[openssl] master update

Richard Levitte levitte at openssl.org
Fri Apr 5 13:53:43 UTC 2019


The branch master has been updated
       via  de3955f66225e42bfae710c50b51c98aa4616ac1 (commit)
       via  cb92964563a053d5d9c0810912fa6d3ff35c1e16 (commit)
      from  bc362b9b72021c2a066102f4f6bee5afc981e07a (commit)


- Log -----------------------------------------------------------------
commit de3955f66225e42bfae710c50b51c98aa4616ac1
Author: Richard Levitte <levitte at openssl.org>
Date:   Fri Apr 5 10:53:11 2019 +0200

    EVP configuration section: add 'default_properties' command
    
    The value of the 'default_properties' command is simply passed to
    EVP_set_default_properties().
    
    Reviewed-by: Paul Dale <paul.dale at oracle.com>
    (Merged from https://github.com/openssl/openssl/pull/8681)

commit cb92964563a053d5d9c0810912fa6d3ff35c1e16
Author: Richard Levitte <levitte at openssl.org>
Date:   Fri Apr 5 10:46:18 2019 +0200

    EVP_set_default_properties(): New function to set global properties
    
    EVP_MD_fetch() can be given a property query string.  However, there
    are cases when it won't, for example in implicit fetches.  Therefore,
    we also need a way to set a global property query string to be used in
    all subsequent fetches.  This also applies to all future algorithm
    fetching functions.
    
    Reviewed-by: Paul Dale <paul.dale at oracle.com>
    (Merged from https://github.com/openssl/openssl/pull/8681)

-----------------------------------------------------------------------

Summary of changes:
 crypto/err/openssl.txt                  |  1 +
 crypto/evp/evp_cnf.c                    | 22 +++++++++++---
 crypto/evp/evp_err.c                    |  2 ++
 crypto/evp/evp_fetch.c                  | 13 +++++++--
 doc/man3/EVP_MD_fetch.pod               | 11 ++++---
 doc/man3/EVP_set_default_properties.pod | 52 +++++++++++++++++++++++++++++++++
 doc/man5/config.pod                     | 29 +++++++++++++++---
 include/openssl/evp.h                   |  2 ++
 include/openssl/evperr.h                |  1 +
 util/libcrypto.num                      |  1 +
 10 files changed, 120 insertions(+), 14 deletions(-)
 create mode 100644 doc/man3/EVP_set_default_properties.pod

diff --git a/crypto/err/openssl.txt b/crypto/err/openssl.txt
index 19a418f..a3d15c9 100644
--- a/crypto/err/openssl.txt
+++ b/crypto/err/openssl.txt
@@ -858,6 +858,7 @@ EVP_F_EVP_PKEY_VERIFY:142:EVP_PKEY_verify
 EVP_F_EVP_PKEY_VERIFY_INIT:143:EVP_PKEY_verify_init
 EVP_F_EVP_PKEY_VERIFY_RECOVER:144:EVP_PKEY_verify_recover
 EVP_F_EVP_PKEY_VERIFY_RECOVER_INIT:145:EVP_PKEY_verify_recover_init
+EVP_F_EVP_SET_DEFAULT_PROPERTIES:236:EVP_set_default_properties
 EVP_F_EVP_SIGNFINAL:107:EVP_SignFinal
 EVP_F_EVP_VERIFYFINAL:108:EVP_VerifyFinal
 EVP_F_GMAC_CTRL:215:gmac_ctrl
diff --git a/crypto/evp/evp_cnf.c b/crypto/evp/evp_cnf.c
index f75ea67..7cfa0a2 100644
--- a/crypto/evp/evp_cnf.c
+++ b/crypto/evp/evp_cnf.c
@@ -13,9 +13,11 @@
 #include <openssl/conf.h>
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
+#include <openssl/trace.h>
 
 /* Algorithm configuration module. */
 
+/* TODO(3.0): the config module functions should be passed a library context */
 static int alg_module_init(CONF_IMODULE *md, const CONF *cnf)
 {
     int i;
@@ -23,6 +25,9 @@ static int alg_module_init(CONF_IMODULE *md, const CONF *cnf)
     STACK_OF(CONF_VALUE) *sktmp;
     CONF_VALUE *oval;
 
+    OSSL_TRACE2(CONF, "Loading EVP module: name %s, value %s\n",
+                CONF_imodule_get_name(md), CONF_imodule_get_value(md));
+
     oid_section = CONF_imodule_get_value(md);
     if ((sktmp = NCONF_get_section(cnf, oid_section)) == NULL) {
         EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_ERROR_LOADING_SECTION);
@@ -32,18 +37,26 @@ static int alg_module_init(CONF_IMODULE *md, const CONF *cnf)
         oval = sk_CONF_VALUE_value(sktmp, i);
         if (strcmp(oval->name, "fips_mode") == 0) {
             int m;
+
             if (!X509V3_get_value_bool(oval, &m)) {
                 EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_INVALID_FIPS_MODE);
                 return 0;
             }
-            if (m > 0) {
-                EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_FIPS_MODE_NOT_SUPPORTED);
-                return 0;
-            }
+            /*
+             * fips_mode is deprecated and should not be used in new
+             * configurations.  Old configurations are likely to ONLY
+             * have this, so we assume that no default properties have
+             * been set before this.
+             */
+            if (m > 0)
+                EVP_set_default_properties(NULL, "fips=yes");
+        } else if (strcmp(oval->name, "default_properties") == 0) {
+            EVP_set_default_properties(NULL, oval->value);
         } else {
             EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_UNKNOWN_OPTION);
             ERR_add_error_data(4, "name=", oval->name,
                                ", value=", oval->value);
+            return 0;
         }
 
     }
@@ -52,5 +65,6 @@ static int alg_module_init(CONF_IMODULE *md, const CONF *cnf)
 
 void EVP_add_alg_module(void)
 {
+    OSSL_TRACE(CONF, "Adding config module 'alg_section'\n");
     CONF_module_add("alg_section", alg_module_init, 0);
 }
diff --git a/crypto/evp/evp_err.c b/crypto/evp/evp_err.c
index 1a4f381..a9f8800 100644
--- a/crypto/evp/evp_err.c
+++ b/crypto/evp/evp_err.c
@@ -156,6 +156,8 @@ static const ERR_STRING_DATA EVP_str_functs[] = {
      "EVP_PKEY_verify_recover"},
     {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_PKEY_VERIFY_RECOVER_INIT, 0),
      "EVP_PKEY_verify_recover_init"},
+    {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_SET_DEFAULT_PROPERTIES, 0),
+     "EVP_set_default_properties"},
     {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_SIGNFINAL, 0), "EVP_SignFinal"},
     {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_VERIFYFINAL, 0), "EVP_VerifyFinal"},
     {ERR_PACK(ERR_LIB_EVP, EVP_F_GMAC_CTRL, 0), "gmac_ctrl"},
diff --git a/crypto/evp/evp_fetch.c b/crypto/evp/evp_fetch.c
index e50dd59..329129d 100644
--- a/crypto/evp/evp_fetch.c
+++ b/crypto/evp/evp_fetch.c
@@ -78,8 +78,7 @@ static void *alloc_tmp_method_store(void)
         ossl_method_store_free(store);
 }
 
-static
-struct OSSL_METHOD_STORE *get_default_method_store(OPENSSL_CTX *libctx)
+static OSSL_METHOD_STORE *get_default_method_store(OPENSSL_CTX *libctx)
 {
     if (!RUN_ONCE(&default_method_store_init_flag,
                   do_default_method_store_init))
@@ -195,3 +194,13 @@ void *evp_generic_fetch(OPENSSL_CTX *libctx, int operation_id,
 
     return method;
 }
+
+int EVP_set_default_properties(OPENSSL_CTX *libctx, const char *propq)
+{
+    OSSL_METHOD_STORE *store = get_default_method_store(libctx);
+
+    if (store != NULL)
+        return ossl_method_store_set_global_properties(store, propq);
+    EVPerr(EVP_F_EVP_SET_DEFAULT_PROPERTIES, ERR_R_INTERNAL_ERROR);
+    return 0;
+}
diff --git a/doc/man3/EVP_MD_fetch.pod b/doc/man3/EVP_MD_fetch.pod
index 9653604..cba3bc4 100644
--- a/doc/man3/EVP_MD_fetch.pod
+++ b/doc/man3/EVP_MD_fetch.pod
@@ -39,9 +39,11 @@ algorithm from the default provider.
 
 With explicit fetch an application uses the EVP_MD_fetch() function to obtain
 an algorithm implementation. An implementation with the given name and
-satisfying the search criteria specified in the B<properties> parameter will be
-looked for within the available providers and returned. See L<OSSL_PROVIDER(3)>
-for information about providers.
+satisfying the search criteria specified in the B<properties> parameter
+combined with the default search criteria will be looked for within the
+available providers and returned.
+See L<EVP_set_default_properties(3)> for information on default search criteria
+and L<OSSL_PROVIDER(3)> for information about providers.
 
 =item User defined
 
@@ -156,7 +158,8 @@ other providers:
 =head1 SEE ALSO
 
 L<EVP_DigestInit(3)>, L<EVP_MD_meth_new(3)>, L<EVP_MD_meth_free(3)>,
-L<EVP_MD_upref(3)>, L<OSSL_PROVIDER_load(3)>, L<OPENSSL_CTX(3)>
+L<EVP_MD_upref(3)>, L<OSSL_PROVIDER_load(3)>, L<OPENSSL_CTX(3)>,
+L<EVP_set_default_properties(3)>
 
 =head1 HISTORY
 
diff --git a/doc/man3/EVP_set_default_properties.pod b/doc/man3/EVP_set_default_properties.pod
new file mode 100644
index 0000000..077913c
--- /dev/null
+++ b/doc/man3/EVP_set_default_properties.pod
@@ -0,0 +1,52 @@
+=pod
+
+=head1 NAME
+
+EVP_set_default_properties
+- Set default properties for future algorithm fetches
+
+=head1 SYNOPSIS
+
+ #include <openssl/evp.h>
+
+ int EVP_set_default_properties(OPENSSL_CTX *libctx, const char *propq);
+
+=head1 DESCRIPTION
+
+EVP_set_default_properties() sets the default properties for all
+future EVP algorithm fetches, implicit as well as explicit.
+
+=for comment TODO(3.0) We should consider having an EVP document in
+section 7 that details everything about implicit vs explicit fetches
+and how they relate to properties.
+
+EVP_set_default_properties stores the properties given with the string
+I<propq> among the EVP data that's been stored in the library context
+given with I<libctx> (NULL signifies the default library context).
+
+Any previous default property for the specified library context will
+be dropped.
+
+=head1 RETURN VALUES
+
+EVP_set_default_properties() returns 1 on success, or 0 on failure.
+The latter adds an error on the error stack.
+
+=head1 SEE ALSO
+
+L<EVP_MD_fetch>
+
+=head1 HISTORY
+
+The functions described here were added in OpenSSL 3.0.
+
+=head1 COPYRIGHT
+
+Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
+
+Licensed under the Apache License 2.0 (the "License").  You may not use
+this file except in compliance with the License.  You can obtain a copy
+in the file LICENSE in the source distribution or at
+L<https://www.openssl.org/source/license.html>.
+
+=cut
diff --git a/doc/man5/config.pod b/doc/man5/config.pod
index 985b07f..cac4ef6 100644
--- a/doc/man5/config.pod
+++ b/doc/man5/config.pod
@@ -274,12 +274,33 @@ available to the provider.
 
 =head2 EVP Configuration Module
 
-This modules has the name B<alg_section> which points to a section containing
+This module has the name B<alg_section> which points to a section containing
 algorithm commands.
 
-Currently the only algorithm command supported is B<fips_mode> whose
-value can only be the boolean string B<off>. If B<fips_mode> is set to B<on>,
-an error occurs as this library version is not FIPS capable.
+The supported algorithm commands are:
+
+=over 4
+
+=item B<default_properties>
+
+The value may be anything that is acceptable as a property query
+string for EVP_set_default_properties().
+
+=item B<fips_mode> (deprecated)
+
+The value is a boolean that can be B<yes> or B<no>.  If the value is
+B<yes>, this is exactly equivalent to:
+
+    default_properties = fips=yes
+
+If the value is B<no>, nothing happens.
+
+=back
+
+These two commands should not be used together, as there is no control
+over how they affect each other.
+The use of B<fips_mode> is strongly discouraged and is only present
+for backward compatibility with earlier OpenSSL FIPS modules.
 
 =head2 SSL Configuration Module
 
diff --git a/include/openssl/evp.h b/include/openssl/evp.h
index db8eec1..a903b29 100644
--- a/include/openssl/evp.h
+++ b/include/openssl/evp.h
@@ -69,6 +69,8 @@
 extern "C" {
 #endif
 
+int EVP_set_default_properties(OPENSSL_CTX *libctx, const char *propq);
+
 # define EVP_PKEY_MO_SIGN        0x0001
 # define EVP_PKEY_MO_VERIFY      0x0002
 # define EVP_PKEY_MO_ENCRYPT     0x0004
diff --git a/include/openssl/evperr.h b/include/openssl/evperr.h
index 5d3c576..e62cfb3 100644
--- a/include/openssl/evperr.h
+++ b/include/openssl/evperr.h
@@ -128,6 +128,7 @@ int ERR_load_EVP_strings(void);
 # define EVP_F_EVP_PKEY_VERIFY_INIT                       143
 # define EVP_F_EVP_PKEY_VERIFY_RECOVER                    144
 # define EVP_F_EVP_PKEY_VERIFY_RECOVER_INIT               145
+# define EVP_F_EVP_SET_DEFAULT_PROPERTIES                 236
 # define EVP_F_EVP_SIGNFINAL                              107
 # define EVP_F_EVP_VERIFYFINAL                            108
 # define EVP_F_GMAC_CTRL                                  215
diff --git a/util/libcrypto.num b/util/libcrypto.num
index 5b488d0..6388973 100644
--- a/util/libcrypto.num
+++ b/util/libcrypto.num
@@ -4793,3 +4793,4 @@ X509_get0_sm2_id                        4740	3_0_0	EXIST::FUNCTION:SM2
 EVP_PKEY_get0_engine                    4741	3_0_0	EXIST::FUNCTION:ENGINE
 EVP_MD_upref                            4742	3_0_0	EXIST::FUNCTION:
 EVP_MD_fetch                            4743	3_0_0	EXIST::FUNCTION:
+EVP_set_default_properties              4744	3_0_0	EXIST::FUNCTION:


More information about the openssl-commits mailing list