1From 2e730b2259c701f16d473dbfb7e58e86a6e71b01 Mon Sep 17 00:00:00 2001 2From: Daniel Kurtz <djkurtz@chromium.org> 3Date: Fri, 18 Jan 2019 13:04:59 +0200 4Subject: [PATCH] Update for openssl 1.1 5 6OpenSSL 1.1 has made significant non-backwards compatible changes to its 7API as outlined in: 8https://wiki.openssl.org/index.php/OpenSSL_1.1.0_Changes 9 10BRANCH=none 11BUG=chromium:738114 12TEST=cros_workon --host start vboot_reference 13TEST=w/ openssl-1.0.2k: sudo emerge vboot_reference 14TEST=w/ openssl-1.1.0e: sudo emerge vboot_reference 15 => both build ok 16 $ futility version 17 => command runs without error 18TEST=cros_workon --board=soraka start vboot_reference coreboot 19TEST=w/ openssl-1.0.2k: emerge-soraka vboot_reference coreboot 20TEST=w/ openssl-1.1.0e: emerge-soraka vboot_reference coreboot 21 => All build ok 22 23Change-Id: I37cfc8cbb04a092eab7b0b3224f475b82609447c 24Reviewed-on: https://chromium-review.googlesource.com/557739 25Commit-Ready: Daniel Kurtz <djkurtz@chromium.org> 26Tested-by: Daniel Kurtz <djkurtz@chromium.org> 27Reviewed-by: Randall Spangler <rspangler@chromium.org> 28Reviewed-by: Mike Frysinger <vapier@chromium.org> 29 30(cherry-picked from bce7904376beee2912932433a4634c1c25afe2f5) 31Signed-off-by: Vadim Kochan <vadim4j@gmail.com> 32--- 33 futility/cmd_create.c | 5 ++++- 34 futility/vb2_helper.c | 7 +++++-- 35 host/include/openssl_compat.h | 26 ++++++++++++++++++++++++++ 36 host/lib/util_misc.c | 7 +++++-- 37 host/lib21/host_key.c | 8 +++++++- 38 utility/dumpRSAPublicKey.c | 19 ++++++++++++++----- 39 6 files changed, 61 insertions(+), 11 deletions(-) 40 create mode 100644 host/include/openssl_compat.h 41 42diff --git a/futility/cmd_create.c b/futility/cmd_create.c 43index 143ea9ae..80d3fd90 100644 44--- a/futility/cmd_create.c 45+++ b/futility/cmd_create.c 46@@ -13,6 +13,7 @@ 47 #include "2common.h" 48 #include "2id.h" 49 #include "2rsa.h" 50+#include "openssl_compat.h" 51 #include "util_misc.h" 52 #include "vb2_common.h" 53 #include "vb2_struct.h" 54@@ -170,6 +171,7 @@ static int vb2_make_keypair() 55 enum vb2_signature_algorithm sig_alg; 56 uint8_t *pubkey_buf = 0; 57 int has_priv = 0; 58+ const BIGNUM *rsa_d; 59 60 FILE *fp; 61 int ret = 1; 62@@ -193,7 +195,8 @@ static int vb2_make_keypair() 63 goto done; 64 } 65 /* Public keys doesn't have the private exponent */ 66- has_priv = !!rsa_key->d; 67+ RSA_get0_key(rsa_key, NULL, NULL, &rsa_d); 68+ has_priv = !!rsa_d; 69 if (!has_priv) 70 fprintf(stderr, "%s has a public key only.\n", infile); 71 72diff --git a/futility/vb2_helper.c b/futility/vb2_helper.c 73index 51a78375..c6cc0fdd 100644 74--- a/futility/vb2_helper.c 75+++ b/futility/vb2_helper.c 76@@ -11,6 +11,7 @@ 77 #include "2common.h" 78 #include "2id.h" 79 #include "2rsa.h" 80+#include "openssl_compat.h" 81 #include "util_misc.h" 82 #include "vb2_common.h" 83 #include "vb2_struct.h" 84@@ -216,6 +217,7 @@ int ft_show_pem(const char *name, uint8_t *buf, uint32_t len, void *data) 85 uint8_t *keyb, *digest; 86 uint32_t keyb_len; 87 int i, bits; 88+ const BIGNUM *rsa_key_n, *rsa_key_d; 89 90 /* We're called only after ft_recognize_pem, so this should work. */ 91 rsa_key = rsa_from_buffer(buf, len); 92@@ -223,10 +225,11 @@ int ft_show_pem(const char *name, uint8_t *buf, uint32_t len, void *data) 93 DIE; 94 95 /* Use to presence of the private exponent to decide if it's public */ 96- printf("%s Key file: %s\n", rsa_key->d ? "Private" : "Public", 97+ RSA_get0_key(rsa_key, &rsa_key_n, NULL, &rsa_key_d); 98+ printf("%s Key file: %s\n", rsa_key_d ? "Private" : "Public", 99 name); 100 101- bits = BN_num_bits(rsa_key->n); 102+ bits = BN_num_bits(rsa_key_n); 103 printf(" Key length: %d\n", bits); 104 105 if (vb_keyb_from_rsa(rsa_key, &keyb, &keyb_len)) { 106diff --git a/host/include/openssl_compat.h b/host/include/openssl_compat.h 107new file mode 100644 108index 00000000..7771f32a 109--- /dev/null 110+++ b/host/include/openssl_compat.h 111@@ -0,0 +1,26 @@ 112+/* Copyright 2017 The Chromium OS Authors. All rights reserved. 113+ * Use of this source code is governed by a BSD-style license that can be 114+ * found in the LICENSE file. 115+ */ 116+ 117+#ifndef VBOOT_REFERENCE_OPENSSL_COMPAT_H_ 118+#define VBOOT_REFERENCE_OPENSSL_COMPAT_H_ 119+ 120+#include <openssl/rsa.h> 121+ 122+#if OPENSSL_VERSION_NUMBER < 0x10100000L 123+ 124+static inline void RSA_get0_key(const RSA *rsa, const BIGNUM **n, 125+ const BIGNUM **e, const BIGNUM **d) 126+{ 127+ if (n != NULL) 128+ *n = rsa->n; 129+ if (e != NULL) 130+ *e = rsa->e; 131+ if (d != NULL) 132+ *d = rsa->d; 133+} 134+ 135+#endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */ 136+ 137+#endif /* VBOOT_REFERENCE_OPENSSL_COMPAT_H_ */ 138diff --git a/host/lib/util_misc.c b/host/lib/util_misc.c 139index 03ec683f..f0a1f7ad 100644 140--- a/host/lib/util_misc.c 141+++ b/host/lib/util_misc.c 142@@ -15,6 +15,7 @@ 143 144 #include "cryptolib.h" 145 #include "host_common.h" 146+#include "openssl_compat.h" 147 #include "util_misc.h" 148 #include "vboot_common.h" 149 150@@ -58,6 +59,7 @@ int vb_keyb_from_rsa(struct rsa_st *rsa_private_key, 151 BIGNUM *N0inv = NULL, *R = NULL, *RR = NULL; 152 BIGNUM *RRTemp = NULL, *NnumBits = NULL; 153 BIGNUM *n = NULL, *rr = NULL; 154+ const BIGNUM *rsa_private_key_n; 155 BN_CTX *bn_ctx = BN_CTX_new(); 156 uint32_t n0invout; 157 uint32_t bufsize; 158@@ -65,7 +67,7 @@ int vb_keyb_from_rsa(struct rsa_st *rsa_private_key, 159 int retval = 1; 160 161 /* Size of RSA key in 32-bit words */ 162- nwords = BN_num_bits(rsa_private_key->n) / 32; 163+ nwords = RSA_size(rsa_private_key) / 4; 164 165 bufsize = (2 + nwords + nwords) * sizeof(uint32_t); 166 outbuf = malloc(bufsize); 167@@ -94,7 +96,8 @@ int vb_keyb_from_rsa(struct rsa_st *rsa_private_key, 168 NEW_BIGNUM(B); 169 #undef NEW_BIGNUM 170 171- BN_copy(N, rsa_private_key->n); 172+ RSA_get0_key(rsa_private_key, &rsa_private_key_n, NULL, NULL); 173+ BN_copy(N, rsa_private_key_n); 174 BN_set_word(Big1, 1L); 175 BN_set_word(Big2, 2L); 176 BN_set_word(Big32, 32L); 177diff --git a/host/lib21/host_key.c b/host/lib21/host_key.c 178index f7ea1622..f9419ad3 100644 179--- a/host/lib21/host_key.c 180+++ b/host/lib21/host_key.c 181@@ -17,6 +17,7 @@ 182 #include "host_common.h" 183 #include "host_key2.h" 184 #include "host_misc.h" 185+#include "openssl_compat.h" 186 187 struct vb2_text_vs_enum vb2_text_vs_algorithm[] = { 188 {"RSA1024 SHA1", VB2_ALG_RSA1024_SHA1}, 189@@ -544,7 +545,12 @@ int vb2_public_key_hash(struct vb2_public_key *key, 190 191 enum vb2_signature_algorithm vb2_rsa_sig_alg(struct rsa_st *rsa) 192 { 193- int bits = BN_num_bits(rsa->n); 194+ const BIGNUM *e, *n; 195+ int exp, bits; 196+ 197+ RSA_get0_key(rsa, &n, &e, NULL); 198+ exp = BN_get_word(e); 199+ bits = BN_num_bits(n); 200 201 switch (bits) { 202 case 1024: 203diff --git a/utility/dumpRSAPublicKey.c b/utility/dumpRSAPublicKey.c 204index b3b7b96b..a17b159e 100644 205--- a/utility/dumpRSAPublicKey.c 206+++ b/utility/dumpRSAPublicKey.c 207@@ -14,14 +14,20 @@ 208 #include <string.h> 209 #include <unistd.h> 210 211+#include "openssl_compat.h" 212+ 213 /* Command line tool to extract RSA public keys from X.509 certificates 214 * and output a pre-processed version of keys for use by RSA verification 215 * routines. 216 */ 217 218 int check(RSA* key) { 219- int public_exponent = BN_get_word(key->e); 220- int modulus = BN_num_bits(key->n); 221+ const BIGNUM *n, *e; 222+ int public_exponent, modulus; 223+ 224+ RSA_get0_key(key, &n, &e, NULL); 225+ public_exponent = BN_get_word(e); 226+ modulus = BN_num_bits(n); 227 228 if (public_exponent != 65537) { 229 fprintf(stderr, "WARNING: Public exponent should be 65537 (but is %d).\n", 230@@ -40,7 +46,8 @@ int check(RSA* key) { 231 */ 232 void output(RSA* key) { 233 int i, nwords; 234- BIGNUM *N = key->n; 235+ const BIGNUM *key_n; 236+ BIGNUM *N = NULL; 237 BIGNUM *Big1 = NULL, *Big2 = NULL, *Big32 = NULL, *BigMinus1 = NULL; 238 BIGNUM *B = NULL; 239 BIGNUM *N0inv= NULL, *R = NULL, *RR = NULL, *RRTemp = NULL, *NnumBits = NULL; 240@@ -48,14 +55,15 @@ void output(RSA* key) { 241 BN_CTX *bn_ctx = BN_CTX_new(); 242 uint32_t n0invout; 243 244- N = key->n; 245 /* Output size of RSA key in 32-bit words */ 246- nwords = BN_num_bits(N) / 32; 247+ nwords = RSA_size(key) / 4; 248 if (-1 == write(1, &nwords, sizeof(nwords))) 249 goto failure; 250 251 252 /* Initialize BIGNUMs */ 253+ RSA_get0_key(key, &key_n, NULL, NULL); 254+ N = BN_dup(key_n); 255 Big1 = BN_new(); 256 Big2 = BN_new(); 257 Big32 = BN_new(); 258@@ -120,6 +128,7 @@ void output(RSA* key) { 259 260 failure: 261 /* Free BIGNUMs. */ 262+ BN_free(N); 263 BN_free(Big1); 264 BN_free(Big2); 265 BN_free(Big32); 266-- 2672.14.1 268 269