diff options
| -rw-r--r-- | src/openssl.c | 397 |
1 files changed, 339 insertions, 58 deletions
diff --git a/src/openssl.c b/src/openssl.c index e493ae4..78d79cc 100644 --- a/src/openssl.c +++ b/src/openssl.c @@ -83,6 +83,50 @@ #define LIBRESSL_PREREQ(M, m, p) \ (LIBRESSL_VERSION_NUMBER >= (((M) << 28) | ((m) << 20) | ((p) << 12))) +#ifndef HAVE_DH_GET0_KEY +#define HAVE_DH_GET0_KEY 0 +#endif + +#ifndef HAVE_DH_GET0_PQG +#define HAVE_DH_GET0_PQG 0 +#endif + +#ifndef HAVE_DSA_GET0_KEY +#define HAVE_DSA_GET0_KEY 0 +#endif + +#ifndef HAVE_DSA_GET0_PQG +#define HAVE_DSA_GET0_PQG 0 +#endif + +#ifndef HAVE_EVP_PKEY_ID +#define HAVE_EVP_PKEY_ID 0 +#endif + +#ifndef HAVE_RSA_GET0_CRT_PARAMS +#define HAVE_RSA_GET0_CRT_PARAMS 0 +#endif + +#ifndef HAVE_RSA_GET0_FACTORS +#define HAVE_RSA_GET0_FACTORS 0 +#endif + +#ifndef HAVE_RSA_GET0_KEY +#define HAVE_RSA_GET0_KEY 0 +#endif + +#ifndef HAVE_RSA_SET0_CRT_PARAMS +#define HAVE_RSA_SET0_CRT_PARAMS 0 +#endif + +#ifndef HAVE_RSA_SET0_FACTORS +#define HAVE_RSA_SET0_FACTORS 0 +#endif + +#ifndef HAVE_RSA_SET0_KEY +#define HAVE_RSA_SET0_KEY 0 +#endif + #ifndef HAVE_SSL_CTX_SET_ALPN_PROTOS #define HAVE_SSL_CTX_SET_ALPN_PROTOS (OPENSSL_PREREQ(1, 0, 2) || LIBRESSL_PREREQ(2, 1, 3)) #endif @@ -91,6 +135,14 @@ #define HAVE_SSL_CTX_SET_ALPN_SELECT_CB HAVE_SSL_CTX_SET_ALPN_PROTOS #endif +#ifndef HAVE_SSL_CTX_SET1_CERT_STORE +#define HAVE_SSL_CTX_SET1_CERT_STORE (HAVE_SSL_CTX_set1_cert_store || 0) /* backwards compatible with old macro name */ +#endif + +#ifndef HAVE_SSL_CTX_CERT_STORE +#define HAVE_SSL_CTX_CERT_STORE 1 +#endif + #ifndef HAVE_SSL_SET_ALPN_PROTOS #define HAVE_SSL_SET_ALPN_PROTOS HAVE_SSL_CTX_SET_ALPN_PROTOS #endif @@ -123,6 +175,10 @@ #define HAVE_DTLSV1_2_SERVER_METHOD HAVE_DTLSV1_2_CLIENT_METHOD #endif +#ifndef HAVE_X509_STORE_REFERENCES +#define HAVE_X509_STORE_REFERENCES 1 +#endif + #ifndef STRERROR_R_CHAR_P #define STRERROR_R_CHAR_P (defined __GLIBC__ && (_GNU_SOURCE || !(_POSIX_C_SOURCE >= 200112L || _XOPEN_SOURCE >= 600))) #endif @@ -488,6 +544,13 @@ static const char *aux_strerror_r(int error, char *dst, size_t lim) { * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */ +static void auxS_bn_free_and_set0(BIGNUM **dst, BIGNUM *src) { + if (*dst) { + BN_clear_free(*dst); + } + *dst = src; +} /* auxS_bn_free_and_set0() */ + static size_t auxS_nid2sn(void *dst, size_t lim, int nid) { const char *sn; @@ -1021,11 +1084,111 @@ static struct { .X509_STORE_free = &X509_STORE_free, }; +#if !HAVE_DH_GET0_KEY +#define DH_get0_key(...) compat_DH_get0_key(__VA_ARGS__) + +static void compat_DH_get0_key(const DH *d, const BIGNUM **pub_key, const BIGNUM **priv_key) { + if (pub_key) + *pub_key = d->pub_key; + if (priv_key) + *priv_key = d->priv_key; +} /* compat_DH_get0_key() */ +#endif + +#if !HAVE_DH_GET0_PQG +#define DH_get0_pqg(...) compat_DH_get0_pqg(__VA_ARGS__) + +static void compat_DH_get0_pqg(const DH *d, const BIGNUM **p, const BIGNUM **q, const BIGNUM **g) { + if (p) + *p = d->p; + if (q) + *q = d->q; + if (g) + *g = d->g; +} /* compat_DH_get0_pqg() */ +#endif + +#if !HAVE_DH_SET0_KEY +#define DH_set0_key(...) compat_DH_set0_key(__VA_ARGS__) + +static void compat_DH_set0_key(DH *d, BIGNUM *pub_key, BIGNUM *priv_key) { + if (pub_key) + auxS_bn_free_and_set0(&d->pub_key, pub_key); + if (priv_key) + auxS_bn_free_and_set0(&d->priv_key, priv_key); +} /* compat_DH_set0_key() */ +#endif + +#if !HAVE_DH_SET0_PQG +#define DH_set0_pqg(...) compat_DH_set0_pqg(__VA_ARGS__) + +static void compat_DH_set0_pqg(DH *d, BIGNUM *p, BIGNUM *q, BIGNUM *g) { + if (p) + auxS_bn_free_and_set0(&d->p, p); + if (q) + auxS_bn_free_and_set0(&d->q, q); + if (g) + auxS_bn_free_and_set0(&d->g, g); +} /* compat_DH_set0_pqg() */ +#endif + +#if !HAVE_DSA_GET0_KEY +#define DSA_get0_key(...) compat_DSA_get0_key(__VA_ARGS__) + +static void compat_DSA_get0_key(const DSA *d, const BIGNUM **pub_key, const BIGNUM **priv_key) { + if (pub_key) + *pub_key = d->pub_key; + if (priv_key) + *priv_key = d->priv_key; +} /* compat_DSA_get0_key() */ +#endif + +#if !HAVE_DSA_GET0_PQG +#define DSA_get0_pqg(...) compat_DSA_get0_pqg(__VA_ARGS__) + +static void compat_DSA_get0_pqg(const DSA *d, const BIGNUM **p, const BIGNUM **q, const BIGNUM **g) { + if (p) + *p = d->p; + if (q) + *q = d->q; + if (g) + *g = d->g; +} /* compat_DSA_get0_pqg() */ +#endif + +#if !HAVE_DSA_SET0_KEY +#define DSA_set0_key(...) compat_DSA_set0_key(__VA_ARGS__) + +static void compat_DSA_set0_key(DSA *d, BIGNUM *pub_key, BIGNUM *priv_key) { + if (pub_key) + auxS_bn_free_and_set0(&d->pub_key, pub_key); + if (priv_key) + auxS_bn_free_and_set0(&d->priv_key, priv_key); +} /* compat_DSA_set0_key() */ +#endif + +#if !HAVE_DSA_SET0_PQG +#define DSA_set0_pqg(...) compat_DSA_set0_pqg(__VA_ARGS__) + +static void compat_DSA_set0_pqg(DSA *d, BIGNUM *p, BIGNUM *q, BIGNUM *g) { + if (p) + auxS_bn_free_and_set0(&d->p, p); + if (q) + auxS_bn_free_and_set0(&d->q, q); + if (g) + auxS_bn_free_and_set0(&d->g, g); +} /* compat_DSA_set0_pqg() */ +#endif + +#if !HAVE_EVP_PKEY_ID +#define EVP_PKEY_id(key) ((key)->type) +#endif + #if !HAVE_EVP_PKEY_BASE_ID #define EVP_PKEY_base_id(key) compat_EVP_PKEY_base_id((key)) static int compat_EVP_PKEY_base_id(EVP_PKEY *key) { - return EVP_PKEY_type(key->type); + return EVP_PKEY_type(EVP_PKEY_id(key)); } /* compat_EVP_PKEY_base_id() */ #endif @@ -1065,6 +1228,80 @@ static void *compat_EVP_PKEY_get0(EVP_PKEY *key) { } /* compat_EVP_PKEY_get0() */ #endif +#if !HAVE_RSA_GET0_CRT_PARAMS +#define RSA_get0_crt_params(...) compat_RSA_get0_crt_params(__VA_ARGS__) + +static void compat_RSA_get0_crt_params(const RSA *r, const BIGNUM **dmp1, const BIGNUM **dmq1, const BIGNUM **iqmp) { + if (dmp1) + *dmp1 = r->dmp1; + if (dmq1) + *dmq1 = r->dmq1; + if (iqmp) + *iqmp = r->iqmp; +} /* compat_RSA_get0_crt_params() */ +#endif + +#if !HAVE_RSA_GET0_FACTORS +#define RSA_get0_factors(...) compat_RSA_get0_factors(__VA_ARGS__) + +static void compat_RSA_get0_factors(const RSA *r, const BIGNUM **p, const BIGNUM **q) { + if (p) + *p = r->p; + if (q) + *q = r->q; +} /* compat_RSA_get0_factors() */ +#endif + +#if !HAVE_RSA_GET0_KEY +#define RSA_get0_key(...) compat_RSA_get0_key(__VA_ARGS__) + +static void compat_RSA_get0_key(const RSA *r, const BIGNUM **n, const BIGNUM **e, const BIGNUM **d) { + if (n) + *n = r->n; + if (e) + *e = r->e; + if (d) + *d = r->d; +} /* compat_RSA_get0_key() */ +#endif + +#if !HAVE_RSA_SET0_CRT_PARAMS +#define RSA_set0_crt_params(...) compat_RSA_set0_crt_params(__VA_ARGS__) + +static void compat_RSA_set0_crt_params(RSA *r, BIGNUM *dmp1, BIGNUM *dmq1, BIGNUM *iqmp) { + if (dmp1) + auxS_bn_free_and_set0(&r->dmp1, dmp1); + if (dmq1) + auxS_bn_free_and_set0(&r->dmq1, dmq1); + if (iqmp) + auxS_bn_free_and_set0(&r->iqmp, iqmp); +} /* compat_RSA_set0_crt_params() */ +#endif + +#if !HAVE_RSA_SET0_FACTORS +#define RSA_set0_factors(...) compat_RSA_set0_factors(__VA_ARGS__) + +static void compat_RSA_set0_factors(RSA *r, BIGNUM *p, BIGNUM *q) { + if (p) + auxS_bn_free_and_set0(&r->p, p); + if (q) + auxS_bn_free_and_set0(&r->q, q); +} /* compat_RSA_set0_factors() */ +#endif + +#if !HAVE_RSA_SET0_KEY +#define RSA_set0_key(...) compat_RSA_set0_key(__VA_ARGS__) + +static void compat_RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d) { + if (n) + auxS_bn_free_and_set0(&r->n, n); + if (e) + auxS_bn_free_and_set0(&r->e, e); + if (d) + auxS_bn_free_and_set0(&r->d, d); +} /* compat_RSA_set0_key() */ +#endif + #if !HAVE_X509_GET0_EXT #define X509_get0_ext(crt, i) X509_get_ext((crt), (i)) #endif @@ -1081,13 +1318,18 @@ static void *compat_EVP_PKEY_get0(EVP_PKEY *key) { #define X509_EXTENSION_get0_data(ext) X509_EXTENSION_get_data((ext)) #endif +#if HAVE_X509_STORE_REFERENCES /* * X509_STORE_free in OpenSSL versions < 1.0.2 doesn't obey reference count */ #define X509_STORE_free(store) \ (compat.X509_STORE_free)((store)) -static void compat_X509_STORE_free(X509_STORE *store) { +/* to support preprocessor detection below */ +#define compat_X509_STORE_free(store) \ + compat_X509_STORE_free((store)) + +static void (compat_X509_STORE_free)(X509_STORE *store) { int i; i = CRYPTO_add(&store->references, -1, CRYPTO_LOCK_X509_STORE); @@ -1097,12 +1339,21 @@ static void compat_X509_STORE_free(X509_STORE *store) { (X509_STORE_free)(store); } /* compat_X509_STORE_free() */ +#endif -#if !HAVE_SSL_CTX_set1_cert_store +#if !HAVE_SSL_CTX_SET1_CERT_STORE +#if !HAVE_SSL_CTX_CERT_STORE || !HAVE_X509_STORE_REFERENCES +#define SSL_CTX_set1_cert_store(ctx, store) \ + SSL_CTX_set_cert_store((ctx), (store)) +#else #define SSL_CTX_set1_cert_store(ctx, store) \ compat_SSL_CTX_set1_cert_store((ctx), (store)) -static void compat_SSL_CTX_set1_cert_store(SSL_CTX *ctx, X509_STORE *store) { +/* to support preprocessor detection below */ +#define compat_SSL_CTX_set1_cert_store(ctx, store) \ + compat_SSL_CTX_set1_cert_store((ctx), (store)) + +static void (compat_SSL_CTX_set1_cert_store)(SSL_CTX *ctx, X509_STORE *store) { int n; /* @@ -1122,6 +1373,9 @@ static void compat_SSL_CTX_set1_cert_store(SSL_CTX *ctx, X509_STORE *store) { CRYPTO_add(&store->references, 1, CRYPTO_LOCK_X509_STORE); } /* compat_SSL_CTX_set1_cert_store() */ #endif +#endif + +#if HAVE_SSL_CTX_CERT_STORE static void compat_init_SSL_CTX_onfree(void *_ctx, void *data NOTUSED, CRYPTO_EX_DATA *ad NOTUSED, int idx NOTUSED, long argl NOTUSED, void *argp NOTUSED) { SSL_CTX *ctx = _ctx; @@ -1132,6 +1386,8 @@ static void compat_init_SSL_CTX_onfree(void *_ctx, void *data NOTUSED, CRYPTO_EX } } /* compat_init_SSL_CTX_onfree() */ +#endif + /* helper routine to determine if X509_STORE_free obeys reference count */ static void compat_init_X509_STORE_onfree(void *store, void *data NOTUSED, CRYPTO_EX_DATA *ad NOTUSED, int idx NOTUSED, long argl NOTUSED, void *argp NOTUSED) { /* unfortunately there's no way to remove a handler */ @@ -1161,6 +1417,7 @@ static int compat_init(void) { if ((error = dl_anchor())) goto epilog; +#if defined compat_X509_STORE_free /* * Test if X509_STORE_free obeys reference counts by installing an * onfree callback. @@ -1210,6 +1467,7 @@ static int compat_init(void) { compat.flags |= COMPAT_X509_STORE_FREE_BUG; } +#endif done = 1; epilog: @@ -2640,7 +2898,7 @@ static int pk_interpose(lua_State *L) { static int pk_type(lua_State *L) { EVP_PKEY *key = checksimple(L, 1, PKEY_CLASS); - int nid = key->type; + int nid = EVP_PKEY_id(key); auxL_pushnid(L, nid); @@ -2802,7 +3060,7 @@ static int pk_toPEM(lua_State *L) { #if 0 case 4: case 5: /* params, Parameters */ /* EVP_PKEY_base_id not in OS X */ - switch (EVP_PKEY_type(key->type)) { + switch (EVP_PKEY_base_id(key)) { case EVP_PKEY_RSA: break; case EVP_PKEY_DSA: { @@ -2845,7 +3103,7 @@ static int pk_toPEM(lua_State *L) { } #endif default: - return luaL_error(L, "%d: unsupported EVP_PKEY base type", EVP_PKEY_type(key->type)); + return luaL_error(L, "%d: unsupported EVP_PKEY base type", EVP_PKEY_base_id(key)); } lua_pushlstring(L, pem, len); @@ -2961,82 +3219,100 @@ static void pk_pushparam(lua_State *L, void *base_key, enum pk_param which) { EC_KEY *ec; #endif } key = { base_key }; + const BIGNUM *i; switch (which) { case PK_RSA_N: /* RSA public modulus n */ - bn_dup_nil(L, key.rsa->n); + RSA_get0_key(key.rsa, &i, NULL, NULL); + bn_dup_nil(L, i); break; case PK_RSA_E: /* RSA public exponent e */ - bn_dup_nil(L, key.rsa->e); + RSA_get0_key(key.rsa, NULL, &i, NULL); + bn_dup_nil(L, i); break; case PK_RSA_D: /* RSA secret exponent d */ - bn_dup_nil(L, key.rsa->d); + RSA_get0_key(key.rsa, NULL, NULL, &i); + bn_dup_nil(L, i); break; case PK_RSA_P: /* RSA secret prime p */ - bn_dup_nil(L, key.rsa->p); + RSA_get0_factors(key.rsa, &i, NULL); + bn_dup_nil(L, i); break; case PK_RSA_Q: /* RSA secret prime q with p < q */ - bn_dup_nil(L, key.rsa->q); + RSA_get0_factors(key.rsa, NULL, &i); + bn_dup_nil(L, i); break; case PK_RSA_DMP1: /* exponent1 */ - bn_dup_nil(L, key.rsa->dmp1); + RSA_get0_crt_params(key.rsa, &i, NULL, NULL); + bn_dup_nil(L, i); break; case PK_RSA_DMQ1: /* exponent2 */ - bn_dup_nil(L, key.rsa->dmq1); + RSA_get0_crt_params(key.rsa, NULL, &i, NULL); + bn_dup_nil(L, i); break; case PK_RSA_IQMP: /* coefficient */ - bn_dup_nil(L, key.rsa->iqmp); + RSA_get0_crt_params(key.rsa, NULL, NULL, &i); + bn_dup_nil(L, i); break; case PK_DSA_P: - bn_dup_nil(L, key.dsa->p); + DSA_get0_pqg(key.dsa, &i, NULL, NULL); + bn_dup_nil(L, i); break; case PK_DSA_Q: - bn_dup_nil(L, key.dsa->q); + DSA_get0_pqg(key.dsa, NULL, &i, NULL); + bn_dup_nil(L, i); break; case PK_DSA_G: - bn_dup_nil(L, key.dsa->g); + DSA_get0_pqg(key.dsa, NULL, NULL, &i); + bn_dup_nil(L, i); break; case PK_DSA_PUB_KEY: - bn_dup_nil(L, key.dsa->pub_key); + DSA_get0_key(key.dsa, &i, NULL); + bn_dup_nil(L, i); break; case PK_DSA_PRIV_KEY: - bn_dup_nil(L, key.dsa->priv_key); + DSA_get0_key(key.dsa, NULL, &i); + bn_dup_nil(L, i); break; case PK_DH_P: - bn_dup_nil(L, key.dh->p); + DH_get0_pqg(key.dh, &i, NULL, NULL); + bn_dup_nil(L, i); break; case PK_DH_G: - bn_dup_nil(L, key.dh->g); + DH_get0_pqg(key.dh, NULL, NULL, &i); + bn_dup_nil(L, i); break; case PK_DH_PUB_KEY: - bn_dup_nil(L, key.dh->pub_key); + DH_get0_key(key.dh, &i, NULL); + bn_dup_nil(L, i); break; case PK_DH_PRIV_KEY: - bn_dup_nil(L, key.dh->priv_key); + DH_get0_key(key.dh, NULL, &i); + bn_dup_nil(L, i); break; #ifndef OPENSSL_NO_EC @@ -3069,22 +3345,9 @@ static void pk_pushparam(lua_State *L, void *base_key, enum pk_param which) { } /* pk_pushparam() */ -static _Bool pk_bn_set_nothrow(BIGNUM **dst, BIGNUM *src) { - BIGNUM *tmp; - - if (!(tmp = BN_dup(src))) - return 0; - - if (*dst) - BN_clear_free(*dst); - *dst = tmp; - - return 1; -} /* pk_bn_set_nothrow() */ - -#define pk_bn_set(L, dst, index) do { \ - BIGNUM *n = checkbig((L), (index)); \ - if (!pk_bn_set_nothrow((dst), n)) \ +#define pk_setparam_bn_dup(L, index, dst) do { \ + BIGNUM *tmp = checkbig((L), (index)); \ + if (!(*dst = BN_dup(tmp))) \ goto sslerr; \ } while (0) @@ -3097,74 +3360,92 @@ static void pk_setparam(lua_State *L, void *base_key, enum pk_param which, int i EC_KEY *ec; #endif } key = { base_key }; + BIGNUM *i; switch (which) { case PK_RSA_N: - pk_bn_set(L, &key.rsa->n, index); + pk_setparam_bn_dup(L, index, &i); + RSA_set0_key(key.rsa, i, NULL, NULL); break; case PK_RSA_E: - pk_bn_set(L, &key.rsa->e, index); + pk_setparam_bn_dup(L, index, &i); + RSA_set0_key(key.rsa, NULL, i, NULL); break; case PK_RSA_D: - pk_bn_set(L, &key.rsa->d, index); + pk_setparam_bn_dup(L, index, &i); + RSA_set0_key(key.rsa, NULL, NULL, i); break; case PK_RSA_P: - pk_bn_set(L, &key.rsa->p, index); + pk_setparam_bn_dup(L, index, &i); + RSA_set0_factors(key.rsa, i, NULL); break; case PK_RSA_Q: - pk_bn_set(L, &key.rsa->q, index); + pk_setparam_bn_dup(L, index, &i); + RSA_set0_factors(key.rsa, NULL, i); break; case PK_RSA_DMP1: - pk_bn_set(L, &key.rsa->dmp1, index); + pk_setparam_bn_dup(L, index, &i); + RSA_set0_crt_params(key.rsa, i, NULL, NULL); break; case PK_RSA_DMQ1: - pk_bn_set(L, &key.rsa->dmq1, index); + pk_setparam_bn_dup(L, index, &i); + RSA_set0_crt_params(key.rsa, NULL, i, NULL); break; case PK_RSA_IQMP: - pk_bn_set(L, &key.rsa->iqmp, index); + pk_setparam_bn_dup(L, index, &i); + RSA_set0_crt_params(key.rsa, NULL, NULL, i); break; case PK_DSA_P: - pk_bn_set(L, &key.dsa->p, index); + pk_setparam_bn_dup(L, index, &i); + DSA_set0_pqg(key.dsa, i, NULL, NULL); break; case PK_DSA_Q: - pk_bn_set(L, &key.dsa->q, index); + pk_setparam_bn_dup(L, index, &i); + DSA_set0_pqg(key.dsa, NULL, i, NULL); break; case PK_DSA_G: - pk_bn_set(L, &key.dsa->g, index); + pk_setparam_bn_dup(L, index, &i); + DSA_set0_pqg(key.dsa, NULL, NULL, i); break; case PK_DSA_PUB_KEY: - pk_bn_set(L, &key.dsa->pub_key, index); + pk_setparam_bn_dup(L, index, &i); + DSA_set0_key(key.dsa, i, NULL); break; case PK_DSA_PRIV_KEY: - pk_bn_set(L, &key.dsa->priv_key, index); + pk_setparam_bn_dup(L, index, &i); + DSA_set0_key(key.dsa, NULL, i); break; case PK_DH_P: - pk_bn_set(L, &key.dh->p, index); + pk_setparam_bn_dup(L, index, &i); + DH_set0_pqg(key.dh, i, NULL, NULL); break; case PK_DH_G: - pk_bn_set(L, &key.dh->g, index); + pk_setparam_bn_dup(L, index, &i); + DH_set0_pqg(key.dh, NULL, NULL, i); break; case PK_DH_PUB_KEY: - pk_bn_set(L, &key.dh->pub_key, index); + pk_setparam_bn_dup(L, index, &i); + DH_set0_key(key.dh, i, NULL); break; case PK_DH_PRIV_KEY: - pk_bn_set(L, &key.dh->priv_key, index); + pk_setparam_bn_dup(L, index, &i); + DH_set0_key(key.dh, NULL, i); break; #ifndef OPENSSL_NO_EC @@ -5180,7 +5461,7 @@ static const EVP_MD *xc_signature(lua_State *L, int index, EVP_PKEY *key) { if ((id = luaL_optstring(L, index, NULL))) return ((md = EVP_get_digestbyname(id)))? md : EVP_md_null(); - switch (EVP_PKEY_type(key->type)) { + switch (EVP_PKEY_base_id(key)) { case EVP_PKEY_RSA: return EVP_sha1(); case EVP_PKEY_DSA: |