From 2cdeff698147ba9ef57912896716620e03db77cb Mon Sep 17 00:00:00 2001 From: Dmitry Belyavskiy Date: Tue, 25 May 2021 16:11:13 +0200 Subject: [PATCH] OpenSSL 3.0 compatibility Resolves: rhbz#1961051 --- libfido2-openssl30.patch | 217 +++++++++++++++++++++++++++++++++++++++ libfido2.spec | 6 +- 2 files changed, 222 insertions(+), 1 deletion(-) create mode 100644 libfido2-openssl30.patch diff --git a/libfido2-openssl30.patch b/libfido2-openssl30.patch new file mode 100644 index 0000000..bc2a201 --- /dev/null +++ b/libfido2-openssl30.patch @@ -0,0 +1,217 @@ +diff --git a/src/assert.c b/src/assert.c +index b4f9dd0..d0950a7 100644 +--- a/src/assert.c ++++ b/src/assert.c +@@ -363,7 +363,11 @@ fido_get_signed_hash(int cose_alg, fido_blob_t *dgst, + unsigned char *authdata_ptr = NULL; + size_t authdata_len; + struct cbor_load_result cbor; ++#if OPENSSL_VERSION_NUMBER < 0x30000000 + SHA256_CTX ctx; ++#else ++ EVP_MD_CTX *mdctx = NULL; ++#endif + int ok = -1; + + if ((item = cbor_load(authdata_cbor->ptr, authdata_cbor->len, +@@ -377,10 +381,20 @@ fido_get_signed_hash(int cose_alg, fido_blob_t *dgst, + authdata_len = cbor_bytestring_length(item); + + if (cose_alg != COSE_EDDSA) { +- if (dgst->len < SHA256_DIGEST_LENGTH || SHA256_Init(&ctx) == 0 || ++ if (dgst->len < SHA256_DIGEST_LENGTH || ++#if OPENSSL_VERSION_NUMBER < 0x30000000 ++ SHA256_Init(&ctx) == 0 || + SHA256_Update(&ctx, authdata_ptr, authdata_len) == 0 || + SHA256_Update(&ctx, clientdata->ptr, clientdata->len) == 0 || +- SHA256_Final(dgst->ptr, &ctx) == 0) { ++ SHA256_Final(dgst->ptr, &ctx) == 0 ++#else ++ (mdctx = EVP_MD_CTX_new()) == NULL || ++ EVP_DigestInit_ex(mdctx, EVP_sha256(), NULL) <= 0 || ++ EVP_DigestUpdate(mdctx, authdata_ptr, authdata_len) <= 0 || ++ EVP_DigestUpdate(mdctx, clientdata->ptr, clientdata->len) <= 0 || ++ EVP_DigestFinal_ex(mdctx, dgst->ptr, NULL) <= 0 ++#endif ++ ) { + fido_log_debug("%s: sha256", __func__); + goto fail; + } +@@ -406,6 +415,9 @@ fido_get_signed_hash(int cose_alg, fido_blob_t *dgst, + fail: + if (item != NULL) + cbor_decref(&item); ++#if OPENSSL_VERSION_NUMBER >= 0x30000000 ++ EVP_MD_CTX_free(mdctx); ++#endif + + return (ok); + } +@@ -410,7 +424,11 @@ fido_verify_sig_es256(const fido_blob_t *dgst, const es256_pk_t *pk, + const fido_blob_t *sig) + { + EVP_PKEY *pkey = NULL; ++#if OPENSSL_VERSION_NUMBER >= 0x30000000 ++ EVP_PKEY_CTX *pctx = NULL; ++#else + EC_KEY *ec = NULL; ++#endif + int ok = -1; + + /* ECDSA_verify needs ints */ +@@ -420,6 +438,20 @@ fido_verify_sig_es256(const fido_blob_t *dgst, const es256_pk_t *pk, + return (-1); + } + ++#if OPENSSL_VERSION_NUMBER >= 0x30000000 ++ if ((pkey = es256_pk_to_EVP_PKEY(pk)) == NULL || ++ (pctx = EVP_PKEY_CTX_new(pkey, NULL)) == NULL) { ++ fido_log_debug("%s: pk -> ec", __func__); ++ goto fail; ++ } ++ ++ if (EVP_PKEY_verify_init(pctx) != 1 || ++ EVP_PKEY_verify(pctx, sig->ptr, sig->len, ++ dgst->ptr, dgst->len) != 1) { ++ fido_log_debug("%s: EVP_PKEY_verify", __func__); ++ goto fail; ++ } ++#else + if ((pkey = es256_pk_to_EVP_PKEY(pk)) == NULL || + (ec = EVP_PKEY_get0_EC_KEY(pkey)) == NULL) { + fido_log_debug("%s: pk -> ec", __func__); +@@ -433,10 +465,13 @@ fido_verify_sig_es256(const fido_blob_t *dgst, const es256_pk_t *pk, + } + + ok = 0; ++#endif + fail: + if (pkey != NULL) + EVP_PKEY_free(pkey); +- ++#if OPENSSL_VERSION_NUMBER >= 0x30000000 ++ EVP_PKEY_CTX_free(pctx); ++#endif + return (ok); + } + +@@ -445,7 +480,11 @@ fido_verify_sig_rs256(const fido_blob_t *dgst, const rs256_pk_t *pk, + const fido_blob_t *sig) + { + EVP_PKEY *pkey = NULL; ++#if OPENSSL_VERSION_NUMBER >= 0x30000000 ++ EVP_PKEY_CTX *pctx = NULL; ++#else + RSA *rsa = NULL; ++#endif + int ok = -1; + + /* RSA_verify needs unsigned ints */ +@@ -455,6 +494,22 @@ fido_verify_sig_rs256(const fido_blob_t *dgst, const rs256_pk_t *pk, + return (-1); + } + ++#if OPENSSL_VERSION_NUMBER >= 0x30000000 ++ if ((pkey = rs256_pk_to_EVP_PKEY(pk)) == NULL || ++ (pctx = EVP_PKEY_CTX_new(pkey, NULL)) == NULL) { ++ fido_log_debug("%s: pk -> ec", __func__); ++ goto fail; ++ } ++ ++ if (EVP_PKEY_verify_init(pctx) != 1 || ++ EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PADDING) != 1 || ++ EVP_PKEY_CTX_set_signature_md(pctx, EVP_sha256()) != 1 || ++ EVP_PKEY_verify(pctx, sig->ptr, sig->len, ++ dgst->ptr, dgst->len) != 1) { ++ fido_log_debug("%s: EVP_PKEY_verify", __func__); ++ goto fail; ++ } ++#else + if ((pkey = rs256_pk_to_EVP_PKEY(pk)) == NULL || + (rsa = EVP_PKEY_get0_RSA(pkey)) == NULL) { + fido_log_debug("%s: pk -> ec", __func__); +@@ -466,12 +521,16 @@ fido_verify_sig_rs256(const fido_blob_t *dgst, const rs256_pk_t *pk, + fido_log_debug("%s: RSA_verify", __func__); + goto fail; + } ++#endif + + ok = 0; + fail: + if (pkey != NULL) + EVP_PKEY_free(pkey); + ++#if OPENSSL_VERSION_NUMBER >= 0x30000000 ++ EVP_PKEY_CTX_free(pctx); ++#endif + return (ok); + } + +diff --git a/src/cred.c b/src/cred.c +index 92efde4..2ba1dd9 100644 +--- a/src/cred.c ++++ b/src/cred.c +@@ -247,7 +247,11 @@ verify_sig(const fido_blob_t *dgst, const fido_blob_t *x5c, + BIO *rawcert = NULL; + X509 *cert = NULL; + EVP_PKEY *pkey = NULL; +- EC_KEY *ec; ++#if OPENSSL_VERSION_NUMBER >= 0x30000000 ++ EVP_PKEY_CTX *pctx = NULL; ++#else ++ EC_KEY *ec = NULL; ++#endif + int ok = -1; + + /* openssl needs ints */ +@@ -257,6 +261,22 @@ verify_sig(const fido_blob_t *dgst, const fido_blob_t *x5c, + return (-1); + } + ++#if OPENSSL_VERSION_NUMBER >= 0x30000000 ++ if ((rawcert = BIO_new_mem_buf(x5c->ptr, (int)x5c->len)) == NULL || ++ (cert = d2i_X509_bio(rawcert, NULL)) == NULL || ++ (pkey = X509_get_pubkey(cert)) == NULL || ++ (pctx = EVP_PKEY_CTX_new(pkey, NULL)) == NULL) { ++ fido_log_debug("%s: x509 key", __func__); ++ goto fail; ++ } ++ ++ if (EVP_PKEY_verify_init(pctx) != 1 || ++ EVP_PKEY_verify(pctx, sig->ptr, sig->len, ++ dgst->ptr, dgst->len) != 1) { ++ fido_log_debug("%s: EVP_PKEY_verify", __func__); ++ goto fail; ++ } ++#else + /* fetch key from x509 */ + if ((rawcert = BIO_new_mem_buf(x5c->ptr, (int)x5c->len)) == NULL || + (cert = d2i_X509_bio(rawcert, NULL)) == NULL || +@@ -271,6 +291,7 @@ verify_sig(const fido_blob_t *dgst, const fido_blob_t *x5c, + fido_log_debug("%s: ECDSA_verify", __func__); + goto fail; + } ++#endif + + ok = 0; + fail: +@@ -280,6 +301,9 @@ fail: + X509_free(cert); + if (pkey != NULL) + EVP_PKEY_free(pkey); ++#if OPENSSL_VERSION_NUMBER >= 0x30000000 ++ EVP_PKEY_CTX_free(pctx); ++#endif + + return (ok); + } +--- libfido2-1.6.0/CMakeLists.txt.orig 2021-05-25 16:26:28.124822909 +0200 ++++ libfido2-1.6.0/CMakeLists.txt 2021-05-25 16:27:08.492148194 +0200 +@@ -152,6 +152,7 @@ + set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-stringop-overflow") + set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -pedantic") + set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -pedantic-errors") ++ set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-deprecated-declarations") + check_c_compiler_flag("-fstack-protector-all" HAVE_STACK_PROTECTOR_ALL) + if(HAVE_STACK_PROTECTOR_ALL) + set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fstack-protector-all") diff --git a/libfido2.spec b/libfido2.spec index 9fbeb6c..afff2e2 100644 --- a/libfido2.spec +++ b/libfido2.spec @@ -1,7 +1,7 @@ Name: libfido2 Version: 1.6.0 -Release: 3%{?dist} +Release: 4%{?dist} Summary: FIDO2 library License: BSD @@ -12,6 +12,7 @@ Source2: yubico-release-gpgkeys.asc # Work around false positive from gcc-11 until its fixed upstream # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97631 Patch0002: %{name}-gcc11.patch +Patch0003: %{name}-openssl30.patch BuildRequires: cmake BuildRequires: hidapi-devel @@ -88,6 +89,9 @@ find %{buildroot} -type f -name "*.a" -delete -print %changelog +* Tue May 25 2021 Dmitry Belyavskiy - 1.6.0-4 +- OpenSSL 3.0 compatibility. Related: rhbz#1961051 + * Fri Apr 16 2021 Mohan Boddu - 1.6.0-3 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937