File 1646-crypto-Update-the-EVP_CIPHER_CTX_-usage.patch of Package erlang

Overview Repositories Revisions Requests Users Attributes Meta

File 1646-crypto-Update-the-EVP_CIPHER_CTX_-usage.patch of Package erlang (Revision 75e053fb70ae9038cf6513f776cd662d)

Currently displaying revision 75e053fb70ae9038cf6513f776cd662d , Show latest

From b19ec6a69bc7a459295e6f00fd7b79196a8e1b05 Mon Sep 17 00:00:00 2001
From: Hans Nilsson <hans@erlang.org>
Date: Mon, 11 May 2020 10:39:43 +0200
Subject: [PATCH 16/17] crypto: Update the EVP_CIPHER_CTX_* usage

to better fit OpenSSL 3.0:

- use new EVP_CIPHER_CTX_ctrl for .ccm and .gcm
 - remove EVP_CIPHER_CTX_copy if OpenSSL 3.0 cryptolib
---
 lib/crypto/c_src/api_ng.c | 61 ++++++++++++++++++++++++++++++++-------
 lib/crypto/c_src/cipher.c | 12 ++++++--
 lib/crypto/c_src/cipher.h |  1 +
 3 files changed, 62 insertions(+), 12 deletions(-)

diff --git a/lib/crypto/c_src/api_ng.c b/lib/crypto/c_src/api_ng.c
index 077cdda92e..b745974d14 100644
--- a/lib/crypto/c_src/api_ng.c
+++ b/lib/crypto/c_src/api_ng.c
@@ -200,13 +200,14 @@ static int get_init_args(ErlNifEnv* env,
                          ERL_NIF_TERM *return_term)
 {
     int ivec_len;
-    ErlNifBinary key_bin;
     ErlNifBinary ivec_bin;
 
     ctx_res->ctx = NULL; /* For testing if *ctx should be freed after errors */
 #if !defined(HAVE_EVP_AES_CTR)
     ctx_res->env = NULL; /* For testing if *env should be freed after errors */
 #endif
+    ctx_res->key_bin.data = NULL;
+    ctx_res->padding = atom_undefined;
     ctx_res->padded_size = -1;
     ctx_res->size = 0;
 
@@ -222,7 +223,7 @@ static int get_init_args(ErlNifEnv* env,
         goto err;
 
     /* Fetch the key */
-    if (!enif_inspect_iolist_as_binary(env, argv[key_arg_num], &key_bin))
+    if (!enif_inspect_iolist_as_binary(env, argv[key_arg_num], &ctx_res->key_bin))
         {
             *return_term = EXCP_BADARG_N(env, key_arg_num, "Bad key");
             goto err;
@@ -235,7 +236,7 @@ static int get_init_args(ErlNifEnv* env,
             goto err;
         }
 
-    if (!(*cipherp = get_cipher_type(argv[cipher_arg_num], key_bin.size)))
+    if (!(*cipherp = get_cipher_type(argv[cipher_arg_num], ctx_res->key_bin.size)))
         {
             if (!get_cipher_type_no_key(argv[cipher_arg_num]))
                 *return_term = EXCP_BADARG_N(env, cipher_arg_num, "Unknown cipher");
@@ -349,7 +350,7 @@ static int get_init_args(ErlNifEnv* env,
             goto err;
         }
 
-    if (!EVP_CIPHER_CTX_set_key_length(ctx_res->ctx, (int)key_bin.size))
+    if (!EVP_CIPHER_CTX_set_key_length(ctx_res->ctx, (int)ctx_res->key_bin.size))
         {
             *return_term = EXCP_ERROR_N(env, key_arg_num, "Can't initialize context, key_length");
             goto err;
@@ -357,11 +358,11 @@ static int get_init_args(ErlNifEnv* env,
 
 #ifdef HAVE_RC2
     if (EVP_CIPHER_type((*cipherp)->cipher.p) == NID_rc2_cbc) {
-        if (key_bin.size > INT_MAX / 8) {
+        if (ctx_res->key_bin.size > INT_MAX / 8) {
             *return_term = EXCP_BADARG_N(env, key_arg_num, "To large rc2_cbc key");
             goto err;
         }
-        if (!EVP_CIPHER_CTX_ctrl(ctx_res->ctx, EVP_CTRL_SET_RC2_KEY_BITS, (int)key_bin.size * 8, NULL)) {
+        if (!EVP_CIPHER_CTX_ctrl(ctx_res->ctx, EVP_CTRL_SET_RC2_KEY_BITS, (int)ctx_res->key_bin.size * 8, NULL)) {
             *return_term = EXCP_BADARG_N(env, key_arg_num, "ctrl rc2_cbc key");
             goto err;
         }
@@ -370,13 +371,13 @@ static int get_init_args(ErlNifEnv* env,
 
     if (argv[ivec_arg_num] == atom_undefined || ivec_len == 0)
         {
-            if (!EVP_CipherInit_ex(ctx_res->ctx, NULL, NULL, key_bin.data, NULL, -1)) {
+            if (!EVP_CipherInit_ex(ctx_res->ctx, NULL, NULL,ctx_res->key_bin.data, NULL, -1)) {
                 *return_term = EXCP_BADARG_N(env, key_arg_num, "Can't initialize key");
                 goto err;
             }
         }
     else
-        if (!EVP_CipherInit_ex(ctx_res->ctx, NULL, NULL, key_bin.data, ivec_bin.data, -1))
+        if (!EVP_CipherInit_ex(ctx_res->ctx, NULL, NULL, ctx_res->key_bin.data, ivec_bin.data, -1))
             {
                 *return_term = EXCP_ERROR(env, "Can't initialize key or iv");
                 goto err;
@@ -732,11 +733,50 @@ ERL_NIF_TERM ng_crypto_update(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[
 #endif
             {
                 ctx_res_copy.ctx = EVP_CIPHER_CTX_new();
+                if (! ctx_res->ctx)
+                    {
+                        ret = EXCP_ERROR(env, "Can't allocate context");
+                        goto err;
+                    }
 
+#if OPENSSL_VERSION_NUMBER < PACKED_OPENSSL_VERSION_PLAIN(3,0,0)
                 if (!EVP_CIPHER_CTX_copy(ctx_res_copy.ctx, ctx_res->ctx)) {
                     ret = EXCP_ERROR(env, "Can't copy ctx_res");
                     goto err;
                 }
+#else
+
+                if (!EVP_CipherInit_ex(ctx_res_copy.ctx,
+                                       EVP_CIPHER_CTX_cipher(ctx_res->ctx),
+                                       NULL, NULL, NULL, ctx_res->encflag))
+                    {
+                        ret = EXCP_ERROR(env, "Can't initialize context, step 1");
+                        goto err;
+                    }
+
+
+                if (!EVP_CIPHER_CTX_set_key_length(ctx_res_copy.ctx,
+                                                   ctx_res->key_bin.size))
+                    {
+                        ret = EXCP_ERROR(env, "Can't initialize context, key_length");
+                        goto err;
+                    }
+
+
+                if (!EVP_CipherInit_ex(ctx_res_copy.ctx, NULL, NULL,
+                                       ctx_res->key_bin.data,
+                                       NULL, -1))
+                    {
+                        ret = EXCP_ERROR(env, "Can't initialize key or iv");
+                        goto err;
+                    }
+
+                if ((ctx_res->padding == atom_undefined) ||
+                    (ctx_res->padding == atom_none) ||
+                    (ctx_res->padding == atom_zero) ||
+                    (ctx_res->padding == atom_random) )
+                    EVP_CIPHER_CTX_set_padding(ctx_res_copy.ctx, 0);
+#endif
             }
 
         if (!enif_inspect_iolist_as_binary(env, argv[2], &ivec_bin))
@@ -763,14 +803,15 @@ ERL_NIF_TERM ng_crypto_update(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[
                 ctx_res_copy.state = enif_make_tuple4(env, tuple_argv[0], argv[2], tuple_argv[2], tuple_argv[3]);
             }
         } else
-#endif
-            if (!EVP_CipherInit_ex(ctx_res_copy.ctx, NULL, NULL, NULL, ivec_bin.data, -1))
+#endif 
+           if (!EVP_CipherInit_ex(ctx_res_copy.ctx, NULL, NULL, NULL, ivec_bin.data, -1))
                 {
                     ret = EXCP_ERROR(env, "Can't set iv");
                     goto err;
                 }
         
         get_update_args(env, &ctx_res_copy, argv, 1, &ret);
+
         ctx_res->size = ctx_res_copy.size;
     } else
         /* argc != 3, that is, argc = 2 (we don't have an IV in this call) */
diff --git a/lib/crypto/c_src/cipher.c b/lib/crypto/c_src/cipher.c
index b4fd0700f3..d2942ef8f5 100644
--- a/lib/crypto/c_src/cipher.c
+++ b/lib/crypto/c_src/cipher.c
@@ -109,7 +109,11 @@ static struct cipher_type_t cipher_types[] =
     {{"chacha20_poly1305"}, {NULL}, 0, NO_FIPS_CIPHER | AEAD_CIPHER, {{0,0,0}}},
 #endif
 
-#if defined(HAVE_GCM)
+#if defined(HAVE_GCM) && OPENSSL_VERSION_NUMBER >= PACKED_OPENSSL_VERSION_PLAIN(3,0,0)
+    {{"aes_128_gcm"}, {&EVP_aes_128_gcm}, 16, AEAD_CIPHER|GCM_MODE, {{EVP_CTRL_AEAD_SET_IVLEN,EVP_CTRL_AEAD_GET_TAG,EVP_CTRL_AEAD_SET_TAG}}},
+    {{"aes_192_gcm"}, {&EVP_aes_192_gcm}, 24, AEAD_CIPHER|GCM_MODE, {{EVP_CTRL_AEAD_SET_IVLEN,EVP_CTRL_AEAD_GET_TAG,EVP_CTRL_AEAD_SET_TAG}}},
+    {{"aes_256_gcm"}, {&EVP_aes_256_gcm}, 32, AEAD_CIPHER|GCM_MODE, {{EVP_CTRL_AEAD_SET_IVLEN,EVP_CTRL_AEAD_GET_TAG,EVP_CTRL_AEAD_SET_TAG}}},
+#elif defined(HAVE_GCM)
     {{"aes_128_gcm"}, {&EVP_aes_128_gcm}, 16, AEAD_CIPHER|GCM_MODE, {{EVP_CTRL_GCM_SET_IVLEN,EVP_CTRL_GCM_GET_TAG,EVP_CTRL_GCM_SET_TAG}}},
     {{"aes_192_gcm"}, {&EVP_aes_192_gcm}, 24, AEAD_CIPHER|GCM_MODE, {{EVP_CTRL_GCM_SET_IVLEN,EVP_CTRL_GCM_GET_TAG,EVP_CTRL_GCM_SET_TAG}}},
     {{"aes_256_gcm"}, {&EVP_aes_256_gcm}, 32, AEAD_CIPHER|GCM_MODE, {{EVP_CTRL_GCM_SET_IVLEN,EVP_CTRL_GCM_GET_TAG,EVP_CTRL_GCM_SET_TAG}}},
@@ -119,7 +123,11 @@ static struct cipher_type_t cipher_types[] =
     {{"aes_256_gcm"}, {NULL}, 32, AEAD_CIPHER|GCM_MODE, {{0,0,0}}},
 #endif
 
-#if defined(HAVE_CCM)
+#if defined(HAVE_CCM) && OPENSSL_VERSION_NUMBER >= PACKED_OPENSSL_VERSION_PLAIN(3,0,0)
+    {{"aes_128_ccm"}, {&EVP_aes_128_ccm}, 16, AEAD_CIPHER|CCM_MODE, {{EVP_CTRL_AEAD_SET_IVLEN,EVP_CTRL_AEAD_GET_TAG,EVP_CTRL_AEAD_SET_TAG}}},
+    {{"aes_192_ccm"}, {&EVP_aes_192_ccm}, 24, AEAD_CIPHER|CCM_MODE, {{EVP_CTRL_AEAD_SET_IVLEN,EVP_CTRL_AEAD_GET_TAG,EVP_CTRL_AEAD_SET_TAG}}},
+    {{"aes_256_ccm"}, {&EVP_aes_256_ccm}, 32, AEAD_CIPHER|CCM_MODE, {{EVP_CTRL_AEAD_SET_IVLEN,EVP_CTRL_AEAD_GET_TAG,EVP_CTRL_AEAD_SET_TAG}}},
+#elif defined(HAVE_CCM)
     {{"aes_128_ccm"}, {&EVP_aes_128_ccm}, 16, AEAD_CIPHER|CCM_MODE, {{EVP_CTRL_CCM_SET_IVLEN,EVP_CTRL_CCM_GET_TAG,EVP_CTRL_CCM_SET_TAG}}},
     {{"aes_192_ccm"}, {&EVP_aes_192_ccm}, 24, AEAD_CIPHER|CCM_MODE, {{EVP_CTRL_CCM_SET_IVLEN,EVP_CTRL_CCM_GET_TAG,EVP_CTRL_CCM_SET_TAG}}},
     {{"aes_256_ccm"}, {&EVP_aes_256_ccm}, 32, AEAD_CIPHER|CCM_MODE, {{EVP_CTRL_CCM_SET_IVLEN,EVP_CTRL_CCM_GET_TAG,EVP_CTRL_CCM_SET_TAG}}},
diff --git a/lib/crypto/c_src/cipher.h b/lib/crypto/c_src/cipher.h
index 0189e4416b..85d2f4e14c 100644
--- a/lib/crypto/c_src/cipher.h
+++ b/lib/crypto/c_src/cipher.h
@@ -60,6 +60,7 @@ struct evp_cipher_ctx {
     EVP_CIPHER_CTX* ctx;
     int iv_len;
     ERL_NIF_TERM padding; /* id of the padding to add by get_final_args() */
+    ErlNifBinary key_bin;
     int padded_size;   /* Length of the padding that was added */
     int encflag; /* 1 if encrypting, 0 if decrypting */
     unsigned int size; /* The sum of all sizes of input texts to get_update_args() */
-- 
2.31.1

Places

File 1646-crypto-Update-the-EVP_CIPHER_CTX_-usage.patch of Package erlang (Revision 75e053fb70ae9038cf6513f776cd662d)

Places