Mirrors/libwebsockets
1
0
Fork 0
mirror of https://github.com/warmcat/libwebsockets.git synced 2025-03-09 00:00:04 +01:00
Code Issues Releases Wiki Activity

openssl3: migrate genhmac to EVP

Browse source 
The low level apis for HMAC (including those only introduced at 1.1.0...)
are all deprecated in OpenSSL v3.

Let's bite the bullet and migrate to EVP, it's already existing in modern
OpenSSL and we already use it for genhash.

EVP needs a PKEY, sort that out and keep it around until the hmac is
destroyed.
This commit is contained in:
Andy Green 2020-06-11 16:09:51 +01:00
parent 4948291b8b
commit 30e6c22e14
4 changed files with 83 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
cmake/lws_config.h.in
View file

@ -46,6 +46,7 @@
#cmakedefine LWS_HAVE_EVP_aes_256_cfb8
#cmakedefine LWS_HAVE_EVP_aes_256_cfb128
#cmakedefine LWS_HAVE_EVP_aes_128_xts
#cmakedefine LWS_HAVE_EVP_PKEY_new_raw_private_key
#cmakedefine LWS_HAVE_EXECVPE
#cmakedefine LWS_HAVE_LIBCAP
#cmakedefine LWS_HAVE_HMAC_CTX_new

7
include/libwebsockets/lws-genhash.h
View file

@ -74,11 +74,18 @@ struct lws_genhmac_ctx {
mbedtls_md_context_t ctx;
#else
const EVP_MD *evp_type;
#if defined(LWS_HAVE_EVP_PKEY_new_raw_private_key)
EVP_MD_CTX *ctx;
EVP_PKEY *key;
#else
#if defined(LWS_HAVE_HMAC_CTX_new)
HMAC_CTX *ctx;
#else
HMAC_CTX ctx;
#endif
#endif
#endif
};

1
lib/tls/CMakeLists.txt
View file

@ -298,6 +298,7 @@ CHECK_FUNCTION_EXISTS(${VARIA}EVP_aes_128_xts LWS_HAVE_EVP_aes_128_xts PARENT_SC
CHECK_FUNCTION_EXISTS(${VARIA}RSA_verify_pss_mgf1 LWS_HAVE_RSA_verify_pss_mgf1 PARENT_SCOPE)
CHECK_FUNCTION_EXISTS(${VARIA}HMAC_CTX_new LWS_HAVE_HMAC_CTX_new PARENT_SCOPE)
CHECK_FUNCTION_EXISTS(${VARIA}SSL_CTX_set_ciphersuites LWS_HAVE_SSL_CTX_set_ciphersuites PARENT_SCOPE)
CHECK_FUNCTION_EXISTS(${VARIA}EVP_PKEY_new_raw_private_key LWS_HAVE_EVP_PKEY_new_raw_private_key PARENT_SCOPE)
if (LWS_WITH_SSL AND NOT LWS_WITH_MBEDTLS)
# we don't want to confuse what's in or out of the wrapper with

74
lib/tls/openssl/lws-genhash.c
View file

@ -93,6 +93,78 @@ lws_genhash_destroy(struct lws_genhash_ctx *ctx, void *result)
return ret;
}
#if defined(LWS_HAVE_EVP_PKEY_new_raw_private_key)
int
lws_genhmac_init(struct lws_genhmac_ctx *ctx, enum lws_genhmac_types type,
const uint8_t *key, size_t key_len)
{
ctx->ctx = EVP_MD_CTX_create();
if (!ctx->ctx)
return -1;
ctx->evp_type = 0;
ctx->type = type;
switch (type) {
case LWS_GENHMAC_TYPE_SHA256:
ctx->evp_type = EVP_sha256();
break;
case LWS_GENHMAC_TYPE_SHA384:
ctx->evp_type = EVP_sha384();
break;
case LWS_GENHMAC_TYPE_SHA512:
ctx->evp_type = EVP_sha512();
break;
default:
lwsl_err("%s: unknown HMAC type %d\n", __func__, type);
goto bail;
}
ctx->key = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL, key, key_len);
if (!ctx->key)
goto bail;
if (EVP_DigestSignInit(ctx->ctx, NULL, ctx->evp_type, NULL, ctx->key) != 1)
goto bail1;
return 0;
bail1:
EVP_PKEY_free(ctx->key);
bail:
EVP_MD_CTX_free(ctx->ctx);
return -1;
}
int
lws_genhmac_update(struct lws_genhmac_ctx *ctx, const void *in, size_t len)
{
if (EVP_DigestSignUpdate(ctx->ctx, in, len) != 1)
return -1;
return 0;
}
int
lws_genhmac_destroy(struct lws_genhmac_ctx *ctx, void *result)
{
size_t size = (size_t)lws_genhmac_size(ctx->type);
int n;
n = EVP_DigestSignFinal(ctx->ctx, result, &size);
EVP_MD_CTX_free(ctx->ctx);
EVP_PKEY_free(ctx->key);
if (n != 1)
return -1;
return 0;
}
#else
int
lws_genhmac_init(struct lws_genhmac_ctx *ctx, enum lws_genhmac_types type,
@ -172,3 +244,5 @@ lws_genhmac_destroy(struct lws_genhmac_ctx *ctx, void *result)
return 0;
}
#endif