diff options
| -rw-r--r-- | botan_version.py | 2 | ||||
| -rw-r--r-- | doc/news.rst | 33 | ||||
| -rw-r--r-- | doc/security.rst | 4 | ||||
| -rw-r--r-- | doc/todo.rst | 5 | ||||
| -rw-r--r-- | readme.rst | 25 | ||||
| -rw-r--r-- | src/build-data/buildh.in | 6 | ||||
| -rw-r--r-- | src/build-data/cc/msvc.txt | 2 | ||||
| -rw-r--r-- | src/cli/main.cpp | 12 | ||||
| -rw-r--r-- | src/lib/cert/x509/x509_ext.h | 2 | ||||
| -rw-r--r-- | src/scripts/ci/appveyor.yml | 3 | ||||
| -rwxr-xr-x | src/scripts/dist.py | 67 |
11 files changed, 107 insertions, 54 deletions
diff --git a/botan_version.py b/botan_version.py index b92681d93..e5e2b811a 100644 --- a/botan_version.py +++ b/botan_version.py @@ -1,7 +1,7 @@ release_major = 1 release_minor = 11 -release_patch = 29 +release_patch = 30 release_so_abi_rev = release_patch # These are set by the distribution script diff --git a/doc/news.rst b/doc/news.rst index fe6b5c4b7..2a9fe53a6 100644 --- a/doc/news.rst +++ b/doc/news.rst @@ -9,6 +9,17 @@ Version 1.11.30, Not Yet Released a MAC failure. Records like this are used by OpenSSL in TLS 1.0 connections in order to randomize the IV. +* The Transform and Keyed_Transform interfaces has been removed. The + two concrete implementations of these interfaces were Cipher_Mode + and the Compressor_tkk. The Cipher_Mode interface remains unchanged + as the Transform and Keyed_Transform signatures have moved to it; + no changes to Cipher_Mode usage should be necessary. Any uses of + Transform& or Keyed_Transform& to refer to a cipher should be replaced + by Cipher_Mode&. The compression algorithm interface has changed; the start + function now takes the per-message compression ratio to use. Previously the + compression level to use had to be set once, at creation time, and + the required `secure_vector` argument to start was required to be empty. + * Add IETF versions of the ChaCha20Poly1305 TLS ciphersuites from draft-ietf-tls-chacha20-poly1305-04. The previously implemented (non-standard) ChaCha20Poly1305 ciphersuites from @@ -19,10 +30,32 @@ Version 1.11.30, Not Yet Released previous versions of the draft, and the ciphersuite numbers used for the (still experimental) OCB ciphersuites have changed. +* Previously an unknown critical extension caused X.509 certificate + parsing to fail; such a cert could not be created at all. Now + parsing succeeds and the certificate validation fails with + an error indicating an unknown critical extension. GH #469 + +* X509_CRL previously had an option to cause it to ignore unknown + critical extensions. This has been removed. + +* Added support for ChaCha stream cipher with 12 rounds. + +* Add ECGDSA signature algorithm (GH #479) + +* Add NIST SP800-108 and 56C KDFs (GH #481) + * A bug in the IETF version of ChaCha20Poly1305 (with 96 bit nonces) caused incorrect computation when the plaintext or AAD was exactly a multiple of 16 bytes. +* Fix return type of TLS_Reader::get_u32bit, which was truncated to + 16 bits. This only affected decoding of session ticket lifetimes. + GH #478 + +* Fix OS X dylib naming problem (GH #468 #467) + +* Fix bcrypt function under Python 3 (GH #461) + Version 1.10.13, 2016-04-23 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ diff --git a/doc/security.rst b/doc/security.rst index c2858cb0a..23b46f30d 100644 --- a/doc/security.rst +++ b/doc/security.rst @@ -27,7 +27,7 @@ Advisories information about the nonce to eventually recover the ECDSA secret key. Found by Sean Devlin. - Introduced in 1.7.15, fixed in 1.11.29 + Introduced in 1.7.15, fixed in 1.10.13 and 1.11.29 * 2016-03-17 (CVE-2016-2850): Failure to enforce TLS policy @@ -158,7 +158,7 @@ Advisories time blocks with ctgrind (https://github.com/agl/ctgrind) were added to PKCS #1 decoding among other areas. Found in a review by Sirrix AG and 3curity GmbH. - Fixed in 1.11.22. Affected all previous versions. + Fixed in 1.11.22 and 1.10.13. Affected all previous versions. * 2015-08-03 (CVE-2015-5726): Crash in BER decoder diff --git a/doc/todo.rst b/doc/todo.rst index 4d33731ea..930c23fbd 100644 --- a/doc/todo.rst +++ b/doc/todo.rst @@ -14,8 +14,11 @@ CLI for an example * `encrypt` / `decrypt` tools providing password and/or public key based file encryption +* `bcrypt` cmdlet +* Make help output more helpful * More microbenchmarks in `speed`: modular exponentiation, ECC point multiplication, other BigInt operations +* Compute cycles/byte estimates for benchmark output TLS ---------------------------------------- @@ -81,6 +84,7 @@ Symmetric Algorithms, Hashes, ... * Bitsliced AES or Camellia * Compressed tables for AES * AES using vector permutes for NEON, AltiVec +* Use ARMv8 crypto: AES, SHA * Camellia with AES-NI * Serpent using AVX2 * Serpent using SSSE3 pshufb for sboxes @@ -112,7 +116,6 @@ Library Infrastructure * Add logging callbacks * Add latency tracing framework -* Compute cycles/byte estimates for benchmark output Build ---------------------------------------- diff --git a/readme.rst b/readme.rst index ff8f769c0..0fe50df7c 100644 --- a/readme.rst +++ b/readme.rst @@ -5,10 +5,13 @@ Botan (Japanese for peony) is a cryptography library written in C++11 and released under the permissive `Simplified BSD <http://botan.randombit.net/license.txt>`_ license. -It provides TLS, X.509 certificates, OCSP, ECDSA, AES, GCM, ChaCha20Poly1305, -McEliece, bcrypt, and quite a few other things. It also provides a `botan` -command line tool for various cryptographic operations, the source for which -also helps demonstrate usage of the library. +It contains TLS client and server implementation, X.509 certificates, +ECDSA, AES, GCM, ChaCha20Poly1305, McEliece, bcrypt and other useful +tools. + +As part of the build there is also a `botan` program built for command +line usage (similar to `openssl`). The sources for these are intended to +act as good examples of library usage. Development is coordinated on `GitHub <https://github.com/randombit/botan>`_ and contributions are welcome. Read `doc/contributing.rst` for more @@ -40,18 +43,16 @@ think you've found a security bug, read the `security page <http://botan.randombit.net/security.html>`_ for contact information and procedures. -The `GitHub wiki <https://github.com/randombit/botan/wiki>`_ -and `Doxygen docs <https://botan.randombit.net/doxygen>`_ -may also prove as useful resources. - In addition to C++, botan has a C89 API specifically designed to be easy to call from other languages. A Python binding using ctypes is included, there are also partial bindings for `Node.js <https://github.com/justinfreitag/node-botan>`_ and `OCaml <https://github.com/randombit/botan-ocaml>`_ among others. -There is also a third party open source implementation of -`SSHv2 <https://github.com/cdesjardins/cppssh>`_ using the library. +There is no support for the SSH protocol in Botan but there is a +seperately developed C++11 SSH library by `cdesjardins +<https://github.com/cdesjardins/cppssh>`_ which uses Botan for crypto +operations. .. image:: https://travis-ci.org/randombit/botan.svg?branch=master :target: https://travis-ci.org/randombit/botan @@ -188,9 +189,9 @@ Hash functions and MACs * SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512 * SHA-3 winner Keccak-1600 -* SHA-3 candidate Skein-512 -* Authentication codes HMAC, CMAC, Poly1305, SipHash +* Skein-512, BLAKE2b * RIPEMD-160, Tiger, Whirlpool, GOST 34.11 +* Authentication codes HMAC, CMAC, Poly1305, SipHash * Hash function combiners (Parallel and Comb4P) * Non-cryptographic checksums Adler32, CRC24, CRC32 * Obsolete algorithms MD5, MD4, CBC-MAC, X9.19 DES-MAC diff --git a/src/build-data/buildh.in b/src/build-data/buildh.in index 6412fdcdf..d6201be19 100644 --- a/src/build-data/buildh.in +++ b/src/build-data/buildh.in @@ -226,12 +226,6 @@ Each poll generates 32 bit entropy %{target_compiler_defines} -#if defined(_MSC_VER) - // 4250: inherits via dominance (diamond inheritence issue) - // 4251: needs DLL interface (STL DLL exports) - #pragma warning(disable: 4250 4251) -#endif - /* * Compile-time deprecatation warnings */ diff --git a/src/build-data/cc/msvc.txt b/src/build-data/cc/msvc.txt index 02e33bfab..8231c0429 100644 --- a/src/build-data/cc/msvc.txt +++ b/src/build-data/cc/msvc.txt @@ -19,7 +19,7 @@ optimization_flags "/O2" debug_info_flags "/Zi /FS" lang_flags "/EHs /GR" -warning_flags "/W3 /wd4275 /wd4267" +warning_flags "/W4 /wd4250 /wd4251 /wd4275" visibility_build_flags "/DBOTAN_DLL=__declspec(dllexport)" visibility_attribute "__declspec(dllimport)" diff --git a/src/cli/main.cpp b/src/cli/main.cpp index f6bbcc30e..f63de8fa2 100644 --- a/src/cli/main.cpp +++ b/src/cli/main.cpp @@ -21,11 +21,13 @@ std::string main_help() std::ostringstream oss; oss << "Usage: botan <cmd> <cmd-options>\n"; - oss << "Available commands: "; - std::copy(avail_commands.begin(), - avail_commands.end(), - std::ostream_iterator<std::string>(oss, " ")); - oss << "\n"; + oss << "Available commands:\n"; + + for(auto& cmd_name : avail_commands) + { + auto cmd = Botan_CLI::Command::get_cmd(cmd_name); + oss << cmd->cmd_spec() << "\n"; + } return oss.str(); } diff --git a/src/lib/cert/x509/x509_ext.h b/src/lib/cert/x509/x509_ext.h index caefcb855..8ea2f2da6 100644 --- a/src/lib/cert/x509/x509_ext.h +++ b/src/lib/cert/x509/x509_ext.h @@ -490,7 +490,7 @@ class BOTAN_DLL Unknown_Critical_Extension final : public Certificate_Extension std::string oid_name() const override { return "Unknown OID name"; } - bool should_encode() const { return false; } + bool should_encode() const override { return false; } std::vector<byte> encode_inner() const override; void decode_inner(const std::vector<byte>&) override; void contents_to(Data_Store&, Data_Store&) const override; diff --git a/src/scripts/ci/appveyor.yml b/src/scripts/ci/appveyor.yml index d0f59c920..58e04eea9 100644 --- a/src/scripts/ci/appveyor.yml +++ b/src/scripts/ci/appveyor.yml @@ -24,9 +24,8 @@ install: ) - cl # check compiler version -# always build via amalgamation due to build time constraints on appveyor build_script: - - python configure.py --cc=msvc --via-amalgamation --cpu=%PLATFORM% %MODE% + - python configure.py --cc=msvc --cpu=%PLATFORM% %MODE% - nmake - botan-test - nmake install diff --git a/src/scripts/dist.py b/src/scripts/dist.py index 224f01395..9ec0e6738 100755 --- a/src/scripts/dist.py +++ b/src/scripts/dist.py @@ -3,7 +3,7 @@ """ Release script for botan (http://botan.randombit.net/) -(C) 2011, 2012, 2013, 2015 Jack Lloyd +(C) 2011, 2012, 2013, 2015, 2016 Jack Lloyd Botan is released under the Simplified BSD License (see license.txt) """ @@ -218,30 +218,51 @@ def main(args = None): version_file = os.path.join(output_basename, 'botan_version.py') - if os.access(version_file, os.R_OK): - # rewrite botan_version.py - - contents = open(version_file).readlines() - - def content_rewriter(): - for line in contents: - if line == 'release_vc_rev = None\n': - yield 'release_vc_rev = \'git:%s\'\n' % (rev_id) - elif line == 'release_datestamp = 0\n': - yield 'release_datestamp = %d\n' % (rel_date) - elif line == "release_type = \'unreleased\'\n": - if args[0] == 'snapshot': - yield "release_type = 'snapshot'\n" - else: - yield "release_type = 'released'\n" - else: - yield line - - open(version_file, 'w').write(''.join(list(content_rewriter()))) - else: + if os.access(version_file, os.R_OK) == False: logging.error('Cannot read %s' % (version_file)) return 2 + # rewrite botan_version.py + + contents = open(version_file).readlines() + + version_re = re.compile('release_(major|minor|patch) = ([0-9]+)') + version_parts = target_version.split('.') + assert len(version_parts) == 3 + + def content_rewriter(): + for line in contents: + + if target_version != 'HEAD': + match = version_re.match(line) + if match: + name_to_idx = { + 'major': 0, + 'minor': 1, + 'patch': 2 + } + in_tag = int(version_parts[name_to_idx[match.group(1)]]) + in_file = int(match.group(2)) + + if in_tag != in_file: + logging.error('Version number part "%s" in botan_version.py does not match tag %s' % + (match.group(1), target_version)) + raise Exception('Bad botan_version.py') + + if line == 'release_vc_rev = None\n': + yield 'release_vc_rev = \'git:%s\'\n' % (rev_id) + elif line == 'release_datestamp = 0\n': + yield 'release_datestamp = %d\n' % (rel_date) + elif line == "release_type = \'unreleased\'\n": + if args[0] == 'snapshot': + yield "release_type = 'snapshot'\n" + else: + yield "release_type = 'released'\n" + else: + yield line + + open(version_file, 'w').write(''.join(list(content_rewriter()))) + try: os.makedirs(options.output_dir) except OSError as e: @@ -323,5 +344,5 @@ if __name__ == '__main__': except Exception as e: logging.error(e) import traceback - logging.info(traceback.format_exc()) + logging.debug(traceback.format_exc()) sys.exit(1) |