From patchwork Sun Sep 19 06:29:49 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 1960 Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director8.mail.ord1d.rsapps.net ([172.30.191.6]) by backend30.mail.ord1d.rsapps.net with LMTP id kPUJOdllR2FxHgAAIUCqbw (envelope-from ) for ; Sun, 19 Sep 2021 12:31:21 -0400 Received: from proxy7.mail.ord1d.rsapps.net ([172.30.191.6]) by director8.mail.ord1d.rsapps.net with LMTP id MDfYONllR2EbEwAAfY0hYg (envelope-from ) for ; Sun, 19 Sep 2021 12:31:21 -0400 Received: from smtp11.gate.ord1d ([172.30.191.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy7.mail.ord1d.rsapps.net with LMTPS id QHSBONllR2HNWAAAMe1Fpw (envelope-from ) for ; Sun, 19 Sep 2021 12:31:21 -0400 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp11.gate.ord1d.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: 05cb458a-1967-11ec-a1d6-5254005f837b-1-1 Received: from [216.105.38.7] ([216.105.38.7:33804] helo=lists.sourceforge.net) by smtp11.gate.ord1d.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id 6E/0C-31074-9D567416; Sun, 19 Sep 2021 12:31:21 -0400 Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.92.3) (envelope-from ) id 1mRzi3-0008S0-TD; Sun, 19 Sep 2021 16:30:31 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.92.3) (envelope-from ) id 1mRzhk-0008RH-8B for openvpn-devel@lists.sourceforge.net; Sun, 19 Sep 2021 16:30:12 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:Message-Id: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=aR5+R8qBy/nLurAL3/mP3IQGF5mdJTtF73gBicQDA8I=; b=F9Zbg25OpRcPMW3tnmMue4vGG6 q/Gs+2Z+raqNfGN4+17at2ZHVmowOz6bo13j/LLWd3K41L6lLCzq7w1EesCyWw8Av0u1OnHN1h72M 2/tFNeC+ZUt93ZAJb+AkxqlEJHoWJZgl5FtKZitsCVppmag73EOrkcX2HWfli/caO4w4=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:Message-Id:Date:Subject:To:From: Sender:Reply-To:Cc:Content-Type:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post: List-Owner:List-Archive; bh=aR5+R8qBy/nLurAL3/mP3IQGF5mdJTtF73gBicQDA8I=; b=l vTiVXcU4A5rocDTGF6DGXfH/h2saZRqN53s5oMSJzOUXtJUEcPAviktvTqZzJ7XdaDAmtlK6xFAKk GK2l/igW3YiH+zkdt8Edorx4R70FWKEUD5MJ7xX7apsQyGiIOIOpvDs/YX8+hQhzc9CvEVjy3XSBH TtI1QDQoYNhvJHWM=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.92.3) id 1mRzhf-00052c-6Q for openvpn-devel@lists.sourceforge.net; Sun, 19 Sep 2021 16:30:12 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.94.2 (FreeBSD)) (envelope-from ) id 1mRzhU-0002YU-9l for openvpn-devel@lists.sourceforge.net; Sun, 19 Sep 2021 18:29:56 +0200 Received: (nullmailer pid 695549 invoked by uid 10006); Sun, 19 Sep 2021 16:29:56 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Sun, 19 Sep 2021 18:29:49 +0200 Message-Id: <20210919162956.695496-1-arne@rfc2549.org> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-Spam-Report: Spam detection software, running on the system "util-spamd-2.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: The old API is deprecated in OpenSSL 3.0 and the new API does not yet exist in OpenSSL 1.1. Emulating the new API would be more complex than just having two implementations. So this switches to a new [...] Content analysis details: (0.3 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 SPF_NONE SPF: sender does not publish an SPF Record 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record X-Headers-End: 1mRzhf-00052c-6Q Subject: [Openvpn-devel] [PATCH 1/8] [OSSL 3.0] Use new EVP_MAC API for HMAC implementation X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox The old API is deprecated in OpenSSL 3.0 and the new API does not yet exist in OpenSSL 1.1. Emulating the new API would be more complex than just having two implementations. So this switches to a new hmac implementation for OpenSSL 3.0. --- src/openvpn/crypto_backend.h | 2 +- src/openvpn/crypto_mbedtls.c | 2 +- src/openvpn/crypto_openssl.c | 82 +++++++++++++++++++++++++++++++++++- src/openvpn/crypto_openssl.h | 4 ++ 4 files changed, 86 insertions(+), 4 deletions(-) diff --git a/src/openvpn/crypto_backend.h b/src/openvpn/crypto_backend.h index e9447f82f..e0bfdf585 100644 --- a/src/openvpn/crypto_backend.h +++ b/src/openvpn/crypto_backend.h @@ -643,7 +643,7 @@ void hmac_ctx_cleanup(hmac_ctx_t *ctx); * * @return Size of the HMAC, or \0 if ctx is NULL. */ -int hmac_ctx_size(const hmac_ctx_t *ctx); +int hmac_ctx_size(hmac_ctx_t *ctx); /* * Resets the given HMAC context, preserving the associated key information diff --git a/src/openvpn/crypto_mbedtls.c b/src/openvpn/crypto_mbedtls.c index c632849db..e2f5f4012 100644 --- a/src/openvpn/crypto_mbedtls.c +++ b/src/openvpn/crypto_mbedtls.c @@ -939,7 +939,7 @@ hmac_ctx_cleanup(mbedtls_md_context_t *ctx) } int -hmac_ctx_size(const mbedtls_md_context_t *ctx) +hmac_ctx_size(mbedtls_md_context_t *ctx) { if (NULL == ctx) { diff --git a/src/openvpn/crypto_openssl.c b/src/openvpn/crypto_openssl.c index 419265a51..f1b2d8b4a 100644 --- a/src/openvpn/crypto_openssl.c +++ b/src/openvpn/crypto_openssl.c @@ -1001,7 +1001,7 @@ md_ctx_final(EVP_MD_CTX *ctx, uint8_t *dst) * Generic HMAC functions * */ - +#if OPENSSL_VERSION_NUMBER < 0x30000000L HMAC_CTX * hmac_ctx_new(void) { @@ -1039,7 +1039,7 @@ hmac_ctx_cleanup(HMAC_CTX *ctx) } int -hmac_ctx_size(const HMAC_CTX *ctx) +hmac_ctx_size(HMAC_CTX *ctx) { return HMAC_size(ctx); } @@ -1066,6 +1066,84 @@ hmac_ctx_final(HMAC_CTX *ctx, uint8_t *dst) HMAC_Final(ctx, dst, &in_hmac_len); } +#else +EVP_MAC_CTX * +hmac_ctx_new(void) +{ + EVP_MAC *hmac = EVP_MAC_fetch(NULL, "HMAC", NULL); + EVP_MAC_CTX *ctx = EVP_MAC_CTX_new(hmac); + check_malloc_return(ctx); + return ctx; +} + +void +hmac_ctx_free(EVP_MAC_CTX *ctx) +{ + EVP_MAC_CTX_free(ctx); +} + +void +hmac_ctx_init(EVP_MAC_CTX *ctx, const uint8_t *key, int key_len, + const EVP_MD *kt) +{ + ASSERT(NULL != kt && NULL != ctx); + + /* Lookup/setting of parameters in OpenSSL 3.0 are string based */ + OSSL_PARAM params[2]; + + /* The OSSL_PARAM_construct_utf8_string needs a non const str but this + * only used for lookup so we cast (as OpenSSL also does internally) + * the constness away here */ + params[0] = OSSL_PARAM_construct_utf8_string("digest", + (char*) EVP_MD_get0_name(kt), 0); + params[1] = OSSL_PARAM_construct_end(); + + if (!EVP_MAC_init(ctx, key, key_len, params)) + { + crypto_msg(M_FATAL, "EVP_MAC_init failed"); + } + + /* make sure we used a big enough key */ + ASSERT(EVP_MAC_CTX_get_mac_size(ctx) <= key_len); +} + +void +hmac_ctx_cleanup(EVP_MAC_CTX *ctx) +{ + EVP_MAC_init(ctx, NULL, 0, NULL); +} + +int +hmac_ctx_size(EVP_MAC_CTX *ctx) +{ + return (int)EVP_MAC_CTX_get_mac_size(ctx); +} + +void +hmac_ctx_reset(EVP_MAC_CTX *ctx) +{ + if (!EVP_MAC_init(ctx, NULL, 0, NULL)) + { + crypto_msg(M_FATAL, "EVP_MAC_init failed"); + } +} + +void +hmac_ctx_update(EVP_MAC_CTX *ctx, const uint8_t *src, int src_len) +{ + EVP_MAC_update(ctx, src, src_len); +} + +void +hmac_ctx_final(EVP_MAC_CTX *ctx, uint8_t *dst) +{ + /* The calling code always gives us a buffer that has the size of our + * algorithm */ + size_t in_hmac_len = EVP_MAC_CTX_get_mac_size(ctx); + + EVP_MAC_final(ctx, dst, &in_hmac_len, in_hmac_len); +} +#endif int memcmp_constant_time(const void *a, const void *b, size_t size) diff --git a/src/openvpn/crypto_openssl.h b/src/openvpn/crypto_openssl.h index 59a31aacf..bafb3a245 100644 --- a/src/openvpn/crypto_openssl.h +++ b/src/openvpn/crypto_openssl.h @@ -47,7 +47,11 @@ typedef EVP_CIPHER_CTX cipher_ctx_t; typedef EVP_MD_CTX md_ctx_t; /** Generic HMAC %context. */ +#if OPENSSL_VERSION_NUMBER < 0x30000000L typedef HMAC_CTX hmac_ctx_t; +#else +typedef EVP_MAC_CTX hmac_ctx_t; +#endif /** Maximum length of an IV */ #define OPENVPN_MAX_IV_LENGTH EVP_MAX_IV_LENGTH