[openssl] master update
Richard Levitte
levitte at openssl.org
Fri Apr 5 13:53:43 UTC 2019
The branch master has been updated
via de3955f66225e42bfae710c50b51c98aa4616ac1 (commit)
via cb92964563a053d5d9c0810912fa6d3ff35c1e16 (commit)
from bc362b9b72021c2a066102f4f6bee5afc981e07a (commit)
- Log -----------------------------------------------------------------
commit de3955f66225e42bfae710c50b51c98aa4616ac1
Author: Richard Levitte <levitte at openssl.org>
Date: Fri Apr 5 10:53:11 2019 +0200
EVP configuration section: add 'default_properties' command
The value of the 'default_properties' command is simply passed to
EVP_set_default_properties().
Reviewed-by: Paul Dale <paul.dale at oracle.com>
(Merged from https://github.com/openssl/openssl/pull/8681)
commit cb92964563a053d5d9c0810912fa6d3ff35c1e16
Author: Richard Levitte <levitte at openssl.org>
Date: Fri Apr 5 10:46:18 2019 +0200
EVP_set_default_properties(): New function to set global properties
EVP_MD_fetch() can be given a property query string. However, there
are cases when it won't, for example in implicit fetches. Therefore,
we also need a way to set a global property query string to be used in
all subsequent fetches. This also applies to all future algorithm
fetching functions.
Reviewed-by: Paul Dale <paul.dale at oracle.com>
(Merged from https://github.com/openssl/openssl/pull/8681)
-----------------------------------------------------------------------
Summary of changes:
crypto/err/openssl.txt | 1 +
crypto/evp/evp_cnf.c | 22 +++++++++++---
crypto/evp/evp_err.c | 2 ++
crypto/evp/evp_fetch.c | 13 +++++++--
doc/man3/EVP_MD_fetch.pod | 11 ++++---
doc/man3/EVP_set_default_properties.pod | 52 +++++++++++++++++++++++++++++++++
doc/man5/config.pod | 29 +++++++++++++++---
include/openssl/evp.h | 2 ++
include/openssl/evperr.h | 1 +
util/libcrypto.num | 1 +
10 files changed, 120 insertions(+), 14 deletions(-)
create mode 100644 doc/man3/EVP_set_default_properties.pod
diff --git a/crypto/err/openssl.txt b/crypto/err/openssl.txt
index 19a418f..a3d15c9 100644
--- a/crypto/err/openssl.txt
+++ b/crypto/err/openssl.txt
@@ -858,6 +858,7 @@ EVP_F_EVP_PKEY_VERIFY:142:EVP_PKEY_verify
EVP_F_EVP_PKEY_VERIFY_INIT:143:EVP_PKEY_verify_init
EVP_F_EVP_PKEY_VERIFY_RECOVER:144:EVP_PKEY_verify_recover
EVP_F_EVP_PKEY_VERIFY_RECOVER_INIT:145:EVP_PKEY_verify_recover_init
+EVP_F_EVP_SET_DEFAULT_PROPERTIES:236:EVP_set_default_properties
EVP_F_EVP_SIGNFINAL:107:EVP_SignFinal
EVP_F_EVP_VERIFYFINAL:108:EVP_VerifyFinal
EVP_F_GMAC_CTRL:215:gmac_ctrl
diff --git a/crypto/evp/evp_cnf.c b/crypto/evp/evp_cnf.c
index f75ea67..7cfa0a2 100644
--- a/crypto/evp/evp_cnf.c
+++ b/crypto/evp/evp_cnf.c
@@ -13,9 +13,11 @@
#include <openssl/conf.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
+#include <openssl/trace.h>
/* Algorithm configuration module. */
+/* TODO(3.0): the config module functions should be passed a library context */
static int alg_module_init(CONF_IMODULE *md, const CONF *cnf)
{
int i;
@@ -23,6 +25,9 @@ static int alg_module_init(CONF_IMODULE *md, const CONF *cnf)
STACK_OF(CONF_VALUE) *sktmp;
CONF_VALUE *oval;
+ OSSL_TRACE2(CONF, "Loading EVP module: name %s, value %s\n",
+ CONF_imodule_get_name(md), CONF_imodule_get_value(md));
+
oid_section = CONF_imodule_get_value(md);
if ((sktmp = NCONF_get_section(cnf, oid_section)) == NULL) {
EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_ERROR_LOADING_SECTION);
@@ -32,18 +37,26 @@ static int alg_module_init(CONF_IMODULE *md, const CONF *cnf)
oval = sk_CONF_VALUE_value(sktmp, i);
if (strcmp(oval->name, "fips_mode") == 0) {
int m;
+
if (!X509V3_get_value_bool(oval, &m)) {
EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_INVALID_FIPS_MODE);
return 0;
}
- if (m > 0) {
- EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_FIPS_MODE_NOT_SUPPORTED);
- return 0;
- }
+ /*
+ * fips_mode is deprecated and should not be used in new
+ * configurations. Old configurations are likely to ONLY
+ * have this, so we assume that no default properties have
+ * been set before this.
+ */
+ if (m > 0)
+ EVP_set_default_properties(NULL, "fips=yes");
+ } else if (strcmp(oval->name, "default_properties") == 0) {
+ EVP_set_default_properties(NULL, oval->value);
} else {
EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_UNKNOWN_OPTION);
ERR_add_error_data(4, "name=", oval->name,
", value=", oval->value);
+ return 0;
}
}
@@ -52,5 +65,6 @@ static int alg_module_init(CONF_IMODULE *md, const CONF *cnf)
void EVP_add_alg_module(void)
{
+ OSSL_TRACE(CONF, "Adding config module 'alg_section'\n");
CONF_module_add("alg_section", alg_module_init, 0);
}
diff --git a/crypto/evp/evp_err.c b/crypto/evp/evp_err.c
index 1a4f381..a9f8800 100644
--- a/crypto/evp/evp_err.c
+++ b/crypto/evp/evp_err.c
@@ -156,6 +156,8 @@ static const ERR_STRING_DATA EVP_str_functs[] = {
"EVP_PKEY_verify_recover"},
{ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_PKEY_VERIFY_RECOVER_INIT, 0),
"EVP_PKEY_verify_recover_init"},
+ {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_SET_DEFAULT_PROPERTIES, 0),
+ "EVP_set_default_properties"},
{ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_SIGNFINAL, 0), "EVP_SignFinal"},
{ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_VERIFYFINAL, 0), "EVP_VerifyFinal"},
{ERR_PACK(ERR_LIB_EVP, EVP_F_GMAC_CTRL, 0), "gmac_ctrl"},
diff --git a/crypto/evp/evp_fetch.c b/crypto/evp/evp_fetch.c
index e50dd59..329129d 100644
--- a/crypto/evp/evp_fetch.c
+++ b/crypto/evp/evp_fetch.c
@@ -78,8 +78,7 @@ static void *alloc_tmp_method_store(void)
ossl_method_store_free(store);
}
-static
-struct OSSL_METHOD_STORE *get_default_method_store(OPENSSL_CTX *libctx)
+static OSSL_METHOD_STORE *get_default_method_store(OPENSSL_CTX *libctx)
{
if (!RUN_ONCE(&default_method_store_init_flag,
do_default_method_store_init))
@@ -195,3 +194,13 @@ void *evp_generic_fetch(OPENSSL_CTX *libctx, int operation_id,
return method;
}
+
+int EVP_set_default_properties(OPENSSL_CTX *libctx, const char *propq)
+{
+ OSSL_METHOD_STORE *store = get_default_method_store(libctx);
+
+ if (store != NULL)
+ return ossl_method_store_set_global_properties(store, propq);
+ EVPerr(EVP_F_EVP_SET_DEFAULT_PROPERTIES, ERR_R_INTERNAL_ERROR);
+ return 0;
+}
diff --git a/doc/man3/EVP_MD_fetch.pod b/doc/man3/EVP_MD_fetch.pod
index 9653604..cba3bc4 100644
--- a/doc/man3/EVP_MD_fetch.pod
+++ b/doc/man3/EVP_MD_fetch.pod
@@ -39,9 +39,11 @@ algorithm from the default provider.
With explicit fetch an application uses the EVP_MD_fetch() function to obtain
an algorithm implementation. An implementation with the given name and
-satisfying the search criteria specified in the B<properties> parameter will be
-looked for within the available providers and returned. See L<OSSL_PROVIDER(3)>
-for information about providers.
+satisfying the search criteria specified in the B<properties> parameter
+combined with the default search criteria will be looked for within the
+available providers and returned.
+See L<EVP_set_default_properties(3)> for information on default search criteria
+and L<OSSL_PROVIDER(3)> for information about providers.
=item User defined
@@ -156,7 +158,8 @@ other providers:
=head1 SEE ALSO
L<EVP_DigestInit(3)>, L<EVP_MD_meth_new(3)>, L<EVP_MD_meth_free(3)>,
-L<EVP_MD_upref(3)>, L<OSSL_PROVIDER_load(3)>, L<OPENSSL_CTX(3)>
+L<EVP_MD_upref(3)>, L<OSSL_PROVIDER_load(3)>, L<OPENSSL_CTX(3)>,
+L<EVP_set_default_properties(3)>
=head1 HISTORY
diff --git a/doc/man3/EVP_set_default_properties.pod b/doc/man3/EVP_set_default_properties.pod
new file mode 100644
index 0000000..077913c
--- /dev/null
+++ b/doc/man3/EVP_set_default_properties.pod
@@ -0,0 +1,52 @@
+=pod
+
+=head1 NAME
+
+EVP_set_default_properties
+- Set default properties for future algorithm fetches
+
+=head1 SYNOPSIS
+
+ #include <openssl/evp.h>
+
+ int EVP_set_default_properties(OPENSSL_CTX *libctx, const char *propq);
+
+=head1 DESCRIPTION
+
+EVP_set_default_properties() sets the default properties for all
+future EVP algorithm fetches, implicit as well as explicit.
+
+=for comment TODO(3.0) We should consider having an EVP document in
+section 7 that details everything about implicit vs explicit fetches
+and how they relate to properties.
+
+EVP_set_default_properties stores the properties given with the string
+I<propq> among the EVP data that's been stored in the library context
+given with I<libctx> (NULL signifies the default library context).
+
+Any previous default property for the specified library context will
+be dropped.
+
+=head1 RETURN VALUES
+
+EVP_set_default_properties() returns 1 on success, or 0 on failure.
+The latter adds an error on the error stack.
+
+=head1 SEE ALSO
+
+L<EVP_MD_fetch>
+
+=head1 HISTORY
+
+The functions described here were added in OpenSSL 3.0.
+
+=head1 COPYRIGHT
+
+Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
+
+Licensed under the Apache License 2.0 (the "License"). You may not use
+this file except in compliance with the License. You can obtain a copy
+in the file LICENSE in the source distribution or at
+L<https://www.openssl.org/source/license.html>.
+
+=cut
diff --git a/doc/man5/config.pod b/doc/man5/config.pod
index 985b07f..cac4ef6 100644
--- a/doc/man5/config.pod
+++ b/doc/man5/config.pod
@@ -274,12 +274,33 @@ available to the provider.
=head2 EVP Configuration Module
-This modules has the name B<alg_section> which points to a section containing
+This module has the name B<alg_section> which points to a section containing
algorithm commands.
-Currently the only algorithm command supported is B<fips_mode> whose
-value can only be the boolean string B<off>. If B<fips_mode> is set to B<on>,
-an error occurs as this library version is not FIPS capable.
+The supported algorithm commands are:
+
+=over 4
+
+=item B<default_properties>
+
+The value may be anything that is acceptable as a property query
+string for EVP_set_default_properties().
+
+=item B<fips_mode> (deprecated)
+
+The value is a boolean that can be B<yes> or B<no>. If the value is
+B<yes>, this is exactly equivalent to:
+
+ default_properties = fips=yes
+
+If the value is B<no>, nothing happens.
+
+=back
+
+These two commands should not be used together, as there is no control
+over how they affect each other.
+The use of B<fips_mode> is strongly discouraged and is only present
+for backward compatibility with earlier OpenSSL FIPS modules.
=head2 SSL Configuration Module
diff --git a/include/openssl/evp.h b/include/openssl/evp.h
index db8eec1..a903b29 100644
--- a/include/openssl/evp.h
+++ b/include/openssl/evp.h
@@ -69,6 +69,8 @@
extern "C" {
#endif
+int EVP_set_default_properties(OPENSSL_CTX *libctx, const char *propq);
+
# define EVP_PKEY_MO_SIGN 0x0001
# define EVP_PKEY_MO_VERIFY 0x0002
# define EVP_PKEY_MO_ENCRYPT 0x0004
diff --git a/include/openssl/evperr.h b/include/openssl/evperr.h
index 5d3c576..e62cfb3 100644
--- a/include/openssl/evperr.h
+++ b/include/openssl/evperr.h
@@ -128,6 +128,7 @@ int ERR_load_EVP_strings(void);
# define EVP_F_EVP_PKEY_VERIFY_INIT 143
# define EVP_F_EVP_PKEY_VERIFY_RECOVER 144
# define EVP_F_EVP_PKEY_VERIFY_RECOVER_INIT 145
+# define EVP_F_EVP_SET_DEFAULT_PROPERTIES 236
# define EVP_F_EVP_SIGNFINAL 107
# define EVP_F_EVP_VERIFYFINAL 108
# define EVP_F_GMAC_CTRL 215
diff --git a/util/libcrypto.num b/util/libcrypto.num
index 5b488d0..6388973 100644
--- a/util/libcrypto.num
+++ b/util/libcrypto.num
@@ -4793,3 +4793,4 @@ X509_get0_sm2_id 4740 3_0_0 EXIST::FUNCTION:SM2
EVP_PKEY_get0_engine 4741 3_0_0 EXIST::FUNCTION:ENGINE
EVP_MD_upref 4742 3_0_0 EXIST::FUNCTION:
EVP_MD_fetch 4743 3_0_0 EXIST::FUNCTION:
+EVP_set_default_properties 4744 3_0_0 EXIST::FUNCTION:
More information about the openssl-commits
mailing list