rpms/libfido2
7
0
Fork 0
Code Issues Pull Requests Releases Activity

OpenSSL 3.0 compatibility

Browse Source 
Resolves: rhbz#1961051
This commit is contained in:
Dmitry Belyavskiy 2021-05-25 16:11:13 +02:00
parent 2f1efd6c25
commit 2cdeff6981
2 changed files with 222 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

217
libfido2-openssl30.patch Normal file
View File

@ -0,0 +1,217 @@
diff --git a/src/assert.c b/src/assert.c
index b4f9dd0..d0950a7 100644
--- a/src/assert.c
+++ b/src/assert.c
@@ -363,7 +363,11 @@ fido_get_signed_hash(int cose_alg, fido_blob_t *dgst,
unsigned char *authdata_ptr = NULL;
size_t authdata_len;
struct cbor_load_result cbor;
+#if OPENSSL_VERSION_NUMBER < 0x30000000
SHA256_CTX ctx;
+#else
+ EVP_MD_CTX *mdctx = NULL;
+#endif
int ok = -1;
if ((item = cbor_load(authdata_cbor->ptr, authdata_cbor->len,
@@ -377,10 +381,20 @@ fido_get_signed_hash(int cose_alg, fido_blob_t *dgst,
authdata_len = cbor_bytestring_length(item);
if (cose_alg != COSE_EDDSA) {
- if (dgst->len < SHA256_DIGEST_LENGTH || SHA256_Init(&ctx) == 0 ||
+ if (dgst->len < SHA256_DIGEST_LENGTH ||
+#if OPENSSL_VERSION_NUMBER < 0x30000000
+ SHA256_Init(&ctx) == 0 ||
SHA256_Update(&ctx, authdata_ptr, authdata_len) == 0 ||
SHA256_Update(&ctx, clientdata->ptr, clientdata->len) == 0 ||
- SHA256_Final(dgst->ptr, &ctx) == 0) {
+ SHA256_Final(dgst->ptr, &ctx) == 0
+#else
+ (mdctx = EVP_MD_CTX_new()) == NULL ||
+ EVP_DigestInit_ex(mdctx, EVP_sha256(), NULL) <= 0 ||
+ EVP_DigestUpdate(mdctx, authdata_ptr, authdata_len) <= 0 ||
+ EVP_DigestUpdate(mdctx, clientdata->ptr, clientdata->len) <= 0 ||
+ EVP_DigestFinal_ex(mdctx, dgst->ptr, NULL) <= 0
+#endif
+ ) {
fido_log_debug("%s: sha256", __func__);
goto fail;
}
@@ -406,6 +415,9 @@ fido_get_signed_hash(int cose_alg, fido_blob_t *dgst,
fail:
if (item != NULL)
cbor_decref(&item);
+#if OPENSSL_VERSION_NUMBER >= 0x30000000
+ EVP_MD_CTX_free(mdctx);
+#endif
return (ok);
}
@@ -410,7 +424,11 @@ fido_verify_sig_es256(const fido_blob_t *dgst, const es256_pk_t *pk,
const fido_blob_t *sig)
{
EVP_PKEY *pkey = NULL;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000
+ EVP_PKEY_CTX *pctx = NULL;
+#else
EC_KEY *ec = NULL;
+#endif
int ok = -1;
/* ECDSA_verify needs ints */
@@ -420,6 +438,20 @@ fido_verify_sig_es256(const fido_blob_t *dgst, const es256_pk_t *pk,
return (-1);
}
+#if OPENSSL_VERSION_NUMBER >= 0x30000000
+ if ((pkey = es256_pk_to_EVP_PKEY(pk)) == NULL ||
+ (pctx = EVP_PKEY_CTX_new(pkey, NULL)) == NULL) {
+ fido_log_debug("%s: pk -> ec", __func__);
+ goto fail;
+ }
+
+ if (EVP_PKEY_verify_init(pctx) != 1 ||
+ EVP_PKEY_verify(pctx, sig->ptr, sig->len,
+ dgst->ptr, dgst->len) != 1) {
+ fido_log_debug("%s: EVP_PKEY_verify", __func__);
+ goto fail;
+ }
+#else
if ((pkey = es256_pk_to_EVP_PKEY(pk)) == NULL ||
(ec = EVP_PKEY_get0_EC_KEY(pkey)) == NULL) {
fido_log_debug("%s: pk -> ec", __func__);
@@ -433,10 +465,13 @@ fido_verify_sig_es256(const fido_blob_t *dgst, const es256_pk_t *pk,
}
ok = 0;
+#endif
fail:
if (pkey != NULL)
EVP_PKEY_free(pkey);
-
+#if OPENSSL_VERSION_NUMBER >= 0x30000000
+ EVP_PKEY_CTX_free(pctx);
+#endif
return (ok);
}
@@ -445,7 +480,11 @@ fido_verify_sig_rs256(const fido_blob_t *dgst, const rs256_pk_t *pk,
const fido_blob_t *sig)
{
EVP_PKEY *pkey = NULL;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000
+ EVP_PKEY_CTX *pctx = NULL;
+#else
RSA *rsa = NULL;
+#endif
int ok = -1;
/* RSA_verify needs unsigned ints */
@@ -455,6 +494,22 @@ fido_verify_sig_rs256(const fido_blob_t *dgst, const rs256_pk_t *pk,
return (-1);
}
+#if OPENSSL_VERSION_NUMBER >= 0x30000000
+ if ((pkey = rs256_pk_to_EVP_PKEY(pk)) == NULL ||
+ (pctx = EVP_PKEY_CTX_new(pkey, NULL)) == NULL) {
+ fido_log_debug("%s: pk -> ec", __func__);
+ goto fail;
+ }
+
+ if (EVP_PKEY_verify_init(pctx) != 1 ||
+ EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PADDING) != 1 ||
+ EVP_PKEY_CTX_set_signature_md(pctx, EVP_sha256()) != 1 ||
+ EVP_PKEY_verify(pctx, sig->ptr, sig->len,
+ dgst->ptr, dgst->len) != 1) {
+ fido_log_debug("%s: EVP_PKEY_verify", __func__);
+ goto fail;
+ }
+#else
if ((pkey = rs256_pk_to_EVP_PKEY(pk)) == NULL ||
(rsa = EVP_PKEY_get0_RSA(pkey)) == NULL) {
fido_log_debug("%s: pk -> ec", __func__);
@@ -466,12 +521,16 @@ fido_verify_sig_rs256(const fido_blob_t *dgst, const rs256_pk_t *pk,
fido_log_debug("%s: RSA_verify", __func__);
goto fail;
}
+#endif
ok = 0;
fail:
if (pkey != NULL)
EVP_PKEY_free(pkey);
+#if OPENSSL_VERSION_NUMBER >= 0x30000000
+ EVP_PKEY_CTX_free(pctx);
+#endif
return (ok);
}
diff --git a/src/cred.c b/src/cred.c
index 92efde4..2ba1dd9 100644
--- a/src/cred.c
+++ b/src/cred.c
@@ -247,7 +247,11 @@ verify_sig(const fido_blob_t *dgst, const fido_blob_t *x5c,
BIO *rawcert = NULL;
X509 *cert = NULL;
EVP_PKEY *pkey = NULL;
- EC_KEY *ec;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000
+ EVP_PKEY_CTX *pctx = NULL;
+#else
+ EC_KEY *ec = NULL;
+#endif
int ok = -1;
/* openssl needs ints */
@@ -257,6 +261,22 @@ verify_sig(const fido_blob_t *dgst, const fido_blob_t *x5c,
return (-1);
}
+#if OPENSSL_VERSION_NUMBER >= 0x30000000
+ if ((rawcert = BIO_new_mem_buf(x5c->ptr, (int)x5c->len)) == NULL ||
+ (cert = d2i_X509_bio(rawcert, NULL)) == NULL ||
+ (pkey = X509_get_pubkey(cert)) == NULL ||
+ (pctx = EVP_PKEY_CTX_new(pkey, NULL)) == NULL) {
+ fido_log_debug("%s: x509 key", __func__);
+ goto fail;
+ }
+
+ if (EVP_PKEY_verify_init(pctx) != 1 ||
+ EVP_PKEY_verify(pctx, sig->ptr, sig->len,
+ dgst->ptr, dgst->len) != 1) {
+ fido_log_debug("%s: EVP_PKEY_verify", __func__);
+ goto fail;
+ }
+#else
/* fetch key from x509 */
if ((rawcert = BIO_new_mem_buf(x5c->ptr, (int)x5c->len)) == NULL ||
(cert = d2i_X509_bio(rawcert, NULL)) == NULL ||
@@ -271,6 +291,7 @@ verify_sig(const fido_blob_t *dgst, const fido_blob_t *x5c,
fido_log_debug("%s: ECDSA_verify", __func__);
goto fail;
}
+#endif
ok = 0;
fail:
@@ -280,6 +301,9 @@ fail:
X509_free(cert);
if (pkey != NULL)
EVP_PKEY_free(pkey);
+#if OPENSSL_VERSION_NUMBER >= 0x30000000
+ EVP_PKEY_CTX_free(pctx);
+#endif
return (ok);
}
--- libfido2-1.6.0/CMakeLists.txt.orig 2021-05-25 16:26:28.124822909 +0200
+++ libfido2-1.6.0/CMakeLists.txt 2021-05-25 16:27:08.492148194 +0200
@@ -152,6 +152,7 @@
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-stringop-overflow")
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -pedantic")
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -pedantic-errors")
+ set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-deprecated-declarations")
check_c_compiler_flag("-fstack-protector-all" HAVE_STACK_PROTECTOR_ALL)
if(HAVE_STACK_PROTECTOR_ALL)
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fstack-protector-all")

6
libfido2.spec
View File

@ -1,7 +1,7 @@
Name: libfido2
Version: 1.6.0
Release: 3%{?dist}
Release: 4%{?dist}
Summary: FIDO2 library
License: BSD
@ -12,6 +12,7 @@ Source2: yubico-release-gpgkeys.asc
# Work around false positive from gcc-11 until its fixed upstream
# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97631
Patch0002: %{name}-gcc11.patch
Patch0003: %{name}-openssl30.patch
BuildRequires: cmake
BuildRequires: hidapi-devel
@ -88,6 +89,9 @@ find %{buildroot} -type f -name "*.a" -delete -print
%changelog
* Tue May 25 2021 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1.6.0-4
- OpenSSL 3.0 compatibility. Related: rhbz#1961051
* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 1.6.0-3
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937