prefer libcrypto chacha20-poly1305 where possible

diff --git a/Makefile.in b/Makefile.in
index e7549470c520f11226e25648a27ddab3e82abc95..efbc62a4a4b7b7055046c780ee241fce59ec79fa 100644 (file)
--- a/Makefile.in
+++ b/Makefile.in
@@ -103,7 +103,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
        ssh-ed25519-sk.o ssh-rsa.o dh.o \
        msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
        ssh-pkcs11.o smult_curve25519_ref.o \
-       poly1305.o chacha.o cipher-chachapoly.o \
+       poly1305.o chacha.o cipher-chachapoly.o cipher-chachapoly-libcrypto.o \
        ssh-ed25519.o digest-openssl.o digest-libc.o \
        hmac.o sc25519.o ge25519.o fe25519.o ed25519.o verify.o hash.o \
        kex.o kexdh.o kexgex.o kexecdh.o kexc25519.o \

diff --git a/cipher-chachapoly-libcrypto.c b/cipher-chachapoly-libcrypto.c
index 960ac14cf1f0937310f3a129fa1882f5091f5b01..2c0f80f28ac2f2dbd1bc5d0d17f464391740a369 100644 (file)
--- a/cipher-chachapoly-libcrypto.c
+++ b/cipher-chachapoly-libcrypto.c
@@ -18,6 +18,8 @@
 
 #include "includes.h"
 
+#if defined(HAVE_EVP_CHACHA20) || !defined(HAVE_BROKEN_CHACHA20)
+
 #include <sys/types.h>
 #include <stdarg.h> /* needed for log.h */
 #include <string.h>
@@ -158,3 +160,4 @@ chachapoly_get_length(struct chachapoly_ctx *ctx,
        *plenp = PEEK_U32(buf);
        return 0;
 }
+#endif /* defined(HAVE_EVP_CHACHA20) && !defined(HAVE_BROKEN_CHACHA20) */

diff --git a/cipher-chachapoly.c b/cipher-chachapoly.c
index 42e8d40b7b19d7c1f45de0a69a96c9bfdba82497..132cdeec908bd5d00d072a4311fdbac70b7d7902 100644 (file)
--- a/cipher-chachapoly.c
+++ b/cipher-chachapoly.c
@@ -18,6 +18,8 @@
 
 #include "includes.h"
 
+#if !defined(HAVE_EVP_CHACHA20) || defined(HAVE_BROKEN_CHACHA20)
+
 #include <sys/types.h>
 #include <stdarg.h> /* needed for log.h */
 #include <string.h>
@@ -130,3 +132,5 @@ chachapoly_get_length(struct chachapoly_ctx *ctx,
        *plenp = PEEK_U32(buf);
        return 0;
 }
+
+#endif /* !defined(HAVE_EVP_CHACHA20) || defined(HAVE_BROKEN_CHACHA20) */

diff --git a/configure.ac b/configure.ac
index de6ad127c37a078e41ac296c14398a80e4261d96..9cba9542a8429e88742b85c0b1bee997690e3df1 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -2804,6 +2804,7 @@ if test "x$openssl" = "xyes" ; then
                EVP_PKEY_get0_RSA \
                EVP_MD_CTX_new \
                EVP_MD_CTX_free \
+               EVP_chacha20 \
        ])
 
        if test "x$openssl_engine" = "xyes" ; then

diff --git a/openbsd-compat/openssl-compat.h b/openbsd-compat/openssl-compat.h
index abdcb8763e5252255d630ba9d525cf9f22b8c533..bcefd8f28f9190e72bb99ed2c27b5f05294a36a3 100644 (file)
--- a/openbsd-compat/openssl-compat.h
+++ b/openbsd-compat/openssl-compat.h
@@ -62,6 +62,12 @@ void ssh_libcrypto_init(void);
 # define OPENSSL_DSA_MAX_MODULUS_BITS  10000
 #endif
 
+#ifdef LIBRESSL_VERSION_NUMBER
+# if LIBRESSL_VERSION_NUMBER >= 0x3010000fL
+#  define HAVE_BROKEN_CHACHA20
+# endif
+#endif
+
 #ifndef OPENSSL_HAVE_EVPCTR
 # define EVP_aes_128_ctr evp_aes_128_ctr
 # define EVP_aes_192_ctr evp_aes_128_ctr