patched for openssl1.1 interface with patch file from fedora porject https://fedora.pkgs.org/rawhide/fedora-x86_64/ima-evm-utils-1.0-3.fc28.x86_64.rpm.html

patch/openssl1-1-interface.patch

@@ -0,0 +1,224 @@
+diff -urNp ima-evm-utils-1.0-orig/src/libimaevm.c ima-evm-utils-1.0/src/libimaevm.c
+--- ima-evm-utils-1.0-orig/src/libimaevm.c	2015-07-30 15:28:53.000000000 -0300
++++ ima-evm-utils-1.0/src/libimaevm.c	2017-12-01 12:01:28.008705290 -0200
+@@ -269,7 +269,7 @@ int ima_calc_hash(const char *file, uint
+ {
+ 	const EVP_MD *md;
+ 	struct stat st;
+-	EVP_MD_CTX ctx;
++	EVP_MD_CTX *ctx;
+ 	unsigned int mdlen;
+ 	int err;
+ 
+@@ -286,25 +286,30 @@ int ima_calc_hash(const char *file, uint
+ 		return 1;
+ 	}
+ 
+-	err = EVP_DigestInit(&ctx, md);
++	ctx = EVP_MD_CTX_new();
++	if (!ctx) {
++		log_err("EVP_MD_CTX_new() failed\n");
++		return 1;
++	}
++	err = EVP_DigestInit_ex(ctx, md, NULL);
+ 	if (!err) {
+-		log_err("EVP_DigestInit() failed\n");
++		log_err("EVP_DigestInit_ex() failed\n");
+ 		return 1;
+ 	}
+ 
+ 	switch (st.st_mode & S_IFMT) {
+ 	case S_IFREG:
+-		err = add_file_hash(file, &ctx);
++		err = add_file_hash(file, ctx);
+ 		break;
+ 	case S_IFDIR:
+-		err = add_dir_hash(file, &ctx);
++		err = add_dir_hash(file, ctx);
+ 		break;
+ 	case S_IFLNK:
+-		err = add_link_hash(file, &ctx);
++		err = add_link_hash(file, ctx);
+ 		break;
+ 	case S_IFIFO: case S_IFSOCK:
+ 	case S_IFCHR: case S_IFBLK:
+-		err = add_dev_hash(&st, &ctx);
++		err = add_dev_hash(&st, ctx);
+ 		break;
+ 	default:
+ 		log_errno("Unsupported file type");
+@@ -314,11 +319,12 @@ int ima_calc_hash(const char *file, uint
+ 	if (err)
+ 		return err;
+ 
+-	err = EVP_DigestFinal(&ctx, hash, &mdlen);
++	err = EVP_DigestFinal_ex(ctx, hash, &mdlen);
+ 	if (!err) {
+-		log_err("EVP_DigestFinal() failed\n");
++		log_err("EVP_DigestFinal_ex() failed\n");
+ 		return 1;
+ 	}
++	EVP_MD_CTX_free(ctx);
+ 
+ 	return mdlen;
+ }
+@@ -547,6 +553,7 @@ int key2bin(RSA *key, unsigned char *pub
+ {
+ 	int len, b, offset = 0;
+ 	struct pubkey_hdr *pkh = (struct pubkey_hdr *)pub;
++	const BIGNUM *n, *e;
+ 
+ 	/* add key header */
+ 	pkh->version = 1;
+@@ -556,18 +563,19 @@ int key2bin(RSA *key, unsigned char *pub
+ 
+ 	offset += sizeof(*pkh);
+ 
+-	len = BN_num_bytes(key->n);
+-	b = BN_num_bits(key->n);
++	RSA_get0_key(key, &n, &e, NULL);
++	len = BN_num_bytes(n);
++	b = BN_num_bits(n);
+ 	pub[offset++] = b >> 8;
+ 	pub[offset++] = b & 0xff;
+-	BN_bn2bin(key->n, &pub[offset]);
++	BN_bn2bin(n, &pub[offset]);
+ 	offset += len;
+ 
+-	len = BN_num_bytes(key->e);
+-	b = BN_num_bits(key->e);
++	len = BN_num_bytes(e);
++	b = BN_num_bits(e);
+ 	pub[offset++] = b >> 8;
+ 	pub[offset++] = b & 0xff;
+-	BN_bn2bin(key->e, &pub[offset]);
++	BN_bn2bin(e, &pub[offset]);
+ 	offset += len;
+ 
+ 	return offset;
+
+diff -urNp ima-evm-utils-1.0-orig/src/evmctl.c ima-evm-utils-1.0/src/evmctl.c
+--- ima-evm-utils-1.0-orig/src/evmctl.c	2015-07-30 15:28:53.000000000 -0300
++++ ima-evm-utils-1.0/src/evmctl.c	2017-12-01 12:00:39.683306265 -0200
+@@ -305,7 +305,7 @@ static int calc_evm_hash(const char *fil
+ 	struct stat st;
+ 	int err;
+ 	uint32_t generation = 0;
+-	EVP_MD_CTX ctx;
++	EVP_MD_CTX *ctx;
+ 	unsigned int mdlen;
+ 	char **xattrname;
+ 	char xattr_value[1024];
+@@ -345,9 +345,14 @@ static int calc_evm_hash(const char *fil
+ 		return -1;
+ 	}
+ 
+-	err = EVP_DigestInit(&ctx, EVP_sha1());
++	ctx = EVP_MD_CTX_new();
++	if (!ctx) {
++		log_err("EVP_MD_CTX_new() failed\n");
++		return 1;
++	}
++	err = EVP_DigestInit_ex(ctx, EVP_sha1(), NULL);
+ 	if (!err) {
+-		log_err("EVP_DigestInit() failed\n");
++		log_err("EVP_DigestInit_ex() failed\n");
+ 		return 1;
+ 	}
+ 
+@@ -364,7 +369,7 @@ static int calc_evm_hash(const char *fil
+ 		/*log_debug("name: %s, value: %s, size: %d\n", *xattrname, xattr_value, err);*/
+ 		log_info("name: %s, size: %d\n", *xattrname, err);
+ 		log_debug_dump(xattr_value, err);
+-		err = EVP_DigestUpdate(&ctx, xattr_value, err);
++		err = EVP_DigestUpdate(ctx, xattr_value, err);
+ 		if (!err) {
+ 			log_err("EVP_DigestUpdate() failed\n");
+ 			return 1;
+@@ -412,7 +417,7 @@ static int calc_evm_hash(const char *fil
+ 	log_debug("hmac_misc (%d): ", hmac_size);
+ 	log_debug_dump(&hmac_misc, hmac_size);
+ 
+-	err = EVP_DigestUpdate(&ctx, &hmac_misc, hmac_size);
++	err = EVP_DigestUpdate(ctx, &hmac_misc, hmac_size);
+ 	if (!err) {
+ 		log_err("EVP_DigestUpdate() failed\n");
+ 		return 1;
+@@ -423,18 +428,19 @@ static int calc_evm_hash(const char *fil
+ 		if (err)
+ 			return -1;
+ 
+-		err = EVP_DigestUpdate(&ctx, (const unsigned char *)uuid, sizeof(uuid));
++		err = EVP_DigestUpdate(ctx, (const unsigned char *)uuid, sizeof(uuid));
+ 		if (!err) {
+ 			log_err("EVP_DigestUpdate() failed\n");
+ 			return 1;
+ 		}
+ 	}
+ 
+-	err = EVP_DigestFinal(&ctx, hash, &mdlen);
++	err = EVP_DigestFinal_ex(ctx, hash, &mdlen);
+ 	if (!err) {
+ 		log_err("EVP_DigestFinal() failed\n");
+ 		return 1;
+ 	}
++	EVP_MD_CTX_free(ctx);
+ 
+ 	return mdlen;
+ }
+@@ -844,7 +850,7 @@ static int calc_evm_hmac(const char *fil
+ 	struct stat st;
+ 	int err = -1;
+ 	uint32_t generation = 0;
+-	HMAC_CTX ctx;
++	HMAC_CTX *ctx;
+ 	unsigned int mdlen;
+ 	char **xattrname;
+ 	unsigned char xattr_value[1024];
+@@ -900,10 +906,15 @@ static int calc_evm_hmac(const char *fil
+ 		goto out;
+ 	}
+ 
+-	err = !HMAC_Init(&ctx, evmkey, sizeof(evmkey), EVP_sha1());
++	ctx = HMAC_CTX_new();
++	if (!ctx) {
++		log_err("HMAC_MD_CTX_new() failed\n");
++		goto out;
++	}
++	err = !HMAC_Init_ex(ctx, evmkey, sizeof(evmkey), EVP_sha1(), NULL);
+ 	if (err) {
+ 		log_err("HMAC_Init() failed\n");
+-		goto out;
++		goto out_ctx_cleanup;
+ 	}
+ 
+ 	for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) {
+@@ -919,7 +930,7 @@ static int calc_evm_hmac(const char *fil
+ 		/*log_debug("name: %s, value: %s, size: %d\n", *xattrname, xattr_value, err);*/
+ 		log_info("name: %s, size: %d\n", *xattrname, err);
+ 		log_debug_dump(xattr_value, err);
+-		err = !HMAC_Update(&ctx, xattr_value, err);
++		err = !HMAC_Update(ctx, xattr_value, err);
+ 		if (err) {
+ 			log_err("HMAC_Update() failed\n");
+ 			goto out_ctx_cleanup;
+@@ -960,16 +971,16 @@ static int calc_evm_hmac(const char *fil
+ 	log_debug("hmac_misc (%d): ", hmac_size);
+ 	log_debug_dump(&hmac_misc, hmac_size);
+ 
+-	err = !HMAC_Update(&ctx, (const unsigned char *)&hmac_misc, hmac_size);
++	err = !HMAC_Update(ctx, (const unsigned char *)&hmac_misc, hmac_size);
+ 	if (err) {
+ 		log_err("HMAC_Update() failed\n");
+ 		goto out_ctx_cleanup;
+ 	}
+-	err = !HMAC_Final(&ctx, hash, &mdlen);
++	err = !HMAC_Final(ctx, hash, &mdlen);
+ 	if (err)
+ 		log_err("HMAC_Final() failed\n");
+ out_ctx_cleanup:
+-	HMAC_CTX_cleanup(&ctx);
++	HMAC_CTX_free(ctx);
+ out:
+ 	free(key);
+ 	return err ?: mdlen;

src/evmctl.c

@@ -314,7 +314,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
 	struct stat st;
 	int err;
 	uint32_t generation = 0;
-	EVP_MD_CTX ctx;
+	EVP_MD_CTX *ctx;
 	unsigned int mdlen;
 	char **xattrname;
 	char xattr_value[1024];
@@ -366,9 +366,14 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
 		return -1;
 	}
 
-	err = EVP_DigestInit(&ctx, EVP_sha1());
+	ctx = EVP_MD_CTX_new();
+	if (!ctx) {
+		log_err("EVP_MD_CTX_new() failed\n");
+		return 1;
+	}
+	err = EVP_DigestInit_ex(ctx, EVP_sha1(), NULL);
 	if (!err) {
-		log_err("EVP_DigestInit() failed\n");
+		log_err("EVP_DigestInit_ex() failed\n");
 		return 1;
 	}
 
@@ -398,7 +403,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
 		/*log_debug("name: %s, value: %s, size: %d\n", *xattrname, xattr_value, err);*/
 		log_info("name: %s, size: %d\n", *xattrname, err);
 		log_debug_dump(xattr_value, err);
-		err = EVP_DigestUpdate(&ctx, xattr_value, err);
+		err = EVP_DigestUpdate(ctx, xattr_value, err);
 		if (!err) {
 			log_err("EVP_DigestUpdate() failed\n");
 			return 1;
@@ -446,7 +451,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
 	log_debug("hmac_misc (%d): ", hmac_size);
 	log_debug_dump(&hmac_misc, hmac_size);
 
-	err = EVP_DigestUpdate(&ctx, &hmac_misc, hmac_size);
+	err = EVP_DigestUpdate(ctx, &hmac_misc, hmac_size);
 	if (!err) {
 		log_err("EVP_DigestUpdate() failed\n");
 		return 1;
@@ -457,18 +462,19 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
 		if (err)
 			return -1;
 
-		err = EVP_DigestUpdate(&ctx, (const unsigned char *)uuid, sizeof(uuid));
+		err = EVP_DigestUpdate(ctx, (const unsigned char *)uuid, sizeof(uuid));
 		if (!err) {
 			log_err("EVP_DigestUpdate() failed\n");
 			return 1;
 		}
 	}
 
-	err = EVP_DigestFinal(&ctx, hash, &mdlen);
+	err = EVP_DigestFinal_ex(ctx, hash, &mdlen);
 	if (!err) {
 		log_err("EVP_DigestFinal() failed\n");
 		return 1;
 	}
+	EVP_MD_CTX_free(ctx);
 
 	return mdlen;
 }
@@ -908,7 +914,7 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
 	struct stat st;
 	int err = -1;
 	uint32_t generation = 0;
-	HMAC_CTX ctx;
+	HMAC_CTX *ctx;
 	unsigned int mdlen;
 	char **xattrname;
 	unsigned char xattr_value[1024];
@@ -965,10 +971,15 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
 		goto out;
 	}
 
-	err = !HMAC_Init(&ctx, evmkey, sizeof(evmkey), EVP_sha1());
+	ctx = HMAC_CTX_new();
+	if (!ctx) {
+		log_err("HMAC_MD_CTX_new() failed\n");
+		goto out;
+	}
+	err = !HMAC_Init_ex(ctx, evmkey, sizeof(evmkey), EVP_sha1(), NULL);
 	if (err) {
 		log_err("HMAC_Init() failed\n");
-		goto out;
+		goto out_ctx_cleanup;
 	}
 
 	for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) {
@@ -984,7 +995,7 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
 		/*log_debug("name: %s, value: %s, size: %d\n", *xattrname, xattr_value, err);*/
 		log_info("name: %s, size: %d\n", *xattrname, err);
 		log_debug_dump(xattr_value, err);
-		err = !HMAC_Update(&ctx, xattr_value, err);
+		err = !HMAC_Update(ctx, xattr_value, err);
 		if (err) {
 			log_err("HMAC_Update() failed\n");
 			goto out_ctx_cleanup;
@@ -1025,16 +1036,16 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
 	log_debug("hmac_misc (%d): ", hmac_size);
 	log_debug_dump(&hmac_misc, hmac_size);
 
-	err = !HMAC_Update(&ctx, (const unsigned char *)&hmac_misc, hmac_size);
+	err = !HMAC_Update(ctx, (const unsigned char *)&hmac_misc, hmac_size);
 	if (err) {
 		log_err("HMAC_Update() failed\n");
 		goto out_ctx_cleanup;
 	}
-	err = !HMAC_Final(&ctx, hash, &mdlen);
+	err = !HMAC_Final(ctx, hash, &mdlen);
 	if (err)
 		log_err("HMAC_Final() failed\n");
 out_ctx_cleanup:
-	HMAC_CTX_cleanup(&ctx);
+	HMAC_CTX_free(ctx);
 out:
 	free(key);
 	return err ?: mdlen;

src/libimaevm.c

@@ -271,7 +271,7 @@ int ima_calc_hash(const char *file, uint8_t *hash)
 {
 	const EVP_MD *md;
 	struct stat st;
-	EVP_MD_CTX ctx;
+	EVP_MD_CTX *ctx;
 	unsigned int mdlen;
 	int err;
 
@@ -288,25 +288,30 @@ int ima_calc_hash(const char *file, uint8_t *hash)
 		return 1;
 	}
 
-	err = EVP_DigestInit(&ctx, md);
+	ctx = EVP_MD_CTX_new();
+	if (!ctx) {
+		log_err("EVP_MD_CTX_new() failed\n");
+		return 1;
+	}
+	err = EVP_DigestInit_ex(ctx, md, NULL);
 	if (!err) {
-		log_err("EVP_DigestInit() failed\n");
+		log_err("EVP_DigestInit_ex() failed\n");
 		return 1;
 	}
 
 	switch (st.st_mode & S_IFMT) {
 	case S_IFREG:
-		err = add_file_hash(file, &ctx);
+		err = add_file_hash(file, ctx);
 		break;
 	case S_IFDIR:
-		err = add_dir_hash(file, &ctx);
+		err = add_dir_hash(file, ctx);
 		break;
 	case S_IFLNK:
-		err = add_link_hash(file, &ctx);
+		err = add_link_hash(file, ctx);
 		break;
 	case S_IFIFO: case S_IFSOCK:
 	case S_IFCHR: case S_IFBLK:
-		err = add_dev_hash(&st, &ctx);
+		err = add_dev_hash(&st, ctx);
 		break;
 	default:
 		log_errno("Unsupported file type");
@@ -316,11 +321,12 @@ int ima_calc_hash(const char *file, uint8_t *hash)
 	if (err)
 		return err;
 
-	err = EVP_DigestFinal(&ctx, hash, &mdlen);
+	err = EVP_DigestFinal_ex(ctx, hash, &mdlen);
 	if (!err) {
-		log_err("EVP_DigestFinal() failed\n");
+		log_err("EVP_DigestFinal_ex() failed\n");
 		return 1;
 	}
+	EVP_MD_CTX_free(ctx);
 
 	return mdlen;
 }
@@ -549,6 +555,7 @@ int key2bin(RSA *key, unsigned char *pub)
 {
 	int len, b, offset = 0;
 	struct pubkey_hdr *pkh = (struct pubkey_hdr *)pub;
+	const BIGNUM *n, *e;
 
 	/* add key header */
 	pkh->version = 1;
@@ -558,18 +565,19 @@ int key2bin(RSA *key, unsigned char *pub)
 
 	offset += sizeof(*pkh);
 
-	len = BN_num_bytes(key->n);
-	b = BN_num_bits(key->n);
+	RSA_get0_key(key, &n, &e, NULL);
+	len = BN_num_bytes(n);
+	b = BN_num_bits(n);
 	pub[offset++] = b >> 8;
 	pub[offset++] = b & 0xff;
-	BN_bn2bin(key->n, &pub[offset]);
+	BN_bn2bin(n, &pub[offset]);
 	offset += len;
 
-	len = BN_num_bytes(key->e);
-	b = BN_num_bits(key->e);
+	len = BN_num_bytes(e);
+	b = BN_num_bits(e);
 	pub[offset++] = b >> 8;
 	pub[offset++] = b & 0xff;
-	BN_bn2bin(key->e, &pub[offset]);
+	BN_bn2bin(e, &pub[offset]);
 	offset += len;
 
 	return offset;