From 63abe0078521d91db7a28de1db14bd193f74aad3 Mon Sep 17 00:00:00 2001 From: rhe Date: Sun, 5 Jun 2016 15:00:47 +0000 Subject: openssl: adapt OpenSSL::PKey to OpenSSL 1.1.0 opaque structs * ext/openssl/openssl_missing.[ch]: Implement EVP_PKEY_get0_*() and {RSA,DSA,EC_KEY,DH}_get0_*() functions. OpenSSL 1.1.0 makes EVP_PKEY/RSA/DSA/DH opaque. We used to provide setter methods for each parameter of each PKey type, for example PKey::RSA#e=, but this is no longer possible because the new API RSA_set0_key() requires the 'n' at the same time. This commit adds deprecation warning to them and adds PKey::*#set_* methods as direct wrapper for those new APIs. For example, 'rsa.e = 3' now needs to be rewritten as 'rsa.set_key(rsa.n, 3, rsa.d)'. [ruby-core:75225] [Feature #12324] * ext/openssl/ossl_pkey*.[ch]: Use the new accessor functions. Implement RSA#set_{key,factors,crt_params}, DSA#set_{key,pqg}, DH#set_{key,pqg}. Emit a warning with rb_warning() when old setter methods are used. * test/drb/ut_array_drbssl.rb, test/drb/ut_drb_drbssl.rb, test/rubygems/test_gem_remote_fetcher.rb: Don't set a priv_key for DH object that are used in tmp_dh_callback. Generating a new key pair every time should be fine - actually the private exponent is ignored in OpenSSL >= 1.0.2f/1.0.1r even if we explicitly set. https://www.openssl.org/news/secadv/20160128.txt git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55285 b2dd03c8-39d4-4d8f-98ff-823fe69b080e --- ext/openssl/ossl_pkey.h | 140 +++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 120 insertions(+), 20 deletions(-) (limited to 'ext/openssl/ossl_pkey.h') diff --git a/ext/openssl/ossl_pkey.h b/ext/openssl/ossl_pkey.h index b806d63e15..6f9555e563 100644 --- a/ext/openssl/ossl_pkey.h +++ b/ext/openssl/ossl_pkey.h @@ -95,53 +95,153 @@ extern VALUE eEC_POINT; VALUE ossl_ec_new(EVP_PKEY *); void Init_ossl_ec(void); - -#define OSSL_PKEY_BN(keytype, name) \ +#define OSSL_PKEY_BN_DEF_GETTER0(_keytype, _type, _name, _get) \ /* \ * call-seq: \ - * key.##name -> aBN \ + * _keytype##.##_name -> aBN \ */ \ -static VALUE ossl_##keytype##_get_##name(VALUE self) \ +static VALUE ossl_##_keytype##_get_##_name(VALUE self) \ { \ - EVP_PKEY *pkey; \ + _type *obj; \ BIGNUM *bn; \ \ - GetPKey(self, pkey); \ - bn = pkey->pkey.keytype->name; \ + Get##_type(self, obj); \ + _get; \ if (bn == NULL) \ return Qnil; \ return ossl_bn_new(bn); \ -} \ +} + +#define OSSL_PKEY_BN_DEF_GETTER3(_keytype, _type, _group, a1, a2, a3) \ + OSSL_PKEY_BN_DEF_GETTER0(_keytype, _type, a1, \ + _type##_get0_##_group(obj, &bn, NULL, NULL)) \ + OSSL_PKEY_BN_DEF_GETTER0(_keytype, _type, a2, \ + _type##_get0_##_group(obj, NULL, &bn, NULL)) \ + OSSL_PKEY_BN_DEF_GETTER0(_keytype, _type, a3, \ + _type##_get0_##_group(obj, NULL, NULL, &bn)) + +#define OSSL_PKEY_BN_DEF_GETTER2(_keytype, _type, _group, a1, a2) \ + OSSL_PKEY_BN_DEF_GETTER0(_keytype, _type, a1, \ + _type##_get0_##_group(obj, &bn, NULL)) \ + OSSL_PKEY_BN_DEF_GETTER0(_keytype, _type, a2, \ + _type##_get0_##_group(obj, NULL, &bn)) + +#define OSSL_PKEY_BN_DEF_SETTER3(_keytype, _type, _group, a1, a2, a3) \ +/* \ + * call-seq: \ + * _keytype##.set_##_group(a1, a2, a3) -> self \ + */ \ +static VALUE ossl_##_keytype##_set_##_group(VALUE self, VALUE v1, VALUE v2, VALUE v3) \ +{ \ + _type *obj; \ + BIGNUM *bn1 = NULL, *orig_bn1 = NIL_P(v1) ? NULL : GetBNPtr(v1);\ + BIGNUM *bn2 = NULL, *orig_bn2 = NIL_P(v2) ? NULL : GetBNPtr(v2);\ + BIGNUM *bn3 = NULL, *orig_bn3 = NIL_P(v3) ? NULL : GetBNPtr(v3);\ + \ + Get##_type(self, obj); \ + if (orig_bn1 && !(bn1 = BN_dup(orig_bn1)) || \ + orig_bn2 && !(bn2 = BN_dup(orig_bn2)) || \ + orig_bn3 && !(bn3 = BN_dup(orig_bn3))) { \ + BN_clear_free(bn1); \ + BN_clear_free(bn2); \ + BN_clear_free(bn3); \ + ossl_raise(eBNError, NULL); \ + } \ + \ + if (!_type##_set0_##_group(obj, bn1, bn2, bn3)) { \ + BN_clear_free(bn1); \ + BN_clear_free(bn2); \ + BN_clear_free(bn3); \ + ossl_raise(ePKeyError, #_type"_set0_"#_group); \ + } \ + return self; \ +} + +#define OSSL_PKEY_BN_DEF_SETTER2(_keytype, _type, _group, a1, a2) \ /* \ * call-seq: \ - * key.##name = bn -> bn \ + * _keytype##.set_##_group(a1, a2) -> self \ */ \ -static VALUE ossl_##keytype##_set_##name(VALUE self, VALUE bignum) \ +static VALUE ossl_##_keytype##_set_##_group(VALUE self, VALUE v1, VALUE v2) \ { \ - EVP_PKEY *pkey; \ + _type *obj; \ + BIGNUM *bn1 = NULL, *orig_bn1 = NIL_P(v1) ? NULL : GetBNPtr(v1);\ + BIGNUM *bn2 = NULL, *orig_bn2 = NIL_P(v2) ? NULL : GetBNPtr(v2);\ + \ + Get##_type(self, obj); \ + if (orig_bn1 && !(bn1 = BN_dup(orig_bn1)) || \ + orig_bn2 && !(bn2 = BN_dup(orig_bn2))) { \ + BN_clear_free(bn1); \ + BN_clear_free(bn2); \ + ossl_raise(eBNError, NULL); \ + } \ + \ + if (!_type##_set0_##_group(obj, bn1, bn2)) { \ + BN_clear_free(bn1); \ + BN_clear_free(bn2); \ + ossl_raise(ePKeyError, #_type"_set0_"#_group); \ + } \ + return self; \ +} + +#define OSSL_PKEY_BN_DEF_SETTER_OLD(_keytype, _type, _group, _name) \ +/* \ + * call-seq: \ + * _keytype##.##_name = bn -> bn \ + */ \ +static VALUE ossl_##_keytype##_set_##_name(VALUE self, VALUE bignum) \ +{ \ + _type *obj; \ BIGNUM *bn; \ \ - GetPKey(self, pkey); \ + rb_warning("#"#_name"= is deprecated; use #set_"#_group); \ + Get##_type(self, obj); \ if (NIL_P(bignum)) { \ - BN_clear_free(pkey->pkey.keytype->name); \ - pkey->pkey.keytype->name = NULL; \ + BN_clear_free(obj->_name); \ + obj->_name = NULL; \ return Qnil; \ } \ \ bn = GetBNPtr(bignum); \ - if (pkey->pkey.keytype->name == NULL) \ - pkey->pkey.keytype->name = BN_new(); \ - if (pkey->pkey.keytype->name == NULL) \ + if (obj->_name == NULL) \ + obj->_name = BN_new(); \ + if (obj->_name == NULL) \ ossl_raise(eBNError, NULL); \ - if (BN_copy(pkey->pkey.keytype->name, bn) == NULL) \ + if (BN_copy(obj->_name, bn) == NULL) \ ossl_raise(eBNError, NULL); \ return bignum; \ } +#if defined(HAVE_OPAQUE_OPENSSL) /* OpenSSL 1.1.0 */ +#define OSSL_PKEY_BN_DEF3(_keytype, _type, _group, a1, a2, a3) \ + OSSL_PKEY_BN_DEF_GETTER3(_keytype, _type, _group, a1, a2, a3) \ + OSSL_PKEY_BN_DEF_SETTER3(_keytype, _type, _group, a1, a2, a3) + +#define OSSL_PKEY_BN_DEF2(_keytype, _type, _group, a1, a2) \ + OSSL_PKEY_BN_DEF_GETTER2(_keytype, _type, _group, a1, a2) \ + OSSL_PKEY_BN_DEF_SETTER2(_keytype, _type, _group, a1, a2) + #define DEF_OSSL_PKEY_BN(class, keytype, name) \ -do { \ - rb_define_method((class), #name, ossl_##keytype##_get_##name, 0); \ + rb_define_method((class), #name, ossl_##keytype##_get_##name, 0) + +#else +#define OSSL_PKEY_BN_DEF3(_keytype, _type, _group, a1, a2, a3) \ + OSSL_PKEY_BN_DEF_GETTER3(_keytype, _type, _group, a1, a2, a3) \ + OSSL_PKEY_BN_DEF_SETTER3(_keytype, _type, _group, a1, a2, a3) \ + OSSL_PKEY_BN_DEF_SETTER_OLD(_keytype, _type, _group, a1) \ + OSSL_PKEY_BN_DEF_SETTER_OLD(_keytype, _type, _group, a2) \ + OSSL_PKEY_BN_DEF_SETTER_OLD(_keytype, _type, _group, a3) + +#define OSSL_PKEY_BN_DEF2(_keytype, _type, _group, a1, a2) \ + OSSL_PKEY_BN_DEF_GETTER2(_keytype, _type, _group, a1, a2) \ + OSSL_PKEY_BN_DEF_SETTER2(_keytype, _type, _group, a1, a2) \ + OSSL_PKEY_BN_DEF_SETTER_OLD(_keytype, _type, _group, a1) \ + OSSL_PKEY_BN_DEF_SETTER_OLD(_keytype, _type, _group, a2) + +#define DEF_OSSL_PKEY_BN(class, keytype, name) do { \ + rb_define_method((class), #name, ossl_##keytype##_get_##name, 0);\ rb_define_method((class), #name "=", ossl_##keytype##_set_##name, 1);\ } while (0) +#endif /* HAVE_OPAQUE_OPENSSL */ #endif /* _OSSL_PKEY_H_ */ -- cgit v1.2.3