#14465: Update openssl to tag android-4.0.4_r2.1
diff --git a/jni/openssl/crypto/ecdsa/ecdsa.h b/jni/openssl/crypto/ecdsa/ecdsa.h
index 7fb5254..e61c539 100644
--- a/jni/openssl/crypto/ecdsa/ecdsa.h
+++ b/jni/openssl/crypto/ecdsa/ecdsa.h
@@ -238,7 +238,6 @@
/* Error codes for the ECDSA functions. */
/* Function codes. */
-#define ECDSA_F_ECDSA_CHECK 104
#define ECDSA_F_ECDSA_DATA_NEW_METHOD 100
#define ECDSA_F_ECDSA_DO_SIGN 101
#define ECDSA_F_ECDSA_DO_VERIFY 102
@@ -250,7 +249,6 @@
#define ECDSA_R_ERR_EC_LIB 102
#define ECDSA_R_MISSING_PARAMETERS 103
#define ECDSA_R_NEED_NEW_SETUP_VALUES 106
-#define ECDSA_R_NON_FIPS_METHOD 107
#define ECDSA_R_RANDOM_NUMBER_GENERATION_FAILED 104
#define ECDSA_R_SIGNATURE_MALLOC_FAILED 105
diff --git a/jni/openssl/crypto/ecdsa/ecdsatest.c b/jni/openssl/crypto/ecdsa/ecdsatest.c
index 537bb30..26a4a9e 100644
--- a/jni/openssl/crypto/ecdsa/ecdsatest.c
+++ b/jni/openssl/crypto/ecdsa/ecdsatest.c
@@ -262,7 +262,6 @@
"3238135532097973577080787768312505059318910517550078427819"
"78505179448783"))
goto x962_err;
-#ifndef OPENSSL_NO_EC2M
if (!x9_62_test_internal(out, NID_X9_62_c2tnb191v1,
"87194383164871543355722284926904419997237591535066528048",
"308992691965804947361541664549085895292153777025772063598"))
@@ -273,7 +272,7 @@
"1970303740007316867383349976549972270528498040721988191026"
"49413465737174"))
goto x962_err;
-#endif
+
ret = 1;
x962_err:
if (!restore_rand())
@@ -287,13 +286,9 @@
size_t crv_len = 0, n = 0;
EC_KEY *eckey = NULL, *wrong_eckey = NULL;
EC_GROUP *group;
- ECDSA_SIG *ecdsa_sig = NULL;
unsigned char digest[20], wrong_digest[20];
- unsigned char *signature = NULL;
- const unsigned char *sig_ptr;
- unsigned char *sig_ptr2;
- unsigned char *raw_buf = NULL;
- unsigned int sig_len, degree, r_len, s_len, bn_len, buf_len;
+ unsigned char *signature = NULL;
+ unsigned int sig_len;
int nid, ret = 0;
/* fill digest values with some random data */
@@ -343,8 +338,7 @@
if (EC_KEY_set_group(eckey, group) == 0)
goto builtin_err;
EC_GROUP_free(group);
- degree = EC_GROUP_get_degree(EC_KEY_get0_group(eckey));
- if (degree < 160)
+ if (EC_GROUP_get_degree(EC_KEY_get0_group(eckey)) < 160)
/* drop the curve */
{
EC_KEY_free(eckey);
@@ -420,89 +414,26 @@
}
BIO_printf(out, ".");
(void)BIO_flush(out);
- /* wrong length */
- if (ECDSA_verify(0, digest, 20, signature, sig_len - 1,
- eckey) == 1)
- {
- BIO_printf(out, " failed\n");
- goto builtin_err;
- }
- BIO_printf(out, ".");
- (void)BIO_flush(out);
-
- /* Modify a single byte of the signature: to ensure we don't
- * garble the ASN1 structure, we read the raw signature and
- * modify a byte in one of the bignums directly. */
- sig_ptr = signature;
- if ((ecdsa_sig = d2i_ECDSA_SIG(NULL, &sig_ptr, sig_len)) == NULL)
- {
- BIO_printf(out, " failed\n");
- goto builtin_err;
- }
-
- /* Store the two BIGNUMs in raw_buf. */
- r_len = BN_num_bytes(ecdsa_sig->r);
- s_len = BN_num_bytes(ecdsa_sig->s);
- bn_len = (degree + 7) / 8;
- if ((r_len > bn_len) || (s_len > bn_len))
- {
- BIO_printf(out, " failed\n");
- goto builtin_err;
- }
- buf_len = 2 * bn_len;
- if ((raw_buf = OPENSSL_malloc(buf_len)) == NULL)
- goto builtin_err;
- /* Pad the bignums with leading zeroes. */
- memset(raw_buf, 0, buf_len);
- BN_bn2bin(ecdsa_sig->r, raw_buf + bn_len - r_len);
- BN_bn2bin(ecdsa_sig->s, raw_buf + buf_len - s_len);
-
- /* Modify a single byte in the buffer. */
- offset = raw_buf[10] % buf_len;
- dirt = raw_buf[11] ? raw_buf[11] : 1;
- raw_buf[offset] ^= dirt;
- /* Now read the BIGNUMs back in from raw_buf. */
- if ((BN_bin2bn(raw_buf, bn_len, ecdsa_sig->r) == NULL) ||
- (BN_bin2bn(raw_buf + bn_len, bn_len, ecdsa_sig->s) == NULL))
- goto builtin_err;
-
- sig_ptr2 = signature;
- sig_len = i2d_ECDSA_SIG(ecdsa_sig, &sig_ptr2);
+ /* modify a single byte of the signature */
+ offset = signature[10] % sig_len;
+ dirt = signature[11];
+ signature[offset] ^= dirt ? dirt : 1;
if (ECDSA_verify(0, digest, 20, signature, sig_len, eckey) == 1)
{
BIO_printf(out, " failed\n");
goto builtin_err;
}
- /* Sanity check: undo the modification and verify signature. */
- raw_buf[offset] ^= dirt;
- if ((BN_bin2bn(raw_buf, bn_len, ecdsa_sig->r) == NULL) ||
- (BN_bin2bn(raw_buf + bn_len, bn_len, ecdsa_sig->s) == NULL))
- goto builtin_err;
-
- sig_ptr2 = signature;
- sig_len = i2d_ECDSA_SIG(ecdsa_sig, &sig_ptr2);
- if (ECDSA_verify(0, digest, 20, signature, sig_len, eckey) != 1)
- {
- BIO_printf(out, " failed\n");
- goto builtin_err;
- }
BIO_printf(out, ".");
(void)BIO_flush(out);
BIO_printf(out, " ok\n");
/* cleanup */
- /* clean bogus errors */
- ERR_clear_error();
OPENSSL_free(signature);
signature = NULL;
EC_KEY_free(eckey);
eckey = NULL;
EC_KEY_free(wrong_eckey);
wrong_eckey = NULL;
- ECDSA_SIG_free(ecdsa_sig);
- ecdsa_sig = NULL;
- OPENSSL_free(raw_buf);
- raw_buf = NULL;
}
ret = 1;
@@ -511,12 +442,8 @@
EC_KEY_free(eckey);
if (wrong_eckey)
EC_KEY_free(wrong_eckey);
- if (ecdsa_sig)
- ECDSA_SIG_free(ecdsa_sig);
if (signature)
OPENSSL_free(signature);
- if (raw_buf)
- OPENSSL_free(raw_buf);
if (curves)
OPENSSL_free(curves);
diff --git a/jni/openssl/crypto/ecdsa/ecs_err.c b/jni/openssl/crypto/ecdsa/ecs_err.c
index 81542e6..98e38d5 100644
--- a/jni/openssl/crypto/ecdsa/ecs_err.c
+++ b/jni/openssl/crypto/ecdsa/ecs_err.c
@@ -1,6 +1,6 @@
/* crypto/ecdsa/ecs_err.c */
/* ====================================================================
- * Copyright (c) 1999-2011 The OpenSSL Project. All rights reserved.
+ * Copyright (c) 1999-2006 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -70,7 +70,6 @@
static ERR_STRING_DATA ECDSA_str_functs[]=
{
-{ERR_FUNC(ECDSA_F_ECDSA_CHECK), "ECDSA_CHECK"},
{ERR_FUNC(ECDSA_F_ECDSA_DATA_NEW_METHOD), "ECDSA_DATA_NEW_METHOD"},
{ERR_FUNC(ECDSA_F_ECDSA_DO_SIGN), "ECDSA_do_sign"},
{ERR_FUNC(ECDSA_F_ECDSA_DO_VERIFY), "ECDSA_do_verify"},
@@ -85,7 +84,6 @@
{ERR_REASON(ECDSA_R_ERR_EC_LIB) ,"err ec lib"},
{ERR_REASON(ECDSA_R_MISSING_PARAMETERS) ,"missing parameters"},
{ERR_REASON(ECDSA_R_NEED_NEW_SETUP_VALUES),"need new setup values"},
-{ERR_REASON(ECDSA_R_NON_FIPS_METHOD) ,"non fips method"},
{ERR_REASON(ECDSA_R_RANDOM_NUMBER_GENERATION_FAILED),"random number generation failed"},
{ERR_REASON(ECDSA_R_SIGNATURE_MALLOC_FAILED),"signature malloc failed"},
{0,NULL}
diff --git a/jni/openssl/crypto/ecdsa/ecs_lib.c b/jni/openssl/crypto/ecdsa/ecs_lib.c
index e477da4..2ebae3a 100644
--- a/jni/openssl/crypto/ecdsa/ecs_lib.c
+++ b/jni/openssl/crypto/ecdsa/ecs_lib.c
@@ -60,9 +60,6 @@
#endif
#include <openssl/err.h>
#include <openssl/bn.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
const char ECDSA_version[]="ECDSA" OPENSSL_VERSION_PTEXT;
@@ -80,16 +77,7 @@
const ECDSA_METHOD *ECDSA_get_default_method(void)
{
if(!default_ECDSA_method)
- {
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return FIPS_ecdsa_openssl();
- else
- return ECDSA_OpenSSL();
-#else
default_ECDSA_method = ECDSA_OpenSSL();
-#endif
- }
return default_ECDSA_method;
}
@@ -205,14 +193,7 @@
}
else
ecdsa_data = (ECDSA_DATA *)data;
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && !(ecdsa_data->flags & ECDSA_FLAG_FIPS_METHOD)
- && !(EC_KEY_get_flags(key) & EC_FLAG_NON_FIPS_ALLOW))
- {
- ECDSAerr(ECDSA_F_ECDSA_CHECK, ECDSA_R_NON_FIPS_METHOD);
- return NULL;
- }
-#endif
+
return ecdsa_data;
}
diff --git a/jni/openssl/crypto/ecdsa/ecs_locl.h b/jni/openssl/crypto/ecdsa/ecs_locl.h
index cb3be13..3a69a84 100644
--- a/jni/openssl/crypto/ecdsa/ecs_locl.h
+++ b/jni/openssl/crypto/ecdsa/ecs_locl.h
@@ -82,14 +82,6 @@
char *app_data;
};
-/* If this flag is set the ECDSA method is FIPS compliant and can be used
- * in FIPS mode. This is set in the validated module method. If an
- * application sets this flag in its own methods it is its responsibility
- * to ensure the result is compliant.
- */
-
-#define ECDSA_FLAG_FIPS_METHOD 0x1
-
typedef struct ecdsa_data_st {
/* EC_KEY_METH_DATA part */
int (*init)(EC_KEY *);
diff --git a/jni/openssl/crypto/ecdsa/ecs_ossl.c b/jni/openssl/crypto/ecdsa/ecs_ossl.c
index 7725935..1bbf328 100644
--- a/jni/openssl/crypto/ecdsa/ecs_ossl.c
+++ b/jni/openssl/crypto/ecdsa/ecs_ossl.c
@@ -167,7 +167,6 @@
goto err;
}
}
-#ifndef OPENSSL_NO_EC2M
else /* NID_X9_62_characteristic_two_field */
{
if (!EC_POINT_get_affine_coordinates_GF2m(group,
@@ -177,7 +176,6 @@
goto err;
}
}
-#endif
if (!BN_nnmod(r, X, order, ctx))
{
ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB);
@@ -456,7 +454,6 @@
goto err;
}
}
-#ifndef OPENSSL_NO_EC2M
else /* NID_X9_62_characteristic_two_field */
{
if (!EC_POINT_get_affine_coordinates_GF2m(group,
@@ -466,7 +463,7 @@
goto err;
}
}
-#endif
+
if (!BN_nnmod(u1, X, order, ctx))
{
ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_BN_LIB);