From: Gleb Pesin <[email protected]> OpenSSL 3.0.3 and newer can reinitialize an EVP_MAC HMAC context with its existing key when EVP_MAC_init is called without parameters. Use that path instead of supplying the digest and key again on every OpenVPN HMAC reset.
Retain the old parameter-based reset for OpenSSL 3.0.0 through 3.0.2, where parameterless EVP_MAC reinitialization did not reset the underlying HMAC implementation. Change-Id: I1913a6e64b7ce22b66d2034df2a2fac33f60ea9f Signed-off-by: Arne Schwabe <[email protected]> Acked-by: Arne Schwabe <[email protected]> Acked-by: Razvan Cojocaru <[email protected]> Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1840 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1840 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Arne Schwabe <[email protected]> Razvan Cojocaru <[email protected]> diff --git a/src/openvpn/crypto_openssl.c b/src/openvpn/crypto_openssl.c index 1191f20..2019280 100644 --- a/src/openvpn/crypto_openssl.c +++ b/src/openvpn/crypto_openssl.c @@ -1209,7 +1209,7 @@ HMAC_Final(ctx, dst, &in_hmac_len); } -#else /* if OPENSSL_VERSION_NUMBER < 0x30000000L */ +#else /* if OPENSSL_VERSION_NUMBER < 0x30000000L */ hmac_ctx_t * hmac_ctx_new(void) { @@ -1275,10 +1275,14 @@ void hmac_ctx_reset(hmac_ctx_t *ctx) { - /* The OpenSSL MAC API lacks a reset method and passing NULL as params - * does not reset it either, so use the params array to reinitialise it the - * same way as before */ - if (!EVP_MAC_init(ctx->ctx, NULL, 0, ctx->params)) + /* OpenSSL 3.0.3 fixed EVP_MAC reinitialization with an existing key. + * Older versions need the parameters, including the key, to reset. */ +#if OPENSSL_VERSION_NUMBER >= 0x30000030L + const OSSL_PARAM *params = NULL; +#else + const OSSL_PARAM *params = ctx->params; +#endif + if (!EVP_MAC_init(ctx->ctx, NULL, 0, params)) { crypto_msg(M_FATAL, "EVP_MAC_init failed"); } _______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
