Add compat functions for EVP_Digest{Sign,Verify}.

This should make LibreSSL 3.1.x through 3.3.x work again.  Code from
tb@, ok djm@.  Restore the test configs covering those.

diff --git a/.github/workflows/c-cpp.yml b/.github/workflows/c-cpp.yml
index a5cac7c8eafa0acfd074b604a6774657b05f226e..609028703f8093fa2eef7f6da57ed971e69303a7 100644 (file)
--- a/.github/workflows/c-cpp.yml
+++ b/.github/workflows/c-cpp.yml
@@ -57,6 +57,8 @@ jobs:
           - { target: ubuntu-20.04, config: musl }
           - { target: ubuntu-latest, config: boringssl }
           - { target: ubuntu-latest, config: libressl-master }
+          - { target: ubuntu-latest, config: libressl-3.2.6 }
+          - { target: ubuntu-latest, config: libressl-3.3.6 }
           - { target: ubuntu-latest, config: libressl-3.4.3 }
           - { target: ubuntu-latest, config: libressl-3.5.3 }
           - { target: ubuntu-latest, config: libressl-3.6.1 }

diff --git a/configure.ac b/configure.ac
index d21b57989ccaba982de061994ca669087d1103dc..591d5a3880c59c23074fe58f2eb580ff4d71938c 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -2983,6 +2983,8 @@ if test "x$openssl" = "xyes" ; then
                BN_is_prime_ex \
                DES_crypt \
                DSA_generate_parameters_ex \
+               EVP_DigestSign \
+               EVP_DigestVerify \
                EVP_DigestFinal_ex \
                EVP_DigestInit_ex \
                EVP_MD_CTX_cleanup \

diff --git a/openbsd-compat/openssl-compat.c b/openbsd-compat/openssl-compat.c
index 6c65003f2b3c90af4295e6d127a2ef1f521ae961..14865077e469edd2aa93df5000e6adc5a1ccd516 100644 (file)
--- a/openbsd-compat/openssl-compat.c
+++ b/openbsd-compat/openssl-compat.c
@@ -95,4 +95,30 @@ ssh_libcrypto_init(void)
 #endif /* USE_OPENSSL_ENGINE */
 }
 
+#ifndef HAVE_EVP_DIGESTSIGN
+int
+EVP_DigestSign(EVP_MD_CTX *ctx, unsigned char *sigret, size_t *siglen,
+    const unsigned char *tbs, size_t tbslen)
+{
+       if (sigret != NULL) {
+               if (EVP_DigestSignUpdate(ctx, tbs, tbslen) <= 0)
+                       return 0;
+       }
+
+       return EVP_DigestSignFinal(ctx, sigret, siglen);
+}
+#endif
+
+#ifndef HAVE_EVP_DIGESTVERIFY
+int
+EVP_DigestVerify(EVP_MD_CTX *ctx, const unsigned char *sigret, size_t siglen,
+    const unsigned char *tbs, size_t tbslen)
+{
+       if (EVP_DigestVerifyUpdate(ctx, tbs, tbslen) <= 0)
+               return -1;
+
+       return EVP_DigestVerifyFinal(ctx, sigret, siglen);
+}
+#endif
+
 #endif /* WITH_OPENSSL */

diff --git a/openbsd-compat/openssl-compat.h b/openbsd-compat/openssl-compat.h
index f6796b3baaa9e0ba012d58716b6a8e41625e6514..2b9780f5e86bff41b90f2400a5b793570bfd9fb7 100644 (file)
--- a/openbsd-compat/openssl-compat.h
+++ b/openbsd-compat/openssl-compat.h
@@ -78,5 +78,15 @@ int EVP_CIPHER_CTX_set_iv(EVP_CIPHER_CTX *ctx,
     const unsigned char *iv, size_t len);
 #endif /* HAVE_EVP_CIPHER_CTX_SET_IV */
 
+#ifndef HAVE_EVP_DIGESTSIGN
+int EVP_DigestSign(EVP_MD_CTX *, unsigned char *, size_t *,
+    const unsigned char *, size_t);
+#endif
+
+#ifndef HAVE_EVP_DIGESTVERIFY
+int EVP_DigestVerify(EVP_MD_CTX *, const unsigned char *, size_t,
+    const unsigned char *, size_t);
+#endif
+
 #endif /* WITH_OPENSSL */
 #endif /* _OPENSSL_COMPAT_H */