You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
217 lines
6.3 KiB
217 lines
6.3 KiB
diff --git a/src/assert.c b/src/assert.c |
|
index b4f9dd0..d0950a7 100644 |
|
--- a/src/assert.c |
|
+++ b/src/assert.c |
|
@@ -363,7 +363,11 @@ fido_get_signed_hash(int cose_alg, fido_blob_t *dgst, |
|
unsigned char *authdata_ptr = NULL; |
|
size_t authdata_len; |
|
struct cbor_load_result cbor; |
|
+#if OPENSSL_VERSION_NUMBER < 0x30000000 |
|
SHA256_CTX ctx; |
|
+#else |
|
+ EVP_MD_CTX *mdctx = NULL; |
|
+#endif |
|
int ok = -1; |
|
|
|
if ((item = cbor_load(authdata_cbor->ptr, authdata_cbor->len, |
|
@@ -377,10 +381,20 @@ fido_get_signed_hash(int cose_alg, fido_blob_t *dgst, |
|
authdata_len = cbor_bytestring_length(item); |
|
|
|
if (cose_alg != COSE_EDDSA) { |
|
- if (dgst->len < SHA256_DIGEST_LENGTH || SHA256_Init(&ctx) == 0 || |
|
+ if (dgst->len < SHA256_DIGEST_LENGTH || |
|
+#if OPENSSL_VERSION_NUMBER < 0x30000000 |
|
+ SHA256_Init(&ctx) == 0 || |
|
SHA256_Update(&ctx, authdata_ptr, authdata_len) == 0 || |
|
SHA256_Update(&ctx, clientdata->ptr, clientdata->len) == 0 || |
|
- SHA256_Final(dgst->ptr, &ctx) == 0) { |
|
+ SHA256_Final(dgst->ptr, &ctx) == 0 |
|
+#else |
|
+ (mdctx = EVP_MD_CTX_new()) == NULL || |
|
+ EVP_DigestInit_ex(mdctx, EVP_sha256(), NULL) <= 0 || |
|
+ EVP_DigestUpdate(mdctx, authdata_ptr, authdata_len) <= 0 || |
|
+ EVP_DigestUpdate(mdctx, clientdata->ptr, clientdata->len) <= 0 || |
|
+ EVP_DigestFinal_ex(mdctx, dgst->ptr, NULL) <= 0 |
|
+#endif |
|
+ ) { |
|
fido_log_debug("%s: sha256", __func__); |
|
goto fail; |
|
} |
|
@@ -406,6 +415,9 @@ fido_get_signed_hash(int cose_alg, fido_blob_t *dgst, |
|
fail: |
|
if (item != NULL) |
|
cbor_decref(&item); |
|
+#if OPENSSL_VERSION_NUMBER >= 0x30000000 |
|
+ EVP_MD_CTX_free(mdctx); |
|
+#endif |
|
|
|
return (ok); |
|
} |
|
@@ -410,7 +424,11 @@ fido_verify_sig_es256(const fido_blob_t *dgst, const es256_pk_t *pk, |
|
const fido_blob_t *sig) |
|
{ |
|
EVP_PKEY *pkey = NULL; |
|
+#if OPENSSL_VERSION_NUMBER >= 0x30000000 |
|
+ EVP_PKEY_CTX *pctx = NULL; |
|
+#else |
|
EC_KEY *ec = NULL; |
|
+#endif |
|
int ok = -1; |
|
|
|
/* ECDSA_verify needs ints */ |
|
@@ -420,6 +438,20 @@ fido_verify_sig_es256(const fido_blob_t *dgst, const es256_pk_t *pk, |
|
return (-1); |
|
} |
|
|
|
+#if OPENSSL_VERSION_NUMBER >= 0x30000000 |
|
+ if ((pkey = es256_pk_to_EVP_PKEY(pk)) == NULL || |
|
+ (pctx = EVP_PKEY_CTX_new(pkey, NULL)) == NULL) { |
|
+ fido_log_debug("%s: pk -> ec", __func__); |
|
+ goto fail; |
|
+ } |
|
+ |
|
+ if (EVP_PKEY_verify_init(pctx) != 1 || |
|
+ EVP_PKEY_verify(pctx, sig->ptr, sig->len, |
|
+ dgst->ptr, dgst->len) != 1) { |
|
+ fido_log_debug("%s: EVP_PKEY_verify", __func__); |
|
+ goto fail; |
|
+ } |
|
+#else |
|
if ((pkey = es256_pk_to_EVP_PKEY(pk)) == NULL || |
|
(ec = EVP_PKEY_get0_EC_KEY(pkey)) == NULL) { |
|
fido_log_debug("%s: pk -> ec", __func__); |
|
@@ -433,10 +465,13 @@ fido_verify_sig_es256(const fido_blob_t *dgst, const es256_pk_t *pk, |
|
} |
|
|
|
ok = 0; |
|
+#endif |
|
fail: |
|
if (pkey != NULL) |
|
EVP_PKEY_free(pkey); |
|
- |
|
+#if OPENSSL_VERSION_NUMBER >= 0x30000000 |
|
+ EVP_PKEY_CTX_free(pctx); |
|
+#endif |
|
return (ok); |
|
} |
|
|
|
@@ -445,7 +480,11 @@ fido_verify_sig_rs256(const fido_blob_t *dgst, const rs256_pk_t *pk, |
|
const fido_blob_t *sig) |
|
{ |
|
EVP_PKEY *pkey = NULL; |
|
+#if OPENSSL_VERSION_NUMBER >= 0x30000000 |
|
+ EVP_PKEY_CTX *pctx = NULL; |
|
+#else |
|
RSA *rsa = NULL; |
|
+#endif |
|
int ok = -1; |
|
|
|
/* RSA_verify needs unsigned ints */ |
|
@@ -455,6 +494,22 @@ fido_verify_sig_rs256(const fido_blob_t *dgst, const rs256_pk_t *pk, |
|
return (-1); |
|
} |
|
|
|
+#if OPENSSL_VERSION_NUMBER >= 0x30000000 |
|
+ if ((pkey = rs256_pk_to_EVP_PKEY(pk)) == NULL || |
|
+ (pctx = EVP_PKEY_CTX_new(pkey, NULL)) == NULL) { |
|
+ fido_log_debug("%s: pk -> ec", __func__); |
|
+ goto fail; |
|
+ } |
|
+ |
|
+ if (EVP_PKEY_verify_init(pctx) != 1 || |
|
+ EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PADDING) != 1 || |
|
+ EVP_PKEY_CTX_set_signature_md(pctx, EVP_sha256()) != 1 || |
|
+ EVP_PKEY_verify(pctx, sig->ptr, sig->len, |
|
+ dgst->ptr, dgst->len) != 1) { |
|
+ fido_log_debug("%s: EVP_PKEY_verify", __func__); |
|
+ goto fail; |
|
+ } |
|
+#else |
|
if ((pkey = rs256_pk_to_EVP_PKEY(pk)) == NULL || |
|
(rsa = EVP_PKEY_get0_RSA(pkey)) == NULL) { |
|
fido_log_debug("%s: pk -> ec", __func__); |
|
@@ -466,12 +521,16 @@ fido_verify_sig_rs256(const fido_blob_t *dgst, const rs256_pk_t *pk, |
|
fido_log_debug("%s: RSA_verify", __func__); |
|
goto fail; |
|
} |
|
+#endif |
|
|
|
ok = 0; |
|
fail: |
|
if (pkey != NULL) |
|
EVP_PKEY_free(pkey); |
|
|
|
+#if OPENSSL_VERSION_NUMBER >= 0x30000000 |
|
+ EVP_PKEY_CTX_free(pctx); |
|
+#endif |
|
return (ok); |
|
} |
|
|
|
diff --git a/src/cred.c b/src/cred.c |
|
index 92efde4..2ba1dd9 100644 |
|
--- a/src/cred.c |
|
+++ b/src/cred.c |
|
@@ -247,7 +247,11 @@ verify_sig(const fido_blob_t *dgst, const fido_blob_t *x5c, |
|
BIO *rawcert = NULL; |
|
X509 *cert = NULL; |
|
EVP_PKEY *pkey = NULL; |
|
- EC_KEY *ec; |
|
+#if OPENSSL_VERSION_NUMBER >= 0x30000000 |
|
+ EVP_PKEY_CTX *pctx = NULL; |
|
+#else |
|
+ EC_KEY *ec = NULL; |
|
+#endif |
|
int ok = -1; |
|
|
|
/* openssl needs ints */ |
|
@@ -257,6 +261,22 @@ verify_sig(const fido_blob_t *dgst, const fido_blob_t *x5c, |
|
return (-1); |
|
} |
|
|
|
+#if OPENSSL_VERSION_NUMBER >= 0x30000000 |
|
+ if ((rawcert = BIO_new_mem_buf(x5c->ptr, (int)x5c->len)) == NULL || |
|
+ (cert = d2i_X509_bio(rawcert, NULL)) == NULL || |
|
+ (pkey = X509_get_pubkey(cert)) == NULL || |
|
+ (pctx = EVP_PKEY_CTX_new(pkey, NULL)) == NULL) { |
|
+ fido_log_debug("%s: x509 key", __func__); |
|
+ goto fail; |
|
+ } |
|
+ |
|
+ if (EVP_PKEY_verify_init(pctx) != 1 || |
|
+ EVP_PKEY_verify(pctx, sig->ptr, sig->len, |
|
+ dgst->ptr, dgst->len) != 1) { |
|
+ fido_log_debug("%s: EVP_PKEY_verify", __func__); |
|
+ goto fail; |
|
+ } |
|
+#else |
|
/* fetch key from x509 */ |
|
if ((rawcert = BIO_new_mem_buf(x5c->ptr, (int)x5c->len)) == NULL || |
|
(cert = d2i_X509_bio(rawcert, NULL)) == NULL || |
|
@@ -271,6 +291,7 @@ verify_sig(const fido_blob_t *dgst, const fido_blob_t *x5c, |
|
fido_log_debug("%s: ECDSA_verify", __func__); |
|
goto fail; |
|
} |
|
+#endif |
|
|
|
ok = 0; |
|
fail: |
|
@@ -280,6 +301,9 @@ fail: |
|
X509_free(cert); |
|
if (pkey != NULL) |
|
EVP_PKEY_free(pkey); |
|
+#if OPENSSL_VERSION_NUMBER >= 0x30000000 |
|
+ EVP_PKEY_CTX_free(pctx); |
|
+#endif |
|
|
|
return (ok); |
|
} |
|
--- libfido2-1.6.0/CMakeLists.txt.orig 2021-05-25 16:26:28.124822909 +0200 |
|
+++ libfido2-1.6.0/CMakeLists.txt 2021-05-25 16:27:08.492148194 +0200 |
|
@@ -152,6 +152,7 @@ |
|
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-stringop-overflow") |
|
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -pedantic") |
|
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -pedantic-errors") |
|
+ set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-deprecated-declarations") |
|
check_c_compiler_flag("-fstack-protector-all" HAVE_STACK_PROTECTOR_ALL) |
|
if(HAVE_STACK_PROTECTOR_ALL) |
|
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fstack-protector-all")
|
|
|