1From 2e730b2259c701f16d473dbfb7e58e86a6e71b01 Mon Sep 17 00:00:00 2001
2From: Daniel Kurtz <djkurtz@chromium.org>
3Date: Fri, 18 Jan 2019 13:04:59 +0200
4Subject: [PATCH] Update for openssl 1.1
5
6OpenSSL 1.1 has made significant non-backwards compatible changes to its
7API as outlined in:
8https://wiki.openssl.org/index.php/OpenSSL_1.1.0_Changes
9
10BRANCH=none
11BUG=chromium:738114
12TEST=cros_workon --host start vboot_reference
13TEST=w/ openssl-1.0.2k: sudo emerge vboot_reference
14TEST=w/ openssl-1.1.0e: sudo emerge vboot_reference
15 => both build ok
16 $ futility version
17  => command runs without error
18TEST=cros_workon --board=soraka start vboot_reference coreboot
19TEST=w/ openssl-1.0.2k: emerge-soraka vboot_reference coreboot
20TEST=w/ openssl-1.1.0e: emerge-soraka vboot_reference coreboot
21 => All build ok
22
23Change-Id: I37cfc8cbb04a092eab7b0b3224f475b82609447c
24Reviewed-on: https://chromium-review.googlesource.com/557739
25Commit-Ready: Daniel Kurtz <djkurtz@chromium.org>
26Tested-by: Daniel Kurtz <djkurtz@chromium.org>
27Reviewed-by: Randall Spangler <rspangler@chromium.org>
28Reviewed-by: Mike Frysinger <vapier@chromium.org>
29
30(cherry-picked from bce7904376beee2912932433a4634c1c25afe2f5)
31Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
32---
33 futility/cmd_create.c         |  5 ++++-
34 futility/vb2_helper.c         |  7 +++++--
35 host/include/openssl_compat.h | 26 ++++++++++++++++++++++++++
36 host/lib/util_misc.c          |  7 +++++--
37 host/lib21/host_key.c         |  8 +++++++-
38 utility/dumpRSAPublicKey.c    | 19 ++++++++++++++-----
39 6 files changed, 61 insertions(+), 11 deletions(-)
40 create mode 100644 host/include/openssl_compat.h
41
42diff --git a/futility/cmd_create.c b/futility/cmd_create.c
43index 143ea9ae..80d3fd90 100644
44--- a/futility/cmd_create.c
45+++ b/futility/cmd_create.c
46@@ -13,6 +13,7 @@
47 #include "2common.h"
48 #include "2id.h"
49 #include "2rsa.h"
50+#include "openssl_compat.h"
51 #include "util_misc.h"
52 #include "vb2_common.h"
53 #include "vb2_struct.h"
54@@ -170,6 +171,7 @@ static int vb2_make_keypair()
55 	enum vb2_signature_algorithm sig_alg;
56 	uint8_t *pubkey_buf = 0;
57 	int has_priv = 0;
58+	const BIGNUM *rsa_d;
59
60 	FILE *fp;
61 	int ret = 1;
62@@ -193,7 +195,8 @@ static int vb2_make_keypair()
63 		goto done;
64 	}
65 	/* Public keys doesn't have the private exponent */
66-	has_priv = !!rsa_key->d;
67+	RSA_get0_key(rsa_key, NULL, NULL, &rsa_d);
68+	has_priv = !!rsa_d;
69 	if (!has_priv)
70 		fprintf(stderr, "%s has a public key only.\n", infile);
71
72diff --git a/futility/vb2_helper.c b/futility/vb2_helper.c
73index 51a78375..c6cc0fdd 100644
74--- a/futility/vb2_helper.c
75+++ b/futility/vb2_helper.c
76@@ -11,6 +11,7 @@
77 #include "2common.h"
78 #include "2id.h"
79 #include "2rsa.h"
80+#include "openssl_compat.h"
81 #include "util_misc.h"
82 #include "vb2_common.h"
83 #include "vb2_struct.h"
84@@ -216,6 +217,7 @@ int ft_show_pem(const char *name, uint8_t *buf, uint32_t len, void *data)
85 	uint8_t *keyb, *digest;
86 	uint32_t keyb_len;
87 	int i, bits;
88+	const BIGNUM *rsa_key_n, *rsa_key_d;
89
90 	/* We're called only after ft_recognize_pem, so this should work. */
91 	rsa_key = rsa_from_buffer(buf, len);
92@@ -223,10 +225,11 @@ int ft_show_pem(const char *name, uint8_t *buf, uint32_t len, void *data)
93 		DIE;
94
95 	/* Use to presence of the private exponent to decide if it's public */
96-	printf("%s Key file:      %s\n", rsa_key->d ? "Private" : "Public",
97+	RSA_get0_key(rsa_key, &rsa_key_n, NULL, &rsa_key_d);
98+	printf("%s Key file:      %s\n", rsa_key_d ? "Private" : "Public",
99 					 name);
100
101-	bits = BN_num_bits(rsa_key->n);
102+	bits = BN_num_bits(rsa_key_n);
103 	printf("  Key length:          %d\n", bits);
104
105 	if (vb_keyb_from_rsa(rsa_key, &keyb, &keyb_len)) {
106diff --git a/host/include/openssl_compat.h b/host/include/openssl_compat.h
107new file mode 100644
108index 00000000..7771f32a
109--- /dev/null
110+++ b/host/include/openssl_compat.h
111@@ -0,0 +1,26 @@
112+/* Copyright 2017 The Chromium OS Authors. All rights reserved.
113+ * Use of this source code is governed by a BSD-style license that can be
114+ * found in the LICENSE file.
115+ */
116+
117+#ifndef VBOOT_REFERENCE_OPENSSL_COMPAT_H_
118+#define VBOOT_REFERENCE_OPENSSL_COMPAT_H_
119+
120+#include <openssl/rsa.h>
121+
122+#if OPENSSL_VERSION_NUMBER < 0x10100000L
123+
124+static inline void RSA_get0_key(const RSA *rsa, const BIGNUM **n,
125+				const BIGNUM **e, const BIGNUM **d)
126+{
127+	if (n != NULL)
128+		*n = rsa->n;
129+	if (e != NULL)
130+		*e = rsa->e;
131+	if (d != NULL)
132+		*d = rsa->d;
133+}
134+
135+#endif  /* OPENSSL_VERSION_NUMBER < 0x10100000L */
136+
137+#endif  /* VBOOT_REFERENCE_OPENSSL_COMPAT_H_ */
138diff --git a/host/lib/util_misc.c b/host/lib/util_misc.c
139index 03ec683f..f0a1f7ad 100644
140--- a/host/lib/util_misc.c
141+++ b/host/lib/util_misc.c
142@@ -15,6 +15,7 @@
143
144 #include "cryptolib.h"
145 #include "host_common.h"
146+#include "openssl_compat.h"
147 #include "util_misc.h"
148 #include "vboot_common.h"
149
150@@ -58,6 +59,7 @@ int vb_keyb_from_rsa(struct rsa_st *rsa_private_key,
151 	BIGNUM *N0inv = NULL, *R = NULL, *RR = NULL;
152 	BIGNUM *RRTemp = NULL, *NnumBits = NULL;
153 	BIGNUM *n = NULL, *rr = NULL;
154+	const BIGNUM *rsa_private_key_n;
155 	BN_CTX *bn_ctx = BN_CTX_new();
156 	uint32_t n0invout;
157 	uint32_t bufsize;
158@@ -65,7 +67,7 @@ int vb_keyb_from_rsa(struct rsa_st *rsa_private_key,
159 	int retval = 1;
160
161 	/* Size of RSA key in 32-bit words */
162-	nwords = BN_num_bits(rsa_private_key->n) / 32;
163+	nwords = RSA_size(rsa_private_key) / 4;
164
165 	bufsize = (2 + nwords + nwords) * sizeof(uint32_t);
166 	outbuf = malloc(bufsize);
167@@ -94,7 +96,8 @@ int vb_keyb_from_rsa(struct rsa_st *rsa_private_key,
168 	NEW_BIGNUM(B);
169 #undef NEW_BIGNUM
170
171-	BN_copy(N, rsa_private_key->n);
172+	RSA_get0_key(rsa_private_key, &rsa_private_key_n, NULL, NULL);
173+	BN_copy(N, rsa_private_key_n);
174 	BN_set_word(Big1, 1L);
175 	BN_set_word(Big2, 2L);
176 	BN_set_word(Big32, 32L);
177diff --git a/host/lib21/host_key.c b/host/lib21/host_key.c
178index f7ea1622..f9419ad3 100644
179--- a/host/lib21/host_key.c
180+++ b/host/lib21/host_key.c
181@@ -17,6 +17,7 @@
182 #include "host_common.h"
183 #include "host_key2.h"
184 #include "host_misc.h"
185+#include "openssl_compat.h"
186
187 struct vb2_text_vs_enum vb2_text_vs_algorithm[] = {
188 	{"RSA1024 SHA1",   VB2_ALG_RSA1024_SHA1},
189@@ -544,7 +545,12 @@ int vb2_public_key_hash(struct vb2_public_key *key,
190
191 enum vb2_signature_algorithm vb2_rsa_sig_alg(struct rsa_st *rsa)
192 {
193-	int bits = BN_num_bits(rsa->n);
194+	const BIGNUM *e, *n;
195+	int exp, bits;
196+
197+	RSA_get0_key(rsa, &n, &e, NULL);
198+	exp = BN_get_word(e);
199+	bits = BN_num_bits(n);
200
201 	switch (bits) {
202 	case 1024:
203diff --git a/utility/dumpRSAPublicKey.c b/utility/dumpRSAPublicKey.c
204index b3b7b96b..a17b159e 100644
205--- a/utility/dumpRSAPublicKey.c
206+++ b/utility/dumpRSAPublicKey.c
207@@ -14,14 +14,20 @@
208 #include <string.h>
209 #include <unistd.h>
210
211+#include "openssl_compat.h"
212+
213 /* Command line tool to extract RSA public keys from X.509 certificates
214  * and output a pre-processed version of keys for use by RSA verification
215  * routines.
216  */
217
218 int check(RSA* key) {
219-  int public_exponent = BN_get_word(key->e);
220-  int modulus = BN_num_bits(key->n);
221+  const BIGNUM *n, *e;
222+  int public_exponent, modulus;
223+
224+  RSA_get0_key(key, &n, &e, NULL);
225+  public_exponent = BN_get_word(e);
226+  modulus = BN_num_bits(n);
227
228   if (public_exponent != 65537) {
229     fprintf(stderr, "WARNING: Public exponent should be 65537 (but is %d).\n",
230@@ -40,7 +46,8 @@ int check(RSA* key) {
231  */
232 void output(RSA* key) {
233   int i, nwords;
234-  BIGNUM *N = key->n;
235+  const BIGNUM *key_n;
236+  BIGNUM *N = NULL;
237   BIGNUM *Big1 = NULL, *Big2 = NULL, *Big32 = NULL, *BigMinus1 = NULL;
238   BIGNUM *B = NULL;
239   BIGNUM *N0inv= NULL, *R = NULL, *RR = NULL, *RRTemp = NULL, *NnumBits = NULL;
240@@ -48,14 +55,15 @@ void output(RSA* key) {
241   BN_CTX *bn_ctx = BN_CTX_new();
242   uint32_t n0invout;
243
244-  N = key->n;
245   /* Output size of RSA key in 32-bit words */
246-  nwords = BN_num_bits(N) / 32;
247+  nwords = RSA_size(key) / 4;
248   if (-1 == write(1, &nwords, sizeof(nwords)))
249     goto failure;
250
251
252   /* Initialize BIGNUMs */
253+  RSA_get0_key(key, &key_n, NULL, NULL);
254+  N = BN_dup(key_n);
255   Big1 = BN_new();
256   Big2 = BN_new();
257   Big32 = BN_new();
258@@ -120,6 +128,7 @@ void output(RSA* key) {
259
260 failure:
261   /* Free BIGNUMs. */
262+  BN_free(N);
263   BN_free(Big1);
264   BN_free(Big2);
265   BN_free(Big32);
266--
2672.14.1
268
269