VirtualBox

Changeset 100491 in vbox


Ignore:
Timestamp:
Jul 10, 2023 10:05:12 PM (17 months ago)
Author:
vboxsync
Message:

Forward ported r158259 from 6.1: Support ECDSA for pre-3.0.0 OpenSSL versions. bugref:10479 ticketref:21621

Location:
trunk
Files:
4 edited

Legend:

Unmodified
Added
Removed

  • trunk

    • Property svn:mergeinfo

      •  

        old new  
        1010/branches/VBox-5.2:119536,120083,120099,120213,120221,120239,123597-123598,123600-123601,123755,124260,124263,124271,124273,124277-124279,124284-124286,124288-124290,125768,125779-125780,125812
        1111/branches/VBox-6.0:130474-130475,130477,130479,131352
        12 /branches/VBox-6.1:139660,139797,141521,141567-141568,141588-141590,141592-141595,141652,141920,142071,158257-158258
         12/branches/VBox-6.1:139660,139797,141521,141567-141568,141588-141590,141592-141595,141652,141920,142071,158257-158259
        1313/branches/VBox-7.0:156229,156768
        1414/branches/aeichner/vbox-chromium-cleanup:129816,129818-129851,129853-129861,129871-129872,129876,129880,129882,130013-130015,130036,130094-130095

  • trunk/src/VBox

    • Property svn:mergeinfo

      •  

        old new  
        1010/branches/VBox-5.2/src/VBox:119536,120083,120099,120213,120221,120239,123597-123598,123600-123601,123755,124263,124273,124277-124279,124284-124286,124288-124290,125768,125779-125780,125812,127158-127159,127162-127167,127180
        1111/branches/VBox-6.0/src/VBox:130474-130475,130477,130479,131352
        12 /branches/VBox-6.1/src/VBox:141521,141567-141568,141588-141590,141592-141595,141652,141920,158257-158258
         12/branches/VBox-6.1/src/VBox:141521,141567-141568,141588-141590,141592-141595,141652,141920,158257-158259
        1313/branches/VBox-7.0/src/VBox:156229,156768
        1414/branches/aeichner/vbox-chromium-cleanup/src/VBox:129818-129851,129853-129861,129871-129872,129876,129880,129882,130013-130015,130094-130095

  • trunk/src/VBox/Runtime/common/crypto/key-openssl.cpp

    r100447 r100491  
    4848#include <iprt/string.h>
    4949#include <iprt/crypto/digest.h>
    50 
    5150
    5251#ifdef IPRT_WITH_OPENSSL
    … …  
    5958#  error "Missing OPENSSL_VERSION_NUMBER!"
    6059# endif
     60# if OPENSSL_VERSION_NUMBER < 0x30000000 || defined(LIBRESSL_VERSION_NUMBER)
     61#  include "openssl/x509.h"
     62#  include <iprt/crypto/x509.h>
     63# endif
    6164
    6265# include "key-internal.h"
    … …  
    6467
    6568/**
    66  * Helper that loads key parameters if present.
    67  */
    68 static int rtCrKeyToOpenSslKeyLoadParams(RTCRKEY hKey, int idKeyType, EVP_PKEY **ppEvpNewKey, PRTERRINFO pErrInfo)
     69 * Helper that loads key parameters and the actual key bits if present.
     70 */
     71static int rtCrKeyToOpenSslKeyLoad(RTCRKEY hKey, int idKeyType, EVP_PKEY **ppEvpNewKey, bool fNeedPublic, PRTERRINFO pErrInfo)
    6972{
    7073    int rc = VINF_SUCCESS;
    … …  
    9295        }
    9396#else
    94         /** @todo d2i_KeyParams was introduced with 3.0.0, so ECDSA stuff won't work
    95          *        with older openssl versions atm.  Fortunately we only really needs
    96          *        it on Windows atm., so no problem. */
     97        /*
     98         * Cannot find any real suitable alternative to d2i_KeyParams in pre-3.0.x
     99         * OpenSSL, so decided to use d2i_PUBKEY instead.  This means we need to
     100         * encode the stuff a X.509 SubjectPublicKeyInfo ASN.1 sequence first.
     101         */
     102        if (hKey->enmType == RTCRKEYTYPE_ECDSA_PUBLIC)
     103        {
     104            RTCRX509SUBJECTPUBLICKEYINFO PubKeyInfo;
     105            rc = RTCrX509SubjectPublicKeyInfo_Init(&PubKeyInfo, &g_RTAsn1DefaultAllocator);
     106            AssertRCReturn(rc, rc);
     107
     108            rc = RTAsn1ObjId_SetFromString(&PubKeyInfo.Algorithm.Algorithm, RTCRX509ALGORITHMIDENTIFIERID_ECDSA,
     109                                           &g_RTAsn1DefaultAllocator);
     110            if (RT_SUCCESS(rc))
     111                rc = RTAsn1DynType_SetToObjId(&PubKeyInfo.Algorithm.Parameters, &hKey->u.EcdsaPublic.NamedCurve,
     112                                              &g_RTAsn1DefaultAllocator);
     113            if (RT_SUCCESS(rc))
     114            {
     115                RTAsn1BitString_Delete(&PubKeyInfo.SubjectPublicKey);
     116                rc = RTAsn1BitString_InitWithData(&PubKeyInfo.SubjectPublicKey, hKey->pbEncoded, hKey->cbEncoded * 8,
     117                                                  &g_RTAsn1DefaultAllocator);
     118                if (RT_SUCCESS(rc))
     119                {
     120                    /* Encode the whole shebang. */
     121                    void          *pvFree = NULL;
     122                    const uint8_t *pbRaw  = NULL;
     123                    uint32_t       cbRaw  = 0;
     124                    rc = RTAsn1EncodeQueryRawBits(&PubKeyInfo.SeqCore.Asn1Core, &pbRaw, &cbRaw, &pvFree, pErrInfo);
     125                    if (RT_SUCCESS(rc))
     126                    {
     127
     128                        const unsigned char *puchPubKey = pbRaw;
     129                        EVP_PKEY *pRet = d2i_PUBKEY(ppEvpNewKey, &puchPubKey, cbRaw);
     130                        if (pRet != NULL && pRet == *ppEvpNewKey)
     131                            rc = VINF_SUCCESS;
     132                        else
     133                            rc = RTERRINFO_LOG_SET(pErrInfo, VERR_CR_PKIX_OSSL_D2I_KEY_PARAMS_FAILED, "d2i_KeyParams failed");
     134                        RTMemTmpFree(pvFree);
     135                    }
     136                }
     137            }
     138            AssertRC(rc);
     139            RTCrX509SubjectPublicKeyInfo_Delete(&PubKeyInfo);
     140            return rc;
     141        }
    97142        rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_CR_OPENSSL_VERSION_TOO_OLD,
    98143                                 "OpenSSL version %#x is too old for IPRTs ECDSA code", OPENSSL_VERSION_NUMBER);
    … …  
    100145#endif
    101146    }
     147
     148    if (RT_SUCCESS(rc))
     149    {
     150        /*
     151         * Load the key into the structure.
     152         */
     153        const unsigned char *puchPublicKey = hKey->pbEncoded;
     154        EVP_PKEY *pRet;
     155        if (fNeedPublic)
     156            pRet = d2i_PublicKey(idKeyType, ppEvpNewKey, &puchPublicKey, hKey->cbEncoded);
     157        else
     158            pRet = d2i_PrivateKey(idKeyType, ppEvpNewKey, &puchPublicKey, hKey->cbEncoded);
     159        if (pRet != NULL && pRet == *ppEvpNewKey)
     160            return VINF_SUCCESS;
     161
     162        /* Bail out: */
     163        if (fNeedPublic)
     164            rc = RTERRINFO_LOG_SET(pErrInfo, VERR_CR_PKIX_OSSL_D2I_PUBLIC_KEY_FAILED, "d2i_PublicKey failed");
     165        else
     166            rc = RTERRINFO_LOG_SET(pErrInfo, VERR_CR_PKIX_OSSL_D2I_PRIVATE_KEY_FAILED, "d2i_PrivateKey failed");
     167    }
    102168    return rc;
    103 }
    104 
    105 
    106 /**
    107  * Helper that loads key bits.
    108  */
    109 static int rtCrKeyToOpenSslKeyLoadKeyBits(RTCRKEY hKey, int idKeyType, EVP_PKEY **ppEvpNewKey,
    110                                           bool fNeedPublic, PRTERRINFO pErrInfo)
    111 {
    112     /*
    113      * Load the key into the structure.
    114      */
    115     const unsigned char *puchPublicKey = hKey->pbEncoded;
    116     EVP_PKEY *pRet;
    117     if (fNeedPublic)
    118         pRet = d2i_PublicKey(idKeyType, ppEvpNewKey, &puchPublicKey, hKey->cbEncoded);
    119     else
    120         pRet = d2i_PrivateKey(idKeyType, ppEvpNewKey, &puchPublicKey, hKey->cbEncoded);
    121     if (pRet != NULL && pRet == *ppEvpNewKey)
    122         return VINF_SUCCESS;
    123 
    124     /* Bail out: */
    125     if (fNeedPublic)
    126         return RTERRINFO_LOG_SET(pErrInfo, VERR_CR_PKIX_OSSL_D2I_PUBLIC_KEY_FAILED, "d2i_PublicKey failed");
    127     return RTERRINFO_LOG_SET(pErrInfo, VERR_CR_PKIX_OSSL_D2I_PRIVATE_KEY_FAILED, "d2i_PrivateKey failed");
    128169}
    129170
    … …  
    180221     * Load key parameters and the key into the EVP structure.
    181222     */
    182     int rc = rtCrKeyToOpenSslKeyLoadParams(hKey, idKeyType, &pEvpNewKey, pErrInfo);
     223    int rc = rtCrKeyToOpenSslKeyLoad(hKey, idKeyType, &pEvpNewKey, fNeedPublic, pErrInfo);
    183224    if (RT_SUCCESS(rc))
    184225    {
    185         rc = rtCrKeyToOpenSslKeyLoadKeyBits(hKey, idKeyType, &pEvpNewKey, fNeedPublic, pErrInfo);
    186         if (RT_SUCCESS(rc))
    187         {
    188             *ppEvpKey = pEvpNewKey;
    189             return rc;
    190         }
     226        *ppEvpKey = pEvpNewKey;
     227        return rc;
    191228    }
    192229    EVP_PKEY_free(pEvpNewKey);
    … …  
    272309             * Load key parameters and the key into the EVP structure.
    273310             */
    274             rc = rtCrKeyToOpenSslKeyLoadParams(hKey, idKeyType, &pEvpNewKey, pErrInfo);
     311            rc = rtCrKeyToOpenSslKeyLoad(hKey, idKeyType, &pEvpNewKey, fNeedPublic, pErrInfo);
    275312            if (RT_SUCCESS(rc))
    276313            {
    277                 rc = rtCrKeyToOpenSslKeyLoadKeyBits(hKey, idKeyType, &pEvpNewKey, fNeedPublic, pErrInfo);
    278                 if (RT_SUCCESS(rc))
    279                 {
    280                     *ppEvpKey = pEvpNewKey;
    281                     return rc;
    282                 }
     314                *ppEvpKey = pEvpNewKey;
     315                return rc;
    283316            }
    284317        }

  • trunk/src/VBox/Runtime/common/crypto/pkix-signature-ossl.cpp

    r100447 r100491  
    151151    RT_NOREF_PV(pThis);
    152152
    153 #if OPENSSL_VERSION_NUMBER >= 0x30000000 && !defined(LIBRESSL_VERSION_NUMBER)
     153#if OPENSSL_VERSION_NUMBER >= 0x10000000
    154154    PRTERRINFO const pErrInfo = NULL;
    155155
    … …  
    186186    if (RT_SUCCESS(rc))
    187187    {
     188# if OPENSSL_VERSION_NUMBER >= 0x30000000 && !defined(LIBRESSL_VERSION_NUMBER)
    188189        EVP_PKEY_CTX * const pEvpPublickKeyCtx = EVP_PKEY_CTX_new_from_pkey(NULL, pEvpPublicKey, NULL);
     190# else
     191        EVP_PKEY_CTX * const pEvpPublickKeyCtx = EVP_PKEY_CTX_new(pEvpPublicKey, NULL);
     192# endif
    189193        if (pEvpPublickKeyCtx)
    190194        {
Note: See TracChangeset for help on using the changeset viewer.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette