From 5af8cc781eca6552cf48b715b53a5ab16c7b8281 Mon Sep 17 00:00:00 2001 From: Johann Neuhauser Date: Sat, 13 Jan 2018 16:59:58 +0100 Subject: [PATCH] patched for openssl1.1 interface with patch file from fedora porject https://fedora.pkgs.org/rawhide/fedora-x86_64/ima-evm-utils-1.0-3.fc28.x86_64.rpm.html --- patch/openssl1-1-interface.patch | 224 +++++++++++++++++++++++++++++++ src/evmctl.c | 39 ++++-- src/libimaevm.c | 38 +++--- 3 files changed, 272 insertions(+), 29 deletions(-) create mode 100644 patch/openssl1-1-interface.patch diff --git a/patch/openssl1-1-interface.patch b/patch/openssl1-1-interface.patch new file mode 100644 index 0000000..e00fb2f --- /dev/null +++ b/patch/openssl1-1-interface.patch @@ -0,0 +1,224 @@ +diff -urNp ima-evm-utils-1.0-orig/src/libimaevm.c ima-evm-utils-1.0/src/libimaevm.c +--- ima-evm-utils-1.0-orig/src/libimaevm.c 2015-07-30 15:28:53.000000000 -0300 ++++ ima-evm-utils-1.0/src/libimaevm.c 2017-12-01 12:01:28.008705290 -0200 +@@ -269,7 +269,7 @@ int ima_calc_hash(const char *file, uint + { + const EVP_MD *md; + struct stat st; +- EVP_MD_CTX ctx; ++ EVP_MD_CTX *ctx; + unsigned int mdlen; + int err; + +@@ -286,25 +286,30 @@ int ima_calc_hash(const char *file, uint + return 1; + } + +- err = EVP_DigestInit(&ctx, md); ++ ctx = EVP_MD_CTX_new(); ++ if (!ctx) { ++ log_err("EVP_MD_CTX_new() failed\n"); ++ return 1; ++ } ++ err = EVP_DigestInit_ex(ctx, md, NULL); + if (!err) { +- log_err("EVP_DigestInit() failed\n"); ++ log_err("EVP_DigestInit_ex() failed\n"); + return 1; + } + + switch (st.st_mode & S_IFMT) { + case S_IFREG: +- err = add_file_hash(file, &ctx); ++ err = add_file_hash(file, ctx); + break; + case S_IFDIR: +- err = add_dir_hash(file, &ctx); ++ err = add_dir_hash(file, ctx); + break; + case S_IFLNK: +- err = add_link_hash(file, &ctx); ++ err = add_link_hash(file, ctx); + break; + case S_IFIFO: case S_IFSOCK: + case S_IFCHR: case S_IFBLK: +- err = add_dev_hash(&st, &ctx); ++ err = add_dev_hash(&st, ctx); + break; + default: + log_errno("Unsupported file type"); +@@ -314,11 +319,12 @@ int ima_calc_hash(const char *file, uint + if (err) + return err; + +- err = EVP_DigestFinal(&ctx, hash, &mdlen); ++ err = EVP_DigestFinal_ex(ctx, hash, &mdlen); + if (!err) { +- log_err("EVP_DigestFinal() failed\n"); ++ log_err("EVP_DigestFinal_ex() failed\n"); + return 1; + } ++ EVP_MD_CTX_free(ctx); + + return mdlen; + } +@@ -547,6 +553,7 @@ int key2bin(RSA *key, unsigned char *pub + { + int len, b, offset = 0; + struct pubkey_hdr *pkh = (struct pubkey_hdr *)pub; ++ const BIGNUM *n, *e; + + /* add key header */ + pkh->version = 1; +@@ -556,18 +563,19 @@ int key2bin(RSA *key, unsigned char *pub + + offset += sizeof(*pkh); + +- len = BN_num_bytes(key->n); +- b = BN_num_bits(key->n); ++ RSA_get0_key(key, &n, &e, NULL); ++ len = BN_num_bytes(n); ++ b = BN_num_bits(n); + pub[offset++] = b >> 8; + pub[offset++] = b & 0xff; +- BN_bn2bin(key->n, &pub[offset]); ++ BN_bn2bin(n, &pub[offset]); + offset += len; + +- len = BN_num_bytes(key->e); +- b = BN_num_bits(key->e); ++ len = BN_num_bytes(e); ++ b = BN_num_bits(e); + pub[offset++] = b >> 8; + pub[offset++] = b & 0xff; +- BN_bn2bin(key->e, &pub[offset]); ++ BN_bn2bin(e, &pub[offset]); + offset += len; + + return offset; + +diff -urNp ima-evm-utils-1.0-orig/src/evmctl.c ima-evm-utils-1.0/src/evmctl.c +--- ima-evm-utils-1.0-orig/src/evmctl.c 2015-07-30 15:28:53.000000000 -0300 ++++ ima-evm-utils-1.0/src/evmctl.c 2017-12-01 12:00:39.683306265 -0200 +@@ -305,7 +305,7 @@ static int calc_evm_hash(const char *fil + struct stat st; + int err; + uint32_t generation = 0; +- EVP_MD_CTX ctx; ++ EVP_MD_CTX *ctx; + unsigned int mdlen; + char **xattrname; + char xattr_value[1024]; +@@ -345,9 +345,14 @@ static int calc_evm_hash(const char *fil + return -1; + } + +- err = EVP_DigestInit(&ctx, EVP_sha1()); ++ ctx = EVP_MD_CTX_new(); ++ if (!ctx) { ++ log_err("EVP_MD_CTX_new() failed\n"); ++ return 1; ++ } ++ err = EVP_DigestInit_ex(ctx, EVP_sha1(), NULL); + if (!err) { +- log_err("EVP_DigestInit() failed\n"); ++ log_err("EVP_DigestInit_ex() failed\n"); + return 1; + } + +@@ -364,7 +369,7 @@ static int calc_evm_hash(const char *fil + /*log_debug("name: %s, value: %s, size: %d\n", *xattrname, xattr_value, err);*/ + log_info("name: %s, size: %d\n", *xattrname, err); + log_debug_dump(xattr_value, err); +- err = EVP_DigestUpdate(&ctx, xattr_value, err); ++ err = EVP_DigestUpdate(ctx, xattr_value, err); + if (!err) { + log_err("EVP_DigestUpdate() failed\n"); + return 1; +@@ -412,7 +417,7 @@ static int calc_evm_hash(const char *fil + log_debug("hmac_misc (%d): ", hmac_size); + log_debug_dump(&hmac_misc, hmac_size); + +- err = EVP_DigestUpdate(&ctx, &hmac_misc, hmac_size); ++ err = EVP_DigestUpdate(ctx, &hmac_misc, hmac_size); + if (!err) { + log_err("EVP_DigestUpdate() failed\n"); + return 1; +@@ -423,18 +428,19 @@ static int calc_evm_hash(const char *fil + if (err) + return -1; + +- err = EVP_DigestUpdate(&ctx, (const unsigned char *)uuid, sizeof(uuid)); ++ err = EVP_DigestUpdate(ctx, (const unsigned char *)uuid, sizeof(uuid)); + if (!err) { + log_err("EVP_DigestUpdate() failed\n"); + return 1; + } + } + +- err = EVP_DigestFinal(&ctx, hash, &mdlen); ++ err = EVP_DigestFinal_ex(ctx, hash, &mdlen); + if (!err) { + log_err("EVP_DigestFinal() failed\n"); + return 1; + } ++ EVP_MD_CTX_free(ctx); + + return mdlen; + } +@@ -844,7 +850,7 @@ static int calc_evm_hmac(const char *fil + struct stat st; + int err = -1; + uint32_t generation = 0; +- HMAC_CTX ctx; ++ HMAC_CTX *ctx; + unsigned int mdlen; + char **xattrname; + unsigned char xattr_value[1024]; +@@ -900,10 +906,15 @@ static int calc_evm_hmac(const char *fil + goto out; + } + +- err = !HMAC_Init(&ctx, evmkey, sizeof(evmkey), EVP_sha1()); ++ ctx = HMAC_CTX_new(); ++ if (!ctx) { ++ log_err("HMAC_MD_CTX_new() failed\n"); ++ goto out; ++ } ++ err = !HMAC_Init_ex(ctx, evmkey, sizeof(evmkey), EVP_sha1(), NULL); + if (err) { + log_err("HMAC_Init() failed\n"); +- goto out; ++ goto out_ctx_cleanup; + } + + for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) { +@@ -919,7 +930,7 @@ static int calc_evm_hmac(const char *fil + /*log_debug("name: %s, value: %s, size: %d\n", *xattrname, xattr_value, err);*/ + log_info("name: %s, size: %d\n", *xattrname, err); + log_debug_dump(xattr_value, err); +- err = !HMAC_Update(&ctx, xattr_value, err); ++ err = !HMAC_Update(ctx, xattr_value, err); + if (err) { + log_err("HMAC_Update() failed\n"); + goto out_ctx_cleanup; +@@ -960,16 +971,16 @@ static int calc_evm_hmac(const char *fil + log_debug("hmac_misc (%d): ", hmac_size); + log_debug_dump(&hmac_misc, hmac_size); + +- err = !HMAC_Update(&ctx, (const unsigned char *)&hmac_misc, hmac_size); ++ err = !HMAC_Update(ctx, (const unsigned char *)&hmac_misc, hmac_size); + if (err) { + log_err("HMAC_Update() failed\n"); + goto out_ctx_cleanup; + } +- err = !HMAC_Final(&ctx, hash, &mdlen); ++ err = !HMAC_Final(ctx, hash, &mdlen); + if (err) + log_err("HMAC_Final() failed\n"); + out_ctx_cleanup: +- HMAC_CTX_cleanup(&ctx); ++ HMAC_CTX_free(ctx); + out: + free(key); + return err ?: mdlen; diff --git a/src/evmctl.c b/src/evmctl.c index c54efbb..7d9be32 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -314,7 +314,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash) struct stat st; int err; uint32_t generation = 0; - EVP_MD_CTX ctx; + EVP_MD_CTX *ctx; unsigned int mdlen; char **xattrname; char xattr_value[1024]; @@ -366,9 +366,14 @@ static int calc_evm_hash(const char *file, unsigned char *hash) return -1; } - err = EVP_DigestInit(&ctx, EVP_sha1()); + ctx = EVP_MD_CTX_new(); + if (!ctx) { + log_err("EVP_MD_CTX_new() failed\n"); + return 1; + } + err = EVP_DigestInit_ex(ctx, EVP_sha1(), NULL); if (!err) { - log_err("EVP_DigestInit() failed\n"); + log_err("EVP_DigestInit_ex() failed\n"); return 1; } @@ -398,7 +403,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash) /*log_debug("name: %s, value: %s, size: %d\n", *xattrname, xattr_value, err);*/ log_info("name: %s, size: %d\n", *xattrname, err); log_debug_dump(xattr_value, err); - err = EVP_DigestUpdate(&ctx, xattr_value, err); + err = EVP_DigestUpdate(ctx, xattr_value, err); if (!err) { log_err("EVP_DigestUpdate() failed\n"); return 1; @@ -446,7 +451,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash) log_debug("hmac_misc (%d): ", hmac_size); log_debug_dump(&hmac_misc, hmac_size); - err = EVP_DigestUpdate(&ctx, &hmac_misc, hmac_size); + err = EVP_DigestUpdate(ctx, &hmac_misc, hmac_size); if (!err) { log_err("EVP_DigestUpdate() failed\n"); return 1; @@ -457,18 +462,19 @@ static int calc_evm_hash(const char *file, unsigned char *hash) if (err) return -1; - err = EVP_DigestUpdate(&ctx, (const unsigned char *)uuid, sizeof(uuid)); + err = EVP_DigestUpdate(ctx, (const unsigned char *)uuid, sizeof(uuid)); if (!err) { log_err("EVP_DigestUpdate() failed\n"); return 1; } } - err = EVP_DigestFinal(&ctx, hash, &mdlen); + err = EVP_DigestFinal_ex(ctx, hash, &mdlen); if (!err) { log_err("EVP_DigestFinal() failed\n"); return 1; } + EVP_MD_CTX_free(ctx); return mdlen; } @@ -908,7 +914,7 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h struct stat st; int err = -1; uint32_t generation = 0; - HMAC_CTX ctx; + HMAC_CTX *ctx; unsigned int mdlen; char **xattrname; unsigned char xattr_value[1024]; @@ -965,10 +971,15 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h goto out; } - err = !HMAC_Init(&ctx, evmkey, sizeof(evmkey), EVP_sha1()); + ctx = HMAC_CTX_new(); + if (!ctx) { + log_err("HMAC_MD_CTX_new() failed\n"); + goto out; + } + err = !HMAC_Init_ex(ctx, evmkey, sizeof(evmkey), EVP_sha1(), NULL); if (err) { log_err("HMAC_Init() failed\n"); - goto out; + goto out_ctx_cleanup; } for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) { @@ -984,7 +995,7 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h /*log_debug("name: %s, value: %s, size: %d\n", *xattrname, xattr_value, err);*/ log_info("name: %s, size: %d\n", *xattrname, err); log_debug_dump(xattr_value, err); - err = !HMAC_Update(&ctx, xattr_value, err); + err = !HMAC_Update(ctx, xattr_value, err); if (err) { log_err("HMAC_Update() failed\n"); goto out_ctx_cleanup; @@ -1025,16 +1036,16 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h log_debug("hmac_misc (%d): ", hmac_size); log_debug_dump(&hmac_misc, hmac_size); - err = !HMAC_Update(&ctx, (const unsigned char *)&hmac_misc, hmac_size); + err = !HMAC_Update(ctx, (const unsigned char *)&hmac_misc, hmac_size); if (err) { log_err("HMAC_Update() failed\n"); goto out_ctx_cleanup; } - err = !HMAC_Final(&ctx, hash, &mdlen); + err = !HMAC_Final(ctx, hash, &mdlen); if (err) log_err("HMAC_Final() failed\n"); out_ctx_cleanup: - HMAC_CTX_cleanup(&ctx); + HMAC_CTX_free(ctx); out: free(key); return err ?: mdlen; diff --git a/src/libimaevm.c b/src/libimaevm.c index eedffb4..f6339e5 100644 --- a/src/libimaevm.c +++ b/src/libimaevm.c @@ -271,7 +271,7 @@ int ima_calc_hash(const char *file, uint8_t *hash) { const EVP_MD *md; struct stat st; - EVP_MD_CTX ctx; + EVP_MD_CTX *ctx; unsigned int mdlen; int err; @@ -288,25 +288,30 @@ int ima_calc_hash(const char *file, uint8_t *hash) return 1; } - err = EVP_DigestInit(&ctx, md); + ctx = EVP_MD_CTX_new(); + if (!ctx) { + log_err("EVP_MD_CTX_new() failed\n"); + return 1; + } + err = EVP_DigestInit_ex(ctx, md, NULL); if (!err) { - log_err("EVP_DigestInit() failed\n"); + log_err("EVP_DigestInit_ex() failed\n"); return 1; } switch (st.st_mode & S_IFMT) { case S_IFREG: - err = add_file_hash(file, &ctx); + err = add_file_hash(file, ctx); break; case S_IFDIR: - err = add_dir_hash(file, &ctx); + err = add_dir_hash(file, ctx); break; case S_IFLNK: - err = add_link_hash(file, &ctx); + err = add_link_hash(file, ctx); break; case S_IFIFO: case S_IFSOCK: case S_IFCHR: case S_IFBLK: - err = add_dev_hash(&st, &ctx); + err = add_dev_hash(&st, ctx); break; default: log_errno("Unsupported file type"); @@ -316,11 +321,12 @@ int ima_calc_hash(const char *file, uint8_t *hash) if (err) return err; - err = EVP_DigestFinal(&ctx, hash, &mdlen); + err = EVP_DigestFinal_ex(ctx, hash, &mdlen); if (!err) { - log_err("EVP_DigestFinal() failed\n"); + log_err("EVP_DigestFinal_ex() failed\n"); return 1; } + EVP_MD_CTX_free(ctx); return mdlen; } @@ -549,6 +555,7 @@ int key2bin(RSA *key, unsigned char *pub) { int len, b, offset = 0; struct pubkey_hdr *pkh = (struct pubkey_hdr *)pub; + const BIGNUM *n, *e; /* add key header */ pkh->version = 1; @@ -558,18 +565,19 @@ int key2bin(RSA *key, unsigned char *pub) offset += sizeof(*pkh); - len = BN_num_bytes(key->n); - b = BN_num_bits(key->n); + RSA_get0_key(key, &n, &e, NULL); + len = BN_num_bytes(n); + b = BN_num_bits(n); pub[offset++] = b >> 8; pub[offset++] = b & 0xff; - BN_bn2bin(key->n, &pub[offset]); + BN_bn2bin(n, &pub[offset]); offset += len; - len = BN_num_bytes(key->e); - b = BN_num_bits(key->e); + len = BN_num_bytes(e); + b = BN_num_bits(e); pub[offset++] = b >> 8; pub[offset++] = b & 0xff; - BN_bn2bin(key->e, &pub[offset]); + BN_bn2bin(e, &pub[offset]); offset += len; return offset;