Check for OPENSSL_NO_RSA, OPENSSL_NO_DSA and OPENSSL_NO_DH and disable (9e78e6c3) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP OpenSSL

crypto/engine/engine.h

+22 −0

Original line number	Diff line number	Diff line
		@@ -60,9 +60,15 @@
		#define HEADER_ENGINE_H

		#include <openssl/bn.h>
		#ifndef OPENSSL_NO_RSA
		#include <openssl/rsa.h>
		#endif
		#ifndef OPENSSL_NO_DSA
		#include <openssl/dsa.h>
		#endif
		#ifndef OPENSSL_NO_DH
		#include <openssl/dh.h>
		#endif
		#include <openssl/rand.h>
		#include <openssl/evp.h>
		#include <openssl/symhacks.h>
		@@ -71,6 +77,17 @@
		extern "C" {
		#endif

		/* Fixups for missing algorithms */
		#ifdef OPENSSL_NO_RSA
		typedef void RSA_METHOD;
		#endif
		#ifdef OPENSSL_NO_DSA
		typedef void DSA_METHOD;
		#endif
		#ifdef OPENSSL_NO_DH
		typedef void DH_METHOD;
		#endif

		/* These flags are used to control combinations of algorithm (methods)
		* by bitwise "OR"ing. */
		#define ENGINE_METHOD_RSA (unsigned int)0x0001
		@@ -442,6 +459,7 @@ void ERR_load_ENGINE_strings(void);
		#define ENGINE_F_ENGINE_CTRL_CMD_STRING 171
		#define ENGINE_F_ENGINE_FINISH 107
		#define ENGINE_F_ENGINE_FREE 108
		#define ENGINE_F_ENGINE_GET_DEFAULT_TYPE 177
		#define ENGINE_F_ENGINE_GET_NEXT 115
		#define ENGINE_F_ENGINE_GET_PREV 116
		#define ENGINE_F_ENGINE_INIT 119
		@@ -492,6 +510,8 @@ void ERR_load_ENGINE_strings(void);
		#define ENGINE_R_COMMAND_TAKES_NO_INPUT 136
		#define ENGINE_R_CONFLICTING_ENGINE_ID 103
		#define ENGINE_R_CTRL_COMMAND_NOT_IMPLEMENTED 119
		#define ENGINE_R_DH_NOT_IMPLEMENTED 139
		#define ENGINE_R_DSA_NOT_IMPLEMENTED 140
		#define ENGINE_R_DSO_FAILURE 104
		#define ENGINE_R_DSO_FUNCTION_NOT_FOUND 131
		#define ENGINE_R_DSO_NOT_FOUND 132
		@@ -515,9 +535,11 @@ void ERR_load_ENGINE_strings(void);
		#define ENGINE_R_NO_REFERENCE 130
		#define ENGINE_R_NO_SUCH_ENGINE 116
		#define ENGINE_R_NO_UNLOAD_FUNCTION 126
		#define ENGINE_R_PRIVATE_KEY_ALGORITHMS_DISABLED 142
		#define ENGINE_R_PROVIDE_PARAMETERS 113
		#define ENGINE_R_REQUEST_FAILED 114
		#define ENGINE_R_REQUEST_FALLBACK 118
		#define ENGINE_R_RSA_NOT_IMPLEMENTED 141
		#define ENGINE_R_SIZE_TOO_LARGE_OR_TOO_SMALL 122
		#define ENGINE_R_UNIT_FAILURE 115

crypto/engine/engine_err.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -86,6 +86,7 @@ static ERR_STRING_DATA ENGINE_str_functs[]=
		{ERR_PACK(0,ENGINE_F_ENGINE_CTRL_CMD_STRING,0), "ENGINE_ctrl_cmd_string"},
		{ERR_PACK(0,ENGINE_F_ENGINE_FINISH,0), "ENGINE_finish"},
		{ERR_PACK(0,ENGINE_F_ENGINE_FREE,0), "ENGINE_free"},
		{ERR_PACK(0,ENGINE_F_ENGINE_GET_DEFAULT_TYPE,0), "ENGINE_GET_DEFAULT_TYPE"},
		{ERR_PACK(0,ENGINE_F_ENGINE_GET_NEXT,0), "ENGINE_get_next"},
		{ERR_PACK(0,ENGINE_F_ENGINE_GET_PREV,0), "ENGINE_get_prev"},
		{ERR_PACK(0,ENGINE_F_ENGINE_INIT,0), "ENGINE_init"},
		@@ -139,6 +140,8 @@ static ERR_STRING_DATA ENGINE_str_reasons[]=
		{ENGINE_R_COMMAND_TAKES_NO_INPUT ,"command takes no input"},
		{ENGINE_R_CONFLICTING_ENGINE_ID ,"conflicting engine id"},
		{ENGINE_R_CTRL_COMMAND_NOT_IMPLEMENTED ,"ctrl command not implemented"},
		{ENGINE_R_DH_NOT_IMPLEMENTED ,"dh not implemented"},
		{ENGINE_R_DSA_NOT_IMPLEMENTED ,"dsa not implemented"},
		{ENGINE_R_DSO_FAILURE ,"DSO failure"},
		{ENGINE_R_DSO_FUNCTION_NOT_FOUND ,"dso function not found"},
		{ENGINE_R_DSO_NOT_FOUND ,"dso not found"},
		@@ -162,9 +165,11 @@ static ERR_STRING_DATA ENGINE_str_reasons[]=
		{ENGINE_R_NO_REFERENCE ,"no reference"},
		{ENGINE_R_NO_SUCH_ENGINE ,"no such engine"},
		{ENGINE_R_NO_UNLOAD_FUNCTION ,"no unload function"},
		{ENGINE_R_PRIVATE_KEY_ALGORITHMS_DISABLED,"private key algorithms disabled"},
		{ENGINE_R_PROVIDE_PARAMETERS ,"provide parameters"},
		{ENGINE_R_REQUEST_FAILED ,"request failed"},
		{ENGINE_R_REQUEST_FALLBACK ,"request fallback"},
		{ENGINE_R_RSA_NOT_IMPLEMENTED ,"rsa not implemented"},
		{ENGINE_R_SIZE_TOO_LARGE_OR_TOO_SMALL ,"size too large or too small"},
		{ENGINE_R_UNIT_FAILURE ,"unit failure"},
		{0,NULL}

crypto/engine/engine_lib.c

+42 −0

Original line number	Diff line number	Diff line
		@@ -67,9 +67,15 @@
		* reference and the caller is responsible for freeing that when they
		* are finished with it (with a call to ENGINE_finish() NOT just
		* ENGINE_free()!!!!!!). */
		#ifndef OPENSSL_NO_RSA
		static ENGINE *engine_def_rsa = NULL;
		#endif
		#ifndef OPENSSL_NO_DSA
		static ENGINE *engine_def_dsa = NULL;
		#endif
		#ifndef OPENSSL_NO_DH
		static ENGINE *engine_def_dh = NULL;
		#endif
		static ENGINE *engine_def_rand = NULL;
		static ENGINE *engine_def_bn_mod_exp = NULL;
		static ENGINE *engine_def_bn_mod_exp_crt = NULL;
		@@ -125,9 +131,15 @@ static void engine_def_check(void)
		goto skip_set_defaults;
		/* OK, we got a functional reference, so we get one each
		* for the defaults too. */
		#ifndef OPENSSL_NO_RSA
		engine_def_check_util(&engine_def_rsa, e);
		#endif
		#ifndef OPENSSL_NO_RSA
		engine_def_check_util(&engine_def_dsa, e);
		#endif
		#ifndef OPENSSL_NO_DH
		engine_def_check_util(&engine_def_dh, e);
		#endif
		engine_def_check_util(&engine_def_rand, e);
		engine_def_check_util(&engine_def_bn_mod_exp, e);
		engine_def_check_util(&engine_def_bn_mod_exp_crt, e);
		@@ -590,12 +602,18 @@ static ENGINE *engine_get_default_type(ENGINE_TYPE t)
		CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
		switch(t)
		{
		#ifndef OPENSSL_NO_RSA
		case ENGINE_TYPE_RSA:
		ret = engine_def_rsa; break;
		#endif
		#ifndef OPENSSL_NO_DSA
		case ENGINE_TYPE_DSA:
		ret = engine_def_dsa; break;
		#endif
		#ifndef OPENSSL_NO_DH
		case ENGINE_TYPE_DH:
		ret = engine_def_dh; break;
		#endif
		case ENGINE_TYPE_RAND:
		ret = engine_def_rand; break;
		case ENGINE_TYPE_BN_MOD_EXP:
		@@ -615,20 +633,26 @@ static ENGINE *engine_get_default_type(ENGINE_TYPE t)
		return ret;
		}

		#ifndef OPENSSL_NO_RSA
		ENGINE *ENGINE_get_default_RSA(void)
		{
		return engine_get_default_type(ENGINE_TYPE_RSA);
		}
		#endif

		#ifndef OPENSSL_NO_DSA
		ENGINE *ENGINE_get_default_DSA(void)
		{
		return engine_get_default_type(ENGINE_TYPE_DSA);
		}
		#endif

		#ifndef OPENSSL_NO_DH
		ENGINE *ENGINE_get_default_DH(void)
		{
		return engine_get_default_type(ENGINE_TYPE_DH);
		}
		#endif

		ENGINE *ENGINE_get_default_RAND(void)
		{
		@@ -671,15 +695,21 @@ static int engine_set_default_type(ENGINE_TYPE t, ENGINE *e)
		CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
		switch(t)
		{
		#ifndef OPENSSL_NO_RSA
		case ENGINE_TYPE_RSA:
		old = engine_def_rsa;
		engine_def_rsa = e; break;
		#endif
		#ifndef OPENSSL_NO_DSA
		case ENGINE_TYPE_DSA:
		old = engine_def_dsa;
		engine_def_dsa = e; break;
		#endif
		#ifndef OPENSSL_NO_DH
		case ENGINE_TYPE_DH:
		old = engine_def_dh;
		engine_def_dh = e; break;
		#endif
		case ENGINE_TYPE_RAND:
		old = engine_def_rand;
		engine_def_rand = e; break;
		@@ -702,20 +732,26 @@ static int engine_set_default_type(ENGINE_TYPE t, ENGINE *e)
		return 1;
		}

		#ifndef OPENSSL_NO_RSA
		int ENGINE_set_default_RSA(ENGINE *e)
		{
		return engine_set_default_type(ENGINE_TYPE_RSA, e);
		}
		#endif

		#ifndef OPENSSL_NO_DSA
		int ENGINE_set_default_DSA(ENGINE *e)
		{
		return engine_set_default_type(ENGINE_TYPE_DSA, e);
		}
		#endif

		#ifndef OPENSSL_NO_DH
		int ENGINE_set_default_DH(ENGINE *e)
		{
		return engine_set_default_type(ENGINE_TYPE_DH, e);
		}
		#endif

		int ENGINE_set_default_RAND(ENGINE *e)
		{
		@@ -734,15 +770,21 @@ int ENGINE_set_default_BN_mod_exp_crt(ENGINE *e)

		int ENGINE_set_default(ENGINE *e, unsigned int flags)
		{
		#ifndef OPENSSL_NO_RSA
		if((flags & ENGINE_METHOD_RSA) && e->rsa_meth &&
		!ENGINE_set_default_RSA(e))
		return 0;
		#endif
		#ifndef OPENSSL_NO_DSA
		if((flags & ENGINE_METHOD_DSA) && e->dsa_meth &&
		!ENGINE_set_default_DSA(e))
		return 0;
		#endif
		#ifndef OPENSSL_NO_DH
		if((flags & ENGINE_METHOD_DH) && e->dh_meth &&
		!ENGINE_set_default_DH(e))
		return 0;
		#endif
		if((flags & ENGINE_METHOD_RAND) && e->rand_meth &&
		!ENGINE_set_default_RAND(e))
		return 0;

crypto/engine/engine_list.c

+18 −0

Original line number	Diff line number	Diff line
		@@ -402,20 +402,32 @@ int ENGINE_set_name(ENGINE e, const char name)

		int ENGINE_set_RSA(ENGINE e, const RSA_METHOD rsa_meth)
		{
		#ifndef OPENSSL_NO_RSA
		e->rsa_meth = rsa_meth;
		return 1;
		#else
		return 0;
		#endif
		}

		int ENGINE_set_DSA(ENGINE e, const DSA_METHOD dsa_meth)
		{
		#ifndef OPENSSL_NO_DSA
		e->dsa_meth = dsa_meth;
		return 1;
		#else
		return 0;
		#endif
		}

		int ENGINE_set_DH(ENGINE e, const DH_METHOD dh_meth)
		{
		#ifndef OPENSSL_NO_DH
		e->dh_meth = dh_meth;
		return 1;
		#else
		return 0;
		#endif
		}

		int ENGINE_set_RAND(ENGINE e, const RAND_METHOD rand_meth)
		@@ -482,9 +494,15 @@ int ENGINE_cpy(ENGINE dest, const ENGINE src)
		{
		if(ENGINE_set_id(dest, ENGINE_get_id(src)) &&
		ENGINE_set_name(dest, ENGINE_get_name(src)) &&
		#ifndef OPENSSL_NO_RSA
		ENGINE_set_RSA(dest, ENGINE_get_RSA(src)) &&
		#endif
		#ifndef OPENSSL_NO_RSA
		ENGINE_set_DSA(dest, ENGINE_get_DSA(src)) &&
		#endif
		#ifndef OPENSSL_NO_RSA
		ENGINE_set_DH(dest, ENGINE_get_DH(src)) &&
		#endif
		ENGINE_set_RAND(dest, ENGINE_get_RAND(src)) &&
		ENGINE_set_BN_mod_exp(dest,
		ENGINE_get_BN_mod_exp(src)) &&

crypto/engine/engine_openssl.c

+6 −5

Original line number	Diff line number	Diff line
		@@ -62,11 +62,6 @@
		#include "cryptlib.h"
		#include <openssl/engine.h>
		#include <openssl/dso.h>
		#include <openssl/rsa.h>
		#include <openssl/dsa.h>
		#include <openssl/dh.h>
		#include <openssl/rand.h>
		#include <openssl/bn.h>

		/* This is the only function we need to implement as OpenSSL
		* doesn't have a native CRT mod_exp. Perhaps this should be
		@@ -88,9 +83,15 @@ ENGINE *ENGINE_openssl()
		return NULL;
		if(!ENGINE_set_id(ret, engine_openssl_id) \|\|
		!ENGINE_set_name(ret, engine_openssl_name) \|\|
		#ifndef OPENSSL_NO_RSA
		!ENGINE_set_RSA(ret, RSA_get_default_openssl_method()) \|\|
		#endif
		#ifndef OPENSSL_NO_DSA
		!ENGINE_set_DSA(ret, DSA_get_default_openssl_method()) \|\|
		#endif
		#ifndef OPENSSL_NO_DH
		!ENGINE_set_DH(ret, DH_get_default_openssl_method()) \|\|
		#endif
		!ENGINE_set_RAND(ret, RAND_SSLeay()) \|\|
		!ENGINE_set_BN_mod_exp(ret, BN_mod_exp) \|\|
		!ENGINE_set_BN_mod_exp_crt(ret, openssl_mod_exp_crt))