shinys000114/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2026-02-11 18:50:28 +09:00
Code Issues Packages Projects Releases Wiki Activity

Make it work with openssl3.0

Browse Source 
The KDF was changed in the new API, fetching the algorithm first
then creating the context using it.

Signed-off-by: Norbert Pocs <npocs@redhat.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
This commit is contained in:
Norbert Pocs
2022-06-30 20:21:59 +02:00
parent 8343a43edc
commit 9a4c5203af
1 changed files with 95 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

101
src/libcrypto.c
View File

@@ -73,9 +73,13 @@
#include "libssh/crypto.h" #include "libssh/crypto.h"
#ifdef HAVE_OPENSSL_EVP_KDF_CTX_NEW_ID #ifdef HAVE_OPENSSL_EVP_KDF_CTX
#include <openssl/kdf.h> #include <openssl/kdf.h>
#endif #if OPENSSL_VERSION_NUMBER >= 0x30000000L
#include <openssl/param_build.h>
#include <openssl/core_names.h>
#endif /* OPENSSL_VERSION_NUMBER */
#endif /* HAVE_OPENSSL_EVP_KDF_CTX */
#include "libssh/crypto.h" #include "libssh/crypto.h"
@@ -347,7 +351,8 @@ void md5_final(unsigned char *md, MD5CTX c)
EVP_MD_CTX_free(c); EVP_MD_CTX_free(c);
} }
#ifdef HAVE_OPENSSL_EVP_KDF_CTX_NEW_ID #ifdef HAVE_OPENSSL_EVP_KDF_CTX
#if OPENSSL_VERSION_NUMBER < 0x30000000L
static const EVP_MD *sshkdf_digest_to_md(enum ssh_kdf_digest digest_type) static const EVP_MD *sshkdf_digest_to_md(enum ssh_kdf_digest digest_type)
{ {
switch (digest_type) { switch (digest_type) {
@@ -362,19 +367,50 @@ static const EVP_MD *sshkdf_digest_to_md(enum ssh_kdf_digest digest_type)
} }
return NULL; return NULL;
} }
#else
static const char *sshkdf_digest_to_md(enum ssh_kdf_digest digest_type)
{
switch (digest_type) {
case SSH_KDF_SHA1:
return SN_sha1;
case SSH_KDF_SHA256:
return SN_sha256;
case SSH_KDF_SHA384:
return SN_sha384;
case SSH_KDF_SHA512:
return SN_sha512;
}
return NULL;
}
#endif /* OPENSSL_VERSION_NUMBER */
int ssh_kdf(struct ssh_crypto_struct *crypto, int ssh_kdf(struct ssh_crypto_struct *crypto,
unsigned char *key, size_t key_len, unsigned char *key, size_t key_len,
int key_type, unsigned char *output, int key_type, unsigned char *output,
size_t requested_len) size_t requested_len)
{ {
int rc = -1;
#if OPENSSL_VERSION_NUMBER < 0x30000000L
EVP_KDF_CTX *ctx = EVP_KDF_CTX_new_id(EVP_KDF_SSHKDF); EVP_KDF_CTX *ctx = EVP_KDF_CTX_new_id(EVP_KDF_SSHKDF);
int rc; #else
EVP_KDF *kdf = EVP_KDF_fetch(NULL, "SSHKDF", NULL);
EVP_KDF_CTX *ctx = EVP_KDF_CTX_new(kdf);
OSSL_PARAM_BLD *param_bld = OSSL_PARAM_BLD_new();
OSSL_PARAM *params = NULL;
const char *md = sshkdf_digest_to_md(crypto->digest_type);
if (ctx == NULL) { EVP_KDF_free(kdf);
if (param_bld == NULL) {
EVP_KDF_CTX_free(ctx);
return -1; return -1;
} }
#endif /* OPENSSL_VERSION_NUMBER */
if (ctx == NULL) {
goto out;
}
#if OPENSSL_VERSION_NUMBER < 0x30000000L
rc = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_MD, rc = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_MD,
sshkdf_digest_to_md(crypto->digest_type)); sshkdf_digest_to_md(crypto->digest_type));
if (rc != 1) { if (rc != 1) {
@@ -402,8 +438,60 @@ int ssh_kdf(struct ssh_crypto_struct *crypto,
if (rc != 1) { if (rc != 1) {
goto out; goto out;
} }
#else
rc = OSSL_PARAM_BLD_push_utf8_string(param_bld, OSSL_KDF_PARAM_DIGEST,
md, strlen(md));
if (rc != 1) {
rc = -1;
goto out;
}
rc = OSSL_PARAM_BLD_push_octet_string(param_bld, OSSL_KDF_PARAM_KEY,
key, key_len);
if (rc != 1) {
rc = -1;
goto out;
}
rc = OSSL_PARAM_BLD_push_octet_string(param_bld,
OSSL_KDF_PARAM_SSHKDF_XCGHASH,
crypto->secret_hash,
crypto->digest_len);
if (rc != 1) {
rc = -1;
goto out;
}
rc = OSSL_PARAM_BLD_push_octet_string(param_bld,
OSSL_KDF_PARAM_SSHKDF_SESSION_ID,
crypto->session_id,
crypto->session_id_len);
if (rc != 1) {
rc = -1;
goto out;
}
rc = OSSL_PARAM_BLD_push_utf8_string(param_bld, OSSL_KDF_PARAM_SSHKDF_TYPE,
(const char*)&key_type, 1);
if (rc != 1) {
rc = -1;
goto out;
}
params = OSSL_PARAM_BLD_to_param(param_bld);
if (params == NULL) {
rc = -1;
goto out;
}
rc = EVP_KDF_derive(ctx, output, requested_len, params);
if (rc != 1) {
rc = -1;
goto out;
}
#endif /* OPENSSL_VERSION_NUMBER */
out: out:
#if OPENSSL_VERSION_NUMBER >= 0x30000000L
OSSL_PARAM_BLD_free(param_bld);
OSSL_PARAM_free(params);
#endif
EVP_KDF_CTX_free(ctx); EVP_KDF_CTX_free(ctx);
if (rc < 0) { if (rc < 0) {
return rc; return rc;
@@ -420,7 +508,8 @@ int ssh_kdf(struct ssh_crypto_struct *crypto,
return sshkdf_derive_key(crypto, key, key_len, return sshkdf_derive_key(crypto, key, key_len,
key_type, output, requested_len); key_type, output, requested_len);
} }
#endif /* HAVE_OPENSSL_EVP_KDF_CTX_NEW_ID */ #endif /* HAVE_OPENSSL_EVP_KDF_CTX */
HMACCTX hmac_init(const void *key, size_t len, enum ssh_hmac_e type) HMACCTX hmac_init(const void *key, size_t len, enum ssh_hmac_e type)
{ {
HMACCTX ctx = NULL; HMACCTX ctx = NULL;