Remove warnings when openssl 3 is used. (#13170)
* remove_warnings_openssl_v3: Add new macro to define latest OpenSSL version * remove_warnings_openssl_v3: Add headers necessary for new API * remove_warnings_openssl_v3: Add compatible variables and adjst code inside load_private_key * remove_warnings_openssl_v3: Adjust function aclk_get_mqtt_otp according to openssl version * remove_warnings_openssl_v3: Adjust function private_decrypt * remove_warnings_openssl_v3: Fix function private_decrypt * remove_warnings_openssl_v3: Update error message * remove_warnings_openssl_v3: Update missing error message
thiagoftsm committed
Jun 30, 2022 at 07:11 UTC
12340cf1ef5065c5ab539967e610a263cc602741
4 files changed
+77
-3
aclk/aclk.c
+33
-1
@@ -49,11 +49,25 @@ struct aclk_shared_state aclk_shared_state = {
49
.mqtt_shutdown_msg_rcvd = 0
50
};
51
52
+#if OPENSSL_VERSION_NUMBER >= OPENSSL_VERSION_300
53
+OSSL_DECODER_CTX *aclk_dctx = NULL;
54
+EVP_PKEY *aclk_private_key = NULL;
55
+#else
56
static RSA *aclk_private_key = NULL;
57
+#endif
58
static int load_private_key()
59
{
55
- if (aclk_private_key != NULL)
60
+ if (aclk_private_key != NULL) {
61
+#if OPENSSL_VERSION_NUMBER >= OPENSSL_VERSION_300
62
+ EVP_PKEY_free(aclk_private_key);
63
+ if (aclk_dctx)
64
+ OSSL_DECODER_CTX_free(aclk_dctx);
65
+
66
+ aclk_dctx = NULL;
67
+#else
68
RSA_free(aclk_private_key);
69
+#endif
70
+ }
71
aclk_private_key = NULL;
72
char filename[FILENAME_MAX + 1];
73
snprintfz(filename, FILENAME_MAX, "%s/cloud.d/private.pem", netdata_configured_varlib_dir);
@@ -72,7 +86,25 @@ static int load_private_key()
86
goto biofailed;
87
}
88
89
+#if OPENSSL_VERSION_NUMBER >= OPENSSL_VERSION_300
90
+ aclk_dctx = OSSL_DECODER_CTX_new_for_pkey(&aclk_private_key, "PEM", NULL,
91
+ "RSA",
92
+ OSSL_KEYMGMT_SELECT_PRIVATE_KEY,
93
+ NULL, NULL);
94
+
95
+ if (!aclk_dctx) {
96
+ error("Loading private key (from claiming) failed - no OpenSSL Decoders found");
97
+ goto biofailed;
98
+ }
99
+
100
+ // this is necesseary to avoid RSA key with wrong size
101
+ if (!OSSL_DECODER_from_bio(aclk_dctx, key_bio)) {
102
+ error("Decoding private key (from claiming) failed - invalid format.");
103
+ goto biofailed;
104
+ }
105
+#else
106
aclk_private_key = PEM_read_bio_RSAPrivateKey(key_bio, NULL, NULL, NULL);
107
+#endif
108
BIO_free(key_bio);
109
if (aclk_private_key!=NULL)
110
{
aclk/aclk_otp.c
+32
-2
@@ -446,11 +446,37 @@ cleanup_buffers:
446
return rc;
447
}
448
449
+#if OPENSSL_VERSION_NUMBER >= OPENSSL_VERSION_300
450
+static int private_decrypt(EVP_PKEY *p_key, unsigned char * enc_data, int data_len, unsigned char **decrypted)
451
+#else
452
static int private_decrypt(RSA *p_key, unsigned char * enc_data, int data_len, unsigned char **decrypted)
453
+#endif
454
{
455
+ int result;
456
+#if OPENSSL_VERSION_NUMBER >= OPENSSL_VERSION_300
457
+ size_t outlen = EVP_PKEY_size(p_key);
458
+ EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new(p_key, NULL);
459
+ if (!ctx)
460
+ return 1;
461
+
462
+ if (EVP_PKEY_decrypt_init(ctx) <= 0)
463
+ return 1;
464
+
465
+ if (EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_OAEP_PADDING) <= 0)
466
+ return 1;
467
+
468
+ *decrypted = mallocz(outlen);
469
+
470
+ if (EVP_PKEY_decrypt(ctx, *decrypted, &outlen, enc_data, data_len) == 1)
471
+ result = (int) outlen;
472
+ else
473
+ result = -1;
474
+#else
475
*decrypted = mallocz(RSA_size(p_key));
452
- int result = RSA_private_decrypt(data_len, enc_data, *decrypted, p_key, RSA_PKCS1_OAEP_PADDING);
453
- if (result == -1) {
476
+ result = RSA_private_decrypt(data_len, enc_data, *decrypted, p_key, RSA_PKCS1_OAEP_PADDING);
477
+#endif
478
+ if (result == -1)
479
+ {
480
char err[512];
481
ERR_error_string_n(ERR_get_error(), err, sizeof(err));
482
error("Decryption of the challenge failed: %s", err);
@@ -458,7 +484,11 @@ static int private_decrypt(RSA *p_key, unsigned char * enc_data, int data_len, u
484
return result;
485
}
486
487
+#if OPENSSL_VERSION_NUMBER >= OPENSSL_VERSION_300
488
+int aclk_get_mqtt_otp(EVP_PKEY *p_key, char **mqtt_id, char **mqtt_usr, char **mqtt_pass, url_t *target)
489
+#else
490
int aclk_get_mqtt_otp(RSA *p_key, char **mqtt_id, char **mqtt_usr, char **mqtt_pass, url_t *target)
491
+#endif
492
{
493
unsigned char *challenge;
494
int challenge_bytes;
aclk/aclk_otp.h
+4
@@ -8,7 +8,11 @@
8
#include "https_client.h"
9
#include "aclk_util.h"
10
11
+#if OPENSSL_VERSION_NUMBER >= OPENSSL_VERSION_300
12
+int aclk_get_mqtt_otp(EVP_PKEY *p_key, char **mqtt_id, char **mqtt_usr, char **mqtt_pass, url_t *target);
13
+#else
14
int aclk_get_mqtt_otp(RSA *p_key, char **mqtt_id, char **mqtt_usr, char **mqtt_pass, url_t *target);
15
+#endif
16
int aclk_get_env(aclk_env_t *env, const char *aclk_hostname, int aclk_port);
17
18
#endif /* ACLK_OTP_H */
libnetdata/socket/security.h
+8
@@ -22,13 +22,21 @@
22
#define OPENSSL_VERSION_097 0x0907000L
23
#define OPENSSL_VERSION_110 0x10100000L
24
#define OPENSSL_VERSION_111 0x10101000L
25
+#define OPENSSL_VERSION_300 0x30000000L
26
27
# include <openssl/ssl.h>
28
# include <openssl/err.h>
29
+# include <openssl/evp.h>
30
+# include <openssl/pem.h>
31
# if (SSLEAY_VERSION_NUMBER >= OPENSSL_VERSION_097) && (OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110)
32
# include <openssl/conf.h>
33
# endif
34
35
+#if OPENSSL_VERSION_NUMBER >= OPENSSL_VERSION_300
36
+#include <openssl/core_names.h>
37
+#include <openssl/decoder.h>
38
+#endif
39
+
40
struct netdata_ssl{
41
SSL *conn; //SSL connection
42
uint32_t flags; //The flags for SSL connection