diff options
| author | Pierre Pronchery <pierre@freebsdfoundation.org> | 2023-08-02 16:26:43 +0000 |
|---|---|---|
| committer | Ed Maste <emaste@FreeBSD.org> | 2023-08-03 01:09:39 +0000 |
| commit | cf2fc1b0f5ce501f5a29d307294e5637e0f5aba6 (patch) | |
| tree | a2a5a488a727724dbe0c40f964fd21be2bf2d2c6 /apps | |
| parent | b84c4564effd02dfdc047dd6cbeaf910bbb1a888 (diff) | |
openssl: Vendor import of OpenSSL-3.0.9vendor/openssl/3.0.10
Summary:
Release notes can be found at
https://www.openssl.org/news/openssl-3.0-notes.html .
Obtained from: https://www.openssl.org/source/openssl-3.0.10.tar.gz
Test Plan:
```
$ git status
On branch vendor/openssl-3.0
Your branch is up to date with 'origin/vendor/openssl-3.0'.
nothing to commit, working tree clean
$ (cd ..; fetch https://www.openssl.org/source/openssl-${OSSLVER}.tar.gz https://www.openssl.org/source/openssl-${OSSLVER}.tar.gz.asc)
openssl-3.0.10.tar.gz 14 MB 15 MBps 01s
openssl-3.0.10.tar.gz.asc 833 B 11 MBps 00s
$ set | egrep '(XLIST|OSSLVER)='
OSSLVER=3.0.10
XLIST=FREEBSD-Xlist
$ gpg --list-keys
/home/khorben/.gnupg/pubring.kbx
--------------------------------
pub rsa4096 2011-03-01 [SCA]
DC34EE5DB2417BCC151E5100E5F8F8212F77A498
uid [ unknown] Willem Toorop <willem@nlnetlabs.nl>
sub rsa4096 2011-03-01 [E]
pub rsa4096 2014-10-04 [SC] [expires: 2024-01-30]
EFC0A467D613CB83C7ED6D30D894E2CE8B3D79F5
uid [ unknown] OpenSSL security team <openssl-security@openssl.org>
uid [ unknown] OpenSSL OMC <openssl-omc@openssl.org>
uid [ unknown] OpenSSL Security <openssl-security@openssl.org>
sub rsa4096 2014-10-04 [E] [expires: 2024-01-30]
$ gpg --verify ../openssl-${OSSLVER}.tar.gz.asc ../openssl-${OSSLVER}.tar.gz
gpg: Signature made Tue Aug 1 15:47:28 2023 CEST
gpg: using RSA key EFC0A467D613CB83C7ED6D30D894E2CE8B3D79F5
gpg: Good signature from "OpenSSL security team <openssl-security@openssl.org>" [unknown]
gpg: aka "OpenSSL OMC <openssl-omc@openssl.org>" [unknown]
gpg: aka "OpenSSL Security <openssl-security@openssl.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: EFC0 A467 D613 CB83 C7ED 6D30 D894 E2CE 8B3D 79F5
$ tar -x -X $XLIST -f ../openssl-${OSSLVER}.tar.gz -C ..
$ rsync --exclude FREEBSD.* --delete -avzz ../openssl-${OSSLVER}/* .
[...]
$ diff -arq ../openssl-${OSSLVER} .
Only in .: .git
Only in .: FREEBSD-Xlist
Only in .: FREEBSD-upgrade
$ git status FREEBSD*
On branch vendor/openssl-3.0
Your branch is up to date with 'origin/vendor/openssl-3.0'.
nothing to commit, working tree clean
```
Subscribers: imp
Differential Revision: https://reviews.freebsd.org/D41293
Diffstat (limited to 'apps')
| -rw-r--r-- | apps/ca.c | 52 | ||||
| -rw-r--r-- | apps/cmp.c | 5 | ||||
| -rw-r--r-- | apps/cms.c | 25 | ||||
| -rw-r--r-- | apps/lib/apps.c | 10 | ||||
| -rw-r--r-- | apps/pkeyutl.c | 4 | ||||
| -rw-r--r-- | apps/req.c | 10 | ||||
| -rw-r--r-- | apps/s_client.c | 4 | ||||
| -rw-r--r-- | apps/speed.c | 30 |
8 files changed, 94 insertions, 46 deletions
diff --git a/apps/ca.c b/apps/ca.c index e14a5cff7802..a7a5ab1ecefb 100644 --- a/apps/ca.c +++ b/apps/ca.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -628,6 +628,8 @@ end_of_options: f = NCONF_get_string(conf, section, ENV_NAMEOPT); + if (f == NULL) + ERR_clear_error(); if (f != NULL) { if (!set_nameopt(f)) { BIO_printf(bio_err, "Invalid name options: \"%s\"\n", f); @@ -785,8 +787,10 @@ end_of_options: /* We can have sections in the ext file */ if (extensions == NULL) { extensions = NCONF_get_string(extfile_conf, "default", "extensions"); - if (extensions == NULL) + if (extensions == NULL) { + ERR_clear_error(); extensions = "default"; + } } } @@ -802,15 +806,20 @@ end_of_options: /* * EVP_PKEY_get_default_digest_name() returns 2 if the digest is * mandatory for this algorithm. + * + * That call may give back the name "UNDEF", which has these meanings: + * + * when def_ret == 2: the user MUST leave the digest unspecified + * when def_ret == 1: the user MAY leave the digest unspecified */ if (def_ret == 2 && strcmp(def_dgst, "UNDEF") == 0) { - /* The signing algorithm requires there to be no digest */ dgst = NULL; } else if (dgst == NULL - && (dgst = lookup_conf(conf, section, ENV_DEFAULT_MD)) == NULL) { + && (dgst = lookup_conf(conf, section, ENV_DEFAULT_MD)) == NULL + && strcmp(def_dgst, "UNDEF") != 0) { goto end; } else { - if (strcmp(dgst, "default") == 0) { + if (strcmp(dgst, "default") == 0 || strcmp(def_dgst, "UNDEF") == 0) { if (def_ret <= 0) { BIO_puts(bio_err, "no default digest\n"); goto end; @@ -824,6 +833,8 @@ end_of_options: char *tmp_email_dn = NULL; tmp_email_dn = NCONF_get_string(conf, section, ENV_DEFAULT_EMAIL_DN); + if (tmp_email_dn == NULL) + ERR_clear_error(); if (tmp_email_dn != NULL && strcmp(tmp_email_dn, "no") == 0) email_dn = 0; } @@ -839,6 +850,7 @@ end_of_options: if (NCONF_get_string(conf, section, ENV_RAND_SERIAL) != NULL) { rand_ser = 1; } else { + ERR_clear_error(); serialfile = lookup_conf(conf, section, ENV_SERIAL); if (serialfile == NULL) goto end; @@ -908,8 +920,10 @@ end_of_options: } if (days == 0) { - if (!NCONF_get_number(conf, section, ENV_DEFAULT_DAYS, &days)) + if (!NCONF_get_number(conf, section, ENV_DEFAULT_DAYS, &days)) { + ERR_clear_error(); days = 0; + } } if (enddate == NULL && days == 0) { BIO_printf(bio_err, "cannot lookup how many days to certify for\n"); @@ -1034,7 +1048,7 @@ end_of_options: } } /* - * we have a stack of newly certified certificates and a data base + * we have a stack of newly certified certificates and a database * and serial number that need updating */ @@ -1135,7 +1149,7 @@ end_of_options: if (!rotate_index(dbfile, "new", "old")) goto end; - BIO_printf(bio_err, "Data Base Updated\n"); + BIO_printf(bio_err, "Database updated\n"); } } @@ -1161,22 +1175,28 @@ end_of_options: } } - if ((crlnumberfile = NCONF_get_string(conf, section, ENV_CRLNUMBER)) - != NULL) + crlnumberfile = NCONF_get_string(conf, section, ENV_CRLNUMBER); + if (crlnumberfile != NULL) { if ((crlnumber = load_serial(crlnumberfile, NULL, 0, NULL)) == NULL) { BIO_printf(bio_err, "error while loading CRL number\n"); goto end; } + } else { + ERR_clear_error(); + } if (!crldays && !crlhours && !crlsec) { if (!NCONF_get_number(conf, section, - ENV_DEFAULT_CRL_DAYS, &crldays)) + ENV_DEFAULT_CRL_DAYS, &crldays)) { + ERR_clear_error(); crldays = 0; + } if (!NCONF_get_number(conf, section, - ENV_DEFAULT_CRL_HOURS, &crlhours)) + ENV_DEFAULT_CRL_HOURS, &crlhours)) { + ERR_clear_error(); crlhours = 0; - ERR_clear_error(); + } } if ((crl_nextupdate == NULL) && (crldays == 0) && (crlhours == 0) && (crlsec == 0)) { @@ -1316,7 +1336,7 @@ end_of_options: if (!rotate_index(dbfile, "new", "old")) goto end; - BIO_printf(bio_err, "Data Base Updated\n"); + BIO_printf(bio_err, "Database updated\n"); } } ret = 0; @@ -1758,7 +1778,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, if (verbose) BIO_printf(bio_err, - "The subject name appears to be ok, checking data base for clashes\n"); + "The subject name appears to be ok, checking database for clashes\n"); /* Build the correct Subject if no e-mail is wanted in the subject. */ if (!email_dn) { @@ -1847,7 +1867,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, else if (rrow[DB_type][0] == DB_TYPE_VAL) p = "Valid"; else - p = "\ninvalid type, Data base error\n"; + p = "\ninvalid type, Database error\n"; BIO_printf(bio_err, "Type :%s\n", p);; if (rrow[DB_type][0] == DB_TYPE_REV) { p = rrow[DB_exp_date]; diff --git a/apps/cmp.c b/apps/cmp.c index 3463579c24fb..a317fdb0bf3e 100644 --- a/apps/cmp.c +++ b/apps/cmp.c @@ -2115,7 +2115,7 @@ static const char *prev_item(const char *opt, const char *end) beg = end; while (beg > opt) { --beg; - if (beg[0] == ',' || isspace(beg[0])) { + if (beg[0] == ',' || isspace(_UC(beg[0]))) { ++beg; break; } @@ -2130,7 +2130,7 @@ static const char *prev_item(const char *opt, const char *end) opt_item[len] = '\0'; while (beg > opt) { --beg; - if (beg[0] != ',' && !isspace(beg[0])) { + if (beg[0] != ',' && !isspace(_UC(beg[0]))) { ++beg; break; } @@ -2148,6 +2148,7 @@ static char *conf_get_string(const CONF *src_conf, const char *groups, while ((end = prev_item(groups, end)) != NULL) { if ((res = NCONF_get_string(src_conf, opt_item, name)) != NULL) return res; + ERR_clear_error(); } return res; } diff --git a/apps/cms.c b/apps/cms.c index 76c789671937..0d1730c56fbb 100644 --- a/apps/cms.c +++ b/apps/cms.c @@ -1,5 +1,5 @@ /* - * Copyright 2008-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2008-2023 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -796,6 +796,9 @@ int cms_main(int argc, char **argv) if ((operation & SMIME_IP) == 0 && contfile != NULL) BIO_printf(bio_err, "Warning: -contfile option is ignored for the given operation\n"); + if (operation != SMIME_ENCRYPT && *argv != NULL) + BIO_printf(bio_err, + "Warning: recipient certificate file parameters ignored for operation other than -encrypt\n"); if ((flags & CMS_BINARY) != 0) { if (!(operation & SMIME_OP)) @@ -823,19 +826,13 @@ int cms_main(int argc, char **argv) goto end; } - if (*argv != NULL) { - if (operation == SMIME_ENCRYPT) { - for (; *argv != NULL; argv++) { - cert = load_cert(*argv, FORMAT_UNDEF, - "recipient certificate file"); - if (cert == NULL) - goto end; - sk_X509_push(encerts, cert); - cert = NULL; - } - } else { - BIO_printf(bio_err, "Warning: recipient certificate file parameters ignored for operation other than -encrypt\n"); - } + for (; *argv != NULL; argv++) { + cert = load_cert(*argv, FORMAT_UNDEF, + "recipient certificate file"); + if (cert == NULL) + goto end; + sk_X509_push(encerts, cert); + cert = NULL; } } diff --git a/apps/lib/apps.c b/apps/lib/apps.c index 79afa1deab99..4baeb352fedf 100644 --- a/apps/lib/apps.c +++ b/apps/lib/apps.c @@ -638,13 +638,13 @@ void *app_malloc(size_t sz, const char *what) char *next_item(char *opt) /* in list separated by comma and/or space */ { /* advance to separator (comma or whitespace), if any */ - while (*opt != ',' && !isspace(*opt) && *opt != '\0') + while (*opt != ',' && !isspace(_UC(*opt)) && *opt != '\0') opt++; if (*opt != '\0') { /* terminate current item */ *opt++ = '\0'; /* skip over any whitespace after separator */ - while (isspace(*opt)) + while (isspace(_UC(*opt))) opt++; } return *opt == '\0' ? NULL : opt; /* NULL indicates end of input */ @@ -1679,7 +1679,10 @@ CA_DB *load_index(const char *dbfile, DB_ATTR *db_attr) char *p = NCONF_get_string(dbattr_conf, NULL, "unique_subject"); if (p) { retdb->attributes.unique_subject = parse_yesno(p, 1); + } else { + ERR_clear_error(); } + } retdb->dbfname = OPENSSL_strdup(dbfile); @@ -2008,7 +2011,8 @@ int bio_to_mem(unsigned char **out, int maxlen, BIO *in) BIO_free(mem); return -1; } - maxlen -= len; + if (maxlen != -1) + maxlen -= len; if (maxlen == 0) break; diff --git a/apps/pkeyutl.c b/apps/pkeyutl.c index 518a74166153..3c9f9025a160 100644 --- a/apps/pkeyutl.c +++ b/apps/pkeyutl.c @@ -1,5 +1,5 @@ /* - * Copyright 2006-2022 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2006-2023 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -421,7 +421,7 @@ int pkeyutl_main(int argc, char **argv) /* Raw input data is handled elsewhere */ if (in != NULL && !rawin) { /* Read the input data */ - buf_inlen = bio_to_mem(&buf_in, keysize * 10, in); + buf_inlen = bio_to_mem(&buf_in, -1, in); if (buf_inlen < 0) { BIO_printf(bio_err, "Error reading input Data\n"); goto end; diff --git a/apps/req.c b/apps/req.c index 23757044ab7f..73b320a7098c 100644 --- a/apps/req.c +++ b/apps/req.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -199,7 +199,7 @@ static int duplicated(LHASH_OF(OPENSSL_STRING) *addexts, char *kv) /* Check syntax. */ /* Skip leading whitespace, make a copy. */ - while (*kv && isspace(*kv)) + while (*kv && isspace(_UC(*kv))) if (*++kv == '\0') return 1; if ((p = strchr(kv, '=')) == NULL) @@ -210,7 +210,7 @@ static int duplicated(LHASH_OF(OPENSSL_STRING) *addexts, char *kv) /* Skip trailing space before the equal sign. */ for (p = kv + off; p > kv; --p) - if (!isspace(p[-1])) + if (!isspace(_UC(p[-1]))) break; if (p == kv) { OPENSSL_free(kv); @@ -635,8 +635,10 @@ int req_main(int argc, char **argv) if (newreq && pkey == NULL) { app_RAND_load_conf(req_conf, section); - if (!NCONF_get_number(req_conf, section, BITS, &newkey_len)) + if (!NCONF_get_number(req_conf, section, BITS, &newkey_len)) { + ERR_clear_error(); newkey_len = DEFAULT_KEY_LENGTH; + } genctx = set_keygen_ctx(keyalg, &keyalgstr, &newkey_len, gen_eng); if (genctx == NULL) diff --git a/apps/s_client.c b/apps/s_client.c index a9142386428d..efa2879ca0e7 100644 --- a/apps/s_client.c +++ b/apps/s_client.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved. * Copyright 2005 Nokia. All rights reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use @@ -2271,7 +2271,7 @@ int s_client_main(int argc, char **argv) do { mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ); } - while (mbuf_len > 3 && (!isdigit(mbuf[0]) || !isdigit(mbuf[1]) || !isdigit(mbuf[2]) || mbuf[3] != ' ')); + while (mbuf_len > 3 && (!isdigit((unsigned char)mbuf[0]) || !isdigit((unsigned char)mbuf[1]) || !isdigit((unsigned char)mbuf[2]) || mbuf[3] != ' ')); (void)BIO_flush(fbio); BIO_pop(fbio); BIO_free(fbio); diff --git a/apps/speed.c b/apps/speed.c index addf7e32137f..f30435704d19 100644 --- a/apps/speed.c +++ b/apps/speed.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved. * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved * * Licensed under the Apache License 2.0 (the "License"). You may not use @@ -1005,6 +1005,13 @@ static int EdDSA_sign_loop(void *args) int ret, count; for (count = 0; COND(eddsa_c[testnum][0]); count++) { + ret = EVP_DigestSignInit(edctx[testnum], NULL, NULL, NULL, NULL); + if (ret == 0) { + BIO_printf(bio_err, "EdDSA sign init failure\n"); + ERR_print_errors(bio_err); + count = -1; + break; + } ret = EVP_DigestSign(edctx[testnum], eddsasig, eddsasigsize, buf, 20); if (ret == 0) { BIO_printf(bio_err, "EdDSA sign failure\n"); @@ -1026,6 +1033,13 @@ static int EdDSA_verify_loop(void *args) int ret, count; for (count = 0; COND(eddsa_c[testnum][1]); count++) { + ret = EVP_DigestVerifyInit(edctx[testnum], NULL, NULL, NULL, NULL); + if (ret == 0) { + BIO_printf(bio_err, "EdDSA verify init failure\n"); + ERR_print_errors(bio_err); + count = -1; + break; + } ret = EVP_DigestVerify(edctx[testnum], eddsasig, eddsasigsize, buf, 20); if (ret != 1) { BIO_printf(bio_err, "EdDSA verify failure\n"); @@ -3133,12 +3147,22 @@ skip_hmac: } for (k = 0; k < ALGOR_NUM; k++) { + const char *alg_name = names[k]; + if (!doit[k]) continue; + + if (k == D_EVP) { + if (evp_cipher == NULL) + alg_name = evp_md_name; + else if ((alg_name = EVP_CIPHER_get0_name(evp_cipher)) == NULL) + app_bail_out("failed to get name of cipher '%s'\n", evp_cipher); + } + if (mr) - printf("+F:%u:%s", k, names[k]); + printf("+F:%u:%s", k, alg_name); else - printf("%-13s", names[k]); + printf("%-13s", alg_name); for (testnum = 0; testnum < size_num; testnum++) { if (results[k][testnum] > 10000 && !mr) printf(" %11.2fk", results[k][testnum] / 1e3); |