bacula/bacula-9.0.6-use-crypto-from-openssl.patch

Author: Vaclav Dolezal <vdolezal@redhat.com>
Date:   Mon Aug 12 14:51:39 2019 +0200

    Use functions from OpenSSL for HMAC, MD5 and random bytes

diff --git a/bacula/src/dird/dird_conf.c b/bacula/src/dird/dird_conf.c
index 02fae0bab..dff241356 100644
--- a/bacula/src/dird/dird_conf.c
+++ b/bacula/src/dird/dird_conf.c
@@ -42,6 +42,10 @@
 #include "bacula.h"
 #include "dird.h"
 
+#if HAVE_OPENSSL
+# include <openssl/evp.h>
+#endif
+
 /* Define the first and last resource ID record
  * types. Note, these should be unique for each
  * daemon though not a requirement.
@@ -1645,6 +1649,11 @@ void free_resource(RES *rres, int type)
          free(res->res_fs.exclude_items);
       }
       res->res_fs.num_excludes = 0;
+#if HAVE_OPENSSL
+      EVP_MD_CTX_free(res->res_fs.md5c);
+      res->res_fs.md5c = NULL;
+      res->res_fs.have_MD5 = false;
+#endif
       break;
    case R_POOL:
       if (res->res_pool.pool_type) {
diff --git a/bacula/src/dird/dird_conf.h b/bacula/src/dird/dird_conf.h
index 5174a7a14..4e910c5bd 100644
--- a/bacula/src/dird/dird_conf.h
+++ b/bacula/src/dird/dird_conf.h
@@ -24,6 +24,10 @@
 
 /* NOTE:  #includes at the end of this file */
 
+#if HAVE_OPENSSL
+# include <openssl/evp.h>
+#endif
+
 /*
  * Resource codes -- they must be sequential for indexing
  */
@@ -591,7 +595,11 @@ public:
    INCEXE **exclude_items;
    int32_t num_excludes;
    bool have_MD5;                     /* set if MD5 initialized */
+#if HAVE_OPENSSL
+   EVP_MD_CTX *md5c;                  /* MD5 of include/exclude */
+#else
    struct MD5Context md5c;            /* MD5 of include/exclude */
+#endif
    char MD5[30];                      /* base 64 representation of MD5 */
    bool ignore_fs_changes;            /* Don't force Full if FS changed */
    bool enable_vss;                   /* Enable Volume Shadow Copy */
diff --git a/bacula/src/dird/inc_conf.c b/bacula/src/dird/inc_conf.c
index 3f4fbf55e..64b422242 100644
--- a/bacula/src/dird/inc_conf.c
+++ b/bacula/src/dird/inc_conf.c
@@ -32,6 +32,10 @@
 #include <regex.h>
 #endif
 
+#if HAVE_OPENSSL
+# include <openssl/evp.h>
+#endif
+
 /* Forward referenced subroutines */
 
 void store_inc(LEX *lc, RES_ITEM *item, int index, int pass);
@@ -354,7 +358,17 @@ static void store_newinc(LEX *lc, RES_ITEM *item, int index, int pass)
    bool options;
 
    if (!res_all.res_fs.have_MD5) {
+#if HAVE_OPENSSL
+      res_all.res_fs.md5c = EVP_MD_CTX_new();
+      if (!res_all.res_fs.md5c
+         || !EVP_DigestInit_ex(res_all.res_fs.md5c, EVP_md5(), NULL)
+      ) {
+         Emsg1(M_ERROR_TERM, 0, "MD5 computation failed: %s\n",
+               ERR_reason_error_string(ERR_peek_last_error()));
+      }
+#else
       MD5Init(&res_all.res_fs.md5c);
+#endif
       res_all.res_fs.have_MD5 = true;
    }
    memset(&res_incexe, 0, sizeof(INCEXE));
@@ -620,7 +634,13 @@ static void store_fname(LEX *lc, RES_ITEM2 *item, int index, int pass, bool excl
          }
       case T_QUOTED_STRING:
          if (res_all.res_fs.have_MD5) {
+#if HAVE_OPENSSL
+            if (!EVP_DigestUpdate(res_all.res_fs.md5c, (void *)lc->str, (size_t) lc->str_len))
+               Emsg1(M_ERROR_TERM, 0, "MD5 computation failed: %s\n",
+                     ERR_reason_error_string(ERR_peek_last_error()));
+#else
             MD5Update(&res_all.res_fs.md5c, (unsigned char *)lc->str, lc->str_len);
+#endif
          }
          incexe = &res_incexe;
          if (incexe->name_list.size() == 0) {
@@ -663,7 +683,13 @@ static void store_plugin_name(LEX *lc, RES_ITEM2 *item, int index, int pass, boo
          }
       case T_QUOTED_STRING:
          if (res_all.res_fs.have_MD5) {
+#if HAVE_OPENSSL
+            if (!EVP_DigestUpdate(res_all.res_fs.md5c, (void *)lc->str, (size_t) lc->str_len))
+               Emsg1(M_ERROR_TERM, 0, "MD5 computation failed: %s\n",
+                     ERR_reason_error_string(ERR_peek_last_error()));
+#else
             MD5Update(&res_all.res_fs.md5c, (unsigned char *)lc->str, lc->str_len);
+#endif
          }
          incexe = &res_incexe;
          if (incexe->plugin_list.size() == 0) {
diff --git a/bacula/src/dird/job.c b/bacula/src/dird/job.c
index b5b39c7d5..7d69f0157 100644
--- a/bacula/src/dird/job.c
+++ b/bacula/src/dird/job.c
@@ -25,6 +25,10 @@
 #include "bacula.h"
 #include "dird.h"
 
+#if HAVE_OPENSSL
+# include <openssl/evp.h>
+#endif
+
 /* Forward referenced subroutines */
 static void *job_thread(void *arg);
 static void job_monitor_watchdog(watchdog_t *self);
@@ -1308,10 +1312,27 @@ bool get_or_create_fileset_record(JCR *jcr)
    memset(&fsr, 0, sizeof(FILESET_DBR));
    bstrncpy(fsr.FileSet, jcr->fileset->hdr.name, sizeof(fsr.FileSet));
    if (jcr->fileset->have_MD5) {
+#if HAVE_OPENSSL
+      EVP_MD_CTX *mdctx = EVP_MD_CTX_new();
+      if (!mdctx)
+         Emsg1(M_ERROR_TERM, 0, "MD5 computation failed: %s\n",
+               ERR_reason_error_string(ERR_peek_last_error()));
+#else
       struct MD5Context md5c;
+#endif
       unsigned char digest[MD5HashSize];
+#if HAVE_OPENSSL
+      if (!EVP_MD_CTX_copy_ex(mdctx, jcr->fileset->md5c)
+         || !EVP_DigestFinal_ex(mdctx, digest, NULL)
+      ) {
+         Emsg1(M_ERROR_TERM, 0, "MD5 computation failed: %s\n",
+               ERR_reason_error_string(ERR_peek_last_error()));
+      }
+      EVP_MD_CTX_free(mdctx);
+#else
       memcpy(&md5c, &jcr->fileset->md5c, sizeof(md5c));
       MD5Final(digest, &md5c);
+#endif
       /*
        * Keep the flag (last arg) set to false otherwise old FileSets will
        * get new MD5 sums and the user will get Full backups on everything
diff --git a/bacula/src/lib/hmac.c b/bacula/src/lib/hmac.c
index a8d5e3dc0..dc3b78383 100644
--- a/bacula/src/lib/hmac.c
+++ b/bacula/src/lib/hmac.c
@@ -26,6 +26,10 @@
  */
 #include "bacula.h"
 
+#if HAVE_OPENSSL
+# include <openssl/hmac.h>
+#endif
+
 #define PAD_LEN 64           /* PAD length */
 #define SIG_LEN MD5HashSize  /* MD5 digest length */
 
@@ -36,6 +40,19 @@ hmac_md5(
     uint8_t*  key,             /* pointer to authentication key */
     int   key_len,             /* length of authentication key */
     uint8_t  *hmac)            /* returned hmac-md5 */
+#if HAVE_OPENSSL
+{
+    if (!HMAC(
+        EVP_md5(),
+        key, key_len,
+        text, text_len,
+        hmac, NULL
+    )) {
+        Emsg0(M_ERROR_TERM, 0, "HMAC computation failed\n");
+    }
+
+}
+#else
 {
    MD5Context md5c;
    uint8_t k_ipad[PAD_LEN];    /* inner padding - key XORd with ipad */
@@ -90,6 +107,7 @@ hmac_md5(
    MD5Update(&md5c, hmac, SIG_LEN);   /* hash inner hash */
    MD5Final(hmac, &md5c);             /* store results */
 }
+#endif
 /*
 Test Vectors (Trailing '\0' of a character string not included in test):
 
diff --git a/bacula/src/lib/parse_conf.c b/bacula/src/lib/parse_conf.c
index cb3573fbd..3f3f93fdc 100644
--- a/bacula/src/lib/parse_conf.c
+++ b/bacula/src/lib/parse_conf.c
@@ -59,6 +59,10 @@
 #define MAX_PATH  1024
 #endif
 
+#if HAVE_OPENSSL
+# include <openssl/evp.h>
+#endif
+
 /*
  * Define the Union of all the common resource structure definitions.
  */
@@ -538,7 +542,11 @@ void store_dir(LEX *lc, RES_ITEM *item, int index, int pass)
 void store_password(LEX *lc, RES_ITEM *item, int index, int pass)
 {
    unsigned int i, j;
+#if HAVE_OPENSSL
+   EVP_MD_CTX *mdctx = NULL;
+#else
    struct MD5Context md5c;
+#endif
    unsigned char digest[CRYPTO_DIGEST_MD5_SIZE];
    char sig[100];
 
@@ -548,9 +556,21 @@ void store_password(LEX *lc, RES_ITEM *item, int index, int pass)
    } else {
       lex_get_token(lc, T_STRING);
       if (pass == 1) {
+#if HAVE_OPENSSL
+         mdctx = EVP_MD_CTX_new();
+         if (!mdctx
+            || !EVP_DigestInit_ex(mdctx, EVP_md5(), NULL)
+            || !EVP_DigestUpdate(mdctx, (const void *) lc->str, (size_t) lc->str_len)
+            || !EVP_DigestFinal_ex(mdctx, digest, NULL)
+         ) {
+            Emsg1(M_ERROR_TERM, 0, "MD5 computation failed: %s\n",
+                  ERR_reason_error_string(ERR_peek_last_error()));
+         }
+#else
          MD5Init(&md5c);
          MD5Update(&md5c, (unsigned char *) (lc->str), lc->str_len);
          MD5Final(digest, &md5c);
+#endif
          for (i = j = 0; i < sizeof(digest); i++) {
             sprintf(&sig[j], "%02x", digest[i]);
             j += 2;
diff --git a/bacula/src/lib/util.c b/bacula/src/lib/util.c
index 2c425aa4c..e82b907d8 100644
--- a/bacula/src/lib/util.c
+++ b/bacula/src/lib/util.c
@@ -707,6 +707,35 @@ int do_shell_expansion(char *name, int name_len)
     from SpeakFreely by John Walker */
 
 void make_session_key(char *key, char *seed, int mode)
+#if HAVE_OPENSSL
+{
+   int j, k;
+   unsigned char buf[16];
+
+   (void) seed;
+
+   if (!RAND_bytes(buf, sizeof(buf)))
+       Emsg1(M_ERROR_TERM, 0, "Random bytes generation failed: %s\n",
+             ERR_reason_error_string(ERR_peek_last_error()));
+
+   if (mode) {
+     for (j = k = 0; j < 16; j++) {
+        unsigned char rb = buf[j];
+
+#define Rad16(x) ((x) + 'A')
+        key[k++] = Rad16((rb >> 4) & 0xF);
+        key[k++] = Rad16(rb & 0xF);
+#undef Rad16
+        if (j & 1) {
+           key[k++] = '-';
+        }
+     }
+     key[--k] = 0;
+   } else {
+      memcpy(key, buf, sizeof(buf));
+   }
+}
+#else
 {
    int j, k;
    struct MD5Context md5c;
@@ -790,6 +819,7 @@ void make_session_key(char *key, char *seed, int mode)
    }
 }
 #undef nextrand
+#endif
 
 void encode_session_key(char *encode, char *session, char *key, int maxlen)
 {