mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-30 22:15:20 +00:00
Code Issues Releases Wiki Activity

4129. [port] Address API changes in OpenSSL 1.1.0. [RT #39532]

Browse Source
This commit is contained in:
Mark Andrews
2015-05-28 14:41:21 +10:00
parent a450977e98
commit 8bb630c751
7 changed files with 130 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
CHANGES
View File

@@ -1,3 +1,5 @@
4129. [port] Address API changes in OpenSSL 1.1.0. [RT #39532]
4128. [bug] Address issues raised by Coverity 7.6. [RT #39537] 4128. [bug] Address issues raised by Coverity 7.6. [RT #39537]
4127. [protocol] CDS and CDNSKEY need to be signed by the key signing 4127. [protocol] CDS and CDNSKEY need to be signed by the key signing

15
lib/dns/dst_openssl.h
View File

@@ -29,12 +29,27 @@
#include <openssl/evp.h> #include <openssl/evp.h>
#include <openssl/conf.h> #include <openssl/conf.h>
#include <openssl/crypto.h> #include <openssl/crypto.h>
#include <openssl/bn.h>
#if !defined(OPENSSL_NO_ENGINE) && defined(CRYPTO_LOCK_ENGINE) && \ #if !defined(OPENSSL_NO_ENGINE) && defined(CRYPTO_LOCK_ENGINE) && \
(OPENSSL_VERSION_NUMBER >= 0x0090707f) (OPENSSL_VERSION_NUMBER >= 0x0090707f)
#define USE_ENGINE 1 #define USE_ENGINE 1
#endif #endif
#if OPENSSL_VERSION_NUMBER < 0x10100000L
/*
* These are new in OpenSSL 1.1.0. BN_GENCB _cb needs to be declared in
* the function like this before the BN_GENCB_new call:
*
* #if OPENSSL_VERSION_NUMBER < 0x10100000L
* _cb;
* #endif
*/
#define BN_GENCB_free(x) (x = NULL);
#define BN_GENCB_new() (&_cb)
#define BN_GENCB_get_arg(x) ((x)->arg)
#endif
ISC_LANG_BEGINDECLS ISC_LANG_BEGINDECLS
isc_result_t isc_result_t

19
lib/dns/openssl_link.c
View File

@@ -88,6 +88,7 @@ entropy_getpseudo(unsigned char *buf, int num) {
return (result == ISC_R_SUCCESS ? 1 : -1); return (result == ISC_R_SUCCESS ? 1 : -1);
} }
#if OPENSSL_VERSION_NUMBER < 0x10100000L
static void static void
entropy_add(const void *buf, int num, double entropy) { entropy_add(const void *buf, int num, double entropy) {
/* /*
@@ -97,6 +98,18 @@ entropy_add(const void *buf, int num, double entropy) {
UNUSED(num); UNUSED(num);
UNUSED(entropy); UNUSED(entropy);
} }
#else
static int
entropy_add(const void *buf, int num, double entropy) {
/*
* Do nothing. The only call to this provides no useful data anyway.
*/
UNUSED(buf);
UNUSED(num);
UNUSED(entropy);
return (1);
}
#endif
static void static void
lock_callback(int mode, int type, const char *file, int line) { lock_callback(int mode, int type, const char *file, int line) {
@@ -108,10 +121,12 @@ lock_callback(int mode, int type, const char *file, int line) {
UNLOCK(&locks[type]); UNLOCK(&locks[type]);
} }
#if OPENSSL_VERSION_NUMBER < 0x10100000L
static unsigned long static unsigned long
id_callback(void) { id_callback(void) {
return ((unsigned long)isc_thread_self()); return ((unsigned long)isc_thread_self());
} }
#endif
static void * static void *
mem_alloc(size_t size) { mem_alloc(size_t size) {
@@ -172,7 +187,9 @@ dst__openssl_init(const char *engine) {
if (result != ISC_R_SUCCESS) if (result != ISC_R_SUCCESS)
goto cleanup_mutexalloc; goto cleanup_mutexalloc;
CRYPTO_set_locking_callback(lock_callback); CRYPTO_set_locking_callback(lock_callback);
#if OPENSSL_VERSION_NUMBER < 0x10100000L
CRYPTO_set_id_callback(id_callback); CRYPTO_set_id_callback(id_callback);
#endif
ERR_load_crypto_strings(); ERR_load_crypto_strings();
@@ -270,7 +287,9 @@ dst__openssl_destroy(void) {
CRYPTO_cleanup_all_ex_data(); CRYPTO_cleanup_all_ex_data();
#endif #endif
ERR_clear_error(); ERR_clear_error();
#if OPENSSL_VERSION_NUMBER < 0x10100000L
ERR_remove_state(0); ERR_remove_state(0);
#endif
ERR_free_strings(); ERR_free_strings();
#ifdef DNS_CRYPTO_LEAKS #ifdef DNS_CRYPTO_LEAKS

108
lib/dns/openssldh_link.c
View File

@@ -71,7 +71,7 @@
static isc_result_t openssldh_todns(const dst_key_t *key, isc_buffer_t *data); static isc_result_t openssldh_todns(const dst_key_t *key, isc_buffer_t *data);
static BIGNUM bn2, bn768, bn1024, bn1536; static BIGNUM *bn2, *bn768, *bn1024, *bn1536;
static isc_result_t static isc_result_t
openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv, openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv,
@@ -161,7 +161,7 @@ progress_cb(int p, int n, BN_GENCB *cb)
UNUSED(n); UNUSED(n);
u.dptr = cb->arg; u.dptr = BN_GENCB_get_arg(cb);
if (u.fptr != NULL) if (u.fptr != NULL)
u.fptr(p); u.fptr(p);
return (1); return (1);
@@ -172,7 +172,10 @@ static isc_result_t
openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) { openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
DH *dh = NULL; DH *dh = NULL;
#if OPENSSL_VERSION_NUMBER > 0x00908000L #if OPENSSL_VERSION_NUMBER > 0x00908000L
BN_GENCB cb; BN_GENCB *cb;
#if OPENSSL_VERSION_NUMBER < 0x10100000L
BN_GENCB _cb;
#endif
union { union {
void *dptr; void *dptr;
void (*fptr)(int); void (*fptr)(int);
@@ -191,12 +194,12 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
if (dh == NULL) if (dh == NULL)
return (dst__openssl_toresult(ISC_R_NOMEMORY)); return (dst__openssl_toresult(ISC_R_NOMEMORY));
if (key->key_size == 768) if (key->key_size == 768)
dh->p = &bn768; dh->p = bn768;
else if (key->key_size == 1024) else if (key->key_size == 1024)
dh->p = &bn1024; dh->p = bn1024;
else else
dh->p = &bn1536; dh->p = bn1536;
dh->g = &bn2; dh->g = bn2;
} else } else
generator = 2; generator = 2;
} }
@@ -206,21 +209,28 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
dh = DH_new(); dh = DH_new();
if (dh == NULL) if (dh == NULL)
return (dst__openssl_toresult(ISC_R_NOMEMORY)); return (dst__openssl_toresult(ISC_R_NOMEMORY));
cb = BN_GENCB_new();
if (cb == NULL) {
DH_free(dh);
return (dst__openssl_toresult(ISC_R_NOMEMORY));
}
if (callback == NULL) { if (callback == NULL) {
BN_GENCB_set_old(&cb, NULL, NULL); BN_GENCB_set_old(cb, NULL, NULL);
} else { } else {
u.fptr = callback; u.fptr = callback;
BN_GENCB_set(&cb, &progress_cb, u.dptr); BN_GENCB_set(cb, &progress_cb, u.dptr);
} }
if (!DH_generate_parameters_ex(dh, key->key_size, generator, if (!DH_generate_parameters_ex(dh, key->key_size, generator,
&cb)) { cb)) {
DH_free(dh); DH_free(dh);
BN_GENCB_free(cb);
return (dst__openssl_toresult2( return (dst__openssl_toresult2(
"DH_generate_parameters_ex", "DH_generate_parameters_ex",
DST_R_OPENSSLFAILURE)); DST_R_OPENSSLFAILURE));
} }
BN_GENCB_free(cb);
#else #else
dh = DH_generate_parameters(key->key_size, generator, dh = DH_generate_parameters(key->key_size, generator,
NULL, NULL); NULL, NULL);
@@ -256,9 +266,9 @@ openssldh_destroy(dst_key_t *key) {
if (dh == NULL) if (dh == NULL)
return; return;
if (dh->p == &bn768 || dh->p == &bn1024 || dh->p == &bn1536) if (dh->p == bn768 || dh->p == bn1024 || dh->p == bn1536)
dh->p = NULL; dh->p = NULL;
if (dh->g == &bn2) if (dh->g == bn2)
dh->g = NULL; dh->g = NULL;
DH_free(dh); DH_free(dh);
key->keydata.dh = NULL; key->keydata.dh = NULL;
@@ -294,8 +304,8 @@ openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {
isc_buffer_availableregion(data, &r); isc_buffer_availableregion(data, &r);
if (dh->g == &bn2 && if (dh->g == bn2 &&
(dh->p == &bn768 || dh->p == &bn1024 || dh->p == &bn1536)) { (dh->p == bn768 || dh->p == bn1024 || dh->p == bn1536)) {
plen = 1; plen = 1;
glen = 0; glen = 0;
} }
@@ -310,9 +320,9 @@ openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {
uint16_toregion(plen, &r); uint16_toregion(plen, &r);
if (plen == 1) { if (plen == 1) {
if (dh->p == &bn768) if (dh->p == bn768)
*r.base = 1; *r.base = 1;
else if (dh->p == &bn1024) else if (dh->p == bn1024)
*r.base = 2; *r.base = 2;
else else
*r.base = 3; *r.base = 3;
@@ -375,13 +385,13 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
special = uint16_fromregion(&r); special = uint16_fromregion(&r);
switch (special) { switch (special) {
case 1: case 1:
dh->p = &bn768; dh->p = bn768;
break; break;
case 2: case 2:
dh->p = &bn1024; dh->p = bn1024;
break; break;
case 3: case 3:
dh->p = &bn1536; dh->p = bn1536;
break; break;
default: default:
DH_free(dh); DH_free(dh);
@@ -409,12 +419,12 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
} }
if (special != 0) { if (special != 0) {
if (glen == 0) if (glen == 0)
dh->g = &bn2; dh->g = bn2;
else { else {
dh->g = BN_bin2bn(r.base, glen, NULL); dh->g = BN_bin2bn(r.base, glen, NULL);
if (BN_cmp(dh->g, &bn2) == 0) { if (BN_cmp(dh->g, bn2) == 0) {
BN_free(dh->g); BN_free(dh->g);
dh->g = &bn2; dh->g = bn2;
} }
else { else {
DH_free(dh); DH_free(dh);
@@ -569,25 +579,25 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
if ((key->key_size == 768 || if ((key->key_size == 768 ||
key->key_size == 1024 || key->key_size == 1024 ||
key->key_size == 1536) && key->key_size == 1536) &&
BN_cmp(dh->g, &bn2) == 0) BN_cmp(dh->g, bn2) == 0)
{ {
if (key->key_size == 768 && BN_cmp(dh->p, &bn768) == 0) { if (key->key_size == 768 && BN_cmp(dh->p, bn768) == 0) {
BN_free(dh->p); BN_free(dh->p);
BN_free(dh->g); BN_free(dh->g);
dh->p = &bn768; dh->p = bn768;
dh->g = &bn2; dh->g = bn2;
} else if (key->key_size == 1024 && } else if (key->key_size == 1024 &&
BN_cmp(dh->p, &bn1024) == 0) { BN_cmp(dh->p, bn1024) == 0) {
BN_free(dh->p); BN_free(dh->p);
BN_free(dh->g); BN_free(dh->g);
dh->p = &bn1024; dh->p = bn1024;
dh->g = &bn2; dh->g = bn2;
} else if (key->key_size == 1536 && } else if (key->key_size == 1536 &&
BN_cmp(dh->p, &bn1536) == 0) { BN_cmp(dh->p, bn1536) == 0) {
BN_free(dh->p); BN_free(dh->p);
BN_free(dh->g); BN_free(dh->g);
dh->p = &bn1536; dh->p = bn1536;
dh->g = &bn2; dh->g = bn2;
} }
} }
@@ -628,10 +638,10 @@ BN_fromhex(BIGNUM *b, const char *str) {
static void static void
openssldh_cleanup(void) { openssldh_cleanup(void) {
BN_free(&bn2); BN_free(bn2);
BN_free(&bn768); BN_free(bn768);
BN_free(&bn1024); BN_free(bn1024);
BN_free(&bn1536); BN_free(bn1536);
} }
static dst_func_t openssldh_functions = { static dst_func_t openssldh_functions = {
@@ -662,17 +672,27 @@ isc_result_t
dst__openssldh_init(dst_func_t **funcp) { dst__openssldh_init(dst_func_t **funcp) {
REQUIRE(funcp != NULL); REQUIRE(funcp != NULL);
if (*funcp == NULL) { if (*funcp == NULL) {
BN_init(&bn2); bn2 = BN_new();
BN_init(&bn768); bn768 = BN_new();
BN_init(&bn1024); bn1024 = BN_new();
BN_init(&bn1536); bn1536 = BN_new();
BN_set_word(&bn2, 2); if (bn2 == NULL || bn768 == NULL ||
BN_fromhex(&bn768, PRIME768); bn1024 == NULL || bn1536 == NULL)
BN_fromhex(&bn1024, PRIME1024); goto cleanup;
BN_fromhex(&bn1536, PRIME1536); BN_set_word(bn2, 2);
BN_fromhex(bn768, PRIME768);
BN_fromhex(bn1024, PRIME1024);
BN_fromhex(bn1536, PRIME1536);
*funcp = &openssldh_functions; *funcp = &openssldh_functions;
} }
return (ISC_R_SUCCESS); return (ISC_R_SUCCESS);
cleanup:
if (bn2 != NULL) BN_free(bn2);
if (bn768 != NULL) BN_free(bn768);
if (bn1024 != NULL) BN_free(bn1024);
if (bn1536 != NULL) BN_free(bn1536);
return (ISC_R_NOMEMORY);
} }
#else /* OPENSSL */ #else /* OPENSSL */

21
lib/dns/openssldsa_link.c
View File

@@ -339,7 +339,7 @@ progress_cb(int p, int n, BN_GENCB *cb)
UNUSED(n); UNUSED(n);
u.dptr = cb->arg; u.dptr = BN_GENCB_get_arg(cb);
if (u.fptr != NULL) if (u.fptr != NULL)
u.fptr(p); u.fptr(p);
return (1); return (1);
@@ -352,7 +352,10 @@ openssldsa_generate(dst_key_t *key, int unused, void (*callback)(int)) {
unsigned char rand_array[ISC_SHA1_DIGESTLENGTH]; unsigned char rand_array[ISC_SHA1_DIGESTLENGTH];
isc_result_t result; isc_result_t result;
#if OPENSSL_VERSION_NUMBER > 0x00908000L #if OPENSSL_VERSION_NUMBER > 0x00908000L
BN_GENCB cb; BN_GENCB *cb;
#if OPENSSL_VERSION_NUMBER < 0x10100000L
BN_GENCB _cb;
#endif
union { union {
void *dptr; void *dptr;
void (*fptr)(int); void (*fptr)(int);
@@ -373,22 +376,30 @@ openssldsa_generate(dst_key_t *key, int unused, void (*callback)(int)) {
dsa = DSA_new(); dsa = DSA_new();
if (dsa == NULL) if (dsa == NULL)
return (dst__openssl_toresult(DST_R_OPENSSLFAILURE)); return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
cb = BN_GENCB_new();
if (cb == NULL) {
DSA_free(dsa);
return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
}
if (callback == NULL) { if (callback == NULL) {
BN_GENCB_set_old(&cb, NULL, NULL); BN_GENCB_set_old(cb, NULL, NULL);
} else { } else {
u.fptr = callback; u.fptr = callback;
BN_GENCB_set(&cb, &progress_cb, u.dptr); BN_GENCB_set(cb, &progress_cb, u.dptr);
} }
if (!DSA_generate_parameters_ex(dsa, key->key_size, rand_array, if (!DSA_generate_parameters_ex(dsa, key->key_size, rand_array,
ISC_SHA1_DIGESTLENGTH, NULL, NULL, ISC_SHA1_DIGESTLENGTH, NULL, NULL,
&cb)) cb))
{ {
DSA_free(dsa); DSA_free(dsa);
BN_GENCB_free(cb);
return (dst__openssl_toresult2("DSA_generate_parameters_ex", return (dst__openssl_toresult2("DSA_generate_parameters_ex",
DST_R_OPENSSLFAILURE)); DST_R_OPENSSLFAILURE));
} }
BN_GENCB_free(cb);
#else #else
dsa = DSA_generate_parameters(key->key_size, rand_array, dsa = DSA_generate_parameters(key->key_size, rand_array,
ISC_SHA1_DIGESTLENGTH, NULL, NULL, ISC_SHA1_DIGESTLENGTH, NULL, NULL,

19
lib/dns/opensslrsa_link.c
View File

@@ -752,7 +752,7 @@ progress_cb(int p, int n, BN_GENCB *cb) {
UNUSED(n); UNUSED(n);
u.dptr = cb->arg; u.dptr = BN_GENCB_get_arg(cb);
if (u.fptr != NULL) if (u.fptr != NULL)
u.fptr(p); u.fptr(p);
return (1); return (1);
@@ -763,18 +763,21 @@ static isc_result_t
opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) { opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
#if OPENSSL_VERSION_NUMBER > 0x00908000L #if OPENSSL_VERSION_NUMBER > 0x00908000L
isc_result_t ret = DST_R_OPENSSLFAILURE; isc_result_t ret = DST_R_OPENSSLFAILURE;
BN_GENCB cb;
union { union {
void *dptr; void *dptr;
void (*fptr)(int); void (*fptr)(int);
} u; } u;
RSA *rsa = RSA_new(); RSA *rsa = RSA_new();
BIGNUM *e = BN_new(); BIGNUM *e = BN_new();
#if OPENSSL_VERSION_NUMBER < 0x10100000L
BN_GENCB _cb;
#endif
BN_GENCB *cb = BN_GENCB_new();
#if USE_EVP #if USE_EVP
EVP_PKEY *pkey = EVP_PKEY_new(); EVP_PKEY *pkey = EVP_PKEY_new();
#endif #endif
if (rsa == NULL || e == NULL) if (rsa == NULL || e == NULL || cb == NULL)
goto err; goto err;
#if USE_EVP #if USE_EVP
if (pkey == NULL) if (pkey == NULL)
@@ -794,14 +797,15 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
} }
if (callback == NULL) { if (callback == NULL) {
BN_GENCB_set_old(&cb, NULL, NULL); BN_GENCB_set_old(cb, NULL, NULL);
} else { } else {
u.fptr = callback; u.fptr = callback;
BN_GENCB_set(&cb, &progress_cb, u.dptr); BN_GENCB_set(cb, &progress_cb, u.dptr);
} }
if (RSA_generate_key_ex(rsa, key->key_size, e, &cb)) { if (RSA_generate_key_ex(rsa, key->key_size, e, cb)) {
BN_free(e); BN_free(e);
BN_GENCB_free(cb);
SET_FLAGS(rsa); SET_FLAGS(rsa);
#if USE_EVP #if USE_EVP
key->keydata.pkey = pkey; key->keydata.pkey = pkey;
@@ -812,6 +816,7 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
#endif #endif
return (ISC_R_SUCCESS); return (ISC_R_SUCCESS);
} }
BN_GENCB_free(cb);
ret = dst__openssl_toresult2("RSA_generate_key_ex", ret = dst__openssl_toresult2("RSA_generate_key_ex",
DST_R_OPENSSLFAILURE); DST_R_OPENSSLFAILURE);
@@ -824,6 +829,8 @@ err:
BN_free(e); BN_free(e);
if (rsa != NULL) if (rsa != NULL)
RSA_free(rsa); RSA_free(rsa);
if (cb != NULL)
BN_GENCB_free(cb);
return (dst__openssl_toresult(ret)); return (dst__openssl_toresult(ret));
#else #else
RSA *rsa; RSA *rsa;

1
lib/dns/tests/gost_test.c
View File

@@ -37,6 +37,7 @@
#include <openssl/objects.h> #include <openssl/objects.h>
#include <openssl/rsa.h> #include <openssl/rsa.h>
#include <openssl/engine.h> #include <openssl/engine.h>
#include <openssl/bn.h>
#endif #endif
#ifdef HAVE_PKCS11_GOST #ifdef HAVE_PKCS11_GOST