mirrors/openvpn
0
0
Fork 0
mirror of https://github.com/OpenVPN/openvpn.git synced 2024-11-23 17:53:49 +08:00
Code Issues Packages Projects Releases Wiki Activity

openssl: Fix compilation without deprecated OpenSSL 1.1 APIs

Browse Source 
EVP_CIPHER_CTX_init and _cleanup were deprecated in 1.1 and both were
replaced with _reset.

EVP_CIPHER_CTX_free in OpenSSL 1.1 replaces the cleanup/free combo of
earlier OpenSSL version. And OpenSSL 1.0.2 already calls cleanup as part
of _free.

Therefore we can remove the _cleanup calls and use the OpenSSL 1.1. API
everywhere.

Also removed initialisation with OpenSSL 1.1 as it is no longer
needed and causes compilation errors when disabling deprecated APIs.

Same with SSL_CTX_set_ecdh_auto as it got removed.

Patch V3: Use EVP_CIPHER_CTX_reset instead of init/cleanup

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Rosen Penev <rosenp@gmail.com>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <20190724152934.9884-1-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18700.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
This commit is contained in:
Rosen Penev 2019-07-24 17:29:34 +02:00 committed by Gert Doering
parent 6d8380c78b
commit 8a01147ff7
7 changed files with 27 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
configure.ac
View File

@ -919,10 +919,13 @@ if test "${with_crypto_library}" = "openssl"; then
EVP_MD_CTX_new \
EVP_MD_CTX_free \
EVP_MD_CTX_reset \
EVP_CIPHER_CTX_reset \
OpenSSL_version \
SSL_CTX_get_default_passwd_cb \
SSL_CTX_get_default_passwd_cb_userdata \
SSL_CTX_set_security_level \
X509_get0_notBefore \
X509_get0_notAfter \
X509_get0_pubkey \
X509_STORE_get0_objects \
X509_OBJECT_free \

1
src/openvpn/crypto.c
View File

@ -895,7 +895,6 @@ free_key_ctx(struct key_ctx *ctx)
{
if (ctx->cipher)
{
cipher_ctx_cleanup(ctx->cipher);
cipher_ctx_free(ctx->cipher);
ctx->cipher = NULL;
}

9
src/openvpn/crypto_backend.h
View File

@ -341,7 +341,7 @@ bool cipher_kt_mode_aead(const cipher_kt_t *cipher);
cipher_ctx_t *cipher_ctx_new(void);
/**
* Free a cipher context
* Cleanup and free a cipher context
*
* @param ctx Cipher context.
*/
@ -360,13 +360,6 @@ void cipher_ctx_free(cipher_ctx_t *ctx);
void cipher_ctx_init(cipher_ctx_t *ctx, const uint8_t *key, int key_len,
const cipher_kt_t *kt, int enc);
/**
* Cleanup the specified context.
*
* @param ctx Cipher context to cleanup.
*/
void cipher_ctx_cleanup(cipher_ctx_t *ctx);
/**
* Returns the size of the IV used by the cipher, in bytes, or 0 if no IV is
* used.

7
src/openvpn/crypto_mbedtls.c
View File

@ -616,12 +616,6 @@ cipher_ctx_init(mbedtls_cipher_context_t *ctx, const uint8_t *key, int key_len,
ASSERT(ctx->key_bitlen <= key_len*8);
}
void
cipher_ctx_cleanup(mbedtls_cipher_context_t *ctx)
{
mbedtls_cipher_free(ctx);
}
int
cipher_ctx_iv_length(const mbedtls_cipher_context_t *ctx)
{
@ -861,6 +855,7 @@ md_ctx_new(void)
void
md_ctx_free(mbedtls_md_context_t *ctx)
{
mbedtls_cipher_free(ctx);
free(ctx);
}

8
src/openvpn/crypto_openssl.c
View File

@ -772,7 +772,7 @@ cipher_ctx_init(EVP_CIPHER_CTX *ctx, const uint8_t *key, int key_len,
{
ASSERT(NULL != kt && NULL != ctx);
EVP_CIPHER_CTX_init(ctx);
EVP_CIPHER_CTX_reset(ctx);
if (!EVP_CipherInit(ctx, kt, NULL, NULL, enc))
{
crypto_msg(M_FATAL, "EVP cipher init #1");
@ -792,12 +792,6 @@ cipher_ctx_init(EVP_CIPHER_CTX *ctx, const uint8_t *key, int key_len,
ASSERT(EVP_CIPHER_CTX_key_length(ctx) <= key_len);
}
void
cipher_ctx_cleanup(EVP_CIPHER_CTX *ctx)
{
EVP_CIPHER_CTX_cleanup(ctx);
}
int
cipher_ctx_iv_length(const EVP_CIPHER_CTX *ctx)
{

12
src/openvpn/openssl_compat.h
View File

@ -89,6 +89,18 @@ EVP_MD_CTX_new(void)
}
#endif
#if !defined(HAVE_EVP_CIPHER_CTX_RESET)
#define EVP_CIPHER_CTX_reset EVP_CIPHER_CTX_init
#endif
#if !defined(HAVE_X509_GET0_NOTBEFORE)
#define X509_get0_notBefore X509_get_notBefore
#endif
#if !defined(HAVE_X509_GET0_NOTAFTER)
#define X509_get0_notAfter X509_get_notAfter
#endif
#if !defined(HAVE_HMAC_CTX_RESET)
/**
* Reset a HMAC context

12
src/openvpn/ssl_openssl.c
View File

@ -76,12 +76,13 @@ int mydata_index; /* GLOBAL */
void
tls_init_lib(void)
{
#if (OPENSSL_VERSION_NUMBER < 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER))
SSL_library_init();
#ifndef ENABLE_SMALL
SSL_load_error_strings();
#endif
OpenSSL_add_all_algorithms();
#endif
mydata_index = SSL_get_ex_new_index(0, "struct session *", NULL, NULL, NULL);
ASSERT(mydata_index >= 0);
}
@ -89,10 +90,12 @@ tls_init_lib(void)
void
tls_free_lib(void)
{
#if (OPENSSL_VERSION_NUMBER < 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER))
EVP_cleanup();
#ifndef ENABLE_SMALL
ERR_free_strings();
#endif
#endif
}
void
@ -541,7 +544,7 @@ tls_ctx_check_cert_time(const struct tls_root_ctx *ctx)
goto cleanup; /* Nothing to check if there is no certificate */
}
ret = X509_cmp_time(X509_get_notBefore(cert), NULL);
ret = X509_cmp_time(X509_get0_notBefore(cert), NULL);
if (ret == 0)
{
msg(D_TLS_DEBUG_MED, "Failed to read certificate notBefore field.");
@ -551,7 +554,7 @@ tls_ctx_check_cert_time(const struct tls_root_ctx *ctx)
msg(M_WARN, "WARNING: Your certificate is not yet valid!");
}
ret = X509_cmp_time(X509_get_notAfter(cert), NULL);
ret = X509_cmp_time(X509_get0_notAfter(cert), NULL);
if (ret == 0)
{
msg(D_TLS_DEBUG_MED, "Failed to read certificate notAfter field.");
@ -634,10 +637,13 @@ tls_ctx_load_ecdh_params(struct tls_root_ctx *ctx, const char *curve_name
else
{
#if OPENSSL_VERSION_NUMBER >= 0x10002000L
#if (OPENSSL_VERSION_NUMBER < 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER))
/* OpenSSL 1.0.2 and newer can automatically handle ECDH parameter
* loading */
SSL_CTX_set_ecdh_auto(ctx->ctx, 1);
return;
#endif
#else
/* For older OpenSSL we have to extract the curve from key on our own */
EC_KEY *eckey = NULL;