URL: https://github.com/SSSD/sssd/pull/54
Author: lslebodn
Title: #54: crypto: Port libcrypto code to openssl-1.1
Action: opened
PR body:
"""
I am not sure whether using EVP_.*_init() is required after calling
"constructor"
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/54/head:pr54
git checkout pr54
From 33c56eb8e3169592f82c7df368016c0b773044e2 Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lsleb...@redhat.com>
Date: Mon, 17 Oct 2016 15:44:20 +0200
Subject: [PATCH] crypto: Port libcrypto code to openssl-1.1
---
src/util/cert/libcrypto/cert.c | 24 ++++++--
src/util/crypto/libcrypto/crypto_hmac_sha1.c | 32 ++++++-----
src/util/crypto/libcrypto/crypto_nite.c | 78 +++++++++++++++++---------
src/util/crypto/libcrypto/crypto_obfuscate.c | 34 +++++++----
src/util/crypto/libcrypto/crypto_sha512crypt.c | 76 ++++++++++++++-----------
5 files changed, 153 insertions(+), 91 deletions(-)
diff --git a/src/util/cert/libcrypto/cert.c b/src/util/cert/libcrypto/cert.c
index a7752d7..eb84b3b 100644
--- a/src/util/cert/libcrypto/cert.c
+++ b/src/util/cert/libcrypto/cert.c
@@ -182,6 +182,9 @@ errno_t cert_to_ssh_key(TALLOC_CTX *mem_ctx, const char *ca_db,
size_t c;
X509 *cert = NULL;
EVP_PKEY *cert_pub_key = NULL;
+ RSA *rsa_pub_key = NULL;
+ const BIGNUM *n;
+ const BIGNUM *e;
int modulus_len;
unsigned char modulus[OPENSSL_RSA_MAX_MODULUS_BITS/8];
int exponent_len;
@@ -208,16 +211,29 @@ errno_t cert_to_ssh_key(TALLOC_CTX *mem_ctx, const char *ca_db,
goto done;
}
- if (cert_pub_key->type != EVP_PKEY_RSA) {
+ if (EVP_PKEY_base_id(cert_pub_key) != EVP_PKEY_RSA) {
DEBUG(SSSDBG_CRIT_FAILURE,
"Expected RSA public key, found unsupported [%d].\n",
- cert_pub_key->type);
+ EVP_PKEY_base_id(cert_pub_key));
ret = EINVAL;
goto done;
}
- modulus_len = BN_bn2bin(cert_pub_key->pkey.rsa->n, modulus);
- exponent_len = BN_bn2bin(cert_pub_key->pkey.rsa->e, exponent);
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+ rsa_pub_key = EVP_PKEY_get1_RSA(cert_pub_key);
+ if (rsa_pub_key == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+
+ RSA_get0_key(rsa_pub_key, &n, &e, NULL);
+ RSA_free(rsa_pub_key);
+#else
+ n = cert_pub_key->pkey.rsa->n;
+ e = cert_pub_key->pkey.rsa->e;
+#endif
+ modulus_len = BN_bn2bin(n, modulus);
+ exponent_len = BN_bn2bin(e, exponent);
size = SSH_RSA_HEADER_LEN + 3 * sizeof(uint32_t)
+ modulus_len
diff --git a/src/util/crypto/libcrypto/crypto_hmac_sha1.c b/src/util/crypto/libcrypto/crypto_hmac_sha1.c
index 37d2579..e1964df 100644
--- a/src/util/crypto/libcrypto/crypto_hmac_sha1.c
+++ b/src/util/crypto/libcrypto/crypto_hmac_sha1.c
@@ -33,23 +33,27 @@ int sss_hmac_sha1(const unsigned char *key,
unsigned char *out)
{
int ret;
- EVP_MD_CTX ctx;
+ EVP_MD_CTX *ctx;
unsigned char ikey[HMAC_SHA1_BLOCKSIZE], okey[HMAC_SHA1_BLOCKSIZE];
size_t i;
unsigned char hash[SSS_SHA1_LENGTH];
unsigned int res_len;
- EVP_MD_CTX_init(&ctx);
+ ctx = EVP_MD_CTX_create();
+ if (ctx == NULL) {
+ return ENOMEM;
+ }
+ EVP_MD_CTX_init(ctx);
if (key_len > HMAC_SHA1_BLOCKSIZE) {
/* keys longer than blocksize are shortened */
- if (!EVP_DigestInit_ex(&ctx, EVP_sha1(), NULL)) {
+ if (!EVP_DigestInit_ex(ctx, EVP_sha1(), NULL)) {
ret = EIO;
goto done;
}
- EVP_DigestUpdate(&ctx, (const unsigned char *)key, key_len);
- EVP_DigestFinal_ex(&ctx, ikey, &res_len);
+ EVP_DigestUpdate(ctx, (const unsigned char *)key, key_len);
+ EVP_DigestFinal_ex(ctx, ikey, &res_len);
memset(ikey + SSS_SHA1_LENGTH, 0, HMAC_SHA1_BLOCKSIZE - SSS_SHA1_LENGTH);
} else {
/* keys shorter than blocksize are zero-padded */
@@ -63,25 +67,25 @@ int sss_hmac_sha1(const unsigned char *key,
ikey[i] ^= 0x36;
}
- if (!EVP_DigestInit_ex(&ctx, EVP_sha1(), NULL)) {
+ if (!EVP_DigestInit_ex(ctx, EVP_sha1(), NULL)) {
ret = EIO;
goto done;
}
- EVP_DigestUpdate(&ctx, (const unsigned char *)ikey, HMAC_SHA1_BLOCKSIZE);
- EVP_DigestUpdate(&ctx, (const unsigned char *)in, in_len);
- EVP_DigestFinal_ex(&ctx, hash, &res_len);
+ EVP_DigestUpdate(ctx, (const unsigned char *)ikey, HMAC_SHA1_BLOCKSIZE);
+ EVP_DigestUpdate(ctx, (const unsigned char *)in, in_len);
+ EVP_DigestFinal_ex(ctx, hash, &res_len);
- if (!EVP_DigestInit_ex(&ctx, EVP_sha1(), NULL)) {
+ if (!EVP_DigestInit_ex(ctx, EVP_sha1(), NULL)) {
ret = EIO;
goto done;
}
- EVP_DigestUpdate(&ctx, (const unsigned char *)okey, HMAC_SHA1_BLOCKSIZE);
- EVP_DigestUpdate(&ctx, (const unsigned char *)hash, SSS_SHA1_LENGTH);
- EVP_DigestFinal_ex(&ctx, out, &res_len);
+ EVP_DigestUpdate(ctx, (const unsigned char *)okey, HMAC_SHA1_BLOCKSIZE);
+ EVP_DigestUpdate(ctx, (const unsigned char *)hash, SSS_SHA1_LENGTH);
+ EVP_DigestFinal_ex(ctx, out, &res_len);
ret = EOK;
done:
- EVP_MD_CTX_cleanup(&ctx);
+ EVP_MD_CTX_destroy(ctx);
return ret;
}
diff --git a/src/util/crypto/libcrypto/crypto_nite.c b/src/util/crypto/libcrypto/crypto_nite.c
index fa267fb..005eeb5 100644
--- a/src/util/crypto/libcrypto/crypto_nite.c
+++ b/src/util/crypto/libcrypto/crypto_nite.c
@@ -47,9 +47,9 @@ int sss_encrypt(TALLOC_CTX *mem_ctx, enum encmethod enctype,
{
const EVP_CIPHER *cipher;
const EVP_MD *digest;
- EVP_PKEY *hmackey;
- EVP_CIPHER_CTX ctx;
- EVP_MD_CTX mdctx;
+ EVP_PKEY *hmackey = NULL;
+ EVP_CIPHER_CTX *ctx;
+ EVP_MD_CTX *mdctx = NULL;
uint8_t *out = NULL;
int evpkeylen;
int evpivlen;
@@ -86,8 +86,14 @@ int sss_encrypt(TALLOC_CTX *mem_ctx, enum encmethod enctype,
RAND_bytes(out, evpivlen);
}
- EVP_CIPHER_CTX_init(&ctx);
- ret = EVP_EncryptInit_ex(&ctx, cipher, 0, key, evpivlen ? out : NULL);
+ ctx = EVP_CIPHER_CTX_new();
+ if (ctx == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+ EVP_CIPHER_CTX_init(ctx);
+
+ ret = EVP_EncryptInit_ex(ctx, cipher, 0, key, evpivlen ? out : NULL);
if (ret != 1) {
ret = EFAULT;
goto done;
@@ -95,7 +101,7 @@ int sss_encrypt(TALLOC_CTX *mem_ctx, enum encmethod enctype,
outlen = evpivlen;
tmplen = 0;
- ret = EVP_EncryptUpdate(&ctx, out + outlen, &tmplen, plaintext, plainlen);
+ ret = EVP_EncryptUpdate(ctx, out + outlen, &tmplen, plaintext, plainlen);
if (ret != 1) {
ret = EFAULT;
goto done;
@@ -103,7 +109,7 @@ int sss_encrypt(TALLOC_CTX *mem_ctx, enum encmethod enctype,
outlen += tmplen;
- ret = EVP_EncryptFinal_ex(&ctx, out + outlen, &tmplen);
+ ret = EVP_EncryptFinal_ex(ctx, out + outlen, &tmplen);
if (ret != 1) {
ret = EFAULT;
goto done;
@@ -113,28 +119,33 @@ int sss_encrypt(TALLOC_CTX *mem_ctx, enum encmethod enctype,
/* Then HMAC */
- EVP_MD_CTX_init(&mdctx);
+ mdctx = EVP_MD_CTX_create();
+ if (mdctx == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+ EVP_MD_CTX_init(mdctx);
- ret = EVP_DigestInit_ex(&mdctx, digest, NULL);
+ ret = EVP_DigestInit_ex(mdctx, digest, NULL);
if (ret != 1) {
ret = EFAULT;
goto done;
}
- ret = EVP_DigestSignInit(&mdctx, NULL, digest, NULL, hmackey);
+ ret = EVP_DigestSignInit(mdctx, NULL, digest, NULL, hmackey);
if (ret != 1) {
ret = EFAULT;
goto done;
}
- ret = EVP_DigestSignUpdate(&mdctx, out, outlen);
+ ret = EVP_DigestSignUpdate(mdctx, out, outlen);
if (ret != 1) {
ret = EFAULT;
goto done;
}
slen = hmaclen;
- ret = EVP_DigestSignFinal(&mdctx, &out[outlen], &slen);
+ ret = EVP_DigestSignFinal(mdctx, &out[outlen], &slen);
if (ret != 1) {
ret = EFAULT;
goto done;
@@ -147,8 +158,8 @@ int sss_encrypt(TALLOC_CTX *mem_ctx, enum encmethod enctype,
ret = EOK;
done:
- EVP_MD_CTX_cleanup(&mdctx);
- EVP_CIPHER_CTX_cleanup(&ctx);
+ EVP_MD_CTX_destroy(mdctx);
+ EVP_CIPHER_CTX_free(ctx);
EVP_PKEY_free(hmackey);
return ret;
}
@@ -160,9 +171,9 @@ int sss_decrypt(TALLOC_CTX *mem_ctx, enum encmethod enctype,
{
const EVP_CIPHER *cipher;
const EVP_MD *digest;
- EVP_PKEY *hmackey;
- EVP_CIPHER_CTX ctx;
- EVP_MD_CTX mdctx;
+ EVP_PKEY *hmackey = NULL;
+ EVP_CIPHER_CTX *ctx = NULL;
+ EVP_MD_CTX *mdctx;
const uint8_t *iv = NULL;
uint8_t *out;
int evpkeylen;
@@ -194,28 +205,33 @@ int sss_decrypt(TALLOC_CTX *mem_ctx, enum encmethod enctype,
/* First check HMAC */
- EVP_MD_CTX_init(&mdctx);
+ mdctx = EVP_MD_CTX_create();
+ if (mdctx == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+ EVP_MD_CTX_init(mdctx);
- ret = EVP_DigestInit_ex(&mdctx, digest, NULL);
+ ret = EVP_DigestInit_ex(mdctx, digest, NULL);
if (ret != 1) {
ret = EFAULT;
goto done;
}
- ret = EVP_DigestSignInit(&mdctx, NULL, digest, NULL, hmackey);
+ ret = EVP_DigestSignInit(mdctx, NULL, digest, NULL, hmackey);
if (ret != 1) {
ret = EFAULT;
goto done;
}
- ret = EVP_DigestSignUpdate(&mdctx, ciphertext, cipherlen - hmaclen);
+ ret = EVP_DigestSignUpdate(mdctx, ciphertext, cipherlen - hmaclen);
if (ret != 1) {
ret = EFAULT;
goto done;
}
slen = hmaclen;
- ret = EVP_DigestSignFinal(&mdctx, out, &slen);
+ ret = EVP_DigestSignFinal(mdctx, out, &slen);
if (ret != 1) {
ret = EFAULT;
goto done;
@@ -233,14 +249,20 @@ int sss_decrypt(TALLOC_CTX *mem_ctx, enum encmethod enctype,
iv = ciphertext;
}
- EVP_CIPHER_CTX_init(&ctx);
- ret = EVP_DecryptInit_ex(&ctx, cipher, 0, key, iv);
+ ctx = EVP_CIPHER_CTX_new();
+ if (ctx == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+ EVP_CIPHER_CTX_init(ctx);
+
+ ret = EVP_DecryptInit_ex(ctx, cipher, 0, key, iv);
if (ret != 1) {
ret = EFAULT;
goto done;
}
- ret = EVP_DecryptUpdate(&ctx, out, &outlen,
+ ret = EVP_DecryptUpdate(ctx, out, &outlen,
ciphertext + evpivlen,
cipherlen - evpivlen - hmaclen);
if (ret != 1) {
@@ -248,7 +270,7 @@ int sss_decrypt(TALLOC_CTX *mem_ctx, enum encmethod enctype,
goto done;
}
- ret = EVP_DecryptFinal_ex(&ctx, out + outlen, &tmplen);
+ ret = EVP_DecryptFinal_ex(ctx, out + outlen, &tmplen);
if (ret != 1) {
ret = EFAULT;
goto done;
@@ -261,8 +283,8 @@ int sss_decrypt(TALLOC_CTX *mem_ctx, enum encmethod enctype,
ret = EOK;
done:
- EVP_MD_CTX_cleanup(&mdctx);
- EVP_CIPHER_CTX_cleanup(&ctx);
+ EVP_MD_CTX_destroy(mdctx);
+ EVP_CIPHER_CTX_free(ctx);
EVP_PKEY_free(hmackey);
return ret;
}
diff --git a/src/util/crypto/libcrypto/crypto_obfuscate.c b/src/util/crypto/libcrypto/crypto_obfuscate.c
index 85de333..11c84f4 100644
--- a/src/util/crypto/libcrypto/crypto_obfuscate.c
+++ b/src/util/crypto/libcrypto/crypto_obfuscate.c
@@ -70,7 +70,7 @@ int sss_password_encrypt(TALLOC_CTX *mem_ctx, const char *password, int plen,
enum obfmethod meth, char **obfpwd)
{
int ret;
- EVP_CIPHER_CTX ctx;
+ EVP_CIPHER_CTX *ctx;
struct crypto_mech_data *mech_props;
TALLOC_CTX *tmp_ctx = NULL;
unsigned char *keybuf;
@@ -90,7 +90,12 @@ int sss_password_encrypt(TALLOC_CTX *mem_ctx, const char *password, int plen,
return ENOMEM;
}
- EVP_CIPHER_CTX_init(&ctx);
+ ctx = EVP_CIPHER_CTX_new();
+ if (ctx == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+ EVP_CIPHER_CTX_init(ctx);
mech_props = get_crypto_mech_data(meth);
if (mech_props == NULL) {
@@ -121,20 +126,20 @@ int sss_password_encrypt(TALLOC_CTX *mem_ctx, const char *password, int plen,
goto done;
}
- if (!EVP_EncryptInit_ex(&ctx, mech_props->cipher(), 0, keybuf, ivbuf)) {
+ if (!EVP_EncryptInit_ex(ctx, mech_props->cipher(), 0, keybuf, ivbuf)) {
DEBUG(SSSDBG_CRIT_FAILURE, "Failure to initialize cipher contex\n");
ret = EIO;
goto done;
}
/* sample data we'll encrypt and decrypt */
- if (!EVP_EncryptUpdate(&ctx, cryptotext, &ctlen, (const unsigned char*)password, plen)) {
+ if (!EVP_EncryptUpdate(ctx, cryptotext, &ctlen, (const unsigned char *)password, plen)) {
DEBUG(SSSDBG_CRIT_FAILURE, "Cannot execute the encryption operation\n");
ret = EIO;
goto done;
}
- if(!EVP_EncryptFinal_ex(&ctx, cryptotext+ctlen, &digestlen)) {
+ if (!EVP_EncryptFinal_ex(ctx, cryptotext + ctlen, &digestlen)) {
DEBUG(SSSDBG_CRIT_FAILURE, "Cannot finialize the encryption operation\n");
ret = EIO;
goto done;
@@ -185,7 +190,7 @@ int sss_password_encrypt(TALLOC_CTX *mem_ctx, const char *password, int plen,
done:
talloc_free(tmp_ctx);
- EVP_CIPHER_CTX_cleanup(&ctx);
+ EVP_CIPHER_CTX_free(ctx);
return ret;
}
@@ -193,7 +198,7 @@ int sss_password_decrypt(TALLOC_CTX *mem_ctx, char *b64encoded,
char **password)
{
int ret;
- EVP_CIPHER_CTX ctx;
+ EVP_CIPHER_CTX *ctx;
TALLOC_CTX *tmp_ctx = NULL;
struct crypto_mech_data *mech_props;
@@ -217,7 +222,12 @@ int sss_password_decrypt(TALLOC_CTX *mem_ctx, char *b64encoded,
return ENOMEM;
}
- EVP_CIPHER_CTX_init(&ctx);
+ ctx = EVP_CIPHER_CTX_new();
+ if (ctx == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+ EVP_CIPHER_CTX_init(ctx);
/* Base64 decode the incoming buffer */
obfbuf = sss_base64_decode(tmp_ctx, b64encoded, &obflen);
@@ -276,18 +286,18 @@ int sss_password_decrypt(TALLOC_CTX *mem_ctx, char *b64encoded,
goto done;
}
- if (!EVP_DecryptInit_ex(&ctx, mech_props->cipher(), 0, keybuf, ivbuf)) {
+ if (!EVP_DecryptInit_ex(ctx, mech_props->cipher(), 0, keybuf, ivbuf)) {
ret = EIO;
goto done;
}
/* sample data we'll encrypt and decrypt */
- if (!EVP_DecryptUpdate(&ctx, (unsigned char*)pwdbuf, &plainlen, cryptotext, ctsize)) {
+ if (!EVP_DecryptUpdate(ctx, (unsigned char *)pwdbuf, &plainlen, cryptotext, ctsize)) {
ret = EIO;
goto done;
}
- if(!EVP_DecryptFinal_ex(&ctx, (unsigned char*)pwdbuf+plainlen, &digestlen)) {
+ if (!EVP_DecryptFinal_ex(ctx, (unsigned char *)pwdbuf + plainlen, &digestlen)) {
ret = EIO;
goto done;
}
@@ -296,6 +306,6 @@ int sss_password_decrypt(TALLOC_CTX *mem_ctx, char *b64encoded,
ret = EOK;
done:
talloc_free(tmp_ctx);
- EVP_CIPHER_CTX_cleanup(&ctx);
+ EVP_CIPHER_CTX_free(ctx);
return ret;
}
diff --git a/src/util/crypto/libcrypto/crypto_sha512crypt.c b/src/util/crypto/libcrypto/crypto_sha512crypt.c
index 34547d0..57e5de5 100644
--- a/src/util/crypto/libcrypto/crypto_sha512crypt.c
+++ b/src/util/crypto/libcrypto/crypto_sha512crypt.c
@@ -75,8 +75,8 @@ static int sha512_crypt_r(const char *key,
unsigned char alt_result[64] __attribute__((__aligned__(ALIGN64)));
size_t rounds = ROUNDS_DEFAULT;
bool rounds_custom = false;
- EVP_MD_CTX alt_ctx;
- EVP_MD_CTX ctx;
+ EVP_MD_CTX *alt_ctx;
+ EVP_MD_CTX *ctx;
size_t salt_len;
size_t key_len;
size_t cnt;
@@ -125,75 +125,85 @@ static int sha512_crypt_r(const char *key,
salt = copied_salt = memcpy(tmp + ALIGN64 - PTR_2_INT(tmp) % ALIGN64, salt, salt_len);
}
- EVP_MD_CTX_init(&ctx);
+ ctx = EVP_MD_CTX_create();
+ if (ctx == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+ EVP_MD_CTX_init(ctx);
- EVP_MD_CTX_init(&alt_ctx);
+ alt_ctx = EVP_MD_CTX_create();
+ if (alt_ctx == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+ EVP_MD_CTX_init(alt_ctx);
/* Prepare for the real work. */
- if (!EVP_DigestInit_ex(&ctx, EVP_sha512(), NULL)) {
+ if (!EVP_DigestInit_ex(ctx, EVP_sha512(), NULL)) {
ret = EIO;
goto done;
}
/* Add the key string. */
- EVP_DigestUpdate(&ctx, (const unsigned char *)key, key_len);
+ EVP_DigestUpdate(ctx, (const unsigned char *)key, key_len);
/* The last part is the salt string. This must be at most 16
* characters and it ends at the first `$' character (for
* compatibility with existing implementations). */
- EVP_DigestUpdate(&ctx, (const unsigned char *)salt, salt_len);
+ EVP_DigestUpdate(ctx, (const unsigned char *)salt, salt_len);
/* Compute alternate SHA512 sum with input KEY, SALT, and KEY.
* The final result will be added to the first context. */
- if (!EVP_DigestInit_ex(&alt_ctx, EVP_sha512(), NULL)) {
+ if (!EVP_DigestInit_ex(alt_ctx, EVP_sha512(), NULL)) {
ret = EIO;
goto done;
}
/* Add key. */
- EVP_DigestUpdate(&alt_ctx, (const unsigned char *)key, key_len);
+ EVP_DigestUpdate(alt_ctx, (const unsigned char *)key, key_len);
/* Add salt. */
- EVP_DigestUpdate(&alt_ctx, (const unsigned char *)salt, salt_len);
+ EVP_DigestUpdate(alt_ctx, (const unsigned char *)salt, salt_len);
/* Add key again. */
- EVP_DigestUpdate(&alt_ctx, (const unsigned char *)key, key_len);
+ EVP_DigestUpdate(alt_ctx, (const unsigned char *)key, key_len);
/* Now get result of this (64 bytes) and add it to the other context. */
- EVP_DigestFinal_ex(&alt_ctx, alt_result, &part);
+ EVP_DigestFinal_ex(alt_ctx, alt_result, &part);
/* Add for any character in the key one byte of the alternate sum. */
for (cnt = key_len; cnt > 64; cnt -= 64) {
- EVP_DigestUpdate(&ctx, alt_result, 64);
+ EVP_DigestUpdate(ctx, alt_result, 64);
}
- EVP_DigestUpdate(&ctx, alt_result, cnt);
+ EVP_DigestUpdate(ctx, alt_result, cnt);
/* Take the binary representation of the length of the key and for every
* 1 add the alternate sum, for every 0 the key. */
for (cnt = key_len; cnt > 0; cnt >>= 1) {
if ((cnt & 1) != 0) {
- EVP_DigestUpdate(&ctx, alt_result, 64);
+ EVP_DigestUpdate(ctx, alt_result, 64);
} else {
- EVP_DigestUpdate(&ctx, (const unsigned char *)key, key_len);
+ EVP_DigestUpdate(ctx, (const unsigned char *)key, key_len);
}
}
/* Create intermediate result. */
- EVP_DigestFinal_ex(&ctx, alt_result, &part);
+ EVP_DigestFinal_ex(ctx, alt_result, &part);
/* Start computation of P byte sequence. */
- if (!EVP_DigestInit_ex(&alt_ctx, EVP_sha512(), NULL)) {
+ if (!EVP_DigestInit_ex(alt_ctx, EVP_sha512(), NULL)) {
ret = EIO;
goto done;
}
/* For every character in the password add the entire password. */
for (cnt = 0; cnt < key_len; cnt++) {
- EVP_DigestUpdate(&alt_ctx, (const unsigned char *)key, key_len);
+ EVP_DigestUpdate(alt_ctx, (const unsigned char *)key, key_len);
}
/* Finish the digest. */
- EVP_DigestFinal_ex(&alt_ctx, temp_result, &part);
+ EVP_DigestFinal_ex(alt_ctx, temp_result, &part);
/* Create byte sequence P. */
cp = p_bytes = alloca(key_len);
@@ -203,18 +213,18 @@ static int sha512_crypt_r(const char *key,
memcpy(cp, temp_result, cnt);
/* Start computation of S byte sequence. */
- if (!EVP_DigestInit_ex(&alt_ctx, EVP_sha512(), NULL)) {
+ if (!EVP_DigestInit_ex(alt_ctx, EVP_sha512(), NULL)) {
ret = EIO;
goto done;
}
/* For every character in the password add the entire salt. */
for (cnt = 0; cnt < 16 + alt_result[0]; cnt++) {
- EVP_DigestUpdate(&alt_ctx, (const unsigned char *)salt, salt_len);
+ EVP_DigestUpdate(alt_ctx, (const unsigned char *)salt, salt_len);
}
/* Finish the digest. */
- EVP_DigestFinal_ex(&alt_ctx, temp_result, &part);
+ EVP_DigestFinal_ex(alt_ctx, temp_result, &part);
/* Create byte sequence S. */
cp = s_bytes = alloca(salt_len);
@@ -226,37 +236,37 @@ static int sha512_crypt_r(const char *key,
/* Repeatedly run the collected hash value through SHA512 to burn CPU cycles. */
for (cnt = 0; cnt < rounds; cnt++) {
- if (!EVP_DigestInit_ex(&ctx, EVP_sha512(), NULL)) {
+ if (!EVP_DigestInit_ex(ctx, EVP_sha512(), NULL)) {
ret = EIO;
goto done;
}
/* Add key or last result. */
if ((cnt & 1) != 0) {
- EVP_DigestUpdate(&ctx, (const unsigned char *)p_bytes, key_len);
+ EVP_DigestUpdate(ctx, (const unsigned char *)p_bytes, key_len);
} else {
- EVP_DigestUpdate(&ctx, alt_result, 64);
+ EVP_DigestUpdate(ctx, alt_result, 64);
}
/* Add salt for numbers not divisible by 3. */
if (cnt % 3 != 0) {
- EVP_DigestUpdate(&ctx, (const unsigned char *)s_bytes, salt_len);
+ EVP_DigestUpdate(ctx, (const unsigned char *)s_bytes, salt_len);
}
/* Add key for numbers not divisible by 7. */
if (cnt % 7 != 0) {
- EVP_DigestUpdate(&ctx, (const unsigned char *)p_bytes, key_len);
+ EVP_DigestUpdate(ctx, (const unsigned char *)p_bytes, key_len);
}
/* Add key or last result. */
if ((cnt & 1) != 0) {
- EVP_DigestUpdate(&ctx, alt_result, 64);
+ EVP_DigestUpdate(ctx, alt_result, 64);
} else {
- EVP_DigestUpdate(&ctx, (const unsigned char *)p_bytes, key_len);
+ EVP_DigestUpdate(ctx, (const unsigned char *)p_bytes, key_len);
}
/* Create intermediate result. */
- EVP_DigestFinal_ex(&ctx, alt_result, &part);
+ EVP_DigestFinal_ex(ctx, alt_result, &part);
}
/* Now we can construct the result string.
@@ -318,8 +328,8 @@ static int sha512_crypt_r(const char *key,
* to processes or reading core dumps cannot get any information. We do it
* in this way to clear correct_words[] inside the SHA512 implementation
* as well. */
- EVP_MD_CTX_cleanup(&ctx);
- EVP_MD_CTX_cleanup(&alt_ctx);
+ EVP_MD_CTX_destroy(ctx);
+ EVP_MD_CTX_destroy(alt_ctx);
if (p_bytes) memset(p_bytes, '\0', key_len);
if (s_bytes) memset(s_bytes, '\0', salt_len);
if (copied_key) memset(copied_key, '\0', key_len);
_______________________________________________
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-le...@lists.fedorahosted.org
