- djm@cvs.openbsd.org 2010/11/10 01:33:07

     [kexdhc.c kexdhs.c kexgexc.c kexgexs.c key.c moduli.c]
     use only libcrypto APIs that are retained with OPENSSL_NO_DEPRECATED.
     these have been around for years by this time. ok markus

diff --git a/ChangeLog b/ChangeLog
index 64c7d8abd6065b4dccbe9079acd14e1d07bea4b6..0f9ed852459acec3b09137bfec711b3f76862b7f 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -3,6 +3,10 @@
    - djm@cvs.openbsd.org 2010/11/05 02:46:47
      [packet.c]
      whitespace KNF
+   - djm@cvs.openbsd.org 2010/11/10 01:33:07
+     [kexdhc.c kexdhs.c kexgexc.c kexgexs.c key.c moduli.c]
+     use only libcrypto APIs that are retained with OPENSSL_NO_DEPRECATED.
+     these have been around for years by this time. ok markus
 
 20101111
  - (djm) [servconf.c ssh-add.c ssh-keygen.c] don't look for ECDSA keys on

diff --git a/kexdhc.c b/kexdhc.c
index d384c8052b605d5fe934de3d628cd82929db67c0..76ceb5dd89e07e80db07ea3311cd1b0eedbb2f83 100644 (file)
--- a/kexdhc.c
+++ b/kexdhc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexdhc.c,v 1.11 2006/11/06 21:25:28 markus Exp $ */
+/* $OpenBSD: kexdhc.c,v 1.12 2010/11/10 01:33:07 djm Exp $ */
 /*
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
  *
@@ -27,6 +27,8 @@
 
 #include <sys/types.h>
 
+#include <openssl/dh.h>
+
 #include <stdarg.h>
 #include <stdio.h>
 #include <string.h>

diff --git a/kexdhs.c b/kexdhs.c
index e722877d5f860cd9d364e4e8fb58c0c1c0daa9e4..f56e88764a7c8eebcb1116153f40970d9b099ccf 100644 (file)
--- a/kexdhs.c
+++ b/kexdhs.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexdhs.c,v 1.11 2010/02/26 20:29:54 djm Exp $ */
+/* $OpenBSD: kexdhs.c,v 1.12 2010/11/10 01:33:07 djm Exp $ */
 /*
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
  *
@@ -31,6 +31,8 @@
 #include <string.h>
 #include <signal.h>
 
+#include <openssl/dh.h>
+
 #include "xmalloc.h"
 #include "buffer.h"
 #include "key.h"

diff --git a/kexgexc.c b/kexgexc.c
index adb973d5b40cb9656d2a7a3877f74ed066e1f7a1..79552d70983a965f7ad5dbc393ceccd21abe0988 100644 (file)
--- a/kexgexc.c
+++ b/kexgexc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexgexc.c,v 1.11 2006/11/06 21:25:28 markus Exp $ */
+/* $OpenBSD: kexgexc.c,v 1.12 2010/11/10 01:33:07 djm Exp $ */
 /*
  * Copyright (c) 2000 Niels Provos.  All rights reserved.
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
@@ -28,6 +28,8 @@
 
 #include <sys/types.h>
 
+#include <openssl/dh.h>
+
 #include <stdarg.h>
 #include <stdio.h>
 #include <string.h>

diff --git a/kexgexs.c b/kexgexs.c
index f4156af96362b119de18d046c3ac30aa1abda6cf..a5e3df7bcc3ba58931f3d1e42ff658061d459b2a 100644 (file)
--- a/kexgexs.c
+++ b/kexgexs.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexgexs.c,v 1.13 2010/02/26 20:29:54 djm Exp $ */
+/* $OpenBSD: kexgexs.c,v 1.14 2010/11/10 01:33:07 djm Exp $ */
 /*
  * Copyright (c) 2000 Niels Provos.  All rights reserved.
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
@@ -33,6 +33,8 @@
 #include <string.h>
 #include <signal.h>
 
+#include <openssl/dh.h>
+
 #include "xmalloc.h"
 #include "buffer.h"
 #include "key.h"

diff --git a/key.c b/key.c
index c71bf5b0a8e89b485e61f2e9b953053fbd0cb899..1defb1132e82f949578173ca64112ec214236692 100644 (file)
--- a/key.c
+++ b/key.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: key.c,v 1.94 2010/10/28 11:22:09 djm Exp $ */
+/* $OpenBSD: key.c,v 1.95 2010/11/10 01:33:07 djm Exp $ */
 /*
  * read_bignum():
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1013,25 +1013,33 @@ key_size(const Key *k)
 static RSA *
 rsa_generate_private_key(u_int bits)
 {
-       RSA *private;
+       RSA *private = RSA_new();
+       BIGNUM *f4 = BN_new();
 
-       private = RSA_generate_key(bits, RSA_F4, NULL, NULL);
        if (private == NULL)
-               fatal("rsa_generate_private_key: key generation failed.");
+               fatal("%s: RSA_new failed", __func__);
+       if (f4 == NULL)
+               fatal("%s: BN_new failed", __func__);
+       if (!BN_set_word(f4, RSA_F4))
+               fatal("%s: BN_new failed", __func__);
+       if (!RSA_generate_key_ex(private, bits, f4, NULL))
+               fatal("%s: key generation failed.", __func__);
+       BN_free(f4);
        return private;
 }
 
 static DSA*
 dsa_generate_private_key(u_int bits)
 {
-       DSA *private = DSA_generate_parameters(bits, NULL, 0, NULL, NULL, NULL, NULL);
+       DSA *private = DSA_new();
 
        if (private == NULL)
-               fatal("dsa_generate_private_key: DSA_generate_parameters failed");
+               fatal("%s: DSA_new failed", __func__);
+       if (!DSA_generate_parameters_ex(private, bits, NULL, 0, NULL,
+           NULL, NULL))
+               fatal("%s: DSA_generate_parameters failed", __func__);
        if (!DSA_generate_key(private))
-               fatal("dsa_generate_private_key: DSA_generate_key failed.");
-       if (private == NULL)
-               fatal("dsa_generate_private_key: NULL.");
+               fatal("%s: DSA_generate_key failed.", __func__);
        return private;
 }
 

diff --git a/moduli.c b/moduli.c
index f737cb3f517d2063ac30d4774da4e0d06dcc6677..2c2b388c7dc93a78ae798760d8b9394382e88995 100644 (file)
--- a/moduli.c
+++ b/moduli.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: moduli.c,v 1.21 2008/06/26 09:19:40 djm Exp $ */
+/* $OpenBSD: moduli.c,v 1.22 2010/11/10 01:33:07 djm Exp $ */
 /*
  * Copyright 1994 Phil Karn <karn@qualcomm.com>
  * Copyright 1996-1998, 2003 William Allen Simpson <wsimpson@greendragon.com>
@@ -600,7 +600,7 @@ prime_test(FILE *in, FILE *out, u_int32_t trials, u_int32_t generator_wanted)
                 * that p is also prime. A single pass will weed out the
                 * vast majority of composite q's.
                 */
-               if (BN_is_prime(q, 1, NULL, ctx, NULL) <= 0) {
+               if (BN_is_prime_ex(q, 1, ctx, NULL) <= 0) {
                        debug("%10u: q failed first possible prime test",
                            count_in);
                        continue;
@@ -613,14 +613,14 @@ prime_test(FILE *in, FILE *out, u_int32_t trials, u_int32_t generator_wanted)
                 * will show up on the first Rabin-Miller iteration so it
                 * doesn't hurt to specify a high iteration count.
                 */
-               if (!BN_is_prime(p, trials, NULL, ctx, NULL)) {
+               if (!BN_is_prime_ex(p, trials, ctx, NULL)) {
                        debug("%10u: p is not prime", count_in);
                        continue;
                }
                debug("%10u: p is almost certainly prime", count_in);
 
                /* recheck q more rigorously */
-               if (!BN_is_prime(q, trials - 1, NULL, ctx, NULL)) {
+               if (!BN_is_prime_ex(q, trials - 1, ctx, NULL)) {
                        debug("%10u: q is not prime", count_in);
                        continue;
                }