246 lines
8.2 KiB
Diff
246 lines
8.2 KiB
Diff
From cc8edfc6670ba97434bc5acb595539fd9c7d9123 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
|
|
Date: Thu, 8 Sep 2022 16:33:38 +0200
|
|
Subject: [PATCH 3/3] Remove engine related parts for OpenSSL 3.0
|
|
|
|
OpenSSL just cannot work with mixing ENGINE_* api mixed with OSSL_PARAM
|
|
builders. But it can be built in legacy mode, where deprecated but still
|
|
working API would be used.
|
|
|
|
It can work under OpenSSL 3.0, but only if using legacy code paths
|
|
matching OpenSSL 1.1 calls and functions.
|
|
|
|
Remove fromlabel processing by OpenSSL 3.0 only functions. They can
|
|
return later with a proper provider support for pkcs11.
|
|
---
|
|
lib/dns/opensslecdsa_link.c | 55 -------------------------------------
|
|
lib/dns/opensslrsa_link.c | 32 ---------------------
|
|
2 files changed, 87 deletions(-)
|
|
|
|
diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
|
|
index 04f0d80b5e..f04f076e42 100644
|
|
--- a/lib/dns/opensslecdsa_link.c
|
|
+++ b/lib/dns/opensslecdsa_link.c
|
|
@@ -1311,15 +1311,9 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
|
|
#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
|
|
isc_result_t ret = ISC_R_SUCCESS;
|
|
ENGINE *e;
|
|
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
EC_KEY *eckey = NULL;
|
|
EC_KEY *pubeckey = NULL;
|
|
int group_nid;
|
|
-#else
|
|
- size_t len;
|
|
- const char *curve_name, *nist_curve_name;
|
|
- char buf[128]; /* Sufficient for all of the supported curves' names. */
|
|
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
EVP_PKEY *pkey = NULL;
|
|
EVP_PKEY *pubpkey = NULL;
|
|
|
|
@@ -1336,22 +1330,11 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
|
|
DST_RET(DST_R_NOENGINE);
|
|
}
|
|
|
|
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
if (key->key_alg == DST_ALG_ECDSA256) {
|
|
group_nid = NID_X9_62_prime256v1;
|
|
} else {
|
|
group_nid = NID_secp384r1;
|
|
}
|
|
-#else
|
|
- /* Get the expected curve names */
|
|
- if (key->key_alg == DST_ALG_ECDSA256) {
|
|
- curve_name = "prime256v1";
|
|
- nist_curve_name = "P-256";
|
|
- } else {
|
|
- curve_name = "secp384r1";
|
|
- nist_curve_name = "P-384";
|
|
- }
|
|
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
|
/* Load private key. */
|
|
pkey = ENGINE_load_private_key(e, label, NULL, NULL);
|
|
@@ -1363,7 +1346,6 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
|
|
if (EVP_PKEY_base_id(pkey) != EVP_PKEY_EC) {
|
|
DST_RET(DST_R_INVALIDPRIVATEKEY);
|
|
}
|
|
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
eckey = EVP_PKEY_get1_EC_KEY(pkey);
|
|
if (eckey == NULL) {
|
|
DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
|
|
@@ -1371,20 +1353,6 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
|
|
if (EC_GROUP_get_curve_name(EC_KEY_get0_group(eckey)) != group_nid) {
|
|
DST_RET(DST_R_INVALIDPRIVATEKEY);
|
|
}
|
|
-#else
|
|
- len = 0;
|
|
- if (EVP_PKEY_get_utf8_string_param(pkey, OSSL_PKEY_PARAM_GROUP_NAME,
|
|
- buf, sizeof buf, &len) != 1 ||
|
|
- len == 0 || len >= sizeof buf)
|
|
- {
|
|
- DST_RET(DST_R_INVALIDPRIVATEKEY);
|
|
- }
|
|
- if (strncasecmp(buf, curve_name, strlen(curve_name)) != 0 &&
|
|
- strncasecmp(buf, nist_curve_name, strlen(nist_curve_name)) != 0)
|
|
- {
|
|
- DST_RET(DST_R_INVALIDPRIVATEKEY);
|
|
- }
|
|
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
|
/* Load public key. */
|
|
pubpkey = ENGINE_load_public_key(e, label, NULL, NULL);
|
|
@@ -1396,7 +1364,6 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
|
|
if (EVP_PKEY_base_id(pubpkey) != EVP_PKEY_EC) {
|
|
DST_RET(DST_R_INVALIDPUBLICKEY);
|
|
}
|
|
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
pubeckey = EVP_PKEY_get1_EC_KEY(pubpkey);
|
|
if (pubeckey == NULL) {
|
|
DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
|
|
@@ -1404,30 +1371,10 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
|
|
if (EC_GROUP_get_curve_name(EC_KEY_get0_group(pubeckey)) != group_nid) {
|
|
DST_RET(DST_R_INVALIDPUBLICKEY);
|
|
}
|
|
-#else
|
|
- len = 0;
|
|
- if (EVP_PKEY_get_utf8_string_param(pubpkey, OSSL_PKEY_PARAM_GROUP_NAME,
|
|
- buf, sizeof buf, &len) != 1 ||
|
|
- len == 0 || len >= sizeof buf)
|
|
- {
|
|
- DST_RET(DST_R_INVALIDPUBLICKEY);
|
|
- }
|
|
- if (strncasecmp(buf, curve_name, strlen(curve_name)) != 0 &&
|
|
- strncasecmp(buf, nist_curve_name, strlen(nist_curve_name)) != 0)
|
|
- {
|
|
- DST_RET(DST_R_INVALIDPUBLICKEY);
|
|
- }
|
|
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
|
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
if (ecdsa_check(eckey, pubeckey) != ISC_R_SUCCESS) {
|
|
DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
|
|
}
|
|
-#else
|
|
- if (ecdsa_check(&pkey, pubpkey) != ISC_R_SUCCESS) {
|
|
- DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
|
|
- }
|
|
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
|
key->label = isc_mem_strdup(key->mctx, label);
|
|
key->engine = isc_mem_strdup(key->mctx, engine);
|
|
@@ -1442,14 +1389,12 @@ err:
|
|
if (pkey != NULL) {
|
|
EVP_PKEY_free(pkey);
|
|
}
|
|
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
if (pubeckey != NULL) {
|
|
EC_KEY_free(pubeckey);
|
|
}
|
|
if (eckey != NULL) {
|
|
EC_KEY_free(eckey);
|
|
}
|
|
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
|
return (ret);
|
|
#else
|
|
diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
|
|
index 867b486a2f..cf350610ba 100644
|
|
--- a/lib/dns/opensslrsa_link.c
|
|
+++ b/lib/dns/opensslrsa_link.c
|
|
@@ -1167,7 +1167,6 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
|
|
key->engine = isc_mem_strdup(key->mctx, engine);
|
|
key->label = isc_mem_strdup(key->mctx, label);
|
|
|
|
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
rsa = EVP_PKEY_get1_RSA(pkey);
|
|
if (rsa == NULL) {
|
|
DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
|
|
@@ -1176,16 +1175,6 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
|
|
DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
|
|
}
|
|
RSA_get0_key(rsa, NULL, &ex, NULL);
|
|
-#else
|
|
- if (rsa_check(pkey, pub != NULL ? pub->keydata.pkey : NULL) !=
|
|
- ISC_R_SUCCESS) {
|
|
- DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
|
|
- }
|
|
- if (EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_E, &ex) !=
|
|
- 1) {
|
|
- DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
|
|
- }
|
|
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
|
if (ex == NULL) {
|
|
DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
|
|
@@ -1437,12 +1426,8 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
|
|
ENGINE *e = NULL;
|
|
isc_result_t ret = ISC_R_SUCCESS;
|
|
EVP_PKEY *pkey = NULL, *pubpkey = NULL;
|
|
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
RSA *rsa = NULL, *pubrsa = NULL;
|
|
const BIGNUM *ex = NULL;
|
|
-#else
|
|
- BIGNUM *ex = NULL;
|
|
-#endif
|
|
|
|
UNUSED(pin);
|
|
|
|
@@ -1459,12 +1444,10 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
|
|
DST_RET(dst__openssl_toresult2("ENGINE_load_public_key",
|
|
DST_R_OPENSSLFAILURE));
|
|
}
|
|
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
pubrsa = EVP_PKEY_get1_RSA(pubpkey);
|
|
if (pubrsa == NULL) {
|
|
DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
|
|
}
|
|
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
|
pkey = ENGINE_load_private_key(e, label, NULL, NULL);
|
|
if (pkey == NULL) {
|
|
@@ -1475,7 +1458,6 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
|
|
key->engine = isc_mem_strdup(key->mctx, engine);
|
|
key->label = isc_mem_strdup(key->mctx, label);
|
|
|
|
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
rsa = EVP_PKEY_get1_RSA(pkey);
|
|
if (rsa == NULL) {
|
|
DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
|
|
@@ -1484,14 +1466,6 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
|
|
DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
|
|
}
|
|
RSA_get0_key(rsa, NULL, &ex, NULL);
|
|
-#else
|
|
- if (rsa_check(pkey, pubpkey) != ISC_R_SUCCESS) {
|
|
- DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
|
|
- }
|
|
- if (EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_E, &ex) != 1) {
|
|
- DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
|
|
- }
|
|
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
|
if (ex == NULL) {
|
|
DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
|
|
@@ -1505,18 +1479,12 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
|
|
pkey = NULL;
|
|
|
|
err:
|
|
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
if (rsa != NULL) {
|
|
RSA_free(rsa);
|
|
}
|
|
if (pubrsa != NULL) {
|
|
RSA_free(pubrsa);
|
|
}
|
|
-#else
|
|
- if (ex != NULL) {
|
|
- BN_free(ex);
|
|
- }
|
|
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
if (pkey != NULL) {
|
|
EVP_PKEY_free(pkey);
|
|
}
|
|
--
|
|
2.37.2
|
|
|