From 63a221007c62b14e40995a94a351452d4b0501d0 Mon Sep 17 00:00:00 2001 From: csoler Date: Sat, 18 Feb 2017 14:40:44 +0100 Subject: [PATCH 01/25] fixing compilation with openssl-1.1.0 (part 1) --- openpgpsdk/src/openpgpsdk/openssl_crypto.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/openpgpsdk/src/openpgpsdk/openssl_crypto.c b/openpgpsdk/src/openpgpsdk/openssl_crypto.c index a9457208c..afb92f22d 100644 --- a/openpgpsdk/src/openpgpsdk/openssl_crypto.c +++ b/openpgpsdk/src/openpgpsdk/openssl_crypto.c @@ -45,10 +45,17 @@ void test_secret_key(const ops_secret_key_t *skey) { RSA* test=RSA_new(); +#if OPENSSL_VERSION_NUMBER < 0x10100000L test->n=BN_dup(skey->public_key.key.rsa.n); test->e=BN_dup(skey->public_key.key.rsa.e); - test->d=BN_dup(skey->key.rsa.d); +#else + RSA_set0_key(test, + BN_dup(skey->public_key.key.rsa.n), + BN_dup(skey->public_key.key.rsa.e), + BN_dup(skey->key.rsa.d)); +#endif + test->p=BN_dup(skey->key.rsa.p); test->q=BN_dup(skey->key.rsa.q); @@ -392,8 +399,13 @@ ops_boolean_t ops_dsa_verify(const unsigned char *hash,size_t hash_length, int ret; osig=DSA_SIG_new(); + +#if OPENSSL_VERSION_NUMBER < 0x10100000L osig->r=sig->r; osig->s=sig->s; +#else + DSA_SIG_set0(osig,sig->r,sig->s) ; +#endif if(BN_num_bits(dsa->q) != 160) { From ba52b059686abbd80982025045ca04be44725ff8 Mon Sep 17 00:00:00 2001 From: csoler Date: Sat, 18 Feb 2017 15:28:27 +0100 Subject: [PATCH 02/25] fixing compilation for openssl-1.1.0 (part 2) --- openpgpsdk/src/openpgpsdk/openssl_crypto.c | 29 ++++++++++++---------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/openpgpsdk/src/openpgpsdk/openssl_crypto.c b/openpgpsdk/src/openpgpsdk/openssl_crypto.c index afb92f22d..c68f13021 100644 --- a/openpgpsdk/src/openpgpsdk/openssl_crypto.c +++ b/openpgpsdk/src/openpgpsdk/openssl_crypto.c @@ -49,15 +49,17 @@ void test_secret_key(const ops_secret_key_t *skey) test->n=BN_dup(skey->public_key.key.rsa.n); test->e=BN_dup(skey->public_key.key.rsa.e); test->d=BN_dup(skey->key.rsa.d); + + test->p=BN_dup(skey->key.rsa.p); + test->q=BN_dup(skey->key.rsa.q); #else RSA_set0_key(test, BN_dup(skey->public_key.key.rsa.n), BN_dup(skey->public_key.key.rsa.e), BN_dup(skey->key.rsa.d)); -#endif - test->p=BN_dup(skey->key.rsa.p); - test->q=BN_dup(skey->key.rsa.q); + RSA_set0_factors(test, BN_dup(skey->key.rsa.p), BN_dup(skey->key.rsa.q)); +#endif assert(RSA_check_key(test)==1); RSA_free(test); @@ -401,10 +403,10 @@ ops_boolean_t ops_dsa_verify(const unsigned char *hash,size_t hash_length, osig=DSA_SIG_new(); #if OPENSSL_VERSION_NUMBER < 0x10100000L - osig->r=sig->r; - osig->s=sig->s; + osig->r=BN_dup(sig->r); + osig->s=BN_dup(sig->s); #else - DSA_SIG_set0(osig,sig->r,sig->s) ; + DSA_SIG_set0(osig,BN_dup(sig->r),BN_dup(sig->s)) ; #endif if(BN_num_bits(dsa->q) != 160) @@ -414,15 +416,18 @@ ops_boolean_t ops_dsa_verify(const unsigned char *hash,size_t hash_length, fprintf(stderr,"(WW) ops_dsa_verify: openssl does only supports 'q' of 160 bits. Current is %d bits.\n",BN_num_bits(dsa->q)) ; already_said=ops_true ; } - osig->r=osig->s=NULL; DSA_SIG_free(osig); return ops_false ; } odsa=DSA_new(); - odsa->p=dsa->p; - odsa->q=dsa->q; - odsa->g=dsa->g; +#if OPENSSL_VERSION_NUMBER < 0x10100000L + odsa->p=BN_dup(dsa->p); + odsa->q=BN_dup(dsa->q); + odsa->g=BN_dup(dsa->g); +#else + DSA_set0_pqg(BN_dup(dsa->p),BN_dup(dsa->q),BN_dup(dsa->g)); +#endif odsa->pub_key=dsa->y; if (debug) @@ -457,10 +462,8 @@ ops_boolean_t ops_dsa_verify(const unsigned char *hash,size_t hash_length, return ops_false ; } - odsa->p=odsa->q=odsa->g=odsa->pub_key=NULL; + odsa->pub_key=NULL; DSA_free(odsa); - - osig->r=osig->s=NULL; DSA_SIG_free(osig); return ret != 0; From 262fa9c593304b74aae7434ae9e5b5be139ff783 Mon Sep 17 00:00:00 2001 From: csoler Date: Sat, 18 Feb 2017 15:45:45 +0100 Subject: [PATCH 03/25] fixing compilation for openssl-1.1.0 (part 3) --- openpgpsdk/src/openpgpsdk/openssl_crypto.c | 42 +++++++++++++++++----- 1 file changed, 33 insertions(+), 9 deletions(-) diff --git a/openpgpsdk/src/openpgpsdk/openssl_crypto.c b/openpgpsdk/src/openpgpsdk/openssl_crypto.c index c68f13021..2f61285a8 100644 --- a/openpgpsdk/src/openpgpsdk/openssl_crypto.c +++ b/openpgpsdk/src/openpgpsdk/openssl_crypto.c @@ -403,10 +403,10 @@ ops_boolean_t ops_dsa_verify(const unsigned char *hash,size_t hash_length, osig=DSA_SIG_new(); #if OPENSSL_VERSION_NUMBER < 0x10100000L - osig->r=BN_dup(sig->r); - osig->s=BN_dup(sig->s); + osig->r=sig->r; + osig->s=sig->s; #else - DSA_SIG_set0(osig,BN_dup(sig->r),BN_dup(sig->s)) ; + DSA_SIG_set0(osig,sig->r,sig->s) ; #endif if(BN_num_bits(dsa->q) != 160) @@ -422,13 +422,15 @@ ops_boolean_t ops_dsa_verify(const unsigned char *hash,size_t hash_length, odsa=DSA_new(); #if OPENSSL_VERSION_NUMBER < 0x10100000L - odsa->p=BN_dup(dsa->p); - odsa->q=BN_dup(dsa->q); - odsa->g=BN_dup(dsa->g); -#else - DSA_set0_pqg(BN_dup(dsa->p),BN_dup(dsa->q),BN_dup(dsa->g)); -#endif + odsa->p=dsa->p; + odsa->q=dsa->q; + odsa->g=dsa->g; + odsa->pub_key=dsa->y; +#else + DSA_set0_pqg(odsa,dsa->p,dsa->q,dsa->g); + DSA_set0_key(odsa,dsa->y,NULL) ; +#endif if (debug) { @@ -462,7 +464,21 @@ ops_boolean_t ops_dsa_verify(const unsigned char *hash,size_t hash_length, return ops_false ; } +#if OPENSSL_VERSION_NUMBER < 0x10100000L + osig->r=NULL; + osig->s=NULL; + + odsa->p=NULL; + odsa->q=NULL; + odsa->g=NULL; odsa->pub_key=NULL; +#else + DSA_SIG_set0(osig,NULL,NULL) ; + + DSA_set0_pqg(odsa,NULL,NULL,NULL); + DSA_set0_key(odsa,NULL,NULL) ; +#endif + DSA_free(odsa); DSA_SIG_free(osig); @@ -485,12 +501,20 @@ int ops_rsa_public_decrypt(unsigned char *out,const unsigned char *in, int n; orsa=RSA_new(); +#if OPENSSL_VERSION_NUMBER < 0x10100000L orsa->n=rsa->n; orsa->e=rsa->e; +#else + RSA_set0_key(orsa,rsa->n,rsa->e,NULL) ; +#endif n=RSA_public_decrypt(length,in,out,orsa,RSA_NO_PADDING); +#if OPENSSL_VERSION_NUMBER < 0x10100000L orsa->n=orsa->e=NULL; +#else + RSA_set0_key(orsa,NULL,NULL,NULL) ; +#endif RSA_free(orsa); return n; From 13a8389f6825a342828b5bab858daf839d918e5f Mon Sep 17 00:00:00 2001 From: csoler Date: Sat, 18 Feb 2017 16:21:17 +0100 Subject: [PATCH 04/25] fixing compilation for openssl-1.1.0 (part 4) --- openpgpsdk/src/openpgpsdk/openssl_crypto.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/openpgpsdk/src/openpgpsdk/openssl_crypto.c b/openpgpsdk/src/openpgpsdk/openssl_crypto.c index 2f61285a8..f4cb28f05 100644 --- a/openpgpsdk/src/openpgpsdk/openssl_crypto.c +++ b/openpgpsdk/src/openpgpsdk/openssl_crypto.c @@ -444,7 +444,8 @@ ops_boolean_t ops_dsa_verify(const unsigned char *hash,size_t hash_length, } //printf("hash_length=%ld\n", hash_length); //printf("Q=%d\n", BN_num_bytes(odsa->q)); - unsigned int qlen=BN_num_bytes(odsa->q); + unsigned int qlen=BN_num_bytes(dsa->q); + if (qlen < hash_length) hash_length=qlen; // ret=DSA_do_verify(hash,hash_length,osig,odsa); @@ -538,6 +539,7 @@ int ops_rsa_private_encrypt(unsigned char *out,const unsigned char *in, int n; orsa=RSA_new(); +#if OPENSSL_VERSION_NUMBER < 0x10100000L orsa->n=rsa->n; // XXX: do we need n? orsa->d=srsa->d; orsa->p=srsa->q; @@ -545,17 +547,31 @@ int ops_rsa_private_encrypt(unsigned char *out,const unsigned char *in, /* debug */ orsa->e=rsa->e; + // If this isn't set, it's very likely that the programmer hasn't // decrypted the secret key. RSA_check_key segfaults in that case. // Use ops_decrypt_secret_key_from_data() to do that. assert(orsa->d); +#else + RSA_set0_key(orsa,rsa->n,rsa->e,rsa->d) ; + RSA_set0_factors(orsa,rsa->p,rsa->q); +#endif + assert(RSA_check_key(orsa) == 1); orsa->e=NULL; /* end debug */ + // WARNING: this function should *never* be called for direct encryption, because of the padding. + // It's actually only called in the signature function now, where an adapted padding is placed. + n=RSA_private_encrypt(length,in,out,orsa,RSA_NO_PADDING); +#if OPENSSL_VERSION_NUMBER < 0x10100000L orsa->n=orsa->d=orsa->p=orsa->q=NULL; +#else + RSA_set0_key(orsa,NULL,NULL,NULL); + RSA_set0_factors(orsa,NULL,NULL); +#endif RSA_free(orsa); return n; From 70e2a67786a924479039da43c66d64b7288a1dc5 Mon Sep 17 00:00:00 2001 From: csoler Date: Sat, 18 Feb 2017 16:40:38 +0100 Subject: [PATCH 05/25] fixing compilation for openssl-1.1.0 (part 5) --- openpgpsdk/src/openpgpsdk/openssl_crypto.c | 31 ++++++++++------------ 1 file changed, 14 insertions(+), 17 deletions(-) diff --git a/openpgpsdk/src/openpgpsdk/openssl_crypto.c b/openpgpsdk/src/openpgpsdk/openssl_crypto.c index f4cb28f05..ad8a235ee 100644 --- a/openpgpsdk/src/openpgpsdk/openssl_crypto.c +++ b/openpgpsdk/src/openpgpsdk/openssl_crypto.c @@ -406,7 +406,7 @@ ops_boolean_t ops_dsa_verify(const unsigned char *hash,size_t hash_length, osig->r=sig->r; osig->s=sig->s; #else - DSA_SIG_set0(osig,sig->r,sig->s) ; + DSA_SIG_set0(osig,BN_dup(sig->r),BN_dup(sig->s)) ; #endif if(BN_num_bits(dsa->q) != 160) @@ -428,8 +428,8 @@ ops_boolean_t ops_dsa_verify(const unsigned char *hash,size_t hash_length, odsa->pub_key=dsa->y; #else - DSA_set0_pqg(odsa,dsa->p,dsa->q,dsa->g); - DSA_set0_key(odsa,dsa->y,NULL) ; + DSA_set0_pqg(odsa,BN_dup(dsa->p),BN_dup(dsa->q),BN_dup(dsa->g)); + DSA_set0_key(odsa,BN_dup(dsa->y),NULL) ; #endif if (debug) @@ -473,11 +473,6 @@ ops_boolean_t ops_dsa_verify(const unsigned char *hash,size_t hash_length, odsa->q=NULL; odsa->g=NULL; odsa->pub_key=NULL; -#else - DSA_SIG_set0(osig,NULL,NULL) ; - - DSA_set0_pqg(odsa,NULL,NULL,NULL); - DSA_set0_key(odsa,NULL,NULL) ; #endif DSA_free(odsa); @@ -506,15 +501,13 @@ int ops_rsa_public_decrypt(unsigned char *out,const unsigned char *in, orsa->n=rsa->n; orsa->e=rsa->e; #else - RSA_set0_key(orsa,rsa->n,rsa->e,NULL) ; + RSA_set0_key(orsa,BN_dup(rsa->n),BN_dup(rsa->e),NULL) ; #endif n=RSA_public_decrypt(length,in,out,orsa,RSA_NO_PADDING); #if OPENSSL_VERSION_NUMBER < 0x10100000L orsa->n=orsa->e=NULL; -#else - RSA_set0_key(orsa,NULL,NULL,NULL) ; #endif RSA_free(orsa); @@ -553,12 +546,11 @@ int ops_rsa_private_encrypt(unsigned char *out,const unsigned char *in, // Use ops_decrypt_secret_key_from_data() to do that. assert(orsa->d); #else - RSA_set0_key(orsa,rsa->n,rsa->e,rsa->d) ; - RSA_set0_factors(orsa,rsa->p,rsa->q); + RSA_set0_key(orsa,BN_dup(rsa->n),BN_dup(rsa->e),BN_dup(srsa->d)) ; + RSA_set0_factors(orsa,BN_dup(srsa->p),BN_dup(srsa->q)); #endif assert(RSA_check_key(orsa) == 1); - orsa->e=NULL; /* end debug */ // WARNING: this function should *never* be called for direct encryption, because of the padding. @@ -568,9 +560,7 @@ int ops_rsa_private_encrypt(unsigned char *out,const unsigned char *in, #if OPENSSL_VERSION_NUMBER < 0x10100000L orsa->n=orsa->d=orsa->p=orsa->q=NULL; -#else - RSA_set0_key(orsa,NULL,NULL,NULL); - RSA_set0_factors(orsa,NULL,NULL); + orsa->e=NULL; #endif RSA_free(orsa); @@ -858,15 +848,22 @@ DSA_SIG* ops_dsa_sign(unsigned char* hashbuf, unsigned hashsize, const ops_dsa_s DSA_SIG *dsasig; odsa=DSA_new(); +#if OPENSSL_VERSION_NUMBER < 0x10100000L odsa->p=dsa->p; odsa->q=dsa->q; odsa->g=dsa->g; odsa->pub_key=dsa->y; odsa->priv_key=sdsa->x; +#else + DSA_set0_pqg(odsa,BN_dup(dsa->p),BN_dup(dsa->q),BN_dup(dsa->g)); + DSA_set0_key(odsa,BN_dup(dsa->y),BN_dup(sdsa->x)); +#endif dsasig=DSA_do_sign(hashbuf,hashsize,odsa); +#if OPENSSL_VERSION_NUMBER < 0x10100000L odsa->p=odsa->q=odsa->g=odsa->pub_key=odsa->priv_key=NULL; +#endif DSA_free(odsa); return dsasig; From 5951f460f663727570c59d70b7df8576ce760c75 Mon Sep 17 00:00:00 2001 From: csoler Date: Sat, 18 Feb 2017 16:49:35 +0100 Subject: [PATCH 06/25] fixing compilation for openssl-1.1.0 (part 6) --- openpgpsdk/src/openpgpsdk/openssl_crypto.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/openpgpsdk/src/openpgpsdk/openssl_crypto.c b/openpgpsdk/src/openpgpsdk/openssl_crypto.c index ad8a235ee..7d5555ca3 100644 --- a/openpgpsdk/src/openpgpsdk/openssl_crypto.c +++ b/openpgpsdk/src/openpgpsdk/openssl_crypto.c @@ -586,15 +586,19 @@ int ops_rsa_private_decrypt(unsigned char *out,const unsigned char *in, char errbuf[1024]; orsa=RSA_new(); +#if OPENSSL_VERSION_NUMBER < 0x10100000L orsa->n=rsa->n; // XXX: do we need n? orsa->d=srsa->d; orsa->p=srsa->q; orsa->q=srsa->p; + orsa->e=rsa->e; +#else + RSA_set0_key(orsa,BN_dup(rsa->n),BN_dup(rsa->e),BN_dup(srsa->d)) ; + RSA_set0_factors(orsa,BN_dup(srsa->p),BN_dup(srsa->q)); +#endif /* debug */ - orsa->e=rsa->e; assert(RSA_check_key(orsa) == 1); - orsa->e=NULL; /* end debug */ n=RSA_private_decrypt(length,in,out,orsa,RSA_NO_PADDING); @@ -608,7 +612,10 @@ int ops_rsa_private_decrypt(unsigned char *out,const unsigned char *in, ERR_error_string(err,&errbuf[0]); fprintf(stderr,"openssl error : %s\n",errbuf); } +#if OPENSSL_VERSION_NUMBER < 0x10100000L orsa->n=orsa->d=orsa->p=orsa->q=NULL; + orsa->e=NULL; +#endif RSA_free(orsa); return n; @@ -631,8 +638,12 @@ int ops_rsa_public_encrypt(unsigned char *out,const unsigned char *in, // printf("ops_rsa_public_encrypt: length=%ld\n", length); orsa=RSA_new(); +#if OPENSSL_VERSION_NUMBER < 0x10100000L orsa->n=rsa->n; orsa->e=rsa->e; +#else + RSA_set0_key(orsa,BN_dup(rsa->n),BN_dup(rsa->e),NULL); +#endif // printf("len: %ld\n", length); // ops_print_bn("n: ", orsa->n); @@ -647,7 +658,9 @@ int ops_rsa_public_encrypt(unsigned char *out,const unsigned char *in, BIO_free(fd_out) ; } +#if OPENSSL_VERSION_NUMBER < 0x10100000L orsa->n=orsa->e=NULL; +#endif RSA_free(orsa); return n; From deb3a49b6a97379b22b92aa07c7413261f4a2136 Mon Sep 17 00:00:00 2001 From: csoler Date: Sat, 18 Feb 2017 17:00:46 +0100 Subject: [PATCH 07/25] fixing compilation for openssl-1.1.0 (part 7) --- openpgpsdk/src/openpgpsdk/openssl_crypto.c | 23 +++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/openpgpsdk/src/openpgpsdk/openssl_crypto.c b/openpgpsdk/src/openpgpsdk/openssl_crypto.c index 7d5555ca3..768abab8e 100644 --- a/openpgpsdk/src/openpgpsdk/openssl_crypto.c +++ b/openpgpsdk/src/openpgpsdk/openssl_crypto.c @@ -738,8 +738,19 @@ ops_boolean_t ops_rsa_generate_keypair(const int numbits, const unsigned long e, skey->public_key.days_valid=0; skey->public_key.algorithm= OPS_PKA_RSA; +#if OPENSSL_VERSION_NUMBER < 0x10100000L skey->public_key.key.rsa.n=BN_dup(rsa->n); skey->public_key.key.rsa.e=BN_dup(rsa->e); + skey->key.rsa.d=BN_dup(rsa->d); +#else + BIGNUM *nn=NULL,*ee=NULL,*dd=NULL ; + + RSA_get0_key(rsa,&nn,&ee,&dd) ; + + skey->public_key.key.rsa.n=BN_dup(nn) ; + skey->public_key.key.rsa.e=BN_dup(ee) ; + skey->public_key.key.rsa.e=BN_dup(dd) ; +#endif skey->s2k_usage=OPS_S2KU_ENCRYPTED_AND_HASHED; skey->s2k_specifier=OPS_S2KS_SALTED; @@ -749,10 +760,20 @@ ops_boolean_t ops_rsa_generate_keypair(const int numbits, const unsigned long e, skey->octet_count=0; skey->checksum=0; - skey->key.rsa.d=BN_dup(rsa->d); +#if OPENSSL_VERSION_NUMBER < 0x10100000L skey->key.rsa.p=BN_dup(rsa->p); skey->key.rsa.q=BN_dup(rsa->q); skey->key.rsa.u=BN_mod_inverse(NULL,rsa->p, rsa->q, ctx); +#else + BIGNUM *pp=NULL,*qq=NULL ; + + RSA_get0_factors(rsa,&pp,&qq) ; + + skey->key.rsa.p=BN_dup(pp); + skey->key.rsa.q=BN_dup(qq); + + skey->key.rsa.u=BN_mod_inverse(NULL,pp,qq, ctx); +#endif assert(skey->key.rsa.u); BN_CTX_free(ctx); From d5e679299c51f7ce7410873a5abf86dab9bd87ae Mon Sep 17 00:00:00 2001 From: csoler Date: Sat, 18 Feb 2017 18:09:49 +0100 Subject: [PATCH 08/25] fixing compilation for openssl-1.1.0 (part 8) --- openpgpsdk/src/openpgpsdk/signature.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/openpgpsdk/src/openpgpsdk/signature.c b/openpgpsdk/src/openpgpsdk/signature.c index 87b4def70..109d39fc7 100644 --- a/openpgpsdk/src/openpgpsdk/signature.c +++ b/openpgpsdk/src/openpgpsdk/signature.c @@ -298,8 +298,18 @@ static ops_boolean_t dsa_sign(ops_hash_t *hash, const ops_dsa_public_key_t *dsa, dsasig=ops_dsa_sign(hashbuf, hashsize, sdsa, dsa); // convert and write the sig out to memory +#if OPENSSL_VERSION_NUMBER < 0x10100000L ops_write_mpi(dsasig->r, cinfo); ops_write_mpi(dsasig->s, cinfo); +#else + BIGNUM *rr=NULL,*ss=NULL ; + + DSA_SIG_get0(&rr,&ss) ; + + ops_write_mpi(rr, cinfo); + ops_write_mpi(ss, cinfo); +#endif + DSA_SIG_free(dsasig); return ops_true ; From fc1a792a12219148f7fdfcb9d9d1edcc74f13b91 Mon Sep 17 00:00:00 2001 From: csoler Date: Sat, 18 Feb 2017 18:16:10 +0100 Subject: [PATCH 09/25] fixing compilation for openssl-1.1.0 (part 9) --- openpgpsdk/src/openpgpsdk/signature.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/openpgpsdk/src/openpgpsdk/signature.c b/openpgpsdk/src/openpgpsdk/signature.c index 109d39fc7..e6820e325 100644 --- a/openpgpsdk/src/openpgpsdk/signature.c +++ b/openpgpsdk/src/openpgpsdk/signature.c @@ -302,9 +302,9 @@ static ops_boolean_t dsa_sign(ops_hash_t *hash, const ops_dsa_public_key_t *dsa, ops_write_mpi(dsasig->r, cinfo); ops_write_mpi(dsasig->s, cinfo); #else - BIGNUM *rr=NULL,*ss=NULL ; + const BIGNUM *rr=NULL,*ss=NULL ; - DSA_SIG_get0(&rr,&ss) ; + DSA_SIG_get0(dsasig,&rr,&ss) ; ops_write_mpi(rr, cinfo); ops_write_mpi(ss, cinfo); From 01e89bb0d8e346b812275889c82e6f4723812d53 Mon Sep 17 00:00:00 2001 From: csoler Date: Sat, 18 Feb 2017 23:47:47 +0100 Subject: [PATCH 10/25] fixing compilation for openssl-1.1.0 (part 10) --- openpgpsdk/src/openpgpsdk/signature.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openpgpsdk/src/openpgpsdk/signature.c b/openpgpsdk/src/openpgpsdk/signature.c index e6820e325..7195d8007 100644 --- a/openpgpsdk/src/openpgpsdk/signature.c +++ b/openpgpsdk/src/openpgpsdk/signature.c @@ -302,7 +302,7 @@ static ops_boolean_t dsa_sign(ops_hash_t *hash, const ops_dsa_public_key_t *dsa, ops_write_mpi(dsasig->r, cinfo); ops_write_mpi(dsasig->s, cinfo); #else - const BIGNUM *rr=NULL,*ss=NULL ; + BIGNUM *rr=NULL,*ss=NULL ; DSA_SIG_get0(dsasig,&rr,&ss) ; From 0c77a102248c237d97b1845201b09ab2a853d821 Mon Sep 17 00:00:00 2001 From: csoler Date: Sat, 18 Feb 2017 23:47:53 +0100 Subject: [PATCH 11/25] fixing compilation for openssl-1.1.0 (part 11) --- libretroshare/src/tcponudp/bss_tou.c | 59 ++++++++++++++++------------ 1 file changed, 33 insertions(+), 26 deletions(-) diff --git a/libretroshare/src/tcponudp/bss_tou.c b/libretroshare/src/tcponudp/bss_tou.c index f96abb19d..1637b4c65 100644 --- a/libretroshare/src/tcponudp/bss_tou.c +++ b/libretroshare/src/tcponudp/bss_tou.c @@ -90,7 +90,13 @@ static int clear_tou_socket_error(int s); #include "tou.h" - +#if OPENSSL_VERSION_NUMBER < 0x10100000L +static int BIO_get_shutdown(BIO *a) { return a->shutdown; } +static void BIO_set_shutdown(BIO *a,int s) { a->shutdown=s; } +static int BIO_get_init(BIO *a) { return a->init; } +static void BIO_set_init(BIO *a,int i) { a->init=i; } +static void BIO_set_data(BIO *a,void *p) { a->ptr = p; } +#endif static BIO_METHOD methods_tou_sockp= { @@ -132,10 +138,10 @@ static int tou_socket_new(BIO *bi) #ifdef DEBUG_TOU_BIO fprintf(stderr, "tou_socket_new()\n"); #endif - bi->init=0; - bi->num=0; - bi->ptr=NULL; - bi->flags=0; + BIO_set_init(bi,0) ; + BIO_set_data(bi,NULL) ; // sets bi->ptr + BIO_set_flags(bi,0) ; + BIO_set_fd(bi,0,0) ; return(1); } @@ -145,14 +151,15 @@ static int tou_socket_free(BIO *a) fprintf(stderr, "tou_socket_free()\n"); #endif if (a == NULL) return(0); - if (a->shutdown) + + if(BIO_get_shutdown(a)) { - if (a->init) + if(BIO_get_init(a)) { - tou_close(a->num); + tou_close(BIO_get_fd(a,NULL)); } - a->init=0; - a->flags=0; + BIO_set_init(a,0) ; + BIO_set_flags(a,0) ; } return(1); } @@ -166,13 +173,13 @@ static int tou_socket_read(BIO *b, char *out, int outl) if (out != NULL) { - clear_tou_socket_error(b->num); + clear_tou_socket_error(BIO_get_fd(b,NULL)); /* call tou library */ - ret=tou_read(b->num,out,outl); + ret=tou_read(BIO_get_fd(b,NULL),out,outl); BIO_clear_retry_flags(b); if (ret <= 0) { - if (BIO_tou_socket_should_retry(b->num, ret)) + if (BIO_tou_socket_should_retry(BIO_get_fd(b,NULL), ret)) BIO_set_retry_read(b); } } @@ -189,13 +196,13 @@ static int tou_socket_write(BIO *b, const char *in, int inl) fprintf(stderr, "tou_socket_write(%p,%p,%d)\n",b,in,inl); #endif - clear_tou_socket_error(b->num); + clear_tou_socket_error(BIO_get_fd(b,NULL)); /* call tou library */ - ret=tou_write(b->num,in,inl); + ret=tou_write(BIO_get_fd(b,NULL),in,inl); BIO_clear_retry_flags(b); if (ret <= 0) { - if (BIO_tou_socket_should_retry(b->num,ret)) + if (BIO_tou_socket_should_retry(BIO_get_fd(b,NULL),ret)) { BIO_set_retry_write(b); #ifdef DEBUG_TOU_BIO @@ -230,34 +237,34 @@ static long tou_socket_ctrl(BIO *b, int cmd, long num, void *ptr) break; case BIO_C_SET_FD: tou_socket_free(b); - b->num= *((int *)ptr); - b->shutdown=(int)num; - b->init=1; + BIO_set_fd(b,*((int *)ptr),0); + BIO_set_shutdown(b,(int)num) ; + BIO_set_init(b,1) ; break; case BIO_C_GET_FD: - if (b->init) + if (BIO_get_init(b)) { ip=(int *)ptr; - if (ip != NULL) *ip=b->num; - ret=b->num; + if (ip != NULL) *ip=BIO_get_fd(b,NULL); + ret=BIO_get_fd(b,NULL); } else ret= -1; break; case BIO_CTRL_GET_CLOSE: - ret=b->shutdown; + ret=BIO_get_shutdown(b); break; case BIO_CTRL_SET_CLOSE: - b->shutdown=(int)num; + BIO_set_shutdown(b,(int)num) ; break; case BIO_CTRL_PENDING: - ret = tou_maxread(b->num); + ret = tou_maxread(BIO_get_fd(b,NULL)); #ifdef DEBUG_TOU_BIO fprintf(stderr, "tou_pending = %ld\n", ret); #endif break; case BIO_CTRL_WPENDING: - ret = tou_maxwrite(b->num); + ret = tou_maxwrite(BIO_get_fd(b,NULL)); #ifdef DEBUG_TOU_BIO fprintf(stderr, "tou_wpending = %ld\n", ret); #endif From 175664e10e89707c7a2f13070e807e596050bf7a Mon Sep 17 00:00:00 2001 From: csoler Date: Sat, 18 Feb 2017 23:58:47 +0100 Subject: [PATCH 12/25] fixing compilation for openssl-1.1.0 (part 12) --- libretroshare/src/tcponudp/bss_tou.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/libretroshare/src/tcponudp/bss_tou.c b/libretroshare/src/tcponudp/bss_tou.c index 1637b4c65..34b935e0e 100644 --- a/libretroshare/src/tcponudp/bss_tou.c +++ b/libretroshare/src/tcponudp/bss_tou.c @@ -96,6 +96,20 @@ static void BIO_set_shutdown(BIO *a,int s) { a->shutdown=s; } static int BIO_get_init(BIO *a) { return a->init; } static void BIO_set_init(BIO *a,int i) { a->init=i; } static void BIO_set_data(BIO *a,void *p) { a->ptr = p; } +#else +typedef struct bio_method_st { + int type; + const char *name; + int (*bwrite) (BIO *, const char *, int); + int (*bread) (BIO *, char *, int); + int (*bputs) (BIO *, const char *); + int (*bgets) (BIO *, char *, int); + long (*ctrl) (BIO *, int, long, void *); + int (*create) (BIO *); + int (*destroy) (BIO *); + long (*callback_ctrl) (BIO *, int, bio_info_cb *); +} BIO_METHOD; + #endif static BIO_METHOD methods_tou_sockp= From d7bfc3264bf03ce0ac87414aa0bb1e4efccfbb6e Mon Sep 17 00:00:00 2001 From: csoler Date: Sun, 19 Feb 2017 10:56:33 +0100 Subject: [PATCH 13/25] fixing compilation for openssl-1.1.0 (chacha20.cc, HMAC structure) --- libretroshare/src/crypto/chacha20.cpp | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/libretroshare/src/crypto/chacha20.cpp b/libretroshare/src/crypto/chacha20.cpp index bee4f034e..612533130 100644 --- a/libretroshare/src/crypto/chacha20.cpp +++ b/libretroshare/src/crypto/chacha20.cpp @@ -537,6 +537,7 @@ bool AEAD_chacha20_sha256(uint8_t key[32], uint8_t nonce[12],uint8_t *data,uint3 uint8_t computed_tag[EVP_MAX_MD_SIZE]; unsigned int md_size ; +#if OPENSSL_VERSION_NUMBER < 0x10100000L HMAC_CTX hmac_ctx ; HMAC_CTX_init(&hmac_ctx) ; @@ -544,6 +545,17 @@ bool AEAD_chacha20_sha256(uint8_t key[32], uint8_t nonce[12],uint8_t *data,uint3 HMAC_Update(&hmac_ctx,aad,aad_size) ; HMAC_Update(&hmac_ctx,data,data_size) ; HMAC_Final(&hmac_ctx,computed_tag,&md_size) ; +#else + HMAC_CTX *hmac_ctx = HMAC_CTX_new(); + + HMAC_Init_ex(hmac_ctx,key,32,EVP_sha256()) ; + HMAC_Update(hmac_ctx,aad,aad_size) ; + HMAC_Update(hmac_ctx,data,data_size) ; + HMAC_Final(hmac_ctx,computed_tag,&md_size) ; + + HMAC_CTX_free(hmac_ctx) ; + hmac_ctx=NULL; +#endif assert(md_size >= 16); @@ -556,6 +568,7 @@ bool AEAD_chacha20_sha256(uint8_t key[32], uint8_t nonce[12],uint8_t *data,uint3 uint8_t computed_tag[EVP_MAX_MD_SIZE]; unsigned int md_size ; +#if OPENSSL_VERSION_NUMBER < 0x10100000L HMAC_CTX hmac_ctx ; HMAC_CTX_init(&hmac_ctx) ; @@ -563,6 +576,14 @@ bool AEAD_chacha20_sha256(uint8_t key[32], uint8_t nonce[12],uint8_t *data,uint3 HMAC_Update(&hmac_ctx,aad,aad_size) ; HMAC_Update(&hmac_ctx,data,data_size) ; HMAC_Final(&hmac_ctx,computed_tag,&md_size) ; +#else + HMAC_CTX *hmac_ctx = HMAC_CTX_new(); + + HMAC_Init_ex(hmac_ctx,key,32,EVP_sha256()) ; + HMAC_Update(hmac_ctx,aad,aad_size) ; + HMAC_Update(hmac_ctx,data,data_size) ; + HMAC_Final(hmac_ctx,computed_tag,&md_size) ; +#endif // decrypt From 57bbd158936f1fa1a29bee03eca05e17095a0e8f Mon Sep 17 00:00:00 2001 From: csoler Date: Sun, 19 Feb 2017 11:10:25 +0100 Subject: [PATCH 14/25] fixing compilation for openssl-1.1.0 (chacha20.cc, HMAC structure, part 2) --- libretroshare/src/crypto/chacha20.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libretroshare/src/crypto/chacha20.cpp b/libretroshare/src/crypto/chacha20.cpp index 612533130..5219983a4 100644 --- a/libretroshare/src/crypto/chacha20.cpp +++ b/libretroshare/src/crypto/chacha20.cpp @@ -548,7 +548,7 @@ bool AEAD_chacha20_sha256(uint8_t key[32], uint8_t nonce[12],uint8_t *data,uint3 #else HMAC_CTX *hmac_ctx = HMAC_CTX_new(); - HMAC_Init_ex(hmac_ctx,key,32,EVP_sha256()) ; + HMAC_Init_ex(hmac_ctx,key,32,EVP_sha256(),NULL) ; HMAC_Update(hmac_ctx,aad,aad_size) ; HMAC_Update(hmac_ctx,data,data_size) ; HMAC_Final(hmac_ctx,computed_tag,&md_size) ; @@ -579,7 +579,7 @@ bool AEAD_chacha20_sha256(uint8_t key[32], uint8_t nonce[12],uint8_t *data,uint3 #else HMAC_CTX *hmac_ctx = HMAC_CTX_new(); - HMAC_Init_ex(hmac_ctx,key,32,EVP_sha256()) ; + HMAC_Init_ex(hmac_ctx,key,32,EVP_sha256(),NULL) ; HMAC_Update(hmac_ctx,aad,aad_size) ; HMAC_Update(hmac_ctx,data,data_size) ; HMAC_Final(hmac_ctx,computed_tag,&md_size) ; From 5c95b880956b575af37e868d91ebb7c2e827fe6e Mon Sep 17 00:00:00 2001 From: csoler Date: Sun, 19 Feb 2017 22:38:02 +0100 Subject: [PATCH 15/25] compilation fix for openssl-1.1.0 (pqissl+authssl part) --- libretroshare/src/crypto/chacha20.cpp | 3 + libretroshare/src/pqi/authssl.cc | 149 ++++++++++++++++++------ libretroshare/src/pqi/pqissl.cc | 9 ++ libretroshare/src/pqi/pqissllistener.cc | 9 ++ libretroshare/src/pqi/pqistreamer.cc | 1 + libretroshare/src/pqi/sslfns.cc | 18 ++- libretroshare/src/util/rsaes.cc | 34 +++--- libretroshare/src/util/rsrecogn.cc | 16 +++ retroshare.pri | 3 + 9 files changed, 190 insertions(+), 52 deletions(-) diff --git a/libretroshare/src/crypto/chacha20.cpp b/libretroshare/src/crypto/chacha20.cpp index 5219983a4..2653a7046 100644 --- a/libretroshare/src/crypto/chacha20.cpp +++ b/libretroshare/src/crypto/chacha20.cpp @@ -583,6 +583,9 @@ bool AEAD_chacha20_sha256(uint8_t key[32], uint8_t nonce[12],uint8_t *data,uint3 HMAC_Update(hmac_ctx,aad,aad_size) ; HMAC_Update(hmac_ctx,data,data_size) ; HMAC_Final(hmac_ctx,computed_tag,&md_size) ; + + HMAC_CTX_free(hmac_ctx) ; + hmac_ctx=NULL; #endif // decrypt diff --git a/libretroshare/src/pqi/authssl.cc b/libretroshare/src/pqi/authssl.cc index 07c12b942..bbe99b2a6 100644 --- a/libretroshare/src/pqi/authssl.cc +++ b/libretroshare/src/pqi/authssl.cc @@ -245,12 +245,18 @@ sslcert::sslcert(X509 *x509, const RsPeerId& pid) { certificate = x509; id = pid; +#if OPENSSL_VERSION_NUMBER < 0x10100000L name = getX509CNString(x509->cert_info->subject); org = getX509OrgString(x509->cert_info->subject); location = getX509LocString(x509->cert_info->subject); - email = ""; - issuer = RsPgpId(std::string(getX509CNString(x509->cert_info->issuer))); +#else + name = getX509CNString(X509_get_subject_name(x509)); + org = getX509OrgString(X509_get_subject_name(x509)); + location = getX509LocString(X509_get_subject_name(x509)); + issuer = RsPgpId(std::string(getX509CNString(X509_get_issuer_name(x509)))); +#endif + email = ""; authed = false; } @@ -371,8 +377,17 @@ static int initLib = 0; if (dh) { +#if OPENSSL_VERSION_NUMBER < 0x10100000L BN_hex2bn(&dh->p,dh_prime_4096_hex.c_str()) ; BN_hex2bn(&dh->g,"5") ; +#else + BIGNUM *pp=NULL,*gg=NULL ; + + BN_hex2bn(&pp,dh_prime_4096_hex.c_str()) ; + BN_hex2bn(&gg,"5"); + + DH_set0_pqg(dh,pp,NULL,gg) ; +#endif std::cout.flush() ; @@ -776,47 +791,74 @@ X509 *AuthSSLimpl::SignX509ReqWithGPG(X509_REQ *req, long /*days*/) std::cerr << "X509 Cert, prepared for signing" << std::endl; /*** NOW The Manual signing bit (HACKED FROM asn1/a_sign.c) ***/ + // + // The code has been copied in order to use the PGP signing instead of supplying the + // private EVP_KEY to ASN1_sign(), which would be another alternative. + int (*i2d)(X509_CINF*, unsigned char**) = i2d_X509_CINF; +#if OPENSSL_VERSION_NUMBER < 0x10100000L X509_ALGOR *algor1 = x509->cert_info->signature; X509_ALGOR *algor2 = x509->sig_alg; ASN1_BIT_STRING *signature = x509->signature; X509_CINF *data = x509->cert_info; +#else + const X509_ALGOR *algor1 = X509_get0_tbs_sigalg(x509) ; + const X509_ALGOR *algor2 = NULL ; + + const ASN1_BIT_STRING *tmp_signature = NULL ; + + X509_get0_signature(&tmp_signature,&algor2,x509); + + ASN1_BIT_STRING *signature = const_cast(tmp_signature); +#endif //EVP_PKEY *pkey = NULL; const EVP_MD *type = EVP_sha1(); - EVP_MD_CTX ctx; + EVP_MD_CTX *ctx = EVP_MD_CTX_new(); unsigned char *p,*buf_in=NULL; unsigned char *buf_hashout=NULL,*buf_sigout=NULL; int inl=0,hashoutl=0; int sigoutl=0; X509_ALGOR *a; - EVP_MD_CTX_init(&ctx); + EVP_MD_CTX_init(ctx); /* FIX ALGORITHMS */ - a = algor1; + a = const_cast(algor1); +#if OPENSSL_VERSION_NUMBER < 0x10100000L ASN1_TYPE_free(a->parameter); a->parameter=ASN1_TYPE_new(); a->parameter->type=V_ASN1_NULL; ASN1_OBJECT_free(a->algorithm); a->algorithm=OBJ_nid2obj(type->pkey_type); +#else + X509_ALGOR_set0(a,OBJ_nid2obj(EVP_MD_pkey_type(type)),V_ASN1_NULL,NULL); +#endif - a = algor2; + a = const_cast(algor2); +#if OPENSSL_VERSION_NUMBER < 0x10100000L ASN1_TYPE_free(a->parameter); a->parameter=ASN1_TYPE_new(); a->parameter->type=V_ASN1_NULL; ASN1_OBJECT_free(a->algorithm); - a->algorithm=OBJ_nid2obj(type->pkey_type); + a->algorithm=OBJ_nid2obj(type->pkey_type); +#else + X509_ALGOR_set0(a,OBJ_nid2obj(EVP_MD_pkey_type(type)),V_ASN1_NULL,NULL); +#endif std::cerr << "Algorithms Fixed" << std::endl; /* input buffer */ +#if OPENSSL_VERSION_NUMBER < 0x10100000L inl=i2d(data,NULL); buf_in=(unsigned char *)OPENSSL_malloc((unsigned int)inl); +#else + inl=i2d_re_X509_tbs(x509,&buf_in) ; // this does the i2d over x509->cert_info +#endif hashoutl=EVP_MD_size(type); buf_hashout=(unsigned char *)OPENSSL_malloc((unsigned int)hashoutl); @@ -831,15 +873,17 @@ X509 *AuthSSLimpl::SignX509ReqWithGPG(X509_REQ *req, long /*days*/) fprintf(stderr, "AuthSSLimpl::SignX509Req: ASN1err(ASN1_F_ASN1_SIGN,ERR_R_MALLOC_FAILURE)\n"); goto err; } - p=buf_in; - std::cerr << "Buffers Allocated" << std::endl; +#if OPENSSL_VERSION_NUMBER < 0x10100000L + p=buf_in; i2d(data,&p); +#endif + /* data in buf_in, ready to be hashed */ - EVP_DigestInit_ex(&ctx,type, NULL); - EVP_DigestUpdate(&ctx,(unsigned char *)buf_in,inl); - if (!EVP_DigestFinal(&ctx,(unsigned char *)buf_hashout, + EVP_DigestInit_ex(ctx,type, NULL); + EVP_DigestUpdate(ctx,(unsigned char *)buf_in,inl); + if (!EVP_DigestFinal(ctx,(unsigned char *)buf_hashout, (unsigned int *)&hashoutl)) { hashoutl=0; @@ -879,6 +923,8 @@ X509 *AuthSSLimpl::SignX509ReqWithGPG(X509_REQ *req, long /*days*/) std::cerr << "Certificate Complete" << std::endl; + EVP_MD_CTX_free(ctx) ; + return x509; /* XXX CLEANUP */ @@ -915,7 +961,11 @@ bool AuthSSLimpl::AuthX509WithGPG(X509 *x509,uint32_t& diagnostic) } /* extract CN for peer Id */ +#if OPENSSL_VERSION_NUMBER < 0x10100000L RsPgpId issuer(std::string(getX509CNString(x509->cert_info->issuer))); +#else + RsPgpId issuer(std::string(getX509CNString(X509_get_issuer_name(x509)))); +#endif RsPeerDetails pd; #ifdef AUTHSSL_DEBUG std::cerr << "Checking GPG issuer : " << issuer.toStdString() << std::endl ; @@ -930,22 +980,33 @@ bool AuthSSLimpl::AuthX509WithGPG(X509 *x509,uint32_t& diagnostic) /*** NOW The Manual signing bit (HACKED FROM asn1/a_sign.c) ***/ int (*i2d)(X509_CINF*, unsigned char**) = i2d_X509_CINF; + +#if OPENSSL_VERSION_NUMBER < 0x10100000L ASN1_BIT_STRING *signature = x509->signature; X509_CINF *data = x509->cert_info; +#else + const ASN1_BIT_STRING *signature = NULL ; + const X509_ALGOR *algor2=NULL; + + X509_get0_signature(&signature,&algor2,x509); +#endif + + const EVP_MD *type = EVP_sha1(); - EVP_MD_CTX ctx; + EVP_MD_CTX *ctx = EVP_MD_CTX_new(); unsigned char *p,*buf_in=NULL; unsigned char *buf_hashout=NULL,*buf_sigout=NULL; int inl=0,hashoutl=0; int sigoutl=0; - //X509_ALGOR *a; - - EVP_MD_CTX_init(&ctx); /* input buffer */ +#if OPENSSL_VERSION_NUMBER < 0x10100000L inl=i2d(data,NULL); buf_in=(unsigned char *)OPENSSL_malloc((unsigned int)inl); +#else + inl=i2d_re_X509_tbs(x509,&buf_in) ; // this does the i2d over x509->cert_info +#endif hashoutl=EVP_MD_size(type); buf_hashout=(unsigned char *)OPENSSL_malloc((unsigned int)hashoutl); @@ -973,11 +1034,13 @@ bool AuthSSLimpl::AuthX509WithGPG(X509 *x509,uint32_t& diagnostic) std::cerr << "Buffers Allocated" << std::endl; #endif +#if OPENSSL_VERSION_NUMBER < 0x10100000L i2d(data,&p); +#endif /* data in buf_in, ready to be hashed */ - EVP_DigestInit_ex(&ctx,type, NULL); - EVP_DigestUpdate(&ctx,(unsigned char *)buf_in,inl); - if (!EVP_DigestFinal(&ctx,(unsigned char *)buf_hashout, + EVP_DigestInit_ex(ctx,type, NULL); + EVP_DigestUpdate(ctx,(unsigned char *)buf_in,inl); + if (!EVP_DigestFinal(ctx,(unsigned char *)buf_hashout, (unsigned int *)&hashoutl)) { hashoutl=0; @@ -1017,6 +1080,7 @@ bool AuthSSLimpl::AuthX509WithGPG(X509 *x509,uint32_t& diagnostic) #ifdef AUTHSSL_DEBUG std::cerr << "AuthSSLimpl::AuthX509() X509 authenticated" << std::endl; #endif + EVP_MD_CTX_free(ctx) ; OPENSSL_free(buf_in) ; OPENSSL_free(buf_hashout) ; @@ -1093,21 +1157,34 @@ static int verify_x509_callback(int preverify_ok, X509_STORE_CTX *ctx) if(x509 != NULL) { +#if OPENSSL_VERSION_NUMBER < 0x10100000L RsPgpId gpgid (std::string(getX509CNString(x509->cert_info->issuer))); +#else + RsPgpId gpgid (std::string(getX509CNString(X509_get_issuer_name(x509)))); +#endif + if(gpgid.isNull()) { +#if OPENSSL_VERSION_NUMBER < 0x10100000L std::cerr << "verify_x509_callback(): wrong PGP id \"" << std::string(getX509CNString(x509->cert_info->issuer)) << "\"" << std::endl; +#else + std::cerr << "verify_x509_callback(): wrong PGP id \"" << std::string(getX509CNString(X509_get_issuer_name(x509))) << "\"" << std::endl; +#endif return false ; } +#if OPENSSL_VERSION_NUMBER < 0x10100000L std::string sslcn = getX509CNString(x509->cert_info->subject); +#else + std::string sslcn = getX509CNString(X509_get_subject_name(x509)); +#endif RsPeerId sslid ; getX509id(x509,sslid); if(sslid.isNull()) { - std::cerr << "verify_x509_callback(): wrong SSL id \"" << std::string(getX509CNString(x509->cert_info->subject)) << "\"" << std::endl; + std::cerr << "verify_x509_callback(): wrong PGP id \"" << sslcn << "\"" << std::endl; return false ; } @@ -1185,7 +1262,11 @@ int AuthSSLimpl::VerifyX509Callback(int preverify_ok, X509_STORE_CTX *ctx) std::cerr << "(WW) Certificate was rejected because authentication failed. Diagnostic = " << auth_diagnostic << std::endl; return false; } - RsPgpId pgpid = RsPgpId(std::string(getX509CNString(X509_STORE_CTX_get_current_cert(ctx)->cert_info->issuer))); +#if OPENSSL_VERSION_NUMBER < 0x10100000L + RsPgpId pgpid(std::string(getX509CNString(X509_STORE_CTX_get_current_cert(ctx)->cert_info->issuer))); +#else + RsPgpId pgpid(std::string(getX509CNString(X509_get_issuer_name(X509_STORE_CTX_get_current_cert(ctx))))); +#endif if (pgpid != AuthGPG::getAuthGPG()->getGPGOwnId() && !AuthGPG::getAuthGPG()->isGPGAccepted(pgpid)) { @@ -1258,15 +1339,18 @@ bool AuthSSLimpl::encrypt(void *&out, int &outlen, const void *in, int inlen, #endif return false; } else { +#if OPENSSL_VERSION_NUMBER < 0x10100000L public_key = mCerts[peerId]->certificate->cert_info->key->pkey; +#else + public_key = X509_get0_pubkey(mCerts[peerId]->certificate) ; +#endif } } - EVP_CIPHER_CTX ctx; + EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new(); int eklen, net_ekl; unsigned char *ek; unsigned char iv[EVP_MAX_IV_LENGTH]; - EVP_CIPHER_CTX_init(&ctx); int out_currOffset = 0; int out_offset = 0; @@ -1283,7 +1367,7 @@ bool AuthSSLimpl::encrypt(void *&out, int &outlen, const void *in, int inlen, int max_outlen = inlen + cipher_block_size + EVP_MAX_IV_LENGTH + max_evp_key_size + size_net_ekl; // intialize context and send store encrypted cipher in ek - if(!EVP_SealInit(&ctx, EVP_aes_128_cbc(), &ek, &eklen, iv, &public_key, 1)) { + if(!EVP_SealInit(ctx, EVP_aes_128_cbc(), &ek, &eklen, iv, &public_key, 1)) { free(ek); return false; } @@ -1307,7 +1391,7 @@ bool AuthSSLimpl::encrypt(void *&out, int &outlen, const void *in, int inlen, out_offset += EVP_MAX_IV_LENGTH; // now encrypt actual data - if(!EVP_SealUpdate(&ctx, (unsigned char*) out + out_offset, &out_currOffset, (unsigned char*) in, inlen)) { + if(!EVP_SealUpdate(ctx, (unsigned char*) out + out_offset, &out_currOffset, (unsigned char*) in, inlen)) { free(ek); free(out); out = NULL; @@ -1318,7 +1402,7 @@ bool AuthSSLimpl::encrypt(void *&out, int &outlen, const void *in, int inlen, out_offset += out_currOffset; // add padding - if(!EVP_SealFinal(&ctx, (unsigned char*) out + out_offset, &out_currOffset)) { + if(!EVP_SealFinal(ctx, (unsigned char*) out + out_offset, &out_currOffset)) { free(ek); free(out) ; out = NULL; @@ -1334,7 +1418,7 @@ bool AuthSSLimpl::encrypt(void *&out, int &outlen, const void *in, int inlen, // free encrypted key data free(ek); - EVP_CIPHER_CTX_cleanup(&ctx); + EVP_CIPHER_CTX_free(ctx); outlen = out_offset; @@ -1358,7 +1442,7 @@ bool AuthSSLimpl::decrypt(void *&out, int &outlen, const void *in, int inlen) // out = malloc(inlen); // memcpy(out, in, inlen); // outlen = inlen; - EVP_CIPHER_CTX ctx; + EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new(); int eklen = 0, net_ekl = 0; unsigned char *ek = NULL; unsigned char iv[EVP_MAX_IV_LENGTH]; @@ -1370,7 +1454,6 @@ bool AuthSSLimpl::decrypt(void *&out, int &outlen, const void *in, int inlen) std::cerr << "(EE) Cannot allocate memory for " << ek_mkl << " bytes in " << __PRETTY_FUNCTION__ << std::endl; return false ; } - EVP_CIPHER_CTX_init(&ctx); int in_offset = 0, out_currOffset = 0; int size_net_ekl = sizeof(net_ekl); @@ -1402,7 +1485,7 @@ bool AuthSSLimpl::decrypt(void *&out, int &outlen, const void *in, int inlen) const EVP_CIPHER* cipher = EVP_aes_128_cbc(); - if(0 == EVP_OpenInit(&ctx, cipher, ek, eklen, iv, mOwnPrivateKey)) { + if(0 == EVP_OpenInit(ctx, cipher, ek, eklen, iv, mOwnPrivateKey)) { free(ek); return false; } @@ -1414,7 +1497,7 @@ bool AuthSSLimpl::decrypt(void *&out, int &outlen, const void *in, int inlen) free(ek) ; return false ; } - if(!EVP_OpenUpdate(&ctx, (unsigned char*) out, &out_currOffset, (unsigned char*)in + in_offset, inlen - in_offset)) { + if(!EVP_OpenUpdate(ctx, (unsigned char*) out, &out_currOffset, (unsigned char*)in + in_offset, inlen - in_offset)) { free(ek); free(out) ; out = NULL; @@ -1424,7 +1507,7 @@ bool AuthSSLimpl::decrypt(void *&out, int &outlen, const void *in, int inlen) in_offset += out_currOffset; outlen += out_currOffset; - if(!EVP_OpenFinal(&ctx, (unsigned char*)out + out_currOffset, &out_currOffset)) { + if(!EVP_OpenFinal(ctx, (unsigned char*)out + out_currOffset, &out_currOffset)) { free(ek); free(out) ; out = NULL; @@ -1436,7 +1519,7 @@ bool AuthSSLimpl::decrypt(void *&out, int &outlen, const void *in, int inlen) if(ek != NULL) free(ek); - EVP_CIPHER_CTX_cleanup(&ctx); + EVP_CIPHER_CTX_free(ctx); #ifdef AUTHSSL_DEBUG std::cerr << "AuthSSLimpl::decrypt() finished with outlen : " << outlen << std::endl; diff --git a/libretroshare/src/pqi/pqissl.cc b/libretroshare/src/pqi/pqissl.cc index 795691586..b7709bb82 100644 --- a/libretroshare/src/pqi/pqissl.cc +++ b/libretroshare/src/pqi/pqissl.cc @@ -361,7 +361,11 @@ void pqissl::getCryptoParams(RsPeerCryptoParams& params) bool pqissl::actAsServer() { +#if OPENSSL_VERSION_NUMBER < 0x10100000L return (bool)ssl_connection->server; +#else + return (bool)SSL_is_server(ssl_connection); +#endif } /* returns ... @@ -1226,8 +1230,13 @@ int pqissl::Extract_Failed_SSL_Certificate() RsPeerId sslid ; getX509id(peercert, sslid) ; +#if OPENSSL_VERSION_NUMBER < 0x10100000L RsPgpId gpgid(getX509CNString(peercert->cert_info->issuer)); std::string sslcn = getX509CNString(peercert->cert_info->subject); +#else + RsPgpId gpgid(getX509CNString(X509_get_issuer_name(peercert))); + std::string sslcn = getX509CNString(X509_get_subject_name(peercert)); +#endif AuthSSL::getAuthSSL()->FailedCertificate(peercert, gpgid,sslid,sslcn,remote_addr, false); mLinkMgr->notifyDeniedConnection(gpgid, sslid, sslcn, remote_addr, false); diff --git a/libretroshare/src/pqi/pqissllistener.cc b/libretroshare/src/pqi/pqissllistener.cc index 189eb5dce..9c2040247 100644 --- a/libretroshare/src/pqi/pqissllistener.cc +++ b/libretroshare/src/pqi/pqissllistener.cc @@ -494,8 +494,13 @@ int pqissllistenbase::continueSSL(IncomingSSLInfo& incoming_connexion_info, bool #endif if(x509 != NULL) { +#if OPENSSL_VERSION_NUMBER < 0x10100000L incoming_connexion_info.gpgid = RsPgpId(std::string(getX509CNString(x509->cert_info->issuer))); incoming_connexion_info.sslcn = getX509CNString(x509->cert_info->subject); +#else + incoming_connexion_info.gpgid = RsPgpId(std::string(getX509CNString(X509_get_issuer_name(x509)))); + incoming_connexion_info.sslcn = getX509CNString(X509_get_subject_name(x509)); +#endif getX509id(x509,incoming_connexion_info.sslid); @@ -888,7 +893,11 @@ int pqissllistener::completeConnection(int fd, IncomingSSLInfo& info) AuthSSL::getAuthSSL()->CheckCertificate(newPeerId, peercert); /* now need to get GPG id too */ +#if OPENSSL_VERSION_NUMBER < 0x10100000L RsPgpId pgpid(std::string(getX509CNString(peercert->cert_info->issuer))); +#else + RsPgpId pgpid(std::string(getX509CNString(X509_get_issuer_name(peercert)))); +#endif mPeerMgr->addFriend(newPeerId, pgpid); X509_free(peercert); diff --git a/libretroshare/src/pqi/pqistreamer.cc b/libretroshare/src/pqi/pqistreamer.cc index 76f5b1581..626f1db76 100644 --- a/libretroshare/src/pqi/pqistreamer.cc +++ b/libretroshare/src/pqi/pqistreamer.cc @@ -26,6 +26,7 @@ #include "pqi/pqistreamer.h" +#include // for gettimeofday #include // for free, realloc, exit #include // for memcpy, memset, memcmp #include // for NULL, time, time_t diff --git a/libretroshare/src/pqi/sslfns.cc b/libretroshare/src/pqi/sslfns.cc index 07ec804a2..7cf742956 100644 --- a/libretroshare/src/pqi/sslfns.cc +++ b/libretroshare/src/pqi/sslfns.cc @@ -242,6 +242,7 @@ X509_REQ *GenerateX509Req( #define SERIAL_RAND_BITS 64 +#ifdef UNUSED_CODE X509 *SignX509Certificate(X509_NAME *issuer, EVP_PKEY *privkey, X509_REQ *req, long days) { const EVP_MD *digest = EVP_sha1(); @@ -369,6 +370,7 @@ X509 *SignX509Certificate(X509_NAME *issuer, EVP_PKEY *privkey, X509_REQ *req, l return x509; } +#endif /********************************************************************************/ /********************************************************************************/ @@ -600,7 +602,14 @@ bool getX509id(X509 *x509, RsPeerId& xid) } // get the signature from the cert, and copy to the array. +#if OPENSSL_VERSION_NUMBER < 0x10100000L ASN1_BIT_STRING *signature = x509->signature; +#else + const ASN1_BIT_STRING *signature = NULL ; + const X509_ALGOR *algor ; + + X509_get0_signature(&signature,&algor,x509); +#endif int signlen = ASN1_STRING_length(signature); if (signlen < CERTSIGNLEN) { @@ -612,12 +621,14 @@ bool getX509id(X509 *x509, RsPeerId& xid) } // else copy in the first CERTSIGNLEN. - unsigned char *signdata = ASN1_STRING_data(signature); + unsigned char *signdata = ASN1_STRING_data(const_cast(signature)); /* switched to the other end of the signature. for * more randomness */ +#warning this is cryptographically horrible. We should do a hash of the public key here!!! + xid = RsPeerId(&signdata[signlen - CERTSIGNLEN]) ; //for(int i = signlen - CERTSIGNLEN; i < signlen; i++) @@ -689,8 +700,13 @@ int LoadCheckX509(const char *cert_file, RsPgpId& issuerName, std::string &locat if (valid) { // extract the name. +#if OPENSSL_VERSION_NUMBER < 0x10100000L issuerName = RsPgpId(std::string(getX509CNString(x509->cert_info->issuer))); location = getX509LocString(x509->cert_info->subject); +#else + issuerName = RsPgpId(std::string(getX509CNString(X509_get_issuer_name(x509)))); + location = getX509LocString(X509_get_subject_name(x509)); +#endif } #ifdef AUTHSSL_DEBUG diff --git a/libretroshare/src/util/rsaes.cc b/libretroshare/src/util/rsaes.cc index 1703c4d77..7be5175f9 100644 --- a/libretroshare/src/util/rsaes.cc +++ b/libretroshare/src/util/rsaes.cc @@ -52,9 +52,8 @@ bool RsAES::aes_crypt_8_16(const uint8_t *input_data,uint32_t input_data_length, return false ; } - EVP_CIPHER_CTX e_ctx ; - EVP_CIPHER_CTX_init(&e_ctx); - EVP_EncryptInit_ex(&e_ctx, EVP_aes_256_cbc(), NULL, key, iv); + EVP_CIPHER_CTX *e_ctx = EVP_CIPHER_CTX_new(); + EVP_EncryptInit_ex(e_ctx, EVP_aes_256_cbc(), NULL, key, iv); /* max ciphertext len for a n bytes of plaintext is n + AES_BLOCK_SIZE -1 bytes */ int c_len = input_data_length + AES_BLOCK_SIZE ; @@ -62,31 +61,31 @@ bool RsAES::aes_crypt_8_16(const uint8_t *input_data,uint32_t input_data_length, if(output_data_length < (uint32_t)c_len) { - EVP_CIPHER_CTX_cleanup(&e_ctx) ; + EVP_CIPHER_CTX_free(e_ctx) ; return false ; } /* update ciphertext, c_len is filled with the length of ciphertext generated, *len is the size of plaintext in bytes */ - if(!EVP_EncryptUpdate(&e_ctx, output_data, &c_len, input_data, input_data_length)) + if(!EVP_EncryptUpdate(e_ctx, output_data, &c_len, input_data, input_data_length)) { std::cerr << "RsAES: decryption failed at end. Check padding." << std::endl; - EVP_CIPHER_CTX_cleanup(&e_ctx) ; + EVP_CIPHER_CTX_free(e_ctx) ; return false ; } /* update ciphertext with the final remaining bytes */ - if(!EVP_EncryptFinal_ex(&e_ctx, output_data+c_len, &f_len)) + if(!EVP_EncryptFinal_ex(e_ctx, output_data+c_len, &f_len)) { std::cerr << "RsAES: decryption failed at end. Check padding." << std::endl; - EVP_CIPHER_CTX_cleanup(&e_ctx) ; + EVP_CIPHER_CTX_free(e_ctx) ; return false ; } output_data_length = c_len + f_len; - EVP_CIPHER_CTX_cleanup(&e_ctx) ; + EVP_CIPHER_CTX_free(e_ctx) ; return true; } @@ -108,9 +107,8 @@ bool RsAES::aes_decrypt_8_16(const uint8_t *input_data,uint32_t input_data_lengt return false ; } - EVP_CIPHER_CTX e_ctx ; - EVP_CIPHER_CTX_init(&e_ctx); - EVP_DecryptInit_ex(&e_ctx, EVP_aes_256_cbc(), NULL, key, iv); + EVP_CIPHER_CTX *e_ctx = EVP_CIPHER_CTX_new(); + EVP_DecryptInit_ex(e_ctx, EVP_aes_256_cbc(), NULL, key, iv); /* max ciphertext len for a n bytes of plaintext is n + AES_BLOCK_SIZE -1 bytes */ int c_len = input_data_length + AES_BLOCK_SIZE ; @@ -118,7 +116,7 @@ bool RsAES::aes_decrypt_8_16(const uint8_t *input_data,uint32_t input_data_lengt if(output_data_length < (uint32_t)c_len) { - EVP_CIPHER_CTX_cleanup(&e_ctx) ; + EVP_CIPHER_CTX_free(e_ctx) ; return false ; } @@ -127,24 +125,24 @@ bool RsAES::aes_decrypt_8_16(const uint8_t *input_data,uint32_t input_data_lengt /* update ciphertext, c_len is filled with the length of ciphertext generated, *len is the size of plaintext in bytes */ - if(! EVP_DecryptUpdate(&e_ctx, output_data, &c_len, input_data, input_data_length)) + if(! EVP_DecryptUpdate(e_ctx, output_data, &c_len, input_data, input_data_length)) { std::cerr << "RsAES: decryption failed." << std::endl; - EVP_CIPHER_CTX_cleanup(&e_ctx) ; + EVP_CIPHER_CTX_free(e_ctx) ; return false ; } /* update ciphertext with the final remaining bytes */ - if(!EVP_DecryptFinal_ex(&e_ctx, output_data+c_len, &f_len)) + if(!EVP_DecryptFinal_ex(e_ctx, output_data+c_len, &f_len)) { std::cerr << "RsAES: decryption failed at end. Check padding." << std::endl; - EVP_CIPHER_CTX_cleanup(&e_ctx) ; + EVP_CIPHER_CTX_free(e_ctx) ; return false ; } output_data_length = c_len + f_len; - EVP_CIPHER_CTX_cleanup(&e_ctx) ; + EVP_CIPHER_CTX_free(e_ctx) ; return true; } diff --git a/libretroshare/src/util/rsrecogn.cc b/libretroshare/src/util/rsrecogn.cc index f7c51b9e9..f42a4dd6f 100644 --- a/libretroshare/src/util/rsrecogn.cc +++ b/libretroshare/src/util/rsrecogn.cc @@ -28,6 +28,7 @@ #include "util/rsrecogn.h" #include "util/radix64.h" #include "util/rsstring.h" +#include "util/rsdir.h" #include "gxs/gxssecurity.h" @@ -507,9 +508,23 @@ bool RsRecogn::itemToRadix64(RsItem *item, std::string &radstr) std::string RsRecogn::getRsaKeyId(RSA *pubkey) { +#if OPENSSL_VERSION_NUMBER < 0x10100000L int len = BN_num_bytes(pubkey -> n); unsigned char tmp[len]; BN_bn2bin(pubkey -> n, tmp); +#else + const BIGNUM *nn=NULL ; + RSA_get0_key(pubkey,&nn,NULL,NULL) ; + + int len = BN_num_bytes(nn); + unsigned char tmp[len]; + BN_bn2bin(nn, tmp); +#endif + + return RsDirUtil::sha1sum(tmp,len).toStdString(); + +#ifdef OLD_VERSION_REMOVED + // (cyril) I removed this because this is cryptographically insane, as it allows to easily forge a RSA key with the same ID. // copy first CERTSIGNLEN bytes... if (len > CERTSIGNLEN) @@ -524,6 +539,7 @@ std::string RsRecogn::getRsaKeyId(RSA *pubkey) } return id; +#endif } diff --git a/retroshare.pri b/retroshare.pri index 498131aea..7642acc88 100644 --- a/retroshare.pri +++ b/retroshare.pri @@ -60,6 +60,9 @@ rs_nodeprecatedwarning:CONFIG -= no_rs_nodeprecatedwarning CONFIG *= no_rs_nocppwarning rs_nocppwarning:CONFIG -= no_rs_nocppwarning +INCLUDEPATH += /usr/local/openssl/include +LIBS += -L/usr/local/openssl/lib + unix { isEmpty(PREFIX) { PREFIX = "/usr" } isEmpty(BIN_DIR) { BIN_DIR = "$${PREFIX}/bin" } From c3b49855e02b8525223c133858e2417deabb5779 Mon Sep 17 00:00:00 2001 From: csoler Date: Mon, 20 Feb 2017 21:44:48 +0100 Subject: [PATCH 16/25] compilation fix for openssl-1.1.0 (gxssecurity+gxstunnel part) --- libretroshare/src/gxs/gxssecurity.cc | 353 +++++++++++---------- libretroshare/src/gxstunnel/p3gxstunnel.cc | 16 + 2 files changed, 202 insertions(+), 167 deletions(-) diff --git a/libretroshare/src/gxs/gxssecurity.cc b/libretroshare/src/gxs/gxssecurity.cc index 20ddc1462..9591b3f9e 100644 --- a/libretroshare/src/gxs/gxssecurity.cc +++ b/libretroshare/src/gxs/gxssecurity.cc @@ -41,20 +41,31 @@ static const uint32_t MULTI_ENCRYPTION_FORMAT_v001_ENCRYPTED_KEY_SIZE = 256 ; static RsGxsId getRsaKeyFingerprint_old_insecure_method(RSA *pubkey) { +#if OPENSSL_VERSION_NUMBER < 0x10100000L int lenn = BN_num_bytes(pubkey -> n); RsTemporaryMemory tmp(lenn) ; BN_bn2bin(pubkey -> n, tmp); +#else + const BIGNUM *nn=NULL,*ee=NULL ; + RSA_get0_key(pubkey,&nn,&ee,NULL) ; + + int lenn = BN_num_bytes(nn); + + RsTemporaryMemory tmp(lenn) ; + BN_bn2bin(nn, tmp); +#endif // Copy first CERTSIGNLEN bytes from the hash of the public modulus and exponent - // We should not be using strings here, but a real ID. To be done later. + // We should not be using strings here, but a real ID. To be done later. - assert(lenn >= CERTSIGNLEN) ; + assert(lenn >= CERTSIGNLEN) ; - return RsGxsId((unsigned char*)tmp) ; + return RsGxsId((unsigned char*)tmp) ; } static RsGxsId getRsaKeyFingerprint(RSA *pubkey) { +#if OPENSSL_VERSION_NUMBER < 0x10100000L int lenn = BN_num_bytes(pubkey -> n); int lene = BN_num_bytes(pubkey -> e); @@ -62,6 +73,18 @@ static RsGxsId getRsaKeyFingerprint(RSA *pubkey) BN_bn2bin(pubkey -> n, tmp); BN_bn2bin(pubkey -> e, &tmp[lenn]); +#else + const BIGNUM *nn=NULL,*ee=NULL ; + RSA_get0_key(pubkey,&nn,&ee,NULL) ; + + int lenn = BN_num_bytes(nn); + int lene = BN_num_bytes(ee); + + RsTemporaryMemory tmp(lenn+lene) ; + + BN_bn2bin(nn, tmp); + BN_bn2bin(ee, &tmp[lenn]); +#endif Sha1CheckSum s = RsDirUtil::sha1sum(tmp,lenn+lene) ; @@ -530,11 +553,10 @@ bool GxsSecurity::encrypt(uint8_t *& out, uint32_t &outlen, const uint8_t *in, u return false; } - EVP_CIPHER_CTX ctx; + EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new(); int eklen, net_ekl; unsigned char *ek; unsigned char iv[EVP_MAX_IV_LENGTH]; - EVP_CIPHER_CTX_init(&ctx); int out_currOffset = 0; int out_offset = 0; @@ -551,7 +573,7 @@ bool GxsSecurity::encrypt(uint8_t *& out, uint32_t &outlen, const uint8_t *in, u int max_outlen = inlen + cipher_block_size + EVP_MAX_IV_LENGTH + max_evp_key_size + size_net_ekl; // intialize context and send store encrypted cipher in ek - if(!EVP_SealInit(&ctx, EVP_aes_128_cbc(), &ek, &eklen, iv, &public_key, 1)) return false; + if(!EVP_SealInit(ctx, EVP_aes_128_cbc(), &ek, &eklen, iv, &public_key, 1)) return false; // now assign memory to out accounting for data, and cipher block size, key length, and key length val out = (uint8_t*)rs_malloc(inlen + cipher_block_size + size_net_ekl + eklen + EVP_MAX_IV_LENGTH) ; @@ -570,7 +592,7 @@ bool GxsSecurity::encrypt(uint8_t *& out, uint32_t &outlen, const uint8_t *in, u out_offset += EVP_MAX_IV_LENGTH; // now encrypt actual data - if(!EVP_SealUpdate(&ctx, (unsigned char*) out + out_offset, &out_currOffset, (unsigned char*) in, inlen)) + if(!EVP_SealUpdate(ctx, (unsigned char*) out + out_offset, &out_currOffset, (unsigned char*) in, inlen)) { free(out) ; out = NULL ; @@ -581,7 +603,7 @@ bool GxsSecurity::encrypt(uint8_t *& out, uint32_t &outlen, const uint8_t *in, u out_offset += out_currOffset; // add padding - if(!EVP_SealFinal(&ctx, (unsigned char*) out + out_offset, &out_currOffset)) + if(!EVP_SealFinal(ctx, (unsigned char*) out + out_offset, &out_currOffset)) { free(out) ; out = NULL ; @@ -602,7 +624,7 @@ bool GxsSecurity::encrypt(uint8_t *& out, uint32_t &outlen, const uint8_t *in, u // free encrypted key data free(ek); - EVP_CIPHER_CTX_cleanup(&ctx); + EVP_CIPHER_CTX_free(ctx); outlen = out_offset; return true; @@ -613,152 +635,151 @@ bool GxsSecurity::encrypt(uint8_t *& out, uint32_t &outlen, const uint8_t *in, u #ifdef DISTRIB_DEBUG std::cerr << "GxsSecurity::encrypt() " << std::endl; #endif - // Encrypts (in,inlen) into (out,outlen) using the given RSA public key. - // The format of the encrypted data is: - // - // [--- ID ---|--- number of encrypted keys---| n * (--- Encrypted session keys ---) |--- IV ---|---- Encrypted data ---] - // 2 bytes 2 byte = n 256 bytes EVP_MAX_IV_LENGTH Rest of packet - // + // Encrypts (in,inlen) into (out,outlen) using the given RSA public key. + // The format of the encrypted data is: + // + // [--- ID ---|--- number of encrypted keys---| n * (--- Encrypted session keys ---) |--- IV ---|---- Encrypted data ---] + // 2 bytes 2 byte = n 256 bytes EVP_MAX_IV_LENGTH Rest of packet + // - out = NULL ; - EVP_CIPHER_CTX ctx; - EVP_CIPHER_CTX_init(&ctx); - std::vector public_keys(keys.size(),NULL); - - try - { - for(uint32_t i=0;i ek(keys.size(),NULL) ; - std::vector eklen(keys.size(),0) ; - - for(uint32_t i=0;i> 8) & 0xff ; - - // number of keys - - out[out_offset++] = keys.size() & 0xff ; - out[out_offset++] = (keys.size() >> 8) & 0xff ; - - // encrypted keys, each preceeded with its length - - for(uint32_t i=0;i max_outlen) - throw std::runtime_error("Memory used by encryption exceeds allocated memory block") ; - - // free encrypted key data - - for(uint32_t i=0;i public_keys(keys.size(),NULL); + + try + { + for(uint32_t i=0;i ek(keys.size(),NULL) ; + std::vector eklen(keys.size(),0) ; + + for(uint32_t i=0;i> 8) & 0xff ; + + // number of keys + + out[out_offset++] = keys.size() & 0xff ; + out[out_offset++] = (keys.size() >> 8) & 0xff ; + + // encrypted keys, each preceeded with its length + + for(uint32_t i=0;i max_outlen) + throw std::runtime_error("Memory used by encryption exceeds allocated memory block") ; + + // free encrypted key data + + for(uint32_t i=0;ipublic_key = BN_dup(dh->pub_key) ; +#else + const BIGNUM *pub_key=NULL ; + DH_get0_key(dh,&pub_key,NULL) ; + dhitem->public_key = BN_dup(pub_key) ; +#endif // we should also sign the data and check the signature on the other end. // @@ -1133,8 +1139,18 @@ bool p3GxsTunnelService::locked_initDHSessionKey(DH *& dh) return false ; } +#if OPENSSL_VERSION_NUMBER < 0x10100000L BN_hex2bn(&dh->p,dh_prime_2048_hex.c_str()) ; BN_hex2bn(&dh->g,"5") ; +#else + BIGNUM *pp=NULL ; + BIGNUM *gg=NULL ; + + BN_hex2bn(&pp,dh_prime_2048_hex.c_str()) ; + BN_hex2bn(&gg,"5") ; + + DH_set0_pqg(dh,pp,NULL,gg) ; +#endif int codes = 0 ; From 4dac3b4f148ec865ec4c6c425303b4749e743afd Mon Sep 17 00:00:00 2001 From: csoler Date: Mon, 20 Feb 2017 22:36:35 +0100 Subject: [PATCH 17/25] removed compilation tweak --- retroshare.pri | 3 --- 1 file changed, 3 deletions(-) diff --git a/retroshare.pri b/retroshare.pri index 7642acc88..498131aea 100644 --- a/retroshare.pri +++ b/retroshare.pri @@ -60,9 +60,6 @@ rs_nodeprecatedwarning:CONFIG -= no_rs_nodeprecatedwarning CONFIG *= no_rs_nocppwarning rs_nocppwarning:CONFIG -= no_rs_nocppwarning -INCLUDEPATH += /usr/local/openssl/include -LIBS += -L/usr/local/openssl/lib - unix { isEmpty(PREFIX) { PREFIX = "/usr" } isEmpty(BIN_DIR) { BIN_DIR = "$${PREFIX}/bin" } From 8c3f553579a88170f340744463001cac9cd0505b Mon Sep 17 00:00:00 2001 From: csoler Date: Mon, 20 Feb 2017 22:54:25 +0100 Subject: [PATCH 18/25] fixed compilation with openssl1.0.1 broken by previous commits --- libretroshare/src/pqi/authssl.cc | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/libretroshare/src/pqi/authssl.cc b/libretroshare/src/pqi/authssl.cc index bbe99b2a6..b74de49af 100644 --- a/libretroshare/src/pqi/authssl.cc +++ b/libretroshare/src/pqi/authssl.cc @@ -814,15 +814,13 @@ X509 *AuthSSLimpl::SignX509ReqWithGPG(X509_REQ *req, long /*days*/) //EVP_PKEY *pkey = NULL; const EVP_MD *type = EVP_sha1(); - EVP_MD_CTX *ctx = EVP_MD_CTX_new(); + EVP_MD_CTX *ctx = EVP_MD_CTX_create(); unsigned char *p,*buf_in=NULL; unsigned char *buf_hashout=NULL,*buf_sigout=NULL; int inl=0,hashoutl=0; int sigoutl=0; X509_ALGOR *a; - EVP_MD_CTX_init(ctx); - /* FIX ALGORITHMS */ a = const_cast(algor1); @@ -923,7 +921,7 @@ X509 *AuthSSLimpl::SignX509ReqWithGPG(X509_REQ *req, long /*days*/) std::cerr << "Certificate Complete" << std::endl; - EVP_MD_CTX_free(ctx) ; + EVP_MD_CTX_destroy(ctx) ; return x509; @@ -994,7 +992,7 @@ bool AuthSSLimpl::AuthX509WithGPG(X509 *x509,uint32_t& diagnostic) const EVP_MD *type = EVP_sha1(); - EVP_MD_CTX *ctx = EVP_MD_CTX_new(); + EVP_MD_CTX *ctx = EVP_MD_CTX_create(); unsigned char *p,*buf_in=NULL; unsigned char *buf_hashout=NULL,*buf_sigout=NULL; int inl=0,hashoutl=0; @@ -1080,7 +1078,7 @@ bool AuthSSLimpl::AuthX509WithGPG(X509 *x509,uint32_t& diagnostic) #ifdef AUTHSSL_DEBUG std::cerr << "AuthSSLimpl::AuthX509() X509 authenticated" << std::endl; #endif - EVP_MD_CTX_free(ctx) ; + EVP_MD_CTX_destroy(ctx) ; OPENSSL_free(buf_in) ; OPENSSL_free(buf_hashout) ; From 9371521dd134559b5908e43cafa9d09699f7976b Mon Sep 17 00:00:00 2001 From: csoler Date: Mon, 20 Feb 2017 23:19:29 +0100 Subject: [PATCH 19/25] fixed bug causing crash in openssl_crypto due to not zeroing a field that was not duplicated before delete --- openpgpsdk/src/openpgpsdk/openssl_crypto.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/openpgpsdk/src/openpgpsdk/openssl_crypto.c b/openpgpsdk/src/openpgpsdk/openssl_crypto.c index 768abab8e..4b36d2caf 100644 --- a/openpgpsdk/src/openpgpsdk/openssl_crypto.c +++ b/openpgpsdk/src/openpgpsdk/openssl_crypto.c @@ -416,6 +416,12 @@ ops_boolean_t ops_dsa_verify(const unsigned char *hash,size_t hash_length, fprintf(stderr,"(WW) ops_dsa_verify: openssl does only supports 'q' of 160 bits. Current is %d bits.\n",BN_num_bits(dsa->q)) ; already_said=ops_true ; } + +#if OPENSSL_VERSION_NUMBER < 0x10100000L + osig->r=NULL; // in this case, the values are not copied. + osig->s=NULL; +#endif + DSA_SIG_free(osig); return ops_false ; } From 65a383afeaa58f9167b2c6d33e92f3cc72dcf6bc Mon Sep 17 00:00:00 2001 From: csoler Date: Thu, 23 Feb 2017 19:16:48 +0100 Subject: [PATCH 20/25] fixed typo causing crash in openpgp-sdk --- openpgpsdk/src/openpgpsdk/openssl_crypto.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openpgpsdk/src/openpgpsdk/openssl_crypto.c b/openpgpsdk/src/openpgpsdk/openssl_crypto.c index 4b36d2caf..964ea3832 100644 --- a/openpgpsdk/src/openpgpsdk/openssl_crypto.c +++ b/openpgpsdk/src/openpgpsdk/openssl_crypto.c @@ -755,7 +755,7 @@ ops_boolean_t ops_rsa_generate_keypair(const int numbits, const unsigned long e, skey->public_key.key.rsa.n=BN_dup(nn) ; skey->public_key.key.rsa.e=BN_dup(ee) ; - skey->public_key.key.rsa.e=BN_dup(dd) ; + skey->key.rsa.d=BN_dup(dd) ; #endif skey->s2k_usage=OPS_S2KU_ENCRYPTED_AND_HASHED; From d1bf977b1543d786386d8571bac1e871e0c14d4f Mon Sep 17 00:00:00 2001 From: csoler Date: Fri, 24 Feb 2017 23:19:47 +0100 Subject: [PATCH 21/25] fixed bug causing decryption of group data to crash --- libretroshare/src/gxs/gxssecurity.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libretroshare/src/gxs/gxssecurity.cc b/libretroshare/src/gxs/gxssecurity.cc index 9591b3f9e..e3c7c0c2b 100644 --- a/libretroshare/src/gxs/gxssecurity.cc +++ b/libretroshare/src/gxs/gxssecurity.cc @@ -973,7 +973,7 @@ bool GxsSecurity::decrypt(uint8_t *& out, uint32_t & outlen, const uint8_t *in, succeed = EVP_OpenInit(ctx, EVP_aes_128_cbc(),in + encrypted_keys_offset + i*MULTI_ENCRYPTION_FORMAT_v001_ENCRYPTED_KEY_SIZE , MULTI_ENCRYPTION_FORMAT_v001_ENCRYPTED_KEY_SIZE, in+IV_offset, privateKey); if(!succeed) - EVP_CIPHER_CTX_free(ctx); + EVP_CIPHER_CTX_reset(ctx); #ifdef GXS_SECURITY_DEBUG std::cerr << " encrypted key at offset " << encrypted_keys_offset + i*MULTI_ENCRYPTION_FORMAT_v001_ENCRYPTED_KEY_SIZE << ": " << succeed << std::endl; From e18cc3eff65aa0fa1b681a8808dfbd65fbe53ee8 Mon Sep 17 00:00:00 2001 From: csoler Date: Fri, 24 Feb 2017 23:34:52 +0100 Subject: [PATCH 22/25] changed reset to cleanup for backward compatibility in EVP_CIPHER_CTX_cleanup call --- libretroshare/src/gxs/gxssecurity.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libretroshare/src/gxs/gxssecurity.cc b/libretroshare/src/gxs/gxssecurity.cc index e3c7c0c2b..ff430796c 100644 --- a/libretroshare/src/gxs/gxssecurity.cc +++ b/libretroshare/src/gxs/gxssecurity.cc @@ -973,7 +973,7 @@ bool GxsSecurity::decrypt(uint8_t *& out, uint32_t & outlen, const uint8_t *in, succeed = EVP_OpenInit(ctx, EVP_aes_128_cbc(),in + encrypted_keys_offset + i*MULTI_ENCRYPTION_FORMAT_v001_ENCRYPTED_KEY_SIZE , MULTI_ENCRYPTION_FORMAT_v001_ENCRYPTED_KEY_SIZE, in+IV_offset, privateKey); if(!succeed) - EVP_CIPHER_CTX_reset(ctx); + EVP_CIPHER_CTX_cleanup(ctx); #ifdef GXS_SECURITY_DEBUG std::cerr << " encrypted key at offset " << encrypted_keys_offset + i*MULTI_ENCRYPTION_FORMAT_v001_ENCRYPTED_KEY_SIZE << ": " << succeed << std::endl; From c313fb54534f32684d84322e24e4ce941694d328 Mon Sep 17 00:00:00 2001 From: csoler Date: Sat, 25 Feb 2017 14:09:39 +0100 Subject: [PATCH 23/25] removed compilation warning --- openpgpsdk/src/openpgpsdk/openssl_crypto.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/openpgpsdk/src/openpgpsdk/openssl_crypto.c b/openpgpsdk/src/openpgpsdk/openssl_crypto.c index 964ea3832..3a431d1ac 100644 --- a/openpgpsdk/src/openpgpsdk/openssl_crypto.c +++ b/openpgpsdk/src/openpgpsdk/openssl_crypto.c @@ -749,7 +749,7 @@ ops_boolean_t ops_rsa_generate_keypair(const int numbits, const unsigned long e, skey->public_key.key.rsa.e=BN_dup(rsa->e); skey->key.rsa.d=BN_dup(rsa->d); #else - BIGNUM *nn=NULL,*ee=NULL,*dd=NULL ; + const BIGNUM *nn=NULL,*ee=NULL,*dd=NULL ; RSA_get0_key(rsa,&nn,&ee,&dd) ; @@ -771,7 +771,7 @@ ops_boolean_t ops_rsa_generate_keypair(const int numbits, const unsigned long e, skey->key.rsa.q=BN_dup(rsa->q); skey->key.rsa.u=BN_mod_inverse(NULL,rsa->p, rsa->q, ctx); #else - BIGNUM *pp=NULL,*qq=NULL ; + const BIGNUM *pp=NULL,*qq=NULL ; RSA_get0_factors(rsa,&pp,&qq) ; From a531a41c4a98c96b346f4e7e99cfcb4edf9c009f Mon Sep 17 00:00:00 2001 From: csoler Date: Sat, 25 Feb 2017 18:21:24 +0100 Subject: [PATCH 24/25] fixed recursive call to BIO_set_fd() --- libretroshare/src/tcponudp/bss_tou.c | 23 +++++++++-------------- 1 file changed, 9 insertions(+), 14 deletions(-) diff --git a/libretroshare/src/tcponudp/bss_tou.c b/libretroshare/src/tcponudp/bss_tou.c index 34b935e0e..dda929716 100644 --- a/libretroshare/src/tcponudp/bss_tou.c +++ b/libretroshare/src/tcponudp/bss_tou.c @@ -91,8 +91,9 @@ static int clear_tou_socket_error(int s); #include "tou.h" #if OPENSSL_VERSION_NUMBER < 0x10100000L +//static void BIO_set_shutdown(BIO *a,int s) { a->shutdown=s; } + static int BIO_get_shutdown(BIO *a) { return a->shutdown; } -static void BIO_set_shutdown(BIO *a,int s) { a->shutdown=s; } static int BIO_get_init(BIO *a) { return a->init; } static void BIO_set_init(BIO *a,int i) { a->init=i; } static void BIO_set_data(BIO *a,void *p) { a->ptr = p; } @@ -238,6 +239,8 @@ static long tou_socket_ctrl(BIO *b, int cmd, long num, void *ptr) fprintf(stderr, "tou_socket_ctrl(%p,%d,%ld)\n", b, cmd, num); #endif + // We are not allowed to call BIO_set_fd here, because it will trigger a callback, which re-ends here + switch (cmd) { case BIO_CTRL_RESET: @@ -251,25 +254,17 @@ static long tou_socket_ctrl(BIO *b, int cmd, long num, void *ptr) break; case BIO_C_SET_FD: tou_socket_free(b); - BIO_set_fd(b,*((int *)ptr),0); - BIO_set_shutdown(b,(int)num) ; - BIO_set_init(b,1) ; + ret = BIO_s_fd()->ctrl(b,cmd,num,ptr) ; + break; case BIO_C_GET_FD: - if (BIO_get_init(b)) - { - ip=(int *)ptr; - if (ip != NULL) *ip=BIO_get_fd(b,NULL); - ret=BIO_get_fd(b,NULL); - } - else - ret= -1; + ret = BIO_s_fd()->ctrl(b,cmd,num,ptr) ; break; case BIO_CTRL_GET_CLOSE: - ret=BIO_get_shutdown(b); + ret = BIO_s_fd()->ctrl(b,cmd,num,ptr) ; break; case BIO_CTRL_SET_CLOSE: - BIO_set_shutdown(b,(int)num) ; + ret = BIO_s_fd()->ctrl(b,cmd,num,ptr) ; break; case BIO_CTRL_PENDING: ret = tou_maxread(BIO_get_fd(b,NULL)); From e75487e48abda31063ee44f86d5926acd89bcd1d Mon Sep 17 00:00:00 2001 From: csoler Date: Sat, 25 Feb 2017 23:16:43 +0100 Subject: [PATCH 25/25] suppressed a few warnings (suggested by Phenom) --- libretroshare/src/pqi/authssl.cc | 2 +- libretroshare/src/tcponudp/bss_tou.c | 1 - openpgpsdk/src/openpgpsdk/signature.c | 2 +- 3 files changed, 2 insertions(+), 3 deletions(-) diff --git a/libretroshare/src/pqi/authssl.cc b/libretroshare/src/pqi/authssl.cc index b74de49af..4191e0b4f 100644 --- a/libretroshare/src/pqi/authssl.cc +++ b/libretroshare/src/pqi/authssl.cc @@ -795,8 +795,8 @@ X509 *AuthSSLimpl::SignX509ReqWithGPG(X509_REQ *req, long /*days*/) // The code has been copied in order to use the PGP signing instead of supplying the // private EVP_KEY to ASN1_sign(), which would be another alternative. - int (*i2d)(X509_CINF*, unsigned char**) = i2d_X509_CINF; #if OPENSSL_VERSION_NUMBER < 0x10100000L + int (*i2d)(X509_CINF*, unsigned char**) = i2d_X509_CINF; X509_ALGOR *algor1 = x509->cert_info->signature; X509_ALGOR *algor2 = x509->sig_alg; ASN1_BIT_STRING *signature = x509->signature; diff --git a/libretroshare/src/tcponudp/bss_tou.c b/libretroshare/src/tcponudp/bss_tou.c index dda929716..72969562f 100644 --- a/libretroshare/src/tcponudp/bss_tou.c +++ b/libretroshare/src/tcponudp/bss_tou.c @@ -234,7 +234,6 @@ static int tou_socket_write(BIO *b, const char *in, int inl) static long tou_socket_ctrl(BIO *b, int cmd, long num, void *ptr) { long ret=1; - int *ip; #ifdef DEBUG_TOU_BIO fprintf(stderr, "tou_socket_ctrl(%p,%d,%ld)\n", b, cmd, num); #endif diff --git a/openpgpsdk/src/openpgpsdk/signature.c b/openpgpsdk/src/openpgpsdk/signature.c index 7195d8007..e6820e325 100644 --- a/openpgpsdk/src/openpgpsdk/signature.c +++ b/openpgpsdk/src/openpgpsdk/signature.c @@ -302,7 +302,7 @@ static ops_boolean_t dsa_sign(ops_hash_t *hash, const ops_dsa_public_key_t *dsa, ops_write_mpi(dsasig->r, cinfo); ops_write_mpi(dsasig->s, cinfo); #else - BIGNUM *rr=NULL,*ss=NULL ; + const BIGNUM *rr=NULL,*ss=NULL ; DSA_SIG_get0(dsasig,&rr,&ss) ;