bind/lib/dns/openssl_shim.h

/*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * SPDX-License-Identifier: MPL-2.0
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, you can obtain one at https://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */

#pragma once

#include <openssl/bn.h>
#include <openssl/dh.h>
#include <openssl/ecdsa.h>
#include <openssl/err.h>
#include <openssl/evp.h>
#include <openssl/opensslv.h>
#include <openssl/rsa.h>

/*
 * Limit the size of public exponents.
 */
#ifndef RSA_MAX_PUBEXP_BITS
#define RSA_MAX_PUBEXP_BITS 35
#endif /* ifndef RSA_MAX_PUBEXP_BITS */

#if !HAVE_EVP_PKEY_EQ
#define EVP_PKEY_eq EVP_PKEY_cmp
#endif
Use ERR_get_error_all() instead of deprecated ERR_get_error_line_data() OpenSSL 3.0.0 deprecates the ERR_get_error_line_data() function. Use ERR_get_error_all() instead of ERR_get_error_line_data() and create a shim to use the old variant for the older OpenSSL versions which don't have the newer ERR_get_error_all(). 2021-09-05 09:41:00 +00:00			`/*`
			`* Copyright (C) Internet Systems Consortium, Inc. ("ISC")`
			`*`
			`* SPDX-License-Identifier: MPL-2.0`
Update the copyright information in all files in the repository This commit converts the license handling to adhere to the REUSE specification. It specifically: 1. Adds used licnses to LICENSES/ directory 2. Add "isc" template for adding the copyright boilerplate 3. Changes all source files to include copyright and SPDX license header, this includes all the C sources, documentation, zone files, configuration files. There are notes in the doc/dev/copyrights file on how to add correct headers to the new files. 4. Handle the rest that can't be modified via .reuse/dep5 file. The binary (or otherwise unmodifiable) files could have license places next to them in <foo>.license file, but this would lead to cluttered repository and most of the files handled in the .reuse/dep5 file are system test files. 2021-06-03 08:37:05 +02:00			`*`
Use ERR_get_error_all() instead of deprecated ERR_get_error_line_data() OpenSSL 3.0.0 deprecates the ERR_get_error_line_data() function. Use ERR_get_error_all() instead of ERR_get_error_line_data() and create a shim to use the old variant for the older OpenSSL versions which don't have the newer ERR_get_error_all(). 2021-09-05 09:41:00 +00:00			`* This Source Code Form is subject to the terms of the Mozilla Public`
			`* License, v. 2.0. If a copy of the MPL was not distributed with this`
			`* file, you can obtain one at https://mozilla.org/MPL/2.0/.`
			`*`
			`* See the COPYRIGHT file distributed with this work for additional`
			`* information regarding copyright ownership.`
			`*/`

			`#pragma once`

Use the special shims file for ECDSA shims Since we now have a separate `openssl_shim.{c,h}` files in the `dns` library, we can place the exisintg shims there. 2021-09-14 14:59:18 +00:00			`#include <openssl/bn.h>`
Use the special shims file for DH shims Since we now have a separate `openssl_shim.{c,h}` files in the `dns` library, we can place the exisintg shims there. 2021-10-04 16:51:02 +00:00			`#include <openssl/dh.h>`
Use the special shims file for ECDSA shims Since we now have a separate `openssl_shim.{c,h}` files in the `dns` library, we can place the exisintg shims there. 2021-09-14 14:59:18 +00:00			`#include <openssl/ecdsa.h>`
Use ERR_get_error_all() instead of deprecated ERR_get_error_line_data() OpenSSL 3.0.0 deprecates the ERR_get_error_line_data() function. Use ERR_get_error_all() instead of ERR_get_error_line_data() and create a shim to use the old variant for the older OpenSSL versions which don't have the newer ERR_get_error_all(). 2021-09-05 09:41:00 +00:00			`#include <openssl/err.h>`
Refactor OpenSSL RSA exponent bits checking to a helper function - Make it a separate opensslrsa_check_exponent_bits() function to clean up the code a bit - Always use provider API first if using openssl 3.0, and fallback to EVP API for older openssl or if built with engine support - Use RSA_get0_key() (with shim for openssl 1.0) to avoid memory allocations 2022-12-26 14:25:18 +02:00			`#include <openssl/evp.h>`
Use the special shims file for RSA shims Since we now have a separate `openssl_shim.{c,h}` files in the `dns` library, we can place the exisintg shims there. 2021-09-26 18:53:38 +00:00			`#include <openssl/opensslv.h>`
			`#include <openssl/rsa.h>`

			`/*`
			`* Limit the size of public exponents.`
			`*/`
			`#ifndef RSA_MAX_PUBEXP_BITS`
			`#define RSA_MAX_PUBEXP_BITS 35`
			`#endif /* ifndef RSA_MAX_PUBEXP_BITS */`

Use EVP_PKEY_eq() instead of deprected EVP_PKEY_cmp() EVP_PKEY_eq() is the replacement with a smaller result range (0, 1) instead of (-1, 0, 1). EVP_PKEY_cmp() is mapped to EVP_PKEY_eq() when building with older versions of OpenSSL. 2021-09-08 16:31:56 +10:00			`#if !HAVE_EVP_PKEY_EQ`
			`#define EVP_PKEY_eq EVP_PKEY_cmp`
			`#endif`