diff options
59 files changed, 622 insertions, 364 deletions
diff --git a/lib/libcrypto/Makefile.ssl b/lib/libcrypto/Makefile.ssl index 2489b614c66..db8baf385e1 100644 --- a/lib/libcrypto/Makefile.ssl +++ b/lib/libcrypto/Makefile.ssl @@ -98,7 +98,7 @@ lib: $(LIBOBJ) shared: if [ -n "$(SHARED_LIBS)" ]; then \ - (cd ..; make $(SHARED_LIB)); \ + (cd ..; $(MAKE) $(SHARED_LIB)); \ fi libs: diff --git a/lib/libcrypto/asn1/a_bitstr.c b/lib/libcrypto/asn1/a_bitstr.c index ed0bdfbde1a..e0265f69d2a 100644 --- a/lib/libcrypto/asn1/a_bitstr.c +++ b/lib/libcrypto/asn1/a_bitstr.c @@ -120,6 +120,12 @@ ASN1_BIT_STRING *c2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a, unsigned char **pp, unsigned char *p,*s; int i; + if (len < 1) + { + i=ASN1_R_STRING_TOO_SHORT; + goto err; + } + if ((a == NULL) || ((*a) == NULL)) { if ((ret=M_ASN1_BIT_STRING_new()) == NULL) return(NULL); diff --git a/lib/libcrypto/asn1/a_strex.c b/lib/libcrypto/asn1/a_strex.c index 8dab29dca14..7ddb7662f1e 100644 --- a/lib/libcrypto/asn1/a_strex.c +++ b/lib/libcrypto/asn1/a_strex.c @@ -544,7 +544,7 @@ int ASN1_STRING_to_UTF8(unsigned char **out, ASN1_STRING *in) { ASN1_STRING stmp, *str = &stmp; int mbflag, type, ret; - if(!*out || !in) return -1; + if(!in) return -1; type = in->type; if((type < 0) || (type > 30)) return -1; mbflag = tag2nbyte[type]; @@ -553,6 +553,6 @@ int ASN1_STRING_to_UTF8(unsigned char **out, ASN1_STRING *in) stmp.data = NULL; ret = ASN1_mbstring_copy(&str, in->data, in->length, mbflag, B_ASN1_UTF8STRING); if(ret < 0) return ret; - if(out) *out = stmp.data; + *out = stmp.data; return stmp.length; } diff --git a/lib/libcrypto/asn1/t_req.c b/lib/libcrypto/asn1/t_req.c index 848c29a2dd3..739f272ecf4 100644 --- a/lib/libcrypto/asn1/t_req.c +++ b/lib/libcrypto/asn1/t_req.c @@ -82,7 +82,7 @@ int X509_REQ_print_fp(FILE *fp, X509_REQ *x) } #endif -int X509_REQ_print(BIO *bp, X509_REQ *x) +int X509_REQ_print_ex(BIO *bp, X509_REQ *x, unsigned long nmflags, unsigned long cflag) { unsigned long l; int i; @@ -92,143 +92,185 @@ int X509_REQ_print(BIO *bp, X509_REQ *x) STACK_OF(X509_ATTRIBUTE) *sk; STACK_OF(X509_EXTENSION) *exts; char str[128]; + char mlch = ' '; + int nmindent = 0; + + if((nmflags & XN_FLAG_SEP_MASK) == XN_FLAG_SEP_MULTILINE) { + mlch = '\n'; + nmindent = 12; + } + + if(nmflags == X509_FLAG_COMPAT) + nmindent = 16; + ri=x->req_info; - sprintf(str,"Certificate Request:\n"); - if (BIO_puts(bp,str) <= 0) goto err; - sprintf(str,"%4sData:\n",""); - if (BIO_puts(bp,str) <= 0) goto err; - - neg=(ri->version->type == V_ASN1_NEG_INTEGER)?"-":""; - l=0; - for (i=0; i<ri->version->length; i++) - { l<<=8; l+=ri->version->data[i]; } - sprintf(str,"%8sVersion: %s%lu (%s0x%lx)\n","",neg,l,neg,l); - if (BIO_puts(bp,str) <= 0) goto err; - sprintf(str,"%8sSubject: ",""); - if (BIO_puts(bp,str) <= 0) goto err; - - X509_NAME_print(bp,ri->subject,16); - sprintf(str,"\n%8sSubject Public Key Info:\n",""); - if (BIO_puts(bp,str) <= 0) goto err; - i=OBJ_obj2nid(ri->pubkey->algor->algorithm); - sprintf(str,"%12sPublic Key Algorithm: %s\n","", - (i == NID_undef)?"UNKNOWN":OBJ_nid2ln(i)); - if (BIO_puts(bp,str) <= 0) goto err; - - pkey=X509_REQ_get_pubkey(x); -#ifndef OPENSSL_NO_RSA - if (pkey != NULL && pkey->type == EVP_PKEY_RSA) + if(!(cflag & X509_FLAG_NO_HEADER)) { - BIO_printf(bp,"%12sRSA Public Key: (%d bit)\n","", - BN_num_bits(pkey->pkey.rsa->n)); - RSA_print(bp,pkey->pkey.rsa,16); + if (BIO_write(bp,"Certificate Request:\n",21) <= 0) goto err; + if (BIO_write(bp," Data:\n",10) <= 0) goto err; } - else -#endif -#ifndef OPENSSL_NO_DSA - if (pkey != NULL && pkey->type == EVP_PKEY_DSA) + if(!(cflag & X509_FLAG_NO_VERSION)) { - BIO_printf(bp,"%12sDSA Public Key:\n",""); - DSA_print(bp,pkey->pkey.dsa,16); + neg=(ri->version->type == V_ASN1_NEG_INTEGER)?"-":""; + l=0; + for (i=0; i<ri->version->length; i++) + { l<<=8; l+=ri->version->data[i]; } + sprintf(str,"%8sVersion: %s%lu (%s0x%lx)\n","",neg,l,neg,l); + if (BIO_puts(bp,str) <= 0) goto err; } - else -#endif - BIO_printf(bp,"%12sUnknown Public Key:\n",""); + if(!(cflag & X509_FLAG_NO_SUBJECT)) + { + if (BIO_printf(bp," Subject:%c",mlch) <= 0) goto err; + if (X509_NAME_print_ex(bp,ri->subject,nmindent, nmflags) < 0) goto err; + if (BIO_write(bp,"\n",1) <= 0) goto err; + } + if(!(cflag & X509_FLAG_NO_PUBKEY)) + { + if (BIO_write(bp," Subject Public Key Info:\n",33) <= 0) + goto err; + if (BIO_printf(bp,"%12sPublic Key Algorithm: ","") <= 0) + goto err; + if (i2a_ASN1_OBJECT(bp, ri->pubkey->algor->algorithm) <= 0) + goto err; + if (BIO_puts(bp, "\n") <= 0) + goto err; - if (pkey != NULL) - EVP_PKEY_free(pkey); + pkey=X509_REQ_get_pubkey(x); + if (pkey == NULL) + { + BIO_printf(bp,"%12sUnable to load Public Key\n",""); + ERR_print_errors(bp); + } + else +#ifndef OPENSSL_NO_RSA + if (pkey->type == EVP_PKEY_RSA) + { + BIO_printf(bp,"%12sRSA Public Key: (%d bit)\n","", + BN_num_bits(pkey->pkey.rsa->n)); + RSA_print(bp,pkey->pkey.rsa,16); + } + else +#endif +#ifndef OPENSSL_NO_DSA + if (pkey->type == EVP_PKEY_DSA) + { + BIO_printf(bp,"%12sDSA Public Key:\n",""); + DSA_print(bp,pkey->pkey.dsa,16); + } + else +#endif + BIO_printf(bp,"%12sUnknown Public Key:\n",""); - /* may not be */ - sprintf(str,"%8sAttributes:\n",""); - if (BIO_puts(bp,str) <= 0) goto err; + EVP_PKEY_free(pkey); + } - sk=x->req_info->attributes; - if (sk_X509_ATTRIBUTE_num(sk) == 0) + if(!(cflag & X509_FLAG_NO_ATTRIBUTES)) { - sprintf(str,"%12sa0:00\n",""); + /* may not be */ + sprintf(str,"%8sAttributes:\n",""); if (BIO_puts(bp,str) <= 0) goto err; - } - else - { - for (i=0; i<sk_X509_ATTRIBUTE_num(sk); i++) + + sk=x->req_info->attributes; + if (sk_X509_ATTRIBUTE_num(sk) == 0) { - ASN1_TYPE *at; - X509_ATTRIBUTE *a; - ASN1_BIT_STRING *bs=NULL; - ASN1_TYPE *t; - int j,type=0,count=1,ii=0; - - a=sk_X509_ATTRIBUTE_value(sk,i); - if(X509_REQ_extension_nid(OBJ_obj2nid(a->object))) - continue; - sprintf(str,"%12s",""); + sprintf(str,"%12sa0:00\n",""); if (BIO_puts(bp,str) <= 0) goto err; - if ((j=i2a_ASN1_OBJECT(bp,a->object)) > 0) + } + else { - if (a->single) + for (i=0; i<sk_X509_ATTRIBUTE_num(sk); i++) { - t=a->value.single; - type=t->type; - bs=t->value.bit_string; - } - else + ASN1_TYPE *at; + X509_ATTRIBUTE *a; + ASN1_BIT_STRING *bs=NULL; + ASN1_TYPE *t; + int j,type=0,count=1,ii=0; + + a=sk_X509_ATTRIBUTE_value(sk,i); + if(X509_REQ_extension_nid(OBJ_obj2nid(a->object))) + continue; + sprintf(str,"%12s",""); + if (BIO_puts(bp,str) <= 0) goto err; + if ((j=i2a_ASN1_OBJECT(bp,a->object)) > 0) { - ii=0; - count=sk_ASN1_TYPE_num(a->value.set); + if (a->single) + { + t=a->value.single; + type=t->type; + bs=t->value.bit_string; + } + else + { + ii=0; + count=sk_ASN1_TYPE_num(a->value.set); get_next: - at=sk_ASN1_TYPE_value(a->value.set,ii); - type=at->type; - bs=at->value.asn1_string; + at=sk_ASN1_TYPE_value(a->value.set,ii); + type=at->type; + bs=at->value.asn1_string; + } + } + for (j=25-j; j>0; j--) + if (BIO_write(bp," ",1) != 1) goto err; + if (BIO_puts(bp,":") <= 0) goto err; + if ( (type == V_ASN1_PRINTABLESTRING) || + (type == V_ASN1_T61STRING) || + (type == V_ASN1_IA5STRING)) + { + if (BIO_write(bp,(char *)bs->data,bs->length) + != bs->length) + goto err; + BIO_puts(bp,"\n"); + } + else + { + BIO_puts(bp,"unable to print attribute\n"); + } + if (++ii < count) goto get_next; } } - for (j=25-j; j>0; j--) - if (BIO_write(bp," ",1) != 1) goto err; - if (BIO_puts(bp,":") <= 0) goto err; - if ( (type == V_ASN1_PRINTABLESTRING) || - (type == V_ASN1_T61STRING) || - (type == V_ASN1_IA5STRING)) + } + if(!(cflag & X509_FLAG_NO_ATTRIBUTES)) + { + exts = X509_REQ_get_extensions(x); + if(exts) + { + BIO_printf(bp,"%8sRequested Extensions:\n",""); + for (i=0; i<sk_X509_EXTENSION_num(exts); i++) { - if (BIO_write(bp,(char *)bs->data,bs->length) - != bs->length) + ASN1_OBJECT *obj; + X509_EXTENSION *ex; + int j; + ex=sk_X509_EXTENSION_value(exts, i); + if (BIO_printf(bp,"%12s","") <= 0) goto err; + obj=X509_EXTENSION_get_object(ex); + i2a_ASN1_OBJECT(bp,obj); + j=X509_EXTENSION_get_critical(ex); + if (BIO_printf(bp,": %s\n",j?"critical":"","") <= 0) goto err; - BIO_puts(bp,"\n"); - } - else - { - BIO_puts(bp,"unable to print attribute\n"); + if(!X509V3_EXT_print(bp, ex, 0, 16)) + { + BIO_printf(bp, "%16s", ""); + M_ASN1_OCTET_STRING_print(bp,ex->value); + } + if (BIO_write(bp,"\n",1) <= 0) goto err; } - if (++ii < count) goto get_next; + sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free); } } - exts = X509_REQ_get_extensions(x); - if(exts) { - BIO_printf(bp,"%8sRequested Extensions:\n",""); - for (i=0; i<sk_X509_EXTENSION_num(exts); i++) { - ASN1_OBJECT *obj; - X509_EXTENSION *ex; - int j; - ex=sk_X509_EXTENSION_value(exts, i); - if (BIO_printf(bp,"%12s","") <= 0) goto err; - obj=X509_EXTENSION_get_object(ex); - i2a_ASN1_OBJECT(bp,obj); - j=X509_EXTENSION_get_critical(ex); - if (BIO_printf(bp,": %s\n",j?"critical":"","") <= 0) - goto err; - if(!X509V3_EXT_print(bp, ex, 0, 16)) { - BIO_printf(bp, "%16s", ""); - M_ASN1_OCTET_STRING_print(bp,ex->value); - } - if (BIO_write(bp,"\n",1) <= 0) goto err; + if(!(cflag & X509_FLAG_NO_SIGDUMP)) + { + if(!X509_signature_print(bp, x->sig_alg, x->signature)) goto err; } - sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free); - } - - if(!X509_signature_print(bp, x->sig_alg, x->signature)) goto err; return(1); err: X509err(X509_F_X509_REQ_PRINT,ERR_R_BUF_LIB); return(0); } + +int X509_REQ_print(BIO *bp, X509_REQ *x) + { + return X509_REQ_print_ex(bp, x, XN_FLAG_COMPAT, X509_FLAG_COMPAT); + } diff --git a/lib/libcrypto/asn1/tasn_dec.c b/lib/libcrypto/asn1/tasn_dec.c index 0fc1f421e28..f87c08793aa 100644 --- a/lib/libcrypto/asn1/tasn_dec.c +++ b/lib/libcrypto/asn1/tasn_dec.c @@ -913,10 +913,10 @@ static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass, char *i ctx->ptag = ptag; ctx->hdrlen = p - q; ctx->valid = 1; - /* If definite length, length + header can't exceed total - * amount of data available. + /* If definite length, and no error, length + + * header can't exceed total amount of data available. */ - if(!(i & 1) && ((plen + ctx->hdrlen) > len)) { + if(!(i & 0x81) && ((plen + ctx->hdrlen) > len)) { ASN1err(ASN1_F_ASN1_CHECK_TLEN, ASN1_R_TOO_LONG); asn1_tlc_clear(ctx); return 0; diff --git a/lib/libcrypto/bio/b_print.c b/lib/libcrypto/bio/b_print.c index 3ce12907728..80c9cb69db2 100644 --- a/lib/libcrypto/bio/b_print.c +++ b/lib/libcrypto/bio/b_print.c @@ -109,7 +109,7 @@ * o ... (for OpenSSL) */ -#if HAVE_LONG_DOUBLE +#ifdef HAVE_LONG_DOUBLE #define LDOUBLE long double #else #define LDOUBLE double diff --git a/lib/libcrypto/bn/bn.h b/lib/libcrypto/bn/bn.h index 1eaf8795531..b40682f8318 100644 --- a/lib/libcrypto/bn/bn.h +++ b/lib/libcrypto/bn/bn.h @@ -430,7 +430,7 @@ int BN_mod_mul_montgomery(BIGNUM *r,const BIGNUM *a,const BIGNUM *b, int BN_from_montgomery(BIGNUM *r,const BIGNUM *a, BN_MONT_CTX *mont, BN_CTX *ctx); void BN_MONT_CTX_free(BN_MONT_CTX *mont); -int BN_MONT_CTX_set(BN_MONT_CTX *mont,const BIGNUM *modulus,BN_CTX *ctx); +int BN_MONT_CTX_set(BN_MONT_CTX *mont,const BIGNUM *mod,BN_CTX *ctx); BN_MONT_CTX *BN_MONT_CTX_copy(BN_MONT_CTX *to,BN_MONT_CTX *from); BN_BLINDING *BN_BLINDING_new(BIGNUM *A,BIGNUM *Ai,BIGNUM *mod); diff --git a/lib/libcrypto/crypto-lib.com b/lib/libcrypto/crypto-lib.com index 4847a69a716..dfcff11860a 100644 --- a/lib/libcrypto/crypto-lib.com +++ b/lib/libcrypto/crypto-lib.com @@ -231,7 +231,7 @@ $ LIB_RAND = "md_rand,randfile,rand_lib,rand_err,rand_egd,"+ - "rand_vms" $ LIB_ERR = "err,err_all,err_prn" $ LIB_OBJECTS = "o_names,obj_dat,obj_lib,obj_err" -$ LIB_EVP = "encode,digest,evp_enc,evp_key,"+ - +$ LIB_EVP = "encode,digest,evp_enc,evp_key,evp_acnf,"+ - "e_des,e_bf,e_idea,e_des3,"+ - "e_rc4,e_aes,names,"+ - "e_xcbc_d,e_rc2,e_cast,e_rc5" @@ -265,14 +265,14 @@ $ LIB_X509V3 = "v3_bcons,v3_bitst,v3_conf,v3_extku,v3_ia5,v3_lib,"+ - "v3_prn,v3_utl,v3err,v3_genn,v3_alt,v3_skey,v3_akey,v3_pku,"+ - "v3_int,v3_enum,v3_sxnet,v3_cpols,v3_crld,v3_purp,v3_info,"+ - "v3_ocsp,v3_akeya" -$ LIB_CONF = "conf_err,conf_lib,conf_api,conf_def,conf_mod,conf_mall" +$ LIB_CONF = "conf_err,conf_lib,conf_api,conf_def,conf_mod,conf_mall,conf_sap" $ LIB_TXT_DB = "txt_db" $ LIB_PKCS7 = "pk7_asn1,pk7_lib,pkcs7err,pk7_doit,pk7_smime,pk7_attr,"+ - "pk7_mime" $ LIB_PKCS12 = "p12_add,p12_asn,p12_attr,p12_crpt,p12_crt,p12_decr,"+ - "p12_init,p12_key,p12_kiss,p12_mutl,"+ - "p12_utl,p12_npas,pk12err,p12_p8d,p12_p8e" -$ LIB_COMP = "comp_lib,"+ - +$ LIB_COMP = "comp_lib,comp_err,"+ - "c_rle,c_zlib" $ LIB_OCSP = "ocsp_asn,ocsp_ext,ocsp_ht,ocsp_lib,ocsp_cl,"+ - "ocsp_srv,ocsp_prn,ocsp_vfy,ocsp_err" @@ -1325,7 +1325,7 @@ $ CC4 = CC - CCDISABLEWARNINGS + CC4DISABLEWARNINGS $! $! Show user the result $! -$ WRITE SYS$OUTPUT "Main C Compiling Command: ",CC +$ WRITE/SYMBOL SYS$OUTPUT "Main C Compiling Command: ",CC $! $! Else The User Entered An Invalid Arguement. $! @@ -1356,7 +1356,7 @@ $ IF ARCH .EQS. "AXP" THEN MACRO = "MACRO/MIGRATION/''DEBUGGER'/''MACRO_OPTIMIZE $! $! Show user the result $! -$ WRITE SYS$OUTPUT "Main MACRO Compiling Command: ",MACRO +$ WRITE/SYMBOL SYS$OUTPUT "Main MACRO Compiling Command: ",MACRO $! $! Time to check the contents, and to make sure we get the correct library. $! diff --git a/lib/libcrypto/des/Makefile.ssl b/lib/libcrypto/des/Makefile.ssl index ee5849d8fad..826ffcc58c2 100644 --- a/lib/libcrypto/des/Makefile.ssl +++ b/lib/libcrypto/des/Makefile.ssl @@ -207,7 +207,8 @@ ecb_enc.o: ../../include/openssl/des_old.h ../../include/openssl/e_os2.h ecb_enc.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h ecb_enc.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h ecb_enc.o: ../../include/openssl/symhacks.h ../../include/openssl/ui.h -ecb_enc.o: ../../include/openssl/ui_compat.h des_locl.h ecb_enc.c spr.h +ecb_enc.o: ../../include/openssl/ui_compat.h des_locl.h des_ver.h ecb_enc.c +ecb_enc.o: spr.h ede_cbcm_enc.o: ../../include/openssl/crypto.h ../../include/openssl/des.h ede_cbcm_enc.o: ../../include/openssl/des_old.h ../../include/openssl/e_os2.h ede_cbcm_enc.o: ../../include/openssl/opensslconf.h diff --git a/lib/libcrypto/des/des_ver.h b/lib/libcrypto/des/des_ver.h index 0fa94d53682..ec9cc736e3c 100644 --- a/lib/libcrypto/des/des_ver.h +++ b/lib/libcrypto/des/des_ver.h @@ -63,5 +63,5 @@ # define OPENSSL_EXTERN OPENSSL_EXPORT #endif -OPENSSL_EXTERN char *DES_version; /* SSLeay version string */ -OPENSSL_EXTERN char *libdes_version; /* old libdes version string */ +OPENSSL_EXTERN const char *DES_version; /* SSLeay version string */ +OPENSSL_EXTERN const char *libdes_version; /* old libdes version string */ diff --git a/lib/libcrypto/des/ecb_enc.c b/lib/libcrypto/des/ecb_enc.c index 4650f2fa0f5..1b70f68806d 100644 --- a/lib/libcrypto/des/ecb_enc.c +++ b/lib/libcrypto/des/ecb_enc.c @@ -57,6 +57,7 @@ */ #include "des_locl.h" +#include "des_ver.h" #include "spr.h" #include <openssl/opensslv.h> diff --git a/lib/libcrypto/des/set_key.c b/lib/libcrypto/des/set_key.c index 683916e71b0..143008ed9c5 100644 --- a/lib/libcrypto/des/set_key.c +++ b/lib/libcrypto/des/set_key.c @@ -342,7 +342,7 @@ void DES_set_key_unchecked(const_DES_cblock *key, DES_key_schedule *schedule) register DES_LONG *k; register int i; -#if OPENBSD_DEV_CRYPTO +#ifdef OPENBSD_DEV_CRYPTO memcpy(schedule->key,key,sizeof schedule->key); schedule->session=NULL; #endif diff --git a/lib/libcrypto/doc/DH_set_method.pod b/lib/libcrypto/doc/DH_set_method.pod index d990bf87860..73261fc4675 100644 --- a/lib/libcrypto/doc/DH_set_method.pod +++ b/lib/libcrypto/doc/DH_set_method.pod @@ -2,7 +2,7 @@ =head1 NAME -DH_set_default_openssl_method, DH_get_default_openssl_method, +DH_set_default_method, DH_get_default_method, DH_set_method, DH_new_method, DH_OpenSSL - select DH method =head1 SYNOPSIS @@ -10,45 +10,47 @@ DH_set_method, DH_new_method, DH_OpenSSL - select DH method #include <openssl/dh.h> #include <openssl/engine.h> - void DH_set_default_openssl_method(DH_METHOD *meth); + void DH_set_default_method(const DH_METHOD *meth); - DH_METHOD *DH_get_default_openssl_method(void); + const DH_METHOD *DH_get_default_method(void); - int DH_set_method(DH *dh, ENGINE *engine); + int DH_set_method(DH *dh, const DH_METHOD *meth); DH *DH_new_method(ENGINE *engine); - DH_METHOD *DH_OpenSSL(void); + const DH_METHOD *DH_OpenSSL(void); =head1 DESCRIPTION A B<DH_METHOD> specifies the functions that OpenSSL uses for Diffie-Hellman operations. By modifying the method, alternative implementations -such as hardware accelerators may be used. - -Initially, the default is to use the OpenSSL internal implementation. -DH_OpenSSL() returns a pointer to that method. - -DH_set_default_openssl_method() makes B<meth> the default method for all DH -structures created later. B<NB:> This is true only whilst the default engine -for Diffie-Hellman operations remains as "openssl". ENGINEs provide an -encapsulation for implementations of one or more algorithms, and all the DH -functions mentioned here operate within the scope of the default -"openssl" engine. - -DH_get_default_openssl_method() returns a pointer to the current default -method for the "openssl" engine. - -DH_set_method() selects B<engine> as the engine that will be responsible for -all operations using the structure B<dh>. If this function completes successfully, -then the B<dh> structure will have its own functional reference of B<engine>, so -the caller should remember to free their own reference to B<engine> when they are -finished with it. NB: An ENGINE's DH_METHOD can be retrieved (or set) by -ENGINE_get_DH() or ENGINE_set_DH(). - -DH_new_method() allocates and initializes a DH structure so that -B<engine> will be used for the DH operations. If B<engine> is NULL, -the default engine for Diffie-Hellman opertaions is used. +such as hardware accelerators may be used. IMPORTANT: See the NOTES section for +important information about how these DH API functions are affected by the use +of B<ENGINE> API calls. + +Initially, the default DH_METHOD is the OpenSSL internal implementation, as +returned by DH_OpenSSL(). + +DH_set_default_method() makes B<meth> the default method for all DH +structures created later. B<NB>: This is true only whilst no ENGINE has been set +as a default for DH, so this function is no longer recommended. + +DH_get_default_method() returns a pointer to the current default DH_METHOD. +However, the meaningfulness of this result is dependant on whether the ENGINE +API is being used, so this function is no longer recommended. + +DH_set_method() selects B<meth> to perform all operations using the key B<dh>. +This will replace the DH_METHOD used by the DH key and if the previous method +was supplied by an ENGINE, the handle to that ENGINE will be released during the +change. It is possible to have DH keys that only work with certain DH_METHOD +implementations (eg. from an ENGINE module that supports embedded +hardware-protected keys), and in such cases attempting to change the DH_METHOD +for the key can have unexpected results. + +DH_new_method() allocates and initializes a DH structure so that B<engine> will +be used for the DH operations. If B<engine> is NULL, the default ENGINE for DH +operations is used, and if no default ENGINE is set, the DH_METHOD controlled by +DH_set_default_method() is used. =head1 THE DH_METHOD STRUCTURE @@ -82,17 +84,28 @@ the default engine for Diffie-Hellman opertaions is used. =head1 RETURN VALUES -DH_OpenSSL() and DH_get_default_openssl_method() return pointers to the -respective B<DH_METHOD>s. +DH_OpenSSL() and DH_get_default_method() return pointers to the respective +B<DH_METHOD>s. + +DH_set_default_method() returns no value. + +DH_set_method() returns non-zero if the provided B<meth> was successfully set as +the method for B<dh> (including unloading the ENGINE handle if the previous +method was supplied by an ENGINE). -DH_set_default_openssl_method() returns no value. +DH_new_method() returns NULL and sets an error code that can be obtained by +L<ERR_get_error(3)|ERR_get_error(3)> if the allocation fails. Otherwise it +returns a pointer to the newly allocated structure. -DH_set_method() returns non-zero if the ENGINE associated with B<dh> -was successfully changed to B<engine>. +=head1 NOTES -DH_new_method() returns NULL and sets an error code that can be -obtained by L<ERR_get_error(3)|ERR_get_error(3)> if the allocation fails. -Otherwise it returns a pointer to the newly allocated structure. +As of version 0.9.7, DH_METHOD implementations are grouped together with other +algorithmic APIs (eg. RSA_METHOD, EVP_CIPHER, etc) in B<ENGINE> modules. If a +default ENGINE is specified for DH functionality using an ENGINE API function, +that will override any DH defaults set using the DH API (ie. +DH_set_default_method()). For this reason, the ENGINE API is the recommended way +to control default implementations for use in DH and other cryptographic +algorithms. =head1 SEE ALSO @@ -103,9 +116,14 @@ L<dh(3)|dh(3)>, L<DH_new(3)|DH_new(3)> DH_set_default_method(), DH_get_default_method(), DH_set_method(), DH_new_method() and DH_OpenSSL() were added in OpenSSL 0.9.4. -DH_set_default_openssl_method() and DH_get_default_openssl_method() -replaced DH_set_default_method() and DH_get_default_method() respectively, -and DH_set_method() and DH_new_method() were altered to use B<ENGINE>s -rather than B<DH_METHOD>s during development of OpenSSL 0.9.6. +DH_set_default_openssl_method() and DH_get_default_openssl_method() replaced +DH_set_default_method() and DH_get_default_method() respectively, and +DH_set_method() and DH_new_method() were altered to use B<ENGINE>s rather than +B<DH_METHOD>s during development of the engine version of OpenSSL 0.9.6. For +0.9.7, the handling of defaults in the ENGINE API was restructured so that this +change was reversed, and behaviour of the other functions resembled more closely +the previous behaviour. The behaviour of defaults in the ENGINE API now +transparently overrides the behaviour of defaults in the DH API without +requiring changing these function prototypes. =cut diff --git a/lib/libcrypto/doc/DSA_dup_DH.pod b/lib/libcrypto/doc/DSA_dup_DH.pod index 695f99a13b1..7f6f0d1115a 100644 --- a/lib/libcrypto/doc/DSA_dup_DH.pod +++ b/lib/libcrypto/doc/DSA_dup_DH.pod @@ -8,7 +8,7 @@ DSA_dup_DH - create a DH structure out of DSA structure #include <openssl/dsa.h> - DH * DSA_dup_DH(DSA *r); + DH * DSA_dup_DH(const DSA *r); =head1 DESCRIPTION diff --git a/lib/libcrypto/doc/DSA_new.pod b/lib/libcrypto/doc/DSA_new.pod index 301af912dd5..48e9b82a09c 100644 --- a/lib/libcrypto/doc/DSA_new.pod +++ b/lib/libcrypto/doc/DSA_new.pod @@ -14,7 +14,8 @@ DSA_new, DSA_free - allocate and free DSA objects =head1 DESCRIPTION -DSA_new() allocates and initializes a B<DSA> structure. +DSA_new() allocates and initializes a B<DSA> structure. It is equivalent to +calling DSA_new_method(NULL). DSA_free() frees the B<DSA> structure and its components. The values are erased before the memory is returned to the system. diff --git a/lib/libcrypto/doc/DSA_set_method.pod b/lib/libcrypto/doc/DSA_set_method.pod index 36a1052d276..bc3cfb1f0a7 100644 --- a/lib/libcrypto/doc/DSA_set_method.pod +++ b/lib/libcrypto/doc/DSA_set_method.pod @@ -2,7 +2,7 @@ =head1 NAME -DSA_set_default_openssl_method, DSA_get_default_openssl_method, +DSA_set_default_method, DSA_get_default_method, DSA_set_method, DSA_new_method, DSA_OpenSSL - select DSA method =head1 SYNOPSIS @@ -10,11 +10,11 @@ DSA_set_method, DSA_new_method, DSA_OpenSSL - select DSA method #include <openssl/dsa.h> #include <openssl/engine.h> - void DSA_set_default_openssl_method(DSA_METHOD *meth); + void DSA_set_default_method(const DSA_METHOD *meth); - DSA_METHOD *DSA_get_default_openssl_method(void); + const DSA_METHOD *DSA_get_default_method(void); - int DSA_set_method(DSA *dsa, ENGINE *engine); + int DSA_set_method(DSA *dsa, const DSA_METHOD *meth); DSA *DSA_new_method(ENGINE *engine); @@ -24,26 +24,35 @@ DSA_set_method, DSA_new_method, DSA_OpenSSL - select DSA method A B<DSA_METHOD> specifies the functions that OpenSSL uses for DSA operations. By modifying the method, alternative implementations -such as hardware accelerators may be used. - -Initially, the default is to use the OpenSSL internal implementation. -DSA_OpenSSL() returns a pointer to that method. - -DSA_set_default_openssl_method() makes B<meth> the default method for -all DSA structures created later. B<NB:> This is true only whilst the -default engine for DSA operations remains as "openssl". ENGINEs -provide an encapsulation for implementations of one or more algorithms at a -time, and all the DSA functions mentioned here operate within the scope -of the default "openssl" engine. - -DSA_get_default_openssl_method() returns a pointer to the current default -method for the "openssl" engine. - -DSA_set_method() selects B<engine> for all operations using the structure B<dsa>. - -DSA_new_method() allocates and initializes a DSA structure so that -B<engine> will be used for the DSA operations. If B<engine> is NULL, -the default engine for DSA operations is used. +such as hardware accelerators may be used. IMPORTANT: See the NOTES section for +important information about how these DSA API functions are affected by the use +of B<ENGINE> API calls. + +Initially, the default DSA_METHOD is the OpenSSL internal implementation, +as returned by DSA_OpenSSL(). + +DSA_set_default_method() makes B<meth> the default method for all DSA +structures created later. B<NB>: This is true only whilst no ENGINE has +been set as a default for DSA, so this function is no longer recommended. + +DSA_get_default_method() returns a pointer to the current default +DSA_METHOD. However, the meaningfulness of this result is dependant on +whether the ENGINE API is being used, so this function is no longer +recommended. + +DSA_set_method() selects B<meth> to perform all operations using the key +B<rsa>. This will replace the DSA_METHOD used by the DSA key and if the +previous method was supplied by an ENGINE, the handle to that ENGINE will +be released during the change. It is possible to have DSA keys that only +work with certain DSA_METHOD implementations (eg. from an ENGINE module +that supports embedded hardware-protected keys), and in such cases +attempting to change the DSA_METHOD for the key can have unexpected +results. + +DSA_new_method() allocates and initializes a DSA structure so that B<engine> +will be used for the DSA operations. If B<engine> is NULL, the default engine +for DSA operations is used, and if no default ENGINE is set, the DSA_METHOD +controlled by DSA_set_default_method() is used. =head1 THE DSA_METHOD STRUCTURE @@ -89,18 +98,29 @@ struct =head1 RETURN VALUES -DSA_OpenSSL() and DSA_get_default_openssl_method() return pointers to the -respective B<DSA_METHOD>s. +DSA_OpenSSL() and DSA_get_default_method() return pointers to the respective +B<DSA_METHOD>s. -DSA_set_default_openssl_method() returns no value. +DSA_set_default_method() returns no value. -DSA_set_method() returns non-zero if the ENGINE associated with B<dsa> -was successfully changed to B<engine>. +DSA_set_method() returns non-zero if the provided B<meth> was successfully set as +the method for B<dsa> (including unloading the ENGINE handle if the previous +method was supplied by an ENGINE). DSA_new_method() returns NULL and sets an error code that can be obtained by L<ERR_get_error(3)|ERR_get_error(3)> if the allocation fails. Otherwise it returns a pointer to the newly allocated structure. +=head1 NOTES + +As of version 0.9.7, DSA_METHOD implementations are grouped together with other +algorithmic APIs (eg. RSA_METHOD, EVP_CIPHER, etc) in B<ENGINE> modules. If a +default ENGINE is specified for DSA functionality using an ENGINE API function, +that will override any DSA defaults set using the DSA API (ie. +DSA_set_default_method()). For this reason, the ENGINE API is the recommended way +to control default implementations for use in DSA and other cryptographic +algorithms. + =head1 SEE ALSO L<dsa(3)|dsa(3)>, L<DSA_new(3)|DSA_new(3)> @@ -110,9 +130,14 @@ L<dsa(3)|dsa(3)>, L<DSA_new(3)|DSA_new(3)> DSA_set_default_method(), DSA_get_default_method(), DSA_set_method(), DSA_new_method() and DSA_OpenSSL() were added in OpenSSL 0.9.4. -DSA_set_default_openssl_method() and DSA_get_default_openssl_method() -replaced DSA_set_default_method() and DSA_get_default_method() respectively, -and DSA_set_method() and DSA_new_method() were altered to use B<ENGINE>s -rather than B<DSA_METHOD>s during development of OpenSSL 0.9.6. +DSA_set_default_openssl_method() and DSA_get_default_openssl_method() replaced +DSA_set_default_method() and DSA_get_default_method() respectively, and +DSA_set_method() and DSA_new_method() were altered to use B<ENGINE>s rather than +B<DSA_METHOD>s during development of the engine version of OpenSSL 0.9.6. For +0.9.7, the handling of defaults in the ENGINE API was restructured so that this +change was reversed, and behaviour of the other functions resembled more closely +the previous behaviour. The behaviour of defaults in the ENGINE API now +transparently overrides the behaviour of defaults in the DSA API without +requiring changing these function prototypes. =cut diff --git a/lib/libcrypto/doc/DSA_size.pod b/lib/libcrypto/doc/DSA_size.pod index 23b6320a4d4..ba4f650361c 100644 --- a/lib/libcrypto/doc/DSA_size.pod +++ b/lib/libcrypto/doc/DSA_size.pod @@ -8,7 +8,7 @@ DSA_size - get DSA signature size #include <openssl/dsa.h> - int DSA_size(DSA *dsa); + int DSA_size(const DSA *dsa); =head1 DESCRIPTION diff --git a/lib/libcrypto/doc/EVP_SealInit.pod b/lib/libcrypto/doc/EVP_SealInit.pod index 0451eb648a3..25ef07f7c7b 100644 --- a/lib/libcrypto/doc/EVP_SealInit.pod +++ b/lib/libcrypto/doc/EVP_SealInit.pod @@ -73,4 +73,6 @@ L<EVP_OpenInit(3)|EVP_OpenInit(3)> =head1 HISTORY +EVP_SealFinal() did not return a value before OpenSSL 0.9.7. + =cut diff --git a/lib/libcrypto/doc/RAND_set_rand_method.pod b/lib/libcrypto/doc/RAND_set_rand_method.pod index 464eba416d4..c9bb6d9f27b 100644 --- a/lib/libcrypto/doc/RAND_set_rand_method.pod +++ b/lib/libcrypto/doc/RAND_set_rand_method.pod @@ -8,22 +8,30 @@ RAND_set_rand_method, RAND_get_rand_method, RAND_SSLeay - select RAND method #include <openssl/rand.h> - void RAND_set_rand_method(RAND_METHOD *meth); + void RAND_set_rand_method(const RAND_METHOD *meth); - RAND_METHOD *RAND_get_rand_method(void); + const RAND_METHOD *RAND_get_rand_method(void); RAND_METHOD *RAND_SSLeay(void); =head1 DESCRIPTION -A B<RAND_METHOD> specifies the functions that OpenSSL uses for random -number generation. By modifying the method, alternative -implementations such as hardware RNGs may be used. Initially, the -default is to use the OpenSSL internal implementation. RAND_SSLeay() -returns a pointer to that method. +A B<RAND_METHOD> specifies the functions that OpenSSL uses for random number +generation. By modifying the method, alternative implementations such as +hardware RNGs may be used. IMPORTANT: See the NOTES section for important +information about how these RAND API functions are affected by the use of +B<ENGINE> API calls. -RAND_set_rand_method() sets the RAND method to B<meth>. -RAND_get_rand_method() returns a pointer to the current method. +Initially, the default RAND_METHOD is the OpenSSL internal implementation, as +returned by RAND_SSLeay(). + +RAND_set_default_method() makes B<meth> the method for PRNG use. B<NB>: This is +true only whilst no ENGINE has been set as a default for RAND, so this function +is no longer recommended. + +RAND_get_default_method() returns a pointer to the current RAND_METHOD. +However, the meaningfulness of this result is dependant on whether the ENGINE +API is being used, so this function is no longer recommended. =head1 THE RAND_METHOD STRUCTURE @@ -47,13 +55,29 @@ Each component may be NULL if the function is not implemented. RAND_set_rand_method() returns no value. RAND_get_rand_method() and RAND_SSLeay() return pointers to the respective methods. +=head1 NOTES + +As of version 0.9.7, RAND_METHOD implementations are grouped together with other +algorithmic APIs (eg. RSA_METHOD, EVP_CIPHER, etc) in B<ENGINE> modules. If a +default ENGINE is specified for RAND functionality using an ENGINE API function, +that will override any RAND defaults set using the RAND API (ie. +RAND_set_rand_method()). For this reason, the ENGINE API is the recommended way +to control default implementations for use in RAND and other cryptographic +algorithms. + =head1 SEE ALSO -L<rand(3)|rand(3)> +L<rand(3)|rand(3)>, L<engine(3)|engine(3)> =head1 HISTORY RAND_set_rand_method(), RAND_get_rand_method() and RAND_SSLeay() are available in all versions of OpenSSL. +In the engine version of version 0.9.6, RAND_set_rand_method() was altered to +take an ENGINE pointer as its argument. As of version 0.9.7, that has been +reverted as the ENGINE API transparently overrides RAND defaults if used, +otherwise RAND API functions work as before. RAND_set_rand_engine() was also +introduced in version 0.9.7. + =cut diff --git a/lib/libcrypto/doc/RSA_new.pod b/lib/libcrypto/doc/RSA_new.pod index 299047f31fa..3d15b928243 100644 --- a/lib/libcrypto/doc/RSA_new.pod +++ b/lib/libcrypto/doc/RSA_new.pod @@ -14,7 +14,8 @@ RSA_new, RSA_free - allocate and free RSA objects =head1 DESCRIPTION -RSA_new() allocates and initializes an B<RSA> structure. +RSA_new() allocates and initializes an B<RSA> structure. It is equivalent to +calling RSA_new_method(NULL). RSA_free() frees the B<RSA> structure and its components. The key is erased before the memory is returned to the system. @@ -30,7 +31,8 @@ RSA_free() returns no value. =head1 SEE ALSO L<ERR_get_error(3)|ERR_get_error(3)>, L<rsa(3)|rsa(3)>, -L<RSA_generate_key(3)|RSA_generate_key(3)> +L<RSA_generate_key(3)|RSA_generate_key(3)>, +L<RSA_new_method(3)|RSA_new_method(3)> =head1 HISTORY diff --git a/lib/libcrypto/doc/RSA_set_method.pod b/lib/libcrypto/doc/RSA_set_method.pod index 14917dd35f9..0687c2242a5 100644 --- a/lib/libcrypto/doc/RSA_set_method.pod +++ b/lib/libcrypto/doc/RSA_set_method.pod @@ -11,52 +11,64 @@ RSA_null_method, RSA_flags, RSA_new_method - select RSA method #include <openssl/rsa.h> #include <openssl/engine.h> - void RSA_set_default_openssl_method(RSA_METHOD *meth); + void RSA_set_default_method(const RSA_METHOD *meth); - RSA_METHOD *RSA_get_default_openssl_method(void); + RSA_METHOD *RSA_get_default_method(void); - int RSA_set_method(RSA *rsa, ENGINE *engine); + int RSA_set_method(RSA *rsa, const RSA_METHOD *meth); - RSA_METHOD *RSA_get_method(RSA *rsa); + RSA_METHOD *RSA_get_method(const RSA *rsa); RSA_METHOD *RSA_PKCS1_SSLeay(void); RSA_METHOD *RSA_null_method(void); - int RSA_flags(RSA *rsa); + int RSA_flags(const RSA *rsa); RSA *RSA_new_method(ENGINE *engine); =head1 DESCRIPTION An B<RSA_METHOD> specifies the functions that OpenSSL uses for RSA -operations. By modifying the method, alternative implementations -such as hardware accelerators may be used. - -Initially, the default is to use the OpenSSL internal implementation. -RSA_PKCS1_SSLeay() returns a pointer to that method. - -RSA_set_default_openssl_method() makes B<meth> the default method for all B<RSA> -structures created later. B<NB:> This is true only whilst the default engine -for RSA operations remains as "openssl". ENGINEs provide an -encapsulation for implementations of one or more algorithms at a time, and all -the RSA functions mentioned here operate within the scope of the default -"openssl" engine. - -RSA_get_default_openssl_method() returns a pointer to the current default -method for the "openssl" engine. - -RSA_set_method() selects B<engine> for all operations using the key -B<rsa>. - -RSA_get_method() returns a pointer to the RSA_METHOD from the currently -selected ENGINE for B<rsa>. - -RSA_flags() returns the B<flags> that are set for B<rsa>'s current method. +operations. By modifying the method, alternative implementations such as +hardware accelerators may be used. IMPORTANT: See the NOTES section for +important information about how these RSA API functions are affected by the +use of B<ENGINE> API calls. + +Initially, the default RSA_METHOD is the OpenSSL internal implementation, +as returned by RSA_PKCS1_SSLeay(). + +RSA_set_default_method() makes B<meth> the default method for all RSA +structures created later. B<NB>: This is true only whilst no ENGINE has +been set as a default for RSA, so this function is no longer recommended. + +RSA_get_default_method() returns a pointer to the current default +RSA_METHOD. However, the meaningfulness of this result is dependant on +whether the ENGINE API is being used, so this function is no longer +recommended. + +RSA_set_method() selects B<meth> to perform all operations using the key +B<rsa>. This will replace the RSA_METHOD used by the RSA key and if the +previous method was supplied by an ENGINE, the handle to that ENGINE will +be released during the change. It is possible to have RSA keys that only +work with certain RSA_METHOD implementations (eg. from an ENGINE module +that supports embedded hardware-protected keys), and in such cases +attempting to change the RSA_METHOD for the key can have unexpected +results. + +RSA_get_method() returns a pointer to the RSA_METHOD being used by B<rsa>. +This method may or may not be supplied by an ENGINE implementation, but if +it is, the return value can only be guaranteed to be valid as long as the +RSA key itself is valid and does not have its implementation changed by +RSA_set_method(). + +RSA_flags() returns the B<flags> that are set for B<rsa>'s current +RSA_METHOD. See the BUGS section. RSA_new_method() allocates and initializes an RSA structure so that -B<engine> will be used for the RSA operations. If B<engine> is NULL, -the default engine for RSA operations is used. +B<engine> will be used for the RSA operations. If B<engine> is NULL, the +default ENGINE for RSA operations is used, and if no default ENGINE is set, +the RSA_METHOD controlled by RSA_set_default_method() is used. =head1 THE RSA_METHOD STRUCTURE @@ -121,22 +133,45 @@ the default engine for RSA operations is used. =head1 RETURN VALUES -RSA_PKCS1_SSLeay(), RSA_PKCS1_null_method(), RSA_get_default_openssl_method() +RSA_PKCS1_SSLeay(), RSA_PKCS1_null_method(), RSA_get_default_method() and RSA_get_method() return pointers to the respective RSA_METHODs. -RSA_set_default_openssl_method() returns no value. +RSA_set_default_method() returns no value. -RSA_set_method() selects B<engine> as the engine that will be responsible for -all operations using the structure B<rsa>. If this function completes successfully, -then the B<rsa> structure will have its own functional reference of B<engine>, so -the caller should remember to free their own reference to B<engine> when they are -finished with it. NB: An ENGINE's RSA_METHOD can be retrieved (or set) by -ENGINE_get_RSA() or ENGINE_set_RSA(). +RSA_set_method() returns a pointer to the old RSA_METHOD implementation +that was replaced. However, this return value should probably be ignored +because if it was supplied by an ENGINE, the pointer could be invalidated +at any time if the ENGINE is unloaded (in fact it could be unloaded as a +result of the RSA_set_method() function releasing its handle to the +ENGINE). For this reason, the return type may be replaced with a B<void> +declaration in a future release. -RSA_new_method() returns NULL and sets an error code that can be -obtained by L<ERR_get_error(3)|ERR_get_error(3)> if the allocation fails. Otherwise +RSA_new_method() returns NULL and sets an error code that can be obtained +by L<ERR_get_error(3)|ERR_get_error(3)> if the allocation fails. Otherwise it returns a pointer to the newly allocated structure. +=head1 NOTES + +As of version 0.9.7, RSA_METHOD implementations are grouped together with +other algorithmic APIs (eg. DSA_METHOD, EVP_CIPHER, etc) into B<ENGINE> +modules. If a default ENGINE is specified for RSA functionality using an +ENGINE API function, that will override any RSA defaults set using the RSA +API (ie. RSA_set_default_method()). For this reason, the ENGINE API is the +recommended way to control default implementations for use in RSA and other +cryptographic algorithms. + +=head1 BUGS + +The behaviour of RSA_flags() is a mis-feature that is left as-is for now +to avoid creating compatibility problems. RSA functionality, such as the +encryption functions, are controlled by the B<flags> value in the RSA key +itself, not by the B<flags> value in the RSA_METHOD attached to the RSA key +(which is what this function returns). If the flags element of an RSA key +is changed, the changes will be honoured by RSA functionality but will not +be reflected in the return value of the RSA_flags() function - in effect +RSA_flags() behaves more like an RSA_default_flags() function (which does +not currently exist). + =head1 SEE ALSO L<rsa(3)|rsa(3)>, L<RSA_new(3)|RSA_new(3)> @@ -149,8 +184,14 @@ well as the rsa_sign and rsa_verify components of RSA_METHOD were added in OpenSSL 0.9.4. RSA_set_default_openssl_method() and RSA_get_default_openssl_method() -replaced RSA_set_default_method() and RSA_get_default_method() respectively, -and RSA_set_method() and RSA_new_method() were altered to use B<ENGINE>s -rather than B<RSA_METHOD>s during development of OpenSSL 0.9.6. +replaced RSA_set_default_method() and RSA_get_default_method() +respectively, and RSA_set_method() and RSA_new_method() were altered to use +B<ENGINE>s rather than B<RSA_METHOD>s during development of the engine +version of OpenSSL 0.9.6. For 0.9.7, the handling of defaults in the ENGINE +API was restructured so that this change was reversed, and behaviour of the +other functions resembled more closely the previous behaviour. The +behaviour of defaults in the ENGINE API now transparently overrides the +behaviour of defaults in the RSA API without requiring changing these +function prototypes. =cut diff --git a/lib/libcrypto/doc/RSA_size.pod b/lib/libcrypto/doc/RSA_size.pod index b36b4d58d54..5b7f835f95d 100644 --- a/lib/libcrypto/doc/RSA_size.pod +++ b/lib/libcrypto/doc/RSA_size.pod @@ -8,7 +8,7 @@ RSA_size - get RSA modulus size #include <openssl/rsa.h> - int RSA_size(RSA *rsa); + int RSA_size(const RSA *rsa); =head1 DESCRIPTION diff --git a/lib/libcrypto/doc/dh.pod b/lib/libcrypto/doc/dh.pod index b4be4be4058..c3ccd062078 100644 --- a/lib/libcrypto/doc/dh.pod +++ b/lib/libcrypto/doc/dh.pod @@ -12,20 +12,20 @@ dh - Diffie-Hellman key agreement DH * DH_new(void); void DH_free(DH *dh); - int DH_size(DH *dh); + int DH_size(const DH *dh); DH * DH_generate_parameters(int prime_len, int generator, void (*callback)(int, int, void *), void *cb_arg); - int DH_check(DH *dh, int *codes); + int DH_check(const DH *dh, int *codes); int DH_generate_key(DH *dh); int DH_compute_key(unsigned char *key, BIGNUM *pub_key, DH *dh); - void DH_set_default_openssl_method(DH_METHOD *meth); - DH_METHOD *DH_get_default_openssl_method(void); - int DH_set_method(DH *dh, ENGINE *engine); + void DH_set_default_method(const DH_METHOD *meth); + const DH_METHOD *DH_get_default_method(void); + int DH_set_method(DH *dh, const DH_METHOD *meth); DH *DH_new_method(ENGINE *engine); - DH_METHOD *DH_OpenSSL(void); + const DH_METHOD *DH_OpenSSL(void); int DH_get_ex_new_index(long argl, char *argp, int (*new_func)(), int (*dup_func)(), void (*free_func)()); @@ -33,10 +33,10 @@ dh - Diffie-Hellman key agreement char *DH_get_ex_data(DH *d, int idx); DH * d2i_DHparams(DH **a, unsigned char **pp, long length); - int i2d_DHparams(DH *a, unsigned char **pp); + int i2d_DHparams(const DH *a, unsigned char **pp); - int DHparams_print_fp(FILE *fp, DH *x); - int DHparams_print(BIO *bp, DH *x); + int DHparams_print_fp(FILE *fp, const DH *x); + int DHparams_print(BIO *bp, const DH *x); =head1 DESCRIPTION @@ -57,11 +57,20 @@ The B<DH> structure consists of several BIGNUM components. }; DH +Note that DH keys may use non-standard B<DH_METHOD> implementations, +either directly or by the use of B<ENGINE> modules. In some cases (eg. an +ENGINE providing support for hardware-embedded keys), these BIGNUM values +will not be used by the implementation or may be used for alternative data +storage. For this reason, applications should generally avoid using DH +structure elements directly and instead use API functions to query or +modify keys. + =head1 SEE ALSO L<dhparam(1)|dhparam(1)>, L<bn(3)|bn(3)>, L<dsa(3)|dsa(3)>, L<err(3)|err(3)>, -L<rand(3)|rand(3)>, L<rsa(3)|rsa(3)>, L<DH_set_method(3)|DH_set_method(3)>, -L<DH_new(3)|DH_new(3)>, L<DH_get_ex_new_index(3)|DH_get_ex_new_index(3)>, +L<rand(3)|rand(3)>, L<rsa(3)|rsa(3)>, L<engine(3)|engine(3)>, +L<DH_set_method(3)|DH_set_method(3)>, L<DH_new(3)|DH_new(3)>, +L<DH_get_ex_new_index(3)|DH_get_ex_new_index(3)>, L<DH_generate_parameters(3)|DH_generate_parameters(3)>, L<DH_compute_key(3)|DH_compute_key(3)>, L<d2i_DHparams(3)|d2i_DHparams(3)>, L<RSA_print(3)|RSA_print(3)> diff --git a/lib/libcrypto/doc/dsa.pod b/lib/libcrypto/doc/dsa.pod index 573500204bb..ae2e5d81f9a 100644 --- a/lib/libcrypto/doc/dsa.pod +++ b/lib/libcrypto/doc/dsa.pod @@ -12,13 +12,13 @@ dsa - Digital Signature Algorithm DSA * DSA_new(void); void DSA_free(DSA *dsa); - int DSA_size(DSA *dsa); + int DSA_size(const DSA *dsa); DSA * DSA_generate_parameters(int bits, unsigned char *seed, int seed_len, int *counter_ret, unsigned long *h_ret, void (*callback)(int, int, void *), void *cb_arg); - DH * DSA_dup_DH(DSA *r); + DH * DSA_dup_DH(const DSA *r); int DSA_generate_key(DSA *dsa); @@ -27,13 +27,13 @@ dsa - Digital Signature Algorithm int DSA_sign_setup(DSA *dsa, BN_CTX *ctx, BIGNUM **kinvp, BIGNUM **rp); int DSA_verify(int dummy, const unsigned char *dgst, int len, - unsigned char *sigbuf, int siglen, DSA *dsa); + const unsigned char *sigbuf, int siglen, DSA *dsa); - void DSA_set_default_openssl_method(DSA_METHOD *meth); - DSA_METHOD *DSA_get_default_openssl_method(void); - int DSA_set_method(DSA *dsa, ENGINE *engine); + void DSA_set_default_method(const DSA_METHOD *meth); + const DSA_METHOD *DSA_get_default_method(void); + int DSA_set_method(DSA *dsa, const DSA_METHOD *meth); DSA *DSA_new_method(ENGINE *engine); - DSA_METHOD *DSA_OpenSSL(void); + const DSA_METHOD *DSA_OpenSSL(void); int DSA_get_ex_new_index(long argl, char *argp, int (*new_func)(), int (*dup_func)(), void (*free_func)()); @@ -42,7 +42,7 @@ dsa - Digital Signature Algorithm DSA_SIG *DSA_SIG_new(void); void DSA_SIG_free(DSA_SIG *a); - int i2d_DSA_SIG(DSA_SIG *a, unsigned char **pp); + int i2d_DSA_SIG(const DSA_SIG *a, unsigned char **pp); DSA_SIG *d2i_DSA_SIG(DSA_SIG **v, unsigned char **pp, long length); DSA_SIG *DSA_do_sign(const unsigned char *dgst, int dlen, DSA *dsa); @@ -52,14 +52,14 @@ dsa - Digital Signature Algorithm DSA * d2i_DSAPublicKey(DSA **a, unsigned char **pp, long length); DSA * d2i_DSAPrivateKey(DSA **a, unsigned char **pp, long length); DSA * d2i_DSAparams(DSA **a, unsigned char **pp, long length); - int i2d_DSAPublicKey(DSA *a, unsigned char **pp); - int i2d_DSAPrivateKey(DSA *a, unsigned char **pp); - int i2d_DSAparams(DSA *a,unsigned char **pp); + int i2d_DSAPublicKey(const DSA *a, unsigned char **pp); + int i2d_DSAPrivateKey(const DSA *a, unsigned char **pp); + int i2d_DSAparams(const DSA *a,unsigned char **pp); - int DSAparams_print(BIO *bp, DSA *x); - int DSAparams_print_fp(FILE *fp, DSA *x); - int DSA_print(BIO *bp, DSA *x, int off); - int DSA_print_fp(FILE *bp, DSA *x, int off); + int DSAparams_print(BIO *bp, const DSA *x); + int DSAparams_print_fp(FILE *fp, const DSA *x); + int DSA_print(BIO *bp, const DSA *x, int off); + int DSA_print_fp(FILE *bp, const DSA *x, int off); =head1 DESCRIPTION @@ -85,6 +85,14 @@ The B<DSA> structure consists of several BIGNUM components. In public keys, B<priv_key> is NULL. +Note that DSA keys may use non-standard B<DSA_METHOD> implementations, +either directly or by the use of B<ENGINE> modules. In some cases (eg. an +ENGINE providing support for hardware-embedded keys), these BIGNUM values +will not be used by the implementation or may be used for alternative data +storage. For this reason, applications should generally avoid using DSA +structure elements directly and instead use API functions to query or +modify keys. + =head1 CONFORMING TO US Federal Information Processing Standard FIPS 186 (Digital Signature diff --git a/lib/libcrypto/doc/evp.pod b/lib/libcrypto/doc/evp.pod index edf47dbde66..b3ca14314fa 100644 --- a/lib/libcrypto/doc/evp.pod +++ b/lib/libcrypto/doc/evp.pod @@ -24,6 +24,13 @@ functions. The B<EVP_Digest>I<...> functions provide message digests. Algorithms are loaded with OpenSSL_add_all_algorithms(3). +All the symmetric algorithms (ciphers) and digests can be replaced by ENGINE +modules providing alternative implementations. If ENGINE implementations of +ciphers or digests are registered as defaults, then the various EVP functions +will automatically use those implementations automatically in preference to +built in software implementations. For more information, consult the engine(3) +man page. + =head1 SEE ALSO L<EVP_DigestInit(3)|EVP_DigestInit(3)>, @@ -32,6 +39,7 @@ L<EVP_OpenInit(3)|EVP_OpenInit(3)>, L<EVP_SealInit(3)|EVP_SealInit(3)>, L<EVP_SignInit(3)|EVP_SignInit(3)>, L<EVP_VerifyInit(3)|EVP_VerifyInit(3)>, -L<OpenSSL_add_all_algorithms(3)|OpenSSL_add_all_algorithms(3)> +L<OpenSSL_add_all_algorithms(3)|OpenSSL_add_all_algorithms(3)>, +L<engine(3)|engine(3)> =cut diff --git a/lib/libcrypto/doc/rsa.pod b/lib/libcrypto/doc/rsa.pod index 2b93a12b654..45ac53ffc14 100644 --- a/lib/libcrypto/doc/rsa.pod +++ b/lib/libcrypto/doc/rsa.pod @@ -16,13 +16,17 @@ rsa - RSA public key cryptosystem unsigned char *to, RSA *rsa, int padding); int RSA_private_decrypt(int flen, unsigned char *from, unsigned char *to, RSA *rsa, int padding); + int RSA_private_encrypt(int flen, unsigned char *from, + unsigned char *to, RSA *rsa,int padding); + int RSA_public_decrypt(int flen, unsigned char *from, + unsigned char *to, RSA *rsa,int padding); int RSA_sign(int type, unsigned char *m, unsigned int m_len, unsigned char *sigret, unsigned int *siglen, RSA *rsa); int RSA_verify(int type, unsigned char *m, unsigned int m_len, unsigned char *sigbuf, unsigned int siglen, RSA *rsa); - int RSA_size(RSA *rsa); + int RSA_size(const RSA *rsa); RSA *RSA_generate_key(int num, unsigned long e, void (*callback)(int,int,void *), void *cb_arg); @@ -32,13 +36,13 @@ rsa - RSA public key cryptosystem int RSA_blinding_on(RSA *rsa, BN_CTX *ctx); void RSA_blinding_off(RSA *rsa); - void RSA_set_default_openssl_method(RSA_METHOD *meth); - RSA_METHOD *RSA_get_default_openssl_method(void); - int RSA_set_method(RSA *rsa, ENGINE *engine); - RSA_METHOD *RSA_get_method(RSA *rsa); + void RSA_set_default_method(const RSA_METHOD *meth); + const RSA_METHOD *RSA_get_default_method(void); + int RSA_set_method(RSA *rsa, const RSA_METHOD *meth); + const RSA_METHOD *RSA_get_method(const RSA *rsa); RSA_METHOD *RSA_PKCS1_SSLeay(void); RSA_METHOD *RSA_null_method(void); - int RSA_flags(RSA *rsa); + int RSA_flags(const RSA *rsa); RSA *RSA_new_method(ENGINE *engine); int RSA_print(BIO *bp, RSA *x, int offset); @@ -49,11 +53,6 @@ rsa - RSA public key cryptosystem int RSA_set_ex_data(RSA *r,int idx,char *arg); char *RSA_get_ex_data(RSA *r, int idx); - int RSA_private_encrypt(int flen, unsigned char *from, - unsigned char *to, RSA *rsa,int padding); - int RSA_public_decrypt(int flen, unsigned char *from, - unsigned char *to, RSA *rsa,int padding); - int RSA_sign_ASN1_OCTET_STRING(int dummy, unsigned char *m, unsigned int m_len, unsigned char *sigret, unsigned int *siglen, RSA *rsa); @@ -90,6 +89,14 @@ B<p>, B<q>, B<dmp1>, B<dmq1> and B<iqmp> may be B<NULL> in private keys, but the RSA operations are much faster when these values are available. +Note that RSA keys may use non-standard B<RSA_METHOD> implementations, +either directly or by the use of B<ENGINE> modules. In some cases (eg. an +ENGINE providing support for hardware-embedded keys), these BIGNUM values +will not be used by the implementation or may be used for alternative data +storage. For this reason, applications should generally avoid using RSA +structure elements directly and instead use API functions to query or +modify keys. + =head1 CONFORMING TO SSL, PKCS #1 v2.0 @@ -101,7 +108,7 @@ RSA was covered by a US patent which expired in September 2000. =head1 SEE ALSO L<rsa(1)|rsa(1)>, L<bn(3)|bn(3)>, L<dsa(3)|dsa(3)>, L<dh(3)|dh(3)>, -L<rand(3)|rand(3)>, L<RSA_new(3)|RSA_new(3)>, +L<rand(3)|rand(3)>, L<engine(3)|engine(3)>, L<RSA_new(3)|RSA_new(3)>, L<RSA_public_encrypt(3)|RSA_public_encrypt(3)>, L<RSA_sign(3)|RSA_sign(3)>, L<RSA_size(3)|RSA_size(3)>, L<RSA_generate_key(3)|RSA_generate_key(3)>, diff --git a/lib/libcrypto/engine/hw_4758_cca.c b/lib/libcrypto/engine/hw_4758_cca.c index f404b1a3b8f..6d41b9ed2ad 100644 --- a/lib/libcrypto/engine/hw_4758_cca.c +++ b/lib/libcrypto/engine/hw_4758_cca.c @@ -953,7 +953,7 @@ static void cca_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad, int idx, #ifdef ENGINE_DYNAMIC_SUPPORT static int bind_fn(ENGINE *e, const char *id) { - if(id && (strcmp(id, engine_cswift_id) != 0)) + if(id && (strcmp(id, engine_4758_cca_id) != 0)) return 0; if(!bind_helper(e)) return 0; diff --git a/lib/libcrypto/engine/hw_openbsd_dev_crypto.c b/lib/libcrypto/engine/hw_openbsd_dev_crypto.c index f946389b8a3..b8aab545db6 100644 --- a/lib/libcrypto/engine/hw_openbsd_dev_crypto.c +++ b/lib/libcrypto/engine/hw_openbsd_dev_crypto.c @@ -408,7 +408,7 @@ static int do_digest(int ses,unsigned char *md,const void *data,int len) cryp.op=COP_ENCRYPT;/* required to do the MAC rather than check it */ cryp.len=len; cryp.src=(caddr_t)data; - cryp.dst=(caddr_t)data; // FIXME!!! + cryp.dst=(caddr_t)data; /* FIXME!!! */ cryp.mac=(caddr_t)md; if(ioctl(fd, CIOCCRYPT, &cryp) == -1) @@ -420,7 +420,7 @@ static int do_digest(int ses,unsigned char *md,const void *data,int len) dcopy=OPENSSL_malloc(len); memcpy(dcopy,data,len); cryp.src=dcopy; - cryp.dst=cryp.src; // FIXME!!! + cryp.dst=cryp.src; /* FIXME!!! */ if(ioctl(fd, CIOCCRYPT, &cryp) == -1) { @@ -437,7 +437,7 @@ static int do_digest(int ses,unsigned char *md,const void *data,int len) return 0; } } - // printf("done\n"); + /* printf("done\n"); */ return 1; } @@ -483,7 +483,7 @@ static int dev_crypto_md5_copy(EVP_MD_CTX *to,const EVP_MD_CTX *from) const MD_DATA *from_md=from->md_data; MD_DATA *to_md=to->md_data; - // How do we copy sessions? + /* How do we copy sessions? */ assert(from->digest->flags&EVP_MD_FLAG_ONESHOT); to_md->data=OPENSSL_malloc(from_md->len); @@ -530,7 +530,7 @@ static const EVP_MD md5_md= NID_md5, NID_md5WithRSAEncryption, MD5_DIGEST_LENGTH, - EVP_MD_FLAG_ONESHOT, // XXX: set according to device info... + EVP_MD_FLAG_ONESHOT, /* XXX: set according to device info... */ dev_crypto_md5_init, dev_crypto_md5_update, dev_crypto_md5_final, diff --git a/lib/libcrypto/engine/hw_ubsec.c b/lib/libcrypto/engine/hw_ubsec.c index 63397f868c5..ed8401ec162 100644 --- a/lib/libcrypto/engine/hw_ubsec.c +++ b/lib/libcrypto/engine/hw_ubsec.c @@ -93,7 +93,7 @@ static int ubsec_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa); static int ubsec_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx); #ifndef OPENSSL_NO_DSA -#if NOT_USED +#ifdef NOT_USED static int ubsec_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1, BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont); @@ -113,7 +113,7 @@ static int ubsec_dh_compute_key(unsigned char *key,const BIGNUM *pub_key,DH *dh) static int ubsec_dh_generate_key(DH *dh); #endif -#if NOT_USED +#ifdef NOT_USED static int ubsec_rand_bytes(unsigned char *buf, int num); static int ubsec_rand_status(void); #endif @@ -663,7 +663,7 @@ static int ubsec_mod_exp_crt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, } #ifndef OPENSSL_NO_DSA -#if NOT_USED +#ifdef NOT_USED static int ubsec_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1, BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont) @@ -987,7 +987,7 @@ err: } #endif -#if NOT_USED +#ifdef NOT_USED static int ubsec_rand_bytes(unsigned char * buf, int num) { diff --git a/lib/libcrypto/evp/evp_locl.h b/lib/libcrypto/evp/evp_locl.h index 7b088b48480..4d81a3bf4c5 100644 --- a/lib/libcrypto/evp/evp_locl.h +++ b/lib/libcrypto/evp/evp_locl.h @@ -124,17 +124,17 @@ const EVP_CIPHER *EVP_##cname##_##mode(void) { return &cname##_##mode; } BLOCK_CIPHER_def1(cname, cbc, cbc, CBC, kstruct, nid, block_size, key_len, \ iv_len, flags, init_key, cleanup, set_asn1, get_asn1, ctrl) -#define BLOCK_CIPHER_def_cfb(cname, kstruct, nid, block_size, key_len, \ +#define BLOCK_CIPHER_def_cfb(cname, kstruct, nid, key_len, \ iv_len, cbits, flags, init_key, cleanup, \ set_asn1, get_asn1, ctrl) \ -BLOCK_CIPHER_def1(cname, cfb##cbits, cfb, CFB, kstruct, nid, block_size, \ +BLOCK_CIPHER_def1(cname, cfb##cbits, cfb, CFB, kstruct, nid, 1, \ key_len, iv_len, flags, init_key, cleanup, set_asn1, \ get_asn1, ctrl) -#define BLOCK_CIPHER_def_ofb(cname, kstruct, nid, block_size, key_len, \ +#define BLOCK_CIPHER_def_ofb(cname, kstruct, nid, key_len, \ iv_len, cbits, flags, init_key, cleanup, \ set_asn1, get_asn1, ctrl) \ -BLOCK_CIPHER_def1(cname, ofb##cbits, ofb, OFB, kstruct, nid, block_size, \ +BLOCK_CIPHER_def1(cname, ofb##cbits, ofb, OFB, kstruct, nid, 1, \ key_len, iv_len, flags, init_key, cleanup, set_asn1, \ get_asn1, ctrl) @@ -149,9 +149,9 @@ BLOCK_CIPHER_def1(cname, ecb, ecb, ECB, kstruct, nid, block_size, key_len, \ init_key, cleanup, set_asn1, get_asn1, ctrl) \ BLOCK_CIPHER_def_cbc(cname, kstruct, nid, block_size, key_len, iv_len, flags, \ init_key, cleanup, set_asn1, get_asn1, ctrl) \ -BLOCK_CIPHER_def_cfb(cname, kstruct, nid, block_size, key_len, iv_len, cbits, \ +BLOCK_CIPHER_def_cfb(cname, kstruct, nid, key_len, iv_len, cbits, \ flags, init_key, cleanup, set_asn1, get_asn1, ctrl) \ -BLOCK_CIPHER_def_ofb(cname, kstruct, nid, block_size, key_len, iv_len, cbits, \ +BLOCK_CIPHER_def_ofb(cname, kstruct, nid, key_len, iv_len, cbits, \ flags, init_key, cleanup, set_asn1, get_asn1, ctrl) \ BLOCK_CIPHER_def_ecb(cname, kstruct, nid, block_size, key_len, iv_len, flags, \ init_key, cleanup, set_asn1, get_asn1, ctrl) diff --git a/lib/libcrypto/krb5/Makefile.ssl b/lib/libcrypto/krb5/Makefile.ssl index caf111be8d3..7ad0cbb0bcc 100644 --- a/lib/libcrypto/krb5/Makefile.ssl +++ b/lib/libcrypto/krb5/Makefile.ssl @@ -45,13 +45,13 @@ lib: $(LIBOBJ) @touch lib files: - perl $(TOP)/util/files.pl Makefile.ssl >> $(TOP)/MINFO + $(PERL) $(TOP)/util/files.pl Makefile.ssl >> $(TOP)/MINFO links: - @sh $(TOP)/util/point.sh Makefile.ssl Makefile - $(PERL) $(TOP)/util/mklink.pl ../../include/openssl $(EXHEADER) - $(PERL) $(TOP)/util/mklink.pl ../../test $(TEST) - $(PERL) $(TOP)/util/mklink.pl ../../apps $(APPS) + @sh $(TOP)/util/point.sh Makefile.ssl Makefile ; + @$(PERL) $(TOP)/util/mklink.pl ../../include/openssl $(EXHEADER) + @$(PERL) $(TOP)/util/mklink.pl ../../test $(TEST) + @$(PERL) $(TOP)/util/mklink.pl ../../apps $(APPS) install: @for i in $(EXHEADER) ; \ diff --git a/lib/libcrypto/mem.c b/lib/libcrypto/mem.c index effec714e82..a7826908e61 100644 --- a/lib/libcrypto/mem.c +++ b/lib/libcrypto/mem.c @@ -303,6 +303,9 @@ void *CRYPTO_realloc(void *str, int num, const char *file, int line) { void *ret = NULL; + if (str == NULL) + return CRYPTO_malloc(num, file, line); + if (realloc_debug_func != NULL) realloc_debug_func(str, NULL, num, file, line, 0); ret = realloc_ex_func(str,num,file,line); diff --git a/lib/libcrypto/objects/obj_dat.c b/lib/libcrypto/objects/obj_dat.c index 02c3719f04e..ce779dc1b5b 100644 --- a/lib/libcrypto/objects/obj_dat.c +++ b/lib/libcrypto/objects/obj_dat.c @@ -425,7 +425,7 @@ ASN1_OBJECT *OBJ_txt2obj(const char *s, int no_name) a2d_ASN1_OBJECT(p,i,s,-1); p=buf; - op=d2i_ASN1_OBJECT(NULL,&p,i); + op=d2i_ASN1_OBJECT(NULL,&p,j); OPENSSL_free(buf); return op; } diff --git a/lib/libcrypto/ocsp/Makefile.ssl b/lib/libcrypto/ocsp/Makefile.ssl index 44eacbbb138..2be98179aea 100644 --- a/lib/libcrypto/ocsp/Makefile.ssl +++ b/lib/libcrypto/ocsp/Makefile.ssl @@ -47,13 +47,13 @@ lib: $(LIBOBJ) @touch lib files: - perl $(TOP)/util/files.pl Makefile.ssl >> $(TOP)/MINFO + $(PERL) $(TOP)/util/files.pl Makefile.ssl >> $(TOP)/MINFO links: - @sh $(TOP)/util/point.sh Makefile.ssl Makefile - $(PERL) $(TOP)/util/mklink.pl ../../include/openssl $(EXHEADER) - $(PERL) $(TOP)/util/mklink.pl ../../test $(TEST) - $(PERL) $(TOP)/util/mklink.pl ../../apps $(APPS) + @sh $(TOP)/util/point.sh Makefile.ssl Makefile ; + @$(PERL) $(TOP)/util/mklink.pl ../../include/openssl $(EXHEADER) + @$(PERL) $(TOP)/util/mklink.pl ../../test $(TEST) + @$(PERL) $(TOP)/util/mklink.pl ../../apps $(APPS) install: @for i in $(EXHEADER) ; \ diff --git a/lib/libcrypto/pem/pem_lib.c b/lib/libcrypto/pem/pem_lib.c index 18b751a91a8..a8db6ffbf5c 100644 --- a/lib/libcrypto/pem/pem_lib.c +++ b/lib/libcrypto/pem/pem_lib.c @@ -366,8 +366,11 @@ err: memset(iv,0,sizeof(iv)); memset((char *)&ctx,0,sizeof(ctx)); memset(buf,0,PEM_BUFSIZE); - memset(data,0,(unsigned int)dsize); - OPENSSL_free(data); + if (data != NULL) + { + memset(data,0,(unsigned int)dsize); + OPENSSL_free(data); + } return(ret); } diff --git a/lib/libcrypto/pkcs12/p12_asn.c b/lib/libcrypto/pkcs12/p12_asn.c index c327bdba039..a3739fee1a6 100644 --- a/lib/libcrypto/pkcs12/p12_asn.c +++ b/lib/libcrypto/pkcs12/p12_asn.c @@ -83,8 +83,8 @@ ASN1_ADB_TEMPLATE(bag_default) = ASN1_EXP(PKCS12_BAGS, value.other, ASN1_ANY, 0) ASN1_ADB(PKCS12_BAGS) = { ADB_ENTRY(NID_x509Certificate, ASN1_EXP(PKCS12_BAGS, value.x509cert, ASN1_OCTET_STRING, 0)), - ADB_ENTRY(NID_x509Certificate, ASN1_EXP(PKCS12_BAGS, value.x509crl, ASN1_OCTET_STRING, 0)), - ADB_ENTRY(NID_x509Certificate, ASN1_EXP(PKCS12_BAGS, value.sdsicert, ASN1_IA5STRING, 0)), + ADB_ENTRY(NID_x509Crl, ASN1_EXP(PKCS12_BAGS, value.x509crl, ASN1_OCTET_STRING, 0)), + ADB_ENTRY(NID_sdsiCertificate, ASN1_EXP(PKCS12_BAGS, value.sdsicert, ASN1_IA5STRING, 0)), } ASN1_ADB_END(PKCS12_BAGS, 0, type, 0, &bag_default_tt, NULL); ASN1_SEQUENCE(PKCS12_BAGS) = { @@ -98,7 +98,7 @@ ASN1_ADB_TEMPLATE(safebag_default) = ASN1_EXP(PKCS12_SAFEBAG, value.other, ASN1_ ASN1_ADB(PKCS12_SAFEBAG) = { ADB_ENTRY(NID_keyBag, ASN1_EXP(PKCS12_SAFEBAG, value.keybag, PKCS8_PRIV_KEY_INFO, 0)), - ADB_ENTRY(NID_pkcs8ShroudedKeyBag, ASN1_EXP(PKCS12_SAFEBAG, value.keybag, X509_SIG, 0)), + ADB_ENTRY(NID_pkcs8ShroudedKeyBag, ASN1_EXP(PKCS12_SAFEBAG, value.shkeybag, X509_SIG, 0)), ADB_ENTRY(NID_safeContentsBag, ASN1_EXP_SET_OF(PKCS12_SAFEBAG, value.safes, PKCS12_SAFEBAG, 0)), ADB_ENTRY(NID_certBag, ASN1_EXP(PKCS12_SAFEBAG, value.bag, PKCS12_BAGS, 0)), ADB_ENTRY(NID_crlBag, ASN1_EXP(PKCS12_SAFEBAG, value.bag, PKCS12_BAGS, 0)), diff --git a/lib/libcrypto/pkcs7/pk7_lib.c b/lib/libcrypto/pkcs7/pk7_lib.c index c00ed6833a5..985b07245cc 100644 --- a/lib/libcrypto/pkcs7/pk7_lib.c +++ b/lib/libcrypto/pkcs7/pk7_lib.c @@ -74,6 +74,13 @@ long PKCS7_ctrl(PKCS7 *p7, int cmd, long larg, char *parg) if (nid == NID_pkcs7_signed) { ret=p7->detached=(int)larg; + if (ret && PKCS7_type_is_data(p7->d.sign->contents)) + { + ASN1_OCTET_STRING *os; + os=p7->d.sign->contents->d.data; + ASN1_OCTET_STRING_free(os); + p7->d.sign->contents->d.data = NULL; + } } else { diff --git a/lib/libcrypto/ripemd/rmdtest.c b/lib/libcrypto/ripemd/rmdtest.c index 19e9741db2a..be1fb8b1f6d 100644 --- a/lib/libcrypto/ripemd/rmdtest.c +++ b/lib/libcrypto/ripemd/rmdtest.c @@ -59,7 +59,6 @@ #include <stdio.h> #include <string.h> #include <stdlib.h> -#include <openssl/ripemd.h> #ifdef OPENSSL_NO_RIPEMD int main(int argc, char *argv[]) @@ -68,6 +67,7 @@ int main(int argc, char *argv[]) return(0); } #else +#include <openssl/ripemd.h> #include <openssl/evp.h> #ifdef CHARSET_EBCDIC diff --git a/lib/libcrypto/util/libeay.num b/lib/libcrypto/util/libeay.num index 512185e2573..7e5728495f6 100644 --- a/lib/libcrypto/util/libeay.num +++ b/lib/libcrypto/util/libeay.num @@ -2792,3 +2792,4 @@ ASN1_UNIVERSALSTRING_it 3234 EXIST:!EXPORT_VAR_AS_FUNCTION:VARIA ASN1_UNIVERSALSTRING_it 3234 EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION: d2i_ASN1_UNIVERSALSTRING 3235 EXIST::FUNCTION: EVP_des_ede3_ecb 3236 EXIST::FUNCTION:DES +X509_REQ_print_ex 3237 EXIST::FUNCTION:BIO diff --git a/lib/libcrypto/x509/x509.h b/lib/libcrypto/x509/x509.h index c75aa0c7174..7095440d369 100644 --- a/lib/libcrypto/x509/x509.h +++ b/lib/libcrypto/x509/x509.h @@ -331,6 +331,7 @@ DECLARE_STACK_OF(X509_TRUST) #define X509_FLAG_NO_EXTENSIONS (1L << 8) #define X509_FLAG_NO_SIGDUMP (1L << 9) #define X509_FLAG_NO_AUX (1L << 10) +#define X509_FLAG_NO_ATTRIBUTES (1L << 11) /* Flags specific to X509_NAME_print_ex() */ @@ -1015,6 +1016,7 @@ int X509_print(BIO *bp,X509 *x); int X509_ocspid_print(BIO *bp,X509 *x); int X509_CERT_AUX_print(BIO *bp,X509_CERT_AUX *x, int indent); int X509_CRL_print(BIO *bp,X509_CRL *x); +int X509_REQ_print_ex(BIO *bp, X509_REQ *x, unsigned long nmflag, unsigned long cflag); int X509_REQ_print(BIO *bp,X509_REQ *req); #endif diff --git a/lib/libssl/doc/openssl.txt b/lib/libssl/doc/openssl.txt index 5da519e7e46..432a17b66cf 100644 --- a/lib/libssl/doc/openssl.txt +++ b/lib/libssl/doc/openssl.txt @@ -344,7 +344,7 @@ the extension. Examples: -subjectAltName=email:copy,email:my@other.address,URL:http://my.url.here/ +subjectAltName=email:copy,email:my@other.address,URI:http://my.url.here/ subjectAltName=email:my@other.address,RID:1.2.3.4 Issuer Alternative Name. diff --git a/lib/libssl/s3_clnt.c b/lib/libssl/s3_clnt.c index 27df7a5a648..9ce5373b515 100644 --- a/lib/libssl/s3_clnt.c +++ b/lib/libssl/s3_clnt.c @@ -545,7 +545,11 @@ static int ssl3_client_hello(SSL *s) *(p++)=i; if (i != 0) { - die(i <= sizeof s->session->session_id); + if (i > sizeof s->session->session_id) + { + SSLerr(SSL_F_SSL3_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); + goto err; + } memcpy(p,s->session->session_id,i); p+=i; } @@ -1597,7 +1601,11 @@ static int ssl3_send_client_key_exchange(SSL *s) SSL_MAX_MASTER_KEY_LENGTH); EVP_EncryptFinal_ex(&ciph_ctx,&(epms[outl]),&padl); outl += padl; - die(outl <= sizeof epms); + if (outl > sizeof epms) + { + SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); + goto err; + } EVP_CIPHER_CTX_cleanup(&ciph_ctx); /* KerberosWrapper.EncryptedPreMasterSecret */ diff --git a/lib/libssl/s3_srvr.c b/lib/libssl/s3_srvr.c index dfffed7165e..2e1b0eb892b 100644 --- a/lib/libssl/s3_srvr.c +++ b/lib/libssl/s3_srvr.c @@ -966,7 +966,11 @@ static int ssl3_send_server_hello(SSL *s) s->session->session_id_length=0; sl=s->session->session_id_length; - die(sl <= sizeof s->session->session_id); + if (sl > sizeof s->session->session_id) + { + SSLerr(SSL_F_SSL3_SEND_SERVER_HELLO, ERR_R_INTERNAL_ERROR); + return -1; + } *(p++)=sl; memcpy(p,s->session->session_id,sl); p+=sl; diff --git a/lib/libssl/ssl.h b/lib/libssl/ssl.h index d9949e8eb27..e9d1e896d79 100644 --- a/lib/libssl/ssl.h +++ b/lib/libssl/ssl.h @@ -1462,6 +1462,7 @@ void ERR_load_SSL_strings(void); /* Function codes. */ #define SSL_F_CLIENT_CERTIFICATE 100 +#define SSL_F_CLIENT_FINISHED 238 #define SSL_F_CLIENT_HELLO 101 #define SSL_F_CLIENT_MASTER_KEY 102 #define SSL_F_D2I_SSL_SESSION 103 @@ -1475,7 +1476,9 @@ void ERR_load_SSL_strings(void); #define SSL_F_I2D_SSL_SESSION 111 #define SSL_F_READ_N 112 #define SSL_F_REQUEST_CERTIFICATE 113 +#define SSL_F_SERVER_FINISH 239 #define SSL_F_SERVER_HELLO 114 +#define SSL_F_SERVER_VERIFY 240 #define SSL_F_SSL23_ACCEPT 115 #define SSL_F_SSL23_CLIENT_HELLO 116 #define SSL_F_SSL23_CONNECT 117 @@ -1487,6 +1490,7 @@ void ERR_load_SSL_strings(void); #define SSL_F_SSL2_ACCEPT 122 #define SSL_F_SSL2_CONNECT 123 #define SSL_F_SSL2_ENC_INIT 124 +#define SSL_F_SSL2_GENERATE_KEY_MATERIAL 241 #define SSL_F_SSL2_PEEK 234 #define SSL_F_SSL2_READ 125 #define SSL_F_SSL2_READ_INTERNAL 236 @@ -1523,6 +1527,7 @@ void ERR_load_SSL_strings(void); #define SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE 152 #define SSL_F_SSL3_SEND_CLIENT_VERIFY 153 #define SSL_F_SSL3_SEND_SERVER_CERTIFICATE 154 +#define SSL_F_SSL3_SEND_SERVER_HELLO 242 #define SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE 155 #define SSL_F_SSL3_SETUP_BUFFERS 156 #define SSL_F_SSL3_SETUP_KEY_BLOCK 157 @@ -1747,6 +1752,7 @@ void ERR_load_SSL_strings(void); #define SSL_R_SHORT_READ 219 #define SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE 220 #define SSL_R_SSL23_DOING_SESSION_ID_REUSE 221 +#define SSL_R_SSL2_CONNECTION_ID_TOO_LONG 1114 #define SSL_R_SSL3_SESSION_ID_TOO_LONG 1113 #define SSL_R_SSL3_SESSION_ID_TOO_SHORT 222 #define SSL_R_SSLV3_ALERT_BAD_CERTIFICATE 1042 diff --git a/lib/libssl/ssl_asn1.c b/lib/libssl/ssl_asn1.c index c5507479473..23bfe44e218 100644 --- a/lib/libssl/ssl_asn1.c +++ b/lib/libssl/ssl_asn1.c @@ -57,8 +57,8 @@ */ #include <stdio.h> -#include "ssl_locl.h" #include <stdlib.h> +#include "ssl_locl.h" #include <openssl/asn1_mac.h> #include <openssl/objects.h> #include <openssl/x509.h> @@ -293,10 +293,11 @@ SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, unsigned char **pp, i=SSL2_MAX_SSL_SESSION_ID_LENGTH; if (os.length > i) - os.length=i; + os.length = i; + if (os.length > sizeof ret->session_id) /* can't happen */ + os.length = sizeof ret->session_id; ret->session_id_length=os.length; - die(os.length <= sizeof ret->session_id); memcpy(ret->session_id,os.data,os.length); M_ASN1_D2I_get(osp,d2i_ASN1_OCTET_STRING); diff --git a/lib/libssl/ssl_err.c b/lib/libssl/ssl_err.c index 0cad32c855d..7067a745f30 100644 --- a/lib/libssl/ssl_err.c +++ b/lib/libssl/ssl_err.c @@ -67,6 +67,7 @@ static ERR_STRING_DATA SSL_str_functs[]= { {ERR_PACK(0,SSL_F_CLIENT_CERTIFICATE,0), "CLIENT_CERTIFICATE"}, +{ERR_PACK(0,SSL_F_CLIENT_FINISHED,0), "CLIENT_FINISHED"}, {ERR_PACK(0,SSL_F_CLIENT_HELLO,0), "CLIENT_HELLO"}, {ERR_PACK(0,SSL_F_CLIENT_MASTER_KEY,0), "CLIENT_MASTER_KEY"}, {ERR_PACK(0,SSL_F_D2I_SSL_SESSION,0), "d2i_SSL_SESSION"}, @@ -80,7 +81,9 @@ static ERR_STRING_DATA SSL_str_functs[]= {ERR_PACK(0,SSL_F_I2D_SSL_SESSION,0), "i2d_SSL_SESSION"}, {ERR_PACK(0,SSL_F_READ_N,0), "READ_N"}, {ERR_PACK(0,SSL_F_REQUEST_CERTIFICATE,0), "REQUEST_CERTIFICATE"}, +{ERR_PACK(0,SSL_F_SERVER_FINISH,0), "SERVER_FINISH"}, {ERR_PACK(0,SSL_F_SERVER_HELLO,0), "SERVER_HELLO"}, +{ERR_PACK(0,SSL_F_SERVER_VERIFY,0), "SERVER_VERIFY"}, {ERR_PACK(0,SSL_F_SSL23_ACCEPT,0), "SSL23_ACCEPT"}, {ERR_PACK(0,SSL_F_SSL23_CLIENT_HELLO,0), "SSL23_CLIENT_HELLO"}, {ERR_PACK(0,SSL_F_SSL23_CONNECT,0), "SSL23_CONNECT"}, @@ -92,6 +95,7 @@ static ERR_STRING_DATA SSL_str_functs[]= {ERR_PACK(0,SSL_F_SSL2_ACCEPT,0), "SSL2_ACCEPT"}, {ERR_PACK(0,SSL_F_SSL2_CONNECT,0), "SSL2_CONNECT"}, {ERR_PACK(0,SSL_F_SSL2_ENC_INIT,0), "SSL2_ENC_INIT"}, +{ERR_PACK(0,SSL_F_SSL2_GENERATE_KEY_MATERIAL,0), "SSL2_GENERATE_KEY_MATERIAL"}, {ERR_PACK(0,SSL_F_SSL2_PEEK,0), "SSL2_PEEK"}, {ERR_PACK(0,SSL_F_SSL2_READ,0), "SSL2_READ"}, {ERR_PACK(0,SSL_F_SSL2_READ_INTERNAL,0), "SSL2_READ_INTERNAL"}, @@ -128,6 +132,7 @@ static ERR_STRING_DATA SSL_str_functs[]= {ERR_PACK(0,SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,0), "SSL3_SEND_CLIENT_KEY_EXCHANGE"}, {ERR_PACK(0,SSL_F_SSL3_SEND_CLIENT_VERIFY,0), "SSL3_SEND_CLIENT_VERIFY"}, {ERR_PACK(0,SSL_F_SSL3_SEND_SERVER_CERTIFICATE,0), "SSL3_SEND_SERVER_CERTIFICATE"}, +{ERR_PACK(0,SSL_F_SSL3_SEND_SERVER_HELLO,0), "SSL3_SEND_SERVER_HELLO"}, {ERR_PACK(0,SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,0), "SSL3_SEND_SERVER_KEY_EXCHANGE"}, {ERR_PACK(0,SSL_F_SSL3_SETUP_BUFFERS,0), "SSL3_SETUP_BUFFERS"}, {ERR_PACK(0,SSL_F_SSL3_SETUP_KEY_BLOCK,0), "SSL3_SETUP_KEY_BLOCK"}, @@ -355,6 +360,7 @@ static ERR_STRING_DATA SSL_str_reasons[]= {SSL_R_SHORT_READ ,"short read"}, {SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE,"signature for non signing certificate"}, {SSL_R_SSL23_DOING_SESSION_ID_REUSE ,"ssl23 doing session id reuse"}, +{SSL_R_SSL2_CONNECTION_ID_TOO_LONG ,"ssl2 connection id too long"}, {SSL_R_SSL3_SESSION_ID_TOO_LONG ,"ssl3 session id too long"}, {SSL_R_SSL3_SESSION_ID_TOO_SHORT ,"ssl3 session id too short"}, {SSL_R_SSLV3_ALERT_BAD_CERTIFICATE ,"sslv3 alert bad certificate"}, diff --git a/lib/libssl/ssl_lib.c b/lib/libssl/ssl_lib.c index 4a87a146e35..4bc4ce5b3a5 100644 --- a/lib/libssl/ssl_lib.c +++ b/lib/libssl/ssl_lib.c @@ -1405,13 +1405,24 @@ void SSL_CTX_free(SSL_CTX *a) abort(); /* ok */ } #endif - CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data); + /* + * Free internal session cache. However: the remove_cb() may reference + * the ex_data of SSL_CTX, thus the ex_data store can only be removed + * after the sessions were flushed. + * As the ex_data handling routines might also touch the session cache, + * the most secure solution seems to be: empty (flush) the cache, then + * free ex_data, then finally free the cache. + * (See ticket [openssl.org #212].) + */ if (a->sessions != NULL) - { SSL_CTX_flush_sessions(a,0); + + CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data); + + if (a->sessions != NULL) lh_free(a->sessions); - } + if (a->cert_store != NULL) X509_STORE_free(a->cert_store); if (a->cipher_list != NULL) @@ -2289,10 +2300,3 @@ void SSL_set_msg_callback(SSL *ssl, void (*cb)(int write_p, int version, int con IMPLEMENT_STACK_OF(SSL_CIPHER) IMPLEMENT_STACK_OF(SSL_COMP) - -void OpenSSLDie(const char *file,int line,const char *assertion) - { - fprintf(stderr,"%s(%d): OpenSSL internal error, assertion failed: %s\n", - file,line,assertion); - abort(); - } diff --git a/lib/libssl/ssl_locl.h b/lib/libssl/ssl_locl.h index 4c77e27acca..dd6c7a7323f 100644 --- a/lib/libssl/ssl_locl.h +++ b/lib/libssl/ssl_locl.h @@ -510,7 +510,7 @@ STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s); int ssl_verify_alarm_type(long type); int ssl2_enc_init(SSL *s, int client); -void ssl2_generate_key_material(SSL *s); +int ssl2_generate_key_material(SSL *s); void ssl2_enc(SSL *s,int send_data); void ssl2_mac(SSL *s,unsigned char *mac,int send_data); SSL_CIPHER *ssl2_get_cipher_by_char(const unsigned char *p); @@ -616,8 +616,5 @@ int ssl_ok(SSL *s); SSL_COMP *ssl3_comp_find(STACK_OF(SSL_COMP) *sk, int n); STACK_OF(SSL_COMP) *SSL_COMP_get_compression_methods(void); -/* die if we have to */ -void OpenSSLDie(const char *file,int line,const char *assertion); -#define die(e) ((e) ? (void)0 : OpenSSLDie(__FILE__, __LINE__, #e)) #endif diff --git a/lib/libssl/ssl_sess.c b/lib/libssl/ssl_sess.c index a0c3100b29f..664f8c22305 100644 --- a/lib/libssl/ssl_sess.c +++ b/lib/libssl/ssl_sess.c @@ -250,7 +250,12 @@ int ssl_get_new_session(SSL *s, int session) ss->session_id_length=0; } - die(s->sid_ctx_length <= sizeof ss->sid_ctx); + if (s->sid_ctx_length > sizeof ss->sid_ctx) + { + SSLerr(SSL_F_SSL_GET_NEW_SESSION, ERR_R_INTERNAL_ERROR); + SSL_SESSION_free(ss); + return 0; + } memcpy(ss->sid_ctx,s->sid_ctx,s->sid_ctx_length); ss->sid_ctx_length=s->sid_ctx_length; s->session=ss; diff --git a/lib/libssl/test/Makefile.ssl b/lib/libssl/test/Makefile.ssl index c1408021baf..f489332a653 100644 --- a/lib/libssl/test/Makefile.ssl +++ b/lib/libssl/test/Makefile.ssl @@ -224,7 +224,7 @@ test_ec: test_verify: @echo "The following command should have some OK's and some failures" @echo "There are definitly a few expired certificates" - ../apps/openssl verify -CApath ../certs ../certs/*.pem + -../apps/openssl verify -CApath ../certs ../certs/*.pem test_dh: @echo "Generate a set of DH parameters" diff --git a/lib/libssl/test/maketests.com b/lib/libssl/test/maketests.com index b3bf8bb837d..91e859deabe 100644 --- a/lib/libssl/test/maketests.com +++ b/lib/libssl/test/maketests.com @@ -887,7 +887,7 @@ $ CC = CC + "/DEFINE=(" + CCDEFS + ")" + CCDISABLEWARNINGS $! $! Show user the result $! -$ WRITE SYS$OUTPUT "Main Compiling Command: ",CC +$ WRITE/SYMBOL SYS$OUTPUT "Main Compiling Command: ",CC $! $! Else The User Entered An Invalid Arguement. $! diff --git a/lib/libssl/test/tcrl.com b/lib/libssl/test/tcrl.com index 2e6ab2814d8..86bf9735aa6 100644 --- a/lib/libssl/test/tcrl.com +++ b/lib/libssl/test/tcrl.com @@ -13,7 +13,9 @@ $ write sys$output "testing CRL conversions" $ if f$search("fff.*") .nes "" then delete fff.*;* $ if f$search("ff.*") .nes "" then delete ff.*;* $ if f$search("f.*") .nes "" then delete f.*;* -$ copy 't' fff.p +$ convert/fdl=sys$input: 't' fff.p +RECORD + FORMAT STREAM_LF $ $ write sys$output "p -> d" $ 'cmd' -in fff.p -inform p -outform d -out f.d diff --git a/lib/libssl/test/testenc.com b/lib/libssl/test/testenc.com index 3b66f2e0d06..c24fa388c06 100644 --- a/lib/libssl/test/testenc.com +++ b/lib/libssl/test/testenc.com @@ -9,7 +9,9 @@ $ test := p.txt $ cmd := mcr 'exe_dir'openssl $ $ if f$search(test) .nes. "" then delete 'test';* -$ copy 'testsrc' 'test' +$ convert/fdl=sys$input: 'testsrc' 'test' +RECORD + FORMAT STREAM_LF $ $ if f$search(test+"-cipher") .nes. "" then delete 'test'-cipher;* $ if f$search(test+"-clear") .nes. "" then delete 'test'-clear;* diff --git a/lib/libssl/test/tpkcs7.com b/lib/libssl/test/tpkcs7.com index 9e345937c6e..047834fba42 100644 --- a/lib/libssl/test/tpkcs7.com +++ b/lib/libssl/test/tpkcs7.com @@ -13,7 +13,9 @@ $ write sys$output "testing PKCS7 conversions" $ if f$search("fff.*") .nes "" then delete fff.*;* $ if f$search("ff.*") .nes "" then delete ff.*;* $ if f$search("f.*") .nes "" then delete f.*;* -$ copy 't' fff.p +$ convert/fdl=sys$input: 't' fff.p +RECORD + FORMAT STREAM_LF $ $ write sys$output "p -> d" $ 'cmd' -in fff.p -inform p -outform d -out f.d diff --git a/lib/libssl/test/tpkcs7d.com b/lib/libssl/test/tpkcs7d.com index 7d4f8794a4c..193bb72137e 100644 --- a/lib/libssl/test/tpkcs7d.com +++ b/lib/libssl/test/tpkcs7d.com @@ -13,7 +13,9 @@ $ write sys$output "testing PKCS7 conversions (2)" $ if f$search("fff.*") .nes "" then delete fff.*;* $ if f$search("ff.*") .nes "" then delete ff.*;* $ if f$search("f.*") .nes "" then delete f.*;* -$ copy 't' fff.p +$ convert/fdl=sys$input: 't' fff.p +RECORD + FORMAT STREAM_LF $ $ write sys$output "p -> d" $ 'cmd' -in fff.p -inform p -outform d -out f.d diff --git a/lib/libssl/test/treq.com b/lib/libssl/test/treq.com index 22c22c3aa9e..5524e485ba3 100644 --- a/lib/libssl/test/treq.com +++ b/lib/libssl/test/treq.com @@ -13,7 +13,9 @@ $ write sys$output "testing req conversions" $ if f$search("fff.*") .nes "" then delete fff.*;* $ if f$search("ff.*") .nes "" then delete ff.*;* $ if f$search("f.*") .nes "" then delete f.*;* -$ copy 't' fff.p +$ convert/fdl=sys$input: 't' fff.p +RECORD + FORMAT STREAM_LF $ $ write sys$output "p -> d" $ 'cmd' -in fff.p -inform p -outform d -out f.d diff --git a/lib/libssl/test/trsa.com b/lib/libssl/test/trsa.com index 6b6c318e2b5..6dbe59ef644 100644 --- a/lib/libssl/test/trsa.com +++ b/lib/libssl/test/trsa.com @@ -24,7 +24,9 @@ $ write sys$output "testing RSA conversions" $ if f$search("fff.*") .nes "" then delete fff.*;* $ if f$search("ff.*") .nes "" then delete ff.*;* $ if f$search("f.*") .nes "" then delete f.*;* -$ copy 't' fff.p +$ convert/fdl=sys$input: 't' fff.p +RECORD + FORMAT STREAM_LF $ $ write sys$output "p -> d" $ 'cmd' -in fff.p -inform p -outform d -out f.d diff --git a/lib/libssl/test/tsid.com b/lib/libssl/test/tsid.com index bde23f9bb97..abd1d4d7376 100644 --- a/lib/libssl/test/tsid.com +++ b/lib/libssl/test/tsid.com @@ -13,7 +13,9 @@ $ write sys$output "testing session-id conversions" $ if f$search("fff.*") .nes "" then delete fff.*;* $ if f$search("ff.*") .nes "" then delete ff.*;* $ if f$search("f.*") .nes "" then delete f.*;* -$ copy 't' fff.p +$ convert/fdl=sys$input: 't' fff.p +RECORD + FORMAT STREAM_LF $ $ write sys$output "p -> d" $ 'cmd' -in fff.p -inform p -outform d -out f.d diff --git a/lib/libssl/test/tx509.com b/lib/libssl/test/tx509.com index 985969c566f..7b2592f7732 100644 --- a/lib/libssl/test/tx509.com +++ b/lib/libssl/test/tx509.com @@ -13,7 +13,9 @@ $ write sys$output "testing X509 conversions" $ if f$search("fff.*") .nes "" then delete fff.*;* $ if f$search("ff.*") .nes "" then delete ff.*;* $ if f$search("f.*") .nes "" then delete f.*;* -$ copy 't' fff.p +$ convert/fdl=sys$input: 't' fff.p +RECORD + FORMAT STREAM_LF $ $ write sys$output "p -> d" $ 'cmd' -in fff.p -inform p -outform d -out f.d |