From cb65e95d4ab223b96ae680618a7733de778666ca Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 8 Apr 2016 15:52:58 +0200 Subject: [PATCH 1/6] android: OPENSSL_NO_ENGINE is now properly defined in the headers --- src/frontends/android/app/src/main/jni/Android.mk | 1 - 1 file changed, 1 deletion(-) diff --git a/src/frontends/android/app/src/main/jni/Android.mk b/src/frontends/android/app/src/main/jni/Android.mk index 39620aa42..9e81a14c5 100644 --- a/src/frontends/android/app/src/main/jni/Android.mk +++ b/src/frontends/android/app/src/main/jni/Android.mk @@ -46,7 +46,6 @@ strongswan_CFLAGS := \ -DHAVE_IPSEC_DIR_FWD \ -DHAVE_IN6ADDR_ANY \ -DHAVE_NETINET_IP6_H \ - -DOPENSSL_NO_ENGINE \ -DCONFIG_H_INCLUDED \ -DCAPABILITIES \ -DCAPABILITIES_NATIVE \ From 9b85a6853b644d72a56319647ca2f45d456818b7 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 13 Apr 2016 09:31:50 +0200 Subject: [PATCH 2/6] android: Remove OPENSSL_NO_EC* defines Current versions of OpenSSL/BoringSSL shipped with Android support ECC. --- Android.mk | 3 --- 1 file changed, 3 deletions(-) diff --git a/Android.mk b/Android.mk index 840cc14cf..3899eff23 100644 --- a/Android.mk +++ b/Android.mk @@ -66,9 +66,6 @@ strongswan_CFLAGS := \ -DHAVE_STRUCT_SADB_X_POLICY_SADB_X_POLICY_PRIORITY \ -DHAVE_IPSEC_MODE_BEET \ -DHAVE_IPSEC_DIR_FWD \ - -DOPENSSL_NO_EC \ - -DOPENSSL_NO_ECDSA \ - -DOPENSSL_NO_ECDH \ -DOPENSSL_NO_ENGINE \ -DCONFIG_H_INCLUDED \ -DCAPABILITIES \ From 77df573a9551c5a344ad00b901b1bbd47cd57134 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 8 Apr 2016 15:54:08 +0200 Subject: [PATCH 3/6] openssl: Use proper EVP macro to determine size of a hash --- src/libstrongswan/plugins/openssl/openssl_hasher.c | 2 +- src/libstrongswan/plugins/openssl/openssl_util.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/libstrongswan/plugins/openssl/openssl_hasher.c b/src/libstrongswan/plugins/openssl/openssl_hasher.c index 8f7df0f8a..96ee230c9 100644 --- a/src/libstrongswan/plugins/openssl/openssl_hasher.c +++ b/src/libstrongswan/plugins/openssl/openssl_hasher.c @@ -43,7 +43,7 @@ struct private_openssl_hasher_t { METHOD(hasher_t, get_hash_size, size_t, private_openssl_hasher_t *this) { - return this->hasher->md_size; + return EVP_MD_size(this->hasher); } METHOD(hasher_t, reset, bool, diff --git a/src/libstrongswan/plugins/openssl/openssl_util.c b/src/libstrongswan/plugins/openssl/openssl_util.c index 2f9813701..914060358 100644 --- a/src/libstrongswan/plugins/openssl/openssl_util.c +++ b/src/libstrongswan/plugins/openssl/openssl_util.c @@ -51,7 +51,7 @@ bool openssl_hash_chunk(int hash_type, chunk_t data, chunk_t *hash) goto error; } - *hash = chunk_alloc(hasher->md_size); + *hash = chunk_alloc(EVP_MD_size(hasher)); if (!EVP_DigestFinal_ex(ctx, hash->ptr, NULL)) { chunk_free(hash); From c8a219a28d937a638dba817bddaa7c77ad81ad0e Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 8 Apr 2016 15:55:05 +0200 Subject: [PATCH 4/6] openssl: The member storing the DH exponent length has been renamed in BoringSSL --- src/libstrongswan/plugins/openssl/openssl_diffie_hellman.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/libstrongswan/plugins/openssl/openssl_diffie_hellman.c b/src/libstrongswan/plugins/openssl/openssl_diffie_hellman.c index 49ec48804..5b1859b35 100644 --- a/src/libstrongswan/plugins/openssl/openssl_diffie_hellman.c +++ b/src/libstrongswan/plugins/openssl/openssl_diffie_hellman.c @@ -145,7 +145,11 @@ static status_t set_modulus(private_openssl_diffie_hellman_t *this) this->dh->g = BN_bin2bn(params->generator.ptr, params->generator.len, NULL); if (params->exp_len != params->prime.len) { +#ifdef OPENSSL_IS_BORINGSSL + this->dh->priv_length = params->exp_len * 8; +#else this->dh->length = params->exp_len * 8; +#endif } return SUCCESS; } From 47a46be5976d71beb9fbaefa7350f79411419edb Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 8 Apr 2016 15:56:25 +0200 Subject: [PATCH 5/6] openssl: BoringSSL does not support configuration The other initialization functions are still defined but many are apparently no-ops (this is also true for the threading initialization). --- src/libstrongswan/plugins/openssl/openssl_plugin.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/libstrongswan/plugins/openssl/openssl_plugin.c b/src/libstrongswan/plugins/openssl/openssl_plugin.c index aeb9be409..e5c1dc0ee 100644 --- a/src/libstrongswan/plugins/openssl/openssl_plugin.c +++ b/src/libstrongswan/plugins/openssl/openssl_plugin.c @@ -502,8 +502,10 @@ METHOD(plugin_t, get_features, int, METHOD(plugin_t, destroy, void, private_openssl_plugin_t *this) { +#ifndef OPENSSL_IS_BORINGSSL CONF_modules_free(); OBJ_cleanup(); +#endif EVP_cleanup(); #ifndef OPENSSL_NO_ENGINE ENGINE_cleanup(); @@ -555,7 +557,9 @@ plugin_t *openssl_plugin_create() threading_init(); +#ifndef OPENSSL_IS_BORINGSSL OPENSSL_config(NULL); +#endif OpenSSL_add_all_algorithms(); #ifdef OPENSSL_FIPS From 689bb349588c691fadc0937aa28b53f81e8f0ea7 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 11 Apr 2016 11:33:41 +0200 Subject: [PATCH 6/6] curl: Add TLS support if libcurl is built against BoringSSL We don't have to rely on the openssl plugin and its threading initialization as BoringSSL is thread-safe out of the box. --- src/libstrongswan/plugins/curl/curl_plugin.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/libstrongswan/plugins/curl/curl_plugin.c b/src/libstrongswan/plugins/curl/curl_plugin.c index f9e5dcd27..42ae9cdd2 100644 --- a/src/libstrongswan/plugins/curl/curl_plugin.c +++ b/src/libstrongswan/plugins/curl/curl_plugin.c @@ -70,7 +70,8 @@ static void add_feature_with_ssl(private_curl_plugin_t *this, const char *ssl, add_feature(this, f); add_feature(this, PLUGIN_DEPENDS(CUSTOM, "gcrypt-threading")); } - else if (strpfx(ssl, "NSS")) + else if (strpfx(ssl, "NSS") || + strpfx(ssl, "BoringSSL")) { add_feature(this, f); }