summaryrefslogtreecommitdiff
path: root/openssl.c (follow)
Commit message (Collapse)AuthorAge
* Switch to SPDX identifiers.Andre Noll2026-03-17
| | | | | | | | Generated with sed -i 's|Copyright.*Andre Noll.*|SPDX-License-Identifier: GPL-2.0 */|g' *.c *.h followed by manually tweaking the result a bit. No license change intended.
* Merge topic branch t/rm_pem into masterAndre Noll2026-02-25
|\ | | | | | | | | | | | | | | | | | | Remove support for PEM keys A single patch which removes support for old style PEM keys. The old key format has been deprecated since paraslash-0.7.3, released in March 2024. * refs/heads/t/rm_pem: Remove support for PEM private keys.
| * Remove support for PEM private keys.Andre Noll2026-01-28
| | | | | | | | | | This gets us rid of a couple of hand-written parsers, which can only be a good thing. The shortstat says it all...
* | Remove support for openssl-1.0.Andre Noll2026-01-29
|/ | | | | | This simplifies configure.ac because we can now get rid of the NO_OPENSSL_THREAD_STOP and RSA_set0_key defines. openssl-1.1 is still supported.
* build: Rename two openssl related #defines.Andre Noll2025-10-27
| | | | | | | | | | | | | | | | | | | | | | openssl-1.1 and later have OPENSSL_thread_stop() and RSA_set0_key(). We plan to drop support for openssl-1.0 so that we can get rid of the autoconf checks which create the preprocessor macros HAVE_OPENSSL_THREAD_STOP and HAVE_RSA_SET0_KEY that indicate whether these functions exist. In fact, there is already a commit in a (currently experimental) git branch which removes the checks. Running autoconf on this branch, then switching to a different branch, then running make(1) fails on systems with openssl-1.1 or later because the macros are undefined, hence openssl-1.0 is assumed. This is only an inconvenience and no bug, because the user is supposed to re-run ./autogen.sh after switching to a different revision if the checkout modifies autoconf related files such as configure.ac. However, inverting the semantics of those macros, as implemented in this commit, is simple enough and works around this inconvenience nicely. On openssl-1.1 or later the new NO_OPENSSL_THREAD_STOP and NO_RSA_SET0_KEY variables will be unset regardless of the branch that was checked out when autoconf was run. So let's merge this early, it'll save pain, time and energy.
* Merge topic branch t/rm_sha1 into masterAndre Noll2025-09-22
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The series first drops the para_upgrade_db executable because it is no longer needed. This removes the penultimate user of the sha1 infrastructure. The remaining commits deal with the last user: the handshake between para_client and para_server. Since paraslash-0.7.0, client and server employ sha256 by default, but fall back to sha1 in order to stay compatible to old 0.6.x versions. After this series, server and client always employ sha256 as the hash algorithm, breaking compatibility with 0.6.x clients. As a result, the sha1 hash algorithm is no longer used anywhere, so the corresponding infrastructure is no longer needed. This gets rid of a fair amount of code. * refs/heads/t/rm_sha1: Rename hash2 -> hash. Remove sha1. Remove para_upgrade_db. aft: Compare the full hash, not just the first 20 bytes.
| * Rename hash2 -> hash.Andre Noll2025-05-22
| | | | | | | | | | Now that sha1 is no longer supported, the hash2 naming has become meaningless. Rename it back to "hash".
| * Remove sha1.Andre Noll2025-05-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Server and client prefer sha256 in the authentication protocol since paraslash-0.7.0, while 0.6.x clients and servers only know about sha1. This patch drops the compatibility code which enabled old clients to connect to new servers and vice versa. Now the client code no longer checks whether the sha256 feature is supported, but requests and uses the feature unconditionally. The server still announces the sha256 feature and accepts the corresponding feature request, but uses sha256 unconditionally. With this approach older 0.7.x clients are still compatible to current server versions and current clients can still talk to servers running older 0.7.x versions.
* | openssl: Fix a memory leak.Andre Noll2025-08-07
|/ | | | | | This leak happens only with openssl-1.1, where we call RSA_free() which does not free the coefficient for the Chinese remainder theorem we extracted from the key file.
* Include regex.h from para.h.Andre Noll2025-05-19
| | | | Every .c file includes it anyway.
* Merge topic branch t/openssl-3 into masterAndre Noll2024-09-17
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The series starts with a few cleanups and crypto-backend tweaks to beat the openssl specific code into shape for the main objective: the switch of the RSA encryption and decryption routines to the high-level EVP API. This has become necessary because the old RSA API functions have been deprecated in openssl-3. This merge conflicted against commit a18458cff51c (No longer check for CRYPTO_cleanup_all_ex_data()). The resolution is to remove the checks which that commit removed and to add the checks which commit 0485079436ad (openssl: Use the EVP library for RSA public encryption) of this series introduced. Cooking for four months. * refs/heads/t/openssl-3: openssl: Reactivate openssl warnings. openssl: Use the EVP library for RSA private decryption. openssl: Use the EVP library for RSA public encryption. apc_priv_decrypt: Let the callee allocate the buffer. apc_pub_encrypt: Let the callee allocate the buffer. openssl: Assume that openssl allocation functions functions succeed. openssl: Introduce openssl_perror(). openssl: Don't pass pointers to RSA structures around. openssl: Kill rsa coefficient computations. client: Check buffer size returned by apc_priv_decrypt().
| * openssl: Use the EVP library for RSA private decryption.Andre Noll2024-05-17
| | | | | | | | | | | | This is the counterpart of the previous commit which converted the public RSA encryption. We employ the HAVE_OSSL_PARAM macro again to distinguish between the openssl-1 and openssl-3 cases.
| * openssl: Use the EVP library for RSA public encryption.Andre Noll2024-05-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Many functions related to RSA have been deprecated in openssl-3. Users of the deprecated API are expected to switch to the high-level cryptographic functions of the EVP library which ships together with openssl. Since openssl-1.0 is still supported and even openssl-1.1 lacks some of the features we need for EVP, for example OSSL_PARAM_construct_BN(), we check for this symbol at configure time and use #ifdefs in openssl.c to compile the code conditionally depending on the value of the new HAVE_OSSL_PARAM preprocessor macro. The code should work with both old and new openssl versions. apc_get_pubkey() used to call RSA_size() to obtain the key size in bytes for the return value, but RSA_size() is one of the functions that got deprecated in openssl-3. So modify read_public_key() to return the number of bits of the modulus (rather than the constant one), and use 1/8 of this number as the return value.
| * apc_priv_decrypt: Let the callee allocate the buffer.Andre Noll2024-05-17
| | | | | | | | | | | | | | This complements the previous commit which made the analogous change for public encryption. Passing char ** instead of char * to apc_priv_decrypt() allows us to get rid of the magic 1024 constant in client_common.c.
| * apc_pub_encrypt: Let the callee allocate the buffer.Andre Noll2024-05-17
| | | | | | | | | | | | | | | | | | | | Change the encryption routine of the apc API to allocate a suitably sized buffer itself. Currently, the caller has to guess the size of the buffer to pass to the function and we reuse our 4k handshake buffer for that. While 4k is is plenty at the moment, that may change, and it's always better to use the exact size if it is readily available. This is the case here because the required buffer size is just the number of bits of the modulus of the key.
| * openssl: Assume that openssl allocation functions functions succeed.Andre Noll2024-05-17
| | | | | | | | | | | | | | We do the same thing with malloc() and friends, so replace error checking by assertions whenever OOM is the only possible error reason. Also add assertions for EVP_MD_CTX_new(), whose return value was not checked at all.
| * openssl: Introduce openssl_perror().Andre Noll2024-05-17
| | | | | | | | | | | | | | | | | | | | | | Openssl has a decent error reporting framework, but we only employ it if get_random_bytes_or_die() fails. This patch abstracts out a new helper which prints the error string of the earliest error code from the thread's error queue. We make the helper return -E_OPENSSL unconditionally as this simplifies callers a bit. Only get_random_bytes_or_die() calls the new helper for now but additional callers will be added in subsequent commits.
| * openssl: Don't pass pointers to RSA structures around.Andre Noll2024-05-17
| | | | | | | | | | | | The RSA structure has been made opaque in openssl-3. As a preparation for not using this structure any more, pass pointers to the containing asymmetric key structure instead.
| * openssl: Kill rsa coefficient computations.Andre Noll2024-05-17
| | | | | | | | | | There's no need to pre-compute the two exponents for the Chinese Remainder Theorem calculations as openssl will do that for us.
* | build: No longer check for CRYPTO_cleanup_all_ex_data().Andre Noll2024-03-17
|/ | | | | | | Recent openssl versions no longer declare this unless the openssl API compatibility version is set explicitly, in which case it gets defined as a macro which does nothing. Either way, the check in configure.ac and the call in openssl.c can go away.
* openssl: Assign bignums in canonical order.Andre Noll2023-05-15
| | | | | | The order of the bignums stored in the private key is n, e, d, iqmp, p, q. We read the bignums in this order, so assign the members of the RSA structure in the same order. This does not really matter, but still..
* openssl: Unify naming of public key structures.Andre Noll2023-05-15
| | | | | | The pointers to private key structures are all called "priv", but for their public counterparts we often use "key" rather than "pub". Fix that to improve readability.
* openssl: Rename read_private_rsa_params() -> read_openssh_private_key().Andre Noll2023-05-15
| | | | | The new name encodes the format of the key in the function name just like the counterpart read_pem_private_key() does.
* openssl: Rename read_rsa_bignums() -> read_public_key().Andre Noll2023-05-15
| | | | This makes clear that the function is only used for public encryption.
* openssl: Dedox crypt_init().Andre Noll2023-05-15
| | | | | | The API of this function is documented in crypt.h while the comment in openssl.c describes openssl specific implementation details which do not need doxygen annotations.
* openssl: Switch to evp API for sha1 and sha256.Andre Noll2022-10-29
| | | | | This is easy to do and gets rid of some warnings about depreciated APIs (which got deactivated in the previous commit, but still).
* string: Rename para_malloc() -> alloc().Andre Noll2022-07-29
| | | | | | | Just because it's shorter and matches the naming of the new allocators we are about to introduce. The bulk of this patch was created with sed -i 's/para_malloc/alloc/g' *.c *.h yy/mp.y
* Introduce hash2 (sha256).Andre Noll2021-10-21
| | | | | | This adds a second hash function which will replace sha1. Both openssl and libgcrypt support sha256, so it is easy to do. There are no users of the new functions so far, so this patch has no effect yet.
* openssl: Fix (harmless) memory leaks at exit.Andre Noll2020-02-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Without this, valgrind --leak-check=full --show-leak-kinds=all complains about four memory blocks reachable at exit, see below. The first leak is fixed by the new call to ERR_remove_thread_state(), which frees the error queue of the current thread. To squash the other three, the call to EVP_cleanup() is needed to remove all of openssl's internal ciphers and digests. To make this work on both openssl-1.0 and for openssl-1.1, we need to add additional header checks for configure. --- ==2818== 12 bytes in 1 blocks are still reachable in loss record 1 of 4 ==2818== at 0x40355EE: malloc (vg_replace_malloc.c:309) ==2818== by 0x41B887C: CRYPTO_malloc (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x42459B7: lh_insert (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x4248542: int_thread_set_item (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x4249920: ERR_get_state (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x424A255: ERR_put_error (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x4222EF6: RSA_padding_check_PKCS1_OAEP_mgf1 (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x422306A: RSA_padding_check_PKCS1_OAEP (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x421F921: RSA_eay_private_decrypt (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x804F2E9: apc_priv_decrypt (openssl.c:206) ==2818== by 0x804DB59: client_post_select (client_common.c:321) ==2818== by 0x804CC57: call_post_select (sched.c:80) ==2818== by 0x804CC57: sched_post_select (sched.c:106) ==2818== by 0x804CC57: schedule (sched.c:159) ==2818== ==2818== 64 bytes in 1 blocks are still reachable in loss record 2 of 4 ==2818== at 0x40355EE: malloc (vg_replace_malloc.c:309) ==2818== by 0x41B887C: CRYPTO_malloc (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x4245643: lh_new (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x424811F: int_thread_get (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x4248511: int_thread_set_item (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x4249920: ERR_get_state (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x424A255: ERR_put_error (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x4222EF6: RSA_padding_check_PKCS1_OAEP_mgf1 (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x422306A: RSA_padding_check_PKCS1_OAEP (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x421F921: RSA_eay_private_decrypt (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x804F2E9: apc_priv_decrypt (openssl.c:206) ==2818== by 0x804DB59: client_post_select (client_common.c:321) ==2818== ==2818== 96 bytes in 1 blocks are still reachable in loss record 3 of 4 ==2818== at 0x40355EE: malloc (vg_replace_malloc.c:309) ==2818== by 0x41B887C: CRYPTO_malloc (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x4245628: lh_new (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x424811F: int_thread_get (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x4248511: int_thread_set_item (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x4249920: ERR_get_state (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x424A255: ERR_put_error (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x4222EF6: RSA_padding_check_PKCS1_OAEP_mgf1 (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x422306A: RSA_padding_check_PKCS1_OAEP (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x421F921: RSA_eay_private_decrypt (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x804F2E9: apc_priv_decrypt (openssl.c:206) ==2818== by 0x804DB59: client_post_select (client_common.c:321) ==2818== ==2818== 400 bytes in 1 blocks are still reachable in loss record 4 of 4 ==2818== at 0x40355EE: malloc (vg_replace_malloc.c:309) ==2818== by 0x41B887C: CRYPTO_malloc (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x424988C: ERR_get_state (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x424A255: ERR_put_error (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x4222EF6: RSA_padding_check_PKCS1_OAEP_mgf1 (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x422306A: RSA_padding_check_PKCS1_OAEP (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x421F921: RSA_eay_private_decrypt (in /usr/local/lib/libcrypto.so.1.0.0) ==2818== by 0x804F2E9: apc_priv_decrypt (openssl.c:206) ==2818== by 0x804DB59: client_post_select (client_common.c:321) ==2818== by 0x804CC57: call_post_select (sched.c:80) ==2818== by 0x804CC57: sched_post_select (sched.c:106) ==2818== by 0x804CC57: schedule (sched.c:159) ==2818== by 0x804AB2D: main (client.c:656)
* Merge branch 'refs/heads/t/ssh'Andre Noll2019-11-23
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A medium sized series which teaches both crypto backends about the RFC4716 key format, which has become the default for ssh-keygen as of openssh-7.8. Was cooking for almost a year. * refs/heads/t/ssh: manual: Instruct the user to create RFC4716 keys. openssl: Add support for RFC4716 keys openssl: Move get_private_key() down. gcrypt: Add support for RFC4716 private keys. crypt: Rename decoding functions. gcrypt: Introduce read_openssh_bignum(). gcrypt: Factor out read_pem_rsa_params(). gcrypt: Let read_bignum() return bits, not bytes. gcrypt: Let decode_key() return blob size through additional argument. gcrypt: Drop unnecessary arguments of decode_key().
| * openssl: Add support for RFC4716 keysAndre Noll2018-12-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The decode_private_key() helper of gcrypt.c base64-decodes the key but does not read the RSA bignums. It is thus independent of gcrypt and openssl. To add support for RFC4716 keys to the openssl backend, we need to move it to crypt_common.c, making it a crypo backend function. That is, non-static and declared in crypt_backend.h. The patch also documents the function using doxgen comments. With decode_private_key() and find_openssh_bignum_offset() to our disposal, supporting RFC4716 keys is simple. We only need to initialize the openssl-specific rsa structure with the six bignums stored in a private RFC4716 key. This is implemented in the new read_private_rsa_params() which calls the existing read_bignum() six times. The fields of the rsa structure are exposed to applications in openssl-1.0, but the structure was made opaque in openssl-1.1. We use the existing HAVE_RSA_SET0_KEY macro to decide whether or not we must use the accessor functions of openssl-1.1 to initialize the rsa structure.
| * openssl: Move get_private_key() down.Andre Noll2018-12-25
| | | | | | | | | | | | | | Prep patch for supporting RFC4716 keys. The function now comes after read_bignum() and thus may call it. Pure code movement, no actual changes.
| * crypt: Rename decoding functions.Andre Noll2018-12-25
| | | | | | | | | | | | | | | | decode_ssh_key() and decode_key() operate on public and private keys respectively. This should be obvious from the naming. Also, the two functions will soon be grouped together in the same file. The inconsistent naming would even increase the possible confusion, so it's better to rename the functions now.
* | build: Check also for CRYPTO_cleanup_all_ex_data.Andre Noll2019-02-16
|/ | | | | | FreeBSD 12 does not seem to have it. This is not fatal since omitting the call to CRYPTO_cleanup_all_ex_data() just results in a harmless memory leak at exit.
* openssl: Fix memory leak in read_rsa_bignums().Andre Noll2018-08-29
| | | | | If an error occurs while reading the second bignum we leak the memory allocated for the first bignum.
* crypt: Introduce crypt_shutdown().Andre Noll2018-02-26
| | | | | | | | | | This plugs a few harmless memory leaks in the openssl crypto backend. The leaks occur on exit and are only reported by valgrind if it is run with --leak-check=full --show-leak-kinds=all. The gcrypt backend has similar problems, but there is no way to provide a similar patch for libgrypt. The newly added comment in gcrypt.c explains why.
* crypt: Rename RSA functions.Andre Noll2018-02-26
| | | | | | | | | | | This renames the functions and constants of the public crypto API which deal with RSA to have the common "apc" (asymmetric pubkey cryptosystem) prefix. This hides RSA as an implementation detail and makes it clear that the functions/constants are related to apc. Pure renaming, no semantic change. The only other changes are a new comment to crypt.h and a \ref statement in the doxygen comment of apc_free_pubkey().
* crypt: Deduplicate get_public_key().Andre Noll2018-02-26
| | | | | | | | | | | | The openssl and grypt implementations of this function share quite some code. This patch factors out the common code into the new decode_ssh_key() helper of crypt_common.c. Both implementations are changed to call the new helper. As a side effect of this change, all callers of is_ssh_rsa_key() and check_ssh_key_header() now reside in crypt_common.c, so we can make these two functions static and remove their declarations from crypt_backend.h.
* Rename crypt.c -> openssl.c.Andre Noll2018-02-26
The old name made sense back when we had only one crypto backend. These days paraslash can be compiled against either openssl or gcrypt, so the new name makes it clear that the file is only compiled in if the openssl library was selected as the crypto backend.
generated by cgit v1.2.3 (git 2.46.0) at 2026-09-20 14:47:32 +0000