[Bug 3682] Fixes for warnings when compiled without OpenSSL

bk: 5f93cf28W4Obs6AISUUcIY8jPcivPA

diff --git a/ChangeLog b/ChangeLog
index eeceaa9f10cb57b56caf561eaab50a81ec861f63..50ed500bfa446f30e60490e2cedcef7fe10c29df 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+---
+* [Bug 3682] Fixes for warnings when compiled without OpenSSL <perlinger@ntp.org>
+  - original patch by Gerry Garvey
+
 ---
 (4.2.8p15) 2020/06/23 Released by Harlan Stenn <stenn@ntp.org>
 

diff --git a/libntp/a_md5encrypt.c b/libntp/a_md5encrypt.c
index 57100de3a86e4cd7722f15e0e23fe9d45f8a046f..b55ccbdbc1ec7dfafeaa0572c74f3291bf18ec13 100644 (file)
--- a/libntp/a_md5encrypt.c
+++ b/libntp/a_md5encrypt.c
@@ -51,9 +51,9 @@ make_mac(
         * was created.
         */
        size_t  retlen = 0;
-       
+
 #ifdef OPENSSL
-       
+
        INIT_SSL();
 
        /* Check if CMAC key type specific code required */
@@ -70,7 +70,7 @@ make_mac(
                               (AES_128_KEY_SIZE - key->len));
                        keyptr = keybuf;
                }
-               
+
                if (NULL == (ctx = CMAC_CTX_new())) {
                        msyslog(LOG_ERR, "MAC encrypt: CMAC %s CTX new failed.", CMAC);
                        goto cmac_fail;
@@ -100,13 +100,13 @@ make_mac(
        {       /* generic MAC handling */
                EVP_MD_CTX *    ctx   = EVP_MD_CTX_new();
                u_int           uilen = 0;
-               
+
                if ( ! ctx) {
                        msyslog(LOG_ERR, "MAC encrypt: MAC %s Digest CTX new failed.",
                                OBJ_nid2sn(ktype));
                        goto mac_fail;
                }
-               
+
            #ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW
                /* make sure MD5 is allowd */
                EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
@@ -140,13 +140,13 @@ make_mac(
                }
          mac_fail:
                retlen = (size_t)uilen;
-               
+
                if (ctx)
                        EVP_MD_CTX_free(ctx);
        }
 
 #else /* !OPENSSL follows */
-       
+
        if (ktype == NID_md5)
        {
                EVP_MD_CTX *    ctx   = EVP_MD_CTX_new();
@@ -158,8 +158,10 @@ make_mac(
                else if ( ! ctx) {
                        msyslog(LOG_ERR, "%s", "MAC encrypt: MAC md5 Digest CTX new failed.");
                }
+               else if (!EVP_DigestInit(ctx, EVP_get_digestbynid(ktype))) {
+                       msyslog(LOG_ERR, "%s", "MAC encrypt: MAC md5 Digest INIT failed.");
+               }
                else {
-                       EVP_DigestInit(ctx, EVP_get_digestbynid(ktype));
                        EVP_DigestUpdate(ctx, key->buf, key->len);
                        EVP_DigestUpdate(ctx, msg->buf, msg->len);
                        EVP_DigestFinal(ctx, digest->buf, &uilen);
@@ -172,7 +174,7 @@ make_mac(
        {
                msyslog(LOG_ERR, "MAC encrypt: invalid key type %d"  , ktype);
        }
-       
+
 #endif /* !OPENSSL */
 
        return retlen;
@@ -196,7 +198,7 @@ MD5authencrypt(
        u_char  digest[EVP_MAX_MD_SIZE];
        rwbuffT digb = { digest, sizeof(digest) };
        robuffT keyb = { key, klen };
-       robuffT msgb = { pkt, length }; 
+       robuffT msgb = { pkt, length };
        size_t  dlen = 0;
 
        dlen = make_mac(&digb, type, &keyb, &msgb);
@@ -226,11 +228,11 @@ MD5authdecrypt(
        u_char  digest[EVP_MAX_MD_SIZE];
        rwbuffT digb = { digest, sizeof(digest) };
        robuffT keyb = { key, klen };
-       robuffT msgb = { pkt, length }; 
+       robuffT msgb = { pkt, length };
        size_t  dlen = 0;
 
        dlen = make_mac(&digb, type, &keyb, &msgb);
-       
+
        /* If the MAC is longer than the MAX then truncate it. */
        if (dlen > MAX_MDG_LEN)
                dlen = MAX_MDG_LEN;

diff --git a/ntpd/ntp_control.c b/ntpd/ntp_control.c
index 9c408034a4d7dce2ccd6076deecdc59e3ab1bd02..0d8749bbb7cc7e27674e5079dca3bdb5e5240a59 100644 (file)
--- a/ntpd/ntp_control.c
+++ b/ntpd/ntp_control.c
@@ -3656,6 +3656,7 @@ static u_int32 derive_nonce(
        }               d;
        EVP_MD_CTX      *ctx;
        u_int           len;
+       int rc;
 
        while (!salt[0] || current_time - last_salt_update >= 3600) {
                salt[0] = ntp_random();
@@ -3669,10 +3670,15 @@ static u_int32 derive_nonce(
 #   if defined(OPENSSL) && defined(EVP_MD_CTX_FLAG_NON_FIPS_ALLOW)
        /* [Bug 3457] set flags and don't kill them again */
        EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
-       EVP_DigestInit_ex(ctx, EVP_get_digestbynid(NID_md5), NULL);
+       rc = EVP_DigestInit_ex(ctx, EVP_get_digestbynid(NID_md5), NULL);
 #   else
-       EVP_DigestInit(ctx, EVP_get_digestbynid(NID_md5));
+       rc = EVP_DigestInit(ctx, EVP_get_digestbynid(NID_md5));
 #   endif
+       if (!rc) {
+               msyslog(LOG_ERR, "EVP_DigestInit failed in '%s'", __func__);
+               return (0);
+       }
+
        EVP_DigestUpdate(ctx, salt, sizeof(salt));
        EVP_DigestUpdate(ctx, &ts_i, sizeof(ts_i));
        EVP_DigestUpdate(ctx, &ts_f, sizeof(ts_f));

diff --git a/ntpd/ntpd.c b/ntpd/ntpd.c
index eeb7a88fe5ad4833d8369087bd9c00f11124d701..52357e9e02d7009d58720e25df5bcd36235336ad 100644 (file)
--- a/ntpd/ntpd.c
+++ b/ntpd/ntpd.c
@@ -684,8 +684,7 @@ detach_from_terminal(
  * Map user name/number to user ID
 */
 static int
-map_user(
-       )
+map_user(void)
 {
        char *endp;
 

diff --git a/ntpq/ntpq.c b/ntpq/ntpq.c
index 0382c0f948d7d3487b91725d179e6920ea942a8a..e70b9547b8148cd9393883caa60069a46ba82821 100644 (file)
--- a/ntpq/ntpq.c
+++ b/ntpq/ntpq.c
@@ -236,13 +236,15 @@ static    int     assoccmp        (const void *, const void *);
 
 #ifndef BUILD_AS_LIB
 static char   *list_digest_names(void);
-static char   *insert_cmac     (char *list);
 static void    on_ctrlc        (void);
 static int     my_easprintf    (char**, const char *, ...) NTP_PRINTF(2, 3);
-# if defined(OPENSSL) && defined(HAVE_EVP_MD_DO_ALL_SORTED)
+#ifdef OPENSSL
+static char   *insert_cmac     (char *list);
+# ifdef HAVE_EVP_MD_DO_ALL_SORTED
 static void    list_md_fn      (const EVP_MD *m, const char *from,
                                 const char *to, void *arg);
-# endif /* defined(OPENSSL) && defined(HAVE_EVP_MD_DO_ALL_SORTED) */
+# endif /* HAVE_EVP_MD_DO_ALL_SORTED */
+#endif /* OPENSSL */
 #endif /* !defined(BUILD_AS_LIB) */
 
 

diff --git a/sntp/crypto.c b/sntp/crypto.c
index 8a47edef7184ea111485e10a722c9091e26c1166..5456c092aff8e16c82de6bfaa220e934ca3249db 100644 (file)
--- a/sntp/crypto.c
+++ b/sntp/crypto.c
@@ -36,7 +36,7 @@ compute_mac(
        size_t          slen = 0;
 #endif
        int             key_type;
-       
+
        INIT_SSL();
        key_type = keytype_from_text(macname, NULL);
 
@@ -69,16 +69,16 @@ compute_mac(
                        slen = 0;
                }
                len = (u_int)slen;
-               
+
                if (ctx)
                        CMAC_CTX_free(ctx);
                /* Test our AES-128-CMAC implementation */
-               
+
        } else  /* MD5 MAC handling */
 #endif
        {
                EVP_MD_CTX *    ctx;
-               
+
                if (!(ctx = EVP_MD_CTX_new())) {
                        msyslog(LOG_ERR, "make_mac: MAC %s Digest CTX new failed.",
                                macname);
@@ -111,7 +111,11 @@ compute_mac(
                        len = 0;
                }
 #else /* !OPENSSL */
-               EVP_DigestInit(ctx, EVP_get_digestbynid(key_type));
+               (void)key_type; /* unused, so try to prevent compiler from croaks */
+               if (!EVP_DigestInit(ctx, EVP_get_digestbynid(key_type))) {
+                       msyslog(LOG_ERR, "make_mac: MAC MD5 Digest Init failed.");
+                       goto mac_fail;
+               }
                EVP_DigestUpdate(ctx, key_data, key_size);
                EVP_DigestUpdate(ctx, pkt_data, pkt_size);
                EVP_DigestFinal(ctx, digest, &len);
@@ -134,7 +138,7 @@ make_mac(
 {
        u_int           len;
        u_char          dbuf[EVP_MAX_MD_SIZE];
-       
+
        if (cmp_key->key_len > 64 || mac_size <= 0)
                return 0;
        if (pkt_size % 4 != 0)
@@ -143,7 +147,7 @@ make_mac(
        len = compute_mac(dbuf, cmp_key->typen,
                          pkt_data, (u_int)pkt_size,
                          cmp_key->key_seq, (u_int)cmp_key->key_len);
-                         
+
 
        if (len) {
                if (len > (u_int)mac_size)
@@ -170,10 +174,10 @@ auth_md5(
        u_int           len       = 0;
        u_char const *  pkt_ptr   = pkt_data;
        u_char          dbuf[EVP_MAX_MD_SIZE];
-       
+
        if (mac_size <= 0 || (size_t)mac_size > sizeof(dbuf))
                return FALSE;
-       
+
        len = compute_mac(dbuf, cmp_key->typen,
                          pkt_ptr, (u_int)pkt_size,
                          cmp_key->key_seq, (u_int)cmp_key->key_len);
@@ -181,7 +185,7 @@ auth_md5(
        pkt_ptr += pkt_size + 4;
        if (len > (u_int)mac_size)
                len = (u_int)mac_size;
-       
+
        /* isc_tsmemcmp will be better when its easy to link with.  sntp
         * is a 1-shot program, so snooping for timing attacks is
         * Harder.
@@ -226,7 +230,7 @@ auth_init(
 
        /* HMS: Is it OK to do this later, after we know we have a key file? */
        INIT_SSL();
-       
+
        if (keyf == NULL) {
                if (debug)
                        printf("sntp auth_init: Couldn't open key file %s for reading!\n", keyfile);