diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fc8a9f3f88..d4712c262e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -588,7 +588,7 @@ jobs: - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - name: config - run: ./config --strict-warnings --banner=Configured --debug no-afalgeng enable-demos enable-h3demo no-shared enable-crypto-mdebug enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 no-fips && perl configdata.pm --dump + run: ./config --strict-warnings --banner=Configured --debug enable-demos enable-h3demo no-shared enable-crypto-mdebug enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 no-fips && perl configdata.pm --dump - name: make run: make -s -j4 - name: get cpu info @@ -711,7 +711,7 @@ jobs: - name: setup hostname workaround run: sudo hostname localhost - name: config - run: ./config --strict-warnings --banner=Configured --debug no-afalgeng enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 enable-external-tests no-fips && perl configdata.pm --dump + run: ./config --strict-warnings --banner=Configured --debug enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 enable-external-tests no-fips && perl configdata.pm --dump - name: make run: make -s -j4 - uses: dtolnay/rust-toolchain@0f44b27771c32bda9f458f75a1e241b09791b331 diff --git a/.github/workflows/coveralls.yml b/.github/workflows/coveralls.yml index 5c05e8e2e5..c219577991 100644 --- a/.github/workflows/coveralls.yml +++ b/.github/workflows/coveralls.yml @@ -68,7 +68,7 @@ jobs: "extra_config": "no-afalgeng enable-fips" }, { "branch": "master", - "extra_config": "no-afalgeng enable-fips enable-tfo enable-lms enable-crypto-mdebug enable-allocfail-tests" + "extra_config": "enable-fips enable-tfo enable-lms enable-crypto-mdebug enable-allocfail-tests" }] EOF ) diff --git a/.github/workflows/run-checker-daily.yml b/.github/workflows/run-checker-daily.yml index d517dacf2f..9d347b16bf 100644 --- a/.github/workflows/run-checker-daily.yml +++ b/.github/workflows/run-checker-daily.yml @@ -24,7 +24,6 @@ jobs: matrix: opt: [ 386, - no-afalgeng, no-apps, no-argon2, no-aria, @@ -41,7 +40,6 @@ jobs: no-bulk, no-cached-fetch, no-camellia, - no-capieng, no-cast, no-chacha, no-cmac, @@ -52,7 +50,6 @@ jobs: enable-demos, no-deprecated, no-des, -# enable-devcryptoeng, # Cannot work on Linux no-docs, no-dsa, no-dtls1, @@ -63,7 +60,6 @@ jobs: no-ecdsa, enable-ec_nistp_64_gcc_128, enable-egd, - no-engine, # enable-external-tests, # Requires extra setup enable-fips, enable-fips enable-acvp-tests, @@ -76,7 +72,6 @@ jobs: enable-heartbeats, enable-hqinterop, no-hw, - no-hw-padlock, no-idea, enable-lms, no-makedepend, @@ -87,7 +82,6 @@ jobs: no-multiblock, no-nextprotoneg, no-ocb, - no-padlockeng, no-pic, no-poly1305, no-posix-io, @@ -114,7 +108,7 @@ jobs: enable-ssl3, enable-ssl3-method, enable-sslkeylog, - no-static-engine no-shared, + no-shared, no-tests, enable-tfo, no-tls1, diff --git a/.github/workflows/run-checker-merge.yml b/.github/workflows/run-checker-merge.yml index fd553f5491..1a3a12c3e3 100644 --- a/.github/workflows/run-checker-merge.yml +++ b/.github/workflows/run-checker-merge.yml @@ -20,9 +20,8 @@ jobs: opt: [ enable-asan enable-ubsan no-shared no-asm -DOPENSSL_SMALL_FOOTPRINT -fno-sanitize=function, no-dso, - no-dynamic-engine, no-ec2m enable-fips, - no-engine no-shared, + no-shared, no-err, no-filenames, enable-ubsan no-asm -DOPENSSL_SMALL_FOOTPRINT -fno-sanitize=function, diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index fa6fc827a4..55eac915cc 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -72,7 +72,6 @@ jobs: run: | echo ${Env:OSSL_VERSION} reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32 - reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v ENGINESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32 reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v MODULESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32 reg.exe query HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /reg:32 - name: get cpu info diff --git a/.github/workflows/windows_comp.yml b/.github/workflows/windows_comp.yml index adaa586167..87ab5ba321 100644 --- a/.github/workflows/windows_comp.yml +++ b/.github/workflows/windows_comp.yml @@ -63,7 +63,6 @@ jobs: run: | echo ${Env:OSSL_VERSION} reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32 - reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v ENGINESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32 reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v MODULESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32 reg.exe query HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /reg:32 - name: download coreinfo @@ -130,7 +129,6 @@ jobs: run: | echo ${Env:OSSL_VERSION} reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32 - reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v ENGINESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32 reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v MODULESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32 reg.exe query HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /reg:32 - name: download coreinfo diff --git a/CHANGES.md b/CHANGES.md index 5ab746753c..720409f5b8 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -81,6 +81,15 @@ OpenSSL 4.0 *Daniel Kubec* + * ENGINE support was removed. The `no-engine` build option and the + `OPENSSL_NO_ENGINE` macro is always present. + Applications using `ENGINE_` functions unguarded with `OPENSSL_NO_ENGINE` + can be built by defining a macro `OPENSSL_ENGINE_STUBS`, however all these + functions will return error when called. Provider API should be used to + replace ENGINEs functionality. + + *Milan Broz*, *Neil Horman*, *Norbert Pocs* + OpenSSL 3.6 ----------- diff --git a/Configurations/10-main.conf b/Configurations/10-main.conf index 7e9396868a..92b3923e40 100644 --- a/Configurations/10-main.conf +++ b/Configurations/10-main.conf @@ -694,7 +694,6 @@ my %targets = ( shared_target => "linux-shared", shared_cflag => "-fPIC", shared_ldflag => sub { $disabled{pinshared} ? () : "-Wl,-znodelete" }, - enable => [ "afalgeng" ], }, "linux-latomic" => { inherit_from => [ "linux-generic32" ], @@ -1027,7 +1026,6 @@ my %targets = ( cflags => threads("-pthread"), cppflags => threads("-D_THREAD_SAFE -D_REENTRANT"), ex_libs => add(threads("-pthread")), - enable => add("devcryptoeng"), bn_ops => "BN_LLONG", thread_scheme => "pthreads", dso_scheme => "dlfcn", @@ -1201,7 +1199,6 @@ my %targets = ( cflags => threads("-pthread"), cppflags => threads("-D_THREAD_SAFE -D_REENTRANT"), ex_libs => add(threads("-pthread")), - enable => add("devcryptoeng"), bn_ops => "BN_LLONG", thread_scheme => "pthreads", dso_scheme => "dlfcn", @@ -2049,7 +2046,7 @@ my %targets = ( asflags => sub { vms_info()->{asflags} }, perlasm_scheme => sub { vms_info()->{perlasm_scheme} }, - disable => add('pinshared', 'loadereng'), + disable => add('pinshared'), }, diff --git a/Configurations/descrip.mms.tmpl b/Configurations/descrip.mms.tmpl index 7c9918bb20..adfd448f9f 100644 --- a/Configurations/descrip.mms.tmpl +++ b/Configurations/descrip.mms.tmpl @@ -56,13 +56,8 @@ map { platform->sharedname($_) // () } grep { !$unified_info{attributes}->{libraries}->{$_}->{noinst} } @{$unified_info{libraries}}; - our @install_engines = - grep { !$unified_info{attributes}->{modules}->{$_}->{noinst} - && $unified_info{attributes}->{modules}->{$_}->{engine} } - @{$unified_info{modules}}; our @install_modules = grep { !$unified_info{attributes}->{modules}->{$_}->{noinst} - && !$unified_info{attributes}->{modules}->{$_}->{engine} && !$unified_info{attributes}->{modules}->{$_}->{fips} } @{$unified_info{modules}}; our @install_fipsmodules = @@ -109,7 +104,6 @@ @{$config{lib_defines}}, @{$config{shared_defines}}, @cnf_defines, 'OPENSSLDIR="""$(OPENSSLDIR_C)"""', - 'ENGINESDIR="""$(ENGINESDIR_C)"""', 'MODULESDIR="""$(MODULESDIR_C)"""' ) . '$(DEFINES)' @@ -353,7 +347,6 @@ GENERATED={- # common0.tmpl provides @generated INSTALL_LIBS={- join(", ", map { "-\n\t".$_.".OLB" } @install_libs) -} INSTALL_SHLIBS={- join(", ", map { "-\n\t".$_.".EXE" } @install_shlibs) -} -INSTALL_ENGINES={- join(", ", map { "-\n\t".$_.".EXE" } @install_engines) -} INSTALL_MODULES={- join(", ", map { "-\n\t".$_.".EXE" } @install_modules) -} INSTALL_FIPSMODULE={- join(", ", map { "-\n\t".$_.".EXE" } @install_fipsmodules) -} INSTALL_FIPSMODULECONF=[.providers]fipsmodule.cnf @@ -387,8 +380,6 @@ OPENSSLDIR={- catdir($config{openssldir}) or : "SYS\$COMMON:[OPENSSL-COMMON]" -} # The same, but for C OPENSSLDIR_C={- platform->osslprefix() -}DATAROOT:[000000] -# Where installed ENGINE modules reside, for C -ENGINESDIR_C={- platform->osslprefix() -}ENGINES{- $sover_dirname.$target{pointer_size} -}: # Where modules reside, for C MODULESDIR_C={- platform->osslprefix() -}MODULES{- $target{pointer_size} -}: @@ -598,10 +589,10 @@ depend : descrip.mms # Install helper targets ############################################# -install_sw : install_dev install_engines install_modules - +install_sw : install_dev install_modules - install_runtime install_startup install_ivp -uninstall_sw : uninstall_dev uninstall_modules uninstall_engines - +uninstall_sw : uninstall_dev uninstall_modules - uninstall_runtime uninstall_startup uninstall_ivp install_docs : install_html_docs @@ -660,15 +651,6 @@ install_dev : check_INSTALLTOP install_runtime_libs map { "COPY/PROT=W:R $_.OLB ossl_installroot:[LIB.'arch']" } @install_libs) -} -install_engines : check_INSTALLTOP install_runtime_libs build_modules - @ {- output_off() unless scalar @install_engines; "" -} ! - @ WRITE SYS$OUTPUT "*** Installing engines" - - CREATE/DIR ossl_installroot:[ENGINES{- $sover_dirname.$target{pointer_size} -}.'arch'] - {- join("\n ", - map { "COPY/PROT=W:RE $_.EXE ossl_installroot:[ENGINES$sover_dirname$target{pointer_size}.'arch']" } - @install_engines) -} - @ {- output_on() unless scalar @install_engines; "" -} ! - install_modules : check_INSTALLTOP install_runtime_libs build_modules @ {- output_off() unless scalar @install_modules; "" -} ! @ WRITE SYS$OUTPUT "*** Installing modules" diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl index 7fdb0b86eb..b6a7810766 100644 --- a/Configurations/unix-Makefile.tmpl +++ b/Configurations/unix-Makefile.tmpl @@ -183,20 +183,11 @@ INSTALL_SHLIB_INFO={- grep { !$unified_info{attributes}->{libraries}->{$_}->{noinst} } @{$unified_info{libraries}})) -} -INSTALL_ENGINES={- - join(" \\\n" . ' ' x 16, - fill_lines(" ", $COLUMNS - 16, - map { platform->dso($_) } - grep { !$unified_info{attributes}->{modules}->{$_}->{noinst} - && $unified_info{attributes}->{modules}->{$_}->{engine} } - @{$unified_info{modules}})) --} INSTALL_MODULES={- join(" \\\n" . ' ' x 16, fill_lines(" ", $COLUMNS - 16, map { platform->dso($_) } grep { !$unified_info{attributes}->{modules}->{$_}->{noinst} - && !$unified_info{attributes}->{modules}->{$_}->{engine} && !$unified_info{attributes}->{modules}->{$_}->{fips} } @{$unified_info{modules}})) -} @@ -333,7 +324,6 @@ LIBDIR={- our $libdir = $config{libdir}; # $(libdir) is chosen to be compatible with the GNU coding standards libdir={- file_name_is_absolute($libdir) ? $libdir : '$(INSTALLTOP)/$(LIBDIR)' -} -ENGINESDIR=$(libdir)/engines-{- $sover_dirname -} MODULESDIR=$(libdir)/ossl-modules # Convenience variable for those who want to set the rpath in shared @@ -450,7 +440,6 @@ LIB_CPPFLAGS={- our $lib_cppflags = join(' ', $lib_cppflags, (map { '-D'.$_ } 'OPENSSLDIR="\"$(OPENSSLDIR)\""', - 'ENGINESDIR="\"$(ENGINESDIR)\""', 'MODULESDIR="\"$(MODULESDIR)\""'), '$(CNF_CPPFLAGS)', '$(CPPFLAGS)') -} LIB_CFLAGS={- join(' ', $target{lib_cflags} || (), @@ -541,7 +530,7 @@ LANG=C {- dependmagic('build_sw', 'Build all the software (default target)'); -}: build_libs_nodep build_modules_nodep build_programs_nodep link-utils {- dependmagic('build_libs', 'Build the libraries libssl and libcrypto'); -}: build_libs_nodep -{- dependmagic('build_modules', 'Build the modules (i.e. providers and engines)'); -}: build_modules_nodep +{- dependmagic('build_modules', 'Build the modules (i.e. providers)'); -}: build_modules_nodep {- dependmagic('build_programs', 'Build the openssl executables, scripts and all other programs as configured (e.g. tests or demos)'); -}: build_programs_nodep {- dependmagic('build_inst_sw', 'Build all the software to be installed'); -}: build_libs_nodep build_modules_nodep build_inst_programs_nodep link-utils {- dependmagic('build_inst_programs', 'Build only the installable openssl executables and scripts'); -}: build_inst_programs_nodep @@ -675,9 +664,9 @@ install: Makefile ## Install software and documentation, create OpenSSL director uninstall: {- "uninstall_docs" if !$disabled{docs}; -} uninstall_sw {- $disabled{fips} ? "" : "uninstall_fips" -} ## Uninstall software and documentation -install_sw: install_dev install_engines install_modules install_runtime ## Install just the software and libraries +install_sw: install_dev install_modules install_runtime ## Install just the software and libraries -uninstall_sw: uninstall_runtime uninstall_modules uninstall_engines uninstall_dev ## Uninstall the software and libraries +uninstall_sw: uninstall_runtime uninstall_modules uninstall_dev ## Uninstall the software and libraries install_docs: install_man_docs install_html_docs ## Install manpages and HTML documentation @@ -894,30 +883,6 @@ uninstall_dev: uninstall_runtime_libs _install_modules_deps: install_runtime_libs build_modules -install_engines: _install_modules_deps - @[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1) - @$(PERL) $(SRCDIR)/util/mkdir-p.pl "$(DESTDIR)$(ENGINESDIR)/" - @$(ECHO) "*** Installing engines" - @set -e; for e in dummy $(INSTALL_ENGINES); do \ - if [ "$$e" = "dummy" ]; then continue; fi; \ - fn=`basename $$e`; \ - $(ECHO) "install $$e -> $(DESTDIR)$(ENGINESDIR)/$$fn"; \ - cp $$e "$(DESTDIR)$(ENGINESDIR)/$$fn.new"; \ - chmod 755 "$(DESTDIR)$(ENGINESDIR)/$$fn.new"; \ - mv -f "$(DESTDIR)$(ENGINESDIR)/$$fn.new" \ - "$(DESTDIR)$(ENGINESDIR)/$$fn"; \ - done - -uninstall_engines: - @$(ECHO) "*** Uninstalling engines" - @set -e; for e in dummy $(INSTALL_ENGINES); do \ - if [ "$$e" = "dummy" ]; then continue; fi; \ - fn=`basename $$e`; \ - $(ECHO) "$(RM) $(DESTDIR)$(ENGINESDIR)/$$fn"; \ - $(RM) "$(DESTDIR)$(ENGINESDIR)/$$fn"; \ - done - -$(RMDIR) "$(DESTDIR)$(ENGINESDIR)" - install_modules: _install_modules_deps @[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1) @$(PERL) $(SRCDIR)/util/mkdir-p.pl "$(DESTDIR)$(MODULESDIR)/" @@ -1330,13 +1295,6 @@ errors: ( b=`pwd`; set -e; cd $(SRCDIR); \ $(PERL) util/ck_errf.pl -strict -internal; \ $(PERL) -I$$b util/mkerr.pl $(ERROR_REBUILD) -internal ) - ( b=`pwd`; set -e; cd $(SRCDIR)/engines; \ - for E in *.ec ; do \ - $(PERL) ../util/ck_errf.pl -strict \ - -conf $$E `basename $$E .ec`.c; \ - $(PERL) -I$$b ../util/mkerr.pl $(ERROR_REBUILD) -static \ - -conf $$E `basename $$E .ec`.c ; \ - done ) {- use File::Basename; @@ -1361,6 +1319,7 @@ errors: my @cryptoskipheaders = ( @sslheaders_tmpl, qw( include/openssl/conf_api.h include/openssl/ebcdic.h + include/openssl/engine.h include/openssl/opensslconf.h include/openssl/symhacks.h ) ); our %cryptoheaders = (); diff --git a/Configurations/windows-makefile.tmpl b/Configurations/windows-makefile.tmpl index ef39bb4c27..498d33369c 100644 --- a/Configurations/windows-makefile.tmpl +++ b/Configurations/windows-makefile.tmpl @@ -101,29 +101,15 @@ INSTALL_SHLIBPDBS={- grep { !$unified_info{attributes}->{libraries}->{$_}->{noinst} } @{$unified_info{libraries}}) -} -INSTALL_ENGINES={- - join(" ", map { quotify1(platform->dso($_)) } - grep { !$unified_info{attributes}->{modules}->{$_}->{noinst} - && $unified_info{attributes}->{modules}->{$_}->{engine} } - @{$unified_info{modules}}) --} -INSTALL_ENGINEPDBS={- - join(" ", map { quotify1(platform->dsopdb($_)) } - grep { !$unified_info{attributes}->{modules}->{$_}->{noinst} - && $unified_info{attributes}->{modules}->{$_}->{engine} } - @{$unified_info{modules}}) --} INSTALL_MODULES={- join(" ", map { quotify1(platform->dso($_)) } grep { !$unified_info{attributes}->{modules}->{$_}->{noinst} - && !$unified_info{attributes}->{modules}->{$_}->{engine} && !$unified_info{attributes}->{modules}->{$_}->{fips} } @{$unified_info{modules}}) -} INSTALL_MODULEPDBS={- join(" ", map { quotify1(platform->dsopdb($_)) } - grep { !$unified_info{attributes}->{modules}->{$_}->{noinst} - && !$unified_info{attributes}->{modules}->{$_}->{engine} } + grep { !$unified_info{attributes}->{modules}->{$_}->{noinst} } @{$unified_info{modules}}) -} INSTALL_FIPSMODULE={- @@ -230,23 +216,15 @@ MODULESDIR_dev={- use File::Spec::Functions qw(:DEFAULT splitpath catpath); our $modulesdir_dir = catdir($modulesprefix_dir, "ossl-modules"); our $modulesdir = catpath($modulesdir_dev, $modulesdir_dir); - our $enginesdir_dev = $modulesprefix_dev; - our $enginesdir_dir = - catdir($modulesprefix_dir, "engines-$sover_dirname"); - our $enginesdir = catpath($enginesdir_dev, $enginesdir_dir); $modulesdir_dev -} MODULESDIR_dir={- canonpath($modulesdir_dir) -} -ENGINESDIR_dev={- $enginesdir_dev -} -ENGINESDIR_dir={- canonpath($enginesdir_dir) -} !IF "$(DESTDIR)" != "" INSTALLTOP=$(DESTDIR)$(INSTALLTOP_dir) OPENSSLDIR=$(DESTDIR)$(OPENSSLDIR_dir) -ENGINESDIR=$(DESTDIR)$(ENGINESDIR_dir) MODULESDIR=$(DESTDIR)$(MODULESDIR_dir) !ELSE INSTALLTOP=$(INSTALLTOP_dev)$(INSTALLTOP_dir) OPENSSLDIR=$(OPENSSLDIR_dev)$(OPENSSLDIR_dir) -ENGINESDIR=$(ENGINESDIR_dev)$(ENGINESDIR_dir) MODULESDIR=$(MODULESDIR_dev)$(MODULESDIR_dir) !ENDIF @@ -344,7 +322,6 @@ LIB_CPPFLAGS={- our $lib_cppflags = join(' ', $lib_cppflags, (map { '-D'.quotify1($_) } "OPENSSLDIR=\"$openssldir\"", - "ENGINESDIR=\"$enginesdir\"", "MODULESDIR=\"$modulesdir\""), '$(CNF_CPPFLAGS)', '$(CPPFLAGS)') -} LIB_CFLAGS={- join(' ', $target{lib_cflags} || (), @@ -485,7 +462,6 @@ clean: libclean {- join("\n\t", map { "-del /Q /F $_" } @GENERATED_MANDATORY) || "\@rem" -} {- join("\n\t", map { "-del /Q /F $_" } @GENERATED) || "\@rem" -} -del /Q /S /F *.d *.obj *.pdb *.ilk *.manifest - -del /Q /S /F engines\*.lib engines\*.exp -del /Q /S /F apps\*.lib apps\*.rc apps\*.res apps\*.exp -del /Q /S /F test\*.exp -rd /Q /S test\test-runs @@ -502,9 +478,9 @@ depend: makefile # Install helper targets ############################################# -install_sw: install_dev install_engines install_modules install_runtime +install_sw: install_dev install_modules install_runtime -uninstall_sw: uninstall_runtime uninstall_modules uninstall_engines uninstall_dev +uninstall_sw: uninstall_runtime uninstall_modules uninstall_dev install_docs: install_html_docs @@ -577,17 +553,6 @@ uninstall_dev: _install_modules_deps: install_runtime_libs build_modules -install_engines: _install_modules_deps - @if "$(INSTALLTOP)"=="" ( $(ECHO) "INSTALLTOP should not be empty" & exit 1 ) - @$(ECHO) "*** Installing engines" - @"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(ENGINESDIR)" - @if not "$(INSTALL_ENGINES)"=="" \ - "$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_ENGINES) "$(ENGINESDIR)" - @if not "$(INSTALL_ENGINES)"=="" \ - "$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_ENGINEPDBS) "$(ENGINESDIR)" - -uninstall_engines: - install_modules: _install_modules_deps @if "$(INSTALLTOP)"=="" ( $(ECHO) "INSTALLTOP should not be empty" & exit 1 ) @$(ECHO) "*** Installing modules" diff --git a/Configure b/Configure index b19a093ea8..a73f464fd7 100755 --- a/Configure +++ b/Configure @@ -96,7 +96,7 @@ EOF # [don't] allow default thread pool functionality # [no-]shared [don't] try to create shared libraries when supported. # [no-]pic [don't] try to build position independent code when supported. -# If disabled, it also disables shared and dynamic-engine. +# If disabled, it also disables shared. # no-asm do not use assembler # no-egd do not compile support for the entropy-gathering daemon APIs # [no-]zlib [don't] compile support for zlib compression. @@ -422,7 +422,6 @@ my @dtls = qw(dtls1 dtls1_2); my @disablables = ( "acvp-tests", - "afalgeng", "apps", "argon2", "aria", @@ -441,7 +440,6 @@ my @disablables = ( "bulk", "cached-fetch", "camellia", - "capieng", "winstore", "cast", "chacha", @@ -458,14 +456,12 @@ my @disablables = ( "hqinterop", "deprecated", "des", - "devcryptoeng", "dgram", "dh", "docs", "dsa", "dso", "dtls", - "dynamic-engine", "ec", "ec2m", "ec_nistp_64_gcc_128", @@ -473,7 +469,6 @@ my @disablables = ( "ecdsa", "ecx", "egd", - "engine", "err", "external-tests", "filenames", @@ -491,7 +486,6 @@ my @disablables = ( "ktls", "legacy", "lms", - "loadereng", "makedepend", "md2", "md4", @@ -504,7 +498,6 @@ my @disablables = ( "nextprotoneg", "ocb", "ocsp", - "padlockeng", "pic", "pie", "pinshared", @@ -537,7 +530,6 @@ my @disablables = ( "sse2", "ssl", "ssl-trace", - "static-engine", "stdio", "sslkeylog", "tests", @@ -574,11 +566,19 @@ my @disablables_int = qw( ); my %deprecated_disablables = ( + "engine" => undef, + "static-engine" => undef, + "dynamic-engine" => undef, + "afalgeng" => undef, + "capieng" => undef, + "devcryptoeng" => undef, + "loadereng" => undef, + "padlockeng" => undef, "ssl2" => undef, "buf-freelists" => undef, "crypto-mdebug-backtrace" => undef, - "hw" => "hw", # causes cascade, but no macro - "hw-padlock" => "padlockeng", + "hw" => undef, + "hw-padlock" => undef, "ripemd" => "rmd160", "ui" => "ui-console", "heartbeats" => undef, @@ -599,9 +599,9 @@ our %disabled = ( # "what" => "comment" "demos" => "default", "h3demo" => "default", "hqinterop" => "default", - "devcryptoeng" => "default", "ec_nistp_64_gcc_128" => "default", "egd" => "default", + "engine" => "default", "external-tests" => "default", "fuzz-afl" => "default", "fuzz-libfuzzer" => "default", @@ -635,7 +635,7 @@ my @disable_cascades = ( "blake2", "bf", "camellia", "cast", "chacha", "cmac", "cms", "cmp", "comp", "ct", "des", "dgram", "dh", "dsa", - "ec", "engine", + "ec", "filenames", "idea", "ktls", "lms", "md4", "ml-dsa", "ml-kem", "multiblock", @@ -671,17 +671,10 @@ my @disable_cascades = ( "crypto-mdebug" => [ "crypto-mdebug-backtrace", "allocfail-tests" ], - "module" => [ "dynamic-engine", "fips" ], + "module" => [ "fips" ], - # Without shared libraries, dynamic engines aren't possible. - # This is due to them having to link with libcrypto and register features - # using the ENGINE functionality, and since that relies on global tables, - # those *have* to be exactly the same as the ones accessed from the app, - # which cannot be guaranteed if shared libraries aren't present. - # (note that even with shared libraries, both the app and dynamic engines - # must be linked with the same library) - "shared" => [ "dynamic-engine", "uplink" ], - "dso" => [ "dynamic-engine", "module" ], + "shared" => [ "uplink" ], + "dso" => [ "module" ], # Other modules don't necessarily have to link with libcrypto, so shared # libraries do not have to be a condition to produce those. @@ -689,14 +682,12 @@ my @disable_cascades = ( # or modules. "pic" => [ "shared", "module" ], - "engine" => [ "dynamic-engine", grep(/eng$/, @disablables) ], - "dynamic-engine" => [ "loadereng" ], - "hw" => [ "padlockeng" ], + "engine" => [ "static-engine", "dynamic-engine" ], # no-autoalginit is only useful when building non-shared "autoalginit" => [ "shared", "apps", "fips" ], - "stdio" => [ "apps", "capieng", "egd" ], + "stdio" => [ "apps", "egd" ], "apps" => [ "tests" ], "tests" => [ "external-tests" ], "comp" => [ "zlib", "brotli", "zstd" ], @@ -718,7 +709,7 @@ my @disable_cascades = ( "blake2" => [ "argon2" ], - "deprecated-3.0" => [ "engine", "srp" ], + "deprecated-3.0" => [ "srp" ], "http" => [ "ocsp" ] ); @@ -926,14 +917,6 @@ while (@argvcopy) $disabled{$proto} = "option(tls)"; } } - elsif ($1 eq "static-engine") - { - delete $disabled{"dynamic-engine"}; - } - elsif ($1 eq "dynamic-engine") - { - $disabled{"dynamic-engine"} = "option"; - } elsif (exists $deprecated_disablables{$1}) { $deprecated_options{$_} = 1; @@ -955,15 +938,7 @@ while (@argvcopy) } elsif (/^enable-(.+)$/) { - if ($1 eq "static-engine") - { - $disabled{"dynamic-engine"} = "option"; - } - elsif ($1 eq "dynamic-engine") - { - delete $disabled{"dynamic-engine"}; - } - elsif ($1 eq "zlib-dynamic") + if ($1 eq "zlib-dynamic") { delete $disabled{"zlib"}; } @@ -1646,16 +1621,10 @@ my $no_shared_warn=0; if (($target{shared_target} // '') eq "") { $no_shared_warn = 1 - if (!$disabled{shared} || !$disabled{"dynamic-engine"}); + if (!$disabled{shared}); disable('no-shared-target', 'pic'); } -if ($disabled{"dynamic-engine"}) { - $config{dynamic_engines} = 0; -} else { - $config{dynamic_engines} = 1; -} - unless ($disabled{asan} || defined $detected_sanitizers{asan}) { push @{$config{cflags}}, "-fsanitize=address"; } @@ -1834,30 +1803,6 @@ $config{CFLAGS} = [ map { $_ eq '--ossl-strict-warnings' : ( $_ ) } @{$config{CFLAGS}} ]; -unless ($disabled{afalgeng}) { - $config{afalgeng}=""; - if (grep { $_ eq 'afalgeng' } @{$target{enable}}) { - push @{$config{engdirs}}, "afalg"; - } else { - disable('not-linux', 'afalgeng'); - } -} - -unless ($disabled{devcryptoeng}) { - if ($target =~ m/^BSD/) { - my $maxver = 5*100 + 7; - my $sysstr = `uname -s`; - my $verstr = `uname -r`; - $sysstr =~ s|\R$||; - $verstr =~ s|\R$||; - my ($ma, $mi, @rest) = split m|\.|, $verstr; - my $ver = $ma*100 + $mi; - if ($sysstr eq 'OpenBSD' && $ver >= $maxver) { - disable('too-new-kernel', 'devcryptoeng'); - } - } -} - unless ($disabled{ktls}) { $config{ktls}=""; my $cc = $config{CROSS_COMPILE}.$config{CC}; @@ -1952,7 +1897,7 @@ foreach my $what (sort keys %disabled) { $config{options} .= " no-$what"; if (!grep { $what eq $_ } ( 'buildtest-c++', 'fips', 'threads', 'shared', - 'module', 'pic', 'dynamic-engine', 'makedepend', + 'module', 'pic', 'makedepend', 'sse2', 'legacy' )) { (my $WHAT = uc $what) =~ s|-|_|g; my $skipdir = $what; @@ -1964,18 +1909,11 @@ foreach my $what (sort keys %disabled) { my $macro = $disabled_info{$what}->{macro} = "OPENSSL_NO_$WHAT"; push @{$config{openssl_feature_defines}}, $macro; - $skipdir{engines} = $what if $what eq 'engine'; $skipdir{"crypto/$skipdir"} = $what unless $what eq 'async' || $what eq 'err' || $what eq 'dso' || $what eq 'http'; } } -if ($disabled{"dynamic-engine"}) { - push @{$config{openssl_feature_defines}}, "OPENSSL_NO_DYNAMIC_ENGINE"; -} else { - push @{$config{openssl_feature_defines}}, "OPENSSL_NO_STATIC_ENGINE"; -} - # If we use the unified build, collect information from build.info files my %unified_info = (); @@ -2377,14 +2315,6 @@ if ($builder eq "unified") { ); die "runaway IF?" if (@skip); - if (grep { defined $attributes{modules}->{$_}->{engine} } keys %attributes - and !$config{dynamic_engines}) { - die <<"EOF" -ENGINES can only be used if configured with 'dynamic-engine'. -This is usually a fault in a build.info file. -EOF - } - { my %infos = ( programs => [ @programs ], libraries => [ @libraries ], @@ -3051,9 +2981,9 @@ EOF print <<"EOF" if ($no_shared_warn); -The options 'shared', 'pic' and 'dynamic-engine' aren't supported on this +The options 'shared' and 'pic' aren't supported on this platform, so we will pretend you gave the option 'no-pic', which also disables -'shared' and 'dynamic-engine'. If you know how to implement shared libraries +'shared'. If you know how to implement shared libraries or position independent code, please let us know (but please first make sure you have tried with a current version of OpenSSL). EOF diff --git a/INSTALL.md b/INSTALL.md index f90b937cef..414c08d366 100644 --- a/INSTALL.md +++ b/INSTALL.md @@ -584,12 +584,6 @@ In the following list, always the non-default variant is documented: if feature `xxxx` is disabled by default then `enable-xxxx` is documented and if feature `xxxx` is enabled by default then `no-xxxx` is documented. -### no-afalgeng - -Don't build the AFALG engine. - -This option will be forced on a platform that does not support AFALG. - ### enable-ktls Build with Kernel TLS support. @@ -715,12 +709,6 @@ this option will reduce run-time memory usage but it also introduces a significant performance penalty. This option is primarily designed to help with detecting incorrect reference counting. -### no-capieng - -Don't build the CAPI engine. - -This option will be forced if on a platform that does not support CAPI. - ### no-cmp Don't build support for Certificate Management Protocol (CMP) @@ -773,19 +761,6 @@ Don't build and install documentation, i.e. manual pages in various forms. Don't build support for loading Dynamic Shared Objects (DSO) -### enable-devcryptoeng - -Build the `/dev/crypto` engine. - -This option is automatically selected on the BSD platform, in which case it can -be disabled with `no-devcryptoeng`. - -### no-dynamic-engine - -Don't build the dynamically loaded engines. - -This only has an effect in a shared build. - ### no-ec Don't build support for Elliptic Curves. @@ -817,10 +792,6 @@ This option is only supported on platforms: Build support for gathering entropy from the Entropy Gathering Daemon (EGD). -### no-engine - -Don't build support for loading engines. - ### no-err Don't compile in any error strings. @@ -922,9 +893,7 @@ support. ML-KEM is based on CRYSTALS-KYBER. See [FIPS 203]. ### no-module -Don't build any dynamically loadable engines. - -This also implies `no-dynamic-engine`. +Don't build any dynamically loadable modules. ### no-multiblock @@ -940,14 +909,6 @@ Don't build support for the Next Protocol Negotiation (NPN) TLS extension. Don't build support for Online Certificate Status Protocol (OCSP). -### no-padlockeng - -Don't build the padlock engine. - -### no-hw-padlock - -As synonym for `no-padlockeng`. Deprecated and should not be used. - ### no-pic Don't build with support for Position Independent Code. @@ -1054,12 +1015,6 @@ This removes the `-trace` option from `s_client` and `s_server`, and omits the Disabling `ssl-trace` may provide a small reduction in libssl binary size. -### no-static-engine - -Don't build the statically linked engines. - -This only has an impact when not built "shared". - ### no-stdio Don't use anything from the C header file `stdio.h` that makes use of the `FILE` @@ -1548,7 +1503,6 @@ its default): to build your own programs that use libcrypto or libssl. lib Contains the OpenSSL library files. - lib/engines Contains the OpenSSL dynamically loadable engines. share/man/man1 Contains the OpenSSL command line man-pages. share/man/man3 Contains the OpenSSL library calls man-pages. @@ -1574,8 +1528,6 @@ its default): to build your own programs that use libcrypto or libssl. [.LIB.'arch'] Contains the OpenSSL library files. - [.ENGINES'sover''pz'.'arch'] - Contains the OpenSSL dynamically loadable engines. [.SYS$STARTUP] Contains startup, login and shutdown scripts. These define appropriate logical names and command symbols. @@ -1596,7 +1548,7 @@ for you convenience: The installation directory should be appropriately protected to ensure unprivileged users cannot make changes to OpenSSL binaries or files, or -install engines. If you already have a pre-installed version of OpenSSL as +install providers. If you already have a pre-installed version of OpenSSL as part of your Operating System it is recommended that you do not overwrite the system version and instead install to somewhere else. diff --git a/NEWS.md b/NEWS.md index 10b4d24e07..3944e99cf0 100644 --- a/NEWS.md +++ b/NEWS.md @@ -27,7 +27,8 @@ OpenSSL 4.0 ### Major changes between OpenSSL 3.6 and OpenSSL 4.0 [under development] - * none + * ENGINE support was removed. The `no-engine` build option and the + `OPENSSL_NO_ENGINE` macro is always present. OpenSSL 3.6 ----------- diff --git a/NOTES-WINDOWS.md b/NOTES-WINDOWS.md index 5d6287a8e8..20748b5365 100644 --- a/NOTES-WINDOWS.md +++ b/NOTES-WINDOWS.md @@ -112,11 +112,10 @@ install it to a variety of locations. The following keys: `\\HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\OpenSSL--\OPENSSLDIR` - `\\HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\OpenSSL--\ENGINESDIR` `\\HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\OpenSSL--\MODULESDIR` Can be administratively set, and openssl will take the paths found there as the -values for OPENSSLDIR, ENGINESDIR and MODULESDIR respectively. +values for OPENSSLDIR and MODULESDIR respectively. To enable the reading of registry keys from windows builds, add `-DOSSL_WINCTX=`to the Configure command line. This define is used diff --git a/README-ENGINES.md b/README-ENGINES.md deleted file mode 100644 index 24ec748fe5..0000000000 --- a/README-ENGINES.md +++ /dev/null @@ -1,317 +0,0 @@ -Engines -======= - -Deprecation Note ----------------- - -The ENGINE API was introduced in OpenSSL version 0.9.6 as a low level -interface for adding alternative implementations of cryptographic -primitives, most notably for integrating hardware crypto devices. - -The ENGINE interface has its limitations and it has been superseded -by the [PROVIDER API](README-PROVIDERS.md), it is deprecated in OpenSSL -version 3.0. The following documentation is retained as an aid for -users who need to maintain or support existing ENGINE implementations. -Support for new hardware devices or new algorithms should be added -via providers, and existing engines should be converted to providers -as soon as possible. - -Built-in ENGINE implementations -------------------------------- - -There are currently built-in ENGINE implementations for the following -crypto devices: - -- Microsoft CryptoAPI -- VIA Padlock -- nCipher CHIL - -In addition, dynamic binding to external ENGINE implementations is now -provided by a special ENGINE called "dynamic". See the "DYNAMIC ENGINE" -section below for details. - -At this stage, a number of things are still needed and are being worked on: - -1. Integration of EVP support. -2. Configuration support. -3. Documentation! - -Integration of EVP support --------------------------- - -With respect to EVP, this relates to support for ciphers and digests in -the ENGINE model so that alternative implementations of existing -algorithms/modes (or previously unimplemented ones) can be provided by -ENGINE implementations. - -Configuration support ---------------------- - -Configuration support currently exists in the ENGINE API itself, in the -form of "control commands". These allow an application to expose to the -user/admin the set of commands and parameter types a given ENGINE -implementation supports, and for an application to directly feed string -based input to those ENGINEs, in the form of name-value pairs. This is an -extensible way for ENGINEs to define their own "configuration" mechanisms -that are specific to a given ENGINE (eg. for a particular hardware -device) but that should be consistent across *all* OpenSSL-based -applications when they use that ENGINE. Work is in progress (or at least -in planning) for supporting these control commands from the CONF (or -NCONF) code so that applications using OpenSSL's existing configuration -file format can have ENGINE settings specified in much the same way. -Presently however, applications must use the ENGINE API itself to provide -such functionality. To see first hand the types of commands available -with the various compiled-in ENGINEs (see further down for dynamic -ENGINEs), use the "engine" openssl utility with full verbosity, i.e.: - - openssl engine -vvvv - -Documentation -------------- - -Documentation? Volunteers welcome! The source code is reasonably well -self-documenting, but some summaries and usage instructions are needed - -moreover, they are needed in the same POD format the existing OpenSSL -documentation is provided in. Any complete or incomplete contributions -would help make this happen. - -STABILITY & BUG-REPORTS -======================= - -What already exists is fairly stable as far as it has been tested, but -the test base has been a bit small most of the time. For the most part, -the vendors of the devices these ENGINEs support have contributed to the -development and/or testing of the implementations, and *usually* (with no -guarantees) have experience in using the ENGINE support to drive their -devices from common OpenSSL-based applications. Bugs and/or inexplicable -behaviour in using a specific ENGINE implementation should be sent to the -author of that implementation (if it is mentioned in the corresponding C -file), and in the case of implementations for commercial hardware -devices, also through whatever vendor support channels are available. If -none of this is possible, or the problem seems to be something about the -ENGINE API itself (ie. not necessarily specific to a particular ENGINE -implementation) then you should mail complete details to the relevant -OpenSSL mailing list. For a definition of "complete details", refer to -the OpenSSL "README" file. As for which list to send it to: - -- openssl-users: if you are *using* the ENGINE abstraction, either in an - pre-compiled application or in your own application code. - -- openssl-dev: if you are discussing problems with OpenSSL source code. - -USAGE -===== - -The default "openssl" ENGINE is always chosen when performing crypto -operations unless you specify otherwise. You must actively tell the -openssl utility commands to use anything else through a new command line -switch called "-engine". Also, if you want to use the ENGINE support in -your own code to do something similar, you must likewise explicitly -select the ENGINE implementation you want. - -Depending on the type of hardware, system, and configuration, "settings" -may need to be applied to an ENGINE for it to function as expected/hoped. -The recommended way of doing this is for the application to support -ENGINE "control commands" so that each ENGINE implementation can provide -whatever configuration primitives it might require and the application -can allow the user/admin (and thus the hardware vendor's support desk -also) to provide any such input directly to the ENGINE implementation. -This way, applications do not need to know anything specific to any -device, they only need to provide the means to carry such user/admin -input through to the ENGINE in question. Ie. this connects *you* (and -your helpdesk) to the specific ENGINE implementation (and device), and -allows application authors to not get buried in hassle supporting -arbitrary devices they know (and care) nothing about. - -A new "openssl" utility, "openssl engine", has been added in that allows -for testing and examination of ENGINE implementations. Basic usage -instructions are available by specifying the "-?" command line switch. - -DYNAMIC ENGINES -=============== - -The new "dynamic" ENGINE provides a low-overhead way to support ENGINE -implementations that aren't pre-compiled and linked into OpenSSL-based -applications. This could be because existing compiled-in implementations -have known problems and you wish to use a newer version with an existing -application. It could equally be because the application (or OpenSSL -library) you are using simply doesn't have support for the ENGINE you -wish to use, and the ENGINE provider (eg. hardware vendor) is providing -you with a self-contained implementation in the form of a shared-library. -The other use-case for "dynamic" is with applications that wish to -maintain the smallest foot-print possible and so do not link in various -ENGINE implementations from OpenSSL, but instead leaves you to provide -them, if you want them, in the form of "dynamic"-loadable -shared-libraries. It should be possible for hardware vendors to provide -their own shared-libraries to support arbitrary hardware to work with -applications based on OpenSSL 0.9.7 or later. If you're using an -application based on 0.9.7 (or later) and the support you desire is only -announced for versions later than the one you need, ask the vendor to -backport their ENGINE to the version you need. - -How does "dynamic" work? ------------------------- - -The dynamic ENGINE has a special flag in its implementation such that -every time application code asks for the 'dynamic' ENGINE, it in fact -gets its own copy of it. As such, multi-threaded code (or code that -multiplexes multiple uses of 'dynamic' in a single application in any -way at all) does not get confused by 'dynamic' being used to do many -independent things. Other ENGINEs typically don't do this so there is -only ever 1 ENGINE structure of its type (and reference counts are used -to keep order). The dynamic ENGINE itself provides absolutely no -cryptographic functionality, and any attempt to "initialise" the ENGINE -automatically fails. All it does provide are a few "control commands" -that can be used to control how it will load an external ENGINE -implementation from a shared-library. To see these control commands, -use the command-line; - - openssl engine -vvvv dynamic - -The "SO_PATH" control command should be used to identify the -shared-library that contains the ENGINE implementation, and "NO_VCHECK" -might possibly be useful if there is a minor version conflict and you -(or a vendor helpdesk) is convinced you can safely ignore it. -"ID" is probably only needed if a shared-library implements -multiple ENGINEs, but if you know the engine id you expect to be using, -it doesn't hurt to specify it (and this provides a sanity check if -nothing else). "LIST_ADD" is only required if you actually wish the -loaded ENGINE to be discoverable by application code later on using the -ENGINE's "id". For most applications, this isn't necessary - but some -application authors may have nifty reasons for using it. The "LOAD" -command is the only one that takes no parameters and is the command -that uses the settings from any previous commands to actually *load* -the shared-library ENGINE implementation. If this command succeeds, the -(copy of the) 'dynamic' ENGINE will magically morph into the ENGINE -that has been loaded from the shared-library. As such, any control -commands supported by the loaded ENGINE could then be executed as per -normal. For instance, if ENGINE "foo" is implemented in the shared-library -"libfoo.so" and it supports some special control command "CMD_FOO", the -following code would load and use it (NB: obviously this code has no -error checking); - - ENGINE *e = ENGINE_by_id("dynamic"); - ENGINE_ctrl_cmd_string(e, "SO_PATH", "/lib/libfoo.so", 0); - ENGINE_ctrl_cmd_string(e, "ID", "foo", 0); - ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0); - ENGINE_ctrl_cmd_string(e, "CMD_FOO", "some input data", 0); - -For testing, the "openssl engine" utility can be useful for this sort -of thing. For example the above code excerpt would achieve much the -same result as; - - openssl engine dynamic \ - -pre SO_PATH:/lib/libfoo.so \ - -pre ID:foo \ - -pre LOAD \ - -pre "CMD_FOO:some input data" - -Or to simply see the list of commands supported by the "foo" ENGINE; - - openssl engine -vvvv dynamic \ - -pre SO_PATH:/lib/libfoo.so \ - -pre ID:foo \ - -pre LOAD - -Applications that support the ENGINE API and more specifically, the -"control commands" mechanism, will provide some way for you to pass -such commands through to ENGINEs. As such, you would select "dynamic" -as the ENGINE to use, and the parameters/commands you pass would -control the *actual* ENGINE used. Each command is actually a name-value -pair and the value can sometimes be omitted (eg. the "LOAD" command). -Whilst the syntax demonstrated in "openssl engine" uses a colon to -separate the command name from the value, applications may provide -their own syntax for making that separation (eg. a win32 registry -key-value pair may be used by some applications). The reason for the -"-pre" syntax in the "openssl engine" utility is that some commands -might be issued to an ENGINE *after* it has been initialised for use. -Eg. if an ENGINE implementation requires a smart-card to be inserted -during initialisation (or a PIN to be typed, or whatever), there may be -a control command you can issue afterwards to "forget" the smart-card -so that additional initialisation is no longer possible. In -applications such as web-servers, where potentially volatile code may -run on the same host system, this may provide some arguable security -value. In such a case, the command would be passed to the ENGINE after -it has been initialised for use, and so the "-post" switch would be -used instead. Applications may provide a different syntax for -supporting this distinction, and some may simply not provide it at all -("-pre" is almost always what you're after, in reality). - -How do I build a "dynamic" ENGINE? ----------------------------------- - -This question is trickier - currently OpenSSL bundles various ENGINE -implementations that are statically built in, and any application that -calls the "ENGINE_load_builtin_engines()" function will automatically -have all such ENGINEs available (and occupying memory). Applications -that don't call that function have no ENGINEs available like that and -would have to use "dynamic" to load any such ENGINE - but on the other -hand such applications would only have the memory footprint of any -ENGINEs explicitly loaded using user/admin provided control commands. -The main advantage of not statically linking ENGINEs and only using -"dynamic" for hardware support is that any installation using no -"external" ENGINE suffers no unnecessary memory footprint from unused -ENGINEs. Likewise, installations that do require an ENGINE incur the -overheads from only *that* ENGINE once it has been loaded. - -Sounds good? Maybe, but currently building an ENGINE implementation as -a shared-library that can be loaded by "dynamic" isn't automated in -OpenSSL's build process. It can be done manually quite easily however. -Such a shared-library can either be built with any OpenSSL code it -needs statically linked in, or it can link dynamically against OpenSSL -if OpenSSL itself is built as a shared library. The instructions are -the same in each case, but in the former (statically linked any -dependencies on OpenSSL) you must ensure OpenSSL is built with -position-independent code ("PIC"). The default OpenSSL compilation may -already specify the relevant flags to do this, but you should consult -with your compiler documentation if you are in any doubt. - -This example will show building the "atalla" ENGINE in the -crypto/engine/ directory as a shared-library for use via the "dynamic" -ENGINE. - -1. "cd" to the crypto/engine/ directory of a pre-compiled OpenSSL - source tree. - -2. Recompile at least one source file so you can see all the compiler - flags (and syntax) being used to build normally. Eg; - - touch hw_atalla.c ; make - - will rebuild "hw_atalla.o" using all such flags. - -3. Manually enter the same compilation line to compile the - "hw_atalla.c" file but with the following two changes; - - - add "-DENGINE_DYNAMIC_SUPPORT" to the command line switches, - - change the output file from "hw_atalla.o" to something new, - eg. "tmp_atalla.o" - -4. Link "tmp_atalla.o" into a shared-library using the top-level - OpenSSL libraries to resolve any dependencies. The syntax for doing - this depends heavily on your system/compiler and is a nightmare - known well to anyone who has worked with shared-library portability - before. 'gcc' on Linux, for example, would use the following syntax; - - gcc -shared -o dyn_atalla.so tmp_atalla.o -L../.. -lcrypto - -5. Test your shared library using "openssl engine" as explained in the - previous section. Eg. from the top-level directory, you might try - - apps/openssl engine -vvvv dynamic \ - -pre SO_PATH:./crypto/engine/dyn_atalla.so -pre LOAD - -If the shared-library loads successfully, you will see both "-pre" -commands marked as "SUCCESS" and the list of control commands -displayed (because of "-vvvv") will be the control commands for the -*atalla* ENGINE (ie. *not* the 'dynamic' ENGINE). You can also add -the "-t" switch to the utility if you want it to try and initialise -the atalla ENGINE for use to test any possible hardware/driver issues. - -PROBLEMS -======== - -It seems like the ENGINE part doesn't work too well with CryptoSwift on Win32. -A quick test done right before the release showed that trying "openssl speed --engine cswift" generated errors. If the DSO gets enabled, an attempt is made -to write at memory address 0x00000002. diff --git a/README.md b/README.md index ec21a38d3d..1d84f5ab1b 100644 --- a/README.md +++ b/README.md @@ -136,7 +136,6 @@ containing additional information on specific topics. * [Information about the OpenSSL QUIC protocol implementation](README-QUIC.md) * [Information about the OpenSSL Provider architecture](README-PROVIDERS.md) * [Information about using the OpenSSL FIPS validated module](README-FIPS.md) - * [Information about the legacy OpenSSL Engine architecture](README-ENGINES.md) The OpenSSL Guide ----------------- diff --git a/apps/build.info b/apps/build.info index 345f707958..976a24d71b 100644 --- a/apps/build.info +++ b/apps/build.info @@ -37,9 +37,6 @@ ENDIF IF[{- !$disabled{'dsa'} -}] $OPENSSLSRC=$OPENSSLSRC dsa.c dsaparam.c gendsa.c ENDIF -IF[{- !$disabled{'engine'} -}] -$OPENSSLSRC=$OPENSSLSRC engine.c -ENDIF IF[{- !$disabled{'rsa'} -}] $OPENSSLSRC=$OPENSSLSRC rsa.c genrsa.c ENDIF diff --git a/apps/ca.c b/apps/ca.c index 3a5689ce5b..850cbc6bb6 100644 --- a/apps/ca.c +++ b/apps/ca.c @@ -145,7 +145,7 @@ static int msie_hack = 0; typedef enum OPTION_choice { OPT_COMMON, - OPT_ENGINE, OPT_VERBOSE, OPT_CONFIG, OPT_NAME, OPT_SUBJ, OPT_UTF8, + OPT_VERBOSE, OPT_CONFIG, OPT_NAME, OPT_SUBJ, OPT_UTF8, OPT_CREATE_SERIAL, OPT_MULTIVALUE_RDN, OPT_STARTDATE, OPT_ENDDATE, OPT_DAYS, OPT_MD, OPT_POLICY, OPT_KEYFILE, OPT_KEYFORM, OPT_PASSIN, OPT_KEY, OPT_CERT, OPT_CERTFORM, OPT_SELFSIGN, @@ -182,9 +182,6 @@ const OPTIONS ca_options[] = { {"ss_cert", OPT_SS_CERT, '<', "File contains a self signed cert to sign"}, {"spkac", OPT_SPKAC, '<', "File contains DN and signed public key and challenge"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, -#endif OPT_SECTION("Configuration"), {"config", OPT_CONFIG, 's', "A config file"}, @@ -218,8 +215,7 @@ const OPTIONS ca_options[] = { OPT_SECTION("Signing"), {"md", OPT_MD, 's', "Digest to use, such as sha256"}, {"keyfile", OPT_KEYFILE, 's', "The CA private key"}, - {"keyform", OPT_KEYFORM, 'f', - "Private key file format (ENGINE, other values ignored)"}, + {"keyform", OPT_KEYFORM, 'f', "Private key file format (DER/PEM)"}, {"passin", OPT_PASSIN, 's', "Key and cert input file pass phrase source"}, {"key", OPT_KEY, 's', "Key to decrypt the private key or cert files if encrypted. Better use -passin"}, @@ -266,7 +262,6 @@ const OPTIONS ca_options[] = { int ca_main(int argc, char **argv) { CONF *conf = NULL; - ENGINE *e = NULL; BIGNUM *crlnumber = NULL, *serial = NULL; EVP_PKEY *pkey = NULL; BIO *in = NULL, *out = NULL, *Sout = NULL; @@ -500,9 +495,6 @@ opthelp: rev_arg = opt_arg(); rev_type = (o - OPT_CRL_REASON) + REV_CRL_REASON; break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; } } @@ -591,7 +583,7 @@ end_of_options: goto end; } } - pkey = load_key(keyfile, keyformat, 0, passin, e, "CA private key"); + pkey = load_key(keyfile, keyformat, 0, passin, "CA private key"); cleanse(passin); if (pkey == NULL) /* load_key() has already printed an appropriate message */ @@ -1319,7 +1311,6 @@ end_of_options: X509_CRL_free(crl); NCONF_free(conf); NCONF_free(extfile_conf); - release_engine(e); return ret; } diff --git a/apps/cmp.c b/apps/cmp.c index 627fac1a85..dc69a64ab7 100644 --- a/apps/cmp.c +++ b/apps/cmp.c @@ -160,7 +160,6 @@ static int opt_crlform = FORMAT_ASN1; static char *opt_keyform_s = NULL; static int opt_keyform = FORMAT_UNDEF; static char *opt_otherpass = NULL; -static char *opt_engine = NULL; #if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_HTTP) /* TLS connection */ @@ -264,9 +263,6 @@ typedef enum OPTION_choice { OPT_CERTFORM, OPT_CRLFORM, OPT_KEYFORM, OPT_OTHERPASS, -#ifndef OPENSSL_NO_ENGINE - OPT_ENGINE, -#endif OPT_PROV_ENUM, OPT_R_ENUM, @@ -496,16 +492,9 @@ const OPTIONS cmp_options[] = { "Format (PEM or DER) to use when saving a certificate to a file. Default PEM"}, {"crlform", OPT_CRLFORM, 's', "Format (PEM or DER) to use when saving a CRL to a file. Default DER"}, - {"keyform", OPT_KEYFORM, 's', - "Format of the key input (ENGINE, other values ignored)"}, + {"keyform", OPT_KEYFORM, 's', "Format of the key input (DER/PEM/P12)"}, {"otherpass", OPT_OTHERPASS, 's', "Pass phrase source potentially needed for loading certificates of others"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', - "Use crypto engine with given identifier, possibly a hardware device."}, - {OPT_MORE_STR, 0, 0, - "Engines may also be defined in OpenSSL config file engine section."}, -#endif OPT_PROV_OPTIONS, OPT_R_OPTIONS, @@ -678,9 +667,6 @@ static varref cmp_vars[] = { /* must be in same order as enumerated above! */ {&opt_certform_s}, {&opt_crlform_s}, {&opt_keyform_s}, {&opt_otherpass}, -#ifndef OPENSSL_NO_ENGINE - {&opt_engine}, -#endif #if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_HTTP) {(char **)&opt_tls_used}, {&opt_tls_cert}, {&opt_tls_key}, @@ -768,10 +754,10 @@ static int set_verbosity(int level) } static EVP_PKEY *load_key_pwd(const char *uri, int format, - const char *pass, ENGINE *eng, const char *desc) + const char *pass, const char *desc) { char *pass_string = get_passwd(pass, desc); - EVP_PKEY *pkey = load_key(uri, format, 0, pass_string, eng, desc); + EVP_PKEY *pkey = load_key(uri, format, 0, pass_string, desc); clear_free(pass_string); return pkey; @@ -1099,11 +1085,7 @@ static int transform_opts(void) return 0; } -#ifndef OPENSSL_NO_ENGINE -# define FORMAT_OPTIONS (OPT_FMT_PEMDER | OPT_FMT_PKCS12 | OPT_FMT_ENGINE) -#else -# define FORMAT_OPTIONS (OPT_FMT_PEMDER | OPT_FMT_PKCS12) -#endif +#define FORMAT_OPTIONS (OPT_FMT_PEMDER | OPT_FMT_PKCS12) if (opt_keyform_s != NULL && !opt_format(opt_keyform_s, FORMAT_OPTIONS, &opt_keyform)) { @@ -1127,7 +1109,7 @@ static int transform_opts(void) return 1; } -static OSSL_CMP_SRV_CTX *setup_srv_ctx(ENGINE *engine) +static OSSL_CMP_SRV_CTX *setup_srv_ctx(void) { OSSL_CMP_CTX *ctx; /* extra CMP (client) ctx partly used by server */ OSSL_CMP_SRV_CTX *srv_ctx = ossl_cmp_mock_srv_new(app_get0_libctx(), @@ -1180,7 +1162,7 @@ static OSSL_CMP_SRV_CTX *setup_srv_ctx(ENGINE *engine) if (opt_srv_key != NULL) { EVP_PKEY *pkey = load_key_pwd(opt_srv_key, opt_keyform, opt_srv_keypass, - engine, "private key for mock server cert"); + "private key for mock server cert"); if (pkey == NULL || !OSSL_CMP_CTX_set1_pkey(ctx, pkey)) { EVP_PKEY_free(pkey); @@ -1220,7 +1202,7 @@ static OSSL_CMP_SRV_CTX *setup_srv_ctx(ENGINE *engine) } if (opt_rsp_key != NULL) { EVP_PKEY *pkey = load_key_pwd(opt_rsp_key, opt_keyform, - opt_rsp_keypass, engine, + opt_rsp_keypass, "private key for enrollment cert"); if (pkey == NULL @@ -1370,8 +1352,7 @@ static int setup_verification_ctx(OSSL_CMP_CTX *ctx) * set up ssl_ctx for the OSSL_CMP_CTX based on options from config file/CLI. * Returns pointer on success, NULL on error */ -static SSL_CTX *setup_ssl_ctx(OSSL_CMP_CTX *ctx, const char *host, - ENGINE *engine) +static SSL_CTX *setup_ssl_ctx(OSSL_CMP_CTX *ctx, const char *host) { STACK_OF(X509) *untrusted = OSSL_CMP_CTX_get0_untrusted(ctx); EVP_PKEY *pkey = NULL; @@ -1477,7 +1458,7 @@ static SSL_CTX *setup_ssl_ctx(OSSL_CMP_CTX *ctx, const char *host, } pkey = load_key_pwd(opt_tls_key, opt_keyform, opt_tls_keypass, - engine, "TLS client private key"); + "TLS client private key"); cleanse(opt_tls_keypass); if (pkey == NULL) goto err; @@ -1526,7 +1507,7 @@ static SSL_CTX *setup_ssl_ctx(OSSL_CMP_CTX *ctx, const char *host, * file/CLI while parsing options and checking their consistency. * Returns 1 on success, 0 on error */ -static int setup_protection_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine) +static int setup_protection_ctx(OSSL_CMP_CTX *ctx) { if (!opt_unprotected_requests && opt_secret == NULL && opt_key == NULL) { CMP_err("must give -key or -secret unless -unprotected_requests is used"); @@ -1564,7 +1545,7 @@ static int setup_protection_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine) return 0; if (opt_key != NULL) { - EVP_PKEY *pkey = load_key_pwd(opt_key, opt_keyform, opt_keypass, engine, + EVP_PKEY *pkey = load_key_pwd(opt_key, opt_keyform, opt_keypass, "private key for CMP client certificate"); if (pkey == NULL || !OSSL_CMP_CTX_set1_pkey(ctx, pkey)) { @@ -1688,7 +1669,7 @@ static int set_fallback_pubkey(OSSL_CMP_CTX *ctx) * based on options from CLI and/or config file. * Returns 1 on success, 0 on error */ -static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine) +static int setup_request_ctx(OSSL_CMP_CTX *ctx) { X509_REQ *csr = NULL; X509_EXTENSIONS *exts = NULL; @@ -1870,14 +1851,14 @@ static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine) BIO *bio_bak = bio_err; bio_err = NULL; /* suppress diagnostics on first try loading key */ - pkey = load_key_pwd(file, format, pass, engine, desc); + pkey = load_key_pwd(file, format, pass, desc); bio_err = bio_bak; if (pkey == NULL) { ERR_clear_error(); desc = opt_csr == NULL ? "fallback public key for cert to be enrolled" : "public key for checking cert resulting from p10cr"; - pkey = load_pubkey(file, format, 0, pass, engine, desc); + pkey = load_pubkey(file, format, 0, pass, desc); priv = 0; } @@ -2140,7 +2121,7 @@ static int handle_opt_geninfo(OSSL_CMP_CTX *ctx) * Prints reason for error to bio_err. * Returns 1 on success, 0 on error */ -static int setup_client_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine) +static int setup_client_ctx(OSSL_CMP_CTX *ctx) { int ret = 0; char *host = NULL, *port = NULL, *path = NULL, *used_path = opt_path; @@ -2299,7 +2280,7 @@ static int setup_client_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine) goto err; APP_HTTP_TLS_INFO_free(OSSL_CMP_CTX_get_http_cb_arg(ctx)); (void)OSSL_CMP_CTX_set_http_cb_arg(ctx, info); - info->ssl_ctx = setup_ssl_ctx(ctx, host, engine); + info->ssl_ctx = setup_ssl_ctx(ctx, host); info->server = host; host = NULL; /* prevent deallocation */ if ((info->port = OPENSSL_strdup(server_port)) == NULL) @@ -2314,10 +2295,10 @@ static int setup_client_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine) } #endif - if (!setup_protection_ctx(ctx, engine)) + if (!setup_protection_ctx(ctx)) goto err; - if (!setup_request_ctx(ctx, engine)) + if (!setup_request_ctx(ctx)) goto err; if (!set_name(opt_recipient, OSSL_CMP_CTX_set1_recipient, ctx, "recipient") @@ -3069,11 +3050,6 @@ static int get_opts(int argc, char **argv) case OPT_OTHERPASS: opt_otherpass = opt_str(); break; -#ifndef OPENSSL_NO_ENGINE - case OPT_ENGINE: - opt_engine = opt_str(); - break; -#endif case OPT_PROV_CASES: if (!opt_provider(o)) goto opthelp; @@ -3606,7 +3582,6 @@ int cmp_main(int argc, char **argv) char *configfile = NULL; int i; X509 *newcert = NULL; - ENGINE *engine = NULL; int ret = 0; /* default: failure */ if (!handle_opts_upfront(argc, argv)) @@ -3672,15 +3647,6 @@ int cmp_main(int argc, char **argv) if (opt_batch) set_base_ui_method(UI_null()); - if (opt_engine != NULL) { - engine = setup_engine_methods(opt_engine, - 0 /* not: ENGINE_METHOD_ALL */, 0); - if (engine == NULL) { - CMP_err1("cannot load engine %s", opt_engine); - goto err; - } - } - OSSL_CMP_CTX_set_log_verbosity(cmp_ctx, opt_verbosity); if (!OSSL_CMP_CTX_set_log_cb(cmp_ctx, print_to_bio_out)) { CMP_err1("cannot set up error reporting and logging for %s", prog); @@ -3740,7 +3706,7 @@ int cmp_main(int argc, char **argv) OSSL_CMP_SRV_CTX *srv_ctx; OSSL_CMP_CTX *srv_cmp_ctx; - if ((srv_ctx = setup_srv_ctx(engine)) == NULL) + if ((srv_ctx = setup_srv_ctx()) == NULL) goto err; OSSL_CMP_CTX_set_transfer_cb_arg(cmp_ctx /* of client */, srv_ctx); @@ -3791,7 +3757,7 @@ int cmp_main(int argc, char **argv) CMP_warn("-use_mock_srv option is not used if enough filenames given for -rspin"); } - if (!setup_client_ctx(cmp_ctx, engine)) { + if (!setup_client_ctx(cmp_ctx)) { CMP_err("cannot set up CMP context"); goto err; } @@ -3935,7 +3901,6 @@ int cmp_main(int argc, char **argv) #endif } X509_VERIFY_PARAM_free(vpm); - release_engine(engine); NCONF_free(conf); /* must not do as long as opt_... variables are used */ OSSL_CMP_log_close(); diff --git a/apps/cms.c b/apps/cms.c index 7e2d6ba32a..144f956943 100644 --- a/apps/cms.c +++ b/apps/cms.c @@ -89,7 +89,7 @@ typedef enum OPTION_choice { OPT_PASSIN, OPT_TO, OPT_FROM, OPT_SUBJECT, OPT_SIGNER, OPT_RECIP, OPT_CERTSOUT, OPT_MD, OPT_INKEY, OPT_KEYFORM, OPT_KEYOPT, OPT_RR_FROM, OPT_RR_TO, OPT_AES128_WRAP, OPT_AES192_WRAP, OPT_AES256_WRAP, - OPT_3DES_WRAP, OPT_WRAP, OPT_ENGINE, + OPT_3DES_WRAP, OPT_WRAP, OPT_R_ENUM, OPT_PROV_ENUM, OPT_CONFIG, OPT_V_ENUM, @@ -159,11 +159,7 @@ const OPTIONS cms_options[] = { "Input private key (if not signer or recipient)"}, {"passin", OPT_PASSIN, 's', "Input file pass phrase source"}, {"keyopt", OPT_KEYOPT, 's', "Set public key parameters as n:v pairs"}, - {"keyform", OPT_KEYFORM, 'f', - "Input private key format (ENGINE, other values ignored)"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"}, -#endif + {"keyform", OPT_KEYFORM, 'f', "Input private key format (DER/PEM)"}, OPT_PROV_OPTIONS, OPT_R_OPTIONS, @@ -313,7 +309,6 @@ int cms_main(int argc, char **argv) BIO *in = NULL, *out = NULL, *indata = NULL, *rctin = NULL; CMS_ContentInfo *cms = NULL, *rcms = NULL; CMS_ReceiptRequest *rr = NULL; - ENGINE *e = NULL; EVP_PKEY *key = NULL; EVP_CIPHER *cipher = NULL, *wrap_cipher = NULL, *kekcipher = NULL; EVP_MD *sign_md = NULL; @@ -599,9 +594,6 @@ int cms_main(int argc, char **argv) goto opthelp; } break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; case OPT_PASSIN: passinarg = opt_arg(); break; @@ -962,7 +954,7 @@ int cms_main(int argc, char **argv) } if (keyfile != NULL) { - key = load_key(keyfile, keyform, 0, passin, e, "signing key"); + key = load_key(keyfile, keyform, 0, passin, "signing key"); if (key == NULL) goto end; } @@ -1220,7 +1212,7 @@ int cms_main(int argc, char **argv) ret = 2; goto end; } - key = load_key(keyfile, keyform, 0, passin, e, "signing key"); + key = load_key(keyfile, keyform, 0, passin, "signing key"); if (key == NULL) { ret = 2; goto end; @@ -1439,7 +1431,6 @@ int cms_main(int argc, char **argv) EVP_MD_free(sign_md); CMS_ContentInfo_free(cms); CMS_ContentInfo_free(rcms); - release_engine(e); BIO_free(rctin); BIO_free(in); BIO_free(indata); diff --git a/apps/crl.c b/apps/crl.c index 5f9c629656..e0218334d1 100644 --- a/apps/crl.c +++ b/apps/crl.c @@ -265,7 +265,7 @@ int crl_main(int argc, char **argv) newcrl = load_crl(crldiff, informat, 0, "other CRL"); if (!newcrl) goto end; - pkey = load_key(keyfile, keyformat, 0, NULL, NULL, "CRL signing key"); + pkey = load_key(keyfile, keyformat, 0, NULL, "CRL signing key"); if (pkey == NULL) { X509_CRL_free(newcrl); goto end; diff --git a/apps/dgst.c b/apps/dgst.c index 07fa5fe26d..31a9c2cf7f 100644 --- a/apps/dgst.c +++ b/apps/dgst.c @@ -42,7 +42,7 @@ typedef enum OPTION_choice { OPT_COMMON, OPT_LIST, OPT_C, OPT_R, OPT_OUT, OPT_SIGN, OPT_PASSIN, OPT_VERIFY, - OPT_PRVERIFY, OPT_SIGNATURE, OPT_KEYFORM, OPT_ENGINE, OPT_ENGINE_IMPL, + OPT_PRVERIFY, OPT_SIGNATURE, OPT_KEYFORM, OPT_HEX, OPT_BINARY, OPT_DEBUG, OPT_FIPS_FINGERPRINT, OPT_HMAC, OPT_HMAC_ENV, OPT_HMAC_STDIN, OPT_MAC, OPT_SIGOPT, OPT_MACOPT, OPT_XOFLEN, OPT_DIGEST, @@ -55,18 +55,13 @@ const OPTIONS dgst_options[] = { OPT_SECTION("General"), {"help", OPT_HELP, '-', "Display this summary"}, {"list", OPT_LIST, '-', "List digests"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"}, - {"engine_impl", OPT_ENGINE_IMPL, '-', - "Also use engine given by -engine for digest operations"}, -#endif {"passin", OPT_PASSIN, 's', "Input file pass phrase source"}, OPT_SECTION("Output"), {"c", OPT_C, '-', "Print the digest with separating colons"}, {"r", OPT_R, '-', "Print the digest in coreutils format"}, {"out", OPT_OUT, '>', "Output to filename rather than stdout"}, - {"keyform", OPT_KEYFORM, 'f', "Key file format (ENGINE, other values ignored)"}, + {"keyform", OPT_KEYFORM, 'f', "Key file format (DER/PEM)"}, {"hex", OPT_HEX, '-', "Print as hex dump"}, {"binary", OPT_BINARY, '-', "Print in binary form"}, {"xoflen", OPT_XOFLEN, 'p', "Output length for XOF algorithms. To obtain the maximum security strength set this to 32 (or greater) for SHAKE128, and 64 (or greater) for SHAKE256"}, @@ -99,7 +94,6 @@ const OPTIONS dgst_options[] = { int dgst_main(int argc, char **argv) { BIO *in = NULL, *inp = NULL, *bmd = NULL, *out = NULL; - ENGINE *e = NULL, *impl = NULL; EVP_PKEY *sigkey = NULL; STACK_OF(OPENSSL_STRING) *sigopts = NULL, *macopts = NULL; char *hmac_key = NULL; @@ -117,7 +111,6 @@ int dgst_main(int argc, char **argv) int i, ret = EXIT_FAILURE, out_bin = -1, want_pub = 0, do_verify = 0; int xoflen = 0; unsigned char *buf = NULL, *sigbuf = NULL; - int engine_impl = 0; struct doall_dgst_digests dec; EVP_MD_CTX *signctx = NULL; int oneshot_sign = 0; @@ -183,12 +176,6 @@ int dgst_main(int argc, char **argv) if (!opt_format(opt_arg(), OPT_FMT_ANY, &keyform)) goto opthelp; break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; - case OPT_ENGINE_IMPL: - engine_impl = 1; - break; case OPT_HEX: out_bin = 0; break; @@ -282,8 +269,6 @@ int dgst_main(int argc, char **argv) "No signature to verify: use the -signature option\n"); goto end; } - if (engine_impl) - impl = e; in = BIO_new(BIO_s_file()); bmd = BIO_new(BIO_f_md()); @@ -319,9 +304,9 @@ int dgst_main(int argc, char **argv) if (keyfile != NULL) { if (want_pub) - sigkey = load_pubkey(keyfile, keyform, 0, NULL, e, "public key"); + sigkey = load_pubkey(keyfile, keyform, 0, NULL, "public key"); else - sigkey = load_key(keyfile, keyform, 0, passin, e, "private key"); + sigkey = load_key(keyfile, keyform, 0, passin, "private key"); if (sigkey == NULL) { /* * load_[pub]key() has already printed an appropriate message @@ -344,7 +329,7 @@ int dgst_main(int argc, char **argv) if (mac_name != NULL) { EVP_PKEY_CTX *mac_ctx = NULL; - if (!init_gen_str(&mac_ctx, mac_name, impl, 0, NULL, NULL)) + if (!init_gen_str(&mac_ctx, mac_name, 0, NULL, NULL)) goto end; if (macopts != NULL) { for (i = 0; i < sk_OPENSSL_STRING_num(macopts); i++) { @@ -359,7 +344,6 @@ int dgst_main(int argc, char **argv) } sigkey = app_keygen(mac_ctx, mac_name, 0, 0 /* not verbose */); - /* Verbose output would make external-tests gost-engine fail */ EVP_PKEY_CTX_free(mac_ctx); if (sigkey == NULL) goto end; @@ -370,7 +354,7 @@ int dgst_main(int argc, char **argv) md = (EVP_MD *)EVP_sha256(); digestname = SN_sha256; } - sigkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, impl, + sigkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL, (unsigned char *)hmac_key, strlen(hmac_key)); if (sigkey == NULL) @@ -389,19 +373,13 @@ int dgst_main(int argc, char **argv) goto end; } if (do_verify) - if (impl == NULL) - res = EVP_DigestVerifyInit_ex(mctx, &pctx, digestname, - app_get0_libctx(), - app_get0_propq(), sigkey, NULL); - else - res = EVP_DigestVerifyInit(mctx, &pctx, md, impl, sigkey); + res = EVP_DigestVerifyInit_ex(mctx, &pctx, digestname, + app_get0_libctx(), + app_get0_propq(), sigkey, NULL); else - if (impl == NULL) - res = EVP_DigestSignInit_ex(mctx, &pctx, digestname, - app_get0_libctx(), - app_get0_propq(), sigkey, NULL); - else - res = EVP_DigestSignInit(mctx, &pctx, md, impl, sigkey); + res = EVP_DigestSignInit_ex(mctx, &pctx, digestname, + app_get0_libctx(), + app_get0_propq(), sigkey, NULL); if (res == 0) { BIO_printf(bio_err, "Error setting context\n"); goto end; @@ -432,7 +410,7 @@ int dgst_main(int argc, char **argv) } if (md == NULL) md = (EVP_MD *)EVP_sha256(); - if (!EVP_DigestInit_ex(mctx, md, impl)) { + if (!EVP_DigestInit_ex(mctx, md, NULL)) { BIO_printf(bio_err, "Error setting digest\n"); goto end; } @@ -534,7 +512,6 @@ int dgst_main(int argc, char **argv) sk_OPENSSL_STRING_pop_free(macopts, clear_free); OPENSSL_free(sigbuf); BIO_free(bmd); - release_engine(e); return ret; } diff --git a/apps/dhparam.c b/apps/dhparam.c index 600b7ed2b5..72fa6f0d9a 100644 --- a/apps/dhparam.c +++ b/apps/dhparam.c @@ -37,7 +37,7 @@ static int verbose = 1; typedef enum OPTION_choice { OPT_COMMON, OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, - OPT_ENGINE, OPT_CHECK, OPT_TEXT, OPT_NOOUT, + OPT_CHECK, OPT_TEXT, OPT_NOOUT, OPT_DSAPARAM, OPT_2, OPT_3, OPT_5, OPT_VERBOSE, OPT_QUIET, OPT_R_ENUM, OPT_PROV_ENUM } OPTION_CHOICE; @@ -52,9 +52,6 @@ const OPTIONS dhparam_options[] = { {"dsaparam", OPT_DSAPARAM, '-', "Read or generate DSA parameters, convert to DH"}, #endif -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"}, -#endif OPT_SECTION("Input"), {"in", OPT_IN, '<', "Input file"}, @@ -85,7 +82,6 @@ int dhparam_main(int argc, char **argv) EVP_PKEY *pkey = NULL, *tmppkey = NULL; EVP_PKEY_CTX *ctx = NULL; char *infile = NULL, *outfile = NULL, *prog; - ENGINE *e = NULL; int dsaparam = 0; int text = 0, ret = 1, num = 0, g = 0; int informat = FORMAT_PEM, outformat = FORMAT_PEM, check = 0, noout = 0; @@ -117,9 +113,6 @@ int dhparam_main(int argc, char **argv) case OPT_OUT: outfile = opt_arg(); break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; case OPT_CHECK: check = 1; break; @@ -362,7 +355,6 @@ int dhparam_main(int argc, char **argv) EVP_PKEY_free(pkey); EVP_PKEY_free(tmppkey); EVP_PKEY_CTX_free(ctx); - release_engine(e); return ret; } diff --git a/apps/dsa.c b/apps/dsa.c index 9ba8c252da..7ba3634d6d 100644 --- a/apps/dsa.c +++ b/apps/dsa.c @@ -34,7 +34,7 @@ typedef enum OPTION_choice { OPT_COMMON, - OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_ENGINE, + OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, /* Do not change the order here; see case statements below */ OPT_PVK_NONE, OPT_PVK_WEAK, OPT_PVK_STRONG, OPT_NOOUT, OPT_TEXT, OPT_MODULUS, OPT_PUBIN, @@ -51,9 +51,6 @@ const OPTIONS dsa_options[] = { {"pvk-weak", OPT_PVK_WEAK, '-', "Enable 'Weak' PVK encoding level"}, {"pvk-none", OPT_PVK_NONE, '-', "Don't enforce PVK encoding"}, #endif -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"}, -#endif OPT_SECTION("Input"), {"in", OPT_IN, 's', "Input key"}, @@ -77,7 +74,6 @@ const OPTIONS dsa_options[] = { int dsa_main(int argc, char **argv) { BIO *out = NULL; - ENGINE *e = NULL; EVP_PKEY *pkey = NULL; EVP_CIPHER *enc = NULL; char *infile = NULL, *outfile = NULL, *prog; @@ -120,9 +116,6 @@ int dsa_main(int argc, char **argv) case OPT_OUT: outfile = opt_arg(); break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; case OPT_PASSIN: passinarg = opt_arg(); break; @@ -176,9 +169,9 @@ int dsa_main(int argc, char **argv) BIO_printf(bio_err, "read DSA key\n"); if (pubin) - pkey = load_pubkey(infile, informat, 1, passin, e, "public key"); + pkey = load_pubkey(infile, informat, 1, passin, "public key"); else - pkey = load_key(infile, informat, 1, passin, e, "private key"); + pkey = load_key(infile, informat, 1, passin, "private key"); if (pkey == NULL) { BIO_printf(bio_err, "unable to load Key\n"); @@ -300,7 +293,6 @@ int dsa_main(int argc, char **argv) BIO_free_all(out); EVP_PKEY_free(pkey); EVP_CIPHER_free(enc); - release_engine(e); OPENSSL_free(passin); OPENSSL_free(passout); return ret; diff --git a/apps/dsaparam.c b/apps/dsaparam.c index 6cb0007aa3..583224f56d 100644 --- a/apps/dsaparam.c +++ b/apps/dsaparam.c @@ -27,7 +27,7 @@ static int verbose = 0; typedef enum OPTION_choice { OPT_COMMON, OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_TEXT, - OPT_NOOUT, OPT_GENKEY, OPT_ENGINE, OPT_VERBOSE, OPT_QUIET, + OPT_NOOUT, OPT_GENKEY, OPT_VERBOSE, OPT_QUIET, OPT_R_ENUM, OPT_PROV_ENUM } OPTION_CHOICE; @@ -36,9 +36,6 @@ const OPTIONS dsaparam_options[] = { OPT_SECTION("General"), {"help", OPT_HELP, '-', "Display this summary"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"}, -#endif OPT_SECTION("Input"), {"in", OPT_IN, '<', "Input file"}, @@ -64,7 +61,6 @@ const OPTIONS dsaparam_options[] = { int dsaparam_main(int argc, char **argv) { - ENGINE *e = NULL; BIO *out = NULL; EVP_PKEY *params = NULL, *pkey = NULL; EVP_PKEY_CTX *ctx = NULL; @@ -100,9 +96,6 @@ int dsaparam_main(int argc, char **argv) case OPT_OUT: outfile = opt_arg(); break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; case OPT_TEXT: text = 1; break; @@ -253,6 +246,5 @@ int dsaparam_main(int argc, char **argv) EVP_PKEY_CTX_free(ctx); EVP_PKEY_free(pkey); EVP_PKEY_free(params); - release_engine(e); return ret; } diff --git a/apps/ec.c b/apps/ec.c index 9f4d5fadea..0d0cddfb29 100644 --- a/apps/ec.c +++ b/apps/ec.c @@ -23,7 +23,7 @@ typedef enum OPTION_choice { OPT_COMMON, - OPT_INFORM, OPT_OUTFORM, OPT_ENGINE, OPT_IN, OPT_OUT, + OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_NOOUT, OPT_TEXT, OPT_PARAM_OUT, OPT_PUBIN, OPT_PUBOUT, OPT_PASSIN, OPT_PASSOUT, OPT_PARAM_ENC, OPT_CONV_FORM, OPT_CIPHER, OPT_NO_PUBLIC, OPT_CHECK, OPT_PROV_ENUM @@ -32,13 +32,10 @@ typedef enum OPTION_choice { const OPTIONS ec_options[] = { OPT_SECTION("General"), {"help", OPT_HELP, '-', "Display this summary"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, -#endif OPT_SECTION("Input"), {"in", OPT_IN, 's', "Input file"}, - {"inform", OPT_INFORM, 'f', "Input format (DER/PEM/P12/ENGINE)"}, + {"inform", OPT_INFORM, 'f', "Input format (DER/PEM/P12)"}, {"pubin", OPT_PUBIN, '-', "Expect a public key in input file"}, {"passin", OPT_PASSIN, 's', "Input file pass phrase source"}, {"check", OPT_CHECK, '-', "check key consistency"}, @@ -68,7 +65,6 @@ int ec_main(int argc, char **argv) EVP_PKEY_CTX *pctx = NULL; EVP_PKEY *eckey = NULL; BIO *out = NULL; - ENGINE *e = NULL; EVP_CIPHER *enc = NULL; char *infile = NULL, *outfile = NULL, *ciphername = NULL, *prog; char *passin = NULL, *passout = NULL, *passinarg = NULL, *passoutarg = NULL; @@ -128,9 +124,6 @@ int ec_main(int argc, char **argv) case OPT_PASSOUT: passoutarg = opt_arg(); break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; case OPT_CIPHER: ciphername = opt_unknown(); break; @@ -171,9 +164,9 @@ int ec_main(int argc, char **argv) } if (pubin) - eckey = load_pubkey(infile, informat, 1, passin, e, "public key"); + eckey = load_pubkey(infile, informat, 1, passin, "public key"); else - eckey = load_key(infile, informat, 1, passin, e, "private key"); + eckey = load_key(infile, informat, 1, passin, "private key"); if (eckey == NULL) { BIO_printf(bio_err, "unable to load Key\n"); @@ -278,7 +271,6 @@ end: OSSL_ENCODER_CTX_free(ectx); OSSL_DECODER_CTX_free(dctx); EVP_PKEY_CTX_free(pctx); - release_engine(e); if (passin != NULL) OPENSSL_clear_free(passin, strlen(passin)); if (passout != NULL) diff --git a/apps/ecparam.c b/apps/ecparam.c index b025e9bc75..f326105ec5 100644 --- a/apps/ecparam.c +++ b/apps/ecparam.c @@ -25,7 +25,7 @@ typedef enum OPTION_choice { OPT_COMMON, OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_TEXT, OPT_CHECK, OPT_LIST_CURVES, OPT_NO_SEED, OPT_NOOUT, OPT_NAME, - OPT_CONV_FORM, OPT_PARAM_ENC, OPT_GENKEY, OPT_ENGINE, OPT_CHECK_NAMED, + OPT_CONV_FORM, OPT_PARAM_ENC, OPT_GENKEY, OPT_CHECK_NAMED, OPT_R_ENUM, OPT_PROV_ENUM } OPTION_CHOICE; @@ -34,9 +34,6 @@ const OPTIONS ecparam_options[] = { {"help", OPT_HELP, '-', "Display this summary"}, {"list_curves", OPT_LIST_CURVES, '-', "Prints a list of all curve 'short names'"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, -#endif {"genkey", OPT_GENKEY, '-', "Generate ec key"}, {"in", OPT_IN, '<', "Input file - default stdin"}, @@ -95,7 +92,6 @@ int ecparam_main(int argc, char **argv) EVP_PKEY *params_key = NULL, *key = NULL; OSSL_ENCODER_CTX *ectx_key = NULL, *ectx_params = NULL; OSSL_DECODER_CTX *dctx_params = NULL; - ENGINE *e = NULL; BIO *out = NULL; char *curve_name = NULL; char *asn1_encoding = NULL; @@ -175,9 +171,6 @@ int ecparam_main(int argc, char **argv) if (!opt_provider(o)) goto end; break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; } } @@ -345,7 +338,6 @@ int ecparam_main(int argc, char **argv) end: if (ret != 0) ERR_print_errors(bio_err); - release_engine(e); EVP_PKEY_free(params_key); EVP_PKEY_free(key); EVP_PKEY_CTX_free(pctx); diff --git a/apps/enc.c b/apps/enc.c index ab53e83c02..15cc52847c 100644 --- a/apps/enc.c +++ b/apps/enc.c @@ -45,7 +45,7 @@ struct doall_enc_ciphers { typedef enum OPTION_choice { OPT_COMMON, OPT_LIST, - OPT_E, OPT_IN, OPT_OUT, OPT_PASS, OPT_ENGINE, OPT_D, OPT_P, OPT_V, + OPT_E, OPT_IN, OPT_OUT, OPT_PASS, OPT_D, OPT_P, OPT_V, OPT_NOPAD, OPT_SALT, OPT_NOSALT, OPT_DEBUG, OPT_UPPER_P, OPT_UPPER_A, OPT_A, OPT_Z, OPT_BUFSIZE, OPT_K, OPT_KFILE, OPT_UPPER_K, OPT_NONE, OPT_UPPER_S, OPT_IV, OPT_MD, OPT_ITER, OPT_PBKDF2, OPT_CIPHER, @@ -64,9 +64,6 @@ const OPTIONS enc_options[] = { {"d", OPT_D, '-', "Decrypt"}, {"p", OPT_P, '-', "Print the iv/key"}, {"P", OPT_UPPER_P, '-', "Print the iv/key and exit"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, -#endif OPT_SECTION("Input"), {"in", OPT_IN, '<', "Input file"}, @@ -119,7 +116,6 @@ int enc_main(int argc, char **argv) { static char buf[128]; static const char magic[] = "Salted__"; - ENGINE *e = NULL; BIO *in = NULL, *out = NULL, *b64 = NULL, *benc = NULL, *rbio = NULL, *wbio = NULL; EVP_CIPHER_CTX *ctx = NULL; @@ -211,9 +207,6 @@ int enc_main(int argc, char **argv) case OPT_PASS: passarg = opt_arg(); break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; case OPT_D: enc = 0; break; @@ -667,7 +660,7 @@ int enc_main(int argc, char **argv) EVP_CIPHER_CTX_set_flags(ctx, EVP_CIPHER_CTX_FLAG_WRAP_ALLOW); if (rawkey_set) { - if (!EVP_CipherInit_ex(ctx, cipher, e, key, + if (!EVP_CipherInit_ex(ctx, cipher, NULL, key, (hiv == NULL && wrap == 1 ? NULL : iv), enc)) { BIO_printf(bio_err, "Error setting cipher %s\n", EVP_CIPHER_get0_name(cipher)); @@ -792,7 +785,6 @@ int enc_main(int argc, char **argv) #endif BIO_free(bbrot); BIO_free(bzstd); - release_engine(e); OPENSSL_free(pass); return ret; } diff --git a/apps/engine.c b/apps/engine.c deleted file mode 100644 index 90e3e8be3f..0000000000 --- a/apps/engine.c +++ /dev/null @@ -1,501 +0,0 @@ -/* - * Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - -#include - -#include "apps.h" -#include "progs.h" -#include -#include -#include -#include -#include -#include -#include - -typedef enum OPTION_choice { - OPT_COMMON, - OPT_C, OPT_T, OPT_TT, OPT_PRE, OPT_POST, - OPT_V = 100, OPT_VV, OPT_VVV, OPT_VVVV -} OPTION_CHOICE; - -const OPTIONS engine_options[] = { - {OPT_HELP_STR, 1, '-', "Usage: %s [options] engine...\n"}, - - OPT_SECTION("General"), - {"help", OPT_HELP, '-', "Display this summary"}, - {"t", OPT_T, '-', "Check that specified engine is available"}, - {"pre", OPT_PRE, 's', "Run command against the ENGINE before loading it"}, - {"post", OPT_POST, 's', "Run command against the ENGINE after loading it"}, - - OPT_SECTION("Output"), - {"v", OPT_V, '-', "List 'control commands' For each specified engine"}, - {"vv", OPT_VV, '-', "Also display each command's description"}, - {"vvv", OPT_VVV, '-', "Also add the input flags for each command"}, - {"vvvv", OPT_VVVV, '-', "Also show internal input flags"}, - {"c", OPT_C, '-', "List the capabilities of specified engine"}, - {"tt", OPT_TT, '-', "Display error trace for unavailable engines"}, - {OPT_MORE_STR, OPT_EOF, 1, - "Commands are like \"SO_PATH:/lib/libdriver.so\""}, - - OPT_PARAMETERS(), - {"engine", 0, 0, "ID of engine(s) to load"}, - {NULL} -}; - -static int append_buf(char **buf, int *size, const char *s) -{ - const int expand = 256; - int len = (int)(strlen(s) + 1); - char *p = *buf; - - if (p == NULL) { - *size = ((len + expand - 1) / expand) * expand; - p = *buf = app_malloc(*size, "engine buffer"); - } else { - const int blen = (int)strlen(p); - - if (blen > 0) - len += 2 + blen; - - if (len > *size) { - *size = ((len + expand - 1) / expand) * expand; - p = OPENSSL_realloc(p, *size); - if (p == NULL) { - OPENSSL_free(*buf); - *buf = NULL; - return 0; - } - *buf = p; - } - - if (blen > 0) { - p += blen; - *p++ = ','; - *p++ = ' '; - } - } - - strcpy(p, s); - return 1; -} - -static int util_flags(BIO *out, unsigned int flags, const char *indent) -{ - int started = 0, err = 0; - /* Indent before displaying input flags */ - BIO_printf(out, "%s%s(input flags): ", indent, indent); - if (flags == 0) { - BIO_printf(out, "\n"); - return 1; - } - /* - * If the object is internal, mark it in a way that shows instead of - * having it part of all the other flags, even if it really is. - */ - if (flags & ENGINE_CMD_FLAG_INTERNAL) { - BIO_printf(out, "[Internal] "); - } - - if (flags & ENGINE_CMD_FLAG_NUMERIC) { - BIO_printf(out, "NUMERIC"); - started = 1; - } - /* - * Now we check that no combinations of the mutually exclusive NUMERIC, - * STRING, and NO_INPUT flags have been used. Future flags that can be - * OR'd together with these would need to added after these to preserve - * the testing logic. - */ - if (flags & ENGINE_CMD_FLAG_STRING) { - if (started) { - BIO_printf(out, "|"); - err = 1; - } - BIO_printf(out, "STRING"); - started = 1; - } - if (flags & ENGINE_CMD_FLAG_NO_INPUT) { - if (started) { - BIO_printf(out, "|"); - err = 1; - } - BIO_printf(out, "NO_INPUT"); - started = 1; - } - /* Check for unknown flags */ - flags = flags & ~ENGINE_CMD_FLAG_NUMERIC & - ~ENGINE_CMD_FLAG_STRING & - ~ENGINE_CMD_FLAG_NO_INPUT & ~ENGINE_CMD_FLAG_INTERNAL; - if (flags) { - if (started) - BIO_printf(out, "|"); - BIO_printf(out, "<0x%04X>", flags); - } - if (err) - BIO_printf(out, " "); - BIO_printf(out, "\n"); - return 1; -} - -static int util_verbose(ENGINE *e, int verbose, BIO *out, const char *indent) -{ - static const int line_wrap = 78; - int num; - int ret = 0; - char *name = NULL; - char *desc = NULL; - int flags; - int xpos = 0; - STACK_OF(OPENSSL_STRING) *cmds = NULL; - if (!ENGINE_ctrl(e, ENGINE_CTRL_HAS_CTRL_FUNCTION, 0, NULL, NULL) || - ((num = ENGINE_ctrl(e, ENGINE_CTRL_GET_FIRST_CMD_TYPE, - 0, NULL, NULL)) <= 0)) { - return 1; - } - - cmds = sk_OPENSSL_STRING_new_null(); - if (cmds == NULL) - goto err; - - do { - int len; - /* Get the command input flags */ - if ((flags = ENGINE_ctrl(e, ENGINE_CTRL_GET_CMD_FLAGS, num, - NULL, NULL)) < 0) - goto err; - if (!(flags & ENGINE_CMD_FLAG_INTERNAL) || verbose >= 4) { - /* Get the command name */ - if ((len = ENGINE_ctrl(e, ENGINE_CTRL_GET_NAME_LEN_FROM_CMD, num, - NULL, NULL)) <= 0) - goto err; - name = app_malloc(len + 1, "name buffer"); - if (ENGINE_ctrl(e, ENGINE_CTRL_GET_NAME_FROM_CMD, num, name, - NULL) <= 0) - goto err; - /* Get the command description */ - if ((len = ENGINE_ctrl(e, ENGINE_CTRL_GET_DESC_LEN_FROM_CMD, num, - NULL, NULL)) < 0) - goto err; - if (len > 0) { - desc = app_malloc(len + 1, "description buffer"); - if (ENGINE_ctrl(e, ENGINE_CTRL_GET_DESC_FROM_CMD, num, desc, - NULL) <= 0) - goto err; - } - /* Now decide on the output */ - if (xpos == 0) - /* Do an indent */ - xpos = BIO_puts(out, indent); - else - /* Otherwise prepend a ", " */ - xpos += BIO_printf(out, ", "); - if (verbose == 1) { - /* - * We're just listing names, comma-delimited - */ - if ((xpos > (int)strlen(indent)) && - (xpos + (int)strlen(name) > line_wrap)) { - BIO_printf(out, "\n"); - xpos = BIO_puts(out, indent); - } - xpos += BIO_printf(out, "%s", name); - } else { - /* We're listing names plus descriptions */ - BIO_printf(out, "%s: %s\n", name, - (desc == NULL) ? "" : desc); - /* ... and sometimes input flags */ - if ((verbose >= 3) && !util_flags(out, flags, indent)) - goto err; - xpos = 0; - } - } - OPENSSL_free(name); - name = NULL; - OPENSSL_free(desc); - desc = NULL; - /* Move to the next command */ - num = ENGINE_ctrl(e, ENGINE_CTRL_GET_NEXT_CMD_TYPE, num, NULL, NULL); - } while (num > 0); - if (xpos > 0) - BIO_printf(out, "\n"); - ret = 1; - err: - sk_OPENSSL_STRING_free(cmds); - OPENSSL_free(name); - OPENSSL_free(desc); - return ret; -} - -static void util_do_cmds(ENGINE *e, STACK_OF(OPENSSL_STRING) *cmds, - BIO *out, const char *indent) -{ - int loop, res, num = sk_OPENSSL_STRING_num(cmds); - - if (num < 0) { - BIO_printf(out, "[Error]: internal stack error\n"); - return; - } - for (loop = 0; loop < num; loop++) { - char buf[256]; - const char *cmd, *arg; - cmd = sk_OPENSSL_STRING_value(cmds, loop); - res = 1; /* assume success */ - /* Check if this command has no ":arg" */ - if ((arg = strchr(cmd, ':')) == NULL) { - if (!ENGINE_ctrl_cmd_string(e, cmd, NULL, 0)) - res = 0; - } else { - if ((int)(arg - cmd) > 254) { - BIO_printf(out, "[Error]: command name too long\n"); - return; - } - memcpy(buf, cmd, (int)(arg - cmd)); - buf[arg - cmd] = '\0'; - arg++; /* Move past the ":" */ - /* Call the command with the argument */ - if (!ENGINE_ctrl_cmd_string(e, buf, arg, 0)) - res = 0; - } - if (res) { - BIO_printf(out, "[Success]: %s\n", cmd); - } else { - BIO_printf(out, "[Failure]: %s\n", cmd); - ERR_print_errors(out); - } - } -} - -struct util_store_cap_data { - ENGINE *engine; - char **cap_buf; - int *cap_size; - int ok; -}; -static void util_store_cap(const OSSL_STORE_LOADER *loader, void *arg) -{ - struct util_store_cap_data *ctx = arg; - - if (OSSL_STORE_LOADER_get0_engine(loader) == ctx->engine) { - char buf[256]; - BIO_snprintf(buf, sizeof(buf), "STORE(%s)", - OSSL_STORE_LOADER_get0_scheme(loader)); - if (!append_buf(ctx->cap_buf, ctx->cap_size, buf)) - ctx->ok = 0; - } -} - -int engine_main(int argc, char **argv) -{ - int ret = 1, i; - int verbose = 0, list_cap = 0, test_avail = 0, test_avail_noise = 0; - ENGINE *e; - STACK_OF(OPENSSL_CSTRING) *engines = sk_OPENSSL_CSTRING_new_null(); - STACK_OF(OPENSSL_STRING) *pre_cmds = sk_OPENSSL_STRING_new_null(); - STACK_OF(OPENSSL_STRING) *post_cmds = sk_OPENSSL_STRING_new_null(); - BIO *out; - const char *indent = " "; - OPTION_CHOICE o; - char *prog; - char *argv1; - - out = dup_bio_out(FORMAT_TEXT); - if (engines == NULL || pre_cmds == NULL || post_cmds == NULL) - goto end; - - /* Remember the original command name, parse/skip any leading engine - * names, and then setup to parse the rest of the line as flags. */ - prog = argv[0]; - while ((argv1 = argv[1]) != NULL && *argv1 != '-') { - if (!sk_OPENSSL_CSTRING_push(engines, argv1)) - goto end; - argc--; - argv++; - } - argv[0] = prog; - opt_init(argc, argv, engine_options); - - while ((o = opt_next()) != OPT_EOF) { - switch (o) { - case OPT_EOF: - case OPT_ERR: - BIO_printf(bio_err, "%s: Use -help for summary.\n", prog); - goto end; - case OPT_HELP: - opt_help(engine_options); - ret = 0; - goto end; - case OPT_VVVV: - case OPT_VVV: - case OPT_VV: - case OPT_V: - /* Convert to an integer from one to four. */ - i = (int)(o - OPT_V) + 1; - if (verbose < i) - verbose = i; - break; - case OPT_C: - list_cap = 1; - break; - case OPT_TT: - test_avail_noise++; - /* fall through */ - case OPT_T: - test_avail++; - break; - case OPT_PRE: - if (sk_OPENSSL_STRING_push(pre_cmds, opt_arg()) <= 0) - goto end; - break; - case OPT_POST: - if (sk_OPENSSL_STRING_push(post_cmds, opt_arg()) <= 0) - goto end; - break; - } - } - - /* Any remaining arguments are engine names. */ - argc = opt_num_rest(); - argv = opt_rest(); - for ( ; *argv; argv++) { - if (**argv == '-') { - BIO_printf(bio_err, "%s: Cannot mix flags and engine names.\n", - prog); - BIO_printf(bio_err, "%s: Use -help for summary.\n", prog); - goto end; - } - if (!sk_OPENSSL_CSTRING_push(engines, *argv)) - goto end; - } - - if (sk_OPENSSL_CSTRING_num(engines) == 0) { - for (e = ENGINE_get_first(); e != NULL; e = ENGINE_get_next(e)) { - if (!sk_OPENSSL_CSTRING_push(engines, ENGINE_get_id(e))) - goto end; - } - } - - ret = 0; - for (i = 0; i < sk_OPENSSL_CSTRING_num(engines); i++) { - const char *id = sk_OPENSSL_CSTRING_value(engines, i); - if ((e = ENGINE_by_id(id)) != NULL) { - const char *name = ENGINE_get_name(e); - /* - * Do "id" first, then "name". Easier to auto-parse. - */ - BIO_printf(out, "(%s) %s\n", id, name); - util_do_cmds(e, pre_cmds, out, indent); - if (strcmp(ENGINE_get_id(e), id) != 0) { - BIO_printf(out, "Loaded: (%s) %s\n", - ENGINE_get_id(e), ENGINE_get_name(e)); - } - if (list_cap) { - int cap_size = 256; - char *cap_buf = NULL; - int k, n; - const int *nids; - ENGINE_CIPHERS_PTR fn_c; - ENGINE_DIGESTS_PTR fn_d; - ENGINE_PKEY_METHS_PTR fn_pk; - - if (ENGINE_get_RSA(e) != NULL - && !append_buf(&cap_buf, &cap_size, "RSA")) - goto end; - if (ENGINE_get_EC(e) != NULL - && !append_buf(&cap_buf, &cap_size, "EC")) - goto end; - if (ENGINE_get_DSA(e) != NULL - && !append_buf(&cap_buf, &cap_size, "DSA")) - goto end; - if (ENGINE_get_DH(e) != NULL - && !append_buf(&cap_buf, &cap_size, "DH")) - goto end; - if (ENGINE_get_RAND(e) != NULL - && !append_buf(&cap_buf, &cap_size, "RAND")) - goto end; - - fn_c = ENGINE_get_ciphers(e); - if (fn_c == NULL) - goto skip_ciphers; - n = fn_c(e, NULL, &nids, 0); - for (k = 0; k < n; ++k) - if (!append_buf(&cap_buf, &cap_size, OBJ_nid2sn(nids[k]))) - goto end; - - skip_ciphers: - fn_d = ENGINE_get_digests(e); - if (fn_d == NULL) - goto skip_digests; - n = fn_d(e, NULL, &nids, 0); - for (k = 0; k < n; ++k) - if (!append_buf(&cap_buf, &cap_size, OBJ_nid2sn(nids[k]))) - goto end; - - skip_digests: - fn_pk = ENGINE_get_pkey_meths(e); - if (fn_pk == NULL) - goto skip_pmeths; - n = fn_pk(e, NULL, &nids, 0); - for (k = 0; k < n; ++k) - if (!append_buf(&cap_buf, &cap_size, OBJ_nid2sn(nids[k]))) - goto end; - skip_pmeths: - { - struct util_store_cap_data store_ctx; - - store_ctx.engine = e; - store_ctx.cap_buf = &cap_buf; - store_ctx.cap_size = &cap_size; - store_ctx.ok = 1; - - OSSL_STORE_do_all_loaders(util_store_cap, &store_ctx); - if (!store_ctx.ok) - goto end; - } - if (cap_buf != NULL && (*cap_buf != '\0')) - BIO_printf(out, " [%s]\n", cap_buf); - - OPENSSL_free(cap_buf); - } - if (test_avail) { - BIO_printf(out, "%s", indent); - if (ENGINE_init(e)) { - BIO_printf(out, "[ available ]\n"); - util_do_cmds(e, post_cmds, out, indent); - ENGINE_finish(e); - } else { - BIO_printf(out, "[ unavailable ]\n"); - if (test_avail_noise) - ERR_print_errors_fp(stdout); - ERR_clear_error(); - } - } - if ((verbose > 0) && !util_verbose(e, verbose, out, indent)) - goto end; - ENGINE_free(e); - } else { - ERR_print_errors(bio_err); - /* because exit codes above 127 have special meaning on Unix */ - if (++ret > 127) - ret = 127; - } - } - - end: - - ERR_print_errors(bio_err); - sk_OPENSSL_CSTRING_free(engines); - sk_OPENSSL_STRING_free(pre_cmds); - sk_OPENSSL_STRING_free(post_cmds); - BIO_free_all(out); - return ret; -} diff --git a/apps/gendsa.c b/apps/gendsa.c index a655c6ea02..fd9de9ecb6 100644 --- a/apps/gendsa.c +++ b/apps/gendsa.c @@ -24,7 +24,7 @@ typedef enum OPTION_choice { OPT_COMMON, - OPT_OUT, OPT_PASSOUT, OPT_ENGINE, OPT_CIPHER, OPT_VERBOSE, OPT_QUIET, + OPT_OUT, OPT_PASSOUT, OPT_CIPHER, OPT_VERBOSE, OPT_QUIET, OPT_R_ENUM, OPT_PROV_ENUM } OPTION_CHOICE; @@ -33,9 +33,6 @@ const OPTIONS gendsa_options[] = { OPT_SECTION("General"), {"help", OPT_HELP, '-', "Display this summary"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, -#endif OPT_SECTION("Output"), {"out", OPT_OUT, '>', "Output the key to the specified file"}, @@ -53,7 +50,6 @@ const OPTIONS gendsa_options[] = { int gendsa_main(int argc, char **argv) { - ENGINE *e = NULL; BIO *out = NULL, *in = NULL; EVP_PKEY *pkey = NULL; EVP_PKEY_CTX *ctx = NULL; @@ -82,9 +78,6 @@ int gendsa_main(int argc, char **argv) case OPT_PASSOUT: passoutarg = opt_arg(); break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; case OPT_R_CASES: if (!opt_rand(o)) goto end; @@ -166,7 +159,6 @@ int gendsa_main(int argc, char **argv) EVP_PKEY_free(pkey); EVP_PKEY_CTX_free(ctx); EVP_CIPHER_free(enc); - release_engine(e); OPENSSL_free(passout); return ret; } diff --git a/apps/genpkey.c b/apps/genpkey.c index 2dcca2ee88..f39388b1f8 100644 --- a/apps/genpkey.c +++ b/apps/genpkey.c @@ -17,11 +17,11 @@ static int verbose = 0; -static int init_keygen_file(EVP_PKEY_CTX **pctx, const char *file, ENGINE *e, +static int init_keygen_file(EVP_PKEY_CTX **pctx, const char *file, OSSL_LIB_CTX *libctx, const char *propq); typedef enum OPTION_choice { OPT_COMMON, - OPT_ENGINE, OPT_OUTFORM, OPT_OUT, OPT_PASS, OPT_PARAMFILE, + OPT_OUTFORM, OPT_OUT, OPT_PASS, OPT_PARAMFILE, OPT_ALGORITHM, OPT_PKEYOPT, OPT_GENPARAM, OPT_TEXT, OPT_CIPHER, OPT_VERBOSE, OPT_QUIET, OPT_CONFIG, OPT_OUTPUBKEY, OPT_PROV_ENUM, OPT_R_ENUM @@ -30,9 +30,6 @@ typedef enum OPTION_choice { const OPTIONS genpkey_options[] = { OPT_SECTION("General"), {"help", OPT_HELP, '-', "Display this summary"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, -#endif {"paramfile", OPT_PARAMFILE, '<', "Parameters file"}, {"algorithm", OPT_ALGORITHM, 's', "The public key algorithm"}, {"verbose", OPT_VERBOSE, '-', "Output status while generating keys"}, @@ -107,7 +104,6 @@ int genpkey_main(int argc, char **argv) { CONF *conf = NULL; BIO *mem_out = NULL, *mem_outpubkey = NULL; - ENGINE *e = NULL; EVP_PKEY *pkey = NULL; EVP_PKEY_CTX *ctx = NULL; char *outfile = NULL, *passarg = NULL, *pass = NULL, *prog, *p; @@ -150,9 +146,6 @@ int genpkey_main(int argc, char **argv) case OPT_PASS: passarg = opt_arg(); break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; case OPT_PARAMFILE: if (do_param == 1) goto opthelp; @@ -205,11 +198,11 @@ int genpkey_main(int argc, char **argv) /* Fetch cipher, etc. */ if (paramfile != NULL) { - if (!init_keygen_file(&ctx, paramfile, e, libctx, app_get0_propq())) + if (!init_keygen_file(&ctx, paramfile, libctx, app_get0_propq())) goto end; } if (algname != NULL) { - if (!init_gen_str(&ctx, algname, e, do_param, libctx, app_get0_propq())) + if (!init_gen_str(&ctx, algname, do_param, libctx, app_get0_propq())) goto end; } if (ctx == NULL) @@ -317,13 +310,12 @@ int genpkey_main(int argc, char **argv) EVP_CIPHER_free(cipher); BIO_free_all(mem_out); BIO_free_all(mem_outpubkey); - release_engine(e); OPENSSL_free(pass); NCONF_free(conf); return ret; } -static int init_keygen_file(EVP_PKEY_CTX **pctx, const char *file, ENGINE *e, +static int init_keygen_file(EVP_PKEY_CTX **pctx, const char *file, OSSL_LIB_CTX *libctx, const char *propq) { BIO *pbio; @@ -348,10 +340,7 @@ static int init_keygen_file(EVP_PKEY_CTX **pctx, const char *file, ENGINE *e, return 0; } - if (e != NULL) - ctx = EVP_PKEY_CTX_new(pkey, e); - else - ctx = EVP_PKEY_CTX_new_from_pkey(libctx, pkey, propq); + ctx = EVP_PKEY_CTX_new_from_pkey(libctx, pkey, propq); if (ctx == NULL) goto err; if (EVP_PKEY_keygen_init(ctx) <= 0) @@ -370,26 +359,17 @@ static int init_keygen_file(EVP_PKEY_CTX **pctx, const char *file, ENGINE *e, } int init_gen_str(EVP_PKEY_CTX **pctx, - const char *algname, ENGINE *e, int do_param, + const char *algname, int do_param, OSSL_LIB_CTX *libctx, const char *propq) { EVP_PKEY_CTX *ctx = NULL; -#ifndef OPENSSL_NO_DEPRECATED_3_6 - int pkey_id; -#endif if (*pctx) { BIO_puts(bio_err, "Algorithm already set!\n"); return 0; } -#ifndef OPENSSL_NO_DEPRECATED_3_6 - pkey_id = get_legacy_pkey_id(libctx, algname, e); - if (pkey_id != NID_undef) - ctx = EVP_PKEY_CTX_new_id(pkey_id, e); - else -#endif - ctx = EVP_PKEY_CTX_new_from_name(libctx, algname, propq); + ctx = EVP_PKEY_CTX_new_from_name(libctx, algname, propq); if (ctx == NULL) goto err; diff --git a/apps/genrsa.c b/apps/genrsa.c index 54d025e24c..5b022fd3a2 100644 --- a/apps/genrsa.c +++ b/apps/genrsa.c @@ -34,7 +34,7 @@ typedef enum OPTION_choice { #ifndef OPENSSL_NO_DEPRECATED_3_0 OPT_3, #endif - OPT_F4, OPT_ENGINE, + OPT_F4, OPT_OUT, OPT_PASSOUT, OPT_CIPHER, OPT_PRIMES, OPT_VERBOSE, OPT_QUIET, OPT_R_ENUM, OPT_PROV_ENUM, OPT_TRADITIONAL } OPTION_CHOICE; @@ -44,9 +44,6 @@ const OPTIONS genrsa_options[] = { OPT_SECTION("General"), {"help", OPT_HELP, '-', "Display this summary"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, -#endif OPT_SECTION("Input"), #ifndef OPENSSL_NO_DEPRECATED_3_0 @@ -76,7 +73,6 @@ const OPTIONS genrsa_options[] = { int genrsa_main(int argc, char **argv) { BN_GENCB *cb = BN_GENCB_new(); - ENGINE *eng = NULL; BIGNUM *bn = BN_new(); BIO *out = NULL; EVP_PKEY *pkey = NULL; @@ -116,9 +112,6 @@ opthelp: case OPT_OUT: outfile = opt_arg(); break; - case OPT_ENGINE: - eng = setup_engine(opt_arg(), 0); - break; case OPT_R_CASES: if (!opt_rand(o)) goto end; @@ -179,7 +172,7 @@ opthelp: if (out == NULL) goto end; - if (!init_gen_str(&ctx, "RSA", eng, 0, app_get0_libctx(), + if (!init_gen_str(&ctx, "RSA", 0, app_get0_libctx(), app_get0_propq())) goto end; @@ -242,7 +235,6 @@ opthelp: EVP_PKEY_free(pkey); EVP_CIPHER_free(enc); BIO_free_all(out); - release_engine(eng); OPENSSL_free(passout); if (ret != 0) ERR_print_errors(bio_err); diff --git a/apps/include/apps.h b/apps/include/apps.h index 58e9210236..db4df40382 100644 --- a/apps/include/apps.h +++ b/apps/include/apps.h @@ -27,7 +27,6 @@ # include # include # include -# include # include # include # include @@ -35,7 +34,6 @@ # include "opt.h" # include "fmt.h" # include "platform.h" -# include "engine_loader.h" # include "app_libctx.h" /* @@ -129,10 +127,10 @@ X509_CRL *load_crl(const char *uri, int format, int maybe_stdin, void cleanse(char *str); void clear_free(char *str); EVP_PKEY *load_key(const char *uri, int format, int maybe_stdin, - const char *pass, ENGINE *e, const char *desc); + const char *pass, const char *desc); /* first try reading public key, on failure resort to loading private key */ EVP_PKEY *load_pubkey(const char *uri, int format, int maybe_stdin, - const char *pass, ENGINE *e, const char *desc); + const char *pass, const char *desc); EVP_PKEY *load_keyparams(const char *uri, int format, int maybe_stdin, const char *keytype, const char *desc); EVP_PKEY *load_keyparams_suppress(const char *uri, int format, int maybe_stdin, @@ -178,19 +176,6 @@ __owur int ctx_set_ctlog_list_file(SSL_CTX *ctx, const char *path); # endif -ENGINE *setup_engine_methods(const char *id, unsigned int methods, int debug); -# define setup_engine(e, debug) setup_engine_methods(e, (unsigned int)-1, debug) -void release_engine(ENGINE *e); -int init_engine(ENGINE *e); -int finish_engine(ENGINE *e); -char *make_engine_uri(ENGINE *e, const char *key_id, const char *desc); - -# ifndef OPENSSL_NO_DEPRECATED_3_6 -int get_legacy_pkey_id(OSSL_LIB_CTX *libctx, const char *algname, ENGINE *e); -# endif -const EVP_MD *get_digest_from_engine(const char *name); -const EVP_CIPHER *get_cipher_from_engine(const char *name); - # ifndef OPENSSL_NO_OCSP OCSP_RESPONSE *process_responder(OCSP_REQUEST *req, const char *host, const char *port, const char *path, @@ -281,7 +266,7 @@ int pkey_ctrl_string(EVP_PKEY_CTX *ctx, const char *value); int x509_ctrl_string(X509 *x, const char *value); int x509_req_ctrl_string(X509_REQ *x, const char *value); int init_gen_str(EVP_PKEY_CTX **pctx, - const char *algname, ENGINE *e, int do_param, + const char *algname, int do_param, OSSL_LIB_CTX *libctx, const char *propq); int cert_matches_key(const X509 *cert, const EVP_PKEY *pkey); int do_X509_sign(X509 *x, int force_v1, EVP_PKEY *pkey, const char *md, diff --git a/apps/include/engine_loader.h b/apps/include/engine_loader.h deleted file mode 100644 index 30fdb9e551..0000000000 --- a/apps/include/engine_loader.h +++ /dev/null @@ -1,21 +0,0 @@ -/* - * Copyright 2018-2022 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ -#ifndef HEADER_ENGINE_LOADER_H -# define HEADER_ENGINE_LOADER_H - -# include - -/* this is a private URI scheme */ -# define ENGINE_SCHEME "org.openssl.engine" -# define ENGINE_SCHEME_COLON ENGINE_SCHEME ":" - -int setup_engine_loader(void); -void destroy_engine_loader(void); - -#endif diff --git a/apps/include/fmt.h b/apps/include/fmt.h index 98dfed7dc0..17b891cfa2 100644 --- a/apps/include/fmt.h +++ b/apps/include/fmt.h @@ -32,7 +32,6 @@ # define FORMAT_PEM (5 | B_FORMAT_TEXT) # define FORMAT_PKCS12 6 # define FORMAT_SMIME (7 | B_FORMAT_TEXT) -# define FORMAT_ENGINE 8 /* Not really a file format */ # define FORMAT_PEMRSA (9 | B_FORMAT_TEXT) /* PEM RSAPublicKey format */ # define FORMAT_ASN1RSA 10 /* DER RSAPublicKey format */ # define FORMAT_MSBLOB 11 /* MS Key blob format */ diff --git a/apps/include/opt.h b/apps/include/opt.h index d8d7518280..d4fd4f115f 100644 --- a/apps/include/opt.h +++ b/apps/include/opt.h @@ -343,7 +343,6 @@ typedef struct options_st { * 'f' any format [OPT_FMT_ANY] * 'F' der/pem format [OPT_FMT_PEMDER] * 'A' any ASN1, der/pem/b64 format [OPT_FMT_ASN1] - * 'E' der/pem/engine format [OPT_FMT_PDE] * 'c' pem/der/smime format [OPT_FMT_PDS] * * The 'l', 'n' and 'u' value types include the values zero, @@ -372,7 +371,6 @@ typedef struct string_int_pair_st { # define OPT_FMT_B64 (1L << 3) # define OPT_FMT_PKCS12 (1L << 4) # define OPT_FMT_SMIME (1L << 5) -# define OPT_FMT_ENGINE (1L << 6) # define OPT_FMT_MSBLOB (1L << 7) # define OPT_FMT_NSS (1L << 8) # define OPT_FMT_TEXT (1L << 9) @@ -381,13 +379,11 @@ typedef struct string_int_pair_st { # define OPT_FMT_PEMDER (OPT_FMT_PEM | OPT_FMT_DER) # define OPT_FMT_ASN1 (OPT_FMT_PEM | OPT_FMT_DER | OPT_FMT_B64) -# define OPT_FMT_PDE (OPT_FMT_PEMDER | OPT_FMT_ENGINE) # define OPT_FMT_PDS (OPT_FMT_PEMDER | OPT_FMT_SMIME) -# define OPT_FMT_ANY ( \ - OPT_FMT_PEM | OPT_FMT_DER | OPT_FMT_B64 | \ - OPT_FMT_PKCS12 | OPT_FMT_SMIME | \ - OPT_FMT_ENGINE | OPT_FMT_MSBLOB | OPT_FMT_NSS | \ - OPT_FMT_TEXT | OPT_FMT_HTTP | OPT_FMT_PVK) +# define OPT_FMT_ANY (OPT_FMT_PEM | OPT_FMT_DER | OPT_FMT_B64 | \ + OPT_FMT_PKCS12 | OPT_FMT_SMIME | \ + OPT_FMT_MSBLOB | OPT_FMT_NSS | \ + OPT_FMT_TEXT | OPT_FMT_HTTP | OPT_FMT_PVK) /* Divide options into sections when displaying usage */ #define OPT_SECTION(sec) { OPT_SECTION_STR, 1, '-', sec " options:\n" } @@ -437,8 +433,5 @@ char **opt_rest(void); int opt_num_rest(void); int opt_check_rest_arg(const char *expected); -/* Returns non-zero if legacy paths are still available */ -int opt_legacy_okay(void); - #endif /* OSSL_APPS_OPT_H */ diff --git a/apps/info.c b/apps/info.c index 5a469eed96..b3115d11d9 100644 --- a/apps/info.c +++ b/apps/info.c @@ -13,7 +13,7 @@ typedef enum OPTION_choice { OPT_COMMON, - OPT_CONFIGDIR, OPT_ENGINESDIR, OPT_MODULESDIR, OPT_DSOEXT, OPT_DIRNAMESEP, + OPT_CONFIGDIR, OPT_MODULESDIR, OPT_DSOEXT, OPT_DIRNAMESEP, OPT_LISTSEP, OPT_SEEDS, OPT_CPUSETTINGS, OPT_WINDOWSCONTEXT } OPTION_CHOICE; @@ -24,7 +24,6 @@ const OPTIONS info_options[] = { OPT_SECTION("Output"), {"configdir", OPT_CONFIGDIR, '-', "Default configuration file directory"}, - {"enginesdir", OPT_ENGINESDIR, '-', "Default engine module directory"}, {"modulesdir", OPT_MODULESDIR, '-', "Default module directory (other than engine modules)"}, {"dsoext", OPT_DSOEXT, '-', "Configured extension for modules"}, @@ -58,10 +57,6 @@ opthelp: type = OPENSSL_INFO_CONFIG_DIR; dirty++; break; - case OPT_ENGINESDIR: - type = OPENSSL_INFO_ENGINES_DIR; - dirty++; - break; case OPT_MODULESDIR: type = OPENSSL_INFO_MODULES_DIR; dirty++; diff --git a/apps/lib/apps.c b/apps/lib/apps.c index 8933565de1..765832a0b2 100644 --- a/apps/lib/apps.c +++ b/apps/lib/apps.c @@ -15,12 +15,6 @@ # define _POSIX_C_SOURCE 2 #endif -#ifndef OPENSSL_NO_ENGINE -/* We need to use some deprecated APIs */ -# define OPENSSL_SUPPRESS_DEPRECATED -# include -#endif - #include #include #include @@ -558,41 +552,33 @@ void clear_free(char *str) } EVP_PKEY *load_key(const char *uri, int format, int may_stdin, - const char *pass, ENGINE *e, const char *desc) + const char *pass, const char *desc) { EVP_PKEY *pkey = NULL; - char *allocated_uri = NULL; if (desc == NULL) desc = "private key"; - if (format == FORMAT_ENGINE) - uri = allocated_uri = make_engine_uri(e, uri, desc); (void)load_key_certs_crls(uri, format, may_stdin, pass, desc, 0, &pkey, NULL, NULL, NULL, NULL, NULL, NULL); - OPENSSL_free(allocated_uri); return pkey; } /* first try reading public key, on failure resort to loading private key */ EVP_PKEY *load_pubkey(const char *uri, int format, int maybe_stdin, - const char *pass, ENGINE *e, const char *desc) + const char *pass, const char *desc) { EVP_PKEY *pkey = NULL; - char *allocated_uri = NULL; if (desc == NULL) desc = "public key"; - if (format == FORMAT_ENGINE) - uri = allocated_uri = make_engine_uri(e, uri, desc); (void)load_key_certs_crls(uri, format, maybe_stdin, pass, desc, 1, NULL, &pkey, NULL, NULL, NULL, NULL, NULL); if (pkey == NULL) (void)load_key_certs_crls(uri, format, maybe_stdin, pass, desc, 0, &pkey, NULL, NULL, NULL, NULL, NULL, NULL); - OPENSSL_free(allocated_uri); return pkey; } @@ -3509,25 +3495,6 @@ EVP_PKEY *app_paramgen(EVP_PKEY_CTX *ctx, const char *alg) return res; } -/* - * Return non-zero if the legacy path is still an option. - * This decision is based on the global command line operations and the - * behaviour thus far. - */ -int opt_legacy_okay(void) -{ - int provider_options = opt_provider_option_given(); - int libctx = app_get0_libctx() != NULL || app_get0_propq() != NULL; - - /* - * Having a provider option specified or a custom library context or - * property query, is a sure sign we're not using legacy. - */ - if (provider_options || libctx) - return 0; - return 1; -} - #define MAX_KEY_SIZE 2048 /* Hope nobody needs mac key longer than 2048 bytes */ /* diff --git a/apps/lib/build.info b/apps/lib/build.info index f0df608734..a781117264 100644 --- a/apps/lib/build.info +++ b/apps/lib/build.info @@ -10,7 +10,7 @@ ENDIF # Source for libapps $LIBAPPSSRC=apps.c apps_ui.c log.c opt.c fmt.c s_cb.c s_socket.c app_rand.c \ columns.c app_params.c names.c app_provider.c app_x509.c http_server.c \ - engine.c engine_loader.c app_libctx.c apps_opt_printf.c + app_libctx.c apps_opt_printf.c IF[{- !$disabled{apps} -}] LIBS{noinst}=../libapps.a diff --git a/apps/lib/engine.c b/apps/lib/engine.c deleted file mode 100644 index 5d9b408c7b..0000000000 --- a/apps/lib/engine.c +++ /dev/null @@ -1,195 +0,0 @@ -/* - * Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* - * Here is a set of wrappers for the ENGINE API, which are no-ops when the - * ENGINE API is disabled / removed. - * We need to suppress deprecation warnings to make this work. - */ -#define OPENSSL_SUPPRESS_DEPRECATED - -#include /* strcmp */ - -#include /* Ensure we have the ENGINE type, regardless */ -#include -#ifndef OPENSSL_NO_ENGINE -# include -#endif -#include "apps.h" - -#ifndef OPENSSL_NO_ENGINE -/* Try to load an engine in a shareable library */ -static ENGINE *try_load_engine(const char *engine) -{ - ENGINE *e = NULL; - - if ((e = ENGINE_by_id("dynamic")) != NULL) { - if (!ENGINE_ctrl_cmd_string(e, "SO_PATH", engine, 0) - || !ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0)) { - ENGINE_free(e); - e = NULL; - } - } - return e; -} -#endif - -ENGINE *setup_engine_methods(const char *id, unsigned int methods, int debug) -{ - ENGINE *e = NULL; - -#ifndef OPENSSL_NO_ENGINE - if (id != NULL) { - if (strcmp(id, "auto") == 0) { - BIO_printf(bio_err, "Enabling auto ENGINE support\n"); - ENGINE_register_all_complete(); - return NULL; - } - if ((e = ENGINE_by_id(id)) == NULL - && (e = try_load_engine(id)) == NULL) { - BIO_printf(bio_err, "Invalid engine \"%s\"\n", id); - ERR_print_errors(bio_err); - return NULL; - } - if (debug) - (void)ENGINE_ctrl(e, ENGINE_CTRL_SET_LOGSTREAM, 0, bio_err, 0); - if (!ENGINE_ctrl_cmd(e, "SET_USER_INTERFACE", 0, - (void *)get_ui_method(), 0, 1) - || !ENGINE_set_default(e, methods)) { - BIO_printf(bio_err, "Cannot use engine \"%s\"\n", ENGINE_get_id(e)); - ERR_print_errors(bio_err); - ENGINE_free(e); - return NULL; - } - - BIO_printf(bio_err, "Engine \"%s\" set.\n", ENGINE_get_id(e)); - } -#endif - return e; -} - -void release_engine(ENGINE *e) -{ -#ifndef OPENSSL_NO_ENGINE - /* Free our "structural" reference. */ - ENGINE_free(e); -#endif -} - -int init_engine(ENGINE *e) -{ - int rv = 1; - -#ifndef OPENSSL_NO_ENGINE - rv = ENGINE_init(e); -#endif - return rv; -} - -int finish_engine(ENGINE *e) -{ - int rv = 1; - -#ifndef OPENSSL_NO_ENGINE - rv = ENGINE_finish(e); -#endif - return rv; -} - -char *make_engine_uri(ENGINE *e, const char *key_id, const char *desc) -{ - char *new_uri = NULL; - -#ifndef OPENSSL_NO_ENGINE - if (e == NULL) { - BIO_printf(bio_err, "No engine specified for loading %s\n", desc); - } else if (key_id == NULL) { - BIO_printf(bio_err, "No engine key id specified for loading %s\n", desc); - } else { - const char *engineid = ENGINE_get_id(e); - size_t uri_sz = - sizeof(ENGINE_SCHEME_COLON) - 1 - + strlen(engineid) - + 1 /* : */ - + strlen(key_id) - + 1 /* \0 */ - ; - - new_uri = OPENSSL_malloc(uri_sz); - if (new_uri != NULL) { - OPENSSL_strlcpy(new_uri, ENGINE_SCHEME_COLON, uri_sz); - OPENSSL_strlcat(new_uri, engineid, uri_sz); - OPENSSL_strlcat(new_uri, ":", uri_sz); - OPENSSL_strlcat(new_uri, key_id, uri_sz); - } - } -#else - BIO_printf(bio_err, "Engines not supported for loading %s\n", desc); -#endif - return new_uri; -} - -#ifndef OPENSSL_NO_DEPRECATED_3_6 -int get_legacy_pkey_id(OSSL_LIB_CTX *libctx, const char *algname, ENGINE *e) -{ - const EVP_PKEY_ASN1_METHOD *ameth; - ENGINE *tmpeng = NULL; - int pkey_id = NID_undef; - - ERR_set_mark(); - ameth = EVP_PKEY_asn1_find_str(&tmpeng, algname, -1); - -#if !defined(OPENSSL_NO_ENGINE) - ENGINE_finish(tmpeng); - - if (ameth == NULL && e != NULL) - ameth = ENGINE_get_pkey_asn1_meth_str(e, algname, -1); - else -#endif - /* We're only interested if it comes from an ENGINE */ - if (tmpeng == NULL) - ameth = NULL; - - ERR_pop_to_mark(); - if (ameth == NULL) - return NID_undef; - - EVP_PKEY_asn1_get0_info(&pkey_id, NULL, NULL, NULL, NULL, ameth); - - return pkey_id; -} -#endif - -const EVP_MD *get_digest_from_engine(const char *name) -{ -#ifndef OPENSSL_NO_ENGINE - ENGINE *eng; - - eng = ENGINE_get_digest_engine(OBJ_sn2nid(name)); - if (eng != NULL) { - ENGINE_finish(eng); - return EVP_get_digestbyname(name); - } -#endif - return NULL; -} - -const EVP_CIPHER *get_cipher_from_engine(const char *name) -{ -#ifndef OPENSSL_NO_ENGINE - ENGINE *eng; - - eng = ENGINE_get_cipher_engine(OBJ_sn2nid(name)); - if (eng != NULL) { - ENGINE_finish(eng); - return EVP_get_cipherbyname(name); - } -#endif - return NULL; -} diff --git a/apps/lib/engine_loader.c b/apps/lib/engine_loader.c deleted file mode 100644 index e0f26f614a..0000000000 --- a/apps/lib/engine_loader.c +++ /dev/null @@ -1,202 +0,0 @@ -/* - * Copyright 2018-2022 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* - * Here is an STORE loader for ENGINE backed keys. It relies on deprecated - * functions, and therefore need to have deprecation warnings suppressed. - * This file is not compiled at all in a '--api=3 no-deprecated' configuration. - */ -#define OPENSSL_SUPPRESS_DEPRECATED - -#include "internal/e_os.h" -#include "apps.h" - -#ifndef OPENSSL_NO_ENGINE - -# include -# include -# include -# include - -/* - * Support for legacy private engine keys via the 'org.openssl.engine:' scheme - * - * org.openssl.engine:{engineid}:{keyid} - * - * Note: we ONLY support ENGINE_load_private_key() and ENGINE_load_public_key() - * Note 2: This scheme has a precedent in code in PKIX-SSH. for exactly - * this sort of purpose. - */ - -/* Local definition of OSSL_STORE_LOADER_CTX */ -struct ossl_store_loader_ctx_st { - ENGINE *e; /* Structural reference */ - char *keyid; - int expected; - int loaded; /* 0 = key not loaded yet, 1 = key loaded */ -}; - -static OSSL_STORE_LOADER_CTX *OSSL_STORE_LOADER_CTX_new(ENGINE *e, char *keyid) -{ - OSSL_STORE_LOADER_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx)); - - if (ctx != NULL) { - ctx->e = e; - ctx->keyid = keyid; - } - return ctx; -} - -static void OSSL_STORE_LOADER_CTX_free(OSSL_STORE_LOADER_CTX *ctx) -{ - if (ctx != NULL) { - ENGINE_free(ctx->e); - OPENSSL_free(ctx->keyid); - OPENSSL_free(ctx); - } -} - -static OSSL_STORE_LOADER_CTX *engine_open(const OSSL_STORE_LOADER *loader, - const char *uri, - const UI_METHOD *ui_method, - void *ui_data) -{ - const char *p = uri, *q; - ENGINE *e = NULL; - char *keyid = NULL; - OSSL_STORE_LOADER_CTX *ctx = NULL; - - if (!CHECK_AND_SKIP_CASE_PREFIX(p, ENGINE_SCHEME_COLON)) - return NULL; - - /* Look for engine ID */ - q = strchr(p, ':'); - if (q != NULL /* There is both an engine ID and a key ID */ - && p[0] != ':' /* The engine ID is at least one character */ - && q[1] != '\0') { /* The key ID is at least one character */ - char engineid[256]; - size_t engineid_l = q - p; - - strncpy(engineid, p, engineid_l); - engineid[engineid_l] = '\0'; - e = ENGINE_by_id(engineid); - - keyid = OPENSSL_strdup(q + 1); - } - - if (e != NULL && keyid != NULL) - ctx = OSSL_STORE_LOADER_CTX_new(e, keyid); - - if (ctx == NULL) { - OPENSSL_free(keyid); - ENGINE_free(e); - } - - return ctx; -} - -static int engine_expect(OSSL_STORE_LOADER_CTX *ctx, int expected) -{ - if (expected == 0 - || expected == OSSL_STORE_INFO_PUBKEY - || expected == OSSL_STORE_INFO_PKEY) { - ctx->expected = expected; - return 1; - } - return 0; -} - -static OSSL_STORE_INFO *engine_load(OSSL_STORE_LOADER_CTX *ctx, - const UI_METHOD *ui_method, void *ui_data) -{ - EVP_PKEY *pkey = NULL, *pubkey = NULL; - OSSL_STORE_INFO *info = NULL; - - if (ctx->loaded == 0) { - if (ENGINE_init(ctx->e)) { - if (ctx->expected == 0 - || ctx->expected == OSSL_STORE_INFO_PKEY) - pkey = - ENGINE_load_private_key(ctx->e, ctx->keyid, - (UI_METHOD *)ui_method, ui_data); - if ((pkey == NULL && ctx->expected == 0) - || ctx->expected == OSSL_STORE_INFO_PUBKEY) - pubkey = - ENGINE_load_public_key(ctx->e, ctx->keyid, - (UI_METHOD *)ui_method, ui_data); - ENGINE_finish(ctx->e); - } - } - - ctx->loaded = 1; - - if (pubkey != NULL) - info = OSSL_STORE_INFO_new_PUBKEY(pubkey); - else if (pkey != NULL) - info = OSSL_STORE_INFO_new_PKEY(pkey); - if (info == NULL) { - EVP_PKEY_free(pkey); - EVP_PKEY_free(pubkey); - } - return info; -} - -static int engine_eof(OSSL_STORE_LOADER_CTX *ctx) -{ - return ctx->loaded != 0; -} - -static int engine_error(OSSL_STORE_LOADER_CTX *ctx) -{ - return 0; -} - -static int engine_close(OSSL_STORE_LOADER_CTX *ctx) -{ - OSSL_STORE_LOADER_CTX_free(ctx); - return 1; -} - -int setup_engine_loader(void) -{ - OSSL_STORE_LOADER *loader = NULL; - - if ((loader = OSSL_STORE_LOADER_new(NULL, ENGINE_SCHEME)) == NULL - || !OSSL_STORE_LOADER_set_open(loader, engine_open) - || !OSSL_STORE_LOADER_set_expect(loader, engine_expect) - || !OSSL_STORE_LOADER_set_load(loader, engine_load) - || !OSSL_STORE_LOADER_set_eof(loader, engine_eof) - || !OSSL_STORE_LOADER_set_error(loader, engine_error) - || !OSSL_STORE_LOADER_set_close(loader, engine_close) - || !OSSL_STORE_register_loader(loader)) { - OSSL_STORE_LOADER_free(loader); - loader = NULL; - } - - return loader != NULL; -} - -void destroy_engine_loader(void) -{ - OSSL_STORE_LOADER *loader = OSSL_STORE_unregister_loader(ENGINE_SCHEME); - OSSL_STORE_LOADER_free(loader); -} - -#else /* !OPENSSL_NO_ENGINE */ - -int setup_engine_loader(void) -{ - return 0; -} - -void destroy_engine_loader(void) -{ -} - -#endif diff --git a/apps/lib/opt.c b/apps/lib/opt.c index 422a78975e..b978120ff4 100644 --- a/apps/lib/opt.c +++ b/apps/lib/opt.c @@ -192,7 +192,7 @@ char *opt_init(int ac, char **av, const OPTIONS *o) OPENSSL_assert(o->retval == OPT_DUP || o->retval > OPT_PARAM); switch (i) { case 0: case '-': case '.': - case '/': case '<': case '>': case 'E': case 'F': + case '/': case '<': case '>': case 'F': case 'M': case 'U': case 'f': case 'l': case 'n': case 'p': case 's': case 'u': case 'c': case ':': case 'N': case 'A': break; @@ -230,7 +230,6 @@ static OPT_PAIR formats[] = { {"b64", OPT_FMT_B64}, {"pkcs12", OPT_FMT_PKCS12}, {"smime", OPT_FMT_SMIME}, - {"engine", OPT_FMT_ENGINE}, {"msblob", OPT_FMT_MSBLOB}, {"nss", OPT_FMT_NSS}, {"text", OPT_FMT_TEXT}, @@ -309,12 +308,6 @@ int opt_format(const char *s, unsigned long flags, int *result) return opt_format_error(s, flags); *result = FORMAT_MSBLOB; break; - case 'E': - case 'e': - if ((flags & OPT_FMT_ENGINE) == 0) - return opt_format_error(s, flags); - *result = FORMAT_ENGINE; - break; case 'H': case 'h': if ((flags & OPT_FMT_HTTP) == 0) @@ -368,8 +361,6 @@ static const char *format2str(int format) return "SMIME"; case FORMAT_MSBLOB: return "MSBLOB"; - case FORMAT_ENGINE: - return "ENGINE"; case FORMAT_HTTP: return "HTTP"; case FORMAT_PKCS12: @@ -395,9 +386,7 @@ int opt_cipher_silent(const char *name, EVP_CIPHER **cipherp) ERR_set_mark(); if ((c = EVP_CIPHER_fetch(app_get0_libctx(), name, - app_get0_propq())) != NULL - || (opt_legacy_okay() - && (c = (EVP_CIPHER *)EVP_get_cipherbyname(name)) != NULL)) { + app_get0_propq())) != NULL) { ERR_pop_to_mark(); if (cipherp != NULL) { EVP_CIPHER_free(*cipherp); @@ -456,9 +445,7 @@ int opt_md_silent(const char *name, EVP_MD **mdp) EVP_MD *md; ERR_set_mark(); - if ((md = EVP_MD_fetch(app_get0_libctx(), name, app_get0_propq())) != NULL - || (opt_legacy_okay() - && (md = (EVP_MD *)EVP_get_digestbyname(name)) != NULL)) { + if ((md = EVP_MD_fetch(app_get0_libctx(), name, app_get0_propq())) != NULL) { ERR_pop_to_mark(); if (mdp != NULL) { EVP_MD_free(*mdp); @@ -990,14 +977,12 @@ int opt_next(void) return -1; break; case 'c': - case 'E': case 'F': case 'f': case 'A': case 'a': if (opt_format(arg, o->valtype == 'c' ? OPT_FMT_PDS : - o->valtype == 'E' ? OPT_FMT_PDE : o->valtype == 'F' ? OPT_FMT_PEMDER : o->valtype == 'A' ? OPT_FMT_ASN1 : OPT_FMT_ANY, &ival)) @@ -1114,8 +1099,6 @@ static const char *valtype2param(const OPTIONS *o) return "long"; case 'u': return "ulong"; - case 'E': - return "PEM|DER|ENGINE"; case 'F': return "PEM|DER"; case 'f': diff --git a/apps/lib/s_cb.c b/apps/lib/s_cb.c index b567b179b6..c4fa5d9d8a 100644 --- a/apps/lib/s_cb.c +++ b/apps/lib/s_cb.c @@ -1126,10 +1126,10 @@ int load_excert(SSL_EXCERT **pexc) return 0; if (exc->keyfile != NULL) { exc->key = load_key(exc->keyfile, exc->keyform, - 0, NULL, NULL, "server key"); + 0, NULL, "server key"); } else { exc->key = load_key(exc->certfile, exc->certform, - 0, NULL, NULL, "server key"); + 0, NULL, "server key"); } if (exc->key == NULL) return 0; diff --git a/apps/list.c b/apps/list.c index 2aeedbbda8..9e3e65e77d 100644 --- a/apps/list.c +++ b/apps/list.c @@ -1181,7 +1181,7 @@ static int is_md_available(const char *name) return 1; } - return propq != NULL || get_digest_from_engine(name) == NULL ? 0 : 1; + return 0; } static int is_cipher_available(const char *name) @@ -1198,7 +1198,7 @@ static int is_cipher_available(const char *name) return 1; } - return propq != NULL || get_cipher_from_engine(name) == NULL ? 0 : 1; + return 0; } static void list_type(FUNC_TYPE ft, int one) @@ -1443,24 +1443,6 @@ static void list_provider_info(void) sk_OSSL_PROVIDER_free(providers); } -#ifndef OPENSSL_NO_DEPRECATED_3_0 -static void list_engines(void) -{ -# ifndef OPENSSL_NO_ENGINE - ENGINE *e; - - BIO_puts(bio_out, "Engines:\n"); - e = ENGINE_get_first(); - while (e) { - BIO_printf(bio_out, "%s\n", ENGINE_get_id(e)); - e = ENGINE_get_next(e); - } -# else - BIO_puts(bio_out, "Engine support is disabled.\n"); -# endif -} -#endif - static void list_disabled(void) { BIO_puts(bio_out, "Disabled algorithms:\n"); @@ -1521,9 +1503,6 @@ static void list_disabled(void) #ifdef OPENSSL_NO_EC2M BIO_puts(bio_out, "EC2M\n"); #endif -#if defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0) - BIO_puts(bio_out, "ENGINE\n"); -#endif #ifdef OPENSSL_NO_GOST BIO_puts(bio_out, "GOST\n"); #endif @@ -1639,9 +1618,6 @@ typedef enum HELPLIST_CHOICE { # if !defined(OPENSSL_NO_TLS1_3) OPT_TLS1_3, # endif -#endif -#ifndef OPENSSL_NO_DEPRECATED_3_0 - OPT_ENGINES, #endif OPT_PROV_ENUM } HELPLIST_CHOICE; @@ -1714,10 +1690,6 @@ const OPTIONS list_options[] = { #endif {"providers", OPT_PROVIDER_INFO, '-', "List of provider information"}, -#ifndef OPENSSL_NO_DEPRECATED_3_0 - {"engines", OPT_ENGINES, '-', - "List of loaded engines"}, -#endif {"disabled", OPT_DISABLED, '-', "List of disabled features"}, {"options", OPT_OPTIONS, 's', "List options for specified command"}, @@ -1767,9 +1739,6 @@ int list_main(int argc, char **argv) unsigned int pk_method:1; unsigned int store_loaders:1; unsigned int provider_info:1; -#ifndef OPENSSL_NO_DEPRECATED_3_0 - unsigned int engines:1; -#endif unsigned int disabled:1; unsigned int objects:1; unsigned int options:1; @@ -1879,11 +1848,6 @@ opthelp: case OPT_PROVIDER_INFO: todo.provider_info = 1; break; -#ifndef OPENSSL_NO_DEPRECATED_3_0 - case OPT_ENGINES: - todo.engines = 1; - break; -#endif case OPT_DISABLED: todo.disabled = 1; break; @@ -1997,10 +1961,6 @@ opthelp: MAYBE_ADD_NL(list_store_loaders()); if (todo.provider_info) MAYBE_ADD_NL(list_provider_info()); -#ifndef OPENSSL_NO_DEPRECATED_3_0 - if (todo.engines) - MAYBE_ADD_NL(list_engines()); -#endif if (todo.disabled) MAYBE_ADD_NL(list_disabled()); if (todo.objects) diff --git a/apps/ocsp.c b/apps/ocsp.c index 4769880fc6..e187582152 100644 --- a/apps/ocsp.c +++ b/apps/ocsp.c @@ -598,7 +598,7 @@ int ocsp_main(int argc, char **argv) BIO_printf(bio_err, "Error getting password\n"); goto end; } - rkey = load_key(rkeyfile, FORMAT_UNDEF, 0, passin, NULL, + rkey = load_key(rkeyfile, FORMAT_UNDEF, 0, passin, "responder private key"); if (rkey == NULL) goto end; @@ -694,7 +694,7 @@ redo_accept: "signer certificates")) goto end; } - key = load_key(keyfile, FORMAT_UNDEF, 0, NULL, NULL, + key = load_key(keyfile, FORMAT_UNDEF, 0, NULL, "signer private key"); if (key == NULL) goto end; diff --git a/apps/openssl-vms.cnf b/apps/openssl-vms.cnf index 768291e4ee..9c02c1c7ec 100644 --- a/apps/openssl-vms.cnf +++ b/apps/openssl-vms.cnf @@ -311,7 +311,6 @@ default_tsa = tsa_config1 # the default TSA section # These are used by the TSA reply generation only. dir = sys\$disk:[.demoCA # TSA root directory serial = $dir]tsaserial. # The current serial number (mandatory) -crypto_device = builtin # OpenSSL engine to use for signing signer_cert = $dir/tsacert.pem # The TSA signing certificate # (optional) certs = $dir.cacert.pem] # Certificate chain to include in reply diff --git a/apps/openssl.c b/apps/openssl.c index cc9932ca43..b7f2f9982a 100644 --- a/apps/openssl.c +++ b/apps/openssl.c @@ -20,9 +20,6 @@ #include #include #include -#ifndef OPENSSL_NO_ENGINE -# include -#endif #include /* Needed to get the other O_xxx flags. */ #ifdef OPENSSL_SYS_VMS @@ -65,12 +62,10 @@ static int apps_startup(void) #endif /* Set non-default library initialisation settings */ - if (!OPENSSL_init_ssl(OPENSSL_INIT_ENGINE_ALL_BUILTIN - | OPENSSL_INIT_LOAD_CONFIG, NULL)) + if (!OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, NULL)) return 0; (void)setup_ui_method(); - (void)setup_engine_loader(); /* * NOTE: This is an undocumented feature required for testing only. @@ -92,7 +87,6 @@ static void apps_shutdown(void) { app_providers_cleanup(); OSSL_LIB_CTX_free(app_get0_libctx()); - destroy_engine_loader(); destroy_ui_method(); } diff --git a/apps/openssl.cnf b/apps/openssl.cnf index abace0ea7f..4db6a549b1 100644 --- a/apps/openssl.cnf +++ b/apps/openssl.cnf @@ -311,7 +311,6 @@ default_tsa = tsa_config1 # the default TSA section # These are used by the TSA reply generation only. dir = ./demoCA # TSA root directory serial = $dir/tsaserial # The current serial number (mandatory) -crypto_device = builtin # OpenSSL engine to use for signing signer_cert = $dir/tsacert.pem # The TSA signing certificate # (optional) certs = $dir/cacert.pem # Certificate chain to include in reply diff --git a/apps/pkcs12.c b/apps/pkcs12.c index 9964faf21a..7620edd69a 100644 --- a/apps/pkcs12.c +++ b/apps/pkcs12.c @@ -69,7 +69,7 @@ typedef enum OPTION_choice { OPT_INKEY, OPT_CERTFILE, OPT_UNTRUSTED, OPT_PASSCERTS, OPT_NAME, OPT_CSP, OPT_CANAME, OPT_IN, OPT_OUT, OPT_PASSIN, OPT_PASSOUT, OPT_PASSWORD, OPT_CAPATH, - OPT_CAFILE, OPT_CASTORE, OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE, OPT_ENGINE, + OPT_CAFILE, OPT_CASTORE, OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE, OPT_R_ENUM, OPT_PROV_ENUM, OPT_JDKTRUST, OPT_PBMAC1_PBKDF2, OPT_PBMAC1_PBKDF2_MD, #ifndef OPENSSL_NO_DES OPT_LEGACY_ALG @@ -96,9 +96,6 @@ const OPTIONS pkcs12_options[] = { "Use legacy encryption: 3DES_CBC for keys, RC2_CBC for certs" # endif }, -#endif -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, #endif OPT_PROV_OPTIONS, OPT_R_OPTIONS, @@ -183,7 +180,6 @@ int pkcs12_main(int argc, char **argv) char *cpass = NULL, *mpass = NULL, *badpass = NULL; const char *CApath = NULL, *CAfile = NULL, *CAstore = NULL, *prog; int noCApath = 0, noCAfile = 0, noCAstore = 0; - ENGINE *e = NULL; BIO *in = NULL, *out = NULL; PKCS12 *p12 = NULL; STACK_OF(OPENSSL_STRING) *canames = NULL; @@ -364,9 +360,6 @@ int pkcs12_main(int argc, char **argv) case OPT_NOCAFILE: noCAfile = 1; break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; #ifndef OPENSSL_NO_DES case OPT_LEGACY_ALG: use_legacy = 1; @@ -557,7 +550,7 @@ int pkcs12_main(int argc, char **argv) if (!(options & NOKEYS)) { key = load_key(keyname ? keyname : infile, - FORMAT_PEM, 1, passin, e, + FORMAT_PEM, 1, passin, keyname ? "private key from -inkey file" : "private key from -in file"); @@ -904,7 +897,6 @@ int pkcs12_main(int argc, char **argv) ret = 0; end: PKCS12_free(p12); - release_engine(e); BIO_free(in); BIO_free_all(out); sk_OPENSSL_STRING_free(canames); diff --git a/apps/pkcs7.c b/apps/pkcs7.c index 57cb517b17..90659334b8 100644 --- a/apps/pkcs7.c +++ b/apps/pkcs7.c @@ -24,15 +24,12 @@ typedef enum OPTION_choice { OPT_COMMON, OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_NOOUT, OPT_TEXT, OPT_PRINT, OPT_PRINT_CERTS, OPT_QUIET, - OPT_ENGINE, OPT_PROV_ENUM + OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS pkcs7_options[] = { OPT_SECTION("General"), {"help", OPT_HELP, '-', "Display this summary"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, -#endif OPT_SECTION("Input"), {"in", OPT_IN, '<', "Input file"}, @@ -55,7 +52,6 @@ const OPTIONS pkcs7_options[] = { int pkcs7_main(int argc, char **argv) { - ENGINE *e = NULL; PKCS7 *p7 = NULL, *p7i; BIO *in = NULL, *out = NULL; int informat = FORMAT_PEM, outformat = FORMAT_PEM; @@ -105,9 +101,6 @@ int pkcs7_main(int argc, char **argv) case OPT_QUIET: quiet = 1; break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; case OPT_PROV_CASES: if (!opt_provider(o)) goto end; @@ -217,7 +210,6 @@ int pkcs7_main(int argc, char **argv) ret = 0; end: PKCS7_free(p7); - release_engine(e); BIO_free(in); BIO_free_all(out); return ret; diff --git a/apps/pkcs8.c b/apps/pkcs8.c index 4ba81fe08b..4876ce502a 100644 --- a/apps/pkcs8.c +++ b/apps/pkcs8.c @@ -22,7 +22,7 @@ typedef enum OPTION_choice { OPT_COMMON, - OPT_INFORM, OPT_OUTFORM, OPT_ENGINE, OPT_IN, OPT_OUT, + OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_TOPK8, OPT_NOITER, OPT_NOCRYPT, #ifndef OPENSSL_NO_SCRYPT OPT_SCRYPT, OPT_SCRYPT_N, OPT_SCRYPT_R, OPT_SCRYPT_P, @@ -36,9 +36,6 @@ typedef enum OPTION_choice { const OPTIONS pkcs8_options[] = { OPT_SECTION("General"), {"help", OPT_HELP, '-', "Display this summary"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, -#endif {"v1", OPT_V1, 's', "Use PKCS#5 v1.5 and cipher"}, {"v2", OPT_V2, 's', "Use PKCS#5 v2.0 and cipher"}, {"v2prf", OPT_V2PRF, 's', "Set the PRF algorithm to use with PKCS#5 v2.0"}, @@ -75,7 +72,6 @@ const OPTIONS pkcs8_options[] = { int pkcs8_main(int argc, char **argv) { BIO *in = NULL, *out = NULL; - ENGINE *e = NULL; EVP_PKEY *pkey = NULL; PKCS8_PRIV_KEY_INFO *p8inf = NULL; X509_SIG *p8 = NULL; @@ -171,9 +167,6 @@ int pkcs8_main(int argc, char **argv) case OPT_PASSOUT: passoutarg = opt_arg(); break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; #ifndef OPENSSL_NO_SCRYPT case OPT_SCRYPT: scrypt_N = 16384; @@ -229,7 +222,7 @@ int pkcs8_main(int argc, char **argv) goto end; if (topk8) { - pkey = load_key(infile, informat, 1, passin, e, "key"); + pkey = load_key(infile, informat, 1, passin, "key"); if (pkey == NULL) goto end; if ((p8inf = EVP_PKEY2PKCS8(pkey)) == NULL) { @@ -382,7 +375,6 @@ int pkcs8_main(int argc, char **argv) PKCS8_PRIV_KEY_INFO_free(p8inf); EVP_PKEY_free(pkey); EVP_CIPHER_free(cipher); - release_engine(e); BIO_free_all(out); BIO_free(in); OPENSSL_free(passin); diff --git a/apps/pkey.c b/apps/pkey.c index a876326e2b..b9dcc2f0f6 100644 --- a/apps/pkey.c +++ b/apps/pkey.c @@ -19,7 +19,7 @@ typedef enum OPTION_choice { OPT_COMMON, - OPT_INFORM, OPT_OUTFORM, OPT_PASSIN, OPT_PASSOUT, OPT_ENGINE, + OPT_INFORM, OPT_OUTFORM, OPT_PASSIN, OPT_PASSOUT, OPT_IN, OPT_OUT, OPT_PUBIN, OPT_PUBOUT, OPT_TEXT_PUB, OPT_TEXT, OPT_NOOUT, OPT_CIPHER, OPT_TRADITIONAL, OPT_CHECK, OPT_PUB_CHECK, OPT_EC_PARAM_ENC, OPT_EC_CONV_FORM, @@ -29,9 +29,6 @@ typedef enum OPTION_choice { const OPTIONS pkey_options[] = { OPT_SECTION("General"), {"help", OPT_HELP, '-', "Display this summary"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, -#endif OPT_PROV_OPTIONS, {"check", OPT_CHECK, '-', "Check key consistency"}, @@ -39,8 +36,7 @@ const OPTIONS pkey_options[] = { OPT_SECTION("Input"), {"in", OPT_IN, 's', "Input key"}, - {"inform", OPT_INFORM, 'f', - "Key input format (ENGINE, other values ignored)"}, + {"inform", OPT_INFORM, 'f', "Key input format (DER/PEM)"}, {"passin", OPT_PASSIN, 's', "Key input pass phrase source"}, {"pubin", OPT_PUBIN, '-', "Read only public components from key input"}, @@ -68,7 +64,6 @@ const OPTIONS pkey_options[] = { int pkey_main(int argc, char **argv) { BIO *out = NULL; - ENGINE *e = NULL; EVP_PKEY *pkey = NULL; EVP_PKEY_CTX *ctx = NULL; EVP_CIPHER *cipher = NULL; @@ -110,9 +105,6 @@ int pkey_main(int argc, char **argv) case OPT_PASSOUT: passoutarg = opt_arg(); break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; case OPT_IN: infile = opt_arg(); break; @@ -209,9 +201,9 @@ int pkey_main(int argc, char **argv) } if (pubin) - pkey = load_pubkey(infile, informat, 1, passin, e, "Public Key"); + pkey = load_pubkey(infile, informat, 1, passin, "Public Key"); else - pkey = load_key(infile, informat, 1, passin, e, "key"); + pkey = load_key(infile, informat, 1, passin, "key"); if (pkey == NULL) goto end; @@ -242,7 +234,7 @@ int pkey_main(int argc, char **argv) if (check || pub_check) { int r; - ctx = EVP_PKEY_CTX_new(pkey, e); + ctx = EVP_PKEY_CTX_new(pkey, NULL); if (ctx == NULL) { ERR_print_errors(bio_err); goto end; @@ -327,7 +319,6 @@ int pkey_main(int argc, char **argv) EVP_PKEY_CTX_free(ctx); EVP_PKEY_free(pkey); EVP_CIPHER_free(cipher); - release_engine(e); BIO_free_all(out); OPENSSL_free(passin); OPENSSL_free(passout); diff --git a/apps/pkeyparam.c b/apps/pkeyparam.c index fd8de0e02f..a35ad3e3b3 100644 --- a/apps/pkeyparam.c +++ b/apps/pkeyparam.c @@ -19,16 +19,13 @@ typedef enum OPTION_choice { OPT_COMMON, OPT_IN, OPT_OUT, OPT_TEXT, OPT_NOOUT, - OPT_ENGINE, OPT_CHECK, + OPT_CHECK, OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS pkeyparam_options[] = { OPT_SECTION("General"), {"help", OPT_HELP, '-', "Display this summary"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, -#endif {"check", OPT_CHECK, '-', "Check key param consistency"}, OPT_SECTION("Input"), @@ -45,7 +42,6 @@ const OPTIONS pkeyparam_options[] = { int pkeyparam_main(int argc, char **argv) { - ENGINE *e = NULL; BIO *in = NULL, *out = NULL; EVP_PKEY *pkey = NULL; EVP_PKEY_CTX *ctx = NULL; @@ -71,9 +67,6 @@ int pkeyparam_main(int argc, char **argv) case OPT_OUT: outfile = opt_arg(); break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; case OPT_TEXT: text = 1; break; @@ -109,11 +102,8 @@ int pkeyparam_main(int argc, char **argv) goto end; if (check) { - if (e == NULL) - ctx = EVP_PKEY_CTX_new_from_pkey(app_get0_libctx(), pkey, - app_get0_propq()); - else - ctx = EVP_PKEY_CTX_new(pkey, e); + ctx = EVP_PKEY_CTX_new_from_pkey(app_get0_libctx(), pkey, + app_get0_propq()); if (ctx == NULL) { ERR_print_errors(bio_err); goto end; @@ -145,7 +135,6 @@ int pkeyparam_main(int argc, char **argv) end: EVP_PKEY_CTX_free(ctx); EVP_PKEY_free(pkey); - release_engine(e); BIO_free_all(out); BIO_free(in); diff --git a/apps/pkeyutl.c b/apps/pkeyutl.c index 900af11c38..2e77f2b29d 100644 --- a/apps/pkeyutl.c +++ b/apps/pkeyutl.c @@ -22,16 +22,14 @@ static EVP_PKEY *get_pkey(const char *kdfalg, const char *keyfile, int keyform, int key_type, - char *passinarg, int pkey_op, ENGINE *e); + char *passinarg, int pkey_op); static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize, - int pkey_op, ENGINE *e, - const int engine_impl, int rawin, + int pkey_op, int rawin, EVP_PKEY *pkey /* ownership is passed to ctx */, EVP_MD_CTX *mctx, const char *digestname, const char *kemop, OSSL_LIB_CTX *libctx, const char *propq); -static int setup_peer(EVP_PKEY_CTX *ctx, int peerform, const char *file, - ENGINE *e); +static int setup_peer(EVP_PKEY_CTX *ctx, int peerform, const char *file); static int do_keyop(EVP_PKEY_CTX *ctx, int pkey_op, unsigned char *out, size_t *poutlen, @@ -56,7 +54,7 @@ static int only_nomd(EVP_PKEY *pkey) typedef enum OPTION_choice { OPT_COMMON, - OPT_ENGINE, OPT_ENGINE_IMPL, OPT_IN, OPT_OUT, + OPT_IN, OPT_OUT, OPT_PUBIN, OPT_CERTIN, OPT_ASN1PARSE, OPT_HEXDUMP, OPT_SIGN, OPT_VERIFY, OPT_VERIFYRECOVER, OPT_REV, OPT_ENCRYPT, OPT_DECRYPT, OPT_DERIVE, OPT_SIGFILE, OPT_INKEY, OPT_PEERKEY, OPT_PASSIN, @@ -70,11 +68,6 @@ typedef enum OPTION_choice { const OPTIONS pkeyutl_options[] = { OPT_SECTION("General"), {"help", OPT_HELP, '-', "Display this summary"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, - {"engine_impl", OPT_ENGINE_IMPL, '-', - "Also use engine given by -engine for crypto operations"}, -#endif {"sign", OPT_SIGN, '-', "Sign input data with private key"}, {"verify", OPT_VERIFY, '-', "Verify with public key"}, {"encrypt", OPT_ENCRYPT, '-', "Encrypt input data with public key"}, @@ -90,11 +83,11 @@ const OPTIONS pkeyutl_options[] = { {"pubin", OPT_PUBIN, '-', "Input key is a public key"}, {"passin", OPT_PASSIN, 's', "Input file pass phrase source"}, {"peerkey", OPT_PEERKEY, 's', "Peer key file used in key derivation"}, - {"peerform", OPT_PEERFORM, 'E', "Peer key format (DER/PEM/P12/ENGINE)"}, + {"peerform", OPT_PEERFORM, 'f', "Peer key format (DER/PEM/P12)"}, {"certin", OPT_CERTIN, '-', "Input is a cert with a public key"}, {"rev", OPT_REV, '-', "Reverse the order of the input buffer"}, {"sigfile", OPT_SIGFILE, '<', "Signature file (verify operation only)"}, - {"keyform", OPT_KEYFORM, 'E', "Private key format (ENGINE, other values ignored)"}, + {"keyform", OPT_KEYFORM, 'f', "Private key format (DER/PEM)"}, OPT_SECTION("Output"), {"out", OPT_OUT, '>', "Output file - default stdout"}, @@ -126,7 +119,6 @@ int pkeyutl_main(int argc, char **argv) { CONF *conf = NULL; BIO *in = NULL, *out = NULL, *secout = NULL; - ENGINE *e = NULL; EVP_PKEY_CTX *ctx = NULL; EVP_PKEY *pkey = NULL; char *infile = NULL, *outfile = NULL, *secoutfile = NULL, *sigfile = NULL, *passinarg = NULL; @@ -136,7 +128,6 @@ int pkeyutl_main(int argc, char **argv) int buf_inlen = 0, siglen = -1; int keyform = FORMAT_UNDEF, peerform = FORMAT_UNDEF; int keysize = -1, pkey_op = EVP_PKEY_OP_SIGN, key_type = KEY_PRIVKEY; - int engine_impl = 0; int ret = 1, rv = -1; size_t buf_outlen = 0, secretlen = 0; const char *inkey = NULL; @@ -175,9 +166,6 @@ int pkeyutl_main(int argc, char **argv) case OPT_SIGFILE: sigfile = opt_arg(); break; - case OPT_ENGINE_IMPL: - engine_impl = 1; - break; case OPT_INKEY: inkey = opt_arg(); break; @@ -208,9 +196,6 @@ int pkeyutl_main(int argc, char **argv) if (!opt_provider(o)) goto end; break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; case OPT_PUBIN: key_type = KEY_PUBKEY; break; @@ -317,7 +302,7 @@ int pkeyutl_main(int argc, char **argv) goto opthelp; } - pkey = get_pkey(kdfalg, inkey, keyform, key_type, passinarg, pkey_op, e); + pkey = get_pkey(kdfalg, inkey, keyform, key_type, passinarg, pkey_op); if (key_type != KEY_NONE && pkey == NULL) { BIO_printf(bio_err, "%s: Error loading key\n", prog); goto end; @@ -357,13 +342,13 @@ int pkeyutl_main(int argc, char **argv) goto end; } } - ctx = init_ctx(kdfalg, &keysize, pkey_op, e, engine_impl, rawin, pkey, + ctx = init_ctx(kdfalg, &keysize, pkey_op, rawin, pkey, mctx, digestname, kemop, libctx, app_get0_propq()); if (ctx == NULL) { BIO_printf(bio_err, "%s: Error initializing context\n", prog); goto end; } - if (peerkey != NULL && !setup_peer(ctx, peerform, peerkey, e)) { + if (peerkey != NULL && !setup_peer(ctx, peerform, peerkey)) { BIO_printf(bio_err, "%s: Error setting up peer key\n", prog); goto end; } @@ -601,7 +586,6 @@ int pkeyutl_main(int argc, char **argv) EVP_PKEY_CTX_free(ctx); EVP_PKEY_free(pkey); EVP_MD_free(md); - release_engine(e); BIO_free(in); BIO_free_all(out); BIO_free_all(secout); @@ -617,7 +601,7 @@ int pkeyutl_main(int argc, char **argv) static EVP_PKEY *get_pkey(const char *kdfalg, const char *keyfile, int keyform, int key_type, - char *passinarg, int pkey_op, ENGINE *e) + char *passinarg, int pkey_op) { EVP_PKEY *pkey = NULL; char *passin = NULL; @@ -635,11 +619,11 @@ static EVP_PKEY *get_pkey(const char *kdfalg, } switch (key_type) { case KEY_PRIVKEY: - pkey = load_key(keyfile, keyform, 0, passin, e, "private key"); + pkey = load_key(keyfile, keyform, 0, passin, "private key"); break; case KEY_PUBKEY: - pkey = load_pubkey(keyfile, keyform, 0, NULL, e, "public key"); + pkey = load_pubkey(keyfile, keyform, 0, NULL, "public key"); break; case KEY_CERT: @@ -659,21 +643,14 @@ static EVP_PKEY *get_pkey(const char *kdfalg, } static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize, - int pkey_op, ENGINE *e, - const int engine_impl, int rawin, + int pkey_op, int rawin, EVP_PKEY *pkey /* ownership is passed to ctx */, EVP_MD_CTX *mctx, const char *digestname, const char *kemop, OSSL_LIB_CTX *libctx, const char *propq) { EVP_PKEY_CTX *ctx = NULL; - ENGINE *impl = NULL; int rv = -1; -#ifndef OPENSSL_NO_ENGINE - if (engine_impl) - impl = e; -#endif - if (kdfalg != NULL) { int kdfnid = OBJ_sn2nid(kdfalg); @@ -685,19 +662,13 @@ static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize, return NULL; } } - if (impl != NULL) - ctx = EVP_PKEY_CTX_new_id(kdfnid, impl); - else - ctx = EVP_PKEY_CTX_new_from_name(libctx, kdfalg, propq); + ctx = EVP_PKEY_CTX_new_from_name(libctx, kdfalg, propq); } else { if (pkey == NULL) return NULL; *pkeysize = EVP_PKEY_get_size(pkey); - if (impl != NULL) - ctx = EVP_PKEY_CTX_new(pkey, impl); - else - ctx = EVP_PKEY_CTX_new_from_pkey(libctx, pkey, propq); + ctx = EVP_PKEY_CTX_new_from_pkey(libctx, pkey, propq); } if (ctx == NULL) @@ -766,17 +737,13 @@ static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize, return ctx; } -static int setup_peer(EVP_PKEY_CTX *ctx, int peerform, const char *file, - ENGINE *e) +static int setup_peer(EVP_PKEY_CTX *ctx, int peerform, const char *file) { EVP_PKEY *pkey = EVP_PKEY_CTX_get0_pkey(ctx); EVP_PKEY *peer = NULL; - ENGINE *engine = NULL; int ret = 1; - if (peerform == FORMAT_ENGINE) - engine = e; - peer = load_pubkey(file, peerform, 0, NULL, engine, "peer key"); + peer = load_pubkey(file, peerform, 0, NULL, "peer key"); if (peer == NULL) { BIO_printf(bio_err, "Error reading peer key %s\n", file); return 0; diff --git a/apps/rand.c b/apps/rand.c index da747c1783..d57ed74f6e 100644 --- a/apps/rand.c +++ b/apps/rand.c @@ -20,7 +20,7 @@ typedef enum OPTION_choice { OPT_COMMON, - OPT_OUT, OPT_ENGINE, OPT_BASE64, OPT_HEX, + OPT_OUT, OPT_BASE64, OPT_HEX, OPT_R_ENUM, OPT_PROV_ENUM } OPTION_CHOICE; @@ -29,9 +29,6 @@ const OPTIONS rand_options[] = { OPT_SECTION("General"), {"help", OPT_HELP, '-', "Display this summary"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, -#endif OPT_SECTION("Output"), {"out", OPT_OUT, '>', "Output file"}, @@ -48,7 +45,6 @@ const OPTIONS rand_options[] = { int rand_main(int argc, char **argv) { - ENGINE *e = NULL; BIO *out = NULL; char *outfile = NULL, *prog; OPTION_CHOICE o; @@ -73,9 +69,6 @@ int rand_main(int argc, char **argv) case OPT_OUT: outfile = opt_arg(); break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; case OPT_R_CASES: if (!opt_rand(o)) goto end; @@ -223,7 +216,6 @@ int rand_main(int argc, char **argv) if (ret != 0) ERR_print_errors(bio_err); OPENSSL_free(buf); - release_engine(e); BIO_free_all(out); return ret; } diff --git a/apps/req.c b/apps/req.c index 1e877c2317..79afbaf621 100644 --- a/apps/req.c +++ b/apps/req.c @@ -71,8 +71,7 @@ static int check_end(const char *str, const char *end); static int join(char buf[], size_t buf_size, const char *name, const char *tail, const char *desc); static EVP_PKEY_CTX *set_keygen_ctx(const char *gstr, - char **pkeytype, long *pkeylen, - ENGINE *keygen_engine); + char **pkeytype, long *pkeylen); static const char *section = "req"; static CONF *req_conf = NULL; @@ -82,7 +81,7 @@ static int batch = 0; typedef enum OPTION_choice { OPT_COMMON, OPT_CIPHER, - OPT_INFORM, OPT_OUTFORM, OPT_ENGINE, OPT_KEYGEN_ENGINE, OPT_KEY, + OPT_INFORM, OPT_OUTFORM, OPT_KEY, OPT_PUBKEY, OPT_NEW, OPT_CONFIG, OPT_KEYFORM, OPT_IN, OPT_OUT, OPT_KEYOUT, OPT_PASSIN, OPT_PASSOUT, OPT_NEWKEY, OPT_PKEYOPT, OPT_SIGOPT, OPT_VFYOPT, OPT_BATCH, OPT_NEWHDR, OPT_MODULUS, @@ -100,11 +99,6 @@ const OPTIONS req_options[] = { OPT_SECTION("General"), {"help", OPT_HELP, '-', "Display this summary"}, {"cipher", OPT_CIPHER, 's', "Specify the cipher for private key encryption"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, - {"keygen_engine", OPT_KEYGEN_ENGINE, 's', - "Specify engine to be used for key generation operations"}, -#endif {"in", OPT_IN, '<', "X.509 request input file (default stdin)"}, {"inform", OPT_INFORM, 'F', "CSR input format to use (PEM or DER; by default try PEM first)"}, @@ -147,7 +141,7 @@ const OPTIONS req_options[] = { OPT_SECTION("Keys and Signing"), {"key", OPT_KEY, 's', "Key for signing, and to include unless -in given"}, - {"keyform", OPT_KEYFORM, 'f', "Key file format (ENGINE, other values ignored)"}, + {"keyform", OPT_KEYFORM, 'f', "Key file format (DER/PEM)"}, {"pubkey", OPT_PUBKEY, '-', "Output public key"}, {"keyout", OPT_KEYOUT, '>', "File to write private key to"}, {"passin", OPT_PASSIN, 's', "Private key and certificate password source"}, @@ -245,7 +239,6 @@ int req_main(int argc, char **argv) { ASN1_INTEGER *serial = NULL; BIO *out = NULL; - ENGINE *e = NULL, *gen_eng = NULL; EVP_PKEY *pkey = NULL, *CAkey = NULL; EVP_PKEY_CTX *genctx = NULL; STACK_OF(OPENSSL_STRING) *pkeyopts = NULL, *sigopts = NULL, *vfyopts = NULL; @@ -298,18 +291,6 @@ int req_main(int argc, char **argv) if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &outformat)) goto opthelp; break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; - case OPT_KEYGEN_ENGINE: -#ifndef OPENSSL_NO_ENGINE - gen_eng = setup_engine(opt_arg(), 0); - if (gen_eng == NULL) { - BIO_printf(bio_err, "Can't find keygen engine %s\n", *argv); - goto opthelp; - } -#endif - break; case OPT_KEY: keyfile = opt_arg(); break; @@ -624,7 +605,7 @@ int req_main(int argc, char **argv) } if (keyfile != NULL) { - pkey = load_key(keyfile, keyform, 0, passin, e, "private key"); + pkey = load_key(keyfile, keyform, 0, passin, "private key"); if (pkey == NULL) goto end; app_RAND_load_conf(req_conf, section); @@ -640,7 +621,7 @@ int req_main(int argc, char **argv) if (!app_conf_try_number(req_conf, section, BITS, &newkey_len)) newkey_len = DEFAULT_KEY_LENGTH; - genctx = set_keygen_ctx(keyalg, &keyalgstr, &newkey_len, gen_eng); + genctx = set_keygen_ctx(keyalg, &keyalgstr, &newkey_len); if (genctx == NULL) goto end; @@ -762,7 +743,7 @@ int req_main(int argc, char **argv) "Warning: Ignoring -CAkey option since no -CA option is given\n"); } else { if ((CAkey = load_key(CAkeyfile, FORMAT_UNDEF, - 0, passin, e, + 0, passin, CAkeyfile != CAfile ? "issuer private key from -CAkey arg" : "issuer private key from -CA arg")) == NULL) @@ -1056,9 +1037,6 @@ int req_main(int argc, char **argv) sk_OPENSSL_STRING_free(vfyopts); lh_OPENSSL_STRING_doall(addexts, exts_cleanup); lh_OPENSSL_STRING_free(addexts); -#ifndef OPENSSL_NO_ENGINE - release_engine(gen_eng); -#endif OPENSSL_free(keyalgstr); X509_REQ_free(req); X509_NAME_free(fsubj); @@ -1066,7 +1044,6 @@ int req_main(int argc, char **argv) X509_free(CAcert); EVP_PKEY_free(CAkey); ASN1_INTEGER_free(serial); - release_engine(e); if (passin != nofree_passin) OPENSSL_free(passin); if (passout != nofree_passout) @@ -1484,8 +1461,7 @@ static int join(char buf[], size_t buf_size, const char *name, } static EVP_PKEY_CTX *set_keygen_ctx(const char *gstr, - char **pkeytype, long *pkeylen, - ENGINE *keygen_engine) + char **pkeytype, long *pkeylen) { EVP_PKEY_CTX *gctx = NULL; EVP_PKEY *param = NULL; @@ -1601,28 +1577,13 @@ static EVP_PKEY_CTX *set_keygen_ctx(const char *gstr, return NULL; } - if (keygen_engine != NULL) - gctx = EVP_PKEY_CTX_new(param, keygen_engine); - else - gctx = EVP_PKEY_CTX_new_from_pkey(app_get0_libctx(), - param, app_get0_propq()); + gctx = EVP_PKEY_CTX_new_from_pkey(app_get0_libctx(), + param, app_get0_propq()); *pkeylen = EVP_PKEY_get_bits(param); EVP_PKEY_free(param); } else { -#ifndef OPENSSL_NO_DEPRECATED_3_6 - if (keygen_engine != NULL) { - int pkey_id = get_legacy_pkey_id(app_get0_libctx(), *pkeytype, - keygen_engine); - - if (pkey_id != NID_undef) - gctx = EVP_PKEY_CTX_new_id(pkey_id, keygen_engine); - } else { -#endif - gctx = EVP_PKEY_CTX_new_from_name(app_get0_libctx(), - *pkeytype, app_get0_propq()); -#ifndef OPENSSL_NO_DEPRECATED_3_6 - } -#endif + gctx = EVP_PKEY_CTX_new_from_name(app_get0_libctx(), + *pkeytype, app_get0_propq()); } if (gctx == NULL) { diff --git a/apps/rsa.c b/apps/rsa.c index 9a4d16cbb0..8aa3295f8e 100644 --- a/apps/rsa.c +++ b/apps/rsa.c @@ -41,7 +41,7 @@ typedef enum OPTION_choice { OPT_COMMON, - OPT_INFORM, OPT_OUTFORM, OPT_ENGINE, OPT_IN, OPT_OUT, + OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_PUBIN, OPT_PUBOUT, OPT_PASSOUT, OPT_PASSIN, OPT_RSAPUBKEY_IN, OPT_RSAPUBKEY_OUT, /* Do not change the order here; see case statements below */ @@ -55,13 +55,10 @@ const OPTIONS rsa_options[] = { {"help", OPT_HELP, '-', "Display this summary"}, {"check", OPT_CHECK, '-', "Verify key consistency"}, {"", OPT_CIPHER, '-', "Any supported cipher"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, -#endif OPT_SECTION("Input"), {"in", OPT_IN, 's', "Input file"}, - {"inform", OPT_INFORM, 'f', "Input format (DER/PEM/P12/ENGINE)"}, + {"inform", OPT_INFORM, 'f', "Input format (DER/PEM/P12)"}, {"pubin", OPT_PUBIN, '-', "Expect a public key in input file"}, {"RSAPublicKey_in", OPT_RSAPUBKEY_IN, '-', "Input is an RSAPublicKey"}, {"passin", OPT_PASSIN, 's', "Input file pass phrase source"}, @@ -121,7 +118,6 @@ static int try_legacy_encoding(EVP_PKEY *pkey, int outformat, int pubout, int rsa_main(int argc, char **argv) { - ENGINE *e = NULL; BIO *out = NULL; EVP_PKEY *pkey = NULL; EVP_PKEY_CTX *pctx; @@ -172,9 +168,6 @@ int rsa_main(int argc, char **argv) case OPT_PASSOUT: passoutarg = opt_arg(); break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; case OPT_PUBIN: pubin = 1; break; @@ -246,9 +239,9 @@ int rsa_main(int argc, char **argv) tmpformat = informat; } - pkey = load_pubkey(infile, tmpformat, 1, passin, e, "public key"); + pkey = load_pubkey(infile, tmpformat, 1, passin, "public key"); } else { - pkey = load_key(infile, informat, 1, passin, e, "private key"); + pkey = load_key(infile, informat, 1, passin, "private key"); } if (pkey == NULL) { @@ -403,7 +396,6 @@ int rsa_main(int argc, char **argv) ret = 0; end: OSSL_ENCODER_CTX_free(ectx); - release_engine(e); BIO_free_all(out); EVP_PKEY_free(pkey); EVP_CIPHER_free(enc); diff --git a/apps/rsautl.c b/apps/rsautl.c index db11e3498f..1639ecc224 100644 --- a/apps/rsautl.c +++ b/apps/rsautl.c @@ -27,7 +27,7 @@ typedef enum OPTION_choice { OPT_COMMON, - OPT_ENGINE, OPT_IN, OPT_OUT, OPT_ASN1PARSE, OPT_HEXDUMP, + OPT_IN, OPT_OUT, OPT_ASN1PARSE, OPT_HEXDUMP, OPT_RSA_RAW, OPT_OAEP, OPT_PKCS, OPT_X931, OPT_SIGN, OPT_VERIFY, OPT_REV, OPT_ENCRYPT, OPT_DECRYPT, OPT_PUBIN, OPT_CERTIN, OPT_INKEY, OPT_PASSIN, OPT_KEYFORM, @@ -41,14 +41,11 @@ const OPTIONS rsautl_options[] = { {"verify", OPT_VERIFY, '-', "Verify with public key"}, {"encrypt", OPT_ENCRYPT, '-', "Encrypt with public key"}, {"decrypt", OPT_DECRYPT, '-', "Decrypt with private key"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, -#endif OPT_SECTION("Input"), {"in", OPT_IN, '<', "Input file"}, {"inkey", OPT_INKEY, 's', "Input key, by default an RSA private key"}, - {"keyform", OPT_KEYFORM, 'E', "Private key format (ENGINE, other values ignored)"}, + {"keyform", OPT_KEYFORM, 'f', "Private key format (DER/PEM)"}, {"pubin", OPT_PUBIN, '-', "Input key is an RSA public pkey"}, {"certin", OPT_CERTIN, '-', "Input is a cert carrying an RSA public key"}, {"rev", OPT_REV, '-', "Reverse the order of the input buffer"}, @@ -72,7 +69,6 @@ const OPTIONS rsautl_options[] = { int rsautl_main(int argc, char **argv) { BIO *in = NULL, *out = NULL; - ENGINE *e = NULL; EVP_PKEY *pkey = NULL; EVP_PKEY_CTX *ctx = NULL; X509 *x; @@ -107,9 +103,6 @@ int rsautl_main(int argc, char **argv) case OPT_OUT: outfile = opt_arg(); break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; case OPT_ASN1PARSE: asn1parse = 1; break; @@ -187,11 +180,11 @@ int rsautl_main(int argc, char **argv) switch (key_type) { case KEY_PRIVKEY: - pkey = load_key(keyfile, keyformat, 0, passin, e, "private key"); + pkey = load_key(keyfile, keyformat, 0, passin, "private key"); break; case KEY_PUBKEY: - pkey = load_pubkey(keyfile, keyformat, 0, NULL, e, "public key"); + pkey = load_pubkey(keyfile, keyformat, 0, NULL, "public key"); break; case KEY_CERT: @@ -282,7 +275,6 @@ int rsautl_main(int argc, char **argv) end: EVP_PKEY_CTX_free(ctx); EVP_PKEY_free(pkey); - release_engine(e); BIO_free(in); BIO_free_all(out); OPENSSL_free(rsa_in); diff --git a/apps/s_client.c b/apps/s_client.c index 7c3e1ef7bc..44d8421673 100644 --- a/apps/s_client.c +++ b/apps/s_client.c @@ -483,12 +483,11 @@ typedef enum OPTION_choice { OPT_CERT, OPT_CRL, OPT_CRL_DOWNLOAD, OPT_SESS_OUT, OPT_SESS_IN, OPT_CERTFORM, OPT_CRLFORM, OPT_VERIFY_RET_ERROR, OPT_VERIFY_QUIET, OPT_BRIEF, OPT_PREXIT, OPT_NO_INTERACTIVE, OPT_CRLF, OPT_QUIET, OPT_NBIO, - OPT_SSL_CLIENT_ENGINE, OPT_IGN_EOF, OPT_NO_IGN_EOF, - OPT_DEBUG, OPT_TLSEXTDEBUG, OPT_WDEBUG, + OPT_IGN_EOF, OPT_NO_IGN_EOF, OPT_DEBUG, OPT_TLSEXTDEBUG, OPT_WDEBUG, # ifndef OPENSSL_NO_OCSP OPT_STATUS, OPT_STATUS_OCSP_CHECK_LEAF, OPT_STATUS_OCSP_CHECK_ALL, # endif - OPT_MSG, OPT_MSGFILE, OPT_ENGINE, OPT_TRACE, OPT_SECURITY_DEBUG, + OPT_MSG, OPT_MSGFILE, OPT_TRACE, OPT_SECURITY_DEBUG, OPT_SECURITY_DEBUG_VERBOSE, OPT_SHOWCERTS, OPT_NBIO_TEST, OPT_STATE, OPT_PSK_IDENTITY, OPT_PSK, OPT_PSK_SESS, #ifndef OPENSSL_NO_SRP @@ -530,11 +529,6 @@ const OPTIONS s_client_options[] = { OPT_SECTION("General"), {"help", OPT_HELP, '-', "Display this summary"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, - {"ssl_client_engine", OPT_SSL_CLIENT_ENGINE, 's', - "Specify engine to be used for client certificate operations"}, -#endif {"ssl_config", OPT_SSL_CONFIG, 's', "Use specified section for SSL_CTX configuration"}, #ifndef OPENSSL_NO_CT {"ct", OPT_CT, '-', "Request and parse SCTs (also enables OCSP stapling)"}, @@ -578,7 +572,7 @@ const OPTIONS s_client_options[] = { "Client certificate chain file (in PEM format)"}, {"build_chain", OPT_BUILD_CHAIN, '-', "Build client certificate chain"}, {"key", OPT_KEY, 's', "Private key file to use; default: -cert file"}, - {"keyform", OPT_KEYFORM, 'E', "Key format (ENGINE, other values ignored)"}, + {"keyform", OPT_KEYFORM, 'f', "Key format (DER/PEM)"}, {"pass", OPT_PASS, 's', "Private key and cert file pass phrase source"}, {"verify", OPT_VERIFY, 'p', "Turn on peer certificate verification"}, {"nameopt", OPT_NAMEOPT, 's', "Certificate subject/issuer name printing options"}, @@ -913,10 +907,6 @@ int s_client_main(int argc, char **argv) int enable_timeouts = 0; long socket_mtu = 0; #endif -#ifndef OPENSSL_NO_ENGINE - ENGINE *ssl_client_engine = NULL; -#endif - ENGINE *e = NULL; #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) struct timeval tv; #endif @@ -1175,18 +1165,6 @@ int s_client_main(int argc, char **argv) case OPT_ADV: cmdmode = USER_DATA_MODE_ADVANCED; break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 1); - break; - case OPT_SSL_CLIENT_ENGINE: -#ifndef OPENSSL_NO_ENGINE - ssl_client_engine = setup_engine(opt_arg(), 0); - if (ssl_client_engine == NULL) { - BIO_printf(bio_err, "Error getting client auth engine\n"); - goto opthelp; - } -#endif - break; case OPT_R_CASES: if (!opt_rand(o)) goto end; @@ -1771,7 +1749,7 @@ int s_client_main(int argc, char **argv) key_file = cert_file; if (key_file != NULL) { - key = load_key(key_file, key_format, 0, pass, e, + key = load_key(key_file, key_format, 0, pass, "client certificate private key"); if (key == NULL) goto end; @@ -1929,16 +1907,6 @@ int s_client_main(int argc, char **argv) } SSL_CTX_set0_CA_list(ctx, nm); } -#ifndef OPENSSL_NO_ENGINE - if (ssl_client_engine) { - if (!SSL_CTX_set_client_cert_engine(ctx, ssl_client_engine)) { - BIO_puts(bio_err, "Error setting client auth engine\n"); - release_engine(ssl_client_engine); - goto end; - } - release_engine(ssl_client_engine); - } -#endif #ifndef OPENSSL_NO_PSK if (psk_key != NULL) { @@ -3344,7 +3312,6 @@ int s_client_main(int argc, char **argv) OPENSSL_clear_free(sbuf, BUFSIZZ); OPENSSL_clear_free(mbuf, BUFSIZZ); clear_free(proxypass); - release_engine(e); BIO_free(bio_c_out); bio_c_out = NULL; BIO_free(bio_c_msg); diff --git a/apps/s_server.c b/apps/s_server.c index 52b4a60794..12c5451ea5 100644 --- a/apps/s_server.c +++ b/apps/s_server.c @@ -939,7 +939,6 @@ static int not_resumable_sess_cb(SSL *s, int is_forward_secure) typedef enum OPTION_choice { OPT_COMMON, - OPT_ENGINE, OPT_4, OPT_6, OPT_ACCEPT, OPT_PORT, OPT_UNIX, OPT_UNLINK, OPT_NACCEPT, OPT_VERIFY, OPT_NAMEOPT, OPT_UPPER_V_VERIFY, OPT_CONTEXT, OPT_CERT, OPT_CRL, OPT_CRL_DOWNLOAD, OPT_SERVERINFO, OPT_CERTFORM, OPT_KEY, OPT_KEYFORM, @@ -987,9 +986,6 @@ const OPTIONS s_server_options[] = { #ifndef OPENSSL_NO_SSL_TRACE {"trace", OPT_TRACE, '-', "trace protocol messages"}, #endif -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, -#endif OPT_SECTION("Network"), {"port", OPT_PORT, 'p', @@ -1036,7 +1032,7 @@ const OPTIONS s_server_options[] = { "Private key file to use; default is -cert file or else" TEST_CERT}, {"key2", OPT_KEY2, '<', "-Private Key file to use for servername if not in -cert2"}, - {"keyform", OPT_KEYFORM, 'f', "Key format (ENGINE, other values ignored)"}, + {"keyform", OPT_KEYFORM, 'f', "Key format (DER/PEM)"}, {"pass", OPT_PASS, 's', "Private key and cert file pass phrase source"}, {"dcert", OPT_DCERT, '<', "Second server certificate file to use (usually for DSA)"}, @@ -1046,8 +1042,7 @@ const OPTIONS s_server_options[] = { "second server certificate chain file in PEM format"}, {"dkey", OPT_DKEY, '<', "Second private key file to use (usually for DSA)"}, - {"dkeyform", OPT_DKEYFORM, 'f', - "Second key file format (ENGINE, other values ignored)"}, + {"dkeyform", OPT_DKEYFORM, 'f', "Second key file format (DER/PEM)"}, {"dpass", OPT_DPASS, 's', "Second private key and cert file pass phrase source"}, {"dhparam", OPT_DHPARAM, '<', "DH parameters file to use"}, @@ -1242,7 +1237,6 @@ const OPTIONS s_server_options[] = { int s_server_main(int argc, char *argv[]) { - ENGINE *engine = NULL; EVP_PKEY *s_key = NULL, *s_dkey = NULL; SSL_CONF_CTX *cctx = NULL; const SSL_METHOD *meth = TLS_server_method(); @@ -1832,11 +1826,6 @@ int s_server_main(int argc, char *argv[]) case OPT_ID_PREFIX: session_id_prefix = opt_arg(); break; - case OPT_ENGINE: -#ifndef OPENSSL_NO_ENGINE - engine = setup_engine(opt_arg(), s_debug); -#endif - break; case OPT_R_CASES: if (!opt_rand(o)) goto end; @@ -2048,7 +2037,7 @@ int s_server_main(int argc, char *argv[]) goto end; if (nocert == 0) { - s_key = load_key(s_key_file, s_key_format, 0, pass, engine, + s_key = load_key(s_key_file, s_key_format, 0, pass, "server certificate private key"); if (s_key == NULL) goto end; @@ -2065,7 +2054,7 @@ int s_server_main(int argc, char *argv[]) } if (tlsextcbp.servername != NULL) { - s_key2 = load_key(s_key_file2, s_key_format, 0, pass, engine, + s_key2 = load_key(s_key_file2, s_key_format, 0, pass, "second server certificate private key"); if (s_key2 == NULL) goto end; @@ -2111,7 +2100,7 @@ int s_server_main(int argc, char *argv[]) s_dkey_file = s_dcert_file; s_dkey = load_key(s_dkey_file, s_dkey_format, - 0, dpass, engine, "second certificate private key"); + 0, dpass, "second certificate private key"); if (s_dkey == NULL) goto end; @@ -2612,7 +2601,6 @@ int s_server_main(int argc, char *argv[]) ssl_excert_free(exc); sk_OPENSSL_STRING_free(ssl_args); SSL_CONF_CTX_free(cctx); - release_engine(engine); BIO_free(bio_s_out); bio_s_out = NULL; BIO_free(bio_s_msg); diff --git a/apps/smime.c b/apps/smime.c index 211ddce4ab..6e0aa92c17 100644 --- a/apps/smime.c +++ b/apps/smime.c @@ -38,7 +38,7 @@ typedef enum OPTION_choice { OPT_PK7OUT, OPT_TEXT, OPT_NOINTERN, OPT_NOVERIFY, OPT_NOCHAIN, OPT_NOCERTS, OPT_NOATTR, OPT_NODETACH, OPT_NOSMIMECAP, OPT_BINARY, OPT_NOSIGS, OPT_STREAM, OPT_INDEF, OPT_NOINDEF, - OPT_CRLFEOL, OPT_ENGINE, OPT_PASSIN, + OPT_CRLFEOL, OPT_PASSIN, OPT_TO, OPT_FROM, OPT_SUBJECT, OPT_SIGNER, OPT_RECIP, OPT_MD, OPT_CIPHER, OPT_INKEY, OPT_KEYFORM, OPT_CERTFILE, OPT_CAFILE, OPT_CAPATH, OPT_CASTORE, OPT_NOCAFILE, OPT_NOCAPATH, OPT_NOCASTORE, @@ -60,10 +60,7 @@ const OPTIONS smime_options[] = { "Output format SMIME (default), PEM or DER"}, {"inkey", OPT_INKEY, 's', "Input private key (if not signer or recipient)"}, - {"keyform", OPT_KEYFORM, 'f', "Input private key format (ENGINE, other values ignored)"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, -#endif + {"keyform", OPT_KEYFORM, 'f', "Input private key format (DER/PEM)"}, {"stream", OPT_STREAM, '-', "Enable CMS streaming" }, {"indef", OPT_INDEF, '-', "Same as -stream" }, {"noindef", OPT_NOINDEF, '-', "Disable CMS streaming"}, @@ -182,7 +179,6 @@ int smime_main(int argc, char **argv) int informat = FORMAT_SMIME, outformat = FORMAT_SMIME, keyform = FORMAT_UNDEF; int vpmtouched = 0, rv = 0; - ENGINE *e = NULL; const char *mime_eol = "\n"; OSSL_LIB_CTX *libctx = app_get0_libctx(); @@ -294,9 +290,6 @@ int smime_main(int argc, char **argv) if (conf == NULL) goto end; break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; case OPT_PASSIN: passinarg = opt_arg(); break; @@ -520,7 +513,7 @@ int smime_main(int argc, char **argv) } if (keyfile != NULL) { - key = load_key(keyfile, keyform, 0, passin, e, "signing key"); + key = load_key(keyfile, keyform, 0, passin, "signing key"); if (key == NULL) goto end; } @@ -612,7 +605,7 @@ int smime_main(int argc, char **argv) signer = load_cert(signerfile, FORMAT_UNDEF, "signer certificate"); if (signer == NULL) goto end; - key = load_key(keyfile, keyform, 0, passin, e, "signing key"); + key = load_key(keyfile, keyform, 0, passin, "signing key"); if (key == NULL) goto end; @@ -701,7 +694,6 @@ int smime_main(int argc, char **argv) EVP_MD_free(sign_md); EVP_CIPHER_free(cipher); PKCS7_free(p7); - release_engine(e); BIO_free(in); BIO_free(indata); BIO_free_all(out); diff --git a/apps/speed.c b/apps/speed.c index cafd4c4880..4467385746 100644 --- a/apps/speed.c +++ b/apps/speed.c @@ -233,7 +233,7 @@ static int opt_found(const char *name, unsigned int *result, typedef enum OPTION_choice { OPT_COMMON, - OPT_ELAPSED, OPT_EVP, OPT_HMAC, OPT_DECRYPT, OPT_ENGINE, OPT_MULTI, + OPT_ELAPSED, OPT_EVP, OPT_HMAC, OPT_DECRYPT, OPT_MULTI, OPT_MR, OPT_MB, OPT_MISALIGN, OPT_ASYNCJOBS, OPT_R_ENUM, OPT_PROV_ENUM, OPT_CONFIG, OPT_PRIMES, OPT_SECONDS, OPT_BYTES, OPT_AEAD, OPT_CMAC, OPT_MLOCK, OPT_TESTMODE, OPT_KEM, OPT_SIG @@ -257,9 +257,6 @@ const OPTIONS speed_options[] = { #ifndef OPENSSL_NO_ASYNC {"async_jobs", OPT_ASYNCJOBS, 'p', "Enable async mode and start specified number of jobs"}, -#endif -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, #endif {"primes", OPT_PRIMES, 'p', "Specify number of primes (for RSA only)"}, {"mlock", OPT_MLOCK, '-', "Lock memory for better result determinism"}, @@ -1879,10 +1876,8 @@ static int get_max(const uint8_t doit[], size_t algs_len) { int speed_main(int argc, char **argv) { CONF *conf = NULL; - ENGINE *e = NULL; loopargs_t *loopargs = NULL; const char *prog; - const char *engine_id = NULL; EVP_CIPHER *evp_cipher = NULL; EVP_MAC *mac = NULL; double d = 0.0; @@ -2096,14 +2091,6 @@ int speed_main(int argc, char **argv) case OPT_DECRYPT: decrypt = 1; break; - case OPT_ENGINE: - /* - * In a forked execution, an engine might need to be - * initialised by each child process, not by the parent. - * So store the name here and run setup_engine() later on. - */ - engine_id = opt_arg(); - break; case OPT_MULTI: #ifndef NO_FORK multi = opt_int_arg(); @@ -2554,9 +2541,6 @@ int speed_main(int argc, char **argv) memset(loopargs[i].buf2_malloc, 0, buflen); } - /* Initialize the engine after the fork */ - e = setup_engine(engine_id, 0); - /* No parameters; turn on everything. */ if (argc == 0 && !doit[D_EVP] && !doit[D_HMAC] && !doit[D_EVP_CMAC] && !do_kems && !do_sigs) { @@ -3231,7 +3215,7 @@ int speed_main(int argc, char **argv) bn = BN_new(); st = bn != NULL && BN_set_word(bn, RSA_F4) - && init_gen_str(&genctx, "RSA", NULL, 0, NULL, NULL) + && init_gen_str(&genctx, "RSA", 0, NULL, NULL) && EVP_PKEY_CTX_set_rsa_keygen_bits(genctx, rsa_keys[testnum].bits) > 0 && EVP_PKEY_CTX_set1_rsa_keygen_pubexp(genctx, bn) > 0 && EVP_PKEY_CTX_set_rsa_keygen_primes(genctx, primes) > 0 @@ -4784,7 +4768,6 @@ int speed_main(int argc, char **argv) ASYNC_cleanup_thread(); } OPENSSL_free(loopargs); - release_engine(e); EVP_CIPHER_free(evp_cipher); EVP_MAC_free(mac); NCONF_free(conf); diff --git a/apps/spkac.c b/apps/spkac.c index 5a129a7fa7..3634fb21b7 100644 --- a/apps/spkac.c +++ b/apps/spkac.c @@ -23,7 +23,7 @@ typedef enum OPTION_choice { OPT_COMMON, OPT_NOOUT, OPT_PUBKEY, OPT_VERIFY, OPT_IN, OPT_OUT, - OPT_ENGINE, OPT_KEY, OPT_CHALLENGE, OPT_PASSIN, OPT_SPKAC, + OPT_KEY, OPT_CHALLENGE, OPT_PASSIN, OPT_SPKAC, OPT_SPKSECT, OPT_KEYFORM, OPT_DIGEST, OPT_PROV_ENUM } OPTION_CHOICE; @@ -33,14 +33,11 @@ const OPTIONS spkac_options[] = { {"help", OPT_HELP, '-', "Display this summary"}, {"spksect", OPT_SPKSECT, 's', "Specify the name of an SPKAC-dedicated section of configuration"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, -#endif OPT_SECTION("Input"), {"in", OPT_IN, '<', "Input file"}, {"key", OPT_KEY, '<', "Create SPKAC using private key"}, - {"keyform", OPT_KEYFORM, 'f', "Private key file format (ENGINE, other values ignored)"}, + {"keyform", OPT_KEYFORM, 'f', "Private key file format (DER/PEM)"}, {"passin", OPT_PASSIN, 's', "Input file pass phrase source"}, {"challenge", OPT_CHALLENGE, 's', "Challenge string"}, {"spkac", OPT_SPKAC, 's', "Alternative SPKAC name"}, @@ -60,7 +57,6 @@ int spkac_main(int argc, char **argv) { BIO *out = NULL; CONF *conf = NULL; - ENGINE *e = NULL; EVP_PKEY *pkey = NULL; NETSCAPE_SPKI *spki = NULL; char *challenge = NULL, *keyfile = NULL; @@ -122,9 +118,6 @@ int spkac_main(int argc, char **argv) case OPT_DIGEST: digest = opt_arg(); break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; case OPT_PROV_CASES: if (!opt_provider(o)) goto end; @@ -146,7 +139,7 @@ int spkac_main(int argc, char **argv) goto end; pkey = load_key(strcmp(keyfile, "-") ? keyfile : NULL, - keyformat, 1, passin, e, "private key"); + keyformat, 1, passin, "private key"); if (pkey == NULL) goto end; spki = NETSCAPE_SPKI_new(); @@ -227,7 +220,6 @@ int spkac_main(int argc, char **argv) NETSCAPE_SPKI_free(spki); BIO_free_all(out); EVP_PKEY_free(pkey); - release_engine(e); OPENSSL_free(passin); return ret; } diff --git a/apps/srp.c b/apps/srp.c index 4e8f226503..f35fe128cb 100644 --- a/apps/srp.c +++ b/apps/srp.c @@ -193,7 +193,7 @@ typedef enum OPTION_choice { OPT_COMMON, OPT_VERBOSE, OPT_CONFIG, OPT_NAME, OPT_SRPVFILE, OPT_ADD, OPT_DELETE, OPT_MODIFY, OPT_LIST, OPT_GN, OPT_USERINFO, - OPT_PASSIN, OPT_PASSOUT, OPT_ENGINE, OPT_R_ENUM, OPT_PROV_ENUM + OPT_PASSIN, OPT_PASSOUT, OPT_R_ENUM, OPT_PROV_ENUM } OPTION_CHOICE; const OPTIONS srp_options[] = { @@ -204,9 +204,6 @@ const OPTIONS srp_options[] = { {"verbose", OPT_VERBOSE, '-', "Talk a lot while doing things"}, {"config", OPT_CONFIG, '<', "A config file"}, {"name", OPT_NAME, 's', "The particular srp definition to use"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, -#endif OPT_SECTION("Action"), {"add", OPT_ADD, '-', "Add a user and SRP verifier"}, @@ -231,7 +228,6 @@ const OPTIONS srp_options[] = { int srp_main(int argc, char **argv) { - ENGINE *e = NULL; CA_DB *db = NULL; CONF *conf = NULL; int gNindex = -1, maxgN = -1, ret = 1, errors = 0, verbose = 0, i; @@ -291,9 +287,6 @@ int srp_main(int argc, char **argv) case OPT_PASSOUT: passoutarg = opt_arg(); break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; case OPT_R_CASES: if (!opt_rand(o)) goto end; @@ -626,6 +619,5 @@ int srp_main(int argc, char **argv) ERR_print_errors(bio_err); NCONF_free(conf); free_index(db); - release_engine(e); return ret; } diff --git a/apps/storeutl.c b/apps/storeutl.c index bb489d6d9b..fe809d421c 100644 --- a/apps/storeutl.c +++ b/apps/storeutl.c @@ -25,7 +25,7 @@ static BIO *out = NULL; typedef enum OPTION_choice { OPT_COMMON, - OPT_ENGINE, OPT_OUT, OPT_PASSIN, + OPT_OUT, OPT_PASSIN, OPT_NOOUT, OPT_TEXT, OPT_RECURSIVE, OPT_SEARCHFOR_CERTS, OPT_SEARCHFOR_KEYS, OPT_SEARCHFOR_CRLS, OPT_CRITERION_SUBJECT, OPT_CRITERION_ISSUER, OPT_CRITERION_SERIAL, @@ -39,9 +39,6 @@ const OPTIONS storeutl_options[] = { OPT_SECTION("General"), {"help", OPT_HELP, '-', "Display this summary"}, {"", OPT_MD, '-', "Any supported digest"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, -#endif OPT_SECTION("Search"), {"certs", OPT_SEARCHFOR_CERTS, '-', "Search for certificates only"}, @@ -73,7 +70,6 @@ int storeutl_main(int argc, char *argv[]) { int ret = 1, noout = 0, text = 0, recursive = 0; char *outfile = NULL, *passin = NULL, *passinarg = NULL; - ENGINE *e = NULL; OPTION_CHOICE o; char *prog; PW_CB_DATA pw_cb_data; @@ -243,9 +239,6 @@ int storeutl_main(int argc, char *argv[]) goto end; } break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; case OPT_MD: digestname = opt_unknown(); break; @@ -324,7 +317,6 @@ int storeutl_main(int argc, char *argv[]) OSSL_STORE_SEARCH_free(search); BIO_free_all(out); OPENSSL_free(passin); - release_engine(e); return ret; } diff --git a/apps/ts.c b/apps/ts.c index e59bc3b4b4..3bb9032d8f 100644 --- a/apps/ts.c +++ b/apps/ts.c @@ -46,13 +46,13 @@ static int create_digest(BIO *input, const char *digest, static ASN1_INTEGER *create_nonce(int bits); /* Reply related functions. */ -static int reply_command(CONF *conf, const char *section, const char *engine, +static int reply_command(CONF *conf, const char *section, const char *queryfile, const char *passin, const char *inkey, const EVP_MD *md, const char *signer, const char *chain, const char *policy, const char *in, int token_in, const char *out, int token_out, int text); static TS_RESP *read_PKCS7(BIO *in_bio); -static TS_RESP *create_response(CONF *conf, const char *section, const char *engine, +static TS_RESP *create_response(CONF *conf, const char *section, const char *queryfile, const char *passin, const char *inkey, const EVP_MD *md, const char *signer, const char *chain, const char *policy); @@ -78,7 +78,7 @@ static int verify_cb(int ok, X509_STORE_CTX *ctx); typedef enum OPTION_choice { OPT_COMMON, - OPT_ENGINE, OPT_CONFIG, OPT_SECTION, OPT_QUERY, OPT_DATA, + OPT_CONFIG, OPT_SECTION, OPT_QUERY, OPT_DATA, OPT_DIGEST, OPT_TSPOLICY, OPT_NO_NONCE, OPT_CERT, OPT_IN, OPT_TOKEN_IN, OPT_OUT, OPT_TOKEN_OUT, OPT_TEXT, OPT_REPLY, OPT_QUERYFILE, OPT_PASSIN, OPT_INKEY, OPT_SIGNER, @@ -91,9 +91,6 @@ const OPTIONS ts_options[] = { {"help", OPT_HELP, '-', "Display this summary"}, {"config", OPT_CONFIG, '<', "Configuration file"}, {"section", OPT_SECTION, 's', "Section to use within config file"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, -#endif {"inkey", OPT_INKEY, 's', "File with private key for reply"}, {"signer", OPT_SIGNER, 's', "Signer certificate file"}, {"chain", OPT_CHAIN, '<', "File with signer CA chain"}, @@ -143,11 +140,7 @@ static char* opt_helplist[] = { " [-signer tsa_cert.pem] [-inkey private_key.pem]", " [-chain certs_file.pem] [-tspolicy oid]", " [-in file] [-token_in] [-out file] [-token_out]", -#ifndef OPENSSL_NO_ENGINE - " [-text] [-engine id]", -#else " [-text]", -#endif "", " openssl ts -verify -CApath dir -CAfile root-cert.pem -CAstore uri", " -untrusted extra-certs.pem [-data file] [-digest hexstring]", @@ -160,7 +153,7 @@ int ts_main(int argc, char **argv) CONF *conf = NULL; const char *CAfile = NULL, *prog; char *untrusted = NULL; - const char *configfile = default_config_file, *engine = NULL; + const char *configfile = default_config_file; const char *section = NULL, *digestname = NULL; char **helpp; char *password = NULL; @@ -276,9 +269,6 @@ int ts_main(int argc, char **argv) case OPT_UNTRUSTED: untrusted = opt_arg(); break; - case OPT_ENGINE: - engine = opt_arg(); - break; case OPT_MD: digestname = opt_unknown(); break; @@ -331,7 +321,7 @@ int ts_main(int argc, char **argv) if ((conf == NULL) || (token_in != 0)) goto opthelp; } - ret = !reply_command(conf, section, engine, queryfile, + ret = !reply_command(conf, section, queryfile, password, inkey, md, signer, chain, policy, in, token_in, out, token_out, text); @@ -587,7 +577,7 @@ static ASN1_INTEGER *create_nonce(int bits) * Reply-related method definitions. */ -static int reply_command(CONF *conf, const char *section, const char *engine, +static int reply_command(CONF *conf, const char *section, const char *queryfile, const char *passin, const char *inkey, const EVP_MD *md, const char *signer, const char *chain, const char *policy, const char *in, int token_in, @@ -610,7 +600,7 @@ static int reply_command(CONF *conf, const char *section, const char *engine, response = d2i_TS_RESP_bio(in_bio, NULL); } } else { - response = create_response(conf, section, engine, queryfile, + response = create_response(conf, section, queryfile, passin, inkey, md, signer, chain, policy); if (response != NULL) BIO_printf(bio_err, "Response has been generated.\n"); @@ -695,7 +685,7 @@ static TS_RESP *read_PKCS7(BIO *in_bio) return resp; } -static TS_RESP *create_response(CONF *conf, const char *section, const char *engine, +static TS_RESP *create_response(CONF *conf, const char *section, const char *queryfile, const char *passin, const char *inkey, const EVP_MD *md, const char *signer, const char *chain, const char *policy) @@ -713,10 +703,6 @@ static TS_RESP *create_response(CONF *conf, const char *section, const char *eng goto end; if (!TS_CONF_set_serial(conf, section, serial_cb, resp_ctx)) goto end; -#ifndef OPENSSL_NO_ENGINE - if (!TS_CONF_set_crypto_device(conf, section, engine)) - goto end; -#endif if (!TS_CONF_set_signer_cert(conf, section, signer, resp_ctx)) goto end; if (!TS_CONF_set_certs(conf, section, chain, resp_ctx)) diff --git a/apps/verify.c b/apps/verify.c index 93b214281e..ac2382b924 100644 --- a/apps/verify.c +++ b/apps/verify.c @@ -27,7 +27,7 @@ static int v_verbose = 0, vflags = 0; typedef enum OPTION_choice { OPT_COMMON, - OPT_ENGINE, OPT_CAPATH, OPT_CAFILE, OPT_CASTORE, + OPT_CAPATH, OPT_CAFILE, OPT_CASTORE, OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE, OPT_UNTRUSTED, OPT_TRUSTED, OPT_CRLFILE, OPT_CRL_DOWNLOAD, OPT_SHOW_CHAIN, OPT_V_ENUM, OPT_NAMEOPT, OPT_VFYOPT, @@ -40,9 +40,6 @@ const OPTIONS verify_options[] = { OPT_SECTION("General"), {"help", OPT_HELP, '-', "Display this summary"}, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, -#endif {"verbose", OPT_VERBOSE, '-', "Print extra information about the operations being performed."}, {"nameopt", OPT_NAMEOPT, 's', "Certificate subject/issuer name printing options"}, @@ -78,7 +75,6 @@ const OPTIONS verify_options[] = { int verify_main(int argc, char **argv) { - ENGINE *e = NULL; STACK_OF(X509) *untrusted = NULL, *trusted = NULL; STACK_OF(X509_CRL) *crls = NULL; STACK_OF(OPENSSL_STRING) *vfyopts = NULL; @@ -165,12 +161,6 @@ int verify_main(int argc, char **argv) case OPT_CRL_DOWNLOAD: crl_download = 1; break; - case OPT_ENGINE: - if ((e = setup_engine(opt_arg(), 0)) == NULL) { - /* Failure message already displayed */ - goto end; - } - break; case OPT_SHOW_CHAIN: show_chain = 1; break; @@ -238,7 +228,6 @@ int verify_main(int argc, char **argv) OSSL_STACK_OF_X509_free(trusted); sk_X509_CRL_pop_free(crls, X509_CRL_free); sk_OPENSSL_STRING_free(vfyopts); - release_engine(e); return (ret < 0 ? 2 : ret); } diff --git a/apps/version.c b/apps/version.c index 89fb64b70a..370ded6375 100644 --- a/apps/version.c +++ b/apps/version.c @@ -18,7 +18,7 @@ typedef enum OPTION_choice { OPT_COMMON, - OPT_B, OPT_D, OPT_E, OPT_M, OPT_F, OPT_O, OPT_P, OPT_V, OPT_A, OPT_R, OPT_C + OPT_B, OPT_D, OPT_M, OPT_F, OPT_O, OPT_P, OPT_V, OPT_A, OPT_R, OPT_C #if defined(_WIN32) ,OPT_W #endif @@ -32,7 +32,6 @@ const OPTIONS version_options[] = { {"a", OPT_A, '-', "Show all data"}, {"b", OPT_B, '-', "Show build date"}, {"d", OPT_D, '-', "Show configuration directory"}, - {"e", OPT_E, '-', "Show engines directory"}, {"m", OPT_M, '-', "Show modules directory"}, {"f", OPT_F, '-', "Show compiler flags used"}, {"o", OPT_O, '-', "Show some internal datatype options"}, @@ -50,7 +49,7 @@ int version_main(int argc, char **argv) { int ret = 1, dirty = 0, seed = 0; int cflags = 0, version = 0, date = 0, options = 0, platform = 0, dir = 0; - int engdir = 0, moddir = 0, cpuinfo = 0; + int moddir = 0, cpuinfo = 0; #if defined(_WIN32) int windows = 0; #endif @@ -75,9 +74,6 @@ opthelp: case OPT_D: dirty = dir = 1; break; - case OPT_E: - dirty = engdir = 1; - break; case OPT_M: dirty = moddir = 1; break; @@ -106,7 +102,7 @@ opthelp: #endif case OPT_A: seed = options = cflags = version = date = platform - = dir = engdir = moddir = cpuinfo + = dir = moddir = cpuinfo = 1; break; } @@ -135,8 +131,6 @@ opthelp: printf("%s\n", OpenSSL_version(OPENSSL_CFLAGS)); if (dir) printf("%s\n", OpenSSL_version(OPENSSL_DIR)); - if (engdir) - printf("%s\n", OpenSSL_version(OPENSSL_ENGINES_DIR)); if (moddir) printf("%s\n", OpenSSL_version(OPENSSL_MODULES_DIR)); if (seed) { diff --git a/apps/x509.c b/apps/x509.c index d8c8dc9ae6..ac8a72dce2 100644 --- a/apps/x509.c +++ b/apps/x509.c @@ -53,7 +53,7 @@ typedef enum OPTION_choice { OPT_CHECKEMAIL, OPT_CHECKIP, OPT_NOOUT, OPT_TRUSTOUT, OPT_CLRTRUST, OPT_CLRREJECT, OPT_ALIAS, OPT_CACREATESERIAL, OPT_CLREXT, OPT_OCSPID, OPT_SUBJECT_HASH_OLD, OPT_ISSUER_HASH_OLD, OPT_COPY_EXTENSIONS, - OPT_BADSIG, OPT_MD, OPT_ENGINE, OPT_NOCERT, OPT_PRESERVE_DATES, + OPT_BADSIG, OPT_MD, OPT_NOCERT, OPT_PRESERVE_DATES, OPT_NOT_BEFORE, OPT_NOT_AFTER, OPT_R_ENUM, OPT_PROV_ENUM, OPT_EXT } OPTION_CHOICE; @@ -78,8 +78,7 @@ const OPTIONS x509_options[] = { "Key for signing, and to include unless using -force_pubkey"}, {"signkey", OPT_SIGNKEY, 's', "Same as -key"}, - {"keyform", OPT_KEYFORM, 'E', - "Key input format (ENGINE, other values ignored)"}, + {"keyform", OPT_KEYFORM, 'f', "Key input format (DER/PEM)"}, {"out", OPT_OUT, '>', "Output file - default stdout"}, {"outform", OPT_OUTFORM, 'f', "Output format (DER or PEM) - default PEM"}, @@ -165,8 +164,7 @@ const OPTIONS x509_options[] = { "Use the given CA certificate, conflicts with -key"}, {"CAform", OPT_CAFORM, 'F', "CA cert format (PEM/DER/P12); has no effect"}, {"CAkey", OPT_CAKEY, 's', "The corresponding CA key; default is -CA arg"}, - {"CAkeyform", OPT_CAKEYFORM, 'E', - "CA key format (ENGINE, other values ignored)"}, + {"CAkeyform", OPT_CAKEYFORM, 'f', "CA key format (DER/PEM)"}, {"CAserial", OPT_CASERIAL, 's', "File that keeps track of CA-generated serial number"}, {"CAcreateserial", OPT_CACREATESERIAL, '-', @@ -183,9 +181,6 @@ const OPTIONS x509_options[] = { "Reject certificate for a given purpose"}, OPT_R_OPTIONS, -#ifndef OPENSSL_NO_ENGINE - {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, -#endif OPT_PROV_OPTIONS, {NULL} }; @@ -303,7 +298,6 @@ int x509_main(int argc, char **argv) unsigned long certflag = 0; int preserve_dates = 0; OPTION_CHOICE o; - ENGINE *e = NULL; #ifndef OPENSSL_NO_MD5 int subject_hash_old = 0, issuer_hash_old = 0; #endif @@ -483,9 +477,6 @@ int x509_main(int argc, char **argv) if (!set_nameopt(opt_arg())) goto opthelp; break; - case OPT_ENGINE: - e = setup_engine(opt_arg(), 0); - break; case OPT_EMAIL: email = ++num; break; @@ -663,12 +654,12 @@ int x509_main(int argc, char **argv) goto err; } if (privkeyfile != NULL) { - privkey = load_key(privkeyfile, keyformat, 0, passin, e, "private key"); + privkey = load_key(privkeyfile, keyformat, 0, passin, "private key"); if (privkey == NULL) goto err; } if (pubkeyfile != NULL) { - if ((pubkey = load_pubkey(pubkeyfile, keyformat, 0, NULL, e, + if ((pubkey = load_pubkey(pubkeyfile, keyformat, 0, NULL, "explicitly set public key")) == NULL) goto err; } @@ -956,7 +947,7 @@ int x509_main(int argc, char **argv) noout = 1; } else if (CAfile != NULL) { if ((CAkey = load_key(CAkeyfile, CAkeyformat, - 0, passin, e, "CA private key")) == NULL) + 0, passin, "CA private key")) == NULL) goto err; if (!X509_check_private_key(xca, CAkey)) { BIO_printf(bio_err, @@ -1172,7 +1163,6 @@ int x509_main(int argc, char **argv) ASN1_INTEGER_free(sno); sk_ASN1_OBJECT_pop_free(trust, ASN1_OBJECT_free); sk_ASN1_OBJECT_pop_free(reject, ASN1_OBJECT_free); - release_engine(e); clear_free(passin); return ret; } diff --git a/build.info b/build.info index 5bd9253744..1faec4d8de 100644 --- a/build.info +++ b/build.info @@ -8,9 +8,6 @@ ENDIF IF[{- !$disabled{demos} -}] SUBDIRS=demos ENDIF -IF[{- !$disabled{'deprecated-3.0'} -}] - SUBDIRS=engines -ENDIF SUBDIRS=exporters LIBS=libcrypto libssl @@ -463,7 +460,7 @@ DEPEND[openssl.pc]=libcrypto.pc libssl.pc GENERATE[builddata.pm]=util/mkinstallvars.pl \ PREFIX=. BINDIR=apps APPLINKDIR=ms \ LIBDIR= INCLUDEDIR=include "INCLUDEDIR=$(SRCDIR)/include" \ - ENGINESDIR=engines MODULESDIR=providers \ + MODULESDIR=providers \ libdir= CMAKECONFIGDIR= PKGCONFIGDIR= \ "VERSION=$(VERSION)" "LDLIBS=$(LIB_EX_LIBS)" diff --git a/crypto/asn1/a_digest.c b/crypto/asn1/a_digest.c index 67e8a96ba1..f485a19213 100644 --- a/crypto/asn1/a_digest.c +++ b/crypto/asn1/a_digest.c @@ -7,16 +7,12 @@ * https://www.openssl.org/source/license.html */ -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - #include #include #include #include "internal/cryptlib.h" -#include #include #include #include @@ -63,16 +59,8 @@ int ossl_asn1_item_digest_ex(const ASN1_ITEM *it, const EVP_MD *md, void *asn, if (i < 0 || str == NULL) return 0; - if (EVP_MD_get0_provider(md) == NULL) { -#if !defined(OPENSSL_NO_ENGINE) - ENGINE *tmpeng = ENGINE_get_digest_engine(EVP_MD_get_type(md)); - - if (tmpeng != NULL) - ENGINE_finish(tmpeng); - else -#endif - fetched_md = EVP_MD_fetch(libctx, EVP_MD_get0_name(md), propq); - } + if (EVP_MD_get0_provider(md) == NULL) + fetched_md = EVP_MD_fetch(libctx, EVP_MD_get0_name(md), propq); if (fetched_md == NULL) goto err; diff --git a/crypto/asn1/ameth_lib.c b/crypto/asn1/ameth_lib.c index 330e7559c8..f56d05e1ae 100644 --- a/crypto/asn1/ameth_lib.c +++ b/crypto/asn1/ameth_lib.c @@ -8,7 +8,7 @@ */ /* - * We need to use some engine deprecated APIs + * We need to use some EVP_PKEY_asn1 deprecated APIs */ #include "internal/deprecated.h" @@ -16,7 +16,6 @@ #include #include #include -#include #include "crypto/asn1.h" #include "crypto/evp.h" @@ -75,11 +74,10 @@ static const EVP_PKEY_ASN1_METHOD *pkey_asn1_find(int type) } /* - * Find an implementation of an ASN1 algorithm. If 'pe' is not NULL also - * search through engines and set *pe to a functional reference to the engine - * implementing 'type' or NULL if no engine implements it. + * Return ASN1 method for desired `type`, returns NULL if no method is found for + * `type`. If pe is not NULL, the function will set *pe to NULL to indicate no + * engine is used. */ - const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_find(ENGINE **pe, int type) { const EVP_PKEY_ASN1_METHOD *t; @@ -91,15 +89,6 @@ const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_find(ENGINE **pe, int type) type = t->pkey_base_id; } if (pe) { -#ifndef OPENSSL_NO_ENGINE - ENGINE *e; - /* type will contain the final unaliased type */ - e = ENGINE_get_pkey_asn1_meth_engine(type); - if (e) { - *pe = e; - return ENGINE_get_pkey_asn1_meth(e, type); - } -#endif *pe = NULL; } return t; @@ -114,20 +103,6 @@ const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_find_str(ENGINE **pe, if (len == -1) len = (int)strlen(str); if (pe) { -#ifndef OPENSSL_NO_ENGINE - ENGINE *e; - ameth = ENGINE_pkey_asn1_find_str(&e, str, len); - if (ameth) { - /* - * Convert structural into functional reference - */ - if (!ENGINE_init(e)) - ameth = NULL; - ENGINE_free(e); - *pe = e; - return ameth; - } -#endif *pe = NULL; } for (i = EVP_PKEY_asn1_get_count(); i-- > 0; ) { diff --git a/crypto/asn1/d2i_pr.c b/crypto/asn1/d2i_pr.c index d0c0be517b..7b9d55ec7a 100644 --- a/crypto/asn1/d2i_pr.c +++ b/crypto/asn1/d2i_pr.c @@ -7,16 +7,12 @@ * https://www.openssl.org/source/license.html */ -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - #include #include "internal/cryptlib.h" #include #include #include #include -#include #include #include #include "crypto/asn1.h" @@ -112,10 +108,6 @@ ossl_d2i_PrivateKey_legacy(int keytype, EVP_PKEY **a, const unsigned char **pp, } } else { ret = *a; -#ifndef OPENSSL_NO_ENGINE - ENGINE_finish(ret->engine); - ret->engine = NULL; -#endif } if (!EVP_PKEY_set_type(ret, keytype)) { diff --git a/crypto/build.info b/crypto/build.info index 8fed477fef..a6801047c8 100644 --- a/crypto/build.info +++ b/crypto/build.info @@ -4,7 +4,7 @@ SUBDIRS=objects buffer bio stack lhash hashtable rand evp asn1 pem x509 conf \ txt_db pkcs7 pkcs12 ui kdf store property \ md2 md4 md5 sha mdc2 ml_kem hmac ripemd whrlpool poly1305 \ siphash sm3 des aes rc2 rc4 rc5 idea aria bf cast camellia \ - seed sm4 chacha modes bn ec rsa dsa dh sm2 dso engine \ + seed sm4 chacha modes bn ec rsa dsa dh sm2 dso \ err comp http ocsp cms ts srp cmac ct async ess crmf cmp encode_decode \ ffc hpke thread lms ml_dsa slh_dsa diff --git a/crypto/cmac/cmac.c b/crypto/cmac/cmac.c index 75c342a4a3..ad357c8b8c 100644 --- a/crypto/cmac/cmac.c +++ b/crypto/cmac/cmac.c @@ -20,6 +20,7 @@ #include #include #include "crypto/cmac.h" +#include "internal/common.h" #define LOCAL_BUF_SIZE 2048 struct CMAC_CTX_st { @@ -109,14 +110,13 @@ int CMAC_CTX_copy(CMAC_CTX *out, const CMAC_CTX *in) } int ossl_cmac_init(CMAC_CTX *ctx, const void *key, size_t keylen, - const EVP_CIPHER *cipher, ENGINE *impl, - const OSSL_PARAM param[]) + const EVP_CIPHER *cipher, const OSSL_PARAM param[]) { static const unsigned char zero_iv[EVP_MAX_BLOCK_LENGTH] = { 0 }; int block_len; /* All zeros means restart */ - if (!key && !cipher && !impl && keylen == 0) { + if (key == NULL && cipher == NULL && keylen == 0) { /* Not initialised */ if (ctx->nlast_block == -1) return 0; @@ -133,13 +133,8 @@ int ossl_cmac_init(CMAC_CTX *ctx, const void *key, size_t keylen, if (cipher != NULL) { /* Ensure we can't use this ctx until we also have a key */ ctx->nlast_block = -1; - if (impl != NULL) { - if (!EVP_EncryptInit_ex(ctx->cctx, cipher, impl, NULL, NULL)) - return 0; - } else { - if (!EVP_EncryptInit_ex2(ctx->cctx, cipher, NULL, NULL, param)) - return 0; - } + if (!EVP_EncryptInit_ex2(ctx->cctx, cipher, NULL, NULL, param)) + return 0; } /* Non-NULL key means initialisation complete */ if (key != NULL) { @@ -174,7 +169,9 @@ int ossl_cmac_init(CMAC_CTX *ctx, const void *key, size_t keylen, int CMAC_Init(CMAC_CTX *ctx, const void *key, size_t keylen, const EVP_CIPHER *cipher, ENGINE *impl) { - return ossl_cmac_init(ctx, key, keylen, cipher, impl, NULL); + if (!ossl_assert(impl == NULL)) + return 0; + return ossl_cmac_init(ctx, key, keylen, cipher, NULL); } int CMAC_Update(CMAC_CTX *ctx, const void *in, size_t dlen) diff --git a/crypto/conf/conf_mall.c b/crypto/conf/conf_mall.c index bad19c96cc..67ec97ec3c 100644 --- a/crypto/conf/conf_mall.c +++ b/crypto/conf/conf_mall.c @@ -7,16 +7,12 @@ * https://www.openssl.org/source/license.html */ -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - #include #include #include "internal/cryptlib.h" #include #include #include -#include #include "internal/provider.h" #include "crypto/rand.h" #include "conf_local.h" @@ -28,9 +24,6 @@ void OPENSSL_load_builtin_modules(void) /* Add builtin modules here */ ASN1_add_oid_module(); ASN1_add_stable_module(); -#ifndef OPENSSL_NO_ENGINE - ENGINE_add_conf_module(); -#endif EVP_add_alg_module(); ossl_config_add_ssl_module(); ossl_provider_add_conf_module(); diff --git a/crypto/conf/conf_mod.c b/crypto/conf/conf_mod.c index 3559293f27..b1010ee9c6 100644 --- a/crypto/conf/conf_mod.c +++ b/crypto/conf/conf_mod.c @@ -7,9 +7,6 @@ * https://www.openssl.org/source/license.html */ -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - #include "internal/cryptlib.h" #include "internal/rcu.h" #include @@ -22,7 +19,6 @@ #include "internal/thread_once.h" #include #include -#include #include "conf_local.h" DEFINE_STACK_OF(CONF_MODULE) @@ -219,10 +215,6 @@ int CONF_modules_load_file(const char *filename, DEFINE_RUN_ONCE_STATIC(do_load_builtin_modules) { OPENSSL_load_builtin_modules(); -#ifndef OPENSSL_NO_ENGINE - /* Need to load ENGINEs */ - ENGINE_load_builtin_engines(); -#endif return 1; } diff --git a/crypto/conf/conf_sap.c b/crypto/conf/conf_sap.c index 106434dcbf..8d65b393ab 100644 --- a/crypto/conf/conf_sap.c +++ b/crypto/conf/conf_sap.c @@ -14,7 +14,6 @@ #include "conf_local.h" #include #include -#include #if defined(_WIN32) && !defined(__BORLANDC__) # define strdup _strdup diff --git a/crypto/cversion.c b/crypto/cversion.c index eaa6ac0d65..1d21c1b70c 100644 --- a/crypto/cversion.c +++ b/crypto/cversion.c @@ -52,9 +52,6 @@ extern char ossl_cpu_info_str[]; /* size: MAX_PATH + sizeof("OPENSSLDIR: \"\"") */ static char openssldir[MAX_PATH + 15]; -/* size: MAX_PATH + sizeof("ENGINESDIR: \"\"") */ -static char enginesdir[MAX_PATH + 15]; - /* size: MAX_PATH + sizeof("MODULESDIR: \"\"") */ static char modulesdir[MAX_PATH + 15]; @@ -64,8 +61,6 @@ DEFINE_RUN_ONCE_STATIC(version_strings_setup) { BIO_snprintf(openssldir, sizeof(openssldir), "OPENSSLDIR: \"%s\"", ossl_get_openssldir()); - BIO_snprintf(enginesdir, sizeof(enginesdir), "ENGINESDIR: \"%s\"", - ossl_get_enginesdir()); BIO_snprintf(modulesdir, sizeof(modulesdir), "MODULESDIR: \"%s\"", ossl_get_modulesdir()); return 1; @@ -99,8 +94,6 @@ const char *OpenSSL_version(int t) #if defined(_WIN32) && defined(OSSL_WINCTX) case OPENSSL_DIR: return openssldir; - case OPENSSL_ENGINES_DIR: - return enginesdir; case OPENSSL_MODULES_DIR: return modulesdir; #else @@ -109,12 +102,6 @@ const char *OpenSSL_version(int t) return "OPENSSLDIR: \"" OPENSSLDIR "\""; # else return "OPENSSLDIR: N/A"; -# endif - case OPENSSL_ENGINES_DIR: -# ifdef ENGINESDIR - return "ENGINESDIR: \"" ENGINESDIR "\""; -# else - return "ENGINESDIR: N/A"; # endif case OPENSSL_MODULES_DIR: # ifdef MODULESDIR @@ -134,6 +121,8 @@ const char *OpenSSL_version(int t) #else return "OSSL_WINCTX: Undefined"; #endif + case OPENSSL_ENGINES_DIR: + return "ENGINESDIR: N/A"; } return "not available"; } diff --git a/crypto/defaults.c b/crypto/defaults.c index 727781b3cc..debf134850 100644 --- a/crypto/defaults.c +++ b/crypto/defaults.c @@ -32,17 +32,6 @@ static char openssldir[MAX_PATH + 1]; */ static char *openssldirptr = NULL; -/** - * @brief The directory where OpenSSL engines are located. - */ - -static char enginesdir[MAX_PATH + 1]; - -/** - * @brief The pointer to the enginesdir buffer - */ -static char *enginesdirptr = NULL; - /** * @brief The directory where OpenSSL modules are located. */ @@ -122,7 +111,6 @@ static CRYPTO_ONCE defaults_setup_init = CRYPTO_ONCE_STATIC_INIT; DEFINE_RUN_ONCE_STATIC(do_defaults_setup) { get_windows_regdirs(openssldir, sizeof(openssldir), L"OPENSSLDIR"); - get_windows_regdirs(enginesdir, sizeof(enginesdir), L"ENGINESDIR"); get_windows_regdirs(modulesdir, sizeof(modulesdir), L"MODULESDIR"); /* @@ -131,9 +119,6 @@ DEFINE_RUN_ONCE_STATIC(do_defaults_setup) if (strlen(openssldir) > 0) openssldirptr = openssldir; - if (strlen(enginesdir) > 0) - enginesdirptr = enginesdir; - if (strlen(modulesdir) > 0) modulesdirptr = modulesdir; @@ -157,22 +142,6 @@ const char *ossl_get_openssldir(void) #endif } -/** - * @brief Get the directory where OpenSSL engines are located. - * - * @return A pointer to a string containing the engines directory path. - */ -const char *ossl_get_enginesdir(void) -{ -#if defined(_WIN32) && defined (OSSL_WINCTX) - if (!RUN_ONCE(&defaults_setup_init, do_defaults_setup)) - return NULL; - return (const char *)enginesdirptr; -#else - return ENGINESDIR; -#endif -} - /** * @brief Get the directory where OpenSSL modules are located. * diff --git a/crypto/dh/dh_backend.c b/crypto/dh/dh_backend.c index b15284cfff..ee7a67b71b 100644 --- a/crypto/dh/dh_backend.c +++ b/crypto/dh/dh_backend.c @@ -124,7 +124,7 @@ int ossl_dh_key_todata(DH *dh, OSSL_PARAM_BLD *bld, OSSL_PARAM *pubkey, int ossl_dh_is_foreign(const DH *dh) { #ifndef FIPS_MODULE - if (dh->engine != NULL || ossl_dh_get_method(dh) != DH_OpenSSL()) + if (ossl_dh_get_method(dh) != DH_OpenSSL()) return 1; #endif return 0; diff --git a/crypto/dh/dh_lib.c b/crypto/dh/dh_lib.c index 93e08b3f8c..6c714e41f2 100644 --- a/crypto/dh/dh_lib.c +++ b/crypto/dh/dh_lib.c @@ -15,18 +15,16 @@ #include #include -#ifndef FIPS_MODULE -# include -#endif #include #include #include "internal/cryptlib.h" #include "internal/refcount.h" +#include "internal/common.h" #include "crypto/evp.h" #include "crypto/dh.h" #include "dh_local.h" -static DH *dh_new_intern(ENGINE *engine, OSSL_LIB_CTX *libctx); +static DH *dh_new_intern(OSSL_LIB_CTX *libctx); #ifndef FIPS_MODULE int DH_set_method(DH *dh, const DH_METHOD *meth) @@ -39,10 +37,6 @@ int DH_set_method(DH *dh, const DH_METHOD *meth) mtmp = dh->meth; if (mtmp->finish) mtmp->finish(dh); -#ifndef OPENSSL_NO_ENGINE - ENGINE_finish(dh->engine); - dh->engine = NULL; -#endif dh->meth = meth; if (meth->init) meth->init(dh); @@ -56,22 +50,24 @@ const DH_METHOD *ossl_dh_get_method(const DH *dh) # ifndef OPENSSL_NO_DEPRECATED_3_0 DH *DH_new(void) { - return dh_new_intern(NULL, NULL); + return dh_new_intern(NULL); } # endif DH *DH_new_method(ENGINE *engine) { - return dh_new_intern(engine, NULL); + if (!ossl_assert(engine == NULL)) + return NULL; + return dh_new_intern(NULL); } #endif /* !FIPS_MODULE */ DH *ossl_dh_new_ex(OSSL_LIB_CTX *libctx) { - return dh_new_intern(NULL, libctx); + return dh_new_intern(libctx); } -static DH *dh_new_intern(ENGINE *engine, OSSL_LIB_CTX *libctx) +static DH *dh_new_intern(OSSL_LIB_CTX *libctx) { DH *ret = OPENSSL_zalloc(sizeof(*ret)); @@ -93,25 +89,6 @@ static DH *dh_new_intern(ENGINE *engine, OSSL_LIB_CTX *libctx) ret->libctx = libctx; ret->meth = DH_get_default_method(); -#if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_ENGINE) - ret->flags = ret->meth->flags; /* early default init */ - if (engine) { - if (!ENGINE_init(engine)) { - ERR_raise(ERR_LIB_DH, ERR_R_ENGINE_LIB); - goto err; - } - ret->engine = engine; - } else - ret->engine = ENGINE_get_default_DH(); - if (ret->engine) { - ret->meth = ENGINE_get_DH(ret->engine); - if (ret->meth == NULL) { - ERR_raise(ERR_LIB_DH, ERR_R_ENGINE_LIB); - goto err; - } - } -#endif - ret->flags = ret->meth->flags; #ifndef FIPS_MODULE @@ -149,9 +126,6 @@ void DH_free(DH *r) if (r->meth != NULL && r->meth->finish != NULL) r->meth->finish(r); #if !defined(FIPS_MODULE) -# if !defined(OPENSSL_NO_ENGINE) - ENGINE_finish(r->engine); -# endif CRYPTO_free_ex_data(CRYPTO_EX_INDEX_DH, r, &r->ex_data); #endif @@ -319,13 +293,6 @@ void DH_set_flags(DH *dh, int flags) dh->flags |= flags; } -#ifndef FIPS_MODULE -ENGINE *DH_get0_engine(DH *dh) -{ - return dh->engine; -} -#endif /*FIPS_MODULE */ - FFC_PARAMS *ossl_dh_get0_params(DH *dh) { return &dh->params; diff --git a/crypto/dh/dh_local.h b/crypto/dh/dh_local.h index 1ff075e3dc..e4cba4c301 100644 --- a/crypto/dh/dh_local.h +++ b/crypto/dh/dh_local.h @@ -30,7 +30,6 @@ struct dh_st { CRYPTO_REF_COUNT references; #ifndef FIPS_MODULE CRYPTO_EX_DATA ex_data; - ENGINE *engine; #endif OSSL_LIB_CTX *libctx; const DH_METHOD *meth; diff --git a/crypto/dsa/dsa_backend.c b/crypto/dsa/dsa_backend.c index 8bd4b8ad7e..99f417cad7 100644 --- a/crypto/dsa/dsa_backend.c +++ b/crypto/dsa/dsa_backend.c @@ -66,7 +66,7 @@ int ossl_dsa_key_fromdata(DSA *dsa, const OSSL_PARAM params[], int ossl_dsa_is_foreign(const DSA *dsa) { #ifndef FIPS_MODULE - if (dsa->engine != NULL || DSA_get_method((DSA *)dsa) != DSA_OpenSSL()) + if (DSA_get_method((DSA *)dsa) != DSA_OpenSSL()) return 1; #endif return 0; diff --git a/crypto/dsa/dsa_lib.c b/crypto/dsa/dsa_lib.c index db6e3b059b..53097e7306 100644 --- a/crypto/dsa/dsa_lib.c +++ b/crypto/dsa/dsa_lib.c @@ -14,16 +14,14 @@ #include "internal/deprecated.h" #include -#ifndef FIPS_MODULE -# include -#endif #include "internal/cryptlib.h" #include "internal/refcount.h" +#include "internal/common.h" #include "crypto/dsa.h" #include "crypto/dh.h" /* required by DSA_dup_DH() */ #include "dsa_local.h" -static DSA *dsa_new_intern(ENGINE *engine, OSSL_LIB_CTX *libctx); +static DSA *dsa_new_intern(OSSL_LIB_CTX *libctx); #ifndef FIPS_MODULE @@ -98,11 +96,6 @@ void DSA_set_flags(DSA *d, int flags) d->flags |= flags; } -ENGINE *DSA_get0_engine(DSA *d) -{ - return d->engine; -} - int DSA_set_method(DSA *dsa, const DSA_METHOD *meth) { /* @@ -113,10 +106,6 @@ int DSA_set_method(DSA *dsa, const DSA_METHOD *meth) mtmp = dsa->meth; if (mtmp->finish) mtmp->finish(dsa); -#ifndef OPENSSL_NO_ENGINE - ENGINE_finish(dsa->engine); - dsa->engine = NULL; -#endif dsa->meth = meth; if (meth->init) meth->init(dsa); @@ -130,7 +119,7 @@ const DSA_METHOD *DSA_get_method(DSA *d) return d->meth; } -static DSA *dsa_new_intern(ENGINE *engine, OSSL_LIB_CTX *libctx) +static DSA *dsa_new_intern(OSSL_LIB_CTX *libctx) { DSA *ret = OPENSSL_zalloc(sizeof(*ret)); @@ -152,24 +141,6 @@ static DSA *dsa_new_intern(ENGINE *engine, OSSL_LIB_CTX *libctx) ret->libctx = libctx; ret->meth = DSA_get_default_method(); -#if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_ENGINE) - ret->flags = ret->meth->flags & ~DSA_FLAG_NON_FIPS_ALLOW; /* early default init */ - if (engine) { - if (!ENGINE_init(engine)) { - ERR_raise(ERR_LIB_DSA, ERR_R_ENGINE_LIB); - goto err; - } - ret->engine = engine; - } else - ret->engine = ENGINE_get_default_DSA(); - if (ret->engine) { - ret->meth = ENGINE_get_DSA(ret->engine); - if (ret->meth == NULL) { - ERR_raise(ERR_LIB_DSA, ERR_R_ENGINE_LIB); - goto err; - } - } -#endif ret->flags = ret->meth->flags & ~DSA_FLAG_NON_FIPS_ALLOW; @@ -195,18 +166,20 @@ static DSA *dsa_new_intern(ENGINE *engine, OSSL_LIB_CTX *libctx) DSA *DSA_new_method(ENGINE *engine) { - return dsa_new_intern(engine, NULL); + if (!ossl_assert(engine == NULL)) + return NULL; + return dsa_new_intern(NULL); } DSA *ossl_dsa_new(OSSL_LIB_CTX *libctx) { - return dsa_new_intern(NULL, libctx); + return dsa_new_intern(libctx); } #ifndef FIPS_MODULE DSA *DSA_new(void) { - return dsa_new_intern(NULL, NULL); + return dsa_new_intern(NULL); } #endif @@ -225,9 +198,6 @@ void DSA_free(DSA *r) if (r->meth != NULL && r->meth->finish != NULL) r->meth->finish(r); -#if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_ENGINE) - ENGINE_finish(r->engine); -#endif #ifndef FIPS_MODULE CRYPTO_free_ex_data(CRYPTO_EX_INDEX_DSA, r, &r->ex_data); diff --git a/crypto/dsa/dsa_local.h b/crypto/dsa/dsa_local.h index 38cb64a829..341f039e4f 100644 --- a/crypto/dsa/dsa_local.h +++ b/crypto/dsa/dsa_local.h @@ -29,8 +29,6 @@ struct dsa_st { CRYPTO_EX_DATA ex_data; #endif const DSA_METHOD *meth; - /* functional reference if 'meth' is ENGINE-provided */ - ENGINE *engine; CRYPTO_RWLOCK *lock; OSSL_LIB_CTX *libctx; diff --git a/crypto/ec/ec_backend.c b/crypto/ec/ec_backend.c index f0191a7db3..a5c0020dc9 100644 --- a/crypto/ec/ec_backend.c +++ b/crypto/ec/ec_backend.c @@ -18,7 +18,6 @@ #include #include #ifndef FIPS_MODULE -# include # include #endif #include "crypto/bn.h" @@ -587,7 +586,7 @@ int ossl_ec_key_otherparams_fromdata(EC_KEY *ec, const OSSL_PARAM params[]) int ossl_ec_key_is_foreign(const EC_KEY *ec) { #ifndef FIPS_MODULE - if (ec->engine != NULL || EC_KEY_get_method(ec) != EC_KEY_OpenSSL()) + if (EC_KEY_get_method(ec) != EC_KEY_OpenSSL()) return 1; #endif return 0; @@ -603,8 +602,7 @@ EC_KEY *ossl_ec_key_dup(const EC_KEY *src, int selection) return NULL; } - if ((ret = ossl_ec_key_new_method_int(src->libctx, src->propq, - src->engine)) == NULL) + if ((ret = ossl_ec_key_new_method_int(src->libctx, src->propq)) == NULL) return NULL; /* copy the parameters */ diff --git a/crypto/ec/ec_key.c b/crypto/ec/ec_key.c index 8adc6e8996..46b4db87dc 100644 --- a/crypto/ec/ec_key.c +++ b/crypto/ec/ec_key.c @@ -19,9 +19,6 @@ #include "ec_local.h" #include "internal/refcount.h" #include -#ifndef FIPS_MODULE -# include -#endif #include #include "prov/providercommon.h" #include "prov/ecx.h" @@ -33,13 +30,13 @@ static int ecdsa_keygen_pairwise_test(EC_KEY *eckey, OSSL_CALLBACK *cb, #ifndef FIPS_MODULE EC_KEY *EC_KEY_new(void) { - return ossl_ec_key_new_method_int(NULL, NULL, NULL); + return ossl_ec_key_new_method_int(NULL, NULL); } #endif EC_KEY *EC_KEY_new_ex(OSSL_LIB_CTX *ctx, const char *propq) { - return ossl_ec_key_new_method_int(ctx, propq, NULL); + return ossl_ec_key_new_method_int(ctx, propq); } EC_KEY *EC_KEY_new_by_curve_name_ex(OSSL_LIB_CTX *ctx, const char *propq, @@ -84,10 +81,6 @@ void EC_KEY_free(EC_KEY *r) if (r->meth != NULL && r->meth->finish != NULL) r->meth->finish(r); -#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) - ENGINE_finish(r->engine); -#endif - if (r->group && r->group->meth->keyfinish) r->group->meth->keyfinish(r); @@ -114,11 +107,6 @@ EC_KEY *EC_KEY_copy(EC_KEY *dest, const EC_KEY *src) dest->meth->finish(dest); if (dest->group && dest->group->meth->keyfinish) dest->group->meth->keyfinish(dest); -#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) - if (ENGINE_finish(dest->engine) == 0) - return 0; - dest->engine = NULL; -#endif } dest->libctx = src->libctx; /* copy the parameters */ @@ -169,11 +157,6 @@ EC_KEY *EC_KEY_copy(EC_KEY *dest, const EC_KEY *src) #endif if (src->meth != dest->meth) { -#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) - if (src->engine != NULL && ENGINE_init(src->engine) == 0) - return NULL; - dest->engine = src->engine; -#endif dest->meth = src->meth; } @@ -202,11 +185,6 @@ int EC_KEY_up_ref(EC_KEY *r) return ((i > 1) ? 1 : 0); } -ENGINE *EC_KEY_get0_engine(const EC_KEY *eckey) -{ - return eckey->engine; -} - int EC_KEY_generate_key(EC_KEY *eckey) { if (eckey == NULL || eckey->group == NULL) { diff --git a/crypto/ec/ec_kmeth.c b/crypto/ec/ec_kmeth.c index 5c9ef4807d..88323d69ba 100644 --- a/crypto/ec/ec_kmeth.c +++ b/crypto/ec/ec_kmeth.c @@ -15,13 +15,9 @@ #include #include -#ifndef FIPS_MODULE -# include -#endif #include #include "ec_local.h" - static const EC_KEY_METHOD openssl_ec_key_method = { "OpenSSL EC_KEY method", 0, @@ -67,19 +63,13 @@ int EC_KEY_set_method(EC_KEY *key, const EC_KEY_METHOD *meth) if (finish != NULL) finish(key); -#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) - ENGINE_finish(key->engine); - key->engine = NULL; -#endif - key->meth = meth; if (meth->init != NULL) return meth->init(key); return 1; } -EC_KEY *ossl_ec_key_new_method_int(OSSL_LIB_CTX *libctx, const char *propq, - ENGINE *engine) +EC_KEY *ossl_ec_key_new_method_int(OSSL_LIB_CTX *libctx, const char *propq) { EC_KEY *ret = OPENSSL_zalloc(sizeof(*ret)); @@ -99,24 +89,6 @@ EC_KEY *ossl_ec_key_new_method_int(OSSL_LIB_CTX *libctx, const char *propq, } ret->meth = EC_KEY_get_default_method(); -#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) - if (engine != NULL) { - if (!ENGINE_init(engine)) { - ERR_raise(ERR_LIB_EC, ERR_R_ENGINE_LIB); - goto err; - } - ret->engine = engine; - } else - ret->engine = ENGINE_get_default_EC(); - if (ret->engine != NULL) { - ret->meth = ENGINE_get_EC(ret->engine); - if (ret->meth == NULL) { - ERR_raise(ERR_LIB_EC, ERR_R_ENGINE_LIB); - goto err; - } - } -#endif - ret->version = 1; ret->conv_form = POINT_CONVERSION_UNCOMPRESSED; @@ -140,9 +112,11 @@ EC_KEY *ossl_ec_key_new_method_int(OSSL_LIB_CTX *libctx, const char *propq, } #ifndef FIPS_MODULE -EC_KEY *EC_KEY_new_method(ENGINE *engine) +EC_KEY *EC_KEY_new_method(ossl_unused ENGINE *engine) { - return ossl_ec_key_new_method_int(NULL, NULL, engine); + if (engine != NULL) + return NULL; + return ossl_ec_key_new_method_int(NULL, NULL); } #endif diff --git a/crypto/ec/ec_local.h b/crypto/ec/ec_local.h index 91c3a71902..80729f370f 100644 --- a/crypto/ec/ec_local.h +++ b/crypto/ec/ec_local.h @@ -289,7 +289,6 @@ struct ec_group_st { struct ec_key_st { const EC_KEY_METHOD *meth; - ENGINE *engine; int version; EC_GROUP *group; EC_POINT *pub_key; @@ -692,8 +691,7 @@ struct ec_key_method_st { #define EC_KEY_METHOD_DYNAMIC 1 -EC_KEY *ossl_ec_key_new_method_int(OSSL_LIB_CTX *libctx, const char *propq, - ENGINE *engine); +EC_KEY *ossl_ec_key_new_method_int(OSSL_LIB_CTX *libctx, const char *propq); int ossl_ec_key_gen(EC_KEY *eckey); int ossl_ecdh_compute_key(unsigned char **pout, size_t *poutlen, diff --git a/crypto/engine/README.md b/crypto/engine/README.md deleted file mode 100644 index b45115ca24..0000000000 --- a/crypto/engine/README.md +++ /dev/null @@ -1,210 +0,0 @@ -Notes on engines of 2001-09-24 -============================== - -This "description" (if one chooses to call it that) needed some major updating -so here goes. This update addresses a change being made at the same time to -OpenSSL, and it pretty much completely restructures the underlying mechanics of -the "ENGINE" code. So it serves a double purpose of being a "ENGINE internals -for masochists" document *and* a rather extensive commit log message. (I'd get -lynched for sticking all this in CHANGES.md or the commit mails :-). - -ENGINE_TABLE underlies this restructuring, as described in the internal header -"eng_local.h", implemented in eng_table.c, and used in each of the "class" files; -tb_rsa.c, tb_dsa.c, etc. - -However, "EVP_CIPHER" underlies the motivation and design of ENGINE_TABLE so -I'll mention a bit about that first. EVP_CIPHER (and most of this applies -equally to EVP_MD for digests) is both a "method" and a algorithm/mode -identifier that, in the current API, "lingers". These cipher description + -implementation structures can be defined or obtained directly by applications, -or can be loaded "en masse" into EVP storage so that they can be catalogued and -searched in various ways, ie. two ways of encrypting with the "des_cbc" -algorithm/mode pair are; - - (i) directly; - const EVP_CIPHER *cipher = EVP_des_cbc(); - EVP_EncryptInit(&ctx, cipher, key, iv); - [ ... use EVP_EncryptUpdate() and EVP_EncryptFinal() ...] - - (ii) indirectly; - OpenSSL_add_all_ciphers(); - cipher = EVP_get_cipherbyname("des_cbc"); - EVP_EncryptInit(&ctx, cipher, key, iv); - [ ... etc ... ] - -The latter is more generally used because it also allows ciphers/digests to be -looked up based on other identifiers which can be useful for automatic cipher -selection, eg. in SSL/TLS, or by user-controllable configuration. - -The important point about this is that EVP_CIPHER definitions and structures are -passed around with impunity and there is no safe way, without requiring massive -rewrites of many applications, to assume that EVP_CIPHERs can be reference -counted. One an EVP_CIPHER is exposed to the caller, neither it nor anything it -comes from can "safely" be destroyed. Unless of course the way of getting to -such ciphers is via entirely distinct API calls that didn't exist before. -However existing API usage cannot be made to understand when an EVP_CIPHER -pointer, that has been passed to the caller, is no longer being used. - -The other problem with the existing API w.r.t. to hooking EVP_CIPHER support -into ENGINE is storage - the OBJ_NAME-based storage used by EVP to register -ciphers simultaneously registers cipher *types* and cipher *implementations* - -they are effectively the same thing, an "EVP_CIPHER" pointer. The problem with -hooking in ENGINEs is that multiple ENGINEs may implement the same ciphers. The -solution is necessarily that ENGINE-provided ciphers simply are not registered, -stored, or exposed to the caller in the same manner as existing ciphers. This is -especially necessary considering the fact ENGINE uses reference counts to allow -for cleanup, modularity, and DSO support - yet EVP_CIPHERs, as exposed to -callers in the current API, support no such controls. - -Another sticking point for integrating cipher support into ENGINE is linkage. -Already there is a problem with the way ENGINE supports RSA, DSA, etc whereby -they are available *because* they're part of a giant ENGINE called "openssl". -Ie. all implementations *have* to come from an ENGINE, but we get round that by -having a giant ENGINE with all the software support encapsulated. This creates -linker hassles if nothing else - linking a 1-line application that calls 2 basic -RSA functions (eg. "RSA_free(RSA_new());") will result in large quantities of -ENGINE code being linked in *and* because of that DSA, DH, and RAND also. If we -continue with this approach for EVP_CIPHER support (even if it *was* possible) -we would lose our ability to link selectively by selectively loading certain -implementations of certain functionality. Touching any part of any kind of -crypto would result in massive static linkage of everything else. So the -solution is to change the way ENGINE feeds existing "classes", ie. how the -hooking to ENGINE works from RSA, DSA, DH, RAND, as well as adding new hooking -for EVP_CIPHER, and EVP_MD. - -The way this is now being done is by mostly reverting back to how things used to -work prior to ENGINE :-). Ie. RSA now has a "RSA_METHOD" pointer again - this -was previously replaced by an "ENGINE" pointer and all RSA code that required -the RSA_METHOD would call ENGINE_get_RSA() each time on its ENGINE handle to -temporarily get and use the ENGINE's RSA implementation. Apart from being more -efficient, switching back to each RSA having an RSA_METHOD pointer also allows -us to conceivably operate with *no* ENGINE. As we'll see, this removes any need -for a fallback ENGINE that encapsulates default implementations - we can simply -have our RSA structure pointing its RSA_METHOD pointer to the software -implementation and have its ENGINE pointer set to NULL. - -A look at the EVP_CIPHER hooking is most explanatory, the RSA, DSA (etc) cases -turn out to be degenerate forms of the same thing. The EVP storage of ciphers, -and the existing EVP API functions that return "software" implementations and -descriptions remain untouched. However, the storage takes more meaning in terms -of "cipher description" and less meaning in terms of "implementation". When an -EVP_CIPHER_CTX is actually initialised with an EVP_CIPHER method and is about to -begin en/decryption, the hooking to ENGINE comes into play. What happens is that -cipher-specific ENGINE code is asked for an ENGINE pointer (a functional -reference) for any ENGINE that is registered to perform the algo/mode that the -provided EVP_CIPHER structure represents. Under normal circumstances, that -ENGINE code will return NULL because no ENGINEs will have had any cipher -implementations *registered*. As such, a NULL ENGINE pointer is stored in the -EVP_CIPHER_CTX context, and the EVP_CIPHER structure is left hooked into the -context and so is used as the implementation. Pretty much how things work now -except we'd have a redundant ENGINE pointer set to NULL and doing nothing. - -Conversely, if an ENGINE *has* been registered to perform the algorithm/mode -combination represented by the provided EVP_CIPHER, then a functional reference -to that ENGINE will be returned to the EVP_CIPHER_CTX during initialisation. -That functional reference will be stored in the context (and released on -cleanup) - and having that reference provides a *safe* way to use an EVP_CIPHER -definition that is private to the ENGINE. Ie. the EVP_CIPHER provided by the -application will actually be replaced by an EVP_CIPHER from the registered -ENGINE - it will support the same algorithm/mode as the original but will be a -completely different implementation. Because this EVP_CIPHER isn't stored in the -EVP storage, nor is it returned to applications from traditional API functions, -there is no associated problem with it not having reference counts. And of -course, when one of these "private" cipher implementations is hooked into -EVP_CIPHER_CTX, it is done whilst the EVP_CIPHER_CTX holds a functional -reference to the ENGINE that owns it, thus the use of the ENGINE's EVP_CIPHER is -safe. - -The "cipher-specific ENGINE code" I mentioned is implemented in tb_cipher.c but -in essence it is simply an instantiation of "ENGINE_TABLE" code for use by -EVP_CIPHER code. tb_digest.c is virtually identical but, of course, it is for -use by EVP_MD code. Ditto for tb_rsa.c, tb_dsa.c, etc. These instantiations of -ENGINE_TABLE essentially provide linker-separation of the classes so that even -if ENGINEs implement *all* possible algorithms, an application using only -EVP_CIPHER code will link at most code relating to EVP_CIPHER, tb_cipher.c, core -ENGINE code that is independent of class, and of course the ENGINE -implementation that the application loaded. It will *not* however link any -class-specific ENGINE code for digests, RSA, etc nor will it bleed over into -other APIs, such as the RSA/DSA/etc library code. - -ENGINE_TABLE is a little more complicated than may seem necessary but this is -mostly to avoid a lot of "init()"-thrashing on ENGINEs (that may have to load -DSOs, and other expensive setup that shouldn't be thrashed unnecessarily) *and* -to duplicate "default" behaviour. Basically an ENGINE_TABLE instantiation, for -example tb_cipher.c, implements a hash-table keyed by integer "nid" values. -These nids provide the uniquenness of an algorithm/mode - and each nid will hash -to a potentially NULL "ENGINE_PILE". An ENGINE_PILE is essentially a list of -pointers to ENGINEs that implement that particular 'nid'. Each "pile" uses some -caching tricks such that requests on that 'nid' will be cached and all future -requests will return immediately (well, at least with minimal operation) unless -a change is made to the pile, eg. perhaps an ENGINE was unloaded. The reason is -that an application could have support for 10 ENGINEs statically linked -in, and the machine in question may not have any of the hardware those 10 -ENGINEs support. If each of those ENGINEs has a "des_cbc" implementation, we -want to avoid every EVP_CIPHER_CTX setup from trying (and failing) to initialise -each of those 10 ENGINEs. Instead, the first such request will try to do that -and will either return (and cache) a NULL ENGINE pointer or will return a -functional reference to the first that successfully initialised. In the latter -case it will also cache an extra functional reference to the ENGINE as a -"default" for that 'nid'. The caching is acknowledged by a 'uptodate' variable -that is unset only if un/registration takes place on that pile. Ie. if -implementations of "des_cbc" are added or removed. This behaviour can be -tweaked; the ENGINE_TABLE_FLAG_NOINIT value can be passed to -ENGINE_set_table_flags(), in which case the only ENGINEs that tb_cipher.c will -try to initialise from the "pile" will be those that are already initialised -(ie. it's simply an increment of the functional reference count, and no real -"initialisation" will take place). - -RSA, DSA, DH, and RAND all have their own ENGINE_TABLE code as well, and the -difference is that they all use an implicit 'nid' of 1. Whereas EVP_CIPHERs are -actually qualitatively different depending on 'nid' (the "des_cbc" EVP_CIPHER is -not an interoperable implementation of "aes_256_cbc"), RSA_METHODs are -necessarily interoperable and don't have different flavours, only different -implementations. In other words, the ENGINE_TABLE for RSA will either be empty, -or will have a single ENGINE_PILE hashed to by the 'nid' 1 and that pile -represents ENGINEs that implement the single "type" of RSA there is. - -Cleanup - the registration and unregistration may pose questions about how -cleanup works with the ENGINE_PILE doing all this caching nonsense (ie. when the -application or EVP_CIPHER code releases its last reference to an ENGINE, the -ENGINE_PILE code may still have references and thus those ENGINEs will stay -hooked in forever). The way this is handled is via "unregistration". With these -new ENGINE changes, an abstract ENGINE can be loaded and initialised, but that -is an algorithm-agnostic process. Even if initialised, it will not have -registered any of its implementations (to do so would link all class "table" -code despite the fact the application may use only ciphers, for example). This -is deliberately a distinct step. Moreover, registration and unregistration has -nothing to do with whether an ENGINE is *functional* or not (ie. you can even -register an ENGINE and its implementations without it being operational, you may -not even have the drivers to make it operate). What actually happens with -respect to cleanup is managed inside eng_lib.c with the `engine_cleanup_***` -functions. These functions are internal-only and each part of ENGINE code that -could require cleanup will, upon performing its first allocation, register a -callback with the "engine_cleanup" code. The other part of this that makes it -tick is that the ENGINE_TABLE instantiations (tb_***.c) use NULL as their -initialised state. So if RSA code asks for an ENGINE and no ENGINE has -registered an implementation, the code will simply return NULL and the tb_rsa.c -state will be unchanged. Thus, no cleanup is required unless registration takes -place. ENGINE_cleanup() will simply iterate across a list of registered cleanup -callbacks calling each in turn, and will then internally delete its own storage -(a STACK). When a cleanup callback is next registered (eg. if the cleanup() is -part of a graceful restart and the application wants to cleanup all state then -start again), the internal STACK storage will be freshly allocated. This is much -the same as the situation in the ENGINE_TABLE instantiations ... NULL is the -initialised state, so only modification operations (not queries) will cause that -code to have to register a cleanup. - -What else? The bignum callbacks and associated ENGINE functions have been -removed for two obvious reasons; (i) there was no way to generalise them to the -mechanism now used by RSA/DSA/..., because there's no such thing as a BIGNUM -method, and (ii) because of (i), there was no meaningful way for library or -application code to automatically hook and use ENGINE supplied bignum functions -anyway. Also, ENGINE_cpy() has been removed (although an internal-only version -exists) - the idea of providing an ENGINE_cpy() function probably wasn't a good -one and now certainly doesn't make sense in any generalised way. Some of the -RSA, DSA, DH, and RAND functions that were fiddled during the original ENGINE -changes have now, as a consequence, been reverted back. This is because the -hooking of ENGINE is now automatic (and passive, it can internally use a NULL -ENGINE pointer to simply ignore ENGINE from then on). - -Hell, that should be enough for now ... comments welcome. diff --git a/crypto/engine/build.info b/crypto/engine/build.info deleted file mode 100644 index 47fe948966..0000000000 --- a/crypto/engine/build.info +++ /dev/null @@ -1,8 +0,0 @@ -LIBS=../../libcrypto -SOURCE[../../libcrypto]=\ - eng_err.c eng_lib.c eng_list.c eng_init.c eng_ctrl.c \ - eng_table.c eng_pkey.c eng_fat.c eng_all.c \ - tb_rsa.c tb_dsa.c tb_dh.c tb_rand.c \ - tb_cipher.c tb_digest.c tb_pkmeth.c tb_asnmth.c tb_eckey.c \ - eng_openssl.c eng_cnf.c eng_dyn.c \ - eng_rdrand.c diff --git a/crypto/engine/eng_all.c b/crypto/engine/eng_all.c deleted file mode 100644 index 2f83b2ec18..0000000000 --- a/crypto/engine/eng_all.c +++ /dev/null @@ -1,24 +0,0 @@ -/* - * Copyright 2001-2018 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#include "internal/cryptlib.h" -#include "eng_local.h" - -void ENGINE_load_builtin_engines(void) -{ - OPENSSL_init_crypto(OPENSSL_INIT_ENGINE_ALL_BUILTIN, NULL); -} - -#ifndef OPENSSL_NO_DEPRECATED_1_1_0 -# if (defined(__OpenBSD__) || defined(__FreeBSD__) || defined(__DragonFly__)) -void ENGINE_setup_bsd_cryptodev(void) -{ -} -# endif -#endif diff --git a/crypto/engine/eng_cnf.c b/crypto/engine/eng_cnf.c deleted file mode 100644 index 14744bb7f5..0000000000 --- a/crypto/engine/eng_cnf.c +++ /dev/null @@ -1,185 +0,0 @@ -/* - * Copyright 2002-2020 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - -#include "eng_local.h" -#include -#include - -/* ENGINE config module */ - -static const char *skip_dot(const char *name) -{ - const char *p = strchr(name, '.'); - - if (p != NULL) - return p + 1; - return name; -} - -static STACK_OF(ENGINE) *initialized_engines = NULL; - -static int int_engine_init(ENGINE *e) -{ - if (!ENGINE_init(e)) - return 0; - if (!initialized_engines) - initialized_engines = sk_ENGINE_new_null(); - if (!initialized_engines || !sk_ENGINE_push(initialized_engines, e)) { - ENGINE_finish(e); - return 0; - } - return 1; -} - -static int int_engine_configure(const char *name, const char *value, const CONF *cnf) -{ - int i; - int ret = 0; - long do_init = -1; - STACK_OF(CONF_VALUE) *ecmds; - CONF_VALUE *ecmd = NULL; - const char *ctrlname, *ctrlvalue; - ENGINE *e = NULL; - int soft = 0; - - name = skip_dot(name); - OSSL_TRACE1(CONF, "Configuring engine %s\n", name); - /* Value is a section containing ENGINE commands */ - ecmds = NCONF_get_section(cnf, value); - - if (!ecmds) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_ENGINE_SECTION_ERROR); - return 0; - } - - for (i = 0; i < sk_CONF_VALUE_num(ecmds); i++) { - ecmd = sk_CONF_VALUE_value(ecmds, i); - ctrlname = skip_dot(ecmd->name); - ctrlvalue = ecmd->value; - OSSL_TRACE2(CONF, "ENGINE: doing ctrl(%s,%s)\n", - ctrlname, ctrlvalue); - - /* First handle some special pseudo ctrls */ - - /* Override engine name to use */ - if (strcmp(ctrlname, "engine_id") == 0) - name = ctrlvalue; - else if (strcmp(ctrlname, "soft_load") == 0) - soft = 1; - /* Load a dynamic ENGINE */ - else if (strcmp(ctrlname, "dynamic_path") == 0) { - e = ENGINE_by_id("dynamic"); - if (!e) - goto err; - if (!ENGINE_ctrl_cmd_string(e, "SO_PATH", ctrlvalue, 0)) - goto err; - if (!ENGINE_ctrl_cmd_string(e, "LIST_ADD", "2", 0)) - goto err; - if (!ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0)) - goto err; - } - /* ... add other pseudos here ... */ - else { - /* - * At this point we need an ENGINE structural reference if we - * don't already have one. - */ - if (!e) { - e = ENGINE_by_id(name); - if (!e && soft) { - ERR_clear_error(); - return 1; - } - if (!e) - goto err; - } - /* - * Allow "EMPTY" to mean no value: this allows a valid "value" to - * be passed to ctrls of type NO_INPUT - */ - if (strcmp(ctrlvalue, "EMPTY") == 0) - ctrlvalue = NULL; - if (strcmp(ctrlname, "init") == 0) { - if (!NCONF_get_number_e(cnf, value, "init", &do_init)) - goto err; - if (do_init == 1) { - if (!int_engine_init(e)) - goto err; - } else if (do_init != 0) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INVALID_INIT_VALUE); - goto err; - } - } else if (strcmp(ctrlname, "default_algorithms") == 0) { - if (!ENGINE_set_default_string(e, ctrlvalue)) - goto err; - } else if (!ENGINE_ctrl_cmd_string(e, ctrlname, ctrlvalue, 0)) - goto err; - } - - } - if (e && (do_init == -1) && !int_engine_init(e)) { - ecmd = NULL; - goto err; - } - ret = 1; - err: - if (ret != 1) { - if (ecmd == NULL) - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_ENGINE_CONFIGURATION_ERROR); - else - ERR_raise_data(ERR_LIB_ENGINE, ENGINE_R_ENGINE_CONFIGURATION_ERROR, - "section=%s, name=%s, value=%s", - ecmd->section, ecmd->name, ecmd->value); - } - ENGINE_free(e); - return ret; -} - -static int int_engine_module_init(CONF_IMODULE *md, const CONF *cnf) -{ - STACK_OF(CONF_VALUE) *elist; - CONF_VALUE *cval; - int i; - OSSL_TRACE2(CONF, "Called engine module: name %s, value %s\n", - CONF_imodule_get_name(md), CONF_imodule_get_value(md)); - /* Value is a section containing ENGINEs to configure */ - elist = NCONF_get_section(cnf, CONF_imodule_get_value(md)); - - if (!elist) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_ENGINES_SECTION_ERROR); - return 0; - } - - for (i = 0; i < sk_CONF_VALUE_num(elist); i++) { - cval = sk_CONF_VALUE_value(elist, i); - if (!int_engine_configure(cval->name, cval->value, cnf)) - return 0; - } - - return 1; -} - -static void int_engine_module_finish(CONF_IMODULE *md) -{ - ENGINE *e; - - while ((e = sk_ENGINE_pop(initialized_engines))) - ENGINE_finish(e); - sk_ENGINE_free(initialized_engines); - initialized_engines = NULL; -} - -void ENGINE_add_conf_module(void) -{ - CONF_module_add("engines", - int_engine_module_init, int_engine_module_finish); -} diff --git a/crypto/engine/eng_ctrl.c b/crypto/engine/eng_ctrl.c deleted file mode 100644 index 247575c99d..0000000000 --- a/crypto/engine/eng_ctrl.c +++ /dev/null @@ -1,322 +0,0 @@ -/* - * Copyright 2001-2025 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - -#include "eng_local.h" - -/* - * When querying a ENGINE-specific control command's 'description', this - * string is used if the ENGINE_CMD_DEFN has cmd_desc set to NULL. - */ -static const char *int_no_description = ""; - -/* - * These internal functions handle 'CMD'-related control commands when the - * ENGINE in question has asked us to take care of it (ie. the ENGINE did not - * set the ENGINE_FLAGS_MANUAL_CMD_CTRL flag. - */ - -static int int_ctrl_cmd_is_null(const ENGINE_CMD_DEFN *defn) -{ - if ((defn->cmd_num == 0) || (defn->cmd_name == NULL)) - return 1; - return 0; -} - -static int int_ctrl_cmd_by_name(const ENGINE_CMD_DEFN *defn, const char *s) -{ - int idx = 0; - while (!int_ctrl_cmd_is_null(defn) && (strcmp(defn->cmd_name, s) != 0)) { - idx++; - defn++; - } - if (int_ctrl_cmd_is_null(defn)) - /* The given name wasn't found */ - return -1; - return idx; -} - -static int int_ctrl_cmd_by_num(const ENGINE_CMD_DEFN *defn, unsigned int num) -{ - int idx = 0; - /* - * NB: It is stipulated that 'cmd_defn' lists are ordered by cmd_num. So - * our searches don't need to take any longer than necessary. - */ - while (!int_ctrl_cmd_is_null(defn) && (defn->cmd_num < num)) { - idx++; - defn++; - } - if (defn->cmd_num == num) - return idx; - /* The given cmd_num wasn't found */ - return -1; -} - -static int int_ctrl_helper(ENGINE *e, int cmd, long i, void *p, - void (*f) (void)) -{ - int idx; - char *s = (char *)p; - const ENGINE_CMD_DEFN *cdp; - - /* Take care of the easy one first (eg. it requires no searches) */ - if (cmd == ENGINE_CTRL_GET_FIRST_CMD_TYPE) { - if ((e->cmd_defns == NULL) || int_ctrl_cmd_is_null(e->cmd_defns)) - return 0; - return e->cmd_defns->cmd_num; - } - /* One or two commands require that "p" be a valid string buffer */ - if ((cmd == ENGINE_CTRL_GET_CMD_FROM_NAME) || - (cmd == ENGINE_CTRL_GET_NAME_FROM_CMD) || - (cmd == ENGINE_CTRL_GET_DESC_FROM_CMD)) { - if (s == NULL) { - ERR_raise(ERR_LIB_ENGINE, ERR_R_PASSED_NULL_PARAMETER); - return -1; - } - } - /* Now handle cmd_name -> cmd_num conversion */ - if (cmd == ENGINE_CTRL_GET_CMD_FROM_NAME) { - if ((e->cmd_defns == NULL) - || ((idx = int_ctrl_cmd_by_name(e->cmd_defns, s)) < 0)) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INVALID_CMD_NAME); - return -1; - } - return e->cmd_defns[idx].cmd_num; - } - /* - * For the rest of the commands, the 'long' argument must specify a valid - * command number - so we need to conduct a search. - */ - if ((e->cmd_defns == NULL) - || ((idx = int_ctrl_cmd_by_num(e->cmd_defns, (unsigned int)i)) < 0)) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INVALID_CMD_NUMBER); - return -1; - } - /* Now the logic splits depending on command type */ - cdp = &e->cmd_defns[idx]; - switch (cmd) { - case ENGINE_CTRL_GET_NEXT_CMD_TYPE: - cdp++; - return int_ctrl_cmd_is_null(cdp) ? 0 : cdp->cmd_num; - case ENGINE_CTRL_GET_NAME_LEN_FROM_CMD: - return (int)strlen(cdp->cmd_name); - case ENGINE_CTRL_GET_NAME_FROM_CMD: - return (int)strlen(strcpy(s, cdp->cmd_name)); - case ENGINE_CTRL_GET_DESC_LEN_FROM_CMD: - return (int)strlen(cdp->cmd_desc == NULL ? int_no_description - : cdp->cmd_desc); - case ENGINE_CTRL_GET_DESC_FROM_CMD: - return (int)strlen(strcpy(s, cdp->cmd_desc == NULL ? int_no_description - : cdp->cmd_desc)); - case ENGINE_CTRL_GET_CMD_FLAGS: - return cdp->cmd_flags; - } - /* Shouldn't really be here ... */ - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INTERNAL_LIST_ERROR); - return -1; -} - -int ENGINE_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f) (void)) -{ - int ctrl_exists; - - if (e == NULL) { - ERR_raise(ERR_LIB_ENGINE, ERR_R_PASSED_NULL_PARAMETER); - return 0; - } - - ctrl_exists = ((e->ctrl == NULL) ? 0 : 1); - - /* - * Intercept any "root-level" commands before trying to hand them on to - * ctrl() handlers. - */ - switch (cmd) { - case ENGINE_CTRL_HAS_CTRL_FUNCTION: - return ctrl_exists; - case ENGINE_CTRL_GET_FIRST_CMD_TYPE: - case ENGINE_CTRL_GET_NEXT_CMD_TYPE: - case ENGINE_CTRL_GET_CMD_FROM_NAME: - case ENGINE_CTRL_GET_NAME_LEN_FROM_CMD: - case ENGINE_CTRL_GET_NAME_FROM_CMD: - case ENGINE_CTRL_GET_DESC_LEN_FROM_CMD: - case ENGINE_CTRL_GET_DESC_FROM_CMD: - case ENGINE_CTRL_GET_CMD_FLAGS: - if (ctrl_exists && !(e->flags & ENGINE_FLAGS_MANUAL_CMD_CTRL)) - return int_ctrl_helper(e, cmd, i, p, f); - if (!ctrl_exists) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_NO_CONTROL_FUNCTION); - /* - * For these cmd-related functions, failure is indicated by a -1 - * return value (because 0 is used as a valid return in some - * places). - */ - return -1; - } - default: - break; - } - /* Anything else requires a ctrl() handler to exist. */ - if (!ctrl_exists) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_NO_CONTROL_FUNCTION); - return 0; - } - return e->ctrl(e, cmd, i, p, f); -} - -int ENGINE_cmd_is_executable(ENGINE *e, int cmd) -{ - int flags; - if ((flags = - ENGINE_ctrl(e, ENGINE_CTRL_GET_CMD_FLAGS, cmd, NULL, NULL)) < 0) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INVALID_CMD_NUMBER); - return 0; - } - if (!(flags & ENGINE_CMD_FLAG_NO_INPUT) && - !(flags & ENGINE_CMD_FLAG_NUMERIC) && - !(flags & ENGINE_CMD_FLAG_STRING)) - return 0; - return 1; -} - -int ENGINE_ctrl_cmd(ENGINE *e, const char *cmd_name, - long i, void *p, void (*f) (void), int cmd_optional) -{ - int num; - - if (e == NULL || cmd_name == NULL) { - ERR_raise(ERR_LIB_ENGINE, ERR_R_PASSED_NULL_PARAMETER); - return 0; - } - if (e->ctrl == NULL - || (num = ENGINE_ctrl(e, ENGINE_CTRL_GET_CMD_FROM_NAME, - 0, (void *)cmd_name, NULL)) <= 0) { - /* - * If the command didn't *have* to be supported, we fake success. - * This allows certain settings to be specified for multiple ENGINEs - * and only require a change of ENGINE id (without having to - * selectively apply settings). Eg. changing from a hardware device - * back to the regular software ENGINE without editing the config - * file, etc. - */ - if (cmd_optional) { - ERR_clear_error(); - return 1; - } - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INVALID_CMD_NAME); - return 0; - } - /* - * Force the result of the control command to 0 or 1, for the reasons - * mentioned before. - */ - if (ENGINE_ctrl(e, num, i, p, f) > 0) - return 1; - return 0; -} - -int ENGINE_ctrl_cmd_string(ENGINE *e, const char *cmd_name, const char *arg, - int cmd_optional) -{ - int num, flags; - long l; - char *ptr; - - if (e == NULL || cmd_name == NULL) { - ERR_raise(ERR_LIB_ENGINE, ERR_R_PASSED_NULL_PARAMETER); - return 0; - } - if (e->ctrl == NULL - || (num = ENGINE_ctrl(e, ENGINE_CTRL_GET_CMD_FROM_NAME, - 0, (void *)cmd_name, NULL)) <= 0) { - /* - * If the command didn't *have* to be supported, we fake success. - * This allows certain settings to be specified for multiple ENGINEs - * and only require a change of ENGINE id (without having to - * selectively apply settings). Eg. changing from a hardware device - * back to the regular software ENGINE without editing the config - * file, etc. - */ - if (cmd_optional) { - ERR_clear_error(); - return 1; - } - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INVALID_CMD_NAME); - return 0; - } - if (!ENGINE_cmd_is_executable(e, num)) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_CMD_NOT_EXECUTABLE); - return 0; - } - - flags = ENGINE_ctrl(e, ENGINE_CTRL_GET_CMD_FLAGS, num, NULL, NULL); - if (flags < 0) { - /* - * Shouldn't happen, given that ENGINE_cmd_is_executable() returned - * success. - */ - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INTERNAL_LIST_ERROR); - return 0; - } - /* - * If the command takes no input, there must be no input. And vice versa. - */ - if (flags & ENGINE_CMD_FLAG_NO_INPUT) { - if (arg != NULL) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_COMMAND_TAKES_NO_INPUT); - return 0; - } - /* - * We deliberately force the result of ENGINE_ctrl() to 0 or 1 rather - * than returning it as "return data". This is to ensure usage of - * these commands is consistent across applications and that certain - * applications don't understand it one way, and others another. - */ - if (ENGINE_ctrl(e, num, 0, (void *)arg, NULL) > 0) - return 1; - return 0; - } - /* So, we require input */ - if (arg == NULL) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_COMMAND_TAKES_INPUT); - return 0; - } - /* If it takes string input, that's easy */ - if (flags & ENGINE_CMD_FLAG_STRING) { - /* Same explanation as above */ - if (ENGINE_ctrl(e, num, 0, (void *)arg, NULL) > 0) - return 1; - return 0; - } - /* - * If it doesn't take numeric either, then it is unsupported for use in a - * config-setting situation, which is what this function is for. This - * should never happen though, because ENGINE_cmd_is_executable() was - * used. - */ - if (!(flags & ENGINE_CMD_FLAG_NUMERIC)) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INTERNAL_LIST_ERROR); - return 0; - } - l = strtol(arg, &ptr, 10); - if ((arg == ptr) || (*ptr != '\0')) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_ARGUMENT_IS_NOT_A_NUMBER); - return 0; - } - /* - * Force the result of the control command to 0 or 1, for the reasons - * mentioned before. - */ - if (ENGINE_ctrl(e, num, l, NULL, NULL) > 0) - return 1; - return 0; -} diff --git a/crypto/engine/eng_dyn.c b/crypto/engine/eng_dyn.c deleted file mode 100644 index cc3a2b0aa3..0000000000 --- a/crypto/engine/eng_dyn.c +++ /dev/null @@ -1,534 +0,0 @@ -/* - * Copyright 2001-2022 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - -#include "eng_local.h" -#include "internal/dso.h" -#include - -/* - * Shared libraries implementing ENGINEs for use by the "dynamic" ENGINE - * loader should implement the hook-up functions with the following - * prototypes. - */ - -/* Our ENGINE handlers */ -static int dynamic_init(ENGINE *e); -static int dynamic_finish(ENGINE *e); -static int dynamic_ctrl(ENGINE *e, int cmd, long i, void *p, - void (*f) (void)); -/* Predeclare our context type */ -typedef struct st_dynamic_data_ctx dynamic_data_ctx; -/* The implementation for the important control command */ -static int dynamic_load(ENGINE *e, dynamic_data_ctx *ctx); - -#define DYNAMIC_CMD_SO_PATH ENGINE_CMD_BASE -#define DYNAMIC_CMD_NO_VCHECK (ENGINE_CMD_BASE + 1) -#define DYNAMIC_CMD_ID (ENGINE_CMD_BASE + 2) -#define DYNAMIC_CMD_LIST_ADD (ENGINE_CMD_BASE + 3) -#define DYNAMIC_CMD_DIR_LOAD (ENGINE_CMD_BASE + 4) -#define DYNAMIC_CMD_DIR_ADD (ENGINE_CMD_BASE + 5) -#define DYNAMIC_CMD_LOAD (ENGINE_CMD_BASE + 6) - -/* The constants used when creating the ENGINE */ -static const char *engine_dynamic_id = "dynamic"; -static const char *engine_dynamic_name = "Dynamic engine loading support"; -static const ENGINE_CMD_DEFN dynamic_cmd_defns[] = { - {DYNAMIC_CMD_SO_PATH, - "SO_PATH", - "Specifies the path to the new ENGINE shared library", - ENGINE_CMD_FLAG_STRING}, - {DYNAMIC_CMD_NO_VCHECK, - "NO_VCHECK", - "Specifies to continue even if version checking fails (boolean)", - ENGINE_CMD_FLAG_NUMERIC}, - {DYNAMIC_CMD_ID, - "ID", - "Specifies an ENGINE id name for loading", - ENGINE_CMD_FLAG_STRING}, - {DYNAMIC_CMD_LIST_ADD, - "LIST_ADD", - "Whether to add a loaded ENGINE to the internal list (0=no,1=yes,2=mandatory)", - ENGINE_CMD_FLAG_NUMERIC}, - {DYNAMIC_CMD_DIR_LOAD, - "DIR_LOAD", - "Specifies whether to load from 'DIR_ADD' directories (0=no,1=yes,2=mandatory)", - ENGINE_CMD_FLAG_NUMERIC}, - {DYNAMIC_CMD_DIR_ADD, - "DIR_ADD", - "Adds a directory from which ENGINEs can be loaded", - ENGINE_CMD_FLAG_STRING}, - {DYNAMIC_CMD_LOAD, - "LOAD", - "Load up the ENGINE specified by other settings", - ENGINE_CMD_FLAG_NO_INPUT}, - {0, NULL, NULL, 0} -}; - -/* - * Loading code stores state inside the ENGINE structure via the "ex_data" - * element. We load all our state into a single structure and use that as a - * single context in the "ex_data" stack. - */ -struct st_dynamic_data_ctx { - /* The DSO object we load that supplies the ENGINE code */ - DSO *dynamic_dso; - /* - * The function pointer to the version checking shared library function - */ - dynamic_v_check_fn v_check; - /* - * The function pointer to the engine-binding shared library function - */ - dynamic_bind_engine bind_engine; - /* The default name/path for loading the shared library */ - char *DYNAMIC_LIBNAME; - /* Whether to continue loading on a version check failure */ - int no_vcheck; - /* If non-NULL, stipulates the 'id' of the ENGINE to be loaded */ - char *engine_id; - /* - * If non-zero, a successfully loaded ENGINE should be added to the - * internal ENGINE list. If 2, the add must succeed or the entire load - * should fail. - */ - int list_add_value; - /* The symbol name for the version checking function */ - const char *DYNAMIC_F1; - /* The symbol name for the "initialise ENGINE structure" function */ - const char *DYNAMIC_F2; - /* - * Whether to never use 'dirs', use 'dirs' as a fallback, or only use - * 'dirs' for loading. Default is to use 'dirs' as a fallback. - */ - int dir_load; - /* A stack of directories from which ENGINEs could be loaded */ - STACK_OF(OPENSSL_STRING) *dirs; -}; - -/* - * This is the "ex_data" index we obtain and reserve for use with our context - * structure. - */ -static int dynamic_ex_data_idx = -1; - -static void int_free_str(char *s) -{ - OPENSSL_free(s); -} - -/* - * Because our ex_data element may or may not get allocated depending on - * whether a "first-use" occurs before the ENGINE is freed, we have a memory - * leak problem to solve. We can't declare a "new" handler for the ex_data as - * we don't want a dynamic_data_ctx in *all* ENGINE structures of all types - * (this is a bug in the design of CRYPTO_EX_DATA). As such, we just declare - * a "free" handler and that will get called if an ENGINE is being destroyed - * and there was an ex_data element corresponding to our context type. - */ -static void dynamic_data_ctx_free_func(void *parent, void *ptr, - CRYPTO_EX_DATA *ad, int idx, long argl, - void *argp) -{ - if (ptr) { - dynamic_data_ctx *ctx = (dynamic_data_ctx *)ptr; - DSO_free(ctx->dynamic_dso); - OPENSSL_free(ctx->DYNAMIC_LIBNAME); - OPENSSL_free(ctx->engine_id); - sk_OPENSSL_STRING_pop_free(ctx->dirs, int_free_str); - OPENSSL_free(ctx); - } -} - -/* - * Construct the per-ENGINE context. We create it blindly and then use a lock - * to check for a race - if so, all but one of the threads "racing" will have - * wasted their time. The alternative involves creating everything inside the - * lock which is far worse. - */ -static int dynamic_set_data_ctx(ENGINE *e, dynamic_data_ctx **ctx) -{ - dynamic_data_ctx *c = OPENSSL_zalloc(sizeof(*c)); - int ret = 0; - - if (c == NULL) - return 0; - c->dirs = sk_OPENSSL_STRING_new_null(); - if (c->dirs == NULL) { - ERR_raise(ERR_LIB_ENGINE, ERR_R_CRYPTO_LIB); - goto end; - } - c->DYNAMIC_F1 = "v_check"; - c->DYNAMIC_F2 = "bind_engine"; - c->dir_load = 1; - if (!CRYPTO_THREAD_write_lock(global_engine_lock)) - goto end; - if ((*ctx = (dynamic_data_ctx *)ENGINE_get_ex_data(e, - dynamic_ex_data_idx)) - == NULL) { - /* Good, we're the first */ - ret = ENGINE_set_ex_data(e, dynamic_ex_data_idx, c); - if (ret) { - *ctx = c; - c = NULL; - } - } - CRYPTO_THREAD_unlock(global_engine_lock); - ret = 1; - /* - * If we lost the race to set the context, c is non-NULL and *ctx is the - * context of the thread that won. - */ -end: - if (c != NULL) - sk_OPENSSL_STRING_free(c->dirs); - OPENSSL_free(c); - return ret; -} - -/* - * This function retrieves the context structure from an ENGINE's "ex_data", - * or if it doesn't exist yet, sets it up. - */ -static dynamic_data_ctx *dynamic_get_data_ctx(ENGINE *e) -{ - dynamic_data_ctx *ctx; - if (dynamic_ex_data_idx < 0) { - /* - * Create and register the ENGINE ex_data, and associate our "free" - * function with it to ensure any allocated contexts get freed when - * an ENGINE goes underground. - */ - int new_idx = ENGINE_get_ex_new_index(0, NULL, NULL, NULL, - dynamic_data_ctx_free_func); - if (new_idx == -1) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_NO_INDEX); - return NULL; - } - if (!CRYPTO_THREAD_write_lock(global_engine_lock)) - return NULL; - /* Avoid a race by checking again inside this lock */ - if (dynamic_ex_data_idx < 0) { - /* Good, someone didn't beat us to it */ - dynamic_ex_data_idx = new_idx; - new_idx = -1; - } - CRYPTO_THREAD_unlock(global_engine_lock); - /* - * In theory we could "give back" the index here if (new_idx>-1), but - * it's not possible and wouldn't gain us much if it were. - */ - } - ctx = (dynamic_data_ctx *)ENGINE_get_ex_data(e, dynamic_ex_data_idx); - /* Check if the context needs to be created */ - if ((ctx == NULL) && !dynamic_set_data_ctx(e, &ctx)) - /* "set_data" will set errors if necessary */ - return NULL; - return ctx; -} - -static ENGINE *engine_dynamic(void) -{ - ENGINE *ret = ENGINE_new(); - if (ret == NULL) - return NULL; - if (!ENGINE_set_id(ret, engine_dynamic_id) || - !ENGINE_set_name(ret, engine_dynamic_name) || - !ENGINE_set_init_function(ret, dynamic_init) || - !ENGINE_set_finish_function(ret, dynamic_finish) || - !ENGINE_set_ctrl_function(ret, dynamic_ctrl) || - !ENGINE_set_flags(ret, ENGINE_FLAGS_BY_ID_COPY) || - !ENGINE_set_cmd_defns(ret, dynamic_cmd_defns)) { - ENGINE_free(ret); - return NULL; - } - return ret; -} - -void engine_load_dynamic_int(void) -{ - ENGINE *toadd = engine_dynamic(); - if (!toadd) - return; - - ERR_set_mark(); - ENGINE_add(toadd); - /* - * If the "add" worked, it gets a structural reference. So either way, we - * release our just-created reference. - */ - ENGINE_free(toadd); - /* - * If the "add" didn't work, it was probably a conflict because it was - * already added (eg. someone calling ENGINE_load_blah then calling - * ENGINE_load_builtin_engines() perhaps). - */ - ERR_pop_to_mark(); -} - -static int dynamic_init(ENGINE *e) -{ - /* - * We always return failure - the "dynamic" engine itself can't be used - * for anything. - */ - return 0; -} - -static int dynamic_finish(ENGINE *e) -{ - /* - * This should never be called on account of "dynamic_init" always - * failing. - */ - return 0; -} - -static int dynamic_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f) (void)) -{ - dynamic_data_ctx *ctx = dynamic_get_data_ctx(e); - int initialised; - - if (!ctx) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_NOT_LOADED); - return 0; - } - initialised = ((ctx->dynamic_dso == NULL) ? 0 : 1); - /* All our control commands require the ENGINE to be uninitialised */ - if (initialised) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_ALREADY_LOADED); - return 0; - } - switch (cmd) { - case DYNAMIC_CMD_SO_PATH: - /* a NULL 'p' or a string of zero-length is the same thing */ - if (p && (strlen((const char *)p) < 1)) - p = NULL; - OPENSSL_free(ctx->DYNAMIC_LIBNAME); - if (p) - ctx->DYNAMIC_LIBNAME = OPENSSL_strdup(p); - else - ctx->DYNAMIC_LIBNAME = NULL; - return (ctx->DYNAMIC_LIBNAME ? 1 : 0); - case DYNAMIC_CMD_NO_VCHECK: - ctx->no_vcheck = ((i == 0) ? 0 : 1); - return 1; - case DYNAMIC_CMD_ID: - /* a NULL 'p' or a string of zero-length is the same thing */ - if (p && (strlen((const char *)p) < 1)) - p = NULL; - OPENSSL_free(ctx->engine_id); - if (p) - ctx->engine_id = OPENSSL_strdup(p); - else - ctx->engine_id = NULL; - return (ctx->engine_id ? 1 : 0); - case DYNAMIC_CMD_LIST_ADD: - if ((i < 0) || (i > 2)) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INVALID_ARGUMENT); - return 0; - } - ctx->list_add_value = (int)i; - return 1; - case DYNAMIC_CMD_LOAD: - return dynamic_load(e, ctx); - case DYNAMIC_CMD_DIR_LOAD: - if ((i < 0) || (i > 2)) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INVALID_ARGUMENT); - return 0; - } - ctx->dir_load = (int)i; - return 1; - case DYNAMIC_CMD_DIR_ADD: - /* a NULL 'p' or a string of zero-length is the same thing */ - if (p == NULL || (strlen((const char *)p) < 1)) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INVALID_ARGUMENT); - return 0; - } - { - char *tmp_str = OPENSSL_strdup(p); - if (tmp_str == NULL) - return 0; - if (!sk_OPENSSL_STRING_push(ctx->dirs, tmp_str)) { - OPENSSL_free(tmp_str); - ERR_raise(ERR_LIB_ENGINE, ERR_R_CRYPTO_LIB); - return 0; - } - } - return 1; - default: - break; - } - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_CTRL_COMMAND_NOT_IMPLEMENTED); - return 0; -} - -static int int_load(dynamic_data_ctx *ctx) -{ - int num, loop; - /* Unless told not to, try a direct load */ - if ((ctx->dir_load != 2) && (DSO_load(ctx->dynamic_dso, - ctx->DYNAMIC_LIBNAME, NULL, - 0)) != NULL) - return 1; - /* If we're not allowed to use 'dirs' or we have none, fail */ - if (!ctx->dir_load || (num = sk_OPENSSL_STRING_num(ctx->dirs)) < 1) - return 0; - for (loop = 0; loop < num; loop++) { - const char *s = sk_OPENSSL_STRING_value(ctx->dirs, loop); - char *merge = DSO_merge(ctx->dynamic_dso, ctx->DYNAMIC_LIBNAME, s); - if (!merge) - return 0; - if (DSO_load(ctx->dynamic_dso, merge, NULL, 0)) { - /* Found what we're looking for */ - OPENSSL_free(merge); - return 1; - } - OPENSSL_free(merge); - } - return 0; -} - -/* - * Unfortunately the version checker does not distinguish between - * engines built for openssl 1.1.x and openssl 3.x, but loading - * an engine that is built for openssl 1.1.x will cause a fatal - * error. Detect such engines, since EVP_PKEY_base_id is exported - * as a function in openssl 1.1.x, while it is named EVP_PKEY_get_base_id - * in openssl 3.x. Therefore we take the presence of that symbol - * as an indication that the engine will be incompatible. - */ -static int using_libcrypto_11(dynamic_data_ctx *ctx) -{ - int ret; - - ERR_set_mark(); - ret = DSO_bind_func(ctx->dynamic_dso, "EVP_PKEY_base_id") != NULL; - ERR_pop_to_mark(); - - return ret; -} - -static int dynamic_load(ENGINE *e, dynamic_data_ctx *ctx) -{ - ENGINE cpy; - dynamic_fns fns; - - if (ctx->dynamic_dso == NULL) - ctx->dynamic_dso = DSO_new(); - if (ctx->dynamic_dso == NULL) - return 0; - if (!ctx->DYNAMIC_LIBNAME) { - if (!ctx->engine_id) - return 0; - DSO_ctrl(ctx->dynamic_dso, DSO_CTRL_SET_FLAGS, - DSO_FLAG_NAME_TRANSLATION_EXT_ONLY, NULL); - ctx->DYNAMIC_LIBNAME = - DSO_convert_filename(ctx->dynamic_dso, ctx->engine_id); - } - if (!int_load(ctx)) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_DSO_NOT_FOUND); - DSO_free(ctx->dynamic_dso); - ctx->dynamic_dso = NULL; - return 0; - } - /* We have to find a bind function otherwise it'll always end badly */ - if (! - (ctx->bind_engine = - (dynamic_bind_engine) DSO_bind_func(ctx->dynamic_dso, - ctx->DYNAMIC_F2))) { - ctx->bind_engine = NULL; - DSO_free(ctx->dynamic_dso); - ctx->dynamic_dso = NULL; - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_DSO_FAILURE); - return 0; - } - /* Do we perform version checking? */ - if (!ctx->no_vcheck) { - unsigned long vcheck_res = 0; - /* - * Now we try to find a version checking function and decide how to - * cope with failure if/when it fails. - */ - ctx->v_check = - (dynamic_v_check_fn) DSO_bind_func(ctx->dynamic_dso, - ctx->DYNAMIC_F1); - if (ctx->v_check) - vcheck_res = ctx->v_check(OSSL_DYNAMIC_VERSION); - /* - * We fail if the version checker veto'd the load *or* if it is - * deferring to us (by returning its version) and we think it is too - * old. Also fail if this is engine for openssl 1.1.x. - */ - if (vcheck_res < OSSL_DYNAMIC_OLDEST || using_libcrypto_11(ctx)) { - /* Fail */ - ctx->bind_engine = NULL; - ctx->v_check = NULL; - DSO_free(ctx->dynamic_dso); - ctx->dynamic_dso = NULL; - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_VERSION_INCOMPATIBILITY); - return 0; - } - } - /* - * First binary copy the ENGINE structure so that we can roll back if the - * hand-over fails - */ - memcpy(&cpy, e, sizeof(ENGINE)); - /* - * Provide the ERR, "ex_data", memory, and locking callbacks so the - * loaded library uses our state rather than its own. FIXME: As noted in - * engine.h, much of this would be simplified if each area of code - * provided its own "summary" structure of all related callbacks. It - * would also increase opaqueness. - */ - fns.static_state = ENGINE_get_static_state(); - CRYPTO_get_mem_functions(&fns.mem_fns.malloc_fn, &fns.mem_fns.realloc_fn, - &fns.mem_fns.free_fn); - /* - * Now that we've loaded the dynamic engine, make sure no "dynamic" - * ENGINE elements will show through. - */ - engine_set_all_null(e); - - /* Try to bind the ENGINE onto our own ENGINE structure */ - if (!engine_add_dynamic_id(e, (ENGINE_DYNAMIC_ID)ctx->bind_engine, 1) - || !ctx->bind_engine(e, ctx->engine_id, &fns)) { - engine_remove_dynamic_id(e, 1); - ctx->bind_engine = NULL; - ctx->v_check = NULL; - DSO_free(ctx->dynamic_dso); - ctx->dynamic_dso = NULL; - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INIT_FAILED); - /* Copy the original ENGINE structure back */ - memcpy(e, &cpy, sizeof(ENGINE)); - return 0; - } - /* Do we try to add this ENGINE to the internal list too? */ - if (ctx->list_add_value > 0) { - if (!ENGINE_add(e)) { - /* Do we tolerate this or fail? */ - if (ctx->list_add_value > 1) { - /* - * Fail - NB: By this time, it's too late to rollback, and - * trying to do so allows the bind_engine() code to have - * created leaks. We just have to fail where we are, after - * the ENGINE has changed. - */ - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_CONFLICTING_ENGINE_ID); - return 0; - } - /* Tolerate */ - ERR_clear_error(); - } - } - return 1; -} diff --git a/crypto/engine/eng_err.c b/crypto/engine/eng_err.c deleted file mode 100644 index 17c1b7d008..0000000000 --- a/crypto/engine/eng_err.c +++ /dev/null @@ -1,94 +0,0 @@ -/* - * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#include -#include -#include "crypto/engineerr.h" - -#ifndef OPENSSL_NO_ENGINE - -# ifndef OPENSSL_NO_ERR - -static const ERR_STRING_DATA ENGINE_str_reasons[] = { - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_ALREADY_LOADED), "already loaded"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_ARGUMENT_IS_NOT_A_NUMBER), - "argument is not a number"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_CMD_NOT_EXECUTABLE), - "cmd not executable"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_COMMAND_TAKES_INPUT), - "command takes input"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_COMMAND_TAKES_NO_INPUT), - "command takes no input"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_CONFLICTING_ENGINE_ID), - "conflicting engine id"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_CTRL_COMMAND_NOT_IMPLEMENTED), - "ctrl command not implemented"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_DSO_FAILURE), "DSO failure"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_DSO_NOT_FOUND), "dso not found"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_ENGINES_SECTION_ERROR), - "engines section error"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_ENGINE_CONFIGURATION_ERROR), - "engine configuration error"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_ENGINE_IS_NOT_IN_LIST), - "engine is not in the list"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_ENGINE_SECTION_ERROR), - "engine section error"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_FAILED_LOADING_PRIVATE_KEY), - "failed loading private key"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_FAILED_LOADING_PUBLIC_KEY), - "failed loading public key"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_FINISH_FAILED), "finish failed"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_ID_OR_NAME_MISSING), - "'id' or 'name' missing"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_INIT_FAILED), "init failed"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_INTERNAL_LIST_ERROR), - "internal list error"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_INVALID_ARGUMENT), - "invalid argument"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_INVALID_CMD_NAME), - "invalid cmd name"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_INVALID_CMD_NUMBER), - "invalid cmd number"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_INVALID_INIT_VALUE), - "invalid init value"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_INVALID_STRING), "invalid string"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_NOT_INITIALISED), "not initialised"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_NOT_LOADED), "not loaded"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_NO_CONTROL_FUNCTION), - "no control function"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_NO_INDEX), "no index"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_NO_LOAD_FUNCTION), - "no load function"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_NO_REFERENCE), "no reference"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_NO_SUCH_ENGINE), "no such engine"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_UNIMPLEMENTED_CIPHER), - "unimplemented cipher"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_UNIMPLEMENTED_DIGEST), - "unimplemented digest"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_UNIMPLEMENTED_PUBLIC_KEY_METHOD), - "unimplemented public key method"}, - {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_VERSION_INCOMPATIBILITY), - "version incompatibility"}, - {0, NULL} -}; - -# endif - -int ossl_err_load_ENGINE_strings(void) -{ -# ifndef OPENSSL_NO_ERR - if (ERR_reason_error_string(ENGINE_str_reasons[0].error) == NULL) - ERR_load_strings_const(ENGINE_str_reasons); -# endif - return 1; -} -#else -NON_EMPTY_TRANSLATION_UNIT -#endif diff --git a/crypto/engine/eng_fat.c b/crypto/engine/eng_fat.c deleted file mode 100644 index 0cf27715c5..0000000000 --- a/crypto/engine/eng_fat.c +++ /dev/null @@ -1,121 +0,0 @@ -/* - * Copyright 2001-2020 The OpenSSL Project Authors. All Rights Reserved. - * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - -#include "eng_local.h" -#include - -int ENGINE_set_default(ENGINE *e, unsigned int flags) -{ - if ((flags & ENGINE_METHOD_CIPHERS) && !ENGINE_set_default_ciphers(e)) - return 0; - if ((flags & ENGINE_METHOD_DIGESTS) && !ENGINE_set_default_digests(e)) - return 0; - if ((flags & ENGINE_METHOD_RSA) && !ENGINE_set_default_RSA(e)) - return 0; -#ifndef OPENSSL_NO_DSA - if ((flags & ENGINE_METHOD_DSA) && !ENGINE_set_default_DSA(e)) - return 0; -#endif -#ifndef OPENSSL_NO_DH - if ((flags & ENGINE_METHOD_DH) && !ENGINE_set_default_DH(e)) - return 0; -#endif -#ifndef OPENSSL_NO_EC - if ((flags & ENGINE_METHOD_EC) && !ENGINE_set_default_EC(e)) - return 0; -#endif - if ((flags & ENGINE_METHOD_RAND) && !ENGINE_set_default_RAND(e)) - return 0; - if ((flags & ENGINE_METHOD_PKEY_METHS) - && !ENGINE_set_default_pkey_meths(e)) - return 0; - if ((flags & ENGINE_METHOD_PKEY_ASN1_METHS) - && !ENGINE_set_default_pkey_asn1_meths(e)) - return 0; - return 1; -} - -/* Set default algorithms using a string */ - -static int int_def_cb(const char *alg, int len, void *arg) -{ - unsigned int *pflags = arg; - if (alg == NULL) - return 0; - if (strncmp(alg, "ALL", len) == 0) - *pflags |= ENGINE_METHOD_ALL; - else if (strncmp(alg, "RSA", len) == 0) - *pflags |= ENGINE_METHOD_RSA; - else if (strncmp(alg, "DSA", len) == 0) - *pflags |= ENGINE_METHOD_DSA; - else if (strncmp(alg, "DH", len) == 0) - *pflags |= ENGINE_METHOD_DH; - else if (strncmp(alg, "EC", len) == 0) - *pflags |= ENGINE_METHOD_EC; - else if (strncmp(alg, "RAND", len) == 0) - *pflags |= ENGINE_METHOD_RAND; - else if (strncmp(alg, "CIPHERS", len) == 0) - *pflags |= ENGINE_METHOD_CIPHERS; - else if (strncmp(alg, "DIGESTS", len) == 0) - *pflags |= ENGINE_METHOD_DIGESTS; - else if (strncmp(alg, "PKEY", len) == 0) - *pflags |= ENGINE_METHOD_PKEY_METHS | ENGINE_METHOD_PKEY_ASN1_METHS; - else if (strncmp(alg, "PKEY_CRYPTO", len) == 0) - *pflags |= ENGINE_METHOD_PKEY_METHS; - else if (strncmp(alg, "PKEY_ASN1", len) == 0) - *pflags |= ENGINE_METHOD_PKEY_ASN1_METHS; - else - return 0; - return 1; -} - -int ENGINE_set_default_string(ENGINE *e, const char *def_list) -{ - unsigned int flags = 0; - if (!CONF_parse_list(def_list, ',', 1, int_def_cb, &flags)) { - ERR_raise_data(ERR_LIB_ENGINE, ENGINE_R_INVALID_STRING, - "str=%s", def_list); - return 0; - } - return ENGINE_set_default(e, flags); -} - -int ENGINE_register_complete(ENGINE *e) -{ - ENGINE_register_ciphers(e); - ENGINE_register_digests(e); - ENGINE_register_RSA(e); -#ifndef OPENSSL_NO_DSA - ENGINE_register_DSA(e); -#endif -#ifndef OPENSSL_NO_DH - ENGINE_register_DH(e); -#endif -#ifndef OPENSSL_NO_EC - ENGINE_register_EC(e); -#endif - ENGINE_register_RAND(e); - ENGINE_register_pkey_meths(e); - ENGINE_register_pkey_asn1_meths(e); - return 1; -} - -int ENGINE_register_all_complete(void) -{ - ENGINE *e; - - for (e = ENGINE_get_first(); e; e = ENGINE_get_next(e)) - if (!(e->flags & ENGINE_FLAGS_NO_REGISTER_ALL)) - ENGINE_register_complete(e); - return 1; -} diff --git a/crypto/engine/eng_init.c b/crypto/engine/eng_init.c deleted file mode 100644 index 0ac91ff5ed..0000000000 --- a/crypto/engine/eng_init.c +++ /dev/null @@ -1,121 +0,0 @@ -/* - * Copyright 2001-2023 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - -#include "internal/e_os.h" -#include "eng_local.h" - -/* - * Initialise an engine type for use (or up its functional reference count if - * it's already in use). This version is only used internally. - */ -int engine_unlocked_init(ENGINE *e) -{ - int to_return = 1; - - if ((e->funct_ref == 0) && e->init) - /* - * This is the first functional reference and the engine requires - * initialisation so we do it now. - */ - to_return = e->init(e); - if (to_return) { - int ref; - - /* - * OK, we return a functional reference which is also a structural - * reference. - */ - if (!CRYPTO_UP_REF(&e->struct_ref, &ref)) { - e->finish(e); - return 0; - } - e->funct_ref++; - ENGINE_REF_PRINT(e, 0, 1); - ENGINE_REF_PRINT(e, 1, 1); - } - return to_return; -} - -/* - * Free a functional reference to an engine type. This version is only used - * internally. - */ -int engine_unlocked_finish(ENGINE *e, int unlock_for_handlers) -{ - int to_return = 1; - - /* - * Reduce the functional reference count here so if it's the terminating - * case, we can release the lock safely and call the finish() handler - * without risk of a race. We get a race if we leave the count until - * after and something else is calling "finish" at the same time - - * there's a chance that both threads will together take the count from 2 - * to 0 without either calling finish(). - */ - e->funct_ref--; - ENGINE_REF_PRINT(e, 1, -1); - if ((e->funct_ref == 0) && e->finish) { - if (unlock_for_handlers) - CRYPTO_THREAD_unlock(global_engine_lock); - to_return = e->finish(e); - if (unlock_for_handlers) - if (!CRYPTO_THREAD_write_lock(global_engine_lock)) - return 0; - if (!to_return) - return 0; - } - REF_ASSERT_ISNT(e->funct_ref < 0); - /* Release the structural reference too */ - if (!engine_free_util(e, 0)) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_FINISH_FAILED); - return 0; - } - return to_return; -} - -/* The API (locked) version of "init" */ -int ENGINE_init(ENGINE *e) -{ - int ret; - if (e == NULL) { - ERR_raise(ERR_LIB_ENGINE, ERR_R_PASSED_NULL_PARAMETER); - return 0; - } - if (!RUN_ONCE(&engine_lock_init, do_engine_lock_init)) { - /* Maybe this should be raised in do_engine_lock_init() */ - ERR_raise(ERR_LIB_ENGINE, ERR_R_CRYPTO_LIB); - return 0; - } - if (!CRYPTO_THREAD_write_lock(global_engine_lock)) - return 0; - ret = engine_unlocked_init(e); - CRYPTO_THREAD_unlock(global_engine_lock); - return ret; -} - -/* The API (locked) version of "finish" */ -int ENGINE_finish(ENGINE *e) -{ - int to_return = 1; - - if (e == NULL) - return 1; - if (!CRYPTO_THREAD_write_lock(global_engine_lock)) - return 0; - to_return = engine_unlocked_finish(e, 1); - CRYPTO_THREAD_unlock(global_engine_lock); - if (!to_return) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_FINISH_FAILED); - return 0; - } - return to_return; -} diff --git a/crypto/engine/eng_lib.c b/crypto/engine/eng_lib.c deleted file mode 100644 index 412363fa37..0000000000 --- a/crypto/engine/eng_lib.c +++ /dev/null @@ -1,309 +0,0 @@ -/* - * Copyright 2001-2023 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#include "internal/e_os.h" -#include "eng_local.h" -#include -#include "internal/refcount.h" - -CRYPTO_RWLOCK *global_engine_lock; - -CRYPTO_ONCE engine_lock_init = CRYPTO_ONCE_STATIC_INIT; - -/* The "new"/"free" stuff first */ - -DEFINE_RUN_ONCE(do_engine_lock_init) -{ - global_engine_lock = CRYPTO_THREAD_lock_new(); - return global_engine_lock != NULL; -} - -ENGINE *ENGINE_new(void) -{ - ENGINE *ret; - - if (!RUN_ONCE(&engine_lock_init, do_engine_lock_init)) { - /* Maybe this should be raised in do_engine_lock_init() */ - ERR_raise(ERR_LIB_ENGINE, ERR_R_CRYPTO_LIB); - return 0; - } - if ((ret = OPENSSL_zalloc(sizeof(*ret))) == NULL) - return NULL; - if (!CRYPTO_NEW_REF(&ret->struct_ref, 1)) { - OPENSSL_free(ret); - return NULL; - } - ENGINE_REF_PRINT(ret, 0, 1); - if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_ENGINE, ret, &ret->ex_data)) { - CRYPTO_FREE_REF(&ret->struct_ref); - OPENSSL_free(ret); - return NULL; - } - return ret; -} - -/* - * Placed here (close proximity to ENGINE_new) so that modifications to the - * elements of the ENGINE structure are more likely to be caught and changed - * here. - */ -void engine_set_all_null(ENGINE *e) -{ - e->id = NULL; - e->name = NULL; - e->rsa_meth = NULL; - e->dsa_meth = NULL; - e->dh_meth = NULL; - e->rand_meth = NULL; - e->ciphers = NULL; - e->digests = NULL; - e->destroy = NULL; - e->init = NULL; - e->finish = NULL; - e->ctrl = NULL; - e->load_privkey = NULL; - e->load_pubkey = NULL; - e->cmd_defns = NULL; - e->flags = 0; - e->dynamic_id = NULL; -} - -int engine_free_util(ENGINE *e, int not_locked) -{ - int i; - - if (e == NULL) - return 1; - CRYPTO_DOWN_REF(&e->struct_ref, &i); - ENGINE_REF_PRINT(e, 0, -1); - if (i > 0) - return 1; - REF_ASSERT_ISNT(i < 0); - /* Free up any dynamically allocated public key methods */ - engine_pkey_meths_free(e); - engine_pkey_asn1_meths_free(e); - /* - * Give the ENGINE a chance to do any structural cleanup corresponding to - * allocation it did in its constructor (eg. unload error strings) - */ - if (e->destroy) - e->destroy(e); - engine_remove_dynamic_id(e, not_locked); - CRYPTO_free_ex_data(CRYPTO_EX_INDEX_ENGINE, e, &e->ex_data); - CRYPTO_FREE_REF(&e->struct_ref); - OPENSSL_free(e); - return 1; -} - -int ENGINE_free(ENGINE *e) -{ - return engine_free_util(e, 1); -} - -/* Cleanup stuff */ - -/* - * engine_cleanup_int() is coded such that anything that does work that will - * need cleanup can register a "cleanup" callback here. That way we don't get - * linker bloat by referring to all *possible* cleanups, but any linker bloat - * into code "X" will cause X's cleanup function to end up here. - */ -static STACK_OF(ENGINE_CLEANUP_ITEM) *cleanup_stack = NULL; -static int int_cleanup_check(int create) -{ - if (cleanup_stack) - return 1; - if (!create) - return 0; - cleanup_stack = sk_ENGINE_CLEANUP_ITEM_new_null(); - return (cleanup_stack ? 1 : 0); -} - -static ENGINE_CLEANUP_ITEM *int_cleanup_item(ENGINE_CLEANUP_CB *cb) -{ - ENGINE_CLEANUP_ITEM *item; - - if ((item = OPENSSL_malloc(sizeof(*item))) == NULL) - return NULL; - item->cb = cb; - return item; -} - -int engine_cleanup_add_first(ENGINE_CLEANUP_CB *cb) -{ - ENGINE_CLEANUP_ITEM *item; - - if (!int_cleanup_check(1)) - return 0; - item = int_cleanup_item(cb); - if (item != NULL) { - if (sk_ENGINE_CLEANUP_ITEM_insert(cleanup_stack, item, 0)) - return 1; - OPENSSL_free(item); - } - return 0; -} - -int engine_cleanup_add_last(ENGINE_CLEANUP_CB *cb) -{ - ENGINE_CLEANUP_ITEM *item; - - if (!int_cleanup_check(1)) - return 0; - item = int_cleanup_item(cb); - if (item != NULL) { - if (sk_ENGINE_CLEANUP_ITEM_push(cleanup_stack, item) > 0) - return 1; - OPENSSL_free(item); - } - return 0; -} - -/* The API function that performs all cleanup */ -static void engine_cleanup_cb_free(ENGINE_CLEANUP_ITEM *item) -{ - (*(item->cb)) (); - OPENSSL_free(item); -} - -void engine_cleanup_int(void) -{ - if (int_cleanup_check(0)) { - sk_ENGINE_CLEANUP_ITEM_pop_free(cleanup_stack, - engine_cleanup_cb_free); - cleanup_stack = NULL; - } - CRYPTO_THREAD_lock_free(global_engine_lock); - global_engine_lock = NULL; -} - -/* Now the "ex_data" support */ - -int ENGINE_set_ex_data(ENGINE *e, int idx, void *arg) -{ - return CRYPTO_set_ex_data(&e->ex_data, idx, arg); -} - -void *ENGINE_get_ex_data(const ENGINE *e, int idx) -{ - return CRYPTO_get_ex_data(&e->ex_data, idx); -} - -/* - * Functions to get/set an ENGINE's elements - mainly to avoid exposing the - * ENGINE structure itself. - */ - -int ENGINE_set_id(ENGINE *e, const char *id) -{ - if (id == NULL) { - ERR_raise(ERR_LIB_ENGINE, ERR_R_PASSED_NULL_PARAMETER); - return 0; - } - e->id = id; - return 1; -} - -int ENGINE_set_name(ENGINE *e, const char *name) -{ - if (name == NULL) { - ERR_raise(ERR_LIB_ENGINE, ERR_R_PASSED_NULL_PARAMETER); - return 0; - } - e->name = name; - return 1; -} - -int ENGINE_set_destroy_function(ENGINE *e, ENGINE_GEN_INT_FUNC_PTR destroy_f) -{ - e->destroy = destroy_f; - return 1; -} - -int ENGINE_set_init_function(ENGINE *e, ENGINE_GEN_INT_FUNC_PTR init_f) -{ - e->init = init_f; - return 1; -} - -int ENGINE_set_finish_function(ENGINE *e, ENGINE_GEN_INT_FUNC_PTR finish_f) -{ - e->finish = finish_f; - return 1; -} - -int ENGINE_set_ctrl_function(ENGINE *e, ENGINE_CTRL_FUNC_PTR ctrl_f) -{ - e->ctrl = ctrl_f; - return 1; -} - -int ENGINE_set_flags(ENGINE *e, int flags) -{ - e->flags = flags; - return 1; -} - -int ENGINE_set_cmd_defns(ENGINE *e, const ENGINE_CMD_DEFN *defns) -{ - e->cmd_defns = defns; - return 1; -} - -const char *ENGINE_get_id(const ENGINE *e) -{ - return e->id; -} - -const char *ENGINE_get_name(const ENGINE *e) -{ - return e->name; -} - -ENGINE_GEN_INT_FUNC_PTR ENGINE_get_destroy_function(const ENGINE *e) -{ - return e->destroy; -} - -ENGINE_GEN_INT_FUNC_PTR ENGINE_get_init_function(const ENGINE *e) -{ - return e->init; -} - -ENGINE_GEN_INT_FUNC_PTR ENGINE_get_finish_function(const ENGINE *e) -{ - return e->finish; -} - -ENGINE_CTRL_FUNC_PTR ENGINE_get_ctrl_function(const ENGINE *e) -{ - return e->ctrl; -} - -int ENGINE_get_flags(const ENGINE *e) -{ - return e->flags; -} - -const ENGINE_CMD_DEFN *ENGINE_get_cmd_defns(const ENGINE *e) -{ - return e->cmd_defns; -} - -/* - * eng_lib.o is pretty much linked into anything that touches ENGINE already, - * so put the "static_state" hack here. - */ - -static int internal_static_hack = 0; - -void *ENGINE_get_static_state(void) -{ - return &internal_static_hack; -} diff --git a/crypto/engine/eng_list.c b/crypto/engine/eng_list.c deleted file mode 100644 index 0f24f2f450..0000000000 --- a/crypto/engine/eng_list.c +++ /dev/null @@ -1,489 +0,0 @@ -/* - * Copyright 2001-2024 The OpenSSL Project Authors. All Rights Reserved. - * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - -#include "eng_local.h" - -/* - * The linked-list of pointers to engine types. engine_list_head incorporates - * an implicit structural reference but engine_list_tail does not - the - * latter is a computational optimization and only points to something that - * is already pointed to by its predecessor in the list (or engine_list_head - * itself). In the same way, the use of the "prev" pointer in each ENGINE is - * to save excessive list iteration, it doesn't correspond to an extra - * structural reference. Hence, engine_list_head, and each non-null "next" - * pointer account for the list itself assuming exactly 1 structural - * reference on each list member. - */ -static ENGINE *engine_list_head = NULL; -static ENGINE *engine_list_tail = NULL; - -/* - * The linked list of currently loaded dynamic engines. - */ -static ENGINE *engine_dyn_list_head = NULL; -static ENGINE *engine_dyn_list_tail = NULL; - -/* - * This cleanup function is only needed internally. If it should be called, - * we register it with the "engine_cleanup_int()" stack to be called during - * cleanup. - */ - -static void engine_list_cleanup(void) -{ - ENGINE *iterator = engine_list_head; - - while (iterator != NULL) { - ENGINE_remove(iterator); - iterator = engine_list_head; - } - return; -} - -/* - * These static functions starting with a lower case "engine_" always take - * place when global_engine_lock has been locked up. - */ -static int engine_list_add(ENGINE *e) -{ - int conflict = 0; - ENGINE *iterator = NULL; - int ref; - - if (e == NULL) { - ERR_raise(ERR_LIB_ENGINE, ERR_R_PASSED_NULL_PARAMETER); - return 0; - } - iterator = engine_list_head; - while (iterator && !conflict) { - conflict = (strcmp(iterator->id, e->id) == 0); - iterator = iterator->next; - } - if (conflict) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_CONFLICTING_ENGINE_ID); - return 0; - } - - /* - * Having the engine in the list assumes a structural reference. - */ - if (!CRYPTO_UP_REF(&e->struct_ref, &ref)) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INTERNAL_LIST_ERROR); - return 0; - } - ENGINE_REF_PRINT(e, 0, 1); - if (engine_list_head == NULL) { - /* We are adding to an empty list. */ - if (engine_list_tail != NULL) { - CRYPTO_DOWN_REF(&e->struct_ref, &ref); - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INTERNAL_LIST_ERROR); - return 0; - } - /* - * The first time the list allocates, we should register the cleanup. - */ - if (!engine_cleanup_add_last(engine_list_cleanup)) { - CRYPTO_DOWN_REF(&e->struct_ref, &ref); - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INTERNAL_LIST_ERROR); - return 0; - } - engine_list_head = e; - e->prev = NULL; - } else { - /* We are adding to the tail of an existing list. */ - if ((engine_list_tail == NULL) || (engine_list_tail->next != NULL)) { - CRYPTO_DOWN_REF(&e->struct_ref, &ref); - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INTERNAL_LIST_ERROR); - return 0; - } - engine_list_tail->next = e; - e->prev = engine_list_tail; - } - - /* However it came to be, e is the last item in the list. */ - engine_list_tail = e; - e->next = NULL; - return 1; -} - -static int engine_list_remove(ENGINE *e) -{ - ENGINE *iterator; - - if (e == NULL) { - ERR_raise(ERR_LIB_ENGINE, ERR_R_PASSED_NULL_PARAMETER); - return 0; - } - /* We need to check that e is in our linked list! */ - iterator = engine_list_head; - while (iterator && (iterator != e)) - iterator = iterator->next; - if (iterator == NULL) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_ENGINE_IS_NOT_IN_LIST); - return 0; - } - /* un-link e from the chain. */ - if (e->next) - e->next->prev = e->prev; - if (e->prev) - e->prev->next = e->next; - /* Correct our head/tail if necessary. */ - if (engine_list_head == e) - engine_list_head = e->next; - if (engine_list_tail == e) - engine_list_tail = e->prev; - engine_free_util(e, 0); - return 1; -} - -/* Add engine to dynamic engine list. */ -int engine_add_dynamic_id(ENGINE *e, ENGINE_DYNAMIC_ID dynamic_id, - int not_locked) -{ - int result = 0; - ENGINE *iterator = NULL; - - if (e == NULL) - return 0; - - if (e->dynamic_id == NULL && dynamic_id == NULL) - return 0; - - if (not_locked && !CRYPTO_THREAD_write_lock(global_engine_lock)) - return 0; - - if (dynamic_id != NULL) { - iterator = engine_dyn_list_head; - while (iterator != NULL) { - if (iterator->dynamic_id == dynamic_id) - goto err; - iterator = iterator->next; - } - if (e->dynamic_id != NULL) - goto err; - e->dynamic_id = dynamic_id; - } - - if (engine_dyn_list_head == NULL) { - /* We are adding to an empty list. */ - if (engine_dyn_list_tail != NULL) - goto err; - engine_dyn_list_head = e; - e->prev_dyn = NULL; - } else { - /* We are adding to the tail of an existing list. */ - if (engine_dyn_list_tail == NULL - || engine_dyn_list_tail->next_dyn != NULL) - goto err; - engine_dyn_list_tail->next_dyn = e; - e->prev_dyn = engine_dyn_list_tail; - } - - engine_dyn_list_tail = e; - e->next_dyn = NULL; - result = 1; - - err: - if (not_locked) - CRYPTO_THREAD_unlock(global_engine_lock); - return result; -} - -/* Remove engine from dynamic engine list. */ -void engine_remove_dynamic_id(ENGINE *e, int not_locked) -{ - if (e == NULL || e->dynamic_id == NULL) - return; - - if (not_locked && !CRYPTO_THREAD_write_lock(global_engine_lock)) - return; - - e->dynamic_id = NULL; - - /* un-link e from the chain. */ - if (e->next_dyn != NULL) - e->next_dyn->prev_dyn = e->prev_dyn; - if (e->prev_dyn != NULL) - e->prev_dyn->next_dyn = e->next_dyn; - /* Correct our head/tail if necessary. */ - if (engine_dyn_list_head == e) - engine_dyn_list_head = e->next_dyn; - if (engine_dyn_list_tail == e) - engine_dyn_list_tail = e->prev_dyn; - - if (not_locked) - CRYPTO_THREAD_unlock(global_engine_lock); -} - -/* Get the first/last "ENGINE" type available. */ -ENGINE *ENGINE_get_first(void) -{ - ENGINE *ret; - - if (!RUN_ONCE(&engine_lock_init, do_engine_lock_init)) { - /* Maybe this should be raised in do_engine_lock_init() */ - ERR_raise(ERR_LIB_ENGINE, ERR_R_CRYPTO_LIB); - return NULL; - } - - if (!CRYPTO_THREAD_write_lock(global_engine_lock)) - return NULL; - ret = engine_list_head; - if (ret) { - int ref; - - if (!CRYPTO_UP_REF(&ret->struct_ref, &ref)) { - CRYPTO_THREAD_unlock(global_engine_lock); - ERR_raise(ERR_LIB_ENGINE, ERR_R_CRYPTO_LIB); - return NULL; - } - ENGINE_REF_PRINT(ret, 0, 1); - } - CRYPTO_THREAD_unlock(global_engine_lock); - return ret; -} - -ENGINE *ENGINE_get_last(void) -{ - ENGINE *ret; - - if (!RUN_ONCE(&engine_lock_init, do_engine_lock_init)) { - /* Maybe this should be raised in do_engine_lock_init() */ - ERR_raise(ERR_LIB_ENGINE, ERR_R_CRYPTO_LIB); - return NULL; - } - - if (!CRYPTO_THREAD_write_lock(global_engine_lock)) - return NULL; - ret = engine_list_tail; - if (ret) { - int ref; - - if (!CRYPTO_UP_REF(&ret->struct_ref, &ref)) { - CRYPTO_THREAD_unlock(global_engine_lock); - ERR_raise(ERR_LIB_ENGINE, ERR_R_CRYPTO_LIB); - return NULL; - } - ENGINE_REF_PRINT(ret, 0, 1); - } - CRYPTO_THREAD_unlock(global_engine_lock); - return ret; -} - -/* Iterate to the next/previous "ENGINE" type (NULL = end of the list). */ -ENGINE *ENGINE_get_next(ENGINE *e) -{ - ENGINE *ret = NULL; - if (e == NULL) { - ERR_raise(ERR_LIB_ENGINE, ERR_R_PASSED_NULL_PARAMETER); - return NULL; - } - if (!CRYPTO_THREAD_write_lock(global_engine_lock)) - return NULL; - ret = e->next; - if (ret) { - int ref; - - /* Return a valid structural reference to the next ENGINE */ - if (!CRYPTO_UP_REF(&ret->struct_ref, &ref)) { - CRYPTO_THREAD_unlock(global_engine_lock); - ERR_raise(ERR_LIB_ENGINE, ERR_R_CRYPTO_LIB); - return NULL; - } - ENGINE_REF_PRINT(ret, 0, 1); - } - CRYPTO_THREAD_unlock(global_engine_lock); - /* Release the structural reference to the previous ENGINE */ - ENGINE_free(e); - return ret; -} - -ENGINE *ENGINE_get_prev(ENGINE *e) -{ - ENGINE *ret = NULL; - if (e == NULL) { - ERR_raise(ERR_LIB_ENGINE, ERR_R_PASSED_NULL_PARAMETER); - return NULL; - } - if (!CRYPTO_THREAD_write_lock(global_engine_lock)) - return NULL; - ret = e->prev; - if (ret) { - int ref; - - /* Return a valid structural reference to the next ENGINE */ - if (!CRYPTO_UP_REF(&ret->struct_ref, &ref)) { - CRYPTO_THREAD_unlock(global_engine_lock); - ERR_raise(ERR_LIB_ENGINE, ERR_R_CRYPTO_LIB); - return NULL; - } - ENGINE_REF_PRINT(ret, 0, 1); - } - CRYPTO_THREAD_unlock(global_engine_lock); - /* Release the structural reference to the previous ENGINE */ - ENGINE_free(e); - return ret; -} - -/* Add another "ENGINE" type into the list. */ -int ENGINE_add(ENGINE *e) -{ - int to_return = 1; - if (e == NULL) { - ERR_raise(ERR_LIB_ENGINE, ERR_R_PASSED_NULL_PARAMETER); - return 0; - } - if ((e->id == NULL) || (e->name == NULL)) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_ID_OR_NAME_MISSING); - return 0; - } - if (!CRYPTO_THREAD_write_lock(global_engine_lock)) - return 0; - if (!engine_list_add(e)) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INTERNAL_LIST_ERROR); - to_return = 0; - } - CRYPTO_THREAD_unlock(global_engine_lock); - return to_return; -} - -/* Remove an existing "ENGINE" type from the array. */ -int ENGINE_remove(ENGINE *e) -{ - int to_return = 1; - if (e == NULL) { - ERR_raise(ERR_LIB_ENGINE, ERR_R_PASSED_NULL_PARAMETER); - return 0; - } - if (!CRYPTO_THREAD_write_lock(global_engine_lock)) - return 0; - if (!engine_list_remove(e)) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INTERNAL_LIST_ERROR); - to_return = 0; - } - CRYPTO_THREAD_unlock(global_engine_lock); - return to_return; -} - -static void engine_cpy(ENGINE *dest, const ENGINE *src) -{ - dest->id = src->id; - dest->name = src->name; - dest->rsa_meth = src->rsa_meth; -#ifndef OPENSSL_NO_DSA - dest->dsa_meth = src->dsa_meth; -#endif -#ifndef OPENSSL_NO_DH - dest->dh_meth = src->dh_meth; -#endif -#ifndef OPENSSL_NO_EC - dest->ec_meth = src->ec_meth; -#endif - dest->rand_meth = src->rand_meth; - dest->ciphers = src->ciphers; - dest->digests = src->digests; - dest->pkey_meths = src->pkey_meths; - dest->destroy = src->destroy; - dest->init = src->init; - dest->finish = src->finish; - dest->ctrl = src->ctrl; - dest->load_privkey = src->load_privkey; - dest->load_pubkey = src->load_pubkey; - dest->cmd_defns = src->cmd_defns; - dest->flags = src->flags; - dest->dynamic_id = src->dynamic_id; - engine_add_dynamic_id(dest, NULL, 0); -} - -ENGINE *ENGINE_by_id(const char *id) -{ - ENGINE *iterator; - const char *load_dir = NULL; - if (id == NULL) { - ERR_raise(ERR_LIB_ENGINE, ERR_R_PASSED_NULL_PARAMETER); - return NULL; - } - ENGINE_load_builtin_engines(); - - if (!RUN_ONCE(&engine_lock_init, do_engine_lock_init)) { - /* Maybe this should be raised in do_engine_lock_init() */ - ERR_raise(ERR_LIB_ENGINE, ERR_R_CRYPTO_LIB); - return NULL; - } - - if (!CRYPTO_THREAD_write_lock(global_engine_lock)) - return NULL; - iterator = engine_list_head; - while (iterator && (strcmp(id, iterator->id) != 0)) - iterator = iterator->next; - if (iterator != NULL) { - /* - * We need to return a structural reference. If this is an ENGINE - * type that returns copies, make a duplicate - otherwise increment - * the existing ENGINE's reference count. - */ - if (iterator->flags & ENGINE_FLAGS_BY_ID_COPY) { - ENGINE *cp = ENGINE_new(); - if (cp == NULL) - iterator = NULL; - else { - engine_cpy(cp, iterator); - iterator = cp; - } - } else { - int ref; - - if (!CRYPTO_UP_REF(&iterator->struct_ref, &ref)) { - CRYPTO_THREAD_unlock(global_engine_lock); - ERR_raise(ERR_LIB_ENGINE, ERR_R_CRYPTO_LIB); - return NULL; - } - ENGINE_REF_PRINT(iterator, 0, 1); - } - } - CRYPTO_THREAD_unlock(global_engine_lock); - if (iterator != NULL) - return iterator; - /* - * Prevent infinite recursion if we're looking for the dynamic engine. - */ - if (strcmp(id, "dynamic")) { - if ((load_dir = ossl_safe_getenv("OPENSSL_ENGINES")) == NULL) - load_dir = ossl_get_enginesdir(); - iterator = ENGINE_by_id("dynamic"); - if (!iterator || !ENGINE_ctrl_cmd_string(iterator, "ID", id, 0) || - !ENGINE_ctrl_cmd_string(iterator, "DIR_LOAD", "2", 0) || - !ENGINE_ctrl_cmd_string(iterator, "DIR_ADD", - load_dir, 0) || - !ENGINE_ctrl_cmd_string(iterator, "LIST_ADD", "1", 0) || - !ENGINE_ctrl_cmd_string(iterator, "LOAD", NULL, 0)) - goto notfound; - return iterator; - } - notfound: - ENGINE_free(iterator); - ERR_raise_data(ERR_LIB_ENGINE, ENGINE_R_NO_SUCH_ENGINE, "id=%s", id); - return NULL; - /* EEK! Experimental code ends */ -} - -int ENGINE_up_ref(ENGINE *e) -{ - int i; - if (e == NULL) { - ERR_raise(ERR_LIB_ENGINE, ERR_R_PASSED_NULL_PARAMETER); - return 0; - } - CRYPTO_UP_REF(&e->struct_ref, &i); - return 1; -} diff --git a/crypto/engine/eng_local.h b/crypto/engine/eng_local.h deleted file mode 100644 index 24920973e7..0000000000 --- a/crypto/engine/eng_local.h +++ /dev/null @@ -1,169 +0,0 @@ -/* - * Copyright 2001-2023 The OpenSSL Project Authors. All Rights Reserved. - * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#ifndef OSSL_CRYPTO_ENGINE_ENG_LOCAL_H -# define OSSL_CRYPTO_ENGINE_ENG_LOCAL_H - -# include -# include "internal/cryptlib.h" -# include "crypto/engine.h" -# include "internal/thread_once.h" -# include "internal/refcount.h" - -extern CRYPTO_RWLOCK *global_engine_lock; - -/* - * This prints the engine's pointer address, "struct" or "funct" to - * indicate the reference type, the before and after reference count, and - * the file:line-number pair. The "ENGINE_REF_PRINT" statements must come - * *after* the change. - */ -# define ENGINE_REF_PRINT(e, isfunct, diff) \ - OSSL_TRACE6(ENGINE_REF_COUNT, \ - "engine: %p %s from %d to %d (%s:%d)\n", \ - (void *)(e), (isfunct ? "funct" : "struct"), \ - ((isfunct) \ - ? ((e)->funct_ref - (diff)) \ - : (eng_struct_ref(e) - (diff))), \ - ((isfunct) ? (e)->funct_ref : eng_struct_ref(e)), \ - (OPENSSL_FILE), (OPENSSL_LINE)) - -/* - * Any code that will need cleanup operations should use these functions to - * register callbacks. engine_cleanup_int() will call all registered - * callbacks in order. NB: both the "add" functions assume the engine lock to - * already be held (in "write" mode). - */ -typedef void (ENGINE_CLEANUP_CB) (void); -typedef struct st_engine_cleanup_item { - ENGINE_CLEANUP_CB *cb; -} ENGINE_CLEANUP_ITEM; -DEFINE_STACK_OF(ENGINE_CLEANUP_ITEM) -int engine_cleanup_add_first(ENGINE_CLEANUP_CB *cb); -int engine_cleanup_add_last(ENGINE_CLEANUP_CB *cb); - -/* We need stacks of ENGINEs for use in eng_table.c */ -DEFINE_STACK_OF(ENGINE) - -/* - * This represents an implementation table. Dependent code should instantiate - * it as a (ENGINE_TABLE *) pointer value set initially to NULL. - */ -typedef struct st_engine_table ENGINE_TABLE; -int engine_table_register(ENGINE_TABLE **table, ENGINE_CLEANUP_CB *cleanup, - ENGINE *e, const int *nids, int num_nids, - int setdefault); -void engine_table_unregister(ENGINE_TABLE **table, ENGINE *e); -void engine_table_cleanup(ENGINE_TABLE **table); -ENGINE *ossl_engine_table_select(ENGINE_TABLE **table, int nid, - const char *f, int l); -typedef void (engine_table_doall_cb) (int nid, STACK_OF(ENGINE) *sk, - ENGINE *def, void *arg); -void engine_table_doall(ENGINE_TABLE *table, engine_table_doall_cb *cb, - void *arg); - -/* - * Internal versions of API functions that have control over locking. These - * are used between C files when functionality needs to be shared but the - * caller may already be controlling of the engine lock. - */ -int engine_unlocked_init(ENGINE *e); -int engine_unlocked_finish(ENGINE *e, int unlock_for_handlers); -int engine_free_util(ENGINE *e, int not_locked); - -/* - * This function will reset all "set"able values in an ENGINE to NULL. This - * won't touch reference counts or ex_data, but is equivalent to calling all - * the ENGINE_set_***() functions with a NULL value. - */ -void engine_set_all_null(ENGINE *e); - -/* - * NB: Bitwise OR-able values for the "flags" variable in ENGINE are now - * exposed in engine.h. - */ - -/* Free up dynamically allocated public key methods associated with ENGINE */ - -void engine_pkey_meths_free(ENGINE *e); -void engine_pkey_asn1_meths_free(ENGINE *e); - -/* Once initialisation function */ -extern CRYPTO_ONCE engine_lock_init; -DECLARE_RUN_ONCE(do_engine_lock_init) - -typedef void (*ENGINE_DYNAMIC_ID)(void); -int engine_add_dynamic_id(ENGINE *e, ENGINE_DYNAMIC_ID dynamic_id, - int not_locked); -void engine_remove_dynamic_id(ENGINE *e, int not_locked); - -/* - * This is a structure for storing implementations of various crypto - * algorithms and functions. - */ -struct engine_st { - const char *id; - const char *name; - const RSA_METHOD *rsa_meth; - const DSA_METHOD *dsa_meth; - const DH_METHOD *dh_meth; - const EC_KEY_METHOD *ec_meth; - const RAND_METHOD *rand_meth; - /* Cipher handling is via this callback */ - ENGINE_CIPHERS_PTR ciphers; - /* Digest handling is via this callback */ - ENGINE_DIGESTS_PTR digests; - /* Public key handling via this callback */ - ENGINE_PKEY_METHS_PTR pkey_meths; - /* ASN1 public key handling via this callback */ - ENGINE_PKEY_ASN1_METHS_PTR pkey_asn1_meths; - ENGINE_GEN_INT_FUNC_PTR destroy; - ENGINE_GEN_INT_FUNC_PTR init; - ENGINE_GEN_INT_FUNC_PTR finish; - ENGINE_CTRL_FUNC_PTR ctrl; - ENGINE_LOAD_KEY_PTR load_privkey; - ENGINE_LOAD_KEY_PTR load_pubkey; - ENGINE_SSL_CLIENT_CERT_PTR load_ssl_client_cert; - const ENGINE_CMD_DEFN *cmd_defns; - int flags; - /* reference count on the structure itself */ - CRYPTO_REF_COUNT struct_ref; - /* - * reference count on usability of the engine type. NB: This controls the - * loading and initialisation of any functionality required by this - * engine, whereas the previous count is simply to cope with - * (de)allocation of this structure. Hence, running_ref <= struct_ref at - * all times. - */ - int funct_ref; - /* A place to store per-ENGINE data */ - CRYPTO_EX_DATA ex_data; - /* Used to maintain the linked-list of engines. */ - struct engine_st *prev; - struct engine_st *next; - /* Used to maintain the linked-list of dynamic engines. */ - struct engine_st *prev_dyn; - struct engine_st *next_dyn; - ENGINE_DYNAMIC_ID dynamic_id; -}; - -typedef struct st_engine_pile ENGINE_PILE; - -DEFINE_LHASH_OF_EX(ENGINE_PILE); - -static ossl_unused ossl_inline int eng_struct_ref(ENGINE *e) -{ - int res; - - CRYPTO_GET_REF(&e->struct_ref, &res); - return res; -} - -#endif /* OSSL_CRYPTO_ENGINE_ENG_LOCAL_H */ diff --git a/crypto/engine/eng_openssl.c b/crypto/engine/eng_openssl.c deleted file mode 100644 index cc4fe96218..0000000000 --- a/crypto/engine/eng_openssl.c +++ /dev/null @@ -1,670 +0,0 @@ -/* - * Copyright 2001-2025 The OpenSSL Project Authors. All Rights Reserved. - * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - -/* - * RC4 and SHA-1 low level APIs and EVP _meth_ APISs are deprecated for public - * use, but still ok for internal use. - */ -#include "internal/deprecated.h" - -#include -#include -#include "internal/cryptlib.h" -#include "crypto/engine.h" -#include -#include -#include -#include -#include -#include - -#include -#include - -/* - * This testing gunk is implemented (and explained) lower down. It also - * assumes the application explicitly calls "ENGINE_load_openssl()" because - * this is no longer automatic in ENGINE_load_builtin_engines(). - */ -#define TEST_ENG_OPENSSL_RC4 -#ifndef OPENSSL_NO_STDIO -# define TEST_ENG_OPENSSL_PKEY -#endif -/* #define TEST_ENG_OPENSSL_HMAC */ -/* #define TEST_ENG_OPENSSL_HMAC_INIT */ -/* #define TEST_ENG_OPENSSL_RC4_OTHERS */ -#ifndef OPENSSL_NO_STDIO -# define TEST_ENG_OPENSSL_RC4_P_INIT -#endif -/* #define TEST_ENG_OPENSSL_RC4_P_CIPHER */ -#define TEST_ENG_OPENSSL_SHA -/* #define TEST_ENG_OPENSSL_SHA_OTHERS */ -/* #define TEST_ENG_OPENSSL_SHA_P_INIT */ -/* #define TEST_ENG_OPENSSL_SHA_P_UPDATE */ -/* #define TEST_ENG_OPENSSL_SHA_P_FINAL */ - -/* Now check what of those algorithms are actually enabled */ -#ifdef OPENSSL_NO_RC4 -# undef TEST_ENG_OPENSSL_RC4 -# undef TEST_ENG_OPENSSL_RC4_OTHERS -# undef TEST_ENG_OPENSSL_RC4_P_INIT -# undef TEST_ENG_OPENSSL_RC4_P_CIPHER -#endif - -static int openssl_destroy(ENGINE *e); - -#ifdef TEST_ENG_OPENSSL_RC4 -static int openssl_ciphers(ENGINE *e, const EVP_CIPHER **cipher, - const int **nids, int nid); -#endif -#ifdef TEST_ENG_OPENSSL_SHA -static int openssl_digests(ENGINE *e, const EVP_MD **digest, - const int **nids, int nid); -#endif - -#ifdef TEST_ENG_OPENSSL_PKEY -static EVP_PKEY *openssl_load_privkey(ENGINE *eng, const char *key_id, - UI_METHOD *ui_method, - void *callback_data); -#endif - -#ifdef TEST_ENG_OPENSSL_HMAC -static int ossl_register_hmac_meth(void); -static int ossl_pkey_meths(ENGINE *e, EVP_PKEY_METHOD **pmeth, - const int **nids, int nid); -#endif - -/* The constants used when creating the ENGINE */ -static const char *engine_openssl_id = "openssl"; -static const char *engine_openssl_name = "Software engine support"; - -/* - * This internal function is used by ENGINE_openssl() and possibly by the - * "dynamic" ENGINE support too - */ -static int bind_helper(ENGINE *e) -{ - if (!ENGINE_set_id(e, engine_openssl_id) - || !ENGINE_set_name(e, engine_openssl_name) - || !ENGINE_set_destroy_function(e, openssl_destroy) -#ifndef TEST_ENG_OPENSSL_NO_ALGORITHMS - || !ENGINE_set_RSA(e, RSA_get_default_method()) -# ifndef OPENSSL_NO_DSA - || !ENGINE_set_DSA(e, DSA_get_default_method()) -# endif -# ifndef OPENSSL_NO_EC - || !ENGINE_set_EC(e, EC_KEY_OpenSSL()) -# endif -# ifndef OPENSSL_NO_DH - || !ENGINE_set_DH(e, DH_get_default_method()) -# endif - || !ENGINE_set_RAND(e, RAND_OpenSSL()) -# ifdef TEST_ENG_OPENSSL_RC4 - || !ENGINE_set_ciphers(e, openssl_ciphers) -# endif -# ifdef TEST_ENG_OPENSSL_SHA - || !ENGINE_set_digests(e, openssl_digests) -# endif -#endif -#ifdef TEST_ENG_OPENSSL_PKEY - || !ENGINE_set_load_privkey_function(e, openssl_load_privkey) -#endif -#ifdef TEST_ENG_OPENSSL_HMAC - || !ossl_register_hmac_meth() - || !ENGINE_set_pkey_meths(e, ossl_pkey_meths) -#endif - ) - return 0; - /* - * If we add errors to this ENGINE, ensure the error handling is setup - * here - */ - /* openssl_load_error_strings(); */ - return 1; -} - -static ENGINE *engine_openssl(void) -{ - ENGINE *ret = ENGINE_new(); - if (ret == NULL) - return NULL; - if (!bind_helper(ret)) { - ENGINE_free(ret); - return NULL; - } - return ret; -} - -void engine_load_openssl_int(void) -{ - ENGINE *toadd = engine_openssl(); - if (!toadd) - return; - - ERR_set_mark(); - ENGINE_add(toadd); - /* - * If the "add" worked, it gets a structural reference. So either way, we - * release our just-created reference. - */ - ENGINE_free(toadd); - /* - * If the "add" didn't work, it was probably a conflict because it was - * already added (eg. someone calling ENGINE_load_blah then calling - * ENGINE_load_builtin_engines() perhaps). - */ - ERR_pop_to_mark(); -} - -/* - * This stuff is needed if this ENGINE is being compiled into a - * self-contained shared-library. - */ -#ifdef ENGINE_DYNAMIC_SUPPORT -static int bind_fn(ENGINE *e, const char *id) -{ - if (id && (strcmp(id, engine_openssl_id) != 0)) - return 0; - if (!bind_helper(e)) - return 0; - return 1; -} - -IMPLEMENT_DYNAMIC_CHECK_FN() - IMPLEMENT_DYNAMIC_BIND_FN(bind_fn) -#endif /* ENGINE_DYNAMIC_SUPPORT */ -#ifdef TEST_ENG_OPENSSL_RC4 -/*- - * This section of code compiles an "alternative implementation" of two modes of - * RC4 into this ENGINE. The result is that EVP_CIPHER operation for "rc4" - * should under normal circumstances go via this support rather than the default - * EVP support. There are other symbols to tweak the testing; - * TEST_ENC_OPENSSL_RC4_OTHERS - print a one line message to stderr each time - * we're asked for a cipher we don't support (should not happen). - * TEST_ENG_OPENSSL_RC4_P_INIT - print a one line message to stderr each time - * the "init_key" handler is called. - * TEST_ENG_OPENSSL_RC4_P_CIPHER - ditto for the "cipher" handler. - */ -# include -# define TEST_RC4_KEY_SIZE 16 -typedef struct { - unsigned char key[TEST_RC4_KEY_SIZE]; - RC4_KEY ks; -} TEST_RC4_KEY; -# define test(ctx) ((TEST_RC4_KEY *)EVP_CIPHER_CTX_get_cipher_data(ctx)) -static int test_rc4_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, - const unsigned char *iv, int enc) -{ - const int n = EVP_CIPHER_CTX_get_key_length(ctx); - -# ifdef TEST_ENG_OPENSSL_RC4_P_INIT - fprintf(stderr, "(TEST_ENG_OPENSSL_RC4) test_init_key() called\n"); -# endif - if (n <= 0) - return n; - memcpy(&test(ctx)->key[0], key, n); - RC4_set_key(&test(ctx)->ks, n, test(ctx)->key); - return 1; -} - -static int test_rc4_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) -{ -# ifdef TEST_ENG_OPENSSL_RC4_P_CIPHER - fprintf(stderr, "(TEST_ENG_OPENSSL_RC4) test_cipher() called\n"); -# endif - RC4(&test(ctx)->ks, inl, in, out); - return 1; -} - -static EVP_CIPHER *r4_cipher = NULL; -static const EVP_CIPHER *test_r4_cipher(void) -{ - if (r4_cipher == NULL) { - EVP_CIPHER *cipher; - - if ((cipher = EVP_CIPHER_meth_new(NID_rc4, 1, TEST_RC4_KEY_SIZE)) == NULL - || !EVP_CIPHER_meth_set_iv_length(cipher, 0) - || !EVP_CIPHER_meth_set_flags(cipher, EVP_CIPH_VARIABLE_LENGTH) - || !EVP_CIPHER_meth_set_init(cipher, test_rc4_init_key) - || !EVP_CIPHER_meth_set_do_cipher(cipher, test_rc4_cipher) - || !EVP_CIPHER_meth_set_impl_ctx_size(cipher, sizeof(TEST_RC4_KEY))) { - EVP_CIPHER_meth_free(cipher); - cipher = NULL; - } - r4_cipher = cipher; - } - return r4_cipher; -} -static void test_r4_cipher_destroy(void) -{ - EVP_CIPHER_meth_free(r4_cipher); - r4_cipher = NULL; -} - -static EVP_CIPHER *r4_40_cipher = NULL; -static const EVP_CIPHER *test_r4_40_cipher(void) -{ - if (r4_40_cipher == NULL) { - EVP_CIPHER *cipher; - - if ((cipher = EVP_CIPHER_meth_new(NID_rc4, 1, 5 /* 40 bits */)) == NULL - || !EVP_CIPHER_meth_set_iv_length(cipher, 0) - || !EVP_CIPHER_meth_set_flags(cipher, EVP_CIPH_VARIABLE_LENGTH) - || !EVP_CIPHER_meth_set_init(cipher, test_rc4_init_key) - || !EVP_CIPHER_meth_set_do_cipher(cipher, test_rc4_cipher) - || !EVP_CIPHER_meth_set_impl_ctx_size(cipher, sizeof(TEST_RC4_KEY))) { - EVP_CIPHER_meth_free(cipher); - cipher = NULL; - } - r4_40_cipher = cipher; - } - return r4_40_cipher; -} -static void test_r4_40_cipher_destroy(void) -{ - EVP_CIPHER_meth_free(r4_40_cipher); - r4_40_cipher = NULL; -} -static int test_cipher_nids(const int **nids) -{ - static int cipher_nids[4] = { 0, 0, 0, 0 }; - static int pos = 0; - static int init = 0; - - if (!init) { - const EVP_CIPHER *cipher; - if ((cipher = test_r4_cipher()) != NULL) - cipher_nids[pos++] = EVP_CIPHER_get_nid(cipher); - if ((cipher = test_r4_40_cipher()) != NULL) - cipher_nids[pos++] = EVP_CIPHER_get_nid(cipher); - cipher_nids[pos] = 0; - init = 1; - } - *nids = cipher_nids; - return pos; -} - -static int openssl_ciphers(ENGINE *e, const EVP_CIPHER **cipher, - const int **nids, int nid) -{ - if (!cipher) { - /* We are returning a list of supported nids */ - return test_cipher_nids(nids); - } - /* We are being asked for a specific cipher */ - if (nid == NID_rc4) - *cipher = test_r4_cipher(); - else if (nid == NID_rc4_40) - *cipher = test_r4_40_cipher(); - else { -# ifdef TEST_ENG_OPENSSL_RC4_OTHERS - fprintf(stderr, "(TEST_ENG_OPENSSL_RC4) returning NULL for " - "nid %d\n", nid); -# endif - *cipher = NULL; - return 0; - } - return 1; -} -#endif - -#ifdef TEST_ENG_OPENSSL_SHA -/* Much the same sort of comment as for TEST_ENG_OPENSSL_RC4 */ -# include - -static int test_sha1_init(EVP_MD_CTX *ctx) -{ -# ifdef TEST_ENG_OPENSSL_SHA_P_INIT - fprintf(stderr, "(TEST_ENG_OPENSSL_SHA) test_sha1_init() called\n"); -# endif - return SHA1_Init(EVP_MD_CTX_get0_md_data(ctx)); -} - -static int test_sha1_update(EVP_MD_CTX *ctx, const void *data, size_t count) -{ -# ifdef TEST_ENG_OPENSSL_SHA_P_UPDATE - fprintf(stderr, "(TEST_ENG_OPENSSL_SHA) test_sha1_update() called\n"); -# endif - return SHA1_Update(EVP_MD_CTX_get0_md_data(ctx), data, count); -} - -static int test_sha1_final(EVP_MD_CTX *ctx, unsigned char *md) -{ -# ifdef TEST_ENG_OPENSSL_SHA_P_FINAL - fprintf(stderr, "(TEST_ENG_OPENSSL_SHA) test_sha1_final() called\n"); -# endif - return SHA1_Final(md, EVP_MD_CTX_get0_md_data(ctx)); -} - -static EVP_MD *sha1_md = NULL; -static const EVP_MD *test_sha_md(void) -{ - if (sha1_md == NULL) { - EVP_MD *md; - - if ((md = EVP_MD_meth_new(NID_sha1, NID_sha1WithRSAEncryption)) == NULL - || !EVP_MD_meth_set_result_size(md, SHA_DIGEST_LENGTH) - || !EVP_MD_meth_set_input_blocksize(md, SHA_CBLOCK) - || !EVP_MD_meth_set_app_datasize(md, - sizeof(EVP_MD *) + sizeof(SHA_CTX)) - || !EVP_MD_meth_set_flags(md, 0) - || !EVP_MD_meth_set_init(md, test_sha1_init) - || !EVP_MD_meth_set_update(md, test_sha1_update) - || !EVP_MD_meth_set_final(md, test_sha1_final)) { - EVP_MD_meth_free(md); - md = NULL; - } - sha1_md = md; - } - return sha1_md; -} -static void test_sha_md_destroy(void) -{ - EVP_MD_meth_free(sha1_md); - sha1_md = NULL; -} -static int test_digest_nids(const int **nids) -{ - static int digest_nids[2] = { 0, 0 }; - static int pos = 0; - static int init = 0; - - if (!init) { - const EVP_MD *md; - if ((md = test_sha_md()) != NULL) - digest_nids[pos++] = EVP_MD_get_type(md); - digest_nids[pos] = 0; - init = 1; - } - *nids = digest_nids; - return pos; -} - -static int openssl_digests(ENGINE *e, const EVP_MD **digest, - const int **nids, int nid) -{ - if (!digest) { - /* We are returning a list of supported nids */ - return test_digest_nids(nids); - } - /* We are being asked for a specific digest */ - if (nid == NID_sha1) - *digest = test_sha_md(); - else { -# ifdef TEST_ENG_OPENSSL_SHA_OTHERS - fprintf(stderr, "(TEST_ENG_OPENSSL_SHA) returning NULL for " - "nid %d\n", nid); -# endif - *digest = NULL; - return 0; - } - return 1; -} -#endif - -#ifdef TEST_ENG_OPENSSL_PKEY -static EVP_PKEY *openssl_load_privkey(ENGINE *eng, const char *key_id, - UI_METHOD *ui_method, - void *callback_data) -{ - BIO *in; - EVP_PKEY *key; - fprintf(stderr, "(TEST_ENG_OPENSSL_PKEY)Loading Private key %s\n", - key_id); -# if defined(OPENSSL_SYS_WINDOWS) - in = BIO_new_file(key_id, "rb"); -# else - in = BIO_new_file(key_id, "r"); -# endif - if (!in) - return NULL; - key = PEM_read_bio_PrivateKey(in, NULL, 0, NULL); - BIO_free(in); - return key; -} -#endif - -#ifdef TEST_ENG_OPENSSL_HMAC - -/* - * Experimental HMAC redirection implementation: mainly copied from - * hm_pmeth.c - */ - -/* HMAC pkey context structure */ - -typedef struct { - const EVP_MD *md; /* MD for HMAC use */ - ASN1_OCTET_STRING ktmp; /* Temp storage for key */ - HMAC_CTX *ctx; -} OSSL_HMAC_PKEY_CTX; - -static int ossl_hmac_init(EVP_PKEY_CTX *ctx) -{ - OSSL_HMAC_PKEY_CTX *hctx; - - if ((hctx = OPENSSL_zalloc(sizeof(*hctx))) == NULL) - return 0; - hctx->ktmp.type = V_ASN1_OCTET_STRING; - hctx->ctx = HMAC_CTX_new(); - if (hctx->ctx == NULL) { - OPENSSL_free(hctx); - return 0; - } - EVP_PKEY_CTX_set_data(ctx, hctx); - EVP_PKEY_CTX_set0_keygen_info(ctx, NULL, 0); -# ifdef TEST_ENG_OPENSSL_HMAC_INIT - fprintf(stderr, "(TEST_ENG_OPENSSL_HMAC) ossl_hmac_init() called\n"); -# endif - return 1; -} - -static void ossl_hmac_cleanup(EVP_PKEY_CTX *ctx); - -static int ossl_hmac_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src) -{ - OSSL_HMAC_PKEY_CTX *sctx, *dctx; - - /* allocate memory for dst->data and a new HMAC_CTX in dst->data->ctx */ - if (!ossl_hmac_init(dst)) - return 0; - sctx = EVP_PKEY_CTX_get_data(src); - dctx = EVP_PKEY_CTX_get_data(dst); - dctx->md = sctx->md; - if (!HMAC_CTX_copy(dctx->ctx, sctx->ctx)) - goto err; - if (sctx->ktmp.data) { - if (!ASN1_OCTET_STRING_set(&dctx->ktmp, - sctx->ktmp.data, sctx->ktmp.length)) - goto err; - } - return 1; -err: - /* release HMAC_CTX in dst->data->ctx and memory allocated for dst->data */ - ossl_hmac_cleanup(dst); - return 0; -} - -static void ossl_hmac_cleanup(EVP_PKEY_CTX *ctx) -{ - OSSL_HMAC_PKEY_CTX *hctx = EVP_PKEY_CTX_get_data(ctx); - - if (hctx) { - HMAC_CTX_free(hctx->ctx); - OPENSSL_clear_free(hctx->ktmp.data, hctx->ktmp.length); - OPENSSL_free(hctx); - EVP_PKEY_CTX_set_data(ctx, NULL); - } -} - -static int ossl_hmac_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey) -{ - ASN1_OCTET_STRING *hkey = NULL; - OSSL_HMAC_PKEY_CTX *hctx = EVP_PKEY_CTX_get_data(ctx); - if (!hctx->ktmp.data) - return 0; - hkey = ASN1_OCTET_STRING_dup(&hctx->ktmp); - if (!hkey) - return 0; - EVP_PKEY_assign(pkey, EVP_PKEY_HMAC, hkey); - - return 1; -} - -static int ossl_int_update(EVP_MD_CTX *ctx, const void *data, size_t count) -{ - OSSL_HMAC_PKEY_CTX *hctx = EVP_PKEY_CTX_get_data(EVP_MD_CTX_get_pkey_ctx(ctx)); - if (!HMAC_Update(hctx->ctx, data, count)) - return 0; - return 1; -} - -static int ossl_hmac_signctx_init(EVP_PKEY_CTX *ctx, EVP_MD_CTX *mctx) -{ - EVP_MD_CTX_set_flags(mctx, EVP_MD_CTX_FLAG_NO_INIT); - EVP_MD_CTX_set_update_fn(mctx, ossl_int_update); - return 1; -} - -static int ossl_hmac_signctx(EVP_PKEY_CTX *ctx, unsigned char *sig, - size_t *siglen, EVP_MD_CTX *mctx) -{ - unsigned int hlen; - OSSL_HMAC_PKEY_CTX *hctx = EVP_PKEY_CTX_get_data(ctx); - int l = EVP_MD_CTX_get_size(mctx); - - if (l < 0) - return 0; - *siglen = l; - if (!sig) - return 1; - - if (!HMAC_Final(hctx->ctx, sig, &hlen)) - return 0; - *siglen = (size_t)hlen; - return 1; -} - -static int ossl_hmac_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) -{ - OSSL_HMAC_PKEY_CTX *hctx = EVP_PKEY_CTX_get_data(ctx); - EVP_PKEY *pk; - ASN1_OCTET_STRING *key; - switch (type) { - - case EVP_PKEY_CTRL_SET_MAC_KEY: - if ((!p2 && p1 > 0) || (p1 < -1)) - return 0; - if (!ASN1_OCTET_STRING_set(&hctx->ktmp, p2, p1)) - return 0; - break; - - case EVP_PKEY_CTRL_MD: - hctx->md = p2; - break; - - case EVP_PKEY_CTRL_DIGESTINIT: - pk = EVP_PKEY_CTX_get0_pkey(ctx); - key = EVP_PKEY_get0(pk); - if (!HMAC_Init_ex(hctx->ctx, key->data, key->length, hctx->md, NULL)) - return 0; - break; - - default: - return -2; - - } - return 1; -} - -static int ossl_hmac_ctrl_str(EVP_PKEY_CTX *ctx, - const char *type, const char *value) -{ - if (!value) { - return 0; - } - if (strcmp(type, "key") == 0) { - void *p = (void *)value; - return ossl_hmac_ctrl(ctx, EVP_PKEY_CTRL_SET_MAC_KEY, -1, p); - } - if (strcmp(type, "hexkey") == 0) { - unsigned char *key; - int r; - long keylen; - key = OPENSSL_hexstr2buf(value, &keylen); - if (!key) - return 0; - r = ossl_hmac_ctrl(ctx, EVP_PKEY_CTRL_SET_MAC_KEY, keylen, key); - OPENSSL_free(key); - return r; - } - return -2; -} - -static EVP_PKEY_METHOD *ossl_hmac_meth; - -static int ossl_register_hmac_meth(void) -{ - EVP_PKEY_METHOD *meth; - meth = EVP_PKEY_meth_new(EVP_PKEY_HMAC, 0); - if (meth == NULL) - return 0; - EVP_PKEY_meth_set_init(meth, ossl_hmac_init); - EVP_PKEY_meth_set_copy(meth, ossl_hmac_copy); - EVP_PKEY_meth_set_cleanup(meth, ossl_hmac_cleanup); - - EVP_PKEY_meth_set_keygen(meth, 0, ossl_hmac_keygen); - - EVP_PKEY_meth_set_signctx(meth, ossl_hmac_signctx_init, - ossl_hmac_signctx); - - EVP_PKEY_meth_set_ctrl(meth, ossl_hmac_ctrl, ossl_hmac_ctrl_str); - ossl_hmac_meth = meth; - return 1; -} - -static int ossl_pkey_meths(ENGINE *e, EVP_PKEY_METHOD **pmeth, - const int **nids, int nid) -{ - static int ossl_pkey_nids[] = { - EVP_PKEY_HMAC, - 0 - }; - - if (pmeth == NULL) { - *nids = ossl_pkey_nids; - return 1; - } - - if (nid == EVP_PKEY_HMAC) { - *pmeth = ossl_hmac_meth; - return 1; - } - - *pmeth = NULL; - return 0; -} - -#endif - -int openssl_destroy(ENGINE *e) -{ - test_sha_md_destroy(); -#ifdef TEST_ENG_OPENSSL_RC4 - test_r4_cipher_destroy(); - test_r4_40_cipher_destroy(); -#endif - return 1; -} - diff --git a/crypto/engine/eng_pkey.c b/crypto/engine/eng_pkey.c deleted file mode 100644 index d18d837e62..0000000000 --- a/crypto/engine/eng_pkey.c +++ /dev/null @@ -1,138 +0,0 @@ -/* - * Copyright 2001-2024 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - -#include "eng_local.h" - -/* Basic get/set stuff */ - -int ENGINE_set_load_privkey_function(ENGINE *e, - ENGINE_LOAD_KEY_PTR loadpriv_f) -{ - e->load_privkey = loadpriv_f; - return 1; -} - -int ENGINE_set_load_pubkey_function(ENGINE *e, ENGINE_LOAD_KEY_PTR loadpub_f) -{ - e->load_pubkey = loadpub_f; - return 1; -} - -int ENGINE_set_load_ssl_client_cert_function(ENGINE *e, - ENGINE_SSL_CLIENT_CERT_PTR - loadssl_f) -{ - e->load_ssl_client_cert = loadssl_f; - return 1; -} - -ENGINE_LOAD_KEY_PTR ENGINE_get_load_privkey_function(const ENGINE *e) -{ - return e->load_privkey; -} - -ENGINE_LOAD_KEY_PTR ENGINE_get_load_pubkey_function(const ENGINE *e) -{ - return e->load_pubkey; -} - -ENGINE_SSL_CLIENT_CERT_PTR ENGINE_get_ssl_client_cert_function(const ENGINE - *e) -{ - return e->load_ssl_client_cert; -} - -/* API functions to load public/private keys */ - -EVP_PKEY *ENGINE_load_private_key(ENGINE *e, const char *key_id, - UI_METHOD *ui_method, void *callback_data) -{ - EVP_PKEY *pkey; - - if (e == NULL) { - ERR_raise(ERR_LIB_ENGINE, ERR_R_PASSED_NULL_PARAMETER); - return NULL; - } - if (!CRYPTO_THREAD_write_lock(global_engine_lock)) - return NULL; - if (e->funct_ref == 0) { - CRYPTO_THREAD_unlock(global_engine_lock); - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_NOT_INITIALISED); - return NULL; - } - CRYPTO_THREAD_unlock(global_engine_lock); - if (!e->load_privkey) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_NO_LOAD_FUNCTION); - return NULL; - } - pkey = e->load_privkey(e, key_id, ui_method, callback_data); - if (pkey == NULL) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_FAILED_LOADING_PRIVATE_KEY); - return NULL; - } - return pkey; -} - -EVP_PKEY *ENGINE_load_public_key(ENGINE *e, const char *key_id, - UI_METHOD *ui_method, void *callback_data) -{ - EVP_PKEY *pkey; - - if (e == NULL) { - ERR_raise(ERR_LIB_ENGINE, ERR_R_PASSED_NULL_PARAMETER); - return NULL; - } - if (!CRYPTO_THREAD_write_lock(global_engine_lock)) - return NULL; - if (e->funct_ref == 0) { - CRYPTO_THREAD_unlock(global_engine_lock); - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_NOT_INITIALISED); - return NULL; - } - CRYPTO_THREAD_unlock(global_engine_lock); - if (!e->load_pubkey) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_NO_LOAD_FUNCTION); - return NULL; - } - pkey = e->load_pubkey(e, key_id, ui_method, callback_data); - if (pkey == NULL) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_FAILED_LOADING_PUBLIC_KEY); - return NULL; - } - return pkey; -} - -int ENGINE_load_ssl_client_cert(ENGINE *e, SSL *s, - STACK_OF(X509_NAME) *ca_dn, X509 **pcert, - EVP_PKEY **ppkey, STACK_OF(X509) **pother, - UI_METHOD *ui_method, void *callback_data) -{ - - if (e == NULL) { - ERR_raise(ERR_LIB_ENGINE, ERR_R_PASSED_NULL_PARAMETER); - return 0; - } - if (!CRYPTO_THREAD_write_lock(global_engine_lock)) - return 0; - if (e->funct_ref == 0) { - CRYPTO_THREAD_unlock(global_engine_lock); - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_NOT_INITIALISED); - return 0; - } - CRYPTO_THREAD_unlock(global_engine_lock); - if (!e->load_ssl_client_cert) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_NO_LOAD_FUNCTION); - return 0; - } - return e->load_ssl_client_cert(e, s, ca_dn, pcert, ppkey, pother, - ui_method, callback_data); -} diff --git a/crypto/engine/eng_rdrand.c b/crypto/engine/eng_rdrand.c deleted file mode 100644 index b3ece7bd91..0000000000 --- a/crypto/engine/eng_rdrand.c +++ /dev/null @@ -1,125 +0,0 @@ -/* - * Copyright 2011-2023 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - -#include - -#include -#include -#include "crypto/engine.h" -#include "internal/cryptlib.h" -#include -#include -#include - -#if defined(__has_feature) -# if __has_feature(memory_sanitizer) -# include -# endif -#endif - -#if (defined(__i386) || defined(__i386__) || defined(_M_IX86) || \ - defined(__x86_64) || defined(__x86_64__) || \ - defined(_M_AMD64) || defined (_M_X64)) && defined(OPENSSL_CPUID_OBJ) - -size_t OPENSSL_ia32_rdrand_bytes(unsigned char *buf, size_t len); - -static int get_random_bytes(unsigned char *buf, int num) -{ - if (num < 0) { - return 0; - } - -# if defined(__has_feature) -# if __has_feature(memory_sanitizer) - /* - * MemorySanitizer fails to understand asm and produces false positive - * use-of-uninitialized-value warnings. - */ - __msan_unpoison(buf, num); -# endif -# endif - - return (size_t)num == OPENSSL_ia32_rdrand_bytes(buf, (size_t)num); -} - -static int random_status(void) -{ - return 1; -} - -static RAND_METHOD rdrand_meth = { - NULL, /* seed */ - get_random_bytes, - NULL, /* cleanup */ - NULL, /* add */ - get_random_bytes, - random_status, -}; - -static int rdrand_init(ENGINE *e) -{ - return 1; -} - -static const char *engine_e_rdrand_id = "rdrand"; -static const char *engine_e_rdrand_name = "Intel RDRAND engine"; - -static int bind_helper(ENGINE *e) -{ - if (!ENGINE_set_id(e, engine_e_rdrand_id) || - !ENGINE_set_name(e, engine_e_rdrand_name) || - !ENGINE_set_flags(e, ENGINE_FLAGS_NO_REGISTER_ALL) || - !ENGINE_set_init_function(e, rdrand_init) || - !ENGINE_set_RAND(e, &rdrand_meth)) - return 0; - - return 1; -} - -static ENGINE *ENGINE_rdrand(void) -{ - ENGINE *ret = ENGINE_new(); - if (ret == NULL) - return NULL; - if (!bind_helper(ret)) { - ENGINE_free(ret); - return NULL; - } - return ret; -} - -void engine_load_rdrand_int(void) -{ - if (OPENSSL_ia32cap_P[1] & (1 << (62 - 32))) { - ENGINE *toadd = ENGINE_rdrand(); - if (!toadd) - return; - ERR_set_mark(); - ENGINE_add(toadd); - /* - * If the "add" worked, it gets a structural reference. So either way, we - * release our just-created reference. - */ - ENGINE_free(toadd); - /* - * If the "add" didn't work, it was probably a conflict because it was - * already added (eg. someone calling ENGINE_load_blah then calling - * ENGINE_load_builtin_engines() perhaps). - */ - ERR_pop_to_mark(); - } -} -#else -void engine_load_rdrand_int(void) -{ -} -#endif diff --git a/crypto/engine/eng_table.c b/crypto/engine/eng_table.c deleted file mode 100644 index 6280965cc0..0000000000 --- a/crypto/engine/eng_table.c +++ /dev/null @@ -1,316 +0,0 @@ -/* - * Copyright 2001-2024 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#include "internal/cryptlib.h" -#include -#include -#include -#include "eng_local.h" - -/* The type of the items in the table */ -struct st_engine_pile { - /* The 'nid' of this algorithm/mode */ - int nid; - /* ENGINEs that implement this algorithm/mode. */ - STACK_OF(ENGINE) *sk; - /* The default ENGINE to perform this algorithm/mode. */ - ENGINE *funct; - /* - * Zero if 'sk' is newer than the cached 'funct', non-zero otherwise - */ - int uptodate; -}; - -/* The type exposed in eng_local.h */ -struct st_engine_table { - LHASH_OF(ENGINE_PILE) piles; -}; /* ENGINE_TABLE */ - -typedef struct st_engine_pile_doall { - engine_table_doall_cb *cb; - void *arg; -} ENGINE_PILE_DOALL; - -/* Global flags (ENGINE_TABLE_FLAG_***). */ -static unsigned int table_flags = 0; - -/* API function manipulating 'table_flags' */ -unsigned int ENGINE_get_table_flags(void) -{ - return table_flags; -} - -void ENGINE_set_table_flags(unsigned int flags) -{ - table_flags = flags; -} - -/* Internal functions for the "piles" hash table */ -static unsigned long engine_pile_hash(const ENGINE_PILE *c) -{ - return c->nid; -} - -static int engine_pile_cmp(const ENGINE_PILE *a, const ENGINE_PILE *b) -{ - return a->nid - b->nid; -} - -static int int_table_check(ENGINE_TABLE **t, int create) -{ - LHASH_OF(ENGINE_PILE) *lh; - - if (*t) - return 1; - if (!create) - return 0; - if ((lh = lh_ENGINE_PILE_new(engine_pile_hash, engine_pile_cmp)) == NULL) - return 0; - *t = (ENGINE_TABLE *)lh; - return 1; -} - -/* - * Privately exposed (via eng_local.h) functions for adding and/or removing - * ENGINEs from the implementation table - */ -int engine_table_register(ENGINE_TABLE **table, ENGINE_CLEANUP_CB *cleanup, - ENGINE *e, const int *nids, int num_nids, - int setdefault) -{ - int ret = 0, added = 0; - ENGINE_PILE tmplate, *fnd; - - if (!CRYPTO_THREAD_write_lock(global_engine_lock)) - return 0; - if (!(*table)) - added = 1; - if (!int_table_check(table, 1)) - goto end; - /* The cleanup callback needs to be added */ - if (added && !engine_cleanup_add_first(cleanup)) { - lh_ENGINE_PILE_free(&(*table)->piles); - *table = NULL; - goto end; - } - while (num_nids--) { - tmplate.nid = *nids; - fnd = lh_ENGINE_PILE_retrieve(&(*table)->piles, &tmplate); - if (!fnd) { - fnd = OPENSSL_malloc(sizeof(*fnd)); - if (fnd == NULL) - goto end; - fnd->uptodate = 1; - fnd->nid = *nids; - fnd->sk = sk_ENGINE_new_null(); - if (!fnd->sk) { - OPENSSL_free(fnd); - goto end; - } - fnd->funct = NULL; - (void)lh_ENGINE_PILE_insert(&(*table)->piles, fnd); - if (lh_ENGINE_PILE_retrieve(&(*table)->piles, &tmplate) != fnd) { - sk_ENGINE_free(fnd->sk); - OPENSSL_free(fnd); - goto end; - } - } - /* A registration shouldn't add duplicate entries */ - (void)sk_ENGINE_delete_ptr(fnd->sk, e); - /* - * if 'setdefault', this ENGINE goes to the head of the list - */ - if (!sk_ENGINE_push(fnd->sk, e)) - goto end; - /* "touch" this ENGINE_PILE */ - fnd->uptodate = 0; - if (setdefault) { - if (!engine_unlocked_init(e)) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INIT_FAILED); - goto end; - } - if (fnd->funct) - engine_unlocked_finish(fnd->funct, 0); - fnd->funct = e; - fnd->uptodate = 1; - } - nids++; - } - ret = 1; - end: - CRYPTO_THREAD_unlock(global_engine_lock); - return ret; -} - -static void int_unregister_cb(ENGINE_PILE *pile, ENGINE *e) -{ - int n; - /* Iterate the 'c->sk' stack removing any occurrence of 'e' */ - while ((n = sk_ENGINE_find(pile->sk, e)) >= 0) { - (void)sk_ENGINE_delete(pile->sk, n); - pile->uptodate = 0; - } - if (pile->funct == e) { - engine_unlocked_finish(e, 0); - pile->funct = NULL; - } -} - -IMPLEMENT_LHASH_DOALL_ARG(ENGINE_PILE, ENGINE); - -void engine_table_unregister(ENGINE_TABLE **table, ENGINE *e) -{ - if (!CRYPTO_THREAD_write_lock(global_engine_lock)) - /* Can't return a value. :( */ - return; - if (int_table_check(table, 0)) - lh_ENGINE_PILE_doall_ENGINE(&(*table)->piles, int_unregister_cb, e); - CRYPTO_THREAD_unlock(global_engine_lock); -} - -static void int_cleanup_cb_doall(ENGINE_PILE *p) -{ - if (p == NULL) - return; - sk_ENGINE_free(p->sk); - if (p->funct) - engine_unlocked_finish(p->funct, 0); - OPENSSL_free(p); -} - -void engine_table_cleanup(ENGINE_TABLE **table) -{ - if (!CRYPTO_THREAD_write_lock(global_engine_lock)) - return; - if (*table) { - lh_ENGINE_PILE_doall(&(*table)->piles, int_cleanup_cb_doall); - lh_ENGINE_PILE_free(&(*table)->piles); - *table = NULL; - } - CRYPTO_THREAD_unlock(global_engine_lock); -} - -/* return a functional reference for a given 'nid' */ -ENGINE *ossl_engine_table_select(ENGINE_TABLE **table, int nid, - const char *f, int l) -{ - ENGINE *ret = NULL; - ENGINE_PILE tmplate, *fnd = NULL; - int initres, loop = 0; - -#ifndef OPENSSL_NO_AUTOLOAD_CONFIG - /* Load the config before trying to check if engines are available */ - OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL); -#endif - - if (!(*table)) { - OSSL_TRACE3(ENGINE_TABLE, - "%s:%d, nid=%d, nothing registered!\n", - f, l, nid); - return NULL; - } - - if (!CRYPTO_THREAD_write_lock(global_engine_lock)) - return NULL; - - ERR_set_mark(); - /* - * Check again inside the lock otherwise we could race against cleanup - * operations. But don't worry about a debug printout - */ - if (!int_table_check(table, 0)) - goto end; - tmplate.nid = nid; - fnd = lh_ENGINE_PILE_retrieve(&(*table)->piles, &tmplate); - if (!fnd) - goto end; - if (fnd->funct && engine_unlocked_init(fnd->funct)) { - OSSL_TRACE4(ENGINE_TABLE, - "%s:%d, nid=%d, using ENGINE '%s' cached\n", - f, l, nid, fnd->funct->id); - ret = fnd->funct; - goto end; - } - if (fnd->uptodate) { - ret = fnd->funct; - goto end; - } - trynext: - ret = sk_ENGINE_value(fnd->sk, loop++); - if (!ret) { - OSSL_TRACE3(ENGINE_TABLE, - "%s:%d, nid=%d, " - "no registered implementations would initialise\n", - f, l, nid); - goto end; - } - /* Try to initialise the ENGINE? */ - if ((ret->funct_ref > 0) || !(table_flags & ENGINE_TABLE_FLAG_NOINIT)) - initres = engine_unlocked_init(ret); - else - initres = 0; - if (initres) { - /* Update 'funct' */ - if ((fnd->funct != ret) && engine_unlocked_init(ret)) { - /* If there was a previous default we release it. */ - if (fnd->funct) - engine_unlocked_finish(fnd->funct, 0); - fnd->funct = ret; - OSSL_TRACE4(ENGINE_TABLE, - "%s:%d, nid=%d, setting default to '%s'\n", - f, l, nid, ret->id); - } - OSSL_TRACE4(ENGINE_TABLE, - "%s:%d, nid=%d, using newly initialised '%s'\n", - f, l, nid, ret->id); - goto end; - } - goto trynext; - end: - /* - * If it failed, it is unlikely to succeed again until some future - * registrations have taken place. In all cases, we cache. - */ - if (fnd) - fnd->uptodate = 1; - if (ret) - OSSL_TRACE4(ENGINE_TABLE, - "%s:%d, nid=%d, caching ENGINE '%s'\n", - f, l, nid, ret->id); - else - OSSL_TRACE3(ENGINE_TABLE, - "%s:%d, nid=%d, caching 'no matching ENGINE'\n", - f, l, nid); - CRYPTO_THREAD_unlock(global_engine_lock); - /* - * Whatever happened, any failed init()s are not failures in this - * context, so clear our error state. - */ - ERR_pop_to_mark(); - return ret; -} - -/* Table enumeration */ - -static void int_dall(const ENGINE_PILE *pile, ENGINE_PILE_DOALL *dall) -{ - dall->cb(pile->nid, pile->sk, pile->funct, dall->arg); -} - -IMPLEMENT_LHASH_DOALL_ARG_CONST(ENGINE_PILE, ENGINE_PILE_DOALL); - -void engine_table_doall(ENGINE_TABLE *table, engine_table_doall_cb *cb, - void *arg) -{ - ENGINE_PILE_DOALL dall; - dall.cb = cb; - dall.arg = arg; - if (table) - lh_ENGINE_PILE_doall_ENGINE_PILE_DOALL(&table->piles, int_dall, &dall); -} diff --git a/crypto/engine/tb_asnmth.c b/crypto/engine/tb_asnmth.c deleted file mode 100644 index e394dbfa85..0000000000 --- a/crypto/engine/tb_asnmth.c +++ /dev/null @@ -1,221 +0,0 @@ -/* - * Copyright 2006-2025 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - -#include "internal/e_os.h" -#include "eng_local.h" -#include -#include "crypto/asn1.h" - -/* - * If this symbol is defined then ENGINE_get_pkey_asn1_meth_engine(), the - * function that is used by EVP to hook in pkey_asn1_meth code and cache - * defaults (etc), will display brief debugging summaries to stderr with the - * 'nid'. - */ -/* #define ENGINE_PKEY_ASN1_METH_DEBUG */ - -static ENGINE_TABLE *pkey_asn1_meth_table = NULL; - -void ENGINE_unregister_pkey_asn1_meths(ENGINE *e) -{ - engine_table_unregister(&pkey_asn1_meth_table, e); -} - -static void engine_unregister_all_pkey_asn1_meths(void) -{ - engine_table_cleanup(&pkey_asn1_meth_table); -} - -int ENGINE_register_pkey_asn1_meths(ENGINE *e) -{ - if (e->pkey_asn1_meths) { - const int *nids; - int num_nids = e->pkey_asn1_meths(e, NULL, &nids, 0); - if (num_nids > 0) - return engine_table_register(&pkey_asn1_meth_table, - engine_unregister_all_pkey_asn1_meths, - e, nids, num_nids, 0); - } - return 1; -} - -void ENGINE_register_all_pkey_asn1_meths(void) -{ - ENGINE *e; - - for (e = ENGINE_get_first(); e; e = ENGINE_get_next(e)) - ENGINE_register_pkey_asn1_meths(e); -} - -int ENGINE_set_default_pkey_asn1_meths(ENGINE *e) -{ - if (e->pkey_asn1_meths) { - const int *nids; - int num_nids = e->pkey_asn1_meths(e, NULL, &nids, 0); - if (num_nids > 0) - return engine_table_register(&pkey_asn1_meth_table, - engine_unregister_all_pkey_asn1_meths, - e, nids, num_nids, 1); - } - return 1; -} - -/* - * Exposed API function to get a functional reference from the implementation - * table (ie. try to get a functional reference from the tabled structural - * references) for a given pkey_asn1_meth 'nid' - */ -ENGINE *ENGINE_get_pkey_asn1_meth_engine(int nid) -{ - return ossl_engine_table_select(&pkey_asn1_meth_table, nid, - OPENSSL_FILE, OPENSSL_LINE); -} - -/* - * Obtains a pkey_asn1_meth implementation from an ENGINE functional - * reference - */ -const EVP_PKEY_ASN1_METHOD *ENGINE_get_pkey_asn1_meth(ENGINE *e, int nid) -{ - EVP_PKEY_ASN1_METHOD *ret; - ENGINE_PKEY_ASN1_METHS_PTR fn = ENGINE_get_pkey_asn1_meths(e); - if (!fn || !fn(e, &ret, NULL, nid)) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_UNIMPLEMENTED_PUBLIC_KEY_METHOD); - return NULL; - } - return ret; -} - -/* Gets the pkey_asn1_meth callback from an ENGINE structure */ -ENGINE_PKEY_ASN1_METHS_PTR ENGINE_get_pkey_asn1_meths(const ENGINE *e) -{ - return e->pkey_asn1_meths; -} - -/* Sets the pkey_asn1_meth callback in an ENGINE structure */ -int ENGINE_set_pkey_asn1_meths(ENGINE *e, ENGINE_PKEY_ASN1_METHS_PTR f) -{ - e->pkey_asn1_meths = f; - return 1; -} - -/* - * Internal function to free up EVP_PKEY_ASN1_METHOD structures before an - * ENGINE is destroyed - */ - -void engine_pkey_asn1_meths_free(ENGINE *e) -{ - int i; - EVP_PKEY_ASN1_METHOD *pkm; - if (e->pkey_asn1_meths) { - const int *pknids; - int npknids; - npknids = e->pkey_asn1_meths(e, NULL, &pknids, 0); - for (i = 0; i < npknids; i++) { - if (e->pkey_asn1_meths(e, &pkm, NULL, pknids[i])) { - EVP_PKEY_asn1_free(pkm); - } - } - } -} - -/* - * Find a method based on a string. This does a linear search through all - * implemented algorithms. This is OK in practice because only a small number - * of algorithms are likely to be implemented in an engine and it is not used - * for speed critical operations. - */ - -const EVP_PKEY_ASN1_METHOD *ENGINE_get_pkey_asn1_meth_str(ENGINE *e, - const char *str, - int len) -{ - int i, nidcount; - const int *nids; - EVP_PKEY_ASN1_METHOD *ameth; - if (!e->pkey_asn1_meths) - return NULL; - if (len == -1) - len = (int)strlen(str); - nidcount = e->pkey_asn1_meths(e, NULL, &nids, 0); - for (i = 0; i < nidcount; i++) { - e->pkey_asn1_meths(e, &ameth, NULL, nids[i]); - if (ameth != NULL - && ((int)strlen(ameth->pem_str) == len) - && OPENSSL_strncasecmp(ameth->pem_str, str, len) == 0) - return ameth; - } - return NULL; -} - -typedef struct { - ENGINE *e; - const EVP_PKEY_ASN1_METHOD *ameth; - const char *str; - int len; -} ENGINE_FIND_STR; - -static void look_str_cb(int nid, STACK_OF(ENGINE) *sk, ENGINE *def, void *arg) -{ - ENGINE_FIND_STR *lk = arg; - int i; - if (lk->ameth) - return; - for (i = 0; i < sk_ENGINE_num(sk); i++) { - ENGINE *e = sk_ENGINE_value(sk, i); - EVP_PKEY_ASN1_METHOD *ameth; - e->pkey_asn1_meths(e, &ameth, NULL, nid); - if (ameth != NULL - && ((int)strlen(ameth->pem_str) == lk->len) - && OPENSSL_strncasecmp(ameth->pem_str, lk->str, lk->len) == 0) { - lk->e = e; - lk->ameth = ameth; - return; - } - } -} - -const EVP_PKEY_ASN1_METHOD *ENGINE_pkey_asn1_find_str(ENGINE **pe, - const char *str, - int len) -{ - ENGINE_FIND_STR fstr; - fstr.e = NULL; - fstr.ameth = NULL; - fstr.str = str; - fstr.len = len; - - if (!RUN_ONCE(&engine_lock_init, do_engine_lock_init)) { - /* Maybe this should be raised in do_engine_lock_init() */ - ERR_raise(ERR_LIB_ENGINE, ERR_R_CRYPTO_LIB); - return NULL; - } - - if (!CRYPTO_THREAD_read_lock(global_engine_lock)) - return NULL; - engine_table_doall(pkey_asn1_meth_table, look_str_cb, &fstr); - /* If found obtain a structural reference to engine */ - if (fstr.e != NULL) { - int ref; - - if (!CRYPTO_UP_REF(&fstr.e->struct_ref, &ref)) { - CRYPTO_THREAD_unlock(global_engine_lock); - ERR_raise(ERR_LIB_ENGINE, ERR_R_CRYPTO_LIB); - return NULL; - } - ENGINE_REF_PRINT(fstr.e, 0, 1); - } - *pe = fstr.e; - CRYPTO_THREAD_unlock(global_engine_lock); - return fstr.ameth; -} diff --git a/crypto/engine/tb_cipher.c b/crypto/engine/tb_cipher.c deleted file mode 100644 index 037f568752..0000000000 --- a/crypto/engine/tb_cipher.c +++ /dev/null @@ -1,95 +0,0 @@ -/* - * Copyright 2001-2021 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - -#include "eng_local.h" - -static ENGINE_TABLE *cipher_table = NULL; - -void ENGINE_unregister_ciphers(ENGINE *e) -{ - engine_table_unregister(&cipher_table, e); -} - -static void engine_unregister_all_ciphers(void) -{ - engine_table_cleanup(&cipher_table); -} - -int ENGINE_register_ciphers(ENGINE *e) -{ - if (e->ciphers) { - const int *nids; - int num_nids = e->ciphers(e, NULL, &nids, 0); - if (num_nids > 0) - return engine_table_register(&cipher_table, - engine_unregister_all_ciphers, e, - nids, num_nids, 0); - } - return 1; -} - -void ENGINE_register_all_ciphers(void) -{ - ENGINE *e; - - for (e = ENGINE_get_first(); e; e = ENGINE_get_next(e)) - ENGINE_register_ciphers(e); -} - -int ENGINE_set_default_ciphers(ENGINE *e) -{ - if (e->ciphers) { - const int *nids; - int num_nids = e->ciphers(e, NULL, &nids, 0); - if (num_nids > 0) - return engine_table_register(&cipher_table, - engine_unregister_all_ciphers, e, - nids, num_nids, 1); - } - return 1; -} - -/* - * Exposed API function to get a functional reference from the implementation - * table (ie. try to get a functional reference from the tabled structural - * references) for a given cipher 'nid' - */ -ENGINE *ENGINE_get_cipher_engine(int nid) -{ - return ossl_engine_table_select(&cipher_table, nid, - OPENSSL_FILE, OPENSSL_LINE); -} - -/* Obtains a cipher implementation from an ENGINE functional reference */ -const EVP_CIPHER *ENGINE_get_cipher(ENGINE *e, int nid) -{ - const EVP_CIPHER *ret; - ENGINE_CIPHERS_PTR fn = ENGINE_get_ciphers(e); - if (!fn || !fn(e, &ret, NULL, nid)) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_UNIMPLEMENTED_CIPHER); - return NULL; - } - return ret; -} - -/* Gets the cipher callback from an ENGINE structure */ -ENGINE_CIPHERS_PTR ENGINE_get_ciphers(const ENGINE *e) -{ - return e->ciphers; -} - -/* Sets the cipher callback in an ENGINE structure */ -int ENGINE_set_ciphers(ENGINE *e, ENGINE_CIPHERS_PTR f) -{ - e->ciphers = f; - return 1; -} diff --git a/crypto/engine/tb_dh.c b/crypto/engine/tb_dh.c deleted file mode 100644 index e1fa45685b..0000000000 --- a/crypto/engine/tb_dh.c +++ /dev/null @@ -1,76 +0,0 @@ -/* - * Copyright 2001-2021 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - -#include "eng_local.h" - -static ENGINE_TABLE *dh_table = NULL; -static const int dummy_nid = 1; - -void ENGINE_unregister_DH(ENGINE *e) -{ - engine_table_unregister(&dh_table, e); -} - -static void engine_unregister_all_DH(void) -{ - engine_table_cleanup(&dh_table); -} - -int ENGINE_register_DH(ENGINE *e) -{ - if (e->dh_meth) - return engine_table_register(&dh_table, - engine_unregister_all_DH, e, &dummy_nid, - 1, 0); - return 1; -} - -void ENGINE_register_all_DH(void) -{ - ENGINE *e; - - for (e = ENGINE_get_first(); e; e = ENGINE_get_next(e)) - ENGINE_register_DH(e); -} - -int ENGINE_set_default_DH(ENGINE *e) -{ - if (e->dh_meth) - return engine_table_register(&dh_table, - engine_unregister_all_DH, e, &dummy_nid, - 1, 1); - return 1; -} - -/* - * Exposed API function to get a functional reference from the implementation - * table (ie. try to get a functional reference from the tabled structural - * references). - */ -ENGINE *ENGINE_get_default_DH(void) -{ - return ossl_engine_table_select(&dh_table, dummy_nid, - OPENSSL_FILE, OPENSSL_LINE); -} - -/* Obtains an DH implementation from an ENGINE functional reference */ -const DH_METHOD *ENGINE_get_DH(const ENGINE *e) -{ - return e->dh_meth; -} - -/* Sets an DH implementation in an ENGINE structure */ -int ENGINE_set_DH(ENGINE *e, const DH_METHOD *dh_meth) -{ - e->dh_meth = dh_meth; - return 1; -} diff --git a/crypto/engine/tb_digest.c b/crypto/engine/tb_digest.c deleted file mode 100644 index dcc70eca45..0000000000 --- a/crypto/engine/tb_digest.c +++ /dev/null @@ -1,95 +0,0 @@ -/* - * Copyright 2001-2021 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - -#include "eng_local.h" - -static ENGINE_TABLE *digest_table = NULL; - -void ENGINE_unregister_digests(ENGINE *e) -{ - engine_table_unregister(&digest_table, e); -} - -static void engine_unregister_all_digests(void) -{ - engine_table_cleanup(&digest_table); -} - -int ENGINE_register_digests(ENGINE *e) -{ - if (e->digests) { - const int *nids; - int num_nids = e->digests(e, NULL, &nids, 0); - if (num_nids > 0) - return engine_table_register(&digest_table, - engine_unregister_all_digests, e, - nids, num_nids, 0); - } - return 1; -} - -void ENGINE_register_all_digests(void) -{ - ENGINE *e; - - for (e = ENGINE_get_first(); e; e = ENGINE_get_next(e)) - ENGINE_register_digests(e); -} - -int ENGINE_set_default_digests(ENGINE *e) -{ - if (e->digests) { - const int *nids; - int num_nids = e->digests(e, NULL, &nids, 0); - if (num_nids > 0) - return engine_table_register(&digest_table, - engine_unregister_all_digests, e, - nids, num_nids, 1); - } - return 1; -} - -/* - * Exposed API function to get a functional reference from the implementation - * table (ie. try to get a functional reference from the tabled structural - * references) for a given digest 'nid' - */ -ENGINE *ENGINE_get_digest_engine(int nid) -{ - return ossl_engine_table_select(&digest_table, nid, - OPENSSL_FILE, OPENSSL_LINE); -} - -/* Obtains a digest implementation from an ENGINE functional reference */ -const EVP_MD *ENGINE_get_digest(ENGINE *e, int nid) -{ - const EVP_MD *ret; - ENGINE_DIGESTS_PTR fn = ENGINE_get_digests(e); - if (!fn || !fn(e, &ret, NULL, nid)) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_UNIMPLEMENTED_DIGEST); - return NULL; - } - return ret; -} - -/* Gets the digest callback from an ENGINE structure */ -ENGINE_DIGESTS_PTR ENGINE_get_digests(const ENGINE *e) -{ - return e->digests; -} - -/* Sets the digest callback in an ENGINE structure */ -int ENGINE_set_digests(ENGINE *e, ENGINE_DIGESTS_PTR f) -{ - e->digests = f; - return 1; -} diff --git a/crypto/engine/tb_dsa.c b/crypto/engine/tb_dsa.c deleted file mode 100644 index 6de314b7fc..0000000000 --- a/crypto/engine/tb_dsa.c +++ /dev/null @@ -1,76 +0,0 @@ -/* - * Copyright 2001-2021 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - -#include "eng_local.h" - -static ENGINE_TABLE *dsa_table = NULL; -static const int dummy_nid = 1; - -void ENGINE_unregister_DSA(ENGINE *e) -{ - engine_table_unregister(&dsa_table, e); -} - -static void engine_unregister_all_DSA(void) -{ - engine_table_cleanup(&dsa_table); -} - -int ENGINE_register_DSA(ENGINE *e) -{ - if (e->dsa_meth) - return engine_table_register(&dsa_table, - engine_unregister_all_DSA, e, &dummy_nid, - 1, 0); - return 1; -} - -void ENGINE_register_all_DSA(void) -{ - ENGINE *e; - - for (e = ENGINE_get_first(); e; e = ENGINE_get_next(e)) - ENGINE_register_DSA(e); -} - -int ENGINE_set_default_DSA(ENGINE *e) -{ - if (e->dsa_meth) - return engine_table_register(&dsa_table, - engine_unregister_all_DSA, e, &dummy_nid, - 1, 1); - return 1; -} - -/* - * Exposed API function to get a functional reference from the implementation - * table (ie. try to get a functional reference from the tabled structural - * references). - */ -ENGINE *ENGINE_get_default_DSA(void) -{ - return ossl_engine_table_select(&dsa_table, dummy_nid, - OPENSSL_FILE, OPENSSL_LINE); -} - -/* Obtains an DSA implementation from an ENGINE functional reference */ -const DSA_METHOD *ENGINE_get_DSA(const ENGINE *e) -{ - return e->dsa_meth; -} - -/* Sets an DSA implementation in an ENGINE structure */ -int ENGINE_set_DSA(ENGINE *e, const DSA_METHOD *dsa_meth) -{ - e->dsa_meth = dsa_meth; - return 1; -} diff --git a/crypto/engine/tb_eckey.c b/crypto/engine/tb_eckey.c deleted file mode 100644 index 0394a5bc22..0000000000 --- a/crypto/engine/tb_eckey.c +++ /dev/null @@ -1,76 +0,0 @@ -/* - * Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - -#include "eng_local.h" - -static ENGINE_TABLE *dh_table = NULL; -static const int dummy_nid = 1; - -void ENGINE_unregister_EC(ENGINE *e) -{ - engine_table_unregister(&dh_table, e); -} - -static void engine_unregister_all_EC(void) -{ - engine_table_cleanup(&dh_table); -} - -int ENGINE_register_EC(ENGINE *e) -{ - if (e->ec_meth != NULL) - return engine_table_register(&dh_table, - engine_unregister_all_EC, e, &dummy_nid, - 1, 0); - return 1; -} - -void ENGINE_register_all_EC(void) -{ - ENGINE *e; - - for (e = ENGINE_get_first(); e; e = ENGINE_get_next(e)) - ENGINE_register_EC(e); -} - -int ENGINE_set_default_EC(ENGINE *e) -{ - if (e->ec_meth != NULL) - return engine_table_register(&dh_table, - engine_unregister_all_EC, e, &dummy_nid, - 1, 1); - return 1; -} - -/* - * Exposed API function to get a functional reference from the implementation - * table (ie. try to get a functional reference from the tabled structural - * references). - */ -ENGINE *ENGINE_get_default_EC(void) -{ - return ossl_engine_table_select(&dh_table, dummy_nid, - OPENSSL_FILE, OPENSSL_LINE); -} - -/* Obtains an EC_KEY implementation from an ENGINE functional reference */ -const EC_KEY_METHOD *ENGINE_get_EC(const ENGINE *e) -{ - return e->ec_meth; -} - -/* Sets an EC_KEY implementation in an ENGINE structure */ -int ENGINE_set_EC(ENGINE *e, const EC_KEY_METHOD *ec_meth) -{ - e->ec_meth = ec_meth; - return 1; -} diff --git a/crypto/engine/tb_pkmeth.c b/crypto/engine/tb_pkmeth.c deleted file mode 100644 index 5c3da1136d..0000000000 --- a/crypto/engine/tb_pkmeth.c +++ /dev/null @@ -1,117 +0,0 @@ -/* - * Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* We need to use some deprecated APIs */ -#include "internal/deprecated.h" - -#include "eng_local.h" -#include - -static ENGINE_TABLE *pkey_meth_table = NULL; - -void ENGINE_unregister_pkey_meths(ENGINE *e) -{ - engine_table_unregister(&pkey_meth_table, e); -} - -static void engine_unregister_all_pkey_meths(void) -{ - engine_table_cleanup(&pkey_meth_table); -} - -int ENGINE_register_pkey_meths(ENGINE *e) -{ - if (e->pkey_meths) { - const int *nids; - int num_nids = e->pkey_meths(e, NULL, &nids, 0); - if (num_nids > 0) - return engine_table_register(&pkey_meth_table, - engine_unregister_all_pkey_meths, e, - nids, num_nids, 0); - } - return 1; -} - -void ENGINE_register_all_pkey_meths(void) -{ - ENGINE *e; - - for (e = ENGINE_get_first(); e; e = ENGINE_get_next(e)) - ENGINE_register_pkey_meths(e); -} - -int ENGINE_set_default_pkey_meths(ENGINE *e) -{ - if (e->pkey_meths) { - const int *nids; - int num_nids = e->pkey_meths(e, NULL, &nids, 0); - if (num_nids > 0) - return engine_table_register(&pkey_meth_table, - engine_unregister_all_pkey_meths, e, - nids, num_nids, 1); - } - return 1; -} - -/* - * Exposed API function to get a functional reference from the implementation - * table (ie. try to get a functional reference from the tabled structural - * references) for a given pkey_meth 'nid' - */ -ENGINE *ENGINE_get_pkey_meth_engine(int nid) -{ - return ossl_engine_table_select(&pkey_meth_table, nid, - OPENSSL_FILE, OPENSSL_LINE); -} - -/* Obtains a pkey_meth implementation from an ENGINE functional reference */ -const EVP_PKEY_METHOD *ENGINE_get_pkey_meth(ENGINE *e, int nid) -{ - EVP_PKEY_METHOD *ret; - ENGINE_PKEY_METHS_PTR fn = ENGINE_get_pkey_meths(e); - if (!fn || !fn(e, &ret, NULL, nid)) { - ERR_raise(ERR_LIB_ENGINE, ENGINE_R_UNIMPLEMENTED_PUBLIC_KEY_METHOD); - return NULL; - } - return ret; -} - -/* Gets the pkey_meth callback from an ENGINE structure */ -ENGINE_PKEY_METHS_PTR ENGINE_get_pkey_meths(const ENGINE *e) -{ - return e->pkey_meths; -} - -/* Sets the pkey_meth callback in an ENGINE structure */ -int ENGINE_set_pkey_meths(ENGINE *e, ENGINE_PKEY_METHS_PTR f) -{ - e->pkey_meths = f; - return 1; -} - -/* - * Internal function to free up EVP_PKEY_METHOD structures before an ENGINE - * is destroyed - */ - -void engine_pkey_meths_free(ENGINE *e) -{ - int i; - EVP_PKEY_METHOD *pkm; - if (e->pkey_meths) { - const int *pknids; - int npknids; - npknids = e->pkey_meths(e, NULL, &pknids, 0); - for (i = 0; i < npknids; i++) { - if (e->pkey_meths(e, &pkm, NULL, pknids[i])) { - EVP_PKEY_meth_free(pkm); - } - } - } -} diff --git a/crypto/engine/tb_rand.c b/crypto/engine/tb_rand.c deleted file mode 100644 index 991a4914ea..0000000000 --- a/crypto/engine/tb_rand.c +++ /dev/null @@ -1,76 +0,0 @@ -/* - * Copyright 2001-2021 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - -#include "eng_local.h" - -static ENGINE_TABLE *rand_table = NULL; -static const int dummy_nid = 1; - -void ENGINE_unregister_RAND(ENGINE *e) -{ - engine_table_unregister(&rand_table, e); -} - -static void engine_unregister_all_RAND(void) -{ - engine_table_cleanup(&rand_table); -} - -int ENGINE_register_RAND(ENGINE *e) -{ - if (e->rand_meth) - return engine_table_register(&rand_table, - engine_unregister_all_RAND, e, - &dummy_nid, 1, 0); - return 1; -} - -void ENGINE_register_all_RAND(void) -{ - ENGINE *e; - - for (e = ENGINE_get_first(); e; e = ENGINE_get_next(e)) - ENGINE_register_RAND(e); -} - -int ENGINE_set_default_RAND(ENGINE *e) -{ - if (e->rand_meth) - return engine_table_register(&rand_table, - engine_unregister_all_RAND, e, - &dummy_nid, 1, 1); - return 1; -} - -/* - * Exposed API function to get a functional reference from the implementation - * table (ie. try to get a functional reference from the tabled structural - * references). - */ -ENGINE *ENGINE_get_default_RAND(void) -{ - return ossl_engine_table_select(&rand_table, dummy_nid, - OPENSSL_FILE, OPENSSL_LINE); -} - -/* Obtains an RAND implementation from an ENGINE functional reference */ -const RAND_METHOD *ENGINE_get_RAND(const ENGINE *e) -{ - return e->rand_meth; -} - -/* Sets an RAND implementation in an ENGINE structure */ -int ENGINE_set_RAND(ENGINE *e, const RAND_METHOD *rand_meth) -{ - e->rand_meth = rand_meth; - return 1; -} diff --git a/crypto/engine/tb_rsa.c b/crypto/engine/tb_rsa.c deleted file mode 100644 index b68b8f0ca7..0000000000 --- a/crypto/engine/tb_rsa.c +++ /dev/null @@ -1,76 +0,0 @@ -/* - * Copyright 2001-2021 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - -#include "eng_local.h" - -static ENGINE_TABLE *rsa_table = NULL; -static const int dummy_nid = 1; - -void ENGINE_unregister_RSA(ENGINE *e) -{ - engine_table_unregister(&rsa_table, e); -} - -static void engine_unregister_all_RSA(void) -{ - engine_table_cleanup(&rsa_table); -} - -int ENGINE_register_RSA(ENGINE *e) -{ - if (e->rsa_meth) - return engine_table_register(&rsa_table, - engine_unregister_all_RSA, e, &dummy_nid, - 1, 0); - return 1; -} - -void ENGINE_register_all_RSA(void) -{ - ENGINE *e; - - for (e = ENGINE_get_first(); e; e = ENGINE_get_next(e)) - ENGINE_register_RSA(e); -} - -int ENGINE_set_default_RSA(ENGINE *e) -{ - if (e->rsa_meth) - return engine_table_register(&rsa_table, - engine_unregister_all_RSA, e, &dummy_nid, - 1, 1); - return 1; -} - -/* - * Exposed API function to get a functional reference from the implementation - * table (ie. try to get a functional reference from the tabled structural - * references). - */ -ENGINE *ENGINE_get_default_RSA(void) -{ - return ossl_engine_table_select(&rsa_table, dummy_nid, - OPENSSL_FILE, OPENSSL_LINE); -} - -/* Obtains an RSA implementation from an ENGINE functional reference */ -const RSA_METHOD *ENGINE_get_RSA(const ENGINE *e) -{ - return e->rsa_meth; -} - -/* Sets an RSA implementation in an ENGINE structure */ -int ENGINE_set_RSA(ENGINE *e, const RSA_METHOD *rsa_meth) -{ - e->rsa_meth = rsa_meth; - return 1; -} diff --git a/crypto/err/err_all.c b/crypto/err/err_all.c index 86b609a555..9463cf62ea 100644 --- a/crypto/err/err_all.c +++ b/crypto/err/err_all.c @@ -30,7 +30,6 @@ #include "crypto/pkcs12err.h" #include "crypto/randerr.h" #include "internal/dsoerr.h" -#include "crypto/engineerr.h" #include "crypto/uierr.h" #include "crypto/httperr.h" #include "crypto/ocsperr.h" @@ -82,9 +81,6 @@ int ossl_err_load_crypto_strings(void) # ifndef OPENSSL_NO_TS || ossl_err_load_TS_strings() == 0 # endif -# ifndef OPENSSL_NO_ENGINE - || ossl_err_load_ENGINE_strings() == 0 -# endif # ifndef OPENSSL_NO_HTTP || ossl_err_load_HTTP_strings() == 0 # endif diff --git a/crypto/err/err_all_legacy.c b/crypto/err/err_all_legacy.c index 64dd61867d..1a1443597f 100644 --- a/crypto/err/err_all_legacy.c +++ b/crypto/err/err_all_legacy.c @@ -27,7 +27,6 @@ # include "crypto/dsaerr.h" # include "internal/dsoerr.h" # include "crypto/ecerr.h" -# include "crypto/engineerr.h" # include "crypto/evperr.h" # include "crypto/httperr.h" # include "crypto/objectserr.h" @@ -82,9 +81,6 @@ IMPLEMENT_LEGACY_ERR_LOAD(DSA) # ifndef OPENSSL_NO_EC IMPLEMENT_LEGACY_ERR_LOAD(EC) # endif -# ifndef OPENSSL_NO_ENGINE -IMPLEMENT_LEGACY_ERR_LOAD(ENGINE) -# endif IMPLEMENT_LEGACY_ERR_LOAD(ERR) IMPLEMENT_LEGACY_ERR_LOAD(EVP) IMPLEMENT_LEGACY_ERR_LOAD(OBJ) diff --git a/crypto/err/openssl.ec b/crypto/err/openssl.ec index 22f87d4c13..a3fce49548 100644 --- a/crypto/err/openssl.ec +++ b/crypto/err/openssl.ec @@ -24,7 +24,6 @@ L X509V3 include/openssl/x509v3err.h crypto/x509/v3err.c L PKCS12 include/openssl/pkcs12err.h crypto/pkcs12/pk12err.c include/crypto/pkcs12err.h L RAND include/openssl/randerr.h crypto/rand/rand_err.c include/crypto/randerr.h L DSO NONE crypto/dso/dso_err.c include/internal/dsoerr.h -L ENGINE include/openssl/engineerr.h crypto/engine/eng_err.c include/crypto/engineerr.h L OCSP include/openssl/ocsperr.h crypto/ocsp/ocsp_err.c include/crypto/ocsperr.h L UI include/openssl/uierr.h crypto/ui/ui_err.c include/crypto/uierr.h L COMP include/openssl/comperr.h crypto/comp/comp_err.c include/crypto/comperr.h diff --git a/crypto/err/openssl.txt b/crypto/err/openssl.txt index 6c7d4f40fa..568b6bd5aa 100644 --- a/crypto/err/openssl.txt +++ b/crypto/err/openssl.txt @@ -676,41 +676,6 @@ EC_R_UNKNOWN_ORDER:114:unknown order EC_R_UNSUPPORTED_FIELD:131:unsupported field EC_R_WRONG_CURVE_PARAMETERS:145:wrong curve parameters EC_R_WRONG_ORDER:130:wrong order -ENGINE_R_ALREADY_LOADED:100:already loaded -ENGINE_R_ARGUMENT_IS_NOT_A_NUMBER:133:argument is not a number -ENGINE_R_CMD_NOT_EXECUTABLE:134:cmd not executable -ENGINE_R_COMMAND_TAKES_INPUT:135:command takes input -ENGINE_R_COMMAND_TAKES_NO_INPUT:136:command takes no input -ENGINE_R_CONFLICTING_ENGINE_ID:103:conflicting engine id -ENGINE_R_CTRL_COMMAND_NOT_IMPLEMENTED:119:ctrl command not implemented -ENGINE_R_DSO_FAILURE:104:DSO failure -ENGINE_R_DSO_NOT_FOUND:132:dso not found -ENGINE_R_ENGINES_SECTION_ERROR:148:engines section error -ENGINE_R_ENGINE_CONFIGURATION_ERROR:102:engine configuration error -ENGINE_R_ENGINE_IS_NOT_IN_LIST:105:engine is not in the list -ENGINE_R_ENGINE_SECTION_ERROR:149:engine section error -ENGINE_R_FAILED_LOADING_PRIVATE_KEY:128:failed loading private key -ENGINE_R_FAILED_LOADING_PUBLIC_KEY:129:failed loading public key -ENGINE_R_FINISH_FAILED:106:finish failed -ENGINE_R_ID_OR_NAME_MISSING:108:'id' or 'name' missing -ENGINE_R_INIT_FAILED:109:init failed -ENGINE_R_INTERNAL_LIST_ERROR:110:internal list error -ENGINE_R_INVALID_ARGUMENT:143:invalid argument -ENGINE_R_INVALID_CMD_NAME:137:invalid cmd name -ENGINE_R_INVALID_CMD_NUMBER:138:invalid cmd number -ENGINE_R_INVALID_INIT_VALUE:151:invalid init value -ENGINE_R_INVALID_STRING:150:invalid string -ENGINE_R_NOT_INITIALISED:117:not initialised -ENGINE_R_NOT_LOADED:112:not loaded -ENGINE_R_NO_CONTROL_FUNCTION:120:no control function -ENGINE_R_NO_INDEX:144:no index -ENGINE_R_NO_LOAD_FUNCTION:125:no load function -ENGINE_R_NO_REFERENCE:130:no reference -ENGINE_R_NO_SUCH_ENGINE:116:no such engine -ENGINE_R_UNIMPLEMENTED_CIPHER:146:unimplemented cipher -ENGINE_R_UNIMPLEMENTED_DIGEST:147:unimplemented digest -ENGINE_R_UNIMPLEMENTED_PUBLIC_KEY_METHOD:101:unimplemented public key method -ENGINE_R_VERSION_INCOMPATIBILITY:145:version incompatibility ESS_R_EMPTY_ESS_CERT_ID_LIST:107:empty ess cert id list ESS_R_ESS_CERT_DIGEST_ERROR:103:ess cert digest error ESS_R_ESS_CERT_ID_NOT_FOUND:104:ess cert id not found diff --git a/crypto/evp/digest.c b/crypto/evp/digest.c index 680917da57..99623acc1f 100644 --- a/crypto/evp/digest.c +++ b/crypto/evp/digest.c @@ -7,22 +7,17 @@ * https://www.openssl.org/source/license.html */ -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - #include #include #include #include -#ifndef FIPS_MODULE -# include -#endif #include #include #include "internal/cryptlib.h" #include "internal/nelem.h" #include "internal/provider.h" #include "internal/core.h" +#include "internal/common.h" #include "crypto/evp.h" #include "evp_local.h" @@ -60,11 +55,6 @@ void evp_md_ctx_clear_digest(EVP_MD_CTX *ctx, int force, int keep_fetched) if (force) ctx->digest = NULL; -#if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_ENGINE) - ENGINE_finish(ctx->engine); - ctx->engine = NULL; -#endif - /* Non legacy code, this has to be later than the ctx->digest cleaning */ if (!keep_fetched) { EVP_MD_free(ctx->fetched_digest); @@ -155,12 +145,8 @@ int evp_md_ctx_free_algctx(EVP_MD_CTX *ctx) } static int evp_md_init_internal(EVP_MD_CTX *ctx, const EVP_MD *type, - const OSSL_PARAM params[], ENGINE *impl) + const OSSL_PARAM params[]) { -#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) - ENGINE *tmpimpl = NULL; -#endif - #if !defined(FIPS_MODULE) if (ctx->pctx != NULL && EVP_PKEY_CTX_IS_SIGNATURE_OP(ctx->pctx) @@ -172,9 +158,9 @@ static int evp_md_init_internal(EVP_MD_CTX *ctx, const EVP_MD *type, * operation. So in that case we redirect to EVP_DigestSignInit() */ if (ctx->pctx->operation == EVP_PKEY_OP_SIGNCTX) - return EVP_DigestSignInit(ctx, NULL, type, impl, NULL); + return EVP_DigestSignInit(ctx, NULL, type, NULL, NULL); if (ctx->pctx->operation == EVP_PKEY_OP_VERIFYCTX) - return EVP_DigestVerifyInit(ctx, NULL, type, impl, NULL); + return EVP_DigestVerifyInit(ctx, NULL, type, NULL, NULL); ERR_raise(ERR_LIB_EVP, EVP_R_UPDATE_ERROR); return 0; } @@ -193,43 +179,11 @@ static int evp_md_init_internal(EVP_MD_CTX *ctx, const EVP_MD *type, type = ctx->digest; } - /* Code below to be removed when legacy support is dropped. */ -#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) /* - * Whether it's nice or not, "Inits" can be used on "Final"'d contexts so - * this context may already have an ENGINE! Try to avoid releasing the - * previous handle, re-querying for an ENGINE, and having a - * reinitialisation, when it may all be unnecessary. - */ - if (ossl_unlikely(ctx->engine != NULL) - && ctx->digest != NULL - && type->type == ctx->digest->type) - goto skip_to_init; - - /* - * Ensure an ENGINE left lying around from last time is cleared (the - * previous check attempted to avoid this if the same ENGINE and - * EVP_MD could be used). - */ - ENGINE_finish(ctx->engine); - ctx->engine = NULL; - - if (impl == NULL) - tmpimpl = ENGINE_get_digest_engine(type->type); -#endif - - /* - * If there are engines involved or EVP_MD_CTX_FLAG_NO_INIT is set then we + * If there is EVP_MD_CTX_FLAG_NO_INIT set then we * should use legacy handling for now. */ - if (impl != NULL -#if !defined(OPENSSL_NO_ENGINE) - || ctx->engine != NULL -# if !defined(FIPS_MODULE) - || tmpimpl != NULL -# endif -#endif - || (ctx->flags & EVP_MD_CTX_FLAG_NO_INIT) != 0 + if ((ctx->flags & EVP_MD_CTX_FLAG_NO_INIT) != 0 || (type != NULL && type->origin == EVP_ORIG_METH) || (type == NULL && ctx->digest != NULL && ctx->digest->origin == EVP_ORIG_METH)) { @@ -304,37 +258,6 @@ static int evp_md_init_internal(EVP_MD_CTX *ctx, const EVP_MD *type, /* Code below to be removed when legacy support is dropped. */ legacy: -#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) - if (type) { - if (impl != NULL) { - if (!ENGINE_init(impl)) { - ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR); - return 0; - } - } else { - /* Ask if an ENGINE is reserved for this job */ - impl = tmpimpl; - } - if (impl != NULL) { - /* There's an ENGINE for this job ... (apparently) */ - const EVP_MD *d = ENGINE_get_digest(impl, type->type); - - if (d == NULL) { - ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR); - ENGINE_finish(impl); - return 0; - } - /* We'll use the ENGINE's private digest definition */ - type = d; - /* - * Store the ENGINE functional reference so we know 'type' came - * from an ENGINE and we need to release it when done. - */ - ctx->engine = impl; - } else - ctx->engine = NULL; - } -#endif if (ctx->digest != type) { cleanup_old_md_data(ctx, 1); @@ -346,9 +269,6 @@ static int evp_md_init_internal(EVP_MD_CTX *ctx, const EVP_MD *type, return 0; } } -#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) - skip_to_init: -#endif #ifndef FIPS_MODULE if (ctx->pctx != NULL && (!EVP_PKEY_CTX_IS_SIGNATURE_OP(ctx->pctx) @@ -368,18 +288,20 @@ static int evp_md_init_internal(EVP_MD_CTX *ctx, const EVP_MD *type, int EVP_DigestInit_ex2(EVP_MD_CTX *ctx, const EVP_MD *type, const OSSL_PARAM params[]) { - return evp_md_init_internal(ctx, type, params, NULL); + return evp_md_init_internal(ctx, type, params); } int EVP_DigestInit(EVP_MD_CTX *ctx, const EVP_MD *type) { EVP_MD_CTX_reset(ctx); - return evp_md_init_internal(ctx, type, NULL, NULL); + return evp_md_init_internal(ctx, type, NULL); } int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl) { - return evp_md_init_internal(ctx, type, NULL, impl); + if (!ossl_assert(impl == NULL)) + return 0; + return evp_md_init_internal(ctx, type, NULL); } int EVP_DigestUpdate(EVP_MD_CTX *ctx, const void *data, size_t count) @@ -668,13 +590,6 @@ int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in) /* Code below to be removed when legacy support is dropped. */ legacy: -#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) - /* Make sure it's safe to copy a digest context using an ENGINE */ - if (in->engine && !ENGINE_init(in->engine)) { - ERR_raise(ERR_LIB_EVP, ERR_R_ENGINE_LIB); - return 0; - } -#endif if (out->digest == in->digest) { tmp_buf = out->md_data; @@ -727,13 +642,17 @@ int EVP_Digest(const void *data, size_t count, unsigned char *md, unsigned int *size, const EVP_MD *type, ENGINE *impl) { - EVP_MD_CTX *ctx = EVP_MD_CTX_new(); + EVP_MD_CTX *ctx; int ret; + if (!ossl_assert(impl == NULL)) + return 0; + + ctx = EVP_MD_CTX_new(); if (ctx == NULL) return 0; EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_ONESHOT); - ret = EVP_DigestInit_ex(ctx, type, impl) + ret = EVP_DigestInit_ex(ctx, type, NULL) && EVP_DigestUpdate(ctx, data, count) && EVP_DigestFinal_ex(ctx, md, size); EVP_MD_CTX_free(ctx); diff --git a/crypto/evp/evp_enc.c b/crypto/evp/evp_enc.c index bcc507edfd..92bf546327 100644 --- a/crypto/evp/evp_enc.c +++ b/crypto/evp/evp_enc.c @@ -7,23 +7,18 @@ * https://www.openssl.org/source/license.html */ -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - #include #include #include #include #include #include -#ifndef FIPS_MODULE -# include -#endif #include #include #include "internal/cryptlib.h" #include "internal/provider.h" #include "internal/core.h" +#include "internal/common.h" #include "internal/safe_math.h" #include "crypto/evp.h" #include "evp_local.h" @@ -61,9 +56,6 @@ int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *ctx) OPENSSL_cleanse(ctx->cipher_data, ctx->cipher->ctx_size); } OPENSSL_free(ctx->cipher_data); -#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) - ENGINE_finish(ctx->engine); -#endif memset(ctx, 0, sizeof(*ctx)); ctx->iv_len = -1; return 1; @@ -91,15 +83,12 @@ void EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *ctx) static int evp_cipher_init_internal(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, - ENGINE *impl, const unsigned char *key, + const unsigned char *key, const unsigned char *iv, int enc, uint8_t is_pipeline, const OSSL_PARAM params[]) { int n; -#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) - ENGINE *tmpimpl = NULL; -#endif /* * enc == 1 means we are encrypting. @@ -123,32 +112,10 @@ static int evp_cipher_init_internal(EVP_CIPHER_CTX *ctx, if (is_pipeline) goto nonlegacy; -#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) - /* - * Whether it's nice or not, "Inits" can be used on "Final"'d contexts so - * this context may already have an ENGINE! Try to avoid releasing the - * previous handle, re-querying for an ENGINE, and having a - * reinitialisation, when it may all be unnecessary. - */ - if (ctx->engine && ctx->cipher - && (cipher == NULL || cipher->nid == ctx->cipher->nid)) - goto skip_to_init; - - if (cipher != NULL && impl == NULL) { - /* Ask if an ENGINE is reserved for this job */ - tmpimpl = ENGINE_get_cipher_engine(cipher->nid); - } -#endif - /* * If there are engines involved then we should use legacy handling for now. */ - if (ctx->engine != NULL -#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) - || tmpimpl != NULL -#endif - || impl != NULL - || (cipher != NULL && cipher->origin == EVP_ORIG_METH) + if ((cipher != NULL && cipher->origin == EVP_ORIG_METH) || (cipher == NULL && ctx->cipher != NULL && ctx->cipher->origin == EVP_ORIG_METH)) { if (ctx->cipher == ctx->fetched_cipher) @@ -349,39 +316,6 @@ nonlegacy: ctx->encrypt = enc; ctx->flags = flags; } -#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) - if (impl != NULL) { - if (!ENGINE_init(impl)) { - ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR); - return 0; - } - } else { - impl = tmpimpl; - } - if (impl != NULL) { - /* There's an ENGINE for this job ... (apparently) */ - const EVP_CIPHER *c = ENGINE_get_cipher(impl, cipher->nid); - - if (c == NULL) { - /* - * One positive side-effect of US's export control history, - * is that we should at least be able to avoid using US - * misspellings of "initialisation"? - */ - ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR); - return 0; - } - /* We'll use the ENGINE's private cipher definition */ - cipher = c; - /* - * Store the ENGINE functional reference so we know 'cipher' came - * from an ENGINE and we need to release it when done. - */ - ctx->engine = impl; - } else { - ctx->engine = NULL; - } -#endif ctx->cipher = cipher; if (ctx->cipher->ctx_size) { @@ -404,9 +338,6 @@ nonlegacy: } } } -#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) - skip_to_init: -#endif if (ctx->cipher == NULL) return 0; @@ -504,8 +435,7 @@ static int evp_cipher_init_skey_internal(EVP_CIPHER_CTX *ctx, /* * If there are engines involved then we throw an error */ - if (ctx->engine != NULL - || (cipher != NULL && cipher->origin == EVP_ORIG_METH) + if ((cipher != NULL && cipher->origin == EVP_ORIG_METH) || (cipher == NULL && ctx->cipher != NULL && ctx->cipher->origin == EVP_ORIG_METH)) { ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR); @@ -635,7 +565,7 @@ int EVP_CipherInit_ex2(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, const unsigned char *key, const unsigned char *iv, int enc, const OSSL_PARAM params[]) { - return evp_cipher_init_internal(ctx, cipher, NULL, key, iv, enc, 0, params); + return evp_cipher_init_internal(ctx, cipher, key, iv, enc, 0, params); } int EVP_CipherInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, @@ -643,14 +573,16 @@ int EVP_CipherInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, { if (cipher != NULL) EVP_CIPHER_CTX_reset(ctx); - return evp_cipher_init_internal(ctx, cipher, NULL, key, iv, enc, 0, NULL); + return evp_cipher_init_internal(ctx, cipher, key, iv, enc, 0, NULL); } int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, ENGINE *impl, const unsigned char *key, const unsigned char *iv, int enc) { - return evp_cipher_init_internal(ctx, cipher, impl, key, iv, enc, 0, NULL); + if (!ossl_assert(impl == NULL)) + return 0; + return evp_cipher_init_internal(ctx, cipher, key, iv, enc, 0, NULL); } int EVP_CipherPipelineEncryptInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, @@ -665,7 +597,7 @@ int EVP_CipherPipelineEncryptInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, ctx->numpipes = numpipes; - if (!evp_cipher_init_internal(ctx, cipher, NULL, NULL, NULL, 1, 1, + if (!evp_cipher_init_internal(ctx, cipher, NULL, NULL, 1, 1, NULL)) return 0; @@ -695,7 +627,7 @@ int EVP_CipherPipelineDecryptInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, ctx->numpipes = numpipes; - if (!evp_cipher_init_internal(ctx, cipher, NULL, NULL, NULL, 0, 1, + if (!evp_cipher_init_internal(ctx, cipher, NULL, NULL, 0, 1, NULL)) return 0; @@ -816,7 +748,9 @@ int EVP_EncryptInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, ENGINE *impl, const unsigned char *key, const unsigned char *iv) { - return EVP_CipherInit_ex(ctx, cipher, impl, key, iv, 1); + if (!ossl_assert(impl == NULL)) + return 0; + return EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, 1); } int EVP_EncryptInit_ex2(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, @@ -836,7 +770,9 @@ int EVP_DecryptInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, ENGINE *impl, const unsigned char *key, const unsigned char *iv) { - return EVP_CipherInit_ex(ctx, cipher, impl, key, iv, 0); + if (!ossl_assert(impl == NULL)) + return 0; + return EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, 0); } int EVP_DecryptInit_ex2(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, @@ -1811,14 +1747,6 @@ int EVP_CIPHER_CTX_copy(EVP_CIPHER_CTX *out, const EVP_CIPHER_CTX *in) /* Code below to be removed when legacy support is dropped. */ legacy: -#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) - /* Make sure it's safe to copy a cipher context using an ENGINE */ - if (in->engine && !ENGINE_init(in->engine)) { - ERR_raise(ERR_LIB_EVP, ERR_R_ENGINE_LIB); - return 0; - } -#endif - EVP_CIPHER_CTX_reset(out); memcpy(out, in, sizeof(*out)); diff --git a/crypto/evp/evp_local.h b/crypto/evp/evp_local.h index 677711ebea..9da138ede9 100644 --- a/crypto/evp/evp_local.h +++ b/crypto/evp/evp_local.h @@ -16,8 +16,6 @@ struct evp_md_ctx_st { const EVP_MD *reqdigest; /* The original requested digest */ const EVP_MD *digest; - ENGINE *engine; /* functional reference if 'digest' is - * ENGINE-provided */ unsigned long flags; void *md_data; /* Public key context for sign/verify */ @@ -35,8 +33,6 @@ struct evp_md_ctx_st { struct evp_cipher_ctx_st { const EVP_CIPHER *cipher; - ENGINE *engine; /* functional reference if 'cipher' is - * ENGINE-provided */ int encrypt; /* encrypt or decrypt */ int buf_len; /* number we have left */ unsigned char oiv[EVP_MAX_IV_LENGTH]; /* original iv */ diff --git a/crypto/evp/evp_pkey_type.c b/crypto/evp/evp_pkey_type.c index 15f1863a05..70ca5aee77 100644 --- a/crypto/evp/evp_pkey_type.c +++ b/crypto/evp/evp_pkey_type.c @@ -13,7 +13,6 @@ #include #include #ifndef OPENSSL_NO_DEPRECATED_3_6 -# include # include "crypto/asn1.h" #include #else @@ -65,16 +64,12 @@ int EVP_PKEY_type(int type) #ifndef OPENSSL_NO_DEPRECATED_3_6 int ret; const EVP_PKEY_ASN1_METHOD *ameth; - ENGINE *e; - ameth = EVP_PKEY_asn1_find(&e, type); + ameth = EVP_PKEY_asn1_find(NULL, type); if (ameth) ret = ameth->pkey_id; else ret = NID_undef; -# ifndef OPENSSL_NO_ENGINE - ENGINE_finish(e); -# endif return ret; #else size_t i; diff --git a/crypto/evp/m_sigver.c b/crypto/evp/m_sigver.c index 740b9d7387..d15bece28b 100644 --- a/crypto/evp/m_sigver.c +++ b/crypto/evp/m_sigver.c @@ -14,6 +14,7 @@ #include "crypto/evp.h" #include "internal/provider.h" #include "internal/numbers.h" /* includes SIZE_MAX */ +#include "internal/common.h" #include "evp_local.h" static int update(EVP_MD_CTX *ctx, const void *data, size_t datalen) @@ -37,7 +38,7 @@ static const char *canon_mdname(const char *mdname) static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, const EVP_MD *type, const char *mdname, OSSL_LIB_CTX *libctx, const char *props, - ENGINE *e, EVP_PKEY *pkey, int ver, + EVP_PKEY *pkey, int ver, const OSSL_PARAM params[]) { EVP_PKEY_CTX *locpctx = NULL; @@ -55,10 +56,7 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, if (ctx->pctx == NULL) { reinit = 0; - if (e == NULL) - ctx->pctx = EVP_PKEY_CTX_new_from_pkey(libctx, pkey, props); - else - ctx->pctx = EVP_PKEY_CTX_new(pkey, e); + ctx->pctx = EVP_PKEY_CTX_new_from_pkey(libctx, pkey, props); } if (ctx->pctx == NULL) return 0; @@ -351,7 +349,7 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, *pctx = ctx->pctx; if (ctx->pctx->pmeth->flags & EVP_PKEY_FLAG_SIGCTX_CUSTOM) return 1; - if (!EVP_DigestInit_ex(ctx, type, e)) + if (!EVP_DigestInit_ex(ctx, type, NULL)) return 0; /* * This indicates the current algorithm requires @@ -375,14 +373,16 @@ int EVP_DigestSignInit_ex(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, const char *props, EVP_PKEY *pkey, const OSSL_PARAM params[]) { - return do_sigver_init(ctx, pctx, NULL, mdname, libctx, props, NULL, pkey, 0, + return do_sigver_init(ctx, pctx, NULL, mdname, libctx, props, pkey, 0, params); } int EVP_DigestSignInit(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey) { - return do_sigver_init(ctx, pctx, type, NULL, NULL, NULL, e, pkey, 0, + if (!ossl_assert(e == NULL)) + return 0; + return do_sigver_init(ctx, pctx, type, NULL, NULL, NULL, pkey, 0, NULL); } @@ -391,14 +391,16 @@ int EVP_DigestVerifyInit_ex(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, const char *props, EVP_PKEY *pkey, const OSSL_PARAM params[]) { - return do_sigver_init(ctx, pctx, NULL, mdname, libctx, props, NULL, pkey, 1, + return do_sigver_init(ctx, pctx, NULL, mdname, libctx, props, pkey, 1, params); } int EVP_DigestVerifyInit(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey) { - return do_sigver_init(ctx, pctx, type, NULL, NULL, NULL, e, pkey, 1, + if (!ossl_assert(e == NULL)) + return 0; + return do_sigver_init(ctx, pctx, type, NULL, NULL, NULL, pkey, 1, NULL); } diff --git a/crypto/evp/p_lib.c b/crypto/evp/p_lib.c index f292dcadd9..c76e6c5ac3 100644 --- a/crypto/evp/p_lib.c +++ b/crypto/evp/p_lib.c @@ -27,9 +27,6 @@ #include #include #include -#ifndef FIPS_MODULE -# include -#endif #include #include #include @@ -48,9 +45,10 @@ # include "crypto/x509.h" #endif #include "internal/provider.h" +#include "internal/common.h" #include "evp_local.h" -static int pkey_set_type(EVP_PKEY *pkey, ENGINE *e, int type, const char *str, +static int pkey_set_type(EVP_PKEY *pkey, int type, const char *str, int len, EVP_KEYMGMT *keymgmt); static void evp_pkey_free_it(EVP_PKEY *key); @@ -419,68 +417,42 @@ static EVP_PKEY *new_raw_key_int(OSSL_LIB_CTX *libctx, const char *strtype, const char *propq, int nidtype, - ENGINE *e, const unsigned char *key, size_t len, int key_is_priv) { EVP_PKEY *pkey = NULL; EVP_PKEY_CTX *ctx = NULL; - const EVP_PKEY_ASN1_METHOD *ameth = NULL; int result = 0; -# ifndef OPENSSL_NO_ENGINE - /* Check if there is an Engine for this type */ - if (e == NULL) { - ENGINE *tmpe = NULL; + ctx = EVP_PKEY_CTX_new_from_name(libctx, + strtype != NULL ? strtype + : OBJ_nid2sn(nidtype), + propq); + if (ctx == NULL) + goto err; + /* May fail if no provider available */ + ERR_set_mark(); + if (EVP_PKEY_fromdata_init(ctx) == 1) { + OSSL_PARAM params[] = { OSSL_PARAM_END, OSSL_PARAM_END }; - if (strtype != NULL) - ameth = EVP_PKEY_asn1_find_str(&tmpe, strtype, -1); - else if (nidtype != EVP_PKEY_NONE) - ameth = EVP_PKEY_asn1_find(&tmpe, nidtype); + ERR_clear_last_mark(); + params[0] = OSSL_PARAM_construct_octet_string( + key_is_priv ? OSSL_PKEY_PARAM_PRIV_KEY + : OSSL_PKEY_PARAM_PUB_KEY, + (void *)key, len); - /* If tmpe is NULL then no engine is claiming to support this type */ - if (tmpe == NULL) - ameth = NULL; - - ENGINE_finish(tmpe); - } -# endif - - if (e == NULL && ameth == NULL) { - /* - * No engine is claiming to support this type, so lets see if we have - * a provider. - */ - ctx = EVP_PKEY_CTX_new_from_name(libctx, - strtype != NULL ? strtype - : OBJ_nid2sn(nidtype), - propq); - if (ctx == NULL) + if (EVP_PKEY_fromdata(ctx, &pkey, EVP_PKEY_KEYPAIR, params) != 1) { + ERR_raise(ERR_LIB_EVP, EVP_R_KEY_SETUP_FAILED); goto err; - /* May fail if no provider available */ - ERR_set_mark(); - if (EVP_PKEY_fromdata_init(ctx) == 1) { - OSSL_PARAM params[] = { OSSL_PARAM_END, OSSL_PARAM_END }; - - ERR_clear_last_mark(); - params[0] = OSSL_PARAM_construct_octet_string( - key_is_priv ? OSSL_PKEY_PARAM_PRIV_KEY - : OSSL_PKEY_PARAM_PUB_KEY, - (void *)key, len); - - if (EVP_PKEY_fromdata(ctx, &pkey, EVP_PKEY_KEYPAIR, params) != 1) { - ERR_raise(ERR_LIB_EVP, EVP_R_KEY_SETUP_FAILED); - goto err; - } - - EVP_PKEY_CTX_free(ctx); - - return pkey; } - ERR_pop_to_mark(); - /* else not supported so fallback to legacy */ + + EVP_PKEY_CTX_free(ctx); + + return pkey; } + ERR_pop_to_mark(); + /* else not supported so fallback to legacy */ /* Legacy code path */ @@ -490,7 +462,7 @@ static EVP_PKEY *new_raw_key_int(OSSL_LIB_CTX *libctx, goto err; } - if (!pkey_set_type(pkey, e, nidtype, strtype, -1, NULL)) { + if (!pkey_set_type(pkey, nidtype, strtype, -1, NULL)) { /* ERR_raise(ERR_LIB_EVP, ...) already called */ goto err; } @@ -535,7 +507,7 @@ EVP_PKEY *EVP_PKEY_new_raw_private_key_ex(OSSL_LIB_CTX *libctx, const char *propq, const unsigned char *priv, size_t len) { - return new_raw_key_int(libctx, keytype, propq, EVP_PKEY_NONE, NULL, priv, + return new_raw_key_int(libctx, keytype, propq, EVP_PKEY_NONE, priv, len, 1); } @@ -543,14 +515,16 @@ EVP_PKEY *EVP_PKEY_new_raw_private_key(int type, ENGINE *e, const unsigned char *priv, size_t len) { - return new_raw_key_int(NULL, NULL, NULL, type, e, priv, len, 1); + if (!ossl_assert(e == NULL)) + return NULL; + return new_raw_key_int(NULL, NULL, NULL, type, priv, len, 1); } EVP_PKEY *EVP_PKEY_new_raw_public_key_ex(OSSL_LIB_CTX *libctx, const char *keytype, const char *propq, const unsigned char *pub, size_t len) { - return new_raw_key_int(libctx, keytype, propq, EVP_PKEY_NONE, NULL, pub, + return new_raw_key_int(libctx, keytype, propq, EVP_PKEY_NONE, pub, len, 0); } @@ -558,7 +532,9 @@ EVP_PKEY *EVP_PKEY_new_raw_public_key(int type, ENGINE *e, const unsigned char *pub, size_t len) { - return new_raw_key_int(NULL, NULL, NULL, type, e, pub, len, 0); + if (!ossl_assert(e == NULL)) + return NULL; + return new_raw_key_int(NULL, NULL, NULL, type, pub, len, 0); } struct raw_key_details_st { @@ -658,12 +634,9 @@ static EVP_PKEY *new_cmac_key_int(const unsigned char *priv, size_t len, const char *cipher_name, const EVP_CIPHER *cipher, OSSL_LIB_CTX *libctx, - const char *propq, ENGINE *e) + const char *propq) { # ifndef OPENSSL_NO_CMAC -# ifndef OPENSSL_NO_ENGINE - const char *engine_id = e != NULL ? ENGINE_get_id(e) : NULL; -# endif OSSL_PARAM params[5], *p = params; EVP_PKEY *pkey = NULL; EVP_PKEY_CTX *ctx; @@ -692,11 +665,6 @@ static EVP_PKEY *new_cmac_key_int(const unsigned char *priv, size_t len, if (propq != NULL) *p++ = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_PROPERTIES, (char *)propq, 0); -# ifndef OPENSSL_NO_ENGINE - if (engine_id != NULL) - *p++ = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_ENGINE, - (char *)engine_id, 0); -# endif *p = OSSL_PARAM_construct_end(); if (EVP_PKEY_fromdata(ctx, &pkey, EVP_PKEY_KEYPAIR, params) <= 0) { @@ -717,44 +685,21 @@ static EVP_PKEY *new_cmac_key_int(const unsigned char *priv, size_t len, EVP_PKEY *EVP_PKEY_new_CMAC_key(ENGINE *e, const unsigned char *priv, size_t len, const EVP_CIPHER *cipher) { - return new_cmac_key_int(priv, len, NULL, cipher, NULL, NULL, e); + if (!ossl_assert(e == NULL)) + return NULL; + return new_cmac_key_int(priv, len, NULL, cipher, NULL, NULL); } int EVP_PKEY_set_type(EVP_PKEY *pkey, int type) { - return pkey_set_type(pkey, NULL, type, NULL, -1, NULL); + return pkey_set_type(pkey, type, NULL, -1, NULL); } int EVP_PKEY_set_type_str(EVP_PKEY *pkey, const char *str, int len) { - return pkey_set_type(pkey, NULL, EVP_PKEY_NONE, str, len, NULL); + return pkey_set_type(pkey, EVP_PKEY_NONE, str, len, NULL); } -# ifndef OPENSSL_NO_ENGINE -int EVP_PKEY_set1_engine(EVP_PKEY *pkey, ENGINE *e) -{ - if (e != NULL) { - if (!ENGINE_init(e)) { - ERR_raise(ERR_LIB_EVP, ERR_R_ENGINE_LIB); - return 0; - } - if (ENGINE_get_pkey_meth(e, pkey->type) == NULL) { - ENGINE_finish(e); - ERR_raise(ERR_LIB_EVP, EVP_R_UNSUPPORTED_ALGORITHM); - return 0; - } - } - ENGINE_finish(pkey->pmeth_engine); - pkey->pmeth_engine = e; - return 1; -} - -ENGINE *EVP_PKEY_get0_engine(const EVP_PKEY *pkey) -{ - return pkey->engine; -} -# endif - # ifndef OPENSSL_NO_DEPRECATED_3_0 static void detect_foreign_key(EVP_PKEY *pkey) { @@ -1527,8 +1472,8 @@ EVP_PKEY *EVP_PKEY_new(void) * Setup a public key management method. * * For legacy keys, either |type| or |str| is expected to have the type - * information. In this case, the setup consists of finding an ASN1 method - * and potentially an ENGINE, and setting those fields in |pkey|. + * information. In this case, the setup consists of finding an ASN1 method + * and setting those fields in |pkey|. * * For provider side keys, |keymgmt| is expected to be non-NULL. In this * case, the setup consists of setting the |keymgmt| field in |pkey|. @@ -1536,20 +1481,18 @@ EVP_PKEY *EVP_PKEY_new(void) * If pkey is NULL just return 1 or 0 if the key management method exists. */ -static int pkey_set_type(EVP_PKEY *pkey, ENGINE *e, int type, const char *str, +static int pkey_set_type(EVP_PKEY *pkey, int type, const char *str, int len, EVP_KEYMGMT *keymgmt) { #ifndef FIPS_MODULE const EVP_PKEY_ASN1_METHOD *ameth = NULL; - ENGINE **eptr = (e == NULL) ? &e : NULL; #endif /* * The setups can't set both legacy and provider side methods. * It is forbidden */ - if (!ossl_assert(type == EVP_PKEY_NONE || keymgmt == NULL) - || !ossl_assert(e == NULL || keymgmt == NULL)) { + if (!ossl_assert(type == EVP_PKEY_NONE || keymgmt == NULL)) { ERR_raise(ERR_LIB_EVP, ERR_R_INTERNAL_ERROR); return 0; } @@ -1572,24 +1515,13 @@ static int pkey_set_type(EVP_PKEY *pkey, ENGINE *e, int type, const char *str, && type == pkey->save_type && pkey->ameth != NULL) return 1; -# ifndef OPENSSL_NO_ENGINE - /* If we have ENGINEs release them */ - ENGINE_finish(pkey->engine); - pkey->engine = NULL; - ENGINE_finish(pkey->pmeth_engine); - pkey->pmeth_engine = NULL; -# endif #endif } #ifndef FIPS_MODULE if (str != NULL) - ameth = EVP_PKEY_asn1_find_str(eptr, str, len); + ameth = EVP_PKEY_asn1_find_str(NULL, str, len); else if (type != EVP_PKEY_NONE) - ameth = EVP_PKEY_asn1_find(eptr, type); -# ifndef OPENSSL_NO_ENGINE - if (pkey == NULL && eptr != NULL) - ENGINE_finish(e); -# endif + ameth = EVP_PKEY_asn1_find(NULL, type); #endif @@ -1639,13 +1571,6 @@ static int pkey_set_type(EVP_PKEY *pkey, ENGINE *e, int type, const char *str, } else { pkey->type = EVP_PKEY_KEYMGMT; } -# ifndef OPENSSL_NO_ENGINE - if (eptr == NULL && e != NULL && !ENGINE_init(e)) { - ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR); - return 0; - } -# endif - pkey->engine = e; #endif } return 1; @@ -1662,7 +1587,7 @@ static void find_ameth(const char *name, void *data) */ ERR_set_mark(); - if (pkey_set_type(NULL, NULL, EVP_PKEY_NONE, name, (int)strlen(name), + if (pkey_set_type(NULL, EVP_PKEY_NONE, name, (int)strlen(name), NULL)) { if (str[0] == NULL) str[0] = name; @@ -1695,7 +1620,7 @@ int EVP_PKEY_set_type_by_keymgmt(EVP_PKEY *pkey, EVP_KEYMGMT *keymgmt) # define EVP_PKEY_TYPE_STR NULL # define EVP_PKEY_TYPE_STRLEN -1 #endif - return pkey_set_type(pkey, NULL, EVP_PKEY_NONE, + return pkey_set_type(pkey, EVP_PKEY_NONE, EVP_PKEY_TYPE_STR, EVP_PKEY_TYPE_STRLEN, keymgmt); @@ -1780,10 +1705,9 @@ err: void evp_pkey_free_legacy(EVP_PKEY *x) { const EVP_PKEY_ASN1_METHOD *ameth = x->ameth; - ENGINE *tmpe = NULL; if (ameth == NULL && x->legacy_cache_pkey.ptr != NULL) - ameth = EVP_PKEY_asn1_find(&tmpe, x->type); + ameth = EVP_PKEY_asn1_find(NULL, x->type); if (ameth != NULL) { if (x->legacy_cache_pkey.ptr != NULL) { @@ -1803,13 +1727,6 @@ void evp_pkey_free_legacy(EVP_PKEY *x) ameth->pkey_free(x); x->pkey.ptr = NULL; } -# ifndef OPENSSL_NO_ENGINE - ENGINE_finish(tmpe); - ENGINE_finish(x->engine); - x->engine = NULL; - ENGINE_finish(x->pmeth_engine); - x->pmeth_engine = NULL; -# endif } #endif /* FIPS_MODULE */ diff --git a/crypto/evp/pmeth_gn.c b/crypto/evp/pmeth_gn.c index 682980273a..f71447f060 100644 --- a/crypto/evp/pmeth_gn.c +++ b/crypto/evp/pmeth_gn.c @@ -13,6 +13,7 @@ #include #include "internal/cryptlib.h" #include "internal/core.h" +#include "internal/common.h" #include #include #include "crypto/bn.h" @@ -318,7 +319,10 @@ EVP_PKEY *EVP_PKEY_new_mac_key(int type, ENGINE *e, { EVP_PKEY_CTX *mac_ctx = NULL; EVP_PKEY *mac_key = NULL; - mac_ctx = EVP_PKEY_CTX_new_id(type, e); + + if (!ossl_assert(e == NULL)) + return NULL; + mac_ctx = EVP_PKEY_CTX_new_id(type, NULL); if (!mac_ctx) return NULL; if (EVP_PKEY_keygen_init(mac_ctx) <= 0) diff --git a/crypto/evp/pmeth_lib.c b/crypto/evp/pmeth_lib.c index 059469f0b0..06f52ea463 100644 --- a/crypto/evp/pmeth_lib.c +++ b/crypto/evp/pmeth_lib.c @@ -15,9 +15,6 @@ #include #include -#ifndef FIPS_MODULE -# include -#endif #include #include #include @@ -33,6 +30,7 @@ #include "internal/ffc.h" #include "internal/numbers.h" #include "internal/provider.h" +#include "internal/common.h" #include "evp_local.h" #ifndef FIPS_MODULE @@ -155,8 +153,7 @@ int evp_pkey_ctx_state(const EVP_PKEY_CTX *ctx) return EVP_PKEY_STATE_LEGACY; } -static EVP_PKEY_CTX *int_ctx_new(OSSL_LIB_CTX *libctx, - EVP_PKEY *pkey, ENGINE *e, +static EVP_PKEY_CTX *int_ctx_new(OSSL_LIB_CTX *libctx, EVP_PKEY *pkey, const char *keytype, const char *propquery, int id) @@ -185,52 +182,18 @@ static EVP_PKEY_CTX *int_ctx_new(OSSL_LIB_CTX *libctx, } } /* If no ID was found here, we can only resort to find a keymgmt */ - if (id == -1) { -#ifndef FIPS_MODULE - /* Using engine with a key without id will not work */ - if (e != NULL) { - ERR_raise(ERR_LIB_EVP, EVP_R_UNSUPPORTED_ALGORITHM); - return NULL; - } -#endif + if (id == -1) goto common; - } #ifndef FIPS_MODULE /* * Here, we extract what information we can for the purpose of * supporting usage with implementations from providers, to make * for a smooth transition from legacy stuff to provider based stuff. - * - * If an engine is given, this is entirely legacy, and we should not - * pretend anything else, so we clear the name. */ - if (e != NULL) - keytype = NULL; - if (e == NULL && (pkey == NULL || pkey->foreign == 0)) + if (pkey == NULL || pkey->foreign == 0) keytype = OBJ_nid2sn(id); -# ifndef OPENSSL_NO_ENGINE - if (e == NULL && pkey != NULL) - e = pkey->pmeth_engine != NULL ? pkey->pmeth_engine : pkey->engine; - /* Try to find an ENGINE which implements this method */ - if (e != NULL) { - if (!ENGINE_init(e)) { - ERR_raise(ERR_LIB_EVP, ERR_R_ENGINE_LIB); - return NULL; - } - } else { - e = ENGINE_get_pkey_meth_engine(id); - } - - /* - * If an ENGINE handled this method look it up. Otherwise use internal - * tables. - */ - if (e != NULL) - pmeth = ENGINE_get_pkey_meth(e, id); - else -# endif /* OPENSSL_NO_ENGINE */ if (pkey != NULL && pkey->foreign) pmeth = EVP_PKEY_meth_find(id); else @@ -240,10 +203,10 @@ static EVP_PKEY_CTX *int_ctx_new(OSSL_LIB_CTX *libctx, #endif /* FIPS_MODULE */ common: /* - * If there's no engine and no app supplied pmeth and there's a name, we try + * If there's no app supplied pmeth and there's a name, we try * fetching a provider implementation. */ - if (e == NULL && app_pmeth == NULL && keytype != NULL) { + if (app_pmeth == NULL && keytype != NULL) { /* * If |pkey| is given and is provided, we take a reference to its * keymgmt. Otherwise, we fetch one for the keytype we got. This @@ -297,11 +260,6 @@ static EVP_PKEY_CTX *int_ctx_new(OSSL_LIB_CTX *libctx, ret = OPENSSL_zalloc(sizeof(*ret)); } -#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) - if ((ret == NULL || pmeth == NULL) && e != NULL) - ENGINE_finish(e); -#endif - if (ret == NULL) { EVP_KEYMGMT_free(keymgmt); return NULL; @@ -318,7 +276,6 @@ static EVP_PKEY_CTX *int_ctx_new(OSSL_LIB_CTX *libctx, ret->keytype = keytype; ret->keymgmt = keymgmt; ret->legacy_keytype = id; - ret->engine = e; ret->pmeth = pmeth; ret->operation = EVP_PKEY_OP_UNDEFINED; @@ -346,13 +303,13 @@ EVP_PKEY_CTX *EVP_PKEY_CTX_new_from_name(OSSL_LIB_CTX *libctx, const char *name, const char *propquery) { - return int_ctx_new(libctx, NULL, NULL, name, propquery, -1); + return int_ctx_new(libctx, NULL, name, propquery, -1); } EVP_PKEY_CTX *EVP_PKEY_CTX_new_from_pkey(OSSL_LIB_CTX *libctx, EVP_PKEY *pkey, const char *propquery) { - return int_ctx_new(libctx, pkey, NULL, NULL, propquery, -1); + return int_ctx_new(libctx, pkey, NULL, propquery, -1); } void evp_pkey_ctx_free_old_ops(EVP_PKEY_CTX *ctx) @@ -404,9 +361,6 @@ void EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx) OPENSSL_free(ctx->propquery); EVP_PKEY_free(ctx->pkey); EVP_PKEY_free(ctx->peerkey); -#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) - ENGINE_finish(ctx->engine); -#endif BN_free(ctx->rsa_pubexp); OPENSSL_free(ctx); } @@ -442,25 +396,22 @@ void EVP_PKEY_meth_free(EVP_PKEY_METHOD *pmeth) EVP_PKEY_CTX *EVP_PKEY_CTX_new(EVP_PKEY *pkey, ENGINE *e) { - return int_ctx_new(NULL, pkey, e, NULL, NULL, -1); + if (!ossl_assert(e == NULL)) + return NULL; + return int_ctx_new(NULL, pkey, NULL, NULL, -1); } EVP_PKEY_CTX *EVP_PKEY_CTX_new_id(int id, ENGINE *e) { - return int_ctx_new(NULL, NULL, e, NULL, NULL, id); + if (!ossl_assert(e == NULL)) + return NULL; + return int_ctx_new(NULL, NULL, NULL, NULL, id); } EVP_PKEY_CTX *EVP_PKEY_CTX_dup(const EVP_PKEY_CTX *pctx) { EVP_PKEY_CTX *rctx; -# ifndef OPENSSL_NO_ENGINE - /* Make sure it's safe to copy a pkey context using an ENGINE */ - if (pctx->engine && !ENGINE_init(pctx->engine)) { - ERR_raise(ERR_LIB_EVP, ERR_R_ENGINE_LIB); - return 0; - } -# endif rctx = OPENSSL_zalloc(sizeof(*rctx)); if (rctx == NULL) return NULL; @@ -576,9 +527,6 @@ EVP_PKEY_CTX *EVP_PKEY_CTX_dup(const EVP_PKEY_CTX *pctx) } rctx->pmeth = pctx->pmeth; -# ifndef OPENSSL_NO_ENGINE - rctx->engine = pctx->engine; -# endif if (pctx->peerkey != NULL && !EVP_PKEY_up_ref(pctx->peerkey)) goto err; diff --git a/crypto/hmac/hmac.c b/crypto/hmac/hmac.c index 19fc7d3b4f..005ccb7727 100644 --- a/crypto/hmac/hmac.c +++ b/crypto/hmac/hmac.c @@ -35,6 +35,9 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len, if (md != NULL && md != ctx->md && (key == NULL || len < 0)) return 0; + if (impl != NULL) + return 0; + if (md != NULL) ctx->md = md; else if (ctx->md != NULL) @@ -50,7 +53,7 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len, return 0; #ifdef OPENSSL_HMAC_S390X - rv = s390x_HMAC_init(ctx, key, len, impl); + rv = s390x_HMAC_init(ctx, key, len); if (rv >= 1) return rv; #endif @@ -64,7 +67,7 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len, if (j < 0) return 0; if (j < len) { - if (!EVP_DigestInit_ex(ctx->md_ctx, md, impl) + if (!EVP_DigestInit_ex(ctx->md_ctx, md, NULL) || !EVP_DigestUpdate(ctx->md_ctx, key, len) || !EVP_DigestFinal_ex(ctx->md_ctx, keytmp, &keytmp_length)) @@ -81,14 +84,14 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len, for (i = 0; i < HMAC_MAX_MD_CBLOCK_SIZE; i++) pad[i] = 0x36 ^ keytmp[i]; - if (!EVP_DigestInit_ex(ctx->i_ctx, md, impl) + if (!EVP_DigestInit_ex(ctx->i_ctx, md, NULL) || !EVP_DigestUpdate(ctx->i_ctx, pad, EVP_MD_get_block_size(md))) goto err; for (i = 0; i < HMAC_MAX_MD_CBLOCK_SIZE; i++) pad[i] = 0x5c ^ keytmp[i]; - if (!EVP_DigestInit_ex(ctx->o_ctx, md, impl) + if (!EVP_DigestInit_ex(ctx->o_ctx, md, NULL) || !EVP_DigestUpdate(ctx->o_ctx, pad, EVP_MD_get_block_size(md))) goto err; diff --git a/crypto/hmac/hmac_local.h b/crypto/hmac/hmac_local.h index 1b871e7320..0b5c6146eb 100644 --- a/crypto/hmac/hmac_local.h +++ b/crypto/hmac/hmac_local.h @@ -56,7 +56,7 @@ struct hmac_ctx_st { # ifdef OPENSSL_HMAC_S390X # define HMAC_S390X_BUF_NUM_BLOCKS 64 -int s390x_HMAC_init(HMAC_CTX *ctx, const void *key, int key_len, ENGINE *impl); +int s390x_HMAC_init(HMAC_CTX *ctx, const void *key, int key_len); int s390x_HMAC_update(HMAC_CTX *ctx, const unsigned char *data, size_t len); int s390x_HMAC_final(HMAC_CTX *ctx, unsigned char *md, unsigned int *len); int s390x_HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx); diff --git a/crypto/hmac/hmac_s390x.c b/crypto/hmac/hmac_s390x.c index 702cb9d315..35a50fb15c 100644 --- a/crypto/hmac/hmac_s390x.c +++ b/crypto/hmac/hmac_s390x.c @@ -15,9 +15,6 @@ #include "openssl/obj_mac.h" #include "openssl/evp.h" #include "openssl/err.h" -#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) -# include -#endif #ifdef OPENSSL_HMAC_S390X @@ -70,32 +67,7 @@ static void s390x_call_kmac(HMAC_CTX *ctx, const unsigned char *in, size_t len) ctx->plat.s390x.ikp = 1; } -static int s390x_check_engine_used(const EVP_MD *md, ENGINE *impl) -{ -# if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) - const EVP_MD *d; - - if (impl != NULL) { - if (!ENGINE_init(impl)) - return 0; - } else { - impl = ENGINE_get_digest_engine(EVP_MD_get_type(md)); - } - - if (impl == NULL) - return 0; - - d = ENGINE_get_digest(impl, EVP_MD_get_type(md)); - ENGINE_finish(impl); - - if (d != NULL) - return 1; -# endif - - return 0; -} - -int s390x_HMAC_init(HMAC_CTX *ctx, const void *key, int key_len, ENGINE *impl) +int s390x_HMAC_init(HMAC_CTX *ctx, const void *key, int key_len) { unsigned char *key_param; unsigned int key_param_len; @@ -104,11 +76,6 @@ int s390x_HMAC_init(HMAC_CTX *ctx, const void *key, int key_len, ENGINE *impl) if (ctx->plat.s390x.fc == 0) return -1; /* Not supported by kmac instruction */ - if (s390x_check_engine_used(ctx->md, impl)) { - ctx->plat.s390x.fc = 0; - return -1; /* An engine handles the digest, disable acceleration */ - } - ctx->plat.s390x.blk_size = EVP_MD_get_block_size(ctx->md); if (ctx->plat.s390x.blk_size < 0) return 0; @@ -170,7 +137,7 @@ int s390x_HMAC_init(HMAC_CTX *ctx, const void *key, int key_len, ENGINE *impl) return 0; if (key_len > ctx->plat.s390x.blk_size) { - if (!EVP_DigestInit_ex(ctx->md_ctx, ctx->md, impl) + if (!EVP_DigestInit_ex(ctx->md_ctx, ctx->md, NULL) || !EVP_DigestUpdate(ctx->md_ctx, key, key_len) || !EVP_DigestFinal_ex(ctx->md_ctx, key_param, &key_param_len)) diff --git a/crypto/info.c b/crypto/info.c index 2725127077..54c3498dfe 100644 --- a/crypto/info.c +++ b/crypto/info.c @@ -273,7 +273,7 @@ const char *OPENSSL_info(int t) case OPENSSL_INFO_CONFIG_DIR: return ossl_get_openssldir(); case OPENSSL_INFO_ENGINES_DIR: - return ossl_get_enginesdir(); + return NULL; case OPENSSL_INFO_MODULES_DIR: return ossl_get_modulesdir(); case OPENSSL_INFO_DSO_EXTENSION: diff --git a/crypto/init.c b/crypto/init.c index e2fe479db5..9c01f1065c 100644 --- a/crypto/init.c +++ b/crypto/init.c @@ -7,9 +7,6 @@ * https://www.openssl.org/source/license.html */ -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - #include "internal/e_os.h" #include "crypto/cryptlib.h" #include @@ -19,7 +16,6 @@ #include "crypto/evp.h" #include "internal/conf.h" #include "crypto/async.h" -#include "crypto/engine.h" #include "internal/comp.h" #include "internal/err.h" #include "crypto/err.h" @@ -310,70 +306,6 @@ DEFINE_RUN_ONCE_STATIC(ossl_init_async) return 1; } -#ifndef OPENSSL_NO_ENGINE -static CRYPTO_ONCE engine_openssl = CRYPTO_ONCE_STATIC_INIT; -DEFINE_RUN_ONCE_STATIC(ossl_init_engine_openssl) -{ - OSSL_TRACE(INIT, "engine_load_openssl_int()\n"); - engine_load_openssl_int(); - return 1; -} -# ifndef OPENSSL_NO_RDRAND -static CRYPTO_ONCE engine_rdrand = CRYPTO_ONCE_STATIC_INIT; -DEFINE_RUN_ONCE_STATIC(ossl_init_engine_rdrand) -{ - OSSL_TRACE(INIT, "engine_load_rdrand_int()\n"); - engine_load_rdrand_int(); - return 1; -} -# endif -static CRYPTO_ONCE engine_dynamic = CRYPTO_ONCE_STATIC_INIT; -DEFINE_RUN_ONCE_STATIC(ossl_init_engine_dynamic) -{ - OSSL_TRACE(INIT, "engine_load_dynamic_int()\n"); - engine_load_dynamic_int(); - return 1; -} -# ifndef OPENSSL_NO_STATIC_ENGINE -# ifndef OPENSSL_NO_DEVCRYPTOENG -static CRYPTO_ONCE engine_devcrypto = CRYPTO_ONCE_STATIC_INIT; -DEFINE_RUN_ONCE_STATIC(ossl_init_engine_devcrypto) -{ - OSSL_TRACE(INIT, "engine_load_devcrypto_int()\n"); - engine_load_devcrypto_int(); - return 1; -} -# endif -# if !defined(OPENSSL_NO_PADLOCKENG) -static CRYPTO_ONCE engine_padlock = CRYPTO_ONCE_STATIC_INIT; -DEFINE_RUN_ONCE_STATIC(ossl_init_engine_padlock) -{ - OSSL_TRACE(INIT, "engine_load_padlock_int()\n"); - engine_load_padlock_int(); - return 1; -} -# endif -# if defined(OPENSSL_SYS_WIN32) && !defined(OPENSSL_NO_CAPIENG) -static CRYPTO_ONCE engine_capi = CRYPTO_ONCE_STATIC_INIT; -DEFINE_RUN_ONCE_STATIC(ossl_init_engine_capi) -{ - OSSL_TRACE(INIT, "engine_load_capi_int()\n"); - engine_load_capi_int(); - return 1; -} -# endif -# if !defined(OPENSSL_NO_AFALGENG) -static CRYPTO_ONCE engine_afalg = CRYPTO_ONCE_STATIC_INIT; -DEFINE_RUN_ONCE_STATIC(ossl_init_engine_afalg) -{ - OSSL_TRACE(INIT, "engine_load_afalg_int()\n"); - engine_load_afalg_int(); - return 1; -} -# endif -# endif -#endif - void OPENSSL_cleanup(void) { OPENSSL_INIT_STOP *currhandler, *lasthandler; @@ -450,11 +382,6 @@ void OPENSSL_cleanup(void) OSSL_TRACE(INIT, "OPENSSL_cleanup: ossl_config_modules_free()\n"); ossl_config_modules_free(); -#ifndef OPENSSL_NO_ENGINE - OSSL_TRACE(INIT, "OPENSSL_cleanup: engine_cleanup_int()\n"); - engine_cleanup_int(); -#endif - #ifndef OPENSSL_NO_DEPRECATED_3_0 OSSL_TRACE(INIT, "OPENSSL_cleanup: ossl_store_cleanup_int()\n"); ossl_store_cleanup_int(); @@ -651,47 +578,6 @@ int OPENSSL_init_crypto(uint64_t opts, const OPENSSL_INIT_SETTINGS *settings) && !RUN_ONCE(&async, ossl_init_async)) return 0; -#ifndef OPENSSL_NO_ENGINE - if ((opts & OPENSSL_INIT_ENGINE_OPENSSL) - && !RUN_ONCE(&engine_openssl, ossl_init_engine_openssl)) - return 0; -# ifndef OPENSSL_NO_RDRAND - if ((opts & OPENSSL_INIT_ENGINE_RDRAND) - && !RUN_ONCE(&engine_rdrand, ossl_init_engine_rdrand)) - return 0; -# endif - if ((opts & OPENSSL_INIT_ENGINE_DYNAMIC) - && !RUN_ONCE(&engine_dynamic, ossl_init_engine_dynamic)) - return 0; -# ifndef OPENSSL_NO_STATIC_ENGINE -# ifndef OPENSSL_NO_DEVCRYPTOENG - if ((opts & OPENSSL_INIT_ENGINE_CRYPTODEV) - && !RUN_ONCE(&engine_devcrypto, ossl_init_engine_devcrypto)) - return 0; -# endif -# if !defined(OPENSSL_NO_PADLOCKENG) - if ((opts & OPENSSL_INIT_ENGINE_PADLOCK) - && !RUN_ONCE(&engine_padlock, ossl_init_engine_padlock)) - return 0; -# endif -# if defined(OPENSSL_SYS_WIN32) && !defined(OPENSSL_NO_CAPIENG) - if ((opts & OPENSSL_INIT_ENGINE_CAPI) - && !RUN_ONCE(&engine_capi, ossl_init_engine_capi)) - return 0; -# endif -# if !defined(OPENSSL_NO_AFALGENG) - if ((opts & OPENSSL_INIT_ENGINE_AFALG) - && !RUN_ONCE(&engine_afalg, ossl_init_engine_afalg)) - return 0; -# endif -# endif - if (opts & (OPENSSL_INIT_ENGINE_ALL_BUILTIN - | OPENSSL_INIT_ENGINE_OPENSSL - | OPENSSL_INIT_ENGINE_AFALG)) { - ENGINE_register_all_complete(); - } -#endif - if (!CRYPTO_atomic_or(&optsdone, opts, &tmp, optsdone_lock)) return 0; diff --git a/crypto/pem/pem_lib.c b/crypto/pem/pem_lib.c index 04e92ec956..b2c1ad50f0 100644 --- a/crypto/pem/pem_lib.c +++ b/crypto/pem/pem_lib.c @@ -8,7 +8,7 @@ */ /* - * We need to use some engine deprecated APIs + * We need to use some EVP_PKEY_asn1 deprecated APIs */ #include "internal/deprecated.h" @@ -25,7 +25,6 @@ #include #include "crypto/asn1.h" #include -#include #define MIN_LENGTH 4 @@ -158,17 +157,13 @@ static int check_pem(const char *nm, const char *name) const EVP_PKEY_ASN1_METHOD *ameth; slen = ossl_pem_check_suffix(nm, "PARAMETERS"); if (slen > 0) { - ENGINE *e; - ameth = EVP_PKEY_asn1_find_str(&e, nm, slen); + ameth = EVP_PKEY_asn1_find_str(NULL, nm, slen); if (ameth) { int r; if (ameth->param_decode) r = 1; else r = 0; -#ifndef OPENSSL_NO_ENGINE - ENGINE_finish(e); -#endif return r; } } diff --git a/crypto/pem/pem_pkey.c b/crypto/pem/pem_pkey.c index b1001e2d4b..02ade5bfbc 100644 --- a/crypto/pem/pem_pkey.c +++ b/crypto/pem/pem_pkey.c @@ -19,7 +19,6 @@ #include #include #include -#include #include #include #include diff --git a/crypto/rand/rand_lib.c b/crypto/rand/rand_lib.c index 0c62109de9..000d32d908 100644 --- a/crypto/rand/rand_lib.c +++ b/crypto/rand/rand_lib.c @@ -7,7 +7,7 @@ * https://www.openssl.org/source/license.html */ -/* We need to use some engine deprecated APIs */ +/* We need to use some RAND deprecated APIs */ #define OPENSSL_SUPPRESS_DEPRECATED #include @@ -23,6 +23,7 @@ #include "rand_local.h" #include "crypto/context.h" #include "internal/provider.h" +#include "internal/common.h" #ifndef OPENSSL_DEFAULT_SEED_SRC # define OPENSSL_DEFAULT_SEED_SRC SEED-SRC @@ -88,7 +89,6 @@ static RAND_GLOBAL *rand_get_global(OSSL_LIB_CTX *libctx) # include # include # include -# include # include "crypto/rand_pool.h" # include "prov/seeding.h" # include "internal/e_os.h" @@ -112,11 +112,6 @@ static int set_random_provider_name(RAND_GLOBAL *dgbl, const char *name) return dgbl->random_provider_name != NULL; } -# ifndef OPENSSL_NO_ENGINE -/* non-NULL if default_RAND_meth is ENGINE-provided */ -static ENGINE *funct_ref; -static CRYPTO_RWLOCK *rand_engine_lock; -# endif /* !OPENSSL_NO_ENGINE */ # ifndef OPENSSL_NO_DEPRECATED_3_0 static CRYPTO_RWLOCK *rand_meth_lock; static const RAND_METHOD *default_RAND_meth; @@ -127,12 +122,6 @@ static int rand_inited = 0; DEFINE_RUN_ONCE_STATIC(do_rand_init) { -# ifndef OPENSSL_NO_ENGINE - rand_engine_lock = CRYPTO_THREAD_lock_new(); - if (rand_engine_lock == NULL) - return 0; -# endif /* !OPENSSL_NO_ENGINE */ - # ifndef OPENSSL_NO_DEPRECATED_3_0 rand_meth_lock = CRYPTO_THREAD_lock_new(); if (rand_meth_lock == NULL) @@ -150,10 +139,6 @@ DEFINE_RUN_ONCE_STATIC(do_rand_init) CRYPTO_THREAD_lock_free(rand_meth_lock); rand_meth_lock = NULL; # endif /* !OPENSSL_NO_DEPRECATED_3_0 */ -# ifndef OPENSSL_NO_ENGINE - CRYPTO_THREAD_lock_free(rand_engine_lock); - rand_engine_lock = NULL; -# endif /* !OPENSSL_NO_ENGINE */ return 0; } @@ -170,10 +155,6 @@ void ossl_rand_cleanup_int(void) RAND_set_rand_method(NULL); # endif /* !OPENSSL_NO_DEPRECATED_3_0 */ ossl_rand_pool_cleanup(); -# ifndef OPENSSL_NO_ENGINE - CRYPTO_THREAD_lock_free(rand_engine_lock); - rand_engine_lock = NULL; -# endif /* !OPENSSL_NO_ENGINE */ # ifndef OPENSSL_NO_DEPRECATED_3_0 CRYPTO_THREAD_lock_free(rand_meth_lock); rand_meth_lock = NULL; @@ -242,17 +223,15 @@ int RAND_poll(void) # ifndef OPENSSL_NO_DEPRECATED_3_0 static int rand_set_rand_method_internal(const RAND_METHOD *meth, - ossl_unused ENGINE *e) + ENGINE *e) { + if (!ossl_assert(e == NULL)) + return 0; if (!RUN_ONCE(&rand_init, do_rand_init)) return 0; if (!CRYPTO_THREAD_write_lock(rand_meth_lock)) return 0; -# ifndef OPENSSL_NO_ENGINE - ENGINE_finish(funct_ref); - funct_ref = e; -# endif default_RAND_meth = meth; CRYPTO_THREAD_unlock(rand_meth_lock); return 1; @@ -282,56 +261,12 @@ const RAND_METHOD *RAND_get_rand_method(void) if (!CRYPTO_THREAD_write_lock(rand_meth_lock)) return NULL; - if (default_RAND_meth == NULL) { -# ifndef OPENSSL_NO_ENGINE - ENGINE *e; - - /* If we have an engine that can do RAND, use it. */ - if ((e = ENGINE_get_default_RAND()) != NULL - && (tmp_meth = ENGINE_get_RAND(e)) != NULL) { - funct_ref = e; - default_RAND_meth = tmp_meth; - } else { - ENGINE_finish(e); - default_RAND_meth = &ossl_rand_meth; - } -# else + if (default_RAND_meth == NULL) default_RAND_meth = &ossl_rand_meth; -# endif - } tmp_meth = default_RAND_meth; CRYPTO_THREAD_unlock(rand_meth_lock); return tmp_meth; } - -# if !defined(OPENSSL_NO_ENGINE) -int RAND_set_rand_engine(ENGINE *engine) -{ - const RAND_METHOD *tmp_meth = NULL; - - if (!RUN_ONCE(&rand_init, do_rand_init)) - return 0; - - if (engine != NULL) { - if (!ENGINE_init(engine)) - return 0; - tmp_meth = ENGINE_get_RAND(engine); - if (tmp_meth == NULL) { - ENGINE_finish(engine); - return 0; - } - } - if (!CRYPTO_THREAD_write_lock(rand_engine_lock)) { - ENGINE_finish(engine); - return 0; - } - - /* This function releases any prior ENGINE so call it first */ - rand_set_rand_method_internal(tmp_meth, engine); - CRYPTO_THREAD_unlock(rand_engine_lock); - return 1; -} -# endif # endif /* OPENSSL_NO_DEPRECATED_3_0 */ void RAND_seed(const void *buf, int num) diff --git a/crypto/rand/rand_pool.c b/crypto/rand/rand_pool.c index 4f258b87ee..1c4e49c1d0 100644 --- a/crypto/rand/rand_pool.c +++ b/crypto/rand/rand_pool.c @@ -12,7 +12,6 @@ #include "internal/cryptlib.h" #include #include "crypto/rand.h" -#include #include "internal/thread_once.h" #include "crypto/rand_pool.h" diff --git a/crypto/rsa/rsa_backend.c b/crypto/rsa/rsa_backend.c index d6864dc237..04c4ccdf1b 100644 --- a/crypto/rsa/rsa_backend.c +++ b/crypto/rsa/rsa_backend.c @@ -455,7 +455,7 @@ int ossl_rsa_pss_params_30_fromdata(RSA_PSS_PARAMS_30 *pss_params, int ossl_rsa_is_foreign(const RSA *rsa) { #ifndef FIPS_MODULE - if (rsa->engine != NULL || RSA_get_method(rsa) != RSA_PKCS1_OpenSSL()) + if (RSA_get_method(rsa) != RSA_PKCS1_OpenSSL()) return 1; #endif return 0; diff --git a/crypto/rsa/rsa_lib.c b/crypto/rsa/rsa_lib.c index 3d12f5affa..2484b1ca71 100644 --- a/crypto/rsa/rsa_lib.c +++ b/crypto/rsa/rsa_lib.c @@ -15,13 +15,11 @@ #include #include -#ifndef FIPS_MODULE -# include -#endif #include #include #include "internal/cryptlib.h" #include "internal/refcount.h" +#include "internal/common.h" #include "crypto/bn.h" #include "crypto/evp.h" #include "crypto/rsa.h" @@ -29,12 +27,12 @@ #include "crypto/security_bits.h" #include "rsa_local.h" -static RSA *rsa_new_intern(ENGINE *engine, OSSL_LIB_CTX *libctx); +static RSA *rsa_new_intern(OSSL_LIB_CTX *libctx); #ifndef FIPS_MODULE RSA *RSA_new(void) { - return rsa_new_intern(NULL, NULL); + return rsa_new_intern(NULL); } const RSA_METHOD *RSA_get_method(const RSA *rsa) @@ -52,10 +50,6 @@ int RSA_set_method(RSA *rsa, const RSA_METHOD *meth) mtmp = rsa->meth; if (mtmp->finish) mtmp->finish(rsa); -#ifndef OPENSSL_NO_ENGINE - ENGINE_finish(rsa->engine); - rsa->engine = NULL; -#endif rsa->meth = meth; if (meth->init) meth->init(rsa); @@ -64,16 +58,18 @@ int RSA_set_method(RSA *rsa, const RSA_METHOD *meth) RSA *RSA_new_method(ENGINE *engine) { - return rsa_new_intern(engine, NULL); + if (!ossl_assert(engine == NULL)) + return NULL; + return rsa_new_intern(NULL); } #endif RSA *ossl_rsa_new_with_ctx(OSSL_LIB_CTX *libctx) { - return rsa_new_intern(NULL, libctx); + return rsa_new_intern(libctx); } -static RSA *rsa_new_intern(ENGINE *engine, OSSL_LIB_CTX *libctx) +static RSA *rsa_new_intern(OSSL_LIB_CTX *libctx) { RSA *ret = OPENSSL_zalloc(sizeof(*ret)); @@ -99,26 +95,6 @@ static RSA *rsa_new_intern(ENGINE *engine, OSSL_LIB_CTX *libctx) ret->libctx = libctx; ret->meth = RSA_get_default_method(); -#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) - ret->flags = ret->meth->flags & ~RSA_FLAG_NON_FIPS_ALLOW; - if (engine) { - if (!ENGINE_init(engine)) { - ERR_raise(ERR_LIB_RSA, ERR_R_ENGINE_LIB); - goto err; - } - ret->engine = engine; - } else { - ret->engine = ENGINE_get_default_RSA(); - } - if (ret->engine) { - ret->meth = ENGINE_get_RSA(ret->engine); - if (ret->meth == NULL) { - ERR_raise(ERR_LIB_RSA, ERR_R_ENGINE_LIB); - goto err; - } - } -#endif - ret->flags = ret->meth->flags & ~RSA_FLAG_NON_FIPS_ALLOW; #ifndef FIPS_MODULE if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_RSA, ret, &ret->ex_data)) { @@ -153,9 +129,6 @@ void RSA_free(RSA *r) if (r->meth != NULL && r->meth->finish != NULL) r->meth->finish(r); -#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) - ENGINE_finish(r->engine); -#endif #ifndef FIPS_MODULE CRYPTO_free_ex_data(CRYPTO_EX_INDEX_RSA, r, &r->ex_data); @@ -735,11 +708,6 @@ int RSA_get_version(RSA *r) } #ifndef FIPS_MODULE -ENGINE *RSA_get0_engine(const RSA *r) -{ - return r->engine; -} - int RSA_pkey_ctx_ctrl(EVP_PKEY_CTX *ctx, int optype, int cmd, int p1, void *p2) { /* If key type not RSA or RSA-PSS return error */ diff --git a/crypto/rsa/rsa_local.h b/crypto/rsa/rsa_local.h index 8ab2bef3fb..d438283d9e 100644 --- a/crypto/rsa/rsa_local.h +++ b/crypto/rsa/rsa_local.h @@ -57,8 +57,6 @@ struct rsa_st { OSSL_LIB_CTX *libctx; int32_t version; const RSA_METHOD *meth; - /* functional reference if 'meth' is ENGINE-provided */ - ENGINE *engine; BIGNUM *n; BIGNUM *e; BIGNUM *d; diff --git a/crypto/store/store_local.h b/crypto/store/store_local.h index 6ad79180a0..eff232332f 100644 --- a/crypto/store/store_local.h +++ b/crypto/store/store_local.h @@ -11,7 +11,6 @@ #include "internal/thread_once.h" #include "internal/refcount.h" #include -#include #include #include #include @@ -83,7 +82,6 @@ struct ossl_store_loader_st { #ifndef OPENSSL_NO_DEPRECATED_3_0 /* Legacy stuff */ const char *scheme; - ENGINE *engine; OSSL_STORE_open_fn open; OSSL_STORE_attach_fn attach; OSSL_STORE_ctrl_fn ctrl; diff --git a/crypto/store/store_register.c b/crypto/store/store_register.c index 6f73e19720..a72dc20b4c 100644 --- a/crypto/store/store_register.c +++ b/crypto/store/store_register.c @@ -13,6 +13,7 @@ #include #include +#include "internal/common.h" #include "store_local.h" static CRYPTO_RWLOCK *registry_lock; @@ -32,6 +33,8 @@ OSSL_STORE_LOADER *OSSL_STORE_LOADER_new(ENGINE *e, const char *scheme) { OSSL_STORE_LOADER *res = NULL; + if (!ossl_assert(e == NULL)) + return NULL; /* * We usually don't check NULL arguments. For loaders, though, the * scheme is crucial and must never be NULL, or the user will get @@ -46,16 +49,10 @@ OSSL_STORE_LOADER *OSSL_STORE_LOADER_new(ENGINE *e, const char *scheme) if ((res = OPENSSL_zalloc(sizeof(*res))) == NULL) return NULL; - res->engine = e; res->scheme = scheme; return res; } -const ENGINE *OSSL_STORE_LOADER_get0_engine(const OSSL_STORE_LOADER *loader) -{ - return loader->engine; -} - const char *OSSL_STORE_LOADER_get0_scheme(const OSSL_STORE_LOADER *loader) { return loader->scheme; diff --git a/crypto/trace.c b/crypto/trace.c index 8fee348a6c..83e8da8b71 100644 --- a/crypto/trace.c +++ b/crypto/trace.c @@ -127,8 +127,6 @@ static const struct trace_category_st TRACE_CATEGORY_(TLS), TRACE_CATEGORY_(TLS_CIPHER), TRACE_CATEGORY_(CONF), - TRACE_CATEGORY_(ENGINE_TABLE), - TRACE_CATEGORY_(ENGINE_REF_COUNT), TRACE_CATEGORY_(PKCS5V2), TRACE_CATEGORY_(PKCS12_KEYGEN), TRACE_CATEGORY_(PKCS12_DECRYPT), diff --git a/crypto/ts/ts_conf.c b/crypto/ts/ts_conf.c index 59737a5cec..60d4ac3e9c 100644 --- a/crypto/ts/ts_conf.c +++ b/crypto/ts/ts_conf.c @@ -7,15 +7,11 @@ * https://www.openssl.org/source/license.html */ -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - #include #include #include "internal/cryptlib.h" #include -#include #include #include @@ -23,7 +19,6 @@ #define BASE_SECTION "tsa" #define ENV_DEFAULT_TSA "default_tsa" #define ENV_SERIAL "serial" -#define ENV_CRYPTO_DEVICE "crypto_device" #define ENV_SIGNER_CERT "signer_cert" #define ENV_CERTS "certs" #define ENV_SIGNER_KEY "signer_key" @@ -158,51 +153,6 @@ int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb, return ret; } -#ifndef OPENSSL_NO_ENGINE - -int TS_CONF_set_crypto_device(CONF *conf, const char *section, - const char *device) -{ - int ret = 0; - - if (device == NULL) - device = NCONF_get_string(conf, section, ENV_CRYPTO_DEVICE); - - if (device && !TS_CONF_set_default_engine(device)) { - ts_CONF_invalid(section, ENV_CRYPTO_DEVICE); - goto err; - } - ret = 1; - err: - return ret; -} - -int TS_CONF_set_default_engine(const char *name) -{ - ENGINE *e = NULL; - int ret = 0; - - if (strcmp(name, "builtin") == 0) - return 1; - - if ((e = ENGINE_by_id(name)) == NULL) - goto err; - if (strcmp(name, "chil") == 0) - ENGINE_ctrl(e, ENGINE_CTRL_CHIL_SET_FORKCHECK, 1, 0, 0); - if (!ENGINE_set_default(e, ENGINE_METHOD_ALL)) - goto err; - ret = 1; - - err: - if (!ret) - ERR_raise_data(ERR_LIB_TS, TS_R_COULD_NOT_SET_ENGINE, - "engine:%s", name); - ENGINE_free(e); - return ret; -} - -#endif - int TS_CONF_set_signer_cert(CONF *conf, const char *section, const char *cert, TS_RESP_CTX *ctx) { diff --git a/crypto/x509/x_pubkey.c b/crypto/x509/x_pubkey.c index d649f9b802..d07b3752d3 100644 --- a/crypto/x509/x_pubkey.c +++ b/crypto/x509/x_pubkey.c @@ -17,7 +17,6 @@ #include "internal/cryptlib.h" #include #include -#include #include "crypto/asn1.h" #include "crypto/evp.h" #include "crypto/x509.h" @@ -410,18 +409,8 @@ static int x509_pubkey_decode(EVP_PKEY **ppkey, const X509_PUBKEY *key) int nid; nid = OBJ_obj2nid(key->algor->algorithm); - if (!key->flag_force_legacy) { -#ifndef OPENSSL_NO_ENGINE - ENGINE *e = NULL; - - e = ENGINE_get_pkey_meth_engine(nid); - if (e == NULL) - return 0; - ENGINE_finish(e); -#else + if (!key->flag_force_legacy) return 0; -#endif - } pkey = EVP_PKEY_new(); if (pkey == NULL) { diff --git a/doc/build.info b/doc/build.info index 36aa5b08bb..d7e169e580 100644 --- a/doc/build.info +++ b/doc/build.info @@ -100,12 +100,6 @@ DEPEND[man/man1/openssl-enc.1]=man1/openssl-enc.pod GENERATE[man/man1/openssl-enc.1]=man1/openssl-enc.pod DEPEND[man1/openssl-enc.pod]{pod}=man1/openssl-enc.pod.in GENERATE[man1/openssl-enc.pod]=man1/openssl-enc.pod.in -DEPEND[html/man1/openssl-engine.html]=man1/openssl-engine.pod -GENERATE[html/man1/openssl-engine.html]=man1/openssl-engine.pod -DEPEND[man/man1/openssl-engine.1]=man1/openssl-engine.pod -GENERATE[man/man1/openssl-engine.1]=man1/openssl-engine.pod -DEPEND[man1/openssl-engine.pod]{pod}=man1/openssl-engine.pod.in -GENERATE[man1/openssl-engine.pod]=man1/openssl-engine.pod.in DEPEND[html/man1/openssl-errstr.html]=man1/openssl-errstr.pod GENERATE[html/man1/openssl-errstr.html]=man1/openssl-errstr.pod DEPEND[man/man1/openssl-errstr.1]=man1/openssl-errstr.pod @@ -376,7 +370,6 @@ html/man1/openssl-dsaparam.html \ html/man1/openssl-ec.html \ html/man1/openssl-ecparam.html \ html/man1/openssl-enc.html \ -html/man1/openssl-engine.html \ html/man1/openssl-errstr.html \ html/man1/openssl-fipsinstall.html \ html/man1/openssl-format-options.html \ @@ -438,7 +431,6 @@ man/man1/openssl-dsaparam.1 \ man/man1/openssl-ec.1 \ man/man1/openssl-ecparam.1 \ man/man1/openssl-enc.1 \ -man/man1/openssl-engine.1 \ man/man1/openssl-errstr.1 \ man/man1/openssl-fipsinstall.1 \ man/man1/openssl-format-options.1 \ diff --git a/doc/internal/man3/OPTIONS.pod b/doc/internal/man3/OPTIONS.pod index acd7a44038..669823ee8f 100644 --- a/doc/internal/man3/OPTIONS.pod +++ b/doc/internal/man3/OPTIONS.pod @@ -8,7 +8,7 @@ opt_begin, opt_next, opt_flag, opt_arg, opt_unknown, opt_cipher, opt_cipher_any, opt_cipher_silent, opt_md, opt_int, opt_int_arg, opt_long, opt_ulong, opt_intmax, opt_uintmax, opt_format, opt_isdir, opt_string, opt_pair, -opt_num_rest, opt_rest, opt_legacy_okay +opt_num_rest, opt_rest - Option parsing for commands and tests =head1 SYNOPSIS @@ -53,8 +53,6 @@ opt_num_rest, opt_rest, opt_legacy_okay int opt_num_rest(void); char **opt_rest(void); - int opt_legacy_okay(void); - =head1 DESCRIPTION The functions on this page provide a common set of option-parsing for @@ -126,7 +124,6 @@ be chosen from the following set: 'u' An unsigned number that fits in the C type 'c' File in PEM, DER, or S/MIME format 'F' A file in PEM or DER format - 'E' Like 'F' but also allows ENGINE 'f' Any file format The B is what to display when the user uses the help option, @@ -292,12 +289,6 @@ The opt_rest() function returns a pointer to the first non-option. If there were no parameters, it will point to the NULL that is at the end of the standard I array. -The opt_legacy_okay() function returns true if no options have been -specified that would preclude using legacy code paths. Currently, -the various provider options preclude legacy operation. This means, -for example, that specifying both B<-provider> and B<-engine> in the -same command line will not work as expected. - =head2 Common Options There are a few groups of options that are common to many OpenSSL programs. diff --git a/doc/internal/man7/EVP_PKEY.pod b/doc/internal/man7/EVP_PKEY.pod index fd3c27c2db..b8588b0dfb 100644 --- a/doc/internal/man7/EVP_PKEY.pod +++ b/doc/internal/man7/EVP_PKEY.pod @@ -30,15 +30,12 @@ and it can take one of the following forms: This is the form that an B in OpenSSL prior to 3.0 had. The internal key in the B is a pointer to the low-level key -types, such as B, B and B, or an engine driven -structure, and is governed by an associated L and -an L. +types, such as B, B and B, and is governed by an associated +L and an L. The functions available through those two method structures get full access to the B and therefore have a lot of freedom to -modify whatever they want. This also means that an B is a -shared structure between libcrypto and any ENGINE that serves such -methods. +modify whatever they want. =item provider-native origin @@ -135,8 +132,7 @@ the exported key data) must implement OSSL_FUNC_keymgmt_import(). If such caching isn't supported, the operations that can be performed with that key are limited to the same backend as the origin key -(ENGINE for legacy origin keys, provider for provider side origin -keys). +(only provider by now). =head3 Exporting implementation details diff --git a/doc/internal/man7/build.info.pod b/doc/internal/man7/build.info.pod index 6f67aca7a5..de5bcb33c6 100644 --- a/doc/internal/man7/build.info.pod +++ b/doc/internal/man7/build.info.pod @@ -583,12 +583,6 @@ This is used with B, to specify that some scripts should be installed in the "misc" directory rather than the normal program directory. -=item B - -This is used with B, to specify what modules are engines and -should be installed in the engines directory instead of the modules -directory. - =item B This is used with B where libraries are involved, to specify diff --git a/doc/man1/build.info b/doc/man1/build.info index 5c41a1687d..aba8a89dd5 100644 --- a/doc/man1/build.info +++ b/doc/man1/build.info @@ -18,7 +18,6 @@ DEPEND[openssl-dsa.pod]=../perlvars.pm DEPEND[openssl-ecparam.pod]=../perlvars.pm DEPEND[openssl-ec.pod]=../perlvars.pm DEPEND[openssl-enc.pod]=../perlvars.pm -DEPEND[openssl-engine.pod]=../perlvars.pm DEPEND[openssl-errstr.pod]=../perlvars.pm DEPEND[openssl-fipsinstall.pod]=../perlvars.pm DEPEND[openssl-gendsa.pod]=../perlvars.pm diff --git a/doc/man1/openssl-ca.pod.in b/doc/man1/openssl-ca.pod.in index 04075004bc..33bc11a431 100644 --- a/doc/man1/openssl-ca.pod.in +++ b/doc/man1/openssl-ca.pod.in @@ -37,7 +37,7 @@ B B [B<-md> I] [B<-policy> I] [B<-keyfile> I|I] -[B<-keyform> B|B|B|B] +[B<-keyform> B|B|B] [B<-key> I] [B<-passin> I] [B<-cert> I] @@ -66,7 +66,7 @@ B B [B<-rand_serial>] [B<-multivalue-rdn>] {- $OpenSSL::safe::opt_r_synopsis -} -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_provider_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} [I...] =head1 DESCRIPTION @@ -171,7 +171,7 @@ See L for details. The CA private key to sign certificate requests with. This must match with B<-cert>. -=item B<-keyform> B|B|B|B +=item B<-keyform> B|B|B The format of the private key input file; unspecified by default. See L for details. @@ -355,8 +355,6 @@ This option has been deprecated and has no effect. {- $OpenSSL::safe::opt_r_item -} -{- $OpenSSL::safe::opt_engine_item -} - {- $OpenSSL::safe::opt_provider_item -} =back @@ -800,7 +798,7 @@ nevertheless some people are using it for this purpose at least internally. When doing so, specific care should be taken to properly secure the private key(s) used for signing certificates. It is advisable to keep them in a secure HW storage such as a smart card or HSM -and access them via a suitable engine or crypto provider. +and access them via a suitable crypto provider. This command is effectively a single user command: no locking is done on the various files and attempts to run more than one B @@ -847,11 +845,11 @@ The B<-section> option was added in OpenSSL 3.0.0. The B<-multivalue-rdn> option has become obsolete in OpenSSL 3.0.0 and has no effect. -The B<-engine> option was deprecated in OpenSSL 3.0. - Since OpenSSL 3.2, generated certificates bear X.509 version 3, and key identifier extensions are included by default. +The B<-engine> option was removed in OpenSSL 4.0. + =head1 SEE ALSO L, diff --git a/doc/man1/openssl-ciphers.pod.in b/doc/man1/openssl-ciphers.pod.in index 69195bcdcb..24852e2dc9 100644 --- a/doc/man1/openssl-ciphers.pod.in +++ b/doc/man1/openssl-ciphers.pod.in @@ -359,7 +359,7 @@ Cipher suites using SHA256 or SHA384. =item B Cipher suites using GOST R 34.10 (either 2001 or 94) for authentication -(needs an engine supporting GOST algorithms). +(needs a provider supporting GOST algorithms). =item B @@ -512,9 +512,8 @@ is used. =head2 GOST cipher suites from draft-chudov-cryptopro-cptls, extending TLS v1.0 -Note: these ciphers require an engine which including GOST cryptographic -algorithms, such as the B engine, which isn't part of the OpenSSL -distribution. +Note: these ciphers require a GOST provider which isn't part of OpenSSL and a +3rd party implementation is a work in progress. TLS_GOSTR341094_WITH_28147_CNT_IMIT GOST94-GOST89-GOST89 TLS_GOSTR341001_WITH_28147_CNT_IMIT GOST2001-GOST89-GOST89 @@ -523,9 +522,8 @@ distribution. =head2 GOST cipher suites, extending TLS v1.2 -Note: these ciphers require an engine which including GOST cryptographic -algorithms, such as the B engine, which isn't part of the OpenSSL -distribution. +Note: these ciphers require a GOST provider which isn't part of OpenSSL and a +3rd party implementation is a work in progress. TLS_GOSTR341112_256_WITH_28147_CNT_IMIT GOST2012-GOST8912-GOST8912 TLS_GOSTR341112_256_WITH_NULL_GOSTR3411 GOST2012-NULL-GOST12 diff --git a/doc/man1/openssl-cmds.pod.in b/doc/man1/openssl-cmds.pod.in index 4cfb7ce4ee..89890e43a9 100644 --- a/doc/man1/openssl-cmds.pod.in +++ b/doc/man1/openssl-cmds.pod.in @@ -19,7 +19,6 @@ dsaparam, ec, ecparam, enc, -engine, errstr, gendsa, genpkey, @@ -100,7 +99,6 @@ L, L, L, L, -L, L, L, L, @@ -150,6 +148,8 @@ In order to reduce cluttering of the global manual page namespace, the manual page entries without the 'openssl-' prefix have been deprecated in OpenSSL 3.0 and will be removed in OpenSSL 4.0. +The B command was removed in OpenSSL 4.0. + =head1 COPYRIGHT Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man1/openssl-cmp.pod.in b/doc/man1/openssl-cmp.pod.in index 943f4a1f70..696df2febd 100644 --- a/doc/man1/openssl-cmp.pod.in +++ b/doc/man1/openssl-cmp.pod.in @@ -99,9 +99,9 @@ Credentials format options: [B<-certform> I] [B<-crlform> I] -[B<-keyform> I] +[B<-keyform> I] [B<-otherpass> I] -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_provider_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} Random state options: @@ -927,7 +927,7 @@ Default value is DER. DER format is preferred because it enables more efficient storage of large CRLs. -=item B<-keyform> I +=item B<-keyform> I The format of the key input; unspecified by default. See L for details. @@ -945,22 +945,6 @@ If not given here, the password will be prompted for if needed. For more information about the format of I see L. -{- $OpenSSL::safe::opt_engine_item -} - -{- output_off() if $disabled{"deprecated-3.0"}; "" -} -As an alternative to using this combination: - - -engine {engineid} -key {keyid} -keyform ENGINE - -... it's also possible to just give the key ID in URI form to B<-key>, -like this: - - -key org.openssl.engine:{engineid}:{keyid} - -This applies to all options specifying keys: B<-key>, B<-newkey>, and -B<-tls_key>. -{- output_on() if $disabled{"deprecated-3.0"}; "" -} - =back =head2 Provider options @@ -1515,8 +1499,6 @@ L, L, L The B application was added in OpenSSL 3.0. -The B<-engine> option was deprecated in OpenSSL 3.0. - The B<-oldwithold>, B<-newwithnew>, B<-newwithold>, B<-oldwithnew>, The B<-srvcertout>, and B<-serial> option were added in OpenSSL 3.2, as well as an extension of B<-cacertsout> to use when getting CA certificates. @@ -1531,6 +1513,8 @@ and B<-rsp_crl> options were added in OpenSSL 3.4. B<-centralkeygen>, B<-newkeyout>, B<-rsp_key> and B<-rsp_keypass> were added in OpenSSL 3.5. +The B<-engine> option was removed in OpenSSL 4.0. + =head1 COPYRIGHT Copyright 2007-2025 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man1/openssl-cms.pod.in b/doc/man1/openssl-cms.pod.in index 7e4272877f..4d79fe9add 100644 --- a/doc/man1/openssl-cms.pod.in +++ b/doc/man1/openssl-cms.pod.in @@ -58,8 +58,8 @@ Keys and password options: [B<-inkey> I|I] [B<-passin> I] [B<-keyopt> I:I] -[B<-keyform> B|B|B|B] -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_provider_synopsis -} +[B<-keyform> B|B|B] +{- $OpenSSL::safe::opt_provider_synopsis -} {- $OpenSSL::safe::opt_r_synopsis -} Encryption options: @@ -375,13 +375,11 @@ set customised parameters for the preceding key or certificate. It can currently be used to set RSA-PSS for signing, RSA-OAEP for encryption or to modify default parameters for ECDH. -=item B<-keyform> B|B|B|B +=item B<-keyform> B|B|B The format of the private key file; unspecified by default. See L for details. -{- $OpenSSL::safe::opt_engine_item -} - {- $OpenSSL::safe::opt_provider_item -} {- $OpenSSL::safe::opt_r_item -} @@ -948,12 +946,12 @@ The -no_alt_chains option was added in OpenSSL 1.0.2b. The B<-nameopt> option was added in OpenSSL 3.0.0. -The B<-engine> option was deprecated in OpenSSL 3.0. - The B<-digest> option was added in OpenSSL 3.2. The B<-recip_kdf> and B<-recip_ukm> options were added in OpenSSL 3.6. +The B<-engine> option was removed in OpenSSL 4.0. + =head1 COPYRIGHT Copyright 2008-2025 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man1/openssl-dgst.pod.in b/doc/man1/openssl-dgst.pod.in index 579a8aed0b..eaf332367d 100644 --- a/doc/man1/openssl-dgst.pod.in +++ b/doc/man1/openssl-dgst.pod.in @@ -20,7 +20,7 @@ B B|I [B<-r>] [B<-out> I] [B<-sign> I|I] -[B<-keyform> B|B|B|B] +[B<-keyform> B|B|B] [B<-passin> I] [B<-verify> I] [B<-prverify> I] @@ -32,9 +32,6 @@ B B|I [B<-mac> I] [B<-macopt> I:I] [B<-fips-fingerprint>] -{- $OpenSSL::safe::opt_engine_synopsis -}{- output_off() if $disabled{"deprecated-3.0"}; "" --}[B<-engine_impl> I]{- - output_on() if $disabled{"deprecated-3.0"}; "" -} {- $OpenSSL::safe::opt_r_synopsis -} {- $OpenSSL::safe::opt_provider_synopsis -} [I ...] @@ -126,7 +123,7 @@ be set. For these algorithms the input is buffered (and not digested) before signing. For these algorithms, if the input is larger than 16MB an error will occur. -=item B<-keyform> B|B|B|B +=item B<-keyform> B|B|B The format of the key to sign with; unspecified by default. See L for details. @@ -193,8 +190,7 @@ option. Create MAC (keyed Message Authentication Code). The most popular MAC algorithm is HMAC (hash-based MAC), but there are other MAC algorithms -which are not based on hash, for instance B algorithm, -supported by the B engine. MAC keys and other options should be set +which are not based on hash. MAC keys and other options should be set via B<-macopt> parameter. Cannot be used together with -hmac, -hmac-env and -hmac-stdin. @@ -261,17 +257,6 @@ Compute HMAC using a specific key for certain OpenSSL-FIPS operations. {- $OpenSSL::safe::opt_r_item -} -{- $OpenSSL::safe::opt_engine_item -} -{- output_off() if $disabled{"deprecated-3.0"}; "" -} -The engine is not used for digests unless the B<-engine_impl> option is -used or it is configured to do so, see L. - -=item B<-engine_impl> I - -When used with the B<-engine> option, it specifies to also use -engine I for digest operations. - -{- output_on() if $disabled{"deprecated-3.0"}; "" -} {- $OpenSSL::safe::opt_provider_item -} =item I ... @@ -341,7 +326,7 @@ L The default digest was changed from MD5 to SHA256 in OpenSSL 1.1.0. The FIPS-related options were removed in OpenSSL 1.1.0. -The B<-engine> and B<-engine_impl> options were deprecated in OpenSSL 3.0. +The B<-engine> and B<-engine_impl> options were removed in OpenSSL 4.0. The B<-hmac-env> and B<-hmac-stdin> options were added in OpenSSL 4.0. diff --git a/doc/man1/openssl-dhparam.pod.in b/doc/man1/openssl-dhparam.pod.in index 62ea9d2a43..cc23c2575a 100644 --- a/doc/man1/openssl-dhparam.pod.in +++ b/doc/man1/openssl-dhparam.pod.in @@ -22,7 +22,7 @@ B [B<-2>] [B<-3>] [B<-5>] -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_r_synopsis -} +{- $OpenSSL::safe::opt_r_synopsis -} {- $OpenSSL::safe::opt_provider_synopsis -} [I] @@ -101,8 +101,6 @@ This option inhibits the output of the encoded version of the parameters. This option prints out the DH parameters in human readable form. -{- $OpenSSL::safe::opt_engine_item -} - {- $OpenSSL::safe::opt_r_item -} {- $OpenSSL::safe::opt_provider_item -} @@ -133,10 +131,10 @@ L. =head1 HISTORY -The B<-engine> option was deprecated in OpenSSL 3.0. - The B<-C> option was removed in OpenSSL 3.0. +The B<-engine> option was removed in OpenSSL 4.0. + =head1 COPYRIGHT Copyright 2000-2023 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man1/openssl-dsa.pod.in b/doc/man1/openssl-dsa.pod.in index 116cafd71e..01a82a9409 100644 --- a/doc/man1/openssl-dsa.pod.in +++ b/doc/man1/openssl-dsa.pod.in @@ -39,7 +39,7 @@ B B [B<-pvk-strong>] [B<-pvk-weak>] [B<-pvk-none>] -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_provider_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =head1 DESCRIPTION @@ -137,8 +137,6 @@ Enable 'Weak' PVK encoding level. Don't enforce PVK encoding. -{- $OpenSSL::safe::opt_engine_item -} - {- $OpenSSL::safe::opt_provider_item -} =back @@ -182,7 +180,7 @@ L =head1 HISTORY -The B<-engine> option was deprecated in OpenSSL 3.0. +The B<-engine> option was removed in OpenSSL 4.0. =head1 COPYRIGHT diff --git a/doc/man1/openssl-dsaparam.pod.in b/doc/man1/openssl-dsaparam.pod.in index 68cc83aa63..322c719a6a 100644 --- a/doc/man1/openssl-dsaparam.pod.in +++ b/doc/man1/openssl-dsaparam.pod.in @@ -19,7 +19,7 @@ B [B<-verbose>] [B<-quiet>] {- $OpenSSL::safe::opt_r_synopsis -} -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_provider_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} [I] [I] @@ -90,8 +90,6 @@ be handy during batch scripts and pipelines. {- $OpenSSL::safe::opt_r_item -} -{- $OpenSSL::safe::opt_engine_item -} - =item I This optional argument specifies that a parameter set should be generated of @@ -119,10 +117,10 @@ L =head1 HISTORY -The B<-engine> option was deprecated in OpenSSL 3.0. - The B<-C> option was removed in OpenSSL 3.0. +The B<-engine> option was removed in OpenSSL 4.0. + =head1 COPYRIGHT Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man1/openssl-ec.pod.in b/doc/man1/openssl-ec.pod.in index 51200076a8..a60b796c00 100644 --- a/doc/man1/openssl-ec.pod.in +++ b/doc/man1/openssl-ec.pod.in @@ -13,7 +13,7 @@ openssl-ec - EC key processing B B [B<-help>] -[B<-inform> B|B|B|B] +[B<-inform> B|B|B] [B<-outform> B|B] [B<-in> I|I] [B<-passin> I] @@ -31,7 +31,7 @@ B B [B<-param_enc> I] [B<-no_public>] [B<-check>] -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_provider_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =head1 DESCRIPTION @@ -49,7 +49,7 @@ PKCS#8 private key format use the L command. Print out a usage message. -=item B<-inform> B|B|B|B +=item B<-inform> B|B|B The key input format; unspecified by default. See L for details. @@ -144,8 +144,6 @@ This option omits the public key components from the private key output. This option checks the consistency of an EC private or public key. -{- $OpenSSL::safe::opt_engine_item -} - {- $OpenSSL::safe::opt_provider_item -} =back @@ -192,11 +190,11 @@ L =head1 HISTORY -The B<-engine> option was deprecated in OpenSSL 3.0. - The B<-conv_form> and B<-no_public> options are no longer supported with keys loaded from an engine in OpenSSL 3.0. +The B<-engine> option was removed in OpenSSL 4.0. + =head1 COPYRIGHT Copyright 2003-2023 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man1/openssl-ecparam.pod.in b/doc/man1/openssl-ecparam.pod.in index 27ce10490f..ca4e002762 100644 --- a/doc/man1/openssl-ecparam.pod.in +++ b/doc/man1/openssl-ecparam.pod.in @@ -23,7 +23,7 @@ B [B<-param_enc> I] [B<-no_seed>] [B<-genkey>] -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_r_synopsis -} +{- $OpenSSL::safe::opt_r_synopsis -} {- $OpenSSL::safe::opt_provider_synopsis -} =head1 DESCRIPTION @@ -121,8 +121,6 @@ is included in the ECParameters structure (see RFC 3279). This option will generate an EC private key using the specified parameters. -{- $OpenSSL::safe::opt_engine_item -} - {- $OpenSSL::safe::opt_r_item -} {- $OpenSSL::safe::opt_provider_item -} @@ -172,10 +170,10 @@ L =head1 HISTORY -The B<-engine> option was deprecated in OpenSSL 3.0. - The B<-C> option was removed in OpenSSL 3.0. +The B<-engine> option was removed in OpenSSL 4.0. + =head1 COPYRIGHT Copyright 2003-2021 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man1/openssl-enc.pod.in b/doc/man1/openssl-enc.pod.in index fb4f72ed8a..429ef9abcf 100644 --- a/doc/man1/openssl-enc.pod.in +++ b/doc/man1/openssl-enc.pod.in @@ -41,7 +41,7 @@ B B|I [B<-none>] [B<-skeymgmt> I] [B<-skeyopt> I:I] -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_r_synopsis -} +{- $OpenSSL::safe::opt_r_synopsis -} {- $OpenSSL::safe::opt_provider_synopsis -} B I [B<...>] @@ -241,26 +241,15 @@ any options implying raw key directly or indirectly. {- $OpenSSL::safe::opt_provider_item -} -{- $OpenSSL::safe::opt_engine_item -} - =back =head1 NOTES The program can be called either as C> or -C>. The first form doesn't work with -engine-provided ciphers, because this form is processed before the -configuration file is read and any ENGINEs loaded. +C>. Use the L command to get a list of supported ciphers. -Engines which provide entirely new encryption algorithms (such as the ccgost -engine which provides gost89 algorithm) should be configured in the -configuration file. Engines specified on the command line using B<-engine> -option can only be used for hardware-assisted implementations of -ciphers which are supported by the OpenSSL core or another engine specified -in the configuration file. - -When the enc command lists supported ciphers, ciphers provided by engines, +When the enc command lists supported ciphers, ciphers provided by providers, specified in the configuration files are listed too. A password will be prompted for to derive the key and IV if necessary. @@ -310,11 +299,11 @@ to the output. =head1 SUPPORTED CIPHERS Note that some of these ciphers can be disabled at compile time -and some are available only if an appropriate engine is configured +and some are available only if an appropriate provider is configured in the configuration file. The output when invoking this command with the B<-list> option (that is C) is a list of ciphers, supported by your version of OpenSSL, including -ones provided by configured engines. +ones provided by configured providers. This command does not support authenticated encryption modes like CCM and GCM, and will not support such modes in the future. @@ -380,9 +369,6 @@ In both cases, no IV is needed. See example below. desx DESX algorithm. - gost89 GOST 28147-89 in CFB mode (provided by ccgost engine) - gost89-cnt GOST 28147-89 in CNT mode (provided by ccgost engine) - idea-cbc IDEA algorithm in CBC mode idea same as idea-cbc idea-cfb IDEA in CFB mode @@ -507,12 +493,14 @@ The default digest was changed from MD5 to SHA256 in OpenSSL 1.1.0. The B<-list> option was added in OpenSSL 1.1.1e. -The B<-ciphers> and B<-engine> options were deprecated in OpenSSL 3.0. +The B<-ciphers> option was deprecated in OpenSSL 3.0. The B<-saltlen> option was added in OpenSSL 3.2. The B<-skeymgmt> and B<-skeyopt> options were added in OpenSSL 3.5. +The B<-engine> option was removed in OpenSSL 4.0. + =head1 COPYRIGHT Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man1/openssl-engine.pod.in b/doc/man1/openssl-engine.pod.in deleted file mode 100644 index bcc31ebad1..0000000000 --- a/doc/man1/openssl-engine.pod.in +++ /dev/null @@ -1,132 +0,0 @@ -=pod -{- OpenSSL::safe::output_do_not_edit_headers(); -} - -=head1 NAME - -openssl-engine - load and query engines - -=head1 SYNOPSIS - -B -[B<-help>] -[B<-v>] -[B<-vv>] -[B<-vvv>] -[B<-vvvv>] -[B<-c>] -[B<-t>] -[B<-tt>] -[B<-pre> I] ... -[B<-post> I] ... -[I ...] - -=head1 DESCRIPTION - -This command has been deprecated. Providers should be used instead of engines. - -This command is used to query the status and capabilities -of the specified Is. -Engines may be specified before and after all other command-line flags. -Only those specified are queried. - -=head1 OPTIONS - -=over 4 - -=item B<-help> - -Display an option summary. - -=item B<-v> B<-vv> B<-vvv> B<-vvvv> - -Provides information about each specified engine. The first flag lists -all the possible run-time control commands; the second adds a -description of each command; the third adds the input flags, and the -final option adds the internal input flags. - -=item B<-c> - -Lists the capabilities of each engine. - -=item B<-t> - -Tests if each specified engine is available, and displays the answer. - -=item B<-tt> - -Displays an error trace for any unavailable engine. - -=item B<-pre> I - -=item B<-post> I - -Command-line configuration of engines. -The B<-pre> command is given to the engine before it is loaded and -the B<-post> command is given after the engine is loaded. -The I is of the form I:I where I is the command, -and I is the value for the command. -See the example below. - -These two options are cumulative, so they may be given more than once in the -same command. - -=back - -=head1 EXAMPLES - -To list all the commands available to a dynamic engine: - - $ openssl engine -t -tt -vvvv dynamic - (dynamic) Dynamic engine loading support - [ unavailable ] - SO_PATH: Specifies the path to the new ENGINE shared library - (input flags): STRING - NO_VCHECK: Specifies to continue even if version checking fails (boolean) - (input flags): NUMERIC - ID: Specifies an ENGINE id name for loading - (input flags): STRING - LIST_ADD: Whether to add a loaded ENGINE to the internal list (0=no,1=yes,2=mandatory) - (input flags): NUMERIC - DIR_LOAD: Specifies whether to load from 'DIR_ADD' directories (0=no,1=yes,2=mandatory) - (input flags): NUMERIC - DIR_ADD: Adds a directory from which ENGINEs can be loaded - (input flags): STRING - LOAD: Load up the ENGINE specified by other settings - (input flags): NO_INPUT - -To list the capabilities of the B engine: - - $ openssl engine -c - (rsax) RSAX engine support - [RSA] - (dynamic) Dynamic engine loading support - -=head1 ENVIRONMENT - -=over 4 - -=item B - -The path to the engines directory. - -=back - -=head1 SEE ALSO - -L, -L - -=head1 HISTORY - -This command was deprecated in OpenSSL 3.0. - -=head1 COPYRIGHT - -Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved. - -Licensed under the Apache License 2.0 (the "License"). You may not use -this file except in compliance with the License. You can obtain a copy -in the file LICENSE in the source distribution or at -L. - -=cut diff --git a/doc/man1/openssl-format-options.pod b/doc/man1/openssl-format-options.pod index a9bd1d6971..b85b34a682 100644 --- a/doc/man1/openssl-format-options.pod +++ b/doc/man1/openssl-format-options.pod @@ -22,11 +22,6 @@ format is no more needed and the openssl commands will automatically try all the possible formats. However if the B or B input format is specified it will be enforced. -In order to access a key via an engine the input format B may be used; -alternatively the key identifier in the argument of the respective key -option may be preceded by C. -See L for an example usage of the latter. - =head1 OPTIONS =head2 Format Options @@ -65,12 +60,6 @@ is described in each command documentation. A binary format, encoded or parsed according to Distinguished Encoding Rules (DER) of the ASN.1 data language. -=item B - -Used to specify that the cryptographic material is in an OpenSSL B. -An engine must be configured or specified using the B<-engine> option. -A password or PIN may be supplied to the engine using the B<-passin> option. - =item B A DER-encoded file containing a PKCS#12 object. diff --git a/doc/man1/openssl-gendsa.pod.in b/doc/man1/openssl-gendsa.pod.in index cfbb305eb3..a546b8b725 100644 --- a/doc/man1/openssl-gendsa.pod.in +++ b/doc/man1/openssl-gendsa.pod.in @@ -26,7 +26,7 @@ B B [B<-verbose>] [B<-quiet>] {- $OpenSSL::safe::opt_r_synopsis -} -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_provider_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} [I] =head1 DESCRIPTION @@ -71,8 +71,6 @@ be handy during batch scripts and pipelines. {- $OpenSSL::safe::opt_r_item -} -{- $OpenSSL::safe::opt_engine_item -} - =item I The DSA parameter file to use. The parameters in this file determine @@ -99,7 +97,7 @@ L =head1 HISTORY -The B<-engine> option was deprecated in OpenSSL 3.0. +The B<-engine> option was removed in OpenSSL 4.0. =head1 COPYRIGHT diff --git a/doc/man1/openssl-genpkey.pod.in b/doc/man1/openssl-genpkey.pod.in index 9824aa7a84..76fc3ac134 100644 --- a/doc/man1/openssl-genpkey.pod.in +++ b/doc/man1/openssl-genpkey.pod.in @@ -26,7 +26,6 @@ B B [B<-genparam>] [B<-text>] {- $OpenSSL::safe::opt_r_synopsis -} -{- $OpenSSL::safe::opt_engine_synopsis -} {- $OpenSSL::safe::opt_provider_synopsis -} {- $OpenSSL::safe::opt_config_synopsis -} @@ -83,7 +82,7 @@ algorithm with a 128-bit key in CBC mode. Public key algorithm to use such as RSA, DSA, DH or DHX. If used this option must precede any B<-pkeyopt> options. The options B<-paramfile> and B<-algorithm> -are mutually exclusive. Engines or providers may add algorithms in addition to +are mutually exclusive. Providers may add algorithms in addition to the standard built-in ones. Valid built-in algorithm names for private key generation are RSA, RSA-PSS, EC, @@ -125,8 +124,6 @@ parameters along with the PEM or DER structure. {- $OpenSSL::safe::opt_r_item -} -{- $OpenSSL::safe::opt_engine_item -} - {- $OpenSSL::safe::opt_provider_item -} {- $OpenSSL::safe::opt_config_item -} @@ -441,7 +438,7 @@ L above. =head1 NOTES The use of the genpkey program is encouraged over the algorithm specific -utilities because additional algorithm options and ENGINE provided algorithms +utilities because additional algorithm options and provider provided algorithms can be used. =head1 EXAMPLES @@ -552,10 +549,10 @@ were added in OpenSSL 1.0.2. The ability to generate X25519 keys was added in OpenSSL 1.1.0. The ability to generate X448, ED25519 and ED448 keys was added in OpenSSL 1.1.1. -The B<-engine> option was deprecated in OpenSSL 3.0. - Support for B and B was added in OpenSSL 3.5. +The B<-engine> option was removed in OpenSSL 4.0. + =head1 COPYRIGHT Copyright 2006-2025 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man1/openssl-genrsa.pod.in b/doc/man1/openssl-genrsa.pod.in index c75d52ceae..374301e181 100644 --- a/doc/man1/openssl-genrsa.pod.in +++ b/doc/man1/openssl-genrsa.pod.in @@ -31,7 +31,7 @@ B B [B<-quiet>] [B<-traditional>] {- $OpenSSL::safe::opt_r_synopsis -} -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_provider_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} [B] =head1 DESCRIPTION @@ -90,8 +90,6 @@ Write the key using the traditional PKCS#1 format instead of the PKCS#8 format. {- $OpenSSL::safe::opt_r_item -} -{- $OpenSSL::safe::opt_engine_item -} - {- $OpenSSL::safe::opt_provider_item -} =item B @@ -121,6 +119,10 @@ L, L, L +=head1 HISTORY + +The B<-engine> option was removed in OpenSSL 4.0. + =head1 COPYRIGHT Copyright 2000-2023 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man1/openssl-info.pod.in b/doc/man1/openssl-info.pod.in index ac3a36d54c..33618874dd 100644 --- a/doc/man1/openssl-info.pod.in +++ b/doc/man1/openssl-info.pod.in @@ -10,7 +10,6 @@ openssl-info - print OpenSSL built-in information B [B<-help>] [B<-configdir>] -[B<-enginesdir>] [B<-modulesdir> ] [B<-dsoext>] [B<-dirnamesep>] @@ -40,14 +39,9 @@ Print out a usage message. Outputs the default directory for OpenSSL configuration files. -=item B<-enginesdir> - -Outputs the default directory for OpenSSL engine modules. - =item B<-modulesdir> -Outputs the default directory for OpenSSL dynamically loadable modules -other than engine modules. +Outputs the default directory for OpenSSL dynamically loadable modules. =item B<-dsoext> @@ -86,6 +80,8 @@ This command was added in OpenSSL 3.0. The B<-windowscontext> option was added in OpenSSL 3.4. +The B<-enginesdir> option was removed in OpenSSL 4.0. + =head1 COPYRIGHT Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man1/openssl-list.pod.in b/doc/man1/openssl-list.pod.in index dce292a3f5..9159eebd80 100644 --- a/doc/man1/openssl-list.pod.in +++ b/doc/man1/openssl-list.pod.in @@ -44,8 +44,6 @@ B [B<-public-key-methods>] [B<-store-loaders>] [B<-providers>] -{- output_off() if $disabled{"deprecated-3.0"}; "" --}[B<-engines>] {- output_on() if $disabled{"deprecated-3.0"}; "" -}[B<-disabled>] [B<-objects>] @@ -251,13 +249,6 @@ Display a list of all loaded providers with their names, version and status. In verbose mode, the full version and all provider parameters will additionally be displayed. - -=item B<-engines> - -This option is deprecated. - -Display a list of loaded engines. - =item B<-disabled> Display a list of disabled features, those that were compiled out @@ -309,11 +300,13 @@ In both cases, C is the name of the provider. =head1 HISTORY -The B<-engines>, B<-digest-commands>, and B<-cipher-commands> options +The B<-digest-commands>, and B<-cipher-commands> options were deprecated in OpenSSL 3.0. The B<-skey-managers> option was added in OpenSSL 3.5. +The B<-engines> option was removed in OpenSSL 4.0. + =head1 COPYRIGHT Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man1/openssl-pkcs12.pod.in b/doc/man1/openssl-pkcs12.pod.in index de2672537d..1f153bd326 100644 --- a/doc/man1/openssl-pkcs12.pod.in +++ b/doc/man1/openssl-pkcs12.pod.in @@ -21,7 +21,7 @@ B B [B<-nocerts>] [B<-noout>] [B<-legacy>] -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_provider_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} {- $OpenSSL::safe::opt_r_synopsis -} PKCS#12 input (parsing) options: @@ -153,8 +153,6 @@ If the legacy option is not specified, then the legacy provider is not loaded and the default encryption algorithm for both certificates and private keys is AES_256_CBC with PBKDF2 for key derivation. -{- $OpenSSL::safe::opt_engine_item -} - {- $OpenSSL::safe::opt_provider_item -} {- $OpenSSL::safe::opt_r_item -} @@ -247,20 +245,16 @@ by default. This specifies the input filename or URI. Standard input is used by default. -With the B<-export> option this is a file with certificates and a key, -or a URI that refers to a key accessed via an engine. +With the B<-export> option this is a file with certificates and a key. The order of credentials in a file doesn't matter but one private key and its corresponding certificate should be present. If additional certificates are present they will also be included in the PKCS#12 output file. =item B<-inkey> I|I -The private key input for PKCS12 output. +The input filename for the private key for PKCS12 output. If this option is not specified then the input file (B<-in> argument) must contain a private key. -If no engine is used, the argument is taken as a file. -If the B<-engine> option is used or the URI has prefix C -then the rest of the URI is taken as key identifier for the given engine. =item B<-certfile> I @@ -485,10 +479,11 @@ L =head1 HISTORY -The B<-engine> option was deprecated in OpenSSL 3.0. The B<-nodes> option was deprecated in OpenSSL 3.0, too; use B<-noenc> instead. The B<-macsaltlen> option default changed from 8 to 16 bytes in OpenSSL 3.6. +The B<-engine> option was removed in OpenSSL 4.0. + =head1 COPYRIGHT Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man1/openssl-pkcs7.pod.in b/doc/man1/openssl-pkcs7.pod.in index 412c7592d9..d86b6a3400 100644 --- a/doc/man1/openssl-pkcs7.pod.in +++ b/doc/man1/openssl-pkcs7.pod.in @@ -22,7 +22,7 @@ B B [B<-quiet>] [B<-text>] [B<-noout>] -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_provider_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =head1 DESCRIPTION @@ -79,8 +79,6 @@ issuer names. Don't output the encoded version of the PKCS#7 structure (or certificates if B<-print_certs> is set). -{- $OpenSSL::safe::opt_engine_item -} - {- $OpenSSL::safe::opt_provider_item -} =back @@ -102,7 +100,7 @@ L =head1 HISTORY -The B<-engine> option was deprecated in OpenSSL 3.0. +The B<-engine> option was removed in OpenSSL 4.0. =head1 COPYRIGHT diff --git a/doc/man1/openssl-pkcs8.pod.in b/doc/man1/openssl-pkcs8.pod.in index 72ab63a058..e2356b4aea 100644 --- a/doc/man1/openssl-pkcs8.pod.in +++ b/doc/man1/openssl-pkcs8.pod.in @@ -29,7 +29,7 @@ B B [B<-scrypt_p> I

] [B<-saltlen> I] {- $OpenSSL::safe::opt_r_synopsis -} -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_provider_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =head1 DESCRIPTION @@ -161,8 +161,6 @@ and 8 (64 bits) for PBES1. {- $OpenSSL::safe::opt_r_item -} -{- $OpenSSL::safe::opt_engine_item -} - {- $OpenSSL::safe::opt_provider_item -} =back @@ -285,7 +283,7 @@ L The B<-iter> option was added in OpenSSL 1.1.0. -The B<-engine> option was deprecated in OpenSSL 3.0. +The B<-engine> option was removed in OpenSSL 4.0. =head1 COPYRIGHT diff --git a/doc/man1/openssl-pkey.pod.in b/doc/man1/openssl-pkey.pod.in index 64e28bcada..238d0c812a 100644 --- a/doc/man1/openssl-pkey.pod.in +++ b/doc/man1/openssl-pkey.pod.in @@ -13,11 +13,11 @@ openssl-pkey - public or private key processing command B B [B<-help>] -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_provider_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} [B<-check>] [B<-pubcheck>] [B<-in> I|I] -[B<-inform> B|B|B|B] +[B<-inform> B|B|B] [B<-passin> I] [B<-pubin>] [B<-out> I] @@ -47,8 +47,6 @@ converted between various forms and their components printed. Print out a usage message. -{- $OpenSSL::safe::opt_engine_item -} - {- $OpenSSL::safe::opt_provider_item -} =item B<-check> @@ -75,7 +73,7 @@ or standard input if this option is not specified. If the key input is encrypted and B<-passin> is not given a pass phrase will be prompted for. -=item B<-inform> B|B|B|B +=item B<-inform> B|B|B The key input format; unspecified by default. See L for details. @@ -230,7 +228,7 @@ L =head1 HISTORY -The B<-engine> option was deprecated in OpenSSL 3.0. +The B<-engine> option was removed in OpenSSL 4.0. =head1 COPYRIGHT diff --git a/doc/man1/openssl-pkeyparam.pod.in b/doc/man1/openssl-pkeyparam.pod.in index b8b1792f28..13d97f5dc0 100644 --- a/doc/man1/openssl-pkeyparam.pod.in +++ b/doc/man1/openssl-pkeyparam.pod.in @@ -18,7 +18,7 @@ B B [B<-text>] [B<-noout>] [B<-check>] -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_provider_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =head1 DESCRIPTION @@ -58,8 +58,6 @@ Do not output the encoded version of the parameters. This option checks the correctness of parameters. -{- $OpenSSL::safe::opt_engine_item -} - {- $OpenSSL::safe::opt_provider_item -} =back @@ -87,7 +85,7 @@ L =head1 HISTORY -The B<-engine> option was deprecated in OpenSSL 3.0. +The B<-engine> option was removed in OpenSSL 4.0. =head1 COPYRIGHT diff --git a/doc/man1/openssl-pkeyutl.pod.in b/doc/man1/openssl-pkeyutl.pod.in index c5fb8378e8..750455c995 100644 --- a/doc/man1/openssl-pkeyutl.pod.in +++ b/doc/man1/openssl-pkeyutl.pod.in @@ -16,7 +16,7 @@ B B [B<-secret> I] [B<-sigfile> I] [B<-inkey> I|I] -[B<-keyform> B|B|B|B] +[B<-keyform> B|B|B] [B<-passin> I] [B<-pubin>] [B<-certin>] @@ -28,7 +28,7 @@ B B [B<-decrypt>] [B<-derive>] [B<-peerkey> I] -[B<-peerform> B|B|B|B] +[B<-peerform> B|B|B] [B<-encap>] [B<-decap>] [B<-kdf> I] @@ -38,7 +38,6 @@ B B [B<-pkeyopt_passin> I[:I]] [B<-hexdump>] [B<-asn1parse>] -{- $OpenSSL::safe::opt_engine_synopsis -}[B<-engine_impl>] {- $OpenSSL::safe::opt_r_synopsis -} {- $OpenSSL::safe::opt_provider_synopsis -} {- $OpenSSL::safe::opt_config_synopsis -} @@ -113,7 +112,7 @@ Signature file, required and allowed for B<-verify> operations only. The input key, by default it should be a private key. -=item B<-keyform> B|B|B|B +=item B<-keyform> B|B|B The key format; unspecified by default. See L for details. @@ -191,7 +190,7 @@ File containing the peer public or private (EC)DH key to use with the key derivation (agreement) operation. Its type must match the type of the own private key given with B<-inkey>. -=item B<-peerform> B|B|B|B +=item B<-peerform> B|B|B The peer key format; unspecified by default. See L for details. @@ -284,15 +283,6 @@ When combined with the B<-verifyrecover> option, this may be useful in case an ASN.1 DER-encoded structure had been signed directly (without hashing it) and when checking a signature in PKCS#1 v1.5 format, which has a DER encoding. -{- $OpenSSL::safe::opt_engine_item -} - -{- output_off() if $disabled{"deprecated-3.0"}; "" -} -=item B<-engine_impl> - -When used with the B<-engine> option, it specifies to also use -engine I for crypto operations. -{- output_on() if $disabled{"deprecated-3.0"}; "" -} - {- $OpenSSL::safe::opt_r_item -} {- $OpenSSL::safe::opt_provider_item -} @@ -689,7 +679,7 @@ no longer required when signing or verifying with an Ed25519 or Ed448 key. Also since OpenSSL 3.5, the B<-kemop> option is no longer required for any of the supported algorithms, the only supported B is now the default. -The B<-engine> option was deprecated in OpenSSL 3.0. +The B<-engine> option was removed in OpenSSL 4.0. =head1 COPYRIGHT diff --git a/doc/man1/openssl-rand.pod.in b/doc/man1/openssl-rand.pod.in index 7c07df3f14..d38961acc3 100644 --- a/doc/man1/openssl-rand.pod.in +++ b/doc/man1/openssl-rand.pod.in @@ -12,7 +12,7 @@ B [B<-out> I] [B<-base64>] [B<-hex>] -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_r_synopsis -} +{- $OpenSSL::safe::opt_r_synopsis -} {- $OpenSSL::safe::opt_provider_synopsis -} I[K|M|G|T] @@ -55,8 +55,6 @@ Perform base64 encoding on the output. Show the output as a hex string. -{- $OpenSSL::safe::opt_engine_item -} - {- $OpenSSL::safe::opt_r_item -} {- $OpenSSL::safe::opt_provider_item -} @@ -72,7 +70,7 @@ L =head1 HISTORY -The B<-engine> option was deprecated in OpenSSL 3.0. +The B<-engine> option was removed in OpenSSL 4.0. =head1 COPYRIGHT diff --git a/doc/man1/openssl-req.pod.in b/doc/man1/openssl-req.pod.in index 97a4a5b01c..8e3dea6a2c 100644 --- a/doc/man1/openssl-req.pod.in +++ b/doc/man1/openssl-req.pod.in @@ -27,9 +27,8 @@ B B [B<-noenc>] [B<-nodes>] [B<-key> I|I] -[B<-keyform> B|B|B|B] +[B<-keyform> B|B|B] [B<-keyout> I] -[B<-keygen_engine> I] [B<-I>] [B<-config> I] [B<-section> I] @@ -59,7 +58,7 @@ B B [B<-quiet>] {- $OpenSSL::safe::opt_name_synopsis -} {- $OpenSSL::safe::opt_r_synopsis -} -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_provider_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =head1 DESCRIPTION @@ -203,10 +202,7 @@ any necessary parameters should be specified via the B<-pkeyopt> option. BI generates a DSA key using the parameters in the file I. BI generates EC key (usable both with -ECDSA or ECDH algorithms), BI generates GOST R -34.10-2001 key (requires B engine configured in the configuration -file). If just B is specified a parameter set should be -specified by B<-pkeyopt> I +ECDSA or ECDH algorithms). =item B<-pkeyopt> I:I @@ -226,7 +222,7 @@ For certificate signing this option is overridden by the B<-CA> option. This option also accepts PKCS#8 format private keys for PEM format files. -=item B<-keyform> B|B|B|B +=item B<-keyform> B|B|B The format of the private key; unspecified by default. See L for details. @@ -449,17 +445,10 @@ Print fewer details about the operations being performed, which may be handy during batch scripts or pipelines (specifically "progress dots" during key generation are suppressed). -=item B<-keygen_engine> I - -Specifies an engine (by its unique I string) which would be used -for key generation operations. - {- $OpenSSL::safe::opt_name_item -} {- $OpenSSL::safe::opt_r_item -} -{- $OpenSSL::safe::opt_engine_item -} - {- $OpenSSL::safe::opt_provider_item -} =back @@ -842,8 +831,7 @@ The B<-section> option was added in OpenSSL 3.0.0. The B<-multivalue-rdn> option has become obsolete in OpenSSL 3.0.0 and has no effect. -The B<-engine> option was deprecated in OpenSSL 3.0. -The <-nodes> option was deprecated in OpenSSL 3.0, too; use B<-noenc> instead. +The <-nodes> option was deprecated in OpenSSL 3.0; use B<-noenc> instead. The B<-reqexts> option has been made an alias of B<-extensions> in OpenSSL 3.2. @@ -853,6 +841,8 @@ and key identifier extensions are included by default. Since OpenSSL 3.3, the B<-verify> option will exit with 1 on failure. +The B<-engine> option was removed in OpenSSL 4.0. + =head1 COPYRIGHT Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man1/openssl-rsa.pod.in b/doc/man1/openssl-rsa.pod.in index faa4872e19..b06a05b602 100644 --- a/doc/man1/openssl-rsa.pod.in +++ b/doc/man1/openssl-rsa.pod.in @@ -13,7 +13,7 @@ openssl-rsa - RSA key processing command B B [B<-help>] -[B<-inform> B|B|B|B] +[B<-inform> B|B|B] [B<-outform> B|B] [B<-in> I|I] [B<-passin> I] @@ -43,7 +43,7 @@ B B [B<-pvk-strong>] [B<-pvk-weak>] [B<-pvk-none>] -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_provider_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =head1 DESCRIPTION @@ -58,7 +58,7 @@ various forms and their components printed out. Print out a usage message. -=item B<-inform> B|B|B|B +=item B<-inform> B|B|B The key input format; unspecified by default. See L for details. @@ -147,8 +147,6 @@ Enable 'Weak' PVK encoding level. Don't enforce PVK encoding. -{- $OpenSSL::safe::opt_engine_item -} - {- $OpenSSL::safe::opt_provider_item -} =back @@ -203,7 +201,7 @@ L =head1 HISTORY -The B<-engine> option was deprecated in OpenSSL 3.0. +The B<-engine> option was removed in OpenSSL 4.0. =head1 COPYRIGHT diff --git a/doc/man1/openssl-rsautl.pod.in b/doc/man1/openssl-rsautl.pod.in index 41d0d309dd..677daf0f09 100644 --- a/doc/man1/openssl-rsautl.pod.in +++ b/doc/man1/openssl-rsautl.pod.in @@ -14,7 +14,7 @@ B B [B<-rev>] [B<-out> I] [B<-inkey> I|I] -[B<-keyform> B|B|B|B] +[B<-keyform> B|B|B] [B<-pubin>] [B<-certin>] [B<-sign>] @@ -27,7 +27,7 @@ B B [B<-raw>] [B<-hexdump>] [B<-asn1parse>] -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_r_synopsis -} +{- $OpenSSL::safe::opt_r_synopsis -} {- $OpenSSL::safe::opt_provider_synopsis -} =head1 DESCRIPTION @@ -69,7 +69,7 @@ default. The input key, by default it should be an RSA private key. -=item B<-keyform> B|B|B|B +=item B<-keyform> B|B|B The key format; unspecified by default. See L for details. @@ -121,8 +121,6 @@ Hex dump the output data. Parse the ASN.1 output data, this is useful when combined with the B<-verify> option. -{- $OpenSSL::safe::opt_engine_item -} - {- $OpenSSL::safe::opt_r_item -} {- $OpenSSL::safe::opt_provider_item -} @@ -235,7 +233,7 @@ L This command was deprecated in OpenSSL 3.0. -The B<-engine> option was deprecated in OpenSSL 3.0. +The B<-engine> option was removed in OpenSSL 4.0. =head1 COPYRIGHT diff --git a/doc/man1/openssl-s_client.pod.in b/doc/man1/openssl-s_client.pod.in index 4c0759ab0f..bc2d3c822f 100644 --- a/doc/man1/openssl-s_client.pod.in +++ b/doc/man1/openssl-s_client.pod.in @@ -37,7 +37,7 @@ B B [B<-CRLform> B|B] [B<-crl_download>] [B<-key> I|I] -[B<-keyform> B|B|B|B] +[B<-keyform> B|B|B] [B<-pass> I] [B<-chainCAfile> I] [B<-chainCApath> I] @@ -119,7 +119,6 @@ B B {- $OpenSSL::safe::opt_s_synopsis -} {- $OpenSSL::safe::opt_r_synopsis -} {- $OpenSSL::safe::opt_provider_synopsis -} -{- $OpenSSL::safe::opt_engine_synopsis -}[B<-ssl_client_engine> I] {- $OpenSSL::safe::opt_v_synopsis -} [B<-enable_server_rpk>] [B<-enable_client_rpk>] @@ -274,7 +273,7 @@ of CRL is limited by L function. The client private key to use. If not specified then the certificate file will be used to read also the key. -=item B<-keyform> B|B|B|B +=item B<-keyform> B|B|B The key format; unspecified by default. See L for details. @@ -559,9 +558,8 @@ Send TLS_FALLBACK_SCSV in the ClientHello. =item B<-async> Switch on asynchronous mode. Cryptographic operations will be performed -asynchronously. This will only have an effect if an asynchronous capable engine -is also used via the B<-engine> option. For test purposes the dummy async engine -(dasync) can be used (if available). +asynchronously. This will only have an effect if an asynchronous capable +provider is also used. =item B<-maxfraglen> I @@ -575,19 +573,15 @@ See L for further information. =item B<-split_send_frag> I -The size used to split data for encrypt pipelines. If more data is written in -one go than this value then it will be split into multiple pipelines, up to the -maximum number of pipelines defined by max_pipelines. This only has an effect if -a suitable cipher suite has been negotiated, an engine that supports pipelining -has been loaded, and max_pipelines is greater than 1. See -L for further information. +This is used for pipelines. There is currently B for cipher +pipelining in libssl. See L for further +information. =item B<-max_pipelines> I -The maximum number of encrypt/decrypt pipelines to be used. This will only have -an effect if an engine has been loaded that supports pipelining (e.g. the dasync -engine) and a suitable cipher suite has been negotiated. The default value is 1. -See L for further information. +This is used for pipelines. There is currently B for cipher +pipelining in libssl. See L for further +information. =item B<-read_buf> I @@ -785,14 +779,6 @@ Enable creation of connections via TCP fast open (RFC7413). {- $OpenSSL::safe::opt_provider_item -} -{- $OpenSSL::safe::opt_engine_item -} - -{- output_off() if $disabled{"deprecated-3.0"}; "" -} -=item B<-ssl_client_engine> I - -Specify engine to be used for client certificate operations. -{- output_on() if $disabled{"deprecated-3.0"}; "" -} - {- $OpenSSL::safe::opt_v_item -} Verification errors are displayed, for debugging, but the command will @@ -1033,7 +1019,7 @@ The B<-name> option was added in OpenSSL 1.1.1. The B<-certform> option has become obsolete in OpenSSL 3.0.0 and has no effect. -The B<-engine> option was deprecated in OpenSSL 3.0. +The B<-engine> option was removed in OpenSSL 4.0. The B<-enable_client_rpk>, diff --git a/doc/man1/openssl-s_server.pod.in b/doc/man1/openssl-s_server.pod.in index 4c30c9c628..dbf6a30da4 100644 --- a/doc/man1/openssl-s_server.pod.in +++ b/doc/man1/openssl-s_server.pod.in @@ -28,13 +28,13 @@ B B [B<-serverinfo> I] [B<-key> I|I] [B<-key2> I|I] -[B<-keyform> B|B|B|B] +[B<-keyform> B|B|B] [B<-pass> I] [B<-dcert> I] [B<-dcertform> B|B|B] [B<-dcert_chain> I] [B<-dkey> I|I] -[B<-dkeyform> B|B|B|B] +[B<-dkeyform> B|B|B] [B<-dpass> I] [B<-nbio_test>] [B<-crlf>] @@ -132,7 +132,7 @@ B B {- $OpenSSL::safe::opt_x_synopsis -} {- $OpenSSL::safe::opt_trust_synopsis -} {- $OpenSSL::safe::opt_r_synopsis -} -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_provider_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} [B<-enable_server_rpk>] [B<-enable_client_rpk>] @@ -243,7 +243,7 @@ be used. The private Key file to use for servername if not given via B<-cert2>. -=item B<-keyform> B|B|B|B +=item B<-keyform> B|B|B The key format; unspecified by default. See L for details. @@ -277,7 +277,7 @@ The input can be in PEM, DER, or PKCS#12 format. The format of the additional certificate file; unspecified by default. See L for details. -=item B<-dkeyform> B|B|B|B +=item B<-dkeyform> B|B|B The format of the additional private key; unspecified by default. See L for details. @@ -563,9 +563,8 @@ Cannot be used in conjunction with B<-early_data>. =item B<-async> Switch on asynchronous mode. Cryptographic operations will be performed -asynchronously. This will only have an effect if an asynchronous capable engine -is also used via the B<-engine> option. For test purposes the dummy async engine -(dasync) can be used (if available). +asynchronously. This will only have an effect if an asynchronous capable +provider is also used via the B<-provider> option. =item B<-max_send_frag> I<+int> @@ -574,19 +573,15 @@ See L for further information. =item B<-split_send_frag> I<+int> -The size used to split data for encrypt pipelines. If more data is written in -one go than this value then it will be split into multiple pipelines, up to the -maximum number of pipelines defined by max_pipelines. This only has an effect if -a suitable cipher suite has been negotiated, an engine that supports pipelining -has been loaded, and max_pipelines is greater than 1. See -L for further information. +This is used for pipelines. There is currently B for cipher +pipelining in libssl. See L for further +information. =item B<-max_pipelines> I<+int> -The maximum number of encrypt/decrypt pipelines to be used. This will only have -an effect if an engine has been loaded that supports pipelining (e.g. the dasync -engine) and a suitable cipher suite has been negotiated. The default value is 1. -See L for further information. +This is used for pipelines. There is currently B for cipher +pipelining in libssl. See L for further +information. =item B<-naccept> I<+int> @@ -794,8 +789,6 @@ Pre-compresses certificates (RFC8879) that will be sent during the handshake. {- $OpenSSL::safe::opt_r_item -} -{- $OpenSSL::safe::opt_engine_item -} - {- $OpenSSL::safe::opt_provider_item -} {- $OpenSSL::safe::opt_v_item -} @@ -925,7 +918,7 @@ The -no_alt_chains option was added in OpenSSL 1.1.0. The -allow-no-dhe-kex and -prioritize_chacha options were added in OpenSSL 1.1.1. -The B<-srpvfile>, B<-srpuserseed>, and B<-engine> +The B<-srpvfile> and B<-srpuserseed> option were deprecated in OpenSSL 3.0. The @@ -938,6 +931,8 @@ options were added in OpenSSL 3.2. The B<-status_all> option was added in OpenSSL 3.6. +The B option was removed in OpenSSL 4.0. + =head1 COPYRIGHT Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man1/openssl-smime.pod.in b/doc/man1/openssl-smime.pod.in index 0a8fe01366..061f1f23fb 100644 --- a/doc/man1/openssl-smime.pod.in +++ b/doc/man1/openssl-smime.pod.in @@ -32,7 +32,7 @@ B B [B<-recip> I< file>] [B<-inform> B|B|B] [B<-outform> B|B|B] -[B<-keyform> B|B|B|B] +[B<-keyform> B|B|B] [B<-passin> I] [B<-inkey> I|I] [B<-out> I] @@ -46,7 +46,7 @@ B B [B<-stream>] [B<-md> I] {- $OpenSSL::safe::opt_trust_synopsis -} -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_r_synopsis -} +{- $OpenSSL::safe::opt_r_synopsis -} {- $OpenSSL::safe::opt_v_synopsis -} {- $OpenSSL::safe::opt_provider_synopsis -} {- $OpenSSL::safe::opt_config_synopsis -} @@ -125,7 +125,7 @@ The output format of the PKCS#7 (S/MIME) structure (if one is being written); the default is B. See L for details. -=item B<-keyform> B|B|B|B +=item B<-keyform> B|B|B The key format; unspecified by default. See L for details. @@ -277,8 +277,6 @@ Any verification errors cause the command to exit. {- $OpenSSL::safe::opt_trust_item -} -{- $OpenSSL::safe::opt_engine_item -} - {- $OpenSSL::safe::opt_r_item -} {- $OpenSSL::safe::opt_provider_item -} @@ -475,7 +473,7 @@ added in OpenSSL 1.0.0 The -no_alt_chains option was added in OpenSSL 1.1.0. -The B<-engine> option was deprecated in OpenSSL 3.0. +The B<-engine> option was removed in OpenSSL 4.0. =head1 COPYRIGHT diff --git a/doc/man1/openssl-speed.pod.in b/doc/man1/openssl-speed.pod.in index 83a35bb52b..8862827777 100644 --- a/doc/man1/openssl-speed.pod.in +++ b/doc/man1/openssl-speed.pod.in @@ -29,7 +29,7 @@ B [B<-mlock>] [B<-testmode>] {- $OpenSSL::safe::opt_r_synopsis -} -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_provider_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} [I ...] =head1 DESCRIPTION @@ -53,8 +53,7 @@ see L. =item B<-elapsed> When calculating operations- or bytes-per-second, use wall-clock time -instead of CPU user time as divisor. It can be useful when testing speed -of hardware engines. +instead of CPU user time as divisor. =item B<-evp> I @@ -139,8 +138,6 @@ the speed command will return with a failure result. {- $OpenSSL::safe::opt_r_item -} -{- $OpenSSL::safe::opt_engine_item -} - {- $OpenSSL::safe::opt_provider_item -} =item I ... @@ -167,6 +164,8 @@ DSA512 was removed in OpenSSL 3.2. The B<-testmode> option was added in OpenSSL 3.4. +The B<-engine> option was removed in OpenSSL 4.0. + =head1 COPYRIGHT Copyright 2000-2024 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man1/openssl-spkac.pod.in b/doc/man1/openssl-spkac.pod.in index 5e55a7498b..53f12400dc 100644 --- a/doc/man1/openssl-spkac.pod.in +++ b/doc/man1/openssl-spkac.pod.in @@ -17,7 +17,7 @@ B B [B<-out> I] [B<-digest> I] [B<-key> I|I] -[B<-keyform> B|B|B|B] +[B<-keyform> B|B|B] [B<-passin> I] [B<-challenge> I] [B<-pubkey>] @@ -25,7 +25,7 @@ B B [B<-spksect> I

] [B<-noout>] [B<-verify>] -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_provider_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =head1 DESCRIPTION @@ -62,7 +62,7 @@ Create an SPKAC file using the private key specified by I or I. The B<-in>, B<-noout>, B<-spksect> and B<-verify> options are ignored if present. -=item B<-keyform> B|B|B|B +=item B<-keyform> B|B|B The key format; unspecified by default. See L for details. @@ -101,8 +101,6 @@ being created). Verifies the digital signature on the supplied SPKAC. -{- $OpenSSL::safe::opt_engine_item -} - {- $OpenSSL::safe::opt_provider_item -} =back @@ -153,10 +151,10 @@ L =head1 HISTORY -The B<-engine> option was deprecated in OpenSSL 3.0. - The B<-digest> option was added in OpenSSL 3.0. +The B<-engine> option was removed in OpenSSL 4.0. + =head1 COPYRIGHT Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man1/openssl-srp.pod.in b/doc/man1/openssl-srp.pod.in index 26f7ebcef9..87f54cf381 100644 --- a/doc/man1/openssl-srp.pod.in +++ b/doc/man1/openssl-srp.pod.in @@ -20,7 +20,7 @@ B [B<-userinfo> I] [B<-passin> I] [B<-passout> I] -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_r_synopsis -} +{- $OpenSSL::safe::opt_r_synopsis -} {- $OpenSSL::safe::opt_provider_synopsis -} {- $OpenSSL::safe::opt_config_synopsis -} [I ...] @@ -90,8 +90,6 @@ The password source for the input and output file. For more information about the format of B see L. -{- $OpenSSL::safe::opt_engine_item -} - {- $OpenSSL::safe::opt_r_item -} {- $OpenSSL::safe::opt_provider_item -} @@ -104,7 +102,7 @@ see L. =head1 HISTORY -The B<-engine> option was deprecated in OpenSSL 3.0. +The B<-engine> option was removed in OpenSSL 4.0. =head1 COPYRIGHT diff --git a/doc/man1/openssl-storeutl.pod.in b/doc/man1/openssl-storeutl.pod.in index 75acb07743..38dd1df645 100644 --- a/doc/man1/openssl-storeutl.pod.in +++ b/doc/man1/openssl-storeutl.pod.in @@ -27,7 +27,7 @@ B B [B<-alias> I] [B<-fingerprint> I] [B<-I>] -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_provider_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} I =head1 DESCRIPTION @@ -124,8 +124,6 @@ Search for an object having the given fingerprint. The digest that was used to compute the fingerprint given with B<-fingerprint>. -{- $OpenSSL::safe::opt_engine_item -} - {- $OpenSSL::safe::opt_provider_item -} =back @@ -138,7 +136,7 @@ L This command was added in OpenSSL 1.1.1. -The B<-engine> option was deprecated in OpenSSL 3.0. +The B<-engine> option was removed in OpenSSL 4.0. =head1 COPYRIGHT diff --git a/doc/man1/openssl-ts.pod.in b/doc/man1/openssl-ts.pod.in index 202f218f31..d7493f6bb2 100644 --- a/doc/man1/openssl-ts.pod.in +++ b/doc/man1/openssl-ts.pod.in @@ -43,7 +43,7 @@ B<-reply> [B<-out> I] [B<-token_out>] [B<-text>] -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_provider_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} B B B<-verify> @@ -295,8 +295,6 @@ response (TimeStampResp). (Optional) If this option is specified the output is human-readable text format instead of DER. (Optional) -{- $OpenSSL::safe::opt_engine_item -} - {- $OpenSSL::safe::opt_provider_item -} =back @@ -407,13 +405,6 @@ last timestamp response created. This number is incremented by 1 for each response. If the file does not exist at the time of response generation a new file is created with serial number 1. (Mandatory) -=item B - -Specifies the OpenSSL engine that will be set as the default for -all available algorithms. The default value is built-in, you can specify -any other engines supported by OpenSSL (e.g. use chil for the NCipher HSM). -(Optional) - =item B TSA signing certificate in PEM format. The same as the B<-signer> @@ -641,7 +632,8 @@ seeding mechanism. The new seeding mechanism makes it unnecessary to define a RANDFILE for saving and restoring randomness. This option is retained mainly for compatibility reasons. -The B<-engine> option was deprecated in OpenSSL 3.0. +The B<-engine> option and B configuration option were removed in +OpenSSL 4.0. =head1 SEE ALSO diff --git a/doc/man1/openssl-verify.pod.in b/doc/man1/openssl-verify.pod.in index 7e51af6eac..0f6a1ba463 100644 --- a/doc/man1/openssl-verify.pod.in +++ b/doc/man1/openssl-verify.pod.in @@ -18,7 +18,7 @@ B B [B<-vfyopt> I:I] {- $OpenSSL::safe::opt_name_synopsis -} {- $OpenSSL::safe::opt_trust_synopsis -} -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_v_synopsis -} +{- $OpenSSL::safe::opt_v_synopsis -} {- $OpenSSL::safe::opt_provider_synopsis -} [B<-->] [I ...] @@ -77,13 +77,6 @@ Names and values of these options are algorithm-specific. {- $OpenSSL::safe::opt_name_item -} -{- $OpenSSL::safe::opt_engine_item -} -{- output_off() if $disabled{"deprecated-3.0"}; "" -} -To load certificates or CRLs that require engine support, specify the -B<-engine> option before any of the -B<-trusted>, B<-untrusted> or B<-CRLfile> options. -{- output_on() if $disabled{"deprecated-3.0"}; "" -} - {- $OpenSSL::safe::opt_trust_item -} {- $OpenSSL::safe::opt_v_item -} @@ -136,7 +129,7 @@ L The B<-show_chain> option was added in OpenSSL 1.1.0. -The B<-engine option> was deprecated in OpenSSL 3.0. +The B<-engine> option was removed in OpenSSL 4.0. =head1 COPYRIGHT diff --git a/doc/man1/openssl-version.pod.in b/doc/man1/openssl-version.pod.in index 5dad0e5032..ba666244f3 100644 --- a/doc/man1/openssl-version.pod.in +++ b/doc/man1/openssl-version.pod.in @@ -16,7 +16,6 @@ B [B<-f>] [B<-p>] [B<-d>] -[B<-e>] [B<-m>] [B<-r>] [B<-c>] @@ -62,10 +61,6 @@ Platform setting. OPENSSLDIR setting. -=item B<-e> - -ENGINESDIR settings. - =item B<-m> MODULESDIR settings. @@ -89,7 +84,7 @@ non-Windows platforms. =head1 HISTORY In OpenSSL versions prior to 3.4, OpenSSL had a limitation regarding the -B, B and B build time macros. These macros +B and B build time macros. These macros were defined at build time, and represented filesystem paths. This is common practice on unix like systems, as there was an expectation that a given build would be installed to a pre-determined location. On Windows however, there is @@ -98,7 +93,7 @@ B was introduced as a new build time variable to define a set of registry keys identified by the name openssl--, in which the value is derived from the version string in the openssl source, and the extension is derived from the B variable. The values of -B, B and B can be set to various paths +B and B can be set to various paths underneath this key to break the requirement to predict the installation path at build time. diff --git a/doc/man1/openssl-x509.pod.in b/doc/man1/openssl-x509.pod.in index 835a55eddf..43a5747d80 100644 --- a/doc/man1/openssl-x509.pod.in +++ b/doc/man1/openssl-x509.pod.in @@ -18,7 +18,7 @@ B B [B<-inform> B|B] [B<-vfyopt> I:I] [B<-key> I|I] -[B<-keyform> B|B|B|B] +[B<-keyform> B|B|B] [B<-signkey> I|I] [B<-out> I] [B<-outform> B|B] @@ -72,7 +72,7 @@ B B [B<-CA> I|I] [B<-CAform> B|B|B] [B<-CAkey> I|I] -[B<-CAkeyform> B|B|B|B] +[B<-CAkeyform> B|B|B] [B<-CAserial> I] [B<-CAcreateserial>] [B<-trustout>] @@ -82,7 +82,7 @@ B B [B<-clrreject>] [B<-addreject> I] {- $OpenSSL::safe::opt_r_synopsis -} -{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_provider_synopsis -} +{- $OpenSSL::safe::opt_provider_synopsis -} =head1 DESCRIPTION @@ -193,7 +193,7 @@ B<-not_before> and B<-not_after>. This option is an alias of B<-key>. -=item B<-keyform> B|B|B|B +=item B<-keyform> B|B|B The key input format; unspecified by default. See L for details. @@ -546,7 +546,7 @@ Sets the CA private key to sign a certificate with. The private key must match the public key of the certificate given with B<-CA>. If this option is not provided then the key must be present in the B<-CA> input. -=item B<-CAkeyform> B|B|B|B +=item B<-CAkeyform> B|B|B The format for the CA key; unspecified by default. See L for details. @@ -645,8 +645,6 @@ It accepts the same values as the B<-addtrust> option. {- $OpenSSL::safe::opt_r_item -} -{- $OpenSSL::safe::opt_engine_item -} - {- $OpenSSL::safe::opt_provider_item -} =back @@ -843,13 +841,13 @@ form must have their links rebuilt using L or similar. The B<-signkey> option has been renamed to B<-key> in OpenSSL 3.0, keeping the old name as an alias. -The B<-engine> option was deprecated in OpenSSL 3.0. - The B<-C> option was removed in OpenSSL 3.0. Since OpenSSL 3.2, generated certificates bear X.509 version 3, and key identifier extensions are included by default. +The B<-engine> option was removed in OpenSSL 4.0. + =head1 COPYRIGHT Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man1/openssl.pod b/doc/man1/openssl.pod index edef2ff598..ea506b7c35 100644 --- a/doc/man1/openssl.pod +++ b/doc/man1/openssl.pod @@ -131,10 +131,6 @@ EC parameter manipulation and generation. Encryption, decryption, and encoding. -=item B - -Engine (loadable module) information and manipulation. - =item B Error Number to Error String Conversion. @@ -620,50 +616,6 @@ respectively. =back -=head2 Engine Options - -=over 4 - -=item B<-engine> I - -Load the engine identified by I and use all the methods it implements -(algorithms, key storage, etc.), unless specified otherwise in the -command-specific documentation or it is configured to do so, as described in -L. - -The engine will be used for key ids specified with B<-key> and similar -options when an option like B<-keyform engine> is given. - -A special case is the C engine, which -is meant just for internal OpenSSL testing purposes and -supports loading keys, parameters, certificates, and CRLs from files. -When this engine is used, files with such credentials are read via this engine. -Using the C schema is optional; a plain file (path) name will do. - -=back - -Options specifying keys, like B<-key> and similar, can use the generic -OpenSSL engine key loading URI scheme C to retrieve -private keys and public keys. The URI syntax is as follows, in simplified -form: - - org.openssl.engine:{engineid}:{keyid} - -Where C<{engineid}> is the identity/name of the engine, and C<{keyid}> is a -key identifier that's acceptable by that engine. For example, when using an -engine that interfaces against a PKCS#11 implementation, the generic key URI -would be something like this (this happens to be an example for the PKCS#11 -engine that's part of OpenSC): - - -key org.openssl.engine:pkcs11:label_some-private-key - -As a third possibility, for engines and providers that have implemented -their own L, C should not be -necessary. For a PKCS#11 implementation that has implemented such a loader, -the PKCS#11 URI as defined in RFC 7512 should be possible to use directly: - - -key pkcs11:object=some-private-key;pin-value=1234 - =head2 Provider Options =over 4 @@ -718,8 +670,8 @@ see L. For information about the use of environment variables in configuration, see L. -For information about specific commands, see L, -L, and L. +For information about specific commands, see L +and L. For information about querying or specifying CPU architecture flags, see L, L and L. @@ -739,7 +691,6 @@ L, L, L, L, -L, L, L, L, @@ -798,6 +749,10 @@ The interactive mode, which could be invoked by running C with no further arguments, was removed in OpenSSL 3.0, and running that program with no arguments is now equivalent to C. +The B command, the whole engine support together with the +C URI scheme was removed in OpenSSL 4.0; use providers as +a replacement. + =head1 COPYRIGHT Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man3/ASYNC_WAIT_CTX_new.pod b/doc/man3/ASYNC_WAIT_CTX_new.pod index d85c51e555..accbeeaf19 100644 --- a/doc/man3/ASYNC_WAIT_CTX_new.pod +++ b/doc/man3/ASYNC_WAIT_CTX_new.pod @@ -70,8 +70,8 @@ descriptors. Calling ASYNC_WAIT_CTX_get_all_fds() with a NULL I value will return no file descriptors but will still populate I<*numfds>. Therefore, application code is typically expected to call this function twice: once to get the number of fds, and then again when sufficient memory has been allocated. If -only one asynchronous engine is being used then normally this call will only -ever return one fd. If multiple asynchronous engines are being used then more +only one asynchronous provider is being used then normally this call will only +ever return one fd. If multiple asynchronous providers are being used then more could be returned. The function ASYNC_WAIT_CTX_get_changed_fds() can be used to detect if any fds @@ -83,7 +83,7 @@ will be populated with the list of added and deleted fds respectively. Similarly to ASYNC_WAIT_CTX_get_all_fds() either of these can be NULL, but if they are not NULL then the caller is responsible for ensuring sufficient memory is allocated. -Implementers of async aware code (e.g. engines) are encouraged to return a +Implementers of async aware code (e.g. providers) are encouraged to return a stable fd for the lifetime of the B in order to reduce the "churn" of regularly changing fds - although no guarantees of this are provided to applications. @@ -94,41 +94,40 @@ that the job should be resumed). If no file descriptor is made available then an application will have to periodically "poll" the job by attempting to restart it to see if it is ready to continue. -Async aware code (e.g. engines) can get the current B from the +Async aware code (e.g. providers) can get the current B from the job via L and provide a file descriptor to use for waiting on by calling ASYNC_WAIT_CTX_set_wait_fd(). Typically this would be done -by an engine immediately prior to calling ASYNC_pause_job() and not by end user -code. An existing association with a file descriptor can be obtained using +by a provider immediately prior to calling ASYNC_pause_job() and not by end +user code. An existing association with a file descriptor can be obtained using ASYNC_WAIT_CTX_get_fd() and cleared using ASYNC_WAIT_CTX_clear_fd(). Both of these functions requires a I value which is unique to the async aware -code. This could be any unique value but a good candidate might be the -B for the engine. The I parameter can be any value, and -will be returned in a subsequent call to ASYNC_WAIT_CTX_get_fd(). The +code. This could be any unique value. The I parameter can be any +value, and will be returned in a subsequent call to ASYNC_WAIT_CTX_get_fd(). The ASYNC_WAIT_CTX_set_wait_fd() function also expects a pointer to a "cleanup" routine. This can be NULL but if provided will automatically get called when -the B is freed, and gives the engine the opportunity to close +the B is freed, and gives the provider the opportunity to close the fd or any other resources. Note: The "cleanup" routine does not get called if the fd is cleared directly via a call to ASYNC_WAIT_CTX_clear_fd(). -An example of typical usage might be an async capable engine. User code would -initiate cryptographic operations. The engine would initiate those operations +An example of typical usage might be an async capable provider. User code would +initiate cryptographic operations. The provider would initiate those operations asynchronously and then call ASYNC_WAIT_CTX_set_wait_fd() followed by ASYNC_pause_job() to return control to the user code. The user code can then perform other tasks or wait for the job to be ready by calling "select" or other -similar function on the wait file descriptor. The engine can signal to the user -code that the job should be resumed by making the wait file descriptor -"readable". Once resumed the engine should clear the wake signal on the wait +similar function on the wait file descriptor. The provider can signal to the +user code that the job should be resumed by making the wait file descriptor +"readable". Once resumed the provider should clear the wake signal on the wait file descriptor. As well as a file descriptor, user code may also be notified via a callback. The callback and data pointers are stored within the B along with an -additional status field that can be used for the notification of retries from an -engine. This additional method can be used when the user thinks that a file +additional status field that can be used for the notification of retries from a +provider. This additional method can be used when the user thinks that a file descriptor is too costly in terms of CPU cycles or in some context where a file descriptor is not appropriate. ASYNC_WAIT_CTX_set_callback() sets the callback and the callback argument. The -callback will be called to notify user code when an engine completes a +callback will be called to notify user code when a provider completes a cryptography operation. It is a requirement that the callback function is small and nonblocking as it will be run in the context of a polling mechanism or an interrupt. @@ -136,22 +135,22 @@ interrupt. ASYNC_WAIT_CTX_get_callback() returns the callback set in the B structure. -ASYNC_WAIT_CTX_set_status() allows an engine to set the current engine status. -The possible status values are the following: +ASYNC_WAIT_CTX_set_status() allows a provider to set the current provider +status. The possible status values are the following: =over 4 =item B -The engine does not support the callback mechanism. This is the default value. -The engine must call ASYNC_WAIT_CTX_set_status() to set the status to some value -other than B if it intends to enable the callback -mechanism. +The provider does not support the callback mechanism. This is the default value. +The provider must call ASYNC_WAIT_CTX_set_status() to set the status to some +value other than B if it intends to enable the +callback mechanism. =item B -The engine has a fatal problem with this request. The user code should clean up -this session. +The provider has a fatal problem with this request. The user code should clean +up this session. =item B @@ -159,21 +158,21 @@ The request has been successfully submitted. =item B -The engine has some problem which will be recovered soon, such as a buffer is +The provider has some problem which will be recovered soon, such as a buffer is full, so user code should resume the job. =back ASYNC_WAIT_CTX_get_status() allows user code to obtain the current status value. If the status is any value other than B then the user code -should not expect to receive a callback from the engine even if one has been +should not expect to receive a callback from the provider even if one has been set. An example of the usage of the callback method might be the following. User -code would initiate cryptographic operations, and the engine code would dispatch -this operation to hardware, and if the dispatch is successful, then the engine -code would call ASYNC_pause_job() to return control to the user code. After -that, user code can perform other tasks. When the hardware completes the +code would initiate cryptographic operations, and the provider code would +dispatch this operation to hardware, and if the dispatch is successful, then the +provider code would call ASYNC_pause_job() to return control to the user code. +After that, user code can perform other tasks. When the hardware completes the operation, normally it is detected by a polling function or an interrupt, as the user code set a callback by calling ASYNC_WAIT_CTX_set_callback() previously, then the registered callback will be called. @@ -190,7 +189,7 @@ ASYNC_WAIT_CTX_set_wait_fd, ASYNC_WAIT_CTX_get_fd, ASYNC_WAIT_CTX_get_all_fds, ASYNC_WAIT_CTX_get_changed_fds, ASYNC_WAIT_CTX_clear_fd, ASYNC_WAIT_CTX_set_callback, ASYNC_WAIT_CTX_get_callback and ASYNC_WAIT_CTX_set_status all return 1 on success or 0 on error. -ASYNC_WAIT_CTX_get_status() returns the engine status. +ASYNC_WAIT_CTX_get_status() returns the provider status. =head1 NOTES diff --git a/doc/man3/ASYNC_start_job.pod b/doc/man3/ASYNC_start_job.pod index 89b34ae6a4..d641933fc1 100644 --- a/doc/man3/ASYNC_start_job.pod +++ b/doc/man3/ASYNC_start_job.pod @@ -131,14 +131,15 @@ an application will have to periodically "poll" the job by attempting to restart it to see if it is ready to continue. Bs also have a "callback" mechanism to notify applications. The -callback is set by an application, and it will be automatically called when an -engine completes a cryptography operation, so that the application can resume -the paused work flow without polling. An engine could be written to look whether -the callback has been set. If it has then it would use the callback mechanism -in preference to the file descriptor notifications. If a callback is not set -then the engine may use file descriptor based notifications. Please note that -not all engines may support the callback mechanism, so the callback may not be -used even if it has been set. See ASYNC_WAIT_CTX_new() for more details. +callback is set by an application, and it will be automatically called when a +provider completes a cryptography operation, so that the application can resume +the paused work flow without polling. A provider could be written to look +whether the callback has been set. If it has then it would use the callback +mechanism in preference to the file descriptor notifications. If a callback is +not set then the provider may use file descriptor based notifications. Please +note that not all providers may support the callback mechanism, so the callback +may not be used even if it has been set. See ASYNC_WAIT_CTX_new() for more +details. The ASYNC_block_pause() function will prevent the currently active job from pausing. The block will remain in place until a subsequent call to @@ -243,8 +244,8 @@ The following example demonstrates how to use most of the core async APIs: /* * Create a way to inform the calling thread when this job is ready * to resume, in this example we're using file descriptors. - * For offloading the task to an asynchronous ENGINE it's not necessary, - * the ENGINE should handle that internally. + * For offloading the task to an asynchronous provider it's not necessary, + * the provider should handle that internally. */ if (pipe(pipefds) != 0) { diff --git a/doc/man3/BIO_get_ex_new_index.pod b/doc/man3/BIO_get_ex_new_index.pod index 95bdc79389..9b3c5ce680 100644 --- a/doc/man3/BIO_get_ex_new_index.pod +++ b/doc/man3/BIO_get_ex_new_index.pod @@ -7,7 +7,6 @@ BIO_set_app_data, BIO_get_app_data, DH_get_ex_new_index, DH_set_ex_data, DH_get_ex_data, DSA_get_ex_new_index, DSA_set_ex_data, DSA_get_ex_data, EC_KEY_get_ex_new_index, EC_KEY_set_ex_data, EC_KEY_get_ex_data, -ENGINE_get_ex_new_index, ENGINE_set_ex_data, ENGINE_get_ex_data, EVP_PKEY_get_ex_new_index, EVP_PKEY_set_ex_data, EVP_PKEY_get_ex_data, RSA_get_ex_new_index, RSA_set_ex_data, RSA_get_ex_data, RSA_set_app_data, RSA_get_app_data, @@ -65,10 +64,6 @@ see L: void *RSA_get_ex_data(RSA *type, int idx); int RSA_set_app_data(RSA *type, void *arg); void *RSA_get_app_data(RSA *type); - int ENGINE_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func, - CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func); - int ENGINE_set_ex_data(ENGINE *type, int idx, void *arg); - void *ENGINE_get_ex_data(ENGINE *type, int idx); =head1 DESCRIPTION @@ -79,9 +74,6 @@ All functions with a I of B, B, B and B are deprecat Applications should instead use EVP_PKEY_set_ex_data(), EVP_PKEY_get_ex_data() and EVP_PKEY_get_ex_new_index(). -All functions with a I of B are deprecated. -Applications using engines should be replaced by providers. - These functions handle application-specific data for OpenSSL data structures. @@ -119,13 +111,12 @@ L. The functions DH_get_ex_new_index(), DH_set_ex_data(), DH_get_ex_data(), DSA_get_ex_new_index(), DSA_set_ex_data(), DSA_get_ex_data(), EC_KEY_get_ex_new_index(), EC_KEY_set_ex_data(), EC_KEY_get_ex_data(), -ENGINE_get_ex_new_index(), ENGINE_set_ex_data(), ENGINE_get_ex_data(), RSA_get_ex_new_index(), RSA_set_ex_data(), RSA_get_ex_data(), RSA_set_app_data() and RSA_get_app_data() were deprecated in OpenSSL 3.0. =head1 COPYRIGHT -Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2015-2025 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/CMAC_CTX.pod b/doc/man3/CMAC_CTX.pod index fae4fd1516..ae469ce9c2 100644 --- a/doc/man3/CMAC_CTX.pod +++ b/doc/man3/CMAC_CTX.pod @@ -69,7 +69,7 @@ CMAC_CTX_copy() copies the state from one B structure to another. CMAC_Init() initializes the B structure for a new CMAC calculation with the specified key, key length, and cipher type. -Optionally, an B can be provided. +I B be NULL. CMAC_Update() processes data to be included in the CMAC calculation. This function can be called multiple times to update the context with diff --git a/doc/man3/CMS_add1_signer.pod b/doc/man3/CMS_add1_signer.pod index 606df6f6fd..c7618f6f32 100644 --- a/doc/man3/CMS_add1_signer.pod +++ b/doc/man3/CMS_add1_signer.pod @@ -79,8 +79,7 @@ have a subject key identifier extension. If present the SMIMECapabilities attribute indicates support for the following algorithms in preference order: 256 bit AES, Gost R3411-94, Gost 28147-89, 192 bit AES, 128 bit AES, triple DES, 128 bit RC2, 64 bit RC2, DES and 40 bit RC2. -If any of these algorithms is not available then it will not be included: for example the GOST algorithms will not be included if the GOST ENGINE is -not loaded. +If any of these algorithms is not available then it will not be included. Note that, in the case signedAttributes are not used, for some hash-less signing schemes the given hash B will be ignored and a hash required by the signing @@ -106,7 +105,7 @@ L, =head1 COPYRIGHT -Copyright 2014-2016 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/CMS_sign.pod b/doc/man3/CMS_sign.pod index ce4f39f885..772b59f206 100644 --- a/doc/man3/CMS_sign.pod +++ b/doc/man3/CMS_sign.pod @@ -67,9 +67,7 @@ omitted. If present the SMIMECapabilities attribute indicates support for the following algorithms in preference order: 256 bit AES, Gost R3411-94, Gost 28147-89, 192 bit AES, 128 bit AES, triple DES, 128 bit RC2, 64 bit RC2, DES and 40 bit RC2. -If any of these algorithms is not available then it will not be included: -for example the GOST algorithms will not be included if the GOST ENGINE is -not loaded. +If any of these algorithms is not available then it will not be included. OpenSSL will by default identify signing certificates using issuer name and serial number. If B is set it will use the subject key diff --git a/doc/man3/CRYPTO_get_ex_new_index.pod b/doc/man3/CRYPTO_get_ex_new_index.pod index d2b44fd694..b0c68cbd5c 100644 --- a/doc/man3/CRYPTO_get_ex_new_index.pod +++ b/doc/man3/CRYPTO_get_ex_new_index.pod @@ -48,7 +48,6 @@ The specific structures are: DH DSA EC_KEY - ENGINE EVP_PKEY RSA SSL @@ -166,7 +165,8 @@ CRYPTO_alloc_ex_data() was added in OpenSSL 3.0. The signature of the dup_func() callback was changed in OpenSSL 3.0 to use the type B for B. Previously this parameter was of type B. -Support for ENGINE "exdata" was deprecated in OpenSSL 3.0. +Support for ENGINE "exdata" was deprecated in OpenSSL 3.0 and removed in +OpenSSL 4.0. =head1 COPYRIGHT diff --git a/doc/man3/DH_get0_pqg.pod b/doc/man3/DH_get0_pqg.pod index ae8da4865b..70c5fd6018 100644 --- a/doc/man3/DH_get0_pqg.pod +++ b/doc/man3/DH_get0_pqg.pod @@ -5,7 +5,7 @@ DH_get0_pqg, DH_set0_pqg, DH_get0_key, DH_set0_key, DH_get0_p, DH_get0_q, DH_get0_g, DH_get0_priv_key, DH_get0_pub_key, -DH_clear_flags, DH_test_flags, DH_set_flags, DH_get0_engine, +DH_clear_flags, DH_test_flags, DH_set_flags, DH_get_length, DH_set_length - Routines for getting and setting data in a DH object =head1 SYNOPSIS @@ -34,8 +34,6 @@ see L: long DH_get_length(const DH *dh); int DH_set_length(DH *dh, long length); - ENGINE *DH_get0_engine(DH *d); - =head1 DESCRIPTION All of the functions described on this page are deprecated. @@ -92,10 +90,6 @@ flags can be tested in one go. All flags that are currently set are returned, or zero if none of the flags are set. DH_clear_flags() clears the specified flags within the DH object. -DH_get0_engine() returns a handle to the ENGINE that has been set for this DH -object, or NULL if no such ENGINE has been set. This function is deprecated. All -engines should be replaced by providers. - The DH_get_length() and DH_set_length() functions get and set the optional length parameter associated with this DH object. If the length is nonzero then it is used, otherwise it is ignored. The I parameter indicates the @@ -122,9 +116,6 @@ return the respective value, or NULL if it is unset. DH_test_flags() returns the current state of the flags in the DH object. -DH_get0_engine() returns the ENGINE set for the DH object or NULL if no ENGINE -has been set. - DH_get_length() returns the length of the secret exponent (private key) in bits, or zero if no such length has been explicitly set. @@ -139,6 +130,8 @@ The functions described here were added in OpenSSL 1.1.0. All of these functions were deprecated in OpenSSL 3.0. +The DH_get0_engine() was removed in OpenSSL 4.0. + =head1 COPYRIGHT Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man3/DH_set_method.pod b/doc/man3/DH_set_method.pod index d6da381001..3b1e68115c 100644 --- a/doc/man3/DH_set_method.pod +++ b/doc/man3/DH_set_method.pod @@ -30,36 +30,28 @@ Applications should instead use the provider APIs. A B specifies the functions that OpenSSL uses for Diffie-Hellman operations. By modifying the method, alternative implementations -such as hardware accelerators may be used. IMPORTANT: See the NOTES section for -important information about how these DH API functions are affected by the use -of B API calls. +such as hardware accelerators may be used. Initially, the default DH_METHOD is the OpenSSL internal implementation, as returned by DH_OpenSSL(). DH_set_default_method() makes B the default method for all DH structures created later. -B: This is true only whilst no ENGINE has been set -as a default for DH, so this function is no longer recommended. +B: This function is not thread-safe and should not be called at the same time as other OpenSSL functions. DH_get_default_method() returns a pointer to the current default DH_METHOD. -However, the meaningfulness of this result is dependent on whether the ENGINE -API is being used, so this function is no longer recommended. -DH_set_method() selects B to perform all operations using the key B. -This will replace the DH_METHOD used by the DH key and if the previous method -was supplied by an ENGINE, the handle to that ENGINE will be released during the -change. It is possible to have DH keys that only work with certain DH_METHOD -implementations (e.g. from an ENGINE module that supports embedded -hardware-protected keys), and in such cases attempting to change the DH_METHOD -for the key can have unexpected results. +DH_set_method() selects B to perform all operations using the key +B. This will replace the DH_METHOD used by the DH key. +It is possible to have DH keys that only work with certain DH_METHOD +implementations, and in such cases attempting to change the DH_METHOD for the +key can have unexpected results. See L for information on +constructing custom DH_METHOD objects. -DH_new_method() allocates and initializes a DH structure so that B will -be used for the DH operations. If B is NULL, the default ENGINE for DH -operations is used, and if no default ENGINE is set, the DH_METHOD controlled by -DH_set_default_method() is used. +DH_new_method() allocates and initializes a DH structure. B must +be NULL and the DH_METHOD controlled by DH_set_default_method() is used. A new DH_METHOD object may be constructed using DH_meth_new() (see L). @@ -72,8 +64,7 @@ Bs. DH_set_default_method() returns no value. DH_set_method() returns nonzero if the provided B was successfully set as -the method for B (including unloading the ENGINE handle if the previous -method was supplied by an ENGINE). +the method for B. DH_new_method() returns NULL and sets an error code that can be obtained by L if the allocation fails. Otherwise it @@ -89,7 +80,7 @@ All of these functions were deprecated in OpenSSL 3.0. =head1 COPYRIGHT -Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/DSA_get0_pqg.pod b/doc/man3/DSA_get0_pqg.pod index fc2a967cfa..68a6e6aec4 100644 --- a/doc/man3/DSA_get0_pqg.pod +++ b/doc/man3/DSA_get0_pqg.pod @@ -5,9 +5,8 @@ DSA_get0_pqg, DSA_set0_pqg, DSA_get0_key, DSA_set0_key, DSA_get0_p, DSA_get0_q, DSA_get0_g, DSA_get0_pub_key, DSA_get0_priv_key, -DSA_clear_flags, DSA_test_flags, DSA_set_flags, -DSA_get0_engine - Routines for getting and -setting data in a DSA object +DSA_clear_flags, DSA_test_flags, DSA_set_flags +- Routines for getting and setting data in a DSA object =head1 SYNOPSIS @@ -31,7 +30,6 @@ see L: void DSA_clear_flags(DSA *d, int flags); int DSA_test_flags(const DSA *d, int flags); void DSA_set_flags(DSA *d, int flags); - ENGINE *DSA_get0_engine(DSA *d); =head1 DESCRIPTION @@ -80,9 +78,6 @@ flags can be tested in one go. All flags that are currently set are returned, or zero if none of the flags are set. DSA_clear_flags() clears the specified flags within the DSA object. -DSA_get0_engine() returns a handle to the ENGINE that has been set for this DSA -object, or NULL if no such ENGINE has been set. - =head1 NOTES Values retrieved with DSA_get0_key() are owned by the DSA object used @@ -96,9 +91,6 @@ DSA_set0_pqg() and DSA_set0_key() return 1 on success or 0 on failure. DSA_test_flags() returns the current state of the flags in the DSA object. -DSA_get0_engine() returns the ENGINE set for the DSA object or NULL if no ENGINE -has been set. - =head1 SEE ALSO L, @@ -111,6 +103,8 @@ L, L, L The functions described here were added in OpenSSL 1.1.0 and deprecated in OpenSSL 3.0. +The DSA_get0_engine() was removed in OpenSSL 4.0. + =head1 COPYRIGHT Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man3/DSA_set_method.pod b/doc/man3/DSA_set_method.pod index 6275859b2c..6243c93d6b 100644 --- a/doc/man3/DSA_set_method.pod +++ b/doc/man3/DSA_set_method.pod @@ -30,39 +30,29 @@ Applications should providers instead of method overrides. A B specifies the functions that OpenSSL uses for DSA operations. By modifying the method, alternative implementations -such as hardware accelerators may be used. IMPORTANT: See the NOTES section for -important information about how these DSA API functions are affected by the use -of B API calls. +such as hardware accelerators may be used. Initially, the default DSA_METHOD is the OpenSSL internal implementation, as returned by DSA_OpenSSL(). DSA_set_default_method() makes B the default method for all DSA structures created later. -B: This is true only whilst no ENGINE has -been set as a default for DSA, so this function is no longer recommended. -This function is not thread-safe and should not be called at the same time +B: This function is not thread-safe and should not be called at the same time as other OpenSSL functions. DSA_get_default_method() returns a pointer to the current default -DSA_METHOD. However, the meaningfulness of this result is dependent on -whether the ENGINE API is being used, so this function is no longer -recommended. +DSA_METHOD. DSA_set_method() selects B to perform all operations using the key -B. This will replace the DSA_METHOD used by the DSA key and if the -previous method was supplied by an ENGINE, the handle to that ENGINE will -be released during the change. It is possible to have DSA keys that only -work with certain DSA_METHOD implementations (e.g. from an ENGINE module -that supports embedded hardware-protected keys), and in such cases -attempting to change the DSA_METHOD for the key can have unexpected -results. See L for information on constructing custom DSA_METHOD -objects; +B. This will replace the DSA_METHOD used by the DSA key. +It is possible to have DSA keys that only work with certain DSA_METHOD +implementations, and in such cases attempting to change the DSA_METHOD for the +key can have unexpected results. See L for information on +constructing custom DSA_METHOD objects. -DSA_new_method() allocates and initializes a DSA structure so that B -will be used for the DSA operations. If B is NULL, the default engine -for DSA operations is used, and if no default ENGINE is set, the DSA_METHOD -controlled by DSA_set_default_method() is used. +DSA_new_method() allocates and initializes a DSA structure so that the +DSA_METHOD controlled by DSA_set_default_method() is used. I B +be NULL. =head1 RETURN VALUES @@ -72,8 +62,7 @@ Bs. DSA_set_default_method() returns no value. DSA_set_method() returns nonzero if the provided B was successfully set as -the method for B (including unloading the ENGINE handle if the previous -method was supplied by an ENGINE). +the method for B. DSA_new_method() returns NULL and sets an error code that can be obtained by L if the allocation @@ -89,7 +78,7 @@ All of these functions were deprecated in OpenSSL 3.0. =head1 COPYRIGHT -Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/ECDSA_sign.pod b/doc/man3/ECDSA_sign.pod index 88e851885a..0f820b44bd 100644 --- a/doc/man3/ECDSA_sign.pod +++ b/doc/man3/ECDSA_sign.pod @@ -70,9 +70,7 @@ ECDSA_do_verify() is similar to ECDSA_verify() except the signature is presented in the form of a pointer to an B structure. The remaining functions utilise the internal I and I values used -during signature computation. Most applications will never need to call these -and some external ECDSA ENGINE implementations may not support them at all if -either I or I is not NULL. +during signature computation. Most applications will never need to call these. ECDSA_sign_setup() may be used to precompute parts of the signing operation. I is the private EC key and I is a pointer to B structure diff --git a/doc/man3/EC_KEY_new.pod b/doc/man3/EC_KEY_new.pod index d93586b1d0..2bdfd6d96a 100644 --- a/doc/man3/EC_KEY_new.pod +++ b/doc/man3/EC_KEY_new.pod @@ -6,7 +6,7 @@ EVP_EC_gen, EC_KEY_get_method, EC_KEY_set_method, EC_KEY_new_ex, EC_KEY_new, EC_KEY_get_flags, EC_KEY_set_flags, EC_KEY_clear_flags, EC_KEY_new_by_curve_name_ex, EC_KEY_new_by_curve_name, EC_KEY_free, -EC_KEY_copy, EC_KEY_dup, EC_KEY_up_ref, EC_KEY_get0_engine, +EC_KEY_copy, EC_KEY_dup, EC_KEY_up_ref, EC_KEY_get0_group, EC_KEY_set_group, EC_KEY_get0_private_key, EC_KEY_set_private_key, EC_KEY_get0_public_key, EC_KEY_set_public_key, EC_KEY_get_conv_form, @@ -39,7 +39,6 @@ see L: EC_KEY *EC_KEY_copy(EC_KEY *dst, const EC_KEY *src); EC_KEY *EC_KEY_dup(const EC_KEY *src); int EC_KEY_up_ref(EC_KEY *key); - ENGINE *EC_KEY_get0_engine(const EC_KEY *eckey); const EC_GROUP *EC_KEY_get0_group(const EC_KEY *key); int EC_KEY_set_group(EC_KEY *key, const EC_GROUP *group); const BIGNUM *EC_KEY_get0_private_key(const EC_KEY *key); @@ -114,9 +113,6 @@ EC_KEY_dup() creates a new EC_KEY object and copies I into it. EC_KEY_up_ref() increments the reference count associated with the EC_KEY object. -EC_KEY_get0_engine() returns a handle to the ENGINE that has been set for -this EC_KEY object. - EC_KEY_generate_key() generates a new public and private key for the supplied I object. I must have an EC_GROUP object associated with it before calling this function. The private key is a random integer (0 < priv_key @@ -197,8 +193,6 @@ integer. EC_KEY_copy() returns a pointer to the destination key, or NULL on error. -EC_KEY_get0_engine() returns a pointer to an ENGINE, or NULL if it wasn't set. - EC_KEY_up_ref(), EC_KEY_set_group(), EC_KEY_set_public_key(), EC_KEY_precompute_mult(), EC_KEY_generate_key(), EC_KEY_check_key(), EC_KEY_set_public_key_affine_coordinates(), EC_KEY_oct2key() and @@ -233,6 +227,8 @@ EVP_EC_gen() was added in OpenSSL 3.0. All other functions described here were deprecated in OpenSSL 3.0. For replacement see L. +The EC_KEY_get0_engine() was removed in OpenSSL 4.0. + =head1 COPYRIGHT Copyright 2013-2023 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man3/ENGINE_add.pod b/doc/man3/ENGINE_add.pod index 24c83c5764..4e471f1520 100644 --- a/doc/man3/ENGINE_add.pod +++ b/doc/man3/ENGINE_add.pod @@ -39,16 +39,16 @@ ENGINE_register_all_RSA, ENGINE_register_all_ciphers, ENGINE_register_all_digests, ENGINE_set_table_flags, ENGINE_unregister_DH, ENGINE_unregister_DSA, ENGINE_unregister_RAND, ENGINE_unregister_RSA, ENGINE_unregister_ciphers, -ENGINE_unregister_digests +ENGINE_get_ex_new_index, ENGINE_set_ex_data, ENGINE_get_ex_data, +ENGINE_unregister_digests, ENGINE_add_conf_module - ENGINE cryptographic module support =head1 SYNOPSIS #include -The following functions have been deprecated since OpenSSL 3.0, and can be -hidden entirely by defining B with a suitable version value, -see L: +The following functions have been removed in OpenSSL 4.0. Provider API should be +used instead. ENGINE *ENGINE_get_first(void); ENGINE *ENGINE_get_last(void); @@ -157,417 +157,20 @@ see L: UI_METHOD *ui_method, void *callback_data); EVP_PKEY *ENGINE_load_public_key(ENGINE *e, const char *key_id, UI_METHOD *ui_method, void *callback_data); - -The following function has been deprecated since OpenSSL 1.1.0, and can be -hidden entirely by defining B with a suitable version value, -see L: - void ENGINE_cleanup(void); + void ENGINE_add_conf_module(void); + int ENGINE_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func, + CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func); + int ENGINE_set_ex_data(ENGINE *type, int idx, void *arg); + void *ENGINE_get_ex_data(ENGINE *type, int idx); =head1 DESCRIPTION -All of the functions described on this page are deprecated. -Applications should instead use the provider APIs. - -These functions create, manipulate, and use cryptographic modules in the -form of B objects. These objects act as containers for -implementations of cryptographic algorithms, and support a -reference-counted mechanism to allow them to be dynamically loaded in and -out of the running application. - -The cryptographic functionality that can be provided by an B -implementation includes the following abstractions; - - RSA_METHOD - for providing alternative RSA implementations - DSA_METHOD, DH_METHOD, RAND_METHOD, ECDH_METHOD, ECDSA_METHOD, - - similarly for other OpenSSL APIs - EVP_CIPHER - potentially multiple cipher algorithms (indexed by 'nid') - EVP_DIGEST - potentially multiple hash algorithms (indexed by 'nid') - key-loading - loading public and/or private EVP_PKEY keys - -=head2 Reference counting and handles - -Due to the modular nature of the ENGINE API, pointers to ENGINEs need to be -treated as handles - i.e. not only as pointers, but also as references to -the underlying ENGINE object. Ie. one should obtain a new reference when -making copies of an ENGINE pointer if the copies will be used (and -released) independently. - -ENGINE objects have two levels of reference-counting to match the way in -which the objects are used. At the most basic level, each ENGINE pointer is -inherently a B reference - a structural reference is required -to use the pointer value at all, as this kind of reference is a guarantee -that the structure can not be deallocated until the reference is released. - -However, a structural reference provides no guarantee that the ENGINE is -initialised and able to use any of its cryptographic -implementations. Indeed it's quite possible that most ENGINEs will not -initialise at all in typical environments, as ENGINEs are typically used to -support specialised hardware. To use an ENGINE's functionality, you need a -B reference. This kind of reference can be considered a -specialised form of structural reference, because each functional reference -implicitly contains a structural reference as well - however to avoid -difficult-to-find programming bugs, it is recommended to treat the two -kinds of reference independently. If you have a functional reference to an -ENGINE, you have a guarantee that the ENGINE has been initialised and -is ready to perform cryptographic operations, and will remain initialised -until after you have released your reference. - -I - -This basic type of reference is used for instantiating new ENGINEs, -iterating across OpenSSL's internal linked-list of loaded -ENGINEs, reading information about an ENGINE, etc. Essentially a structural -reference is sufficient if you only need to query or manipulate the data of -an ENGINE implementation rather than use its functionality. - -The ENGINE_new() function returns a structural reference to a new (empty) -ENGINE object. There are other ENGINE API functions that return structural -references such as; ENGINE_by_id(), ENGINE_get_first(), ENGINE_get_last(), -ENGINE_get_next(), ENGINE_get_prev(). All structural references should be -released by a corresponding to call to the ENGINE_free() function - the -ENGINE object itself will only actually be cleaned up and deallocated when -the last structural reference is released. If the argument to ENGINE_free() -is NULL, nothing is done. - -It should also be noted that many ENGINE API function calls that accept a -structural reference will internally obtain another reference - typically -this happens whenever the supplied ENGINE will be needed by OpenSSL after -the function has returned. Eg. the function to add a new ENGINE to -OpenSSL's internal list is ENGINE_add() - if this function returns success, -then OpenSSL will have stored a new structural reference internally so the -caller is still responsible for freeing their own reference with -ENGINE_free() when they are finished with it. In a similar way, some -functions will automatically release the structural reference passed to it -if part of the function's job is to do so. Eg. the ENGINE_get_next() and -ENGINE_get_prev() functions are used for iterating across the internal -ENGINE list - they will return a new structural reference to the next (or -previous) ENGINE in the list or NULL if at the end (or beginning) of the -list, but in either case the structural reference passed to the function is -released on behalf of the caller. - -To clarify a particular function's handling of references, one should -always consult that function's documentation "man" page, or failing that -the F<< >> header file includes some hints. - -I - -As mentioned, functional references exist when the cryptographic -functionality of an ENGINE is required to be available. A functional -reference can be obtained in one of two ways; from an existing structural -reference to the required ENGINE, or by asking OpenSSL for the default -operational ENGINE for a given cryptographic purpose. - -To obtain a functional reference from an existing structural reference, -call the ENGINE_init() function. This returns zero if the ENGINE was not -already operational and couldn't be successfully initialised (e.g. lack of -system drivers, no special hardware attached, etc), otherwise it will -return nonzero to indicate that the ENGINE is now operational and will -have allocated a new B reference to the ENGINE. All functional -references are released by calling ENGINE_finish() (which removes the -implicit structural reference as well). - -The second way to get a functional reference is by asking OpenSSL for a -default implementation for a given task, e.g. by ENGINE_get_default_RSA(), -ENGINE_get_default_cipher_engine(), etc. These are discussed in the next -section, though they are not usually required by application programmers as -they are used automatically when creating and using the relevant -algorithm-specific types in OpenSSL, such as RSA, DSA, EVP_CIPHER_CTX, etc. - -=head2 Default implementations - -For each supported abstraction, the ENGINE code maintains an internal table -of state to control which implementations are available for a given -abstraction and which should be used by default. These implementations are -registered in the tables and indexed by an 'nid' value, because -abstractions like EVP_CIPHER and EVP_DIGEST support many distinct -algorithms and modes, and ENGINEs can support arbitrarily many of them. -In the case of other abstractions like RSA, DSA, etc, there is only one -"algorithm" so all implementations implicitly register using the same 'nid' -index. - -When a default ENGINE is requested for a given abstraction/algorithm/mode, (e.g. -when calling RSA_new_method(NULL)), a "get_default" call will be made to the -ENGINE subsystem to process the corresponding state table and return a -functional reference to an initialised ENGINE whose implementation should be -used. If no ENGINE should (or can) be used, it will return NULL and the caller -will operate with a NULL ENGINE handle - this usually equates to using the -conventional software implementation. In the latter case, OpenSSL will from -then on behave the way it used to before the ENGINE API existed. - -Each state table has a flag to note whether it has processed this -"get_default" query since the table was last modified, because to process -this question it must iterate across all the registered ENGINEs in the -table trying to initialise each of them in turn, in case one of them is -operational. If it returns a functional reference to an ENGINE, it will -also cache another reference to speed up processing future queries (without -needing to iterate across the table). Likewise, it will cache a NULL -response if no ENGINE was available so that future queries won't repeat the -same iteration unless the state table changes. This behaviour can also be -changed; if the ENGINE_TABLE_FLAG_NOINIT flag is set (using -ENGINE_set_table_flags()), no attempted initialisations will take place, -instead the only way for the state table to return a non-NULL ENGINE to the -"get_default" query will be if one is expressly set in the table. Eg. -ENGINE_set_default_RSA() does the same job as ENGINE_register_RSA() except -that it also sets the state table's cached response for the "get_default" -query. In the case of abstractions like EVP_CIPHER, where implementations are -indexed by 'nid', these flags and cached-responses are distinct for each 'nid' -value. - -=head2 Application requirements - -This section will explain the basic things an application programmer should -support to make the most useful elements of the ENGINE functionality -available to the user. The first thing to consider is whether the -programmer wishes to make alternative ENGINE modules available to the -application and user. OpenSSL maintains an internal linked list of -"visible" ENGINEs from which it has to operate - at start-up, this list is -empty and in fact if an application does not call any ENGINE API calls and -it uses static linking against openssl, then the resulting application -binary will not contain any alternative ENGINE code at all. So the first -consideration is whether any/all available ENGINE implementations should be -made visible to OpenSSL - this is controlled by calling the various "load" -functions. - -The fact that ENGINEs are made visible to OpenSSL (and thus are linked into -the program and loaded into memory at run-time) does not mean they are -"registered" or called into use by OpenSSL automatically - that behaviour -is something for the application to control. Some applications -will want to allow the user to specify exactly which ENGINE they want used -if any is to be used at all. Others may prefer to load all support and have -OpenSSL automatically use at run-time any ENGINE that is able to -successfully initialise - i.e. to assume that this corresponds to -acceleration hardware attached to the machine or some such thing. There are -probably numerous other ways in which applications may prefer to handle -things, so we will simply illustrate the consequences as they apply to a -couple of simple cases and leave developers to consider these and the -source code to openssl's built-in utilities as guides. - -If no ENGINE API functions are called within an application, then OpenSSL -will not allocate any internal resources. Prior to OpenSSL 1.1.0, however, -if any ENGINEs are loaded, even if not registered or used, it was necessary to -call ENGINE_cleanup() before the program exits. - -I - -Here we'll assume an application has been configured by its user or admin -to want to use the "ACME" ENGINE if it is available in the version of -OpenSSL the application was compiled with. If it is available, it should be -used by default for all RSA, DSA, and symmetric cipher operations, otherwise -OpenSSL should use its built-in software as per usual. The following code -illustrates how to approach this; - - ENGINE *e; - const char *engine_id = "ACME"; - ENGINE_load_builtin_engines(); - e = ENGINE_by_id(engine_id); - if (!e) - /* the engine isn't available */ - return; - if (!ENGINE_init(e)) { - /* the engine couldn't initialise, release 'e' */ - ENGINE_free(e); - return; - } - if (!ENGINE_set_default_RSA(e)) - /* - * This should only happen when 'e' can't initialise, but the previous - * statement suggests it did. - */ - abort(); - ENGINE_set_default_DSA(e); - ENGINE_set_default_ciphers(e); - /* Release the functional reference from ENGINE_init() */ - ENGINE_finish(e); - /* Release the structural reference from ENGINE_by_id() */ - ENGINE_free(e); - -I - -Here we'll assume we want to load and register all ENGINE implementations -bundled with OpenSSL, such that for any cryptographic algorithm required by -OpenSSL - if there is an ENGINE that implements it and can be initialised, -it should be used. The following code illustrates how this can work; - - /* Load all bundled ENGINEs into memory and make them visible */ - ENGINE_load_builtin_engines(); - /* Register all of them for every algorithm they collectively implement */ - ENGINE_register_all_complete(); - -That's all that's required. Eg. the next time OpenSSL tries to set up an -RSA key, any bundled ENGINEs that implement RSA_METHOD will be passed to -ENGINE_init() and if any of those succeed, that ENGINE will be set as the -default for RSA use from then on. - -=head2 Advanced configuration support - -There is a mechanism supported by the ENGINE framework that allows each -ENGINE implementation to define an arbitrary set of configuration -"commands" and expose them to OpenSSL and any applications based on -OpenSSL. This mechanism is entirely based on the use of name-value pairs -and assumes ASCII input (no unicode or UTF for now!), so it is ideal if -applications want to provide a transparent way for users to provide -arbitrary configuration "directives" directly to such ENGINEs. It is also -possible for the application to dynamically interrogate the loaded ENGINE -implementations for the names, descriptions, and input flags of their -available "control commands", providing a more flexible configuration -scheme. However, if the user is expected to know which ENGINE device he/she -is using (in the case of specialised hardware, this goes without saying) -then applications may not need to concern themselves with discovering the -supported control commands and simply prefer to pass settings into ENGINEs -exactly as they are provided by the user. - -Before illustrating how control commands work, it is worth mentioning what -they are typically used for. Broadly speaking there are two uses for -control commands; the first is to provide the necessary details to the -implementation (which may know nothing at all specific to the host system) -so that it can be initialised for use. This could include the path to any -driver or config files it needs to load, required network addresses, -smart-card identifiers, passwords to initialise protected devices, -logging information, etc etc. This class of commands typically needs to be -passed to an ENGINE B attempting to initialise it, i.e. before -calling ENGINE_init(). The other class of commands consist of settings or -operations that tweak certain behaviour or cause certain operations to take -place, and these commands may work either before or after ENGINE_init(), or -in some cases both. ENGINE implementations should provide indications of -this in the descriptions attached to built-in control commands and/or in -external product documentation. - -I - -Let's illustrate by example; a function for which the caller supplies the -name of the ENGINE it wishes to use, a table of string-pairs for use before -initialisation, and another table for use after initialisation. Note that -the string-pairs used for control commands consist of a command "name" -followed by the command "parameter" - the parameter could be NULL in some -cases but the name can not. This function should initialise the ENGINE -(issuing the "pre" commands beforehand and the "post" commands afterwards) -and set it as the default for everything except RAND and then return a -boolean success or failure. - - int generic_load_engine_fn(const char *engine_id, - const char **pre_cmds, int pre_num, - const char **post_cmds, int post_num) - { - ENGINE *e = ENGINE_by_id(engine_id); - if (!e) return 0; - while (pre_num--) { - if (!ENGINE_ctrl_cmd_string(e, pre_cmds[0], pre_cmds[1], 0)) { - fprintf(stderr, "Failed command (%s - %s:%s)\n", engine_id, - pre_cmds[0], pre_cmds[1] ? pre_cmds[1] : "(NULL)"); - ENGINE_free(e); - return 0; - } - pre_cmds += 2; - } - if (!ENGINE_init(e)) { - fprintf(stderr, "Failed initialisation\n"); - ENGINE_free(e); - return 0; - } - /* - * ENGINE_init() returned a functional reference, so free the structural - * reference from ENGINE_by_id(). - */ - ENGINE_free(e); - while (post_num--) { - if (!ENGINE_ctrl_cmd_string(e, post_cmds[0], post_cmds[1], 0)) { - fprintf(stderr, "Failed command (%s - %s:%s)\n", engine_id, - post_cmds[0], post_cmds[1] ? post_cmds[1] : "(NULL)"); - ENGINE_finish(e); - return 0; - } - post_cmds += 2; - } - ENGINE_set_default(e, ENGINE_METHOD_ALL & ~ENGINE_METHOD_RAND); - /* Success */ - return 1; - } - -Note that ENGINE_ctrl_cmd_string() accepts a boolean argument that can -relax the semantics of the function - if set nonzero it will only return -failure if the ENGINE supported the given command name but failed while -executing it, if the ENGINE doesn't support the command name it will simply -return success without doing anything. In this case we assume the user is -only supplying commands specific to the given ENGINE so we set this to -FALSE. - -I - -It is possible to discover at run-time the names, numerical-ids, descriptions -and input parameters of the control commands supported by an ENGINE using a -structural reference. Note that some control commands are defined by OpenSSL -itself and it will intercept and handle these control commands on behalf of the -ENGINE, i.e. the ENGINE's ctrl() handler is not used for the control command. -F<< >> defines an index, ENGINE_CMD_BASE, that all control -commands implemented by ENGINEs should be numbered from. Any command value -lower than this symbol is considered a "generic" command is handled directly -by the OpenSSL core routines. - -It is using these "core" control commands that one can discover the control -commands implemented by a given ENGINE, specifically the commands: - - ENGINE_HAS_CTRL_FUNCTION - ENGINE_CTRL_GET_FIRST_CMD_TYPE - ENGINE_CTRL_GET_NEXT_CMD_TYPE - ENGINE_CTRL_GET_CMD_FROM_NAME - ENGINE_CTRL_GET_NAME_LEN_FROM_CMD - ENGINE_CTRL_GET_NAME_FROM_CMD - ENGINE_CTRL_GET_DESC_LEN_FROM_CMD - ENGINE_CTRL_GET_DESC_FROM_CMD - ENGINE_CTRL_GET_CMD_FLAGS - -Whilst these commands are automatically processed by the OpenSSL framework code, -they use various properties exposed by each ENGINE to process these -queries. An ENGINE has 3 properties it exposes that can affect how this behaves; -it can supply a ctrl() handler, it can specify ENGINE_FLAGS_MANUAL_CMD_CTRL in -the ENGINE's flags, and it can expose an array of control command descriptions. -If an ENGINE specifies the ENGINE_FLAGS_MANUAL_CMD_CTRL flag, then it will -simply pass all these "core" control commands directly to the ENGINE's ctrl() -handler (and thus, it must have supplied one), so it is up to the ENGINE to -reply to these "discovery" commands itself. If that flag is not set, then the -OpenSSL framework code will work with the following rules: - - if no ctrl() handler supplied; - ENGINE_HAS_CTRL_FUNCTION returns FALSE (zero), - all other commands fail. - if a ctrl() handler was supplied but no array of control commands; - ENGINE_HAS_CTRL_FUNCTION returns TRUE, - all other commands fail. - if a ctrl() handler and array of control commands was supplied; - ENGINE_HAS_CTRL_FUNCTION returns TRUE, - all other commands proceed processing ... - -If the ENGINE's array of control commands is empty then all other commands will -fail, otherwise; ENGINE_CTRL_GET_FIRST_CMD_TYPE returns the identifier of -the first command supported by the ENGINE, ENGINE_GET_NEXT_CMD_TYPE takes the -identifier of a command supported by the ENGINE and returns the next command -identifier or fails if there are no more, ENGINE_CMD_FROM_NAME takes a string -name for a command and returns the corresponding identifier or fails if no such -command name exists, and the remaining commands take a command identifier and -return properties of the corresponding commands. All except -ENGINE_CTRL_GET_FLAGS return the string length of a command name or description, -or populate a supplied character buffer with a copy of the command name or -description. ENGINE_CTRL_GET_FLAGS returns a bitwise-OR'd mask of the following -possible values: - - ENGINE_CMD_FLAG_NUMERIC - ENGINE_CMD_FLAG_STRING - ENGINE_CMD_FLAG_NO_INPUT - ENGINE_CMD_FLAG_INTERNAL - -If the ENGINE_CMD_FLAG_INTERNAL flag is set, then any other flags are purely -informational to the caller - this flag will prevent the command being usable -for any higher-level ENGINE functions such as ENGINE_ctrl_cmd_string(). -"INTERNAL" commands are not intended to be exposed to text-based configuration -by applications, administrations, users, etc. These can support arbitrary -operations via ENGINE_ctrl(), including passing to and/or from the control -commands data of any arbitrary type. These commands are supported in the -discovery mechanisms simply to allow applications to determine if an ENGINE -supports certain specific commands it might want to use (e.g. application "foo" -might query various ENGINEs to see if they implement "FOO_GET_VENDOR_LOGO_GIF" - -and ENGINE could therefore decide whether or not to support this "foo"-specific -extension). +All of these functions were removed since OpenSSL 4.0. If there is still a need +for these definitions to present (despite the support for engines being absent), +it is possible to define the B macro (before the inclusion +of the C header) to get stub definitions of the +aforementioned functions. =head1 ENVIRONMENT @@ -575,98 +178,31 @@ extension). =item B -The path to the engines directory. -Ignored in set-user-ID and set-group-ID programs. +This environment variable was removed in OpenSSL 4.0. =back =head1 RETURN VALUES -ENGINE_get_first(), ENGINE_get_last(), ENGINE_get_next() and ENGINE_get_prev() -return a valid B structure or NULL if an error occurred. - -ENGINE_add() and ENGINE_remove() return 1 on success or 0 on error. - -ENGINE_by_id() returns a valid B structure or NULL if an error occurred. - -ENGINE_init() and ENGINE_finish() return 1 on success or 0 on error. - -All ENGINE_get_default_TYPE() functions, ENGINE_get_cipher_engine() and -ENGINE_get_digest_engine() return a valid B structure on success or NULL -if an error occurred. - -All ENGINE_set_default_TYPE() functions return 1 on success or 0 on error. - -ENGINE_set_default() returns 1 on success or 0 on error. - -ENGINE_get_table_flags() returns an unsigned integer value representing the -global table flags which are used to control the registration behaviour of -B implementations. - -All ENGINE_register_TYPE() functions return 1 on success or 0 on error. - -ENGINE_register_complete() and ENGINE_register_all_complete() always return 1. - -ENGINE_ctrl() returns a positive value on success or others on error. - -ENGINE_cmd_is_executable() returns 1 if B is executable or 0 otherwise. - -ENGINE_ctrl_cmd() and ENGINE_ctrl_cmd_string() return 1 on success or 0 on error. - -ENGINE_new() returns a valid B structure on success or NULL if an error -occurred. - -ENGINE_free() always returns 1. - -ENGINE_up_ref() returns 1 on success or 0 on error. - -ENGINE_set_id() and ENGINE_set_name() return 1 on success or 0 on error. - -All other B functions return 1 on success or 0 on error. - -ENGINE_get_id() and ENGINE_get_name() return a string representing the identifier -and the name of the ENGINE B respectively. - -ENGINE_get_RSA(), ENGINE_get_DSA(), ENGINE_get_DH() and ENGINE_get_RAND() -return corresponding method structures for each algorithms. - -ENGINE_get_destroy_function(), ENGINE_get_init_function(), -ENGINE_get_finish_function(), ENGINE_get_ctrl_function(), -ENGINE_get_load_privkey_function(), ENGINE_get_load_pubkey_function(), -ENGINE_get_ciphers() and ENGINE_get_digests() return corresponding function -pointers of the callbacks. - -ENGINE_get_cipher() returns a valid B structure on success or NULL -if an error occurred. - -ENGINE_get_digest() returns a valid B structure on success or NULL if an -error occurred. - -ENGINE_get_flags() returns an integer representing the ENGINE flags which are -used to control various behaviours of an ENGINE. - -ENGINE_get_cmd_defns() returns an B structure or NULL if it's -not set. - -ENGINE_load_private_key() and ENGINE_load_public_key() return a valid B -structure on success or NULL if an error occurred. +When the B macro is defined, these functions will always +fail and will return either NULL or 0 depending on the nature of the function. =head1 SEE ALSO -L, L, L, L, -L, L +L =head1 HISTORY All of these functions were deprecated in OpenSSL 3.0. ENGINE_cleanup() was deprecated in OpenSSL 1.1.0 by the automatic cleanup -done by OPENSSL_cleanup() -and should not be used. +done by OPENSSL_cleanup() and should not be used. + +All of these functions were removed in OpenSSL 4.0. =head1 COPYRIGHT -Copyright 2002-2024 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2002-2025 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/ERR_put_error.pod b/doc/man3/ERR_put_error.pod index 56c73c13ef..9ba02a235e 100644 --- a/doc/man3/ERR_put_error.pod +++ b/doc/man3/ERR_put_error.pod @@ -107,8 +107,7 @@ with any sub-library code. =head3 Other pieces of software Other pieces of software that may want to use OpenSSL's error reporting -system, such as engines or applications, must normally get their own -numbers. +system, such as applications, must normally get their own numbers. =over 4 diff --git a/doc/man3/EVP_CIPHER_CTX_get_cipher_data.pod b/doc/man3/EVP_CIPHER_CTX_get_cipher_data.pod index efb2aca1b9..31797a7a1a 100644 --- a/doc/man3/EVP_CIPHER_CTX_get_cipher_data.pod +++ b/doc/man3/EVP_CIPHER_CTX_get_cipher_data.pod @@ -16,12 +16,11 @@ inspect and modify EVP_CIPHER_CTX objects The EVP_CIPHER_CTX_get_cipher_data() function returns a pointer to the cipher data relevant to EVP_CIPHER_CTX. The contents of this data is specific to the -particular implementation of the cipher. For example this data can be used by -engines to store engine specific information. The data is automatically -allocated and freed by OpenSSL, so applications and engines should not normally +particular implementation of the cipher. The data is automatically +allocated and freed by OpenSSL, so applications should not normally free this directly (but see below). -The EVP_CIPHER_CTX_set_cipher_data() function allows an application or engine to +The EVP_CIPHER_CTX_set_cipher_data() function allows an application to replace the cipher data with new data. A pointer to any existing cipher data is returned from this function. If the old data is no longer required then it should be freed through a call to OPENSSL_free(). diff --git a/doc/man3/EVP_DigestInit.pod b/doc/man3/EVP_DigestInit.pod index ddad2f8f88..804a76f73b 100644 --- a/doc/man3/EVP_DigestInit.pod +++ b/doc/man3/EVP_DigestInit.pod @@ -256,11 +256,12 @@ if the pointer is not NULL. At most B bytes will be written. =item EVP_Digest() -A wrapper around the Digest Init_ex, Update and Final_ex functions. -Hashes I bytes of data at I using a digest I from ENGINE -I. The digest value is placed in I and its length is written at I -if the pointer is not NULL. At most B bytes will be written. -If I is NULL the default implementation of digest I is used. +A wrapper around the EVP_DigestInit_ex(), EVP_DigestUpdate() and +EVP_DigestFinal_ex() functions. +Hashes I bytes of data at I. The digest value is placed in I +and its length is written at I if the pointer is not NULL. At most +B bytes will be written. I B be NULL and the +default implementation of digest I is used. =item EVP_DigestInit_ex2() @@ -545,7 +546,7 @@ EVP_MD_CTX_get_params() can be used with the following OSSL_PARAM keys: Gets the digest Message Integrity Check algorithm string. This is used when creating S/MIME multipart/signed messages, as specified in RFC 3851. -It may be used by external engines or providers. +It may be used by external providers. =back diff --git a/doc/man3/EVP_DigestSignInit.pod b/doc/man3/EVP_DigestSignInit.pod index 68baac639f..dbdb87af72 100644 --- a/doc/man3/EVP_DigestSignInit.pod +++ b/doc/man3/EVP_DigestSignInit.pod @@ -113,8 +113,7 @@ If RSA-PSS is used and restrictions apply then the digest must match. EVP_DigestSignInit() works in the same way as EVP_DigestSignInit_ex() except that the I parameter will be inferred from the supplied -digest I, and I will be NULL. Where supplied the ENGINE I will -be used for the signing and digest algorithm implementations. I may be NULL. +digest I, and I will be NULL. I B be NULL. EVP_DigestSignUpdate() hashes I bytes of data at I into the signature context I. This function can be called several times on the diff --git a/doc/man3/EVP_DigestVerifyInit.pod b/doc/man3/EVP_DigestVerifyInit.pod index dc694308f9..d195425e46 100644 --- a/doc/man3/EVP_DigestVerifyInit.pod +++ b/doc/man3/EVP_DigestVerifyInit.pod @@ -104,9 +104,8 @@ If RSA-PSS is used and restrictions apply then the digest must match. EVP_DigestVerifyInit() works in the same way as EVP_DigestVerifyInit_ex() except that the B parameter will be -inferred from the supplied digest B, and B will be NULL. Where -supplied the ENGINE B will be used for the signature verification and digest -algorithm implementations. B may be NULL. +inferred from the supplied digest B, and B will be NULL. +B B be NULL. EVP_DigestVerifyUpdate() hashes B bytes of data at B into the verification context B. This function can be called several times on the diff --git a/doc/man3/EVP_EncryptInit.pod b/doc/man3/EVP_EncryptInit.pod index 3c62659319..05801a17a5 100644 --- a/doc/man3/EVP_EncryptInit.pod +++ b/doc/man3/EVP_EncryptInit.pod @@ -395,9 +395,8 @@ specified. =item EVP_EncryptInit_ex() -This legacy function is similar to EVP_EncryptInit_ex2() when I is NULL. -The implementation of the I from the I engine will be used if it -exists. +This legacy function is the same as EVP_EncryptInit_ex2() except B will +be NULL. I B be NULL. =item EVP_EncryptUpdate() diff --git a/doc/man3/EVP_PKEY_CTX_get0_libctx.pod b/doc/man3/EVP_PKEY_CTX_get0_libctx.pod index 81332b8c70..20645a3e86 100644 --- a/doc/man3/EVP_PKEY_CTX_get0_libctx.pod +++ b/doc/man3/EVP_PKEY_CTX_get0_libctx.pod @@ -22,8 +22,7 @@ OSSL_LIB_CTX and property query string values respectively that were associated with the EVP_PKEY_CTX when it was constructed. EVP_PKEY_CTX_get0_provider() returns the provider associated with the -ongoing B operation. If the operation is performed by -en B, this function returns NULL. +ongoing B operation. =head1 RETURN VALUES diff --git a/doc/man3/EVP_PKEY_CTX_new.pod b/doc/man3/EVP_PKEY_CTX_new.pod index a15abc2c3e..fff102a769 100644 --- a/doc/man3/EVP_PKEY_CTX_new.pod +++ b/doc/man3/EVP_PKEY_CTX_new.pod @@ -26,10 +26,10 @@ EVP_PKEY_CTX_is_a =head1 DESCRIPTION The EVP_PKEY_CTX_new() function allocates public key algorithm context using -the I key type and ENGINE I. +the I key type. I B be NULL. The EVP_PKEY_CTX_new_id() function allocates public key algorithm context -using the key type specified by I and ENGINE I. +using the key type specified by I. I B be NULL. The EVP_PKEY_CTX_new_from_name() function allocates a public key algorithm context using the library context I (see L), the diff --git a/doc/man3/EVP_PKEY_CTX_set_hkdf_md.pod b/doc/man3/EVP_PKEY_CTX_set_hkdf_md.pod index 81ee5c485b..f16b3bcb5a 100644 --- a/doc/man3/EVP_PKEY_CTX_set_hkdf_md.pod +++ b/doc/man3/EVP_PKEY_CTX_set_hkdf_md.pod @@ -111,8 +111,6 @@ desired length, and pass that buffer to L along with (a pointer initialized to) the desired length. Passing a B buffer to obtain the length is allowed when using EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY. -Optimised versions of HKDF can be implemented in an ENGINE. - =head1 RETURN VALUES All these functions return 1 for success and 0 or a negative value for failure. diff --git a/doc/man3/EVP_PKEY_CTX_set_tls1_prf_md.pod b/doc/man3/EVP_PKEY_CTX_set_tls1_prf_md.pod index 9c204b8b32..333a910d3e 100644 --- a/doc/man3/EVP_PKEY_CTX_set_tls1_prf_md.pod +++ b/doc/man3/EVP_PKEY_CTX_set_tls1_prf_md.pod @@ -60,8 +60,6 @@ The output length of the PRF is specified by the length parameter in the EVP_PKEY_derive() function. Since the output length is variable, setting the buffer to B is not meaningful for the TLS PRF. -Optimised versions of the TLS PRF can be implemented in an ENGINE. - =head1 RETURN VALUES All these functions return 1 for success and 0 or a negative value for failure. @@ -102,7 +100,7 @@ OpenSSL 3.0. =head1 COPYRIGHT -Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/EVP_PKEY_asn1_get_count.pod b/doc/man3/EVP_PKEY_asn1_get_count.pod index 3cb5faee6c..f367c74b04 100644 --- a/doc/man3/EVP_PKEY_asn1_get_count.pod +++ b/doc/man3/EVP_PKEY_asn1_get_count.pod @@ -39,16 +39,13 @@ The value of B must be between zero and EVP_PKEY_asn1_get_count() EVP_PKEY_asn1_find() looks up the B with NID B. -If B isn't B, then it will look up an engine implementing a -B for the NID B and return that instead, -and also set B<*pe> to point at the engine that implements it. +If B isn't B, then NULL will be placed at the given address, as +ENGINEs were removed, therefore none can be found. EVP_PKEY_asn1_find_str() looks up the B with PEM type string B. -Just like EVP_PKEY_asn1_find(), if B isn't B, then it will -look up an engine implementing a B for the NID -B and return that instead, and also set B<*pe> to point at the -engine that implements it. +Just like EVP_PKEY_asn1_find(), if B isn't B, then NULL will be placed +at the given address, as ENGINEs were removed, therefore none can be found. EVP_PKEY_asn1_get0_info() returns the public key ID, base public key ID (both NIDs), any flags, the method description and PEM type string diff --git a/doc/man3/EVP_PKEY_decrypt.pod b/doc/man3/EVP_PKEY_decrypt.pod index 7d6807d68b..5e624e8c61 100644 --- a/doc/man3/EVP_PKEY_decrypt.pod +++ b/doc/man3/EVP_PKEY_decrypt.pod @@ -80,16 +80,15 @@ Decrypt data using OAEP (for RSA keys): #include EVP_PKEY_CTX *ctx; - ENGINE *eng; unsigned char *out, *in; size_t outlen, inlen; EVP_PKEY *key; /* - * NB: assumes key, eng, in, inlen are already set up + * NB: assumes key, in, inlen are already set up * and that key is an RSA private key */ - ctx = EVP_PKEY_CTX_new(key, eng); + ctx = EVP_PKEY_CTX_new(key, NULL); if (!ctx) /* Error occurred */ if (EVP_PKEY_decrypt_init(ctx) <= 0) diff --git a/doc/man3/EVP_PKEY_derive.pod b/doc/man3/EVP_PKEY_derive.pod index 391d79875a..792e2bbf4b 100644 --- a/doc/man3/EVP_PKEY_derive.pod +++ b/doc/man3/EVP_PKEY_derive.pod @@ -81,13 +81,12 @@ Derive shared secret (for example DH or EC keys): #include EVP_PKEY_CTX *ctx; - ENGINE *eng; unsigned char *skey; size_t skeylen; EVP_PKEY *pkey, *peerkey; - /* NB: assumes pkey, eng, peerkey have been already set up */ + /* NB: assumes pkey, peerkey have been already set up */ - ctx = EVP_PKEY_CTX_new(pkey, eng); + ctx = EVP_PKEY_CTX_new(pkey, NULL); if (!ctx) /* Error occurred */ if (EVP_PKEY_derive_init(ctx) <= 0) diff --git a/doc/man3/EVP_PKEY_encrypt.pod b/doc/man3/EVP_PKEY_encrypt.pod index c5d91e1c18..1fb41f99f4 100644 --- a/doc/man3/EVP_PKEY_encrypt.pod +++ b/doc/man3/EVP_PKEY_encrypt.pod @@ -52,24 +52,21 @@ algorithm. =head1 EXAMPLES Encrypt data using OAEP (for RSA keys). See also L or -L for means to load a public key. You may also simply -set 'eng = NULL;' to start with the default OpenSSL RSA implementation: +L for means to load a public key. #include #include - #include EVP_PKEY_CTX *ctx; - ENGINE *eng; unsigned char *out, *in; size_t outlen, inlen; EVP_PKEY *key; /* - * NB: assumes eng, key, in, inlen are already set up, + * NB: assumes key, in, inlen are already set up, * and that key is an RSA public key */ - ctx = EVP_PKEY_CTX_new(key, eng); + ctx = EVP_PKEY_CTX_new(key, NULL); if (!ctx) /* Error occurred */ if (EVP_PKEY_encrypt_init(ctx) <= 0) @@ -94,7 +91,6 @@ set 'eng = NULL;' to start with the default OpenSSL RSA implementation: =head1 SEE ALSO L, -L, L, L, L, diff --git a/doc/man3/EVP_PKEY_get_default_digest_nid.pod b/doc/man3/EVP_PKEY_get_default_digest_nid.pod index e22a3e7b47..726d129b52 100644 --- a/doc/man3/EVP_PKEY_get_default_digest_nid.pod +++ b/doc/man3/EVP_PKEY_get_default_digest_nid.pod @@ -27,8 +27,7 @@ I. Note that some signature algorithms (i.e. Ed25519 and Ed448) do not use a digest during signing. In this case I will be set to NID_undef. This function is only reliable for legacy keys, which are keys with a B; these keys have typically -been loaded from engines, or created with L or -similar. +been created with L or similar. =head1 NOTES diff --git a/doc/man3/EVP_PKEY_keygen.pod b/doc/man3/EVP_PKEY_keygen.pod index 9cdea5b362..82bfa5cad6 100644 --- a/doc/man3/EVP_PKEY_keygen.pod +++ b/doc/man3/EVP_PKEY_keygen.pod @@ -177,11 +177,10 @@ Generate a key from a set of parameters: #include EVP_PKEY_CTX *ctx; - ENGINE *eng; EVP_PKEY *pkey = NULL, *param; - /* Assumed param, eng are set up already */ - ctx = EVP_PKEY_CTX_new(param, eng); + /* Assumed param is set up already */ + ctx = EVP_PKEY_CTX_new(param, NULL); if (!ctx) /* Error occurred */ if (EVP_PKEY_keygen_init(ctx) <= 0) diff --git a/doc/man3/EVP_PKEY_new.pod b/doc/man3/EVP_PKEY_new.pod index 0a56600c2b..a7a1777c2e 100644 --- a/doc/man3/EVP_PKEY_new.pod +++ b/doc/man3/EVP_PKEY_new.pod @@ -63,7 +63,7 @@ B is a generic structure to hold diverse types of asymmetric keys (also known as "key pairs"), and can be used for diverse operations, like signing, verifying signatures, key derivation, etc. The asymmetric keys themselves are often referred to as the "internal key", and are handled by -backends, such as providers (through L) or Bs. +providers through L. Conceptually, an B internal key may hold a private key, a public key, or both (a keypair), and along with those, key parameters if the key type @@ -84,17 +84,17 @@ B<1>. EVP_PKEY_up_ref() increments the reference count of I. -EVP_PKEY_dup() duplicates the I. The I must not be ENGINE based or -a raw key, otherwise the duplication will fail. +EVP_PKEY_dup() duplicates the I. The I must not be a raw key, +otherwise the duplication will fail. EVP_PKEY_free() decrements the reference count of I and, if the reference count is zero, frees it up. If I is NULL, nothing is done. -EVP_PKEY_new_raw_private_key_ex() allocates a new B. Unless an -engine should be used for the key type, a provider for the key is found using -the library context I and the property query string I. The -I argument indicates what kind of key this is. The value should be a -string for a public key algorithm that supports raw private keys, e.g., one of: +EVP_PKEY_new_raw_private_key_ex() allocates a new B. A provider for +the key is found using the library context I and the property query +string I. The I argument indicates what kind of key this is. +The value should be a string for a public key algorithm that supports raw +private keys, e.g., one of: C, C, C, @@ -114,11 +114,10 @@ algorithm type). EVP_PKEY_new_raw_private_key() does the same as EVP_PKEY_new_raw_private_key_ex() except that the default library context and -default property query are used instead. If I is non-NULL then the new -B structure is associated with the engine I. The I argument -indicates what kind of key this is. The value should be a NID for a public key -algorithm that supports raw private keys, i.e. one of B, -B, B or B. +default property query are used instead. I B be NULL. The I +argument indicates what kind of key this is. The value should be a NID for a +public key algorithm that supports raw private keys, i.e. one of +B, B, B or B. EVP_PKEY_new_raw_private_key_ex() and EVP_PKEY_new_raw_private_key() may also be used with most MACs implemented as public key algorithms, so key types such diff --git a/doc/man3/EVP_PKEY_set1_RSA.pod b/doc/man3/EVP_PKEY_set1_RSA.pod index 6489b11894..0a3c83447f 100644 --- a/doc/man3/EVP_PKEY_set1_RSA.pod +++ b/doc/man3/EVP_PKEY_set1_RSA.pod @@ -9,7 +9,6 @@ EVP_PKEY_assign_RSA, EVP_PKEY_assign_DSA, EVP_PKEY_assign_DH, EVP_PKEY_assign_EC_KEY, EVP_PKEY_assign_POLY1305, EVP_PKEY_assign_SIPHASH, EVP_PKEY_get0_hmac, EVP_PKEY_get0_poly1305, EVP_PKEY_get0_siphash, EVP_PKEY_get0, EVP_PKEY_type, EVP_PKEY_get_id, EVP_PKEY_get_base_id, -EVP_PKEY_set1_engine, EVP_PKEY_get0_engine, EVP_PKEY_id, EVP_PKEY_base_id - EVP_PKEY assignment functions @@ -54,9 +53,6 @@ see L: int EVP_PKEY_assign_POLY1305(EVP_PKEY *pkey, ASN1_OCTET_STRING *key); int EVP_PKEY_assign_SIPHASH(EVP_PKEY *pkey, ASN1_OCTET_STRING *key); - ENGINE *EVP_PKEY_get0_engine(const EVP_PKEY *pkey); - int EVP_PKEY_set1_engine(EVP_PKEY *pkey, ENGINE *engine); - =head1 DESCRIPTION EVP_PKEY_get_base_id() returns the type of I. For example @@ -126,16 +122,6 @@ the provider's key. Subsequent calls to EVP_PKEY_get1_RSA(), EVP_PKEY_get1_DSA(), EVP_PKEY_get1_DH() and EVP_PKEY_get1_EC_KEY() will always return the cached copy returned by the first call. -EVP_PKEY_get0_engine() returns a reference to the ENGINE handling I. This -function is deprecated. Applications should use providers instead of engines -(see L for details). - -EVP_PKEY_set1_engine() sets the ENGINE handling I to I. It -must be called after the key algorithm and components are set up. -If I does not include an B for I an -error occurs. This function is deprecated. Applications should use providers -instead of engines (see L for details). - =head1 WARNINGS The following functions are only reliable with Bs that have @@ -181,9 +167,6 @@ Previous versions of this document suggested using EVP_PKEY_type(pkey->type) to determine the type of a key. Since B is now opaque this is no longer possible: the equivalent is EVP_PKEY_get_base_id(pkey). -EVP_PKEY_set1_engine() is typically used by an ENGINE returning an HSM -key as part of its routine to load a private key. - =head1 RETURN VALUES EVP_PKEY_set1_RSA(), EVP_PKEY_set1_DSA(), EVP_PKEY_set1_DH() and @@ -200,8 +183,6 @@ and EVP_PKEY_assign_SIPHASH() return 1 for success and 0 for failure. EVP_PKEY_get_base_id(), EVP_PKEY_get_id() and EVP_PKEY_type() return a key type or B (equivalently B) on error. -EVP_PKEY_set1_engine() returns 1 for success and 0 for failure. - =head1 SEE ALSO L, L @@ -217,8 +198,8 @@ EVP_PKEY_get1_RSA, EVP_PKEY_get1_DSA, EVP_PKEY_get1_DH, EVP_PKEY_get1_EC_KEY, EVP_PKEY_get0_RSA, EVP_PKEY_get0_DSA, EVP_PKEY_get0_DH, EVP_PKEY_get0_EC_KEY, EVP_PKEY_assign_RSA, EVP_PKEY_assign_DSA, EVP_PKEY_assign_DH, EVP_PKEY_assign_EC_KEY, EVP_PKEY_assign_POLY1305, EVP_PKEY_assign_SIPHASH, -EVP_PKEY_get0_hmac, EVP_PKEY_get0_poly1305, EVP_PKEY_get0_siphash, -EVP_PKEY_set1_engine and EVP_PKEY_get0_engine were deprecated in OpenSSL 3.0. +EVP_PKEY_get0_hmac, EVP_PKEY_get0_poly1305 and EVP_PKEY_get0_siphash +were deprecated in OpenSSL 3.0. The return value from EVP_PKEY_get0_RSA, EVP_PKEY_get0_DSA, EVP_PKEY_get0_DH, EVP_PKEY_get0_EC_KEY were made const in OpenSSL 3.0. diff --git a/doc/man3/EVP_PKEY_sign.pod b/doc/man3/EVP_PKEY_sign.pod index 300f77889f..852da754e8 100644 --- a/doc/man3/EVP_PKEY_sign.pod +++ b/doc/man3/EVP_PKEY_sign.pod @@ -164,7 +164,7 @@ Sign data using RSA with PKCS#1 padding and a SHA256 digest as input: * step. signing_key must be an RSA private key and md must * point to the SHA-256 digest to be signed. */ - ctx = EVP_PKEY_CTX_new(signing_key, NULL /* no engine */); + ctx = EVP_PKEY_CTX_new(signing_key, NULL); if (ctx == NULL) /* Error occurred */ if (EVP_PKEY_sign_init(ctx) <= 0) @@ -209,7 +209,7 @@ input digest is assumed to have been computed using SHA256. * step. signing_key must be an RSA private key and md must * point to the SHA-256 digest to be signed. */ - ctx = EVP_PKEY_CTX_new(signing_key, NULL /* no engine */); + ctx = EVP_PKEY_CTX_new(signing_key, NULL); alg = EVP_SIGNATURE_fetch(NULL, "RSA-SHA256", NULL); if (ctx == NULL) @@ -256,7 +256,7 @@ B. * in must point to data to be digested and signed, and * inlen must be the size of the data in bytes. */ - ctx = EVP_PKEY_CTX_new(signing_key, NULL /* no engine */); + ctx = EVP_PKEY_CTX_new(signing_key, NULL); alg = EVP_SIGNATURE_fetch(NULL, "RSA-SHA256", NULL); if (ctx == NULL || alg == NULL) @@ -301,7 +301,7 @@ functionality. * in must point to data to be digested and signed, and * inlen must be the size of the data in bytes. */ - ctx = EVP_PKEY_CTX_new(signing_key, NULL /* no engine */); + ctx = EVP_PKEY_CTX_new(signing_key, NULL); alg = EVP_SIGNATURE_fetch(NULL, "RSA-SHA256", NULL); if (ctx == NULL || alg == NULL) diff --git a/doc/man3/EVP_PKEY_verify.pod b/doc/man3/EVP_PKEY_verify.pod index c0a097031a..07f152ce46 100644 --- a/doc/man3/EVP_PKEY_verify.pod +++ b/doc/man3/EVP_PKEY_verify.pod @@ -174,7 +174,7 @@ Verify signature using PKCS#1 padding and a SHA256 digest as input: * NB: assumes verify_key, sig, siglen md and mdlen are already set up * and that verify_key is an RSA public key */ - ctx = EVP_PKEY_CTX_new(verify_key, NULL /* no engine */); + ctx = EVP_PKEY_CTX_new(verify_key, NULL); if (ctx == NULL) /* Error occurred */ if (EVP_PKEY_verify_init(ctx) <= 0) @@ -212,7 +212,7 @@ input digest is assumed to have been computed using SHA256. * NB: assumes verify_key, sig, siglen, md and mdlen are already set up * and that verify_key is an RSA public key */ - ctx = EVP_PKEY_CTX_new(signing_key, NULL /* no engine */); + ctx = EVP_PKEY_CTX_new(signing_key, NULL); alg = EVP_SIGNATURE_fetch(NULL, "RSA-SHA256", NULL); if (ctx == NULL) @@ -256,7 +256,7 @@ B. * in must point to data to be digested and signed, and * inlen must be the size of the data in bytes. */ - ctx = EVP_PKEY_CTX_new(signing_key, NULL /* no engine */); + ctx = EVP_PKEY_CTX_new(signing_key, NULL); alg = EVP_SIGNATURE_fetch(NULL, "RSA-SHA256", NULL); if (ctx == NULL || alg == NULL) @@ -294,7 +294,7 @@ functionality. * in must point to data to be digested and signed, and * inlen must be the size of the data in bytes. */ - ctx = EVP_PKEY_CTX_new(signing_key, NULL /* no engine */); + ctx = EVP_PKEY_CTX_new(signing_key, NULL); alg = EVP_SIGNATURE_fetch(NULL, "RSA-SHA256", NULL); if (ctx == NULL || alg == NULL) diff --git a/doc/man3/EVP_PKEY_verify_recover.pod b/doc/man3/EVP_PKEY_verify_recover.pod index d859f68a46..10084d61c1 100644 --- a/doc/man3/EVP_PKEY_verify_recover.pod +++ b/doc/man3/EVP_PKEY_verify_recover.pod @@ -90,7 +90,7 @@ Recover digest originally signed using PKCS#1 and SHA256 digest: * NB: assumes verify_key, sig and siglen are already set up * and that verify_key is an RSA public key */ - ctx = EVP_PKEY_CTX_new(verify_key, NULL /* no engine */); + ctx = EVP_PKEY_CTX_new(verify_key, NULL); if (!ctx) /* Error occurred */ if (EVP_PKEY_verify_recover_init(ctx) <= 0) diff --git a/doc/man3/EVP_SignInit.pod b/doc/man3/EVP_SignInit.pod index 553ce0e347..4c3c15b7d0 100644 --- a/doc/man3/EVP_SignInit.pod +++ b/doc/man3/EVP_SignInit.pod @@ -25,7 +25,7 @@ The EVP signature routines are a high-level interface to digital signatures. EVP_SignInit_ex() sets up signing context I to use digest -I from B I. I must be created with +I. I B be NULL. I must be created with EVP_MD_CTX_new() before calling this function. EVP_SignUpdate() hashes I bytes of data at I into the diff --git a/doc/man3/EVP_VerifyInit.pod b/doc/man3/EVP_VerifyInit.pod index 0459804671..f242cceaf2 100644 --- a/doc/man3/EVP_VerifyInit.pod +++ b/doc/man3/EVP_VerifyInit.pod @@ -26,8 +26,8 @@ The EVP signature verification routines are a high-level interface to digital signatures. EVP_VerifyInit_ex() sets up verification context I to use digest -I from ENGINE I. I must be created by calling -EVP_MD_CTX_new() before calling this function. +I. I B be created by calling EVP_MD_CTX_new() before calling +this function. I B be NULL. EVP_VerifyUpdate() hashes I bytes of data at I into the verification context I. This function can be called several times on the @@ -104,7 +104,7 @@ The function EVP_VerifyFinal_ex() was added in OpenSSL 3.0. =head1 COPYRIGHT -Copyright 2000-2023 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/HMAC.pod b/doc/man3/HMAC.pod index ebe69d2db9..53a3853eb2 100644 --- a/doc/man3/HMAC.pod +++ b/doc/man3/HMAC.pod @@ -95,9 +95,9 @@ stored in memory: HMAC_Init_ex() initializes or reuses a B structure to use the hash function I and key I. If both are NULL, or if I is NULL and I is the same as the previous call, then the -existing key is -reused. I must have been created with HMAC_CTX_new() before the first use -of an B in this function. +existing key is reused. I must have been created with HMAC_CTX_new() +before the first use of an B in this function. I B +be NULL. If HMAC_Init_ex() is called with I NULL and I is not the same as the previous digest used by I then an error is returned diff --git a/doc/man3/OPENSSL_config.pod b/doc/man3/OPENSSL_config.pod index 60f1c5a658..08827e98b7 100644 --- a/doc/man3/OPENSSL_config.pod +++ b/doc/man3/OPENSSL_config.pod @@ -41,15 +41,6 @@ and its use should be avoided. Applications should instead call CONF_modules_load() during initialization (that is before starting any threads). -There are several reasons why calling the OpenSSL configuration routines is -advisable. For example, to load dynamic ENGINEs from shared libraries (DSOs). -However, very few applications currently support the control interface and so -very few can load and use dynamic ENGINEs. Equally in future more sophisticated -ENGINEs will require certain control operations to customize them. If an -application calls OPENSSL_config() it doesn't need to know or care about -ENGINE control operations because they can be performed by editing a -configuration file. - =head1 ENVIRONMENT =over 4 @@ -77,7 +68,7 @@ deprecated in OpenSSL 1.1.0 by OPENSSL_init_crypto(). =head1 COPYRIGHT -Copyright 2004-2020 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2004-2025 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/OPENSSL_init_crypto.pod b/doc/man3/OPENSSL_init_crypto.pod index c06e81500e..3ef6aba822 100644 --- a/doc/man3/OPENSSL_init_crypto.pod +++ b/doc/man3/OPENSSL_init_crypto.pod @@ -119,55 +119,6 @@ option. With this option the library with automatically initialise the libcrypto async sub-library (see L). This is a default option. -=item OPENSSL_INIT_ENGINE_RDRAND - -With this option the library will automatically load and initialise the -RDRAND engine (if available). This not a default option and is deprecated -in OpenSSL 3.0. - -=item OPENSSL_INIT_ENGINE_DYNAMIC - -With this option the library will automatically load and initialise the -dynamic engine. This not a default option and is deprecated -in OpenSSL 3.0. - -=item OPENSSL_INIT_ENGINE_OPENSSL - -With this option the library will automatically load and initialise the -openssl engine. This not a default option and is deprecated -in OpenSSL 3.0. - -=item OPENSSL_INIT_ENGINE_CRYPTODEV - -With this option the library will automatically load and initialise the -cryptodev engine (if available). This not a default option and is deprecated -in OpenSSL 3.0. - -=item OPENSSL_INIT_ENGINE_CAPI - -With this option the library will automatically load and initialise the -CAPI engine (if available). This not a default option and is deprecated -in OpenSSL 3.0. - -=item OPENSSL_INIT_ENGINE_PADLOCK - -With this option the library will automatically load and initialise the -padlock engine (if available). This not a default option and is deprecated -in OpenSSL 3.0. - -=item OPENSSL_INIT_ENGINE_AFALG - -With this option the library will automatically load and initialise the -AFALG engine. This not a default option and is deprecated -in OpenSSL 3.0. - -=item OPENSSL_INIT_ENGINE_ALL_BUILTIN - -With this option the library will automatically load and initialise all the -built in engines listed above with the exception of the openssl and afalg -engines. This not a default option and is deprecated -in OpenSSL 3.0. - =item OPENSSL_INIT_ATFORK With this option the library will register its fork handlers. @@ -288,6 +239,14 @@ The OPENSSL_init_crypto(), OPENSSL_cleanup(), OPENSSL_atexit(), OPENSSL_thread_stop(), OPENSSL_INIT_new(), OPENSSL_INIT_set_config_appname() and OPENSSL_INIT_free() functions were added in OpenSSL 1.1.0. +B, B, +B, B, +B, B, +B OPENSSL_init_crypto() I were removed in +OpenSSL 4.0. + +B is defined to 0 since OpenSSL 4.0. + =head1 COPYRIGHT Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man3/OPENSSL_load_builtin_modules.pod b/doc/man3/OPENSSL_load_builtin_modules.pod index 126ef8331a..90f6a92237 100644 --- a/doc/man3/OPENSSL_load_builtin_modules.pod +++ b/doc/man3/OPENSSL_load_builtin_modules.pod @@ -2,7 +2,8 @@ =head1 NAME -OPENSSL_load_builtin_modules, ASN1_add_oid_module, ENGINE_add_conf_module - add standard configuration modules +OPENSSL_load_builtin_modules, ASN1_add_oid_module +- add standard configuration modules =head1 SYNOPSIS @@ -10,7 +11,6 @@ OPENSSL_load_builtin_modules, ASN1_add_oid_module, ENGINE_add_conf_module - add void OPENSSL_load_builtin_modules(void); void ASN1_add_oid_module(void); - void ENGINE_add_conf_module(void); =head1 DESCRIPTION @@ -20,8 +20,6 @@ OpenSSL configuration code. ASN1_add_oid_module() adds just the ASN1 OBJECT module. -ENGINE_add_conf_module() adds just the ENGINE configuration module. - =head1 NOTES If the simple configuration function OPENSSL_config() is called then @@ -44,10 +42,6 @@ None of the functions return a value. L, L -=head1 HISTORY - -ENGINE_add_conf_module() was deprecated in OpenSSL 3.0. - =head1 COPYRIGHT Copyright 2004-2020 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man3/OSSL_STORE_LOADER.pod b/doc/man3/OSSL_STORE_LOADER.pod index f1752b2a02..f88c15a844 100644 --- a/doc/man3/OSSL_STORE_LOADER.pod +++ b/doc/man3/OSSL_STORE_LOADER.pod @@ -13,7 +13,7 @@ OSSL_STORE_LOADER_get0_description, OSSL_STORE_LOADER_do_all_provided, OSSL_STORE_LOADER_names_do_all, OSSL_STORE_LOADER_CTX, OSSL_STORE_LOADER_new, -OSSL_STORE_LOADER_get0_engine, OSSL_STORE_LOADER_get0_scheme, +OSSL_STORE_LOADER_get0_scheme, OSSL_STORE_LOADER_set_open, OSSL_STORE_LOADER_set_open_ex, OSSL_STORE_LOADER_set_attach, OSSL_STORE_LOADER_set_ctrl, OSSL_STORE_LOADER_set_expect, OSSL_STORE_LOADER_set_find, @@ -60,8 +60,6 @@ hidden entirely by defining B with a suitable version value, see L: OSSL_STORE_LOADER *OSSL_STORE_LOADER_new(ENGINE *e, const char *scheme); - const ENGINE *OSSL_STORE_LOADER_get0_engine(const OSSL_STORE_LOADER - *store_loader); const char *OSSL_STORE_LOADER_get0_scheme(const OSSL_STORE_LOADER *store_loader); @@ -158,7 +156,7 @@ L. =head2 Legacy Types and Functions (deprecated) -These functions help applications and engines to create loaders for +These functions help applications to create loaders for schemes they support. These are all deprecated and discouraged in favour of provider implementations, see L. @@ -272,12 +270,10 @@ It returns 1 on success and 0 on error. =back OSSL_STORE_LOADER_new() creates a new B. -It takes an B I and a string I. -I must I be set. -Both I and I are used as is and must therefore be alive as -long as the created loader is. +It takes a string I. I must I be set. +I B be NULL. I is used as is and must therefore be alive +as long as the created loader is. -OSSL_STORE_LOADER_get0_engine() returns the engine of the I. OSSL_STORE_LOADER_get0_scheme() returns the scheme of the I. OSSL_STORE_LOADER_set_open() sets the opener function for the @@ -393,6 +389,8 @@ were added in OpenSSL 1.1.1, and became deprecated in OpenSSL 3.0. OSSL_STORE_LOADER_settable_ctx_params() was added in OpenSSL 3.6. +The OSSL_STORE_LOADER_get0_engine() was removed in OpenSSL 4.0. + =head1 COPYRIGHT Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man3/OSSL_trace_enabled.pod b/doc/man3/OSSL_trace_enabled.pod index 273d7da799..7ecb376b7c 100644 --- a/doc/man3/OSSL_trace_enabled.pod +++ b/doc/man3/OSSL_trace_enabled.pod @@ -53,8 +53,7 @@ OSSL_TRACE_ENABLED =head1 DESCRIPTION The functions described here are mainly interesting for those who provide -OpenSSL functionality, either in OpenSSL itself or in engine modules -or similar. +OpenSSL functionality, either in OpenSSL itself or in a provider or similar. If the tracing facility is enabled (see L below), these functions are used to generate free text tracing output. diff --git a/doc/man3/OSSL_trace_set_channel.pod b/doc/man3/OSSL_trace_set_channel.pod index 0db38e8db0..c4345f22fd 100644 --- a/doc/man3/OSSL_trace_set_channel.pod +++ b/doc/man3/OSSL_trace_set_channel.pod @@ -145,23 +145,7 @@ Traces the ciphers used by the TLS/SSL protocol. =item B -Traces details about the provider and engine configuration. - -=item B - -Traces the ENGINE algorithm table selection. - -More precisely, functions like ENGINE_get_pkey_asn1_meth_engine(), -ENGINE_get_pkey_meth_engine(), ENGINE_get_cipher_engine(), -ENGINE_get_digest_engine(), will generate trace summaries of the -handling of internal tables. - -=item B - -Traces the ENGINE reference counting. - -More precisely, both reference counts in the ENGINE structure will be -monitored with a line of trace output generated for each change. +Traces details about the provider configuration. =item B @@ -334,6 +318,10 @@ OSSL_trace_set_channel(), OSSL_trace_set_prefix(), OSSL_trace_set_suffix(), and OSSL_trace_set_callback() were all added in OpenSSL 3.0. +The B and +B tracing categories were removed in +OpenSSL 4.0. For details please see L + =head1 COPYRIGHT Copyright 2019-2023 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man3/OpenSSL_version.pod b/doc/man3/OpenSSL_version.pod index fc30dc0737..d978eb35ee 100644 --- a/doc/man3/OpenSSL_version.pod +++ b/doc/man3/OpenSSL_version.pod @@ -142,12 +142,6 @@ if available, or C otherwise. The B setting of the library build in the form C if available, or C otherwise. -=item OPENSSL_ENGINES_DIR - -The B setting of the library build in the form C -if available, or C otherwise. This option is deprecated in -OpenSSL 3.0. - =item OPENSSL_MODULES_DIR The B setting of the library build in the form C @@ -184,15 +178,10 @@ OPENSSL_info() also returns different strings depending on I: The configured C, which is the default location for OpenSSL configuration files. -=item OPENSSL_INFO_ENGINES_DIR - -The configured C, which is the default location for -OpenSSL engines. - =item OPENSSL_INFO_MODULES_DIR The configured C, which is the default location for -dynamically loadable OpenSSL modules other than engines. +dynamically loadable OpenSSL modules. =item OPENSSL_INFO_DSO_EXTENSION @@ -256,6 +245,16 @@ L The macros and functions described here were added in OpenSSL 3.0, except for OPENSSL_VERSION_NUMBER and OpenSSL_version_num(). +The B and B strings +are no longer supported and, for compatibility reasons, will always +return values indicating that engine support was disabled. + +The B and B strings +were removed since OpenSSL 4.0. + +The B setting of the library is no longer supported +since OpenSSL 4.0. + =head1 BUGS There was a discrepancy between this manual and commentary + code @@ -265,7 +264,7 @@ C<0x0f> in released OpenSSL versions. =head1 COPYRIGHT -Copyright 2018-2022 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2018-2025 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/RAND_set_rand_method.pod b/doc/man3/RAND_set_rand_method.pod index 0cd5ac41ce..33f27d3f1f 100644 --- a/doc/man3/RAND_set_rand_method.pod +++ b/doc/man3/RAND_set_rand_method.pod @@ -30,12 +30,8 @@ generation. RAND_OpenSSL() returns the default B implementation by OpenSSL. This implementation ensures that the PRNG state is unique for each thread. -If an B is loaded that provides the RAND API, however, it will -be used instead of the method returned by RAND_OpenSSL(). This is deprecated -in OpenSSL 3.0. -RAND_set_rand_method() makes B the method for PRNG use. If an -ENGINE was providing the method, it will be released first. +RAND_set_rand_method() makes B the method for PRNG use. RAND_get_rand_method() returns a pointer to the current B. @@ -66,7 +62,6 @@ methods. L, L, L, -L, L, L diff --git a/doc/man3/RSA_check_key.pod b/doc/man3/RSA_check_key.pod index a9e3d36aa6..25686c95b8 100644 --- a/doc/man3/RSA_check_key.pod +++ b/doc/man3/RSA_check_key.pod @@ -50,17 +50,6 @@ They return -1 if an error occurs while checking the key. If the key is invalid or an error occurred, the reason code can be obtained using L. -=head1 NOTES - -Unlike most other RSA functions, this function does B work -transparently with any underlying ENGINE implementation because it uses the -key data in the RSA structure directly. An ENGINE implementation can -override the way key data is stored and handled, and can even provide -support for HSM keys - in which case the RSA structure may contain B -key data at all! If the ENGINE in question is only being used for -acceleration or analysis purposes, then in all likelihood the RSA key data -is complete and untouched, but this can't be assumed in the general case. - =head1 BUGS A method of verifying the RSA key using opaque RSA API functions might need diff --git a/doc/man3/RSA_get0_key.pod b/doc/man3/RSA_get0_key.pod index ffcc04e3be..1ff1322c92 100644 --- a/doc/man3/RSA_get0_key.pod +++ b/doc/man3/RSA_get0_key.pod @@ -7,7 +7,7 @@ RSA_get0_factors, RSA_get0_crt_params, RSA_get0_n, RSA_get0_e, RSA_get0_d, RSA_get0_p, RSA_get0_q, RSA_get0_dmp1, RSA_get0_dmq1, RSA_get0_iqmp, RSA_get0_pss_params, RSA_clear_flags, -RSA_test_flags, RSA_set_flags, RSA_get0_engine, RSA_get_multi_prime_extra_count, +RSA_test_flags, RSA_set_flags, RSA_get_multi_prime_extra_count, RSA_get0_multi_prime_factors, RSA_get0_multi_prime_crt_params, RSA_set0_multi_prime_params, RSA_get_version - Routines for getting and setting data in an RSA object @@ -41,7 +41,6 @@ see L: void RSA_clear_flags(RSA *r, int flags); int RSA_test_flags(const RSA *r, int flags); void RSA_set_flags(RSA *r, int flags); - ENGINE *RSA_get0_engine(RSA *r); int RSA_get_multi_prime_extra_count(const RSA *r); int RSA_get0_multi_prime_factors(const RSA *r, const BIGNUM *primes[]); int RSA_get0_multi_prime_crt_params(const RSA *r, const BIGNUM *exps[], @@ -118,9 +117,6 @@ flags that are currently set are returned, or zero if none of the flags are set. RSA_clear_flags() clears the specified flags within the RSA object. -RSA_get0_engine() returns a handle to the ENGINE that has been set for -this RSA object, or NULL if no such ENGINE has been set. - RSA_get_version() returns the version of an RSA object B. =head1 NOTES @@ -162,9 +158,6 @@ B for normal two-prime RSA, as defined in RFC 8017. RSA_test_flags() returns the current state of the flags in the RSA object. -RSA_get0_engine() returns the ENGINE set for the RSA object or NULL if no -ENGINE has been set. - =head1 SEE ALSO L, L @@ -182,6 +175,8 @@ Other functions described here were added in OpenSSL 1.1.0. All of these functions were deprecated in OpenSSL 3.0. +The RSA_get0_engine() was removed in OpenSSL 4.0. + =head1 COPYRIGHT Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved. diff --git a/doc/man3/RSA_set_method.pod b/doc/man3/RSA_set_method.pod index 21cfeed27b..cee191a6cd 100644 --- a/doc/man3/RSA_set_method.pod +++ b/doc/man3/RSA_set_method.pod @@ -35,47 +35,37 @@ Applications should instead use the OSSL_PROVIDER APIs. An B specifies the functions that OpenSSL uses for RSA operations. By modifying the method, alternative implementations such as -hardware accelerators may be used. IMPORTANT: See the NOTES section for -important information about how these RSA API functions are affected by the -use of B API calls. +hardware accelerators may be used. Initially, the default RSA_METHOD is the OpenSSL internal implementation, as returned by RSA_PKCS1_OpenSSL(). RSA_set_default_method() makes B the default method for all RSA structures created later. -B: This is true only whilst no ENGINE has -been set as a default for RSA, so this function is no longer recommended. -This function is not thread-safe and should not be called at the same time +B: This function is not thread-safe and should not be called at the same time as other OpenSSL functions. RSA_get_default_method() returns a pointer to the current default -RSA_METHOD. However, the meaningfulness of this result is dependent on -whether the ENGINE API is being used, so this function is no longer -recommended. +RSA_METHOD. RSA_set_method() selects B to perform all operations using the key -B. This will replace the RSA_METHOD used by the RSA key and if the -previous method was supplied by an ENGINE, the handle to that ENGINE will -be released during the change. It is possible to have RSA keys that only -work with certain RSA_METHOD implementations (e.g. from an ENGINE module -that supports embedded hardware-protected keys), and in such cases +B. This will replace the RSA_METHOD used by the RSA key. +It is possible to have RSA keys that only +work with certain RSA_METHOD implementations, and in such cases attempting to change the RSA_METHOD for the key can have unexpected results. RSA_get_method() returns a pointer to the RSA_METHOD being used by B. -This method may or may not be supplied by an ENGINE implementation, but if -it is, the return value can only be guaranteed to be valid as long as the +The return value can only be guaranteed to be valid as long as the RSA key itself is valid and does not have its implementation changed by RSA_set_method(). RSA_flags() returns the B that are set for B's current RSA_METHOD. See the BUGS section. -RSA_new_method() allocates and initializes an RSA structure so that -B will be used for the RSA operations. If B is NULL, the -default ENGINE for RSA operations is used, and if no default ENGINE is set, -the RSA_METHOD controlled by RSA_set_default_method() is used. +RSA_new_method() allocates and initializes an RSA structure. +B must be NULL and the RSA_METHOD controlled by RSA_set_default_method() +is used. RSA_flags() returns the B that are set for B's current method. @@ -149,11 +139,7 @@ and RSA_get_method() return pointers to the respective RSA_METHODs. RSA_set_default_method() returns no value. RSA_set_method() returns a pointer to the old RSA_METHOD implementation -that was replaced. However, this return value should probably be ignored -because if it was supplied by an ENGINE, the pointer could be invalidated -at any time if the ENGINE is unloaded (in fact it could be unloaded as a -result of the RSA_set_method() function releasing its handle to the -ENGINE). For this reason, the return type may be replaced with a B +that was replaced. The return type may be replaced with a B declaration in a future release. RSA_new_method() returns NULL and sets an error code that can be obtained @@ -185,7 +171,7 @@ was replaced to always return NULL in OpenSSL 1.1.1. =head1 COPYRIGHT -Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/SSL_CTX_set_mode.pod b/doc/man3/SSL_CTX_set_mode.pod index 325e086c54..a7707b3391 100644 --- a/doc/man3/SSL_CTX_set_mode.pod +++ b/doc/man3/SSL_CTX_set_mode.pod @@ -105,7 +105,7 @@ in draft-ietf-tls-downgrade-scsv-00. =item SSL_MODE_ASYNC Enable asynchronous processing. TLS I/O operations may indicate a retry with -SSL_ERROR_WANT_ASYNC with this mode set if an asynchronous capable engine is +SSL_ERROR_WANT_ASYNC with this mode set if an asynchronous capable provider is used to perform cryptographic operations. See L. =item SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG diff --git a/doc/man3/SSL_CTX_set_split_send_fragment.pod b/doc/man3/SSL_CTX_set_split_send_fragment.pod index 8f92ec1ec7..22433e5e37 100644 --- a/doc/man3/SSL_CTX_set_split_send_fragment.pod +++ b/doc/man3/SSL_CTX_set_split_send_fragment.pod @@ -32,17 +32,20 @@ SSL_SESSION_get_max_fragment_length - Control fragment size settings and pipelin =head1 DESCRIPTION -Some engines are able to process multiple simultaneous crypto operations. This +Previous versions of libssl supported the concept of cipher pipelining. There is +no support for this in OpenSSL 4.0. In previous versions some engines were +able to process multiple simultaneous crypto operations. This capability could be utilised to parallelise the processing of a single connection. For example a single write can be split into multiple records and -each one encrypted independently and in parallel. Note: this will only work in -TLS1.1+. There is no support in SSLv3, TLSv1.0 or DTLS (any version). This +each one encrypted independently and in parallel. Note: this would only work in +TLS1.1+. There was no support in SSLv3, TLSv1.0 or DTLS (any version). This capability is known as "pipelining" within OpenSSL. -In order to benefit from the pipelining capability. You need to have an engine -that provides ciphers that support this. The OpenSSL "dasync" engine provides -AES128-SHA based ciphers that have this capability. However, these are for -development and test purposes only. +In order to benefit from the pipelining capability, you would need to have an +engine that provides ciphers that support this. Since OpenSSL 4.0 engines are no +longer supported and therefore pipelining is not supported either. In some +future version it may be that this capability is added back via the provider +mechanism. SSL_CTX_set_max_send_fragment() and SSL_set_max_send_fragment() set the B parameter for SSL_CTX and SSL objects respectively. This @@ -187,7 +190,7 @@ and SSL_SESSION_get_max_fragment_length() functions were added in OpenSSL 1.1.1. =head1 COPYRIGHT -Copyright 2016-2023 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/SSL_CTX_use_certificate.pod b/doc/man3/SSL_CTX_use_certificate.pod index 2a9227c2ae..3d5049c286 100644 --- a/doc/man3/SSL_CTX_use_certificate.pod +++ b/doc/man3/SSL_CTX_use_certificate.pod @@ -106,8 +106,8 @@ key of the X.509 certificate B. If the B argument is 0, then B, B and B are set only if all were not previously set. If B is non-0, then the certificate, private key and chain certs are always set. If B is NULL, then the public key of B is used as -the private key. This is intended to be used with hardware (via the ENGINE -interface) that stores the private key securely, such that it cannot be +the private key. This is intended to be used with hardware +that stores the private key securely, such that it cannot be accessed by OpenSSL. The reference count of the public key is incremented (twice if there is no private key); it is not copied nor duplicated. This allows all private key validations checks to succeed without an actual @@ -196,7 +196,7 @@ L =head1 COPYRIGHT -Copyright 2000-2024 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man3/SSL_get_all_async_fds.pod b/doc/man3/SSL_get_all_async_fds.pod index 82749249ea..e5323fe253 100644 --- a/doc/man3/SSL_get_all_async_fds.pod +++ b/doc/man3/SSL_get_all_async_fds.pod @@ -33,7 +33,7 @@ from the file descriptor). This function should only be called if the B object is currently waiting for asynchronous work to complete (i.e. B has been received - see L). Typically the list will only contain one file descriptor. However, if multiple asynchronous -capable engines are in use then more than one is possible. The number of file +capable providers are in use then more than one is possible. The number of file descriptors returned is stored in I<*numfds> and the file descriptors themselves are in I<*fds>. The I parameter may be NULL in which case no file descriptors are returned but I<*numfds> is still populated. It is the callers diff --git a/doc/man3/SSL_get_error.pod b/doc/man3/SSL_get_error.pod index 794598facb..a599a9eee6 100644 --- a/doc/man3/SSL_get_error.pod +++ b/doc/man3/SSL_get_error.pod @@ -135,10 +135,10 @@ Details depend on the application. =item SSL_ERROR_WANT_ASYNC -The operation did not complete because an asynchronous engine is still +The job did not complete because an asynchronous provider is still processing data. This will only occur if the mode has been set to SSL_MODE_ASYNC using L or L and an asynchronous capable -engine is being used. An application can determine whether the engine has +provider is being used. An application can determine whether the job has completed its processing using select() or poll() on the asynchronous wait file descriptor. This file descriptor is available by calling L or L. The TLS/SSL I/O diff --git a/doc/man3/SSL_set_async_callback.pod b/doc/man3/SSL_set_async_callback.pod index db858a00ce..6f4c21eccb 100644 --- a/doc/man3/SSL_set_async_callback.pod +++ b/doc/man3/SSL_set_async_callback.pod @@ -26,26 +26,26 @@ SSL_async_callback_fn =head1 DESCRIPTION SSL_CTX_set_async_callback() sets an asynchronous callback function. All B -objects generated based on this B will get this callback. If an engine -supports the callback mechanism, it will be automatically called if -B has been set and an asynchronous capable engine completes a -cryptography operation to notify the application to resume the paused work flow. +objects generated based on this B will get this callback. If a +provider supports the callback mechanism, it will be automatically called if +B has been set and the provider completes a cryptography +operation to notify the application to resume the paused work flow. SSL_CTX_set_async_callback_arg() sets the callback argument. SSL_set_async_callback() allows an application to set a callback in an -asynchronous B object, so that when an engine completes a cryptography +asynchronous B object, so that when an provider completes a cryptography operation, the callback will be called to notify the application to resume the paused work flow. SSL_set_async_callback_arg() sets an argument for the B object when the above callback is called. -SSL_get_async_status() returns the engine status. This function facilitates the -communication from the engine to the application. During an SSL session, -cryptographic operations are dispatched to an engine. The engine status is very -useful for an application to know if the operation has been successfully -dispatched. If the engine does not support this additional callback method, +SSL_get_async_status() returns the provider status. This function facilitates +the communication from the provider to the application. During an SSL session, +cryptographic operations are dispatched to a provider. The provider status is +very useful for an application to know if the operation has been successfully +dispatched. If the provider does not support this additional callback method, B will be returned. See ASYNC_WAIT_CTX_set_status() for a description of all of the status values. @@ -60,28 +60,28 @@ by calling SSL_set_async_callback(). =item 2. -Application sets B and makes an asynchronous SSL call +Application sets B and makes an asynchronous SSL call. =item 3. -OpenSSL submits the asynchronous request to the engine. If a retry occurs at +OpenSSL submits the asynchronous request to the provider. If a retry occurs at this point then the status within the B would be set and the async callback function would be called (goto Step 7). =item 4. -The OpenSSL engine pauses the current job and returns, so that the +The OpenSSL provider pauses the current job and returns, so that the application can continue processing other connections. =item 5. At a future point in time (probably via a polling mechanism or via an -interrupt) the engine will become aware that the asynchronous request has +interrupt) the provider will become aware that the asynchronous request has finished processing. =item 6. -The engine will call the application's callback passing the callback data as +The provider will call the application's callback passing the callback data as a parameter. =item 7. @@ -121,7 +121,7 @@ SSL_get_async_status() were first added to OpenSSL 3.0. =head1 COPYRIGHT -Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man5/config.pod b/doc/man5/config.pod index 7a8480bd10..36159c7820 100644 --- a/doc/man5/config.pod +++ b/doc/man5/config.pod @@ -191,7 +191,6 @@ will be allowed but the desired configuration will B be used. providers = providers alg_section = evp_properties ssl_conf = ssl_configuration - engines = engines random = random [oids] @@ -206,9 +205,6 @@ will be allowed but the desired configuration will B be used. [ssl_configuration] ... SSL/TLS configuration properties here ... - [engines] - ... engine properties here ... - [random] ... random properties here ... @@ -367,69 +363,6 @@ key types, as shown here: RSA.Certificate = server-rsa.pem ECDSA.Certificate = server-ecdsa.pem -=head2 Engine Configuration - -The name B in the initialization section names the section -containing the list of ENGINE configurations. -As with the providers, each name in this section identifies an engine -with the configuration for that engine. -The engine-specific section is used to specify how to load the engine, -activate it, and set other parameters. - -Within an engine section, the following names have meaning: - -=over 4 - -=item B - -This is used to specify an alternate name, overriding the default name -specified in the list of engines. If present, it must be first. -For example: - - [engines] - foo = foo_engine - - [foo_engine] - engine_id = myfoo - -=item B - -This loads and adds an ENGINE from the given path. It is equivalent to -sending the ctrls B with the path argument followed by B -with value B<2> and B to the dynamic ENGINE. If this is not the -required behaviour then alternative ctrls can be sent directly to the -dynamic ENGINE using ctrl commands. - -=item B - -This specifies whether to initialize the ENGINE. If the value is B<0> the -ENGINE will not be initialized, if the value is B<1> an attempt is made -to initialize -the ENGINE immediately. If the B command is not present then an -attempt will be made to initialize the ENGINE after all commands in its -section have been processed. - -=item B - -This sets the default algorithms an ENGINE will supply using the function -ENGINE_set_default_string(). - -=back - -All other names are taken to be the name of a ctrl command that is -sent to the ENGINE, and the value is the argument passed with the command. -The special value B means no value is sent with the command. -For example: - - [engines] - foo = foo_engine - - [foo_engine] - dynamic_path = /some/path/fooengine.so - some_ctrl = some_value - default_algorithms = ALL - other_ctrl = EMPTY - =head2 Random Configuration The name B in the initialization section names the section @@ -548,11 +481,6 @@ F. The path to the config file, or the empty string for none. Ignored in set-user-ID and set-group-ID programs. -=item B - -The path to the engines directory. -Ignored in set-user-ID and set-group-ID programs. - =item B The path to the directory with OpenSSL modules, such as providers. @@ -586,6 +514,8 @@ and comments began with a semi-colon. This function was deprecated in OpenSSL 3.0; applications with configuration files using that syntax will have to be modified. +The I parameter was removed in OpenSSL 4.0. + =head1 SEE ALSO L, L, L, diff --git a/doc/man7/EVP_PKEY-HMAC.pod b/doc/man7/EVP_PKEY-HMAC.pod index 84b647e530..eafc5aec1e 100644 --- a/doc/man7/EVP_PKEY-HMAC.pod +++ b/doc/man7/EVP_PKEY-HMAC.pod @@ -46,10 +46,6 @@ supports the following parameters. The name of a cipher to be used when generating the MAC. -=item "engine" (B) - -The name of an engine to be used for the specified cipher (if any). - =back =head2 Common MAC key generation parameters @@ -83,9 +79,14 @@ The name of a cipher to be used when generating the MAC. L, L, L +=head1 HISTORY + +The CMAC parameter I (B) was removed in +OpenSSL 4.0. + =head1 COPYRIGHT -Copyright 2020 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man7/evp.pod b/doc/man7/evp.pod index 9e0dc58e85..80d9db633a 100644 --- a/doc/man7/evp.pod +++ b/doc/man7/evp.pod @@ -66,19 +66,16 @@ The LI|EVP_EncodeInit(3)> and LI|EVP_EncodeInit(3)> functions implement base64 encoding and decoding. -All the symmetric algorithms (ciphers), digests and asymmetric algorithms -(public key algorithms) can be replaced by ENGINE modules providing alternative -implementations. If ENGINE implementations of ciphers or digests are registered -as defaults, then the various EVP functions will automatically use those -implementations automatically in preference to built in software -implementations. For more information, consult the engine(3) man page. +Providers can supply implementations for a wide range of cryptographic +operations, including symmetric algorithms (ciphers), digests, asymmetric +algorithms (public key algorithms), key management, parameter generation, +and more. For more information, consult the provider(7) man page. -Although low-level algorithm specific functions exist for many algorithms -their use is discouraged. They cannot be used with an ENGINE and ENGINE -versions of new algorithms cannot be accessed using the low-level functions. -Also makes code harder to adapt to new algorithms and some options are not -cleanly supported at the low-level and some operations are more efficient -using the high-level interface. +Although low-level algorithm specific functions exist for many algorithms, +their use is discouraged. They do not call into providers such as the fips +provider and thus they are not FIPS 140-3 validated. If an accelerated +implementation of an algorithm is provided through a third party provider +the low level API will not use that implementation either. =head1 SEE ALSO @@ -102,11 +99,10 @@ L, L, L, L, -L =head1 COPYRIGHT -Copyright 2000-2024 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/doc/man7/fips_module.pod b/doc/man7/fips_module.pod index f32c65081e..d42acaba45 100644 --- a/doc/man7/fips_module.pod +++ b/doc/man7/fips_module.pod @@ -31,10 +31,6 @@ Low level cryptographic APIs (use the high level APIs, such as EVP, instead) =item * -Engines - -=item * - Any functions that create or modify custom "METHODS" (for example EVP_MD_meth_new(), EVP_CIPHER_meth_new(), EVP_PKEY_meth_new(), RSA_meth_new(), EC_KEY_METHOD_new(), etc.) diff --git a/doc/man7/openssl-env.pod b/doc/man7/openssl-env.pod index 0c7656bc5f..de0545d5b4 100644 --- a/doc/man7/openssl-env.pod +++ b/doc/man7/openssl-env.pod @@ -77,13 +77,6 @@ than 1, outputs information about every processed feature. This variable is not considered security-sensitive. -=item B - -Specifies the directory from which dynamic engines are loaded. -See L. - -This variable is considered a security-sensitive environment variable. - =item B, B, B If built with debugging, this allows memory allocation to fail. @@ -153,7 +146,7 @@ Traces CMP client and server activity. =item B -Show details about provider and engine configuration. +Show details about provider configuration. =item B @@ -163,17 +156,6 @@ Traces decoder operations. Traces encoder operations. -=item B - -Reference counts in the ENGINE structure will be monitored with a line -of generated for each change. - -=item B - -The function that is used by RSA, DSA (etc) code to select registered -ENGINEs, cache defaults and functional references (etc), will generate -debugging summaries. - =item B Traces the HTTP client and server, such as messages being sent and received. @@ -331,6 +313,11 @@ under test output with the output for the TAP consumer. This variable was not considered security-sensitive. +=item B + +This variable, support for which was removed in OpenSSL 4.0, specified the +directory from which dynamic engines were loaded. + =back =head1 COPYRIGHT diff --git a/doc/man7/ossl_store.pod b/doc/man7/ossl_store.pod index d6fdae8f22..5e16a10f2f 100644 --- a/doc/man7/ossl_store.pod +++ b/doc/man7/ossl_store.pod @@ -28,7 +28,7 @@ from which an OpenSSL type can be retrieved. =head2 URI schemes and loaders Support for a URI scheme is called a STORE "loader", and can be added -dynamically from the calling application or from a loadable engine. +dynamically from the calling application or from a loadable provider. Support for the 'file' scheme is built into C. See L for more information. diff --git a/doc/perlvars.pm b/doc/perlvars.pm index d4443f13c7..ae3dfad545 100644 --- a/doc/perlvars.pm +++ b/doc/perlvars.pm @@ -115,19 +115,6 @@ $OpenSSL::safe::opt_config_item = "" . "\n" . "See L."; -# Engine option -$OpenSSL::safe::opt_engine_synopsis = ""; -$OpenSSL::safe::opt_engine_item = ""; -if (!$disabled{"deprecated-3.0"}) { - $OpenSSL::safe::opt_engine_synopsis = "" - . "[B<-engine> I]\n"; - $OpenSSL::safe::opt_engine_item = "" - . "=item B<-engine> I\n" - . "\n" - . "See L.\n" - . "This option is deprecated."; -} - # Trusted certs options $OpenSSL::safe::opt_trust_synopsis = "" . "[B<-CAfile> I]\n" diff --git a/engines/asm/e_padlock-x86.pl b/engines/asm/e_padlock-x86.pl deleted file mode 100644 index 18dab8ffee..0000000000 --- a/engines/asm/e_padlock-x86.pl +++ /dev/null @@ -1,628 +0,0 @@ -#! /usr/bin/env perl -# Copyright 2011-2025 The OpenSSL Project Authors. All Rights Reserved. -# -# Licensed under the Apache License 2.0 (the "License"). You may not use -# this file except in compliance with the License. You can obtain a copy -# in the file LICENSE in the source distribution or at -# https://www.openssl.org/source/license.html - - -# ==================================================================== -# Written by Andy Polyakov, @dot-asm, initially for use in the OpenSSL -# project. The module is, however, dual licensed under OpenSSL and -# CRYPTOGAMS licenses depending on where you obtain it. For further -# details see https://github.com/dot-asm/cryptogams/. -# ==================================================================== - -# September 2011 -# -# Assembler helpers for Padlock engine. Compared to original engine -# version relying on inline assembler and compiled with gcc 3.4.6 it -# was measured to provide ~100% improvement on misaligned data in ECB -# mode and ~75% in CBC mode. For aligned data improvement can be -# observed for short inputs only, e.g. 45% for 64-byte messages in -# ECB mode, 20% in CBC. Difference in performance for aligned vs. -# misaligned data depends on misalignment and is either ~1.8x or 2.9x. -# These are approximately same factors as for hardware support, so -# there is little reason to rely on the latter. On the contrary, it -# might actually hurt performance in mixture of aligned and misaligned -# buffers, because a) if you choose to flip 'align' flag in control -# word on per-buffer basis, then you'd have to reload key context, -# which incurs penalty; b) if you choose to set 'align' flag -# permanently, it limits performance even for aligned data to ~1/2. -# All above mentioned results were collected on 1.5GHz C7. Nano on the -# other hand handles unaligned data more gracefully. Depending on -# algorithm and how unaligned data is, hardware can be up to 70% more -# efficient than below software alignment procedures, nor does 'align' -# flag have affect on aligned performance [if has any meaning at all]. -# Therefore suggestion is to unconditionally set 'align' flag on Nano -# for optimal performance. - -$0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1; -push(@INC,"${dir}","${dir}../../crypto/perlasm"); -require "x86asm.pl"; - -$output=pop and open STDOUT,">$output"; - -&asm_init($ARGV[0]); - -%PADLOCK_PREFETCH=(ecb=>128, cbc=>64); # prefetch errata -$PADLOCK_CHUNK=512; # Must be a power of 2 larger than 16 - -$ctx="edx"; -$out="edi"; -$inp="esi"; -$len="ecx"; -$chunk="ebx"; - -&function_begin_B("padlock_capability"); - &push ("ebx"); - &pushf (); - &pop ("eax"); - &mov ("ecx","eax"); - &xor ("eax",1<<21); - &push ("eax"); - &popf (); - &pushf (); - &pop ("eax"); - &xor ("ecx","eax"); - &xor ("eax","eax"); - &bt ("ecx",21); - &jnc (&label("noluck")); - &cpuid (); - &xor ("eax","eax"); - &cmp ("ebx","0x".unpack("H*",'tneC')); - &jne (&label("zhaoxin")); - &cmp ("edx","0x".unpack("H*",'Hrua')); - &jne (&label("noluck")); - &cmp ("ecx","0x".unpack("H*",'slua')); - &jne (&label("noluck")); - &jmp (&label("zhaoxinEnd")); -&set_label("zhaoxin"); - &cmp ("ebx","0x".unpack("H*",'hS ')); - &jne (&label("noluck")); - &cmp ("edx","0x".unpack("H*",'hgna')); - &jne (&label("noluck")); - &cmp ("ecx","0x".unpack("H*",' ia')); - &jne (&label("noluck")); -&set_label("zhaoxinEnd"); - &mov ("eax",0xC0000000); - &cpuid (); - &mov ("edx","eax"); - &xor ("eax","eax"); - &cmp ("edx",0xC0000001); - &jb (&label("noluck")); - &mov ("eax",1); - &cpuid (); - &or ("eax",0x0f); - &xor ("ebx","ebx"); - &and ("eax",0x0fff); - &cmp ("eax",0x06ff); # check for Nano - &sete ("bl"); - &mov ("eax",0xC0000001); - &push ("ebx"); - &cpuid (); - &pop ("ebx"); - &mov ("eax","edx"); - &shl ("ebx",4); # bit#4 denotes Nano - &and ("eax",0xffffffef); - &or ("eax","ebx") -&set_label("noluck"); - &pop ("ebx"); - &ret (); -&function_end_B("padlock_capability") - -&function_begin_B("padlock_key_bswap"); - &mov ("edx",&wparam(0)); - &mov ("ecx",&DWP(240,"edx")); - &inc ("ecx"); - &shl ("ecx",2); -&set_label("bswap_loop"); - &mov ("eax",&DWP(0,"edx")); - &bswap ("eax"); - &mov (&DWP(0,"edx"),"eax"); - &lea ("edx",&DWP(4,"edx")); - &sub ("ecx",1); - &jnz (&label("bswap_loop")); - &ret (); -&function_end_B("padlock_key_bswap"); - -# This is heuristic key context tracing. At first one -# believes that one should use atomic swap instructions, -# but it's not actually necessary. Point is that if -# padlock_saved_context was changed by another thread -# after we've read it and before we compare it with ctx, -# our key *shall* be reloaded upon thread context switch -# and we are therefore set in either case... -&static_label("padlock_saved_context"); - -&function_begin_B("padlock_verify_context"); - &mov ($ctx,&wparam(0)); - &lea ("eax",($::win32 or $::coff) ? &DWP(&label("padlock_saved_context")) : - &DWP(&label("padlock_saved_context")."-".&label("verify_pic_point"))); - &pushf (); - &call ("_padlock_verify_ctx"); -&set_label("verify_pic_point"); - &lea ("esp",&DWP(4,"esp")); - &ret (); -&function_end_B("padlock_verify_context"); - -&function_begin_B("_padlock_verify_ctx"); - &add ("eax",&DWP(0,"esp")) if(!($::win32 or $::coff));# &padlock_saved_context - &bt (&DWP(4,"esp"),30); # eflags - &jnc (&label("verified")); - &cmp ($ctx,&DWP(0,"eax")); - &je (&label("verified")); - &pushf (); - &popf (); -&set_label("verified"); - &mov (&DWP(0,"eax"),$ctx); - &ret (); -&function_end_B("_padlock_verify_ctx"); - -&function_begin_B("padlock_reload_key"); - &pushf (); - &popf (); - &ret (); -&function_end_B("padlock_reload_key"); - -&function_begin_B("padlock_aes_block"); - &push ("edi"); - &push ("esi"); - &push ("ebx"); - &mov ($out,&wparam(0)); # must be 16-byte aligned - &mov ($inp,&wparam(1)); # must be 16-byte aligned - &mov ($ctx,&wparam(2)); - &mov ($len,1); - &lea ("ebx",&DWP(32,$ctx)); # key - &lea ($ctx,&DWP(16,$ctx)); # control word - &data_byte(0xf3,0x0f,0xa7,0xc8); # rep xcryptecb - &pop ("ebx"); - &pop ("esi"); - &pop ("edi"); - &ret (); -&function_end_B("padlock_aes_block"); - -sub generate_mode { -my ($mode,$opcode) = @_; -# int padlock_$mode_encrypt(void *out, const void *inp, -# struct padlock_cipher_data *ctx, size_t len); -&function_begin("padlock_${mode}_encrypt"); - &mov ($out,&wparam(0)); - &mov ($inp,&wparam(1)); - &mov ($ctx,&wparam(2)); - &mov ($len,&wparam(3)); - &test ($ctx,15); - &jnz (&label("${mode}_abort")); - &test ($len,15); - &jnz (&label("${mode}_abort")); - &lea ("eax",($::win32 or $::coff) ? &DWP(&label("padlock_saved_context")) : - &DWP(&label("padlock_saved_context")."-".&label("${mode}_pic_point"))); - &pushf (); - &cld (); - &call ("_padlock_verify_ctx"); -&set_label("${mode}_pic_point"); - &lea ($ctx,&DWP(16,$ctx)); # control word - &xor ("eax","eax"); - if ($mode eq "ctr32") { - &movq ("mm0",&QWP(-16,$ctx)); # load [upper part of] counter - } else { - &xor ("ebx","ebx"); - &test (&DWP(0,$ctx),1<<5); # align bit in control word - &jnz (&label("${mode}_aligned")); - &test ($out,0x0f); - &setz ("al"); # !out_misaligned - &test ($inp,0x0f); - &setz ("bl"); # !inp_misaligned - &test ("eax","ebx"); - &jnz (&label("${mode}_aligned")); - &neg ("eax"); - } - &mov ($chunk,$PADLOCK_CHUNK); - ¬ ("eax"); # out_misaligned?-1:0 - &lea ("ebp",&DWP(-24,"esp")); - &cmp ($len,$chunk); - &cmovc ($chunk,$len); # chunk=len>PADLOCK_CHUNK?PADLOCK_CHUNK:len - &and ("eax",$chunk); # out_misaligned?chunk:0 - &mov ($chunk,$len); - &neg ("eax"); - &and ($chunk,$PADLOCK_CHUNK-1); # chunk=len%PADLOCK_CHUNK - &lea ("esp",&DWP(0,"eax","ebp")); # alloca - &mov ("eax",$PADLOCK_CHUNK); - &cmovz ($chunk,"eax"); # chunk=chunk?:PADLOCK_CHUNK - &mov ("eax","ebp"); - &and ("ebp",-16); - &and ("esp",-16); - &mov (&DWP(16,"ebp"),"eax"); - if ($PADLOCK_PREFETCH{$mode}) { - &cmp ($len,$chunk); - &ja (&label("${mode}_loop")); - &mov ("eax",$inp); # check if prefetch crosses page - &cmp ("ebp","esp"); - &cmove ("eax",$out); - &add ("eax",$len); - &neg ("eax"); - &and ("eax",0xfff); # distance to page boundary - &cmp ("eax",$PADLOCK_PREFETCH{$mode}); - &mov ("eax",-$PADLOCK_PREFETCH{$mode}); - &cmovae ("eax",$chunk); # mask=distanceExceptionCode == STATUS_ACCESS_VIOLATION - &jne (&label("ret")); - &add (&DWP(184,"ecx"),4); # skip over rep sha* - &mov ("eax",0); # ExceptionContinueExecution -&set_label("ret"); - &ret (); -&function_end_B("_win32_segv_handler"); -&safeseh("_win32_segv_handler") if ($::win32); - -&function_begin_B("padlock_sha1_oneshot"); - &push ("edi"); - &push ("esi"); - &xor ("eax","eax"); - &mov ("edi",&wparam(0)); - &mov ("esi",&wparam(1)); - &mov ("ecx",&wparam(2)); - if ($::win32 or $::coff) { - &push (&::islabel("_win32_segv_handler")); - &data_byte(0x64,0xff,0x30); # push %fs:(%eax) - &data_byte(0x64,0x89,0x20); # mov %esp,%fs:(%eax) - } - &mov ("edx","esp"); # put aside %esp - &add ("esp",-128); # 32 is enough but spec says 128 - &movups ("xmm0",&QWP(0,"edi")); # copy-in context - &and ("esp",-16); - &mov ("eax",&DWP(16,"edi")); - &movaps (&QWP(0,"esp"),"xmm0"); - &mov ("edi","esp"); - &mov (&DWP(16,"esp"),"eax"); - &xor ("eax","eax"); - &data_byte(0xf3,0x0f,0xa6,0xc8); # rep xsha1 - &movaps ("xmm0",&QWP(0,"esp")); - &mov ("eax",&DWP(16,"esp")); - &mov ("esp","edx"); # restore %esp - if ($::win32 or $::coff) { - &data_byte(0x64,0x8f,0x05,0,0,0,0); # pop %fs:0 - &lea ("esp",&DWP(4,"esp")); - } - &mov ("edi",&wparam(0)); - &movups (&QWP(0,"edi"),"xmm0"); # copy-out context - &mov (&DWP(16,"edi"),"eax"); - &pop ("esi"); - &pop ("edi"); - &ret (); -&function_end_B("padlock_sha1_oneshot"); - -&function_begin_B("padlock_sha1_blocks"); - &push ("edi"); - &push ("esi"); - &mov ("edi",&wparam(0)); - &mov ("esi",&wparam(1)); - &mov ("edx","esp"); # put aside %esp - &mov ("ecx",&wparam(2)); - &add ("esp",-128); - &movups ("xmm0",&QWP(0,"edi")); # copy-in context - &and ("esp",-16); - &mov ("eax",&DWP(16,"edi")); - &movaps (&QWP(0,"esp"),"xmm0"); - &mov ("edi","esp"); - &mov (&DWP(16,"esp"),"eax"); - &mov ("eax",-1); - &data_byte(0xf3,0x0f,0xa6,0xc8); # rep xsha1 - &movaps ("xmm0",&QWP(0,"esp")); - &mov ("eax",&DWP(16,"esp")); - &mov ("esp","edx"); # restore %esp - &mov ("edi",&wparam(0)); - &movups (&QWP(0,"edi"),"xmm0"); # copy-out context - &mov (&DWP(16,"edi"),"eax"); - &pop ("esi"); - &pop ("edi"); - &ret (); -&function_end_B("padlock_sha1_blocks"); - -&function_begin_B("padlock_sha256_oneshot"); - &push ("edi"); - &push ("esi"); - &xor ("eax","eax"); - &mov ("edi",&wparam(0)); - &mov ("esi",&wparam(1)); - &mov ("ecx",&wparam(2)); - if ($::win32 or $::coff) { - &push (&::islabel("_win32_segv_handler")); - &data_byte(0x64,0xff,0x30); # push %fs:(%eax) - &data_byte(0x64,0x89,0x20); # mov %esp,%fs:(%eax) - } - &mov ("edx","esp"); # put aside %esp - &add ("esp",-128); - &movups ("xmm0",&QWP(0,"edi")); # copy-in context - &and ("esp",-16); - &movups ("xmm1",&QWP(16,"edi")); - &movaps (&QWP(0,"esp"),"xmm0"); - &mov ("edi","esp"); - &movaps (&QWP(16,"esp"),"xmm1"); - &xor ("eax","eax"); - &data_byte(0xf3,0x0f,0xa6,0xd0); # rep xsha256 - &movaps ("xmm0",&QWP(0,"esp")); - &movaps ("xmm1",&QWP(16,"esp")); - &mov ("esp","edx"); # restore %esp - if ($::win32 or $::coff) { - &data_byte(0x64,0x8f,0x05,0,0,0,0); # pop %fs:0 - &lea ("esp",&DWP(4,"esp")); - } - &mov ("edi",&wparam(0)); - &movups (&QWP(0,"edi"),"xmm0"); # copy-out context - &movups (&QWP(16,"edi"),"xmm1"); - &pop ("esi"); - &pop ("edi"); - &ret (); -&function_end_B("padlock_sha256_oneshot"); - -&function_begin_B("padlock_sha256_blocks"); - &push ("edi"); - &push ("esi"); - &mov ("edi",&wparam(0)); - &mov ("esi",&wparam(1)); - &mov ("ecx",&wparam(2)); - &mov ("edx","esp"); # put aside %esp - &add ("esp",-128); - &movups ("xmm0",&QWP(0,"edi")); # copy-in context - &and ("esp",-16); - &movups ("xmm1",&QWP(16,"edi")); - &movaps (&QWP(0,"esp"),"xmm0"); - &mov ("edi","esp"); - &movaps (&QWP(16,"esp"),"xmm1"); - &mov ("eax",-1); - &data_byte(0xf3,0x0f,0xa6,0xd0); # rep xsha256 - &movaps ("xmm0",&QWP(0,"esp")); - &movaps ("xmm1",&QWP(16,"esp")); - &mov ("esp","edx"); # restore %esp - &mov ("edi",&wparam(0)); - &movups (&QWP(0,"edi"),"xmm0"); # copy-out context - &movups (&QWP(16,"edi"),"xmm1"); - &pop ("esi"); - &pop ("edi"); - &ret (); -&function_end_B("padlock_sha256_blocks"); - -&function_begin_B("padlock_sha512_blocks"); - &push ("edi"); - &push ("esi"); - &mov ("edi",&wparam(0)); - &mov ("esi",&wparam(1)); - &mov ("ecx",&wparam(2)); - &mov ("edx","esp"); # put aside %esp - &add ("esp",-128); - &movups ("xmm0",&QWP(0,"edi")); # copy-in context - &and ("esp",-16); - &movups ("xmm1",&QWP(16,"edi")); - &movups ("xmm2",&QWP(32,"edi")); - &movups ("xmm3",&QWP(48,"edi")); - &movaps (&QWP(0,"esp"),"xmm0"); - &mov ("edi","esp"); - &movaps (&QWP(16,"esp"),"xmm1"); - &movaps (&QWP(32,"esp"),"xmm2"); - &movaps (&QWP(48,"esp"),"xmm3"); - &data_byte(0xf3,0x0f,0xa6,0xe0); # rep xsha512 - &movaps ("xmm0",&QWP(0,"esp")); - &movaps ("xmm1",&QWP(16,"esp")); - &movaps ("xmm2",&QWP(32,"esp")); - &movaps ("xmm3",&QWP(48,"esp")); - &mov ("esp","edx"); # restore %esp - &mov ("edi",&wparam(0)); - &movups (&QWP(0,"edi"),"xmm0"); # copy-out context - &movups (&QWP(16,"edi"),"xmm1"); - &movups (&QWP(32,"edi"),"xmm2"); - &movups (&QWP(48,"edi"),"xmm3"); - &pop ("esi"); - &pop ("edi"); - &ret (); -&function_end_B("padlock_sha512_blocks"); - -&asciz ("VIA Padlock x86 module, CRYPTOGAMS by "); -&align (16); - -&dataseg(); -# Essentially this variable belongs in thread local storage. -# Having this variable global on the other hand can only cause -# few bogus key reloads [if any at all on signle-CPU system], -# so we accept the penalty... -&set_label("padlock_saved_context",4); -&data_word(0); - -&asm_finish(); - -close STDOUT; diff --git a/engines/asm/e_padlock-x86_64.pl b/engines/asm/e_padlock-x86_64.pl deleted file mode 100644 index 651af73419..0000000000 --- a/engines/asm/e_padlock-x86_64.pl +++ /dev/null @@ -1,587 +0,0 @@ -#! /usr/bin/env perl -# Copyright 2011-2025 The OpenSSL Project Authors. All Rights Reserved. -# -# Licensed under the Apache License 2.0 (the "License"). You may not use -# this file except in compliance with the License. You can obtain a copy -# in the file LICENSE in the source distribution or at -# https://www.openssl.org/source/license.html - - -# ==================================================================== -# Written by Andy Polyakov, @dot-asm, initially for use in the OpenSSL -# project. The module is, however, dual licensed under OpenSSL and -# CRYPTOGAMS licenses depending on where you obtain it. For further -# details see https://github.com/dot-asm/cryptogams/. -# ==================================================================== - -# September 2011 -# -# Assembler helpers for Padlock engine. See even e_padlock-x86.pl for -# details. - -# $output is the last argument if it looks like a file (it has an extension) -# $flavour is the first argument if it doesn't look like a file -$output = $#ARGV >= 0 && $ARGV[$#ARGV] =~ m|\.\w+$| ? pop : undef; -$flavour = $#ARGV >= 0 && $ARGV[0] !~ m|\.| ? shift : undef; - -$win64=0; $win64=1 if ($flavour =~ /[nm]asm|mingw64/ || $output =~ /\.asm$/); - -$0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1; -( $xlate="${dir}x86_64-xlate.pl" and -f $xlate ) or -( $xlate="${dir}../../crypto/perlasm/x86_64-xlate.pl" and -f $xlate) or -die "can't locate x86_64-xlate.pl"; - -open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\"" - or die "can't call $xlate: $!"; -*STDOUT=*OUT; - -$code=".text\n"; - -%PADLOCK_PREFETCH=(ecb=>128, cbc=>64, ctr32=>32); # prefetch errata -$PADLOCK_CHUNK=512; # Must be a power of 2 between 32 and 2^20 - -$ctx="%rdx"; -$out="%rdi"; -$inp="%rsi"; -$len="%rcx"; -$chunk="%rbx"; - -($arg1,$arg2,$arg3,$arg4)=$win64?("%rcx","%rdx","%r8", "%r9") : # Win64 order - ("%rdi","%rsi","%rdx","%rcx"); # Unix order - -$code.=<<___; -.globl padlock_capability -.type padlock_capability,\@abi-omnipotent -.align 16 -padlock_capability: - mov %rbx,%r8 - xor %eax,%eax - cpuid - xor %eax,%eax - cmp \$`"0x".unpack("H*",'tneC')`,%ebx - jne .Lzhaoxin - cmp \$`"0x".unpack("H*",'Hrua')`,%edx - jne .Lnoluck - cmp \$`"0x".unpack("H*",'slua')`,%ecx - jne .Lnoluck - jmp .LzhaoxinEnd -.Lzhaoxin: - cmp \$`"0x".unpack("H*",'hS ')`,%ebx - jne .Lnoluck - cmp \$`"0x".unpack("H*",'hgna')`,%edx - jne .Lnoluck - cmp \$`"0x".unpack("H*",' ia')`,%ecx - jne .Lnoluck -.LzhaoxinEnd: - mov \$0xC0000000,%eax - cpuid - mov %eax,%edx - xor %eax,%eax - cmp \$0xC0000001,%edx - jb .Lnoluck - mov \$0xC0000001,%eax - cpuid - mov %edx,%eax - and \$0xffffffef,%eax - or \$0x10,%eax # set Nano bit#4 -.Lnoluck: - mov %r8,%rbx - ret -.size padlock_capability,.-padlock_capability - -.globl padlock_key_bswap -.type padlock_key_bswap,\@abi-omnipotent,0 -.align 16 -padlock_key_bswap: - mov 240($arg1),%edx - inc %edx - shl \$2,%edx -.Lbswap_loop: - mov ($arg1),%eax - bswap %eax - mov %eax,($arg1) - lea 4($arg1),$arg1 - sub \$1,%edx - jnz .Lbswap_loop - ret -.size padlock_key_bswap,.-padlock_key_bswap - -.globl padlock_verify_context -.type padlock_verify_context,\@abi-omnipotent -.align 16 -padlock_verify_context: - mov $arg1,$ctx - pushf - lea .Lpadlock_saved_context(%rip),%rax - call _padlock_verify_ctx - lea 8(%rsp),%rsp - ret -.size padlock_verify_context,.-padlock_verify_context - -.type _padlock_verify_ctx,\@abi-omnipotent -.align 16 -_padlock_verify_ctx: - mov 8(%rsp),%r8 - bt \$30,%r8 - jnc .Lverified - cmp (%rax),$ctx - je .Lverified - pushf - popf -.Lverified: - mov $ctx,(%rax) - ret -.size _padlock_verify_ctx,.-_padlock_verify_ctx - -.globl padlock_reload_key -.type padlock_reload_key,\@abi-omnipotent -.align 16 -padlock_reload_key: - pushf - popf - ret -.size padlock_reload_key,.-padlock_reload_key - -.globl padlock_aes_block -.type padlock_aes_block,\@function,3 -.align 16 -padlock_aes_block: - mov %rbx,%r8 - mov \$1,$len - lea 32($ctx),%rbx # key - lea 16($ctx),$ctx # control word - .byte 0xf3,0x0f,0xa7,0xc8 # rep xcryptecb - mov %r8,%rbx - ret -.size padlock_aes_block,.-padlock_aes_block - -.globl padlock_xstore -.type padlock_xstore,\@function,2 -.align 16 -padlock_xstore: - mov %esi,%edx - .byte 0x0f,0xa7,0xc0 # xstore - ret -.size padlock_xstore,.-padlock_xstore - -.globl padlock_sha1_oneshot -.type padlock_sha1_oneshot,\@function,3 -.align 16 -padlock_sha1_oneshot: - mov %rdx,%rcx - mov %rdi,%rdx # put aside %rdi - movups (%rdi),%xmm0 # copy-in context - sub \$128+8,%rsp - mov 16(%rdi),%eax - movaps %xmm0,(%rsp) - mov %rsp,%rdi - mov %eax,16(%rsp) - xor %rax,%rax - .byte 0xf3,0x0f,0xa6,0xc8 # rep xsha1 - movaps (%rsp),%xmm0 - mov 16(%rsp),%eax - add \$128+8,%rsp - movups %xmm0,(%rdx) # copy-out context - mov %eax,16(%rdx) - ret -.size padlock_sha1_oneshot,.-padlock_sha1_oneshot - -.globl padlock_sha1_blocks -.type padlock_sha1_blocks,\@function,3 -.align 16 -padlock_sha1_blocks: - mov %rdx,%rcx - mov %rdi,%rdx # put aside %rdi - movups (%rdi),%xmm0 # copy-in context - sub \$128+8,%rsp - mov 16(%rdi),%eax - movaps %xmm0,(%rsp) - mov %rsp,%rdi - mov %eax,16(%rsp) - mov \$-1,%rax - .byte 0xf3,0x0f,0xa6,0xc8 # rep xsha1 - movaps (%rsp),%xmm0 - mov 16(%rsp),%eax - add \$128+8,%rsp - movups %xmm0,(%rdx) # copy-out context - mov %eax,16(%rdx) - ret -.size padlock_sha1_blocks,.-padlock_sha1_blocks - -.globl padlock_sha256_oneshot -.type padlock_sha256_oneshot,\@function,3 -.align 16 -padlock_sha256_oneshot: - mov %rdx,%rcx - mov %rdi,%rdx # put aside %rdi - movups (%rdi),%xmm0 # copy-in context - sub \$128+8,%rsp - movups 16(%rdi),%xmm1 - movaps %xmm0,(%rsp) - mov %rsp,%rdi - movaps %xmm1,16(%rsp) - xor %rax,%rax - .byte 0xf3,0x0f,0xa6,0xd0 # rep xsha256 - movaps (%rsp),%xmm0 - movaps 16(%rsp),%xmm1 - add \$128+8,%rsp - movups %xmm0,(%rdx) # copy-out context - movups %xmm1,16(%rdx) - ret -.size padlock_sha256_oneshot,.-padlock_sha256_oneshot - -.globl padlock_sha256_blocks -.type padlock_sha256_blocks,\@function,3 -.align 16 -padlock_sha256_blocks: - mov %rdx,%rcx - mov %rdi,%rdx # put aside %rdi - movups (%rdi),%xmm0 # copy-in context - sub \$128+8,%rsp - movups 16(%rdi),%xmm1 - movaps %xmm0,(%rsp) - mov %rsp,%rdi - movaps %xmm1,16(%rsp) - mov \$-1,%rax - .byte 0xf3,0x0f,0xa6,0xd0 # rep xsha256 - movaps (%rsp),%xmm0 - movaps 16(%rsp),%xmm1 - add \$128+8,%rsp - movups %xmm0,(%rdx) # copy-out context - movups %xmm1,16(%rdx) - ret -.size padlock_sha256_blocks,.-padlock_sha256_blocks - -.globl padlock_sha512_blocks -.type padlock_sha512_blocks,\@function,3 -.align 16 -padlock_sha512_blocks: - mov %rdx,%rcx - mov %rdi,%rdx # put aside %rdi - movups (%rdi),%xmm0 # copy-in context - sub \$128+8,%rsp - movups 16(%rdi),%xmm1 - movups 32(%rdi),%xmm2 - movups 48(%rdi),%xmm3 - movaps %xmm0,(%rsp) - mov %rsp,%rdi - movaps %xmm1,16(%rsp) - movaps %xmm2,32(%rsp) - movaps %xmm3,48(%rsp) - .byte 0xf3,0x0f,0xa6,0xe0 # rep xha512 - movaps (%rsp),%xmm0 - movaps 16(%rsp),%xmm1 - movaps 32(%rsp),%xmm2 - movaps 48(%rsp),%xmm3 - add \$128+8,%rsp - movups %xmm0,(%rdx) # copy-out context - movups %xmm1,16(%rdx) - movups %xmm2,32(%rdx) - movups %xmm3,48(%rdx) - ret -.size padlock_sha512_blocks,.-padlock_sha512_blocks -___ - -sub generate_mode { -my ($mode,$opcode) = @_; -# int padlock_$mode_encrypt(void *out, const void *inp, -# struct padlock_cipher_data *ctx, size_t len); -$code.=<<___; -.globl padlock_${mode}_encrypt -.type padlock_${mode}_encrypt,\@function,4 -.align 16 -padlock_${mode}_encrypt: - push %rbp - push %rbx - - xor %eax,%eax - test \$15,$ctx - jnz .L${mode}_abort - test \$15,$len - jnz .L${mode}_abort - lea .Lpadlock_saved_context(%rip),%rax - pushf - cld - call _padlock_verify_ctx - lea 16($ctx),$ctx # control word - xor %eax,%eax - xor %ebx,%ebx - testl \$`1<<5`,($ctx) # align bit in control word - jnz .L${mode}_aligned - test \$0x0f,$out - setz %al # !out_misaligned - test \$0x0f,$inp - setz %bl # !inp_misaligned - test %ebx,%eax - jnz .L${mode}_aligned - neg %rax - mov \$$PADLOCK_CHUNK,$chunk - not %rax # out_misaligned?-1:0 - lea (%rsp),%rbp - cmp $chunk,$len - cmovc $len,$chunk # chunk=len>PADLOCK_CHUNK?PADLOCK_CHUNK:len - and $chunk,%rax # out_misaligned?chunk:0 - mov $len,$chunk - neg %rax - and \$$PADLOCK_CHUNK-1,$chunk # chunk%=PADLOCK_CHUNK - lea (%rax,%rbp),%rsp - mov \$$PADLOCK_CHUNK,%rax - cmovz %rax,$chunk # chunk=chunk?:PADLOCK_CHUNK -___ -$code.=<<___ if ($mode eq "ctr32"); -.L${mode}_reenter: - mov -4($ctx),%eax # pull 32-bit counter - bswap %eax - neg %eax - and \$`$PADLOCK_CHUNK/16-1`,%eax - mov \$$PADLOCK_CHUNK,$chunk - shl \$4,%eax - cmovz $chunk,%rax - cmp %rax,$len - cmova %rax,$chunk # don't let counter cross PADLOCK_CHUNK - cmovbe $len,$chunk -___ -$code.=<<___ if ($PADLOCK_PREFETCH{$mode}); - cmp $chunk,$len - ja .L${mode}_loop - mov $inp,%rax # check if prefetch crosses page - cmp %rsp,%rbp - cmove $out,%rax - add $len,%rax - neg %rax - and \$0xfff,%rax # distance to page boundary - cmp \$$PADLOCK_PREFETCH{$mode},%rax - mov \$-$PADLOCK_PREFETCH{$mode},%rax - cmovae $chunk,%rax # mask=distance" -.align 16 -.data -.align 8 -.Lpadlock_saved_context: - .quad 0 -___ -$code =~ s/\`([^\`]*)\`/eval($1)/gem; - -print $code; - -close STDOUT; diff --git a/engines/build.info b/engines/build.info deleted file mode 100644 index 19e3eab0c1..0000000000 --- a/engines/build.info +++ /dev/null @@ -1,103 +0,0 @@ -IF[{- !$disabled{"engine"} -}] - $PADLOCKASM= - IF[{- !$disabled{asm} -}] - $PADLOCKASM_x86=e_padlock-x86.S - $PADLOCKASM_x86_64=e_padlock-x86_64.s - - # Now that we have defined all the arch specific variables, use the - # appropriate one, and define the appropriate macros - IF[$PADLOCKASM_{- $target{asm_arch} -}] - $PADLOCKASM=$PADLOCKASM_{- $target{asm_arch} -} - $PADLOCKDEF=PADLOCK_ASM - ENDIF - ENDIF - - IF[{- $disabled{"dynamic-engine"} -}] - LIBS=../libcrypto - IF[{- !$disabled{padlockeng} -}] - SOURCE[../libcrypto]=e_padlock.c $PADLOCKASM - DEFINE[../libcrypto]=$PADLOCKDEF - ENDIF - IF[{- !$disabled{capieng} -}] - SOURCE[../libcrypto]=e_capi.c - ENDIF - IF[{- !$disabled{afalgeng} -}] - SOURCE[../libcrypto]=e_afalg.c - ENDIF - IF[{- !$disabled{"devcryptoeng"} -}] - SOURCE[../libcrypto]=e_devcrypto.c - ENDIF - ELSE - IF[{- !$disabled{padlockeng} -}] - MODULES{engine}=padlock - SOURCE[padlock]=e_padlock.c $PADLOCKASM - DEFINE[padlock]=$PADLOCKDEF - DEPEND[padlock]=../libcrypto - INCLUDE[padlock]=../include - IF[{- defined $target{shared_defflag} -}] - SOURCE[padlock]=padlock.ld - GENERATE[padlock.ld]=../util/engines.num - ENDIF - ENDIF - IF[{- !$disabled{capieng} -}] - MODULES{engine}=capi - SOURCE[capi]=e_capi.c - DEPEND[capi]=../libcrypto - INCLUDE[capi]=../include - IF[{- defined $target{shared_defflag} -}] - SOURCE[capi]=capi.ld - GENERATE[capi.ld]=../util/engines.num - ENDIF - ENDIF - IF[{- !$disabled{afalgeng} -}] - MODULES{engine}=afalg - SOURCE[afalg]=e_afalg.c - DEPEND[afalg]=../libcrypto - INCLUDE[afalg]= ../include - IF[{- defined $target{shared_defflag} -}] - SOURCE[afalg]=afalg.ld - GENERATE[afalg.ld]=../util/engines.num - ENDIF - ENDIF - IF[{- !$disabled{"devcryptoeng"} -}] - MODULES{engine}=devcrypto - SOURCE[devcrypto]=e_devcrypto.c - DEPEND[devcrypto]=../libcrypto - INCLUDE[devcrypto]=../include - IF[{- defined $target{shared_defflag} -}] - SOURCE[devcrypto]=devcrypto.ld - GENERATE[devcrypto.ld]=../util/engines.num - ENDIF - ENDIF - IF[{- !$disabled{"loadereng"} -}] - MODULES{engine}=loader_attic - SOURCE[loader_attic]=e_loader_attic.c ../crypto/pem/pvkfmt.c - DEFINE[loader_attic]=OPENSSL_NO_PROVIDER_CODE - DEPEND[loader_attic]=../libcrypto - INCLUDE[loader_attic]=../include - IF[{- defined $target{shared_defflag} -}] - SOURCE[loader_attic]=loader_attic.ld - GENERATE[loader_attic.ld]=../util/engines.num - ENDIF - ENDIF - - MODULES{noinst,engine}=ossltest dasync - SOURCE[dasync]=e_dasync.c - DEPEND[dasync]=../libcrypto - INCLUDE[dasync]=../include - IF[{- defined $target{shared_defflag} -}] - SOURCE[dasync]=dasync.ld - GENERATE[dasync.ld]=../util/engines.num - ENDIF - - SOURCE[ossltest]=e_ossltest.c - DEPEND[ossltest]=../libcrypto - INCLUDE[ossltest]=../include - IF[{- defined $target{shared_defflag} -}] - SOURCE[ossltest]=ossltest.ld - GENERATE[ossltest.ld]=../util/engines.num - ENDIF - ENDIF - GENERATE[e_padlock-x86.S]=asm/e_padlock-x86.pl - GENERATE[e_padlock-x86_64.s]=asm/e_padlock-x86_64.pl -ENDIF diff --git a/engines/e_afalg.c b/engines/e_afalg.c deleted file mode 100644 index 83c5c8f094..0000000000 --- a/engines/e_afalg.c +++ /dev/null @@ -1,959 +0,0 @@ -/* - * Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* We need to use some deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - -/* Required for vmsplice */ -#ifndef _GNU_SOURCE -# define _GNU_SOURCE -#endif -#include -#include -#include - -#include -#include -#include -#include "internal/nelem.h" - -#include -#include -#define K_MAJ 4 -#define K_MIN1 1 -#define K_MIN2 0 -#if LINUX_VERSION_CODE < KERNEL_VERSION(K_MAJ, K_MIN1, K_MIN2) || \ - !defined(AF_ALG) -# ifndef PEDANTIC -# warning "AFALG ENGINE requires Kernel Headers >= 4.1.0" -# warning "Skipping Compilation of AFALG engine" -# endif -void engine_load_afalg_int(void); -void engine_load_afalg_int(void) -{ -} -#else - -# include -# include -# include - -# include -# include -# include - -/* clang-format off */ -# include "e_afalg.h" -# include "e_afalg_err.c" -/* clang-format on */ - -# ifndef SOL_ALG -# define SOL_ALG 279 -# endif - -# ifdef ALG_ZERO_COPY -# ifndef SPLICE_F_GIFT -# define SPLICE_F_GIFT (0x08) -# endif -# endif - -# define ALG_AES_IV_LEN 16 -# define ALG_IV_LEN(len) (sizeof(struct af_alg_iv) + (len)) -# define ALG_OP_TYPE unsigned int -# define ALG_OP_LEN (sizeof(ALG_OP_TYPE)) - -# ifdef OPENSSL_NO_DYNAMIC_ENGINE -void engine_load_afalg_int(void); -# endif - -/* Local Linkage Functions */ -static int afalg_init_aio(afalg_aio *aio); -static int afalg_fin_cipher_aio(afalg_aio *ptr, int sfd, - unsigned char *buf, size_t len); -static int afalg_create_sk(afalg_ctx *actx, const char *ciphertype, - const char *ciphername); -static int afalg_destroy(ENGINE *e); -static int afalg_init(ENGINE *e); -static int afalg_finish(ENGINE *e); -static const EVP_CIPHER *afalg_aes_cbc(int nid); -static cbc_handles *get_cipher_handle(int nid); -static int afalg_ciphers(ENGINE *e, const EVP_CIPHER **cipher, - const int **nids, int nid); -static int afalg_cipher_init(EVP_CIPHER_CTX *ctx, const unsigned char *key, - const unsigned char *iv, int enc); -static int afalg_do_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl); -static int afalg_cipher_cleanup(EVP_CIPHER_CTX *ctx); -static int afalg_chk_platform(void); - -/* Engine Id and Name */ -static const char *engine_afalg_id = "afalg"; -static const char *engine_afalg_name = "AFALG engine support"; - -static int afalg_cipher_nids[] = { - NID_aes_128_cbc, - NID_aes_192_cbc, - NID_aes_256_cbc, -}; - -static cbc_handles cbc_handle[] = {{AES_KEY_SIZE_128, NULL}, - {AES_KEY_SIZE_192, NULL}, - {AES_KEY_SIZE_256, NULL}}; - -static ossl_inline int io_setup(unsigned n, aio_context_t *ctx) -{ - return syscall(__NR_io_setup, n, ctx); -} - -static ossl_inline int eventfd(int n) -{ - return syscall(__NR_eventfd2, n, 0); -} - -static ossl_inline int io_destroy(aio_context_t ctx) -{ - return syscall(__NR_io_destroy, ctx); -} - -static ossl_inline int io_read(aio_context_t ctx, long n, struct iocb **iocb) -{ - return syscall(__NR_io_submit, ctx, n, iocb); -} - -/* A version of 'struct timespec' with 32-bit time_t and nanoseconds. */ -struct __timespec32 { - __kernel_long_t tv_sec; - __kernel_long_t tv_nsec; -}; - -static ossl_inline int io_getevents(aio_context_t ctx, long min, long max, - struct io_event *events, - struct timespec *timeout) -{ -#if defined(__NR_io_pgetevents_time64) - /* Check if we are a 32-bit architecture with a 64-bit time_t */ - if (sizeof(*timeout) != sizeof(struct __timespec32)) { - int ret = syscall(__NR_io_pgetevents_time64, ctx, min, max, events, - timeout, NULL); - if (ret == 0 || errno != ENOSYS) - return ret; - } -#endif - -#if defined(__NR_io_getevents) - if (sizeof(*timeout) == sizeof(struct __timespec32)) - /* - * time_t matches our architecture length, we can just use - * __NR_io_getevents - */ - return syscall(__NR_io_getevents, ctx, min, max, events, timeout); - else { - /* - * We don't have __NR_io_pgetevents_time64, but we are using a - * 64-bit time_t on a 32-bit architecture. If we can fit the - * timeout value in a 32-bit time_t, then let's do that - * and then use the __NR_io_getevents syscall. - */ - if (timeout && timeout->tv_sec == (long)timeout->tv_sec) { - struct __timespec32 ts32; - - ts32.tv_sec = (__kernel_long_t) timeout->tv_sec; - ts32.tv_nsec = (__kernel_long_t) timeout->tv_nsec; - - return syscall(__NR_io_getevents, ctx, min, max, events, &ts32); - } else { - return syscall(__NR_io_getevents, ctx, min, max, events, NULL); - } - } -#endif - - errno = ENOSYS; - return -1; -} - -static void afalg_waitfd_cleanup(ASYNC_WAIT_CTX *ctx, const void *key, - OSSL_ASYNC_FD waitfd, void *custom) -{ - close(waitfd); -} - -static int afalg_setup_async_event_notification(afalg_aio *aio) -{ - ASYNC_JOB *job; - ASYNC_WAIT_CTX *waitctx; - void *custom = NULL; - int ret; - - if ((job = ASYNC_get_current_job()) != NULL) { - /* Async mode */ - waitctx = ASYNC_get_wait_ctx(job); - if (waitctx == NULL) { - ALG_WARN("%s(%d): ASYNC_get_wait_ctx error", __FILE__, __LINE__); - return 0; - } - /* Get waitfd from ASYNC_WAIT_CTX if it is already set */ - ret = ASYNC_WAIT_CTX_get_fd(waitctx, engine_afalg_id, - &aio->efd, &custom); - if (ret == 0) { - /* - * waitfd is not set in ASYNC_WAIT_CTX, create a new one - * and set it. efd will be signaled when AIO operation completes - */ - aio->efd = eventfd(0); - if (aio->efd == -1) { - ALG_PERR("%s(%d): Failed to get eventfd : ", __FILE__, - __LINE__); - AFALGerr(AFALG_F_AFALG_SETUP_ASYNC_EVENT_NOTIFICATION, - AFALG_R_EVENTFD_FAILED); - return 0; - } - ret = ASYNC_WAIT_CTX_set_wait_fd(waitctx, engine_afalg_id, - aio->efd, custom, - afalg_waitfd_cleanup); - if (ret == 0) { - ALG_WARN("%s(%d): Failed to set wait fd", __FILE__, __LINE__); - close(aio->efd); - return 0; - } - /* make fd non-blocking in async mode */ - if (fcntl(aio->efd, F_SETFL, O_NONBLOCK) != 0) { - ALG_WARN("%s(%d): Failed to set event fd as NONBLOCKING", - __FILE__, __LINE__); - } - } - aio->mode = MODE_ASYNC; - } else { - /* Sync mode */ - aio->efd = eventfd(0); - if (aio->efd == -1) { - ALG_PERR("%s(%d): Failed to get eventfd : ", __FILE__, __LINE__); - AFALGerr(AFALG_F_AFALG_SETUP_ASYNC_EVENT_NOTIFICATION, - AFALG_R_EVENTFD_FAILED); - return 0; - } - aio->mode = MODE_SYNC; - } - return 1; -} - -static int afalg_init_aio(afalg_aio *aio) -{ - int r = -1; - - /* Initialise for AIO */ - aio->aio_ctx = 0; - r = io_setup(MAX_INFLIGHTS, &aio->aio_ctx); - if (r < 0) { - ALG_PERR("%s(%d): io_setup error : ", __FILE__, __LINE__); - AFALGerr(AFALG_F_AFALG_INIT_AIO, AFALG_R_IO_SETUP_FAILED); - return 0; - } - - memset(aio->cbt, 0, sizeof(aio->cbt)); - aio->efd = -1; - aio->mode = MODE_UNINIT; - - return 1; -} - -static int afalg_fin_cipher_aio(afalg_aio *aio, int sfd, unsigned char *buf, - size_t len) -{ - int r; - int retry = 0; - unsigned int done = 0; - struct iocb *cb; - struct timespec timeout; - struct io_event events[MAX_INFLIGHTS]; - u_int64_t eval = 0; - - timeout.tv_sec = 0; - timeout.tv_nsec = 0; - - /* if efd has not been initialised yet do it here */ - if (aio->mode == MODE_UNINIT) { - r = afalg_setup_async_event_notification(aio); - if (r == 0) - return 0; - } - - cb = &(aio->cbt[0 % MAX_INFLIGHTS]); - memset(cb, '\0', sizeof(*cb)); - cb->aio_fildes = sfd; - cb->aio_lio_opcode = IOCB_CMD_PREAD; - /* - * The pointer has to be converted to unsigned value first to avoid - * sign extension on cast to 64 bit value in 32-bit builds - */ - cb->aio_buf = (size_t)buf; - cb->aio_offset = 0; - cb->aio_data = 0; - cb->aio_nbytes = len; - cb->aio_flags = IOCB_FLAG_RESFD; - cb->aio_resfd = aio->efd; - - /* - * Perform AIO read on AFALG socket, this in turn performs an async - * crypto operation in kernel space - */ - r = io_read(aio->aio_ctx, 1, &cb); - if (r < 0) { - ALG_PWARN("%s(%d): io_read failed : ", __FILE__, __LINE__); - return 0; - } - - do { - /* While AIO read is being performed pause job */ - ASYNC_pause_job(); - - /* Check for completion of AIO read */ - r = read(aio->efd, &eval, sizeof(eval)); - if (r < 0) { - if (errno == EAGAIN || errno == EWOULDBLOCK) - continue; - ALG_PERR("%s(%d): read failed for event fd : ", __FILE__, __LINE__); - return 0; - } else if (r == 0 || eval <= 0) { - ALG_WARN("%s(%d): eventfd read %d bytes, eval = %lu\n", __FILE__, - __LINE__, r, eval); - } - if (eval > 0) { - -#ifdef OSSL_SANITIZE_MEMORY - /* - * In a memory sanitiser build, the changes to memory made by the - * system call aren't reliably detected. By initialising the - * memory here, the sanitiser is told that they are okay. - */ - memset(events, 0, sizeof(events)); -#endif - - /* Get results of AIO read */ - r = io_getevents(aio->aio_ctx, 1, MAX_INFLIGHTS, - events, &timeout); - if (r > 0) { - /* - * events.res indicates the actual status of the operation. - * Handle the error condition first. - */ - if (events[0].res < 0) { - /* - * Underlying operation cannot be completed at the time - * of previous submission. Resubmit for the operation. - */ - if (events[0].res == -EBUSY && retry++ < 3) { - r = io_read(aio->aio_ctx, 1, &cb); - if (r < 0) { - ALG_PERR("%s(%d): retry %d for io_read failed : ", - __FILE__, __LINE__, retry); - return 0; - } - continue; - } else { - char strbuf[32]; - /* - * sometimes __s64 is defined as long long int - * but on some archs ( like mips64 or powerpc64 ) it's just long int - * - * to be able to use BIO_snprintf() with %lld without warnings - * copy events[0].res to an long long int variable - * - * because long long int should always be at least 64 bit this should work - */ - long long int op_ret = events[0].res; - - /* - * Retries exceed for -EBUSY or unrecoverable error - * condition for this instance of operation. - */ - ALG_WARN - ("%s(%d): Crypto Operation failed with code %lld\n", - __FILE__, __LINE__, events[0].res); - BIO_snprintf(strbuf, sizeof(strbuf), "%lld", op_ret); - switch (events[0].res) { - case -ENOMEM: - AFALGerr(0, AFALG_R_KERNEL_OP_FAILED); - ERR_add_error_data(3, "-ENOMEM ( code ", strbuf, " )"); - break; - default: - AFALGerr(0, AFALG_R_KERNEL_OP_FAILED); - ERR_add_error_data(2, "code ", strbuf); - break; - } - return 0; - } - } - /* Operation successful. */ - done = 1; - } else if (r < 0) { - ALG_PERR("%s(%d): io_getevents failed : ", __FILE__, __LINE__); - return 0; - } else { - ALG_WARN("%s(%d): io_geteventd read 0 bytes\n", __FILE__, - __LINE__); - } - } - } while (!done); - - return 1; -} - -static ossl_inline void afalg_set_op_sk(struct cmsghdr *cmsg, - const ALG_OP_TYPE op) -{ - cmsg->cmsg_level = SOL_ALG; - cmsg->cmsg_type = ALG_SET_OP; - cmsg->cmsg_len = CMSG_LEN(ALG_OP_LEN); - memcpy(CMSG_DATA(cmsg), &op, ALG_OP_LEN); -} - -static void afalg_set_iv_sk(struct cmsghdr *cmsg, const unsigned char *iv, - const unsigned int len) -{ - struct af_alg_iv *aiv; - - cmsg->cmsg_level = SOL_ALG; - cmsg->cmsg_type = ALG_SET_IV; - cmsg->cmsg_len = CMSG_LEN(ALG_IV_LEN(len)); - aiv = (struct af_alg_iv *)CMSG_DATA(cmsg); - aiv->ivlen = len; - memcpy(aiv->iv, iv, len); -} - -static ossl_inline int afalg_set_key(afalg_ctx *actx, const unsigned char *key, - const int klen) -{ - int ret; - ret = setsockopt(actx->bfd, SOL_ALG, ALG_SET_KEY, key, klen); - if (ret < 0) { - ALG_PERR("%s(%d): Failed to set socket option : ", __FILE__, __LINE__); - AFALGerr(AFALG_F_AFALG_SET_KEY, AFALG_R_SOCKET_SET_KEY_FAILED); - return 0; - } - return 1; -} - -static int afalg_create_sk(afalg_ctx *actx, const char *ciphertype, - const char *ciphername) -{ - struct sockaddr_alg sa; - int r = -1; - - actx->bfd = actx->sfd = -1; - - memset(&sa, 0, sizeof(sa)); - sa.salg_family = AF_ALG; - OPENSSL_strlcpy((char *) sa.salg_type, ciphertype, sizeof(sa.salg_type)); - OPENSSL_strlcpy((char *) sa.salg_name, ciphername, sizeof(sa.salg_name)); - - actx->bfd = socket(AF_ALG, SOCK_SEQPACKET, 0); - if (actx->bfd == -1) { - ALG_PERR("%s(%d): Failed to open socket : ", __FILE__, __LINE__); - AFALGerr(AFALG_F_AFALG_CREATE_SK, AFALG_R_SOCKET_CREATE_FAILED); - goto err; - } - - r = bind(actx->bfd, (struct sockaddr *)&sa, sizeof(sa)); - if (r < 0) { - ALG_PERR("%s(%d): Failed to bind socket : ", __FILE__, __LINE__); - AFALGerr(AFALG_F_AFALG_CREATE_SK, AFALG_R_SOCKET_BIND_FAILED); - goto err; - } - - actx->sfd = accept(actx->bfd, NULL, 0); - if (actx->sfd < 0) { - ALG_PERR("%s(%d): Socket Accept Failed : ", __FILE__, __LINE__); - AFALGerr(AFALG_F_AFALG_CREATE_SK, AFALG_R_SOCKET_ACCEPT_FAILED); - goto err; - } - - return 1; - - err: - if (actx->bfd >= 0) - close(actx->bfd); - if (actx->sfd >= 0) - close(actx->sfd); - actx->bfd = actx->sfd = -1; - return 0; -} - -static int afalg_start_cipher_sk(afalg_ctx *actx, const unsigned char *in, - size_t inl, const unsigned char *iv, - unsigned int enc) -{ - struct msghdr msg; - struct cmsghdr *cmsg; - struct iovec iov; - ssize_t sbytes; -# ifdef ALG_ZERO_COPY - int ret; -# endif - char cbuf[CMSG_SPACE(ALG_IV_LEN(ALG_AES_IV_LEN)) + CMSG_SPACE(ALG_OP_LEN)]; - - memset(&msg, 0, sizeof(msg)); - memset(cbuf, 0, sizeof(cbuf)); - msg.msg_control = cbuf; - msg.msg_controllen = sizeof(cbuf); - - /* - * cipher direction (i.e. encrypt or decrypt) and iv are sent to the - * kernel as part of sendmsg()'s ancillary data - */ - cmsg = CMSG_FIRSTHDR(&msg); - afalg_set_op_sk(cmsg, enc); - cmsg = CMSG_NXTHDR(&msg, cmsg); - afalg_set_iv_sk(cmsg, iv, ALG_AES_IV_LEN); - - /* iov that describes input data */ - iov.iov_base = (unsigned char *)in; - iov.iov_len = inl; - - msg.msg_flags = MSG_MORE; - -# ifdef ALG_ZERO_COPY - /* - * ZERO_COPY mode - * Works best when buffer is 4k aligned - * OPENS: out of place processing (i.e. out != in) - */ - - /* Input data is not sent as part of call to sendmsg() */ - msg.msg_iovlen = 0; - msg.msg_iov = NULL; - - /* Sendmsg() sends iv and cipher direction to the kernel */ - sbytes = sendmsg(actx->sfd, &msg, 0); - if (sbytes < 0) { - ALG_PERR("%s(%d): sendmsg failed for zero copy cipher operation : ", - __FILE__, __LINE__); - return 0; - } - - /* - * vmsplice and splice are used to pin the user space input buffer for - * kernel space processing avoiding copies from user to kernel space - */ - ret = vmsplice(actx->zc_pipe[1], &iov, 1, SPLICE_F_GIFT); - if (ret < 0) { - ALG_PERR("%s(%d): vmsplice failed : ", __FILE__, __LINE__); - return 0; - } - - ret = splice(actx->zc_pipe[0], NULL, actx->sfd, NULL, inl, 0); - if (ret < 0) { - ALG_PERR("%s(%d): splice failed : ", __FILE__, __LINE__); - return 0; - } -# else - msg.msg_iovlen = 1; - msg.msg_iov = &iov; - - /* Sendmsg() sends iv, cipher direction and input data to the kernel */ - sbytes = sendmsg(actx->sfd, &msg, 0); - if (sbytes < 0) { - ALG_PERR("%s(%d): sendmsg failed for cipher operation : ", __FILE__, - __LINE__); - return 0; - } - - if (sbytes != (ssize_t) inl) { - ALG_WARN("Cipher operation send bytes %zd != inlen %zd\n", sbytes, - inl); - return 0; - } -# endif - - return 1; -} - -static int afalg_cipher_init(EVP_CIPHER_CTX *ctx, const unsigned char *key, - const unsigned char *iv, int enc) -{ - int ciphertype; - int ret, len; - afalg_ctx *actx; - const char *ciphername; - - if (ctx == NULL || key == NULL) { - ALG_WARN("%s(%d): Null Parameter\n", __FILE__, __LINE__); - return 0; - } - - if (EVP_CIPHER_CTX_get0_cipher(ctx) == NULL) { - ALG_WARN("%s(%d): Cipher object NULL\n", __FILE__, __LINE__); - return 0; - } - - actx = EVP_CIPHER_CTX_get_cipher_data(ctx); - if (actx == NULL) { - ALG_WARN("%s(%d): Cipher data NULL\n", __FILE__, __LINE__); - return 0; - } - - ciphertype = EVP_CIPHER_CTX_get_nid(ctx); - switch (ciphertype) { - case NID_aes_128_cbc: - case NID_aes_192_cbc: - case NID_aes_256_cbc: - ciphername = "cbc(aes)"; - break; - default: - ALG_WARN("%s(%d): Unsupported Cipher type %d\n", __FILE__, __LINE__, - ciphertype); - return 0; - } - - if (ALG_AES_IV_LEN != EVP_CIPHER_CTX_get_iv_length(ctx)) { - ALG_WARN("%s(%d): Unsupported IV length :%d\n", __FILE__, __LINE__, - EVP_CIPHER_CTX_get_iv_length(ctx)); - return 0; - } - - /* Setup AFALG socket for crypto processing */ - ret = afalg_create_sk(actx, "skcipher", ciphername); - if (ret < 1) - return 0; - - if ((len = EVP_CIPHER_CTX_get_key_length(ctx)) <= 0) - goto err; - ret = afalg_set_key(actx, key, len); - if (ret < 1) - goto err; - - /* Setup AIO ctx to allow async AFALG crypto processing */ - if (afalg_init_aio(&actx->aio) == 0) - goto err; - -# ifdef ALG_ZERO_COPY - pipe(actx->zc_pipe); -# endif - - actx->init_done = MAGIC_INIT_NUM; - - return 1; - -err: - close(actx->sfd); - close(actx->bfd); - return 0; -} - -static int afalg_do_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) -{ - afalg_ctx *actx; - int ret; - char nxtiv[ALG_AES_IV_LEN] = { 0 }; - - if (ctx == NULL || out == NULL || in == NULL) { - ALG_WARN("NULL parameter passed to function %s(%d)\n", __FILE__, - __LINE__); - return 0; - } - - actx = (afalg_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); - if (actx == NULL || actx->init_done != MAGIC_INIT_NUM) { - ALG_WARN("%s afalg ctx passed\n", - ctx == NULL ? "NULL" : "Uninitialised"); - return 0; - } - - /* - * set iv now for decrypt operation as the input buffer can be - * overwritten for inplace operation where in = out. - */ - if (EVP_CIPHER_CTX_is_encrypting(ctx) == 0) { - memcpy(nxtiv, in + (inl - ALG_AES_IV_LEN), ALG_AES_IV_LEN); - } - - /* Send input data to kernel space */ - ret = afalg_start_cipher_sk(actx, (unsigned char *)in, inl, - EVP_CIPHER_CTX_iv(ctx), - EVP_CIPHER_CTX_is_encrypting(ctx)); - if (ret < 1) { - return 0; - } - - /* Perform async crypto operation in kernel space */ - ret = afalg_fin_cipher_aio(&actx->aio, actx->sfd, out, inl); - if (ret < 1) - return 0; - - if (EVP_CIPHER_CTX_is_encrypting(ctx)) { - memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), out + (inl - ALG_AES_IV_LEN), - ALG_AES_IV_LEN); - } else { - memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), nxtiv, ALG_AES_IV_LEN); - } - - return 1; -} - -static int afalg_cipher_cleanup(EVP_CIPHER_CTX *ctx) -{ - afalg_ctx *actx; - - if (ctx == NULL) { - ALG_WARN("NULL parameter passed to function %s(%d)\n", __FILE__, - __LINE__); - return 0; - } - - actx = (afalg_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); - if (actx == NULL || actx->init_done != MAGIC_INIT_NUM) - return 1; - - close(actx->sfd); - close(actx->bfd); -# ifdef ALG_ZERO_COPY - close(actx->zc_pipe[0]); - close(actx->zc_pipe[1]); -# endif - /* close efd in sync mode, async mode is closed in afalg_waitfd_cleanup() */ - if (actx->aio.mode == MODE_SYNC) - close(actx->aio.efd); - io_destroy(actx->aio.aio_ctx); - - return 1; -} - -static cbc_handles *get_cipher_handle(int nid) -{ - switch (nid) { - case NID_aes_128_cbc: - return &cbc_handle[AES_CBC_128]; - case NID_aes_192_cbc: - return &cbc_handle[AES_CBC_192]; - case NID_aes_256_cbc: - return &cbc_handle[AES_CBC_256]; - default: - return NULL; - } -} - -static const EVP_CIPHER *afalg_aes_cbc(int nid) -{ - cbc_handles *cipher_handle = get_cipher_handle(nid); - - if (cipher_handle == NULL) - return NULL; - if (cipher_handle->_hidden == NULL - && ((cipher_handle->_hidden = - EVP_CIPHER_meth_new(nid, - AES_BLOCK_SIZE, - cipher_handle->key_size)) == NULL - || !EVP_CIPHER_meth_set_iv_length(cipher_handle->_hidden, - AES_IV_LEN) - || !EVP_CIPHER_meth_set_flags(cipher_handle->_hidden, - EVP_CIPH_CBC_MODE | - EVP_CIPH_FLAG_DEFAULT_ASN1) - || !EVP_CIPHER_meth_set_init(cipher_handle->_hidden, - afalg_cipher_init) - || !EVP_CIPHER_meth_set_do_cipher(cipher_handle->_hidden, - afalg_do_cipher) - || !EVP_CIPHER_meth_set_cleanup(cipher_handle->_hidden, - afalg_cipher_cleanup) - || !EVP_CIPHER_meth_set_impl_ctx_size(cipher_handle->_hidden, - sizeof(afalg_ctx)))) { - EVP_CIPHER_meth_free(cipher_handle->_hidden); - cipher_handle->_hidden= NULL; - } - return cipher_handle->_hidden; -} - -static int afalg_ciphers(ENGINE *e, const EVP_CIPHER **cipher, - const int **nids, int nid) -{ - int r = 1; - - if (cipher == NULL) { - *nids = afalg_cipher_nids; - return OSSL_NELEM(afalg_cipher_nids); - } - - switch (nid) { - case NID_aes_128_cbc: - case NID_aes_192_cbc: - case NID_aes_256_cbc: - *cipher = afalg_aes_cbc(nid); - break; - default: - *cipher = NULL; - r = 0; - } - return r; -} - -static int bind_afalg(ENGINE *e) -{ - /* Ensure the afalg error handling is set up */ - unsigned short i; - ERR_load_AFALG_strings(); - - if (!ENGINE_set_id(e, engine_afalg_id) - || !ENGINE_set_name(e, engine_afalg_name) - || !ENGINE_set_destroy_function(e, afalg_destroy) - || !ENGINE_set_init_function(e, afalg_init) - || !ENGINE_set_finish_function(e, afalg_finish)) { - AFALGerr(AFALG_F_BIND_AFALG, AFALG_R_INIT_FAILED); - return 0; - } - - /* - * Create _hidden_aes_xxx_cbc by calling afalg_aes_xxx_cbc - * now, as bind_aflag can only be called by one thread at a - * time. - */ - for (i = 0; i < OSSL_NELEM(afalg_cipher_nids); i++) { - if (afalg_aes_cbc(afalg_cipher_nids[i]) == NULL) { - AFALGerr(AFALG_F_BIND_AFALG, AFALG_R_INIT_FAILED); - return 0; - } - } - - if (!ENGINE_set_ciphers(e, afalg_ciphers)) { - AFALGerr(AFALG_F_BIND_AFALG, AFALG_R_INIT_FAILED); - return 0; - } - - return 1; -} - -# ifndef OPENSSL_NO_DYNAMIC_ENGINE -static int bind_helper(ENGINE *e, const char *id) -{ - if (id && (strcmp(id, engine_afalg_id) != 0)) - return 0; - - if (!afalg_chk_platform()) - return 0; - - if (!bind_afalg(e)) { - afalg_destroy(e); - return 0; - } - return 1; -} - -IMPLEMENT_DYNAMIC_CHECK_FN() - IMPLEMENT_DYNAMIC_BIND_FN(bind_helper) -# endif - -static int afalg_chk_platform(void) -{ - int ret; - int i; - int kver[3] = { -1, -1, -1 }; - int sock; - char *str; - struct utsname ut; - - ret = uname(&ut); - if (ret != 0) { - AFALGerr(AFALG_F_AFALG_CHK_PLATFORM, - AFALG_R_FAILED_TO_GET_PLATFORM_INFO); - return 0; - } - - str = strtok(ut.release, "."); - for (i = 0; i < 3 && str != NULL; i++) { - kver[i] = atoi(str); - str = strtok(NULL, "."); - } - - if (KERNEL_VERSION(kver[0], kver[1], kver[2]) - < KERNEL_VERSION(K_MAJ, K_MIN1, K_MIN2)) { - ALG_ERR("ASYNC AFALG not supported this kernel(%d.%d.%d)\n", - kver[0], kver[1], kver[2]); - ALG_ERR("ASYNC AFALG requires kernel version %d.%d.%d or later\n", - K_MAJ, K_MIN1, K_MIN2); - AFALGerr(AFALG_F_AFALG_CHK_PLATFORM, - AFALG_R_KERNEL_DOES_NOT_SUPPORT_ASYNC_AFALG); - return 0; - } - - /* Test if we can actually create an AF_ALG socket */ - sock = socket(AF_ALG, SOCK_SEQPACKET, 0); - if (sock == -1) { - AFALGerr(AFALG_F_AFALG_CHK_PLATFORM, AFALG_R_SOCKET_CREATE_FAILED); - return 0; - } - close(sock); - - return 1; -} - -# ifdef OPENSSL_NO_DYNAMIC_ENGINE -static ENGINE *engine_afalg(void) -{ - ENGINE *ret = ENGINE_new(); - if (ret == NULL) - return NULL; - if (!bind_afalg(ret)) { - ENGINE_free(ret); - return NULL; - } - return ret; -} - -void engine_load_afalg_int(void) -{ - ENGINE *toadd; - - if (!afalg_chk_platform()) - return; - - toadd = engine_afalg(); - if (toadd == NULL) - return; - ERR_set_mark(); - ENGINE_add(toadd); - /* - * If the "add" worked, it gets a structural reference. So either way, we - * release our just-created reference. - */ - ENGINE_free(toadd); - /* - * If the "add" didn't work, it was probably a conflict because it was - * already added (eg. someone calling ENGINE_load_blah then calling - * ENGINE_load_builtin_engines() perhaps). - */ - ERR_pop_to_mark(); -} -# endif - -static int afalg_init(ENGINE *e) -{ - return 1; -} - -static int afalg_finish(ENGINE *e) -{ - return 1; -} - -static int free_cbc(void) -{ - short unsigned int i; - for (i = 0; i < OSSL_NELEM(afalg_cipher_nids); i++) { - EVP_CIPHER_meth_free(cbc_handle[i]._hidden); - cbc_handle[i]._hidden = NULL; - } - return 1; -} - -static int afalg_destroy(ENGINE *e) -{ - ERR_unload_AFALG_strings(); - free_cbc(); - return 1; -} - -#endif /* KERNEL VERSION */ diff --git a/engines/e_afalg.ec b/engines/e_afalg.ec deleted file mode 100644 index 6d7420fe5c..0000000000 --- a/engines/e_afalg.ec +++ /dev/null @@ -1,3 +0,0 @@ -# The INPUT HEADER is scanned for declarations -# LIBNAME INPUT HEADER ERROR-TABLE FILE -L AFALG e_afalg_err.h e_afalg_err.c diff --git a/engines/e_afalg.h b/engines/e_afalg.h deleted file mode 100644 index b8e4911d21..0000000000 --- a/engines/e_afalg.h +++ /dev/null @@ -1,95 +0,0 @@ -/* - * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#ifndef OSSL_ENGINES_E_AFALG_H -# define OSSL_ENGINES_E_AFALG_H - -# if defined(__GNUC__) && __GNUC__ >= 4 && \ - (!defined(__STDC_VERSION__) || __STDC_VERSION__ < 199901L) -# pragma GCC diagnostic ignored "-Wvariadic-macros" -# endif - -# ifdef ALG_DEBUG -# define ALG_DGB(x, ...) fprintf(stderr, "ALG_DBG: " x, __VA_ARGS__) -# define ALG_INFO(x, ...) fprintf(stderr, "ALG_INFO: " x, __VA_ARGS__) -# define ALG_WARN(x, ...) fprintf(stderr, "ALG_WARN: " x, __VA_ARGS__) -# else -# define ALG_DGB(x, ...) -# define ALG_INFO(x, ...) -# define ALG_WARN(x, ...) -# endif - -# define ALG_ERR(x, ...) fprintf(stderr, "ALG_ERR: " x, __VA_ARGS__) -# define ALG_PERR(x, ...) \ - do { \ - fprintf(stderr, "ALG_PERR: " x, __VA_ARGS__); \ - perror(NULL); \ - } while(0) -# define ALG_PWARN(x, ...) \ - do { \ - fprintf(stderr, "ALG_PERR: " x, __VA_ARGS__); \ - perror(NULL); \ - } while(0) - -# ifndef AES_BLOCK_SIZE -# define AES_BLOCK_SIZE 16 -# endif -# define AES_KEY_SIZE_128 16 -# define AES_KEY_SIZE_192 24 -# define AES_KEY_SIZE_256 32 -# define AES_IV_LEN 16 - -# define MAX_INFLIGHTS 1 - -typedef enum { - MODE_UNINIT = 0, - MODE_SYNC, - MODE_ASYNC -} op_mode; - -enum { - AES_CBC_128 = 0, - AES_CBC_192, - AES_CBC_256 -}; - -struct cbc_cipher_handles { - int key_size; - EVP_CIPHER *_hidden; -}; - -typedef struct cbc_cipher_handles cbc_handles; - -struct afalg_aio_st { - int efd; - op_mode mode; - aio_context_t aio_ctx; - struct io_event events[MAX_INFLIGHTS]; - struct iocb cbt[MAX_INFLIGHTS]; -}; -typedef struct afalg_aio_st afalg_aio; - -/* - * MAGIC Number to identify correct initialisation - * of afalg_ctx. - */ -# define MAGIC_INIT_NUM 0x1890671 - -struct afalg_ctx_st { - int init_done; - int sfd; - int bfd; -# ifdef ALG_ZERO_COPY - int zc_pipe[2]; -# endif - afalg_aio aio; -}; - -typedef struct afalg_ctx_st afalg_ctx; -#endif diff --git a/engines/e_afalg.txt b/engines/e_afalg.txt deleted file mode 100644 index 9b5fee8475..0000000000 --- a/engines/e_afalg.txt +++ /dev/null @@ -1,22 +0,0 @@ -# Copyright 1999-2022 The OpenSSL Project Authors. All Rights Reserved. -# -# Licensed under the Apache License 2.0 (the "License"). You may not use -# this file except in compliance with the License. You can obtain a copy -# in the file LICENSE in the source distribution or at -# https://www.openssl.org/source/license.html - -#Reason codes -AFALG_R_EVENTFD_FAILED:108:eventfd failed -AFALG_R_FAILED_TO_GET_PLATFORM_INFO:111:failed to get platform info -AFALG_R_INIT_FAILED:100:init failed -AFALG_R_IO_SETUP_FAILED:105:io setup failed -AFALG_R_KERNEL_DOES_NOT_SUPPORT_AFALG:101:kernel does not support afalg -AFALG_R_KERNEL_DOES_NOT_SUPPORT_ASYNC_AFALG:107:\ - kernel does not support async afalg -AFALG_R_KERNEL_OP_FAILED:112:kernel op failed -AFALG_R_MEM_ALLOC_FAILED:102:mem alloc failed -AFALG_R_SOCKET_ACCEPT_FAILED:110:socket accept failed -AFALG_R_SOCKET_BIND_FAILED:103:socket bind failed -AFALG_R_SOCKET_CREATE_FAILED:109:socket create failed -AFALG_R_SOCKET_OPERATION_FAILED:104:socket operation failed -AFALG_R_SOCKET_SET_KEY_FAILED:106:socket set key failed diff --git a/engines/e_afalg_err.c b/engines/e_afalg_err.c deleted file mode 100644 index fa38678e9e..0000000000 --- a/engines/e_afalg_err.c +++ /dev/null @@ -1,72 +0,0 @@ -/* - * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#include -#include "e_afalg_err.h" - -#ifndef OPENSSL_NO_ERR - -static ERR_STRING_DATA AFALG_str_reasons[] = { - {ERR_PACK(0, 0, AFALG_R_EVENTFD_FAILED), "eventfd failed"}, - {ERR_PACK(0, 0, AFALG_R_FAILED_TO_GET_PLATFORM_INFO), - "failed to get platform info"}, - {ERR_PACK(0, 0, AFALG_R_INIT_FAILED), "init failed"}, - {ERR_PACK(0, 0, AFALG_R_IO_SETUP_FAILED), "io setup failed"}, - {ERR_PACK(0, 0, AFALG_R_KERNEL_DOES_NOT_SUPPORT_AFALG), - "kernel does not support afalg"}, - {ERR_PACK(0, 0, AFALG_R_KERNEL_DOES_NOT_SUPPORT_ASYNC_AFALG), - "kernel does not support async afalg"}, - {ERR_PACK(0, 0, AFALG_R_KERNEL_OP_FAILED), "kernel op failed"}, - {ERR_PACK(0, 0, AFALG_R_MEM_ALLOC_FAILED), "mem alloc failed"}, - {ERR_PACK(0, 0, AFALG_R_SOCKET_ACCEPT_FAILED), "socket accept failed"}, - {ERR_PACK(0, 0, AFALG_R_SOCKET_BIND_FAILED), "socket bind failed"}, - {ERR_PACK(0, 0, AFALG_R_SOCKET_CREATE_FAILED), "socket create failed"}, - {ERR_PACK(0, 0, AFALG_R_SOCKET_OPERATION_FAILED), - "socket operation failed"}, - {ERR_PACK(0, 0, AFALG_R_SOCKET_SET_KEY_FAILED), "socket set key failed"}, - {0, NULL} -}; - -#endif - -static int lib_code = 0; -static int error_loaded = 0; - -static int ERR_load_AFALG_strings(void) -{ - if (lib_code == 0) - lib_code = ERR_get_next_error_library(); - - if (!error_loaded) { -#ifndef OPENSSL_NO_ERR - ERR_load_strings(lib_code, AFALG_str_reasons); -#endif - error_loaded = 1; - } - return 1; -} - -static void ERR_unload_AFALG_strings(void) -{ - if (error_loaded) { -#ifndef OPENSSL_NO_ERR - ERR_unload_strings(lib_code, AFALG_str_reasons); -#endif - error_loaded = 0; - } -} - -static void ERR_AFALG_error(int function, int reason, const char *file, int line) -{ - if (lib_code == 0) - lib_code = ERR_get_next_error_library(); - ERR_raise(lib_code, reason); - ERR_set_debug(file, line, NULL); -} diff --git a/engines/e_afalg_err.h b/engines/e_afalg_err.h deleted file mode 100644 index 8328b21e8e..0000000000 --- a/engines/e_afalg_err.h +++ /dev/null @@ -1,39 +0,0 @@ -/* - * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#ifndef OSSL_E_AFALG_ERR_H -# define OSSL_E_AFALG_ERR_H -# pragma once - -# include -# include - - -# define AFALGerr(f, r) ERR_AFALG_error(0, (r), OPENSSL_FILE, OPENSSL_LINE) - - -/* - * AFALG reason codes. - */ -# define AFALG_R_EVENTFD_FAILED 108 -# define AFALG_R_FAILED_TO_GET_PLATFORM_INFO 111 -# define AFALG_R_INIT_FAILED 100 -# define AFALG_R_IO_SETUP_FAILED 105 -# define AFALG_R_KERNEL_DOES_NOT_SUPPORT_AFALG 101 -# define AFALG_R_KERNEL_DOES_NOT_SUPPORT_ASYNC_AFALG 107 -# define AFALG_R_KERNEL_OP_FAILED 112 -# define AFALG_R_MEM_ALLOC_FAILED 102 -# define AFALG_R_SOCKET_ACCEPT_FAILED 110 -# define AFALG_R_SOCKET_BIND_FAILED 103 -# define AFALG_R_SOCKET_CREATE_FAILED 109 -# define AFALG_R_SOCKET_OPERATION_FAILED 104 -# define AFALG_R_SOCKET_SET_KEY_FAILED 106 - -#endif diff --git a/engines/e_capi.c b/engines/e_capi.c deleted file mode 100644 index 5d5546b98f..0000000000 --- a/engines/e_capi.c +++ /dev/null @@ -1,1936 +0,0 @@ -/* - * Copyright 2008-2025 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* We need to use some deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - -#ifdef _WIN32 -# ifndef _WIN32_WINNT -# define _WIN32_WINNT 0x0400 -# endif -# include -# include - -# include -# include -# include -# include -# ifndef alloca -# define alloca _alloca -# endif - -# include - -# ifndef OPENSSL_NO_CAPIENG - -# include -# include -# include -# include - -/* - * This module uses several "new" interfaces, among which is - * CertGetCertificateContextProperty. CERT_KEY_PROV_INFO_PROP_ID is - * one of possible values you can pass to function in question. By - * checking if it's defined we can see if wincrypt.h and accompanying - * crypt32.lib are in shape. The native MingW32 headers up to and - * including __W32API_VERSION 3.14 lack of struct DSSPUBKEY and the - * defines CERT_STORE_PROV_SYSTEM_A and CERT_STORE_READONLY_FLAG, - * so we check for these too and avoid compiling. - * Yes, it's rather "weak" test and if compilation fails, - * then re-configure with -DOPENSSL_NO_CAPIENG. - */ -# if defined(CERT_KEY_PROV_INFO_PROP_ID) && \ - defined(CERT_STORE_PROV_SYSTEM_A) && \ - defined(CERT_STORE_READONLY_FLAG) -# define __COMPILE_CAPIENG -# endif /* CERT_KEY_PROV_INFO_PROP_ID */ -# endif /* OPENSSL_NO_CAPIENG */ -#endif /* _WIN32 */ - -#ifdef __COMPILE_CAPIENG - -# undef X509_EXTENSIONS - -/* Definitions which may be missing from earlier version of headers */ -# ifndef CERT_STORE_OPEN_EXISTING_FLAG -# define CERT_STORE_OPEN_EXISTING_FLAG 0x00004000 -# endif - -# ifndef CERT_STORE_CREATE_NEW_FLAG -# define CERT_STORE_CREATE_NEW_FLAG 0x00002000 -# endif - -# ifndef CERT_SYSTEM_STORE_CURRENT_USER -# define CERT_SYSTEM_STORE_CURRENT_USER 0x00010000 -# endif - -# ifndef ALG_SID_SHA_256 -# define ALG_SID_SHA_256 12 -# endif -# ifndef ALG_SID_SHA_384 -# define ALG_SID_SHA_384 13 -# endif -# ifndef ALG_SID_SHA_512 -# define ALG_SID_SHA_512 14 -# endif - -# ifndef CALG_SHA_256 -# define CALG_SHA_256 (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_SHA_256) -# endif -# ifndef CALG_SHA_384 -# define CALG_SHA_384 (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_SHA_384) -# endif -# ifndef CALG_SHA_512 -# define CALG_SHA_512 (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_SHA_512) -# endif - -# ifndef PROV_RSA_AES -# define PROV_RSA_AES 24 -# endif - -# include -# include -# include - -/* clang-format off */ -# include "e_capi_err.h" -# include "e_capi_err.c" -/* clang-format on */ - -static const char *engine_capi_id = "capi"; -static const char *engine_capi_name = "CryptoAPI ENGINE"; - -typedef struct CAPI_CTX_st CAPI_CTX; -typedef struct CAPI_KEY_st CAPI_KEY; - -static void capi_addlasterror(void); -static void capi_adderror(DWORD err); - -static void CAPI_trace(CAPI_CTX *ctx, char *format, ...); - -static int capi_list_providers(CAPI_CTX *ctx, BIO *out); -static int capi_list_containers(CAPI_CTX *ctx, BIO *out); -int capi_list_certs(CAPI_CTX *ctx, BIO *out, char *storename); -void capi_free_key(CAPI_KEY *key); - -static PCCERT_CONTEXT capi_find_cert(CAPI_CTX *ctx, const char *id, - HCERTSTORE hstore); - -CAPI_KEY *capi_find_key(CAPI_CTX *ctx, const char *id); - -static EVP_PKEY *capi_load_privkey(ENGINE *eng, const char *key_id, - UI_METHOD *ui_method, void *callback_data); -static int capi_rsa_sign(int dtype, const unsigned char *m, - unsigned int m_len, unsigned char *sigret, - unsigned int *siglen, const RSA *rsa); -static int capi_rsa_priv_enc(int flen, const unsigned char *from, - unsigned char *to, RSA *rsa, int padding); -static int capi_rsa_priv_dec(int flen, const unsigned char *from, - unsigned char *to, RSA *rsa, int padding); -static int capi_rsa_free(RSA *rsa); - -# ifndef OPENSSL_NO_DSA -static DSA_SIG *capi_dsa_do_sign(const unsigned char *digest, int dlen, - DSA *dsa); -static int capi_dsa_free(DSA *dsa); -# endif - -static int capi_load_ssl_client_cert(ENGINE *e, SSL *ssl, - STACK_OF(X509_NAME) *ca_dn, X509 **pcert, - EVP_PKEY **pkey, STACK_OF(X509) **pother, - UI_METHOD *ui_method, - void *callback_data); - -static int cert_select_simple(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs); -# ifdef OPENSSL_CAPIENG_DIALOG -static int cert_select_dialog(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs); -# endif - -void engine_load_capi_int(void); - -typedef PCCERT_CONTEXT(WINAPI *CERTDLG)(HCERTSTORE, HWND, LPCWSTR, - LPCWSTR, DWORD, DWORD, void *); -typedef HWND(WINAPI *GETCONSWIN)(void); - -/* - * This structure contains CAPI ENGINE specific data: it contains various - * global options and affects how other functions behave. - */ - -# define CAPI_DBG_TRACE 2 -# define CAPI_DBG_ERROR 1 - -struct CAPI_CTX_st { - int debug_level; - char *debug_file; - /* Parameters to use for container lookup */ - DWORD keytype; - LPSTR cspname; - DWORD csptype; - /* Certificate store name to use */ - LPSTR storename; - LPSTR ssl_client_store; - /* System store flags */ - DWORD store_flags; -/* Lookup string meanings in load_private_key */ -# define CAPI_LU_SUBSTR 1 /* Substring of subject: uses "storename" */ -# define CAPI_LU_FNAME 2 /* Friendly name: uses storename */ -# define CAPI_LU_CONTNAME 3 /* Container name: uses cspname, keytype */ - int lookup_method; -/* Info to dump with dumpcerts option */ -# define CAPI_DMP_SUMMARY 0x1 /* Issuer and serial name strings */ -# define CAPI_DMP_FNAME 0x2 /* Friendly name */ -# define CAPI_DMP_FULL 0x4 /* Full X509_print dump */ -# define CAPI_DMP_PEM 0x8 /* Dump PEM format certificate */ -# define CAPI_DMP_PSKEY 0x10 /* Dump pseudo key (if possible) */ -# define CAPI_DMP_PKEYINFO 0x20 /* Dump key info (if possible) */ - DWORD dump_flags; - int (*client_cert_select) (ENGINE *e, SSL *ssl, STACK_OF(X509) *certs); - CERTDLG certselectdlg; - GETCONSWIN getconswindow; -}; - -static CAPI_CTX *capi_ctx_new(void); -static void capi_ctx_free(CAPI_CTX *ctx); -static int capi_ctx_set_provname(CAPI_CTX *ctx, LPSTR pname, DWORD type, - int check); -static int capi_ctx_set_provname_idx(CAPI_CTX *ctx, int idx); - -# define CAPI_CMD_LIST_CERTS ENGINE_CMD_BASE -# define CAPI_CMD_LOOKUP_CERT (ENGINE_CMD_BASE + 1) -# define CAPI_CMD_DEBUG_LEVEL (ENGINE_CMD_BASE + 2) -# define CAPI_CMD_DEBUG_FILE (ENGINE_CMD_BASE + 3) -# define CAPI_CMD_KEYTYPE (ENGINE_CMD_BASE + 4) -# define CAPI_CMD_LIST_CSPS (ENGINE_CMD_BASE + 5) -# define CAPI_CMD_SET_CSP_IDX (ENGINE_CMD_BASE + 6) -# define CAPI_CMD_SET_CSP_NAME (ENGINE_CMD_BASE + 7) -# define CAPI_CMD_SET_CSP_TYPE (ENGINE_CMD_BASE + 8) -# define CAPI_CMD_LIST_CONTAINERS (ENGINE_CMD_BASE + 9) -# define CAPI_CMD_LIST_OPTIONS (ENGINE_CMD_BASE + 10) -# define CAPI_CMD_LOOKUP_METHOD (ENGINE_CMD_BASE + 11) -# define CAPI_CMD_STORE_NAME (ENGINE_CMD_BASE + 12) -# define CAPI_CMD_STORE_FLAGS (ENGINE_CMD_BASE + 13) - -static const ENGINE_CMD_DEFN capi_cmd_defns[] = { - {CAPI_CMD_LIST_CERTS, - "list_certs", - "List all certificates in store", - ENGINE_CMD_FLAG_NO_INPUT}, - {CAPI_CMD_LOOKUP_CERT, - "lookup_cert", - "Lookup and output certificates", - ENGINE_CMD_FLAG_STRING}, - {CAPI_CMD_DEBUG_LEVEL, - "debug_level", - "debug level (1=errors, 2=trace)", - ENGINE_CMD_FLAG_NUMERIC}, - {CAPI_CMD_DEBUG_FILE, - "debug_file", - "debugging filename)", - ENGINE_CMD_FLAG_STRING}, - {CAPI_CMD_KEYTYPE, - "key_type", - "Key type: 1=AT_KEYEXCHANGE (default), 2=AT_SIGNATURE", - ENGINE_CMD_FLAG_NUMERIC}, - {CAPI_CMD_LIST_CSPS, - "list_csps", - "List all CSPs", - ENGINE_CMD_FLAG_NO_INPUT}, - {CAPI_CMD_SET_CSP_IDX, - "csp_idx", - "Set CSP by index", - ENGINE_CMD_FLAG_NUMERIC}, - {CAPI_CMD_SET_CSP_NAME, - "csp_name", - "Set CSP name, (default CSP used if not specified)", - ENGINE_CMD_FLAG_STRING}, - {CAPI_CMD_SET_CSP_TYPE, - "csp_type", - "Set CSP type, (default RSA_PROV_FULL)", - ENGINE_CMD_FLAG_NUMERIC}, - {CAPI_CMD_LIST_CONTAINERS, - "list_containers", - "list container names", - ENGINE_CMD_FLAG_NO_INPUT}, - {CAPI_CMD_LIST_OPTIONS, - "list_options", - "Set list options (1=summary,2=friendly name, 4=full printout, 8=PEM output, 16=XXX, " - "32=private key info)", - ENGINE_CMD_FLAG_NUMERIC}, - {CAPI_CMD_LOOKUP_METHOD, - "lookup_method", - "Set key lookup method (1=substring, 2=friendlyname, 3=container name)", - ENGINE_CMD_FLAG_NUMERIC}, - {CAPI_CMD_STORE_NAME, - "store_name", - "certificate store name, default \"MY\"", - ENGINE_CMD_FLAG_STRING}, - {CAPI_CMD_STORE_FLAGS, - "store_flags", - "Certificate store flags: 1 = system store", - ENGINE_CMD_FLAG_NUMERIC}, - - {0, NULL, NULL, 0} -}; - -static int capi_idx = -1; -static int rsa_capi_idx = -1; -static int dsa_capi_idx = -1; -static int cert_capi_idx = -1; - -static int capi_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f) (void)) -{ - int ret = 1; - CAPI_CTX *ctx; - BIO *out; - LPSTR tmpstr; - if (capi_idx == -1) { - CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_ENGINE_NOT_INITIALIZED); - return 0; - } - ctx = ENGINE_get_ex_data(e, capi_idx); - out = BIO_new_fp(stdout, BIO_NOCLOSE); - if (out == NULL) { - CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_FILE_OPEN_ERROR); - return 0; - } - switch (cmd) { - case CAPI_CMD_LIST_CSPS: - ret = capi_list_providers(ctx, out); - break; - - case CAPI_CMD_LIST_CERTS: - ret = capi_list_certs(ctx, out, NULL); - break; - - case CAPI_CMD_LOOKUP_CERT: - ret = capi_list_certs(ctx, out, p); - break; - - case CAPI_CMD_LIST_CONTAINERS: - ret = capi_list_containers(ctx, out); - break; - - case CAPI_CMD_STORE_NAME: - tmpstr = OPENSSL_strdup(p); - if (tmpstr != NULL) { - OPENSSL_free(ctx->storename); - ctx->storename = tmpstr; - CAPI_trace(ctx, "Setting store name to %s\n", p); - } else { - ret = 0; - } - break; - - case CAPI_CMD_STORE_FLAGS: - if (i & 1) { - ctx->store_flags |= CERT_SYSTEM_STORE_LOCAL_MACHINE; - ctx->store_flags &= ~CERT_SYSTEM_STORE_CURRENT_USER; - } else { - ctx->store_flags |= CERT_SYSTEM_STORE_CURRENT_USER; - ctx->store_flags &= ~CERT_SYSTEM_STORE_LOCAL_MACHINE; - } - CAPI_trace(ctx, "Setting flags to %d\n", i); - break; - - case CAPI_CMD_DEBUG_LEVEL: - ctx->debug_level = (int)i; - CAPI_trace(ctx, "Setting debug level to %d\n", ctx->debug_level); - break; - - case CAPI_CMD_DEBUG_FILE: - tmpstr = OPENSSL_strdup(p); - if (tmpstr != NULL) { - ctx->debug_file = tmpstr; - CAPI_trace(ctx, "Setting debug file to %s\n", ctx->debug_file); - } else { - ret = 0; - } - break; - - case CAPI_CMD_KEYTYPE: - ctx->keytype = i; - CAPI_trace(ctx, "Setting key type to %d\n", ctx->keytype); - break; - - case CAPI_CMD_SET_CSP_IDX: - ret = capi_ctx_set_provname_idx(ctx, i); - break; - - case CAPI_CMD_LIST_OPTIONS: - ctx->dump_flags = i; - break; - - case CAPI_CMD_LOOKUP_METHOD: - if (i < 1 || i > 3) { - CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_INVALID_LOOKUP_METHOD); - BIO_free(out); - return 0; - } - ctx->lookup_method = i; - break; - - case CAPI_CMD_SET_CSP_NAME: - ret = capi_ctx_set_provname(ctx, p, ctx->csptype, 1); - break; - - case CAPI_CMD_SET_CSP_TYPE: - ctx->csptype = i; - break; - - default: - CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_UNKNOWN_COMMAND); - ret = 0; - } - - BIO_free(out); - return ret; - -} - -static RSA_METHOD *capi_rsa_method = NULL; -# ifndef OPENSSL_NO_DSA -static DSA_METHOD *capi_dsa_method = NULL; -# endif - -static int use_aes_csp = 0; -static const WCHAR rsa_aes_cspname[] = - L"Microsoft Enhanced RSA and AES Cryptographic Provider"; -static const WCHAR rsa_enh_cspname[] = - L"Microsoft Enhanced Cryptographic Provider v1.0"; - -static int capi_init(ENGINE *e) -{ - CAPI_CTX *ctx; - const RSA_METHOD *ossl_rsa_meth; -# ifndef OPENSSL_NO_DSA - const DSA_METHOD *ossl_dsa_meth; -# endif - HCRYPTPROV hprov; - - if (capi_idx < 0) { - capi_idx = ENGINE_get_ex_new_index(0, NULL, NULL, NULL, 0); - if (capi_idx < 0) { - CAPIerr(CAPI_F_CAPI_INIT, ERR_R_ENGINE_LIB); - goto err; - } - - cert_capi_idx = X509_get_ex_new_index(0, NULL, NULL, NULL, 0); - - /* Setup RSA_METHOD */ - rsa_capi_idx = RSA_get_ex_new_index(0, NULL, NULL, NULL, 0); - ossl_rsa_meth = RSA_PKCS1_OpenSSL(); - if (!RSA_meth_set_pub_enc(capi_rsa_method, - RSA_meth_get_pub_enc(ossl_rsa_meth)) - || !RSA_meth_set_pub_dec(capi_rsa_method, - RSA_meth_get_pub_dec(ossl_rsa_meth)) - || !RSA_meth_set_priv_enc(capi_rsa_method, capi_rsa_priv_enc) - || !RSA_meth_set_priv_dec(capi_rsa_method, capi_rsa_priv_dec) - || !RSA_meth_set_mod_exp(capi_rsa_method, - RSA_meth_get_mod_exp(ossl_rsa_meth)) - || !RSA_meth_set_bn_mod_exp(capi_rsa_method, - RSA_meth_get_bn_mod_exp(ossl_rsa_meth)) - || !RSA_meth_set_finish(capi_rsa_method, capi_rsa_free) - || !RSA_meth_set_sign(capi_rsa_method, capi_rsa_sign)) { - CAPIerr(CAPI_F_CAPI_INIT, ERR_R_RSA_LIB); - goto err; - } - -# ifndef OPENSSL_NO_DSA - /* Setup DSA Method */ - dsa_capi_idx = DSA_get_ex_new_index(0, NULL, NULL, NULL, 0); - ossl_dsa_meth = DSA_OpenSSL(); - if (!DSA_meth_set_sign(capi_dsa_method, capi_dsa_do_sign) - || !DSA_meth_set_verify(capi_dsa_method, - DSA_meth_get_verify(ossl_dsa_meth)) - || !DSA_meth_set_finish(capi_dsa_method, capi_dsa_free) - || !DSA_meth_set_mod_exp(capi_dsa_method, - DSA_meth_get_mod_exp(ossl_dsa_meth)) - || !DSA_meth_set_bn_mod_exp(capi_dsa_method, - DSA_meth_get_bn_mod_exp(ossl_dsa_meth))) { - CAPIerr(CAPI_F_CAPI_INIT, ERR_R_DSA_LIB); - goto err; - } -# endif - } - - ctx = capi_ctx_new(); - if (ctx == NULL) { - CAPIerr(CAPI_F_CAPI_INIT, ERR_R_CAPI_LIB); - goto err; - } - - ENGINE_set_ex_data(e, capi_idx, ctx); - -# ifdef OPENSSL_CAPIENG_DIALOG - { - HMODULE cryptui = LoadLibrary(TEXT("CRYPTUI.DLL")); - HMODULE kernel = GetModuleHandle(TEXT("KERNEL32.DLL")); - if (cryptui) - ctx->certselectdlg = - (CERTDLG) GetProcAddress(cryptui, - "CryptUIDlgSelectCertificateFromStore"); - if (kernel) - ctx->getconswindow = - (GETCONSWIN) GetProcAddress(kernel, "GetConsoleWindow"); - if (cryptui && !OPENSSL_isservice()) - ctx->client_cert_select = cert_select_dialog; - } -# endif - - /* See if there is RSA+AES CSP */ - if (CryptAcquireContextW(&hprov, NULL, rsa_aes_cspname, PROV_RSA_AES, - CRYPT_VERIFYCONTEXT)) { - use_aes_csp = 1; - CryptReleaseContext(hprov, 0); - } - - return 1; - - err: - return 0; -} - -static int capi_destroy(ENGINE *e) -{ - RSA_meth_free(capi_rsa_method); - capi_rsa_method = NULL; -# ifndef OPENSSL_NO_DSA - DSA_meth_free(capi_dsa_method); - capi_dsa_method = NULL; -# endif - ERR_unload_CAPI_strings(); - return 1; -} - -static int capi_finish(ENGINE *e) -{ - CAPI_CTX *ctx; - ctx = ENGINE_get_ex_data(e, capi_idx); - capi_ctx_free(ctx); - ENGINE_set_ex_data(e, capi_idx, NULL); - return 1; -} - -/* - * CryptoAPI key application data. This contains a handle to the private key - * container (for sign operations) and a handle to the key (for decrypt - * operations). - */ - -struct CAPI_KEY_st { - /* Associated certificate context (if any) */ - PCCERT_CONTEXT pcert; - HCRYPTPROV hprov; - HCRYPTKEY key; - DWORD keyspec; -}; - -static int bind_capi(ENGINE *e) -{ - capi_rsa_method = RSA_meth_new("CryptoAPI RSA method", 0); - if (capi_rsa_method == NULL) - return 0; -# ifndef OPENSSL_NO_DSA - capi_dsa_method = DSA_meth_new("CryptoAPI DSA method", 0); - if (capi_dsa_method == NULL) - goto memerr; -# endif - if (!ENGINE_set_id(e, engine_capi_id) - || !ENGINE_set_name(e, engine_capi_name) - || !ENGINE_set_flags(e, ENGINE_FLAGS_NO_REGISTER_ALL) - || !ENGINE_set_init_function(e, capi_init) - || !ENGINE_set_finish_function(e, capi_finish) - || !ENGINE_set_destroy_function(e, capi_destroy) - || !ENGINE_set_RSA(e, capi_rsa_method) -# ifndef OPENSSL_NO_DSA - || !ENGINE_set_DSA(e, capi_dsa_method) -# endif - || !ENGINE_set_load_privkey_function(e, capi_load_privkey) - || !ENGINE_set_load_ssl_client_cert_function(e, - capi_load_ssl_client_cert) - || !ENGINE_set_cmd_defns(e, capi_cmd_defns) - || !ENGINE_set_ctrl_function(e, capi_ctrl)) - goto memerr; - ERR_load_CAPI_strings(); - - return 1; - memerr: - RSA_meth_free(capi_rsa_method); - capi_rsa_method = NULL; -# ifndef OPENSSL_NO_DSA - DSA_meth_free(capi_dsa_method); - capi_dsa_method = NULL; -# endif - return 0; -} - -# ifndef OPENSSL_NO_DYNAMIC_ENGINE -static int bind_helper(ENGINE *e, const char *id) -{ - if (id && (strcmp(id, engine_capi_id) != 0)) - return 0; - if (!bind_capi(e)) - return 0; - return 1; -} - -IMPLEMENT_DYNAMIC_CHECK_FN() -IMPLEMENT_DYNAMIC_BIND_FN(bind_helper) -# else -static ENGINE *engine_capi(void) -{ - ENGINE *ret = ENGINE_new(); - if (ret == NULL) - return NULL; - if (!bind_capi(ret)) { - ENGINE_free(ret); - return NULL; - } - return ret; -} - -void engine_load_capi_int(void) -{ - /* Copied from eng_[openssl|dyn].c */ - ENGINE *toadd = engine_capi(); - if (!toadd) - return; - ERR_set_mark(); - ENGINE_add(toadd); - /* - * If the "add" worked, it gets a structural reference. So either way, we - * release our just-created reference. - */ - ENGINE_free(toadd); - /* - * If the "add" didn't work, it was probably a conflict because it was - * already added (eg. someone calling ENGINE_load_blah then calling - * ENGINE_load_builtin_engines() perhaps). - */ - ERR_pop_to_mark(); -} -# endif - -static int lend_tobn(BIGNUM *bn, unsigned char *bin, int binlen) -{ - int i; - /* - * Reverse buffer in place: since this is a keyblob structure that will - * be freed up after conversion anyway it doesn't matter if we change - * it. - */ - for (i = 0; i < binlen / 2; i++) { - unsigned char c; - c = bin[i]; - bin[i] = bin[binlen - i - 1]; - bin[binlen - i - 1] = c; - } - - if (!BN_bin2bn(bin, binlen, bn)) - return 0; - return 1; -} - -/* Given a CAPI_KEY get an EVP_PKEY structure */ - -static EVP_PKEY *capi_get_pkey(ENGINE *eng, CAPI_KEY *key) -{ - unsigned char *pubkey = NULL; - DWORD len; - BLOBHEADER *bh; - RSA *rkey = NULL; - DSA *dkey = NULL; - EVP_PKEY *ret = NULL; - if (!CryptExportKey(key->key, 0, PUBLICKEYBLOB, 0, NULL, &len)) { - CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_PUBKEY_EXPORT_LENGTH_ERROR); - capi_addlasterror(); - return NULL; - } - - pubkey = OPENSSL_malloc(len); - - if (pubkey == NULL) - goto err; - - if (!CryptExportKey(key->key, 0, PUBLICKEYBLOB, 0, pubkey, &len)) { - CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_PUBKEY_EXPORT_ERROR); - capi_addlasterror(); - goto err; - } - - bh = (BLOBHEADER *) pubkey; - if (bh->bType != PUBLICKEYBLOB) { - CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_INVALID_PUBLIC_KEY_BLOB); - goto err; - } - if (bh->aiKeyAlg == CALG_RSA_SIGN || bh->aiKeyAlg == CALG_RSA_KEYX) { - RSAPUBKEY *rp; - DWORD rsa_modlen; - BIGNUM *e = NULL, *n = NULL; - unsigned char *rsa_modulus; - rp = (RSAPUBKEY *) (bh + 1); - if (rp->magic != 0x31415352) { - char magstr[10]; - BIO_snprintf(magstr, 10, "%lx", rp->magic); - CAPIerr(CAPI_F_CAPI_GET_PKEY, - CAPI_R_INVALID_RSA_PUBLIC_KEY_BLOB_MAGIC_NUMBER); - ERR_add_error_data(2, "magic=0x", magstr); - goto err; - } - rsa_modulus = (unsigned char *)(rp + 1); - rkey = RSA_new_method(eng); - if (!rkey) { - CAPIerr(CAPI_F_CAPI_GET_PKEY, ERR_R_RSA_LIB); - goto err; - } - - e = BN_new(); - n = BN_new(); - - if (e == NULL || n == NULL) { - BN_free(e); - BN_free(n); - CAPIerr(CAPI_F_CAPI_GET_PKEY, ERR_R_BN_LIB); - goto err; - } - - RSA_set0_key(rkey, n, e, NULL); - - if (!BN_set_word(e, rp->pubexp)) { - CAPIerr(CAPI_F_CAPI_GET_PKEY, ERR_R_BN_LIB); - goto err; - } - - rsa_modlen = rp->bitlen / 8; - if (!lend_tobn(n, rsa_modulus, rsa_modlen)) { - CAPIerr(CAPI_F_CAPI_GET_PKEY, ERR_R_BN_LIB); - goto err; - } - - RSA_set_ex_data(rkey, rsa_capi_idx, key); - - if ((ret = EVP_PKEY_new()) == NULL) { - CAPIerr(CAPI_F_CAPI_GET_PKEY, ERR_R_EVP_LIB); - goto err; - } - - EVP_PKEY_assign_RSA(ret, rkey); - rkey = NULL; - -# ifndef OPENSSL_NO_DSA - } else if (bh->aiKeyAlg == CALG_DSS_SIGN) { - DSSPUBKEY *dp; - DWORD dsa_plen; - unsigned char *btmp; - BIGNUM *p, *q, *g, *pub_key; - dp = (DSSPUBKEY *) (bh + 1); - if (dp->magic != 0x31535344) { - char magstr[10]; - BIO_snprintf(magstr, 10, "%lx", dp->magic); - CAPIerr(CAPI_F_CAPI_GET_PKEY, - CAPI_R_INVALID_DSA_PUBLIC_KEY_BLOB_MAGIC_NUMBER); - ERR_add_error_data(2, "magic=0x", magstr); - goto err; - } - dsa_plen = dp->bitlen / 8; - btmp = (unsigned char *)(dp + 1); - dkey = DSA_new_method(eng); - if (!dkey) { - CAPIerr(CAPI_F_CAPI_GET_PKEY, ERR_R_DSA_LIB); - goto err; - } - p = BN_new(); - q = BN_new(); - g = BN_new(); - pub_key = BN_new(); - if (p == NULL || q == NULL || g == NULL || pub_key == NULL) { - BN_free(p); - BN_free(q); - BN_free(g); - BN_free(pub_key); - CAPIerr(CAPI_F_CAPI_GET_PKEY, ERR_R_BN_LIB); - goto err; - } - DSA_set0_pqg(dkey, p, q, g); - DSA_set0_key(dkey, pub_key, NULL); - if (!lend_tobn(p, btmp, dsa_plen)) { - CAPIerr(CAPI_F_CAPI_GET_PKEY, ERR_R_CAPI_LIB); - goto err; - } - btmp += dsa_plen; - if (!lend_tobn(q, btmp, 20)) { - CAPIerr(CAPI_F_CAPI_GET_PKEY, ERR_R_CAPI_LIB); - goto err; - } - btmp += 20; - if (!lend_tobn(g, btmp, dsa_plen)) { - CAPIerr(CAPI_F_CAPI_GET_PKEY, ERR_R_CAPI_LIB); - goto err; - } - btmp += dsa_plen; - if (!lend_tobn(pub_key, btmp, dsa_plen)) { - CAPIerr(CAPI_F_CAPI_GET_PKEY, ERR_R_CAPI_LIB); - goto err; - } - btmp += dsa_plen; - - DSA_set_ex_data(dkey, dsa_capi_idx, key); - - if ((ret = EVP_PKEY_new()) == NULL) { - CAPIerr(CAPI_F_CAPI_GET_PKEY, ERR_R_EVP_LIB); - goto err; - } - - EVP_PKEY_assign_DSA(ret, dkey); - dkey = NULL; -# endif - } else { - char algstr[10]; - BIO_snprintf(algstr, 10, "%ux", bh->aiKeyAlg); - CAPIerr(CAPI_F_CAPI_GET_PKEY, - CAPI_R_UNSUPPORTED_PUBLIC_KEY_ALGORITHM); - ERR_add_error_data(2, "aiKeyAlg=0x", algstr); - goto err; - } - - err: - OPENSSL_free(pubkey); - if (!ret) { - RSA_free(rkey); -# ifndef OPENSSL_NO_DSA - DSA_free(dkey); -# endif - } - - return ret; -} - -static EVP_PKEY *capi_load_privkey(ENGINE *eng, const char *key_id, - UI_METHOD *ui_method, void *callback_data) -{ - CAPI_CTX *ctx; - CAPI_KEY *key; - EVP_PKEY *ret; - ctx = ENGINE_get_ex_data(eng, capi_idx); - - if (!ctx) { - CAPIerr(CAPI_F_CAPI_LOAD_PRIVKEY, CAPI_R_CANT_FIND_CAPI_CONTEXT); - return NULL; - } - - key = capi_find_key(ctx, key_id); - - if (!key) - return NULL; - - ret = capi_get_pkey(eng, key); - - if (!ret) - capi_free_key(key); - return ret; - -} - -/* CryptoAPI RSA operations */ - -int capi_rsa_priv_enc(int flen, const unsigned char *from, - unsigned char *to, RSA *rsa, int padding) -{ - CAPIerr(CAPI_F_CAPI_RSA_PRIV_ENC, CAPI_R_FUNCTION_NOT_SUPPORTED); - return -1; -} - -int capi_rsa_sign(int dtype, const unsigned char *m, unsigned int m_len, - unsigned char *sigret, unsigned int *siglen, const RSA *rsa) -{ - ALG_ID alg; - HCRYPTHASH hash; - DWORD slen; - unsigned int i; - int ret = -1; - CAPI_KEY *capi_key; - CAPI_CTX *ctx; - - ctx = ENGINE_get_ex_data(RSA_get0_engine(rsa), capi_idx); - - CAPI_trace(ctx, "Called CAPI_rsa_sign()\n"); - - capi_key = RSA_get_ex_data(rsa, rsa_capi_idx); - if (!capi_key) { - CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_GET_KEY); - return -1; - } - /* Convert the signature type to a CryptoAPI algorithm ID */ - switch (dtype) { - case NID_sha256: - alg = CALG_SHA_256; - break; - - case NID_sha384: - alg = CALG_SHA_384; - break; - - case NID_sha512: - alg = CALG_SHA_512; - break; - - case NID_sha1: - alg = CALG_SHA1; - break; - - case NID_md5: - alg = CALG_MD5; - break; - - case NID_md5_sha1: - alg = CALG_SSL3_SHAMD5; - break; - default: - { - char algstr[10]; - BIO_snprintf(algstr, 10, "%x", dtype); - CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_UNSUPPORTED_ALGORITHM_NID); - ERR_add_error_data(2, "NID=0x", algstr); - return -1; - } - } - - /* Create the hash object */ - if (!CryptCreateHash(capi_key->hprov, alg, 0, 0, &hash)) { - CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_CREATE_HASH_OBJECT); - capi_addlasterror(); - return -1; - } - /* Set the hash value to the value passed */ - - if (!CryptSetHashParam(hash, HP_HASHVAL, (unsigned char *)m, 0)) { - CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_SET_HASH_VALUE); - capi_addlasterror(); - goto err; - } - - /* Finally sign it */ - slen = RSA_size(rsa); - if (!CryptSignHash(hash, capi_key->keyspec, NULL, 0, sigret, &slen)) { - CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_ERROR_SIGNING_HASH); - capi_addlasterror(); - goto err; - } else { - ret = 1; - /* Inplace byte reversal of signature */ - for (i = 0; i < slen / 2; i++) { - unsigned char c; - c = sigret[i]; - sigret[i] = sigret[slen - i - 1]; - sigret[slen - i - 1] = c; - } - *siglen = slen; - } - - /* Now cleanup */ - - err: - CryptDestroyHash(hash); - - return ret; -} - -int capi_rsa_priv_dec(int flen, const unsigned char *from, - unsigned char *to, RSA *rsa, int padding) -{ - int i; - unsigned char *tmpbuf; - CAPI_KEY *capi_key; - CAPI_CTX *ctx; - DWORD flags = 0; - DWORD dlen; - - if (flen <= 0) - return flen; - - ctx = ENGINE_get_ex_data(RSA_get0_engine(rsa), capi_idx); - - CAPI_trace(ctx, "Called capi_rsa_priv_dec()\n"); - - capi_key = RSA_get_ex_data(rsa, rsa_capi_idx); - if (!capi_key) { - CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_CANT_GET_KEY); - return -1; - } - - switch (padding) { - case RSA_PKCS1_PADDING: - /* Nothing to do */ - break; -#ifdef CRYPT_DECRYPT_RSA_NO_PADDING_CHECK - case RSA_NO_PADDING: - flags = CRYPT_DECRYPT_RSA_NO_PADDING_CHECK; - break; -#endif - default: - { - char errstr[10]; - BIO_snprintf(errstr, 10, "%d", padding); - CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_UNSUPPORTED_PADDING); - ERR_add_error_data(2, "padding=", errstr); - return -1; - } - } - - /* Create temp reverse order version of input */ - if ((tmpbuf = OPENSSL_malloc(flen)) == NULL) - return -1; - for (i = 0; i < flen; i++) - tmpbuf[flen - i - 1] = from[i]; - - /* Finally decrypt it */ - dlen = flen; - if (!CryptDecrypt(capi_key->key, 0, TRUE, flags, tmpbuf, &dlen)) { - CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_DECRYPT_ERROR); - capi_addlasterror(); - OPENSSL_cleanse(tmpbuf, dlen); - OPENSSL_free(tmpbuf); - return -1; - } else { - memcpy(to, tmpbuf, (flen = (int)dlen)); - } - OPENSSL_cleanse(tmpbuf, flen); - OPENSSL_free(tmpbuf); - - return flen; -} - -static int capi_rsa_free(RSA *rsa) -{ - CAPI_KEY *capi_key; - capi_key = RSA_get_ex_data(rsa, rsa_capi_idx); - capi_free_key(capi_key); - RSA_set_ex_data(rsa, rsa_capi_idx, 0); - return 1; -} - -# ifndef OPENSSL_NO_DSA -/* CryptoAPI DSA operations */ - -static DSA_SIG *capi_dsa_do_sign(const unsigned char *digest, int dlen, - DSA *dsa) -{ - HCRYPTHASH hash; - DWORD slen; - DSA_SIG *ret = NULL; - CAPI_KEY *capi_key; - CAPI_CTX *ctx; - unsigned char csigbuf[40]; - - ctx = ENGINE_get_ex_data(DSA_get0_engine(dsa), capi_idx); - - CAPI_trace(ctx, "Called CAPI_dsa_do_sign()\n"); - - capi_key = DSA_get_ex_data(dsa, dsa_capi_idx); - - if (!capi_key) { - CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_GET_KEY); - return NULL; - } - - if (dlen != 20) { - CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_INVALID_DIGEST_LENGTH); - return NULL; - } - - /* Create the hash object */ - if (!CryptCreateHash(capi_key->hprov, CALG_SHA1, 0, 0, &hash)) { - CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_CREATE_HASH_OBJECT); - capi_addlasterror(); - return NULL; - } - - /* Set the hash value to the value passed */ - if (!CryptSetHashParam(hash, HP_HASHVAL, (unsigned char *)digest, 0)) { - CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_SET_HASH_VALUE); - capi_addlasterror(); - goto err; - } - - /* Finally sign it */ - slen = sizeof(csigbuf); - if (!CryptSignHash(hash, capi_key->keyspec, NULL, 0, csigbuf, &slen)) { - CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_ERROR_SIGNING_HASH); - capi_addlasterror(); - goto err; - } else { - BIGNUM *r = BN_new(), *s = BN_new(); - - if (r == NULL || s == NULL - || !lend_tobn(r, csigbuf, 20) - || !lend_tobn(s, csigbuf + 20, 20) - || (ret = DSA_SIG_new()) == NULL) { - BN_free(r); /* BN_free checks for BIGNUM * being NULL */ - BN_free(s); - goto err; - } - DSA_SIG_set0(ret, r, s); - } - - /* Now cleanup */ - - err: - OPENSSL_cleanse(csigbuf, 40); - CryptDestroyHash(hash); - return ret; -} - -static int capi_dsa_free(DSA *dsa) -{ - CAPI_KEY *capi_key; - capi_key = DSA_get_ex_data(dsa, dsa_capi_idx); - capi_free_key(capi_key); - DSA_set_ex_data(dsa, dsa_capi_idx, 0); - return 1; -} -# endif - -static void capi_vtrace(CAPI_CTX *ctx, int level, char *format, - va_list argptr) -{ - BIO *out; - - if (!ctx || (ctx->debug_level < level) || (!ctx->debug_file)) - return; - out = BIO_new_file(ctx->debug_file, "a+"); - if (out == NULL) { - CAPIerr(CAPI_F_CAPI_VTRACE, CAPI_R_FILE_OPEN_ERROR); - return; - } - BIO_vprintf(out, format, argptr); - BIO_free(out); -} - -static void CAPI_trace(CAPI_CTX *ctx, char *format, ...) -{ - va_list args; - va_start(args, format); - capi_vtrace(ctx, CAPI_DBG_TRACE, format, args); - va_end(args); -} - -static void capi_addlasterror(void) -{ - capi_adderror(GetLastError()); -} - -static void capi_adderror(DWORD err) -{ - char errstr[10]; - BIO_snprintf(errstr, 10, "%lX", err); - ERR_add_error_data(2, "Error code= 0x", errstr); -} - -static char *wide_to_asc(LPCWSTR wstr) -{ - char *str; - int len_0, sz; - size_t len_1; - - if (!wstr) - return NULL; - - len_1 = wcslen(wstr) + 1; - - if (len_1 > INT_MAX) { - CAPIerr(CAPI_F_WIDE_TO_ASC, CAPI_R_FUNCTION_NOT_SUPPORTED); - return NULL; - } - - len_0 = (int)len_1; /* WideCharToMultiByte expects int */ - sz = WideCharToMultiByte(CP_ACP, 0, wstr, len_0, NULL, 0, NULL, NULL); - if (!sz) { - CAPIerr(CAPI_F_WIDE_TO_ASC, CAPI_R_WIN32_ERROR); - return NULL; - } - str = OPENSSL_malloc(sz); - if (str == NULL) - return NULL; - if (!WideCharToMultiByte(CP_ACP, 0, wstr, len_0, str, sz, NULL, NULL)) { - OPENSSL_free(str); - CAPIerr(CAPI_F_WIDE_TO_ASC, CAPI_R_WIN32_ERROR); - return NULL; - } - return str; -} - -static int capi_get_provname(CAPI_CTX *ctx, LPSTR *pname, DWORD *ptype, - DWORD idx) -{ - DWORD len, err; - LPTSTR name; - CAPI_trace(ctx, "capi_get_provname, index=%d\n", idx); - if (!CryptEnumProviders(idx, NULL, 0, ptype, NULL, &len)) { - err = GetLastError(); - if (err == ERROR_NO_MORE_ITEMS) - return 2; - CAPIerr(CAPI_F_CAPI_GET_PROVNAME, CAPI_R_CRYPTENUMPROVIDERS_ERROR); - capi_adderror(err); - return 0; - } - name = OPENSSL_malloc(len); - if (name == NULL) - return 0; - if (!CryptEnumProviders(idx, NULL, 0, ptype, name, &len)) { - err = GetLastError(); - OPENSSL_free(name); - if (err == ERROR_NO_MORE_ITEMS) - return 2; - CAPIerr(CAPI_F_CAPI_GET_PROVNAME, CAPI_R_CRYPTENUMPROVIDERS_ERROR); - capi_adderror(err); - return 0; - } - if (sizeof(TCHAR) != sizeof(char)) { - *pname = wide_to_asc((WCHAR *)name); - OPENSSL_free(name); - if (*pname == NULL) - return 0; - } else { - *pname = (char *)name; - } - CAPI_trace(ctx, "capi_get_provname, returned name=%s, type=%d\n", *pname, - *ptype); - - return 1; -} - -static int capi_list_providers(CAPI_CTX *ctx, BIO *out) -{ - DWORD idx, ptype; - int ret; - LPSTR provname = NULL; - CAPI_trace(ctx, "capi_list_providers\n"); - BIO_printf(out, "Available CSPs:\n"); - for (idx = 0;; idx++) { - ret = capi_get_provname(ctx, &provname, &ptype, idx); - if (ret == 2) - break; - if (ret == 0) - break; - BIO_printf(out, "%lu. %s, type %lu\n", idx, provname, ptype); - OPENSSL_free(provname); - } - return 1; -} - -static int capi_list_containers(CAPI_CTX *ctx, BIO *out) -{ - int ret = 1; - HCRYPTPROV hprov; - DWORD err, idx, flags, buflen = 0, clen; - LPSTR cname; - LPWSTR cspname = NULL; - - CAPI_trace(ctx, "Listing containers CSP=%s, type = %d\n", ctx->cspname, - ctx->csptype); - if (ctx->cspname != NULL) { - if ((clen = MultiByteToWideChar(CP_ACP, 0, ctx->cspname, -1, - NULL, 0))) { - cspname = alloca(clen * sizeof(WCHAR)); - MultiByteToWideChar(CP_ACP, 0, ctx->cspname, -1, (WCHAR *)cspname, - clen); - } - if (cspname == NULL) { - CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, ERR_R_MALLOC_FAILURE); - capi_addlasterror(); - return 0; - } - } - if (!CryptAcquireContextW(&hprov, NULL, cspname, ctx->csptype, - CRYPT_VERIFYCONTEXT)) { - CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, - CAPI_R_CRYPTACQUIRECONTEXT_ERROR); - capi_addlasterror(); - return 0; - } - if (!CryptGetProvParam(hprov, PP_ENUMCONTAINERS, NULL, &buflen, - CRYPT_FIRST)) { - CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_ENUMCONTAINERS_ERROR); - capi_addlasterror(); - CryptReleaseContext(hprov, 0); - return 0; - } - CAPI_trace(ctx, "Got max container len %d\n", buflen); - if (buflen == 0) - buflen = 1024; - cname = OPENSSL_malloc(buflen); - if (cname == NULL) - goto err; - - for (idx = 0;; idx++) { - clen = buflen; - cname[0] = 0; - - if (idx == 0) - flags = CRYPT_FIRST; - else - flags = 0; - if (!CryptGetProvParam(hprov, PP_ENUMCONTAINERS, (BYTE *)cname, - &clen, flags)) { - err = GetLastError(); - if (err == ERROR_NO_MORE_ITEMS) - goto done; - CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_ENUMCONTAINERS_ERROR); - capi_adderror(err); - goto err; - } - CAPI_trace(ctx, "Container name %s, len=%d, index=%d, flags=%d\n", - cname, clen, idx, flags); - if (!cname[0] && (clen == buflen)) { - CAPI_trace(ctx, "Enumerate bug: using workaround\n"); - goto done; - } - BIO_printf(out, "%lu. %s\n", idx, cname); - } - err: - - ret = 0; - - done: - OPENSSL_free(cname); - CryptReleaseContext(hprov, 0); - - return ret; -} - -static CRYPT_KEY_PROV_INFO *capi_get_prov_info(CAPI_CTX *ctx, - PCCERT_CONTEXT cert) -{ - DWORD len; - CRYPT_KEY_PROV_INFO *pinfo; - - if (!CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, - NULL, &len)) - return NULL; - pinfo = OPENSSL_malloc(len); - if (pinfo == NULL) - return NULL; - if (!CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, - pinfo, &len)) { - CAPIerr(CAPI_F_CAPI_GET_PROV_INFO, - CAPI_R_ERROR_GETTING_KEY_PROVIDER_INFO); - capi_addlasterror(); - OPENSSL_free(pinfo); - return NULL; - } - return pinfo; -} - -static void capi_dump_prov_info(CAPI_CTX *ctx, BIO *out, - CRYPT_KEY_PROV_INFO *pinfo) -{ - char *provname = NULL, *contname = NULL; - - if (pinfo == NULL) { - BIO_printf(out, " No Private Key\n"); - return; - } - provname = wide_to_asc(pinfo->pwszProvName); - contname = wide_to_asc(pinfo->pwszContainerName); - if (provname == NULL || contname == NULL) - goto err; - - BIO_printf(out, " Private Key Info:\n"); - BIO_printf(out, " Provider Name: %s, Provider Type %lu\n", provname, - pinfo->dwProvType); - BIO_printf(out, " Container Name: %s, Key Type %lu\n", contname, - pinfo->dwKeySpec); - err: - OPENSSL_free(provname); - OPENSSL_free(contname); -} - -static char *capi_cert_get_fname(CAPI_CTX *ctx, PCCERT_CONTEXT cert) -{ - LPWSTR wfname; - DWORD dlen; - - CAPI_trace(ctx, "capi_cert_get_fname\n"); - if (!CertGetCertificateContextProperty(cert, CERT_FRIENDLY_NAME_PROP_ID, - NULL, &dlen)) - return NULL; - wfname = OPENSSL_malloc(dlen); - if (wfname == NULL) - return NULL; - if (CertGetCertificateContextProperty(cert, CERT_FRIENDLY_NAME_PROP_ID, - wfname, &dlen)) { - char *fname = wide_to_asc(wfname); - OPENSSL_free(wfname); - return fname; - } - CAPIerr(CAPI_F_CAPI_CERT_GET_FNAME, CAPI_R_ERROR_GETTING_FRIENDLY_NAME); - capi_addlasterror(); - - OPENSSL_free(wfname); - return NULL; -} - -static void capi_dump_cert(CAPI_CTX *ctx, BIO *out, PCCERT_CONTEXT cert) -{ - X509 *x; - const unsigned char *p; - unsigned long flags = ctx->dump_flags; - if (flags & CAPI_DMP_FNAME) { - char *fname; - fname = capi_cert_get_fname(ctx, cert); - if (fname) { - BIO_printf(out, " Friendly Name \"%s\"\n", fname); - OPENSSL_free(fname); - } else { - BIO_printf(out, " \n"); - } - } - - p = cert->pbCertEncoded; - x = d2i_X509(NULL, &p, cert->cbCertEncoded); - if (!x) - BIO_printf(out, " \n"); - if (flags & CAPI_DMP_SUMMARY) { - BIO_printf(out, " Subject: "); - X509_NAME_print_ex(out, X509_get_subject_name(x), 0, XN_FLAG_ONELINE); - BIO_printf(out, "\n Issuer: "); - X509_NAME_print_ex(out, X509_get_issuer_name(x), 0, XN_FLAG_ONELINE); - BIO_printf(out, "\n"); - } - if (flags & CAPI_DMP_FULL) - X509_print_ex(out, x, XN_FLAG_ONELINE, 0); - - if (flags & CAPI_DMP_PKEYINFO) { - CRYPT_KEY_PROV_INFO *pinfo; - pinfo = capi_get_prov_info(ctx, cert); - capi_dump_prov_info(ctx, out, pinfo); - OPENSSL_free(pinfo); - } - - if (flags & CAPI_DMP_PEM) - PEM_write_bio_X509(out, x); - X509_free(x); -} - -static HCERTSTORE capi_open_store(CAPI_CTX *ctx, char *storename) -{ - HCERTSTORE hstore; - - if (!storename) - storename = ctx->storename; - if (!storename) - storename = "MY"; - CAPI_trace(ctx, "Opening certificate store %s\n", storename); - - hstore = CertOpenStore(CERT_STORE_PROV_SYSTEM_A, 0, 0, - ctx->store_flags, storename); - if (!hstore) { - CAPIerr(CAPI_F_CAPI_OPEN_STORE, CAPI_R_ERROR_OPENING_STORE); - capi_addlasterror(); - } - return hstore; -} - -int capi_list_certs(CAPI_CTX *ctx, BIO *out, char *id) -{ - char *storename; - int idx; - int ret = 1; - HCERTSTORE hstore; - PCCERT_CONTEXT cert = NULL; - - storename = ctx->storename; - if (!storename) - storename = "MY"; - CAPI_trace(ctx, "Listing certs for store %s\n", storename); - - hstore = capi_open_store(ctx, storename); - if (!hstore) - return 0; - if (id) { - cert = capi_find_cert(ctx, id, hstore); - if (!cert) { - ret = 0; - goto err; - } - capi_dump_cert(ctx, out, cert); - CertFreeCertificateContext(cert); - } else { - for (idx = 0;; idx++) { - cert = CertEnumCertificatesInStore(hstore, cert); - if (!cert) - break; - BIO_printf(out, "Certificate %d\n", idx); - capi_dump_cert(ctx, out, cert); - } - } - err: - CertCloseStore(hstore, 0); - return ret; -} - -static PCCERT_CONTEXT capi_find_cert(CAPI_CTX *ctx, const char *id, - HCERTSTORE hstore) -{ - PCCERT_CONTEXT cert = NULL; - char *fname = NULL; - int match; - switch (ctx->lookup_method) { - case CAPI_LU_SUBSTR: - return CertFindCertificateInStore(hstore, X509_ASN_ENCODING, 0, - CERT_FIND_SUBJECT_STR_A, id, NULL); - case CAPI_LU_FNAME: - for (;;) { - cert = CertEnumCertificatesInStore(hstore, cert); - if (!cert) - return NULL; - fname = capi_cert_get_fname(ctx, cert); - if (fname) { - if (strcmp(fname, id)) - match = 0; - else - match = 1; - OPENSSL_free(fname); - if (match) - return cert; - } - } - default: - return NULL; - } -} - -static CAPI_KEY *capi_get_key(CAPI_CTX *ctx, const WCHAR *contname, - const WCHAR *provname, DWORD ptype, - DWORD keyspec) -{ - DWORD dwFlags = 0; - CAPI_KEY *key = OPENSSL_malloc(sizeof(*key)); - - if (key == NULL) - return NULL; - /* If PROV_RSA_AES supported use it instead */ - if (ptype == PROV_RSA_FULL && use_aes_csp && - wcscmp(provname, rsa_enh_cspname) == 0) { - provname = rsa_aes_cspname; - ptype = PROV_RSA_AES; - } - if (ctx && ctx->debug_level >= CAPI_DBG_TRACE && ctx->debug_file) { - /* - * above 'if' is [complementary] copy from CAPI_trace and serves - * as optimization to minimize [below] malloc-ations - */ - char *_contname = wide_to_asc(contname); - char *_provname = wide_to_asc(provname); - - CAPI_trace(ctx, "capi_get_key, contname=%s, provname=%s, type=%d\n", - _contname, _provname, ptype); - OPENSSL_free(_provname); - OPENSSL_free(_contname); - } - if (ctx->store_flags & CERT_SYSTEM_STORE_LOCAL_MACHINE) - dwFlags = CRYPT_MACHINE_KEYSET; - if (!CryptAcquireContextW(&key->hprov, contname, provname, ptype, - dwFlags)) { - CAPIerr(CAPI_F_CAPI_GET_KEY, CAPI_R_CRYPTACQUIRECONTEXT_ERROR); - capi_addlasterror(); - goto err; - } - if (!CryptGetUserKey(key->hprov, keyspec, &key->key)) { - CAPIerr(CAPI_F_CAPI_GET_KEY, CAPI_R_GETUSERKEY_ERROR); - capi_addlasterror(); - CryptReleaseContext(key->hprov, 0); - goto err; - } - key->keyspec = keyspec; - key->pcert = NULL; - return key; - - err: - OPENSSL_free(key); - return NULL; -} - -static CAPI_KEY *capi_get_cert_key(CAPI_CTX *ctx, PCCERT_CONTEXT cert) -{ - CAPI_KEY *key = NULL; - CRYPT_KEY_PROV_INFO *pinfo = NULL; - - pinfo = capi_get_prov_info(ctx, cert); - - if (pinfo != NULL) - key = capi_get_key(ctx, pinfo->pwszContainerName, pinfo->pwszProvName, - pinfo->dwProvType, pinfo->dwKeySpec); - - OPENSSL_free(pinfo); - return key; -} - -CAPI_KEY *capi_find_key(CAPI_CTX *ctx, const char *id) -{ - PCCERT_CONTEXT cert; - HCERTSTORE hstore; - CAPI_KEY *key = NULL; - - switch (ctx->lookup_method) { - case CAPI_LU_SUBSTR: - case CAPI_LU_FNAME: - hstore = capi_open_store(ctx, NULL); - if (!hstore) - return NULL; - cert = capi_find_cert(ctx, id, hstore); - if (cert) { - key = capi_get_cert_key(ctx, cert); - CertFreeCertificateContext(cert); - } - CertCloseStore(hstore, 0); - break; - - case CAPI_LU_CONTNAME: - { - WCHAR *contname, *provname; - DWORD len; - - if ((len = MultiByteToWideChar(CP_ACP, 0, id, -1, NULL, 0)) && - (contname = alloca(len * sizeof(WCHAR)), - MultiByteToWideChar(CP_ACP, 0, id, -1, contname, len)) && - (len = MultiByteToWideChar(CP_ACP, 0, ctx->cspname, -1, - NULL, 0)) && - (provname = alloca(len * sizeof(WCHAR)), - MultiByteToWideChar(CP_ACP, 0, ctx->cspname, -1, - provname, len))) - key = capi_get_key(ctx, contname, provname, - ctx->csptype, ctx->keytype); - } - break; - } - - return key; -} - -void capi_free_key(CAPI_KEY *key) -{ - if (!key) - return; - CryptDestroyKey(key->key); - CryptReleaseContext(key->hprov, 0); - if (key->pcert) - CertFreeCertificateContext(key->pcert); - OPENSSL_free(key); -} - -/* Initialize a CAPI_CTX structure */ - -static CAPI_CTX *capi_ctx_new(void) -{ - CAPI_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx)); - - if (ctx == NULL) - return NULL; - ctx->csptype = PROV_RSA_FULL; - ctx->dump_flags = CAPI_DMP_SUMMARY | CAPI_DMP_FNAME; - ctx->keytype = AT_KEYEXCHANGE; - ctx->store_flags = CERT_STORE_OPEN_EXISTING_FLAG | - CERT_STORE_READONLY_FLAG | CERT_SYSTEM_STORE_CURRENT_USER; - ctx->lookup_method = CAPI_LU_SUBSTR; - ctx->client_cert_select = cert_select_simple; - return ctx; -} - -static void capi_ctx_free(CAPI_CTX *ctx) -{ - CAPI_trace(ctx, "Calling capi_ctx_free with %lx\n", ctx); - if (!ctx) - return; - OPENSSL_free(ctx->cspname); - OPENSSL_free(ctx->debug_file); - OPENSSL_free(ctx->storename); - OPENSSL_free(ctx->ssl_client_store); - OPENSSL_free(ctx); -} - -static int capi_ctx_set_provname(CAPI_CTX *ctx, LPSTR pname, DWORD type, - int check) -{ - LPSTR tmpcspname; - - CAPI_trace(ctx, "capi_ctx_set_provname, name=%s, type=%d\n", pname, type); - if (check) { - HCRYPTPROV hprov; - LPWSTR name = NULL; - DWORD len; - - if ((len = MultiByteToWideChar(CP_ACP, 0, pname, -1, NULL, 0))) { - name = alloca(len * sizeof(WCHAR)); - MultiByteToWideChar(CP_ACP, 0, pname, -1, (WCHAR *)name, len); - } - if (name == NULL || !CryptAcquireContextW(&hprov, NULL, name, type, - CRYPT_VERIFYCONTEXT)) { - CAPIerr(CAPI_F_CAPI_CTX_SET_PROVNAME, - CAPI_R_CRYPTACQUIRECONTEXT_ERROR); - capi_addlasterror(); - return 0; - } - CryptReleaseContext(hprov, 0); - } - tmpcspname = OPENSSL_strdup(pname); - if (tmpcspname == NULL) - return 0; - OPENSSL_free(ctx->cspname); - ctx->cspname = tmpcspname; - ctx->csptype = type; - return 1; -} - -static int capi_ctx_set_provname_idx(CAPI_CTX *ctx, int idx) -{ - LPSTR pname; - DWORD type; - int res; - if (capi_get_provname(ctx, &pname, &type, idx) != 1) - return 0; - res = capi_ctx_set_provname(ctx, pname, type, 0); - OPENSSL_free(pname); - return res; -} - -static int cert_issuer_match(STACK_OF(X509_NAME) *ca_dn, X509 *x) -{ - int i; - X509_NAME *nm; - /* Special case: empty list: match anything */ - if (sk_X509_NAME_num(ca_dn) <= 0) - return 1; - for (i = 0; i < sk_X509_NAME_num(ca_dn); i++) { - nm = sk_X509_NAME_value(ca_dn, i); - if (!X509_NAME_cmp(nm, X509_get_issuer_name(x))) - return 1; - } - return 0; -} - -static int capi_load_ssl_client_cert(ENGINE *e, SSL *ssl, - STACK_OF(X509_NAME) *ca_dn, X509 **pcert, - EVP_PKEY **pkey, STACK_OF(X509) **pother, - UI_METHOD *ui_method, - void *callback_data) -{ - STACK_OF(X509) *certs = NULL; - X509 *x; - char *storename; - const unsigned char *p; - int i, client_cert_idx; - HCERTSTORE hstore; - PCCERT_CONTEXT cert = NULL, excert = NULL; - CAPI_CTX *ctx; - CAPI_KEY *key; - ctx = ENGINE_get_ex_data(e, capi_idx); - - *pcert = NULL; - *pkey = NULL; - - storename = ctx->ssl_client_store; - if (!storename) - storename = "MY"; - - hstore = capi_open_store(ctx, storename); - if (!hstore) - return 0; - /* Enumerate all certificates collect any matches */ - for (i = 0;; i++) { - cert = CertEnumCertificatesInStore(hstore, cert); - if (!cert) - break; - p = cert->pbCertEncoded; - x = d2i_X509(NULL, &p, cert->cbCertEncoded); - if (!x) { - CAPI_trace(ctx, "Can't Parse Certificate %d\n", i); - continue; - } - if (cert_issuer_match(ca_dn, x) - && X509_check_purpose(x, X509_PURPOSE_SSL_CLIENT, 0)) { - key = capi_get_cert_key(ctx, cert); - if (!key) { - X509_free(x); - continue; - } - /* - * Match found: attach extra data to it so we can retrieve the - * key later. - */ - excert = CertDuplicateCertificateContext(cert); - key->pcert = excert; - X509_set_ex_data(x, cert_capi_idx, key); - - if (!certs) - certs = sk_X509_new_null(); - - if (!sk_X509_push(certs, x)) { - X509_free(x); - continue; - } - } else { - X509_free(x); - } - } - - if (cert) - CertFreeCertificateContext(cert); - if (hstore) - CertCloseStore(hstore, 0); - - if (!certs) - return 0; - - /* Select the appropriate certificate */ - - client_cert_idx = ctx->client_cert_select(e, ssl, certs); - - /* Set the selected certificate and free the rest */ - - for (i = 0; i < sk_X509_num(certs); i++) { - x = sk_X509_value(certs, i); - if (i == client_cert_idx) - *pcert = x; - else { - key = X509_get_ex_data(x, cert_capi_idx); - capi_free_key(key); - X509_free(x); - } - } - - sk_X509_free(certs); - - if (*pcert == NULL) - return 0; - - /* Setup key for selected certificate */ - - key = X509_get_ex_data(*pcert, cert_capi_idx); - *pkey = capi_get_pkey(e, key); - X509_set_ex_data(*pcert, cert_capi_idx, NULL); - - return 1; - -} - -/* Simple client cert selection function: always select first */ - -static int cert_select_simple(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs) -{ - return 0; -} - -# ifdef OPENSSL_CAPIENG_DIALOG - -/* - * More complex cert selection function, using standard function - * CryptUIDlgSelectCertificateFromStore() to produce a dialog box. - */ - -/* - * Definitions which are in cryptuiapi.h but this is not present in older - * versions of headers. - */ - -# ifndef CRYPTUI_SELECT_LOCATION_COLUMN -# define CRYPTUI_SELECT_LOCATION_COLUMN 0x000000010 -# define CRYPTUI_SELECT_INTENDEDUSE_COLUMN 0x000000004 -# endif - -# define dlg_title L"OpenSSL Application SSL Client Certificate Selection" -# define dlg_prompt L"Select a certificate to use for authentication" -# define dlg_columns CRYPTUI_SELECT_LOCATION_COLUMN \ - |CRYPTUI_SELECT_INTENDEDUSE_COLUMN - -static int cert_select_dialog(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs) -{ - X509 *x; - HCERTSTORE dstore; - PCCERT_CONTEXT cert; - CAPI_CTX *ctx; - CAPI_KEY *key; - HWND hwnd; - int i, idx = -1; - if (sk_X509_num(certs) == 1) - return 0; - ctx = ENGINE_get_ex_data(e, capi_idx); - /* Create an in memory store of certificates */ - dstore = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0, - CERT_STORE_CREATE_NEW_FLAG, NULL); - if (!dstore) { - CAPIerr(CAPI_F_CERT_SELECT_DIALOG, CAPI_R_ERROR_CREATING_STORE); - capi_addlasterror(); - goto err; - } - /* Add all certificates to store */ - for (i = 0; i < sk_X509_num(certs); i++) { - x = sk_X509_value(certs, i); - key = X509_get_ex_data(x, cert_capi_idx); - - if (!CertAddCertificateContextToStore(dstore, key->pcert, - CERT_STORE_ADD_NEW, NULL)) { - CAPIerr(CAPI_F_CERT_SELECT_DIALOG, CAPI_R_ERROR_ADDING_CERT); - capi_addlasterror(); - goto err; - } - - } - hwnd = GetForegroundWindow(); - if (!hwnd) - hwnd = GetActiveWindow(); - if (!hwnd && ctx->getconswindow) - hwnd = ctx->getconswindow(); - /* Call dialog to select one */ - cert = ctx->certselectdlg(dstore, hwnd, dlg_title, dlg_prompt, - dlg_columns, 0, NULL); - - /* Find matching cert from list */ - if (cert) { - for (i = 0; i < sk_X509_num(certs); i++) { - x = sk_X509_value(certs, i); - key = X509_get_ex_data(x, cert_capi_idx); - if (CertCompareCertificate - (X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, cert->pCertInfo, - key->pcert->pCertInfo)) { - idx = i; - break; - } - } - } - - err: - if (dstore) - CertCloseStore(dstore, 0); - return idx; - -} -# endif - -#else /* !__COMPILE_CAPIENG */ -# include -# ifndef OPENSSL_NO_DYNAMIC_ENGINE -OPENSSL_EXPORT - int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns); -OPENSSL_EXPORT - int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns) -{ - return 0; -} - -IMPLEMENT_DYNAMIC_CHECK_FN() -# else -void engine_load_capi_int(void); -void engine_load_capi_int(void) -{ -} -# endif -#endif diff --git a/engines/e_capi.ec b/engines/e_capi.ec deleted file mode 100644 index d9c7aa510f..0000000000 --- a/engines/e_capi.ec +++ /dev/null @@ -1,3 +0,0 @@ -# The INPUT HEADER is scanned for declarations -# LIBNAME INPUT HEADER ERROR-TABLE FILE -L CAPI e_capi_err.h e_capi_err.c diff --git a/engines/e_capi.txt b/engines/e_capi.txt deleted file mode 100644 index 58f4a15962..0000000000 --- a/engines/e_capi.txt +++ /dev/null @@ -1,40 +0,0 @@ -# Copyright 1999-2023 The OpenSSL Project Authors. All Rights Reserved. -# -# Licensed under the Apache License 2.0 (the "License"). You may not use -# this file except in compliance with the License. You can obtain a copy -# in the file LICENSE in the source distribution or at -# https://www.openssl.org/source/license.html - -#Reason codes -CAPI_R_CANT_CREATE_HASH_OBJECT:100:can't create hash object -CAPI_R_CANT_FIND_CAPI_CONTEXT:101:can't find capi context -CAPI_R_CANT_GET_KEY:102:can't get key -CAPI_R_CANT_SET_HASH_VALUE:103:can't set hash value -CAPI_R_CRYPTACQUIRECONTEXT_ERROR:104:cryptacquirecontext error -CAPI_R_CRYPTENUMPROVIDERS_ERROR:105:cryptenumproviders error -CAPI_R_DECRYPT_ERROR:106:decrypt error -CAPI_R_ENGINE_NOT_INITIALIZED:107:engine not initialized -CAPI_R_ENUMCONTAINERS_ERROR:108:enumcontainers error -CAPI_R_ERROR_ADDING_CERT:109:error adding cert -CAPI_R_ERROR_CREATING_STORE:110:error creating store -CAPI_R_ERROR_GETTING_FRIENDLY_NAME:111:error getting friendly name -CAPI_R_ERROR_GETTING_KEY_PROVIDER_INFO:112:error getting key provider info -CAPI_R_ERROR_OPENING_STORE:113:error opening store -CAPI_R_ERROR_SIGNING_HASH:114:error signing hash -CAPI_R_FILE_OPEN_ERROR:115:file open error -CAPI_R_FUNCTION_NOT_SUPPORTED:116:function not supported -CAPI_R_GETUSERKEY_ERROR:117:getuserkey error -CAPI_R_INVALID_DIGEST_LENGTH:118:invalid digest length -CAPI_R_INVALID_DSA_PUBLIC_KEY_BLOB_MAGIC_NUMBER:119:\ - invalid dsa public key blob magic number -CAPI_R_INVALID_LOOKUP_METHOD:120:invalid lookup method -CAPI_R_INVALID_PUBLIC_KEY_BLOB:121:invalid public key blob -CAPI_R_INVALID_RSA_PUBLIC_KEY_BLOB_MAGIC_NUMBER:122:\ - invalid rsa public key blob magic number -CAPI_R_PUBKEY_EXPORT_ERROR:123:pubkey export error -CAPI_R_PUBKEY_EXPORT_LENGTH_ERROR:124:pubkey export length error -CAPI_R_UNKNOWN_COMMAND:125:unknown command -CAPI_R_UNSUPPORTED_ALGORITHM_NID:126:unsupported algorithm nid -CAPI_R_UNSUPPORTED_PADDING:127:unsupported padding -CAPI_R_UNSUPPORTED_PUBLIC_KEY_ALGORITHM:128:unsupported public key algorithm -CAPI_R_WIN32_ERROR:129:win32 error diff --git a/engines/e_capi_err.c b/engines/e_capi_err.c deleted file mode 100644 index 2588c15304..0000000000 --- a/engines/e_capi_err.c +++ /dev/null @@ -1,101 +0,0 @@ -/* - * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#include -#include "e_capi_err.h" - -#ifndef OPENSSL_NO_ERR - -static ERR_STRING_DATA CAPI_str_reasons[] = { - {ERR_PACK(0, 0, CAPI_R_CANT_CREATE_HASH_OBJECT), "can't create hash object"}, - {ERR_PACK(0, 0, CAPI_R_CANT_FIND_CAPI_CONTEXT), "can't find capi context"}, - {ERR_PACK(0, 0, CAPI_R_CANT_GET_KEY), "can't get key"}, - {ERR_PACK(0, 0, CAPI_R_CANT_SET_HASH_VALUE), "can't set hash value"}, - {ERR_PACK(0, 0, CAPI_R_CRYPTACQUIRECONTEXT_ERROR), - "cryptacquirecontext error"}, - {ERR_PACK(0, 0, CAPI_R_CRYPTENUMPROVIDERS_ERROR), - "cryptenumproviders error"}, - {ERR_PACK(0, 0, CAPI_R_DECRYPT_ERROR), "decrypt error"}, - {ERR_PACK(0, 0, CAPI_R_ENGINE_NOT_INITIALIZED), "engine not initialized"}, - {ERR_PACK(0, 0, CAPI_R_ENUMCONTAINERS_ERROR), "enumcontainers error"}, - {ERR_PACK(0, 0, CAPI_R_ERROR_ADDING_CERT), "error adding cert"}, - {ERR_PACK(0, 0, CAPI_R_ERROR_CREATING_STORE), "error creating store"}, - {ERR_PACK(0, 0, CAPI_R_ERROR_GETTING_FRIENDLY_NAME), - "error getting friendly name"}, - {ERR_PACK(0, 0, CAPI_R_ERROR_GETTING_KEY_PROVIDER_INFO), - "error getting key provider info"}, - {ERR_PACK(0, 0, CAPI_R_ERROR_OPENING_STORE), "error opening store"}, - {ERR_PACK(0, 0, CAPI_R_ERROR_SIGNING_HASH), "error signing hash"}, - {ERR_PACK(0, 0, CAPI_R_FILE_OPEN_ERROR), "file open error"}, - {ERR_PACK(0, 0, CAPI_R_FUNCTION_NOT_SUPPORTED), "function not supported"}, - {ERR_PACK(0, 0, CAPI_R_GETUSERKEY_ERROR), "getuserkey error"}, - {ERR_PACK(0, 0, CAPI_R_INVALID_DIGEST_LENGTH), "invalid digest length"}, - {ERR_PACK(0, 0, CAPI_R_INVALID_DSA_PUBLIC_KEY_BLOB_MAGIC_NUMBER), - "invalid dsa public key blob magic number"}, - {ERR_PACK(0, 0, CAPI_R_INVALID_LOOKUP_METHOD), "invalid lookup method"}, - {ERR_PACK(0, 0, CAPI_R_INVALID_PUBLIC_KEY_BLOB), "invalid public key blob"}, - {ERR_PACK(0, 0, CAPI_R_INVALID_RSA_PUBLIC_KEY_BLOB_MAGIC_NUMBER), - "invalid rsa public key blob magic number"}, - {ERR_PACK(0, 0, CAPI_R_PUBKEY_EXPORT_ERROR), "pubkey export error"}, - {ERR_PACK(0, 0, CAPI_R_PUBKEY_EXPORT_LENGTH_ERROR), - "pubkey export length error"}, - {ERR_PACK(0, 0, CAPI_R_UNKNOWN_COMMAND), "unknown command"}, - {ERR_PACK(0, 0, CAPI_R_UNSUPPORTED_ALGORITHM_NID), - "unsupported algorithm nid"}, - {ERR_PACK(0, 0, CAPI_R_UNSUPPORTED_PADDING), "unsupported padding"}, - {ERR_PACK(0, 0, CAPI_R_UNSUPPORTED_PUBLIC_KEY_ALGORITHM), - "unsupported public key algorithm"}, - {ERR_PACK(0, 0, CAPI_R_WIN32_ERROR), "win32 error"}, - {0, NULL} -}; - -#endif - -static int lib_code = 0; -static int error_loaded = 0; - -static int ERR_load_CAPI_strings(void) -{ - if (lib_code == 0) - lib_code = ERR_get_next_error_library(); - - if (!error_loaded) { -#ifndef OPENSSL_NO_ERR - ERR_load_strings(lib_code, CAPI_str_reasons); -#endif - error_loaded = 1; - } - return 1; -} - -static void ERR_unload_CAPI_strings(void) -{ - if (error_loaded) { -#ifndef OPENSSL_NO_ERR - ERR_unload_strings(lib_code, CAPI_str_reasons); -#endif - error_loaded = 0; - } -} - -static void ERR_CAPI_error(int function, int reason, const char *file, int line) -{ - if (lib_code == 0) - lib_code = ERR_get_next_error_library(); - ERR_raise(lib_code, reason); - ERR_set_debug(file, line, NULL); -} - -static int ERR_CAPI_lib(void) -{ - if (lib_code == 0) - lib_code = ERR_get_next_error_library(); - return lib_code; -} diff --git a/engines/e_capi_err.h b/engines/e_capi_err.h deleted file mode 100644 index 480a8269d3..0000000000 --- a/engines/e_capi_err.h +++ /dev/null @@ -1,57 +0,0 @@ -/* - * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#ifndef OSSL_E_CAPI_ERR_H -# define OSSL_E_CAPI_ERR_H -# pragma once - -# include -# include - - -# define CAPIerr(f, r) ERR_CAPI_error(0, (r), OPENSSL_FILE, OPENSSL_LINE) -# define ERR_R_CAPI_LIB ERR_CAPI_lib() - - -/* - * CAPI reason codes. - */ -# define CAPI_R_CANT_CREATE_HASH_OBJECT 100 -# define CAPI_R_CANT_FIND_CAPI_CONTEXT 101 -# define CAPI_R_CANT_GET_KEY 102 -# define CAPI_R_CANT_SET_HASH_VALUE 103 -# define CAPI_R_CRYPTACQUIRECONTEXT_ERROR 104 -# define CAPI_R_CRYPTENUMPROVIDERS_ERROR 105 -# define CAPI_R_DECRYPT_ERROR 106 -# define CAPI_R_ENGINE_NOT_INITIALIZED 107 -# define CAPI_R_ENUMCONTAINERS_ERROR 108 -# define CAPI_R_ERROR_ADDING_CERT 109 -# define CAPI_R_ERROR_CREATING_STORE 110 -# define CAPI_R_ERROR_GETTING_FRIENDLY_NAME 111 -# define CAPI_R_ERROR_GETTING_KEY_PROVIDER_INFO 112 -# define CAPI_R_ERROR_OPENING_STORE 113 -# define CAPI_R_ERROR_SIGNING_HASH 114 -# define CAPI_R_FILE_OPEN_ERROR 115 -# define CAPI_R_FUNCTION_NOT_SUPPORTED 116 -# define CAPI_R_GETUSERKEY_ERROR 117 -# define CAPI_R_INVALID_DIGEST_LENGTH 118 -# define CAPI_R_INVALID_DSA_PUBLIC_KEY_BLOB_MAGIC_NUMBER 119 -# define CAPI_R_INVALID_LOOKUP_METHOD 120 -# define CAPI_R_INVALID_PUBLIC_KEY_BLOB 121 -# define CAPI_R_INVALID_RSA_PUBLIC_KEY_BLOB_MAGIC_NUMBER 122 -# define CAPI_R_PUBKEY_EXPORT_ERROR 123 -# define CAPI_R_PUBKEY_EXPORT_LENGTH_ERROR 124 -# define CAPI_R_UNKNOWN_COMMAND 125 -# define CAPI_R_UNSUPPORTED_ALGORITHM_NID 126 -# define CAPI_R_UNSUPPORTED_PADDING 127 -# define CAPI_R_UNSUPPORTED_PUBLIC_KEY_ALGORITHM 128 -# define CAPI_R_WIN32_ERROR 129 - -#endif diff --git a/engines/e_dasync.c b/engines/e_dasync.c deleted file mode 100644 index 47eca87a6b..0000000000 --- a/engines/e_dasync.c +++ /dev/null @@ -1,1008 +0,0 @@ -/* - * Copyright 2015-2024 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - -/* - * SHA-1 low level APIs are deprecated for public use, but still ok for - * internal use. Note, that due to symbols not being exported, only the - * #defines and structures can be accessed, in this case SHA_CBLOCK and - * sizeof(SHA_CTX). - */ -#include "internal/deprecated.h" - -#include -#if defined(_WIN32) -# include -#endif - -#include -#include - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -#if defined(OPENSSL_SYS_UNIX) && defined(OPENSSL_THREADS) -# undef ASYNC_POSIX -# define ASYNC_POSIX -# include -#elif defined(_WIN32) -# undef ASYNC_WIN -# define ASYNC_WIN -#endif - -/* clang-format off */ -#include "e_dasync_err.c" -/* clang-format on */ - -/* Engine Id and Name */ -static const char *engine_dasync_id = "dasync"; -static const char *engine_dasync_name = "Dummy Async engine support"; - - -/* Engine Lifetime functions */ -static int dasync_destroy(ENGINE *e); -static int dasync_init(ENGINE *e); -static int dasync_finish(ENGINE *e); -void engine_load_dasync_int(void); - - -/* Set up digests. Just SHA1 for now */ -static int dasync_digests(ENGINE *e, const EVP_MD **digest, - const int **nids, int nid); - -static void dummy_pause_job(void); - -/* SHA1 */ -static int dasync_sha1_init(EVP_MD_CTX *ctx); -static int dasync_sha1_update(EVP_MD_CTX *ctx, const void *data, - size_t count); -static int dasync_sha1_final(EVP_MD_CTX *ctx, unsigned char *md); - -/* - * Holds the EVP_MD object for sha1 in this engine. Set up once only during - * engine bind and can then be reused many times. - */ -static EVP_MD *_hidden_sha1_md = NULL; -static const EVP_MD *dasync_sha1(void) -{ - return _hidden_sha1_md; -} -static void destroy_digests(void) -{ - EVP_MD_meth_free(_hidden_sha1_md); - _hidden_sha1_md = NULL; -} - -static int dasync_digest_nids(const int **nids) -{ - static int digest_nids[2] = { 0, 0 }; - static int pos = 0; - static int init = 0; - - if (!init) { - const EVP_MD *md; - if ((md = dasync_sha1()) != NULL) - digest_nids[pos++] = EVP_MD_get_type(md); - digest_nids[pos] = 0; - init = 1; - } - *nids = digest_nids; - return pos; -} - -/* RSA */ -static int dasync_pkey(ENGINE *e, EVP_PKEY_METHOD **pmeth, - const int **pnids, int nid); - -static int dasync_rsa_init(EVP_PKEY_CTX *ctx); -static void dasync_rsa_cleanup(EVP_PKEY_CTX *ctx); -static int dasync_rsa_paramgen_init(EVP_PKEY_CTX *ctx); -static int dasync_rsa_paramgen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey); -static int dasync_rsa_keygen_init(EVP_PKEY_CTX *ctx); -static int dasync_rsa_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey); -static int dasync_rsa_encrypt_init(EVP_PKEY_CTX *ctx); -static int dasync_rsa_encrypt(EVP_PKEY_CTX *ctx, unsigned char *out, - size_t *outlen, const unsigned char *in, - size_t inlen); -static int dasync_rsa_decrypt_init(EVP_PKEY_CTX *ctx); -static int dasync_rsa_decrypt(EVP_PKEY_CTX *ctx, unsigned char *out, - size_t *outlen, const unsigned char *in, - size_t inlen); -static int dasync_rsa_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2); -static int dasync_rsa_ctrl_str(EVP_PKEY_CTX *ctx, const char *type, - const char *value); - -static EVP_PKEY_METHOD *dasync_rsa; -static const EVP_PKEY_METHOD *dasync_rsa_orig; - -/* AES */ - -static int dasync_aes128_cbc_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, - void *ptr); -static int dasync_aes128_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, - const unsigned char *iv, int enc); -static int dasync_aes128_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl); -static int dasync_aes128_cbc_cleanup(EVP_CIPHER_CTX *ctx); - -static int dasync_aes256_ctr_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, - void *ptr); -static int dasync_aes256_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, - const unsigned char *iv, int enc); -static int dasync_aes256_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl); -static int dasync_aes256_ctr_cleanup(EVP_CIPHER_CTX *ctx); - -static int dasync_aes128_cbc_hmac_sha1_ctrl(EVP_CIPHER_CTX *ctx, int type, - int arg, void *ptr); -static int dasync_aes128_cbc_hmac_sha1_init_key(EVP_CIPHER_CTX *ctx, - const unsigned char *key, - const unsigned char *iv, - int enc); -static int dasync_aes128_cbc_hmac_sha1_cipher(EVP_CIPHER_CTX *ctx, - unsigned char *out, - const unsigned char *in, - size_t inl); -static int dasync_aes128_cbc_hmac_sha1_cleanup(EVP_CIPHER_CTX *ctx); - -struct dasync_pipeline_ctx { - void *inner_cipher_data; - unsigned int numpipes; - unsigned char **inbufs; - unsigned char **outbufs; - size_t *lens; - unsigned char tlsaad[SSL_MAX_PIPELINES][EVP_AEAD_TLS1_AAD_LEN]; - unsigned int aadctr; -}; - -/* - * Holds the EVP_CIPHER object for aes_128_cbc in this engine. Set up once only - * during engine bind and can then be reused many times. - */ -static EVP_CIPHER *_hidden_aes_128_cbc = NULL; -static const EVP_CIPHER *dasync_aes_128_cbc(void) -{ - return _hidden_aes_128_cbc; -} - -static EVP_CIPHER *_hidden_aes_256_ctr = NULL; -static const EVP_CIPHER *dasync_aes_256_ctr(void) -{ - return _hidden_aes_256_ctr; -} - -/* - * Holds the EVP_CIPHER object for aes_128_cbc_hmac_sha1 in this engine. Set up - * once only during engine bind and can then be reused many times. - * - * This 'stitched' cipher depends on the EVP_aes_128_cbc_hmac_sha1() cipher, - * which is implemented only if the AES-NI instruction set extension is available - * (see OPENSSL_IA32CAP(3)). If that's not the case, then this cipher will not - * be available either. - * - * Note: Since it is a legacy mac-then-encrypt cipher, modern TLS peers (which - * negotiate the encrypt-then-mac extension) won't negotiate it anyway. - */ -static EVP_CIPHER *_hidden_aes_128_cbc_hmac_sha1 = NULL; -static const EVP_CIPHER *dasync_aes_128_cbc_hmac_sha1(void) -{ - return _hidden_aes_128_cbc_hmac_sha1; -} - -static void destroy_ciphers(void) -{ - EVP_CIPHER_meth_free(_hidden_aes_128_cbc); - EVP_CIPHER_meth_free(_hidden_aes_256_ctr); - EVP_CIPHER_meth_free(_hidden_aes_128_cbc_hmac_sha1); - _hidden_aes_128_cbc = NULL; - _hidden_aes_256_ctr = NULL; - _hidden_aes_128_cbc_hmac_sha1 = NULL; -} - -static int dasync_ciphers(ENGINE *e, const EVP_CIPHER **cipher, - const int **nids, int nid); - -static int dasync_cipher_nids[] = { - NID_aes_128_cbc, - NID_aes_256_ctr, - NID_aes_128_cbc_hmac_sha1, - 0 -}; - -static int bind_dasync(ENGINE *e) -{ - /* Setup RSA */ - if ((dasync_rsa_orig = EVP_PKEY_meth_find(EVP_PKEY_RSA)) == NULL - || (dasync_rsa = EVP_PKEY_meth_new(EVP_PKEY_RSA, - EVP_PKEY_FLAG_AUTOARGLEN)) == NULL) - return 0; - EVP_PKEY_meth_set_init(dasync_rsa, dasync_rsa_init); - EVP_PKEY_meth_set_cleanup(dasync_rsa, dasync_rsa_cleanup); - EVP_PKEY_meth_set_paramgen(dasync_rsa, dasync_rsa_paramgen_init, - dasync_rsa_paramgen); - EVP_PKEY_meth_set_keygen(dasync_rsa, dasync_rsa_keygen_init, - dasync_rsa_keygen); - EVP_PKEY_meth_set_encrypt(dasync_rsa, dasync_rsa_encrypt_init, - dasync_rsa_encrypt); - EVP_PKEY_meth_set_decrypt(dasync_rsa, dasync_rsa_decrypt_init, - dasync_rsa_decrypt); - EVP_PKEY_meth_set_ctrl(dasync_rsa, dasync_rsa_ctrl, - dasync_rsa_ctrl_str); - - /* Ensure the dasync error handling is set up */ - ERR_load_DASYNC_strings(); - - if (!ENGINE_set_id(e, engine_dasync_id) - || !ENGINE_set_name(e, engine_dasync_name) - || !ENGINE_set_pkey_meths(e, dasync_pkey) - || !ENGINE_set_digests(e, dasync_digests) - || !ENGINE_set_ciphers(e, dasync_ciphers) - || !ENGINE_set_destroy_function(e, dasync_destroy) - || !ENGINE_set_init_function(e, dasync_init) - || !ENGINE_set_finish_function(e, dasync_finish)) { - DASYNCerr(DASYNC_F_BIND_DASYNC, DASYNC_R_INIT_FAILED); - return 0; - } - - /* - * Set up the EVP_CIPHER and EVP_MD objects for the ciphers/digests - * supplied by this engine - */ - _hidden_sha1_md = EVP_MD_meth_new(NID_sha1, NID_sha1WithRSAEncryption); - if (_hidden_sha1_md == NULL - || !EVP_MD_meth_set_result_size(_hidden_sha1_md, SHA_DIGEST_LENGTH) - || !EVP_MD_meth_set_input_blocksize(_hidden_sha1_md, SHA_CBLOCK) - || !EVP_MD_meth_set_app_datasize(_hidden_sha1_md, - sizeof(EVP_MD *) + sizeof(SHA_CTX)) - || !EVP_MD_meth_set_flags(_hidden_sha1_md, EVP_MD_FLAG_DIGALGID_ABSENT) - || !EVP_MD_meth_set_init(_hidden_sha1_md, dasync_sha1_init) - || !EVP_MD_meth_set_update(_hidden_sha1_md, dasync_sha1_update) - || !EVP_MD_meth_set_final(_hidden_sha1_md, dasync_sha1_final)) { - EVP_MD_meth_free(_hidden_sha1_md); - _hidden_sha1_md = NULL; - } - - _hidden_aes_128_cbc = EVP_CIPHER_meth_new(NID_aes_128_cbc, - 16 /* block size */, - 16 /* key len */); - if (_hidden_aes_128_cbc == NULL - || !EVP_CIPHER_meth_set_iv_length(_hidden_aes_128_cbc,16) - || !EVP_CIPHER_meth_set_flags(_hidden_aes_128_cbc, - EVP_CIPH_FLAG_DEFAULT_ASN1 - | EVP_CIPH_CBC_MODE - | EVP_CIPH_FLAG_PIPELINE - | EVP_CIPH_CUSTOM_COPY) - || !EVP_CIPHER_meth_set_init(_hidden_aes_128_cbc, - dasync_aes128_init_key) - || !EVP_CIPHER_meth_set_do_cipher(_hidden_aes_128_cbc, - dasync_aes128_cbc_cipher) - || !EVP_CIPHER_meth_set_cleanup(_hidden_aes_128_cbc, - dasync_aes128_cbc_cleanup) - || !EVP_CIPHER_meth_set_ctrl(_hidden_aes_128_cbc, - dasync_aes128_cbc_ctrl) - || !EVP_CIPHER_meth_set_impl_ctx_size(_hidden_aes_128_cbc, - sizeof(struct dasync_pipeline_ctx))) { - EVP_CIPHER_meth_free(_hidden_aes_128_cbc); - _hidden_aes_128_cbc = NULL; - } - - _hidden_aes_256_ctr = EVP_CIPHER_meth_new(NID_aes_256_ctr, - 1 /* block size */, - 32 /* key len */); - if (_hidden_aes_256_ctr == NULL - || !EVP_CIPHER_meth_set_iv_length(_hidden_aes_256_ctr,16) - || !EVP_CIPHER_meth_set_flags(_hidden_aes_256_ctr, - EVP_CIPH_FLAG_DEFAULT_ASN1 - | EVP_CIPH_CTR_MODE - | EVP_CIPH_FLAG_PIPELINE - | EVP_CIPH_CUSTOM_COPY) - || !EVP_CIPHER_meth_set_init(_hidden_aes_256_ctr, - dasync_aes256_init_key) - || !EVP_CIPHER_meth_set_do_cipher(_hidden_aes_256_ctr, - dasync_aes256_ctr_cipher) - || !EVP_CIPHER_meth_set_cleanup(_hidden_aes_256_ctr, - dasync_aes256_ctr_cleanup) - || !EVP_CIPHER_meth_set_ctrl(_hidden_aes_256_ctr, - dasync_aes256_ctr_ctrl) - || !EVP_CIPHER_meth_set_impl_ctx_size(_hidden_aes_256_ctr, - sizeof(struct dasync_pipeline_ctx))) { - EVP_CIPHER_meth_free(_hidden_aes_256_ctr); - _hidden_aes_256_ctr = NULL; - } - - _hidden_aes_128_cbc_hmac_sha1 = EVP_CIPHER_meth_new( - NID_aes_128_cbc_hmac_sha1, - 16 /* block size */, - 16 /* key len */); - if (_hidden_aes_128_cbc_hmac_sha1 == NULL - || !EVP_CIPHER_meth_set_iv_length(_hidden_aes_128_cbc_hmac_sha1,16) - || !EVP_CIPHER_meth_set_flags(_hidden_aes_128_cbc_hmac_sha1, - EVP_CIPH_CBC_MODE - | EVP_CIPH_FLAG_DEFAULT_ASN1 - | EVP_CIPH_FLAG_AEAD_CIPHER - | EVP_CIPH_FLAG_PIPELINE - | EVP_CIPH_CUSTOM_COPY) - || !EVP_CIPHER_meth_set_init(_hidden_aes_128_cbc_hmac_sha1, - dasync_aes128_cbc_hmac_sha1_init_key) - || !EVP_CIPHER_meth_set_do_cipher(_hidden_aes_128_cbc_hmac_sha1, - dasync_aes128_cbc_hmac_sha1_cipher) - || !EVP_CIPHER_meth_set_cleanup(_hidden_aes_128_cbc_hmac_sha1, - dasync_aes128_cbc_hmac_sha1_cleanup) - || !EVP_CIPHER_meth_set_ctrl(_hidden_aes_128_cbc_hmac_sha1, - dasync_aes128_cbc_hmac_sha1_ctrl) - || !EVP_CIPHER_meth_set_impl_ctx_size(_hidden_aes_128_cbc_hmac_sha1, - sizeof(struct dasync_pipeline_ctx))) { - EVP_CIPHER_meth_free(_hidden_aes_128_cbc_hmac_sha1); - _hidden_aes_128_cbc_hmac_sha1 = NULL; - } - - return 1; -} - -static void destroy_pkey(void) -{ - /* - * We don't actually need to free the dasync_rsa method since this is - * automatically freed for us by libcrypto. - */ - dasync_rsa_orig = NULL; - dasync_rsa = NULL; -} - -# ifndef OPENSSL_NO_DYNAMIC_ENGINE -static int bind_helper(ENGINE *e, const char *id) -{ - if (id && (strcmp(id, engine_dasync_id) != 0)) - return 0; - if (!bind_dasync(e)) - return 0; - return 1; -} - -IMPLEMENT_DYNAMIC_CHECK_FN() - IMPLEMENT_DYNAMIC_BIND_FN(bind_helper) -# endif - -static ENGINE *engine_dasync(void) -{ - ENGINE *ret = ENGINE_new(); - if (!ret) - return NULL; - if (!bind_dasync(ret)) { - ENGINE_free(ret); - return NULL; - } - return ret; -} - -void engine_load_dasync_int(void) -{ - ENGINE *toadd = engine_dasync(); - if (!toadd) - return; - ERR_set_mark(); - ENGINE_add(toadd); - /* - * If the "add" worked, it gets a structural reference. So either way, we - * release our just-created reference. - */ - ENGINE_free(toadd); - /* - * If the "add" didn't work, it was probably a conflict because it was - * already added (eg. someone calling ENGINE_load_blah then calling - * ENGINE_load_builtin_engines() perhaps). - */ - ERR_pop_to_mark(); -} - -static int dasync_init(ENGINE *e) -{ - return 1; -} - - -static int dasync_finish(ENGINE *e) -{ - return 1; -} - - -static int dasync_destroy(ENGINE *e) -{ - destroy_digests(); - destroy_ciphers(); - destroy_pkey(); - ERR_unload_DASYNC_strings(); - return 1; -} - -static int dasync_pkey(ENGINE *e, EVP_PKEY_METHOD **pmeth, - const int **pnids, int nid) -{ - static const int rnid = EVP_PKEY_RSA; - - if (pmeth == NULL) { - *pnids = &rnid; - return 1; - } - - if (nid == EVP_PKEY_RSA) { - *pmeth = dasync_rsa; - return 1; - } - - *pmeth = NULL; - return 0; -} - -static int dasync_digests(ENGINE *e, const EVP_MD **digest, - const int **nids, int nid) -{ - int ok = 1; - if (!digest) { - /* We are returning a list of supported nids */ - return dasync_digest_nids(nids); - } - /* We are being asked for a specific digest */ - switch (nid) { - case NID_sha1: - *digest = dasync_sha1(); - break; - default: - ok = 0; - *digest = NULL; - break; - } - return ok; -} - -static int dasync_ciphers(ENGINE *e, const EVP_CIPHER **cipher, - const int **nids, int nid) -{ - int ok = 1; - if (cipher == NULL) { - /* We are returning a list of supported nids */ - *nids = dasync_cipher_nids; - return (sizeof(dasync_cipher_nids) - - 1) / sizeof(dasync_cipher_nids[0]); - } - /* We are being asked for a specific cipher */ - switch (nid) { - case NID_aes_128_cbc: - *cipher = dasync_aes_128_cbc(); - break; - case NID_aes_256_ctr: - *cipher = dasync_aes_256_ctr(); - break; - case NID_aes_128_cbc_hmac_sha1: - *cipher = dasync_aes_128_cbc_hmac_sha1(); - break; - default: - ok = 0; - *cipher = NULL; - break; - } - return ok; -} - -static void wait_cleanup(ASYNC_WAIT_CTX *ctx, const void *key, - OSSL_ASYNC_FD readfd, void *pvwritefd) -{ - OSSL_ASYNC_FD *pwritefd = (OSSL_ASYNC_FD *)pvwritefd; -#if defined(ASYNC_WIN) - CloseHandle(readfd); - CloseHandle(*pwritefd); -#elif defined(ASYNC_POSIX) - close(readfd); - close(*pwritefd); -#endif - OPENSSL_free(pwritefd); -} - -#define DUMMY_CHAR 'X' - -static void dummy_pause_job(void) { - ASYNC_JOB *job; - ASYNC_WAIT_CTX *waitctx; - ASYNC_callback_fn callback; - void *callback_arg; - OSSL_ASYNC_FD pipefds[2] = {0, 0}; - OSSL_ASYNC_FD *writefd; -#if defined(ASYNC_WIN) - DWORD numwritten, numread; - char buf = DUMMY_CHAR; -#elif defined(ASYNC_POSIX) - char buf = DUMMY_CHAR; -#endif - - if ((job = ASYNC_get_current_job()) == NULL) - return; - - waitctx = ASYNC_get_wait_ctx(job); - - if (ASYNC_WAIT_CTX_get_callback(waitctx, &callback, &callback_arg) && callback != NULL) { - /* - * In the Dummy async engine we are cheating. We call the callback that the job - * is complete before the call to ASYNC_pause_job(). A real - * async engine would only call the callback when the job was actually complete - */ - (*callback)(callback_arg); - ASYNC_pause_job(); - return; - } - - - if (ASYNC_WAIT_CTX_get_fd(waitctx, engine_dasync_id, &pipefds[0], - (void **)&writefd)) { - pipefds[1] = *writefd; - } else { - writefd = OPENSSL_malloc(sizeof(*writefd)); - if (writefd == NULL) - return; -#if defined(ASYNC_WIN) - if (CreatePipe(&pipefds[0], &pipefds[1], NULL, 256) == 0) { - OPENSSL_free(writefd); - return; - } -#elif defined(ASYNC_POSIX) - if (pipe(pipefds) != 0) { - OPENSSL_free(writefd); - return; - } -#endif - *writefd = pipefds[1]; - - if (!ASYNC_WAIT_CTX_set_wait_fd(waitctx, engine_dasync_id, pipefds[0], - writefd, wait_cleanup)) { - wait_cleanup(waitctx, engine_dasync_id, pipefds[0], writefd); - return; - } - } - /* - * In the Dummy async engine we are cheating. We signal that the job - * is complete by waking it before the call to ASYNC_pause_job(). A real - * async engine would only wake when the job was actually complete - */ -#if defined(ASYNC_WIN) - WriteFile(pipefds[1], &buf, 1, &numwritten, NULL); -#elif defined(ASYNC_POSIX) - if (write(pipefds[1], &buf, 1) < 0) - return; -#endif - - /* Ignore errors - we carry on anyway */ - ASYNC_pause_job(); - - /* Clear the wake signal */ -#if defined(ASYNC_WIN) - ReadFile(pipefds[0], &buf, 1, &numread, NULL); -#elif defined(ASYNC_POSIX) - if (read(pipefds[0], &buf, 1) < 0) - return; -#endif -} - -/* - * SHA1 implementation. At the moment we just defer to the standard - * implementation - */ -static int dasync_sha1_init(EVP_MD_CTX *ctx) -{ - dummy_pause_job(); - - return EVP_MD_meth_get_init(EVP_sha1())(ctx); -} - -static int dasync_sha1_update(EVP_MD_CTX *ctx, const void *data, - size_t count) -{ - dummy_pause_job(); - - return EVP_MD_meth_get_update(EVP_sha1())(ctx, data, count); -} - -static int dasync_sha1_final(EVP_MD_CTX *ctx, unsigned char *md) -{ - dummy_pause_job(); - - return EVP_MD_meth_get_final(EVP_sha1())(ctx, md); -} - -/* Cipher helper functions */ - -static int dasync_cipher_ctrl_helper(EVP_CIPHER_CTX *ctx, int type, int arg, - void *ptr, int aeadcapable, - const EVP_CIPHER *ciph) -{ - int ret; - struct dasync_pipeline_ctx *pipe_ctx = - (struct dasync_pipeline_ctx *)EVP_CIPHER_CTX_get_cipher_data(ctx); - - if (pipe_ctx == NULL) - return 0; - - switch (type) { - case EVP_CTRL_COPY: - { - size_t sz = EVP_CIPHER_impl_ctx_size(ciph); - void *inner_cipher_data = OPENSSL_malloc(sz); - - if (inner_cipher_data == NULL) - return -1; - memcpy(inner_cipher_data, pipe_ctx->inner_cipher_data, sz); - pipe_ctx->inner_cipher_data = inner_cipher_data; - } - break; - - case EVP_CTRL_SET_PIPELINE_OUTPUT_BUFS: - pipe_ctx->numpipes = arg; - pipe_ctx->outbufs = (unsigned char **)ptr; - break; - - case EVP_CTRL_SET_PIPELINE_INPUT_BUFS: - pipe_ctx->numpipes = arg; - pipe_ctx->inbufs = (unsigned char **)ptr; - break; - - case EVP_CTRL_SET_PIPELINE_INPUT_LENS: - pipe_ctx->numpipes = arg; - pipe_ctx->lens = (size_t *)ptr; - break; - - case EVP_CTRL_AEAD_SET_MAC_KEY: - if (!aeadcapable) - return -1; - EVP_CIPHER_CTX_set_cipher_data(ctx, pipe_ctx->inner_cipher_data); - ret = EVP_CIPHER_meth_get_ctrl(EVP_aes_128_cbc_hmac_sha1()) - (ctx, type, arg, ptr); - EVP_CIPHER_CTX_set_cipher_data(ctx, pipe_ctx); - return ret; - - case EVP_CTRL_AEAD_TLS1_AAD: - { - unsigned char *p = ptr; - unsigned int len; - - if (!aeadcapable || arg != EVP_AEAD_TLS1_AAD_LEN) - return -1; - - if (pipe_ctx->aadctr >= SSL_MAX_PIPELINES) - return -1; - - memcpy(pipe_ctx->tlsaad[pipe_ctx->aadctr], ptr, - EVP_AEAD_TLS1_AAD_LEN); - pipe_ctx->aadctr++; - - len = p[arg - 2] << 8 | p[arg - 1]; - - if (EVP_CIPHER_CTX_is_encrypting(ctx)) { - if ((p[arg - 4] << 8 | p[arg - 3]) >= TLS1_1_VERSION) { - if (len < AES_BLOCK_SIZE) - return 0; - len -= AES_BLOCK_SIZE; - } - - return ((len + SHA_DIGEST_LENGTH + AES_BLOCK_SIZE) - & -AES_BLOCK_SIZE) - len; - } else { - return SHA_DIGEST_LENGTH; - } - } - - default: - return 0; - } - - return 1; -} - -static int dasync_cipher_init_key_helper(EVP_CIPHER_CTX *ctx, - const unsigned char *key, - const unsigned char *iv, int enc, - const EVP_CIPHER *cipher) -{ - int ret; - struct dasync_pipeline_ctx *pipe_ctx = - (struct dasync_pipeline_ctx *)EVP_CIPHER_CTX_get_cipher_data(ctx); - - if (pipe_ctx->inner_cipher_data == NULL - && EVP_CIPHER_impl_ctx_size(cipher) != 0) { - pipe_ctx->inner_cipher_data = OPENSSL_zalloc( - EVP_CIPHER_impl_ctx_size(cipher)); - if (pipe_ctx->inner_cipher_data == NULL) - return 0; - } - - pipe_ctx->numpipes = 0; - pipe_ctx->aadctr = 0; - - EVP_CIPHER_CTX_set_cipher_data(ctx, pipe_ctx->inner_cipher_data); - ret = EVP_CIPHER_meth_get_init(cipher)(ctx, key, iv, enc); - EVP_CIPHER_CTX_set_cipher_data(ctx, pipe_ctx); - - return ret; -} - -static int dasync_cipher_helper(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl, - const EVP_CIPHER *cipher) -{ - int ret = 1; - unsigned int i, pipes; - struct dasync_pipeline_ctx *pipe_ctx = - (struct dasync_pipeline_ctx *)EVP_CIPHER_CTX_get_cipher_data(ctx); - - pipes = pipe_ctx->numpipes; - EVP_CIPHER_CTX_set_cipher_data(ctx, pipe_ctx->inner_cipher_data); - if (pipes == 0) { - if (pipe_ctx->aadctr != 0) { - if (pipe_ctx->aadctr != 1) - return -1; - EVP_CIPHER_meth_get_ctrl(cipher) - (ctx, EVP_CTRL_AEAD_TLS1_AAD, - EVP_AEAD_TLS1_AAD_LEN, - pipe_ctx->tlsaad[0]); - } - ret = EVP_CIPHER_meth_get_do_cipher(cipher) - (ctx, out, in, inl); - } else { - if (pipe_ctx->aadctr > 0 && pipe_ctx->aadctr != pipes) - return -1; - for (i = 0; i < pipes; i++) { - if (pipe_ctx->aadctr > 0) { - EVP_CIPHER_meth_get_ctrl(cipher) - (ctx, EVP_CTRL_AEAD_TLS1_AAD, - EVP_AEAD_TLS1_AAD_LEN, - pipe_ctx->tlsaad[i]); - } - ret = ret && EVP_CIPHER_meth_get_do_cipher(cipher) - (ctx, pipe_ctx->outbufs[i], pipe_ctx->inbufs[i], - pipe_ctx->lens[i]); - } - pipe_ctx->numpipes = 0; - } - pipe_ctx->aadctr = 0; - EVP_CIPHER_CTX_set_cipher_data(ctx, pipe_ctx); - return ret; -} - -static int dasync_cipher_cleanup_helper(EVP_CIPHER_CTX *ctx, - const EVP_CIPHER *cipher) -{ - struct dasync_pipeline_ctx *pipe_ctx = - (struct dasync_pipeline_ctx *)EVP_CIPHER_CTX_get_cipher_data(ctx); - - OPENSSL_clear_free(pipe_ctx->inner_cipher_data, - EVP_CIPHER_impl_ctx_size(cipher)); - - return 1; -} - -/* - * AES128 CBC Implementation - */ - -static int dasync_aes128_cbc_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, - void *ptr) -{ - return dasync_cipher_ctrl_helper(ctx, type, arg, ptr, 0, EVP_aes_128_cbc()); -} - -static int dasync_aes128_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, - const unsigned char *iv, int enc) -{ - return dasync_cipher_init_key_helper(ctx, key, iv, enc, EVP_aes_128_cbc()); -} - -static int dasync_aes128_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) -{ - return dasync_cipher_helper(ctx, out, in, inl, EVP_aes_128_cbc()); -} - -static int dasync_aes128_cbc_cleanup(EVP_CIPHER_CTX *ctx) -{ - return dasync_cipher_cleanup_helper(ctx, EVP_aes_128_cbc()); -} - -static int dasync_aes256_ctr_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, - void *ptr) -{ - return dasync_cipher_ctrl_helper(ctx, type, arg, ptr, 0, EVP_aes_256_ctr()); -} - -static int dasync_aes256_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, - const unsigned char *iv, int enc) -{ - return dasync_cipher_init_key_helper(ctx, key, iv, enc, EVP_aes_256_ctr()); -} - -static int dasync_aes256_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) -{ - return dasync_cipher_helper(ctx, out, in, inl, EVP_aes_256_ctr()); -} - -static int dasync_aes256_ctr_cleanup(EVP_CIPHER_CTX *ctx) -{ - return dasync_cipher_cleanup_helper(ctx, EVP_aes_256_ctr()); -} - - -/* - * AES128 CBC HMAC SHA1 Implementation - */ - -static int dasync_aes128_cbc_hmac_sha1_ctrl(EVP_CIPHER_CTX *ctx, int type, - int arg, void *ptr) -{ - return dasync_cipher_ctrl_helper(ctx, type, arg, ptr, 1, EVP_aes_128_cbc_hmac_sha1()); -} - -static int dasync_aes128_cbc_hmac_sha1_init_key(EVP_CIPHER_CTX *ctx, - const unsigned char *key, - const unsigned char *iv, - int enc) -{ - /* - * We can safely assume that EVP_aes_128_cbc_hmac_sha1() != NULL, - * see comment before the definition of dasync_aes_128_cbc_hmac_sha1(). - */ - return dasync_cipher_init_key_helper(ctx, key, iv, enc, - EVP_aes_128_cbc_hmac_sha1()); -} - -static int dasync_aes128_cbc_hmac_sha1_cipher(EVP_CIPHER_CTX *ctx, - unsigned char *out, - const unsigned char *in, - size_t inl) -{ - return dasync_cipher_helper(ctx, out, in, inl, EVP_aes_128_cbc_hmac_sha1()); -} - -static int dasync_aes128_cbc_hmac_sha1_cleanup(EVP_CIPHER_CTX *ctx) -{ - /* - * We can safely assume that EVP_aes_128_cbc_hmac_sha1() != NULL, - * see comment before the definition of dasync_aes_128_cbc_hmac_sha1(). - */ - return dasync_cipher_cleanup_helper(ctx, EVP_aes_128_cbc_hmac_sha1()); -} - - -/* - * RSA implementation - */ -static int dasync_rsa_init(EVP_PKEY_CTX *ctx) -{ - static int (*pinit)(EVP_PKEY_CTX *ctx); - - if (pinit == NULL) - EVP_PKEY_meth_get_init(dasync_rsa_orig, &pinit); - return pinit(ctx); -} - -static void dasync_rsa_cleanup(EVP_PKEY_CTX *ctx) -{ - static void (*pcleanup)(EVP_PKEY_CTX *ctx); - - if (pcleanup == NULL) - EVP_PKEY_meth_get_cleanup(dasync_rsa_orig, &pcleanup); - pcleanup(ctx); -} - -static int dasync_rsa_paramgen_init(EVP_PKEY_CTX *ctx) -{ - static int (*pparamgen_init)(EVP_PKEY_CTX *ctx); - - if (pparamgen_init == NULL) - EVP_PKEY_meth_get_paramgen(dasync_rsa_orig, &pparamgen_init, NULL); - return pparamgen_init != NULL ? pparamgen_init(ctx) : 1; -} - -static int dasync_rsa_paramgen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey) -{ - static int (*pparamgen)(EVP_PKEY_CTX *c, EVP_PKEY *pkey); - - if (pparamgen == NULL) - EVP_PKEY_meth_get_paramgen(dasync_rsa_orig, NULL, &pparamgen); - return pparamgen != NULL ? pparamgen(ctx, pkey) : 1; -} - -static int dasync_rsa_keygen_init(EVP_PKEY_CTX *ctx) -{ - static int (*pkeygen_init)(EVP_PKEY_CTX *ctx); - - if (pkeygen_init == NULL) - EVP_PKEY_meth_get_keygen(dasync_rsa_orig, &pkeygen_init, NULL); - return pkeygen_init != NULL ? pkeygen_init(ctx) : 1; -} - -static int dasync_rsa_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey) -{ - static int (*pkeygen)(EVP_PKEY_CTX *c, EVP_PKEY *pkey); - - if (pkeygen == NULL) - EVP_PKEY_meth_get_keygen(dasync_rsa_orig, NULL, &pkeygen); - return pkeygen(ctx, pkey); -} - -static int dasync_rsa_encrypt_init(EVP_PKEY_CTX *ctx) -{ - static int (*pencrypt_init)(EVP_PKEY_CTX *ctx); - - if (pencrypt_init == NULL) - EVP_PKEY_meth_get_encrypt(dasync_rsa_orig, &pencrypt_init, NULL); - return pencrypt_init != NULL ? pencrypt_init(ctx) : 1; -} - -static int dasync_rsa_encrypt(EVP_PKEY_CTX *ctx, unsigned char *out, - size_t *outlen, const unsigned char *in, - size_t inlen) -{ - static int (*pencryptfn)(EVP_PKEY_CTX *ctx, unsigned char *out, - size_t *outlen, const unsigned char *in, - size_t inlen); - - if (pencryptfn == NULL) - EVP_PKEY_meth_get_encrypt(dasync_rsa_orig, NULL, &pencryptfn); - return pencryptfn(ctx, out, outlen, in, inlen); -} - -static int dasync_rsa_decrypt_init(EVP_PKEY_CTX *ctx) -{ - static int (*pdecrypt_init)(EVP_PKEY_CTX *ctx); - - if (pdecrypt_init == NULL) - EVP_PKEY_meth_get_decrypt(dasync_rsa_orig, &pdecrypt_init, NULL); - return pdecrypt_init != NULL ? pdecrypt_init(ctx) : 1; -} - -static int dasync_rsa_decrypt(EVP_PKEY_CTX *ctx, unsigned char *out, - size_t *outlen, const unsigned char *in, - size_t inlen) -{ - static int (*pdecrypt)(EVP_PKEY_CTX *ctx, unsigned char *out, - size_t *outlen, const unsigned char *in, - size_t inlen); - - if (pdecrypt == NULL) - EVP_PKEY_meth_get_decrypt(dasync_rsa_orig, NULL, &pdecrypt); - return pdecrypt(ctx, out, outlen, in, inlen); -} - -static int dasync_rsa_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) -{ - static int (*pctrl)(EVP_PKEY_CTX *ctx, int type, int p1, void *p2); - - if (pctrl == NULL) - EVP_PKEY_meth_get_ctrl(dasync_rsa_orig, &pctrl, NULL); - return pctrl(ctx, type, p1, p2); -} - -static int dasync_rsa_ctrl_str(EVP_PKEY_CTX *ctx, const char *type, - const char *value) -{ - static int (*pctrl_str)(EVP_PKEY_CTX *ctx, const char *type, - const char *value); - - if (pctrl_str == NULL) - EVP_PKEY_meth_get_ctrl(dasync_rsa_orig, NULL, &pctrl_str); - return pctrl_str(ctx, type, value); -} diff --git a/engines/e_dasync.ec b/engines/e_dasync.ec deleted file mode 100644 index 3d56ebcc5f..0000000000 --- a/engines/e_dasync.ec +++ /dev/null @@ -1,3 +0,0 @@ -# The INPUT HEADER is scanned for declarations -# LIBNAME INPUT HEADER ERROR-TABLE FILE -L DASYNC e_dasync_err.h e_dasync_err.c diff --git a/engines/e_dasync.txt b/engines/e_dasync.txt deleted file mode 100644 index d050a148c3..0000000000 --- a/engines/e_dasync.txt +++ /dev/null @@ -1,9 +0,0 @@ -# Copyright 1999-2021 The OpenSSL Project Authors. All Rights Reserved. -# -# Licensed under the Apache License 2.0 (the "License"). You may not use -# this file except in compliance with the License. You can obtain a copy -# in the file LICENSE in the source distribution or at -# https://www.openssl.org/source/license.html - -#Reason codes -DASYNC_R_INIT_FAILED:100:init failed diff --git a/engines/e_dasync_err.c b/engines/e_dasync_err.c deleted file mode 100644 index 16021f3196..0000000000 --- a/engines/e_dasync_err.c +++ /dev/null @@ -1,56 +0,0 @@ -/* - * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#include -#include "e_dasync_err.h" - -#ifndef OPENSSL_NO_ERR - -static ERR_STRING_DATA DASYNC_str_reasons[] = { - {ERR_PACK(0, 0, DASYNC_R_INIT_FAILED), "init failed"}, - {0, NULL} -}; - -#endif - -static int lib_code = 0; -static int error_loaded = 0; - -static int ERR_load_DASYNC_strings(void) -{ - if (lib_code == 0) - lib_code = ERR_get_next_error_library(); - - if (!error_loaded) { -#ifndef OPENSSL_NO_ERR - ERR_load_strings(lib_code, DASYNC_str_reasons); -#endif - error_loaded = 1; - } - return 1; -} - -static void ERR_unload_DASYNC_strings(void) -{ - if (error_loaded) { -#ifndef OPENSSL_NO_ERR - ERR_unload_strings(lib_code, DASYNC_str_reasons); -#endif - error_loaded = 0; - } -} - -static void ERR_DASYNC_error(int function, int reason, const char *file, int line) -{ - if (lib_code == 0) - lib_code = ERR_get_next_error_library(); - ERR_raise(lib_code, reason); - ERR_set_debug(file, line, NULL); -} diff --git a/engines/e_dasync_err.h b/engines/e_dasync_err.h deleted file mode 100644 index 7a067c6037..0000000000 --- a/engines/e_dasync_err.h +++ /dev/null @@ -1,27 +0,0 @@ -/* - * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#ifndef OSSL_E_DASYNC_ERR_H -# define OSSL_E_DASYNC_ERR_H -# pragma once - -# include -# include - - -# define DASYNCerr(f, r) ERR_DASYNC_error(0, (r), OPENSSL_FILE, OPENSSL_LINE) - - -/* - * DASYNC reason codes. - */ -# define DASYNC_R_INIT_FAILED 100 - -#endif diff --git a/engines/e_devcrypto.c b/engines/e_devcrypto.c deleted file mode 100644 index 1e1d9d12b8..0000000000 --- a/engines/e_devcrypto.c +++ /dev/null @@ -1,1383 +0,0 @@ -/* - * Copyright 2017-2023 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* We need to use some deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - -#include "internal/e_os.h" -#include -#include -#include -#include -#include -#include -#include - -#include -#include -#include -#include -#include -#include "crypto/cryptodev.h" -#include "internal/nelem.h" - -/* #define ENGINE_DEVCRYPTO_DEBUG */ - -#if CRYPTO_ALGORITHM_MIN < CRYPTO_ALGORITHM_MAX -# define CHECK_BSD_STYLE_MACROS -#endif - -#define engine_devcrypto_id "devcrypto" - -/* - * Use session2_op on FreeBSD which permits requesting specific - * drivers or classes of drivers at session creation time. - */ -#ifdef CIOCGSESSION2 -typedef struct session2_op session_op_t; -#else -typedef struct session_op session_op_t; -#endif - -/* - * ONE global file descriptor for all sessions. This allows operations - * such as digest session data copying (see digest_copy()), but is also - * saner... why re-open /dev/crypto for every session? - */ -static int cfd = -1; -#define DEVCRYPTO_REQUIRE_ACCELERATED 0 /* require confirmation of acceleration */ -#define DEVCRYPTO_USE_SOFTWARE 1 /* allow software drivers */ -#define DEVCRYPTO_REJECT_SOFTWARE 2 /* only disallow confirmed software drivers */ - -#define DEVCRYPTO_DEFAULT_USE_SOFTDRIVERS DEVCRYPTO_REJECT_SOFTWARE -static int use_softdrivers = DEVCRYPTO_DEFAULT_USE_SOFTDRIVERS; - -/* - * cipher/digest status & acceleration definitions - * Make sure the defaults are set to 0 - */ -struct driver_info_st { - enum devcrypto_status_t { - DEVCRYPTO_STATUS_FAILURE = -3, /* unusable for other reason */ - DEVCRYPTO_STATUS_NO_CIOCCPHASH = -2, /* hash state copy not supported */ - DEVCRYPTO_STATUS_NO_CIOCGSESSION = -1, /* session open failed */ - DEVCRYPTO_STATUS_UNKNOWN = 0, /* not tested yet */ - DEVCRYPTO_STATUS_USABLE = 1 /* algo can be used */ - } status; - - enum devcrypto_accelerated_t { - DEVCRYPTO_NOT_ACCELERATED = -1, /* software implemented */ - DEVCRYPTO_ACCELERATION_UNKNOWN = 0, /* acceleration support unknown */ - DEVCRYPTO_ACCELERATED = 1 /* hardware accelerated */ - } accelerated; - - char *driver_name; -}; - -#ifdef OPENSSL_NO_DYNAMIC_ENGINE -void engine_load_devcrypto_int(void); -#endif - -static int clean_devcrypto_session(session_op_t *sess) { - if (ioctl(cfd, CIOCFSESSION, &sess->ses) < 0) { - ERR_raise_data(ERR_LIB_SYS, errno, "calling ioctl()"); - return 0; - } - memset(sess, 0, sizeof(*sess)); - return 1; -} - -/****************************************************************************** - * - * Ciphers - * - * Because they all do the same basic operation, we have only one set of - * method functions for them all to share, and a mapping table between - * NIDs and cryptodev IDs, with all the necessary size data. - * - *****/ - -struct cipher_ctx { - session_op_t sess; - int op; /* COP_ENCRYPT or COP_DECRYPT */ - unsigned long mode; /* EVP_CIPH_*_MODE */ - - /* to handle ctr mode being a stream cipher */ - unsigned char partial[EVP_MAX_BLOCK_LENGTH]; - unsigned int blocksize, num; -}; - -static const struct cipher_data_st { - int nid; - int blocksize; - int keylen; - int ivlen; - int flags; - int devcryptoid; -} cipher_data[] = { -#ifndef OPENSSL_NO_DES - { NID_des_cbc, 8, 8, 8, EVP_CIPH_CBC_MODE, CRYPTO_DES_CBC }, - { NID_des_ede3_cbc, 8, 24, 8, EVP_CIPH_CBC_MODE, CRYPTO_3DES_CBC }, -#endif -#ifndef OPENSSL_NO_BF - { NID_bf_cbc, 8, 16, 8, EVP_CIPH_CBC_MODE, CRYPTO_BLF_CBC }, -#endif -#ifndef OPENSSL_NO_CAST - { NID_cast5_cbc, 8, 16, 8, EVP_CIPH_CBC_MODE, CRYPTO_CAST_CBC }, -#endif - { NID_aes_128_cbc, 16, 128 / 8, 16, EVP_CIPH_CBC_MODE, CRYPTO_AES_CBC }, - { NID_aes_192_cbc, 16, 192 / 8, 16, EVP_CIPH_CBC_MODE, CRYPTO_AES_CBC }, - { NID_aes_256_cbc, 16, 256 / 8, 16, EVP_CIPH_CBC_MODE, CRYPTO_AES_CBC }, -#ifndef OPENSSL_NO_RC4 - { NID_rc4, 1, 16, 0, EVP_CIPH_STREAM_CIPHER, CRYPTO_ARC4 }, -#endif -#if !defined(CHECK_BSD_STYLE_MACROS) || defined(CRYPTO_AES_CTR) - { NID_aes_128_ctr, 16, 128 / 8, 16, EVP_CIPH_CTR_MODE, CRYPTO_AES_CTR }, - { NID_aes_192_ctr, 16, 192 / 8, 16, EVP_CIPH_CTR_MODE, CRYPTO_AES_CTR }, - { NID_aes_256_ctr, 16, 256 / 8, 16, EVP_CIPH_CTR_MODE, CRYPTO_AES_CTR }, -#endif -#if 0 /* Not yet supported */ - { NID_aes_128_xts, 16, 128 / 8 * 2, 16, EVP_CIPH_XTS_MODE, CRYPTO_AES_XTS }, - { NID_aes_256_xts, 16, 256 / 8 * 2, 16, EVP_CIPH_XTS_MODE, CRYPTO_AES_XTS }, -#endif -#if !defined(CHECK_BSD_STYLE_MACROS) || defined(CRYPTO_AES_ECB) - { NID_aes_128_ecb, 16, 128 / 8, 0, EVP_CIPH_ECB_MODE, CRYPTO_AES_ECB }, - { NID_aes_192_ecb, 16, 192 / 8, 0, EVP_CIPH_ECB_MODE, CRYPTO_AES_ECB }, - { NID_aes_256_ecb, 16, 256 / 8, 0, EVP_CIPH_ECB_MODE, CRYPTO_AES_ECB }, -#endif -#if 0 /* Not yet supported */ - { NID_aes_128_gcm, 16, 128 / 8, 16, EVP_CIPH_GCM_MODE, CRYPTO_AES_GCM }, - { NID_aes_192_gcm, 16, 192 / 8, 16, EVP_CIPH_GCM_MODE, CRYPTO_AES_GCM }, - { NID_aes_256_gcm, 16, 256 / 8, 16, EVP_CIPH_GCM_MODE, CRYPTO_AES_GCM }, -#endif -#ifndef OPENSSL_NO_CAMELLIA - { NID_camellia_128_cbc, 16, 128 / 8, 16, EVP_CIPH_CBC_MODE, - CRYPTO_CAMELLIA_CBC }, - { NID_camellia_192_cbc, 16, 192 / 8, 16, EVP_CIPH_CBC_MODE, - CRYPTO_CAMELLIA_CBC }, - { NID_camellia_256_cbc, 16, 256 / 8, 16, EVP_CIPH_CBC_MODE, - CRYPTO_CAMELLIA_CBC }, -#endif -}; - -static size_t find_cipher_data_index(int nid) -{ - size_t i; - - for (i = 0; i < OSSL_NELEM(cipher_data); i++) - if (nid == cipher_data[i].nid) - return i; - return (size_t)-1; -} - -static size_t get_cipher_data_index(int nid) -{ - size_t i = find_cipher_data_index(nid); - - if (i != (size_t)-1) - return i; - - /* - * Code further down must make sure that only NIDs in the table above - * are used. If any other NID reaches this function, there's a grave - * coding error further down. - */ - assert("Code that never should be reached" == NULL); - return -1; -} - -static const struct cipher_data_st *get_cipher_data(int nid) -{ - return &cipher_data[get_cipher_data_index(nid)]; -} - -/* - * Following are the three necessary functions to map OpenSSL functionality - * with cryptodev. - */ - -static int cipher_init(EVP_CIPHER_CTX *ctx, const unsigned char *key, - const unsigned char *iv, int enc) -{ - struct cipher_ctx *cipher_ctx = - (struct cipher_ctx *)EVP_CIPHER_CTX_get_cipher_data(ctx); - const struct cipher_data_st *cipher_d = - get_cipher_data(EVP_CIPHER_CTX_get_nid(ctx)); - int ret; - - /* cleanup a previous session */ - if (cipher_ctx->sess.ses != 0 && - clean_devcrypto_session(&cipher_ctx->sess) == 0) - return 0; - - cipher_ctx->sess.cipher = cipher_d->devcryptoid; - cipher_ctx->sess.keylen = cipher_d->keylen; - cipher_ctx->sess.key = (void *)key; - cipher_ctx->op = enc ? COP_ENCRYPT : COP_DECRYPT; - cipher_ctx->mode = cipher_d->flags & EVP_CIPH_MODE; - cipher_ctx->blocksize = cipher_d->blocksize; -#ifdef CIOCGSESSION2 - cipher_ctx->sess.crid = (use_softdrivers == DEVCRYPTO_USE_SOFTWARE) ? - CRYPTO_FLAG_SOFTWARE | CRYPTO_FLAG_HARDWARE : - CRYPTO_FLAG_HARDWARE; - ret = ioctl(cfd, CIOCGSESSION2, &cipher_ctx->sess); -#else - ret = ioctl(cfd, CIOCGSESSION, &cipher_ctx->sess); -#endif - if (ret < 0) { - ERR_raise_data(ERR_LIB_SYS, errno, "calling ioctl()"); - return 0; - } - - return 1; -} - -static int cipher_do_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) -{ - struct cipher_ctx *cipher_ctx = - (struct cipher_ctx *)EVP_CIPHER_CTX_get_cipher_data(ctx); - struct crypt_op cryp; - unsigned char *iv = EVP_CIPHER_CTX_iv_noconst(ctx); -#if !defined(COP_FLAG_WRITE_IV) - unsigned char saved_iv[EVP_MAX_IV_LENGTH]; - const unsigned char *ivptr; - size_t nblocks, ivlen; -#endif - - memset(&cryp, 0, sizeof(cryp)); - cryp.ses = cipher_ctx->sess.ses; - cryp.len = inl; - cryp.src = (void *)in; - cryp.dst = (void *)out; - cryp.iv = (void *)iv; - cryp.op = cipher_ctx->op; -#if !defined(COP_FLAG_WRITE_IV) - cryp.flags = 0; - - ivlen = EVP_CIPHER_CTX_get_iv_length(ctx); - if (ivlen > 0) - switch (cipher_ctx->mode) { - case EVP_CIPH_CBC_MODE: - assert(inl >= ivlen); - if (!EVP_CIPHER_CTX_is_encrypting(ctx)) { - ivptr = in + inl - ivlen; - memcpy(saved_iv, ivptr, ivlen); - } - break; - - case EVP_CIPH_CTR_MODE: - break; - - default: /* should not happen */ - return 0; - } -#else - cryp.flags = COP_FLAG_WRITE_IV; -#endif - - if (ioctl(cfd, CIOCCRYPT, &cryp) < 0) { - ERR_raise_data(ERR_LIB_SYS, errno, "calling ioctl()"); - return 0; - } - -#if !defined(COP_FLAG_WRITE_IV) - if (ivlen > 0) - switch (cipher_ctx->mode) { - case EVP_CIPH_CBC_MODE: - assert(inl >= ivlen); - if (EVP_CIPHER_CTX_is_encrypting(ctx)) - ivptr = out + inl - ivlen; - else - ivptr = saved_iv; - - memcpy(iv, ivptr, ivlen); - break; - - case EVP_CIPH_CTR_MODE: - nblocks = (inl + cipher_ctx->blocksize - 1) - / cipher_ctx->blocksize; - do { - ivlen--; - nblocks += iv[ivlen]; - iv[ivlen] = (uint8_t) nblocks; - nblocks >>= 8; - } while (ivlen); - break; - - default: /* should not happen */ - return 0; - } -#endif - - return 1; -} - -static int ctr_do_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) -{ - struct cipher_ctx *cipher_ctx = - (struct cipher_ctx *)EVP_CIPHER_CTX_get_cipher_data(ctx); - size_t nblocks, len; - - /* initial partial block */ - while (cipher_ctx->num && inl) { - (*out++) = *(in++) ^ cipher_ctx->partial[cipher_ctx->num]; - --inl; - cipher_ctx->num = (cipher_ctx->num + 1) % cipher_ctx->blocksize; - } - - /* full blocks */ - if (inl > cipher_ctx->blocksize) { - nblocks = inl/cipher_ctx->blocksize; - len = nblocks * cipher_ctx->blocksize; - if (cipher_do_cipher(ctx, out, in, len) < 1) - return 0; - inl -= len; - out += len; - in += len; - } - - /* final partial block */ - if (inl) { - memset(cipher_ctx->partial, 0, cipher_ctx->blocksize); - if (cipher_do_cipher(ctx, cipher_ctx->partial, cipher_ctx->partial, - cipher_ctx->blocksize) < 1) - return 0; - while (inl--) { - out[cipher_ctx->num] = in[cipher_ctx->num] - ^ cipher_ctx->partial[cipher_ctx->num]; - cipher_ctx->num++; - } - } - - return 1; -} - -static int cipher_ctrl(EVP_CIPHER_CTX *ctx, int type, int p1, void* p2) -{ - struct cipher_ctx *cipher_ctx = - (struct cipher_ctx *)EVP_CIPHER_CTX_get_cipher_data(ctx); - EVP_CIPHER_CTX *to_ctx = (EVP_CIPHER_CTX *)p2; - struct cipher_ctx *to_cipher_ctx; - - switch (type) { - - case EVP_CTRL_COPY: - if (cipher_ctx == NULL) - return 1; - /* when copying the context, a new session needs to be initialized */ - to_cipher_ctx = - (struct cipher_ctx *)EVP_CIPHER_CTX_get_cipher_data(to_ctx); - memset(&to_cipher_ctx->sess, 0, sizeof(to_cipher_ctx->sess)); - return cipher_init(to_ctx, (void *)cipher_ctx->sess.key, EVP_CIPHER_CTX_iv(ctx), - (cipher_ctx->op == COP_ENCRYPT)); - - case EVP_CTRL_INIT: - memset(&cipher_ctx->sess, 0, sizeof(cipher_ctx->sess)); - return 1; - - default: - break; - } - - return -1; -} - -static int cipher_cleanup(EVP_CIPHER_CTX *ctx) -{ - struct cipher_ctx *cipher_ctx = - (struct cipher_ctx *)EVP_CIPHER_CTX_get_cipher_data(ctx); - - return clean_devcrypto_session(&cipher_ctx->sess); -} - -/* - * Keep tables of known nids, associated methods, selected ciphers, and driver - * info. - * Note that known_cipher_nids[] isn't necessarily indexed the same way as - * cipher_data[] above, which the other tables are. - */ -static int known_cipher_nids[OSSL_NELEM(cipher_data)]; -static int known_cipher_nids_amount = -1; /* -1 indicates not yet initialised */ -static EVP_CIPHER *known_cipher_methods[OSSL_NELEM(cipher_data)] = { NULL, }; -static int selected_ciphers[OSSL_NELEM(cipher_data)]; -static struct driver_info_st cipher_driver_info[OSSL_NELEM(cipher_data)]; - - -static int devcrypto_test_cipher(size_t cipher_data_index) -{ - return (cipher_driver_info[cipher_data_index].status == DEVCRYPTO_STATUS_USABLE - && selected_ciphers[cipher_data_index] == 1 - && (cipher_driver_info[cipher_data_index].accelerated - == DEVCRYPTO_ACCELERATED - || use_softdrivers == DEVCRYPTO_USE_SOFTWARE - || (cipher_driver_info[cipher_data_index].accelerated - != DEVCRYPTO_NOT_ACCELERATED - && use_softdrivers == DEVCRYPTO_REJECT_SOFTWARE))); -} - -static void prepare_cipher_methods(void) -{ - size_t i; - session_op_t sess; - unsigned long cipher_mode; -#ifdef CIOCGSESSION2 - struct crypt_find_op fop; - enum devcrypto_accelerated_t accelerated; -#elif defined(CIOCGSESSINFO) - struct session_info_op siop; -#endif - - memset(&cipher_driver_info, 0, sizeof(cipher_driver_info)); - - memset(&sess, 0, sizeof(sess)); - sess.key = (void *)"01234567890123456789012345678901234567890123456789"; - - for (i = 0, known_cipher_nids_amount = 0; - i < OSSL_NELEM(cipher_data); i++) { - - selected_ciphers[i] = 1; - /* - * Check that the cipher is usable - */ - sess.cipher = cipher_data[i].devcryptoid; - sess.keylen = cipher_data[i].keylen; -#ifdef CIOCGSESSION2 - /* - * When using CIOCGSESSION2, first try to allocate a hardware - * ("accelerated") session. If that fails, fall back to - * allocating a software session. - */ - sess.crid = CRYPTO_FLAG_HARDWARE; - if (ioctl(cfd, CIOCGSESSION2, &sess) == 0) { - accelerated = DEVCRYPTO_ACCELERATED; - } else { - sess.crid = CRYPTO_FLAG_SOFTWARE; - if (ioctl(cfd, CIOCGSESSION2, &sess) < 0) { - cipher_driver_info[i].status = DEVCRYPTO_STATUS_NO_CIOCGSESSION; - continue; - } - accelerated = DEVCRYPTO_NOT_ACCELERATED; - } -#else - if (ioctl(cfd, CIOCGSESSION, &sess) < 0) { - cipher_driver_info[i].status = DEVCRYPTO_STATUS_NO_CIOCGSESSION; - continue; - } -#endif - - cipher_mode = cipher_data[i].flags & EVP_CIPH_MODE; - - if ((known_cipher_methods[i] = - EVP_CIPHER_meth_new(cipher_data[i].nid, - cipher_mode == EVP_CIPH_CTR_MODE ? 1 : - cipher_data[i].blocksize, - cipher_data[i].keylen)) == NULL - || !EVP_CIPHER_meth_set_iv_length(known_cipher_methods[i], - cipher_data[i].ivlen) - || !EVP_CIPHER_meth_set_flags(known_cipher_methods[i], - cipher_data[i].flags - | EVP_CIPH_CUSTOM_COPY - | EVP_CIPH_CTRL_INIT - | EVP_CIPH_FLAG_DEFAULT_ASN1) - || !EVP_CIPHER_meth_set_init(known_cipher_methods[i], cipher_init) - || !EVP_CIPHER_meth_set_do_cipher(known_cipher_methods[i], - cipher_mode == EVP_CIPH_CTR_MODE ? - ctr_do_cipher : - cipher_do_cipher) - || !EVP_CIPHER_meth_set_ctrl(known_cipher_methods[i], cipher_ctrl) - || !EVP_CIPHER_meth_set_cleanup(known_cipher_methods[i], - cipher_cleanup) - || !EVP_CIPHER_meth_set_impl_ctx_size(known_cipher_methods[i], - sizeof(struct cipher_ctx))) { - cipher_driver_info[i].status = DEVCRYPTO_STATUS_FAILURE; - EVP_CIPHER_meth_free(known_cipher_methods[i]); - known_cipher_methods[i] = NULL; - } else { - cipher_driver_info[i].status = DEVCRYPTO_STATUS_USABLE; -#ifdef CIOCGSESSION2 - cipher_driver_info[i].accelerated = accelerated; - fop.crid = sess.crid; - if (ioctl(cfd, CIOCFINDDEV, &fop) == 0) { - cipher_driver_info[i].driver_name = - OPENSSL_strndup(fop.name, sizeof(fop.name)); - } -#elif defined(CIOCGSESSINFO) - siop.ses = sess.ses; - if (ioctl(cfd, CIOCGSESSINFO, &siop) < 0) { - cipher_driver_info[i].accelerated = DEVCRYPTO_ACCELERATION_UNKNOWN; - } else { - cipher_driver_info[i].driver_name = - OPENSSL_strndup(siop.cipher_info.cra_driver_name, - CRYPTODEV_MAX_ALG_NAME); - if (!(siop.flags & SIOP_FLAG_KERNEL_DRIVER_ONLY)) - cipher_driver_info[i].accelerated = DEVCRYPTO_NOT_ACCELERATED; - else - cipher_driver_info[i].accelerated = DEVCRYPTO_ACCELERATED; - } -#endif /* CIOCGSESSINFO */ - } - ioctl(cfd, CIOCFSESSION, &sess.ses); - if (devcrypto_test_cipher(i)) { - known_cipher_nids[known_cipher_nids_amount++] = - cipher_data[i].nid; - } - } -} - -static void rebuild_known_cipher_nids(ENGINE *e) -{ - size_t i; - - for (i = 0, known_cipher_nids_amount = 0; i < OSSL_NELEM(cipher_data); i++) { - if (devcrypto_test_cipher(i)) - known_cipher_nids[known_cipher_nids_amount++] = cipher_data[i].nid; - } - ENGINE_unregister_ciphers(e); - ENGINE_register_ciphers(e); -} - -static const EVP_CIPHER *get_cipher_method(int nid) -{ - size_t i = get_cipher_data_index(nid); - - if (i == (size_t)-1) - return NULL; - return known_cipher_methods[i]; -} - -static int get_cipher_nids(const int **nids) -{ - *nids = known_cipher_nids; - return known_cipher_nids_amount; -} - -static void destroy_cipher_method(int nid) -{ - size_t i = get_cipher_data_index(nid); - - EVP_CIPHER_meth_free(known_cipher_methods[i]); - known_cipher_methods[i] = NULL; -} - -static void destroy_all_cipher_methods(void) -{ - size_t i; - - for (i = 0; i < OSSL_NELEM(cipher_data); i++) { - destroy_cipher_method(cipher_data[i].nid); - OPENSSL_free(cipher_driver_info[i].driver_name); - cipher_driver_info[i].driver_name = NULL; - } -} - -static int devcrypto_ciphers(ENGINE *e, const EVP_CIPHER **cipher, - const int **nids, int nid) -{ - if (cipher == NULL) - return get_cipher_nids(nids); - - *cipher = get_cipher_method(nid); - - return *cipher != NULL; -} - -static void devcrypto_select_all_ciphers(int *cipher_list) -{ - size_t i; - - for (i = 0; i < OSSL_NELEM(cipher_data); i++) - cipher_list[i] = 1; -} - -static int cryptodev_select_cipher_cb(const char *str, int len, void *usr) -{ - int *cipher_list = (int *)usr; - char *name; - const EVP_CIPHER *EVP; - size_t i; - - if (len == 0) - return 1; - if (usr == NULL || (name = OPENSSL_strndup(str, len)) == NULL) - return 0; - EVP = EVP_get_cipherbyname(name); - if (EVP == NULL) - fprintf(stderr, "devcrypto: unknown cipher %s\n", name); - else if ((i = find_cipher_data_index(EVP_CIPHER_get_nid(EVP))) != (size_t)-1) - cipher_list[i] = 1; - else - fprintf(stderr, "devcrypto: cipher %s not available\n", name); - OPENSSL_free(name); - return 1; -} - -static void dump_cipher_info(void) -{ - size_t i; - const char *name; - - fprintf (stderr, "Information about ciphers supported by the /dev/crypto" - " engine:\n"); -#ifndef CIOCGSESSINFO - fprintf(stderr, "CIOCGSESSINFO (session info call) unavailable\n"); -#endif - for (i = 0; i < OSSL_NELEM(cipher_data); i++) { - name = OBJ_nid2sn(cipher_data[i].nid); - fprintf (stderr, "Cipher %s, NID=%d, /dev/crypto info: id=%d, ", - name ? name : "unknown", cipher_data[i].nid, - cipher_data[i].devcryptoid); - if (cipher_driver_info[i].status == DEVCRYPTO_STATUS_NO_CIOCGSESSION) { - fprintf (stderr, "CIOCGSESSION (session open call) failed\n"); - continue; - } - fprintf (stderr, "driver=%s ", cipher_driver_info[i].driver_name ? - cipher_driver_info[i].driver_name : "unknown"); - if (cipher_driver_info[i].accelerated == DEVCRYPTO_ACCELERATED) - fprintf(stderr, "(hw accelerated)"); - else if (cipher_driver_info[i].accelerated == DEVCRYPTO_NOT_ACCELERATED) - fprintf(stderr, "(software)"); - else - fprintf(stderr, "(acceleration status unknown)"); - if (cipher_driver_info[i].status == DEVCRYPTO_STATUS_FAILURE) - fprintf (stderr, ". Cipher setup failed"); - fprintf(stderr, "\n"); - } - fprintf(stderr, "\n"); -} - -/* - * We only support digests if the cryptodev implementation supports multiple - * data updates and session copying. Otherwise, we would be forced to maintain - * a cache, which is perilous if there's a lot of data coming in (if someone - * wants to checksum an OpenSSL tarball, for example). - */ -#if defined(CIOCCPHASH) && defined(COP_FLAG_UPDATE) && defined(COP_FLAG_FINAL) -#define IMPLEMENT_DIGEST - -/****************************************************************************** - * - * Digests - * - * Because they all do the same basic operation, we have only one set of - * method functions for them all to share, and a mapping table between - * NIDs and cryptodev IDs, with all the necessary size data. - * - *****/ - -struct digest_ctx { - session_op_t sess; - /* This signals that the init function was called, not that it succeeded. */ - int init_called; - unsigned char digest_res[HASH_MAX_LEN]; -}; - -static const struct digest_data_st { - int nid; - int blocksize; - int digestlen; - int devcryptoid; -} digest_data[] = { -#ifndef OPENSSL_NO_MD5 - { NID_md5, /* MD5_CBLOCK */ 64, 16, CRYPTO_MD5 }, -#endif - { NID_sha1, SHA_CBLOCK, 20, CRYPTO_SHA1 }, -#ifndef OPENSSL_NO_RMD160 -# if !defined(CHECK_BSD_STYLE_MACROS) || defined(CRYPTO_RIPEMD160) - { NID_ripemd160, /* RIPEMD160_CBLOCK */ 64, 20, CRYPTO_RIPEMD160 }, -# endif -#endif -#if !defined(CHECK_BSD_STYLE_MACROS) || defined(CRYPTO_SHA2_224) - { NID_sha224, SHA256_CBLOCK, 224 / 8, CRYPTO_SHA2_224 }, -#endif -#if !defined(CHECK_BSD_STYLE_MACROS) || defined(CRYPTO_SHA2_256) - { NID_sha256, SHA256_CBLOCK, 256 / 8, CRYPTO_SHA2_256 }, -#endif -#if !defined(CHECK_BSD_STYLE_MACROS) || defined(CRYPTO_SHA2_384) - { NID_sha384, SHA512_CBLOCK, 384 / 8, CRYPTO_SHA2_384 }, -#endif -#if !defined(CHECK_BSD_STYLE_MACROS) || defined(CRYPTO_SHA2_512) - { NID_sha512, SHA512_CBLOCK, 512 / 8, CRYPTO_SHA2_512 }, -#endif -}; - -static size_t find_digest_data_index(int nid) -{ - size_t i; - - for (i = 0; i < OSSL_NELEM(digest_data); i++) - if (nid == digest_data[i].nid) - return i; - return (size_t)-1; -} - -static size_t get_digest_data_index(int nid) -{ - size_t i = find_digest_data_index(nid); - - if (i != (size_t)-1) - return i; - - /* - * Code further down must make sure that only NIDs in the table above - * are used. If any other NID reaches this function, there's a grave - * coding error further down. - */ - assert("Code that never should be reached" == NULL); - return -1; -} - -static const struct digest_data_st *get_digest_data(int nid) -{ - return &digest_data[get_digest_data_index(nid)]; -} - -/* - * Following are the five necessary functions to map OpenSSL functionality - * with cryptodev: init, update, final, cleanup, and copy. - */ - -static int digest_init(EVP_MD_CTX *ctx) -{ - struct digest_ctx *digest_ctx = - (struct digest_ctx *)EVP_MD_CTX_get0_md_data(ctx); - const struct digest_data_st *digest_d = - get_digest_data(EVP_MD_CTX_get_type(ctx)); - - digest_ctx->init_called = 1; - - memset(&digest_ctx->sess, 0, sizeof(digest_ctx->sess)); - digest_ctx->sess.mac = digest_d->devcryptoid; - if (ioctl(cfd, CIOCGSESSION, &digest_ctx->sess) < 0) { - ERR_raise_data(ERR_LIB_SYS, errno, "calling ioctl()"); - return 0; - } - return 1; -} - -static int digest_op(struct digest_ctx *ctx, const void *src, size_t srclen, - void *res, unsigned int flags) -{ - struct crypt_op cryp; - - memset(&cryp, 0, sizeof(cryp)); - cryp.ses = ctx->sess.ses; - cryp.len = srclen; - cryp.src = (void *)src; - cryp.dst = NULL; - cryp.mac = res; - cryp.flags = flags; - return ioctl(cfd, CIOCCRYPT, &cryp); -} - -static int digest_update(EVP_MD_CTX *ctx, const void *data, size_t count) -{ - struct digest_ctx *digest_ctx = - (struct digest_ctx *)EVP_MD_CTX_get0_md_data(ctx); - - if (count == 0) - return 1; - - if (digest_ctx == NULL) - return 0; - - if (EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_ONESHOT)) { - if (digest_op(digest_ctx, data, count, digest_ctx->digest_res, 0) >= 0) - return 1; - } else if (digest_op(digest_ctx, data, count, NULL, COP_FLAG_UPDATE) >= 0) { - return 1; - } - - ERR_raise_data(ERR_LIB_SYS, errno, "calling ioctl()"); - return 0; -} - -static int digest_final(EVP_MD_CTX *ctx, unsigned char *md) -{ - struct digest_ctx *digest_ctx = - (struct digest_ctx *)EVP_MD_CTX_get0_md_data(ctx); - - if (md == NULL || digest_ctx == NULL) - return 0; - - if (EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_ONESHOT)) { - memcpy(md, digest_ctx->digest_res, EVP_MD_CTX_get_size(ctx)); - } else if (digest_op(digest_ctx, NULL, 0, md, COP_FLAG_FINAL) < 0) { - ERR_raise_data(ERR_LIB_SYS, errno, "calling ioctl()"); - return 0; - } - - return 1; -} - -static int digest_copy(EVP_MD_CTX *to, const EVP_MD_CTX *from) -{ - struct digest_ctx *digest_from = - (struct digest_ctx *)EVP_MD_CTX_get0_md_data(from); - struct digest_ctx *digest_to = - (struct digest_ctx *)EVP_MD_CTX_get0_md_data(to); - struct cphash_op cphash; - - if (digest_from == NULL || digest_from->init_called != 1) - return 1; - - if (!digest_init(to)) { - ERR_raise_data(ERR_LIB_SYS, errno, "calling ioctl()"); - return 0; - } - - cphash.src_ses = digest_from->sess.ses; - cphash.dst_ses = digest_to->sess.ses; - if (ioctl(cfd, CIOCCPHASH, &cphash) < 0) { - ERR_raise_data(ERR_LIB_SYS, errno, "calling ioctl()"); - return 0; - } - return 1; -} - -static int digest_cleanup(EVP_MD_CTX *ctx) -{ - struct digest_ctx *digest_ctx = - (struct digest_ctx *)EVP_MD_CTX_get0_md_data(ctx); - - if (digest_ctx == NULL) - return 1; - - return clean_devcrypto_session(&digest_ctx->sess); -} - -/* - * Keep tables of known nids, associated methods, selected digests, and - * driver info. - * Note that known_digest_nids[] isn't necessarily indexed the same way as - * digest_data[] above, which the other tables are. - */ -static int known_digest_nids[OSSL_NELEM(digest_data)]; -static int known_digest_nids_amount = -1; /* -1 indicates not yet initialised */ -static EVP_MD *known_digest_methods[OSSL_NELEM(digest_data)] = { NULL, }; -static int selected_digests[OSSL_NELEM(digest_data)]; -static struct driver_info_st digest_driver_info[OSSL_NELEM(digest_data)]; - -static int devcrypto_test_digest(size_t digest_data_index) -{ - return (digest_driver_info[digest_data_index].status == DEVCRYPTO_STATUS_USABLE - && selected_digests[digest_data_index] == 1 - && (digest_driver_info[digest_data_index].accelerated - == DEVCRYPTO_ACCELERATED - || use_softdrivers == DEVCRYPTO_USE_SOFTWARE - || (digest_driver_info[digest_data_index].accelerated - != DEVCRYPTO_NOT_ACCELERATED - && use_softdrivers == DEVCRYPTO_REJECT_SOFTWARE))); -} - -static void rebuild_known_digest_nids(ENGINE *e) -{ - size_t i; - - for (i = 0, known_digest_nids_amount = 0; i < OSSL_NELEM(digest_data); i++) { - if (devcrypto_test_digest(i)) - known_digest_nids[known_digest_nids_amount++] = digest_data[i].nid; - } - ENGINE_unregister_digests(e); - ENGINE_register_digests(e); -} - -static void prepare_digest_methods(void) -{ - size_t i; - session_op_t sess1, sess2; -#ifdef CIOCGSESSINFO - struct session_info_op siop; -#endif - struct cphash_op cphash; - - memset(&digest_driver_info, 0, sizeof(digest_driver_info)); - - memset(&sess1, 0, sizeof(sess1)); - memset(&sess2, 0, sizeof(sess2)); - - for (i = 0, known_digest_nids_amount = 0; i < OSSL_NELEM(digest_data); - i++) { - - selected_digests[i] = 1; - - /* - * Check that the digest is usable - */ - sess1.mac = digest_data[i].devcryptoid; - sess2.ses = 0; - if (ioctl(cfd, CIOCGSESSION, &sess1) < 0) { - digest_driver_info[i].status = DEVCRYPTO_STATUS_NO_CIOCGSESSION; - goto finish; - } - -#ifdef CIOCGSESSINFO - /* gather hardware acceleration info from the driver */ - siop.ses = sess1.ses; - if (ioctl(cfd, CIOCGSESSINFO, &siop) < 0) { - digest_driver_info[i].accelerated = DEVCRYPTO_ACCELERATION_UNKNOWN; - } else { - digest_driver_info[i].driver_name = - OPENSSL_strndup(siop.hash_info.cra_driver_name, - CRYPTODEV_MAX_ALG_NAME); - if (siop.flags & SIOP_FLAG_KERNEL_DRIVER_ONLY) - digest_driver_info[i].accelerated = DEVCRYPTO_ACCELERATED; - else - digest_driver_info[i].accelerated = DEVCRYPTO_NOT_ACCELERATED; - } -#endif - - /* digest must be capable of hash state copy */ - sess2.mac = sess1.mac; - if (ioctl(cfd, CIOCGSESSION, &sess2) < 0) { - digest_driver_info[i].status = DEVCRYPTO_STATUS_FAILURE; - goto finish; - } - cphash.src_ses = sess1.ses; - cphash.dst_ses = sess2.ses; - if (ioctl(cfd, CIOCCPHASH, &cphash) < 0) { - digest_driver_info[i].status = DEVCRYPTO_STATUS_NO_CIOCCPHASH; - goto finish; - } - if ((known_digest_methods[i] = EVP_MD_meth_new(digest_data[i].nid, - NID_undef)) == NULL - || !EVP_MD_meth_set_input_blocksize(known_digest_methods[i], - digest_data[i].blocksize) - || !EVP_MD_meth_set_result_size(known_digest_methods[i], - digest_data[i].digestlen) - || !EVP_MD_meth_set_init(known_digest_methods[i], digest_init) - || !EVP_MD_meth_set_update(known_digest_methods[i], digest_update) - || !EVP_MD_meth_set_final(known_digest_methods[i], digest_final) - || !EVP_MD_meth_set_copy(known_digest_methods[i], digest_copy) - || !EVP_MD_meth_set_cleanup(known_digest_methods[i], digest_cleanup) - || !EVP_MD_meth_set_app_datasize(known_digest_methods[i], - sizeof(struct digest_ctx))) { - digest_driver_info[i].status = DEVCRYPTO_STATUS_FAILURE; - EVP_MD_meth_free(known_digest_methods[i]); - known_digest_methods[i] = NULL; - goto finish; - } - digest_driver_info[i].status = DEVCRYPTO_STATUS_USABLE; -finish: - ioctl(cfd, CIOCFSESSION, &sess1.ses); - if (sess2.ses != 0) - ioctl(cfd, CIOCFSESSION, &sess2.ses); - if (devcrypto_test_digest(i)) - known_digest_nids[known_digest_nids_amount++] = digest_data[i].nid; - } -} - -static const EVP_MD *get_digest_method(int nid) -{ - size_t i = get_digest_data_index(nid); - - if (i == (size_t)-1) - return NULL; - return known_digest_methods[i]; -} - -static int get_digest_nids(const int **nids) -{ - *nids = known_digest_nids; - return known_digest_nids_amount; -} - -static void destroy_digest_method(int nid) -{ - size_t i = get_digest_data_index(nid); - - EVP_MD_meth_free(known_digest_methods[i]); - known_digest_methods[i] = NULL; -} - -static void destroy_all_digest_methods(void) -{ - size_t i; - - for (i = 0; i < OSSL_NELEM(digest_data); i++) { - destroy_digest_method(digest_data[i].nid); - OPENSSL_free(digest_driver_info[i].driver_name); - digest_driver_info[i].driver_name = NULL; - } -} - -static int devcrypto_digests(ENGINE *e, const EVP_MD **digest, - const int **nids, int nid) -{ - if (digest == NULL) - return get_digest_nids(nids); - - *digest = get_digest_method(nid); - - return *digest != NULL; -} - -static void devcrypto_select_all_digests(int *digest_list) -{ - size_t i; - - for (i = 0; i < OSSL_NELEM(digest_data); i++) - digest_list[i] = 1; -} - -static int cryptodev_select_digest_cb(const char *str, int len, void *usr) -{ - int *digest_list = (int *)usr; - char *name; - const EVP_MD *EVP; - size_t i; - - if (len == 0) - return 1; - if (usr == NULL || (name = OPENSSL_strndup(str, len)) == NULL) - return 0; - EVP = EVP_get_digestbyname(name); - if (EVP == NULL) - fprintf(stderr, "devcrypto: unknown digest %s\n", name); - else if ((i = find_digest_data_index(EVP_MD_get_type(EVP))) != (size_t)-1) - digest_list[i] = 1; - else - fprintf(stderr, "devcrypto: digest %s not available\n", name); - OPENSSL_free(name); - return 1; -} - -static void dump_digest_info(void) -{ - size_t i; - const char *name; - - fprintf (stderr, "Information about digests supported by the /dev/crypto" - " engine:\n"); -#ifndef CIOCGSESSINFO - fprintf(stderr, "CIOCGSESSINFO (session info call) unavailable\n"); -#endif - - for (i = 0; i < OSSL_NELEM(digest_data); i++) { - name = OBJ_nid2sn(digest_data[i].nid); - fprintf (stderr, "Digest %s, NID=%d, /dev/crypto info: id=%d, driver=%s", - name ? name : "unknown", digest_data[i].nid, - digest_data[i].devcryptoid, - digest_driver_info[i].driver_name ? digest_driver_info[i].driver_name : "unknown"); - if (digest_driver_info[i].status == DEVCRYPTO_STATUS_NO_CIOCGSESSION) { - fprintf (stderr, ". CIOCGSESSION (session open) failed\n"); - continue; - } - if (digest_driver_info[i].accelerated == DEVCRYPTO_ACCELERATED) - fprintf(stderr, " (hw accelerated)"); - else if (digest_driver_info[i].accelerated == DEVCRYPTO_NOT_ACCELERATED) - fprintf(stderr, " (software)"); - else - fprintf(stderr, " (acceleration status unknown)"); - if (cipher_driver_info[i].status == DEVCRYPTO_STATUS_FAILURE) - fprintf (stderr, ". Cipher setup failed\n"); - else if (digest_driver_info[i].status == DEVCRYPTO_STATUS_NO_CIOCCPHASH) - fprintf(stderr, ", CIOCCPHASH failed\n"); - else - fprintf(stderr, ", CIOCCPHASH capable\n"); - } - fprintf(stderr, "\n"); -} - -#endif - -/****************************************************************************** - * - * CONTROL COMMANDS - * - *****/ - -#define DEVCRYPTO_CMD_USE_SOFTDRIVERS ENGINE_CMD_BASE -#define DEVCRYPTO_CMD_CIPHERS (ENGINE_CMD_BASE + 1) -#define DEVCRYPTO_CMD_DIGESTS (ENGINE_CMD_BASE + 2) -#define DEVCRYPTO_CMD_DUMP_INFO (ENGINE_CMD_BASE + 3) - -static const ENGINE_CMD_DEFN devcrypto_cmds[] = { -#if defined(CIOCGSESSINFO) || defined(CIOCGSESSION2) - {DEVCRYPTO_CMD_USE_SOFTDRIVERS, - "USE_SOFTDRIVERS", - "specifies whether to use software (not accelerated) drivers (" - OPENSSL_MSTR(DEVCRYPTO_REQUIRE_ACCELERATED) "=use only accelerated drivers, " - OPENSSL_MSTR(DEVCRYPTO_USE_SOFTWARE) "=allow all drivers, " - OPENSSL_MSTR(DEVCRYPTO_REJECT_SOFTWARE) - "=use if acceleration can't be determined) [default=" - OPENSSL_MSTR(DEVCRYPTO_DEFAULT_USE_SOFTDRIVERS) "]", - ENGINE_CMD_FLAG_NUMERIC}, -#endif - - {DEVCRYPTO_CMD_CIPHERS, - "CIPHERS", - "either ALL, NONE, or a comma-separated list of ciphers to enable [default=ALL]", - ENGINE_CMD_FLAG_STRING}, - -#ifdef IMPLEMENT_DIGEST - {DEVCRYPTO_CMD_DIGESTS, - "DIGESTS", - "either ALL, NONE, or a comma-separated list of digests to enable [default=ALL]", - ENGINE_CMD_FLAG_STRING}, -#endif - - {DEVCRYPTO_CMD_DUMP_INFO, - "DUMP_INFO", - "dump info about each algorithm to stderr; use 'openssl engine -pre DUMP_INFO devcrypto'", - ENGINE_CMD_FLAG_NO_INPUT}, - - {0, NULL, NULL, 0} -}; - -static int devcrypto_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f) (void)) -{ - int *new_list; - switch (cmd) { -#if defined(CIOCGSESSINFO) || defined(CIOCGSESSION2) - case DEVCRYPTO_CMD_USE_SOFTDRIVERS: - switch (i) { - case DEVCRYPTO_REQUIRE_ACCELERATED: - case DEVCRYPTO_USE_SOFTWARE: - case DEVCRYPTO_REJECT_SOFTWARE: - break; - default: - fprintf(stderr, "devcrypto: invalid value (%ld) for USE_SOFTDRIVERS\n", i); - return 0; - } - if (use_softdrivers == i) - return 1; - use_softdrivers = i; -#ifdef IMPLEMENT_DIGEST - rebuild_known_digest_nids(e); -#endif - rebuild_known_cipher_nids(e); - return 1; -#endif /* CIOCGSESSINFO || CIOCGSESSION2 */ - - case DEVCRYPTO_CMD_CIPHERS: - if (p == NULL) - return 1; - if (OPENSSL_strcasecmp((const char *)p, "ALL") == 0) { - devcrypto_select_all_ciphers(selected_ciphers); - } else if (OPENSSL_strcasecmp((const char*)p, "NONE") == 0) { - memset(selected_ciphers, 0, sizeof(selected_ciphers)); - } else { - new_list=OPENSSL_zalloc(sizeof(selected_ciphers)); - if (!CONF_parse_list(p, ',', 1, cryptodev_select_cipher_cb, new_list)) { - OPENSSL_free(new_list); - return 0; - } - memcpy(selected_ciphers, new_list, sizeof(selected_ciphers)); - OPENSSL_free(new_list); - } - rebuild_known_cipher_nids(e); - return 1; - -#ifdef IMPLEMENT_DIGEST - case DEVCRYPTO_CMD_DIGESTS: - if (p == NULL) - return 1; - if (OPENSSL_strcasecmp((const char *)p, "ALL") == 0) { - devcrypto_select_all_digests(selected_digests); - } else if (OPENSSL_strcasecmp((const char*)p, "NONE") == 0) { - memset(selected_digests, 0, sizeof(selected_digests)); - } else { - new_list=OPENSSL_zalloc(sizeof(selected_digests)); - if (!CONF_parse_list(p, ',', 1, cryptodev_select_digest_cb, new_list)) { - OPENSSL_free(new_list); - return 0; - } - memcpy(selected_digests, new_list, sizeof(selected_digests)); - OPENSSL_free(new_list); - } - rebuild_known_digest_nids(e); - return 1; -#endif /* IMPLEMENT_DIGEST */ - - case DEVCRYPTO_CMD_DUMP_INFO: - dump_cipher_info(); -#ifdef IMPLEMENT_DIGEST - dump_digest_info(); -#endif - return 1; - - default: - break; - } - return 0; -} - -/****************************************************************************** - * - * LOAD / UNLOAD - * - *****/ - -/* - * Opens /dev/crypto - */ -static int open_devcrypto(void) -{ - int fd; - - if (cfd >= 0) - return 1; - - if ((fd = open("/dev/crypto", O_RDWR, 0)) < 0) { -#ifndef ENGINE_DEVCRYPTO_DEBUG - if (errno != ENOENT && errno != ENXIO) -#endif - fprintf(stderr, "Could not open /dev/crypto: %s\n", strerror(errno)); - return 0; - } - -#ifdef CRIOGET - if (ioctl(fd, CRIOGET, &cfd) < 0) { - fprintf(stderr, "Could not create crypto fd: %s\n", strerror(errno)); - close(fd); - cfd = -1; - return 0; - } - close(fd); -#else - cfd = fd; -#endif - - return 1; -} - -static int close_devcrypto(void) -{ - int ret; - - if (cfd < 0) - return 1; - ret = close(cfd); - cfd = -1; - if (ret != 0) { - fprintf(stderr, "Error closing /dev/crypto: %s\n", strerror(errno)); - return 0; - } - return 1; -} - -static int devcrypto_unload(ENGINE *e) -{ - destroy_all_cipher_methods(); -#ifdef IMPLEMENT_DIGEST - destroy_all_digest_methods(); -#endif - - close_devcrypto(); - - return 1; -} - -static int bind_devcrypto(ENGINE *e) { - - if (!ENGINE_set_id(e, engine_devcrypto_id) - || !ENGINE_set_name(e, "/dev/crypto engine") - || !ENGINE_set_destroy_function(e, devcrypto_unload) - || !ENGINE_set_cmd_defns(e, devcrypto_cmds) - || !ENGINE_set_ctrl_function(e, devcrypto_ctrl)) - return 0; - - prepare_cipher_methods(); -#ifdef IMPLEMENT_DIGEST - prepare_digest_methods(); -#endif - - return (ENGINE_set_ciphers(e, devcrypto_ciphers) -#ifdef IMPLEMENT_DIGEST - && ENGINE_set_digests(e, devcrypto_digests) -#endif -/* - * Asymmetric ciphers aren't well supported with /dev/crypto. Among the BSD - * implementations, it seems to only exist in FreeBSD, and regarding the - * parameters in its crypt_kop, the manual crypto(4) has this to say: - * - * The semantics of these arguments are currently undocumented. - * - * Reading through the FreeBSD source code doesn't give much more than - * their CRK_MOD_EXP implementation for ubsec. - * - * It doesn't look much better with cryptodev-linux. They have the crypt_kop - * structure as well as the command (CRK_*) in cryptodev.h, but no support - * seems to be implemented at all for the moment. - * - * At the time of writing, it seems impossible to write proper support for - * FreeBSD's asym features without some very deep knowledge and access to - * specific kernel modules. - * - * /Richard Levitte, 2017-05-11 - */ -#if 0 - && ENGINE_set_RSA(e, devcrypto_rsa) -# ifndef OPENSSL_NO_DSA - && ENGINE_set_DSA(e, devcrypto_dsa) -# endif -# ifndef OPENSSL_NO_DH - && ENGINE_set_DH(e, devcrypto_dh) -# endif -# ifndef OPENSSL_NO_EC - && ENGINE_set_EC(e, devcrypto_ec) -# endif -#endif - ); -} - -#ifdef OPENSSL_NO_DYNAMIC_ENGINE -/* - * In case this engine is built into libcrypto, then it doesn't offer any - * ability to be dynamically loadable. - */ -void engine_load_devcrypto_int(void) -{ - ENGINE *e = NULL; - - if (!open_devcrypto()) - return; - - if ((e = ENGINE_new()) == NULL - || !bind_devcrypto(e)) { - close_devcrypto(); - ENGINE_free(e); - return; - } - - ERR_set_mark(); - ENGINE_add(e); - /* - * If the "add" worked, it gets a structural reference. So either way, we - * release our just-created reference. - */ - ENGINE_free(e); /* Loose our local reference */ - /* - * If the "add" didn't work, it was probably a conflict because it was - * already added (eg. someone calling ENGINE_load_blah then calling - * ENGINE_load_builtin_engines() perhaps). - */ - ERR_pop_to_mark(); -} - -#else - -static int bind_helper(ENGINE *e, const char *id) -{ - if ((id && (strcmp(id, engine_devcrypto_id) != 0)) - || !open_devcrypto()) - return 0; - if (!bind_devcrypto(e)) { - close_devcrypto(); - return 0; - } - return 1; -} - -IMPLEMENT_DYNAMIC_CHECK_FN() -IMPLEMENT_DYNAMIC_BIND_FN(bind_helper) - -#endif diff --git a/engines/e_loader_attic.c b/engines/e_loader_attic.c deleted file mode 100644 index e7597c54ef..0000000000 --- a/engines/e_loader_attic.c +++ /dev/null @@ -1,1758 +0,0 @@ -/* - * Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* THIS ENGINE IS FOR TESTING PURPOSES ONLY. */ - -/* This file has quite some overlap with providers/implementations/storemgmt/file_store.c */ - -/* - * We need to use some asn1_meth deprecated APIs - */ -#define OPENSSL_SUPPRESS_DEPRECATED - -#include "internal/e_os.h" /* for stat */ -#include -#include -#include -#include - -#include -#include /* For d2i_DSAPrivateKey */ -#include -#include -#include -#include /* For the PKCS8 stuff o.O */ -#include /* For d2i_RSAPrivateKey */ -#include -#include -#include -#include -#include /* For the PKCS8 stuff o.O */ -#include "internal/asn1.h" /* For asn1_d2i_read_bio */ -#include "internal/o_dir.h" -#include "internal/cryptlib.h" -#include "crypto/ctype.h" /* For ossl_isdigit */ -#include "crypto/pem.h" /* For PVK and "blob" PEM headers */ - -/* clang-format off */ -#include "e_loader_attic_err.c" -/* clang-format on */ - -DEFINE_STACK_OF(OSSL_STORE_INFO) - -#ifndef S_ISDIR -# define S_ISDIR(a) (((a) & S_IFMT) == S_IFDIR) -#endif - -/*- - * Password prompting - * ------------------ - */ - -static char *file_get_pass(const UI_METHOD *ui_method, char *pass, - size_t maxsize, const char *desc, const char *info, - void *data) -{ - UI *ui = UI_new(); - char *prompt = NULL; - - if (ui == NULL) { - ATTICerr(0, ERR_R_UI_LIB); - return NULL; - } - - if (ui_method != NULL) - UI_set_method(ui, ui_method); - UI_add_user_data(ui, data); - - if ((prompt = UI_construct_prompt(ui, desc, info)) == NULL) { - ATTICerr(0, ERR_R_UI_LIB); - pass = NULL; - } else if (UI_add_input_string(ui, prompt, UI_INPUT_FLAG_DEFAULT_PWD, - pass, 0, (int)(maxsize - 1)) <= 0) { - ATTICerr(0, ERR_R_UI_LIB); - pass = NULL; - } else { - switch (UI_process(ui)) { - case -2: - ATTICerr(0, ATTIC_R_UI_PROCESS_INTERRUPTED_OR_CANCELLED); - pass = NULL; - break; - case -1: - ATTICerr(0, ERR_R_UI_LIB); - pass = NULL; - break; - default: - break; - } - } - - OPENSSL_free(prompt); - UI_free(ui); - return pass; -} - -struct pem_pass_data { - const UI_METHOD *ui_method; - void *data; - const char *prompt_desc; - const char *prompt_info; -}; - -static int file_fill_pem_pass_data(struct pem_pass_data *pass_data, - const char *desc, const char *info, - const UI_METHOD *ui_method, void *ui_data) -{ - if (pass_data == NULL) - return 0; - pass_data->ui_method = ui_method; - pass_data->data = ui_data; - pass_data->prompt_desc = desc; - pass_data->prompt_info = info; - return 1; -} - -/* This is used anywhere a pem_password_cb is needed */ -static int file_get_pem_pass(char *buf, int num, int w, void *data) -{ - struct pem_pass_data *pass_data = data; - char *pass = file_get_pass(pass_data->ui_method, buf, num, - pass_data->prompt_desc, pass_data->prompt_info, - pass_data->data); - - return pass == NULL ? 0 : (int)strlen(pass); -} - -/* - * Check if |str| ends with |suffix| preceded by a space, and if it does, - * return the index of that space. If there is no such suffix in |str|, - * return -1. - * For |str| == "FOO BAR" and |suffix| == "BAR", the returned value is 3. - */ -static int check_suffix(const char *str, const char *suffix) -{ - int str_len = (int)strlen(str); - int suffix_len = (int)(strlen(suffix) + 1); - const char *p = NULL; - - if (suffix_len >= str_len) - return -1; - p = str + str_len - suffix_len; - if (*p != ' ' - || strcmp(p + 1, suffix) != 0) - return -1; - return (int)(p - str); -} - -/* - * EMBEDDED is a special type of OSSL_STORE_INFO, specially for the file - * handlers, so we define it internally. This uses the possibility to - * create an OSSL_STORE_INFO with a generic data pointer and arbitrary - * type number. - * - * This is used by a FILE_HANDLER's try_decode function to signal that it - * has decoded the incoming blob into a new blob, and that the attempted - * decoding should be immediately restarted with the new blob, using the - * new PEM name. - */ -/* Negative numbers are never used for public OSSL_STORE_INFO types */ -#define STORE_INFO_EMBEDDED -1 - -/* This is the embedded data */ -struct embedded_st { - BUF_MEM *blob; - char *pem_name; -}; - -/* Helper functions */ -static struct embedded_st *get0_EMBEDDED(OSSL_STORE_INFO *info) -{ - return OSSL_STORE_INFO_get0_data(STORE_INFO_EMBEDDED, info); -} - -static void store_info_free(OSSL_STORE_INFO *info) -{ - struct embedded_st *data; - - if (info != NULL && (data = get0_EMBEDDED(info)) != NULL) { - BUF_MEM_free(data->blob); - OPENSSL_free(data->pem_name); - OPENSSL_free(data); - } - OSSL_STORE_INFO_free(info); -} - -static OSSL_STORE_INFO *new_EMBEDDED(const char *new_pem_name, - BUF_MEM *embedded) -{ - OSSL_STORE_INFO *info = NULL; - struct embedded_st *data = NULL; - - if ((data = OPENSSL_zalloc(sizeof(*data))) == NULL) - return NULL; - if ((info = OSSL_STORE_INFO_new(STORE_INFO_EMBEDDED, data)) == NULL) { - ATTICerr(0, ERR_R_OSSL_STORE_LIB); - OPENSSL_free(data); - return NULL; - } - - data->blob = embedded; - data->pem_name = - new_pem_name == NULL ? NULL : OPENSSL_strdup(new_pem_name); - - if (new_pem_name != NULL && data->pem_name == NULL) { - store_info_free(info); - info = NULL; - } - - return info; -} - -/*- - * The file scheme decoders - * ------------------------ - * - * Each possible data type has its own decoder, which either operates - * through a given PEM name, or attempts to decode to see if the blob - * it's given is decodable for its data type. The assumption is that - * only the correct data type will match the content. - */ - -/*- - * The try_decode function is called to check if the blob of data can - * be used by this handler, and if it can, decodes it into a supported - * OpenSSL type and returns an OSSL_STORE_INFO with the decoded data. - * Input: - * pem_name: If this blob comes from a PEM file, this holds - * the PEM name. If it comes from another type of - * file, this is NULL. - * pem_header: If this blob comes from a PEM file, this holds - * the PEM headers. If it comes from another type of - * file, this is NULL. - * blob: The blob of data to match with what this handler - * can use. - * len: The length of the blob. - * handler_ctx: For a handler marked repeatable, this pointer can - * be used to create a context for the handler. IT IS - * THE HANDLER'S RESPONSIBILITY TO CREATE AND DESTROY - * THIS CONTEXT APPROPRIATELY, i.e. create on first call - * and destroy when about to return NULL. - * matchcount: A pointer to an int to count matches for this data. - * Usually becomes 0 (no match) or 1 (match!), but may - * be higher in the (unlikely) event that the data matches - * more than one possibility. The int will always be - * zero when the function is called. - * ui_method: Application UI method for getting a password, pin - * or any other interactive data. - * ui_data: Application data to be passed to ui_method when - * it's called. - * libctx: The library context to be used if applicable - * propq: The property query string for any algorithm fetches - * Output: - * an OSSL_STORE_INFO - */ -typedef OSSL_STORE_INFO *(*file_try_decode_fn)(const char *pem_name, - const char *pem_header, - const unsigned char *blob, - size_t len, void **handler_ctx, - int *matchcount, - const UI_METHOD *ui_method, - void *ui_data, const char *uri, - OSSL_LIB_CTX *libctx, - const char *propq); -/* - * The eof function should return 1 if there's no more data to be found - * with the handler_ctx, otherwise 0. This is only used when the handler is - * marked repeatable. - */ -typedef int (*file_eof_fn)(void *handler_ctx); -/* - * The destroy_ctx function is used to destroy the handler_ctx that was - * initiated by a repeatable try_decode function. This is only used when - * the handler is marked repeatable. - */ -typedef void (*file_destroy_ctx_fn)(void **handler_ctx); - -typedef struct file_handler_st { - const char *name; - file_try_decode_fn try_decode; - file_eof_fn eof; - file_destroy_ctx_fn destroy_ctx; - - /* flags */ - int repeatable; -} FILE_HANDLER; - -/* - * PKCS#12 decoder. It operates by decoding all of the blob content, - * extracting all the interesting data from it and storing them internally, - * then serving them one piece at a time. - */ -static OSSL_STORE_INFO *try_decode_PKCS12(const char *pem_name, - const char *pem_header, - const unsigned char *blob, - size_t len, void **pctx, - int *matchcount, - const UI_METHOD *ui_method, - void *ui_data, const char *uri, - OSSL_LIB_CTX *libctx, - const char *propq) -{ - OSSL_STORE_INFO *store_info = NULL; - STACK_OF(OSSL_STORE_INFO) *ctx = *pctx; - - if (ctx == NULL) { - /* Initial parsing */ - PKCS12 *p12; - - if (pem_name != NULL || len > LONG_MAX) - /* No match, there is no PEM PKCS12 tag */ - return NULL; - - if ((p12 = d2i_PKCS12(NULL, &blob, (long)len)) != NULL) { - char *pass = NULL; - char tpass[PEM_BUFSIZE]; - EVP_PKEY *pkey = NULL; - X509 *cert = NULL; - STACK_OF(X509) *chain = NULL; - - *matchcount = 1; - - if (!PKCS12_mac_present(p12) - || PKCS12_verify_mac(p12, "", 0) - || PKCS12_verify_mac(p12, NULL, 0)) { - pass = ""; - } else { - if ((pass = file_get_pass(ui_method, tpass, PEM_BUFSIZE, - "PKCS12 import", uri, - ui_data)) == NULL) { - ATTICerr(0, ATTIC_R_PASSPHRASE_CALLBACK_ERROR); - goto p12_end; - } - if (!PKCS12_verify_mac(p12, pass, (int)strlen(pass))) { - ATTICerr(0, ATTIC_R_ERROR_VERIFYING_PKCS12_MAC); - goto p12_end; - } - } - - if (PKCS12_parse(p12, pass, &pkey, &cert, &chain)) { - OSSL_STORE_INFO *osi_pkey = NULL; - OSSL_STORE_INFO *osi_cert = NULL; - OSSL_STORE_INFO *osi_ca = NULL; - int ok = 1; - - if ((ctx = sk_OSSL_STORE_INFO_new_null()) != NULL) { - if (pkey != NULL) { - if ((osi_pkey = OSSL_STORE_INFO_new_PKEY(pkey)) != NULL - /* clearing pkey here avoids case distinctions */ - && (pkey = NULL) == NULL - && sk_OSSL_STORE_INFO_push(ctx, osi_pkey) != 0) - osi_pkey = NULL; - else - ok = 0; - } - if (ok && cert != NULL) { - if ((osi_cert = OSSL_STORE_INFO_new_CERT(cert)) != NULL - /* clearing cert here avoids case distinctions */ - && (cert = NULL) == NULL - && sk_OSSL_STORE_INFO_push(ctx, osi_cert) != 0) - osi_cert = NULL; - else - ok = 0; - } - while (ok && sk_X509_num(chain) > 0) { - X509 *ca = sk_X509_value(chain, 0); - - if ((osi_ca = OSSL_STORE_INFO_new_CERT(ca)) != NULL - && sk_X509_shift(chain) != NULL - && sk_OSSL_STORE_INFO_push(ctx, osi_ca) != 0) - osi_ca = NULL; - else - ok = 0; - } - } - EVP_PKEY_free(pkey); - X509_free(cert); - OSSL_STACK_OF_X509_free(chain); - store_info_free(osi_pkey); - store_info_free(osi_cert); - store_info_free(osi_ca); - if (!ok) { - sk_OSSL_STORE_INFO_pop_free(ctx, store_info_free); - ctx = NULL; - } - *pctx = ctx; - } - } - p12_end: - PKCS12_free(p12); - if (ctx == NULL) - return NULL; - } - - *matchcount = 1; - store_info = sk_OSSL_STORE_INFO_shift(ctx); - return store_info; -} - -static int eof_PKCS12(void *ctx_) -{ - STACK_OF(OSSL_STORE_INFO) *ctx = ctx_; - - return ctx == NULL || sk_OSSL_STORE_INFO_num(ctx) == 0; -} - -static void destroy_ctx_PKCS12(void **pctx) -{ - STACK_OF(OSSL_STORE_INFO) *ctx = *pctx; - - sk_OSSL_STORE_INFO_pop_free(ctx, store_info_free); - *pctx = NULL; -} - -static FILE_HANDLER PKCS12_handler = { - "PKCS12", - try_decode_PKCS12, - eof_PKCS12, - destroy_ctx_PKCS12, - 1 /* repeatable */ -}; - -/* - * Encrypted PKCS#8 decoder. It operates by just decrypting the given blob - * into a new blob, which is returned as an EMBEDDED STORE_INFO. The whole - * decoding process will then start over with the new blob. - */ -static OSSL_STORE_INFO *try_decode_PKCS8Encrypted(const char *pem_name, - const char *pem_header, - const unsigned char *blob, - size_t len, void **pctx, - int *matchcount, - const UI_METHOD *ui_method, - void *ui_data, - const char *uri, - OSSL_LIB_CTX *libctx, - const char *propq) -{ - X509_SIG *p8 = NULL; - char kbuf[PEM_BUFSIZE]; - char *pass = NULL; - const X509_ALGOR *dalg = NULL; - const ASN1_OCTET_STRING *doct = NULL; - OSSL_STORE_INFO *store_info = NULL; - BUF_MEM *mem = NULL; - unsigned char *new_data = NULL; - int new_data_len; - - if (pem_name != NULL) { - if (strcmp(pem_name, PEM_STRING_PKCS8) != 0) - return NULL; - *matchcount = 1; - } - - if (len > LONG_MAX || (p8 = d2i_X509_SIG(NULL, &blob, (long)len)) == NULL) - return NULL; - - *matchcount = 1; - - if ((mem = BUF_MEM_new()) == NULL) { - ATTICerr(0, ERR_R_BUF_LIB); - goto nop8; - } - - if ((pass = file_get_pass(ui_method, kbuf, PEM_BUFSIZE, - "PKCS8 decrypt pass phrase", uri, - ui_data)) == NULL) { - ATTICerr(0, ATTIC_R_BAD_PASSWORD_READ); - goto nop8; - } - - X509_SIG_get0(p8, &dalg, &doct); - if (!PKCS12_pbe_crypt(dalg, pass, (int)strlen(pass), - doct->data, doct->length, - &new_data, &new_data_len, 0)) - goto nop8; - - mem->data = (char *)new_data; - mem->max = mem->length = (size_t)new_data_len; - X509_SIG_free(p8); - p8 = NULL; - - store_info = new_EMBEDDED(PEM_STRING_PKCS8INF, mem); - if (store_info == NULL) { - ATTICerr(0, ERR_R_OSSL_STORE_LIB); - goto nop8; - } - - return store_info; - nop8: - X509_SIG_free(p8); - BUF_MEM_free(mem); - return NULL; -} - -static FILE_HANDLER PKCS8Encrypted_handler = { - "PKCS8Encrypted", - try_decode_PKCS8Encrypted -}; - -/* - * Private key decoder. Decodes all sorts of private keys, both PKCS#8 - * encoded ones and old style PEM ones (with the key type is encoded into - * the PEM name). - */ -static OSSL_STORE_INFO *try_decode_PrivateKey(const char *pem_name, - const char *pem_header, - const unsigned char *blob, - size_t len, void **pctx, - int *matchcount, - const UI_METHOD *ui_method, - void *ui_data, const char *uri, - OSSL_LIB_CTX *libctx, - const char *propq) -{ - OSSL_STORE_INFO *store_info = NULL; - EVP_PKEY *pkey = NULL; - const EVP_PKEY_ASN1_METHOD *ameth = NULL; - - if (len > LONG_MAX) - return NULL; - if (pem_name != NULL) { - if (strcmp(pem_name, PEM_STRING_PKCS8INF) == 0) { - PKCS8_PRIV_KEY_INFO *p8inf = - d2i_PKCS8_PRIV_KEY_INFO(NULL, &blob, (long)len); - - *matchcount = 1; - if (p8inf != NULL) - pkey = EVP_PKCS82PKEY_ex(p8inf, libctx, propq); - PKCS8_PRIV_KEY_INFO_free(p8inf); - } else { - int slen; - int pkey_id; - - if ((slen = check_suffix(pem_name, "PRIVATE KEY")) > 0 - && (ameth = EVP_PKEY_asn1_find_str(NULL, pem_name, - slen)) != NULL - && EVP_PKEY_asn1_get0_info(&pkey_id, NULL, NULL, NULL, NULL, - ameth)) { - *matchcount = 1; - pkey = d2i_PrivateKey_ex(pkey_id, NULL, &blob, (long)len, - libctx, propq); - } - } - } else { - int i; -#ifndef OPENSSL_NO_ENGINE - ENGINE *curengine = ENGINE_get_first(); - - while (curengine != NULL) { - ENGINE_PKEY_ASN1_METHS_PTR asn1meths = - ENGINE_get_pkey_asn1_meths(curengine); - - if (asn1meths != NULL) { - const int *nids = NULL; - int nids_n = asn1meths(curengine, NULL, &nids, 0); - - for (i = 0; i < nids_n; i++) { - EVP_PKEY_ASN1_METHOD *ameth2 = NULL; - EVP_PKEY *tmp_pkey = NULL; - const unsigned char *tmp_blob = blob; - int pkey_id, pkey_flags; - - if (!asn1meths(curengine, &ameth2, NULL, nids[i]) - || !EVP_PKEY_asn1_get0_info(&pkey_id, NULL, - &pkey_flags, NULL, NULL, - ameth2) - || (pkey_flags & ASN1_PKEY_ALIAS) != 0) - continue; - - ERR_set_mark(); /* prevent flooding error queue */ - tmp_pkey = d2i_PrivateKey_ex(pkey_id, NULL, - &tmp_blob, (long)len, - libctx, propq); - if (tmp_pkey != NULL) { - if (pkey != NULL) - EVP_PKEY_free(tmp_pkey); - else - pkey = tmp_pkey; - (*matchcount)++; - } - ERR_pop_to_mark(); - } - } - curengine = ENGINE_get_next(curengine); - } -#endif - - for (i = 0; i < EVP_PKEY_asn1_get_count(); i++) { - EVP_PKEY *tmp_pkey = NULL; - const unsigned char *tmp_blob = blob; - int pkey_id, pkey_flags; - - ameth = EVP_PKEY_asn1_get0(i); - if (!EVP_PKEY_asn1_get0_info(&pkey_id, NULL, &pkey_flags, NULL, - NULL, ameth) - || (pkey_flags & ASN1_PKEY_ALIAS) != 0) - continue; - - ERR_set_mark(); /* prevent flooding error queue */ - tmp_pkey = d2i_PrivateKey_ex(pkey_id, NULL, &tmp_blob, (long)len, - libctx, propq); - if (tmp_pkey != NULL) { - if (pkey != NULL) - EVP_PKEY_free(tmp_pkey); - else - pkey = tmp_pkey; - (*matchcount)++; - } - ERR_pop_to_mark(); - } - - if (*matchcount > 1) { - EVP_PKEY_free(pkey); - pkey = NULL; - } - } - if (pkey == NULL) - /* No match */ - return NULL; - - store_info = OSSL_STORE_INFO_new_PKEY(pkey); - if (store_info == NULL) - EVP_PKEY_free(pkey); - - return store_info; -} - -static FILE_HANDLER PrivateKey_handler = { - "PrivateKey", - try_decode_PrivateKey -}; - -/* - * Public key decoder. Only supports SubjectPublicKeyInfo formatted keys. - */ -static OSSL_STORE_INFO *try_decode_PUBKEY(const char *pem_name, - const char *pem_header, - const unsigned char *blob, - size_t len, void **pctx, - int *matchcount, - const UI_METHOD *ui_method, - void *ui_data, const char *uri, - OSSL_LIB_CTX *libctx, - const char *propq) -{ - OSSL_STORE_INFO *store_info = NULL; - EVP_PKEY *pkey = NULL; - - if (pem_name != NULL) { - if (strcmp(pem_name, PEM_STRING_PUBLIC) != 0) - /* No match */ - return NULL; - *matchcount = 1; - } - - if (len > LONG_MAX || (pkey = d2i_PUBKEY(NULL, &blob, (long)len)) != NULL) { - *matchcount = 1; - store_info = OSSL_STORE_INFO_new_PUBKEY(pkey); - } - - return store_info; -} - -static FILE_HANDLER PUBKEY_handler = { - "PUBKEY", - try_decode_PUBKEY -}; - -/* - * Key parameter decoder. - */ -static OSSL_STORE_INFO *try_decode_params(const char *pem_name, - const char *pem_header, - const unsigned char *blob, - size_t len, void **pctx, - int *matchcount, - const UI_METHOD *ui_method, - void *ui_data, const char *uri, - OSSL_LIB_CTX *libctx, - const char *propq) -{ - OSSL_STORE_INFO *store_info = NULL; - EVP_PKEY *pkey = NULL; - const EVP_PKEY_ASN1_METHOD *ameth = NULL; - - if (len > LONG_MAX) - return NULL; - if (pem_name != NULL) { - int slen; - int pkey_id; - - if ((slen = check_suffix(pem_name, "PARAMETERS")) > 0 - && (ameth = EVP_PKEY_asn1_find_str(NULL, pem_name, slen)) != NULL - && EVP_PKEY_asn1_get0_info(&pkey_id, NULL, NULL, NULL, NULL, - ameth)) { - *matchcount = 1; - pkey = d2i_KeyParams(pkey_id, NULL, &blob, (long)len); - } - } else { - int i; - - for (i = 0; i < EVP_PKEY_asn1_get_count(); i++) { - EVP_PKEY *tmp_pkey = NULL; - const unsigned char *tmp_blob = blob; - int pkey_id, pkey_flags; - - ameth = EVP_PKEY_asn1_get0(i); - if (!EVP_PKEY_asn1_get0_info(&pkey_id, NULL, &pkey_flags, NULL, - NULL, ameth) - || (pkey_flags & ASN1_PKEY_ALIAS) != 0) - continue; - - ERR_set_mark(); /* prevent flooding error queue */ - - tmp_pkey = d2i_KeyParams(pkey_id, NULL, &tmp_blob, (long)len); - - if (tmp_pkey != NULL) { - if (pkey != NULL) - EVP_PKEY_free(tmp_pkey); - else - pkey = tmp_pkey; - (*matchcount)++; - } - ERR_pop_to_mark(); - } - - if (*matchcount > 1) { - EVP_PKEY_free(pkey); - pkey = NULL; - } - } - if (pkey == NULL) - /* No match */ - return NULL; - - store_info = OSSL_STORE_INFO_new_PARAMS(pkey); - if (store_info == NULL) - EVP_PKEY_free(pkey); - - return store_info; -} - -static FILE_HANDLER params_handler = { - "params", - try_decode_params -}; - -/* - * X.509 certificate decoder. - */ -static OSSL_STORE_INFO *try_decode_X509Certificate(const char *pem_name, - const char *pem_header, - const unsigned char *blob, - size_t len, void **pctx, - int *matchcount, - const UI_METHOD *ui_method, - void *ui_data, - const char *uri, - OSSL_LIB_CTX *libctx, - const char *propq) -{ - OSSL_STORE_INFO *store_info = NULL; - X509 *cert = NULL; - - /* - * In most cases, we can try to interpret the serialized data as a trusted - * cert (X509 + X509_AUX) and fall back to reading it as a normal cert - * (just X509), but if the PEM name specifically declares it as a trusted - * cert, then no fallback should be engaged. |ignore_trusted| tells if - * the fallback can be used (1) or not (0). - */ - int ignore_trusted = 1; - - if (len > LONG_MAX) - return NULL; - if (pem_name != NULL) { - if (strcmp(pem_name, PEM_STRING_X509_TRUSTED) == 0) - ignore_trusted = 0; - else if (strcmp(pem_name, PEM_STRING_X509_OLD) != 0 - && strcmp(pem_name, PEM_STRING_X509) != 0) - /* No match */ - return NULL; - *matchcount = 1; - } - - cert = X509_new_ex(libctx, propq); - if (cert == NULL) - return NULL; - - if ((d2i_X509_AUX(&cert, &blob, (long)len)) != NULL - || (ignore_trusted && (d2i_X509(&cert, &blob, (long)len)) != NULL)) { - *matchcount = 1; - store_info = OSSL_STORE_INFO_new_CERT(cert); - } - - if (store_info == NULL) - X509_free(cert); - - return store_info; -} - -static FILE_HANDLER X509Certificate_handler = { - "X509Certificate", - try_decode_X509Certificate -}; - -/* - * X.509 CRL decoder. - */ -static OSSL_STORE_INFO *try_decode_X509CRL(const char *pem_name, - const char *pem_header, - const unsigned char *blob, - size_t len, void **pctx, - int *matchcount, - const UI_METHOD *ui_method, - void *ui_data, const char *uri, - OSSL_LIB_CTX *libctx, - const char *propq) -{ - OSSL_STORE_INFO *store_info = NULL; - X509_CRL *crl = NULL; - - if (len > LONG_MAX) - return NULL; - if (pem_name != NULL) { - if (strcmp(pem_name, PEM_STRING_X509_CRL) != 0) - /* No match */ - return NULL; - *matchcount = 1; - } - - if ((crl = d2i_X509_CRL(NULL, &blob, (long)len)) != NULL) { - *matchcount = 1; - store_info = OSSL_STORE_INFO_new_CRL(crl); - } - - if (store_info == NULL) - X509_CRL_free(crl); - - return store_info; -} - -static FILE_HANDLER X509CRL_handler = { - "X509CRL", - try_decode_X509CRL -}; - -/* - * To finish it all off, we collect all the handlers. - */ -static const FILE_HANDLER *file_handlers[] = { - &PKCS12_handler, - &PKCS8Encrypted_handler, - &X509Certificate_handler, - &X509CRL_handler, - ¶ms_handler, - &PUBKEY_handler, - &PrivateKey_handler, -}; - - -/*- - * The loader itself - * ----------------- - */ - -struct ossl_store_loader_ctx_st { - char *uri; /* The URI we currently try to load */ - enum { - is_raw = 0, - is_pem, - is_dir - } type; - int errcnt; -#define FILE_FLAG_SECMEM (1<<0) -#define FILE_FLAG_ATTACHED (1<<1) - unsigned int flags; - union { - struct { /* Used with is_raw and is_pem */ - BIO *file; - - /* - * The following are used when the handler is marked as - * repeatable - */ - const FILE_HANDLER *last_handler; - void *last_handler_ctx; - } file; - struct { /* Used with is_dir */ - OPENSSL_DIR_CTX *ctx; - int end_reached; - - /* - * When a search expression is given, these are filled in. - * |search_name| contains the file basename to look for. - * The string is exactly 8 characters long. - */ - char search_name[9]; - - /* - * The directory reading utility we have combines opening with - * reading the first name. To make sure we can detect the end - * at the right time, we read early and cache the name. - */ - const char *last_entry; - int last_errno; - } dir; - } _; - - /* Expected object type. May be unspecified */ - int expected_type; - - OSSL_LIB_CTX *libctx; - char *propq; -}; - -static void OSSL_STORE_LOADER_CTX_free(OSSL_STORE_LOADER_CTX *ctx) -{ - if (ctx == NULL) - return; - - OPENSSL_free(ctx->propq); - OPENSSL_free(ctx->uri); - if (ctx->type != is_dir) { - if (ctx->_.file.last_handler != NULL) { - ctx->_.file.last_handler->destroy_ctx(&ctx->_.file.last_handler_ctx); - ctx->_.file.last_handler_ctx = NULL; - ctx->_.file.last_handler = NULL; - } - } - OPENSSL_free(ctx); -} - -static int file_find_type(OSSL_STORE_LOADER_CTX *ctx) -{ - BIO *buff = NULL; - char peekbuf[4096] = { 0, }; - - if ((buff = BIO_new(BIO_f_buffer())) == NULL) - return 0; - - ctx->_.file.file = BIO_push(buff, ctx->_.file.file); - if (BIO_buffer_peek(ctx->_.file.file, peekbuf, sizeof(peekbuf) - 1) > 0) { - peekbuf[sizeof(peekbuf) - 1] = '\0'; - if (strstr(peekbuf, "-----BEGIN ") != NULL) - ctx->type = is_pem; - } - return 1; -} - -static OSSL_STORE_LOADER_CTX *file_open_ex - (const OSSL_STORE_LOADER *loader, const char *uri, - OSSL_LIB_CTX *libctx, const char *propq, - const UI_METHOD *ui_method, void *ui_data) -{ - OSSL_STORE_LOADER_CTX *ctx = NULL; - struct stat st; - const char *path_data[2]; - size_t path_data_n = 0, i; - const char *path, *p = uri, *q; - - /* - * First step, just take the URI as is. - */ - path_data[path_data_n++] = uri; - - /* - * Second step, if the URI appears to start with the "file" scheme, - * extract the path and make that the second path to check. - * There's a special case if the URI also contains an authority, then - * the full URI shouldn't be used as a path anywhere. - */ - if (CHECK_AND_SKIP_CASE_PREFIX(p, "file:")) { - q = p; - if (CHECK_AND_SKIP_PREFIX(q, "//")) { - path_data_n--; /* Invalidate using the full URI */ - if (CHECK_AND_SKIP_CASE_PREFIX(q, "localhost/") - || CHECK_AND_SKIP_PREFIX(q, "/")) { - /* - * In this case, we step back on char to ensure that the - * first slash is preserved, making the path always absolute - */ - p = q - 1; - } else { - ATTICerr(0, ATTIC_R_URI_AUTHORITY_UNSUPPORTED); - return NULL; - } - } -#ifdef _WIN32 - /* Windows "file:" URIs with a drive letter start with a '/' */ - if (p[0] == '/' && p[2] == ':' && p[3] == '/') { - char c = tolower((unsigned char)p[1]); - - if (c >= 'a' && c <= 'z') { - /* Skip past the slash, making the path a normal Windows path */ - p++; - } - } -#endif - path_data[path_data_n++] = p; - } - - - for (i = 0, path = NULL; path == NULL && i < path_data_n; i++) { - if (stat(path_data[i], &st) < 0) { - ERR_raise_data(ERR_LIB_SYS, errno, - "calling stat(%s)", - path_data[i]); - } else { - path = path_data[i]; - } - } - if (path == NULL) { - return NULL; - } - - /* Successfully found a working path */ - - ctx = OPENSSL_zalloc(sizeof(*ctx)); - if (ctx == NULL) - return NULL; - ctx->uri = OPENSSL_strdup(uri); - if (ctx->uri == NULL) - goto err; - - if (S_ISDIR(st.st_mode)) { - ctx->type = is_dir; - ctx->_.dir.last_entry = OPENSSL_DIR_read(&ctx->_.dir.ctx, path); - ctx->_.dir.last_errno = errno; - if (ctx->_.dir.last_entry == NULL) { - if (ctx->_.dir.last_errno != 0) { - ERR_raise(ERR_LIB_SYS, ctx->_.dir.last_errno); - goto err; - } - ctx->_.dir.end_reached = 1; - } - } else if ((ctx->_.file.file = BIO_new_file(path, "rb")) == NULL - || !file_find_type(ctx)) { - BIO_free_all(ctx->_.file.file); - goto err; - } - if (propq != NULL) { - ctx->propq = OPENSSL_strdup(propq); - if (ctx->propq == NULL) - goto err; - } - ctx->libctx = libctx; - - return ctx; - err: - OSSL_STORE_LOADER_CTX_free(ctx); - return NULL; -} - -static OSSL_STORE_LOADER_CTX *file_open - (const OSSL_STORE_LOADER *loader, const char *uri, - const UI_METHOD *ui_method, void *ui_data) -{ - return file_open_ex(loader, uri, NULL, NULL, ui_method, ui_data); -} - -static OSSL_STORE_LOADER_CTX *file_attach - (const OSSL_STORE_LOADER *loader, BIO *bp, - OSSL_LIB_CTX *libctx, const char *propq, - const UI_METHOD *ui_method, void *ui_data) -{ - OSSL_STORE_LOADER_CTX *ctx = NULL; - - if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) == NULL - || (propq != NULL && (ctx->propq = OPENSSL_strdup(propq)) == NULL)) { - OSSL_STORE_LOADER_CTX_free(ctx); - return NULL; - } - ctx->libctx = libctx; - ctx->flags |= FILE_FLAG_ATTACHED; - ctx->_.file.file = bp; - if (!file_find_type(ctx)) { - /* Safety measure */ - ctx->_.file.file = NULL; - goto err; - } - return ctx; -err: - OSSL_STORE_LOADER_CTX_free(ctx); - return NULL; -} - -static int file_ctrl(OSSL_STORE_LOADER_CTX *ctx, int cmd, va_list args) -{ - int ret = 1; - - switch (cmd) { - case OSSL_STORE_C_USE_SECMEM: - { - int on = *(va_arg(args, int *)); - - switch (on) { - case 0: - ctx->flags &= ~FILE_FLAG_SECMEM; - break; - case 1: - ctx->flags |= FILE_FLAG_SECMEM; - break; - default: - ATTICerr(0, ERR_R_PASSED_INVALID_ARGUMENT); - ret = 0; - break; - } - } - break; - default: - break; - } - - return ret; -} - -static int file_expect(OSSL_STORE_LOADER_CTX *ctx, int expected) -{ - ctx->expected_type = expected; - return 1; -} - -static int file_find(OSSL_STORE_LOADER_CTX *ctx, - const OSSL_STORE_SEARCH *search) -{ - /* - * If ctx == NULL, the library is looking to know if this loader supports - * the given search type. - */ - - if (OSSL_STORE_SEARCH_get_type(search) == OSSL_STORE_SEARCH_BY_NAME) { - unsigned long hash = 0; - - if (ctx == NULL) - return 1; - - if (ctx->type != is_dir) { - ATTICerr(0, ATTIC_R_SEARCH_ONLY_SUPPORTED_FOR_DIRECTORIES); - return 0; - } - - hash = X509_NAME_hash_ex(OSSL_STORE_SEARCH_get0_name(search), - NULL, NULL, NULL); - BIO_snprintf(ctx->_.dir.search_name, sizeof(ctx->_.dir.search_name), - "%08lx", hash); - return 1; - } - - if (ctx != NULL) - ATTICerr(0, ATTIC_R_UNSUPPORTED_SEARCH_TYPE); - return 0; -} - -static OSSL_STORE_INFO *file_load_try_decode(OSSL_STORE_LOADER_CTX *ctx, - const char *pem_name, - const char *pem_header, - unsigned char *data, size_t len, - const UI_METHOD *ui_method, - void *ui_data, int *matchcount) -{ - OSSL_STORE_INFO *result = NULL; - BUF_MEM *new_mem = NULL; - char *new_pem_name = NULL; - int t = 0; - - again: - { - size_t i = 0; - void *handler_ctx = NULL; - const FILE_HANDLER **matching_handlers = - OPENSSL_zalloc(sizeof(*matching_handlers) - * OSSL_NELEM(file_handlers)); - - if (matching_handlers == NULL) - goto err; - - *matchcount = 0; - for (i = 0; i < OSSL_NELEM(file_handlers); i++) { - const FILE_HANDLER *handler = file_handlers[i]; - int try_matchcount = 0; - void *tmp_handler_ctx = NULL; - OSSL_STORE_INFO *tmp_result; - unsigned long err; - - ERR_set_mark(); - tmp_result = - handler->try_decode(pem_name, pem_header, data, len, - &tmp_handler_ctx, &try_matchcount, - ui_method, ui_data, ctx->uri, - ctx->libctx, ctx->propq); - /* avoid flooding error queue with low-level ASN.1 parse errors */ - err = ERR_peek_last_error(); - if (ERR_GET_LIB(err) == ERR_LIB_ASN1 - && ERR_GET_REASON(err) == ERR_R_NESTED_ASN1_ERROR) - ERR_pop_to_mark(); - else - ERR_clear_last_mark(); - - if (try_matchcount > 0) { - - matching_handlers[*matchcount] = handler; - - if (handler_ctx) - handler->destroy_ctx(&handler_ctx); - handler_ctx = tmp_handler_ctx; - - if ((*matchcount += try_matchcount) > 1) { - /* more than one match => ambiguous, kill any result */ - store_info_free(result); - store_info_free(tmp_result); - if (handler->destroy_ctx != NULL) - handler->destroy_ctx(&handler_ctx); - handler_ctx = NULL; - tmp_result = NULL; - result = NULL; - } - if (result == NULL) - result = tmp_result; - if (result == NULL) /* e.g., PKCS#12 file decryption error */ - break; - } - } - - if (result != NULL - && *matchcount == 1 && matching_handlers[0]->repeatable) { - ctx->_.file.last_handler = matching_handlers[0]; - ctx->_.file.last_handler_ctx = handler_ctx; - } - - OPENSSL_free(matching_handlers); - } - - err: - OPENSSL_free(new_pem_name); - BUF_MEM_free(new_mem); - - if (result != NULL - && (t = OSSL_STORE_INFO_get_type(result)) == STORE_INFO_EMBEDDED) { - struct embedded_st *embedded = get0_EMBEDDED(result); - - /* "steal" the embedded data */ - pem_name = new_pem_name = embedded->pem_name; - new_mem = embedded->blob; - data = (unsigned char *)new_mem->data; - len = new_mem->length; - embedded->pem_name = NULL; - embedded->blob = NULL; - - store_info_free(result); - result = NULL; - goto again; - } - - return result; -} - -static OSSL_STORE_INFO *file_load_try_repeat(OSSL_STORE_LOADER_CTX *ctx, - const UI_METHOD *ui_method, - void *ui_data) -{ - OSSL_STORE_INFO *result = NULL; - int try_matchcount = 0; - - if (ctx->_.file.last_handler != NULL) { - result = - ctx->_.file.last_handler->try_decode(NULL, NULL, NULL, 0, - &ctx->_.file.last_handler_ctx, - &try_matchcount, - ui_method, ui_data, ctx->uri, - ctx->libctx, ctx->propq); - - if (result == NULL) { - ctx->_.file.last_handler->destroy_ctx(&ctx->_.file.last_handler_ctx); - ctx->_.file.last_handler_ctx = NULL; - ctx->_.file.last_handler = NULL; - } - } - return result; -} - -static void pem_free_flag(void *pem_data, int secure, size_t num) -{ - if (secure) - OPENSSL_secure_clear_free(pem_data, num); - else - OPENSSL_free(pem_data); -} -static int file_read_pem(BIO *bp, char **pem_name, char **pem_header, - unsigned char **data, long *len, - const UI_METHOD *ui_method, void *ui_data, - const char *uri, int secure) -{ - int i = secure - ? PEM_read_bio_ex(bp, pem_name, pem_header, data, len, - PEM_FLAG_SECURE | PEM_FLAG_EAY_COMPATIBLE) - : PEM_read_bio(bp, pem_name, pem_header, data, len); - - if (i <= 0) - return 0; - - /* - * 10 is the number of characters in "Proc-Type:", which - * PEM_get_EVP_CIPHER_INFO() requires to be present. - * If the PEM header has less characters than that, it's - * not worth spending cycles on it. - */ - if (strlen(*pem_header) > 10) { - EVP_CIPHER_INFO cipher; - struct pem_pass_data pass_data; - - if (!PEM_get_EVP_CIPHER_INFO(*pem_header, &cipher) - || !file_fill_pem_pass_data(&pass_data, "PEM pass phrase", uri, - ui_method, ui_data) - || !PEM_do_header(&cipher, *data, len, file_get_pem_pass, - &pass_data)) { - return 0; - } - } - return 1; -} - -static OSSL_STORE_INFO *file_try_read_msblob(BIO *bp, int *matchcount) -{ - OSSL_STORE_INFO *result = NULL; - int ispub = -1; - - { - unsigned int magic = 0, bitlen = 0; - int isdss = 0; - unsigned char peekbuf[16] = { 0, }; - const unsigned char *p = peekbuf; - - if (BIO_buffer_peek(bp, peekbuf, sizeof(peekbuf)) <= 0) - return 0; - if (ossl_do_blob_header(&p, sizeof(peekbuf), &magic, &bitlen, - &isdss, &ispub) <= 0) - return 0; - } - - (*matchcount)++; - - { - EVP_PKEY *tmp = ispub - ? b2i_PublicKey_bio(bp) - : b2i_PrivateKey_bio(bp); - - if (tmp == NULL - || (result = OSSL_STORE_INFO_new_PKEY(tmp)) == NULL) { - EVP_PKEY_free(tmp); - return 0; - } - } - - return result; -} - -static OSSL_STORE_INFO *file_try_read_PVK(BIO *bp, const UI_METHOD *ui_method, - void *ui_data, const char *uri, - int *matchcount) -{ - OSSL_STORE_INFO *result = NULL; - - { - unsigned int saltlen = 0, keylen = 0; - int isdss = -1; - unsigned char peekbuf[24] = { 0, }; - const unsigned char *p = peekbuf; - - if (BIO_buffer_peek(bp, peekbuf, sizeof(peekbuf)) <= 0) - return 0; - if (!ossl_do_PVK_header(&p, sizeof(peekbuf), 0, &isdss, &saltlen, &keylen)) - return 0; - } - - (*matchcount)++; - - { - EVP_PKEY *tmp = NULL; - struct pem_pass_data pass_data; - - if (!file_fill_pem_pass_data(&pass_data, "PVK pass phrase", uri, - ui_method, ui_data) - || (tmp = b2i_PVK_bio(bp, file_get_pem_pass, &pass_data)) == NULL - || (result = OSSL_STORE_INFO_new_PKEY(tmp)) == NULL) { - EVP_PKEY_free(tmp); - return 0; - } - } - - return result; -} - -static int file_read_asn1(BIO *bp, unsigned char **data, long *len) -{ - BUF_MEM *mem = NULL; - - if (asn1_d2i_read_bio(bp, &mem) < 0) - return 0; - - *data = (unsigned char *)mem->data; - *len = (long)mem->length; - OPENSSL_free(mem); - - return 1; -} - -static int file_name_to_uri(OSSL_STORE_LOADER_CTX *ctx, const char *name, - char **data) -{ - assert(name != NULL); - assert(data != NULL); - { - const char *pathsep = ossl_ends_with_dirsep(ctx->uri) ? "" : "/"; - long calculated_length = (long)(strlen(ctx->uri) + strlen(pathsep) - + strlen(name) + 1 /* \0 */); - - *data = OPENSSL_zalloc(calculated_length); - if (*data == NULL) - return 0; - - OPENSSL_strlcat(*data, ctx->uri, calculated_length); - OPENSSL_strlcat(*data, pathsep, calculated_length); - OPENSSL_strlcat(*data, name, calculated_length); - } - return 1; -} - -static int file_name_check(OSSL_STORE_LOADER_CTX *ctx, const char *name) -{ - const char *p = NULL; - size_t len = strlen(ctx->_.dir.search_name); - - /* If there are no search criteria, all names are accepted */ - if (ctx->_.dir.search_name[0] == '\0') - return 1; - - /* If the expected type isn't supported, no name is accepted */ - if (ctx->expected_type != 0 - && ctx->expected_type != OSSL_STORE_INFO_CERT - && ctx->expected_type != OSSL_STORE_INFO_CRL) - return 0; - - /* - * First, check the basename - */ - if (OPENSSL_strncasecmp(name, ctx->_.dir.search_name, len) != 0 - || name[len] != '.') - return 0; - p = &name[len + 1]; - - /* - * Then, if the expected type is a CRL, check that the extension starts - * with 'r' - */ - if (*p == 'r') { - p++; - if (ctx->expected_type != 0 - && ctx->expected_type != OSSL_STORE_INFO_CRL) - return 0; - } else if (ctx->expected_type == OSSL_STORE_INFO_CRL) { - return 0; - } - - /* - * Last, check that the rest of the extension is a decimal number, at - * least one digit long. - */ - if (!isdigit((unsigned char)*p)) - return 0; - while (isdigit((unsigned char)*p)) - p++; - -#ifdef __VMS - /* - * One extra step here, check for a possible generation number. - */ - if (*p == ';') - for (p++; *p != '\0'; p++) - if (!ossl_isdigit(*p)) - break; -#endif - - /* - * If we've reached the end of the string at this point, we've successfully - * found a fitting file name. - */ - return *p == '\0'; -} - -static int file_eof(OSSL_STORE_LOADER_CTX *ctx); -static int file_error(OSSL_STORE_LOADER_CTX *ctx); -static OSSL_STORE_INFO *file_load(OSSL_STORE_LOADER_CTX *ctx, - const UI_METHOD *ui_method, - void *ui_data) -{ - OSSL_STORE_INFO *result = NULL; - - ctx->errcnt = 0; - - if (ctx->type == is_dir) { - do { - char *newname = NULL; - - if (ctx->_.dir.last_entry == NULL) { - if (!ctx->_.dir.end_reached) { - assert(ctx->_.dir.last_errno != 0); - ERR_raise(ERR_LIB_SYS, ctx->_.dir.last_errno); - ctx->errcnt++; - } - return NULL; - } - - if (ctx->_.dir.last_entry[0] != '.' - && file_name_check(ctx, ctx->_.dir.last_entry) - && !file_name_to_uri(ctx, ctx->_.dir.last_entry, &newname)) - return NULL; - - /* - * On the first call (with a NULL context), OPENSSL_DIR_read() - * cares about the second argument. On the following calls, it - * only cares that it isn't NULL. Therefore, we can safely give - * it our URI here. - */ - ctx->_.dir.last_entry = OPENSSL_DIR_read(&ctx->_.dir.ctx, ctx->uri); - ctx->_.dir.last_errno = errno; - if (ctx->_.dir.last_entry == NULL && ctx->_.dir.last_errno == 0) - ctx->_.dir.end_reached = 1; - - if (newname != NULL - && (result = OSSL_STORE_INFO_new_NAME(newname)) == NULL) { - OPENSSL_free(newname); - ATTICerr(0, ERR_R_OSSL_STORE_LIB); - return NULL; - } - } while (result == NULL && !file_eof(ctx)); - } else { - int matchcount = -1; - - again: - result = file_load_try_repeat(ctx, ui_method, ui_data); - if (result != NULL) - return result; - - if (file_eof(ctx)) - return NULL; - - do { - char *pem_name = NULL; /* PEM record name */ - char *pem_header = NULL; /* PEM record header */ - unsigned char *data = NULL; /* DER encoded data */ - long len = 0; /* DER encoded data length */ - - matchcount = -1; - if (ctx->type == is_pem) { - if (!file_read_pem(ctx->_.file.file, &pem_name, &pem_header, - &data, &len, ui_method, ui_data, ctx->uri, - (ctx->flags & FILE_FLAG_SECMEM) != 0)) { - ctx->errcnt++; - goto endloop; - } - } else { - if ((result = file_try_read_msblob(ctx->_.file.file, - &matchcount)) != NULL - || (result = file_try_read_PVK(ctx->_.file.file, - ui_method, ui_data, ctx->uri, - &matchcount)) != NULL) - goto endloop; - - if (!file_read_asn1(ctx->_.file.file, &data, &len)) { - ctx->errcnt++; - goto endloop; - } - } - - result = file_load_try_decode(ctx, pem_name, pem_header, data, len, - ui_method, ui_data, &matchcount); - - if (result != NULL) - goto endloop; - - /* - * If a PEM name matches more than one handler, the handlers are - * badly coded. - */ - if (!ossl_assert(pem_name == NULL || matchcount <= 1)) { - ctx->errcnt++; - goto endloop; - } - - if (matchcount > 1) { - ATTICerr(0, ATTIC_R_AMBIGUOUS_CONTENT_TYPE); - } else if (matchcount == 1) { - /* - * If there are other errors on the stack, they already show - * what the problem is. - */ - if (ERR_peek_error() == 0) { - ATTICerr(0, ATTIC_R_UNSUPPORTED_CONTENT_TYPE); - if (pem_name != NULL) - ERR_add_error_data(3, "PEM type is '", pem_name, "'"); - } - } - if (matchcount > 0) - ctx->errcnt++; - - endloop: - pem_free_flag(pem_name, (ctx->flags & FILE_FLAG_SECMEM) != 0, 0); - pem_free_flag(pem_header, (ctx->flags & FILE_FLAG_SECMEM) != 0, 0); - pem_free_flag(data, (ctx->flags & FILE_FLAG_SECMEM) != 0, len); - } while (matchcount == 0 && !file_eof(ctx) && !file_error(ctx)); - - /* We bail out on ambiguity */ - if (matchcount > 1) { - store_info_free(result); - return NULL; - } - - if (result != NULL - && ctx->expected_type != 0 - && ctx->expected_type != OSSL_STORE_INFO_get_type(result)) { - store_info_free(result); - goto again; - } - } - - return result; -} - -static int file_error(OSSL_STORE_LOADER_CTX *ctx) -{ - return ctx->errcnt > 0; -} - -static int file_eof(OSSL_STORE_LOADER_CTX *ctx) -{ - if (ctx->type == is_dir) - return ctx->_.dir.end_reached; - - if (ctx->_.file.last_handler != NULL - && !ctx->_.file.last_handler->eof(ctx->_.file.last_handler_ctx)) - return 0; - return BIO_eof(ctx->_.file.file); -} - -static int file_close(OSSL_STORE_LOADER_CTX *ctx) -{ - if ((ctx->flags & FILE_FLAG_ATTACHED) == 0) { - if (ctx->type == is_dir) - OPENSSL_DIR_end(&ctx->_.dir.ctx); - else - BIO_free_all(ctx->_.file.file); - } else { - /* - * Because file_attach() called file_find_type(), we know that a - * BIO_f_buffer() has been pushed on top of the regular BIO. - */ - BIO *buff = ctx->_.file.file; - - /* Detach buff */ - (void)BIO_pop(ctx->_.file.file); - /* Safety measure */ - ctx->_.file.file = NULL; - - BIO_free(buff); - } - OSSL_STORE_LOADER_CTX_free(ctx); - return 1; -} - -/*- - * ENGINE management - */ - -static const char *loader_attic_id = "loader_attic"; -static const char *loader_attic_name = "'file:' loader"; - -static OSSL_STORE_LOADER *loader_attic = NULL; - -static int loader_attic_init(ENGINE *e) -{ - return 1; -} - - -static int loader_attic_finish(ENGINE *e) -{ - return 1; -} - - -static int loader_attic_destroy(ENGINE *e) -{ - OSSL_STORE_LOADER *loader = OSSL_STORE_unregister_loader("file"); - - if (loader == NULL) - return 0; - - ERR_unload_ATTIC_strings(); - OSSL_STORE_LOADER_free(loader); - return 1; -} - -static int bind_loader_attic(ENGINE *e) -{ - - /* Ensure the ATTIC error handling is set up on best effort basis */ - ERR_load_ATTIC_strings(); - - if (/* Create the OSSL_STORE_LOADER */ - (loader_attic = OSSL_STORE_LOADER_new(e, "file")) == NULL - || !OSSL_STORE_LOADER_set_open_ex(loader_attic, file_open_ex) - || !OSSL_STORE_LOADER_set_open(loader_attic, file_open) - || !OSSL_STORE_LOADER_set_attach(loader_attic, file_attach) - || !OSSL_STORE_LOADER_set_ctrl(loader_attic, file_ctrl) - || !OSSL_STORE_LOADER_set_expect(loader_attic, file_expect) - || !OSSL_STORE_LOADER_set_find(loader_attic, file_find) - || !OSSL_STORE_LOADER_set_load(loader_attic, file_load) - || !OSSL_STORE_LOADER_set_eof(loader_attic, file_eof) - || !OSSL_STORE_LOADER_set_error(loader_attic, file_error) - || !OSSL_STORE_LOADER_set_close(loader_attic, file_close) - /* Init the engine itself */ - || !ENGINE_set_id(e, loader_attic_id) - || !ENGINE_set_name(e, loader_attic_name) - || !ENGINE_set_destroy_function(e, loader_attic_destroy) - || !ENGINE_set_init_function(e, loader_attic_init) - || !ENGINE_set_finish_function(e, loader_attic_finish) - /* Finally, register the method with libcrypto */ - || !OSSL_STORE_register_loader(loader_attic)) { - OSSL_STORE_LOADER_free(loader_attic); - loader_attic = NULL; - ATTICerr(0, ATTIC_R_INIT_FAILED); - return 0; - } - - return 1; -} - -#ifdef OPENSSL_NO_DYNAMIC_ENGINE -# error "Only allowed as dynamically shared object" -#endif - -static int bind_helper(ENGINE *e, const char *id) -{ - if (id && (strcmp(id, loader_attic_id) != 0)) - return 0; - if (!bind_loader_attic(e)) - return 0; - return 1; -} - -IMPLEMENT_DYNAMIC_CHECK_FN() - IMPLEMENT_DYNAMIC_BIND_FN(bind_helper) diff --git a/engines/e_loader_attic.ec b/engines/e_loader_attic.ec deleted file mode 100644 index 525a689fe5..0000000000 --- a/engines/e_loader_attic.ec +++ /dev/null @@ -1,3 +0,0 @@ -# The INPUT HEADER is scanned for declarations -# LIBNAME INPUT HEADER ERROR-TABLE FILE -L ATTIC e_loader_attic_err.h e_loader_attic_err.c diff --git a/engines/e_loader_attic.txt b/engines/e_loader_attic.txt deleted file mode 100644 index 4fb8fdf5e8..0000000000 --- a/engines/e_loader_attic.txt +++ /dev/null @@ -1,21 +0,0 @@ -# Copyright 1999-2021 The OpenSSL Project Authors. All Rights Reserved. -# -# Licensed under the Apache License 2.0 (the "License"). You may not use -# this file except in compliance with the License. You can obtain a copy -# in the file LICENSE in the source distribution or at -# https://www.openssl.org/source/license.html - -#Reason codes -ATTIC_R_AMBIGUOUS_CONTENT_TYPE:100:ambiguous content type -ATTIC_R_BAD_PASSWORD_READ:101:bad password read -ATTIC_R_ERROR_VERIFYING_PKCS12_MAC:102:error verifying pkcs12 mac -ATTIC_R_INIT_FAILED:103:init failed -ATTIC_R_PASSPHRASE_CALLBACK_ERROR:104:passphrase callback error -ATTIC_R_PATH_MUST_BE_ABSOLUTE:105:path must be absolute -ATTIC_R_SEARCH_ONLY_SUPPORTED_FOR_DIRECTORIES:106:\ - search only supported for directories -ATTIC_R_UI_PROCESS_INTERRUPTED_OR_CANCELLED:107:\ - ui process interrupted or cancelled -ATTIC_R_UNSUPPORTED_CONTENT_TYPE:108:unsupported content type -ATTIC_R_UNSUPPORTED_SEARCH_TYPE:109:unsupported search type -ATTIC_R_URI_AUTHORITY_UNSUPPORTED:110:uri authority unsupported diff --git a/engines/e_loader_attic_err.c b/engines/e_loader_attic_err.c deleted file mode 100644 index d7c71463d8..0000000000 --- a/engines/e_loader_attic_err.c +++ /dev/null @@ -1,73 +0,0 @@ -/* - * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#include -#include "e_loader_attic_err.h" - -#ifndef OPENSSL_NO_ERR - -static ERR_STRING_DATA ATTIC_str_reasons[] = { - {ERR_PACK(0, 0, ATTIC_R_AMBIGUOUS_CONTENT_TYPE), "ambiguous content type"}, - {ERR_PACK(0, 0, ATTIC_R_BAD_PASSWORD_READ), "bad password read"}, - {ERR_PACK(0, 0, ATTIC_R_ERROR_VERIFYING_PKCS12_MAC), - "error verifying pkcs12 mac"}, - {ERR_PACK(0, 0, ATTIC_R_INIT_FAILED), "init failed"}, - {ERR_PACK(0, 0, ATTIC_R_PASSPHRASE_CALLBACK_ERROR), - "passphrase callback error"}, - {ERR_PACK(0, 0, ATTIC_R_PATH_MUST_BE_ABSOLUTE), "path must be absolute"}, - {ERR_PACK(0, 0, ATTIC_R_SEARCH_ONLY_SUPPORTED_FOR_DIRECTORIES), - "search only supported for directories"}, - {ERR_PACK(0, 0, ATTIC_R_UI_PROCESS_INTERRUPTED_OR_CANCELLED), - "ui process interrupted or cancelled"}, - {ERR_PACK(0, 0, ATTIC_R_UNSUPPORTED_CONTENT_TYPE), - "unsupported content type"}, - {ERR_PACK(0, 0, ATTIC_R_UNSUPPORTED_SEARCH_TYPE), - "unsupported search type"}, - {ERR_PACK(0, 0, ATTIC_R_URI_AUTHORITY_UNSUPPORTED), - "uri authority unsupported"}, - {0, NULL} -}; - -#endif - -static int lib_code = 0; -static int error_loaded = 0; - -static int ERR_load_ATTIC_strings(void) -{ - if (lib_code == 0) - lib_code = ERR_get_next_error_library(); - - if (!error_loaded) { -#ifndef OPENSSL_NO_ERR - ERR_load_strings(lib_code, ATTIC_str_reasons); -#endif - error_loaded = 1; - } - return 1; -} - -static void ERR_unload_ATTIC_strings(void) -{ - if (error_loaded) { -#ifndef OPENSSL_NO_ERR - ERR_unload_strings(lib_code, ATTIC_str_reasons); -#endif - error_loaded = 0; - } -} - -static void ERR_ATTIC_error(int function, int reason, const char *file, int line) -{ - if (lib_code == 0) - lib_code = ERR_get_next_error_library(); - ERR_raise(lib_code, reason); - ERR_set_debug(file, line, NULL); -} diff --git a/engines/e_loader_attic_err.h b/engines/e_loader_attic_err.h deleted file mode 100644 index b4a144f4cb..0000000000 --- a/engines/e_loader_attic_err.h +++ /dev/null @@ -1,37 +0,0 @@ -/* - * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#ifndef OSSL_E_LOADER_ATTIC_ERR_H -# define OSSL_E_LOADER_ATTIC_ERR_H -# pragma once - -# include -# include - - -# define ATTICerr(f, r) ERR_ATTIC_error(0, (r), OPENSSL_FILE, OPENSSL_LINE) - - -/* - * ATTIC reason codes. - */ -# define ATTIC_R_AMBIGUOUS_CONTENT_TYPE 100 -# define ATTIC_R_BAD_PASSWORD_READ 101 -# define ATTIC_R_ERROR_VERIFYING_PKCS12_MAC 102 -# define ATTIC_R_INIT_FAILED 103 -# define ATTIC_R_PASSPHRASE_CALLBACK_ERROR 104 -# define ATTIC_R_PATH_MUST_BE_ABSOLUTE 105 -# define ATTIC_R_SEARCH_ONLY_SUPPORTED_FOR_DIRECTORIES 106 -# define ATTIC_R_UI_PROCESS_INTERRUPTED_OR_CANCELLED 107 -# define ATTIC_R_UNSUPPORTED_CONTENT_TYPE 108 -# define ATTIC_R_UNSUPPORTED_SEARCH_TYPE 109 -# define ATTIC_R_URI_AUTHORITY_UNSUPPORTED 110 - -#endif diff --git a/engines/e_ossltest.c b/engines/e_ossltest.c deleted file mode 100644 index dd5bef57dc..0000000000 --- a/engines/e_ossltest.c +++ /dev/null @@ -1,928 +0,0 @@ -/* - * Copyright 2015-2025 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* - * This is the OSSLTEST engine. It provides deliberately crippled digest - * implementations for test purposes. It is highly insecure and must NOT be - * used for any purpose except testing - */ - -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - -/* - * SHA low level APIs are deprecated for public use, but still ok for - * internal use. Note, that due to symbols not being exported, only the - * #defines and type definitions can be accessed, function calls are not - * available. The digest lengths, block sizes and sizeof(CTX) are used herein - * for several different digests. - */ -#include "internal/deprecated.h" - -#include -#include -#include "internal/common.h" /* for CHECK_AND_SKIP_CASE_PREFIX */ - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -/* clang-format off */ -#include "e_ossltest_err.c" -/* clang-format on */ - -/* Engine Id and Name */ -static const char *engine_ossltest_id = "ossltest"; -static const char *engine_ossltest_name = "OpenSSL Test engine support"; - - -/* Engine Lifetime functions */ -static int ossltest_destroy(ENGINE *e); -static int ossltest_init(ENGINE *e); -static int ossltest_finish(ENGINE *e); -void ENGINE_load_ossltest(void); - - -/* Set up digests */ -static int ossltest_digests(ENGINE *e, const EVP_MD **digest, - const int **nids, int nid); -static const RAND_METHOD *ossltest_rand_method(void); - -/* MD5 */ -static int digest_md5_init(EVP_MD_CTX *ctx); -static int digest_md5_update(EVP_MD_CTX *ctx, const void *data, - size_t count); -static int digest_md5_final(EVP_MD_CTX *ctx, unsigned char *md); - -static EVP_MD *_hidden_md5_md = NULL; -static const EVP_MD *digest_md5(void) -{ - if (_hidden_md5_md == NULL) { - EVP_MD *md; - - if ((md = EVP_MD_meth_new(NID_md5, NID_md5WithRSAEncryption)) == NULL - || !EVP_MD_meth_set_result_size(md, MD5_DIGEST_LENGTH) - || !EVP_MD_meth_set_input_blocksize(md, MD5_CBLOCK) - || !EVP_MD_meth_set_app_datasize(md, - sizeof(EVP_MD *) + sizeof(MD5_CTX)) - || !EVP_MD_meth_set_flags(md, 0) - || !EVP_MD_meth_set_init(md, digest_md5_init) - || !EVP_MD_meth_set_update(md, digest_md5_update) - || !EVP_MD_meth_set_final(md, digest_md5_final)) { - EVP_MD_meth_free(md); - md = NULL; - } - _hidden_md5_md = md; - } - return _hidden_md5_md; -} - -/* SHA1 */ -static int digest_sha1_init(EVP_MD_CTX *ctx); -static int digest_sha1_update(EVP_MD_CTX *ctx, const void *data, - size_t count); -static int digest_sha1_final(EVP_MD_CTX *ctx, unsigned char *md); - -static EVP_MD *_hidden_sha1_md = NULL; -static const EVP_MD *digest_sha1(void) -{ - if (_hidden_sha1_md == NULL) { - EVP_MD *md; - - if ((md = EVP_MD_meth_new(NID_sha1, NID_sha1WithRSAEncryption)) == NULL - || !EVP_MD_meth_set_result_size(md, SHA_DIGEST_LENGTH) - || !EVP_MD_meth_set_input_blocksize(md, SHA_CBLOCK) - || !EVP_MD_meth_set_app_datasize(md, - sizeof(EVP_MD *) + sizeof(SHA_CTX)) - || !EVP_MD_meth_set_flags(md, EVP_MD_FLAG_DIGALGID_ABSENT) - || !EVP_MD_meth_set_init(md, digest_sha1_init) - || !EVP_MD_meth_set_update(md, digest_sha1_update) - || !EVP_MD_meth_set_final(md, digest_sha1_final)) { - EVP_MD_meth_free(md); - md = NULL; - } - _hidden_sha1_md = md; - } - return _hidden_sha1_md; -} - -/* SHA256 */ -static int digest_sha256_init(EVP_MD_CTX *ctx); -static int digest_sha256_update(EVP_MD_CTX *ctx, const void *data, - size_t count); -static int digest_sha256_final(EVP_MD_CTX *ctx, unsigned char *md); - -static EVP_MD *_hidden_sha256_md = NULL; -static const EVP_MD *digest_sha256(void) -{ - if (_hidden_sha256_md == NULL) { - EVP_MD *md; - - if ((md = EVP_MD_meth_new(NID_sha256, NID_sha256WithRSAEncryption)) == NULL - || !EVP_MD_meth_set_result_size(md, SHA256_DIGEST_LENGTH) - || !EVP_MD_meth_set_input_blocksize(md, SHA256_CBLOCK) - || !EVP_MD_meth_set_app_datasize(md, - sizeof(EVP_MD *) + sizeof(SHA256_CTX)) - || !EVP_MD_meth_set_flags(md, EVP_MD_FLAG_DIGALGID_ABSENT) - || !EVP_MD_meth_set_init(md, digest_sha256_init) - || !EVP_MD_meth_set_update(md, digest_sha256_update) - || !EVP_MD_meth_set_final(md, digest_sha256_final)) { - EVP_MD_meth_free(md); - md = NULL; - } - _hidden_sha256_md = md; - } - return _hidden_sha256_md; -} - -/* SHA384/SHA512 */ -static int digest_sha384_init(EVP_MD_CTX *ctx); -static int digest_sha384_update(EVP_MD_CTX *ctx, const void *data, - size_t count); -static int digest_sha384_final(EVP_MD_CTX *ctx, unsigned char *md); - -static int digest_sha512_init(EVP_MD_CTX *ctx); -static int digest_sha512_update(EVP_MD_CTX *ctx, const void *data, - size_t count); -static int digest_sha512_final(EVP_MD_CTX *ctx, unsigned char *md); - -static EVP_MD *_hidden_sha384_md = NULL; -static const EVP_MD *digest_sha384(void) -{ - if (_hidden_sha384_md == NULL) { - EVP_MD *md; - - if ((md = EVP_MD_meth_new(NID_sha384, NID_sha384WithRSAEncryption)) == NULL - || !EVP_MD_meth_set_result_size(md, SHA384_DIGEST_LENGTH) - || !EVP_MD_meth_set_input_blocksize(md, SHA512_CBLOCK) - || !EVP_MD_meth_set_app_datasize(md, - sizeof(EVP_MD *) + sizeof(SHA512_CTX)) - || !EVP_MD_meth_set_flags(md, EVP_MD_FLAG_DIGALGID_ABSENT) - || !EVP_MD_meth_set_init(md, digest_sha384_init) - || !EVP_MD_meth_set_update(md, digest_sha384_update) - || !EVP_MD_meth_set_final(md, digest_sha384_final)) { - EVP_MD_meth_free(md); - md = NULL; - } - _hidden_sha384_md = md; - } - return _hidden_sha384_md; -} -static EVP_MD *_hidden_sha512_md = NULL; -static const EVP_MD *digest_sha512(void) -{ - if (_hidden_sha512_md == NULL) { - EVP_MD *md; - - if ((md = EVP_MD_meth_new(NID_sha512, NID_sha512WithRSAEncryption)) == NULL - || !EVP_MD_meth_set_result_size(md, SHA512_DIGEST_LENGTH) - || !EVP_MD_meth_set_input_blocksize(md, SHA512_CBLOCK) - || !EVP_MD_meth_set_app_datasize(md, - sizeof(EVP_MD *) + sizeof(SHA512_CTX)) - || !EVP_MD_meth_set_flags(md, EVP_MD_FLAG_DIGALGID_ABSENT) - || !EVP_MD_meth_set_init(md, digest_sha512_init) - || !EVP_MD_meth_set_update(md, digest_sha512_update) - || !EVP_MD_meth_set_final(md, digest_sha512_final)) { - EVP_MD_meth_free(md); - md = NULL; - } - _hidden_sha512_md = md; - } - return _hidden_sha512_md; -} -static void destroy_digests(void) -{ - EVP_MD_meth_free(_hidden_md5_md); - _hidden_md5_md = NULL; - EVP_MD_meth_free(_hidden_sha1_md); - _hidden_sha1_md = NULL; - EVP_MD_meth_free(_hidden_sha256_md); - _hidden_sha256_md = NULL; - EVP_MD_meth_free(_hidden_sha384_md); - _hidden_sha384_md = NULL; - EVP_MD_meth_free(_hidden_sha512_md); - _hidden_sha512_md = NULL; -} -static int ossltest_digest_nids(const int **nids) -{ - static int digest_nids[6] = { 0, 0, 0, 0, 0, 0 }; - static int pos = 0; - static int init = 0; - - if (!init) { - const EVP_MD *md; - if ((md = digest_md5()) != NULL) - digest_nids[pos++] = EVP_MD_get_type(md); - if ((md = digest_sha1()) != NULL) - digest_nids[pos++] = EVP_MD_get_type(md); - if ((md = digest_sha256()) != NULL) - digest_nids[pos++] = EVP_MD_get_type(md); - if ((md = digest_sha384()) != NULL) - digest_nids[pos++] = EVP_MD_get_type(md); - if ((md = digest_sha512()) != NULL) - digest_nids[pos++] = EVP_MD_get_type(md); - digest_nids[pos] = 0; - init = 1; - } - *nids = digest_nids; - return pos; -} - -/* Setup ciphers */ -static int ossltest_ciphers(ENGINE *, const EVP_CIPHER **, - const int **, int); - -static int ossltest_cipher_nids[] = { - NID_aes_128_cbc, NID_aes_128_gcm, - NID_aes_128_cbc_hmac_sha1, 0 -}; - -/* AES128 */ - -static int ossltest_aes128_init_key(EVP_CIPHER_CTX *ctx, - const unsigned char *key, - const unsigned char *iv, int enc); -static int ossltest_aes128_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl); -static int ossltest_aes128_gcm_init_key(EVP_CIPHER_CTX *ctx, - const unsigned char *key, - const unsigned char *iv, int enc); -static int ossltest_aes128_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl); -static int ossltest_aes128_gcm_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, - void *ptr); -static int ossltest_aes128_cbc_hmac_sha1_init_key(EVP_CIPHER_CTX *ctx, - const unsigned char *key, - const unsigned char *iv, - int enc); -static int ossltest_aes128_cbc_hmac_sha1_cipher(EVP_CIPHER_CTX *ctx, - unsigned char *out, - const unsigned char *in, - size_t inl); -static int ossltest_aes128_cbc_hmac_sha1_ctrl(EVP_CIPHER_CTX *ctx, int type, - int arg, void *ptr); - -typedef struct { - size_t payload_length; /* AAD length in decrypt case */ - unsigned int tls_ver; -} EVP_AES_HMAC_SHA1; - -static EVP_CIPHER *_hidden_aes_128_cbc = NULL; -static const EVP_CIPHER *ossltest_aes_128_cbc(void) -{ - if (_hidden_aes_128_cbc == NULL - && ((_hidden_aes_128_cbc = EVP_CIPHER_meth_new(NID_aes_128_cbc, - 16 /* block size */, - 16 /* key len */)) == NULL - || !EVP_CIPHER_meth_set_iv_length(_hidden_aes_128_cbc,16) - || !EVP_CIPHER_meth_set_flags(_hidden_aes_128_cbc, - EVP_CIPH_FLAG_DEFAULT_ASN1 - | EVP_CIPH_CBC_MODE) - || !EVP_CIPHER_meth_set_init(_hidden_aes_128_cbc, - ossltest_aes128_init_key) - || !EVP_CIPHER_meth_set_do_cipher(_hidden_aes_128_cbc, - ossltest_aes128_cbc_cipher) - || !EVP_CIPHER_meth_set_impl_ctx_size(_hidden_aes_128_cbc, - EVP_CIPHER_impl_ctx_size(EVP_aes_128_cbc())))) { - EVP_CIPHER_meth_free(_hidden_aes_128_cbc); - _hidden_aes_128_cbc = NULL; - } - return _hidden_aes_128_cbc; -} - -static EVP_CIPHER *_hidden_aes_128_gcm = NULL; - -#define AES_GCM_FLAGS (EVP_CIPH_FLAG_DEFAULT_ASN1 \ - | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER \ - | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT \ - | EVP_CIPH_CUSTOM_COPY |EVP_CIPH_FLAG_AEAD_CIPHER \ - | EVP_CIPH_GCM_MODE) - -static const EVP_CIPHER *ossltest_aes_128_gcm(void) -{ - if (_hidden_aes_128_gcm == NULL - && ((_hidden_aes_128_gcm = EVP_CIPHER_meth_new(NID_aes_128_gcm, - 1 /* block size */, - 16 /* key len */)) == NULL - || !EVP_CIPHER_meth_set_iv_length(_hidden_aes_128_gcm,12) - || !EVP_CIPHER_meth_set_flags(_hidden_aes_128_gcm, AES_GCM_FLAGS) - || !EVP_CIPHER_meth_set_init(_hidden_aes_128_gcm, - ossltest_aes128_gcm_init_key) - || !EVP_CIPHER_meth_set_do_cipher(_hidden_aes_128_gcm, - ossltest_aes128_gcm_cipher) - || !EVP_CIPHER_meth_set_ctrl(_hidden_aes_128_gcm, - ossltest_aes128_gcm_ctrl) - || !EVP_CIPHER_meth_set_impl_ctx_size(_hidden_aes_128_gcm, - EVP_CIPHER_impl_ctx_size(EVP_aes_128_gcm())))) { - EVP_CIPHER_meth_free(_hidden_aes_128_gcm); - _hidden_aes_128_gcm = NULL; - } - return _hidden_aes_128_gcm; -} - -static EVP_CIPHER *_hidden_aes_128_cbc_hmac_sha1 = NULL; - -static const EVP_CIPHER *ossltest_aes_128_cbc_hmac_sha1(void) -{ - if (_hidden_aes_128_cbc_hmac_sha1 == NULL - && ((_hidden_aes_128_cbc_hmac_sha1 - = EVP_CIPHER_meth_new(NID_aes_128_cbc_hmac_sha1, - 16 /* block size */, - 16 /* key len */)) == NULL - || !EVP_CIPHER_meth_set_iv_length(_hidden_aes_128_cbc_hmac_sha1,16) - || !EVP_CIPHER_meth_set_flags(_hidden_aes_128_cbc_hmac_sha1, - EVP_CIPH_CBC_MODE | EVP_CIPH_FLAG_DEFAULT_ASN1 | - EVP_CIPH_FLAG_AEAD_CIPHER) - || !EVP_CIPHER_meth_set_init(_hidden_aes_128_cbc_hmac_sha1, - ossltest_aes128_cbc_hmac_sha1_init_key) - || !EVP_CIPHER_meth_set_do_cipher(_hidden_aes_128_cbc_hmac_sha1, - ossltest_aes128_cbc_hmac_sha1_cipher) - || !EVP_CIPHER_meth_set_ctrl(_hidden_aes_128_cbc_hmac_sha1, - ossltest_aes128_cbc_hmac_sha1_ctrl) - || !EVP_CIPHER_meth_set_set_asn1_params(_hidden_aes_128_cbc_hmac_sha1, - EVP_CIPH_FLAG_DEFAULT_ASN1 ? NULL : EVP_CIPHER_set_asn1_iv) - || !EVP_CIPHER_meth_set_get_asn1_params(_hidden_aes_128_cbc_hmac_sha1, - EVP_CIPH_FLAG_DEFAULT_ASN1 ? NULL : EVP_CIPHER_get_asn1_iv) - || !EVP_CIPHER_meth_set_impl_ctx_size(_hidden_aes_128_cbc_hmac_sha1, - sizeof(EVP_AES_HMAC_SHA1)))) { - EVP_CIPHER_meth_free(_hidden_aes_128_cbc_hmac_sha1); - _hidden_aes_128_cbc_hmac_sha1 = NULL; - } - return _hidden_aes_128_cbc_hmac_sha1; -} - -static void destroy_ciphers(void) -{ - EVP_CIPHER_meth_free(_hidden_aes_128_cbc); - EVP_CIPHER_meth_free(_hidden_aes_128_gcm); - EVP_CIPHER_meth_free(_hidden_aes_128_cbc_hmac_sha1); - _hidden_aes_128_cbc = NULL; - _hidden_aes_128_gcm = NULL; - _hidden_aes_128_cbc_hmac_sha1 = NULL; -} - -/* Key loading */ -static EVP_PKEY *load_key(ENGINE *eng, const char *key_id, int pub, - UI_METHOD *ui_method, void *ui_data) -{ - BIO *in; - EVP_PKEY *key; - - if (!CHECK_AND_SKIP_CASE_PREFIX(key_id, "ot:")) - return NULL; - - fprintf(stderr, "[ossltest]Loading %s key %s\n", - pub ? "Public" : "Private", key_id); - in = BIO_new_file(key_id, "r"); - if (!in) - return NULL; - if (pub) - key = PEM_read_bio_PUBKEY(in, NULL, 0, NULL); - else - key = PEM_read_bio_PrivateKey(in, NULL, 0, NULL); - BIO_free(in); - return key; -} - -static EVP_PKEY *ossltest_load_privkey(ENGINE *eng, const char *key_id, - UI_METHOD *ui_method, void *ui_data) -{ - return load_key(eng, key_id, 0, ui_method, ui_data); -} - -static EVP_PKEY *ossltest_load_pubkey(ENGINE *eng, const char *key_id, - UI_METHOD *ui_method, void *ui_data) -{ - return load_key(eng, key_id, 1, ui_method, ui_data); -} - - -static int bind_ossltest(ENGINE *e) -{ - /* Ensure the ossltest error handling is set up */ - ERR_load_OSSLTEST_strings(); - - if (!ENGINE_set_id(e, engine_ossltest_id) - || !ENGINE_set_name(e, engine_ossltest_name) - || !ENGINE_set_digests(e, ossltest_digests) - || !ENGINE_set_ciphers(e, ossltest_ciphers) - || !ENGINE_set_RAND(e, ossltest_rand_method()) - || !ENGINE_set_destroy_function(e, ossltest_destroy) - || !ENGINE_set_load_privkey_function(e, ossltest_load_privkey) - || !ENGINE_set_load_pubkey_function(e, ossltest_load_pubkey) - || !ENGINE_set_init_function(e, ossltest_init) - || !ENGINE_set_finish_function(e, ossltest_finish)) { - OSSLTESTerr(OSSLTEST_F_BIND_OSSLTEST, OSSLTEST_R_INIT_FAILED); - return 0; - } - - return 1; -} - -#ifndef OPENSSL_NO_DYNAMIC_ENGINE -static int bind_helper(ENGINE *e, const char *id) -{ - if (id && (strcmp(id, engine_ossltest_id) != 0)) - return 0; - if (!bind_ossltest(e)) - return 0; - return 1; -} - -IMPLEMENT_DYNAMIC_CHECK_FN() - IMPLEMENT_DYNAMIC_BIND_FN(bind_helper) -#endif - -static ENGINE *engine_ossltest(void) -{ - ENGINE *ret = ENGINE_new(); - if (ret == NULL) - return NULL; - if (!bind_ossltest(ret)) { - ENGINE_free(ret); - return NULL; - } - return ret; -} - -void ENGINE_load_ossltest(void) -{ - /* Copied from eng_[openssl|dyn].c */ - ENGINE *toadd = engine_ossltest(); - if (!toadd) - return; - ENGINE_add(toadd); - ENGINE_free(toadd); - ERR_clear_error(); -} - - -static int ossltest_init(ENGINE *e) -{ - return 1; -} - - -static int ossltest_finish(ENGINE *e) -{ - return 1; -} - - -static int ossltest_destroy(ENGINE *e) -{ - destroy_digests(); - destroy_ciphers(); - ERR_unload_OSSLTEST_strings(); - return 1; -} - -static int ossltest_digests(ENGINE *e, const EVP_MD **digest, - const int **nids, int nid) -{ - int ok = 1; - if (!digest) { - /* We are returning a list of supported nids */ - return ossltest_digest_nids(nids); - } - /* We are being asked for a specific digest */ - switch (nid) { - case NID_md5: - *digest = digest_md5(); - break; - case NID_sha1: - *digest = digest_sha1(); - break; - case NID_sha256: - *digest = digest_sha256(); - break; - case NID_sha384: - *digest = digest_sha384(); - break; - case NID_sha512: - *digest = digest_sha512(); - break; - default: - ok = 0; - *digest = NULL; - break; - } - return ok; -} - -static int ossltest_ciphers(ENGINE *e, const EVP_CIPHER **cipher, - const int **nids, int nid) -{ - int ok = 1; - if (!cipher) { - /* We are returning a list of supported nids */ - *nids = ossltest_cipher_nids; - return (sizeof(ossltest_cipher_nids) - 1) - / sizeof(ossltest_cipher_nids[0]); - } - /* We are being asked for a specific cipher */ - switch (nid) { - case NID_aes_128_cbc: - *cipher = ossltest_aes_128_cbc(); - break; - case NID_aes_128_gcm: - *cipher = ossltest_aes_128_gcm(); - break; - case NID_aes_128_cbc_hmac_sha1: - *cipher = ossltest_aes_128_cbc_hmac_sha1(); - break; - default: - ok = 0; - *cipher = NULL; - break; - } - return ok; -} - -static void fill_known_data(unsigned char *md, unsigned int len) -{ - unsigned int i; - - for (i=0; i 0) { - fill_known_data(md, MD5_DIGEST_LENGTH); - } - return ret; -} - -/* - * SHA1 implementation. - */ -static int digest_sha1_init(EVP_MD_CTX *ctx) -{ - return EVP_MD_meth_get_init(EVP_sha1())(ctx); -} - -static int digest_sha1_update(EVP_MD_CTX *ctx, const void *data, - size_t count) -{ - return EVP_MD_meth_get_update(EVP_sha1())(ctx, data, count); -} - -static int digest_sha1_final(EVP_MD_CTX *ctx, unsigned char *md) -{ - int ret = EVP_MD_meth_get_final(EVP_sha1())(ctx, md); - - if (ret > 0) { - fill_known_data(md, SHA_DIGEST_LENGTH); - } - return ret; -} - -/* - * SHA256 implementation. - */ -static int digest_sha256_init(EVP_MD_CTX *ctx) -{ - return EVP_MD_meth_get_init(EVP_sha256())(ctx); -} - -static int digest_sha256_update(EVP_MD_CTX *ctx, const void *data, - size_t count) -{ - return EVP_MD_meth_get_update(EVP_sha256())(ctx, data, count); -} - -static int digest_sha256_final(EVP_MD_CTX *ctx, unsigned char *md) -{ - int ret = EVP_MD_meth_get_final(EVP_sha256())(ctx, md); - - if (ret > 0) { - fill_known_data(md, SHA256_DIGEST_LENGTH); - } - return ret; -} - -/* - * SHA384 implementation. - */ -static int digest_sha384_init(EVP_MD_CTX *ctx) -{ - return EVP_MD_meth_get_init(EVP_sha384())(ctx); -} - -static int digest_sha384_update(EVP_MD_CTX *ctx, const void *data, - size_t count) -{ - return EVP_MD_meth_get_update(EVP_sha384())(ctx, data, count); -} - -static int digest_sha384_final(EVP_MD_CTX *ctx, unsigned char *md) -{ - int ret = EVP_MD_meth_get_final(EVP_sha384())(ctx, md); - - if (ret > 0) { - fill_known_data(md, SHA384_DIGEST_LENGTH); - } - return ret; -} - -/* - * SHA512 implementation. - */ -static int digest_sha512_init(EVP_MD_CTX *ctx) -{ - return EVP_MD_meth_get_init(EVP_sha512())(ctx); -} - -static int digest_sha512_update(EVP_MD_CTX *ctx, const void *data, - size_t count) -{ - return EVP_MD_meth_get_update(EVP_sha512())(ctx, data, count); -} - -static int digest_sha512_final(EVP_MD_CTX *ctx, unsigned char *md) -{ - int ret = EVP_MD_meth_get_final(EVP_sha512())(ctx, md); - - if (ret > 0) { - fill_known_data(md, SHA512_DIGEST_LENGTH); - } - return ret; -} - -/* - * AES128 Implementation - */ - -static int ossltest_aes128_init_key(EVP_CIPHER_CTX *ctx, - const unsigned char *key, - const unsigned char *iv, int enc) -{ - return EVP_CIPHER_meth_get_init(EVP_aes_128_cbc()) (ctx, key, iv, enc); -} - -static int ossltest_aes128_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) -{ - unsigned char *tmpbuf; - int ret; - - tmpbuf = OPENSSL_malloc(inl); - - /* OPENSSL_malloc will return NULL if inl == 0 */ - if (tmpbuf == NULL && inl > 0) - return -1; - - /* Remember what we were asked to encrypt */ - if (tmpbuf != NULL) - memcpy(tmpbuf, in, inl); - - /* Go through the motions of encrypting it */ - ret = EVP_CIPHER_meth_get_do_cipher(EVP_aes_128_cbc())(ctx, out, in, inl); - - /* Throw it all away and just use the plaintext as the output */ - if (tmpbuf != NULL) - memcpy(out, tmpbuf, inl); - OPENSSL_free(tmpbuf); - - return ret; -} - -static int ossltest_aes128_gcm_init_key(EVP_CIPHER_CTX *ctx, - const unsigned char *key, - const unsigned char *iv, int enc) -{ - return EVP_CIPHER_meth_get_init(EVP_aes_128_gcm()) (ctx, key, iv, enc); -} - -static int ossltest_aes128_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) -{ - unsigned char *tmpbuf = OPENSSL_malloc(inl); - - /* OPENSSL_malloc will return NULL if inl == 0 */ - if (tmpbuf == NULL && inl > 0) - return -1; - - /* Remember what we were asked to encrypt */ - if (tmpbuf != NULL) - memcpy(tmpbuf, in, inl); - - /* Go through the motions of encrypting it */ - EVP_CIPHER_meth_get_do_cipher(EVP_aes_128_gcm())(ctx, out, in, inl); - - /* Throw it all away and just use the plaintext as the output */ - if (tmpbuf != NULL && out != NULL) - memcpy(out, tmpbuf, inl); - OPENSSL_free(tmpbuf); - - return (int)inl; -} - -static int ossltest_aes128_gcm_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, - void *ptr) -{ - /* Pass the ctrl down */ - int ret = EVP_CIPHER_meth_get_ctrl(EVP_aes_128_gcm())(ctx, type, arg, ptr); - - if (ret <= 0) - return ret; - - switch (type) { - case EVP_CTRL_AEAD_GET_TAG: - /* Always give the same tag */ - memset(ptr, 0, EVP_GCM_TLS_TAG_LEN); - break; - - default: - break; - } - - return 1; -} - -#define NO_PAYLOAD_LENGTH ((size_t)-1) -# define data(ctx) ((EVP_AES_HMAC_SHA1 *)EVP_CIPHER_CTX_get_cipher_data(ctx)) - -static int ossltest_aes128_cbc_hmac_sha1_init_key(EVP_CIPHER_CTX *ctx, - const unsigned char *inkey, - const unsigned char *iv, - int enc) -{ - EVP_AES_HMAC_SHA1 *key = data(ctx); - key->payload_length = NO_PAYLOAD_LENGTH; - return 1; -} - -static int ossltest_aes128_cbc_hmac_sha1_cipher(EVP_CIPHER_CTX *ctx, - unsigned char *out, - const unsigned char *in, - size_t len) -{ - EVP_AES_HMAC_SHA1 *key = data(ctx); - unsigned int l; - size_t plen = key->payload_length; - - key->payload_length = NO_PAYLOAD_LENGTH; - - if (len % AES_BLOCK_SIZE) - return 0; - - if (EVP_CIPHER_CTX_is_encrypting(ctx)) { - if (plen == NO_PAYLOAD_LENGTH) - plen = len; - else if (len != - ((plen + SHA_DIGEST_LENGTH + - AES_BLOCK_SIZE) & -AES_BLOCK_SIZE)) - return 0; - - memmove(out, in, plen); - - if (plen != len) { /* "TLS" mode of operation */ - /* calculate HMAC and append it to payload */ - fill_known_data(out + plen, SHA_DIGEST_LENGTH); - - /* pad the payload|hmac */ - plen += SHA_DIGEST_LENGTH; - for (l = (unsigned int)(len - plen - 1); plen < len; plen++) - out[plen] = l; - } - } else { - /* decrypt HMAC|padding at once */ - memmove(out, in, len); - - if (plen != NO_PAYLOAD_LENGTH) { /* "TLS" mode of operation */ - unsigned int maxpad, pad; - - if (key->tls_ver >= TLS1_1_VERSION) { - if (len < (AES_BLOCK_SIZE + SHA_DIGEST_LENGTH + 1)) - return 0; - - /* omit explicit iv */ - in += AES_BLOCK_SIZE; - out += AES_BLOCK_SIZE; - len -= AES_BLOCK_SIZE; - } else if (len < (SHA_DIGEST_LENGTH + 1)) - return 0; - - /* figure out payload length */ - pad = out[len - 1]; - maxpad = (unsigned int)(len - (SHA_DIGEST_LENGTH + 1)); - if (pad > maxpad) - return 0; - for (plen = len - pad - 1; plen < len; plen++) - if (out[plen] != pad) - return 0; - } - } - - return 1; -} - -static int ossltest_aes128_cbc_hmac_sha1_ctrl(EVP_CIPHER_CTX *ctx, int type, - int arg, void *ptr) -{ - EVP_AES_HMAC_SHA1 *key = data(ctx); - - switch (type) { - case EVP_CTRL_AEAD_SET_MAC_KEY: - return 1; - - case EVP_CTRL_AEAD_TLS1_AAD: - { - unsigned char *p = ptr; - unsigned int len; - - if (arg != EVP_AEAD_TLS1_AAD_LEN) - return -1; - - len = p[arg - 2] << 8 | p[arg - 1]; - key->tls_ver = p[arg - 4] << 8 | p[arg - 3]; - - if (EVP_CIPHER_CTX_is_encrypting(ctx)) { - key->payload_length = len; - if (key->tls_ver >= TLS1_1_VERSION) { - if (len < AES_BLOCK_SIZE) - return 0; - len -= AES_BLOCK_SIZE; - p[arg - 2] = len >> 8; - p[arg - 1] = len; - } - - return (int)(((len + SHA_DIGEST_LENGTH + - AES_BLOCK_SIZE) & -AES_BLOCK_SIZE) - - len); - } else { - key->payload_length = arg; - - return SHA_DIGEST_LENGTH; - } - } - default: - return -1; - } -} - -static int ossltest_rand_bytes(unsigned char *buf, int num) -{ - unsigned char val = 1; - - while (--num >= 0) - *buf++ = val++; - return 1; -} - -static int ossltest_rand_status(void) -{ - return 1; -} - -static const RAND_METHOD *ossltest_rand_method(void) -{ - - static RAND_METHOD osslt_rand_meth = { - NULL, - ossltest_rand_bytes, - NULL, - NULL, - ossltest_rand_bytes, - ossltest_rand_status - }; - - return &osslt_rand_meth; -} diff --git a/engines/e_ossltest.ec b/engines/e_ossltest.ec deleted file mode 100644 index a4a55ecb3f..0000000000 --- a/engines/e_ossltest.ec +++ /dev/null @@ -1,3 +0,0 @@ -# The INPUT HEADER is scanned for declarations -# LIBNAME INPUT HEADER ERROR-TABLE FILE -L OSSLTEST e_ossltest_err.h e_ossltest_err.c diff --git a/engines/e_ossltest.txt b/engines/e_ossltest.txt deleted file mode 100644 index 645917fe3b..0000000000 --- a/engines/e_ossltest.txt +++ /dev/null @@ -1,9 +0,0 @@ -# Copyright 1999-2021 The OpenSSL Project Authors. All Rights Reserved. -# -# Licensed under the Apache License 2.0 (the "License"). You may not use -# this file except in compliance with the License. You can obtain a copy -# in the file LICENSE in the source distribution or at -# https://www.openssl.org/source/license.html - -#Reason codes -OSSLTEST_R_INIT_FAILED:100:init failed diff --git a/engines/e_ossltest_err.c b/engines/e_ossltest_err.c deleted file mode 100644 index f229aeb438..0000000000 --- a/engines/e_ossltest_err.c +++ /dev/null @@ -1,56 +0,0 @@ -/* - * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#include -#include "e_ossltest_err.h" - -#ifndef OPENSSL_NO_ERR - -static ERR_STRING_DATA OSSLTEST_str_reasons[] = { - {ERR_PACK(0, 0, OSSLTEST_R_INIT_FAILED), "init failed"}, - {0, NULL} -}; - -#endif - -static int lib_code = 0; -static int error_loaded = 0; - -static int ERR_load_OSSLTEST_strings(void) -{ - if (lib_code == 0) - lib_code = ERR_get_next_error_library(); - - if (!error_loaded) { -#ifndef OPENSSL_NO_ERR - ERR_load_strings(lib_code, OSSLTEST_str_reasons); -#endif - error_loaded = 1; - } - return 1; -} - -static void ERR_unload_OSSLTEST_strings(void) -{ - if (error_loaded) { -#ifndef OPENSSL_NO_ERR - ERR_unload_strings(lib_code, OSSLTEST_str_reasons); -#endif - error_loaded = 0; - } -} - -static void ERR_OSSLTEST_error(int function, int reason, const char *file, int line) -{ - if (lib_code == 0) - lib_code = ERR_get_next_error_library(); - ERR_raise(lib_code, reason); - ERR_set_debug(file, line, NULL); -} diff --git a/engines/e_ossltest_err.h b/engines/e_ossltest_err.h deleted file mode 100644 index c89409079b..0000000000 --- a/engines/e_ossltest_err.h +++ /dev/null @@ -1,27 +0,0 @@ -/* - * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#ifndef OSSL_E_OSSLTEST_ERR_H -# define OSSL_E_OSSLTEST_ERR_H -# pragma once - -# include -# include - - -# define OSSLTESTerr(f, r) ERR_OSSLTEST_error(0, (r), OPENSSL_FILE, OPENSSL_LINE) - - -/* - * OSSLTEST reason codes. - */ -# define OSSLTEST_R_INIT_FAILED 100 - -#endif diff --git a/engines/e_padlock.c b/engines/e_padlock.c deleted file mode 100644 index bdad24b5b2..0000000000 --- a/engines/e_padlock.c +++ /dev/null @@ -1,765 +0,0 @@ -/* - * Copyright 2004-2025 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* - * This file uses the low level AES and engine functions (which are deprecated - * for non-internal use) in order to implement the padlock engine AES ciphers. - */ -#define OPENSSL_SUPPRESS_DEPRECATED - -#include -#include - -#include -#include -#include -#include -#include -#include -#include -#include - -#ifndef OPENSSL_NO_PADLOCKENG - -/* - * VIA PadLock AES is available *ONLY* on some x86 CPUs. Not only that it - * doesn't exist elsewhere, but it even can't be compiled on other platforms! - */ - -# undef COMPILE_PADLOCKENG -# if defined(PADLOCK_ASM) -# define COMPILE_PADLOCKENG -# ifdef OPENSSL_NO_DYNAMIC_ENGINE -static ENGINE *ENGINE_padlock(void); -# endif -# endif - -# ifdef OPENSSL_NO_DYNAMIC_ENGINE -void engine_load_padlock_int(void); -void engine_load_padlock_int(void) -{ -/* On non-x86 CPUs it just returns. */ -# ifdef COMPILE_PADLOCKENG - ENGINE *toadd = ENGINE_padlock(); - if (!toadd) - return; - ERR_set_mark(); - ENGINE_add(toadd); - /* - * If the "add" worked, it gets a structural reference. So either way, we - * release our just-created reference. - */ - ENGINE_free(toadd); - /* - * If the "add" didn't work, it was probably a conflict because it was - * already added (eg. someone calling ENGINE_load_blah then calling - * ENGINE_load_builtin_engines() perhaps). - */ - ERR_pop_to_mark(); -# endif -} - -# endif - -# ifdef COMPILE_PADLOCKENG - -/* Function for ENGINE detection and control */ -static int padlock_available(void); -static int padlock_init(ENGINE *e); - -/* RNG Stuff */ -static RAND_METHOD padlock_rand; - -/* Cipher Stuff */ -static int padlock_ciphers(ENGINE *e, const EVP_CIPHER **cipher, - const int **nids, int nid); - -/* Engine names */ -static const char *padlock_id = "padlock"; -static char padlock_name[100]; - -/* Available features */ -static int padlock_use_ace = 0; /* Advanced Cryptography Engine */ -static int padlock_use_rng = 0; /* Random Number Generator */ - -/* ===== Engine "management" functions ===== */ - -/* Prepare the ENGINE structure for registration */ -static int padlock_bind_helper(ENGINE *e) -{ - /* Check available features */ - padlock_available(); - - /* - * RNG is currently disabled for reasons discussed in commentary just - * before padlock_rand_bytes function. - */ - padlock_use_rng = 0; - - /* Generate a nice engine name with available features */ - BIO_snprintf(padlock_name, sizeof(padlock_name), - "VIA PadLock (%s, %s)", - padlock_use_rng ? "RNG" : "no-RNG", - padlock_use_ace ? "ACE" : "no-ACE"); - - /* Register everything or return with an error */ - if (!ENGINE_set_id(e, padlock_id) || - !ENGINE_set_name(e, padlock_name) || - !ENGINE_set_init_function(e, padlock_init) || - (padlock_use_ace && !ENGINE_set_ciphers(e, padlock_ciphers)) || - (padlock_use_rng && !ENGINE_set_RAND(e, &padlock_rand))) { - return 0; - } - - /* Everything looks good */ - return 1; -} - -# ifdef OPENSSL_NO_DYNAMIC_ENGINE -/* Constructor */ -static ENGINE *ENGINE_padlock(void) -{ - ENGINE *eng = ENGINE_new(); - - if (eng == NULL) { - return NULL; - } - - if (!padlock_bind_helper(eng)) { - ENGINE_free(eng); - return NULL; - } - - return eng; -} -# endif - -/* Check availability of the engine */ -static int padlock_init(ENGINE *e) -{ - return (padlock_use_rng || padlock_use_ace); -} - -# ifndef AES_ASM -static int padlock_aes_set_encrypt_key(const unsigned char *userKey, - const int bits, - AES_KEY *key); -static int padlock_aes_set_decrypt_key(const unsigned char *userKey, - const int bits, - AES_KEY *key); -# define AES_ASM -# define AES_set_encrypt_key padlock_aes_set_encrypt_key -# define AES_set_decrypt_key padlock_aes_set_decrypt_key -/* clang-format off */ -# include "../crypto/aes/aes_core.c" -/* clang-format on */ -# endif - -/* - * This stuff is needed if this ENGINE is being compiled into a - * self-contained shared-library. - */ -# ifndef OPENSSL_NO_DYNAMIC_ENGINE -static int padlock_bind_fn(ENGINE *e, const char *id) -{ - if (id && (strcmp(id, padlock_id) != 0)) { - return 0; - } - - if (!padlock_bind_helper(e)) { - return 0; - } - - return 1; -} - -IMPLEMENT_DYNAMIC_CHECK_FN() -IMPLEMENT_DYNAMIC_BIND_FN(padlock_bind_fn) -# endif /* !OPENSSL_NO_DYNAMIC_ENGINE */ -/* ===== Here comes the "real" engine ===== */ - -/* Some AES-related constants */ -# define AES_BLOCK_SIZE 16 -# define AES_KEY_SIZE_128 16 -# define AES_KEY_SIZE_192 24 -# define AES_KEY_SIZE_256 32 - /* - * Here we store the status information relevant to the current context. - */ - /* - * BIG FAT WARNING: Inline assembler in PADLOCK_XCRYPT_ASM() depends on - * the order of items in this structure. Don't blindly modify, reorder, - * etc! - */ -struct padlock_cipher_data { - unsigned char iv[AES_BLOCK_SIZE]; /* Initialization vector */ - union { - unsigned int pad[4]; - struct { - int rounds:4; - int dgst:1; /* n/a in C3 */ - int align:1; /* n/a in C3 */ - int cipher:1; /* n/a in C3 */ - unsigned int keygen:1; - int intern:1; - unsigned int encdec:1; - int ksize:2; - } b; - } cword; /* Control word */ - AES_KEY ks; /* Encryption key */ -}; - -/* Interface to assembler module */ -unsigned int padlock_capability(void); -void padlock_key_bswap(AES_KEY *key); -void padlock_verify_context(struct padlock_cipher_data *ctx); -void padlock_reload_key(void); -void padlock_aes_block(void *out, const void *inp, - struct padlock_cipher_data *ctx); -int padlock_ecb_encrypt(void *out, const void *inp, - struct padlock_cipher_data *ctx, size_t len); -int padlock_cbc_encrypt(void *out, const void *inp, - struct padlock_cipher_data *ctx, size_t len); -int padlock_cfb_encrypt(void *out, const void *inp, - struct padlock_cipher_data *ctx, size_t len); -int padlock_ofb_encrypt(void *out, const void *inp, - struct padlock_cipher_data *ctx, size_t len); -int padlock_ctr32_encrypt(void *out, const void *inp, - struct padlock_cipher_data *ctx, size_t len); -int padlock_xstore(void *out, int edx); -void padlock_sha1_oneshot(void *ctx, const void *inp, size_t len); -void padlock_sha1(void *ctx, const void *inp, size_t len); -void padlock_sha256_oneshot(void *ctx, const void *inp, size_t len); -void padlock_sha256(void *ctx, const void *inp, size_t len); - -/* - * Load supported features of the CPU to see if the PadLock is available. - */ -static int padlock_available(void) -{ - unsigned int edx = padlock_capability(); - - /* Fill up some flags */ - padlock_use_ace = ((edx & (0x3 << 6)) == (0x3 << 6)); - padlock_use_rng = ((edx & (0x3 << 2)) == (0x3 << 2)); - - return padlock_use_ace + padlock_use_rng; -} - -/* ===== AES encryption/decryption ===== */ - -# if defined(NID_aes_128_cfb128) && ! defined (NID_aes_128_cfb) -# define NID_aes_128_cfb NID_aes_128_cfb128 -# endif - -# if defined(NID_aes_128_ofb128) && ! defined (NID_aes_128_ofb) -# define NID_aes_128_ofb NID_aes_128_ofb128 -# endif - -# if defined(NID_aes_192_cfb128) && ! defined (NID_aes_192_cfb) -# define NID_aes_192_cfb NID_aes_192_cfb128 -# endif - -# if defined(NID_aes_192_ofb128) && ! defined (NID_aes_192_ofb) -# define NID_aes_192_ofb NID_aes_192_ofb128 -# endif - -# if defined(NID_aes_256_cfb128) && ! defined (NID_aes_256_cfb) -# define NID_aes_256_cfb NID_aes_256_cfb128 -# endif - -# if defined(NID_aes_256_ofb128) && ! defined (NID_aes_256_ofb) -# define NID_aes_256_ofb NID_aes_256_ofb128 -# endif - -/* List of supported ciphers. */ -static const int padlock_cipher_nids[] = { - NID_aes_128_ecb, - NID_aes_128_cbc, - NID_aes_128_cfb, - NID_aes_128_ofb, - NID_aes_128_ctr, - - NID_aes_192_ecb, - NID_aes_192_cbc, - NID_aes_192_cfb, - NID_aes_192_ofb, - NID_aes_192_ctr, - - NID_aes_256_ecb, - NID_aes_256_cbc, - NID_aes_256_cfb, - NID_aes_256_ofb, - NID_aes_256_ctr -}; - -static int padlock_cipher_nids_num = (sizeof(padlock_cipher_nids) / - sizeof(padlock_cipher_nids[0])); - -/* Function prototypes ... */ -static int padlock_aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, - const unsigned char *iv, int enc); - -# define NEAREST_ALIGNED(ptr) ( (unsigned char *)(ptr) + \ - ( (0x10 - ((size_t)(ptr) & 0x0F)) & 0x0F ) ) -# define ALIGNED_CIPHER_DATA(ctx) ((struct padlock_cipher_data *)\ - NEAREST_ALIGNED(EVP_CIPHER_CTX_get_cipher_data(ctx))) - -static int -padlock_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg, - const unsigned char *in_arg, size_t nbytes) -{ - return padlock_ecb_encrypt(out_arg, in_arg, - ALIGNED_CIPHER_DATA(ctx), nbytes); -} - -static int -padlock_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg, - const unsigned char *in_arg, size_t nbytes) -{ - struct padlock_cipher_data *cdata = ALIGNED_CIPHER_DATA(ctx); - int ret; - - memcpy(cdata->iv, EVP_CIPHER_CTX_iv(ctx), AES_BLOCK_SIZE); - if ((ret = padlock_cbc_encrypt(out_arg, in_arg, cdata, nbytes))) - memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), cdata->iv, AES_BLOCK_SIZE); - return ret; -} - -static int -padlock_cfb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg, - const unsigned char *in_arg, size_t nbytes) -{ - struct padlock_cipher_data *cdata = ALIGNED_CIPHER_DATA(ctx); - size_t chunk; - - if ((chunk = EVP_CIPHER_CTX_get_num(ctx))) { /* borrow chunk variable */ - unsigned char *ivp = EVP_CIPHER_CTX_iv_noconst(ctx); - - if (chunk >= AES_BLOCK_SIZE) - return 0; /* bogus value */ - - if (EVP_CIPHER_CTX_is_encrypting(ctx)) - while (chunk < AES_BLOCK_SIZE && nbytes != 0) { - ivp[chunk] = *(out_arg++) = *(in_arg++) ^ ivp[chunk]; - chunk++, nbytes--; - } else - while (chunk < AES_BLOCK_SIZE && nbytes != 0) { - unsigned char c = *(in_arg++); - *(out_arg++) = c ^ ivp[chunk]; - ivp[chunk++] = c, nbytes--; - } - - EVP_CIPHER_CTX_set_num(ctx, chunk % AES_BLOCK_SIZE); - } - - if (nbytes == 0) - return 1; - - memcpy(cdata->iv, EVP_CIPHER_CTX_iv(ctx), AES_BLOCK_SIZE); - - if ((chunk = nbytes & ~(AES_BLOCK_SIZE - 1))) { - if (!padlock_cfb_encrypt(out_arg, in_arg, cdata, chunk)) - return 0; - nbytes -= chunk; - } - - if (nbytes) { - unsigned char *ivp = cdata->iv; - - out_arg += chunk; - in_arg += chunk; - EVP_CIPHER_CTX_set_num(ctx, (int)nbytes); - if (cdata->cword.b.encdec) { - cdata->cword.b.encdec = 0; - padlock_reload_key(); - padlock_aes_block(ivp, ivp, cdata); - cdata->cword.b.encdec = 1; - padlock_reload_key(); - while (nbytes) { - unsigned char c = *(in_arg++); - *(out_arg++) = c ^ *ivp; - *(ivp++) = c, nbytes--; - } - } else { - padlock_reload_key(); - padlock_aes_block(ivp, ivp, cdata); - padlock_reload_key(); - while (nbytes) { - *ivp = *(out_arg++) = *(in_arg++) ^ *ivp; - ivp++, nbytes--; - } - } - } - - memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), cdata->iv, AES_BLOCK_SIZE); - - return 1; -} - -static int -padlock_ofb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg, - const unsigned char *in_arg, size_t nbytes) -{ - struct padlock_cipher_data *cdata = ALIGNED_CIPHER_DATA(ctx); - size_t chunk; - - /* - * ctx->num is maintained in byte-oriented modes, such as CFB and OFB... - */ - if ((chunk = EVP_CIPHER_CTX_get_num(ctx))) { /* borrow chunk variable */ - unsigned char *ivp = EVP_CIPHER_CTX_iv_noconst(ctx); - - if (chunk >= AES_BLOCK_SIZE) - return 0; /* bogus value */ - - while (chunk < AES_BLOCK_SIZE && nbytes != 0) { - *(out_arg++) = *(in_arg++) ^ ivp[chunk]; - chunk++, nbytes--; - } - - EVP_CIPHER_CTX_set_num(ctx, chunk % AES_BLOCK_SIZE); - } - - if (nbytes == 0) - return 1; - - memcpy(cdata->iv, EVP_CIPHER_CTX_iv(ctx), AES_BLOCK_SIZE); - - if ((chunk = nbytes & ~(AES_BLOCK_SIZE - 1))) { - if (!padlock_ofb_encrypt(out_arg, in_arg, cdata, chunk)) - return 0; - nbytes -= chunk; - } - - if (nbytes) { - unsigned char *ivp = cdata->iv; - - out_arg += chunk; - in_arg += chunk; - EVP_CIPHER_CTX_set_num(ctx, (int)nbytes); - padlock_reload_key(); /* empirically found */ - padlock_aes_block(ivp, ivp, cdata); - padlock_reload_key(); /* empirically found */ - while (nbytes) { - *(out_arg++) = *(in_arg++) ^ *ivp; - ivp++, nbytes--; - } - } - - memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), cdata->iv, AES_BLOCK_SIZE); - - return 1; -} - -static void padlock_ctr32_encrypt_glue(const unsigned char *in, - unsigned char *out, size_t blocks, - struct padlock_cipher_data *ctx, - const unsigned char *ivec) -{ - memcpy(ctx->iv, ivec, AES_BLOCK_SIZE); - padlock_ctr32_encrypt(out, in, ctx, AES_BLOCK_SIZE * blocks); -} - -static int -padlock_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg, - const unsigned char *in_arg, size_t nbytes) -{ - struct padlock_cipher_data *cdata = ALIGNED_CIPHER_DATA(ctx); - int n = EVP_CIPHER_CTX_get_num(ctx); - unsigned int num; - - if (n < 0) - return 0; - num = (unsigned int)n; - - CRYPTO_ctr128_encrypt_ctr32(in_arg, out_arg, nbytes, - cdata, EVP_CIPHER_CTX_iv_noconst(ctx), - EVP_CIPHER_CTX_buf_noconst(ctx), &num, - (ctr128_f) padlock_ctr32_encrypt_glue); - - EVP_CIPHER_CTX_set_num(ctx, (size_t)num); - return 1; -} - -# define EVP_CIPHER_block_size_ECB AES_BLOCK_SIZE -# define EVP_CIPHER_block_size_CBC AES_BLOCK_SIZE -# define EVP_CIPHER_block_size_OFB 1 -# define EVP_CIPHER_block_size_CFB 1 -# define EVP_CIPHER_block_size_CTR 1 - -/* - * Declaring so many ciphers by hand would be a pain. Instead introduce a bit - * of preprocessor magic :-) - */ -# define DECLARE_AES_EVP(ksize,lmode,umode) \ -static EVP_CIPHER *_hidden_aes_##ksize##_##lmode = NULL; \ -static const EVP_CIPHER *padlock_aes_##ksize##_##lmode(void) \ -{ \ - if (_hidden_aes_##ksize##_##lmode == NULL \ - && ((_hidden_aes_##ksize##_##lmode = \ - EVP_CIPHER_meth_new(NID_aes_##ksize##_##lmode, \ - EVP_CIPHER_block_size_##umode, \ - AES_KEY_SIZE_##ksize)) == NULL \ - || !EVP_CIPHER_meth_set_iv_length(_hidden_aes_##ksize##_##lmode, \ - AES_BLOCK_SIZE) \ - || !EVP_CIPHER_meth_set_flags(_hidden_aes_##ksize##_##lmode, \ - 0 | EVP_CIPH_##umode##_MODE) \ - || !EVP_CIPHER_meth_set_init(_hidden_aes_##ksize##_##lmode, \ - padlock_aes_init_key) \ - || !EVP_CIPHER_meth_set_do_cipher(_hidden_aes_##ksize##_##lmode, \ - padlock_##lmode##_cipher) \ - || !EVP_CIPHER_meth_set_impl_ctx_size(_hidden_aes_##ksize##_##lmode, \ - sizeof(struct padlock_cipher_data) + 16) \ - || !EVP_CIPHER_meth_set_set_asn1_params(_hidden_aes_##ksize##_##lmode, \ - EVP_CIPHER_set_asn1_iv) \ - || !EVP_CIPHER_meth_set_get_asn1_params(_hidden_aes_##ksize##_##lmode, \ - EVP_CIPHER_get_asn1_iv))) { \ - EVP_CIPHER_meth_free(_hidden_aes_##ksize##_##lmode); \ - _hidden_aes_##ksize##_##lmode = NULL; \ - } \ - return _hidden_aes_##ksize##_##lmode; \ -} - -DECLARE_AES_EVP(128, ecb, ECB) -DECLARE_AES_EVP(128, cbc, CBC) -DECLARE_AES_EVP(128, cfb, CFB) -DECLARE_AES_EVP(128, ofb, OFB) -DECLARE_AES_EVP(128, ctr, CTR) - -DECLARE_AES_EVP(192, ecb, ECB) -DECLARE_AES_EVP(192, cbc, CBC) -DECLARE_AES_EVP(192, cfb, CFB) -DECLARE_AES_EVP(192, ofb, OFB) -DECLARE_AES_EVP(192, ctr, CTR) - -DECLARE_AES_EVP(256, ecb, ECB) -DECLARE_AES_EVP(256, cbc, CBC) -DECLARE_AES_EVP(256, cfb, CFB) -DECLARE_AES_EVP(256, ofb, OFB) -DECLARE_AES_EVP(256, ctr, CTR) - -static int -padlock_ciphers(ENGINE *e, const EVP_CIPHER **cipher, const int **nids, - int nid) -{ - /* No specific cipher => return a list of supported nids ... */ - if (!cipher) { - *nids = padlock_cipher_nids; - return padlock_cipher_nids_num; - } - - /* ... or the requested "cipher" otherwise */ - switch (nid) { - case NID_aes_128_ecb: - *cipher = padlock_aes_128_ecb(); - break; - case NID_aes_128_cbc: - *cipher = padlock_aes_128_cbc(); - break; - case NID_aes_128_cfb: - *cipher = padlock_aes_128_cfb(); - break; - case NID_aes_128_ofb: - *cipher = padlock_aes_128_ofb(); - break; - case NID_aes_128_ctr: - *cipher = padlock_aes_128_ctr(); - break; - - case NID_aes_192_ecb: - *cipher = padlock_aes_192_ecb(); - break; - case NID_aes_192_cbc: - *cipher = padlock_aes_192_cbc(); - break; - case NID_aes_192_cfb: - *cipher = padlock_aes_192_cfb(); - break; - case NID_aes_192_ofb: - *cipher = padlock_aes_192_ofb(); - break; - case NID_aes_192_ctr: - *cipher = padlock_aes_192_ctr(); - break; - - case NID_aes_256_ecb: - *cipher = padlock_aes_256_ecb(); - break; - case NID_aes_256_cbc: - *cipher = padlock_aes_256_cbc(); - break; - case NID_aes_256_cfb: - *cipher = padlock_aes_256_cfb(); - break; - case NID_aes_256_ofb: - *cipher = padlock_aes_256_ofb(); - break; - case NID_aes_256_ctr: - *cipher = padlock_aes_256_ctr(); - break; - - default: - /* Sorry, we don't support this NID */ - *cipher = NULL; - return 0; - } - - return 1; -} - -/* Prepare the encryption key for PadLock usage */ -static int -padlock_aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, - const unsigned char *iv, int enc) -{ - struct padlock_cipher_data *cdata; - int key_len = EVP_CIPHER_CTX_get_key_length(ctx) * 8; - unsigned long mode = EVP_CIPHER_CTX_get_mode(ctx); - - if (key == NULL) - return 0; /* ERROR */ - - cdata = ALIGNED_CIPHER_DATA(ctx); - memset(cdata, 0, sizeof(*cdata)); - - /* Prepare Control word. */ - if (mode == EVP_CIPH_OFB_MODE || mode == EVP_CIPH_CTR_MODE) - cdata->cword.b.encdec = 0; - else - cdata->cword.b.encdec = (EVP_CIPHER_CTX_is_encrypting(ctx) == 0); - cdata->cword.b.rounds = 10 + (key_len - 128) / 32; - cdata->cword.b.ksize = (key_len - 128) / 64; - - switch (key_len) { - case 128: - /* - * PadLock can generate an extended key for AES128 in hardware - */ - memcpy(cdata->ks.rd_key, key, AES_KEY_SIZE_128); - cdata->cword.b.keygen = 0; - break; - - case 192: - case 256: - /* - * Generate an extended AES key in software. Needed for AES192/AES256 - */ - /* - * Well, the above applies to Stepping 8 CPUs and is listed as - * hardware errata. They most likely will fix it at some point and - * then a check for stepping would be due here. - */ - if ((mode == EVP_CIPH_ECB_MODE || mode == EVP_CIPH_CBC_MODE) - && !enc) - AES_set_decrypt_key(key, key_len, &cdata->ks); - else - AES_set_encrypt_key(key, key_len, &cdata->ks); - /* - * OpenSSL C functions use byte-swapped extended key. - */ - padlock_key_bswap(&cdata->ks); - cdata->cword.b.keygen = 1; - break; - - default: - /* ERROR */ - return 0; - } - - /* - * This is done to cover for cases when user reuses the - * context for new key. The catch is that if we don't do - * this, padlock_eas_cipher might proceed with old key... - */ - padlock_reload_key(); - - return 1; -} - -/* ===== Random Number Generator ===== */ -/* - * This code is not engaged. The reason is that it does not comply - * with recommendations for VIA RNG usage for secure applications - * (posted at http://www.via.com.tw/en/viac3/c3.jsp) nor does it - * provide meaningful error control... - */ -/* - * Wrapper that provides an interface between the API and the raw PadLock - * RNG - */ -static int padlock_rand_bytes(unsigned char *output, int count) -{ - unsigned int eax, buf; - - while (count >= 8) { - eax = padlock_xstore(output, 0); - if (!(eax & (1 << 6))) - return 0; /* RNG disabled */ - /* this ---vv--- covers DC bias, Raw Bits and String Filter */ - if (eax & (0x1F << 10)) - return 0; - if ((eax & 0x1F) == 0) - continue; /* no data, retry... */ - if ((eax & 0x1F) != 8) - return 0; /* fatal failure... */ - output += 8; - count -= 8; - } - while (count > 0) { - eax = padlock_xstore(&buf, 3); - if (!(eax & (1 << 6))) - return 0; /* RNG disabled */ - /* this ---vv--- covers DC bias, Raw Bits and String Filter */ - if (eax & (0x1F << 10)) - return 0; - if ((eax & 0x1F) == 0) - continue; /* no data, retry... */ - if ((eax & 0x1F) != 1) - return 0; /* fatal failure... */ - *output++ = (unsigned char)buf; - count--; - } - OPENSSL_cleanse(&buf, sizeof(buf)); - - return 1; -} - -/* Dummy but necessary function */ -static int padlock_rand_status(void) -{ - return 1; -} - -/* Prepare structure for registration */ -static RAND_METHOD padlock_rand = { - NULL, /* seed */ - padlock_rand_bytes, /* bytes */ - NULL, /* cleanup */ - NULL, /* add */ - padlock_rand_bytes, /* pseudorand */ - padlock_rand_status, /* rand status */ -}; - -# endif /* COMPILE_PADLOCKENG */ -#endif /* !OPENSSL_NO_PADLOCKENG */ - -#if defined(OPENSSL_NO_PADLOCKENG) || !defined(COMPILE_PADLOCKENG) -# ifndef OPENSSL_NO_DYNAMIC_ENGINE -OPENSSL_EXPORT - int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns); -OPENSSL_EXPORT - int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns) -{ - return 0; -} - -IMPLEMENT_DYNAMIC_CHECK_FN() -# endif -#endif diff --git a/exporters/build.info b/exporters/build.info index 9241dc9b0a..4ef487a41a 100644 --- a/exporters/build.info +++ b/exporters/build.info @@ -21,6 +21,6 @@ DEPEND[""]=openssl.pc GENERATE[../installdata.pm]=../util/mkinstallvars.pl \ "PREFIX=$(INSTALLTOP)" BINDIR=bin "LIBDIR=$(LIBDIR)" "libdir=$(libdir)" \ INCLUDEDIR=include APPLINKDIR=include/openssl \ - "ENGINESDIR=$(ENGINESDIR)" "MODULESDIR=$(MODULESDIR)" \ + "MODULESDIR=$(MODULESDIR)" \ "PKGCONFIGDIR=$(PKGCONFIGDIR)" "CMAKECONFIGDIR=$(CMAKECONFIGDIR)" \ "LDLIBS=$(LIB_EX_LIBS)" "VERSION=$(VERSION)" diff --git a/exporters/cmake/OpenSSLConfig.cmake.in b/exporters/cmake/OpenSSLConfig.cmake.in index 766aebe3d4..79602796cb 100644 --- a/exporters/cmake/OpenSSLConfig.cmake.in +++ b/exporters/cmake/OpenSSLConfig.cmake.in @@ -133,7 +133,6 @@ set(OPENSSL_LIBRARY_DIR "${_ossl_prefix}/{- unixify($OpenSSL::safe::installdata: set(OPENSSL_INCLUDE_DIR{- $OUT = ''; $OUT .= ' "${_ossl_prefix}/' . $_ . '"' foreach (@OpenSSL::safe::installdata::INCLUDEDIR_REL_PREFIX); -}) -set(OPENSSL_ENGINES_DIR "${_ossl_prefix}/{- unixify($OpenSSL::safe::installdata::LIBDIR_REL_PREFIX[0], 1); -}/{- unixify($OpenSSL::safe::installdata::ENGINESDIR_REL_LIBDIR[0], 1); -}") set(OPENSSL_MODULES_DIR "${_ossl_prefix}/{- unixify($OpenSSL::safe::installdata::LIBDIR_REL_PREFIX[0], 1); -}/{- unixify($OpenSSL::safe::installdata::MODULESDIR_REL_LIBDIR[0], 1); -}") set(OPENSSL_RUNTIME_DIR "${_ossl_prefix}/{- unixify($OpenSSL::safe::installdata::BINDIR_REL_PREFIX[0], 1); -}") {- output_off() if $disabled{uplink}; "" -} diff --git a/exporters/pkg-config/libcrypto.pc.in b/exporters/pkg-config/libcrypto.pc.in index 3d56e97418..952bd8130c 100644 --- a/exporters/pkg-config/libcrypto.pc.in +++ b/exporters/pkg-config/libcrypto.pc.in @@ -11,7 +11,6 @@ libdir={- if (defined $OpenSSL::safe::installdata::LIBDIR_REL_PREFIX[0]) { includedir={- $OUT = ''; $OUT .= '${prefix}/' . $_ . ' ' foreach (@OpenSSL::safe::installdata::INCLUDEDIR_REL_PREFIX); -} -enginesdir=${libdir}/{- $OpenSSL::safe::installdata::ENGINESDIR_REL_LIBDIR[0] -} modulesdir=${libdir}/{- $OpenSSL::safe::installdata::MODULESDIR_REL_LIBDIR[0] -} Name: OpenSSL-libcrypto diff --git a/include/crypto/cmac.h b/include/crypto/cmac.h index df55b68f8b..6ae2916a40 100644 --- a/include/crypto/cmac.h +++ b/include/crypto/cmac.h @@ -16,7 +16,6 @@ # include int ossl_cmac_init(CMAC_CTX *ctx, const void *key, size_t keylen, - const EVP_CIPHER *cipher, ENGINE *impl, - const OSSL_PARAM param[]); + const EVP_CIPHER *cipher, const OSSL_PARAM param[]); #endif /* OSSL_CRYPTO_CMAC_H */ diff --git a/include/crypto/engine.h b/include/crypto/engine.h deleted file mode 100644 index fac6ed0966..0000000000 --- a/include/crypto/engine.h +++ /dev/null @@ -1,20 +0,0 @@ -/* - * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#include - -void engine_load_openssl_int(void); -void engine_load_devcrypto_int(void); -void engine_load_rdrand_int(void); -void engine_load_dynamic_int(void); -void engine_load_padlock_int(void); -void engine_load_capi_int(void); -void engine_load_dasync_int(void); -void engine_load_afalg_int(void); -void engine_cleanup_int(void); diff --git a/include/crypto/engineerr.h b/include/crypto/engineerr.h deleted file mode 100644 index 737c841d64..0000000000 --- a/include/crypto/engineerr.h +++ /dev/null @@ -1,30 +0,0 @@ -/* - * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#ifndef OSSL_CRYPTO_ENGINEERR_H -# define OSSL_CRYPTO_ENGINEERR_H -# pragma once - -# include -# include - -# ifdef __cplusplus -extern "C" { -# endif - -# ifndef OPENSSL_NO_ENGINE - -int ossl_err_load_ENGINE_strings(void); -# endif - -# ifdef __cplusplus -} -# endif -#endif diff --git a/include/crypto/evp.h b/include/crypto/evp.h index ed867f77fb..6c729a3dca 100644 --- a/include/crypto/evp.h +++ b/include/crypto/evp.h @@ -121,8 +121,6 @@ struct evp_pkey_ctx_st { int legacy_keytype; /* Method associated with this operation */ const EVP_PKEY_METHOD *pmeth; - /* Engine that implements this method or NULL if builtin */ - ENGINE *engine; /* Key: may be NULL */ EVP_PKEY *pkey; /* Peer key for key agreement, may be NULL */ @@ -678,8 +676,6 @@ struct evp_pkey_st { * a pointer to a low level key and possibly a pointer to an engine. */ const EVP_PKEY_ASN1_METHOD *ameth; - ENGINE *engine; - ENGINE *pmeth_engine; /* If not NULL public key ENGINE to use */ /* Union to store the reference to an origin legacy key */ union legacy_pkey_st pkey; diff --git a/include/internal/common.h b/include/internal/common.h index 894dac9a4e..832fb0f9bc 100644 --- a/include/internal/common.h +++ b/include/internal/common.h @@ -229,7 +229,6 @@ static ossl_inline int ossl_is_absolute_path(const char *path) } const char *ossl_get_openssldir(void); -const char *ossl_get_enginesdir(void); const char *ossl_get_modulesdir(void); const char *ossl_get_wininstallcontext(void); diff --git a/include/openssl/cmac.h b/include/openssl/cmac.h index f50861836f..029ea141e7 100644 --- a/include/openssl/cmac.h +++ b/include/openssl/cmac.h @@ -36,7 +36,8 @@ OSSL_DEPRECATEDIN_3_0 EVP_CIPHER_CTX *CMAC_CTX_get0_cipher_ctx(CMAC_CTX *ctx); OSSL_DEPRECATEDIN_3_0 int CMAC_CTX_copy(CMAC_CTX *out, const CMAC_CTX *in); OSSL_DEPRECATEDIN_3_0 int CMAC_Init(CMAC_CTX *ctx, const void *key, size_t keylen, - const EVP_CIPHER *cipher, ENGINE *impl); + const EVP_CIPHER *cipher, + ENGINE *impl /* must be NULL */); OSSL_DEPRECATEDIN_3_0 int CMAC_Update(CMAC_CTX *ctx, const void *data, size_t dlen); OSSL_DEPRECATEDIN_3_0 int CMAC_Final(CMAC_CTX *ctx, diff --git a/include/openssl/crypto.h.in b/include/openssl/crypto.h.in index c78e72b7ed..0d9852cd9a 100644 --- a/include/openssl/crypto.h.in +++ b/include/openssl/crypto.h.in @@ -480,13 +480,6 @@ int CRYPTO_memcmp(const void * in_a, const void * in_b, size_t len); # define OPENSSL_INIT_LOAD_CONFIG 0x00000040L # define OPENSSL_INIT_NO_LOAD_CONFIG 0x00000080L # define OPENSSL_INIT_ASYNC 0x00000100L -# define OPENSSL_INIT_ENGINE_RDRAND 0x00000200L -# define OPENSSL_INIT_ENGINE_DYNAMIC 0x00000400L -# define OPENSSL_INIT_ENGINE_OPENSSL 0x00000800L -# define OPENSSL_INIT_ENGINE_CRYPTODEV 0x00001000L -# define OPENSSL_INIT_ENGINE_CAPI 0x00002000L -# define OPENSSL_INIT_ENGINE_PADLOCK 0x00004000L -# define OPENSSL_INIT_ENGINE_AFALG 0x00008000L /* FREE: 0x00010000L */ # define OPENSSL_INIT_ATFORK 0x00020000L /* OPENSSL_INIT_BASE_ONLY 0x00040000L */ @@ -500,11 +493,18 @@ int CRYPTO_memcmp(const void * in_a, const void * in_b, size_t len); /* FREE: 0x80000000L */ /* Max OPENSSL_INIT flag value is 0x80000000 */ -/* openssl and dasync not counted as builtin */ -# define OPENSSL_INIT_ENGINE_ALL_BUILTIN \ - (OPENSSL_INIT_ENGINE_RDRAND | OPENSSL_INIT_ENGINE_DYNAMIC \ - | OPENSSL_INIT_ENGINE_CRYPTODEV | OPENSSL_INIT_ENGINE_CAPI | \ - OPENSSL_INIT_ENGINE_PADLOCK) +/* ENGINEs are no longer available */ +# define OPENSSL_INIT_ENGINE_ALL_BUILTIN 0 + +# ifdef OPENSSL_ENGINE_STUBS +# define OPENSSL_INIT_ENGINE_RDRAND 0 +# define OPENSSL_INIT_ENGINE_DYNAMIC 0 +# define OPENSSL_INIT_ENGINE_OPENSSL 0 +# define OPENSSL_INIT_ENGINE_CRYPTODEV 0 +# define OPENSSL_INIT_ENGINE_CAPI 0 +# define OPENSSL_INIT_ENGINE_PADLOCK 0 +# define OPENSSL_INIT_ENGINE_AFALG 0 +# endif /* Library initialisation functions */ void OPENSSL_cleanup(void); diff --git a/include/openssl/cryptoerr_legacy.h b/include/openssl/cryptoerr_legacy.h index ccab33a5d4..16076bf49c 100644 --- a/include/openssl/cryptoerr_legacy.h +++ b/include/openssl/cryptoerr_legacy.h @@ -51,9 +51,6 @@ OSSL_DEPRECATEDIN_3_0 int ERR_load_DSA_strings(void); # ifndef OPENSSL_NO_EC OSSL_DEPRECATEDIN_3_0 int ERR_load_EC_strings(void); # endif -# ifndef OPENSSL_NO_ENGINE -OSSL_DEPRECATEDIN_3_0 int ERR_load_ENGINE_strings(void); -# endif OSSL_DEPRECATEDIN_3_0 int ERR_load_ERR_strings(void); OSSL_DEPRECATEDIN_3_0 int ERR_load_EVP_strings(void); OSSL_DEPRECATEDIN_3_0 int ERR_load_KDF_strings(void); @@ -751,7 +748,46 @@ OSSL_DEPRECATEDIN_3_0 int ERR_load_X509V3_strings(void); # define EC_F_VALIDATE_ECX_DERIVE 0 # endif -# ifndef OPENSSL_NO_ENGINE +# ifdef OPENSSL_ENGINE_STUBS +/* + * ENGINE reason codes. + */ +# define ENGINE_R_ALREADY_LOADED 0 +# define ENGINE_R_ARGUMENT_IS_NOT_A_NUMBER 0 +# define ENGINE_R_CMD_NOT_EXECUTABLE 0 +# define ENGINE_R_COMMAND_TAKES_INPUT 0 +# define ENGINE_R_COMMAND_TAKES_NO_INPUT 0 +# define ENGINE_R_CONFLICTING_ENGINE_ID 0 +# define ENGINE_R_CTRL_COMMAND_NOT_IMPLEMENTED 0 +# define ENGINE_R_DSO_FAILURE 0 +# define ENGINE_R_DSO_NOT_FOUND 0 +# define ENGINE_R_ENGINES_SECTION_ERROR 0 +# define ENGINE_R_ENGINE_CONFIGURATION_ERROR 0 +# define ENGINE_R_ENGINE_IS_NOT_IN_LIST 0 +# define ENGINE_R_ENGINE_SECTION_ERROR 0 +# define ENGINE_R_FAILED_LOADING_PRIVATE_KEY 0 +# define ENGINE_R_FAILED_LOADING_PUBLIC_KEY 0 +# define ENGINE_R_FINISH_FAILED 0 +# define ENGINE_R_ID_OR_NAME_MISSING 0 +# define ENGINE_R_INIT_FAILED 0 +# define ENGINE_R_INTERNAL_LIST_ERROR 0 +# define ENGINE_R_INVALID_ARGUMENT 0 +# define ENGINE_R_INVALID_CMD_NAME 0 +# define ENGINE_R_INVALID_CMD_NUMBER 0 +# define ENGINE_R_INVALID_INIT_VALUE 0 +# define ENGINE_R_INVALID_STRING 0 +# define ENGINE_R_NOT_INITIALISED 0 +# define ENGINE_R_NOT_LOADED 0 +# define ENGINE_R_NO_CONTROL_FUNCTION 0 +# define ENGINE_R_NO_INDEX 0 +# define ENGINE_R_NO_LOAD_FUNCTION 0 +# define ENGINE_R_NO_REFERENCE 0 +# define ENGINE_R_NO_SUCH_ENGINE 0 +# define ENGINE_R_UNIMPLEMENTED_CIPHER 0 +# define ENGINE_R_UNIMPLEMENTED_DIGEST 0 +# define ENGINE_R_UNIMPLEMENTED_PUBLIC_KEY_METHOD 0 +# define ENGINE_R_VERSION_INCOMPATIBILITY 0 + /* * ENGINE function codes. */ diff --git a/include/openssl/dh.h b/include/openssl/dh.h index 8906eac437..d1bf57576a 100644 --- a/include/openssl/dh.h +++ b/include/openssl/dh.h @@ -205,7 +205,7 @@ OSSL_DEPRECATEDIN_3_0 const DH_METHOD *DH_OpenSSL(void); OSSL_DEPRECATEDIN_3_0 void DH_set_default_method(const DH_METHOD *meth); OSSL_DEPRECATEDIN_3_0 const DH_METHOD *DH_get_default_method(void); OSSL_DEPRECATEDIN_3_0 int DH_set_method(DH *dh, const DH_METHOD *meth); -OSSL_DEPRECATEDIN_3_0 DH *DH_new_method(ENGINE *engine); +OSSL_DEPRECATEDIN_3_0 DH *DH_new_method(ENGINE *engine /* must be NULL */); OSSL_DEPRECATEDIN_3_0 DH *DH_new(void); OSSL_DEPRECATEDIN_3_0 void DH_free(DH *dh); @@ -275,7 +275,6 @@ OSSL_DEPRECATEDIN_3_0 const BIGNUM *DH_get0_pub_key(const DH *dh); OSSL_DEPRECATEDIN_3_0 void DH_clear_flags(DH *dh, int flags); OSSL_DEPRECATEDIN_3_0 int DH_test_flags(const DH *dh, int flags); OSSL_DEPRECATEDIN_3_0 void DH_set_flags(DH *dh, int flags); -OSSL_DEPRECATEDIN_3_0 ENGINE *DH_get0_engine(DH *d); OSSL_DEPRECATEDIN_3_0 long DH_get_length(const DH *dh); OSSL_DEPRECATEDIN_3_0 int DH_set_length(DH *dh, long length); diff --git a/include/openssl/dsa.h b/include/openssl/dsa.h index 245a46c7c3..c62ee98740 100644 --- a/include/openssl/dsa.h +++ b/include/openssl/dsa.h @@ -128,7 +128,7 @@ OSSL_DEPRECATEDIN_3_0 int DSA_set_method(DSA *dsa, const DSA_METHOD *); OSSL_DEPRECATEDIN_3_0 const DSA_METHOD *DSA_get_method(DSA *d); OSSL_DEPRECATEDIN_3_0 DSA *DSA_new(void); -OSSL_DEPRECATEDIN_3_0 DSA *DSA_new_method(ENGINE *engine); +OSSL_DEPRECATEDIN_3_0 DSA *DSA_new_method(ENGINE *engine /* must be NULL */); OSSL_DEPRECATEDIN_3_0 void DSA_free(DSA *r); /* "up" the DSA object's reference count */ OSSL_DEPRECATEDIN_3_0 int DSA_up_ref(DSA *r); @@ -218,7 +218,6 @@ OSSL_DEPRECATEDIN_3_0 const BIGNUM *DSA_get0_priv_key(const DSA *d); OSSL_DEPRECATEDIN_3_0 void DSA_clear_flags(DSA *d, int flags); OSSL_DEPRECATEDIN_3_0 int DSA_test_flags(const DSA *d, int flags); OSSL_DEPRECATEDIN_3_0 void DSA_set_flags(DSA *d, int flags); -OSSL_DEPRECATEDIN_3_0 ENGINE *DSA_get0_engine(DSA *d); OSSL_DEPRECATEDIN_3_0 DSA_METHOD *DSA_meth_new(const char *name, int flags); OSSL_DEPRECATEDIN_3_0 void DSA_meth_free(DSA_METHOD *dsam); diff --git a/include/openssl/ec.h b/include/openssl/ec.h index e1cbe98228..fcf4ebeb71 100644 --- a/include/openssl/ec.h +++ b/include/openssl/ec.h @@ -1040,12 +1040,6 @@ OSSL_DEPRECATEDIN_3_0 EC_KEY *EC_KEY_dup(const EC_KEY *src); */ OSSL_DEPRECATEDIN_3_0 int EC_KEY_up_ref(EC_KEY *key); -/** Returns the ENGINE object of a EC_KEY object - * \param eckey EC_KEY object - * \return the ENGINE object (possibly NULL). - */ -OSSL_DEPRECATEDIN_3_0 ENGINE *EC_KEY_get0_engine(const EC_KEY *eckey); - /** Returns the EC_GROUP object of a EC_KEY object * \param key EC_KEY object * \return the EC_GROUP object (possibly NULL). diff --git a/include/openssl/engine.h b/include/openssl/engine.h index 5b4b504be7..274a9bdef2 100644 --- a/include/openssl/engine.h +++ b/include/openssl/engine.h @@ -19,7 +19,72 @@ # include -# ifndef OPENSSL_NO_ENGINE +/* + * Engine support is gone. Definitions here are provided for the source code + * compatibility only. They are meant to keep compilation working for legacy + * projects that, for whatever reason, cannot remove/disable old legacy code. + * + * We deliberately keep the OPENSSL_NO_ENGINE macro around as it is supplied + * when the build is configured with the `no-engine` option. OpenSSL 4.0 keeps + * the `no-engine` option around. + * + * Note, we have to use a compile-time message to warn only if the API is really + * used. To avoid complex macros, we kind of abuse the existing OSSL_DEPRECATED + * macros. + */ + +# ifdef OPENSSL_ENGINE_STUBS +# define ENGINE_INFO_MSG \ + " API symbol is replaced with stub to avoid linker error." + +# define ENGINE_FUNC(ret_type, name, args, default_val) \ + OSSL_DEPRECATED_MESSAGE(#name ENGINE_INFO_MSG) \ + static inline ret_type name args \ + { \ + return default_val; /* stub return */ \ + } + +# define ENGINE_FUNC_NOARGS(ret_type, name, default_val) \ + OSSL_DEPRECATED_MESSAGE(#name ENGINE_INFO_MSG) \ + static inline ret_type name(void) \ + { \ + return default_val; /* stub return */ \ + } + +# define ENGINE_VOID_FUNC(name, args) \ + OSSL_DEPRECATED_MESSAGE(#name ENGINE_INFO_MSG) \ + static inline void name args \ + { \ + } + +# define ENGINE_VOID_FUNC_NOARGS(name) \ + OSSL_DEPRECATED_MESSAGE(#name ENGINE_INFO_MSG) \ + static inline void name(void) \ + { \ + } +# else /* OPENSSL_ENGINE_STUBS */ +# define ENGINE_INFO_MSG \ + " API symbol is removed. Define OPENSSL_ENGINE_STUBS to mask linker errors." + +# define ENGINE_FUNC(ret_type, name, args, default_val) \ + OSSL_DEPRECATED_MESSAGE(#name ENGINE_INFO_MSG) \ + ret_type name args; + +# define ENGINE_FUNC_NOARGS(ret_type, name, default_val) \ + OSSL_DEPRECATED_MESSAGE(#name ENGINE_INFO_MSG) \ + ret_type name(void); + +# define ENGINE_VOID_FUNC(name, args) \ + OSSL_DEPRECATED_MESSAGE(#name ENGINE_INFO_MSG) \ + void name args; + +# define ENGINE_VOID_FUNC_NOARGS(name) \ + OSSL_DEPRECATED_MESSAGE(#name ENGINE_INFO_MSG) \ + void name(void); +# endif /* OPENSSL_ENGINE_STUBS */ + +# ifdef ENGINE_FUNC + # ifndef OPENSSL_NO_DEPRECATED_1_1_0 # include # include @@ -38,6 +103,15 @@ extern "C" { # endif +/* Ignore stubs unused arguments */ +# if defined(__GNUC__) +# pragma GCC diagnostic push +# pragma GCC diagnostic ignored "-Wunused-value" +# elif defined(__clang__) +# pragma clang diagnostic push +# pragma clang diagnostic ignored "-Wunused-value" +# endif + /* * These flags are used to control combinations of algorithm (methods) by * bitwise "OR"ing. @@ -315,47 +389,52 @@ typedef int (*ENGINE_PKEY_ASN1_METHS_PTR) (ENGINE *, EVP_PKEY_ASN1_METHOD **, /* Get the first/last "ENGINE" type available. */ # ifndef OPENSSL_NO_DEPRECATED_3_0 -OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_first(void); -OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_last(void); +/* OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_first(void); */ +ENGINE_FUNC_NOARGS(ENGINE *, ENGINE_get_first, NULL) + +/* OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_last(void); */ +ENGINE_FUNC_NOARGS(ENGINE *, ENGINE_get_last, NULL) + # endif /* Iterate to the next/previous "ENGINE" type (NULL = end of the list). */ # ifndef OPENSSL_NO_DEPRECATED_3_0 -OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_next(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_prev(ENGINE *e); +/* OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_next(ENGINE *e); */ +ENGINE_FUNC(ENGINE *, ENGINE_get_next, (ENGINE *e), NULL) + +/* OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_prev(ENGINE *e); */ +ENGINE_FUNC(ENGINE *, ENGINE_get_prev, (ENGINE *e), NULL) + # endif /* Add another "ENGINE" type into the array. */ # ifndef OPENSSL_NO_DEPRECATED_3_0 -OSSL_DEPRECATEDIN_3_0 int ENGINE_add(ENGINE *e); +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_add(ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_add, (ENGINE *e), 0) # endif /* Remove an existing "ENGINE" type from the array. */ # ifndef OPENSSL_NO_DEPRECATED_3_0 -OSSL_DEPRECATEDIN_3_0 int ENGINE_remove(ENGINE *e); +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_remove(ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_remove, (ENGINE *e), 0) # endif /* Retrieve an engine from the list by its unique "id" value. */ # ifndef OPENSSL_NO_DEPRECATED_3_0 -OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_by_id(const char *id); +/* OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_by_id(const char *id); */ +ENGINE_FUNC(ENGINE *, ENGINE_by_id, (const char *id), NULL) # endif # ifndef OPENSSL_NO_DEPRECATED_1_1_0 -# define ENGINE_load_openssl() \ - OPENSSL_init_crypto(OPENSSL_INIT_ENGINE_OPENSSL, NULL) -# define ENGINE_load_dynamic() \ - OPENSSL_init_crypto(OPENSSL_INIT_ENGINE_DYNAMIC, NULL) +ENGINE_FUNC_NOARGS(int, ENGINE_load_openssl, 0) +ENGINE_FUNC_NOARGS(int, ENGINE_load_dynamic, 0) +ENGINE_FUNC_NOARGS(int, ENGINE_load_cryptodev, 0) +ENGINE_FUNC_NOARGS(int, ENGINE_load_rdrand, 0) # ifndef OPENSSL_NO_STATIC_ENGINE -# define ENGINE_load_padlock() \ - OPENSSL_init_crypto(OPENSSL_INIT_ENGINE_PADLOCK, NULL) -# define ENGINE_load_capi() \ - OPENSSL_init_crypto(OPENSSL_INIT_ENGINE_CAPI, NULL) -# define ENGINE_load_afalg() \ - OPENSSL_init_crypto(OPENSSL_INIT_ENGINE_AFALG, NULL) +ENGINE_FUNC_NOARGS(int, ENGINE_load_padlock, 0) +ENGINE_FUNC_NOARGS(int, ENGINE_load_capi, 0) +ENGINE_FUNC_NOARGS(int, ENGINE_load_afalg, 0) # endif -# define ENGINE_load_cryptodev() \ - OPENSSL_init_crypto(OPENSSL_INIT_ENGINE_CRYPTODEV, NULL) -# define ENGINE_load_rdrand() \ - OPENSSL_init_crypto(OPENSSL_INIT_ENGINE_RDRAND, NULL) # endif # ifndef OPENSSL_NO_DEPRECATED_3_0 -OSSL_DEPRECATEDIN_3_0 void ENGINE_load_builtin_engines(void); +/* OSSL_DEPRECATEDIN_3_0 void ENGINE_load_builtin_engines(void); */ +ENGINE_VOID_FUNC_NOARGS(ENGINE_load_builtin_engines) # endif /* @@ -363,8 +442,11 @@ OSSL_DEPRECATEDIN_3_0 void ENGINE_load_builtin_engines(void); * "registry" handling. */ # ifndef OPENSSL_NO_DEPRECATED_3_0 -OSSL_DEPRECATEDIN_3_0 unsigned int ENGINE_get_table_flags(void); -OSSL_DEPRECATEDIN_3_0 void ENGINE_set_table_flags(unsigned int flags); +/* OSSL_DEPRECATEDIN_3_0 unsigned int ENGINE_get_table_flags(void); */ +ENGINE_FUNC_NOARGS(unsigned int, ENGINE_get_table_flags, 0) + +/* OSSL_DEPRECATEDIN_3_0 void ENGINE_set_table_flags(unsigned int flags); */ +ENGINE_VOID_FUNC(ENGINE_set_table_flags, (unsigned int flags)) # endif /*- Manage registration of ENGINEs per "table". For each type, there are 3 @@ -375,33 +457,60 @@ OSSL_DEPRECATEDIN_3_0 void ENGINE_set_table_flags(unsigned int flags); * Cleanup is automatically registered from each table when required. */ # ifndef OPENSSL_NO_DEPRECATED_3_0 -OSSL_DEPRECATEDIN_3_0 int ENGINE_register_RSA(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 void ENGINE_unregister_RSA(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 void ENGINE_register_all_RSA(void); -OSSL_DEPRECATEDIN_3_0 int ENGINE_register_DSA(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 void ENGINE_unregister_DSA(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 void ENGINE_register_all_DSA(void); -OSSL_DEPRECATEDIN_3_0 int ENGINE_register_EC(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 void ENGINE_unregister_EC(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 void ENGINE_register_all_EC(void); -OSSL_DEPRECATEDIN_3_0 int ENGINE_register_DH(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 void ENGINE_unregister_DH(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 void ENGINE_register_all_DH(void); -OSSL_DEPRECATEDIN_3_0 int ENGINE_register_RAND(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 void ENGINE_unregister_RAND(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 void ENGINE_register_all_RAND(void); -OSSL_DEPRECATEDIN_3_0 int ENGINE_register_ciphers(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 void ENGINE_unregister_ciphers(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 void ENGINE_register_all_ciphers(void); -OSSL_DEPRECATEDIN_3_0 int ENGINE_register_digests(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 void ENGINE_unregister_digests(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 void ENGINE_register_all_digests(void); -OSSL_DEPRECATEDIN_3_0 int ENGINE_register_pkey_meths(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 void ENGINE_unregister_pkey_meths(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 void ENGINE_register_all_pkey_meths(void); -OSSL_DEPRECATEDIN_3_0 int ENGINE_register_pkey_asn1_meths(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 void ENGINE_unregister_pkey_asn1_meths(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 void ENGINE_register_all_pkey_asn1_meths(void); +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_register_RSA(ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_register_RSA, (ENGINE *e), 0) +/* OSSL_DEPRECATEDIN_3_0 void ENGINE_unregister_RSA(ENGINE *e); */ +ENGINE_VOID_FUNC(ENGINE_unregister_RSA, (ENGINE *e)) +/* OSSL_DEPRECATEDIN_3_0 void ENGINE_register_all_RSA(void); */ +ENGINE_VOID_FUNC_NOARGS(ENGINE_register_all_RSA) +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_register_DSA(ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_register_DSA, (ENGINE *e), 0) +/* OSSL_DEPRECATEDIN_3_0 void ENGINE_unregister_DSA(ENGINE *e); */ +ENGINE_VOID_FUNC(ENGINE_unregister_DSA, (ENGINE *e)) +/* OSSL_DEPRECATEDIN_3_0 void ENGINE_register_all_DSA(void); */ +ENGINE_VOID_FUNC_NOARGS(ENGINE_register_all_DSA) +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_register_EC(ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_register_EC, (ENGINE *e), 0) +/* OSSL_DEPRECATEDIN_3_0 void ENGINE_unregister_EC(ENGINE *e); */ +ENGINE_VOID_FUNC(ENGINE_unregister_EC, (ENGINE *e)) +/* OSSL_DEPRECATEDIN_3_0 void ENGINE_register_all_EC(void); */ +ENGINE_VOID_FUNC_NOARGS(ENGINE_unregister_all_EC) +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_register_DH(ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_register_DH, (ENGINE *e), 0) +/* OSSL_DEPRECATEDIN_3_0 void ENGINE_unregister_DH(ENGINE *e); */ +ENGINE_VOID_FUNC(ENGINE_unregister_DH, (ENGINE *e)) +/* OSSL_DEPRECATEDIN_3_0 void ENGINE_register_all_DH(void); */ +ENGINE_VOID_FUNC_NOARGS(ENGINE_register_all_DH) +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_register_RAND(ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_register_RAND, (ENGINE *e), 0) +/* OSSL_DEPRECATEDIN_3_0 void ENGINE_unregister_RAND(ENGINE *e); */ +ENGINE_VOID_FUNC(ENGINE_unregister_RAND, (ENGINE *e)) +/* OSSL_DEPRECATEDIN_3_0 void ENGINE_register_all_RAND(void); */ +ENGINE_VOID_FUNC_NOARGS(ENGINE_register_all_RAND) +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_register_ciphers(ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_register_ciphers, (ENGINE *e), 0) +/* OSSL_DEPRECATEDIN_3_0 void ENGINE_unregister_ciphers(ENGINE *e); */ +ENGINE_VOID_FUNC(ENGINE_unregister_ciphers, (ENGINE *e)) +/* OSSL_DEPRECATEDIN_3_0 void ENGINE_register_all_ciphers(void); */ +ENGINE_VOID_FUNC_NOARGS(ENGINE_register_all_ciphers) +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_register_digests(ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_register_digests, (ENGINE *e), 0) +/* OSSL_DEPRECATEDIN_3_0 void ENGINE_unregister_digests(ENGINE *e); */ +ENGINE_VOID_FUNC(ENGINE_unregister_digests, (ENGINE *e)) +/* OSSL_DEPRECATEDIN_3_0 void ENGINE_register_all_digests(void); */ +ENGINE_VOID_FUNC_NOARGS(ENGINE_register_all_digests) +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_register_pkey_meths(ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_register_pkey_meths, (ENGINE *e), 0) +/* OSSL_DEPRECATEDIN_3_0 void ENGINE_unregister_pkey_meths(ENGINE *e); */ +ENGINE_VOID_FUNC(ENGINE_unregister_pkey_meths, (ENGINE *e)) +/* OSSL_DEPRECATEDIN_3_0 void ENGINE_register_all_pkey_meths(void); */ +ENGINE_VOID_FUNC_NOARGS(ENGINE_register_all_pkey_meths) +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_register_pkey_asn1_meths(ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_register_pkey_asn1_meths, (ENGINE *e), 0) +/* OSSL_DEPRECATEDIN_3_0 void ENGINE_unregister_pkey_asn1_meths(ENGINE *e); */ +ENGINE_VOID_FUNC(ENGINE_unregister_pkey_asn1_meths, (ENGINE *e)) +/* OSSL_DEPRECATEDIN_3_0 void ENGINE_register_all_pkey_asn1_meths(void); */ +ENGINE_VOID_FUNC_NOARGS(ENGINE_register_all_pkey_asn1_meths) # endif /* @@ -411,8 +520,10 @@ OSSL_DEPRECATEDIN_3_0 void ENGINE_register_all_pkey_asn1_meths(void); * more selective initialisation. */ # ifndef OPENSSL_NO_DEPRECATED_3_0 -OSSL_DEPRECATEDIN_3_0 int ENGINE_register_complete(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 int ENGINE_register_all_complete(void); +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_register_complete(ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_register_complete, (ENGINE *e), 0) +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_register_all_complete(void); */ +ENGINE_FUNC_NOARGS(int, ENGINE_register_all_complete, 0) # endif /* @@ -426,8 +537,12 @@ OSSL_DEPRECATEDIN_3_0 int ENGINE_register_all_complete(void); * references in such situations. */ # ifndef OPENSSL_NO_DEPRECATED_3_0 -OSSL_DEPRECATEDIN_3_0 int ENGINE_ctrl(ENGINE *e, int cmd, long i, void *p, - void (*f) (void)); +/* + * OSSL_DEPRECATEDIN_3_0 int ENGINE_ctrl(ENGINE *e, int cmd, long i, void *p, + * void (*f) (void)); + */ +ENGINE_FUNC(int, ENGINE_ctrl, (ENGINE *e, int cmd, long i, void *p, + void (*f) (void)), 0) # endif /* @@ -437,7 +552,8 @@ OSSL_DEPRECATEDIN_3_0 int ENGINE_ctrl(ENGINE *e, int cmd, long i, void *p, * ENGINE_ctrl_cmd_string(), only ENGINE_ctrl(). */ # ifndef OPENSSL_NO_DEPRECATED_3_0 -OSSL_DEPRECATEDIN_3_0 int ENGINE_cmd_is_executable(ENGINE *e, int cmd); +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_cmd_is_executable(ENGINE *e, int cmd); */ +ENGINE_FUNC(int, ENGINE_cmd_is_executable, (ENGINE *e, int cmd), 0) # endif /* @@ -447,9 +563,14 @@ OSSL_DEPRECATEDIN_3_0 int ENGINE_cmd_is_executable(ENGINE *e, int cmd); * on how to use the cmd_name and cmd_optional. */ # ifndef OPENSSL_NO_DEPRECATED_3_0 -OSSL_DEPRECATEDIN_3_0 int ENGINE_ctrl_cmd(ENGINE *e, const char *cmd_name, - long i, void *p, void (*f) (void), - int cmd_optional); +/* + * OSSL_DEPRECATEDIN_3_0 int ENGINE_ctrl_cmd(ENGINE *e, const char *cmd_name, + * long i, void *p, void (*f) (void), + * int cmd_optional); + */ +ENGINE_FUNC(int, ENGINE_ctrl_cmd, (ENGINE *e, const char *cmd_name, long i, + void *p, void (*f) (void), + int cmd_optional), 0) # endif /* @@ -475,9 +596,13 @@ OSSL_DEPRECATEDIN_3_0 int ENGINE_ctrl_cmd(ENGINE *e, const char *cmd_name, * same ENGINE-enabled devices, across applications. */ # ifndef OPENSSL_NO_DEPRECATED_3_0 -OSSL_DEPRECATEDIN_3_0 -int ENGINE_ctrl_cmd_string(ENGINE *e, const char *cmd_name, const char *arg, - int cmd_optional); +/* + * OSSL_DEPRECATEDIN_3_0 + * int ENGINE_ctrl_cmd_string(ENGINE *e, const char *cmd_name, const char *arg, + * int cmd_optional); + */ +ENGINE_FUNC(int, ENGINE_ctrl_cmd_string, + (ENGINE *e, const char *cmd_name, const char *arg, int cmd_optional), 0) # endif /* @@ -489,50 +614,132 @@ int ENGINE_ctrl_cmd_string(ENGINE *e, const char *cmd_name, const char *arg, * exposed and break binary compatibility! */ # ifndef OPENSSL_NO_DEPRECATED_3_0 -OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_new(void); -OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 int ENGINE_up_ref(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 int ENGINE_set_id(ENGINE *e, const char *id); -OSSL_DEPRECATEDIN_3_0 int ENGINE_set_name(ENGINE *e, const char *name); -OSSL_DEPRECATEDIN_3_0 int ENGINE_set_RSA(ENGINE *e, const RSA_METHOD *rsa_meth); -OSSL_DEPRECATEDIN_3_0 int ENGINE_set_DSA(ENGINE *e, const DSA_METHOD *dsa_meth); -OSSL_DEPRECATEDIN_3_0 int ENGINE_set_EC(ENGINE *e, const EC_KEY_METHOD *ecdsa_meth); -OSSL_DEPRECATEDIN_3_0 int ENGINE_set_DH(ENGINE *e, const DH_METHOD *dh_meth); -OSSL_DEPRECATEDIN_3_0 int ENGINE_set_RAND(ENGINE *e, const RAND_METHOD *rand_meth); -OSSL_DEPRECATEDIN_3_0 -int ENGINE_set_destroy_function(ENGINE *e,ENGINE_GEN_INT_FUNC_PTR destroy_f); -OSSL_DEPRECATEDIN_3_0 -int ENGINE_set_init_function(ENGINE *e, ENGINE_GEN_INT_FUNC_PTR init_f); -OSSL_DEPRECATEDIN_3_0 -int ENGINE_set_finish_function(ENGINE *e, ENGINE_GEN_INT_FUNC_PTR finish_f); -OSSL_DEPRECATEDIN_3_0 -int ENGINE_set_ctrl_function(ENGINE *e, ENGINE_CTRL_FUNC_PTR ctrl_f); -OSSL_DEPRECATEDIN_3_0 -int ENGINE_set_load_privkey_function(ENGINE *e, ENGINE_LOAD_KEY_PTR loadpriv_f); -OSSL_DEPRECATEDIN_3_0 -int ENGINE_set_load_pubkey_function(ENGINE *e, ENGINE_LOAD_KEY_PTR loadpub_f); -OSSL_DEPRECATEDIN_3_0 -int ENGINE_set_load_ssl_client_cert_function(ENGINE *e, - ENGINE_SSL_CLIENT_CERT_PTR loadssl_f); -OSSL_DEPRECATEDIN_3_0 -int ENGINE_set_ciphers(ENGINE *e, ENGINE_CIPHERS_PTR f); -OSSL_DEPRECATEDIN_3_0 -int ENGINE_set_digests(ENGINE *e, ENGINE_DIGESTS_PTR f); -OSSL_DEPRECATEDIN_3_0 -int ENGINE_set_pkey_meths(ENGINE *e, ENGINE_PKEY_METHS_PTR f); -OSSL_DEPRECATEDIN_3_0 -int ENGINE_set_pkey_asn1_meths(ENGINE *e, ENGINE_PKEY_ASN1_METHS_PTR f); -OSSL_DEPRECATEDIN_3_0 int ENGINE_set_flags(ENGINE *e, int flags); -OSSL_DEPRECATEDIN_3_0 int ENGINE_set_cmd_defns(ENGINE *e, - const ENGINE_CMD_DEFN *defns); +/* OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_new(void); */ +ENGINE_FUNC_NOARGS(ENGINE *, ENGINE_new, NULL) +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_free, (ENGINE *e), 0) +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_up_ref(ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_up_ref, (ENGINE *e), 0) +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_set_id(ENGINE *e, const char *id); */ +ENGINE_FUNC(int, ENGINE_set_id, (ENGINE *e, const char *id), 0) +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_set_name(ENGINE *e, const char *name); */ +ENGINE_FUNC(int, ENGINE_set_name, (ENGINE *e, const char *name), 0) +/* + * OSSL_DEPRECATEDIN_3_0 + * int ENGINE_set_RSA(ENGINE *e, const RSA_METHOD *rsa_meth); + */ +ENGINE_FUNC(int, ENGINE_set_RSA, (ENGINE *e, const RSA_METHOD *rsa_meth), 0) +/* + * OSSL_DEPRECATEDIN_3_0 + * int ENGINE_set_DSA(ENGINE *e, const DSA_METHOD *dsa_meth); + */ +ENGINE_FUNC(int, ENGINE_set_DSA, (ENGINE *e, const DSA_METHOD *dsa_meth), 0) +/* + * OSSL_DEPRECATEDIN_3_0 + * int ENGINE_set_EC(ENGINE *e, const EC_KEY_METHOD *ecdsa_meth); + */ +ENGINE_FUNC(int, ENGINE_set_EC, (ENGINE *e, const EC_KEY_METHOD *ecdsa_meth), 0) +/* + * OSSL_DEPRECATEDIN_3_0 + * int ENGINE_set_DH(ENGINE *e, const DH_METHOD *dh_meth); + */ +ENGINE_FUNC(int, ENGINE_set_DH, (ENGINE *e, const DH_METHOD *dh_meth), 0) +/* + * OSSL_DEPRECATEDIN_3_0 + * int ENGINE_set_RAND(ENGINE *e, const RAND_METHOD *rand_meth); + */ +ENGINE_FUNC(int, ENGINE_set_RAND, (ENGINE *e, const RAND_METHOD *rand_meth), 0) +/* + * OSSL_DEPRECATEDIN_3_0 + * int ENGINE_set_destroy_function(ENGINE *e, ENGINE_GEN_INT_FUNC_PTR destroy_f); + */ +ENGINE_FUNC(int, ENGINE_set_destroy_function, + (ENGINE *e, ENGINE_GEN_INT_FUNC_PTR destroy_f), 0) +/* + * OSSL_DEPRECATEDIN_3_0 + * int ENGINE_set_init_function(ENGINE *e, ENGINE_GEN_INT_FUNC_PTR init_f); + */ +ENGINE_FUNC(int, ENGINE_set_init_function, + (ENGINE *e, ENGINE_GEN_INT_FUNC_PTR init_f), 0) +/* + * OSSL_DEPRECATEDIN_3_0 + * int ENGINE_set_finish_function(ENGINE *e, ENGINE_GEN_INT_FUNC_PTR finish_f); + */ +ENGINE_FUNC(int, ENGINE_set_finish_function, + (ENGINE *e, ENGINE_GEN_INT_FUNC_PTR finish_f), 0) +/* + * OSSL_DEPRECATEDIN_3_0 + * int ENGINE_set_ctrl_function(ENGINE *e, ENGINE_CTRL_FUNC_PTR ctrl_f); + */ +ENGINE_FUNC(int, ENGINE_set_ctrl_function, + (ENGINE *e, ENGINE_CTRL_FUNC_PTR ctrl_f), 0) +/* + * OSSL_DEPRECATEDIN_3_0 + * int ENGINE_set_load_privkey_function(ENGINE *e, ENGINE_LOAD_KEY_PTR loadpriv_f); + */ +ENGINE_FUNC(int, ENGINE_set_load_privkey_function, + (ENGINE *e, ENGINE_LOAD_KEY_PTR loadpriv_f), 0) +/* + * OSSL_DEPRECATEDIN_3_0 + * int ENGINE_set_load_pubkey_function(ENGINE *e, ENGINE_LOAD_KEY_PTR loadpub_f); + */ +ENGINE_FUNC(int, ENGINE_set_load_pubkey_function, + (ENGINE *e, ENGINE_LOAD_KEY_PTR loadpub_f), 0) +/* + * OSSL_DEPRECATEDIN_3_0 + * int ENGINE_set_load_ssl_client_cert_function(ENGINE *e, + * ENGINE_SSL_CLIENT_CERT_PTR loadssl_f); + */ +ENGINE_FUNC(int, ENGINE_set_load_ssl_client_cert_function, + (ENGINE *e, ENGINE_SSL_CLIENT_CERT_PTR loadssl_f), 0) +/* + * OSSL_DEPRECATEDIN_3_0 + * int ENGINE_set_ciphers(ENGINE *e, ENGINE_CIPHERS_PTR f); + */ +ENGINE_FUNC(int, ENGINE_set_ciphers, (ENGINE *e, ENGINE_CIPHERS_PTR f), 0) +/* + * OSSL_DEPRECATEDIN_3_0 + * int ENGINE_set_digests(ENGINE *e, ENGINE_DIGESTS_PTR f); + */ +ENGINE_FUNC(int, ENGINE_set_digests, (ENGINE *e, ENGINE_DIGESTS_PTR f), 0) +/* + * OSSL_DEPRECATEDIN_3_0 + * int ENGINE_set_pkey_meths(ENGINE *e, ENGINE_PKEY_METHS_PTR f); + */ +ENGINE_FUNC(int, ENGINE_set_pkey_meths, (ENGINE *e, ENGINE_PKEY_METHS_PTR f), 0) +/* + * OSSL_DEPRECATEDIN_3_0 + * int ENGINE_set_pkey_asn1_meths(ENGINE *e, ENGINE_PKEY_ASN1_METHS_PTR f); + */ +ENGINE_FUNC(int, ENGINE_set_pkey_asn1_meths, (ENGINE *e, ENGINE_PKEY_ASN1_METHS_PTR f), + 0) +/* + * OSSL_DEPRECATEDIN_3_0 int ENGINE_set_flags(ENGINE *e, int flags); + */ +ENGINE_FUNC(int, ENGINE_set_flags, (ENGINE *e, int flags), 0) +/* + * OSSL_DEPRECATEDIN_3_0 + * int ENGINE_set_cmd_defns(ENGINE *e, const ENGINE_CMD_DEFN *defns); + */ +ENGINE_FUNC(int, ENGINE_set_cmd_defns, (ENGINE *e, const ENGINE_CMD_DEFN *defns), 0) # endif /* These functions allow control over any per-structure ENGINE data. */ -# define ENGINE_get_ex_new_index(l, p, newf, dupf, freef) \ +# ifndef OPENSSL_ENGINE_STUBS +# define ENGINE_get_ex_new_index(l, p, newf, dupf, freef) \ CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_ENGINE, l, p, newf, dupf, freef) -# ifndef OPENSSL_NO_DEPRECATED_3_0 -OSSL_DEPRECATEDIN_3_0 int ENGINE_set_ex_data(ENGINE *e, int idx, void *arg); -OSSL_DEPRECATEDIN_3_0 void *ENGINE_get_ex_data(const ENGINE *e, int idx); -# endif +# else +ENGINE_FUNC(int, ENGINE_get_ex_new_index, (long l, void *p, CRYPTO_EX_new *newf, + CRYPTO_EX_dup *dupf, CRYPTO_EX_free *freef), 0) +# endif +# ifndef OPENSSL_NO_DEPRECATED_3_0 +/* + * OSSL_DEPRECATEDIN_3_0 + * int ENGINE_set_ex_data(ENGINE *e, int idx, void *arg); + */ +ENGINE_FUNC(int, ENGINE_set_ex_data, (ENGINE *e, int idx, void *arg), 0) +/* OSSL_DEPRECATEDIN_3_0 void *ENGINE_get_ex_data(const ENGINE *e, int idx); */ +ENGINE_FUNC(void *, ENGINE_get_ex_data, (ENGINE *e, int idx), NULL) +# endif # ifndef OPENSSL_NO_DEPRECATED_1_1_0 /* @@ -549,53 +756,132 @@ OSSL_DEPRECATEDIN_3_0 void *ENGINE_get_ex_data(const ENGINE *e, int idx); * obtained a structural reference may be problematic! */ # ifndef OPENSSL_NO_DEPRECATED_3_0 -OSSL_DEPRECATEDIN_3_0 const char *ENGINE_get_id(const ENGINE *e); -OSSL_DEPRECATEDIN_3_0 const char *ENGINE_get_name(const ENGINE *e); -OSSL_DEPRECATEDIN_3_0 const RSA_METHOD *ENGINE_get_RSA(const ENGINE *e); -OSSL_DEPRECATEDIN_3_0 const DSA_METHOD *ENGINE_get_DSA(const ENGINE *e); -OSSL_DEPRECATEDIN_3_0 const EC_KEY_METHOD *ENGINE_get_EC(const ENGINE *e); -OSSL_DEPRECATEDIN_3_0 const DH_METHOD *ENGINE_get_DH(const ENGINE *e); -OSSL_DEPRECATEDIN_3_0 const RAND_METHOD *ENGINE_get_RAND(const ENGINE *e); -OSSL_DEPRECATEDIN_3_0 -ENGINE_GEN_INT_FUNC_PTR ENGINE_get_destroy_function(const ENGINE *e); -OSSL_DEPRECATEDIN_3_0 -ENGINE_GEN_INT_FUNC_PTR ENGINE_get_init_function(const ENGINE *e); -OSSL_DEPRECATEDIN_3_0 -ENGINE_GEN_INT_FUNC_PTR ENGINE_get_finish_function(const ENGINE *e); -OSSL_DEPRECATEDIN_3_0 -ENGINE_CTRL_FUNC_PTR ENGINE_get_ctrl_function(const ENGINE *e); -OSSL_DEPRECATEDIN_3_0 -ENGINE_LOAD_KEY_PTR ENGINE_get_load_privkey_function(const ENGINE *e); -OSSL_DEPRECATEDIN_3_0 -ENGINE_LOAD_KEY_PTR ENGINE_get_load_pubkey_function(const ENGINE *e); -OSSL_DEPRECATEDIN_3_0 -ENGINE_SSL_CLIENT_CERT_PTR ENGINE_get_ssl_client_cert_function(const ENGINE *e); -OSSL_DEPRECATEDIN_3_0 -ENGINE_CIPHERS_PTR ENGINE_get_ciphers(const ENGINE *e); -OSSL_DEPRECATEDIN_3_0 -ENGINE_DIGESTS_PTR ENGINE_get_digests(const ENGINE *e); -OSSL_DEPRECATEDIN_3_0 -ENGINE_PKEY_METHS_PTR ENGINE_get_pkey_meths(const ENGINE *e); -OSSL_DEPRECATEDIN_3_0 -ENGINE_PKEY_ASN1_METHS_PTR ENGINE_get_pkey_asn1_meths(const ENGINE *e); -OSSL_DEPRECATEDIN_3_0 -const EVP_CIPHER *ENGINE_get_cipher(ENGINE *e, int nid); -OSSL_DEPRECATEDIN_3_0 -const EVP_MD *ENGINE_get_digest(ENGINE *e, int nid); -OSSL_DEPRECATEDIN_3_0 -const EVP_PKEY_METHOD *ENGINE_get_pkey_meth(ENGINE *e, int nid); -OSSL_DEPRECATEDIN_3_0 -const EVP_PKEY_ASN1_METHOD *ENGINE_get_pkey_asn1_meth(ENGINE *e, int nid); -OSSL_DEPRECATEDIN_3_0 -const EVP_PKEY_ASN1_METHOD *ENGINE_get_pkey_asn1_meth_str(ENGINE *e, - const char *str, - int len); -OSSL_DEPRECATEDIN_3_0 -const EVP_PKEY_ASN1_METHOD *ENGINE_pkey_asn1_find_str(ENGINE **pe, - const char *str, int len); -OSSL_DEPRECATEDIN_3_0 -const ENGINE_CMD_DEFN *ENGINE_get_cmd_defns(const ENGINE *e); -OSSL_DEPRECATEDIN_3_0 int ENGINE_get_flags(const ENGINE *e); +/* OSSL_DEPRECATEDIN_3_0 const char *ENGINE_get_id(const ENGINE *e); */ +ENGINE_FUNC(const char *, ENGINE_get_id, (const ENGINE *e), NULL) +/* OSSL_DEPRECATEDIN_3_0 const char *ENGINE_get_name(const ENGINE *e); */ +ENGINE_FUNC(const char *, ENGINE_get_name, (const ENGINE *e), NULL) +/* OSSL_DEPRECATEDIN_3_0 const RSA_METHOD *ENGINE_get_RSA(const ENGINE *e); */ +ENGINE_FUNC(const RSA_METHOD *, ENGINE_get_RSA, (const ENGINE *e), NULL) +/* OSSL_DEPRECATEDIN_3_0 const DSA_METHOD *ENGINE_get_DSA(const ENGINE *e); */ +ENGINE_FUNC(const DSA_METHOD *, ENGINE_get_DSA, (const ENGINE *e), NULL) +/* OSSL_DEPRECATEDIN_3_0 const EC_KEY_METHOD *ENGINE_get_EC(const ENGINE *e); */ +ENGINE_FUNC(const EC_KEY_METHOD *, ENGINE_get_EC, (const ENGINE *e), NULL) +/* OSSL_DEPRECATEDIN_3_0 const DH_METHOD *ENGINE_get_DH(const ENGINE *e); */ +ENGINE_FUNC(const DH_METHOD *, ENGINE_get_DH, (const ENGINE *e), NULL) +/* OSSL_DEPRECATEDIN_3_0 const RAND_METHOD *ENGINE_get_RAND(const ENGINE *e); */ +ENGINE_FUNC(const RAND_METHOD *, ENGINE_get_RAND, (const ENGINE *e), NULL) +/* + * OSSL_DEPRECATEDIN_3_0 + * ENGINE_GEN_INT_FUNC_PTR ENGINE_get_destroy_function(const ENGINE *e); + */ +ENGINE_FUNC(ENGINE_GEN_INT_FUNC_PTR, ENGINE_get_destroy_function, + (const ENGINE *e), NULL) +/* + * OSSL_DEPRECATEDIN_3_0 + * ENGINE_GEN_INT_FUNC_PTR ENGINE_get_init_function(const ENGINE *e); + */ +ENGINE_FUNC(ENGINE_GEN_INT_FUNC_PTR, ENGINE_get_init_function, + (const ENGINE *e), NULL) +/* + * OSSL_DEPRECATEDIN_3_0 + * ENGINE_GEN_INT_FUNC_PTR ENGINE_get_finish_function(const ENGINE *e); + */ +ENGINE_FUNC(ENGINE_GEN_INT_FUNC_PTR, ENGINE_get_finish_function, + (const ENGINE *e), NULL) +/* + * OSSL_DEPRECATEDIN_3_0 + * ENGINE_CTRL_FUNC_PTR ENGINE_get_ctrl_function(const ENGINE *e); + */ +ENGINE_FUNC(ENGINE_CTRL_FUNC_PTR, ENGINE_get_ctrl_function, + (const ENGINE *e), NULL) +/* + * OSSL_DEPRECATEDIN_3_0 + * ENGINE_LOAD_KEY_PTR ENGINE_get_load_privkey_function(const ENGINE *e); + */ +ENGINE_FUNC(ENGINE_LOAD_KEY_PTR, ENGINE_get_load_privkey_function, + (const ENGINE *e), NULL) +/* + * OSSL_DEPRECATEDIN_3_0 + * ENGINE_LOAD_KEY_PTR ENGINE_get_load_pubkey_function(const ENGINE *e); + */ +ENGINE_FUNC(ENGINE_LOAD_KEY_PTR, ENGINE_get_load_pubkey_function, + (const ENGINE *e), NULL) +/* + * OSSL_DEPRECATEDIN_3_0 ENGINE_SSL_CLIENT_CERT_PTR + * ENGINE_get_ssl_client_cert_function(const ENGINE *e); + */ +ENGINE_FUNC(ENGINE_SSL_CLIENT_CERT_PTR, ENGINE_get_ssl_client_cert_function, + (const ENGINE *e), NULL) +/* + * OSSL_DEPRECATEDIN_3_0 + * ENGINE_CIPHERS_PTR ENGINE_get_ciphers(const ENGINE *e); + */ +ENGINE_FUNC(ENGINE_CIPHERS_PTR, ENGINE_get_ciphers, + (const ENGINE *e), NULL) +/* + * OSSL_DEPRECATEDIN_3_0 + * ENGINE_DIGESTS_PTR ENGINE_get_digests(const ENGINE *e); + */ +ENGINE_FUNC(ENGINE_DIGESTS_PTR, ENGINE_get_digests, + (const ENGINE *e), NULL) +/* + * OSSL_DEPRECATEDIN_3_0 + * ENGINE_PKEY_METHS_PTR ENGINE_get_pkey_meths(const ENGINE *e); + */ +ENGINE_FUNC(ENGINE_PKEY_METHS_PTR, ENGINE_get_pkey_meths, + (const ENGINE *e), NULL) +/* + * OSSL_DEPRECATEDIN_3_0 + * ENGINE_PKEY_ASN1_METHS_PTR ENGINE_get_pkey_asn1_meths(const ENGINE *e); + */ +ENGINE_FUNC(ENGINE_PKEY_ASN1_METHS_PTR, ENGINE_get_pkey_asn1_meths, + (const ENGINE *e), NULL) +/* + * OSSL_DEPRECATEDIN_3_0 + * const EVP_CIPHER *ENGINE_get_cipher(ENGINE *e, int nid); + */ +ENGINE_FUNC(const EVP_CIPHER *, ENGINE_get_cipher, + (ENGINE *e, int nid), NULL) +/* + * OSSL_DEPRECATEDIN_3_0 + * const EVP_MD *ENGINE_get_digest(ENGINE *e, int nid); + */ +ENGINE_FUNC(const EVP_MD *, ENGINE_get_digest, + (ENGINE *e, int nid), NULL) +/* + * OSSL_DEPRECATEDIN_3_0 + * const EVP_PKEY_METHOD *ENGINE_get_pkey_meth(ENGINE *e, int nid); + */ +ENGINE_FUNC(const EVP_PKEY_METHOD *, ENGINE_get_pkey_meth, + (ENGINE *e, int nid), NULL) +/* + * OSSL_DEPRECATEDIN_3_0 + * const EVP_PKEY_ASN1_METHOD *ENGINE_get_pkey_asn1_meth(ENGINE *e, int nid); + */ +ENGINE_FUNC(const EVP_PKEY_ASN1_METHOD *, ENGINE_get_pkey_asn1_meth, + (ENGINE *e, int nid), NULL) +/* + * OSSL_DEPRECATEDIN_3_0 + * const EVP_PKEY_ASN1_METHOD *ENGINE_get_pkey_asn1_meth_str(ENGINE *e, + * const char *str, int len); + */ +ENGINE_FUNC(const EVP_PKEY_ASN1_METHOD *, ENGINE_get_pkey_asn1_meth_str, + (ENGINE *e, const char *str, int len), NULL) +/* + * OSSL_DEPRECATEDIN_3_0 + * const EVP_PKEY_ASN1_METHOD *ENGINE_pkey_asn1_find_str(ENGINE **pe, + * const char *str, int len); + */ +ENGINE_FUNC(const EVP_PKEY_ASN1_METHOD *, ENGINE_pkey_asn1_find_str, + (ENGINE **pe, const char *str, int len), NULL) +/* + * OSSL_DEPRECATEDIN_3_0 + * const ENGINE_CMD_DEFN *ENGINE_get_cmd_defns(const ENGINE *e); + */ +ENGINE_FUNC(const ENGINE_CMD_DEFN *, ENGINE_get_cmd_defns, + (const ENGINE *e), NULL) +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_get_flags(const ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_get_flags, (const ENGINE *e), 0) # endif /* @@ -617,7 +903,8 @@ OSSL_DEPRECATEDIN_3_0 int ENGINE_get_flags(const ENGINE *e); * and cannot initialise. */ # ifndef OPENSSL_NO_DEPRECATED_3_0 -OSSL_DEPRECATEDIN_3_0 int ENGINE_init(ENGINE *e); +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_init(ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_init, (ENGINE *e), 0) # endif /* * Free a functional reference to an engine type. This does not require a @@ -625,7 +912,8 @@ OSSL_DEPRECATEDIN_3_0 int ENGINE_init(ENGINE *e); * reference. */ # ifndef OPENSSL_NO_DEPRECATED_3_0 -OSSL_DEPRECATEDIN_3_0 int ENGINE_finish(ENGINE *e); +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_finish(ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_finish, (ENGINE *e), 0) # endif /* @@ -634,17 +922,33 @@ OSSL_DEPRECATEDIN_3_0 int ENGINE_finish(ENGINE *e); * whatever. */ # ifndef OPENSSL_NO_DEPRECATED_3_0 -OSSL_DEPRECATEDIN_3_0 -EVP_PKEY *ENGINE_load_private_key(ENGINE *e, const char *key_id, - UI_METHOD *ui_method, void *callback_data); -OSSL_DEPRECATEDIN_3_0 -EVP_PKEY *ENGINE_load_public_key(ENGINE *e, const char *key_id, - UI_METHOD *ui_method, void *callback_data); -OSSL_DEPRECATEDIN_3_0 -int ENGINE_load_ssl_client_cert(ENGINE *e, SSL *s, STACK_OF(X509_NAME) *ca_dn, - X509 **pcert, EVP_PKEY **ppkey, - STACK_OF(X509) **pother, - UI_METHOD *ui_method, void *callback_data); +/* + * OSSL_DEPRECATEDIN_3_0 + * EVP_PKEY *ENGINE_load_private_key(ENGINE *e, const char *key_id, + * UI_METHOD *ui_method, void *callback_data); + */ +ENGINE_FUNC(EVP_PKEY *, ENGINE_load_private_key, + (ENGINE *e, const char *key_id, UI_METHOD *ui_method, + void *callback_data), NULL) +/* + * OSSL_DEPRECATEDIN_3_0 + * EVP_PKEY *ENGINE_load_public_key(ENGINE *e, const char *key_id, + * UI_METHOD *ui_method, void *callback_data); + */ +ENGINE_FUNC(EVP_PKEY *, ENGINE_load_public_key, + (ENGINE *e, const char *key_id, UI_METHOD *ui_method, + void *callback_data), NULL) +/* + * OSSL_DEPRECATEDIN_3_0 + * int ENGINE_load_ssl_client_cert(ENGINE *e, SSL *s, STACK_OF(X509_NAME) *ca_dn, + * X509 **pcert, EVP_PKEY **ppkey, + * STACK_OF(X509) **pother, + * UI_METHOD *ui_method, void *callback_data); + */ +ENGINE_FUNC(int, ENGINE_load_ssl_client_cert, + (ENGINE *e, SSL *s, STACK_OF(X509_NAME) *ca_dn, X509 **pcert, + EVP_PKEY **ppkey, STACK_OF(X509) **pother, UI_METHOD *ui_method, + void *callback_data), 0) # endif /* @@ -654,24 +958,33 @@ int ENGINE_load_ssl_client_cert(ENGINE *e, SSL *s, STACK_OF(X509_NAME) *ca_dn, * discarded. */ # ifndef OPENSSL_NO_DEPRECATED_3_0 -OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_default_RSA(void); +/* OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_default_RSA(void); */ +ENGINE_FUNC_NOARGS(ENGINE *, ENGINE_get_default_RSA, NULL) # endif /* Same for the other "methods" */ # ifndef OPENSSL_NO_DEPRECATED_3_0 -OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_default_DSA(void); -OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_default_EC(void); -OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_default_DH(void); -OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_default_RAND(void); +/* OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_default_DSA(void); */ +ENGINE_FUNC_NOARGS(ENGINE *, ENGINE_get_default_DSA, NULL) +/* OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_default_EC(void); */ +ENGINE_FUNC_NOARGS(ENGINE *, ENGINE_get_default_EC, NULL) +/* OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_default_DH(void); */ +ENGINE_FUNC_NOARGS(ENGINE *, ENGINE_get_default_DH, NULL) +/* OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_default_RAND(void); */ +ENGINE_FUNC_NOARGS(ENGINE *, ENGINE_get_default_RAND, NULL) # endif /* * These functions can be used to get a functional reference to perform * ciphering or digesting corresponding to "nid". */ # ifndef OPENSSL_NO_DEPRECATED_3_0 -OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_cipher_engine(int nid); -OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_digest_engine(int nid); -OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_pkey_meth_engine(int nid); -OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_pkey_asn1_meth_engine(int nid); +/* OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_cipher_engine(int nid); */ +ENGINE_FUNC(ENGINE *, ENGINE_get_cipher_engine, (int nid), NULL) +/* OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_digest_engine(int nid); */ +ENGINE_FUNC(ENGINE *, ENGINE_get_digest_engine, (int nid), NULL) +/* OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_pkey_meth_engine(int nid); */ +ENGINE_FUNC(ENGINE *, ENGINE_get_pkey_meth_engine, (int nid), NULL) +/* OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_pkey_asn1_meth_engine(int nid); */ +ENGINE_FUNC(ENGINE *, ENGINE_get_pkey_asn1_meth_engine, (int nid), NULL) # endif /* @@ -681,20 +994,32 @@ OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_get_pkey_asn1_meth_engine(int nid); * reference 'e'. */ # ifndef OPENSSL_NO_DEPRECATED_3_0 -OSSL_DEPRECATEDIN_3_0 int ENGINE_set_default_RSA(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 int ENGINE_set_default_string(ENGINE *e, - const char *def_list); +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_set_default_RSA(ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_set_default_RSA, (ENGINE *e), 0) +/* + * OSSL_DEPRECATEDIN_3_0 int ENGINE_set_default_string(ENGINE *e, + * const char *def_list); + */ +ENGINE_FUNC(int, ENGINE_set_default_string, (ENGINE *e, const char *def_list), 0) # endif /* Same for the other "methods" */ # ifndef OPENSSL_NO_DEPRECATED_3_0 -OSSL_DEPRECATEDIN_3_0 int ENGINE_set_default_DSA(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 int ENGINE_set_default_EC(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 int ENGINE_set_default_DH(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 int ENGINE_set_default_RAND(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 int ENGINE_set_default_ciphers(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 int ENGINE_set_default_digests(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 int ENGINE_set_default_pkey_meths(ENGINE *e); -OSSL_DEPRECATEDIN_3_0 int ENGINE_set_default_pkey_asn1_meths(ENGINE *e); +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_set_default_DSA(ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_set_default_DSA, (ENGINE *e), 0) +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_set_default_EC(ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_set_default_EC, (ENGINE *e), 0) +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_set_default_DH(ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_set_default_DH, (ENGINE *e), 0) +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_set_default_RAND(ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_set_default_RAND, (ENGINE *e), 0) +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_set_default_ciphers(ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_set_default_ciphers, (ENGINE *e), 0) +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_set_default_digests(ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_set_default_digests, (ENGINE *e), 0) +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_set_default_pkey_meths(ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_set_default_pkey_meths, (ENGINE *e), 0) +/* OSSL_DEPRECATEDIN_3_0 int ENGINE_set_default_pkey_asn1_meths(ENGINE *e); */ +ENGINE_FUNC(int, ENGINE_set_default_pkey_asn1_meths, (ENGINE *e), 0) # endif /* @@ -705,8 +1030,13 @@ OSSL_DEPRECATEDIN_3_0 int ENGINE_set_default_pkey_asn1_meths(ENGINE *e); * selective functions. */ # ifndef OPENSSL_NO_DEPRECATED_3_0 -OSSL_DEPRECATEDIN_3_0 int ENGINE_set_default(ENGINE *e, unsigned int flags); -OSSL_DEPRECATEDIN_3_0 void ENGINE_add_conf_module(void); +/* + * OSSL_DEPRECATEDIN_3_0 + * int ENGINE_set_default(ENGINE *e, unsigned int flags); + */ +ENGINE_FUNC(int, ENGINE_set_default, (ENGINE *e, unsigned int flags), 0) +/* OSSL_DEPRECATEDIN_3_0 void ENGINE_add_conf_module(void); */ +ENGINE_VOID_FUNC_NOARGS(ENGINE_add_conf_module) # endif /* Deprecated functions ... */ @@ -754,37 +1084,27 @@ typedef struct st_dynamic_fns { } dynamic_fns; /* - * The version checking function should be of this prototype. NB: The - * ossl_version value passed in is the OSSL_DYNAMIC_VERSION of the loading - * code. If this function returns zero, it indicates a (potential) version + * The version checking function should be of this prototype. + * As a stub, this function returns zero, it indicates a (potential) version * incompatibility and the loaded library doesn't believe it can proceed. - * Otherwise, the returned value is the (latest) version supported by the - * loading library. The loader may still decide that the loaded code's - * version is unsatisfactory and could veto the load. The function is - * expected to be implemented with the symbol name "v_check", and a default - * implementation can be fully instantiated with + * The function is expected to be implemented with the symbol name "v_check", + * and a default implementation can be fully instantiated with * IMPLEMENT_DYNAMIC_CHECK_FN(). */ typedef unsigned long (*dynamic_v_check_fn) (unsigned long ossl_version); # define IMPLEMENT_DYNAMIC_CHECK_FN() \ - OPENSSL_EXPORT unsigned long v_check(unsigned long v); \ - OPENSSL_EXPORT unsigned long v_check(unsigned long v) { \ - if (v >= OSSL_DYNAMIC_OLDEST) return OSSL_DYNAMIC_VERSION; \ - return 0; } + OPENSSL_EXPORT unsigned long v_check(unsigned long v); \ + OPENSSL_EXPORT unsigned long v_check(unsigned long v) \ + { \ + return 0; \ + } /* * This function is passed the ENGINE structure to initialise with its own * function and command settings. It should not adjust the structural or - * functional reference counts. If this function returns zero, (a) the load - * will be aborted, (b) the previous ENGINE state will be memcpy'd back onto - * the structure, and (c) the shared library will be unloaded. So - * implementations should do their own internal cleanup in failure - * circumstances otherwise they could leak. The 'id' parameter, if non-NULL, - * represents the ENGINE id that the loader is looking for. If this is NULL, - * the shared library can choose to return failure or to initialise a - * 'default' ENGINE. If non-NULL, the shared library must initialise only an - * ENGINE matching the passed 'id'. The function is expected to be - * implemented with the symbol name "bind_engine". A standard implementation + * functional reference counts. As a stub, this function returns zero, the load + * will be aborted. The function is expected to be implemented with the symbol + * name "bind_engine". A standard implementation * can be instantiated with IMPLEMENT_DYNAMIC_BIND_FN(fn) where the parameter * 'fn' is a callback function that populates the ENGINE structure and * returns an int value (zero for failure). 'fn' should have prototype; @@ -793,18 +1113,13 @@ typedef unsigned long (*dynamic_v_check_fn) (unsigned long ossl_version); typedef int (*dynamic_bind_engine) (ENGINE *e, const char *id, const dynamic_fns *fns); # define IMPLEMENT_DYNAMIC_BIND_FN(fn) \ - OPENSSL_EXPORT \ - int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns); \ - OPENSSL_EXPORT \ - int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns) { \ - if (ENGINE_get_static_state() == fns->static_state) goto skip_cbs; \ - CRYPTO_set_mem_functions(fns->mem_fns.malloc_fn, \ - fns->mem_fns.realloc_fn, \ - fns->mem_fns.free_fn); \ - OPENSSL_init_crypto(OPENSSL_INIT_NO_ATEXIT, NULL); \ - skip_cbs: \ - if (!fn(e, id)) return 0; \ - return 1; } + OPENSSL_EXPORT \ + int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns); \ + OPENSSL_EXPORT \ + int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns) \ + { \ + return 0; \ + } /* * If the loading application (or library) and the loaded ENGINE library @@ -817,17 +1132,80 @@ typedef int (*dynamic_bind_engine) (ENGINE *e, const char *id, * static data and let the loading application and loaded ENGINE compare * their respective values. */ -void *ENGINE_get_static_state(void); +/* void *ENGINE_get_static_state(void); */ +ENGINE_FUNC_NOARGS(void *, ENGINE_get_static_state, NULL) # if defined(__OpenBSD__) || defined(__FreeBSD__) || defined(__DragonFly__) # ifndef OPENSSL_NO_DEPRECATED_1_1_0 -OSSL_DEPRECATEDIN_1_1_0 void ENGINE_setup_bsd_cryptodev(void); +/* OSSL_DEPRECATEDIN_1_1_0 void ENGINE_setup_bsd_cryptodev(void); */ +ENGINE_VOID_FUNC_NOARGS(ENGINE_setup_bsd_cryptodev) # endif # endif +/* + * Stubs for ENGINE-related API functions that were removed + * from other headers. + */ + +/* int ossl_err_load_ENGINE_strings(void); */ +ENGINE_FUNC_NOARGS(int, ossl_err_load_ENGINE_strings, 1) + +/* int EVP_PKEY_set1_engine(EVP_PKEY *pkey, ENGINE *e); */ +ENGINE_FUNC(int, EVP_PKEY_set1_engine, (EVP_PKEY *pkey, ENGINE *e), 0) + +/* ENGINE *EVP_PKEY_get0_engine(const EVP_PKEY *pkey); */ +ENGINE_FUNC(ENGINE *, EVP_PKEY_get0_engine, (const EVP_PKEY *pkey), NULL) + +/* ENGINE *DH_get0_engine(DH *d); */ +ENGINE_FUNC(ENGINE *, DH_get0_engine, (DH *d), NULL) + +/* ENGINE *RSA_get0_engine(const RSA *r); */ +ENGINE_FUNC(ENGINE *, RSA_get0_engine, (const RSA *r), NULL) + +/* ENGINE *DSA_get0_engine(DSA *d); */ +ENGINE_FUNC(ENGINE *, DSA_get0_engine, (DSA *d), NULL) + +/* ENGINE *EC_KEY_get0_engine(const EC_KEY *eckey); */ +ENGINE_FUNC(ENGINE *, EC_KEY_get0_engine, (const EC_KEY *eckey), NULL) + +/* const ENGINE *OSSL_STORE_LOADER_get0_engine(const OSSL_STORE_LOADER *loader); */ +ENGINE_FUNC(const ENGINE *, OSSL_STORE_LOADER_get0_engine, (const OSSL_STORE_LOADER *loader), + NULL) + +/* int RAND_set_rand_engine(ENGINE *engine); */ +ENGINE_FUNC(int, RAND_set_rand_engine, (ENGINE *engine), 0) + +/* + * int TS_CONF_set_crypto_device(CONF *conf, const char *section, + * const char *device); + */ +ENGINE_FUNC(int, TS_CONF_set_crypto_device, + (CONF *conf, const char *section, const char *device), 0) + +/* int TS_CONF_set_default_engine(const char *name); */ +ENGINE_FUNC(int, TS_CONF_set_default_engine, (const char *name), 0) + +/* int ERR_load_ENGINE_strings(void); */ +ENGINE_FUNC_NOARGS(int, ERR_load_ENGINE_strings, 1) + +/* int SSL_CTX_set_client_cert_engine(SSL_CTX *ctx, ENGINE *e); */ +ENGINE_FUNC(int, SSL_CTX_set_client_cert_engine, (SSL_CTX *ctx, ENGINE *e), 0) # ifdef __cplusplus } # endif -# endif /* OPENSSL_NO_ENGINE */ + +# undef ENGINE_INFO_MSG +# undef ENGINE_FUNC +# undef ENGINE_VOID_FUNC +# undef ENGINE_FUNC_NOARGS +# undef ENGINE_VOID_FUNC_NOARGS + +# if defined(__GNUC__) +# pragma GCC diagnostic pop +# elif defined(__clang__) +# pragma clang diagnostic pop +# endif + +# endif #endif /* OPENSSL_ENGINE_H */ diff --git a/include/openssl/engineerr.h b/include/openssl/engineerr.h index d439b6827e..d30b1e768a 100644 --- a/include/openssl/engineerr.h +++ b/include/openssl/engineerr.h @@ -16,48 +16,4 @@ # include # include - -# ifndef OPENSSL_NO_ENGINE - - -/* - * ENGINE reason codes. - */ -# define ENGINE_R_ALREADY_LOADED 100 -# define ENGINE_R_ARGUMENT_IS_NOT_A_NUMBER 133 -# define ENGINE_R_CMD_NOT_EXECUTABLE 134 -# define ENGINE_R_COMMAND_TAKES_INPUT 135 -# define ENGINE_R_COMMAND_TAKES_NO_INPUT 136 -# define ENGINE_R_CONFLICTING_ENGINE_ID 103 -# define ENGINE_R_CTRL_COMMAND_NOT_IMPLEMENTED 119 -# define ENGINE_R_DSO_FAILURE 104 -# define ENGINE_R_DSO_NOT_FOUND 132 -# define ENGINE_R_ENGINES_SECTION_ERROR 148 -# define ENGINE_R_ENGINE_CONFIGURATION_ERROR 102 -# define ENGINE_R_ENGINE_IS_NOT_IN_LIST 105 -# define ENGINE_R_ENGINE_SECTION_ERROR 149 -# define ENGINE_R_FAILED_LOADING_PRIVATE_KEY 128 -# define ENGINE_R_FAILED_LOADING_PUBLIC_KEY 129 -# define ENGINE_R_FINISH_FAILED 106 -# define ENGINE_R_ID_OR_NAME_MISSING 108 -# define ENGINE_R_INIT_FAILED 109 -# define ENGINE_R_INTERNAL_LIST_ERROR 110 -# define ENGINE_R_INVALID_ARGUMENT 143 -# define ENGINE_R_INVALID_CMD_NAME 137 -# define ENGINE_R_INVALID_CMD_NUMBER 138 -# define ENGINE_R_INVALID_INIT_VALUE 151 -# define ENGINE_R_INVALID_STRING 150 -# define ENGINE_R_NOT_INITIALISED 117 -# define ENGINE_R_NOT_LOADED 112 -# define ENGINE_R_NO_CONTROL_FUNCTION 120 -# define ENGINE_R_NO_INDEX 144 -# define ENGINE_R_NO_LOAD_FUNCTION 125 -# define ENGINE_R_NO_REFERENCE 130 -# define ENGINE_R_NO_SUCH_ENGINE 116 -# define ENGINE_R_UNIMPLEMENTED_CIPHER 146 -# define ENGINE_R_UNIMPLEMENTED_DIGEST 147 -# define ENGINE_R_UNIMPLEMENTED_PUBLIC_KEY_METHOD 101 -# define ENGINE_R_VERSION_INCOMPATIBILITY 145 - -# endif #endif diff --git a/include/openssl/evp.h b/include/openssl/evp.h index ff82695c99..370e0fef25 100644 --- a/include/openssl/evp.h +++ b/include/openssl/evp.h @@ -745,7 +745,7 @@ int EVP_MD_CTX_test_flags(const EVP_MD_CTX *ctx, int flags); __owur int EVP_DigestInit_ex2(EVP_MD_CTX *ctx, const EVP_MD *type, const OSSL_PARAM params[]); __owur int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, - ENGINE *impl); + ENGINE *impl /* must be NULL */); __owur int EVP_DigestUpdate(EVP_MD_CTX *ctx, const void *d, size_t cnt); __owur int EVP_DigestFinal_ex(EVP_MD_CTX *ctx, unsigned char *md, @@ -790,9 +790,10 @@ int EVP_CIPHER_CTX_test_flags(const EVP_CIPHER_CTX *ctx, int flags); __owur int EVP_EncryptInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, const unsigned char *key, const unsigned char *iv); __owur int EVP_EncryptInit_ex(EVP_CIPHER_CTX *ctx, - const EVP_CIPHER *cipher, ENGINE *impl, - const unsigned char *key, - const unsigned char *iv); + const EVP_CIPHER *cipher, + ENGINE *impl /* must be NULL */, + const unsigned char *key, + const unsigned char *iv); __owur int EVP_EncryptInit_ex2(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, const unsigned char *key, const unsigned char *iv, @@ -807,9 +808,10 @@ __owur int EVP_EncryptFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, __owur int EVP_DecryptInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, const unsigned char *key, const unsigned char *iv); __owur int EVP_DecryptInit_ex(EVP_CIPHER_CTX *ctx, - const EVP_CIPHER *cipher, ENGINE *impl, - const unsigned char *key, - const unsigned char *iv); + const EVP_CIPHER *cipher, + ENGINE *impl /* must be NULL */, + const unsigned char *key, + const unsigned char *iv); __owur int EVP_DecryptInit_ex2(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, const unsigned char *key, const unsigned char *iv, @@ -825,9 +827,10 @@ __owur int EVP_CipherInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, const unsigned char *key, const unsigned char *iv, int enc); __owur int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, - const EVP_CIPHER *cipher, ENGINE *impl, - const unsigned char *key, - const unsigned char *iv, int enc); + const EVP_CIPHER *cipher, + ENGINE *impl /* must be NULL */, + const unsigned char *key, + const unsigned char *iv, int enc); __owur int EVP_CipherInit_SKEY(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, EVP_SKEY *skey, const unsigned char *iv, size_t iv_len, int enc, const OSSL_PARAM params[]); @@ -883,8 +886,9 @@ __owur int EVP_DigestSignInit_ex(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, const char *props, EVP_PKEY *pkey, const OSSL_PARAM params[]); __owur int EVP_DigestSignInit(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, - const EVP_MD *type, ENGINE *e, - EVP_PKEY *pkey); + const EVP_MD *type, + ENGINE *e /* must be NULL */, + EVP_PKEY *pkey); __owur int EVP_DigestSignUpdate(EVP_MD_CTX *ctx, const void *data, size_t dsize); __owur int EVP_DigestSignFinal(EVP_MD_CTX *ctx, unsigned char *sigret, size_t *siglen); @@ -894,7 +898,8 @@ __owur int EVP_DigestVerifyInit_ex(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, const char *props, EVP_PKEY *pkey, const OSSL_PARAM params[]); __owur int EVP_DigestVerifyInit(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, - const EVP_MD *type, ENGINE *e, + const EVP_MD *type, + ENGINE *e /* must be NULL */, EVP_PKEY *pkey); int EVP_DigestVerifyUpdate(EVP_MD_CTX *ctx, const void *data, size_t dsize); __owur int EVP_DigestVerifyFinal(EVP_MD_CTX *ctx, const unsigned char *sig, @@ -1386,12 +1391,6 @@ int EVP_PKEY_set_type(EVP_PKEY *pkey, int type); int EVP_PKEY_set_type_str(EVP_PKEY *pkey, const char *str, int len); int EVP_PKEY_set_type_by_keymgmt(EVP_PKEY *pkey, EVP_KEYMGMT *keymgmt); # ifndef OPENSSL_NO_DEPRECATED_3_0 -# ifndef OPENSSL_NO_ENGINE -OSSL_DEPRECATEDIN_3_0 -int EVP_PKEY_set1_engine(EVP_PKEY *pkey, ENGINE *e); -OSSL_DEPRECATEDIN_3_0 -ENGINE *EVP_PKEY_get0_engine(const EVP_PKEY *pkey); -# endif OSSL_DEPRECATEDIN_3_0 int EVP_PKEY_assign(EVP_PKEY *pkey, int type, void *key); OSSL_DEPRECATEDIN_3_0 @@ -1892,8 +1891,8 @@ int EVP_SKEYMGMT_names_do_all(const EVP_SKEYMGMT *keymgmt, const OSSL_PARAM *EVP_SKEYMGMT_get0_gen_settable_params(const EVP_SKEYMGMT *skeymgmt); const OSSL_PARAM *EVP_SKEYMGMT_get0_imp_settable_params(const EVP_SKEYMGMT *skeymgmt); -EVP_PKEY_CTX *EVP_PKEY_CTX_new(EVP_PKEY *pkey, ENGINE *e); -EVP_PKEY_CTX *EVP_PKEY_CTX_new_id(int id, ENGINE *e); +EVP_PKEY_CTX *EVP_PKEY_CTX_new(EVP_PKEY *pkey, ENGINE *e /* must be NULL */); +EVP_PKEY_CTX *EVP_PKEY_CTX_new_id(int id, ENGINE *e /* must be NULL */); EVP_PKEY_CTX *EVP_PKEY_CTX_new_from_name(OSSL_LIB_CTX *libctx, const char *name, const char *propquery); @@ -1927,19 +1926,19 @@ int EVP_PKEY_CTX_md(EVP_PKEY_CTX *ctx, int optype, int cmd, const char *md); int EVP_PKEY_CTX_get_operation(EVP_PKEY_CTX *ctx); void EVP_PKEY_CTX_set0_keygen_info(EVP_PKEY_CTX *ctx, int *dat, int datlen); -EVP_PKEY *EVP_PKEY_new_mac_key(int type, ENGINE *e, +EVP_PKEY *EVP_PKEY_new_mac_key(int type, ENGINE *e /* must be NULL */, const unsigned char *key, int keylen); EVP_PKEY *EVP_PKEY_new_raw_private_key_ex(OSSL_LIB_CTX *libctx, const char *keytype, const char *propq, const unsigned char *priv, size_t len); -EVP_PKEY *EVP_PKEY_new_raw_private_key(int type, ENGINE *e, +EVP_PKEY *EVP_PKEY_new_raw_private_key(int type, ENGINE *e /* must be NULL */, const unsigned char *priv, size_t len); EVP_PKEY *EVP_PKEY_new_raw_public_key_ex(OSSL_LIB_CTX *libctx, const char *keytype, const char *propq, const unsigned char *pub, size_t len); -EVP_PKEY *EVP_PKEY_new_raw_public_key(int type, ENGINE *e, +EVP_PKEY *EVP_PKEY_new_raw_public_key(int type, ENGINE *e /* must be NULL */, const unsigned char *pub, size_t len); int EVP_PKEY_get_raw_private_key(const EVP_PKEY *pkey, unsigned char *priv, @@ -1949,7 +1948,8 @@ int EVP_PKEY_get_raw_public_key(const EVP_PKEY *pkey, unsigned char *pub, # ifndef OPENSSL_NO_DEPRECATED_3_0 OSSL_DEPRECATEDIN_3_0 -EVP_PKEY *EVP_PKEY_new_CMAC_key(ENGINE *e, const unsigned char *priv, +EVP_PKEY *EVP_PKEY_new_CMAC_key(ENGINE *e /* must be NULL */, + const unsigned char *priv, size_t len, const EVP_CIPHER *cipher); # endif diff --git a/include/openssl/hmac.h b/include/openssl/hmac.h index f9e1bff3f7..b6dc1c2864 100644 --- a/include/openssl/hmac.h +++ b/include/openssl/hmac.h @@ -41,7 +41,8 @@ OSSL_DEPRECATEDIN_1_1_0 __owur int HMAC_Init(HMAC_CTX *ctx, # endif # ifndef OPENSSL_NO_DEPRECATED_3_0 OSSL_DEPRECATEDIN_3_0 int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len, - const EVP_MD *md, ENGINE *impl); + const EVP_MD *md, + ENGINE *impl /* must be NULL */); OSSL_DEPRECATEDIN_3_0 int HMAC_Update(HMAC_CTX *ctx, const unsigned char *data, size_t len); OSSL_DEPRECATEDIN_3_0 int HMAC_Final(HMAC_CTX *ctx, unsigned char *md, diff --git a/include/openssl/macros.h b/include/openssl/macros.h index 9e4e77f2c1..2bf3b01ed9 100644 --- a/include/openssl/macros.h +++ b/include/openssl/macros.h @@ -44,9 +44,11 @@ __declspec(deprecated("Since OpenSSL " # since)) # define OSSL_DEPRECATED_FOR(since, message) \ __declspec(deprecated("Since OpenSSL " # since ";" message)) +# define OSSL_DEPRECATED_MESSAGE(message) __declspec(deprecated(message)) # elif _MSC_VER >= 1310 # define OSSL_DEPRECATED(since) __declspec(deprecated) # define OSSL_DEPRECATED_FOR(since, message) __declspec(deprecated) +# define OSSL_DEPRECATED_MESSAGE(message) __declspec(deprecated) # endif # elif defined(__GNUC__) /* @@ -58,14 +60,17 @@ __attribute__((deprecated("Since OpenSSL " # since))) # define OSSL_DEPRECATED_FOR(since, message) \ __attribute__((deprecated("Since OpenSSL " # since ";" message))) +# define OSSL_DEPRECATED_MESSAGE(message) __attribute__((deprecated(message))) # elif __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ > 0) # define OSSL_DEPRECATED(since) __attribute__((deprecated)) # define OSSL_DEPRECATED_FOR(since, message) __attribute__((deprecated)) +# define OSSL_DEPRECATED_MESSAGE(message) __attribute__((deprecated)) # endif # elif defined(__SUNPRO_C) # if (__SUNPRO_C >= 0x5130) # define OSSL_DEPRECATED(since) __attribute__ ((deprecated)) # define OSSL_DEPRECATED_FOR(since, message) __attribute__ ((deprecated)) +# define OSSL_DEPRECATED_MESSAGE(message) __attribute__((deprecated)) # endif # endif # endif @@ -73,11 +78,12 @@ /* * Still not defined? Then define no-op macros. This means these macros - * are unsuitable for use in a typedef. + * are unsuitable for use in a typedef except OSSL_DEPRECATED_MESSAGE. */ # ifndef OSSL_DEPRECATED # define OSSL_DEPRECATED(since) extern # define OSSL_DEPRECATED_FOR(since, message) extern +# define OSSL_DEPRECATED_MESSAGE(message) # endif /* diff --git a/include/openssl/rand.h b/include/openssl/rand.h index 4e59e50f78..a1ddfe68b3 100644 --- a/include/openssl/rand.h +++ b/include/openssl/rand.h @@ -48,9 +48,6 @@ struct rand_meth_st { OSSL_DEPRECATEDIN_3_0 int RAND_set_rand_method(const RAND_METHOD *meth); OSSL_DEPRECATEDIN_3_0 const RAND_METHOD *RAND_get_rand_method(void); -# ifndef OPENSSL_NO_ENGINE -OSSL_DEPRECATEDIN_3_0 int RAND_set_rand_engine(ENGINE *engine); -# endif OSSL_DEPRECATEDIN_3_0 RAND_METHOD *RAND_OpenSSL(void); # endif /* OPENSSL_NO_DEPRECATED_3_0 */ diff --git a/include/openssl/rsa.h b/include/openssl/rsa.h index 167427d3c4..5240049203 100644 --- a/include/openssl/rsa.h +++ b/include/openssl/rsa.h @@ -210,7 +210,7 @@ int EVP_PKEY_CTX_get0_rsa_oaep_label(EVP_PKEY_CTX *ctx, unsigned char **label); # ifndef OPENSSL_NO_DEPRECATED_3_0 OSSL_DEPRECATEDIN_3_0 RSA *RSA_new(void); -OSSL_DEPRECATEDIN_3_0 RSA *RSA_new_method(ENGINE *engine); +OSSL_DEPRECATEDIN_3_0 RSA *RSA_new_method(ENGINE *engine /* must be NULL */); OSSL_DEPRECATEDIN_3_0 int RSA_bits(const RSA *rsa); OSSL_DEPRECATEDIN_3_0 int RSA_size(const RSA *rsa); OSSL_DEPRECATEDIN_3_0 int RSA_security_bits(const RSA *rsa); @@ -253,7 +253,6 @@ OSSL_DEPRECATEDIN_3_0 void RSA_clear_flags(RSA *r, int flags); OSSL_DEPRECATEDIN_3_0 int RSA_test_flags(const RSA *r, int flags); OSSL_DEPRECATEDIN_3_0 void RSA_set_flags(RSA *r, int flags); OSSL_DEPRECATEDIN_3_0 int RSA_get_version(RSA *r); -OSSL_DEPRECATEDIN_3_0 ENGINE *RSA_get0_engine(const RSA *r); # endif /* !OPENSSL_NO_DEPRECATED_3_0 */ # define EVP_RSA_gen(bits) \ diff --git a/include/openssl/ssl.h.in b/include/openssl/ssl.h.in index 87bf1cc48b..26dcd98e07 100644 --- a/include/openssl/ssl.h.in +++ b/include/openssl/ssl.h.in @@ -750,9 +750,6 @@ void SSL_CTX_set_client_cert_cb(SSL_CTX *ctx, EVP_PKEY **pkey)); int (*SSL_CTX_get_client_cert_cb(SSL_CTX *ctx)) (SSL *ssl, X509 **x509, EVP_PKEY **pkey); -# ifndef OPENSSL_NO_ENGINE -__owur int SSL_CTX_set_client_cert_engine(SSL_CTX *ctx, ENGINE *e); -# endif void SSL_CTX_set_cookie_generate_cb(SSL_CTX *ctx, int (*app_gen_cookie_cb) (SSL *ssl, unsigned char diff --git a/include/openssl/store.h b/include/openssl/store.h index a137f59211..46907dcc7d 100644 --- a/include/openssl/store.h +++ b/include/openssl/store.h @@ -259,8 +259,6 @@ int OSSL_STORE_find(OSSL_STORE_CTX *ctx, const OSSL_STORE_SEARCH *search); * --------------------------------------------------- */ -typedef struct ossl_store_loader_st OSSL_STORE_LOADER; - OSSL_STORE_LOADER *OSSL_STORE_LOADER_fetch(OSSL_LIB_CTX *libctx, const char *scheme, const char *properties); @@ -321,7 +319,8 @@ typedef int (*OSSL_STORE_close_fn)(OSSL_STORE_LOADER_CTX *ctx); # endif # ifndef OPENSSL_NO_DEPRECATED_3_0 OSSL_DEPRECATEDIN_3_0 -OSSL_STORE_LOADER *OSSL_STORE_LOADER_new(ENGINE *e, const char *scheme); +OSSL_STORE_LOADER *OSSL_STORE_LOADER_new(ENGINE *e /* must be NULL */, + const char *scheme); OSSL_DEPRECATEDIN_3_0 int OSSL_STORE_LOADER_set_open(OSSL_STORE_LOADER *loader, OSSL_STORE_open_fn open_function); @@ -353,8 +352,6 @@ OSSL_DEPRECATEDIN_3_0 int OSSL_STORE_LOADER_set_close(OSSL_STORE_LOADER *loader, OSSL_STORE_close_fn close_function); OSSL_DEPRECATEDIN_3_0 -const ENGINE *OSSL_STORE_LOADER_get0_engine(const OSSL_STORE_LOADER *loader); -OSSL_DEPRECATEDIN_3_0 const char *OSSL_STORE_LOADER_get0_scheme(const OSSL_STORE_LOADER *loader); OSSL_DEPRECATEDIN_3_0 int OSSL_STORE_register_loader(OSSL_STORE_LOADER *loader); diff --git a/include/openssl/trace.h b/include/openssl/trace.h index 2ca07f748f..705c638d72 100644 --- a/include/openssl/trace.h +++ b/include/openssl/trace.h @@ -43,22 +43,20 @@ extern "C" { # define OSSL_TRACE_CATEGORY_TLS 3 # define OSSL_TRACE_CATEGORY_TLS_CIPHER 4 # define OSSL_TRACE_CATEGORY_CONF 5 -# define OSSL_TRACE_CATEGORY_ENGINE_TABLE 6 -# define OSSL_TRACE_CATEGORY_ENGINE_REF_COUNT 7 -# define OSSL_TRACE_CATEGORY_PKCS5V2 8 -# define OSSL_TRACE_CATEGORY_PKCS12_KEYGEN 9 -# define OSSL_TRACE_CATEGORY_PKCS12_DECRYPT 10 -# define OSSL_TRACE_CATEGORY_X509V3_POLICY 11 -# define OSSL_TRACE_CATEGORY_BN_CTX 12 -# define OSSL_TRACE_CATEGORY_CMP 13 -# define OSSL_TRACE_CATEGORY_STORE 14 -# define OSSL_TRACE_CATEGORY_DECODER 15 -# define OSSL_TRACE_CATEGORY_ENCODER 16 -# define OSSL_TRACE_CATEGORY_REF_COUNT 17 -# define OSSL_TRACE_CATEGORY_HTTP 18 -# define OSSL_TRACE_CATEGORY_PROVIDER 19 -# define OSSL_TRACE_CATEGORY_QUERY 20 -# define OSSL_TRACE_CATEGORY_NUM 21 +# define OSSL_TRACE_CATEGORY_PKCS5V2 6 +# define OSSL_TRACE_CATEGORY_PKCS12_KEYGEN 7 +# define OSSL_TRACE_CATEGORY_PKCS12_DECRYPT 8 +# define OSSL_TRACE_CATEGORY_X509V3_POLICY 9 +# define OSSL_TRACE_CATEGORY_BN_CTX 10 +# define OSSL_TRACE_CATEGORY_CMP 11 +# define OSSL_TRACE_CATEGORY_STORE 12 +# define OSSL_TRACE_CATEGORY_DECODER 13 +# define OSSL_TRACE_CATEGORY_ENCODER 14 +# define OSSL_TRACE_CATEGORY_REF_COUNT 15 +# define OSSL_TRACE_CATEGORY_HTTP 16 +# define OSSL_TRACE_CATEGORY_PROVIDER 17 +# define OSSL_TRACE_CATEGORY_QUERY 18 +# define OSSL_TRACE_CATEGORY_NUM 19 /* KEEP THIS LIST IN SYNC with trace_categories[] in crypto/trace.c */ /* Returns the trace category number for the given |name| */ diff --git a/include/openssl/ts.h b/include/openssl/ts.h index 31c78b55a4..19938dfb5c 100644 --- a/include/openssl/ts.h +++ b/include/openssl/ts.h @@ -487,11 +487,6 @@ EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass); const char *TS_CONF_get_tsa_section(CONF *conf, const char *section); int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb, TS_RESP_CTX *ctx); -#ifndef OPENSSL_NO_ENGINE -int TS_CONF_set_crypto_device(CONF *conf, const char *section, - const char *device); -int TS_CONF_set_default_engine(const char *name); -#endif int TS_CONF_set_signer_cert(CONF *conf, const char *section, const char *cert, TS_RESP_CTX *ctx); int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs, diff --git a/include/openssl/types.h b/include/openssl/types.h index a83811e748..fe060c2381 100644 --- a/include/openssl/types.h +++ b/include/openssl/types.h @@ -217,6 +217,7 @@ typedef struct ct_policy_eval_ctx_st CT_POLICY_EVAL_CTX; typedef struct ossl_store_info_st OSSL_STORE_INFO; typedef struct ossl_store_search_st OSSL_STORE_SEARCH; +typedef struct ossl_store_loader_st OSSL_STORE_LOADER; typedef struct ossl_lib_ctx_st OSSL_LIB_CTX; diff --git a/providers/common/include/prov/provider_util.h b/providers/common/include/prov/provider_util.h index f04e811ac3..b14de9bf06 100644 --- a/providers/common/include/prov/provider_util.h +++ b/providers/common/include/prov/provider_util.h @@ -18,9 +18,6 @@ typedef struct { */ const EVP_CIPHER *cipher; /* cipher */ EVP_CIPHER *alloc_cipher; /* fetched cipher */ - - /* Conditions for legacy EVP_CIPHER uses */ - ENGINE *engine; /* cipher engine */ } PROV_CIPHER; typedef struct { @@ -31,21 +28,16 @@ typedef struct { */ const EVP_MD *md; /* digest */ EVP_MD *alloc_md; /* fetched digest */ - - /* Conditions for legacy EVP_MD uses */ - ENGINE *engine; /* digest engine */ } PROV_DIGEST; /* Cipher functions */ /* * Load a cipher from the specified parameters with the specified context. - * The params "propq", "engine" and "cipher" are used to determine the - * implementation used. If a provider cannot be found, it falls back to trying - * non-provider based implementations. + * The params "propq" and "cipher" are used to determine the + * implementation used. */ int ossl_prov_cipher_load(PROV_CIPHER *pc, const OSSL_PARAM *cipher, - const OSSL_PARAM *propq, const OSSL_PARAM *engine, - OSSL_LIB_CTX *ctx); + const OSSL_PARAM *propq, OSSL_LIB_CTX *ctx); /* Reset the PROV_CIPHER fields and free any allocated cipher reference */ void ossl_prov_cipher_reset(PROV_CIPHER *pc); @@ -53,9 +45,8 @@ void ossl_prov_cipher_reset(PROV_CIPHER *pc); /* Clone a PROV_CIPHER structure into a second */ int ossl_prov_cipher_copy(PROV_CIPHER *dst, const PROV_CIPHER *src); -/* Query the cipher and associated engine (if any) */ +/* Query the cipher (if any) */ const EVP_CIPHER *ossl_prov_cipher_cipher(const PROV_CIPHER *pc); -ENGINE *ossl_prov_cipher_engine(const PROV_CIPHER *pc); /* Digest functions */ @@ -68,13 +59,11 @@ const EVP_MD *ossl_prov_digest_fetch(PROV_DIGEST *pd, OSSL_LIB_CTX *libctx, /* * Load a digest from the specified parameters with the specified context. - * The params "propq", "engine" and "digest" are used to determine the - * implementation used. If a provider cannot be found, it falls back to trying - * non-provider based implementations. + * The params "propq" and "digest" are used to determine the + * implementation used. */ int ossl_prov_digest_load(PROV_DIGEST *pd,const OSSL_PARAM *digest, - const OSSL_PARAM *propq, const OSSL_PARAM *engine, - OSSL_LIB_CTX *ctx); + const OSSL_PARAM *propq, OSSL_LIB_CTX *ctx); /* Reset the PROV_DIGEST fields and free any allocated digest reference */ void ossl_prov_digest_reset(PROV_DIGEST *pd); @@ -82,9 +71,8 @@ void ossl_prov_digest_reset(PROV_DIGEST *pd); /* Clone a PROV_DIGEST structure into a second */ int ossl_prov_digest_copy(PROV_DIGEST *dst, const PROV_DIGEST *src); -/* Query the digest and associated engine (if any) */ +/* Query the digest (if any) */ const EVP_MD *ossl_prov_digest_md(const PROV_DIGEST *pd); -ENGINE *ossl_prov_digest_engine(const PROV_DIGEST *pd); /* Set a specific md, resets current digests first */ void ossl_prov_digest_set_md(PROV_DIGEST *pd, EVP_MD *md); @@ -97,14 +85,12 @@ void ossl_prov_digest_set_md(PROV_DIGEST *pd, EVP_MD *md); int ossl_prov_macctx_load(EVP_MAC_CTX **macctx, const OSSL_PARAM *pmac, const OSSL_PARAM *pcipher, const OSSL_PARAM *pdigest, const OSSL_PARAM *propq, - const OSSL_PARAM *pengine, const char *macname, const char *ciphername, const char *mdname, OSSL_LIB_CTX *libctx); int ossl_prov_set_macctx(EVP_MAC_CTX *macctx, const char *ciphername, const char *mdname, - const char *engine, const char *properties, const OSSL_PARAM param[]); diff --git a/providers/common/provider_util.c b/providers/common/provider_util.c index 2f123f5f2b..c7f60f1737 100644 --- a/providers/common/provider_util.c +++ b/providers/common/provider_util.c @@ -7,15 +7,11 @@ * https://www.openssl.org/source/license.html */ -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - #include #include #include #include #ifndef FIPS_MODULE -# include # include "crypto/evp.h" #endif #include "prov/providercommon.h" @@ -26,23 +22,12 @@ void ossl_prov_cipher_reset(PROV_CIPHER *pc) EVP_CIPHER_free(pc->alloc_cipher); pc->alloc_cipher = NULL; pc->cipher = NULL; -#if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_ENGINE) - ENGINE_finish(pc->engine); -#endif - pc->engine = NULL; } int ossl_prov_cipher_copy(PROV_CIPHER *dst, const PROV_CIPHER *src) { if (src->alloc_cipher != NULL && !EVP_CIPHER_up_ref(src->alloc_cipher)) return 0; -#if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_ENGINE) - if (src->engine != NULL && !ENGINE_init(src->engine)) { - EVP_CIPHER_free(src->alloc_cipher); - return 0; - } -#endif - dst->engine = src->engine; dst->cipher = src->cipher; dst->alloc_cipher = src->alloc_cipher; return 1; @@ -59,41 +44,12 @@ static int set_propq(const OSSL_PARAM *propq, const char **propquery) return 1; } -static int set_engine(const OSSL_PARAM *e, ENGINE **engine) -{ -#if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_ENGINE) - ENGINE_finish(*engine); -#endif - *engine = NULL; - /* Inside the FIPS module, we don't support legacy ciphers */ -#if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_ENGINE) - if (e != NULL) { - if (e->data_type != OSSL_PARAM_UTF8_STRING) - return 0; - /* Get a structural reference */ - *engine = ENGINE_by_id(e->data); - if (*engine == NULL) - return 0; - /* Get a functional reference */ - if (!ENGINE_init(*engine)) { - ENGINE_free(*engine); - *engine = NULL; - return 0; - } - /* Free the structural reference */ - ENGINE_free(*engine); - } -#endif - return 1; -} - int ossl_prov_cipher_load(PROV_CIPHER *pc, const OSSL_PARAM *cipher, - const OSSL_PARAM *propq, const OSSL_PARAM *engine, - OSSL_LIB_CTX *ctx) + const OSSL_PARAM *propq, OSSL_LIB_CTX *ctx) { const char *propquery; - if (!set_propq(propq, &propquery) || !set_engine(engine, &pc->engine)) + if (!set_propq(propq, &propquery)) return 0; if (cipher == NULL) @@ -127,33 +83,17 @@ const EVP_CIPHER *ossl_prov_cipher_cipher(const PROV_CIPHER *pc) return pc->cipher; } -ENGINE *ossl_prov_cipher_engine(const PROV_CIPHER *pc) -{ - return pc->engine; -} - void ossl_prov_digest_reset(PROV_DIGEST *pd) { EVP_MD_free(pd->alloc_md); pd->alloc_md = NULL; pd->md = NULL; -#if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_ENGINE) - ENGINE_finish(pd->engine); -#endif - pd->engine = NULL; } int ossl_prov_digest_copy(PROV_DIGEST *dst, const PROV_DIGEST *src) { if (src->alloc_md != NULL && !EVP_MD_up_ref(src->alloc_md)) return 0; -#if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_ENGINE) - if (src->engine != NULL && !ENGINE_init(src->engine)) { - EVP_MD_free(src->alloc_md); - return 0; - } -#endif - dst->engine = src->engine; dst->md = src->md; dst->alloc_md = src->alloc_md; return 1; @@ -169,12 +109,11 @@ const EVP_MD *ossl_prov_digest_fetch(PROV_DIGEST *pd, OSSL_LIB_CTX *libctx, } int ossl_prov_digest_load(PROV_DIGEST *pd, const OSSL_PARAM *digest, - const OSSL_PARAM *propq, const OSSL_PARAM *engine, - OSSL_LIB_CTX *ctx) + const OSSL_PARAM *propq, OSSL_LIB_CTX *ctx) { const char *propquery; - if (!set_propq(propq, &propquery) || !set_engine(engine, &pd->engine)) + if (!set_propq(propq, &propquery)) return 0; if (digest == NULL) @@ -212,15 +151,9 @@ const EVP_MD *ossl_prov_digest_md(const PROV_DIGEST *pd) return pd->md; } -ENGINE *ossl_prov_digest_engine(const PROV_DIGEST *pd) -{ - return pd->engine; -} - int ossl_prov_set_macctx(EVP_MAC_CTX *macctx, const char *ciphername, const char *mdname, - const char *engine, const char *properties, const OSSL_PARAM param[]) { @@ -238,12 +171,6 @@ int ossl_prov_set_macctx(EVP_MAC_CTX *macctx, *mp++ = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_PROPERTIES, (char *)properties, 0); -#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) - if (engine != NULL) - *mp++ = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_ENGINE, - (char *) engine, 0); -#endif - *mp = OSSL_PARAM_construct_end(); /* @@ -274,12 +201,10 @@ int ossl_prov_set_macctx(EVP_MAC_CTX *macctx, int ossl_prov_macctx_load(EVP_MAC_CTX **macctx, const OSSL_PARAM *pmac, const OSSL_PARAM *pcipher, const OSSL_PARAM *pdigest, const OSSL_PARAM *propq, - const OSSL_PARAM *pengine, const char *macname, const char *ciphername, const char *mdname, OSSL_LIB_CTX *libctx) { const char *properties = NULL; - const char *engine = NULL; if (macname == NULL && pmac != NULL) if (!OSSL_PARAM_get_utf8_string_ptr(pmac, &macname)) @@ -312,10 +237,8 @@ int ossl_prov_macctx_load(EVP_MAC_CTX **macctx, if (mdname == NULL && pdigest != NULL) if (!OSSL_PARAM_get_utf8_string_ptr(pdigest, &mdname)) return 0; - if (pengine != NULL && !OSSL_PARAM_get_utf8_string_ptr(pengine, &engine)) - return 0; - if (ossl_prov_set_macctx(*macctx, ciphername, mdname, engine, properties, NULL)) + if (ossl_prov_set_macctx(*macctx, ciphername, mdname, properties, NULL)) return 1; EVP_MAC_CTX_free(*macctx); diff --git a/providers/fips-sources.checksums b/providers/fips-sources.checksums index bb286d128f..00575a3be1 100644 --- a/providers/fips-sources.checksums +++ b/providers/fips-sources.checksums @@ -543,8 +543,6 @@ bc9ec2be442a4f49980ba2c63c8f0da701de1f6e23d7db35d781658f833dd7b9 include/openss 7aa8c5bee779af59d4733f6a50f7f6be39f1eb43409e5b3357440f9a7d0ca115 include/openssl/ecerr.h 61c76ee3f12ed0e42503a56421ca00f1cb9a0f4caa5f9c4421c374bcd45917d7 include/openssl/encoder.h 69dd983f45b8ccd551f084796519446552963a18c52b70470d978b597c81b2dc include/openssl/encodererr.h -e09078b3c2966e0f2fe18fb1370800942fb0e6e5c49cc02e6cdcce6a677faef0 include/openssl/engine.h -fb510978001ebea15eee4c4c6cbeebb126a66e11117e6f6d9b9fb4be5057b92c include/openssl/engineerr.h aa02455482d744418123266f581b9b4310ba678c7d28c10fffc5eec74ce3c8ef include/openssl/err.h.in 1b69b729f14255bb17c917b95692e1b1b8b2004b4d177754bc8a4e576a615e26 include/openssl/evp.h b2a8058dd51abe6c1ac4a0f32175f550a308efd31607a9cf1620aa032b1f7e55 include/openssl/evperr.h diff --git a/providers/fips.module.sources b/providers/fips.module.sources index 333af461e5..799073c2c6 100644 --- a/providers/fips.module.sources +++ b/providers/fips.module.sources @@ -543,8 +543,6 @@ include/openssl/ec.h include/openssl/ecerr.h include/openssl/encoder.h include/openssl/encodererr.h -include/openssl/engine.h -include/openssl/engineerr.h include/openssl/err.h.in include/openssl/evp.h include/openssl/evperr.h diff --git a/providers/implementations/asymciphers/sm2_enc.c b/providers/implementations/asymciphers/sm2_enc.c index b8d991c1c3..43ecd43519 100644 --- a/providers/implementations/asymciphers/sm2_enc.c +++ b/providers/implementations/asymciphers/sm2_enc.c @@ -189,7 +189,7 @@ static int sm2_set_ctx_params(void *vpsm2ctx, const OSSL_PARAM params[]) if (psm2ctx == NULL || !sm2_set_ctx_params_decoder(params, &p)) return 0; - if (!ossl_prov_digest_load(&psm2ctx->md, p.digest, p.propq, p.engine, + if (!ossl_prov_digest_load(&psm2ctx->md, p.digest, p.propq, psm2ctx->libctx)) return 0; diff --git a/providers/implementations/asymciphers/sm2_enc.inc.in b/providers/implementations/asymciphers/sm2_enc.inc.in index f545a6ab35..7ad4185bc5 100644 --- a/providers/implementations/asymciphers/sm2_enc.inc.in +++ b/providers/implementations/asymciphers/sm2_enc.inc.in @@ -18,5 +18,4 @@ use OpenSSL::paramnames qw(produce_param_decoder); {- produce_param_decoder('sm2_set_ctx_params', (['OSSL_ASYM_CIPHER_PARAM_DIGEST', 'digest', 'utf8_string'], ['OSSL_ASYM_CIPHER_PARAM_PROPERTIES', 'propq', 'utf8_string'], - ['OSSL_ASYM_CIPHER_PARAM_ENGINE', 'engine', 'utf8_string', 'hidden'], )); -} diff --git a/providers/implementations/include/prov/drbg.h b/providers/implementations/include/prov/drbg.h index e74ddd0717..237ca41699 100644 --- a/providers/implementations/include/prov/drbg.h +++ b/providers/implementations/include/prov/drbg.h @@ -242,7 +242,6 @@ int ossl_drbg_get_ctx_params_no_lock(PROV_DRBG *drbg, struct drbg_set_ctx_params_st { OSSL_PARAM *propq; - OSSL_PARAM *engine; OSSL_PARAM *cipher; /* CTR DRBG */ OSSL_PARAM *df; /* CTR DRBG */ OSSL_PARAM *digest; /* HASH and HMAC DRBG */ diff --git a/providers/implementations/kdfs/hkdf.c b/providers/implementations/kdfs/hkdf.c index b4c84a007a..d9dd9f06da 100644 --- a/providers/implementations/kdfs/hkdf.c +++ b/providers/implementations/kdfs/hkdf.c @@ -264,7 +264,6 @@ static int kdf_hkdf_derive(void *vctx, unsigned char *key, size_t keylen, struct hkdf_all_set_ctx_params_st { OSSL_PARAM *mode; OSSL_PARAM *propq; - OSSL_PARAM *engine; OSSL_PARAM *digest; OSSL_PARAM *key; OSSL_PARAM *salt; @@ -294,8 +293,7 @@ static int hkdf_common_set_ctx_params if (p->digest != NULL) { const EVP_MD *md = NULL; - if (!ossl_prov_digest_load(&ctx->digest, p->digest, - p->propq, p->engine, libctx)) + if (!ossl_prov_digest_load(&ctx->digest, p->digest, p->propq, libctx)) return 0; md = ossl_prov_digest_md(&ctx->digest); @@ -488,7 +486,7 @@ static void *kdf_hkdf_fixed_digest_new(void *provctx, const char *digest) param = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_DIGEST, (char *)digest, 0); - if (!ossl_prov_digest_load(&ctx->digest, ¶m, NULL, NULL, libctx)) { + if (!ossl_prov_digest_load(&ctx->digest, ¶m, NULL, libctx)) { kdf_hkdf_free(ctx); return NULL; } diff --git a/providers/implementations/kdfs/hkdf.inc.in b/providers/implementations/kdfs/hkdf.inc.in index 32e5abf0b2..7fd4f90130 100644 --- a/providers/implementations/kdfs/hkdf.inc.in +++ b/providers/implementations/kdfs/hkdf.inc.in @@ -19,7 +19,6 @@ use OpenSSL::paramnames qw(produce_param_decoder); ); our @HKDF_DIGEST_SET_CTX_PARAMS = ( ['OSSL_KDF_PARAM_PROPERTIES', 'propq', 'utf8_string'], - ['OSSL_ALG_PARAM_ENGINE', 'engine', 'utf8_string', 'hidden'], ['OSSL_KDF_PARAM_DIGEST', 'digest', 'utf8_string'], ); our @HKDF_INFO_SET_CTX_PARAMS = ( diff --git a/providers/implementations/kdfs/hmacdrbg_kdf.c b/providers/implementations/kdfs/hmacdrbg_kdf.c index 2d2805b53d..a36d92cd22 100644 --- a/providers/implementations/kdfs/hmacdrbg_kdf.c +++ b/providers/implementations/kdfs/hmacdrbg_kdf.c @@ -210,8 +210,7 @@ static int hmac_drbg_kdf_set_ctx_params(void *vctx, } if (p.digest != NULL) { - if (!ossl_prov_digest_load(&drbg->digest, p.digest, - p.propq, p.engine, libctx)) + if (!ossl_prov_digest_load(&drbg->digest, p.digest, p.propq, libctx)) return 0; /* Confirm digest is allowed. Allow all digests that are not XOF */ @@ -227,7 +226,7 @@ static int hmac_drbg_kdf_set_ctx_params(void *vctx, drbg->blocklen = (size_t)md_size; } if (!ossl_prov_macctx_load(&drbg->ctx, NULL, NULL, p.digest, p.propq, - p.engine, "HMAC", NULL, NULL, libctx)) + "HMAC", NULL, NULL, libctx)) return 0; } return 1; diff --git a/providers/implementations/kdfs/hmacdrbg_kdf.inc.in b/providers/implementations/kdfs/hmacdrbg_kdf.inc.in index 699c960718..19ed1ae3b6 100644 --- a/providers/implementations/kdfs/hmacdrbg_kdf.inc.in +++ b/providers/implementations/kdfs/hmacdrbg_kdf.inc.in @@ -18,7 +18,6 @@ use OpenSSL::paramnames qw(produce_param_decoder); {- produce_param_decoder('hmac_drbg_kdf_set_ctx_params', (['OSSL_KDF_PARAM_PROPERTIES', 'propq', 'utf8_string'], - ['OSSL_ALG_PARAM_ENGINE', 'engine', 'utf8_string', 'hidden'], ['OSSL_KDF_PARAM_DIGEST', 'digest', 'utf8_string'], ['OSSL_KDF_PARAM_HMACDRBG_ENTROPY', 'ent', 'octet_string'], ['OSSL_KDF_PARAM_HMACDRBG_NONCE', 'nonce', 'octet_string'], diff --git a/providers/implementations/kdfs/kbkdf.c b/providers/implementations/kdfs/kbkdf.c index d8fa4d8186..2f273f8db9 100644 --- a/providers/implementations/kdfs/kbkdf.c +++ b/providers/implementations/kdfs/kbkdf.c @@ -383,8 +383,7 @@ static int kbkdf_set_ctx_params(void *vctx, const OSSL_PARAM params[]) return 0; if (!ossl_prov_macctx_load(&ctx->ctx_init, p.mac, p.cipher, - p.digest, p.propq, p.engine, - NULL, NULL, NULL, libctx)) + p.digest, p.propq, NULL, NULL, NULL, libctx)) return 0; if (ctx->ctx_init != NULL) { diff --git a/providers/implementations/kdfs/kbkdf.inc.in b/providers/implementations/kdfs/kbkdf.inc.in index 1cecc84cfd..0aabcfefea 100644 --- a/providers/implementations/kdfs/kbkdf.inc.in +++ b/providers/implementations/kdfs/kbkdf.inc.in @@ -21,7 +21,6 @@ use OpenSSL::paramnames qw(produce_param_decoder); ['OSSL_KDF_PARAM_MAC', 'mac', 'utf8_string'], ['OSSL_KDF_PARAM_MODE', 'mode', 'utf8_string'], ['OSSL_KDF_PARAM_PROPERTIES', 'propq', 'utf8_string'], - ['OSSL_ALG_PARAM_ENGINE', 'engine', 'utf8_string', 'hidden'], ['OSSL_KDF_PARAM_KBKDF_USE_L', 'use_l', 'int'], ['OSSL_KDF_PARAM_KBKDF_USE_SEPARATOR', 'sep', 'int'], ['OSSL_KDF_PARAM_KBKDF_R', 'r', 'int'], diff --git a/providers/implementations/kdfs/krb5kdf.c b/providers/implementations/kdfs/krb5kdf.c index 03e8fc62c7..a340943edf 100644 --- a/providers/implementations/kdfs/krb5kdf.c +++ b/providers/implementations/kdfs/krb5kdf.c @@ -44,7 +44,7 @@ static OSSL_FUNC_kdf_set_ctx_params_fn krb5kdf_set_ctx_params; static OSSL_FUNC_kdf_gettable_ctx_params_fn krb5kdf_gettable_ctx_params; static OSSL_FUNC_kdf_get_ctx_params_fn krb5kdf_get_ctx_params; -static int KRB5KDF(const EVP_CIPHER *cipher, ENGINE *engine, +static int KRB5KDF(const EVP_CIPHER *cipher, const unsigned char *key, size_t key_len, const unsigned char *constant, size_t constant_len, unsigned char *okey, size_t okey_len); @@ -128,7 +128,6 @@ static int krb5kdf_derive(void *vctx, unsigned char *key, size_t keylen, { KRB5KDF_CTX *ctx = (KRB5KDF_CTX *)vctx; const EVP_CIPHER *cipher; - ENGINE *engine; if (!ossl_prov_is_running() || !krb5kdf_set_ctx_params(ctx, params)) return 0; @@ -146,8 +145,8 @@ static int krb5kdf_derive(void *vctx, unsigned char *key, size_t keylen, ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_CONSTANT); return 0; } - engine = ossl_prov_cipher_engine(&ctx->cipher); - return KRB5KDF(cipher, engine, ctx->key, ctx->key_len, + + return KRB5KDF(cipher, ctx->key, ctx->key_len, ctx->constant, ctx->constant_len, key, keylen); } @@ -163,7 +162,7 @@ static int krb5kdf_set_ctx_params(void *vctx, const OSSL_PARAM params[]) provctx = PROV_LIBCTX_OF(ctx->provctx); - if (!ossl_prov_cipher_load(&ctx->cipher, p.cipher, p.propq, p.engine, provctx)) + if (!ossl_prov_cipher_load(&ctx->cipher, p.cipher, p.propq, provctx)) return 0; if (p.key != NULL && !krb5kdf_set_membuf(&ctx->key, &ctx->key_len, p.key)) @@ -339,13 +338,12 @@ static void n_fold(unsigned char *block, unsigned int blocksize, } } -static int cipher_init(EVP_CIPHER_CTX *ctx, - const EVP_CIPHER *cipher, ENGINE *engine, +static int cipher_init(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, const unsigned char *key, size_t key_len) { int klen, ret; - ret = EVP_EncryptInit_ex(ctx, cipher, engine, NULL, NULL); + ret = EVP_EncryptInit_ex(ctx, cipher, NULL, NULL, NULL); if (!ret) goto out; /* set the key len for the odd variable key len cipher */ @@ -371,7 +369,7 @@ out: return ret; } -static int KRB5KDF(const EVP_CIPHER *cipher, ENGINE *engine, +static int KRB5KDF(const EVP_CIPHER *cipher, const unsigned char *key, size_t key_len, const unsigned char *constant, size_t constant_len, unsigned char *okey, size_t okey_len) @@ -407,7 +405,7 @@ static int KRB5KDF(const EVP_CIPHER *cipher, ENGINE *engine, if (ctx == NULL) return 0; - ret = cipher_init(ctx, cipher, engine, key, key_len); + ret = cipher_init(ctx, cipher, key, key_len); if (!ret) goto out; @@ -457,7 +455,7 @@ static int KRB5KDF(const EVP_CIPHER *cipher, ENGINE *engine, ret = EVP_CIPHER_CTX_reset(ctx); if (!ret) goto out; - ret = cipher_init(ctx, cipher, engine, key, key_len); + ret = cipher_init(ctx, cipher, key, key_len); if (!ret) goto out; diff --git a/providers/implementations/kdfs/krb5kdf.inc.in b/providers/implementations/kdfs/krb5kdf.inc.in index 62124ec5b9..c404d52125 100644 --- a/providers/implementations/kdfs/krb5kdf.inc.in +++ b/providers/implementations/kdfs/krb5kdf.inc.in @@ -13,7 +13,6 @@ use OpenSSL::paramnames qw(produce_param_decoder); {- produce_param_decoder('krb5kdf_set_ctx_params', (['OSSL_KDF_PARAM_PROPERTIES', 'propq', 'utf8_string'], - ['OSSL_ALG_PARAM_ENGINE', 'engine', 'utf8_string', 'hidden'], ['OSSL_KDF_PARAM_CIPHER', 'cipher', 'utf8_string'], ['OSSL_KDF_PARAM_KEY', 'key', 'octet_string'], ['OSSL_KDF_PARAM_CONSTANT', 'cnst', 'octet_string'], diff --git a/providers/implementations/kdfs/pbkdf1.c b/providers/implementations/kdfs/pbkdf1.c index 6830c5cdf9..2f37f7a95f 100644 --- a/providers/implementations/kdfs/pbkdf1.c +++ b/providers/implementations/kdfs/pbkdf1.c @@ -236,8 +236,7 @@ static int kdf_pbkdf1_set_ctx_params(void *vctx, const OSSL_PARAM params[]) libctx = PROV_LIBCTX_OF(ctx->provctx); - if (!ossl_prov_digest_load(&ctx->digest, p.digest, - p.propq, p.engine, libctx)) + if (!ossl_prov_digest_load(&ctx->digest, p.digest, p.propq, libctx)) return 0; if (p.pw != NULL && !kdf_pbkdf1_set_membuf(&ctx->pass, &ctx->pass_len, p.pw)) diff --git a/providers/implementations/kdfs/pbkdf1.inc.in b/providers/implementations/kdfs/pbkdf1.inc.in index 697042061f..5cbab68cee 100644 --- a/providers/implementations/kdfs/pbkdf1.inc.in +++ b/providers/implementations/kdfs/pbkdf1.inc.in @@ -13,7 +13,6 @@ use OpenSSL::paramnames qw(produce_param_decoder); {- produce_param_decoder('pbkdf1_set_ctx_params', (['OSSL_KDF_PARAM_PROPERTIES', 'propq', 'utf8_string'], - ['OSSL_ALG_PARAM_ENGINE', 'engine', 'utf8_string', 'hidden'], ['OSSL_KDF_PARAM_DIGEST', 'digest', 'utf8_string'], ['OSSL_KDF_PARAM_PASSWORD', 'pw', 'octet_string'], ['OSSL_KDF_PARAM_SALT', 'salt', 'octet_string'], diff --git a/providers/implementations/kdfs/pbkdf2.c b/providers/implementations/kdfs/pbkdf2.c index 182525552d..ca46995dcd 100644 --- a/providers/implementations/kdfs/pbkdf2.c +++ b/providers/implementations/kdfs/pbkdf2.c @@ -178,7 +178,7 @@ static void kdf_pbkdf2_init(KDF_PBKDF2 *ctx) param = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, SN_sha1, 0); - if (!ossl_prov_digest_load(&ctx->digest, ¶m, NULL, NULL, provctx)) + if (!ossl_prov_digest_load(&ctx->digest, ¶m, NULL, provctx)) /* This is an error, but there is no way to indicate such directly */ ossl_prov_digest_reset(&ctx->digest); ctx->iter = PKCS5_DEFAULT_ITER; @@ -327,8 +327,7 @@ static int kdf_pbkdf2_set_ctx_params(void *vctx, const OSSL_PARAM params[]) provctx = PROV_LIBCTX_OF(ctx->provctx); if (p.digest != NULL) { - if (!ossl_prov_digest_load(&ctx->digest, p.digest, - p.propq, p.engine, provctx)) + if (!ossl_prov_digest_load(&ctx->digest, p.digest, p.propq, provctx)) return 0; md = ossl_prov_digest_md(&ctx->digest); if (EVP_MD_xof(md)) { diff --git a/providers/implementations/kdfs/pbkdf2.inc.in b/providers/implementations/kdfs/pbkdf2.inc.in index 94ea25a78a..3bf8139ff5 100644 --- a/providers/implementations/kdfs/pbkdf2.inc.in +++ b/providers/implementations/kdfs/pbkdf2.inc.in @@ -13,7 +13,6 @@ use OpenSSL::paramnames qw(produce_param_decoder); {- produce_param_decoder('pbkdf2_set_ctx_params', (['OSSL_KDF_PARAM_PROPERTIES', 'propq', 'utf8_string'], - ['OSSL_ALG_PARAM_ENGINE', 'engine', 'utf8_string', 'hidden'], ['OSSL_KDF_PARAM_DIGEST', 'digest', 'utf8_string'], ['OSSL_KDF_PARAM_PASSWORD', 'pw', 'octet_string'], ['OSSL_KDF_PARAM_SALT', 'salt', 'octet_string'], diff --git a/providers/implementations/kdfs/pkcs12kdf.c b/providers/implementations/kdfs/pkcs12kdf.c index cc07139ec4..98942fb0bb 100644 --- a/providers/implementations/kdfs/pkcs12kdf.c +++ b/providers/implementations/kdfs/pkcs12kdf.c @@ -252,8 +252,7 @@ static int kdf_pkcs12_set_ctx_params(void *vctx, const OSSL_PARAM params[]) provctx = PROV_LIBCTX_OF(ctx->provctx); - if (!ossl_prov_digest_load(&ctx->digest, p.digest, - p.propq, p.engine, provctx)) + if (!ossl_prov_digest_load(&ctx->digest, p.digest, p.propq, provctx)) return 0; if (p.pw != NULL && !pkcs12kdf_set_membuf(&ctx->pass, &ctx->pass_len, p.pw)) diff --git a/providers/implementations/kdfs/pkcs12kdf.inc.in b/providers/implementations/kdfs/pkcs12kdf.inc.in index aebd403b3a..7dce2c2eff 100644 --- a/providers/implementations/kdfs/pkcs12kdf.inc.in +++ b/providers/implementations/kdfs/pkcs12kdf.inc.in @@ -13,7 +13,6 @@ use OpenSSL::paramnames qw(produce_param_decoder); {- produce_param_decoder('pkcs12_set_ctx_params', (['OSSL_KDF_PARAM_PROPERTIES', 'propq', 'utf8_string'], - ['OSSL_ALG_PARAM_ENGINE', 'engine', 'utf8_string', 'hidden'], ['OSSL_KDF_PARAM_DIGEST', 'digest', 'utf8_string'], ['OSSL_KDF_PARAM_PASSWORD', 'pw', 'octet_string'], ['OSSL_KDF_PARAM_SALT', 'salt', 'octet_string'], diff --git a/providers/implementations/kdfs/pvkkdf.c b/providers/implementations/kdfs/pvkkdf.c index 40afdcc127..9558e33334 100644 --- a/providers/implementations/kdfs/pvkkdf.c +++ b/providers/implementations/kdfs/pvkkdf.c @@ -111,7 +111,7 @@ static void kdf_pvk_init(KDF_PVK *ctx) param = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, SN_sha1, 0); - if (!ossl_prov_digest_load(&ctx->digest, ¶m, NULL, NULL, provctx)) + if (!ossl_prov_digest_load(&ctx->digest, ¶m, NULL, provctx)) /* This is an error, but there is no way to indicate such directly */ ossl_prov_digest_reset(&ctx->digest); } @@ -190,8 +190,7 @@ static int kdf_pvk_set_ctx_params(void *vctx, const OSSL_PARAM params[]) provctx = PROV_LIBCTX_OF(ctx->provctx); - if (!ossl_prov_digest_load(&ctx->digest, p.digest, p.propq, p.engine, - provctx)) + if (!ossl_prov_digest_load(&ctx->digest, p.digest, p.propq, provctx)) return 0; if (p.pass != NULL && !pvk_set_membuf(&ctx->pass, &ctx->pass_len, p.pass)) diff --git a/providers/implementations/kdfs/pvkkdf.inc.in b/providers/implementations/kdfs/pvkkdf.inc.in index 17dfa2f61e..998497e5bd 100644 --- a/providers/implementations/kdfs/pvkkdf.inc.in +++ b/providers/implementations/kdfs/pvkkdf.inc.in @@ -13,7 +13,6 @@ use OpenSSL::paramnames qw(produce_param_decoder); {- produce_param_decoder('pvk_set_ctx_params', (['OSSL_KDF_PARAM_PROPERTIES', 'propq', 'utf8_string'], - ['OSSL_ALG_PARAM_ENGINE', 'engine', 'utf8_string', 'hidden'], ['OSSL_KDF_PARAM_DIGEST', 'digest', 'utf8_string'], ['OSSL_KDF_PARAM_PASSWORD', 'pass', 'octet_string'], ['OSSL_KDF_PARAM_SALT', 'salt', 'octet_string'], diff --git a/providers/implementations/kdfs/sshkdf.c b/providers/implementations/kdfs/sshkdf.c index 4d58437447..81ca574ccb 100644 --- a/providers/implementations/kdfs/sshkdf.c +++ b/providers/implementations/kdfs/sshkdf.c @@ -226,8 +226,7 @@ static int kdf_sshkdf_set_ctx_params(void *vctx, const OSSL_PARAM params[]) if (p.digest != NULL) { const EVP_MD *md = NULL; - if (!ossl_prov_digest_load(&ctx->digest, p.digest, - p.propq, p.engine, provctx)) + if (!ossl_prov_digest_load(&ctx->digest, p.digest, p.propq, provctx)) return 0; md = ossl_prov_digest_md(&ctx->digest); diff --git a/providers/implementations/kdfs/sshkdf.inc.in b/providers/implementations/kdfs/sshkdf.inc.in index 85e1fdf951..743edf4f5d 100644 --- a/providers/implementations/kdfs/sshkdf.inc.in +++ b/providers/implementations/kdfs/sshkdf.inc.in @@ -13,7 +13,6 @@ use OpenSSL::paramnames qw(produce_param_decoder); {- produce_param_decoder('sshkdf_set_ctx_params', (['OSSL_KDF_PARAM_PROPERTIES', 'propq', 'utf8_string'], - ['OSSL_ALG_PARAM_ENGINE', 'engine', 'utf8_string', 'hidden'], ['OSSL_KDF_PARAM_DIGEST', 'digest', 'utf8_string'], ['OSSL_KDF_PARAM_KEY', 'key', 'octet_string'], ['OSSL_KDF_PARAM_SSHKDF_XCGHASH', 'xcg', 'octet_string'], diff --git a/providers/implementations/kdfs/sskdf.c b/providers/implementations/kdfs/sskdf.c index 2fac552d8d..1e10e68868 100644 --- a/providers/implementations/kdfs/sskdf.c +++ b/providers/implementations/kdfs/sskdf.c @@ -537,7 +537,6 @@ static int x963kdf_derive(void *vctx, unsigned char *key, size_t keylen, struct sskdf_all_set_ctx_params_st { OSSL_PARAM *secret; OSSL_PARAM *propq; - OSSL_PARAM *engine; OSSL_PARAM *digest; OSSL_PARAM *mac; OSSL_PARAM *salt; @@ -565,7 +564,7 @@ static int sskdf_common_set_ctx_params int r; if (!ossl_prov_macctx_load(&ctx->macctx, - p->mac, NULL, p->digest, p->propq, p->engine, + p->mac, NULL, p->digest, p->propq, NULL, NULL, NULL, libctx)) return 0; if (ctx->macctx != NULL) { @@ -578,8 +577,7 @@ static int sskdf_common_set_ctx_params } if (p->digest != NULL) { - if (!ossl_prov_digest_load(&ctx->digest, p->digest, - p->propq, p->engine, libctx)) + if (!ossl_prov_digest_load(&ctx->digest, p->digest, p->propq, libctx)) return 0; md = ossl_prov_digest_md(&ctx->digest); diff --git a/providers/implementations/kdfs/sskdf.inc.in b/providers/implementations/kdfs/sskdf.inc.in index a90d0ebf8f..059e179445 100644 --- a/providers/implementations/kdfs/sskdf.inc.in +++ b/providers/implementations/kdfs/sskdf.inc.in @@ -16,7 +16,6 @@ use OpenSSL::paramnames qw(produce_param_decoder); ['OSSL_KDF_PARAM_KEY', 'secret', 'octet_string'], ['OSSL_KDF_PARAM_INFO', 'info', 'octet_string', SSKDF_MAX_INFOS], ['OSSL_KDF_PARAM_PROPERTIES', 'propq', 'utf8_string'], - ['OSSL_ALG_PARAM_ENGINE', 'engine', 'utf8_string', 'hidden'], ['OSSL_KDF_PARAM_DIGEST', 'digest', 'utf8_string'], ['OSSL_KDF_PARAM_MAC', 'mac', 'utf8_string'], ['OSSL_KDF_PARAM_SALT', 'salt', 'octet_string'], @@ -34,7 +33,6 @@ use OpenSSL::paramnames qw(produce_param_decoder); ['OSSL_KDF_PARAM_KEY', 'secret', 'octet_string'], ['OSSL_KDF_PARAM_INFO', 'info', 'octet_string', SSKDF_MAX_INFOS], ['OSSL_KDF_PARAM_PROPERTIES', 'propq', 'utf8_string'], - ['OSSL_ALG_PARAM_ENGINE', 'engine', 'utf8_string', 'hidden'], ['OSSL_KDF_PARAM_DIGEST', 'digest', 'utf8_string'], ['OSSL_KDF_PARAM_MAC', 'mac', 'utf8_string'], ['OSSL_KDF_PARAM_SALT', 'salt', 'octet_string'], diff --git a/providers/implementations/kdfs/tls1_prf.c b/providers/implementations/kdfs/tls1_prf.c index f65c9eb71d..04908cacea 100644 --- a/providers/implementations/kdfs/tls1_prf.c +++ b/providers/implementations/kdfs/tls1_prf.c @@ -313,25 +313,25 @@ static int kdf_tls1_prf_set_ctx_params(void *vctx, const OSSL_PARAM params[]) if (OPENSSL_strcasecmp(dgst, OSSL_DIGEST_NAME_MD5_SHA1) == 0) { if (!ossl_prov_macctx_load(&ctx->P_hash, NULL, NULL, NULL, - p.propq, p.engine, + p.propq, OSSL_MAC_NAME_HMAC, NULL, OSSL_DIGEST_NAME_MD5, libctx)) return 0; if (!ossl_prov_macctx_load(&ctx->P_sha1, NULL, NULL, NULL, - p.propq, p.engine, + p.propq, OSSL_MAC_NAME_HMAC, NULL, OSSL_DIGEST_NAME_SHA1, libctx)) return 0; } else { EVP_MAC_CTX_free(ctx->P_sha1); if (!ossl_prov_macctx_load(&ctx->P_hash, NULL, NULL, p.digest, - p.propq, p.engine, + p.propq, OSSL_MAC_NAME_HMAC, NULL, NULL, libctx)) return 0; } memset(&digest, 0, sizeof(digest)); - if (!ossl_prov_digest_load(&digest, p.digest, p.propq, p.engine, libctx)) + if (!ossl_prov_digest_load(&digest, p.digest, p.propq, libctx)) return 0; md = ossl_prov_digest_md(&digest); diff --git a/providers/implementations/kdfs/tls1_prf.inc.in b/providers/implementations/kdfs/tls1_prf.inc.in index 9f04f59861..03583fcd05 100644 --- a/providers/implementations/kdfs/tls1_prf.inc.in +++ b/providers/implementations/kdfs/tls1_prf.inc.in @@ -13,7 +13,6 @@ use OpenSSL::paramnames qw(produce_param_decoder); {- produce_param_decoder('tls1prf_set_ctx_params', (['OSSL_KDF_PARAM_PROPERTIES', 'propq', 'utf8_string'], - ['OSSL_ALG_PARAM_ENGINE', 'engine', 'utf8_string', 'hidden'], ['OSSL_KDF_PARAM_DIGEST', 'digest', 'utf8_string'], ['OSSL_KDF_PARAM_SECRET', 'secret', 'octet_string'], ['OSSL_KDF_PARAM_SEED', 'seed', 'octet_string', TLSPRF_MAX_SEEDS], diff --git a/providers/implementations/kdfs/x942kdf.c b/providers/implementations/kdfs/x942kdf.c index 09ed47cedd..f22e1124f2 100644 --- a/providers/implementations/kdfs/x942kdf.c +++ b/providers/implementations/kdfs/x942kdf.c @@ -545,8 +545,7 @@ static int x942kdf_set_ctx_params(void *vctx, const OSSL_PARAM params[]) return 0; if (p.digest != NULL) { - if (!ossl_prov_digest_load(&ctx->digest, p.digest, - p.propq, p.engine, provctx)) + if (!ossl_prov_digest_load(&ctx->digest, p.digest, p.propq, provctx)) return 0; md = ossl_prov_digest_md(&ctx->digest); if (EVP_MD_xof(md)) { diff --git a/providers/implementations/kdfs/x942kdf.inc.in b/providers/implementations/kdfs/x942kdf.inc.in index 538bf2b3d2..57c4a549c5 100644 --- a/providers/implementations/kdfs/x942kdf.inc.in +++ b/providers/implementations/kdfs/x942kdf.inc.in @@ -13,7 +13,6 @@ use OpenSSL::paramnames qw(produce_param_decoder); {- produce_param_decoder('sshkdf_set_ctx_params', (['OSSL_KDF_PARAM_PROPERTIES', 'propq', 'utf8_string'], - ['OSSL_ALG_PARAM_ENGINE', 'engine', 'utf8_string', 'hidden'], ['OSSL_KDF_PARAM_DIGEST', 'digest', 'utf8_string'], ['OSSL_KDF_PARAM_SECRET', 'secret', 'octet_string'], ['OSSL_KDF_PARAM_KEY', 'secret', 'octet_string'], diff --git a/providers/implementations/keymgmt/mac_legacy_kmgmt.c b/providers/implementations/keymgmt/mac_legacy_kmgmt.c index 4b3b4e8c9c..b7cc62c16e 100644 --- a/providers/implementations/keymgmt/mac_legacy_kmgmt.c +++ b/providers/implementations/keymgmt/mac_legacy_kmgmt.c @@ -7,9 +7,6 @@ * https://www.openssl.org/source/license.html */ -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - #include #include #include @@ -18,9 +15,6 @@ #include #include #include -#ifndef FIPS_MODULE -# include -#endif #include "internal/param_build_set.h" #include "prov/implementations.h" #include "prov/providercommon.h" @@ -186,7 +180,6 @@ struct mac_common_params_st { OSSL_PARAM *key; OSSL_PARAM *cipher; /* CMAC */ OSSL_PARAM *propq; - OSSL_PARAM *engine; }; #define mac_import_st mac_common_params_st @@ -228,7 +221,7 @@ static int mac_key_fromdata(MAC_KEY *key, const struct mac_common_params_st *p) } if (key->cmac && !ossl_prov_cipher_load(&key->cipher, p->cipher, p->propq, - p->engine, key->libctx)) { + key->libctx)) { ERR_raise(ERR_LIB_PROV, ERR_R_PASSED_INVALID_ARGUMENT); return 0; } @@ -301,14 +294,6 @@ static int key_to_params(MAC_KEY *key, OSSL_PARAM_BLD *tmpl, EVP_CIPHER_get0_name(key->cipher.cipher))) return 0; -#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) - if (key->cipher.engine != NULL - && !ossl_param_build_set_utf8_string(tmpl, p->engine, - OSSL_PKEY_PARAM_ENGINE, - ENGINE_get_id(key->cipher.engine))) - return 0; -#endif - return 1; } @@ -475,7 +460,7 @@ static int cmac_gen_set_params(void *genctx, const OSSL_PARAM params[]) return 0; if (!ossl_prov_cipher_load(&gctx->cipher, p.cipher, p.propq, - p.engine, gctx->libctx)) { + gctx->libctx)) { ERR_raise(ERR_LIB_PROV, ERR_R_PASSED_INVALID_ARGUMENT); return 0; } diff --git a/providers/implementations/keymgmt/mac_legacy_kmgmt.inc.in b/providers/implementations/keymgmt/mac_legacy_kmgmt.inc.in index 3d9028710e..be5ca7e4af 100644 --- a/providers/implementations/keymgmt/mac_legacy_kmgmt.inc.in +++ b/providers/implementations/keymgmt/mac_legacy_kmgmt.inc.in @@ -19,7 +19,6 @@ use OpenSSL::paramnames qw(produce_param_decoder); {- produce_param_decoder('cmac_import', (['OSSL_PKEY_PARAM_PRIV_KEY', 'key', 'octet_string'], ['OSSL_PKEY_PARAM_CIPHER', 'cipher', 'utf8_string'], - ['OSSL_PKEY_PARAM_ENGINE', 'engine', 'utf8_string', 'hidden'], ['OSSL_PKEY_PARAM_PROPERTIES', 'propq', 'utf8_string'], )); -} @@ -30,7 +29,6 @@ use OpenSSL::paramnames qw(produce_param_decoder); {- produce_param_decoder('cmac_get_params', (['OSSL_PKEY_PARAM_PRIV_KEY', 'key', 'octet_string'], ['OSSL_PKEY_PARAM_CIPHER', 'cipher', 'utf8_string'], - ['OSSL_PKEY_PARAM_ENGINE', 'engine', 'utf8_string', 'hidden'], )); -} {- produce_param_decoder('mac_set_params', @@ -45,5 +43,4 @@ use OpenSSL::paramnames qw(produce_param_decoder); (['OSSL_PKEY_PARAM_PRIV_KEY', 'key', 'octet_string'], ['OSSL_PKEY_PARAM_CIPHER', 'cipher', 'utf8_string'], ['OSSL_PKEY_PARAM_PROPERTIES', 'propq', 'utf8_string'], - ['OSSL_PKEY_PARAM_ENGINE', 'engine', 'utf8_string', 'hidden'], )); -} diff --git a/providers/implementations/macs/cmac_prov.c b/providers/implementations/macs/cmac_prov.c index 90b81acc04..89f0c3d65b 100644 --- a/providers/implementations/macs/cmac_prov.c +++ b/providers/implementations/macs/cmac_prov.c @@ -163,8 +163,7 @@ static int cmac_setkey(struct cmac_data_st *macctx, p = prms; #endif rv = ossl_cmac_init(macctx->ctx, key, keylen, - ossl_prov_cipher_cipher(&macctx->cipher), - ossl_prov_cipher_engine(&macctx->cipher), p); + ossl_prov_cipher_cipher(&macctx->cipher), p); ossl_prov_cipher_reset(&macctx->cipher); return rv; } @@ -251,8 +250,7 @@ static int cmac_set_ctx_params(void *vmacctx, const OSSL_PARAM params[]) return 0; if (p.cipher != NULL) { - if (!ossl_prov_cipher_load(&macctx->cipher, p.cipher, p.propq, - p.engine, ctx)) + if (!ossl_prov_cipher_load(&macctx->cipher, p.cipher, p.propq, ctx)) return 0; if (EVP_CIPHER_get_mode(ossl_prov_cipher_cipher(&macctx->cipher)) diff --git a/providers/implementations/macs/cmac_prov.inc.in b/providers/implementations/macs/cmac_prov.inc.in index 36e2117c36..e82beaa1aa 100644 --- a/providers/implementations/macs/cmac_prov.inc.in +++ b/providers/implementations/macs/cmac_prov.inc.in @@ -19,7 +19,6 @@ use OpenSSL::paramnames qw(produce_param_decoder); {- produce_param_decoder('cmac_set_ctx_params', (['OSSL_MAC_PARAM_CIPHER', 'cipher', 'utf8_string'], - ['OSSL_ALG_PARAM_ENGINE', 'engine', 'utf8_string', 'hidden'], ['OSSL_MAC_PARAM_PROPERTIES', 'propq', 'utf8_string'], ['OSSL_MAC_PARAM_KEY', 'key', 'octet_string'], ['OSSL_CIPHER_PARAM_FIPS_ENCRYPT_CHECK', 'ind_ec', 'int', 'fips'], diff --git a/providers/implementations/macs/gmac_prov.c b/providers/implementations/macs/gmac_prov.c index 2c58922a90..d7903af8e4 100644 --- a/providers/implementations/macs/gmac_prov.c +++ b/providers/implementations/macs/gmac_prov.c @@ -210,8 +210,7 @@ static int gmac_set_ctx_params(void *vmacctx, const OSSL_PARAM params[]) provctx = PROV_LIBCTX_OF(macctx->provctx); if (p.cipher != NULL) { - if (!ossl_prov_cipher_load(&macctx->cipher, p.cipher, p.propq, - p.engine, provctx)) + if (!ossl_prov_cipher_load(&macctx->cipher, p.cipher, p.propq, provctx)) return 0; if (EVP_CIPHER_get_mode(ossl_prov_cipher_cipher(&macctx->cipher)) != EVP_CIPH_GCM_MODE) { @@ -219,8 +218,7 @@ static int gmac_set_ctx_params(void *vmacctx, const OSSL_PARAM params[]) return 0; } if (!EVP_EncryptInit_ex(ctx, ossl_prov_cipher_cipher(&macctx->cipher), - ossl_prov_cipher_engine(&macctx->cipher), NULL, - NULL)) + NULL, NULL, NULL)) return 0; } diff --git a/providers/implementations/macs/gmac_prov.inc.in b/providers/implementations/macs/gmac_prov.inc.in index edf049f29c..5a6dfa6748 100644 --- a/providers/implementations/macs/gmac_prov.inc.in +++ b/providers/implementations/macs/gmac_prov.inc.in @@ -17,7 +17,6 @@ use OpenSSL::paramnames qw(produce_param_decoder); {- produce_param_decoder('gmac_set_ctx_params', (['OSSL_MAC_PARAM_CIPHER', 'cipher', 'utf8_string'], - ['OSSL_ALG_PARAM_ENGINE', 'engine', 'utf8_string', 'hidden'], ['OSSL_MAC_PARAM_PROPERTIES', 'propq', 'utf8_string'], ['OSSL_MAC_PARAM_KEY', 'key', 'octet_string'], ['OSSL_MAC_PARAM_IV', 'iv', 'octet_string'], diff --git a/providers/implementations/macs/hmac_prov.c b/providers/implementations/macs/hmac_prov.c index ff934128c1..2275fdfa77 100644 --- a/providers/implementations/macs/hmac_prov.c +++ b/providers/implementations/macs/hmac_prov.c @@ -193,8 +193,7 @@ static int hmac_setkey(struct hmac_data_st *macctx, digest = ossl_prov_digest_md(&macctx->digest); /* HMAC_Init_ex doesn't tolerate all zero params, so we must be careful */ if (key != NULL || (macctx->tls_data_size == 0 && digest != NULL)) - return HMAC_Init_ex(macctx->ctx, key, (int)keylen, digest, - ossl_prov_digest_engine(&macctx->digest)); + return HMAC_Init_ex(macctx->ctx, key, (int)keylen, digest, NULL); return 1; } @@ -326,8 +325,7 @@ static int hmac_set_ctx_params(void *vmacctx, const OSSL_PARAM params[]) return 0; if (p.digest != NULL - && !ossl_prov_digest_load(&macctx->digest, p.digest, p.propq, - p.engine, ctx)) + && !ossl_prov_digest_load(&macctx->digest, p.digest, p.propq, ctx)) return 0; if (p.key != NULL) { diff --git a/providers/implementations/macs/hmac_prov.inc.in b/providers/implementations/macs/hmac_prov.inc.in index fd1dda6f42..4e4f15f81d 100644 --- a/providers/implementations/macs/hmac_prov.inc.in +++ b/providers/implementations/macs/hmac_prov.inc.in @@ -19,7 +19,6 @@ use OpenSSL::paramnames qw(produce_param_decoder); {- produce_param_decoder('hmac_set_ctx_params', (['OSSL_MAC_PARAM_DIGEST', 'digest', 'utf8_string'], - ['OSSL_ALG_PARAM_ENGINE', 'engine', 'utf8_string', 'hidden'], ['OSSL_MAC_PARAM_PROPERTIES', 'propq', 'utf8_string'], ['OSSL_MAC_PARAM_KEY', 'key', 'octet_string'], ['OSSL_MAC_PARAM_TLS_DATA_SIZE', 'tlssize', 'size_t'], diff --git a/providers/implementations/macs/kmac_prov.c b/providers/implementations/macs/kmac_prov.c index dc8addc39c..5beea468cb 100644 --- a/providers/implementations/macs/kmac_prov.c +++ b/providers/implementations/macs/kmac_prov.c @@ -199,7 +199,7 @@ static void *kmac_fetch_new(void *provctx, const OSSL_PARAM *params) return 0; if (!kmac_new_decoder(params, &p)) goto err; - if (!ossl_prov_digest_load(&kctx->digest, p.digest, p.propq, p.engine, + if (!ossl_prov_digest_load(&kctx->digest, p.digest, p.propq, PROV_LIBCTX_OF(provctx))) goto err; diff --git a/providers/implementations/macs/kmac_prov.inc.in b/providers/implementations/macs/kmac_prov.inc.in index 1089ef8b68..56ccd75c8b 100644 --- a/providers/implementations/macs/kmac_prov.inc.in +++ b/providers/implementations/macs/kmac_prov.inc.in @@ -14,7 +14,6 @@ use OpenSSL::paramnames qw(produce_param_decoder); {- produce_param_decoder('kmac_new', (['OSSL_MAC_PARAM_DIGEST', 'digest', 'utf8_string'], ['OSSL_MAC_PARAM_PROPERTIES', 'propq', 'utf8_string'], - ['OSSL_ALG_PARAM_ENGINE', 'engine', 'utf8_string', 'hidden'], )); -} {- produce_param_decoder('kmac_get_ctx_params', diff --git a/providers/implementations/rands/drbg_hash.c b/providers/implementations/rands/drbg_hash.c index 28a7bb8afa..e682443005 100644 --- a/providers/implementations/rands/drbg_hash.c +++ b/providers/implementations/rands/drbg_hash.c @@ -570,8 +570,7 @@ static int drbg_hash_set_ctx_params_locked if (!drbg_fetch_digest_from_prov(p, libctx, &prov_md)) { (void)ERR_pop_to_mark(); /* fall back to full implementation search */ - if (!ossl_prov_digest_load(&hash->digest, p->digest, p->propq, - p->engine, libctx)) + if (!ossl_prov_digest_load(&hash->digest, p->digest, p->propq, libctx)) return 0; } else { (void)ERR_clear_last_mark(); diff --git a/providers/implementations/rands/drbg_hash.inc.in b/providers/implementations/rands/drbg_hash.inc.in index 5983813fac..695071a152 100644 --- a/providers/implementations/rands/drbg_hash.inc.in +++ b/providers/implementations/rands/drbg_hash.inc.in @@ -31,7 +31,6 @@ use OpenSSL::paramnames qw(produce_param_decoder); {- produce_param_decoder('drbg_hash_set_ctx_params', (['OSSL_DRBG_PARAM_PROPERTIES', 'propq', 'utf8_string'], - ['OSSL_ALG_PARAM_ENGINE', 'engine', 'utf8_string', 'hidden'], ['OSSL_DRBG_PARAM_DIGEST', 'digest', 'utf8_string'], ['OSSL_PROV_PARAM_CORE_PROV_NAME', 'prov', 'utf8_string'], ['OSSL_DRBG_PARAM_RESEED_REQUESTS', 'reseed_req', 'uint'], diff --git a/providers/implementations/rands/drbg_hmac.c b/providers/implementations/rands/drbg_hmac.c index adf1d24e58..51f1ca26cd 100644 --- a/providers/implementations/rands/drbg_hmac.c +++ b/providers/implementations/rands/drbg_hmac.c @@ -464,12 +464,11 @@ static int drbg_hmac_set_ctx_params_locked if (p->digest != NULL) { /* fall back to full implementation search */ if (!ossl_prov_digest_load(&hmac->digest, p->digest, p->propq, - p->engine, libctx)) + libctx)) return 0; if (!ossl_prov_macctx_load(&hmac->ctx, NULL, NULL, p->digest, - p->propq, p->engine, - "HMAC", NULL, NULL, libctx)) + p->propq, "HMAC", NULL, NULL, libctx)) return 0; } } else { diff --git a/providers/implementations/rands/drbg_hmac.inc.in b/providers/implementations/rands/drbg_hmac.inc.in index 53f81410f3..360fb6808a 100644 --- a/providers/implementations/rands/drbg_hmac.inc.in +++ b/providers/implementations/rands/drbg_hmac.inc.in @@ -31,7 +31,6 @@ use OpenSSL::paramnames qw(produce_param_decoder); {- produce_param_decoder('drbg_hmac_set_ctx_params', (['OSSL_DRBG_PARAM_PROPERTIES', 'propq', 'utf8_string'], - ['OSSL_ALG_PARAM_ENGINE', 'engine', 'utf8_string', 'hidden'], ['OSSL_DRBG_PARAM_DIGEST', 'digest', 'utf8_string'], ['OSSL_PROV_PARAM_CORE_PROV_NAME', 'prov', 'utf8_string'], ['OSSL_DRBG_PARAM_RESEED_REQUESTS', 'reseed_req', 'uint'], diff --git a/providers/implementations/signature/mac_legacy_sig.c b/providers/implementations/signature/mac_legacy_sig.c index a5661eaa0b..d1861acc04 100644 --- a/providers/implementations/signature/mac_legacy_sig.c +++ b/providers/implementations/signature/mac_legacy_sig.c @@ -7,9 +7,6 @@ * https://www.openssl.org/source/license.html */ -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - #include #include #include @@ -17,9 +14,6 @@ #include #include #include -#ifndef FIPS_MODULE -# include -#endif #include "prov/implementations.h" #include "prov/provider_ctx.h" #include "prov/macsignature.h" @@ -97,7 +91,7 @@ static int mac_digest_sign_init(void *vpmacctx, const char *mdname, void *vkey, const OSSL_PARAM params[]) { PROV_MAC_CTX *pmacctx = (PROV_MAC_CTX *)vpmacctx; - const char *ciphername = NULL, *engine = NULL; + const char *ciphername = NULL; if (!ossl_prov_is_running() || pmacctx == NULL) @@ -117,15 +111,10 @@ static int mac_digest_sign_init(void *vpmacctx, const char *mdname, void *vkey, if (pmacctx->key->cipher.cipher != NULL) ciphername = (char *)EVP_CIPHER_get0_name(pmacctx->key->cipher.cipher); -#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE) - if (pmacctx->key->cipher.engine != NULL) - engine = (char *)ENGINE_get_id(pmacctx->key->cipher.engine); -#endif if (!ossl_prov_set_macctx(pmacctx->macctx, (char *)ciphername, (char *)mdname, - (char *)engine, pmacctx->key->properties, params)) return 0; diff --git a/ssl/record/methods/ssl3_cbc.c b/ssl/record/methods/ssl3_cbc.c index a8282989ed..1e42a9cb53 100644 --- a/ssl/record/methods/ssl3_cbc.c +++ b/ssl/record/methods/ssl3_cbc.c @@ -456,7 +456,7 @@ int ssl3_cbc_digest_record(const EVP_MD *md, if (md_ctx == NULL) goto err; - if (EVP_DigestInit_ex(md_ctx, md, NULL /* engine */) <= 0) + if (EVP_DigestInit_ex(md_ctx, md, NULL) <= 0) goto err; if (is_sslv3) { /* We repurpose |hmac_pad| to contain the SSLv3 pad2 block. */ diff --git a/ssl/record/methods/ssl3_meth.c b/ssl/record/methods/ssl3_meth.c index 6b5a1bed23..092085df63 100644 --- a/ssl/record/methods/ssl3_meth.c +++ b/ssl/record/methods/ssl3_meth.c @@ -64,10 +64,6 @@ static int ssl3_set_crypto_state(OSSL_RECORD_LAYER *rl, int level, return OSSL_RECORD_RETURN_FATAL; } - /* - * The cipher we actually ended up using in the EVP_CIPHER_CTX may be - * different to that in ciph if we have an ENGINE in use - */ if (EVP_CIPHER_get0_provider(EVP_CIPHER_CTX_get0_cipher(ciph_ctx)) != NULL && !ossl_set_tls_provider_parameters(rl, ciph_ctx, ciph, md)) { /* ERR_raise already called */ diff --git a/ssl/record/methods/tls1_meth.c b/ssl/record/methods/tls1_meth.c index 19295f6e58..114a2e1eb6 100644 --- a/ssl/record/methods/tls1_meth.c +++ b/ssl/record/methods/tls1_meth.c @@ -130,10 +130,6 @@ static int tls1_set_crypto_state(OSSL_RECORD_LAYER *rl, int level, return OSSL_RECORD_RETURN_FATAL; } - /* - * The cipher we actually ended up using in the EVP_CIPHER_CTX may be - * different to that in ciph if we have an ENGINE in use - */ if (EVP_CIPHER_get0_provider(EVP_CIPHER_CTX_get0_cipher(ciph_ctx)) != NULL && !ossl_set_tls_provider_parameters(rl, ciph_ctx, ciph, md)) { /* ERR_raise already called */ diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c index 159b9e60fe..1b194bf095 100644 --- a/ssl/s3_enc.c +++ b/ssl/s3_enc.c @@ -31,8 +31,8 @@ static int ssl3_generate_key_block(SSL_CONNECTION *s, unsigned char *km, int num c = os_toascii[c]; /* 'A' in ASCII */ #endif k = 0; - md5 = ssl_evp_md_fetch(sctx->libctx, NID_md5, sctx->propq); - sha1 = ssl_evp_md_fetch(sctx->libctx, NID_sha1, sctx->propq); + md5 = EVP_MD_fetch(sctx->libctx, "MD5", sctx->propq); + sha1 = EVP_MD_fetch(sctx->libctx, "SHA1", sctx->propq); m5 = EVP_MD_CTX_new(); s1 = EVP_MD_CTX_new(); if (md5 == NULL || sha1 == NULL || m5 == NULL || s1 == NULL) { diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c index 2c35f31065..cdfb69eb16 100644 --- a/ssl/ssl_ciph.c +++ b/ssl/ssl_ciph.c @@ -18,7 +18,6 @@ #include #include #include -#include #include #include #include @@ -125,11 +124,6 @@ static int ssl_cipher_info_find(const ssl_cipher_table *table, #define ssl_cipher_info_lookup(table, x) \ ssl_cipher_info_find(table, OSSL_NELEM(table), x) -/* - * PKEY_TYPE for GOST89MAC is known in advance, but, because implementation - * is engine-provided, we'll fill it only if corresponding EVP_PKEY_METHOD is - * found - */ static const int default_mac_pkey_id[SSL_MD_NUM_IDX] = { /* MD5, SHA, GOST94, MAC89 */ EVP_PKEY_HMAC, EVP_PKEY_HMAC, EVP_PKEY_HMAC, NID_undef, @@ -285,8 +279,6 @@ static const SSL_CIPHER cipher_aliases[] = { * Search for public key algorithm with given name and return its pkey_id if * it is available. Otherwise return 0 */ -# ifdef OPENSSL_NO_ENGINE - static int get_optional_pkey_id(const char *pkey_name) { const EVP_PKEY_ASN1_METHOD *ameth; @@ -298,23 +290,6 @@ static int get_optional_pkey_id(const char *pkey_name) return 0; } -# else - -static int get_optional_pkey_id(const char *pkey_name) -{ - const EVP_PKEY_ASN1_METHOD *ameth; - ENGINE *tmpeng = NULL; - int pkey_id = 0; - ameth = EVP_PKEY_asn1_find_str(&tmpeng, pkey_name, -1); - if (ameth) { - if (EVP_PKEY_asn1_get0_info(&pkey_id, NULL, NULL, NULL, NULL, - ameth) <= 0) - pkey_id = 0; - } - tls_engine_finish(tmpeng); - return pkey_id; -} -# endif #else static int get_optional_pkey_id(const char *pkey_name) { @@ -333,8 +308,9 @@ int ssl_load_ciphers(SSL_CTX *ctx) ctx->disabled_enc_mask = 0; for (i = 0, t = ssl_cipher_table_cipher; i < SSL_ENC_NUM_IDX; i++, t++) { if (t->nid != NID_undef) { - const EVP_CIPHER *cipher - = ssl_evp_cipher_fetch(ctx->libctx, t->nid, ctx->propq); + const EVP_CIPHER *cipher = ssl_evp_cipher_fetch(ctx->libctx, + OBJ_nid2sn(t->nid), + ctx->propq); ctx->ssl_cipher_methods[i] = cipher; if (cipher == NULL) @@ -343,8 +319,15 @@ int ssl_load_ciphers(SSL_CTX *ctx) } ctx->disabled_mac_mask = 0; for (i = 0, t = ssl_cipher_table_mac; i < SSL_MD_NUM_IDX; i++, t++) { - const EVP_MD *md - = ssl_evp_md_fetch(ctx->libctx, t->nid, ctx->propq); + /* + * We ignore any errors from the fetch below. It is expected to fail + * if these algorithms are not available. + */ + ERR_set_mark(); + const EVP_MD *md = EVP_MD_fetch(ctx->libctx, + OBJ_nid2sn(t->nid), + ctx->propq); + ERR_pop_to_mark(); ctx->ssl_digest_methods[i] = md; if (md == NULL) { @@ -461,9 +444,8 @@ int ssl_cipher_get_evp_cipher(SSL_CTX *ctx, const SSL_CIPHER *sslc, } else { if (i == SSL_ENC_NULL_IDX) { /* - * We assume we don't care about this coming from an ENGINE so - * just do a normal EVP_CIPHER_fetch instead of - * ssl_evp_cipher_fetch() + * This does not need any special handling. Use EVP_CIPHER_fetch() + * directly. */ *enc = EVP_CIPHER_fetch(ctx->libctx, "NULL", ctx->propq); if (*enc == NULL) @@ -561,27 +543,28 @@ int ssl_cipher_get_evp(SSL_CTX *ctx, const SSL_SESSION *s, if (c->algorithm_enc == SSL_RC4 && c->algorithm_mac == SSL_MD5) - evp = ssl_evp_cipher_fetch(ctx->libctx, NID_rc4_hmac_md5, + evp = ssl_evp_cipher_fetch(ctx->libctx, + "RC4-HMAC-MD5", ctx->propq); else if (c->algorithm_enc == SSL_AES128 && c->algorithm_mac == SSL_SHA1) evp = ssl_evp_cipher_fetch(ctx->libctx, - NID_aes_128_cbc_hmac_sha1, + "AES-128-CBC-HMAC-SHA1", ctx->propq); else if (c->algorithm_enc == SSL_AES256 && c->algorithm_mac == SSL_SHA1) evp = ssl_evp_cipher_fetch(ctx->libctx, - NID_aes_256_cbc_hmac_sha1, + "AES-256-CBC-HMAC-SHA1", ctx->propq); else if (c->algorithm_enc == SSL_AES128 && c->algorithm_mac == SSL_SHA256) evp = ssl_evp_cipher_fetch(ctx->libctx, - NID_aes_128_cbc_hmac_sha256, + "AES-128-CBC-HMAC-SHA256", ctx->propq); else if (c->algorithm_enc == SSL_AES256 && c->algorithm_mac == SSL_SHA256) evp = ssl_evp_cipher_fetch(ctx->libctx, - NID_aes_256_cbc_hmac_sha256, + "AES-256-CBC-HMAC-SHA256", ctx->propq); if (evp != NULL) { diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c index 54a22a1e5e..488b68f828 100644 --- a/ssl/ssl_lib.c +++ b/ssl/ssl_lib.c @@ -13,12 +13,12 @@ #include "internal/e_winsock.h" #include "ssl_local.h" +#include #include #include #include #include #include -#include #include #include #include @@ -4148,8 +4148,10 @@ SSL_CTX *SSL_CTX_new_ex(OSSL_LIB_CTX *libctx, const char *propq, * If these aren't available from the provider we'll get NULL returns. * That's fine but will cause errors later if SSLv3 is negotiated */ - ret->md5 = ssl_evp_md_fetch(libctx, NID_md5, propq); - ret->sha1 = ssl_evp_md_fetch(libctx, NID_sha1, propq); + ERR_set_mark(); + ret->md5 = EVP_MD_fetch(libctx, "MD5", propq); + ret->sha1 = EVP_MD_fetch(libctx, "SHA1", propq); + ERR_pop_to_mark(); if ((ret->ca_names = sk_X509_NAME_new_null()) == NULL) { ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); @@ -4197,24 +4199,6 @@ SSL_CTX *SSL_CTX_new_ex(OSSL_LIB_CTX *libctx, const char *propq, goto err; } #endif -#ifndef OPENSSL_NO_ENGINE -# ifdef OPENSSL_SSL_CLIENT_ENGINE_AUTO -# define eng_strx(x) #x -# define eng_str(x) eng_strx(x) - /* Use specific client engine automatically... ignore errors */ - { - ENGINE *eng; - eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO)); - if (!eng) { - ERR_clear_error(); - ENGINE_load_builtin_engines(); - eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO)); - } - if (!eng || !SSL_CTX_set_client_cert_engine(ret, eng)) - ERR_clear_error(); - } -# endif -#endif #ifndef OPENSSL_NO_COMP_ALG /* @@ -4426,9 +4410,6 @@ void SSL_CTX_free(SSL_CTX *a) #ifndef OPENSSL_NO_SRP ssl_ctx_srp_ctx_free_intern(a); #endif -#ifndef OPENSSL_NO_ENGINE - tls_engine_finish(a->client_cert_engine); -#endif OPENSSL_free(a->ext.ecpointformats); OPENSSL_free(a->ext.supportedgroups); @@ -7491,21 +7472,13 @@ void SSL_set_allow_early_data_cb(SSL *s, } const EVP_CIPHER *ssl_evp_cipher_fetch(OSSL_LIB_CTX *libctx, - int nid, + const char *name, const char *properties) { const EVP_CIPHER *ciph; - ciph = tls_get_cipher_from_engine(nid); - if (ciph != NULL) - return ciph; - - /* - * If there is no engine cipher then we do an explicit fetch. This may fail - * and that could be ok - */ ERR_set_mark(); - ciph = EVP_CIPHER_fetch(libctx, OBJ_nid2sn(nid), properties); + ciph = EVP_CIPHER_fetch(libctx, name, properties); if (ciph != NULL) { OSSL_PARAM params[2]; int decrypt_only = 0; @@ -7552,23 +7525,6 @@ void ssl_evp_cipher_free(const EVP_CIPHER *cipher) } } -const EVP_MD *ssl_evp_md_fetch(OSSL_LIB_CTX *libctx, - int nid, - const char *properties) -{ - const EVP_MD *md; - - md = tls_get_digest_from_engine(nid); - if (md != NULL) - return md; - - /* Otherwise we do an explicit fetch */ - ERR_set_mark(); - md = EVP_MD_fetch(libctx, OBJ_nid2sn(nid), properties); - ERR_pop_to_mark(); - return md; -} - int ssl_evp_md_up_ref(const EVP_MD *md) { /* Don't up-ref an implicit EVP_MD */ diff --git a/ssl/ssl_local.h b/ssl/ssl_local.h index 3af36274c9..77e21f2a9d 100644 --- a/ssl/ssl_local.h +++ b/ssl/ssl_local.h @@ -975,13 +975,6 @@ struct ssl_ctx_st { /* The default read buffer length to use (0 means not set) */ size_t default_read_buf_len; -# ifndef OPENSSL_NO_ENGINE - /* - * Engine to pass requests for client certs to - */ - ENGINE *client_cert_engine; -# endif - /* ClientHello callback. Mostly for extensions, but not entirely. */ SSL_client_hello_cb_fn client_hello_cb; void *client_hello_cb_arg; @@ -3017,21 +3010,13 @@ void custom_exts_free(custom_ext_methods *exts); int ssl_ctx_system_config(SSL_CTX *ctx); const EVP_CIPHER *ssl_evp_cipher_fetch(OSSL_LIB_CTX *libctx, - int nid, + const char *name, const char *properties); int ssl_evp_cipher_up_ref(const EVP_CIPHER *cipher); void ssl_evp_cipher_free(const EVP_CIPHER *cipher); -const EVP_MD *ssl_evp_md_fetch(OSSL_LIB_CTX *libctx, - int nid, - const char *properties); int ssl_evp_md_up_ref(const EVP_MD *md); void ssl_evp_md_free(const EVP_MD *md); -void tls_engine_finish(ENGINE *e); -const EVP_CIPHER *tls_get_cipher_from_engine(int nid); -const EVP_MD *tls_get_digest_from_engine(int nid); -int tls_engine_load_ssl_client_cert(SSL_CONNECTION *s, X509 **px509, - EVP_PKEY **ppkey); int ssl_hmac_old_new(SSL_HMAC *ret); void ssl_hmac_old_free(SSL_HMAC *ctx); int ssl_hmac_old_init(SSL_HMAC *ctx, void *key, size_t len, char *md); diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c index c3aa35009d..c726e3418c 100644 --- a/ssl/ssl_sess.c +++ b/ssl/ssl_sess.c @@ -14,7 +14,6 @@ #endif #include #include -#include #include "internal/refcount.h" #include "internal/cryptlib.h" #include "internal/ssl_unwrap.h" diff --git a/ssl/statem/statem_clnt.c b/ssl/statem/statem_clnt.c index d8d6ad48ee..9e9e6b0097 100644 --- a/ssl/statem/statem_clnt.c +++ b/ssl/statem/statem_clnt.c @@ -22,7 +22,6 @@ #include #include #include -#include #include #include #include @@ -3455,8 +3454,7 @@ int ossl_gost_ukm(const SSL_CONNECTION *s, unsigned char *dgst_buf) EVP_MD_CTX *hash = NULL; unsigned int md_len; SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); - const EVP_MD *md = ssl_evp_md_fetch(sctx->libctx, NID_id_GostR3411_2012_256, - sctx->propq); + const EVP_MD *md = EVP_MD_fetch(sctx->libctx, "md_gost12_256", sctx->propq); if (md == NULL) return 0; @@ -3534,7 +3532,7 @@ static int tls_construct_cke_gost18(SSL_CONNECTION *s, WPACKET *pkt) goto err; }; - /* Reuse EVP_PKEY_CTRL_SET_IV, make choice in engine code */ + /* Reuse EVP_PKEY_CTRL_SET_IV */ if (EVP_PKEY_CTX_ctrl(pkey_ctx, -1, EVP_PKEY_OP_ENCRYPT, EVP_PKEY_CTRL_SET_IV, 32, rnd_dgst) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_LIBRARY_BUG); @@ -4127,13 +4125,6 @@ int ssl_do_client_cert_cb(SSL_CONNECTION *s, X509 **px509, EVP_PKEY **ppkey) int i = 0; SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); -#ifndef OPENSSL_NO_ENGINE - if (sctx->client_cert_engine) { - i = tls_engine_load_ssl_client_cert(s, px509, ppkey); - if (i != 0) - return i; - } -#endif if (sctx->client_cert_cb) i = sctx->client_cert_cb(SSL_CONNECTION_GET_USER_SSL(s), px509, ppkey); return i; diff --git a/ssl/statem/statem_srvr.c b/ssl/statem/statem_srvr.c index 8658e78bba..c7baa896f1 100644 --- a/ssl/statem/statem_srvr.c +++ b/ssl/statem/statem_srvr.c @@ -3513,7 +3513,6 @@ static int tls_process_cke_gost18(SSL_CONNECTION *s, PACKET *pkt) goto err; } - /* Reuse EVP_PKEY_CTRL_SET_IV, make choice in engine code depending on size */ if (EVP_PKEY_CTX_ctrl(pkey_ctx, -1, EVP_PKEY_OP_DECRYPT, EVP_PKEY_CTRL_SET_IV, 32, rnd_dgst) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_LIBRARY_BUG); diff --git a/ssl/tls_depr.c b/ssl/tls_depr.c index b489ab11fa..59aa475e27 100644 --- a/ssl/tls_depr.c +++ b/ssl/tls_depr.c @@ -7,93 +7,12 @@ * https://www.openssl.org/source/license.html */ -/* We need to use some engine and HMAC deprecated APIs */ +/* We need to use some HMAC deprecated APIs */ #define OPENSSL_SUPPRESS_DEPRECATED -#include #include "ssl_local.h" #include "internal/ssl_unwrap.h" -/* - * Engine APIs are only used to support applications that still use ENGINEs. - * Once ENGINE is removed completely, all of this code can also be removed. - */ - -#ifndef OPENSSL_NO_ENGINE -void tls_engine_finish(ENGINE *e) -{ - ENGINE_finish(e); -} -#endif - -const EVP_CIPHER *tls_get_cipher_from_engine(int nid) -{ - const EVP_CIPHER *ret = NULL; -#ifndef OPENSSL_NO_ENGINE - ENGINE *eng; - - /* - * If there is an Engine available for this cipher we use the "implicit" - * form to ensure we use that engine later. - */ - eng = ENGINE_get_cipher_engine(nid); - if (eng != NULL) { - ret = ENGINE_get_cipher(eng, nid); - ENGINE_finish(eng); - } -#endif - return ret; -} - -const EVP_MD *tls_get_digest_from_engine(int nid) -{ - const EVP_MD *ret = NULL; -#ifndef OPENSSL_NO_ENGINE - ENGINE *eng; - - /* - * If there is an Engine available for this digest we use the "implicit" - * form to ensure we use that engine later. - */ - eng = ENGINE_get_digest_engine(nid); - if (eng != NULL) { - ret = ENGINE_get_digest(eng, nid); - ENGINE_finish(eng); - } -#endif - return ret; -} - -#ifndef OPENSSL_NO_ENGINE -int tls_engine_load_ssl_client_cert(SSL_CONNECTION *s, X509 **px509, - EVP_PKEY **ppkey) -{ - SSL *ssl = SSL_CONNECTION_GET_SSL(s); - - return ENGINE_load_ssl_client_cert(SSL_CONNECTION_GET_CTX(s)->client_cert_engine, - ssl, - SSL_get_client_CA_list(ssl), - px509, ppkey, NULL, NULL, NULL); -} -#endif - -#ifndef OPENSSL_NO_ENGINE -int SSL_CTX_set_client_cert_engine(SSL_CTX *ctx, ENGINE *e) -{ - if (!ENGINE_init(e)) { - ERR_raise(ERR_LIB_SSL, ERR_R_ENGINE_LIB); - return 0; - } - if (!ENGINE_get_ssl_client_cert_function(e)) { - ERR_raise(ERR_LIB_SSL, SSL_R_NO_CLIENT_CERT_METHOD); - ENGINE_finish(e); - return 0; - } - ctx->client_cert_engine = e; - return 1; -} -#endif - /* * The HMAC APIs below are only used to support the deprecated public API * macro SSL_CTX_set_tlsext_ticket_key_cb(). The application supplied callback diff --git a/test/README-dev.md b/test/README-dev.md index d8922de000..3b855d8519 100644 --- a/test/README-dev.md +++ b/test/README-dev.md @@ -29,7 +29,7 @@ The number `{nn}` is (somewhat loosely) grouped as follows: 15-19 individual asymmetric cipher algorithms 20-24 openssl commands (some otherwise not tested) 25-29 certificate forms, generation and verification - 30-35 engine and evp + 30-35 evp 60-79 APIs: 60 X509 subsystem 61 BIO subsystem diff --git a/test/README-external.md b/test/README-external.md index a98c6976c8..2d7e71d79b 100644 --- a/test/README-external.md +++ b/test/README-external.md @@ -65,28 +65,6 @@ krb5 will automatically adapt its test suite to account for the configuration of your system. Certain tests may require more installed packages to run. No tests are expected to fail. -GOST engine test suite -====================== - -Much like the PYCA/Cryptography test suite, this builds and runs the GOST engine -tests against the local OpenSSL build. - -You will need a git checkout of gost-engine at the top level: - - $ git submodule update --init - -Then configure/build OpenSSL enabling external tests: - - $ ./config enable-external-tests - $ make - -GOST engine requires CMake for the build process. - -GOST engine tests will then be run as part of the rest of the suite, or can be -explicitly run (with more debugging): - - $ make test VERBOSE=1 TESTS=test_external_gost_engine - OQSprovider test suite ====================== diff --git a/test/afalgtest.c b/test/afalgtest.c deleted file mode 100644 index 764f07e927..0000000000 --- a/test/afalgtest.c +++ /dev/null @@ -1,160 +0,0 @@ -/* - * Copyright 2016-2023 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* We need to use some engine deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - -#include -#include - -#include -#include -#include -#include -#include "testutil.h" - -/* Use a buffer size which is not aligned to block size */ -#define BUFFER_SIZE 17 - -#ifndef OPENSSL_NO_ENGINE -static ENGINE *e; - -static int test_afalg_aes_cbc(int keysize_idx) -{ - EVP_CIPHER_CTX *ctx; - const EVP_CIPHER *cipher; - unsigned char ebuf[BUFFER_SIZE + 32]; - unsigned char dbuf[BUFFER_SIZE + 32]; - const unsigned char *enc_result = NULL; - int encl, encf, decl, decf; - int ret = 0; - static const unsigned char key[] = - "\x06\xa9\x21\x40\x36\xb8\xa1\x5b\x51\x2e\x03\xd5\x34\x12\x00\x06" - "\x06\xa9\x21\x40\x36\xb8\xa1\x5b\x51\x2e\x03\xd5\x34\x12\x00\x06"; - static const unsigned char iv[] = - "\x3d\xaf\xba\x42\x9d\x9e\xb4\x30\xb4\x22\xda\x80\x2c\x9f\xac\x41"; - /* input = "Single block msg\n" 17 Bytes*/ - static const unsigned char in[BUFFER_SIZE] = - "\x53\x69\x6e\x67\x6c\x65\x20\x62\x6c\x6f\x63\x6b\x20\x6d\x73\x67" - "\x0a"; - static const unsigned char encresult_128[BUFFER_SIZE] = - "\xe3\x53\x77\x9c\x10\x79\xae\xb8\x27\x08\x94\x2d\xbe\x77\x18\x1a" - "\x2d"; - static const unsigned char encresult_192[BUFFER_SIZE] = - "\xf7\xe4\x26\xd1\xd5\x4f\x8f\x39\xb1\x9e\xe0\xdf\x61\xb9\xc2\x55" - "\xeb"; - static const unsigned char encresult_256[BUFFER_SIZE] = - "\xa0\x76\x85\xfd\xc1\x65\x71\x9d\xc7\xe9\x13\x6e\xae\x55\x49\xb4" - "\x13"; - -#ifdef OSSL_SANITIZE_MEMORY - /* - * Initialise the encryption & decryption buffers to pacify the memory - * sanitiser. The sanitiser doesn't know that this memory is modified - * by the engine, this tells it that all is good. - */ - OPENSSL_cleanse(ebuf, sizeof(ebuf)); - OPENSSL_cleanse(dbuf, sizeof(dbuf)); -#endif - - switch (keysize_idx) { - case 0: - cipher = EVP_aes_128_cbc(); - enc_result = &encresult_128[0]; - break; - case 1: - cipher = EVP_aes_192_cbc(); - enc_result = &encresult_192[0]; - break; - case 2: - cipher = EVP_aes_256_cbc(); - enc_result = &encresult_256[0]; - break; - default: - cipher = NULL; - } - if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) - return 0; - - if (!TEST_true(EVP_CipherInit_ex(ctx, cipher, e, key, iv, 1)) - || !TEST_true(EVP_CipherUpdate(ctx, ebuf, &encl, in, BUFFER_SIZE)) - || !TEST_true(EVP_CipherFinal_ex(ctx, ebuf + encl, &encf))) - goto end; - encl += encf; - - if (!TEST_mem_eq(enc_result, BUFFER_SIZE, ebuf, BUFFER_SIZE)) - goto end; - - if (!TEST_true(EVP_CIPHER_CTX_reset(ctx)) - || !TEST_true(EVP_CipherInit_ex(ctx, cipher, e, key, iv, 0)) - || !TEST_true(EVP_CipherUpdate(ctx, dbuf, &decl, ebuf, encl)) - || !TEST_true(EVP_CipherFinal_ex(ctx, dbuf + decl, &decf))) - goto end; - decl += decf; - - if (!TEST_int_eq(decl, BUFFER_SIZE) - || !TEST_mem_eq(dbuf, BUFFER_SIZE, in, BUFFER_SIZE)) - goto end; - - ret = 1; - - end: - EVP_CIPHER_CTX_free(ctx); - return ret; -} - -static int test_pr16743(void) -{ - int ret = 0; - const EVP_CIPHER *cipher; - EVP_CIPHER_CTX *ctx; - - if (!TEST_true(ENGINE_init(e))) - return 0; - cipher = ENGINE_get_cipher(e, NID_aes_128_cbc); - ctx = EVP_CIPHER_CTX_new(); - if (cipher != NULL && ctx != NULL) - ret = EVP_EncryptInit_ex(ctx, cipher, e, NULL, NULL); - TEST_true(ret); - EVP_CIPHER_CTX_free(ctx); - ENGINE_finish(e); - return ret; -} - -int global_init(void) -{ - ENGINE_load_builtin_engines(); -# ifndef OPENSSL_NO_STATIC_ENGINE - OPENSSL_init_crypto(OPENSSL_INIT_ENGINE_AFALG, NULL); -# endif - return 1; -} -#endif - -int setup_tests(void) -{ -#ifndef OPENSSL_NO_ENGINE - if ((e = ENGINE_by_id("afalg")) == NULL) { - /* Probably a platform env issue, not a test failure. */ - TEST_info("Can't load AFALG engine"); - } else { - ADD_ALL_TESTS(test_afalg_aes_cbc, 3); - ADD_TEST(test_pr16743); - } -#endif - - return 1; -} - -#ifndef OPENSSL_NO_ENGINE -void cleanup_tests(void) -{ - ENGINE_free(e); -} -#endif diff --git a/test/build.info b/test/build.info index 1392bb1a48..9eaf1b2b78 100644 --- a/test/build.info +++ b/test/build.info @@ -51,7 +51,7 @@ IF[{- !$disabled{tests} -}] conf_include_test params_api_test params_conversion_test \ constant_time_test safe_math_test verify_extra_test clienthellotest \ packettest asynctest secmemtest srptest memleaktest stack_test \ - dtlsv1listentest ct_test threadstest afalgtest d2i_test \ + dtlsv1listentest ct_test threadstest d2i_test \ ssl_test_ctx_test ssl_test x509aux cipherlist_test asynciotest \ bio_callback_test bio_memleak_test bio_core_test bio_dgram_test param_build_test \ bioprinttest sslapitest ssl_handshake_rtt_test dtlstest sslcorrupttest \ @@ -80,10 +80,6 @@ IF[{- !$disabled{tests} -}] PROGRAMS{noninst}=handshake-memfail x509-memfail ENDIF - IF[{- !$disabled{'deprecated-3.0'} -}] - PROGRAMS{noinst}=enginetest - ENDIF - IF[{- !$disabled{quic} -}] PROGRAMS{noinst}=priority_queue_test quicfaultstest quicapitest \ quic_newcid_test quic_srt_gen_test @@ -160,10 +156,6 @@ IF[{- !$disabled{tests} -}] INCLUDE[sha_test]=../include ../apps/include DEPEND[sha_test]=../libcrypto libtestutil.a - SOURCE[enginetest]=enginetest.c - INCLUDE[enginetest]=../include ../apps/include - DEPEND[enginetest]=../libcrypto libtestutil.a - SOURCE[exptest]=exptest.c INCLUDE[exptest]=../include ../apps/include DEPEND[exptest]=../libcrypto libtestutil.a @@ -498,10 +490,6 @@ IF[{- !$disabled{tests} -}] INCLUDE[threadstest_fips]=../include ../apps/include DEPEND[threadstest_fips]=../libcrypto libtestutil.a - SOURCE[afalgtest]=afalgtest.c - INCLUDE[afalgtest]=../include ../apps/include - DEPEND[afalgtest]=../libcrypto libtestutil.a - SOURCE[d2i_test]=d2i_test.c INCLUDE[d2i_test]=../include ../apps/include DEPEND[d2i_test]=../libcrypto libtestutil.a @@ -830,7 +818,7 @@ IF[{- !$disabled{tests} -}] DEPEND[cmp_client_test]=../libcrypto.a libtestutil.a SOURCE[ca_internals_test]=ca_internals_test.c ../apps/ca.c ../apps/lib/apps.c \ - ../apps/lib/app_rand.c ../apps/lib/engine.c ../apps/lib/app_provider.c \ + ../apps/lib/app_rand.c ../apps/lib/app_provider.c \ ../apps/lib/app_libctx.c ../apps/lib/fmt.c ../apps/lib/apps_ui.c \ ../apps/lib/app_x509.c ../crypto/asn1/a_time.c ../crypto/ctype.c INCLUDE[ca_internals_test]=.. ../include ../apps/include diff --git a/test/danetest.c b/test/danetest.c index e0c5b52280..335025b5d9 100644 --- a/test/danetest.c +++ b/test/danetest.c @@ -19,9 +19,6 @@ #include #include #include -#ifndef OPENSSL_NO_ENGINE -# include -#endif #include "testutil.h" #include "internal/nelem.h" diff --git a/test/ectest.c b/test/ectest.c index 6a13a46787..f164c5ac06 100644 --- a/test/ectest.c +++ b/test/ectest.c @@ -19,9 +19,6 @@ #include "testutil.h" #include -#ifndef OPENSSL_NO_ENGINE -# include -#endif #include #include #include diff --git a/test/enginetest.c b/test/enginetest.c deleted file mode 100644 index 7e67ee4506..0000000000 --- a/test/enginetest.c +++ /dev/null @@ -1,465 +0,0 @@ -/* - * Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* We need to use some deprecated APIs */ -#define OPENSSL_SUPPRESS_DEPRECATED - -#include -#include -#include -#include - -# include "testutil.h" - -#ifndef OPENSSL_NO_ENGINE -# include -# include -# include -# include -# include -# include -# include - -static void display_engine_list(void) -{ - ENGINE *h; - int loop; - - loop = 0; - for (h = ENGINE_get_first(); h != NULL; h = ENGINE_get_next(h)) { - TEST_info("#%d: id = \"%s\", name = \"%s\"", - loop++, ENGINE_get_id(h), ENGINE_get_name(h)); - } - - /* - * ENGINE_get_first() increases the struct_ref counter, so we must call - * ENGINE_free() to decrease it again - */ - ENGINE_free(h); -} - -#define NUMTOADD 512 - -static int test_engines(void) -{ - ENGINE *block[NUMTOADD]; - char *eid[NUMTOADD]; - char *ename[NUMTOADD]; - char buf[256]; - ENGINE *ptr; - int loop; - int to_return = 0; - ENGINE *new_h1 = NULL; - ENGINE *new_h2 = NULL; - ENGINE *new_h3 = NULL; - ENGINE *new_h4 = NULL; - - memset(block, 0, sizeof(block)); - if (!TEST_ptr(new_h1 = ENGINE_new()) - || !TEST_true(ENGINE_set_id(new_h1, "test_id0")) - || !TEST_true(ENGINE_set_name(new_h1, "First test item")) - || !TEST_ptr(new_h2 = ENGINE_new()) - || !TEST_true(ENGINE_set_id(new_h2, "test_id1")) - || !TEST_true(ENGINE_set_name(new_h2, "Second test item")) - || !TEST_ptr(new_h3 = ENGINE_new()) - || !TEST_true(ENGINE_set_id(new_h3, "test_id2")) - || !TEST_true(ENGINE_set_name(new_h3, "Third test item")) - || !TEST_ptr(new_h4 = ENGINE_new()) - || !TEST_true(ENGINE_set_id(new_h4, "test_id3")) - || !TEST_true(ENGINE_set_name(new_h4, "Fourth test item"))) - goto end; - TEST_info("Engines:"); - display_engine_list(); - - if (!TEST_true(ENGINE_add(new_h1))) - goto end; - TEST_info("Engines:"); - display_engine_list(); - - ptr = ENGINE_get_first(); - if (!TEST_true(ENGINE_remove(ptr))) - goto end; - ENGINE_free(ptr); - TEST_info("Engines:"); - display_engine_list(); - - if (!TEST_true(ENGINE_add(new_h3)) - || !TEST_true(ENGINE_add(new_h2))) - goto end; - TEST_info("Engines:"); - display_engine_list(); - - if (!TEST_true(ENGINE_remove(new_h2))) - goto end; - TEST_info("Engines:"); - display_engine_list(); - - if (!TEST_true(ENGINE_add(new_h4))) - goto end; - TEST_info("Engines:"); - display_engine_list(); - - /* Should fail. */ - if (!TEST_false(ENGINE_add(new_h3))) - goto end; - ERR_clear_error(); - - /* Should fail. */ - if (!TEST_false(ENGINE_remove(new_h2))) - goto end; - ERR_clear_error(); - - if (!TEST_true(ENGINE_remove(new_h3))) - goto end; - TEST_info("Engines:"); - display_engine_list(); - - if (!TEST_true(ENGINE_remove(new_h4))) - goto end; - TEST_info("Engines:"); - display_engine_list(); - - /* - * At this point, we should have an empty list, unless some hardware - * support engine got added. However, since we don't allow the config - * file to be loaded and don't otherwise load any built in engines, - * that is unlikely. Still, we check, if for nothing else, then to - * notify that something is a little off (and might mean that |new_h1| - * wasn't unloaded when it should have) - */ - if ((ptr = ENGINE_get_first()) != NULL) { - if (!ENGINE_remove(ptr)) - TEST_info("Remove failed - probably no hardware support present"); - } - ENGINE_free(ptr); - TEST_info("Engines:"); - display_engine_list(); - - if (!TEST_true(ENGINE_add(new_h1)) - || !TEST_true(ENGINE_remove(new_h1))) - goto end; - - TEST_info("About to beef up the engine-type list"); - for (loop = 0; loop < NUMTOADD; loop++) { - BIO_snprintf(buf, sizeof(buf), "id%d", loop); - eid[loop] = OPENSSL_strdup(buf); - BIO_snprintf(buf, sizeof(buf), "Fake engine type %d", loop); - ename[loop] = OPENSSL_strdup(buf); - if (!TEST_ptr(block[loop] = ENGINE_new()) - || !TEST_true(ENGINE_set_id(block[loop], eid[loop])) - || !TEST_true(ENGINE_set_name(block[loop], ename[loop]))) - goto end; - } - for (loop = 0; loop < NUMTOADD; loop++) { - if (!TEST_true(ENGINE_add(block[loop]))) { - test_note("Adding stopped at %d, (%s,%s)", - loop, ENGINE_get_id(block[loop]), - ENGINE_get_name(block[loop])); - goto cleanup_loop; - } - } - cleanup_loop: - TEST_info("About to empty the engine-type list"); - while ((ptr = ENGINE_get_first()) != NULL) { - if (!TEST_true(ENGINE_remove(ptr))) - goto end; - ENGINE_free(ptr); - } - for (loop = 0; loop < NUMTOADD; loop++) { - OPENSSL_free(eid[loop]); - OPENSSL_free(ename[loop]); - } - to_return = 1; - - end: - ENGINE_free(new_h1); - ENGINE_free(new_h2); - ENGINE_free(new_h3); - ENGINE_free(new_h4); - for (loop = 0; loop < NUMTOADD; loop++) - ENGINE_free(block[loop]); - return to_return; -} - -/* Test EVP_PKEY method */ -static EVP_PKEY_METHOD *test_rsa = NULL; - -static int called_encrypt = 0; - -/* Test function to check operation has been redirected */ -static int test_encrypt(EVP_PKEY_CTX *ctx, unsigned char *sig, - size_t *siglen, const unsigned char *tbs, size_t tbslen) -{ - called_encrypt = 1; - return 1; -} - -static int test_pkey_meths(ENGINE *e, EVP_PKEY_METHOD **pmeth, - const int **pnids, int nid) -{ - static const int rnid = EVP_PKEY_RSA; - if (pmeth == NULL) { - *pnids = &rnid; - return 1; - } - - if (nid == EVP_PKEY_RSA) { - *pmeth = test_rsa; - return 1; - } - - *pmeth = NULL; - return 0; -} - -/* Return a test EVP_PKEY value */ - -static EVP_PKEY *get_test_pkey(void) -{ - static unsigned char n[] = - "\x00\xAA\x36\xAB\xCE\x88\xAC\xFD\xFF\x55\x52\x3C\x7F\xC4\x52\x3F" - "\x90\xEF\xA0\x0D\xF3\x77\x4A\x25\x9F\x2E\x62\xB4\xC5\xD9\x9C\xB5" - "\xAD\xB3\x00\xA0\x28\x5E\x53\x01\x93\x0E\x0C\x70\xFB\x68\x76\x93" - "\x9C\xE6\x16\xCE\x62\x4A\x11\xE0\x08\x6D\x34\x1E\xBC\xAC\xA0\xA1" - "\xF5"; - static unsigned char e[] = "\x11"; - - RSA *rsa = RSA_new(); - EVP_PKEY *pk = EVP_PKEY_new(); - - if (rsa == NULL || pk == NULL || !EVP_PKEY_assign_RSA(pk, rsa)) { - RSA_free(rsa); - EVP_PKEY_free(pk); - return NULL; - } - - if (!RSA_set0_key(rsa, BN_bin2bn(n, sizeof(n)-1, NULL), - BN_bin2bn(e, sizeof(e)-1, NULL), NULL)) { - EVP_PKEY_free(pk); - return NULL; - } - - return pk; -} - -static int test_redirect(void) -{ - const unsigned char pt[] = "Hello World\n"; - unsigned char *tmp = NULL; - size_t len; - EVP_PKEY_CTX *ctx = NULL; - ENGINE *e = NULL; - EVP_PKEY *pkey = NULL; - - int to_return = 0; - - if (!TEST_ptr(pkey = get_test_pkey())) - goto err; - - len = EVP_PKEY_get_size(pkey); - if (!TEST_ptr(tmp = OPENSSL_malloc(len))) - goto err; - - if (!TEST_ptr(ctx = EVP_PKEY_CTX_new(pkey, NULL))) - goto err; - TEST_info("EVP_PKEY_encrypt test: no redirection"); - /* Encrypt some data: should succeed but not be redirected */ - if (!TEST_int_gt(EVP_PKEY_encrypt_init(ctx), 0) - || !TEST_int_gt(EVP_PKEY_encrypt(ctx, tmp, &len, pt, sizeof(pt)), 0) - || !TEST_false(called_encrypt)) - goto err; - EVP_PKEY_CTX_free(ctx); - ctx = NULL; - - /* Create a test ENGINE */ - if (!TEST_ptr(e = ENGINE_new()) - || !TEST_true(ENGINE_set_id(e, "Test redirect engine")) - || !TEST_true(ENGINE_set_name(e, "Test redirect engine"))) - goto err; - - /* - * Try to create a context for this engine and test key. - * Try setting test key engine. Both should fail because the - * engine has no public key methods. - */ - if (!TEST_ptr_null(ctx = EVP_PKEY_CTX_new(pkey, e)) - || !TEST_int_le(EVP_PKEY_set1_engine(pkey, e), 0)) - goto err; - - /* Setup an empty test EVP_PKEY_METHOD and set callback to return it */ - if (!TEST_ptr(test_rsa = EVP_PKEY_meth_new(EVP_PKEY_RSA, 0))) - goto err; - ENGINE_set_pkey_meths(e, test_pkey_meths); - - /* Getting a context for test ENGINE should now succeed */ - if (!TEST_ptr(ctx = EVP_PKEY_CTX_new(pkey, e))) - goto err; - /* Encrypt should fail because operation is not supported */ - if (!TEST_int_le(EVP_PKEY_encrypt_init(ctx), 0)) - goto err; - EVP_PKEY_CTX_free(ctx); - ctx = NULL; - - /* Add test encrypt operation to method */ - EVP_PKEY_meth_set_encrypt(test_rsa, 0, test_encrypt); - - TEST_info("EVP_PKEY_encrypt test: redirection via EVP_PKEY_CTX_new()"); - if (!TEST_ptr(ctx = EVP_PKEY_CTX_new(pkey, e))) - goto err; - /* Encrypt some data: should succeed and be redirected */ - if (!TEST_int_gt(EVP_PKEY_encrypt_init(ctx), 0) - || !TEST_int_gt(EVP_PKEY_encrypt(ctx, tmp, &len, pt, sizeof(pt)), 0) - || !TEST_true(called_encrypt)) - goto err; - - EVP_PKEY_CTX_free(ctx); - ctx = NULL; - called_encrypt = 0; - - /* Create context with default engine: should not be redirected */ - if (!TEST_ptr(ctx = EVP_PKEY_CTX_new(pkey, NULL)) - || !TEST_int_gt(EVP_PKEY_encrypt_init(ctx), 0) - || !TEST_int_gt(EVP_PKEY_encrypt(ctx, tmp, &len, pt, sizeof(pt)), 0) - || !TEST_false(called_encrypt)) - goto err; - - EVP_PKEY_CTX_free(ctx); - ctx = NULL; - - /* Set engine explicitly for test key */ - if (!TEST_true(EVP_PKEY_set1_engine(pkey, e))) - goto err; - - TEST_info("EVP_PKEY_encrypt test: redirection via EVP_PKEY_set1_engine()"); - - /* Create context with default engine: should be redirected now */ - if (!TEST_ptr(ctx = EVP_PKEY_CTX_new(pkey, NULL)) - || !TEST_int_gt(EVP_PKEY_encrypt_init(ctx), 0) - || !TEST_int_gt(EVP_PKEY_encrypt(ctx, tmp, &len, pt, sizeof(pt)), 0) - || !TEST_true(called_encrypt)) - goto err; - - to_return = 1; - - err: - EVP_PKEY_CTX_free(ctx); - EVP_PKEY_free(pkey); - ENGINE_free(e); - OPENSSL_free(tmp); - return to_return; -} - -static int test_x509_dup_w_engine(void) -{ - ENGINE *e = NULL; - X509 *cert = NULL, *dupcert = NULL; - X509_PUBKEY *pubkey, *duppubkey = NULL; - int ret = 0; - BIO *b = NULL; - RSA_METHOD *rsameth = NULL; - - if (!TEST_ptr(b = BIO_new_file(test_get_argument(0), "r")) - || !TEST_ptr(cert = PEM_read_bio_X509(b, NULL, NULL, NULL))) - goto err; - - /* Dup without an engine */ - if (!TEST_ptr(dupcert = X509_dup(cert))) - goto err; - X509_free(dupcert); - dupcert = NULL; - - if (!TEST_ptr(pubkey = X509_get_X509_PUBKEY(cert)) - || !TEST_ptr(duppubkey = X509_PUBKEY_dup(pubkey)) - || !TEST_ptr_ne(duppubkey, pubkey) - || !TEST_ptr_ne(X509_PUBKEY_get0(duppubkey), X509_PUBKEY_get0(pubkey))) - goto err; - - X509_PUBKEY_free(duppubkey); - duppubkey = NULL; - - X509_free(cert); - cert = NULL; - - /* Create a test ENGINE */ - if (!TEST_ptr(e = ENGINE_new()) - || !TEST_true(ENGINE_set_id(e, "Test dummy engine")) - || !TEST_true(ENGINE_set_name(e, "Test dummy engine"))) - goto err; - - if (!TEST_ptr(rsameth = RSA_meth_dup(RSA_get_default_method()))) - goto err; - - ENGINE_set_RSA(e, rsameth); - - if (!TEST_true(ENGINE_set_default_RSA(e))) - goto err; - - if (!TEST_int_ge(BIO_seek(b, 0), 0) - || !TEST_ptr(cert = PEM_read_bio_X509(b, NULL, NULL, NULL))) - goto err; - - /* Dup with an engine set on the key */ - if (!TEST_ptr(dupcert = X509_dup(cert))) - goto err; - - if (!TEST_ptr(pubkey = X509_get_X509_PUBKEY(cert)) - || !TEST_ptr(duppubkey = X509_PUBKEY_dup(pubkey)) - || !TEST_ptr_ne(duppubkey, pubkey) - || !TEST_ptr_ne(X509_PUBKEY_get0(duppubkey), X509_PUBKEY_get0(pubkey))) - goto err; - - ret = 1; - - err: - X509_free(cert); - X509_free(dupcert); - X509_PUBKEY_free(duppubkey); - if (e != NULL) { - ENGINE_unregister_RSA(e); - ENGINE_free(e); - } - RSA_meth_free(rsameth); - BIO_free(b); - return ret; -} -#endif - -int global_init(void) -{ - /* - * If the config file gets loaded, the dynamic engine will be loaded, - * and that interferes with our test above. - */ - return OPENSSL_init_crypto(OPENSSL_INIT_NO_LOAD_CONFIG, NULL); -} - -OPT_TEST_DECLARE_USAGE("certfile\n") - -int setup_tests(void) -{ -#ifdef OPENSSL_NO_ENGINE - TEST_note("No ENGINE support"); -#else - size_t n; - - if (!test_skip_common_options()) { - TEST_error("Error parsing test options\n"); - return 0; - } - - n = test_get_argument_count(); - if (n == 0) - return 0; - - ADD_TEST(test_engines); - ADD_TEST(test_redirect); - ADD_TEST(test_x509_dup_w_engine); -#endif - return 1; -} diff --git a/test/evp_extra_test.c b/test/evp_extra_test.c index 581eb40189..ec8179d773 100644 --- a/test/evp_extra_test.c +++ b/test/evp_extra_test.c @@ -30,7 +30,6 @@ #include #include #include -#include #include #include # include @@ -3392,7 +3391,6 @@ static int test_CMAC_keygen(void) /* * This is a legacy method for CMACs, but should still work. - * This verifies that it works without an ENGINE. */ kctx = EVP_PKEY_CTX_new_id(EVP_PKEY_CMAC, NULL); @@ -6063,151 +6061,6 @@ static int test_custom_ciph_meth(void) return testresult; } -# ifndef OPENSSL_NO_DYNAMIC_ENGINE -/* Test we can create a signature keys with an associated ENGINE */ -static int test_signatures_with_engine(int tst) -{ - ENGINE *e; - const char *engine_id = "dasync"; - EVP_PKEY *pkey = NULL; - const unsigned char badcmackey[] = { 0x00, 0x01 }; - const unsigned char cmackey[] = { - 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, - 0x0c, 0x0d, 0x0e, 0x0f - }; - const unsigned char ed25519key[] = { - 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, - 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, - 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f - }; - const unsigned char msg[] = { 0x00, 0x01, 0x02, 0x03 }; - int testresult = 0; - EVP_MD_CTX *ctx = NULL; - unsigned char *mac = NULL; - size_t maclen = 0; - int ret; - -# ifdef OPENSSL_NO_CMAC - /* Skip CMAC tests in a no-cmac build */ - if (tst <= 1) - return 1; -# endif -# ifdef OPENSSL_NO_ECX - /* Skip ECX tests in a no-ecx build */ - if (tst == 2) - return 1; -# endif - - if (!TEST_ptr(e = ENGINE_by_id(engine_id))) - return 0; - - if (!TEST_true(ENGINE_init(e))) { - ENGINE_free(e); - return 0; - } - - switch (tst) { - case 0: - pkey = EVP_PKEY_new_CMAC_key(e, cmackey, sizeof(cmackey), - EVP_aes_128_cbc()); - break; - case 1: - pkey = EVP_PKEY_new_CMAC_key(e, badcmackey, sizeof(badcmackey), - EVP_aes_128_cbc()); - break; - case 2: - pkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_ED25519, e, ed25519key, - sizeof(ed25519key)); - break; - default: - TEST_error("Invalid test case"); - goto err; - } - if (!TEST_ptr(pkey)) - goto err; - - if (!TEST_ptr(ctx = EVP_MD_CTX_new())) - goto err; - - ret = EVP_DigestSignInit(ctx, NULL, tst == 2 ? NULL : EVP_sha256(), NULL, - pkey); - if (tst == 0) { - if (!TEST_true(ret)) - goto err; - - if (!TEST_true(EVP_DigestSignUpdate(ctx, msg, sizeof(msg))) - || !TEST_true(EVP_DigestSignFinal(ctx, NULL, &maclen))) - goto err; - - if (!TEST_ptr(mac = OPENSSL_malloc(maclen))) - goto err; - - if (!TEST_true(EVP_DigestSignFinal(ctx, mac, &maclen))) - goto err; - } else { - /* We used a bad key. We expect a failure here */ - if (!TEST_false(ret)) - goto err; - } - - testresult = 1; - err: - EVP_MD_CTX_free(ctx); - OPENSSL_free(mac); - EVP_PKEY_free(pkey); - ENGINE_finish(e); - ENGINE_free(e); - - return testresult; -} - -static int test_cipher_with_engine(void) -{ - ENGINE *e; - const char *engine_id = "dasync"; - const unsigned char keyiv[] = { - 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, - 0x0c, 0x0d, 0x0e, 0x0f - }; - const unsigned char msg[] = { 0x00, 0x01, 0x02, 0x03 }; - int testresult = 0; - EVP_CIPHER_CTX *ctx = NULL, *ctx2 = NULL; - unsigned char buf[AES_BLOCK_SIZE]; - int len = 0; - - if (!TEST_ptr(e = ENGINE_by_id(engine_id))) - return 0; - - if (!TEST_true(ENGINE_init(e))) { - ENGINE_free(e); - return 0; - } - - if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new()) - || !TEST_ptr(ctx2 = EVP_CIPHER_CTX_new())) - goto err; - - if (!TEST_true(EVP_EncryptInit_ex(ctx, EVP_aes_128_cbc(), e, keyiv, keyiv))) - goto err; - - /* Copy the ctx, and complete the operation with the new ctx */ - if (!TEST_true(EVP_CIPHER_CTX_copy(ctx2, ctx))) - goto err; - - if (!TEST_true(EVP_EncryptUpdate(ctx2, buf, &len, msg, sizeof(msg))) - || !TEST_true(EVP_EncryptFinal_ex(ctx2, buf + len, &len))) - goto err; - - testresult = 1; - err: - EVP_CIPHER_CTX_free(ctx); - EVP_CIPHER_CTX_free(ctx2); - ENGINE_finish(e); - ENGINE_free(e); - - return testresult; -} -# endif /* OPENSSL_NO_DYNAMIC_ENGINE */ #endif /* OPENSSL_NO_DEPRECATED_3_0 */ #ifndef OPENSSL_NO_ECX @@ -7038,18 +6891,6 @@ int setup_tests(void) ADD_TEST(test_evp_md_cipher_meth); ADD_TEST(test_custom_md_meth); ADD_TEST(test_custom_ciph_meth); - -# ifndef OPENSSL_NO_DYNAMIC_ENGINE - /* Tests only support the default libctx */ - if (testctx == NULL) { -# ifndef OPENSSL_NO_EC - ADD_ALL_TESTS(test_signatures_with_engine, 3); -# else - ADD_ALL_TESTS(test_signatures_with_engine, 2); -# endif - ADD_TEST(test_cipher_with_engine); - } -# endif #endif #ifndef OPENSSL_NO_ECX diff --git a/test/evp_kdf_test.c b/test/evp_kdf_test.c index 7a07168bc6..6a2010b665 100644 --- a/test/evp_kdf_test.c +++ b/test/evp_kdf_test.c @@ -2199,9 +2199,7 @@ static int test_kdf_hmac_drbg_settables(void) * the digest is also set */ if (OPENSSL_strcasecmp(settableparams[i].key, - OSSL_KDF_PARAM_PROPERTIES) != 0 - && OPENSSL_strcasecmp(settableparams[i].key, - OSSL_ALG_PARAM_ENGINE) != 0) { + OSSL_KDF_PARAM_PROPERTIES) != 0) { TEST_note("Testing set int into %s fails", settableparams[i].key); params[0] = OSSL_PARAM_construct_int(settableparams[i].key, &j); if (!TEST_int_le(EVP_KDF_CTX_set_params(kctx, params), 0)) diff --git a/test/helpers/ssltestlib.c b/test/helpers/ssltestlib.c index c5120c2daf..b7429778fb 100644 --- a/test/helpers/ssltestlib.c +++ b/test/helpers/ssltestlib.c @@ -7,17 +7,8 @@ * https://www.openssl.org/source/license.html */ -/* - * We need access to the deprecated low level ENGINE APIs for legacy purposes - * when the deprecated calls are not hidden - */ -#ifndef OPENSSL_NO_DEPRECATED_3_0 -# define OPENSSL_SUPPRESS_DEPRECATED -#endif - #include -#include #include "internal/e_os.h" #include "internal/nelem.h" #include "ssltestlib.h" @@ -1526,27 +1517,3 @@ int ssl_ctx_add_large_cert_chain(OSSL_LIB_CTX *libctx, SSL_CTX *sctx, X509_free(chaincert); return ret; } - -ENGINE *load_dasync(void) -{ -#if !defined(OPENSSL_NO_TLS1_2) && !defined(OPENSSL_NO_DYNAMIC_ENGINE) - ENGINE *e; - - if (!TEST_ptr(e = ENGINE_by_id("dasync"))) - return NULL; - - if (!TEST_true(ENGINE_init(e))) { - ENGINE_free(e); - return NULL; - } - - if (!TEST_true(ENGINE_register_ciphers(e))) { - ENGINE_free(e); - return NULL; - } - - return e; -#else - return NULL; -#endif -} diff --git a/test/helpers/ssltestlib.h b/test/helpers/ssltestlib.h index 557b820efb..c490c4cfa5 100644 --- a/test/helpers/ssltestlib.h +++ b/test/helpers/ssltestlib.h @@ -88,6 +88,4 @@ SSL_SESSION *create_a_psk(SSL *ssl, size_t mdsize); int ssl_ctx_add_large_cert_chain(OSSL_LIB_CTX *libctx, SSL_CTX *sctx, const char *cert_file); -ENGINE *load_dasync(void); - #endif /* OSSL_TEST_SSLTESTLIB_H */ diff --git a/test/recipes/02-test_windows_registry.t b/test/recipes/02-test_windows_registry.t index 3029b151e8..c5ad8092ca 100644 --- a/test/recipes/02-test_windows_registry.t +++ b/test/recipes/02-test_windows_registry.t @@ -42,8 +42,6 @@ plan tests => 3; my @expectossldir = run(cmd(["reg.exe", "query", $regkey, "/reg:32", "/t", "REG_EXPAND_SZ", "/v", "OPENSSLDIR"]), capture => 1); -my @expectengdir = run(cmd(["reg.exe", "query", $regkey, "/reg:32", "/t", "REG_EXPAND_SZ", "/v", "ENGINESDIR"]), capture => 1); - my @expectmoddir = run(cmd(["reg.exe", "query", $regkey, "/reg:32", "/t", "REG_EXPAND_SZ", "/v", "MODULESDIR"]), capture => 1); my @ossldir = run(app(["openssl", "version", "-d"]), capture => 1); @@ -59,18 +57,6 @@ $actual =~ s/OPENSSLDIR: *//; ok(grep(/$expect/,$actual), "Confirming version output for openssldir from registry"); -my @osslengineout = run(app(["openssl", "version", "-e"]), capture => 1); - -$expect = "@expectengdir"; -$actual = "@osslengineout"; -$expect =~ s/HKEY_LOCAL_MACHINE.*\n*//; -$expect =~ s/\n//g; -$expect =~ s/.*REG_EXPAND_SZ *//; -$expect =~ s/ .*$//; -$actual =~ s/ENGINESDIR: *//; - -ok(grep(/$expect/, $actual) == 1, "Confirming version output for enginesdir from registry"); - my @osslmoduleout = run(app(["openssl", "version", "-m"]), capture => 1); $expect = "@expectmoddir"; diff --git a/test/recipes/05-test_rand.t b/test/recipes/05-test_rand.t index 3a1bac8726..73a163d4d1 100644 --- a/test/recipes/05-test_rand.t +++ b/test/recipes/05-test_rand.t @@ -13,7 +13,7 @@ use OpenSSL::Test::Utils; use OpenSSL::Test qw/:DEFAULT srctop_file bldtop_dir/; use Cwd qw(abs_path); -plan tests => 6; +plan tests => 5; setup("test_rand"); ok(run(test(["rand_test", srctop_file("test", "default.cnf")]))); @@ -28,16 +28,16 @@ ok(run(test(["drbgtest"]))); ok(run(test(["rand_status_test"]))); SKIP: { - skip "engine is not supported by this OpenSSL build", 2 - if disabled("engine") || disabled("dynamic-engine"); - my $success; my @randdata; my $expected = '0102030405060708090a0b0c0d0e0f10'; $ENV{OPENSSL_MODULES} = abs_path(bldtop_dir("test")); - @randdata = run(app(['openssl', 'rand', '-provider', 'p_ossltest', '-provider', 'default', '-propquery', '?provider=p_ossltest', '-hex', '16' ]), - capture => 1, statusvar => \$success); + skip "provider modules are not supported by this OpenSSL build", 1 + if disabled("module"); + + @randdata = run(app(['openssl', 'rand', '-provider', 'p_ossltest', '-provider', 'default', '-propquery', '?provider=p_ossltest', '-hex', '16' ]), capture => 1, statusvar => \$success); + chomp(@randdata); ok($success && $randdata[0] eq $expected, "rand with ossltest provider: Check rand output is as expected"); @@ -45,10 +45,4 @@ SKIP: { @randdata = run(app(['openssl', 'rand', '-hex', '2K' ]), capture => 1, statusvar => \$success); chomp(@randdata); - - @randdata = run(app(['openssl', 'rand', '-engine', 'dasync', '-hex', '16' ]), - capture => 1, statusvar => \$success); - chomp(@randdata); - ok($success && length($randdata[0]) == 32, - "rand with dasync: Check rand output is of expected length"); } diff --git a/test/recipes/30-test_afalg.t b/test/recipes/30-test_afalg.t deleted file mode 100644 index 572a847511..0000000000 --- a/test/recipes/30-test_afalg.t +++ /dev/null @@ -1,21 +0,0 @@ -#! /usr/bin/env perl -# Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved. -# -# Licensed under the Apache License 2.0 (the "License"). You may not use -# this file except in compliance with the License. You can obtain a copy -# in the file LICENSE in the source distribution or at -# https://www.openssl.org/source/license.html - -use strict; -use OpenSSL::Test qw/:DEFAULT/; -use OpenSSL::Test::Utils; - -my $test_name = "test_afalg"; -setup($test_name); - -plan skip_all => "$test_name not supported for this build" - if disabled("afalgeng"); - -plan tests => 1; - -ok(run(test(["afalgtest"])), "running afalgtest"); diff --git a/test/recipes/30-test_engine.t b/test/recipes/30-test_engine.t deleted file mode 100644 index 88db8ec9a7..0000000000 --- a/test/recipes/30-test_engine.t +++ /dev/null @@ -1,25 +0,0 @@ -#! /usr/bin/env perl -# Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved. -# -# Licensed under the Apache License 2.0 (the "License"). You may not use -# this file except in compliance with the License. You can obtain a copy -# in the file LICENSE in the source distribution or at -# https://www.openssl.org/source/license.html - - -use strict; -use warnings; - -use OpenSSL::Test qw/:DEFAULT srctop_file/; -use OpenSSL::Test::Utils; - -setup("test_engine"); - -my @path = qw(test certs); - -plan skip_all => "engines are deprecated" - if disabled('deprecated-3.0'); - -plan tests => 1; -ok(run(test(["enginetest", srctop_file(@path, "root-cert.pem")])), - "running enginetest"); diff --git a/test/recipes/95-test_external_gost_engine.t b/test/recipes/95-test_external_gost_engine.t deleted file mode 100644 index 37daaf7eca..0000000000 --- a/test/recipes/95-test_external_gost_engine.t +++ /dev/null @@ -1,28 +0,0 @@ -#! /usr/bin/env perl -# Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved. -# -# Licensed under the Apache License 2.0 (the "License"). You may not use -# this file except in compliance with the License. You can obtain a copy -# in the file LICENSE in the source distribution or at -# https://www.openssl.org/source/license.html - - -use OpenSSL::Test; -use OpenSSL::Test::Utils; -use OpenSSL::Test qw/:DEFAULT data_file bldtop_dir srctop_dir cmdstr/; - -setup("test_external_gost_engine"); - -plan skip_all => "No external tests in this configuration" - if disabled("external-tests"); -plan skip_all => "GOST engine tests not available on Windows or VMS" - if $^O =~ /^(VMS|MSWin32)$/; -plan skip_all => "GOST engine tests only available in a shared build" - if disabled("shared"); -plan skip_all => "GOST engine tests not supported in out of tree builds" - if bldtop_dir() ne srctop_dir(); - -plan tests => 1; - -ok(run(cmd(["sh", data_file("gost_engine.sh")])), - "running GOST engine tests"); diff --git a/test/recipes/95-test_external_gost_engine_data/gost_engine.sh b/test/recipes/95-test_external_gost_engine_data/gost_engine.sh deleted file mode 100755 index 0831722741..0000000000 --- a/test/recipes/95-test_external_gost_engine_data/gost_engine.sh +++ /dev/null @@ -1,54 +0,0 @@ -#!/bin/sh -# -# Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved. -# -# Licensed under the Apache License 2.0 (the "License"). You may not use -# this file except in compliance with the License. You can obtain a copy -# in the file LICENSE in the source distribution or at -# https://www.openssl.org/source/license.html - -# -# OpenSSL external testing using the GOST engine -# -set -e - -PWD="$(pwd)" - -SRCTOP="$(cd $SRCTOP; pwd)" -BLDTOP="$(cd $BLDTOP; pwd)" - -if [ "$SRCTOP" != "$BLDTOP" ] ; then - echo "Out of tree builds not supported with gost_engine test!" - exit 1 -fi - -O_EXE="$BLDTOP/apps" -O_BINC="$BLDTOP/include" -O_SINC="$SRCTOP/include" -O_LIB="$BLDTOP" - -unset OPENSSL_CONF - -export PATH="$O_EXE:$PATH" -export LD_LIBRARY_PATH="$O_LIB:$LD_LIBRARY_PATH" -export OPENSSL_ROOT_DIR="$O_LIB" - -# Check/Set openssl version -OPENSSL_VERSION=`openssl version | cut -f 2 -d ' '` - -echo "------------------------------------------------------------------" -echo "Testing OpenSSL using GOST engine:" -echo " CWD: $PWD" -echo " SRCTOP: $SRCTOP" -echo " BLDTOP: $BLDTOP" -echo " OPENSSL_ROOT_DIR: $OPENSSL_ROOT_DIR" -echo " OpenSSL version: $OPENSSL_VERSION" -echo "------------------------------------------------------------------" - -cmake $SRCTOP/gost-engine -DOPENSSL_ROOT_DIR="$OPENSSL_ROOT_DIR" -DOPENSSL_ENGINES_DIR="$OPENSSL_ROOT_DIR/engines" -make -export CTEST_OUTPUT_ON_FAILURE=1 -export OPENSSL_ENGINES="$PWD/bin" -export OPENSSL_APP="$O_EXE/openssl" -make test -make tcl_tests diff --git a/test/run_tests.pl b/test/run_tests.pl index 7b1c8deecb..38d38bdb5c 100644 --- a/test/run_tests.pl +++ b/test/run_tests.pl @@ -70,7 +70,6 @@ if (!defined($jobs)) { $ENV{OPENSSL_CONF} = rel2abs(catfile($srctop, "apps", "openssl.cnf")); $ENV{OPENSSL_CONF_INCLUDE} = rel2abs(catdir($bldtop, "test")); $ENV{OPENSSL_MODULES} = rel2abs(catdir($bldtop, "providers")); -$ENV{OPENSSL_ENGINES} = rel2abs(catdir($bldtop, "engines")); $ENV{CTLOG_FILE} = rel2abs(catfile($srctop, "test", "ct", "log_list.cnf")); # On platforms that support this, this will ensure malloc returns data that is diff --git a/test/ssl_handshake_rtt_test.c b/test/ssl_handshake_rtt_test.c index 1d24ba995e..c7d0a011a6 100644 --- a/test/ssl_handshake_rtt_test.c +++ b/test/ssl_handshake_rtt_test.c @@ -22,7 +22,6 @@ #include #include #include -#include #include "helpers/ssltestlib.h" #include "testutil.h" diff --git a/test/sslapitest.c b/test/sslapitest.c index 370b9b8a37..df5ccf1198 100644 --- a/test/sslapitest.c +++ b/test/sslapitest.c @@ -33,7 +33,6 @@ #include #include #include -#include #include "helpers/ssltestlib.h" #include "testutil.h" @@ -11898,205 +11897,6 @@ end: } #endif /* OSSL_NO_USABLE_TLS1_3 */ -#if !defined(OPENSSL_NO_TLS1_2) && !defined(OPENSSL_NO_DYNAMIC_ENGINE) -/* - * Test TLSv1.2 with a pipeline capable cipher. TLSv1.3 and DTLS do not - * support this yet. The only pipeline capable cipher that we have is in the - * dasync engine (providers don't support this yet), so we have to use - * deprecated APIs for this test. - * - * Test 0: Client has pipelining enabled, server does not - * Test 1: Server has pipelining enabled, client does not - * Test 2: Client has pipelining enabled, server does not: not enough data to - * fill all the pipelines - * Test 3: Client has pipelining enabled, server does not: not enough data to - * fill all the pipelines by more than a full pipeline's worth - * Test 4: Client has pipelining enabled, server does not: more data than all - * the available pipelines can take - * Test 5: Client has pipelining enabled, server does not: Maximum size pipeline - * Test 6: Repeat of test 0, but the engine is loaded late (after the SSL_CTX - * is created) - */ -static int test_pipelining(int idx) -{ - SSL_CTX *cctx = NULL, *sctx = NULL; - SSL *clientssl = NULL, *serverssl = NULL, *peera, *peerb; - int testresult = 0, numreads, numpipes = 5; - /* A 55 byte message */ - unsigned char *msg = (unsigned char *) - "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz123"; - size_t written, readbytes, offset, msglen, fragsize = 10; - int expectedreads; - unsigned char *buf = NULL; - ENGINE *e = NULL; - - if (idx != 6) { - e = load_dasync(); - if (e == NULL) - return 0; - } - - if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(), - TLS_client_method(), 0, - TLS1_2_VERSION, &sctx, &cctx, cert, - privkey))) - goto end; - - if (idx == 6) { - e = load_dasync(); - if (e == NULL) - goto end; - /* Now act like test 0 */ - idx = 0; - } - - if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, - &clientssl, NULL, NULL))) - goto end; - - if (!TEST_true(SSL_set_cipher_list(clientssl, "AES128-SHA"))) - goto end; - - /* peera is always configured for pipelining, while peerb is not. */ - if (idx == 1) { - peera = serverssl; - peerb = clientssl; - - } else { - peera = clientssl; - peerb = serverssl; - } - - if (idx == 5) { - numpipes = 2; - /* Maximum allowed fragment size */ - fragsize = SSL3_RT_MAX_PLAIN_LENGTH; - msglen = fragsize * numpipes; - msg = OPENSSL_malloc(msglen); - if (!TEST_ptr(msg)) - goto end; - if (!TEST_int_gt(RAND_bytes_ex(libctx, msg, msglen, 0), 0)) - goto end; - } else if (idx == 4) { - msglen = 55; - } else { - msglen = 50; - } - if (idx == 2) - msglen -= 2; /* Send 2 less bytes */ - else if (idx == 3) - msglen -= 12; /* Send 12 less bytes */ - - buf = OPENSSL_malloc(msglen); - if (!TEST_ptr(buf)) - goto end; - - if (idx == 5) { - /* - * Test that setting a split send fragment longer than the maximum - * allowed fails - */ - if (!TEST_false(SSL_set_split_send_fragment(peera, (long)(fragsize + 1)))) - goto end; - } - - /* - * In the normal case. We have 5 pipelines with 10 bytes per pipeline - * (50 bytes in total). This is a ridiculously small number of bytes - - * but sufficient for our purposes - */ - if (!TEST_true(SSL_set_max_pipelines(peera, numpipes)) - || !TEST_true(SSL_set_split_send_fragment(peera, (long)fragsize))) - goto end; - - if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))) - goto end; - - /* Write some data from peera to peerb */ - if (!TEST_true(SSL_write_ex(peera, msg, msglen, &written)) - || !TEST_size_t_eq(written, msglen)) - goto end; - - /* - * If the pipelining code worked, then we expect all |numpipes| pipelines to - * have been used - except in test 3 where only |numpipes - 1| pipelines - * will be used. This will result in |numpipes| records (|numpipes - 1| for - * test 3) having been sent to peerb. Since peerb is not using read_ahead we - * expect this to be read in |numpipes| or |numpipes - 1| separate - * SSL_read_ex calls. In the case of test 4, there is then one additional - * read for left over data that couldn't fit in the previous pipelines - */ - for (offset = 0, numreads = 0; - offset < msglen; - offset += readbytes, numreads++) { - if (!TEST_true(SSL_read_ex(peerb, buf + offset, - msglen - offset, &readbytes))) - goto end; - } - - expectedreads = idx == 4 ? numpipes + 1 - : (idx == 3 ? numpipes - 1 : numpipes); - if (!TEST_mem_eq(msg, msglen, buf, offset) - || !TEST_int_eq(numreads, expectedreads)) - goto end; - - /* - * Write some data from peerb to peera. We do this in up to |numpipes + 1| - * chunks to exercise the read pipelining code on peera. - */ - for (offset = 0; offset < msglen; offset += fragsize) { - size_t sendlen = msglen - offset; - - if (sendlen > fragsize) - sendlen = fragsize; - if (!TEST_true(SSL_write_ex(peerb, msg + offset, sendlen, &written)) - || !TEST_size_t_eq(written, sendlen)) - goto end; - } - - /* - * The data was written in |numpipes|, |numpipes - 1| or |numpipes + 1| - * separate chunks (depending on which test we are running). If the - * pipelining is working then we expect peera to read up to numpipes chunks - * and process them in parallel, giving back the complete result in a single - * call to SSL_read_ex - */ - if (!TEST_true(SSL_read_ex(peera, buf, msglen, &readbytes)) - || !TEST_size_t_le(readbytes, msglen)) - goto end; - - if (idx == 4) { - size_t readbytes2; - - if (!TEST_true(SSL_read_ex(peera, buf + readbytes, - msglen - readbytes, &readbytes2))) - goto end; - readbytes += readbytes2; - if (!TEST_size_t_le(readbytes, msglen)) - goto end; - } - - if (!TEST_mem_eq(msg, msglen, buf, readbytes)) - goto end; - - testresult = 1; -end: - SSL_free(serverssl); - SSL_free(clientssl); - SSL_CTX_free(sctx); - SSL_CTX_free(cctx); - if (e != NULL) { - ENGINE_unregister_ciphers(e); - ENGINE_finish(e); - ENGINE_free(e); - } - OPENSSL_free(buf); - if (fragsize == SSL3_RT_MAX_PLAIN_LENGTH) - OPENSSL_free(msg); - return testresult; -} -#endif /* !defined(OPENSSL_NO_TLS1_2) && !defined(OPENSSL_NO_DYNAMIC_ENGINE) */ - static int check_version_string(SSL *s, int version) { const char *verstr = NULL; @@ -14190,9 +13990,6 @@ int setup_tests(void) #endif #if !defined(OPENSSL_NO_TLS1_2) && !defined(OSSL_NO_USABLE_TLS1_3) ADD_ALL_TESTS(test_serverinfo_custom, 4); -#endif -#if !defined(OPENSSL_NO_TLS1_2) && !defined(OPENSSL_NO_DYNAMIC_ENGINE) - ADD_ALL_TESTS(test_pipelining, 7); #endif ADD_ALL_TESTS(test_version, 6); ADD_TEST(test_rstate_string); diff --git a/test/sslbuffertest.c b/test/sslbuffertest.c index 1ec179b59c..caa048b278 100644 --- a/test/sslbuffertest.c +++ b/test/sslbuffertest.c @@ -8,19 +8,10 @@ * or in the file LICENSE in the source distribution. */ -/* - * We need access to the deprecated low level Engine APIs for legacy purposes - * when the deprecated calls are not hidden - */ -#ifndef OPENSSL_NO_DEPRECATED_3_0 -# define OPENSSL_SUPPRESS_DEPRECATED -#endif - #include #include #include #include -#include #ifndef OPENSSL_NO_QUIC /* This test does not link libssl so avoid pulling in QUIC unwrappers. */ @@ -199,8 +190,6 @@ static int test_func(int test) * Test 2: Attempt to free buffers after a full record header but no record body * Test 3: Attempt to free buffers after a full record hedaer and partial record * body - * Test 4-7: We repeat tests 0-3 but including data from a second pipelined - * record */ static int test_free_buffers(int test) { @@ -209,55 +198,22 @@ static int test_free_buffers(int test) const char testdata[] = "Test data"; char buf[120]; size_t written, readbytes; - int i, pipeline = test > 3; - ENGINE *e = NULL; - - if (pipeline) { - e = load_dasync(); - if (e == NULL) - goto end; - test -= 4; - } if (!TEST_true(create_ssl_objects(serverctx, clientctx, &serverssl, &clientssl, NULL, NULL))) goto end; - if (pipeline) { - if (!TEST_true(SSL_set_cipher_list(serverssl, "AES128-SHA")) - || !TEST_true(SSL_set_max_proto_version(serverssl, - TLS1_2_VERSION)) - || !TEST_true(SSL_set_max_pipelines(serverssl, 2))) - goto end; - } - if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))) goto end; - /* - * For the non-pipeline case we write one record. For pipelining we write - * two records. - */ - for (i = 0; i <= pipeline; i++) { - if (!TEST_true(SSL_write_ex(clientssl, testdata, strlen(testdata), - &written))) - goto end; - } + if (!TEST_true(SSL_write_ex(clientssl, testdata, strlen(testdata), + &written))) + goto end; if (test == 0) { - size_t readlen = 1; - - /* - * Deliberately only read the first byte - so the remaining bytes are - * still buffered. In the pipelining case we read as far as the first - * byte from the second record. - */ - if (pipeline) - readlen += strlen(testdata); - - if (!TEST_true(SSL_read_ex(serverssl, buf, readlen, &readbytes)) - || !TEST_size_t_eq(readlen, readbytes)) + if (!TEST_true(SSL_read_ex(serverssl, buf, 1, &readbytes)) + || !TEST_size_t_eq(1, readbytes)) goto end; } else { BIO *tmp; @@ -285,21 +241,6 @@ static int test_free_buffers(int test) goto end; } - if (pipeline) { - /* We happen to know the first record is 57 bytes long */ - const size_t first_rec_len = 57; - - if (test != 3) - partial_len += first_rec_len; - - /* - * Sanity check. If we got the record len right then this should - * never fail. - */ - if (!TEST_int_eq(buf[first_rec_len], SSL3_RT_APPLICATION_DATA)) - goto end; - } - /* * Put back just the partial record (plus the whole initial record in * the pipelining case) @@ -307,25 +248,13 @@ static int test_free_buffers(int test) if (!TEST_true(BIO_write_ex(tmp, buf, partial_len, &written))) goto end; - if (pipeline) { - /* - * Attempt a read. This should pass but only return data from the - * first record. Only a partial record is available for the second - * record. - */ - if (!TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), - &readbytes)) - || !TEST_size_t_eq(readbytes, strlen(testdata))) - goto end; - } else { - /* - * Attempt a read. This should fail because only a partial record is - * available. - */ - if (!TEST_false(SSL_read_ex(serverssl, buf, sizeof(buf), - &readbytes))) - goto end; - } + /* + * Attempt a read. This should fail because only a partial record is + * available. + */ + if (!TEST_false(SSL_read_ex(serverssl, buf, sizeof(buf), + &readbytes))) + goto end; } /* @@ -339,13 +268,6 @@ static int test_free_buffers(int test) end: SSL_free(clientssl); SSL_free(serverssl); -#ifndef OPENSSL_NO_DYNAMIC_ENGINE - if (e != NULL) { - ENGINE_unregister_ciphers(e); - ENGINE_finish(e); - ENGINE_free(e); - } -#endif return result; } @@ -372,11 +294,7 @@ int setup_tests(void) } ADD_ALL_TESTS(test_func, 9); -#if !defined(OPENSSL_NO_TLS1_2) && !defined(OPENSSL_NO_DYNAMIC_ENGINE) - ADD_ALL_TESTS(test_free_buffers, 8); -#else ADD_ALL_TESTS(test_free_buffers, 4); -#endif return 1; } diff --git a/test/sysdefaulttest.c b/test/sysdefaulttest.c index cc756fd139..90166bdf98 100644 --- a/test/sysdefaulttest.c +++ b/test/sysdefaulttest.c @@ -44,8 +44,7 @@ static int test_func(void) int global_init(void) { - if (!OPENSSL_init_ssl(OPENSSL_INIT_ENGINE_ALL_BUILTIN - | OPENSSL_INIT_LOAD_CONFIG, NULL)) + if (!OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, NULL)) return 0; return 1; } diff --git a/test/testutil/apps_shims.c b/test/testutil/apps_shims.c index e4466ea4dc..f102188f88 100644 --- a/test/testutil/apps_shims.c +++ b/test/testutil/apps_shims.c @@ -44,13 +44,6 @@ void *app_malloc_array(size_t n, size_t sz, const char *what) return vp; } -/* shim to prevent sucking in too much from apps */ - -int opt_legacy_okay(void) -{ - return 1; -} - /* * These three functions are defined here so that they don't need to come from * the apps source code and pull in a lot of additional things. diff --git a/test/trace_api_test.c b/test/trace_api_test.c index 1f2c9dc611..bc68f367e6 100644 --- a/test/trace_api_test.c +++ b/test/trace_api_test.c @@ -34,10 +34,6 @@ static int test_trace_categories(void) SET_EXPECTED_CAT_NAME(TLS_CIPHER); case OSSL_TRACE_CATEGORY_CONF: SET_EXPECTED_CAT_NAME(CONF); - case OSSL_TRACE_CATEGORY_ENGINE_TABLE: - SET_EXPECTED_CAT_NAME(ENGINE_TABLE); - case OSSL_TRACE_CATEGORY_ENGINE_REF_COUNT: - SET_EXPECTED_CAT_NAME(ENGINE_REF_COUNT); case OSSL_TRACE_CATEGORY_PKCS5V2: SET_EXPECTED_CAT_NAME(PKCS5V2); case OSSL_TRACE_CATEGORY_PKCS12_KEYGEN: diff --git a/util/engines.num b/util/engines.num deleted file mode 100644 index 4fc4e001df..0000000000 --- a/util/engines.num +++ /dev/null @@ -1,2 +0,0 @@ -bind_engine 1 * EXIST::FUNCTION: -v_check 2 * EXIST::FUNCTION: diff --git a/util/err-to-raise b/util/err-to-raise index 174686d3ab..4eb9159536 100755 --- a/util/err-to-raise +++ b/util/err-to-raise @@ -13,9 +13,6 @@ # Consider running util/merge-err-lines first, to catch most (all?) of the # cases where the XXXerr() call is split into two lines. -# Do not use this in engines/, they have their own error reporting functions, -# which do call ERR_raise(). - use strict; use warnings; diff --git a/util/find-doc-nits b/util/find-doc-nits index cd9e502d53..f7092bf129 100755 --- a/util/find-doc-nits +++ b/util/find-doc-nits @@ -113,6 +113,7 @@ my $ignored = qr/(?| ^i2d_ | ^DEFINE_LHASH_OF_(INTERNAL|DEPRECATED) | ^OSSL_HTO[BL]E(16|32|64) # undefed | ^OSSL_[BL]E(16|32|64)TOH # undefed + | ^ENGINE_ # TODO(ENGINE REMOVAL): Fix docs )/x; # There are macro functions added before version 1.1.1 we don't want to track diff --git a/util/fix-includes.sed b/util/fix-includes.sed index 5b9a834b86..16c723bf73 100644 --- a/util/fix-includes.sed +++ b/util/fix-includes.sed @@ -1,5 +1,5 @@ s|internal/([a-z0-9_]+)_int\.h|crypto/\1.h|g ; -s@internal/(aria.h|asn1_dsa.h|async.h|bn_dh.h|bn_srp.h|chacha.h|(aes|des|cmll)_platform.h|ctype.h|__DECC_INCLUDE_EPILOGUE.H|__DECC_INCLUDE_PROLOGUE.H|dso_conf.h|dso_conf.h|engine.h|lhash.h|md32_common.h|objects.h|poly1305.h|sha.h|siphash.h|sm2err.h|sm2.h|sm4.h|sparse_array.h|store.h|foobar)@crypto/\1@g ; +s@internal/(aria.h|asn1_dsa.h|async.h|bn_dh.h|bn_srp.h|chacha.h|(aes|des|cmll)_platform.h|ctype.h|__DECC_INCLUDE_EPILOGUE.H|__DECC_INCLUDE_PROLOGUE.H|dso_conf.h|dso_conf.h|lhash.h|md32_common.h|objects.h|poly1305.h|sha.h|siphash.h|sm2err.h|sm2.h|sm4.h|sparse_array.h|store.h|foobar)@crypto/\1@g ; s/constant_time_locl/constant_time/g ; s/_lo?cl\.h/_local.h/g ; s/_int\.h/_local.h/g ; diff --git a/util/indent.pro b/util/indent.pro index 1937cfa476..6fabf305da 100644 --- a/util/indent.pro +++ b/util/indent.pro @@ -207,22 +207,6 @@ -T EC_PRIVATEKEY -T EC_builtin_curve -T EDIPARTYNAME --T ENGINE --T ENGINE_CIPHERS_PTR --T ENGINE_CLEANUP_CB --T ENGINE_CLEANUP_ITEM --T ENGINE_CMD_DEFN --T ENGINE_CTRL_FUNC_PTR --T ENGINE_DIGESTS_PTR --T ENGINE_GEN_FUNC_PTR --T ENGINE_GEN_INT_FUNC_PTR --T ENGINE_LOAD_KEY_PTR --T ENGINE_PILE --T ENGINE_PILE_DOALL --T ENGINE_PKEY_ASN1_METHS_PTR --T ENGINE_PKEY_METHS_PTR --T ENGINE_SSL_CLIENT_CERT_PTR --T ENGINE_TABLE -T ENUMERATED_NAMES -T ERR_STATE -T ERR_STRING_DATA @@ -528,8 +512,6 @@ -T STACK_OF_CONF_VALUE_ -T STACK_OF_CRYPTO_dynlock_ -T STACK_OF_DIST_POINT_ --T STACK_OF_ENGINE_ --T STACK_OF_ENGINE_CLEANUP_ITEM_ -T STACK_OF_ESS_CERT_ID_ -T STACK_OF_ESS_CERT_ID_V2_ -T STACK_OF_EVP_PBE_CTL_ @@ -590,7 +572,6 @@ -T STACK_OF_void_ -T LHASH_OF_ADDED_OBJ_ -T LHASH_OF_CONF_VALUE_ --T LHASH_OF_ENGINE_PILE_ -T LHASH_OF_ERR_STATE_ -T LHASH_OF_ERR_STRING_DATA_ -T LHASH_OF_FUNCTION_ diff --git a/util/libcrypto.num b/util/libcrypto.num index bbdf9af66e..cbda7e80d8 100644 --- a/util/libcrypto.num +++ b/util/libcrypto.num @@ -316,7 +316,6 @@ ERR_load_CT_strings ? 4_0_0 EXIST::FUNCTION:CT,DEPRECATEDIN_ ERR_load_DH_strings ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,DH ERR_load_DSA_strings ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,DSA ERR_load_EC_strings ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,EC -ERR_load_ENGINE_strings ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE ERR_load_ERR_strings ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 ERR_load_EVP_strings ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 ERR_load_KDF_strings ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 @@ -475,7 +474,6 @@ DH_get0_pub_key ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 DH_clear_flags ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,DH DH_test_flags ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,DH DH_set_flags ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,DH -DH_get0_engine ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,DH DH_get_length ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,DH DH_set_length ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,DH DH_meth_new ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,DH @@ -559,7 +557,6 @@ DSA_get0_priv_key ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 DSA_clear_flags ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,DSA DSA_test_flags ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,DSA DSA_set_flags ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,DSA -DSA_get0_engine ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,DSA DSA_meth_new ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,DSA DSA_meth_free ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,DSA DSA_meth_dup ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,DSA @@ -719,7 +716,6 @@ EC_KEY_free ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 EC_KEY_copy ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,EC EC_KEY_dup ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,EC EC_KEY_up_ref ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,EC -EC_KEY_get0_engine ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,EC EC_KEY_get0_group ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,EC EC_KEY_set_group ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,EC EC_KEY_get0_private_key ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,EC @@ -827,128 +823,6 @@ OSSL_ENCODER_to_bio ? 4_0_0 EXIST::FUNCTION: OSSL_ENCODER_to_fp ? 4_0_0 EXIST::FUNCTION:STDIO OSSL_ENCODER_to_data ? 4_0_0 EXIST::FUNCTION: OSSL_ENCODER_CTX_new_for_pkey ? 4_0_0 EXIST::FUNCTION: -ENGINE_get_first ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_last ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_next ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_prev ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_add ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_remove ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_by_id ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_load_builtin_engines ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_table_flags ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_table_flags ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_register_RSA ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_unregister_RSA ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_register_all_RSA ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_register_DSA ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_unregister_DSA ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_register_all_DSA ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_register_EC ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_unregister_EC ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_register_all_EC ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_register_DH ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_unregister_DH ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_register_all_DH ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_register_RAND ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_unregister_RAND ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_register_all_RAND ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_register_ciphers ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_unregister_ciphers ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_register_all_ciphers ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_register_digests ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_unregister_digests ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_register_all_digests ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_register_pkey_meths ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_unregister_pkey_meths ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_register_all_pkey_meths ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_register_pkey_asn1_meths ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_unregister_pkey_asn1_meths ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_register_all_pkey_asn1_meths ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_register_complete ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_register_all_complete ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_ctrl ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_cmd_is_executable ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_ctrl_cmd ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_ctrl_cmd_string ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_new ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_free ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_up_ref ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_id ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_name ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_RSA ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_DSA ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_EC ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_DH ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_RAND ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_destroy_function ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_init_function ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_finish_function ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_ctrl_function ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_load_privkey_function ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_load_pubkey_function ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_load_ssl_client_cert_function ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_ciphers ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_digests ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_pkey_meths ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_pkey_asn1_meths ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_flags ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_cmd_defns ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_ex_data ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_ex_data ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_id ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_name ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_RSA ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_DSA ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_EC ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_DH ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_RAND ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_destroy_function ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_init_function ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_finish_function ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_ctrl_function ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_load_privkey_function ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_load_pubkey_function ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_ssl_client_cert_function ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_ciphers ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_digests ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_pkey_meths ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_pkey_asn1_meths ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_cipher ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_digest ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_pkey_meth ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_pkey_asn1_meth ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_pkey_asn1_meth_str ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_pkey_asn1_find_str ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_cmd_defns ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_flags ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_init ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_finish ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_load_private_key ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_load_public_key ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_load_ssl_client_cert ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_default_RSA ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_default_DSA ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_default_EC ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_default_DH ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_default_RAND ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_cipher_engine ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_digest_engine ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_pkey_meth_engine ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_pkey_asn1_meth_engine ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_default_RSA ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_default_string ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_default_DSA ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_default_EC ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_default_DH ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_default_RAND ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_default_ciphers ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_default_digests ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_default_pkey_meths ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_default_pkey_asn1_meths ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_set_default ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_add_conf_module ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -ENGINE_get_static_state ? 4_0_0 EXIST::FUNCTION:ENGINE -ENGINE_setup_bsd_cryptodev ? 4_0_0 EXIST:__FreeBSD__:FUNCTION:DEPRECATEDIN_1_1_0,ENGINE EVP_set_default_properties ? 4_0_0 EXIST::FUNCTION: EVP_get1_default_properties ? 4_0_0 EXIST::FUNCTION: EVP_default_properties_is_fips_enabled ? 4_0_0 EXIST::FUNCTION: @@ -1425,8 +1299,6 @@ EVP_PKEY_can_sign ? 4_0_0 EXIST::FUNCTION: EVP_PKEY_set_type ? 4_0_0 EXIST::FUNCTION: EVP_PKEY_set_type_str ? 4_0_0 EXIST::FUNCTION: EVP_PKEY_set_type_by_keymgmt ? 4_0_0 EXIST::FUNCTION: -EVP_PKEY_set1_engine ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE -EVP_PKEY_get0_engine ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE EVP_PKEY_assign ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 EVP_PKEY_get0 ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 EVP_PKEY_get0_hmac ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 @@ -2242,7 +2114,6 @@ OSSL_PROVIDER_add_builtin ? 4_0_0 EXIST::FUNCTION: OSSL_PROVIDER_get0_name ? 4_0_0 EXIST::FUNCTION: RAND_set_rand_method ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 RAND_get_rand_method ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 -RAND_set_rand_engine ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0,ENGINE RAND_OpenSSL ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 RAND_bytes ? 4_0_0 EXIST::FUNCTION: RAND_priv_bytes ? 4_0_0 EXIST::FUNCTION: @@ -2343,7 +2214,6 @@ RSA_clear_flags ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 RSA_test_flags ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 RSA_set_flags ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 RSA_get_version ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 -RSA_get0_engine ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 RSA_generate_key ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_0_9_8 RSA_generate_key_ex ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 RSA_generate_multi_prime_key ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 @@ -2580,7 +2450,6 @@ OSSL_STORE_LOADER_set_load ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 OSSL_STORE_LOADER_set_eof ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 OSSL_STORE_LOADER_set_error ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 OSSL_STORE_LOADER_set_close ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 -OSSL_STORE_LOADER_get0_engine ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 OSSL_STORE_LOADER_get0_scheme ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 OSSL_STORE_register_loader ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 OSSL_STORE_unregister_loader ? 4_0_0 EXIST::FUNCTION:DEPRECATEDIN_3_0 @@ -2767,8 +2636,6 @@ TS_CONF_load_certs ? 4_0_0 EXIST::FUNCTION:TS TS_CONF_load_key ? 4_0_0 EXIST::FUNCTION:TS TS_CONF_get_tsa_section ? 4_0_0 EXIST::FUNCTION:TS TS_CONF_set_serial ? 4_0_0 EXIST::FUNCTION:TS -TS_CONF_set_crypto_device ? 4_0_0 EXIST::FUNCTION:ENGINE,TS -TS_CONF_set_default_engine ? 4_0_0 EXIST::FUNCTION:ENGINE,TS TS_CONF_set_signer_cert ? 4_0_0 EXIST::FUNCTION:TS TS_CONF_set_certs ? 4_0_0 EXIST::FUNCTION:TS TS_CONF_set_signer_key ? 4_0_0 EXIST::FUNCTION:TS diff --git a/util/libssl.num b/util/libssl.num index 54e03438a1..5962e18431 100644 --- a/util/libssl.num +++ b/util/libssl.num @@ -44,7 +44,6 @@ SSL_CTX_set_info_callback ? 4_0_0 EXIST::FUNCTION: SSL_CTX_get_info_callback ? 4_0_0 EXIST::FUNCTION: SSL_CTX_set_client_cert_cb ? 4_0_0 EXIST::FUNCTION: SSL_CTX_get_client_cert_cb ? 4_0_0 EXIST::FUNCTION: -SSL_CTX_set_client_cert_engine ? 4_0_0 EXIST::FUNCTION:ENGINE SSL_CTX_set_cookie_generate_cb ? 4_0_0 EXIST::FUNCTION: SSL_CTX_set_cookie_verify_cb ? 4_0_0 EXIST::FUNCTION: SSL_CTX_set_stateless_cookie_generate_cb ? 4_0_0 EXIST::FUNCTION: diff --git a/util/mkinstallvars.pl b/util/mkinstallvars.pl index f8fa12db48..10fd868b18 100644 --- a/util/mkinstallvars.pl +++ b/util/mkinstallvars.pl @@ -26,7 +26,7 @@ my @absolutes = qw(PREFIX libdir); # since the LIBDIR subdirectories depend on the calculation of LIBDIR from # PREFIX. my @subdirs = _pairs (PREFIX => [ qw(BINDIR LIBDIR INCLUDEDIR APPLINKDIR) ], - LIBDIR => [ qw(ENGINESDIR MODULESDIR PKGCONFIGDIR + LIBDIR => [ qw(MODULESDIR PKGCONFIGDIR CMAKECONFIGDIR) ]); # For completeness, other expected variables my @others = qw(VERSION LDLIBS); diff --git a/util/opensslwrap.sh b/util/opensslwrap.sh index 7a38830270..3a58bfd71b 100755 --- a/util/opensslwrap.sh +++ b/util/opensslwrap.sh @@ -3,9 +3,6 @@ HERE="`echo $0 | sed -e 's|[^/]*$||'`" OPENSSL="${HERE}../apps/openssl" -if [ -d "${HERE}../engines" -a "x$OPENSSL_ENGINES" = "x" ]; then - OPENSSL_ENGINES="${HERE}../engines"; export OPENSSL_ENGINES -fi if [ -d "${HERE}../providers" -a "x$OPENSSL_MODULES" = "x" ]; then OPENSSL_MODULES="${HERE}../providers"; export OPENSSL_MODULES fi diff --git a/util/perl/OpenSSL/paramnames.pm b/util/perl/OpenSSL/paramnames.pm index eed78467df..b73863b985 100644 --- a/util/perl/OpenSSL/paramnames.pm +++ b/util/perl/OpenSSL/paramnames.pm @@ -84,14 +84,13 @@ my %params = ( 'OSSL_OBJECT_PARAM_INPUT_TYPE' => "input-type", # UTF8_STRING # Algorithm parameters -# If "engine",or "properties",are specified, they should always be paired +# If "properties" is specified, they should always be paired # with the algorithm type. # Note these are common names that are shared by many types (such as kdf, mac, # and pkey) e.g: see MAC_PARAM_DIGEST below. 'OSSL_ALG_PARAM_DIGEST' => "digest", # utf8_string 'OSSL_ALG_PARAM_CIPHER' => "cipher", # utf8_string - 'OSSL_ALG_PARAM_ENGINE' => "engine", # utf8_string 'OSSL_ALG_PARAM_MAC' => "mac", # utf8_string 'OSSL_ALG_PARAM_PROPERTIES' => "properties", # utf8_string 'OSSL_ALG_PARAM_FIPS_APPROVED_INDICATOR' => 'fips-indicator', # int, -1, 0 or 1 @@ -185,7 +184,7 @@ my %params = ( 'OSSL_MAC_PARAM_C_ROUNDS' => "c-rounds", # unsigned int 'OSSL_MAC_PARAM_D_ROUNDS' => "d-rounds", # unsigned int -# If "engine",or "properties",are specified, they should always be paired +# If "properties" is specified, they should always be paired # with "cipher",or "digest". 'OSSL_MAC_PARAM_CIPHER' => '*OSSL_ALG_PARAM_CIPHER', # utf8 string @@ -295,7 +294,6 @@ my %params = ( 'OSSL_PKEY_PARAM_SECURITY_CATEGORY' => '*OSSL_ALG_PARAM_SECURITY_CATEGORY', 'OSSL_PKEY_PARAM_DIGEST' => '*OSSL_ALG_PARAM_DIGEST', 'OSSL_PKEY_PARAM_CIPHER' => '*OSSL_ALG_PARAM_CIPHER', # utf8 string - 'OSSL_PKEY_PARAM_ENGINE' => '*OSSL_ALG_PARAM_ENGINE', # utf8 string 'OSSL_PKEY_PARAM_PROPERTIES' => '*OSSL_ALG_PARAM_PROPERTIES', 'OSSL_PKEY_PARAM_DEFAULT_DIGEST' => "default-digest",# utf8 string 'OSSL_PKEY_PARAM_MANDATORY_DIGEST' => "mandatory-digest",# utf8 string @@ -503,7 +501,6 @@ my %params = ( # Asym cipher parameters 'OSSL_ASYM_CIPHER_PARAM_DIGEST' => '*OSSL_PKEY_PARAM_DIGEST', 'OSSL_ASYM_CIPHER_PARAM_PROPERTIES' => '*OSSL_PKEY_PARAM_PROPERTIES', - 'OSSL_ASYM_CIPHER_PARAM_ENGINE' => '*OSSL_PKEY_PARAM_ENGINE', 'OSSL_ASYM_CIPHER_PARAM_PAD_MODE' => '*OSSL_PKEY_PARAM_PAD_MODE', 'OSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST' => '*OSSL_PKEY_PARAM_MGF1_DIGEST', 'OSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST_PROPS' => '*OSSL_PKEY_PARAM_MGF1_PROPERTIES', diff --git a/util/perl/TLSProxy/Proxy.pm b/util/perl/TLSProxy/Proxy.pm index 91793481e0..aa6c9ff9a8 100644 --- a/util/perl/TLSProxy/Proxy.pm +++ b/util/perl/TLSProxy/Proxy.pm @@ -330,7 +330,7 @@ sub start my $execcmd = $self->execute ." s_server -no_comp -provider=p_ossltest -provider=default -propquery ?provider=p_ossltest -state" #In TLSv1.3 we issue two session tickets. The default session id - #callback gets confused because the ossltest engine causes the same + #callback gets confused because the ossltest provider causes the same #session id to be created twice due to the changed random number #generation. Using "-ext_cache" replaces the default callback with a #different one that doesn't get confused. diff --git a/util/wrap.pl.in b/util/wrap.pl.in index 2c9cb29fec..221da07b94 100644 --- a/util/wrap.pl.in +++ b/util/wrap.pl.in @@ -51,7 +51,6 @@ sub quote_arg_win32 { } my $there = canonpath(catdir(dirname($0), updir())); -my $std_engines = catdir($there, 'engines'); my $std_providers = catdir($there, 'providers'); my $std_openssl_conf = catdir($there, 'apps/openssl.cnf'); my $unix_shlib_wrap = catfile($there, 'util/shlib_wrap.sh'); @@ -84,8 +83,6 @@ local $ENV{OPENSSL_CONF_INCLUDE} = $std_openssl_conf_include if defined $std_openssl_conf_include &&($ENV{OPENSSL_CONF_INCLUDE} // '') eq '' && -d $std_openssl_conf_include; -local $ENV{OPENSSL_ENGINES} = $std_engines - if ($ENV{OPENSSL_ENGINES} // '') eq '' && -d $std_engines; local $ENV{OPENSSL_MODULES} = $std_providers if ($ENV{OPENSSL_MODULES} // '') eq '' && -d $std_providers; local $ENV{OPENSSL_CONF} = $std_openssl_conf