Compare commits
2 Commits
openssl
...
tk-8.5.15.
| Author | SHA1 | Date | |
|---|---|---|---|
|
27e7dfc7da | ||
|
|
4b29e0458f |
@@ -1,2 +0,0 @@
|
||||
Please https://www.openssl.org/community/thanks.html for the current
|
||||
acknowledgements.
|
||||
21
AUTHORS
21
AUTHORS
@@ -1,21 +0,0 @@
|
||||
Andy Polyakov
|
||||
Ben Laurie
|
||||
Bodo M<>ller
|
||||
Emilia K<>sper
|
||||
Eric Young
|
||||
Geoff Thorpe
|
||||
Holger Reif
|
||||
Kurt Roeckx
|
||||
Lutz J<>nicke
|
||||
Mark J. Cox
|
||||
Matt Caswell
|
||||
Nils Larsch
|
||||
Paul C. Sutton
|
||||
Ralf S. Engelschall
|
||||
Rich Salz
|
||||
Richard Levitte
|
||||
Stephen Henson
|
||||
Steve Marquess
|
||||
Tim Hudson
|
||||
Ulf M<>ller
|
||||
Viktor Dukhovni
|
||||
71
CONTRIBUTING
71
CONTRIBUTING
@@ -1,71 +0,0 @@
|
||||
HOW TO CONTRIBUTE TO OpenSSL
|
||||
----------------------------
|
||||
|
||||
(Please visit https://www.openssl.org/community/getting-started.html for
|
||||
other ideas about how to contribute.)
|
||||
|
||||
Development is done on GitHub, https://github.com/openssl/openssl.
|
||||
|
||||
To request new features or report bugs, please open an issue on GitHub
|
||||
|
||||
To submit a patch, please open a pull request on GitHub. If you are thinking
|
||||
of making a large contribution, open an issue for it before starting work,
|
||||
to get comments from the community. Someone may be already working on
|
||||
the same thing or there may be reasons why that feature isn't implemented.
|
||||
|
||||
To make it easier to review and accept your pull request, please follow these
|
||||
guidelines:
|
||||
|
||||
1. Anything other than a trivial contribution requires a Contributor
|
||||
License Agreement (CLA), giving us permission to use your code. See
|
||||
https://www.openssl.org/policies/cla.html for details. If your
|
||||
contribution is too small to require a CLA, put "CLA: trivial" on a
|
||||
line by itself in your commit message body.
|
||||
|
||||
2. All source files should start with the following text (with
|
||||
appropriate comment characters at the start of each line and the
|
||||
year(s) updated):
|
||||
|
||||
Copyright 20xx-20yy The OpenSSL Project Authors. All Rights Reserved.
|
||||
|
||||
Licensed under the OpenSSL license (the "License"). You may not use
|
||||
this file except in compliance with the License. You can obtain a copy
|
||||
in the file LICENSE in the source distribution or at
|
||||
https://www.openssl.org/source/license.html
|
||||
|
||||
3. Patches should be as current as possible; expect to have to rebase
|
||||
often. We do not accept merge commits, you will have to remove them
|
||||
(usually by rebasing) before it will be acceptable.
|
||||
|
||||
4. Patches should follow our coding style (see
|
||||
https://www.openssl.org/policies/codingstyle.html) and compile
|
||||
without warnings. Where gcc or clang is available you should use the
|
||||
--strict-warnings Configure option. OpenSSL compiles on many varied
|
||||
platforms: try to ensure you only use portable features. Clean builds
|
||||
via Travis and AppVeyor are required, and they are started automatically
|
||||
whenever a PR is created or updated.
|
||||
|
||||
5. When at all possible, patches should include tests. These can
|
||||
either be added to an existing test, or completely new. Please see
|
||||
test/README for information on the test framework.
|
||||
|
||||
6. New features or changed functionality must include
|
||||
documentation. Please look at the "pod" files in doc for
|
||||
examples of our style.
|
||||
|
||||
7. For user visible changes (API changes, behaviour changes, ...),
|
||||
consider adding a note in CHANGES. This could be a summarising
|
||||
description of the change, and could explain the grander details.
|
||||
Have a look through existing entries for inspiration.
|
||||
Please note that this is NOT simply a copy of git-log oneliners.
|
||||
Also note that security fixes get an entry in CHANGES.
|
||||
This file helps users get more in depth information of what comes
|
||||
with a specific release without having to sift through the higher
|
||||
noise ratio in git-log.
|
||||
|
||||
8. For larger or more important user visible changes, as well as
|
||||
security fixes, please add a line in NEWS. On exception, it might be
|
||||
worth adding a multi-line entry (such as the entry that announces all
|
||||
the types that became opaque with OpenSSL 1.1.0).
|
||||
This file helps users get a very quick summary of what comes with a
|
||||
specific release, to see if an upgrade is worth the effort.
|
||||
7877
ChangeLog.2002
Normal file
7877
ChangeLog.2002
Normal file
File diff suppressed because it is too large
Load Diff
3653
ChangeLog.2004
Normal file
3653
ChangeLog.2004
Normal file
File diff suppressed because it is too large
Load Diff
@@ -1,299 +0,0 @@
|
||||
# -*- Mode: perl -*-
|
||||
%targets=(
|
||||
DEFAULTS => {
|
||||
template => 1,
|
||||
|
||||
cflags => "",
|
||||
defines => [],
|
||||
thread_scheme => "(unknown)", # Assume we don't know
|
||||
thread_defines => [],
|
||||
|
||||
apps_aux_src => "",
|
||||
cpuid_asm_src => "mem_clr.c",
|
||||
uplink_aux_src => "",
|
||||
bn_asm_src => "bn_asm.c",
|
||||
ec_asm_src => "",
|
||||
des_asm_src => "des_enc.c fcrypt_b.c",
|
||||
aes_asm_src => "aes_core.c aes_cbc.c",
|
||||
bf_asm_src => "bf_enc.c",
|
||||
md5_asm_src => "",
|
||||
cast_asm_src => "c_enc.c",
|
||||
rc4_asm_src => "rc4_enc.c rc4_skey.c",
|
||||
rmd160_asm_src => "",
|
||||
rc5_asm_src => "rc5_enc.c",
|
||||
wp_asm_src => "wp_block.c",
|
||||
cmll_asm_src => "camellia.c cmll_misc.c cmll_cbc.c",
|
||||
modes_asm_src => "",
|
||||
padlock_asm_src => "",
|
||||
chacha_asm_src => "chacha_enc.c",
|
||||
poly1305_asm_src => "",
|
||||
|
||||
unistd => "<unistd.h>",
|
||||
shared_target => "",
|
||||
shared_cflag => "",
|
||||
shared_defines => [],
|
||||
shared_ldflag => "",
|
||||
shared_rcflag => "",
|
||||
shared_extension => "",
|
||||
|
||||
build_scheme => [ "unified", "unix" ],
|
||||
build_file => "Makefile",
|
||||
},
|
||||
|
||||
BASE_common => {
|
||||
template => 1,
|
||||
defines =>
|
||||
sub {
|
||||
my @defs = ();
|
||||
push @defs, "ZLIB" unless $disabled{zlib};
|
||||
push @defs, "ZLIB_SHARED" unless $disabled{"zlib-dynamic"};
|
||||
return [ @defs ];
|
||||
},
|
||||
},
|
||||
|
||||
BASE_unix => {
|
||||
inherit_from => [ "BASE_common" ],
|
||||
template => 1,
|
||||
|
||||
ex_libs =>
|
||||
sub {
|
||||
unless ($disabled{zlib}) {
|
||||
if (defined($disabled{"zlib-dynamic"})) {
|
||||
if (defined($withargs{zlib_lib})) {
|
||||
return "-L".$withargs{zlib_lib}." -lz";
|
||||
} else {
|
||||
return "-lz";
|
||||
}
|
||||
}
|
||||
}
|
||||
return (); },
|
||||
|
||||
shared_extension => ".so",
|
||||
|
||||
build_scheme => [ "unified", "unix" ],
|
||||
build_file => "Makefile",
|
||||
},
|
||||
|
||||
BASE_Windows => {
|
||||
inherit_from => [ "BASE_common" ],
|
||||
template => 1,
|
||||
|
||||
ex_libs =>
|
||||
sub {
|
||||
unless ($disabled{zlib}) {
|
||||
if (defined($disabled{"zlib-dynamic"})) {
|
||||
return $withargs{zlib_lib} // "ZLIB1";
|
||||
}
|
||||
}
|
||||
return ();
|
||||
},
|
||||
|
||||
ld => "link",
|
||||
lflags => "/nologo",
|
||||
loutflag => "/out:",
|
||||
ar => "lib",
|
||||
arflags => "/nologo",
|
||||
aroutflag => "/out:",
|
||||
rc => "rc",
|
||||
rcoutflag => "/fo",
|
||||
mt => "mt",
|
||||
mtflags => "-nologo",
|
||||
mtinflag => "-manifest ",
|
||||
mtoutflag => "-outputresource:",
|
||||
|
||||
shared_extension => ".dll",
|
||||
|
||||
build_file => "makefile",
|
||||
build_scheme => [ "unified", "windows" ],
|
||||
},
|
||||
|
||||
BASE_VMS => {
|
||||
inherit_from => [ "BASE_common" ],
|
||||
template => 1,
|
||||
|
||||
shared_extension => ".exe",
|
||||
|
||||
build_file => "descrip.mms",
|
||||
build_scheme => [ "unified", "VMS" ],
|
||||
},
|
||||
|
||||
uplink_common => {
|
||||
template => 1,
|
||||
apps_aux_src => add("../ms/applink.c"),
|
||||
uplink_aux_src => add("../ms/uplink.c"),
|
||||
defines => add("OPENSSL_USE_APPLINK"),
|
||||
},
|
||||
x86_uplink => {
|
||||
inherit_from => [ "uplink_common" ],
|
||||
template => 1,
|
||||
uplink_aux_src => add("uplink-x86.s"),
|
||||
},
|
||||
x86_64_uplink => {
|
||||
inherit_from => [ "uplink_common" ],
|
||||
template => 1,
|
||||
uplink_aux_src => add("uplink-x86_64.s"),
|
||||
},
|
||||
ia64_uplink => {
|
||||
inherit_from => [ "uplink_common" ],
|
||||
template => 1,
|
||||
uplink_aux_src => add("uplink-ia64.s"),
|
||||
},
|
||||
|
||||
x86_asm => {
|
||||
template => 1,
|
||||
cpuid_asm_src => "x86cpuid.s",
|
||||
bn_asm_src => "bn-586.s co-586.s x86-mont.s x86-gf2m.s",
|
||||
ec_asm_src => "ecp_nistz256.c ecp_nistz256-x86.s",
|
||||
des_asm_src => "des-586.s crypt586.s",
|
||||
aes_asm_src => "aes-586.s vpaes-x86.s aesni-x86.s",
|
||||
bf_asm_src => "bf-586.s",
|
||||
md5_asm_src => "md5-586.s",
|
||||
cast_asm_src => "cast-586.s",
|
||||
sha1_asm_src => "sha1-586.s sha256-586.s sha512-586.s",
|
||||
rc4_asm_src => "rc4-586.s",
|
||||
rmd160_asm_src => "rmd-586.s",
|
||||
rc5_asm_src => "rc5-586.s",
|
||||
wp_asm_src => "wp_block.c wp-mmx.s",
|
||||
cmll_asm_src => "cmll-x86.s",
|
||||
modes_asm_src => "ghash-x86.s",
|
||||
padlock_asm_src => "e_padlock-x86.s",
|
||||
chacha_asm_src => "chacha-x86.s",
|
||||
poly1305_asm_src=> "poly1305-x86.s",
|
||||
},
|
||||
x86_elf_asm => {
|
||||
template => 1,
|
||||
inherit_from => [ "x86_asm" ],
|
||||
perlasm_scheme => "elf"
|
||||
},
|
||||
x86_64_asm => {
|
||||
template => 1,
|
||||
cpuid_asm_src => "x86_64cpuid.s",
|
||||
bn_asm_src => "asm/x86_64-gcc.c x86_64-mont.s x86_64-mont5.s x86_64-gf2m.s rsaz_exp.c rsaz-x86_64.s rsaz-avx2.s",
|
||||
ec_asm_src => "ecp_nistz256.c ecp_nistz256-x86_64.s",
|
||||
aes_asm_src => "aes-x86_64.s vpaes-x86_64.s bsaes-x86_64.s aesni-x86_64.s aesni-sha1-x86_64.s aesni-sha256-x86_64.s aesni-mb-x86_64.s",
|
||||
md5_asm_src => "md5-x86_64.s",
|
||||
sha1_asm_src => "sha1-x86_64.s sha256-x86_64.s sha512-x86_64.s sha1-mb-x86_64.s sha256-mb-x86_64.s",
|
||||
rc4_asm_src => "rc4-x86_64.s rc4-md5-x86_64.s",
|
||||
wp_asm_src => "wp-x86_64.s",
|
||||
cmll_asm_src => "cmll-x86_64.s cmll_misc.c",
|
||||
modes_asm_src => "ghash-x86_64.s aesni-gcm-x86_64.s",
|
||||
padlock_asm_src => "e_padlock-x86_64.s",
|
||||
chacha_asm_src => "chacha-x86_64.s",
|
||||
poly1305_asm_src=> "poly1305-x86_64.s",
|
||||
},
|
||||
ia64_asm => {
|
||||
template => 1,
|
||||
cpuid_asm_src => "ia64cpuid.s",
|
||||
bn_asm_src => "bn-ia64.s ia64-mont.s",
|
||||
aes_asm_src => "aes_core.c aes_cbc.c aes-ia64.s",
|
||||
md5_asm_src => "md5-ia64.s",
|
||||
sha1_asm_src => "sha1-ia64.s sha256-ia64.s sha512-ia64.s",
|
||||
rc4_asm_src => "rc4-ia64.s rc4_skey.c",
|
||||
modes_asm_src => "ghash-ia64.s",
|
||||
perlasm_scheme => "void"
|
||||
},
|
||||
sparcv9_asm => {
|
||||
template => 1,
|
||||
cpuid_asm_src => "sparcv9cap.c sparccpuid.S",
|
||||
bn_asm_src => "asm/sparcv8plus.S sparcv9-mont.S sparcv9a-mont.S vis3-mont.S sparct4-mont.S sparcv9-gf2m.S",
|
||||
ec_asm_src => "ecp_nistz256.c ecp_nistz256-sparcv9.S",
|
||||
des_asm_src => "des_enc-sparc.S fcrypt_b.c dest4-sparcv9.S",
|
||||
aes_asm_src => "aes_core.c aes_cbc.c aes-sparcv9.S aest4-sparcv9.S aesfx-sparcv9.S",
|
||||
md5_asm_src => "md5-sparcv9.S",
|
||||
sha1_asm_src => "sha1-sparcv9.S sha256-sparcv9.S sha512-sparcv9.S",
|
||||
cmll_asm_src => "camellia.c cmll_misc.c cmll_cbc.c cmllt4-sparcv9.S",
|
||||
modes_asm_src => "ghash-sparcv9.S",
|
||||
poly1305_asm_src=> "poly1305-sparcv9.S",
|
||||
perlasm_scheme => "void"
|
||||
},
|
||||
sparcv8_asm => {
|
||||
template => 1,
|
||||
cpuid_asm_src => "",
|
||||
bn_asm_src => "asm/sparcv8.S",
|
||||
des_asm_src => "des_enc-sparc.S fcrypt_b.c",
|
||||
perlasm_scheme => "void"
|
||||
},
|
||||
alpha_asm => {
|
||||
template => 1,
|
||||
cpuid_asm_src => "alphacpuid.s",
|
||||
bn_asm_src => "bn_asm.c alpha-mont.S",
|
||||
sha1_asm_src => "sha1-alpha.S",
|
||||
modes_asm_src => "ghash-alpha.S",
|
||||
perlasm_scheme => "void"
|
||||
},
|
||||
mips32_asm => {
|
||||
template => 1,
|
||||
bn_asm_src => "bn-mips.s mips-mont.s",
|
||||
aes_asm_src => "aes_cbc.c aes-mips.S",
|
||||
sha1_asm_src => "sha1-mips.S sha256-mips.S",
|
||||
},
|
||||
mips64_asm => {
|
||||
inherit_from => [ "mips32_asm" ],
|
||||
template => 1,
|
||||
sha1_asm_src => add("sha512-mips.S"),
|
||||
poly1305_asm_src=> "poly1305-mips.S",
|
||||
},
|
||||
s390x_asm => {
|
||||
template => 1,
|
||||
cpuid_asm_src => "s390xcap.c s390xcpuid.S",
|
||||
bn_asm_src => "asm/s390x.S s390x-mont.S s390x-gf2m.s",
|
||||
aes_asm_src => "aes-s390x.S aes-ctr.fake aes-xts.fake",
|
||||
sha1_asm_src => "sha1-s390x.S sha256-s390x.S sha512-s390x.S",
|
||||
rc4_asm_src => "rc4-s390x.s",
|
||||
modes_asm_src => "ghash-s390x.S",
|
||||
chacha_asm_src => "chacha-s390x.S",
|
||||
poly1305_asm_src=> "poly1305-s390x.S",
|
||||
},
|
||||
armv4_asm => {
|
||||
template => 1,
|
||||
cpuid_asm_src => "armcap.c armv4cpuid.S",
|
||||
bn_asm_src => "bn_asm.c armv4-mont.S armv4-gf2m.S",
|
||||
ec_asm_src => "ecp_nistz256.c ecp_nistz256-armv4.S",
|
||||
aes_asm_src => "aes_cbc.c aes-armv4.S bsaes-armv7.S aesv8-armx.S",
|
||||
sha1_asm_src => "sha1-armv4-large.S sha256-armv4.S sha512-armv4.S",
|
||||
modes_asm_src => "ghash-armv4.S ghashv8-armx.S",
|
||||
chacha_asm_src => "chacha-armv4.S",
|
||||
poly1305_asm_src=> "poly1305-armv4.S",
|
||||
perlasm_scheme => "void"
|
||||
},
|
||||
aarch64_asm => {
|
||||
template => 1,
|
||||
cpuid_asm_src => "armcap.c arm64cpuid.S",
|
||||
ec_asm_src => "ecp_nistz256.c ecp_nistz256-armv8.S",
|
||||
bn_asm_src => "bn_asm.c armv8-mont.S",
|
||||
aes_asm_src => "aes_core.c aes_cbc.c aesv8-armx.S vpaes-armv8.S",
|
||||
sha1_asm_src => "sha1-armv8.S sha256-armv8.S sha512-armv8.S",
|
||||
modes_asm_src => "ghashv8-armx.S",
|
||||
chacha_asm_src => "chacha-armv8.S",
|
||||
poly1305_asm_src=> "poly1305-armv8.S",
|
||||
},
|
||||
parisc11_asm => {
|
||||
template => 1,
|
||||
cpuid_asm_src => "pariscid.s",
|
||||
bn_asm_src => "bn_asm.c parisc-mont.s",
|
||||
aes_asm_src => "aes_core.c aes_cbc.c aes-parisc.s",
|
||||
sha1_asm_src => "sha1-parisc.s sha256-parisc.s sha512-parisc.s",
|
||||
rc4_asm_src => "rc4-parisc.s",
|
||||
modes_asm_src => "ghash-parisc.s",
|
||||
perlasm_scheme => "32"
|
||||
},
|
||||
parisc20_64_asm => {
|
||||
template => 1,
|
||||
inherit_from => [ "parisc11_asm" ],
|
||||
perlasm_scheme => "64",
|
||||
},
|
||||
ppc64_asm => {
|
||||
template => 1,
|
||||
cpuid_asm_src => "ppccpuid.s ppccap.c",
|
||||
bn_asm_src => "bn-ppc.s ppc-mont.s ppc64-mont.s",
|
||||
aes_asm_src => "aes_core.c aes_cbc.c aes-ppc.s vpaes-ppc.s aesp8-ppc.s",
|
||||
sha1_asm_src => "sha1-ppc.s sha256-ppc.s sha512-ppc.s sha256p8-ppc.s sha512p8-ppc.s",
|
||||
modes_asm_src => "ghashp8-ppc.s",
|
||||
chacha_asm_src => "chacha-ppc.s",
|
||||
poly1305_asm_src=> "poly1305-ppc.s poly1305-ppcfp.s",
|
||||
},
|
||||
ppc32_asm => {
|
||||
inherit_from => [ "ppc64_asm" ],
|
||||
template => 1
|
||||
},
|
||||
);
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,15 +0,0 @@
|
||||
# We can't make any commitment to support the DJGPP platform,
|
||||
# and rely entirely on the OpenSSL community to help is fine
|
||||
# tune and test.
|
||||
|
||||
%targets = (
|
||||
"DJGPP" => {
|
||||
inherit_from => [ asm("x86_asm") ],
|
||||
cc => "gcc",
|
||||
cflags => "-I/dev/env/WATT_ROOT/inc -DTERMIOS -DL_ENDIAN -fomit-frame-pointer -O2 -Wall",
|
||||
sys_id => "MSDOS",
|
||||
ex_libs => add("-L/dev/env/WATT_ROOT/lib -lwatt"),
|
||||
bn_ops => "BN_LLONG",
|
||||
perlasm_scheme => "a.out",
|
||||
},
|
||||
);
|
||||
@@ -1,29 +0,0 @@
|
||||
%targets = (
|
||||
"haiku-common" => {
|
||||
template => 1,
|
||||
cc => "cc",
|
||||
cflags => add_before(picker(default => "-DL_ENDIAN -Wall -include \$(SRCDIR)/os-dep/haiku.h",
|
||||
debug => "-g -O0",
|
||||
release => "-O2"),
|
||||
threads("-D_REENTRANT")),
|
||||
sys_id => "HAIKU",
|
||||
ex_libs => "-lnetwork",
|
||||
perlasm_scheme => "elf",
|
||||
thread_scheme => "pthreads",
|
||||
dso_scheme => "dlfcn",
|
||||
shared_target => "gnu-shared",
|
||||
shared_cflag => "-fPIC",
|
||||
shared_ldflag => "-shared",
|
||||
shared_extension => ".so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
|
||||
},
|
||||
"haiku-x86" => {
|
||||
inherit_from => [ "haiku-common", asm("x86_elf_asm") ],
|
||||
cflags => add(picker(release => "-fomit-frame-pointer")),
|
||||
bn_ops => "BN_LLONG",
|
||||
},
|
||||
"haiku-x86_64" => {
|
||||
inherit_from => [ "haiku-common" ],
|
||||
cflags => add("-m64"),
|
||||
bn_ops => "SIXTY_FOUR_BIT_LONG",
|
||||
},
|
||||
);
|
||||
@@ -1,17 +0,0 @@
|
||||
# We can't make commitment to supporting Microsoft assembler,
|
||||
# because it would mean supporting all masm versions. This in
|
||||
# in turn is because masm is not really an interchangeable option,
|
||||
# while users tend to have reasons to stick with specific Visual
|
||||
# Studio versions. It's usually lesser hassle to make it work
|
||||
# with latest assembler, but tweaking for older versions had
|
||||
# proven to be daunting task. This is experimental target, for
|
||||
# production builds stick with [up-to-date version of] nasm.
|
||||
|
||||
%targets = (
|
||||
"VC-WIN64A-masm" => {
|
||||
inherit_from => [ "VC-WIN64A" ],
|
||||
as => "ml64",
|
||||
asflags => "/c /Cp /Cx /Zi",
|
||||
asoutflag => "/Fo",
|
||||
},
|
||||
);
|
||||
@@ -1,136 +0,0 @@
|
||||
Configure Internals
|
||||
===================
|
||||
|
||||
[ note: this file uses markdown for formatting ]
|
||||
|
||||
Intro
|
||||
-----
|
||||
|
||||
This is a collection of notes that are hopefully of interest to those
|
||||
who decide to dive into Configure and what it does. This is a living
|
||||
document and anyone is encouraged to add to it and submit changes.
|
||||
There's no claim for this document to be complete at any time, but it
|
||||
will hopefully reach such a point in time.
|
||||
|
||||
|
||||
----------------------------------------------------------------------
|
||||
|
||||
Parsing build.info files, processing conditions
|
||||
-----------------------------------------------
|
||||
|
||||
Processing conditions in build.info files is done with the help of a
|
||||
condition stack that tell if a build.info should be processed or if it
|
||||
should just be skipped over. The possible states of the stack top are
|
||||
expressed in the following comment from Configure:
|
||||
|
||||
# The top item of this stack has the following values
|
||||
# -2 positive already run and we found ELSE (following ELSIF should fail)
|
||||
# -1 positive already run (skip until ENDIF)
|
||||
# 0 negatives so far (if we're at a condition, check it)
|
||||
# 1 last was positive (don't skip lines until next ELSE, ELSIF or ENDIF)
|
||||
# 2 positive ELSE (following ELSIF should fail)
|
||||
|
||||
Ground rule is that non-condition lines are skipped over if the
|
||||
stack top is > 0. Condition lines (IF, ELSIF, ELSE and ENDIF
|
||||
statements) need to be processed either way to keep track of the skip
|
||||
stack states, so they are a little more intricate.
|
||||
|
||||
Instead of trying to describe in words, here are some example of what
|
||||
the skip stack should look like after each line is processed:
|
||||
|
||||
Example 1:
|
||||
|
||||
| IF[1] | 1 | |
|
||||
| ... whatever ... | | this line is processed |
|
||||
| IF[1] | 1 1 | |
|
||||
| ... whatever ... | | this line is processed |
|
||||
| ELSIF[1] | 1 -1 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| ELSE | 1 -2 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| ENDIF | 1 | |
|
||||
| ... whatever ... | | this line is processed |
|
||||
| ELSIF[1] | -1 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| IF[1] | -1 -1 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| ELSIF[1] | -1 -1 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| ELSE | -1 -2 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| ENDIF | -1 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| ENDIF | | |
|
||||
|
||||
Example 2:
|
||||
|
||||
| IF[0] | 0 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| IF[1] | 0 -1 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| ELSIF[1] | 0 -1 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| ELSE | 0 -2 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| ENDIF | 0 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| ELSIF[1] | 1 | |
|
||||
| ... whatever ... | | this line is processed |
|
||||
| IF[1] | 1 1 | |
|
||||
| ... whatever ... | | this line is processed |
|
||||
| ELSIF[1] | 1 -1 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| ELSE | 1 -2 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| ENDIF | 1 | |
|
||||
| ... whatever ... | | this line is processed |
|
||||
| ENDIF | | |
|
||||
|
||||
Example 3:
|
||||
|
||||
| IF[0] | 0 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| IF[0] | 0 -1 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| ELSIF[1] | 0 -1 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| ELSE | 0 -2 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| ENDIF | 0 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| ELSIF[1] | 1 | |
|
||||
| ... whatever ... | | this line is processed |
|
||||
| IF[0] | 1 0 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| ELSIF[1] | 1 1 | |
|
||||
| ... whatever ... | | this line is processed |
|
||||
| ELSE | 1 -2 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| ENDIF | 1 | |
|
||||
| ... whatever ... | | this line is processed |
|
||||
| ENDIF | | |
|
||||
|
||||
Example 4:
|
||||
|
||||
| IF[0] | 0 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| IF[0] | 0 -1 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| ELSIF[0] | 0 -1 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| ELSE | 0 -2 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| ENDIF | 0 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| ELSIF[1] | 1 | |
|
||||
| ... whatever ... | | this line is processed |
|
||||
| IF[0] | 1 0 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| ELSIF[0] | 1 0 | |
|
||||
| ... whatever ... | | this line is skipped over |
|
||||
| ELSE | 1 2 | |
|
||||
| ... whatever ... | | this line is processed |
|
||||
| ENDIF | 1 | |
|
||||
| ... whatever ... | | this line is processed |
|
||||
| ENDIF | | |
|
||||
|
||||
@@ -1,721 +0,0 @@
|
||||
Intro
|
||||
=====
|
||||
|
||||
This directory contains a few sets of files that are used for
|
||||
configuration in diverse ways:
|
||||
|
||||
*.conf Target platform configurations, please read
|
||||
'Configurations of OpenSSL target platforms' for more
|
||||
information.
|
||||
*.tmpl Build file templates, please read 'Build-file
|
||||
programming with the "unified" build system' as well
|
||||
as 'Build info files' for more information.
|
||||
*.pm Helper scripts / modules for the main `Configure`
|
||||
script. See 'Configure helper scripts for more
|
||||
information.
|
||||
|
||||
|
||||
Configurations of OpenSSL target platforms
|
||||
==========================================
|
||||
|
||||
Configuration targets are a collection of facts that we know about
|
||||
different platforms and their capabilities. We organise them in a
|
||||
hash table, where each entry represent a specific target.
|
||||
|
||||
Note that configuration target names must be unique across all config
|
||||
files. The Configure script does check that a config file doesn't
|
||||
have config targets that shadow config targets from other files.
|
||||
|
||||
In each table entry, the following keys are significant:
|
||||
|
||||
inherit_from => Other targets to inherit values from.
|
||||
Explained further below. [1]
|
||||
template => Set to 1 if this isn't really a platform
|
||||
target. Instead, this target is a template
|
||||
upon which other targets can be built.
|
||||
Explained further below. [1]
|
||||
|
||||
sys_id => System identity for systems where that
|
||||
is difficult to determine automatically.
|
||||
|
||||
cc => The compiler command, usually one of "cc",
|
||||
"gcc" or "clang". This command is normally
|
||||
also used to link object files and
|
||||
libraries into the final program.
|
||||
cflags => Flags that are used at all times when
|
||||
compiling.
|
||||
defines => As an alternative, macro definitions may be
|
||||
present here instead of in `cflags'. If
|
||||
given here, they MUST be as an array of the
|
||||
string such as "MACRO=value", or just
|
||||
"MACRO" for definitions without value.
|
||||
shared_cflag => Extra compilation flags used when
|
||||
compiling for shared libraries, typically
|
||||
something like "-fPIC".
|
||||
|
||||
(linking is a complex thing, see [3] below)
|
||||
ld => Linker command, usually not defined
|
||||
(meaning the compiler command is used
|
||||
instead).
|
||||
(NOTE: this is here for future use, it's
|
||||
not implemented yet)
|
||||
lflags => Flags that are used when linking apps.
|
||||
shared_ldflag => Flags that are used when linking shared
|
||||
or dynamic libraries.
|
||||
plib_lflags => Extra linking flags to appear just before
|
||||
the libraries on the command line.
|
||||
ex_libs => Extra libraries that are needed when
|
||||
linking.
|
||||
|
||||
ar => The library archive command, the default is
|
||||
"ar".
|
||||
(NOTE: this is here for future use, it's
|
||||
not implemented yet)
|
||||
arflags => Flags to be used with the library archive
|
||||
command.
|
||||
|
||||
ranlib => The library archive indexing command, the
|
||||
default is 'ranlib' it it exists.
|
||||
|
||||
unistd => An alternative header to the typical
|
||||
'<unistd.h>'. This is very rarely needed.
|
||||
|
||||
shared_extension => File name extension used for shared
|
||||
libraries.
|
||||
obj_extension => File name extension used for object files.
|
||||
On unix, this defaults to ".o" (NOTE: this
|
||||
is here for future use, it's not
|
||||
implemented yet)
|
||||
exe_extension => File name extension used for executable
|
||||
files. On unix, this defaults to "" (NOTE:
|
||||
this is here for future use, it's not
|
||||
implemented yet)
|
||||
shlib_variant => A "variant" identifier inserted between the base
|
||||
shared library name and the extension. On "unixy"
|
||||
platforms (BSD, Linux, Solaris, MacOS/X, ...) this
|
||||
supports installation of custom OpenSSL libraries
|
||||
that don't conflict with other builds of OpenSSL
|
||||
installed on the system. The variant identifier
|
||||
becomes part of the SONAME of the library and also
|
||||
any symbol versions (symbol versions are not used or
|
||||
needed with MacOS/X). For example, on a system
|
||||
where a default build would normally create the SSL
|
||||
shared library as 'libssl.so -> libssl.so.1.1' with
|
||||
the value of the symlink as the SONAME, a target
|
||||
definition that sets 'shlib_variant => "-abc"' will
|
||||
create 'libssl.so -> libssl-abc.so.1.1', again with
|
||||
an SONAME equal to the value of the symlink. The
|
||||
symbol versions associated with the variant library
|
||||
would then be 'OPENSSL_ABC_<version>' rather than
|
||||
the default 'OPENSSL_<version>'. The string inserted
|
||||
into symbol versions is obtained by mapping all
|
||||
letters in the "variant" identifier to upper case
|
||||
and all non-alphanumeric characters to '_'.
|
||||
|
||||
thread_scheme => The type of threads is used on the
|
||||
configured platform. Currently known
|
||||
values are "(unknown)", "pthreads",
|
||||
"uithreads" (a.k.a solaris threads) and
|
||||
"winthreads". Except for "(unknown)", the
|
||||
actual value is currently ignored but may
|
||||
be used in the future. See further notes
|
||||
below [2].
|
||||
dso_scheme => The type of dynamic shared objects to build
|
||||
for. This mostly comes into play with
|
||||
engines, but can be used for other purposes
|
||||
as well. Valid values are "DLFCN"
|
||||
(dlopen() et al), "DLFCN_NO_H" (for systems
|
||||
that use dlopen() et al but do not have
|
||||
fcntl.h), "DL" (shl_load() et al), "WIN32"
|
||||
and "VMS".
|
||||
perlasm_scheme => The perlasm method used to created the
|
||||
assembler files used when compiling with
|
||||
assembler implementations.
|
||||
shared_target => The shared library building method used.
|
||||
This is a target found in Makefile.shared.
|
||||
build_scheme => The scheme used to build up a Makefile.
|
||||
In its simplest form, the value is a string
|
||||
with the name of the build scheme.
|
||||
The value may also take the form of a list
|
||||
of strings, if the build_scheme is to have
|
||||
some options. In this case, the first
|
||||
string in the list is the name of the build
|
||||
scheme.
|
||||
Currently recognised build scheme is "unified".
|
||||
For the "unified" build scheme, this item
|
||||
*must* be an array with the first being the
|
||||
word "unified" and the second being a word
|
||||
to identify the platform family.
|
||||
|
||||
multilib => On systems that support having multiple
|
||||
implementations of a library (typically a
|
||||
32-bit and a 64-bit variant), this is used
|
||||
to have the different variants in different
|
||||
directories.
|
||||
|
||||
bn_ops => Building options (was just bignum options in
|
||||
the earlier history of this option, hence the
|
||||
name). This is a string of words that describe
|
||||
algorithms' implementation parameters that
|
||||
are optimal for the designated target platform,
|
||||
such as the type of integers used to build up
|
||||
the bignum, different ways to implement certain
|
||||
ciphers and so on. To fully comprehend the
|
||||
meaning, the best is to read the affected
|
||||
source.
|
||||
The valid words are:
|
||||
|
||||
THIRTY_TWO_BIT bignum limbs are 32 bits,
|
||||
this is default if no
|
||||
option is specified, it
|
||||
works on any supported
|
||||
system [unless "wider"
|
||||
limb size is implied in
|
||||
assembly code];
|
||||
BN_LLONG bignum limbs are 32 bits,
|
||||
but 64-bit 'unsigned long
|
||||
long' is used internally
|
||||
in calculations;
|
||||
SIXTY_FOUR_BIT_LONG bignum limbs are 64 bits
|
||||
and sizeof(long) is 8;
|
||||
SIXTY_FOUR_BIT bignums limbs are 64 bits,
|
||||
but execution environment
|
||||
is ILP32;
|
||||
RC4_CHAR RC4 key schedule is made
|
||||
up of 'unsigned char's;
|
||||
RC4_INT RC4 key schedule is made
|
||||
up of 'unsigned int's;
|
||||
EXPORT_VAR_AS_FN for shared libraries,
|
||||
export vars as
|
||||
accessor functions.
|
||||
|
||||
apps_extra_src => Extra source to build apps/openssl, as
|
||||
needed by the target.
|
||||
cpuid_asm_src => assembler implementation of cpuid code as
|
||||
well as OPENSSL_cleanse().
|
||||
Default to mem_clr.c
|
||||
bn_asm_src => Assembler implementation of core bignum
|
||||
functions.
|
||||
Defaults to bn_asm.c
|
||||
ec_asm_src => Assembler implementation of core EC
|
||||
functions.
|
||||
des_asm_src => Assembler implementation of core DES
|
||||
encryption functions.
|
||||
Defaults to 'des_enc.c fcrypt_b.c'
|
||||
aes_asm_src => Assembler implementation of core AES
|
||||
functions.
|
||||
Defaults to 'aes_core.c aes_cbc.c'
|
||||
bf_asm_src => Assembler implementation of core BlowFish
|
||||
functions.
|
||||
Defaults to 'bf_enc.c'
|
||||
md5_asm_src => Assembler implementation of core MD5
|
||||
functions.
|
||||
sha1_asm_src => Assembler implementation of core SHA1,
|
||||
functions, and also possibly SHA256 and
|
||||
SHA512 ones.
|
||||
cast_asm_src => Assembler implementation of core CAST
|
||||
functions.
|
||||
Defaults to 'c_enc.c'
|
||||
rc4_asm_src => Assembler implementation of core RC4
|
||||
functions.
|
||||
Defaults to 'rc4_enc.c rc4_skey.c'
|
||||
rmd160_asm_src => Assembler implementation of core RMD160
|
||||
functions.
|
||||
rc5_asm_src => Assembler implementation of core RC5
|
||||
functions.
|
||||
Defaults to 'rc5_enc.c'
|
||||
wp_asm_src => Assembler implementation of core WHIRLPOOL
|
||||
functions.
|
||||
cmll_asm_src => Assembler implementation of core CAMELLIA
|
||||
functions.
|
||||
Defaults to 'camellia.c cmll_misc.c cmll_cbc.c'
|
||||
modes_asm_src => Assembler implementation of cipher modes,
|
||||
currently the functions gcm_gmult_4bit and
|
||||
gcm_ghash_4bit.
|
||||
padlock_asm_src => Assembler implementation of core parts of
|
||||
the padlock engine. This is mandatory on
|
||||
any platform where the padlock engine might
|
||||
actually be built.
|
||||
|
||||
|
||||
[1] as part of the target configuration, one can have a key called
|
||||
'inherit_from' that indicate what other configurations to inherit
|
||||
data from. These are resolved recursively.
|
||||
|
||||
Inheritance works as a set of default values that can be overridden
|
||||
by corresponding key values in the inheriting configuration.
|
||||
|
||||
Note 1: any configuration table can be used as a template.
|
||||
Note 2: pure templates have the attribute 'template => 1' and
|
||||
cannot be used as build targets.
|
||||
|
||||
If several configurations are given in the 'inherit_from' array,
|
||||
the values of same attribute are concatenated with space
|
||||
separation. With this, it's possible to have several smaller
|
||||
templates for different configuration aspects that can be combined
|
||||
into a complete configuration.
|
||||
|
||||
instead of a scalar value or an array, a value can be a code block
|
||||
of the form 'sub { /* your code here */ }'. This code block will
|
||||
be called with the list of inherited values for that key as
|
||||
arguments. In fact, the concatenation of strings is really done
|
||||
by using 'sub { join(" ",@_) }' on the list of inherited values.
|
||||
|
||||
An example:
|
||||
|
||||
"foo" => {
|
||||
template => 1,
|
||||
haha => "ha ha",
|
||||
hoho => "ho",
|
||||
ignored => "This should not appear in the end result",
|
||||
},
|
||||
"bar" => {
|
||||
template => 1,
|
||||
haha => "ah",
|
||||
hoho => "haho",
|
||||
hehe => "hehe"
|
||||
},
|
||||
"laughter" => {
|
||||
inherit_from => [ "foo", "bar" ],
|
||||
hehe => sub { join(" ",(@_,"!!!")) },
|
||||
ignored => "",
|
||||
}
|
||||
|
||||
The entry for "laughter" will become as follows after processing:
|
||||
|
||||
"laughter" => {
|
||||
haha => "ha ha ah",
|
||||
hoho => "ho haho",
|
||||
hehe => "hehe !!!",
|
||||
ignored => ""
|
||||
}
|
||||
|
||||
[2] OpenSSL is built with threading capabilities unless the user
|
||||
specifies 'no-threads'. The value of the key 'thread_scheme' may
|
||||
be "(unknown)", in which case the user MUST give some compilation
|
||||
flags to Configure.
|
||||
|
||||
[3] OpenSSL has three types of things to link from object files or
|
||||
static libraries:
|
||||
|
||||
- shared libraries; that would be libcrypto and libssl.
|
||||
- shared objects (sometimes called dynamic libraries); that would
|
||||
be the engines.
|
||||
- applications; those are apps/openssl and all the test apps.
|
||||
|
||||
Very roughly speaking, linking is done like this (words in braces
|
||||
represent the configuration settings documented at the beginning
|
||||
of this file):
|
||||
|
||||
shared libraries:
|
||||
{ld} $(CFLAGS) {shared_ldflag} -shared -o libfoo.so \
|
||||
-Wl,--whole-archive libfoo.a -Wl,--no-whole-archive \
|
||||
{plib_lflags} -lcrypto {ex_libs}
|
||||
|
||||
shared objects:
|
||||
{ld} $(CFLAGS) {shared_ldflag} -shared -o libeng.so \
|
||||
blah1.o blah2.o {plib_lflags} -lcrypto {ex_libs}
|
||||
|
||||
applications:
|
||||
{ld} $(CFLAGS) {lflags} -o app \
|
||||
app1.o utils.o {plib_lflags} -lssl -lcrypto {ex_libs}
|
||||
|
||||
|
||||
Historically, the target configurations came in form of a string with
|
||||
values separated by colons. This use is deprecated. The string form
|
||||
looked like this:
|
||||
|
||||
"target" => "{cc}:{cflags}:{unistd}:{thread_cflag}:{sys_id}:{lflags}:{bn_ops}:{cpuid_obj}:{bn_obj}:{ec_obj}:{des_obj}:{aes_obj}:{bf_obj}:{md5_obj}:{sha1_obj}:{cast_obj}:{rc4_obj}:{rmd160_obj}:{rc5_obj}:{wp_obj}:{cmll_obj}:{modes_obj}:{padlock_obj}:{perlasm_scheme}:{dso_scheme}:{shared_target}:{shared_cflag}:{shared_ldflag}:{shared_extension}:{ranlib}:{arflags}:{multilib}"
|
||||
|
||||
|
||||
Build info files
|
||||
================
|
||||
|
||||
The build.info files that are spread over the source tree contain the
|
||||
minimum information needed to build and distribute OpenSSL. It uses a
|
||||
simple and yet fairly powerful language to determine what needs to be
|
||||
built, from what sources, and other relationships between files.
|
||||
|
||||
For every build.info file, all file references are relative to the
|
||||
directory of the build.info file for source files, and the
|
||||
corresponding build directory for built files if the build tree
|
||||
differs from the source tree.
|
||||
|
||||
When processed, every line is processed with the perl module
|
||||
Text::Template, using the delimiters "{-" and "-}". The hashes
|
||||
%config and %target are passed to the perl fragments, along with
|
||||
$sourcedir and $builddir, which are the locations of the source
|
||||
directory for the current build.info file and the corresponding build
|
||||
directory, all relative to the top of the build tree.
|
||||
|
||||
To begin with, things to be built are declared by setting specific
|
||||
variables:
|
||||
|
||||
PROGRAMS=foo bar
|
||||
LIBS=libsomething
|
||||
ENGINES=libeng
|
||||
SCRIPTS=myhack
|
||||
EXTRA=file1 file2
|
||||
|
||||
Note that the files mentioned for PROGRAMS, LIBS and ENGINES *must* be
|
||||
without extensions. The build file templates will figure them out.
|
||||
|
||||
For each thing to be built, it is then possible to say what sources
|
||||
they are built from:
|
||||
|
||||
PROGRAMS=foo bar
|
||||
SOURCE[foo]=foo.c common.c
|
||||
SOURCE[bar]=bar.c extra.c common.c
|
||||
|
||||
It's also possible to tell some other dependencies:
|
||||
|
||||
DEPEND[foo]=libsomething
|
||||
DEPEND[libbar]=libsomethingelse
|
||||
|
||||
(it could be argued that 'libsomething' and 'libsomethingelse' are
|
||||
source as well. However, the files given through SOURCE are expected
|
||||
to be located in the source tree while files given through DEPEND are
|
||||
expected to be located in the build tree)
|
||||
|
||||
For some libraries, we maintain files with public symbols and their
|
||||
slot in a transfer vector (important on some platforms). It can be
|
||||
declared like this:
|
||||
|
||||
ORDINALS[libcrypto]=crypto
|
||||
|
||||
The value is not the name of the file in question, but rather the
|
||||
argument to util/mkdef.pl that indicates which file to use.
|
||||
|
||||
One some platforms, shared libraries come with a name that's different
|
||||
from their static counterpart. That's declared as follows:
|
||||
|
||||
SHARED_NAME[libfoo]=cygfoo-{- $config{shlibver} -}
|
||||
|
||||
The example is from Cygwin, which has a required naming convention.
|
||||
|
||||
Sometimes, it makes sense to rename an output file, for example a
|
||||
library:
|
||||
|
||||
RENAME[libfoo]=libbar
|
||||
|
||||
That lines has "libfoo" get renamed to "libbar". While it makes no
|
||||
sense at all to just have a rename like that (why not just use
|
||||
"libbar" everywhere?), it does make sense when it can be used
|
||||
conditionally. See a little further below for an example.
|
||||
|
||||
In some cases, it's desirable to include some source files in the
|
||||
shared form of a library only:
|
||||
|
||||
SHARED_SOURCE[libfoo]=dllmain.c
|
||||
|
||||
For any file to be built, it's also possible to tell what extra
|
||||
include paths the build of their source files should use:
|
||||
|
||||
INCLUDE[foo]=include
|
||||
|
||||
In some cases, one might want to generate some source files from
|
||||
others, that's done as follows:
|
||||
|
||||
GENERATE[foo.s]=asm/something.pl $(CFLAGS)
|
||||
GENERATE[bar.s]=asm/bar.S
|
||||
|
||||
The value of each GENERATE line is a command line or part of it.
|
||||
Configure places no rules on the command line, except the the first
|
||||
item muct be the generator file. It is, however, entirely up to the
|
||||
build file template to define exactly how those command lines should
|
||||
be handled, how the output is captured and so on.
|
||||
|
||||
Sometimes, the generator file itself depends on other files, for
|
||||
example if it is a perl script that depends on other perl modules.
|
||||
This can be expressed using DEPEND like this:
|
||||
|
||||
DEPEND[asm/something.pl]=../perlasm/Foo.pm
|
||||
|
||||
There may also be cases where the exact file isn't easily specified,
|
||||
but an inclusion directory still needs to be specified. INCLUDE can
|
||||
be used in that case:
|
||||
|
||||
INCLUDE[asm/something.pl]=../perlasm
|
||||
|
||||
NOTE: GENERATE lines are limited to one command only per GENERATE.
|
||||
|
||||
As a last resort, it's possible to have raw build file lines, between
|
||||
BEGINRAW and ENDRAW lines as follows:
|
||||
|
||||
BEGINRAW[Makefile(unix)]
|
||||
haha.h: {- $builddir -}/Makefile
|
||||
echo "/* haha */" > haha.h
|
||||
ENDRAW[Makefile(unix)]
|
||||
|
||||
The word within square brackets is the build_file configuration item
|
||||
or the build_file configuration item followed by the second word in the
|
||||
build_scheme configuration item for the configured target within
|
||||
parenthesis as shown above. For example, with the following relevant
|
||||
configuration items:
|
||||
|
||||
build_file => "build.ninja"
|
||||
build_scheme => [ "unified", "unix" ]
|
||||
|
||||
... these lines will be considered:
|
||||
|
||||
BEGINRAW[build.ninja]
|
||||
build haha.h: echo "/* haha */" > haha.h
|
||||
ENDRAW[build.ninja]
|
||||
|
||||
BEGINRAW[build.ninja(unix)]
|
||||
build hoho.h: echo "/* hoho */" > hoho.h
|
||||
ENDRAW[build.ninja(unix)]
|
||||
|
||||
Should it be needed because the recipes within a RAW section might
|
||||
clash with those generated by Configure, it's possible to tell it
|
||||
not to generate them with the use of OVERRIDES, for example:
|
||||
|
||||
SOURCE[libfoo]=foo.c bar.c
|
||||
|
||||
OVERRIDES=bar.o
|
||||
BEGINRAW[Makefile(unix)]
|
||||
bar.o: bar.c
|
||||
$(CC) $(CFLAGS) -DSPECIAL -c -o $@ $<
|
||||
ENDRAW[Makefile(unix)]
|
||||
|
||||
See the documentation further up for more information on configuration
|
||||
items.
|
||||
|
||||
Finally, you can have some simple conditional use of the build.info
|
||||
information, looking like this:
|
||||
|
||||
IF[1]
|
||||
something
|
||||
ELSIF[2]
|
||||
something other
|
||||
ELSE
|
||||
something else
|
||||
ENDIF
|
||||
|
||||
The expression in square brackets is interpreted as a string in perl,
|
||||
and will be seen as true if perl thinks it is, otherwise false. For
|
||||
example, the above would have "something" used, since 1 is true.
|
||||
|
||||
Together with the use of Text::Template, this can be used as
|
||||
conditions based on something in the passed variables, for example:
|
||||
|
||||
IF[{- $disabled{shared} -}]
|
||||
LIBS=libcrypto
|
||||
SOURCE[libcrypto]=...
|
||||
ELSE
|
||||
LIBS=libfoo
|
||||
SOURCE[libfoo]=...
|
||||
ENDIF
|
||||
|
||||
or:
|
||||
|
||||
# VMS has a cultural standard where all libraries are prefixed.
|
||||
# For OpenSSL, the choice is 'ossl_'
|
||||
IF[{- $config{target} =~ /^vms/ -}]
|
||||
RENAME[libcrypto]=ossl_libcrypto
|
||||
RENAME[libssl]=ossl_libssl
|
||||
ENDIF
|
||||
|
||||
|
||||
Build-file programming with the "unified" build system
|
||||
======================================================
|
||||
|
||||
"Build files" are called "Makefile" on Unix-like operating systems,
|
||||
"descrip.mms" for MMS on VMS, "makefile" for nmake on Windows, etc.
|
||||
|
||||
To use the "unified" build system, the target configuration needs to
|
||||
set the three items 'build_scheme', 'build_file' and 'build_command'.
|
||||
In the rest of this section, we will assume that 'build_scheme' is set
|
||||
to "unified" (see the configurations documentation above for the
|
||||
details).
|
||||
|
||||
For any name given by 'build_file', the "unified" system expects a
|
||||
template file in Configurations/ named like the build file, with
|
||||
".tmpl" appended, or in case of possible ambiguity, a combination of
|
||||
the second 'build_scheme' list item and the 'build_file' name. For
|
||||
example, if 'build_file' is set to "Makefile", the template could be
|
||||
Configurations/Makefile.tmpl or Configurations/unix-Makefile.tmpl.
|
||||
In case both Configurations/unix-Makefile.tmpl and
|
||||
Configurations/Makefile.tmpl are present, the former takes
|
||||
precedence.
|
||||
|
||||
The build-file template is processed with the perl module
|
||||
Text::Template, using "{-" and "-}" as delimiters that enclose the
|
||||
perl code fragments that generate configuration-dependent content.
|
||||
Those perl fragments have access to all the hash variables from
|
||||
configdata.pem.
|
||||
|
||||
The build-file template is expected to define at least the following
|
||||
perl functions in a perl code fragment enclosed with "{-" and "-}".
|
||||
They are all expected to return a string with the lines they produce.
|
||||
|
||||
generatesrc - function that produces build file lines to generate
|
||||
a source file from some input.
|
||||
|
||||
It's called like this:
|
||||
|
||||
generatesrc(src => "PATH/TO/tobegenerated",
|
||||
generator => [ "generatingfile", ... ]
|
||||
generator_incs => [ "INCL/PATH", ... ]
|
||||
generator_deps => [ "dep1", ... ]
|
||||
generator => [ "generatingfile", ... ]
|
||||
incs => [ "INCL/PATH", ... ],
|
||||
deps => [ "dep1", ... ],
|
||||
intent => one of "libs", "dso", "bin" );
|
||||
|
||||
'src' has the name of the file to be generated.
|
||||
'generator' is the command or part of command to
|
||||
generate the file, of which the first item is
|
||||
expected to be the file to generate from.
|
||||
generatesrc() is expected to analyse and figure out
|
||||
exactly how to apply that file and how to capture
|
||||
the result. 'generator_incs' and 'generator_deps'
|
||||
are include directories and files that the generator
|
||||
file itself depends on. 'incs' and 'deps' are
|
||||
include directories and files that are used if $(CC)
|
||||
is used as an intermediary step when generating the
|
||||
end product (the file indicated by 'src'). 'intent'
|
||||
indicates what the generated file is going to be
|
||||
used for.
|
||||
|
||||
src2obj - function that produces build file lines to build an
|
||||
object file from source files and associated data.
|
||||
|
||||
It's called like this:
|
||||
|
||||
src2obj(obj => "PATH/TO/objectfile",
|
||||
srcs => [ "PATH/TO/sourcefile", ... ],
|
||||
deps => [ "dep1", ... ],
|
||||
incs => [ "INCL/PATH", ... ]
|
||||
intent => one of "lib", "dso", "bin" );
|
||||
|
||||
'obj' has the intended object file *without*
|
||||
extension, src2obj() is expected to add that.
|
||||
'srcs' has the list of source files to build the
|
||||
object file, with the first item being the source
|
||||
file that directly corresponds to the object file.
|
||||
'deps' is a list of explicit dependencies. 'incs'
|
||||
is a list of include file directories. Finally,
|
||||
'intent' indicates what this object file is going
|
||||
to be used for.
|
||||
|
||||
obj2lib - function that produces build file lines to build a
|
||||
static library file ("libfoo.a" in Unix terms) from
|
||||
object files.
|
||||
|
||||
called like this:
|
||||
|
||||
obj2lib(lib => "PATH/TO/libfile",
|
||||
objs => [ "PATH/TO/objectfile", ... ]);
|
||||
|
||||
'lib' has the intended library file name *without*
|
||||
extension, obj2lib is expected to add that. 'objs'
|
||||
has the list of object files (also *without*
|
||||
extension) to build this library.
|
||||
|
||||
libobj2shlib - function that produces build file lines to build a
|
||||
shareable object library file ("libfoo.so" in Unix
|
||||
terms) from the corresponding static library file
|
||||
or object files.
|
||||
|
||||
called like this:
|
||||
|
||||
libobj2shlib(shlib => "PATH/TO/shlibfile",
|
||||
lib => "PATH/TO/libfile",
|
||||
objs => [ "PATH/TO/objectfile", ... ],
|
||||
deps => [ "PATH/TO/otherlibfile", ... ],
|
||||
ordinals => [ "word", "/PATH/TO/ordfile" ]);
|
||||
|
||||
'lib' has the intended library file name *without*
|
||||
extension, libobj2shlib is expected to add that.
|
||||
'shlib' has the corresponding shared library name
|
||||
*without* extension. 'deps' has the list of other
|
||||
libraries (also *without* extension) this library
|
||||
needs to be linked with. 'objs' has the list of
|
||||
object files (also *without* extension) to build
|
||||
this library. 'ordinals' MAY be present, and when
|
||||
it is, its value is an array where the word is
|
||||
"crypto" or "ssl" and the file is one of the ordinal
|
||||
files util/libeay.num or util/ssleay.num in the
|
||||
source directory.
|
||||
|
||||
This function has a choice; it can use the
|
||||
corresponding static library as input to make the
|
||||
shared library, or the list of object files.
|
||||
|
||||
obj2dso - function that produces build file lines to build a
|
||||
dynamic shared object file from object files.
|
||||
|
||||
called like this:
|
||||
|
||||
obj2dso(lib => "PATH/TO/libfile",
|
||||
objs => [ "PATH/TO/objectfile", ... ],
|
||||
deps => [ "PATH/TO/otherlibfile",
|
||||
... ]);
|
||||
|
||||
This is almost the same as libobj2shlib, but the
|
||||
intent is to build a shareable library that can be
|
||||
loaded in runtime (a "plugin"...). The differences
|
||||
are subtle, one of the most visible ones is that the
|
||||
resulting shareable library is produced from object
|
||||
files only.
|
||||
|
||||
obj2bin - function that produces build file lines to build an
|
||||
executable file from object files.
|
||||
|
||||
called like this:
|
||||
|
||||
obj2bin(bin => "PATH/TO/binfile",
|
||||
objs => [ "PATH/TO/objectfile", ... ],
|
||||
deps => [ "PATH/TO/libfile", ... ]);
|
||||
|
||||
'bin' has the intended executable file name
|
||||
*without* extension, obj2bin is expected to add
|
||||
that. 'objs' has the list of object files (also
|
||||
*without* extension) to build this library. 'deps'
|
||||
has the list of library files (also *without*
|
||||
extension) that the programs needs to be linked
|
||||
with.
|
||||
|
||||
in2script - function that produces build file lines to build a
|
||||
script file from some input.
|
||||
|
||||
called like this:
|
||||
|
||||
in2script(script => "PATH/TO/scriptfile",
|
||||
sources => [ "PATH/TO/infile", ... ]);
|
||||
|
||||
'script' has the intended script file name.
|
||||
'sources' has the list of source files to build the
|
||||
resulting script from.
|
||||
|
||||
In all cases, file file paths are relative to the build tree top, and
|
||||
the build file actions run with the build tree top as current working
|
||||
directory.
|
||||
|
||||
Make sure to end the section with these functions with a string that
|
||||
you thing is appropriate for the resulting build file. If nothing
|
||||
else, end it like this:
|
||||
|
||||
""; # Make sure no lingering values end up in the Makefile
|
||||
-}
|
||||
|
||||
|
||||
Configure helper scripts
|
||||
========================
|
||||
|
||||
Configure uses helper scripts in this directory:
|
||||
|
||||
Checker scripts
|
||||
---------------
|
||||
|
||||
These scripts are per platform family, to check the integrity of the
|
||||
tools used for configuration and building. The checker script used is
|
||||
either {build_platform}-{build_file}-checker.pm or
|
||||
{build_platform}-checker.pm, where {build_platform} is the second
|
||||
'build_scheme' list element from the configuration target data, and
|
||||
{build_file} is 'build_file' from the same target data.
|
||||
|
||||
If the check succeeds, the script is expected to end with a non-zero
|
||||
expression. If the check fails, the script can end with a zero, or
|
||||
with a `die`.
|
||||
@@ -1,641 +0,0 @@
|
||||
Design document for the unified scheme data
|
||||
===========================================
|
||||
|
||||
How are things connected?
|
||||
-------------------------
|
||||
|
||||
The unified scheme takes all its data from the build.info files seen
|
||||
throughout the source tree. These files hold the minimum information
|
||||
needed to build end product files from diverse sources. See the
|
||||
section on build.info files below.
|
||||
|
||||
From the information in build.info files, Configure builds up an
|
||||
information database as a hash table called %unified_info, which is
|
||||
stored in configdata.pm, found at the top of the build tree (which may
|
||||
or may not be the same as the source tree).
|
||||
|
||||
Configurations/common.tmpl uses the data from %unified_info to
|
||||
generate the rules for building end product files as well as
|
||||
intermediary files with the help of a few functions found in the
|
||||
build-file templates. See the section on build-file templates further
|
||||
down for more information.
|
||||
|
||||
build.info files
|
||||
----------------
|
||||
|
||||
As mentioned earlier, build.info files are meant to hold the minimum
|
||||
information needed to build output files, and therefore only (with a
|
||||
few possible exceptions [1]) have information about end products (such
|
||||
as scripts, library files and programs) and source files (such as C
|
||||
files, C header files, assembler files, etc). Intermediate files such
|
||||
as object files are rarely directly referred to in build.info files (and
|
||||
when they are, it's always with the file name extension .o), they are
|
||||
inferred by Configure. By the same rule of minimalism, end product
|
||||
file name extensions (such as .so, .a, .exe, etc) are never mentioned
|
||||
in build.info. Their file name extensions will be inferred by the
|
||||
build-file templates, adapted for the platform they are meant for (see
|
||||
sections on %unified_info and build-file templates further down).
|
||||
|
||||
The variables PROGRAMS, LIBS, ENGINES and SCRIPTS are used to declare
|
||||
end products. There are variants for them with '_NO_INST' as suffix
|
||||
(PROGRAM_NO_INST etc) to specify end products that shouldn't get
|
||||
installed.
|
||||
|
||||
The variables SOURCE, DEPEND, INCLUDE and ORDINALS are indexed by a
|
||||
produced file, and their values are the source used to produce that
|
||||
particular produced file, extra dependencies, include directories
|
||||
needed, and ordinal files (explained further below.
|
||||
|
||||
All their values in all the build.info throughout the source tree are
|
||||
collected together and form a set of programs, libraries, engines and
|
||||
scripts to be produced, source files, dependencies, etc etc etc.
|
||||
|
||||
Let's have a pretend example, a very limited contraption of OpenSSL,
|
||||
composed of the program 'apps/openssl', the libraries 'libssl' and
|
||||
'libcrypto', an engine 'engines/ossltest' and their sources and
|
||||
dependencies.
|
||||
|
||||
# build.info
|
||||
LIBS=libcrypto libssl
|
||||
ORDINALS[libcrypto]=crypto
|
||||
ORDINALS[libssl]=ssl
|
||||
INCLUDE[libcrypto]=include
|
||||
INCLUDE[libssl]=include
|
||||
DEPEND[libssl]=libcrypto
|
||||
|
||||
This is the top directory build.info file, and it tells us that two
|
||||
libraries are to be built, there are some ordinals to be used to
|
||||
declare what symbols in those libraries are seen as public, the
|
||||
include directory 'include/' shall be used throughout when building
|
||||
anything that will end up in each library, and that the library
|
||||
'libssl' depend on the library 'libcrypto' to function properly.
|
||||
|
||||
# apps/build.info
|
||||
PROGRAMS=openssl
|
||||
SOURCE[openssl]=openssl.c
|
||||
INCLUDE[openssl]=.. ../include
|
||||
DEPEND[openssl]=../libssl
|
||||
|
||||
This is the build.info file in 'apps/', one may notice that all file
|
||||
paths mentioned are relative to the directory the build.info file is
|
||||
located in. This one tells us that there's a program to be built
|
||||
called 'apps/openssl' (the file name extension will depend on the
|
||||
platform and is therefore not mentioned in the build.info file). It's
|
||||
built from one source file, 'apps/openssl.c', and building it requires
|
||||
the use of '.' and 'include' include directories (both are declared
|
||||
from the point of view of the 'apps/' directory), and that the program
|
||||
depends on the library 'libssl' to function properly.
|
||||
|
||||
# crypto/build.info
|
||||
LIBS=../libcrypto
|
||||
SOURCE[../libcrypto]=aes.c evp.c cversion.c
|
||||
DEPEND[cversion.o]=buildinf.h
|
||||
|
||||
GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(CC) $(CFLAGS)" "$(PLATFORM)"
|
||||
DEPEND[buildinf.h]=../Makefile
|
||||
DEPEND[../util/mkbuildinf.pl]=../util/Foo.pm
|
||||
|
||||
This is the build.info file in 'crypto', and it tells us a little more
|
||||
about what's needed to produce 'libcrypto'. LIBS is used again to
|
||||
declare that 'libcrypto' is to be produced. This declaration is
|
||||
really unnecessary as it's already mentioned in the top build.info
|
||||
file, but can make the info file easier to understand. This is to
|
||||
show that duplicate information isn't an issue.
|
||||
|
||||
This build.info file informs us that 'libcrypto' is built from a few
|
||||
source files, 'crypto/aes.c', 'crypto/evp.c' and 'crypto/cversion.c'.
|
||||
It also shows us that building the object file inferred from
|
||||
'crypto/cversion.c' depends on 'crypto/buildinf.h'. Finally, it
|
||||
also shows the possibility to declare how some files are generated
|
||||
using some script, in this case a perl script, and how such scripts
|
||||
can be declared to depend on other files, in this case a perl module.
|
||||
|
||||
Two things are worth an extra note:
|
||||
|
||||
'DEPEND[cversion.o]' mentions an object file. DEPEND indexes is the
|
||||
only location where it's valid to mention them
|
||||
|
||||
Lines in 'BEGINRAW'..'ENDRAW' sections must always mention files as
|
||||
seen from the top directory, no exception.
|
||||
|
||||
# ssl/build.info
|
||||
LIBS=../libssl
|
||||
SOURCE[../libssl]=tls.c
|
||||
|
||||
This is the build.info file in 'ssl/', and it tells us that the
|
||||
library 'libssl' is built from the source file 'ssl/tls.c'.
|
||||
|
||||
# engines/build.info
|
||||
ENGINES=dasync
|
||||
SOURCE[dasync]=e_dasync.c
|
||||
DEPEND[dasync]=../libcrypto
|
||||
INCLUDE[dasync]=../include
|
||||
|
||||
ENGINES_NO_INST=ossltest
|
||||
SOURCE[ossltest]=e_ossltest.c
|
||||
DEPEND[ossltest]=../libcrypto
|
||||
INCLUDE[ossltest]=../include
|
||||
|
||||
This is the build.info file in 'engines/', telling us that two engines
|
||||
called 'engines/dasync' and 'engines/ossltest' shall be built, that
|
||||
dasync's source is 'engines/e_dasync.c' and ossltest's source is
|
||||
'engines/e_ossltest.c' and that the include directory 'include/' may
|
||||
be used when building anything that will be part of these engines.
|
||||
Also, both engines depend on the library 'libcrypto' to function
|
||||
properly. Finally, only dasync is being installed, as ossltest is
|
||||
only for internal testing.
|
||||
|
||||
When Configure digests these build.info files, the accumulated
|
||||
information comes down to this:
|
||||
|
||||
LIBS=libcrypto libssl
|
||||
ORDINALS[libcrypto]=crypto
|
||||
SOURCE[libcrypto]=crypto/aes.c crypto/evp.c crypto/cversion.c
|
||||
DEPEND[crypto/cversion.o]=crypto/buildinf.h
|
||||
INCLUDE[libcrypto]=include
|
||||
ORDINALS[libssl]=ssl
|
||||
SOURCE[libssl]=ssl/tls.c
|
||||
INCLUDE[libssl]=include
|
||||
DEPEND[libssl]=libcrypto
|
||||
|
||||
PROGRAMS=apps/openssl
|
||||
SOURCE[apps/openssl]=apps/openssl.c
|
||||
INCLUDE[apps/openssl]=. include
|
||||
DEPEND[apps/openssl]=libssl
|
||||
|
||||
ENGINES=engines/dasync
|
||||
SOURCE[engines/dasync]=engines/e_dasync.c
|
||||
DEPEND[engines/dasync]=libcrypto
|
||||
INCLUDE[engines/dasync]=include
|
||||
|
||||
ENGINES_NO_INST=engines/ossltest
|
||||
SOURCE[engines/ossltest]=engines/e_ossltest.c
|
||||
DEPEND[engines/ossltest]=libcrypto
|
||||
INCLUDE[engines/ossltest]=include
|
||||
|
||||
GENERATE[crypto/buildinf.h]=util/mkbuildinf.pl "$(CC) $(CFLAGS)" "$(PLATFORM)"
|
||||
DEPEND[crypto/buildinf.h]=Makefile
|
||||
DEPEND[util/mkbuildinf.pl]=util/Foo.pm
|
||||
|
||||
|
||||
A few notes worth mentioning:
|
||||
|
||||
LIBS may be used to declare routine libraries only.
|
||||
|
||||
PROGRAMS may be used to declare programs only.
|
||||
|
||||
ENGINES may be used to declare engines only.
|
||||
|
||||
The indexes for SOURCE and ORDINALS must only be end product files,
|
||||
such as libraries, programs or engines. The values of SOURCE
|
||||
variables must only be source files (possibly generated)
|
||||
|
||||
INCLUDE and DEPEND shows a relationship between different files
|
||||
(usually produced files) or between files and directories, such as a
|
||||
program depending on a library, or between an object file and some
|
||||
extra source file.
|
||||
|
||||
When Configure processes the build.info files, it will take it as
|
||||
truth without question, and will therefore perform very few checks.
|
||||
If the build tree is separate from the source tree, it will assume
|
||||
that all built files and up in the build directory and that all source
|
||||
files are to be found in the source tree, if they can be found there.
|
||||
Configure will assume that source files that can't be found in the
|
||||
source tree (such as 'crypto/bildinf.h' in the example above) are
|
||||
generated and will be found in the build tree.
|
||||
|
||||
|
||||
The %unified_info database
|
||||
--------------------------
|
||||
|
||||
The information in all the build.info get digested by Configure and
|
||||
collected into the %unified_info database, divided into the following
|
||||
indexes:
|
||||
|
||||
depends => a hash table containing 'file' => [ 'dependency' ... ]
|
||||
pairs. These are directly inferred from the DEPEND
|
||||
variables in build.info files.
|
||||
|
||||
engines => a list of engines. These are directly inferred from
|
||||
the ENGINES variable in build.info files.
|
||||
|
||||
generate => a hash table containing 'file' => [ 'generator' ... ]
|
||||
pairs. These are directly inferred from the GENERATE
|
||||
variables in build.info files.
|
||||
|
||||
includes => a hash table containing 'file' => [ 'include' ... ]
|
||||
pairs. These are directly inferred from the INCLUDE
|
||||
variables in build.info files.
|
||||
|
||||
install => a hash table containing 'type' => [ 'file' ... ] pairs.
|
||||
The types are 'programs', 'libraries', 'engines' and
|
||||
'scripts', and the array of files list the files of
|
||||
that type that should be installed.
|
||||
|
||||
libraries => a list of libraries. These are directly inferred from
|
||||
the LIBS variable in build.info files.
|
||||
|
||||
ordinals => a hash table containing 'file' => [ 'word', 'ordfile' ]
|
||||
pairs. 'file' and 'word' are directly inferred from
|
||||
the ORDINALS variables in build.info files, while the
|
||||
file 'ofile' comes from internal knowledge in
|
||||
Configure.
|
||||
|
||||
programs => a list of programs. These are directly inferred from
|
||||
the PROGRAMS variable in build.info files.
|
||||
|
||||
rawlines => a list of build-file lines. These are a direct copy of
|
||||
the BEGINRAW..ENDRAW lines in build.info files. Note:
|
||||
only the BEGINRAW..ENDRAW section for the current
|
||||
platform are copied, the rest are ignored.
|
||||
|
||||
scripts => a list of scripts. There are directly inferred from
|
||||
the SCRIPTS variable in build.info files.
|
||||
|
||||
sources => a hash table containing 'file' => [ 'sourcefile' ... ]
|
||||
pairs. These are indirectly inferred from the SOURCE
|
||||
variables in build.info files. Object files are
|
||||
mentioned in this hash table, with source files from
|
||||
SOURCE variables, and AS source files for programs and
|
||||
libraries.
|
||||
|
||||
shared_sources =>
|
||||
a hash table just like 'sources', but only as source
|
||||
files (object files) for building shared libraries.
|
||||
|
||||
As an example, here is how the build.info files example from the
|
||||
section above would be digested into a %unified_info table:
|
||||
|
||||
our %unified_info = (
|
||||
"depends" =>
|
||||
{
|
||||
"apps/openssl" =>
|
||||
[
|
||||
"libssl",
|
||||
],
|
||||
"crypto/buildinf.h" =>
|
||||
[
|
||||
"Makefile",
|
||||
],
|
||||
"crypto/cversion.o" =>
|
||||
[
|
||||
"crypto/buildinf.h",
|
||||
],
|
||||
"engines/ossltest" =>
|
||||
[
|
||||
"libcrypto",
|
||||
],
|
||||
"libssl" =>
|
||||
[
|
||||
"libcrypto",
|
||||
],
|
||||
"util/mkbuildinf.pl" =>
|
||||
[
|
||||
"util/Foo.pm",
|
||||
],
|
||||
},
|
||||
"engines" =>
|
||||
[
|
||||
"engines/dasync",
|
||||
"engines/ossltest",
|
||||
],
|
||||
"generate" =>
|
||||
{
|
||||
"crypto/buildinf.h" =>
|
||||
[
|
||||
"util/mkbuildinf.pl",
|
||||
"\"\$(CC)",
|
||||
"\$(CFLAGS)\"",
|
||||
"\"$(PLATFORM)\"",
|
||||
],
|
||||
},
|
||||
"includes" =>
|
||||
{
|
||||
"apps/openssl" =>
|
||||
[
|
||||
".",
|
||||
"include",
|
||||
],
|
||||
"engines/ossltest" =>
|
||||
[
|
||||
"include"
|
||||
],
|
||||
"libcrypto" =>
|
||||
[
|
||||
"include",
|
||||
],
|
||||
"libssl" =>
|
||||
[
|
||||
"include",
|
||||
],
|
||||
"util/mkbuildinf.pl" =>
|
||||
[
|
||||
"util",
|
||||
],
|
||||
}
|
||||
"install" =>
|
||||
{
|
||||
"engines" =>
|
||||
[
|
||||
"engines/dasync",
|
||||
],
|
||||
"libraries" =>
|
||||
[
|
||||
"libcrypto",
|
||||
"libssl",
|
||||
],
|
||||
"programs" =>
|
||||
[
|
||||
"apps/openssl",
|
||||
],
|
||||
},
|
||||
"libraries" =>
|
||||
[
|
||||
"libcrypto",
|
||||
"libssl",
|
||||
],
|
||||
"ordinals" =>
|
||||
{
|
||||
"libcrypto" =>
|
||||
[
|
||||
"crypto",
|
||||
"util/libcrypto.num",
|
||||
],
|
||||
"libssl" =>
|
||||
[
|
||||
"ssl",
|
||||
"util/libssl.num",
|
||||
],
|
||||
},
|
||||
"programs" =>
|
||||
[
|
||||
"apps/openssl",
|
||||
],
|
||||
"rawlines" =>
|
||||
[
|
||||
],
|
||||
"sources" =>
|
||||
{
|
||||
"apps/openssl" =>
|
||||
[
|
||||
"apps/openssl.o",
|
||||
],
|
||||
"apps/openssl.o" =>
|
||||
[
|
||||
"apps/openssl.c",
|
||||
],
|
||||
"crypto/aes.o" =>
|
||||
[
|
||||
"crypto/aes.c",
|
||||
],
|
||||
"crypto/cversion.o" =>
|
||||
[
|
||||
"crypto/cversion.c",
|
||||
],
|
||||
"crypto/evp.o" =>
|
||||
[
|
||||
"crypto/evp.c",
|
||||
],
|
||||
"engines/e_ossltest.o" =>
|
||||
[
|
||||
"engines/e_ossltest.c",
|
||||
],
|
||||
"engines/ossltest" =>
|
||||
[
|
||||
"engines/e_ossltest.o",
|
||||
],
|
||||
"libcrypto" =>
|
||||
[
|
||||
"crypto/aes.c",
|
||||
"crypto/cversion.c",
|
||||
"crypto/evp.c",
|
||||
],
|
||||
"libssl" =>
|
||||
[
|
||||
"ssl/tls.c",
|
||||
],
|
||||
"ssl/tls.o" =>
|
||||
[
|
||||
"ssl/tls.c",
|
||||
],
|
||||
},
|
||||
);
|
||||
|
||||
As can be seen, everything in %unified_info is fairly simple suggest
|
||||
of information. Still, it tells us that to build all programs, we
|
||||
must build 'apps/openssl', and to build the latter, we will need to
|
||||
build all its sources ('apps/openssl.o' in this case) and all the
|
||||
other things it depends on (such as 'libssl'). All those dependencies
|
||||
need to be built as well, using the same logic, so to build 'libssl',
|
||||
we need to build 'ssl/tls.o' as well as 'libcrypto', and to build the
|
||||
latter...
|
||||
|
||||
|
||||
Build-file templates
|
||||
--------------------
|
||||
|
||||
Build-file templates are essentially build-files (such as Makefile on
|
||||
Unix) with perl code fragments mixed in. Those perl code fragment
|
||||
will generate all the configuration dependent data, including all the
|
||||
rules needed to build end product files and intermediary files alike.
|
||||
At a minimum, there must be a perl code fragment that defines a set of
|
||||
functions that are used to generates specific build-file rules, to
|
||||
build static libraries from object files, to build shared libraries
|
||||
from static libraries, to programs from object files and libraries,
|
||||
etc.
|
||||
|
||||
generatesrc - function that produces build file lines to generate
|
||||
a source file from some input.
|
||||
|
||||
It's called like this:
|
||||
|
||||
generatesrc(src => "PATH/TO/tobegenerated",
|
||||
generator => [ "generatingfile", ... ]
|
||||
generator_incs => [ "INCL/PATH", ... ]
|
||||
generator_deps => [ "dep1", ... ]
|
||||
incs => [ "INCL/PATH", ... ],
|
||||
deps => [ "dep1", ... ],
|
||||
intent => one of "libs", "dso", "bin" );
|
||||
|
||||
'src' has the name of the file to be generated.
|
||||
'generator' is the command or part of command to
|
||||
generate the file, of which the first item is
|
||||
expected to be the file to generate from.
|
||||
generatesrc() is expected to analyse and figure out
|
||||
exactly how to apply that file and how to capture
|
||||
the result. 'generator_incs' and 'generator_deps'
|
||||
are include directories and files that the generator
|
||||
file itself depends on. 'incs' and 'deps' are
|
||||
include directories and files that are used if $(CC)
|
||||
is used as an intermediary step when generating the
|
||||
end product (the file indicated by 'src'). 'intent'
|
||||
indicates what the generated file is going to be
|
||||
used for.
|
||||
|
||||
src2obj - function that produces build file lines to build an
|
||||
object file from source files and associated data.
|
||||
|
||||
It's called like this:
|
||||
|
||||
src2obj(obj => "PATH/TO/objectfile",
|
||||
srcs => [ "PATH/TO/sourcefile", ... ],
|
||||
deps => [ "dep1", ... ],
|
||||
incs => [ "INCL/PATH", ... ]
|
||||
intent => one of "lib", "dso", "bin" );
|
||||
|
||||
'obj' has the intended object file *without*
|
||||
extension, src2obj() is expected to add that.
|
||||
'srcs' has the list of source files to build the
|
||||
object file, with the first item being the source
|
||||
file that directly corresponds to the object file.
|
||||
'deps' is a list of explicit dependencies. 'incs'
|
||||
is a list of include file directories. Finally,
|
||||
'intent' indicates what this object file is going
|
||||
to be used for.
|
||||
|
||||
obj2lib - function that produces build file lines to build a
|
||||
static library file ("libfoo.a" in Unix terms) from
|
||||
object files.
|
||||
|
||||
called like this:
|
||||
|
||||
obj2lib(lib => "PATH/TO/libfile",
|
||||
objs => [ "PATH/TO/objectfile", ... ]);
|
||||
|
||||
'lib' has the intended library file name *without*
|
||||
extension, obj2lib is expected to add that. 'objs'
|
||||
has the list of object files (also *without*
|
||||
extension) to build this library.
|
||||
|
||||
libobj2shlib - function that produces build file lines to build a
|
||||
shareable object library file ("libfoo.so" in Unix
|
||||
terms) from the corresponding static library file
|
||||
or object files.
|
||||
|
||||
called like this:
|
||||
|
||||
libobj2shlib(shlib => "PATH/TO/shlibfile",
|
||||
lib => "PATH/TO/libfile",
|
||||
objs => [ "PATH/TO/objectfile", ... ],
|
||||
deps => [ "PATH/TO/otherlibfile", ... ],
|
||||
ordinals => [ "word", "/PATH/TO/ordfile" ]);
|
||||
|
||||
'lib' has the intended library file name *without*
|
||||
extension, libobj2shlib is expected to add that.
|
||||
'shlib' has the corresponding shared library name
|
||||
*without* extension. 'deps' has the list of other
|
||||
libraries (also *without* extension) this library
|
||||
needs to be linked with. 'objs' has the list of
|
||||
object files (also *without* extension) to build
|
||||
this library. 'ordinals' MAY be present, and when
|
||||
it is, its value is an array where the word is
|
||||
"crypto" or "ssl" and the file is one of the ordinal
|
||||
files util/libcrypto.num or util/libssl.num in the
|
||||
source directory.
|
||||
|
||||
This function has a choice; it can use the
|
||||
corresponding static library as input to make the
|
||||
shared library, or the list of object files.
|
||||
|
||||
obj2dynlib - function that produces build file lines to build a
|
||||
dynamically loadable library file ("libfoo.so" on
|
||||
Unix) from object files.
|
||||
|
||||
called like this:
|
||||
|
||||
obj2dynlib(lib => "PATH/TO/libfile",
|
||||
objs => [ "PATH/TO/objectfile", ... ],
|
||||
deps => [ "PATH/TO/otherlibfile",
|
||||
... ]);
|
||||
|
||||
This is almost the same as libobj2shlib, but the
|
||||
intent is to build a shareable library that can be
|
||||
loaded in runtime (a "plugin"...). The differences
|
||||
are subtle, one of the most visible ones is that the
|
||||
resulting shareable library is produced from object
|
||||
files only.
|
||||
|
||||
obj2bin - function that produces build file lines to build an
|
||||
executable file from object files.
|
||||
|
||||
called like this:
|
||||
|
||||
obj2bin(bin => "PATH/TO/binfile",
|
||||
objs => [ "PATH/TO/objectfile", ... ],
|
||||
deps => [ "PATH/TO/libfile", ... ]);
|
||||
|
||||
'bin' has the intended executable file name
|
||||
*without* extension, obj2bin is expected to add
|
||||
that. 'objs' has the list of object files (also
|
||||
*without* extension) to build this library. 'deps'
|
||||
has the list of library files (also *without*
|
||||
extension) that the programs needs to be linked
|
||||
with.
|
||||
|
||||
in2script - function that produces build file lines to build a
|
||||
script file from some input.
|
||||
|
||||
called like this:
|
||||
|
||||
in2script(script => "PATH/TO/scriptfile",
|
||||
sources => [ "PATH/TO/infile", ... ]);
|
||||
|
||||
'script' has the intended script file name.
|
||||
'sources' has the list of source files to build the
|
||||
resulting script from.
|
||||
|
||||
Along with the build-file templates is the driving engine
|
||||
Configurations/common.tmpl, which looks through all the information in
|
||||
%unified_info and generates all the rulesets to build libraries,
|
||||
programs and all intermediate files, using the rule generating
|
||||
functions defined in the build-file template.
|
||||
|
||||
As an example with the smaller build.info set we've seen as an
|
||||
example, producing the rules to build 'libcrypto' would result in the
|
||||
following calls:
|
||||
|
||||
# Note: libobj2shlib will only be called if shared libraries are
|
||||
# to be produced.
|
||||
# Note 2: libobj2shlib gets both the name of the static library
|
||||
# and the names of all the object files that go into it. It's up
|
||||
# to the implementation to decide which to use as input.
|
||||
# Note 3: common.tmpl peals off the ".o" extension from all object
|
||||
# files, as the platform at hand may have a different one.
|
||||
libobj2shlib(shlib => "libcrypto",
|
||||
lib => "libcrypto",
|
||||
objs => [ "crypto/aes", "crypto/evp", "crypto/cversion" ],
|
||||
deps => [ ]
|
||||
ordinals => [ "crypto", "util/libcrypto.num" ]);
|
||||
|
||||
obj2lib(lib => "libcrypto"
|
||||
objs => [ "crypto/aes", "crypto/evp", "crypto/cversion" ]);
|
||||
|
||||
src2obj(obj => "crypto/aes"
|
||||
srcs => [ "crypto/aes.c" ],
|
||||
deps => [ ],
|
||||
incs => [ "include" ],
|
||||
intent => "lib");
|
||||
|
||||
src2obj(obj => "crypto/evp"
|
||||
srcs => [ "crypto/evp.c" ],
|
||||
deps => [ ],
|
||||
incs => [ "include" ],
|
||||
intent => "lib");
|
||||
|
||||
src2obj(obj => "crypto/cversion"
|
||||
srcs => [ "crypto/cversion.c" ],
|
||||
deps => [ "crypto/buildinf.h" ],
|
||||
incs => [ "include" ],
|
||||
intent => "lib");
|
||||
|
||||
generatesrc(src => "crypto/buildinf.h",
|
||||
generator => [ "util/mkbuildinf.pl", "\"$(CC)",
|
||||
"$(CFLAGS)\"", "\"$(PLATFORM)\"" ],
|
||||
generator_incs => [ "util" ],
|
||||
generator_deps => [ "util/Foo.pm" ],
|
||||
incs => [ ],
|
||||
deps => [ ],
|
||||
intent => "lib");
|
||||
|
||||
The returned strings from all those calls are then concatenated
|
||||
together and written to the resulting build-file.
|
||||
@@ -1,229 +0,0 @@
|
||||
{- # -*- Mode: perl -*-
|
||||
|
||||
use File::Basename;
|
||||
|
||||
# A cache of objects for which a recipe has already been generated
|
||||
my %cache;
|
||||
|
||||
# resolvedepends and reducedepends work in tandem to make sure
|
||||
# there are no duplicate dependencies and that they are in the
|
||||
# right order. This is especially used to sort the list of
|
||||
# libraries that a build depends on.
|
||||
sub resolvedepends {
|
||||
my $thing = shift;
|
||||
my @listsofar = @_; # to check if we're looping
|
||||
my @list = @{$unified_info{depends}->{$thing}};
|
||||
my @newlist = ();
|
||||
if (scalar @list) {
|
||||
foreach my $item (@list) {
|
||||
# It's time to break off when the dependency list starts looping
|
||||
next if grep { $_ eq $item } @listsofar;
|
||||
push @newlist, $item, resolvedepends($item, @listsofar, $item);
|
||||
}
|
||||
}
|
||||
@newlist;
|
||||
}
|
||||
sub reducedepends {
|
||||
my @list = @_;
|
||||
my @newlist = ();
|
||||
while (@list) {
|
||||
my $item = shift @list;
|
||||
push @newlist, $item
|
||||
unless grep { $item eq $_ } @list;
|
||||
}
|
||||
@newlist;
|
||||
}
|
||||
|
||||
# dogenerate is responsible for producing all the recipes that build
|
||||
# generated source files. It recurses in case a dependency is also a
|
||||
# generated source file.
|
||||
sub dogenerate {
|
||||
my $src = shift;
|
||||
return "" if $cache{$src};
|
||||
my $obj = shift;
|
||||
my $bin = shift;
|
||||
my %opts = @_;
|
||||
if ($unified_info{generate}->{$src}) {
|
||||
die "$src is generated by Configure, should not appear in build file\n"
|
||||
if ref $unified_info{generate}->{$src} eq "";
|
||||
my $script = $unified_info{generate}->{$src}->[0];
|
||||
$OUT .= generatesrc(src => $src,
|
||||
generator => $unified_info{generate}->{$src},
|
||||
generator_incs => $unified_info{includes}->{$script},
|
||||
generator_deps => $unified_info{depends}->{$script},
|
||||
deps => $unified_info{depends}->{$src},
|
||||
incs => $unified_info{includes}->{$obj},
|
||||
%opts);
|
||||
foreach (@{$unified_info{depends}->{$src}}) {
|
||||
dogenerate($_, $obj, $bin, %opts);
|
||||
}
|
||||
}
|
||||
$cache{$src} = 1;
|
||||
}
|
||||
|
||||
# doobj is responsible for producing all the recipes that build
|
||||
# object files as well as dependency files.
|
||||
sub doobj {
|
||||
my $obj = shift;
|
||||
return "" if $cache{$obj};
|
||||
(my $obj_no_o = $obj) =~ s|\.o$||;
|
||||
my $bin = shift;
|
||||
my %opts = @_;
|
||||
if (@{$unified_info{sources}->{$obj}}) {
|
||||
$OUT .= src2obj(obj => $obj_no_o,
|
||||
srcs => $unified_info{sources}->{$obj},
|
||||
deps => $unified_info{depends}->{$obj},
|
||||
incs => $unified_info{includes}->{$obj},
|
||||
%opts);
|
||||
foreach ((@{$unified_info{sources}->{$obj}},
|
||||
@{$unified_info{depends}->{$obj}})) {
|
||||
dogenerate($_, $obj, $bin, %opts);
|
||||
}
|
||||
}
|
||||
$cache{$obj} = 1;
|
||||
}
|
||||
|
||||
# dolib is responsible for building libraries. It will call
|
||||
# libobj2shlib is shared libraries are produced, and obj2lib in all
|
||||
# cases. It also makes sure all object files for the library are
|
||||
# built.
|
||||
sub dolib {
|
||||
my $lib = shift;
|
||||
return "" if $cache{$lib};
|
||||
unless ($disabled{shared}) {
|
||||
my %ordinals =
|
||||
$unified_info{ordinals}->{$lib}
|
||||
? (ordinals => $unified_info{ordinals}->{$lib}) : ();
|
||||
$OUT .= libobj2shlib(shlib => $unified_info{sharednames}->{$lib},
|
||||
lib => $lib,
|
||||
objs => [ map { (my $x = $_) =~ s|\.o$||; $x }
|
||||
(@{$unified_info{sources}->{$lib}},
|
||||
@{$unified_info{shared_sources}->{$lib}}) ],
|
||||
deps => [ reducedepends(resolvedepends($lib)) ],
|
||||
%ordinals);
|
||||
foreach (@{$unified_info{shared_sources}->{$lib}}) {
|
||||
doobj($_, $lib, intent => "lib");
|
||||
}
|
||||
}
|
||||
$OUT .= obj2lib(lib => $lib,
|
||||
objs => [ map { (my $x = $_) =~ s|\.o$||; $x }
|
||||
@{$unified_info{sources}->{$lib}} ]);
|
||||
foreach (@{$unified_info{sources}->{$lib}}) {
|
||||
doobj($_, $lib, intent => "lib");
|
||||
}
|
||||
$cache{$lib} = 1;
|
||||
}
|
||||
|
||||
# doengine is responsible for building engines. It will call
|
||||
# obj2dso, and also makes sure all object files for the library
|
||||
# are built.
|
||||
sub doengine {
|
||||
my $lib = shift;
|
||||
return "" if $cache{$lib};
|
||||
$OUT .= obj2dso(lib => $lib,
|
||||
objs => [ map { (my $x = $_) =~ s|\.o$||; $x }
|
||||
(@{$unified_info{sources}->{$lib}},
|
||||
@{$unified_info{shared_sources}->{$lib}}) ],
|
||||
deps => [ resolvedepends($lib) ]);
|
||||
foreach ((@{$unified_info{sources}->{$lib}},
|
||||
@{$unified_info{shared_sources}->{$lib}})) {
|
||||
doobj($_, $lib, intent => "dso");
|
||||
}
|
||||
$cache{$lib} = 1;
|
||||
}
|
||||
|
||||
# dobin is responsible for building programs. It will call obj2bin,
|
||||
# and also makes sure all object files for the library are built.
|
||||
sub dobin {
|
||||
my $bin = shift;
|
||||
return "" if $cache{$bin};
|
||||
my $deps = [ reducedepends(resolvedepends($bin)) ];
|
||||
$OUT .= obj2bin(bin => $bin,
|
||||
objs => [ map { (my $x = $_) =~ s|\.o$||; $x }
|
||||
@{$unified_info{sources}->{$bin}} ],
|
||||
deps => $deps);
|
||||
foreach (@{$unified_info{sources}->{$bin}}) {
|
||||
doobj($_, $bin, intent => "bin");
|
||||
}
|
||||
$cache{$bin} = 1;
|
||||
}
|
||||
|
||||
# dobin is responsible for building scripts from templates. It will
|
||||
# call in2script.
|
||||
sub doscript {
|
||||
my $script = shift;
|
||||
return "" if $cache{$script};
|
||||
$OUT .= in2script(script => $script,
|
||||
sources => $unified_info{sources}->{$script});
|
||||
$cache{$script} = 1;
|
||||
}
|
||||
|
||||
sub dodir {
|
||||
my $dir = shift;
|
||||
return "" if !exists(&generatedir) or $cache{$dir};
|
||||
$OUT .= generatedir(dir => $dir,
|
||||
deps => $unified_info{dirinfo}->{$dir}->{deps},
|
||||
%{$unified_info{dirinfo}->{$_}->{products}});
|
||||
$cache{$dir} = 1;
|
||||
}
|
||||
|
||||
# Start with populating the cache with all the overrides
|
||||
%cache = map { $_ => 1 } @{$unified_info{overrides}};
|
||||
|
||||
# For convenience collect information regarding directories where
|
||||
# files are generated, those generated files and the end product
|
||||
# they end up in where applicable. Then, add build rules for those
|
||||
# directories
|
||||
if (exists &generatedir) {
|
||||
my %loopinfo = ( "dso" => [ @{$unified_info{engines}} ],
|
||||
"lib" => [ @{$unified_info{libraries}} ],
|
||||
"bin" => [ @{$unified_info{programs}} ],
|
||||
"script" => [ @{$unified_info{scripts}} ] );
|
||||
foreach my $type (keys %loopinfo) {
|
||||
foreach my $product (@{$loopinfo{$type}}) {
|
||||
my %dirs = ();
|
||||
my $pd = dirname($product);
|
||||
|
||||
# We already have a "test" target, and the current directory
|
||||
# is just silly to make a target for
|
||||
$dirs{$pd} = 1 unless $pd eq "test" || $pd eq ".";
|
||||
|
||||
foreach (@{$unified_info{sources}->{$product}}) {
|
||||
my $d = dirname($_);
|
||||
|
||||
# We don't want to create targets for source directories
|
||||
# when building out of source
|
||||
next if ($config{sourcedir} ne $config{builddir}
|
||||
&& $d =~ m|^\Q$config{sourcedir}\E|);
|
||||
# We already have a "test" target, and the current directory
|
||||
# is just silly to make a target for
|
||||
next if $d eq "test" || $d eq ".";
|
||||
|
||||
$dirs{$d} = 1;
|
||||
push @{$unified_info{dirinfo}->{$d}->{deps}}, $_
|
||||
if $d ne $pd;
|
||||
}
|
||||
foreach (keys %dirs) {
|
||||
push @{$unified_info{dirinfo}->{$_}->{products}->{$type}},
|
||||
$product;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Build mandatory generated headers
|
||||
foreach (@{$unified_info{depends}->{""}}) { dogenerate($_); }
|
||||
|
||||
# Build all known libraries, engines, programs and scripts.
|
||||
# Everything else will be handled as a consequence.
|
||||
foreach (@{$unified_info{libraries}}) { dolib($_); }
|
||||
foreach (@{$unified_info{engines}}) { doengine($_); }
|
||||
foreach (@{$unified_info{programs}}) { dobin($_); }
|
||||
foreach (@{$unified_info{scripts}}) { doscript($_); }
|
||||
|
||||
foreach (sort keys %{$unified_info{dirinfo}}) { dodir($_); }
|
||||
|
||||
# Finally, should there be any applicable BEGINRAW/ENDRAW sections,
|
||||
# they are added here.
|
||||
$OUT .= $_."\n" foreach @{$unified_info{rawlines}};
|
||||
-}
|
||||
@@ -1,777 +0,0 @@
|
||||
## descrip.mms to build OpenSSL on OpenVMS
|
||||
##
|
||||
## {- join("\n## ", @autowarntext) -}
|
||||
{-
|
||||
use File::Spec::Functions qw/:DEFAULT abs2rel rel2abs/;
|
||||
|
||||
# Our prefix, claimed when speaking with the VSI folks Tuesday
|
||||
# January 26th 2016
|
||||
our $osslprefix = 'OSSL$';
|
||||
(our $osslprefix_q = $osslprefix) =~ s/\$/\\\$/;
|
||||
|
||||
our $sover = sprintf "%02d%02d", $config{shlib_major}, $config{shlib_minor};
|
||||
our $osslver = sprintf "%02d%02d", split(/\./, $config{version});
|
||||
|
||||
our $sourcedir = $config{sourcedir};
|
||||
our $builddir = $config{builddir};
|
||||
sub sourcefile {
|
||||
catfile($sourcedir, @_);
|
||||
}
|
||||
sub buildfile {
|
||||
catfile($builddir, @_);
|
||||
}
|
||||
sub sourcedir {
|
||||
catdir($sourcedir, @_);
|
||||
}
|
||||
sub builddir {
|
||||
catdir($builddir, @_);
|
||||
}
|
||||
sub tree {
|
||||
(my $x = shift) =~ s|\]$|...]|;
|
||||
$x
|
||||
}
|
||||
sub move {
|
||||
my $f = catdir(@_);
|
||||
my $b = abs2rel(rel2abs("."),rel2abs($f));
|
||||
$sourcedir = catdir($b,$sourcedir)
|
||||
if !file_name_is_absolute($sourcedir);
|
||||
$builddir = catdir($b,$builddir)
|
||||
if !file_name_is_absolute($builddir);
|
||||
"";
|
||||
}
|
||||
|
||||
# Because we need to make two computations of these data,
|
||||
# we store them in arrays for reuse
|
||||
our @shlibs = map { $unified_info{sharednames}->{$_} || () } @{$unified_info{libraries}};
|
||||
our @install_shlibs = map { $unified_info{sharednames}->{$_} || () } @{$unified_info{install}->{libraries}};
|
||||
our @generated = ( ( map { (my $x = $_) =~ s|\.S$|\.s|; $x }
|
||||
grep { defined $unified_info{generate}->{$_} }
|
||||
map { @{$unified_info{sources}->{$_}} }
|
||||
grep { /\.o$/ } keys %{$unified_info{sources}} ),
|
||||
( grep { /\.h$/ } keys %{$unified_info{generate}} ) );
|
||||
|
||||
# This is a horrible hack, but is needed because recursive inclusion of files
|
||||
# in different directories does not work well with HP C.
|
||||
my $sd = sourcedir("crypto", "async", "arch");
|
||||
foreach (grep /\[\.crypto\.async\.arch\].*\.o$/, keys %{$unified_info{sources}}) {
|
||||
(my $x = $_) =~ s|\.o$|.OBJ|;
|
||||
$unified_info{before}->{$x}
|
||||
= qq(arch_include = F\$PARSE("$sd","A.;",,,"SYNTAX_ONLY") - "A.;"
|
||||
define arch 'arch_include');
|
||||
$unified_info{after}->{$x}
|
||||
= qq(deassign arch);
|
||||
}
|
||||
my $sd1 = sourcedir("ssl","record");
|
||||
my $sd2 = sourcedir("ssl","statem");
|
||||
$unified_info{before}->{"[.test]heartbeat_test.OBJ"}
|
||||
= $unified_info{before}->{"[.test]ssltest_old.OBJ"}
|
||||
= qq(record_include = F\$PARSE("$sd1","A.;",,,"SYNTAX_ONLY") - "A.;"
|
||||
define record 'record_include'
|
||||
statem_include = F\$PARSE("$sd2","A.;",,,"SYNTAX_ONLY") - "A.;"
|
||||
define statem 'statem_include');
|
||||
$unified_info{after}->{"[.test]heartbeat_test.OBJ"}
|
||||
= $unified_info{after}->{"[.test]ssltest.OBJ"}
|
||||
= qq(deassign statem
|
||||
deassign record);
|
||||
foreach (grep /^\[\.ssl\.(?:record|statem)\].*\.o$/, keys %{$unified_info{sources}}) {
|
||||
(my $x = $_) =~ s|\.o$|.OBJ|;
|
||||
$unified_info{before}->{$x}
|
||||
= qq(record_include = F\$PARSE("$sd1","A.;",,,"SYNTAX_ONLY") - "A.;"
|
||||
define record 'record_include'
|
||||
statem_include = F\$PARSE("$sd2","A.;",,,"SYNTAX_ONLY") - "A.;"
|
||||
define statem 'statem_include');
|
||||
$unified_info{after}->{$x}
|
||||
= qq(deassign statem
|
||||
deassign record);
|
||||
}
|
||||
# This makes sure things get built in the order they need
|
||||
# to. You're welcome.
|
||||
sub dependmagic {
|
||||
my $target = shift;
|
||||
|
||||
return "$target : build_generated\n\t\pipe \$(MMS) \$(MMSQUALIFIERS) depend && \$(MMS) \$(MMSQUALIFIERS) _$target\n_$target";
|
||||
}
|
||||
#use Data::Dumper;
|
||||
#print STDERR "DEBUG: before:\n", Dumper($unified_info{before});
|
||||
#print STDERR "DEBUG: after:\n", Dumper($unified_info{after});
|
||||
"";
|
||||
-}
|
||||
PLATFORM={- $config{target} -}
|
||||
OPTIONS={- $config{options} -}
|
||||
CONFIGURE_ARGS=({- join(", ",quotify_l(@{$config{perlargv}})) -})
|
||||
SRCDIR={- $config{sourcedir} -}
|
||||
BLDDIR={- $config{builddir} -}
|
||||
|
||||
# Allow both V and VERBOSE to indicate verbosity. This only applies
|
||||
# to testing.
|
||||
VERBOSE=$(V)
|
||||
|
||||
VERSION={- $config{version} -}
|
||||
MAJOR={- $config{major} -}
|
||||
MINOR={- $config{minor} -}
|
||||
SHLIB_VERSION_NUMBER={- $config{shlib_version_number} -}
|
||||
SHLIB_VERSION_HISTORY={- $config{shlib_version_history} -}
|
||||
SHLIB_MAJOR={- $config{shlib_major} -}
|
||||
SHLIB_MINOR={- $config{shlib_minor} -}
|
||||
SHLIB_TARGET={- $target{shared_target} -}
|
||||
|
||||
EXE_EXT=.EXE
|
||||
LIB_EXT=.OLB
|
||||
SHLIB_EXT=.EXE
|
||||
OBJ_EXT=.OBJ
|
||||
DEP_EXT=.D
|
||||
|
||||
LIBS={- join(", ", map { "-\n\t".$_.".OLB" } @{$unified_info{libraries}}) -}
|
||||
SHLIBS={- join(", ", map { "-\n\t".$_.".EXE" } @shlibs) -}
|
||||
ENGINES={- join(", ", map { "-\n\t".$_.".EXE" } @{$unified_info{engines}}) -}
|
||||
PROGRAMS={- join(", ", map { "-\n\t".$_.".EXE" } @{$unified_info{programs}}) -}
|
||||
SCRIPTS={- join(", ", map { "-\n\t".$_ } @{$unified_info{scripts}}) -}
|
||||
{- output_off() if $disabled{makedepend}; "" -}
|
||||
DEPS={- our @deps = map { (my $x = $_) =~ s|\.o$|\$(DEP_EXT)|; $x; }
|
||||
grep { $unified_info{sources}->{$_}->[0] =~ /\.c$/ }
|
||||
keys %{$unified_info{sources}};
|
||||
join(", ", map { "-\n\t".$_ } @deps); -}
|
||||
{- output_on() if $disabled{makedepend}; "" -}
|
||||
GENERATED_MANDATORY={- join(", ", map { "-\n\t".$_ } @{$unified_info{depends}->{""}} ) -}
|
||||
GENERATED={- join(", ", map { "-\n\t".$_ } @generated) -}
|
||||
|
||||
INSTALL_LIBS={- join(", ", map { "-\n\t".$_.".OLB" } @{$unified_info{install}->{libraries}}) -}
|
||||
INSTALL_SHLIBS={- join(", ", map { "-\n\t".$_.".EXE" } @install_shlibs) -}
|
||||
INSTALL_ENGINES={- join(", ", map { "-\n\t".$_.".EXE" } @{$unified_info{install}->{engines}}) -}
|
||||
INSTALL_PROGRAMS={- join(", ", map { "-\n\t".$_.".EXE" } @{$unified_info{install}->{programs}}) -}
|
||||
{- output_off() if $disabled{apps}; "" -}
|
||||
BIN_SCRIPTS=[.tools]c_rehash.pl
|
||||
MISC_SCRIPTS=[.apps]CA.pl, [.apps]tsget.pl
|
||||
{- output_on() if $disabled{apps}; "" -}
|
||||
|
||||
APPS_OPENSSL={- use File::Spec::Functions;
|
||||
catfile("apps","openssl") -}
|
||||
|
||||
# DESTDIR is for package builders so that they can configure for, say,
|
||||
# SYS$COMMON:[OPENSSL] and yet have everything installed in STAGING:[USER].
|
||||
# In that case, configure with --prefix=SYS$COMMON:[OPENSSL] and then run
|
||||
# MMS with /MACROS=(DESTDIR=STAGING:[USER]). The result will end up in
|
||||
# STAGING:[USER.OPENSSL].
|
||||
# Normally it is left empty.
|
||||
DESTDIR=
|
||||
|
||||
# Do not edit this manually. Use Configure --prefix=DIR to change this!
|
||||
INSTALLTOP={- our $installtop =
|
||||
catdir($config{prefix}) || "SYS\$COMMON:[OPENSSL]";
|
||||
$installtop -}
|
||||
SYSTARTUP={- catdir($installtop, '[.SYS$STARTUP]'); -}
|
||||
# This is the standard central area to store certificates, private keys...
|
||||
OPENSSLDIR={- catdir($config{openssldir}) or
|
||||
$config{prefix} ? catdir($config{prefix},"COMMON")
|
||||
: "SYS\$COMMON:[OPENSSL-COMMON]" -}
|
||||
# The same, but for C
|
||||
OPENSSLDIR_C={- $osslprefix -}DATAROOT:[000000]
|
||||
# Where installed engines reside, for C
|
||||
ENGINESDIR_C={- $osslprefix -}ENGINES{- $sover.$target{pointer_size} -}:
|
||||
|
||||
CC= {- $target{cc} -}
|
||||
CFLAGS= /DEFINE=({- join(",", @{$target{defines}}, @{$config{defines}},"OPENSSLDIR=\"\"\"\$(OPENSSLDIR_C)\"\"\"","ENGINESDIR=\"\"\"\$(ENGINESDIR_C)\"\"\"") -}) {- $target{cflags} -} {- $config{cflags} -}
|
||||
CFLAGS_Q=$(CFLAGS)
|
||||
DEPFLAG= /DEFINE=({- join(",", @{$config{depdefines}}) -})
|
||||
LDFLAGS= {- $target{lflags} -}
|
||||
EX_LIBS= {- $target{ex_libs} ? ",".$target{ex_libs} : "" -}{- $config{ex_libs} ? ",".$config{ex_libs} : "" -}
|
||||
LIB_CFLAGS={- $target{lib_cflags} || "" -}
|
||||
DSO_CFLAGS={- $target{dso_cflags} || "" -}
|
||||
BIN_CFLAGS={- $target{bin_cflags} || "" -}
|
||||
|
||||
PERL={- $config{perl} -}
|
||||
|
||||
# We let the C compiler driver to take care of .s files. This is done in
|
||||
# order to be excused from maintaining a separate set of architecture
|
||||
# dependent assembler flags. E.g. if you throw -mcpu=ultrasparc at SPARC
|
||||
# gcc, then the driver will automatically translate it to -xarch=v8plus
|
||||
# and pass it down to assembler.
|
||||
AS={- $target{as} -}
|
||||
ASFLAG={- $target{asflags} -}
|
||||
|
||||
# .FIRST and .LAST are special targets with MMS and MMK.
|
||||
# The defines in there are for C. includes that look like
|
||||
# this:
|
||||
#
|
||||
# #include <openssl/foo.h>
|
||||
# #include "internal/bar.h"
|
||||
#
|
||||
# will use the logical names to find the files. Expecting
|
||||
# DECompHP C to find files in subdirectories of whatever was
|
||||
# given with /INCLUDE is a fantasy, unfortunately.
|
||||
NODEBUG=@
|
||||
.FIRST :
|
||||
$(NODEBUG) openssl_inc1 = F$PARSE("[.include.openssl]","A.;",,,"syntax_only") - "A.;"
|
||||
$(NODEBUG) openssl_inc2 = F$PARSE("{- catdir($config{sourcedir},"[.include.openssl]") -}","A.;",,,"SYNTAX_ONLY") - "A.;"
|
||||
$(NODEBUG) internal_inc1 = F$PARSE("[.crypto.include.internal]","A.;",,,"SYNTAX_ONLY") - "A.;"
|
||||
$(NODEBUG) internal_inc2 = F$PARSE("{- catdir($config{sourcedir},"[.include.internal]") -}","A.;",,,"SYNTAX_ONLY") - "A.;"
|
||||
$(NODEBUG) internal_inc3 = F$PARSE("{- catdir($config{sourcedir},"[.crypto.include.internal]") -}","A.;",,,"SYNTAX_ONLY") - "A.;"
|
||||
$(NODEBUG) DEFINE openssl 'openssl_inc1','openssl_inc2'
|
||||
$(NODEBUG) DEFINE internal 'internal_inc1','internal_inc2','internal_inc3'
|
||||
$(NODEBUG) staging_dir = "$(DESTDIR)"
|
||||
$(NODEBUG) staging_instdir = ""
|
||||
$(NODEBUG) staging_datadir = ""
|
||||
$(NODEBUG) IF staging_dir .NES. "" THEN -
|
||||
staging_instdir = F$PARSE("A.;",staging_dir,"[]",,"SYNTAX_ONLY")
|
||||
$(NODEBUG) IF staging_instdir - "]A.;" .NES. staging_instdir THEN -
|
||||
staging_instdir = staging_instdir - "]A.;" + ".OPENSSL-INSTALL]"
|
||||
$(NODEBUG) IF staging_instdir - "A.;" .NES. staging_instdir THEN -
|
||||
staging_instdir = staging_instdir - "A.;" + "[OPENSSL-INSTALL]"
|
||||
$(NODEBUG) IF staging_dir .NES. "" THEN -
|
||||
staging_datadir = F$PARSE("A.;",staging_dir,"[]",,"SYNTAX_ONLY")
|
||||
$(NODEBUG) IF staging_datadir - "]A.;" .NES. staging_datadir THEN -
|
||||
staging_datadir = staging_datadir - "]A.;" + ".OPENSSL-COMMON]"
|
||||
$(NODEBUG) IF staging_datadir - "A.;" .NES. staging_datadir THEN -
|
||||
staging_datadir = staging_datadir - "A.;" + "[OPENSSL-COMMON]"
|
||||
$(NODEBUG) !
|
||||
$(NODEBUG) ! Installation logical names
|
||||
$(NODEBUG) !
|
||||
$(NODEBUG) installtop = F$PARSE(staging_instdir,"$(INSTALLTOP)","[]A.;",,"SYNTAX_ONLY,NO_CONCEAL") - ".][000000" - "[000000." - "][" - "]A.;" + ".]"
|
||||
$(NODEBUG) datatop = F$PARSE(staging_datadir,"$(OPENSSLDIR)","[]A.;",,"SYNTAX_ONLY,NO_CONCEAL") - ".][000000" - "[000000." - "][" - "]A.;" + ".]"
|
||||
$(NODEBUG) DEFINE ossl_installroot 'installtop'
|
||||
$(NODEBUG) DEFINE ossl_dataroot 'datatop'
|
||||
$(NODEBUG) !
|
||||
$(NODEBUG) ! Figure out the architecture
|
||||
$(NODEBUG) !
|
||||
$(NODEBUG) arch = f$edit( f$getsyi( "arch_name"), "upcase")
|
||||
$(NODEBUG) !
|
||||
$(NODEBUG) ! Set up logical names for the libraries, so LINK and
|
||||
$(NODEBUG) ! running programs can use them.
|
||||
$(NODEBUG) !
|
||||
$(NODEBUG) {- join("\n\t\$(NODEBUG) ", map { "DEFINE ".uc($_)." 'F\$ENV(\"DEFAULT\")'".uc($_)."\$(SHLIB_EXT)" } map { $unified_info{sharednames}->{$_} || () } @{$unified_info{libraries}}) || "!" -}
|
||||
|
||||
.LAST :
|
||||
$(NODEBUG) {- join("\n\t\$(NODEBUG) ", map { "DEASSIGN ".uc($_) } map { $unified_info{sharednames}->{$_} || () } @{$unified_info{libraries}}) || "!" -}
|
||||
$(NODEBUG) DEASSIGN ossl_dataroot
|
||||
$(NODEBUG) DEASSIGN ossl_installroot
|
||||
$(NODEBUG) DEASSIGN internal
|
||||
$(NODEBUG) DEASSIGN openssl
|
||||
.DEFAULT :
|
||||
@ ! MMS cannot handle no actions...
|
||||
|
||||
# The main targets ###################################################
|
||||
|
||||
{- dependmagic('all'); -} : build_libs_nodep, build_engines_nodep, build_programs_nodep
|
||||
{- dependmagic('build_libs'); -} : build_libs_nodep
|
||||
{- dependmagic('build_engines'); -} : build_engines_nodep
|
||||
{- dependmagic('build_programs'); -} : build_programs_nodep
|
||||
|
||||
build_generated : $(GENERATED_MANDATORY)
|
||||
build_libs_nodep : $(LIBS), $(SHLIBS)
|
||||
build_engines_nodep : $(ENGINES)
|
||||
build_programs_nodep : $(PROGRAMS), $(SCRIPTS)
|
||||
|
||||
# Kept around for backward compatibility
|
||||
build_apps build_tests : build_programs
|
||||
|
||||
# Convenience target to prebuild all generated files, not just the mandatory
|
||||
# ones
|
||||
build_all_generated : $(GENERATED_MANDATORY) $(GENERATED)
|
||||
|
||||
test : tests
|
||||
{- dependmagic('tests'); -} : build_programs_nodep, build_engines_nodep
|
||||
@ ! {- output_off() if $disabled{tests}; "" -}
|
||||
SET DEFAULT [.test]{- move("test") -}
|
||||
CREATE/DIR [.test-runs]
|
||||
DEFINE SRCTOP {- sourcedir() -}
|
||||
DEFINE BLDTOP {- builddir() -}
|
||||
DEFINE RESULT_D {- builddir(qw(test test-runs)) -}
|
||||
DEFINE OPENSSL_ENGINES {- builddir("engines") -}
|
||||
DEFINE OPENSSL_DEBUG_MEMORY "on"
|
||||
IF "$(VERBOSE)" .NES. "" THEN DEFINE VERBOSE "$(VERBOSE)"
|
||||
$(PERL) {- sourcefile("test", "run_tests.pl") -} $(TESTS)
|
||||
DEASSIGN OPENSSL_DEBUG_MEMORY
|
||||
DEASSIGN OPENSSL_ENGINES
|
||||
DEASSIGN BLDTOP
|
||||
DEASSIGN SRCTOP
|
||||
SET DEFAULT [-]{- move("..") -}
|
||||
@ ! {- if ($disabled{tests}) { output_on(); } else { output_off(); } "" -}
|
||||
@ WRITE SYS$OUTPUT "Tests are not supported with your chosen Configure options"
|
||||
@ ! {- output_on() if !$disabled{tests}; "" -}
|
||||
|
||||
list-tests :
|
||||
@ ! {- output_off() if $disabled{tests}; "" -}
|
||||
@ DEFINE SRCTOP {- sourcedir() -}
|
||||
@ $(PERL) {- sourcefile("test", "run_tests.pl") -} list
|
||||
@ DEASSIGN SRCTOP
|
||||
@ ! {- if ($disabled{tests}) { output_on(); } else { output_off(); } "" -}
|
||||
@ WRITE SYS$OUTPUT "Tests are not supported with your chosen Configure options"
|
||||
@ ! {- output_on() if !$disabled{tests}; "" -}
|
||||
|
||||
install : install_sw install_ssldirs install_docs
|
||||
@ WRITE SYS$OUTPUT ""
|
||||
@ WRITE SYS$OUTPUT "######################################################################"
|
||||
@ WRITE SYS$OUTPUT ""
|
||||
@ IF "$(DESTDIR)" .EQS. "" THEN -
|
||||
PIPE ( WRITE SYS$OUTPUT "Installation complete" ; -
|
||||
WRITE SYS$OUTPUT "" ; -
|
||||
WRITE SYS$OUTPUT "Run @$(SYSTARTUP)openssl_startup{- $osslver -} to set up logical names" ; -
|
||||
WRITE SYS$OUTPUT "then run @$(SYSTARTUP)openssl_utils{- $osslver -} to define commands" ; -
|
||||
WRITE SYS$OUTPUT "" )
|
||||
@ IF "$(DESTDIR)" .NES. "" THEN -
|
||||
PIPE ( WRITE SYS$OUTPUT "Staging installation complete" ; -
|
||||
WRITE SYS$OUTPUT "" ; -
|
||||
WRITE SYS$OUTPUT "Finish or package in such a way that the contents of the directory tree" ; -
|
||||
WRITE SYS$OUTPUT staging_instdir ; -
|
||||
WRITE SYS$OUTPUT "ends up in $(INSTALLTOP)," ; -
|
||||
WRITE SYS$OUTPUT "and that the contents of the contents of the directory tree" ; -
|
||||
WRITE SYS$OUTPUT staging_datadir ; -
|
||||
WRITE SYS$OUTPUT "ends up in $(OPENSSLDIR)" ; -
|
||||
WRITE SYS$OUTPUT "" ; -
|
||||
WRITE SYS$OUTPUT "When in its final destination," ; -
|
||||
WRITE SYS$OUTPUT "Run @$(SYSTARTUP)openssl_startup{- $osslver -} to set up logical names" ; -
|
||||
WRITE SYS$OUTPUT "then run @$(SYSTARTUP)openssl_utils{- $osslver -} to define commands" ; -
|
||||
WRITE SYS$OUTPUT "" )
|
||||
|
||||
check_install :
|
||||
spawn/nolog @ossl_installroot:[SYSTEST]openssl_ivp{- $osslver -}.com
|
||||
|
||||
uninstall : uninstall_docs uninstall_sw
|
||||
|
||||
# Because VMS wants the generation number (or *) to delete files, we can't
|
||||
# use $(LIBS), $(PROGRAMS), $(GENERATED) and $(ENGINES)directly.
|
||||
libclean :
|
||||
{- join("\n\t", map { "- DELETE $_.OLB;*" } @{$unified_info{libraries}}) || "@ !" -}
|
||||
{- join("\n\t", map { "- DELETE $_.EXE;*,$_.MAP;*,$_.OPT;*" } @shlibs) || "@ !" -}
|
||||
|
||||
clean : libclean
|
||||
{- join("\n\t", map { "- DELETE $_.EXE;*,$_.OPT;*" } @{$unified_info{programs}}) || "@ !" -}
|
||||
{- join("\n\t", map { "- DELETE $_.EXE;*,$_.OPT;*" } @{$unified_info{engines}}) || "@ !" -}
|
||||
{- join("\n\t", map { "- DELETE $_;*" } @{$unified_info{scripts}}) || "@ !" -}
|
||||
{- join("\n\t", map { "- DELETE $_;*" } @generated) || "@ !" -}
|
||||
- DELETE [...]*.MAP;*
|
||||
- DELETE [...]*.D;*
|
||||
- DELETE [...]*.OBJ;*,*.LIS;*
|
||||
- DELETE []CXX$DEMANGLER_DB.;*
|
||||
- DELETE [.VMS]openssl_startup.com;*
|
||||
- DELETE [.VMS]openssl_shutdown.com;*
|
||||
- DELETE []vmsconfig.pm;*
|
||||
|
||||
distclean : clean
|
||||
- DELETE configdata.pm;*
|
||||
- DELETE descrip.mms;*
|
||||
|
||||
depend : descrip.mms
|
||||
descrip.mms : FORCE
|
||||
@ ! {- output_off() if $disabled{makedepend}; "" -}
|
||||
@ $(PERL) -pe "if (/^# DO NOT DELETE.*/) { exit(0); }" -
|
||||
< descrip.mms > descrip.mms-new
|
||||
@ OPEN/APPEND DESCRIP descrip.mms-new
|
||||
@ WRITE DESCRIP "# DO NOT DELETE THIS LINE -- make depend depends on it."
|
||||
{- join("\n\t", map { "\@ IF F\$SEARCH(\"$_\") .NES. \"\" THEN TYPE $_ /OUTPUT=DESCRIP:" } @deps); -}
|
||||
@ CLOSE DESCRIP
|
||||
@ PIPE ( $(PERL) -e "use File::Compare qw/compare_text/; my $x = compare_text(""descrip.mms"",""descrip.mms-new""); exit(0x10000000 + ($x == 0));" || -
|
||||
RENAME descrip.mms-new descrip.mms )
|
||||
@ IF F$SEARCH("descrip.mms-new") .NES. "" THEN DELETE descrip.mms-new;*
|
||||
-@ SPAWN/OUTPUT=NLA0: PURGE/NOLOG descrip.mms
|
||||
@ ! {- output_on() if $disabled{makedepend}; "" -}
|
||||
|
||||
# Install helper targets #############################################
|
||||
|
||||
install_sw : install_dev install_engines install_runtime -
|
||||
install_startup install_ivp
|
||||
|
||||
uninstall_sw : uninstall_dev uninstall_engines uninstall_runtime -
|
||||
uninstall_startup uninstall_ivp
|
||||
|
||||
install_docs : install_html_docs
|
||||
|
||||
uninstall_docs : uninstall_html_docs
|
||||
|
||||
install_ssldirs : check_INSTALLTOP
|
||||
- CREATE/DIR/PROT=(S:RWED,O:RWE,G:RE,W:RE) OSSL_DATAROOT:[000000]
|
||||
IF F$SEARCH("OSSL_DATAROOT:[000000]CERTS.DIR;1") .EQS. "" THEN -
|
||||
CREATE/DIR/PROT=(S:RWED,O:RWE,G:RE,W:RE) OSSL_DATAROOT:[CERTS]
|
||||
IF F$SEARCH("OSSL_DATAROOT:[000000]PRIVATE.DIR;1") .EQS. "" THEN -
|
||||
CREATE/DIR/PROT=(S:RWED,O:RWE,G,W) OSSL_DATAROOT:[PRIVATE]
|
||||
IF F$SEARCH("OSSL_DATAROOT:[000000]MISC.DIR;1") .EQS. "" THEN -
|
||||
CREATE/DIR/PROT=(S:RWED,O:RWE,G,W) OSSL_DATAROOT:[MISC]
|
||||
COPY/PROT=W:RE $(MISC_SCRIPTS) OSSL_DATAROOT:[MISC]
|
||||
@ ! Install configuration file
|
||||
COPY/PROT=W:R {- sourcefile("apps", "openssl-vms.cnf") -} -
|
||||
ossl_dataroot:[000000]openssl.cnf-dist
|
||||
IF F$SEARCH("OSSL_DATAROOT:[000000]openssl.cnf") .EQS. "" THEN -
|
||||
COPY/PROT=W:R {- sourcefile("apps", "openssl-vms.cnf") -} -
|
||||
ossl_dataroot:[000000]openssl.cnf
|
||||
|
||||
install_dev : check_INSTALLTOP install_runtime_libs
|
||||
@ WRITE SYS$OUTPUT "*** Installing development files"
|
||||
@ ! Install header files
|
||||
- CREATE/DIR ossl_installroot:[include.openssl]
|
||||
COPY/PROT=W:R openssl:*.h ossl_installroot:[include.openssl]
|
||||
@ ! Install static (development) libraries
|
||||
- CREATE/DIR ossl_installroot:[LIB.'arch']
|
||||
{- join("\n ",
|
||||
map { "COPY/PROT=W:R $_.OLB ossl_installroot:[LIB.'arch']" }
|
||||
@{$unified_info{install}->{libraries}}) -}
|
||||
|
||||
install_engines : check_INSTALLTOP install_runtime_libs build_engines
|
||||
@ {- output_off() unless scalar @{$unified_info{engines}}; "" -} !
|
||||
@ WRITE SYS$OUTPUT "*** Installing engines"
|
||||
- CREATE/DIR ossl_installroot:[ENGINES{- $sover.$target{pointer_size} -}.'arch']
|
||||
{- join("\n ",
|
||||
map { "COPY/PROT=W:RE $_.EXE ossl_installroot:[ENGINES$sover$target{pointer_size}.'arch']" }
|
||||
@{$unified_info{install}->{engines}}) -}
|
||||
@ {- output_on() unless scalar @{$unified_info{engines}}; "" -} !
|
||||
|
||||
install_runtime : install_programs
|
||||
|
||||
install_runtime_libs : check_INSTALLTOP build_libs
|
||||
@ {- output_off() if $disabled{shared}; "" -} !
|
||||
@ WRITE SYS$OUTPUT "*** Installing shareable images"
|
||||
@ ! Install shared (runtime) libraries
|
||||
- CREATE/DIR ossl_installroot:[LIB.'arch']
|
||||
{- join("\n ",
|
||||
map { "COPY/PROT=W:R $_.EXE ossl_installroot:[LIB.'arch']" }
|
||||
@install_shlibs) -}
|
||||
@ {- output_on() if $disabled{shared}; "" -} !
|
||||
|
||||
install_programs : check_INSTALLTOP install_runtime_libs build_programs
|
||||
@ {- output_off() if $disabled{apps}; "" -} !
|
||||
@ ! Install the main program
|
||||
- CREATE/DIR ossl_installroot:[EXE.'arch']
|
||||
COPY/PROT=W:RE [.APPS]openssl.EXE -
|
||||
ossl_installroot:[EXE.'arch']openssl{- $osslver -}.EXE
|
||||
@ ! Install scripts
|
||||
COPY/PROT=W:RE $(BIN_SCRIPTS) ossl_installroot:[EXE]
|
||||
@ ! {- output_on() if $disabled{apps}; "" -}
|
||||
|
||||
install_startup : [.VMS]openssl_startup.com [.VMS]openssl_shutdown.com -
|
||||
[.VMS]openssl_utils.com, check_INSTALLTOP
|
||||
- CREATE/DIR ossl_installroot:[SYS$STARTUP]
|
||||
COPY/PROT=W:RE [.VMS]openssl_startup.com -
|
||||
ossl_installroot:[SYS$STARTUP]openssl_startup{- $osslver -}.com
|
||||
COPY/PROT=W:RE [.VMS]openssl_shutdown.com -
|
||||
ossl_installroot:[SYS$STARTUP]openssl_shutdown{- $osslver -}.com
|
||||
COPY/PROT=W:RE [.VMS]openssl_utils.com -
|
||||
ossl_installroot:[SYS$STARTUP]openssl_utils{- $osslver -}.com
|
||||
|
||||
install_ivp : [.VMS]openssl_ivp.com check_INSTALLTOP
|
||||
- CREATE/DIR ossl_installroot:[SYSTEST]
|
||||
COPY/PROT=W:RE [.VMS]openssl_ivp.com -
|
||||
ossl_installroot:[SYSTEST]openssl_ivp{- $osslver -}.com
|
||||
|
||||
[.VMS]openssl_startup.com : vmsconfig.pm {- sourcefile("VMS", "openssl_startup.com.in") -}
|
||||
- CREATE/DIR [.VMS]
|
||||
$(PERL) "-I." "-Mvmsconfig" {- sourcefile("util", "dofile.pl") -} -
|
||||
{- sourcefile("VMS", "openssl_startup.com.in") -} -
|
||||
> [.VMS]openssl_startup.com
|
||||
|
||||
[.VMS]openssl_utils.com : vmsconfig.pm {- sourcefile("VMS", "openssl_utils.com.in") -}
|
||||
- CREATE/DIR [.VMS]
|
||||
$(PERL) "-I." "-Mvmsconfig" {- sourcefile("util", "dofile.pl") -} -
|
||||
{- sourcefile("VMS", "openssl_utils.com.in") -} -
|
||||
> [.VMS]openssl_utils.com
|
||||
|
||||
[.VMS]openssl_shutdown.com : vmsconfig.pm {- sourcefile("VMS", "openssl_shutdown.com.in") -}
|
||||
- CREATE/DIR [.VMS]
|
||||
$(PERL) "-I." "-Mvmsconfig" {- sourcefile("util", "dofile.pl") -} -
|
||||
{- sourcefile("VMS", "openssl_shutdown.com.in") -} -
|
||||
> [.VMS]openssl_shutdown.com
|
||||
|
||||
[.VMS]openssl_ivp.com : vmsconfig.pm {- sourcefile("VMS", "openssl_ivp.com.in") -}
|
||||
- CREATE/DIR [.VMS]
|
||||
$(PERL) "-I." "-Mvmsconfig" {- sourcefile("util", "dofile.pl") -} -
|
||||
{- sourcefile("VMS", "openssl_ivp.com.in") -} -
|
||||
> [.VMS]openssl_ivp.com
|
||||
|
||||
vmsconfig.pm : configdata.pm
|
||||
OPEN/WRITE/SHARE=READ CONFIG []vmsconfig.pm
|
||||
WRITE CONFIG "package vmsconfig;"
|
||||
WRITE CONFIG "use strict; use warnings;"
|
||||
WRITE CONFIG "use Exporter;"
|
||||
WRITE CONFIG "our @ISA = qw(Exporter);"
|
||||
WRITE CONFIG "our @EXPORT = qw(%config %target %withargs %unified_info %disabled);"
|
||||
WRITE CONFIG "our %config = ("
|
||||
WRITE CONFIG " target => '","{- $config{target} -}","',"
|
||||
WRITE CONFIG " version => '","{- $config{version} -}","',"
|
||||
WRITE CONFIG " shlib_major => '","{- $config{shlib_major} -}","',"
|
||||
WRITE CONFIG " shlib_minor => '","{- $config{shlib_minor} -}","',"
|
||||
WRITE CONFIG " no_shared => '","{- $disabled{shared} -}","',"
|
||||
WRITE CONFIG " INSTALLTOP => '$(INSTALLTOP)',"
|
||||
WRITE CONFIG " OPENSSLDIR => '$(OPENSSLDIR)',"
|
||||
WRITE CONFIG " pointer_size => '","{- $target{pointer_size} -}","',"
|
||||
WRITE CONFIG ");"
|
||||
WRITE CONFIG "our %target = ();"
|
||||
WRITE CONFIG "our %disabled = ();"
|
||||
WRITE CONFIG "our %withargs = ();"
|
||||
WRITE CONFIG "our %unified_info = ();"
|
||||
WRITE CONFIG "1;"
|
||||
CLOSE CONFIG
|
||||
|
||||
install_html_docs : check_INSTALLTOP
|
||||
sourcedir = F$PARSE("{- $sourcedir -}A.;","[]") - "]A.;" + ".DOC]"
|
||||
$(PERL) {- sourcefile("util", "process_docs.pl") -} -
|
||||
--sourcedir='sourcedir' --destdir=ossl_installroot:[HTML] -
|
||||
--type=html
|
||||
|
||||
check_INSTALLTOP :
|
||||
@ IF "$(INSTALLTOP)" .EQS. "" THEN -
|
||||
WRITE SYS$ERROR "INSTALLTOP should not be empty"
|
||||
@ IF "$(INSTALLTOP)" .EQS. "" THEN -
|
||||
EXIT %x10000002
|
||||
|
||||
# Helper targets #####################################################
|
||||
|
||||
# Developer targets ##################################################
|
||||
|
||||
debug_logicals :
|
||||
SH LOGICAL/PROC openssl,internal,ossl_installroot,ossl_dataroot
|
||||
|
||||
# Building targets ###################################################
|
||||
|
||||
configdata.pm : $(SRCDIR)Configure $(SRCDIR)config.com {- join(" ", @{$config{build_file_templates}}, @{$config{build_infos}}, @{$config{conf_files}}) -}
|
||||
@ WRITE SYS$OUTPUT "Reconfiguring..."
|
||||
perl $(SRCDIR)Configure reconf
|
||||
@ WRITE SYS$OUTPUT "*************************************************"
|
||||
@ WRITE SYS$OUTPUT "*** ***"
|
||||
@ WRITE SYS$OUTPUT "*** Please run the same mms command again ***"
|
||||
@ WRITE SYS$OUTPUT "*** ***"
|
||||
@ WRITE SYS$OUTPUT "*************************************************"
|
||||
@ PIPE ( EXIT %X10000000 )
|
||||
|
||||
{-
|
||||
use File::Basename;
|
||||
use File::Spec::Functions qw/abs2rel rel2abs catfile catdir/;
|
||||
|
||||
sub generatesrc {
|
||||
my %args = @_;
|
||||
my $generator = join(" ", @{$args{generator}});
|
||||
my $generator_incs = join("", map { ' "-I'.$_.'"' } @{$args{generator_incs}});
|
||||
my $deps = join(", -\n\t\t", @{$args{generator_deps}}, @{$args{deps}});
|
||||
|
||||
if ($args{src} !~ /\.[sS]$/) {
|
||||
if ($args{generator}->[0] =~ m|^.*\.in$|) {
|
||||
my $dofile = abs2rel(rel2abs(catfile($config{sourcedir},
|
||||
"util", "dofile.pl")),
|
||||
rel2abs($config{builddir}));
|
||||
return <<"EOF";
|
||||
$args{src} : $args{generator}->[0] $deps
|
||||
\$(PERL) "-I\$(BLDDIR)" "-Mconfigdata" $dofile \\
|
||||
"-o$target{build_file}" $generator > \$@
|
||||
EOF
|
||||
} else {
|
||||
return <<"EOF";
|
||||
$args{src} : $args{generator}->[0] $deps
|
||||
\$(PERL)$generator_incs $generator > \$@
|
||||
EOF
|
||||
}
|
||||
} else {
|
||||
die "No method to generate assembler source present.\n";
|
||||
}
|
||||
}
|
||||
|
||||
sub src2obj {
|
||||
my %args = @_;
|
||||
my $obj = $args{obj};
|
||||
my $deps = join(", -\n\t\t", @{$args{srcs}}, @{$args{deps}});
|
||||
|
||||
# Because VMS C isn't very good at combining a /INCLUDE path with
|
||||
# #includes having a relative directory (like '#include "../foo.h"),
|
||||
# the best choice is to move to the first source file's intended
|
||||
# directory before compiling, and make sure to write the object file
|
||||
# in the correct position (important when the object tree is other
|
||||
# than the source tree).
|
||||
my $forward = dirname($args{srcs}->[0]);
|
||||
my $backward = abs2rel(rel2abs("."), rel2abs($forward));
|
||||
my $objd = abs2rel(rel2abs(dirname($obj)), rel2abs($forward));
|
||||
my $objn = basename($obj);
|
||||
my $srcs =
|
||||
join(", ",
|
||||
map { abs2rel(rel2abs($_), rel2abs($forward)) } @{$args{srcs}});
|
||||
my $ecflags = { lib => '$(LIB_CFLAGS)',
|
||||
dso => '$(DSO_CFLAGS)',
|
||||
bin => '$(BIN_CFLAGS)' } -> {$args{intent}};
|
||||
my $incs_on = "\@ !";
|
||||
my $incs_off = "\@ !";
|
||||
my $incs = "";
|
||||
my @incs = ();
|
||||
push @incs, @{$args{incs}} if @{$args{incs}};
|
||||
unless ($disabled{zlib}) {
|
||||
# GNV$ZLIB_INCLUDE is the standard logical name for later zlib
|
||||
# incarnations.
|
||||
push @incs, ($withargs{zlib_include} || 'GNV$ZLIB_INCLUDE:');
|
||||
}
|
||||
if (@incs) {
|
||||
$incs_on =
|
||||
"DEFINE tmp_includes "
|
||||
.join(",-\n\t\t\t", map {
|
||||
file_name_is_absolute($_)
|
||||
? $_ : catdir($backward,$_)
|
||||
} @incs);
|
||||
$incs_off = "DEASSIGN tmp_includes";
|
||||
$incs = " /INCLUDE=(tmp_includes:)";
|
||||
}
|
||||
my $before = $unified_info{before}->{$obj.".OBJ"} || "\@ !";
|
||||
my $after = $unified_info{after}->{$obj.".OBJ"} || "\@ !";
|
||||
my $depbuild = $disabled{makedepend} ? ""
|
||||
: " /MMS=(FILE=${objd}${objn}.tmp-D,TARGET=$obj.OBJ)";
|
||||
|
||||
return <<"EOF";
|
||||
$obj.OBJ : $deps
|
||||
${before}
|
||||
SET DEFAULT $forward
|
||||
$incs_on
|
||||
\$(CC) \$(CFLAGS)${ecflags}${incs}${depbuild} /OBJECT=${objd}${objn}.OBJ /REPOSITORY=$backward $srcs
|
||||
$incs_off
|
||||
SET DEFAULT $backward
|
||||
${after}
|
||||
\@ PIPE ( \$(PERL) -e "use File::Compare qw/compare_text/; my \$x = compare_text(""$obj.D"",""$obj.tmp-D""); exit(0x10000000 + (\$x == 0));" || -
|
||||
RENAME $obj.tmp-D $obj.d )
|
||||
\@ IF F\$SEARCH("$obj.tmp-D") .NES. "" THEN DELETE $obj.tmp-D;*
|
||||
- PURGE $obj.OBJ
|
||||
EOF
|
||||
}
|
||||
sub libobj2shlib {
|
||||
my %args = @_;
|
||||
my $lib = $args{lib};
|
||||
my $shlib = $args{shlib};
|
||||
my $libd = dirname($lib);
|
||||
my $libn = basename($lib);
|
||||
(my $mkdef_key = $libn) =~ s/^${osslprefix_q}lib([^0-9]*)\d*/$1/i;
|
||||
my @deps = map {
|
||||
$disabled{shared} ? $_.".OLB"
|
||||
: $unified_info{sharednames}->{$_}.".EXE"; } @{$args{deps}};
|
||||
my $deps = join(", -\n\t\t", @deps);
|
||||
my $shlib_target = $disabled{shared} ? "" : $target{shared_target};
|
||||
my $ordinalsfile = defined($args{ordinals}) ? $args{ordinals}->[1] : "";
|
||||
my $engine_opt = abs2rel(rel2abs(catfile($config{sourcedir},
|
||||
"VMS", "engine.opt")),
|
||||
rel2abs($config{builddir}));
|
||||
my $mkdef_pl = abs2rel(rel2abs(catfile($config{sourcedir},
|
||||
"util", "mkdef.pl")),
|
||||
rel2abs($config{builddir}));
|
||||
my $translatesyms_pl = abs2rel(rel2abs(catfile($config{sourcedir},
|
||||
"VMS", "translatesyms.pl")),
|
||||
rel2abs($config{builddir}));
|
||||
# The "[]" hack is because in .OPT files, each line inherits the
|
||||
# previous line's file spec as default, so if no directory spec
|
||||
# is present in the current line and the previous line has one that
|
||||
# doesn't apply, you're in for a surprise.
|
||||
my $write_opt =
|
||||
join("\n\t", map { my $x = $_ =~ /\[/ ? $_ : "[]".$_;
|
||||
$x =~ s|(\.EXE)|$1/SHARE|;
|
||||
$x =~ s|(\.OLB)|$1/LIB|;
|
||||
"WRITE OPT_FILE \"$x\"" } @deps)
|
||||
|| "\@ !";
|
||||
return <<"EOF";
|
||||
$shlib.EXE : $lib.OLB $deps $ordinalsfile
|
||||
\$(PERL) $mkdef_pl "$mkdef_key" "VMS" > $shlib.SYMVEC-tmp
|
||||
\$(PERL) $translatesyms_pl \$(BLDDIR)CXX\$DEMANGLER_DB. < $shlib.SYMVEC-tmp > $shlib.SYMVEC
|
||||
DELETE $shlib.SYMVEC-tmp;*
|
||||
OPEN/WRITE/SHARE=READ OPT_FILE $shlib.OPT
|
||||
WRITE OPT_FILE "IDENTIFICATION=""V$config{version}"""
|
||||
TYPE $shlib.SYMVEC /OUTPUT=OPT_FILE:
|
||||
WRITE OPT_FILE "$lib.OLB/LIBRARY"
|
||||
$write_opt
|
||||
CLOSE OPT_FILE
|
||||
LINK /MAP=$shlib.MAP /FULL/SHARE=$shlib.EXE $shlib.OPT/OPT \$(EX_LIBS)
|
||||
DELETE $shlib.SYMVEC;*
|
||||
PURGE $shlib.EXE,$shlib.OPT,$shlib.MAP
|
||||
EOF
|
||||
}
|
||||
sub obj2dso {
|
||||
my %args = @_;
|
||||
my $lib = $args{lib};
|
||||
my $libd = dirname($lib);
|
||||
my $libn = basename($lib);
|
||||
(my $libn_nolib = $libn) =~ s/^lib//;
|
||||
my @objs = map { "$_.OBJ" } @{$args{objs}};
|
||||
my @deps = map {
|
||||
$disabled{shared} ? $_.".OLB"
|
||||
: $unified_info{sharednames}->{$_}.".EXE"; } @{$args{deps}};
|
||||
my $deps = join(", -\n\t\t", @objs, @deps);
|
||||
my $shlib_target = $disabled{shared} ? "" : $target{shared_target};
|
||||
my $engine_opt = abs2rel(rel2abs(catfile($config{sourcedir},
|
||||
"VMS", "engine.opt")),
|
||||
rel2abs($config{builddir}));
|
||||
# The "[]" hack is because in .OPT files, each line inherits the
|
||||
# previous line's file spec as default, so if no directory spec
|
||||
# is present in the current line and the previous line has one that
|
||||
# doesn't apply, you're in for a surprise.
|
||||
my $write_opt1 =
|
||||
join(",-\"\n\t", map { my $x = $_ =~ /\[/ ? $_ : "[]".$_;
|
||||
"WRITE OPT_FILE \"$x" } @objs).
|
||||
"\"";
|
||||
my $write_opt2 =
|
||||
join("\n\t", map { my $x = $_ =~ /\[/ ? $_ : "[]".$_;
|
||||
$x =~ s|(\.EXE)|$1/SHARE|;
|
||||
$x =~ s|(\.OLB)|$1/LIB|;
|
||||
"WRITE OPT_FILE \"$x\"" } @deps)
|
||||
|| "\@ !";
|
||||
return <<"EOF";
|
||||
$lib.EXE : $deps
|
||||
OPEN/WRITE/SHARE=READ OPT_FILE $lib.OPT
|
||||
TYPE $engine_opt /OUTPUT=OPT_FILE:
|
||||
$write_opt1
|
||||
$write_opt2
|
||||
CLOSE OPT_FILE
|
||||
LINK /MAP=$lib.MAP /FULL/SHARE=$lib.EXE $lib.OPT/OPT \$(EX_LIBS)
|
||||
- PURGE $lib.EXE,$lib.OPT,$lib.MAP
|
||||
EOF
|
||||
}
|
||||
sub obj2lib {
|
||||
my %args = @_;
|
||||
my $lib = $args{lib};
|
||||
my $objs = join(", -\n\t\t", map { $_.".OBJ" } (@{$args{objs}}));
|
||||
my $fill_lib = join("\n\t", (map { "LIBRARY/REPLACE $lib.OLB $_.OBJ" }
|
||||
@{$args{objs}}));
|
||||
return <<"EOF";
|
||||
$lib.OLB : $objs
|
||||
LIBRARY/CREATE/OBJECT $lib.OLB
|
||||
$fill_lib
|
||||
- PURGE $lib.OLB
|
||||
EOF
|
||||
}
|
||||
sub obj2bin {
|
||||
my %args = @_;
|
||||
my $bin = $args{bin};
|
||||
my $bind = dirname($bin);
|
||||
my $binn = basename($bin);
|
||||
my @objs = map { "$_.OBJ" } @{$args{objs}};
|
||||
my @deps = map {
|
||||
$disabled{shared} ? $_.".OLB"
|
||||
: $unified_info{sharednames}->{$_}.".EXE"; } @{$args{deps}};
|
||||
my $deps = join(", -\n\t\t", @objs, @deps);
|
||||
# The "[]" hack is because in .OPT files, each line inherits the
|
||||
# previous line's file spec as default, so if no directory spec
|
||||
# is present in the current line and the previous line has one that
|
||||
# doesn't apply, you're in for a surprise.
|
||||
my $write_opt1 =
|
||||
join(",-\"\n\t", map { my $x = $_ =~ /\[/ ? $_ : "[]".$_;
|
||||
"WRITE OPT_FILE \"$x" } @objs).
|
||||
"\"";
|
||||
my $write_opt2 =
|
||||
join("\n\t", map { my $x = $_ =~ /\[/ ? $_ : "[]".$_;
|
||||
$x =~ s|(\.EXE)|$1/SHARE|;
|
||||
$x =~ s|(\.OLB)|$1/LIB|;
|
||||
"WRITE OPT_FILE \"$x\"" } @deps)
|
||||
|| "\@ !";
|
||||
return <<"EOF";
|
||||
$bin.EXE : $deps
|
||||
OPEN/WRITE/SHARE=READ OPT_FILE $bin.OPT
|
||||
$write_opt1
|
||||
$write_opt2
|
||||
CLOSE OPT_FILE
|
||||
LINK/EXEC=$bin.EXE \$(LDFLAGS) $bin.OPT/OPT \$(EX_LIBS)
|
||||
- PURGE $bin.EXE,$bin.OPT
|
||||
EOF
|
||||
}
|
||||
sub in2script {
|
||||
my %args = @_;
|
||||
my $script = $args{script};
|
||||
return "" if grep { $_ eq $script } @{$args{sources}}; # No overwrite!
|
||||
my $sources = join(" ", @{$args{sources}});
|
||||
my $dofile = abs2rel(rel2abs(catfile($config{sourcedir},
|
||||
"util", "dofile.pl")),
|
||||
rel2abs($config{builddir}));
|
||||
return <<"EOF";
|
||||
$script : $sources
|
||||
\$(PERL) "-I\$(BLDDIR)" "-Mconfigdata" $dofile -
|
||||
"-o$target{build_file}" $sources > $script
|
||||
SET FILE/PROT=(S:RWED,O:RWED,G:RE,W:RE) $script
|
||||
PURGE $script
|
||||
EOF
|
||||
}
|
||||
"" # Important! This becomes part of the template result.
|
||||
-}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,22 +0,0 @@
|
||||
#! /usr/bin/perl
|
||||
|
||||
use Config;
|
||||
|
||||
# Check that the perl implementation file modules generate paths that
|
||||
# we expect for the platform
|
||||
use File::Spec::Functions qw(:DEFAULT rel2abs);
|
||||
|
||||
if (rel2abs('.') !~ m|/|) {
|
||||
die <<EOF;
|
||||
|
||||
******************************************************************************
|
||||
This perl implementation doesn't produce Unix like paths (with forward slash
|
||||
directory separators). Please use an implementation that matches your
|
||||
building platform.
|
||||
|
||||
This Perl version: $Config{version} for $Config{archname}
|
||||
******************************************************************************
|
||||
EOF
|
||||
}
|
||||
|
||||
1;
|
||||
@@ -1,22 +0,0 @@
|
||||
#! /usr/bin/perl
|
||||
|
||||
use Config;
|
||||
|
||||
# Check that the perl implementation file modules generate paths that
|
||||
# we expect for the platform
|
||||
use File::Spec::Functions qw(:DEFAULT rel2abs);
|
||||
|
||||
if (!$ENV{CONFIGURE_INSIST} && rel2abs('.') !~ m|\\|) {
|
||||
die <<EOF;
|
||||
|
||||
******************************************************************************
|
||||
This perl implementation doesn't produce Windows like paths (with backward
|
||||
slash directory separators). Please use an implementation that matches your
|
||||
building platform.
|
||||
|
||||
This Perl version: $Config{version} for $Config{archname}
|
||||
******************************************************************************
|
||||
EOF
|
||||
}
|
||||
|
||||
1;
|
||||
@@ -1,628 +0,0 @@
|
||||
##
|
||||
## Makefile for OpenSSL
|
||||
##
|
||||
## {- join("\n## ", @autowarntext) -}
|
||||
{-
|
||||
our $objext = $target{obj_extension} || ".obj";
|
||||
our $depext = $target{dep_extension} || ".d";
|
||||
our $exeext = $target{exe_extension} || ".exe";
|
||||
our $libext = $target{lib_extension} || ".lib";
|
||||
our $shlibext = $target{shared_extension} || ".dll";
|
||||
our $shlibextimport = $target{shared_import_extension} || ".lib";
|
||||
our $dsoext = $target{dso_extension} || ".dll";
|
||||
|
||||
our $sover = $config{shlib_major}."_".$config{shlib_minor};
|
||||
|
||||
my $win_installenv =
|
||||
$target{build_scheme}->[2] eq "VC-W32" ?
|
||||
"ProgramFiles(x86)" : "ProgramW6432";
|
||||
my $win_commonenv =
|
||||
$target{build_scheme}->[2] eq "VC-W32"
|
||||
? "CommonProgramFiles(x86)" : "CommonProgramW6432";
|
||||
our $win_installroot =
|
||||
defined($ENV{$win_installenv})
|
||||
? $win_installenv : 'ProgramFiles';
|
||||
our $win_commonroot =
|
||||
defined($ENV{$win_commonenv})
|
||||
? $win_commonenv : 'CommonProgramFiles';
|
||||
|
||||
# expand variables early
|
||||
$win_installroot = $ENV{$win_installroot};
|
||||
$win_commonroot = $ENV{$win_commonroot};
|
||||
|
||||
sub shlib {
|
||||
return () if $disabled{shared};
|
||||
my $lib = shift;
|
||||
return $unified_info{sharednames}->{$lib} . $shlibext;
|
||||
}
|
||||
|
||||
sub shlib_import {
|
||||
return () if $disabled{shared};
|
||||
my $lib = shift;
|
||||
return $lib . $shlibextimport;
|
||||
}
|
||||
|
||||
sub dso {
|
||||
my $dso = shift;
|
||||
|
||||
return $dso . $dsoext;
|
||||
}
|
||||
# This makes sure things get built in the order they need
|
||||
# to. You're welcome.
|
||||
sub dependmagic {
|
||||
my $target = shift;
|
||||
|
||||
return "$target: build_generated\n\t\$(MAKE) depend && \$(MAKE) _$target\n_$target";
|
||||
}
|
||||
'';
|
||||
-}
|
||||
|
||||
PLATFORM={- $config{target} -}
|
||||
SRCDIR={- $config{sourcedir} -}
|
||||
BLDDIR={- $config{builddir} -}
|
||||
|
||||
VERSION={- $config{version} -}
|
||||
MAJOR={- $config{major} -}
|
||||
MINOR={- $config{minor} -}
|
||||
|
||||
SHLIB_VERSION_NUMBER={- $config{shlib_version_number} -}
|
||||
|
||||
LIBS={- join(" ", map { $_.$libext } @{$unified_info{libraries}}) -}
|
||||
SHLIBS={- join(" ", map { shlib($_) } @{$unified_info{libraries}}) -}
|
||||
SHLIBPDBS={- join(" ", map { local $shlibext = ".pdb"; shlib($_) } @{$unified_info{libraries}}) -}
|
||||
ENGINES={- join(" ", map { dso($_) } @{$unified_info{engines}}) -}
|
||||
ENGINEPDBS={- join(" ", map { local $dsoext = ".pdb"; dso($_) } @{$unified_info{engines}}) -}
|
||||
PROGRAMS={- our @PROGRAMS = map { $_.$exeext } @{$unified_info{programs}}; join(" ", @PROGRAMS) -}
|
||||
PROGRAMPDBS={- join(" ", map { $_.".pdb" } @{$unified_info{programs}}) -}
|
||||
SCRIPTS={- join(" ", @{$unified_info{scripts}}) -}
|
||||
{- output_off() if $disabled{makedepend}; "" -}
|
||||
DEPS={- join(" ", map { (my $x = $_) =~ s|\.o$|$depext|; $x; }
|
||||
grep { $unified_info{sources}->{$_}->[0] =~ /\.c$/ }
|
||||
keys %{$unified_info{sources}}); -}
|
||||
{- output_on() if $disabled{makedepend}; "" -}
|
||||
GENERATED_MANDATORY={- join(" ", @{$unified_info{depends}->{""}} ) -}
|
||||
GENERATED={- join(" ",
|
||||
( map { (my $x = $_) =~ s|\.[sS]$|\.asm|; $x }
|
||||
grep { defined $unified_info{generate}->{$_} }
|
||||
map { @{$unified_info{sources}->{$_}} }
|
||||
grep { /\.o$/ } keys %{$unified_info{sources}} ),
|
||||
( grep { /\.h$/ } keys %{$unified_info{generate}} )) -}
|
||||
|
||||
INSTALL_LIBS={- join(" ", map { quotify1($_.$libext) } @{$unified_info{install}->{libraries}}) -}
|
||||
INSTALL_SHLIBS={- join(" ", map { quotify_l(shlib($_)) } @{$unified_info{install}->{libraries}}) -}
|
||||
INSTALL_SHLIBPDBS={- join(" ", map { local $shlibext = ".pdb"; quotify_l(shlib($_)) } @{$unified_info{install}->{libraries}}) -}
|
||||
INSTALL_ENGINES={- join(" ", map { quotify1(dso($_)) } @{$unified_info{install}->{engines}}) -}
|
||||
INSTALL_ENGINEPDBS={- join(" ", map { local $dsoext = ".pdb"; quotify1(dso($_)) } @{$unified_info{install}->{engines}}) -}
|
||||
INSTALL_PROGRAMS={- join(" ", map { quotify1($_.$exeext) } grep { !m|^test\\| } @{$unified_info{install}->{programs}}) -}
|
||||
INSTALL_PROGRAMPDBS={- join(" ", map { quotify1($_.".pdb") } grep { !m|^test\\| } @{$unified_info{install}->{programs}}) -}
|
||||
{- output_off() if $disabled{apps}; "" -}
|
||||
BIN_SCRIPTS="$(BLDDIR)\tools\c_rehash.pl"
|
||||
MISC_SCRIPTS="$(BLDDIR)\apps\CA.pl" "$(BLDDIR)\apps\tsget.pl"
|
||||
{- output_on() if $disabled{apps}; "" -}
|
||||
|
||||
APPS_OPENSSL={- use File::Spec::Functions;
|
||||
"\"".catfile("apps","openssl")."\"" -}
|
||||
|
||||
# Do not edit these manually. Use Configure with --prefix or --openssldir
|
||||
# to change this! Short explanation in the top comment in Configure
|
||||
INSTALLTOP_dev={- # $prefix is used in the OPENSSLDIR perl snippet
|
||||
#
|
||||
use File::Spec::Functions qw(:DEFAULT splitpath);
|
||||
our $prefix = canonpath($config{prefix}
|
||||
|| "$win_installroot\\OpenSSL");
|
||||
our ($prefix_dev, $prefix_dir, $prefix_file) =
|
||||
splitpath($prefix, 1);
|
||||
$prefix_dev -}
|
||||
INSTALLTOP_dir={- canonpath($prefix_dir) -}
|
||||
OPENSSLDIR_dev={- #
|
||||
# The logic here is that if no --openssldir was given,
|
||||
# OPENSSLDIR will get the value from $prefix plus "/ssl".
|
||||
# If --openssldir was given and the value is an absolute
|
||||
# path, OPENSSLDIR will get its value without change.
|
||||
# If the value from --openssldir is a relative path,
|
||||
# OPENSSLDIR will get $prefix with the --openssldir
|
||||
# value appended as a subdirectory.
|
||||
#
|
||||
use File::Spec::Functions qw(:DEFAULT splitpath);
|
||||
our $openssldir =
|
||||
$config{openssldir} ?
|
||||
(file_name_is_absolute($config{openssldir}) ?
|
||||
canonpath($config{openssldir})
|
||||
: catdir($prefix, $config{openssldir}))
|
||||
: canonpath("$win_commonroot\\SSL");
|
||||
our ($openssldir_dev, $openssldir_dir, $openssldir_file) =
|
||||
splitpath($openssldir, 1);
|
||||
$openssldir_dev -}
|
||||
OPENSSLDIR_dir={- canonpath($openssldir_dir) -}
|
||||
LIBDIR={- our $libdir = $config{libdir} || "lib";
|
||||
$libdir -}
|
||||
ENGINESDIR_dev={- use File::Spec::Functions qw(:DEFAULT splitpath);
|
||||
our $enginesdir = catdir($prefix,$libdir,"engines-$sover");
|
||||
our ($enginesdir_dev, $enginesdir_dir, $enginesdir_file) =
|
||||
splitpath($enginesdir, 1);
|
||||
$enginesdir_dev -}
|
||||
ENGINESDIR_dir={- canonpath($enginesdir_dir) -}
|
||||
!IF "$(DESTDIR)" != ""
|
||||
INSTALLTOP=$(DESTDIR)$(INSTALLTOP_dir)
|
||||
OPENSSLDIR=$(DESTDIR)$(OPENSSLDIR_dir)
|
||||
ENGINESDIR=$(DESTDIR)$(ENGINESDIR_dir)
|
||||
!ELSE
|
||||
INSTALLTOP=$(INSTALLTOP_dev)$(INSTALLTOP_dir)
|
||||
OPENSSLDIR=$(OPENSSLDIR_dev)$(OPENSSLDIR_dir)
|
||||
ENGINESDIR=$(ENGINESDIR_dev)$(ENGINESDIR_dir)
|
||||
!ENDIF
|
||||
|
||||
CC={- $target{cc} -}
|
||||
CFLAGS={- join(" ",(map { "-D".$_} @{$target{defines}}, @{$config{defines}})) -} {- join(" ", quotify_l("-DENGINESDIR=\"$enginesdir\"", "-DOPENSSLDIR=\"$openssldir\"")) -} {- $target{cflags} -} {- $config{cflags} -}
|
||||
COUTFLAG={- $target{coutflag} || "/Fo" -}$(OSSL_EMPTY)
|
||||
RC={- $target{rc} || "rc" -}
|
||||
RCOUTFLAG={- $target{rcoutflag} || "/fo" -}$(OSSL_EMPTY)
|
||||
LD={- $target{ld} || "link" -}
|
||||
LDFLAGS={- $target{lflags} -}
|
||||
LDOUTFLAG={- $target{loutflag} || "/out:" -}$(OSSL_EMPTY)
|
||||
EX_LIBS={- $target{ex_libs} -}
|
||||
LIB_CFLAGS={- join(" ", $target{lib_cflags}, $target{shared_cflag}) || "" -}
|
||||
LIB_LDFLAGS={- $target{shared_ldflag} || "" -}
|
||||
DSO_CFLAGS={- join(" ", $target{dso_cflags}, $target{shared_cflag}) || "" -}
|
||||
DSO_LDFLAGS={- join(" ", $target{dso_lflags}, $target{shared_ldflag}) || "" -}
|
||||
BIN_CFLAGS={- $target{bin_cflags} -}
|
||||
BIN_LDFLAGS={- $target{bin_lflags} -}
|
||||
|
||||
PERL={- $config{perl} -}
|
||||
|
||||
AR={- $target{ar} -}
|
||||
ARFLAGS= {- $target{arflags} -}
|
||||
AROUTFLAG={- $target{aroutflag} || "/out:" -}$(OSSL_EMPTY)
|
||||
|
||||
MT={- $target{mt} -}
|
||||
MTFLAGS= {- $target{mtflags} -}
|
||||
MTINFLAG={- $target{mtinflag} || "-manifest " -}$(OSSL_EMPTY)
|
||||
MTOUTFLAG={- $target{mtoutflag} || "-outputresource:" -}$(OSSL_EMPTY)
|
||||
|
||||
AS={- $target{as} -}
|
||||
ASFLAGS={- $target{asflags} -}
|
||||
ASOUTFLAG={- $target{asoutflag} -}$(OSSL_EMPTY)
|
||||
|
||||
ECHO="$(PERL)" "$(SRCDIR)\util\echo.pl"
|
||||
|
||||
PERLASM_SCHEME= {- $target{perlasm_scheme} -}
|
||||
|
||||
PROCESSOR= {- $config{processor} -}
|
||||
|
||||
# The main targets ###################################################
|
||||
|
||||
{- dependmagic('all'); -}: build_libs_nodep build_engines_nodep build_programs_nodep
|
||||
{- dependmagic('build_libs'); -}: build_libs_nodep
|
||||
{- dependmagic('build_engines'); -}: build_engines_nodep
|
||||
{- dependmagic('build_programs'); -}: build_programs_nodep
|
||||
|
||||
build_generated: $(GENERATED_MANDATORY)
|
||||
build_libs_nodep: $(LIBS) {- join(" ",map { shlib_import($_) } @{$unified_info{libraries}}) -}
|
||||
build_engines_nodep: $(ENGINES)
|
||||
build_programs_nodep: $(PROGRAMS) $(SCRIPTS)
|
||||
|
||||
# Kept around for backward compatibility
|
||||
build_apps build_tests: build_programs
|
||||
|
||||
# Convenience target to prebuild all generated files, not just the mandatory
|
||||
# ones
|
||||
build_all_generated: $(GENERATED_MANDATORY) $(GENERATED)
|
||||
|
||||
test: tests
|
||||
{- dependmagic('tests'); -}: build_programs_nodep build_engines_nodep
|
||||
@{- output_off() if $disabled{tests}; "" -}
|
||||
-mkdir $(BLDDIR)\test\test-runs
|
||||
set SRCTOP=$(SRCDIR)
|
||||
set BLDTOP=$(BLDDIR)
|
||||
set RESULT_D=$(BLDDIR)\test\test-runs
|
||||
set PERL=$(PERL)
|
||||
set OPENSSL_ENGINES=$(MAKEDIR)\engines
|
||||
set OPENSSL_DEBUG_MEMORY=on
|
||||
"$(PERL)" "$(SRCDIR)\test\run_tests.pl" $(TESTS)
|
||||
@{- if ($disabled{tests}) { output_on(); } else { output_off(); } "" -}
|
||||
@$(ECHO) "Tests are not supported with your chosen Configure options"
|
||||
@{- output_on() if !$disabled{tests}; "" -}
|
||||
|
||||
list-tests:
|
||||
@{- output_off() if $disabled{tests}; "" -}
|
||||
@set SRCTOP=$(SRCDIR)
|
||||
@"$(PERL)" "$(SRCDIR)\test\run_tests.pl" list
|
||||
@{- if ($disabled{tests}) { output_on(); } else { output_off(); } "" -}
|
||||
@$(ECHO) "Tests are not supported with your chosen Configure options"
|
||||
@{- output_on() if !$disabled{tests}; "" -}
|
||||
|
||||
install: install_sw install_ssldirs install_docs
|
||||
|
||||
uninstall: uninstall_docs uninstall_sw
|
||||
|
||||
libclean:
|
||||
"$(PERL)" -e "map { m/(.*)\.dll$$/; unlink glob """$$1.*"""; } @ARGV" $(SHLIBS)
|
||||
"$(PERL)" -e "map { m/(.*)\.dll$$/; unlink glob """apps/$$1.*"""; } @ARGV" $(SHLIBS)
|
||||
"$(PERL)" -e "map { m/(.*)\.dll$$/; unlink glob """test/$$1.*"""; } @ARGV" $(SHLIBS)
|
||||
"$(PERL)" -e "map { m/(.*)\.dll$$/; unlink glob """fuzz/$$1.*"""; } @ARGV" $(SHLIBS)
|
||||
-del /Q /F $(LIBS)
|
||||
-del /Q ossl_static.pdb
|
||||
|
||||
clean: libclean
|
||||
{- join("\n\t", map { "-del /Q /F $_" } @PROGRAMS) -}
|
||||
-del /Q /F $(ENGINES)
|
||||
-del /Q /F $(SCRIPTS)
|
||||
-del /Q /F $(GENERATED)
|
||||
-del /Q /S /F *.d
|
||||
-del /Q /S /F *.obj
|
||||
-del /Q /S /F *.pdb
|
||||
-del /Q /S /F *.exp
|
||||
-del /Q /S /F engines\*.ilk
|
||||
-del /Q /S /F engines\*.lib
|
||||
-del /Q /S /F apps\*.lib
|
||||
-del /Q /S /F engines\*.manifest
|
||||
-del /Q /S /F apps\*.manifest
|
||||
-del /Q /S /F test\*.manifest
|
||||
|
||||
distclean: clean
|
||||
-del /Q /F configdata.pm
|
||||
-del /Q /F makefile
|
||||
|
||||
depend:
|
||||
|
||||
# Install helper targets #############################################
|
||||
|
||||
install_sw: install_dev install_engines install_runtime
|
||||
|
||||
uninstall_sw: uninstall_runtime uninstall_engines uninstall_dev
|
||||
|
||||
install_docs: install_html_docs
|
||||
|
||||
uninstall_docs: uninstall_html_docs
|
||||
|
||||
install_ssldirs:
|
||||
@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(OPENSSLDIR)\certs"
|
||||
@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(OPENSSLDIR)\private"
|
||||
@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(OPENSSLDIR)\misc"
|
||||
@"$(PERL)" "$(SRCDIR)\util\copy.pl" "$(SRCDIR)\apps\openssl.cnf" \
|
||||
"$(OPENSSLDIR)\openssl.cnf.dist"
|
||||
@IF NOT EXIST "$(OPENSSLDIR)\openssl.cnf" \
|
||||
"$(PERL)" "$(SRCDIR)\util\copy.pl" "$(SRCDIR)\apps\openssl.cnf" \
|
||||
"$(OPENSSLDIR)\openssl.cnf"
|
||||
@"$(PERL)" "$(SRCDIR)\util\copy.pl" $(MISC_SCRIPTS) \
|
||||
"$(OPENSSLDIR)\misc"
|
||||
|
||||
install_dev: install_runtime_libs
|
||||
@if "$(INSTALLTOP)"=="" ( $(ECHO) "INSTALLTOP should not be empty" & exit 1 )
|
||||
@$(ECHO) "*** Installing development files"
|
||||
@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(INSTALLTOP)\include\openssl"
|
||||
@{- output_off() unless grep { $_ eq "OPENSSL_USE_APPLINK" } @{$target{defines}}; "" -}
|
||||
@"$(PERL)" "$(SRCDIR)\util\copy.pl" "$(SRCDIR)\ms\applink.c" \
|
||||
"$(INSTALLTOP)\include\openssl"
|
||||
@{- output_on() unless grep { $_ eq "OPENSSL_USE_APPLINK" } @{$target{defines}}; "" -}
|
||||
@"$(PERL)" "$(SRCDIR)\util\copy.pl" "-exclude_re=/__DECC_" \
|
||||
"$(SRCDIR)\include\openssl\*.h" \
|
||||
"$(INSTALLTOP)\include\openssl"
|
||||
@"$(PERL)" "$(SRCDIR)\util\copy.pl" "$(BLDDIR)\include\openssl\*.h" \
|
||||
"$(INSTALLTOP)\include\openssl"
|
||||
@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(INSTALLTOP)\$(LIBDIR)"
|
||||
@"$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_LIBS) \
|
||||
"$(INSTALLTOP)\$(LIBDIR)"
|
||||
@if "$(SHLIBS)"=="" \
|
||||
"$(PERL)" "$(SRCDIR)\util\copy.pl" ossl_static.pdb \
|
||||
"$(INSTALLTOP)\$(LIBDIR)"
|
||||
|
||||
uninstall_dev:
|
||||
|
||||
install_engines: install_runtime_libs build_engines
|
||||
@if "$(INSTALLTOP)"=="" ( $(ECHO) "INSTALLTOP should not be empty" & exit 1 )
|
||||
@$(ECHO) "*** Installing engines"
|
||||
@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(ENGINESDIR)"
|
||||
@if not "$(ENGINES)"=="" \
|
||||
"$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_ENGINES) "$(ENGINESDIR)"
|
||||
@if not "$(ENGINES)"=="" \
|
||||
"$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_ENGINEPDBS) "$(ENGINESDIR)"
|
||||
|
||||
uninstall_engines:
|
||||
|
||||
install_runtime: install_programs
|
||||
|
||||
install_runtime_libs: build_libs
|
||||
@if "$(INSTALLTOP)"=="" ( $(ECHO) "INSTALLTOP should not be empty" & exit 1 )
|
||||
@$(ECHO) "*** Installing runtime libraries"
|
||||
@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(INSTALLTOP)\bin"
|
||||
@if not "$(SHLIBS)"=="" \
|
||||
"$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_SHLIBS) "$(INSTALLTOP)\bin"
|
||||
@if not "$(SHLIBS)"=="" \
|
||||
"$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_SHLIBPDBS) \
|
||||
"$(INSTALLTOP)\bin"
|
||||
|
||||
install_programs: install_runtime_libs build_programs
|
||||
@if "$(INSTALLTOP)"=="" ( $(ECHO) "INSTALLTOP should not be empty" & exit 1 )
|
||||
@$(ECHO) "*** Installing runtime programs"
|
||||
@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(INSTALLTOP)\bin"
|
||||
@"$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_PROGRAMS) \
|
||||
"$(INSTALLTOP)\bin"
|
||||
@"$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_PROGRAMPDBS) \
|
||||
"$(INSTALLTOP)\bin"
|
||||
@"$(PERL)" "$(SRCDIR)\util\copy.pl" $(BIN_SCRIPTS) \
|
||||
"$(INSTALLTOP)\bin"
|
||||
|
||||
uninstall_runtime:
|
||||
|
||||
install_html_docs:
|
||||
"$(PERL)" "$(SRCDIR)\util\process_docs.pl" \
|
||||
"--destdir=$(INSTALLTOP)\html" --type=html
|
||||
|
||||
uninstall_html_docs:
|
||||
|
||||
# Building targets ###################################################
|
||||
|
||||
configdata.pm: "$(SRCDIR)\Configure" {- join(" ", map { '"'.$_.'"' } @{$config{build_file_templates}}, @{$config{build_infos}}, @{$config{conf_files}}) -}
|
||||
@$(ECHO) "Detected changed: $?"
|
||||
@$(ECHO) "Reconfiguring..."
|
||||
"$(PERL)" "$(SRCDIR)\Configure" reconf
|
||||
@$(ECHO) "**************************************************"
|
||||
@$(ECHO) "*** ***"
|
||||
@$(ECHO) "*** Please run the same make command again ***"
|
||||
@$(ECHO) "*** ***"
|
||||
@$(ECHO) "**************************************************"
|
||||
@exit 1
|
||||
|
||||
{-
|
||||
use File::Basename;
|
||||
use File::Spec::Functions qw/:DEFAULT abs2rel rel2abs/;
|
||||
|
||||
# Helper function to figure out dependencies on libraries
|
||||
# It takes a list of library names and outputs a list of dependencies
|
||||
sub compute_lib_depends {
|
||||
if ($disabled{shared}) {
|
||||
return map { $_.$libext } @_;
|
||||
}
|
||||
return map { shlib_import($_) } @_;
|
||||
}
|
||||
|
||||
sub generatesrc {
|
||||
my %args = @_;
|
||||
(my $target = $args{src}) =~ s/\.[sS]$/.asm/;
|
||||
my ($gen0, @gens) = @{$args{generator}};
|
||||
my $generator = '"'.$gen0.'"'.join('', map { " $_" } @gens);
|
||||
my $generator_incs = join("", map { " -I \"$_\"" } @{$args{generator_incs}});
|
||||
my $incs = join("", map { " /I \"$_\"" } @{$args{incs}});
|
||||
my $deps = @{$args{deps}} ?
|
||||
'"'.join('" "', @{$args{generator_deps}}, @{$args{deps}}).'"' : '';
|
||||
|
||||
if ($target !~ /\.asm$/) {
|
||||
if ($args{generator}->[0] =~ m|^.*\.in$|) {
|
||||
my $dofile = abs2rel(rel2abs(catfile($config{sourcedir},
|
||||
"util", "dofile.pl")),
|
||||
rel2abs($config{builddir}));
|
||||
return <<"EOF";
|
||||
$target: "$args{generator}->[0]" $deps
|
||||
"\$(PERL)" "-I\$(BLDDIR)" -Mconfigdata "$dofile" \\
|
||||
"-o$target{build_file}" $generator > \$@
|
||||
EOF
|
||||
} else {
|
||||
return <<"EOF";
|
||||
$target: "$args{generator}->[0]" $deps
|
||||
"\$(PERL)"$generator_incs $generator > \$@
|
||||
EOF
|
||||
}
|
||||
} else {
|
||||
if ($args{generator}->[0] =~ /\.pl$/) {
|
||||
$generator = '"$(PERL)"'.$generator_incs.' '.$generator;
|
||||
} elsif ($args{generator}->[0] =~ /\.S$/) {
|
||||
$generator = undef;
|
||||
} else {
|
||||
die "Generator type for $src unknown: $generator\n";
|
||||
}
|
||||
|
||||
if (defined($generator)) {
|
||||
# If the target is named foo.S in build.info, we want to
|
||||
# end up generating foo.s in two steps.
|
||||
if ($args{src} =~ /\.S$/) {
|
||||
return <<"EOF";
|
||||
$target: "$args{generator}->[0]" $deps
|
||||
set ASM=\$(AS)
|
||||
$generator \$@.S
|
||||
\$(CC) $incs \$(CFLAGS) /EP /C \$@.S > \$@.i && move /Y \$@.i \$@
|
||||
del /Q \$@.S
|
||||
EOF
|
||||
}
|
||||
# Otherwise....
|
||||
return <<"EOF";
|
||||
$target: "$args{generator}->[0]" $deps
|
||||
set ASM=\$(AS)
|
||||
$generator \$@
|
||||
EOF
|
||||
}
|
||||
return <<"EOF";
|
||||
$target: "$args{generator}->[0]" $deps
|
||||
\$(CC) $incs \$(CFLAGS) /EP /C "$args{generator}->[0]" > \$@.i && move /Y \$@.i \$@
|
||||
EOF
|
||||
}
|
||||
}
|
||||
|
||||
sub src2obj {
|
||||
my %args = @_;
|
||||
my $obj = $args{obj};
|
||||
my @srcs = map { (my $x = $_) =~ s/\.s$/.asm/; $x
|
||||
} ( @{$args{srcs}} );
|
||||
my $srcs = '"'.join('" "', @srcs).'"';
|
||||
my $deps = '"'.join('" "', @srcs, @{$args{deps}}).'"';
|
||||
my $incs = join("", map { ' /I "'.$_.'"' } @{$args{incs}});
|
||||
unless ($disabled{zlib}) {
|
||||
if ($withargs{zlib_include}) {
|
||||
$incs .= ' /I "'.$withargs{zlib_include}.'"';
|
||||
}
|
||||
}
|
||||
my $ecflags = { lib => '$(LIB_CFLAGS)',
|
||||
dso => '$(DSO_CFLAGS)',
|
||||
bin => '$(BIN_CFLAGS)' } -> {$args{intent}};
|
||||
my $makedepprog = $config{makedepprog};
|
||||
if ($srcs[0] =~ /\.asm$/) {
|
||||
return <<"EOF";
|
||||
$obj$objext: $deps
|
||||
\$(AS) \$(ASFLAGS) \$(ASOUTFLAG)\$\@ $srcs
|
||||
EOF
|
||||
}
|
||||
my $recipe = <<"EOF";
|
||||
$obj$objext: $deps
|
||||
\$(CC) $incs \$(CFLAGS) $ecflags -c \$(COUTFLAG)\$\@ $srcs
|
||||
EOF
|
||||
$recipe .= <<"EOF" unless $disabled{makedepend};
|
||||
\$(CC) $incs \$(CFLAGS) $ecflags /Zs /showIncludes $srcs 2>&1 | \\
|
||||
"\$(PERL)" -n << > $obj$depext
|
||||
chomp;
|
||||
s/^Note: including file: *//;
|
||||
\$\$collect{\$\$_} = 1;
|
||||
END { print '$obj$objext: ',join(" ", sort keys \%collect),"\\n" }
|
||||
<<
|
||||
EOF
|
||||
return $recipe;
|
||||
}
|
||||
|
||||
# On Unix, we build shlibs from static libs, so we're ignoring the
|
||||
# object file array. We *know* this routine is only called when we've
|
||||
# configure 'shared'.
|
||||
sub libobj2shlib {
|
||||
my %args = @_;
|
||||
my $lib = $args{lib};
|
||||
my $shlib = $args{shlib};
|
||||
(my $mkdef_key = $lib) =~ s/^lib//i;
|
||||
my $objs = join("\n", map { $_.$objext } @{$args{objs}});
|
||||
my $linklibs = join("",
|
||||
map { "\n$_" } compute_lib_depends(@{$args{deps}}));
|
||||
my $deps = join(" ",
|
||||
(map { $_.$objext } @{$args{objs}}),
|
||||
compute_lib_depends(@{$args{deps}}));
|
||||
my $ordinalsfile = defined($args{ordinals}) ? $args{ordinals}->[1] : "";
|
||||
my $mkdef_pl = abs2rel(rel2abs(catfile($config{sourcedir},
|
||||
"util", "mkdef.pl")),
|
||||
rel2abs($config{builddir}));
|
||||
my $mkrc_pl = abs2rel(rel2abs(catfile($config{sourcedir},
|
||||
"util", "mkrc.pl")),
|
||||
rel2abs($config{builddir}));
|
||||
my $target = shlib_import($lib);
|
||||
return <<"EOF"
|
||||
$target: $deps "$ordinalsfile" "$mkdef_pl"
|
||||
"\$(PERL)" "$mkdef_pl" "$mkdef_key" 32 > $shlib.def
|
||||
"\$(PERL)" -i.tmp -pe "s|^LIBRARY\\s+${mkdef_key}32|LIBRARY $shlib|;" $shlib.def
|
||||
DEL $shlib.def.tmp
|
||||
"\$(PERL)" "$mkrc_pl" $shlib$shlibext > $shlib.rc
|
||||
\$(RC) \$(RCOUTFLAG)$shlib.res $shlib.rc
|
||||
IF EXIST $shlib$shlibext.manifest DEL /F /Q $shlib$shlibext.manifest
|
||||
\$(LD) \$(LDFLAGS) \$(LIB_LDFLAGS) \\
|
||||
/implib:\$@ \$(LDOUTFLAG)$shlib$shlibext /def:$shlib.def @<< || (DEL /Q \$(\@B).* $shlib.* && EXIT 1)
|
||||
$objs $shlib.res$linklibs \$(EX_LIBS)
|
||||
<<
|
||||
IF EXIST $shlib$shlibext.manifest \\
|
||||
\$(MT) \$(MTFLAGS) \$(MTINFLAG)$shlib$shlibext.manifest \$(MTOUTFLAG)$shlib$shlibext
|
||||
IF EXIST apps\\$shlib$shlibext DEL /Q /F apps\\$shlib$shlibext
|
||||
IF EXIST test\\$shlib$shlibext DEL /Q /F test\\$shlib$shlibext
|
||||
IF EXIST fuzz\\$shlib$shlibext DEL /Q /F fuzz\\$shlib$shlibext
|
||||
COPY $shlib$shlibext apps
|
||||
COPY $shlib$shlibext test
|
||||
COPY $shlib$shlibext fuzz
|
||||
EOF
|
||||
}
|
||||
sub obj2dso {
|
||||
my %args = @_;
|
||||
my $dso = $args{lib};
|
||||
my $dso_n = basename($dso);
|
||||
my $objs = join("\n", map { $_.$objext } @{$args{objs}});
|
||||
my $linklibs = join("",
|
||||
map { "\n$_" } compute_lib_depends(@{$args{deps}}));
|
||||
my $deps = join(" ",
|
||||
(map { $_.$objext } @{$args{objs}}),
|
||||
compute_lib_depends(@{$args{deps}}));
|
||||
return <<"EOF";
|
||||
$dso$dsoext: $deps
|
||||
IF EXIST $dso$dsoext.manifest DEL /F /Q $dso$dsoext.manifest
|
||||
\$(LD) \$(LDFLAGS) \$(DSO_LDFLAGS) \$(LDOUTFLAG)$dso$dsoext /def:<< @<<
|
||||
LIBRARY $dso_n
|
||||
EXPORTS
|
||||
bind_engine @1
|
||||
v_check @2
|
||||
<<
|
||||
$objs$linklibs \$(EX_LIBS)
|
||||
<<
|
||||
IF EXIST $dso$dsoext.manifest \\
|
||||
\$(MT) \$(MTFLAGS) \$(MTINFLAG)$dso$dsoext.manifest \$(MTOUTFLAG)$dso$dsoext
|
||||
EOF
|
||||
}
|
||||
sub obj2lib {
|
||||
# Because static libs and import libs are both named the same in native
|
||||
# Windows, we can't have both. We skip the static lib in that case,
|
||||
# as the shared libs are what we use anyway.
|
||||
return "" unless $disabled{"shared"};
|
||||
|
||||
my %args = @_;
|
||||
my $lib = $args{lib};
|
||||
my $objs = join("\n", map { $_.$objext } @{$args{objs}});
|
||||
my $deps = join(" ", map { $_.$objext } @{$args{objs}});
|
||||
return <<"EOF";
|
||||
$lib$libext: $deps
|
||||
\$(AR) \$(ARFLAGS) \$(AROUTFLAG)$lib$libext @<<
|
||||
\$**
|
||||
<<
|
||||
EOF
|
||||
}
|
||||
sub obj2bin {
|
||||
my %args = @_;
|
||||
my $bin = $args{bin};
|
||||
my $objs = join("\n", map { $_.$objext } @{$args{objs}});
|
||||
my $linklibs = join("",
|
||||
map { "\n$_" } compute_lib_depends(@{$args{deps}}));
|
||||
my $deps = join(" ",
|
||||
(map { $_.$objext } @{$args{objs}}),
|
||||
compute_lib_depends(@{$args{deps}}));
|
||||
return <<"EOF";
|
||||
$bin$exeext: $deps
|
||||
IF EXIST $bin$exeext.manifest DEL /F /Q $bin$exeext.manifest
|
||||
\$(LD) \$(LDFLAGS) \$(BIN_LDFLAGS) \$(LDOUTFLAG)$bin$exeext @<<
|
||||
$objs setargv.obj$linklibs \$(EX_LIBS)
|
||||
<<
|
||||
IF EXIST $bin$exeext.manifest \\
|
||||
\$(MT) \$(MTFLAGS) \$(MTINFLAG)$bin$exeext.manifest \$(MTOUTFLAG)$bin$exeext
|
||||
EOF
|
||||
}
|
||||
sub in2script {
|
||||
my %args = @_;
|
||||
my $script = $args{script};
|
||||
my $sources = '"'.join('" "', @{$args{sources}}).'"';
|
||||
my $dofile = abs2rel(rel2abs(catfile($config{sourcedir},
|
||||
"util", "dofile.pl")),
|
||||
rel2abs($config{builddir}));
|
||||
return <<"EOF";
|
||||
$script: $sources
|
||||
"\$(PERL)" "-I\$(BLDDIR)" -Mconfigdata "$dofile" \\
|
||||
"-o$target{build_file}" $sources > "$script"
|
||||
EOF
|
||||
}
|
||||
sub generatedir {
|
||||
my %args = @_;
|
||||
my $dir = $args{dir};
|
||||
my @deps = map { s|\.o$|$objext|; $_ } @{$args{deps}};
|
||||
my @actions = ();
|
||||
my %extinfo = ( dso => $dsoext,
|
||||
lib => $libext,
|
||||
bin => $exeext );
|
||||
|
||||
foreach my $type (("dso", "lib", "bin", "script")) {
|
||||
next unless defined($unified_info{dirinfo}->{$dir}->{products}->{$type});
|
||||
# For lib object files, we could update the library. However,
|
||||
# LIB on Windows doesn't work that way, so we won't create any
|
||||
# actions for it, and the dependencies are already taken care of.
|
||||
if ($type ne "lib") {
|
||||
foreach my $prod (@{$unified_info{dirinfo}->{$dir}->{products}->{$type}}) {
|
||||
if (dirname($prod) eq $dir) {
|
||||
push @deps, $prod.$extinfo{$type};
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
my $deps = join(" ", @deps);
|
||||
my $actions = join("\n", "", @actions);
|
||||
return <<"EOF";
|
||||
$args{dir} $args{dir}\\ : $deps$actions
|
||||
EOF
|
||||
}
|
||||
"" # Important! This becomes part of the template result.
|
||||
-}
|
||||
2
FAQ
2
FAQ
@@ -1,2 +0,0 @@
|
||||
The FAQ is now maintained on the web:
|
||||
https://www.openssl.org/docs/faq.html
|
||||
965
INSTALL
965
INSTALL
@@ -1,965 +0,0 @@
|
||||
|
||||
OPENSSL INSTALLATION
|
||||
--------------------
|
||||
|
||||
This document describes installation on all supported operating
|
||||
systems (the Unix/Linux family (which includes Mac OS/X), OpenVMS,
|
||||
and Windows).
|
||||
|
||||
To install OpenSSL, you will need:
|
||||
|
||||
* A make implementation
|
||||
* Perl 5 with core modules (please read NOTES.PERL)
|
||||
* The perl module Text::Template (please read NOTES.PERL)
|
||||
* an ANSI C compiler
|
||||
* a development environment in the form of development libraries and C
|
||||
header files
|
||||
* a supported operating system
|
||||
|
||||
For additional platform specific requirements, solutions to specific
|
||||
issues and other details, please read one of these:
|
||||
|
||||
* NOTES.UNIX (any supported Unix like system)
|
||||
* NOTES.VMS (OpenVMS)
|
||||
* NOTES.WIN (any supported Windows)
|
||||
* NOTES.DJGPP (DOS platform with DJGPP)
|
||||
|
||||
Notational conventions in this document
|
||||
---------------------------------------
|
||||
|
||||
Throughout this document, we use the following conventions in command
|
||||
examples:
|
||||
|
||||
$ command Any line starting with a dollar sign
|
||||
($) is a command line.
|
||||
|
||||
{ word1 | word2 | word3 } This denotes a mandatory choice, to be
|
||||
replaced with one of the given words.
|
||||
A simple example would be this:
|
||||
|
||||
$ echo { FOO | BAR | COOKIE }
|
||||
|
||||
which is to be understood as one of
|
||||
these:
|
||||
|
||||
$ echo FOO
|
||||
- or -
|
||||
$ echo BAR
|
||||
- or -
|
||||
$ echo COOKIE
|
||||
|
||||
[ word1 | word2 | word3 ] Similar to { word1 | word2 | word3 }
|
||||
except it's optional to give any of
|
||||
those. In addition to the examples
|
||||
above, this would also be valid:
|
||||
|
||||
$ echo
|
||||
|
||||
{{ target }} This denotes a mandatory word or
|
||||
sequence of words of some sort. A
|
||||
simple example would be this:
|
||||
|
||||
$ type {{ filename }}
|
||||
|
||||
which is to be understood to use the
|
||||
command 'type' on some file name
|
||||
determined by the user.
|
||||
|
||||
[[ options ]] Similar to {{ target }}, but is
|
||||
optional.
|
||||
|
||||
Note that the notation assumes spaces around {, }, [, ], {{, }} and
|
||||
[[, ]]. This is to differentiate from OpenVMS directory
|
||||
specifications, which also use [ and ], but without spaces.
|
||||
|
||||
Quick Start
|
||||
-----------
|
||||
|
||||
If you want to just get on with it, do:
|
||||
|
||||
on Unix (again, this includes Mac OS/X):
|
||||
|
||||
$ ./config
|
||||
$ make
|
||||
$ make test
|
||||
$ make install
|
||||
|
||||
on OpenVMS:
|
||||
|
||||
$ @config
|
||||
$ mms
|
||||
$ mms test
|
||||
$ mms install
|
||||
|
||||
on Windows (only pick one of the targets for configuration):
|
||||
|
||||
$ perl Configure { VC-WIN32 | VC-WIN64A | VC-WIN64I | VC-CE }
|
||||
$ nmake
|
||||
$ nmake test
|
||||
$ nmake install
|
||||
|
||||
If any of these steps fails, see section Installation in Detail below.
|
||||
|
||||
This will build and install OpenSSL in the default location, which is:
|
||||
|
||||
Unix: normal installation directories under /usr/local
|
||||
OpenVMS: SYS$COMMON:[OPENSSL-'version'...], where 'version' is the
|
||||
OpenSSL version number with underscores instead of periods.
|
||||
Windows: C:\Program Files\OpenSSL or C:\Program Files (x86)\OpenSSL
|
||||
|
||||
If you want to install it anywhere else, run config like this:
|
||||
|
||||
On Unix:
|
||||
|
||||
$ ./config --prefix=/opt/openssl --openssldir=/usr/local/ssl
|
||||
|
||||
On OpenVMS:
|
||||
|
||||
$ @config --prefix=PROGRAM:[INSTALLS] --openssldir=SYS$MANAGER:[OPENSSL]
|
||||
|
||||
(Note: if you do add options to the configuration command, please make sure
|
||||
you've read more than just this Quick Start, such as relevant NOTES.* files,
|
||||
the options outline below, as configuration options may change the outcome
|
||||
in otherwise unexpected ways)
|
||||
|
||||
|
||||
Configuration Options
|
||||
---------------------
|
||||
|
||||
There are several options to ./config (or ./Configure) to customize
|
||||
the build (note that for Windows, the defaults for --prefix and
|
||||
--openssldir depend in what configuration is used and what Windows
|
||||
implementation OpenSSL is built on. More notes on this in NOTES.WIN):
|
||||
|
||||
--api=x.y.z
|
||||
Don't build with support for deprecated APIs below the
|
||||
specified version number. For example "--api=1.1.0" will
|
||||
remove support for all APIS that were deprecated in OpenSSL
|
||||
version 1.1.0 or below.
|
||||
|
||||
--cross-compile-prefix=PREFIX
|
||||
The PREFIX to include in front of commands for your
|
||||
toolchain. It's likely to have to end with dash, e.g.
|
||||
a-b-c- would invoke GNU compiler as a-b-c-gcc, etc.
|
||||
Unfortunately cross-compiling is too case-specific to
|
||||
put together one-size-fits-all instructions. You might
|
||||
have to pass more flags or set up environment variables
|
||||
to actually make it work. Android and iOS cases are
|
||||
discussed in corresponding Configurations/10-main.cf
|
||||
sections. But there are cases when this option alone is
|
||||
sufficient. For example to build the mingw64 target on
|
||||
Linux "--cross-compile-prefix=x86_64-w64-mingw32-"
|
||||
works. Naturally provided that mingw packages are
|
||||
installed. Today Debian and Ubuntu users have option to
|
||||
install a number of prepackaged cross-compilers along
|
||||
with corresponding run-time and development packages for
|
||||
"alien" hardware. To give another example
|
||||
"--cross-compile-prefix=mipsel-linux-gnu-" suffices
|
||||
in such case. Needless to mention that you have to
|
||||
invoke ./Configure, not ./config, and pass your target
|
||||
name explicitly.
|
||||
|
||||
--debug
|
||||
Build OpenSSL with debugging symbols.
|
||||
|
||||
--libdir=DIR
|
||||
The name of the directory under the top of the installation
|
||||
directory tree (see the --prefix option) where libraries will
|
||||
be installed. By default this is "lib". Note that on Windows
|
||||
only ".lib" files will be stored in this location. dll files
|
||||
will always be installed to the "bin" directory.
|
||||
|
||||
--openssldir=DIR
|
||||
Directory for OpenSSL configuration files, and also the
|
||||
default certificate and key store. Defaults are:
|
||||
|
||||
Unix: /usr/local/ssl
|
||||
Windows: C:\Program Files\Common Files\SSL
|
||||
or C:\Program Files (x86)\Common Files\SSL
|
||||
OpenVMS: SYS$COMMON:[OPENSSL-COMMON]
|
||||
|
||||
--prefix=DIR
|
||||
The top of the installation directory tree. Defaults are:
|
||||
|
||||
Unix: /usr/local
|
||||
Windows: C:\Program Files\OpenSSL
|
||||
or C:\Program Files (x86)\OpenSSL
|
||||
OpenVMS: SYS$COMMON:[OPENSSL-'version']
|
||||
|
||||
--release
|
||||
Build OpenSSL without debugging symbols. This is the default.
|
||||
|
||||
--strict-warnings
|
||||
This is a developer flag that switches on various compiler
|
||||
options recommended for OpenSSL development. It only works
|
||||
when using gcc or clang as the compiler. If you are
|
||||
developing a patch for OpenSSL then it is recommended that
|
||||
you use this option where possible.
|
||||
|
||||
--with-zlib-include=DIR
|
||||
The directory for the location of the zlib include file. This
|
||||
option is only necessary if enable-zlib (see below) is used
|
||||
and the include file is not already on the system include
|
||||
path.
|
||||
|
||||
--with-zlib-lib=LIB
|
||||
On Unix: this is the directory containing the zlib library.
|
||||
If not provided the system library path will be used.
|
||||
On Windows: this is the filename of the zlib library (with or
|
||||
without a path). This flag must be provided if the
|
||||
zlib-dynamic option is not also used. If zlib-dynamic is used
|
||||
then this flag is optional and a default value ("ZLIB1") is
|
||||
used if not provided.
|
||||
On VMS: this is the filename of the zlib library (with or
|
||||
without a path). This flag is optional and if not provided
|
||||
then "GNV$LIBZSHR", "GNV$LIBZSHR32" or "GNV$LIBZSHR64" is
|
||||
used by default depending on the pointer size chosen.
|
||||
|
||||
no-afalgeng
|
||||
Don't build the AFALG engine. This option will be forced if
|
||||
on a platform that does not support AFALG.
|
||||
|
||||
enable-asan
|
||||
Build with the Address sanitiser. This is a developer option
|
||||
only. It may not work on all platforms and should never be
|
||||
used in production environments. It will only work when used
|
||||
with gcc or clang and should be used in conjunction with the
|
||||
no-shared option.
|
||||
|
||||
no-asm
|
||||
Do not use assembler code. On some platforms a small amount
|
||||
of assembler code may still be used.
|
||||
|
||||
no-async
|
||||
Do not build support for async operations.
|
||||
|
||||
no-autoalginit
|
||||
Don't automatically load all supported ciphers and digests.
|
||||
Typically OpenSSL will make available all of its supported
|
||||
ciphers and digests. For a statically linked application this
|
||||
may be undesirable if small executable size is an objective.
|
||||
This only affects libcrypto. Ciphers and digests will have to
|
||||
be loaded manually using EVP_add_cipher() and
|
||||
EVP_add_digest() if this option is used. This option will
|
||||
force a non-shared build.
|
||||
|
||||
no-autoerrinit
|
||||
Don't automatically load all libcrypto/libssl error strings.
|
||||
Typically OpenSSL will automatically load human readable
|
||||
error strings. For a statically linked application this may
|
||||
be undesirable if small executable size is an objective.
|
||||
|
||||
|
||||
no-capieng
|
||||
Don't build the CAPI engine. This option will be forced if
|
||||
on a platform that does not support CAPI.
|
||||
|
||||
no-cms
|
||||
Don't build support for CMS features
|
||||
|
||||
no-comp
|
||||
Don't build support for SSL/TLS compression. If this option
|
||||
is left enabled (the default), then compression will only
|
||||
work if the zlib or zlib-dynamic options are also chosen.
|
||||
|
||||
enable-crypto-mdebug
|
||||
Build support for debugging memory allocated via
|
||||
OPENSSL_malloc() or OPENSSL_zalloc().
|
||||
|
||||
enable-crypto-mdebug-backtrace
|
||||
As for crypto-mdebug, but additionally provide backtrace
|
||||
information for allocated memory.
|
||||
TO BE USED WITH CARE: this uses GNU C functionality, and
|
||||
is therefore not usable for non-GNU config targets. If
|
||||
your build complains about the use of '-rdynamic' or the
|
||||
lack of header file execinfo.h, this option is not for you.
|
||||
ALSO NOTE that even though execinfo.h is available on your
|
||||
system (through Gnulib), the functions might just be stubs
|
||||
that do nothing.
|
||||
|
||||
no-ct
|
||||
Don't build support for Certificate Transparency.
|
||||
|
||||
no-deprecated
|
||||
Don't build with support for any deprecated APIs. This is the
|
||||
same as using "--api" and supplying the latest version
|
||||
number.
|
||||
|
||||
no-dgram
|
||||
Don't build support for datagram based BIOs. Selecting this
|
||||
option will also force the disabling of DTLS.
|
||||
|
||||
no-dso
|
||||
Don't build support for loading Dynamic Shared Objects.
|
||||
|
||||
no-dynamic-engine
|
||||
Don't build the dynamically loaded engines. This only has an
|
||||
effect in a "shared" build
|
||||
|
||||
no-ec
|
||||
Don't build support for Elliptic Curves.
|
||||
|
||||
no-ec2m
|
||||
Don't build support for binary Elliptic Curves
|
||||
|
||||
enable-ec_nistp_64_gcc_128
|
||||
Enable support for optimised implementations of some commonly
|
||||
used NIST elliptic curves. This is only supported on some
|
||||
platforms.
|
||||
|
||||
enable-egd
|
||||
Build support for gathering entropy from EGD (Entropy
|
||||
Gathering Daemon).
|
||||
|
||||
no-engine
|
||||
Don't build support for loading engines.
|
||||
|
||||
no-err
|
||||
Don't compile in any error strings.
|
||||
|
||||
no-filenames
|
||||
Don't compile in filename and line number information (e.g.
|
||||
for errors and memory allocation).
|
||||
|
||||
enable-fuzz-libfuzzer, enable-fuzz-afl
|
||||
Build with support for fuzzing using either libfuzzer or AFL.
|
||||
These are developer options only. They may not work on all
|
||||
platforms and should never be used in production environments.
|
||||
See the file fuzz/README.md for further details.
|
||||
|
||||
no-gost
|
||||
Don't build support for GOST based ciphersuites. Note that
|
||||
if this feature is enabled then GOST ciphersuites are only
|
||||
available if the GOST algorithms are also available through
|
||||
loading an externally supplied engine.
|
||||
|
||||
enable-heartbeats
|
||||
Build support for DTLS heartbeats.
|
||||
|
||||
no-hw-padlock
|
||||
Don't build the padlock engine.
|
||||
|
||||
no-makedepend
|
||||
Don't generate dependencies.
|
||||
|
||||
no-multiblock
|
||||
Don't build support for writing multiple records in one
|
||||
go in libssl (Note: this is a different capability to the
|
||||
pipelining functionality).
|
||||
|
||||
no-nextprotoneg
|
||||
Don't build support for the NPN TLS extension.
|
||||
|
||||
no-ocsp
|
||||
Don't build support for OCSP.
|
||||
|
||||
no-pic
|
||||
Don't build with support for Position Independent Code.
|
||||
|
||||
no-posix-io
|
||||
Don't use POSIX IO capabilities.
|
||||
|
||||
no-psk
|
||||
Don't build support for Pre-Shared Key based ciphersuites.
|
||||
|
||||
no-rdrand
|
||||
Don't use hardware RDRAND capabilities.
|
||||
|
||||
no-rfc3779
|
||||
Don't build support for RFC3779 ("X.509 Extensions for IP
|
||||
Addresses and AS Identifiers")
|
||||
|
||||
sctp
|
||||
Build support for SCTP
|
||||
|
||||
no-shared
|
||||
Do not create shared libraries, only static ones. See "Note
|
||||
on shared libraries" below.
|
||||
|
||||
no-sock
|
||||
Don't build support for socket BIOs
|
||||
|
||||
no-srp
|
||||
Don't build support for SRP or SRP based ciphersuites.
|
||||
|
||||
no-srtp
|
||||
Don't build SRTP support
|
||||
|
||||
no-sse2
|
||||
Exclude SSE2 code paths from 32-bit x86 assembly modules.
|
||||
Normally SSE2 extension is detected at run-time, but the
|
||||
decision whether or not the machine code will be executed
|
||||
is taken solely on CPU capability vector. This means that
|
||||
if you happen to run OS kernel which does not support SSE2
|
||||
extension on Intel P4 processor, then your application
|
||||
might be exposed to "illegal instruction" exception.
|
||||
There might be a way to enable support in kernel, e.g.
|
||||
FreeBSD kernel can be compiled with CPU_ENABLE_SSE, and
|
||||
there is a way to disengage SSE2 code paths upon application
|
||||
start-up, but if you aim for wider "audience" running
|
||||
such kernel, consider no-sse2. Both the 386 and
|
||||
no-asm options imply no-sse2.
|
||||
|
||||
enable-ssl-trace
|
||||
Build with the SSL Trace capabilities (adds the "-trace"
|
||||
option to s_client and s_server).
|
||||
|
||||
no-static-engine
|
||||
Don't build the statically linked engines. This only
|
||||
has an impact when not built "shared".
|
||||
|
||||
no-stdio
|
||||
Don't use anything from the C header file "stdio.h" that
|
||||
makes use of the "FILE" type. Only libcrypto and libssl can
|
||||
be built in this way. Using this option will suppress
|
||||
building the command line applications. Additionally since
|
||||
the OpenSSL tests also use the command line applications the
|
||||
tests will also be skipped.
|
||||
|
||||
no-threads
|
||||
Don't try to build with support for multi-threaded
|
||||
applications.
|
||||
|
||||
threads
|
||||
Build with support for multi-threaded applications. Most
|
||||
platforms will enable this by default. However if on a
|
||||
platform where this is not the case then this will usually
|
||||
require additional system-dependent options! See "Note on
|
||||
multi-threading" below.
|
||||
|
||||
no-ts
|
||||
Don't build Time Stamping Authority support.
|
||||
|
||||
enable-ubsan
|
||||
Build with the Undefined Behaviour sanitiser. This is a
|
||||
developer option only. It may not work on all platforms and
|
||||
should never be used in production environments. It will only
|
||||
work when used with gcc or clang and should be used in
|
||||
conjunction with the "-DPEDANTIC" option (or the
|
||||
--strict-warnings option).
|
||||
|
||||
no-ui
|
||||
Don't build with the "UI" capability (i.e. the set of
|
||||
features enabling text based prompts).
|
||||
|
||||
enable-unit-test
|
||||
Enable additional unit test APIs. This should not typically
|
||||
be used in production deployments.
|
||||
|
||||
enable-weak-ssl-ciphers
|
||||
Build support for SSL/TLS ciphers that are considered "weak"
|
||||
(e.g. RC4 based ciphersuites).
|
||||
|
||||
zlib
|
||||
Build with support for zlib compression/decompression.
|
||||
|
||||
zlib-dynamic
|
||||
Like "zlib", but has OpenSSL load the zlib library
|
||||
dynamically when needed. This is only supported on systems
|
||||
where loading of shared libraries is supported.
|
||||
|
||||
386
|
||||
In 32-bit x86 builds, when generating assembly modules,
|
||||
use the 80386 instruction set only (the default x86 code
|
||||
is more efficient, but requires at least a 486). Note:
|
||||
This doesn't affect code generated by compiler, you're
|
||||
likely to complement configuration command line with
|
||||
suitable compiler-specific option.
|
||||
|
||||
no-<prot>
|
||||
Don't build support for negotiating the specified SSL/TLS
|
||||
protocol (one of ssl, ssl3, tls, tls1, tls1_1, tls1_2, dtls,
|
||||
dtls1 or dtls1_2). If "no-tls" is selected then all of tls1,
|
||||
tls1_1 and tls1_2 are disabled. Similarly "no-dtls" will
|
||||
disable dtls1 and dtls1_2. The "no-ssl" option is synonymous
|
||||
with "no-ssl3". Note this only affects version negotiation.
|
||||
OpenSSL will still provide the methods for applications to
|
||||
explicitly select the individual protocol versions.
|
||||
|
||||
no-<prot>-method
|
||||
As for no-<prot> but in addition do not build the methods for
|
||||
applications to explicitly select individual protocol
|
||||
versions.
|
||||
|
||||
enable-<alg>
|
||||
Build with support for the specified algorithm, where <alg>
|
||||
is one of: md2 or rc5.
|
||||
|
||||
no-<alg>
|
||||
Build without support for the specified algorithm, where
|
||||
<alg> is one of: bf, blake2, camellia, cast, chacha, cmac,
|
||||
des, dh, dsa, ecdh, ecdsa, idea, md4, mdc2, ocb, poly1305,
|
||||
rc2, rc4, rmd160, scrypt, seed or whirlpool. The "ripemd"
|
||||
algorithm is deprecated and if used is synonymous with rmd160.
|
||||
|
||||
-Dxxx, lxxx, -Lxxx, -Wl, -rpath, -R, -framework, -static
|
||||
These system specific options will be recocognised and
|
||||
passed through to the compiler to allow you to define
|
||||
preprocessor symbols, specify additional libraries, library
|
||||
directories or other compiler options. It might be worth
|
||||
noting that some compilers generate code specifically for
|
||||
processor the compiler currently executes on. This is not
|
||||
necessarily what you might have in mind, since it might be
|
||||
unsuitable for execution on other, typically older,
|
||||
processor. Consult your compiler documentation.
|
||||
|
||||
-xxx, +xxx
|
||||
Additional options that are not otherwise recognised are
|
||||
passed through as they are to the compiler as well. Again,
|
||||
consult your compiler documentation.
|
||||
|
||||
|
||||
Installation in Detail
|
||||
----------------------
|
||||
|
||||
1a. Configure OpenSSL for your operation system automatically:
|
||||
|
||||
NOTE: This is not available on Windows.
|
||||
|
||||
$ ./config [[ options ]] # Unix
|
||||
|
||||
or
|
||||
|
||||
$ @config [[ options ]] ! OpenVMS
|
||||
|
||||
For the remainder of this text, the Unix form will be used in all
|
||||
examples, please use the appropriate form for your platform.
|
||||
|
||||
This guesses at your operating system (and compiler, if necessary) and
|
||||
configures OpenSSL based on this guess. Run ./config -t to see
|
||||
if it guessed correctly. If you want to use a different compiler, you
|
||||
are cross-compiling for another platform, or the ./config guess was
|
||||
wrong for other reasons, go to step 1b. Otherwise go to step 2.
|
||||
|
||||
On some systems, you can include debugging information as follows:
|
||||
|
||||
$ ./config -d [[ options ]]
|
||||
|
||||
1b. Configure OpenSSL for your operating system manually
|
||||
|
||||
OpenSSL knows about a range of different operating system, hardware and
|
||||
compiler combinations. To see the ones it knows about, run
|
||||
|
||||
$ ./Configure # Unix
|
||||
|
||||
or
|
||||
|
||||
$ perl Configure # All other platforms
|
||||
|
||||
For the remainder of this text, the Unix form will be used in all
|
||||
examples, please use the appropriate form for your platform.
|
||||
|
||||
Pick a suitable name from the list that matches your system. For most
|
||||
operating systems there is a choice between using "cc" or "gcc". When
|
||||
you have identified your system (and if necessary compiler) use this name
|
||||
as the argument to Configure. For example, a "linux-elf" user would
|
||||
run:
|
||||
|
||||
$ ./Configure linux-elf [[ options ]]
|
||||
|
||||
If your system isn't listed, you will have to create a configuration
|
||||
file named Configurations/{{ something }}.conf and add the correct
|
||||
configuration for your system. See the available configs as examples
|
||||
and read Configurations/README and Configurations/README.design for
|
||||
more information.
|
||||
|
||||
The generic configurations "cc" or "gcc" should usually work on 32 bit
|
||||
Unix-like systems.
|
||||
|
||||
Configure creates a build file ("Makefile" on Unix, "makefile" on Windows
|
||||
and "descrip.mms" on OpenVMS) from a suitable template in Configurations,
|
||||
and defines various macros in include/openssl/opensslconf.h (generated from
|
||||
include/openssl/opensslconf.h.in).
|
||||
|
||||
1c. Configure OpenSSL for building outside of the source tree.
|
||||
|
||||
OpenSSL can be configured to build in a build directory separate from
|
||||
the directory with the source code. It's done by placing yourself in
|
||||
some other directory and invoking the configuration commands from
|
||||
there.
|
||||
|
||||
Unix example:
|
||||
|
||||
$ mkdir /var/tmp/openssl-build
|
||||
$ cd /var/tmp/openssl-build
|
||||
$ /PATH/TO/OPENSSL/SOURCE/config [[ options ]]
|
||||
|
||||
or
|
||||
|
||||
$ /PATH/TO/OPENSSL/SOURCE/Configure {{ target }} [[ options ]]
|
||||
|
||||
OpenVMS example:
|
||||
|
||||
$ set default sys$login:
|
||||
$ create/dir [.tmp.openssl-build]
|
||||
$ set default [.tmp.openssl-build]
|
||||
$ @[PATH.TO.OPENSSL.SOURCE]config [[ options ]]
|
||||
|
||||
or
|
||||
|
||||
$ @[PATH.TO.OPENSSL.SOURCE]Configure {{ target }} [[ options ]]
|
||||
|
||||
Windows example:
|
||||
|
||||
$ C:
|
||||
$ mkdir \temp-openssl
|
||||
$ cd \temp-openssl
|
||||
$ perl d:\PATH\TO\OPENSSL\SOURCE\Configure {{ target }} [[ options ]]
|
||||
|
||||
Paths can be relative just as well as absolute. Configure will
|
||||
do its best to translate them to relative paths whenever possible.
|
||||
|
||||
2. Build OpenSSL by running:
|
||||
|
||||
$ make # Unix
|
||||
$ mms ! (or mmk) OpenVMS
|
||||
$ nmake # Windows
|
||||
|
||||
This will build the OpenSSL libraries (libcrypto.a and libssl.a on
|
||||
Unix, corresponding on other platforms) and the OpenSSL binary
|
||||
("openssl"). The libraries will be built in the top-level directory,
|
||||
and the binary will be in the "apps" subdirectory.
|
||||
|
||||
If the build fails, look at the output. There may be reasons
|
||||
for the failure that aren't problems in OpenSSL itself (like
|
||||
missing standard headers). If you are having problems you can
|
||||
get help by sending an email to the openssl-users email list (see
|
||||
https://www.openssl.org/community/mailinglists.html for details). If
|
||||
it is a bug with OpenSSL itself, please open an issue on GitHub, at
|
||||
https://github.com/openssl/openssl/issues. Please review the existing
|
||||
ones first; maybe the bug was already reported or has already been
|
||||
fixed.
|
||||
|
||||
(If you encounter assembler error messages, try the "no-asm"
|
||||
configuration option as an immediate fix.)
|
||||
|
||||
Compiling parts of OpenSSL with gcc and others with the system
|
||||
compiler will result in unresolved symbols on some systems.
|
||||
|
||||
3. After a successful build, the libraries should be tested. Run:
|
||||
|
||||
$ make test # Unix
|
||||
$ mms test ! OpenVMS
|
||||
$ nmake test # Windows
|
||||
|
||||
NOTE: you MUST run the tests from an unprivileged account (or
|
||||
disable your privileges temporarily if your platform allows it).
|
||||
|
||||
If some tests fail, look at the output. There may be reasons for
|
||||
the failure that isn't a problem in OpenSSL itself (like a
|
||||
malfunction with Perl). You may want increased verbosity, that
|
||||
can be accomplished like this:
|
||||
|
||||
$ make VERBOSE=1 test # Unix
|
||||
|
||||
$ mms /macro=(VERBOSE=1) test ! OpenVMS
|
||||
|
||||
$ nmake VERBOSE=1 test # Windows
|
||||
|
||||
If you want to run just one or a few specific tests, you can use
|
||||
the make variable TESTS to specify them, like this:
|
||||
|
||||
$ make TESTS='test_rsa test_dsa' test # Unix
|
||||
$ mms/macro="TESTS=test_rsa test_dsa" test ! OpenVMS
|
||||
$ nmake TESTS='test_rsa test_dsa' test # Windows
|
||||
|
||||
And of course, you can combine (Unix example shown):
|
||||
|
||||
$ make VERBOSE=1 TESTS='test_rsa test_dsa' test
|
||||
|
||||
You can find the list of available tests like this:
|
||||
|
||||
$ make list-tests # Unix
|
||||
$ mms list-tests ! OpenVMS
|
||||
$ nmake list-tests # Windows
|
||||
|
||||
Have a look at the manual for the perl module Test::Harness to
|
||||
see what other HARNESS_* variables there are.
|
||||
|
||||
If you find a problem with OpenSSL itself, try removing any
|
||||
compiler optimization flags from the CFLAGS line in Makefile and
|
||||
run "make clean; make" or corresponding.
|
||||
|
||||
To report a bug please open an issue on GitHub, at
|
||||
https://github.com/openssl/openssl/issues.
|
||||
|
||||
4. If everything tests ok, install OpenSSL with
|
||||
|
||||
$ make install # Unix
|
||||
$ mms install ! OpenVMS
|
||||
$ nmake install # Windows
|
||||
|
||||
This will install all the software components in this directory
|
||||
tree under PREFIX (the directory given with --prefix or its
|
||||
default):
|
||||
|
||||
Unix:
|
||||
|
||||
bin/ Contains the openssl binary and a few other
|
||||
utility scripts.
|
||||
include/openssl
|
||||
Contains the header files needed if you want
|
||||
to build your own programs that use libcrypto
|
||||
or libssl.
|
||||
lib Contains the OpenSSL library files.
|
||||
lib/engines Contains the OpenSSL dynamically loadable engines.
|
||||
|
||||
share/man/man1 Contains the OpenSSL command line man-pages.
|
||||
share/man/man3 Contains the OpenSSL library calls man-pages.
|
||||
share/man/man5 Contains the OpenSSL configuration format man-pages.
|
||||
share/man/man7 Contains the OpenSSL other misc man-pages.
|
||||
|
||||
share/doc/openssl/html/man1
|
||||
share/doc/openssl/html/man3
|
||||
share/doc/openssl/html/man5
|
||||
share/doc/openssl/html/man7
|
||||
Contains the HTML rendition of the man-pages.
|
||||
|
||||
OpenVMS ('arch' is replaced with the architecture name, "Alpha"
|
||||
or "ia64", 'sover' is replaced with the shared library version
|
||||
(0101 for 1.1), and 'pz' is replaced with the pointer size
|
||||
OpenSSL was built with):
|
||||
|
||||
[.EXE.'arch'] Contains the openssl binary.
|
||||
[.EXE] Contains a few utility scripts.
|
||||
[.include.openssl]
|
||||
Contains the header files needed if you want
|
||||
to build your own programs that use libcrypto
|
||||
or libssl.
|
||||
[.LIB.'arch'] Contains the OpenSSL library files.
|
||||
[.ENGINES'sover''pz'.'arch']
|
||||
Contains the OpenSSL dynamically loadable engines.
|
||||
[.SYS$STARTUP] Contains startup, login and shutdown scripts.
|
||||
These define appropriate logical names and
|
||||
command symbols.
|
||||
[.SYSTEST] Contains the installation verification procedure.
|
||||
[.HTML] Contains the HTML rendition of the manual pages.
|
||||
|
||||
|
||||
Additionally, install will add the following directories under
|
||||
OPENSSLDIR (the directory given with --openssldir or its default)
|
||||
for you convenience:
|
||||
|
||||
certs Initially empty, this is the default location
|
||||
for certificate files.
|
||||
private Initially empty, this is the default location
|
||||
for private key files.
|
||||
misc Various scripts.
|
||||
|
||||
Package builders who want to configure the library for standard
|
||||
locations, but have the package installed somewhere else so that
|
||||
it can easily be packaged, can use
|
||||
|
||||
$ make DESTDIR=/tmp/package-root install # Unix
|
||||
$ mms/macro="DESTDIR=TMP:[PACKAGE-ROOT]" install ! OpenVMS
|
||||
|
||||
The specified destination directory will be prepended to all
|
||||
installation target paths.
|
||||
|
||||
Compatibility issues with previous OpenSSL versions:
|
||||
|
||||
* COMPILING existing applications
|
||||
|
||||
OpenSSL 1.1.0 hides a number of structures that were previously
|
||||
open. This includes all internal libssl structures and a number
|
||||
of EVP types. Accessor functions have been added to allow
|
||||
controlled access to the structures' data.
|
||||
|
||||
This means that some software needs to be rewritten to adapt to
|
||||
the new ways of doing things. This often amounts to allocating
|
||||
an instance of a structure explicitly where you could previously
|
||||
allocate them on the stack as automatic variables, and using the
|
||||
provided accessor functions where you would previously access a
|
||||
structure's field directly.
|
||||
|
||||
Some APIs have changed as well. However, older APIs have been
|
||||
preserved when possible.
|
||||
|
||||
Environment Variables
|
||||
---------------------
|
||||
|
||||
A number of environment variables can be used to provide additional control
|
||||
over the build process. Typically these should be defined prior to running
|
||||
config or Configure. Not all environment variables are relevant to all
|
||||
platforms.
|
||||
|
||||
AR
|
||||
The name of the ar executable to use.
|
||||
|
||||
BUILDFILE
|
||||
Use a different build file name than the platform default
|
||||
("Makefile" on Unixly platforms, "makefile" on native Windows,
|
||||
"descrip.mms" on OpenVMS). This requires that there is a
|
||||
corresponding build file template. See Configurations/README
|
||||
for further information.
|
||||
|
||||
CC
|
||||
The compiler to use. Configure will attempt to pick a default
|
||||
compiler for your platform but this choice can be overridden
|
||||
using this variable. Set it to the compiler executable you wish
|
||||
to use, e.g. "gcc" or "clang".
|
||||
|
||||
CROSS_COMPILE
|
||||
This environment variable has the same meaning as for the
|
||||
"--cross-compile-prefix" Configure flag described above. If both
|
||||
are set then the Configure flag takes precedence.
|
||||
|
||||
NM
|
||||
The name of the nm executable to use.
|
||||
|
||||
OPENSSL_LOCAL_CONFIG_DIR
|
||||
OpenSSL comes with a database of information about how it
|
||||
should be built on different platforms as well as build file
|
||||
templates for those platforms. The database is comprised of
|
||||
".conf" files in the Configurations directory. The build
|
||||
file templates reside there as well as ".tmpl" files. See the
|
||||
file Configurations/README for further information about the
|
||||
format of ".conf" files as well as information on the ".tmpl"
|
||||
files.
|
||||
In addition to the standard ".conf" and ".tmpl" files, it is
|
||||
possible to create your own ".conf" and ".tmpl" files and store
|
||||
them locally, outside the OpenSSL source tree. This environment
|
||||
variable can be set to the directory where these files are held
|
||||
and will have Configure to consider them in addition to the
|
||||
standard ones.
|
||||
|
||||
PERL
|
||||
The name of the Perl executable to use when building OpenSSL.
|
||||
|
||||
HASHBANGPERL
|
||||
The command string for the Perl executable to insert in the
|
||||
#! line of perl scripts that will be publically installed.
|
||||
Default: /usr/bin/env perl
|
||||
Note: the value of this variable is added to the same scripts
|
||||
on all platforms, but it's only relevant on Unix-like platforms.
|
||||
|
||||
RC
|
||||
The name of the rc executable to use. The default will be as
|
||||
defined for the target platform in the ".conf" file. If not
|
||||
defined then "windres" will be used. The WINDRES environment
|
||||
variable is synonymous to this. If both are defined then RC
|
||||
takes precedence.
|
||||
|
||||
RANLIB
|
||||
The name of the ranlib executable to use.
|
||||
|
||||
WINDRES
|
||||
See RC.
|
||||
|
||||
Makefile targets
|
||||
----------------
|
||||
|
||||
The Configure script generates a Makefile in a format relevant to the specific
|
||||
platform. The Makefiles provide a number of targets that can be used. Not all
|
||||
targets may be available on all platforms. Only the most common targets are
|
||||
described here. Examine the Makefiles themselves for the full list.
|
||||
|
||||
all
|
||||
The default target to build all the software components.
|
||||
|
||||
clean
|
||||
Remove all build artefacts and return the directory to a "clean"
|
||||
state.
|
||||
|
||||
depend
|
||||
Rebuild the dependencies in the Makefiles. This is a legacy
|
||||
option that no longer needs to be used in OpenSSL 1.1.0.
|
||||
|
||||
install
|
||||
Install all OpenSSL components.
|
||||
|
||||
install_sw
|
||||
Only install the OpenSSL software components.
|
||||
|
||||
install_docs
|
||||
Only install the OpenSSL documentation components.
|
||||
|
||||
install_man_docs
|
||||
Only install the OpenSSL man pages (Unix only).
|
||||
|
||||
install_html_docs
|
||||
Only install the OpenSSL html documentation.
|
||||
|
||||
list-tests
|
||||
Prints a list of all the self test names.
|
||||
|
||||
test
|
||||
Build and run the OpenSSL self tests.
|
||||
|
||||
uninstall
|
||||
Uninstall all OpenSSL components.
|
||||
|
||||
update
|
||||
This is a developer option. If you are developing a patch for
|
||||
OpenSSL you may need to use this if you want to update
|
||||
automatically generated files; add new error codes or add new
|
||||
(or change the visibility of) public API functions. (Unix only).
|
||||
|
||||
Note on multi-threading
|
||||
-----------------------
|
||||
|
||||
For some systems, the OpenSSL Configure script knows what compiler options
|
||||
are needed to generate a library that is suitable for multi-threaded
|
||||
applications. On these systems, support for multi-threading is enabled
|
||||
by default; use the "no-threads" option to disable (this should never be
|
||||
necessary).
|
||||
|
||||
On other systems, to enable support for multi-threading, you will have
|
||||
to specify at least two options: "threads", and a system-dependent option.
|
||||
(The latter is "-D_REENTRANT" on various systems.) The default in this
|
||||
case, obviously, is not to include support for multi-threading (but
|
||||
you can still use "no-threads" to suppress an annoying warning message
|
||||
from the Configure script.)
|
||||
|
||||
OpenSSL provides built-in support for two threading models: pthreads (found on
|
||||
most UNIX/Linux systems), and Windows threads. No other threading models are
|
||||
supported. If your platform does not provide pthreads or Windows threads then
|
||||
you should Configure with the "no-threads" option.
|
||||
|
||||
Notes on shared libraries
|
||||
-------------------------
|
||||
|
||||
For most systems the OpenSSL Configure script knows what is needed to
|
||||
build shared libraries for libcrypto and libssl. On these systems
|
||||
the shared libraries will be created by default. This can be suppressed and
|
||||
only static libraries created by using the "no-shared" option. On systems
|
||||
where OpenSSL does not know how to build shared libraries the "no-shared"
|
||||
option will be forced and only static libraries will be created.
|
||||
|
||||
Shared libraries are named a little differently on different platforms.
|
||||
One way or another, they all have the major OpenSSL version number as
|
||||
part of the file name, i.e. for OpenSSL 1.1.x, 1.1 is somehow part of
|
||||
the name.
|
||||
|
||||
On most POSIXly platforms, shared libraries are named libcrypto.so.1.1
|
||||
and libssl.so.1.1.
|
||||
|
||||
on Cygwin, shared libraries are named cygcrypto-1.1.dll and cygssl-1.1.dll
|
||||
with import libraries libcrypto.dll.a and libssl.dll.a.
|
||||
|
||||
On Windows build with MSVC or using MingW, shared libraries are named
|
||||
libcrypto-1_1.dll and libssl-1_1.dll for 32-bit Windows, libcrypto-1_1-x64.dll
|
||||
and libssl-1_1-x64.dll for 64-bit x86_64 Windows, and libcrypto-1_1-ia64.dll
|
||||
and libssl-1_1-ia64.dll for IA64 Windows. With MSVC, the import libraries
|
||||
are named libcrypto.lib and libssl.lib, while with MingW, they are named
|
||||
libcrypto.dll.a and libssl.dll.a.
|
||||
|
||||
On VMS, shareable images (VMS speak for shared libraries) are named
|
||||
ossl$libcrypto0101_shr.exe and ossl$libssl0101_shr.exe. However, when
|
||||
OpenSSL is specifically built for 32-bit pointers, the shareable images
|
||||
are named ossl$libcrypto0101_shr32.exe and ossl$libssl0101_shr32.exe
|
||||
instead, and when built for 64-bit pointers, they are named
|
||||
ossl$libcrypto0101_shr64.exe and ossl$libssl0101_shr64.exe.
|
||||
|
||||
Note on random number generation
|
||||
--------------------------------
|
||||
|
||||
Availability of cryptographically secure random numbers is required for
|
||||
secret key generation. OpenSSL provides several options to seed the
|
||||
internal PRNG. If not properly seeded, the internal PRNG will refuse
|
||||
to deliver random bytes and a "PRNG not seeded error" will occur.
|
||||
On systems without /dev/urandom (or similar) device, it may be necessary
|
||||
to install additional support software to obtain a random seed.
|
||||
Please check out the manual pages for RAND_add(), RAND_bytes(), RAND_egd(),
|
||||
and the FAQ for more information.
|
||||
|
||||
125
LICENSE
125
LICENSE
@@ -1,125 +0,0 @@
|
||||
|
||||
LICENSE ISSUES
|
||||
==============
|
||||
|
||||
The OpenSSL toolkit stays under a double license, i.e. both the conditions of
|
||||
the OpenSSL License and the original SSLeay license apply to the toolkit.
|
||||
See below for the actual license texts.
|
||||
|
||||
OpenSSL License
|
||||
---------------
|
||||
|
||||
/* ====================================================================
|
||||
* Copyright (c) 1998-2018 The OpenSSL Project. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* 3. All advertising materials mentioning features or use of this
|
||||
* software must display the following acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
|
||||
*
|
||||
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* prior written permission. For written permission, please contact
|
||||
* openssl-core@openssl.org.
|
||||
*
|
||||
* 5. Products derived from this software may not be called "OpenSSL"
|
||||
* nor may "OpenSSL" appear in their names without prior written
|
||||
* permission of the OpenSSL Project.
|
||||
*
|
||||
* 6. Redistributions of any form whatsoever must retain the following
|
||||
* acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
|
||||
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
|
||||
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
* ====================================================================
|
||||
*
|
||||
* This product includes cryptographic software written by Eric Young
|
||||
* (eay@cryptsoft.com). This product includes software written by Tim
|
||||
* Hudson (tjh@cryptsoft.com).
|
||||
*
|
||||
*/
|
||||
|
||||
Original SSLeay License
|
||||
-----------------------
|
||||
|
||||
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
|
||||
* All rights reserved.
|
||||
*
|
||||
* This package is an SSL implementation written
|
||||
* by Eric Young (eay@cryptsoft.com).
|
||||
* The implementation was written so as to conform with Netscapes SSL.
|
||||
*
|
||||
* This library is free for commercial and non-commercial use as long as
|
||||
* the following conditions are aheared to. The following conditions
|
||||
* apply to all code found in this distribution, be it the RC4, RSA,
|
||||
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
|
||||
* included with this distribution is covered by the same copyright terms
|
||||
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
|
||||
*
|
||||
* Copyright remains Eric Young's, and as such any Copyright notices in
|
||||
* the code are not to be removed.
|
||||
* If this package is used in a product, Eric Young should be given attribution
|
||||
* as the author of the parts of the library used.
|
||||
* This can be in the form of a textual message at program startup or
|
||||
* in documentation (online or textual) provided with the package.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. All advertising materials mentioning features or use of this software
|
||||
* must display the following acknowledgement:
|
||||
* "This product includes cryptographic software written by
|
||||
* Eric Young (eay@cryptsoft.com)"
|
||||
* The word 'cryptographic' can be left out if the rouines from the library
|
||||
* being used are not cryptographic related :-).
|
||||
* 4. If you include any Windows specific code (or a derivative thereof) from
|
||||
* the apps directory (application code) you must include an acknowledgement:
|
||||
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* The licence and distribution terms for any publically available version or
|
||||
* derivative of this code cannot be changed. i.e. this code cannot simply be
|
||||
* copied and put under another distribution licence
|
||||
* [including the GNU Public Licence.]
|
||||
*/
|
||||
|
||||
521
Makefile.shared
521
Makefile.shared
@@ -1,521 +0,0 @@
|
||||
#
|
||||
# Helper makefile to link shared libraries in a portable way.
|
||||
# This is much simpler than libtool, and hopefully not too error-prone.
|
||||
#
|
||||
# The following variables need to be set on the command line to build
|
||||
# properly
|
||||
|
||||
# CC contains the current compiler. This one MUST be defined
|
||||
CC=cc
|
||||
CFLAGS=$(CFLAG)
|
||||
# LDFLAGS contains flags to be used when temporary object files (when building
|
||||
# shared libraries) are created, or when an application is linked.
|
||||
# SHARED_LDFLAGS contains flags to be used when the shared library is created.
|
||||
LDFLAGS=$(LDFLAG)
|
||||
SHARED_LDFLAGS=$(SHARED_LDFLAG)
|
||||
|
||||
RC=windres
|
||||
# SHARED_RCFLAGS are flags used with windres, i.e. when build for Cygwin
|
||||
# or Mingw.
|
||||
SHARED_RCFLAGS=$(SHARED_RCFLAG)
|
||||
|
||||
NM=nm
|
||||
|
||||
# LIBNAME contains just the name of the library, without prefix ("lib"
|
||||
# on Unix, "cyg" for certain forms under Cygwin...) or suffix (.a, .so,
|
||||
# .dll, ...). This one MUST have a value when using this makefile to
|
||||
# build shared libraries.
|
||||
# For example, to build libfoo.so, you need to do the following:
|
||||
#LIBNAME=foo
|
||||
LIBNAME=
|
||||
|
||||
# STLIBNAME contains the path of the static library to build the shared
|
||||
# library from, for example:
|
||||
#STLIBNAME=libfoo.a
|
||||
STLIBNAME=
|
||||
|
||||
# On most Unix platforms, SHLIBNAME contains the path of the short name of
|
||||
# the shared library to build, for example
|
||||
#SHLIBNAME=libfoo.so
|
||||
# On Windows POSIX layers (cygwin and mingw), SHLIBNAME contains the import
|
||||
# library name for the shared library to be built, for example:
|
||||
#SHLIBNAME=libfoo.dll.a
|
||||
|
||||
# SHLIBNAME_FULL contains the path of the full name of the shared library to
|
||||
# build, for example:
|
||||
#SHLIBNAME_FULL=libfoo.so.1.2
|
||||
# When building DSOs, SHLIBNAME_FULL contains path of the full DSO name, for
|
||||
# example:
|
||||
#SHLIBNAME_FULL=dir/dso.so
|
||||
SHLIBNAME_FULL=
|
||||
|
||||
# SHLIBVERSION contains the current version of the shared library (not to
|
||||
# be confused with the project version)
|
||||
#SHLIBVERSION=1.2
|
||||
SHLIBVERSION=
|
||||
|
||||
# NOTE: to build shared libraries, LIBNAME, STLIBNAME, SHLIBNAME and
|
||||
# SHLIBNAME_FULL MUST have values when using this makefile, and in some
|
||||
# cases, SHLIBVERSION as well. To build DSOs, SHLIBNAME_FULL MUST have
|
||||
# a value, the rest can be left alone.
|
||||
|
||||
|
||||
# APPNAME contains just the name of the application, without suffix (""
|
||||
# on Unix, ".exe" on Windows, ...). This one MUST have a value when using
|
||||
# this makefile to build applications.
|
||||
# For example, to build foo, you need to do the following:
|
||||
#APPNAME=foo
|
||||
APPNAME=
|
||||
|
||||
# SRCDIR is the top directory of the source tree.
|
||||
SRCDIR=.
|
||||
|
||||
# OBJECTS contains all the object files to link together into the application.
|
||||
# This must contain at least one object file.
|
||||
#OBJECTS=foo.o
|
||||
OBJECTS=
|
||||
|
||||
# LIBEXTRAS contains extra modules to link together with the library.
|
||||
# For example, if a second library, say libbar.a needs to be linked into
|
||||
# libfoo.so, you need to do the following:
|
||||
#LIBEXTRAS=libbar.a
|
||||
# Note that this MUST be used when using the link_dso targets, to hold the
|
||||
# names of all object files that go into the target shared object.
|
||||
LIBEXTRAS=
|
||||
|
||||
# LIBDEPS contains all the flags necessary to cover all necessary
|
||||
# dependencies to other libraries.
|
||||
LIBDEPS=
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# The rest is private to this makefile.
|
||||
|
||||
SET_X=:
|
||||
#SET_X=set -x
|
||||
|
||||
top:
|
||||
echo "Trying to use this makefile interactively? Don't."
|
||||
|
||||
LINK_APP= \
|
||||
( $(SET_X); \
|
||||
LIBDEPS=$${LIBDEPS:-'$(LIBDEPS)'}; \
|
||||
LDCMD=$${LDCMD:-'$(CC)'}; LDFLAGS=$${LDFLAGS:-'$(CFLAGS) $(LDFLAGS)'}; \
|
||||
LIBPATH=`for x in $$LIBDEPS; do echo $$x; done | sed -e 's/^ *-L//;t' -e d | uniq`; \
|
||||
LIBPATH=`echo $$LIBPATH | sed -e 's/ /:/g'`; \
|
||||
echo LD_LIBRARY_PATH=$$LIBPATH:$$LD_LIBRARY_PATH \
|
||||
$${LDCMD} $${LDFLAGS} -o $${APPNAME:=$(APPNAME)} $(OBJECTS) $${LIBDEPS}; \
|
||||
LD_LIBRARY_PATH=$$LIBPATH:$$LD_LIBRARY_PATH \
|
||||
eval "$${LDCMD} $${LDFLAGS} -o $${APPNAME:=$(APPNAME)} $(OBJECTS) $${LIBDEPS}" )
|
||||
|
||||
LINK_SO= \
|
||||
( $(SET_X); \
|
||||
LIBDEPS=$${LIBDEPS:-'$(LIBDEPS)'}; \
|
||||
SHAREDCMD=$${SHAREDCMD:-'$(CC)'}; \
|
||||
SHAREDFLAGS=$${SHAREDFLAGS:-'$(CFLAGS) $(SHARED_LDFLAGS)'}; \
|
||||
LIBPATH=`for x in $$LIBDEPS; do echo $$x; done | sed -e 's/^ *-L//;t' -e d | uniq`; \
|
||||
LIBPATH=`echo $$LIBPATH | sed -e 's/ /:/g'`; \
|
||||
echo LD_LIBRARY_PATH=$$LIBPATH:$$LD_LIBRARY_PATH \
|
||||
$${SHAREDCMD} $${SHAREDFLAGS} \
|
||||
-o $(SHLIBNAME_FULL) \
|
||||
$$ALLSYMSFLAGS $$SHOBJECTS $$NOALLSYMSFLAGS $$LIBDEPS; \
|
||||
LD_LIBRARY_PATH=$$LIBPATH:$$LD_LIBRARY_PATH \
|
||||
eval "$${SHAREDCMD} $${SHAREDFLAGS} \
|
||||
-o $(SHLIBNAME_FULL) \
|
||||
$$ALLSYMSFLAGS $$SHOBJECTS $$NOALLSYMSFLAGS $$LIBDEPS" \
|
||||
) && $(SYMLINK_SO)
|
||||
|
||||
SYMLINK_SO= \
|
||||
if [ -n "$$INHIBIT_SYMLINKS" ]; then :; else \
|
||||
if [ -n '$(SHLIBNAME_FULL)' -a -n '$(SHLIBNAME)' -a \
|
||||
'$(SHLIBNAME_FULL)' != '$(SHLIBNAME)' ]; then \
|
||||
( $(SET_X); \
|
||||
rm -f $(SHLIBNAME); \
|
||||
ln -s $(SHLIBNAME_FULL) $(SHLIBNAME) ); \
|
||||
fi; \
|
||||
fi
|
||||
|
||||
LINK_SO_SHLIB= SHOBJECTS='$(STLIBNAME) $(LIBEXTRAS)'; $(LINK_SO)
|
||||
LINK_SO_DSO= INHIBIT_SYMLINKS=yes; SHOBJECTS='$(LIBEXTRAS)'; $(LINK_SO)
|
||||
|
||||
LINK_SO_SHLIB_VIA_O= \
|
||||
SHOBJECTS=$(STLIBNAME).o; \
|
||||
ALL=$$ALLSYMSFLAGS; ALLSYMSFLAGS=; NOALLSYMSFLAGS=; \
|
||||
( echo ld $(LDFLAGS) -r -o $$SHOBJECTS $$ALL $(STLIBNAME) $(LIBEXTRAS); \
|
||||
ld $(LDFLAGS) -r -o $$SHOBJECTS $$ALL $(STLIBNAME) $(LIBEXTRAS) ); \
|
||||
$(LINK_SO) && ( echo rm -f $$SHOBJECTS; rm -f $$SHOBJECTS )
|
||||
|
||||
LINK_SO_SHLIB_UNPACKED= \
|
||||
UNPACKDIR=link_tmp.$$$$; rm -rf $$UNPACKDIR; mkdir $$UNPACKDIR; \
|
||||
(cd $$UNPACKDIR; ar x ../$(STLIBNAME)) && \
|
||||
([ -z '$(LIBEXTRAS)' ] || cp $(LIBEXTRAS) $$UNPACKDIR) && \
|
||||
SHOBJECTS=$$UNPACKDIR/*.o; \
|
||||
$(LINK_SO) && rm -rf $$UNPACKDIR
|
||||
|
||||
DETECT_GNU_LD=($(CC) -Wl,-V /dev/null 2>&1 | grep '^GNU ld' )>/dev/null
|
||||
|
||||
DO_GNU_SO_COMMON=\
|
||||
SHAREDFLAGS='$(CFLAGS) $(SHARED_LDFLAGS) -shared -Wl,-Bsymbolic -Wl,-soname=$(SHLIBNAME_FULL)'
|
||||
DO_GNU_DSO=\
|
||||
$(DO_GNU_SO_COMMON)
|
||||
DO_GNU_SO=\
|
||||
ALLSYMSFLAGS='-Wl,--whole-archive'; \
|
||||
NOALLSYMSFLAGS='-Wl,--no-whole-archive'; \
|
||||
$(DO_GNU_SO_COMMON)
|
||||
DO_GNU_APP=LDFLAGS='$(CFLAGS) $(LDFLAGS)'
|
||||
|
||||
#This is rather special. It's a special target with which one can link
|
||||
#applications without bothering with any features that have anything to
|
||||
#do with shared libraries, for example when linking against static
|
||||
#libraries. It's mostly here to avoid a lot of conditionals everywhere
|
||||
#else...
|
||||
link_app.:
|
||||
$(LINK_APP)
|
||||
|
||||
link_dso.gnu:
|
||||
@ $(DO_GNU_DSO); $(LINK_SO_DSO)
|
||||
link_shlib.gnu:
|
||||
@ $(DO_GNU_SO); $(LINK_SO_SHLIB)
|
||||
link_app.gnu:
|
||||
@ $(DO_GNU_APP); $(LINK_APP)
|
||||
|
||||
link_shlib.linux-shared:
|
||||
@$(PERL) $(SRCDIR)/util/mkdef.pl $(LIBNAME) linux >$(LIBNAME).map; \
|
||||
$(DO_GNU_SO); \
|
||||
ALLSYMSFLAGS='-Wl,--whole-archive,--version-script=$(LIBNAME).map'; \
|
||||
$(LINK_SO_SHLIB)
|
||||
|
||||
link_dso.bsd:
|
||||
@if $(DETECT_GNU_LD); then $(DO_GNU_DSO); else \
|
||||
LIBDEPS=' '; \
|
||||
ALLSYMSFLAGS=; \
|
||||
NOALLSYMSFLAGS=; \
|
||||
SHAREDFLAGS='$(CFLAGS) $(SHARED_LDFLAGS) -shared -nostdlib'; \
|
||||
fi; $(LINK_SO_DSO)
|
||||
link_shlib.bsd:
|
||||
@if $(DETECT_GNU_LD); then $(DO_GNU_SO); else \
|
||||
LIBDEPS=' '; \
|
||||
ALLSYMSFLAGS='-Wl,-Bforcearchive'; \
|
||||
NOALLSYMSFLAGS=; \
|
||||
SHAREDFLAGS='$(CFLAGS) $(SHARED_LDFLAGS) -shared -nostdlib'; \
|
||||
fi; $(LINK_SO_SHLIB)
|
||||
link_app.bsd:
|
||||
@if $(DETECT_GNU_LD); then $(DO_GNU_APP); else \
|
||||
LDFLAGS='$(CFLAGS) $(LDFLAGS)'; \
|
||||
fi; $(LINK_APP)
|
||||
|
||||
# For Darwin AKA Mac OS/X (dyld)
|
||||
# Originally link_dso.darwin produced .so, because it was hard-coded
|
||||
# in dso_dlfcn module. At later point dso_dlfcn switched to .dylib
|
||||
# extension in order to allow for run-time linking with vendor-
|
||||
# supplied shared libraries such as libz, so that link_dso.darwin had
|
||||
# to be harmonized with it. This caused minor controversy, because
|
||||
# it was believed that dlopen can't be used to dynamically load
|
||||
# .dylib-s, only so called bundle modules (ones linked with -bundle
|
||||
# flag). The belief seems to be originating from pre-10.4 release,
|
||||
# where dlfcn functionality was emulated by dlcompat add-on. In
|
||||
# 10.4 dlopen was rewritten as native part of dyld and is documented
|
||||
# to be capable of loading both dynamic libraries and bundles. In
|
||||
# order to provide compatibility with pre-10.4 dlopen, modules are
|
||||
# linked with -bundle flag, which makes .dylib extension misleading.
|
||||
# It works, because dlopen is [and always was] extension-agnostic.
|
||||
# Alternative to this heuristic approach is to develop specific
|
||||
# MacOS X dso module relying on whichever "native" dyld interface.
|
||||
link_dso.darwin:
|
||||
@ ALLSYMSFLAGS=''; \
|
||||
NOALLSYMSFLAGS=''; \
|
||||
SHAREDFLAGS='$(CFLAGS) '"`echo '$(SHARED_LDFLAGS)' | sed s/dynamiclib/bundle/`"; \
|
||||
$(LINK_SO_DSO)
|
||||
link_shlib.darwin:
|
||||
@ ALLSYMSFLAGS='-all_load'; \
|
||||
NOALLSYMSFLAGS=''; \
|
||||
SHAREDFLAGS='$(CFLAGS) $(SHARED_LDFLAGS) -current_version $(SHLIBVERSION) -compatibility_version $(SHLIBVERSION) -install_name $(INSTALLTOP)/$(LIBDIR)/$(SHLIBNAME_FULL)'; \
|
||||
$(LINK_SO_SHLIB)
|
||||
link_app.darwin: # is there run-path on darwin?
|
||||
$(LINK_APP)
|
||||
|
||||
link_dso.cygwin:
|
||||
@ALLSYMSFLAGS=''; \
|
||||
NOALLSYMSFLAGS=''; \
|
||||
base=-Wl,--enable-auto-image-base; \
|
||||
SHAREDFLAGS='$(CFLAGS) $(SHARED_LDFLAGS)'" -shared $$base -Wl,-Bsymbolic"; \
|
||||
$(LINK_SO_DSO)
|
||||
link_shlib.cygwin:
|
||||
@ INHIBIT_SYMLINKS=yes; \
|
||||
echo '$(PERL) $(SRCDIR)/util/mkrc.pl $(SHLIBNAME_FULL) |' \
|
||||
'$(RC) $(SHARED_RCFLAGS) -o rc.o'; \
|
||||
$(PERL) $(SRCDIR)/util/mkrc.pl $(SHLIBNAME_FULL) | \
|
||||
$(RC) $(SHARED_RCFLAGS) -o rc.o; \
|
||||
ALLSYMSFLAGS='-Wl,--whole-archive'; \
|
||||
NOALLSYMSFLAGS='-Wl,--no-whole-archive'; \
|
||||
SHAREDFLAGS='$(CFLAGS) $(SHARED_LDFLAGS) -shared -Wl,--enable-auto-image-base -Wl,-Bsymbolic -Wl,--out-implib,$(SHLIBNAME) rc.o'; \
|
||||
$(LINK_SO_SHLIB) || exit 1; \
|
||||
rm rc.o
|
||||
link_app.cygwin:
|
||||
$(LINK_APP)
|
||||
|
||||
# link_dso.mingw-shared and link_app.mingw-shared are mapped to the
|
||||
# corresponding cygwin targets, as they do the exact same thing.
|
||||
link_shlib.mingw:
|
||||
@ INHIBIT_SYMLINKS=yes; \
|
||||
base=; [ '$(LIBNAME)' = 'crypto' -a -n '$(FIPSCANLIB)' ] && base=-Wl,--image-base,0x63000000; \
|
||||
$(PERL) $(SRCDIR)/util/mkdef.pl 32 $(LIBNAME) \
|
||||
| sed -e 's|^\(LIBRARY *\)$(LIBNAME)32|\1$(SHLIBNAME_FULL)|' \
|
||||
> $(LIBNAME).def; \
|
||||
echo '$(PERL) $(SRCDIR)/util/mkrc.pl $(SHLIBNAME_FULL) |' \
|
||||
'$(RC) $(SHARED_RCFLAGS) -o rc.o'; \
|
||||
$(PERL) $(SRCDIR)/util/mkrc.pl $(SHLIBNAME_FULL) | \
|
||||
$(RC) $(SHARED_RCFLAGS) -o rc.o; \
|
||||
ALLSYMSFLAGS='-Wl,--whole-archive'; \
|
||||
NOALLSYMSFLAGS='-Wl,--no-whole-archive'; \
|
||||
SHAREDFLAGS='$(CFLAGS) $(SHARED_LDFLAGS) -shared '"$$base"' -Wl,-Bsymbolic -Wl,--out-implib,$(SHLIBNAME) $(LIBNAME).def rc.o'; \
|
||||
$(LINK_SO_SHLIB) || exit 1; \
|
||||
rm $(LIBNAME).def rc.o
|
||||
|
||||
link_dso.alpha-osf1:
|
||||
@ if $(DETECT_GNU_LD); then \
|
||||
$(DO_GNU_DSO); \
|
||||
else \
|
||||
ALLSYMSFLAGS=''; \
|
||||
NOALLSYMSFLAGS=''; \
|
||||
SHAREDFLAGS='$(CFLAGS) $(SHARED_LDFLAGS) -shared -Wl,-B,symbolic'; \
|
||||
fi; \
|
||||
$(LINK_SO_DSO)
|
||||
link_shlib.alpha-osf1:
|
||||
@ if $(DETECT_GNU_LD); then \
|
||||
$(DO_GNU_SO); \
|
||||
else \
|
||||
ALLSYMSFLAGS='-all'; \
|
||||
NOALLSYMSFLAGS='-none'; \
|
||||
SHAREDFLAGS='$(CFLAGS) $(SHARED_LDFLAGS) -shared -Wl,-B,symbolic -set_version $(SHLIBVERSION)'; \
|
||||
fi; \
|
||||
$(LINK_SO_SHLIB)
|
||||
link_app.alpha-osf1:
|
||||
@if $(DETECT_GNU_LD); then \
|
||||
$(DO_GNU_APP); \
|
||||
else \
|
||||
LDFLAGS='$(CFLAGS) $(LDFLAGS)'; \
|
||||
fi; \
|
||||
$(LINK_APP)
|
||||
|
||||
link_dso.solaris:
|
||||
@ if $(DETECT_GNU_LD); then \
|
||||
$(DO_GNU_DSO); \
|
||||
else \
|
||||
ALLSYMSFLAGS=''; \
|
||||
NOALLSYMSFLAGS=''; \
|
||||
SHAREDFLAGS='$(CFLAGS) $(SHARED_LDFLAGS) -h $(SHLIBNAME_FULL) -Wl,-Bsymbolic'; \
|
||||
fi; \
|
||||
$(LINK_SO_DSO)
|
||||
link_shlib.solaris:
|
||||
@ if $(DETECT_GNU_LD); then \
|
||||
$(DO_GNU_SO); \
|
||||
else \
|
||||
$(PERL) $(SRCDIR)/util/mkdef.pl $(LIBNAME) linux >$(LIBNAME).map; \
|
||||
ALLSYMSFLAGS='-Wl,-z,allextract,-M,$(LIBNAME).map'; \
|
||||
NOALLSYMSFLAGS='-Wl,-z,defaultextract'; \
|
||||
SHAREDFLAGS='$(CFLAGS) $(SHARED_LDFLAGS) -h $(SHLIBNAME_FULL) -Wl,-Bsymbolic'; \
|
||||
fi; \
|
||||
$(LINK_SO_SHLIB)
|
||||
link_app.solaris:
|
||||
@ if $(DETECT_GNU_LD); then \
|
||||
$(DO_GNU_APP); \
|
||||
else \
|
||||
LDFLAGS='$(CFLAGS) $(LDFLAGS)'; \
|
||||
fi; \
|
||||
$(LINK_APP)
|
||||
|
||||
# OpenServer 5 native compilers used
|
||||
link_dso.svr3:
|
||||
@ if $(DETECT_GNU_LD); then \
|
||||
$(DO_GNU_DSO); \
|
||||
else \
|
||||
ALLSYMSFLAGS=''; \
|
||||
NOALLSYMSFLAGS=''; \
|
||||
SHAREDFLAGS='$(CFLAGS) -G -h $(SHLIBNAME_FULL)'; \
|
||||
fi; \
|
||||
$(LINK_SO_DSO)
|
||||
link_shlib.svr3:
|
||||
@ if $(DETECT_GNU_LD); then \
|
||||
$(DO_GNU_SO); \
|
||||
else \
|
||||
ALLSYMSFLAGS=''; \
|
||||
NOALLSYMSFLAGS=''; \
|
||||
SHAREDFLAGS='$(CFLAGS) -G -h $(SHLIBNAME_FULL)'; \
|
||||
fi; \
|
||||
$(LINK_SO_SHLIB_UNPACKED)
|
||||
link_app.svr3:
|
||||
@$(DETECT_GNU_LD) && $(DO_GNU_APP); \
|
||||
$(LINK_APP)
|
||||
|
||||
# UnixWare 7 and OpenUNIX 8 native compilers used
|
||||
link_dso.svr5:
|
||||
@ if $(DETECT_GNU_LD); then \
|
||||
$(DO_GNU_DSO); \
|
||||
else \
|
||||
SHARE_FLAG='-G'; \
|
||||
($(CC) -v 2>&1 | grep gcc) > /dev/null && SHARE_FLAG='-shared'; \
|
||||
ALLSYMSFLAGS=''; \
|
||||
NOALLSYMSFLAGS=''; \
|
||||
SHAREDFLAGS='$(CFLAGS) '"$${SHARE_FLAG}"' -h $(SHLIBNAME_FULL)'; \
|
||||
fi; \
|
||||
$(LINK_SO_DSO)
|
||||
link_shlib.svr5:
|
||||
@ if $(DETECT_GNU_LD); then \
|
||||
$(DO_GNU_SO); \
|
||||
else \
|
||||
SHARE_FLAG='-G'; \
|
||||
($(CC) -v 2>&1 | grep gcc) > /dev/null && SHARE_FLAG='-shared'; \
|
||||
ALLSYMSFLAGS=''; \
|
||||
NOALLSYMSFLAGS=''; \
|
||||
SHAREDFLAGS='$(CFLAGS) '"$${SHARE_FLAG}"' -h $(SHLIBNAME_FULL)'; \
|
||||
fi; \
|
||||
$(LINK_SO_SHLIB_UNPACKED)
|
||||
link_app.svr5:
|
||||
@$(DETECT_GNU_LD) && $(DO_GNU_APP); \
|
||||
$(LINK_APP)
|
||||
|
||||
link_dso.irix:
|
||||
@ if $(DETECT_GNU_LD); then \
|
||||
$(DO_GNU_DSO); \
|
||||
else \
|
||||
ALLSYMSFLAGS=''; \
|
||||
NOALLSYMSFLAGS=''; \
|
||||
SHAREDFLAGS='$(CFLAGS) $(SHARED_LDFLAGS) -shared -Wl,-soname,$(SHLIBNAME_FULL),-B,symbolic'; \
|
||||
fi; \
|
||||
$(LINK_SO_DSO)
|
||||
link_shlib.irix:
|
||||
@ if $(DETECT_GNU_LD); then \
|
||||
$(DO_GNU_SO); \
|
||||
else \
|
||||
MINUSWL=''; \
|
||||
($(CC) -v 2>&1 | grep gcc) > /dev/null && MINUSWL='-Wl,'; \
|
||||
ALLSYMSFLAGS="$${MINUSWL}-all"; \
|
||||
NOALLSYMSFLAGS="$${MINUSWL}-none"; \
|
||||
SHAREDFLAGS='$(CFLAGS) $(SHARED_LDFLAGS) -shared -Wl,-soname,$(SHLIBNAME_FULL),-B,symbolic'; \
|
||||
fi; \
|
||||
$(LINK_SO_SHLIB)
|
||||
link_app.irix:
|
||||
@LDFLAGS='$(CFLAGS) $(LDFLAGS)'; \
|
||||
$(LINK_APP)
|
||||
|
||||
# 32-bit PA-RISC HP-UX embeds the -L pathname of libs we link with, so
|
||||
# we compensate for it with +cdp ../: and +cdp ./:. Yes, these rewrite
|
||||
# rules imply that we can only link one level down in catalog structure,
|
||||
# but that's what takes place for the moment of this writing. +cdp option
|
||||
# was introduced in HP-UX 11.x and applies in 32-bit PA-RISC link
|
||||
# editor context only [it's simply ignored in other cases, which are all
|
||||
# ELFs by the way].
|
||||
#
|
||||
link_dso.hpux:
|
||||
@if $(DETECT_GNU_LD); then $(DO_GNU_DSO); else \
|
||||
ALLSYMSFLAGS=''; \
|
||||
NOALLSYMSFLAGS=''; \
|
||||
expr $(PLATFORM) : 'hpux64' > /dev/null && ALLSYMSFLAGS='-Wl,+forceload'; \
|
||||
SHAREDFLAGS='$(CFLAGS) $(SHARED_LDFLAGS) -Wl,-B,symbolic,+vnocompatwarnings,-z,+s,+h,$(SHLIBNAME_FULL),+cdp,../:,+cdp,./:'; \
|
||||
fi; \
|
||||
rm -f $(SHLIBNAME_FULL) || :; \
|
||||
$(LINK_SO_DSO) && chmod a=rx $(SHLIBNAME_FULL)
|
||||
link_shlib.hpux:
|
||||
@if $(DETECT_GNU_LD); then $(DO_GNU_SO); else \
|
||||
ALLSYMSFLAGS='-Wl,-Fl'; \
|
||||
NOALLSYMSFLAGS=''; \
|
||||
expr $(PLATFORM) : 'hpux64' > /dev/null && ALLSYMSFLAGS='-Wl,+forceload'; \
|
||||
SHAREDFLAGS='$(CFLAGS) $(SHARED_LDFLAGS) -Wl,-B,symbolic,+vnocompatwarnings,-z,+s,+h,$(SHLIBNAME_FULL),+cdp,../:,+cdp,./:'; \
|
||||
fi; \
|
||||
rm -f $(SHLIBNAME_FULL) || :; \
|
||||
$(LINK_SO_SHLIB) && chmod a=rx $(SHLIBNAME_FULL)
|
||||
link_app.hpux:
|
||||
@if $(DETECT_GNU_LD); then $(DO_GNU_APP); else \
|
||||
LDFLAGS='$(CFLAGS) $(LDFLAGS) -Wl,+s,+cdp,../:,+cdp,./:'; \
|
||||
fi; \
|
||||
$(LINK_APP)
|
||||
|
||||
link_dso.aix:
|
||||
@OBJECT_MODE=`expr 'x$(SHARED_LDFLAGS)' : 'x\-[a-z]*\(64\)'` || :; \
|
||||
OBJECT_MODE=$${OBJECT_MODE:-32}; export OBJECT_MODE; \
|
||||
ALLSYMSFLAGS=''; \
|
||||
NOALLSYMSFLAGS=''; \
|
||||
SHAREDFLAGS='$(CFLAGS) $(SHARED_LDFLAGS) -Wl,-bexpall,-bnolibpath,-bM:SRE'; \
|
||||
rm -f $(SHLIBNAME_FULL) 2>&1 > /dev/null ; \
|
||||
$(LINK_SO_DSO);
|
||||
link_shlib.aix:
|
||||
@ OBJECT_MODE=`expr 'x$(SHARED_LDFLAGS)' : 'x\-[a-z]*\(64\)'` || : ; \
|
||||
OBJECT_MODE=$${OBJECT_MODE:-32}; export OBJECT_MODE; \
|
||||
ALLSYMSFLAGS='-bnogc'; \
|
||||
NOALLSYMSFLAGS=''; \
|
||||
SHAREDFLAGS='$(CFLAGS) $(SHARED_LDFLAGS) -Wl,-bexpall,-bnolibpath,-bM:SRE'; \
|
||||
rm -f $(SHLIBNAME_FULL) 2>&1 > /dev/null ; \
|
||||
$(LINK_SO_SHLIB_VIA_O)
|
||||
link_app.aix:
|
||||
LDFLAGS='$(CFLAGS) -Wl,-bsvr4 $(LDFLAGS)'; \
|
||||
$(LINK_APP)
|
||||
|
||||
|
||||
# Targets to build symbolic links when needed
|
||||
symlink.gnu symlink.solaris symlink.svr3 symlink.svr5 symlink.irix \
|
||||
symlink.aix:
|
||||
@ $(SYMLINK_SO)
|
||||
symlink.darwin:
|
||||
@ $(SYMLINK_SO)
|
||||
symlink.hpux:
|
||||
@ $(SYMLINK_SO)
|
||||
# The following lines means those specific architectures do no symlinks
|
||||
symlink.cygwin symlink.alpha-osf1 symlink.tru64 symlink.tru64-rpath:
|
||||
|
||||
# Compatibility targets
|
||||
link_dso.bsd-gcc-shared link_dso.linux-shared link_dso.gnu-shared: link_dso.gnu
|
||||
link_shlib.bsd-gcc-shared: link_shlib.linux-shared
|
||||
link_shlib.gnu-shared: link_shlib.gnu
|
||||
link_app.bsd-gcc-shared link_app.linux-shared link_app.gnu-shared: link_app.gnu
|
||||
symlink.bsd-gcc-shared symlink.bsd-shared symlink.linux-shared symlink.gnu-shared: symlink.gnu
|
||||
link_dso.bsd-shared: link_dso.bsd
|
||||
link_shlib.bsd-shared: link_shlib.bsd
|
||||
link_app.bsd-shared: link_app.bsd
|
||||
link_dso.darwin-shared: link_dso.darwin
|
||||
link_shlib.darwin-shared: link_shlib.darwin
|
||||
link_app.darwin-shared: link_app.darwin
|
||||
symlink.darwin-shared: symlink.darwin
|
||||
link_dso.cygwin-shared: link_dso.cygwin
|
||||
link_shlib.cygwin-shared: link_shlib.cygwin
|
||||
link_app.cygwin-shared: link_app.cygwin
|
||||
symlink.cygwin-shared: symlink.cygwin
|
||||
link_dso.mingw-shared: link_dso.cygwin
|
||||
link_shlib.mingw-shared: link_shlib.mingw
|
||||
link_app.mingw-shared: link_app.cygwin
|
||||
symlink.mingw-shared: symlink.cygwin
|
||||
link_dso.alpha-osf1-shared: link_dso.alpha-osf1
|
||||
link_shlib.alpha-osf1-shared: link_shlib.alpha-osf1
|
||||
link_app.alpha-osf1-shared: link_app.alpha-osf1
|
||||
symlink.alpha-osf1-shared: symlink.alpha-osf1
|
||||
link_dso.tru64-shared: link_dso.tru64
|
||||
link_shlib.tru64-shared: link_shlib.tru64
|
||||
link_app.tru64-shared: link_app.tru64
|
||||
symlink.tru64-shared: symlink.tru64
|
||||
link_dso.tru64-shared-rpath: link_dso.tru64-rpath
|
||||
link_shlib.tru64-shared-rpath: link_shlib.tru64-rpath
|
||||
link_app.tru64-shared-rpath: link_app.tru64-rpath
|
||||
symlink.tru64-shared-rpath: symlink.tru64-rpath
|
||||
link_dso.solaris-shared: link_dso.solaris
|
||||
link_shlib.solaris-shared: link_shlib.solaris
|
||||
link_app.solaris-shared: link_app.solaris
|
||||
symlink.solaris-shared: symlink.solaris
|
||||
link_dso.svr3-shared: link_dso.svr3
|
||||
link_shlib.svr3-shared: link_shlib.svr3
|
||||
link_app.svr3-shared: link_app.svr3
|
||||
symlink.svr3-shared: symlink.svr3
|
||||
link_dso.svr5-shared: link_dso.svr5
|
||||
link_shlib.svr5-shared: link_shlib.svr5
|
||||
link_app.svr5-shared: link_app.svr5
|
||||
symlink.svr5-shared: symlink.svr5
|
||||
link_dso.irix-shared: link_dso.irix
|
||||
link_shlib.irix-shared: link_shlib.irix
|
||||
link_app.irix-shared: link_app.irix
|
||||
symlink.irix-shared: symlink.irix
|
||||
link_dso.hpux-shared: link_dso.hpux
|
||||
link_shlib.hpux-shared: link_shlib.hpux
|
||||
link_app.hpux-shared: link_app.hpux
|
||||
symlink.hpux-shared: symlink.hpux
|
||||
link_dso.aix-shared: link_dso.aix
|
||||
link_shlib.aix-shared: link_shlib.aix
|
||||
link_app.aix-shared: link_app.aix
|
||||
symlink.aix-shared: symlink.aix
|
||||
892
NEWS
892
NEWS
@@ -1,892 +0,0 @@
|
||||
|
||||
NEWS
|
||||
====
|
||||
|
||||
This file gives a brief overview of the major changes between each OpenSSL
|
||||
release. For more details please read the CHANGES file.
|
||||
|
||||
Major changes between OpenSSL 1.1.0k and OpenSSL 1.1.0l [10 Sep 2019]
|
||||
|
||||
o Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey
|
||||
(CVE-2019-1563)
|
||||
o For built-in EC curves, ensure an EC_GROUP built from the curve name is
|
||||
used even when parsing explicit parameters
|
||||
o Compute ECC cofactors if not provided during EC_GROUP construction
|
||||
(CVE-2019-1547)
|
||||
o Use Windows installation paths in the mingw builds (CVE-2019-1552)
|
||||
|
||||
Major changes between OpenSSL 1.1.0j and OpenSSL 1.1.0k [28 May 2019]
|
||||
|
||||
o Prevent over long nonces in ChaCha20-Poly1305 (CVE-2019-1543)
|
||||
|
||||
Major changes between OpenSSL 1.1.0i and OpenSSL 1.1.0j [20 Nov 2018]
|
||||
|
||||
o Timing vulnerability in DSA signature generation (CVE-2018-0734)
|
||||
o Timing vulnerability in ECDSA signature generation (CVE-2018-0735)
|
||||
|
||||
Major changes between OpenSSL 1.1.0h and OpenSSL 1.1.0i [14 Aug 2018]
|
||||
|
||||
o Client DoS due to large DH parameter (CVE-2018-0732)
|
||||
o Cache timing vulnerability in RSA Key Generation (CVE-2018-0737)
|
||||
|
||||
Major changes between OpenSSL 1.1.0g and OpenSSL 1.1.0h [27 Mar 2018]
|
||||
|
||||
o Constructed ASN.1 types with a recursive definition could exceed the
|
||||
stack (CVE-2018-0739)
|
||||
o Incorrect CRYPTO_memcmp on HP-UX PA-RISC (CVE-2018-0733)
|
||||
o rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)
|
||||
|
||||
Major changes between OpenSSL 1.1.0f and OpenSSL 1.1.0g [2 Nov 2017]
|
||||
|
||||
o bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)
|
||||
o Malformed X.509 IPAddressFamily could cause OOB read (CVE-2017-3735)
|
||||
|
||||
Major changes between OpenSSL 1.1.0e and OpenSSL 1.1.0f [25 May 2017]
|
||||
|
||||
o config now recognises 64-bit mingw and chooses mingw64 instead of mingw
|
||||
|
||||
Major changes between OpenSSL 1.1.0d and OpenSSL 1.1.0e [16 Feb 2017]
|
||||
|
||||
o Encrypt-Then-Mac renegotiation crash (CVE-2017-3733)
|
||||
|
||||
Major changes between OpenSSL 1.1.0c and OpenSSL 1.1.0d [26 Jan 2017]
|
||||
|
||||
o Truncated packet could crash via OOB read (CVE-2017-3731)
|
||||
o Bad (EC)DHE parameters cause a client crash (CVE-2017-3730)
|
||||
o BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)
|
||||
|
||||
Major changes between OpenSSL 1.1.0b and OpenSSL 1.1.0c [10 Nov 2016]
|
||||
|
||||
o ChaCha20/Poly1305 heap-buffer-overflow (CVE-2016-7054)
|
||||
o CMS Null dereference (CVE-2016-7053)
|
||||
o Montgomery multiplication may produce incorrect results (CVE-2016-7055)
|
||||
|
||||
Major changes between OpenSSL 1.1.0a and OpenSSL 1.1.0b [26 Sep 2016]
|
||||
|
||||
o Fix Use After Free for large message sizes (CVE-2016-6309)
|
||||
|
||||
Major changes between OpenSSL 1.1.0 and OpenSSL 1.1.0a [22 Sep 2016]
|
||||
|
||||
o OCSP Status Request extension unbounded memory growth (CVE-2016-6304)
|
||||
o SSL_peek() hang on empty record (CVE-2016-6305)
|
||||
o Excessive allocation of memory in tls_get_message_header()
|
||||
(CVE-2016-6307)
|
||||
o Excessive allocation of memory in dtls1_preprocess_fragment()
|
||||
(CVE-2016-6308)
|
||||
|
||||
Major changes between OpenSSL 1.0.2h and OpenSSL 1.1.0 [25 Aug 2016]
|
||||
|
||||
o Copyright text was shrunk to a boilerplate that points to the license
|
||||
o "shared" builds are now the default when possible
|
||||
o Added support for "pipelining"
|
||||
o Added the AFALG engine
|
||||
o New threading API implemented
|
||||
o Support for ChaCha20 and Poly1305 added to libcrypto and libssl
|
||||
o Support for extended master secret
|
||||
o CCM ciphersuites
|
||||
o Reworked test suite, now based on perl, Test::Harness and Test::More
|
||||
o *Most* libcrypto and libssl public structures were made opaque,
|
||||
including:
|
||||
BIGNUM and associated types, EC_KEY and EC_KEY_METHOD,
|
||||
DH and DH_METHOD, DSA and DSA_METHOD, RSA and RSA_METHOD,
|
||||
BIO and BIO_METHOD, EVP_MD_CTX, EVP_MD, EVP_CIPHER_CTX,
|
||||
EVP_CIPHER, EVP_PKEY and associated types, HMAC_CTX,
|
||||
X509, X509_CRL, X509_OBJECT, X509_STORE_CTX, X509_STORE,
|
||||
X509_LOOKUP, X509_LOOKUP_METHOD
|
||||
o libssl internal structures made opaque
|
||||
o SSLv2 support removed
|
||||
o Kerberos ciphersuite support removed
|
||||
o RC4 removed from DEFAULT ciphersuites in libssl
|
||||
o 40 and 56 bit cipher support removed from libssl
|
||||
o All public header files moved to include/openssl, no more symlinking
|
||||
o SSL/TLS state machine, version negotiation and record layer rewritten
|
||||
o EC revision: now operations use new EC_KEY_METHOD.
|
||||
o Support for OCB mode added to libcrypto
|
||||
o Support for asynchronous crypto operations added to libcrypto and libssl
|
||||
o Deprecated interfaces can now be disabled at build time either
|
||||
relative to the latest release via the "no-deprecated" Configure
|
||||
argument, or via the "--api=1.1.0|1.0.0|0.9.8" option.
|
||||
o Application software can be compiled with -DOPENSSL_API_COMPAT=version
|
||||
to ensure that features deprecated in that version are not exposed.
|
||||
o Support for RFC6698/RFC7671 DANE TLSA peer authentication
|
||||
o Change of Configure to use --prefix as the main installation
|
||||
directory location rather than --openssldir. The latter becomes
|
||||
the directory for certs, private key and openssl.cnf exclusively.
|
||||
o Reworked BIO networking library, with full support for IPv6.
|
||||
o New "unified" build system
|
||||
o New security levels
|
||||
o Support for scrypt algorithm
|
||||
o Support for X25519
|
||||
o Extended SSL_CONF support using configuration files
|
||||
o KDF algorithm support. Implement TLS PRF as a KDF.
|
||||
o Support for Certificate Transparency
|
||||
o HKDF support.
|
||||
|
||||
Major changes between OpenSSL 1.0.2g and OpenSSL 1.0.2h [3 May 2016]
|
||||
|
||||
o Prevent padding oracle in AES-NI CBC MAC check (CVE-2016-2107)
|
||||
o Fix EVP_EncodeUpdate overflow (CVE-2016-2105)
|
||||
o Fix EVP_EncryptUpdate overflow (CVE-2016-2106)
|
||||
o Prevent ASN.1 BIO excessive memory allocation (CVE-2016-2109)
|
||||
o EBCDIC overread (CVE-2016-2176)
|
||||
o Modify behavior of ALPN to invoke callback after SNI/servername
|
||||
callback, such that updates to the SSL_CTX affect ALPN.
|
||||
o Remove LOW from the DEFAULT cipher list. This removes singles DES from
|
||||
the default.
|
||||
o Only remove the SSLv2 methods with the no-ssl2-method option.
|
||||
|
||||
Major changes between OpenSSL 1.0.2f and OpenSSL 1.0.2g [1 Mar 2016]
|
||||
|
||||
o Disable weak ciphers in SSLv3 and up in default builds of OpenSSL.
|
||||
o Disable SSLv2 default build, default negotiation and weak ciphers
|
||||
(CVE-2016-0800)
|
||||
o Fix a double-free in DSA code (CVE-2016-0705)
|
||||
o Disable SRP fake user seed to address a server memory leak
|
||||
(CVE-2016-0798)
|
||||
o Fix BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption
|
||||
(CVE-2016-0797)
|
||||
o Fix memory issues in BIO_*printf functions (CVE-2016-0799)
|
||||
o Fix side channel attack on modular exponentiation (CVE-2016-0702)
|
||||
|
||||
Major changes between OpenSSL 1.0.2e and OpenSSL 1.0.2f [28 Jan 2016]
|
||||
|
||||
o DH small subgroups (CVE-2016-0701)
|
||||
o SSLv2 doesn't block disabled ciphers (CVE-2015-3197)
|
||||
|
||||
Major changes between OpenSSL 1.0.2d and OpenSSL 1.0.2e [3 Dec 2015]
|
||||
|
||||
o BN_mod_exp may produce incorrect results on x86_64 (CVE-2015-3193)
|
||||
o Certificate verify crash with missing PSS parameter (CVE-2015-3194)
|
||||
o X509_ATTRIBUTE memory leak (CVE-2015-3195)
|
||||
o Rewrite EVP_DecodeUpdate (base64 decoding) to fix several bugs
|
||||
o In DSA_generate_parameters_ex, if the provided seed is too short,
|
||||
return an error
|
||||
|
||||
Major changes between OpenSSL 1.0.2c and OpenSSL 1.0.2d [9 Jul 2015]
|
||||
|
||||
o Alternate chains certificate forgery (CVE-2015-1793)
|
||||
o Race condition handling PSK identify hint (CVE-2015-3196)
|
||||
|
||||
Major changes between OpenSSL 1.0.2b and OpenSSL 1.0.2c [12 Jun 2015]
|
||||
|
||||
o Fix HMAC ABI incompatibility
|
||||
|
||||
Major changes between OpenSSL 1.0.2a and OpenSSL 1.0.2b [11 Jun 2015]
|
||||
|
||||
o Malformed ECParameters causes infinite loop (CVE-2015-1788)
|
||||
o Exploitable out-of-bounds read in X509_cmp_time (CVE-2015-1789)
|
||||
o PKCS7 crash with missing EnvelopedContent (CVE-2015-1790)
|
||||
o CMS verify infinite loop with unknown hash function (CVE-2015-1792)
|
||||
o Race condition handling NewSessionTicket (CVE-2015-1791)
|
||||
|
||||
Major changes between OpenSSL 1.0.2 and OpenSSL 1.0.2a [19 Mar 2015]
|
||||
|
||||
o OpenSSL 1.0.2 ClientHello sigalgs DoS fix (CVE-2015-0291)
|
||||
o Multiblock corrupted pointer fix (CVE-2015-0290)
|
||||
o Segmentation fault in DTLSv1_listen fix (CVE-2015-0207)
|
||||
o Segmentation fault in ASN1_TYPE_cmp fix (CVE-2015-0286)
|
||||
o Segmentation fault for invalid PSS parameters fix (CVE-2015-0208)
|
||||
o ASN.1 structure reuse memory corruption fix (CVE-2015-0287)
|
||||
o PKCS7 NULL pointer dereferences fix (CVE-2015-0289)
|
||||
o DoS via reachable assert in SSLv2 servers fix (CVE-2015-0293)
|
||||
o Empty CKE with client auth and DHE fix (CVE-2015-1787)
|
||||
o Handshake with unseeded PRNG fix (CVE-2015-0285)
|
||||
o Use After Free following d2i_ECPrivatekey error fix (CVE-2015-0209)
|
||||
o X509_to_X509_REQ NULL pointer deref fix (CVE-2015-0288)
|
||||
o Removed the export ciphers from the DEFAULT ciphers
|
||||
|
||||
Major changes between OpenSSL 1.0.1l and OpenSSL 1.0.2 [22 Jan 2015]:
|
||||
|
||||
o Suite B support for TLS 1.2 and DTLS 1.2
|
||||
o Support for DTLS 1.2
|
||||
o TLS automatic EC curve selection.
|
||||
o API to set TLS supported signature algorithms and curves
|
||||
o SSL_CONF configuration API.
|
||||
o TLS Brainpool support.
|
||||
o ALPN support.
|
||||
o CMS support for RSA-PSS, RSA-OAEP, ECDH and X9.42 DH.
|
||||
|
||||
Major changes between OpenSSL 1.0.1k and OpenSSL 1.0.1l [15 Jan 2015]
|
||||
|
||||
o Build fixes for the Windows and OpenVMS platforms
|
||||
|
||||
Major changes between OpenSSL 1.0.1j and OpenSSL 1.0.1k [8 Jan 2015]
|
||||
|
||||
o Fix for CVE-2014-3571
|
||||
o Fix for CVE-2015-0206
|
||||
o Fix for CVE-2014-3569
|
||||
o Fix for CVE-2014-3572
|
||||
o Fix for CVE-2015-0204
|
||||
o Fix for CVE-2015-0205
|
||||
o Fix for CVE-2014-8275
|
||||
o Fix for CVE-2014-3570
|
||||
|
||||
Major changes between OpenSSL 1.0.1i and OpenSSL 1.0.1j [15 Oct 2014]
|
||||
|
||||
o Fix for CVE-2014-3513
|
||||
o Fix for CVE-2014-3567
|
||||
o Mitigation for CVE-2014-3566 (SSL protocol vulnerability)
|
||||
o Fix for CVE-2014-3568
|
||||
|
||||
Major changes between OpenSSL 1.0.1h and OpenSSL 1.0.1i [6 Aug 2014]
|
||||
|
||||
o Fix for CVE-2014-3512
|
||||
o Fix for CVE-2014-3511
|
||||
o Fix for CVE-2014-3510
|
||||
o Fix for CVE-2014-3507
|
||||
o Fix for CVE-2014-3506
|
||||
o Fix for CVE-2014-3505
|
||||
o Fix for CVE-2014-3509
|
||||
o Fix for CVE-2014-5139
|
||||
o Fix for CVE-2014-3508
|
||||
|
||||
Major changes between OpenSSL 1.0.1g and OpenSSL 1.0.1h [5 Jun 2014]
|
||||
|
||||
o Fix for CVE-2014-0224
|
||||
o Fix for CVE-2014-0221
|
||||
o Fix for CVE-2014-0198
|
||||
o Fix for CVE-2014-0195
|
||||
o Fix for CVE-2014-3470
|
||||
o Fix for CVE-2010-5298
|
||||
|
||||
Major changes between OpenSSL 1.0.1f and OpenSSL 1.0.1g [7 Apr 2014]
|
||||
|
||||
o Fix for CVE-2014-0160
|
||||
o Add TLS padding extension workaround for broken servers.
|
||||
o Fix for CVE-2014-0076
|
||||
|
||||
Major changes between OpenSSL 1.0.1e and OpenSSL 1.0.1f [6 Jan 2014]
|
||||
|
||||
o Don't include gmt_unix_time in TLS server and client random values
|
||||
o Fix for TLS record tampering bug CVE-2013-4353
|
||||
o Fix for TLS version checking bug CVE-2013-6449
|
||||
o Fix for DTLS retransmission bug CVE-2013-6450
|
||||
|
||||
Major changes between OpenSSL 1.0.1d and OpenSSL 1.0.1e [11 Feb 2013]:
|
||||
|
||||
o Corrected fix for CVE-2013-0169
|
||||
|
||||
Major changes between OpenSSL 1.0.1c and OpenSSL 1.0.1d [4 Feb 2013]:
|
||||
|
||||
o Fix renegotiation in TLS 1.1, 1.2 by using the correct TLS version.
|
||||
o Include the fips configuration module.
|
||||
o Fix OCSP bad key DoS attack CVE-2013-0166
|
||||
o Fix for SSL/TLS/DTLS CBC plaintext recovery attack CVE-2013-0169
|
||||
o Fix for TLS AESNI record handling flaw CVE-2012-2686
|
||||
|
||||
Major changes between OpenSSL 1.0.1b and OpenSSL 1.0.1c [10 May 2012]:
|
||||
|
||||
o Fix TLS/DTLS record length checking bug CVE-2012-2333
|
||||
o Don't attempt to use non-FIPS composite ciphers in FIPS mode.
|
||||
|
||||
Major changes between OpenSSL 1.0.1a and OpenSSL 1.0.1b [26 Apr 2012]:
|
||||
|
||||
o Fix compilation error on non-x86 platforms.
|
||||
o Make FIPS capable OpenSSL ciphers work in non-FIPS mode.
|
||||
o Fix SSL_OP_NO_TLSv1_1 clash with SSL_OP_ALL in OpenSSL 1.0.0
|
||||
|
||||
Major changes between OpenSSL 1.0.1 and OpenSSL 1.0.1a [19 Apr 2012]:
|
||||
|
||||
o Fix for ASN1 overflow bug CVE-2012-2110
|
||||
o Workarounds for some servers that hang on long client hellos.
|
||||
o Fix SEGV in AES code.
|
||||
|
||||
Major changes between OpenSSL 1.0.0h and OpenSSL 1.0.1 [14 Mar 2012]:
|
||||
|
||||
o TLS/DTLS heartbeat support.
|
||||
o SCTP support.
|
||||
o RFC 5705 TLS key material exporter.
|
||||
o RFC 5764 DTLS-SRTP negotiation.
|
||||
o Next Protocol Negotiation.
|
||||
o PSS signatures in certificates, requests and CRLs.
|
||||
o Support for password based recipient info for CMS.
|
||||
o Support TLS v1.2 and TLS v1.1.
|
||||
o Preliminary FIPS capability for unvalidated 2.0 FIPS module.
|
||||
o SRP support.
|
||||
|
||||
Major changes between OpenSSL 1.0.0g and OpenSSL 1.0.0h [12 Mar 2012]:
|
||||
|
||||
o Fix for CMS/PKCS#7 MMA CVE-2012-0884
|
||||
o Corrected fix for CVE-2011-4619
|
||||
o Various DTLS fixes.
|
||||
|
||||
Major changes between OpenSSL 1.0.0f and OpenSSL 1.0.0g [18 Jan 2012]:
|
||||
|
||||
o Fix for DTLS DoS issue CVE-2012-0050
|
||||
|
||||
Major changes between OpenSSL 1.0.0e and OpenSSL 1.0.0f [4 Jan 2012]:
|
||||
|
||||
o Fix for DTLS plaintext recovery attack CVE-2011-4108
|
||||
o Clear block padding bytes of SSL 3.0 records CVE-2011-4576
|
||||
o Only allow one SGC handshake restart for SSL/TLS CVE-2011-4619
|
||||
o Check parameters are not NULL in GOST ENGINE CVE-2012-0027
|
||||
o Check for malformed RFC3779 data CVE-2011-4577
|
||||
|
||||
Major changes between OpenSSL 1.0.0d and OpenSSL 1.0.0e [6 Sep 2011]:
|
||||
|
||||
o Fix for CRL vulnerability issue CVE-2011-3207
|
||||
o Fix for ECDH crashes CVE-2011-3210
|
||||
o Protection against EC timing attacks.
|
||||
o Support ECDH ciphersuites for certificates using SHA2 algorithms.
|
||||
o Various DTLS fixes.
|
||||
|
||||
Major changes between OpenSSL 1.0.0c and OpenSSL 1.0.0d [8 Feb 2011]:
|
||||
|
||||
o Fix for security issue CVE-2011-0014
|
||||
|
||||
Major changes between OpenSSL 1.0.0b and OpenSSL 1.0.0c [2 Dec 2010]:
|
||||
|
||||
o Fix for security issue CVE-2010-4180
|
||||
o Fix for CVE-2010-4252
|
||||
o Fix mishandling of absent EC point format extension.
|
||||
o Fix various platform compilation issues.
|
||||
o Corrected fix for security issue CVE-2010-3864.
|
||||
|
||||
Major changes between OpenSSL 1.0.0a and OpenSSL 1.0.0b [16 Nov 2010]:
|
||||
|
||||
o Fix for security issue CVE-2010-3864.
|
||||
o Fix for CVE-2010-2939
|
||||
o Fix WIN32 build system for GOST ENGINE.
|
||||
|
||||
Major changes between OpenSSL 1.0.0 and OpenSSL 1.0.0a [1 Jun 2010]:
|
||||
|
||||
o Fix for security issue CVE-2010-1633.
|
||||
o GOST MAC and CFB fixes.
|
||||
|
||||
Major changes between OpenSSL 0.9.8n and OpenSSL 1.0.0 [29 Mar 2010]:
|
||||
|
||||
o RFC3280 path validation: sufficient to process PKITS tests.
|
||||
o Integrated support for PVK files and keyblobs.
|
||||
o Change default private key format to PKCS#8.
|
||||
o CMS support: able to process all examples in RFC4134
|
||||
o Streaming ASN1 encode support for PKCS#7 and CMS.
|
||||
o Multiple signer and signer add support for PKCS#7 and CMS.
|
||||
o ASN1 printing support.
|
||||
o Whirlpool hash algorithm added.
|
||||
o RFC3161 time stamp support.
|
||||
o New generalised public key API supporting ENGINE based algorithms.
|
||||
o New generalised public key API utilities.
|
||||
o New ENGINE supporting GOST algorithms.
|
||||
o SSL/TLS GOST ciphersuite support.
|
||||
o PKCS#7 and CMS GOST support.
|
||||
o RFC4279 PSK ciphersuite support.
|
||||
o Supported points format extension for ECC ciphersuites.
|
||||
o ecdsa-with-SHA224/256/384/512 signature types.
|
||||
o dsa-with-SHA224 and dsa-with-SHA256 signature types.
|
||||
o Opaque PRF Input TLS extension support.
|
||||
o Updated time routines to avoid OS limitations.
|
||||
|
||||
Major changes between OpenSSL 0.9.8m and OpenSSL 0.9.8n [24 Mar 2010]:
|
||||
|
||||
o CFB cipher definition fixes.
|
||||
o Fix security issues CVE-2010-0740 and CVE-2010-0433.
|
||||
|
||||
Major changes between OpenSSL 0.9.8l and OpenSSL 0.9.8m [25 Feb 2010]:
|
||||
|
||||
o Cipher definition fixes.
|
||||
o Workaround for slow RAND_poll() on some WIN32 versions.
|
||||
o Remove MD2 from algorithm tables.
|
||||
o SPKAC handling fixes.
|
||||
o Support for RFC5746 TLS renegotiation extension.
|
||||
o Compression memory leak fixed.
|
||||
o Compression session resumption fixed.
|
||||
o Ticket and SNI coexistence fixes.
|
||||
o Many fixes to DTLS handling.
|
||||
|
||||
Major changes between OpenSSL 0.9.8k and OpenSSL 0.9.8l [5 Nov 2009]:
|
||||
|
||||
o Temporary work around for CVE-2009-3555: disable renegotiation.
|
||||
|
||||
Major changes between OpenSSL 0.9.8j and OpenSSL 0.9.8k [25 Mar 2009]:
|
||||
|
||||
o Fix various build issues.
|
||||
o Fix security issues (CVE-2009-0590, CVE-2009-0591, CVE-2009-0789)
|
||||
|
||||
Major changes between OpenSSL 0.9.8i and OpenSSL 0.9.8j [7 Jan 2009]:
|
||||
|
||||
o Fix security issue (CVE-2008-5077)
|
||||
o Merge FIPS 140-2 branch code.
|
||||
|
||||
Major changes between OpenSSL 0.9.8g and OpenSSL 0.9.8h [28 May 2008]:
|
||||
|
||||
o CryptoAPI ENGINE support.
|
||||
o Various precautionary measures.
|
||||
o Fix for bugs affecting certificate request creation.
|
||||
o Support for local machine keyset attribute in PKCS#12 files.
|
||||
|
||||
Major changes between OpenSSL 0.9.8f and OpenSSL 0.9.8g [19 Oct 2007]:
|
||||
|
||||
o Backport of CMS functionality to 0.9.8.
|
||||
o Fixes for bugs introduced with 0.9.8f.
|
||||
|
||||
Major changes between OpenSSL 0.9.8e and OpenSSL 0.9.8f [11 Oct 2007]:
|
||||
|
||||
o Add gcc 4.2 support.
|
||||
o Add support for AES and SSE2 assembly language optimization
|
||||
for VC++ build.
|
||||
o Support for RFC4507bis and server name extensions if explicitly
|
||||
selected at compile time.
|
||||
o DTLS improvements.
|
||||
o RFC4507bis support.
|
||||
o TLS Extensions support.
|
||||
|
||||
Major changes between OpenSSL 0.9.8d and OpenSSL 0.9.8e [23 Feb 2007]:
|
||||
|
||||
o Various ciphersuite selection fixes.
|
||||
o RFC3779 support.
|
||||
|
||||
Major changes between OpenSSL 0.9.8c and OpenSSL 0.9.8d [28 Sep 2006]:
|
||||
|
||||
o Introduce limits to prevent malicious key DoS (CVE-2006-2940)
|
||||
o Fix security issues (CVE-2006-2937, CVE-2006-3737, CVE-2006-4343)
|
||||
o Changes to ciphersuite selection algorithm
|
||||
|
||||
Major changes between OpenSSL 0.9.8b and OpenSSL 0.9.8c [5 Sep 2006]:
|
||||
|
||||
o Fix Daniel Bleichenbacher forged signature attack, CVE-2006-4339
|
||||
o New cipher Camellia
|
||||
|
||||
Major changes between OpenSSL 0.9.8a and OpenSSL 0.9.8b [4 May 2006]:
|
||||
|
||||
o Cipher string fixes.
|
||||
o Fixes for VC++ 2005.
|
||||
o Updated ECC cipher suite support.
|
||||
o New functions EVP_CIPHER_CTX_new() and EVP_CIPHER_CTX_free().
|
||||
o Zlib compression usage fixes.
|
||||
o Built in dynamic engine compilation support on Win32.
|
||||
o Fixes auto dynamic engine loading in Win32.
|
||||
|
||||
Major changes between OpenSSL 0.9.8 and OpenSSL 0.9.8a [11 Oct 2005]:
|
||||
|
||||
o Fix potential SSL 2.0 rollback, CVE-2005-2969
|
||||
o Extended Windows CE support
|
||||
|
||||
Major changes between OpenSSL 0.9.7g and OpenSSL 0.9.8 [5 Jul 2005]:
|
||||
|
||||
o Major work on the BIGNUM library for higher efficiency and to
|
||||
make operations more streamlined and less contradictory. This
|
||||
is the result of a major audit of the BIGNUM library.
|
||||
o Addition of BIGNUM functions for fields GF(2^m) and NIST
|
||||
curves, to support the Elliptic Crypto functions.
|
||||
o Major work on Elliptic Crypto; ECDH and ECDSA added, including
|
||||
the use through EVP, X509 and ENGINE.
|
||||
o New ASN.1 mini-compiler that's usable through the OpenSSL
|
||||
configuration file.
|
||||
o Added support for ASN.1 indefinite length constructed encoding.
|
||||
o New PKCS#12 'medium level' API to manipulate PKCS#12 files.
|
||||
o Complete rework of shared library construction and linking
|
||||
programs with shared or static libraries, through a separate
|
||||
Makefile.shared.
|
||||
o Rework of the passing of parameters from one Makefile to another.
|
||||
o Changed ENGINE framework to load dynamic engine modules
|
||||
automatically from specifically given directories.
|
||||
o New structure and ASN.1 functions for CertificatePair.
|
||||
o Changed the ZLIB compression method to be stateful.
|
||||
o Changed the key-generation and primality testing "progress"
|
||||
mechanism to take a structure that contains the ticker
|
||||
function and an argument.
|
||||
o New engine module: GMP (performs private key exponentiation).
|
||||
o New engine module: VIA PadLOck ACE extension in VIA C3
|
||||
Nehemiah processors.
|
||||
o Added support for IPv6 addresses in certificate extensions.
|
||||
See RFC 1884, section 2.2.
|
||||
o Added support for certificate policy mappings, policy
|
||||
constraints and name constraints.
|
||||
o Added support for multi-valued AVAs in the OpenSSL
|
||||
configuration file.
|
||||
o Added support for multiple certificates with the same subject
|
||||
in the 'openssl ca' index file.
|
||||
o Make it possible to create self-signed certificates using
|
||||
'openssl ca -selfsign'.
|
||||
o Make it possible to generate a serial number file with
|
||||
'openssl ca -create_serial'.
|
||||
o New binary search functions with extended functionality.
|
||||
o New BUF functions.
|
||||
o New STORE structure and library to provide an interface to all
|
||||
sorts of data repositories. Supports storage of public and
|
||||
private keys, certificates, CRLs, numbers and arbitrary blobs.
|
||||
This library is unfortunately unfinished and unused within
|
||||
OpenSSL.
|
||||
o New control functions for the error stack.
|
||||
o Changed the PKCS#7 library to support one-pass S/MIME
|
||||
processing.
|
||||
o Added the possibility to compile without old deprecated
|
||||
functionality with the OPENSSL_NO_DEPRECATED macro or the
|
||||
'no-deprecated' argument to the config and Configure scripts.
|
||||
o Constification of all ASN.1 conversion functions, and other
|
||||
affected functions.
|
||||
o Improved platform support for PowerPC.
|
||||
o New FIPS 180-2 algorithms (SHA-224, -256, -384 and -512).
|
||||
o New X509_VERIFY_PARAM structure to support parametrisation
|
||||
of X.509 path validation.
|
||||
o Major overhaul of RC4 performance on Intel P4, IA-64 and
|
||||
AMD64.
|
||||
o Changed the Configure script to have some algorithms disabled
|
||||
by default. Those can be explicitly enabled with the new
|
||||
argument form 'enable-xxx'.
|
||||
o Change the default digest in 'openssl' commands from MD5 to
|
||||
SHA-1.
|
||||
o Added support for DTLS.
|
||||
o New BIGNUM blinding.
|
||||
o Added support for the RSA-PSS encryption scheme
|
||||
o Added support for the RSA X.931 padding.
|
||||
o Added support for BSD sockets on NetWare.
|
||||
o Added support for files larger than 2GB.
|
||||
o Added initial support for Win64.
|
||||
o Added alternate pkg-config files.
|
||||
|
||||
Major changes between OpenSSL 0.9.7l and OpenSSL 0.9.7m [23 Feb 2007]:
|
||||
|
||||
o FIPS 1.1.1 module linking.
|
||||
o Various ciphersuite selection fixes.
|
||||
|
||||
Major changes between OpenSSL 0.9.7k and OpenSSL 0.9.7l [28 Sep 2006]:
|
||||
|
||||
o Introduce limits to prevent malicious key DoS (CVE-2006-2940)
|
||||
o Fix security issues (CVE-2006-2937, CVE-2006-3737, CVE-2006-4343)
|
||||
|
||||
Major changes between OpenSSL 0.9.7j and OpenSSL 0.9.7k [5 Sep 2006]:
|
||||
|
||||
o Fix Daniel Bleichenbacher forged signature attack, CVE-2006-4339
|
||||
|
||||
Major changes between OpenSSL 0.9.7i and OpenSSL 0.9.7j [4 May 2006]:
|
||||
|
||||
o Visual C++ 2005 fixes.
|
||||
o Update Windows build system for FIPS.
|
||||
|
||||
Major changes between OpenSSL 0.9.7h and OpenSSL 0.9.7i [14 Oct 2005]:
|
||||
|
||||
o Give EVP_MAX_MD_SIZE it's old value, except for a FIPS build.
|
||||
|
||||
Major changes between OpenSSL 0.9.7g and OpenSSL 0.9.7h [11 Oct 2005]:
|
||||
|
||||
o Fix SSL 2.0 Rollback, CVE-2005-2969
|
||||
o Allow use of fixed-length exponent on DSA signing
|
||||
o Default fixed-window RSA, DSA, DH private-key operations
|
||||
|
||||
Major changes between OpenSSL 0.9.7f and OpenSSL 0.9.7g [11 Apr 2005]:
|
||||
|
||||
o More compilation issues fixed.
|
||||
o Adaptation to more modern Kerberos API.
|
||||
o Enhanced or corrected configuration for Solaris64, Mingw and Cygwin.
|
||||
o Enhanced x86_64 assembler BIGNUM module.
|
||||
o More constification.
|
||||
o Added processing of proxy certificates (RFC 3820).
|
||||
|
||||
Major changes between OpenSSL 0.9.7e and OpenSSL 0.9.7f [22 Mar 2005]:
|
||||
|
||||
o Several compilation issues fixed.
|
||||
o Many memory allocation failure checks added.
|
||||
o Improved comparison of X509 Name type.
|
||||
o Mandatory basic checks on certificates.
|
||||
o Performance improvements.
|
||||
|
||||
Major changes between OpenSSL 0.9.7d and OpenSSL 0.9.7e [25 Oct 2004]:
|
||||
|
||||
o Fix race condition in CRL checking code.
|
||||
o Fixes to PKCS#7 (S/MIME) code.
|
||||
|
||||
Major changes between OpenSSL 0.9.7c and OpenSSL 0.9.7d [17 Mar 2004]:
|
||||
|
||||
o Security: Fix Kerberos ciphersuite SSL/TLS handshaking bug
|
||||
o Security: Fix null-pointer assignment in do_change_cipher_spec()
|
||||
o Allow multiple active certificates with same subject in CA index
|
||||
o Multiple X509 verification fixes
|
||||
o Speed up HMAC and other operations
|
||||
|
||||
Major changes between OpenSSL 0.9.7b and OpenSSL 0.9.7c [30 Sep 2003]:
|
||||
|
||||
o Security: fix various ASN1 parsing bugs.
|
||||
o New -ignore_err option to OCSP utility.
|
||||
o Various interop and bug fixes in S/MIME code.
|
||||
o SSL/TLS protocol fix for unrequested client certificates.
|
||||
|
||||
Major changes between OpenSSL 0.9.7a and OpenSSL 0.9.7b [10 Apr 2003]:
|
||||
|
||||
o Security: counter the Klima-Pokorny-Rosa extension of
|
||||
Bleichbacher's attack
|
||||
o Security: make RSA blinding default.
|
||||
o Configuration: Irix fixes, AIX fixes, better mingw support.
|
||||
o Support for new platforms: linux-ia64-ecc.
|
||||
o Build: shared library support fixes.
|
||||
o ASN.1: treat domainComponent correctly.
|
||||
o Documentation: fixes and additions.
|
||||
|
||||
Major changes between OpenSSL 0.9.7 and OpenSSL 0.9.7a [19 Feb 2003]:
|
||||
|
||||
o Security: Important security related bugfixes.
|
||||
o Enhanced compatibility with MIT Kerberos.
|
||||
o Can be built without the ENGINE framework.
|
||||
o IA32 assembler enhancements.
|
||||
o Support for new platforms: FreeBSD/IA64 and FreeBSD/Sparc64.
|
||||
o Configuration: the no-err option now works properly.
|
||||
o SSL/TLS: now handles manual certificate chain building.
|
||||
o SSL/TLS: certain session ID malfunctions corrected.
|
||||
|
||||
Major changes between OpenSSL 0.9.6 and OpenSSL 0.9.7 [30 Dec 2002]:
|
||||
|
||||
o New library section OCSP.
|
||||
o Complete rewrite of ASN1 code.
|
||||
o CRL checking in verify code and openssl utility.
|
||||
o Extension copying in 'ca' utility.
|
||||
o Flexible display options in 'ca' utility.
|
||||
o Provisional support for international characters with UTF8.
|
||||
o Support for external crypto devices ('engine') is no longer
|
||||
a separate distribution.
|
||||
o New elliptic curve library section.
|
||||
o New AES (Rijndael) library section.
|
||||
o Support for new platforms: Windows CE, Tandem OSS, A/UX, AIX 64-bit,
|
||||
Linux x86_64, Linux 64-bit on Sparc v9
|
||||
o Extended support for some platforms: VxWorks
|
||||
o Enhanced support for shared libraries.
|
||||
o Now only builds PIC code when shared library support is requested.
|
||||
o Support for pkg-config.
|
||||
o Lots of new manuals.
|
||||
o Makes symbolic links to or copies of manuals to cover all described
|
||||
functions.
|
||||
o Change DES API to clean up the namespace (some applications link also
|
||||
against libdes providing similar functions having the same name).
|
||||
Provide macros for backward compatibility (will be removed in the
|
||||
future).
|
||||
o Unify handling of cryptographic algorithms (software and engine)
|
||||
to be available via EVP routines for asymmetric and symmetric ciphers.
|
||||
o NCONF: new configuration handling routines.
|
||||
o Change API to use more 'const' modifiers to improve error checking
|
||||
and help optimizers.
|
||||
o Finally remove references to RSAref.
|
||||
o Reworked parts of the BIGNUM code.
|
||||
o Support for new engines: Broadcom ubsec, Accelerated Encryption
|
||||
Processing, IBM 4758.
|
||||
o A few new engines added in the demos area.
|
||||
o Extended and corrected OID (object identifier) table.
|
||||
o PRNG: query at more locations for a random device, automatic query for
|
||||
EGD style random sources at several locations.
|
||||
o SSL/TLS: allow optional cipher choice according to server's preference.
|
||||
o SSL/TLS: allow server to explicitly set new session ids.
|
||||
o SSL/TLS: support Kerberos cipher suites (RFC2712).
|
||||
Only supports MIT Kerberos for now.
|
||||
o SSL/TLS: allow more precise control of renegotiations and sessions.
|
||||
o SSL/TLS: add callback to retrieve SSL/TLS messages.
|
||||
o SSL/TLS: support AES cipher suites (RFC3268).
|
||||
|
||||
Major changes between OpenSSL 0.9.6j and OpenSSL 0.9.6k [30 Sep 2003]:
|
||||
|
||||
o Security: fix various ASN1 parsing bugs.
|
||||
o SSL/TLS protocol fix for unrequested client certificates.
|
||||
|
||||
Major changes between OpenSSL 0.9.6i and OpenSSL 0.9.6j [10 Apr 2003]:
|
||||
|
||||
o Security: counter the Klima-Pokorny-Rosa extension of
|
||||
Bleichbacher's attack
|
||||
o Security: make RSA blinding default.
|
||||
o Build: shared library support fixes.
|
||||
|
||||
Major changes between OpenSSL 0.9.6h and OpenSSL 0.9.6i [19 Feb 2003]:
|
||||
|
||||
o Important security related bugfixes.
|
||||
|
||||
Major changes between OpenSSL 0.9.6g and OpenSSL 0.9.6h [5 Dec 2002]:
|
||||
|
||||
o New configuration targets for Tandem OSS and A/UX.
|
||||
o New OIDs for Microsoft attributes.
|
||||
o Better handling of SSL session caching.
|
||||
o Better comparison of distinguished names.
|
||||
o Better handling of shared libraries in a mixed GNU/non-GNU environment.
|
||||
o Support assembler code with Borland C.
|
||||
o Fixes for length problems.
|
||||
o Fixes for uninitialised variables.
|
||||
o Fixes for memory leaks, some unusual crashes and some race conditions.
|
||||
o Fixes for smaller building problems.
|
||||
o Updates of manuals, FAQ and other instructive documents.
|
||||
|
||||
Major changes between OpenSSL 0.9.6f and OpenSSL 0.9.6g [9 Aug 2002]:
|
||||
|
||||
o Important building fixes on Unix.
|
||||
|
||||
Major changes between OpenSSL 0.9.6e and OpenSSL 0.9.6f [8 Aug 2002]:
|
||||
|
||||
o Various important bugfixes.
|
||||
|
||||
Major changes between OpenSSL 0.9.6d and OpenSSL 0.9.6e [30 Jul 2002]:
|
||||
|
||||
o Important security related bugfixes.
|
||||
o Various SSL/TLS library bugfixes.
|
||||
|
||||
Major changes between OpenSSL 0.9.6c and OpenSSL 0.9.6d [9 May 2002]:
|
||||
|
||||
o Various SSL/TLS library bugfixes.
|
||||
o Fix DH parameter generation for 'non-standard' generators.
|
||||
|
||||
Major changes between OpenSSL 0.9.6b and OpenSSL 0.9.6c [21 Dec 2001]:
|
||||
|
||||
o Various SSL/TLS library bugfixes.
|
||||
o BIGNUM library fixes.
|
||||
o RSA OAEP and random number generation fixes.
|
||||
o Object identifiers corrected and added.
|
||||
o Add assembler BN routines for IA64.
|
||||
o Add support for OS/390 Unix, UnixWare with gcc, OpenUNIX 8,
|
||||
MIPS Linux; shared library support for Irix, HP-UX.
|
||||
o Add crypto accelerator support for AEP, Baltimore SureWare,
|
||||
Broadcom and Cryptographic Appliance's keyserver
|
||||
[in 0.9.6c-engine release].
|
||||
|
||||
Major changes between OpenSSL 0.9.6a and OpenSSL 0.9.6b [9 Jul 2001]:
|
||||
|
||||
o Security fix: PRNG improvements.
|
||||
o Security fix: RSA OAEP check.
|
||||
o Security fix: Reinsert and fix countermeasure to Bleichbacher's
|
||||
attack.
|
||||
o MIPS bug fix in BIGNUM.
|
||||
o Bug fix in "openssl enc".
|
||||
o Bug fix in X.509 printing routine.
|
||||
o Bug fix in DSA verification routine and DSA S/MIME verification.
|
||||
o Bug fix to make PRNG thread-safe.
|
||||
o Bug fix in RAND_file_name().
|
||||
o Bug fix in compatibility mode trust settings.
|
||||
o Bug fix in blowfish EVP.
|
||||
o Increase default size for BIO buffering filter.
|
||||
o Compatibility fixes in some scripts.
|
||||
|
||||
Major changes between OpenSSL 0.9.6 and OpenSSL 0.9.6a [5 Apr 2001]:
|
||||
|
||||
o Security fix: change behavior of OpenSSL to avoid using
|
||||
environment variables when running as root.
|
||||
o Security fix: check the result of RSA-CRT to reduce the
|
||||
possibility of deducing the private key from an incorrectly
|
||||
calculated signature.
|
||||
o Security fix: prevent Bleichenbacher's DSA attack.
|
||||
o Security fix: Zero the premaster secret after deriving the
|
||||
master secret in DH ciphersuites.
|
||||
o Reimplement SSL_peek(), which had various problems.
|
||||
o Compatibility fix: the function des_encrypt() renamed to
|
||||
des_encrypt1() to avoid clashes with some Unixen libc.
|
||||
o Bug fixes for Win32, HP/UX and Irix.
|
||||
o Bug fixes in BIGNUM, SSL, PKCS#7, PKCS#12, X.509, CONF and
|
||||
memory checking routines.
|
||||
o Bug fixes for RSA operations in threaded environments.
|
||||
o Bug fixes in misc. openssl applications.
|
||||
o Remove a few potential memory leaks.
|
||||
o Add tighter checks of BIGNUM routines.
|
||||
o Shared library support has been reworked for generality.
|
||||
o More documentation.
|
||||
o New function BN_rand_range().
|
||||
o Add "-rand" option to openssl s_client and s_server.
|
||||
|
||||
Major changes between OpenSSL 0.9.5a and OpenSSL 0.9.6 [10 Oct 2000]:
|
||||
|
||||
o Some documentation for BIO and SSL libraries.
|
||||
o Enhanced chain verification using key identifiers.
|
||||
o New sign and verify options to 'dgst' application.
|
||||
o Support for DER and PEM encoded messages in 'smime' application.
|
||||
o New 'rsautl' application, low level RSA utility.
|
||||
o MD4 now included.
|
||||
o Bugfix for SSL rollback padding check.
|
||||
o Support for external crypto devices [1].
|
||||
o Enhanced EVP interface.
|
||||
|
||||
[1] The support for external crypto devices is currently a separate
|
||||
distribution. See the file README.ENGINE.
|
||||
|
||||
Major changes between OpenSSL 0.9.5 and OpenSSL 0.9.5a [1 Apr 2000]:
|
||||
|
||||
o Bug fixes for Win32, SuSE Linux, NeXTSTEP and FreeBSD 2.2.8
|
||||
o Shared library support for HPUX and Solaris-gcc
|
||||
o Support of Linux/IA64
|
||||
o Assembler support for Mingw32
|
||||
o New 'rand' application
|
||||
o New way to check for existence of algorithms from scripts
|
||||
|
||||
Major changes between OpenSSL 0.9.4 and OpenSSL 0.9.5 [25 May 2000]:
|
||||
|
||||
o S/MIME support in new 'smime' command
|
||||
o Documentation for the OpenSSL command line application
|
||||
o Automation of 'req' application
|
||||
o Fixes to make s_client, s_server work under Windows
|
||||
o Support for multiple fieldnames in SPKACs
|
||||
o New SPKAC command line utilty and associated library functions
|
||||
o Options to allow passwords to be obtained from various sources
|
||||
o New public key PEM format and options to handle it
|
||||
o Many other fixes and enhancements to command line utilities
|
||||
o Usable certificate chain verification
|
||||
o Certificate purpose checking
|
||||
o Certificate trust settings
|
||||
o Support of authority information access extension
|
||||
o Extensions in certificate requests
|
||||
o Simplified X509 name and attribute routines
|
||||
o Initial (incomplete) support for international character sets
|
||||
o New DH_METHOD, DSA_METHOD and enhanced RSA_METHOD
|
||||
o Read only memory BIOs and simplified creation function
|
||||
o TLS/SSL protocol bugfixes: Accept TLS 'client hello' in SSL 3.0
|
||||
record; allow fragmentation and interleaving of handshake and other
|
||||
data
|
||||
o TLS/SSL code now "tolerates" MS SGC
|
||||
o Work around for Netscape client certificate hang bug
|
||||
o RSA_NULL option that removes RSA patent code but keeps other
|
||||
RSA functionality
|
||||
o Memory leak detection now allows applications to add extra information
|
||||
via a per-thread stack
|
||||
o PRNG robustness improved
|
||||
o EGD support
|
||||
o BIGNUM library bug fixes
|
||||
o Faster DSA parameter generation
|
||||
o Enhanced support for Alpha Linux
|
||||
o Experimental MacOS support
|
||||
|
||||
Major changes between OpenSSL 0.9.3 and OpenSSL 0.9.4 [9 Aug 1999]:
|
||||
|
||||
o Transparent support for PKCS#8 format private keys: these are used
|
||||
by several software packages and are more secure than the standard
|
||||
form
|
||||
o PKCS#5 v2.0 implementation
|
||||
o Password callbacks have a new void * argument for application data
|
||||
o Avoid various memory leaks
|
||||
o New pipe-like BIO that allows using the SSL library when actual I/O
|
||||
must be handled by the application (BIO pair)
|
||||
|
||||
Major changes between OpenSSL 0.9.2b and OpenSSL 0.9.3 [24 May 1999]:
|
||||
o Lots of enhancements and cleanups to the Configuration mechanism
|
||||
o RSA OEAP related fixes
|
||||
o Added `openssl ca -revoke' option for revoking a certificate
|
||||
o Source cleanups: const correctness, type-safe stacks and ASN.1 SETs
|
||||
o Source tree cleanups: removed lots of obsolete files
|
||||
o Thawte SXNet, certificate policies and CRL distribution points
|
||||
extension support
|
||||
o Preliminary (experimental) S/MIME support
|
||||
o Support for ASN.1 UTF8String and VisibleString
|
||||
o Full integration of PKCS#12 code
|
||||
o Sparc assembler bignum implementation, optimized hash functions
|
||||
o Option to disable selected ciphers
|
||||
|
||||
Major changes between OpenSSL 0.9.1c and OpenSSL 0.9.2b [22 Mar 1999]:
|
||||
o Fixed a security hole related to session resumption
|
||||
o Fixed RSA encryption routines for the p < q case
|
||||
o "ALL" in cipher lists now means "everything except NULL ciphers"
|
||||
o Support for Triple-DES CBCM cipher
|
||||
o Support of Optimal Asymmetric Encryption Padding (OAEP) for RSA
|
||||
o First support for new TLSv1 ciphers
|
||||
o Added a few new BIOs (syslog BIO, reliable BIO)
|
||||
o Extended support for DSA certificate/keys.
|
||||
o Extended support for Certificate Signing Requests (CSR)
|
||||
o Initial support for X.509v3 extensions
|
||||
o Extended support for compression inside the SSL record layer
|
||||
o Overhauled Win32 builds
|
||||
o Cleanups and fixes to the Big Number (BN) library
|
||||
o Support for ASN.1 GeneralizedTime
|
||||
o Splitted ASN.1 SETs from SEQUENCEs
|
||||
o ASN1 and PEM support for Netscape Certificate Sequences
|
||||
o Overhauled Perl interface
|
||||
o Lots of source tree cleanups.
|
||||
o Lots of memory leak fixes.
|
||||
o Lots of bug fixes.
|
||||
|
||||
Major changes between SSLeay 0.9.0b and OpenSSL 0.9.1c [23 Dec 1998]:
|
||||
o Integration of the popular NO_RSA/NO_DSA patches
|
||||
o Initial support for compression inside the SSL record layer
|
||||
o Added BIO proxy and filtering functionality
|
||||
o Extended Big Number (BN) library
|
||||
o Added RIPE MD160 message digest
|
||||
o Addeed support for RC2/64bit cipher
|
||||
o Extended ASN.1 parser routines
|
||||
o Adjustations of the source tree for CVS
|
||||
o Support for various new platforms
|
||||
|
||||
48
NOTES.DJGPP
48
NOTES.DJGPP
@@ -1,48 +0,0 @@
|
||||
|
||||
|
||||
INSTALLATION ON THE DOS PLATFORM WITH DJGPP
|
||||
-------------------------------------------
|
||||
|
||||
OpenSSL has been ported to DJGPP, a Unix look-alike 32-bit run-time
|
||||
environment for 16-bit DOS, but only with long filename support.
|
||||
If you wish to compile on native DOS with 8+3 filenames, you will
|
||||
have to tweak the installation yourself, including renaming files
|
||||
with illegal or duplicate names.
|
||||
|
||||
You should have a full DJGPP environment installed, including the
|
||||
latest versions of DJGPP, GCC, BINUTILS, BASH, etc. This package
|
||||
requires that PERL and the PERL module Text::Template also be
|
||||
installed (see NOTES.PERL).
|
||||
|
||||
All of these can be obtained from the usual DJGPP mirror sites or
|
||||
directly at "http://www.delorie.com/pub/djgpp". For help on which
|
||||
files to download, see the DJGPP "ZIP PICKER" page at
|
||||
"http://www.delorie.com/djgpp/zip-picker.html". You also need to have
|
||||
the WATT-32 networking package installed before you try to compile
|
||||
OpenSSL. This can be obtained from "http://www.watt-32.net/".
|
||||
The Makefile assumes that the WATT-32 code is in the directory
|
||||
specified by the environment variable WATT_ROOT. If you have watt-32
|
||||
in directory "watt32" under your main DJGPP directory, specify
|
||||
WATT_ROOT="/dev/env/DJDIR/watt32".
|
||||
|
||||
To compile OpenSSL, start your BASH shell, then configure for DJGPP by
|
||||
running "./Configure" with appropriate arguments:
|
||||
|
||||
./Configure no-threads --prefix=/dev/env/DJDIR DJGPP
|
||||
|
||||
And finally fire up "make". You may run out of DPMI selectors when
|
||||
running in a DOS box under Windows. If so, just close the BASH
|
||||
shell, go back to Windows, and restart BASH. Then run "make" again.
|
||||
|
||||
RUN-TIME CAVEAT LECTOR
|
||||
--------------
|
||||
|
||||
Quoting FAQ:
|
||||
|
||||
"Cryptographic software needs a source of unpredictable data to work
|
||||
correctly. Many open source operating systems provide a "randomness
|
||||
device" (/dev/urandom or /dev/random) that serves this purpose."
|
||||
|
||||
As of version 0.9.7f DJGPP port checks upon /dev/urandom$ for a 3rd
|
||||
party "randomness" DOS driver. One such driver, NOISE.SYS, can be
|
||||
obtained from "http://www.rahul.net/dkaufman/index.html".
|
||||
119
NOTES.PERL
119
NOTES.PERL
@@ -1,119 +0,0 @@
|
||||
TOC
|
||||
===
|
||||
|
||||
- Notes on Perl
|
||||
- Notes on Perl on Windows
|
||||
- Notes on Perl modules we use
|
||||
- Notes on installing a perl module
|
||||
|
||||
Notes on Perl
|
||||
-------------
|
||||
|
||||
For our scripts, we rely quite a bit on Perl, and increasingly on
|
||||
some core Perl modules. These Perl modules are part of the Perl
|
||||
source, so if you build Perl on your own, you should be set.
|
||||
|
||||
However, if you install Perl as binary packages, the outcome might
|
||||
differ, and you may have to check that you do get the core modules
|
||||
installed properly. We do not claim to know them all, but experience
|
||||
has told us the following:
|
||||
|
||||
- on Linux distributions based on Debian, the package 'perl' will
|
||||
install the core Perl modules as well, so you will be fine.
|
||||
- on Linux distributions based on RPMs, you will need to install
|
||||
'perl-core' rather than just 'perl'.
|
||||
|
||||
You MUST have at least Perl version 5.10.0 installed. This minimum
|
||||
requirement is due to our use of regexp backslash sequence \R among
|
||||
other features that didn't exist in core Perl before that version.
|
||||
|
||||
Notes on Perl on Windows
|
||||
------------------------
|
||||
|
||||
There are a number of build targets that can be viewed as "Windows".
|
||||
Indeed, there are VC-* configs targeting VisualStudio C, as well as
|
||||
MinGW and Cygwin. The key recommendation is to use "matching" Perl,
|
||||
one that matches build environment. For example, if you will build
|
||||
on Cygwin be sure to use the Cygwin package manager to install Perl.
|
||||
For MSYS builds use the MSYS provided Perl. For VC-* builds we
|
||||
recommend ActiveState Perl, available from
|
||||
http://www.activestate.com/ActivePerl.
|
||||
|
||||
Notes on Perl on VMS
|
||||
--------------------
|
||||
|
||||
You will need to install Perl separately. One way to do so is to
|
||||
download the source from http://perl.org/, unpacking it, reading
|
||||
README.vms and follow the instructions. Another way is to download a
|
||||
.PCSI file from http://www.vmsperl.com/ and install it using the
|
||||
POLYCENTER install tool.
|
||||
|
||||
Notes on Perl modules we use
|
||||
----------------------------
|
||||
|
||||
We make increasing use of Perl modules, and do our best to limit
|
||||
ourselves to core Perl modules to keep the requirements down. There
|
||||
are just a few exceptions:
|
||||
|
||||
Test::More We require the minimum version to be 0.96, which
|
||||
appeared in Perl 5.13.4, because that version was
|
||||
the first to have all the features we're using.
|
||||
This module is required for testing only! If you
|
||||
don't plan on running the tests, you don't need to
|
||||
bother with this one.
|
||||
|
||||
Text::Template This module is not part of the core Perl modules.
|
||||
As a matter of fact, the core Perl modules do not
|
||||
include any templating module to date.
|
||||
This module is absolutely needed, configuration
|
||||
depends on it.
|
||||
|
||||
To avoid unnecessary initial hurdles, we have bundled a copy of the
|
||||
following modules in our source. They will work as fallbacks if
|
||||
these modules aren't already installed on the system.
|
||||
|
||||
Text::Template
|
||||
|
||||
Notes on installing a perl module
|
||||
---------------------------------
|
||||
|
||||
There are a number of ways to install a perl module. In all
|
||||
descriptions below, Text::Template will server as an example.
|
||||
|
||||
1. for Linux users, the easiest is to install with the use of your
|
||||
favorite package manager. Usually, all you need to do is search
|
||||
for the module name and to install the package that comes up.
|
||||
|
||||
On Debian based Linux distributions, it would go like this:
|
||||
|
||||
$ apt-cache search Text::Template
|
||||
...
|
||||
libtext-template-perl - perl module to process text templates
|
||||
$ sudo apt-get install libtext-template-perl
|
||||
|
||||
Perl modules in Debian based distributions use package names like
|
||||
the name of the module in question, with "lib" prepended and
|
||||
"-perl" appended.
|
||||
|
||||
2. Install using CPAN. This is very easy, but usually requires root
|
||||
access:
|
||||
|
||||
$ cpan -i Text::Template
|
||||
|
||||
Note that this runs all the tests that the module to be installed
|
||||
comes with. This is usually a smooth operation, but there are
|
||||
platforms where a failure is indicated even though the actual tests
|
||||
were successful. Should that happen, you can force an
|
||||
installation regardless (that should be safe since you've already
|
||||
seen the tests succeed!):
|
||||
|
||||
$ cpan -f -i Text::Template
|
||||
|
||||
Note: on VMS, you must quote any argument that contains upper case
|
||||
characters, so the lines above would be:
|
||||
|
||||
$ cpan -i "Text::Template"
|
||||
|
||||
and:
|
||||
|
||||
$ cpan -f -i "Text::Template"
|
||||
30
NOTES.UNIX
30
NOTES.UNIX
@@ -1,30 +0,0 @@
|
||||
|
||||
NOTES FOR UNIX LIKE PLATFORMS
|
||||
=============================
|
||||
|
||||
For Unix/POSIX runtime systems on Windows, please see NOTES.WIN.
|
||||
|
||||
|
||||
Shared libraries and installation in non-standard locations
|
||||
-----------------------------------------------------------
|
||||
|
||||
Binaries on Unix variants expect to find shared libraries in standard
|
||||
locations, such as /usr/lib, /usr/local/lib and some other locations
|
||||
configured in the system (for example /etc/ld.so.conf on some systems).
|
||||
If the libraries are installed in non-standard locations, binaries
|
||||
will not find them and therefore fail to run unless they get a bit of
|
||||
help from a defined RPATH or RUNPATH. This can be applied by adding
|
||||
the appropriate linker flags to the configuration command, such as
|
||||
this (/usr/local/ssl was the default location for OpenSSL installation
|
||||
in versions before 1.1.0):
|
||||
|
||||
$ ./config --prefix=/usr/local/ssl --openssldir=/usr/local/ssl \
|
||||
-Wl,-rpath,/usr/local/ssl/lib
|
||||
|
||||
Because the actual library location may vary further (for example on
|
||||
multilib installations), there is a convenience variable in Makefile
|
||||
that holds the exact installation directory and that can be used like
|
||||
this:
|
||||
|
||||
$ ./config --prefix=/usr/local/ssl --openssldir=/usr/local/ssl \
|
||||
-Wl,-rpath,'$(LIBRPATH)'
|
||||
81
NOTES.VMS
81
NOTES.VMS
@@ -1,81 +0,0 @@
|
||||
|
||||
NOTES FOR THE OPENVMS PLATFORM
|
||||
==============================
|
||||
|
||||
Requirement details
|
||||
-------------------
|
||||
|
||||
In addition to the requirements and instructions listed in INSTALL,
|
||||
this are required as well:
|
||||
|
||||
* At least ODS-5 disk organization for source and build.
|
||||
Installation can be done on any existing disk organization.
|
||||
|
||||
|
||||
About ANSI C compiler
|
||||
---------------------
|
||||
|
||||
An ANSI C compiled is needed among other things. This means that
|
||||
VAX C is not and will not be supported.
|
||||
|
||||
We have only tested with DEC C (a.k.a HP VMS C / VSI C) and require
|
||||
version 7.1 or later. Compiling with a different ANSI C compiler may
|
||||
require some work.
|
||||
|
||||
Please avoid using C RTL feature logical names DECC$* when building
|
||||
and testing OpenSSL. Most of all, they can be disruptive when
|
||||
running the tests, as they affect the Perl interpreter.
|
||||
|
||||
|
||||
About ODS-5 directory names and Perl
|
||||
------------------------------------
|
||||
|
||||
It seems that the perl function canonpath() in the File::Spec module
|
||||
doesn't treat file specifications where the last directory name
|
||||
contains periods very well. Unfortunately, some versions of VMS tar
|
||||
will keep the periods in the OpenSSL source directory instead of
|
||||
converting them to underscore, thereby leaving your source in
|
||||
something like [.openssl-1^.1^.0]. This will lead to issues when
|
||||
configuring and building OpenSSL.
|
||||
|
||||
We have no replacement for Perl's canonpath(), so the best workaround
|
||||
for now is to rename the OpenSSL source directory, as follows (please
|
||||
adjust for the actual source directory name you have):
|
||||
|
||||
$ rename openssl-1^.1^.0.DIR openssl-1_1_0.DIR
|
||||
|
||||
|
||||
About MMS and DCL
|
||||
-----------------
|
||||
|
||||
MMS has certain limitations when it comes to line length, and DCL has
|
||||
certain limitations when it comes to total command length. We do
|
||||
what we can to mitigate, but there is the possibility that it's not
|
||||
enough. Should you run into issues, a very simple solution is to set
|
||||
yourself up a few logical names for the directory trees you're going
|
||||
to use.
|
||||
|
||||
|
||||
Checking the distribution
|
||||
-------------------------
|
||||
|
||||
There have been reports of places where the distribution didn't quite
|
||||
get through, for example if you've copied the tree from a NFS-mounted
|
||||
Unix mount point.
|
||||
|
||||
The easiest way to check if everything got through as it should is to
|
||||
check for one of the following files:
|
||||
|
||||
[.crypto]opensslconf^.h.in
|
||||
|
||||
The best way to get a correct distribution is to download the gzipped
|
||||
tar file from ftp://ftp.openssl.org/source/, use GZIP -d to uncompress
|
||||
it and VMSTAR to unpack the resulting tar file.
|
||||
|
||||
Gzip and VMSTAR are available here:
|
||||
|
||||
http://antinode.info/dec/index.html#Software
|
||||
|
||||
Should you need it, you can find UnZip for VMS here:
|
||||
|
||||
http://www.info-zip.org/UnZip.html
|
||||
154
NOTES.WIN
154
NOTES.WIN
@@ -1,154 +0,0 @@
|
||||
|
||||
NOTES FOR THE WINDOWS PLATFORMS
|
||||
===============================
|
||||
|
||||
Requirement details for native (Visual C++) builds
|
||||
--------------------------------------------------
|
||||
|
||||
In addition to the requirements and instructions listed in INSTALL,
|
||||
this are required as well:
|
||||
|
||||
- You need Perl. We recommend ActiveState Perl, available from
|
||||
https://www.activestate.com/ActivePerl. Another viable alternative
|
||||
appears to be Strawberry Perl, http://strawberryperl.com.
|
||||
You also need the perl module Text::Template, available on CPAN.
|
||||
Please read NOTES.PERL for more information.
|
||||
|
||||
- You need a C compiler. OpenSSL has been tested to build with these:
|
||||
|
||||
* Visual C++
|
||||
|
||||
- Netwide Assembler, a.k.a. NASM, available from http://www.nasm.us,
|
||||
is required if you intend to utilize assembler modules. Note that NASM
|
||||
is the only supported assembler. The Microsoft provided assembler is NOT
|
||||
supported.
|
||||
|
||||
|
||||
Visual C++ (native Windows)
|
||||
---------------------------
|
||||
|
||||
Installation directories
|
||||
|
||||
The default installation directories are derived from environment
|
||||
variables.
|
||||
|
||||
For VC-WIN32, the following defaults are use:
|
||||
|
||||
PREFIX: %ProgramFiles(86)%\OpenSSL
|
||||
OPENSSLDIR: %CommonProgramFiles(86)%\SSL
|
||||
|
||||
For VC-WIN64, the following defaults are use:
|
||||
|
||||
PREFIX: %ProgramW6432%\OpenSSL
|
||||
OPENSSLDIR: %CommonProgramW6432%\SSL
|
||||
|
||||
Should those environment variables not exist (on a pure Win32
|
||||
installation for examples), these fallbacks are used:
|
||||
|
||||
PREFIX: %ProgramFiles%\OpenSSL
|
||||
OPENSSLDIR: %CommonProgramFiles%\SSL
|
||||
|
||||
ALSO NOTE that those directories are usually write protected, even if
|
||||
your account is in the Administrators group. To work around that,
|
||||
start the command prompt by right-clicking on it and choosing "Run as
|
||||
Administrator" before running 'nmake install'. The other solution
|
||||
is, of course, to choose a different set of directories by using
|
||||
--prefix and --openssldir when configuring.
|
||||
|
||||
GNU C (Cygwin)
|
||||
--------------
|
||||
|
||||
Cygwin implements a Posix/Unix runtime system (cygwin1.dll) on top of the
|
||||
Windows subsystem and provides a bash shell and GNU tools environment.
|
||||
Consequently, a make of OpenSSL with Cygwin is virtually identical to the
|
||||
Unix procedure.
|
||||
|
||||
To build OpenSSL using Cygwin, you need to:
|
||||
|
||||
* Install Cygwin (see https://cygwin.com/)
|
||||
|
||||
* Install Cygwin Perl and ensure it is in the path. Recall that
|
||||
as least 5.10.0 is required.
|
||||
|
||||
* Run the Cygwin bash shell
|
||||
|
||||
Apart from that, follow the Unix instructions in INSTALL.
|
||||
|
||||
NOTE: "make test" and normal file operations may fail in directories
|
||||
mounted as text (i.e. mount -t c:\somewhere /home) due to Cygwin
|
||||
stripping of carriage returns. To avoid this ensure that a binary
|
||||
mount is used, e.g. mount -b c:\somewhere /home.
|
||||
|
||||
It is also possible to create "conventional" Windows binaries that use
|
||||
the Microsoft C runtime system (msvcrt.dll or crtdll.dll) using MinGW
|
||||
development add-on for Cygwin. MinGW is supported even as a standalone
|
||||
setup as described in the following section. In the context you should
|
||||
recognize that binaries targeting Cygwin itself are not interchangeable
|
||||
with "conventional" Windows binaries you generate with/for MinGW.
|
||||
|
||||
|
||||
GNU C (MinGW/MSYS)
|
||||
------------------
|
||||
|
||||
* Compiler and shell environment installation:
|
||||
|
||||
MinGW and MSYS are available from http://www.mingw.org/, both are
|
||||
required. Run the installers and do whatever magic they say it takes
|
||||
to start MSYS bash shell with GNU tools and matching Perl on its PATH.
|
||||
"Matching Perl" refers to chosen "shell environment", i.e. if built
|
||||
under MSYS, then Perl compiled for MSYS must be used.
|
||||
|
||||
Alternatively, one can use MSYS2 from https://msys2.github.io/,
|
||||
which includes MingW (32-bit and 64-bit).
|
||||
|
||||
* It is also possible to cross-compile it on Linux by configuring
|
||||
with './Configure --cross-compile-prefix=i386-mingw32- mingw ...'.
|
||||
Other possible cross compile prefixes include x86_64-w64-mingw32-
|
||||
and i686-w64-mingw32-.
|
||||
|
||||
|
||||
Independently of the method chosen to build for mingw, the installation
|
||||
paths are similar to those used when building with VC-* targets, except
|
||||
that in case the fallbacks mentioned there aren't possible (typically
|
||||
when cross compiling on Linux), the paths will be the following:
|
||||
|
||||
For mingw:
|
||||
|
||||
PREFIX: C:/Program Files (x86)/OpenSSL
|
||||
OPENSSLDIR C:/Program Files (x86)/Common Files/SSL
|
||||
|
||||
For mingw64:
|
||||
|
||||
PREFIX: C:/Program Files/OpenSSL
|
||||
OPENSSLDIR C:/Program Files/Common Files/SSL
|
||||
|
||||
Linking your application
|
||||
------------------------
|
||||
|
||||
This section applies to non-Cygwin builds.
|
||||
|
||||
If you link with static OpenSSL libraries then you're expected to
|
||||
additionally link your application with WS2_32.LIB, GDI32.LIB,
|
||||
ADVAPI32.LIB, CRYPT32.LIB and USER32.LIB. Those developing
|
||||
non-interactive service applications might feel concerned about
|
||||
linking with GDI32.LIB and USER32.LIB, as they are justly associated
|
||||
with interactive desktop, which is not available to service
|
||||
processes. The toolkit is designed to detect in which context it's
|
||||
currently executed, GUI, console app or service, and act accordingly,
|
||||
namely whether or not to actually make GUI calls. Additionally those
|
||||
who wish to /DELAYLOAD:GDI32.DLL and /DELAYLOAD:USER32.DLL and
|
||||
actually keep them off service process should consider implementing
|
||||
and exporting from .exe image in question own _OPENSSL_isservice not
|
||||
relying on USER32.DLL. E.g., on Windows Vista and later you could:
|
||||
|
||||
__declspec(dllexport) __cdecl BOOL _OPENSSL_isservice(void)
|
||||
{ DWORD sess;
|
||||
if (ProcessIdToSessionId(GetCurrentProcessId(),&sess))
|
||||
return sess==0;
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
If you link with OpenSSL .DLLs, then you're expected to include into
|
||||
your application code small "shim" snippet, which provides glue between
|
||||
OpenSSL BIO layer and your compiler run-time. See the OPENSSL_Applink
|
||||
manual page for further details.
|
||||
111
README
111
README
@@ -1,94 +1,41 @@
|
||||
README: Tk
|
||||
This is the Tk 8.5.15 source distribution.
|
||||
http://sourceforge.net/projects/tcl/files/Tcl/
|
||||
You can get any source release of Tk from the URL above.
|
||||
|
||||
OpenSSL 1.1.0l 10 Sep 2019
|
||||
1. Introduction
|
||||
---------------
|
||||
|
||||
Copyright (c) 1998-2019 The OpenSSL Project
|
||||
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
|
||||
All rights reserved.
|
||||
This directory contains the sources and documentation for Tk, a
|
||||
cross-platform GUI toolkit implemented with the Tcl scripting language.
|
||||
|
||||
DESCRIPTION
|
||||
-----------
|
||||
For details on features, incompatibilities, and potential problems with
|
||||
this release, see the Tcl/Tk 8.5 Web page at
|
||||
|
||||
The OpenSSL Project is a collaborative effort to develop a robust,
|
||||
commercial-grade, fully featured, and Open Source toolkit implementing the
|
||||
Transport Layer Security (TLS) protocols (including SSLv3) as well as a
|
||||
full-strength general purpose cryptographic library.
|
||||
http://www.tcl.tk/software/tcltk/8.5.html
|
||||
|
||||
OpenSSL is descended from the SSLeay library developed by Eric A. Young
|
||||
and Tim J. Hudson. The OpenSSL toolkit is licensed under a dual-license (the
|
||||
OpenSSL license plus the SSLeay license), which means that you are free to
|
||||
get and use it for commercial and non-commercial purposes as long as you
|
||||
fulfill the conditions of both licenses.
|
||||
or refer to the "changes" file in this directory, which contains a
|
||||
historical record of all changes to Tk.
|
||||
|
||||
OVERVIEW
|
||||
--------
|
||||
Tk is maintained, enhanced, and distributed freely by the Tcl community.
|
||||
Source code development and tracking of bug reports and feature requests
|
||||
takes place at:
|
||||
|
||||
The OpenSSL toolkit includes:
|
||||
http://core.tcl.tk/tk/
|
||||
|
||||
libssl (with platform specific naming):
|
||||
Provides the client and server-side implementations for SSLv3 and TLS.
|
||||
with the Tcl Developer Xchange at:
|
||||
|
||||
libcrypto (with platform specific naming):
|
||||
Provides general cryptographic and X.509 support needed by SSL/TLS but
|
||||
not logically part of it.
|
||||
http://www.tcl.tk/
|
||||
|
||||
openssl:
|
||||
A command line tool that can be used for:
|
||||
Creation of key parameters
|
||||
Creation of X.509 certificates, CSRs and CRLs
|
||||
Calculation of message digests
|
||||
Encryption and decryption
|
||||
SSL/TLS client and server tests
|
||||
Handling of S/MIME signed or encrypted mail
|
||||
And more...
|
||||
Tk is a freely available open source package. You can do virtually
|
||||
anything you like with it, such as modifying it, redistributing it,
|
||||
and selling it either in whole or in part. See the file
|
||||
"license.terms" for complete information.
|
||||
|
||||
INSTALLATION
|
||||
------------
|
||||
2. See Tcl README
|
||||
-----------------
|
||||
|
||||
See the appropriate file:
|
||||
INSTALL Linux, Unix, Windows, OpenVMS, ...
|
||||
NOTES.* INSTALL addendums for different platforms
|
||||
|
||||
SUPPORT
|
||||
-------
|
||||
|
||||
See the OpenSSL website www.openssl.org for details on how to obtain
|
||||
commercial technical support. Free community support is available through the
|
||||
openssl-users email list (see
|
||||
https://www.openssl.org/community/mailinglists.html for further details).
|
||||
|
||||
If you have any problems with OpenSSL then please take the following steps
|
||||
first:
|
||||
|
||||
- Download the latest version from the repository
|
||||
to see if the problem has already been addressed
|
||||
- Configure with no-asm
|
||||
- Remove compiler optimisation flags
|
||||
|
||||
If you wish to report a bug then please include the following information
|
||||
and create an issue on GitHub:
|
||||
|
||||
- OpenSSL version: output of 'openssl version -a'
|
||||
- Any "Configure" options that you selected during compilation of the
|
||||
library if applicable (see INSTALL)
|
||||
- OS Name, Version, Hardware platform
|
||||
- Compiler Details (name, version)
|
||||
- Application Details (name, version)
|
||||
- Problem Description (steps that will reproduce the problem, if known)
|
||||
- Stack Traceback (if the application dumps core)
|
||||
|
||||
Just because something doesn't work the way you expect does not mean it
|
||||
is necessarily a bug in OpenSSL. Use the openssl-users email list for this type
|
||||
of query.
|
||||
|
||||
HOW TO CONTRIBUTE TO OpenSSL
|
||||
----------------------------
|
||||
|
||||
See CONTRIBUTING
|
||||
|
||||
LEGALITIES
|
||||
----------
|
||||
|
||||
A number of nations restrict the use or export of cryptography. If you
|
||||
are potentially subject to such restrictions you should seek competent
|
||||
professional legal advice before attempting to develop or distribute
|
||||
cryptographic code.
|
||||
Please see the README file that comes with the associated Tcl release
|
||||
for more information. There are pointers there to extensive
|
||||
documentation. In addition, there are additional README files
|
||||
in the subdirectories of this distribution.
|
||||
|
||||
61
README.ECC
61
README.ECC
@@ -1,61 +0,0 @@
|
||||
NOTE: The OpenSSL Software Foundation has executed a sublicense agreement
|
||||
entitled "Elliptic Curve Cryptography Patent License Agreement" with the
|
||||
National Security Agency/ Central Security Service Commercial Solutions
|
||||
Center (NCSC) dated 2010-11-04. That agreement permits implementation and
|
||||
distribution of software containing features covered by any or all of the
|
||||
following patents:
|
||||
|
||||
1.) U.S. Pat. No. 5,761,305 entitled "Key Agreement and Transport Protocol
|
||||
with Implicit Signatures" issued on June 2, 1998;
|
||||
2.) Can. Pat. Appl. Ser. No. 2176972 entitled "Key Agreement and Transport
|
||||
Protocol with Implicit Signature and Reduced Bandwidth" filed on May
|
||||
16, 1996;
|
||||
3.) U.S. Pat. No. 5,889,865 entitled "Key Agreement and Transport Protocol
|
||||
with Implicit Signatures" issued on March 30, 1999;
|
||||
4.) U.S. Pat. No. 5,896,455 entitled "Key Agreement and Transport Protocol
|
||||
with Implicit Signatures" issued on April 20, 1999;
|
||||
5.) U.S. Pat. No. 5,933,504 entitled "Strengthened Public Key Protocol"
|
||||
issued on August 3, 1999;
|
||||
6.) Can. Pat. Appl. Ser. No. 2176866 entitled "Strengthened Public Key
|
||||
Protocol" filed on May 17, 1996;
|
||||
7.) E.P. Pat. Appl. Ser. No. 96201322.3 entitled "Strengthened Public Key
|
||||
Protocol" filed on May 17, 1996;
|
||||
8.) U.S. Pat. No. 5,999,626 entitled "Digital Signatures on a Smartcard"
|
||||
issued on December 7, 1999;
|
||||
9.) Can. Pat. Appl. Ser. No. 2202566 entitled "Digital Signatures on a
|
||||
Smartcard" filed on April 14, 1997;
|
||||
10.) E.P. Pat. Appl. No. 97106114.8 entitled "Digital Signatures on a
|
||||
Smartcard" filed on April 15, 1997;
|
||||
11.) U.S Pat. No. 6,122,736 entitled "Key Agreement and Transport Protocol
|
||||
with Implicit Signatures" issued on September 19, 2000;
|
||||
12.) Can. Pat. Appl. Ser. No. 2174261 entitled "Key Agreement and Transport
|
||||
Protocol with Implicit Signatures" filed on April 16, 1996;
|
||||
13.) E.P. Pat. Appl. Ser. No. 96105920.1 entitled "Key Agreement and
|
||||
Transport Protocol with Implicit Signatures" filed on April 16, 1996;
|
||||
14.) U.S. Pat. No. 6,141,420 entitled "Elliptic Curve Encryption Systems"
|
||||
issued on October 31, 2000;
|
||||
15.) Can. Pat. Appl. Ser. No. 2155038 entitled "Elliptic Curve Encryption
|
||||
Systems" filed on July 31, 1995;
|
||||
16.) E.P. Pat. Appl. Ser. No. 95926348.4 entitled "Elliptic Curve Encryption
|
||||
Systems" filed on July 31, 1995;
|
||||
17.) U.S. Pat. No. 6,336,188 entitled "Authenticated Key Agreement" issued
|
||||
on January 1, 2002;
|
||||
18.) U.S. Pat. No. 6,487,661 entitled "Key Agreement and Transport Protocol"
|
||||
issued on November 26, 2002;
|
||||
19.) Can. Pat. Appl. Ser. No. 2174260 entitled "Key Agreement and Transport
|
||||
Protocol" filed on April 16, 1996;
|
||||
20.) E.P. Pat. Appl. Ser. No. 96105921.9 entitled "Key Agreement and
|
||||
Transport Protocol" filed on April 21, 1996;
|
||||
21.) U.S. Pat. No. 6,563,928 entitled "Strengthened Public Key Protocol"
|
||||
issued on May 13, 2003;
|
||||
22.) U.S. Pat. No. 6,618,483 entitled "Elliptic Curve Encryption Systems"
|
||||
issued September 9, 2003;
|
||||
23.) U.S. Pat. Appl. Ser. No. 09/434,247 entitled "Digital Signatures on a
|
||||
Smartcard" filed on November 5, 1999;
|
||||
24.) U.S. Pat. Appl. Ser. No. 09/558,256 entitled "Key Agreement and
|
||||
Transport Protocol with Implicit Signatures" filed on April 25, 2000;
|
||||
25.) U.S. Pat. Appl. Ser. No. 09/942,492 entitled "Digital Signatures on a
|
||||
Smartcard" filed on August 29, 2001 and published on July 18, 2002; and,
|
||||
26.) U.S. Pat. Appl. Ser. No. 10/185,735 entitled "Strengthened Public Key
|
||||
Protocol" filed on July 1, 2000.
|
||||
|
||||
288
README.ENGINE
288
README.ENGINE
@@ -1,288 +0,0 @@
|
||||
ENGINE
|
||||
======
|
||||
|
||||
With OpenSSL 0.9.6, a new component was added to support alternative
|
||||
cryptography implementations, most commonly for interfacing with external
|
||||
crypto devices (eg. accelerator cards). This component is called ENGINE,
|
||||
and its presence in OpenSSL 0.9.6 (and subsequent bug-fix releases)
|
||||
caused a little confusion as 0.9.6** releases were rolled in two
|
||||
versions, a "standard" and an "engine" version. In development for 0.9.7,
|
||||
the ENGINE code has been merged into the main branch and will be present
|
||||
in the standard releases from 0.9.7 forwards.
|
||||
|
||||
There are currently built-in ENGINE implementations for the following
|
||||
crypto devices:
|
||||
|
||||
o Cryptodev
|
||||
o Microsoft CryptoAPI
|
||||
o VIA Padlock
|
||||
o nCipher CHIL
|
||||
|
||||
In addition, dynamic binding to external ENGINE implementations is now
|
||||
provided by a special ENGINE called "dynamic". See the "DYNAMIC ENGINE"
|
||||
section below for details.
|
||||
|
||||
At this stage, a number of things are still needed and are being worked on:
|
||||
|
||||
1 Integration of EVP support.
|
||||
2 Configuration support.
|
||||
3 Documentation!
|
||||
|
||||
1 With respect to EVP, this relates to support for ciphers and digests in
|
||||
the ENGINE model so that alternative implementations of existing
|
||||
algorithms/modes (or previously unimplemented ones) can be provided by
|
||||
ENGINE implementations.
|
||||
|
||||
2 Configuration support currently exists in the ENGINE API itself, in the
|
||||
form of "control commands". These allow an application to expose to the
|
||||
user/admin the set of commands and parameter types a given ENGINE
|
||||
implementation supports, and for an application to directly feed string
|
||||
based input to those ENGINEs, in the form of name-value pairs. This is an
|
||||
extensible way for ENGINEs to define their own "configuration" mechanisms
|
||||
that are specific to a given ENGINE (eg. for a particular hardware
|
||||
device) but that should be consistent across *all* OpenSSL-based
|
||||
applications when they use that ENGINE. Work is in progress (or at least
|
||||
in planning) for supporting these control commands from the CONF (or
|
||||
NCONF) code so that applications using OpenSSL's existing configuration
|
||||
file format can have ENGINE settings specified in much the same way.
|
||||
Presently however, applications must use the ENGINE API itself to provide
|
||||
such functionality. To see first hand the types of commands available
|
||||
with the various compiled-in ENGINEs (see further down for dynamic
|
||||
ENGINEs), use the "engine" openssl utility with full verbosity, ie;
|
||||
openssl engine -vvvv
|
||||
|
||||
3 Documentation? Volunteers welcome! The source code is reasonably well
|
||||
self-documenting, but some summaries and usage instructions are needed -
|
||||
moreover, they are needed in the same POD format the existing OpenSSL
|
||||
documentation is provided in. Any complete or incomplete contributions
|
||||
would help make this happen.
|
||||
|
||||
STABILITY & BUG-REPORTS
|
||||
=======================
|
||||
|
||||
What already exists is fairly stable as far as it has been tested, but
|
||||
the test base has been a bit small most of the time. For the most part,
|
||||
the vendors of the devices these ENGINEs support have contributed to the
|
||||
development and/or testing of the implementations, and *usually* (with no
|
||||
guarantees) have experience in using the ENGINE support to drive their
|
||||
devices from common OpenSSL-based applications. Bugs and/or inexplicable
|
||||
behaviour in using a specific ENGINE implementation should be sent to the
|
||||
author of that implementation (if it is mentioned in the corresponding C
|
||||
file), and in the case of implementations for commercial hardware
|
||||
devices, also through whatever vendor support channels are available. If
|
||||
none of this is possible, or the problem seems to be something about the
|
||||
ENGINE API itself (ie. not necessarily specific to a particular ENGINE
|
||||
implementation) then you should mail complete details to the relevant
|
||||
OpenSSL mailing list. For a definition of "complete details", refer to
|
||||
the OpenSSL "README" file. As for which list to send it to;
|
||||
|
||||
openssl-users: if you are *using* the ENGINE abstraction, either in an
|
||||
pre-compiled application or in your own application code.
|
||||
|
||||
openssl-dev: if you are discussing problems with OpenSSL source code.
|
||||
|
||||
USAGE
|
||||
=====
|
||||
|
||||
The default "openssl" ENGINE is always chosen when performing crypto
|
||||
operations unless you specify otherwise. You must actively tell the
|
||||
openssl utility commands to use anything else through a new command line
|
||||
switch called "-engine". Also, if you want to use the ENGINE support in
|
||||
your own code to do something similar, you must likewise explicitly
|
||||
select the ENGINE implementation you want.
|
||||
|
||||
Depending on the type of hardware, system, and configuration, "settings"
|
||||
may need to be applied to an ENGINE for it to function as expected/hoped.
|
||||
The recommended way of doing this is for the application to support
|
||||
ENGINE "control commands" so that each ENGINE implementation can provide
|
||||
whatever configuration primitives it might require and the application
|
||||
can allow the user/admin (and thus the hardware vendor's support desk
|
||||
also) to provide any such input directly to the ENGINE implementation.
|
||||
This way, applications do not need to know anything specific to any
|
||||
device, they only need to provide the means to carry such user/admin
|
||||
input through to the ENGINE in question. Ie. this connects *you* (and
|
||||
your helpdesk) to the specific ENGINE implementation (and device), and
|
||||
allows application authors to not get buried in hassle supporting
|
||||
arbitrary devices they know (and care) nothing about.
|
||||
|
||||
A new "openssl" utility, "openssl engine", has been added in that allows
|
||||
for testing and examination of ENGINE implementations. Basic usage
|
||||
instructions are available by specifying the "-?" command line switch.
|
||||
|
||||
DYNAMIC ENGINES
|
||||
===============
|
||||
|
||||
The new "dynamic" ENGINE provides a low-overhead way to support ENGINE
|
||||
implementations that aren't pre-compiled and linked into OpenSSL-based
|
||||
applications. This could be because existing compiled-in implementations
|
||||
have known problems and you wish to use a newer version with an existing
|
||||
application. It could equally be because the application (or OpenSSL
|
||||
library) you are using simply doesn't have support for the ENGINE you
|
||||
wish to use, and the ENGINE provider (eg. hardware vendor) is providing
|
||||
you with a self-contained implementation in the form of a shared-library.
|
||||
The other use-case for "dynamic" is with applications that wish to
|
||||
maintain the smallest foot-print possible and so do not link in various
|
||||
ENGINE implementations from OpenSSL, but instead leaves you to provide
|
||||
them, if you want them, in the form of "dynamic"-loadable
|
||||
shared-libraries. It should be possible for hardware vendors to provide
|
||||
their own shared-libraries to support arbitrary hardware to work with
|
||||
applications based on OpenSSL 0.9.7 or later. If you're using an
|
||||
application based on 0.9.7 (or later) and the support you desire is only
|
||||
announced for versions later than the one you need, ask the vendor to
|
||||
backport their ENGINE to the version you need.
|
||||
|
||||
How does "dynamic" work?
|
||||
------------------------
|
||||
The dynamic ENGINE has a special flag in its implementation such that
|
||||
every time application code asks for the 'dynamic' ENGINE, it in fact
|
||||
gets its own copy of it. As such, multi-threaded code (or code that
|
||||
multiplexes multiple uses of 'dynamic' in a single application in any
|
||||
way at all) does not get confused by 'dynamic' being used to do many
|
||||
independent things. Other ENGINEs typically don't do this so there is
|
||||
only ever 1 ENGINE structure of its type (and reference counts are used
|
||||
to keep order). The dynamic ENGINE itself provides absolutely no
|
||||
cryptographic functionality, and any attempt to "initialise" the ENGINE
|
||||
automatically fails. All it does provide are a few "control commands"
|
||||
that can be used to control how it will load an external ENGINE
|
||||
implementation from a shared-library. To see these control commands,
|
||||
use the command-line;
|
||||
|
||||
openssl engine -vvvv dynamic
|
||||
|
||||
The "SO_PATH" control command should be used to identify the
|
||||
shared-library that contains the ENGINE implementation, and "NO_VCHECK"
|
||||
might possibly be useful if there is a minor version conflict and you
|
||||
(or a vendor helpdesk) is convinced you can safely ignore it.
|
||||
"ID" is probably only needed if a shared-library implements
|
||||
multiple ENGINEs, but if you know the engine id you expect to be using,
|
||||
it doesn't hurt to specify it (and this provides a sanity check if
|
||||
nothing else). "LIST_ADD" is only required if you actually wish the
|
||||
loaded ENGINE to be discoverable by application code later on using the
|
||||
ENGINE's "id". For most applications, this isn't necessary - but some
|
||||
application authors may have nifty reasons for using it. The "LOAD"
|
||||
command is the only one that takes no parameters and is the command
|
||||
that uses the settings from any previous commands to actually *load*
|
||||
the shared-library ENGINE implementation. If this command succeeds, the
|
||||
(copy of the) 'dynamic' ENGINE will magically morph into the ENGINE
|
||||
that has been loaded from the shared-library. As such, any control
|
||||
commands supported by the loaded ENGINE could then be executed as per
|
||||
normal. Eg. if ENGINE "foo" is implemented in the shared-library
|
||||
"libfoo.so" and it supports some special control command "CMD_FOO", the
|
||||
following code would load and use it (NB: obviously this code has no
|
||||
error checking);
|
||||
|
||||
ENGINE *e = ENGINE_by_id("dynamic");
|
||||
ENGINE_ctrl_cmd_string(e, "SO_PATH", "/lib/libfoo.so", 0);
|
||||
ENGINE_ctrl_cmd_string(e, "ID", "foo", 0);
|
||||
ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0);
|
||||
ENGINE_ctrl_cmd_string(e, "CMD_FOO", "some input data", 0);
|
||||
|
||||
For testing, the "openssl engine" utility can be useful for this sort
|
||||
of thing. For example the above code excerpt would achieve much the
|
||||
same result as;
|
||||
|
||||
openssl engine dynamic \
|
||||
-pre SO_PATH:/lib/libfoo.so \
|
||||
-pre ID:foo \
|
||||
-pre LOAD \
|
||||
-pre "CMD_FOO:some input data"
|
||||
|
||||
Or to simply see the list of commands supported by the "foo" ENGINE;
|
||||
|
||||
openssl engine -vvvv dynamic \
|
||||
-pre SO_PATH:/lib/libfoo.so \
|
||||
-pre ID:foo \
|
||||
-pre LOAD
|
||||
|
||||
Applications that support the ENGINE API and more specifically, the
|
||||
"control commands" mechanism, will provide some way for you to pass
|
||||
such commands through to ENGINEs. As such, you would select "dynamic"
|
||||
as the ENGINE to use, and the parameters/commands you pass would
|
||||
control the *actual* ENGINE used. Each command is actually a name-value
|
||||
pair and the value can sometimes be omitted (eg. the "LOAD" command).
|
||||
Whilst the syntax demonstrated in "openssl engine" uses a colon to
|
||||
separate the command name from the value, applications may provide
|
||||
their own syntax for making that separation (eg. a win32 registry
|
||||
key-value pair may be used by some applications). The reason for the
|
||||
"-pre" syntax in the "openssl engine" utility is that some commands
|
||||
might be issued to an ENGINE *after* it has been initialised for use.
|
||||
Eg. if an ENGINE implementation requires a smart-card to be inserted
|
||||
during initialisation (or a PIN to be typed, or whatever), there may be
|
||||
a control command you can issue afterwards to "forget" the smart-card
|
||||
so that additional initialisation is no longer possible. In
|
||||
applications such as web-servers, where potentially volatile code may
|
||||
run on the same host system, this may provide some arguable security
|
||||
value. In such a case, the command would be passed to the ENGINE after
|
||||
it has been initialised for use, and so the "-post" switch would be
|
||||
used instead. Applications may provide a different syntax for
|
||||
supporting this distinction, and some may simply not provide it at all
|
||||
("-pre" is almost always what you're after, in reality).
|
||||
|
||||
How do I build a "dynamic" ENGINE?
|
||||
----------------------------------
|
||||
This question is trickier - currently OpenSSL bundles various ENGINE
|
||||
implementations that are statically built in, and any application that
|
||||
calls the "ENGINE_load_builtin_engines()" function will automatically
|
||||
have all such ENGINEs available (and occupying memory). Applications
|
||||
that don't call that function have no ENGINEs available like that and
|
||||
would have to use "dynamic" to load any such ENGINE - but on the other
|
||||
hand such applications would only have the memory footprint of any
|
||||
ENGINEs explicitly loaded using user/admin provided control commands.
|
||||
The main advantage of not statically linking ENGINEs and only using
|
||||
"dynamic" for hardware support is that any installation using no
|
||||
"external" ENGINE suffers no unnecessary memory footprint from unused
|
||||
ENGINEs. Likewise, installations that do require an ENGINE incur the
|
||||
overheads from only *that* ENGINE once it has been loaded.
|
||||
|
||||
Sounds good? Maybe, but currently building an ENGINE implementation as
|
||||
a shared-library that can be loaded by "dynamic" isn't automated in
|
||||
OpenSSL's build process. It can be done manually quite easily however.
|
||||
Such a shared-library can either be built with any OpenSSL code it
|
||||
needs statically linked in, or it can link dynamically against OpenSSL
|
||||
if OpenSSL itself is built as a shared library. The instructions are
|
||||
the same in each case, but in the former (statically linked any
|
||||
dependencies on OpenSSL) you must ensure OpenSSL is built with
|
||||
position-independent code ("PIC"). The default OpenSSL compilation may
|
||||
already specify the relevant flags to do this, but you should consult
|
||||
with your compiler documentation if you are in any doubt.
|
||||
|
||||
This example will show building the "atalla" ENGINE in the
|
||||
crypto/engine/ directory as a shared-library for use via the "dynamic"
|
||||
ENGINE.
|
||||
1) "cd" to the crypto/engine/ directory of a pre-compiled OpenSSL
|
||||
source tree.
|
||||
2) Recompile at least one source file so you can see all the compiler
|
||||
flags (and syntax) being used to build normally. Eg;
|
||||
touch hw_atalla.c ; make
|
||||
will rebuild "hw_atalla.o" using all such flags.
|
||||
3) Manually enter the same compilation line to compile the
|
||||
"hw_atalla.c" file but with the following two changes;
|
||||
(a) add "-DENGINE_DYNAMIC_SUPPORT" to the command line switches,
|
||||
(b) change the output file from "hw_atalla.o" to something new,
|
||||
eg. "tmp_atalla.o"
|
||||
4) Link "tmp_atalla.o" into a shared-library using the top-level
|
||||
OpenSSL libraries to resolve any dependencies. The syntax for doing
|
||||
this depends heavily on your system/compiler and is a nightmare
|
||||
known well to anyone who has worked with shared-library portability
|
||||
before. 'gcc' on Linux, for example, would use the following syntax;
|
||||
gcc -shared -o dyn_atalla.so tmp_atalla.o -L../.. -lcrypto
|
||||
5) Test your shared library using "openssl engine" as explained in the
|
||||
previous section. Eg. from the top-level directory, you might try;
|
||||
apps/openssl engine -vvvv dynamic \
|
||||
-pre SO_PATH:./crypto/engine/dyn_atalla.so -pre LOAD
|
||||
If the shared-library loads successfully, you will see both "-pre"
|
||||
commands marked as "SUCCESS" and the list of control commands
|
||||
displayed (because of "-vvvv") will be the control commands for the
|
||||
*atalla* ENGINE (ie. *not* the 'dynamic' ENGINE). You can also add
|
||||
the "-t" switch to the utility if you want it to try and initialise
|
||||
the atalla ENGINE for use to test any possible hardware/driver
|
||||
issues.
|
||||
|
||||
PROBLEMS
|
||||
========
|
||||
|
||||
It seems like the ENGINE part doesn't work too well with CryptoSwift on Win32.
|
||||
A quick test done right before the release showed that trying "openssl speed
|
||||
-engine cswift" generated errors. If the DSO gets enabled, an attempt is made
|
||||
to write at memory address 0x00000002.
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
This release does not support a FIPS 140-2 validated module.
|
||||
@@ -1,41 +0,0 @@
|
||||
#! /usr/bin/env perl
|
||||
# Copyright 2004-2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
#
|
||||
# Licensed under the OpenSSL license (the "License"). You may not use
|
||||
# this file except in compliance with the License. You can obtain a copy
|
||||
# in the file LICENSE in the source distribution or at
|
||||
# https://www.openssl.org/source/license.html
|
||||
|
||||
|
||||
use strict;
|
||||
use warnings;
|
||||
|
||||
my @directory_vars = ( "dir", "certs", "crl_dir", "new_certs_dir" );
|
||||
my @file_vars = ( "database", "certificate", "serial", "crlnumber",
|
||||
"crl", "private_key", "RANDFILE" );
|
||||
while(<STDIN>) {
|
||||
s|\R$||;
|
||||
foreach my $d (@directory_vars) {
|
||||
if (/^(\s*\#?\s*${d}\s*=\s*)\.\/([^\s\#]*)([\s\#].*)$/) {
|
||||
$_ = "$1sys\\\$disk:\[.$2$3";
|
||||
} elsif (/^(\s*\#?\s*${d}\s*=\s*)(\w[^\s\#]*)([\s\#].*)$/) {
|
||||
$_ = "$1sys\\\$disk:\[.$2$3";
|
||||
}
|
||||
s/^(\s*\#?\s*${d}\s*=\s*\$\w+)\/([^\s\#]*)([\s\#].*)$/$1.$2\]$3/;
|
||||
while(/^(\s*\#?\s*${d}\s*=\s*(\$\w+\.|sys\\\$disk:\[\.)[\w\.]+)\/([^\]]*)\](.*)$/) {
|
||||
$_ = "$1.$3]$4";
|
||||
}
|
||||
}
|
||||
foreach my $f (@file_vars) {
|
||||
s/^(\s*\#?\s*${f}\s*=\s*)\.\/(.*)$/$1sys\\\$disk:\[\/$2/;
|
||||
while(/^(\s*\#?\s*${f}\s*=\s*(\$\w+|sys\\\$disk:\[)[^\/]*)\/(\w+\/[^\s\#]*)([\s\#].*)$/) {
|
||||
$_ = "$1.$3$4";
|
||||
}
|
||||
if (/^(\s*\#?\s*${f}\s*=\s*(\$\w+|sys\\\$disk:\[)[^\/]*)\/(\w+)([\s\#].*)$/) {
|
||||
$_ = "$1]$3.$4";
|
||||
} elsif (/^(\s*\#?\s*${f}\s*=\s*(\$\w+|sys\\\$disk:\[)[^\/]*)\/([^\s\#]*)([\s\#].*)$/) {
|
||||
$_ = "$1]$3$4";
|
||||
}
|
||||
}
|
||||
print $_,"\n";
|
||||
}
|
||||
@@ -1,2 +0,0 @@
|
||||
CASE_SENSITIVE=YES
|
||||
SYMBOL_VECTOR=(bind_engine=PROCEDURE,v_check=PROCEDURE)
|
||||
@@ -1,50 +0,0 @@
|
||||
$ ! OpenSSL Internal Verification Procedure
|
||||
$ !
|
||||
$ ! This script checks the consistency of a OpenSSL installation
|
||||
$ ! It had better be spawned, as it creates process logicals
|
||||
$
|
||||
$ ! Generated information
|
||||
$ INSTALLTOP := {- $config{INSTALLTOP} -}
|
||||
$ OPENSSLDIR := {- $config{OPENSSLDIR} -}
|
||||
$
|
||||
$ ! Make sure that INSTALLTOP and OPENSSLDIR become something one
|
||||
$ ! can use to call the startup procedure
|
||||
$ INSTALLTOP_ = F$PARSE("A.;",INSTALLTOP,,,"NO_CONCEAL") -
|
||||
- ".][000000" - "[000000." - "][" - "]A.;" + "."
|
||||
$ OPENSSLDIR_ = F$PARSE("A.;",OPENSSLDIR,,,"NO_CONCEAL") -
|
||||
- ".][000000" - "[000000." - "][" - "]A.;" + "."
|
||||
$
|
||||
$ v := {- sprintf "%02d%02d", split(/\./, $config{version}) -}
|
||||
$ pz := {- $config{pointer_size} -}
|
||||
$
|
||||
$ @'INSTALLTOP_'SYS$STARTUP]openssl_startup'v'
|
||||
$ @'INSTALLTOP_'SYS$STARTUP]openssl_utils'v'
|
||||
$
|
||||
$ IF F$SEARCH("OSSL$LIBCRYPTO''pz'") .EQS. "" -
|
||||
.OR. F$SEARCH("OSSL$LIBSSL''pz'") .EQS. "" {- output_off() if $config{no_shared}; "" -}-
|
||||
.OR. F$SEARCH("OSSL$LIBCRYPTO_SHR''pz'") .EQS. "" -
|
||||
.OR. F$SEARCH("OSSL$LIBSSL_SHR''pz'") .EQS. "" {- output_on() if $config{no_shared}; "" -}-
|
||||
.OR. F$SEARCH("OSSL$INCLUDE:[OPENSSL]crypto.h") .EQS. "" -
|
||||
.OR. F$SEARCH("OPENSSL:crypto.h") .EQS. "" -
|
||||
.OR. F$SEARCH("OSSL$EXE:OPENSSL''v'.EXE") .EQS. ""
|
||||
$ THEN
|
||||
$ WRITE SYS$ERROR "Installation inconsistent"
|
||||
$ EXIT %x00018292 ! RMS$_FNF, file not found
|
||||
$ ENDIF
|
||||
$
|
||||
$ ON ERROR THEN GOTO error
|
||||
$
|
||||
$ ! If something else is wrong with the installation, we're likely
|
||||
$ ! to get an image activation error here
|
||||
$ openssl version -a
|
||||
$
|
||||
$ ! FUTURE ENHANCEMENT: Verify that engines are where they should be.
|
||||
$ ! openssl engine -c -t checker
|
||||
$
|
||||
$ WRITE SYS$ERROR "OpenSSL IVP passed"
|
||||
$ EXIT %x10000001
|
||||
$
|
||||
$ error:
|
||||
$ save_status = $STATUS
|
||||
$ WRITE SYS$ERROR "OpenSSL IVP failed"
|
||||
$ EXIT 'save_status'
|
||||
@@ -1,56 +0,0 @@
|
||||
$ ! OpenSSL shutdown script
|
||||
$ !
|
||||
$ ! This script deassigns the logical names used by the installation
|
||||
$ ! of OpenSSL. It can do so at any level, defined by P1.
|
||||
$ !
|
||||
$ ! P1 Qualifier(s) for DEASSIGN.
|
||||
$ ! Default: /PROCESS
|
||||
$ !
|
||||
$ ! P2 If the value is "NOALIASES", no alias logical names are
|
||||
$ ! deassigned.
|
||||
$
|
||||
$ status = %x10000001 ! Generic success
|
||||
$
|
||||
$ ! In case there's a problem
|
||||
$ ON CONTROL_Y THEN GOTO bailout
|
||||
$ ON ERROR THEN GOTO bailout
|
||||
$
|
||||
$ ! Find the architecture
|
||||
$ IF F$GETSYI("CPU") .LT. 128
|
||||
$ THEN
|
||||
$ arch := VAX
|
||||
$ ELSE
|
||||
$ arch := F$EDIT(F$GETSYI("ARCH_NAME"),"UPCASE")
|
||||
$ IF arch .EQS. "" THEN GOTO unknown_arch
|
||||
$ ENDIF
|
||||
$
|
||||
$ ! Abbrevs
|
||||
$ DEAS := DEASSIGN /NOLOG 'P1'
|
||||
$ sv := {- sprintf "%02d%02d", $config{shlib_major}, $config{shlib_minor} -}
|
||||
$ pz := {- $config{pointer_size} -}
|
||||
$
|
||||
$ DEAS OSSL$DATAROOT
|
||||
$ DEAS OSSL$INSTROOT
|
||||
$ DEAS OSSL$INCLUDE
|
||||
$ DEAS OSSL$LIB
|
||||
$ DEAS OSSL$SHARE
|
||||
$ DEAS OSSL$ENGINES'sv'
|
||||
$ DEAS OSSL$EXE
|
||||
$ DEAS OSSL$LIBCRYPTO'pz'
|
||||
$ DEAS OSSL$LIBSSL'pz'
|
||||
${- output_off() if $config{no_shared}; "" -}
|
||||
$ DEAS OSSL$LIBCRYPTO'sv'_SHR'pz'
|
||||
$ DEAS OSSL$LIBSSL'sv'_SHR'pz'
|
||||
${- output_on() if $config{no_shared}; "" -}
|
||||
$ DEAS OPENSSL
|
||||
$
|
||||
$ IF P2 .NES. "NOALIASES"
|
||||
$ THEN
|
||||
$ DEAS OSSL$ENGINES
|
||||
${- output_off() if $config{no_shared}; "" -}
|
||||
$ DEAS OSSL$LIBCRYPTO_SHR'pz'
|
||||
$ DEAS OSSL$LIBSSL_SHR'pz'
|
||||
${- output_on() if $config{no_shared}; "" -}
|
||||
$ ENDIF
|
||||
$
|
||||
$ EXIT 'status'
|
||||
@@ -1,123 +0,0 @@
|
||||
$ ! OpenSSL startup script
|
||||
$ !
|
||||
$ ! This script defines the logical names used by the installation
|
||||
$ ! of OpenSSL. It can provide those logical names at any level,
|
||||
$ ! defined by P1.
|
||||
$ !
|
||||
$ ! The logical names created are:
|
||||
$ !
|
||||
$ ! OSSL$INSTROOT Installation root
|
||||
$ ! OSSL$DATAROOT Data root (common directory
|
||||
$ ! for certs etc)
|
||||
$ ! OSSL$INCLUDE Include directory root
|
||||
$ ! OSSL$LIB Where the static library files
|
||||
$ ! are located
|
||||
$ ! OSSL$SHARE Where the shareable image files
|
||||
$ ! are located
|
||||
$ ! OSSL$EXE Where the executables are located
|
||||
$ ! OSSL$ENGINESnnn Where the shareable images are located
|
||||
$ ! OSSL$LIBCRYPTO The static crypto library
|
||||
$ ! OSSL$LIBSSL The static ssl library
|
||||
$ ! OSSL$LIBCRYPTOnnn_SHR The shareable crypto image
|
||||
$ ! OSSL$LIBSSLnnn_SHR The shareable ssl image
|
||||
$ ! OPENSSL is OSSL$INCLUDE:[OPENSSL]
|
||||
$ !
|
||||
$ ! In all these, nnn is the OpenSSL version number. This allows
|
||||
$ ! several OpenSSL versions to be installed simultaneously, which
|
||||
$ ! matters for applications that are linked to the shareable images
|
||||
$ ! or that depend on engines.
|
||||
$ !
|
||||
$ ! In addition, unless P2 is "NOALIASES", these logical names are
|
||||
$ ! created:
|
||||
$ !
|
||||
$ ! OSSL$ENGINES Alias for OSSL$ENGINESnnn
|
||||
$ ! OSSL$LIBCRYPTO_SHR Alias for OSSL$LIBCRYPTOnnn_SHR
|
||||
$ ! OSSL$LIBSSL_SHR Alias for OSSL$LIBSSLnnn_SHR
|
||||
$ !
|
||||
$ ! P1 Qualifier(s) for DEFINE. "/SYSTEM" would be typical when
|
||||
$ ! calling this script from SYS$STARTUP:SYSTARTUP_VMS.COM,
|
||||
$ ! while "/PROCESS" would be typical for a personal install.
|
||||
$ ! Default: /PROCESS
|
||||
$ !
|
||||
$ ! P2 If the value is "NOALIASES", no alias logical names are
|
||||
$ ! created.
|
||||
$
|
||||
$ status = %x10000001 ! Generic success
|
||||
$
|
||||
$ ! In case there's a problem
|
||||
$ ON CONTROL_Y THEN GOTO bailout
|
||||
$ ON ERROR THEN GOTO bailout
|
||||
$
|
||||
$ ! Find the architecture
|
||||
$ IF F$GETSYI("CPU") .LT. 128
|
||||
$ THEN
|
||||
$ arch := VAX
|
||||
$ ELSE
|
||||
$ arch = F$EDIT(F$GETSYI("ARCH_NAME"),"UPCASE")
|
||||
$ IF arch .EQS. "" THEN GOTO unknown_arch
|
||||
$ ENDIF
|
||||
$
|
||||
$ ! Generated information
|
||||
$ INSTALLTOP := {- $config{INSTALLTOP} -}
|
||||
$ OPENSSLDIR := {- $config{OPENSSLDIR} -}
|
||||
$
|
||||
$ ! Make sure that INSTALLTOP and OPENSSLDIR become something one
|
||||
$ ! can build concealed logical names on
|
||||
$ INSTALLTOP_ = F$PARSE("A.;",INSTALLTOP,,,"NO_CONCEAL") -
|
||||
- ".][000000" - "[000000." - "][" - "]A.;" + "."
|
||||
$ OPENSSLDIR_ = F$PARSE("A.;",OPENSSLDIR,,,"NO_CONCEAL") -
|
||||
- ".][000000" - "[000000." - "][" - "]A.;" + "."
|
||||
$
|
||||
$ DEFINE /TRANSLATION=CONCEALED /NOLOG WRK_INSTALLTOP 'INSTALLTOP_']
|
||||
$ DEFINE /TRANSLATION=CONCEALED /NOLOG WRK_OPENSSLDIR 'OPENSSLDIR_']
|
||||
$
|
||||
$ ! Check that things are in place, and specifically, the stuff
|
||||
$ ! belonging to this architecture
|
||||
$ IF F$SEARCH("WRK_INSTALLTOP:[000000]INCLUDE.DIR;1") .EQS. "" -
|
||||
.OR. F$SEARCH("WRK_INSTALLTOP:[000000]LIB.DIR;1") .EQS. "" -
|
||||
.OR. F$SEARCH("WRK_INSTALLTOP:[000000]EXE.DIR;1") .EQS. "" -
|
||||
.OR. F$SEARCH("WRK_INSTALLTOP:[LIB]''arch'.DIR;1") .EQS. "" -
|
||||
.OR. F$SEARCH("WRK_INSTALLTOP:[EXE]''arch'.DIR;1") .EQS. "" -
|
||||
.OR. F$SEARCH("WRK_OPENSSLDIR:[000000]openssl.cnf") .EQS. ""
|
||||
$ THEN
|
||||
$ WRITE SYS$ERROR "''INSTALLTOP' doesn't look like an OpenSSL installation for ''arch'"
|
||||
$ status = %x00018292 ! RMS$_FNF, file not found
|
||||
$ GOTO bailout
|
||||
$ ENDIF
|
||||
$
|
||||
$ ! Abbrevs
|
||||
$ DEFT := DEFINE /TRANSLATION=CONCEALED /NOLOG 'P1'
|
||||
$ DEF := DEFINE /NOLOG 'P1'
|
||||
$ sv := {- sprintf "%02d%02d", $config{shlib_major}, $config{shlib_minor} -}
|
||||
$ pz := {- $config{pointer_size} -}
|
||||
$
|
||||
$ DEFT OSSL$DATAROOT 'OPENSSLDIR_']
|
||||
$ DEFT OSSL$INSTROOT 'INSTALLTOP_']
|
||||
$ DEFT OSSL$INCLUDE 'INSTALLTOP_'INCLUDE.]
|
||||
$ DEF OSSL$LIB OSSL$INSTROOT:[LIB.'arch']
|
||||
$ DEF OSSL$SHARE OSSL$INSTROOT:[LIB.'arch']
|
||||
$ DEF OSSL$ENGINES'sv''pz' OSSL$INSTROOT:[ENGINES'sv''pz'.'arch']
|
||||
$ DEF OSSL$EXE OSSL$INSTROOT:[EXE.'arch'],-
|
||||
OSSL$INSTROOT:[EXE]
|
||||
$ DEF OSSL$LIBCRYPTO'pz' OSSL$LIB:OSSL$LIBCRYPTO'pz'.OLB
|
||||
$ DEF OSSL$LIBSSL'pz' OSSL$LIB:OSSL$LIBSSL'pz'.OLB
|
||||
${- output_off() if $config{no_shared}; "" -}
|
||||
$ DEF OSSL$LIBCRYPTO'sv'_SHR'pz' OSSL$SHARE:OSSL$LIBCRYPTO'sv'_SHR'pz'.EXE
|
||||
$ DEF OSSL$LIBSSL'sv'_SHR'pz' OSSL$SHARE:OSSL$LIBSSL'sv'_SHR'pz'.EXE
|
||||
${- output_on() if $config{no_shared}; "" -}
|
||||
$ DEF OPENSSL OSSL$INCLUDE:[OPENSSL]
|
||||
$
|
||||
$ IF P2 .NES. "NOALIASES"
|
||||
$ THEN
|
||||
$ DEF OSSL$ENGINES'pz' OSSL$ENGINES'sv''pz'
|
||||
${- output_off() if $config{no_shared}; "" -}
|
||||
$ DEF OSSL$LIBCRYPTO_SHR'pz' OSSL$LIBCRYPTO'sv'_SHR'pz'
|
||||
$ DEF OSSL$LIBSSL_SHR'pz' OSSL$LIBSSL'sv'_SHR'pz'
|
||||
${- output_on() if $config{no_shared}; "" -}
|
||||
$ ENDIF
|
||||
$
|
||||
$ bailout:
|
||||
$ DEASSIGN WRK_INSTALLTOP
|
||||
$ DEASSIGN WRK_OPENSSLDIR
|
||||
$
|
||||
$ EXIT 'status'
|
||||
@@ -1,14 +0,0 @@
|
||||
$ ! OpenSSL utilities
|
||||
$ !
|
||||
$
|
||||
$ v := {- sprintf "%02d%02d", split(/\./, $config{version}) -}
|
||||
$
|
||||
$ OPENSSL'v' :== $OSSL$EXE:OPENSSL'v'
|
||||
$ OPENSSL :== $OSSL$EXE:OPENSSL'v'
|
||||
$
|
||||
$ IF F$TYPE(PERL) .EQS. "STRING"
|
||||
$ THEN
|
||||
$ C_REHASH :== 'PERL' OSSL$EXE:c_rehash.pl
|
||||
$ ELSE
|
||||
$ WRITE SYS$ERROR "NOTE: no perl => no C_REHASH"
|
||||
$ ENDIF
|
||||
@@ -1,28 +0,0 @@
|
||||
$! Quick script to check how well including individual header files works
|
||||
$! on VMS, even when the VMS macro isn't defined.
|
||||
$
|
||||
$ sav_def = f$env("DEFAULT")
|
||||
$ here = f$parse("A.;0",f$ENV("PROCEDURE")) - "A.;0"
|
||||
$ set default 'here'
|
||||
$ set default [-.include.openssl]
|
||||
$ define openssl 'f$env("DEFAULT")'
|
||||
$ set default [--]
|
||||
$
|
||||
$ loop:
|
||||
$ f = f$search("openssl:*.h")
|
||||
$ if f .eqs. "" then goto loop_end
|
||||
$ write sys$output "Checking ",f
|
||||
$ open/write foo foo.c
|
||||
$ write foo "#undef VMS"
|
||||
$ write foo "#include <stdio.h>"
|
||||
$ write foo "#include <openssl/",f$parse(f,,,"NAME"),".h>"
|
||||
$ write foo "main()"
|
||||
$ write foo "{printf(""foo\n"");}"
|
||||
$ close foo
|
||||
$ cc/STANDARD=ANSI89/NOLIST/PREFIX=ALL foo.c
|
||||
$ delete foo.c;
|
||||
$ goto loop
|
||||
$ loop_end:
|
||||
$ set default 'save_def'
|
||||
$ exit
|
||||
|
||||
@@ -1,62 +0,0 @@
|
||||
#! /usr/bin/env perl
|
||||
# Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
#
|
||||
# Licensed under the OpenSSL license (the "License"). You may not use
|
||||
# this file except in compliance with the License. You can obtain a copy
|
||||
# in the file LICENSE in the source distribution or at
|
||||
# https://www.openssl.org/source/license.html
|
||||
|
||||
|
||||
# This script will translate any SYMBOL_VECTOR item that has a translation
|
||||
# in CXX$DEMANGLER_DB. The latter is generated by and CC/DECC command that
|
||||
# uses the qualifier /REPOSITORY with the build directory as value. When
|
||||
# /NAMES=SHORTENED has been used, this file will hold the translations from
|
||||
# the original symbols to the shortened variants.
|
||||
#
|
||||
# CXX$DEMAGLER_DB. is an ISAM file, but with the magic of RMS, it can be
|
||||
# read as a text file, with each record as one line.
|
||||
#
|
||||
# The lines will have the following syntax for any symbol found that's longer
|
||||
# than 31 characters:
|
||||
#
|
||||
# LONG_symbol_34567890123{cksum}$LONG_symbol_34567890123_more_than_31_chars
|
||||
#
|
||||
# $ is present at the end of the shortened symbol name, and is preceded by a
|
||||
# 7 character checksum. The $ makes it easy to separate the shortened name
|
||||
# from the original one.
|
||||
|
||||
use strict;
|
||||
use warnings;
|
||||
|
||||
usage() if scalar @ARGV < 1;
|
||||
|
||||
my %translations = ();
|
||||
|
||||
open DEMANGLER_DATA, $ARGV[0]
|
||||
or die "Couldn't open $ARGV[0]: $!\n";
|
||||
while(<DEMANGLER_DATA>) {
|
||||
s|\R$||;
|
||||
(my $translated, my $original) = split /\$/;
|
||||
$translations{$original} = $translated.'$';
|
||||
}
|
||||
close DEMANGLER_DATA;
|
||||
|
||||
$| = 1; # Autoflush
|
||||
while(<STDIN>) {
|
||||
s@
|
||||
((?:[A-Za-z0-9_]+)\/)?([A-Za-z0-9_]+)=(PROCEDURE|DATA)
|
||||
@
|
||||
if (defined($translations{$2})) {
|
||||
my $trans = $translations{$2};
|
||||
my $trans_uc = uc $trans;
|
||||
if (defined($1) && $trans ne $trans_uc) {
|
||||
"$trans_uc/$trans=$3"
|
||||
} else {
|
||||
"$trans=$3"
|
||||
}
|
||||
} else {
|
||||
$&
|
||||
}
|
||||
@gxe;
|
||||
print $_;
|
||||
}
|
||||
196
apps/CA.pl.in
196
apps/CA.pl.in
@@ -1,196 +0,0 @@
|
||||
#!{- $config{hashbangperl} -}
|
||||
# Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
#
|
||||
# Licensed under the OpenSSL license (the "License"). You may not use
|
||||
# this file except in compliance with the License. You can obtain a copy
|
||||
# in the file LICENSE in the source distribution or at
|
||||
# https://www.openssl.org/source/license.html
|
||||
|
||||
#
|
||||
# Wrapper around the ca to make it easier to use
|
||||
#
|
||||
# {- join("\n# ", @autowarntext) -}
|
||||
|
||||
use strict;
|
||||
use warnings;
|
||||
|
||||
my $openssl = "openssl";
|
||||
if(defined $ENV{'OPENSSL'}) {
|
||||
$openssl = $ENV{'OPENSSL'};
|
||||
} else {
|
||||
$ENV{'OPENSSL'} = $openssl;
|
||||
}
|
||||
|
||||
my $verbose = 1;
|
||||
|
||||
my $OPENSSL_CONFIG = $ENV{"OPENSSL_CONFIG"} || "";
|
||||
my $DAYS = "-days 365";
|
||||
my $CADAYS = "-days 1095"; # 3 years
|
||||
my $REQ = "$openssl req $OPENSSL_CONFIG";
|
||||
my $CA = "$openssl ca $OPENSSL_CONFIG";
|
||||
my $VERIFY = "$openssl verify";
|
||||
my $X509 = "$openssl x509";
|
||||
my $PKCS12 = "$openssl pkcs12";
|
||||
|
||||
# default openssl.cnf file has setup as per the following
|
||||
my $CATOP = "./demoCA";
|
||||
my $CAKEY = "cakey.pem";
|
||||
my $CAREQ = "careq.pem";
|
||||
my $CACERT = "cacert.pem";
|
||||
my $CACRL = "crl.pem";
|
||||
my $DIRMODE = 0777;
|
||||
|
||||
my $NEWKEY = "newkey.pem";
|
||||
my $NEWREQ = "newreq.pem";
|
||||
my $NEWCERT = "newcert.pem";
|
||||
my $NEWP12 = "newcert.p12";
|
||||
my $RET = 0;
|
||||
my $WHAT = shift @ARGV || "";
|
||||
my $FILE;
|
||||
|
||||
# See if reason for a CRL entry is valid; exit if not.
|
||||
sub crl_reason_ok
|
||||
{
|
||||
my $r = shift;
|
||||
|
||||
if ($r eq 'unspecified' || $r eq 'keyCompromise'
|
||||
|| $r eq 'CACompromise' || $r eq 'affiliationChanged'
|
||||
|| $r eq 'superseded' || $r eq 'cessationOfOperation'
|
||||
|| $r eq 'certificateHold' || $r eq 'removeFromCRL') {
|
||||
return 1;
|
||||
}
|
||||
print STDERR "Invalid CRL reason; must be one of:\n";
|
||||
print STDERR " unspecified, keyCompromise, CACompromise,\n";
|
||||
print STDERR " affiliationChanged, superseded, cessationOfOperation\n";
|
||||
print STDERR " certificateHold, removeFromCRL";
|
||||
exit 1;
|
||||
}
|
||||
|
||||
# Copy a PEM-format file; return like exit status (zero means ok)
|
||||
sub copy_pemfile
|
||||
{
|
||||
my ($infile, $outfile, $bound) = @_;
|
||||
my $found = 0;
|
||||
|
||||
open IN, $infile || die "Cannot open $infile, $!";
|
||||
open OUT, ">$outfile" || die "Cannot write to $outfile, $!";
|
||||
while (<IN>) {
|
||||
$found = 1 if /^-----BEGIN.*$bound/;
|
||||
print OUT $_ if $found;
|
||||
$found = 2, last if /^-----END.*$bound/;
|
||||
}
|
||||
close IN;
|
||||
close OUT;
|
||||
return $found == 2 ? 0 : 1;
|
||||
}
|
||||
|
||||
# Wrapper around system; useful for debugging. Returns just the exit status
|
||||
sub run
|
||||
{
|
||||
my $cmd = shift;
|
||||
print "====\n$cmd\n" if $verbose;
|
||||
my $status = system($cmd);
|
||||
print "==> $status\n====\n" if $verbose;
|
||||
return $status >> 8;
|
||||
}
|
||||
|
||||
|
||||
if ( $WHAT =~ /^(-\?|-h|-help)$/ ) {
|
||||
print STDERR "usage: CA -newcert|-newreq|-newreq-nodes|-newca|-sign|-signcert|-verify\n";
|
||||
print STDERR " CA -pkcs12 [certname]\n";
|
||||
print STDERR " CA -crl|-revoke cert-filename [reason]\n";
|
||||
exit 0;
|
||||
}
|
||||
if ($WHAT eq '-newcert' ) {
|
||||
# create a certificate
|
||||
$RET = run("$REQ -new -x509 -keyout $NEWKEY -out $NEWCERT $DAYS");
|
||||
print "Cert is in $NEWCERT, private key is in $NEWKEY\n" if $RET == 0;
|
||||
} elsif ($WHAT eq '-newreq' ) {
|
||||
# create a certificate request
|
||||
$RET = run("$REQ -new -keyout $NEWKEY -out $NEWREQ $DAYS");
|
||||
print "Request is in $NEWREQ, private key is in $NEWKEY\n" if $RET == 0;
|
||||
} elsif ($WHAT eq '-newreq-nodes' ) {
|
||||
# create a certificate request
|
||||
$RET = run("$REQ -new -nodes -keyout $NEWKEY -out $NEWREQ $DAYS");
|
||||
print "Request is in $NEWREQ, private key is in $NEWKEY\n" if $RET == 0;
|
||||
} elsif ($WHAT eq '-newca' ) {
|
||||
# create the directory hierarchy
|
||||
mkdir ${CATOP}, $DIRMODE;
|
||||
mkdir "${CATOP}/certs", $DIRMODE;
|
||||
mkdir "${CATOP}/crl", $DIRMODE ;
|
||||
mkdir "${CATOP}/newcerts", $DIRMODE;
|
||||
mkdir "${CATOP}/private", $DIRMODE;
|
||||
open OUT, ">${CATOP}/index.txt";
|
||||
close OUT;
|
||||
open OUT, ">${CATOP}/crlnumber";
|
||||
print OUT "01\n";
|
||||
close OUT;
|
||||
# ask user for existing CA certificate
|
||||
print "CA certificate filename (or enter to create)\n";
|
||||
$FILE = "" unless defined($FILE = <STDIN>);
|
||||
$FILE =~ s{\R$}{};
|
||||
if ($FILE ne "") {
|
||||
copy_pemfile($FILE,"${CATOP}/private/$CAKEY", "PRIVATE");
|
||||
copy_pemfile($FILE,"${CATOP}/$CACERT", "CERTIFICATE");
|
||||
} else {
|
||||
print "Making CA certificate ...\n";
|
||||
$RET = run("$REQ -new -keyout"
|
||||
. " ${CATOP}/private/$CAKEY"
|
||||
. " -out ${CATOP}/$CAREQ");
|
||||
$RET = run("$CA -create_serial"
|
||||
. " -out ${CATOP}/$CACERT $CADAYS -batch"
|
||||
. " -keyfile ${CATOP}/private/$CAKEY -selfsign"
|
||||
. " -extensions v3_ca"
|
||||
. " -infiles ${CATOP}/$CAREQ") if $RET == 0;
|
||||
print "CA certificate is in ${CATOP}/$CACERT\n" if $RET == 0;
|
||||
}
|
||||
} elsif ($WHAT eq '-pkcs12' ) {
|
||||
my $cname = $ARGV[0];
|
||||
$cname = "My Certificate" unless defined $cname;
|
||||
$RET = run("$PKCS12 -in $NEWCERT -inkey $NEWKEY"
|
||||
. " -certfile ${CATOP}/$CACERT"
|
||||
. " -out $NEWP12"
|
||||
. " -export -name \"$cname\"");
|
||||
print "PKCS #12 file is in $NEWP12\n" if $RET == 0;
|
||||
} elsif ($WHAT eq '-xsign' ) {
|
||||
$RET = run("$CA -policy policy_anything -infiles $NEWREQ");
|
||||
} elsif ($WHAT eq '-sign' ) {
|
||||
$RET = run("$CA -policy policy_anything -out $NEWCERT -infiles $NEWREQ");
|
||||
print "Signed certificate is in $NEWCERT\n" if $RET == 0;
|
||||
} elsif ($WHAT eq '-signCA' ) {
|
||||
$RET = run("$CA -policy policy_anything -out $NEWCERT"
|
||||
. " -extensions v3_ca -infiles $NEWREQ");
|
||||
print "Signed CA certificate is in $NEWCERT\n" if $RET == 0;
|
||||
} elsif ($WHAT eq '-signcert' ) {
|
||||
$RET = run("$X509 -x509toreq -in $NEWREQ -signkey $NEWREQ"
|
||||
. " -out tmp.pem");
|
||||
$RET = run("$CA -policy policy_anything -out $NEWCERT"
|
||||
. " -infiles tmp.pem") if $RET == 0;
|
||||
print "Signed certificate is in $NEWCERT\n" if $RET == 0;
|
||||
} elsif ($WHAT eq '-verify' ) {
|
||||
my @files = @ARGV ? @ARGV : ( $NEWCERT );
|
||||
my $file;
|
||||
foreach $file (@files) {
|
||||
my $status = run("$VERIFY \"-CAfile\" ${CATOP}/$CACERT $file");
|
||||
$RET = $status if $status != 0;
|
||||
}
|
||||
} elsif ($WHAT eq '-crl' ) {
|
||||
$RET = run("$CA -gencrl -out ${CATOP}/crl/$CACRL");
|
||||
print "Generated CRL is in ${CATOP}/crl/$CACRL\n" if $RET == 0;
|
||||
} elsif ($WHAT eq '-revoke' ) {
|
||||
my $cname = $ARGV[0];
|
||||
if (!defined $cname) {
|
||||
print "Certificate filename is required; reason optional.\n";
|
||||
exit 1;
|
||||
}
|
||||
my $reason = $ARGV[1];
|
||||
$reason = " -crl_reason $reason"
|
||||
if defined $reason && crl_reason_ok($reason);
|
||||
$RET = run("$CA -revoke \"$cname\"" . $reason);
|
||||
} else {
|
||||
print STDERR "Unknown arg \"$WHAT\"\n";
|
||||
print STDERR "Use -help for help.\n";
|
||||
exit 1;
|
||||
}
|
||||
|
||||
exit $RET;
|
||||
115
apps/app_rand.c
115
apps/app_rand.c
@@ -1,115 +0,0 @@
|
||||
/*
|
||||
* Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include "apps.h"
|
||||
#include <openssl/bio.h>
|
||||
#include <openssl/rand.h>
|
||||
|
||||
static int seeded = 0;
|
||||
static int egdsocket = 0;
|
||||
|
||||
int app_RAND_load_file(const char *file, int dont_warn)
|
||||
{
|
||||
int consider_randfile = (file == NULL);
|
||||
char buffer[200];
|
||||
|
||||
if (file == NULL)
|
||||
file = RAND_file_name(buffer, sizeof(buffer));
|
||||
#ifndef OPENSSL_NO_EGD
|
||||
else if (RAND_egd(file) > 0) {
|
||||
/*
|
||||
* we try if the given filename is an EGD socket. if it is, we don't
|
||||
* write anything back to the file.
|
||||
*/
|
||||
egdsocket = 1;
|
||||
return 1;
|
||||
}
|
||||
#endif
|
||||
if (file == NULL || !RAND_load_file(file, -1)) {
|
||||
if (RAND_status() == 0) {
|
||||
if (!dont_warn) {
|
||||
BIO_printf(bio_err, "unable to load 'random state'\n");
|
||||
BIO_printf(bio_err,
|
||||
"This means that the random number generator has not been seeded\n");
|
||||
BIO_printf(bio_err, "with much random data.\n");
|
||||
if (consider_randfile) { /* explanation does not apply when a
|
||||
* file is explicitly named */
|
||||
BIO_printf(bio_err,
|
||||
"Consider setting the RANDFILE environment variable to point at a file that\n");
|
||||
BIO_printf(bio_err,
|
||||
"'random' data can be kept in (the file will be overwritten).\n");
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
seeded = 1;
|
||||
return 1;
|
||||
}
|
||||
|
||||
long app_RAND_load_files(char *name)
|
||||
{
|
||||
char *p, *n;
|
||||
int last;
|
||||
long tot = 0;
|
||||
#ifndef OPENSSL_NO_EGD
|
||||
int egd;
|
||||
#endif
|
||||
|
||||
for (;;) {
|
||||
last = 0;
|
||||
for (p = name; ((*p != '\0') && (*p != LIST_SEPARATOR_CHAR)); p++) ;
|
||||
if (*p == '\0')
|
||||
last = 1;
|
||||
*p = '\0';
|
||||
n = name;
|
||||
name = p + 1;
|
||||
if (*n == '\0')
|
||||
break;
|
||||
|
||||
#ifndef OPENSSL_NO_EGD
|
||||
egd = RAND_egd(n);
|
||||
if (egd > 0)
|
||||
tot += egd;
|
||||
else
|
||||
#endif
|
||||
tot += RAND_load_file(n, -1);
|
||||
if (last)
|
||||
break;
|
||||
}
|
||||
if (tot > 512)
|
||||
app_RAND_allow_write_file();
|
||||
return (tot);
|
||||
}
|
||||
|
||||
int app_RAND_write_file(const char *file)
|
||||
{
|
||||
char buffer[200];
|
||||
|
||||
if (egdsocket || !seeded)
|
||||
/*
|
||||
* If we did not manage to read the seed file, we should not write a
|
||||
* low-entropy seed file back -- it would suppress a crucial warning
|
||||
* the next time we want to use it.
|
||||
*/
|
||||
return 0;
|
||||
|
||||
if (file == NULL)
|
||||
file = RAND_file_name(buffer, sizeof(buffer));
|
||||
if (file == NULL || !RAND_write_file(file)) {
|
||||
BIO_printf(bio_err, "unable to write 'random state'\n");
|
||||
return 0;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
void app_RAND_allow_write_file(void)
|
||||
{
|
||||
seeded = 1;
|
||||
}
|
||||
2663
apps/apps.c
2663
apps/apps.c
File diff suppressed because it is too large
Load Diff
573
apps/apps.h
573
apps/apps.h
@@ -1,573 +0,0 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#ifndef HEADER_APPS_H
|
||||
# define HEADER_APPS_H
|
||||
|
||||
# include "e_os.h"
|
||||
# if defined(__unix) || defined(__unix__)
|
||||
# include <sys/time.h> /* struct timeval for DTLS */
|
||||
# endif
|
||||
# include <assert.h>
|
||||
|
||||
# include <openssl/e_os2.h>
|
||||
# include <openssl/ossl_typ.h>
|
||||
# include <openssl/bio.h>
|
||||
# include <openssl/x509.h>
|
||||
# include <openssl/lhash.h>
|
||||
# include <openssl/conf.h>
|
||||
# include <openssl/txt_db.h>
|
||||
# include <openssl/engine.h>
|
||||
# include <openssl/ocsp.h>
|
||||
# include <signal.h>
|
||||
|
||||
# if defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_WINCE)
|
||||
# define openssl_fdset(a,b) FD_SET((unsigned int)a, b)
|
||||
# else
|
||||
# define openssl_fdset(a,b) FD_SET(a, b)
|
||||
# endif
|
||||
|
||||
/*
|
||||
* quick macro when you need to pass an unsigned char instead of a char.
|
||||
* this is true for some implementations of the is*() functions, for
|
||||
* example.
|
||||
*/
|
||||
#define _UC(c) ((unsigned char)(c))
|
||||
|
||||
int app_RAND_load_file(const char *file, int dont_warn);
|
||||
int app_RAND_write_file(const char *file);
|
||||
/*
|
||||
* When `file' is NULL, use defaults. `bio_e' is for error messages.
|
||||
*/
|
||||
void app_RAND_allow_write_file(void);
|
||||
long app_RAND_load_files(char *file); /* `file' is a list of files to read,
|
||||
* separated by LIST_SEPARATOR_CHAR
|
||||
* (see e_os.h). The string is
|
||||
* destroyed! */
|
||||
|
||||
extern char *default_config_file;
|
||||
extern BIO *bio_in;
|
||||
extern BIO *bio_out;
|
||||
extern BIO *bio_err;
|
||||
BIO *dup_bio_in(int format);
|
||||
BIO *dup_bio_out(int format);
|
||||
BIO *dup_bio_err(int format);
|
||||
BIO *bio_open_owner(const char *filename, int format, int private);
|
||||
BIO *bio_open_default(const char *filename, char mode, int format);
|
||||
BIO *bio_open_default_quiet(const char *filename, char mode, int format);
|
||||
CONF *app_load_config(const char *filename);
|
||||
CONF *app_load_config_quiet(const char *filename);
|
||||
int app_load_modules(const CONF *config);
|
||||
void unbuffer(FILE *fp);
|
||||
void wait_for_async(SSL *s);
|
||||
# if defined(OPENSSL_SYS_MSDOS)
|
||||
int has_stdin_waiting(void);
|
||||
# endif
|
||||
|
||||
void corrupt_signature(const ASN1_STRING *signature);
|
||||
int set_cert_times(X509 *x, const char *startdate, const char *enddate,
|
||||
int days);
|
||||
|
||||
/*
|
||||
* Common verification options.
|
||||
*/
|
||||
# define OPT_V_ENUM \
|
||||
OPT_V__FIRST=2000, \
|
||||
OPT_V_POLICY, OPT_V_PURPOSE, OPT_V_VERIFY_NAME, OPT_V_VERIFY_DEPTH, \
|
||||
OPT_V_ATTIME, OPT_V_VERIFY_HOSTNAME, OPT_V_VERIFY_EMAIL, \
|
||||
OPT_V_VERIFY_IP, OPT_V_IGNORE_CRITICAL, OPT_V_ISSUER_CHECKS, \
|
||||
OPT_V_CRL_CHECK, OPT_V_CRL_CHECK_ALL, OPT_V_POLICY_CHECK, \
|
||||
OPT_V_EXPLICIT_POLICY, OPT_V_INHIBIT_ANY, OPT_V_INHIBIT_MAP, \
|
||||
OPT_V_X509_STRICT, OPT_V_EXTENDED_CRL, OPT_V_USE_DELTAS, \
|
||||
OPT_V_POLICY_PRINT, OPT_V_CHECK_SS_SIG, OPT_V_TRUSTED_FIRST, \
|
||||
OPT_V_SUITEB_128_ONLY, OPT_V_SUITEB_128, OPT_V_SUITEB_192, \
|
||||
OPT_V_PARTIAL_CHAIN, OPT_V_NO_ALT_CHAINS, OPT_V_NO_CHECK_TIME, \
|
||||
OPT_V_VERIFY_AUTH_LEVEL, OPT_V_ALLOW_PROXY_CERTS, \
|
||||
OPT_V__LAST
|
||||
|
||||
# define OPT_V_OPTIONS \
|
||||
{ "policy", OPT_V_POLICY, 's', "adds policy to the acceptable policy set"}, \
|
||||
{ "purpose", OPT_V_PURPOSE, 's', \
|
||||
"certificate chain purpose"}, \
|
||||
{ "verify_name", OPT_V_VERIFY_NAME, 's', "verification policy name"}, \
|
||||
{ "verify_depth", OPT_V_VERIFY_DEPTH, 'n', \
|
||||
"chain depth limit" }, \
|
||||
{ "auth_level", OPT_V_VERIFY_AUTH_LEVEL, 'n', \
|
||||
"chain authentication security level" }, \
|
||||
{ "attime", OPT_V_ATTIME, 'M', "verification epoch time" }, \
|
||||
{ "verify_hostname", OPT_V_VERIFY_HOSTNAME, 's', \
|
||||
"expected peer hostname" }, \
|
||||
{ "verify_email", OPT_V_VERIFY_EMAIL, 's', \
|
||||
"expected peer email" }, \
|
||||
{ "verify_ip", OPT_V_VERIFY_IP, 's', \
|
||||
"expected peer IP address" }, \
|
||||
{ "ignore_critical", OPT_V_IGNORE_CRITICAL, '-', \
|
||||
"permit unhandled critical extensions"}, \
|
||||
{ "issuer_checks", OPT_V_ISSUER_CHECKS, '-', "(deprecated)"}, \
|
||||
{ "crl_check", OPT_V_CRL_CHECK, '-', "check leaf certificate revocation" }, \
|
||||
{ "crl_check_all", OPT_V_CRL_CHECK_ALL, '-', "check full chain revocation" }, \
|
||||
{ "policy_check", OPT_V_POLICY_CHECK, '-', "perform rfc5280 policy checks"}, \
|
||||
{ "explicit_policy", OPT_V_EXPLICIT_POLICY, '-', \
|
||||
"set policy variable require-explicit-policy"}, \
|
||||
{ "inhibit_any", OPT_V_INHIBIT_ANY, '-', \
|
||||
"set policy variable inhibit-any-policy"}, \
|
||||
{ "inhibit_map", OPT_V_INHIBIT_MAP, '-', \
|
||||
"set policy variable inhibit-policy-mapping"}, \
|
||||
{ "x509_strict", OPT_V_X509_STRICT, '-', \
|
||||
"disable certificate compatibility work-arounds"}, \
|
||||
{ "extended_crl", OPT_V_EXTENDED_CRL, '-', \
|
||||
"enable extended CRL features"}, \
|
||||
{ "use_deltas", OPT_V_USE_DELTAS, '-', \
|
||||
"use delta CRLs"}, \
|
||||
{ "policy_print", OPT_V_POLICY_PRINT, '-', \
|
||||
"print policy processing diagnostics"}, \
|
||||
{ "check_ss_sig", OPT_V_CHECK_SS_SIG, '-', \
|
||||
"check root CA self-signatures"}, \
|
||||
{ "trusted_first", OPT_V_TRUSTED_FIRST, '-', \
|
||||
"search trust store first (default)" }, \
|
||||
{ "suiteB_128_only", OPT_V_SUITEB_128_ONLY, '-', "Suite B 128-bit-only mode"}, \
|
||||
{ "suiteB_128", OPT_V_SUITEB_128, '-', \
|
||||
"Suite B 128-bit mode allowing 192-bit algorithms"}, \
|
||||
{ "suiteB_192", OPT_V_SUITEB_192, '-', "Suite B 192-bit-only mode" }, \
|
||||
{ "partial_chain", OPT_V_PARTIAL_CHAIN, '-', \
|
||||
"accept chains anchored by intermediate trust-store CAs"}, \
|
||||
{ "no_alt_chains", OPT_V_NO_ALT_CHAINS, '-', "(deprecated)" }, \
|
||||
{ "no_check_time", OPT_V_NO_CHECK_TIME, '-', "ignore certificate validity time" }, \
|
||||
{ "allow_proxy_certs", OPT_V_ALLOW_PROXY_CERTS, '-', "allow the use of proxy certificates" }
|
||||
|
||||
# define OPT_V_CASES \
|
||||
OPT_V__FIRST: case OPT_V__LAST: break; \
|
||||
case OPT_V_POLICY: \
|
||||
case OPT_V_PURPOSE: \
|
||||
case OPT_V_VERIFY_NAME: \
|
||||
case OPT_V_VERIFY_DEPTH: \
|
||||
case OPT_V_VERIFY_AUTH_LEVEL: \
|
||||
case OPT_V_ATTIME: \
|
||||
case OPT_V_VERIFY_HOSTNAME: \
|
||||
case OPT_V_VERIFY_EMAIL: \
|
||||
case OPT_V_VERIFY_IP: \
|
||||
case OPT_V_IGNORE_CRITICAL: \
|
||||
case OPT_V_ISSUER_CHECKS: \
|
||||
case OPT_V_CRL_CHECK: \
|
||||
case OPT_V_CRL_CHECK_ALL: \
|
||||
case OPT_V_POLICY_CHECK: \
|
||||
case OPT_V_EXPLICIT_POLICY: \
|
||||
case OPT_V_INHIBIT_ANY: \
|
||||
case OPT_V_INHIBIT_MAP: \
|
||||
case OPT_V_X509_STRICT: \
|
||||
case OPT_V_EXTENDED_CRL: \
|
||||
case OPT_V_USE_DELTAS: \
|
||||
case OPT_V_POLICY_PRINT: \
|
||||
case OPT_V_CHECK_SS_SIG: \
|
||||
case OPT_V_TRUSTED_FIRST: \
|
||||
case OPT_V_SUITEB_128_ONLY: \
|
||||
case OPT_V_SUITEB_128: \
|
||||
case OPT_V_SUITEB_192: \
|
||||
case OPT_V_PARTIAL_CHAIN: \
|
||||
case OPT_V_NO_ALT_CHAINS: \
|
||||
case OPT_V_NO_CHECK_TIME: \
|
||||
case OPT_V_ALLOW_PROXY_CERTS
|
||||
|
||||
/*
|
||||
* Common "extended"? options.
|
||||
*/
|
||||
# define OPT_X_ENUM \
|
||||
OPT_X__FIRST=1000, \
|
||||
OPT_X_KEY, OPT_X_CERT, OPT_X_CHAIN, OPT_X_CHAIN_BUILD, \
|
||||
OPT_X_CERTFORM, OPT_X_KEYFORM, \
|
||||
OPT_X__LAST
|
||||
|
||||
# define OPT_X_OPTIONS \
|
||||
{ "xkey", OPT_X_KEY, '<', "key for Extended certificates"}, \
|
||||
{ "xcert", OPT_X_CERT, '<', "cert for Extended certificates"}, \
|
||||
{ "xchain", OPT_X_CHAIN, '<', "chain for Extended certificates"}, \
|
||||
{ "xchain_build", OPT_X_CHAIN_BUILD, '-', \
|
||||
"build certificate chain for the extended certificates"}, \
|
||||
{ "xcertform", OPT_X_CERTFORM, 'F', \
|
||||
"format of Extended certificate (PEM or DER) PEM default " }, \
|
||||
{ "xkeyform", OPT_X_KEYFORM, 'F', \
|
||||
"format of Extended certificate's key (PEM or DER) PEM default"}
|
||||
|
||||
# define OPT_X_CASES \
|
||||
OPT_X__FIRST: case OPT_X__LAST: break; \
|
||||
case OPT_X_KEY: \
|
||||
case OPT_X_CERT: \
|
||||
case OPT_X_CHAIN: \
|
||||
case OPT_X_CHAIN_BUILD: \
|
||||
case OPT_X_CERTFORM: \
|
||||
case OPT_X_KEYFORM
|
||||
|
||||
/*
|
||||
* Common SSL options.
|
||||
* Any changes here must be coordinated with ../ssl/ssl_conf.c
|
||||
*/
|
||||
# define OPT_S_ENUM \
|
||||
OPT_S__FIRST=3000, \
|
||||
OPT_S_NOSSL3, OPT_S_NOTLS1, OPT_S_NOTLS1_1, OPT_S_NOTLS1_2, \
|
||||
OPT_S_BUGS, OPT_S_NO_COMP, OPT_S_NOTICKET, \
|
||||
OPT_S_SERVERPREF, OPT_S_LEGACYRENEG, OPT_S_LEGACYCONN, \
|
||||
OPT_S_ONRESUMP, OPT_S_NOLEGACYCONN, OPT_S_STRICT, OPT_S_SIGALGS, \
|
||||
OPT_S_CLIENTSIGALGS, OPT_S_CURVES, OPT_S_NAMEDCURVE, OPT_S_CIPHER, \
|
||||
OPT_S_DEBUGBROKE, OPT_S_COMP, OPT_S_MINPROTO, OPT_S_MAXPROTO, \
|
||||
OPT_S_NO_RENEGOTIATION, OPT_S__LAST
|
||||
|
||||
# define OPT_S_OPTIONS \
|
||||
{"no_ssl3", OPT_S_NOSSL3, '-',"Just disable SSLv3" }, \
|
||||
{"no_tls1", OPT_S_NOTLS1, '-', "Just disable TLSv1"}, \
|
||||
{"no_tls1_1", OPT_S_NOTLS1_1, '-', "Just disable TLSv1.1" }, \
|
||||
{"no_tls1_2", OPT_S_NOTLS1_2, '-', "Just disable TLSv1.2"}, \
|
||||
{"bugs", OPT_S_BUGS, '-', "Turn on SSL bug compatibility"}, \
|
||||
{"no_comp", OPT_S_NO_COMP, '-', "Disable SSL/TLS compression (default)" }, \
|
||||
{"comp", OPT_S_COMP, '-', "Use SSL/TLS-level compression" }, \
|
||||
{"no_ticket", OPT_S_NOTICKET, '-', \
|
||||
"Disable use of TLS session tickets"}, \
|
||||
{"serverpref", OPT_S_SERVERPREF, '-', "Use server's cipher preferences"}, \
|
||||
{"legacy_renegotiation", OPT_S_LEGACYRENEG, '-', \
|
||||
"Enable use of legacy renegotiation (dangerous)"}, \
|
||||
{"no_renegotiation", OPT_S_NO_RENEGOTIATION, '-', \
|
||||
"Disable all renegotiation."}, \
|
||||
{"legacy_server_connect", OPT_S_LEGACYCONN, '-', \
|
||||
"Allow initial connection to servers that don't support RI"}, \
|
||||
{"no_resumption_on_reneg", OPT_S_ONRESUMP, '-', \
|
||||
"Disallow session resumption on renegotiation"}, \
|
||||
{"no_legacy_server_connect", OPT_S_NOLEGACYCONN, '-', \
|
||||
"Disallow initial connection to servers that don't support RI"}, \
|
||||
{"strict", OPT_S_STRICT, '-', \
|
||||
"Enforce strict certificate checks as per TLS standard"}, \
|
||||
{"sigalgs", OPT_S_SIGALGS, 's', \
|
||||
"Signature algorithms to support (colon-separated list)" }, \
|
||||
{"client_sigalgs", OPT_S_CLIENTSIGALGS, 's', \
|
||||
"Signature algorithms to support for client certificate" \
|
||||
" authentication (colon-separated list)" }, \
|
||||
{"curves", OPT_S_CURVES, 's', \
|
||||
"Elliptic curves to advertise (colon-separated list)" }, \
|
||||
{"named_curve", OPT_S_NAMEDCURVE, 's', \
|
||||
"Elliptic curve used for ECDHE (server-side only)" }, \
|
||||
{"cipher", OPT_S_CIPHER, 's', "Specify cipher list to be used"}, \
|
||||
{"min_protocol", OPT_S_MINPROTO, 's', "Specify the minimum protocol version to be used"}, \
|
||||
{"max_protocol", OPT_S_MAXPROTO, 's', "Specify the maximum protocol version to be used"}, \
|
||||
{"debug_broken_protocol", OPT_S_DEBUGBROKE, '-', \
|
||||
"Perform all sorts of protocol violations for testing purposes"}
|
||||
|
||||
# define OPT_S_CASES \
|
||||
OPT_S__FIRST: case OPT_S__LAST: break; \
|
||||
case OPT_S_NOSSL3: \
|
||||
case OPT_S_NOTLS1: \
|
||||
case OPT_S_NOTLS1_1: \
|
||||
case OPT_S_NOTLS1_2: \
|
||||
case OPT_S_BUGS: \
|
||||
case OPT_S_NO_COMP: \
|
||||
case OPT_S_COMP: \
|
||||
case OPT_S_NOTICKET: \
|
||||
case OPT_S_SERVERPREF: \
|
||||
case OPT_S_LEGACYRENEG: \
|
||||
case OPT_S_LEGACYCONN: \
|
||||
case OPT_S_ONRESUMP: \
|
||||
case OPT_S_NOLEGACYCONN: \
|
||||
case OPT_S_STRICT: \
|
||||
case OPT_S_SIGALGS: \
|
||||
case OPT_S_CLIENTSIGALGS: \
|
||||
case OPT_S_CURVES: \
|
||||
case OPT_S_NAMEDCURVE: \
|
||||
case OPT_S_CIPHER: \
|
||||
case OPT_S_MINPROTO: \
|
||||
case OPT_S_MAXPROTO: \
|
||||
case OPT_S_NO_RENEGOTIATION: \
|
||||
case OPT_S_DEBUGBROKE
|
||||
|
||||
#define IS_NO_PROT_FLAG(o) \
|
||||
(o == OPT_S_NOSSL3 || o == OPT_S_NOTLS1 || o == OPT_S_NOTLS1_1 \
|
||||
|| o == OPT_S_NOTLS1_2)
|
||||
|
||||
/*
|
||||
* Option parsing.
|
||||
*/
|
||||
extern const char OPT_HELP_STR[];
|
||||
extern const char OPT_MORE_STR[];
|
||||
typedef struct options_st {
|
||||
const char *name;
|
||||
int retval;
|
||||
/*
|
||||
* value type: - no value (also the value zero), n number, p positive
|
||||
* number, u unsigned, l long, s string, < input file, > output file,
|
||||
* f any format, F der/pem format , E der/pem/engine format identifier.
|
||||
* l, n and u include zero; p does not.
|
||||
*/
|
||||
int valtype;
|
||||
const char *helpstr;
|
||||
} OPTIONS;
|
||||
|
||||
/*
|
||||
* A string/int pairing; widely use for option value lookup, hence the
|
||||
* name OPT_PAIR. But that name is misleading in s_cb.c, so we also use
|
||||
* the "generic" name STRINT_PAIR.
|
||||
*/
|
||||
typedef struct string_int_pair_st {
|
||||
const char *name;
|
||||
int retval;
|
||||
} OPT_PAIR, STRINT_PAIR;
|
||||
|
||||
/* Flags to pass into opt_format; see FORMAT_xxx, below. */
|
||||
# define OPT_FMT_PEMDER (1L << 1)
|
||||
# define OPT_FMT_PKCS12 (1L << 2)
|
||||
# define OPT_FMT_SMIME (1L << 3)
|
||||
# define OPT_FMT_ENGINE (1L << 4)
|
||||
# define OPT_FMT_MSBLOB (1L << 5)
|
||||
# define OPT_FMT_NETSCAPE (1L << 6)
|
||||
# define OPT_FMT_NSS (1L << 7)
|
||||
# define OPT_FMT_TEXT (1L << 8)
|
||||
# define OPT_FMT_HTTP (1L << 9)
|
||||
# define OPT_FMT_PVK (1L << 10)
|
||||
# define OPT_FMT_PDE (OPT_FMT_PEMDER | OPT_FMT_ENGINE)
|
||||
# define OPT_FMT_PDS (OPT_FMT_PEMDER | OPT_FMT_SMIME)
|
||||
# define OPT_FMT_ANY ( \
|
||||
OPT_FMT_PEMDER | OPT_FMT_PKCS12 | OPT_FMT_SMIME | \
|
||||
OPT_FMT_ENGINE | OPT_FMT_MSBLOB | OPT_FMT_NETSCAPE | \
|
||||
OPT_FMT_NSS | OPT_FMT_TEXT | OPT_FMT_HTTP | OPT_FMT_PVK)
|
||||
|
||||
char *opt_progname(const char *argv0);
|
||||
char *opt_getprog(void);
|
||||
char *opt_init(int ac, char **av, const OPTIONS * o);
|
||||
int opt_next(void);
|
||||
int opt_format(const char *s, unsigned long flags, int *result);
|
||||
int opt_int(const char *arg, int *result);
|
||||
int opt_ulong(const char *arg, unsigned long *result);
|
||||
int opt_long(const char *arg, long *result);
|
||||
#if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 199901L && \
|
||||
defined(INTMAX_MAX) && defined(UINTMAX_MAX)
|
||||
int opt_imax(const char *arg, intmax_t *result);
|
||||
int opt_umax(const char *arg, uintmax_t *result);
|
||||
#else
|
||||
# define opt_imax opt_long
|
||||
# define opt_umax opt_ulong
|
||||
# define intmax_t long
|
||||
# define uintmax_t unsigned long
|
||||
#endif
|
||||
int opt_pair(const char *arg, const OPT_PAIR * pairs, int *result);
|
||||
int opt_cipher(const char *name, const EVP_CIPHER **cipherp);
|
||||
int opt_md(const char *name, const EVP_MD **mdp);
|
||||
char *opt_arg(void);
|
||||
char *opt_flag(void);
|
||||
char *opt_unknown(void);
|
||||
char *opt_reset(void);
|
||||
char **opt_rest(void);
|
||||
int opt_num_rest(void);
|
||||
int opt_verify(int i, X509_VERIFY_PARAM *vpm);
|
||||
void opt_help(const OPTIONS * list);
|
||||
int opt_format_error(const char *s, unsigned long flags);
|
||||
|
||||
typedef struct args_st {
|
||||
int size;
|
||||
int argc;
|
||||
char **argv;
|
||||
} ARGS;
|
||||
|
||||
/*
|
||||
* VMS C only for now, implemented in vms_decc_init.c
|
||||
* If other C compilers forget to terminate argv with NULL, this function
|
||||
* can be re-used.
|
||||
*/
|
||||
char **copy_argv(int *argc, char *argv[]);
|
||||
/*
|
||||
* Win32-specific argv initialization that splits OS-supplied UNICODE
|
||||
* command line string to array of UTF8-encoded strings.
|
||||
*/
|
||||
void win32_utf8argv(int *argc, char **argv[]);
|
||||
|
||||
|
||||
# define PW_MIN_LENGTH 4
|
||||
typedef struct pw_cb_data {
|
||||
const void *password;
|
||||
const char *prompt_info;
|
||||
} PW_CB_DATA;
|
||||
|
||||
int password_callback(char *buf, int bufsiz, int verify, PW_CB_DATA *cb_data);
|
||||
|
||||
int setup_ui_method(void);
|
||||
void destroy_ui_method(void);
|
||||
|
||||
int chopup_args(ARGS *arg, char *buf);
|
||||
# ifdef HEADER_X509_H
|
||||
int dump_cert_text(BIO *out, X509 *x);
|
||||
void print_name(BIO *out, const char *title, X509_NAME *nm,
|
||||
unsigned long lflags);
|
||||
# endif
|
||||
void print_bignum_var(BIO *, const BIGNUM *, const char*,
|
||||
int, unsigned char *);
|
||||
void print_array(BIO *, const char *, int, const unsigned char *);
|
||||
int set_cert_ex(unsigned long *flags, const char *arg);
|
||||
int set_name_ex(unsigned long *flags, const char *arg);
|
||||
int set_ext_copy(int *copy_type, const char *arg);
|
||||
int copy_extensions(X509 *x, X509_REQ *req, int copy_type);
|
||||
int app_passwd(const char *arg1, const char *arg2, char **pass1, char **pass2);
|
||||
int add_oid_section(CONF *conf);
|
||||
X509 *load_cert(const char *file, int format, const char *cert_descrip);
|
||||
X509_CRL *load_crl(const char *infile, int format);
|
||||
EVP_PKEY *load_key(const char *file, int format, int maybe_stdin,
|
||||
const char *pass, ENGINE *e, const char *key_descrip);
|
||||
EVP_PKEY *load_pubkey(const char *file, int format, int maybe_stdin,
|
||||
const char *pass, ENGINE *e, const char *key_descrip);
|
||||
int load_certs(const char *file, STACK_OF(X509) **certs, int format,
|
||||
const char *pass, const char *cert_descrip);
|
||||
int load_crls(const char *file, STACK_OF(X509_CRL) **crls, int format,
|
||||
const char *pass, const char *cert_descrip);
|
||||
X509_STORE *setup_verify(const char *CAfile, const char *CApath,
|
||||
int noCAfile, int noCApath);
|
||||
__owur int ctx_set_verify_locations(SSL_CTX *ctx, const char *CAfile,
|
||||
const char *CApath, int noCAfile,
|
||||
int noCApath);
|
||||
|
||||
#ifndef OPENSSL_NO_CT
|
||||
|
||||
/*
|
||||
* Sets the file to load the Certificate Transparency log list from.
|
||||
* If path is NULL, loads from the default file path.
|
||||
* Returns 1 on success, 0 otherwise.
|
||||
*/
|
||||
__owur int ctx_set_ctlog_list_file(SSL_CTX *ctx, const char *path);
|
||||
|
||||
#endif
|
||||
|
||||
ENGINE *setup_engine(const char *engine, int debug);
|
||||
void release_engine(ENGINE *e);
|
||||
|
||||
# ifndef OPENSSL_NO_OCSP
|
||||
OCSP_RESPONSE *process_responder(OCSP_REQUEST *req,
|
||||
const char *host, const char *path,
|
||||
const char *port, int use_ssl,
|
||||
STACK_OF(CONF_VALUE) *headers,
|
||||
int req_timeout);
|
||||
# endif
|
||||
|
||||
/* Functions defined in ca.c and also used in ocsp.c */
|
||||
int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold,
|
||||
ASN1_GENERALIZEDTIME **pinvtm, const char *str);
|
||||
|
||||
# define DB_type 0
|
||||
# define DB_exp_date 1
|
||||
# define DB_rev_date 2
|
||||
# define DB_serial 3 /* index - unique */
|
||||
# define DB_file 4
|
||||
# define DB_name 5 /* index - unique when active and not
|
||||
* disabled */
|
||||
# define DB_NUMBER 6
|
||||
|
||||
# define DB_TYPE_REV 'R'
|
||||
# define DB_TYPE_EXP 'E'
|
||||
# define DB_TYPE_VAL 'V'
|
||||
|
||||
typedef struct db_attr_st {
|
||||
int unique_subject;
|
||||
} DB_ATTR;
|
||||
typedef struct ca_db_st {
|
||||
DB_ATTR attributes;
|
||||
TXT_DB *db;
|
||||
} CA_DB;
|
||||
|
||||
void* app_malloc(int sz, const char *what);
|
||||
BIGNUM *load_serial(const char *serialfile, int create, ASN1_INTEGER **retai);
|
||||
int save_serial(const char *serialfile, const char *suffix, const BIGNUM *serial,
|
||||
ASN1_INTEGER **retai);
|
||||
int rotate_serial(const char *serialfile, const char *new_suffix,
|
||||
const char *old_suffix);
|
||||
int rand_serial(BIGNUM *b, ASN1_INTEGER *ai);
|
||||
CA_DB *load_index(const char *dbfile, DB_ATTR *dbattr);
|
||||
int index_index(CA_DB *db);
|
||||
int save_index(const char *dbfile, const char *suffix, CA_DB *db);
|
||||
int rotate_index(const char *dbfile, const char *new_suffix,
|
||||
const char *old_suffix);
|
||||
void free_index(CA_DB *db);
|
||||
# define index_name_cmp_noconst(a, b) \
|
||||
index_name_cmp((const OPENSSL_CSTRING *)CHECKED_PTR_OF(OPENSSL_STRING, a), \
|
||||
(const OPENSSL_CSTRING *)CHECKED_PTR_OF(OPENSSL_STRING, b))
|
||||
int index_name_cmp(const OPENSSL_CSTRING *a, const OPENSSL_CSTRING *b);
|
||||
int parse_yesno(const char *str, int def);
|
||||
|
||||
X509_NAME *parse_name(const char *str, long chtype, int multirdn);
|
||||
int args_verify(char ***pargs, int *pargc,
|
||||
int *badarg, X509_VERIFY_PARAM **pm);
|
||||
void policies_print(X509_STORE_CTX *ctx);
|
||||
int bio_to_mem(unsigned char **out, int maxlen, BIO *in);
|
||||
int pkey_ctrl_string(EVP_PKEY_CTX *ctx, const char *value);
|
||||
int init_gen_str(EVP_PKEY_CTX **pctx,
|
||||
const char *algname, ENGINE *e, int do_param);
|
||||
int do_X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md,
|
||||
STACK_OF(OPENSSL_STRING) *sigopts);
|
||||
int do_X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md,
|
||||
STACK_OF(OPENSSL_STRING) *sigopts);
|
||||
int do_X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md,
|
||||
STACK_OF(OPENSSL_STRING) *sigopts);
|
||||
# ifndef OPENSSL_NO_PSK
|
||||
extern char *psk_key;
|
||||
# endif
|
||||
|
||||
unsigned char *next_protos_parse(size_t *outlen, const char *in);
|
||||
|
||||
void print_cert_checks(BIO *bio, X509 *x,
|
||||
const char *checkhost,
|
||||
const char *checkemail, const char *checkip);
|
||||
|
||||
void store_setup_crl_download(X509_STORE *st);
|
||||
|
||||
/* See OPT_FMT_xxx, above. */
|
||||
/* On some platforms, it's important to distinguish between text and binary
|
||||
* files. On some, there might even be specific file formats for different
|
||||
* contents. The FORMAT_xxx macros are meant to express an intent with the
|
||||
* file being read or created.
|
||||
*/
|
||||
# define B_FORMAT_TEXT 0x8000
|
||||
# define FORMAT_UNDEF 0
|
||||
# define FORMAT_TEXT (1 | B_FORMAT_TEXT) /* Generic text */
|
||||
# define FORMAT_BINARY 2 /* Generic binary */
|
||||
# define FORMAT_BASE64 (3 | B_FORMAT_TEXT) /* Base64 */
|
||||
# define FORMAT_ASN1 4 /* ASN.1/DER */
|
||||
# define FORMAT_PEM (5 | B_FORMAT_TEXT)
|
||||
# define FORMAT_PKCS12 6
|
||||
# define FORMAT_SMIME (7 | B_FORMAT_TEXT)
|
||||
# define FORMAT_ENGINE 8 /* Not really a file format */
|
||||
# define FORMAT_PEMRSA (9 | B_FORMAT_TEXT) /* PEM RSAPubicKey format */
|
||||
# define FORMAT_ASN1RSA 10 /* DER RSAPubicKey format */
|
||||
# define FORMAT_MSBLOB 11 /* MS Key blob format */
|
||||
# define FORMAT_PVK 12 /* MS PVK file format */
|
||||
# define FORMAT_HTTP 13 /* Download using HTTP */
|
||||
# define FORMAT_NSS 14 /* NSS keylog format */
|
||||
|
||||
# define EXT_COPY_NONE 0
|
||||
# define EXT_COPY_ADD 1
|
||||
# define EXT_COPY_ALL 2
|
||||
|
||||
# define NETSCAPE_CERT_HDR "certificate"
|
||||
|
||||
# define APP_PASS_LEN 1024
|
||||
|
||||
# define SERIAL_RAND_BITS 64
|
||||
|
||||
int app_isdir(const char *);
|
||||
int app_access(const char *, int flag);
|
||||
int fileno_stdin(void);
|
||||
int fileno_stdout(void);
|
||||
int raw_read_stdin(void *, int);
|
||||
int raw_write_stdout(const void *, int);
|
||||
|
||||
# define TM_START 0
|
||||
# define TM_STOP 1
|
||||
double app_tminterval(int stop, int usertime);
|
||||
|
||||
typedef struct verify_options_st {
|
||||
int depth;
|
||||
int quiet;
|
||||
int error;
|
||||
int return_error;
|
||||
} VERIFY_CB_ARGS;
|
||||
|
||||
extern VERIFY_CB_ARGS verify_args;
|
||||
|
||||
# include "progs.h"
|
||||
|
||||
#endif
|
||||
330
apps/asn1pars.c
330
apps/asn1pars.c
@@ -1,330 +0,0 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
/*
|
||||
* A nice addition from Dr Stephen Henson <steve@openssl.org> to add the
|
||||
* -strparse option which parses nested binary structures
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include "apps.h"
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/evp.h>
|
||||
#include <openssl/x509.h>
|
||||
#include <openssl/pem.h>
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_INFORM, OPT_IN, OPT_OUT, OPT_INDENT, OPT_NOOUT,
|
||||
OPT_OID, OPT_OFFSET, OPT_LENGTH, OPT_DUMP, OPT_DLIMIT,
|
||||
OPT_STRPARSE, OPT_GENSTR, OPT_GENCONF, OPT_STRICTPEM
|
||||
} OPTION_CHOICE;
|
||||
|
||||
OPTIONS asn1parse_options[] = {
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"inform", OPT_INFORM, 'F', "input format - one of DER PEM"},
|
||||
{"in", OPT_IN, '<', "input file"},
|
||||
{"out", OPT_OUT, '>', "output file (output format is always DER)"},
|
||||
{"i", OPT_INDENT, 0, "indents the output"},
|
||||
{"noout", OPT_NOOUT, 0, "do not produce any output"},
|
||||
{"offset", OPT_OFFSET, 'p', "offset into file"},
|
||||
{"length", OPT_LENGTH, 'p', "length of section in file"},
|
||||
{"oid", OPT_OID, '<', "file of extra oid definitions"},
|
||||
{"dump", OPT_DUMP, 0, "unknown data in hex form"},
|
||||
{"dlimit", OPT_DLIMIT, 'p',
|
||||
"dump the first arg bytes of unknown data in hex form"},
|
||||
{"strparse", OPT_STRPARSE, 'p',
|
||||
"offset; a series of these can be used to 'dig'"},
|
||||
{OPT_MORE_STR, 0, 0, "into multiple ASN1 blob wrappings"},
|
||||
{"genstr", OPT_GENSTR, 's', "string to generate ASN1 structure from"},
|
||||
{"genconf", OPT_GENCONF, 's', "file to generate ASN1 structure from"},
|
||||
{OPT_MORE_STR, 0, 0, "(-inform will be ignored)"},
|
||||
{"strictpem", OPT_STRICTPEM, 0,
|
||||
"do not attempt base64 decode outside PEM markers"},
|
||||
{NULL}
|
||||
};
|
||||
|
||||
static int do_generate(char *genstr, const char *genconf, BUF_MEM *buf);
|
||||
|
||||
int asn1parse_main(int argc, char **argv)
|
||||
{
|
||||
ASN1_TYPE *at = NULL;
|
||||
BIO *in = NULL, *b64 = NULL, *derout = NULL;
|
||||
BUF_MEM *buf = NULL;
|
||||
STACK_OF(OPENSSL_STRING) *osk = NULL;
|
||||
char *genstr = NULL, *genconf = NULL;
|
||||
char *infile = NULL, *oidfile = NULL, *derfile = NULL;
|
||||
unsigned char *str = NULL;
|
||||
char *name = NULL, *header = NULL, *prog;
|
||||
const unsigned char *ctmpbuf;
|
||||
int indent = 0, noout = 0, dump = 0, strictpem = 0, informat = FORMAT_PEM;
|
||||
int offset = 0, ret = 1, i, j;
|
||||
long num, tmplen;
|
||||
unsigned char *tmpbuf;
|
||||
unsigned int length = 0;
|
||||
OPTION_CHOICE o;
|
||||
|
||||
prog = opt_init(argc, argv, asn1parse_options);
|
||||
|
||||
if ((osk = sk_OPENSSL_STRING_new_null()) == NULL) {
|
||||
BIO_printf(bio_err, "%s: Memory allocation failure\n", prog);
|
||||
goto end;
|
||||
}
|
||||
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
switch (o) {
|
||||
case OPT_EOF:
|
||||
case OPT_ERR:
|
||||
opthelp:
|
||||
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
||||
goto end;
|
||||
case OPT_HELP:
|
||||
opt_help(asn1parse_options);
|
||||
ret = 0;
|
||||
goto end;
|
||||
case OPT_INFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &informat))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_IN:
|
||||
infile = opt_arg();
|
||||
break;
|
||||
case OPT_OUT:
|
||||
derfile = opt_arg();
|
||||
break;
|
||||
case OPT_INDENT:
|
||||
indent = 1;
|
||||
break;
|
||||
case OPT_NOOUT:
|
||||
noout = 1;
|
||||
break;
|
||||
case OPT_OID:
|
||||
oidfile = opt_arg();
|
||||
break;
|
||||
case OPT_OFFSET:
|
||||
offset = strtol(opt_arg(), NULL, 0);
|
||||
break;
|
||||
case OPT_LENGTH:
|
||||
length = strtol(opt_arg(), NULL, 0);
|
||||
break;
|
||||
case OPT_DUMP:
|
||||
dump = -1;
|
||||
break;
|
||||
case OPT_DLIMIT:
|
||||
dump = strtol(opt_arg(), NULL, 0);
|
||||
break;
|
||||
case OPT_STRPARSE:
|
||||
sk_OPENSSL_STRING_push(osk, opt_arg());
|
||||
break;
|
||||
case OPT_GENSTR:
|
||||
genstr = opt_arg();
|
||||
break;
|
||||
case OPT_GENCONF:
|
||||
genconf = opt_arg();
|
||||
break;
|
||||
case OPT_STRICTPEM:
|
||||
strictpem = 1;
|
||||
informat = FORMAT_PEM;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
if (argc != 0)
|
||||
goto opthelp;
|
||||
|
||||
if (oidfile != NULL) {
|
||||
in = bio_open_default(oidfile, 'r', FORMAT_TEXT);
|
||||
if (in == NULL)
|
||||
goto end;
|
||||
OBJ_create_objects(in);
|
||||
BIO_free(in);
|
||||
}
|
||||
|
||||
if ((in = bio_open_default(infile, 'r', informat)) == NULL)
|
||||
goto end;
|
||||
|
||||
if (derfile && (derout = bio_open_default(derfile, 'w', FORMAT_ASN1)) == NULL)
|
||||
goto end;
|
||||
|
||||
if (strictpem) {
|
||||
if (PEM_read_bio(in, &name, &header, &str, &num) !=
|
||||
1) {
|
||||
BIO_printf(bio_err, "Error reading PEM file\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
} else {
|
||||
|
||||
if ((buf = BUF_MEM_new()) == NULL)
|
||||
goto end;
|
||||
if (!BUF_MEM_grow(buf, BUFSIZ * 8))
|
||||
goto end; /* Pre-allocate :-) */
|
||||
|
||||
if (genstr || genconf) {
|
||||
num = do_generate(genstr, genconf, buf);
|
||||
if (num < 0) {
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
else {
|
||||
|
||||
if (informat == FORMAT_PEM) {
|
||||
BIO *tmp;
|
||||
|
||||
if ((b64 = BIO_new(BIO_f_base64())) == NULL)
|
||||
goto end;
|
||||
BIO_push(b64, in);
|
||||
tmp = in;
|
||||
in = b64;
|
||||
b64 = tmp;
|
||||
}
|
||||
|
||||
num = 0;
|
||||
for (;;) {
|
||||
if (!BUF_MEM_grow(buf, num + BUFSIZ))
|
||||
goto end;
|
||||
i = BIO_read(in, &(buf->data[num]), BUFSIZ);
|
||||
if (i <= 0)
|
||||
break;
|
||||
num += i;
|
||||
}
|
||||
}
|
||||
str = (unsigned char *)buf->data;
|
||||
|
||||
}
|
||||
|
||||
/* If any structs to parse go through in sequence */
|
||||
|
||||
if (sk_OPENSSL_STRING_num(osk)) {
|
||||
tmpbuf = str;
|
||||
tmplen = num;
|
||||
for (i = 0; i < sk_OPENSSL_STRING_num(osk); i++) {
|
||||
ASN1_TYPE *atmp;
|
||||
int typ;
|
||||
j = strtol(sk_OPENSSL_STRING_value(osk, i), NULL, 0);
|
||||
if (j <= 0 || j >= tmplen) {
|
||||
BIO_printf(bio_err, "'%s' is out of range\n",
|
||||
sk_OPENSSL_STRING_value(osk, i));
|
||||
continue;
|
||||
}
|
||||
tmpbuf += j;
|
||||
tmplen -= j;
|
||||
atmp = at;
|
||||
ctmpbuf = tmpbuf;
|
||||
at = d2i_ASN1_TYPE(NULL, &ctmpbuf, tmplen);
|
||||
ASN1_TYPE_free(atmp);
|
||||
if (!at) {
|
||||
BIO_printf(bio_err, "Error parsing structure\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
typ = ASN1_TYPE_get(at);
|
||||
if ((typ == V_ASN1_OBJECT)
|
||||
|| (typ == V_ASN1_BOOLEAN)
|
||||
|| (typ == V_ASN1_NULL)) {
|
||||
BIO_printf(bio_err, "Can't parse %s type\n", ASN1_tag2str(typ));
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
/* hmm... this is a little evil but it works */
|
||||
tmpbuf = at->value.asn1_string->data;
|
||||
tmplen = at->value.asn1_string->length;
|
||||
}
|
||||
str = tmpbuf;
|
||||
num = tmplen;
|
||||
}
|
||||
|
||||
if (offset < 0 || offset >= num) {
|
||||
BIO_printf(bio_err, "Error: offset out of range\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
num -= offset;
|
||||
|
||||
if (length == 0 || length > (unsigned int)num)
|
||||
length = (unsigned int)num;
|
||||
if (derout) {
|
||||
if (BIO_write(derout, str + offset, length) != (int)length) {
|
||||
BIO_printf(bio_err, "Error writing output\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
if (!noout &&
|
||||
!ASN1_parse_dump(bio_out, &(str[offset]), length,
|
||||
indent, dump)) {
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
ret = 0;
|
||||
end:
|
||||
BIO_free(derout);
|
||||
BIO_free(in);
|
||||
BIO_free(b64);
|
||||
if (ret != 0)
|
||||
ERR_print_errors(bio_err);
|
||||
BUF_MEM_free(buf);
|
||||
OPENSSL_free(name);
|
||||
OPENSSL_free(header);
|
||||
if (strictpem)
|
||||
OPENSSL_free(str);
|
||||
ASN1_TYPE_free(at);
|
||||
sk_OPENSSL_STRING_free(osk);
|
||||
return (ret);
|
||||
}
|
||||
|
||||
static int do_generate(char *genstr, const char *genconf, BUF_MEM *buf)
|
||||
{
|
||||
CONF *cnf = NULL;
|
||||
int len;
|
||||
unsigned char *p;
|
||||
ASN1_TYPE *atyp = NULL;
|
||||
|
||||
if (genconf) {
|
||||
if ((cnf = app_load_config(genconf)) == NULL)
|
||||
goto err;
|
||||
if (!genstr)
|
||||
genstr = NCONF_get_string(cnf, "default", "asn1");
|
||||
if (!genstr) {
|
||||
BIO_printf(bio_err, "Can't find 'asn1' in '%s'\n", genconf);
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
|
||||
atyp = ASN1_generate_nconf(genstr, cnf);
|
||||
NCONF_free(cnf);
|
||||
cnf = NULL;
|
||||
|
||||
if (!atyp)
|
||||
return -1;
|
||||
|
||||
len = i2d_ASN1_TYPE(atyp, NULL);
|
||||
|
||||
if (len <= 0)
|
||||
goto err;
|
||||
|
||||
if (!BUF_MEM_grow(buf, len))
|
||||
goto err;
|
||||
|
||||
p = (unsigned char *)buf->data;
|
||||
|
||||
i2d_ASN1_TYPE(atyp, &p);
|
||||
|
||||
ASN1_TYPE_free(atyp);
|
||||
return len;
|
||||
|
||||
err:
|
||||
NCONF_free(cnf);
|
||||
ASN1_TYPE_free(atyp);
|
||||
return -1;
|
||||
}
|
||||
@@ -1,28 +0,0 @@
|
||||
{- our $tsget_name = $config{target} =~ /^(VC|vms)-/ ? "tsget.pl" : "tsget";
|
||||
our @apps_openssl_src =
|
||||
( qw(openssl.c
|
||||
asn1pars.c ca.c ciphers.c cms.c crl.c crl2p7.c dgst.c dhparam.c
|
||||
dsa.c dsaparam.c ec.c ecparam.c enc.c engine.c errstr.c gendsa.c
|
||||
genpkey.c genrsa.c nseq.c ocsp.c passwd.c pkcs12.c pkcs7.c pkcs8.c
|
||||
pkey.c pkeyparam.c pkeyutl.c prime.c rand.c req.c rsa.c rsautl.c
|
||||
s_client.c s_server.c s_time.c sess_id.c smime.c speed.c spkac.c
|
||||
srp.c ts.c verify.c version.c x509.c rehash.c
|
||||
apps.c opt.c s_cb.c s_socket.c
|
||||
app_rand.c),
|
||||
split(/\s+/, $target{apps_aux_src}) );
|
||||
"" -}
|
||||
IF[{- !$disabled{apps} -}]
|
||||
PROGRAMS=openssl
|
||||
SOURCE[openssl]={- join(" ", @apps_openssl_src) -}
|
||||
INCLUDE[openssl]=.. ../include
|
||||
DEPEND[openssl]=../libssl
|
||||
|
||||
{- join("\n ", map { (my $x = $_) =~ s|\.c$|.o|; "DEPEND[$x]=progs.h" }
|
||||
@apps_openssl_src) -}
|
||||
GENERATE[progs.h]=progs.pl $(APPS_OPENSSL)
|
||||
DEPEND[progs.h]=../configdata.pm
|
||||
|
||||
SCRIPTS=CA.pl {- $tsget_name -}
|
||||
SOURCE[CA.pl]=CA.pl.in
|
||||
SOURCE[{- $tsget_name -}]=tsget.in
|
||||
ENDIF
|
||||
@@ -1 +0,0 @@
|
||||
07
|
||||
@@ -1,16 +0,0 @@
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAL4tQNyKy4U2zX6l
|
||||
IZvORB1edmwMwIgSB4cgoFECrG5pixzYxKauZkAwKG9/+L4DB8qXRjfXWcvafcOU
|
||||
DlYpRROykJ7wGkiqmqbZyrxY8DWjk5ZZQXiSuhYOAJB+Fyfb11JZV6+CvBQX/1g+
|
||||
vhJr39Gmp6oAesoYrj90ecozClmnAgMBAAECgYA3j6sSg+5f9hnldUMzbPjTh8Sb
|
||||
XsJlPrc6UFrmMBzGiUleXSpe9Dbla+x0XvQCN4pwMvAN4nnWp/f0Su5BV/9Y93nb
|
||||
im5ijGNrfN9i6QrnqGCr+MMute+4E8HR2pCScX0mBLDDf40SmDvMzCaxtd21keyr
|
||||
9DqHgInQZNEi6NKlkQJBAPCbUTFg6iQ6VTCQ8CsEf5q2xHhuTK23fJ999lvWVxN7
|
||||
QsvWb9RP9Ng34HVtvB7Pl6P7FyHLQYiDJhhvYR0L0+kCQQDKV/09Kt6Wjf5Omp1I
|
||||
wd3A+tFnipdqnPw+qNHGjevv0hYiEIWQOYbx00zXgaX+WN/pzV9eeNN2XAxlNJ++
|
||||
dxcPAkBrzeuPKFFAcjKBVC+H1rgl5gYZv7Hzk+buv02G0H6rZ+sB0c7BXiHiTwbv
|
||||
Fn/XfkP/YR14Ms3mEH0dLaphjU8hAkEAh3Ar/rRiN04mCcEuRFQXtaNtZSv8PA2G
|
||||
Pf7MI2Y9pdHupLCAZlBLRjTUO2/5hu1AO4QPMPIZQSFN3rRBtMCL+wJAMp/m2hvI
|
||||
TmtbMp/IrKGfma09e3yFiCmoNn7cHLJ7jLvXcacV2XNzpr9YHfBxiZo0g9FqZKvv
|
||||
PZoQ5B2XJ7bhTQ==
|
||||
-----END PRIVATE KEY-----
|
||||
@@ -1,11 +0,0 @@
|
||||
-----BEGIN CERTIFICATE REQUEST-----
|
||||
MIIBmzCCAQQCAQAwWzELMAkGA1UEBhMCQVUxEzARBgNVBAgMClF1ZWVuc2xhbmQx
|
||||
GjAYBgNVBAoMEUNyeXB0U29mdCBQdHkgTHRkMRswGQYDVQQDDBJUZXN0IENBICgx
|
||||
MDI0IGJpdCkwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL4tQNyKy4U2zX6l
|
||||
IZvORB1edmwMwIgSB4cgoFECrG5pixzYxKauZkAwKG9/+L4DB8qXRjfXWcvafcOU
|
||||
DlYpRROykJ7wGkiqmqbZyrxY8DWjk5ZZQXiSuhYOAJB+Fyfb11JZV6+CvBQX/1g+
|
||||
vhJr39Gmp6oAesoYrj90ecozClmnAgMBAAGgADANBgkqhkiG9w0BAQsFAAOBgQCo
|
||||
2jE7J1SNV7kyRm9m8CoPw8xYsuVcVFxPheBymYp8BlO0/rSdYygRjobpYnLVRUPZ
|
||||
pV792wzT1Rp4sXfZWO10lkFY4yi0pH2cdK2RX7qedibV1Xu9vt/yYANFBKVpA4dy
|
||||
PRyTQwi3In1N8hdfddpYR8f5MIUYRe5poFMIJcf8JA==
|
||||
-----END CERTIFICATE REQUEST-----
|
||||
@@ -1,11 +0,0 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIBoDCCAUoCAQAwDQYJKoZIhvcNAQEEBQAwYzELMAkGA1UEBhMCQVUxEzARBgNV
|
||||
BAgTClF1ZWVuc2xhbmQxGjAYBgNVBAoTEUNyeXB0U29mdCBQdHkgTHRkMSMwIQYD
|
||||
VQQDExpTZXJ2ZXIgdGVzdCBjZXJ0ICg1MTIgYml0KTAeFw05NzA5MDkwMzQxMjZa
|
||||
Fw05NzEwMDkwMzQxMjZaMF4xCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0
|
||||
YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxFzAVBgNVBAMT
|
||||
DkVyaWMgdGhlIFlvdW5nMFEwCQYFKw4DAgwFAANEAAJBALVEqPODnpI4rShlY8S7
|
||||
tB713JNvabvn6Gned7zylwLLiXQAo/PAT6mfdWPTyCX9RlId/Aroh1ou893BA32Q
|
||||
sggwDQYJKoZIhvcNAQEEBQADQQCU5SSgapJSdRXJoX+CpCvFy+JVh9HpSjCpSNKO
|
||||
19raHv98hKAUJuP9HyM+SUsffO6mAIgitUaqW8/wDMePhEC3
|
||||
-----END CERTIFICATE-----
|
||||
242
apps/ciphers.c
242
apps/ciphers.c
@@ -1,242 +0,0 @@
|
||||
/*
|
||||
* Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include "apps.h"
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/ssl.h>
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_STDNAME,
|
||||
OPT_SSL3,
|
||||
OPT_TLS1,
|
||||
OPT_TLS1_1,
|
||||
OPT_TLS1_2,
|
||||
OPT_PSK,
|
||||
OPT_SRP,
|
||||
OPT_V, OPT_UPPER_V, OPT_S
|
||||
} OPTION_CHOICE;
|
||||
|
||||
OPTIONS ciphers_options[] = {
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"v", OPT_V, '-', "Verbose listing of the SSL/TLS ciphers"},
|
||||
{"V", OPT_UPPER_V, '-', "Even more verbose"},
|
||||
{"s", OPT_S, '-', "Only supported ciphers"},
|
||||
#ifndef OPENSSL_NO_SSL3
|
||||
{"ssl3", OPT_SSL3, '-', "SSL3 mode"},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_TLS1
|
||||
{"tls1", OPT_TLS1, '-', "TLS1 mode"},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_TLS1_1
|
||||
{"tls1_1", OPT_TLS1_1, '-', "TLS1.1 mode"},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_TLS1_2
|
||||
{"tls1_2", OPT_TLS1_2, '-', "TLS1.2 mode"},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_SSL_TRACE
|
||||
{"stdname", OPT_STDNAME, '-', "Show standard cipher names"},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_PSK
|
||||
{"psk", OPT_PSK, '-', "include ciphersuites requiring PSK"},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_SRP
|
||||
{"srp", OPT_SRP, '-', "include ciphersuites requiring SRP"},
|
||||
#endif
|
||||
{NULL}
|
||||
};
|
||||
|
||||
#ifndef OPENSSL_NO_PSK
|
||||
static unsigned int dummy_psk(SSL *ssl, const char *hint, char *identity,
|
||||
unsigned int max_identity_len,
|
||||
unsigned char *psk,
|
||||
unsigned int max_psk_len)
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_SRP
|
||||
static char *dummy_srp(SSL *ssl, void *arg)
|
||||
{
|
||||
return "";
|
||||
}
|
||||
#endif
|
||||
|
||||
int ciphers_main(int argc, char **argv)
|
||||
{
|
||||
SSL_CTX *ctx = NULL;
|
||||
SSL *ssl = NULL;
|
||||
STACK_OF(SSL_CIPHER) *sk = NULL;
|
||||
const SSL_METHOD *meth = TLS_server_method();
|
||||
int ret = 1, i, verbose = 0, Verbose = 0, use_supported = 0;
|
||||
#ifndef OPENSSL_NO_SSL_TRACE
|
||||
int stdname = 0;
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_PSK
|
||||
int psk = 0;
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_SRP
|
||||
int srp = 0;
|
||||
#endif
|
||||
const char *p;
|
||||
char *ciphers = NULL, *prog;
|
||||
char buf[512];
|
||||
OPTION_CHOICE o;
|
||||
int min_version = 0, max_version = 0;
|
||||
|
||||
prog = opt_init(argc, argv, ciphers_options);
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
switch (o) {
|
||||
case OPT_EOF:
|
||||
case OPT_ERR:
|
||||
opthelp:
|
||||
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
||||
goto end;
|
||||
case OPT_HELP:
|
||||
opt_help(ciphers_options);
|
||||
ret = 0;
|
||||
goto end;
|
||||
case OPT_V:
|
||||
verbose = 1;
|
||||
break;
|
||||
case OPT_UPPER_V:
|
||||
verbose = Verbose = 1;
|
||||
break;
|
||||
case OPT_S:
|
||||
use_supported = 1;
|
||||
break;
|
||||
case OPT_STDNAME:
|
||||
#ifndef OPENSSL_NO_SSL_TRACE
|
||||
stdname = verbose = 1;
|
||||
#endif
|
||||
break;
|
||||
case OPT_SSL3:
|
||||
min_version = SSL3_VERSION;
|
||||
max_version = SSL3_VERSION;
|
||||
break;
|
||||
case OPT_TLS1:
|
||||
min_version = TLS1_VERSION;
|
||||
max_version = TLS1_VERSION;
|
||||
break;
|
||||
case OPT_TLS1_1:
|
||||
min_version = TLS1_1_VERSION;
|
||||
max_version = TLS1_1_VERSION;
|
||||
break;
|
||||
case OPT_TLS1_2:
|
||||
min_version = TLS1_2_VERSION;
|
||||
max_version = TLS1_2_VERSION;
|
||||
break;
|
||||
case OPT_PSK:
|
||||
#ifndef OPENSSL_NO_PSK
|
||||
psk = 1;
|
||||
#endif
|
||||
break;
|
||||
case OPT_SRP:
|
||||
#ifndef OPENSSL_NO_SRP
|
||||
srp = 1;
|
||||
#endif
|
||||
break;
|
||||
}
|
||||
}
|
||||
argv = opt_rest();
|
||||
argc = opt_num_rest();
|
||||
|
||||
if (argc == 1)
|
||||
ciphers = *argv;
|
||||
else if (argc != 0)
|
||||
goto opthelp;
|
||||
|
||||
ctx = SSL_CTX_new(meth);
|
||||
if (ctx == NULL)
|
||||
goto err;
|
||||
if (SSL_CTX_set_min_proto_version(ctx, min_version) == 0)
|
||||
goto err;
|
||||
if (SSL_CTX_set_max_proto_version(ctx, max_version) == 0)
|
||||
goto err;
|
||||
|
||||
#ifndef OPENSSL_NO_PSK
|
||||
if (psk)
|
||||
SSL_CTX_set_psk_client_callback(ctx, dummy_psk);
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_SRP
|
||||
if (srp)
|
||||
SSL_CTX_set_srp_client_pwd_callback(ctx, dummy_srp);
|
||||
#endif
|
||||
if (ciphers != NULL) {
|
||||
if (!SSL_CTX_set_cipher_list(ctx, ciphers)) {
|
||||
BIO_printf(bio_err, "Error in cipher list\n");
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
ssl = SSL_new(ctx);
|
||||
if (ssl == NULL)
|
||||
goto err;
|
||||
|
||||
if (use_supported)
|
||||
sk = SSL_get1_supported_ciphers(ssl);
|
||||
else
|
||||
sk = SSL_get_ciphers(ssl);
|
||||
|
||||
if (!verbose) {
|
||||
for (i = 0; i < sk_SSL_CIPHER_num(sk); i++) {
|
||||
const SSL_CIPHER *c = sk_SSL_CIPHER_value(sk, i);
|
||||
p = SSL_CIPHER_get_name(c);
|
||||
if (p == NULL)
|
||||
break;
|
||||
if (i != 0)
|
||||
BIO_printf(bio_out, ":");
|
||||
BIO_printf(bio_out, "%s", p);
|
||||
}
|
||||
BIO_printf(bio_out, "\n");
|
||||
} else {
|
||||
|
||||
for (i = 0; i < sk_SSL_CIPHER_num(sk); i++) {
|
||||
const SSL_CIPHER *c;
|
||||
|
||||
c = sk_SSL_CIPHER_value(sk, i);
|
||||
|
||||
if (Verbose) {
|
||||
unsigned long id = SSL_CIPHER_get_id(c);
|
||||
int id0 = (int)(id >> 24);
|
||||
int id1 = (int)((id >> 16) & 0xffL);
|
||||
int id2 = (int)((id >> 8) & 0xffL);
|
||||
int id3 = (int)(id & 0xffL);
|
||||
|
||||
if ((id & 0xff000000L) == 0x03000000L)
|
||||
BIO_printf(bio_out, " 0x%02X,0x%02X - ", id2, id3); /* SSL3
|
||||
* cipher */
|
||||
else
|
||||
BIO_printf(bio_out, "0x%02X,0x%02X,0x%02X,0x%02X - ", id0, id1, id2, id3); /* whatever */
|
||||
}
|
||||
#ifndef OPENSSL_NO_SSL_TRACE
|
||||
if (stdname) {
|
||||
const char *nm = SSL_CIPHER_standard_name(c);
|
||||
if (nm == NULL)
|
||||
nm = "UNKNOWN";
|
||||
BIO_printf(bio_out, "%s - ", nm);
|
||||
}
|
||||
#endif
|
||||
BIO_puts(bio_out, SSL_CIPHER_description(c, buf, sizeof(buf)));
|
||||
}
|
||||
}
|
||||
|
||||
ret = 0;
|
||||
goto end;
|
||||
err:
|
||||
ERR_print_errors(bio_err);
|
||||
end:
|
||||
if (use_supported)
|
||||
sk_SSL_CIPHER_free(sk);
|
||||
SSL_CTX_free(ctx);
|
||||
SSL_free(ssl);
|
||||
return (ret);
|
||||
}
|
||||
@@ -1,52 +0,0 @@
|
||||
subject= C = UK, O = OpenSSL Group, OU = FOR TESTING PURPOSES ONLY, CN = Test Client Cert
|
||||
issuer= C = UK, O = OpenSSL Group, OU = FOR TESTING PURPOSES ONLY, CN = OpenSSL Test Intermediate CA
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIID5zCCAs+gAwIBAgIJALnu1NlVpZ6yMA0GCSqGSIb3DQEBBQUAMHAxCzAJBgNV
|
||||
BAYTAlVLMRYwFAYDVQQKDA1PcGVuU1NMIEdyb3VwMSIwIAYDVQQLDBlGT1IgVEVT
|
||||
VElORyBQVVJQT1NFUyBPTkxZMSUwIwYDVQQDDBxPcGVuU1NMIFRlc3QgSW50ZXJt
|
||||
ZWRpYXRlIENBMB4XDTExMTIwODE0MDE0OFoXDTIxMTAxNjE0MDE0OFowZDELMAkG
|
||||
A1UEBhMCVUsxFjAUBgNVBAoMDU9wZW5TU0wgR3JvdXAxIjAgBgNVBAsMGUZPUiBU
|
||||
RVNUSU5HIFBVUlBPU0VTIE9OTFkxGTAXBgNVBAMMEFRlc3QgQ2xpZW50IENlcnQw
|
||||
ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC0ranbHRLcLVqN+0BzcZpY
|
||||
+yOLqxzDWT1LD9eW1stC4NzXX9/DCtSIVyN7YIHdGLrIPr64IDdXXaMRzgZ2rOKs
|
||||
lmHCAiFpO/ja99gGCJRxH0xwQatqAULfJVHeUhs7OEGOZc2nWifjqKvGfNTilP7D
|
||||
nwi69ipQFq9oS19FmhwVHk2wg7KZGHI1qDyG04UrfCZMRitvS9+UVhPpIPjuiBi2
|
||||
x3/FZIpL5gXJvvFK6xHY63oq2asyzBATntBgnP4qJFWWcvRx24wF1PnZabxuVoL2
|
||||
bPnQ/KvONDrw3IdqkKhYNTul7jEcu3OlcZIMw+7DiaKJLAzKb/bBF5gm/pwW6As9
|
||||
AgMBAAGjgY8wgYwwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBeAwLAYJYIZI
|
||||
AYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQW
|
||||
BBSZHKyLoTh7Mb409Zn/mK1ceSDAjDAfBgNVHSMEGDAWgBQ2w2yI55X+sL3szj49
|
||||
hqshgYfa2jANBgkqhkiG9w0BAQUFAAOCAQEAD0mL7PtPYgCEuDyOQSbLpeND5hVS
|
||||
curxQdGnrJ6Acrhodb7E9ccATokeb0PLx6HBLQUicxhTZIQ9FbO43YkQcOU6C3BB
|
||||
IlwskqmtN6+VmrQzNolHCDzvxNZs9lYL2VbGPGqVRyjZeHpoAlf9cQr8PgDb4d4b
|
||||
vUx2KAhHQvV2nkmYvKyXcgnRuHggumF87mkxidriGAEFwH4qfOqetUg64WyxP7P2
|
||||
QLipm04SyQa7ONtIApfVXgHcE42Py4/f4arzCzMjKe3VyhGkS7nsT55X/fWgTaRm
|
||||
CQPkO+H94P958WTvQDt77bQ+D3IvYaVvfil8n6HJMOJfFT0LJuSUbpSXJg==
|
||||
-----END CERTIFICATE-----
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEpQIBAAKCAQEAtK2p2x0S3C1ajftAc3GaWPsji6scw1k9Sw/XltbLQuDc11/f
|
||||
wwrUiFcje2CB3Ri6yD6+uCA3V12jEc4GdqzirJZhwgIhaTv42vfYBgiUcR9McEGr
|
||||
agFC3yVR3lIbOzhBjmXNp1on46irxnzU4pT+w58IuvYqUBavaEtfRZocFR5NsIOy
|
||||
mRhyNag8htOFK3wmTEYrb0vflFYT6SD47ogYtsd/xWSKS+YFyb7xSusR2Ot6Ktmr
|
||||
MswQE57QYJz+KiRVlnL0cduMBdT52Wm8blaC9mz50PyrzjQ68NyHapCoWDU7pe4x
|
||||
HLtzpXGSDMPuw4miiSwMym/2wReYJv6cFugLPQIDAQABAoIBAAZOyc9MhIwLSU4L
|
||||
p4RgQvM4UVVe8/Id+3XTZ8NsXExJbWxXfIhiqGjaIfL8u4vsgRjcl+v1s/jo2/iT
|
||||
KMab4o4D8gXD7UavQVDjtjb/ta79WL3SjRl2Uc9YjjMkyq6WmDNQeo2NKDdafCTB
|
||||
1uzSJtLNipB8Z53ELPuHJhxX9QMHrMnuha49riQgXZ7buP9iQrHJFhImBjSzbxJx
|
||||
L+TI6rkyLSf9Wi0Pd3L27Ob3QWNfNRYNSeTE+08eSRChkur5W0RuXAcuAICdQlCl
|
||||
LBvWO/LmmvbzCqiDcgy/TliSb6CGGwgiNG7LJZmlkYNj8laGwalNlYZs3UrVv6NO
|
||||
Br2loAECgYEA2kvCvPGj0Dg/6g7WhXDvAkEbcaL1tSeCxBbNH+6HS2UWMWvyTtCn
|
||||
/bbD519QIdkvayy1QjEf32GV/UjUVmlULMLBcDy0DGjtL3+XpIhLKWDNxN1v1/ai
|
||||
1oz23ZJCOgnk6K4qtFtlRS1XtynjA+rBetvYvLP9SKeFrnpzCgaA2r0CgYEA0+KX
|
||||
1ACXDTNH5ySX3kMjSS9xdINf+OOw4CvPHFwbtc9aqk2HePlEsBTz5I/W3rKwXva3
|
||||
NqZ/bRqVVeZB/hHKFywgdUQk2Uc5z/S7Lw70/w1HubNTXGU06Ngb6zOFAo/o/TwZ
|
||||
zTP1BMIKSOB6PAZPS3l+aLO4FRIRotfFhgRHOoECgYEAmiZbqt8cJaJDB/5YYDzC
|
||||
mp3tSk6gIb936Q6M5VqkMYp9pIKsxhk0N8aDCnTU+kIK6SzWBpr3/d9Ecmqmfyq7
|
||||
5SvWO3KyVf0WWK9KH0abhOm2BKm2HBQvI0DB5u8sUx2/hsvOnjPYDISbZ11t0MtK
|
||||
u35Zy89yMYcSsIYJjG/ROCUCgYEAgI2P9G5PNxEP5OtMwOsW84Y3Xat/hPAQFlI+
|
||||
HES+AzbFGWJkeT8zL2nm95tVkFP1sggZ7Kxjz3w7cpx7GX0NkbWSE9O+T51pNASV
|
||||
tN1sQ3p5M+/a+cnlqgfEGJVvc7iAcXQPa3LEi5h2yPR49QYXAgG6cifn3dDSpmwn
|
||||
SUI7PQECgYEApGCIIpSRPLAEHTGmP87RBL1smurhwmy2s/pghkvUkWehtxg0sGHh
|
||||
kuaqDWcskogv+QC0sVdytiLSz8G0DwcEcsHK1Fkyb8A+ayiw6jWJDo2m9+IF4Fww
|
||||
1Te6jFPYDESnbhq7+TLGgHGhtwcu5cnb4vSuYXGXKupZGzoLOBbv1Zw=
|
||||
-----END RSA PRIVATE KEY-----
|
||||
1298
apps/cms.c
1298
apps/cms.c
File diff suppressed because it is too large
Load Diff
347
apps/crl.c
347
apps/crl.c
@@ -1,347 +0,0 @@
|
||||
/*
|
||||
* Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include "apps.h"
|
||||
#include <openssl/bio.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/x509.h>
|
||||
#include <openssl/x509v3.h>
|
||||
#include <openssl/pem.h>
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_INFORM, OPT_IN, OPT_OUTFORM, OPT_OUT, OPT_KEYFORM, OPT_KEY,
|
||||
OPT_ISSUER, OPT_LASTUPDATE, OPT_NEXTUPDATE, OPT_FINGERPRINT,
|
||||
OPT_CRLNUMBER, OPT_BADSIG, OPT_GENDELTA, OPT_CAPATH, OPT_CAFILE,
|
||||
OPT_NOCAPATH, OPT_NOCAFILE, OPT_VERIFY, OPT_TEXT, OPT_HASH, OPT_HASH_OLD,
|
||||
OPT_NOOUT, OPT_NAMEOPT, OPT_MD
|
||||
} OPTION_CHOICE;
|
||||
|
||||
OPTIONS crl_options[] = {
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"inform", OPT_INFORM, 'F', "Input format; default PEM"},
|
||||
{"in", OPT_IN, '<', "Input file - default stdin"},
|
||||
{"outform", OPT_OUTFORM, 'F', "Output format - default PEM"},
|
||||
{"out", OPT_OUT, '>', "output file - default stdout"},
|
||||
{"keyform", OPT_KEYFORM, 'F', "Private key file format (PEM or ENGINE)"},
|
||||
{"key", OPT_KEY, '<', "CRL signing Private key to use"},
|
||||
{"issuer", OPT_ISSUER, '-', "Print issuer DN"},
|
||||
{"lastupdate", OPT_LASTUPDATE, '-', "Set lastUpdate field"},
|
||||
{"nextupdate", OPT_NEXTUPDATE, '-', "Set nextUpdate field"},
|
||||
{"noout", OPT_NOOUT, '-', "No CRL output"},
|
||||
{"fingerprint", OPT_FINGERPRINT, '-', "Print the crl fingerprint"},
|
||||
{"crlnumber", OPT_CRLNUMBER, '-', "Print CRL number"},
|
||||
{"badsig", OPT_BADSIG, '-', "Corrupt last byte of loaded CRL signature (for test)" },
|
||||
{"gendelta", OPT_GENDELTA, '<', "Other CRL to compare/diff to the Input one"},
|
||||
{"CApath", OPT_CAPATH, '/', "Verify CRL using certificates in dir"},
|
||||
{"CAfile", OPT_CAFILE, '<', "Verify CRL using certificates in file name"},
|
||||
{"no-CAfile", OPT_NOCAFILE, '-',
|
||||
"Do not load the default certificates file"},
|
||||
{"no-CApath", OPT_NOCAPATH, '-',
|
||||
"Do not load certificates from the default certificates directory"},
|
||||
{"verify", OPT_VERIFY, '-', "Verify CRL signature"},
|
||||
{"text", OPT_TEXT, '-', "Print out a text format version"},
|
||||
{"hash", OPT_HASH, '-', "Print hash value"},
|
||||
{"nameopt", OPT_NAMEOPT, 's', "Various certificate name options"},
|
||||
{"", OPT_MD, '-', "Any supported digest"},
|
||||
#ifndef OPENSSL_NO_MD5
|
||||
{"hash_old", OPT_HASH_OLD, '-', "Print old-style (MD5) hash value"},
|
||||
#endif
|
||||
{NULL}
|
||||
};
|
||||
|
||||
int crl_main(int argc, char **argv)
|
||||
{
|
||||
X509_CRL *x = NULL;
|
||||
BIO *out = NULL;
|
||||
X509_STORE *store = NULL;
|
||||
X509_STORE_CTX *ctx = NULL;
|
||||
X509_LOOKUP *lookup = NULL;
|
||||
X509_OBJECT *xobj = NULL;
|
||||
EVP_PKEY *pkey;
|
||||
const EVP_MD *digest = EVP_sha1();
|
||||
unsigned long nmflag = 0;
|
||||
char nmflag_set = 0;
|
||||
char *infile = NULL, *outfile = NULL, *crldiff = NULL, *keyfile = NULL;
|
||||
const char *CAfile = NULL, *CApath = NULL, *prog;
|
||||
OPTION_CHOICE o;
|
||||
int hash = 0, issuer = 0, lastupdate = 0, nextupdate = 0, noout = 0;
|
||||
int informat = FORMAT_PEM, outformat = FORMAT_PEM, keyformat = FORMAT_PEM;
|
||||
int ret = 1, num = 0, badsig = 0, fingerprint = 0, crlnumber = 0;
|
||||
int text = 0, do_ver = 0, noCAfile = 0, noCApath = 0;
|
||||
int i;
|
||||
#ifndef OPENSSL_NO_MD5
|
||||
int hash_old = 0;
|
||||
#endif
|
||||
|
||||
prog = opt_init(argc, argv, crl_options);
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
switch (o) {
|
||||
case OPT_EOF:
|
||||
case OPT_ERR:
|
||||
opthelp:
|
||||
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
||||
goto end;
|
||||
case OPT_HELP:
|
||||
opt_help(crl_options);
|
||||
ret = 0;
|
||||
goto end;
|
||||
case OPT_INFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &informat))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_IN:
|
||||
infile = opt_arg();
|
||||
break;
|
||||
case OPT_OUTFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &outformat))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_OUT:
|
||||
outfile = opt_arg();
|
||||
break;
|
||||
case OPT_KEYFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &keyformat))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_KEY:
|
||||
keyfile = opt_arg();
|
||||
break;
|
||||
case OPT_GENDELTA:
|
||||
crldiff = opt_arg();
|
||||
break;
|
||||
case OPT_CAPATH:
|
||||
CApath = opt_arg();
|
||||
do_ver = 1;
|
||||
break;
|
||||
case OPT_CAFILE:
|
||||
CAfile = opt_arg();
|
||||
do_ver = 1;
|
||||
break;
|
||||
case OPT_NOCAPATH:
|
||||
noCApath = 1;
|
||||
break;
|
||||
case OPT_NOCAFILE:
|
||||
noCAfile = 1;
|
||||
break;
|
||||
case OPT_HASH_OLD:
|
||||
#ifndef OPENSSL_NO_MD5
|
||||
hash_old = ++num;
|
||||
#endif
|
||||
break;
|
||||
case OPT_VERIFY:
|
||||
do_ver = 1;
|
||||
break;
|
||||
case OPT_TEXT:
|
||||
text = 1;
|
||||
break;
|
||||
case OPT_HASH:
|
||||
hash = ++num;
|
||||
break;
|
||||
case OPT_ISSUER:
|
||||
issuer = ++num;
|
||||
break;
|
||||
case OPT_LASTUPDATE:
|
||||
lastupdate = ++num;
|
||||
break;
|
||||
case OPT_NEXTUPDATE:
|
||||
nextupdate = ++num;
|
||||
break;
|
||||
case OPT_NOOUT:
|
||||
noout = ++num;
|
||||
break;
|
||||
case OPT_FINGERPRINT:
|
||||
fingerprint = ++num;
|
||||
break;
|
||||
case OPT_CRLNUMBER:
|
||||
crlnumber = ++num;
|
||||
break;
|
||||
case OPT_BADSIG:
|
||||
badsig = 1;
|
||||
break;
|
||||
case OPT_NAMEOPT:
|
||||
nmflag_set = 1;
|
||||
if (!set_name_ex(&nmflag, opt_arg()))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_MD:
|
||||
if (!opt_md(opt_unknown(), &digest))
|
||||
goto opthelp;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
if (argc != 0)
|
||||
goto opthelp;
|
||||
|
||||
if (!nmflag_set)
|
||||
nmflag = XN_FLAG_ONELINE;
|
||||
|
||||
x = load_crl(infile, informat);
|
||||
if (x == NULL)
|
||||
goto end;
|
||||
|
||||
if (do_ver) {
|
||||
if ((store = setup_verify(CAfile, CApath, noCAfile, noCApath)) == NULL)
|
||||
goto end;
|
||||
lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
|
||||
if (lookup == NULL)
|
||||
goto end;
|
||||
ctx = X509_STORE_CTX_new();
|
||||
if (ctx == NULL || !X509_STORE_CTX_init(ctx, store, NULL, NULL)) {
|
||||
BIO_printf(bio_err, "Error initialising X509 store\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
xobj = X509_STORE_CTX_get_obj_by_subject(ctx, X509_LU_X509,
|
||||
X509_CRL_get_issuer(x));
|
||||
if (xobj == NULL) {
|
||||
BIO_printf(bio_err, "Error getting CRL issuer certificate\n");
|
||||
goto end;
|
||||
}
|
||||
pkey = X509_get_pubkey(X509_OBJECT_get0_X509(xobj));
|
||||
X509_OBJECT_free(xobj);
|
||||
if (!pkey) {
|
||||
BIO_printf(bio_err, "Error getting CRL issuer public key\n");
|
||||
goto end;
|
||||
}
|
||||
i = X509_CRL_verify(x, pkey);
|
||||
EVP_PKEY_free(pkey);
|
||||
if (i < 0)
|
||||
goto end;
|
||||
if (i == 0)
|
||||
BIO_printf(bio_err, "verify failure\n");
|
||||
else
|
||||
BIO_printf(bio_err, "verify OK\n");
|
||||
}
|
||||
|
||||
if (crldiff) {
|
||||
X509_CRL *newcrl, *delta;
|
||||
if (!keyfile) {
|
||||
BIO_puts(bio_err, "Missing CRL signing key\n");
|
||||
goto end;
|
||||
}
|
||||
newcrl = load_crl(crldiff, informat);
|
||||
if (!newcrl)
|
||||
goto end;
|
||||
pkey = load_key(keyfile, keyformat, 0, NULL, NULL, "CRL signing key");
|
||||
if (!pkey) {
|
||||
X509_CRL_free(newcrl);
|
||||
goto end;
|
||||
}
|
||||
delta = X509_CRL_diff(x, newcrl, pkey, digest, 0);
|
||||
X509_CRL_free(newcrl);
|
||||
EVP_PKEY_free(pkey);
|
||||
if (delta) {
|
||||
X509_CRL_free(x);
|
||||
x = delta;
|
||||
} else {
|
||||
BIO_puts(bio_err, "Error creating delta CRL\n");
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
if (badsig) {
|
||||
const ASN1_BIT_STRING *sig;
|
||||
|
||||
X509_CRL_get0_signature(x, &sig, NULL);
|
||||
corrupt_signature(sig);
|
||||
}
|
||||
|
||||
if (num) {
|
||||
for (i = 1; i <= num; i++) {
|
||||
if (issuer == i) {
|
||||
print_name(bio_out, "issuer=", X509_CRL_get_issuer(x),
|
||||
nmflag);
|
||||
}
|
||||
if (crlnumber == i) {
|
||||
ASN1_INTEGER *crlnum;
|
||||
crlnum = X509_CRL_get_ext_d2i(x, NID_crl_number, NULL, NULL);
|
||||
BIO_printf(bio_out, "crlNumber=");
|
||||
if (crlnum) {
|
||||
i2a_ASN1_INTEGER(bio_out, crlnum);
|
||||
ASN1_INTEGER_free(crlnum);
|
||||
} else
|
||||
BIO_puts(bio_out, "<NONE>");
|
||||
BIO_printf(bio_out, "\n");
|
||||
}
|
||||
if (hash == i) {
|
||||
BIO_printf(bio_out, "%08lx\n",
|
||||
X509_NAME_hash(X509_CRL_get_issuer(x)));
|
||||
}
|
||||
#ifndef OPENSSL_NO_MD5
|
||||
if (hash_old == i) {
|
||||
BIO_printf(bio_out, "%08lx\n",
|
||||
X509_NAME_hash_old(X509_CRL_get_issuer(x)));
|
||||
}
|
||||
#endif
|
||||
if (lastupdate == i) {
|
||||
BIO_printf(bio_out, "lastUpdate=");
|
||||
ASN1_TIME_print(bio_out, X509_CRL_get0_lastUpdate(x));
|
||||
BIO_printf(bio_out, "\n");
|
||||
}
|
||||
if (nextupdate == i) {
|
||||
BIO_printf(bio_out, "nextUpdate=");
|
||||
if (X509_CRL_get0_nextUpdate(x))
|
||||
ASN1_TIME_print(bio_out, X509_CRL_get0_nextUpdate(x));
|
||||
else
|
||||
BIO_printf(bio_out, "NONE");
|
||||
BIO_printf(bio_out, "\n");
|
||||
}
|
||||
if (fingerprint == i) {
|
||||
int j;
|
||||
unsigned int n;
|
||||
unsigned char md[EVP_MAX_MD_SIZE];
|
||||
|
||||
if (!X509_CRL_digest(x, digest, md, &n)) {
|
||||
BIO_printf(bio_err, "out of memory\n");
|
||||
goto end;
|
||||
}
|
||||
BIO_printf(bio_out, "%s Fingerprint=",
|
||||
OBJ_nid2sn(EVP_MD_type(digest)));
|
||||
for (j = 0; j < (int)n; j++) {
|
||||
BIO_printf(bio_out, "%02X%c", md[j], (j + 1 == (int)n)
|
||||
? '\n' : ':');
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
out = bio_open_default(outfile, 'w', outformat);
|
||||
if (out == NULL)
|
||||
goto end;
|
||||
|
||||
if (text)
|
||||
X509_CRL_print(out, x);
|
||||
|
||||
if (noout) {
|
||||
ret = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (outformat == FORMAT_ASN1)
|
||||
i = (int)i2d_X509_CRL_bio(out, x);
|
||||
else
|
||||
i = PEM_write_bio_X509_CRL(out, x);
|
||||
if (!i) {
|
||||
BIO_printf(bio_err, "unable to write CRL\n");
|
||||
goto end;
|
||||
}
|
||||
ret = 0;
|
||||
|
||||
end:
|
||||
if (ret != 0)
|
||||
ERR_print_errors(bio_err);
|
||||
BIO_free_all(out);
|
||||
X509_CRL_free(x);
|
||||
X509_STORE_CTX_free(ctx);
|
||||
X509_STORE_free(store);
|
||||
return (ret);
|
||||
}
|
||||
216
apps/crl2p7.c
216
apps/crl2p7.c
@@ -1,216 +0,0 @@
|
||||
/*
|
||||
* Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <sys/types.h>
|
||||
#include "apps.h"
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/evp.h>
|
||||
#include <openssl/x509.h>
|
||||
#include <openssl/pkcs7.h>
|
||||
#include <openssl/pem.h>
|
||||
#include <openssl/objects.h>
|
||||
|
||||
static int add_certs_from_file(STACK_OF(X509) *stack, char *certfile);
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_NOCRL, OPT_CERTFILE
|
||||
} OPTION_CHOICE;
|
||||
|
||||
OPTIONS crl2pkcs7_options[] = {
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"inform", OPT_INFORM, 'F', "Input format - DER or PEM"},
|
||||
{"outform", OPT_OUTFORM, 'F', "Output format - DER or PEM"},
|
||||
{"in", OPT_IN, '<', "Input file"},
|
||||
{"out", OPT_OUT, '>', "Output file"},
|
||||
{"nocrl", OPT_NOCRL, '-', "No crl to load, just certs from '-certfile'"},
|
||||
{"certfile", OPT_CERTFILE, '<',
|
||||
"File of chain of certs to a trusted CA; can be repeated"},
|
||||
{NULL}
|
||||
};
|
||||
|
||||
int crl2pkcs7_main(int argc, char **argv)
|
||||
{
|
||||
BIO *in = NULL, *out = NULL;
|
||||
PKCS7 *p7 = NULL;
|
||||
PKCS7_SIGNED *p7s = NULL;
|
||||
STACK_OF(OPENSSL_STRING) *certflst = NULL;
|
||||
STACK_OF(X509) *cert_stack = NULL;
|
||||
STACK_OF(X509_CRL) *crl_stack = NULL;
|
||||
X509_CRL *crl = NULL;
|
||||
char *infile = NULL, *outfile = NULL, *prog, *certfile;
|
||||
int i = 0, informat = FORMAT_PEM, outformat = FORMAT_PEM, ret = 1, nocrl =
|
||||
0;
|
||||
OPTION_CHOICE o;
|
||||
|
||||
prog = opt_init(argc, argv, crl2pkcs7_options);
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
switch (o) {
|
||||
case OPT_EOF:
|
||||
case OPT_ERR:
|
||||
opthelp:
|
||||
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
||||
goto end;
|
||||
case OPT_HELP:
|
||||
opt_help(crl2pkcs7_options);
|
||||
ret = 0;
|
||||
goto end;
|
||||
case OPT_INFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &informat))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_OUTFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &outformat))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_IN:
|
||||
infile = opt_arg();
|
||||
break;
|
||||
case OPT_OUT:
|
||||
outfile = opt_arg();
|
||||
break;
|
||||
case OPT_NOCRL:
|
||||
nocrl = 1;
|
||||
break;
|
||||
case OPT_CERTFILE:
|
||||
if ((certflst == NULL)
|
||||
&& (certflst = sk_OPENSSL_STRING_new_null()) == NULL)
|
||||
goto end;
|
||||
if (!sk_OPENSSL_STRING_push(certflst, opt_arg()))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
if (argc != 0)
|
||||
goto opthelp;
|
||||
|
||||
if (!nocrl) {
|
||||
in = bio_open_default(infile, 'r', informat);
|
||||
if (in == NULL)
|
||||
goto end;
|
||||
|
||||
if (informat == FORMAT_ASN1)
|
||||
crl = d2i_X509_CRL_bio(in, NULL);
|
||||
else if (informat == FORMAT_PEM)
|
||||
crl = PEM_read_bio_X509_CRL(in, NULL, NULL, NULL);
|
||||
if (crl == NULL) {
|
||||
BIO_printf(bio_err, "unable to load CRL\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
if ((p7 = PKCS7_new()) == NULL)
|
||||
goto end;
|
||||
if ((p7s = PKCS7_SIGNED_new()) == NULL)
|
||||
goto end;
|
||||
p7->type = OBJ_nid2obj(NID_pkcs7_signed);
|
||||
p7->d.sign = p7s;
|
||||
p7s->contents->type = OBJ_nid2obj(NID_pkcs7_data);
|
||||
|
||||
if (!ASN1_INTEGER_set(p7s->version, 1))
|
||||
goto end;
|
||||
if ((crl_stack = sk_X509_CRL_new_null()) == NULL)
|
||||
goto end;
|
||||
p7s->crl = crl_stack;
|
||||
if (crl != NULL) {
|
||||
sk_X509_CRL_push(crl_stack, crl);
|
||||
crl = NULL; /* now part of p7 for OPENSSL_freeing */
|
||||
}
|
||||
|
||||
if ((cert_stack = sk_X509_new_null()) == NULL)
|
||||
goto end;
|
||||
p7s->cert = cert_stack;
|
||||
|
||||
if (certflst)
|
||||
for (i = 0; i < sk_OPENSSL_STRING_num(certflst); i++) {
|
||||
certfile = sk_OPENSSL_STRING_value(certflst, i);
|
||||
if (add_certs_from_file(cert_stack, certfile) < 0) {
|
||||
BIO_printf(bio_err, "error loading certificates\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
out = bio_open_default(outfile, 'w', outformat);
|
||||
if (out == NULL)
|
||||
goto end;
|
||||
|
||||
if (outformat == FORMAT_ASN1)
|
||||
i = i2d_PKCS7_bio(out, p7);
|
||||
else if (outformat == FORMAT_PEM)
|
||||
i = PEM_write_bio_PKCS7(out, p7);
|
||||
if (!i) {
|
||||
BIO_printf(bio_err, "unable to write pkcs7 object\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
ret = 0;
|
||||
end:
|
||||
sk_OPENSSL_STRING_free(certflst);
|
||||
BIO_free(in);
|
||||
BIO_free_all(out);
|
||||
PKCS7_free(p7);
|
||||
X509_CRL_free(crl);
|
||||
|
||||
return (ret);
|
||||
}
|
||||
|
||||
/*-
|
||||
*----------------------------------------------------------------------
|
||||
* int add_certs_from_file
|
||||
*
|
||||
* Read a list of certificates to be checked from a file.
|
||||
*
|
||||
* Results:
|
||||
* number of certs added if successful, -1 if not.
|
||||
*----------------------------------------------------------------------
|
||||
*/
|
||||
static int add_certs_from_file(STACK_OF(X509) *stack, char *certfile)
|
||||
{
|
||||
BIO *in = NULL;
|
||||
int count = 0;
|
||||
int ret = -1;
|
||||
STACK_OF(X509_INFO) *sk = NULL;
|
||||
X509_INFO *xi;
|
||||
|
||||
in = BIO_new_file(certfile, "r");
|
||||
if (in == NULL) {
|
||||
BIO_printf(bio_err, "error opening the file, %s\n", certfile);
|
||||
goto end;
|
||||
}
|
||||
|
||||
/* This loads from a file, a stack of x509/crl/pkey sets */
|
||||
sk = PEM_X509_INFO_read_bio(in, NULL, NULL, NULL);
|
||||
if (sk == NULL) {
|
||||
BIO_printf(bio_err, "error reading the file, %s\n", certfile);
|
||||
goto end;
|
||||
}
|
||||
|
||||
/* scan over it and pull out the CRL's */
|
||||
while (sk_X509_INFO_num(sk)) {
|
||||
xi = sk_X509_INFO_shift(sk);
|
||||
if (xi->x509 != NULL) {
|
||||
sk_X509_push(stack, xi->x509);
|
||||
xi->x509 = NULL;
|
||||
count++;
|
||||
}
|
||||
X509_INFO_free(xi);
|
||||
}
|
||||
|
||||
ret = count;
|
||||
end:
|
||||
/* never need to OPENSSL_free x */
|
||||
BIO_free(in);
|
||||
sk_X509_INFO_free(sk);
|
||||
return (ret);
|
||||
}
|
||||
@@ -1,34 +0,0 @@
|
||||
enabled_logs=pilot,aviator,rocketeer,digicert,certly,izempe,symantec,venafi
|
||||
|
||||
[pilot]
|
||||
description = Google Pilot Log
|
||||
key = MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEfahLEimAoz2t01p3uMziiLOl/fHTDM0YDOhBRuiBARsV4UvxG2LdNgoIGLrtCzWE0J5APC2em4JlvR8EEEFMoA==
|
||||
|
||||
[aviator]
|
||||
description = Google Aviator log
|
||||
key = MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1/TMabLkDpCjiupacAlP7xNi0I1JYP8bQFAHDG1xhtolSY1l4QgNRzRrvSe8liE+NPWHdjGxfx3JhTsN9x8/6Q==
|
||||
|
||||
[rocketeer]
|
||||
description = Google Rocketeer log
|
||||
key = MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIFsYyDzBi7MxCAC/oJBXK7dHjG+1aLCOkHjpoHPqTyghLpzA9BYbqvnV16mAw04vUjyYASVGJCUoI3ctBcJAeg==
|
||||
|
||||
[digicert]
|
||||
description = DigiCert Log Server
|
||||
key = MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEAkbFvhu7gkAW6MHSrBlpE1n4+HCFRkC5OLAjgqhkTH+/uzSfSl8ois8ZxAD2NgaTZe1M9akhYlrYkes4JECs6A==
|
||||
|
||||
[certly]
|
||||
description = Certly.IO log
|
||||
key = MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAECyPLhWKYYUgEc+tUXfPQB4wtGS2MNvXrjwFCCnyYJifBtd2Sk7Cu+Js9DNhMTh35FftHaHu6ZrclnNBKwmbbSA==
|
||||
|
||||
[izempe]
|
||||
description = Izempe log
|
||||
key = MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEJ2Q5DC3cUBj4IQCiDu0s6j51up+TZAkAEcQRF6tczw90rLWXkJMAW7jr9yc92bIKgV8vDXU4lDeZHvYHduDuvg==
|
||||
|
||||
[symantec]
|
||||
description = Symantec log
|
||||
key = MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEluqsHEYMG1XcDfy1lCdGV0JwOmkY4r87xNuroPS2bMBTP01CEDPwWJePa75y9CrsHEKqAy8afig1dpkIPSEUhg==
|
||||
|
||||
[venafi]
|
||||
description = Venafi log
|
||||
key = MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAolpIHxdSlTXLo1s6H1OCdpSj/4DyHDc8wLG9wVmLqy1lk9fz4ATVmm+/1iN2Nk8jmctUKK2MFUtlWXZBSpym97M7frGlSaQXUWyA3CqQUEuIJOmlEjKTBEiQAvpfDjCHjlV2Be4qTM6jamkJbiWtgnYPhJL6ONaGTiSPm7Byy57iaz/hbckldSOIoRhYBiMzeNoA0DiRZ9KmfSeXZ1rB8y8X5urSW+iBzf2SaOfzBvDpcoTuAaWx2DPazoOl28fP1hZ+kHUYvxbcMjttjauCFx+JII0dmuZNIwjfeG/GBb9frpSX219k1O4Wi6OEbHEr8at/XQ0y7gTikOxBn/s5wQIDAQAB
|
||||
|
||||
@@ -1,14 +0,0 @@
|
||||
subject=/C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=SSLeay demo server
|
||||
issuer= /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=CA
|
||||
-----BEGIN X509 CERTIFICATE-----
|
||||
|
||||
MIIBgjCCASwCAQQwDQYJKoZIhvcNAQEEBQAwODELMAkGA1UEBhMCQVUxDDAKBgNV
|
||||
BAgTA1FMRDEbMBkGA1UEAxMSU1NMZWF5L3JzYSB0ZXN0IENBMB4XDTk1MTAwOTIz
|
||||
MzIwNVoXDTk4MDcwNTIzMzIwNVowYDELMAkGA1UEBhMCQVUxDDAKBgNVBAgTA1FM
|
||||
RDEZMBcGA1UEChMQTWluY29tIFB0eS4gTHRkLjELMAkGA1UECxMCQ1MxGzAZBgNV
|
||||
BAMTElNTTGVheSBkZW1vIHNlcnZlcjBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQC3
|
||||
LCXcScWua0PFLkHBLm2VejqpA1F4RQ8q0VjRiPafjx/Z/aWH3ipdMVvuJGa/wFXb
|
||||
/nDFLDlfWp+oCPwhBtVPAgMBAAEwDQYJKoZIhvcNAQEEBQADQQArNFsihWIjBzb0
|
||||
DCsU0BvL2bvSwJrPEqFlkDq3F4M6EGutL9axEcANWgbbEdAvNJD1dmEmoWny27Pn
|
||||
IMs6ZOZB
|
||||
-----END X509 CERTIFICATE-----
|
||||
@@ -1,39 +0,0 @@
|
||||
R 980705233205Z 951009233205Z 01 certs/00000001 /CN=Eric Young
|
||||
E 951009233205Z 02 certs/00000002 /CN=Duncan Young
|
||||
R 980705233205Z 951201010000Z 03 certs/00000003 /CN=Tim Hudson
|
||||
V 980705233205Z 04 certs/00000004 /CN=Eric Young4
|
||||
V 980705233205Z 05 certs/00000004 /CN=Eric Young5
|
||||
V 980705233205Z 06 certs/00000004 /CN=Eric Young6
|
||||
V 980705233205Z 07 certs/00000004 /CN=Eric Young7
|
||||
V 980705233205Z 08 certs/00000004 /CN=Eric Young8
|
||||
V 980705233205Z 09 certs/00000004 /CN=Eric Young9
|
||||
V 980705233205Z 0A certs/00000004 /CN=Eric YoungA
|
||||
V 980705233205Z 0B certs/00000004 /CN=Eric YoungB
|
||||
V 980705233205Z 0C certs/00000004 /CN=Eric YoungC
|
||||
V 980705233205Z 0D certs/00000004 /CN=Eric YoungD
|
||||
V 980705233205Z 0E certs/00000004 /CN=Eric YoungE
|
||||
V 980705233205Z 0F certs/00000004 /CN=Eric YoungF
|
||||
V 980705233205Z 10 certs/00000004 /CN=Eric Young10
|
||||
V 980705233205Z 11 certs/00000004 /CN=Eric Young11
|
||||
V 980705233205Z 12 certs/00000004 /CN=Eric Young12
|
||||
V 980705233205Z 13 certs/00000004 /CN=Eric Young13
|
||||
V 980705233205Z 14 certs/00000004 /CN=Eric Young14
|
||||
V 980705233205Z 15 certs/00000004 /CN=Eric Young15
|
||||
V 980705233205Z 16 certs/00000004 /CN=Eric Young16
|
||||
V 980705233205Z 17 certs/00000004 /CN=Eric Young17
|
||||
V 961206150305Z 010C unknown /C=AU/SP=QLD/O=Mincom Pty. Ltd./OU=MTR/CN=Eric Young/Email=eay@mincom.oz.au
|
||||
V 961206153245Z 010D unknown /C=AU/SP=Queensland/O=Mincom Pty Ltd/OU=MTR/CN=Eric Young/Email=eay@mincom.oz.au
|
||||
V 970322074816Z 010E unknown /CN=Eric Young/Email=eay@mincom.oz.au
|
||||
V 970322075152Z 010F unknown /CN=Eric Young
|
||||
V 970322075906Z 0110 unknown /CN=Eric Youngg
|
||||
V 970324092238Z 0111 unknown /C=AU/SP=Queensland/CN=Eric Young
|
||||
V 970324221931Z 0112 unknown /CN=Fred
|
||||
V 970324224934Z 0113 unknown /C=AU/CN=eay
|
||||
V 971001005237Z 0114 unknown /C=AU/SP=QLD/O=Mincom Pty Ltd/OU=MTR/CN=x509v3 test
|
||||
V 971001010331Z 0115 unknown /C=AU/SP=Queensland/O=Mincom Pty Ltd/OU=MTR/CN=test again - x509v3
|
||||
V 971001013945Z 0117 unknown /C=AU/SP=Queensland/O=Mincom Pty Ltd/OU=MTR/CN=x509v3 test
|
||||
V 971014225415Z 0118 unknown /C=AU/SP=Queensland/CN=test
|
||||
V 971015004448Z 0119 unknown /C=AU/SP=Queensland/O=Mincom Pty Ltd/OU=MTR/CN=test2
|
||||
V 971016035001Z 011A unknown /C=AU/SP=Queensland/O=Mincom Pty Ltd/OU=MTR/CN=test64
|
||||
V 971016080129Z 011B unknown /C=FR/O=ALCATEL/OU=Alcatel Mobile Phones/CN=bourque/Email=bourque@art.alcatel.fr
|
||||
V 971016224000Z 011D unknown /L=Bedford/O=Cranfield University/OU=Computer Centre/CN=Peter R Lister/Email=P.Lister@cranfield.ac.uk
|
||||
@@ -1,24 +0,0 @@
|
||||
issuer= /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=CA
|
||||
subject=/C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=SSLeay demo server
|
||||
-----BEGIN X509 CERTIFICATE-----
|
||||
|
||||
MIIBgjCCASwCAQQwDQYJKoZIhvcNAQEEBQAwODELMAkGA1UEBhMCQVUxDDAKBgNV
|
||||
BAgTA1FMRDEbMBkGA1UEAxMSU1NMZWF5L3JzYSB0ZXN0IENBMB4XDTk1MTAwOTIz
|
||||
MzIwNVoXDTk4MDcwNTIzMzIwNVowYDELMAkGA1UEBhMCQVUxDDAKBgNVBAgTA1FM
|
||||
RDEZMBcGA1UEChMQTWluY29tIFB0eS4gTHRkLjELMAkGA1UECxMCQ1MxGzAZBgNV
|
||||
BAMTElNTTGVheSBkZW1vIHNlcnZlcjBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQC3
|
||||
LCXcScWua0PFLkHBLm2VejqpA1F4RQ8q0VjRiPafjx/Z/aWH3ipdMVvuJGa/wFXb
|
||||
/nDFLDlfWp+oCPwhBtVPAgMBAAEwDQYJKoZIhvcNAQEEBQADQQArNFsihWIjBzb0
|
||||
DCsU0BvL2bvSwJrPEqFlkDq3F4M6EGutL9axEcANWgbbEdAvNJD1dmEmoWny27Pn
|
||||
IMs6ZOZB
|
||||
-----END X509 CERTIFICATE-----
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
|
||||
MIIBPAIBAAJBALcsJdxJxa5rQ8UuQcEubZV6OqkDUXhFDyrRWNGI9p+PH9n9pYfe
|
||||
Kl0xW+4kZr/AVdv+cMUsOV9an6gI/CEG1U8CAwEAAQJAXJMBZ34ZXHd1vtgL/3hZ
|
||||
hexKbVTx/djZO4imXO/dxPGRzG2ylYZpHmG32/T1kaHpZlCHoEPgHoSzmxYXfxjG
|
||||
sQIhAPmZ/bQOjmRUHM/VM2X5zrjjM6z18R1P6l3ObFwt9FGdAiEAu943Yh9SqMRw
|
||||
tL0xHGxKmM/YJueUw1gB6sLkETN71NsCIQCeT3RhoqXfrpXDoEcEU+gwzjI1bpxq
|
||||
agiNTOLfqGoA5QIhAIQFYjgzONxex7FLrsKBm16N2SFl5pXsN9SpRqqL2n63AiEA
|
||||
g9VNIQ3xwpw7og3IbONifeku+J9qGMGQJMKwSTwrFtI=
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -1 +0,0 @@
|
||||
011E
|
||||
@@ -1,6 +0,0 @@
|
||||
# This is a file that will be filled by the openssl srp routine.
|
||||
# You can initialize the file with additional groups, these are
|
||||
# records starting with a I followed by the g and N values and the id.
|
||||
# The exact values ... you have to dig this out from the source of srp.c
|
||||
# or srp_vfy.c
|
||||
# The last value of an I is used as the default group for new users.
|
||||
@@ -1 +0,0 @@
|
||||
unique_subject = yes
|
||||
480
apps/dgst.c
480
apps/dgst.c
@@ -1,480 +0,0 @@
|
||||
/*
|
||||
* Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
#include "apps.h"
|
||||
#include <openssl/bio.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/evp.h>
|
||||
#include <openssl/objects.h>
|
||||
#include <openssl/x509.h>
|
||||
#include <openssl/pem.h>
|
||||
#include <openssl/hmac.h>
|
||||
|
||||
#undef BUFSIZE
|
||||
#define BUFSIZE 1024*8
|
||||
|
||||
int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout,
|
||||
EVP_PKEY *key, unsigned char *sigin, int siglen,
|
||||
const char *sig_name, const char *md_name,
|
||||
const char *file);
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_C, OPT_R, OPT_RAND, OPT_OUT, OPT_SIGN, OPT_PASSIN, OPT_VERIFY,
|
||||
OPT_PRVERIFY, OPT_SIGNATURE, OPT_KEYFORM, OPT_ENGINE, OPT_ENGINE_IMPL,
|
||||
OPT_HEX, OPT_BINARY, OPT_DEBUG, OPT_FIPS_FINGERPRINT,
|
||||
OPT_HMAC, OPT_MAC, OPT_SIGOPT, OPT_MACOPT,
|
||||
OPT_DIGEST
|
||||
} OPTION_CHOICE;
|
||||
|
||||
OPTIONS dgst_options[] = {
|
||||
{OPT_HELP_STR, 1, '-', "Usage: %s [options] [file...]\n"},
|
||||
{OPT_HELP_STR, 1, '-',
|
||||
" file... files to digest (default is stdin)\n"},
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"c", OPT_C, '-', "Print the digest with separating colons"},
|
||||
{"r", OPT_R, '-', "Print the digest in coreutils format"},
|
||||
{"rand", OPT_RAND, 's',
|
||||
"Use file(s) containing random data to seed RNG or an EGD sock"},
|
||||
{"out", OPT_OUT, '>', "Output to filename rather than stdout"},
|
||||
{"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
|
||||
{"sign", OPT_SIGN, 's', "Sign digest using private key"},
|
||||
{"verify", OPT_VERIFY, 's',
|
||||
"Verify a signature using public key"},
|
||||
{"prverify", OPT_PRVERIFY, 's',
|
||||
"Verify a signature using private key"},
|
||||
{"signature", OPT_SIGNATURE, '<', "File with signature to verify"},
|
||||
{"keyform", OPT_KEYFORM, 'f', "Key file format (PEM or ENGINE)"},
|
||||
{"hex", OPT_HEX, '-', "Print as hex dump"},
|
||||
{"binary", OPT_BINARY, '-', "Print in binary form"},
|
||||
{"d", OPT_DEBUG, '-', "Print debug info"},
|
||||
{"debug", OPT_DEBUG, '-', "Print debug info"},
|
||||
{"fips-fingerprint", OPT_FIPS_FINGERPRINT, '-',
|
||||
"Compute HMAC with the key used in OpenSSL-FIPS fingerprint"},
|
||||
{"hmac", OPT_HMAC, 's', "Create hashed MAC with key"},
|
||||
{"mac", OPT_MAC, 's', "Create MAC (not necessarily HMAC)"},
|
||||
{"sigopt", OPT_SIGOPT, 's', "Signature parameter in n:v form"},
|
||||
{"macopt", OPT_MACOPT, 's', "MAC algorithm parameters in n:v form or key"},
|
||||
{"", OPT_DIGEST, '-', "Any supported digest"},
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
{"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
|
||||
{"engine_impl", OPT_ENGINE_IMPL, '-',
|
||||
"Also use engine given by -engine for digest operations"},
|
||||
#endif
|
||||
{NULL}
|
||||
};
|
||||
|
||||
int dgst_main(int argc, char **argv)
|
||||
{
|
||||
BIO *in = NULL, *inp, *bmd = NULL, *out = NULL;
|
||||
ENGINE *e = NULL, *impl = NULL;
|
||||
EVP_PKEY *sigkey = NULL;
|
||||
STACK_OF(OPENSSL_STRING) *sigopts = NULL, *macopts = NULL;
|
||||
char *hmac_key = NULL;
|
||||
char *mac_name = NULL;
|
||||
char *passinarg = NULL, *passin = NULL;
|
||||
const EVP_MD *md = NULL, *m;
|
||||
const char *outfile = NULL, *keyfile = NULL, *prog = NULL;
|
||||
const char *sigfile = NULL, *randfile = NULL;
|
||||
OPTION_CHOICE o;
|
||||
int separator = 0, debug = 0, keyform = FORMAT_PEM, siglen = 0;
|
||||
int i, ret = 1, out_bin = -1, want_pub = 0, do_verify = 0;
|
||||
unsigned char *buf = NULL, *sigbuf = NULL;
|
||||
int engine_impl = 0;
|
||||
|
||||
prog = opt_progname(argv[0]);
|
||||
buf = app_malloc(BUFSIZE, "I/O buffer");
|
||||
md = EVP_get_digestbyname(prog);
|
||||
|
||||
prog = opt_init(argc, argv, dgst_options);
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
switch (o) {
|
||||
case OPT_EOF:
|
||||
case OPT_ERR:
|
||||
opthelp:
|
||||
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
||||
goto end;
|
||||
case OPT_HELP:
|
||||
opt_help(dgst_options);
|
||||
ret = 0;
|
||||
goto end;
|
||||
case OPT_C:
|
||||
separator = 1;
|
||||
break;
|
||||
case OPT_R:
|
||||
separator = 2;
|
||||
break;
|
||||
case OPT_RAND:
|
||||
randfile = opt_arg();
|
||||
break;
|
||||
case OPT_OUT:
|
||||
outfile = opt_arg();
|
||||
break;
|
||||
case OPT_SIGN:
|
||||
keyfile = opt_arg();
|
||||
break;
|
||||
case OPT_PASSIN:
|
||||
passinarg = opt_arg();
|
||||
break;
|
||||
case OPT_VERIFY:
|
||||
keyfile = opt_arg();
|
||||
want_pub = do_verify = 1;
|
||||
break;
|
||||
case OPT_PRVERIFY:
|
||||
keyfile = opt_arg();
|
||||
do_verify = 1;
|
||||
break;
|
||||
case OPT_SIGNATURE:
|
||||
sigfile = opt_arg();
|
||||
break;
|
||||
case OPT_KEYFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_ANY, &keyform))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_ENGINE:
|
||||
e = setup_engine(opt_arg(), 0);
|
||||
break;
|
||||
case OPT_ENGINE_IMPL:
|
||||
engine_impl = 1;
|
||||
break;
|
||||
case OPT_HEX:
|
||||
out_bin = 0;
|
||||
break;
|
||||
case OPT_BINARY:
|
||||
out_bin = 1;
|
||||
break;
|
||||
case OPT_DEBUG:
|
||||
debug = 1;
|
||||
break;
|
||||
case OPT_FIPS_FINGERPRINT:
|
||||
hmac_key = "etaonrishdlcupfm";
|
||||
break;
|
||||
case OPT_HMAC:
|
||||
hmac_key = opt_arg();
|
||||
break;
|
||||
case OPT_MAC:
|
||||
mac_name = opt_arg();
|
||||
break;
|
||||
case OPT_SIGOPT:
|
||||
if (!sigopts)
|
||||
sigopts = sk_OPENSSL_STRING_new_null();
|
||||
if (!sigopts || !sk_OPENSSL_STRING_push(sigopts, opt_arg()))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_MACOPT:
|
||||
if (!macopts)
|
||||
macopts = sk_OPENSSL_STRING_new_null();
|
||||
if (!macopts || !sk_OPENSSL_STRING_push(macopts, opt_arg()))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_DIGEST:
|
||||
if (!opt_md(opt_unknown(), &m))
|
||||
goto opthelp;
|
||||
md = m;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
argv = opt_rest();
|
||||
if (keyfile != NULL && argc > 1) {
|
||||
BIO_printf(bio_err, "%s: Can only sign or verify one file.\n", prog);
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (do_verify && !sigfile) {
|
||||
BIO_printf(bio_err,
|
||||
"No signature to verify: use the -signature option\n");
|
||||
goto end;
|
||||
}
|
||||
if (engine_impl)
|
||||
impl = e;
|
||||
|
||||
in = BIO_new(BIO_s_file());
|
||||
bmd = BIO_new(BIO_f_md());
|
||||
if ((in == NULL) || (bmd == NULL)) {
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (debug) {
|
||||
BIO_set_callback(in, BIO_debug_callback);
|
||||
/* needed for windows 3.1 */
|
||||
BIO_set_callback_arg(in, (char *)bio_err);
|
||||
}
|
||||
|
||||
if (!app_passwd(passinarg, NULL, &passin, NULL)) {
|
||||
BIO_printf(bio_err, "Error getting password\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (out_bin == -1) {
|
||||
if (keyfile)
|
||||
out_bin = 1;
|
||||
else
|
||||
out_bin = 0;
|
||||
}
|
||||
|
||||
if (randfile)
|
||||
app_RAND_load_file(randfile, 0);
|
||||
|
||||
out = bio_open_default(outfile, 'w', out_bin ? FORMAT_BINARY : FORMAT_TEXT);
|
||||
if (out == NULL)
|
||||
goto end;
|
||||
|
||||
if ((! !mac_name + ! !keyfile + ! !hmac_key) > 1) {
|
||||
BIO_printf(bio_err, "MAC and Signing key cannot both be specified\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (keyfile) {
|
||||
if (want_pub)
|
||||
sigkey = load_pubkey(keyfile, keyform, 0, NULL, e, "key file");
|
||||
else
|
||||
sigkey = load_key(keyfile, keyform, 0, passin, e, "key file");
|
||||
if (!sigkey) {
|
||||
/*
|
||||
* load_[pub]key() has already printed an appropriate message
|
||||
*/
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
if (mac_name) {
|
||||
EVP_PKEY_CTX *mac_ctx = NULL;
|
||||
int r = 0;
|
||||
if (!init_gen_str(&mac_ctx, mac_name, impl, 0))
|
||||
goto mac_end;
|
||||
if (macopts) {
|
||||
char *macopt;
|
||||
for (i = 0; i < sk_OPENSSL_STRING_num(macopts); i++) {
|
||||
macopt = sk_OPENSSL_STRING_value(macopts, i);
|
||||
if (pkey_ctrl_string(mac_ctx, macopt) <= 0) {
|
||||
BIO_printf(bio_err,
|
||||
"MAC parameter error \"%s\"\n", macopt);
|
||||
ERR_print_errors(bio_err);
|
||||
goto mac_end;
|
||||
}
|
||||
}
|
||||
}
|
||||
if (EVP_PKEY_keygen(mac_ctx, &sigkey) <= 0) {
|
||||
BIO_puts(bio_err, "Error generating key\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto mac_end;
|
||||
}
|
||||
r = 1;
|
||||
mac_end:
|
||||
EVP_PKEY_CTX_free(mac_ctx);
|
||||
if (r == 0)
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (hmac_key) {
|
||||
sigkey = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, impl,
|
||||
(unsigned char *)hmac_key, -1);
|
||||
if (!sigkey)
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (sigkey) {
|
||||
EVP_MD_CTX *mctx = NULL;
|
||||
EVP_PKEY_CTX *pctx = NULL;
|
||||
int r;
|
||||
if (!BIO_get_md_ctx(bmd, &mctx)) {
|
||||
BIO_printf(bio_err, "Error getting context\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
if (do_verify)
|
||||
r = EVP_DigestVerifyInit(mctx, &pctx, md, impl, sigkey);
|
||||
else
|
||||
r = EVP_DigestSignInit(mctx, &pctx, md, impl, sigkey);
|
||||
if (!r) {
|
||||
BIO_printf(bio_err, "Error setting context\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
if (sigopts) {
|
||||
char *sigopt;
|
||||
for (i = 0; i < sk_OPENSSL_STRING_num(sigopts); i++) {
|
||||
sigopt = sk_OPENSSL_STRING_value(sigopts, i);
|
||||
if (pkey_ctrl_string(pctx, sigopt) <= 0) {
|
||||
BIO_printf(bio_err, "parameter error \"%s\"\n", sigopt);
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
/* we use md as a filter, reading from 'in' */
|
||||
else {
|
||||
EVP_MD_CTX *mctx = NULL;
|
||||
if (!BIO_get_md_ctx(bmd, &mctx)) {
|
||||
BIO_printf(bio_err, "Error getting context\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
if (md == NULL)
|
||||
md = EVP_sha256();
|
||||
if (!EVP_DigestInit_ex(mctx, md, impl)) {
|
||||
BIO_printf(bio_err, "Error setting digest\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
if (sigfile && sigkey) {
|
||||
BIO *sigbio = BIO_new_file(sigfile, "rb");
|
||||
if (!sigbio) {
|
||||
BIO_printf(bio_err, "Error opening signature file %s\n", sigfile);
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
siglen = EVP_PKEY_size(sigkey);
|
||||
sigbuf = app_malloc(siglen, "signature buffer");
|
||||
siglen = BIO_read(sigbio, sigbuf, siglen);
|
||||
BIO_free(sigbio);
|
||||
if (siglen <= 0) {
|
||||
BIO_printf(bio_err, "Error reading signature file %s\n", sigfile);
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
inp = BIO_push(bmd, in);
|
||||
|
||||
if (md == NULL) {
|
||||
EVP_MD_CTX *tctx;
|
||||
BIO_get_md_ctx(bmd, &tctx);
|
||||
md = EVP_MD_CTX_md(tctx);
|
||||
}
|
||||
|
||||
if (argc == 0) {
|
||||
BIO_set_fp(in, stdin, BIO_NOCLOSE);
|
||||
ret = do_fp(out, buf, inp, separator, out_bin, sigkey, sigbuf,
|
||||
siglen, NULL, NULL, "stdin");
|
||||
} else {
|
||||
const char *md_name = NULL, *sig_name = NULL;
|
||||
if (!out_bin) {
|
||||
if (sigkey) {
|
||||
const EVP_PKEY_ASN1_METHOD *ameth;
|
||||
ameth = EVP_PKEY_get0_asn1(sigkey);
|
||||
if (ameth)
|
||||
EVP_PKEY_asn1_get0_info(NULL, NULL,
|
||||
NULL, NULL, &sig_name, ameth);
|
||||
}
|
||||
if (md)
|
||||
md_name = EVP_MD_name(md);
|
||||
}
|
||||
ret = 0;
|
||||
for (i = 0; i < argc; i++) {
|
||||
int r;
|
||||
if (BIO_read_filename(in, argv[i]) <= 0) {
|
||||
perror(argv[i]);
|
||||
ret++;
|
||||
continue;
|
||||
} else
|
||||
r = do_fp(out, buf, inp, separator, out_bin, sigkey, sigbuf,
|
||||
siglen, sig_name, md_name, argv[i]);
|
||||
if (r)
|
||||
ret = r;
|
||||
(void)BIO_reset(bmd);
|
||||
}
|
||||
}
|
||||
end:
|
||||
OPENSSL_clear_free(buf, BUFSIZE);
|
||||
BIO_free(in);
|
||||
OPENSSL_free(passin);
|
||||
BIO_free_all(out);
|
||||
EVP_PKEY_free(sigkey);
|
||||
sk_OPENSSL_STRING_free(sigopts);
|
||||
sk_OPENSSL_STRING_free(macopts);
|
||||
OPENSSL_free(sigbuf);
|
||||
BIO_free(bmd);
|
||||
release_engine(e);
|
||||
return (ret);
|
||||
}
|
||||
|
||||
int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout,
|
||||
EVP_PKEY *key, unsigned char *sigin, int siglen,
|
||||
const char *sig_name, const char *md_name,
|
||||
const char *file)
|
||||
{
|
||||
size_t len;
|
||||
int i;
|
||||
|
||||
for (;;) {
|
||||
i = BIO_read(bp, (char *)buf, BUFSIZE);
|
||||
if (i < 0) {
|
||||
BIO_printf(bio_err, "Read Error in %s\n", file);
|
||||
ERR_print_errors(bio_err);
|
||||
return 1;
|
||||
}
|
||||
if (i == 0)
|
||||
break;
|
||||
}
|
||||
if (sigin) {
|
||||
EVP_MD_CTX *ctx;
|
||||
BIO_get_md_ctx(bp, &ctx);
|
||||
i = EVP_DigestVerifyFinal(ctx, sigin, (unsigned int)siglen);
|
||||
if (i > 0)
|
||||
BIO_printf(out, "Verified OK\n");
|
||||
else if (i == 0) {
|
||||
BIO_printf(out, "Verification Failure\n");
|
||||
return 1;
|
||||
} else {
|
||||
BIO_printf(bio_err, "Error Verifying Data\n");
|
||||
ERR_print_errors(bio_err);
|
||||
return 1;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
if (key) {
|
||||
EVP_MD_CTX *ctx;
|
||||
BIO_get_md_ctx(bp, &ctx);
|
||||
len = BUFSIZE;
|
||||
if (!EVP_DigestSignFinal(ctx, buf, &len)) {
|
||||
BIO_printf(bio_err, "Error Signing Data\n");
|
||||
ERR_print_errors(bio_err);
|
||||
return 1;
|
||||
}
|
||||
} else {
|
||||
len = BIO_gets(bp, (char *)buf, BUFSIZE);
|
||||
if ((int)len < 0) {
|
||||
ERR_print_errors(bio_err);
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
|
||||
if (binout)
|
||||
BIO_write(out, buf, len);
|
||||
else if (sep == 2) {
|
||||
for (i = 0; i < (int)len; i++)
|
||||
BIO_printf(out, "%02x", buf[i]);
|
||||
BIO_printf(out, " *%s\n", file);
|
||||
} else {
|
||||
if (sig_name) {
|
||||
BIO_puts(out, sig_name);
|
||||
if (md_name)
|
||||
BIO_printf(out, "-%s", md_name);
|
||||
BIO_printf(out, "(%s)= ", file);
|
||||
} else if (md_name)
|
||||
BIO_printf(out, "%s(%s)= ", md_name, file);
|
||||
else
|
||||
BIO_printf(out, "(%s)= ", file);
|
||||
for (i = 0; i < (int)len; i++) {
|
||||
if (sep && (i != 0))
|
||||
BIO_printf(out, ":");
|
||||
BIO_printf(out, "%02x", buf[i]);
|
||||
}
|
||||
BIO_printf(out, "\n");
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
-----BEGIN DH PARAMETERS-----
|
||||
MIGHAoGBAP//////////yQ/aoiFowjTExmKLgNwc0SkCTgiKZ8x0Agu+pjsTmyJR
|
||||
Sgh5jjQE3e+VGbPNOkMbMCsKbfJfFDdP4TVtbVHCReSFtXZiXn7G9ExC6aY37WsL
|
||||
/1y29Aa37e44a/taiZ+lrp8kEXxLH+ZJKGZR7OZTgf//////////AgEC
|
||||
-----END DH PARAMETERS-----
|
||||
|
||||
These are the 1024-bit DH parameters from "Internet Key Exchange
|
||||
Protocol Version 2 (IKEv2)": https://tools.ietf.org/html/rfc5996
|
||||
|
||||
See https://tools.ietf.org/html/rfc2412 for how they were generated.
|
||||
@@ -1,14 +0,0 @@
|
||||
-----BEGIN DH PARAMETERS-----
|
||||
MIIBCAKCAQEA///////////JD9qiIWjCNMTGYouA3BzRKQJOCIpnzHQCC76mOxOb
|
||||
IlFKCHmONATd75UZs806QxswKwpt8l8UN0/hNW1tUcJF5IW1dmJefsb0TELppjft
|
||||
awv/XLb0Brft7jhr+1qJn6WunyQRfEsf5kkoZlHs5Fs9wgB8uKFjvwWY2kg2HFXT
|
||||
mmkWP6j9JM9fg2VdI9yjrZYcYvNWIIVSu57VKQdwlpZtZww1Tkq8mATxdGwIyhgh
|
||||
fDKQXkYuNs474553LBgOhgObJ4Oi7Aeij7XFXfBvTFLJ3ivL9pVYFxg5lUl86pVq
|
||||
5RXSJhiY+gUQFXKOWoqsqmj//////////wIBAg==
|
||||
-----END DH PARAMETERS-----
|
||||
|
||||
These are the 2048-bit DH parameters from "More Modular Exponential
|
||||
(MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)":
|
||||
https://tools.ietf.org/html/rfc3526
|
||||
|
||||
See https://tools.ietf.org/html/rfc2412 for how they were generated.
|
||||
@@ -1,19 +0,0 @@
|
||||
-----BEGIN DH PARAMETERS-----
|
||||
MIICCAKCAgEA///////////JD9qiIWjCNMTGYouA3BzRKQJOCIpnzHQCC76mOxOb
|
||||
IlFKCHmONATd75UZs806QxswKwpt8l8UN0/hNW1tUcJF5IW1dmJefsb0TELppjft
|
||||
awv/XLb0Brft7jhr+1qJn6WunyQRfEsf5kkoZlHs5Fs9wgB8uKFjvwWY2kg2HFXT
|
||||
mmkWP6j9JM9fg2VdI9yjrZYcYvNWIIVSu57VKQdwlpZtZww1Tkq8mATxdGwIyhgh
|
||||
fDKQXkYuNs474553LBgOhgObJ4Oi7Aeij7XFXfBvTFLJ3ivL9pVYFxg5lUl86pVq
|
||||
5RXSJhiY+gUQFXKOWoqqxC2tMxcNBFB6M6hVIavfHLpk7PuFBFjb7wqK6nFXXQYM
|
||||
fbOXD4Wm4eTHq/WujNsJM9cejJTgSiVhnc7j0iYa0u5r8S/6BtmKCGTYdgJzPshq
|
||||
ZFIfKxgXeyAMu+EXV3phXWx3CYjAutlG4gjiT6B05asxQ9tb/OD9EI5LgtEgqSEI
|
||||
ARpyPBKnh+bXiHGaEL26WyaZwycYavTiPBqUaDS2FQvaJYPpyirUTOjbu8LbBN6O
|
||||
+S6O/BQfvsqmKHxZR05rwF2ZspZPoJDDoiM7oYZRW+ftH2EpcM7i16+4G912IXBI
|
||||
HNAGkSfVsFqpk7TqmI2P3cGG/7fckKbAj030Nck0BjGZ//////////8CAQI=
|
||||
-----END DH PARAMETERS-----
|
||||
|
||||
These are the 4096-bit DH parameters from "More Modular Exponential
|
||||
(MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)":
|
||||
https://tools.ietf.org/html/rfc3526
|
||||
|
||||
See https://tools.ietf.org/html/rfc2412 for how they were generated.
|
||||
393
apps/dhparam.c
393
apps/dhparam.c
@@ -1,393 +0,0 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include <openssl/opensslconf.h>
|
||||
#ifdef OPENSSL_NO_DH
|
||||
NON_EMPTY_TRANSLATION_UNIT
|
||||
#else
|
||||
|
||||
# include <stdio.h>
|
||||
# include <stdlib.h>
|
||||
# include <time.h>
|
||||
# include <string.h>
|
||||
# include "apps.h"
|
||||
# include <openssl/bio.h>
|
||||
# include <openssl/err.h>
|
||||
# include <openssl/bn.h>
|
||||
# include <openssl/dh.h>
|
||||
# include <openssl/x509.h>
|
||||
# include <openssl/pem.h>
|
||||
|
||||
# ifndef OPENSSL_NO_DSA
|
||||
# include <openssl/dsa.h>
|
||||
# endif
|
||||
|
||||
# define DEFBITS 2048
|
||||
|
||||
static int dh_cb(int p, int n, BN_GENCB *cb);
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT,
|
||||
OPT_ENGINE, OPT_CHECK, OPT_TEXT, OPT_NOOUT,
|
||||
OPT_RAND, OPT_DSAPARAM, OPT_C, OPT_2, OPT_5
|
||||
} OPTION_CHOICE;
|
||||
|
||||
OPTIONS dhparam_options[] = {
|
||||
{OPT_HELP_STR, 1, '-', "Usage: %s [flags] [numbits]\n"},
|
||||
{OPT_HELP_STR, 1, '-', "Valid options are:\n"},
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"in", OPT_IN, '<', "Input file"},
|
||||
{"inform", OPT_INFORM, 'F', "Input format, DER or PEM"},
|
||||
{"outform", OPT_OUTFORM, 'F', "Output format, DER or PEM"},
|
||||
{"out", OPT_OUT, '>', "Output file"},
|
||||
{"check", OPT_CHECK, '-', "Check the DH parameters"},
|
||||
{"text", OPT_TEXT, '-', "Print a text form of the DH parameters"},
|
||||
{"noout", OPT_NOOUT, '-', "Don't output any DH parameters"},
|
||||
{"rand", OPT_RAND, 's',
|
||||
"Load the file(s) into the random number generator"},
|
||||
{"C", OPT_C, '-', "Print C code"},
|
||||
{"2", OPT_2, '-', "Generate parameters using 2 as the generator value"},
|
||||
{"5", OPT_5, '-', "Generate parameters using 5 as the generator value"},
|
||||
# ifndef OPENSSL_NO_DSA
|
||||
{"dsaparam", OPT_DSAPARAM, '-',
|
||||
"Read or generate DSA parameters, convert to DH"},
|
||||
# endif
|
||||
# ifndef OPENSSL_NO_ENGINE
|
||||
{"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
|
||||
# endif
|
||||
{NULL}
|
||||
};
|
||||
|
||||
int dhparam_main(int argc, char **argv)
|
||||
{
|
||||
BIO *in = NULL, *out = NULL;
|
||||
DH *dh = NULL;
|
||||
char *infile = NULL, *outfile = NULL, *prog, *inrand = NULL;
|
||||
ENGINE *e = NULL;
|
||||
#ifndef OPENSSL_NO_DSA
|
||||
int dsaparam = 0;
|
||||
#endif
|
||||
int i, text = 0, C = 0, ret = 1, num = 0, g = 0;
|
||||
int informat = FORMAT_PEM, outformat = FORMAT_PEM, check = 0, noout = 0;
|
||||
OPTION_CHOICE o;
|
||||
|
||||
prog = opt_init(argc, argv, dhparam_options);
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
switch (o) {
|
||||
case OPT_EOF:
|
||||
case OPT_ERR:
|
||||
opthelp:
|
||||
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
||||
goto end;
|
||||
case OPT_HELP:
|
||||
opt_help(dhparam_options);
|
||||
ret = 0;
|
||||
goto end;
|
||||
case OPT_INFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &informat))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_OUTFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &outformat))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_IN:
|
||||
infile = opt_arg();
|
||||
break;
|
||||
case OPT_OUT:
|
||||
outfile = opt_arg();
|
||||
break;
|
||||
case OPT_ENGINE:
|
||||
e = setup_engine(opt_arg(), 0);
|
||||
break;
|
||||
case OPT_CHECK:
|
||||
check = 1;
|
||||
break;
|
||||
case OPT_TEXT:
|
||||
text = 1;
|
||||
break;
|
||||
case OPT_DSAPARAM:
|
||||
#ifndef OPENSSL_NO_DSA
|
||||
dsaparam = 1;
|
||||
#endif
|
||||
break;
|
||||
case OPT_C:
|
||||
C = 1;
|
||||
break;
|
||||
case OPT_2:
|
||||
g = 2;
|
||||
break;
|
||||
case OPT_5:
|
||||
g = 5;
|
||||
break;
|
||||
case OPT_NOOUT:
|
||||
noout = 1;
|
||||
break;
|
||||
case OPT_RAND:
|
||||
inrand = opt_arg();
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
argv = opt_rest();
|
||||
|
||||
if (argv[0] && (!opt_int(argv[0], &num) || num <= 0))
|
||||
goto end;
|
||||
|
||||
if (g && !num)
|
||||
num = DEFBITS;
|
||||
|
||||
# ifndef OPENSSL_NO_DSA
|
||||
if (dsaparam && g) {
|
||||
BIO_printf(bio_err,
|
||||
"generator may not be chosen for DSA parameters\n");
|
||||
goto end;
|
||||
}
|
||||
# endif
|
||||
|
||||
out = bio_open_default(outfile, 'w', outformat);
|
||||
if (out == NULL)
|
||||
goto end;
|
||||
|
||||
/* DH parameters */
|
||||
if (num && !g)
|
||||
g = 2;
|
||||
|
||||
if (num) {
|
||||
|
||||
BN_GENCB *cb;
|
||||
cb = BN_GENCB_new();
|
||||
if (cb == NULL) {
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
|
||||
BN_GENCB_set(cb, dh_cb, bio_err);
|
||||
if (!app_RAND_load_file(NULL, 1) && inrand == NULL) {
|
||||
BIO_printf(bio_err,
|
||||
"warning, not much extra random data, consider using the -rand option\n");
|
||||
}
|
||||
if (inrand != NULL)
|
||||
BIO_printf(bio_err, "%ld semi-random bytes loaded\n",
|
||||
app_RAND_load_files(inrand));
|
||||
|
||||
# ifndef OPENSSL_NO_DSA
|
||||
if (dsaparam) {
|
||||
DSA *dsa = DSA_new();
|
||||
|
||||
BIO_printf(bio_err,
|
||||
"Generating DSA parameters, %d bit long prime\n", num);
|
||||
if (dsa == NULL
|
||||
|| !DSA_generate_parameters_ex(dsa, num, NULL, 0, NULL, NULL,
|
||||
cb)) {
|
||||
DSA_free(dsa);
|
||||
BN_GENCB_free(cb);
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
|
||||
dh = DSA_dup_DH(dsa);
|
||||
DSA_free(dsa);
|
||||
if (dh == NULL) {
|
||||
BN_GENCB_free(cb);
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
} else
|
||||
# endif
|
||||
{
|
||||
dh = DH_new();
|
||||
BIO_printf(bio_err,
|
||||
"Generating DH parameters, %d bit long safe prime, generator %d\n",
|
||||
num, g);
|
||||
BIO_printf(bio_err, "This is going to take a long time\n");
|
||||
if (dh == NULL || !DH_generate_parameters_ex(dh, num, g, cb)) {
|
||||
BN_GENCB_free(cb);
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
BN_GENCB_free(cb);
|
||||
app_RAND_write_file(NULL);
|
||||
} else {
|
||||
|
||||
in = bio_open_default(infile, 'r', informat);
|
||||
if (in == NULL)
|
||||
goto end;
|
||||
|
||||
# ifndef OPENSSL_NO_DSA
|
||||
if (dsaparam) {
|
||||
DSA *dsa;
|
||||
|
||||
if (informat == FORMAT_ASN1)
|
||||
dsa = d2i_DSAparams_bio(in, NULL);
|
||||
else /* informat == FORMAT_PEM */
|
||||
dsa = PEM_read_bio_DSAparams(in, NULL, NULL, NULL);
|
||||
|
||||
if (dsa == NULL) {
|
||||
BIO_printf(bio_err, "unable to load DSA parameters\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
|
||||
dh = DSA_dup_DH(dsa);
|
||||
DSA_free(dsa);
|
||||
if (dh == NULL) {
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
} else
|
||||
# endif
|
||||
{
|
||||
if (informat == FORMAT_ASN1) {
|
||||
/*
|
||||
* We have no PEM header to determine what type of DH params it
|
||||
* is. We'll just try both.
|
||||
*/
|
||||
dh = d2i_DHparams_bio(in, NULL);
|
||||
/* BIO_reset() returns 0 for success for file BIOs only!!! */
|
||||
if (dh == NULL && BIO_reset(in) == 0)
|
||||
dh = d2i_DHxparams_bio(in, NULL);
|
||||
} else {
|
||||
/* informat == FORMAT_PEM */
|
||||
dh = PEM_read_bio_DHparams(in, NULL, NULL, NULL);
|
||||
}
|
||||
|
||||
if (dh == NULL) {
|
||||
BIO_printf(bio_err, "unable to load DH parameters\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
/* dh != NULL */
|
||||
}
|
||||
|
||||
if (text) {
|
||||
DHparams_print(out, dh);
|
||||
}
|
||||
|
||||
if (check) {
|
||||
if (!DH_check(dh, &i)) {
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
if (i & DH_CHECK_P_NOT_PRIME)
|
||||
BIO_printf(bio_err, "WARNING: p value is not prime\n");
|
||||
if (i & DH_CHECK_P_NOT_SAFE_PRIME)
|
||||
BIO_printf(bio_err, "WARNING: p value is not a safe prime\n");
|
||||
if (i & DH_CHECK_Q_NOT_PRIME)
|
||||
BIO_printf(bio_err, "WARNING: q value is not a prime\n");
|
||||
if (i & DH_CHECK_INVALID_Q_VALUE)
|
||||
BIO_printf(bio_err, "WARNING: q value is invalid\n");
|
||||
if (i & DH_CHECK_INVALID_J_VALUE)
|
||||
BIO_printf(bio_err, "WARNING: j value is invalid\n");
|
||||
if (i & DH_UNABLE_TO_CHECK_GENERATOR)
|
||||
BIO_printf(bio_err,
|
||||
"WARNING: unable to check the generator value\n");
|
||||
if (i & DH_NOT_SUITABLE_GENERATOR)
|
||||
BIO_printf(bio_err, "WARNING: the g value is not a generator\n");
|
||||
if (i == 0)
|
||||
BIO_printf(bio_err, "DH parameters appear to be ok.\n");
|
||||
if (num != 0 && i != 0) {
|
||||
/*
|
||||
* We have generated parameters but DH_check() indicates they are
|
||||
* invalid! This should never happen!
|
||||
*/
|
||||
BIO_printf(bio_err, "ERROR: Invalid parameters generated\n");
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
if (C) {
|
||||
unsigned char *data;
|
||||
int len, bits;
|
||||
const BIGNUM *pbn, *gbn;
|
||||
|
||||
len = DH_size(dh);
|
||||
bits = DH_bits(dh);
|
||||
DH_get0_pqg(dh, &pbn, NULL, &gbn);
|
||||
data = app_malloc(len, "print a BN");
|
||||
BIO_printf(out, "#ifndef HEADER_DH_H\n"
|
||||
"# include <openssl/dh.h>\n"
|
||||
"#endif\n"
|
||||
"\n");
|
||||
BIO_printf(out, "DH *get_dh%d()\n{\n", bits);
|
||||
print_bignum_var(out, pbn, "dhp", bits, data);
|
||||
print_bignum_var(out, gbn, "dhg", bits, data);
|
||||
BIO_printf(out, " DH *dh = DH_new();\n"
|
||||
" BIGNUM *dhp_bn, *dhg_bn;\n"
|
||||
"\n"
|
||||
" if (dh == NULL)\n"
|
||||
" return NULL;\n");
|
||||
BIO_printf(out, " dhp_bn = BN_bin2bn(dhp_%d, sizeof(dhp_%d), NULL);\n",
|
||||
bits, bits);
|
||||
BIO_printf(out, " dhg_bn = BN_bin2bn(dhg_%d, sizeof(dhg_%d), NULL);\n",
|
||||
bits, bits);
|
||||
BIO_printf(out, " if (dhp_bn == NULL || dhg_bn == NULL\n"
|
||||
" || !DH_set0_pqg(dh, dhp_bn, NULL, dhg_bn)) {\n"
|
||||
" DH_free(dh);\n"
|
||||
" BN_free(dhp_bn);\n"
|
||||
" BN_free(dhg_bn);\n"
|
||||
" return NULL;\n"
|
||||
" }\n");
|
||||
if (DH_get_length(dh) > 0)
|
||||
BIO_printf(out,
|
||||
" if (!DH_set_length(dh, %ld)) {\n"
|
||||
" DH_free(dh);\n"
|
||||
" }\n", DH_get_length(dh));
|
||||
BIO_printf(out, " return dh;\n}\n");
|
||||
OPENSSL_free(data);
|
||||
}
|
||||
|
||||
if (!noout) {
|
||||
const BIGNUM *q;
|
||||
DH_get0_pqg(dh, NULL, &q, NULL);
|
||||
if (outformat == FORMAT_ASN1) {
|
||||
if (q != NULL)
|
||||
i = i2d_DHxparams_bio(out, dh);
|
||||
else
|
||||
i = i2d_DHparams_bio(out, dh);
|
||||
} else if (q != NULL)
|
||||
i = PEM_write_bio_DHxparams(out, dh);
|
||||
else
|
||||
i = PEM_write_bio_DHparams(out, dh);
|
||||
if (!i) {
|
||||
BIO_printf(bio_err, "unable to write DH parameters\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
ret = 0;
|
||||
end:
|
||||
BIO_free(in);
|
||||
BIO_free_all(out);
|
||||
DH_free(dh);
|
||||
release_engine(e);
|
||||
return (ret);
|
||||
}
|
||||
|
||||
static int dh_cb(int p, int n, BN_GENCB *cb)
|
||||
{
|
||||
char c = '*';
|
||||
|
||||
if (p == 0)
|
||||
c = '.';
|
||||
if (p == 1)
|
||||
c = '+';
|
||||
if (p == 2)
|
||||
c = '*';
|
||||
if (p == 3)
|
||||
c = '\n';
|
||||
BIO_write(BN_GENCB_get_arg(cb), &c, 1);
|
||||
(void)BIO_flush(BN_GENCB_get_arg(cb));
|
||||
return 1;
|
||||
}
|
||||
#endif
|
||||
@@ -1,47 +0,0 @@
|
||||
-----BEGIN DSA PRIVATE KEY-----
|
||||
MIIBugIBAAKBgQCnP26Fv0FqKX3wn0cZMJCaCR3aajMexT2GlrMV4FMuj+BZgnOQ
|
||||
PnUxmUd6UvuF5NmmezibaIqEm4fGHrV+hktTW1nPcWUZiG7OZq5riDb77Cjcwtel
|
||||
u+UsOSZL2ppwGJU3lRBWI/YV7boEXt45T/23Qx+1pGVvzYAR5HCVW1DNSQIVAPcH
|
||||
Me36bAYD1YWKHKycZedQZmVvAoGATd9MA6aRivUZb1BGJZnlaG8w42nh5bNdmLso
|
||||
hkj83pkEP1+IDJxzJA0gXbkqmj8YlifkYofBe3RiU/xhJ6h6kQmdtvFNnFQPWAbu
|
||||
SXQHzlV+I84W9srcWmEBfslxtU323DQph2j2XiCTs9v15AlsQReVkusBtXOlan7Y
|
||||
Mu0OArgCgYAapll6iqz9XrZFlk2GCVcB+KihxWnH7IuHvSLw9YUrJahcBHmbpvt4
|
||||
94lF4gC5w3WPM+vXJofbusk4GoQEEsQNMDaah4m49uUqAylOVFJJJXuirVJ+o+0T
|
||||
tOFDITEAl+YZZariXOD7tdOSOl9RLMPC6+daHKS9e68u3enxhqnDGQIUB78dhW77
|
||||
J6zsFbSEHaQGUmfSeoM=
|
||||
-----END DSA PRIVATE KEY-----
|
||||
-----BEGIN CERTIFICATE REQUEST-----
|
||||
MIICVjCCAhMCAQAwUjELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx
|
||||
ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDELMAkGA1UEAwwCQ0Ew
|
||||
ggG2MIIBKwYHKoZIzjgEATCCAR4CgYEApz9uhb9Bail98J9HGTCQmgkd2mozHsU9
|
||||
hpazFeBTLo/gWYJzkD51MZlHelL7heTZpns4m2iKhJuHxh61foZLU1tZz3FlGYhu
|
||||
zmaua4g2++wo3MLXpbvlLDkmS9qacBiVN5UQViP2Fe26BF7eOU/9t0MftaRlb82A
|
||||
EeRwlVtQzUkCFQD3BzHt+mwGA9WFihysnGXnUGZlbwKBgE3fTAOmkYr1GW9QRiWZ
|
||||
5WhvMONp4eWzXZi7KIZI/N6ZBD9fiAyccyQNIF25Kpo/GJYn5GKHwXt0YlP8YSeo
|
||||
epEJnbbxTZxUD1gG7kl0B85VfiPOFvbK3FphAX7JcbVN9tw0KYdo9l4gk7Pb9eQJ
|
||||
bEEXlZLrAbVzpWp+2DLtDgK4A4GEAAKBgBqmWXqKrP1etkWWTYYJVwH4qKHFacfs
|
||||
i4e9IvD1hSslqFwEeZum+3j3iUXiALnDdY8z69cmh9u6yTgahAQSxA0wNpqHibj2
|
||||
5SoDKU5UUkkle6KtUn6j7RO04UMhMQCX5hllquJc4Pu105I6X1Esw8Lr51ocpL17
|
||||
ry7d6fGGqcMZoAAwCwYJYIZIAWUDBAMCAzAAMC0CFCp7rUwGJNtxK6Aqo6k6US+S
|
||||
KP8sAhUAyfSi8Zs3QAvkJoFG0IMRaq8M03I=
|
||||
-----END CERTIFICATE REQUEST-----
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDMDCCAuygAwIBAgIBAjALBglghkgBZQMEAwIwUzELMAkGA1UEBhMCQVUxEzAR
|
||||
BgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5
|
||||
IEx0ZDEMMAoGA1UEAwwDUENBMCAXDTE2MDExMzIxNDE0OVoYDzMwMTUwNTE2MjE0
|
||||
MTQ5WjBSMQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UE
|
||||
CgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMQswCQYDVQQDDAJDQTCCAbYwggEr
|
||||
BgcqhkjOOAQBMIIBHgKBgQCnP26Fv0FqKX3wn0cZMJCaCR3aajMexT2GlrMV4FMu
|
||||
j+BZgnOQPnUxmUd6UvuF5NmmezibaIqEm4fGHrV+hktTW1nPcWUZiG7OZq5riDb7
|
||||
7Cjcwtelu+UsOSZL2ppwGJU3lRBWI/YV7boEXt45T/23Qx+1pGVvzYAR5HCVW1DN
|
||||
SQIVAPcHMe36bAYD1YWKHKycZedQZmVvAoGATd9MA6aRivUZb1BGJZnlaG8w42nh
|
||||
5bNdmLsohkj83pkEP1+IDJxzJA0gXbkqmj8YlifkYofBe3RiU/xhJ6h6kQmdtvFN
|
||||
nFQPWAbuSXQHzlV+I84W9srcWmEBfslxtU323DQph2j2XiCTs9v15AlsQReVkusB
|
||||
tXOlan7YMu0OArgDgYQAAoGAGqZZeoqs/V62RZZNhglXAfioocVpx+yLh70i8PWF
|
||||
KyWoXAR5m6b7ePeJReIAucN1jzPr1yaH27rJOBqEBBLEDTA2moeJuPblKgMpTlRS
|
||||
SSV7oq1SfqPtE7ThQyExAJfmGWWq4lzg+7XTkjpfUSzDwuvnWhykvXuvLt3p8Yap
|
||||
wxmjUDBOMB0GA1UdDgQWBBTMZcORcBEVlqO/CD4pf4V6N1NM1zAfBgNVHSMEGDAW
|
||||
gBTGjwJ33uvjSa20RNrMKWoGptOLdDAMBgNVHRMEBTADAQH/MAsGCWCGSAFlAwQD
|
||||
AgMxADAuAhUA4V6MrHufG8R79E+AtVO02olPxK8CFQDkZyo/TWpavsUBRDJbCeD9
|
||||
jgjIkA==
|
||||
-----END CERTIFICATE-----
|
||||
@@ -1,47 +0,0 @@
|
||||
-----BEGIN DSA PRIVATE KEY-----
|
||||
MIIBvAIBAAKBgQCnP26Fv0FqKX3wn0cZMJCaCR3aajMexT2GlrMV4FMuj+BZgnOQ
|
||||
PnUxmUd6UvuF5NmmezibaIqEm4fGHrV+hktTW1nPcWUZiG7OZq5riDb77Cjcwtel
|
||||
u+UsOSZL2ppwGJU3lRBWI/YV7boEXt45T/23Qx+1pGVvzYAR5HCVW1DNSQIVAPcH
|
||||
Me36bAYD1YWKHKycZedQZmVvAoGATd9MA6aRivUZb1BGJZnlaG8w42nh5bNdmLso
|
||||
hkj83pkEP1+IDJxzJA0gXbkqmj8YlifkYofBe3RiU/xhJ6h6kQmdtvFNnFQPWAbu
|
||||
SXQHzlV+I84W9srcWmEBfslxtU323DQph2j2XiCTs9v15AlsQReVkusBtXOlan7Y
|
||||
Mu0OArgCgYEApu25HkB1b4gKMIV7aLGNSIknMzYgrB7o1kQxeDf34dDVRM9OZ8tk
|
||||
umz6tl+iUcNe5EoxdsYV1IXSddjOi08LOLsZq7AQlNnKvbtlmMDULpqkZJD0bO7A
|
||||
29nisJfKy1URqABLw5DgfcPh1ZLXtmDfUgJvmjgTmvTPT2j9TPjq7RUCFQDNvrBz
|
||||
6TicfImU7UFRn9h00j0lJQ==
|
||||
-----END DSA PRIVATE KEY-----
|
||||
-----BEGIN CERTIFICATE REQUEST-----
|
||||
MIICWDCCAhUCAQAwUzELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx
|
||||
ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEMMAoGA1UEAwwDUENB
|
||||
MIIBtzCCASsGByqGSM44BAEwggEeAoGBAKc/boW/QWopffCfRxkwkJoJHdpqMx7F
|
||||
PYaWsxXgUy6P4FmCc5A+dTGZR3pS+4Xk2aZ7OJtoioSbh8YetX6GS1NbWc9xZRmI
|
||||
bs5mrmuINvvsKNzC16W75Sw5JkvamnAYlTeVEFYj9hXtugRe3jlP/bdDH7WkZW/N
|
||||
gBHkcJVbUM1JAhUA9wcx7fpsBgPVhYocrJxl51BmZW8CgYBN30wDppGK9RlvUEYl
|
||||
meVobzDjaeHls12YuyiGSPzemQQ/X4gMnHMkDSBduSqaPxiWJ+Rih8F7dGJT/GEn
|
||||
qHqRCZ228U2cVA9YBu5JdAfOVX4jzhb2ytxaYQF+yXG1TfbcNCmHaPZeIJOz2/Xk
|
||||
CWxBF5WS6wG1c6Vqftgy7Q4CuAOBhQACgYEApu25HkB1b4gKMIV7aLGNSIknMzYg
|
||||
rB7o1kQxeDf34dDVRM9OZ8tkumz6tl+iUcNe5EoxdsYV1IXSddjOi08LOLsZq7AQ
|
||||
lNnKvbtlmMDULpqkZJD0bO7A29nisJfKy1URqABLw5DgfcPh1ZLXtmDfUgJvmjgT
|
||||
mvTPT2j9TPjq7RWgADALBglghkgBZQMEAwIDMAAwLQIVAPA6/jxCT1D2HgzE4iZR
|
||||
AEup/C7YAhRPLTQvQnAiS5FRrA+8SwBLvDAsaw==
|
||||
-----END CERTIFICATE REQUEST-----
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDMDCCAu6gAwIBAgIBATALBglghkgBZQMEAwIwUzELMAkGA1UEBhMCQVUxEzAR
|
||||
BgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5
|
||||
IEx0ZDEMMAoGA1UEAwwDUENBMCAXDTE2MDExMzIxNDE0OVoYDzMwMTUwNTE2MjE0
|
||||
MTQ5WjBTMQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UE
|
||||
CgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMQwwCgYDVQQDDANQQ0EwggG3MIIB
|
||||
KwYHKoZIzjgEATCCAR4CgYEApz9uhb9Bail98J9HGTCQmgkd2mozHsU9hpazFeBT
|
||||
Lo/gWYJzkD51MZlHelL7heTZpns4m2iKhJuHxh61foZLU1tZz3FlGYhuzmaua4g2
|
||||
++wo3MLXpbvlLDkmS9qacBiVN5UQViP2Fe26BF7eOU/9t0MftaRlb82AEeRwlVtQ
|
||||
zUkCFQD3BzHt+mwGA9WFihysnGXnUGZlbwKBgE3fTAOmkYr1GW9QRiWZ5WhvMONp
|
||||
4eWzXZi7KIZI/N6ZBD9fiAyccyQNIF25Kpo/GJYn5GKHwXt0YlP8YSeoepEJnbbx
|
||||
TZxUD1gG7kl0B85VfiPOFvbK3FphAX7JcbVN9tw0KYdo9l4gk7Pb9eQJbEEXlZLr
|
||||
AbVzpWp+2DLtDgK4A4GFAAKBgQCm7bkeQHVviAowhXtosY1IiSczNiCsHujWRDF4
|
||||
N/fh0NVEz05ny2S6bPq2X6JRw17kSjF2xhXUhdJ12M6LTws4uxmrsBCU2cq9u2WY
|
||||
wNQumqRkkPRs7sDb2eKwl8rLVRGoAEvDkOB9w+HVkte2YN9SAm+aOBOa9M9PaP1M
|
||||
+OrtFaNQME4wHQYDVR0OBBYEFMaPAnfe6+NJrbRE2swpagam04t0MB8GA1UdIwQY
|
||||
MBaAFMaPAnfe6+NJrbRE2swpagam04t0MAwGA1UdEwQFMAMBAf8wCwYJYIZIAWUD
|
||||
BAMCAy8AMCwCFFhdz4fzQo9BBF20U1CHldYTi/D7AhQydDnDMj21y+U1UhDZJrvh
|
||||
lnt88g==
|
||||
-----END CERTIFICATE-----
|
||||
265
apps/dsa.c
265
apps/dsa.c
@@ -1,265 +0,0 @@
|
||||
/*
|
||||
* Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include <openssl/opensslconf.h>
|
||||
#ifdef OPENSSL_NO_DSA
|
||||
NON_EMPTY_TRANSLATION_UNIT
|
||||
#else
|
||||
|
||||
# include <stdio.h>
|
||||
# include <stdlib.h>
|
||||
# include <string.h>
|
||||
# include <time.h>
|
||||
# include "apps.h"
|
||||
# include <openssl/bio.h>
|
||||
# include <openssl/err.h>
|
||||
# include <openssl/dsa.h>
|
||||
# include <openssl/evp.h>
|
||||
# include <openssl/x509.h>
|
||||
# include <openssl/pem.h>
|
||||
# include <openssl/bn.h>
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_ENGINE,
|
||||
/* Do not change the order here; see case statements below */
|
||||
OPT_PVK_NONE, OPT_PVK_WEAK, OPT_PVK_STRONG,
|
||||
OPT_NOOUT, OPT_TEXT, OPT_MODULUS, OPT_PUBIN,
|
||||
OPT_PUBOUT, OPT_CIPHER, OPT_PASSIN, OPT_PASSOUT
|
||||
} OPTION_CHOICE;
|
||||
|
||||
OPTIONS dsa_options[] = {
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"inform", OPT_INFORM, 'f', "Input format, DER PEM PVK"},
|
||||
{"outform", OPT_OUTFORM, 'f', "Output format, DER PEM PVK"},
|
||||
{"in", OPT_IN, 's', "Input key"},
|
||||
{"out", OPT_OUT, '>', "Output file"},
|
||||
{"noout", OPT_NOOUT, '-', "Don't print key out"},
|
||||
{"text", OPT_TEXT, '-', "Print the key in text"},
|
||||
{"modulus", OPT_MODULUS, '-', "Print the DSA public value"},
|
||||
{"pubin", OPT_PUBIN, '-', "Expect a public key in input file"},
|
||||
{"pubout", OPT_PUBOUT, '-', "Output public key, not private"},
|
||||
{"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
|
||||
{"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
|
||||
{"", OPT_CIPHER, '-', "Any supported cipher"},
|
||||
# ifndef OPENSSL_NO_RC4
|
||||
{"pvk-strong", OPT_PVK_STRONG, '-', "Enable 'Strong' PVK encoding level (default)"},
|
||||
{"pvk-weak", OPT_PVK_WEAK, '-', "Enable 'Weak' PVK encoding level"},
|
||||
{"pvk-none", OPT_PVK_NONE, '-', "Don't enforce PVK encoding"},
|
||||
# endif
|
||||
# ifndef OPENSSL_NO_ENGINE
|
||||
{"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
|
||||
# endif
|
||||
{NULL}
|
||||
};
|
||||
|
||||
int dsa_main(int argc, char **argv)
|
||||
{
|
||||
BIO *out = NULL;
|
||||
DSA *dsa = NULL;
|
||||
ENGINE *e = NULL;
|
||||
const EVP_CIPHER *enc = NULL;
|
||||
char *infile = NULL, *outfile = NULL, *prog;
|
||||
char *passin = NULL, *passout = NULL, *passinarg = NULL, *passoutarg = NULL;
|
||||
OPTION_CHOICE o;
|
||||
int informat = FORMAT_PEM, outformat = FORMAT_PEM, text = 0, noout = 0;
|
||||
int i, modulus = 0, pubin = 0, pubout = 0, ret = 1;
|
||||
# ifndef OPENSSL_NO_RC4
|
||||
int pvk_encr = 2;
|
||||
# endif
|
||||
int private = 0;
|
||||
|
||||
prog = opt_init(argc, argv, dsa_options);
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
switch (o) {
|
||||
case OPT_EOF:
|
||||
case OPT_ERR:
|
||||
opthelp:
|
||||
ret = 0;
|
||||
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
||||
goto end;
|
||||
case OPT_HELP:
|
||||
opt_help(dsa_options);
|
||||
ret = 0;
|
||||
goto end;
|
||||
case OPT_INFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_ANY, &informat))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_IN:
|
||||
infile = opt_arg();
|
||||
break;
|
||||
case OPT_OUTFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_ANY, &outformat))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_OUT:
|
||||
outfile = opt_arg();
|
||||
break;
|
||||
case OPT_ENGINE:
|
||||
e = setup_engine(opt_arg(), 0);
|
||||
break;
|
||||
case OPT_PASSIN:
|
||||
passinarg = opt_arg();
|
||||
break;
|
||||
case OPT_PASSOUT:
|
||||
passoutarg = opt_arg();
|
||||
break;
|
||||
case OPT_PVK_STRONG: /* pvk_encr:= 2 */
|
||||
case OPT_PVK_WEAK: /* pvk_encr:= 1 */
|
||||
case OPT_PVK_NONE: /* pvk_encr:= 0 */
|
||||
#ifndef OPENSSL_NO_RC4
|
||||
pvk_encr = (o - OPT_PVK_NONE);
|
||||
#endif
|
||||
break;
|
||||
case OPT_NOOUT:
|
||||
noout = 1;
|
||||
break;
|
||||
case OPT_TEXT:
|
||||
text = 1;
|
||||
break;
|
||||
case OPT_MODULUS:
|
||||
modulus = 1;
|
||||
break;
|
||||
case OPT_PUBIN:
|
||||
pubin = 1;
|
||||
break;
|
||||
case OPT_PUBOUT:
|
||||
pubout = 1;
|
||||
break;
|
||||
case OPT_CIPHER:
|
||||
if (!opt_cipher(opt_unknown(), &enc))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
if (argc != 0)
|
||||
goto opthelp;
|
||||
|
||||
private = pubin || pubout ? 0 : 1;
|
||||
if (text && !pubin)
|
||||
private = 1;
|
||||
|
||||
if (!app_passwd(passinarg, passoutarg, &passin, &passout)) {
|
||||
BIO_printf(bio_err, "Error getting passwords\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
BIO_printf(bio_err, "read DSA key\n");
|
||||
{
|
||||
EVP_PKEY *pkey;
|
||||
|
||||
if (pubin)
|
||||
pkey = load_pubkey(infile, informat, 1, passin, e, "Public Key");
|
||||
else
|
||||
pkey = load_key(infile, informat, 1, passin, e, "Private Key");
|
||||
|
||||
if (pkey) {
|
||||
dsa = EVP_PKEY_get1_DSA(pkey);
|
||||
EVP_PKEY_free(pkey);
|
||||
}
|
||||
}
|
||||
if (dsa == NULL) {
|
||||
BIO_printf(bio_err, "unable to load Key\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
|
||||
out = bio_open_owner(outfile, outformat, private);
|
||||
if (out == NULL)
|
||||
goto end;
|
||||
|
||||
if (text) {
|
||||
assert(pubin || private);
|
||||
if (!DSA_print(out, dsa, 0)) {
|
||||
perror(outfile);
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
if (modulus) {
|
||||
const BIGNUM *pub_key = NULL;
|
||||
DSA_get0_key(dsa, &pub_key, NULL);
|
||||
BIO_printf(out, "Public Key=");
|
||||
BN_print(out, pub_key);
|
||||
BIO_printf(out, "\n");
|
||||
}
|
||||
|
||||
if (noout) {
|
||||
ret = 0;
|
||||
goto end;
|
||||
}
|
||||
BIO_printf(bio_err, "writing DSA key\n");
|
||||
if (outformat == FORMAT_ASN1) {
|
||||
if (pubin || pubout)
|
||||
i = i2d_DSA_PUBKEY_bio(out, dsa);
|
||||
else {
|
||||
assert(private);
|
||||
i = i2d_DSAPrivateKey_bio(out, dsa);
|
||||
}
|
||||
} else if (outformat == FORMAT_PEM) {
|
||||
if (pubin || pubout)
|
||||
i = PEM_write_bio_DSA_PUBKEY(out, dsa);
|
||||
else {
|
||||
assert(private);
|
||||
i = PEM_write_bio_DSAPrivateKey(out, dsa, enc,
|
||||
NULL, 0, NULL, passout);
|
||||
}
|
||||
# ifndef OPENSSL_NO_RSA
|
||||
} else if (outformat == FORMAT_MSBLOB || outformat == FORMAT_PVK) {
|
||||
EVP_PKEY *pk;
|
||||
pk = EVP_PKEY_new();
|
||||
if (pk == NULL)
|
||||
goto end;
|
||||
|
||||
EVP_PKEY_set1_DSA(pk, dsa);
|
||||
if (outformat == FORMAT_PVK) {
|
||||
if (pubin) {
|
||||
BIO_printf(bio_err, "PVK form impossible with public key input\n");
|
||||
EVP_PKEY_free(pk);
|
||||
goto end;
|
||||
}
|
||||
assert(private);
|
||||
# ifdef OPENSSL_NO_RC4
|
||||
BIO_printf(bio_err, "PVK format not supported\n");
|
||||
EVP_PKEY_free(pk);
|
||||
goto end;
|
||||
# else
|
||||
i = i2b_PVK_bio(out, pk, pvk_encr, 0, passout);
|
||||
# endif
|
||||
}
|
||||
else if (pubin || pubout)
|
||||
i = i2b_PublicKey_bio(out, pk);
|
||||
else {
|
||||
assert(private);
|
||||
i = i2b_PrivateKey_bio(out, pk);
|
||||
}
|
||||
EVP_PKEY_free(pk);
|
||||
# endif
|
||||
} else {
|
||||
BIO_printf(bio_err, "bad output format specified for outfile\n");
|
||||
goto end;
|
||||
}
|
||||
if (i <= 0) {
|
||||
BIO_printf(bio_err, "unable to write private key\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
ret = 0;
|
||||
end:
|
||||
BIO_free_all(out);
|
||||
DSA_free(dsa);
|
||||
release_engine(e);
|
||||
OPENSSL_free(passin);
|
||||
OPENSSL_free(passout);
|
||||
return (ret);
|
||||
}
|
||||
#endif
|
||||
@@ -1,9 +0,0 @@
|
||||
-----BEGIN DSA PARAMETERS-----
|
||||
MIIBHgKBgQCnP26Fv0FqKX3wn0cZMJCaCR3aajMexT2GlrMV4FMuj+BZgnOQPnUx
|
||||
mUd6UvuF5NmmezibaIqEm4fGHrV+hktTW1nPcWUZiG7OZq5riDb77Cjcwtelu+Us
|
||||
OSZL2ppwGJU3lRBWI/YV7boEXt45T/23Qx+1pGVvzYAR5HCVW1DNSQIVAPcHMe36
|
||||
bAYD1YWKHKycZedQZmVvAoGATd9MA6aRivUZb1BGJZnlaG8w42nh5bNdmLsohkj8
|
||||
3pkEP1+IDJxzJA0gXbkqmj8YlifkYofBe3RiU/xhJ6h6kQmdtvFNnFQPWAbuSXQH
|
||||
zlV+I84W9srcWmEBfslxtU323DQph2j2XiCTs9v15AlsQReVkusBtXOlan7YMu0O
|
||||
Arg=
|
||||
-----END DSA PARAMETERS-----
|
||||
@@ -1,6 +0,0 @@
|
||||
-----BEGIN DSA PARAMETERS-----
|
||||
MIGdAkEAnRtpjibb8isRcBmG9hnI+BnyGFOURgbQYlAzSwI8UjADizv5X9EkBk97
|
||||
TLqqQJv9luQ3M7stWtdaEUBmonZ9MQIVAPtT71C0QJIxVoZTeuiLIppJ+3GPAkEA
|
||||
gz6I5cWJc847bAFJv7PHnwrqRJHlMKrZvltftxDXibeOdPvPKR7rqCxUUbgQ3qDO
|
||||
L8wka5B33qJoplISogOdIA==
|
||||
-----END DSA PARAMETERS-----
|
||||
@@ -1,6 +0,0 @@
|
||||
-----BEGIN DSA PARAMETERS-----
|
||||
MIGcAkEA+ZiKEvZmc9MtnaFZh4NiZ3oZS4J1PHvPrm9MXj5ntVheDPkdmBDTncya
|
||||
GAJcMjwsyB/GvLDGd6yGCw/8eF+09wIVAK3VagOxGd/Q4Af5NbxR5FB7CXEjAkA2
|
||||
t/q7HgVLi0KeKvcDG8BRl3wuy7bCvpjgtWiJc/tpvcuzeuAayH89UofjAGueKjXD
|
||||
ADiRffvSdhrNw5dkqdql
|
||||
-----END DSA PARAMETERS-----
|
||||
319
apps/dsaparam.c
319
apps/dsaparam.c
@@ -1,319 +0,0 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include <openssl/opensslconf.h>
|
||||
#ifdef OPENSSL_NO_DSA
|
||||
NON_EMPTY_TRANSLATION_UNIT
|
||||
#else
|
||||
|
||||
# include <stdio.h>
|
||||
# include <stdlib.h>
|
||||
# include <time.h>
|
||||
# include <string.h>
|
||||
# include "apps.h"
|
||||
# include <openssl/bio.h>
|
||||
# include <openssl/err.h>
|
||||
# include <openssl/bn.h>
|
||||
# include <openssl/dsa.h>
|
||||
# include <openssl/x509.h>
|
||||
# include <openssl/pem.h>
|
||||
|
||||
# ifdef GENCB_TEST
|
||||
|
||||
static int stop_keygen_flag = 0;
|
||||
|
||||
static void timebomb_sigalarm(int foo)
|
||||
{
|
||||
stop_keygen_flag = 1;
|
||||
}
|
||||
|
||||
# endif
|
||||
|
||||
static int dsa_cb(int p, int n, BN_GENCB *cb);
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_TEXT, OPT_C,
|
||||
OPT_NOOUT, OPT_GENKEY, OPT_RAND, OPT_ENGINE,
|
||||
OPT_TIMEBOMB
|
||||
} OPTION_CHOICE;
|
||||
|
||||
OPTIONS dsaparam_options[] = {
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"inform", OPT_INFORM, 'F', "Input format - DER or PEM"},
|
||||
{"in", OPT_IN, '<', "Input file"},
|
||||
{"outform", OPT_OUTFORM, 'F', "Output format - DER or PEM"},
|
||||
{"out", OPT_OUT, '>', "Output file"},
|
||||
{"text", OPT_TEXT, '-', "Print as text"},
|
||||
{"C", OPT_C, '-', "Output C code"},
|
||||
{"noout", OPT_NOOUT, '-', "No output"},
|
||||
{"genkey", OPT_GENKEY, '-', "Generate a DSA key"},
|
||||
{"rand", OPT_RAND, 's', "Files to use for random number input"},
|
||||
# ifdef GENCB_TEST
|
||||
{"timebomb", OPT_TIMEBOMB, 'p', "Interrupt keygen after 'pnum' seconds"},
|
||||
# endif
|
||||
# ifndef OPENSSL_NO_ENGINE
|
||||
{"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
|
||||
# endif
|
||||
{NULL}
|
||||
};
|
||||
|
||||
int dsaparam_main(int argc, char **argv)
|
||||
{
|
||||
ENGINE *e = NULL;
|
||||
DSA *dsa = NULL;
|
||||
BIO *in = NULL, *out = NULL;
|
||||
BN_GENCB *cb = NULL;
|
||||
int numbits = -1, num = 0, genkey = 0, need_rand = 0;
|
||||
int informat = FORMAT_PEM, outformat = FORMAT_PEM, noout = 0, C = 0;
|
||||
int ret = 1, i, text = 0, private = 0;
|
||||
# ifdef GENCB_TEST
|
||||
int timebomb = 0;
|
||||
# endif
|
||||
char *infile = NULL, *outfile = NULL, *prog, *inrand = NULL;
|
||||
OPTION_CHOICE o;
|
||||
|
||||
prog = opt_init(argc, argv, dsaparam_options);
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
switch (o) {
|
||||
case OPT_EOF:
|
||||
case OPT_ERR:
|
||||
opthelp:
|
||||
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
||||
goto end;
|
||||
case OPT_HELP:
|
||||
opt_help(dsaparam_options);
|
||||
ret = 0;
|
||||
goto end;
|
||||
case OPT_INFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &informat))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_IN:
|
||||
infile = opt_arg();
|
||||
break;
|
||||
case OPT_OUTFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &outformat))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_OUT:
|
||||
outfile = opt_arg();
|
||||
break;
|
||||
case OPT_ENGINE:
|
||||
e = setup_engine(opt_arg(), 0);
|
||||
break;
|
||||
case OPT_TIMEBOMB:
|
||||
# ifdef GENCB_TEST
|
||||
timebomb = atoi(opt_arg());
|
||||
break;
|
||||
# endif
|
||||
case OPT_TEXT:
|
||||
text = 1;
|
||||
break;
|
||||
case OPT_C:
|
||||
C = 1;
|
||||
break;
|
||||
case OPT_GENKEY:
|
||||
genkey = need_rand = 1;
|
||||
break;
|
||||
case OPT_RAND:
|
||||
inrand = opt_arg();
|
||||
need_rand = 1;
|
||||
break;
|
||||
case OPT_NOOUT:
|
||||
noout = 1;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
argv = opt_rest();
|
||||
|
||||
if (argc == 1) {
|
||||
if (!opt_int(argv[0], &num) || num < 0)
|
||||
goto end;
|
||||
/* generate a key */
|
||||
numbits = num;
|
||||
need_rand = 1;
|
||||
}
|
||||
private = genkey ? 1 : 0;
|
||||
|
||||
in = bio_open_default(infile, 'r', informat);
|
||||
if (in == NULL)
|
||||
goto end;
|
||||
out = bio_open_owner(outfile, outformat, private);
|
||||
if (out == NULL)
|
||||
goto end;
|
||||
|
||||
if (need_rand) {
|
||||
app_RAND_load_file(NULL, (inrand != NULL));
|
||||
if (inrand != NULL)
|
||||
BIO_printf(bio_err, "%ld semi-random bytes loaded\n",
|
||||
app_RAND_load_files(inrand));
|
||||
}
|
||||
|
||||
if (numbits > 0) {
|
||||
cb = BN_GENCB_new();
|
||||
if (cb == NULL) {
|
||||
BIO_printf(bio_err, "Error allocating BN_GENCB object\n");
|
||||
goto end;
|
||||
}
|
||||
BN_GENCB_set(cb, dsa_cb, bio_err);
|
||||
assert(need_rand);
|
||||
dsa = DSA_new();
|
||||
if (dsa == NULL) {
|
||||
BIO_printf(bio_err, "Error allocating DSA object\n");
|
||||
goto end;
|
||||
}
|
||||
BIO_printf(bio_err, "Generating DSA parameters, %d bit long prime\n",
|
||||
num);
|
||||
BIO_printf(bio_err, "This could take some time\n");
|
||||
# ifdef GENCB_TEST
|
||||
if (timebomb > 0) {
|
||||
struct sigaction act;
|
||||
act.sa_handler = timebomb_sigalarm;
|
||||
act.sa_flags = 0;
|
||||
BIO_printf(bio_err,
|
||||
"(though I'll stop it if not done within %d secs)\n",
|
||||
timebomb);
|
||||
if (sigaction(SIGALRM, &act, NULL) != 0) {
|
||||
BIO_printf(bio_err, "Error, couldn't set SIGALRM handler\n");
|
||||
goto end;
|
||||
}
|
||||
alarm(timebomb);
|
||||
}
|
||||
# endif
|
||||
if (!DSA_generate_parameters_ex(dsa, num, NULL, 0, NULL, NULL, cb)) {
|
||||
# ifdef GENCB_TEST
|
||||
if (stop_keygen_flag) {
|
||||
BIO_printf(bio_err, "DSA key generation time-stopped\n");
|
||||
/* This is an asked-for behaviour! */
|
||||
ret = 0;
|
||||
goto end;
|
||||
}
|
||||
# endif
|
||||
ERR_print_errors(bio_err);
|
||||
BIO_printf(bio_err, "Error, DSA key generation failed\n");
|
||||
goto end;
|
||||
}
|
||||
} else if (informat == FORMAT_ASN1)
|
||||
dsa = d2i_DSAparams_bio(in, NULL);
|
||||
else
|
||||
dsa = PEM_read_bio_DSAparams(in, NULL, NULL, NULL);
|
||||
if (dsa == NULL) {
|
||||
BIO_printf(bio_err, "unable to load DSA parameters\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (text) {
|
||||
DSAparams_print(out, dsa);
|
||||
}
|
||||
|
||||
if (C) {
|
||||
const BIGNUM *p = NULL, *q = NULL, *g = NULL;
|
||||
unsigned char *data;
|
||||
int len, bits_p;
|
||||
|
||||
DSA_get0_pqg(dsa, &p, &q, &g);
|
||||
len = BN_num_bytes(p);
|
||||
bits_p = BN_num_bits(p);
|
||||
|
||||
data = app_malloc(len + 20, "BN space");
|
||||
|
||||
BIO_printf(bio_out, "static DSA *get_dsa%d(void)\n{\n", bits_p);
|
||||
print_bignum_var(bio_out, p, "dsap", bits_p, data);
|
||||
print_bignum_var(bio_out, q, "dsaq", bits_p, data);
|
||||
print_bignum_var(bio_out, g, "dsag", bits_p, data);
|
||||
BIO_printf(bio_out, " DSA *dsa = DSA_new();\n"
|
||||
" BIGNUM *p, *q, *g;\n"
|
||||
"\n");
|
||||
BIO_printf(bio_out, " if (dsa == NULL)\n"
|
||||
" return NULL;\n");
|
||||
BIO_printf(bio_out, " if (!DSA_set0_pqg(dsa, p = BN_bin2bn(dsap_%d, sizeof(dsap_%d), NULL),\n",
|
||||
bits_p, bits_p);
|
||||
BIO_printf(bio_out, " q = BN_bin2bn(dsaq_%d, sizeof(dsaq_%d), NULL),\n",
|
||||
bits_p, bits_p);
|
||||
BIO_printf(bio_out, " g = BN_bin2bn(dsag_%d, sizeof(dsag_%d), NULL))) {\n",
|
||||
bits_p, bits_p);
|
||||
BIO_printf(bio_out, " DSA_free(dsa);\n"
|
||||
" BN_free(p);\n"
|
||||
" BN_free(q);\n"
|
||||
" BN_free(g);\n"
|
||||
" return NULL;\n"
|
||||
" }\n"
|
||||
" return dsa;\n}\n");
|
||||
OPENSSL_free(data);
|
||||
}
|
||||
|
||||
if (outformat == FORMAT_ASN1 && genkey)
|
||||
noout = 1;
|
||||
|
||||
if (!noout) {
|
||||
if (outformat == FORMAT_ASN1)
|
||||
i = i2d_DSAparams_bio(out, dsa);
|
||||
else
|
||||
i = PEM_write_bio_DSAparams(out, dsa);
|
||||
if (!i) {
|
||||
BIO_printf(bio_err, "unable to write DSA parameters\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
if (genkey) {
|
||||
DSA *dsakey;
|
||||
|
||||
assert(need_rand);
|
||||
if ((dsakey = DSAparams_dup(dsa)) == NULL)
|
||||
goto end;
|
||||
if (!DSA_generate_key(dsakey)) {
|
||||
ERR_print_errors(bio_err);
|
||||
DSA_free(dsakey);
|
||||
goto end;
|
||||
}
|
||||
assert(private);
|
||||
if (outformat == FORMAT_ASN1)
|
||||
i = i2d_DSAPrivateKey_bio(out, dsakey);
|
||||
else
|
||||
i = PEM_write_bio_DSAPrivateKey(out, dsakey, NULL, NULL, 0, NULL,
|
||||
NULL);
|
||||
DSA_free(dsakey);
|
||||
}
|
||||
if (need_rand)
|
||||
app_RAND_write_file(NULL);
|
||||
ret = 0;
|
||||
end:
|
||||
BN_GENCB_free(cb);
|
||||
BIO_free(in);
|
||||
BIO_free_all(out);
|
||||
DSA_free(dsa);
|
||||
release_engine(e);
|
||||
return (ret);
|
||||
}
|
||||
|
||||
static int dsa_cb(int p, int n, BN_GENCB *cb)
|
||||
{
|
||||
char c = '*';
|
||||
|
||||
if (p == 0)
|
||||
c = '.';
|
||||
if (p == 1)
|
||||
c = '+';
|
||||
if (p == 2)
|
||||
c = '*';
|
||||
if (p == 3)
|
||||
c = '\n';
|
||||
BIO_write(BN_GENCB_get_arg(cb), &c, 1);
|
||||
(void)BIO_flush(BN_GENCB_get_arg(cb));
|
||||
# ifdef GENCB_TEST
|
||||
if (stop_keygen_flag)
|
||||
return 0;
|
||||
# endif
|
||||
return 1;
|
||||
}
|
||||
#endif
|
||||
281
apps/ec.c
281
apps/ec.c
@@ -1,281 +0,0 @@
|
||||
/*
|
||||
* Copyright 2002-2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include <openssl/opensslconf.h>
|
||||
#ifdef OPENSSL_NO_EC
|
||||
NON_EMPTY_TRANSLATION_UNIT
|
||||
#else
|
||||
|
||||
# include <stdio.h>
|
||||
# include <stdlib.h>
|
||||
# include <string.h>
|
||||
# include "apps.h"
|
||||
# include <openssl/bio.h>
|
||||
# include <openssl/err.h>
|
||||
# include <openssl/evp.h>
|
||||
# include <openssl/pem.h>
|
||||
|
||||
static OPT_PAIR conv_forms[] = {
|
||||
{"compressed", POINT_CONVERSION_COMPRESSED},
|
||||
{"uncompressed", POINT_CONVERSION_UNCOMPRESSED},
|
||||
{"hybrid", POINT_CONVERSION_HYBRID},
|
||||
{NULL}
|
||||
};
|
||||
|
||||
static OPT_PAIR param_enc[] = {
|
||||
{"named_curve", OPENSSL_EC_NAMED_CURVE},
|
||||
{"explicit", 0},
|
||||
{NULL}
|
||||
};
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_INFORM, OPT_OUTFORM, OPT_ENGINE, OPT_IN, OPT_OUT,
|
||||
OPT_NOOUT, OPT_TEXT, OPT_PARAM_OUT, OPT_PUBIN, OPT_PUBOUT,
|
||||
OPT_PASSIN, OPT_PASSOUT, OPT_PARAM_ENC, OPT_CONV_FORM, OPT_CIPHER,
|
||||
OPT_NO_PUBLIC, OPT_CHECK
|
||||
} OPTION_CHOICE;
|
||||
|
||||
OPTIONS ec_options[] = {
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"in", OPT_IN, 's', "Input file"},
|
||||
{"inform", OPT_INFORM, 'f', "Input format - DER or PEM"},
|
||||
{"out", OPT_OUT, '>', "Output file"},
|
||||
{"outform", OPT_OUTFORM, 'F', "Output format - DER or PEM"},
|
||||
{"noout", OPT_NOOUT, '-', "Don't print key out"},
|
||||
{"text", OPT_TEXT, '-', "Print the key"},
|
||||
{"param_out", OPT_PARAM_OUT, '-', "Print the elliptic curve parameters"},
|
||||
{"pubin", OPT_PUBIN, '-', "Expect a public key in input file"},
|
||||
{"pubout", OPT_PUBOUT, '-', "Output public key, not private"},
|
||||
{"no_public", OPT_NO_PUBLIC, '-', "exclude public key from private key"},
|
||||
{"check", OPT_CHECK, '-', "check key consistency"},
|
||||
{"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
|
||||
{"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
|
||||
{"param_enc", OPT_PARAM_ENC, 's',
|
||||
"Specifies the way the ec parameters are encoded"},
|
||||
{"conv_form", OPT_CONV_FORM, 's', "Specifies the point conversion form "},
|
||||
{"", OPT_CIPHER, '-', "Any supported cipher"},
|
||||
# ifndef OPENSSL_NO_ENGINE
|
||||
{"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
|
||||
# endif
|
||||
{NULL}
|
||||
};
|
||||
|
||||
int ec_main(int argc, char **argv)
|
||||
{
|
||||
BIO *in = NULL, *out = NULL;
|
||||
ENGINE *e = NULL;
|
||||
EC_KEY *eckey = NULL;
|
||||
const EC_GROUP *group;
|
||||
const EVP_CIPHER *enc = NULL;
|
||||
point_conversion_form_t form = POINT_CONVERSION_UNCOMPRESSED;
|
||||
char *infile = NULL, *outfile = NULL, *prog;
|
||||
char *passin = NULL, *passout = NULL, *passinarg = NULL, *passoutarg = NULL;
|
||||
OPTION_CHOICE o;
|
||||
int asn1_flag = OPENSSL_EC_NAMED_CURVE, new_form = 0, new_asn1_flag = 0;
|
||||
int informat = FORMAT_PEM, outformat = FORMAT_PEM, text = 0, noout = 0;
|
||||
int pubin = 0, pubout = 0, param_out = 0, i, ret = 1, private = 0;
|
||||
int no_public = 0, check = 0;
|
||||
|
||||
prog = opt_init(argc, argv, ec_options);
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
switch (o) {
|
||||
case OPT_EOF:
|
||||
case OPT_ERR:
|
||||
opthelp:
|
||||
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
||||
goto end;
|
||||
case OPT_HELP:
|
||||
opt_help(ec_options);
|
||||
ret = 0;
|
||||
goto end;
|
||||
case OPT_INFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_ANY, &informat))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_IN:
|
||||
infile = opt_arg();
|
||||
break;
|
||||
case OPT_OUTFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &outformat))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_OUT:
|
||||
outfile = opt_arg();
|
||||
break;
|
||||
case OPT_NOOUT:
|
||||
noout = 1;
|
||||
break;
|
||||
case OPT_TEXT:
|
||||
text = 1;
|
||||
break;
|
||||
case OPT_PARAM_OUT:
|
||||
param_out = 1;
|
||||
break;
|
||||
case OPT_PUBIN:
|
||||
pubin = 1;
|
||||
break;
|
||||
case OPT_PUBOUT:
|
||||
pubout = 1;
|
||||
break;
|
||||
case OPT_PASSIN:
|
||||
passinarg = opt_arg();
|
||||
break;
|
||||
case OPT_PASSOUT:
|
||||
passoutarg = opt_arg();
|
||||
break;
|
||||
case OPT_ENGINE:
|
||||
e = setup_engine(opt_arg(), 0);
|
||||
break;
|
||||
case OPT_CIPHER:
|
||||
if (!opt_cipher(opt_unknown(), &enc))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_CONV_FORM:
|
||||
if (!opt_pair(opt_arg(), conv_forms, &i))
|
||||
goto opthelp;
|
||||
new_form = 1;
|
||||
form = i;
|
||||
break;
|
||||
case OPT_PARAM_ENC:
|
||||
if (!opt_pair(opt_arg(), param_enc, &i))
|
||||
goto opthelp;
|
||||
new_asn1_flag = 1;
|
||||
asn1_flag = i;
|
||||
break;
|
||||
case OPT_NO_PUBLIC:
|
||||
no_public = 1;
|
||||
break;
|
||||
case OPT_CHECK:
|
||||
check = 1;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
if (argc != 0)
|
||||
goto opthelp;
|
||||
|
||||
private = param_out || pubin || pubout ? 0 : 1;
|
||||
if (text && !pubin)
|
||||
private = 1;
|
||||
|
||||
if (!app_passwd(passinarg, passoutarg, &passin, &passout)) {
|
||||
BIO_printf(bio_err, "Error getting passwords\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (informat != FORMAT_ENGINE) {
|
||||
in = bio_open_default(infile, 'r', informat);
|
||||
if (in == NULL)
|
||||
goto end;
|
||||
}
|
||||
|
||||
BIO_printf(bio_err, "read EC key\n");
|
||||
if (informat == FORMAT_ASN1) {
|
||||
if (pubin)
|
||||
eckey = d2i_EC_PUBKEY_bio(in, NULL);
|
||||
else
|
||||
eckey = d2i_ECPrivateKey_bio(in, NULL);
|
||||
} else if (informat == FORMAT_ENGINE) {
|
||||
EVP_PKEY *pkey;
|
||||
if (pubin)
|
||||
pkey = load_pubkey(infile, informat , 1, passin, e, "Public Key");
|
||||
else
|
||||
pkey = load_key(infile, informat, 1, passin, e, "Private Key");
|
||||
if (pkey != NULL) {
|
||||
eckey = EVP_PKEY_get1_EC_KEY(pkey);
|
||||
EVP_PKEY_free(pkey);
|
||||
}
|
||||
} else {
|
||||
if (pubin)
|
||||
eckey = PEM_read_bio_EC_PUBKEY(in, NULL, NULL, NULL);
|
||||
else
|
||||
eckey = PEM_read_bio_ECPrivateKey(in, NULL, NULL, passin);
|
||||
}
|
||||
if (eckey == NULL) {
|
||||
BIO_printf(bio_err, "unable to load Key\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
|
||||
out = bio_open_owner(outfile, outformat, private);
|
||||
if (out == NULL)
|
||||
goto end;
|
||||
|
||||
group = EC_KEY_get0_group(eckey);
|
||||
|
||||
if (new_form)
|
||||
EC_KEY_set_conv_form(eckey, form);
|
||||
|
||||
if (new_asn1_flag)
|
||||
EC_KEY_set_asn1_flag(eckey, asn1_flag);
|
||||
|
||||
if (no_public)
|
||||
EC_KEY_set_enc_flags(eckey, EC_PKEY_NO_PUBKEY);
|
||||
|
||||
if (text) {
|
||||
assert(pubin || private);
|
||||
if (!EC_KEY_print(out, eckey, 0)) {
|
||||
perror(outfile);
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
if (check) {
|
||||
if (EC_KEY_check_key(eckey) == 1) {
|
||||
BIO_printf(bio_err, "EC Key valid.\n");
|
||||
} else {
|
||||
BIO_printf(bio_err, "EC Key Invalid!\n");
|
||||
ERR_print_errors(bio_err);
|
||||
}
|
||||
}
|
||||
|
||||
if (noout) {
|
||||
ret = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
BIO_printf(bio_err, "writing EC key\n");
|
||||
if (outformat == FORMAT_ASN1) {
|
||||
if (param_out)
|
||||
i = i2d_ECPKParameters_bio(out, group);
|
||||
else if (pubin || pubout)
|
||||
i = i2d_EC_PUBKEY_bio(out, eckey);
|
||||
else {
|
||||
assert(private);
|
||||
i = i2d_ECPrivateKey_bio(out, eckey);
|
||||
}
|
||||
} else {
|
||||
if (param_out)
|
||||
i = PEM_write_bio_ECPKParameters(out, group);
|
||||
else if (pubin || pubout)
|
||||
i = PEM_write_bio_EC_PUBKEY(out, eckey);
|
||||
else {
|
||||
assert(private);
|
||||
i = PEM_write_bio_ECPrivateKey(out, eckey, enc,
|
||||
NULL, 0, NULL, passout);
|
||||
}
|
||||
}
|
||||
|
||||
if (!i) {
|
||||
BIO_printf(bio_err, "unable to write private key\n");
|
||||
ERR_print_errors(bio_err);
|
||||
} else
|
||||
ret = 0;
|
||||
end:
|
||||
BIO_free(in);
|
||||
BIO_free_all(out);
|
||||
EC_KEY_free(eckey);
|
||||
release_engine(e);
|
||||
OPENSSL_free(passin);
|
||||
OPENSSL_free(passout);
|
||||
return (ret);
|
||||
}
|
||||
#endif
|
||||
471
apps/ecparam.c
471
apps/ecparam.c
@@ -1,471 +0,0 @@
|
||||
/*
|
||||
* Copyright 2002-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
/* ====================================================================
|
||||
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
|
||||
*
|
||||
* Portions of the attached software ("Contribution") are developed by
|
||||
* SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
|
||||
*
|
||||
* The Contribution is licensed pursuant to the OpenSSL open source
|
||||
* license provided above.
|
||||
*
|
||||
* The elliptic curve binary polynomial software is originally written by
|
||||
* Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories.
|
||||
*
|
||||
*/
|
||||
|
||||
#include <openssl/opensslconf.h>
|
||||
#ifdef OPENSSL_NO_EC
|
||||
NON_EMPTY_TRANSLATION_UNIT
|
||||
#else
|
||||
|
||||
# include <stdio.h>
|
||||
# include <stdlib.h>
|
||||
# include <time.h>
|
||||
# include <string.h>
|
||||
# include "apps.h"
|
||||
# include <openssl/bio.h>
|
||||
# include <openssl/err.h>
|
||||
# include <openssl/bn.h>
|
||||
# include <openssl/ec.h>
|
||||
# include <openssl/x509.h>
|
||||
# include <openssl/pem.h>
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_TEXT, OPT_C,
|
||||
OPT_CHECK, OPT_LIST_CURVES, OPT_NO_SEED, OPT_NOOUT, OPT_NAME,
|
||||
OPT_CONV_FORM, OPT_PARAM_ENC, OPT_GENKEY, OPT_RAND, OPT_ENGINE
|
||||
} OPTION_CHOICE;
|
||||
|
||||
OPTIONS ecparam_options[] = {
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"inform", OPT_INFORM, 'F', "Input format - default PEM (DER or PEM)"},
|
||||
{"outform", OPT_OUTFORM, 'F', "Output format - default PEM"},
|
||||
{"in", OPT_IN, '<', "Input file - default stdin"},
|
||||
{"out", OPT_OUT, '>', "Output file - default stdout"},
|
||||
{"text", OPT_TEXT, '-', "Print the ec parameters in text form"},
|
||||
{"C", OPT_C, '-', "Print a 'C' function creating the parameters"},
|
||||
{"check", OPT_CHECK, '-', "Validate the ec parameters"},
|
||||
{"list_curves", OPT_LIST_CURVES, '-',
|
||||
"Prints a list of all curve 'short names'"},
|
||||
{"no_seed", OPT_NO_SEED, '-',
|
||||
"If 'explicit' parameters are chosen do not use the seed"},
|
||||
{"noout", OPT_NOOUT, '-', "Do not print the ec parameter"},
|
||||
{"name", OPT_NAME, 's',
|
||||
"Use the ec parameters with specified 'short name'"},
|
||||
{"conv_form", OPT_CONV_FORM, 's', "Specifies the point conversion form "},
|
||||
{"param_enc", OPT_PARAM_ENC, 's',
|
||||
"Specifies the way the ec parameters are encoded"},
|
||||
{"genkey", OPT_GENKEY, '-', "Generate ec key"},
|
||||
{"rand", OPT_RAND, 's', "Files to use for random number input"},
|
||||
# ifndef OPENSSL_NO_ENGINE
|
||||
{"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
|
||||
# endif
|
||||
{NULL}
|
||||
};
|
||||
|
||||
static OPT_PAIR forms[] = {
|
||||
{"compressed", POINT_CONVERSION_COMPRESSED},
|
||||
{"uncompressed", POINT_CONVERSION_UNCOMPRESSED},
|
||||
{"hybrid", POINT_CONVERSION_HYBRID},
|
||||
{NULL}
|
||||
};
|
||||
|
||||
static OPT_PAIR encodings[] = {
|
||||
{"named_curve", OPENSSL_EC_NAMED_CURVE},
|
||||
{"explicit", 0},
|
||||
{NULL}
|
||||
};
|
||||
|
||||
int ecparam_main(int argc, char **argv)
|
||||
{
|
||||
ENGINE *e = NULL;
|
||||
BIGNUM *ec_gen = NULL, *ec_order = NULL, *ec_cofactor = NULL;
|
||||
BIGNUM *ec_p = NULL, *ec_a = NULL, *ec_b = NULL;
|
||||
BIO *in = NULL, *out = NULL;
|
||||
EC_GROUP *group = NULL;
|
||||
point_conversion_form_t form = POINT_CONVERSION_UNCOMPRESSED;
|
||||
char *curve_name = NULL, *inrand = NULL;
|
||||
char *infile = NULL, *outfile = NULL, *prog;
|
||||
unsigned char *buffer = NULL;
|
||||
OPTION_CHOICE o;
|
||||
int asn1_flag = OPENSSL_EC_NAMED_CURVE, new_asn1_flag = 0;
|
||||
int informat = FORMAT_PEM, outformat = FORMAT_PEM, noout = 0, C = 0;
|
||||
int ret = 1, private = 0;
|
||||
int list_curves = 0, no_seed = 0, check = 0, new_form = 0;
|
||||
int text = 0, i, need_rand = 0, genkey = 0;
|
||||
|
||||
prog = opt_init(argc, argv, ecparam_options);
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
switch (o) {
|
||||
case OPT_EOF:
|
||||
case OPT_ERR:
|
||||
opthelp:
|
||||
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
||||
goto end;
|
||||
case OPT_HELP:
|
||||
opt_help(ecparam_options);
|
||||
ret = 0;
|
||||
goto end;
|
||||
case OPT_INFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &informat))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_IN:
|
||||
infile = opt_arg();
|
||||
break;
|
||||
case OPT_OUTFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &outformat))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_OUT:
|
||||
outfile = opt_arg();
|
||||
break;
|
||||
case OPT_TEXT:
|
||||
text = 1;
|
||||
break;
|
||||
case OPT_C:
|
||||
C = 1;
|
||||
break;
|
||||
case OPT_CHECK:
|
||||
check = 1;
|
||||
break;
|
||||
case OPT_LIST_CURVES:
|
||||
list_curves = 1;
|
||||
break;
|
||||
case OPT_NO_SEED:
|
||||
no_seed = 1;
|
||||
break;
|
||||
case OPT_NOOUT:
|
||||
noout = 1;
|
||||
break;
|
||||
case OPT_NAME:
|
||||
curve_name = opt_arg();
|
||||
break;
|
||||
case OPT_CONV_FORM:
|
||||
if (!opt_pair(opt_arg(), forms, &new_form))
|
||||
goto opthelp;
|
||||
form = new_form;
|
||||
new_form = 1;
|
||||
break;
|
||||
case OPT_PARAM_ENC:
|
||||
if (!opt_pair(opt_arg(), encodings, &asn1_flag))
|
||||
goto opthelp;
|
||||
new_asn1_flag = 1;
|
||||
break;
|
||||
case OPT_GENKEY:
|
||||
genkey = need_rand = 1;
|
||||
break;
|
||||
case OPT_RAND:
|
||||
inrand = opt_arg();
|
||||
need_rand = 1;
|
||||
break;
|
||||
case OPT_ENGINE:
|
||||
e = setup_engine(opt_arg(), 0);
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
if (argc != 0)
|
||||
goto opthelp;
|
||||
|
||||
private = genkey ? 1 : 0;
|
||||
|
||||
in = bio_open_default(infile, 'r', informat);
|
||||
if (in == NULL)
|
||||
goto end;
|
||||
out = bio_open_owner(outfile, outformat, private);
|
||||
if (out == NULL)
|
||||
goto end;
|
||||
|
||||
if (list_curves) {
|
||||
EC_builtin_curve *curves = NULL;
|
||||
size_t crv_len = EC_get_builtin_curves(NULL, 0);
|
||||
size_t n;
|
||||
|
||||
curves = app_malloc((int)sizeof(*curves) * crv_len, "list curves");
|
||||
if (!EC_get_builtin_curves(curves, crv_len)) {
|
||||
OPENSSL_free(curves);
|
||||
goto end;
|
||||
}
|
||||
|
||||
for (n = 0; n < crv_len; n++) {
|
||||
const char *comment;
|
||||
const char *sname;
|
||||
comment = curves[n].comment;
|
||||
sname = OBJ_nid2sn(curves[n].nid);
|
||||
if (comment == NULL)
|
||||
comment = "CURVE DESCRIPTION NOT AVAILABLE";
|
||||
if (sname == NULL)
|
||||
sname = "";
|
||||
|
||||
BIO_printf(out, " %-10s: ", sname);
|
||||
BIO_printf(out, "%s\n", comment);
|
||||
}
|
||||
|
||||
OPENSSL_free(curves);
|
||||
ret = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (curve_name != NULL) {
|
||||
int nid;
|
||||
|
||||
/*
|
||||
* workaround for the SECG curve names secp192r1 and secp256r1 (which
|
||||
* are the same as the curves prime192v1 and prime256v1 defined in
|
||||
* X9.62)
|
||||
*/
|
||||
if (strcmp(curve_name, "secp192r1") == 0) {
|
||||
BIO_printf(bio_err, "using curve name prime192v1 "
|
||||
"instead of secp192r1\n");
|
||||
nid = NID_X9_62_prime192v1;
|
||||
} else if (strcmp(curve_name, "secp256r1") == 0) {
|
||||
BIO_printf(bio_err, "using curve name prime256v1 "
|
||||
"instead of secp256r1\n");
|
||||
nid = NID_X9_62_prime256v1;
|
||||
} else
|
||||
nid = OBJ_sn2nid(curve_name);
|
||||
|
||||
if (nid == 0)
|
||||
nid = EC_curve_nist2nid(curve_name);
|
||||
|
||||
if (nid == 0) {
|
||||
BIO_printf(bio_err, "unknown curve name (%s)\n", curve_name);
|
||||
goto end;
|
||||
}
|
||||
|
||||
group = EC_GROUP_new_by_curve_name(nid);
|
||||
if (group == NULL) {
|
||||
BIO_printf(bio_err, "unable to create curve (%s)\n", curve_name);
|
||||
goto end;
|
||||
}
|
||||
EC_GROUP_set_asn1_flag(group, asn1_flag);
|
||||
EC_GROUP_set_point_conversion_form(group, form);
|
||||
} else if (informat == FORMAT_ASN1)
|
||||
group = d2i_ECPKParameters_bio(in, NULL);
|
||||
else
|
||||
group = PEM_read_bio_ECPKParameters(in, NULL, NULL, NULL);
|
||||
if (group == NULL) {
|
||||
BIO_printf(bio_err, "unable to load elliptic curve parameters\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (new_form)
|
||||
EC_GROUP_set_point_conversion_form(group, form);
|
||||
|
||||
if (new_asn1_flag)
|
||||
EC_GROUP_set_asn1_flag(group, asn1_flag);
|
||||
|
||||
if (no_seed) {
|
||||
EC_GROUP_set_seed(group, NULL, 0);
|
||||
}
|
||||
|
||||
if (text) {
|
||||
if (!ECPKParameters_print(out, group, 0))
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (check) {
|
||||
BIO_printf(bio_err, "checking elliptic curve parameters: ");
|
||||
if (!EC_GROUP_check(group, NULL)) {
|
||||
BIO_printf(bio_err, "failed\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
BIO_printf(bio_err, "ok\n");
|
||||
|
||||
}
|
||||
|
||||
if (C) {
|
||||
size_t buf_len = 0, tmp_len = 0;
|
||||
const EC_POINT *point;
|
||||
int is_prime, len = 0;
|
||||
const EC_METHOD *meth = EC_GROUP_method_of(group);
|
||||
|
||||
if ((ec_p = BN_new()) == NULL
|
||||
|| (ec_a = BN_new()) == NULL
|
||||
|| (ec_b = BN_new()) == NULL
|
||||
|| (ec_gen = BN_new()) == NULL
|
||||
|| (ec_order = BN_new()) == NULL
|
||||
|| (ec_cofactor = BN_new()) == NULL) {
|
||||
perror("Can't allocate BN");
|
||||
goto end;
|
||||
}
|
||||
|
||||
is_prime = (EC_METHOD_get_field_type(meth) == NID_X9_62_prime_field);
|
||||
if (!is_prime) {
|
||||
BIO_printf(bio_err, "Can only handle X9.62 prime fields\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (!EC_GROUP_get_curve_GFp(group, ec_p, ec_a, ec_b, NULL))
|
||||
goto end;
|
||||
|
||||
if ((point = EC_GROUP_get0_generator(group)) == NULL)
|
||||
goto end;
|
||||
if (!EC_POINT_point2bn(group, point,
|
||||
EC_GROUP_get_point_conversion_form(group),
|
||||
ec_gen, NULL))
|
||||
goto end;
|
||||
if (!EC_GROUP_get_order(group, ec_order, NULL))
|
||||
goto end;
|
||||
if (!EC_GROUP_get_cofactor(group, ec_cofactor, NULL))
|
||||
goto end;
|
||||
|
||||
if (!ec_p || !ec_a || !ec_b || !ec_gen || !ec_order || !ec_cofactor)
|
||||
goto end;
|
||||
|
||||
len = BN_num_bits(ec_order);
|
||||
|
||||
if ((tmp_len = (size_t)BN_num_bytes(ec_p)) > buf_len)
|
||||
buf_len = tmp_len;
|
||||
if ((tmp_len = (size_t)BN_num_bytes(ec_a)) > buf_len)
|
||||
buf_len = tmp_len;
|
||||
if ((tmp_len = (size_t)BN_num_bytes(ec_b)) > buf_len)
|
||||
buf_len = tmp_len;
|
||||
if ((tmp_len = (size_t)BN_num_bytes(ec_gen)) > buf_len)
|
||||
buf_len = tmp_len;
|
||||
if ((tmp_len = (size_t)BN_num_bytes(ec_order)) > buf_len)
|
||||
buf_len = tmp_len;
|
||||
if ((tmp_len = (size_t)BN_num_bytes(ec_cofactor)) > buf_len)
|
||||
buf_len = tmp_len;
|
||||
|
||||
buffer = app_malloc(buf_len, "BN buffer");
|
||||
|
||||
BIO_printf(out, "EC_GROUP *get_ec_group_%d(void)\n{\n", len);
|
||||
print_bignum_var(out, ec_p, "ec_p", len, buffer);
|
||||
print_bignum_var(out, ec_a, "ec_a", len, buffer);
|
||||
print_bignum_var(out, ec_b, "ec_b", len, buffer);
|
||||
print_bignum_var(out, ec_gen, "ec_gen", len, buffer);
|
||||
print_bignum_var(out, ec_order, "ec_order", len, buffer);
|
||||
print_bignum_var(out, ec_cofactor, "ec_cofactor", len, buffer);
|
||||
BIO_printf(out, " int ok = 0;\n"
|
||||
" EC_GROUP *group = NULL;\n"
|
||||
" EC_POINT *point = NULL;\n"
|
||||
" BIGNUM *tmp_1 = NULL;\n"
|
||||
" BIGNUM *tmp_2 = NULL;\n"
|
||||
" BIGNUM *tmp_3 = NULL;\n"
|
||||
"\n");
|
||||
|
||||
BIO_printf(out, " if ((tmp_1 = BN_bin2bn(ec_p_%d, sizeof(ec_p_%d), NULL)) == NULL)\n"
|
||||
" goto err;\n", len, len);
|
||||
BIO_printf(out, " if ((tmp_2 = BN_bin2bn(ec_a_%d, sizeof(ec_a_%d), NULL)) == NULL)\n"
|
||||
" goto err;\n", len, len);
|
||||
BIO_printf(out, " if ((tmp_3 = BN_bin2bn(ec_b_%d, sizeof(ec_b_%d), NULL)) == NULL)\n"
|
||||
" goto err;\n", len, len);
|
||||
BIO_printf(out, " if ((group = EC_GROUP_new_curve_GFp(tmp_1, tmp_2, tmp_3, NULL)) == NULL)\n"
|
||||
" goto err;\n"
|
||||
"\n");
|
||||
BIO_printf(out, " /* build generator */\n");
|
||||
BIO_printf(out, " if ((tmp_1 = BN_bin2bn(ec_gen_%d, sizeof(ec_gen_%d), tmp_1)) == NULL)\n"
|
||||
" goto err;\n", len, len);
|
||||
BIO_printf(out, " point = EC_POINT_bn2point(group, tmp_1, NULL, NULL);\n");
|
||||
BIO_printf(out, " if (point == NULL)\n"
|
||||
" goto err;\n");
|
||||
BIO_printf(out, " if ((tmp_2 = BN_bin2bn(ec_order_%d, sizeof(ec_order_%d), tmp_2)) == NULL)\n"
|
||||
" goto err;\n", len, len);
|
||||
BIO_printf(out, " if ((tmp_3 = BN_bin2bn(ec_cofactor_%d, sizeof(ec_cofactor_%d), tmp_3)) == NULL)\n"
|
||||
" goto err;\n", len, len);
|
||||
BIO_printf(out, " if (!EC_GROUP_set_generator(group, point, tmp_2, tmp_3))\n"
|
||||
" goto err;\n"
|
||||
"ok = 1;"
|
||||
"\n");
|
||||
BIO_printf(out, "err:\n"
|
||||
" BN_free(tmp_1);\n"
|
||||
" BN_free(tmp_2);\n"
|
||||
" BN_free(tmp_3);\n"
|
||||
" EC_POINT_free(point);\n"
|
||||
" if (!ok) {\n"
|
||||
" EC_GROUP_free(group);\n"
|
||||
" return NULL;\n"
|
||||
" }\n"
|
||||
" return (group);\n"
|
||||
"}\n");
|
||||
}
|
||||
|
||||
if (outformat == FORMAT_ASN1 && genkey)
|
||||
noout = 1;
|
||||
|
||||
if (!noout) {
|
||||
if (outformat == FORMAT_ASN1)
|
||||
i = i2d_ECPKParameters_bio(out, group);
|
||||
else
|
||||
i = PEM_write_bio_ECPKParameters(out, group);
|
||||
if (!i) {
|
||||
BIO_printf(bio_err, "unable to write elliptic "
|
||||
"curve parameters\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
if (need_rand) {
|
||||
app_RAND_load_file(NULL, (inrand != NULL));
|
||||
if (inrand != NULL)
|
||||
BIO_printf(bio_err, "%ld semi-random bytes loaded\n",
|
||||
app_RAND_load_files(inrand));
|
||||
}
|
||||
|
||||
if (genkey) {
|
||||
EC_KEY *eckey = EC_KEY_new();
|
||||
|
||||
if (eckey == NULL)
|
||||
goto end;
|
||||
|
||||
assert(need_rand);
|
||||
|
||||
if (EC_KEY_set_group(eckey, group) == 0) {
|
||||
BIO_printf(bio_err, "unable to set group when generating key\n");
|
||||
EC_KEY_free(eckey);
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (new_form)
|
||||
EC_KEY_set_conv_form(eckey, form);
|
||||
|
||||
if (!EC_KEY_generate_key(eckey)) {
|
||||
BIO_printf(bio_err, "unable to generate key\n");
|
||||
EC_KEY_free(eckey);
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
assert(private);
|
||||
if (outformat == FORMAT_ASN1)
|
||||
i = i2d_ECPrivateKey_bio(out, eckey);
|
||||
else
|
||||
i = PEM_write_bio_ECPrivateKey(out, eckey, NULL,
|
||||
NULL, 0, NULL, NULL);
|
||||
EC_KEY_free(eckey);
|
||||
}
|
||||
|
||||
if (need_rand)
|
||||
app_RAND_write_file(NULL);
|
||||
|
||||
ret = 0;
|
||||
end:
|
||||
BN_free(ec_p);
|
||||
BN_free(ec_a);
|
||||
BN_free(ec_b);
|
||||
BN_free(ec_gen);
|
||||
BN_free(ec_order);
|
||||
BN_free(ec_cofactor);
|
||||
OPENSSL_free(buffer);
|
||||
EC_GROUP_free(group);
|
||||
release_engine(e);
|
||||
BIO_free(in);
|
||||
BIO_free_all(out);
|
||||
return (ret);
|
||||
}
|
||||
|
||||
#endif
|
||||
623
apps/enc.c
623
apps/enc.c
@@ -1,623 +0,0 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <limits.h>
|
||||
#include "apps.h"
|
||||
#include <openssl/bio.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/evp.h>
|
||||
#include <openssl/objects.h>
|
||||
#include <openssl/x509.h>
|
||||
#include <openssl/rand.h>
|
||||
#include <openssl/pem.h>
|
||||
#ifndef OPENSSL_NO_COMP
|
||||
# include <openssl/comp.h>
|
||||
#endif
|
||||
#include <ctype.h>
|
||||
|
||||
#undef SIZE
|
||||
#undef BSIZE
|
||||
#define SIZE (512)
|
||||
#define BSIZE (8*1024)
|
||||
|
||||
static int set_hex(char *in, unsigned char *out, int size);
|
||||
static void show_ciphers(const OBJ_NAME *name, void *bio_);
|
||||
|
||||
struct doall_enc_ciphers {
|
||||
BIO *bio;
|
||||
int n;
|
||||
};
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_LIST,
|
||||
OPT_E, OPT_IN, OPT_OUT, OPT_PASS, OPT_ENGINE, OPT_D, OPT_P, OPT_V,
|
||||
OPT_NOPAD, OPT_SALT, OPT_NOSALT, OPT_DEBUG, OPT_UPPER_P, OPT_UPPER_A,
|
||||
OPT_A, OPT_Z, OPT_BUFSIZE, OPT_K, OPT_KFILE, OPT_UPPER_K, OPT_NONE,
|
||||
OPT_UPPER_S, OPT_IV, OPT_MD, OPT_CIPHER
|
||||
} OPTION_CHOICE;
|
||||
|
||||
OPTIONS enc_options[] = {
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"ciphers", OPT_LIST, '-', "List ciphers"},
|
||||
{"in", OPT_IN, '<', "Input file"},
|
||||
{"out", OPT_OUT, '>', "Output file"},
|
||||
{"pass", OPT_PASS, 's', "Passphrase source"},
|
||||
{"e", OPT_E, '-', "Encrypt"},
|
||||
{"d", OPT_D, '-', "Decrypt"},
|
||||
{"p", OPT_P, '-', "Print the iv/key"},
|
||||
{"P", OPT_UPPER_P, '-', "Print the iv/key and exit"},
|
||||
{"v", OPT_V, '-', "Verbose output"},
|
||||
{"nopad", OPT_NOPAD, '-', "Disable standard block padding"},
|
||||
{"salt", OPT_SALT, '-', "Use salt in the KDF (default)"},
|
||||
{"nosalt", OPT_NOSALT, '-', "Do not use salt in the KDF"},
|
||||
{"debug", OPT_DEBUG, '-', "Print debug info"},
|
||||
{"a", OPT_A, '-', "Base64 encode/decode, depending on encryption flag"},
|
||||
{"base64", OPT_A, '-', "Same as option -a"},
|
||||
{"A", OPT_UPPER_A, '-',
|
||||
"Used with -[base64|a] to specify base64 buffer as a single line"},
|
||||
{"bufsize", OPT_BUFSIZE, 's', "Buffer size"},
|
||||
{"k", OPT_K, 's', "Passphrase"},
|
||||
{"kfile", OPT_KFILE, '<', "Read passphrase from file"},
|
||||
{"K", OPT_UPPER_K, 's', "Raw key, in hex"},
|
||||
{"S", OPT_UPPER_S, 's', "Salt, in hex"},
|
||||
{"iv", OPT_IV, 's', "IV in hex"},
|
||||
{"md", OPT_MD, 's', "Use specified digest to create a key from the passphrase"},
|
||||
{"none", OPT_NONE, '-', "Don't encrypt"},
|
||||
{"", OPT_CIPHER, '-', "Any supported cipher"},
|
||||
#ifdef ZLIB
|
||||
{"z", OPT_Z, '-', "Use zlib as the 'encryption'"},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
{"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
|
||||
#endif
|
||||
{NULL}
|
||||
};
|
||||
|
||||
int enc_main(int argc, char **argv)
|
||||
{
|
||||
static char buf[128];
|
||||
static const char magic[] = "Salted__";
|
||||
ENGINE *e = NULL;
|
||||
BIO *in = NULL, *out = NULL, *b64 = NULL, *benc = NULL, *rbio =
|
||||
NULL, *wbio = NULL;
|
||||
EVP_CIPHER_CTX *ctx = NULL;
|
||||
const EVP_CIPHER *cipher = NULL, *c;
|
||||
const EVP_MD *dgst = NULL;
|
||||
char *hkey = NULL, *hiv = NULL, *hsalt = NULL, *p;
|
||||
char *infile = NULL, *outfile = NULL, *prog;
|
||||
char *str = NULL, *passarg = NULL, *pass = NULL, *strbuf = NULL;
|
||||
char mbuf[sizeof(magic) - 1];
|
||||
OPTION_CHOICE o;
|
||||
int bsize = BSIZE, verbose = 0, debug = 0, olb64 = 0, nosalt = 0;
|
||||
int enc = 1, printkey = 0, i, k;
|
||||
int base64 = 0, informat = FORMAT_BINARY, outformat = FORMAT_BINARY;
|
||||
int ret = 1, inl, nopad = 0;
|
||||
unsigned char key[EVP_MAX_KEY_LENGTH], iv[EVP_MAX_IV_LENGTH];
|
||||
unsigned char *buff = NULL, salt[PKCS5_SALT_LEN];
|
||||
long n;
|
||||
struct doall_enc_ciphers dec;
|
||||
#ifdef ZLIB
|
||||
int do_zlib = 0;
|
||||
BIO *bzl = NULL;
|
||||
#endif
|
||||
|
||||
/* first check the program name */
|
||||
prog = opt_progname(argv[0]);
|
||||
if (strcmp(prog, "base64") == 0)
|
||||
base64 = 1;
|
||||
#ifdef ZLIB
|
||||
else if (strcmp(prog, "zlib") == 0)
|
||||
do_zlib = 1;
|
||||
#endif
|
||||
else {
|
||||
cipher = EVP_get_cipherbyname(prog);
|
||||
if (cipher == NULL && strcmp(prog, "enc") != 0) {
|
||||
BIO_printf(bio_err, "%s is not a known cipher\n", prog);
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
prog = opt_init(argc, argv, enc_options);
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
switch (o) {
|
||||
case OPT_EOF:
|
||||
case OPT_ERR:
|
||||
opthelp:
|
||||
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
||||
goto end;
|
||||
case OPT_HELP:
|
||||
opt_help(enc_options);
|
||||
ret = 0;
|
||||
goto end;
|
||||
case OPT_LIST:
|
||||
BIO_printf(bio_out, "Supported ciphers:\n");
|
||||
dec.bio = bio_out;
|
||||
dec.n = 0;
|
||||
OBJ_NAME_do_all_sorted(OBJ_NAME_TYPE_CIPHER_METH,
|
||||
show_ciphers, &dec);
|
||||
BIO_printf(bio_out, "\n");
|
||||
ret = 0;
|
||||
goto end;
|
||||
case OPT_E:
|
||||
enc = 1;
|
||||
break;
|
||||
case OPT_IN:
|
||||
infile = opt_arg();
|
||||
break;
|
||||
case OPT_OUT:
|
||||
outfile = opt_arg();
|
||||
break;
|
||||
case OPT_PASS:
|
||||
passarg = opt_arg();
|
||||
break;
|
||||
case OPT_ENGINE:
|
||||
e = setup_engine(opt_arg(), 0);
|
||||
break;
|
||||
case OPT_D:
|
||||
enc = 0;
|
||||
break;
|
||||
case OPT_P:
|
||||
printkey = 1;
|
||||
break;
|
||||
case OPT_V:
|
||||
verbose = 1;
|
||||
break;
|
||||
case OPT_NOPAD:
|
||||
nopad = 1;
|
||||
break;
|
||||
case OPT_SALT:
|
||||
nosalt = 0;
|
||||
break;
|
||||
case OPT_NOSALT:
|
||||
nosalt = 1;
|
||||
break;
|
||||
case OPT_DEBUG:
|
||||
debug = 1;
|
||||
break;
|
||||
case OPT_UPPER_P:
|
||||
printkey = 2;
|
||||
break;
|
||||
case OPT_UPPER_A:
|
||||
olb64 = 1;
|
||||
break;
|
||||
case OPT_A:
|
||||
base64 = 1;
|
||||
break;
|
||||
case OPT_Z:
|
||||
#ifdef ZLIB
|
||||
do_zlib = 1;
|
||||
#endif
|
||||
break;
|
||||
case OPT_BUFSIZE:
|
||||
p = opt_arg();
|
||||
i = (int)strlen(p) - 1;
|
||||
k = i >= 1 && p[i] == 'k';
|
||||
if (k)
|
||||
p[i] = '\0';
|
||||
if (!opt_long(opt_arg(), &n)
|
||||
|| n < 0 || (k && n >= LONG_MAX / 1024))
|
||||
goto opthelp;
|
||||
if (k)
|
||||
n *= 1024;
|
||||
bsize = (int)n;
|
||||
break;
|
||||
case OPT_K:
|
||||
str = opt_arg();
|
||||
break;
|
||||
case OPT_KFILE:
|
||||
in = bio_open_default(opt_arg(), 'r', FORMAT_TEXT);
|
||||
if (in == NULL)
|
||||
goto opthelp;
|
||||
i = BIO_gets(in, buf, sizeof(buf));
|
||||
BIO_free(in);
|
||||
in = NULL;
|
||||
if (i <= 0) {
|
||||
BIO_printf(bio_err,
|
||||
"%s Can't read key from %s\n", prog, opt_arg());
|
||||
goto opthelp;
|
||||
}
|
||||
while (--i > 0 && (buf[i] == '\r' || buf[i] == '\n'))
|
||||
buf[i] = '\0';
|
||||
if (i <= 0) {
|
||||
BIO_printf(bio_err, "%s: zero length password\n", prog);
|
||||
goto opthelp;
|
||||
}
|
||||
str = buf;
|
||||
break;
|
||||
case OPT_UPPER_K:
|
||||
hkey = opt_arg();
|
||||
break;
|
||||
case OPT_UPPER_S:
|
||||
hsalt = opt_arg();
|
||||
break;
|
||||
case OPT_IV:
|
||||
hiv = opt_arg();
|
||||
break;
|
||||
case OPT_MD:
|
||||
if (!opt_md(opt_arg(), &dgst))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_CIPHER:
|
||||
if (!opt_cipher(opt_unknown(), &c))
|
||||
goto opthelp;
|
||||
cipher = c;
|
||||
break;
|
||||
case OPT_NONE:
|
||||
cipher = NULL;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (opt_num_rest() != 0) {
|
||||
BIO_printf(bio_err, "Extra arguments given.\n");
|
||||
goto opthelp;
|
||||
}
|
||||
|
||||
if (cipher && EVP_CIPHER_flags(cipher) & EVP_CIPH_FLAG_AEAD_CIPHER) {
|
||||
BIO_printf(bio_err, "%s: AEAD ciphers not supported\n", prog);
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (cipher && (EVP_CIPHER_mode(cipher) == EVP_CIPH_XTS_MODE)) {
|
||||
BIO_printf(bio_err, "%s XTS ciphers not supported\n", prog);
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (dgst == NULL)
|
||||
dgst = EVP_sha256();
|
||||
|
||||
/* It must be large enough for a base64 encoded line */
|
||||
if (base64 && bsize < 80)
|
||||
bsize = 80;
|
||||
if (verbose)
|
||||
BIO_printf(bio_err, "bufsize=%d\n", bsize);
|
||||
|
||||
#ifdef ZLIB
|
||||
if (!do_zlib)
|
||||
#endif
|
||||
if (base64) {
|
||||
if (enc)
|
||||
outformat = FORMAT_BASE64;
|
||||
else
|
||||
informat = FORMAT_BASE64;
|
||||
}
|
||||
|
||||
strbuf = app_malloc(SIZE, "strbuf");
|
||||
buff = app_malloc(EVP_ENCODE_LENGTH(bsize), "evp buffer");
|
||||
|
||||
if (infile == NULL) {
|
||||
in = dup_bio_in(informat);
|
||||
} else
|
||||
in = bio_open_default(infile, 'r', informat);
|
||||
if (in == NULL)
|
||||
goto end;
|
||||
|
||||
if (!str && passarg) {
|
||||
if (!app_passwd(passarg, NULL, &pass, NULL)) {
|
||||
BIO_printf(bio_err, "Error getting password\n");
|
||||
goto end;
|
||||
}
|
||||
str = pass;
|
||||
}
|
||||
|
||||
if ((str == NULL) && (cipher != NULL) && (hkey == NULL)) {
|
||||
if (1) {
|
||||
#ifndef OPENSSL_NO_UI
|
||||
for (;;) {
|
||||
char prompt[200];
|
||||
|
||||
BIO_snprintf(prompt, sizeof(prompt), "enter %s %s password:",
|
||||
OBJ_nid2ln(EVP_CIPHER_nid(cipher)),
|
||||
(enc) ? "encryption" : "decryption");
|
||||
strbuf[0] = '\0';
|
||||
i = EVP_read_pw_string((char *)strbuf, SIZE, prompt, enc);
|
||||
if (i == 0) {
|
||||
if (strbuf[0] == '\0') {
|
||||
ret = 1;
|
||||
goto end;
|
||||
}
|
||||
str = strbuf;
|
||||
break;
|
||||
}
|
||||
if (i < 0) {
|
||||
BIO_printf(bio_err, "bad password read\n");
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
#endif
|
||||
BIO_printf(bio_err, "password required\n");
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
out = bio_open_default(outfile, 'w', outformat);
|
||||
if (out == NULL)
|
||||
goto end;
|
||||
|
||||
if (debug) {
|
||||
BIO_set_callback(in, BIO_debug_callback);
|
||||
BIO_set_callback(out, BIO_debug_callback);
|
||||
BIO_set_callback_arg(in, (char *)bio_err);
|
||||
BIO_set_callback_arg(out, (char *)bio_err);
|
||||
}
|
||||
|
||||
rbio = in;
|
||||
wbio = out;
|
||||
|
||||
#ifdef ZLIB
|
||||
if (do_zlib) {
|
||||
if ((bzl = BIO_new(BIO_f_zlib())) == NULL)
|
||||
goto end;
|
||||
if (debug) {
|
||||
BIO_set_callback(bzl, BIO_debug_callback);
|
||||
BIO_set_callback_arg(bzl, (char *)bio_err);
|
||||
}
|
||||
if (enc)
|
||||
wbio = BIO_push(bzl, wbio);
|
||||
else
|
||||
rbio = BIO_push(bzl, rbio);
|
||||
}
|
||||
#endif
|
||||
|
||||
if (base64) {
|
||||
if ((b64 = BIO_new(BIO_f_base64())) == NULL)
|
||||
goto end;
|
||||
if (debug) {
|
||||
BIO_set_callback(b64, BIO_debug_callback);
|
||||
BIO_set_callback_arg(b64, (char *)bio_err);
|
||||
}
|
||||
if (olb64)
|
||||
BIO_set_flags(b64, BIO_FLAGS_BASE64_NO_NL);
|
||||
if (enc)
|
||||
wbio = BIO_push(b64, wbio);
|
||||
else
|
||||
rbio = BIO_push(b64, rbio);
|
||||
}
|
||||
|
||||
if (cipher != NULL) {
|
||||
/*
|
||||
* Note that str is NULL if a key was passed on the command line, so
|
||||
* we get no salt in that case. Is this a bug?
|
||||
*/
|
||||
if (str != NULL) {
|
||||
/*
|
||||
* Salt handling: if encrypting generate a salt and write to
|
||||
* output BIO. If decrypting read salt from input BIO.
|
||||
*/
|
||||
unsigned char *sptr;
|
||||
size_t str_len = strlen(str);
|
||||
|
||||
if (nosalt)
|
||||
sptr = NULL;
|
||||
else {
|
||||
if (enc) {
|
||||
if (hsalt) {
|
||||
if (!set_hex(hsalt, salt, sizeof(salt))) {
|
||||
BIO_printf(bio_err, "invalid hex salt value\n");
|
||||
goto end;
|
||||
}
|
||||
} else if (RAND_bytes(salt, sizeof(salt)) <= 0)
|
||||
goto end;
|
||||
/*
|
||||
* If -P option then don't bother writing
|
||||
*/
|
||||
if ((printkey != 2)
|
||||
&& (BIO_write(wbio, magic,
|
||||
sizeof(magic) - 1) != sizeof(magic) - 1
|
||||
|| BIO_write(wbio,
|
||||
(char *)salt,
|
||||
sizeof(salt)) != sizeof(salt))) {
|
||||
BIO_printf(bio_err, "error writing output file\n");
|
||||
goto end;
|
||||
}
|
||||
} else if (BIO_read(rbio, mbuf, sizeof(mbuf)) != sizeof(mbuf)
|
||||
|| BIO_read(rbio,
|
||||
(unsigned char *)salt,
|
||||
sizeof(salt)) != sizeof(salt)) {
|
||||
BIO_printf(bio_err, "error reading input file\n");
|
||||
goto end;
|
||||
} else if (memcmp(mbuf, magic, sizeof(magic) - 1)) {
|
||||
BIO_printf(bio_err, "bad magic number\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
sptr = salt;
|
||||
}
|
||||
|
||||
if (!EVP_BytesToKey(cipher, dgst, sptr,
|
||||
(unsigned char *)str,
|
||||
str_len, 1, key, iv)) {
|
||||
BIO_printf(bio_err, "EVP_BytesToKey failed\n");
|
||||
goto end;
|
||||
}
|
||||
/*
|
||||
* zero the complete buffer or the string passed from the command
|
||||
* line bug picked up by Larry J. Hughes Jr. <hughes@indiana.edu>
|
||||
*/
|
||||
if (str == strbuf)
|
||||
OPENSSL_cleanse(str, SIZE);
|
||||
else
|
||||
OPENSSL_cleanse(str, str_len);
|
||||
}
|
||||
if (hiv != NULL) {
|
||||
int siz = EVP_CIPHER_iv_length(cipher);
|
||||
if (siz == 0) {
|
||||
BIO_printf(bio_err, "warning: iv not use by this cipher\n");
|
||||
} else if (!set_hex(hiv, iv, sizeof(iv))) {
|
||||
BIO_printf(bio_err, "invalid hex iv value\n");
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
if ((hiv == NULL) && (str == NULL)
|
||||
&& EVP_CIPHER_iv_length(cipher) != 0) {
|
||||
/*
|
||||
* No IV was explicitly set and no IV was generated during
|
||||
* EVP_BytesToKey. Hence the IV is undefined, making correct
|
||||
* decryption impossible.
|
||||
*/
|
||||
BIO_printf(bio_err, "iv undefined\n");
|
||||
goto end;
|
||||
}
|
||||
if ((hkey != NULL) && !set_hex(hkey, key, EVP_CIPHER_key_length(cipher))) {
|
||||
BIO_printf(bio_err, "invalid hex key value\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
if ((benc = BIO_new(BIO_f_cipher())) == NULL)
|
||||
goto end;
|
||||
|
||||
/*
|
||||
* Since we may be changing parameters work on the encryption context
|
||||
* rather than calling BIO_set_cipher().
|
||||
*/
|
||||
|
||||
BIO_get_cipher_ctx(benc, &ctx);
|
||||
|
||||
if (!EVP_CipherInit_ex(ctx, cipher, NULL, NULL, NULL, enc)) {
|
||||
BIO_printf(bio_err, "Error setting cipher %s\n",
|
||||
EVP_CIPHER_name(cipher));
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (nopad)
|
||||
EVP_CIPHER_CTX_set_padding(ctx, 0);
|
||||
|
||||
if (!EVP_CipherInit_ex(ctx, NULL, NULL, key, iv, enc)) {
|
||||
BIO_printf(bio_err, "Error setting cipher %s\n",
|
||||
EVP_CIPHER_name(cipher));
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (debug) {
|
||||
BIO_set_callback(benc, BIO_debug_callback);
|
||||
BIO_set_callback_arg(benc, (char *)bio_err);
|
||||
}
|
||||
|
||||
if (printkey) {
|
||||
if (!nosalt) {
|
||||
printf("salt=");
|
||||
for (i = 0; i < (int)sizeof(salt); i++)
|
||||
printf("%02X", salt[i]);
|
||||
printf("\n");
|
||||
}
|
||||
if (EVP_CIPHER_key_length(cipher) > 0) {
|
||||
printf("key=");
|
||||
for (i = 0; i < EVP_CIPHER_key_length(cipher); i++)
|
||||
printf("%02X", key[i]);
|
||||
printf("\n");
|
||||
}
|
||||
if (EVP_CIPHER_iv_length(cipher) > 0) {
|
||||
printf("iv =");
|
||||
for (i = 0; i < EVP_CIPHER_iv_length(cipher); i++)
|
||||
printf("%02X", iv[i]);
|
||||
printf("\n");
|
||||
}
|
||||
if (printkey == 2) {
|
||||
ret = 0;
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/* Only encrypt/decrypt as we write the file */
|
||||
if (benc != NULL)
|
||||
wbio = BIO_push(benc, wbio);
|
||||
|
||||
for (;;) {
|
||||
inl = BIO_read(rbio, (char *)buff, bsize);
|
||||
if (inl <= 0)
|
||||
break;
|
||||
if (BIO_write(wbio, (char *)buff, inl) != inl) {
|
||||
BIO_printf(bio_err, "error writing output file\n");
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
if (!BIO_flush(wbio)) {
|
||||
BIO_printf(bio_err, "bad decrypt\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
ret = 0;
|
||||
if (verbose) {
|
||||
BIO_printf(bio_err, "bytes read :%8"BIO_PRI64"u\n", BIO_number_read(in));
|
||||
BIO_printf(bio_err, "bytes written:%8"BIO_PRI64"u\n", BIO_number_written(out));
|
||||
}
|
||||
end:
|
||||
ERR_print_errors(bio_err);
|
||||
OPENSSL_free(strbuf);
|
||||
OPENSSL_free(buff);
|
||||
BIO_free(in);
|
||||
BIO_free_all(out);
|
||||
BIO_free(benc);
|
||||
BIO_free(b64);
|
||||
#ifdef ZLIB
|
||||
BIO_free(bzl);
|
||||
#endif
|
||||
release_engine(e);
|
||||
OPENSSL_free(pass);
|
||||
return (ret);
|
||||
}
|
||||
|
||||
static void show_ciphers(const OBJ_NAME *name, void *arg)
|
||||
{
|
||||
struct doall_enc_ciphers *dec = (struct doall_enc_ciphers *)arg;
|
||||
const EVP_CIPHER *cipher;
|
||||
|
||||
if (!islower((unsigned char)*name->name))
|
||||
return;
|
||||
|
||||
/* Filter out ciphers that we cannot use */
|
||||
cipher = EVP_get_cipherbyname(name->name);
|
||||
if (cipher == NULL ||
|
||||
(EVP_CIPHER_flags(cipher) & EVP_CIPH_FLAG_AEAD_CIPHER) != 0 ||
|
||||
EVP_CIPHER_mode(cipher) == EVP_CIPH_XTS_MODE)
|
||||
return;
|
||||
|
||||
BIO_printf(dec->bio, "-%-25s", name->name);
|
||||
if (++dec->n == 3) {
|
||||
BIO_printf(dec->bio, "\n");
|
||||
dec->n = 0;
|
||||
} else
|
||||
BIO_printf(dec->bio, " ");
|
||||
}
|
||||
|
||||
static int set_hex(char *in, unsigned char *out, int size)
|
||||
{
|
||||
int i, n;
|
||||
unsigned char j;
|
||||
|
||||
n = strlen(in);
|
||||
if (n > (size * 2)) {
|
||||
BIO_printf(bio_err, "hex string is too long\n");
|
||||
return (0);
|
||||
}
|
||||
memset(out, 0, size);
|
||||
for (i = 0; i < n; i++) {
|
||||
j = (unsigned char)*in;
|
||||
*(in++) = '\0';
|
||||
if (j == 0)
|
||||
break;
|
||||
if (!isxdigit(j)) {
|
||||
BIO_printf(bio_err, "non-hex digit\n");
|
||||
return (0);
|
||||
}
|
||||
j = (unsigned char)OPENSSL_hexchar2int(j);
|
||||
if (i & 1)
|
||||
out[i / 2] |= j;
|
||||
else
|
||||
out[i / 2] = (j << 4);
|
||||
}
|
||||
return (1);
|
||||
}
|
||||
446
apps/engine.c
446
apps/engine.c
@@ -1,446 +0,0 @@
|
||||
/*
|
||||
* Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include <openssl/opensslconf.h>
|
||||
#ifdef OPENSSL_NO_ENGINE
|
||||
NON_EMPTY_TRANSLATION_UNIT
|
||||
#else
|
||||
|
||||
# include "apps.h"
|
||||
# include <stdio.h>
|
||||
# include <stdlib.h>
|
||||
# include <string.h>
|
||||
# include <openssl/err.h>
|
||||
# include <openssl/engine.h>
|
||||
# include <openssl/ssl.h>
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_C, OPT_T, OPT_TT, OPT_PRE, OPT_POST,
|
||||
OPT_V = 100, OPT_VV, OPT_VVV, OPT_VVVV
|
||||
} OPTION_CHOICE;
|
||||
|
||||
OPTIONS engine_options[] = {
|
||||
{OPT_HELP_STR, 1, '-', "Usage: %s [options] engine...\n"},
|
||||
{OPT_HELP_STR, 1, '-',
|
||||
" engine... Engines to load\n"},
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"v", OPT_V, '-', "List 'control commands' For each specified engine"},
|
||||
{"vv", OPT_VV, '-', "Also display each command's description"},
|
||||
{"vvv", OPT_VVV, '-', "Also add the input flags for each command"},
|
||||
{"vvvv", OPT_VVVV, '-', "Also show internal input flags"},
|
||||
{"c", OPT_C, '-', "List the capabilities of specified engine"},
|
||||
{"t", OPT_T, '-', "Check that specified engine is available"},
|
||||
{"tt", OPT_TT, '-', "Display error trace for unavailable engines"},
|
||||
{"pre", OPT_PRE, 's', "Run command against the ENGINE before loading it"},
|
||||
{"post", OPT_POST, 's', "Run command against the ENGINE after loading it"},
|
||||
{OPT_MORE_STR, OPT_EOF, 1,
|
||||
"Commands are like \"SO_PATH:/lib/libdriver.so\""},
|
||||
{NULL}
|
||||
};
|
||||
|
||||
static int append_buf(char **buf, int *size, const char *s)
|
||||
{
|
||||
if (*buf == NULL) {
|
||||
*size = 256;
|
||||
*buf = app_malloc(*size, "engine buffer");
|
||||
**buf = '\0';
|
||||
}
|
||||
|
||||
if (strlen(*buf) + strlen(s) >= (unsigned int)*size) {
|
||||
char *tmp;
|
||||
*size += 256;
|
||||
tmp = OPENSSL_realloc(*buf, *size);
|
||||
if (tmp == NULL) {
|
||||
OPENSSL_free(*buf);
|
||||
*buf = NULL;
|
||||
return 0;
|
||||
}
|
||||
*buf = tmp;
|
||||
}
|
||||
|
||||
if (**buf != '\0')
|
||||
OPENSSL_strlcat(*buf, ", ", *size);
|
||||
OPENSSL_strlcat(*buf, s, *size);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int util_flags(BIO *out, unsigned int flags, const char *indent)
|
||||
{
|
||||
int started = 0, err = 0;
|
||||
/* Indent before displaying input flags */
|
||||
BIO_printf(out, "%s%s(input flags): ", indent, indent);
|
||||
if (flags == 0) {
|
||||
BIO_printf(out, "<no flags>\n");
|
||||
return 1;
|
||||
}
|
||||
/*
|
||||
* If the object is internal, mark it in a way that shows instead of
|
||||
* having it part of all the other flags, even if it really is.
|
||||
*/
|
||||
if (flags & ENGINE_CMD_FLAG_INTERNAL) {
|
||||
BIO_printf(out, "[Internal] ");
|
||||
}
|
||||
|
||||
if (flags & ENGINE_CMD_FLAG_NUMERIC) {
|
||||
BIO_printf(out, "NUMERIC");
|
||||
started = 1;
|
||||
}
|
||||
/*
|
||||
* Now we check that no combinations of the mutually exclusive NUMERIC,
|
||||
* STRING, and NO_INPUT flags have been used. Future flags that can be
|
||||
* OR'd together with these would need to added after these to preserve
|
||||
* the testing logic.
|
||||
*/
|
||||
if (flags & ENGINE_CMD_FLAG_STRING) {
|
||||
if (started) {
|
||||
BIO_printf(out, "|");
|
||||
err = 1;
|
||||
}
|
||||
BIO_printf(out, "STRING");
|
||||
started = 1;
|
||||
}
|
||||
if (flags & ENGINE_CMD_FLAG_NO_INPUT) {
|
||||
if (started) {
|
||||
BIO_printf(out, "|");
|
||||
err = 1;
|
||||
}
|
||||
BIO_printf(out, "NO_INPUT");
|
||||
started = 1;
|
||||
}
|
||||
/* Check for unknown flags */
|
||||
flags = flags & ~ENGINE_CMD_FLAG_NUMERIC &
|
||||
~ENGINE_CMD_FLAG_STRING &
|
||||
~ENGINE_CMD_FLAG_NO_INPUT & ~ENGINE_CMD_FLAG_INTERNAL;
|
||||
if (flags) {
|
||||
if (started)
|
||||
BIO_printf(out, "|");
|
||||
BIO_printf(out, "<0x%04X>", flags);
|
||||
}
|
||||
if (err)
|
||||
BIO_printf(out, " <illegal flags!>");
|
||||
BIO_printf(out, "\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int util_verbose(ENGINE *e, int verbose, BIO *out, const char *indent)
|
||||
{
|
||||
static const int line_wrap = 78;
|
||||
int num;
|
||||
int ret = 0;
|
||||
char *name = NULL;
|
||||
char *desc = NULL;
|
||||
int flags;
|
||||
int xpos = 0;
|
||||
STACK_OF(OPENSSL_STRING) *cmds = NULL;
|
||||
if (!ENGINE_ctrl(e, ENGINE_CTRL_HAS_CTRL_FUNCTION, 0, NULL, NULL) ||
|
||||
((num = ENGINE_ctrl(e, ENGINE_CTRL_GET_FIRST_CMD_TYPE,
|
||||
0, NULL, NULL)) <= 0)) {
|
||||
return 1;
|
||||
}
|
||||
|
||||
cmds = sk_OPENSSL_STRING_new_null();
|
||||
if (!cmds)
|
||||
goto err;
|
||||
|
||||
do {
|
||||
int len;
|
||||
/* Get the command input flags */
|
||||
if ((flags = ENGINE_ctrl(e, ENGINE_CTRL_GET_CMD_FLAGS, num,
|
||||
NULL, NULL)) < 0)
|
||||
goto err;
|
||||
if (!(flags & ENGINE_CMD_FLAG_INTERNAL) || verbose >= 4) {
|
||||
/* Get the command name */
|
||||
if ((len = ENGINE_ctrl(e, ENGINE_CTRL_GET_NAME_LEN_FROM_CMD, num,
|
||||
NULL, NULL)) <= 0)
|
||||
goto err;
|
||||
name = app_malloc(len + 1, "name buffer");
|
||||
if (ENGINE_ctrl(e, ENGINE_CTRL_GET_NAME_FROM_CMD, num, name,
|
||||
NULL) <= 0)
|
||||
goto err;
|
||||
/* Get the command description */
|
||||
if ((len = ENGINE_ctrl(e, ENGINE_CTRL_GET_DESC_LEN_FROM_CMD, num,
|
||||
NULL, NULL)) < 0)
|
||||
goto err;
|
||||
if (len > 0) {
|
||||
desc = app_malloc(len + 1, "description buffer");
|
||||
if (ENGINE_ctrl(e, ENGINE_CTRL_GET_DESC_FROM_CMD, num, desc,
|
||||
NULL) <= 0)
|
||||
goto err;
|
||||
}
|
||||
/* Now decide on the output */
|
||||
if (xpos == 0)
|
||||
/* Do an indent */
|
||||
xpos = BIO_puts(out, indent);
|
||||
else
|
||||
/* Otherwise prepend a ", " */
|
||||
xpos += BIO_printf(out, ", ");
|
||||
if (verbose == 1) {
|
||||
/*
|
||||
* We're just listing names, comma-delimited
|
||||
*/
|
||||
if ((xpos > (int)strlen(indent)) &&
|
||||
(xpos + (int)strlen(name) > line_wrap)) {
|
||||
BIO_printf(out, "\n");
|
||||
xpos = BIO_puts(out, indent);
|
||||
}
|
||||
xpos += BIO_printf(out, "%s", name);
|
||||
} else {
|
||||
/* We're listing names plus descriptions */
|
||||
BIO_printf(out, "%s: %s\n", name,
|
||||
(desc == NULL) ? "<no description>" : desc);
|
||||
/* ... and sometimes input flags */
|
||||
if ((verbose >= 3) && !util_flags(out, flags, indent))
|
||||
goto err;
|
||||
xpos = 0;
|
||||
}
|
||||
}
|
||||
OPENSSL_free(name);
|
||||
name = NULL;
|
||||
OPENSSL_free(desc);
|
||||
desc = NULL;
|
||||
/* Move to the next command */
|
||||
num = ENGINE_ctrl(e, ENGINE_CTRL_GET_NEXT_CMD_TYPE, num, NULL, NULL);
|
||||
} while (num > 0);
|
||||
if (xpos > 0)
|
||||
BIO_printf(out, "\n");
|
||||
ret = 1;
|
||||
err:
|
||||
sk_OPENSSL_STRING_free(cmds);
|
||||
OPENSSL_free(name);
|
||||
OPENSSL_free(desc);
|
||||
return ret;
|
||||
}
|
||||
|
||||
static void util_do_cmds(ENGINE *e, STACK_OF(OPENSSL_STRING) *cmds,
|
||||
BIO *out, const char *indent)
|
||||
{
|
||||
int loop, res, num = sk_OPENSSL_STRING_num(cmds);
|
||||
|
||||
if (num < 0) {
|
||||
BIO_printf(out, "[Error]: internal stack error\n");
|
||||
return;
|
||||
}
|
||||
for (loop = 0; loop < num; loop++) {
|
||||
char buf[256];
|
||||
const char *cmd, *arg;
|
||||
cmd = sk_OPENSSL_STRING_value(cmds, loop);
|
||||
res = 1; /* assume success */
|
||||
/* Check if this command has no ":arg" */
|
||||
if ((arg = strstr(cmd, ":")) == NULL) {
|
||||
if (!ENGINE_ctrl_cmd_string(e, cmd, NULL, 0))
|
||||
res = 0;
|
||||
} else {
|
||||
if ((int)(arg - cmd) > 254) {
|
||||
BIO_printf(out, "[Error]: command name too long\n");
|
||||
return;
|
||||
}
|
||||
memcpy(buf, cmd, (int)(arg - cmd));
|
||||
buf[arg - cmd] = '\0';
|
||||
arg++; /* Move past the ":" */
|
||||
/* Call the command with the argument */
|
||||
if (!ENGINE_ctrl_cmd_string(e, buf, arg, 0))
|
||||
res = 0;
|
||||
}
|
||||
if (res)
|
||||
BIO_printf(out, "[Success]: %s\n", cmd);
|
||||
else {
|
||||
BIO_printf(out, "[Failure]: %s\n", cmd);
|
||||
ERR_print_errors(out);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
int engine_main(int argc, char **argv)
|
||||
{
|
||||
int ret = 1, i;
|
||||
int verbose = 0, list_cap = 0, test_avail = 0, test_avail_noise = 0;
|
||||
ENGINE *e;
|
||||
STACK_OF(OPENSSL_CSTRING) *engines = sk_OPENSSL_CSTRING_new_null();
|
||||
STACK_OF(OPENSSL_STRING) *pre_cmds = sk_OPENSSL_STRING_new_null();
|
||||
STACK_OF(OPENSSL_STRING) *post_cmds = sk_OPENSSL_STRING_new_null();
|
||||
BIO *out;
|
||||
const char *indent = " ";
|
||||
OPTION_CHOICE o;
|
||||
char *prog;
|
||||
char *argv1;
|
||||
|
||||
out = dup_bio_out(FORMAT_TEXT);
|
||||
if (engines == NULL || pre_cmds == NULL || post_cmds == NULL)
|
||||
goto end;
|
||||
|
||||
/* Remember the original command name, parse/skip any leading engine
|
||||
* names, and then setup to parse the rest of the line as flags. */
|
||||
prog = argv[0];
|
||||
while ((argv1 = argv[1]) != NULL && *argv1 != '-') {
|
||||
sk_OPENSSL_CSTRING_push(engines, argv1);
|
||||
argc--;
|
||||
argv++;
|
||||
}
|
||||
argv[0] = prog;
|
||||
opt_init(argc, argv, engine_options);
|
||||
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
switch (o) {
|
||||
case OPT_EOF:
|
||||
case OPT_ERR:
|
||||
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
||||
goto end;
|
||||
case OPT_HELP:
|
||||
opt_help(engine_options);
|
||||
ret = 0;
|
||||
goto end;
|
||||
case OPT_VVVV:
|
||||
case OPT_VVV:
|
||||
case OPT_VV:
|
||||
case OPT_V:
|
||||
/* Convert to an integer from one to four. */
|
||||
i = (int)(o - OPT_V) + 1;
|
||||
if (verbose < i)
|
||||
verbose = i;
|
||||
break;
|
||||
case OPT_C:
|
||||
list_cap = 1;
|
||||
break;
|
||||
case OPT_TT:
|
||||
test_avail_noise++;
|
||||
/* fall thru */
|
||||
case OPT_T:
|
||||
test_avail++;
|
||||
break;
|
||||
case OPT_PRE:
|
||||
sk_OPENSSL_STRING_push(pre_cmds, opt_arg());
|
||||
break;
|
||||
case OPT_POST:
|
||||
sk_OPENSSL_STRING_push(post_cmds, opt_arg());
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
/* Allow any trailing parameters as engine names. */
|
||||
argc = opt_num_rest();
|
||||
argv = opt_rest();
|
||||
for ( ; *argv; argv++) {
|
||||
if (**argv == '-') {
|
||||
BIO_printf(bio_err, "%s: Cannot mix flags and engine names.\n",
|
||||
prog);
|
||||
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
||||
goto end;
|
||||
}
|
||||
sk_OPENSSL_CSTRING_push(engines, *argv);
|
||||
}
|
||||
|
||||
if (sk_OPENSSL_CSTRING_num(engines) == 0) {
|
||||
for (e = ENGINE_get_first(); e != NULL; e = ENGINE_get_next(e)) {
|
||||
sk_OPENSSL_CSTRING_push(engines, ENGINE_get_id(e));
|
||||
}
|
||||
}
|
||||
|
||||
ret = 0;
|
||||
for (i = 0; i < sk_OPENSSL_CSTRING_num(engines); i++) {
|
||||
const char *id = sk_OPENSSL_CSTRING_value(engines, i);
|
||||
if ((e = ENGINE_by_id(id)) != NULL) {
|
||||
const char *name = ENGINE_get_name(e);
|
||||
/*
|
||||
* Do "id" first, then "name". Easier to auto-parse.
|
||||
*/
|
||||
BIO_printf(out, "(%s) %s\n", id, name);
|
||||
util_do_cmds(e, pre_cmds, out, indent);
|
||||
if (strcmp(ENGINE_get_id(e), id) != 0) {
|
||||
BIO_printf(out, "Loaded: (%s) %s\n",
|
||||
ENGINE_get_id(e), ENGINE_get_name(e));
|
||||
}
|
||||
if (list_cap) {
|
||||
int cap_size = 256;
|
||||
char *cap_buf = NULL;
|
||||
int k, n;
|
||||
const int *nids;
|
||||
ENGINE_CIPHERS_PTR fn_c;
|
||||
ENGINE_DIGESTS_PTR fn_d;
|
||||
ENGINE_PKEY_METHS_PTR fn_pk;
|
||||
|
||||
if (ENGINE_get_RSA(e) != NULL
|
||||
&& !append_buf(&cap_buf, &cap_size, "RSA"))
|
||||
goto end;
|
||||
if (ENGINE_get_DSA(e) != NULL
|
||||
&& !append_buf(&cap_buf, &cap_size, "DSA"))
|
||||
goto end;
|
||||
if (ENGINE_get_DH(e) != NULL
|
||||
&& !append_buf(&cap_buf, &cap_size, "DH"))
|
||||
goto end;
|
||||
if (ENGINE_get_RAND(e) != NULL
|
||||
&& !append_buf(&cap_buf, &cap_size, "RAND"))
|
||||
goto end;
|
||||
|
||||
fn_c = ENGINE_get_ciphers(e);
|
||||
if (!fn_c)
|
||||
goto skip_ciphers;
|
||||
n = fn_c(e, NULL, &nids, 0);
|
||||
for (k = 0; k < n; ++k)
|
||||
if (!append_buf(&cap_buf, &cap_size, OBJ_nid2sn(nids[k])))
|
||||
goto end;
|
||||
|
||||
skip_ciphers:
|
||||
fn_d = ENGINE_get_digests(e);
|
||||
if (!fn_d)
|
||||
goto skip_digests;
|
||||
n = fn_d(e, NULL, &nids, 0);
|
||||
for (k = 0; k < n; ++k)
|
||||
if (!append_buf(&cap_buf, &cap_size, OBJ_nid2sn(nids[k])))
|
||||
goto end;
|
||||
|
||||
skip_digests:
|
||||
fn_pk = ENGINE_get_pkey_meths(e);
|
||||
if (!fn_pk)
|
||||
goto skip_pmeths;
|
||||
n = fn_pk(e, NULL, &nids, 0);
|
||||
for (k = 0; k < n; ++k)
|
||||
if (!append_buf(&cap_buf, &cap_size, OBJ_nid2sn(nids[k])))
|
||||
goto end;
|
||||
skip_pmeths:
|
||||
if (cap_buf && (*cap_buf != '\0'))
|
||||
BIO_printf(out, " [%s]\n", cap_buf);
|
||||
|
||||
OPENSSL_free(cap_buf);
|
||||
}
|
||||
if (test_avail) {
|
||||
BIO_printf(out, "%s", indent);
|
||||
if (ENGINE_init(e)) {
|
||||
BIO_printf(out, "[ available ]\n");
|
||||
util_do_cmds(e, post_cmds, out, indent);
|
||||
ENGINE_finish(e);
|
||||
} else {
|
||||
BIO_printf(out, "[ unavailable ]\n");
|
||||
if (test_avail_noise)
|
||||
ERR_print_errors_fp(stdout);
|
||||
ERR_clear_error();
|
||||
}
|
||||
}
|
||||
if ((verbose > 0) && !util_verbose(e, verbose, out, indent))
|
||||
goto end;
|
||||
ENGINE_free(e);
|
||||
} else {
|
||||
ERR_print_errors(bio_err);
|
||||
/* because exit codes above 127 have special meaning on Unix */
|
||||
if (++ret > 127)
|
||||
ret = 127;
|
||||
}
|
||||
}
|
||||
|
||||
end:
|
||||
|
||||
ERR_print_errors(bio_err);
|
||||
sk_OPENSSL_CSTRING_free(engines);
|
||||
sk_OPENSSL_STRING_free(pre_cmds);
|
||||
sk_OPENSSL_STRING_free(post_cmds);
|
||||
BIO_free_all(out);
|
||||
return (ret);
|
||||
}
|
||||
#endif
|
||||
@@ -1,67 +0,0 @@
|
||||
/*
|
||||
* Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include "apps.h"
|
||||
#include <openssl/bio.h>
|
||||
#include <openssl/lhash.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/ssl.h>
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP
|
||||
} OPTION_CHOICE;
|
||||
|
||||
OPTIONS errstr_options[] = {
|
||||
{OPT_HELP_STR, 1, '-', "Usage: %s [options] errnum...\n"},
|
||||
{OPT_HELP_STR, 1, '-', " errnum Error number\n"},
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{NULL}
|
||||
};
|
||||
|
||||
int errstr_main(int argc, char **argv)
|
||||
{
|
||||
OPTION_CHOICE o;
|
||||
char buf[256], *prog;
|
||||
int ret = 1;
|
||||
unsigned long l;
|
||||
|
||||
prog = opt_init(argc, argv, errstr_options);
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
switch (o) {
|
||||
case OPT_EOF:
|
||||
case OPT_ERR:
|
||||
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
||||
goto end;
|
||||
case OPT_HELP:
|
||||
opt_help(errstr_options);
|
||||
ret = 0;
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
ret = 0;
|
||||
for (argv = opt_rest(); *argv; argv++) {
|
||||
if (sscanf(*argv, "%lx", &l) == 0)
|
||||
ret++;
|
||||
else {
|
||||
/* We're not really an SSL application so this won't auto-init, but
|
||||
* we're still interested in SSL error strings
|
||||
*/
|
||||
OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
|
||||
| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
|
||||
ERR_error_string_n(l, buf, sizeof(buf));
|
||||
BIO_printf(bio_out, "%s\n", buf);
|
||||
}
|
||||
}
|
||||
end:
|
||||
return (ret);
|
||||
}
|
||||
147
apps/gendsa.c
147
apps/gendsa.c
@@ -1,147 +0,0 @@
|
||||
/*
|
||||
* Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include <openssl/opensslconf.h>
|
||||
#ifdef OPENSSL_NO_DSA
|
||||
NON_EMPTY_TRANSLATION_UNIT
|
||||
#else
|
||||
|
||||
# include <stdio.h>
|
||||
# include <string.h>
|
||||
# include <sys/types.h>
|
||||
# include <sys/stat.h>
|
||||
# include "apps.h"
|
||||
# include <openssl/bio.h>
|
||||
# include <openssl/err.h>
|
||||
# include <openssl/bn.h>
|
||||
# include <openssl/dsa.h>
|
||||
# include <openssl/x509.h>
|
||||
# include <openssl/pem.h>
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_OUT, OPT_PASSOUT, OPT_ENGINE, OPT_RAND, OPT_CIPHER
|
||||
} OPTION_CHOICE;
|
||||
|
||||
OPTIONS gendsa_options[] = {
|
||||
{OPT_HELP_STR, 1, '-', "Usage: %s [args] dsaparam-file\n"},
|
||||
{OPT_HELP_STR, 1, '-', "Valid options are:\n"},
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"out", OPT_OUT, '>', "Output the key to the specified file"},
|
||||
{"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
|
||||
{"rand", OPT_RAND, 's',
|
||||
"Load the file(s) into the random number generator"},
|
||||
{"", OPT_CIPHER, '-', "Encrypt the output with any supported cipher"},
|
||||
# ifndef OPENSSL_NO_ENGINE
|
||||
{"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
|
||||
# endif
|
||||
{NULL}
|
||||
};
|
||||
|
||||
int gendsa_main(int argc, char **argv)
|
||||
{
|
||||
ENGINE *e = NULL;
|
||||
BIO *out = NULL, *in = NULL;
|
||||
DSA *dsa = NULL;
|
||||
const EVP_CIPHER *enc = NULL;
|
||||
char *inrand = NULL, *dsaparams = NULL;
|
||||
char *outfile = NULL, *passoutarg = NULL, *passout = NULL, *prog;
|
||||
OPTION_CHOICE o;
|
||||
int ret = 1, private = 0;
|
||||
const BIGNUM *p = NULL;
|
||||
|
||||
prog = opt_init(argc, argv, gendsa_options);
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
switch (o) {
|
||||
case OPT_EOF:
|
||||
case OPT_ERR:
|
||||
opthelp:
|
||||
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
||||
goto end;
|
||||
case OPT_HELP:
|
||||
ret = 0;
|
||||
opt_help(gendsa_options);
|
||||
goto end;
|
||||
case OPT_OUT:
|
||||
outfile = opt_arg();
|
||||
break;
|
||||
case OPT_PASSOUT:
|
||||
passoutarg = opt_arg();
|
||||
break;
|
||||
case OPT_ENGINE:
|
||||
e = setup_engine(opt_arg(), 0);
|
||||
break;
|
||||
case OPT_RAND:
|
||||
inrand = opt_arg();
|
||||
break;
|
||||
case OPT_CIPHER:
|
||||
if (!opt_cipher(opt_unknown(), &enc))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
argv = opt_rest();
|
||||
private = 1;
|
||||
|
||||
if (argc != 1)
|
||||
goto opthelp;
|
||||
dsaparams = *argv;
|
||||
|
||||
if (!app_passwd(NULL, passoutarg, NULL, &passout)) {
|
||||
BIO_printf(bio_err, "Error getting password\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
in = bio_open_default(dsaparams, 'r', FORMAT_PEM);
|
||||
if (in == NULL)
|
||||
goto end2;
|
||||
|
||||
if ((dsa = PEM_read_bio_DSAparams(in, NULL, NULL, NULL)) == NULL) {
|
||||
BIO_printf(bio_err, "unable to load DSA parameter file\n");
|
||||
goto end;
|
||||
}
|
||||
BIO_free(in);
|
||||
in = NULL;
|
||||
|
||||
out = bio_open_owner(outfile, FORMAT_PEM, private);
|
||||
if (out == NULL)
|
||||
goto end2;
|
||||
|
||||
if (!app_RAND_load_file(NULL, 1) && inrand == NULL) {
|
||||
BIO_printf(bio_err,
|
||||
"warning, not much extra random data, consider using the -rand option\n");
|
||||
}
|
||||
if (inrand != NULL)
|
||||
BIO_printf(bio_err, "%ld semi-random bytes loaded\n",
|
||||
app_RAND_load_files(inrand));
|
||||
|
||||
DSA_get0_pqg(dsa, &p, NULL, NULL);
|
||||
BIO_printf(bio_err, "Generating DSA key, %d bits\n", BN_num_bits(p));
|
||||
if (!DSA_generate_key(dsa))
|
||||
goto end;
|
||||
|
||||
app_RAND_write_file(NULL);
|
||||
|
||||
assert(private);
|
||||
if (!PEM_write_bio_DSAPrivateKey(out, dsa, enc, NULL, 0, NULL, passout))
|
||||
goto end;
|
||||
ret = 0;
|
||||
end:
|
||||
if (ret != 0)
|
||||
ERR_print_errors(bio_err);
|
||||
end2:
|
||||
BIO_free(in);
|
||||
BIO_free_all(out);
|
||||
DSA_free(dsa);
|
||||
release_engine(e);
|
||||
OPENSSL_free(passout);
|
||||
return (ret);
|
||||
}
|
||||
#endif
|
||||
314
apps/genpkey.c
314
apps/genpkey.c
@@ -1,314 +0,0 @@
|
||||
/*
|
||||
* Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include "apps.h"
|
||||
#include <openssl/pem.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/evp.h>
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
# include <openssl/engine.h>
|
||||
#endif
|
||||
|
||||
static int init_keygen_file(EVP_PKEY_CTX **pctx, const char *file, ENGINE *e);
|
||||
static int genpkey_cb(EVP_PKEY_CTX *ctx);
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_ENGINE, OPT_OUTFORM, OPT_OUT, OPT_PASS, OPT_PARAMFILE,
|
||||
OPT_ALGORITHM, OPT_PKEYOPT, OPT_GENPARAM, OPT_TEXT, OPT_CIPHER
|
||||
} OPTION_CHOICE;
|
||||
|
||||
OPTIONS genpkey_options[] = {
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"out", OPT_OUT, '>', "Output file"},
|
||||
{"outform", OPT_OUTFORM, 'F', "output format (DER or PEM)"},
|
||||
{"pass", OPT_PASS, 's', "Output file pass phrase source"},
|
||||
{"paramfile", OPT_PARAMFILE, '<', "Parameters file"},
|
||||
{"algorithm", OPT_ALGORITHM, 's', "The public key algorithm"},
|
||||
{"pkeyopt", OPT_PKEYOPT, 's',
|
||||
"Set the public key algorithm option as opt:value"},
|
||||
{"genparam", OPT_GENPARAM, '-', "Generate parameters, not key"},
|
||||
{"text", OPT_TEXT, '-', "Print the in text"},
|
||||
{"", OPT_CIPHER, '-', "Cipher to use to encrypt the key"},
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
{"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
|
||||
#endif
|
||||
/* This is deliberately last. */
|
||||
{OPT_HELP_STR, 1, 1,
|
||||
"Order of options may be important! See the documentation.\n"},
|
||||
{NULL}
|
||||
};
|
||||
|
||||
int genpkey_main(int argc, char **argv)
|
||||
{
|
||||
BIO *in = NULL, *out = NULL;
|
||||
ENGINE *e = NULL;
|
||||
EVP_PKEY *pkey = NULL;
|
||||
EVP_PKEY_CTX *ctx = NULL;
|
||||
char *outfile = NULL, *passarg = NULL, *pass = NULL, *prog;
|
||||
const EVP_CIPHER *cipher = NULL;
|
||||
OPTION_CHOICE o;
|
||||
int outformat = FORMAT_PEM, text = 0, ret = 1, rv, do_param = 0;
|
||||
int private = 0;
|
||||
|
||||
prog = opt_init(argc, argv, genpkey_options);
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
switch (o) {
|
||||
case OPT_EOF:
|
||||
case OPT_ERR:
|
||||
opthelp:
|
||||
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
||||
goto end;
|
||||
case OPT_HELP:
|
||||
ret = 0;
|
||||
opt_help(genpkey_options);
|
||||
goto end;
|
||||
case OPT_OUTFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &outformat))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_OUT:
|
||||
outfile = opt_arg();
|
||||
break;
|
||||
case OPT_PASS:
|
||||
passarg = opt_arg();
|
||||
break;
|
||||
case OPT_ENGINE:
|
||||
e = setup_engine(opt_arg(), 0);
|
||||
break;
|
||||
case OPT_PARAMFILE:
|
||||
if (do_param == 1)
|
||||
goto opthelp;
|
||||
if (!init_keygen_file(&ctx, opt_arg(), e))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_ALGORITHM:
|
||||
if (!init_gen_str(&ctx, opt_arg(), e, do_param))
|
||||
goto end;
|
||||
break;
|
||||
case OPT_PKEYOPT:
|
||||
if (ctx == NULL) {
|
||||
BIO_printf(bio_err, "%s: No keytype specified.\n", prog);
|
||||
goto opthelp;
|
||||
}
|
||||
if (pkey_ctrl_string(ctx, opt_arg()) <= 0) {
|
||||
BIO_printf(bio_err,
|
||||
"%s: Error setting %s parameter:\n",
|
||||
prog, opt_arg());
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
break;
|
||||
case OPT_GENPARAM:
|
||||
if (ctx != NULL)
|
||||
goto opthelp;
|
||||
do_param = 1;
|
||||
break;
|
||||
case OPT_TEXT:
|
||||
text = 1;
|
||||
break;
|
||||
case OPT_CIPHER:
|
||||
if (!opt_cipher(opt_unknown(), &cipher)
|
||||
|| do_param == 1)
|
||||
goto opthelp;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
if (argc != 0)
|
||||
goto opthelp;
|
||||
|
||||
private = do_param ? 0 : 1;
|
||||
|
||||
if (ctx == NULL)
|
||||
goto opthelp;
|
||||
|
||||
if (!app_passwd(passarg, NULL, &pass, NULL)) {
|
||||
BIO_puts(bio_err, "Error getting password\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
out = bio_open_owner(outfile, outformat, private);
|
||||
if (out == NULL)
|
||||
goto end;
|
||||
|
||||
EVP_PKEY_CTX_set_cb(ctx, genpkey_cb);
|
||||
EVP_PKEY_CTX_set_app_data(ctx, bio_err);
|
||||
|
||||
if (do_param) {
|
||||
if (EVP_PKEY_paramgen(ctx, &pkey) <= 0) {
|
||||
BIO_puts(bio_err, "Error generating parameters\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
} else {
|
||||
if (EVP_PKEY_keygen(ctx, &pkey) <= 0) {
|
||||
BIO_puts(bio_err, "Error generating key\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
if (do_param)
|
||||
rv = PEM_write_bio_Parameters(out, pkey);
|
||||
else if (outformat == FORMAT_PEM) {
|
||||
assert(private);
|
||||
rv = PEM_write_bio_PrivateKey(out, pkey, cipher, NULL, 0, NULL, pass);
|
||||
} else if (outformat == FORMAT_ASN1) {
|
||||
assert(private);
|
||||
rv = i2d_PrivateKey_bio(out, pkey);
|
||||
} else {
|
||||
BIO_printf(bio_err, "Bad format specified for key\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (rv <= 0) {
|
||||
BIO_puts(bio_err, "Error writing key\n");
|
||||
ERR_print_errors(bio_err);
|
||||
}
|
||||
|
||||
if (text) {
|
||||
if (do_param)
|
||||
rv = EVP_PKEY_print_params(out, pkey, 0, NULL);
|
||||
else
|
||||
rv = EVP_PKEY_print_private(out, pkey, 0, NULL);
|
||||
|
||||
if (rv <= 0) {
|
||||
BIO_puts(bio_err, "Error printing key\n");
|
||||
ERR_print_errors(bio_err);
|
||||
}
|
||||
}
|
||||
|
||||
ret = 0;
|
||||
|
||||
end:
|
||||
EVP_PKEY_free(pkey);
|
||||
EVP_PKEY_CTX_free(ctx);
|
||||
BIO_free_all(out);
|
||||
BIO_free(in);
|
||||
release_engine(e);
|
||||
OPENSSL_free(pass);
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int init_keygen_file(EVP_PKEY_CTX **pctx, const char *file, ENGINE *e)
|
||||
{
|
||||
BIO *pbio;
|
||||
EVP_PKEY *pkey = NULL;
|
||||
EVP_PKEY_CTX *ctx = NULL;
|
||||
if (*pctx) {
|
||||
BIO_puts(bio_err, "Parameters already set!\n");
|
||||
return 0;
|
||||
}
|
||||
|
||||
pbio = BIO_new_file(file, "r");
|
||||
if (!pbio) {
|
||||
BIO_printf(bio_err, "Can't open parameter file %s\n", file);
|
||||
return 0;
|
||||
}
|
||||
|
||||
pkey = PEM_read_bio_Parameters(pbio, NULL);
|
||||
BIO_free(pbio);
|
||||
|
||||
if (!pkey) {
|
||||
BIO_printf(bio_err, "Error reading parameter file %s\n", file);
|
||||
return 0;
|
||||
}
|
||||
|
||||
ctx = EVP_PKEY_CTX_new(pkey, e);
|
||||
if (ctx == NULL)
|
||||
goto err;
|
||||
if (EVP_PKEY_keygen_init(ctx) <= 0)
|
||||
goto err;
|
||||
EVP_PKEY_free(pkey);
|
||||
*pctx = ctx;
|
||||
return 1;
|
||||
|
||||
err:
|
||||
BIO_puts(bio_err, "Error initializing context\n");
|
||||
ERR_print_errors(bio_err);
|
||||
EVP_PKEY_CTX_free(ctx);
|
||||
EVP_PKEY_free(pkey);
|
||||
return 0;
|
||||
|
||||
}
|
||||
|
||||
int init_gen_str(EVP_PKEY_CTX **pctx,
|
||||
const char *algname, ENGINE *e, int do_param)
|
||||
{
|
||||
EVP_PKEY_CTX *ctx = NULL;
|
||||
const EVP_PKEY_ASN1_METHOD *ameth;
|
||||
ENGINE *tmpeng = NULL;
|
||||
int pkey_id;
|
||||
|
||||
if (*pctx) {
|
||||
BIO_puts(bio_err, "Algorithm already set!\n");
|
||||
return 0;
|
||||
}
|
||||
|
||||
ameth = EVP_PKEY_asn1_find_str(&tmpeng, algname, -1);
|
||||
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
if (!ameth && e)
|
||||
ameth = ENGINE_get_pkey_asn1_meth_str(e, algname, -1);
|
||||
#endif
|
||||
|
||||
if (!ameth) {
|
||||
BIO_printf(bio_err, "Algorithm %s not found\n", algname);
|
||||
return 0;
|
||||
}
|
||||
|
||||
ERR_clear_error();
|
||||
|
||||
EVP_PKEY_asn1_get0_info(&pkey_id, NULL, NULL, NULL, NULL, ameth);
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
ENGINE_finish(tmpeng);
|
||||
#endif
|
||||
ctx = EVP_PKEY_CTX_new_id(pkey_id, e);
|
||||
|
||||
if (!ctx)
|
||||
goto err;
|
||||
if (do_param) {
|
||||
if (EVP_PKEY_paramgen_init(ctx) <= 0)
|
||||
goto err;
|
||||
} else {
|
||||
if (EVP_PKEY_keygen_init(ctx) <= 0)
|
||||
goto err;
|
||||
}
|
||||
|
||||
*pctx = ctx;
|
||||
return 1;
|
||||
|
||||
err:
|
||||
BIO_printf(bio_err, "Error initializing %s context\n", algname);
|
||||
ERR_print_errors(bio_err);
|
||||
EVP_PKEY_CTX_free(ctx);
|
||||
return 0;
|
||||
|
||||
}
|
||||
|
||||
static int genpkey_cb(EVP_PKEY_CTX *ctx)
|
||||
{
|
||||
char c = '*';
|
||||
BIO *b = EVP_PKEY_CTX_get_app_data(ctx);
|
||||
int p;
|
||||
p = EVP_PKEY_CTX_get_keygen_info(ctx, 0);
|
||||
if (p == 0)
|
||||
c = '.';
|
||||
if (p == 1)
|
||||
c = '+';
|
||||
if (p == 2)
|
||||
c = '*';
|
||||
if (p == 3)
|
||||
c = '\n';
|
||||
BIO_write(b, &c, 1);
|
||||
(void)BIO_flush(b);
|
||||
return 1;
|
||||
}
|
||||
198
apps/genrsa.c
198
apps/genrsa.c
@@ -1,198 +0,0 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include <openssl/opensslconf.h>
|
||||
#ifdef OPENSSL_NO_RSA
|
||||
NON_EMPTY_TRANSLATION_UNIT
|
||||
#else
|
||||
|
||||
# include <stdio.h>
|
||||
# include <string.h>
|
||||
# include <sys/types.h>
|
||||
# include <sys/stat.h>
|
||||
# include "apps.h"
|
||||
# include <openssl/bio.h>
|
||||
# include <openssl/err.h>
|
||||
# include <openssl/bn.h>
|
||||
# include <openssl/rsa.h>
|
||||
# include <openssl/evp.h>
|
||||
# include <openssl/x509.h>
|
||||
# include <openssl/pem.h>
|
||||
# include <openssl/rand.h>
|
||||
|
||||
# define DEFBITS 2048
|
||||
|
||||
static int genrsa_cb(int p, int n, BN_GENCB *cb);
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_3, OPT_F4, OPT_ENGINE,
|
||||
OPT_OUT, OPT_RAND, OPT_PASSOUT, OPT_CIPHER
|
||||
} OPTION_CHOICE;
|
||||
|
||||
OPTIONS genrsa_options[] = {
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"3", OPT_3, '-', "Use 3 for the E value"},
|
||||
{"F4", OPT_F4, '-', "Use F4 (0x10001) for the E value"},
|
||||
{"f4", OPT_F4, '-', "Use F4 (0x10001) for the E value"},
|
||||
{"out", OPT_OUT, 's', "Output the key to specified file"},
|
||||
{"rand", OPT_RAND, 's',
|
||||
"Load the file(s) into the random number generator"},
|
||||
{"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
|
||||
{"", OPT_CIPHER, '-', "Encrypt the output with any supported cipher"},
|
||||
# ifndef OPENSSL_NO_ENGINE
|
||||
{"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
|
||||
# endif
|
||||
{NULL}
|
||||
};
|
||||
|
||||
int genrsa_main(int argc, char **argv)
|
||||
{
|
||||
BN_GENCB *cb = BN_GENCB_new();
|
||||
PW_CB_DATA cb_data;
|
||||
ENGINE *eng = NULL;
|
||||
BIGNUM *bn = BN_new();
|
||||
BIO *out = NULL;
|
||||
const BIGNUM *e;
|
||||
RSA *rsa = NULL;
|
||||
const EVP_CIPHER *enc = NULL;
|
||||
int ret = 1, num = DEFBITS, private = 0;
|
||||
unsigned long f4 = RSA_F4;
|
||||
char *outfile = NULL, *passoutarg = NULL, *passout = NULL;
|
||||
char *inrand = NULL, *prog, *hexe, *dece;
|
||||
OPTION_CHOICE o;
|
||||
|
||||
if (bn == NULL || cb == NULL)
|
||||
goto end;
|
||||
|
||||
BN_GENCB_set(cb, genrsa_cb, bio_err);
|
||||
|
||||
prog = opt_init(argc, argv, genrsa_options);
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
switch (o) {
|
||||
case OPT_EOF:
|
||||
case OPT_ERR:
|
||||
opthelp:
|
||||
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
||||
goto end;
|
||||
case OPT_HELP:
|
||||
ret = 0;
|
||||
opt_help(genrsa_options);
|
||||
goto end;
|
||||
case OPT_3:
|
||||
f4 = 3;
|
||||
break;
|
||||
case OPT_F4:
|
||||
f4 = RSA_F4;
|
||||
break;
|
||||
case OPT_OUT:
|
||||
outfile = opt_arg();
|
||||
break;
|
||||
case OPT_ENGINE:
|
||||
eng = setup_engine(opt_arg(), 0);
|
||||
break;
|
||||
case OPT_RAND:
|
||||
inrand = opt_arg();
|
||||
break;
|
||||
case OPT_PASSOUT:
|
||||
passoutarg = opt_arg();
|
||||
break;
|
||||
case OPT_CIPHER:
|
||||
if (!opt_cipher(opt_unknown(), &enc))
|
||||
goto end;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
argv = opt_rest();
|
||||
|
||||
if (argc == 1) {
|
||||
if (!opt_int(argv[0], &num) || num <= 0)
|
||||
goto end;
|
||||
} else if (argc > 0) {
|
||||
BIO_printf(bio_err, "Extra arguments given.\n");
|
||||
goto opthelp;
|
||||
}
|
||||
|
||||
private = 1;
|
||||
if (!app_passwd(NULL, passoutarg, NULL, &passout)) {
|
||||
BIO_printf(bio_err, "Error getting password\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
out = bio_open_owner(outfile, FORMAT_PEM, private);
|
||||
if (out == NULL)
|
||||
goto end;
|
||||
|
||||
if (!app_RAND_load_file(NULL, 1) && inrand == NULL
|
||||
&& !RAND_status()) {
|
||||
BIO_printf(bio_err,
|
||||
"warning, not much extra random data, consider using the -rand option\n");
|
||||
}
|
||||
if (inrand != NULL)
|
||||
BIO_printf(bio_err, "%ld semi-random bytes loaded\n",
|
||||
app_RAND_load_files(inrand));
|
||||
|
||||
BIO_printf(bio_err, "Generating RSA private key, %d bit long modulus\n",
|
||||
num);
|
||||
rsa = eng ? RSA_new_method(eng) : RSA_new();
|
||||
if (rsa == NULL)
|
||||
goto end;
|
||||
|
||||
if (!BN_set_word(bn, f4) || !RSA_generate_key_ex(rsa, num, bn, cb))
|
||||
goto end;
|
||||
|
||||
app_RAND_write_file(NULL);
|
||||
|
||||
RSA_get0_key(rsa, NULL, &e, NULL);
|
||||
hexe = BN_bn2hex(e);
|
||||
dece = BN_bn2dec(e);
|
||||
if (hexe && dece) {
|
||||
BIO_printf(bio_err, "e is %s (0x%s)\n", dece, hexe);
|
||||
}
|
||||
OPENSSL_free(hexe);
|
||||
OPENSSL_free(dece);
|
||||
cb_data.password = passout;
|
||||
cb_data.prompt_info = outfile;
|
||||
assert(private);
|
||||
if (!PEM_write_bio_RSAPrivateKey(out, rsa, enc, NULL, 0,
|
||||
(pem_password_cb *)password_callback,
|
||||
&cb_data))
|
||||
goto end;
|
||||
|
||||
ret = 0;
|
||||
end:
|
||||
BN_free(bn);
|
||||
BN_GENCB_free(cb);
|
||||
RSA_free(rsa);
|
||||
BIO_free_all(out);
|
||||
release_engine(eng);
|
||||
OPENSSL_free(passout);
|
||||
if (ret != 0)
|
||||
ERR_print_errors(bio_err);
|
||||
return (ret);
|
||||
}
|
||||
|
||||
static int genrsa_cb(int p, int n, BN_GENCB *cb)
|
||||
{
|
||||
char c = '*';
|
||||
|
||||
if (p == 0)
|
||||
c = '.';
|
||||
if (p == 1)
|
||||
c = '+';
|
||||
if (p == 2)
|
||||
c = '*';
|
||||
if (p == 3)
|
||||
c = '\n';
|
||||
BIO_write(BN_GENCB_get_arg(cb), &c, 1);
|
||||
(void)BIO_flush(BN_GENCB_get_arg(cb));
|
||||
return 1;
|
||||
}
|
||||
#endif
|
||||
113
apps/nseq.c
113
apps/nseq.c
@@ -1,113 +0,0 @@
|
||||
/*
|
||||
* Copyright 1999-2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include "apps.h"
|
||||
#include <openssl/pem.h>
|
||||
#include <openssl/err.h>
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_TOSEQ, OPT_IN, OPT_OUT
|
||||
} OPTION_CHOICE;
|
||||
|
||||
OPTIONS nseq_options[] = {
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"toseq", OPT_TOSEQ, '-', "Output NS Sequence file"},
|
||||
{"in", OPT_IN, '<', "Input file"},
|
||||
{"out", OPT_OUT, '>', "Output file"},
|
||||
{NULL}
|
||||
};
|
||||
|
||||
int nseq_main(int argc, char **argv)
|
||||
{
|
||||
BIO *in = NULL, *out = NULL;
|
||||
X509 *x509 = NULL;
|
||||
NETSCAPE_CERT_SEQUENCE *seq = NULL;
|
||||
OPTION_CHOICE o;
|
||||
int toseq = 0, ret = 1, i;
|
||||
char *infile = NULL, *outfile = NULL, *prog;
|
||||
|
||||
prog = opt_init(argc, argv, nseq_options);
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
switch (o) {
|
||||
case OPT_EOF:
|
||||
case OPT_ERR:
|
||||
opthelp:
|
||||
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
||||
goto end;
|
||||
case OPT_HELP:
|
||||
ret = 0;
|
||||
opt_help(nseq_options);
|
||||
goto end;
|
||||
case OPT_TOSEQ:
|
||||
toseq = 1;
|
||||
break;
|
||||
case OPT_IN:
|
||||
infile = opt_arg();
|
||||
break;
|
||||
case OPT_OUT:
|
||||
outfile = opt_arg();
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
if (argc != 0)
|
||||
goto opthelp;
|
||||
|
||||
in = bio_open_default(infile, 'r', FORMAT_PEM);
|
||||
if (in == NULL)
|
||||
goto end;
|
||||
out = bio_open_default(outfile, 'w', FORMAT_PEM);
|
||||
if (out == NULL)
|
||||
goto end;
|
||||
|
||||
if (toseq) {
|
||||
seq = NETSCAPE_CERT_SEQUENCE_new();
|
||||
if (seq == NULL)
|
||||
goto end;
|
||||
seq->certs = sk_X509_new_null();
|
||||
if (seq->certs == NULL)
|
||||
goto end;
|
||||
while ((x509 = PEM_read_bio_X509(in, NULL, NULL, NULL)))
|
||||
sk_X509_push(seq->certs, x509);
|
||||
|
||||
if (!sk_X509_num(seq->certs)) {
|
||||
BIO_printf(bio_err, "%s: Error reading certs file %s\n",
|
||||
prog, infile);
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
PEM_write_bio_NETSCAPE_CERT_SEQUENCE(out, seq);
|
||||
ret = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
seq = PEM_read_bio_NETSCAPE_CERT_SEQUENCE(in, NULL, NULL, NULL);
|
||||
if (seq == NULL) {
|
||||
BIO_printf(bio_err, "%s: Error reading sequence file %s\n",
|
||||
prog, infile);
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
|
||||
for (i = 0; i < sk_X509_num(seq->certs); i++) {
|
||||
x509 = sk_X509_value(seq->certs, i);
|
||||
dump_cert_text(out, x509);
|
||||
PEM_write_bio_X509(out, x509);
|
||||
}
|
||||
ret = 0;
|
||||
end:
|
||||
BIO_free(in);
|
||||
BIO_free_all(out);
|
||||
NETSCAPE_CERT_SEQUENCE_free(seq);
|
||||
|
||||
return (ret);
|
||||
}
|
||||
1289
apps/ocsp.c
1289
apps/ocsp.c
File diff suppressed because it is too large
Load Diff
@@ -1,346 +0,0 @@
|
||||
#
|
||||
# OpenSSL example configuration file.
|
||||
# This is mostly being used for generation of certificate requests.
|
||||
#
|
||||
|
||||
# This definition stops the following lines choking if HOME isn't
|
||||
# defined.
|
||||
HOME = .
|
||||
RANDFILE = $ENV::HOME/.rnd
|
||||
|
||||
# Extra OBJECT IDENTIFIER info:
|
||||
#oid_file = $ENV::HOME/.oid
|
||||
oid_section = new_oids
|
||||
|
||||
# To use this configuration file with the "-extfile" option of the
|
||||
# "openssl x509" utility, name here the section containing the
|
||||
# X.509v3 extensions to use:
|
||||
# extensions =
|
||||
# (Alternatively, use a configuration file that has only
|
||||
# X.509v3 extensions in its main [= default] section.)
|
||||
|
||||
[ new_oids ]
|
||||
|
||||
# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
|
||||
# Add a simple OID like this:
|
||||
# testoid1=1.2.3.4
|
||||
# Or use config file substitution like this:
|
||||
# testoid2=${testoid1}.5.6
|
||||
|
||||
# Policies used by the TSA examples.
|
||||
tsa_policy1 = 1.2.3.4.1
|
||||
tsa_policy2 = 1.2.3.4.5.6
|
||||
tsa_policy3 = 1.2.3.4.5.7
|
||||
|
||||
####################################################################
|
||||
[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
####################################################################
|
||||
[ CA_default ]
|
||||
|
||||
dir = sys\$disk:[.demoCA # Where everything is kept
|
||||
certs = $dir.certs] # Where the issued certs are kept
|
||||
crl_dir = $dir.crl] # Where the issued crl are kept
|
||||
database = $dir]index.txt # database index file.
|
||||
#unique_subject = no # Set to 'no' to allow creation of
|
||||
# several certs with same subject.
|
||||
new_certs_dir = $dir.newcerts] # default place for new certs.
|
||||
|
||||
certificate = $dir]cacert.pem # The CA certificate
|
||||
serial = $dir]serial. # The current serial number
|
||||
crlnumber = $dir]crlnumber. # the current crl number
|
||||
# must be commented out to leave a V1 CRL
|
||||
crl = $dir]crl.pem # The current CRL
|
||||
private_key = $dir.private]cakey.pem# The private key
|
||||
RANDFILE = $dir.private].rand # private random number file
|
||||
|
||||
x509_extensions = usr_cert # The extensions to add to the cert
|
||||
|
||||
# Comment out the following two lines for the "traditional"
|
||||
# (and highly broken) format.
|
||||
name_opt = ca_default # Subject Name options
|
||||
cert_opt = ca_default # Certificate field options
|
||||
|
||||
# Extension copying option: use with caution.
|
||||
# copy_extensions = copy
|
||||
|
||||
# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
|
||||
# so this is commented out by default to leave a V1 CRL.
|
||||
# crlnumber must also be commented out to leave a V1 CRL.
|
||||
# crl_extensions = crl_ext
|
||||
|
||||
default_days = 365 # how long to certify for
|
||||
default_crl_days= 30 # how long before next CRL
|
||||
default_md = default # use public key default MD
|
||||
preserve = no # keep passed DN ordering
|
||||
|
||||
# A few difference way of specifying how similar the request should look
|
||||
# For type CA, the listed attributes must be the same, and the optional
|
||||
# and supplied fields are just that :-)
|
||||
policy = policy_match
|
||||
|
||||
# For the CA policy
|
||||
[ policy_match ]
|
||||
countryName = match
|
||||
stateOrProvinceName = match
|
||||
organizationName = match
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
# For the 'anything' policy
|
||||
# At this point in time, you must list all acceptable 'object'
|
||||
# types.
|
||||
[ policy_anything ]
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
####################################################################
|
||||
[ req ]
|
||||
default_bits = 2048
|
||||
default_keyfile = privkey.pem
|
||||
distinguished_name = req_distinguished_name
|
||||
attributes = req_attributes
|
||||
x509_extensions = v3_ca # The extensions to add to the self signed cert
|
||||
|
||||
# Passwords for private keys if not present they will be prompted for
|
||||
# input_password = secret
|
||||
# output_password = secret
|
||||
|
||||
# This sets a mask for permitted string types. There are several options.
|
||||
# default: PrintableString, T61String, BMPString.
|
||||
# pkix : PrintableString, BMPString (PKIX recommendation before 2004)
|
||||
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
|
||||
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
|
||||
# MASK:XXXX a literal mask value.
|
||||
# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
|
||||
string_mask = utf8only
|
||||
|
||||
# req_extensions = v3_req # The extensions to add to a certificate request
|
||||
|
||||
[ req_distinguished_name ]
|
||||
countryName = Country Name (2 letter code)
|
||||
countryName_default = AU
|
||||
countryName_min = 2
|
||||
countryName_max = 2
|
||||
|
||||
stateOrProvinceName = State or Province Name (full name)
|
||||
stateOrProvinceName_default = Some-State
|
||||
|
||||
localityName = Locality Name (eg, city)
|
||||
|
||||
0.organizationName = Organization Name (eg, company)
|
||||
0.organizationName_default = Internet Widgits Pty Ltd
|
||||
|
||||
# we can do this but it is not needed normally :-)
|
||||
#1.organizationName = Second Organization Name (eg, company)
|
||||
#1.organizationName_default = World Wide Web Pty Ltd
|
||||
|
||||
organizationalUnitName = Organizational Unit Name (eg, section)
|
||||
#organizationalUnitName_default =
|
||||
|
||||
commonName = Common Name (e.g. server FQDN or YOUR name)
|
||||
commonName_max = 64
|
||||
|
||||
emailAddress = Email Address
|
||||
emailAddress_max = 64
|
||||
|
||||
# SET-ex3 = SET extension number 3
|
||||
|
||||
[ req_attributes ]
|
||||
challengePassword = A challenge password
|
||||
challengePassword_min = 4
|
||||
challengePassword_max = 20
|
||||
|
||||
unstructuredName = An optional company name
|
||||
|
||||
[ usr_cert ]
|
||||
|
||||
# These extensions are added when 'ca' signs a request.
|
||||
|
||||
# This goes against PKIX guidelines but some CAs do it and some software
|
||||
# requires this to avoid interpreting an end user certificate as a CA.
|
||||
|
||||
basicConstraints=CA:FALSE
|
||||
|
||||
# Here are some examples of the usage of nsCertType. If it is omitted
|
||||
# the certificate can be used for anything *except* object signing.
|
||||
|
||||
# This is OK for an SSL server.
|
||||
# nsCertType = server
|
||||
|
||||
# For an object signing certificate this would be used.
|
||||
# nsCertType = objsign
|
||||
|
||||
# For normal client use this is typical
|
||||
# nsCertType = client, email
|
||||
|
||||
# and for everything including object signing:
|
||||
# nsCertType = client, email, objsign
|
||||
|
||||
# This is typical in keyUsage for a client certificate.
|
||||
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
# This will be displayed in Netscape's comment listbox.
|
||||
nsComment = "OpenSSL Generated Certificate"
|
||||
|
||||
# PKIX recommendations harmless if included in all certificates.
|
||||
subjectKeyIdentifier=hash
|
||||
authorityKeyIdentifier=keyid,issuer
|
||||
|
||||
# This stuff is for subjectAltName and issuerAltname.
|
||||
# Import the email address.
|
||||
# subjectAltName=email:copy
|
||||
# An alternative to produce certificates that aren't
|
||||
# deprecated according to PKIX.
|
||||
# subjectAltName=email:move
|
||||
|
||||
# Copy subject details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
|
||||
#nsBaseUrl
|
||||
#nsRevocationUrl
|
||||
#nsRenewalUrl
|
||||
#nsCaPolicyUrl
|
||||
#nsSslServerName
|
||||
|
||||
# This is required for TSA certificates.
|
||||
# extendedKeyUsage = critical,timeStamping
|
||||
|
||||
[ v3_req ]
|
||||
|
||||
# Extensions to add to a certificate request
|
||||
|
||||
basicConstraints = CA:FALSE
|
||||
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
[ v3_ca ]
|
||||
|
||||
|
||||
# Extensions for a typical CA
|
||||
|
||||
|
||||
# PKIX recommendation.
|
||||
|
||||
subjectKeyIdentifier=hash
|
||||
|
||||
authorityKeyIdentifier=keyid:always,issuer
|
||||
|
||||
basicConstraints = critical,CA:true
|
||||
|
||||
# Key usage: this is typical for a CA certificate. However since it will
|
||||
# prevent it being used as an test self-signed certificate it is best
|
||||
# left out by default.
|
||||
# keyUsage = cRLSign, keyCertSign
|
||||
|
||||
# Some might want this also
|
||||
# nsCertType = sslCA, emailCA
|
||||
|
||||
# Include email address in subject alt name: another PKIX recommendation
|
||||
# subjectAltName=email:copy
|
||||
# Copy issuer details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
# DER hex encoding of an extension: beware experts only!
|
||||
# obj=DER:02:03
|
||||
# Where 'obj' is a standard or added object
|
||||
# You can even override a supported extension:
|
||||
# basicConstraints= critical, DER:30:03:01:01:FF
|
||||
|
||||
[ crl_ext ]
|
||||
|
||||
# CRL extensions.
|
||||
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
|
||||
|
||||
# issuerAltName=issuer:copy
|
||||
authorityKeyIdentifier=keyid:always
|
||||
|
||||
[ proxy_cert_ext ]
|
||||
# These extensions should be added when creating a proxy certificate
|
||||
|
||||
# This goes against PKIX guidelines but some CAs do it and some software
|
||||
# requires this to avoid interpreting an end user certificate as a CA.
|
||||
|
||||
basicConstraints=CA:FALSE
|
||||
|
||||
# Here are some examples of the usage of nsCertType. If it is omitted
|
||||
# the certificate can be used for anything *except* object signing.
|
||||
|
||||
# This is OK for an SSL server.
|
||||
# nsCertType = server
|
||||
|
||||
# For an object signing certificate this would be used.
|
||||
# nsCertType = objsign
|
||||
|
||||
# For normal client use this is typical
|
||||
# nsCertType = client, email
|
||||
|
||||
# and for everything including object signing:
|
||||
# nsCertType = client, email, objsign
|
||||
|
||||
# This is typical in keyUsage for a client certificate.
|
||||
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
# This will be displayed in Netscape's comment listbox.
|
||||
nsComment = "OpenSSL Generated Certificate"
|
||||
|
||||
# PKIX recommendations harmless if included in all certificates.
|
||||
subjectKeyIdentifier=hash
|
||||
authorityKeyIdentifier=keyid,issuer
|
||||
|
||||
# This stuff is for subjectAltName and issuerAltname.
|
||||
# Import the email address.
|
||||
# subjectAltName=email:copy
|
||||
# An alternative to produce certificates that aren't
|
||||
# deprecated according to PKIX.
|
||||
# subjectAltName=email:move
|
||||
|
||||
# Copy subject details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
|
||||
#nsBaseUrl
|
||||
#nsRevocationUrl
|
||||
#nsRenewalUrl
|
||||
#nsCaPolicyUrl
|
||||
#nsSslServerName
|
||||
|
||||
# This really needs to be in place for it to be a proxy certificate.
|
||||
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
|
||||
|
||||
####################################################################
|
||||
[ tsa ]
|
||||
|
||||
default_tsa = tsa_config1 # the default TSA section
|
||||
|
||||
[ tsa_config1 ]
|
||||
|
||||
# These are used by the TSA reply generation only.
|
||||
dir = sys\$disk:[.demoCA # TSA root directory
|
||||
serial = $dir]tsaserial. # The current serial number (mandatory)
|
||||
crypto_device = builtin # OpenSSL engine to use for signing
|
||||
signer_cert = $dir/tsacert.pem # The TSA signing certificate
|
||||
# (optional)
|
||||
certs = $dir.cacert.pem] # Certificate chain to include in reply
|
||||
# (optional)
|
||||
signer_key = $dir/private/tsakey.pem # The TSA private key (optional)
|
||||
signer_digest = sha256 # Signing digest to use. (Optional)
|
||||
default_policy = tsa_policy1 # Policy if request did not specify it
|
||||
# (optional)
|
||||
other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional)
|
||||
digests = sha1, sha256, sha384, sha512 # Acceptable message digests (mandatory)
|
||||
accuracy = secs:1, millisecs:500, microsecs:100 # (optional)
|
||||
clock_precision_digits = 0 # number of digits after dot. (optional)
|
||||
ordering = yes # Is ordering defined for timestamps?
|
||||
# (optional, default: no)
|
||||
tsa_name = yes # Must the TSA name be included in the reply?
|
||||
# (optional, default: no)
|
||||
ess_cert_id_chain = no # Must the ESS cert id chain be included?
|
||||
# (optional, default: no)
|
||||
703
apps/openssl.c
703
apps/openssl.c
@@ -1,703 +0,0 @@
|
||||
/*
|
||||
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
#include <openssl/bio.h>
|
||||
#include <openssl/crypto.h>
|
||||
#include <openssl/lhash.h>
|
||||
#include <openssl/conf.h>
|
||||
#include <openssl/x509.h>
|
||||
#include <openssl/pem.h>
|
||||
#include <openssl/ssl.h>
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
# include <openssl/engine.h>
|
||||
#endif
|
||||
#include <openssl/err.h>
|
||||
#ifdef OPENSSL_FIPS
|
||||
# include <openssl/fips.h>
|
||||
#endif
|
||||
#define USE_SOCKETS /* needed for the _O_BINARY defs in the MS world */
|
||||
#include "s_apps.h"
|
||||
/* Needed to get the other O_xxx flags. */
|
||||
#ifdef OPENSSL_SYS_VMS
|
||||
# include <unixio.h>
|
||||
#endif
|
||||
#define INCLUDE_FUNCTION_TABLE
|
||||
#include "apps.h"
|
||||
|
||||
|
||||
#ifdef OPENSSL_NO_CAMELLIA
|
||||
# define FORMAT "%-15s"
|
||||
# define COLUMNS 5
|
||||
#else
|
||||
# define FORMAT "%-18s"
|
||||
# define COLUMNS 4
|
||||
#endif
|
||||
|
||||
/* Special sentinel to exit the program. */
|
||||
#define EXIT_THE_PROGRAM (-1)
|
||||
|
||||
/*
|
||||
* The LHASH callbacks ("hash" & "cmp") have been replaced by functions with
|
||||
* the base prototypes (we cast each variable inside the function to the
|
||||
* required type of "FUNCTION*"). This removes the necessity for
|
||||
* macro-generated wrapper functions.
|
||||
*/
|
||||
static LHASH_OF(FUNCTION) *prog_init(void);
|
||||
static int do_cmd(LHASH_OF(FUNCTION) *prog, int argc, char *argv[]);
|
||||
static void list_pkey(void);
|
||||
static void list_type(FUNC_TYPE ft);
|
||||
static void list_disabled(void);
|
||||
char *default_config_file = NULL;
|
||||
|
||||
BIO *bio_in = NULL;
|
||||
BIO *bio_out = NULL;
|
||||
BIO *bio_err = NULL;
|
||||
|
||||
static int apps_startup()
|
||||
{
|
||||
#ifdef SIGPIPE
|
||||
signal(SIGPIPE, SIG_IGN);
|
||||
#endif
|
||||
|
||||
/* Set non-default library initialisation settings */
|
||||
if (!OPENSSL_init_ssl(OPENSSL_INIT_ENGINE_ALL_BUILTIN
|
||||
| OPENSSL_INIT_LOAD_CONFIG, NULL))
|
||||
return 0;
|
||||
|
||||
#ifndef OPENSSL_NO_UI
|
||||
setup_ui_method();
|
||||
#endif
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static void apps_shutdown()
|
||||
{
|
||||
#ifndef OPENSSL_NO_UI
|
||||
destroy_ui_method();
|
||||
#endif
|
||||
}
|
||||
|
||||
static char *make_config_name()
|
||||
{
|
||||
const char *t;
|
||||
size_t len;
|
||||
char *p;
|
||||
|
||||
if ((t = getenv("OPENSSL_CONF")) != NULL)
|
||||
return OPENSSL_strdup(t);
|
||||
|
||||
t = X509_get_default_cert_area();
|
||||
len = strlen(t) + 1 + strlen(OPENSSL_CONF) + 1;
|
||||
p = app_malloc(len, "config filename buffer");
|
||||
strcpy(p, t);
|
||||
#ifndef OPENSSL_SYS_VMS
|
||||
strcat(p, "/");
|
||||
#endif
|
||||
strcat(p, OPENSSL_CONF);
|
||||
|
||||
return p;
|
||||
}
|
||||
|
||||
int main(int argc, char *argv[])
|
||||
{
|
||||
FUNCTION f, *fp;
|
||||
LHASH_OF(FUNCTION) *prog = NULL;
|
||||
char **copied_argv = NULL;
|
||||
char *p, *pname;
|
||||
char buf[1024];
|
||||
const char *prompt;
|
||||
ARGS arg;
|
||||
int first, n, i, ret = 0;
|
||||
|
||||
arg.argv = NULL;
|
||||
arg.size = 0;
|
||||
|
||||
/* Set up some of the environment. */
|
||||
default_config_file = make_config_name();
|
||||
bio_in = dup_bio_in(FORMAT_TEXT);
|
||||
bio_out = dup_bio_out(FORMAT_TEXT);
|
||||
bio_err = dup_bio_err(FORMAT_TEXT);
|
||||
|
||||
#if defined(OPENSSL_SYS_VMS) && defined(__DECC)
|
||||
copied_argv = argv = copy_argv(&argc, argv);
|
||||
#elif defined(_WIN32)
|
||||
/*
|
||||
* Replace argv[] with UTF-8 encoded strings.
|
||||
*/
|
||||
win32_utf8argv(&argc, &argv);
|
||||
#endif
|
||||
|
||||
p = getenv("OPENSSL_DEBUG_MEMORY");
|
||||
if (p != NULL && strcmp(p, "on") == 0)
|
||||
CRYPTO_set_mem_debug(1);
|
||||
CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
|
||||
|
||||
if (getenv("OPENSSL_FIPS")) {
|
||||
#ifdef OPENSSL_FIPS
|
||||
if (!FIPS_mode_set(1)) {
|
||||
ERR_print_errors(bio_err);
|
||||
return 1;
|
||||
}
|
||||
#else
|
||||
BIO_printf(bio_err, "FIPS mode not supported.\n");
|
||||
return 1;
|
||||
#endif
|
||||
}
|
||||
|
||||
if (!apps_startup()) {
|
||||
BIO_printf(bio_err,
|
||||
"FATAL: Startup failure (dev note: apps_startup() failed)\n");
|
||||
ERR_print_errors(bio_err);
|
||||
ret = 1;
|
||||
goto end;
|
||||
}
|
||||
|
||||
prog = prog_init();
|
||||
pname = opt_progname(argv[0]);
|
||||
|
||||
/* first check the program name */
|
||||
f.name = pname;
|
||||
fp = lh_FUNCTION_retrieve(prog, &f);
|
||||
if (fp != NULL) {
|
||||
argv[0] = pname;
|
||||
ret = fp->func(argc, argv);
|
||||
goto end;
|
||||
}
|
||||
|
||||
/* If there is stuff on the command line, run with that. */
|
||||
if (argc != 1) {
|
||||
argc--;
|
||||
argv++;
|
||||
ret = do_cmd(prog, argc, argv);
|
||||
if (ret < 0)
|
||||
ret = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
/* ok, lets enter interactive mode */
|
||||
for (;;) {
|
||||
ret = 0;
|
||||
/* Read a line, continue reading if line ends with \ */
|
||||
for (p = buf, n = sizeof(buf), i = 0, first = 1; n > 0; first = 0) {
|
||||
prompt = first ? "OpenSSL> " : "> ";
|
||||
p[0] = '\0';
|
||||
#ifndef READLINE
|
||||
fputs(prompt, stdout);
|
||||
fflush(stdout);
|
||||
if (!fgets(p, n, stdin))
|
||||
goto end;
|
||||
if (p[0] == '\0')
|
||||
goto end;
|
||||
i = strlen(p);
|
||||
if (i <= 1)
|
||||
break;
|
||||
if (p[i - 2] != '\\')
|
||||
break;
|
||||
i -= 2;
|
||||
p += i;
|
||||
n -= i;
|
||||
#else
|
||||
{
|
||||
extern char *readline(const char *);
|
||||
extern void add_history(const char *cp);
|
||||
char *text;
|
||||
|
||||
text = readline(prompt);
|
||||
if (text == NULL)
|
||||
goto end;
|
||||
i = strlen(text);
|
||||
if (i == 0 || i > n)
|
||||
break;
|
||||
if (text[i - 1] != '\\') {
|
||||
p += strlen(strcpy(p, text));
|
||||
free(text);
|
||||
add_history(buf);
|
||||
break;
|
||||
}
|
||||
|
||||
text[i - 1] = '\0';
|
||||
p += strlen(strcpy(p, text));
|
||||
free(text);
|
||||
n -= i;
|
||||
}
|
||||
#endif
|
||||
}
|
||||
|
||||
if (!chopup_args(&arg, buf)) {
|
||||
BIO_printf(bio_err, "Can't parse (no memory?)\n");
|
||||
break;
|
||||
}
|
||||
|
||||
ret = do_cmd(prog, arg.argc, arg.argv);
|
||||
if (ret == EXIT_THE_PROGRAM) {
|
||||
ret = 0;
|
||||
goto end;
|
||||
}
|
||||
if (ret != 0)
|
||||
BIO_printf(bio_err, "error in %s\n", arg.argv[0]);
|
||||
(void)BIO_flush(bio_out);
|
||||
(void)BIO_flush(bio_err);
|
||||
}
|
||||
ret = 1;
|
||||
end:
|
||||
OPENSSL_free(copied_argv);
|
||||
OPENSSL_free(default_config_file);
|
||||
lh_FUNCTION_free(prog);
|
||||
OPENSSL_free(arg.argv);
|
||||
|
||||
BIO_free(bio_in);
|
||||
BIO_free_all(bio_out);
|
||||
apps_shutdown();
|
||||
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
|
||||
if (CRYPTO_mem_leaks(bio_err) <= 0)
|
||||
ret = 1;
|
||||
#endif
|
||||
BIO_free(bio_err);
|
||||
EXIT(ret);
|
||||
}
|
||||
|
||||
OPTIONS exit_options[] = {
|
||||
{NULL}
|
||||
};
|
||||
|
||||
static void list_cipher_fn(const EVP_CIPHER *c,
|
||||
const char *from, const char *to, void *arg)
|
||||
{
|
||||
if (c)
|
||||
BIO_printf(arg, "%s\n", EVP_CIPHER_name(c));
|
||||
else {
|
||||
if (!from)
|
||||
from = "<undefined>";
|
||||
if (!to)
|
||||
to = "<undefined>";
|
||||
BIO_printf(arg, "%s => %s\n", from, to);
|
||||
}
|
||||
}
|
||||
|
||||
static void list_md_fn(const EVP_MD *m,
|
||||
const char *from, const char *to, void *arg)
|
||||
{
|
||||
if (m)
|
||||
BIO_printf(arg, "%s\n", EVP_MD_name(m));
|
||||
else {
|
||||
if (!from)
|
||||
from = "<undefined>";
|
||||
if (!to)
|
||||
to = "<undefined>";
|
||||
BIO_printf((BIO *)arg, "%s => %s\n", from, to);
|
||||
}
|
||||
}
|
||||
|
||||
/* Unified enum for help and list commands. */
|
||||
typedef enum HELPLIST_CHOICE {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_COMMANDS, OPT_DIGEST_COMMANDS,
|
||||
OPT_DIGEST_ALGORITHMS, OPT_CIPHER_COMMANDS, OPT_CIPHER_ALGORITHMS,
|
||||
OPT_PK_ALGORITHMS, OPT_DISABLED
|
||||
} HELPLIST_CHOICE;
|
||||
|
||||
OPTIONS list_options[] = {
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"commands", OPT_COMMANDS, '-', "List of standard commands"},
|
||||
{"digest-commands", OPT_DIGEST_COMMANDS, '-',
|
||||
"List of message digest commands"},
|
||||
{"digest-algorithms", OPT_DIGEST_ALGORITHMS, '-',
|
||||
"List of message digest algorithms"},
|
||||
{"cipher-commands", OPT_CIPHER_COMMANDS, '-', "List of cipher commands"},
|
||||
{"cipher-algorithms", OPT_CIPHER_ALGORITHMS, '-',
|
||||
"List of cipher algorithms"},
|
||||
{"public-key-algorithms", OPT_PK_ALGORITHMS, '-',
|
||||
"List of public key algorithms"},
|
||||
{"disabled", OPT_DISABLED, '-',
|
||||
"List of disabled features"},
|
||||
{NULL}
|
||||
};
|
||||
|
||||
int list_main(int argc, char **argv)
|
||||
{
|
||||
char *prog;
|
||||
HELPLIST_CHOICE o;
|
||||
int done = 0;
|
||||
|
||||
prog = opt_init(argc, argv, list_options);
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
switch (o) {
|
||||
case OPT_EOF: /* Never hit, but suppresses warning */
|
||||
case OPT_ERR:
|
||||
opthelp:
|
||||
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
||||
return 1;
|
||||
case OPT_HELP:
|
||||
opt_help(list_options);
|
||||
break;
|
||||
case OPT_COMMANDS:
|
||||
list_type(FT_general);
|
||||
break;
|
||||
case OPT_DIGEST_COMMANDS:
|
||||
list_type(FT_md);
|
||||
break;
|
||||
case OPT_DIGEST_ALGORITHMS:
|
||||
EVP_MD_do_all_sorted(list_md_fn, bio_out);
|
||||
break;
|
||||
case OPT_CIPHER_COMMANDS:
|
||||
list_type(FT_cipher);
|
||||
break;
|
||||
case OPT_CIPHER_ALGORITHMS:
|
||||
EVP_CIPHER_do_all_sorted(list_cipher_fn, bio_out);
|
||||
break;
|
||||
case OPT_PK_ALGORITHMS:
|
||||
list_pkey();
|
||||
break;
|
||||
case OPT_DISABLED:
|
||||
list_disabled();
|
||||
break;
|
||||
}
|
||||
done = 1;
|
||||
}
|
||||
if (opt_num_rest() != 0) {
|
||||
BIO_printf(bio_err, "Extra arguments given.\n");
|
||||
goto opthelp;
|
||||
}
|
||||
|
||||
if (!done)
|
||||
goto opthelp;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
OPTIONS help_options[] = {
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{NULL}
|
||||
};
|
||||
|
||||
int help_main(int argc, char **argv)
|
||||
{
|
||||
FUNCTION *fp;
|
||||
int i, nl;
|
||||
FUNC_TYPE tp;
|
||||
char *prog;
|
||||
HELPLIST_CHOICE o;
|
||||
|
||||
prog = opt_init(argc, argv, help_options);
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
switch (o) {
|
||||
default:
|
||||
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
||||
return 1;
|
||||
case OPT_HELP:
|
||||
opt_help(help_options);
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
|
||||
if (opt_num_rest() != 0) {
|
||||
BIO_printf(bio_err, "Usage: %s\n", prog);
|
||||
return 1;
|
||||
}
|
||||
|
||||
BIO_printf(bio_err, "\nStandard commands");
|
||||
i = 0;
|
||||
tp = FT_none;
|
||||
for (fp = functions; fp->name != NULL; fp++) {
|
||||
nl = 0;
|
||||
if (((i++) % COLUMNS) == 0) {
|
||||
BIO_printf(bio_err, "\n");
|
||||
nl = 1;
|
||||
}
|
||||
if (fp->type != tp) {
|
||||
tp = fp->type;
|
||||
if (!nl)
|
||||
BIO_printf(bio_err, "\n");
|
||||
if (tp == FT_md) {
|
||||
i = 1;
|
||||
BIO_printf(bio_err,
|
||||
"\nMessage Digest commands (see the `dgst' command for more details)\n");
|
||||
} else if (tp == FT_cipher) {
|
||||
i = 1;
|
||||
BIO_printf(bio_err,
|
||||
"\nCipher commands (see the `enc' command for more details)\n");
|
||||
}
|
||||
}
|
||||
BIO_printf(bio_err, FORMAT, fp->name);
|
||||
}
|
||||
BIO_printf(bio_err, "\n\n");
|
||||
return 0;
|
||||
}
|
||||
|
||||
int exit_main(int argc, char **argv)
|
||||
{
|
||||
return EXIT_THE_PROGRAM;
|
||||
}
|
||||
|
||||
static void list_type(FUNC_TYPE ft)
|
||||
{
|
||||
FUNCTION *fp;
|
||||
int i = 0;
|
||||
|
||||
for (fp = functions; fp->name != NULL; fp++)
|
||||
if (fp->type == ft) {
|
||||
if ((i++ % COLUMNS) == 0)
|
||||
BIO_printf(bio_out, "\n");
|
||||
BIO_printf(bio_out, FORMAT, fp->name);
|
||||
}
|
||||
BIO_printf(bio_out, "\n");
|
||||
}
|
||||
|
||||
static int do_cmd(LHASH_OF(FUNCTION) *prog, int argc, char *argv[])
|
||||
{
|
||||
FUNCTION f, *fp;
|
||||
|
||||
if (argc <= 0 || argv[0] == NULL)
|
||||
return (0);
|
||||
f.name = argv[0];
|
||||
fp = lh_FUNCTION_retrieve(prog, &f);
|
||||
if (fp == NULL) {
|
||||
if (EVP_get_digestbyname(argv[0])) {
|
||||
f.type = FT_md;
|
||||
f.func = dgst_main;
|
||||
fp = &f;
|
||||
} else if (EVP_get_cipherbyname(argv[0])) {
|
||||
f.type = FT_cipher;
|
||||
f.func = enc_main;
|
||||
fp = &f;
|
||||
}
|
||||
}
|
||||
if (fp != NULL) {
|
||||
return (fp->func(argc, argv));
|
||||
}
|
||||
if ((strncmp(argv[0], "no-", 3)) == 0) {
|
||||
/*
|
||||
* User is asking if foo is unsupported, by trying to "run" the
|
||||
* no-foo command. Strange.
|
||||
*/
|
||||
f.name = argv[0] + 3;
|
||||
if (lh_FUNCTION_retrieve(prog, &f) == NULL) {
|
||||
BIO_printf(bio_out, "%s\n", argv[0]);
|
||||
return (0);
|
||||
}
|
||||
BIO_printf(bio_out, "%s\n", argv[0] + 3);
|
||||
return 1;
|
||||
}
|
||||
if (strcmp(argv[0], "quit") == 0 || strcmp(argv[0], "q") == 0 ||
|
||||
strcmp(argv[0], "exit") == 0 || strcmp(argv[0], "bye") == 0)
|
||||
/* Special value to mean "exit the program. */
|
||||
return EXIT_THE_PROGRAM;
|
||||
|
||||
BIO_printf(bio_err, "Invalid command '%s'; type \"help\" for a list.\n",
|
||||
argv[0]);
|
||||
return (1);
|
||||
}
|
||||
|
||||
static void list_pkey(void)
|
||||
{
|
||||
int i;
|
||||
|
||||
for (i = 0; i < EVP_PKEY_asn1_get_count(); i++) {
|
||||
const EVP_PKEY_ASN1_METHOD *ameth;
|
||||
int pkey_id, pkey_base_id, pkey_flags;
|
||||
const char *pinfo, *pem_str;
|
||||
ameth = EVP_PKEY_asn1_get0(i);
|
||||
EVP_PKEY_asn1_get0_info(&pkey_id, &pkey_base_id, &pkey_flags,
|
||||
&pinfo, &pem_str, ameth);
|
||||
if (pkey_flags & ASN1_PKEY_ALIAS) {
|
||||
BIO_printf(bio_out, "Name: %s\n", OBJ_nid2ln(pkey_id));
|
||||
BIO_printf(bio_out, "\tAlias for: %s\n",
|
||||
OBJ_nid2ln(pkey_base_id));
|
||||
} else {
|
||||
BIO_printf(bio_out, "Name: %s\n", pinfo);
|
||||
BIO_printf(bio_out, "\tType: %s Algorithm\n",
|
||||
pkey_flags & ASN1_PKEY_DYNAMIC ?
|
||||
"External" : "Builtin");
|
||||
BIO_printf(bio_out, "\tOID: %s\n", OBJ_nid2ln(pkey_id));
|
||||
if (pem_str == NULL)
|
||||
pem_str = "(none)";
|
||||
BIO_printf(bio_out, "\tPEM string: %s\n", pem_str);
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
static int function_cmp(const FUNCTION * a, const FUNCTION * b)
|
||||
{
|
||||
return strncmp(a->name, b->name, 8);
|
||||
}
|
||||
|
||||
static unsigned long function_hash(const FUNCTION * a)
|
||||
{
|
||||
return OPENSSL_LH_strhash(a->name);
|
||||
}
|
||||
|
||||
static int SortFnByName(const void *_f1, const void *_f2)
|
||||
{
|
||||
const FUNCTION *f1 = _f1;
|
||||
const FUNCTION *f2 = _f2;
|
||||
|
||||
if (f1->type != f2->type)
|
||||
return f1->type - f2->type;
|
||||
return strcmp(f1->name, f2->name);
|
||||
}
|
||||
|
||||
static void list_disabled(void)
|
||||
{
|
||||
BIO_puts(bio_out, "Disabled algorithms:\n");
|
||||
#ifdef OPENSSL_NO_BF
|
||||
BIO_puts(bio_out, "BF\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_BLAKE2
|
||||
BIO_puts(bio_out, "BLAKE2\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_CAMELLIA
|
||||
BIO_puts(bio_out, "CAMELLIA\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_CAST
|
||||
BIO_puts(bio_out, "CAST\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_CMAC
|
||||
BIO_puts(bio_out, "CMAC\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_CMS
|
||||
BIO_puts(bio_out, "CMS\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_COMP
|
||||
BIO_puts(bio_out, "COMP\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_DES
|
||||
BIO_puts(bio_out, "DES\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_DGRAM
|
||||
BIO_puts(bio_out, "DGRAM\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_DH
|
||||
BIO_puts(bio_out, "DH\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_DSA
|
||||
BIO_puts(bio_out, "DSA\n");
|
||||
#endif
|
||||
#if defined(OPENSSL_NO_DTLS)
|
||||
BIO_puts(bio_out, "DTLS\n");
|
||||
#endif
|
||||
#if defined(OPENSSL_NO_DTLS1)
|
||||
BIO_puts(bio_out, "DTLS1\n");
|
||||
#endif
|
||||
#if defined(OPENSSL_NO_DTLS1_2)
|
||||
BIO_puts(bio_out, "DTLS1_2\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_EC
|
||||
BIO_puts(bio_out, "EC\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_EC2M
|
||||
BIO_puts(bio_out, "EC2M\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_ENGINE
|
||||
BIO_puts(bio_out, "ENGINE\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_GOST
|
||||
BIO_puts(bio_out, "GOST\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_HEARTBEATS
|
||||
BIO_puts(bio_out, "HEARTBEATS\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_IDEA
|
||||
BIO_puts(bio_out, "IDEA\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_MD2
|
||||
BIO_puts(bio_out, "MD2\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_MD4
|
||||
BIO_puts(bio_out, "MD4\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_MD5
|
||||
BIO_puts(bio_out, "MD5\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_MDC2
|
||||
BIO_puts(bio_out, "MDC2\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_OCB
|
||||
BIO_puts(bio_out, "OCB\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_OCSP
|
||||
BIO_puts(bio_out, "OCSP\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_PSK
|
||||
BIO_puts(bio_out, "PSK\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_RC2
|
||||
BIO_puts(bio_out, "RC2\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_RC4
|
||||
BIO_puts(bio_out, "RC4\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_RC5
|
||||
BIO_puts(bio_out, "RC5\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_RMD160
|
||||
BIO_puts(bio_out, "RMD160\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_RSA
|
||||
BIO_puts(bio_out, "RSA\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_SCRYPT
|
||||
BIO_puts(bio_out, "SCRYPT\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_SCTP
|
||||
BIO_puts(bio_out, "SCTP\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_SEED
|
||||
BIO_puts(bio_out, "SEED\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_SOCK
|
||||
BIO_puts(bio_out, "SOCK\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_SRP
|
||||
BIO_puts(bio_out, "SRP\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_SRTP
|
||||
BIO_puts(bio_out, "SRTP\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_SSL3
|
||||
BIO_puts(bio_out, "SSL3\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_TLS1
|
||||
BIO_puts(bio_out, "TLS1\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_TLS1_1
|
||||
BIO_puts(bio_out, "TLS1_1\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_TLS1_2
|
||||
BIO_puts(bio_out, "TLS1_2\n");
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_WHIRLPOOL
|
||||
BIO_puts(bio_out, "WHIRLPOOL\n");
|
||||
#endif
|
||||
#ifndef ZLIB
|
||||
BIO_puts(bio_out, "ZLIB\n");
|
||||
#endif
|
||||
}
|
||||
|
||||
static LHASH_OF(FUNCTION) *prog_init(void)
|
||||
{
|
||||
LHASH_OF(FUNCTION) *ret;
|
||||
FUNCTION *f;
|
||||
size_t i;
|
||||
|
||||
/* Sort alphabetically within category. For nicer help displays. */
|
||||
for (i = 0, f = functions; f->name != NULL; ++f, ++i) ;
|
||||
qsort(functions, i, sizeof(*functions), SortFnByName);
|
||||
|
||||
if ((ret = lh_FUNCTION_new(function_hash, function_cmp)) == NULL)
|
||||
return (NULL);
|
||||
|
||||
for (f = functions; f->name != NULL; f++)
|
||||
(void)lh_FUNCTION_insert(ret, f);
|
||||
return (ret);
|
||||
}
|
||||
346
apps/openssl.cnf
346
apps/openssl.cnf
@@ -1,346 +0,0 @@
|
||||
#
|
||||
# OpenSSL example configuration file.
|
||||
# This is mostly being used for generation of certificate requests.
|
||||
#
|
||||
|
||||
# This definition stops the following lines choking if HOME isn't
|
||||
# defined.
|
||||
HOME = .
|
||||
RANDFILE = $ENV::HOME/.rnd
|
||||
|
||||
# Extra OBJECT IDENTIFIER info:
|
||||
#oid_file = $ENV::HOME/.oid
|
||||
oid_section = new_oids
|
||||
|
||||
# To use this configuration file with the "-extfile" option of the
|
||||
# "openssl x509" utility, name here the section containing the
|
||||
# X.509v3 extensions to use:
|
||||
# extensions =
|
||||
# (Alternatively, use a configuration file that has only
|
||||
# X.509v3 extensions in its main [= default] section.)
|
||||
|
||||
[ new_oids ]
|
||||
|
||||
# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
|
||||
# Add a simple OID like this:
|
||||
# testoid1=1.2.3.4
|
||||
# Or use config file substitution like this:
|
||||
# testoid2=${testoid1}.5.6
|
||||
|
||||
# Policies used by the TSA examples.
|
||||
tsa_policy1 = 1.2.3.4.1
|
||||
tsa_policy2 = 1.2.3.4.5.6
|
||||
tsa_policy3 = 1.2.3.4.5.7
|
||||
|
||||
####################################################################
|
||||
[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
####################################################################
|
||||
[ CA_default ]
|
||||
|
||||
dir = ./demoCA # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
database = $dir/index.txt # database index file.
|
||||
#unique_subject = no # Set to 'no' to allow creation of
|
||||
# several certs with same subject.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
|
||||
certificate = $dir/cacert.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crlnumber = $dir/crlnumber # the current crl number
|
||||
# must be commented out to leave a V1 CRL
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/private/cakey.pem# The private key
|
||||
RANDFILE = $dir/private/.rand # private random number file
|
||||
|
||||
x509_extensions = usr_cert # The extensions to add to the cert
|
||||
|
||||
# Comment out the following two lines for the "traditional"
|
||||
# (and highly broken) format.
|
||||
name_opt = ca_default # Subject Name options
|
||||
cert_opt = ca_default # Certificate field options
|
||||
|
||||
# Extension copying option: use with caution.
|
||||
# copy_extensions = copy
|
||||
|
||||
# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
|
||||
# so this is commented out by default to leave a V1 CRL.
|
||||
# crlnumber must also be commented out to leave a V1 CRL.
|
||||
# crl_extensions = crl_ext
|
||||
|
||||
default_days = 365 # how long to certify for
|
||||
default_crl_days= 30 # how long before next CRL
|
||||
default_md = default # use public key default MD
|
||||
preserve = no # keep passed DN ordering
|
||||
|
||||
# A few difference way of specifying how similar the request should look
|
||||
# For type CA, the listed attributes must be the same, and the optional
|
||||
# and supplied fields are just that :-)
|
||||
policy = policy_match
|
||||
|
||||
# For the CA policy
|
||||
[ policy_match ]
|
||||
countryName = match
|
||||
stateOrProvinceName = match
|
||||
organizationName = match
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
# For the 'anything' policy
|
||||
# At this point in time, you must list all acceptable 'object'
|
||||
# types.
|
||||
[ policy_anything ]
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
####################################################################
|
||||
[ req ]
|
||||
default_bits = 2048
|
||||
default_keyfile = privkey.pem
|
||||
distinguished_name = req_distinguished_name
|
||||
attributes = req_attributes
|
||||
x509_extensions = v3_ca # The extensions to add to the self signed cert
|
||||
|
||||
# Passwords for private keys if not present they will be prompted for
|
||||
# input_password = secret
|
||||
# output_password = secret
|
||||
|
||||
# This sets a mask for permitted string types. There are several options.
|
||||
# default: PrintableString, T61String, BMPString.
|
||||
# pkix : PrintableString, BMPString (PKIX recommendation before 2004)
|
||||
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
|
||||
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
|
||||
# MASK:XXXX a literal mask value.
|
||||
# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
|
||||
string_mask = utf8only
|
||||
|
||||
# req_extensions = v3_req # The extensions to add to a certificate request
|
||||
|
||||
[ req_distinguished_name ]
|
||||
countryName = Country Name (2 letter code)
|
||||
countryName_default = AU
|
||||
countryName_min = 2
|
||||
countryName_max = 2
|
||||
|
||||
stateOrProvinceName = State or Province Name (full name)
|
||||
stateOrProvinceName_default = Some-State
|
||||
|
||||
localityName = Locality Name (eg, city)
|
||||
|
||||
0.organizationName = Organization Name (eg, company)
|
||||
0.organizationName_default = Internet Widgits Pty Ltd
|
||||
|
||||
# we can do this but it is not needed normally :-)
|
||||
#1.organizationName = Second Organization Name (eg, company)
|
||||
#1.organizationName_default = World Wide Web Pty Ltd
|
||||
|
||||
organizationalUnitName = Organizational Unit Name (eg, section)
|
||||
#organizationalUnitName_default =
|
||||
|
||||
commonName = Common Name (e.g. server FQDN or YOUR name)
|
||||
commonName_max = 64
|
||||
|
||||
emailAddress = Email Address
|
||||
emailAddress_max = 64
|
||||
|
||||
# SET-ex3 = SET extension number 3
|
||||
|
||||
[ req_attributes ]
|
||||
challengePassword = A challenge password
|
||||
challengePassword_min = 4
|
||||
challengePassword_max = 20
|
||||
|
||||
unstructuredName = An optional company name
|
||||
|
||||
[ usr_cert ]
|
||||
|
||||
# These extensions are added when 'ca' signs a request.
|
||||
|
||||
# This goes against PKIX guidelines but some CAs do it and some software
|
||||
# requires this to avoid interpreting an end user certificate as a CA.
|
||||
|
||||
basicConstraints=CA:FALSE
|
||||
|
||||
# Here are some examples of the usage of nsCertType. If it is omitted
|
||||
# the certificate can be used for anything *except* object signing.
|
||||
|
||||
# This is OK for an SSL server.
|
||||
# nsCertType = server
|
||||
|
||||
# For an object signing certificate this would be used.
|
||||
# nsCertType = objsign
|
||||
|
||||
# For normal client use this is typical
|
||||
# nsCertType = client, email
|
||||
|
||||
# and for everything including object signing:
|
||||
# nsCertType = client, email, objsign
|
||||
|
||||
# This is typical in keyUsage for a client certificate.
|
||||
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
# This will be displayed in Netscape's comment listbox.
|
||||
nsComment = "OpenSSL Generated Certificate"
|
||||
|
||||
# PKIX recommendations harmless if included in all certificates.
|
||||
subjectKeyIdentifier=hash
|
||||
authorityKeyIdentifier=keyid,issuer
|
||||
|
||||
# This stuff is for subjectAltName and issuerAltname.
|
||||
# Import the email address.
|
||||
# subjectAltName=email:copy
|
||||
# An alternative to produce certificates that aren't
|
||||
# deprecated according to PKIX.
|
||||
# subjectAltName=email:move
|
||||
|
||||
# Copy subject details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
|
||||
#nsBaseUrl
|
||||
#nsRevocationUrl
|
||||
#nsRenewalUrl
|
||||
#nsCaPolicyUrl
|
||||
#nsSslServerName
|
||||
|
||||
# This is required for TSA certificates.
|
||||
# extendedKeyUsage = critical,timeStamping
|
||||
|
||||
[ v3_req ]
|
||||
|
||||
# Extensions to add to a certificate request
|
||||
|
||||
basicConstraints = CA:FALSE
|
||||
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
[ v3_ca ]
|
||||
|
||||
|
||||
# Extensions for a typical CA
|
||||
|
||||
|
||||
# PKIX recommendation.
|
||||
|
||||
subjectKeyIdentifier=hash
|
||||
|
||||
authorityKeyIdentifier=keyid:always,issuer
|
||||
|
||||
basicConstraints = critical,CA:true
|
||||
|
||||
# Key usage: this is typical for a CA certificate. However since it will
|
||||
# prevent it being used as an test self-signed certificate it is best
|
||||
# left out by default.
|
||||
# keyUsage = cRLSign, keyCertSign
|
||||
|
||||
# Some might want this also
|
||||
# nsCertType = sslCA, emailCA
|
||||
|
||||
# Include email address in subject alt name: another PKIX recommendation
|
||||
# subjectAltName=email:copy
|
||||
# Copy issuer details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
# DER hex encoding of an extension: beware experts only!
|
||||
# obj=DER:02:03
|
||||
# Where 'obj' is a standard or added object
|
||||
# You can even override a supported extension:
|
||||
# basicConstraints= critical, DER:30:03:01:01:FF
|
||||
|
||||
[ crl_ext ]
|
||||
|
||||
# CRL extensions.
|
||||
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
|
||||
|
||||
# issuerAltName=issuer:copy
|
||||
authorityKeyIdentifier=keyid:always
|
||||
|
||||
[ proxy_cert_ext ]
|
||||
# These extensions should be added when creating a proxy certificate
|
||||
|
||||
# This goes against PKIX guidelines but some CAs do it and some software
|
||||
# requires this to avoid interpreting an end user certificate as a CA.
|
||||
|
||||
basicConstraints=CA:FALSE
|
||||
|
||||
# Here are some examples of the usage of nsCertType. If it is omitted
|
||||
# the certificate can be used for anything *except* object signing.
|
||||
|
||||
# This is OK for an SSL server.
|
||||
# nsCertType = server
|
||||
|
||||
# For an object signing certificate this would be used.
|
||||
# nsCertType = objsign
|
||||
|
||||
# For normal client use this is typical
|
||||
# nsCertType = client, email
|
||||
|
||||
# and for everything including object signing:
|
||||
# nsCertType = client, email, objsign
|
||||
|
||||
# This is typical in keyUsage for a client certificate.
|
||||
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
# This will be displayed in Netscape's comment listbox.
|
||||
nsComment = "OpenSSL Generated Certificate"
|
||||
|
||||
# PKIX recommendations harmless if included in all certificates.
|
||||
subjectKeyIdentifier=hash
|
||||
authorityKeyIdentifier=keyid,issuer
|
||||
|
||||
# This stuff is for subjectAltName and issuerAltname.
|
||||
# Import the email address.
|
||||
# subjectAltName=email:copy
|
||||
# An alternative to produce certificates that aren't
|
||||
# deprecated according to PKIX.
|
||||
# subjectAltName=email:move
|
||||
|
||||
# Copy subject details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
|
||||
#nsBaseUrl
|
||||
#nsRevocationUrl
|
||||
#nsRenewalUrl
|
||||
#nsCaPolicyUrl
|
||||
#nsSslServerName
|
||||
|
||||
# This really needs to be in place for it to be a proxy certificate.
|
||||
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
|
||||
|
||||
####################################################################
|
||||
[ tsa ]
|
||||
|
||||
default_tsa = tsa_config1 # the default TSA section
|
||||
|
||||
[ tsa_config1 ]
|
||||
|
||||
# These are used by the TSA reply generation only.
|
||||
dir = ./demoCA # TSA root directory
|
||||
serial = $dir/tsaserial # The current serial number (mandatory)
|
||||
crypto_device = builtin # OpenSSL engine to use for signing
|
||||
signer_cert = $dir/tsacert.pem # The TSA signing certificate
|
||||
# (optional)
|
||||
certs = $dir/cacert.pem # Certificate chain to include in reply
|
||||
# (optional)
|
||||
signer_key = $dir/private/tsakey.pem # The TSA private key (optional)
|
||||
signer_digest = sha256 # Signing digest to use. (Optional)
|
||||
default_policy = tsa_policy1 # Policy if request did not specify it
|
||||
# (optional)
|
||||
other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional)
|
||||
digests = sha1, sha256, sha384, sha512 # Acceptable message digests (mandatory)
|
||||
accuracy = secs:1, millisecs:500, microsecs:100 # (optional)
|
||||
clock_precision_digits = 0 # number of digits after dot. (optional)
|
||||
ordering = yes # Is ordering defined for timestamps?
|
||||
# (optional, default: no)
|
||||
tsa_name = yes # Must the TSA name be included in the reply?
|
||||
# (optional, default: no)
|
||||
ess_cert_id_chain = no # Must the ESS cert id chain be included?
|
||||
# (optional, default: no)
|
||||
977
apps/opt.c
977
apps/opt.c
@@ -1,977 +0,0 @@
|
||||
/*
|
||||
* Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
/* #define COMPILE_STANDALONE_TEST_DRIVER */
|
||||
#include "apps.h"
|
||||
#include <string.h>
|
||||
#if !defined(OPENSSL_SYS_MSDOS)
|
||||
# include OPENSSL_UNISTD
|
||||
#endif
|
||||
|
||||
#include <stdlib.h>
|
||||
#include <errno.h>
|
||||
#include <ctype.h>
|
||||
#include <limits.h>
|
||||
#include <openssl/bio.h>
|
||||
#include <openssl/x509v3.h>
|
||||
|
||||
#define MAX_OPT_HELP_WIDTH 30
|
||||
const char OPT_HELP_STR[] = "--";
|
||||
const char OPT_MORE_STR[] = "---";
|
||||
|
||||
/* Our state */
|
||||
static char **argv;
|
||||
static int argc;
|
||||
static int opt_index;
|
||||
static char *arg;
|
||||
static char *flag;
|
||||
static char *dunno;
|
||||
static const OPTIONS *unknown;
|
||||
static const OPTIONS *opts;
|
||||
static char prog[40];
|
||||
|
||||
/*
|
||||
* Return the simple name of the program; removing various platform gunk.
|
||||
*/
|
||||
#if defined(OPENSSL_SYS_WIN32)
|
||||
char *opt_progname(const char *argv0)
|
||||
{
|
||||
size_t i, n;
|
||||
const char *p;
|
||||
char *q;
|
||||
|
||||
/* find the last '/', '\' or ':' */
|
||||
for (p = argv0 + strlen(argv0); --p > argv0;)
|
||||
if (*p == '/' || *p == '\\' || *p == ':') {
|
||||
p++;
|
||||
break;
|
||||
}
|
||||
|
||||
/* Strip off trailing nonsense. */
|
||||
n = strlen(p);
|
||||
if (n > 4 &&
|
||||
(strcmp(&p[n - 4], ".exe") == 0 || strcmp(&p[n - 4], ".EXE") == 0))
|
||||
n -= 4;
|
||||
|
||||
/* Copy over the name, in lowercase. */
|
||||
if (n > sizeof(prog) - 1)
|
||||
n = sizeof(prog) - 1;
|
||||
for (q = prog, i = 0; i < n; i++, p++)
|
||||
*q++ = tolower((unsigned char)*p);
|
||||
*q = '\0';
|
||||
return prog;
|
||||
}
|
||||
|
||||
#elif defined(OPENSSL_SYS_VMS)
|
||||
|
||||
char *opt_progname(const char *argv0)
|
||||
{
|
||||
const char *p, *q;
|
||||
|
||||
/* Find last special character sys:[foo.bar]openssl */
|
||||
for (p = argv0 + strlen(argv0); --p > argv0;)
|
||||
if (*p == ':' || *p == ']' || *p == '>') {
|
||||
p++;
|
||||
break;
|
||||
}
|
||||
|
||||
q = strrchr(p, '.');
|
||||
strncpy(prog, p, sizeof(prog) - 1);
|
||||
prog[sizeof(prog) - 1] = '\0';
|
||||
if (q != NULL && q - p < sizeof(prog))
|
||||
prog[q - p] = '\0';
|
||||
return prog;
|
||||
}
|
||||
|
||||
#else
|
||||
|
||||
char *opt_progname(const char *argv0)
|
||||
{
|
||||
const char *p;
|
||||
|
||||
/* Could use strchr, but this is like the ones above. */
|
||||
for (p = argv0 + strlen(argv0); --p > argv0;)
|
||||
if (*p == '/') {
|
||||
p++;
|
||||
break;
|
||||
}
|
||||
strncpy(prog, p, sizeof(prog) - 1);
|
||||
prog[sizeof(prog) - 1] = '\0';
|
||||
return prog;
|
||||
}
|
||||
#endif
|
||||
|
||||
char *opt_getprog(void)
|
||||
{
|
||||
return prog;
|
||||
}
|
||||
|
||||
/* Set up the arg parsing. */
|
||||
char *opt_init(int ac, char **av, const OPTIONS *o)
|
||||
{
|
||||
/* Store state. */
|
||||
argc = ac;
|
||||
argv = av;
|
||||
opt_index = 1;
|
||||
opts = o;
|
||||
opt_progname(av[0]);
|
||||
unknown = NULL;
|
||||
|
||||
for (; o->name; ++o) {
|
||||
#ifndef NDEBUG
|
||||
const OPTIONS *next;
|
||||
int duplicated, i;
|
||||
#endif
|
||||
|
||||
if (o->name == OPT_HELP_STR || o->name == OPT_MORE_STR)
|
||||
continue;
|
||||
#ifndef NDEBUG
|
||||
i = o->valtype;
|
||||
|
||||
/* Make sure options are legit. */
|
||||
assert(o->name[0] != '-');
|
||||
assert(o->retval > 0);
|
||||
switch (i) {
|
||||
case 0: case '-': case '/': case '<': case '>': case 'E': case 'F':
|
||||
case 'M': case 'U': case 'f': case 'l': case 'n': case 'p': case 's':
|
||||
case 'u': case 'c':
|
||||
break;
|
||||
default:
|
||||
assert(0);
|
||||
}
|
||||
|
||||
/* Make sure there are no duplicates. */
|
||||
for (next = o + 1; next->name; ++next) {
|
||||
/*
|
||||
* Some compilers inline strcmp and the assert string is too long.
|
||||
*/
|
||||
duplicated = strcmp(o->name, next->name) == 0;
|
||||
assert(!duplicated);
|
||||
}
|
||||
#endif
|
||||
if (o->name[0] == '\0') {
|
||||
assert(unknown == NULL);
|
||||
unknown = o;
|
||||
assert(unknown->valtype == 0 || unknown->valtype == '-');
|
||||
}
|
||||
}
|
||||
return prog;
|
||||
}
|
||||
|
||||
static OPT_PAIR formats[] = {
|
||||
{"PEM/DER", OPT_FMT_PEMDER},
|
||||
{"pkcs12", OPT_FMT_PKCS12},
|
||||
{"smime", OPT_FMT_SMIME},
|
||||
{"engine", OPT_FMT_ENGINE},
|
||||
{"msblob", OPT_FMT_MSBLOB},
|
||||
{"netscape", OPT_FMT_NETSCAPE},
|
||||
{"nss", OPT_FMT_NSS},
|
||||
{"text", OPT_FMT_TEXT},
|
||||
{"http", OPT_FMT_HTTP},
|
||||
{"pvk", OPT_FMT_PVK},
|
||||
{NULL}
|
||||
};
|
||||
|
||||
/* Print an error message about a failed format parse. */
|
||||
int opt_format_error(const char *s, unsigned long flags)
|
||||
{
|
||||
OPT_PAIR *ap;
|
||||
|
||||
if (flags == OPT_FMT_PEMDER)
|
||||
BIO_printf(bio_err, "%s: Bad format \"%s\"; must be pem or der\n",
|
||||
prog, s);
|
||||
else {
|
||||
BIO_printf(bio_err, "%s: Bad format \"%s\"; must be one of:\n",
|
||||
prog, s);
|
||||
for (ap = formats; ap->name; ap++)
|
||||
if (flags & ap->retval)
|
||||
BIO_printf(bio_err, " %s\n", ap->name);
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* Parse a format string, put it into *result; return 0 on failure, else 1. */
|
||||
int opt_format(const char *s, unsigned long flags, int *result)
|
||||
{
|
||||
switch (*s) {
|
||||
default:
|
||||
return 0;
|
||||
case 'D':
|
||||
case 'd':
|
||||
if ((flags & OPT_FMT_PEMDER) == 0)
|
||||
return opt_format_error(s, flags);
|
||||
*result = FORMAT_ASN1;
|
||||
break;
|
||||
case 'T':
|
||||
case 't':
|
||||
if ((flags & OPT_FMT_TEXT) == 0)
|
||||
return opt_format_error(s, flags);
|
||||
*result = FORMAT_TEXT;
|
||||
break;
|
||||
case 'N':
|
||||
case 'n':
|
||||
if ((flags & OPT_FMT_NSS) == 0)
|
||||
return opt_format_error(s, flags);
|
||||
if (strcmp(s, "NSS") != 0 && strcmp(s, "nss") != 0)
|
||||
return opt_format_error(s, flags);
|
||||
*result = FORMAT_NSS;
|
||||
break;
|
||||
case 'S':
|
||||
case 's':
|
||||
if ((flags & OPT_FMT_SMIME) == 0)
|
||||
return opt_format_error(s, flags);
|
||||
*result = FORMAT_SMIME;
|
||||
break;
|
||||
case 'M':
|
||||
case 'm':
|
||||
if ((flags & OPT_FMT_MSBLOB) == 0)
|
||||
return opt_format_error(s, flags);
|
||||
*result = FORMAT_MSBLOB;
|
||||
break;
|
||||
case 'E':
|
||||
case 'e':
|
||||
if ((flags & OPT_FMT_ENGINE) == 0)
|
||||
return opt_format_error(s, flags);
|
||||
*result = FORMAT_ENGINE;
|
||||
break;
|
||||
case 'H':
|
||||
case 'h':
|
||||
if ((flags & OPT_FMT_HTTP) == 0)
|
||||
return opt_format_error(s, flags);
|
||||
*result = FORMAT_HTTP;
|
||||
break;
|
||||
case '1':
|
||||
if ((flags & OPT_FMT_PKCS12) == 0)
|
||||
return opt_format_error(s, flags);
|
||||
*result = FORMAT_PKCS12;
|
||||
break;
|
||||
case 'P':
|
||||
case 'p':
|
||||
if (s[1] == '\0' || strcmp(s, "PEM") == 0 || strcmp(s, "pem") == 0) {
|
||||
if ((flags & OPT_FMT_PEMDER) == 0)
|
||||
return opt_format_error(s, flags);
|
||||
*result = FORMAT_PEM;
|
||||
} else if (strcmp(s, "PVK") == 0 || strcmp(s, "pvk") == 0) {
|
||||
if ((flags & OPT_FMT_PVK) == 0)
|
||||
return opt_format_error(s, flags);
|
||||
*result = FORMAT_PVK;
|
||||
} else if (strcmp(s, "P12") == 0 || strcmp(s, "p12") == 0
|
||||
|| strcmp(s, "PKCS12") == 0 || strcmp(s, "pkcs12") == 0) {
|
||||
if ((flags & OPT_FMT_PKCS12) == 0)
|
||||
return opt_format_error(s, flags);
|
||||
*result = FORMAT_PKCS12;
|
||||
} else
|
||||
return 0;
|
||||
break;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* Parse a cipher name, put it in *EVP_CIPHER; return 0 on failure, else 1. */
|
||||
int opt_cipher(const char *name, const EVP_CIPHER **cipherp)
|
||||
{
|
||||
*cipherp = EVP_get_cipherbyname(name);
|
||||
if (*cipherp)
|
||||
return 1;
|
||||
BIO_printf(bio_err, "%s: Unknown cipher %s\n", prog, name);
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* Parse message digest name, put it in *EVP_MD; return 0 on failure, else 1.
|
||||
*/
|
||||
int opt_md(const char *name, const EVP_MD **mdp)
|
||||
{
|
||||
*mdp = EVP_get_digestbyname(name);
|
||||
if (*mdp)
|
||||
return 1;
|
||||
BIO_printf(bio_err, "%s: Unknown digest %s\n", prog, name);
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* Look through a list of name/value pairs. */
|
||||
int opt_pair(const char *name, const OPT_PAIR* pairs, int *result)
|
||||
{
|
||||
const OPT_PAIR *pp;
|
||||
|
||||
for (pp = pairs; pp->name; pp++)
|
||||
if (strcmp(pp->name, name) == 0) {
|
||||
*result = pp->retval;
|
||||
return 1;
|
||||
}
|
||||
BIO_printf(bio_err, "%s: Value must be one of:\n", prog);
|
||||
for (pp = pairs; pp->name; pp++)
|
||||
BIO_printf(bio_err, "\t%s\n", pp->name);
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* Parse an int, put it into *result; return 0 on failure, else 1. */
|
||||
int opt_int(const char *value, int *result)
|
||||
{
|
||||
long l;
|
||||
|
||||
if (!opt_long(value, &l))
|
||||
return 0;
|
||||
*result = (int)l;
|
||||
if (*result != l) {
|
||||
BIO_printf(bio_err, "%s: Value \"%s\" outside integer range\n",
|
||||
prog, value);
|
||||
return 0;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* Parse a long, put it into *result; return 0 on failure, else 1. */
|
||||
int opt_long(const char *value, long *result)
|
||||
{
|
||||
int oerrno = errno;
|
||||
long l;
|
||||
char *endp;
|
||||
|
||||
errno = 0;
|
||||
l = strtol(value, &endp, 0);
|
||||
if (*endp
|
||||
|| endp == value
|
||||
|| ((l == LONG_MAX || l == LONG_MIN) && errno == ERANGE)
|
||||
|| (l == 0 && errno != 0)) {
|
||||
BIO_printf(bio_err, "%s: Can't parse \"%s\" as a number\n",
|
||||
prog, value);
|
||||
errno = oerrno;
|
||||
return 0;
|
||||
}
|
||||
*result = l;
|
||||
errno = oerrno;
|
||||
return 1;
|
||||
}
|
||||
|
||||
#if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 199901L && \
|
||||
defined(INTMAX_MAX) && defined(UINTMAX_MAX)
|
||||
|
||||
/* Parse an intmax_t, put it into *result; return 0 on failure, else 1. */
|
||||
int opt_imax(const char *value, intmax_t *result)
|
||||
{
|
||||
int oerrno = errno;
|
||||
intmax_t m;
|
||||
char *endp;
|
||||
|
||||
errno = 0;
|
||||
m = strtoimax(value, &endp, 0);
|
||||
if (*endp
|
||||
|| endp == value
|
||||
|| ((m == INTMAX_MAX || m == INTMAX_MIN) && errno == ERANGE)
|
||||
|| (m == 0 && errno != 0)) {
|
||||
BIO_printf(bio_err, "%s: Can't parse \"%s\" as a number\n",
|
||||
prog, value);
|
||||
errno = oerrno;
|
||||
return 0;
|
||||
}
|
||||
*result = m;
|
||||
errno = oerrno;
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* Parse a uintmax_t, put it into *result; return 0 on failure, else 1. */
|
||||
int opt_umax(const char *value, uintmax_t *result)
|
||||
{
|
||||
int oerrno = errno;
|
||||
uintmax_t m;
|
||||
char *endp;
|
||||
|
||||
errno = 0;
|
||||
m = strtoumax(value, &endp, 0);
|
||||
if (*endp
|
||||
|| endp == value
|
||||
|| (m == UINTMAX_MAX && errno == ERANGE)
|
||||
|| (m == 0 && errno != 0)) {
|
||||
BIO_printf(bio_err, "%s: Can't parse \"%s\" as a number\n",
|
||||
prog, value);
|
||||
errno = oerrno;
|
||||
return 0;
|
||||
}
|
||||
*result = m;
|
||||
errno = oerrno;
|
||||
return 1;
|
||||
}
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Parse an unsigned long, put it into *result; return 0 on failure, else 1.
|
||||
*/
|
||||
int opt_ulong(const char *value, unsigned long *result)
|
||||
{
|
||||
int oerrno = errno;
|
||||
char *endptr;
|
||||
unsigned long l;
|
||||
|
||||
errno = 0;
|
||||
l = strtoul(value, &endptr, 0);
|
||||
if (*endptr
|
||||
|| endptr == value
|
||||
|| ((l == ULONG_MAX) && errno == ERANGE)
|
||||
|| (l == 0 && errno != 0)) {
|
||||
BIO_printf(bio_err, "%s: Can't parse \"%s\" as an unsigned number\n",
|
||||
prog, value);
|
||||
errno = oerrno;
|
||||
return 0;
|
||||
}
|
||||
*result = l;
|
||||
errno = oerrno;
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*
|
||||
* We pass opt as an int but cast it to "enum range" so that all the
|
||||
* items in the OPT_V_ENUM enumeration are caught; this makes -Wswitch
|
||||
* in gcc do the right thing.
|
||||
*/
|
||||
enum range { OPT_V_ENUM };
|
||||
|
||||
int opt_verify(int opt, X509_VERIFY_PARAM *vpm)
|
||||
{
|
||||
int i;
|
||||
ossl_intmax_t t = 0;
|
||||
ASN1_OBJECT *otmp;
|
||||
X509_PURPOSE *xptmp;
|
||||
const X509_VERIFY_PARAM *vtmp;
|
||||
|
||||
assert(vpm != NULL);
|
||||
assert(opt > OPT_V__FIRST);
|
||||
assert(opt < OPT_V__LAST);
|
||||
|
||||
switch ((enum range)opt) {
|
||||
case OPT_V__FIRST:
|
||||
case OPT_V__LAST:
|
||||
return 0;
|
||||
case OPT_V_POLICY:
|
||||
otmp = OBJ_txt2obj(opt_arg(), 0);
|
||||
if (otmp == NULL) {
|
||||
BIO_printf(bio_err, "%s: Invalid Policy %s\n", prog, opt_arg());
|
||||
return 0;
|
||||
}
|
||||
X509_VERIFY_PARAM_add0_policy(vpm, otmp);
|
||||
break;
|
||||
case OPT_V_PURPOSE:
|
||||
/* purpose name -> purpose index */
|
||||
i = X509_PURPOSE_get_by_sname(opt_arg());
|
||||
if (i < 0) {
|
||||
BIO_printf(bio_err, "%s: Invalid purpose %s\n", prog, opt_arg());
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* purpose index -> purpose object */
|
||||
xptmp = X509_PURPOSE_get0(i);
|
||||
|
||||
/* purpose object -> purpose value */
|
||||
i = X509_PURPOSE_get_id(xptmp);
|
||||
|
||||
if (!X509_VERIFY_PARAM_set_purpose(vpm, i)) {
|
||||
BIO_printf(bio_err,
|
||||
"%s: Internal error setting purpose %s\n",
|
||||
prog, opt_arg());
|
||||
return 0;
|
||||
}
|
||||
break;
|
||||
case OPT_V_VERIFY_NAME:
|
||||
vtmp = X509_VERIFY_PARAM_lookup(opt_arg());
|
||||
if (vtmp == NULL) {
|
||||
BIO_printf(bio_err, "%s: Invalid verify name %s\n",
|
||||
prog, opt_arg());
|
||||
return 0;
|
||||
}
|
||||
X509_VERIFY_PARAM_set1(vpm, vtmp);
|
||||
break;
|
||||
case OPT_V_VERIFY_DEPTH:
|
||||
i = atoi(opt_arg());
|
||||
if (i >= 0)
|
||||
X509_VERIFY_PARAM_set_depth(vpm, i);
|
||||
break;
|
||||
case OPT_V_VERIFY_AUTH_LEVEL:
|
||||
i = atoi(opt_arg());
|
||||
if (i >= 0)
|
||||
X509_VERIFY_PARAM_set_auth_level(vpm, i);
|
||||
break;
|
||||
case OPT_V_ATTIME:
|
||||
if (!opt_imax(opt_arg(), &t))
|
||||
return 0;
|
||||
if (t != (time_t)t) {
|
||||
BIO_printf(bio_err, "%s: epoch time out of range %s\n",
|
||||
prog, opt_arg());
|
||||
return 0;
|
||||
}
|
||||
X509_VERIFY_PARAM_set_time(vpm, (time_t)t);
|
||||
break;
|
||||
case OPT_V_VERIFY_HOSTNAME:
|
||||
if (!X509_VERIFY_PARAM_set1_host(vpm, opt_arg(), 0))
|
||||
return 0;
|
||||
break;
|
||||
case OPT_V_VERIFY_EMAIL:
|
||||
if (!X509_VERIFY_PARAM_set1_email(vpm, opt_arg(), 0))
|
||||
return 0;
|
||||
break;
|
||||
case OPT_V_VERIFY_IP:
|
||||
if (!X509_VERIFY_PARAM_set1_ip_asc(vpm, opt_arg()))
|
||||
return 0;
|
||||
break;
|
||||
case OPT_V_IGNORE_CRITICAL:
|
||||
X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_IGNORE_CRITICAL);
|
||||
break;
|
||||
case OPT_V_ISSUER_CHECKS:
|
||||
/* NOP, deprecated */
|
||||
break;
|
||||
case OPT_V_CRL_CHECK:
|
||||
X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_CRL_CHECK);
|
||||
break;
|
||||
case OPT_V_CRL_CHECK_ALL:
|
||||
X509_VERIFY_PARAM_set_flags(vpm,
|
||||
X509_V_FLAG_CRL_CHECK |
|
||||
X509_V_FLAG_CRL_CHECK_ALL);
|
||||
break;
|
||||
case OPT_V_POLICY_CHECK:
|
||||
X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_POLICY_CHECK);
|
||||
break;
|
||||
case OPT_V_EXPLICIT_POLICY:
|
||||
X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_EXPLICIT_POLICY);
|
||||
break;
|
||||
case OPT_V_INHIBIT_ANY:
|
||||
X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_INHIBIT_ANY);
|
||||
break;
|
||||
case OPT_V_INHIBIT_MAP:
|
||||
X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_INHIBIT_MAP);
|
||||
break;
|
||||
case OPT_V_X509_STRICT:
|
||||
X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_X509_STRICT);
|
||||
break;
|
||||
case OPT_V_EXTENDED_CRL:
|
||||
X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_EXTENDED_CRL_SUPPORT);
|
||||
break;
|
||||
case OPT_V_USE_DELTAS:
|
||||
X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_USE_DELTAS);
|
||||
break;
|
||||
case OPT_V_POLICY_PRINT:
|
||||
X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_NOTIFY_POLICY);
|
||||
break;
|
||||
case OPT_V_CHECK_SS_SIG:
|
||||
X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_CHECK_SS_SIGNATURE);
|
||||
break;
|
||||
case OPT_V_TRUSTED_FIRST:
|
||||
X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_TRUSTED_FIRST);
|
||||
break;
|
||||
case OPT_V_SUITEB_128_ONLY:
|
||||
X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_SUITEB_128_LOS_ONLY);
|
||||
break;
|
||||
case OPT_V_SUITEB_128:
|
||||
X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_SUITEB_128_LOS);
|
||||
break;
|
||||
case OPT_V_SUITEB_192:
|
||||
X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_SUITEB_192_LOS);
|
||||
break;
|
||||
case OPT_V_PARTIAL_CHAIN:
|
||||
X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_PARTIAL_CHAIN);
|
||||
break;
|
||||
case OPT_V_NO_ALT_CHAINS:
|
||||
X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_NO_ALT_CHAINS);
|
||||
break;
|
||||
case OPT_V_NO_CHECK_TIME:
|
||||
X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_NO_CHECK_TIME);
|
||||
break;
|
||||
case OPT_V_ALLOW_PROXY_CERTS:
|
||||
X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_ALLOW_PROXY_CERTS);
|
||||
break;
|
||||
}
|
||||
return 1;
|
||||
|
||||
}
|
||||
|
||||
/*
|
||||
* Parse the next flag (and value if specified), return 0 if done, -1 on
|
||||
* error, otherwise the flag's retval.
|
||||
*/
|
||||
int opt_next(void)
|
||||
{
|
||||
char *p;
|
||||
const OPTIONS *o;
|
||||
int ival;
|
||||
long lval;
|
||||
unsigned long ulval;
|
||||
ossl_intmax_t imval;
|
||||
ossl_uintmax_t umval;
|
||||
|
||||
/* Look at current arg; at end of the list? */
|
||||
arg = NULL;
|
||||
p = argv[opt_index];
|
||||
if (p == NULL)
|
||||
return 0;
|
||||
|
||||
/* If word doesn't start with a -, we're done. */
|
||||
if (*p != '-')
|
||||
return 0;
|
||||
|
||||
/* Hit "--" ? We're done. */
|
||||
opt_index++;
|
||||
if (strcmp(p, "--") == 0)
|
||||
return 0;
|
||||
|
||||
/* Allow -nnn and --nnn */
|
||||
if (*++p == '-')
|
||||
p++;
|
||||
flag = p - 1;
|
||||
|
||||
/* If we have --flag=foo, snip it off */
|
||||
if ((arg = strchr(p, '=')) != NULL)
|
||||
*arg++ = '\0';
|
||||
for (o = opts; o->name; ++o) {
|
||||
/* If not this option, move on to the next one. */
|
||||
if (strcmp(p, o->name) != 0)
|
||||
continue;
|
||||
|
||||
/* If it doesn't take a value, make sure none was given. */
|
||||
if (o->valtype == 0 || o->valtype == '-') {
|
||||
if (arg) {
|
||||
BIO_printf(bio_err,
|
||||
"%s: Option -%s does not take a value\n", prog, p);
|
||||
return -1;
|
||||
}
|
||||
return o->retval;
|
||||
}
|
||||
|
||||
/* Want a value; get the next param if =foo not used. */
|
||||
if (arg == NULL) {
|
||||
if (argv[opt_index] == NULL) {
|
||||
BIO_printf(bio_err,
|
||||
"%s: Option -%s needs a value\n", prog, o->name);
|
||||
return -1;
|
||||
}
|
||||
arg = argv[opt_index++];
|
||||
}
|
||||
|
||||
/* Syntax-check value. */
|
||||
switch (o->valtype) {
|
||||
default:
|
||||
case 's':
|
||||
/* Just a string. */
|
||||
break;
|
||||
case '/':
|
||||
if (app_isdir(arg) >= 0)
|
||||
break;
|
||||
BIO_printf(bio_err, "%s: Not a directory: %s\n", prog, arg);
|
||||
return -1;
|
||||
case '<':
|
||||
/* Input file. */
|
||||
if (strcmp(arg, "-") == 0 || app_access(arg, R_OK) >= 0)
|
||||
break;
|
||||
BIO_printf(bio_err,
|
||||
"%s: Cannot open input file %s, %s\n",
|
||||
prog, arg, strerror(errno));
|
||||
return -1;
|
||||
case '>':
|
||||
/* Output file. */
|
||||
if (strcmp(arg, "-") == 0 || app_access(arg, W_OK) >= 0 || errno == ENOENT)
|
||||
break;
|
||||
BIO_printf(bio_err,
|
||||
"%s: Cannot open output file %s, %s\n",
|
||||
prog, arg, strerror(errno));
|
||||
return -1;
|
||||
case 'p':
|
||||
case 'n':
|
||||
if (!opt_int(arg, &ival)
|
||||
|| (o->valtype == 'p' && ival <= 0)) {
|
||||
BIO_printf(bio_err,
|
||||
"%s: Non-positive number \"%s\" for -%s\n",
|
||||
prog, arg, o->name);
|
||||
return -1;
|
||||
}
|
||||
break;
|
||||
case 'M':
|
||||
if (!opt_imax(arg, &imval)) {
|
||||
BIO_printf(bio_err,
|
||||
"%s: Invalid number \"%s\" for -%s\n",
|
||||
prog, arg, o->name);
|
||||
return -1;
|
||||
}
|
||||
break;
|
||||
case 'U':
|
||||
if (!opt_umax(arg, &umval)) {
|
||||
BIO_printf(bio_err,
|
||||
"%s: Invalid number \"%s\" for -%s\n",
|
||||
prog, arg, o->name);
|
||||
return -1;
|
||||
}
|
||||
break;
|
||||
case 'l':
|
||||
if (!opt_long(arg, &lval)) {
|
||||
BIO_printf(bio_err,
|
||||
"%s: Invalid number \"%s\" for -%s\n",
|
||||
prog, arg, o->name);
|
||||
return -1;
|
||||
}
|
||||
break;
|
||||
case 'u':
|
||||
if (!opt_ulong(arg, &ulval)) {
|
||||
BIO_printf(bio_err,
|
||||
"%s: Invalid number \"%s\" for -%s\n",
|
||||
prog, arg, o->name);
|
||||
return -1;
|
||||
}
|
||||
break;
|
||||
case 'c':
|
||||
case 'E':
|
||||
case 'F':
|
||||
case 'f':
|
||||
if (opt_format(arg,
|
||||
o->valtype == 'c' ? OPT_FMT_PDS :
|
||||
o->valtype == 'E' ? OPT_FMT_PDE :
|
||||
o->valtype == 'F' ? OPT_FMT_PEMDER
|
||||
: OPT_FMT_ANY, &ival))
|
||||
break;
|
||||
BIO_printf(bio_err,
|
||||
"%s: Invalid format \"%s\" for -%s\n",
|
||||
prog, arg, o->name);
|
||||
return -1;
|
||||
}
|
||||
|
||||
/* Return the flag value. */
|
||||
return o->retval;
|
||||
}
|
||||
if (unknown != NULL) {
|
||||
dunno = p;
|
||||
return unknown->retval;
|
||||
}
|
||||
BIO_printf(bio_err, "%s: Option unknown option -%s\n", prog, p);
|
||||
return -1;
|
||||
}
|
||||
|
||||
/* Return the most recent flag parameter. */
|
||||
char *opt_arg(void)
|
||||
{
|
||||
return arg;
|
||||
}
|
||||
|
||||
/* Return the most recent flag. */
|
||||
char *opt_flag(void)
|
||||
{
|
||||
return flag;
|
||||
}
|
||||
|
||||
/* Return the unknown option. */
|
||||
char *opt_unknown(void)
|
||||
{
|
||||
return dunno;
|
||||
}
|
||||
|
||||
/* Return the rest of the arguments after parsing flags. */
|
||||
char **opt_rest(void)
|
||||
{
|
||||
return &argv[opt_index];
|
||||
}
|
||||
|
||||
/* How many items in remaining args? */
|
||||
int opt_num_rest(void)
|
||||
{
|
||||
int i = 0;
|
||||
char **pp;
|
||||
|
||||
for (pp = opt_rest(); *pp; pp++, i++)
|
||||
continue;
|
||||
return i;
|
||||
}
|
||||
|
||||
/* Return a string describing the parameter type. */
|
||||
static const char *valtype2param(const OPTIONS *o)
|
||||
{
|
||||
switch (o->valtype) {
|
||||
case 0:
|
||||
case '-':
|
||||
return "";
|
||||
case 's':
|
||||
return "val";
|
||||
case '/':
|
||||
return "dir";
|
||||
case '<':
|
||||
return "infile";
|
||||
case '>':
|
||||
return "outfile";
|
||||
case 'p':
|
||||
return "+int";
|
||||
case 'n':
|
||||
return "int";
|
||||
case 'l':
|
||||
return "long";
|
||||
case 'u':
|
||||
return "ulong";
|
||||
case 'E':
|
||||
return "PEM|DER|ENGINE";
|
||||
case 'F':
|
||||
return "PEM|DER";
|
||||
case 'f':
|
||||
return "format";
|
||||
case 'M':
|
||||
return "intmax";
|
||||
case 'U':
|
||||
return "uintmax";
|
||||
}
|
||||
return "parm";
|
||||
}
|
||||
|
||||
void opt_help(const OPTIONS *list)
|
||||
{
|
||||
const OPTIONS *o;
|
||||
int i;
|
||||
int standard_prolog;
|
||||
int width = 5;
|
||||
char start[80 + 1];
|
||||
char *p;
|
||||
const char *help;
|
||||
|
||||
/* Starts with its own help message? */
|
||||
standard_prolog = list[0].name != OPT_HELP_STR;
|
||||
|
||||
/* Find the widest help. */
|
||||
for (o = list; o->name; o++) {
|
||||
if (o->name == OPT_MORE_STR)
|
||||
continue;
|
||||
i = 2 + (int)strlen(o->name);
|
||||
if (o->valtype != '-')
|
||||
i += 1 + strlen(valtype2param(o));
|
||||
if (i < MAX_OPT_HELP_WIDTH && i > width)
|
||||
width = i;
|
||||
assert(i < (int)sizeof(start));
|
||||
}
|
||||
|
||||
if (standard_prolog)
|
||||
BIO_printf(bio_err, "Usage: %s [options]\nValid options are:\n",
|
||||
prog);
|
||||
|
||||
/* Now let's print. */
|
||||
for (o = list; o->name; o++) {
|
||||
help = o->helpstr ? o->helpstr : "(No additional info)";
|
||||
if (o->name == OPT_HELP_STR) {
|
||||
BIO_printf(bio_err, help, prog);
|
||||
continue;
|
||||
}
|
||||
|
||||
/* Pad out prefix */
|
||||
memset(start, ' ', sizeof(start) - 1);
|
||||
start[sizeof(start) - 1] = '\0';
|
||||
|
||||
if (o->name == OPT_MORE_STR) {
|
||||
/* Continuation of previous line; pad and print. */
|
||||
start[width] = '\0';
|
||||
BIO_printf(bio_err, "%s %s\n", start, help);
|
||||
continue;
|
||||
}
|
||||
|
||||
/* Build up the "-flag [param]" part. */
|
||||
p = start;
|
||||
*p++ = ' ';
|
||||
*p++ = '-';
|
||||
if (o->name[0])
|
||||
p += strlen(strcpy(p, o->name));
|
||||
else
|
||||
*p++ = '*';
|
||||
if (o->valtype != '-') {
|
||||
*p++ = ' ';
|
||||
p += strlen(strcpy(p, valtype2param(o)));
|
||||
}
|
||||
*p = ' ';
|
||||
if ((int)(p - start) >= MAX_OPT_HELP_WIDTH) {
|
||||
*p = '\0';
|
||||
BIO_printf(bio_err, "%s\n", start);
|
||||
memset(start, ' ', sizeof(start));
|
||||
}
|
||||
start[width] = '\0';
|
||||
BIO_printf(bio_err, "%s %s\n", start, help);
|
||||
}
|
||||
}
|
||||
|
||||
#ifdef COMPILE_STANDALONE_TEST_DRIVER
|
||||
# include <sys/stat.h>
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_IN, OPT_INFORM, OPT_OUT, OPT_COUNT, OPT_U, OPT_FLAG,
|
||||
OPT_STR, OPT_NOTUSED
|
||||
} OPTION_CHOICE;
|
||||
|
||||
static OPTIONS options[] = {
|
||||
{OPT_HELP_STR, 1, '-', "Usage: %s flags\n"},
|
||||
{OPT_HELP_STR, 1, '-', "Valid options are:\n"},
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"in", OPT_IN, '<', "input file"},
|
||||
{OPT_MORE_STR, 1, '-', "more detail about input"},
|
||||
{"inform", OPT_INFORM, 'f', "input file format; defaults to pem"},
|
||||
{"out", OPT_OUT, '>', "output file"},
|
||||
{"count", OPT_COUNT, 'p', "a counter greater than zero"},
|
||||
{"u", OPT_U, 'u', "an unsigned number"},
|
||||
{"flag", OPT_FLAG, 0, "just some flag"},
|
||||
{"str", OPT_STR, 's', "the magic word"},
|
||||
{"areallyverylongoption", OPT_HELP, '-', "long way for help"},
|
||||
{NULL}
|
||||
};
|
||||
|
||||
BIO *bio_err;
|
||||
|
||||
int app_isdir(const char *name)
|
||||
{
|
||||
struct stat sb;
|
||||
|
||||
return name != NULL && stat(name, &sb) >= 0 && S_ISDIR(sb.st_mode);
|
||||
}
|
||||
|
||||
int main(int ac, char **av)
|
||||
{
|
||||
OPTION_CHOICE o;
|
||||
char **rest;
|
||||
char *prog;
|
||||
|
||||
bio_err = BIO_new_fp(stderr, BIO_NOCLOSE | BIO_FP_TEXT);
|
||||
|
||||
prog = opt_init(ac, av, options);
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
switch (c) {
|
||||
case OPT_NOTUSED:
|
||||
case OPT_EOF:
|
||||
case OPT_ERR:
|
||||
printf("%s: Usage error; try -help.\n", prog);
|
||||
return 1;
|
||||
case OPT_HELP:
|
||||
opt_help(options);
|
||||
return 0;
|
||||
case OPT_IN:
|
||||
printf("in %s\n", opt_arg());
|
||||
break;
|
||||
case OPT_INFORM:
|
||||
printf("inform %s\n", opt_arg());
|
||||
break;
|
||||
case OPT_OUT:
|
||||
printf("out %s\n", opt_arg());
|
||||
break;
|
||||
case OPT_COUNT:
|
||||
printf("count %s\n", opt_arg());
|
||||
break;
|
||||
case OPT_U:
|
||||
printf("u %s\n", opt_arg());
|
||||
break;
|
||||
case OPT_FLAG:
|
||||
printf("flag\n");
|
||||
break;
|
||||
case OPT_STR:
|
||||
printf("str %s\n", opt_arg());
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
argv = opt_rest();
|
||||
|
||||
printf("args = %d\n", argc);
|
||||
if (argc)
|
||||
while (*argv)
|
||||
printf(" %s\n", *argv++);
|
||||
return 0;
|
||||
}
|
||||
#endif
|
||||
512
apps/passwd.c
512
apps/passwd.c
@@ -1,512 +0,0 @@
|
||||
/*
|
||||
* Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#if defined OPENSSL_NO_MD5 || defined CHARSET_EBCDIC
|
||||
# define NO_MD5CRYPT_1
|
||||
#endif
|
||||
|
||||
#if !defined(OPENSSL_NO_DES) || !defined(NO_MD5CRYPT_1)
|
||||
|
||||
# include <string.h>
|
||||
|
||||
# include "apps.h"
|
||||
|
||||
# include <openssl/bio.h>
|
||||
# include <openssl/err.h>
|
||||
# include <openssl/evp.h>
|
||||
# include <openssl/rand.h>
|
||||
# ifndef OPENSSL_NO_DES
|
||||
# include <openssl/des.h>
|
||||
# endif
|
||||
# ifndef NO_MD5CRYPT_1
|
||||
# include <openssl/md5.h>
|
||||
# endif
|
||||
|
||||
static unsigned const char cov_2char[64] = {
|
||||
/* from crypto/des/fcrypt.c */
|
||||
0x2E, 0x2F, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35,
|
||||
0x36, 0x37, 0x38, 0x39, 0x41, 0x42, 0x43, 0x44,
|
||||
0x45, 0x46, 0x47, 0x48, 0x49, 0x4A, 0x4B, 0x4C,
|
||||
0x4D, 0x4E, 0x4F, 0x50, 0x51, 0x52, 0x53, 0x54,
|
||||
0x55, 0x56, 0x57, 0x58, 0x59, 0x5A, 0x61, 0x62,
|
||||
0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6A,
|
||||
0x6B, 0x6C, 0x6D, 0x6E, 0x6F, 0x70, 0x71, 0x72,
|
||||
0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7A
|
||||
};
|
||||
|
||||
static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
|
||||
char *passwd, BIO *out, int quiet, int table,
|
||||
int reverse, size_t pw_maxlen, int usecrypt, int use1,
|
||||
int useapr1);
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_IN,
|
||||
OPT_NOVERIFY, OPT_QUIET, OPT_TABLE, OPT_REVERSE, OPT_APR1,
|
||||
OPT_1, OPT_CRYPT, OPT_SALT, OPT_STDIN
|
||||
} OPTION_CHOICE;
|
||||
|
||||
OPTIONS passwd_options[] = {
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"in", OPT_IN, '<', "Read passwords from file"},
|
||||
{"noverify", OPT_NOVERIFY, '-',
|
||||
"Never verify when reading password from terminal"},
|
||||
{"quiet", OPT_QUIET, '-', "No warnings"},
|
||||
{"table", OPT_TABLE, '-', "Format output as table"},
|
||||
{"reverse", OPT_REVERSE, '-', "Switch table columns"},
|
||||
{"salt", OPT_SALT, 's', "Use provided salt"},
|
||||
{"stdin", OPT_STDIN, '-', "Read passwords from stdin"},
|
||||
# ifndef NO_MD5CRYPT_1
|
||||
{"apr1", OPT_APR1, '-', "MD5-based password algorithm, Apache variant"},
|
||||
{"1", OPT_1, '-', "MD5-based password algorithm"},
|
||||
# endif
|
||||
# ifndef OPENSSL_NO_DES
|
||||
{"crypt", OPT_CRYPT, '-', "Standard Unix password algorithm (default)"},
|
||||
# endif
|
||||
{NULL}
|
||||
};
|
||||
|
||||
int passwd_main(int argc, char **argv)
|
||||
{
|
||||
BIO *in = NULL;
|
||||
char *infile = NULL, *salt = NULL, *passwd = NULL, **passwds = NULL;
|
||||
char *salt_malloc = NULL, *passwd_malloc = NULL, *prog;
|
||||
OPTION_CHOICE o;
|
||||
int in_stdin = 0, pw_source_defined = 0;
|
||||
# ifndef OPENSSL_NO_UI
|
||||
int in_noverify = 0;
|
||||
# endif
|
||||
int passed_salt = 0, quiet = 0, table = 0, reverse = 0;
|
||||
int ret = 1, usecrypt = 0, use1 = 0, useapr1 = 0;
|
||||
size_t passwd_malloc_size = 0, pw_maxlen = 256;
|
||||
|
||||
prog = opt_init(argc, argv, passwd_options);
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
switch (o) {
|
||||
case OPT_EOF:
|
||||
case OPT_ERR:
|
||||
opthelp:
|
||||
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
||||
goto end;
|
||||
case OPT_HELP:
|
||||
opt_help(passwd_options);
|
||||
ret = 0;
|
||||
goto end;
|
||||
case OPT_IN:
|
||||
if (pw_source_defined)
|
||||
goto opthelp;
|
||||
infile = opt_arg();
|
||||
pw_source_defined = 1;
|
||||
break;
|
||||
case OPT_NOVERIFY:
|
||||
# ifndef OPENSSL_NO_UI
|
||||
in_noverify = 1;
|
||||
# endif
|
||||
break;
|
||||
case OPT_QUIET:
|
||||
quiet = 1;
|
||||
break;
|
||||
case OPT_TABLE:
|
||||
table = 1;
|
||||
break;
|
||||
case OPT_REVERSE:
|
||||
reverse = 1;
|
||||
break;
|
||||
case OPT_1:
|
||||
use1 = 1;
|
||||
break;
|
||||
case OPT_APR1:
|
||||
useapr1 = 1;
|
||||
break;
|
||||
case OPT_CRYPT:
|
||||
usecrypt = 1;
|
||||
break;
|
||||
case OPT_SALT:
|
||||
passed_salt = 1;
|
||||
salt = opt_arg();
|
||||
break;
|
||||
case OPT_STDIN:
|
||||
if (pw_source_defined)
|
||||
goto opthelp;
|
||||
in_stdin = 1;
|
||||
pw_source_defined = 1;
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
argv = opt_rest();
|
||||
|
||||
if (*argv) {
|
||||
if (pw_source_defined)
|
||||
goto opthelp;
|
||||
pw_source_defined = 1;
|
||||
passwds = argv;
|
||||
}
|
||||
|
||||
if (!usecrypt && !use1 && !useapr1) {
|
||||
/* use default */
|
||||
usecrypt = 1;
|
||||
}
|
||||
if (usecrypt + use1 + useapr1 > 1) {
|
||||
/* conflict */
|
||||
goto opthelp;
|
||||
}
|
||||
|
||||
# ifdef OPENSSL_NO_DES
|
||||
if (usecrypt)
|
||||
goto opthelp;
|
||||
# endif
|
||||
# ifdef NO_MD5CRYPT_1
|
||||
if (use1 || useapr1)
|
||||
goto opthelp;
|
||||
# endif
|
||||
|
||||
if (infile != NULL && in_stdin) {
|
||||
BIO_printf(bio_err, "%s: Can't combine -in and -stdin\n", prog);
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (infile != NULL || in_stdin) {
|
||||
/*
|
||||
* If in_stdin is true, we know that infile is NULL, and that
|
||||
* bio_open_default() will give us back an alias for stdin.
|
||||
*/
|
||||
in = bio_open_default(infile, 'r', FORMAT_TEXT);
|
||||
if (in == NULL)
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (usecrypt)
|
||||
pw_maxlen = 8;
|
||||
else if (use1 || useapr1)
|
||||
pw_maxlen = 256; /* arbitrary limit, should be enough for most
|
||||
* passwords */
|
||||
|
||||
if (passwds == NULL) {
|
||||
/* no passwords on the command line */
|
||||
|
||||
passwd_malloc_size = pw_maxlen + 2;
|
||||
/* longer than necessary so that we can warn about truncation */
|
||||
passwd = passwd_malloc =
|
||||
app_malloc(passwd_malloc_size, "password buffer");
|
||||
}
|
||||
|
||||
if ((in == NULL) && (passwds == NULL)) {
|
||||
/*
|
||||
* we use the following method to make sure what
|
||||
* in the 'else' section is always compiled, to
|
||||
* avoid rot of not-frequently-used code.
|
||||
*/
|
||||
if (1) {
|
||||
# ifndef OPENSSL_NO_UI
|
||||
/* build a null-terminated list */
|
||||
static char *passwds_static[2] = { NULL, NULL };
|
||||
|
||||
passwds = passwds_static;
|
||||
if (in == NULL) {
|
||||
if (EVP_read_pw_string
|
||||
(passwd_malloc, passwd_malloc_size, "Password: ",
|
||||
!(passed_salt || in_noverify)) != 0)
|
||||
goto end;
|
||||
}
|
||||
passwds[0] = passwd_malloc;
|
||||
} else {
|
||||
# endif
|
||||
BIO_printf(bio_err, "password required\n");
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
if (in == NULL) {
|
||||
assert(passwds != NULL);
|
||||
assert(*passwds != NULL);
|
||||
|
||||
do { /* loop over list of passwords */
|
||||
passwd = *passwds++;
|
||||
if (!do_passwd(passed_salt, &salt, &salt_malloc, passwd, bio_out,
|
||||
quiet, table, reverse, pw_maxlen, usecrypt, use1,
|
||||
useapr1))
|
||||
goto end;
|
||||
} while (*passwds != NULL);
|
||||
} else {
|
||||
/* in != NULL */
|
||||
int done;
|
||||
|
||||
assert(passwd != NULL);
|
||||
do {
|
||||
int r = BIO_gets(in, passwd, pw_maxlen + 1);
|
||||
if (r > 0) {
|
||||
char *c = (strchr(passwd, '\n'));
|
||||
if (c != NULL) {
|
||||
*c = 0; /* truncate at newline */
|
||||
} else {
|
||||
/* ignore rest of line */
|
||||
char trash[BUFSIZ];
|
||||
do
|
||||
r = BIO_gets(in, trash, sizeof(trash));
|
||||
while ((r > 0) && (!strchr(trash, '\n')));
|
||||
}
|
||||
|
||||
if (!do_passwd
|
||||
(passed_salt, &salt, &salt_malloc, passwd, bio_out, quiet,
|
||||
table, reverse, pw_maxlen, usecrypt, use1, useapr1))
|
||||
goto end;
|
||||
}
|
||||
done = (r <= 0);
|
||||
} while (!done);
|
||||
}
|
||||
ret = 0;
|
||||
|
||||
end:
|
||||
ERR_print_errors(bio_err);
|
||||
OPENSSL_free(salt_malloc);
|
||||
OPENSSL_free(passwd_malloc);
|
||||
BIO_free(in);
|
||||
return (ret);
|
||||
}
|
||||
|
||||
# ifndef NO_MD5CRYPT_1
|
||||
/*
|
||||
* MD5-based password algorithm (should probably be available as a library
|
||||
* function; then the static buffer would not be acceptable). For magic
|
||||
* string "1", this should be compatible to the MD5-based BSD password
|
||||
* algorithm. For 'magic' string "apr1", this is compatible to the MD5-based
|
||||
* Apache password algorithm. (Apparently, the Apache password algorithm is
|
||||
* identical except that the 'magic' string was changed -- the laziest
|
||||
* application of the NIH principle I've ever encountered.)
|
||||
*/
|
||||
static char *md5crypt(const char *passwd, const char *magic, const char *salt)
|
||||
{
|
||||
/* "$apr1$..salt..$.......md5hash..........\0" */
|
||||
static char out_buf[6 + 9 + 24 + 2];
|
||||
unsigned char buf[MD5_DIGEST_LENGTH];
|
||||
char *salt_out;
|
||||
int n;
|
||||
unsigned int i;
|
||||
EVP_MD_CTX *md = NULL, *md2 = NULL;
|
||||
size_t passwd_len, salt_len, magic_len;
|
||||
|
||||
passwd_len = strlen(passwd);
|
||||
out_buf[0] = '$';
|
||||
out_buf[1] = 0;
|
||||
magic_len = strlen(magic);
|
||||
|
||||
if (magic_len > 4) /* assert it's "1" or "apr1" */
|
||||
return NULL;
|
||||
|
||||
OPENSSL_strlcat(out_buf, magic, sizeof(out_buf));
|
||||
OPENSSL_strlcat(out_buf, "$", sizeof(out_buf));
|
||||
OPENSSL_strlcat(out_buf, salt, sizeof(out_buf));
|
||||
|
||||
if (strlen(out_buf) > 6 + 8) /* assert "$apr1$..salt.." */
|
||||
return NULL;
|
||||
|
||||
salt_out = out_buf + 2 + magic_len;
|
||||
salt_len = strlen(salt_out);
|
||||
|
||||
if (salt_len > 8)
|
||||
return NULL;
|
||||
|
||||
md = EVP_MD_CTX_new();
|
||||
if (md == NULL
|
||||
|| !EVP_DigestInit_ex(md, EVP_md5(), NULL)
|
||||
|| !EVP_DigestUpdate(md, passwd, passwd_len)
|
||||
|| !EVP_DigestUpdate(md, "$", 1)
|
||||
|| !EVP_DigestUpdate(md, magic, magic_len)
|
||||
|| !EVP_DigestUpdate(md, "$", 1)
|
||||
|| !EVP_DigestUpdate(md, salt_out, salt_len))
|
||||
goto err;
|
||||
|
||||
md2 = EVP_MD_CTX_new();
|
||||
if (md2 == NULL
|
||||
|| !EVP_DigestInit_ex(md2, EVP_md5(), NULL)
|
||||
|| !EVP_DigestUpdate(md2, passwd, passwd_len)
|
||||
|| !EVP_DigestUpdate(md2, salt_out, salt_len)
|
||||
|| !EVP_DigestUpdate(md2, passwd, passwd_len)
|
||||
|| !EVP_DigestFinal_ex(md2, buf, NULL))
|
||||
goto err;
|
||||
|
||||
for (i = passwd_len; i > sizeof(buf); i -= sizeof(buf)) {
|
||||
if (!EVP_DigestUpdate(md, buf, sizeof(buf)))
|
||||
goto err;
|
||||
}
|
||||
if (!EVP_DigestUpdate(md, buf, i))
|
||||
goto err;
|
||||
|
||||
n = passwd_len;
|
||||
while (n) {
|
||||
if (!EVP_DigestUpdate(md, (n & 1) ? "\0" : passwd, 1))
|
||||
goto err;
|
||||
n >>= 1;
|
||||
}
|
||||
if (!EVP_DigestFinal_ex(md, buf, NULL))
|
||||
return NULL;
|
||||
|
||||
for (i = 0; i < 1000; i++) {
|
||||
if (!EVP_DigestInit_ex(md2, EVP_md5(), NULL))
|
||||
goto err;
|
||||
if (!EVP_DigestUpdate(md2,
|
||||
(i & 1) ? (unsigned const char *)passwd : buf,
|
||||
(i & 1) ? passwd_len : sizeof(buf)))
|
||||
goto err;
|
||||
if (i % 3) {
|
||||
if (!EVP_DigestUpdate(md2, salt_out, salt_len))
|
||||
goto err;
|
||||
}
|
||||
if (i % 7) {
|
||||
if (!EVP_DigestUpdate(md2, passwd, passwd_len))
|
||||
goto err;
|
||||
}
|
||||
if (!EVP_DigestUpdate(md2,
|
||||
(i & 1) ? buf : (unsigned const char *)passwd,
|
||||
(i & 1) ? sizeof(buf) : passwd_len))
|
||||
goto err;
|
||||
if (!EVP_DigestFinal_ex(md2, buf, NULL))
|
||||
goto err;
|
||||
}
|
||||
EVP_MD_CTX_free(md2);
|
||||
EVP_MD_CTX_free(md);
|
||||
md2 = NULL;
|
||||
md = NULL;
|
||||
|
||||
{
|
||||
/* transform buf into output string */
|
||||
unsigned char buf_perm[sizeof(buf)];
|
||||
int dest, source;
|
||||
char *output;
|
||||
|
||||
/* silly output permutation */
|
||||
for (dest = 0, source = 0; dest < 14;
|
||||
dest++, source = (source + 6) % 17)
|
||||
buf_perm[dest] = buf[source];
|
||||
buf_perm[14] = buf[5];
|
||||
buf_perm[15] = buf[11];
|
||||
# ifndef PEDANTIC /* Unfortunately, this generates a "no
|
||||
* effect" warning */
|
||||
assert(16 == sizeof(buf_perm));
|
||||
# endif
|
||||
|
||||
output = salt_out + salt_len;
|
||||
assert(output == out_buf + strlen(out_buf));
|
||||
|
||||
*output++ = '$';
|
||||
|
||||
for (i = 0; i < 15; i += 3) {
|
||||
*output++ = cov_2char[buf_perm[i + 2] & 0x3f];
|
||||
*output++ = cov_2char[((buf_perm[i + 1] & 0xf) << 2) |
|
||||
(buf_perm[i + 2] >> 6)];
|
||||
*output++ = cov_2char[((buf_perm[i] & 3) << 4) |
|
||||
(buf_perm[i + 1] >> 4)];
|
||||
*output++ = cov_2char[buf_perm[i] >> 2];
|
||||
}
|
||||
assert(i == 15);
|
||||
*output++ = cov_2char[buf_perm[i] & 0x3f];
|
||||
*output++ = cov_2char[buf_perm[i] >> 6];
|
||||
*output = 0;
|
||||
assert(strlen(out_buf) < sizeof(out_buf));
|
||||
}
|
||||
|
||||
return out_buf;
|
||||
|
||||
err:
|
||||
EVP_MD_CTX_free(md2);
|
||||
EVP_MD_CTX_free(md);
|
||||
return NULL;
|
||||
}
|
||||
# endif
|
||||
|
||||
static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
|
||||
char *passwd, BIO *out, int quiet, int table,
|
||||
int reverse, size_t pw_maxlen, int usecrypt, int use1,
|
||||
int useapr1)
|
||||
{
|
||||
char *hash = NULL;
|
||||
|
||||
assert(salt_p != NULL);
|
||||
assert(salt_malloc_p != NULL);
|
||||
|
||||
/* first make sure we have a salt */
|
||||
if (!passed_salt) {
|
||||
# ifndef OPENSSL_NO_DES
|
||||
if (usecrypt) {
|
||||
if (*salt_malloc_p == NULL)
|
||||
*salt_p = *salt_malloc_p = app_malloc(3, "salt buffer");
|
||||
if (RAND_bytes((unsigned char *)*salt_p, 2) <= 0)
|
||||
goto end;
|
||||
(*salt_p)[0] = cov_2char[(*salt_p)[0] & 0x3f]; /* 6 bits */
|
||||
(*salt_p)[1] = cov_2char[(*salt_p)[1] & 0x3f]; /* 6 bits */
|
||||
(*salt_p)[2] = 0;
|
||||
# ifdef CHARSET_EBCDIC
|
||||
ascii2ebcdic(*salt_p, *salt_p, 2); /* des_crypt will convert back
|
||||
* to ASCII */
|
||||
# endif
|
||||
}
|
||||
# endif /* !OPENSSL_NO_DES */
|
||||
|
||||
# ifndef NO_MD5CRYPT_1
|
||||
if (use1 || useapr1) {
|
||||
int i;
|
||||
|
||||
if (*salt_malloc_p == NULL)
|
||||
*salt_p = *salt_malloc_p = app_malloc(9, "salt buffer");
|
||||
if (RAND_bytes((unsigned char *)*salt_p, 8) <= 0)
|
||||
goto end;
|
||||
|
||||
for (i = 0; i < 8; i++)
|
||||
(*salt_p)[i] = cov_2char[(*salt_p)[i] & 0x3f]; /* 6 bits */
|
||||
(*salt_p)[8] = 0;
|
||||
}
|
||||
# endif /* !NO_MD5CRYPT_1 */
|
||||
}
|
||||
|
||||
assert(*salt_p != NULL);
|
||||
|
||||
/* truncate password if necessary */
|
||||
if ((strlen(passwd) > pw_maxlen)) {
|
||||
if (!quiet)
|
||||
/*
|
||||
* XXX: really we should know how to print a size_t, not cast it
|
||||
*/
|
||||
BIO_printf(bio_err,
|
||||
"Warning: truncating password to %u characters\n",
|
||||
(unsigned)pw_maxlen);
|
||||
passwd[pw_maxlen] = 0;
|
||||
}
|
||||
assert(strlen(passwd) <= pw_maxlen);
|
||||
|
||||
/* now compute password hash */
|
||||
# ifndef OPENSSL_NO_DES
|
||||
if (usecrypt)
|
||||
hash = DES_crypt(passwd, *salt_p);
|
||||
# endif
|
||||
# ifndef NO_MD5CRYPT_1
|
||||
if (use1 || useapr1)
|
||||
hash = md5crypt(passwd, (use1 ? "1" : "apr1"), *salt_p);
|
||||
# endif
|
||||
assert(hash != NULL);
|
||||
|
||||
if (table && !reverse)
|
||||
BIO_printf(out, "%s\t%s\n", passwd, hash);
|
||||
else if (table && reverse)
|
||||
BIO_printf(out, "%s\t%s\n", hash, passwd);
|
||||
else
|
||||
BIO_printf(out, "%s\n", hash);
|
||||
return 1;
|
||||
|
||||
end:
|
||||
return 0;
|
||||
}
|
||||
#else
|
||||
|
||||
int passwd_main(int argc, char **argv)
|
||||
{
|
||||
BIO_printf(bio_err, "Program not available.\n");
|
||||
return (1);
|
||||
}
|
||||
#endif
|
||||
@@ -1 +0,0 @@
|
||||
07
|
||||
@@ -1,16 +0,0 @@
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBALYYjjtpLs/lfkPF
|
||||
xAFZ4V3He5mZFbsEakK9bA2fQaryreRwyfhbXbDJHyBV+c4xI5fbmmVd2t/us4k4
|
||||
rMhGsBtL89SqCEHhPJpLFywiQVmJTAjANYrWkZK5uR/++YmZyzuLfPHLButuK6cF
|
||||
GKXw3NNToxjYooMf0mad2rPX3cKTAgMBAAECgYBvrJ+Nz/Pli9jjt2V9bqHH4Y7r
|
||||
o/avuwVv6Ltbn0+mhy4d6w3yQhYzVSTBr/iDe59YglUt1WFl8/4nKZrNOIzHJlav
|
||||
Sw4hd3fYBHxbT+DgZMQ9ikjHECWRdDffrnlTLsSJAcxnpMJBPe3dKCRDMUrqWUvB
|
||||
IIKaxyqmXJms5Y/wAQJBAPFL9NMKJcWBftMKXCasxsV0ZGjgqHGZODYjtGFN9jJO
|
||||
6AbZrxfCcapTWG4RCC2o/EDEMN8aArEhfdrYY3lhXGsCQQDBMRzFevkD7SYXTw5G
|
||||
NA/gJOAsFMYbt7tebcCRsHT7t3ymVfO2QwK7ZF0f/SYvi7cMAPraHvO7s3kFdGTB
|
||||
kDx5AkAHBICASsFCdzurA5gef9PgFjx9WFtNwnkCChPK6KuKVwUkfdw7wqnvnDDs
|
||||
Mo6cVVfQwmPxeR4u7JxuavCprQ01AkEAp5ZGAh1J9Jj9CQ1AMbAp8WOrvzGKJTM9
|
||||
641Dll4/LLif/d7j2kDJFuvaSMyeGnKVqGkVMq/U+QeYPR4Z5TuM6QJAWK05qFed
|
||||
wYgTZyVN0MY53ZOMAIWwjz0cr24TvDfmsZqIvguGL616GKQZKdKDZQyQHg+dCzqJ
|
||||
HgIoacuFDKz5CA==
|
||||
-----END PRIVATE KEY-----
|
||||
@@ -1,11 +0,0 @@
|
||||
-----BEGIN CERTIFICATE REQUEST-----
|
||||
MIIBnDCCAQUCAQAwXDELMAkGA1UEBhMCQVUxEzARBgNVBAgMClF1ZWVuc2xhbmQx
|
||||
GjAYBgNVBAoMEUNyeXB0U29mdCBQdHkgTHRkMRwwGgYDVQQDDBNUZXN0IFBDQSAo
|
||||
MTAyNCBiaXQpMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC2GI47aS7P5X5D
|
||||
xcQBWeFdx3uZmRW7BGpCvWwNn0Gq8q3kcMn4W12wyR8gVfnOMSOX25plXdrf7rOJ
|
||||
OKzIRrAbS/PUqghB4TyaSxcsIkFZiUwIwDWK1pGSubkf/vmJmcs7i3zxywbrbiun
|
||||
BRil8NzTU6MY2KKDH9Jmndqz193CkwIDAQABoAAwDQYJKoZIhvcNAQELBQADgYEA
|
||||
eJdCB0nHnFK0hek4biAxX0GuJXkknuUy46NKEhv3GBwt4gtO29bfkbQTGOsBBKNs
|
||||
KptlnkItscOXY+0lSva9K3XlwD9do7k2IZFtXJVayZVw1GcKybIY0l7B6kcSxG7T
|
||||
f3CsO+ifdrsJKtyoZNs96lBMrtXyGybt3mgQNdZauQU=
|
||||
-----END CERTIFICATE REQUEST-----
|
||||
935
apps/pkcs12.c
935
apps/pkcs12.c
@@ -1,935 +0,0 @@
|
||||
/*
|
||||
* Copyright 1999-2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include <openssl/opensslconf.h>
|
||||
#if defined(OPENSSL_NO_DES)
|
||||
NON_EMPTY_TRANSLATION_UNIT
|
||||
#else
|
||||
|
||||
# include <stdio.h>
|
||||
# include <stdlib.h>
|
||||
# include <string.h>
|
||||
# include "apps.h"
|
||||
# include <openssl/crypto.h>
|
||||
# include <openssl/err.h>
|
||||
# include <openssl/pem.h>
|
||||
# include <openssl/pkcs12.h>
|
||||
|
||||
# define NOKEYS 0x1
|
||||
# define NOCERTS 0x2
|
||||
# define INFO 0x4
|
||||
# define CLCERTS 0x8
|
||||
# define CACERTS 0x10
|
||||
|
||||
static int get_cert_chain(X509 *cert, X509_STORE *store,
|
||||
STACK_OF(X509) **chain);
|
||||
int dump_certs_keys_p12(BIO *out, const PKCS12 *p12,
|
||||
const char *pass, int passlen, int options,
|
||||
char *pempass, const EVP_CIPHER *enc);
|
||||
int dump_certs_pkeys_bags(BIO *out, const STACK_OF(PKCS12_SAFEBAG) *bags,
|
||||
const char *pass, int passlen, int options,
|
||||
char *pempass, const EVP_CIPHER *enc);
|
||||
int dump_certs_pkeys_bag(BIO *out, const PKCS12_SAFEBAG *bags,
|
||||
const char *pass, int passlen,
|
||||
int options, char *pempass, const EVP_CIPHER *enc);
|
||||
int print_attribs(BIO *out, const STACK_OF(X509_ATTRIBUTE) *attrlst,
|
||||
const char *name);
|
||||
void hex_prin(BIO *out, unsigned char *buf, int len);
|
||||
static int alg_print(const X509_ALGOR *alg);
|
||||
int cert_load(BIO *in, STACK_OF(X509) *sk);
|
||||
static int set_pbe(int *ppbe, const char *str);
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_CIPHER, OPT_NOKEYS, OPT_KEYEX, OPT_KEYSIG, OPT_NOCERTS, OPT_CLCERTS,
|
||||
OPT_CACERTS, OPT_NOOUT, OPT_INFO, OPT_CHAIN, OPT_TWOPASS, OPT_NOMACVER,
|
||||
OPT_DESCERT, OPT_EXPORT, OPT_NOITER, OPT_MACITER, OPT_NOMACITER,
|
||||
OPT_NOMAC, OPT_LMK, OPT_NODES, OPT_MACALG, OPT_CERTPBE, OPT_KEYPBE,
|
||||
OPT_RAND, OPT_INKEY, OPT_CERTFILE, OPT_NAME, OPT_CSP, OPT_CANAME,
|
||||
OPT_IN, OPT_OUT, OPT_PASSIN, OPT_PASSOUT, OPT_PASSWORD, OPT_CAPATH,
|
||||
OPT_CAFILE, OPT_NOCAPATH, OPT_NOCAFILE, OPT_ENGINE
|
||||
} OPTION_CHOICE;
|
||||
|
||||
OPTIONS pkcs12_options[] = {
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"nokeys", OPT_NOKEYS, '-', "Don't output private keys"},
|
||||
{"keyex", OPT_KEYEX, '-', "Set MS key exchange type"},
|
||||
{"keysig", OPT_KEYSIG, '-', "Set MS key signature type"},
|
||||
{"nocerts", OPT_NOCERTS, '-', "Don't output certificates"},
|
||||
{"clcerts", OPT_CLCERTS, '-', "Only output client certificates"},
|
||||
{"cacerts", OPT_CACERTS, '-', "Only output CA certificates"},
|
||||
{"noout", OPT_NOOUT, '-', "Don't output anything, just verify"},
|
||||
{"info", OPT_INFO, '-', "Print info about PKCS#12 structure"},
|
||||
{"chain", OPT_CHAIN, '-', "Add certificate chain"},
|
||||
{"twopass", OPT_TWOPASS, '-', "Separate MAC, encryption passwords"},
|
||||
{"nomacver", OPT_NOMACVER, '-', "Don't verify MAC"},
|
||||
# ifndef OPENSSL_NO_RC2
|
||||
{"descert", OPT_DESCERT, '-',
|
||||
"Encrypt output with 3DES (default RC2-40)"},
|
||||
{"certpbe", OPT_CERTPBE, 's',
|
||||
"Certificate PBE algorithm (default RC2-40)"},
|
||||
# else
|
||||
{"descert", OPT_DESCERT, '-', "Encrypt output with 3DES (the default)"},
|
||||
{"certpbe", OPT_CERTPBE, 's', "Certificate PBE algorithm (default 3DES)"},
|
||||
# endif
|
||||
{"export", OPT_EXPORT, '-', "Output PKCS12 file"},
|
||||
{"noiter", OPT_NOITER, '-', "Don't use encryption iteration"},
|
||||
{"maciter", OPT_MACITER, '-', "Use MAC iteration"},
|
||||
{"nomaciter", OPT_NOMACITER, '-', "Don't use MAC iteration"},
|
||||
{"nomac", OPT_NOMAC, '-', "Don't generate MAC"},
|
||||
{"LMK", OPT_LMK, '-',
|
||||
"Add local machine keyset attribute to private key"},
|
||||
{"nodes", OPT_NODES, '-', "Don't encrypt private keys"},
|
||||
{"macalg", OPT_MACALG, 's',
|
||||
"Digest algorithm used in MAC (default SHA1)"},
|
||||
{"keypbe", OPT_KEYPBE, 's', "Private key PBE algorithm (default 3DES)"},
|
||||
{"rand", OPT_RAND, 's',
|
||||
"Load the file(s) into the random number generator"},
|
||||
{"inkey", OPT_INKEY, 's', "Private key if not infile"},
|
||||
{"certfile", OPT_CERTFILE, '<', "Load certs from file"},
|
||||
{"name", OPT_NAME, 's', "Use name as friendly name"},
|
||||
{"CSP", OPT_CSP, 's', "Microsoft CSP name"},
|
||||
{"caname", OPT_CANAME, 's',
|
||||
"Use name as CA friendly name (can be repeated)"},
|
||||
{"in", OPT_IN, '<', "Input filename"},
|
||||
{"out", OPT_OUT, '>', "Output filename"},
|
||||
{"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
|
||||
{"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
|
||||
{"password", OPT_PASSWORD, 's', "Set import/export password source"},
|
||||
{"CApath", OPT_CAPATH, '/', "PEM-format directory of CA's"},
|
||||
{"CAfile", OPT_CAFILE, '<', "PEM-format file of CA's"},
|
||||
{"no-CAfile", OPT_NOCAFILE, '-',
|
||||
"Do not load the default certificates file"},
|
||||
{"no-CApath", OPT_NOCAPATH, '-',
|
||||
"Do not load certificates from the default certificates directory"},
|
||||
{"", OPT_CIPHER, '-', "Any supported cipher"},
|
||||
# ifndef OPENSSL_NO_ENGINE
|
||||
{"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
|
||||
# endif
|
||||
{NULL}
|
||||
};
|
||||
|
||||
int pkcs12_main(int argc, char **argv)
|
||||
{
|
||||
char *infile = NULL, *outfile = NULL, *keyname = NULL, *certfile = NULL;
|
||||
char *name = NULL, *csp_name = NULL;
|
||||
char pass[2048] = "", macpass[2048] = "";
|
||||
int export_cert = 0, options = 0, chain = 0, twopass = 0, keytype = 0;
|
||||
int iter = PKCS12_DEFAULT_ITER, maciter = PKCS12_DEFAULT_ITER;
|
||||
# ifndef OPENSSL_NO_RC2
|
||||
int cert_pbe = NID_pbe_WithSHA1And40BitRC2_CBC;
|
||||
# else
|
||||
int cert_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
|
||||
# endif
|
||||
int key_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
|
||||
int ret = 1, macver = 1, add_lmk = 0, private = 0;
|
||||
int noprompt = 0;
|
||||
char *passinarg = NULL, *passoutarg = NULL, *passarg = NULL;
|
||||
char *passin = NULL, *passout = NULL, *inrand = NULL, *macalg = NULL;
|
||||
char *cpass = NULL, *mpass = NULL, *badpass = NULL;
|
||||
const char *CApath = NULL, *CAfile = NULL, *prog;
|
||||
int noCApath = 0, noCAfile = 0;
|
||||
ENGINE *e = NULL;
|
||||
BIO *in = NULL, *out = NULL;
|
||||
PKCS12 *p12 = NULL;
|
||||
STACK_OF(OPENSSL_STRING) *canames = NULL;
|
||||
const EVP_CIPHER *enc = EVP_des_ede3_cbc();
|
||||
OPTION_CHOICE o;
|
||||
|
||||
prog = opt_init(argc, argv, pkcs12_options);
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
switch (o) {
|
||||
case OPT_EOF:
|
||||
case OPT_ERR:
|
||||
opthelp:
|
||||
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
||||
goto end;
|
||||
case OPT_HELP:
|
||||
opt_help(pkcs12_options);
|
||||
ret = 0;
|
||||
goto end;
|
||||
case OPT_NOKEYS:
|
||||
options |= NOKEYS;
|
||||
break;
|
||||
case OPT_KEYEX:
|
||||
keytype = KEY_EX;
|
||||
break;
|
||||
case OPT_KEYSIG:
|
||||
keytype = KEY_SIG;
|
||||
break;
|
||||
case OPT_NOCERTS:
|
||||
options |= NOCERTS;
|
||||
break;
|
||||
case OPT_CLCERTS:
|
||||
options |= CLCERTS;
|
||||
break;
|
||||
case OPT_CACERTS:
|
||||
options |= CACERTS;
|
||||
break;
|
||||
case OPT_NOOUT:
|
||||
options |= (NOKEYS | NOCERTS);
|
||||
break;
|
||||
case OPT_INFO:
|
||||
options |= INFO;
|
||||
break;
|
||||
case OPT_CHAIN:
|
||||
chain = 1;
|
||||
break;
|
||||
case OPT_TWOPASS:
|
||||
twopass = 1;
|
||||
break;
|
||||
case OPT_NOMACVER:
|
||||
macver = 0;
|
||||
break;
|
||||
case OPT_DESCERT:
|
||||
cert_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
|
||||
break;
|
||||
case OPT_EXPORT:
|
||||
export_cert = 1;
|
||||
break;
|
||||
case OPT_CIPHER:
|
||||
if (!opt_cipher(opt_unknown(), &enc))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_NOITER:
|
||||
iter = 1;
|
||||
break;
|
||||
case OPT_MACITER:
|
||||
maciter = PKCS12_DEFAULT_ITER;
|
||||
break;
|
||||
case OPT_NOMACITER:
|
||||
maciter = 1;
|
||||
break;
|
||||
case OPT_NOMAC:
|
||||
maciter = -1;
|
||||
break;
|
||||
case OPT_MACALG:
|
||||
macalg = opt_arg();
|
||||
break;
|
||||
case OPT_NODES:
|
||||
enc = NULL;
|
||||
break;
|
||||
case OPT_CERTPBE:
|
||||
if (!set_pbe(&cert_pbe, opt_arg()))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_KEYPBE:
|
||||
if (!set_pbe(&key_pbe, opt_arg()))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_RAND:
|
||||
inrand = opt_arg();
|
||||
break;
|
||||
case OPT_INKEY:
|
||||
keyname = opt_arg();
|
||||
break;
|
||||
case OPT_CERTFILE:
|
||||
certfile = opt_arg();
|
||||
break;
|
||||
case OPT_NAME:
|
||||
name = opt_arg();
|
||||
break;
|
||||
case OPT_LMK:
|
||||
add_lmk = 1;
|
||||
break;
|
||||
case OPT_CSP:
|
||||
csp_name = opt_arg();
|
||||
break;
|
||||
case OPT_CANAME:
|
||||
if (canames == NULL
|
||||
&& (canames = sk_OPENSSL_STRING_new_null()) == NULL)
|
||||
goto end;
|
||||
sk_OPENSSL_STRING_push(canames, opt_arg());
|
||||
break;
|
||||
case OPT_IN:
|
||||
infile = opt_arg();
|
||||
break;
|
||||
case OPT_OUT:
|
||||
outfile = opt_arg();
|
||||
break;
|
||||
case OPT_PASSIN:
|
||||
passinarg = opt_arg();
|
||||
break;
|
||||
case OPT_PASSOUT:
|
||||
passoutarg = opt_arg();
|
||||
break;
|
||||
case OPT_PASSWORD:
|
||||
passarg = opt_arg();
|
||||
break;
|
||||
case OPT_CAPATH:
|
||||
CApath = opt_arg();
|
||||
break;
|
||||
case OPT_CAFILE:
|
||||
CAfile = opt_arg();
|
||||
break;
|
||||
case OPT_NOCAPATH:
|
||||
noCApath = 1;
|
||||
break;
|
||||
case OPT_NOCAFILE:
|
||||
noCAfile = 1;
|
||||
break;
|
||||
case OPT_ENGINE:
|
||||
e = setup_engine(opt_arg(), 0);
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
if (argc != 0)
|
||||
goto opthelp;
|
||||
|
||||
private = 1;
|
||||
|
||||
if (passarg) {
|
||||
if (export_cert)
|
||||
passoutarg = passarg;
|
||||
else
|
||||
passinarg = passarg;
|
||||
}
|
||||
|
||||
if (!app_passwd(passinarg, passoutarg, &passin, &passout)) {
|
||||
BIO_printf(bio_err, "Error getting passwords\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (!cpass) {
|
||||
if (export_cert)
|
||||
cpass = passout;
|
||||
else
|
||||
cpass = passin;
|
||||
}
|
||||
|
||||
if (cpass) {
|
||||
mpass = cpass;
|
||||
noprompt = 1;
|
||||
} else {
|
||||
cpass = pass;
|
||||
mpass = macpass;
|
||||
}
|
||||
|
||||
if (export_cert || inrand) {
|
||||
app_RAND_load_file(NULL, (inrand != NULL));
|
||||
if (inrand != NULL)
|
||||
BIO_printf(bio_err, "%ld semi-random bytes loaded\n",
|
||||
app_RAND_load_files(inrand));
|
||||
}
|
||||
|
||||
if (twopass) {
|
||||
if (1) {
|
||||
#ifndef OPENSSL_NO_UI
|
||||
if (EVP_read_pw_string
|
||||
(macpass, sizeof(macpass), "Enter MAC Password:", export_cert)) {
|
||||
BIO_printf(bio_err, "Can't read Password\n");
|
||||
goto end;
|
||||
}
|
||||
} else {
|
||||
#endif
|
||||
BIO_printf(bio_err, "Unsupported option -twopass\n");
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
if (export_cert) {
|
||||
EVP_PKEY *key = NULL;
|
||||
X509 *ucert = NULL, *x = NULL;
|
||||
STACK_OF(X509) *certs = NULL;
|
||||
const EVP_MD *macmd = NULL;
|
||||
unsigned char *catmp = NULL;
|
||||
int i;
|
||||
|
||||
if ((options & (NOCERTS | NOKEYS)) == (NOCERTS | NOKEYS)) {
|
||||
BIO_printf(bio_err, "Nothing to do!\n");
|
||||
goto export_end;
|
||||
}
|
||||
|
||||
if (options & NOCERTS)
|
||||
chain = 0;
|
||||
|
||||
if (!(options & NOKEYS)) {
|
||||
key = load_key(keyname ? keyname : infile,
|
||||
FORMAT_PEM, 1, passin, e, "private key");
|
||||
if (!key)
|
||||
goto export_end;
|
||||
}
|
||||
|
||||
/* Load in all certs in input file */
|
||||
if (!(options & NOCERTS)) {
|
||||
if (!load_certs(infile, &certs, FORMAT_PEM, NULL,
|
||||
"certificates"))
|
||||
goto export_end;
|
||||
|
||||
if (key) {
|
||||
/* Look for matching private key */
|
||||
for (i = 0; i < sk_X509_num(certs); i++) {
|
||||
x = sk_X509_value(certs, i);
|
||||
if (X509_check_private_key(x, key)) {
|
||||
ucert = x;
|
||||
/* Zero keyid and alias */
|
||||
X509_keyid_set1(ucert, NULL, 0);
|
||||
X509_alias_set1(ucert, NULL, 0);
|
||||
/* Remove from list */
|
||||
(void)sk_X509_delete(certs, i);
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (!ucert) {
|
||||
BIO_printf(bio_err,
|
||||
"No certificate matches private key\n");
|
||||
goto export_end;
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
/* Add any more certificates asked for */
|
||||
if (certfile) {
|
||||
if (!load_certs(certfile, &certs, FORMAT_PEM, NULL,
|
||||
"certificates from certfile"))
|
||||
goto export_end;
|
||||
}
|
||||
|
||||
/* If chaining get chain from user cert */
|
||||
if (chain) {
|
||||
int vret;
|
||||
STACK_OF(X509) *chain2;
|
||||
X509_STORE *store;
|
||||
if ((store = setup_verify(CAfile, CApath, noCAfile, noCApath))
|
||||
== NULL)
|
||||
goto export_end;
|
||||
|
||||
vret = get_cert_chain(ucert, store, &chain2);
|
||||
X509_STORE_free(store);
|
||||
|
||||
if (vret == X509_V_OK) {
|
||||
/* Exclude verified certificate */
|
||||
for (i = 1; i < sk_X509_num(chain2); i++)
|
||||
sk_X509_push(certs, sk_X509_value(chain2, i));
|
||||
/* Free first certificate */
|
||||
X509_free(sk_X509_value(chain2, 0));
|
||||
sk_X509_free(chain2);
|
||||
} else {
|
||||
if (vret != X509_V_ERR_UNSPECIFIED)
|
||||
BIO_printf(bio_err, "Error %s getting chain.\n",
|
||||
X509_verify_cert_error_string(vret));
|
||||
else
|
||||
ERR_print_errors(bio_err);
|
||||
goto export_end;
|
||||
}
|
||||
}
|
||||
|
||||
/* Add any CA names */
|
||||
|
||||
for (i = 0; i < sk_OPENSSL_STRING_num(canames); i++) {
|
||||
catmp = (unsigned char *)sk_OPENSSL_STRING_value(canames, i);
|
||||
X509_alias_set1(sk_X509_value(certs, i), catmp, -1);
|
||||
}
|
||||
|
||||
if (csp_name && key)
|
||||
EVP_PKEY_add1_attr_by_NID(key, NID_ms_csp_name,
|
||||
MBSTRING_ASC, (unsigned char *)csp_name,
|
||||
-1);
|
||||
|
||||
if (add_lmk && key)
|
||||
EVP_PKEY_add1_attr_by_NID(key, NID_LocalKeySet, 0, NULL, -1);
|
||||
|
||||
if (!noprompt) {
|
||||
if (1) {
|
||||
#ifndef OPENSSL_NO_UI
|
||||
if (EVP_read_pw_string(pass, sizeof(pass), "Enter Export Password:",
|
||||
1)) {
|
||||
BIO_printf(bio_err, "Can't read Password\n");
|
||||
goto export_end;
|
||||
}
|
||||
} else {
|
||||
#endif
|
||||
BIO_printf(bio_err, "Password required\n");
|
||||
goto export_end;
|
||||
}
|
||||
}
|
||||
|
||||
if (!twopass)
|
||||
OPENSSL_strlcpy(macpass, pass, sizeof(macpass));
|
||||
|
||||
p12 = PKCS12_create(cpass, name, key, ucert, certs,
|
||||
key_pbe, cert_pbe, iter, -1, keytype);
|
||||
|
||||
if (!p12) {
|
||||
ERR_print_errors(bio_err);
|
||||
goto export_end;
|
||||
}
|
||||
|
||||
if (macalg) {
|
||||
if (!opt_md(macalg, &macmd))
|
||||
goto opthelp;
|
||||
}
|
||||
|
||||
if (maciter != -1)
|
||||
PKCS12_set_mac(p12, mpass, -1, NULL, 0, maciter, macmd);
|
||||
|
||||
assert(private);
|
||||
|
||||
out = bio_open_owner(outfile, FORMAT_PKCS12, private);
|
||||
if (out == NULL)
|
||||
goto end;
|
||||
|
||||
i2d_PKCS12_bio(out, p12);
|
||||
|
||||
ret = 0;
|
||||
|
||||
export_end:
|
||||
|
||||
EVP_PKEY_free(key);
|
||||
sk_X509_pop_free(certs, X509_free);
|
||||
X509_free(ucert);
|
||||
|
||||
goto end;
|
||||
|
||||
}
|
||||
|
||||
in = bio_open_default(infile, 'r', FORMAT_PKCS12);
|
||||
if (in == NULL)
|
||||
goto end;
|
||||
out = bio_open_owner(outfile, FORMAT_PEM, private);
|
||||
if (out == NULL)
|
||||
goto end;
|
||||
|
||||
if ((p12 = d2i_PKCS12_bio(in, NULL)) == NULL) {
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (!noprompt) {
|
||||
if (1) {
|
||||
#ifndef OPENSSL_NO_UI
|
||||
if (EVP_read_pw_string(pass, sizeof(pass), "Enter Import Password:",
|
||||
0)) {
|
||||
BIO_printf(bio_err, "Can't read Password\n");
|
||||
goto end;
|
||||
}
|
||||
} else {
|
||||
#endif
|
||||
BIO_printf(bio_err, "Password required\n");
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
if (!twopass)
|
||||
OPENSSL_strlcpy(macpass, pass, sizeof(macpass));
|
||||
|
||||
if ((options & INFO) && PKCS12_mac_present(p12)) {
|
||||
const ASN1_INTEGER *tmaciter;
|
||||
const X509_ALGOR *macalgid;
|
||||
const ASN1_OBJECT *macobj;
|
||||
PKCS12_get0_mac(NULL, &macalgid, NULL, &tmaciter, p12);
|
||||
X509_ALGOR_get0(&macobj, NULL, NULL, macalgid);
|
||||
BIO_puts(bio_err, "MAC:");
|
||||
i2a_ASN1_OBJECT(bio_err, macobj);
|
||||
BIO_printf(bio_err, " Iteration %ld\n",
|
||||
tmaciter != NULL ? ASN1_INTEGER_get(tmaciter) : 1L);
|
||||
}
|
||||
if (macver) {
|
||||
/* If we enter empty password try no password first */
|
||||
if (!mpass[0] && PKCS12_verify_mac(p12, NULL, 0)) {
|
||||
/* If mac and crypto pass the same set it to NULL too */
|
||||
if (!twopass)
|
||||
cpass = NULL;
|
||||
} else if (!PKCS12_verify_mac(p12, mpass, -1)) {
|
||||
/*
|
||||
* May be UTF8 from previous version of OpenSSL:
|
||||
* convert to a UTF8 form which will translate
|
||||
* to the same Unicode password.
|
||||
*/
|
||||
unsigned char *utmp;
|
||||
int utmplen;
|
||||
utmp = OPENSSL_asc2uni(mpass, -1, NULL, &utmplen);
|
||||
if (utmp == NULL)
|
||||
goto end;
|
||||
badpass = OPENSSL_uni2utf8(utmp, utmplen);
|
||||
OPENSSL_free(utmp);
|
||||
if (!PKCS12_verify_mac(p12, badpass, -1)) {
|
||||
BIO_printf(bio_err, "Mac verify error: invalid password?\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
} else {
|
||||
BIO_printf(bio_err, "Warning: using broken algorithm\n");
|
||||
if (!twopass)
|
||||
cpass = badpass;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
assert(private);
|
||||
if (!dump_certs_keys_p12(out, p12, cpass, -1, options, passout, enc)) {
|
||||
BIO_printf(bio_err, "Error outputting keys and certificates\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
ret = 0;
|
||||
end:
|
||||
PKCS12_free(p12);
|
||||
if (export_cert || inrand)
|
||||
app_RAND_write_file(NULL);
|
||||
release_engine(e);
|
||||
BIO_free(in);
|
||||
BIO_free_all(out);
|
||||
sk_OPENSSL_STRING_free(canames);
|
||||
OPENSSL_free(badpass);
|
||||
OPENSSL_free(passin);
|
||||
OPENSSL_free(passout);
|
||||
return (ret);
|
||||
}
|
||||
|
||||
int dump_certs_keys_p12(BIO *out, const PKCS12 *p12, const char *pass,
|
||||
int passlen, int options, char *pempass,
|
||||
const EVP_CIPHER *enc)
|
||||
{
|
||||
STACK_OF(PKCS7) *asafes = NULL;
|
||||
STACK_OF(PKCS12_SAFEBAG) *bags;
|
||||
int i, bagnid;
|
||||
int ret = 0;
|
||||
PKCS7 *p7;
|
||||
|
||||
if ((asafes = PKCS12_unpack_authsafes(p12)) == NULL)
|
||||
return 0;
|
||||
for (i = 0; i < sk_PKCS7_num(asafes); i++) {
|
||||
p7 = sk_PKCS7_value(asafes, i);
|
||||
bagnid = OBJ_obj2nid(p7->type);
|
||||
if (bagnid == NID_pkcs7_data) {
|
||||
bags = PKCS12_unpack_p7data(p7);
|
||||
if (options & INFO)
|
||||
BIO_printf(bio_err, "PKCS7 Data\n");
|
||||
} else if (bagnid == NID_pkcs7_encrypted) {
|
||||
if (options & INFO) {
|
||||
BIO_printf(bio_err, "PKCS7 Encrypted data: ");
|
||||
alg_print(p7->d.encrypted->enc_data->algorithm);
|
||||
}
|
||||
bags = PKCS12_unpack_p7encdata(p7, pass, passlen);
|
||||
} else
|
||||
continue;
|
||||
if (!bags)
|
||||
goto err;
|
||||
if (!dump_certs_pkeys_bags(out, bags, pass, passlen,
|
||||
options, pempass, enc)) {
|
||||
sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
|
||||
goto err;
|
||||
}
|
||||
sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
|
||||
bags = NULL;
|
||||
}
|
||||
ret = 1;
|
||||
|
||||
err:
|
||||
sk_PKCS7_pop_free(asafes, PKCS7_free);
|
||||
return ret;
|
||||
}
|
||||
|
||||
int dump_certs_pkeys_bags(BIO *out, const STACK_OF(PKCS12_SAFEBAG) *bags,
|
||||
const char *pass, int passlen, int options,
|
||||
char *pempass, const EVP_CIPHER *enc)
|
||||
{
|
||||
int i;
|
||||
for (i = 0; i < sk_PKCS12_SAFEBAG_num(bags); i++) {
|
||||
if (!dump_certs_pkeys_bag(out,
|
||||
sk_PKCS12_SAFEBAG_value(bags, i),
|
||||
pass, passlen, options, pempass, enc))
|
||||
return 0;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
int dump_certs_pkeys_bag(BIO *out, const PKCS12_SAFEBAG *bag,
|
||||
const char *pass, int passlen, int options,
|
||||
char *pempass, const EVP_CIPHER *enc)
|
||||
{
|
||||
EVP_PKEY *pkey;
|
||||
PKCS8_PRIV_KEY_INFO *p8;
|
||||
const PKCS8_PRIV_KEY_INFO *p8c;
|
||||
X509 *x509;
|
||||
const STACK_OF(X509_ATTRIBUTE) *attrs;
|
||||
int ret = 0;
|
||||
|
||||
attrs = PKCS12_SAFEBAG_get0_attrs(bag);
|
||||
|
||||
switch (PKCS12_SAFEBAG_get_nid(bag)) {
|
||||
case NID_keyBag:
|
||||
if (options & INFO)
|
||||
BIO_printf(bio_err, "Key bag\n");
|
||||
if (options & NOKEYS)
|
||||
return 1;
|
||||
print_attribs(out, attrs, "Bag Attributes");
|
||||
p8c = PKCS12_SAFEBAG_get0_p8inf(bag);
|
||||
if ((pkey = EVP_PKCS82PKEY(p8c)) == NULL)
|
||||
return 0;
|
||||
print_attribs(out, PKCS8_pkey_get0_attrs(p8c), "Key Attributes");
|
||||
ret = PEM_write_bio_PrivateKey(out, pkey, enc, NULL, 0, NULL, pempass);
|
||||
EVP_PKEY_free(pkey);
|
||||
break;
|
||||
|
||||
case NID_pkcs8ShroudedKeyBag:
|
||||
if (options & INFO) {
|
||||
const X509_SIG *tp8;
|
||||
const X509_ALGOR *tp8alg;
|
||||
|
||||
BIO_printf(bio_err, "Shrouded Keybag: ");
|
||||
tp8 = PKCS12_SAFEBAG_get0_pkcs8(bag);
|
||||
X509_SIG_get0(tp8, &tp8alg, NULL);
|
||||
alg_print(tp8alg);
|
||||
}
|
||||
if (options & NOKEYS)
|
||||
return 1;
|
||||
print_attribs(out, attrs, "Bag Attributes");
|
||||
if ((p8 = PKCS12_decrypt_skey(bag, pass, passlen)) == NULL)
|
||||
return 0;
|
||||
if ((pkey = EVP_PKCS82PKEY(p8)) == NULL) {
|
||||
PKCS8_PRIV_KEY_INFO_free(p8);
|
||||
return 0;
|
||||
}
|
||||
print_attribs(out, PKCS8_pkey_get0_attrs(p8), "Key Attributes");
|
||||
PKCS8_PRIV_KEY_INFO_free(p8);
|
||||
ret = PEM_write_bio_PrivateKey(out, pkey, enc, NULL, 0, NULL, pempass);
|
||||
EVP_PKEY_free(pkey);
|
||||
break;
|
||||
|
||||
case NID_certBag:
|
||||
if (options & INFO)
|
||||
BIO_printf(bio_err, "Certificate bag\n");
|
||||
if (options & NOCERTS)
|
||||
return 1;
|
||||
if (PKCS12_SAFEBAG_get0_attr(bag, NID_localKeyID)) {
|
||||
if (options & CACERTS)
|
||||
return 1;
|
||||
} else if (options & CLCERTS)
|
||||
return 1;
|
||||
print_attribs(out, attrs, "Bag Attributes");
|
||||
if (PKCS12_SAFEBAG_get_bag_nid(bag) != NID_x509Certificate)
|
||||
return 1;
|
||||
if ((x509 = PKCS12_SAFEBAG_get1_cert(bag)) == NULL)
|
||||
return 0;
|
||||
dump_cert_text(out, x509);
|
||||
ret = PEM_write_bio_X509(out, x509);
|
||||
X509_free(x509);
|
||||
break;
|
||||
|
||||
case NID_safeContentsBag:
|
||||
if (options & INFO)
|
||||
BIO_printf(bio_err, "Safe Contents bag\n");
|
||||
print_attribs(out, attrs, "Bag Attributes");
|
||||
return dump_certs_pkeys_bags(out, PKCS12_SAFEBAG_get0_safes(bag),
|
||||
pass, passlen, options, pempass, enc);
|
||||
|
||||
default:
|
||||
BIO_printf(bio_err, "Warning unsupported bag type: ");
|
||||
i2a_ASN1_OBJECT(bio_err, PKCS12_SAFEBAG_get0_type(bag));
|
||||
BIO_printf(bio_err, "\n");
|
||||
return 1;
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
|
||||
/* Given a single certificate return a verified chain or NULL if error */
|
||||
|
||||
static int get_cert_chain(X509 *cert, X509_STORE *store,
|
||||
STACK_OF(X509) **chain)
|
||||
{
|
||||
X509_STORE_CTX *store_ctx = NULL;
|
||||
STACK_OF(X509) *chn = NULL;
|
||||
int i = 0;
|
||||
|
||||
store_ctx = X509_STORE_CTX_new();
|
||||
if (store_ctx == NULL) {
|
||||
i = X509_V_ERR_UNSPECIFIED;
|
||||
goto end;
|
||||
}
|
||||
if (!X509_STORE_CTX_init(store_ctx, store, cert, NULL)) {
|
||||
i = X509_V_ERR_UNSPECIFIED;
|
||||
goto end;
|
||||
}
|
||||
|
||||
|
||||
if (X509_verify_cert(store_ctx) > 0)
|
||||
chn = X509_STORE_CTX_get1_chain(store_ctx);
|
||||
else if ((i = X509_STORE_CTX_get_error(store_ctx)) == 0)
|
||||
i = X509_V_ERR_UNSPECIFIED;
|
||||
|
||||
end:
|
||||
X509_STORE_CTX_free(store_ctx);
|
||||
*chain = chn;
|
||||
return i;
|
||||
}
|
||||
|
||||
static int alg_print(const X509_ALGOR *alg)
|
||||
{
|
||||
int pbenid, aparamtype;
|
||||
const ASN1_OBJECT *aoid;
|
||||
const void *aparam;
|
||||
PBEPARAM *pbe = NULL;
|
||||
|
||||
X509_ALGOR_get0(&aoid, &aparamtype, &aparam, alg);
|
||||
|
||||
pbenid = OBJ_obj2nid(aoid);
|
||||
|
||||
BIO_printf(bio_err, "%s", OBJ_nid2ln(pbenid));
|
||||
|
||||
/*
|
||||
* If PBE algorithm is PBES2 decode algorithm parameters
|
||||
* for additional details.
|
||||
*/
|
||||
if (pbenid == NID_pbes2) {
|
||||
PBE2PARAM *pbe2 = NULL;
|
||||
int encnid;
|
||||
if (aparamtype == V_ASN1_SEQUENCE)
|
||||
pbe2 = ASN1_item_unpack(aparam, ASN1_ITEM_rptr(PBE2PARAM));
|
||||
if (pbe2 == NULL) {
|
||||
BIO_puts(bio_err, "<unsupported parameters>");
|
||||
goto done;
|
||||
}
|
||||
X509_ALGOR_get0(&aoid, &aparamtype, &aparam, pbe2->keyfunc);
|
||||
pbenid = OBJ_obj2nid(aoid);
|
||||
X509_ALGOR_get0(&aoid, NULL, NULL, pbe2->encryption);
|
||||
encnid = OBJ_obj2nid(aoid);
|
||||
BIO_printf(bio_err, ", %s, %s", OBJ_nid2ln(pbenid),
|
||||
OBJ_nid2sn(encnid));
|
||||
/* If KDF is PBKDF2 decode parameters */
|
||||
if (pbenid == NID_id_pbkdf2) {
|
||||
PBKDF2PARAM *kdf = NULL;
|
||||
int prfnid;
|
||||
if (aparamtype == V_ASN1_SEQUENCE)
|
||||
kdf = ASN1_item_unpack(aparam, ASN1_ITEM_rptr(PBKDF2PARAM));
|
||||
if (kdf == NULL) {
|
||||
BIO_puts(bio_err, "<unsupported parameters>");
|
||||
goto done;
|
||||
}
|
||||
|
||||
if (kdf->prf == NULL) {
|
||||
prfnid = NID_hmacWithSHA1;
|
||||
} else {
|
||||
X509_ALGOR_get0(&aoid, NULL, NULL, kdf->prf);
|
||||
prfnid = OBJ_obj2nid(aoid);
|
||||
}
|
||||
BIO_printf(bio_err, ", Iteration %ld, PRF %s",
|
||||
ASN1_INTEGER_get(kdf->iter), OBJ_nid2sn(prfnid));
|
||||
PBKDF2PARAM_free(kdf);
|
||||
}
|
||||
PBE2PARAM_free(pbe2);
|
||||
} else {
|
||||
if (aparamtype == V_ASN1_SEQUENCE)
|
||||
pbe = ASN1_item_unpack(aparam, ASN1_ITEM_rptr(PBEPARAM));
|
||||
if (pbe == NULL) {
|
||||
BIO_puts(bio_err, "<unsupported parameters>");
|
||||
goto done;
|
||||
}
|
||||
BIO_printf(bio_err, ", Iteration %ld", ASN1_INTEGER_get(pbe->iter));
|
||||
PBEPARAM_free(pbe);
|
||||
}
|
||||
done:
|
||||
BIO_puts(bio_err, "\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* Load all certificates from a given file */
|
||||
|
||||
int cert_load(BIO *in, STACK_OF(X509) *sk)
|
||||
{
|
||||
int ret;
|
||||
X509 *cert;
|
||||
ret = 0;
|
||||
while ((cert = PEM_read_bio_X509(in, NULL, NULL, NULL))) {
|
||||
ret = 1;
|
||||
sk_X509_push(sk, cert);
|
||||
}
|
||||
if (ret)
|
||||
ERR_clear_error();
|
||||
return ret;
|
||||
}
|
||||
|
||||
/* Generalised attribute print: handle PKCS#8 and bag attributes */
|
||||
|
||||
int print_attribs(BIO *out, const STACK_OF(X509_ATTRIBUTE) *attrlst,
|
||||
const char *name)
|
||||
{
|
||||
X509_ATTRIBUTE *attr;
|
||||
ASN1_TYPE *av;
|
||||
char *value;
|
||||
int i, attr_nid;
|
||||
if (!attrlst) {
|
||||
BIO_printf(out, "%s: <No Attributes>\n", name);
|
||||
return 1;
|
||||
}
|
||||
if (!sk_X509_ATTRIBUTE_num(attrlst)) {
|
||||
BIO_printf(out, "%s: <Empty Attributes>\n", name);
|
||||
return 1;
|
||||
}
|
||||
BIO_printf(out, "%s\n", name);
|
||||
for (i = 0; i < sk_X509_ATTRIBUTE_num(attrlst); i++) {
|
||||
ASN1_OBJECT *attr_obj;
|
||||
attr = sk_X509_ATTRIBUTE_value(attrlst, i);
|
||||
attr_obj = X509_ATTRIBUTE_get0_object(attr);
|
||||
attr_nid = OBJ_obj2nid(attr_obj);
|
||||
BIO_printf(out, " ");
|
||||
if (attr_nid == NID_undef) {
|
||||
i2a_ASN1_OBJECT(out, attr_obj);
|
||||
BIO_printf(out, ": ");
|
||||
} else
|
||||
BIO_printf(out, "%s: ", OBJ_nid2ln(attr_nid));
|
||||
|
||||
if (X509_ATTRIBUTE_count(attr)) {
|
||||
av = X509_ATTRIBUTE_get0_type(attr, 0);
|
||||
switch (av->type) {
|
||||
case V_ASN1_BMPSTRING:
|
||||
value = OPENSSL_uni2asc(av->value.bmpstring->data,
|
||||
av->value.bmpstring->length);
|
||||
BIO_printf(out, "%s\n", value);
|
||||
OPENSSL_free(value);
|
||||
break;
|
||||
|
||||
case V_ASN1_OCTET_STRING:
|
||||
hex_prin(out, av->value.octet_string->data,
|
||||
av->value.octet_string->length);
|
||||
BIO_printf(out, "\n");
|
||||
break;
|
||||
|
||||
case V_ASN1_BIT_STRING:
|
||||
hex_prin(out, av->value.bit_string->data,
|
||||
av->value.bit_string->length);
|
||||
BIO_printf(out, "\n");
|
||||
break;
|
||||
|
||||
default:
|
||||
BIO_printf(out, "<Unsupported tag %d>\n", av->type);
|
||||
break;
|
||||
}
|
||||
} else
|
||||
BIO_printf(out, "<No Values>\n");
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
void hex_prin(BIO *out, unsigned char *buf, int len)
|
||||
{
|
||||
int i;
|
||||
for (i = 0; i < len; i++)
|
||||
BIO_printf(out, "%02X ", buf[i]);
|
||||
}
|
||||
|
||||
static int set_pbe(int *ppbe, const char *str)
|
||||
{
|
||||
if (!str)
|
||||
return 0;
|
||||
if (strcmp(str, "NONE") == 0) {
|
||||
*ppbe = -1;
|
||||
return 1;
|
||||
}
|
||||
*ppbe = OBJ_txt2nid(str);
|
||||
if (*ppbe == NID_undef) {
|
||||
BIO_printf(bio_err, "Unknown PBE algorithm %s\n", str);
|
||||
return 0;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
#endif
|
||||
197
apps/pkcs7.c
197
apps/pkcs7.c
@@ -1,197 +0,0 @@
|
||||
/*
|
||||
* Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <time.h>
|
||||
#include "apps.h"
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/objects.h>
|
||||
#include <openssl/evp.h>
|
||||
#include <openssl/x509.h>
|
||||
#include <openssl/pkcs7.h>
|
||||
#include <openssl/pem.h>
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_NOOUT,
|
||||
OPT_TEXT, OPT_PRINT, OPT_PRINT_CERTS, OPT_ENGINE
|
||||
} OPTION_CHOICE;
|
||||
|
||||
OPTIONS pkcs7_options[] = {
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"inform", OPT_INFORM, 'F', "Input format - DER or PEM"},
|
||||
{"in", OPT_IN, '<', "Input file"},
|
||||
{"outform", OPT_OUTFORM, 'F', "Output format - DER or PEM"},
|
||||
{"out", OPT_OUT, '>', "Output file"},
|
||||
{"noout", OPT_NOOUT, '-', "Don't output encoded data"},
|
||||
{"text", OPT_TEXT, '-', "Print full details of certificates"},
|
||||
{"print", OPT_PRINT, '-', "Print out all fields of the PKCS7 structure"},
|
||||
{"print_certs", OPT_PRINT_CERTS, '-',
|
||||
"Print_certs print any certs or crl in the input"},
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
{"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
|
||||
#endif
|
||||
{NULL}
|
||||
};
|
||||
|
||||
int pkcs7_main(int argc, char **argv)
|
||||
{
|
||||
ENGINE *e = NULL;
|
||||
PKCS7 *p7 = NULL;
|
||||
BIO *in = NULL, *out = NULL;
|
||||
int informat = FORMAT_PEM, outformat = FORMAT_PEM;
|
||||
char *infile = NULL, *outfile = NULL, *prog;
|
||||
int i, print_certs = 0, text = 0, noout = 0, p7_print = 0, ret = 1;
|
||||
OPTION_CHOICE o;
|
||||
|
||||
prog = opt_init(argc, argv, pkcs7_options);
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
switch (o) {
|
||||
case OPT_EOF:
|
||||
case OPT_ERR:
|
||||
opthelp:
|
||||
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
||||
goto end;
|
||||
case OPT_HELP:
|
||||
opt_help(pkcs7_options);
|
||||
ret = 0;
|
||||
goto end;
|
||||
case OPT_INFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &informat))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_OUTFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &outformat))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_IN:
|
||||
infile = opt_arg();
|
||||
break;
|
||||
case OPT_OUT:
|
||||
outfile = opt_arg();
|
||||
break;
|
||||
case OPT_NOOUT:
|
||||
noout = 1;
|
||||
break;
|
||||
case OPT_TEXT:
|
||||
text = 1;
|
||||
break;
|
||||
case OPT_PRINT:
|
||||
p7_print = 1;
|
||||
break;
|
||||
case OPT_PRINT_CERTS:
|
||||
print_certs = 1;
|
||||
break;
|
||||
case OPT_ENGINE:
|
||||
e = setup_engine(opt_arg(), 0);
|
||||
break;
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
if (argc != 0)
|
||||
goto opthelp;
|
||||
|
||||
in = bio_open_default(infile, 'r', informat);
|
||||
if (in == NULL)
|
||||
goto end;
|
||||
|
||||
if (informat == FORMAT_ASN1)
|
||||
p7 = d2i_PKCS7_bio(in, NULL);
|
||||
else
|
||||
p7 = PEM_read_bio_PKCS7(in, NULL, NULL, NULL);
|
||||
if (p7 == NULL) {
|
||||
BIO_printf(bio_err, "unable to load PKCS7 object\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
|
||||
out = bio_open_default(outfile, 'w', outformat);
|
||||
if (out == NULL)
|
||||
goto end;
|
||||
|
||||
if (p7_print)
|
||||
PKCS7_print_ctx(out, p7, 0, NULL);
|
||||
|
||||
if (print_certs) {
|
||||
STACK_OF(X509) *certs = NULL;
|
||||
STACK_OF(X509_CRL) *crls = NULL;
|
||||
|
||||
i = OBJ_obj2nid(p7->type);
|
||||
switch (i) {
|
||||
case NID_pkcs7_signed:
|
||||
if (p7->d.sign != NULL) {
|
||||
certs = p7->d.sign->cert;
|
||||
crls = p7->d.sign->crl;
|
||||
}
|
||||
break;
|
||||
case NID_pkcs7_signedAndEnveloped:
|
||||
if (p7->d.signed_and_enveloped != NULL) {
|
||||
certs = p7->d.signed_and_enveloped->cert;
|
||||
crls = p7->d.signed_and_enveloped->crl;
|
||||
}
|
||||
break;
|
||||
default:
|
||||
break;
|
||||
}
|
||||
|
||||
if (certs != NULL) {
|
||||
X509 *x;
|
||||
|
||||
for (i = 0; i < sk_X509_num(certs); i++) {
|
||||
x = sk_X509_value(certs, i);
|
||||
if (text)
|
||||
X509_print(out, x);
|
||||
else
|
||||
dump_cert_text(out, x);
|
||||
|
||||
if (!noout)
|
||||
PEM_write_bio_X509(out, x);
|
||||
BIO_puts(out, "\n");
|
||||
}
|
||||
}
|
||||
if (crls != NULL) {
|
||||
X509_CRL *crl;
|
||||
|
||||
for (i = 0; i < sk_X509_CRL_num(crls); i++) {
|
||||
crl = sk_X509_CRL_value(crls, i);
|
||||
|
||||
X509_CRL_print(out, crl);
|
||||
|
||||
if (!noout)
|
||||
PEM_write_bio_X509_CRL(out, crl);
|
||||
BIO_puts(out, "\n");
|
||||
}
|
||||
}
|
||||
|
||||
ret = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (!noout) {
|
||||
if (outformat == FORMAT_ASN1)
|
||||
i = i2d_PKCS7_bio(out, p7);
|
||||
else
|
||||
i = PEM_write_bio_PKCS7(out, p7);
|
||||
|
||||
if (!i) {
|
||||
BIO_printf(bio_err, "unable to write pkcs7 object\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
ret = 0;
|
||||
end:
|
||||
PKCS7_free(p7);
|
||||
release_engine(e);
|
||||
BIO_free(in);
|
||||
BIO_free_all(out);
|
||||
return (ret);
|
||||
}
|
||||
353
apps/pkcs8.c
353
apps/pkcs8.c
@@ -1,353 +0,0 @@
|
||||
/*
|
||||
* Copyright 1999-2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the OpenSSL license (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include "apps.h"
|
||||
#include <openssl/pem.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/evp.h>
|
||||
#include <openssl/pkcs12.h>
|
||||
|
||||
typedef enum OPTION_choice {
|
||||
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
||||
OPT_INFORM, OPT_OUTFORM, OPT_ENGINE, OPT_IN, OPT_OUT,
|
||||
OPT_TOPK8, OPT_NOITER, OPT_NOCRYPT,
|
||||
#ifndef OPENSSL_NO_SCRYPT
|
||||
OPT_SCRYPT, OPT_SCRYPT_N, OPT_SCRYPT_R, OPT_SCRYPT_P,
|
||||
#endif
|
||||
OPT_V2, OPT_V1, OPT_V2PRF, OPT_ITER, OPT_PASSIN, OPT_PASSOUT,
|
||||
OPT_TRADITIONAL
|
||||
} OPTION_CHOICE;
|
||||
|
||||
OPTIONS pkcs8_options[] = {
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"inform", OPT_INFORM, 'F', "Input format (DER or PEM)"},
|
||||
{"outform", OPT_OUTFORM, 'F', "Output format (DER or PEM)"},
|
||||
{"in", OPT_IN, '<', "Input file"},
|
||||
{"out", OPT_OUT, '>', "Output file"},
|
||||
{"topk8", OPT_TOPK8, '-', "Output PKCS8 file"},
|
||||
{"noiter", OPT_NOITER, '-', "Use 1 as iteration count"},
|
||||
{"nocrypt", OPT_NOCRYPT, '-', "Use or expect unencrypted private key"},
|
||||
{"v2", OPT_V2, 's', "Use PKCS#5 v2.0 and cipher"},
|
||||
{"v1", OPT_V1, 's', "Use PKCS#5 v1.5 and cipher"},
|
||||
{"v2prf", OPT_V2PRF, 's', "Set the PRF algorithm to use with PKCS#5 v2.0"},
|
||||
{"iter", OPT_ITER, 'p', "Specify the iteration count"},
|
||||
{"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
|
||||
{"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
|
||||
{"traditional", OPT_TRADITIONAL, '-', "use traditional format private key"},
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
{"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_SCRYPT
|
||||
{"scrypt", OPT_SCRYPT, '-', "Use scrypt algorithm"},
|
||||
{"scrypt_N", OPT_SCRYPT_N, 's', "Set scrypt N parameter"},
|
||||
{"scrypt_r", OPT_SCRYPT_R, 's', "Set scrypt r parameter"},
|
||||
{"scrypt_p", OPT_SCRYPT_P, 's', "Set scrypt p parameter"},
|
||||
#endif
|
||||
{NULL}
|
||||
};
|
||||
|
||||
int pkcs8_main(int argc, char **argv)
|
||||
{
|
||||
BIO *in = NULL, *out = NULL;
|
||||
ENGINE *e = NULL;
|
||||
EVP_PKEY *pkey = NULL;
|
||||
PKCS8_PRIV_KEY_INFO *p8inf = NULL;
|
||||
X509_SIG *p8 = NULL;
|
||||
const EVP_CIPHER *cipher = NULL;
|
||||
char *infile = NULL, *outfile = NULL;
|
||||
char *passinarg = NULL, *passoutarg = NULL, *prog;
|
||||
#ifndef OPENSSL_NO_UI
|
||||
char pass[APP_PASS_LEN];
|
||||
#endif
|
||||
char *passin = NULL, *passout = NULL, *p8pass = NULL;
|
||||
OPTION_CHOICE o;
|
||||
int nocrypt = 0, ret = 1, iter = PKCS12_DEFAULT_ITER;
|
||||
int informat = FORMAT_PEM, outformat = FORMAT_PEM, topk8 = 0, pbe_nid = -1;
|
||||
int private = 0, traditional = 0;
|
||||
#ifndef OPENSSL_NO_SCRYPT
|
||||
long scrypt_N = 0, scrypt_r = 0, scrypt_p = 0;
|
||||
#endif
|
||||
|
||||
prog = opt_init(argc, argv, pkcs8_options);
|
||||
while ((o = opt_next()) != OPT_EOF) {
|
||||
switch (o) {
|
||||
case OPT_EOF:
|
||||
case OPT_ERR:
|
||||
opthelp:
|
||||
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
||||
goto end;
|
||||
case OPT_HELP:
|
||||
opt_help(pkcs8_options);
|
||||
ret = 0;
|
||||
goto end;
|
||||
case OPT_INFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &informat))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_IN:
|
||||
infile = opt_arg();
|
||||
break;
|
||||
case OPT_OUTFORM:
|
||||
if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &outformat))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_OUT:
|
||||
outfile = opt_arg();
|
||||
break;
|
||||
case OPT_TOPK8:
|
||||
topk8 = 1;
|
||||
break;
|
||||
case OPT_NOITER:
|
||||
iter = 1;
|
||||
break;
|
||||
case OPT_NOCRYPT:
|
||||
nocrypt = 1;
|
||||
break;
|
||||
case OPT_TRADITIONAL:
|
||||
traditional = 1;
|
||||
break;
|
||||
case OPT_V2:
|
||||
if (!opt_cipher(opt_arg(), &cipher))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_V1:
|
||||
pbe_nid = OBJ_txt2nid(opt_arg());
|
||||
if (pbe_nid == NID_undef) {
|
||||
BIO_printf(bio_err,
|
||||
"%s: Unknown PBE algorithm %s\n", prog, opt_arg());
|
||||
goto opthelp;
|
||||
}
|
||||
break;
|
||||
case OPT_V2PRF:
|
||||
pbe_nid = OBJ_txt2nid(opt_arg());
|
||||
if (!EVP_PBE_find(EVP_PBE_TYPE_PRF, pbe_nid, NULL, NULL, 0)) {
|
||||
BIO_printf(bio_err,
|
||||
"%s: Unknown PRF algorithm %s\n", prog, opt_arg());
|
||||
goto opthelp;
|
||||
}
|
||||
if (cipher == NULL)
|
||||
cipher = EVP_aes_256_cbc();
|
||||
break;
|
||||
case OPT_ITER:
|
||||
if (!opt_int(opt_arg(), &iter))
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_PASSIN:
|
||||
passinarg = opt_arg();
|
||||
break;
|
||||
case OPT_PASSOUT:
|
||||
passoutarg = opt_arg();
|
||||
break;
|
||||
case OPT_ENGINE:
|
||||
e = setup_engine(opt_arg(), 0);
|
||||
break;
|
||||
#ifndef OPENSSL_NO_SCRYPT
|
||||
case OPT_SCRYPT:
|
||||
scrypt_N = 16384;
|
||||
scrypt_r = 8;
|
||||
scrypt_p = 1;
|
||||
if (cipher == NULL)
|
||||
cipher = EVP_aes_256_cbc();
|
||||
break;
|
||||
case OPT_SCRYPT_N:
|
||||
if (!opt_long(opt_arg(), &scrypt_N) || scrypt_N <= 0)
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_SCRYPT_R:
|
||||
if (!opt_long(opt_arg(), &scrypt_r) || scrypt_r <= 0)
|
||||
goto opthelp;
|
||||
break;
|
||||
case OPT_SCRYPT_P:
|
||||
if (!opt_long(opt_arg(), &scrypt_p) || scrypt_p <= 0)
|
||||
goto opthelp;
|
||||
break;
|
||||
#endif
|
||||
}
|
||||
}
|
||||
argc = opt_num_rest();
|
||||
if (argc != 0)
|
||||
goto opthelp;
|
||||
|
||||
private = 1;
|
||||
|
||||
if (!app_passwd(passinarg, passoutarg, &passin, &passout)) {
|
||||
BIO_printf(bio_err, "Error getting passwords\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
if ((pbe_nid == -1) && cipher == NULL)
|
||||
cipher = EVP_aes_256_cbc();
|
||||
|
||||
in = bio_open_default(infile, 'r', informat);
|
||||
if (in == NULL)
|
||||
goto end;
|
||||
out = bio_open_owner(outfile, outformat, private);
|
||||
if (out == NULL)
|
||||
goto end;
|
||||
|
||||
if (topk8) {
|
||||
pkey = load_key(infile, informat, 1, passin, e, "key");
|
||||
if (!pkey)
|
||||
goto end;
|
||||
if ((p8inf = EVP_PKEY2PKCS8(pkey)) == NULL) {
|
||||
BIO_printf(bio_err, "Error converting key\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
if (nocrypt) {
|
||||
assert(private);
|
||||
if (outformat == FORMAT_PEM)
|
||||
PEM_write_bio_PKCS8_PRIV_KEY_INFO(out, p8inf);
|
||||
else if (outformat == FORMAT_ASN1)
|
||||
i2d_PKCS8_PRIV_KEY_INFO_bio(out, p8inf);
|
||||
else {
|
||||
BIO_printf(bio_err, "Bad format specified for key\n");
|
||||
goto end;
|
||||
}
|
||||
} else {
|
||||
X509_ALGOR *pbe;
|
||||
if (cipher) {
|
||||
#ifndef OPENSSL_NO_SCRYPT
|
||||
if (scrypt_N && scrypt_r && scrypt_p)
|
||||
pbe = PKCS5_pbe2_set_scrypt(cipher, NULL, 0, NULL,
|
||||
scrypt_N, scrypt_r, scrypt_p);
|
||||
else
|
||||
#endif
|
||||
pbe = PKCS5_pbe2_set_iv(cipher, iter, NULL, 0, NULL,
|
||||
pbe_nid);
|
||||
} else {
|
||||
pbe = PKCS5_pbe_set(pbe_nid, iter, NULL, 0);
|
||||
}
|
||||
if (pbe == NULL) {
|
||||
BIO_printf(bio_err, "Error setting PBE algorithm\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
if (passout)
|
||||
p8pass = passout;
|
||||
else if (1) {
|
||||
#ifndef OPENSSL_NO_UI
|
||||
p8pass = pass;
|
||||
if (EVP_read_pw_string
|
||||
(pass, sizeof(pass), "Enter Encryption Password:", 1)) {
|
||||
X509_ALGOR_free(pbe);
|
||||
goto end;
|
||||
}
|
||||
} else {
|
||||
#endif
|
||||
BIO_printf(bio_err, "Password required\n");
|
||||
goto end;
|
||||
}
|
||||
app_RAND_load_file(NULL, 0);
|
||||
p8 = PKCS8_set0_pbe(p8pass, strlen(p8pass), p8inf, pbe);
|
||||
if (p8 == NULL) {
|
||||
X509_ALGOR_free(pbe);
|
||||
BIO_printf(bio_err, "Error encrypting key\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
app_RAND_write_file(NULL);
|
||||
assert(private);
|
||||
if (outformat == FORMAT_PEM)
|
||||
PEM_write_bio_PKCS8(out, p8);
|
||||
else if (outformat == FORMAT_ASN1)
|
||||
i2d_PKCS8_bio(out, p8);
|
||||
else {
|
||||
BIO_printf(bio_err, "Bad format specified for key\n");
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
ret = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (nocrypt) {
|
||||
if (informat == FORMAT_PEM)
|
||||
p8inf = PEM_read_bio_PKCS8_PRIV_KEY_INFO(in, NULL, NULL, NULL);
|
||||
else if (informat == FORMAT_ASN1)
|
||||
p8inf = d2i_PKCS8_PRIV_KEY_INFO_bio(in, NULL);
|
||||
else {
|
||||
BIO_printf(bio_err, "Bad format specified for key\n");
|
||||
goto end;
|
||||
}
|
||||
} else {
|
||||
if (informat == FORMAT_PEM)
|
||||
p8 = PEM_read_bio_PKCS8(in, NULL, NULL, NULL);
|
||||
else if (informat == FORMAT_ASN1)
|
||||
p8 = d2i_PKCS8_bio(in, NULL);
|
||||
else {
|
||||
BIO_printf(bio_err, "Bad format specified for key\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (!p8) {
|
||||
BIO_printf(bio_err, "Error reading key\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
if (passin)
|
||||
p8pass = passin;
|
||||
else if (1) {
|
||||
#ifndef OPENSSL_NO_UI
|
||||
p8pass = pass;
|
||||
if (EVP_read_pw_string(pass, sizeof(pass), "Enter Password:", 0)) {
|
||||
BIO_printf(bio_err, "Can't read Password\n");
|
||||
goto end;
|
||||
}
|
||||
} else {
|
||||
#endif
|
||||
BIO_printf(bio_err, "Password required\n");
|
||||
goto end;
|
||||
}
|
||||
p8inf = PKCS8_decrypt(p8, p8pass, strlen(p8pass));
|
||||
}
|
||||
|
||||
if (!p8inf) {
|
||||
BIO_printf(bio_err, "Error decrypting key\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
|
||||
if ((pkey = EVP_PKCS82PKEY(p8inf)) == NULL) {
|
||||
BIO_printf(bio_err, "Error converting key\n");
|
||||
ERR_print_errors(bio_err);
|
||||
goto end;
|
||||
}
|
||||
|
||||
assert(private);
|
||||
if (outformat == FORMAT_PEM) {
|
||||
if (traditional)
|
||||
PEM_write_bio_PrivateKey_traditional(out, pkey, NULL, NULL, 0,
|
||||
NULL, passout);
|
||||
else
|
||||
PEM_write_bio_PrivateKey(out, pkey, NULL, NULL, 0, NULL, passout);
|
||||
} else if (outformat == FORMAT_ASN1) {
|
||||
i2d_PrivateKey_bio(out, pkey);
|
||||
} else {
|
||||
BIO_printf(bio_err, "Bad format specified for key\n");
|
||||
goto end;
|
||||
}
|
||||
ret = 0;
|
||||
|
||||
end:
|
||||
X509_SIG_free(p8);
|
||||
PKCS8_PRIV_KEY_INFO_free(p8inf);
|
||||
EVP_PKEY_free(pkey);
|
||||
release_engine(e);
|
||||
BIO_free_all(out);
|
||||
BIO_free(in);
|
||||
OPENSSL_free(passin);
|
||||
OPENSSL_free(passout);
|
||||
|
||||
return ret;
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user