home-assistant
/
buildroot
mirror of https://github.com/home-assistant/buildroot.git
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
buildroot/package/libest/0002-package-libest-Add-Ope...

226 lines
9.5 KiB
Diff
Raw Permalink Blame History

From ad5ce7ff1cae92c151dc6f350ef943106ddd852f Mon Sep 17 00:00:00 2001
From: Aleksandr Makarov <aleksandr.o.makarov@gmail.com>
Date: Fri, 12 Jul 2024 21:07:36 +0300
Subject: [PATCH] package/libest: Add OpenSSL 3.0 compatibility
The functions `FIPS_mode` and `FIPS_mode_set` are deprecated in OpenSSL 3.0, replaced by
`EVP_default_properties_is_fips_enabled` and `EVP_default_properties_enable_fips` respectively.
This commit introduces wrappers for these new EVP APIs to maintain compatibility with OpenSSL 3.0,
while ensuring continued support for older versions of OpenSSL.
- Implemented `is_fips_enabled` wrapper around `EVP_default_properties_is_fips_enabled`
- Implemented `enable_fips` wrapper around `EVP_default_properties_enable_fips`
- Added conditional compilation to support both new and legacy OpenSSL versions
Upstream: https://github.com/cisco/libest/pull/132
Signed-off-by: Aleksandr Makarov <aleksandr.o.makarov@gmail.com>
---
example/client-brski/estclient-brski.c | 2 +-
example/client/estclient.c | 2 +-
example/proxy/estproxy.c | 2 +-
example/server/estserver.c | 2 +-
java/jni/client.c | 2 +-
src/est/est_client.c | 12 ++++++------
src/est/est_ossl_util.c | 18 ++++++++++++++++++
src/est/est_ossl_util.h | 2 ++
src/est/est_server.c | 2 +-
test/UT/US1864/us1864.c | 4 ++--
10 files changed, 34 insertions(+), 14 deletions(-)
diff --git a/example/client-brski/estclient-brski.c b/example/client-brski/estclient-brski.c
index 9e63af5..6e03052 100644
--- a/example/client-brski/estclient-brski.c
+++ b/example/client-brski/estclient-brski.c
@@ -388,7 +388,7 @@ int main (int argc, char **argv)
break;
case 'f':
/* Turn FIPS on if requested and exit if failure */
- set_fips_return = FIPS_mode_set(1);
+ set_fips_return = est_enable_fips(1);
if (!set_fips_return) {
printf("\nERROR setting FIPS MODE ON ...\n");
ERR_load_crypto_strings();
diff --git a/example/client/estclient.c b/example/client/estclient.c
index a8a2d6f..75b1272 100644
--- a/example/client/estclient.c
+++ b/example/client/estclient.c
@@ -1280,7 +1280,7 @@ int main (int argc, char **argv)
break;
case 'f':
/* Turn FIPS on if requested and exit if failure */
- set_fips_return = FIPS_mode_set(1);
+ set_fips_return = est_enable_fips(1);
if (!set_fips_return) {
printf("\nERROR setting FIPS MODE ON ...\n");
ERR_load_crypto_strings();
diff --git a/example/proxy/estproxy.c b/example/proxy/estproxy.c
index 114bd65..6dbdbda 100644
--- a/example/proxy/estproxy.c
+++ b/example/proxy/estproxy.c
@@ -593,7 +593,7 @@ int main (int argc, char **argv)
/*
* Turn FIPS on if user requested it and exit if failure
*/
- set_fips_return = FIPS_mode_set(1);
+ set_fips_return = est_enable_fips(1);
if (set_fips_return != 1) {
set_fips_error = ERR_get_error();
printf("\nERROR WHILE SETTING FIPS MODE ON exiting ....\n");
diff --git a/example/server/estserver.c b/example/server/estserver.c
index 3539dc4..90886cf 100644
--- a/example/server/estserver.c
+++ b/example/server/estserver.c
@@ -2285,7 +2285,7 @@ int main (int argc, char **argv)
/* turn FIPS on if user requested it
* and exit if failure.
*/
- set_fips_return = FIPS_mode_set(1);
+ set_fips_return = est_enable_fips(1);
if (set_fips_return != 1) {
set_fips_error = ERR_get_error();
printf("\nERROR WHILE SETTING FIPS MODE ON exiting ....\n");
diff --git a/java/jni/client.c b/java/jni/client.c
index c5bc28e..f58d5c0 100644
--- a/java/jni/client.c
+++ b/java/jni/client.c
@@ -179,7 +179,7 @@ static int jni_est_client_X509_REQ_sign (X509_REQ *x, EVP_PKEY *pkey, const EVP_
*/
JNIEXPORT jint JNICALL Java_com_cisco_c3m_est_ESTClient_enable_1fips(
JNIEnv *env, jclass obj) {
- if (!FIPS_mode() && !FIPS_mode_set(1)) {
+ if (!est_is_fips_enabled() && !est_enable_fips(1)) {
ERR_print_errors_fp(stderr);
return -1;
} else {
diff --git a/src/est/est_client.c b/src/est/est_client.c
index 5c25d4f..63069af 100644
--- a/src/est/est_client.c
+++ b/src/est/est_client.c
@@ -3183,7 +3183,7 @@ EST_ERROR est_client_enroll_internal (EST_CTX *ctx, char *cn, int *pkcs7_len, in
* HTTPS digest mode requires the use of MD5. Make sure we're not
* in FIPS mode and can use MD5
*/
- if (ctx->auth_mode == AUTH_DIGEST && (FIPS_mode())){
+ if (ctx->auth_mode == AUTH_DIGEST && (est_is_fips_enabled())){
EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
rv = EST_ERR_BAD_MODE;
goto err;
@@ -3594,7 +3594,7 @@ EST_ERROR est_client_reenroll (EST_CTX *ctx, X509 *cert, int *pkcs7_len, EVP_PKE
* HTTPS digest mode requires the use of MD5. Make sure we're not
* in FIPS mode and can use MD5
*/
- if (ctx->auth_mode == AUTH_DIGEST && (FIPS_mode())){
+ if (ctx->auth_mode == AUTH_DIGEST && (est_is_fips_enabled())){
EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
rv = EST_ERR_BAD_MODE;
goto err;
@@ -3680,7 +3680,7 @@ static EST_ERROR est_client_enroll_csr_internal (EST_CTX *ctx, X509_REQ *csr, in
* HTTPS digest mode requires the use of MD5. Make sure we're not
* in FIPS mode and can use MD5
*/
- if (ctx->auth_mode == AUTH_DIGEST && (FIPS_mode())){
+ if (ctx->auth_mode == AUTH_DIGEST && (est_is_fips_enabled())){
EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
rv = EST_ERR_BAD_MODE;
goto err;
@@ -5872,7 +5872,7 @@ static EST_ERROR est_client_brski_send_get_voucher (EST_CTX *ctx, int *cacert_le
* HTTPS digest mode requires the use of MD5. Make sure we're not
* in FIPS mode and can use MD5
*/
- if (ctx->auth_mode == AUTH_DIGEST && (FIPS_mode())){
+ if (ctx->auth_mode == AUTH_DIGEST && (est_is_fips_enabled())){
EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
rv = EST_ERR_BAD_MODE;
goto err;
@@ -6366,7 +6366,7 @@ EST_ERROR est_client_brski_send_voucher_status (EST_CTX *ctx, EST_BRSKI_STATUS_V
* HTTPS digest mode requires the use of MD5. Make sure we're not
* in FIPS mode and can use MD5
*/
- if (ctx->auth_mode == AUTH_DIGEST && (FIPS_mode())){
+ if (ctx->auth_mode == AUTH_DIGEST && (est_is_fips_enabled())){
EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
rv = EST_ERR_BAD_MODE;
goto err;
@@ -6535,7 +6535,7 @@ EST_ERROR est_client_brski_send_enroll_status (EST_CTX *ctx, EST_BRSKI_STATUS_VA
* HTTPS digest mode requires the use of MD5. Make sure we're not
* in FIPS mode and can use MD5
*/
- if (ctx->auth_mode == AUTH_DIGEST && (FIPS_mode())){
+ if (ctx->auth_mode == AUTH_DIGEST && (est_is_fips_enabled())){
EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
rv = EST_ERR_BAD_MODE;
goto err;
diff --git a/src/est/est_ossl_util.c b/src/est/est_ossl_util.c
index daa54f2..0887daa 100644
--- a/src/est/est_ossl_util.c
+++ b/src/est/est_ossl_util.c
@@ -500,3 +500,21 @@ char *est_find_ser_num_in_subj(X509 *cert)
return(ser_num_str);
}
#endif
+
+int est_is_fips_enabled()
+{
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+ return EVP_default_properties_is_fips_enabled(NULL);
+#else
+ return FIPS_mode();
+#endif
+}
+
+int est_enable_fips(int enable)
+{
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+ return EVP_default_properties_enable_fips(NULL, enable);
+#else
+ return FIPS_mode_set(enable);
+#endif
+}
diff --git a/src/est/est_ossl_util.h b/src/est/est_ossl_util.h
index 68ad290..2389e45 100644
--- a/src/est/est_ossl_util.h
+++ b/src/est/est_ossl_util.h
@@ -44,4 +44,6 @@ LIBEST_TEST_API void ossl_dump_ssl_errors(void);
EST_ERROR ossl_init_cert_store(X509_STORE *store,
unsigned char *raw1, int size1);
+int est_is_fips_enabled();
+int est_enable_fips(int);
#endif
diff --git a/src/est/est_server.c b/src/est/est_server.c
index d047b48..979ae53 100644
--- a/src/est/est_server.c
+++ b/src/est/est_server.c
@@ -3355,7 +3355,7 @@ EST_ERROR est_server_set_auth_mode (EST_CTX *ctx, EST_HTTP_AUTH_MODE amode)
/*
* Since HTTP digest auth uses MD5, make sure we're not in FIPS mode.
*/
- if (FIPS_mode()) {
+ if (est_is_fips_enabled()) {
EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
return (EST_ERR_BAD_MODE);
}
diff --git a/test/UT/US1864/us1864.c b/test/UT/US1864/us1864.c
index 3e41cd7..1f57494 100644
--- a/test/UT/US1864/us1864.c
+++ b/test/UT/US1864/us1864.c
@@ -218,12 +218,12 @@ static void us1864_test1 (void)
/*
* Make sure we don't allow DIGEST mode when in FIPS mode
*/
- if (!FIPS_mode_set(1)) {
+ if (!est_enable_fips(1)) {
printf("FIPS mode not supported, skipping test to prevent digest auth when in FIPS mode");
} else {
est_rv = est_server_set_auth_mode(ctx, AUTH_DIGEST);
CU_ASSERT(est_rv == EST_ERR_BAD_MODE);
- FIPS_mode_set(0);
+ est_enable_fips(0);
}
X509_free(x);
--
2.40.1
Reference in New Issue View Git Blame Copy Permalink