From: Kirill Isakov Date: Fri, 18 Mar 2022 13:39:28 +0000 (+0600) Subject: Extract common logic in OpenSSL-specific code X-Git-Url: https://tinc-vpn.org/git/browse?a=commitdiff_plain;h=344c632c7a9f8047a412239dcd22ba1531bdfda5;p=tinc Extract common logic in OpenSSL-specific code --- diff --git a/src/openssl/cipher.c b/src/openssl/cipher.c index 77747f11..77538b14 100644 --- a/src/openssl/cipher.c +++ b/src/openssl/cipher.c @@ -27,6 +27,10 @@ #include "../cipher.h" #include "../logger.h" +typedef int (enc_init_t)(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, ENGINE *impl, const unsigned char *key, const unsigned char *iv); +typedef int (enc_update_t)(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl, const unsigned char *in, int inl); +typedef int (enc_final_t)(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl); + static void cipher_open(cipher_t *cipher, const EVP_CIPHER *evp_cipher) { cipher->cipher = evp_cipher; cipher->ctx = EVP_CIPHER_CTX_new(); @@ -107,13 +111,13 @@ size_t cipher_blocksize(const cipher_t *cipher) { return EVP_CIPHER_block_size(cipher->cipher); } -bool cipher_set_key(cipher_t *cipher, void *key, bool encrypt) { +static bool cipher_init_ctx(cipher_t *cipher, bool encrypt, const unsigned char *key, const unsigned char *iv) { bool result; if(encrypt) { - result = EVP_EncryptInit_ex(cipher->ctx, cipher->cipher, NULL, (unsigned char *)key, (unsigned char *)key + EVP_CIPHER_key_length(cipher->cipher)); + result = EVP_EncryptInit_ex(cipher->ctx, cipher->cipher, NULL, key, iv); } else { - result = EVP_DecryptInit_ex(cipher->ctx, cipher->cipher, NULL, (unsigned char *)key, (unsigned char *)key + EVP_CIPHER_key_length(cipher->cipher)); + result = EVP_DecryptInit_ex(cipher->ctx, cipher->cipher, NULL, key, iv); } if(result) { @@ -124,30 +128,25 @@ bool cipher_set_key(cipher_t *cipher, void *key, bool encrypt) { return false; } -bool cipher_set_key_from_rsa(cipher_t *cipher, void *key, size_t len, bool encrypt) { - bool result; - - if(encrypt) { - result = EVP_EncryptInit_ex(cipher->ctx, cipher->cipher, NULL, (unsigned char *)key + len - EVP_CIPHER_key_length(cipher->cipher), (unsigned char *)key + len - EVP_CIPHER_iv_length(cipher->cipher) - EVP_CIPHER_key_length(cipher->cipher)); - } else { - result = EVP_DecryptInit_ex(cipher->ctx, cipher->cipher, NULL, (unsigned char *)key + len - EVP_CIPHER_key_length(cipher->cipher), (unsigned char *)key + len - EVP_CIPHER_iv_length(cipher->cipher) - EVP_CIPHER_key_length(cipher->cipher)); - } - - if(result) { - return true; - } +bool cipher_set_key(cipher_t *cipher, void *key, bool encrypt) { + unsigned char *iv = (unsigned char *)key + EVP_CIPHER_key_length(cipher->cipher); + return cipher_init_ctx(cipher, encrypt, key, iv); +} - openssl_err("set key"); - return false; +bool cipher_set_key_from_rsa(cipher_t *cipher, void *key, size_t len, bool encrypt) { + unsigned char *k = (unsigned char *)key + len - EVP_CIPHER_key_length(cipher->cipher); + unsigned char *iv = k - EVP_CIPHER_iv_length(cipher->cipher); + return cipher_init_ctx(cipher, encrypt, k, iv); } -bool cipher_encrypt(cipher_t *cipher, const void *indata, size_t inlen, void *outdata, size_t *outlen, bool oneshot) { +static bool cipher_encrypt_decrypt(cipher_t *cipher, const void *indata, size_t inlen, void *outdata, size_t *outlen, bool oneshot, + enc_init_t init, enc_update_t update, enc_final_t final) { if(oneshot) { int len, pad; - if(EVP_EncryptInit_ex(cipher->ctx, NULL, NULL, NULL, NULL) - && EVP_EncryptUpdate(cipher->ctx, (unsigned char *)outdata, &len, indata, (int)inlen) - && EVP_EncryptFinal_ex(cipher->ctx, (unsigned char *)outdata + len, &pad)) { + if(init(cipher->ctx, NULL, NULL, NULL, NULL) + && update(cipher->ctx, (unsigned char *)outdata, &len, indata, (int)inlen) + && final(cipher->ctx, (unsigned char *)outdata + len, &pad)) { if(outlen) { *outlen = len + pad; } @@ -157,7 +156,7 @@ bool cipher_encrypt(cipher_t *cipher, const void *indata, size_t inlen, void *ou } else { int len; - if(EVP_EncryptUpdate(cipher->ctx, outdata, &len, indata, (int)inlen)) { + if(update(cipher->ctx, outdata, &len, indata, (int)inlen)) { if(outlen) { *outlen = len; } @@ -166,37 +165,18 @@ bool cipher_encrypt(cipher_t *cipher, const void *indata, size_t inlen, void *ou } } - openssl_err("encrypt data"); + openssl_err("encrypt or decrypt data"); return false; } -bool cipher_decrypt(cipher_t *cipher, const void *indata, size_t inlen, void *outdata, size_t *outlen, bool oneshot) { - if(oneshot) { - int len, pad; - - if(EVP_DecryptInit_ex(cipher->ctx, NULL, NULL, NULL, NULL) - && EVP_DecryptUpdate(cipher->ctx, (unsigned char *)outdata, &len, indata, (int)inlen) - && EVP_DecryptFinal_ex(cipher->ctx, (unsigned char *)outdata + len, &pad)) { - if(outlen) { - *outlen = len + pad; - } - - return true; - } - } else { - int len; - - if(EVP_DecryptUpdate(cipher->ctx, outdata, &len, indata, (int)inlen)) { - if(outlen) { - *outlen = len; - } - - return true; - } - } +bool cipher_encrypt(cipher_t *cipher, const void *indata, size_t inlen, void *outdata, size_t *outlen, bool oneshot) { + return cipher_encrypt_decrypt(cipher, indata, inlen, outdata, outlen, oneshot, + EVP_EncryptInit_ex, EVP_EncryptUpdate, EVP_EncryptFinal_ex); +} - openssl_err("decrypt data"); - return false; +bool cipher_decrypt(cipher_t *cipher, const void *indata, size_t inlen, void *outdata, size_t *outlen, bool oneshot) { + return cipher_encrypt_decrypt(cipher, indata, inlen, outdata, outlen, oneshot, + EVP_DecryptInit_ex, EVP_DecryptUpdate, EVP_DecryptFinal_ex); } int cipher_get_nid(const cipher_t *cipher) { diff --git a/src/openssl/rsa.c b/src/openssl/rsa.c index bf6938b9..a4e4ac69 100644 --- a/src/openssl/rsa.c +++ b/src/openssl/rsa.c @@ -199,22 +199,23 @@ size_t rsa_size(const rsa_t *rsa) { #endif } -bool rsa_public_encrypt(rsa_t *rsa, const void *in, size_t len, void *out) { -#if OPENSSL_VERSION_MAJOR < 3 +#if OPENSSL_VERSION_MAJOR >= 3 +// Initialize encryption or decryption context. Must return >0 on success, ≤0 on failure. +typedef int (enc_init_t)(EVP_PKEY_CTX *ctx); - if((size_t)RSA_public_encrypt((int) len, in, out, rsa, RSA_NO_PADDING) == len) { - return true; - } +// Encrypt or decrypt data. Must return >0 on success, ≤0 on failure. +typedef int (enc_process_t)(EVP_PKEY_CTX *ctx, unsigned char *out, size_t *outlen, const unsigned char *in, size_t inlen); -#else +static bool rsa_encrypt_decrypt(rsa_t *rsa, const void *in, size_t len, void *out, + enc_init_t init, enc_process_t process) { EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new(rsa, NULL); if(ctx) { size_t outlen = len; - bool ok = EVP_PKEY_encrypt_init(ctx) > 0 + bool ok = init(ctx) > 0 && EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_NO_PADDING) > 0 - && EVP_PKEY_encrypt(ctx, out, &outlen, in, len) > 0 + && process(ctx, out, &outlen, in, len) > 0 && outlen == len; EVP_PKEY_CTX_free(ctx); @@ -224,8 +225,21 @@ bool rsa_public_encrypt(rsa_t *rsa, const void *in, size_t len, void *out) { } } + return false; +} #endif +bool rsa_public_encrypt(rsa_t *rsa, const void *in, size_t len, void *out) { +#if OPENSSL_VERSION_MAJOR < 3 + + if((size_t)RSA_public_encrypt((int) len, in, out, rsa, RSA_NO_PADDING) == len) { +#else + + if(rsa_encrypt_decrypt(rsa, in, len, out, EVP_PKEY_encrypt_init, EVP_PKEY_encrypt)) { +#endif + return true; + } + openssl_err("perform RSA encryption"); return false; } @@ -234,28 +248,12 @@ bool rsa_private_decrypt(rsa_t *rsa, const void *in, size_t len, void *out) { #if OPENSSL_VERSION_MAJOR < 3 if((size_t)RSA_private_decrypt((int) len, in, out, rsa, RSA_NO_PADDING) == len) { - return true; - } - #else - EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new(rsa, NULL); - - if(ctx) { - size_t outlen = len; - - bool ok = EVP_PKEY_decrypt_init(ctx) > 0 - && EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_NO_PADDING) > 0 - && EVP_PKEY_decrypt(ctx, out, &outlen, in, len) > 0 - && outlen == len; - - EVP_PKEY_CTX_free(ctx); - - if(ok) { - return true; - } - } + if(rsa_encrypt_decrypt(rsa, in, len, out, EVP_PKEY_decrypt_init, EVP_PKEY_decrypt)) { #endif + return true; + } openssl_err("perform RSA decryption"); return false;