diff --git a/README b/README index e905d5e..17c0ddf 100644 --- a/README +++ b/README @@ -322,7 +322,7 @@ Building systems. For the server to support DNSSEC, you need to build it - with crypto support. You must have OpenSSL 0.9.5a + with crypto support. You must have OpenSSL 1.0.1t or newer installed and specify "--with-openssl" on the configure command line. If OpenSSL is installed under a nonstandard prefix, you can tell configure where to diff --git a/bin/named/main.c b/bin/named/main.c index e0dafb1..f716b3f 100644 --- a/bin/named/main.c +++ b/bin/named/main.c @@ -688,8 +688,14 @@ parse_command_line(int argc, char *argv[]) { #ifdef OPENSSL printf("compiled with OpenSSL version: %s\n", OPENSSL_VERSION_TEXT); +#if OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */ + printf("linked to OpenSSL version: %s\n", + OpenSSL_version(OPENSSL_VERSION)); + +#else printf("linked to OpenSSL version: %s\n", SSLeay_version(SSLEAY_VERSION)); +#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */ #endif #ifdef HAVE_LIBXML2 printf("compiled with libxml2 version: %s\n", diff --git a/bin/tests/dst/t_dst.c b/bin/tests/dst/t_dst.c index 0bb723d..27da3fd 100644 --- a/bin/tests/dst/t_dst.c +++ b/bin/tests/dst/t_dst.c @@ -910,9 +910,42 @@ t2_sigchk(char *datapath, char *sigpath, char *keyname, * signed at some earlier time, possibly with an entire different * version or implementation of the DSA and RSA algorithms */ -static const char *a2 = - "the dst module provides the capability to " - "verify data signed with the RSA and DSA algorithms"; + +isc_mem_t *t2_mctx = NULL; +isc_entropy_t *t2_ectx = NULL; + +static int +t2_vfy_init(void) { + isc_result_t isc_result; + + t2_mctx = NULL; + isc_result = isc_mem_create(0, 0, &t2_mctx); + if (isc_result != ISC_R_SUCCESS) { + t_info("isc_mem_create failed %s\n", + isc_result_totext(isc_result)); + return(0); + } + t2_ectx = NULL; + isc_result = isc_entropy_create(t2_mctx, &t2_ectx); + if (isc_result != ISC_R_SUCCESS) { + t_info("isc_entropy_create failed %s\n", + isc_result_totext(isc_result)); + return(0); + } + isc_result = isc_entropy_createfilesource(t2_ectx, "randomfile"); + if (isc_result != ISC_R_SUCCESS) { + t_info("isc_entropy_create failed %s\n", + isc_result_totext(isc_result)); + return(0); + } + isc_result = dst_lib_init(t2_mctx, t2_ectx, ISC_ENTROPY_BLOCKING); + if (isc_result != ISC_R_SUCCESS) { + t_info("dst_lib_init failed %s\n", + isc_result_totext(isc_result)); + return(0); + } + return(1); +} /* * av == datafile, sigpath, keyname, keyid, alg, exp_result. @@ -929,9 +962,6 @@ t2_vfy(char **av) { char *exp_result; int nfails; int nprobs; - isc_mem_t *mctx; - isc_entropy_t *ectx; - isc_result_t isc_result; int result; datapath = *av++; @@ -953,33 +983,6 @@ t2_vfy(char **av) { return(T_UNRESOLVED); } - mctx = NULL; - isc_result = isc_mem_create(0, 0, &mctx); - if (isc_result != ISC_R_SUCCESS) { - t_info("isc_mem_create failed %s\n", - isc_result_totext(isc_result)); - return(T_UNRESOLVED); - } - ectx = NULL; - isc_result = isc_entropy_create(mctx, &ectx); - if (isc_result != ISC_R_SUCCESS) { - t_info("isc_entropy_create failed %s\n", - isc_result_totext(isc_result)); - return(T_UNRESOLVED); - } - isc_result = isc_entropy_createfilesource(ectx, "randomfile"); - if (isc_result != ISC_R_SUCCESS) { - t_info("isc_entropy_create failed %s\n", - isc_result_totext(isc_result)); - return(T_UNRESOLVED); - } - isc_result = dst_lib_init(mctx, ectx, ISC_ENTROPY_BLOCKING); - if (isc_result != ISC_R_SUCCESS) { - t_info("dst_lib_init failed %s\n", - isc_result_totext(isc_result)); - return(T_UNRESOLVED); - } - if (!dst_algorithm_supported(DST_ALG_RSAMD5)) { dst_lib_destroy(); t_info("library built without crypto support\n"); @@ -990,15 +993,9 @@ t2_vfy(char **av) { datapath, sigpath, keyname, key, alg, exp_result); t2_sigchk(datapath, sigpath, keyname, keyid, algid, DST_TYPE_PRIVATE|DST_TYPE_PUBLIC, - mctx, exp_result, + t2_mctx, exp_result, &nfails, &nprobs); - dst_lib_destroy(); - - isc_entropy_detach(&ectx); - - isc_mem_destroy(&mctx); - result = T_UNRESOLVED; if (nfails) result = T_FAIL; @@ -1008,11 +1005,24 @@ t2_vfy(char **av) { return(result); } +static const char *a2 = + "the dst module provides the capability to " + "verify data signed with the RSA and DSA algorithms"; + static void t2(void) { int result; t_assert("dst", 2, T_REQUIRED, "%s", a2); - result = t_eval("dst_2_data", t2_vfy, 6); + if (!t2_vfy_init()) { + result = T_UNRESOLVED; + } else { + result = t_eval("dst_2_data", t2_vfy, 6); + dst_lib_destroy(); + } + if (t2_ectx) + isc_entropy_detach(&t2_ectx); + if (t2_mctx) + isc_mem_destroy(&t2_mctx); t_result(result); } diff --git a/configure b/configure index 0ea01af..27156e2 100755 --- a/configure +++ b/configure @@ -15916,8 +15916,8 @@ $as_echo "using OpenSSL from $use_openssl/lib and $use_openssl/include" >&6; } saved_cc="$CC" saved_cflags="$CFLAGS" saved_libs="$LIBS" - CFLAGS="$CFLAGS $DST_OPENSSL_INC" - LIBS="$LIBS $DST_OPENSSL_LIBS" + CFLAGS="$DST_OPENSSL_INC $CFLAGS" + LIBS="$DST_OPENSSL_LIBS $LIBS" { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether linking with OpenSSL works" >&5 $as_echo_n "checking whether linking with OpenSSL works... " >&6; } if test "$cross_compiling" = yes; then : @@ -15955,13 +15955,24 @@ $as_echo_n "checking whether linking with OpenSSL requires -ldl... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ +#include +#if OPENSSL_VERSION_NUMBER >= 0x10100004L +#include +#else #include #include +#endif int main () { - DSO_METHOD_dlfcn(); + +#if OPENSSL_VERSION_NUMBER >= 0x10100004L +OPENSSL_init_crypto(OPENSSL_INIT_ENGINE_ALL_BUILTIN, NULL); +#else +DSO_METHOD_dlfcn(); +#endif + ; return 0; } @@ -15974,13 +15985,23 @@ else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ +#if OPENSSL_VERSION_NUMBER >= 0x10100004L +#include +#else #include #include +#endif int main () { - DSO_METHOD_dlfcn(); + +#if OPENSSL_VERSION_NUMBER >= 0x10100004L +OPENSSL_init_crypto(OPENSSL_INIT_ENGINE_ALL_BUILTIN, NULL); +#else +DSO_METHOD_dlfcn(); +#endif + ; return 0; } @@ -16027,7 +16048,7 @@ int main() { OPENSSL_VERSION_NUMBER < 0x10002000L) || OPENSSL_VERSION_NUMBER >= 0x1000205fL) return (0); - printf("\n\nFound OPENSSL_VERSION_NUMBER %#010x\n", + printf("\n\nFound OPENSSL_VERSION_NUMBER %#010lx\n", OPENSSL_VERSION_NUMBER); printf("Require OPENSSL_VERSION_NUMBER 0x009070cf or greater (0.9.7l)\n" "Require OPENSSL_VERSION_NUMBER 0x0090804f or greater (0.9.8d)\n" @@ -16247,7 +16268,7 @@ else #include int main() { - EVP_CIPHER *aes128, *aes192, *aes256; + const EVP_CIPHER *aes128, *aes192, *aes256; aes128 = EVP_aes_128_ecb(); aes192 = EVP_aes_192_ecb(); @@ -16420,43 +16441,6 @@ $as_echo "yes" >&6; } ISC_PLATFORM_OPENSSLHASH="#define ISC_PLATFORM_OPENSSLHASH 1" ISC_OPENSSL_INC="$DST_OPENSSL_INC" ISC_OPENSSL_LIBS="$DST_OPENSSL_LIBS" - saved_cflags="$CFLAGS" - save_libs="$LIBS" - CFLAGS="$CFLAGS $ISC_OPENSSL_INC" - LIBS="$LIBS $ISC_OPENSSL_LIBS" - { $as_echo "$as_me:${as_lineno-$LINENO}: checking HMAC_Init() return type" >&5 -$as_echo_n "checking HMAC_Init() return type... " >&6; } - cat confdefs.h - <<_ACEOF >conftest.$ac_ext -/* end confdefs.h. */ - - #include -int -main () -{ - - HMAC_CTX ctx; - int n = HMAC_Init(&ctx, NULL, 0, NULL); - n += HMAC_Update(&ctx, NULL, 0); - n += HMAC_Final(&ctx, NULL, NULL); - ; - return 0; -} -_ACEOF -if ac_fn_c_try_compile "$LINENO"; then : - - { $as_echo "$as_me:${as_lineno-$LINENO}: result: int" >&5 -$as_echo "int" >&6; } - -$as_echo "#define HMAC_RETURN_INT 1" >>confdefs.h - -else - - { $as_echo "$as_me:${as_lineno-$LINENO}: result: void" >&5 -$as_echo "void" >&6; } -fi -rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext - CFLAGS="$saved_cflags" - LIBS="$save_libs" ;; no) { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 diff --git a/configure.in b/configure.in index 82480b5..d78e445 100644 --- a/configure.in +++ b/configure.in @@ -1595,8 +1595,8 @@ If you don't want OpenSSL, use --without-openssl]) saved_cc="$CC" saved_cflags="$CFLAGS" saved_libs="$LIBS" - CFLAGS="$CFLAGS $DST_OPENSSL_INC" - LIBS="$LIBS $DST_OPENSSL_LIBS" + CFLAGS="$DST_OPENSSL_INC $CFLAGS" + LIBS="$DST_OPENSSL_LIBS $LIBS" AC_MSG_CHECKING(whether linking with OpenSSL works) AC_TRY_RUN([ #include @@ -1615,16 +1615,38 @@ shared library configuration (e.g., LD_LIBRARY_PATH).)], AC_MSG_CHECKING(whether linking with OpenSSL requires -ldl) AC_TRY_LINK([ +#include +#if OPENSSL_VERSION_NUMBER >= 0x10100004L +#include +#else #include #include +#endif +], +[ +#if OPENSSL_VERSION_NUMBER >= 0x10100004L +OPENSSL_init_crypto(OPENSSL_INIT_ENGINE_ALL_BUILTIN, NULL); +#else +DSO_METHOD_dlfcn(); +#endif ], -[ DSO_METHOD_dlfcn(); ], [AC_MSG_RESULT(no)], [LIBS="$LIBS -ldl" AC_TRY_LINK([ +#if OPENSSL_VERSION_NUMBER >= 0x10100004L +#include +#else #include #include -],[ DSO_METHOD_dlfcn(); ], +#endif +], +[ +#if OPENSSL_VERSION_NUMBER >= 0x10100004L +OPENSSL_init_crypto(OPENSSL_INIT_ENGINE_ALL_BUILTIN, NULL); +#else +DSO_METHOD_dlfcn(); +#endif +], [AC_MSG_RESULT(yes) DST_OPENSSL_LIBS="$DST_OPENSSL_LIBS -ldl" ], @@ -1651,7 +1673,7 @@ int main() { OPENSSL_VERSION_NUMBER < 0x10002000L) || OPENSSL_VERSION_NUMBER >= 0x1000205fL) return (0); - printf("\n\nFound OPENSSL_VERSION_NUMBER %#010x\n", + printf("\n\nFound OPENSSL_VERSION_NUMBER %#010lx\n", OPENSSL_VERSION_NUMBER); printf("Require OPENSSL_VERSION_NUMBER 0x009070cf or greater (0.9.7l)\n" "Require OPENSSL_VERSION_NUMBER 0x0090804f or greater (0.9.8d)\n" @@ -1803,7 +1825,7 @@ int main() { AC_TRY_RUN([ #include int main() { - EVP_CIPHER *aes128, *aes192, *aes256; + const EVP_CIPHER *aes128, *aes192, *aes256; aes128 = EVP_aes_128_ecb(); aes192 = EVP_aes_192_ecb(); @@ -1953,22 +1975,6 @@ case $want_openssl_hash in ISC_PLATFORM_OPENSSLHASH="#define ISC_PLATFORM_OPENSSLHASH 1" ISC_OPENSSL_INC="$DST_OPENSSL_INC" ISC_OPENSSL_LIBS="$DST_OPENSSL_LIBS" - saved_cflags="$CFLAGS" - save_libs="$LIBS" - CFLAGS="$CFLAGS $ISC_OPENSSL_INC" - LIBS="$LIBS $ISC_OPENSSL_LIBS" - AC_MSG_CHECKING([HMAC_Init() return type]) - AC_TRY_COMPILE([ - #include ],[ - HMAC_CTX ctx; - int n = HMAC_Init(&ctx, NULL, 0, NULL); - n += HMAC_Update(&ctx, NULL, 0); - n += HMAC_Final(&ctx, NULL, NULL);],[ - AC_MSG_RESULT(int) - AC_DEFINE(HMAC_RETURN_INT, 1, [HMAC_*() return ints])],[ - AC_MSG_RESULT(void)]) - CFLAGS="$saved_cflags" - LIBS="$save_libs" ;; no) AC_MSG_RESULT(no) diff --git a/lib/dns/dst_gost.h b/lib/dns/dst_gost.h index da6dcf5..86dda8b 100644 --- a/lib/dns/dst_gost.h +++ b/lib/dns/dst_gost.h @@ -18,7 +18,13 @@ #ifdef HAVE_OPENSSL_GOST #include -typedef EVP_MD_CTX isc_gost_t; +typedef struct { + EVP_MD_CTX *ctx; +#if OPENSSL_VERSION_NUMBER < 0x10100000L + EVP_MD_CTX _ctx; +#endif +} isc_gost_t; + #endif #ifdef HAVE_PKCS11_GOST #include diff --git a/lib/dns/dst_openssl.h b/lib/dns/dst_openssl.h index d7dd0e8..f8a3057 100644 --- a/lib/dns/dst_openssl.h +++ b/lib/dns/dst_openssl.h @@ -22,8 +22,10 @@ #include #include -#if !defined(OPENSSL_NO_ENGINE) && defined(CRYPTO_LOCK_ENGINE) && \ - (OPENSSL_VERSION_NUMBER >= 0x0090707f) +#if !defined(OPENSSL_NO_ENGINE) && \ + ((defined(CRYPTO_LOCK_ENGINE) && \ + (OPENSSL_VERSION_NUMBER >= 0x0090707f)) || \ + (OPENSSL_VERSION_NUMBER >= 0x10100000L)) #define USE_ENGINE 1 #endif @@ -41,6 +43,15 @@ #define BN_GENCB_get_arg(x) ((x)->arg) #endif +#if OPENSSL_VERSION_NUMBER >= 0x10100000L +/* + * EVP_dss1() is a version of EVP_sha1() that was needed prior to + * 1.1.0 because there was a link between digests and signing algorithms; + * the link has been eliminated and EVP_sha1() can be used now instead. + */ +#define EVP_dss1 EVP_sha1 +#endif + ISC_LANG_BEGINDECLS isc_result_t diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c index 2e8bcf6..58df04d 100644 --- a/lib/dns/openssl_link.c +++ b/lib/dns/openssl_link.c @@ -102,6 +102,7 @@ entropy_add(const void *buf, int num, double entropy) { } #endif +#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) static void lock_callback(int mode, int type, const char *file, int line) { UNUSED(file); @@ -112,45 +113,59 @@ lock_callback(int mode, int type, const char *file, int line) { UNLOCK(&locks[type]); } -#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) static unsigned long id_callback(void) { return ((unsigned long)isc_thread_self()); } #endif +#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) +#define FLARG_PASS , __FILE__, __LINE__ +#define FLARG +#define FILELINE +#else +#define FLARG , const char *file, int line +#define FILELINE , __FILE__, __LINE__ +#if ISC_MEM_TRACKLINES +#define FLARG_PASS , file, line +#else +#define FLARG_PASS +#endif + +#endif + static void * -mem_alloc(size_t size) { +mem_alloc(size_t size FLARG) { #ifdef OPENSSL_LEAKS void *ptr; INSIST(dst__memory_pool != NULL); - ptr = isc_mem_allocate(dst__memory_pool, size); + ptr = isc__mem_allocate(dst__memory_pool, size FLARG_PASS); return (ptr); #else INSIST(dst__memory_pool != NULL); - return (isc_mem_allocate(dst__memory_pool, size)); + return (isc__mem_allocate(dst__memory_pool, size FLARG_PASS)); #endif } static void -mem_free(void *ptr) { +mem_free(void *ptr FLARG) { INSIST(dst__memory_pool != NULL); if (ptr != NULL) - isc_mem_free(dst__memory_pool, ptr); + isc__mem_free(dst__memory_pool, ptr FLARG_PASS); } static void * -mem_realloc(void *ptr, size_t size) { +mem_realloc(void *ptr, size_t size FLARG) { #ifdef OPENSSL_LEAKS void *rptr; INSIST(dst__memory_pool != NULL); - rptr = isc_mem_reallocate(dst__memory_pool, ptr, size); + rptr = isc__mem_reallocate(dst__memory_pool, ptr, size FLARG_PASS); return (rptr); #else INSIST(dst__memory_pool != NULL); - return (isc_mem_reallocate(dst__memory_pool, ptr, size)); + return (isc__mem_reallocate(dst__memory_pool, ptr, size FLARG_PASS)); #endif } @@ -171,20 +186,20 @@ dst__openssl_init(const char *engine) { #endif CRYPTO_set_mem_functions(mem_alloc, mem_realloc, mem_free); nlocks = CRYPTO_num_locks(); - locks = mem_alloc(sizeof(isc_mutex_t) * nlocks); + locks = mem_alloc(sizeof(isc_mutex_t) * nlocks FILELINE); if (locks == NULL) return (ISC_R_NOMEMORY); result = isc_mutexblock_init(locks, nlocks); if (result != ISC_R_SUCCESS) goto cleanup_mutexalloc; - CRYPTO_set_locking_callback(lock_callback); #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) + CRYPTO_set_locking_callback(lock_callback); CRYPTO_set_id_callback(id_callback); #endif ERR_load_crypto_strings(); - rm = mem_alloc(sizeof(RAND_METHOD)); + rm = mem_alloc(sizeof(RAND_METHOD) FILELINE); if (rm == NULL) { result = ISC_R_NOMEMORY; goto cleanup_mutexinit; @@ -250,20 +265,27 @@ dst__openssl_init(const char *engine) { if (e != NULL) ENGINE_free(e); e = NULL; - mem_free(rm); + mem_free(rm FILELINE); rm = NULL; #endif cleanup_mutexinit: CRYPTO_set_locking_callback(NULL); DESTROYMUTEXBLOCK(locks, nlocks); cleanup_mutexalloc: - mem_free(locks); + mem_free(locks FILELINE); locks = NULL; return (result); } void dst__openssl_destroy(void) { +#if OPENSSL_VERSION_NUMBER >= 0x10100000L + OPENSSL_cleanup(); + if (rm != NULL) { + mem_free(rm FILELINE); + rm = NULL; + } +#else /* * Sequence taken from apps_shutdown() in . */ @@ -271,7 +293,7 @@ dst__openssl_destroy(void) { #if OPENSSL_VERSION_NUMBER >= 0x00907000L RAND_cleanup(); #endif - mem_free(rm); + mem_free(rm FILELINE); rm = NULL; } #if (OPENSSL_VERSION_NUMBER >= 0x00907000L) @@ -303,16 +325,18 @@ dst__openssl_destroy(void) { if (locks != NULL) { CRYPTO_set_locking_callback(NULL); DESTROYMUTEXBLOCK(locks, nlocks); - mem_free(locks); + mem_free(locks FILELINE); locks = NULL; } +#endif } static isc_result_t toresult(isc_result_t fallback) { isc_result_t result = fallback; unsigned long err = ERR_get_error(); -#ifdef HAVE_OPENSSL_ECDSA +#if defined(HAVE_OPENSSL_ECDSA) && \ + defined(ECDSA_R_RANDOM_NUMBER_GENERATION_FAILED) int lib = ERR_GET_LIB(err); #endif int reason = ERR_GET_REASON(err); @@ -326,7 +350,8 @@ toresult(isc_result_t fallback) { result = ISC_R_NOMEMORY; break; default: -#ifdef HAVE_OPENSSL_ECDSA +#if defined(HAVE_OPENSSL_ECDSA) && \ + defined(ECDSA_R_RANDOM_NUMBER_GENERATION_FAILED) if (lib == ERR_R_ECDSA_LIB && reason == ECDSA_R_RANDOM_NUMBER_GENERATION_FAILED) { result = ISC_R_NOENTROPY; diff --git a/lib/dns/openssldh_link.c b/lib/dns/openssldh_link.c index 4237ad0..dec5b3c 100644 --- a/lib/dns/openssldh_link.c +++ b/lib/dns/openssldh_link.c @@ -68,11 +68,74 @@ static isc_result_t openssldh_todns(const dst_key_t *key, isc_buffer_t *data); static BIGNUM *bn2, *bn768, *bn1024, *bn1536; +#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) +/* + * DH_get0_key, DH_set0_key, DH_get0_pqg and DH_set0_pqg + * are from OpenSSL 1.1.0. + */ +static void +DH_get0_key(const DH *dh, const BIGNUM **pub_key, const BIGNUM **priv_key) { + if (pub_key != NULL) + *pub_key = dh->pub_key; + if (priv_key != NULL) + *priv_key = dh->priv_key; +} + +static int +DH_set0_key(DH *dh, BIGNUM *pub_key, BIGNUM *priv_key) { + /* Note that it is valid for priv_key to be NULL */ + if (pub_key == NULL) + return 0; + + BN_free(dh->pub_key); + BN_free(dh->priv_key); + dh->pub_key = pub_key; + dh->priv_key = priv_key; + + return 1; +} + +static void +DH_get0_pqg(const DH *dh, + const BIGNUM **p, const BIGNUM **q, const BIGNUM **g) +{ + if (p != NULL) + *p = dh->p; + if (q != NULL) + *q = dh->q; + if (g != NULL) + *g = dh->g; +} + +static int +DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g) { + /* q is optional */ + if (p == NULL || g == NULL) + return(0); + BN_free(dh->p); + BN_free(dh->q); + BN_free(dh->g); + dh->p = p; + dh->q = q; + dh->g = g; + + if (q != NULL) { + dh->length = BN_num_bits(q); + } + + return(1); +} + +#define DH_clear_flags(d, f) (d)->flags &= ~(f) + +#endif + static isc_result_t openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv, isc_buffer_t *secret) { DH *dhpub, *dhpriv; + const BIGNUM *pub_key = NULL; int ret; isc_region_t r; unsigned int len; @@ -87,7 +150,9 @@ openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv, isc_buffer_availableregion(secret, &r); if (r.length < len) return (ISC_R_NOSPACE); - ret = DH_compute_key(r.base, dhpub->pub_key, dhpriv); + + DH_get0_key(dhpub, &pub_key, NULL); + ret = DH_compute_key(r.base, pub_key, dhpriv); if (ret <= 0) return (dst__openssl_toresult2("DH_compute_key", DST_R_COMPUTESECRETFAILURE)); @@ -97,8 +162,10 @@ openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv, static isc_boolean_t openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) { - int status; DH *dh1, *dh2; + const BIGNUM *pub_key1 = NULL, *pub_key2 = NULL; + const BIGNUM *priv_key1 = NULL, *priv_key2 = NULL; + const BIGNUM *p1 = NULL, *g1 = NULL, *p2 = NULL, *g2 = NULL; dh1 = key1->keydata.dh; dh2 = key2->keydata.dh; @@ -108,17 +175,19 @@ openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) { else if (dh1 == NULL || dh2 == NULL) return (ISC_FALSE); - status = BN_cmp(dh1->p, dh2->p) || - BN_cmp(dh1->g, dh2->g) || - BN_cmp(dh1->pub_key, dh2->pub_key); + DH_get0_key(dh1, &pub_key1, &priv_key1); + DH_get0_key(dh2, &pub_key2, &priv_key2); + DH_get0_pqg(dh1, &p1, NULL, &g1); + DH_get0_pqg(dh2, &p2, NULL, &g2); - if (status != 0) + if (BN_cmp(p1, p2) != 0 || BN_cmp(g1, g2) != 0 || + BN_cmp(pub_key1, pub_key2) != 0) return (ISC_FALSE); - if (dh1->priv_key != NULL || dh2->priv_key != NULL) { - if (dh1->priv_key == NULL || dh2->priv_key == NULL) + if (priv_key1 != NULL || priv_key2 != NULL) { + if (priv_key1 == NULL || priv_key2 == NULL) return (ISC_FALSE); - if (BN_cmp(dh1->priv_key, dh2->priv_key) != 0) + if (BN_cmp(priv_key1, priv_key2) != 0) return (ISC_FALSE); } return (ISC_TRUE); @@ -126,8 +195,8 @@ openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) { static isc_boolean_t openssldh_paramcompare(const dst_key_t *key1, const dst_key_t *key2) { - int status; DH *dh1, *dh2; + const BIGNUM *p1 = NULL, *g1 = NULL, *p2 = NULL, *g2 = NULL; dh1 = key1->keydata.dh; dh2 = key2->keydata.dh; @@ -137,10 +206,10 @@ openssldh_paramcompare(const dst_key_t *key1, const dst_key_t *key2) { else if (dh1 == NULL || dh2 == NULL) return (ISC_FALSE); - status = BN_cmp(dh1->p, dh2->p) || - BN_cmp(dh1->g, dh2->g); + DH_get0_pqg(dh1, &p1, NULL, &g1); + DH_get0_pqg(dh2, &p2, NULL, &g2); - if (status != 0) + if (BN_cmp(p1, p2) != 0 || BN_cmp(g1, g2) != 0) return (ISC_FALSE); return (ISC_TRUE); } @@ -185,16 +254,25 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) { key->key_size == 1024 || key->key_size == 1536) { + BIGNUM *p, *g; dh = DH_new(); - if (dh == NULL) - return (dst__openssl_toresult(ISC_R_NOMEMORY)); if (key->key_size == 768) - dh->p = bn768; + p = BN_dup(bn768); else if (key->key_size == 1024) - dh->p = bn1024; + p = BN_dup(bn1024); else - dh->p = bn1536; - dh->g = bn2; + p = BN_dup(bn1536); + g = BN_dup(bn2); + if (dh == NULL || p == NULL || g == NULL) { + if (dh != NULL) + DH_free(dh); + if (p != NULL) + BN_free(p); + if (g != NULL) + BN_free(g); + return (dst__openssl_toresult(ISC_R_NOMEMORY)); + } + DH_set0_pqg(dh, p, NULL, g); } else generator = 2; } @@ -242,8 +320,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) { return (dst__openssl_toresult2("DH_generate_key", DST_R_OPENSSLFAILURE)); } - dh->flags &= ~DH_FLAG_CACHE_MONT_P; - + DH_clear_flags(dh, DH_FLAG_CACHE_MONT_P); key->keydata.dh = dh; return (ISC_R_SUCCESS); @@ -252,7 +329,10 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) { static isc_boolean_t openssldh_isprivate(const dst_key_t *key) { DH *dh = key->keydata.dh; - return (ISC_TF(dh != NULL && dh->priv_key != NULL)); + const BIGNUM *priv_key = NULL; + + DH_get0_key(dh, NULL, &priv_key); + return (ISC_TF(dh != NULL && priv_key != NULL)); } static void @@ -262,10 +342,6 @@ openssldh_destroy(dst_key_t *key) { if (dh == NULL) return; - if (dh->p == bn768 || dh->p == bn1024 || dh->p == bn1536) - dh->p = NULL; - if (dh->g == bn2) - dh->g = NULL; DH_free(dh); key->keydata.dh = NULL; } @@ -294,6 +370,7 @@ uint16_fromregion(isc_region_t *region) { static isc_result_t openssldh_todns(const dst_key_t *key, isc_buffer_t *data) { DH *dh; + const BIGNUM *pub_key = NULL, *p = NULL, *g = NULL; isc_region_t r; isc_uint16_t dnslen, plen, glen, publen; @@ -303,40 +380,43 @@ openssldh_todns(const dst_key_t *key, isc_buffer_t *data) { isc_buffer_availableregion(data, &r); - if (dh->g == bn2 && - (dh->p == bn768 || dh->p == bn1024 || dh->p == bn1536)) { + DH_get0_pqg(dh, &p, NULL, &g); + if (BN_cmp(g, bn2) == 0 && + (BN_cmp(p, bn768) == 0 || + BN_cmp(p, bn1024) == 0 || + BN_cmp(p, bn1536) == 0)) { plen = 1; glen = 0; } else { - plen = BN_num_bytes(dh->p); - glen = BN_num_bytes(dh->g); + plen = BN_num_bytes(p); + glen = BN_num_bytes(g); } - publen = BN_num_bytes(dh->pub_key); + DH_get0_key(dh, &pub_key, NULL); + publen = BN_num_bytes(pub_key); dnslen = plen + glen + publen + 6; if (r.length < (unsigned int) dnslen) return (ISC_R_NOSPACE); uint16_toregion(plen, &r); if (plen == 1) { - if (dh->p == bn768) + if (BN_cmp(p, bn768) == 0) *r.base = 1; - else if (dh->p == bn1024) + else if (BN_cmp(p, bn1024) == 0) *r.base = 2; else *r.base = 3; - } - else - BN_bn2bin(dh->p, r.base); + } else + BN_bn2bin(p, r.base); isc_region_consume(&r, plen); uint16_toregion(glen, &r); if (glen > 0) - BN_bn2bin(dh->g, r.base); + BN_bn2bin(g, r.base); isc_region_consume(&r, glen); uint16_toregion(publen, &r); - BN_bn2bin(dh->pub_key, r.base); + BN_bn2bin(pub_key, r.base); isc_region_consume(&r, publen); isc_buffer_add(data, dnslen); @@ -347,6 +427,7 @@ openssldh_todns(const dst_key_t *key, isc_buffer_t *data) { static isc_result_t openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) { DH *dh; + BIGNUM *pub_key = NULL, *p = NULL, *g = NULL; isc_region_t r; isc_uint16_t plen, glen, publen; int special = 0; @@ -358,7 +439,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) { dh = DH_new(); if (dh == NULL) return (dst__openssl_toresult(ISC_R_NOMEMORY)); - dh->flags &= ~DH_FLAG_CACHE_MONT_P; + DH_clear_flags(dh, DH_FLAG_CACHE_MONT_P); /* * Read the prime length. 1 & 2 are table entries, > 16 means a @@ -386,20 +467,20 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) { } switch (special) { case 1: - dh->p = bn768; + p = BN_dup(bn768); break; case 2: - dh->p = bn1024; + p = BN_dup(bn1024); break; case 3: - dh->p = bn1536; + p = BN_dup(bn1536); break; default: DH_free(dh); return (DST_R_INVALIDPUBLICKEY); } } else { - dh->p = BN_bin2bn(r.base, plen, NULL); + p = BN_bin2bn(r.base, plen, NULL); isc_region_consume(&r, plen); } @@ -419,15 +500,12 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) { } if (special != 0) { if (glen == 0) - dh->g = bn2; + g = BN_dup(bn2); else { - dh->g = BN_bin2bn(r.base, glen, NULL); - if (BN_cmp(dh->g, bn2) == 0) { - BN_free(dh->g); - dh->g = bn2; - } - else { + g = BN_bin2bn(r.base, glen, NULL); + if (g != NULL && BN_cmp(g, bn2) != 0) { DH_free(dh); + BN_free(g); return (DST_R_INVALIDPUBLICKEY); } } @@ -436,10 +514,20 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) { DH_free(dh); return (DST_R_INVALIDPUBLICKEY); } - dh->g = BN_bin2bn(r.base, glen, NULL); + g = BN_bin2bn(r.base, glen, NULL); } isc_region_consume(&r, glen); + if (p == NULL || g == NULL) { + DH_free(dh); + if (p != NULL) + BN_free(p); + if (g != NULL) + BN_free(g); + return (dst__openssl_toresult(ISC_R_NOMEMORY)); + } + DH_set0_pqg(dh, p, NULL, g); + if (r.length < 2) { DH_free(dh); return (DST_R_INVALIDPUBLICKEY); @@ -449,10 +537,15 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) { DH_free(dh); return (DST_R_INVALIDPUBLICKEY); } - dh->pub_key = BN_bin2bn(r.base, publen, NULL); + pub_key = BN_bin2bn(r.base, publen, NULL); + if (pub_key == NULL) { + DH_free(dh); + return (dst__openssl_toresult(ISC_R_NOMEMORY)); + } + DH_set0_key(dh, pub_key, NULL); isc_region_consume(&r, publen); - key->key_size = BN_num_bits(dh->p); + key->key_size = BN_num_bits(p); isc_buffer_forward(data, plen + glen + publen + 6); @@ -465,6 +558,7 @@ static isc_result_t openssldh_tofile(const dst_key_t *key, const char *directory) { int i; DH *dh; + const BIGNUM *pub_key = NULL, *priv_key = NULL, *p = NULL, *g = NULL; dst_private_t priv; unsigned char *bufs[4]; isc_result_t result; @@ -476,10 +570,12 @@ openssldh_tofile(const dst_key_t *key, const char *directory) { return (DST_R_EXTERNALKEY); dh = key->keydata.dh; + DH_get0_key(dh, &pub_key, &priv_key); + DH_get0_pqg(dh, &p, NULL, &g); memset(bufs, 0, sizeof(bufs)); for (i = 0; i < 4; i++) { - bufs[i] = isc_mem_get(key->mctx, BN_num_bytes(dh->p)); + bufs[i] = isc_mem_get(key->mctx, BN_num_bytes(p)); if (bufs[i] == NULL) { result = ISC_R_NOMEMORY; goto fail; @@ -489,26 +585,26 @@ openssldh_tofile(const dst_key_t *key, const char *directory) { i = 0; priv.elements[i].tag = TAG_DH_PRIME; - priv.elements[i].length = BN_num_bytes(dh->p); - BN_bn2bin(dh->p, bufs[i]); + priv.elements[i].length = BN_num_bytes(p); + BN_bn2bin(p, bufs[i]); priv.elements[i].data = bufs[i]; i++; priv.elements[i].tag = TAG_DH_GENERATOR; - priv.elements[i].length = BN_num_bytes(dh->g); - BN_bn2bin(dh->g, bufs[i]); + priv.elements[i].length = BN_num_bytes(g); + BN_bn2bin(g, bufs[i]); priv.elements[i].data = bufs[i]; i++; priv.elements[i].tag = TAG_DH_PRIVATE; - priv.elements[i].length = BN_num_bytes(dh->priv_key); - BN_bn2bin(dh->priv_key, bufs[i]); + priv.elements[i].length = BN_num_bytes(priv_key); + BN_bn2bin(priv_key, bufs[i]); priv.elements[i].data = bufs[i]; i++; priv.elements[i].tag = TAG_DH_PUBLIC; - priv.elements[i].length = BN_num_bytes(dh->pub_key); - BN_bn2bin(dh->pub_key, bufs[i]); + priv.elements[i].length = BN_num_bytes(pub_key); + BN_bn2bin(pub_key, bufs[i]); priv.elements[i].data = bufs[i]; i++; @@ -518,7 +614,7 @@ openssldh_tofile(const dst_key_t *key, const char *directory) { for (i = 0; i < 4; i++) { if (bufs[i] == NULL) break; - isc_mem_put(key->mctx, bufs[i], BN_num_bytes(dh->p)); + isc_mem_put(key->mctx, bufs[i], BN_num_bytes(p)); } return (result); } @@ -529,6 +625,7 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { isc_result_t ret; int i; DH *dh = NULL; + BIGNUM *pub_key = NULL, *priv_key = NULL, *p = NULL, *g = NULL; isc_mem_t *mctx; #define DST_RET(a) {ret = a; goto err;} @@ -546,63 +643,47 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { dh = DH_new(); if (dh == NULL) DST_RET(ISC_R_NOMEMORY); - dh->flags &= ~DH_FLAG_CACHE_MONT_P; + DH_clear_flags(dh, DH_FLAG_CACHE_MONT_P); key->keydata.dh = dh; for (i = 0; i < priv.nelements; i++) { BIGNUM *bn; bn = BN_bin2bn(priv.elements[i].data, priv.elements[i].length, NULL); - if (bn == NULL) + if (bn == NULL) DST_RET(ISC_R_NOMEMORY); switch (priv.elements[i].tag) { case TAG_DH_PRIME: - dh->p = bn; + p = bn; break; case TAG_DH_GENERATOR: - dh->g = bn; + g = bn; break; case TAG_DH_PRIVATE: - dh->priv_key = bn; + priv_key = bn; break; case TAG_DH_PUBLIC: - dh->pub_key = bn; + pub_key = bn; break; } } dst__privstruct_free(&priv, mctx); + DH_set0_key(dh, pub_key, priv_key); + DH_set0_pqg(dh, p, NULL, g); - key->key_size = BN_num_bits(dh->p); - - if ((key->key_size == 768 || - key->key_size == 1024 || - key->key_size == 1536) && - BN_cmp(dh->g, bn2) == 0) - { - if (key->key_size == 768 && BN_cmp(dh->p, bn768) == 0) { - BN_free(dh->p); - BN_free(dh->g); - dh->p = bn768; - dh->g = bn2; - } else if (key->key_size == 1024 && - BN_cmp(dh->p, bn1024) == 0) { - BN_free(dh->p); - BN_free(dh->g); - dh->p = bn1024; - dh->g = bn2; - } else if (key->key_size == 1536 && - BN_cmp(dh->p, bn1536) == 0) { - BN_free(dh->p); - BN_free(dh->g); - dh->p = bn1536; - dh->g = bn2; - } - } - + key->key_size = BN_num_bits(p); return (ISC_R_SUCCESS); err: + if (p != NULL) + BN_free(p); + if (g != NULL) + BN_free(g); + if (pub_key != NULL) + BN_free(pub_key); + if (priv_key != NULL) + BN_free(priv_key); openssldh_destroy(key); dst__privstruct_free(&priv, mctx); memset(&priv, 0, sizeof(priv)); diff --git a/lib/dns/openssldsa_link.c b/lib/dns/openssldsa_link.c index 184c163..2b55bc4 100644 --- a/lib/dns/openssldsa_link.c +++ b/lib/dns/openssldsa_link.c @@ -48,6 +48,79 @@ static isc_result_t openssldsa_todns(const dst_key_t *key, isc_buffer_t *data); +#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) +static void +DSA_get0_pqg(const DSA *d, const BIGNUM **p, const BIGNUM **q, + const BIGNUM **g) +{ + if (p != NULL) + *p = d->p; + if (q != NULL) + *q = d->q; + if (g != NULL) + *g = d->g; +} + +static int +DSA_set0_pqg(DSA *d, BIGNUM *p, BIGNUM *q, BIGNUM *g) { + if (p == NULL || q == NULL || g == NULL) + return 0; + BN_free(d->p); + BN_free(d->q); + BN_free(d->g); + d->p = p; + d->q = q; + d->g = g; + + return 1; +} + +static void +DSA_get0_key(const DSA *d, const BIGNUM **pub_key, const BIGNUM **priv_key) { + if (pub_key != NULL) + *pub_key = d->pub_key; + if (priv_key != NULL) + *priv_key = d->priv_key; +} + +static int +DSA_set0_key(DSA *d, BIGNUM *pub_key, BIGNUM *priv_key) { + /* Note that it is valid for priv_key to be NULL */ + if (pub_key == NULL) + return 0; + + BN_free(d->pub_key); + BN_free(d->priv_key); + d->pub_key = pub_key; + d->priv_key = priv_key; + + return 1; +} + +static void +DSA_SIG_get0(const DSA_SIG *sig, const BIGNUM **pr, const BIGNUM **ps) { + *pr = sig->r; + *ps = sig->s; +} + +static int +DSA_SIG_set0(DSA_SIG *sig, BIGNUM *r, BIGNUM *s) { + if (r == NULL || s == NULL) + return 0; + + BN_clear_free(sig->r); + BN_clear_free(sig->s); + sig->r = r; + sig->s = s; + + return 1; +} + + +#define DSA_clear_flags(d, x) (d)->flags &= ~(x) + +#endif + static isc_result_t openssldsa_createctx(dst_key_t *key, dst_context_t *dctx) { #if USE_EVP @@ -118,7 +191,7 @@ openssldsa_adddata(dst_context_t *dctx, const isc_region_t *data) { } static int -BN_bn2bin_fixed(BIGNUM *bn, unsigned char *buf, int size) { +BN_bn2bin_fixed(const BIGNUM *bn, unsigned char *buf, int size) { int bytes = size - BN_num_bytes(bn); while (bytes-- > 0) *buf++ = 0; @@ -130,8 +203,9 @@ static isc_result_t openssldsa_sign(dst_context_t *dctx, isc_buffer_t *sig) { dst_key_t *key = dctx->key; DSA *dsa = key->keydata.dsa; - isc_region_t r; + isc_region_t region; DSA_SIG *dsasig; + const BIGNUM *r = 0, *s = NULL; unsigned int klen; #if USE_EVP EVP_MD_CTX *evp_md_ctx = dctx->ctxdata.evp_md_ctx; @@ -144,8 +218,8 @@ openssldsa_sign(dst_context_t *dctx, isc_buffer_t *sig) { unsigned char digest[ISC_SHA1_DIGESTLENGTH]; #endif - isc_buffer_availableregion(sig, &r); - if (r.length < ISC_SHA1_DIGESTLENGTH * 2 + 1) + isc_buffer_availableregion(sig, ®ion); + if (region.length < ISC_SHA1_DIGESTLENGTH * 2 + 1) return (ISC_R_NOSPACE); #if USE_EVP @@ -210,13 +284,14 @@ openssldsa_sign(dst_context_t *dctx, isc_buffer_t *sig) { klen = (key->key_size - 512)/64; if (klen > 255) return (ISC_R_FAILURE); - *r.base = klen; - isc_region_consume(&r, 1); - - BN_bn2bin_fixed(dsasig->r, r.base, ISC_SHA1_DIGESTLENGTH); - isc_region_consume(&r, ISC_SHA1_DIGESTLENGTH); - BN_bn2bin_fixed(dsasig->s, r.base, ISC_SHA1_DIGESTLENGTH); - isc_region_consume(&r, ISC_SHA1_DIGESTLENGTH); + *region.base = klen; + isc_region_consume(®ion, 1); + + DSA_SIG_get0(dsasig, &r, &s); + BN_bn2bin_fixed(r, region.base, ISC_SHA1_DIGESTLENGTH); + isc_region_consume(®ion, ISC_SHA1_DIGESTLENGTH); + BN_bn2bin_fixed(s, region.base, ISC_SHA1_DIGESTLENGTH); + isc_region_consume(®ion, ISC_SHA1_DIGESTLENGTH); DSA_SIG_free(dsasig); isc_buffer_add(sig, ISC_SHA1_DIGESTLENGTH * 2 + 1); @@ -227,6 +302,7 @@ static isc_result_t openssldsa_verify(dst_context_t *dctx, const isc_region_t *sig) { dst_key_t *key = dctx->key; DSA *dsa = key->keydata.dsa; + BIGNUM *r = NULL, *s = NULL; int status = 0; unsigned char *cp = sig->base; DSA_SIG *dsasig; @@ -262,9 +338,10 @@ openssldsa_verify(dst_context_t *dctx, const isc_region_t *sig) { dsasig = DSA_SIG_new(); if (dsasig == NULL) return (ISC_R_NOMEMORY); - dsasig->r = BN_bin2bn(cp, ISC_SHA1_DIGESTLENGTH, NULL); + r = BN_bin2bn(cp, ISC_SHA1_DIGESTLENGTH, NULL); cp += ISC_SHA1_DIGESTLENGTH; - dsasig->s = BN_bin2bn(cp, ISC_SHA1_DIGESTLENGTH, NULL); + s = BN_bin2bn(cp, ISC_SHA1_DIGESTLENGTH, NULL); + DSA_SIG_set0(dsasig, r, s); #if 0 pkey = EVP_PKEY_new(); @@ -303,8 +380,11 @@ openssldsa_verify(dst_context_t *dctx, const isc_region_t *sig) { static isc_boolean_t openssldsa_compare(const dst_key_t *key1, const dst_key_t *key2) { - int status; DSA *dsa1, *dsa2; + const BIGNUM *pub_key1 = NULL, *priv_key1 = NULL; + const BIGNUM *pub_key2 = NULL, *priv_key2 = NULL; + const BIGNUM *p1 = NULL, *q1 = NULL, *g1 = NULL; + const BIGNUM *p2 = NULL, *q2 = NULL, *g2 = NULL; dsa1 = key1->keydata.dsa; dsa2 = key2->keydata.dsa; @@ -314,18 +394,19 @@ openssldsa_compare(const dst_key_t *key1, const dst_key_t *key2) { else if (dsa1 == NULL || dsa2 == NULL) return (ISC_FALSE); - status = BN_cmp(dsa1->p, dsa2->p) || - BN_cmp(dsa1->q, dsa2->q) || - BN_cmp(dsa1->g, dsa2->g) || - BN_cmp(dsa1->pub_key, dsa2->pub_key); + DSA_get0_key(dsa1, &pub_key1, &priv_key1); + DSA_get0_key(dsa2, &pub_key2, &priv_key2); + DSA_get0_pqg(dsa1, &p1, &q1, &g1); + DSA_get0_pqg(dsa2, &p2, &q2, &g2); - if (status != 0) + if (BN_cmp(p1, p2) != 0 || BN_cmp(q1, q2) != 0 || + BN_cmp(g1, g2) != 0 || BN_cmp(pub_key1, pub_key2) != 0) return (ISC_FALSE); - if (dsa1->priv_key != NULL || dsa2->priv_key != NULL) { - if (dsa1->priv_key == NULL || dsa2->priv_key == NULL) + if (priv_key1 != NULL || priv_key2 != NULL) { + if (priv_key1 == NULL || priv_key2 == NULL) return (ISC_FALSE); - if (BN_cmp(dsa1->priv_key, dsa2->priv_key)) + if (BN_cmp(priv_key1, priv_key2)) return (ISC_FALSE); } return (ISC_TRUE); @@ -417,7 +498,8 @@ openssldsa_generate(dst_key_t *key, int unused, void (*callback)(int)) { return (dst__openssl_toresult2("DSA_generate_key", DST_R_OPENSSLFAILURE)); } - dsa->flags &= ~DSA_FLAG_CACHE_MONT_P; + + DSA_clear_flags(dsa, DSA_FLAG_CACHE_MONT_P); key->keydata.dsa = dsa; @@ -427,7 +509,10 @@ openssldsa_generate(dst_key_t *key, int unused, void (*callback)(int)) { static isc_boolean_t openssldsa_isprivate(const dst_key_t *key) { DSA *dsa = key->keydata.dsa; - return (ISC_TF(dsa != NULL && dsa->priv_key != NULL)); + const BIGNUM *priv_key = NULL; + + DSA_get0_key(dsa, NULL, &priv_key); + return (ISC_TF(dsa != NULL && priv_key != NULL)); } static void @@ -441,6 +526,7 @@ openssldsa_destroy(dst_key_t *key) { static isc_result_t openssldsa_todns(const dst_key_t *key, isc_buffer_t *data) { DSA *dsa; + const BIGNUM *pub_key, *p = NULL, *q = NULL, *g = NULL; isc_region_t r; int dnslen; unsigned int t, p_bytes; @@ -451,7 +537,10 @@ openssldsa_todns(const dst_key_t *key, isc_buffer_t *data) { isc_buffer_availableregion(data, &r); - t = (BN_num_bytes(dsa->p) - 64) / 8; + DSA_get0_key(dsa, &pub_key, NULL); + DSA_get0_pqg(dsa, &p, &q, &g); + + t = (BN_num_bytes(p) - 64) / 8; if (t > 8) return (DST_R_INVALIDPUBLICKEY); p_bytes = 64 + 8 * t; @@ -462,13 +551,14 @@ openssldsa_todns(const dst_key_t *key, isc_buffer_t *data) { *r.base = t; isc_region_consume(&r, 1); - BN_bn2bin_fixed(dsa->q, r.base, ISC_SHA1_DIGESTLENGTH); + + BN_bn2bin_fixed(q, r.base, ISC_SHA1_DIGESTLENGTH); isc_region_consume(&r, ISC_SHA1_DIGESTLENGTH); - BN_bn2bin_fixed(dsa->p, r.base, key->key_size/8); + BN_bn2bin_fixed(p, r.base, key->key_size/8); isc_region_consume(&r, p_bytes); - BN_bn2bin_fixed(dsa->g, r.base, key->key_size/8); + BN_bn2bin_fixed(g, r.base, key->key_size/8); isc_region_consume(&r, p_bytes); - BN_bn2bin_fixed(dsa->pub_key, r.base, key->key_size/8); + BN_bn2bin_fixed(pub_key, r.base, key->key_size/8); isc_region_consume(&r, p_bytes); isc_buffer_add(data, dnslen); @@ -479,6 +569,7 @@ openssldsa_todns(const dst_key_t *key, isc_buffer_t *data) { static isc_result_t openssldsa_fromdns(dst_key_t *key, isc_buffer_t *data) { DSA *dsa; + BIGNUM *pub_key, *p, *q, *g; isc_region_t r; unsigned int t, p_bytes; isc_mem_t *mctx = key->mctx; @@ -492,7 +583,7 @@ openssldsa_fromdns(dst_key_t *key, isc_buffer_t *data) { dsa = DSA_new(); if (dsa == NULL) return (ISC_R_NOMEMORY); - dsa->flags &= ~DSA_FLAG_CACHE_MONT_P; + DSA_clear_flags(dsa, DSA_FLAG_CACHE_MONT_P); t = (unsigned int) *r.base; isc_region_consume(&r, 1); @@ -507,18 +598,29 @@ openssldsa_fromdns(dst_key_t *key, isc_buffer_t *data) { return (DST_R_INVALIDPUBLICKEY); } - dsa->q = BN_bin2bn(r.base, ISC_SHA1_DIGESTLENGTH, NULL); + q = BN_bin2bn(r.base, ISC_SHA1_DIGESTLENGTH, NULL); isc_region_consume(&r, ISC_SHA1_DIGESTLENGTH); - dsa->p = BN_bin2bn(r.base, p_bytes, NULL); + p = BN_bin2bn(r.base, p_bytes, NULL); isc_region_consume(&r, p_bytes); - dsa->g = BN_bin2bn(r.base, p_bytes, NULL); + g = BN_bin2bn(r.base, p_bytes, NULL); isc_region_consume(&r, p_bytes); - dsa->pub_key = BN_bin2bn(r.base, p_bytes, NULL); + pub_key = BN_bin2bn(r.base, p_bytes, NULL); isc_region_consume(&r, p_bytes); + if (pub_key == NULL || p == NULL || q == NULL || g == NULL) { + DSA_free(dsa); + if (p != NULL) BN_free(p); + if (q != NULL) BN_free(q); + if (g != NULL) BN_free(g); + return (ISC_R_NOMEMORY); + } + + DSA_set0_key(dsa, pub_key, NULL); + DSA_set0_pqg(dsa, p, q, g); + key->key_size = p_bytes * 8; isc_buffer_forward(data, 1 + ISC_SHA1_DIGESTLENGTH + 3 * p_bytes); @@ -533,6 +635,8 @@ static isc_result_t openssldsa_tofile(const dst_key_t *key, const char *directory) { int cnt = 0; DSA *dsa; + const BIGNUM *pub_key = NULL, *priv_key = NULL; + const BIGNUM *p = NULL, *q = NULL, *g = NULL; dst_private_t priv; unsigned char bufs[5][128]; @@ -546,33 +650,36 @@ openssldsa_tofile(const dst_key_t *key, const char *directory) { dsa = key->keydata.dsa; + DSA_get0_key(dsa, &pub_key, &priv_key); + DSA_get0_pqg(dsa, &p, &q, &g); + priv.elements[cnt].tag = TAG_DSA_PRIME; - priv.elements[cnt].length = BN_num_bytes(dsa->p); - BN_bn2bin(dsa->p, bufs[cnt]); + priv.elements[cnt].length = BN_num_bytes(p); + BN_bn2bin(p, bufs[cnt]); priv.elements[cnt].data = bufs[cnt]; cnt++; priv.elements[cnt].tag = TAG_DSA_SUBPRIME; - priv.elements[cnt].length = BN_num_bytes(dsa->q); - BN_bn2bin(dsa->q, bufs[cnt]); + priv.elements[cnt].length = BN_num_bytes(q); + BN_bn2bin(q, bufs[cnt]); priv.elements[cnt].data = bufs[cnt]; cnt++; priv.elements[cnt].tag = TAG_DSA_BASE; - priv.elements[cnt].length = BN_num_bytes(dsa->g); - BN_bn2bin(dsa->g, bufs[cnt]); + priv.elements[cnt].length = BN_num_bytes(g); + BN_bn2bin(g, bufs[cnt]); priv.elements[cnt].data = bufs[cnt]; cnt++; priv.elements[cnt].tag = TAG_DSA_PRIVATE; - priv.elements[cnt].length = BN_num_bytes(dsa->priv_key); - BN_bn2bin(dsa->priv_key, bufs[cnt]); + priv.elements[cnt].length = BN_num_bytes(priv_key); + BN_bn2bin(priv_key, bufs[cnt]); priv.elements[cnt].data = bufs[cnt]; cnt++; priv.elements[cnt].tag = TAG_DSA_PUBLIC; - priv.elements[cnt].length = BN_num_bytes(dsa->pub_key); - BN_bn2bin(dsa->pub_key, bufs[cnt]); + priv.elements[cnt].length = BN_num_bytes(pub_key); + BN_bn2bin(pub_key, bufs[cnt]); priv.elements[cnt].data = bufs[cnt]; cnt++; @@ -586,6 +693,8 @@ openssldsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { isc_result_t ret; int i; DSA *dsa = NULL; + BIGNUM *pub_key = NULL, *priv_key = NULL; + BIGNUM *p = NULL, *q = NULL, *g = NULL; isc_mem_t *mctx = key->mctx; #define DST_RET(a) {ret = a; goto err;} @@ -610,7 +719,7 @@ openssldsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { dsa = DSA_new(); if (dsa == NULL) DST_RET(ISC_R_NOMEMORY); - dsa->flags &= ~DSA_FLAG_CACHE_MONT_P; + DSA_clear_flags(dsa, DSA_FLAG_CACHE_MONT_P); key->keydata.dsa = dsa; for (i = 0; i < priv.nelements; i++) { @@ -622,28 +731,36 @@ openssldsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { switch (priv.elements[i].tag) { case TAG_DSA_PRIME: - dsa->p = bn; + p = bn; break; case TAG_DSA_SUBPRIME: - dsa->q = bn; + q = bn; break; case TAG_DSA_BASE: - dsa->g = bn; + g = bn; break; case TAG_DSA_PRIVATE: - dsa->priv_key = bn; + priv_key = bn; break; case TAG_DSA_PUBLIC: - dsa->pub_key = bn; + pub_key = bn; break; } } dst__privstruct_free(&priv, mctx); memset(&priv, 0, sizeof(priv)); - key->key_size = BN_num_bits(dsa->p); + DSA_set0_key(dsa, pub_key, priv_key); + DSA_set0_pqg(dsa, p, q, g); + key->key_size = BN_num_bits(p); return (ISC_R_SUCCESS); err: + if (p != NULL) + BN_free(p); + if (q != NULL) + BN_free(q); + if (g != NULL) + BN_free(g); openssldsa_destroy(key); dst__privstruct_free(&priv, mctx); memset(&priv, 0, sizeof(priv)); diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c index a967736..76d5a9d 100644 --- a/lib/dns/opensslecdsa_link.c +++ b/lib/dns/opensslecdsa_link.c @@ -41,6 +41,30 @@ #define DST_RET(a) {ret = a; goto err;} +#if OPENSSL_VERSION_NUMBER < 0x10100000L +/* From OpenSSL 1.1 */ +static void +ECDSA_SIG_get0(const ECDSA_SIG *sig, const BIGNUM **pr, const BIGNUM **ps) { + if (pr != NULL) + *pr = sig->r; + if (ps != NULL) + *ps = sig->s; +} + +static int +ECDSA_SIG_set0(ECDSA_SIG *sig, BIGNUM *r, BIGNUM *s) { + if (r == NULL || s == NULL) + return 0; + + BN_clear_free(sig->r); + BN_clear_free(sig->s); + sig->r = r; + sig->s = s; + + return 1; +} +#endif + static isc_result_t opensslecdsa_todns(const dst_key_t *key, isc_buffer_t *data); @@ -102,7 +126,7 @@ opensslecdsa_adddata(dst_context_t *dctx, const isc_region_t *data) { } static int -BN_bn2bin_fixed(BIGNUM *bn, unsigned char *buf, int size) { +BN_bn2bin_fixed(const BIGNUM *bn, unsigned char *buf, int size) { int bytes = size - BN_num_bytes(bn); while (bytes-- > 0) @@ -115,13 +139,14 @@ static isc_result_t opensslecdsa_sign(dst_context_t *dctx, isc_buffer_t *sig) { isc_result_t ret; dst_key_t *key = dctx->key; - isc_region_t r; + isc_region_t region; ECDSA_SIG *ecdsasig; EVP_MD_CTX *evp_md_ctx = dctx->ctxdata.evp_md_ctx; EVP_PKEY *pkey = key->keydata.pkey; EC_KEY *eckey = EVP_PKEY_get1_EC_KEY(pkey); unsigned int dgstlen, siglen; unsigned char digest[EVP_MAX_MD_SIZE]; + const BIGNUM *r, *s; REQUIRE(key->key_alg == DST_ALG_ECDSA256 || key->key_alg == DST_ALG_ECDSA384); @@ -134,8 +159,8 @@ opensslecdsa_sign(dst_context_t *dctx, isc_buffer_t *sig) { else siglen = DNS_SIG_ECDSA384SIZE; - isc_buffer_availableregion(sig, &r); - if (r.length < siglen) + isc_buffer_availableregion(sig, ®ion); + if (region.length < siglen) DST_RET(ISC_R_NOSPACE); if (!EVP_DigestFinal(evp_md_ctx, digest, &dgstlen)) @@ -148,10 +173,11 @@ opensslecdsa_sign(dst_context_t *dctx, isc_buffer_t *sig) { DST_RET(dst__openssl_toresult3(dctx->category, "ECDSA_do_sign", DST_R_SIGNFAILURE)); - BN_bn2bin_fixed(ecdsasig->r, r.base, siglen / 2); - isc_region_consume(&r, siglen / 2); - BN_bn2bin_fixed(ecdsasig->s, r.base, siglen / 2); - isc_region_consume(&r, siglen / 2); + ECDSA_SIG_get0(ecdsasig, &r, &s); + BN_bn2bin_fixed(r, region.base, siglen / 2); + isc_region_consume(®ion, siglen / 2); + BN_bn2bin_fixed(s, region.base, siglen / 2); + isc_region_consume(®ion, siglen / 2); ECDSA_SIG_free(ecdsasig); isc_buffer_add(sig, siglen); ret = ISC_R_SUCCESS; @@ -174,6 +200,7 @@ opensslecdsa_verify(dst_context_t *dctx, const isc_region_t *sig) { EC_KEY *eckey = EVP_PKEY_get1_EC_KEY(pkey); unsigned int dgstlen, siglen; unsigned char digest[EVP_MAX_MD_SIZE]; + BIGNUM *r = NULL, *s = NULL ; REQUIRE(key->key_alg == DST_ALG_ECDSA256 || key->key_alg == DST_ALG_ECDSA384); @@ -197,13 +224,10 @@ opensslecdsa_verify(dst_context_t *dctx, const isc_region_t *sig) { ecdsasig = ECDSA_SIG_new(); if (ecdsasig == NULL) DST_RET (ISC_R_NOMEMORY); - if (ecdsasig->r != NULL) - BN_free(ecdsasig->r); - ecdsasig->r = BN_bin2bn(cp, siglen / 2, NULL); + r = BN_bin2bn(cp, siglen / 2, NULL); cp += siglen / 2; - if (ecdsasig->s != NULL) - BN_free(ecdsasig->s); - ecdsasig->s = BN_bin2bn(cp, siglen / 2, NULL); + s = BN_bin2bn(cp, siglen / 2, NULL); + ECDSA_SIG_set0(ecdsasig, r, s); /* cp += siglen / 2; */ status = ECDSA_do_verify(digest, dgstlen, ecdsasig, eckey); diff --git a/lib/dns/opensslgost_link.c b/lib/dns/opensslgost_link.c index 6b04f7b..62d7238 100644 --- a/lib/dns/opensslgost_link.c +++ b/lib/dns/opensslgost_link.c @@ -28,6 +28,11 @@ #include #include +#if OPENSSL_VERSION_NUMBER < 0x10100000L +#define EVP_MD_CTX_new() &(ctx->_ctx), EVP_MD_CTX_init(&(ctx->_ctx)) +#define EVP_MD_CTX_free(ptr) EVP_MD_CTX_cleanup(ptr) +#endif + static ENGINE *e = NULL; static const EVP_MD *opensslgost_digest; extern const EVP_MD *EVP_gost(void); @@ -48,8 +53,10 @@ isc_gost_init(isc_gost_t *ctx) { md = EVP_gost(); if (md == NULL) return (DST_R_CRYPTOFAILURE); - EVP_MD_CTX_init(ctx); - ret = EVP_DigestInit(ctx, md); + ctx->ctx = EVP_MD_CTX_new(); + if (ctx->ctx == NULL) + return (ISC_R_NOMEMORY); + ret = EVP_DigestInit(ctx->ctx, md); if (ret != 1) return (DST_R_CRYPTOFAILURE); return (ISC_R_SUCCESS); @@ -57,7 +64,8 @@ isc_gost_init(isc_gost_t *ctx) { void isc_gost_invalidate(isc_gost_t *ctx) { - EVP_MD_CTX_cleanup(ctx); + EVP_MD_CTX_free(ctx->ctx); + ctx->ctx = NULL; } isc_result_t @@ -67,9 +75,10 @@ isc_gost_update(isc_gost_t *ctx, const unsigned char *data, int ret; INSIST(ctx != NULL); + INSIST(ctx->ctx != NULL); INSIST(data != NULL); - ret = EVP_DigestUpdate(ctx, (const void *) data, (size_t) len); + ret = EVP_DigestUpdate(ctx->ctx, (const void *) data, (size_t) len); if (ret != 1) return (DST_R_CRYPTOFAILURE); return (ISC_R_SUCCESS); @@ -80,9 +89,12 @@ isc_gost_final(isc_gost_t *ctx, unsigned char *digest) { int ret; INSIST(ctx != NULL); + INSIST(ctx->ctx != NULL); INSIST(digest != NULL); - ret = EVP_DigestFinal(ctx, digest, NULL); + ret = EVP_DigestFinal(ctx->ctx, digest, NULL); + EVP_MD_CTX_free(ctx->ctx); + ctx->ctx = NULL; if (ret != 1) return (DST_R_CRYPTOFAILURE); return (ISC_R_SUCCESS); diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c index b5ad913..89b4975 100644 --- a/lib/dns/opensslrsa_link.c +++ b/lib/dns/opensslrsa_link.c @@ -99,7 +99,8 @@ (rsa)->flags &= ~(RSA_FLAG_CACHE_PUBLIC | RSA_FLAG_CACHE_PRIVATE); \ (rsa)->flags &= ~RSA_FLAG_BLINDING; \ } while (0) -#elif defined(RSA_FLAG_NO_BLINDING) +#elif OPENSSL_VERSION_NUMBER < 0x10100000L +#if defined(RSA_FLAG_NO_BLINDING) #define SET_FLAGS(rsa) \ do { \ (rsa)->flags &= ~RSA_FLAG_BLINDING; \ @@ -111,9 +112,132 @@ (rsa)->flags &= ~RSA_FLAG_BLINDING; \ } while (0) #endif - +#else +#define SET_FLAGS(rsa) \ + do { \ + RSA_clear_flags(rsa, RSA_FLAG_BLINDING); \ + RSA_set_flags(rsa, RSA_FLAG_NO_BLINDING); \ + } while (0) +#endif #define DST_RET(a) {ret = a; goto err;} +#if OPENSSL_VERSION_NUMBER < 0x10100000L +/* From OpenSSL 1.1.0 */ +static int +RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d) { + + /* + * If the fields n and e in r are NULL, the corresponding input + * parameters MUST be non-NULL for n and e. d may be + * left NULL (in case only the public key is used). + */ + if ((r->n == NULL && n == NULL) || (r->e == NULL && e == NULL)) + return 0; + + if (n != NULL) { + BN_free(r->n); + r->n = n; + } + if (e != NULL) { + BN_free(r->e); + r->e = e; + } + if (d != NULL) { + BN_free(r->d); + r->d = d; + } + + return 1; +} + +static int +RSA_set0_factors(RSA *r, BIGNUM *p, BIGNUM *q) { + + /* + * If the fields p and q in r are NULL, the corresponding input + * parameters MUST be non-NULL. + */ + if ((r->p == NULL && p == NULL) || (r->q == NULL && q == NULL)) + return 0; + + if (p != NULL) { + BN_free(r->p); + r->p = p; + } + if (q != NULL) { + BN_free(r->q); + r->q = q; + } + + return 1; +} + +static int +RSA_set0_crt_params(RSA *r, BIGNUM *dmp1, BIGNUM *dmq1, BIGNUM *iqmp) { + /* + * If the fields dmp1, dmq1 and iqmp in r are NULL, the + * corresponding input parameters MUST be non-NULL. + */ + if ((r->dmp1 == NULL && dmp1 == NULL) || + (r->dmq1 == NULL && dmq1 == NULL) || + (r->iqmp == NULL && iqmp == NULL)) + return 0; + + if (dmp1 != NULL) { + BN_free(r->dmp1); + r->dmp1 = dmp1; + } + if (dmq1 != NULL) { + BN_free(r->dmq1); + r->dmq1 = dmq1; + } + if (iqmp != NULL) { + BN_free(r->iqmp); + r->iqmp = iqmp; + } + + return 1; +} + +static void +RSA_get0_key(const RSA *r, + const BIGNUM **n, const BIGNUM **e, const BIGNUM **d) +{ + if (n != NULL) + *n = r->n; + if (e != NULL) + *e = r->e; + if (d != NULL) + *d = r->d; +} + +static void +RSA_get0_factors(const RSA *r, const BIGNUM **p, const BIGNUM **q) { + if (p != NULL) + *p = r->p; + if (q != NULL) + *q = r->q; +} + +static void +RSA_get0_crt_params(const RSA *r, const BIGNUM **dmp1, const BIGNUM **dmq1, + const BIGNUM **iqmp) +{ + if (dmp1 != NULL) + *dmp1 = r->dmp1; + if (dmq1 != NULL) + *dmq1 = r->dmq1; + if (iqmp != NULL) + *iqmp = r->iqmp; +} + +static int +RSA_test_flags(const RSA *r, int flags) { + return (r->flags & flags); +} + +#endif + static isc_result_t opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data); static isc_result_t @@ -553,6 +677,7 @@ opensslrsa_verify2(dst_context_t *dctx, int maxbits, const isc_region_t *sig) { EVP_MD_CTX *evp_md_ctx = dctx->ctxdata.evp_md_ctx; EVP_PKEY *pkey = key->keydata.pkey; RSA *rsa; + const BIGNUM *e = NULL; int bits; #else /* note: ISC_SHA512_DIGESTLENGTH >= ISC_*_DIGESTLENGTH */ @@ -583,7 +708,8 @@ opensslrsa_verify2(dst_context_t *dctx, int maxbits, const isc_region_t *sig) { rsa = EVP_PKEY_get1_RSA(pkey); if (rsa == NULL) return (dst__openssl_toresult(DST_R_OPENSSLFAILURE)); - bits = BN_num_bits(rsa->e); + RSA_get0_key(rsa, NULL, &e, NULL); + bits = BN_num_bits(e); RSA_free(rsa); if (bits > maxbits && maxbits != 0) return (DST_R_VERIFYFAILURE); @@ -600,7 +726,8 @@ opensslrsa_verify2(dst_context_t *dctx, int maxbits, const isc_region_t *sig) { DST_R_VERIFYFAILURE)); } #else - if (BN_num_bits(rsa->e) > maxbits && maxbits != 0) + RSA_get0_key(rsa, NULL, &e, NULL); + if (BN_num_bits(e) > maxbits && maxbits != 0) return (DST_R_VERIFYFAILURE); switch (dctx->key->key_alg) { @@ -729,6 +856,11 @@ static isc_boolean_t opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) { int status; RSA *rsa1 = NULL, *rsa2 = NULL; + const BIGNUM *n1 = NULL, *n2 = NULL; + const BIGNUM *e1 = NULL, *e2 = NULL; + const BIGNUM *d1 = NULL, *d2 = NULL; + const BIGNUM *p1 = NULL, *p2 = NULL; + const BIGNUM *q1 = NULL, *q2 = NULL; #if USE_EVP EVP_PKEY *pkey1, *pkey2; #endif @@ -758,17 +890,18 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) { else if (rsa1 == NULL || rsa2 == NULL) return (ISC_FALSE); - status = BN_cmp(rsa1->n, rsa2->n) || - BN_cmp(rsa1->e, rsa2->e); + RSA_get0_key(rsa1, &n1, &e1, &d1); + RSA_get0_key(rsa2, &n2, &e2, &d2); + status = BN_cmp(n1, n2) || BN_cmp(e1, e2); if (status != 0) return (ISC_FALSE); #if USE_EVP - if ((rsa1->flags & RSA_FLAG_EXT_PKEY) != 0 || - (rsa2->flags & RSA_FLAG_EXT_PKEY) != 0) { - if ((rsa1->flags & RSA_FLAG_EXT_PKEY) == 0 || - (rsa2->flags & RSA_FLAG_EXT_PKEY) == 0) + if (RSA_test_flags(rsa1, RSA_FLAG_EXT_PKEY) != 0 || + RSA_test_flags(rsa2, RSA_FLAG_EXT_PKEY) != 0) { + if (RSA_test_flags(rsa1, RSA_FLAG_EXT_PKEY) == 0 || + RSA_test_flags(rsa2, RSA_FLAG_EXT_PKEY) == 0) return (ISC_FALSE); /* * Can't compare private parameters, BTW does it make sense? @@ -777,12 +910,12 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) { } #endif - if (rsa1->d != NULL || rsa2->d != NULL) { - if (rsa1->d == NULL || rsa2->d == NULL) + if (d1 != NULL || d2 != NULL) { + if (d1 == NULL || d2 == NULL) return (ISC_FALSE); - status = BN_cmp(rsa1->d, rsa2->d) || - BN_cmp(rsa1->p, rsa2->p) || - BN_cmp(rsa1->q, rsa2->q); + RSA_get0_factors(rsa1, &p1, &q1); + RSA_get0_factors(rsa2, &p2, &q2); + status = BN_cmp(d1, d2) || BN_cmp(p1, p1) || BN_cmp(q1, q2); if (status != 0) return (ISC_FALSE); @@ -868,7 +1001,7 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) { ret = dst__openssl_toresult2("RSA_generate_key_ex", DST_R_OPENSSLFAILURE); -err: + err: #if USE_EVP if (pkey != NULL) EVP_PKEY_free(pkey); @@ -925,6 +1058,7 @@ err: static isc_boolean_t opensslrsa_isprivate(const dst_key_t *key) { + const BIGNUM *d = NULL; #if USE_EVP RSA *rsa = EVP_PKEY_get1_RSA(key->keydata.pkey); INSIST(rsa != NULL); @@ -933,9 +1067,10 @@ opensslrsa_isprivate(const dst_key_t *key) { #else RSA *rsa = key->keydata.rsa; #endif - if (rsa != NULL && (rsa->flags & RSA_FLAG_EXT_PKEY) != 0) + if (rsa != NULL && RSA_test_flags(rsa, RSA_FLAG_EXT_PKEY) != 0) return (ISC_TRUE); - return (ISC_TF(rsa != NULL && rsa->d != NULL)); + RSA_get0_key(rsa, NULL, NULL, &d); + return (ISC_TF(rsa != NULL && d != NULL)); } static void @@ -951,7 +1086,6 @@ opensslrsa_destroy(dst_key_t *key) { #endif } - static isc_result_t opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data) { isc_region_t r; @@ -962,6 +1096,7 @@ opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data) { #if USE_EVP EVP_PKEY *pkey; #endif + const BIGNUM *e = NULL, *n = NULL; #if USE_EVP REQUIRE(key->keydata.pkey != NULL); @@ -980,8 +1115,9 @@ opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data) { isc_buffer_availableregion(data, &r); - e_bytes = BN_num_bytes(rsa->e); - mod_bytes = BN_num_bytes(rsa->n); + RSA_get0_key(rsa, &n, &e, NULL); + mod_bytes = BN_num_bytes(n); + e_bytes = BN_num_bytes(e); if (e_bytes < 256) { /*%< key exponent is <= 2040 bits */ if (r.length < 1) @@ -999,9 +1135,10 @@ opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data) { if (r.length < e_bytes + mod_bytes) DST_RET(ISC_R_NOSPACE); - BN_bn2bin(rsa->e, r.base); + RSA_get0_key(rsa, &n, &e, NULL); + BN_bn2bin(e, r.base); isc_region_consume(&r, e_bytes); - BN_bn2bin(rsa->n, r.base); + BN_bn2bin(n, r.base); isc_buffer_add(data, e_bytes + mod_bytes); @@ -1023,6 +1160,7 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) { #if USE_EVP EVP_PKEY *pkey; #endif + BIGNUM *e = NULL, *n = NULL; isc_buffer_remainingregion(data, &r); if (r.length == 0) @@ -1056,12 +1194,16 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) { RSA_free(rsa); return (DST_R_INVALIDPUBLICKEY); } - rsa->e = BN_bin2bn(r.base, e_bytes, NULL); + e = BN_bin2bn(r.base, e_bytes, NULL); isc_region_consume(&r, e_bytes); - - rsa->n = BN_bin2bn(r.base, r.length, NULL); - - key->key_size = BN_num_bits(rsa->n); + n = BN_bin2bn(r.base, r.length, NULL); + if (RSA_set0_key(rsa, n, e, NULL) == 0) { + if (n != NULL) BN_free(n); + if (e != NULL) BN_free(e); + RSA_free(rsa); + return (ISC_R_NOMEMORY); + } + key->key_size = BN_num_bits(n); isc_buffer_forward(data, length); @@ -1092,6 +1234,9 @@ opensslrsa_tofile(const dst_key_t *key, const char *directory) { dst_private_t priv; unsigned char *bufs[8]; isc_result_t result; + const BIGNUM *n = NULL, *e = NULL, *d = NULL; + const BIGNUM *p = NULL, *q = NULL; + const BIGNUM *dmp1 = NULL, *dmq1 = NULL, *iqmp = NULL; #if USE_EVP if (key->keydata.pkey == NULL) @@ -1106,6 +1251,10 @@ opensslrsa_tofile(const dst_key_t *key, const char *directory) { #endif memset(bufs, 0, sizeof(bufs)); + RSA_get0_key(rsa, &n, &e, &d); + RSA_get0_factors(rsa, &p, &q); + RSA_get0_crt_params(rsa, &dmp1, &dmq1, &iqmp); + if (key->external) { priv.nelements = 0; result = dst__privstruct_writefile(key, &priv, directory); @@ -1113,7 +1262,7 @@ opensslrsa_tofile(const dst_key_t *key, const char *directory) { } for (i = 0; i < 8; i++) { - bufs[i] = isc_mem_get(key->mctx, BN_num_bytes(rsa->n)); + bufs[i] = isc_mem_get(key->mctx, BN_num_bytes(n)); if (bufs[i] == NULL) { result = ISC_R_NOMEMORY; goto fail; @@ -1123,61 +1272,61 @@ opensslrsa_tofile(const dst_key_t *key, const char *directory) { i = 0; priv.elements[i].tag = TAG_RSA_MODULUS; - priv.elements[i].length = BN_num_bytes(rsa->n); - BN_bn2bin(rsa->n, bufs[i]); + priv.elements[i].length = BN_num_bytes(n); + BN_bn2bin(n, bufs[i]); priv.elements[i].data = bufs[i]; i++; priv.elements[i].tag = TAG_RSA_PUBLICEXPONENT; - priv.elements[i].length = BN_num_bytes(rsa->e); - BN_bn2bin(rsa->e, bufs[i]); + priv.elements[i].length = BN_num_bytes(e); + BN_bn2bin(e, bufs[i]); priv.elements[i].data = bufs[i]; i++; - if (rsa->d != NULL) { + if (d != NULL) { priv.elements[i].tag = TAG_RSA_PRIVATEEXPONENT; - priv.elements[i].length = BN_num_bytes(rsa->d); - BN_bn2bin(rsa->d, bufs[i]); + priv.elements[i].length = BN_num_bytes(d); + BN_bn2bin(d, bufs[i]); priv.elements[i].data = bufs[i]; i++; } - if (rsa->p != NULL) { + if (p != NULL) { priv.elements[i].tag = TAG_RSA_PRIME1; - priv.elements[i].length = BN_num_bytes(rsa->p); - BN_bn2bin(rsa->p, bufs[i]); + priv.elements[i].length = BN_num_bytes(p); + BN_bn2bin(p, bufs[i]); priv.elements[i].data = bufs[i]; i++; } - if (rsa->q != NULL) { + if (q != NULL) { priv.elements[i].tag = TAG_RSA_PRIME2; - priv.elements[i].length = BN_num_bytes(rsa->q); - BN_bn2bin(rsa->q, bufs[i]); + priv.elements[i].length = BN_num_bytes(q); + BN_bn2bin(q, bufs[i]); priv.elements[i].data = bufs[i]; i++; } - if (rsa->dmp1 != NULL) { + if (dmp1 != NULL) { priv.elements[i].tag = TAG_RSA_EXPONENT1; - priv.elements[i].length = BN_num_bytes(rsa->dmp1); - BN_bn2bin(rsa->dmp1, bufs[i]); + priv.elements[i].length = BN_num_bytes(dmp1); + BN_bn2bin(dmp1, bufs[i]); priv.elements[i].data = bufs[i]; i++; } - if (rsa->dmq1 != NULL) { + if (dmq1 != NULL) { priv.elements[i].tag = TAG_RSA_EXPONENT2; - priv.elements[i].length = BN_num_bytes(rsa->dmq1); - BN_bn2bin(rsa->dmq1, bufs[i]); + priv.elements[i].length = BN_num_bytes(dmq1); + BN_bn2bin(dmq1, bufs[i]); priv.elements[i].data = bufs[i]; i++; } - if (rsa->iqmp != NULL) { + if (iqmp != NULL) { priv.elements[i].tag = TAG_RSA_COEFFICIENT; - priv.elements[i].length = BN_num_bytes(rsa->iqmp); - BN_bn2bin(rsa->iqmp, bufs[i]); + priv.elements[i].length = BN_num_bytes(iqmp); + BN_bn2bin(iqmp, bufs[i]); priv.elements[i].data = bufs[i]; i++; } @@ -1208,33 +1357,45 @@ opensslrsa_tofile(const dst_key_t *key, const char *directory) { for (i = 0; i < 8; i++) { if (bufs[i] == NULL) break; - isc_mem_put(key->mctx, bufs[i], BN_num_bytes(rsa->n)); + isc_mem_put(key->mctx, bufs[i], BN_num_bytes(n)); } return (result); } static isc_result_t -rsa_check(RSA *rsa, RSA *pub) -{ - /* Public parameters should be the same but if they are not set - * copy them from the public key. */ +rsa_check(RSA *rsa, RSA *pub) { + const BIGNUM *n1 = NULL, *n2 = NULL; + const BIGNUM *e1 = NULL, *e2 = NULL; + BIGNUM *n = NULL, *e = NULL; + + /* + * Public parameters should be the same but if they are not set + * copy them from the public key. + */ + RSA_get0_key(rsa, &n1, &e1, NULL); if (pub != NULL) { - if (rsa->n != NULL) { - if (BN_cmp(rsa->n, pub->n) != 0) + RSA_get0_key(pub, &n2, &e2, NULL); + if (n1 != NULL) { + if (BN_cmp(n1, n2) != 0) return (DST_R_INVALIDPRIVATEKEY); } else { - rsa->n = pub->n; - pub->n = NULL; + n = BN_dup(n2); } - if (rsa->e != NULL) { - if (BN_cmp(rsa->e, pub->e) != 0) + if (e1 != NULL) { + if (BN_cmp(e1, e2) != 0) return (DST_R_INVALIDPRIVATEKEY); } else { - rsa->e = pub->e; - pub->e = NULL; + e = BN_dup(e2); + } + if (RSA_set0_key(rsa, n, e, NULL) == 0) { + if (n != NULL) + BN_free(n); + if (e != NULL) + BN_free(e); } } - if (rsa->n == NULL || rsa->e == NULL) + RSA_get0_key(rsa, &n1, &e1, NULL); + if (n1 == NULL || e1 == NULL) return (DST_R_INVALIDPRIVATEKEY); return (ISC_R_SUCCESS); } @@ -1246,13 +1407,17 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { int i; RSA *rsa = NULL, *pubrsa = NULL; #ifdef USE_ENGINE - ENGINE *e = NULL; + ENGINE *ep = NULL; + const BIGNUM *ex = NULL; #endif isc_mem_t *mctx = key->mctx; const char *engine = NULL, *label = NULL; #if defined(USE_ENGINE) || USE_EVP EVP_PKEY *pkey = NULL; #endif + BIGNUM *n = NULL, *e = NULL, *d = NULL; + BIGNUM *p = NULL, *q = NULL; + BIGNUM *dmp1 = NULL, *dmq1 = NULL, *iqmp = NULL; /* read private key file */ ret = dst__privstruct_parse(key, DST_ALG_RSA, lexer, mctx, &priv); @@ -1303,10 +1468,10 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { #ifdef USE_ENGINE if (engine == NULL) DST_RET(DST_R_NOENGINE); - e = dst__openssl_getengine(engine); - if (e == NULL) + ep = dst__openssl_getengine(engine); + if (ep == NULL) DST_RET(DST_R_NOENGINE); - pkey = ENGINE_load_private_key(e, label, NULL, NULL); + pkey = ENGINE_load_private_key(ep, label, NULL, NULL); if (pkey == NULL) DST_RET(dst__openssl_toresult2( "ENGINE_load_private_key", @@ -1322,7 +1487,8 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); if (rsa_check(rsa, pubrsa) != ISC_R_SUCCESS) DST_RET(DST_R_INVALIDPRIVATEKEY); - if (BN_num_bits(rsa->e) > RSA_MAX_PUBEXP_BITS) + RSA_get0_key(rsa, NULL, &ex, NULL); + if (BN_num_bits(ex) > RSA_MAX_PUBEXP_BITS) DST_RET(ISC_R_RANGE); if (pubrsa != NULL) RSA_free(pubrsa); @@ -1370,43 +1536,57 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { priv.elements[i].length, NULL); if (bn == NULL) DST_RET(ISC_R_NOMEMORY); - } - - switch (priv.elements[i].tag) { + switch (priv.elements[i].tag) { case TAG_RSA_MODULUS: - rsa->n = bn; + n = bn; break; case TAG_RSA_PUBLICEXPONENT: - rsa->e = bn; + e = bn; break; case TAG_RSA_PRIVATEEXPONENT: - rsa->d = bn; + d = bn; break; case TAG_RSA_PRIME1: - rsa->p = bn; + p = bn; break; case TAG_RSA_PRIME2: - rsa->q = bn; + q = bn; break; case TAG_RSA_EXPONENT1: - rsa->dmp1 = bn; + dmp1 = bn; break; case TAG_RSA_EXPONENT2: - rsa->dmq1 = bn; + dmq1 = bn; break; case TAG_RSA_COEFFICIENT: - rsa->iqmp = bn; + iqmp = bn; break; + } } } dst__privstruct_free(&priv, mctx); memset(&priv, 0, sizeof(priv)); + if (RSA_set0_key(rsa, n, e, d) == 0) { + if (n != NULL) BN_free(n); + if (e != NULL) BN_free(e); + if (d != NULL) BN_free(d); + } + if (RSA_set0_factors(rsa, p, q) == 0) { + if (p != NULL) BN_free(p); + if (q != NULL) BN_free(q); + } + if (RSA_set0_crt_params(rsa, dmp1, dmq1, iqmp) == 0) { + if (dmp1 != NULL) BN_free(dmp1); + if (dmq1 != NULL) BN_free(dmq1); + if (iqmp != NULL) BN_free(iqmp); + } + if (rsa_check(rsa, pubrsa) != ISC_R_SUCCESS) DST_RET(DST_R_INVALIDPRIVATEKEY); - if (BN_num_bits(rsa->e) > RSA_MAX_PUBEXP_BITS) + if (BN_num_bits(e) > RSA_MAX_PUBEXP_BITS) DST_RET(ISC_R_RANGE); - key->key_size = BN_num_bits(rsa->n); + key->key_size = BN_num_bits(n); if (pubrsa != NULL) RSA_free(pubrsa); #if USE_EVP @@ -1440,6 +1620,7 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label, EVP_PKEY *pkey = NULL; RSA *rsa = NULL, *pubrsa = NULL; char *colon, *tmpengine = NULL; + const BIGNUM *ex = NULL; UNUSED(pin); @@ -1483,7 +1664,8 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label, DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); if (rsa_check(rsa, pubrsa) != ISC_R_SUCCESS) DST_RET(DST_R_INVALIDPRIVATEKEY); - if (BN_num_bits(rsa->e) > RSA_MAX_PUBEXP_BITS) + RSA_get0_key(rsa, NULL, &ex, NULL); + if (BN_num_bits(ex) > RSA_MAX_PUBEXP_BITS) DST_RET(ISC_R_RANGE); if (pubrsa != NULL) RSA_free(pubrsa); diff --git a/lib/isc/aes.c b/lib/isc/aes.c index a4a61b3..e47ecf3 100644 --- a/lib/isc/aes.c +++ b/lib/isc/aes.c @@ -22,54 +22,72 @@ #ifdef ISC_PLATFORM_WANTAES #if HAVE_OPENSSL_EVP_AES +#include #include +#if OPENSSL_VERSION_NUMBER < 0x10100000L +#define EVP_CIPHER_CTX_new() &(_context), EVP_CIPHER_CTX_init(&_context) +#define EVP_CIPHER_CTX_free(c) RUNTIME_CHECK(EVP_CIPHER_CTX_cleanup(c) == 1) +#endif + void isc_aes128_crypt(const unsigned char *key, const unsigned char *in, unsigned char *out) { - EVP_CIPHER_CTX c; +#if OPENSSL_VERSION_NUMBER < 0x10100000L + EVP_CIPHER_CTX _context; +#endif + EVP_CIPHER_CTX *c; int len; - EVP_CIPHER_CTX_init(&c); - RUNTIME_CHECK(EVP_EncryptInit(&c, EVP_aes_128_ecb(), key, NULL) == 1); - EVP_CIPHER_CTX_set_padding(&c, 0); - RUNTIME_CHECK(EVP_EncryptUpdate(&c, out, &len, in, + c = EVP_CIPHER_CTX_new(); + RUNTIME_CHECK(c != NULL); + RUNTIME_CHECK(EVP_EncryptInit(c, EVP_aes_128_ecb(), key, NULL) == 1); + EVP_CIPHER_CTX_set_padding(c, 0); + RUNTIME_CHECK(EVP_EncryptUpdate(c, out, &len, in, ISC_AES_BLOCK_LENGTH) == 1); RUNTIME_CHECK(len == ISC_AES_BLOCK_LENGTH); - RUNTIME_CHECK(EVP_CIPHER_CTX_cleanup(&c) == 1); + EVP_CIPHER_CTX_free(c); } void isc_aes192_crypt(const unsigned char *key, const unsigned char *in, unsigned char *out) { - EVP_CIPHER_CTX c; +#if OPENSSL_VERSION_NUMBER < 0x10100000L + EVP_CIPHER_CTX _context; +#endif + EVP_CIPHER_CTX *c; int len; - EVP_CIPHER_CTX_init(&c); - RUNTIME_CHECK(EVP_EncryptInit(&c, EVP_aes_192_ecb(), key, NULL) == 1); - EVP_CIPHER_CTX_set_padding(&c, 0); - RUNTIME_CHECK(EVP_EncryptUpdate(&c, out, &len, in, + c = EVP_CIPHER_CTX_new(); + RUNTIME_CHECK(c != NULL); + RUNTIME_CHECK(EVP_EncryptInit(c, EVP_aes_192_ecb(), key, NULL) == 1); + EVP_CIPHER_CTX_set_padding(c, 0); + RUNTIME_CHECK(EVP_EncryptUpdate(c, out, &len, in, ISC_AES_BLOCK_LENGTH) == 1); RUNTIME_CHECK(len == ISC_AES_BLOCK_LENGTH); - RUNTIME_CHECK(EVP_CIPHER_CTX_cleanup(&c) == 1); + EVP_CIPHER_CTX_free(c); } void isc_aes256_crypt(const unsigned char *key, const unsigned char *in, unsigned char *out) { - EVP_CIPHER_CTX c; +#if OPENSSL_VERSION_NUMBER < 0x10100000L + EVP_CIPHER_CTX _context; +#endif + EVP_CIPHER_CTX *c; int len; - EVP_CIPHER_CTX_init(&c); - RUNTIME_CHECK(EVP_EncryptInit(&c, EVP_aes_256_ecb(), key, NULL) == 1); - EVP_CIPHER_CTX_set_padding(&c, 0); - RUNTIME_CHECK(EVP_EncryptUpdate(&c, out, &len, in, + c = EVP_CIPHER_CTX_new(); + RUNTIME_CHECK(c != NULL); + RUNTIME_CHECK(EVP_EncryptInit(c, EVP_aes_256_ecb(), key, NULL) == 1); + EVP_CIPHER_CTX_set_padding(c, 0); + RUNTIME_CHECK(EVP_EncryptUpdate(c, out, &len, in, ISC_AES_BLOCK_LENGTH) == 1); RUNTIME_CHECK(len == ISC_AES_BLOCK_LENGTH); - RUNTIME_CHECK(EVP_CIPHER_CTX_cleanup(&c) == 1); + EVP_CIPHER_CTX_free(c); } #elif HAVE_OPENSSL_AES diff --git a/lib/isc/hmacmd5.c b/lib/isc/hmacmd5.c index 621aa3b..1b81293 100644 --- a/lib/isc/hmacmd5.c +++ b/lib/isc/hmacmd5.c @@ -34,43 +34,41 @@ #endif #ifdef ISC_PLATFORM_OPENSSLHASH +#if OPENSSL_VERSION_NUMBER < 0x10100000L +#define HMAC_CTX_new() &(ctx->_ctx), HMAC_CTX_init(&(ctx->_ctx)) +#define HMAC_CTX_free(ptr) HMAC_CTX_cleanup(ptr) +#endif void isc_hmacmd5_init(isc_hmacmd5_t *ctx, const unsigned char *key, unsigned int len) { -#ifdef HMAC_RETURN_INT - RUNTIME_CHECK(HMAC_Init(ctx, (const void *) key, - (int) len, EVP_md5()) == 1); -#else - HMAC_Init(ctx, (const void *) key, (int) len, EVP_md5()); -#endif + ctx->ctx = HMAC_CTX_new(); + RUNTIME_CHECK(ctx->ctx != NULL); + RUNTIME_CHECK(HMAC_Init_ex(ctx->ctx, (const void *) key, + (int) len, EVP_md5(), NULL) == 1); } void isc_hmacmd5_invalidate(isc_hmacmd5_t *ctx) { - HMAC_CTX_cleanup(ctx); + if (ctx->ctx == NULL) + return; + HMAC_CTX_free(ctx->ctx); + ctx->ctx = NULL; } void isc_hmacmd5_update(isc_hmacmd5_t *ctx, const unsigned char *buf, unsigned int len) { -#ifdef HMAC_RETURN_INT - RUNTIME_CHECK(HMAC_Update(ctx, buf, (int) len) == 1); -#else - HMAC_Update(ctx, buf, (int) len); -#endif + RUNTIME_CHECK(HMAC_Update(ctx->ctx, buf, (int) len) == 1); } void isc_hmacmd5_sign(isc_hmacmd5_t *ctx, unsigned char *digest) { -#ifdef HMAC_RETURN_INT - RUNTIME_CHECK(HMAC_Final(ctx, digest, NULL) == 1); -#else - HMAC_Final(ctx, digest, NULL); -#endif - HMAC_CTX_cleanup(ctx); + RUNTIME_CHECK(HMAC_Final(ctx->ctx, digest, NULL) == 1); + HMAC_CTX_free(ctx->ctx); + ctx->ctx = NULL; } #elif PKCS11CRYPTO diff --git a/lib/isc/hmacsha.c b/lib/isc/hmacsha.c index ef1b8f0..c132aa2 100644 --- a/lib/isc/hmacsha.c +++ b/lib/isc/hmacsha.c @@ -32,32 +32,34 @@ #endif #ifdef ISC_PLATFORM_OPENSSLHASH +#if OPENSSL_VERSION_NUMBER < 0x10100000L +#define HMAC_CTX_new() &(ctx->_ctx), HMAC_CTX_init(&(ctx->_ctx)) +#define HMAC_CTX_free(ptr) HMAC_CTX_cleanup(ptr) +#endif + void isc_hmacsha1_init(isc_hmacsha1_t *ctx, const unsigned char *key, unsigned int len) { -#ifdef HMAC_RETURN_INT - RUNTIME_CHECK(HMAC_Init(ctx, (const void *) key, - (int) len, EVP_sha1()) == 1); -#else - HMAC_Init(ctx, (const void *) key, (int) len, EVP_sha1()); -#endif + ctx->ctx = HMAC_CTX_new(); + RUNTIME_CHECK(ctx->ctx != NULL); + RUNTIME_CHECK(HMAC_Init_ex(ctx->ctx, (const void *) key, + (int) len, EVP_sha1(), NULL) == 1); } void isc_hmacsha1_invalidate(isc_hmacsha1_t *ctx) { - HMAC_CTX_cleanup(ctx); + if (ctx->ctx == NULL) + return; + HMAC_CTX_free(ctx->ctx); + ctx->ctx = NULL; } void isc_hmacsha1_update(isc_hmacsha1_t *ctx, const unsigned char *buf, unsigned int len) { -#ifdef HMAC_RETURN_INT - RUNTIME_CHECK(HMAC_Update(ctx, buf, (int) len) == 1); -#else - HMAC_Update(ctx, buf, (int) len); -#endif + RUNTIME_CHECK(HMAC_Update(ctx->ctx, buf, (int) len) == 1); } void @@ -66,12 +68,9 @@ isc_hmacsha1_sign(isc_hmacsha1_t *ctx, unsigned char *digest, size_t len) { REQUIRE(len <= ISC_SHA1_DIGESTLENGTH); -#ifdef HMAC_RETURN_INT - RUNTIME_CHECK(HMAC_Final(ctx, newdigest, NULL) == 1); -#else - HMAC_Final(ctx, newdigest, NULL); -#endif - HMAC_CTX_cleanup(ctx); + RUNTIME_CHECK(HMAC_Final(ctx->ctx, newdigest, NULL) == 1); + HMAC_CTX_free(ctx->ctx); + ctx->ctx = NULL; memmove(digest, newdigest, len); memset(newdigest, 0, sizeof(newdigest)); } @@ -80,28 +79,25 @@ void isc_hmacsha224_init(isc_hmacsha224_t *ctx, const unsigned char *key, unsigned int len) { -#ifdef HMAC_RETURN_INT - RUNTIME_CHECK(HMAC_Init(ctx, (const void *) key, - (int) len, EVP_sha224()) == 1); -#else - HMAC_Init(ctx, (const void *) key, (int) len, EVP_sha224()); -#endif + ctx->ctx = HMAC_CTX_new(); + RUNTIME_CHECK(ctx->ctx != NULL); + RUNTIME_CHECK(HMAC_Init_ex(ctx->ctx, (const void *) key, + (int) len, EVP_sha224(), NULL) == 1); } void isc_hmacsha224_invalidate(isc_hmacsha224_t *ctx) { - HMAC_CTX_cleanup(ctx); + if (ctx->ctx == NULL) + return; + HMAC_CTX_free(ctx->ctx); + ctx->ctx = NULL; } void isc_hmacsha224_update(isc_hmacsha224_t *ctx, const unsigned char *buf, unsigned int len) { -#ifdef HMAC_RETURN_INT - RUNTIME_CHECK(HMAC_Update(ctx, buf, (int) len) == 1); -#else - HMAC_Update(ctx, buf, (int) len); -#endif + RUNTIME_CHECK(HMAC_Update(ctx->ctx, buf, (int) len) == 1); } void @@ -110,12 +106,9 @@ isc_hmacsha224_sign(isc_hmacsha224_t *ctx, unsigned char *digest, size_t len) { REQUIRE(len <= ISC_SHA224_DIGESTLENGTH); -#ifdef HMAC_RETURN_INT - RUNTIME_CHECK(HMAC_Final(ctx, newdigest, NULL) == 1); -#else - HMAC_Final(ctx, newdigest, NULL); -#endif - HMAC_CTX_cleanup(ctx); + RUNTIME_CHECK(HMAC_Final(ctx->ctx, newdigest, NULL) == 1); + HMAC_CTX_free(ctx->ctx); + ctx->ctx = NULL; memmove(digest, newdigest, len); memset(newdigest, 0, sizeof(newdigest)); } @@ -124,28 +117,25 @@ void isc_hmacsha256_init(isc_hmacsha256_t *ctx, const unsigned char *key, unsigned int len) { -#ifdef HMAC_RETURN_INT - RUNTIME_CHECK(HMAC_Init(ctx, (const void *) key, - (int) len, EVP_sha256()) == 1); -#else - HMAC_Init(ctx, (const void *) key, (int) len, EVP_sha256()); -#endif + ctx->ctx = HMAC_CTX_new(); + RUNTIME_CHECK(ctx->ctx != NULL); + RUNTIME_CHECK(HMAC_Init_ex(ctx->ctx, (const void *) key, + (int) len, EVP_sha256(), NULL) == 1); } void isc_hmacsha256_invalidate(isc_hmacsha256_t *ctx) { - HMAC_CTX_cleanup(ctx); + if (ctx->ctx == NULL) + return; + HMAC_CTX_free(ctx->ctx); + ctx->ctx = NULL; } void isc_hmacsha256_update(isc_hmacsha256_t *ctx, const unsigned char *buf, unsigned int len) { -#ifdef HMAC_RETURN_INT - RUNTIME_CHECK(HMAC_Update(ctx, buf, (int) len) == 1); -#else - HMAC_Update(ctx, buf, (int) len); -#endif + RUNTIME_CHECK(HMAC_Update(ctx->ctx, buf, (int) len) == 1); } void @@ -154,12 +144,9 @@ isc_hmacsha256_sign(isc_hmacsha256_t *ctx, unsigned char *digest, size_t len) { REQUIRE(len <= ISC_SHA256_DIGESTLENGTH); -#ifdef HMAC_RETURN_INT - RUNTIME_CHECK(HMAC_Final(ctx, newdigest, NULL) == 1); -#else - HMAC_Final(ctx, newdigest, NULL); -#endif - HMAC_CTX_cleanup(ctx); + RUNTIME_CHECK(HMAC_Final(ctx->ctx, newdigest, NULL) == 1); + HMAC_CTX_free(ctx->ctx); + ctx->ctx = NULL; memmove(digest, newdigest, len); memset(newdigest, 0, sizeof(newdigest)); } @@ -168,28 +155,25 @@ void isc_hmacsha384_init(isc_hmacsha384_t *ctx, const unsigned char *key, unsigned int len) { -#ifdef HMAC_RETURN_INT - RUNTIME_CHECK(HMAC_Init(ctx, (const void *) key, - (int) len, EVP_sha384()) == 1); -#else - HMAC_Init(ctx, (const void *) key, (int) len, EVP_sha384()); -#endif + ctx->ctx = HMAC_CTX_new(); + RUNTIME_CHECK(ctx->ctx != NULL); + RUNTIME_CHECK(HMAC_Init_ex(ctx->ctx, (const void *) key, + (int) len, EVP_sha384(), NULL) == 1); } void isc_hmacsha384_invalidate(isc_hmacsha384_t *ctx) { - HMAC_CTX_cleanup(ctx); + if (ctx->ctx == NULL) + return; + HMAC_CTX_free(ctx->ctx); + ctx->ctx = NULL; } void isc_hmacsha384_update(isc_hmacsha384_t *ctx, const unsigned char *buf, unsigned int len) { -#ifdef HMAC_RETURN_INT - RUNTIME_CHECK(HMAC_Update(ctx, buf, (int) len) == 1); -#else - HMAC_Update(ctx, buf, (int) len); -#endif + RUNTIME_CHECK(HMAC_Update(ctx->ctx, buf, (int) len) == 1); } void @@ -198,12 +182,9 @@ isc_hmacsha384_sign(isc_hmacsha384_t *ctx, unsigned char *digest, size_t len) { REQUIRE(len <= ISC_SHA384_DIGESTLENGTH); -#ifdef HMAC_RETURN_INT - RUNTIME_CHECK(HMAC_Final(ctx, newdigest, NULL) == 1); -#else - HMAC_Final(ctx, newdigest, NULL); -#endif - HMAC_CTX_cleanup(ctx); + RUNTIME_CHECK(HMAC_Final(ctx->ctx, newdigest, NULL) == 1); + HMAC_CTX_free(ctx->ctx); + ctx->ctx = NULL; memmove(digest, newdigest, len); memset(newdigest, 0, sizeof(newdigest)); } @@ -212,28 +193,25 @@ void isc_hmacsha512_init(isc_hmacsha512_t *ctx, const unsigned char *key, unsigned int len) { -#ifdef HMAC_RETURN_INT - RUNTIME_CHECK(HMAC_Init(ctx, (const void *) key, - (int) len, EVP_sha512()) == 1); -#else - HMAC_Init(ctx, (const void *) key, (int) len, EVP_sha512()); -#endif + ctx->ctx = HMAC_CTX_new(); + RUNTIME_CHECK(ctx->ctx != NULL); + RUNTIME_CHECK(HMAC_Init_ex(ctx->ctx, (const void *) key, + (int) len, EVP_sha512(), NULL) == 1); } void isc_hmacsha512_invalidate(isc_hmacsha512_t *ctx) { - HMAC_CTX_cleanup(ctx); + if (ctx->ctx == NULL) + return; + HMAC_CTX_free(ctx->ctx); + ctx->ctx = NULL; } void isc_hmacsha512_update(isc_hmacsha512_t *ctx, const unsigned char *buf, unsigned int len) { -#ifdef HMAC_RETURN_INT - RUNTIME_CHECK(HMAC_Update(ctx, buf, (int) len) == 1); -#else - HMAC_Update(ctx, buf, (int) len); -#endif + RUNTIME_CHECK(HMAC_Update(ctx->ctx, buf, (int) len) == 1); } void @@ -242,12 +220,9 @@ isc_hmacsha512_sign(isc_hmacsha512_t *ctx, unsigned char *digest, size_t len) { REQUIRE(len <= ISC_SHA512_DIGESTLENGTH); -#ifdef HMAC_RETURN_INT - RUNTIME_CHECK(HMAC_Final(ctx, newdigest, NULL) == 1); -#else - HMAC_Final(ctx, newdigest, NULL); -#endif - HMAC_CTX_cleanup(ctx); + RUNTIME_CHECK(HMAC_Final(ctx->ctx, newdigest, NULL) == 1); + HMAC_CTX_free(ctx->ctx); + ctx->ctx = NULL; memmove(digest, newdigest, len); memset(newdigest, 0, sizeof(newdigest)); } diff --git a/lib/isc/include/isc/hmacmd5.h b/lib/isc/include/isc/hmacmd5.h index 9d18b47..1ff0b87 100644 --- a/lib/isc/include/isc/hmacmd5.h +++ b/lib/isc/include/isc/hmacmd5.h @@ -28,9 +28,15 @@ #define ISC_HMACMD5_KEYLENGTH 64 #ifdef ISC_PLATFORM_OPENSSLHASH +#include #include -typedef HMAC_CTX isc_hmacmd5_t; +typedef struct { + HMAC_CTX *ctx; +#if OPENSSL_VERSION_NUMBER < 0x10100000L + HMAC_CTX _ctx; +#endif +} isc_hmacmd5_t; #elif PKCS11CRYPTO #include diff --git a/lib/isc/include/isc/hmacsha.h b/lib/isc/include/isc/hmacsha.h index 30808fb..d90c194 100644 --- a/lib/isc/include/isc/hmacsha.h +++ b/lib/isc/include/isc/hmacsha.h @@ -29,13 +29,21 @@ #define ISC_HMACSHA512_KEYLENGTH ISC_SHA512_BLOCK_LENGTH #ifdef ISC_PLATFORM_OPENSSLHASH +#include #include -typedef HMAC_CTX isc_hmacsha1_t; -typedef HMAC_CTX isc_hmacsha224_t; -typedef HMAC_CTX isc_hmacsha256_t; -typedef HMAC_CTX isc_hmacsha384_t; -typedef HMAC_CTX isc_hmacsha512_t; +typedef struct { + HMAC_CTX *ctx; +#if OPENSSL_VERSION_NUMBER < 0x10100000L + HMAC_CTX _ctx; +#endif +} isc_hmacsha_t; + +typedef isc_hmacsha_t isc_hmacsha1_t; +typedef isc_hmacsha_t isc_hmacsha224_t; +typedef isc_hmacsha_t isc_hmacsha256_t; +typedef isc_hmacsha_t isc_hmacsha384_t; +typedef isc_hmacsha_t isc_hmacsha512_t; #elif PKCS11CRYPTO #include diff --git a/lib/isc/include/isc/md5.h b/lib/isc/include/isc/md5.h index 0af4e27..b707aa6 100644 --- a/lib/isc/include/isc/md5.h +++ b/lib/isc/include/isc/md5.h @@ -46,9 +46,15 @@ #define ISC_MD5_BLOCK_LENGTH 64U #ifdef ISC_PLATFORM_OPENSSLHASH +#include #include -typedef EVP_MD_CTX isc_md5_t; +typedef struct { + EVP_MD_CTX *ctx; +#if OPENSSL_VERSION_NUMBER < 0x10100000L + EVP_MD_CTX _ctx; +#endif +} isc_md5_t; #elif PKCS11CRYPTO #include diff --git a/lib/isc/include/isc/sha1.h b/lib/isc/include/isc/sha1.h index c4fbfd3..7160a66 100644 --- a/lib/isc/include/isc/sha1.h +++ b/lib/isc/include/isc/sha1.h @@ -27,9 +27,15 @@ #define ISC_SHA1_BLOCK_LENGTH 64U #ifdef ISC_PLATFORM_OPENSSLHASH +#include #include -typedef EVP_MD_CTX isc_sha1_t; +typedef struct { + EVP_MD_CTX *ctx; +#if OPENSSL_VERSION_NUMBER < 0x10100000L + EVP_MD_CTX _ctx; +#endif +} isc_sha1_t; #elif PKCS11CRYPTO #include diff --git a/lib/isc/include/isc/sha2.h b/lib/isc/include/isc/sha2.h index 8a28bed..196f120 100644 --- a/lib/isc/include/isc/sha2.h +++ b/lib/isc/include/isc/sha2.h @@ -71,10 +71,18 @@ /*** SHA-256/384/512 Context Structures *******************************/ #ifdef ISC_PLATFORM_OPENSSLHASH +#include #include -typedef EVP_MD_CTX isc_sha256_t; -typedef EVP_MD_CTX isc_sha512_t; +typedef struct { + EVP_MD_CTX *ctx; +#if OPENSSL_VERSION_NUMBER < 0x10100000L + EVP_MD_CTX _ctx; +#endif +} isc_sha2_t; + +typedef isc_sha2_t isc_sha256_t; +typedef isc_sha2_t isc_sha512_t; #elif PKCS11CRYPTO #include diff --git a/lib/isc/md5.c b/lib/isc/md5.c index 0a79263..8ada1cc 100644 --- a/lib/isc/md5.c +++ b/lib/isc/md5.c @@ -45,28 +45,38 @@ #include #ifdef ISC_PLATFORM_OPENSSLHASH +#if OPENSSL_VERSION_NUMBER < 0x10100000L +#define EVP_MD_CTX_new() &(ctx->_ctx) +#define EVP_MD_CTX_free(ptr) EVP_MD_CTX_cleanup(ptr) +#endif + void isc_md5_init(isc_md5_t *ctx) { - RUNTIME_CHECK(EVP_DigestInit(ctx, EVP_md5()) == 1); + ctx->ctx = EVP_MD_CTX_new(); + RUNTIME_CHECK(ctx->ctx != NULL); + RUNTIME_CHECK(EVP_DigestInit(ctx->ctx, EVP_md5()) == 1); } void isc_md5_invalidate(isc_md5_t *ctx) { - EVP_MD_CTX_cleanup(ctx); + EVP_MD_CTX_free(ctx->ctx); + ctx->ctx = NULL; } void isc_md5_update(isc_md5_t *ctx, const unsigned char *buf, unsigned int len) { if (len == 0U) return; - RUNTIME_CHECK(EVP_DigestUpdate(ctx, + RUNTIME_CHECK(EVP_DigestUpdate(ctx->ctx, (const void *) buf, (size_t) len) == 1); } void isc_md5_final(isc_md5_t *ctx, unsigned char *digest) { - RUNTIME_CHECK(EVP_DigestFinal(ctx, digest, NULL) == 1); + RUNTIME_CHECK(EVP_DigestFinal(ctx->ctx, digest, NULL) == 1); + EVP_MD_CTX_free(ctx->ctx); + ctx->ctx = NULL; } #elif PKCS11CRYPTO diff --git a/lib/isc/sha1.c b/lib/isc/sha1.c index e41b17c..1b7bc19 100644 --- a/lib/isc/sha1.c +++ b/lib/isc/sha1.c @@ -41,17 +41,25 @@ #endif #ifdef ISC_PLATFORM_OPENSSLHASH +#if OPENSSL_VERSION_NUMBER < 0x10100000L +#define EVP_MD_CTX_new() &(context->_ctx) +#define EVP_MD_CTX_free(ptr) EVP_MD_CTX_cleanup(ptr) +#endif + void isc_sha1_init(isc_sha1_t *context) { INSIST(context != NULL); - RUNTIME_CHECK(EVP_DigestInit(context, EVP_sha1()) == 1); + context->ctx = EVP_MD_CTX_new(); + RUNTIME_CHECK(context->ctx != NULL); + RUNTIME_CHECK(EVP_DigestInit(context->ctx, EVP_sha1()) == 1); } void isc_sha1_invalidate(isc_sha1_t *context) { - EVP_MD_CTX_cleanup(context); + EVP_MD_CTX_free(context->ctx); + context->ctx = NULL; } void @@ -59,9 +67,10 @@ isc_sha1_update(isc_sha1_t *context, const unsigned char *data, unsigned int len) { INSIST(context != 0); + INSIST(context->ctx != 0); INSIST(data != 0); - RUNTIME_CHECK(EVP_DigestUpdate(context, + RUNTIME_CHECK(EVP_DigestUpdate(context->ctx, (const void *) data, (size_t) len) == 1); } @@ -70,8 +79,11 @@ void isc_sha1_final(isc_sha1_t *context, unsigned char *digest) { INSIST(digest != 0); INSIST(context != 0); + INSIST(context->ctx != 0); - RUNTIME_CHECK(EVP_DigestFinal(context, digest, NULL) == 1); + RUNTIME_CHECK(EVP_DigestFinal(context->ctx, digest, NULL) == 1); + EVP_MD_CTX_free(context->ctx); + context->ctx = NULL; } #elif PKCS11CRYPTO diff --git a/lib/isc/sha2.c b/lib/isc/sha2.c index a3c00c9..26a940a 100644 --- a/lib/isc/sha2.c +++ b/lib/isc/sha2.c @@ -61,18 +61,26 @@ #endif #ifdef ISC_PLATFORM_OPENSSLHASH +#if OPENSSL_VERSION_NUMBER < 0x10100000L +#define EVP_MD_CTX_new() &(context->_ctx) +#define EVP_MD_CTX_free(ptr) EVP_MD_CTX_cleanup(ptr) +#define EVP_MD_CTX_reset(c) EVP_MD_CTX_cleanup(c) +#endif void isc_sha224_init(isc_sha224_t *context) { if (context == (isc_sha224_t *)0) { return; } - RUNTIME_CHECK(EVP_DigestInit(context, EVP_sha224()) == 1); + context->ctx = EVP_MD_CTX_new(); + RUNTIME_CHECK(context->ctx != NULL); + RUNTIME_CHECK(EVP_DigestInit(context->ctx, EVP_sha224()) == 1); } void isc_sha224_invalidate(isc_sha224_t *context) { - EVP_MD_CTX_cleanup(context); + EVP_MD_CTX_free(context->ctx); + context->ctx = NULL; } void @@ -83,9 +91,11 @@ isc_sha224_update(isc_sha224_t *context, const isc_uint8_t* data, size_t len) { } /* Sanity check: */ - REQUIRE(context != (isc_sha224_t *)0 && data != (isc_uint8_t*)0); + REQUIRE(context != (isc_sha224_t *)0); + REQUIRE(context->ctx != (EVP_MD_CTX *)0); + REQUIRE(data != (isc_uint8_t*)0); - RUNTIME_CHECK(EVP_DigestUpdate(context, + RUNTIME_CHECK(EVP_DigestUpdate(context->ctx, (const void *) data, len) == 1); } @@ -93,13 +103,14 @@ void isc_sha224_final(isc_uint8_t digest[], isc_sha224_t *context) { /* Sanity check: */ REQUIRE(context != (isc_sha224_t *)0); + REQUIRE(context->ctx != (EVP_MD_CTX *)0); /* If no digest buffer is passed, we don't bother doing this: */ - if (digest != (isc_uint8_t*)0) { - RUNTIME_CHECK(EVP_DigestFinal(context, digest, NULL) == 1); - } else { - EVP_MD_CTX_cleanup(context); - } + if (digest != (isc_uint8_t*)0) + RUNTIME_CHECK(EVP_DigestFinal(context->ctx, + digest, NULL) == 1); + EVP_MD_CTX_free(context->ctx); + context->ctx = NULL; } void @@ -107,12 +118,15 @@ isc_sha256_init(isc_sha256_t *context) { if (context == (isc_sha256_t *)0) { return; } - RUNTIME_CHECK(EVP_DigestInit(context, EVP_sha256()) == 1); + context->ctx = EVP_MD_CTX_new(); + RUNTIME_CHECK(context->ctx != NULL); + RUNTIME_CHECK(EVP_DigestInit(context->ctx, EVP_sha256()) == 1); } void isc_sha256_invalidate(isc_sha256_t *context) { - EVP_MD_CTX_cleanup(context); + EVP_MD_CTX_free(context->ctx); + context->ctx = NULL; } void @@ -123,9 +137,11 @@ isc_sha256_update(isc_sha256_t *context, const isc_uint8_t *data, size_t len) { } /* Sanity check: */ - REQUIRE(context != (isc_sha256_t *)0 && data != (isc_uint8_t*)0); + REQUIRE(context != (isc_sha256_t *)0); + REQUIRE(context->ctx != (EVP_MD_CTX *)0); + REQUIRE(data != (isc_uint8_t*)0); - RUNTIME_CHECK(EVP_DigestUpdate(context, + RUNTIME_CHECK(EVP_DigestUpdate(context->ctx, (const void *) data, len) == 1); } @@ -133,13 +149,14 @@ void isc_sha256_final(isc_uint8_t digest[], isc_sha256_t *context) { /* Sanity check: */ REQUIRE(context != (isc_sha256_t *)0); + REQUIRE(context->ctx != (EVP_MD_CTX *)0); /* If no digest buffer is passed, we don't bother doing this: */ - if (digest != (isc_uint8_t*)0) { - RUNTIME_CHECK(EVP_DigestFinal(context, digest, NULL) == 1); - } else { - EVP_MD_CTX_cleanup(context); - } + if (digest != (isc_uint8_t*)0) + RUNTIME_CHECK(EVP_DigestFinal(context->ctx, + digest, NULL) == 1); + EVP_MD_CTX_free(context->ctx); + context->ctx = NULL; } void @@ -147,12 +164,15 @@ isc_sha512_init(isc_sha512_t *context) { if (context == (isc_sha512_t *)0) { return; } - RUNTIME_CHECK(EVP_DigestInit(context, EVP_sha512()) == 1); + context->ctx = EVP_MD_CTX_new(); + RUNTIME_CHECK(context->ctx != NULL); + RUNTIME_CHECK(EVP_DigestInit(context->ctx, EVP_sha512()) == 1); } void isc_sha512_invalidate(isc_sha512_t *context) { - EVP_MD_CTX_cleanup(context); + EVP_MD_CTX_free(context->ctx); + context->ctx = NULL; } void isc_sha512_update(isc_sha512_t *context, const isc_uint8_t *data, size_t len) { @@ -162,22 +182,25 @@ void isc_sha512_update(isc_sha512_t *context, const isc_uint8_t *data, size_t le } /* Sanity check: */ - REQUIRE(context != (isc_sha512_t *)0 && data != (isc_uint8_t*)0); + REQUIRE(context != (isc_sha512_t *)0); + REQUIRE(context->ctx != (EVP_MD_CTX *)0); + REQUIRE(data != (isc_uint8_t*)0); - RUNTIME_CHECK(EVP_DigestUpdate(context, + RUNTIME_CHECK(EVP_DigestUpdate(context->ctx, (const void *) data, len) == 1); } void isc_sha512_final(isc_uint8_t digest[], isc_sha512_t *context) { /* Sanity check: */ REQUIRE(context != (isc_sha512_t *)0); + REQUIRE(context->ctx != (EVP_MD_CTX *)0); /* If no digest buffer is passed, we don't bother doing this: */ - if (digest != (isc_uint8_t*)0) { - RUNTIME_CHECK(EVP_DigestFinal(context, digest, NULL) == 1); - } else { - EVP_MD_CTX_cleanup(context); - } + if (digest != (isc_uint8_t*)0) + RUNTIME_CHECK(EVP_DigestFinal(context->ctx, + digest, NULL) == 1); + EVP_MD_CTX_free(context->ctx); + context->ctx = NULL; } void @@ -185,12 +208,15 @@ isc_sha384_init(isc_sha384_t *context) { if (context == (isc_sha384_t *)0) { return; } - RUNTIME_CHECK(EVP_DigestInit(context, EVP_sha384()) == 1); + context->ctx = EVP_MD_CTX_new(); + RUNTIME_CHECK(context->ctx != NULL); + RUNTIME_CHECK(EVP_DigestInit(context->ctx, EVP_sha384()) == 1); } void isc_sha384_invalidate(isc_sha384_t *context) { - EVP_MD_CTX_cleanup(context); + EVP_MD_CTX_free(context->ctx); + context->ctx = NULL; } void @@ -201,9 +227,11 @@ isc_sha384_update(isc_sha384_t *context, const isc_uint8_t* data, size_t len) { } /* Sanity check: */ - REQUIRE(context != (isc_sha512_t *)0 && data != (isc_uint8_t*)0); + REQUIRE(context != (isc_sha512_t *)0); + REQUIRE(context->ctx != (EVP_MD_CTX *)0); + REQUIRE(data != (isc_uint8_t*)0); - RUNTIME_CHECK(EVP_DigestUpdate(context, + RUNTIME_CHECK(EVP_DigestUpdate(context->ctx, (const void *) data, len) == 1); } @@ -211,13 +239,14 @@ void isc_sha384_final(isc_uint8_t digest[], isc_sha384_t *context) { /* Sanity check: */ REQUIRE(context != (isc_sha384_t *)0); + REQUIRE(context->ctx != (EVP_MD_CTX *)0); /* If no digest buffer is passed, we don't bother doing this: */ - if (digest != (isc_uint8_t*)0) { - RUNTIME_CHECK(EVP_DigestFinal(context, digest, NULL) == 1); - } else { - EVP_MD_CTX_cleanup(context); - } + if (digest != (isc_uint8_t*)0) + RUNTIME_CHECK(EVP_DigestFinal(context->ctx, + digest, NULL) == 1); + EVP_MD_CTX_free(context->ctx); + context->ctx = NULL; } #elif PKCS11CRYPTO @@ -1578,7 +1607,7 @@ isc_sha224_end(isc_sha224_t *context, char buffer[]) { *buffer = (char)0; } else { #ifdef ISC_PLATFORM_OPENSSLHASH - EVP_MD_CTX_cleanup(context); + EVP_MD_CTX_reset(context->ctx); #elif PKCS11CRYPTO pk11_return_session(context); #else @@ -1619,7 +1648,7 @@ isc_sha256_end(isc_sha256_t *context, char buffer[]) { *buffer = (char)0; } else { #ifdef ISC_PLATFORM_OPENSSLHASH - EVP_MD_CTX_cleanup(context); + EVP_MD_CTX_reset(context->ctx); #elif PKCS11CRYPTO pk11_return_session(context); #else @@ -1660,7 +1689,7 @@ isc_sha512_end(isc_sha512_t *context, char buffer[]) { *buffer = (char)0; } else { #ifdef ISC_PLATFORM_OPENSSLHASH - EVP_MD_CTX_cleanup(context); + EVP_MD_CTX_reset(context->ctx); #elif PKCS11CRYPTO pk11_return_session(context); #else @@ -1701,7 +1730,7 @@ isc_sha384_end(isc_sha384_t *context, char buffer[]) { *buffer = (char)0; } else { #ifdef ISC_PLATFORM_OPENSSLHASH - EVP_MD_CTX_cleanup(context); + EVP_MD_CTX_reset(context->ctx); #elif PKCS11CRYPTO pk11_return_session(context); #else diff --git a/win32utils/Configure b/win32utils/Configure index 9aef5bc..0e2da8e 100644 --- a/win32utils/Configure +++ b/win32utils/Configure @@ -432,7 +432,6 @@ my @substdefh = ("AES_CC", "HAVE_PKCS11_GOST", "HAVE_READLINE", "HAVE_ZLIB", - "HMAC_RETURN_INT", "HMAC_SHA1_CC", "HMAC_SHA256_CC", "ISC_LIST_CHECKINIT", @@ -1590,8 +1589,14 @@ if ($use_openssl eq "no") { foreach $file (sort {uc($b) cmp uc($a)} @dirlist) { if (-f File::Spec->catfile($openssl_path, $file, - "inc32\\openssl", - "opensslv.h")) { + "inc32\\openssl\\opensslv.h")) { + $openssl_path = File::Spec->catdir($openssl_path, $file); + $use_openssl = "yes"; + last; + } + if (-f File::Spec->catfile($openssl_path, + $file, + "include\\openssl\\opensslv.h")) { $openssl_path = File::Spec->catdir($openssl_path, $file); $use_openssl = "yes"; last; @@ -1609,21 +1614,50 @@ if ($use_openssl eq "yes") { if ($verbose) { print "checking for OpenSSL built directory at \"$openssl_path\"\n"; } + my $openssl_new = 0; if (!-f File::Spec->catfile($openssl_path, - "inc32\\openssl", - "opensslv.h")) { - die "can't find OpenSSL opensslv.h include\n"; - } - if (!-f File::Spec->catfile($openssl_path, "out32dll", "libeay32.lib")) { - die "can't find OpenSSL libeay32.lib library\n"; - } - if (!-f File::Spec->catfile($openssl_path, "out32dll", "libeay32.dll")) { - die "can't find OpenSSL libeay32.dll DLL\n"; + "inc32\\openssl\\opensslv.h")) { + $openssl_new = 1; + if (!-f File::Spec->catfile($openssl_path, + "include\\openssl\\opensslv.h")) { + die "can't find OpenSSL opensslv.h include\n"; + } } my $openssl_inc = File::Spec->catdir($openssl_path, "inc32"); my $openssl_libdir = File::Spec->catdir($openssl_path, "out32dll"); my $openssl_lib = File::Spec->catfile($openssl_libdir, "libeay32.lib"); my $openssl_dll = File::Spec->catfile($openssl_libdir, "libeay32.dll"); + if (!$openssl_new) { + # Check libraries are where we expect + if (!-f $openssl_lib) { + die "can't find OpenSSL libeay32.lib library\n"; + } + if (!-f $openssl_dll) { + die "can't find OpenSSL libeay32.dll DLL\n"; + } + } else { + # OpenSSL >= 1.1 is easier at the exception of the DLL + if ($verbose) { + print "new (>= 1.1) OpenSSL version\n"; + } + $openssl_inc = File::Spec->catdir($openssl_path, "include"); + $openssl_libdir = $openssl_path; + $openssl_lib = File::Spec->catfile($openssl_path, "libcrypto.lib"); + if (!-f $openssl_lib) { + die "can't find OpenSSL libcrypto.lib library\n"; + } + opendir DIR, $openssl_path || die "No Directory: $!\n"; + my @dirlist = grep (/^libcrypto-[^.]+\.dll$/i, readdir(DIR)); + closedir(DIR); + # We must get one file only + if (scalar(@dirlist) == 0) { + die "can't find OpenSSL libcrypto-*.dll DLL\n"; + } + if (scalar(@dirlist) != 1) { + die "find more than one OpenSSL libcrypto-*.dll DLL candidate\n"; + } + $openssl_dll = File::Spec->catdir($openssl_path, "@dirlist[0]"); + } $configcond{"OPENSSL"} = 1; $configdefd{"CRYPTO"} = "OPENSSL"; @@ -2055,30 +2089,6 @@ if ($enable_openssl_hash eq "yes") { die "No OpenSSL for hash functions\n"; } $configdefp{"ISC_PLATFORM_OPENSSLHASH"} = 1; - if ($verbose) { - print "checking HMAC_Init() return type\n"; - } - open F, ">testhmac.c" || die $!; - print F << 'EOF'; -#include - -int -main(void) -{ - HMAC_CTX ctx; - int n = HMAC_Init(&ctx, NULL, 0, NULL); - n += HMAC_Update(&ctx, NULL, 0); - n += HMAC_Final(&ctx, NULL, NULL); - return(n); -} -EOF - close F; - my $include = $configinc{"OPENSSL_INC"}; - my $library = $configlib{"OPENSSL_LIB"}; - $compret = `cl /nologo /MD /I "$include" testhmac.c "$library"`; - if (grep { -f and -x } ".\\testhmac.exe") { - $configdefh{"HMAC_RETURN_INT"} = 1; - } } # with-pkcs11 @@ -3186,7 +3196,11 @@ sub makeinstallfile { print LOUT "liblwres.dll-BCFT\n"; print LOUT "libirs.dll-BCFT\n"; if ($use_openssl eq "yes") { - print LOUT "libeay32.dll-BCFT\n"; + my $v; + my $d; + my $name; + ($v, $d, $name) =File::Spec->splitpath($configdll{"OPENSSL_DLL"}); + print LOUT "${name}-BCFT\n"; } if ($use_libxml2 eq "yes") { print LOUT "libxml2.dll-BCFT\n"; -- 2.9.0