more fixes from upstream
- fix errors in manual causing build failure (#904777)
This commit is contained in:
Tomas Mraz
parent
2ca16b9a24
commit
0fd0958b75
|
|
@ -0,0 +1,474 @@
|
|||
diff -up openssl-1.0.1c/doc/apps/verify.pod.manfix openssl-1.0.1c/doc/apps/verify.pod
|
||||
--- openssl-1.0.1c/doc/apps/verify.pod.manfix 2010-02-23 15:09:22.000000000 +0100
|
||||
+++ openssl-1.0.1c/doc/apps/verify.pod 2013-01-30 17:36:15.277264650 +0100
|
||||
@@ -54,35 +54,37 @@ in PEM format concatenated together.
|
||||
=item B<-untrusted file>
|
||||
|
||||
A file of untrusted certificates. The file should contain multiple certificates
|
||||
+in PEM format concatenated together.
|
||||
|
||||
=item B<-purpose purpose>
|
||||
|
||||
-the intended use for the certificate. Without this option no chain verification
|
||||
-will be done. Currently accepted uses are B<sslclient>, B<sslserver>,
|
||||
-B<nssslserver>, B<smimesign>, B<smimeencrypt>. See the B<VERIFY OPERATION>
|
||||
-section for more information.
|
||||
+The intended use for the certificate. If this option is not specified,
|
||||
+B<verify> will not consider certificate purpose during chain verification.
|
||||
+Currently accepted uses are B<sslclient>, B<sslserver>, B<nssslserver>,
|
||||
+B<smimesign>, B<smimeencrypt>. See the B<VERIFY OPERATION> section for more
|
||||
+information.
|
||||
|
||||
=item B<-help>
|
||||
|
||||
-prints out a usage message.
|
||||
+Print out a usage message.
|
||||
|
||||
=item B<-verbose>
|
||||
|
||||
-print extra information about the operations being performed.
|
||||
+Print extra information about the operations being performed.
|
||||
|
||||
=item B<-issuer_checks>
|
||||
|
||||
-print out diagnostics relating to searches for the issuer certificate
|
||||
-of the current certificate. This shows why each candidate issuer
|
||||
-certificate was rejected. However the presence of rejection messages
|
||||
-does not itself imply that anything is wrong: during the normal
|
||||
-verify process several rejections may take place.
|
||||
+Print out diagnostics relating to searches for the issuer certificate of the
|
||||
+current certificate. This shows why each candidate issuer certificate was
|
||||
+rejected. The presence of rejection messages does not itself imply that
|
||||
+anything is wrong; during the normal verification process, several
|
||||
+rejections may take place.
|
||||
|
||||
=item B<-policy arg>
|
||||
|
||||
-Enable policy processing and add B<arg> to the user-initial-policy-set
|
||||
-(see RFC3280 et al). The policy B<arg> can be an object name an OID in numeric
|
||||
-form. This argument can appear more than once.
|
||||
+Enable policy processing and add B<arg> to the user-initial-policy-set (see
|
||||
+RFC5280). The policy B<arg> can be an object name an OID in numeric form.
|
||||
+This argument can appear more than once.
|
||||
|
||||
=item B<-policy_check>
|
||||
|
||||
@@ -90,41 +92,40 @@ Enables certificate policy processing.
|
||||
|
||||
=item B<-explicit_policy>
|
||||
|
||||
-Set policy variable require-explicit-policy (see RFC3280 et al).
|
||||
+Set policy variable require-explicit-policy (see RFC5280).
|
||||
|
||||
=item B<-inhibit_any>
|
||||
|
||||
-Set policy variable inhibit-any-policy (see RFC3280 et al).
|
||||
+Set policy variable inhibit-any-policy (see RFC5280).
|
||||
|
||||
=item B<-inhibit_map>
|
||||
|
||||
-Set policy variable inhibit-policy-mapping (see RFC3280 et al).
|
||||
+Set policy variable inhibit-policy-mapping (see RFC5280).
|
||||
|
||||
=item B<-policy_print>
|
||||
|
||||
-Print out diagnostics, related to policy checking
|
||||
+Print out diagnostics related to policy processing.
|
||||
|
||||
=item B<-crl_check>
|
||||
|
||||
-Checks end entity certificate validity by attempting to lookup a valid CRL.
|
||||
+Checks end entity certificate validity by attempting to look up a valid CRL.
|
||||
If a valid CRL cannot be found an error occurs.
|
||||
|
||||
=item B<-crl_check_all>
|
||||
|
||||
Checks the validity of B<all> certificates in the chain by attempting
|
||||
-to lookup valid CRLs.
|
||||
+to look up valid CRLs.
|
||||
|
||||
=item B<-ignore_critical>
|
||||
|
||||
Normally if an unhandled critical extension is present which is not
|
||||
-supported by OpenSSL the certificate is rejected (as required by
|
||||
-RFC3280 et al). If this option is set critical extensions are
|
||||
-ignored.
|
||||
+supported by OpenSSL the certificate is rejected (as required by RFC5280).
|
||||
+If this option is set critical extensions are ignored.
|
||||
|
||||
=item B<-x509_strict>
|
||||
|
||||
-Disable workarounds for broken certificates which have to be disabled
|
||||
-for strict X.509 compliance.
|
||||
+For strict X.509 compliance, disable non-compliant workarounds for broken
|
||||
+certificates.
|
||||
|
||||
=item B<-extended_crl>
|
||||
|
||||
@@ -142,16 +143,15 @@ because it doesn't add any security.
|
||||
|
||||
=item B<->
|
||||
|
||||
-marks the last option. All arguments following this are assumed to be
|
||||
+Indicates the last option. All arguments following this are assumed to be
|
||||
certificate files. This is useful if the first certificate filename begins
|
||||
with a B<->.
|
||||
|
||||
=item B<certificates>
|
||||
|
||||
-one or more certificates to verify. If no certificate filenames are included
|
||||
-then an attempt is made to read a certificate from standard input. They should
|
||||
-all be in PEM format.
|
||||
-
|
||||
+One or more certificates to verify. If no certificates are given, B<verify>
|
||||
+will attempt to read a certificate from standard input. Certificates must be
|
||||
+in PEM format.
|
||||
|
||||
=back
|
||||
|
||||
diff -up openssl-1.0.1c/doc/apps/x509.pod.manfix openssl-1.0.1c/doc/apps/x509.pod
|
||||
--- openssl-1.0.1c/doc/apps/x509.pod.manfix 2013-01-10 10:26:11.000000000 +0100
|
||||
+++ openssl-1.0.1c/doc/apps/x509.pod 2013-01-30 17:35:38.952458133 +0100
|
||||
@@ -29,6 +29,7 @@ B<openssl> B<x509>
|
||||
[B<-purpose>]
|
||||
[B<-dates>]
|
||||
[B<-modulus>]
|
||||
+[B<-pubkey>]
|
||||
[B<-fingerprint>]
|
||||
[B<-alias>]
|
||||
[B<-noout>]
|
||||
@@ -136,6 +137,10 @@ section for more information.
|
||||
|
||||
this option prevents output of the encoded version of the request.
|
||||
|
||||
+=item B<-pubkey>
|
||||
+
|
||||
+outputs the the certificate's SubjectPublicKeyInfo block in PEM format.
|
||||
+
|
||||
=item B<-modulus>
|
||||
|
||||
this option prints out the value of the modulus of the public key
|
||||
diff -up openssl-1.0.1c/doc/crypto/EVP_PKEY_CTX_ctrl.pod.manfix openssl-1.0.1c/doc/crypto/EVP_PKEY_CTX_ctrl.pod
|
||||
--- openssl-1.0.1c/doc/crypto/EVP_PKEY_CTX_ctrl.pod.manfix 2009-10-01 01:40:47.000000000 +0200
|
||||
+++ openssl-1.0.1c/doc/crypto/EVP_PKEY_CTX_ctrl.pod 2013-01-30 17:36:05.381045128 +0100
|
||||
@@ -117,7 +117,7 @@ L<EVP_PKEY_encrypt(3)|EVP_PKEY_encrypt(3
|
||||
L<EVP_PKEY_decrypt(3)|EVP_PKEY_decrypt(3)>,
|
||||
L<EVP_PKEY_sign(3)|EVP_PKEY_sign(3)>,
|
||||
L<EVP_PKEY_verify(3)|EVP_PKEY_verify(3)>,
|
||||
-L<EVP_PKEY_verifyrecover(3)|EVP_PKEY_verifyrecover(3)>,
|
||||
+L<EVP_PKEY_verify_recover(3)|EVP_PKEY_verify_recover(3)>,
|
||||
L<EVP_PKEY_derive(3)|EVP_PKEY_derive(3)>
|
||||
L<EVP_PKEY_keygen(3)|EVP_PKEY_keygen(3)>
|
||||
|
||||
diff -up openssl-1.0.1c/doc/crypto/EVP_PKEY_decrypt.pod.manfix openssl-1.0.1c/doc/crypto/EVP_PKEY_decrypt.pod
|
||||
--- openssl-1.0.1c/doc/crypto/EVP_PKEY_decrypt.pod.manfix 2009-10-01 01:40:48.000000000 +0200
|
||||
+++ openssl-1.0.1c/doc/crypto/EVP_PKEY_decrypt.pod 2013-01-30 17:36:05.381045128 +0100
|
||||
@@ -83,7 +83,7 @@ L<EVP_PKEY_CTX_new(3)|EVP_PKEY_CTX_new(3
|
||||
L<EVP_PKEY_encrypt(3)|EVP_PKEY_encrypt(3)>,
|
||||
L<EVP_PKEY_sign(3)|EVP_PKEY_sign(3)>,
|
||||
L<EVP_PKEY_verify(3)|EVP_PKEY_verify(3)>,
|
||||
-L<EVP_PKEY_verifyrecover(3)|EVP_PKEY_verifyrecover(3)>,
|
||||
+L<EVP_PKEY_verify_recover(3)|EVP_PKEY_verify_recover(3)>,
|
||||
L<EVP_PKEY_derive(3)|EVP_PKEY_derive(3)>
|
||||
|
||||
=head1 HISTORY
|
||||
diff -up openssl-1.0.1c/doc/crypto/EVP_PKEY_derive.pod.manfix openssl-1.0.1c/doc/crypto/EVP_PKEY_derive.pod
|
||||
--- openssl-1.0.1c/doc/crypto/EVP_PKEY_derive.pod.manfix 2009-10-01 01:40:48.000000000 +0200
|
||||
+++ openssl-1.0.1c/doc/crypto/EVP_PKEY_derive.pod 2013-01-30 17:36:05.381045128 +0100
|
||||
@@ -84,7 +84,7 @@ L<EVP_PKEY_encrypt(3)|EVP_PKEY_encrypt(3
|
||||
L<EVP_PKEY_decrypt(3)|EVP_PKEY_decrypt(3)>,
|
||||
L<EVP_PKEY_sign(3)|EVP_PKEY_sign(3)>,
|
||||
L<EVP_PKEY_verify(3)|EVP_PKEY_verify(3)>,
|
||||
-L<EVP_PKEY_verifyrecover(3)|EVP_PKEY_verifyrecover(3)>,
|
||||
+L<EVP_PKEY_verify_recover(3)|EVP_PKEY_verify_recover(3)>,
|
||||
|
||||
=head1 HISTORY
|
||||
|
||||
diff -up openssl-1.0.1c/doc/crypto/EVP_PKEY_encrypt.pod.manfix openssl-1.0.1c/doc/crypto/EVP_PKEY_encrypt.pod
|
||||
--- openssl-1.0.1c/doc/crypto/EVP_PKEY_encrypt.pod.manfix 2009-10-01 01:40:48.000000000 +0200
|
||||
+++ openssl-1.0.1c/doc/crypto/EVP_PKEY_encrypt.pod 2013-01-30 17:36:05.382045143 +0100
|
||||
@@ -83,7 +83,7 @@ L<EVP_PKEY_CTX_new(3)|EVP_PKEY_CTX_new(3
|
||||
L<EVP_PKEY_decrypt(3)|EVP_PKEY_decrypt(3)>,
|
||||
L<EVP_PKEY_sign(3)|EVP_PKEY_sign(3)>,
|
||||
L<EVP_PKEY_verify(3)|EVP_PKEY_verify(3)>,
|
||||
-L<EVP_PKEY_verifyrecover(3)|EVP_PKEY_verifyrecover(3)>,
|
||||
+L<EVP_PKEY_verify_recover(3)|EVP_PKEY_verify_recover(3)>,
|
||||
L<EVP_PKEY_derive(3)|EVP_PKEY_derive(3)>
|
||||
|
||||
=head1 HISTORY
|
||||
diff -up openssl-1.0.1c/doc/crypto/EVP_PKEY_get_default_digest.pod.manfix openssl-1.0.1c/doc/crypto/EVP_PKEY_get_default_digest.pod
|
||||
--- openssl-1.0.1c/doc/crypto/EVP_PKEY_get_default_digest.pod.manfix 2009-10-01 01:40:48.000000000 +0200
|
||||
+++ openssl-1.0.1c/doc/crypto/EVP_PKEY_get_default_digest.pod 2013-01-30 17:36:05.382045143 +0100
|
||||
@@ -32,7 +32,7 @@ public key algorithm.
|
||||
L<EVP_PKEY_CTX_new(3)|EVP_PKEY_CTX_new(3)>,
|
||||
L<EVP_PKEY_sign(3)|EVP_PKEY_sign(3)>,
|
||||
L<EVP_PKEY_verify(3)|EVP_PKEY_verify(3)>,
|
||||
-L<EVP_PKEY_verifyrecover(3)|EVP_PKEY_verifyrecover(3)>,
|
||||
+L<EVP_PKEY_verify_recover(3)|EVP_PKEY_verify_recover(3)>,
|
||||
|
||||
=head1 HISTORY
|
||||
|
||||
diff -up openssl-1.0.1c/doc/crypto/EVP_PKEY_keygen.pod.manfix openssl-1.0.1c/doc/crypto/EVP_PKEY_keygen.pod
|
||||
--- openssl-1.0.1c/doc/crypto/EVP_PKEY_keygen.pod.manfix 2009-10-01 01:40:49.000000000 +0200
|
||||
+++ openssl-1.0.1c/doc/crypto/EVP_PKEY_keygen.pod 2013-01-30 17:36:05.382045143 +0100
|
||||
@@ -151,7 +151,7 @@ L<EVP_PKEY_encrypt(3)|EVP_PKEY_encrypt(3
|
||||
L<EVP_PKEY_decrypt(3)|EVP_PKEY_decrypt(3)>,
|
||||
L<EVP_PKEY_sign(3)|EVP_PKEY_sign(3)>,
|
||||
L<EVP_PKEY_verify(3)|EVP_PKEY_verify(3)>,
|
||||
-L<EVP_PKEY_verifyrecover(3)|EVP_PKEY_verifyrecover(3)>,
|
||||
+L<EVP_PKEY_verify_recover(3)|EVP_PKEY_verify_recover(3)>,
|
||||
L<EVP_PKEY_derive(3)|EVP_PKEY_derive(3)>
|
||||
|
||||
=head1 HISTORY
|
||||
diff -up openssl-1.0.1c/doc/crypto/EVP_PKEY_sign.pod.manfix openssl-1.0.1c/doc/crypto/EVP_PKEY_sign.pod
|
||||
--- openssl-1.0.1c/doc/crypto/EVP_PKEY_sign.pod.manfix 2009-10-01 01:40:50.000000000 +0200
|
||||
+++ openssl-1.0.1c/doc/crypto/EVP_PKEY_sign.pod 2013-01-30 17:36:05.383045149 +0100
|
||||
@@ -86,7 +86,7 @@ L<EVP_PKEY_CTX_new(3)|EVP_PKEY_CTX_new(3
|
||||
L<EVP_PKEY_encrypt(3)|EVP_PKEY_encrypt(3)>,
|
||||
L<EVP_PKEY_decrypt(3)|EVP_PKEY_decrypt(3)>,
|
||||
L<EVP_PKEY_verify(3)|EVP_PKEY_verify(3)>,
|
||||
-L<EVP_PKEY_verifyrecover(3)|EVP_PKEY_verifyrecover(3)>,
|
||||
+L<EVP_PKEY_verify_recover(3)|EVP_PKEY_verify_recover(3)>,
|
||||
L<EVP_PKEY_derive(3)|EVP_PKEY_derive(3)>
|
||||
|
||||
=head1 HISTORY
|
||||
diff -up openssl-1.0.1c/doc/crypto/EVP_PKEY_verify.pod.manfix openssl-1.0.1c/doc/crypto/EVP_PKEY_verify.pod
|
||||
--- openssl-1.0.1c/doc/crypto/EVP_PKEY_verify.pod.manfix 2010-12-02 14:45:25.000000000 +0100
|
||||
+++ openssl-1.0.1c/doc/crypto/EVP_PKEY_verify.pod 2013-01-30 17:36:05.383045149 +0100
|
||||
@@ -81,7 +81,7 @@ L<EVP_PKEY_CTX_new(3)|EVP_PKEY_CTX_new(3
|
||||
L<EVP_PKEY_encrypt(3)|EVP_PKEY_encrypt(3)>,
|
||||
L<EVP_PKEY_decrypt(3)|EVP_PKEY_decrypt(3)>,
|
||||
L<EVP_PKEY_sign(3)|EVP_PKEY_sign(3)>,
|
||||
-L<EVP_PKEY_verifyrecover(3)|EVP_PKEY_verifyrecover(3)>,
|
||||
+L<EVP_PKEY_verify_recover(3)|EVP_PKEY_verify_recover(3)>,
|
||||
L<EVP_PKEY_derive(3)|EVP_PKEY_derive(3)>
|
||||
|
||||
=head1 HISTORY
|
||||
diff -up openssl-1.0.1c/doc/crypto/EVP_PKEY_verify_recover.pod.manfix openssl-1.0.1c/doc/crypto/EVP_PKEY_verify_recover.pod
|
||||
--- openssl-1.0.1c/doc/crypto/EVP_PKEY_verify_recover.pod.manfix 2013-01-30 17:36:05.383045149 +0100
|
||||
+++ openssl-1.0.1c/doc/crypto/EVP_PKEY_verify_recover.pod 2013-01-30 17:36:05.383045149 +0100
|
||||
@@ -0,0 +1,103 @@
|
||||
+=pod
|
||||
+
|
||||
+=head1 NAME
|
||||
+
|
||||
+EVP_PKEY_verify_recover_init, EVP_PKEY_verify_recover - recover signature using a public key algorithm
|
||||
+
|
||||
+=head1 SYNOPSIS
|
||||
+
|
||||
+ #include <openssl/evp.h>
|
||||
+
|
||||
+ int EVP_PKEY_verify_recover_init(EVP_PKEY_CTX *ctx);
|
||||
+ int EVP_PKEY_verify_recover(EVP_PKEY_CTX *ctx,
|
||||
+ unsigned char *rout, size_t *routlen,
|
||||
+ const unsigned char *sig, size_t siglen);
|
||||
+
|
||||
+=head1 DESCRIPTION
|
||||
+
|
||||
+The EVP_PKEY_verify_recover_init() function initializes a public key algorithm
|
||||
+context using key B<pkey> for a verify recover operation.
|
||||
+
|
||||
+The EVP_PKEY_verify_recover() function recovers signed data
|
||||
+using B<ctx>. The signature is specified using the B<sig> and
|
||||
+B<siglen> parameters. If B<rout> is B<NULL> then the maximum size of the output
|
||||
+buffer is written to the B<routlen> parameter. If B<rout> is not B<NULL> then
|
||||
+before the call the B<routlen> parameter should contain the length of the
|
||||
+B<rout> buffer, if the call is successful recovered data is written to
|
||||
+B<rout> and the amount of data written to B<routlen>.
|
||||
+
|
||||
+=head1 NOTES
|
||||
+
|
||||
+Normally an application is only interested in whether a signature verification
|
||||
+operation is successful in those cases the EVP_verify() function should be
|
||||
+used.
|
||||
+
|
||||
+Sometimes however it is useful to obtain the data originally signed using a
|
||||
+signing operation. Only certain public key algorithms can recover a signature
|
||||
+in this way (for example RSA in PKCS padding mode).
|
||||
+
|
||||
+After the call to EVP_PKEY_verify_recover_init() algorithm specific control
|
||||
+operations can be performed to set any appropriate parameters for the
|
||||
+operation.
|
||||
+
|
||||
+The function EVP_PKEY_verify_recover() can be called more than once on the same
|
||||
+context if several operations are performed using the same parameters.
|
||||
+
|
||||
+=head1 RETURN VALUES
|
||||
+
|
||||
+EVP_PKEY_verify_recover_init() and EVP_PKEY_verify_recover() return 1 for success
|
||||
+and 0 or a negative value for failure. In particular a return value of -2
|
||||
+indicates the operation is not supported by the public key algorithm.
|
||||
+
|
||||
+=head1 EXAMPLE
|
||||
+
|
||||
+Recover digest originally signed using PKCS#1 and SHA256 digest:
|
||||
+
|
||||
+ #include <openssl/evp.h>
|
||||
+ #include <openssl/rsa.h>
|
||||
+
|
||||
+ EVP_PKEY_CTX *ctx;
|
||||
+ unsigned char *rout, *sig;
|
||||
+ size_t routlen, siglen;
|
||||
+ EVP_PKEY *verify_key;
|
||||
+ /* NB: assumes verify_key, sig and siglen are already set up
|
||||
+ * and that verify_key is an RSA public key
|
||||
+ */
|
||||
+ ctx = EVP_PKEY_CTX_new(verify_key);
|
||||
+ if (!ctx)
|
||||
+ /* Error occurred */
|
||||
+ if (EVP_PKEY_verify_recover_init(ctx) <= 0)
|
||||
+ /* Error */
|
||||
+ if (EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0)
|
||||
+ /* Error */
|
||||
+ if (EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha256()) <= 0)
|
||||
+ /* Error */
|
||||
+
|
||||
+ /* Determine buffer length */
|
||||
+ if (EVP_PKEY_verify_recover(ctx, NULL, &routlen, sig, siglen) <= 0)
|
||||
+ /* Error */
|
||||
+
|
||||
+ rout = OPENSSL_malloc(routlen);
|
||||
+
|
||||
+ if (!rout)
|
||||
+ /* malloc failure */
|
||||
+
|
||||
+ if (EVP_PKEY_verify_recover(ctx, rout, &routlen, sig, siglen) <= 0)
|
||||
+ /* Error */
|
||||
+
|
||||
+ /* Recovered data is routlen bytes written to buffer rout */
|
||||
+
|
||||
+=head1 SEE ALSO
|
||||
+
|
||||
+L<EVP_PKEY_CTX_new(3)|EVP_PKEY_CTX_new(3)>,
|
||||
+L<EVP_PKEY_encrypt(3)|EVP_PKEY_encrypt(3)>,
|
||||
+L<EVP_PKEY_decrypt(3)|EVP_PKEY_decrypt(3)>,
|
||||
+L<EVP_PKEY_sign(3)|EVP_PKEY_sign(3)>,
|
||||
+L<EVP_PKEY_verify(3)|EVP_PKEY_verify(3)>,
|
||||
+L<EVP_PKEY_derive(3)|EVP_PKEY_derive(3)>
|
||||
+
|
||||
+=head1 HISTORY
|
||||
+
|
||||
+These functions were first added to OpenSSL 1.0.0.
|
||||
+
|
||||
+=cut
|
||||
diff -up openssl-1.0.1c/doc/crypto/X509_STORE_CTX_get_error.pod.manfix openssl-1.0.1c/doc/crypto/X509_STORE_CTX_get_error.pod
|
||||
--- openssl-1.0.1c/doc/crypto/X509_STORE_CTX_get_error.pod.manfix 2009-10-18 17:28:59.000000000 +0200
|
||||
+++ openssl-1.0.1c/doc/crypto/X509_STORE_CTX_get_error.pod 2013-01-30 17:34:16.315630759 +0100
|
||||
@@ -278,6 +278,8 @@ happen if extended CRL checking is enabl
|
||||
an application specific error. This will never be returned unless explicitly
|
||||
set by an application.
|
||||
|
||||
+=back
|
||||
+
|
||||
=head1 NOTES
|
||||
|
||||
The above functions should be used instead of directly referencing the fields
|
||||
diff -up openssl-1.0.1c/doc/crypto/EVP_PKEY_verifyrecover.pod /dev/null
|
||||
--- openssl-1.0.1c/doc/crypto/EVP_PKEY_verifyrecover.pod
|
||||
+++ /dev/null
|
||||
@@ -1,103 +0,0 @@
|
||||
-=pod
|
||||
-
|
||||
-=head1 NAME
|
||||
-
|
||||
-EVP_PKEY_verifyrecover_init, EVP_PKEY_verifyrecover - recover signature using a public key algorithm
|
||||
-
|
||||
-=head1 SYNOPSIS
|
||||
-
|
||||
- #include <openssl/evp.h>
|
||||
-
|
||||
- int EVP_PKEY_verifyrecover_init(EVP_PKEY_CTX *ctx);
|
||||
- int EVP_PKEY_verifyrecover(EVP_PKEY_CTX *ctx,
|
||||
- unsigned char *rout, size_t *routlen,
|
||||
- const unsigned char *sig, size_t siglen);
|
||||
-
|
||||
-=head1 DESCRIPTION
|
||||
-
|
||||
-The EVP_PKEY_verifyrecover_init() function initializes a public key algorithm
|
||||
-context using key B<pkey> for a verify recover operation.
|
||||
-
|
||||
-The EVP_PKEY_verifyrecover() function recovers signed data
|
||||
-using B<ctx>. The signature is specified using the B<sig> and
|
||||
-B<siglen> parameters. If B<rout> is B<NULL> then the maximum size of the output
|
||||
-buffer is written to the B<routlen> parameter. If B<rout> is not B<NULL> then
|
||||
-before the call the B<routlen> parameter should contain the length of the
|
||||
-B<rout> buffer, if the call is successful recovered data is written to
|
||||
-B<rout> and the amount of data written to B<routlen>.
|
||||
-
|
||||
-=head1 NOTES
|
||||
-
|
||||
-Normally an application is only interested in whether a signature verification
|
||||
-operation is successful in those cases the EVP_verify() function should be
|
||||
-used.
|
||||
-
|
||||
-Sometimes however it is useful to obtain the data originally signed using a
|
||||
-signing operation. Only certain public key algorithms can recover a signature
|
||||
-in this way (for example RSA in PKCS padding mode).
|
||||
-
|
||||
-After the call to EVP_PKEY_verifyrecover_init() algorithm specific control
|
||||
-operations can be performed to set any appropriate parameters for the
|
||||
-operation.
|
||||
-
|
||||
-The function EVP_PKEY_verifyrecover() can be called more than once on the same
|
||||
-context if several operations are performed using the same parameters.
|
||||
-
|
||||
-=head1 RETURN VALUES
|
||||
-
|
||||
-EVP_PKEY_verifyrecover_init() and EVP_PKEY_verifyrecover() return 1 for success
|
||||
-and 0 or a negative value for failure. In particular a return value of -2
|
||||
-indicates the operation is not supported by the public key algorithm.
|
||||
-
|
||||
-=head1 EXAMPLE
|
||||
-
|
||||
-Recover digest originally signed using PKCS#1 and SHA256 digest:
|
||||
-
|
||||
- #include <openssl/evp.h>
|
||||
- #include <openssl/rsa.h>
|
||||
-
|
||||
- EVP_PKEY_CTX *ctx;
|
||||
- unsigned char *rout, *sig;
|
||||
- size_t routlen, siglen;
|
||||
- EVP_PKEY *verify_key;
|
||||
- /* NB: assumes verify_key, sig and siglen are already set up
|
||||
- * and that verify_key is an RSA public key
|
||||
- */
|
||||
- ctx = EVP_PKEY_CTX_new(verify_key);
|
||||
- if (!ctx)
|
||||
- /* Error occurred */
|
||||
- if (EVP_PKEY_verifyrecover_init(ctx) <= 0)
|
||||
- /* Error */
|
||||
- if (EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0)
|
||||
- /* Error */
|
||||
- if (EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha256()) <= 0)
|
||||
- /* Error */
|
||||
-
|
||||
- /* Determine buffer length */
|
||||
- if (EVP_PKEY_verifyrecover(ctx, NULL, &routlen, sig, siglen) <= 0)
|
||||
- /* Error */
|
||||
-
|
||||
- rout = OPENSSL_malloc(routlen);
|
||||
-
|
||||
- if (!rout)
|
||||
- /* malloc failure */
|
||||
-
|
||||
- if (EVP_PKEY_verifyrecover(ctx, rout, &routlen, sig, siglen) <= 0)
|
||||
- /* Error */
|
||||
-
|
||||
- /* Recovered data is routlen bytes written to buffer rout */
|
||||
-
|
||||
-=head1 SEE ALSO
|
||||
-
|
||||
-L<EVP_PKEY_CTX_new(3)|EVP_PKEY_CTX_new(3)>,
|
||||
-L<EVP_PKEY_encrypt(3)|EVP_PKEY_encrypt(3)>,
|
||||
-L<EVP_PKEY_decrypt(3)|EVP_PKEY_decrypt(3)>,
|
||||
-L<EVP_PKEY_sign(3)|EVP_PKEY_sign(3)>,
|
||||
-L<EVP_PKEY_verify(3)|EVP_PKEY_verify(3)>,
|
||||
-L<EVP_PKEY_derive(3)|EVP_PKEY_derive(3)>
|
||||
-
|
||||
-=head1 HISTORY
|
||||
-
|
||||
-These functions were first added to OpenSSL 1.0.0.
|
||||
-
|
||||
-=cut
|
||||
--
|
||||
|
||||
|
|
@ -0,0 +1,77 @@
|
|||
From 5bb6d96558ff6013826e3362f4c81513e3df23ff Mon Sep 17 00:00:00 2001
|
||||
From: Ben Laurie <ben@openssl.org>
|
||||
Date: Thu, 13 Dec 2012 15:48:42 +0000
|
||||
Subject: [PATCH] Make verify return errors.
|
||||
|
||||
---
|
||||
CHANGES | 3 +++
|
||||
Makefile.org | 2 +-
|
||||
apps/verify.c | 16 ++++++++++++----
|
||||
test/Makefile | 2 +-
|
||||
4 files changed, 17 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/Makefile.org b/Makefile.org
|
||||
index 55273ea..43d16cb 100644
|
||||
--- a/Makefile.org
|
||||
+++ b/Makefile.org
|
||||
@@ -444,7 +444,7 @@ rehash.time: certs apps
|
||||
[ -x "apps/openssl.exe" ] && OPENSSL="apps/openssl.exe" || :; \
|
||||
OPENSSL_DEBUG_MEMORY=on; \
|
||||
export OPENSSL OPENSSL_DEBUG_MEMORY; \
|
||||
- $(PERL) tools/c_rehash certs) && \
|
||||
+ $(PERL) tools/c_rehash certs/demo) && \
|
||||
touch rehash.time; \
|
||||
else :; fi
|
||||
|
||||
diff --git a/apps/verify.c b/apps/verify.c
|
||||
index 0f34b86..893670f 100644
|
||||
--- a/apps/verify.c
|
||||
+++ b/apps/verify.c
|
||||
@@ -222,11 +222,19 @@ int MAIN(int argc, char **argv)
|
||||
goto end;
|
||||
}
|
||||
|
||||
- if (argc < 1) check(cert_ctx, NULL, untrusted, trusted, crls, e);
|
||||
+ ret = 0;
|
||||
+ if (argc < 1)
|
||||
+ {
|
||||
+ if (1 != check(cert_ctx, NULL, untrusted, trusted, crls, e))
|
||||
+ ret = -1;
|
||||
+ }
|
||||
else
|
||||
+ {
|
||||
for (i=0; i<argc; i++)
|
||||
- check(cert_ctx,argv[i], untrusted, trusted, crls, e);
|
||||
- ret=0;
|
||||
+ if (1 != check(cert_ctx,argv[i], untrusted, trusted, crls, e))
|
||||
+ ret = -1;
|
||||
+ }
|
||||
+
|
||||
end:
|
||||
if (ret == 1) {
|
||||
BIO_printf(bio_err,"usage: verify [-verbose] [-CApath path] [-CAfile file] [-purpose purpose] [-crl_check]");
|
||||
@@ -252,7 +260,7 @@ end:
|
||||
sk_X509_pop_free(trusted, X509_free);
|
||||
sk_X509_CRL_pop_free(crls, X509_CRL_free);
|
||||
apps_shutdown();
|
||||
- OPENSSL_EXIT(ret);
|
||||
+ OPENSSL_EXIT(ret < 0 ? 2 : ret);
|
||||
}
|
||||
|
||||
static int check(X509_STORE *ctx, char *file,
|
||||
diff --git a/test/Makefile b/test/Makefile
|
||||
index 09e6848..4c9eabc 100644
|
||||
--- a/test/Makefile
|
||||
+++ b/test/Makefile
|
||||
@@ -246,7 +246,7 @@ test_ecdh:
|
||||
test_verify:
|
||||
@echo "The following command should have some OK's and some failures"
|
||||
@echo "There are definitly a few expired certificates"
|
||||
- ../util/shlib_wrap.sh ../apps/openssl verify -CApath ../certs ../certs/*.pem
|
||||
+ ../util/shlib_wrap.sh ../apps/openssl verify -CApath ../certs/demo ../certs/demo/*.pem
|
||||
|
||||
test_dh:
|
||||
@echo "Generate a set of DH parameters"
|
||||
--
|
||||
1.7.7.6
|
||||
|
||||
10
openssl.spec
10
openssl.spec
|
|
@ -22,7 +22,7 @@ Summary: Utilities from the general purpose cryptography library with TLS implem
|
|||
Name: openssl
|
||||
Version: 1.0.1c
|
||||
# Do not forget to bump SHLIB_VERSION on version upgrades
|
||||
Release: 11%{?dist}
|
||||
Release: 12%{?dist}
|
||||
Epoch: 1
|
||||
# We have to remove certain patented algorithms from the openssl source
|
||||
# tarball with the hobble-openssl script which is included below.
|
||||
|
|
@ -75,6 +75,8 @@ Patch81: openssl-1.0.1-beta2-padlock64.patch
|
|||
Patch82: openssl-1.0.1c-backports.patch
|
||||
Patch83: openssl-1.0.1c-ccm-init-str.patch
|
||||
Patch84: openssl-1.0.1c-backports2.patch
|
||||
Patch85: openssl-1.0.1c-manfix.patch
|
||||
Patch86: openssl-1.0.1c-verify-error.patch
|
||||
|
||||
License: OpenSSL
|
||||
Group: System Environment/Libraries
|
||||
|
|
@ -181,6 +183,8 @@ from other formats to the formats used by the OpenSSL toolkit.
|
|||
%patch82 -p1 -b .backports
|
||||
%patch83 -p1 -b .init-str
|
||||
%patch84 -p1 -b .backports2
|
||||
%patch85 -p1 -b .manfix
|
||||
%patch86 -p1 -b .verify
|
||||
|
||||
# Modify the various perl scripts to reference perl in the right location.
|
||||
perl util/perlpath.pl `dirname %{__perl}`
|
||||
|
|
@ -436,6 +440,10 @@ rm -rf $RPM_BUILD_ROOT/%{_libdir}/fipscanister.*
|
|||
%postun libs -p /sbin/ldconfig
|
||||
|
||||
%changelog
|
||||
* Wed Jan 30 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1c-12
|
||||
- more fixes from upstream
|
||||
- fix errors in manual causing build failure (#904777)
|
||||
|
||||
* Fri Dec 21 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1c-11
|
||||
- add script for renewal of a self-signed cert by Philip Prindeville (#871566)
|
||||
- allow X509_issuer_and_serial_hash() produce correct result in
|
||||
|
|
|
|||
Loading…
Reference in New Issue