denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

openssl: Fixes for RSA with OpenSSL 3.0

Browse Source
This commit is contained in:
Tobias Brunner
2022-04-14 19:05:44 +02:00
parent 36cf74f5d9
commit 21b586c61c
4 changed files with 445 additions and 452 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/openssl/openssl_rsa_public_key.c
+182 -179
View File
@@ -31,6 +31,11 @@
#include <openssl/rsa.h>
#include <openssl/x509.h>
#if OPENSSL_VERSION_NUMBER >= 0x30000000L
#include <openssl/param_build.h>
#include <openssl/core_names.h>
#endif
#if OPENSSL_VERSION_NUMBER < 0x10100000L
OPENSSL_KEY_FALLBACK(RSA, key, n, e, d)
#endif
@@ -47,9 +52,9 @@ struct private_openssl_rsa_public_key_t {
openssl_rsa_public_key_t public;
/**
* RSA object from OpenSSL
* RSA key object
*/
RSA *rsa;
EVP_PKEY *key;
/**
* reference counter
@@ -57,9 +62,6 @@ struct private_openssl_rsa_public_key_t {
refcount_t ref;
};
#if OPENSSL_VERSION_NUMBER >= 0x10000000L
/**
* Verify RSA signature
*/
@@ -69,8 +71,7 @@ static bool verify_signature(private_openssl_rsa_public_key_t *this,
{
EVP_PKEY_CTX *pctx = NULL;
EVP_MD_CTX *mctx = NULL;
EVP_PKEY *key;
int rsa_size = RSA_size(this->rsa);
int rsa_size = EVP_PKEY_size(this->key);
bool valid = FALSE;
/* OpenSSL expects a signature of exactly RSA size (no leading 0x00) */
@@ -80,16 +81,11 @@ static bool verify_signature(private_openssl_rsa_public_key_t *this,
}
mctx = EVP_MD_CTX_create();
key = EVP_PKEY_new();
if (!mctx || !key)
if (!mctx)
{
goto error;
return FALSE;
}
if (!EVP_PKEY_set1_RSA(key, this->rsa))
{
goto error;
}
if (EVP_DigestVerifyInit(mctx, &pctx, md, NULL, key) <= 0)
if (EVP_DigestVerifyInit(mctx, &pctx, md, NULL, this->key) <= 0)
{
goto error;
}
@@ -110,14 +106,7 @@ static bool verify_signature(private_openssl_rsa_public_key_t *this,
valid = (EVP_DigestVerifyFinal(mctx, signature.ptr, signature.len) == 1);
error:
if (key)
{
EVP_PKEY_free(key);
}
if (mctx)
{
EVP_MD_CTX_destroy(mctx);
}
EVP_MD_CTX_destroy(mctx);
return valid;
}
@@ -128,7 +117,7 @@ static bool verify_plain_signature(private_openssl_rsa_public_key_t *this,
chunk_t data, chunk_t signature)
{
char *buf;
int len, rsa_size = RSA_size(this->rsa);
size_t rsa_size = EVP_PKEY_size(this->key);
bool valid = FALSE;
/* OpenSSL expects a signature of exactly RSA size (no leading 0x00) */
@@ -136,14 +125,39 @@ static bool verify_plain_signature(private_openssl_rsa_public_key_t *this,
{
signature = chunk_skip(signature, signature.len - rsa_size);
}
#if defined(OPENSSL_IS_BORINGSSL) && \
(!defined(BORINGSSL_API_VERSION) || BORINGSSL_API_VERSION < 10)
RSA *rsa = EVP_PKEY_get1_RSA(this->key);
int len;
buf = malloc(rsa_size);
len = RSA_public_decrypt(signature.len, signature.ptr, buf, this->rsa,
len = RSA_public_decrypt(signature.len, signature.ptr, buf, rsa,
RSA_PKCS1_PADDING);
if (len != -1)
{
valid = chunk_equals_const(data, chunk_create(buf, len));
}
RSA_free(rsa);
#else
EVP_PKEY_CTX *ctx;
size_t len = rsa_size;
ctx = EVP_PKEY_CTX_new(this->key, NULL);
if (!ctx ||
EVP_PKEY_verify_recover_init(ctx) <= 0 ||
EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0)
{
EVP_PKEY_CTX_free(ctx);
return FALSE;
}
buf = malloc(rsa_size);
if (EVP_PKEY_verify_recover(ctx, buf, &len, signature.ptr, signature.len) > 0)
{
valid = chunk_equals_const(data, chunk_create(buf, len));
}
free(buf);
EVP_PKEY_CTX_free(ctx);
#endif
return valid;
}
@@ -180,85 +194,6 @@ static bool verify_emsa_pss_signature(private_openssl_rsa_public_key_t *this,
return md && verify_signature(this, md, params, data, signature);
}
#else /* OPENSSL_VERSION_NUMBER < 1.0 */
/**
* Verification of an EMSA PKCS1 signature described in PKCS#1
*/
static bool verify_emsa_pkcs1_signature(private_openssl_rsa_public_key_t *this,
int type, chunk_t data, chunk_t signature)
{
bool valid = FALSE;
int rsa_size = RSA_size(this->rsa);
/* OpenSSL expects a signature of exactly RSA size (no leading 0x00) */
if (signature.len > rsa_size)
{
signature = chunk_skip(signature, signature.len - rsa_size);
}
if (type == NID_undef)
{
char *buf;
int len;
buf = malloc(rsa_size);
len = RSA_public_decrypt(signature.len, signature.ptr, buf, this->rsa,
RSA_PKCS1_PADDING);
if (len != -1)
{
valid = chunk_equals_const(data, chunk_create(buf, len));
}
free(buf);
}
else
{
EVP_MD_CTX *ctx;
EVP_PKEY *key;
const EVP_MD *hasher;
hasher = EVP_get_digestbynid(type);
if (!hasher)
{
return FALSE;
}
ctx = EVP_MD_CTX_create();
key = EVP_PKEY_new();
if (!ctx || !key)
{
goto error;
}
if (!EVP_PKEY_set1_RSA(key, this->rsa))
{
goto error;
}
if (!EVP_VerifyInit_ex(ctx, hasher, NULL))
{
goto error;
}
if (!EVP_VerifyUpdate(ctx, data.ptr, data.len))
{
goto error;
}
valid = (EVP_VerifyFinal(ctx, signature.ptr, signature.len, key) == 1);
error:
if (key)
{
EVP_PKEY_free(key);
}
if (ctx)
{
EVP_MD_CTX_destroy(ctx);
}
}
return valid;
}
#endif /* OPENSSL_VERSION_NUMBER < 1.0 */
METHOD(public_key_t, get_type, key_type_t,
private_openssl_rsa_public_key_t *this)
{
@@ -295,10 +230,8 @@ METHOD(public_key_t, verify, bool,
return verify_emsa_pkcs1_signature(this, NID_sha1, data, signature);
case SIGN_RSA_EMSA_PKCS1_MD5:
return verify_emsa_pkcs1_signature(this, NID_md5, data, signature);
#if OPENSSL_VERSION_NUMBER >= 0x10000000L
case SIGN_RSA_EMSA_PSS:
return verify_emsa_pss_signature(this, params, data, signature);
#endif
default:
DBG1(DBG_LIB, "signature scheme %N not supported in RSA",
signature_scheme_names, scheme);
@@ -311,7 +244,6 @@ METHOD(public_key_t, encrypt, bool,
void *params, chunk_t plain, chunk_t *crypto)
{
EVP_PKEY_CTX *ctx = NULL;
EVP_PKEY *evp_key = NULL;
chunk_t label = chunk_empty;
hash_algorithm_t hash_alg = HASH_UNKNOWN;
size_t len;
@@ -350,23 +282,11 @@ METHOD(public_key_t, encrypt, bool,
return FALSE;
}
evp_key = EVP_PKEY_new();
if (!evp_key)
{
DBG1(DBG_LIB, "could not create EVP key");
goto error;
}
if (EVP_PKEY_set1_RSA(evp_key, this->rsa) <= 0)
{
DBG1(DBG_LIB, "could not set EVP key to RSA key");
goto error;
}
ctx = EVP_PKEY_CTX_new(evp_key, NULL);
ctx = EVP_PKEY_CTX_new(this->key, NULL);
if (!ctx)
{
DBG1(DBG_LIB, "could not create EVP context");
goto error;
return FALSE;
}
if (EVP_PKEY_encrypt_init(ctx) <= 0)
@@ -411,7 +331,7 @@ METHOD(public_key_t, encrypt, bool,
}
/* determine maximum ciphertext size */
len = RSA_size(this->rsa);
len = EVP_PKEY_size(this->key);
encrypted = malloc(len);
/* decrypt data */
@@ -425,59 +345,91 @@ METHOD(public_key_t, encrypt, bool,
success = TRUE;
error:
if (ctx)
{
EVP_PKEY_CTX_free(ctx);
}
if (evp_key)
{
EVP_PKEY_free(evp_key);
}
EVP_PKEY_CTX_free(ctx);
return success;
}
METHOD(public_key_t, get_keysize, int,
private_openssl_rsa_public_key_t *this)
{
return RSA_size(this->rsa) * 8;
return EVP_PKEY_bits(this->key);
}
/**
* Get n and e of the given RSA key (allocated).
*/
static bool get_n_and_e(EVP_PKEY *key, chunk_t *n, chunk_t *e)
{
const BIGNUM *cbn_n, *cbn_e;
BIGNUM *bn_n = NULL, *bn_e = NULL;
bool success = FALSE;
#if OPENSSL_VERSION_NUMBER >= 0x30000000L
if (EVP_PKEY_get_bn_param(key, OSSL_PKEY_PARAM_RSA_N, &bn_n) <= 0 ||
EVP_PKEY_get_bn_param(key, OSSL_PKEY_PARAM_RSA_E, &bn_e) <= 0)
{
goto error;
}
cbn_n = bn_n;
cbn_e = bn_e;
#elif OPENSSL_VERSION_NUMBER >= 0x1010000fL
RSA *rsa = EVP_PKEY_get0_RSA(key);
RSA_get0_key(rsa, &cbn_n, &cbn_e, NULL);
#else
RSA *rsa = EVP_PKEY_get1_RSA(key);
RSA_get0_key(rsa, &cbn_n, &cbn_e, NULL);
RSA_free(rsa);
#endif
*n = *e = chunk_empty;
if (!openssl_bn2chunk(cbn_n, n) ||
!openssl_bn2chunk(cbn_e, e))
{
chunk_free(n);
chunk_free(e);
goto error;
}
success = TRUE;
error:
BN_free(bn_n);
BN_free(bn_e);
return success;
}
/**
* Calculate fingerprint from a RSA key, also used in rsa private key.
*/
bool openssl_rsa_fingerprint(RSA *rsa, cred_encoding_type_t type, chunk_t *fp)
bool openssl_rsa_fingerprint(EVP_PKEY *key, cred_encoding_type_t type, chunk_t *fp)
{
hasher_t *hasher;
chunk_t key;
chunk_t enc;
u_char *p;
if (lib->encoding->get_cache(lib->encoding, type, rsa, fp))
if (lib->encoding->get_cache(lib->encoding, type, key, fp))
{
return TRUE;
}
switch (type)
{
case KEYID_PUBKEY_SHA1:
key = chunk_alloc(i2d_RSAPublicKey(rsa, NULL));
p = key.ptr;
i2d_RSAPublicKey(rsa, &p);
enc = chunk_alloc(i2d_PublicKey(key, NULL));
p = enc.ptr;
i2d_PublicKey(key, &p);
break;
case KEYID_PUBKEY_INFO_SHA1:
key = chunk_alloc(i2d_RSA_PUBKEY(rsa, NULL));
p = key.ptr;
i2d_RSA_PUBKEY(rsa, &p);
enc = chunk_alloc(i2d_PUBKEY(key, NULL));
p = enc.ptr;
i2d_PUBKEY(key, &p);
break;
default:
{
const BIGNUM *bn_n, *bn_e;
chunk_t n = chunk_empty, e = chunk_empty;
bool success = FALSE;
RSA_get0_key(rsa, &bn_n, &bn_e, NULL);
if (openssl_bn2chunk(bn_n, &n) &&
openssl_bn2chunk(bn_e, &e))
if (get_n_and_e(key, &n, &e))
{
success = lib->encoding->encode(lib->encoding, type, rsa, fp,
success = lib->encoding->encode(lib->encoding, type, key, fp,
CRED_PART_RSA_MODULUS, n,
CRED_PART_RSA_PUB_EXP, e, CRED_PART_END);
}
@@ -487,16 +439,16 @@ bool openssl_rsa_fingerprint(RSA *rsa, cred_encoding_type_t type, chunk_t *fp)
}
}
hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
if (!hasher || !hasher->allocate_hash(hasher, key, fp))
if (!hasher || !hasher->allocate_hash(hasher, enc, fp))
{
DBG1(DBG_LIB, "SHA1 hash algorithm not supported, fingerprinting failed");
DESTROY_IF(hasher);
free(key.ptr);
free(enc.ptr);
return FALSE;
}
free(key.ptr);
free(enc.ptr);
hasher->destroy(hasher);
lib->encoding->cache(lib->encoding, type, rsa, *fp);
lib->encoding->cache(lib->encoding, type, key, *fp);
return TRUE;
}
@@ -504,7 +456,7 @@ METHOD(public_key_t, get_fingerprint, bool,
private_openssl_rsa_public_key_t *this, cred_encoding_type_t type,
chunk_t *fingerprint)
{
return openssl_rsa_fingerprint(this->rsa, type, fingerprint);
return openssl_rsa_fingerprint(this->key, type, fingerprint);
}
METHOD(public_key_t, get_encoding, bool,
@@ -512,16 +464,13 @@ METHOD(public_key_t, get_encoding, bool,
chunk_t *encoding)
{
bool success = FALSE;
u_char *p;
switch (type)
{
case PUBKEY_SPKI_ASN1_DER:
case PUBKEY_PEM:
{
*encoding = chunk_alloc(i2d_RSA_PUBKEY(this->rsa, NULL));
p = encoding->ptr;
i2d_RSA_PUBKEY(this->rsa, &p);
*encoding = openssl_i2chunk(PUBKEY, this->key);
success = TRUE;
if (type == PUBKEY_PEM)
@@ -537,19 +486,14 @@ METHOD(public_key_t, get_encoding, bool,
}
case PUBKEY_ASN1_DER:
{
*encoding = chunk_alloc(i2d_RSAPublicKey(this->rsa, NULL));
p = encoding->ptr;
i2d_RSAPublicKey(this->rsa, &p);
*encoding = openssl_i2chunk(PublicKey, this->key);
return TRUE;
}
default:
{
const BIGNUM *bn_n, *bn_e;
chunk_t n = chunk_empty, e = chunk_empty;
RSA_get0_key(this->rsa, &bn_n, &bn_e, NULL);
if (openssl_bn2chunk(bn_n, &n) &&
openssl_bn2chunk(bn_e, &e))
if (get_n_and_e(this->key, &n, &e))
{
success = lib->encoding->encode(lib->encoding, type, NULL,
encoding, CRED_PART_RSA_MODULUS, n,
@@ -574,10 +518,10 @@ METHOD(public_key_t, destroy, void,
{
if (ref_put(&this->ref))
{
if (this->rsa)
if (this->key)
{
lib->encoding->clear_cache(lib->encoding, this->rsa);
RSA_free(this->rsa);
lib->encoding->clear_cache(lib->encoding, this->key);
EVP_PKEY_free(this->key);
}
free(this);
}
@@ -586,7 +530,7 @@ METHOD(public_key_t, destroy, void,
/**
* Generic private constructor
*/
static private_openssl_rsa_public_key_t *create_empty()
static private_openssl_rsa_public_key_t *create_internal(EVP_PKEY *key)
{
private_openssl_rsa_public_key_t *this;
@@ -606,6 +550,7 @@ static private_openssl_rsa_public_key_t *create_empty()
},
},
.ref = 1,
.key = key,
);
return this;
@@ -618,6 +563,7 @@ openssl_rsa_public_key_t *openssl_rsa_public_key_load(key_type_t type,
va_list args)
{
private_openssl_rsa_public_key_t *this;
EVP_PKEY *key = NULL;
chunk_t blob, n, e;
n = e = blob = chunk_empty;
@@ -642,41 +588,98 @@ openssl_rsa_public_key_t *openssl_rsa_public_key_load(key_type_t type,
break;
}
this = create_empty();
if (blob.ptr)
{
switch (type)
{
case KEY_ANY:
this->rsa = d2i_RSA_PUBKEY(NULL, (const u_char**)&blob.ptr,
blob.len);
key = d2i_PUBKEY(NULL, (const u_char**)&blob.ptr, blob.len);
if (key && EVP_PKEY_base_id(key) != EVP_PKEY_RSA)
{
EVP_PKEY_free(key);
key = NULL;
}
break;
case KEY_RSA:
this->rsa = d2i_RSAPublicKey(NULL, (const u_char**)&blob.ptr,
blob.len);
#if defined(OPENSSL_IS_BORINGSSL) && \
(!defined(BORINGSSL_API_VERSION) || BORINGSSL_API_VERSION < 10)
{
RSA *rsa = d2i_RSAPublicKey(NULL, (const u_char**)&blob.ptr,
blob.len);
key = EVP_PKEY_new();
if (!key || !EVP_PKEY_assign_RSA(key, rsa))
{
RSA_free(rsa);
EVP_PKEY_free(key);
key = NULL;
}
}
#else
key = d2i_PublicKey(EVP_PKEY_RSA, NULL, (const u_char**)&blob.ptr,
blob.len);
#endif
break;
default:
break;
}
if (this->rsa)
{
return &this->public;
}
}
else if (n.ptr && e.ptr && type == KEY_RSA)
{
BIGNUM *bn_n, *bn_e;
this->rsa = RSA_new();
bn_n = BN_bin2bn((const u_char*)n.ptr, n.len, NULL);
bn_e = BN_bin2bn((const u_char*)e.ptr, e.len, NULL);
if (RSA_set0_key(this->rsa, bn_n, bn_e, NULL))
#if OPENSSL_VERSION_NUMBER >= 0x30000000L
OSSL_PARAM_BLD *bld;
OSSL_PARAM *params = NULL;
EVP_PKEY_CTX *ctx;
bld = OSSL_PARAM_BLD_new();
if (bld &&
OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_N, bn_n) &&
OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_E, bn_e))
{
return &this->public;
params = OSSL_PARAM_BLD_to_param(bld);
}
OSSL_PARAM_BLD_free(bld);
BN_free(bn_n);
BN_free(bn_e);
ctx = EVP_PKEY_CTX_new_from_name(NULL, "RSA", NULL);
if (!params || !ctx ||
EVP_PKEY_fromdata_init(ctx) <= 0 ||
EVP_PKEY_fromdata(ctx, &key, EVP_PKEY_PUBLIC_KEY, params) <= 0)
{
key = NULL;
}
EVP_PKEY_CTX_free(ctx);
OSSL_PARAM_free(params);
#else /* OPENSSL_VERSION_NUMBER */
RSA *rsa = RSA_new();
if (RSA_set0_key(rsa, bn_n, bn_e, NULL))
{
key = EVP_PKEY_new();
if (!key || !EVP_PKEY_assign_RSA(key, rsa))
{
RSA_free(rsa);
EVP_PKEY_free(key);
key = NULL;
}
}
else
{
RSA_free(rsa);
}
#endif /* OPENSSL_VERSION_NUMBER */
}
destroy(this);
return NULL;
if (!key)
{
return NULL;
}
this = create_internal(key);
return &this->public;
}
#endif /* OPENSSL_NO_RSA */