URL: https://github.com/SSSD/sssd/pull/54 Author: lslebodn Title: #54: crypto: Port libcrypto code to openssl-1.1 Action: opened
PR body: """ I am not sure whether using EVP_.*_init() is required after calling "constructor" """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/54/head:pr54 git checkout pr54
From 33c56eb8e3169592f82c7df368016c0b773044e2 Mon Sep 17 00:00:00 2001 From: Lukas Slebodnik <lsleb...@redhat.com> Date: Mon, 17 Oct 2016 15:44:20 +0200 Subject: [PATCH] crypto: Port libcrypto code to openssl-1.1 --- src/util/cert/libcrypto/cert.c | 24 ++++++-- src/util/crypto/libcrypto/crypto_hmac_sha1.c | 32 ++++++----- src/util/crypto/libcrypto/crypto_nite.c | 78 +++++++++++++++++--------- src/util/crypto/libcrypto/crypto_obfuscate.c | 34 +++++++---- src/util/crypto/libcrypto/crypto_sha512crypt.c | 76 ++++++++++++++----------- 5 files changed, 153 insertions(+), 91 deletions(-) diff --git a/src/util/cert/libcrypto/cert.c b/src/util/cert/libcrypto/cert.c index a7752d7..eb84b3b 100644 --- a/src/util/cert/libcrypto/cert.c +++ b/src/util/cert/libcrypto/cert.c @@ -182,6 +182,9 @@ errno_t cert_to_ssh_key(TALLOC_CTX *mem_ctx, const char *ca_db, size_t c; X509 *cert = NULL; EVP_PKEY *cert_pub_key = NULL; + RSA *rsa_pub_key = NULL; + const BIGNUM *n; + const BIGNUM *e; int modulus_len; unsigned char modulus[OPENSSL_RSA_MAX_MODULUS_BITS/8]; int exponent_len; @@ -208,16 +211,29 @@ errno_t cert_to_ssh_key(TALLOC_CTX *mem_ctx, const char *ca_db, goto done; } - if (cert_pub_key->type != EVP_PKEY_RSA) { + if (EVP_PKEY_base_id(cert_pub_key) != EVP_PKEY_RSA) { DEBUG(SSSDBG_CRIT_FAILURE, "Expected RSA public key, found unsupported [%d].\n", - cert_pub_key->type); + EVP_PKEY_base_id(cert_pub_key)); ret = EINVAL; goto done; } - modulus_len = BN_bn2bin(cert_pub_key->pkey.rsa->n, modulus); - exponent_len = BN_bn2bin(cert_pub_key->pkey.rsa->e, exponent); +#if OPENSSL_VERSION_NUMBER >= 0x10100000L + rsa_pub_key = EVP_PKEY_get1_RSA(cert_pub_key); + if (rsa_pub_key == NULL) { + ret = ENOMEM; + goto done; + } + + RSA_get0_key(rsa_pub_key, &n, &e, NULL); + RSA_free(rsa_pub_key); +#else + n = cert_pub_key->pkey.rsa->n; + e = cert_pub_key->pkey.rsa->e; +#endif + modulus_len = BN_bn2bin(n, modulus); + exponent_len = BN_bn2bin(e, exponent); size = SSH_RSA_HEADER_LEN + 3 * sizeof(uint32_t) + modulus_len diff --git a/src/util/crypto/libcrypto/crypto_hmac_sha1.c b/src/util/crypto/libcrypto/crypto_hmac_sha1.c index 37d2579..e1964df 100644 --- a/src/util/crypto/libcrypto/crypto_hmac_sha1.c +++ b/src/util/crypto/libcrypto/crypto_hmac_sha1.c @@ -33,23 +33,27 @@ int sss_hmac_sha1(const unsigned char *key, unsigned char *out) { int ret; - EVP_MD_CTX ctx; + EVP_MD_CTX *ctx; unsigned char ikey[HMAC_SHA1_BLOCKSIZE], okey[HMAC_SHA1_BLOCKSIZE]; size_t i; unsigned char hash[SSS_SHA1_LENGTH]; unsigned int res_len; - EVP_MD_CTX_init(&ctx); + ctx = EVP_MD_CTX_create(); + if (ctx == NULL) { + return ENOMEM; + } + EVP_MD_CTX_init(ctx); if (key_len > HMAC_SHA1_BLOCKSIZE) { /* keys longer than blocksize are shortened */ - if (!EVP_DigestInit_ex(&ctx, EVP_sha1(), NULL)) { + if (!EVP_DigestInit_ex(ctx, EVP_sha1(), NULL)) { ret = EIO; goto done; } - EVP_DigestUpdate(&ctx, (const unsigned char *)key, key_len); - EVP_DigestFinal_ex(&ctx, ikey, &res_len); + EVP_DigestUpdate(ctx, (const unsigned char *)key, key_len); + EVP_DigestFinal_ex(ctx, ikey, &res_len); memset(ikey + SSS_SHA1_LENGTH, 0, HMAC_SHA1_BLOCKSIZE - SSS_SHA1_LENGTH); } else { /* keys shorter than blocksize are zero-padded */ @@ -63,25 +67,25 @@ int sss_hmac_sha1(const unsigned char *key, ikey[i] ^= 0x36; } - if (!EVP_DigestInit_ex(&ctx, EVP_sha1(), NULL)) { + if (!EVP_DigestInit_ex(ctx, EVP_sha1(), NULL)) { ret = EIO; goto done; } - EVP_DigestUpdate(&ctx, (const unsigned char *)ikey, HMAC_SHA1_BLOCKSIZE); - EVP_DigestUpdate(&ctx, (const unsigned char *)in, in_len); - EVP_DigestFinal_ex(&ctx, hash, &res_len); + EVP_DigestUpdate(ctx, (const unsigned char *)ikey, HMAC_SHA1_BLOCKSIZE); + EVP_DigestUpdate(ctx, (const unsigned char *)in, in_len); + EVP_DigestFinal_ex(ctx, hash, &res_len); - if (!EVP_DigestInit_ex(&ctx, EVP_sha1(), NULL)) { + if (!EVP_DigestInit_ex(ctx, EVP_sha1(), NULL)) { ret = EIO; goto done; } - EVP_DigestUpdate(&ctx, (const unsigned char *)okey, HMAC_SHA1_BLOCKSIZE); - EVP_DigestUpdate(&ctx, (const unsigned char *)hash, SSS_SHA1_LENGTH); - EVP_DigestFinal_ex(&ctx, out, &res_len); + EVP_DigestUpdate(ctx, (const unsigned char *)okey, HMAC_SHA1_BLOCKSIZE); + EVP_DigestUpdate(ctx, (const unsigned char *)hash, SSS_SHA1_LENGTH); + EVP_DigestFinal_ex(ctx, out, &res_len); ret = EOK; done: - EVP_MD_CTX_cleanup(&ctx); + EVP_MD_CTX_destroy(ctx); return ret; } diff --git a/src/util/crypto/libcrypto/crypto_nite.c b/src/util/crypto/libcrypto/crypto_nite.c index fa267fb..005eeb5 100644 --- a/src/util/crypto/libcrypto/crypto_nite.c +++ b/src/util/crypto/libcrypto/crypto_nite.c @@ -47,9 +47,9 @@ int sss_encrypt(TALLOC_CTX *mem_ctx, enum encmethod enctype, { const EVP_CIPHER *cipher; const EVP_MD *digest; - EVP_PKEY *hmackey; - EVP_CIPHER_CTX ctx; - EVP_MD_CTX mdctx; + EVP_PKEY *hmackey = NULL; + EVP_CIPHER_CTX *ctx; + EVP_MD_CTX *mdctx = NULL; uint8_t *out = NULL; int evpkeylen; int evpivlen; @@ -86,8 +86,14 @@ int sss_encrypt(TALLOC_CTX *mem_ctx, enum encmethod enctype, RAND_bytes(out, evpivlen); } - EVP_CIPHER_CTX_init(&ctx); - ret = EVP_EncryptInit_ex(&ctx, cipher, 0, key, evpivlen ? out : NULL); + ctx = EVP_CIPHER_CTX_new(); + if (ctx == NULL) { + ret = ENOMEM; + goto done; + } + EVP_CIPHER_CTX_init(ctx); + + ret = EVP_EncryptInit_ex(ctx, cipher, 0, key, evpivlen ? out : NULL); if (ret != 1) { ret = EFAULT; goto done; @@ -95,7 +101,7 @@ int sss_encrypt(TALLOC_CTX *mem_ctx, enum encmethod enctype, outlen = evpivlen; tmplen = 0; - ret = EVP_EncryptUpdate(&ctx, out + outlen, &tmplen, plaintext, plainlen); + ret = EVP_EncryptUpdate(ctx, out + outlen, &tmplen, plaintext, plainlen); if (ret != 1) { ret = EFAULT; goto done; @@ -103,7 +109,7 @@ int sss_encrypt(TALLOC_CTX *mem_ctx, enum encmethod enctype, outlen += tmplen; - ret = EVP_EncryptFinal_ex(&ctx, out + outlen, &tmplen); + ret = EVP_EncryptFinal_ex(ctx, out + outlen, &tmplen); if (ret != 1) { ret = EFAULT; goto done; @@ -113,28 +119,33 @@ int sss_encrypt(TALLOC_CTX *mem_ctx, enum encmethod enctype, /* Then HMAC */ - EVP_MD_CTX_init(&mdctx); + mdctx = EVP_MD_CTX_create(); + if (mdctx == NULL) { + ret = ENOMEM; + goto done; + } + EVP_MD_CTX_init(mdctx); - ret = EVP_DigestInit_ex(&mdctx, digest, NULL); + ret = EVP_DigestInit_ex(mdctx, digest, NULL); if (ret != 1) { ret = EFAULT; goto done; } - ret = EVP_DigestSignInit(&mdctx, NULL, digest, NULL, hmackey); + ret = EVP_DigestSignInit(mdctx, NULL, digest, NULL, hmackey); if (ret != 1) { ret = EFAULT; goto done; } - ret = EVP_DigestSignUpdate(&mdctx, out, outlen); + ret = EVP_DigestSignUpdate(mdctx, out, outlen); if (ret != 1) { ret = EFAULT; goto done; } slen = hmaclen; - ret = EVP_DigestSignFinal(&mdctx, &out[outlen], &slen); + ret = EVP_DigestSignFinal(mdctx, &out[outlen], &slen); if (ret != 1) { ret = EFAULT; goto done; @@ -147,8 +158,8 @@ int sss_encrypt(TALLOC_CTX *mem_ctx, enum encmethod enctype, ret = EOK; done: - EVP_MD_CTX_cleanup(&mdctx); - EVP_CIPHER_CTX_cleanup(&ctx); + EVP_MD_CTX_destroy(mdctx); + EVP_CIPHER_CTX_free(ctx); EVP_PKEY_free(hmackey); return ret; } @@ -160,9 +171,9 @@ int sss_decrypt(TALLOC_CTX *mem_ctx, enum encmethod enctype, { const EVP_CIPHER *cipher; const EVP_MD *digest; - EVP_PKEY *hmackey; - EVP_CIPHER_CTX ctx; - EVP_MD_CTX mdctx; + EVP_PKEY *hmackey = NULL; + EVP_CIPHER_CTX *ctx = NULL; + EVP_MD_CTX *mdctx; const uint8_t *iv = NULL; uint8_t *out; int evpkeylen; @@ -194,28 +205,33 @@ int sss_decrypt(TALLOC_CTX *mem_ctx, enum encmethod enctype, /* First check HMAC */ - EVP_MD_CTX_init(&mdctx); + mdctx = EVP_MD_CTX_create(); + if (mdctx == NULL) { + ret = ENOMEM; + goto done; + } + EVP_MD_CTX_init(mdctx); - ret = EVP_DigestInit_ex(&mdctx, digest, NULL); + ret = EVP_DigestInit_ex(mdctx, digest, NULL); if (ret != 1) { ret = EFAULT; goto done; } - ret = EVP_DigestSignInit(&mdctx, NULL, digest, NULL, hmackey); + ret = EVP_DigestSignInit(mdctx, NULL, digest, NULL, hmackey); if (ret != 1) { ret = EFAULT; goto done; } - ret = EVP_DigestSignUpdate(&mdctx, ciphertext, cipherlen - hmaclen); + ret = EVP_DigestSignUpdate(mdctx, ciphertext, cipherlen - hmaclen); if (ret != 1) { ret = EFAULT; goto done; } slen = hmaclen; - ret = EVP_DigestSignFinal(&mdctx, out, &slen); + ret = EVP_DigestSignFinal(mdctx, out, &slen); if (ret != 1) { ret = EFAULT; goto done; @@ -233,14 +249,20 @@ int sss_decrypt(TALLOC_CTX *mem_ctx, enum encmethod enctype, iv = ciphertext; } - EVP_CIPHER_CTX_init(&ctx); - ret = EVP_DecryptInit_ex(&ctx, cipher, 0, key, iv); + ctx = EVP_CIPHER_CTX_new(); + if (ctx == NULL) { + ret = ENOMEM; + goto done; + } + EVP_CIPHER_CTX_init(ctx); + + ret = EVP_DecryptInit_ex(ctx, cipher, 0, key, iv); if (ret != 1) { ret = EFAULT; goto done; } - ret = EVP_DecryptUpdate(&ctx, out, &outlen, + ret = EVP_DecryptUpdate(ctx, out, &outlen, ciphertext + evpivlen, cipherlen - evpivlen - hmaclen); if (ret != 1) { @@ -248,7 +270,7 @@ int sss_decrypt(TALLOC_CTX *mem_ctx, enum encmethod enctype, goto done; } - ret = EVP_DecryptFinal_ex(&ctx, out + outlen, &tmplen); + ret = EVP_DecryptFinal_ex(ctx, out + outlen, &tmplen); if (ret != 1) { ret = EFAULT; goto done; @@ -261,8 +283,8 @@ int sss_decrypt(TALLOC_CTX *mem_ctx, enum encmethod enctype, ret = EOK; done: - EVP_MD_CTX_cleanup(&mdctx); - EVP_CIPHER_CTX_cleanup(&ctx); + EVP_MD_CTX_destroy(mdctx); + EVP_CIPHER_CTX_free(ctx); EVP_PKEY_free(hmackey); return ret; } diff --git a/src/util/crypto/libcrypto/crypto_obfuscate.c b/src/util/crypto/libcrypto/crypto_obfuscate.c index 85de333..11c84f4 100644 --- a/src/util/crypto/libcrypto/crypto_obfuscate.c +++ b/src/util/crypto/libcrypto/crypto_obfuscate.c @@ -70,7 +70,7 @@ int sss_password_encrypt(TALLOC_CTX *mem_ctx, const char *password, int plen, enum obfmethod meth, char **obfpwd) { int ret; - EVP_CIPHER_CTX ctx; + EVP_CIPHER_CTX *ctx; struct crypto_mech_data *mech_props; TALLOC_CTX *tmp_ctx = NULL; unsigned char *keybuf; @@ -90,7 +90,12 @@ int sss_password_encrypt(TALLOC_CTX *mem_ctx, const char *password, int plen, return ENOMEM; } - EVP_CIPHER_CTX_init(&ctx); + ctx = EVP_CIPHER_CTX_new(); + if (ctx == NULL) { + ret = ENOMEM; + goto done; + } + EVP_CIPHER_CTX_init(ctx); mech_props = get_crypto_mech_data(meth); if (mech_props == NULL) { @@ -121,20 +126,20 @@ int sss_password_encrypt(TALLOC_CTX *mem_ctx, const char *password, int plen, goto done; } - if (!EVP_EncryptInit_ex(&ctx, mech_props->cipher(), 0, keybuf, ivbuf)) { + if (!EVP_EncryptInit_ex(ctx, mech_props->cipher(), 0, keybuf, ivbuf)) { DEBUG(SSSDBG_CRIT_FAILURE, "Failure to initialize cipher contex\n"); ret = EIO; goto done; } /* sample data we'll encrypt and decrypt */ - if (!EVP_EncryptUpdate(&ctx, cryptotext, &ctlen, (const unsigned char*)password, plen)) { + if (!EVP_EncryptUpdate(ctx, cryptotext, &ctlen, (const unsigned char *)password, plen)) { DEBUG(SSSDBG_CRIT_FAILURE, "Cannot execute the encryption operation\n"); ret = EIO; goto done; } - if(!EVP_EncryptFinal_ex(&ctx, cryptotext+ctlen, &digestlen)) { + if (!EVP_EncryptFinal_ex(ctx, cryptotext + ctlen, &digestlen)) { DEBUG(SSSDBG_CRIT_FAILURE, "Cannot finialize the encryption operation\n"); ret = EIO; goto done; @@ -185,7 +190,7 @@ int sss_password_encrypt(TALLOC_CTX *mem_ctx, const char *password, int plen, done: talloc_free(tmp_ctx); - EVP_CIPHER_CTX_cleanup(&ctx); + EVP_CIPHER_CTX_free(ctx); return ret; } @@ -193,7 +198,7 @@ int sss_password_decrypt(TALLOC_CTX *mem_ctx, char *b64encoded, char **password) { int ret; - EVP_CIPHER_CTX ctx; + EVP_CIPHER_CTX *ctx; TALLOC_CTX *tmp_ctx = NULL; struct crypto_mech_data *mech_props; @@ -217,7 +222,12 @@ int sss_password_decrypt(TALLOC_CTX *mem_ctx, char *b64encoded, return ENOMEM; } - EVP_CIPHER_CTX_init(&ctx); + ctx = EVP_CIPHER_CTX_new(); + if (ctx == NULL) { + ret = ENOMEM; + goto done; + } + EVP_CIPHER_CTX_init(ctx); /* Base64 decode the incoming buffer */ obfbuf = sss_base64_decode(tmp_ctx, b64encoded, &obflen); @@ -276,18 +286,18 @@ int sss_password_decrypt(TALLOC_CTX *mem_ctx, char *b64encoded, goto done; } - if (!EVP_DecryptInit_ex(&ctx, mech_props->cipher(), 0, keybuf, ivbuf)) { + if (!EVP_DecryptInit_ex(ctx, mech_props->cipher(), 0, keybuf, ivbuf)) { ret = EIO; goto done; } /* sample data we'll encrypt and decrypt */ - if (!EVP_DecryptUpdate(&ctx, (unsigned char*)pwdbuf, &plainlen, cryptotext, ctsize)) { + if (!EVP_DecryptUpdate(ctx, (unsigned char *)pwdbuf, &plainlen, cryptotext, ctsize)) { ret = EIO; goto done; } - if(!EVP_DecryptFinal_ex(&ctx, (unsigned char*)pwdbuf+plainlen, &digestlen)) { + if (!EVP_DecryptFinal_ex(ctx, (unsigned char *)pwdbuf + plainlen, &digestlen)) { ret = EIO; goto done; } @@ -296,6 +306,6 @@ int sss_password_decrypt(TALLOC_CTX *mem_ctx, char *b64encoded, ret = EOK; done: talloc_free(tmp_ctx); - EVP_CIPHER_CTX_cleanup(&ctx); + EVP_CIPHER_CTX_free(ctx); return ret; } diff --git a/src/util/crypto/libcrypto/crypto_sha512crypt.c b/src/util/crypto/libcrypto/crypto_sha512crypt.c index 34547d0..57e5de5 100644 --- a/src/util/crypto/libcrypto/crypto_sha512crypt.c +++ b/src/util/crypto/libcrypto/crypto_sha512crypt.c @@ -75,8 +75,8 @@ static int sha512_crypt_r(const char *key, unsigned char alt_result[64] __attribute__((__aligned__(ALIGN64))); size_t rounds = ROUNDS_DEFAULT; bool rounds_custom = false; - EVP_MD_CTX alt_ctx; - EVP_MD_CTX ctx; + EVP_MD_CTX *alt_ctx; + EVP_MD_CTX *ctx; size_t salt_len; size_t key_len; size_t cnt; @@ -125,75 +125,85 @@ static int sha512_crypt_r(const char *key, salt = copied_salt = memcpy(tmp + ALIGN64 - PTR_2_INT(tmp) % ALIGN64, salt, salt_len); } - EVP_MD_CTX_init(&ctx); + ctx = EVP_MD_CTX_create(); + if (ctx == NULL) { + ret = ENOMEM; + goto done; + } + EVP_MD_CTX_init(ctx); - EVP_MD_CTX_init(&alt_ctx); + alt_ctx = EVP_MD_CTX_create(); + if (alt_ctx == NULL) { + ret = ENOMEM; + goto done; + } + EVP_MD_CTX_init(alt_ctx); /* Prepare for the real work. */ - if (!EVP_DigestInit_ex(&ctx, EVP_sha512(), NULL)) { + if (!EVP_DigestInit_ex(ctx, EVP_sha512(), NULL)) { ret = EIO; goto done; } /* Add the key string. */ - EVP_DigestUpdate(&ctx, (const unsigned char *)key, key_len); + EVP_DigestUpdate(ctx, (const unsigned char *)key, key_len); /* The last part is the salt string. This must be at most 16 * characters and it ends at the first `$' character (for * compatibility with existing implementations). */ - EVP_DigestUpdate(&ctx, (const unsigned char *)salt, salt_len); + EVP_DigestUpdate(ctx, (const unsigned char *)salt, salt_len); /* Compute alternate SHA512 sum with input KEY, SALT, and KEY. * The final result will be added to the first context. */ - if (!EVP_DigestInit_ex(&alt_ctx, EVP_sha512(), NULL)) { + if (!EVP_DigestInit_ex(alt_ctx, EVP_sha512(), NULL)) { ret = EIO; goto done; } /* Add key. */ - EVP_DigestUpdate(&alt_ctx, (const unsigned char *)key, key_len); + EVP_DigestUpdate(alt_ctx, (const unsigned char *)key, key_len); /* Add salt. */ - EVP_DigestUpdate(&alt_ctx, (const unsigned char *)salt, salt_len); + EVP_DigestUpdate(alt_ctx, (const unsigned char *)salt, salt_len); /* Add key again. */ - EVP_DigestUpdate(&alt_ctx, (const unsigned char *)key, key_len); + EVP_DigestUpdate(alt_ctx, (const unsigned char *)key, key_len); /* Now get result of this (64 bytes) and add it to the other context. */ - EVP_DigestFinal_ex(&alt_ctx, alt_result, &part); + EVP_DigestFinal_ex(alt_ctx, alt_result, &part); /* Add for any character in the key one byte of the alternate sum. */ for (cnt = key_len; cnt > 64; cnt -= 64) { - EVP_DigestUpdate(&ctx, alt_result, 64); + EVP_DigestUpdate(ctx, alt_result, 64); } - EVP_DigestUpdate(&ctx, alt_result, cnt); + EVP_DigestUpdate(ctx, alt_result, cnt); /* Take the binary representation of the length of the key and for every * 1 add the alternate sum, for every 0 the key. */ for (cnt = key_len; cnt > 0; cnt >>= 1) { if ((cnt & 1) != 0) { - EVP_DigestUpdate(&ctx, alt_result, 64); + EVP_DigestUpdate(ctx, alt_result, 64); } else { - EVP_DigestUpdate(&ctx, (const unsigned char *)key, key_len); + EVP_DigestUpdate(ctx, (const unsigned char *)key, key_len); } } /* Create intermediate result. */ - EVP_DigestFinal_ex(&ctx, alt_result, &part); + EVP_DigestFinal_ex(ctx, alt_result, &part); /* Start computation of P byte sequence. */ - if (!EVP_DigestInit_ex(&alt_ctx, EVP_sha512(), NULL)) { + if (!EVP_DigestInit_ex(alt_ctx, EVP_sha512(), NULL)) { ret = EIO; goto done; } /* For every character in the password add the entire password. */ for (cnt = 0; cnt < key_len; cnt++) { - EVP_DigestUpdate(&alt_ctx, (const unsigned char *)key, key_len); + EVP_DigestUpdate(alt_ctx, (const unsigned char *)key, key_len); } /* Finish the digest. */ - EVP_DigestFinal_ex(&alt_ctx, temp_result, &part); + EVP_DigestFinal_ex(alt_ctx, temp_result, &part); /* Create byte sequence P. */ cp = p_bytes = alloca(key_len); @@ -203,18 +213,18 @@ static int sha512_crypt_r(const char *key, memcpy(cp, temp_result, cnt); /* Start computation of S byte sequence. */ - if (!EVP_DigestInit_ex(&alt_ctx, EVP_sha512(), NULL)) { + if (!EVP_DigestInit_ex(alt_ctx, EVP_sha512(), NULL)) { ret = EIO; goto done; } /* For every character in the password add the entire salt. */ for (cnt = 0; cnt < 16 + alt_result[0]; cnt++) { - EVP_DigestUpdate(&alt_ctx, (const unsigned char *)salt, salt_len); + EVP_DigestUpdate(alt_ctx, (const unsigned char *)salt, salt_len); } /* Finish the digest. */ - EVP_DigestFinal_ex(&alt_ctx, temp_result, &part); + EVP_DigestFinal_ex(alt_ctx, temp_result, &part); /* Create byte sequence S. */ cp = s_bytes = alloca(salt_len); @@ -226,37 +236,37 @@ static int sha512_crypt_r(const char *key, /* Repeatedly run the collected hash value through SHA512 to burn CPU cycles. */ for (cnt = 0; cnt < rounds; cnt++) { - if (!EVP_DigestInit_ex(&ctx, EVP_sha512(), NULL)) { + if (!EVP_DigestInit_ex(ctx, EVP_sha512(), NULL)) { ret = EIO; goto done; } /* Add key or last result. */ if ((cnt & 1) != 0) { - EVP_DigestUpdate(&ctx, (const unsigned char *)p_bytes, key_len); + EVP_DigestUpdate(ctx, (const unsigned char *)p_bytes, key_len); } else { - EVP_DigestUpdate(&ctx, alt_result, 64); + EVP_DigestUpdate(ctx, alt_result, 64); } /* Add salt for numbers not divisible by 3. */ if (cnt % 3 != 0) { - EVP_DigestUpdate(&ctx, (const unsigned char *)s_bytes, salt_len); + EVP_DigestUpdate(ctx, (const unsigned char *)s_bytes, salt_len); } /* Add key for numbers not divisible by 7. */ if (cnt % 7 != 0) { - EVP_DigestUpdate(&ctx, (const unsigned char *)p_bytes, key_len); + EVP_DigestUpdate(ctx, (const unsigned char *)p_bytes, key_len); } /* Add key or last result. */ if ((cnt & 1) != 0) { - EVP_DigestUpdate(&ctx, alt_result, 64); + EVP_DigestUpdate(ctx, alt_result, 64); } else { - EVP_DigestUpdate(&ctx, (const unsigned char *)p_bytes, key_len); + EVP_DigestUpdate(ctx, (const unsigned char *)p_bytes, key_len); } /* Create intermediate result. */ - EVP_DigestFinal_ex(&ctx, alt_result, &part); + EVP_DigestFinal_ex(ctx, alt_result, &part); } /* Now we can construct the result string. @@ -318,8 +328,8 @@ static int sha512_crypt_r(const char *key, * to processes or reading core dumps cannot get any information. We do it * in this way to clear correct_words[] inside the SHA512 implementation * as well. */ - EVP_MD_CTX_cleanup(&ctx); - EVP_MD_CTX_cleanup(&alt_ctx); + EVP_MD_CTX_destroy(ctx); + EVP_MD_CTX_destroy(alt_ctx); if (p_bytes) memset(p_bytes, '\0', key_len); if (s_bytes) memset(s_bytes, '\0', salt_len); if (copied_key) memset(copied_key, '\0', key_len);
_______________________________________________ sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org To unsubscribe send an email to sssd-devel-le...@lists.fedorahosted.org