[openssl] master update
Matt Caswell
matt at openssl.org
Thu Apr 16 13:26:37 UTC 2020
The branch master has been updated
via 7525c930304c7814b3176d0724f271d2bbb1a09e (commit)
via 465f34ed27d54b36b47f98b8ce4b5ec9e33c4f02 (commit)
via 0820217441b68724d91b7644f3560e15149a1848 (commit)
from b27ed819431fb7f50ded6fcddfd25de079d7e808 (commit)
- Log -----------------------------------------------------------------
commit 7525c930304c7814b3176d0724f271d2bbb1a09e
Author: Matt Caswell <matt at openssl.org>
Date: Thu Apr 9 14:26:25 2020 +0100
Document X509_verify_ex() and X509_REQ_verify_ex()
Reviewed-by: Shane Lontis <shane.lontis at oracle.com>
Reviewed-by: Tomas Mraz <tmraz at fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11507)
commit 465f34ed27d54b36b47f98b8ce4b5ec9e33c4f02
Author: Matt Caswell <matt at openssl.org>
Date: Mon Apr 6 12:14:30 2020 +0100
Introduce an internal version of X509_check_issued()
The internal version is library context aware.
Reviewed-by: Shane Lontis <shane.lontis at oracle.com>
Reviewed-by: Tomas Mraz <tmraz at fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11507)
commit 0820217441b68724d91b7644f3560e15149a1848
Author: Matt Caswell <matt at openssl.org>
Date: Fri Apr 3 18:01:04 2020 +0100
Create a libctx aware X509_verify_ex()
This is the same as X509_verify() except that it takes a libctx and propq
parameter and signature verification is done using those.
Reviewed-by: Shane Lontis <shane.lontis at oracle.com>
Reviewed-by: Tomas Mraz <tmraz at fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11507)
-----------------------------------------------------------------------
Summary of changes:
crypto/x509/v3_purp.c | 12 +++++++++---
crypto/x509/x509_vfy.c | 6 +++---
crypto/x509/x_all.c | 24 ++++++++++++++++++------
doc/man3/X509_sign.pod | 48 ++++++++++++++++++++++++++++++------------------
include/crypto/x509.h | 4 ++++
include/openssl/x509.h | 3 +++
util/libcrypto.num | 2 ++
7 files changed, 69 insertions(+), 30 deletions(-)
diff --git a/crypto/x509/v3_purp.c b/crypto/x509/v3_purp.c
index bee8210bfc..687d065303 100644
--- a/crypto/x509/v3_purp.c
+++ b/crypto/x509/v3_purp.c
@@ -811,14 +811,15 @@ static int no_check(const X509_PURPOSE *xp, const X509 *x, int ca)
* codes for X509_verify_cert()
*/
-int X509_check_issued(X509 *issuer, X509 *subject)
+int x509_check_issued_int(X509 *issuer, X509 *subject, OPENSSL_CTX *libctx,
+ const char *propq)
{
if (X509_NAME_cmp(X509_get_subject_name(issuer),
X509_get_issuer_name(subject)))
return X509_V_ERR_SUBJECT_ISSUER_MISMATCH;
- if (!X509v3_cache_extensions(issuer, NULL, NULL)
- || !X509v3_cache_extensions(subject, NULL, NULL))
+ if (!X509v3_cache_extensions(issuer, libctx, propq)
+ || !X509v3_cache_extensions(subject, libctx, propq))
return X509_V_ERR_UNSPECIFIED;
if (subject->akid) {
@@ -853,6 +854,11 @@ int X509_check_issued(X509 *issuer, X509 *subject)
return X509_V_OK;
}
+int X509_check_issued(X509 *issuer, X509 *subject)
+{
+ return x509_check_issued_int(issuer, subject, NULL, NULL);
+}
+
int X509_check_akid(X509 *issuer, AUTHORITY_KEYID *akid)
{
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index 84a4bb2c60..99479444e6 100644
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -334,7 +334,7 @@ static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer)
return ss;
}
- ret = X509_check_issued(issuer, x);
+ ret = x509_check_issued_int(issuer, x, ctx->libctx, ctx->propq);
if (ret == X509_V_OK) {
int i;
X509 *ch;
@@ -1763,7 +1763,7 @@ static int internal_verify(X509_STORE_CTX *ctx)
if (!verify_cb_cert(ctx, xi, xi != xs ? n+1 : n,
X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY))
return 0;
- } else if (X509_verify(xs, pkey) <= 0) {
+ } else if (X509_verify_ex(xs, pkey, ctx->libctx, ctx->propq) <= 0) {
if (!verify_cb_cert(ctx, xs, n,
X509_V_ERR_CERT_SIGNATURE_FAILURE))
return 0;
@@ -2809,7 +2809,7 @@ static int check_dane_pkeys(X509_STORE_CTX *ctx)
if (t->usage != DANETLS_USAGE_DANE_TA ||
t->selector != DANETLS_SELECTOR_SPKI ||
t->mtype != DANETLS_MATCHING_FULL ||
- X509_verify(cert, t->spki) <= 0)
+ X509_verify_ex(cert, t->spki, ctx->libctx, ctx->propq) <= 0)
continue;
/* Clear any PKIX-?? matches that failed to extend to a full chain */
diff --git a/crypto/x509/x_all.c b/crypto/x509/x_all.c
index 0f31c5155f..6d7f341c7f 100644
--- a/crypto/x509/x_all.c
+++ b/crypto/x509/x_all.c
@@ -34,13 +34,14 @@ static void clean_id_ctx(EVP_MD_CTX *ctx)
EVP_MD_CTX_free(ctx);
}
-static EVP_MD_CTX *make_id_ctx(EVP_PKEY *r, ASN1_OCTET_STRING *id)
+static EVP_MD_CTX *make_id_ctx(EVP_PKEY *r, ASN1_OCTET_STRING *id,
+ OPENSSL_CTX *libctx, const char *propq)
{
EVP_MD_CTX *ctx = NULL;
EVP_PKEY_CTX *pctx = NULL;
if ((ctx = EVP_MD_CTX_new()) == NULL
- || (pctx = EVP_PKEY_CTX_new(r, NULL)) == NULL) {
+ || (pctx = EVP_PKEY_CTX_new_from_pkey(libctx, r, propq)) == NULL) {
X509err(0, ERR_R_MALLOC_FAILURE);
goto error;
}
@@ -63,7 +64,7 @@ static EVP_MD_CTX *make_id_ctx(EVP_PKEY *r, ASN1_OCTET_STRING *id)
return NULL;
}
-int X509_verify(X509 *a, EVP_PKEY *r)
+int X509_verify_ex(X509 *a, EVP_PKEY *r, OPENSSL_CTX *libctx, const char *propq)
{
int rv = 0;
EVP_MD_CTX *ctx = NULL;
@@ -73,7 +74,7 @@ int X509_verify(X509 *a, EVP_PKEY *r)
return 0;
id = a->distinguishing_id;
- if ((ctx = make_id_ctx(r, id)) != NULL) {
+ if ((ctx = make_id_ctx(r, id, libctx, propq)) != NULL) {
rv = ASN1_item_verify_ctx(ASN1_ITEM_rptr(X509_CINF), &a->sig_alg,
&a->signature, &a->cert_info, ctx);
clean_id_ctx(ctx);
@@ -81,14 +82,20 @@ int X509_verify(X509 *a, EVP_PKEY *r)
return rv;
}
-int X509_REQ_verify(X509_REQ *a, EVP_PKEY *r)
+int X509_verify(X509 *a, EVP_PKEY *r)
+{
+ return X509_verify_ex(a, r, NULL, NULL);
+}
+
+int X509_REQ_verify_ex(X509_REQ *a, EVP_PKEY *r, OPENSSL_CTX *libctx,
+ const char *propq)
{
int rv = 0;
EVP_MD_CTX *ctx = NULL;
ASN1_OCTET_STRING *id = NULL;
id = a->distinguishing_id;
- if ((ctx = make_id_ctx(r, id)) != NULL) {
+ if ((ctx = make_id_ctx(r, id, libctx, propq)) != NULL) {
rv = ASN1_item_verify_ctx(ASN1_ITEM_rptr(X509_REQ_INFO), &a->sig_alg,
a->signature, &a->req_info, ctx);
clean_id_ctx(ctx);
@@ -96,6 +103,11 @@ int X509_REQ_verify(X509_REQ *a, EVP_PKEY *r)
return rv;
}
+int X509_REQ_verify(X509_REQ *a, EVP_PKEY *r)
+{
+ return X509_REQ_verify_ex(a, r, NULL, NULL);
+}
+
int NETSCAPE_SPKI_verify(NETSCAPE_SPKI *a, EVP_PKEY *r)
{
return (ASN1_item_verify(ASN1_ITEM_rptr(NETSCAPE_SPKAC),
diff --git a/doc/man3/X509_sign.pod b/doc/man3/X509_sign.pod
index ffc4441397..dca5c3cd72 100644
--- a/doc/man3/X509_sign.pod
+++ b/doc/man3/X509_sign.pod
@@ -2,9 +2,10 @@
=head1 NAME
-X509_sign, X509_sign_ctx, X509_verify, X509_REQ_sign, X509_REQ_sign_ctx,
-X509_REQ_verify, X509_CRL_sign, X509_CRL_sign_ctx, X509_CRL_verify -
-sign or verify certificate, certificate request or CRL signature
+X509_sign, X509_sign_ctx, X509_verify_ex, X509_verify, X509_REQ_sign,
+X509_REQ_sign_ctx, X509_REQ_verify_ex, X509_REQ_verify, X509_CRL_sign,
+X509_CRL_sign_ctx, X509_CRL_verify
+- sign or verify certificate, certificate request or CRL signature
=head1 SYNOPSIS
@@ -12,27 +13,35 @@ sign or verify certificate, certificate request or CRL signature
int X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md);
int X509_sign_ctx(X509 *x, EVP_MD_CTX *ctx);
- int X509_verify(X509 *a, EVP_PKEY *r);
+ int X509_verify_ex(X509 *x, EVP_PKEY *pkey, OPENSSL_CTX *libctx, const char *propq);
+ int X509_verify(X509 *x, EVP_PKEY *pkey;
int X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md);
int X509_REQ_sign_ctx(X509_REQ *x, EVP_MD_CTX *ctx);
- int X509_REQ_verify(X509_REQ *a, EVP_PKEY *r);
+ int X509_REQ_verify_ex(X509_REQ *a, EVP_PKEY *pkey, OPENSSL_CTX *libctx,
+ const char *propq);
+ int X509_REQ_verify(X509_REQ *a, EVP_PKEY *pkey);
int X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md);
int X509_CRL_sign_ctx(X509_CRL *x, EVP_MD_CTX *ctx);
- int X509_CRL_verify(X509_CRL *a, EVP_PKEY *r);
+ int X509_CRL_verify(X509_CRL *a, EVP_PKEY *pkey);
=head1 DESCRIPTION
-X509_sign() signs certificate B<x> using private key B<pkey> and message
-digest B<md> and sets the signature in B<x>. X509_sign_ctx() also signs
-certificate B<x> but uses the parameters contained in digest context B<ctx>.
+X509_sign() signs certificate I<x> using private key I<pkey> and message
+digest I<md> and sets the signature in I<x>. X509_sign_ctx() also signs
+certificate I<x> but uses the parameters contained in digest context I<ctx>.
-X509_verify() verifies the signature of certificate B<x> using public key
-B<pkey>. Only the signature is checked: no other checks (such as certificate
-chain validity) are performed.
+X509_verify_ex() verifies the signature of certificate I<x> using public key
+I<pkey>. Any cryptographic algorithms required for the verification are fetched
+using the library context I<libctx> and the property query string I<propq>. Only
+the signature is checked: no other checks (such as certificate chain validity)
+are performed.
-X509_REQ_sign(), X509_REQ_sign_ctx(), X509_REQ_verify(),
+X509_verify() is the same as X509_verify_ex() except that the default library
+context and property query string are used.
+
+X509_REQ_sign(), X509_REQ_sign_ctx(), X509_REQ_verify_ex(), X509_REQ_verify(),
X509_CRL_sign(), X509_CRL_sign_ctx() and X509_CRL_verify() sign and verify
certificate requests and CRLs respectively.
@@ -55,10 +64,10 @@ X509_sign(), X509_sign_ctx(), X509_REQ_sign(), X509_REQ_sign_ctx(),
X509_CRL_sign() and X509_CRL_sign_ctx() return the size of the signature
in bytes for success and zero for failure.
-X509_verify(), X509_REQ_verify() and X509_CRL_verify() return 1 if the
-signature is valid and 0 if the signature check fails. If the signature
-could not be checked at all because it was invalid or some other error
-occurred then -1 is returned.
+X509_verify_ex(), X509_verify(), X509_REQ_verify_ex(), X509_REQ_verify() and
+X509_CRL_verify() return 1 if the signature is valid and 0 if the signature
+check fails. If the signature could not be checked at all because it was invalid
+or some other error occurred then -1 is returned.
=head1 SEE ALSO
@@ -77,7 +86,8 @@ L<X509_NAME_get_index_by_NID(3)>,
L<X509_NAME_print_ex(3)>,
L<X509_new(3)>,
L<X509V3_get_d2i(3)>,
-L<X509_verify_cert(3)>
+L<X509_verify_cert(3)>,
+L<OPENSSL_CTX(3)>
=head1 HISTORY
@@ -87,6 +97,8 @@ available in all versions of OpenSSL.
The X509_sign_ctx(), X509_REQ_sign_ctx()
and X509_CRL_sign_ctx() functions were added OpenSSL 1.0.1.
+X509_verify_ex() and X509_REQ_verify_ex() were added in OpenSSL 3.0.
+
=head1 COPYRIGHT
Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
diff --git a/include/crypto/x509.h b/include/crypto/x509.h
index 560f3abb76..1d2ec3ee52 100644
--- a/include/crypto/x509.h
+++ b/include/crypto/x509.h
@@ -297,3 +297,7 @@ int x509_set1_time(ASN1_TIME **ptm, const ASN1_TIME *tm);
int x509_print_ex_brief(BIO *bio, X509 *cert, unsigned long neg_cflags);
void x509_init_sig_info(X509 *x);
+
+
+int x509_check_issued_int(X509 *issuer, X509 *subject, OPENSSL_CTX *libctx,
+ const char *propq);
diff --git a/include/openssl/x509.h b/include/openssl/x509.h
index 64156d495b..19ff55f46d 100644
--- a/include/openssl/x509.h
+++ b/include/openssl/x509.h
@@ -355,8 +355,11 @@ void *X509_CRL_get_meth_data(X509_CRL *crl);
const char *X509_verify_cert_error_string(long n);
+int X509_verify_ex(X509 *a, EVP_PKEY *r, OPENSSL_CTX *libctx, const char *propq);
int X509_verify(X509 *a, EVP_PKEY *r);
+int X509_REQ_verify_ex(X509_REQ *a, EVP_PKEY *r, OPENSSL_CTX *libctx,
+ const char *propq);
int X509_REQ_verify(X509_REQ *a, EVP_PKEY *r);
int X509_CRL_verify(X509_CRL *a, EVP_PKEY *r);
int NETSCAPE_SPKI_verify(NETSCAPE_SPKI *a, EVP_PKEY *r);
diff --git a/util/libcrypto.num b/util/libcrypto.num
index e14688c8ef..adcf408d34 100644
--- a/util/libcrypto.num
+++ b/util/libcrypto.num
@@ -5072,3 +5072,5 @@ EVP_PKEY_CTX_set_dh_paramgen_generator ? 3_0_0 EXIST::FUNCTION:DH
EVP_PKEY_CTX_set_dh_nid ? 3_0_0 EXIST::FUNCTION:DH
EVP_PKEY_CTX_set_dh_rfc5114 ? 3_0_0 EXIST::FUNCTION:DH
EVP_PKEY_CTX_set_dhx_rfc5114 ? 3_0_0 EXIST::FUNCTION:DH
+X509_verify_ex ? 3_0_0 EXIST::FUNCTION:
+X509_REQ_verify_ex ? 3_0_0 EXIST::FUNCTION:
More information about the openssl-commits
mailing list