The branch master has been updated via de3955f66225e42bfae710c50b51c98aa4616ac1 (commit) via cb92964563a053d5d9c0810912fa6d3ff35c1e16 (commit) from bc362b9b72021c2a066102f4f6bee5afc981e07a (commit)
- Log ----------------------------------------------------------------- commit de3955f66225e42bfae710c50b51c98aa4616ac1 Author: Richard Levitte <levi...@openssl.org> Date: Fri Apr 5 10:53:11 2019 +0200 EVP configuration section: add 'default_properties' command The value of the 'default_properties' command is simply passed to EVP_set_default_properties(). Reviewed-by: Paul Dale <paul.d...@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8681) commit cb92964563a053d5d9c0810912fa6d3ff35c1e16 Author: Richard Levitte <levi...@openssl.org> Date: Fri Apr 5 10:46:18 2019 +0200 EVP_set_default_properties(): New function to set global properties EVP_MD_fetch() can be given a property query string. However, there are cases when it won't, for example in implicit fetches. Therefore, we also need a way to set a global property query string to be used in all subsequent fetches. This also applies to all future algorithm fetching functions. Reviewed-by: Paul Dale <paul.d...@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8681) ----------------------------------------------------------------------- Summary of changes: crypto/err/openssl.txt | 1 + crypto/evp/evp_cnf.c | 22 +++++++++++--- crypto/evp/evp_err.c | 2 ++ crypto/evp/evp_fetch.c | 13 +++++++-- doc/man3/EVP_MD_fetch.pod | 11 ++++--- doc/man3/EVP_set_default_properties.pod | 52 +++++++++++++++++++++++++++++++++ doc/man5/config.pod | 29 +++++++++++++++--- include/openssl/evp.h | 2 ++ include/openssl/evperr.h | 1 + util/libcrypto.num | 1 + 10 files changed, 120 insertions(+), 14 deletions(-) create mode 100644 doc/man3/EVP_set_default_properties.pod diff --git a/crypto/err/openssl.txt b/crypto/err/openssl.txt index 19a418f..a3d15c9 100644 --- a/crypto/err/openssl.txt +++ b/crypto/err/openssl.txt @@ -858,6 +858,7 @@ EVP_F_EVP_PKEY_VERIFY:142:EVP_PKEY_verify EVP_F_EVP_PKEY_VERIFY_INIT:143:EVP_PKEY_verify_init EVP_F_EVP_PKEY_VERIFY_RECOVER:144:EVP_PKEY_verify_recover EVP_F_EVP_PKEY_VERIFY_RECOVER_INIT:145:EVP_PKEY_verify_recover_init +EVP_F_EVP_SET_DEFAULT_PROPERTIES:236:EVP_set_default_properties EVP_F_EVP_SIGNFINAL:107:EVP_SignFinal EVP_F_EVP_VERIFYFINAL:108:EVP_VerifyFinal EVP_F_GMAC_CTRL:215:gmac_ctrl diff --git a/crypto/evp/evp_cnf.c b/crypto/evp/evp_cnf.c index f75ea67..7cfa0a2 100644 --- a/crypto/evp/evp_cnf.c +++ b/crypto/evp/evp_cnf.c @@ -13,9 +13,11 @@ #include <openssl/conf.h> #include <openssl/x509.h> #include <openssl/x509v3.h> +#include <openssl/trace.h> /* Algorithm configuration module. */ +/* TODO(3.0): the config module functions should be passed a library context */ static int alg_module_init(CONF_IMODULE *md, const CONF *cnf) { int i; @@ -23,6 +25,9 @@ static int alg_module_init(CONF_IMODULE *md, const CONF *cnf) STACK_OF(CONF_VALUE) *sktmp; CONF_VALUE *oval; + OSSL_TRACE2(CONF, "Loading EVP module: name %s, value %s\n", + CONF_imodule_get_name(md), CONF_imodule_get_value(md)); + oid_section = CONF_imodule_get_value(md); if ((sktmp = NCONF_get_section(cnf, oid_section)) == NULL) { EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_ERROR_LOADING_SECTION); @@ -32,18 +37,26 @@ static int alg_module_init(CONF_IMODULE *md, const CONF *cnf) oval = sk_CONF_VALUE_value(sktmp, i); if (strcmp(oval->name, "fips_mode") == 0) { int m; + if (!X509V3_get_value_bool(oval, &m)) { EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_INVALID_FIPS_MODE); return 0; } - if (m > 0) { - EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_FIPS_MODE_NOT_SUPPORTED); - return 0; - } + /* + * fips_mode is deprecated and should not be used in new + * configurations. Old configurations are likely to ONLY + * have this, so we assume that no default properties have + * been set before this. + */ + if (m > 0) + EVP_set_default_properties(NULL, "fips=yes"); + } else if (strcmp(oval->name, "default_properties") == 0) { + EVP_set_default_properties(NULL, oval->value); } else { EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_UNKNOWN_OPTION); ERR_add_error_data(4, "name=", oval->name, ", value=", oval->value); + return 0; } } @@ -52,5 +65,6 @@ static int alg_module_init(CONF_IMODULE *md, const CONF *cnf) void EVP_add_alg_module(void) { + OSSL_TRACE(CONF, "Adding config module 'alg_section'\n"); CONF_module_add("alg_section", alg_module_init, 0); } diff --git a/crypto/evp/evp_err.c b/crypto/evp/evp_err.c index 1a4f381..a9f8800 100644 --- a/crypto/evp/evp_err.c +++ b/crypto/evp/evp_err.c @@ -156,6 +156,8 @@ static const ERR_STRING_DATA EVP_str_functs[] = { "EVP_PKEY_verify_recover"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_PKEY_VERIFY_RECOVER_INIT, 0), "EVP_PKEY_verify_recover_init"}, + {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_SET_DEFAULT_PROPERTIES, 0), + "EVP_set_default_properties"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_SIGNFINAL, 0), "EVP_SignFinal"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_VERIFYFINAL, 0), "EVP_VerifyFinal"}, {ERR_PACK(ERR_LIB_EVP, EVP_F_GMAC_CTRL, 0), "gmac_ctrl"}, diff --git a/crypto/evp/evp_fetch.c b/crypto/evp/evp_fetch.c index e50dd59..329129d 100644 --- a/crypto/evp/evp_fetch.c +++ b/crypto/evp/evp_fetch.c @@ -78,8 +78,7 @@ static void *alloc_tmp_method_store(void) ossl_method_store_free(store); } -static -struct OSSL_METHOD_STORE *get_default_method_store(OPENSSL_CTX *libctx) +static OSSL_METHOD_STORE *get_default_method_store(OPENSSL_CTX *libctx) { if (!RUN_ONCE(&default_method_store_init_flag, do_default_method_store_init)) @@ -195,3 +194,13 @@ void *evp_generic_fetch(OPENSSL_CTX *libctx, int operation_id, return method; } + +int EVP_set_default_properties(OPENSSL_CTX *libctx, const char *propq) +{ + OSSL_METHOD_STORE *store = get_default_method_store(libctx); + + if (store != NULL) + return ossl_method_store_set_global_properties(store, propq); + EVPerr(EVP_F_EVP_SET_DEFAULT_PROPERTIES, ERR_R_INTERNAL_ERROR); + return 0; +} diff --git a/doc/man3/EVP_MD_fetch.pod b/doc/man3/EVP_MD_fetch.pod index 9653604..cba3bc4 100644 --- a/doc/man3/EVP_MD_fetch.pod +++ b/doc/man3/EVP_MD_fetch.pod @@ -39,9 +39,11 @@ algorithm from the default provider. With explicit fetch an application uses the EVP_MD_fetch() function to obtain an algorithm implementation. An implementation with the given name and -satisfying the search criteria specified in the B<properties> parameter will be -looked for within the available providers and returned. See L<OSSL_PROVIDER(3)> -for information about providers. +satisfying the search criteria specified in the B<properties> parameter +combined with the default search criteria will be looked for within the +available providers and returned. +See L<EVP_set_default_properties(3)> for information on default search criteria +and L<OSSL_PROVIDER(3)> for information about providers. =item User defined @@ -156,7 +158,8 @@ other providers: =head1 SEE ALSO L<EVP_DigestInit(3)>, L<EVP_MD_meth_new(3)>, L<EVP_MD_meth_free(3)>, -L<EVP_MD_upref(3)>, L<OSSL_PROVIDER_load(3)>, L<OPENSSL_CTX(3)> +L<EVP_MD_upref(3)>, L<OSSL_PROVIDER_load(3)>, L<OPENSSL_CTX(3)>, +L<EVP_set_default_properties(3)> =head1 HISTORY diff --git a/doc/man3/EVP_set_default_properties.pod b/doc/man3/EVP_set_default_properties.pod new file mode 100644 index 0000000..077913c --- /dev/null +++ b/doc/man3/EVP_set_default_properties.pod @@ -0,0 +1,52 @@ +=pod + +=head1 NAME + +EVP_set_default_properties +- Set default properties for future algorithm fetches + +=head1 SYNOPSIS + + #include <openssl/evp.h> + + int EVP_set_default_properties(OPENSSL_CTX *libctx, const char *propq); + +=head1 DESCRIPTION + +EVP_set_default_properties() sets the default properties for all +future EVP algorithm fetches, implicit as well as explicit. + +=for comment TODO(3.0) We should consider having an EVP document in +section 7 that details everything about implicit vs explicit fetches +and how they relate to properties. + +EVP_set_default_properties stores the properties given with the string +I<propq> among the EVP data that's been stored in the library context +given with I<libctx> (NULL signifies the default library context). + +Any previous default property for the specified library context will +be dropped. + +=head1 RETURN VALUES + +EVP_set_default_properties() returns 1 on success, or 0 on failure. +The latter adds an error on the error stack. + +=head1 SEE ALSO + +L<EVP_MD_fetch> + +=head1 HISTORY + +The functions described here were added in OpenSSL 3.0. + +=head1 COPYRIGHT + +Copyright 2019 The OpenSSL Project Authors. All Rights Reserved. + +Licensed under the Apache License 2.0 (the "License"). You may not use +this file except in compliance with the License. You can obtain a copy +in the file LICENSE in the source distribution or at +L<https://www.openssl.org/source/license.html>. + +=cut diff --git a/doc/man5/config.pod b/doc/man5/config.pod index 985b07f..cac4ef6 100644 --- a/doc/man5/config.pod +++ b/doc/man5/config.pod @@ -274,12 +274,33 @@ available to the provider. =head2 EVP Configuration Module -This modules has the name B<alg_section> which points to a section containing +This module has the name B<alg_section> which points to a section containing algorithm commands. -Currently the only algorithm command supported is B<fips_mode> whose -value can only be the boolean string B<off>. If B<fips_mode> is set to B<on>, -an error occurs as this library version is not FIPS capable. +The supported algorithm commands are: + +=over 4 + +=item B<default_properties> + +The value may be anything that is acceptable as a property query +string for EVP_set_default_properties(). + +=item B<fips_mode> (deprecated) + +The value is a boolean that can be B<yes> or B<no>. If the value is +B<yes>, this is exactly equivalent to: + + default_properties = fips=yes + +If the value is B<no>, nothing happens. + +=back + +These two commands should not be used together, as there is no control +over how they affect each other. +The use of B<fips_mode> is strongly discouraged and is only present +for backward compatibility with earlier OpenSSL FIPS modules. =head2 SSL Configuration Module diff --git a/include/openssl/evp.h b/include/openssl/evp.h index db8eec1..a903b29 100644 --- a/include/openssl/evp.h +++ b/include/openssl/evp.h @@ -69,6 +69,8 @@ extern "C" { #endif +int EVP_set_default_properties(OPENSSL_CTX *libctx, const char *propq); + # define EVP_PKEY_MO_SIGN 0x0001 # define EVP_PKEY_MO_VERIFY 0x0002 # define EVP_PKEY_MO_ENCRYPT 0x0004 diff --git a/include/openssl/evperr.h b/include/openssl/evperr.h index 5d3c576..e62cfb3 100644 --- a/include/openssl/evperr.h +++ b/include/openssl/evperr.h @@ -128,6 +128,7 @@ int ERR_load_EVP_strings(void); # define EVP_F_EVP_PKEY_VERIFY_INIT 143 # define EVP_F_EVP_PKEY_VERIFY_RECOVER 144 # define EVP_F_EVP_PKEY_VERIFY_RECOVER_INIT 145 +# define EVP_F_EVP_SET_DEFAULT_PROPERTIES 236 # define EVP_F_EVP_SIGNFINAL 107 # define EVP_F_EVP_VERIFYFINAL 108 # define EVP_F_GMAC_CTRL 215 diff --git a/util/libcrypto.num b/util/libcrypto.num index 5b488d0..6388973 100644 --- a/util/libcrypto.num +++ b/util/libcrypto.num @@ -4793,3 +4793,4 @@ X509_get0_sm2_id 4740 3_0_0 EXIST::FUNCTION:SM2 EVP_PKEY_get0_engine 4741 3_0_0 EXIST::FUNCTION:ENGINE EVP_MD_upref 4742 3_0_0 EXIST::FUNCTION: EVP_MD_fetch 4743 3_0_0 EXIST::FUNCTION: +EVP_set_default_properties 4744 3_0_0 EXIST::FUNCTION: