denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

openssl: PRF_KEYED_SHA1 might not be supported

Browse Source 
The old API has been deprecated with OpenSSL 3 and direct access to the
state isn't possible via EVP API.  In the future we might just remove this
implementation but we'd probably have to implement EAP-AKA' first, which
uses HMAC-SHA-256 with IKEv2's prf+ construct to derive keys instead
of this weird construct (plus what fips-prf builds around it) that's used
by EAP-AKA.
This commit is contained in:
Tobias Brunner
2022-04-14 19:05:44 +02:00
parent 519bc22091
commit 13efce489e
2 changed files with 10 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/openssl/openssl_plugin.c
+2 -1
View File
@@ -615,7 +615,8 @@ METHOD(plugin_t, get_features, int,
PLUGIN_PROVIDE(XOF, XOF_SHAKE_128),
PLUGIN_PROVIDE(XOF, XOF_SHAKE_256),
#endif
#ifndef OPENSSL_NO_SHA1
#if !defined(OPENSSL_NO_SHA1) && \
(OPENSSL_VERSION_NUMBER < 0x30000000L || !defined(OPENSSL_NO_DEPRECATED))
/* keyed sha1 hasher (aka prf) */
PLUGIN_REGISTER(PRF, openssl_sha1_prf_create),
PLUGIN_PROVIDE(PRF, PRF_KEYED_SHA1),
src/libstrongswan/plugins/openssl/openssl_sha1_prf.c
+8 -10
View File
@@ -13,9 +13,15 @@
* for more details.
*/
/* direct access to the state and the SHA1_* API have been deprecated with
* OpenSSL 3, so at some point this won't work anymore */
#define OPENSSL_SUPPRESS_DEPRECATED
#include <openssl/opensslv.h>
#include <openssl/opensslconf.h>
#ifndef OPENSSL_NO_SHA1
#if !defined(OPENSSL_NO_SHA1) && \
(OPENSSL_VERSION_NUMBER < 0x30000000L || !defined(OPENSSL_NO_DEPRECATED))
#include "openssl_sha1_prf.h"
@@ -43,14 +49,10 @@ struct private_openssl_sha1_prf_t {
METHOD(prf_t, get_bytes, bool,
private_openssl_sha1_prf_t *this, chunk_t seed, uint8_t *bytes)
{
#if OPENSSL_VERSION_NUMBER >= 0x10000000L
if (!SHA1_Update(&this->ctx, seed.ptr, seed.len))
{
return FALSE;
}
#else /* OPENSSL_VERSION_NUMBER < 1.0 */
SHA1_Update(&this->ctx, seed.ptr, seed.len);
#endif
if (bytes)
{
@@ -92,14 +94,10 @@ METHOD(prf_t, get_key_size, size_t,
METHOD(prf_t, set_key, bool,
private_openssl_sha1_prf_t *this, chunk_t key)
{
#if OPENSSL_VERSION_NUMBER >= 0x10000000L
if (!SHA1_Init(&this->ctx))
{
return FALSE;
}
#else /* OPENSSL_VERSION_NUMBER < 1.0 */
SHA1_Init(&this->ctx);
#endif
if (key.len % 4)
{
@@ -162,4 +160,4 @@ openssl_sha1_prf_t *openssl_sha1_prf_create(pseudo_random_function_t algo)
return &this->public;
}
#endif /* OPENSSL_NO_SHA1 */
#endif /* !OPENSSL_NO_SHA1 && SHA_LONG */