0006-openssl-1.1.patch 32 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104
  1. From 071fec7181255b9234add44865a435dfdefee520 Mon Sep 17 00:00:00 2001
  2. In-Reply-To: <20180528120513.560-1-cote2004-github@yahoo.com>
  3. References: <20180528120513.560-1-cote2004-github@yahoo.com>
  4. From: Eneas U de Queiroz <cote2004-github@yahoo.com>
  5. Date: Wed, 30 May 2018 15:42:20 -0300
  6. Subject: [PATCH] ipsec-tools: add openssl 1.1 support
  7. To: equeiroz@troianet.com.br
  8. This patch updates the calls to openssl 1.1 API, and adds a
  9. compatibility layer so it compiles with (at least) openssl 1.0.2, I
  10. haven't tested it with lower versions, but all that's needed is to edit
  11. the openssl_compat.* files and add the missing functions there--they're
  12. usually trivial.
  13. Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
  14. Downloaded from
  15. https://github.com/openwrt/packages/blob/master/net/ipsec-tools/patches/015-openssl-1.1.patch
  16. Patch was sent upstream:
  17. https://sourceforge.net/p/ipsec-tools/mailman/ipsec-tools-devel/thread/20180528120513.560-1-cote2004-github%40yahoo.com/#msg36327963
  18. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
  19. ---
  20. src/racoon/Makefile.am | 10 +--
  21. src/racoon/algorithm.c | 6 +-
  22. src/racoon/cfparse.y | 2 +-
  23. src/racoon/crypto_openssl.c | 197 +++++++++++++++++++++-------------------
  24. src/racoon/crypto_openssl.h | 2 +-
  25. src/racoon/eaytest.c | 7 +-
  26. src/racoon/ipsec_doi.c | 2 +-
  27. src/racoon/openssl_compat.c | 213 ++++++++++++++++++++++++++++++++++++++++++++
  28. src/racoon/openssl_compat.h | 45 ++++++++++
  29. src/racoon/plainrsa-gen.c | 41 +++++----
  30. src/racoon/prsa_par.y | 28 ++++--
  31. src/racoon/rsalist.c | 5 +-
  32. 12 files changed, 431 insertions(+), 127 deletions(-)
  33. create mode 100644 src/racoon/openssl_compat.c
  34. create mode 100644 src/racoon/openssl_compat.h
  35. diff --git a/src/racoon/Makefile.am b/src/racoon/Makefile.am
  36. index dbaded9..4c585f3 100644
  37. --- a/src/racoon/Makefile.am
  38. +++ b/src/racoon/Makefile.am
  39. @@ -4,7 +4,7 @@ sbin_PROGRAMS = racoon racoonctl plainrsa-gen
  40. noinst_PROGRAMS = eaytest
  41. include_racoon_HEADERS = racoonctl.h var.h vmbuf.h misc.h gcmalloc.h admin.h \
  42. schedule.h sockmisc.h isakmp_var.h isakmp.h isakmp_xauth.h \
  43. - isakmp_cfg.h isakmp_unity.h ipsec_doi.h evt.h
  44. + isakmp_cfg.h isakmp_unity.h ipsec_doi.h evt.h openssl_compat.h
  45. lib_LTLIBRARIES = libracoon.la
  46. adminsockdir=${localstatedir}/racoon
  47. @@ -32,7 +32,7 @@ racoon_SOURCES = \
  48. gssapi.c dnssec.c getcertsbyname.c privsep.c \
  49. pfkey.c admin.c evt.c ipsec_doi.c oakley.c grabmyaddr.c vendorid.c \
  50. policy.c localconf.c remoteconf.c crypto_openssl.c algorithm.c \
  51. - proposal.c sainfo.c strnames.c \
  52. + openssl_compat.c proposal.c sainfo.c strnames.c \
  53. plog.c logger.c schedule.c str2val.c \
  54. safefile.c backupsa.c genlist.c rsalist.c \
  55. cftoken.l cfparse.y prsa_tok.l prsa_par.y
  56. @@ -51,12 +51,12 @@ libracoon_la_SOURCES = kmpstat.c vmbuf.c sockmisc.c misc.c
  57. libracoon_la_CFLAGS = -DNOUSE_PRIVSEP $(AM_CFLAGS)
  58. plainrsa_gen_SOURCES = plainrsa-gen.c plog.c \
  59. - crypto_openssl.c logger.c
  60. + crypto_openssl.c logger.c openssl_compat.c
  61. EXTRA_plainrsa_gen_SOURCES = $(MISSING_ALGOS)
  62. plainrsa_gen_LDADD = $(CRYPTOBJS) vmbuf.o misc.o
  63. plainrsa_gen_DEPENDENCIES = $(CRYPTOBJS) vmbuf.o misc.o
  64. -eaytest_SOURCES = eaytest.c plog.c logger.c
  65. +eaytest_SOURCES = eaytest.c plog.c logger.c openssl_compat.c
  66. EXTRA_eaytest_SOURCES = missing/crypto/sha2/sha2.c
  67. eaytest_LDADD = crypto_openssl_test.o vmbuf.o str2val.o misc_noplog.o \
  68. $(CRYPTOBJS)
  69. @@ -75,7 +75,7 @@ noinst_HEADERS = \
  70. debugrm.h isakmp.h misc.h sainfo.h \
  71. dhgroup.h isakmp_agg.h netdb_dnssec.h schedule.h \
  72. isakmp_cfg.h isakmp_xauth.h isakmp_unity.h isakmp_frag.h \
  73. - throttle.h privsep.h \
  74. + throttle.h privsep.h openssl_compat.h \
  75. cfparse_proto.h cftoken_proto.h genlist.h rsalist.h \
  76. missing/crypto/sha2/sha2.h missing/crypto/rijndael/rijndael_local.h \
  77. missing/crypto/rijndael/rijndael-api-fst.h \
  78. diff --git a/src/racoon/algorithm.c b/src/racoon/algorithm.c
  79. index 3fd50f6..66c874b 100644
  80. --- a/src/racoon/algorithm.c
  81. +++ b/src/racoon/algorithm.c
  82. @@ -128,7 +128,7 @@ static struct enc_algorithm oakley_encdef[] = {
  83. { "aes", algtype_aes, OAKLEY_ATTR_ENC_ALG_AES, 16,
  84. eay_aes_encrypt, eay_aes_decrypt,
  85. eay_aes_weakkey, eay_aes_keylen, },
  86. -#ifdef HAVE_OPENSSL_CAMELLIA_H
  87. +#if defined(HAVE_OPENSSL_CAMELLIA_H) && ! defined(OPENSSL_NO_CAMELLIA)
  88. { "camellia", algtype_camellia, OAKLEY_ATTR_ENC_ALG_CAMELLIA, 16,
  89. eay_camellia_encrypt, eay_camellia_decrypt,
  90. eay_camellia_weakkey, eay_camellia_keylen, },
  91. @@ -168,7 +168,7 @@ static struct enc_algorithm ipsec_encdef[] = {
  92. { "twofish", algtype_twofish, IPSECDOI_ESP_TWOFISH, 16,
  93. NULL, NULL,
  94. NULL, eay_twofish_keylen, },
  95. -#ifdef HAVE_OPENSSL_IDEA_H
  96. +#if defined(HAVE_OPENSSL_IDEA_H) && ! defined(OPENSSL_NO_IDEA)
  97. { "3idea", algtype_3idea, IPSECDOI_ESP_3IDEA, 8,
  98. NULL, NULL,
  99. NULL, NULL, },
  100. @@ -179,7 +179,7 @@ static struct enc_algorithm ipsec_encdef[] = {
  101. { "rc4", algtype_rc4, IPSECDOI_ESP_RC4, 8,
  102. NULL, NULL,
  103. NULL, NULL, },
  104. -#ifdef HAVE_OPENSSL_CAMELLIA_H
  105. +#if defined(HAVE_OPENSSL_CAMELLIA_H) && ! defined(OPENSSL_NO_CAMELLIA)
  106. { "camellia", algtype_camellia, IPSECDOI_ESP_CAMELLIA, 16,
  107. NULL, NULL,
  108. NULL, eay_camellia_keylen, },
  109. diff --git a/src/racoon/cfparse.y b/src/racoon/cfparse.y
  110. index 0d9bd67..8415752 100644
  111. --- a/src/racoon/cfparse.y
  112. +++ b/src/racoon/cfparse.y
  113. @@ -2564,7 +2564,7 @@ set_isakmp_proposal(rmconf)
  114. plog(LLV_DEBUG2, LOCATION, NULL,
  115. "encklen=%d\n", s->encklen);
  116. - memset(types, 0, ARRAYLEN(types));
  117. + memset(types, 0, sizeof types);
  118. types[algclass_isakmp_enc] = s->algclass[algclass_isakmp_enc];
  119. types[algclass_isakmp_hash] = s->algclass[algclass_isakmp_hash];
  120. types[algclass_isakmp_dh] = s->algclass[algclass_isakmp_dh];
  121. diff --git a/src/racoon/crypto_openssl.c b/src/racoon/crypto_openssl.c
  122. index 55b076a..8fb358f 100644
  123. --- a/src/racoon/crypto_openssl.c
  124. +++ b/src/racoon/crypto_openssl.c
  125. @@ -90,6 +90,7 @@
  126. #endif
  127. #endif
  128. #include "plog.h"
  129. +#include "openssl_compat.h"
  130. #define USE_NEW_DES_API
  131. @@ -316,9 +317,12 @@ eay_cmp_asn1dn(n1, n2)
  132. i = idx+1;
  133. goto end;
  134. }
  135. - if ((ea->value->length == 1 && ea->value->data[0] == '*') ||
  136. - (eb->value->length == 1 && eb->value->data[0] == '*')) {
  137. - if (OBJ_cmp(ea->object,eb->object)) {
  138. + ASN1_STRING *sa = X509_NAME_ENTRY_get_data(ea);
  139. + ASN1_STRING *sb = X509_NAME_ENTRY_get_data(eb);
  140. + if ((ASN1_STRING_length(sa) == 1 && ASN1_STRING_get0_data(sa)[0] == '*') ||
  141. + (ASN1_STRING_length(sb) == 1 && ASN1_STRING_get0_data(sb)[0] == '*')) {
  142. + if (OBJ_cmp(X509_NAME_ENTRY_get_object(ea),
  143. + X509_NAME_ENTRY_get_object(eb))) {
  144. i = idx+1;
  145. goto end;
  146. }
  147. @@ -430,7 +434,7 @@ cb_check_cert_local(ok, ctx)
  148. if (!ok) {
  149. X509_NAME_oneline(
  150. - X509_get_subject_name(ctx->current_cert),
  151. + X509_get_subject_name(X509_STORE_CTX_get_current_cert(ctx)),
  152. buf,
  153. 256);
  154. /*
  155. @@ -438,7 +442,8 @@ cb_check_cert_local(ok, ctx)
  156. * ok if they are self signed. But we should still warn
  157. * the user.
  158. */
  159. - switch (ctx->error) {
  160. + int ctx_error = X509_STORE_CTX_get_error(ctx);
  161. + switch (ctx_error) {
  162. case X509_V_ERR_CERT_HAS_EXPIRED:
  163. case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
  164. case X509_V_ERR_INVALID_CA:
  165. @@ -453,9 +458,9 @@ cb_check_cert_local(ok, ctx)
  166. }
  167. plog(log_tag, LOCATION, NULL,
  168. "%s(%d) at depth:%d SubjectName:%s\n",
  169. - X509_verify_cert_error_string(ctx->error),
  170. - ctx->error,
  171. - ctx->error_depth,
  172. + X509_verify_cert_error_string(ctx_error),
  173. + ctx_error,
  174. + X509_STORE_CTX_get_error_depth(ctx),
  175. buf);
  176. }
  177. ERR_clear_error();
  178. @@ -477,10 +482,11 @@ cb_check_cert_remote(ok, ctx)
  179. if (!ok) {
  180. X509_NAME_oneline(
  181. - X509_get_subject_name(ctx->current_cert),
  182. + X509_get_subject_name(X509_STORE_CTX_get_current_cert(ctx)),
  183. buf,
  184. 256);
  185. - switch (ctx->error) {
  186. + int ctx_error=X509_STORE_CTX_get_error(ctx);
  187. + switch (ctx_error) {
  188. case X509_V_ERR_UNABLE_TO_GET_CRL:
  189. ok = 1;
  190. log_tag = LLV_WARNING;
  191. @@ -490,9 +496,9 @@ cb_check_cert_remote(ok, ctx)
  192. }
  193. plog(log_tag, LOCATION, NULL,
  194. "%s(%d) at depth:%d SubjectName:%s\n",
  195. - X509_verify_cert_error_string(ctx->error),
  196. - ctx->error,
  197. - ctx->error_depth,
  198. + X509_verify_cert_error_string(ctx_error),
  199. + ctx_error,
  200. + X509_STORE_CTX_get_error_depth(ctx),
  201. buf);
  202. }
  203. ERR_clear_error();
  204. @@ -516,14 +522,15 @@ eay_get_x509asn1subjectname(cert)
  205. if (x509 == NULL)
  206. goto error;
  207. + X509_NAME *subject_name = X509_get_subject_name(x509);
  208. /* get the length of the name */
  209. - len = i2d_X509_NAME(x509->cert_info->subject, NULL);
  210. + len = i2d_X509_NAME(subject_name, NULL);
  211. name = vmalloc(len);
  212. if (!name)
  213. goto error;
  214. /* get the name */
  215. bp = (unsigned char *) name->v;
  216. - len = i2d_X509_NAME(x509->cert_info->subject, &bp);
  217. + len = i2d_X509_NAME(subject_name, &bp);
  218. X509_free(x509);
  219. @@ -661,15 +668,16 @@ eay_get_x509asn1issuername(cert)
  220. if (x509 == NULL)
  221. goto error;
  222. + X509_NAME *issuer_name = X509_get_issuer_name(x509);
  223. /* get the length of the name */
  224. - len = i2d_X509_NAME(x509->cert_info->issuer, NULL);
  225. + len = i2d_X509_NAME(issuer_name, NULL);
  226. name = vmalloc(len);
  227. if (name == NULL)
  228. goto error;
  229. /* get the name */
  230. bp = (unsigned char *) name->v;
  231. - len = i2d_X509_NAME(x509->cert_info->issuer, &bp);
  232. + len = i2d_X509_NAME(issuer_name, &bp);
  233. X509_free(x509);
  234. @@ -850,7 +858,7 @@ eay_check_x509sign(source, sig, cert)
  235. return -1;
  236. }
  237. - res = eay_rsa_verify(source, sig, evp->pkey.rsa);
  238. + res = eay_rsa_verify(source, sig, EVP_PKEY_get0_RSA(evp));
  239. EVP_PKEY_free(evp);
  240. X509_free(x509);
  241. @@ -992,7 +1000,7 @@ eay_get_x509sign(src, privkey)
  242. if (evp == NULL)
  243. return NULL;
  244. - sig = eay_rsa_sign(src, evp->pkey.rsa);
  245. + sig = eay_rsa_sign(src, EVP_PKEY_get0_RSA(evp));
  246. EVP_PKEY_free(evp);
  247. @@ -1079,7 +1087,11 @@ eay_strerror()
  248. int line, flags;
  249. unsigned long es;
  250. +#if OPENSSL_VERSION_NUMBER >= 0x10100000L
  251. + es = 0; /* even when allowed by OPENSSL_API_COMPAT, it is defined as 0 */
  252. +#else
  253. es = CRYPTO_thread_id();
  254. +#endif
  255. while ((l = ERR_get_error_line_data(&file, &line, &data, &flags)) != 0){
  256. n = snprintf(ebuf + len, sizeof(ebuf) - len,
  257. @@ -1100,7 +1112,7 @@ vchar_t *
  258. evp_crypt(vchar_t *data, vchar_t *key, vchar_t *iv, const EVP_CIPHER *e, int enc)
  259. {
  260. vchar_t *res;
  261. - EVP_CIPHER_CTX ctx;
  262. + EVP_CIPHER_CTX *ctx;
  263. if (!e)
  264. return NULL;
  265. @@ -1111,7 +1123,7 @@ evp_crypt(vchar_t *data, vchar_t *key, vchar_t *iv, const EVP_CIPHER *e, int enc
  266. if ((res = vmalloc(data->l)) == NULL)
  267. return NULL;
  268. - EVP_CIPHER_CTX_init(&ctx);
  269. + ctx = EVP_CIPHER_CTX_new();
  270. switch(EVP_CIPHER_nid(e)){
  271. case NID_bf_cbc:
  272. @@ -1125,54 +1137,41 @@ evp_crypt(vchar_t *data, vchar_t *key, vchar_t *iv, const EVP_CIPHER *e, int enc
  273. /* XXX: can we do that also for algos with a fixed key size ?
  274. */
  275. /* init context without key/iv
  276. - */
  277. - if (!EVP_CipherInit(&ctx, e, NULL, NULL, enc))
  278. - {
  279. - OpenSSL_BUG();
  280. - vfree(res);
  281. - return NULL;
  282. - }
  283. + */
  284. + if (!EVP_CipherInit(ctx, e, NULL, NULL, enc))
  285. + goto out;
  286. - /* update key size
  287. - */
  288. - if (!EVP_CIPHER_CTX_set_key_length(&ctx, key->l))
  289. - {
  290. - OpenSSL_BUG();
  291. - vfree(res);
  292. - return NULL;
  293. - }
  294. -
  295. - /* finalize context init with desired key size
  296. - */
  297. - if (!EVP_CipherInit(&ctx, NULL, (u_char *) key->v,
  298. + /* update key size
  299. + */
  300. + if (!EVP_CIPHER_CTX_set_key_length(ctx, key->l))
  301. + goto out;
  302. +
  303. + /* finalize context init with desired key size
  304. + */
  305. + if (!EVP_CipherInit(ctx, NULL, (u_char *) key->v,
  306. (u_char *) iv->v, enc))
  307. - {
  308. - OpenSSL_BUG();
  309. - vfree(res);
  310. - return NULL;
  311. - }
  312. + goto out;
  313. break;
  314. default:
  315. - if (!EVP_CipherInit(&ctx, e, (u_char *) key->v,
  316. - (u_char *) iv->v, enc)) {
  317. - OpenSSL_BUG();
  318. - vfree(res);
  319. - return NULL;
  320. - }
  321. + if (!EVP_CipherInit(ctx, e, (u_char *) key->v,
  322. + (u_char *) iv->v, enc))
  323. + goto out;
  324. }
  325. /* disable openssl padding */
  326. - EVP_CIPHER_CTX_set_padding(&ctx, 0);
  327. + EVP_CIPHER_CTX_set_padding(ctx, 0);
  328. - if (!EVP_Cipher(&ctx, (u_char *) res->v, (u_char *) data->v, data->l)) {
  329. - OpenSSL_BUG();
  330. - vfree(res);
  331. - return NULL;
  332. - }
  333. + if (!EVP_Cipher(ctx, (u_char *) res->v, (u_char *) data->v, data->l))
  334. + goto out;
  335. - EVP_CIPHER_CTX_cleanup(&ctx);
  336. + EVP_CIPHER_CTX_free(ctx);
  337. return res;
  338. +out:
  339. + EVP_CIPHER_CTX_free(ctx);
  340. + OpenSSL_BUG();
  341. + vfree(res);
  342. + return NULL;
  343. }
  344. int
  345. @@ -1230,7 +1229,7 @@ eay_des_keylen(len)
  346. return evp_keylen(len, EVP_des_cbc());
  347. }
  348. -#ifdef HAVE_OPENSSL_IDEA_H
  349. +#if defined(HAVE_OPENSSL_IDEA_H) && ! defined(OPENSSL_NO_IDEA)
  350. /*
  351. * IDEA-CBC
  352. */
  353. @@ -1587,7 +1586,7 @@ eay_aes_keylen(len)
  354. return len;
  355. }
  356. -#if defined(HAVE_OPENSSL_CAMELLIA_H)
  357. +#if defined(HAVE_OPENSSL_CAMELLIA_H) && ! defined(OPENSSL_NO_CAMELLIA)
  358. /*
  359. * CAMELLIA-CBC
  360. */
  361. @@ -1680,9 +1679,9 @@ eay_hmac_init(key, md)
  362. vchar_t *key;
  363. const EVP_MD *md;
  364. {
  365. - HMAC_CTX *c = racoon_malloc(sizeof(*c));
  366. + HMAC_CTX *c = HMAC_CTX_new();
  367. - HMAC_Init(c, key->v, key->l, md);
  368. + HMAC_Init_ex(c, key->v, key->l, md, NULL);
  369. return (caddr_t)c;
  370. }
  371. @@ -1761,8 +1760,7 @@ eay_hmacsha2_512_final(c)
  372. HMAC_Final((HMAC_CTX *)c, (unsigned char *) res->v, &l);
  373. res->l = l;
  374. - HMAC_cleanup((HMAC_CTX *)c);
  375. - (void)racoon_free(c);
  376. + HMAC_CTX_free((HMAC_CTX *)c);
  377. if (SHA512_DIGEST_LENGTH != res->l) {
  378. plog(LLV_ERROR, LOCATION, NULL,
  379. @@ -1811,8 +1809,7 @@ eay_hmacsha2_384_final(c)
  380. HMAC_Final((HMAC_CTX *)c, (unsigned char *) res->v, &l);
  381. res->l = l;
  382. - HMAC_cleanup((HMAC_CTX *)c);
  383. - (void)racoon_free(c);
  384. + HMAC_CTX_free((HMAC_CTX *)c);
  385. if (SHA384_DIGEST_LENGTH != res->l) {
  386. plog(LLV_ERROR, LOCATION, NULL,
  387. @@ -1861,8 +1858,7 @@ eay_hmacsha2_256_final(c)
  388. HMAC_Final((HMAC_CTX *)c, (unsigned char *) res->v, &l);
  389. res->l = l;
  390. - HMAC_cleanup((HMAC_CTX *)c);
  391. - (void)racoon_free(c);
  392. + HMAC_CTX_free((HMAC_CTX *)c);
  393. if (SHA256_DIGEST_LENGTH != res->l) {
  394. plog(LLV_ERROR, LOCATION, NULL,
  395. @@ -1912,8 +1908,7 @@ eay_hmacsha1_final(c)
  396. HMAC_Final((HMAC_CTX *)c, (unsigned char *) res->v, &l);
  397. res->l = l;
  398. - HMAC_cleanup((HMAC_CTX *)c);
  399. - (void)racoon_free(c);
  400. + HMAC_CTX_free((HMAC_CTX *)c);
  401. if (SHA_DIGEST_LENGTH != res->l) {
  402. plog(LLV_ERROR, LOCATION, NULL,
  403. @@ -1962,8 +1957,7 @@ eay_hmacmd5_final(c)
  404. HMAC_Final((HMAC_CTX *)c, (unsigned char *) res->v, &l);
  405. res->l = l;
  406. - HMAC_cleanup((HMAC_CTX *)c);
  407. - (void)racoon_free(c);
  408. + HMAC_CTX_free((HMAC_CTX *)c);
  409. if (MD5_DIGEST_LENGTH != res->l) {
  410. plog(LLV_ERROR, LOCATION, NULL,
  411. @@ -2266,6 +2260,7 @@ eay_dh_generate(prime, g, publen, pub, priv)
  412. u_int32_t g;
  413. {
  414. BIGNUM *p = NULL;
  415. + BIGNUM *BNg = NULL;
  416. DH *dh = NULL;
  417. int error = -1;
  418. @@ -2276,25 +2271,28 @@ eay_dh_generate(prime, g, publen, pub, priv)
  419. if ((dh = DH_new()) == NULL)
  420. goto end;
  421. - dh->p = p;
  422. - p = NULL; /* p is now part of dh structure */
  423. - dh->g = NULL;
  424. - if ((dh->g = BN_new()) == NULL)
  425. + if ((BNg = BN_new()) == NULL)
  426. goto end;
  427. - if (!BN_set_word(dh->g, g))
  428. + if (!BN_set_word(BNg, g))
  429. goto end;
  430. + if (! DH_set0_pqg(dh, p, NULL, BNg))
  431. + goto end;
  432. + BNg = NULL;
  433. + p = NULL; /* p is now part of dh structure */
  434. if (publen != 0)
  435. - dh->length = publen;
  436. + DH_set_length(dh, publen);
  437. /* generate public and private number */
  438. if (!DH_generate_key(dh))
  439. goto end;
  440. /* copy results to buffers */
  441. - if (eay_bn2v(pub, dh->pub_key) < 0)
  442. + BIGNUM *pub_key, *priv_key;
  443. + DH_get0_key(dh, (const BIGNUM**) &pub_key, (const BIGNUM**) &priv_key);
  444. + if (eay_bn2v(pub, pub_key) < 0)
  445. goto end;
  446. - if (eay_bn2v(priv, dh->priv_key) < 0) {
  447. + if (eay_bn2v(priv, priv_key) < 0) {
  448. vfree(*pub);
  449. goto end;
  450. }
  451. @@ -2306,6 +2304,8 @@ end:
  452. DH_free(dh);
  453. if (p != 0)
  454. BN_free(p);
  455. + if (BNg != 0)
  456. + BN_free(BNg);
  457. return(error);
  458. }
  459. @@ -2319,6 +2319,10 @@ eay_dh_compute(prime, g, pub, priv, pub2, key)
  460. int l;
  461. unsigned char *v = NULL;
  462. int error = -1;
  463. + BIGNUM *p = BN_new();
  464. + BIGNUM *BNg = BN_new();
  465. + BIGNUM *pub_key = BN_new();
  466. + BIGNUM *priv_key = BN_new();
  467. /* make public number to compute */
  468. if (eay_v2bn(&dh_pub, pub2) < 0)
  469. @@ -2327,19 +2331,21 @@ eay_dh_compute(prime, g, pub, priv, pub2, key)
  470. /* make DH structure */
  471. if ((dh = DH_new()) == NULL)
  472. goto end;
  473. - if (eay_v2bn(&dh->p, prime) < 0)
  474. + if (p == NULL || BNg == NULL || pub_key == NULL || priv_key == NULL)
  475. goto end;
  476. - if (eay_v2bn(&dh->pub_key, pub) < 0)
  477. +
  478. + if (eay_v2bn(&p, prime) < 0)
  479. goto end;
  480. - if (eay_v2bn(&dh->priv_key, priv) < 0)
  481. + if (eay_v2bn(&pub_key, pub) < 0)
  482. goto end;
  483. - dh->length = pub2->l * 8;
  484. -
  485. - dh->g = NULL;
  486. - if ((dh->g = BN_new()) == NULL)
  487. + if (eay_v2bn(&priv_key, priv) < 0)
  488. goto end;
  489. - if (!BN_set_word(dh->g, g))
  490. + if (!BN_set_word(BNg, g))
  491. goto end;
  492. + DH_set0_key(dh, pub_key, priv_key);
  493. + DH_set_length(dh, pub2->l * 8);
  494. + DH_set0_pqg(dh, p, NULL, BNg);
  495. + pub_key = priv_key = p = BNg = NULL;
  496. if ((v = racoon_calloc(prime->l, sizeof(u_char))) == NULL)
  497. goto end;
  498. @@ -2350,6 +2356,14 @@ eay_dh_compute(prime, g, pub, priv, pub2, key)
  499. error = 0;
  500. end:
  501. + if (p != NULL)
  502. + BN_free(p);
  503. + if (BNg != NULL)
  504. + BN_free(BNg);
  505. + if (pub_key != NULL)
  506. + BN_free(pub_key);
  507. + if (priv_key != NULL)
  508. + BN_free(priv_key);
  509. if (dh_pub != NULL)
  510. BN_free(dh_pub);
  511. if (dh != NULL)
  512. @@ -2400,12 +2414,14 @@ eay_bn2v(var, bn)
  513. void
  514. eay_init()
  515. {
  516. +#if OPENSSL_VERSION_NUMBER < 0x10100000L
  517. OpenSSL_add_all_algorithms();
  518. ERR_load_crypto_strings();
  519. #ifdef HAVE_OPENSSL_ENGINE_H
  520. ENGINE_load_builtin_engines();
  521. ENGINE_register_all_complete();
  522. #endif
  523. +#endif
  524. }
  525. vchar_t *
  526. @@ -2504,8 +2520,7 @@ binbuf_pubkey2rsa(vchar_t *binbuf)
  527. goto out;
  528. }
  529. - rsa_pub->n = mod;
  530. - rsa_pub->e = exp;
  531. + RSA_set0_key(rsa_pub, mod, exp, NULL);
  532. out:
  533. return rsa_pub;
  534. @@ -2582,5 +2597,5 @@ eay_random()
  535. const char *
  536. eay_version()
  537. {
  538. - return SSLeay_version(SSLEAY_VERSION);
  539. + return OpenSSL_version(OPENSSL_VERSION);
  540. }
  541. diff --git a/src/racoon/crypto_openssl.h b/src/racoon/crypto_openssl.h
  542. index 66fac73..ee5b765 100644
  543. --- a/src/racoon/crypto_openssl.h
  544. +++ b/src/racoon/crypto_openssl.h
  545. @@ -124,7 +124,7 @@ extern vchar_t *eay_aes_decrypt __P((vchar_t *, vchar_t *, vchar_t *));
  546. extern int eay_aes_weakkey __P((vchar_t *));
  547. extern int eay_aes_keylen __P((int));
  548. -#if defined(HAVE_OPENSSL_CAMELLIA_H)
  549. +#if defined(HAVE_OPENSSL_CAMELLIA_H) && ! defined(OPENSSL_NO_CAMELLIA)
  550. /* Camellia */
  551. extern vchar_t *eay_camellia_encrypt __P((vchar_t *, vchar_t *, vchar_t *));
  552. extern vchar_t *eay_camellia_decrypt __P((vchar_t *, vchar_t *, vchar_t *));
  553. diff --git a/src/racoon/eaytest.c b/src/racoon/eaytest.c
  554. index 1474bdc..ae09db3 100644
  555. --- a/src/racoon/eaytest.c
  556. +++ b/src/racoon/eaytest.c
  557. @@ -62,6 +62,7 @@
  558. #include "dhgroup.h"
  559. #include "crypto_openssl.h"
  560. #include "gnuc.h"
  561. +#include "openssl_compat.h"
  562. #include "package_version.h"
  563. @@ -103,7 +104,7 @@ rsa_verify_with_pubkey(src, sig, pubkey_txt)
  564. printf ("PEM_read_PUBKEY(): %s\n", eay_strerror());
  565. return -1;
  566. }
  567. - error = eay_check_rsasign(src, sig, evp->pkey.rsa);
  568. + error = eay_check_rsasign(src, sig, EVP_PKEY_get0_RSA(evp));
  569. return error;
  570. }
  571. @@ -698,7 +699,7 @@ ciphertest(ac, av)
  572. eay_cast_encrypt, eay_cast_decrypt) < 0)
  573. return -1;
  574. -#ifdef HAVE_OPENSSL_IDEA_H
  575. +#if defined(HAVE_OPENSSL_IDEA_H) && ! defined(OPENSSL_NO_IDEA)
  576. if (ciphertest_1 ("IDEA",
  577. &data, 8,
  578. &key, key.l,
  579. @@ -715,7 +716,7 @@ ciphertest(ac, av)
  580. eay_rc5_encrypt, eay_rc5_decrypt) < 0)
  581. return -1;
  582. #endif
  583. -#if defined(HAVE_OPENSSL_CAMELLIA_H)
  584. +#if defined(HAVE_OPENSSL_CAMELLIA_H) && ! defined(OPENSSL_NO_CAMELLIA)
  585. if (ciphertest_1 ("CAMELLIA",
  586. &data, 16,
  587. &key, key.l,
  588. diff --git a/src/racoon/ipsec_doi.c b/src/racoon/ipsec_doi.c
  589. index 84a4c71..b52469f 100644
  590. --- a/src/racoon/ipsec_doi.c
  591. +++ b/src/racoon/ipsec_doi.c
  592. @@ -715,7 +715,7 @@ out:
  593. /* key length must not be specified on some algorithms */
  594. if (keylen) {
  595. if (sa->enctype == OAKLEY_ATTR_ENC_ALG_DES
  596. -#ifdef HAVE_OPENSSL_IDEA_H
  597. +#if defined(HAVE_OPENSSL_IDEA_H) && ! defined(OPENSSL_NO_IDEA)
  598. || sa->enctype == OAKLEY_ATTR_ENC_ALG_IDEA
  599. #endif
  600. || sa->enctype == OAKLEY_ATTR_ENC_ALG_3DES) {
  601. diff --git a/src/racoon/openssl_compat.c b/src/racoon/openssl_compat.c
  602. new file mode 100644
  603. index 0000000..864b5fb
  604. --- /dev/null
  605. +++ b/src/racoon/openssl_compat.c
  606. @@ -0,0 +1,213 @@
  607. +/*
  608. + * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
  609. + *
  610. + * Licensed under the OpenSSL license (the "License"). You may not use
  611. + * this file except in compliance with the License. You can obtain a copy
  612. + * in the file LICENSE in the source distribution or at
  613. + * https://www.openssl.org/source/license.html
  614. + */
  615. +
  616. +#include "openssl_compat.h"
  617. +
  618. +#if OPENSSL_VERSION_NUMBER < 0x10100000L
  619. +
  620. +#include <string.h>
  621. +
  622. +static void *OPENSSL_zalloc(size_t num)
  623. +{
  624. + void *ret = OPENSSL_malloc(num);
  625. +
  626. + if (ret != NULL)
  627. + memset(ret, 0, num);
  628. + return ret;
  629. +}
  630. +
  631. +int RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d)
  632. +{
  633. + /* If the fields n and e in r are NULL, the corresponding input
  634. + * parameters MUST be non-NULL for n and e. d may be
  635. + * left NULL (in case only the public key is used).
  636. + */
  637. + if ((r->n == NULL && n == NULL)
  638. + || (r->e == NULL && e == NULL))
  639. + return 0;
  640. +
  641. + if (n != NULL) {
  642. + BN_free(r->n);
  643. + r->n = n;
  644. + }
  645. + if (e != NULL) {
  646. + BN_free(r->e);
  647. + r->e = e;
  648. + }
  649. + if (d != NULL) {
  650. + BN_free(r->d);
  651. + r->d = d;
  652. + }
  653. +
  654. + return 1;
  655. +}
  656. +
  657. +int RSA_set0_factors(RSA *r, BIGNUM *p, BIGNUM *q)
  658. +{
  659. + /* If the fields p and q in r are NULL, the corresponding input
  660. + * parameters MUST be non-NULL.
  661. + */
  662. + if ((r->p == NULL && p == NULL)
  663. + || (r->q == NULL && q == NULL))
  664. + return 0;
  665. +
  666. + if (p != NULL) {
  667. + BN_free(r->p);
  668. + r->p = p;
  669. + }
  670. + if (q != NULL) {
  671. + BN_free(r->q);
  672. + r->q = q;
  673. + }
  674. +
  675. + return 1;
  676. +}
  677. +
  678. +int RSA_set0_crt_params(RSA *r, BIGNUM *dmp1, BIGNUM *dmq1, BIGNUM *iqmp)
  679. +{
  680. + /* If the fields dmp1, dmq1 and iqmp in r are NULL, the corresponding input
  681. + * parameters MUST be non-NULL.
  682. + */
  683. + if ((r->dmp1 == NULL && dmp1 == NULL)
  684. + || (r->dmq1 == NULL && dmq1 == NULL)
  685. + || (r->iqmp == NULL && iqmp == NULL))
  686. + return 0;
  687. +
  688. + if (dmp1 != NULL) {
  689. + BN_free(r->dmp1);
  690. + r->dmp1 = dmp1;
  691. + }
  692. + if (dmq1 != NULL) {
  693. + BN_free(r->dmq1);
  694. + r->dmq1 = dmq1;
  695. + }
  696. + if (iqmp != NULL) {
  697. + BN_free(r->iqmp);
  698. + r->iqmp = iqmp;
  699. + }
  700. +
  701. + return 1;
  702. +}
  703. +
  704. +void RSA_get0_key(const RSA *r,
  705. + const BIGNUM **n, const BIGNUM **e, const BIGNUM **d)
  706. +{
  707. + if (n != NULL)
  708. + *n = r->n;
  709. + if (e != NULL)
  710. + *e = r->e;
  711. + if (d != NULL)
  712. + *d = r->d;
  713. +}
  714. +
  715. +void RSA_get0_factors(const RSA *r, const BIGNUM **p, const BIGNUM **q)
  716. +{
  717. + if (p != NULL)
  718. + *p = r->p;
  719. + if (q != NULL)
  720. + *q = r->q;
  721. +}
  722. +
  723. +void RSA_get0_crt_params(const RSA *r,
  724. + const BIGNUM **dmp1, const BIGNUM **dmq1,
  725. + const BIGNUM **iqmp)
  726. +{
  727. + if (dmp1 != NULL)
  728. + *dmp1 = r->dmp1;
  729. + if (dmq1 != NULL)
  730. + *dmq1 = r->dmq1;
  731. + if (iqmp != NULL)
  732. + *iqmp = r->iqmp;
  733. +}
  734. +
  735. +int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g)
  736. +{
  737. + /* If the fields p and g in d are NULL, the corresponding input
  738. + * parameters MUST be non-NULL. q may remain NULL.
  739. + */
  740. + if ((dh->p == NULL && p == NULL)
  741. + || (dh->g == NULL && g == NULL))
  742. + return 0;
  743. +
  744. + if (p != NULL) {
  745. + BN_free(dh->p);
  746. + dh->p = p;
  747. + }
  748. + if (q != NULL) {
  749. + BN_free(dh->q);
  750. + dh->q = q;
  751. + }
  752. + if (g != NULL) {
  753. + BN_free(dh->g);
  754. + dh->g = g;
  755. + }
  756. +
  757. + if (q != NULL) {
  758. + dh->length = BN_num_bits(q);
  759. + }
  760. +
  761. + return 1;
  762. +}
  763. +
  764. +void DH_get0_key(const DH *dh, const BIGNUM **pub_key, const BIGNUM **priv_key)
  765. +{
  766. + if (pub_key != NULL)
  767. + *pub_key = dh->pub_key;
  768. + if (priv_key != NULL)
  769. + *priv_key = dh->priv_key;
  770. +}
  771. +
  772. +int DH_set0_key(DH *dh, BIGNUM *pub_key, BIGNUM *priv_key)
  773. +{
  774. + /* If the field pub_key in dh is NULL, the corresponding input
  775. + * parameters MUST be non-NULL. The priv_key field may
  776. + * be left NULL.
  777. + */
  778. + if (dh->pub_key == NULL && pub_key == NULL)
  779. + return 0;
  780. +
  781. + if (pub_key != NULL) {
  782. + BN_free(dh->pub_key);
  783. + dh->pub_key = pub_key;
  784. + }
  785. + if (priv_key != NULL) {
  786. + BN_free(dh->priv_key);
  787. + dh->priv_key = priv_key;
  788. + }
  789. +
  790. + return 1;
  791. +}
  792. +
  793. +int DH_set_length(DH *dh, long length)
  794. +{
  795. + dh->length = length;
  796. + return 1;
  797. +}
  798. +
  799. +HMAC_CTX *HMAC_CTX_new(void)
  800. +{
  801. + return OPENSSL_zalloc(sizeof(HMAC_CTX));
  802. +}
  803. +
  804. +void HMAC_CTX_free(HMAC_CTX *ctx)
  805. +{
  806. + HMAC_CTX_cleanup(ctx);
  807. + OPENSSL_free(ctx);
  808. +}
  809. +
  810. +RSA *EVP_PKEY_get0_RSA(EVP_PKEY *pkey)
  811. +{
  812. + if (pkey->type != EVP_PKEY_RSA) {
  813. + return NULL;
  814. + }
  815. + return pkey->pkey.rsa;
  816. +}
  817. +
  818. +
  819. +#endif /* OPENSSL_VERSION_NUMBER */
  820. diff --git a/src/racoon/openssl_compat.h b/src/racoon/openssl_compat.h
  821. new file mode 100644
  822. index 0000000..9e152c2
  823. --- /dev/null
  824. +++ b/src/racoon/openssl_compat.h
  825. @@ -0,0 +1,45 @@
  826. +#ifndef OPENSSL_COMPAT_H
  827. +#define OPENSSL_COMPAT_H
  828. +
  829. +#include <openssl/opensslv.h>
  830. +#if OPENSSL_VERSION_NUMBER < 0x10100000L
  831. +
  832. +#include <openssl/rsa.h>
  833. +#include <openssl/dh.h>
  834. +#include <openssl/evp.h>
  835. +#include <openssl/hmac.h>
  836. +
  837. +int RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
  838. +int RSA_set0_factors(RSA *r, BIGNUM *p, BIGNUM *q);
  839. +int RSA_set0_crt_params(RSA *r, BIGNUM *dmp1, BIGNUM *dmq1, BIGNUM *iqmp);
  840. +void RSA_get0_key(const RSA *r, const BIGNUM **n, const BIGNUM **e, const BIGNUM **d);
  841. +void RSA_get0_factors(const RSA *r, const BIGNUM **p, const BIGNUM **q);
  842. +void RSA_get0_crt_params(const RSA *r, const BIGNUM **dmp1, const BIGNUM **dmq1, const BIGNUM **iqmp);
  843. +
  844. +int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g);
  845. +void DH_get0_key(const DH *dh, const BIGNUM **pub_key, const BIGNUM **priv_key);
  846. +int DH_set0_key(DH *dh, BIGNUM *pub_key, BIGNUM *priv_key);
  847. +int DH_set_length(DH *dh, long length);
  848. +
  849. +HMAC_CTX *HMAC_CTX_new(void);
  850. +void HMAC_CTX_free(HMAC_CTX* ctx);
  851. +
  852. +RSA *EVP_PKEY_get0_RSA(EVP_PKEY *pkey);
  853. +
  854. +#define ASN1_STRING_length(s) s->length
  855. +#define ASN1_STRING_get0_data(s) s->data
  856. +
  857. +#define X509_get_subject_name(x) x->cert_info->subject
  858. +#define X509_get_issuer_name(x) x->cert_info->issuer
  859. +#define X509_NAME_ENTRY_get_data(n) n->value
  860. +#define X509_NAME_ENTRY_get_object(n) n->object
  861. +#define X509_STORE_CTX_get_current_cert(ctx) ctx->current_cert
  862. +#define X509_STORE_CTX_get_error(ctx) ctx->error
  863. +#define X509_STORE_CTX_get_error_depth(ctx) ctx->error_depth
  864. +
  865. +#define OPENSSL_VERSION SSLEAY_VERSION
  866. +#define OpenSSL_version SSLeay_version
  867. +
  868. +#endif /* OPENSSL_VERSION_NUMBER */
  869. +
  870. +#endif /* OPENSSL_COMPAT_H */
  871. diff --git a/src/racoon/plainrsa-gen.c b/src/racoon/plainrsa-gen.c
  872. index cad1861..b949b08 100644
  873. --- a/src/racoon/plainrsa-gen.c
  874. +++ b/src/racoon/plainrsa-gen.c
  875. @@ -60,6 +60,7 @@
  876. #include "vmbuf.h"
  877. #include "plog.h"
  878. #include "crypto_openssl.h"
  879. +#include "openssl_compat.h"
  880. #include "package_version.h"
  881. @@ -90,12 +91,14 @@ mix_b64_pubkey(const RSA *key)
  882. char *binbuf;
  883. long binlen, ret;
  884. vchar_t *res;
  885. -
  886. - binlen = 1 + BN_num_bytes(key->e) + BN_num_bytes(key->n);
  887. + const BIGNUM *e, *n;
  888. +
  889. + RSA_get0_key(key, &n, &e, NULL);
  890. + binlen = 1 + BN_num_bytes(e) + BN_num_bytes(n);
  891. binbuf = malloc(binlen);
  892. memset(binbuf, 0, binlen);
  893. - binbuf[0] = BN_bn2bin(key->e, (unsigned char *) &binbuf[1]);
  894. - ret = BN_bn2bin(key->n, (unsigned char *) (&binbuf[binbuf[0] + 1]));
  895. + binbuf[0] = BN_bn2bin(e, (unsigned char *) &binbuf[1]);
  896. + ret = BN_bn2bin(n, (unsigned char *) (&binbuf[binbuf[0] + 1]));
  897. if (1 + binbuf[0] + ret != binlen) {
  898. plog(LLV_ERROR, LOCATION, NULL,
  899. "Pubkey generation failed. This is really strange...\n");
  900. @@ -131,16 +134,20 @@ print_rsa_key(FILE *fp, const RSA *key)
  901. fprintf(fp, "# : PUB 0s%s\n", pubkey64->v);
  902. fprintf(fp, ": RSA\t{\n");
  903. - fprintf(fp, "\t# RSA %d bits\n", BN_num_bits(key->n));
  904. + const BIGNUM *n, *e, *d, *p, *q, *dmp1, *dmq1, *iqmp;
  905. + RSA_get0_key(key, &n, &e, &d);
  906. + RSA_get0_factors(key, &p, &q);
  907. + RSA_get0_crt_params(key, &dmp1, &dmq1, &iqmp);
  908. + fprintf(fp, "\t# RSA %d bits\n", BN_num_bits(n));
  909. fprintf(fp, "\t# pubkey=0s%s\n", pubkey64->v);
  910. - fprintf(fp, "\tModulus: 0x%s\n", lowercase(BN_bn2hex(key->n)));
  911. - fprintf(fp, "\tPublicExponent: 0x%s\n", lowercase(BN_bn2hex(key->e)));
  912. - fprintf(fp, "\tPrivateExponent: 0x%s\n", lowercase(BN_bn2hex(key->d)));
  913. - fprintf(fp, "\tPrime1: 0x%s\n", lowercase(BN_bn2hex(key->p)));
  914. - fprintf(fp, "\tPrime2: 0x%s\n", lowercase(BN_bn2hex(key->q)));
  915. - fprintf(fp, "\tExponent1: 0x%s\n", lowercase(BN_bn2hex(key->dmp1)));
  916. - fprintf(fp, "\tExponent2: 0x%s\n", lowercase(BN_bn2hex(key->dmq1)));
  917. - fprintf(fp, "\tCoefficient: 0x%s\n", lowercase(BN_bn2hex(key->iqmp)));
  918. + fprintf(fp, "\tModulus: 0x%s\n", lowercase(BN_bn2hex(n)));
  919. + fprintf(fp, "\tPublicExponent: 0x%s\n", lowercase(BN_bn2hex(e)));
  920. + fprintf(fp, "\tPrivateExponent: 0x%s\n", lowercase(BN_bn2hex(d)));
  921. + fprintf(fp, "\tPrime1: 0x%s\n", lowercase(BN_bn2hex(p)));
  922. + fprintf(fp, "\tPrime2: 0x%s\n", lowercase(BN_bn2hex(q)));
  923. + fprintf(fp, "\tExponent1: 0x%s\n", lowercase(BN_bn2hex(dmp1)));
  924. + fprintf(fp, "\tExponent2: 0x%s\n", lowercase(BN_bn2hex(dmq1)));
  925. + fprintf(fp, "\tCoefficient: 0x%s\n", lowercase(BN_bn2hex(iqmp)));
  926. fprintf(fp, " }\n");
  927. vfree(pubkey64);
  928. @@ -203,11 +210,13 @@ int
  929. gen_rsa_key(FILE *fp, size_t bits, unsigned long exp)
  930. {
  931. int ret;
  932. - RSA *key;
  933. + RSA *key = RSA_new();
  934. + BIGNUM *e = BN_new();
  935. - key = RSA_generate_key(bits, exp, NULL, NULL);
  936. - if (!key) {
  937. + BN_set_word(e, exp);
  938. + if (! RSA_generate_key_ex(key, bits, e, NULL)) {
  939. fprintf(stderr, "RSA_generate_key(): %s\n", eay_strerror());
  940. + RSA_free(key);
  941. return -1;
  942. }
  943. diff --git a/src/racoon/prsa_par.y b/src/racoon/prsa_par.y
  944. index 1987e4d..27ce4c6 100644
  945. --- a/src/racoon/prsa_par.y
  946. +++ b/src/racoon/prsa_par.y
  947. @@ -68,6 +68,7 @@
  948. #include "isakmp_var.h"
  949. #include "handler.h"
  950. #include "crypto_openssl.h"
  951. +#include "openssl_compat.h"
  952. #include "sockmisc.h"
  953. #include "rsalist.h"
  954. @@ -85,7 +86,18 @@ char *prsa_cur_fname = NULL;
  955. struct genlist *prsa_cur_list = NULL;
  956. enum rsa_key_type prsa_cur_type = RSA_TYPE_ANY;
  957. -static RSA *rsa_cur;
  958. +struct my_rsa_st {
  959. + BIGNUM *n;
  960. + BIGNUM *e;
  961. + BIGNUM *d;
  962. + BIGNUM *p;
  963. + BIGNUM *q;
  964. + BIGNUM *dmp1;
  965. + BIGNUM *dmq1;
  966. + BIGNUM *iqmp;
  967. +};
  968. +
  969. +static struct my_rsa_st *rsa_cur;
  970. void
  971. prsaerror(const char *s, ...)
  972. @@ -201,8 +213,12 @@ rsa_statement:
  973. rsa_cur->iqmp = NULL;
  974. }
  975. }
  976. - $$ = rsa_cur;
  977. - rsa_cur = RSA_new();
  978. + RSA * rsa_tmp = RSA_new();
  979. + RSA_set0_key(rsa_tmp, rsa_cur->n, rsa_cur->e, rsa_cur->d);
  980. + RSA_set0_factors(rsa_tmp, rsa_cur->p, rsa_cur->q);
  981. + RSA_set0_crt_params(rsa_tmp, rsa_cur->dmp1, rsa_cur->dmq1, rsa_cur->iqmp);
  982. + $$ = rsa_tmp;
  983. + memset(rsa_cur, 0, sizeof(struct my_rsa_st));
  984. }
  985. | TAG_PUB BASE64
  986. {
  987. @@ -351,10 +367,12 @@ prsa_parse_file(struct genlist *list, char *fname, enum rsa_key_type type)
  988. prsa_cur_fname = fname;
  989. prsa_cur_list = list;
  990. prsa_cur_type = type;
  991. - rsa_cur = RSA_new();
  992. + rsa_cur = malloc(sizeof(struct my_rsa_st));
  993. + memset(rsa_cur, 0, sizeof(struct my_rsa_st));
  994. ret = prsaparse();
  995. if (rsa_cur) {
  996. - RSA_free(rsa_cur);
  997. + memset(rsa_cur, 0, sizeof(struct my_rsa_st));
  998. + free(rsa_cur);
  999. rsa_cur = NULL;
  1000. }
  1001. fclose (fp);
  1002. diff --git a/src/racoon/rsalist.c b/src/racoon/rsalist.c
  1003. index f152c82..96e8363 100644
  1004. --- a/src/racoon/rsalist.c
  1005. +++ b/src/racoon/rsalist.c
  1006. @@ -52,6 +52,7 @@
  1007. #include "genlist.h"
  1008. #include "remoteconf.h"
  1009. #include "crypto_openssl.h"
  1010. +#include "openssl_compat.h"
  1011. #ifndef LIST_FIRST
  1012. #define LIST_FIRST(head) ((head)->lh_first)
  1013. @@ -98,7 +99,9 @@ rsa_key_dup(struct rsa_key *key)
  1014. return NULL;
  1015. if (key->rsa) {
  1016. - new->rsa = key->rsa->d != NULL ? RSAPrivateKey_dup(key->rsa) : RSAPublicKey_dup(key->rsa);
  1017. + const BIGNUM *d;
  1018. + RSA_get0_key(key->rsa, NULL, NULL, &d);
  1019. + new->rsa = (d != NULL ? RSAPrivateKey_dup(key->rsa) : RSAPublicKey_dup(key->rsa));
  1020. if (new->rsa == NULL)
  1021. goto dup_error;
  1022. }
  1023. --
  1024. 2.16.1