Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

More minor symbols for Ruby support #1581

Merged
merged 8 commits into from
Jun 14, 2024
Merged

More minor symbols for Ruby support #1581

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
6904bec
add support for PKCS12_new
samuel40791765 May 6, 2024
457c55c
Add additional SSL_OP_* no-ops
samuel40791765 May 7, 2024
53b3dbc
add CONF_get1_default_config_file as a noop
samuel40791765 May 8, 2024
09f7a0b
return null on allocation failure
samuel40791765 May 9, 2024
4d6b09c
Use malloc and add small test
samuel40791765 May 9, 2024
01bd884
remove extra error message
samuel40791765 May 10, 2024
97beb2f
add null termination count
samuel40791765 May 24, 2024
de56c61
use OPENSSL_strdup instead
samuel40791765 May 31, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions crypto/conf/conf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -642,6 +642,10 @@ int CONF_modules_load_file(const char *filename, const char *appname,
return 1;
}

char *CONF_get1_default_config_file(void) {
return OPENSSL_strdup("No support for Config files in AWS-LC.");
}

void CONF_modules_free(void) {}

void CONF_modules_unload(int all) {}
Expand Down
5 changes: 5 additions & 0 deletions crypto/conf/conf_test.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -401,3 +401,8 @@ TEST(ConfTest, ParseList) {
EXPECT_EQ(result, t.expected);
}
}

TEST(ConfTest, NoopString) {
bssl::UniquePtr<char> string(CONF_get1_default_config_file());
EXPECT_STREQ("No support for Config files in AWS-LC.", string.get());
}
6 changes: 6 additions & 0 deletions crypto/pkcs8/pkcs12_test.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -674,3 +674,9 @@ TEST(PKCS12Test, CreateWithAlias) {
ASSERT_EQ(alias, std::string(reinterpret_cast<const char *>(parsed_alias),
static_cast<size_t>(alias_len)));
}

TEST(PKCS12Test, BasicAlloc) {
// Test direct allocation of |PKCS12_new| and |PKCS12_free|.
bssl::UniquePtr<PKCS12> p12(PKCS12_new());
ASSERT_TRUE(p12);
}
8 changes: 6 additions & 2 deletions crypto/pkcs8/pkcs8_x509.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -741,7 +741,7 @@ struct pkcs12_st {

PKCS12 *d2i_PKCS12(PKCS12 **out_p12, const uint8_t **ber_bytes,
size_t ber_len) {
PKCS12 *p12 = OPENSSL_malloc(sizeof(PKCS12));
PKCS12 *p12 = PKCS12_new();
if (!p12) {
return NULL;
}
Expand Down Expand Up @@ -1328,7 +1328,7 @@ PKCS12 *PKCS12_create(const char *password, const char *name,
goto err;
}

ret = OPENSSL_malloc(sizeof(PKCS12));
ret = PKCS12_new();
if (ret == NULL ||
!CBB_finish(&cbb, &ret->ber_bytes, &ret->ber_len)) {
OPENSSL_free(ret);
Expand All @@ -1342,6 +1342,10 @@ PKCS12 *PKCS12_create(const char *password, const char *name,
return ret;
}

PKCS12 *PKCS12_new(void) {
return OPENSSL_zalloc(sizeof(PKCS12));
WillChilds-Klein marked this conversation as resolved.
Show resolved Hide resolved
}

void PKCS12_free(PKCS12 *p12) {
if (p12 == NULL) {
return;
Expand Down
47 changes: 46 additions & 1 deletion docs/porting/configuration-differences.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,7 +144,7 @@ The following table contains the differences in libssl configuration options AWS
</td>
</tr>
<tr>
<td rowspan=10>
<td rowspan=13>
<p>
<span>
<a href="https://github.com/aws/aws-lc/blob/e91524c10ad698fd56f77289ba3430baf3c7af64/include/openssl/ssl.h#L794-L797">
Expand Down Expand Up @@ -188,6 +188,21 @@ The following table contains the differences in libssl configuration options AWS
<p><span>NO-OP</span></p>
</td>
</tr>
<tr>
<td>
<p><span>
<a href="">
andrewhop marked this conversation as resolved.
Show resolved Hide resolved
SSL_OP_CRYPTOPRO_TLSEXT_BUG
</a>
</span></p>
</td>
<td>
<p><span>OFF</span></p>
</td>
<td>
<p><span>NO-OP</span></p>
</td>
</tr>
<tr>
<td>
<p><span>
Expand Down Expand Up @@ -280,6 +295,36 @@ The following table contains the differences in libssl configuration options AWS
<td>
<p><span>NO-OP</span></p>
</td>
</tr>
<tr>
<td>
<p><span>
<a href="">
SSL_OP_SAFARI_ECDHE_ECDSA_BUG
</a>
</span></p>
</td>
<td>
<p><span>ON</span></p>
</td>
<td>
<p><span>NO-OP</span></p>
</td>
</tr>
<tr>
<td>
<p><span>
<a href="">
SSL_OP_TLSEXT_PADDING
</a>
</span></p>
</td>
<td>
<p><span>ON</span></p>
</td>
<td>
<p><span>NO-OP</span></p>
</td>
</tr>
<tr>
<td>
Expand Down
12 changes: 10 additions & 2 deletions docs/porting/functionality-differences.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -480,10 +480,10 @@ Older and less common usages of `EVP_PKEY` have been removed. For example, signi
</td>
</tr>
<tr>
<td rowspan=4>
<td rowspan=5>
<p><span>CONF modules</span></p>
</td>
<td rowspan=4>
<td rowspan=5>
<p>
<span>
<a href="https://github.com/aws/aws-lc/blob/746d06505b3a3827cf61959ca0c3d87c3f21accc/include/openssl/conf.h#L127-L149">
Expand All @@ -498,6 +498,14 @@ Older and less common usages of `EVP_PKEY` have been removed. For example, signi
<td>
<p><span>Returns one.</span></p>
</td>
</tr>
<tr>
<td>
<p><span>CONF_get1_default_config_file</span></p>
</td>
<td>
<p><span>Returns a fixed dummy string(&quot;</span>No support for Config files in AWS-LC.&quot;)</p>
</td>
</tr>
<tr>
<td>
Expand Down
4 changes: 4 additions & 0 deletions include/openssl/conf.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,6 +142,10 @@ OPENSSL_EXPORT const char *NCONF_get_string(const CONF *conf,
OPENSSL_EXPORT OPENSSL_DEPRECATED int CONF_modules_load_file(
const char *filename, const char *appname, unsigned long flags);

// CONF_get1_default_config_file returns a fixed dummy string. AWS-LC is defined
// to have no config file options.
andrewhop marked this conversation as resolved.
Show resolved Hide resolved
OPENSSL_EXPORT OPENSSL_DEPRECATED char *CONF_get1_default_config_file(void);

// CONF_modules_free does nothing.
OPENSSL_EXPORT OPENSSL_DEPRECATED void CONF_modules_free(void);

Expand Down
3 changes: 3 additions & 0 deletions include/openssl/pkcs8.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -232,6 +232,9 @@ OPENSSL_EXPORT PKCS12 *PKCS12_create(const char *password, const char *name,
int cert_nid, int iterations,
int mac_iterations, int key_type);

// PKCS12_new returns a newly-allocated |PKCS12| object.
OPENSSL_EXPORT PKCS12 *PKCS12_new(void);

// PKCS12_free frees |p12| and its contents.
OPENSSL_EXPORT void PKCS12_free(PKCS12 *p12);

Expand Down
22 changes: 21 additions & 1 deletion include/openssl/ssl.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5618,6 +5618,14 @@ OPENSSL_EXPORT int SSL_set1_curves_list(SSL *ssl, const char *curves);
// unpatched clients and servers and is intentionally not supported in AWS-LC.
#define SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION 0

// SSL_OP_CRYPTOPRO_TLSEXT_BUG is OFF by default in AWS-LC. Turning this ON in
// OpenSSL lets the server add a server-hello extension from early version of
// the cryptopro draft, when the GOST ciphersuite is negotiated. Required for
// interoperability with CryptoPro CSP 3.x.
//
// Note: AWS-LC does not support GOST ciphersuites.
#define SSL_OP_CRYPTOPRO_TLSEXT_BUG 0

// SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS is ON by default in AWS-LC. This
// disables a countermeasure against a SSL 3.0/TLS 1.0 protocol vulnerability
// affecting CBC ciphers, which cannot be handled by some broken SSL
Expand All @@ -5642,7 +5650,7 @@ OPENSSL_EXPORT int SSL_set1_curves_list(SSL *ssl, const char *curves);
// This always starts a new session when performing renegotiation as a server
// (i.e., session resumption requests are only accepted in the initial
// handshake).
// There is no support for renegototiation for a server in AWS-LC
// There is no support for renegototiation for a server in AWS-LC.
#define SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION 0

// SSL_OP_NO_SSLv2 is ON by default in AWS-LC. There is no support for SSLv2 in
Expand All @@ -5653,6 +5661,18 @@ OPENSSL_EXPORT int SSL_set1_curves_list(SSL *ssl, const char *curves);
// AWS-LC
#define SSL_OP_NO_SSLv3 0

// SSL_OP_SAFARI_ECDHE_ECDSA_BUG is OFF by default in AWS-LC. Turning this ON in
// OpenSSL lets the application not prefer ECDHE-ECDSA ciphers when the client
// appears to be Safari on OSX.
//
// Note: OS X 10.8..10.8.3 broke support for ECDHE-ECDSA ciphers.
andrewhop marked this conversation as resolved.
Show resolved Hide resolved
#define SSL_OP_SAFARI_ECDHE_ECDSA_BUG 0

// SSL_OP_TLSEXT_PADDING is OFF by default in AWS-LC. Turning this ON in OpenSSL
// adds a padding extension to ensure the ClientHello size is never between 256
// and 511 bytes in length. This is needed as a workaround for F5 terminators.
andrewhop marked this conversation as resolved.
Show resolved Hide resolved
#define SSL_OP_TLSEXT_PADDING 0

// SSL_OP_TLS_ROLLBACK_BUG is OFF by default in AWS-LC. Turning this ON in
// OpenSSL disables version rollback attack detection and is intentionally not
// supported in AWS-LC.
Expand Down
Loading