From 71b9b708bcdc8604543bcf2e52e96096bc0672e6 Mon Sep 17 00:00:00 2001 From: samuel40791765 Date: Thu, 18 Apr 2024 22:51:48 +0000 Subject: [PATCH 1/3] Link porting guide table to header documentation --- docs/porting/configuration-differences.md | 233 ++++++++++++++++++---- docs/porting/functionality-differences.md | 91 +++++---- include/openssl/ssl.h | 2 +- 3 files changed, 236 insertions(+), 90 deletions(-) diff --git a/docs/porting/configuration-differences.md b/docs/porting/configuration-differences.md index 3dcc9b5a3b..0579987bb9 100644 --- a/docs/porting/configuration-differences.md +++ b/docs/porting/configuration-differences.md @@ -55,12 +55,12 @@ The following table contains the differences in libssl configuration options AWS

- + SSL_CTX_set_mode
SSL_set_mode

- + SSL_CTX_clear_mode
SSL_clear_mode @@ -85,7 +85,11 @@ The following table contains the differences in libssl configuration options AWS -

SSL_MODE_AUTO_RETRY

+

+ + SSL_MODE_AUTO_RETRY + +

ON

@@ -96,7 +100,11 @@ The following table contains the differences in libssl configuration options AWS -

SSL_MODE_RELEASE_BUFFERS

+

+ + SSL_MODE_RELEASE_BUFFERS + +

ON

@@ -107,7 +115,11 @@ The following table contains the differences in libssl configuration options AWS -

SSL_MODE_SEND_CLIENTHELLO_TIME

+

+ + SSL_MODE_SEND_CLIENTHELLO_TIME + +

OFF

@@ -118,7 +130,11 @@ The following table contains the differences in libssl configuration options AWS -

SSL_MODE_SEND_SERVERHELLO_TIME

+

+ + SSL_MODE_SEND_SERVERHELLO_TIME + +

ON

@@ -131,12 +147,12 @@ The following table contains the differences in libssl configuration options AWS

- + SSL_CTX_set_options
SSL_set_options

- + SSL_CTX_clear_options
SSL_clear_options @@ -144,7 +160,11 @@ The following table contains the differences in libssl configuration options AWS

-

SSL_OP_ALL

+

+ + SSL_OP_ALL + +

OFF

@@ -155,7 +175,11 @@ The following table contains the differences in libssl configuration options AWS -

SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION

+

+ + SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION + +

OFF

@@ -166,7 +190,11 @@ The following table contains the differences in libssl configuration options AWS -

SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS

+

+ + SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS + +

ON

@@ -177,7 +205,11 @@ The following table contains the differences in libssl configuration options AWS -

SSL_OP_LEGACY_SERVER_CONNECT

+

+ + SSL_OP_LEGACY_SERVER_CONNECT + +

OFF

@@ -188,7 +220,11 @@ The following table contains the differences in libssl configuration options AWS -

SSL_OP_NO_COMPRESSION

+

+ + SSL_OP_NO_COMPRESSION + +

ON

@@ -199,7 +235,11 @@ The following table contains the differences in libssl configuration options AWS -

SSL_OP_NO_RENEGOTIATION

+

+ + SSL_OP_NO_RENEGOTIATION + +

ON

@@ -213,7 +253,11 @@ The following table contains the differences in libssl configuration options AWS -

SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION

+

+ + SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION + +

ON

@@ -224,7 +268,11 @@ The following table contains the differences in libssl configuration options AWS -

SSL_OP_NO_SSLv3

+

+ + SSL_OP_NO_SSLv3 + +

ON

@@ -235,7 +283,11 @@ The following table contains the differences in libssl configuration options AWS -

SSL_OP_TLS_ROLLBACK_BUG

+

+ + SSL_OP_TLS_ROLLBACK_BUG + +

OFF

@@ -246,7 +298,11 @@ The following table contains the differences in libssl configuration options AWS -

SSL_VERIFY_CLIENT_ONCE

+

+ + SSL_VERIFY_CLIENT_ONCE + +

OFF

@@ -259,8 +315,11 @@ The following table contains the differences in libssl configuration options AWS

- + SSL_set_hostflags
+ +
+ X509_STORE_CTX_set_flags
X509_STORE_set_flags
X509_VERIFY_PARAM_set_flags
@@ -270,7 +329,11 @@ The following table contains the differences in libssl configuration options AWS

-

X509_V_FLAG_X509_STRICT

+

+ + X509_V_FLAG_X509_STRICT + +

ON

@@ -281,7 +344,11 @@ The following table contains the differences in libssl configuration options AWS -

X509_V_FLAG_ALLOW_PROXY_CERTS

+

+ + X509_V_FLAG_ALLOW_PROXY_CERTS + +

OFF

@@ -319,9 +386,13 @@ The following table contains the differences in libcrypto configuration options

- + X509_check_host
+ + X509_check_email
+ + X509_check_ip
X509_check_ip_asc @@ -329,7 +400,11 @@ The following table contains the differences in libcrypto configuration options

-

X509_CHECK_FLAG_NO_WILDCARDS

+

+ + X509_CHECK_FLAG_NO_WILDCARDS + +

OFF

@@ -340,7 +415,11 @@ The following table contains the differences in libcrypto configuration options -

X509_CHECK_FLAG_NEVER_CHECK_SUBJECT

+

+ + X509_CHECK_FLAG_NEVER_CHECK_SUBJECT + +

OFF

@@ -351,7 +430,11 @@ The following table contains the differences in libcrypto configuration options -

X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT

+

+ + X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT + +

OFF

@@ -362,7 +445,11 @@ The following table contains the differences in libcrypto configuration options -

X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS

+

+ + X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS + +

ON

@@ -373,7 +460,11 @@ The following table contains the differences in libcrypto configuration options -

X509_CHECK_FLAG_MULTI_LABEL_WILDCARDS

+

+ + X509_CHECK_FLAG_MULTI_LABEL_WILDCARDS + +

OFF

@@ -384,7 +475,11 @@ The following table contains the differences in libcrypto configuration options -

X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS

+

+ + X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS + +

OFF

@@ -397,14 +492,18 @@ The following table contains the differences in libcrypto configuration options

- + PKCS7_sign

-

PKCS7_DETACHED

+

+ + PKCS7_DETACHED + +

OFF

@@ -415,7 +514,11 @@ The following table contains the differences in libcrypto configuration options -

PKCS7_BINARY

+

+ + PKCS7_BINARY + +

@@ -435,17 +538,29 @@ The following table contains the differences in libcrypto configuration options -

PKCS7_NOATTR

+

+ + PKCS7_NOATTR + +

-

PKCS7_PARTIAL

+

+ + PKCS7_PARTIAL + +

-

PKCS7_TEXT

+

+ + PKCS7_TEXT + +

OFF

@@ -456,7 +571,11 @@ The following table contains the differences in libcrypto configuration options -

PKCS7_NOCERTS

+

+ + PKCS7_NOCERTS + +

OFF

@@ -467,7 +586,11 @@ The following table contains the differences in libcrypto configuration options -

PKCS7_STREAM

+

+ + PKCS7_STREAM + +

OFF

@@ -478,7 +601,11 @@ The following table contains the differences in libcrypto configuration options -

PKCS7_NOSMIMECAP

+

+ + PKCS7_NOSMIMECAP + +

OFF

@@ -489,10 +616,18 @@ The following table contains the differences in libcrypto configuration options -

EVP_PKEY_assign

+

+ + EVP_PKEY_assign + +

-

EVP_PKEY_DH

+

+ + EVP_PKEY_DH + +

Not Supported

@@ -503,7 +638,11 @@ The following table contains the differences in libcrypto configuration options -

EVP_PKEY_X448

+

+ + EVP_PKEY_X448 + +

Not Supported

@@ -514,7 +653,11 @@ The following table contains the differences in libcrypto configuration options -

EVP_PKEY_ED448

+

+ + EVP_PKEY_ED448 + +

Not Supported

@@ -525,7 +668,11 @@ The following table contains the differences in libcrypto configuration options -

EVP_PKEY_RSA2

+

+ + EVP_PKEY_RSA2 + +

Not Supported

@@ -563,7 +710,7 @@ The following table contains configuration options AWS-LC has intentionally omit

- + BN_FLG_CONSTTIME diff --git a/docs/porting/functionality-differences.md b/docs/porting/functionality-differences.md index d6999dbc1c..5d61001515 100644 --- a/docs/porting/functionality-differences.md +++ b/docs/porting/functionality-differences.md @@ -40,9 +40,8 @@ libssl is the portion of OpenSSL which supports TLS. AWS-LC does not have suppor

- - ssl.h
- Security Levels + + Security Levels No-ops

@@ -68,9 +67,8 @@ libssl is the portion of OpenSSL which supports TLS. AWS-LC does not have suppor

- - ssl.h
- Deprecated DH functions + + FFDH Ciphersuite No-ops

@@ -114,9 +112,8 @@ libssl is the portion of OpenSSL which supports TLS. AWS-LC does not have suppor

- - ssl.h
- Deprecated COMP functions + + SSL_COMP and COMP_METHOD No-ops

@@ -174,8 +171,7 @@ libssl is the portion of OpenSSL which supports TLS. AWS-LC does not have suppor

- - ssl.h
+ TLS Renegotiation

@@ -200,8 +196,7 @@ libssl is the portion of OpenSSL which supports TLS. AWS-LC does not have suppor

- - ssl.h
+ SSL_get_shared_ciphers

@@ -217,8 +212,7 @@ libssl is the portion of OpenSSL which supports TLS. AWS-LC does not have suppor

- - ssl.h
+ SSL_get_shared_sigalgs

@@ -234,8 +228,7 @@ libssl is the portion of OpenSSL which supports TLS. AWS-LC does not have suppor

- - ssl.h
+ SSL_get_server_tmp_key

@@ -332,11 +325,12 @@ Older and less common usages of `EVP_PKEY` have been removed. For example, signi

- - evp.h -
+ + EVP_PKEY_DSA No-ops + +

- EVP_PKEY_DSA + Porting Guide

@@ -360,8 +354,8 @@ Older and less common usages of `EVP_PKEY` have been removed. For example, signi

- - evp.h + + EVP_PKEY_DH No-ops

@@ -385,7 +379,7 @@ Older and less common usages of `EVP_PKEY` have been removed. For example, signi

- + evp.h @@ -407,11 +401,12 @@ Older and less common usages of `EVP_PKEY` have been removed. For example, signi

- - ec_key.h -

- - ec.h + + EC_KEY + +

+ + EC_GROUP

@@ -443,8 +438,8 @@ Older and less common usages of `EVP_PKEY` have been removed. For example, signi

- - ec.h + + EC_METHOD

@@ -468,8 +463,8 @@ Older and less common usages of `EVP_PKEY` have been removed. For example, signi

- - ec.h + + Compressed Forms

@@ -480,7 +475,7 @@ Older and less common usages of `EVP_PKEY` have been removed. For example, signi

Returns nothing as a void function. Aborts if a form other than - POINT_CONVERSION_UNCOMPRESSED is requested. + POINT_CONVERSION_UNCOMPRESSED or POINT_CONVERSION_COMPRESSED is requested.

@@ -491,7 +486,7 @@ Older and less common usages of `EVP_PKEY` have been removed. For example, signi

- + conf.h @@ -535,6 +530,10 @@ Older and less common usages of `EVP_PKEY` have been removed. For example, signi

+ + rand.h + +

Entropy Sources @@ -653,7 +652,7 @@ Older and less common usages of `EVP_PKEY` have been removed. For example, signi

- + asn1.h @@ -697,7 +696,7 @@ Older and less common usages of `EVP_PKEY` have been removed. For example, signi

- + thread.h @@ -838,7 +837,7 @@ Older and less common usages of `EVP_PKEY` have been removed. For example, signi

- + evp.h @@ -887,7 +886,7 @@ Older and less common usages of `EVP_PKEY` have been removed. For example, signi

- + cipher.h @@ -900,7 +899,7 @@ Older and less common usages of `EVP_PKEY` have been removed. For example, signi

Does nothing.

This functions sets flags for EVP_CIPHER_CTX, so any related flags are also no-ops. Related no-op flags can be found in - + the surrounding documentation . @@ -919,7 +918,7 @@ Older and less common usages of `EVP_PKEY` have been removed. For example, signi

- + digest.h @@ -932,7 +931,7 @@ Older and less common usages of `EVP_PKEY` have been removed. For example, signi

Does nothing.

This functions sets flags for EVP_MD_CTX, so any related flags are also no-ops. Related no-op flags can be found in - + the surrounding documentation . @@ -951,7 +950,7 @@ Older and less common usages of `EVP_PKEY` have been removed. For example, signi

- + dh.h @@ -964,7 +963,7 @@ Older and less common usages of `EVP_PKEY` have been removed. For example, signi

Does nothing.

This functions clears flags for DH, so any related flags are also no-ops. Related no-op flags can be found in - + the surrounding documentation . @@ -975,7 +974,7 @@ Older and less common usages of `EVP_PKEY` have been removed. For example, signi

- + ex_data.h @@ -1000,7 +999,7 @@ Older and less common usages of `EVP_PKEY` have been removed. For example, signi

- + bio.h diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h index fe0c09c7b0..299a8968dc 100644 --- a/include/openssl/ssl.h +++ b/include/openssl/ssl.h @@ -5594,7 +5594,7 @@ OPENSSL_EXPORT int SSL_set1_curves_list(SSL *ssl, const char *curves); // AWS-LC #define SSL_OP_NO_SSLv2 0 -// SSL_OP_NO_SSLv2 is ON by default in AWS-LC. There is no support for SSLv3 in +// SSL_OP_NO_SSLv3 is ON by default in AWS-LC. There is no support for SSLv3 in // AWS-LC #define SSL_OP_NO_SSLv3 0 From 3e5d06378217be737a2ba0417be9c44c7ec3193d Mon Sep 17 00:00:00 2001 From: samuel40791765 Date: Wed, 24 Apr 2024 20:31:31 +0000 Subject: [PATCH 2/3] PR comments; fix misaligned links --- docs/porting/functionality-differences.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/porting/functionality-differences.md b/docs/porting/functionality-differences.md index 5d61001515..6798e0b709 100644 --- a/docs/porting/functionality-differences.md +++ b/docs/porting/functionality-differences.md @@ -918,7 +918,7 @@ Older and less common usages of `EVP_PKEY` have been removed. For example, signi

- + digest.h @@ -931,7 +931,7 @@ Older and less common usages of `EVP_PKEY` have been removed. For example, signi

Does nothing.

This functions sets flags for EVP_MD_CTX, so any related flags are also no-ops. Related no-op flags can be found in - + the surrounding documentation . @@ -999,7 +999,7 @@ Older and less common usages of `EVP_PKEY` have been removed. For example, signi

- + bio.h From 964244b9054a95afd34f9939dc2c55ea8a26b0e7 Mon Sep 17 00:00:00 2001 From: samuel40791765 Date: Thu, 25 Apr 2024 18:28:56 +0000 Subject: [PATCH 3/3] add documentation to some x509 functions --- docs/porting/configuration-differences.md | 12 +++++++++--- include/openssl/x509.h | 19 ++++++++++++++++++- 2 files changed, 27 insertions(+), 4 deletions(-) diff --git a/docs/porting/configuration-differences.md b/docs/porting/configuration-differences.md index 0579987bb9..618d370942 100644 --- a/docs/porting/configuration-differences.md +++ b/docs/porting/configuration-differences.md @@ -318,12 +318,18 @@ The following table contains the differences in libssl configuration options AWS SSL_set_hostflags
 -
- + + X509_STORE_CTX_set_flags
+ + X509_STORE_set_flags
+ + X509_VERIFY_PARAM_set_flags
- X509_VERIFY_PARAM_set_hostflags + + + X509_VERIFY_PARAM_set_hostflags

diff --git a/include/openssl/x509.h b/include/openssl/x509.h index a04be3de3b..2042e610b2 100644 --- a/include/openssl/x509.h +++ b/include/openssl/x509.h @@ -3127,7 +3127,15 @@ OPENSSL_EXPORT STACK_OF(X509) *X509_STORE_get1_certs(X509_STORE_CTX *st, X509_NAME *nm); OPENSSL_EXPORT STACK_OF(X509_CRL) *X509_STORE_get1_crls(X509_STORE_CTX *st, X509_NAME *nm); -OPENSSL_EXPORT int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags); + +// X509_STORE_set_flags enables all values in |flags| in |store|'s verification +// flags. |flags| should be a combination of |X509_V_FLAG_*| constants. +// +// WARNING: These flags will be combined with default flags when copied to an +// |X509_STORE_CTX|. This means it is impossible to unset those defaults from +// the |X509_STORE|. See discussion in |X509_STORE_get0_param|. +OPENSSL_EXPORT int X509_STORE_set_flags(X509_STORE *store, unsigned long flags); + OPENSSL_EXPORT int X509_STORE_set_purpose(X509_STORE *ctx, int purpose); OPENSSL_EXPORT int X509_STORE_set_trust(X509_STORE *ctx, int trust); OPENSSL_EXPORT int X509_STORE_set1_param(X509_STORE *ctx, @@ -3248,6 +3256,10 @@ OPENSSL_EXPORT int X509_STORE_CTX_set_trust(X509_STORE_CTX *ctx, int trust); OPENSSL_EXPORT int X509_STORE_CTX_purpose_inherit(X509_STORE_CTX *ctx, int def_purpose, int purpose, int trust); + +// X509_STORE_CTX_set_flags enables all values in |flags| in |ctx|'s +// verification flags. |flags| should be a combination of |X509_V_FLAG_*| +// constants. OPENSSL_EXPORT void X509_STORE_CTX_set_flags(X509_STORE_CTX *ctx, unsigned long flags); @@ -3326,8 +3338,13 @@ OPENSSL_EXPORT int X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *to, const X509_VERIFY_PARAM *from); OPENSSL_EXPORT int X509_VERIFY_PARAM_set1(X509_VERIFY_PARAM *to, const X509_VERIFY_PARAM *from); + +// X509_VERIFY_PARAM_set_flags enables all values in |flags| in |param|'s +// verification flags and returns one. |flags| should be a combination of +// |X509_V_FLAG_*| constants. OPENSSL_EXPORT int X509_VERIFY_PARAM_set_flags(X509_VERIFY_PARAM *param, unsigned long flags); + OPENSSL_EXPORT int X509_VERIFY_PARAM_clear_flags(X509_VERIFY_PARAM *param, unsigned long flags); OPENSSL_EXPORT unsigned long X509_VERIFY_PARAM_get_flags(