Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-15-SP3:Update
libssh.13787
0001-pki_crypto-Use-getters-and-setters-for-opa...
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 0001-pki_crypto-Use-getters-and-setters-for-opaque-keys-a.patch of Package libssh.13787
From 3341f49a49a07cbce003e487ef24a2042e800f01 Mon Sep 17 00:00:00 2001 From: Jakub Jelen <jjelen@redhat.com> Date: Wed, 2 Nov 2016 17:02:58 +0100 Subject: [PATCH] pki_crypto: Use getters and setters for opaque keys and signatures This is for OpenSSL 1.1.0 support. Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> --- src/pki_crypto.c | 295 ++++++++++++++++++++++++++++++++++++++----------------- 1 file changed, 203 insertions(+), 92 deletions(-) Index: libssh-0.7.5/src/pki_crypto.c =================================================================== --- libssh-0.7.5.orig/src/pki_crypto.c 2017-09-15 10:23:38.677834792 +0200 +++ libssh-0.7.5/src/pki_crypto.c 2017-09-15 10:25:38.983736682 +0200 @@ -31,6 +31,7 @@ #include <openssl/dsa.h> #include <openssl/err.h> #include <openssl/rsa.h> +#include "libcrypto-compat.h" #ifdef HAVE_OPENSSL_EC_H #include <openssl/ec.h> @@ -230,7 +231,10 @@ ssh_key pki_key_dup(const ssh_key key, i } switch (key->type) { - case SSH_KEYTYPE_DSS: + case SSH_KEYTYPE_DSS: { + const BIGNUM *p = NULL, *q = NULL, *g = NULL, + *pub_key = NULL, *priv_key = NULL; + BIGNUM *np, *nq, *ng, *npub_key, *npriv_key; new->dsa = DSA_new(); if (new->dsa == NULL) { goto fail; @@ -243,36 +247,54 @@ ssh_key pki_key_dup(const ssh_key key, i * pub_key = public key y = g^x * priv_key = private key x */ - new->dsa->p = BN_dup(key->dsa->p); - if (new->dsa->p == NULL) { + DSA_get0_pqg(key->dsa, &p, &q, &g); + np = BN_dup(p); + nq = BN_dup(q); + ng = BN_dup(g); + if (np == NULL || nq == NULL || ng == NULL) { + BN_free(np); + BN_free(nq); + BN_free(ng); goto fail; } - new->dsa->q = BN_dup(key->dsa->q); - if (new->dsa->q == NULL) { + rc = DSA_set0_pqg(new->dsa, np, nq, ng); + if (rc == 0) { + BN_free(np); + BN_free(nq); + BN_free(ng); goto fail; } - new->dsa->g = BN_dup(key->dsa->g); - if (new->dsa->g == NULL) { + DSA_get0_key(key->dsa, &pub_key, &priv_key); + npub_key = BN_dup(pub_key); + if (npub_key == NULL) { goto fail; } - new->dsa->pub_key = BN_dup(key->dsa->pub_key); - if (new->dsa->pub_key == NULL) { + rc = DSA_set0_key(new->dsa, npub_key, NULL); + if (rc == 0) { goto fail; } if (!demote && (key->flags & SSH_KEY_FLAG_PRIVATE)) { - new->dsa->priv_key = BN_dup(key->dsa->priv_key); - if (new->dsa->priv_key == NULL) { + npriv_key = BN_dup(priv_key); + if (npriv_key == NULL) { + goto fail; + } + + rc = DSA_set0_key(new->dsa, NULL, npriv_key); + if (rc == 0) { goto fail; } } break; + } case SSH_KEYTYPE_RSA: - case SSH_KEYTYPE_RSA1: + case SSH_KEYTYPE_RSA1: { + const BIGNUM *n = NULL, *e = NULL, *d = NULL; + BIGNUM *nn, *ne, *nd; new->rsa = RSA_new(); if (new->rsa == NULL) { goto fail; @@ -288,62 +310,82 @@ ssh_key pki_key_dup(const ssh_key key, i * dmq1 = d mod (q-1) * iqmp = q^-1 mod p */ - new->rsa->n = BN_dup(key->rsa->n); - if (new->rsa->n == NULL) { + RSA_get0_key(key->rsa, &n, &e, &d); + nn = BN_dup(n); + ne = BN_dup(e); + if (nn == NULL || ne == NULL) { + BN_free(nn); + BN_free(ne); goto fail; } - new->rsa->e = BN_dup(key->rsa->e); - if (new->rsa->e == NULL) { + rc = RSA_set0_key(new->rsa, nn, ne, NULL); + if (rc == 0) { + BN_free(nn); + BN_free(ne); goto fail; } if (!demote && (key->flags & SSH_KEY_FLAG_PRIVATE)) { - new->rsa->d = BN_dup(key->rsa->d); - if (new->rsa->d == NULL) { + const BIGNUM *p = NULL, *q = NULL, *dmp1 = NULL, + *dmq1 = NULL, *iqmp = NULL; + BIGNUM *np, *nq, *ndmp1, *ndmq1, *niqmp; + + nd = BN_dup(d); + if (nd == NULL) { + goto fail; + } + + rc = RSA_set0_key(new->rsa, NULL, NULL, nd); + if (rc == 0) { goto fail; } /* p, q, dmp1, dmq1 and iqmp may be NULL in private keys, but the * RSA operations are much faster when these values are available. */ - if (key->rsa->p != NULL) { - new->rsa->p = BN_dup(key->rsa->p); - if (new->rsa->p == NULL) { + RSA_get0_factors(key->rsa, &p, &q); + if (p != NULL && q != NULL) { /* need to set both of them */ + np = BN_dup(p); + nq = BN_dup(q); + if (np == NULL || nq == NULL) { + BN_free(np); + BN_free(nq); goto fail; } - } - if (key->rsa->q != NULL) { - new->rsa->q = BN_dup(key->rsa->q); - if (new->rsa->q == NULL) { + rc = RSA_set0_factors(new->rsa, np, nq); + if (rc == 0) { + BN_free(np); + BN_free(nq); goto fail; } } - if (key->rsa->dmp1 != NULL) { - new->rsa->dmp1 = BN_dup(key->rsa->dmp1); - if (new->rsa->dmp1 == NULL) { + RSA_get0_crt_params(key->rsa, &dmp1, &dmq1, &iqmp); + if (dmp1 != NULL || dmq1 != NULL || iqmp != NULL) { + ndmp1 = BN_dup(dmp1); + ndmq1 = BN_dup(dmq1); + niqmp = BN_dup(iqmp); + if (ndmp1 == NULL || ndmq1 == NULL || niqmp == NULL) { + BN_free(ndmp1); + BN_free(ndmq1); + BN_free(niqmp); goto fail; } - } - if (key->rsa->dmq1 != NULL) { - new->rsa->dmq1 = BN_dup(key->rsa->dmq1); - if (new->rsa->dmq1 == NULL) { - goto fail; - } - } - - if (key->rsa->iqmp != NULL) { - new->rsa->iqmp = BN_dup(key->rsa->iqmp); - if (new->rsa->iqmp == NULL) { + rc = RSA_set0_crt_params(new->rsa, ndmp1, ndmq1, niqmp); + if (rc == 0) { + BN_free(ndmp1); + BN_free(ndmq1); + BN_free(niqmp); goto fail; } } } break; + } case SSH_KEYTYPE_ECDSA: #ifdef HAVE_OPENSSL_ECC new->ecdsa_nid = key->ecdsa_nid; @@ -466,51 +508,64 @@ int pki_key_compare(const ssh_key k1, enum ssh_keycmp_e what) { switch (k1->type) { - case SSH_KEYTYPE_DSS: + case SSH_KEYTYPE_DSS: { + const BIGNUM *p1, *p2, *q1, *q2, *g1, *g2, + *pub_key1, *pub_key2, *priv_key1, *priv_key2; if (DSA_size(k1->dsa) != DSA_size(k2->dsa)) { return 1; } - if (bignum_cmp(k1->dsa->p, k2->dsa->p) != 0) { + DSA_get0_pqg(k1->dsa, &p1, &q1, &g1); + DSA_get0_pqg(k2->dsa, &p2, &q2, &g2); + if (bignum_cmp(p1, p2) != 0) { return 1; } - if (bignum_cmp(k1->dsa->q, k2->dsa->q) != 0) { + if (bignum_cmp(q1, q2) != 0) { return 1; } - if (bignum_cmp(k1->dsa->g, k2->dsa->g) != 0) { + if (bignum_cmp(g1, g2) != 0) { return 1; } - if (bignum_cmp(k1->dsa->pub_key, k2->dsa->pub_key) != 0) { + DSA_get0_key(k1->dsa, &pub_key1, &priv_key1); + DSA_get0_key(k2->dsa, &pub_key2, &priv_key2); + if (bignum_cmp(pub_key1, pub_key2) != 0) { return 1; } if (what == SSH_KEY_CMP_PRIVATE) { - if (bignum_cmp(k1->dsa->priv_key, k2->dsa->priv_key) != 0) { + if (bignum_cmp(priv_key1, priv_key2) != 0) { return 1; } } break; + } case SSH_KEYTYPE_RSA: - case SSH_KEYTYPE_RSA1: + case SSH_KEYTYPE_RSA1: { + const BIGNUM *e1, *e2, *n1, *n2, *p1, *p2, *q1, *q2; if (RSA_size(k1->rsa) != RSA_size(k2->rsa)) { return 1; } - if (bignum_cmp(k1->rsa->e, k2->rsa->e) != 0) { + RSA_get0_key(k1->rsa, &n1, &e1, NULL); + RSA_get0_key(k2->rsa, &n2, &e2, NULL); + if (bignum_cmp(e1, e2) != 0) { return 1; } - if (bignum_cmp(k1->rsa->n, k2->rsa->n) != 0) { + if (bignum_cmp(n1, n2) != 0) { return 1; } if (what == SSH_KEY_CMP_PRIVATE) { - if (bignum_cmp(k1->rsa->p, k2->rsa->p) != 0) { + RSA_get0_factors(k1->rsa, &p1, &q1); + RSA_get0_factors(k2->rsa, &p2, &q2); + if (bignum_cmp(p1, p2) != 0) { return 1; } - if (bignum_cmp(k1->rsa->q, k2->rsa->q) != 0) { + if (bignum_cmp(q1, q2) != 0) { return 1; } } break; + } case SSH_KEYTYPE_ECDSA: #ifdef HAVE_OPENSSL_ECC { @@ -819,43 +874,65 @@ int pki_pubkey_build_dss(ssh_key key, ssh_string q, ssh_string g, ssh_string pubkey) { + int rc; + BIGNUM *bp, *bq, *bg, *bpub_key; + key->dsa = DSA_new(); if (key->dsa == NULL) { return SSH_ERROR; } - key->dsa->p = make_string_bn(p); - key->dsa->q = make_string_bn(q); - key->dsa->g = make_string_bn(g); - key->dsa->pub_key = make_string_bn(pubkey); - if (key->dsa->p == NULL || - key->dsa->q == NULL || - key->dsa->g == NULL || - key->dsa->pub_key == NULL) { - DSA_free(key->dsa); - return SSH_ERROR; + bp = make_string_bn(p); + bq = make_string_bn(q); + bg = make_string_bn(g); + bpub_key = make_string_bn(pubkey); + if (bp == NULL || bq == NULL || + bg == NULL || bpub_key == NULL) { + goto fail; + } + + rc = DSA_set0_pqg(key->dsa, bp, bq, bg); + if (rc == 0) { + goto fail; + } + + rc = DSA_set0_key(key->dsa, bpub_key, NULL); + if (rc == 0) { + goto fail; } return SSH_OK; +fail: + DSA_free(key->dsa); + return SSH_ERROR; } int pki_pubkey_build_rsa(ssh_key key, ssh_string e, ssh_string n) { + int rc; + BIGNUM *be, *bn; + key->rsa = RSA_new(); if (key->rsa == NULL) { return SSH_ERROR; } - key->rsa->e = make_string_bn(e); - key->rsa->n = make_string_bn(n); - if (key->rsa->e == NULL || - key->rsa->n == NULL) { - RSA_free(key->rsa); - return SSH_ERROR; + be = make_string_bn(e); + bn = make_string_bn(n); + if (be == NULL || bn == NULL) { + goto fail; + } + + rc = RSA_set0_key(key->rsa, bn, be, NULL); + if (rc == 0) { + goto fail; } return SSH_OK; +fail: + RSA_free(key->rsa); + return SSH_ERROR; } ssh_string pki_publickey_to_blob(const ssh_key key) @@ -889,23 +966,26 @@ ssh_string pki_publickey_to_blob(const s } switch (key->type) { - case SSH_KEYTYPE_DSS: - p = make_bignum_string(key->dsa->p); + case SSH_KEYTYPE_DSS: { + const BIGNUM *bp, *bq, *bg, *bpub_key; + DSA_get0_pqg(key->dsa, &bp, &bq, &bg); + p = make_bignum_string((BIGNUM *)bp); if (p == NULL) { goto fail; } - q = make_bignum_string(key->dsa->q); + q = make_bignum_string((BIGNUM *)bq); if (q == NULL) { goto fail; } - g = make_bignum_string(key->dsa->g); + g = make_bignum_string((BIGNUM *)bg); if (g == NULL) { goto fail; } - n = make_bignum_string(key->dsa->pub_key); + DSA_get0_key(key->dsa, &bpub_key, NULL); + n = make_bignum_string((BIGNUM *)bpub_key); if (n == NULL) { goto fail; } @@ -937,14 +1017,17 @@ ssh_string pki_publickey_to_blob(const s n = NULL; break; + } case SSH_KEYTYPE_RSA: - case SSH_KEYTYPE_RSA1: - e = make_bignum_string(key->rsa->e); + case SSH_KEYTYPE_RSA1: { + const BIGNUM *be, *bn; + RSA_get0_key(key->rsa, &bn, &be, NULL); + e = make_bignum_string((BIGNUM *)be); if (e == NULL) { goto fail; } - n = make_bignum_string(key->rsa->n); + n = make_bignum_string((BIGNUM *)bn); if (n == NULL) { goto fail; } @@ -964,6 +1047,7 @@ ssh_string pki_publickey_to_blob(const s n = NULL; break; + } case SSH_KEYTYPE_ECDSA: #ifdef HAVE_OPENSSL_ECC rc = ssh_buffer_reinit(buffer); @@ -1065,13 +1149,15 @@ int pki_export_pubkey_rsa1(const ssh_key char *e; char *n; int rsa_size = RSA_size(key->rsa); + const BIGNUM *be, *bn; - e = bignum_bn2dec(key->rsa->e); + RSA_get0_key(key->rsa, &bn, &be, NULL); + e = bignum_bn2dec(be); if (e == NULL) { return SSH_ERROR; } - n = bignum_bn2dec(key->rsa->n); + n = bignum_bn2dec(bn); if (n == NULL) { OPENSSL_free(e); return SSH_ERROR; @@ -1136,6 +1222,7 @@ static ssh_string pki_dsa_signature_to_b { char buffer[40] = { 0 }; ssh_string sig_blob = NULL; + const BIGNUM *pr, *ps; ssh_string r; int r_len, r_offset_in, r_offset_out; @@ -1143,12 +1230,13 @@ static ssh_string pki_dsa_signature_to_b ssh_string s; int s_len, s_offset_in, s_offset_out; - r = make_bignum_string(sig->dsa_sig->r); + DSA_SIG_get0(sig->dsa_sig, &pr, &ps); + r = make_bignum_string((BIGNUM *)pr); if (r == NULL) { return NULL; } - s = make_bignum_string(sig->dsa_sig->s); + s = make_bignum_string((BIGNUM *)ps); if (s == NULL) { ssh_string_free(r); return NULL; @@ -1201,13 +1289,15 @@ ssh_string pki_signature_to_blob(const s ssh_string s; ssh_buffer b; int rc; + const BIGNUM *pr, *ps; b = ssh_buffer_new(); if (b == NULL) { return NULL; } - r = make_bignum_string(sig->ecdsa_sig->r); + ECDSA_SIG_get0(sig->ecdsa_sig, &pr, &ps); + r = make_bignum_string((BIGNUM *)pr); if (r == NULL) { ssh_buffer_free(b); return NULL; @@ -1219,7 +1309,7 @@ ssh_string pki_signature_to_blob(const s return NULL; } - s = make_bignum_string(sig->ecdsa_sig->s); + s = make_bignum_string((BIGNUM *)ps); if (s == NULL) { ssh_buffer_free(b); return NULL; @@ -1324,6 +1414,7 @@ ssh_signature pki_signature_from_blob(co ssh_string s; size_t len; int rc; + BIGNUM *pr = NULL, *ps = NULL; sig = ssh_signature_new(); if (sig == NULL) { @@ -1363,9 +1454,9 @@ ssh_signature pki_signature_from_blob(co } ssh_string_fill(r, ssh_string_data(sig_blob), 20); - sig->dsa_sig->r = make_string_bn(r); + pr = make_string_bn(r); ssh_string_free(r); - if (sig->dsa_sig->r == NULL) { + if (pr == NULL) { ssh_signature_free(sig); return NULL; } @@ -1377,9 +1468,15 @@ ssh_signature pki_signature_from_blob(co } ssh_string_fill(s, (char *)ssh_string_data(sig_blob) + 20, 20); - sig->dsa_sig->s = make_string_bn(s); + ps = make_string_bn(s); ssh_string_free(s); - if (sig->dsa_sig->s == NULL) { + if (ps == NULL) { + ssh_signature_free(sig); + return NULL; + } + + rc = DSA_SIG_set0(sig->dsa_sig, pr, ps); + if (rc == 0) { ssh_signature_free(sig); return NULL; } @@ -1427,10 +1524,10 @@ ssh_signature pki_signature_from_blob(co ssh_print_hexa("r", ssh_string_data(r), ssh_string_len(r)); #endif - make_string_bn_inplace(r, sig->ecdsa_sig->r); + pr = make_string_bn(r); ssh_string_burn(r); ssh_string_free(r); - if (sig->ecdsa_sig->r == NULL) { + if (pr == NULL) { ssh_buffer_free(b); ssh_signature_free(sig); return NULL; @@ -1448,10 +1545,16 @@ ssh_signature pki_signature_from_blob(co ssh_print_hexa("s", ssh_string_data(s), ssh_string_len(s)); #endif - make_string_bn_inplace(s, sig->ecdsa_sig->s); + ps = make_string_bn(s); ssh_string_burn(s); ssh_string_free(s); - if (sig->ecdsa_sig->s == NULL) { + if (ps == NULL) { + ssh_signature_free(sig); + return NULL; + } + + rc = ECDSA_SIG_set0(sig->ecdsa_sig, pr, ps); + if (rc == 0) { ssh_signature_free(sig); return NULL; } @@ -1578,8 +1681,12 @@ ssh_signature pki_do_sign(const ssh_key } #ifdef DEBUG_CRYPTO - ssh_print_bignum("r", sig->dsa_sig->r); - ssh_print_bignum("s", sig->dsa_sig->s); + { + const BIGNUM *pr, *ps; + DSA_SIG_get0(sig->dsa_sig, &pr, &ps); + ssh_print_bignum("r", (BIGNUM *) pr); + ssh_print_bignum("s", (BIGNUM *) ps); + } #endif break; @@ -1601,8 +1708,12 @@ ssh_signature pki_do_sign(const ssh_key } # ifdef DEBUG_CRYPTO - ssh_print_bignum("r", sig->ecdsa_sig->r); - ssh_print_bignum("s", sig->ecdsa_sig->s); + { + const BIGNUM *pr, *ps; + ECDSA_SIG_get0(sig->ecdsa_sig, &pr, &ps); + ssh_print_bignum("r", (BIGNUM *) pr); + ssh_print_bignum("s", (BIGNUM *) ps); + } # endif /* DEBUG_CRYPTO */ break;
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
