature.c b06cb8fd4bd95aae1f66e1e145269c82169257f1a60ef0f78f80a3d4c5131fac crypto/ex_data.c 324feb067d0f8deb4334f3e6518f570114cb388c85b24f9232bd931a64ff0a9e crypto/ffc/ffc_backend.c -ead786b4f5689ab69d6cca5d49e513e0f90cb558b67e6c5898255f2671f1393d crypto/ffc/ffc_dh.c +5fe89ce2ce34848b832a2b5a7ac42c161d7ec214a641b7fb11fb1153f2186f74 crypto/ffc/ffc_dh.c 82abf1f9645336b7dff5e3fa153899280ecaa27b3dad50e6a9ba94d871961888 crypto/ffc/ffc_key_generate.c 084ae8e68a9df5785376bb961a998036336ed13092ffd1c4258b56e6a7e0478b crypto/ffc/ffc_key_validate.c -67fdf1a07ea118963a55540be2ee21c98b7a5eb8149c8caa26e19d922bf60346 crypto/ffc/ffc_params.c +ecc0d737ccece492f86262dd45f8f03eef2beacafce8022f91939a372f68ac90 crypto/ffc/ffc_params.c 5174e008f44909724e0ee7109095ee353e67e9ba77e1ab3bedfcf6eaecab7b6c crypto/ffc/ffc_params_generate.c 73dac805abab36cd9df53a421221c71d06a366a4ce479fa788be777f11b47159 crypto/ffc/ffc_params_validate.c 0a4fc92e408b0562cf95c480df93a9907a318a2c92356642903a5d50ed04fd88 crypto/hmac/hmac.c 0395c1b0834f2f4a0ca1756385f4dc1a4ef6fb925b2db3743df7f57256c5166f crypto/hmac/hmac_local.h f897493b50f4e9dd4cacb2a7accda6683c10ece602641874cdff1dac7128a751 crypto/initthread.c -f0782ee92b6ebf5a0e66b970ecfbd9c9c6fc4a35ccd055967fbb402577c234ab crypto/lhash/lhash.c -73d63f91fbaba47649231636c5afdf76d049a46436fde9fbb2e107cf16bb879e crypto/lhash/lhash_local.h +5482c47c266523129980302426d25839fda662f1544f4b684707e6b272a952c9 crypto/lhash/lhash.c +5d49ce00fc06df1b64cbc139ef45c71e0faf08a33f966bc608c82d574521a49e crypto/lhash/lhash_local.h f866aafae928db1b439ac950dc90744a2397dfe222672fe68b3798396190c8b0 crypto/mem_clr.c 183bdca6f855182d7d2c78a5c961b34283f85ea69ac828b700605ee82546397d crypto/modes/asm/aes-gcm-armv8_64.pl 1d686af304f94743038f916125effcb51790c025f3165d8d37b526bbeee781f0 crypto/modes/asm/aesni-gcm-x86_64.pl @@ -248,12 +248,12 @@ ecb4a6f28a0acdb00cb654612e26cd4c825d9f83b15d42cefc1ccd47b00f8eb0 crypto/o_str.c cc4483ec9ba7a30908e3a433a6817e2f211d4c1f69c206e6bae24bbd39a68281 crypto/param_build.c c2fe815fb3fd5efe9a6544cae55f9469063a0f6fb728361737b927f6182ae0bb crypto/param_build_set.c 02dfeb286c85567bb1b6323a53c089ba66447db97695cc78eceb6677fbc76bf9 crypto/params.c -4f2a8c9acf5898fdc1e4bf98813049947221cd9a1db04faaa490250591f54cb4 crypto/params_dup.c +4fda13f6af05d80b0ab89ec4f5813c274a21a9b4565be958a02d006236cef05c crypto/params_dup.c a0097ff2da8955fe15ba204cb54f3fd48a06f846e2b9826f507b26acf65715c3 crypto/params_from_text.c 2140778d5f35e503e22b173736e18ff84406f6657463e8ff9e7b91a78aa686d3 crypto/property/defn_cache.c 9153343b26e5c2c4f6009d37a12d6af85681ed0c7d3f58de2ace44dfd789a59b crypto/property/property.c a2c69527b60692a8b07cfdfe7e75f654daa092411d5de5e02b446a4ef3752855 crypto/property/property_local.h -c3217b73871d93d81ab9f15e9f1fc37ea609bbe4bbc0c1b84ec62a99c91f6756 crypto/property/property_parse.c +b87bfb053457cbe1cedad3a53cce044375d2f429c75d0c97c2a61def59080644 crypto/property/property_parse.c a7cefda6a117550e2c76e0f307565ce1e11640b11ba10c80e469a837fd1212a3 crypto/property/property_query.c 065698c8d88a5facc0cbc02a3bd0c642c94687a8c5dd79901c942138b406067d crypto/property/property_string.c 01d2e5be52d94efdff4329281b3609c7fa57162ab6143492c380c96952df1396 crypto/provider_core.c @@ -262,7 +262,7 @@ d0af10d4091b2032aac1b7db80f8c2e14fa7176592716b25b9437ab6b53c0a89 crypto/provide 4e6b7d1d8278067c18bcb5e3ac9b7fe7e9b1d0d03bc5a276275483f541d1a12c crypto/rand/rand_lib.c fd03b9bb2c23470fa40880ed3bf9847bb17d50592101a78c0ad7a0f121209788 crypto/rand/rand_local.h f0c8792a99132e0b9c027cfa7370f45594a115934cdc9e8f23bdd64abecaf7fd crypto/rsa/rsa_acvp_test_params.c -054f8e32eabb218d219a5fa8cb40f6e76bc5a395d03e4f83c5f2b703a5a476b9 crypto/rsa/rsa_backend.c +b89d28722134386072670ddc4d5cbff736d1649c114f38d964892f21420c13bf crypto/rsa/rsa_backend.c 38a102cd1da1f6ca5a46e6a22f018237964336274385f5c70cbedcaa6997647e crypto/rsa/rsa_chk.c e32cfa04221a2a3ea33f7bcb93ee51b84cbeba97e94c1fbf6e420b24f97fc9ce crypto/rsa/rsa_crpt.c 21794dcb6bfebcf9a14d4f8aa7fab8f745b595433b388b55f46ba6e615d90f98 crypto/rsa/rsa_gen.c @@ -328,21 +328,21 @@ f64d16c1e5c3fa4a7969de494a8372127502171a517c14be7a1e3a43a7308699 crypto/sha/asm 3d972a11be18bfbfcd45790028635d63548bfe0a2e45d2fc56b6051b759d22f0 crypto/sha/sha3.c 8038a5a97f826f519424db634be5b082b3f7eca3ccb89875ca40fa6bd7dfdcfd crypto/sha/sha512.c 6c6f0e6069ac98e407a5810b84deace2d1396d252c584703bcd154d1a015c3ea crypto/sha/sha_local.h -86913a593b55c759a3824eeede398f966278d79c148bef41986c5ac4e48f0bd7 crypto/sparse_array.c +4f6b66f811144648d6cb6bc26e08779529acbbd563519590c726d0e51699fe96 crypto/sparse_array.c b39e5ba863af36e455cc5864fe8c5d0fc05a6aaef0d528a115951d1248e8fa8b crypto/stack/stack.c 7b4efa594d8d1f3ecbf4605cf54f72fb296a3b1d951bdc69e415aaa08f34e5c8 crypto/threads_lib.c a41ae93a755e2ec89b3cb5b4932e2b508fdda92ace2e025a2650a6da0e9e972c crypto/threads_none.c -ebb210a22c280839853920bee245eb769c713ab99cb35a468ed2b1df0d112a7f crypto/threads_pthread.c +2637a8727dee790812b000f2e02b336f7907949df633dda72938bbaafdb204fe crypto/threads_pthread.c 68e1cdeb948d3a106b5a27b76bcddbae6bb053b2bdc4a21a1fec9797a00cd904 crypto/threads_win.c fd6c27cf7c6b5449b17f2b725f4203c4c10207f1973db09fd41571efe5de08fd crypto/x86_64cpuid.pl -d13560a5f8a66d7b956d54cd6bf24eade529d686992d243bfb312376a57b475e e_os.h +84c4331bbe99471706fadf97299c660dca46f663c2526f33c3424656215aa0c5 e_os.h 6f353dc7c8c4d8f24f7ffbf920668ccb224ebb5810805a7c80d96770cd858005 include/crypto/aes_platform.h 8c6f308c1ca774e6127e325c3b80511dbcdc99631f032694d8db53a5c02364ee include/crypto/asn1_dsa.h 8ce1b35c6924555ef316c7c51d6c27656869e6da7f513f45b7a7051579e3e54d include/crypto/bn.h 1c46818354d42bd1b1c4e5fdae9e019814936e775fd8c918ca49959c2a6416df include/crypto/bn_conf.h.in 7a43a4898fcc8446065e6c99249bcc14e475716e8c1d40d50408c0ab179520e6 include/crypto/bn_dh.h e69b2b20fb415e24b970941c84a62b752b5d0175bc68126e467f7cc970495504 include/crypto/cryptlib.h -5ee1ea30382bef9869f29b6610665ca304f3b9cf3653746a2d02c64b1a24f103 include/crypto/ctype.h +cf1d91147fb3f6cd02387c7fe219ff2efd8c060e9a8501d1c2245fbdb21bf7a6 include/crypto/ctype.h 89693e0a7528a9574e1d2f80644b29e3b895d3684111dd07c18cc5bed28b45b7 include/crypto/des_platform.h daf508bb7ed5783f1c8c622f0c230e179244dd3f584e1223a19ab95930fbcb4f include/crypto/dh.h 20d99c9a740e4d7d67e23fa4ae4c6a39d114e486c66ad41b65d91a8244cd1dea include/crypto/dsa.h @@ -361,7 +361,7 @@ f12bfc145290444bcc7bf408874bded348e742443c145b8b5bc70ae558d96c31 include/crypto 5bfeea62d21b7cb43d9a819c5cd2800f02ea019687a8331abf313d615889ad37 include/crypto/types.h 782a83d4e489fd865e2768a20bfa31e78c2071fd0ceeb9eb077276ae2bcc6590 include/internal/bio.h 92aacb3e49288f91b44f97e41933e88fe455706e1dd21a365683c2ab545db131 include/internal/constant_time.h -71ddae419297069056065ab71f32fe88b09ddbe4db2200a759fedd8ad4349628 include/internal/core.h +1f92626d81730616fb459849c1c7fb0ec105f2ffb0e51edaa0a64307bc1e1027 include/internal/core.h d7ddeab97434a21cb2cad1935a3cb130f6cd0b3c75322463d431c5eab3ab1ae1 include/internal/cryptlib.h 9571cfd3d5666749084b354a6d65adee443deeb5713a58c098c7b03bc69dbc63 include/internal/deprecated.h 8a2371f964cbb7fc3916583d2a4cee5c56f98595dfa30bd60c71637811a6d9da include/internal/der.h @@ -402,7 +402,7 @@ f20c3c845129a129f5e0b1dae970d86a5c96ab49f2e3f6f364734521e9e1abe3 include/openss df5e60af861665675e4a00d40d15e36884f940e3379c7b45c9f717eaf1942697 include/openssl/core.h 00110e80b9b4f621c604ea99f05e7a75d3db4721fc2779224e6fa7e52f06e345 include/openssl/core_dispatch.h cbd9d7855ca3ba4240207fc025c22bbfef7411116446ff63511e336a0559bed0 include/openssl/core_names.h -8880892256a4d2dd7a9be91f23518f71e5037dbd377cd41bdb4c1f3cb3c7ee2d include/openssl/crypto.h.in +194f96a30bdc4dab3f65693c09326ef53c54ebfd613c2513d8258a0aa35a6996 include/openssl/crypto.h.in 1d1697bd3e35920ff9eaec23c29472d727a7fc4d108150957f41f6f5ecf80f1a include/openssl/cryptoerr.h bbc82260cbcadd406091f39b9e3b5ea63146d9a4822623ead16fa12c43ab9fc6 include/openssl/cryptoerr_legacy.h fa3e6b6c2e6222424b9cd7005e3c5499a2334c831cd5d6a29256ce945be8cb1d include/openssl/des.h @@ -413,7 +413,7 @@ fa3e6b6c2e6222424b9cd7005e3c5499a2334c831cd5d6a29256ce945be8cb1d include/openss 41bf49e64e1c341a8c17778147ddeba35e88dfd7ff131db6210e801ef25a8fd5 include/openssl/e_os2.h bc9ec2be442a4f49980ba2c63c8f0da701de1f6e23d7db35d781658f833dd7b9 include/openssl/ebcdic.h 33b6321d1c6b7b1621198346946401bb81472054aa236b03c6f22f247248d2ad include/openssl/ec.h -cbbf74efc7fdb020f06840c856ad7fe97553944f4cc3c197fbb004de38158048 include/openssl/ecerr.h +dad1943d309aaadb800be4a3056096abec611d81982b83c601b482405e11d5c0 include/openssl/ecerr.h 61c76ee3f12ed0e42503a56421ca00f1cb9a0f4caa5f9c4421c374bcd45917d7 include/openssl/encoder.h 69dd983f45b8ccd551f084796519446552963a18c52b70470d978b597c81b2dc include/openssl/encodererr.h 0bb50eda4fe2600c20779d5e3c49668cf2dd8f295104549a33e57bc95a9219eb include/openssl/err.h.in @@ -448,7 +448,7 @@ c169a015d7be52b7b99dd41c418a48d97e52ad21687c39c512a83a7c3f3ddb70 include/openss 410c6eb3ffadcbee13d511d6b8ee576db75b35b324cb394b5e05dbd4a17fb92e include/openssl/trace.h 873d2ec2054ec24c52df4abe830cb2b9666fe4e75cc62b4de0f50ef9d20c5812 include/openssl/types.h c0a9551efccf43f3dd748d4fd8ec897ddaabbc629c00ec1ad76ce983e1195a13 providers/common/bio_prov.c -e7c39ef7b76668dae1470ce0edd7254da2937569762cebbf20e08fb97cb3324c providers/common/capabilities.c +4546387d6642603c81ec4cd8d5fc4af8ba60ac7359eb6f31e7d24827031e68ad providers/common/capabilities.c f94b7435d4ec888ec30df1c611afa8b9eedbb59e905a2c7cb17cfc8c4b9b85b8 providers/common/der/der_digests_gen.c.in 424d7b2ece984a0904b80c73e541400c6e2d50a285c397dd323b440a4f2a8d8e providers/common/der/der_dsa_gen.c.in 27ff361a5fbfc97cd41690ab26639708961d0507b60912f55f5919649842c6ae providers/common/der/der_dsa_key.c @@ -482,8 +482,8 @@ eec462d685dd3b4764b076a3c18ecd9dd254350a0b78ddc2f8a60587829e1ce3 providers/comm ba345b0d71f74c9e3d752579e16d11cc70b4b00faa329cc674bc43dd2620e044 providers/common/securitycheck.c 527eda471e26763a5fcf123b2d290234d5c836de7b8ef6eef2166ef439919d82 providers/common/securitycheck_fips.c abd5997bc33b681a4ab275978b92aebca0806a4a3f0c2f41dacf11b3b6f4e101 providers/fips/fips_entry.c -a4dc9bf2d77e34175737b7b8d28fbe90815ac0e2904e3ac2d9e2a271f345ef20 providers/fips/fipsprov.c -fdbaf748044ce54f13e673b92db876e32436e4d5644f443cc43d063112a89676 providers/fips/self_test.c +c458e4830c0cd31e4aabef0e33c2011079f201c6bbaee59b59cefab70eb9c7b4 providers/fips/fipsprov.c +24a2e1a855de57b9d970727fcc11ebe7e06c0d4884d3cedbacf59fa471f91e72 providers/fips/self_test.c f822a03138e8b83ccaa910b89d72f31691da6778bf6638181f993ec7ae1167e3 providers/fips/self_test.h 5b3379a3d382c4dad37841dbd58b77ed5ff712b0a37c485771b828fa9b39c351 providers/fips/self_test_data.inc 2f4f23ebc2c7ed5ef71c98ca71f06b639112a1dea04784c46af58083482c150f providers/fips/self_test_kats.c @@ -513,7 +513,7 @@ a872195161ac6c3a2cb59c3d15b212e34bb7596a41712258f5d0b5e771e25239 providers/impl c4a2499b214d7cf786dafaaee5c8c6963b3d5d1c27c144eec4b460f839074a3b providers/implementations/ciphers/cipher_aes_xts.h 281157d1da4d7285d878978e6d42d0d33b3a6bc16e3bc5b6879e39093a7d70da providers/implementations/ciphers/cipher_aes_xts_fips.c f358c4121a8a223e2c6cf009fd28b8a195520279016462890214e8858880f632 providers/implementations/ciphers/cipher_aes_xts_hw.c -f2e7404005e0602c4cc90b49b7af7453aa5b8644720ca1028d93e78bc28a7c09 providers/implementations/ciphers/cipher_cts.c +46ba8271917b53fd8fdf77aee19cc326a219c950b94e043d6d118dcac25ad7ad providers/implementations/ciphers/cipher_cts.c 74640ce402acc704af72e055fb7f27e6aa8efd417babc56f710478e571d8631c providers/implementations/ciphers/cipher_cts.h fcc3bb0637864252402aaa9d543209909df9a39611127f777b168bc888498dc0 providers/implementations/ciphers/cipher_tdes.c 77709f7fc3f7c08986cd4f0ebf2ef6e44bacb975c1483ef444b3cf5e5071f9d6 providers/implementations/ciphers/cipher_tdes.h @@ -544,31 +544,31 @@ f7017afcde9e5477b0542ca0eff31edfbd8a3488b28bfdd66db56c78c72329c6 providers/impl c95ce5498e724b9b3d58e3c2f4723e7e3e4beb07f9bea9422e43182cbadb43af providers/implementations/include/prov/macsignature.h 29d1a112b799e1f45fdf8bcee8361c2ed67428c250c1cdf408a9fbb7ebf4cce1 providers/implementations/include/prov/names.h 2187713b446d8b6d24ee986748b941ac3e24292c71e07ff9fb53a33021decdda providers/implementations/include/prov/seeding.h -432e2d5e467a50bd031a6b94b27072f5d66f4fadb6d62c9bfd9453d444c2aedf providers/implementations/kdfs/hkdf.c -06c93b62806819ee51f69c899413fda5be2435d43a70ef467b77a7296cd9528a providers/implementations/kdfs/kbkdf.c +86026710ea733f0dd44e400c43e7dab745526f2255816f48a6b00dd8b8009879 providers/implementations/kdfs/hkdf.c +a62e3af09f5af84dcf36f951ba4ac90ca1694adaf3747126186020b155f94186 providers/implementations/kdfs/kbkdf.c e0644e727aacfea4da3cf2c4d2602d7ef0626ebb760b6467432ffd54d5fbb24d providers/implementations/kdfs/pbkdf2.c c0778565abff112c0c5257329a7750ec4605e62f26cc36851fa1fbee6e03c70c providers/implementations/kdfs/pbkdf2.h abe2b0f3711eaa34846e155cffc9242e4051c45de896f747afd5ac9d87f637dc providers/implementations/kdfs/pbkdf2_fips.c -66d30c754c1e16d97a8e989f7f2e89eab59ec40ca3731dea664ba56ec38c4002 providers/implementations/kdfs/sshkdf.c +9cc42a4b0a8089e6d1be64637dbb9e41bd21ae5e3386022a27a8f29308ad25c9 providers/implementations/kdfs/sshkdf.c 7c692170729ab1d648564abdbf9bcbba5071f9a81a25fab9eae66899316bcd4a providers/implementations/kdfs/sskdf.c -3c46ec0e14be09a133d709c3a1c3d5ab05a4f1ed5385c3e7a1afb2f0ee47ef7a providers/implementations/kdfs/tls1_prf.c +7d258a469fac4d5ae99c785bae5f490044c593ed13a02a861b1d33339ee167e0 providers/implementations/kdfs/tls1_prf.c 27bb6ee5e2d00c545635c0c29402b10e74a1831adbc9800c159cbe04f2bfa2f7 providers/implementations/kdfs/x942kdf.c -f419a9f6b17cfba1543a3690326188ac8335db66807c58de211a3d69e18f7d4d providers/implementations/kem/rsa_kem.c +6b6c776b12664164f3cb54c21df61e1c4477c7855d89431a16fb338cdae58d43 providers/implementations/kem/rsa_kem.c 7628cfd7c88f37faa557c671a78ff56266691d64075104a514a28cb6fb9a6816 providers/implementations/keymgmt/dh_kmgmt.c -68d5cad49334ad0ee6948329b3784bb43eede84c3bc59ff22cbbe7aed9292672 providers/implementations/keymgmt/dsa_kmgmt.c -3e2798d299d6571c973fc75468e2ac025b7c893ae2f15f14e057430325622a69 providers/implementations/keymgmt/ec_kmgmt.c +9dc19fb4e9775e93b233fa93212e60f0959faa61248f853db75f3281e2535e95 providers/implementations/keymgmt/dsa_kmgmt.c +c68b2331f2863d0d92725367c16a6a68b1243c672c14dde13768ed4afd9c7418 providers/implementations/keymgmt/ec_kmgmt.c 258ae17bb2dd87ed1511a8eb3fe99eed9b77f5c2f757215ff6b3d0e8791fc251 providers/implementations/keymgmt/ec_kmgmt_imexport.inc -8871260c1b05832efa8363e5546210004da1683fee74da6c749ebba802b40f2b providers/implementations/keymgmt/ecx_kmgmt.c +d77ece2494e6b12a6201a2806ee5fb24a6dc2fa3e1891a46012a870e0b781ab1 providers/implementations/keymgmt/ecx_kmgmt.c 053a2be39a87f50b877ebdbbf799cf5faf8b2de33b04311d819d212ee1ea329b providers/implementations/keymgmt/kdf_legacy_kmgmt.c -260c560930c5aca61225a40ed49dfbb905f2b1fa50728d1388e946358f9d5e18 providers/implementations/keymgmt/mac_legacy_kmgmt.c +e30357311e4a3e1c78266af6315fd1fc99584bfb09f4a7cd0ddc7261cf1e17e1 providers/implementations/keymgmt/mac_legacy_kmgmt.c d469be20a6d1a3744c1a2d5c26cb3b8ff6339a2242d4ef6e5ed9531551f717c1 providers/implementations/keymgmt/rsa_kmgmt.c -79da66d4b696388d7eab6b2126bccc88908915813d79c4305b8b4d545a500469 providers/implementations/macs/cmac_prov.c -41464d1e640434bb3ff9998f093829d5e2c1963d68033dca7d31e5ab75365fb1 providers/implementations/macs/gmac_prov.c -282c1065f18c87073529ed1bdc2c0b3a1967701728084de6632ddc72c671d209 providers/implementations/macs/hmac_prov.c +aeb42590728ca87b916b8a3d337351b1c82ee0747213e5ce740c2350b3db7185 providers/implementations/macs/cmac_prov.c +93fa712c692bd5c93d3802b2554d5df33ea9d0b8987f9c92aa88358089a4bdfa providers/implementations/macs/gmac_prov.c +400a054d449cdee1f308644f1314bdc044fd0fdf793ae58ffa4e4aac6c0498d3 providers/implementations/macs/hmac_prov.c aa7ba1d39ea4e3347294eb50b4dfcb895ef1a22bd6117d3b076a74e9ff11c242 providers/implementations/macs/kmac_prov.c bf30274dd6b528ae913984775bd8f29c6c48c0ef06d464d0f738217727b7aa5c providers/implementations/rands/crngt.c c7236e6e2e8adce14f8206da0ceef63c7974d4ba1a7dd71b94fa100cac6b46ba providers/implementations/rands/drbg.c -b1e7a0b2610aaab5800af7ede0df13a184f4a321a4084652cdb509357c55783b providers/implementations/rands/drbg_ctr.c +bb5f8161a80d0d1a7ee919af2b167972b00afd62e326252ca6aa93101f315f19 providers/implementations/rands/drbg_ctr.c a05adc3f6d9d6f948e5ead75f0522ed3164cb5b2d301169242f3cb97c4a7fac3 providers/implementations/rands/drbg_hash.c 0876dfae991028c569631938946e458e6829cacf4cfb673d2b144ae50a3160bb providers/implementations/rands/drbg_hmac.c fc43558964bdf12442d3f6ab6cc3e6849f7adb42f4d0123a1279819befcf71cb providers/implementations/rands/drbg_local.h @@ -577,6 +577,6 @@ cafb9e6f54ad15889fcebddac6df61336bff7d78936f7de3bb5aab8aee5728d2 providers/impl a30dc6308de0ca33406e7ce909f3bcf7580fb84d863b0976b275839f866258df providers/implementations/signature/ecdsa_sig.c b057870cf8be1fd28834670fb092f0e6f202424c7ae19282fe9df4e52c9ce036 providers/implementations/signature/eddsa_sig.c 3bb0f342b4cc1b4594ed0986adc47791c0a7b5c1ae7b1888c1fb5edb268a78d9 providers/implementations/signature/mac_legacy_sig.c -cee0e3304cc365ef76b422363ef12affc4d03670fd2ab2c8f3babc38f9d5db37 providers/implementations/signature/rsa_sig.c +2334c8bba705032b8c1db5dd28e024a45a73b72cae82a2d815fe855445a49d10 providers/implementations/signature/rsa_sig.c c8df17850314b145ca83d4037207d6bf0994f9c34e6e55116860cf575df58e81 ssl/record/tls_pad.c 3f2e01a98d9e3fda6cc5cb4b44dd43f6cae4ec34994e8f734d11b1e643e58636 ssl/s3_cbc.c diff --git a/deps/openssl/openssl/providers/fips.checksum b/deps/openssl/openssl/providers/fips.checksum index 6b70dc01a59..3290849639c 100644 --- a/deps/openssl/openssl/providers/fips.checksum +++ b/deps/openssl/openssl/providers/fips.checksum @@ -1 +1 @@ -0223646a9f0ba5ca3bd4dc320fe5a647c8b4d48cc1e273b09acceeabc035c19e providers/fips-sources.checksums +d0e2cb7b2818aed1f4d89da6323f20372c8834c3f57f9dfd1c5e9f908d7e420a providers/fips-sources.checksums diff --git a/deps/openssl/openssl/providers/fips/fipsprov.c b/deps/openssl/openssl/providers/fips/fipsprov.c index f4605dcd6ce..9fbd5c8cb9d 100644 --- a/deps/openssl/openssl/providers/fips/fipsprov.c +++ b/deps/openssl/openssl/providers/fips/fipsprov.c @@ -1,5 +1,5 @@ /* - * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -22,6 +22,7 @@ #include "prov/provider_util.h" #include "prov/seeding.h" #include "self_test.h" +#include "internal/core.h" static const char FIPS_DEFAULT_PROPERTIES[] = "provider=fips,fips=yes"; static const char FIPS_UNAPPROVED_PROPERTIES[] = "provider=fips,fips=no"; @@ -35,6 +36,22 @@ static OSSL_FUNC_provider_gettable_params_fn fips_gettable_params; static OSSL_FUNC_provider_get_params_fn fips_get_params; static OSSL_FUNC_provider_query_operation_fn fips_query; +/* Locale object accessor functions */ +#ifdef OPENSSL_SYS_MACOSX +# include <xlocale.h> +#else +# include <locale.h> +#endif + +#if defined OPENSSL_SYS_WINDOWS +# define locale_t _locale_t +# define freelocale _free_locale +#endif +static locale_t loc; + +static int fips_init_casecmp(void); +static void fips_deinit_casecmp(void); + #define ALGC(NAMES, FUNC, CHECK) { { NAMES, FIPS_DEFAULT_PROPERTIES, FUNC }, CHECK } #define ALG(NAMES, FUNC) ALGC(NAMES, FUNC, NULL) @@ -486,6 +503,23 @@ static const OSSL_ALGORITHM *fips_query(void *provctx, int operation_id, return NULL; } +void *ossl_c_locale() { + return (void *)loc; +} + +static int fips_init_casecmp(void) { +# ifdef OPENSSL_SYS_WINDOWS + loc = _create_locale(LC_COLLATE, "C"); +# else + loc = newlocale(LC_COLLATE_MASK, "C", (locale_t) 0); +# endif + return (loc == (locale_t) 0) ? 0 : 1; +} + +static void fips_deinit_casecmp(void) { + freelocale(loc); +} + static void fips_teardown(void *provctx) { OSSL_LIB_CTX_free(PROV_LIBCTX_OF(provctx)); @@ -498,6 +532,7 @@ static void fips_intern_teardown(void *provctx) * We know that the library context is the same as for the outer provider, * so no need to destroy it here. */ + fips_deinit_casecmp(); ossl_prov_ctx_free(provctx); } @@ -547,6 +582,8 @@ int OSSL_provider_init_int(const OSSL_CORE_HANDLE *handle, memset(&selftest_params, 0, sizeof(selftest_params)); + if (!fips_init_casecmp()) + return 0; if (!ossl_prov_seeding_from_dispatch(in)) return 0; for (; in->function_id != 0; in++) { diff --git a/deps/openssl/openssl/providers/fips/self_test.c b/deps/openssl/openssl/providers/fips/self_test.c index e236bd421a7..346d7eff66d 100644 --- a/deps/openssl/openssl/providers/fips/self_test.c +++ b/deps/openssl/openssl/providers/fips/self_test.c @@ -1,5 +1,5 @@ /* - * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -103,6 +103,13 @@ BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) } return TRUE; } + +#elif defined(__GNUC__) +# undef DEP_INIT_ATTRIBUTE +# undef DEP_FINI_ATTRIBUTE +# define DEP_INIT_ATTRIBUTE static __attribute__((constructor)) +# define DEP_FINI_ATTRIBUTE static __attribute__((destructor)) + #elif defined(__sun) # pragma init(init) # pragma fini(cleanup) @@ -125,12 +132,6 @@ void _cleanup(void) # pragma init "init" # pragma fini "cleanup" -#elif defined(__GNUC__) -# undef DEP_INIT_ATTRIBUTE -# undef DEP_FINI_ATTRIBUTE -# define DEP_INIT_ATTRIBUTE static __attribute__((constructor)) -# define DEP_FINI_ATTRIBUTE static __attribute__((destructor)) - #elif defined(__TANDEM) /* Method automatically called by the NonStop OS when the DLL loads */ void __INIT__init(void) { diff --git a/deps/openssl/openssl/providers/implementations/ciphers/cipher_cts.c b/deps/openssl/openssl/providers/implementations/ciphers/cipher_cts.c index cb3372c646a..6a596508da6 100644 --- a/deps/openssl/openssl/providers/implementations/ciphers/cipher_cts.c +++ b/deps/openssl/openssl/providers/implementations/ciphers/cipher_cts.c @@ -1,5 +1,5 @@ /* - * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -46,7 +46,6 @@ * Otherwise it is the same as CS2. */ -#include "e_os.h" /* strcasecmp */ #include <openssl/core_names.h> #include "prov/ciphercommon.h" #include "internal/nelem.h" @@ -92,7 +91,7 @@ int ossl_cipher_cbc_cts_mode_name2id(const char *name) size_t i; for (i = 0; i < OSSL_NELEM(cts_modes); ++i) { - if (strcasecmp(name, cts_modes[i].name) == 0) + if (OPENSSL_strcasecmp(name, cts_modes[i].name) == 0) return (int)cts_modes[i].id; } return -1; diff --git a/deps/openssl/openssl/providers/implementations/ciphers/cipher_rc4_hmac_md5.c b/deps/openssl/openssl/providers/implementations/ciphers/cipher_rc4_hmac_md5.c index b915122a399..c46c6eab63e 100644 --- a/deps/openssl/openssl/providers/implementations/ciphers/cipher_rc4_hmac_md5.c +++ b/deps/openssl/openssl/providers/implementations/ciphers/cipher_rc4_hmac_md5.c @@ -1,5 +1,5 @@ /* - * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -183,7 +183,7 @@ static int rc4_hmac_md5_set_ctx_params(void *vctx, const OSSL_PARAM params[]) } ctx->tls_aad_pad_sz = sz; } - p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TLS1_AAD); + p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_MAC_KEY); if (p != NULL) { if (p->data_type != OSSL_PARAM_OCTET_STRING) { ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER); diff --git a/deps/openssl/openssl/providers/implementations/kdfs/hkdf.c b/deps/openssl/openssl/providers/implementations/kdfs/hkdf.c index 667d5e9619f..afdb7138e13 100644 --- a/deps/openssl/openssl/providers/implementations/kdfs/hkdf.c +++ b/deps/openssl/openssl/providers/implementations/kdfs/hkdf.c @@ -1,5 +1,5 @@ /* - * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -199,11 +199,11 @@ static int hkdf_common_set_ctx_params(KDF_HKDF *ctx, const OSSL_PARAM params[]) if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_MODE)) != NULL) { if (p->data_type == OSSL_PARAM_UTF8_STRING) { - if (strcasecmp(p->data, "EXTRACT_AND_EXPAND") == 0) { + if (OPENSSL_strcasecmp(p->data, "EXTRACT_AND_EXPAND") == 0) { ctx->mode = EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND; - } else if (strcasecmp(p->data, "EXTRACT_ONLY") == 0) { + } else if (OPENSSL_strcasecmp(p->data, "EXTRACT_ONLY") == 0) { ctx->mode = EVP_KDF_HKDF_MODE_EXTRACT_ONLY; - } else if (strcasecmp(p->data, "EXPAND_ONLY") == 0) { + } else if (OPENSSL_strcasecmp(p->data, "EXPAND_ONLY") == 0) { ctx->mode = EVP_KDF_HKDF_MODE_EXPAND_ONLY; } else { ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MODE); diff --git a/deps/openssl/openssl/providers/implementations/kdfs/kbkdf.c b/deps/openssl/openssl/providers/implementations/kdfs/kbkdf.c index 5f30b037d94..a542f84dfa5 100644 --- a/deps/openssl/openssl/providers/implementations/kdfs/kbkdf.c +++ b/deps/openssl/openssl/providers/implementations/kdfs/kbkdf.c @@ -1,5 +1,5 @@ /* - * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved. * Copyright 2019 Red Hat, Inc. * * Licensed under the Apache License 2.0 (the "License"). You may not use @@ -298,10 +298,11 @@ static int kbkdf_set_ctx_params(void *vctx, const OSSL_PARAM params[]) } p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_MODE); - if (p != NULL && strncasecmp("counter", p->data, p->data_size) == 0) { + if (p != NULL + && OPENSSL_strncasecmp("counter", p->data, p->data_size) == 0) { ctx->mode = COUNTER; } else if (p != NULL - && strncasecmp("feedback", p->data, p->data_size) == 0) { + && OPENSSL_strncasecmp("feedback", p->data, p->data_size) == 0) { ctx->mode = FEEDBACK; } else if (p != NULL) { ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MODE); diff --git a/deps/openssl/openssl/providers/implementations/kdfs/sshkdf.c b/deps/openssl/openssl/providers/implementations/kdfs/sshkdf.c index be23c2143d3..c592ba72f1e 100644 --- a/deps/openssl/openssl/providers/implementations/kdfs/sshkdf.c +++ b/deps/openssl/openssl/providers/implementations/kdfs/sshkdf.c @@ -1,5 +1,5 @@ /* - * Copyright 2018-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2018-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -59,7 +59,8 @@ static void *kdf_sshkdf_new(void *provctx) if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) == NULL) ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE); - ctx->provctx = provctx; + else + ctx->provctx = provctx; return ctx; } diff --git a/deps/openssl/openssl/providers/implementations/kdfs/tls1_prf.c b/deps/openssl/openssl/providers/implementations/kdfs/tls1_prf.c index 74a0f7e1f3e..19c5ad3d3ec 100644 --- a/deps/openssl/openssl/providers/implementations/kdfs/tls1_prf.c +++ b/deps/openssl/openssl/providers/implementations/kdfs/tls1_prf.c @@ -1,5 +1,5 @@ /* - * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -172,7 +172,7 @@ static int kdf_tls1_prf_set_ctx_params(void *vctx, const OSSL_PARAM params[]) return 1; if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_DIGEST)) != NULL) { - if (strcasecmp(p->data, SN_md5_sha1) == 0) { + if (OPENSSL_strcasecmp(p->data, SN_md5_sha1) == 0) { if (!ossl_prov_macctx_load_from_params(&ctx->P_hash, params, OSSL_MAC_NAME_HMAC, NULL, SN_md5, libctx) diff --git a/deps/openssl/openssl/providers/implementations/kem/rsa_kem.c b/deps/openssl/openssl/providers/implementations/kem/rsa_kem.c index 313ab133b33..882cf161258 100644 --- a/deps/openssl/openssl/providers/implementations/kem/rsa_kem.c +++ b/deps/openssl/openssl/providers/implementations/kem/rsa_kem.c @@ -1,5 +1,5 @@ /* - * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -12,8 +12,8 @@ * internal use. */ #include "internal/deprecated.h" +#include "internal/nelem.h" -#include "e_os.h" /* strcasecmp */ #include <openssl/crypto.h> #include <openssl/evp.h> #include <openssl/core_dispatch.h> @@ -69,7 +69,7 @@ static int name2id(const char *name, const OSSL_ITEM *map, size_t sz) return -1; for (i = 0; i < sz; ++i) { - if (strcasecmp(map[i].ptr, name) == 0) + if (OPENSSL_strcasecmp(map[i].ptr, name) == 0) return map[i].id; } return -1; diff --git a/deps/openssl/openssl/providers/implementations/keymgmt/dsa_kmgmt.c b/deps/openssl/openssl/providers/implementations/keymgmt/dsa_kmgmt.c index 885bd62eeaa..2ab69f5f32f 100644 --- a/deps/openssl/openssl/providers/implementations/keymgmt/dsa_kmgmt.c +++ b/deps/openssl/openssl/providers/implementations/keymgmt/dsa_kmgmt.c @@ -13,7 +13,6 @@ */ #include "internal/deprecated.h" -#include "e_os.h" /* strcasecmp */ #include <openssl/core_dispatch.h> #include <openssl/core_names.h> #include <openssl/bn.h> @@ -90,7 +89,7 @@ static int dsa_gen_type_name2id(const char *name) size_t i; for (i = 0; i < OSSL_NELEM(dsatype2id); ++i) { - if (strcasecmp(dsatype2id[i].name, name) == 0) + if (OPENSSL_strcasecmp(dsatype2id[i].name, name) == 0) return dsatype2id[i].id; } return -1; diff --git a/deps/openssl/openssl/providers/implementations/keymgmt/ec_kmgmt.c b/deps/openssl/openssl/providers/implementations/keymgmt/ec_kmgmt.c index 15b4532cd71..44cb7c7140b 100644 --- a/deps/openssl/openssl/providers/implementations/keymgmt/ec_kmgmt.c +++ b/deps/openssl/openssl/providers/implementations/keymgmt/ec_kmgmt.c @@ -1,5 +1,5 @@ /* - * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -13,7 +13,6 @@ */ #include "internal/deprecated.h" -#include "e_os.h" /* strcasecmp */ #include <string.h> #include <openssl/core_dispatch.h> #include <openssl/core_names.h> @@ -470,9 +469,6 @@ int ec_export(void *keydata, int selection, OSSL_CALLBACK *param_cb, if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0 && (selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) == 0) return 0; - if ((selection & OSSL_KEYMGMT_SELECT_OTHER_PARAMETERS) != 0 - && (selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == 0) - return 0; tmpl = OSSL_PARAM_BLD_new(); if (tmpl == NULL) diff --git a/deps/openssl/openssl/providers/implementations/keymgmt/ecx_kmgmt.c b/deps/openssl/openssl/providers/implementations/keymgmt/ecx_kmgmt.c index 99d685735e2..2a7f867aa56 100644 --- a/deps/openssl/openssl/providers/implementations/keymgmt/ecx_kmgmt.c +++ b/deps/openssl/openssl/providers/implementations/keymgmt/ecx_kmgmt.c @@ -9,8 +9,6 @@ #include <assert.h> #include <string.h> -/* For strcasecmp on Windows */ -#include "e_os.h" #include <openssl/core_dispatch.h> #include <openssl/core_names.h> #include <openssl/params.h> @@ -546,7 +544,7 @@ static int ecx_gen_set_params(void *genctx, const OSSL_PARAM params[]) } if (p->data_type != OSSL_PARAM_UTF8_STRING || groupname == NULL - || strcasecmp(p->data, groupname) != 0) { + || OPENSSL_strcasecmp(p->data, groupname) != 0) { ERR_raise(ERR_LIB_PROV, ERR_R_PASSED_INVALID_ARGUMENT); return 0; } diff --git a/deps/openssl/openssl/providers/implementations/keymgmt/mac_legacy_kmgmt.c b/deps/openssl/openssl/providers/implementations/keymgmt/mac_legacy_kmgmt.c index ec34a3ee713..c934ff16409 100644 --- a/deps/openssl/openssl/providers/implementations/keymgmt/mac_legacy_kmgmt.c +++ b/deps/openssl/openssl/providers/implementations/keymgmt/mac_legacy_kmgmt.c @@ -1,5 +1,5 @@ /* - * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -26,7 +26,6 @@ #include "prov/providercommon.h" #include "prov/provider_ctx.h" #include "prov/macsignature.h" -#include "e_os.h" /* strcasecmp */ static OSSL_FUNC_keymgmt_new_fn mac_new; static OSSL_FUNC_keymgmt_free_fn mac_free; diff --git a/deps/openssl/openssl/providers/implementations/macs/cmac_prov.c b/deps/openssl/openssl/providers/implementations/macs/cmac_prov.c index b44f13b5fae..96da429e844 100644 --- a/deps/openssl/openssl/providers/implementations/macs/cmac_prov.c +++ b/deps/openssl/openssl/providers/implementations/macs/cmac_prov.c @@ -1,5 +1,5 @@ /* - * Copyright 2018-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2018-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -122,7 +122,8 @@ static int cmac_init(void *vmacctx, const unsigned char *key, return 0; if (key != NULL) return cmac_setkey(macctx, key, keylen); - return 1; + /* Reinitialize the CMAC context */ + return CMAC_Init(macctx->ctx, NULL, 0, NULL, NULL); } static int cmac_update(void *vmacctx, const unsigned char *data, diff --git a/deps/openssl/openssl/providers/implementations/macs/gmac_prov.c b/deps/openssl/openssl/providers/implementations/macs/gmac_prov.c index 89904fc89d4..ad189d9c146 100644 --- a/deps/openssl/openssl/providers/implementations/macs/gmac_prov.c +++ b/deps/openssl/openssl/providers/implementations/macs/gmac_prov.c @@ -1,5 +1,5 @@ /* - * Copyright 2018-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2018-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -120,7 +120,7 @@ static int gmac_init(void *vmacctx, const unsigned char *key, return 0; if (key != NULL) return gmac_setkey(macctx, key, keylen); - return 1; + return EVP_EncryptInit_ex(macctx->ctx, NULL, NULL, NULL, NULL); } static int gmac_update(void *vmacctx, const unsigned char *data, @@ -209,19 +209,22 @@ static int gmac_set_ctx_params(void *vmacctx, const OSSL_PARAM params[]) if (params == NULL) return 1; - if (ctx == NULL - || !ossl_prov_cipher_load_from_params(&macctx->cipher, params, provctx)) + if (ctx == NULL) return 0; - if (EVP_CIPHER_get_mode(ossl_prov_cipher_cipher(&macctx->cipher)) - != EVP_CIPH_GCM_MODE) { - ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MODE); - return 0; + if ((p = OSSL_PARAM_locate_const(params, OSSL_MAC_PARAM_CIPHER)) != NULL) { + if (!ossl_prov_cipher_load_from_params(&macctx->cipher, params, provctx)) + return 0; + if (EVP_CIPHER_get_mode(ossl_prov_cipher_cipher(&macctx->cipher)) + != EVP_CIPH_GCM_MODE) { + ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MODE); + return 0; + } + if (!EVP_EncryptInit_ex(ctx, ossl_prov_cipher_cipher(&macctx->cipher), + ossl_prov_cipher_engine(&macctx->cipher), NULL, + NULL)) + return 0; } - if (!EVP_EncryptInit_ex(ctx, ossl_prov_cipher_cipher(&macctx->cipher), - ossl_prov_cipher_engine(&macctx->cipher), NULL, - NULL)) - return 0; if ((p = OSSL_PARAM_locate_const(params, OSSL_MAC_PARAM_KEY)) != NULL) if (p->data_type != OSSL_PARAM_OCTET_STRING diff --git a/deps/openssl/openssl/providers/implementations/macs/hmac_prov.c b/deps/openssl/openssl/providers/implementations/macs/hmac_prov.c index 78c4924a38c..2d6087b2c65 100644 --- a/deps/openssl/openssl/providers/implementations/macs/hmac_prov.c +++ b/deps/openssl/openssl/providers/implementations/macs/hmac_prov.c @@ -1,5 +1,5 @@ /* - * Copyright 2018-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2018-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -152,7 +152,7 @@ static int hmac_setkey(struct hmac_data_st *macctx, { const EVP_MD *digest; - if (macctx->keylen > 0) + if (macctx->key != NULL) OPENSSL_secure_clear_free(macctx->key, macctx->keylen); /* Keep a copy of the key in case we need it for TLS HMAC */ macctx->key = OPENSSL_secure_malloc(keylen > 0 ? keylen : 1); @@ -177,9 +177,11 @@ static int hmac_init(void *vmacctx, const unsigned char *key, if (!ossl_prov_is_running() || !hmac_set_ctx_params(macctx, params)) return 0; - if (key != NULL && !hmac_setkey(macctx, key, keylen)) - return 0; - return 1; + if (key != NULL) + return hmac_setkey(macctx, key, keylen); + + /* Just reinit the HMAC context */ + return HMAC_Init_ex(macctx->ctx, NULL, 0, NULL, NULL); } static int hmac_update(void *vmacctx, const unsigned char *data, @@ -325,22 +327,10 @@ static int hmac_set_ctx_params(void *vmacctx, const OSSL_PARAM params[]) if ((p = OSSL_PARAM_locate_const(params, OSSL_MAC_PARAM_KEY)) != NULL) { if (p->data_type != OSSL_PARAM_OCTET_STRING) return 0; - - if (macctx->keylen > 0) - OPENSSL_secure_clear_free(macctx->key, macctx->keylen); - /* Keep a copy of the key if we need it for TLS HMAC */ - macctx->key = OPENSSL_secure_malloc(p->data_size > 0 ? p->data_size : 1); - if (macctx->key == NULL) - return 0; - memcpy(macctx->key, p->data, p->data_size); - macctx->keylen = p->data_size; - - if (!HMAC_Init_ex(macctx->ctx, p->data, p->data_size, - ossl_prov_digest_md(&macctx->digest), - NULL /* ENGINE */)) + if (!hmac_setkey(macctx, p->data, p->data_size)) return 0; - } + if ((p = OSSL_PARAM_locate_const(params, OSSL_MAC_PARAM_TLS_DATA_SIZE)) != NULL) { if (!OSSL_PARAM_get_size_t(p, &macctx->tls_data_size)) diff --git a/deps/openssl/openssl/providers/implementations/macs/poly1305_prov.c b/deps/openssl/openssl/providers/implementations/macs/poly1305_prov.c index 5a099265518..f922802ea79 100644 --- a/deps/openssl/openssl/providers/implementations/macs/poly1305_prov.c +++ b/deps/openssl/openssl/providers/implementations/macs/poly1305_prov.c @@ -1,5 +1,5 @@ /* - * Copyright 2018-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2018-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -37,6 +37,7 @@ static OSSL_FUNC_mac_final_fn poly1305_final; struct poly1305_data_st { void *provctx; + int updated; POLY1305 poly1305; /* Poly1305 data */ }; @@ -64,11 +65,11 @@ static void *poly1305_dup(void *vsrc) if (!ossl_prov_is_running()) return NULL; - dst = poly1305_new(src->provctx); + dst = OPENSSL_malloc(sizeof(*dst)); if (dst == NULL) return NULL; - dst->poly1305 = src->poly1305; + *dst = *src; return dst; } @@ -85,6 +86,7 @@ static int poly1305_setkey(struct poly1305_data_st *ctx, return 0; } Poly1305_Init(&ctx->poly1305, key); + ctx->updated = 0; return 1; } @@ -98,7 +100,8 @@ static int poly1305_init(void *vmacctx, const unsigned char *key, return 0; if (key != NULL) return poly1305_setkey(ctx, key, keylen); - return 1; + /* no reinitialization of context with the same key is allowed */ + return ctx->updated == 0; } static int poly1305_update(void *vmacctx, const unsigned char *data, @@ -106,6 +109,7 @@ static int poly1305_update(void *vmacctx, const unsigned char *data, { struct poly1305_data_st *ctx = vmacctx; + ctx->updated = 1; if (datalen == 0) return 1; @@ -121,6 +125,7 @@ static int poly1305_final(void *vmacctx, unsigned char *out, size_t *outl, if (!ossl_prov_is_running()) return 0; + ctx->updated = 1; Poly1305_Final(&ctx->poly1305, out); *outl = poly1305_size(); return 1; diff --git a/deps/openssl/openssl/providers/implementations/macs/siphash_prov.c b/deps/openssl/openssl/providers/implementations/macs/siphash_prov.c index 0c374bd8619..a28cdb33ac2 100644 --- a/deps/openssl/openssl/providers/implementations/macs/siphash_prov.c +++ b/deps/openssl/openssl/providers/implementations/macs/siphash_prov.c @@ -1,5 +1,5 @@ /* - * Copyright 2018-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2018-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -39,6 +39,7 @@ static OSSL_FUNC_mac_final_fn siphash_final; struct siphash_data_st { void *provctx; SIPHASH siphash; /* Siphash data */ + SIPHASH sipcopy; /* Siphash data copy for reinitialization */ unsigned int crounds, drounds; }; @@ -76,11 +77,11 @@ static void *siphash_dup(void *vsrc) if (!ossl_prov_is_running()) return NULL; - sdst = siphash_new(ssrc->provctx); + sdst = OPENSSL_malloc(sizeof(*sdst)); if (sdst == NULL) return NULL; - sdst->siphash = ssrc->siphash; + *sdst = *ssrc; return sdst; } @@ -94,9 +95,14 @@ static size_t siphash_size(void *vmacctx) static int siphash_setkey(struct siphash_data_st *ctx, const unsigned char *key, size_t keylen) { + int ret; + if (keylen != SIPHASH_KEY_SIZE) return 0; - return SipHash_Init(&ctx->siphash, key, crounds(ctx), drounds(ctx)); + ret = SipHash_Init(&ctx->siphash, key, crounds(ctx), drounds(ctx)); + if (ret) + ctx->sipcopy = ctx->siphash; + return ret; } static int siphash_init(void *vmacctx, const unsigned char *key, size_t keylen, @@ -106,11 +112,14 @@ static int siphash_init(void *vmacctx, const unsigned char *key, size_t keylen, if (!ossl_prov_is_running() || !siphash_set_params(ctx, params)) return 0; - /* Without a key, there is not much to do here, + /* + * Without a key, there is not much to do here, * The actual initialization happens through controls. */ - if (key == NULL) + if (key == NULL) { + ctx->siphash = ctx->sipcopy; return 1; + } return siphash_setkey(ctx, key, keylen); } @@ -194,7 +203,8 @@ static int siphash_set_params(void *vmacctx, const OSSL_PARAM *params) if ((p = OSSL_PARAM_locate_const(params, OSSL_MAC_PARAM_SIZE)) != NULL) { if (!OSSL_PARAM_get_size_t(p, &size) - || !SipHash_set_hash_size(&ctx->siphash, size)) + || !SipHash_set_hash_size(&ctx->siphash, size) + || !SipHash_set_hash_size(&ctx->sipcopy, size)) return 0; } if ((p = OSSL_PARAM_locate_const(params, OSSL_MAC_PARAM_C_ROUNDS)) != NULL diff --git a/deps/openssl/openssl/providers/implementations/rands/drbg_ctr.c b/deps/openssl/openssl/providers/implementations/rands/drbg_ctr.c index dbe57b0d289..451113c4d16 100644 --- a/deps/openssl/openssl/providers/implementations/rands/drbg_ctr.c +++ b/deps/openssl/openssl/providers/implementations/rands/drbg_ctr.c @@ -1,5 +1,5 @@ /* - * Copyright 2011-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2011-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -14,7 +14,6 @@ #include <openssl/rand.h> #include <openssl/aes.h> #include <openssl/proverr.h> -#include "e_os.h" /* strcasecmp */ #include "crypto/modes.h" #include "internal/thread_once.h" #include "prov/implementations.h" @@ -690,7 +689,7 @@ static int drbg_ctr_set_ctx_params(void *vctx, const OSSL_PARAM params[]) if (p->data_type != OSSL_PARAM_UTF8_STRING || p->data_size < ctr_str_len) return 0; - if (strcasecmp("CTR", base + p->data_size - ctr_str_len) != 0) { + if (OPENSSL_strcasecmp("CTR", base + p->data_size - ctr_str_len) != 0) { ERR_raise(ERR_LIB_PROV, PROV_R_REQUIRE_CTR_MODE_CIPHER); return 0; } diff --git a/deps/openssl/openssl/providers/implementations/signature/rsa_sig.c b/deps/openssl/openssl/providers/implementations/signature/rsa_sig.c index 325e855333e..7023a866131 100644 --- a/deps/openssl/openssl/providers/implementations/signature/rsa_sig.c +++ b/deps/openssl/openssl/providers/implementations/signature/rsa_sig.c @@ -1,5 +1,5 @@ /* - * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -13,7 +13,6 @@ */ #include "internal/deprecated.h" -#include "e_os.h" /* strcasecmp */ #include <string.h> #include <openssl/crypto.h> #include <openssl/core_dispatch.h> @@ -854,7 +853,7 @@ static int rsa_digest_signverify_init(void *vprsactx, const char *mdname, if (mdname != NULL /* was rsa_setup_md already called in rsa_signverify_init()? */ - && (mdname[0] == '\0' || strcasecmp(prsactx->mdname, mdname) != 0) + && (mdname[0] == '\0' || OPENSSL_strcasecmp(prsactx->mdname, mdname) != 0) && !rsa_setup_md(prsactx, mdname, prsactx->propq)) return 0; diff --git a/deps/openssl/openssl/providers/implementations/signature/sm2_sig.c b/deps/openssl/openssl/providers/implementations/signature/sm2_sig.c index 3c700ac8871..fffb280c776 100644 --- a/deps/openssl/openssl/providers/implementations/signature/sm2_sig.c +++ b/deps/openssl/openssl/providers/implementations/signature/sm2_sig.c @@ -1,5 +1,5 @@ /* - * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -430,7 +430,7 @@ static int sm2sig_set_ctx_params(void *vpsm2ctx, const OSSL_PARAM params[]) p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_DIST_ID); if (p != NULL) { void *tmp_id = NULL; - size_t tmp_idlen; + size_t tmp_idlen = 0; /* * If the 'z' digest has already been computed, the ID is set too late @@ -438,7 +438,8 @@ static int sm2sig_set_ctx_params(void *vpsm2ctx, const OSSL_PARAM params[]) if (!psm2ctx->flag_compute_z_digest) return 0; - if (!OSSL_PARAM_get_octet_string(p, &tmp_id, 0, &tmp_idlen)) + if (p->data_size != 0 + && !OSSL_PARAM_get_octet_string(p, &tmp_id, 0, &tmp_idlen)) return 0; OPENSSL_free(psm2ctx->id); psm2ctx->id = tmp_id; diff --git a/deps/openssl/openssl/providers/implementations/storemgmt/file_store.c b/deps/openssl/openssl/providers/implementations/storemgmt/file_store.c index fef2b1d2900..6d6312659be 100644 --- a/deps/openssl/openssl/providers/implementations/storemgmt/file_store.c +++ b/deps/openssl/openssl/providers/implementations/storemgmt/file_store.c @@ -1,5 +1,5 @@ /* - * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -9,8 +9,6 @@ /* This file has quite some overlap with engines/e_loader_attic.c */ -#include "e_os.h" /* To get strncasecmp() on Windows */ - #include <string.h> #include <sys/stat.h> #include <ctype.h> /* isdigit */ @@ -220,12 +218,12 @@ static void *file_open(void *provctx, const char *uri) * There's a special case if the URI also contains an authority, then * the full URI shouldn't be used as a path anywhere. */ - if (strncasecmp(uri, "file:", 5) == 0) { + if (OPENSSL_strncasecmp(uri, "file:", 5) == 0) { const char *p = &uri[5]; if (strncmp(&uri[5], "//", 2) == 0) { path_data_n--; /* Invalidate using the full URI */ - if (strncasecmp(&uri[7], "localhost/", 10) == 0) { + if (OPENSSL_strncasecmp(&uri[7], "localhost/", 10) == 0) { p = &uri[16]; } else if (uri[7] == '/') { p = &uri[7]; @@ -592,7 +590,8 @@ static int file_name_check(struct file_ctx_st *ctx, const char *name) /* * First, check the basename */ - if (strncasecmp(name, ctx->_.dir.search_name, len) != 0 || name[len] != '.') + if (OPENSSL_strncasecmp(name, ctx->_.dir.search_name, len) != 0 + || name[len] != '.') return 0; p = &name[len + 1]; diff --git a/deps/openssl/openssl/ssl/s3_lib.c b/deps/openssl/openssl/ssl/s3_lib.c index 2c160d2d6a2..e4eee647df0 100644 --- a/deps/openssl/openssl/ssl/s3_lib.c +++ b/deps/openssl/openssl/ssl/s3_lib.c @@ -3686,6 +3686,12 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg) case SSL_CTRL_SET_CHAIN_CERT_STORE: return ssl_cert_set_cert_store(s->cert, parg, 1, larg); + case SSL_CTRL_GET_VERIFY_CERT_STORE: + return ssl_cert_get_cert_store(s->cert, parg, 0); + + case SSL_CTRL_GET_CHAIN_CERT_STORE: + return ssl_cert_get_cert_store(s->cert, parg, 1); + case SSL_CTRL_GET_PEER_SIGNATURE_NID: if (s->s3.tmp.peer_sigalg == NULL) return 0; @@ -3931,6 +3937,12 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg) case SSL_CTRL_SET_CHAIN_CERT_STORE: return ssl_cert_set_cert_store(ctx->cert, parg, 1, larg); + case SSL_CTRL_GET_VERIFY_CERT_STORE: + return ssl_cert_get_cert_store(ctx->cert, parg, 0); + + case SSL_CTRL_GET_CHAIN_CERT_STORE: + return ssl_cert_get_cert_store(ctx->cert, parg, 1); + /* A Thawte special :-) */ case SSL_CTRL_EXTRA_CHAIN_CERT: if (ctx->extra_certs == NULL) { diff --git a/deps/openssl/openssl/ssl/ssl_cert.c b/deps/openssl/openssl/ssl/ssl_cert.c index 8d90fa54df7..e4168e74c27 100644 --- a/deps/openssl/openssl/ssl/ssl_cert.c +++ b/deps/openssl/openssl/ssl/ssl_cert.c @@ -971,6 +971,12 @@ int ssl_cert_set_cert_store(CERT *c, X509_STORE *store, int chain, int ref) return 1; } +int ssl_cert_get_cert_store(CERT *c, X509_STORE **pstore, int chain) +{ + *pstore = (chain ? c->chain_store : c->verify_store); + return 1; +} + int ssl_get_security_level_bits(const SSL *s, const SSL_CTX *ctx, int *levelp) { int level; diff --git a/deps/openssl/openssl/ssl/ssl_conf.c b/deps/openssl/openssl/ssl/ssl_conf.c index c0cbbe5e2cf..f49b2e5a375 100644 --- a/deps/openssl/openssl/ssl/ssl_conf.c +++ b/deps/openssl/openssl/ssl/ssl_conf.c @@ -1,5 +1,5 @@ /* - * Copyright 2012-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2012-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -148,7 +148,8 @@ static int ssl_match_option(SSL_CONF_CTX *cctx, const ssl_flag_tbl *tbl, if (namelen == -1) { if (strcmp(tbl->name, name)) return 0; - } else if (tbl->namelen != namelen || strncasecmp(tbl->name, name, namelen)) + } else if (tbl->namelen != namelen + || OPENSSL_strncasecmp(tbl->name, name, namelen)) return 0; ssl_set_option(cctx, tbl->name_flags, tbl->option_value, onoff); return 1; @@ -232,8 +233,8 @@ static int cmd_ECDHParameters(SSL_CONF_CTX *cctx, const char *value) /* Ignore values supported by 1.0.2 for the automatic selection */ if ((cctx->flags & SSL_CONF_FLAG_FILE) - && (strcasecmp(value, "+automatic") == 0 - || strcasecmp(value, "automatic") == 0)) + && (OPENSSL_strcasecmp(value, "+automatic") == 0 + || OPENSSL_strcasecmp(value, "automatic") == 0)) return 1; if ((cctx->flags & SSL_CONF_FLAG_CMDLINE) && strcmp(value, "auto") == 0) @@ -597,15 +598,19 @@ static int cmd_DHParameters(SSL_CONF_CTX *cctx, const char *value) = OSSL_DECODER_CTX_new_for_pkey(&dhpkey, "PEM", NULL, "DH", OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS, sslctx->libctx, sslctx->propq); - if (decoderctx == NULL - || !OSSL_DECODER_from_bio(decoderctx, in)) { - OSSL_DECODER_CTX_free(decoderctx); + if (decoderctx == NULL) goto end; - } + ERR_set_mark(); + while (!OSSL_DECODER_from_bio(decoderctx, in) + && dhpkey == NULL + && !BIO_eof(in)); OSSL_DECODER_CTX_free(decoderctx); - if (dhpkey == NULL) + if (dhpkey == NULL) { + ERR_clear_last_mark(); goto end; + } + ERR_pop_to_mark(); } else { return 1; } @@ -808,7 +813,7 @@ static int ssl_conf_cmd_skip_prefix(SSL_CONF_CTX *cctx, const char **pcmd) strncmp(*pcmd, cctx->prefix, cctx->prefixlen)) return 0; if (cctx->flags & SSL_CONF_FLAG_FILE && - strncasecmp(*pcmd, cctx->prefix, cctx->prefixlen)) + OPENSSL_strncasecmp(*pcmd, cctx->prefix, cctx->prefixlen)) return 0; *pcmd += cctx->prefixlen; } else if (cctx->flags & SSL_CONF_FLAG_CMDLINE) { @@ -850,7 +855,7 @@ static const ssl_conf_cmd_tbl *ssl_conf_cmd_lookup(SSL_CONF_CTX *cctx, return t; } if (cctx->flags & SSL_CONF_FLAG_FILE) { - if (t->str_file && strcasecmp(t->str_file, cmd) == 0) + if (t->str_file && OPENSSL_strcasecmp(t->str_file, cmd) == 0) return t; } } diff --git a/deps/openssl/openssl/ssl/ssl_lib.c b/deps/openssl/openssl/ssl/ssl_lib.c index 9b1998a93d5..c492df0dd7e 100644 --- a/deps/openssl/openssl/ssl/ssl_lib.c +++ b/deps/openssl/openssl/ssl/ssl_lib.c @@ -2317,6 +2317,7 @@ int SSL_shutdown(SSL *s) if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) { struct ssl_async_args args; + memset(&args, 0, sizeof(args)); args.s = s; args.type = OTHERFUNC; args.f.func_other = s->method->ssl_shutdown; @@ -4004,6 +4005,7 @@ int SSL_do_handshake(SSL *s) if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) { struct ssl_async_args args; + memset(&args, 0, sizeof(args)); args.s = s; ret = ssl_start_async_job(s, &args, ssl_do_handshake_intern); diff --git a/deps/openssl/openssl/ssl/ssl_local.h b/deps/openssl/openssl/ssl/ssl_local.h index 3dae12226b3..297b634b6d0 100644 --- a/deps/openssl/openssl/ssl/ssl_local.h +++ b/deps/openssl/openssl/ssl/ssl_local.h @@ -2486,6 +2486,7 @@ __owur int ssl_verify_cert_chain(SSL *s, STACK_OF(X509) *sk); __owur int ssl_build_cert_chain(SSL *s, SSL_CTX *ctx, int flags); __owur int ssl_cert_set_cert_store(CERT *c, X509_STORE *store, int chain, int ref); +__owur int ssl_cert_get_cert_store(CERT *c, X509_STORE **pstore, int chain); __owur int ssl_security(const SSL *s, int op, int bits, int nid, void *other); __owur int ssl_ctx_security(const SSL_CTX *ctx, int op, int bits, int nid, diff --git a/deps/openssl/openssl/ssl/ssl_txt.c b/deps/openssl/openssl/ssl/ssl_txt.c index 6abee5da41c..212fe00962e 100644 --- a/deps/openssl/openssl/ssl/ssl_txt.c +++ b/deps/openssl/openssl/ssl/ssl_txt.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. * Copyright 2005 Nokia. All rights reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use @@ -129,11 +129,11 @@ int SSL_SESSION_print(BIO *bp, const SSL_SESSION *x) } #endif if (x->time != 0L) { - if (BIO_printf(bp, "\n Start Time: %ld", x->time) <= 0) + if (BIO_printf(bp, "\n Start Time: %lld", (long long)x->time) <= 0) goto err; } if (x->timeout != 0L) { - if (BIO_printf(bp, "\n Timeout : %ld (sec)", x->timeout) <= 0) + if (BIO_printf(bp, "\n Timeout : %lld (sec)", (long long)x->timeout) <= 0) goto err; } if (BIO_puts(bp, "\n") <= 0) diff --git a/deps/openssl/openssl/ssl/statem/statem_clnt.c b/deps/openssl/openssl/ssl/statem/statem_clnt.c index 12a6b06a49e..1717e9338c5 100644 --- a/deps/openssl/openssl/ssl/statem/statem_clnt.c +++ b/deps/openssl/openssl/ssl/statem/statem_clnt.c @@ -1403,6 +1403,10 @@ MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, PACKET *pkt) && sversion == TLS1_2_VERSION && PACKET_remaining(pkt) >= SSL3_RANDOM_SIZE && memcmp(hrrrandom, PACKET_data(pkt), SSL3_RANDOM_SIZE) == 0) { + if (s->hello_retry_request != SSL_HRR_NONE) { + SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_R_UNEXPECTED_MESSAGE); + goto err; + } s->hello_retry_request = SSL_HRR_PENDING; hrr = 1; if (!PACKET_forward(pkt, SSL3_RANDOM_SIZE)) { diff --git a/deps/openssl/openssl/ssl/statem/statem_dtls.c b/deps/openssl/openssl/ssl/statem/statem_dtls.c index 8c588fd5902..2838d51bdb2 100644 --- a/deps/openssl/openssl/ssl/statem/statem_dtls.c +++ b/deps/openssl/openssl/ssl/statem/statem_dtls.c @@ -1,5 +1,5 @@ /* - * Copyright 2005-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2005-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -218,8 +218,8 @@ int dtls1_do_write(SSL *s, int type) else len = s->init_num; - if (len > s->max_send_fragment) - len = s->max_send_fragment; + if (len > ssl_get_max_send_fragment(s)) + len = ssl_get_max_send_fragment(s); /* * XDTLS: this function is too long. split out the CCS part @@ -241,7 +241,7 @@ int dtls1_do_write(SSL *s, int type) ret = dtls1_write_bytes(s, type, &s->init_buf->data[s->init_off], len, &written); - if (ret < 0) { + if (ret <= 0) { /* * might need to update MTU here, but we don't know which * previous packet caused the failure -- so can't really diff --git a/deps/openssl/openssl/ssl/statem/statem_srvr.c b/deps/openssl/openssl/ssl/statem/statem_srvr.c index 677c1be5801..e0470cbfb1b 100644 --- a/deps/openssl/openssl/ssl/statem/statem_srvr.c +++ b/deps/openssl/openssl/ssl/statem/statem_srvr.c @@ -3641,15 +3641,24 @@ int tls_construct_server_certificate(SSL *s, WPACKET *pkt) static int create_ticket_prequel(SSL *s, WPACKET *pkt, uint32_t age_add, unsigned char *tick_nonce) { + uint32_t timeout = (uint32_t)s->session->timeout; + /* - * Ticket lifetime hint: For TLSv1.2 this is advisory only and we leave this - * unspecified for resumed session (for simplicity). + * Ticket lifetime hint: * In TLSv1.3 we reset the "time" field above, and always specify the - * timeout. + * timeout, limited to a 1 week period per RFC8446. + * For TLSv1.2 this is advisory only and we leave this unspecified for + * resumed session (for simplicity). */ - if (!WPACKET_put_bytes_u32(pkt, - (s->hit && !SSL_IS_TLS13(s)) - ? 0 : (uint32_t)s->session->timeout)) { +#define ONE_WEEK_SEC (7 * 24 * 60 * 60) + + if (SSL_IS_TLS13(s)) { + if (s->session->timeout > ONE_WEEK_SEC) + timeout = ONE_WEEK_SEC; + } else if (s->hit) + timeout = 0; + + if (!WPACKET_put_bytes_u32(pkt, timeout)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); return 0; } diff --git a/deps/openssl/openssl/test/bntest.c b/deps/openssl/openssl/test/bntest.c index 4c1ee0c13b6..c5894c157b3 100644 --- a/deps/openssl/openssl/test/bntest.c +++ b/deps/openssl/openssl/test/bntest.c @@ -10,9 +10,6 @@ #include <errno.h> #include <stdio.h> #include <string.h> -#ifdef __TANDEM -# include <strings.h> /* strcasecmp */ -#endif #include <ctype.h> #include <openssl/bn.h> @@ -23,10 +20,6 @@ #include "internal/numbers.h" #include "testutil.h" -#ifdef OPENSSL_SYS_WINDOWS -# define strcasecmp _stricmp -#endif - /* * Things in boring, not in openssl. */ @@ -64,7 +57,7 @@ static const char *findattr(STANZA *s, const char *key) PAIR *pp = s->pairs; for ( ; --i >= 0; pp++) - if (strcasecmp(pp->key, key) == 0) + if (OPENSSL_strcasecmp(pp->key, key) == 0) return pp->value; return NULL; } diff --git a/deps/openssl/openssl/test/build.info b/deps/openssl/openssl/test/build.info index 0f379e11e22..ee059973d31 100644 --- a/deps/openssl/openssl/test/build.info +++ b/deps/openssl/openssl/test/build.info @@ -37,7 +37,7 @@ IF[{- !$disabled{tests} -}] sanitytest rsa_complex exdatatest bntest \ ecstresstest gmdifftest pbelutest \ destest mdc2test sha_test \ - exptest pbetest \ + exptest pbetest localetest evp_pkey_ctx_new_from_name\ evp_pkey_provided_test evp_test evp_extra_test evp_extra_test2 \ evp_fetch_prov_test evp_libctx_test ossl_store_test \ v3nametest v3ext \ @@ -135,6 +135,14 @@ IF[{- !$disabled{tests} -}] INCLUDE[exptest]=../include ../apps/include DEPEND[exptest]=../libcrypto libtestutil.a + SOURCE[localetest]=localetest.c + INCLUDE[localetest]=../include ../apps/include + DEPEND[localetest]=../libcrypto libtestutil.a + + SOURCE[evp_pkey_ctx_new_from_name]=evp_pkey_ctx_new_from_name.c + INCLUDE[evp_pkey_ctx_new_from_name]=../include ../apps/include + DEPEND[evp_pkey_ctx_new_from_name]=../libcrypto + SOURCE[pbetest]=pbetest.c INCLUDE[pbetest]=../include ../apps/include DEPEND[pbetest]=../libcrypto libtestutil.a diff --git a/deps/openssl/openssl/test/cmsapitest.c b/deps/openssl/openssl/test/cmsapitest.c index 683dad48350..b40089becdc 100644 --- a/deps/openssl/openssl/test/cmsapitest.c +++ b/deps/openssl/openssl/test/cmsapitest.c @@ -1,5 +1,5 @@ /* - * Copyright 2018-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2018-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -18,6 +18,7 @@ static X509 *cert = NULL; static EVP_PKEY *privkey = NULL; +static char *derin = NULL; static int test_encrypt_decrypt(const EVP_CIPHER *cipher) { @@ -288,7 +289,30 @@ static int test_d2i_CMS_bio_NULL(void) return ret; } -OPT_TEST_DECLARE_USAGE("certfile privkeyfile\n") +static int test_d2i_CMS_bio_file_encrypted_data(void) +{ + BIO *bio = NULL; + CMS_ContentInfo *cms = NULL; + int ret = 0; + + ERR_clear_error(); + + if (!TEST_ptr(bio = BIO_new_file(derin, "r")) + || !TEST_ptr(cms = d2i_CMS_bio(bio, NULL))) + goto end; + + if (!TEST_int_eq(ERR_peek_error(), 0)) + goto end; + + ret = 1; +end: + CMS_ContentInfo_free(cms); + BIO_free(bio); + + return ret; +} + +OPT_TEST_DECLARE_USAGE("certfile privkeyfile derfile\n") int setup_tests(void) { @@ -301,7 +325,8 @@ int setup_tests(void) } if (!TEST_ptr(certin = test_get_argument(0)) - || !TEST_ptr(privkeyin = test_get_argument(1))) + || !TEST_ptr(privkeyin = test_get_argument(1)) + || !TEST_ptr(derin = test_get_argument(2))) return 0; certbio = BIO_new_file(certin, "r"); @@ -332,6 +357,7 @@ int setup_tests(void) ADD_TEST(test_encrypt_decrypt_aes_192_gcm); ADD_TEST(test_encrypt_decrypt_aes_256_gcm); ADD_TEST(test_d2i_CMS_bio_NULL); + ADD_TEST(test_d2i_CMS_bio_file_encrypted_data); return 1; } diff --git a/deps/openssl/openssl/test/dtls_mtu_test.c b/deps/openssl/openssl/test/dtls_mtu_test.c index 612b76a3bcb..25844aa0ff5 100644 --- a/deps/openssl/openssl/test/dtls_mtu_test.c +++ b/deps/openssl/openssl/test/dtls_mtu_test.c @@ -1,5 +1,5 @@ /* - * Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -185,12 +185,58 @@ static int run_mtu_tests(void) end: SSL_CTX_free(ctx); - bio_s_mempacket_test_free(); return ret; } +static int test_server_mtu_larger_than_max_fragment_length(void) +{ + SSL_CTX *ctx = NULL; + SSL *srvr_ssl = NULL, *clnt_ssl = NULL; + int rv = 0; + + if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_method()))) + goto end; + + SSL_CTX_set_psk_server_callback(ctx, srvr_psk_callback); + SSL_CTX_set_psk_client_callback(ctx, clnt_psk_callback); + +#ifndef OPENSSL_NO_DH + if (!TEST_true(SSL_CTX_set_dh_auto(ctx, 1))) + goto end; +#endif + + if (!TEST_true(create_ssl_objects(ctx, ctx, &srvr_ssl, &clnt_ssl, + NULL, NULL))) + goto end; + + SSL_set_options(srvr_ssl, SSL_OP_NO_QUERY_MTU); + if (!TEST_true(DTLS_set_link_mtu(srvr_ssl, 1500))) + goto end; + + SSL_set_tlsext_max_fragment_length(clnt_ssl, + TLSEXT_max_fragment_length_512); + + if (!TEST_true(create_ssl_connection(srvr_ssl, clnt_ssl, + SSL_ERROR_NONE))) + goto end; + + rv = 1; + + end: + SSL_free(clnt_ssl); + SSL_free(srvr_ssl); + SSL_CTX_free(ctx); + return rv; +} + int setup_tests(void) { ADD_TEST(run_mtu_tests); + ADD_TEST(test_server_mtu_larger_than_max_fragment_length); return 1; } + +void cleanup_tests(void) +{ + bio_s_mempacket_test_free(); +} diff --git a/deps/openssl/openssl/test/endecode_test.c b/deps/openssl/openssl/test/endecode_test.c index 1698867b408..0e9697bcd35 100644 --- a/deps/openssl/openssl/test/endecode_test.c +++ b/deps/openssl/openssl/test/endecode_test.c @@ -1,5 +1,5 @@ /* - * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -143,6 +143,7 @@ typedef int (checker)(const char *file, const int line, typedef void (dumper)(const char *label, const void *data, size_t data_len); #define FLAG_DECODE_WITH_TYPE 0x0001 +#define FLAG_FAIL_IF_FIPS 0x0002 static int test_encode_decode(const char *file, const int line, const char *type, EVP_PKEY *pkey, @@ -166,8 +167,19 @@ static int test_encode_decode(const char *file, const int line, * dumping purposes. */ if (!TEST_true(encode_cb(file, line, &encoded, &encoded_len, pkey, selection, - output_type, output_structure, pass, pcipher)) - || !TEST_true(check_cb(file, line, type, encoded, encoded_len)) + output_type, output_structure, pass, pcipher))) + goto end; + + if ((flags & FLAG_FAIL_IF_FIPS) != 0 && is_fips) { + if (TEST_false(decode_cb(file, line, (void **)&pkey2, encoded, + encoded_len, output_type, output_structure, + (flags & FLAG_DECODE_WITH_TYPE ? type : NULL), + selection, pass))) + ok = 1; + goto end; + } + + if (!TEST_true(check_cb(file, line, type, encoded, encoded_len)) || !TEST_true(decode_cb(file, line, (void **)&pkey2, encoded, encoded_len, output_type, output_structure, (flags & FLAG_DECODE_WITH_TYPE ? type : NULL), @@ -521,7 +533,7 @@ static int check_unprotected_PKCS8_DER(const char *file, const int line, return ok; } -static int test_unprotected_via_DER(const char *type, EVP_PKEY *key) +static int test_unprotected_via_DER(const char *type, EVP_PKEY *key, int fips) { return test_encode_decode(__FILE__, __LINE__, type, key, OSSL_KEYMGMT_SELECT_KEYPAIR @@ -529,7 +541,7 @@ static int test_unprotected_via_DER(const char *type, EVP_PKEY *key) "DER", "PrivateKeyInfo", NULL, NULL, encode_EVP_PKEY_prov, decode_EVP_PKEY_prov, test_mem, check_unprotected_PKCS8_DER, - dump_der, 0); + dump_der, fips ? 0 : FLAG_FAIL_IF_FIPS); } static int check_unprotected_PKCS8_PEM(const char *file, const int line, @@ -543,7 +555,7 @@ static int check_unprotected_PKCS8_PEM(const char *file, const int line, sizeof(expected_pem_header) - 1); } -static int test_unprotected_via_PEM(const char *type, EVP_PKEY *key) +static int test_unprotected_via_PEM(const char *type, EVP_PKEY *key, int fips) { return test_encode_decode(__FILE__, __LINE__, type, key, OSSL_KEYMGMT_SELECT_KEYPAIR @@ -551,7 +563,7 @@ static int test_unprotected_via_PEM(const char *type, EVP_PKEY *key) "PEM", "PrivateKeyInfo", NULL, NULL, encode_EVP_PKEY_prov, decode_EVP_PKEY_prov, test_text, check_unprotected_PKCS8_PEM, - dump_pem, 0); + dump_pem, fips ? 0 : FLAG_FAIL_IF_FIPS); } #ifndef OPENSSL_NO_KEYPARAMS @@ -698,7 +710,7 @@ static int check_protected_PKCS8_DER(const char *file, const int line, return ok; } -static int test_protected_via_DER(const char *type, EVP_PKEY *key) +static int test_protected_via_DER(const char *type, EVP_PKEY *key, int fips) { return test_encode_decode(__FILE__, __LINE__, type, key, OSSL_KEYMGMT_SELECT_KEYPAIR @@ -707,7 +719,7 @@ static int test_protected_via_DER(const char *type, EVP_PKEY *key) pass, pass_cipher, encode_EVP_PKEY_prov, decode_EVP_PKEY_prov, test_mem, check_protected_PKCS8_DER, - dump_der, 0); + dump_der, fips ? 0 : FLAG_FAIL_IF_FIPS); } static int check_protected_PKCS8_PEM(const char *file, const int line, @@ -721,7 +733,7 @@ static int check_protected_PKCS8_PEM(const char *file, const int line, sizeof(expected_pem_header) - 1); } -static int test_protected_via_PEM(const char *type, EVP_PKEY *key) +static int test_protected_via_PEM(const char *type, EVP_PKEY *key, int fips) { return test_encode_decode(__FILE__, __LINE__, type, key, OSSL_KEYMGMT_SELECT_KEYPAIR @@ -730,7 +742,7 @@ static int test_protected_via_PEM(const char *type, EVP_PKEY *key) pass, pass_cipher, encode_EVP_PKEY_prov, decode_EVP_PKEY_prov, test_text, check_protected_PKCS8_PEM, - dump_pem, 0); + dump_pem, fips ? 0 : FLAG_FAIL_IF_FIPS); } static int check_protected_legacy_PEM(const char *file, const int line, @@ -791,14 +803,15 @@ static int check_public_DER(const char *file, const int line, return ok; } -static int test_public_via_DER(const char *type, EVP_PKEY *key) +static int test_public_via_DER(const char *type, EVP_PKEY *key, int fips) { return test_encode_decode(__FILE__, __LINE__, type, key, OSSL_KEYMGMT_SELECT_PUBLIC_KEY | OSSL_KEYMGMT_SELECT_ALL_PARAMETERS, "DER", "SubjectPublicKeyInfo", NULL, NULL, encode_EVP_PKEY_prov, decode_EVP_PKEY_prov, - test_mem, check_public_DER, dump_der, 0); + test_mem, check_public_DER, dump_der, + fips ? 0 : FLAG_FAIL_IF_FIPS); } static int check_public_PEM(const char *file, const int line, @@ -812,14 +825,15 @@ static int check_public_PEM(const char *file, const int line, sizeof(expected_pem_header) - 1); } -static int test_public_via_PEM(const char *type, EVP_PKEY *key) +static int test_public_via_PEM(const char *type, EVP_PKEY *key, int fips) { return test_encode_decode(__FILE__, __LINE__, type, key, OSSL_KEYMGMT_SELECT_PUBLIC_KEY | OSSL_KEYMGMT_SELECT_ALL_PARAMETERS, "PEM", "SubjectPublicKeyInfo", NULL, NULL, encode_EVP_PKEY_prov, decode_EVP_PKEY_prov, - test_text, check_public_PEM, dump_pem, 0); + test_text, check_public_PEM, dump_pem, + fips ? 0 : FLAG_FAIL_IF_FIPS); } static int check_public_MSBLOB(const char *file, const int line, @@ -864,30 +878,30 @@ static int test_public_via_MSBLOB(const char *type, EVP_PKEY *key) EVP_PKEY_free(template_##KEYTYPE); \ EVP_PKEY_free(key_##KEYTYPE) -#define IMPLEMENT_TEST_SUITE(KEYTYPE, KEYTYPEstr) \ +#define IMPLEMENT_TEST_SUITE(KEYTYPE, KEYTYPEstr, fips) \ static int test_unprotected_##KEYTYPE##_via_DER(void) \ { \ - return test_unprotected_via_DER(KEYTYPEstr, key_##KEYTYPE); \ + return test_unprotected_via_DER(KEYTYPEstr, key_##KEYTYPE, fips); \ } \ static int test_unprotected_##KEYTYPE##_via_PEM(void) \ { \ - return test_unprotected_via_PEM(KEYTYPEstr, key_##KEYTYPE); \ + return test_unprotected_via_PEM(KEYTYPEstr, key_##KEYTYPE, fips); \ } \ static int test_protected_##KEYTYPE##_via_DER(void) \ { \ - return test_protected_via_DER(KEYTYPEstr, key_##KEYTYPE); \ + return test_protected_via_DER(KEYTYPEstr, key_##KEYTYPE, fips); \ } \ static int test_protected_##KEYTYPE##_via_PEM(void) \ { \ - return test_protected_via_PEM(KEYTYPEstr, key_##KEYTYPE); \ + return test_protected_via_PEM(KEYTYPEstr, key_##KEYTYPE, fips); \ } \ static int test_public_##KEYTYPE##_via_DER(void) \ { \ - return test_public_via_DER(KEYTYPEstr, key_##KEYTYPE); \ + return test_public_via_DER(KEYTYPEstr, key_##KEYTYPE, fips); \ } \ static int test_public_##KEYTYPE##_via_PEM(void) \ { \ - return test_public_via_PEM(KEYTYPEstr, key_##KEYTYPE); \ + return test_public_via_PEM(KEYTYPEstr, key_##KEYTYPE, fips); \ } #define ADD_TEST_SUITE(KEYTYPE) \ @@ -961,10 +975,10 @@ static int test_public_via_MSBLOB(const char *type, EVP_PKEY *key) #ifndef OPENSSL_NO_DH DOMAIN_KEYS(DH); -IMPLEMENT_TEST_SUITE(DH, "DH") +IMPLEMENT_TEST_SUITE(DH, "DH", 1) IMPLEMENT_TEST_SUITE_PARAMS(DH, "DH") DOMAIN_KEYS(DHX); -IMPLEMENT_TEST_SUITE(DHX, "X9.42 DH") +IMPLEMENT_TEST_SUITE(DHX, "X9.42 DH", 1) IMPLEMENT_TEST_SUITE_PARAMS(DHX, "X9.42 DH") /* * DH has no support for PEM_write_bio_PrivateKey_traditional(), @@ -973,7 +987,7 @@ IMPLEMENT_TEST_SUITE_PARAMS(DHX, "X9.42 DH") #endif #ifndef OPENSSL_NO_DSA DOMAIN_KEYS(DSA); -IMPLEMENT_TEST_SUITE(DSA, "DSA") +IMPLEMENT_TEST_SUITE(DSA, "DSA", 1) IMPLEMENT_TEST_SUITE_PARAMS(DSA, "DSA") IMPLEMENT_TEST_SUITE_LEGACY(DSA, "DSA") IMPLEMENT_TEST_SUITE_MSBLOB(DSA, "DSA") @@ -984,41 +998,41 @@ IMPLEMENT_TEST_SUITE_PROTECTED_PVK(DSA, "DSA") #endif #ifndef OPENSSL_NO_EC DOMAIN_KEYS(EC); -IMPLEMENT_TEST_SUITE(EC, "EC") +IMPLEMENT_TEST_SUITE(EC, "EC", 1) IMPLEMENT_TEST_SUITE_PARAMS(EC, "EC") IMPLEMENT_TEST_SUITE_LEGACY(EC, "EC") DOMAIN_KEYS(ECExplicitPrimeNamedCurve); -IMPLEMENT_TEST_SUITE(ECExplicitPrimeNamedCurve, "EC") +IMPLEMENT_TEST_SUITE(ECExplicitPrimeNamedCurve, "EC", 1) IMPLEMENT_TEST_SUITE_LEGACY(ECExplicitPrimeNamedCurve, "EC") DOMAIN_KEYS(ECExplicitPrime2G); -IMPLEMENT_TEST_SUITE(ECExplicitPrime2G, "EC") +IMPLEMENT_TEST_SUITE(ECExplicitPrime2G, "EC", 0) IMPLEMENT_TEST_SUITE_LEGACY(ECExplicitPrime2G, "EC") # ifndef OPENSSL_NO_EC2M DOMAIN_KEYS(ECExplicitTriNamedCurve); -IMPLEMENT_TEST_SUITE(ECExplicitTriNamedCurve, "EC") +IMPLEMENT_TEST_SUITE(ECExplicitTriNamedCurve, "EC", 1) IMPLEMENT_TEST_SUITE_LEGACY(ECExplicitTriNamedCurve, "EC") DOMAIN_KEYS(ECExplicitTri2G); -IMPLEMENT_TEST_SUITE(ECExplicitTri2G, "EC") +IMPLEMENT_TEST_SUITE(ECExplicitTri2G, "EC", 0) IMPLEMENT_TEST_SUITE_LEGACY(ECExplicitTri2G, "EC") # endif KEYS(ED25519); -IMPLEMENT_TEST_SUITE(ED25519, "ED25519") +IMPLEMENT_TEST_SUITE(ED25519, "ED25519", 1) KEYS(ED448); -IMPLEMENT_TEST_SUITE(ED448, "ED448") +IMPLEMENT_TEST_SUITE(ED448, "ED448", 1) KEYS(X25519); -IMPLEMENT_TEST_SUITE(X25519, "X25519") +IMPLEMENT_TEST_SUITE(X25519, "X25519", 1) KEYS(X448); -IMPLEMENT_TEST_SUITE(X448, "X448") +IMPLEMENT_TEST_SUITE(X448, "X448", 1) /* * ED25519, ED448, X25519 and X448 have no support for * PEM_write_bio_PrivateKey_traditional(), so no legacy tests. */ #endif KEYS(RSA); -IMPLEMENT_TEST_SUITE(RSA, "RSA") +IMPLEMENT_TEST_SUITE(RSA, "RSA", 1) IMPLEMENT_TEST_SUITE_LEGACY(RSA, "RSA") KEYS(RSA_PSS); -IMPLEMENT_TEST_SUITE(RSA_PSS, "RSA-PSS") +IMPLEMENT_TEST_SUITE(RSA_PSS, "RSA-PSS", 1) /* * RSA-PSS has no support for PEM_write_bio_PrivateKey_traditional(), * so no legacy tests. diff --git a/deps/openssl/openssl/test/evp_extra_test.c b/deps/openssl/openssl/test/evp_extra_test.c index 113ec2bd66a..3b597617791 100644 --- a/deps/openssl/openssl/test/evp_extra_test.c +++ b/deps/openssl/openssl/test/evp_extra_test.c @@ -35,7 +35,6 @@ #include "internal/nelem.h" #include "internal/sizes.h" #include "crypto/evp.h" -#include "../e_os.h" /* strcasecmp */ static OSSL_LIB_CTX *testctx = NULL; static char *testpropq = NULL; @@ -1739,7 +1738,7 @@ static int ec_export_get_encoding_cb(const OSSL_PARAM params[], void *arg) return 0; for (i = 0; i < OSSL_NELEM(ec_encodings); i++) { - if (strcasecmp(enc_name, ec_encodings[i].encoding_name) == 0) { + if (OPENSSL_strcasecmp(enc_name, ec_encodings[i].encoding_name) == 0) { *enc = ec_encodings[i].encoding; break; } @@ -1963,6 +1962,24 @@ static int test_EVP_SM2(void) if (!TEST_int_gt(EVP_DigestVerifyFinal(md_ctx_verify, sig, sig_len), 0)) goto done; + /* + * Try verify again with non-matching 0 length id but ensure that it can + * be set on the context and overrides the previous value. + */ + + if (!TEST_true(EVP_DigestVerifyInit(md_ctx_verify, NULL, check_md, NULL, + pkey))) + goto done; + + if (!TEST_int_gt(EVP_PKEY_CTX_set1_id(sctx, NULL, 0), 0)) + goto done; + + if (!TEST_true(EVP_DigestVerifyUpdate(md_ctx_verify, kMsg, sizeof(kMsg)))) + goto done; + + if (!TEST_int_eq(EVP_DigestVerifyFinal(md_ctx_verify, sig, sig_len), 0)) + goto done; + /* now check encryption/decryption */ gparams[0] = OSSL_PARAM_construct_utf8_string(OSSL_ASYM_CIPHER_PARAM_DIGEST, diff --git a/deps/openssl/openssl/test/evp_libctx_test.c b/deps/openssl/openssl/test/evp_libctx_test.c index e2663dc0299..65f5f694bfd 100644 --- a/deps/openssl/openssl/test/evp_libctx_test.c +++ b/deps/openssl/openssl/test/evp_libctx_test.c @@ -1,5 +1,5 @@ /* - * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -33,7 +33,6 @@ #include "testutil.h" #include "internal/nelem.h" #include "crypto/bn_dh.h" /* _bignum_ffdhe2048_p */ -#include "../e_os.h" /* strcasecmp */ static OSSL_LIB_CTX *libctx = NULL; static OSSL_PROVIDER *nullprov = NULL; @@ -478,7 +477,7 @@ err: static int name_cmp(const char * const *a, const char * const *b) { - return strcasecmp(*a, *b); + return OPENSSL_strcasecmp(*a, *b); } static void collect_cipher_names(EVP_CIPHER *cipher, void *cipher_names_list) diff --git a/deps/openssl/openssl/test/evp_pkey_ctx_new_from_name.c b/deps/openssl/openssl/test/evp_pkey_ctx_new_from_name.c new file mode 100644 index 00000000000..24063ea05ea --- /dev/null +++ b/deps/openssl/openssl/test/evp_pkey_ctx_new_from_name.c @@ -0,0 +1,14 @@ +#include <stdio.h> +#include <openssl/ec.h> +#include <openssl/evp.h> +#include <openssl/err.h> + +int main(int argc, char *argv[]) +{ + EVP_PKEY_CTX *pctx = NULL; + + pctx = EVP_PKEY_CTX_new_from_name(NULL, "NO_SUCH_ALGORITHM", NULL); + EVP_PKEY_CTX_free(pctx); + + return 0; +} diff --git a/deps/openssl/openssl/test/evp_test.c b/deps/openssl/openssl/test/evp_test.c index 7a5b9345e0d..ef6fc0965a9 100644 --- a/deps/openssl/openssl/test/evp_test.c +++ b/deps/openssl/openssl/test/evp_test.c @@ -12,7 +12,6 @@ #include <string.h> #include <stdlib.h> #include <ctype.h> -#include "../e_os.h" /* strcasecmp */ #include <openssl/evp.h> #include <openssl/pem.h> #include <openssl/err.h> @@ -1133,6 +1132,8 @@ typedef struct mac_data_st { size_t salt_len; /* XOF mode? */ int xof; + /* Reinitialization fails */ + int no_reinit; /* Collection of controls */ STACK_OF(OPENSSL_STRING) *controls; /* Output size */ @@ -1245,6 +1246,8 @@ static int mac_test_parse(EVP_TEST *t, return parse_bin(value, &mdata->output, &mdata->output_len); if (strcmp(keyword, "XOF") == 0) return mdata->xof = 1; + if (strcmp(keyword, "NoReinit") == 0) + return mdata->no_reinit = 1; if (strcmp(keyword, "Ctrl") == 0) return sk_OPENSSL_STRING_push(mdata->controls, OPENSSL_strdup(value)) != 0; @@ -1408,6 +1411,7 @@ static int mac_test_run_mac(EVP_TEST *t) const OSSL_PARAM *defined_params = EVP_MAC_settable_ctx_params(expected->mac); int xof; + int reinit = 1; if (expected->alg == NULL) TEST_info("Trying the EVP_MAC %s test", expected->mac_name); @@ -1518,6 +1522,7 @@ static int mac_test_run_mac(EVP_TEST *t) goto err; } } + retry: if (!EVP_MAC_update(ctx, expected->input, expected->input_len)) { t->err = "MAC_UPDATE_ERROR"; goto err; @@ -1552,6 +1557,39 @@ static int mac_test_run_mac(EVP_TEST *t) goto err; } } + if (reinit--) { + OSSL_PARAM ivparams[2] = { OSSL_PARAM_END, OSSL_PARAM_END }; + int ret; + + /* If the MAC uses IV, we have to set it again */ + if (expected->iv != NULL) { + ivparams[0] = + OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_IV, + expected->iv, + expected->iv_len); + ivparams[1] = OSSL_PARAM_construct_end(); + } + ERR_set_mark(); + ret = EVP_MAC_init(ctx, NULL, 0, ivparams); + if (expected->no_reinit) { + if (ret) { + ERR_clear_last_mark(); + t->err = "MAC_REINIT_SHOULD_FAIL"; + goto err; + } + } else if (ret) { + ERR_clear_last_mark(); + OPENSSL_free(got); + got = NULL; + goto retry; + } else { + ERR_clear_last_mark(); + t->err = "MAC_REINIT_ERROR"; + goto err; + } + /* If reinitialization fails, it is unsupported by the algorithm */ + ERR_pop_to_mark(); + } t->err = NULL; /* Test the EVP_Q_mac interface as well */ @@ -3886,9 +3924,9 @@ void cleanup_tests(void) OSSL_LIB_CTX_free(libctx); } -#define STR_STARTS_WITH(str, pre) strncasecmp(pre, str, strlen(pre)) == 0 +#define STR_STARTS_WITH(str, pre) OPENSSL_strncasecmp(pre, str, strlen(pre)) == 0 #define STR_ENDS_WITH(str, pre) \ -strlen(str) < strlen(pre) ? 0 : (strcasecmp(pre, str + strlen(str) - strlen(pre)) == 0) +strlen(str) < strlen(pre) ? 0 : (OPENSSL_strcasecmp(pre, str + strlen(str) - strlen(pre)) == 0) static int is_digest_disabled(const char *name) { @@ -3897,31 +3935,31 @@ static int is_digest_disabled(const char *name) return 1; #endif #ifdef OPENSSL_NO_MD2 - if (strcasecmp(name, "MD2") == 0) + if (OPENSSL_strcasecmp(name, "MD2") == 0) return 1; #endif #ifdef OPENSSL_NO_MDC2 - if (strcasecmp(name, "MDC2") == 0) + if (OPENSSL_strcasecmp(name, "MDC2") == 0) return 1; #endif #ifdef OPENSSL_NO_MD4 - if (strcasecmp(name, "MD4") == 0) + if (OPENSSL_strcasecmp(name, "MD4") == 0) return 1; #endif #ifdef OPENSSL_NO_MD5 - if (strcasecmp(name, "MD5") == 0) + if (OPENSSL_strcasecmp(name, "MD5") == 0) return 1; #endif #ifdef OPENSSL_NO_RMD160 - if (strcasecmp(name, "RIPEMD160") == 0) + if (OPENSSL_strcasecmp(name, "RIPEMD160") == 0) return 1; #endif #ifdef OPENSSL_NO_SM3 - if (strcasecmp(name, "SM3") == 0) + if (OPENSSL_strcasecmp(name, "SM3") == 0) return 1; #endif #ifdef OPENSSL_NO_WHIRLPOOL - if (strcasecmp(name, "WHIRLPOOL") == 0) + if (OPENSSL_strcasecmp(name, "WHIRLPOOL") == 0) return 1; #endif return 0; diff --git a/deps/openssl/openssl/test/helpers/handshake.c b/deps/openssl/openssl/test/helpers/handshake.c index 64b6919f703..285391bc03b 100644 --- a/deps/openssl/openssl/test/helpers/handshake.c +++ b/deps/openssl/openssl/test/helpers/handshake.c @@ -1432,6 +1432,7 @@ static HANDSHAKE_RESULT *do_handshake_internal( test_ctx, extra, &server_ctx_data, &server2_ctx_data, &client_ctx_data)) { TEST_note("configure_handshake_ctx"); + HANDSHAKE_RESULT_free(ret); return NULL; } diff --git a/deps/openssl/openssl/test/helpers/ssl_test_ctx.c b/deps/openssl/openssl/test/helpers/ssl_test_ctx.c index 1374b04cf02..a0e2e794c6d 100644 --- a/deps/openssl/openssl/test/helpers/ssl_test_ctx.c +++ b/deps/openssl/openssl/test/helpers/ssl_test_ctx.c @@ -1,5 +1,5 @@ /* - * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -16,21 +16,17 @@ #include "ssl_test_ctx.h" #include "../testutil.h" -#ifdef OPENSSL_SYS_WINDOWS -# define strcasecmp _stricmp -#endif - static const int default_app_data_size = 256; /* Default set to be as small as possible to exercise fragmentation. */ static const int default_max_fragment_size = 512; static int parse_boolean(const char *value, int *result) { - if (strcasecmp(value, "Yes") == 0) { + if (OPENSSL_strcasecmp(value, "Yes") == 0) { *result = 1; return 1; } - else if (strcasecmp(value, "No") == 0) { + else if (OPENSSL_strcasecmp(value, "No") == 0) { *result = 0; return 1; } diff --git a/deps/openssl/openssl/test/localetest.c b/deps/openssl/openssl/test/localetest.c new file mode 100644 index 00000000000..ea80039b3b8 --- /dev/null +++ b/deps/openssl/openssl/test/localetest.c @@ -0,0 +1,124 @@ + +#include <stdio.h> +#include <string.h> +#include <openssl/x509.h> +#include "testutil.h" +#include "testutil/output.h" + +#include <stdio.h> +#include <stdlib.h> +#include <locale.h> +#ifdef OPENSSL_SYS_WINDOWS +# define strcasecmp _stricmp +#else +# include <strings.h> +#endif + +int setup_tests(void) +{ + const unsigned char der_bytes[] = { + 0x30, 0x82, 0x03, 0x09, 0x30, 0x82, 0x01, 0xf1, 0xa0, 0x03, 0x02, 0x01, + 0x02, 0x02, 0x14, 0x08, 0xe0, 0x8c, 0xd3, 0xf3, 0xbf, 0x2c, 0xf2, 0x0d, + 0x0a, 0x75, 0xd1, 0xe8, 0xea, 0xbe, 0x70, 0x61, 0xd9, 0x67, 0xf9, 0x30, + 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, + 0x05, 0x00, 0x30, 0x14, 0x31, 0x12, 0x30, 0x10, 0x06, 0x03, 0x55, 0x04, + 0x03, 0x0c, 0x09, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73, 0x74, + 0x30, 0x1e, 0x17, 0x0d, 0x32, 0x32, 0x30, 0x34, 0x31, 0x31, 0x31, 0x34, + 0x31, 0x39, 0x35, 0x37, 0x5a, 0x17, 0x0d, 0x32, 0x32, 0x30, 0x35, 0x31, + 0x31, 0x31, 0x34, 0x31, 0x39, 0x35, 0x37, 0x5a, 0x30, 0x14, 0x31, 0x12, + 0x30, 0x10, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x09, 0x6c, 0x6f, 0x63, + 0x61, 0x6c, 0x68, 0x6f, 0x73, 0x74, 0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, + 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, + 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, + 0x01, 0x01, 0x00, 0xc3, 0x1f, 0x5c, 0x56, 0x46, 0x8d, 0x69, 0xb6, 0x48, + 0x3c, 0xbf, 0xe2, 0x0f, 0xa7, 0x4a, 0x44, 0x72, 0x74, 0x36, 0xfe, 0xe8, + 0x2f, 0x10, 0x4a, 0xe9, 0x46, 0x45, 0x72, 0x5e, 0x48, 0xdd, 0x75, 0xab, + 0xd9, 0x63, 0x91, 0x37, 0x93, 0x46, 0x28, 0x7e, 0x45, 0x94, 0x4b, 0x8a, + 0xd5, 0x05, 0x2b, 0x9a, 0x01, 0x96, 0x30, 0xde, 0xcc, 0x14, 0x2d, 0x06, + 0x09, 0x1b, 0x7d, 0x50, 0x14, 0x99, 0x36, 0x6b, 0x97, 0x6e, 0xc9, 0xb1, + 0x69, 0x70, 0xcd, 0x9b, 0x74, 0x24, 0x9a, 0xe2, 0xd4, 0xc0, 0x1e, 0xbc, + 0xec, 0xf6, 0x7a, 0xbb, 0xa0, 0x53, 0x93, 0xf8, 0x68, 0x9a, 0x18, 0xa1, + 0xa1, 0x5c, 0x47, 0x93, 0xd1, 0x4c, 0x36, 0x8c, 0x00, 0xb3, 0x66, 0xda, + 0xf1, 0x05, 0xb2, 0x3a, 0xad, 0x7e, 0x4b, 0xf3, 0xd3, 0x93, 0xfa, 0x59, + 0x09, 0x9c, 0x60, 0x37, 0x69, 0x61, 0xe8, 0x5a, 0x33, 0xc6, 0xb2, 0x1a, + 0xba, 0x36, 0xe2, 0xb3, 0x58, 0xe9, 0x73, 0x01, 0x2d, 0x36, 0x48, 0x36, + 0x94, 0xe4, 0xb2, 0xa4, 0x5b, 0xdf, 0x3d, 0x5f, 0x62, 0x9f, 0xd9, 0xf3, + 0x24, 0x0c, 0xf0, 0x2f, 0x71, 0x44, 0x79, 0x13, 0x70, 0x95, 0xa7, 0xbe, + 0xea, 0x0a, 0x08, 0x0a, 0xa6, 0x4b, 0xe9, 0x58, 0x6b, 0xa4, 0xc2, 0xed, + 0x74, 0x1e, 0xb0, 0x3b, 0x59, 0xd5, 0xe6, 0xdb, 0x8f, 0x58, 0x6a, 0xa3, + 0x7d, 0x52, 0x40, 0xec, 0x72, 0xb7, 0xba, 0x7e, 0x30, 0x9d, 0x12, 0x57, + 0xf2, 0x48, 0xae, 0x80, 0x0d, 0x0a, 0xf4, 0xfd, 0x24, 0xed, 0xd8, 0x05, + 0xb2, 0x96, 0x44, 0x02, 0x3e, 0x6e, 0x25, 0xb0, 0xc4, 0x93, 0xda, 0xfe, + 0x78, 0xd9, 0xbb, 0xd2, 0x71, 0x69, 0x70, 0x7f, 0xba, 0xf7, 0xb0, 0x4f, + 0x14, 0xf7, 0x98, 0x71, 0x01, 0x6c, 0xec, 0x6f, 0x76, 0x03, 0x59, 0xff, + 0xe2, 0xba, 0x8d, 0xd9, 0x21, 0x08, 0xb3, 0x02, 0x03, 0x01, 0x00, 0x01, + 0xa3, 0x53, 0x30, 0x51, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, + 0x16, 0x04, 0x14, 0x59, 0xb8, 0x6e, 0x1a, 0x72, 0xe9, 0x27, 0x1e, 0xbf, + 0x80, 0x87, 0x0f, 0xa9, 0xd0, 0x06, 0x6a, 0x11, 0x30, 0x77, 0x8e, 0x30, + 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, + 0x59, 0xb8, 0x6e, 0x1a, 0x72, 0xe9, 0x27, 0x1e, 0xbf, 0x80, 0x87, 0x0f, + 0xa9, 0xd0, 0x06, 0x6a, 0x11, 0x30, 0x77, 0x8e, 0x30, 0x0f, 0x06, 0x03, + 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x05, 0x30, 0x03, 0x01, 0x01, + 0xff, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, + 0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0x98, 0x76, 0x9e, + 0x3c, 0xfc, 0x3f, 0x58, 0xe8, 0xf2, 0x1f, 0x2e, 0x11, 0xa2, 0x59, 0xfa, + 0x27, 0xb5, 0xec, 0x9d, 0x97, 0x05, 0x06, 0x2c, 0x95, 0xa5, 0x28, 0x88, + 0x86, 0xeb, 0x4e, 0x8a, 0x62, 0xe9, 0x87, 0x78, 0xd8, 0x18, 0x22, 0x4e, + 0xb1, 0x8d, 0x46, 0x4a, 0x4c, 0x6e, 0x7c, 0x53, 0x62, 0x2c, 0xf2, 0x7a, + 0x95, 0xa0, 0x1a, 0x30, 0x18, 0x6a, 0x31, 0x6f, 0x3f, 0x55, 0x25, 0x9f, + 0x67, 0x60, 0x68, 0x99, 0x0f, 0x41, 0x09, 0xc8, 0xe2, 0x04, 0x33, 0x22, + 0x1a, 0xe9, 0xf3, 0xae, 0xce, 0xb6, 0x83, 0x64, 0x78, 0x66, 0x14, 0xc9, + 0x54, 0xc8, 0x34, 0x70, 0x96, 0xaf, 0x16, 0xcd, 0xb8, 0xdf, 0x81, 0x7e, + 0xf0, 0xa6, 0x7d, 0xc1, 0x13, 0xb2, 0x76, 0x3a, 0xd5, 0x7e, 0x68, 0x8c, + 0xd5, 0x00, 0x70, 0x82, 0x23, 0x7e, 0x5e, 0xc9, 0x31, 0x2f, 0x33, 0x54, + 0xaa, 0xaf, 0xcd, 0xe9, 0x38, 0x9a, 0x23, 0x53, 0xad, 0x4e, 0x72, 0xa7, + 0x6f, 0x47, 0x60, 0xc9, 0xd3, 0x06, 0x9b, 0x7a, 0x21, 0xc6, 0xe9, 0xdb, + 0x3c, 0xaa, 0xc0, 0x21, 0x29, 0x5f, 0x44, 0x6a, 0x45, 0x90, 0x73, 0x5e, + 0x6d, 0x78, 0x82, 0xcb, 0x42, 0xe6, 0xba, 0x67, 0xb2, 0xe6, 0xa2, 0x15, + 0x04, 0xea, 0x69, 0xae, 0x3e, 0xc0, 0x0c, 0x10, 0x99, 0xec, 0xa9, 0xb0, + 0x7e, 0xe8, 0x94, 0xe2, 0xf3, 0xaf, 0xf7, 0x9f, 0x65, 0xe7, 0xd7, 0xe2, + 0x49, 0xfa, 0x52, 0x7d, 0xb5, 0xfd, 0xa0, 0xa5, 0xe0, 0x49, 0xa7, 0x3d, + 0x94, 0x20, 0x2d, 0xec, 0x8c, 0x22, 0xa5, 0xa4, 0x43, 0xfa, 0x7e, 0xd0, + 0x50, 0x21, 0xb8, 0x67, 0x18, 0x44, 0x69, 0x8f, 0xdd, 0x47, 0x41, 0xc6, + 0x35, 0xe0, 0xe9, 0x2e, 0x41, 0xa9, 0x6f, 0x41, 0xee, 0xb9, 0xbd, 0x45, + 0xf3, 0x88, 0xc1, 0x23, 0x35, 0x96, 0xba, 0xf8, 0xcd, 0x4b, 0x83, 0x73, + 0x5f +}; + + char str1[] = "SubjectPublicKeyInfo", str2[] = "subjectpublickeyinfo"; + int res; + X509 *cert = NULL; + X509_PUBKEY *cert_pubkey = NULL; + const unsigned char *p = der_bytes; + + if (setlocale(LC_ALL, "") == NULL) + return TEST_skip("Cannot set the locale necessary for test"); + + res = strcasecmp(str1, str2); + TEST_note("Case-insensitive comparison via strcasecmp in current locale %s\n", res ? "failed" : "succeeded"); + + if (!TEST_false(OPENSSL_strcasecmp(str1, str2))) + return 0; + + cert = d2i_X509(NULL, &p, sizeof(der_bytes)); + if (!TEST_ptr(cert)) + return 0; + + cert_pubkey = X509_get_X509_PUBKEY(cert); + if (!TEST_ptr(cert_pubkey)) { + X509_free(cert); + return 0; + } + + if (!TEST_ptr(X509_PUBKEY_get0(cert_pubkey))) { + X509_free(cert); + return 0; + } + + X509_free(cert); + return 1; +} + +void cleanup_tests(void) +{ +} diff --git a/deps/openssl/openssl/test/params_conversion_test.c b/deps/openssl/openssl/test/params_conversion_test.c index 9422ef14734..30477e81279 100644 --- a/deps/openssl/openssl/test/params_conversion_test.c +++ b/deps/openssl/openssl/test/params_conversion_test.c @@ -1,5 +1,5 @@ /* - * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved. * Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use @@ -15,10 +15,6 @@ /* On machines that dont support <inttypes.h> just disable the tests */ #if !defined(OPENSSL_NO_INTTYPES_H) -# ifdef OPENSSL_SYS_WINDOWS -# define strcasecmp _stricmp -# endif - # ifdef OPENSSL_SYS_VMS # define strtoumax strtoull # define strtoimax strtoll @@ -62,7 +58,7 @@ static int param_conversion_load_stanza(PARAM_CONVERSION *pc, const STANZA *s) for (i = 0; i < s->numpairs; i++, pp++) { p = ""; - if (strcasecmp(pp->key, "type") == 0) { + if (OPENSSL_strcasecmp(pp->key, "type") == 0) { if (type != NULL) { TEST_info("Line %d: multiple type lines", s->curr); return 0; @@ -72,48 +68,48 @@ static int param_conversion_load_stanza(PARAM_CONVERSION *pc, const STANZA *s) TEST_info("Line %d: unknown type line", s->curr); return 0; } - } else if (strcasecmp(pp->key, "int32") == 0) { + } else if (OPENSSL_strcasecmp(pp->key, "int32") == 0) { if (def_i32++) { TEST_info("Line %d: multiple int32 lines", s->curr); return 0; } - if (strcasecmp(pp->value, "invalid") != 0) { + if (OPENSSL_strcasecmp(pp->value, "invalid") != 0) { pc->valid_i32 = 1; pc->i32 = (int32_t)strtoimax(pp->value, &p, 10); } - } else if (strcasecmp(pp->key, "int64") == 0) { + } else if (OPENSSL_strcasecmp(pp->key, "int64") == 0) { if (def_i64++) { TEST_info("Line %d: multiple int64 lines", s->curr); return 0; } - if (strcasecmp(pp->value, "invalid") != 0) { + if (OPENSSL_strcasecmp(pp->value, "invalid") != 0) { pc->valid_i64 = 1; pc->i64 = (int64_t)strtoimax(pp->value, &p, 10); } - } else if (strcasecmp(pp->key, "uint32") == 0) { + } else if (OPENSSL_strcasecmp(pp->key, "uint32") == 0) { if (def_u32++) { TEST_info("Line %d: multiple uint32 lines", s->curr); return 0; } - if (strcasecmp(pp->value, "invalid") != 0) { + if (OPENSSL_strcasecmp(pp->value, "invalid") != 0) { pc->valid_u32 = 1; pc->u32 = (uint32_t)strtoumax(pp->value, &p, 10); } - } else if (strcasecmp(pp->key, "uint64") == 0) { + } else if (OPENSSL_strcasecmp(pp->key, "uint64") == 0) { if (def_u64++) { TEST_info("Line %d: multiple uint64 lines", s->curr); return 0; } - if (strcasecmp(pp->value, "invalid") != 0) { + if (OPENSSL_strcasecmp(pp->value, "invalid") != 0) { pc->valid_u64 = 1; pc->u64 = (uint64_t)strtoumax(pp->value, &p, 10); } - } else if (strcasecmp(pp->key, "double") == 0) { + } else if (OPENSSL_strcasecmp(pp->key, "double") == 0) { if (def_d++) { TEST_info("Line %d: multiple double lines", s->curr); return 0; } - if (strcasecmp(pp->value, "invalid") != 0) { + if (OPENSSL_strcasecmp(pp->value, "invalid") != 0) { pc->valid_d = 1; pc->d = strtod(pp->value, &p); } @@ -133,7 +129,7 @@ static int param_conversion_load_stanza(PARAM_CONVERSION *pc, const STANZA *s) return 0; } - if (strcasecmp(type, "int32") == 0) { + if (OPENSSL_strcasecmp(type, "int32") == 0) { if (!TEST_true(def_i32) || !TEST_true(pc->valid_i32)) { TEST_note("errant int32 on line %d", s->curr); return 0; @@ -142,7 +138,7 @@ static int param_conversion_load_stanza(PARAM_CONVERSION *pc, const STANZA *s) pc->datum = &datum_i32; pc->ref = &ref_i32; pc->size = sizeof(ref_i32); - } else if (strcasecmp(type, "int64") == 0) { + } else if (OPENSSL_strcasecmp(type, "int64") == 0) { if (!TEST_true(def_i64) || !TEST_true(pc->valid_i64)) { TEST_note("errant int64 on line %d", s->curr); return 0; @@ -151,7 +147,7 @@ static int param_conversion_load_stanza(PARAM_CONVERSION *pc, const STANZA *s) pc->datum = &datum_i64; pc->ref = &ref_i64; pc->size = sizeof(ref_i64); - } else if (strcasecmp(type, "uint32") == 0) { + } else if (OPENSSL_strcasecmp(type, "uint32") == 0) { if (!TEST_true(def_u32) || !TEST_true(pc->valid_u32)) { TEST_note("errant uint32 on line %d", s->curr); return 0; @@ -160,7 +156,7 @@ static int param_conversion_load_stanza(PARAM_CONVERSION *pc, const STANZA *s) pc->datum = &datum_u32; pc->ref = &ref_u32; pc->size = sizeof(ref_u32); - } else if (strcasecmp(type, "uint64") == 0) { + } else if (OPENSSL_strcasecmp(type, "uint64") == 0) { if (!TEST_true(def_u64) || !TEST_true(pc->valid_u64)) { TEST_note("errant uint64 on line %d", s->curr); return 0; @@ -169,7 +165,7 @@ static int param_conversion_load_stanza(PARAM_CONVERSION *pc, const STANZA *s) pc->datum = &datum_u64; pc->ref = &ref_u64; pc->size = sizeof(ref_u64); - } else if (strcasecmp(type, "double") == 0) { + } else if (OPENSSL_strcasecmp(type, "double") == 0) { if (!TEST_true(def_d) || !TEST_true(pc->valid_d)) { TEST_note("errant double on line %d", s->curr); return 0; diff --git a/deps/openssl/openssl/test/provider_test.c b/deps/openssl/openssl/test/provider_test.c index 807b8fcf22d..b2e0a5da716 100644 --- a/deps/openssl/openssl/test/provider_test.c +++ b/deps/openssl/openssl/test/provider_test.c @@ -1,5 +1,5 @@ /* - * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -191,12 +191,15 @@ static int test_builtin_provider_with_child(void) * In this case we assume we've been built with "no-legacy" and skip * this test (there is no OPENSSL_NO_LEGACY) */ + OSSL_LIB_CTX_free(libctx); return 1; } if (!TEST_true(OSSL_PROVIDER_add_builtin(libctx, name, - PROVIDER_INIT_FUNCTION_NAME))) + PROVIDER_INIT_FUNCTION_NAME))) { + OSSL_LIB_CTX_free(libctx); return 0; + } /* test_provider will free libctx and unload legacy as part of the test */ return test_provider(&libctx, name, legacy); diff --git a/deps/openssl/openssl/test/recipes/02-test_localetest.t b/deps/openssl/openssl/test/recipes/02-test_localetest.t new file mode 100644 index 00000000000..d46cb0ffdf1 --- /dev/null +++ b/deps/openssl/openssl/test/recipes/02-test_localetest.t @@ -0,0 +1,26 @@ +#! /usr/bin/env perl +# Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved. +# Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved. +# +# Licensed under the Apache License 2.0 (the "License"). You may not use +# this file except in compliance with the License. You can obtain a copy +# in the file LICENSE in the source distribution or at +# https://www.openssl.org/source/license.html + +use OpenSSL::Test; +use OpenSSL::Test::Utils; + +setup("locale tests"); + +plan skip_all => "Locale tests not available on Windows or VMS" + if $^O =~ /^(VMS|MSWin32)$/; + +plan tests => 3; + +ok(run(test(["evp_pkey_ctx_new_from_name"])), "running evp_pkey_ctx_new_from_name without explicit context init"); + +$ENV{LANG} = "C"; +ok(run(test(["localetest"])), "running localetest"); + +$ENV{LANG} = "tr_TR.UTF-8"; +ok(run(test(["localetest"])), "running localetest with Turkish locale"); diff --git a/deps/openssl/openssl/test/recipes/03-test_fipsinstall.t b/deps/openssl/openssl/test/recipes/03-test_fipsinstall.t index d99974e4674..007e1be821b 100644 --- a/deps/openssl/openssl/test/recipes/03-test_fipsinstall.t +++ b/deps/openssl/openssl/test/recipes/03-test_fipsinstall.t @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -27,7 +27,7 @@ plan skip_all => "Test only supported in a fips build" if disabled("fips"); plan tests => 29; my $infile = bldtop_file('providers', platform->dso('fips')); -my $fipskey = $ENV{FIPSKEY} // '00'; +my $fipskey = $ENV{FIPSKEY} // config('FIPSKEY') // '00'; # Read in a text $infile and replace the regular expression in $srch with the # value in $repl and output to a new file $outfile. diff --git a/deps/openssl/openssl/test/recipes/15-test_ecparam.t b/deps/openssl/openssl/test/recipes/15-test_ecparam.t index 766524e8cfa..34efe7adb0e 100644 --- a/deps/openssl/openssl/test/recipes/15-test_ecparam.t +++ b/deps/openssl/openssl/test/recipes/15-test_ecparam.t @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -13,7 +13,7 @@ use warnings; use File::Spec; use File::Compare qw/compare_text/; use OpenSSL::Glob; -use OpenSSL::Test qw/:DEFAULT data_file/; +use OpenSSL::Test qw/:DEFAULT data_file srctop_file bldtop_dir/; use OpenSSL::Test::Utils; setup("test_ecparam"); @@ -25,7 +25,7 @@ my @valid = glob(data_file("valid", "*.pem")); my @noncanon = glob(data_file("noncanon", "*.pem")); my @invalid = glob(data_file("invalid", "*.pem")); -plan tests => 11; +plan tests => 12; sub checkload { my $files = shift; # List of files @@ -59,6 +59,8 @@ sub checkcompare { } } +my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0); + subtest "Check loading valid parameters by ecparam with -check" => sub { plan tests => scalar(@valid); checkload(\@valid, 1, "ecparam", "-check"); @@ -113,3 +115,31 @@ subtest "Check pkeyparam does not change the parameter file on output" => sub { plan tests => 2 * scalar(@valid); checkcompare(\@valid, "pkeyparam"); }; + +subtest "Check loading of fips and non-fips params" => sub { + plan skip_all => "FIPS is disabled" + if $no_fips; + plan tests => 3; + + my $fipsconf = srctop_file("test", "fips-and-base.cnf"); + my $defaultconf = srctop_file("test", "default.cnf"); + + $ENV{OPENSSL_CONF} = $fipsconf; + + ok(run(app(['openssl', 'ecparam', + '-in', data_file('valid', 'secp384r1-explicit.pem'), + '-check'])), + "Loading explicitly encoded valid curve"); + + ok(run(app(['openssl', 'ecparam', + '-in', data_file('valid', 'secp384r1-named.pem'), + '-check'])), + "Loading named valid curve"); + + ok(!run(app(['openssl', 'ecparam', + '-in', data_file('valid', 'secp112r1-named.pem'), + '-check'])), + "Fail loading named non-fips curve"); + + $ENV{OPENSSL_CONF} = $defaultconf; +}; diff --git a/deps/openssl/openssl/test/recipes/15-test_rsapss.t b/deps/openssl/openssl/test/recipes/15-test_rsapss.t index 69a5b7b0eb5..12719663d97 100644 --- a/deps/openssl/openssl/test/recipes/15-test_rsapss.t +++ b/deps/openssl/openssl/test/recipes/15-test_rsapss.t @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -16,7 +16,7 @@ use OpenSSL::Test::Utils; setup("test_rsapss"); -plan tests => 7; +plan tests => 9; #using test/testrsa.pem which happens to be a 512 bit RSA ok(run(app(['openssl', 'dgst', '-sign', srctop_file('test', 'testrsa.pem'), '-sha1', @@ -64,3 +64,13 @@ ok(run(app(['openssl', 'dgst', '-prverify', srctop_file('test', 'testrsa.pem'), '-signature', 'testrsapss-unrestricted.sig', srctop_file('test', 'testrsa.pem')])), "openssl dgst -prverify [plain RSA key, PSS padding mode, no PSS restrictions]"); + +# Test that RSA-PSS keys are supported by genpkey and rsa commands. +{ + my $rsapss = "rsapss.key"; + ok(run(app(['openssl', 'genpkey', '-algorithm', 'RSA-PSS', + '-pkeyopt', 'rsa_keygen_bits:1024', + '--out', $rsapss]))); + ok(run(app(['openssl', 'rsa', '-check', + '-in', $rsapss]))); +} diff --git a/deps/openssl/openssl/test/recipes/30-test_evp_data/evpciph_aes_stitched.txt b/deps/openssl/openssl/test/recipes/30-test_evp_data/evpciph_aes_stitched.txt index 40e2695fb21..ef2d1a27f98 100644 --- a/deps/openssl/openssl/test/recipes/30-test_evp_data/evpciph_aes_stitched.txt +++ b/deps/openssl/openssl/test/recipes/30-test_evp_data/evpciph_aes_stitched.txt @@ -124,25 +124,3 @@ TLSVersion = 0x0302 Plaintext = 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f Ciphertext = 261cd0c88a4d4e6db7fc263257a9f6d0ce83c1ff5f2680dc57ffd8eefdbb9c00d3d507672d105a990b2b78509978625b9d93c2bd41e3fb721abd1496553c583c67dad9b662b3d58c8540e10ed9c5ed1a7f33ce9e9a41c30836651d73ee2c003af03a919eb41a6d70ef814e184e740f8a96221b924d9d025ef5e7150d4ca76921a025dd146fef87da738877313f11ec8f4c558b878c28ce6a9a5011d70f58c5dbd3412cf0a32154f5a4286958a5a50a86f15119835ceccf432601e4cc688cdd682ac9620500b60c0760bb93209859823778a7f2b5bab1af259bda13d84f952af9d2f07f500dadedc41a2b6a737a1296e0b2fb96ac4da4bf71fe2f0c4a1b6fc4dd251087e4c03d2e28c85a9b4a835ef166b48e5b7690f332a1d8db7bd9380221891f31ee82f4b8dd9ebf540cab583a0f33 NextIV = 1f31ee82f4b8dd9ebf540cab583a0f33 - -Title = RC4-HMAC-MD5 test vectors - -Availablein = legacy -Cipher = RC4-HMAC-MD5 -Key = d48ecc0a163a06626bd1b7e172dfb5b3 -MACKey = 5973581f63768353af37d3f51ec9f6ef -TLSAAD = 90a1b2c3e4f506172803010050 -TLSVersion = 0x0301 -Plaintext = 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f -Ciphertext = eea8eba927d9b16c640958f922b3ca43b197eea520674aa1d059156dfd4c12249e2890e8f3c72676e20fe4a30848c1cc6c12f4596d6e290b5f84745ac36959645ea4acabc84e748b2fd5e4228a2fe4f8d44460dfb9a0fce1faf00f1fc7159c3c -Operation = ENCRYPT - -Availablein = legacy -Cipher = RC4-HMAC-MD5 -Key = d48ecc0a163a06626bd1b7e172dfb5b3 -MACKey = 5973581f63768353af37d3f51ec9f6ef -TLSAAD = 90a1b2c3e4f506172803010060 -TLSVersion = 0x0301 -Plaintext = 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f -Ciphertext = eea8eba927d9b16c640958f922b3ca43b197eea520674aa1d059156dfd4c12249e2890e8f3c72676e20fe4a30848c1cc6c12f4596d6e290b5f84745ac36959645ea4acabc84e748b2fd5e4228a2fe4f8d44460dfb9a0fce1faf00f1fc7159c3c -Operation = DECRYPT diff --git a/deps/openssl/openssl/test/recipes/30-test_evp_data/evpciph_rc4_stitched.txt b/deps/openssl/openssl/test/recipes/30-test_evp_data/evpciph_rc4_stitched.txt index a41ddab0f2c..e421c5e97d7 100644 --- a/deps/openssl/openssl/test/recipes/30-test_evp_data/evpciph_rc4_stitched.txt +++ b/deps/openssl/openssl/test/recipes/30-test_evp_data/evpciph_rc4_stitched.txt @@ -7,7 +7,7 @@ MACKey = 5973581f63768353af37d3f51ec9f6ef TLSAAD = 90a1b2c3e4f506172803010050 TLSVersion = 0x0301 Plaintext = 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f -Ciphertext = eea8eba927d9b16c640958f922b3ca43b197eea520674aa1d059156dfd4c12249e2890e8f3c72676e20fe4a30848c1cc6c12f4596d6e290b5f84745ac36959645ea4acabc84e748b2fd5e4228a2fe4f8d44460dfb9a0fce1faf00f1fc7159c3c +Ciphertext = eea8eba927d9b16c640958f922b3ca43b197eea520674aa1d059156dfd4c12249e2890e8f3c72676e20fe4a30848c1cc6c12f4596d6e290b5f84745ac36959645ea4acabc84e748b2fd5e4228a2fe4f8c5792501fca9d8455160d626dc1a9716 # DECRYPT must be a separate entry due to change in TLSAAD value Operation = ENCRYPT @@ -18,5 +18,5 @@ MACKey = 5973581f63768353af37d3f51ec9f6ef TLSAAD = 90a1b2c3e4f506172803010060 TLSVersion = 0x0301 Plaintext = 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f -Ciphertext = eea8eba927d9b16c640958f922b3ca43b197eea520674aa1d059156dfd4c12249e2890e8f3c72676e20fe4a30848c1cc6c12f4596d6e290b5f84745ac36959645ea4acabc84e748b2fd5e4228a2fe4f8d44460dfb9a0fce1faf00f1fc7159c3c +Ciphertext = eea8eba927d9b16c640958f922b3ca43b197eea520674aa1d059156dfd4c12249e2890e8f3c72676e20fe4a30848c1cc6c12f4596d6e290b5f84745ac36959645ea4acabc84e748b2fd5e4228a2fe4f8c5792501fca9d8455160d626dc1a9716 Operation = DECRYPT diff --git a/deps/openssl/openssl/test/recipes/30-test_evp_data/evpmac_poly1305.txt b/deps/openssl/openssl/test/recipes/30-test_evp_data/evpmac_poly1305.txt index dcd3c6d369f..fed44dbd26d 100644 --- a/deps/openssl/openssl/test/recipes/30-test_evp_data/evpmac_poly1305.txt +++ b/deps/openssl/openssl/test/recipes/30-test_evp_data/evpmac_poly1305.txt @@ -1,5 +1,5 @@ # -# Copyright 2001-2020 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2001-2022 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -17,51 +17,60 @@ MAC = Poly1305 Key = 0000000000000000000000000000000000000000000000000000000000000000 Input = 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Output = 00000000000000000000000000000000 +NoReinit = 1 MAC = Poly1305 Key = 0000000000000000000000000000000036e5f6b5c5e06070f0efca96227a863e Input = 416e79207375626d697373696f6e20746f20746865204945544620696e74656e6465642062792074686520436f6e7472696275746f7220666f72207075626c69636174696f6e20617320616c6c206f722070617274206f6620616e204945544620496e7465726e65742d4472616674206f722052464320616e6420616e792073746174656d656e74206d6164652077697468696e2074686520636f6e74657874206f6620616e204945544620616374697669747920697320636f6e7369646572656420616e20224945544620436f6e747269627574696f6e222e20537563682073746174656d656e747320696e636c756465206f72616c2073746174656d656e747320696e20494554462073657373696f6e732c2061732077656c6c206173207772697474656e20616e6420656c656374726f6e696320636f6d6d756e69636174696f6e73206d61646520617420616e792074696d65206f7220706c6163652c207768696368206172652061646472657373656420746f Output = 36e5f6b5c5e06070f0efca96227a863e +NoReinit = 1 MAC = Poly1305 Key = 36e5f6b5c5e06070f0efca96227a863e00000000000000000000000000000000 Input = 416e79207375626d697373696f6e20746f20746865204945544620696e74656e6465642062792074686520436f6e7472696275746f7220666f72207075626c69636174696f6e20617320616c6c206f722070617274206f6620616e204945544620496e7465726e65742d4472616674206f722052464320616e6420616e792073746174656d656e74206d6164652077697468696e2074686520636f6e74657874206f6620616e204945544620616374697669747920697320636f6e7369646572656420616e20224945544620436f6e747269627574696f6e222e20537563682073746174656d656e747320696e636c756465206f72616c2073746174656d656e747320696e20494554462073657373696f6e732c2061732077656c6c206173207772697474656e20616e6420656c656374726f6e696320636f6d6d756e69636174696f6e73206d61646520617420616e792074696d65206f7220706c6163652c207768696368206172652061646472657373656420746f Output = f3477e7cd95417af89a6b8794c310cf0 +NoReinit = 1 MAC = Poly1305 Key = 1c9240a5eb55d38af333888604f6b5f0473917c1402b80099dca5cbc207075c0 Input = 2754776173206272696c6c69672c20616e642074686520736c6974687920746f7665730a446964206779726520616e642067696d626c6520696e2074686520776162653a0a416c6c206d696d737920776572652074686520626f726f676f7665732c0a416e6420746865206d6f6d65207261746873206f757467726162652e Output = 4541669a7eaaee61e708dc7cbcc5eb62 +NoReinit = 1 # If one uses 130-bit partial reduction, does the code handle the case where partially reduced final result is not fully reduced? MAC = Poly1305 Key = 0200000000000000000000000000000000000000000000000000000000000000 Input = FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF Output = 03000000000000000000000000000000 +NoReinit = 1 # What happens if addition of s overflows modulo 2^128? MAC = Poly1305 Key = 02000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF Input = 02000000000000000000000000000000 Output = 03000000000000000000000000000000 +NoReinit = 1 # What happens if data limb is all ones and there is carry from lower limb? MAC = Poly1305 Key = 0100000000000000000000000000000000000000000000000000000000000000 Input = FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFF11000000000000000000000000000000 Output = 05000000000000000000000000000000 +NoReinit = 1 # What happens if final result from polynomial part is exactly 2^130-5? MAC = Poly1305 Key = 0100000000000000000000000000000000000000000000000000000000000000 Input = FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBFEFEFEFEFEFEFEFEFEFEFEFEFEFEFE01010101010101010101010101010101 Output = 00000000000000000000000000000000 +NoReinit = 1 # What happens if final result from polynomial part is exactly 2^130-6? MAC = Poly1305 Key = 0200000000000000000000000000000000000000000000000000000000000000 Input = FDFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF Output = FAFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF +NoReinit = 1 # Taken from poly1305_internal_test.c # More RFC7539 @@ -70,6 +79,7 @@ MAC = Poly1305 Input = 43727970746f6772617068696320466f72756d2052657365617263682047726f7570 Key = 85d6be7857556d337f4452fe42d506a80103808afb0db2fd4abff6af4149f51b Output = a8061dc1305136c6c22b8baf0c0127a9 +NoReinit = 1 # test vectors from "The Poly1305-AES message-authentication code" @@ -77,22 +87,26 @@ MAC = Poly1305 Input = f3f6 Key = 851fc40c3467ac0be05cc20404f3f700580b3b0f9447bb1e69d095b5928b6dbc Output = f4c633c3044fc145f84f335cb81953de +NoReinit = 1 # No input? # # MAC = Poly1305 # Input = # Key = a0f3080000f46400d0c7e9076c834403dd3fab2251f11ac759f0887129cc2ee7 # Output = dd3fab2251f11ac759f0887129cc2ee7 +# NoReinit = 1 MAC = Poly1305 Input = 663cea190ffb83d89593f3f476b6bc24d7e679107ea26adb8caf6652d0656136 Key = 48443d0bb0d21109c89a100b5ce2c20883149c69b561dd88298a1798b10716ef Output = 0ee1c16bb73f0f4fd19881753c01cdbe +NoReinit = 1 MAC = Poly1305 Input = ab0812724a7f1e342742cbed374d94d136c6b8795d45b3819830f2c04491faf0990c62e48b8018b2c3e4a0fa3134cb67fa83e158c994d961c4cb21095c1bf9 Key = 12976a08c4426d0ce8a82407c4f4820780f8c20aa71202d1e29179cbcb555a57 Output = 5154ad0d2cb26e01274fc51148491f1b +NoReinit = 1 # self-generated vectors exercise "significant" length such that* are handled by different code paths @@ -100,46 +114,55 @@ MAC = Poly1305 Input = ab0812724a7f1e342742cbed374d94d136c6b8795d45b3819830f2c04491faf0990c62e48b8018b2c3e4a0fa3134cb67fa83e158c994d961c4cb21095c1bf9af Key = 12976a08c4426d0ce8a82407c4f4820780f8c20aa71202d1e29179cbcb555a57 Output = 812059a5da198637cac7c4a631bee466 +NoReinit = 1 MAC = Poly1305 Input = ab0812724a7f1e342742cbed374d94d136c6b8795d45b3819830f2c04491faf0990c62e48b8018b2c3e4a0fa3134cb67 Key = 12976a08c4426d0ce8a82407c4f4820780f8c20aa71202d1e29179cbcb555a57 Output = 5b88d7f6228b11e2e28579a5c0c1f761 +NoReinit = 1 MAC = Poly1305 Input = ab0812724a7f1e342742cbed374d94d136c6b8795d45b3819830f2c04491faf0990c62e48b8018b2c3e4a0fa3134cb67fa83e158c994d961c4cb21095c1bf9af663cea190ffb83d89593f3f476b6bc24d7e679107ea26adb8caf6652d0656136 Key = 12976a08c4426d0ce8a82407c4f4820780f8c20aa71202d1e29179cbcb555a57 Output = bbb613b2b6d753ba07395b916aaece15 +NoReinit = 1 MAC = Poly1305 Input = ab0812724a7f1e342742cbed374d94d136c6b8795d45b3819830f2c04491faf0990c62e48b8018b2c3e4a0fa3134cb67fa83e158c994d961c4cb21095c1bf9af48443d0bb0d21109c89a100b5ce2c20883149c69b561dd88298a1798b10716ef663cea190ffb83d89593f3f476b6bc24 Key = 12976a08c4426d0ce8a82407c4f4820780f8c20aa71202d1e29179cbcb555a57 Output = c794d7057d1778c4bbee0a39b3d97342 +NoReinit = 1 MAC = Poly1305 Input = ab0812724a7f1e342742cbed374d94d136c6b8795d45b3819830f2c04491faf0990c62e48b8018b2c3e4a0fa3134cb67fa83e158c994d961c4cb21095c1bf9af48443d0bb0d21109c89a100b5ce2c20883149c69b561dd88298a1798b10716ef663cea190ffb83d89593f3f476b6bc24d7e679107ea26adb8caf6652d0656136 Key = 12976a08c4426d0ce8a82407c4f4820780f8c20aa71202d1e29179cbcb555a57 Output = ffbcb9b371423152d7fca5ad042fbaa9 +NoReinit = 1 MAC = Poly1305 Input = ab0812724a7f1e342742cbed374d94d136c6b8795d45b3819830f2c04491faf0990c62e48b8018b2c3e4a0fa3134cb67fa83e158c994d961c4cb21095c1bf9af48443d0bb0d21109c89a100b5ce2c20883149c69b561dd88298a1798b10716ef663cea190ffb83d89593f3f476b6bc24d7e679107ea26adb8caf6652d0656136812059a5da198637cac7c4a631bee466 Key = 12976a08c4426d0ce8a82407c4f4820780f8c20aa71202d1e29179cbcb555a57 Output = 069ed6b8ef0f207b3e243bb1019fe632 +NoReinit = 1 MAC = Poly1305 Input = ab0812724a7f1e342742cbed374d94d136c6b8795d45b3819830f2c04491faf0990c62e48b8018b2c3e4a0fa3134cb67fa83e158c994d961c4cb21095c1bf9af48443d0bb0d21109c89a100b5ce2c20883149c69b561dd88298a1798b10716ef663cea190ffb83d89593f3f476b6bc24d7e679107ea26adb8caf6652d0656136812059a5da198637cac7c4a631bee4665b88d7f6228b11e2e28579a5c0c1f761 Key = 12976a08c4426d0ce8a82407c4f4820780f8c20aa71202d1e29179cbcb555a57 Output = cca339d9a45fa2368c2c68b3a4179133 +NoReinit = 1 MAC = Poly1305 Input = ab0812724a7f1e342742cbed374d94d136c6b8795d45b3819830f2c04491faf0990c62e48b8018b2c3e4a0fa3134cb67fa83e158c994d961c4cb21095c1bf9af48443d0bb0d21109c89a100b5ce2c20883149c69b561dd88298a1798b10716ef663cea190ffb83d89593f3f476b6bc24d7e679107ea26adb8caf6652d0656136812059a5da198637cac7c4a631bee4665b88d7f6228b11e2e28579a5c0c1f761ab0812724a7f1e342742cbed374d94d136c6b8795d45b3819830f2c04491faf0990c62e48b8018b2c3e4a0fa3134cb67fa83e158c994d961c4cb21095c1bf9af48443d0bb0d21109c89a100b5ce2c20883149c69b561dd88298a1798b10716ef663cea190ffb83d89593f3f476b6bc24d7e679107ea26adb8caf6652d0656136 Key = 12976a08c4426d0ce8a82407c4f4820780f8c20aa71202d1e29179cbcb555a57 Output = 53f6e828a2f0fe0ee815bf0bd5841a34 +NoReinit = 1 MAC = Poly1305 Input = ab0812724a7f1e342742cbed374d94d136c6b8795d45b3819830f2c04491faf0990c62e48b8018b2c3e4a0fa3134cb67fa83e158c994d961c4cb21095c1bf9af48443d0bb0d21109c89a100b5ce2c20883149c69b561dd88298a1798b10716ef663cea190ffb83d89593f3f476b6bc24d7e679107ea26adb8caf6652d0656136812059a5da198637cac7c4a631bee4665b88d7f6228b11e2e28579a5c0c1f761ab0812724a7f1e342742cbed374d94d136c6b8795d45b3819830f2c04491faf0990c62e48b8018b2c3e4a0fa3134cb67fa83e158c994d961c4cb21095c1bf9af48443d0bb0d21109c89a100b5ce2c20883149c69b561dd88298a1798b10716ef663cea190ffb83d89593f3f476b6bc24d7e679107ea26adb8caf6652d0656136812059a5da198637cac7c4a631bee4665b88d7f6228b11e2e28579a5c0c1f761 Key = 12976a08c4426d0ce8a82407c4f4820780f8c20aa71202d1e29179cbcb555a57 Output = b846d44e9bbd53cedffbfbb6b7fa4933 +NoReinit = 1 # 4th power of the key spills to 131th bit in SIMD key setup @@ -147,6 +170,7 @@ MAC = Poly1305 Input = ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff Key = ad628107e8351d0f2c231a05dc4a410600000000000000000000000000000000 Output = 07145a4c02fe5fa32036de68fabe9066 +NoReinit = 1 # poly1305_ieee754.c failed this in final stage @@ -154,6 +178,7 @@ MAC = Poly1305 Input = 842364e156336c0998b933a6237726180d9e3fdcbde4cd5d17080fc3beb49614d7122c037463ff104d73f19c12704628d417c4c54a3fe30d3c3d7714382d43b0382a50a5dee54be844b076e8df88201a1cd43b90eb21643fa96f39b518aa8340c942ff3c31baf7c9bdbf0f31ae3fa096bf8c63030609829fe72e179824890bc8e08c315c1cce2a83144dbbff09f74e3efc770b54d0984a8f19b14719e63635641d6b1eedf63efbf080e1783d32445412114c20de0b837a0dfa33d6b82825fff44c9a70ea54ce47f07df698e6b03323b53079364a5fc3e9dd034392bdde86dccdda94321c5e44060489336cb65bf3989c36f7282c2f5d2b882c171e74 Key = 95d5c005503e510d8cd0aa072c4a4d066eabc52d11653df47fbf63ab198bcc26 Output = f248312e578d9d58f8b7bb4d19105431 +NoReinit = 1 # AVX2 in poly1305-x86.pl failed this with 176+32 split @@ -161,6 +186,7 @@ MAC = Poly1305 Input = 248ac31085b6c2adaaa38259a0d7192c5c35d1bb4ef39ad94c38d1c82479e2dd2159a077024b0589bc8a20101b506f0a1ad0bbab76e83a83f1b94be6beae74e874cab692c5963a75436b776121ec9f62399a3e66b2d22707dae81933b6277f3c8516bcbe26dbbd86f373103d7cf4cad1888c952118fbfbd0d7b4bedc4ae4936aff91157e7aa47c54442ea78d6ac251d324a0fbe49d89cc3521b66d16e9c66a3709894e4eb0a4eedc4ae19468e66b81f271351b1d921ea551047abcc6b87a901fde7db79fa1818c11336dbc07244a40eb Key = 000102030405060708090a0b0c0d0e0f00000000000000000000000000000000 Output = bc939bc5281480fa99c6d68c258ec42f +NoReinit = 1 # test vectors from Google @@ -169,26 +195,31 @@ Output = bc939bc5281480fa99c6d68c258ec42f # Input = # Key = c8afaac331ee372cd6082de134943b174710130e9f6fea8d72293850a667d86c # Output = 4710130e9f6fea8d72293850a667d86c +# NoReinit = 1 MAC = Poly1305 Input = 48656c6c6f20776f726c6421 Key = 746869732069732033322d62797465206b657920666f7220506f6c7931333035 Output = a6f745008f81c916a20dcc74eef2b2f0 +NoReinit = 1 MAC = Poly1305 Input = 0000000000000000000000000000000000000000000000000000000000000000 Key = 746869732069732033322d62797465206b657920666f7220506f6c7931333035 Output = 49ec78090e481ec6c26b33b91ccc0307 +NoReinit = 1 MAC = Poly1305 Input = 89dab80b7717c1db5db437860a3f70218e93e1b8f461fb677f16f35f6f87e2a91c99bc3a47ace47640cc95c345be5ecca5a3523c35cc01893af0b64a620334270372ec12482d1b1e363561698a578b359803495bb4e2ef1930b17a5190b580f141300df30adbeca28f6427a8bc1a999fd51c554a017d095d8c3e3127daf9f595 Key = 2d773be37adb1e4d683bf0075e79c4ee037918535a7f99ccb7040fb5f5f43aea Output = c85d15ed44c378d6b00e23064c7bcd51 +NoReinit = 1 MAC = Poly1305 Input = 000000000000000b170303020000000006db1f1f368d696a810a349c0c714c9a5e7850c2407d721acded95e018d7a85266a6e1289cdb4aeb18da5ac8a2b0026d24a59ad485227f3eaedbb2e7e35e1c66cd60f9abf716dcc9ac42682dd7dab287a7024c4eefc321cc0574e16793e37cec03c5bda42b54c114a80b57af26416c7be742005e20855c73e21dc8e2edc9d435cb6f6059280011c270b71570051c1c9b3052126620bc1e2730fa066c7a509d53c60e5ae1b40aa6e39e49669228c90eecb4a50db32a50bc49e90b4f4b359a1dfd11749cd3867fcf2fb7bb6cd4738f6a4ad6f7ca5058f7618845af9f020f6c3b967b8f4cd4a91e2813b507ae66f2d35c18284f7292186062e10fd5510d18775351ef334e7634ab4743f5b68f49adcab384d3fd75f7390f4006ef2a295c8c7a076ad54546cd25d2107fbe1436c840924aaebe5b370893cd63d1325b8616fc4810886bc152c53221b6df373119393255ee72bcaa880174f1717f9184fa91646f17a24ac55d16bfddca9581a92eda479201f0edbf633600d6066d1ab36d5d2415d71351bbcd608a25108d25641992c1f26c531cf9f90203bc4cc19f5927d834b0a47116d3884bbb164b8ec883d1ac832e56b3918a98601a08d171881541d594db399c6ae6151221745aec814c45b0b05b565436fd6f137aa10a0c0b643761dbd6f9a9dcb99b1a6e690854ce0769cde39761d82fcdec15f0d92d7d8e94ade8eb83fbe0 Key = 99e5822dd4173c995e3dae0ddefb97743fde3b080134b39f76e9bf8d0e88d546 Output = 2637408fe13086ea73f971e3425e2820 +NoReinit = 1 # test vectors from Hanno Bock @@ -196,26 +227,31 @@ MAC = Poly1305 Input = cccccccccccccccccccccccccccccccccccccccccccccccccc80ccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccceccccccccccccccccccccccccccccccccccccc5cccccccccccccccccccccccccccccccccccccccccce3ccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccaccccccccccccccccccccce6cccccccccc000000afccccccccccccccccccfffffff5000000000000000000000000000000000000000000000000000000ffffffe70000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000719205a8521dfc Key = 7f1b02640000000000000000000000000000000000000000cccccccccccccccc Output = 8559b876eceed66eb37798c0457baff9 +NoReinit = 1 MAC = Poly1305 Input = aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa000000000000000000800264 Key = e00016000000000000000000000000000000aaaaaaaaaaaaaaaaaaaaaaaaaaaa Output = 00bd1258978e205444c9aaaa82006fed +NoReinit = 1 MAC = Poly1305 Input = 02fc Key = 0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c Output = 06120c0c0c0c0c0c0c0c0c0c0c0c0c0c +NoReinit = 1 MAC = Poly1305 Input = 7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7a7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b5c7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b6e7b007b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7a7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b5c7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b6e7b001300000000b300000000000000000000000000000000000000000000f20000000000000000000000000000000000002000efff0009000000000000000000000000100000000009000000640000000000000000000000001300000000b300000000000000000000000000000000000000000000f20000000000000000000000000000000000002000efff00090000000000000000007a000010000000000900000064000000000000000000000000000000000000000000000000fc Key = 00ff000000000000000000000000000000000000001e00000000000000007b7b Output = 33205bbf9e9f8f7212ab9e2ab9b7e4a5 +NoReinit = 1 MAC = Poly1305 Input = 77777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777ffffffe9e9acacacacacacacacacacac0000acacec0100acacac2caca2acacacacacacacacacacac64f2 Key = 0000007f0000007f01000020000000000000cf77777777777777777777777777 Output = 02ee7c8c546ddeb1a467e4c3981158b9 +NoReinit = 1 # test vectors from Andrew Moon - nacl @@ -223,48 +259,56 @@ MAC = Poly1305 Input = 8e993b9f48681273c29650ba32fc76ce48332ea7164d96a4476fb8c531a1186ac0dfc17c98dce87b4da7f011ec48c97271d2c20f9b928fe2270d6fb863d51738b48eeee314a7cc8ab932164548e526ae90224368517acfeabd6bb3732bc0e9da99832b61ca01b6de56244a9e88d5f9b37973f622a43d14a6599b1f654cb45a74e355a5 Key = eea6a7251c1e72916d11c2cb214d3c252539121d8e234e652d651fa4c8cff880 Output = f3ffc7703f9400e52a7dfb4b3d3305d9 +NoReinit = 1 # wrap 2^130-5 MAC = Poly1305 Input = ffffffffffffffffffffffffffffffff Key = 0200000000000000000000000000000000000000000000000000000000000000 Output = 03000000000000000000000000000000 +NoReinit = 1 # wrap 2^128 MAC = Poly1305 Input = 02000000000000000000000000000000 Key = 02000000000000000000000000000000ffffffffffffffffffffffffffffffff Output = 03000000000000000000000000000000 +NoReinit = 1 # limb carry MAC = Poly1305 Input = fffffffffffffffffffffffffffffffff0ffffffffffffffffffffffffffffff11000000000000000000000000000000 Key = 0100000000000000000000000000000000000000000000000000000000000000 Output = 05000000000000000000000000000000 +NoReinit = 1 # 2^130-5 MAC = Poly1305 Input = fffffffffffffffffffffffffffffffffbfefefefefefefefefefefefefefefe01010101010101010101010101010101 Key = 0100000000000000000000000000000000000000000000000000000000000000 Output = 00000000000000000000000000000000 +NoReinit = 1 # 2^130-6 MAC = Poly1305 Input = fdffffffffffffffffffffffffffffff Key = 0200000000000000000000000000000000000000000000000000000000000000 Output = faffffffffffffffffffffffffffffff +NoReinit = 1 # 5*H+L reduction intermediate MAC = Poly1305 Input = e33594d7505e43b900000000000000003394d7505e4379cd01000000000000000000000000000000000000000000000001000000000000000000000000000000 Key = 0100000000000000040000000000000000000000000000000000000000000000 Output = 14000000000000005500000000000000 +NoReinit = 1 # 5*H+L reduction final MAC = Poly1305 Input = e33594d7505e43b900000000000000003394d7505e4379cd010000000000000000000000000000000000000000000000 Key = 0100000000000000040000000000000000000000000000000000000000000000 Output = 13000000000000000000000000000000 +NoReinit = 1 # Here are 4 duplicated cases for Poly1305 by EVP_PKEY MAC = Poly1305 by EVP_PKEY diff --git a/deps/openssl/openssl/test/recipes/70-test_tls13hrr.t b/deps/openssl/openssl/test/recipes/70-test_tls13hrr.t index 845d40aed9a..faf7302e424 100644 --- a/deps/openssl/openssl/test/recipes/70-test_tls13hrr.t +++ b/deps/openssl/openssl/test/recipes/70-test_tls13hrr.t @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -37,7 +37,8 @@ my $proxy = TLSProxy::Proxy->new( use constant { CHANGE_HRR_CIPHERSUITE => 0, - CHANGE_CH1_CIPHERSUITE => 1 + CHANGE_CH1_CIPHERSUITE => 1, + DUPLICATE_HRR => 2 }; #Test 1: A client should fail if the server changes the ciphersuite between the @@ -50,7 +51,7 @@ if (disabled("ec")) { } my $testtype = CHANGE_HRR_CIPHERSUITE; $proxy->start() or plan skip_all => "Unable to start up Proxy for tests"; -plan tests => 2; +plan tests => 3; ok(TLSProxy::Message->fail(), "Server ciphersuite changes"); #Test 2: It is an error if the client changes the offered ciphersuites so that @@ -66,6 +67,19 @@ $testtype = CHANGE_CH1_CIPHERSUITE; $proxy->start(); ok(TLSProxy::Message->fail(), "Client ciphersuite changes"); +#Test 3: A client should fail with unexpected_message alert if the server +# sends more than 1 HRR +my $fatal_alert = 0; +$proxy->clear(); +if (disabled("ec")) { + $proxy->serverflags("-curves ffdhe3072"); +} else { + $proxy->serverflags("-curves P-256"); +} +$testtype = DUPLICATE_HRR; +$proxy->start(); +ok($fatal_alert, "Server duplicated HRR"); + sub hrr_filter { my $proxy = shift; @@ -86,6 +100,39 @@ sub hrr_filter return; } + if ($testtype == DUPLICATE_HRR) { + # We're only interested in the HRR + # and the unexpected_message alert from client + if ($proxy->flight == 4) { + $fatal_alert = 1 + if @{$proxy->record_list}[-1]->is_fatal_alert(0) == 10; + return; + } + if ($proxy->flight != 3) { + return; + } + + # Find ServerHello record (HRR actually) and insert after that + my $i; + for ($i = 0; ${$proxy->record_list}[$i]->flight() < 1; $i++) { + next; + } + my $hrr_record = ${$proxy->record_list}[$i]; + my $dup_hrr = TLSProxy::Record->new(3, + $hrr_record->content_type(), + $hrr_record->version(), + $hrr_record->len(), + $hrr_record->sslv2(), + $hrr_record->len_real(), + $hrr_record->decrypt_len(), + $hrr_record->data(), + $hrr_record->decrypt_data()); + + $i++; + splice @{$proxy->record_list}, $i, 0, $dup_hrr; + return; + } + # CHANGE_CH1_CIPHERSUITE if ($proxy->flight != 0) { return; diff --git a/deps/openssl/openssl/test/recipes/80-test_cmsapi.t b/deps/openssl/openssl/test/recipes/80-test_cmsapi.t index 8f8a1189a51..af00355a9d6 100644 --- a/deps/openssl/openssl/test/recipes/80-test_cmsapi.t +++ b/deps/openssl/openssl/test/recipes/80-test_cmsapi.t @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2018 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2018-2022 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -17,5 +17,6 @@ plan skip_all => "CMS is disabled in this build" if disabled("cms"); plan tests => 1; ok(run(test(["cmsapitest", srctop_file("test", "certs", "servercert.pem"), - srctop_file("test", "certs", "serverkey.pem")])), + srctop_file("test", "certs", "serverkey.pem"), + srctop_file("test", "recipes", "80-test_cmsapi_data", "encryptedData.der")])), "running cmsapitest"); diff --git a/deps/openssl/openssl/test/recipes/80-test_cmsapi_data/encryptedData.der b/deps/openssl/openssl/test/recipes/80-test_cmsapi_data/encryptedData.der Binary files differnew file mode 100644 index 00000000000..4421d08a3e3 --- /dev/null +++ b/deps/openssl/openssl/test/recipes/80-test_cmsapi_data/encryptedData.der diff --git a/deps/openssl/openssl/test/recipes/80-test_ocsp.t b/deps/openssl/openssl/test/recipes/80-test_ocsp.t index d42030cb89f..c2299962523 100644 --- a/deps/openssl/openssl/test/recipes/80-test_ocsp.t +++ b/deps/openssl/openssl/test/recipes/80-test_ocsp.t @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2015-2022 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -35,6 +35,7 @@ sub test_ocsp { $untrusted = $CAfile; } my $expected_exit = shift; + my $nochecks = shift; my $outputfile = basename($inputfile, '.ors') . '.dat'; run(app(["openssl", "base64", "-d", @@ -45,7 +46,8 @@ sub test_ocsp { "-partial_chain", @check_time, "-CAfile", catfile($ocspdir, $CAfile), "-verify_other", catfile($ocspdir, $untrusted), - "-no-CApath", "-no-CAstore"])), + "-no-CApath", "-no-CAstore", + $nochecks ? "-no_cert_checks" : ()])), $title); }); } @@ -55,143 +57,149 @@ subtest "=== VALID OCSP RESPONSES ===" => sub { plan tests => 7; test_ocsp("NON-DELEGATED; Intermediate CA -> EE", - "ND1.ors", "ND1_Issuer_ICA.pem", "", 0); + "ND1.ors", "ND1_Issuer_ICA.pem", "", 0, 0); test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA", - "ND2.ors", "ND2_Issuer_Root.pem", "", 0); + "ND2.ors", "ND2_Issuer_Root.pem", "", 0, 0); test_ocsp("NON-DELEGATED; Root CA -> EE", - "ND3.ors", "ND3_Issuer_Root.pem", "", 0); + "ND3.ors", "ND3_Issuer_Root.pem", "", 0, 0); test_ocsp("NON-DELEGATED; 3-level CA hierarchy", - "ND1.ors", "ND1_Cross_Root.pem", "ND1_Issuer_ICA-Cross.pem", 0); + "ND1.ors", "ND1_Cross_Root.pem", "ND1_Issuer_ICA-Cross.pem", 0, 0); test_ocsp("DELEGATED; Intermediate CA -> EE", - "D1.ors", "D1_Issuer_ICA.pem", "", 0); + "D1.ors", "D1_Issuer_ICA.pem", "", 0, 0); test_ocsp("DELEGATED; Root CA -> Intermediate CA", - "D2.ors", "D2_Issuer_Root.pem", "", 0); + "D2.ors", "D2_Issuer_Root.pem", "", 0, 0); test_ocsp("DELEGATED; Root CA -> EE", - "D3.ors", "D3_Issuer_Root.pem", "", 0); + "D3.ors", "D3_Issuer_Root.pem", "", 0, 0); }; subtest "=== INVALID SIGNATURE on the OCSP RESPONSE ===" => sub { plan tests => 6; test_ocsp("NON-DELEGATED; Intermediate CA -> EE", - "ISOP_ND1.ors", "ND1_Issuer_ICA.pem", "", 1); + "ISOP_ND1.ors", "ND1_Issuer_ICA.pem", "", 1, 0); test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA", - "ISOP_ND2.ors", "ND2_Issuer_Root.pem", "", 1); + "ISOP_ND2.ors", "ND2_Issuer_Root.pem", "", 1, 0); test_ocsp("NON-DELEGATED; Root CA -> EE", - "ISOP_ND3.ors", "ND3_Issuer_Root.pem", "", 1); + "ISOP_ND3.ors", "ND3_Issuer_Root.pem", "", 1, 0); test_ocsp("DELEGATED; Intermediate CA -> EE", - "ISOP_D1.ors", "D1_Issuer_ICA.pem", "", 1); + "ISOP_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0); test_ocsp("DELEGATED; Root CA -> Intermediate CA", - "ISOP_D2.ors", "D2_Issuer_Root.pem", "", 1); + "ISOP_D2.ors", "D2_Issuer_Root.pem", "", 1, 0); test_ocsp("DELEGATED; Root CA -> EE", - "ISOP_D3.ors", "D3_Issuer_Root.pem", "", 1); + "ISOP_D3.ors", "D3_Issuer_Root.pem", "", 1, 0); }; subtest "=== WRONG RESPONDERID in the OCSP RESPONSE ===" => sub { plan tests => 6; test_ocsp("NON-DELEGATED; Intermediate CA -> EE", - "WRID_ND1.ors", "ND1_Issuer_ICA.pem", "", 1); + "WRID_ND1.ors", "ND1_Issuer_ICA.pem", "", 1, 0); test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA", - "WRID_ND2.ors", "ND2_Issuer_Root.pem", "", 1); + "WRID_ND2.ors", "ND2_Issuer_Root.pem", "", 1, 0); test_ocsp("NON-DELEGATED; Root CA -> EE", - "WRID_ND3.ors", "ND3_Issuer_Root.pem", "", 1); + "WRID_ND3.ors", "ND3_Issuer_Root.pem", "", 1, 0); test_ocsp("DELEGATED; Intermediate CA -> EE", - "WRID_D1.ors", "D1_Issuer_ICA.pem", "", 1); + "WRID_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0); test_ocsp("DELEGATED; Root CA -> Intermediate CA", - "WRID_D2.ors", "D2_Issuer_Root.pem", "", 1); + "WRID_D2.ors", "D2_Issuer_Root.pem", "", 1, 0); test_ocsp("DELEGATED; Root CA -> EE", - "WRID_D3.ors", "D3_Issuer_Root.pem", "", 1); + "WRID_D3.ors", "D3_Issuer_Root.pem", "", 1, 0); }; subtest "=== WRONG ISSUERNAMEHASH in the OCSP RESPONSE ===" => sub { plan tests => 6; test_ocsp("NON-DELEGATED; Intermediate CA -> EE", - "WINH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1); + "WINH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1, 0); test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA", - "WINH_ND2.ors", "ND2_Issuer_Root.pem", "", 1); + "WINH_ND2.ors", "ND2_Issuer_Root.pem", "", 1, 0); test_ocsp("NON-DELEGATED; Root CA -> EE", - "WINH_ND3.ors", "ND3_Issuer_Root.pem", "", 1); + "WINH_ND3.ors", "ND3_Issuer_Root.pem", "", 1, 0); test_ocsp("DELEGATED; Intermediate CA -> EE", - "WINH_D1.ors", "D1_Issuer_ICA.pem", "", 1); + "WINH_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0); test_ocsp("DELEGATED; Root CA -> Intermediate CA", - "WINH_D2.ors", "D2_Issuer_Root.pem", "", 1); + "WINH_D2.ors", "D2_Issuer_Root.pem", "", 1, 0); test_ocsp("DELEGATED; Root CA -> EE", - "WINH_D3.ors", "D3_Issuer_Root.pem", "", 1); + "WINH_D3.ors", "D3_Issuer_Root.pem", "", 1, 0); }; subtest "=== WRONG ISSUERKEYHASH in the OCSP RESPONSE ===" => sub { plan tests => 6; test_ocsp("NON-DELEGATED; Intermediate CA -> EE", - "WIKH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1); + "WIKH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1, 0); test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA", - "WIKH_ND2.ors", "ND2_Issuer_Root.pem", "", 1); + "WIKH_ND2.ors", "ND2_Issuer_Root.pem", "", 1, 0); test_ocsp("NON-DELEGATED; Root CA -> EE", - "WIKH_ND3.ors", "ND3_Issuer_Root.pem", "", 1); + "WIKH_ND3.ors", "ND3_Issuer_Root.pem", "", 1, 0); test_ocsp("DELEGATED; Intermediate CA -> EE", - "WIKH_D1.ors", "D1_Issuer_ICA.pem", "", 1); + "WIKH_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0); test_ocsp("DELEGATED; Root CA -> Intermediate CA", - "WIKH_D2.ors", "D2_Issuer_Root.pem", "", 1); + "WIKH_D2.ors", "D2_Issuer_Root.pem", "", 1, 0); test_ocsp("DELEGATED; Root CA -> EE", - "WIKH_D3.ors", "D3_Issuer_Root.pem", "", 1); + "WIKH_D3.ors", "D3_Issuer_Root.pem", "", 1, 0); }; subtest "=== WRONG KEY in the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub { plan tests => 3; test_ocsp("DELEGATED; Intermediate CA -> EE", - "WKDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1); + "WKDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0); test_ocsp("DELEGATED; Root CA -> Intermediate CA", - "WKDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1); + "WKDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1, 0); test_ocsp("DELEGATED; Root CA -> EE", - "WKDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1); + "WKDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1, 0); }; subtest "=== INVALID SIGNATURE on the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub { - plan tests => 3; + plan tests => 6; test_ocsp("DELEGATED; Intermediate CA -> EE", - "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1); + "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0); + test_ocsp("DELEGATED; Root CA -> Intermediate CA", + "ISDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1, 0); + test_ocsp("DELEGATED; Root CA -> EE", + "ISDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1, 0); + test_ocsp("DELEGATED; Intermediate CA -> EE", + "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1, 1); test_ocsp("DELEGATED; Root CA -> Intermediate CA", - "ISDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1); + "ISDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1, 1); test_ocsp("DELEGATED; Root CA -> EE", - "ISDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1); + "ISDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1, 1); }; subtest "=== WRONG SUBJECT NAME in the ISSUER CERTIFICATE ===" => sub { plan tests => 6; test_ocsp("NON-DELEGATED; Intermediate CA -> EE", - "ND1.ors", "WSNIC_ND1_Issuer_ICA.pem", "", 1); + "ND1.ors", "WSNIC_ND1_Issuer_ICA.pem", "", 1, 0); test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA", - "ND2.ors", "WSNIC_ND2_Issuer_Root.pem", "", 1); + "ND2.ors", "WSNIC_ND2_Issuer_Root.pem", "", 1, 0); test_ocsp("NON-DELEGATED; Root CA -> EE", - "ND3.ors", "WSNIC_ND3_Issuer_Root.pem", "", 1); + "ND3.ors", "WSNIC_ND3_Issuer_Root.pem", "", 1, 0); test_ocsp("DELEGATED; Intermediate CA -> EE", - "D1.ors", "WSNIC_D1_Issuer_ICA.pem", "", 1); + "D1.ors", "WSNIC_D1_Issuer_ICA.pem", "", 1, 0); test_ocsp("DELEGATED; Root CA -> Intermediate CA", - "D2.ors", "WSNIC_D2_Issuer_Root.pem", "", 1); + "D2.ors", "WSNIC_D2_Issuer_Root.pem", "", 1, 0); test_ocsp("DELEGATED; Root CA -> EE", - "D3.ors", "WSNIC_D3_Issuer_Root.pem", "", 1); + "D3.ors", "WSNIC_D3_Issuer_Root.pem", "", 1, 0); }; subtest "=== WRONG KEY in the ISSUER CERTIFICATE ===" => sub { plan tests => 6; test_ocsp("NON-DELEGATED; Intermediate CA -> EE", - "ND1.ors", "WKIC_ND1_Issuer_ICA.pem", "", 1); + "ND1.ors", "WKIC_ND1_Issuer_ICA.pem", "", 1, 0); test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA", - "ND2.ors", "WKIC_ND2_Issuer_Root.pem", "", 1); + "ND2.ors", "WKIC_ND2_Issuer_Root.pem", "", 1, 0); test_ocsp("NON-DELEGATED; Root CA -> EE", - "ND3.ors", "WKIC_ND3_Issuer_Root.pem", "", 1); + "ND3.ors", "WKIC_ND3_Issuer_Root.pem", "", 1, 0); test_ocsp("DELEGATED; Intermediate CA -> EE", - "D1.ors", "WKIC_D1_Issuer_ICA.pem", "", 1); + "D1.ors", "WKIC_D1_Issuer_ICA.pem", "", 1, 0); test_ocsp("DELEGATED; Root CA -> Intermediate CA", - "D2.ors", "WKIC_D2_Issuer_Root.pem", "", 1); + "D2.ors", "WKIC_D2_Issuer_Root.pem", "", 1, 0); test_ocsp("DELEGATED; Root CA -> EE", - "D3.ors", "WKIC_D3_Issuer_Root.pem", "", 1); + "D3.ors", "WKIC_D3_Issuer_Root.pem", "", 1, 0); }; subtest "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" => sub { @@ -199,17 +207,17 @@ subtest "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" => sub { # Expect success, because we're explicitly trusting the issuer certificate. test_ocsp("NON-DELEGATED; Intermediate CA -> EE", - "ND1.ors", "ISIC_ND1_Issuer_ICA.pem", "", 0); + "ND1.ors", "ISIC_ND1_Issuer_ICA.pem", "", 0, 0); test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA", - "ND2.ors", "ISIC_ND2_Issuer_Root.pem", "", 0); + "ND2.ors", "ISIC_ND2_Issuer_Root.pem", "", 0, 0); test_ocsp("NON-DELEGATED; Root CA -> EE", - "ND3.ors", "ISIC_ND3_Issuer_Root.pem", "", 0); + "ND3.ors", "ISIC_ND3_Issuer_Root.pem", "", 0, 0); test_ocsp("DELEGATED; Intermediate CA -> EE", - "D1.ors", "ISIC_D1_Issuer_ICA.pem", "", 0); + "D1.ors", "ISIC_D1_Issuer_ICA.pem", "", 0, 0); test_ocsp("DELEGATED; Root CA -> Intermediate CA", - "D2.ors", "ISIC_D2_Issuer_Root.pem", "", 0); + "D2.ors", "ISIC_D2_Issuer_Root.pem", "", 0, 0); test_ocsp("DELEGATED; Root CA -> EE", - "D3.ors", "ISIC_D3_Issuer_Root.pem", "", 0); + "D3.ors", "ISIC_D3_Issuer_Root.pem", "", 0, 0); }; subtest "=== OCSP API TESTS===" => sub { diff --git a/deps/openssl/openssl/test/recipes/90-test_sslapi.t b/deps/openssl/openssl/test/recipes/90-test_sslapi.t index b890be62189..70fa7e50e2d 100644 --- a/deps/openssl/openssl/test/recipes/90-test_sslapi.t +++ b/deps/openssl/openssl/test/recipes/90-test_sslapi.t @@ -1,5 +1,5 @@ #! /usr/bin/env perl -# Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -32,14 +32,22 @@ plan tests => ok(run(test(["sslapitest", srctop_dir("test", "certs"), srctop_file("test", "recipes", "90-test_sslapi_data", "passwd.txt"), $tmpfilename, "default", - srctop_file("test", "default.cnf")])), + srctop_file("test", "default.cnf"), + srctop_file("test", + "recipes", + "90-test_sslapi_data", + "dhparams.pem")])), "running sslapitest"); unless ($no_fips) { ok(run(test(["sslapitest", srctop_dir("test", "certs"), srctop_file("test", "recipes", "90-test_sslapi_data", "passwd.txt"), $tmpfilename, "fips", - srctop_file("test", "fips-and-base.cnf")])), + srctop_file("test", "fips-and-base.cnf"), + srctop_file("test", + "recipes", + "90-test_sslapi_data", + "dhparams.pem")])), "running sslapitest"); } diff --git a/deps/openssl/openssl/test/recipes/90-test_sslapi_data/dhparams.pem b/deps/openssl/openssl/test/recipes/90-test_sslapi_data/dhparams.pem new file mode 100644 index 00000000000..6bb2cf89e7c --- /dev/null +++ b/deps/openssl/openssl/test/recipes/90-test_sslapi_data/dhparams.pem @@ -0,0 +1,122 @@ +-----BEGIN PKCS7----- +MIIIGAYJKoZIhvcNAQcCoIIICTCCCAUCAQExADALBgkqhkiG9w0BBwGgggY8MIIE +cjCCBBygAwIBAgIQeS+OJfWJUZAx6cX0eAiMjzANBgkqhkiG9w0BAQQFADBiMREw +DwYDVQQHEwhJbnRlcm5ldDEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNDAyBgNV +BAsTK1ZlcmlTaWduIENsYXNzIDEgQ0EgLSBJbmRpdmlkdWFsIFN1YnNjcmliZXIw +HhcNOTYwNzE5MDAwMDAwWhcNOTcwMzMwMjM1OTU5WjCB1TERMA8GA1UEBxMISW50 +ZXJuZXQxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTQwMgYDVQQLEytWZXJpU2ln +biBDbGFzcyAxIENBIC0gSW5kaXZpZHVhbCBTdWJzY3JpYmVyMSgwJgYDVQQLEx9E +aWdpdGFsIElEIENsYXNzIDEgLSBTTUlNRSBUZXN0MUcwRQYDVQQLEz53d3cudmVy +aXNpZ24uY29tL3JlcG9zaXRvcnkvQ1BTLTEuMCBJbmMuIGJ5IFJlZi4sTElBQi5M +VEQoYyk5NjBbMA0GCSqGSIb3DQEBAQUAA0oAMEcCQA7LvHEIAiQ5+4gDYvJGnGAq +UM5GXyG11diEXmIEZTHUZhorooX5sr8IIjSXiPY59YYUFSvAaharFM1xaBN8zNEC +AwEAAaOCAjkwggI1MAkGA1UdEwQCMAAwggImBgNVHQMEggIdMIICGTCCAhUwggIR +BgtghkgBhvhFAQcBATCCAgAWggGrVGhpcyBjZXJ0aWZpY2F0ZSBpbmNvcnBvcmF0 +ZXMgYnkgcmVmZXJlbmNlLCBhbmQgaXRzIHVzZSBpcyBzdHJpY3RseSBzdWJqZWN0 +IHRvLCB0aGUgVmVyaVNpZ24gQ2VydGlmaWNhdGlvbiBQcmFjdGljZSBTdGF0ZW1l +bnQgKENQUyksIGF2YWlsYWJsZSBhdDogaHR0cHM6Ly93d3cudmVyaXNpZ24uY29t +L0NQUy0xLjA7IGJ5IEUtbWFpbCBhdCBDUFMtcmVxdWVzdHNAdmVyaXNpZ24uY29t +OyBvciBieSBtYWlsIGF0IFZlcmlTaWduLCBJbmMuLCAyNTkzIENvYXN0IEF2ZS4s +IE1vdW50YWluIFZpZXcsIENBIDk0MDQzIFVTQSBUZWwuICsxICg0MTUpIDk2MS04 +ODMwIENvcHlyaWdodCAoYykgMTk5NiBWZXJpU2lnbiwgSW5jLiAgQWxsIFJpZ2h0 +cyBSZXNlcnZlZC4gQ0VSVEFJTiBXQVJSQU5USUVTIERJU0NMQUlNRUQgYW5kIExJ +QUJJTElUWSBMSU1JVEVELqAOBgxghkgBhvhFAQcBAQGhDgYMYIZIAYb4RQEHAQEC +MC8wLRYraHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JlcG9zaXRvcnkvQ1BTLTEu +AzANBgkqhkiG9w0BAQQFAANBAMCYDuSb/eIlYSxY31nZZTaCZkCSfHjlacMofExr +cF+A2yHoEuT+eCQkqM0pMNHXddUeoQ9RjV+VuMBNmm63DUYwggHCMIIBbKADAgEC +AhB8CYTq1bkRFJBYOd67cp9JMA0GCSqGSIb3DQEBAgUAMD4xCzAJBgNVBAYTAlVT +MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEWMBQGA1UECxMNVEVTVCBSb290IFBD +QTAeFw05NjA3MTcwMDAwMDBaFw05NzA3MTcyMzU5NTlaMGIxETAPBgNVBAcTCElu +dGVybmV0MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE0MDIGA1UECxMrVmVyaVNp +Z24gQ2xhc3MgMSBDQSAtIEluZGl2aWR1YWwgU3Vic2NyaWJlcjBcMA0GCSqGSIb3 +DQEBAQUAA0sAMEgCQQDsVzrNgnDhbAJZrWeLd9g1vMZJA2W67D33TTbga6yMt+ES +TWEywhS6RNP+fzLGg7utinjH4tL60cXa0G27GDsLAgMBAAGjIjAgMAsGA1UdDwQE +AwIBBjARBglghkgBhvhCAQEEBAMCAgQwDQYJKoZIhvcNAQECBQADQQAUp6bRwkaD +2d1MBs/mjUcgTI2fXVmW8tTm/Ud6OzUwpC3vYgybiOOA4f6mOC5dbyUHrLOsrihU +47ZQ0Jo1DUfboYIBrTCBwTBtMA0GCSqGSIb3DQEBAgUAMD4xCzAJBgNVBAYTAlVT +MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEWMBQGA1UECxMNVEVTVCBSb290IFBD +QRcNOTYwNzE3MTc0NDA5WhcNOTgwNzE3MDAwMDAwWjANBgkqhkiG9w0BAQIFAANB +AHitA0/xAukCjHzeh1AMT/l2oC68N+yFb+aJPHBBMxc6gG2MaKjBNwb5hcXUllMl +ExONA3ju10f7owIq3s3wx10wgeYwgZEwDQYJKoZIhvcNAQECBQAwYjERMA8GA1UE +BxMISW50ZXJuZXQxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTQwMgYDVQQLEytW +ZXJpU2lnbiBDbGFzcyAxIENBIC0gSW5kaXZpZHVhbCBTdWJzY3JpYmVyFw05NjA3 +MTcxNzU5MjlaFw05NzA3MTgwMDAwMDBaMA0GCSqGSIb3DQEBAgUAA0EAubVWYTsW +sQmste9f+UgMw8BkjDlM25fwQLrCfmmnLxjewey10kSROypUaJLb+r4oRALc0fG9 +XfZsaiiIgotQHjEA +-----END PKCS7----- +-----BEGIN CERTIFICATE----- +MIIHBzCCBO+gAwIBAgIRAIx3oACP9NGwxj2fOkiDjWswDQYJKoZIhvcNAQEMBQAw +fTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G +A1UEBxMHU2FsZm9yZDEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMSUwIwYDVQQD +ExxTZWN0aWdvIFJTQSBUaW1lIFN0YW1waW5nIENBMB4XDTIwMTAyMzAwMDAwMFoX +DTMyMDEyMjIzNTk1OVowgYQxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVy +IE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGDAWBgNVBAoTD1NlY3RpZ28g +TGltaXRlZDEsMCoGA1UEAwwjU2VjdGlnbyBSU0EgVGltZSBTdGFtcGluZyBTaWdu +ZXIgIzIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCRh0ssi8HxHqCe +0wfGAcpSsL55eV0JZgYtLzV9u8D7J9pCalkbJUzq70DWmn4yyGqBfbRcPlYQgTU6 +IjaM+/ggKYesdNAbYrw/ZIcCX+/FgO8GHNxeTpOHuJreTAdOhcxwxQ177MPZ45fp +yxnbVkVs7ksgbMk+bP3wm/Eo+JGZqvxawZqCIDq37+fWuCVJwjkbh4E5y8O3Os2f +UAQfGpmkgAJNHQWoVdNtUoCD5m5IpV/BiVhgiu/xrM2HYxiOdMuEh0FpY4G89h+q +fNfBQc6tq3aLIIDULZUHjcf1CxcemuXWmWlRx06mnSlv53mTDTJjU67MximKIMFg +xvICLMT5yCLf+SeCoYNRwrzJghohhLKXvNSvRByWgiKVKoVUrvH9Pkl0dPyOrj+l +cvTDWgGqUKWLdpUbZuvv2t+ULtka60wnfUwF9/gjXcRXyCYFevyBI19UCTgqYtWq +yt/tz1OrH/ZEnNWZWcVWZFv3jlIPZvyYP0QGE2Ru6eEVYFClsezPuOjJC77FhPfd +Cp3avClsPVbtv3hntlvIXhQcua+ELXei9zmVN29OfxzGPATWMcV+7z3oUX5xrSR0 +Gyzc+Xyq78J2SWhi1Yv1A9++fY4PNnVGW5N2xIPugr4srjcS8bxWw+StQ8O3ZpZe +lDL6oPariVD6zqDzCIEa0USnzPe4MQIDAQABo4IBeDCCAXQwHwYDVR0jBBgwFoAU +GqH4YRkgD8NBd0UojtE1XwYSBFUwHQYDVR0OBBYEFGl1N3u7nTVCTr9X05rbnwHR +rt7QMA4GA1UdDwEB/wQEAwIGwDAMBgNVHRMBAf8EAjAAMBYGA1UdJQEB/wQMMAoG +CCsGAQUFBwMIMEAGA1UdIAQ5MDcwNQYMKwYBBAGyMQECAQMIMCUwIwYIKwYBBQUH +AgEWF2h0dHBzOi8vc2VjdGlnby5jb20vQ1BTMEQGA1UdHwQ9MDswOaA3oDWGM2h0 +dHA6Ly9jcmwuc2VjdGlnby5jb20vU2VjdGlnb1JTQVRpbWVTdGFtcGluZ0NBLmNy +bDB0BggrBgEFBQcBAQRoMGYwPwYIKwYBBQUHMAKGM2h0dHA6Ly9jcnQuc2VjdGln +by5jb20vU2VjdGlnb1JTQVRpbWVTdGFtcGluZ0NBLmNydDAjBggrBgEFBQcwAYYX +aHR0cDovL29jc3Auc2VjdGlnby5jb20wDQYJKoZIhvcNAQEMBQADggIBAEoDeJBC +M+x7GoMJNjOYVbudQAYwa0Vq8ZQOGVD/WyVeO+E5xFu66ZWQNze93/tk7OWCt5XM +V1VwS070qIfdIoWmV7u4ISfUoCoxlIoHIZ6Kvaca9QIVy0RQmYzsProDd6aCApDC +LpOpviE0dWO54C0PzwE3y42i+rhamq6hep4TkxlVjwmQLt/qiBcW62nW4SW9RQiX +gNdUIChPynuzs6XSALBgNGXE48XDpeS6hap6adt1pD55aJo2i0OuNtRhcjwOhWIN +oF5w22QvAcfBoccklKOyPG6yXqLQ+qjRuCUcFubA1X9oGsRlKTUqLYi86q501oLn +wIi44U948FzKwEBcwp/VMhws2jysNvcGUpqjQDAXsCkWmcmqt4hJ9+gLJTO1P22v +n18KVt8SscPuzpF36CAT6Vwkx+pEC0rmE4QcTesNtbiGoDCni6GftCzMwBYjyZHl +QgNLgM7kTeYqAT7AXoWgJKEXQNXb2+eYEKTx6hkbgFT6R4nomIGpdcAO39BolHmh +oJ6OtrdCZsvZ2WsvTdjePjIeIOTsnE1CjZ3HM5mCN0TUJikmQI54L7nu+i/x8Y/+ +ULh43RSW3hwOcLAqhWqxbGjpKuQQK24h/dN8nTfkKgbWw/HXaONPB3mBCBP+smRe +6bE85tB4I7IJLOImYr87qZdRzMdEMoGyr8/f +-----END CERTIFICATE----- +-----BEGIN DH PARAMETERS----- +MIIBDAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz ++8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a +87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7 +YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi +7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD +ssbzSibBsu/6iGtCOGEoXJf//////////wIBAgICB/8= +-----END DH PARAMETERS----- +-----BEGIN PRIVATE KEY----- +MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDNAIHqeyrh6gbV +n3xz2f+5SglhXC5Lp8Y2zvCN01M+wxhVJbAVx2m5mnfWclv5w1Mqm25fZifV+4UW +B2jT3anL01l0URcX3D0wnS/EfuQfl+Mq23+d2GShxHZ6Zm7NcbwarPXnUX9LOFlP +6psF5C1a2pkSAIAT5FMWpNm7jtCGuI0odYusr5ItRqhotIXSOcm66w4rZFknEPQr +LR6gpLSALAvsqzKPimiwBzvbVG/uqYCdKEmRKzkMFTK8finHZY+BdfrkbzQzL/h7 +yrPkBkm5hXeGnaDqcYNT8HInVIhpE2SHYNEivmduD8SD3SD/wxvalqMZZsmqLnWt +A95H4cRPAgMBAAECggEAYCl6x5kbFnoG1rJHWLjL4gi+ubLZ7Jc4vYD5Ci41AF3X +ziktnim6iFvTFv7x8gkTvArJDWsICLJBTYIQREHYYkozzgIzyPeApIs3Wv8C12cS +IopwJITbP56+zM+77hcJ26GCgA2Unp5CFuC/81WDiPi9kNo3Oh2CdD7D+90UJ/0W +glplejFpEuhpU2URfKL4RckJQF/KxV+JX8FdIDhsJu54yemQdQKaF4psHkzwwgDo +qc+yfp0Vb4bmwq3CKxqEoc1cpbJ5CHXXlAfISzUjlcuBzD/tW7BDtp7eDAcgRVAC +XO6MX0QBcLYSC7SOD3R7zY9SIRCFDfBDxCjf0YcFMQKBgQD2+WG0fLwDXTrt68fe +hQqVa2Xs25z2B2QGPxWqSFU8WNly/mZ1BW413f3De/O58vYi7icTNyVoScm+8hdv +6PfD+LuRujdN1TuvPeyBTSvewQwf3IjN0Wh28mse36PwlBl+301C/x+ylxEDuJjK +hZxCcocIaoQqtBC7ac8tNa9r4wKBgQDUfnJKf/QQSLJwwlJKQQGHi3MVm7c9PbwY +eyIOY1s1NPluJDoYTZP4YLa/u2txwe2aHh9FhYMCPDAelqaSwaCLU9DsnKkQEA2A +RR47fcagG6xK7O+N95iEa8I1oIy7os9MBoBMwRIZ6VYIxxTj8UMNSR+tu6MqV1Gg +T5d0WDTJpQKBgCHyRSu5uV39AoyRS/eZ8cp36JqV1Q08FtOE+EVfi9evnrPfo9WR +2YQt7yNfdjCo5IwIj/ZkLhAXlFNakz4el2+oUJ/HKLLaDEoaCNf883q6rh/zABrK +HcG7sF2d/7qhoJ9/se7zgjfZ68zHIrkzhDbd5xGREnmMJoCcGo3sQyBhAoGAH3UQ +qmLC2N5KPFMoJ4H0HgLQ6LQCrnhDLkScSBEBYaEUA/AtAYgKjcyTgVLXlyGkcRpg +esRHHr+WSBD5W+R6ReYEmeKfTJdzyDdzQE9gZjdyjC0DUbsDwybIu3OnIef6VEDq +IXK7oUZfzDDcsNn4mTDoFaoff5cpqFfgDgM43VkCgYBNHw11b+d+AQmaZS9QqIt7 +aF3FvwCYHV0jdv0Mb+Kc1bY4c0R5MFpzrTwVmdOerjuuA1+9b+0Hwo3nBZM4eaBu +SOamA2hu2OJWCl9q8fLCT69KqWDjghhvFe7c6aJJGucwaA3Uz3eLcPqoaCarMiNH +fMkTd7GabVourqIZdgvu1Q== +-----END PRIVATE KEY----- diff --git a/deps/openssl/openssl/test/siphash_internal_test.c b/deps/openssl/openssl/test/siphash_internal_test.c index 03824ea8ec4..76ae5ecabcb 100644 --- a/deps/openssl/openssl/test/siphash_internal_test.c +++ b/deps/openssl/openssl/test/siphash_internal_test.c @@ -1,5 +1,5 @@ /* - * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -262,8 +262,10 @@ static int test_siphash_basic(void) /* Use invalid hash size */ return TEST_int_eq(SipHash_set_hash_size(&siphash, 4), 0) + && TEST_false(SipHash_Final(&siphash, output, 0)) /* Use hash size = 8 */ && TEST_true(SipHash_set_hash_size(&siphash, 8)) + && TEST_false(SipHash_Final(&siphash, output, 8)) && TEST_true(SipHash_Init(&siphash, key, 0, 0)) && TEST_true(SipHash_Final(&siphash, output, 8)) && TEST_int_eq(SipHash_Final(&siphash, output, 16), 0) diff --git a/deps/openssl/openssl/test/ssl_old_test.c b/deps/openssl/openssl/test/ssl_old_test.c index b07b9806249..5fb54a3a2eb 100644 --- a/deps/openssl/openssl/test/ssl_old_test.c +++ b/deps/openssl/openssl/test/ssl_old_test.c @@ -216,7 +216,7 @@ static int servername_cb(SSL *s, int *ad, void *arg) if (servername) { if (s_ctx2 != NULL && sn_server2 != NULL && - !strcasecmp(servername, sn_server2)) { + !OPENSSL_strcasecmp(servername, sn_server2)) { BIO_printf(bio_stdout, "Switching server context.\n"); SSL_set_SSL_CTX(s, s_ctx2); } diff --git a/deps/openssl/openssl/test/sslapitest.c b/deps/openssl/openssl/test/sslapitest.c index 3e0c95300b3..9a8288b75e3 100644 --- a/deps/openssl/openssl/test/sslapitest.c +++ b/deps/openssl/openssl/test/sslapitest.c @@ -94,6 +94,7 @@ static char *cert8192 = NULL; static char *privkey8192 = NULL; static char *srpvfile = NULL; static char *tmpfilename = NULL; +static char *dhfile = NULL; static int is_fips = 0; @@ -9384,6 +9385,68 @@ end: SSL_CTX_free(cctx); return testresult; } + +/* + * Test that the lifetime hint of a TLSv1.3 ticket is no more than 1 week + * 0 = TLSv1.2 + * 1 = TLSv1.3 + */ +static int test_ticket_lifetime(int idx) +{ + SSL_CTX *cctx = NULL, *sctx = NULL; + SSL *clientssl = NULL, *serverssl = NULL; + int testresult = 0; + int version = TLS1_3_VERSION; + +#define ONE_WEEK_SEC (7 * 24 * 60 * 60) +#define TWO_WEEK_SEC (2 * ONE_WEEK_SEC) + + if (idx == 0) { +#ifdef OPENSSL_NO_TLS1_2 + return TEST_skip("TLS 1.2 is disabled."); +#else + version = TLS1_2_VERSION; +#endif + } + + if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(), + TLS_client_method(), version, version, + &sctx, &cctx, cert, privkey))) + goto end; + + if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, + &clientssl, NULL, NULL))) + goto end; + + /* + * Set the timeout to be more than 1 week + * make sure the returned value is the default + */ + if (!TEST_long_eq(SSL_CTX_set_timeout(sctx, TWO_WEEK_SEC), + SSL_get_default_timeout(serverssl))) + goto end; + + if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))) + goto end; + + if (idx == 0) { + /* TLSv1.2 uses the set value */ + if (!TEST_ulong_eq(SSL_SESSION_get_ticket_lifetime_hint(SSL_get_session(clientssl)), TWO_WEEK_SEC)) + goto end; + } else { + /* TLSv1.3 uses the limited value */ + if (!TEST_ulong_le(SSL_SESSION_get_ticket_lifetime_hint(SSL_get_session(clientssl)), ONE_WEEK_SEC)) + goto end; + } + testresult = 1; + +end: + SSL_free(serverssl); + SSL_free(clientssl); + SSL_CTX_free(sctx); + SSL_CTX_free(cctx); + return testresult; +} #endif /* * Test that setting an ALPN does not violate RFC @@ -9457,6 +9520,172 @@ end: return testresult; } +/* + * Test SSL_CTX_set1_verify/chain_cert_store and SSL_CTX_get_verify/chain_cert_store. + */ +static int test_set_verify_cert_store_ssl_ctx(void) +{ + SSL_CTX *ctx = NULL; + int testresult = 0; + X509_STORE *store = NULL, *new_store = NULL, + *cstore = NULL, *new_cstore = NULL; + + /* Create an initial SSL_CTX. */ + ctx = SSL_CTX_new_ex(libctx, NULL, TLS_server_method()); + if (!TEST_ptr(ctx)) + goto end; + + /* Retrieve verify store pointer. */ + if (!TEST_true(SSL_CTX_get0_verify_cert_store(ctx, &store))) + goto end; + + /* Retrieve chain store pointer. */ + if (!TEST_true(SSL_CTX_get0_chain_cert_store(ctx, &cstore))) + goto end; + + /* We haven't set any yet, so this should be NULL. */ + if (!TEST_ptr_null(store) || !TEST_ptr_null(cstore)) + goto end; + + /* Create stores. We use separate stores so pointers are different. */ + new_store = X509_STORE_new(); + if (!TEST_ptr(new_store)) + goto end; + + new_cstore = X509_STORE_new(); + if (!TEST_ptr(new_cstore)) + goto end; + + /* Set stores. */ + if (!TEST_true(SSL_CTX_set1_verify_cert_store(ctx, new_store))) + goto end; + + if (!TEST_true(SSL_CTX_set1_chain_cert_store(ctx, new_cstore))) + goto end; + + /* Should be able to retrieve the same pointer. */ + if (!TEST_true(SSL_CTX_get0_verify_cert_store(ctx, &store))) + goto end; + + if (!TEST_true(SSL_CTX_get0_chain_cert_store(ctx, &cstore))) + goto end; + + if (!TEST_ptr_eq(store, new_store) || !TEST_ptr_eq(cstore, new_cstore)) + goto end; + + /* Should be able to unset again. */ + if (!TEST_true(SSL_CTX_set1_verify_cert_store(ctx, NULL))) + goto end; + + if (!TEST_true(SSL_CTX_set1_chain_cert_store(ctx, NULL))) + goto end; + + /* Should now be NULL. */ + if (!TEST_true(SSL_CTX_get0_verify_cert_store(ctx, &store))) + goto end; + + if (!TEST_true(SSL_CTX_get0_chain_cert_store(ctx, &cstore))) + goto end; + + if (!TEST_ptr_null(store) || !TEST_ptr_null(cstore)) + goto end; + + testresult = 1; + +end: + X509_STORE_free(new_store); + X509_STORE_free(new_cstore); + SSL_CTX_free(ctx); + return testresult; +} + +/* + * Test SSL_set1_verify/chain_cert_store and SSL_get_verify/chain_cert_store. + */ +static int test_set_verify_cert_store_ssl(void) +{ + SSL_CTX *ctx = NULL; + SSL *ssl = NULL; + int testresult = 0; + X509_STORE *store = NULL, *new_store = NULL, + *cstore = NULL, *new_cstore = NULL; + + /* Create an initial SSL_CTX. */ + ctx = SSL_CTX_new_ex(libctx, NULL, TLS_server_method()); + if (!TEST_ptr(ctx)) + goto end; + + /* Create an SSL object. */ + ssl = SSL_new(ctx); + if (!TEST_ptr(ssl)) + goto end; + + /* Retrieve verify store pointer. */ + if (!TEST_true(SSL_get0_verify_cert_store(ssl, &store))) + goto end; + + /* Retrieve chain store pointer. */ + if (!TEST_true(SSL_get0_chain_cert_store(ssl, &cstore))) + goto end; + + /* We haven't set any yet, so this should be NULL. */ + if (!TEST_ptr_null(store) || !TEST_ptr_null(cstore)) + goto end; + + /* Create stores. We use separate stores so pointers are different. */ + new_store = X509_STORE_new(); + if (!TEST_ptr(new_store)) + goto end; + + new_cstore = X509_STORE_new(); + if (!TEST_ptr(new_cstore)) + goto end; + + /* Set stores. */ + if (!TEST_true(SSL_set1_verify_cert_store(ssl, new_store))) + goto end; + + if (!TEST_true(SSL_set1_chain_cert_store(ssl, new_cstore))) + goto end; + + /* Should be able to retrieve the same pointer. */ + if (!TEST_true(SSL_get0_verify_cert_store(ssl, &store))) + goto end; + + if (!TEST_true(SSL_get0_chain_cert_store(ssl, &cstore))) + goto end; + + if (!TEST_ptr_eq(store, new_store) || !TEST_ptr_eq(cstore, new_cstore)) + goto end; + + /* Should be able to unset again. */ + if (!TEST_true(SSL_set1_verify_cert_store(ssl, NULL))) + goto end; + + if (!TEST_true(SSL_set1_chain_cert_store(ssl, NULL))) + goto end; + + /* Should now be NULL. */ + if (!TEST_true(SSL_get0_verify_cert_store(ssl, &store))) + goto end; + + if (!TEST_true(SSL_get0_chain_cert_store(ssl, &cstore))) + goto end; + + if (!TEST_ptr_null(store) || !TEST_ptr_null(cstore)) + goto end; + + testresult = 1; + +end: + X509_STORE_free(new_store); + X509_STORE_free(new_cstore); + SSL_free(ssl); + SSL_CTX_free(ctx); + return testresult; +} + + static int test_inherit_verify_param(void) { int testresult = 0; @@ -9498,6 +9727,42 @@ static int test_inherit_verify_param(void) return testresult; } + +static int test_load_dhfile(void) +{ +#ifndef OPENSSL_NO_DH + int testresult = 0; + + SSL_CTX *ctx = NULL; + SSL_CONF_CTX *cctx = NULL; + + if (dhfile == NULL) + return 1; + + if (!TEST_ptr(ctx = SSL_CTX_new_ex(libctx, NULL, TLS_client_method())) + || !TEST_ptr(cctx = SSL_CONF_CTX_new())) + goto end; + + SSL_CONF_CTX_set_ssl_ctx(cctx, ctx); + SSL_CONF_CTX_set_flags(cctx, + SSL_CONF_FLAG_CERTIFICATE + | SSL_CONF_FLAG_SERVER + | SSL_CONF_FLAG_FILE); + + if (!TEST_int_eq(SSL_CONF_cmd(cctx, "DHParameters", dhfile), 2)) + goto end; + + testresult = 1; +end: + SSL_CONF_CTX_free(cctx); + SSL_CTX_free(ctx); + + return testresult; +#else + return TEST_skip("DH not supported by this build"); +#endif +} + #ifndef OPENSSL_NO_QUIC static int test_quic_set_encryption_secrets(SSL *ssl, OSSL_ENCRYPTION_LEVEL level, @@ -9857,7 +10122,7 @@ static int test_quic_early_data(int tst) # endif /* OSSL_NO_USABLE_TLS1_3 */ #endif /* OPENSSL_NO_QUIC */ -OPT_TEST_DECLARE_USAGE("certfile privkeyfile srpvfile tmpfile provider config\n") +OPT_TEST_DECLARE_USAGE("certfile privkeyfile srpvfile tmpfile provider config dhfile\n") int setup_tests(void) { @@ -9887,7 +10152,8 @@ int setup_tests(void) || !TEST_ptr(srpvfile = test_get_argument(1)) || !TEST_ptr(tmpfilename = test_get_argument(2)) || !TEST_ptr(modulename = test_get_argument(3)) - || !TEST_ptr(configfile = test_get_argument(4))) + || !TEST_ptr(configfile = test_get_argument(4)) + || !TEST_ptr(dhfile = test_get_argument(5))) return 0; if (!TEST_true(OSSL_LIB_CTX_load_config(libctx, configfile))) @@ -10113,10 +10379,14 @@ int setup_tests(void) #endif #ifndef OSSL_NO_USABLE_TLS1_3 ADD_TEST(test_sni_tls13); + ADD_ALL_TESTS(test_ticket_lifetime, 2); #endif ADD_TEST(test_inherit_verify_param); ADD_TEST(test_set_alpn); + ADD_TEST(test_set_verify_cert_store_ssl_ctx); + ADD_TEST(test_set_verify_cert_store_ssl); ADD_ALL_TESTS(test_session_timeout, 1); + ADD_TEST(test_load_dhfile); #ifndef OPENSSL_NO_QUIC ADD_ALL_TESTS(test_quic_api, 9); # ifndef OSSL_NO_USABLE_TLS1_3 diff --git a/deps/openssl/openssl/test/v3nametest.c b/deps/openssl/openssl/test/v3nametest.c index 06d713b2feb..a1998550e29 100644 --- a/deps/openssl/openssl/test/v3nametest.c +++ b/deps/openssl/openssl/test/v3nametest.c @@ -1,5 +1,5 @@ /* - * Copyright 2012-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2012-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -15,10 +15,6 @@ #include "internal/nelem.h" #include "testutil.h" -#ifdef OPENSSL_SYS_WINDOWS -# define strcasecmp _stricmp -#endif - static const char *const names[] = { "a", "b", ".", "*", "@", ".a", "a.", ".b", "b.", ".*", "*.", "*@", "@*", "a@", "@a", "b@", "..", @@ -287,7 +283,7 @@ static int run_cert(X509 *crt, const char *nameincert, int failed = 0; for (; *pname != NULL; ++pname) { - int samename = strcasecmp(nameincert, *pname) == 0; + int samename = OPENSSL_strcasecmp(nameincert, *pname) == 0; size_t namelen = strlen(*pname); char *name = OPENSSL_malloc(namelen + 1); int match, ret; diff --git a/deps/openssl/openssl/tools/c_rehash.in b/deps/openssl/openssl/tools/c_rehash.in index d51d8856d70..081b34aec87 100644 --- a/deps/openssl/openssl/tools/c_rehash.in +++ b/deps/openssl/openssl/tools/c_rehash.in @@ -1,7 +1,7 @@ #!{- $config{HASHBANGPERL} -} {- use OpenSSL::Util; -} # {- join("\n# ", @autowarntext) -} -# Copyright 1999-2021 The OpenSSL Project Authors. All Rights Reserved. +# Copyright 1999-2022 The OpenSSL Project Authors. All Rights Reserved. # # Licensed under the Apache License 2.0 (the "License"). You may not use # this file except in compliance with the License. You can obtain a copy @@ -152,6 +152,23 @@ sub check_file { return ($is_cert, $is_crl); } +sub compute_hash { + my $fh; + if ( $^O eq "VMS" ) { + # VMS uses the open through shell + # The file names are safe there and list form is unsupported + if (!open($fh, "-|", join(' ', @_))) { + print STDERR "Cannot compute hash on '$fname'\n"; + return; + } + } else { + if (!open($fh, "-|", @_)) { + print STDERR "Cannot compute hash on '$fname'\n"; + return; + } + } + return (<$fh>, <$fh>); +} # Link a certificate to its subject name hash value, each hash is of # the form <hash>.<n> where n is an integer. If the hash value already exists @@ -161,10 +178,12 @@ sub check_file { sub link_hash_cert { my $fname = $_[0]; - $fname =~ s/\"/\\\"/g; - my ($hash, $fprint) = `"$openssl" x509 $x509hash -fingerprint -noout -in "$fname"`; + my ($hash, $fprint) = compute_hash($openssl, "x509", $x509hash, + "-fingerprint", "-noout", + "-in", $fname); chomp $hash; chomp $fprint; + return if !$hash; $fprint =~ s/^.*=//; $fprint =~ tr/://d; my $suffix = 0; @@ -202,10 +221,12 @@ sub link_hash_cert { sub link_hash_crl { my $fname = $_[0]; - $fname =~ s/'/'\\''/g; - my ($hash, $fprint) = `"$openssl" crl $crlhash -fingerprint -noout -in '$fname'`; + my ($hash, $fprint) = compute_hash($openssl, "crl", $crlhash, + "-fingerprint", "-noout", + "-in", $fname); chomp $hash; chomp $fprint; + return if !$hash; $fprint =~ s/^.*=//; $fprint =~ tr/://d; my $suffix = 0; diff --git a/deps/openssl/openssl/util/libcrypto.num b/deps/openssl/openssl/util/libcrypto.num index 10b4e57d796..d9c040fb470 100644 --- a/deps/openssl/openssl/util/libcrypto.num +++ b/deps/openssl/openssl/util/libcrypto.num @@ -5425,3 +5425,5 @@ ASN1_item_d2i_ex 5552 3_0_0 EXIST::FUNCTION: ASN1_TIME_print_ex 5553 3_0_0 EXIST::FUNCTION: EVP_PKEY_get0_provider 5554 3_0_0 EXIST::FUNCTION: EVP_PKEY_CTX_get0_provider 5555 3_0_0 EXIST::FUNCTION: +OPENSSL_strcasecmp 5556 3_0_3 EXIST::FUNCTION: +OPENSSL_strncasecmp 5557 3_0_3 EXIST::FUNCTION: diff --git a/deps/openssl/openssl/util/markdownlint.rb b/deps/openssl/openssl/util/markdownlint.rb index 64a82e36848..159bf20870e 100644 --- a/deps/openssl/openssl/util/markdownlint.rb +++ b/deps/openssl/openssl/util/markdownlint.rb @@ -5,8 +5,9 @@ all # Use --- and === for H1 and H2. rule 'MD003', :style => :setext_with_atx -# Code blocks are indented -rule 'MD046', :style => :indented +# Code blocks may be fenced or indented, both are OK... +# but they must be consistent throughout each file. +rule 'MD046', :style => :consistent # Bug in mdl, https://github.com/markdownlint/markdownlint/issues/313 exclude_rule 'MD007' diff --git a/deps/openssl/openssl/util/missingssl.txt b/deps/openssl/openssl/util/missingssl.txt index 6adf6c51178..48219fd99a9 100644 --- a/deps/openssl/openssl/util/missingssl.txt +++ b/deps/openssl/openssl/util/missingssl.txt @@ -9,12 +9,9 @@ SSL_CTX_SRP_CTX_init(3) SSL_CTX_get0_certificate(3) SSL_CTX_get0_ctlog_store(3) SSL_CTX_get0_privatekey(3) -SSL_CTX_get_ssl_method(3) SSL_CTX_set0_ctlog_store(3) SSL_CTX_set_client_cert_engine(3) SSL_CTX_set_not_resumable_session_callback(3) -SSL_CTX_set_purpose(3) -SSL_CTX_set_trust(3) SSL_SRP_CTX_free(3) SSL_SRP_CTX_init(3) SSL_add_ssl_module(3) @@ -29,11 +26,9 @@ SSL_get_peer_finished(3) SSL_set_SSL_CTX(3) SSL_set_debug(3) SSL_set_not_resumable_session_callback(3) -SSL_set_purpose(3) SSL_set_session_secret_cb(3) SSL_set_session_ticket_ext(3) SSL_set_session_ticket_ext_cb(3) -SSL_set_trust(3) SSL_srp_server_param_with_username(3) SSL_test_functions(3) SSL_trace(3) diff --git a/deps/openssl/openssl/util/other.syms b/deps/openssl/openssl/util/other.syms index af61ea04719..e5bce5a4e78 100644 --- a/deps/openssl/openssl/util/other.syms +++ b/deps/openssl/openssl/util/other.syms @@ -461,6 +461,8 @@ SSL_CTX_decrypt_session_ticket_fn define SSL_CTX_disable_ct define SSL_CTX_generate_session_ticket_fn define SSL_CTX_get0_chain_certs define +SSL_CTX_get0_chain_cert_store define +SSL_CTX_get0_verify_cert_store define SSL_CTX_get_default_read_ahead define SSL_CTX_get_extra_chain_certs define SSL_CTX_get_extra_chain_certs_only define @@ -533,6 +535,8 @@ SSL_clear_mode define SSL_disable_ct define SSL_get0_chain_certs define SSL_get0_session define +SSL_get0_chain_cert_store define +SSL_get0_verify_cert_store define SSL_get1_curves define SSL_get1_groups define SSL_get_cipher define |