File Compile-with-OpenSSL-3.patch of Package libqca2

Overview Repositories Revisions Requests Users Attributes Meta

File Compile-with-OpenSSL-3.patch of Package libqca2 (Revision 35d16342908402d3b5e732e6af91742e)

Currently displaying revision 35d16342908402d3b5e732e6af91742e , Show latest

From b8e0f67484ec914396c585cfc9de77950fca9609 Mon Sep 17 00:00:00 2001
From: Albert Astals Cid <aacid@kde.org>
Date: Fri, 6 Aug 2021 21:00:52 +0200
Subject: [PATCH] Compile with OpenSSL 3

---
 .gitlab-ci.yml                |  18 ++++
 plugins/qca-ossl/qca-ossl.cpp | 152 ++++++++++++++++++++++++----------
 2 files changed, 126 insertions(+), 44 deletions(-)

diff --git a/plugins/qca-ossl/qca-ossl.cpp b/plugins/qca-ossl/qca-ossl.cpp
index 0d9f5d48..ae4d37ad 100644
--- a/plugins/qca-ossl/qca-ossl.cpp
+++ b/plugins/qca-ossl/qca-ossl.cpp
@@ -35,11 +35,15 @@
 #include <iostream>
 
 #include <openssl/rand.h>
+#include <openssl/opensslv.h>
 #include <openssl/pem.h>
 #include <openssl/err.h>
 #include <openssl/x509v3.h>
 #include <openssl/pkcs12.h>
 #include <openssl/ssl.h>
+#ifdef OPENSSL_VERSION_MAJOR
+#include <openssl/provider.h>
+#endif
 
 #include "ossl110-compat.h"
 
@@ -73,6 +77,13 @@
 
 using namespace QCA;
 
+namespace {
+static const auto DsaDeleter = [](DSA *pointer) {
+    if (pointer)
+        DSA_free((DSA *)pointer);
+};
+} // end of anonymous namespace
+
 namespace opensslQCAPlugin {
 
 //----------------------------------------------------------------------------
@@ -1300,9 +1311,9 @@ class opensslHkdfContext : public HKDFContext
 		EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, NULL);
 		EVP_PKEY_derive_init(pctx);
 		EVP_PKEY_CTX_set_hkdf_md(pctx, EVP_sha256());
-		EVP_PKEY_CTX_set1_hkdf_salt(pctx, salt.data(), int(salt.size()));
-		EVP_PKEY_CTX_set1_hkdf_key(pctx, secret.data(), int(secret.size()));
-		EVP_PKEY_CTX_add1_hkdf_info(pctx, info.data(), int(info.size()));
+		EVP_PKEY_CTX_set1_hkdf_salt(pctx, (const unsigned char *)salt.data(), int(salt.size()));
+		EVP_PKEY_CTX_set1_hkdf_key(pctx, (const unsigned char *)secret.data(), int(secret.size()));
+		EVP_PKEY_CTX_add1_hkdf_info(pctx, (const unsigned char *)info.data(), int(info.size()));
 		size_t outlen = out.size();
 		EVP_PKEY_derive(pctx, reinterpret_cast<unsigned char*>(out.data()), &outlen);
 		EVP_PKEY_CTX_free(pctx);
@@ -1487,9 +1498,9 @@ class EVPKey
 
 				if (type == EVP_PKEY_RSA)
 				{
-					RSA *rsa = EVP_PKEY_get0_RSA(pkey);
+					const RSA *rsa = EVP_PKEY_get0_RSA(pkey);
 					if (RSA_private_encrypt(raw.size(), (unsigned char *)raw.data(),
-					                        (unsigned char *)out.data(), rsa,
+					                        (unsigned char *)out.data(), (RSA *)rsa,
 											RSA_PKCS1_PADDING) == -1) {
 
 						state = SignError;
@@ -1534,9 +1545,9 @@ class EVPKey
 				int type = EVP_PKEY_id(pkey);
 
 				if (type == EVP_PKEY_RSA) {
-					RSA *rsa = EVP_PKEY_get0_RSA(pkey);
+					const RSA *rsa = EVP_PKEY_get0_RSA(pkey);
 					if((len = RSA_public_decrypt (sig.size(), (unsigned char *)sig.data(),
-					                                (unsigned char *)out.data(), rsa,
+					                                (unsigned char *)out.data(), (RSA *)rsa,
 												  RSA_PKCS1_PADDING)) == -1) {
 
 						state = VerifyError;
@@ -1669,16 +1680,6 @@ class DLParams
 };
 
 #ifndef OPENSSL_FIPS
-namespace {
-struct DsaDeleter
-{
-	static inline void cleanup(void *pointer)
-	{
-		if (pointer)
-			DSA_free((DSA *)pointer);
-	}
-};
-} // end of anonymous namespace
 
 static bool make_dlgroup(const QByteArray &seed, int bits, int counter, DLParams *params)
 {
@@ -1922,8 +1923,9 @@ class RSAKeyMaker : public QThread
 		if (BN_set_word(e.data(), exp) != 1)
 			return;
 
-		if (RSA_generate_key_ex(rsa.data(), bits, e.data(), NULL) == 0)
+		if (RSA_generate_key_ex(rsa.data(), bits, e.data(), NULL) == 0) {
 			return;
+		}
 
 		result = rsa.take();
 	}
@@ -1993,7 +1995,7 @@ class RSAKey : public RSAContext
 			return;
 
 		// extract the public key into DER format
-		RSA *rsa_pkey = EVP_PKEY_get0_RSA(evp.pkey);
+		const RSA *rsa_pkey = EVP_PKEY_get0_RSA(evp.pkey);
 		int len = i2d_RSAPublicKey(rsa_pkey, NULL);
 		SecureArray result(len);
 		unsigned char *p = (unsigned char *)result.data();
@@ -2020,7 +2022,7 @@ class RSAKey : public RSAContext
 
 	virtual int maximumEncryptSize(EncryptionAlgorithm alg) const
 	{
-		RSA *rsa = EVP_PKEY_get0_RSA(evp.pkey);
+		const RSA *rsa = EVP_PKEY_get0_RSA(evp.pkey);
 		int size = 0;
 		switch(alg)
 		{      
@@ -2035,7 +2037,7 @@ class RSAKey : public RSAContext
 
 	virtual SecureArray encrypt(const SecureArray &in, EncryptionAlgorithm alg)
 	{
-		RSA *rsa = EVP_PKEY_get0_RSA(evp.pkey);
+		const RSA * rsa = EVP_PKEY_get0_RSA(evp.pkey);
 		SecureArray buf = in;
 		int max = maximumEncryptSize(alg);
 
@@ -2048,7 +2050,11 @@ class RSAKey : public RSAContext
 		{
 		case EME_PKCS1v15:      pad = RSA_PKCS1_PADDING;       break;
 		case EME_PKCS1_OAEP:    pad = RSA_PKCS1_OAEP_PADDING;  break;
+// OPENSSL_VERSION_MAJOR is only defined on openssl > 3.0
+// that doesn't have RSA_SSLV23_PADDING so we can use it negatively here
+#ifndef OPENSSL_VERSION_MAJOR
 		case EME_PKCS1v15_SSL:  pad = RSA_SSLV23_PADDING;      break;
+#endif
 		case EME_NO_PADDING:    pad = RSA_NO_PADDING;          break;
 		default: return SecureArray(); break;
 		}
@@ -2055,9 +2061,10 @@ class RSAKey : public RSAContext
 
 		int ret;
 		if (isPrivate())
-			ret = RSA_private_encrypt(buf.size(), (unsigned char *)buf.data(), (unsigned char *)result.data(), rsa, pad);
+			ret = RSA_private_encrypt(buf.size(), (unsigned char *)buf.data(), (unsigned char *)result.data(), (RSA *)rsa, pad);
 		else
-			ret = RSA_public_encrypt(buf.size(), (unsigned char *)buf.data(), (unsigned char *)result.data(), rsa, pad);
+			ret = RSA_public_encrypt(
+				buf.size(), (unsigned char *)buf.data(), (unsigned char *)result.data(), (RSA *)rsa, pad);
 
 		if (ret < 0)
 			return SecureArray();
@@ -2068,7 +2075,7 @@ class RSAKey : public RSAContext
 
	virtual bool decrypt(const SecureArray &in, SecureArray *out, EncryptionAlgorithm alg)
 	{
-		RSA *rsa = EVP_PKEY_get0_RSA(evp.pkey);
+		const RSA * rsa = EVP_PKEY_get0_RSA(evp.pkey);
 		SecureArray result(RSA_size(rsa));
 		int pad;
 
@@ -2076,7 +2083,11 @@ class RSAKey : public RSAContext
 		{
 		case EME_PKCS1v15:      pad = RSA_PKCS1_PADDING;       break;
 		case EME_PKCS1_OAEP:    pad = RSA_PKCS1_OAEP_PADDING;  break;
+// OPENSSL_VERSION_MAJOR is only defined on openssl > 3.0
+// that doesn't have RSA_SSLV23_PADDING so we can use it negatively here
+#ifndef OPENSSL_VERSION_MAJOR
 		case EME_PKCS1v15_SSL:  pad = RSA_SSLV23_PADDING;      break;
+#endif
 		case EME_NO_PADDING:    pad = RSA_NO_PADDING;          break;
 		default: return false; break;
 		}
@@ -2083,9 +2094,11 @@ class RSAKey : public RSAContext
 
 		int ret;
 		if (isPrivate())
-			ret = RSA_private_decrypt(in.size(), (unsigned char *)in.data(), (unsigned char *)result.data(), rsa, pad);
+			ret = RSA_private_decrypt(
+				in.size(), (unsigned char *)in.data(), (unsigned char *)result.data(), (RSA *)rsa, pad);
 		else
-			ret = RSA_public_decrypt(in.size(), (unsigned char *)in.data(), (unsigned char *)result.data(), rsa, pad);
+			ret = RSA_public_decrypt(
+				in.size(), (unsigned char *)in.data(), (unsigned char *)result.data(), (RSA *)rsa, pad);
 
 		if(ret < 0)
 			return false;
@@ -2226,7 +2239,7 @@ class RSAKey : public RSAContext
 
 	virtual BigInteger n() const
 	{
-		RSA *rsa = EVP_PKEY_get0_RSA(evp.pkey);
+		const RSA *rsa = EVP_PKEY_get0_RSA(evp.pkey);
 		const BIGNUM *bnn;
 		RSA_get0_key(rsa, &bnn, NULL, NULL);
 		return bn2bi(bnn);
@@ -2234,7 +2247,7 @@ class RSAKey : public RSAContext
 
 	virtual BigInteger e() const
 		{
-		RSA *rsa = EVP_PKEY_get0_RSA(evp.pkey);
+		const RSA *rsa = EVP_PKEY_get0_RSA(evp.pkey);
 		const BIGNUM *bne;
 		RSA_get0_key(rsa, NULL, &bne, NULL);
 		return bn2bi(bne);
@@ -2242,7 +2255,7 @@ class RSAKey : public RSAContext
 
 	virtual BigInteger p() const
 	{
-		RSA *rsa = EVP_PKEY_get0_RSA(evp.pkey);
+		const RSA *rsa = EVP_PKEY_get0_RSA(evp.pkey);
 		const BIGNUM *bnp;
 		RSA_get0_factors(rsa, &bnp, NULL);
 		return bn2bi(bnp);
@@ -2250,7 +2263,7 @@ class RSAKey : public RSAContext
 
 	virtual BigInteger q() const
 	{
-		RSA *rsa = EVP_PKEY_get0_RSA(evp.pkey);
+		const RSA *rsa = EVP_PKEY_get0_RSA(evp.pkey);
 		const BIGNUM *bnq;
 		RSA_get0_factors(rsa, NULL, &bnq);
 		return bn2bi(bnq);
@@ -2258,7 +2271,7 @@ class RSAKey : public RSAContext
 
 	virtual BigInteger d() const
 	{
-		RSA *rsa = EVP_PKEY_get0_RSA(evp.pkey);
+		const RSA *rsa = EVP_PKEY_get0_RSA(evp.pkey);
 		const BIGNUM *bnd;
 		RSA_get0_key(rsa, NULL, NULL, &bnd);
 		return bn2bi(bnd);
@@ -2309,17 +2322,47 @@ class DSAKeyMaker : public QThread
 
 	virtual void run()
 	{
-		DSA *dsa = DSA_new();
+		std::unique_ptr<DSA, decltype(DsaDeleter)> dsa(DSA_new(), DsaDeleter);
 		BIGNUM *pne = bi2bn(domain.p()),
 		*qne = bi2bn(domain.q()),
 		*gne = bi2bn(domain.g());
 
-		if (!DSA_set0_pqg(dsa, pne, qne, gne)
-		    || !DSA_generate_key(dsa)) {
-			DSA_free(dsa);
+        if (!DSA_set0_pqg(dsa.get(), pne, qne, gne)) {
+            return;
+        }
+        if (!DSA_generate_key(dsa.get())) {
+            // OPENSSL_VERSION_MAJOR is only defined in openssl3
+#ifdef OPENSSL_VERSION_MAJOR
+            // HACK
+            // in openssl3 there is an internal flag for "legacy" values
+            //      bits < 2048 && seed_len <= 20
+            // set in ossl_ffc_params_FIPS186_2_generate (called by DSA_generate_parameters_ex)
+            // that we have no way to get or set, so if the bits are smaller than 2048 we generate
+            // a dsa from a dummy seed and then override the p/q/g with the ones we want
+            // so we can reuse the internal flag
+            if (BN_num_bits(pne) < 2048) {
+                int dummy;
+                dsa.reset(DSA_new());
+                if (DSA_generate_parameters_ex(
+                        dsa.get(), 512, (const unsigned char *)"THIS_IS_A_DUMMY_SEED", 20, &dummy, NULL, NULL) !=
+                    1) {
+                    return;
+                }
+                pne = bi2bn(domain.p());
+                qne = bi2bn(domain.q());
+                gne = bi2bn(domain.g());
+                if (!DSA_set0_pqg(dsa.get(), pne, qne, gne)) {
+                    return;
+                }
+                if (!DSA_generate_key(dsa.get())) {
+                    return;
+                }
+            }
+#else
 			return;
+#endif
 		}
-		result = dsa;
+		result = dsa.release();
 	}
 
 	DSA *takeResult()
@@ -2390,7 +2433,7 @@ class DSAKey : public DSAContext
 			return;
 
 		// extract the public key into DER format
-		DSA *dsa_pkey = EVP_PKEY_get0_DSA(evp.pkey);
+		const DSA *dsa_pkey = EVP_PKEY_get0_DSA(evp.pkey);
 		int len = i2d_DSAPublicKey(dsa_pkey, NULL);
 		SecureArray result(len);
 		unsigned char *p = (unsigned char *)result.data();
@@ -2526,7 +2569,7 @@ class DSAKey : public DSAContext
 
 	virtual DLGroup domain() const
 	{
-		DSA *dsa = EVP_PKEY_get0_DSA(evp.pkey);
+		const DSA *dsa = EVP_PKEY_get0_DSA(evp.pkey);
 		const BIGNUM *bnp, *bnq, *bng;
 		DSA_get0_pqg(dsa, &bnp, &bnq, &bng);
 		return DLGroup(bn2bi(bnp), bn2bi(bnq), bn2bi(bng));
@@ -2534,7 +2577,7 @@ class DSAKey : public DSAContext
 
 	virtual BigInteger y() const
 	{
-		DSA *dsa = EVP_PKEY_get0_DSA(evp.pkey);
+		const DSA *dsa = EVP_PKEY_get0_DSA(evp.pkey);
 		const BIGNUM *bnpub_key;
 		DSA_get0_key(dsa, &bnpub_key, NULL);
 		return bn2bi(bnpub_key);
@@ -2542,7 +2585,7 @@ class DSAKey : public DSAContext
 
 	virtual BigInteger x() const
 	{
-		DSA *dsa = EVP_PKEY_get0_DSA(evp.pkey);
+		const DSA *dsa = EVP_PKEY_get0_DSA(evp.pkey);
 		const BIGNUM *bnpriv_key;
 		DSA_get0_key(dsa, NULL, &bnpriv_key);
 		return bn2bi(bnpriv_key);
@@ -2669,7 +2712,7 @@ class DHKey : public DHContext
 		if (!sec)
 			return;
 
-		DH *orig = EVP_PKEY_get0_DH(evp.pkey);
+		const DH *orig = EVP_PKEY_get0_DH(evp.pkey);
 		DH *dh = DH_new();
 		const BIGNUM *bnp, *bng, *bnpub_key;
 		DH_get0_pqg(orig, &bnp, NULL, &bng);
@@ -2692,13 +2735,13 @@ class DHKey : public DHContext
 
 	virtual SymmetricKey deriveKey(const PKeyBase &theirs)
 	{
-		DH *dh = EVP_PKEY_get0_DH(evp.pkey);
-		DH *them = EVP_PKEY_get0_DH(static_cast<const DHKey *>(&theirs)->evp.pkey);
+		const DH *dh = EVP_PKEY_get0_DH(evp.pkey);
+		const DH *them = EVP_PKEY_get0_DH(static_cast<const DHKey *>(&theirs)->evp.pkey);
 		const BIGNUM *bnpub_key;
 		DH_get0_key(them, &bnpub_key, NULL);
 
 		SecureArray result(DH_size(dh));
-		int ret = DH_compute_key((unsigned char *)result.data(), bnpub_key, dh);
+		int ret = DH_compute_key((unsigned char *)result.data(), bnpub_key, (DH *)dh);
 		if (ret <= 0)
 			return SymmetricKey();
 		result.resize(ret);
@@ -2768,7 +2811,7 @@ class DHKey : public DHContext
 
 	virtual DLGroup domain() const
 	{
-		DH *dh = EVP_PKEY_get0_DH(evp.pkey);
+		const DH *dh = EVP_PKEY_get0_DH(evp.pkey);
 		const BIGNUM *bnp, *bng;
 		DH_get0_pqg(dh, &bnp, NULL, &bng);
 		return DLGroup(bn2bi(bnp), bn2bi(bng));
@@ -2776,7 +2819,7 @@ class DHKey : public DHContext
 
 	virtual BigInteger y() const
 	{
-		DH *dh = EVP_PKEY_get0_DH(evp.pkey);
+		const DH *dh = EVP_PKEY_get0_DH(evp.pkey);
 		const BIGNUM *bnpub_key;
 		DH_get0_key(dh, &bnpub_key, NULL);
 		return bn2bi(bnpub_key);
@@ -2784,7 +2827,7 @@ class DHKey : public DHContext
 
 	virtual BigInteger x() const
 	{
-		DH *dh = EVP_PKEY_get0_DH(evp.pkey);
+		const DH *dh = EVP_PKEY_get0_DH(evp.pkey);
 		const BIGNUM *bnpriv_key;
 		DH_get0_key(dh, NULL, &bnpriv_key);
 		return bn2bi(bnpriv_key);
@@ -7361,6 +7404,22 @@ class opensslProvider : public Provider
 		OpenSSL_add_all_algorithms();
 		ERR_load_crypto_strings();
 
+// OPENSSL_VERSION_MAJOR is only defined in openssl3
+#ifdef OPENSSL_VERSION_MAJOR
+		/* Load Multiple providers into the default (NULL) library context */
+		OSSL_PROVIDER *legacy = OSSL_PROVIDER_load(NULL, "legacy");
+		if (legacy == NULL) {
+			printf("Failed to load Legacy provider\n");
+		 	exit(EXIT_FAILURE);
+		}
+		OSSL_PROVIDER *deflt = OSSL_PROVIDER_load(NULL, "default");
+		if (deflt == NULL) {
+			printf("Failed to load Default provider\n");
+			OSSL_PROVIDER_unload(legacy);
+			exit(EXIT_FAILURE);
+		}
+#endif
+
 		// seed the RNG if it's not seeded yet
 		if (RAND_status() == 0) {
 			qsrand(time(NULL));

Places

File Compile-with-OpenSSL-3.patch of Package libqca2 (Revision 35d16342908402d3b5e732e6af91742e)

Places