switch isc_md_type_t to a proper enum

Get rid of the OpenSSL-isms that plague the codebase where the hash type
is `EVP_MD *`

By using a proper enum, alongside the cleanup, we also get the ability
to use constants for known hash sizes instead of having a function call
every time.

`EVP_MD_CTX_get0_md` has been removed instead of being adapted since it
wasn't used anymore.

diff --git a/lib/dns/catz.c b/lib/dns/catz.c
index 410e00f07823e3f30d238eb2702ede2c6bbe4af8..6e166212040cd2a1615fdf674d431190e912c01b 100644 (file)
--- a/lib/dns/catz.c
+++ b/lib/dns/catz.c
@@ -1859,7 +1859,7 @@ dns_catz_generate_masterfilename(dns_catz_zone_t *catz, dns_catz_entry_t *entry,
        isc_buffer_subtract(tbuf, 1);
 
        /* __catz__<digest>.db */
-       rlen = (isc_md_type_get_size(ISC_MD_SHA256) * 2 + 1) + 12;
+       rlen = (ISC_SHA256_DIGESTLENGTH * 2 + 1) + 12;
 
        /* optionally prepend with <zonedir>/ */
        if (entry->opts.zonedir != NULL) {

diff --git a/lib/dns/ds.c b/lib/dns/ds.c
index e8c71a80c72b5fdc5108a8d6a08db1146e301e2f..bc937c8eecd6f20d1a6932a0b4030af97b10c38f 100644 (file)
--- a/lib/dns/ds.c
+++ b/lib/dns/ds.c
@@ -41,7 +41,7 @@ dns_ds_fromkeyrdata(const dns_name_t *owner, dns_rdata_t *key,
        unsigned int privatelen = 0;
        isc_region_t r;
        isc_md_t *md;
-       const isc_md_type_t *md_type = NULL;
+       isc_md_type_t md_type = ISC_MD_UNKNOWN;
 
        REQUIRE(key != NULL);
        REQUIRE(key->type == dns_rdatatype_dnskey ||

diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
index 2f4ebf9753a54d455264116589a3d3380f9b7b32..b8b673043b27ff9d4fe8eadec1458bac821abf9c 100644 (file)
--- a/lib/dns/dst_api.c
+++ b/lib/dns/dst_api.c
@@ -1321,22 +1321,22 @@ dst_key_sigsize(const dst_key_t *key, unsigned int *n) {
                *n = DNS_SIG_ED448SIZE;
                break;
        case DST_ALG_HMACMD5:
-               *n = isc_md_type_get_size(ISC_MD_MD5);
+               *n = ISC_MD5_DIGESTLENGTH;
                break;
        case DST_ALG_HMACSHA1:
-               *n = isc_md_type_get_size(ISC_MD_SHA1);
+               *n = ISC_SHA1_DIGESTLENGTH;
                break;
        case DST_ALG_HMACSHA224:
-               *n = isc_md_type_get_size(ISC_MD_SHA224);
+               *n = ISC_SHA224_DIGESTLENGTH;
                break;
        case DST_ALG_HMACSHA256:
-               *n = isc_md_type_get_size(ISC_MD_SHA256);
+               *n = ISC_SHA256_DIGESTLENGTH;
                break;
        case DST_ALG_HMACSHA384:
-               *n = isc_md_type_get_size(ISC_MD_SHA384);
+               *n = ISC_SHA384_DIGESTLENGTH;
                break;
        case DST_ALG_HMACSHA512:
-               *n = isc_md_type_get_size(ISC_MD_SHA512);
+               *n = ISC_SHA512_DIGESTLENGTH;
                break;
        case DST_ALG_GSSAPI:
                *n = 128; /*%< XXX */

diff --git a/lib/dns/hmac_link.c b/lib/dns/hmac_link.c
index 320b8adb855168685139caa3fe6f2a24ef17d0eb..40a87aac70c087d0d0d83f1d90170e500a36e88c 100644 (file)
--- a/lib/dns/hmac_link.c
+++ b/lib/dns/hmac_link.c
@@ -141,7 +141,7 @@
        }
 
 static isc_result_t
-hmac_fromdns(const isc_md_type_t *type, dst_key_t *key, isc_buffer_t *data);
+hmac_fromdns(isc_md_type_t type, dst_key_t *key, isc_buffer_t *data);
 
 struct dst_hmac_key {
        uint8_t key[ISC_MAX_BLOCK_SIZE];
@@ -161,8 +161,7 @@ getkeybits(dst_key_t *key, struct dst_private_element *element) {
 }
 
 static isc_result_t
-hmac_createctx(const isc_md_type_t *type, const dst_key_t *key,
-              dst_context_t *dctx) {
+hmac_createctx(isc_md_type_t type, const dst_key_t *key, dst_context_t *dctx) {
        isc_result_t result;
        const dst_hmac_key_t *hkey = key->keydata.hmac_key;
        isc_hmac_t *ctx = isc_hmac_new(); /* Either returns or abort()s */
@@ -252,8 +251,7 @@ hmac_verify(const dst_context_t *dctx, const isc_region_t *sig) {
 }
 
 static bool
-hmac_compare(const isc_md_type_t *type, const dst_key_t *key1,
-            const dst_key_t *key2) {
+hmac_compare(isc_md_type_t type, const dst_key_t *key1, const dst_key_t *key2) {
        dst_hmac_key_t *hkey1, *hkey2;
 
        hkey1 = key1->keydata.hmac_key;
@@ -270,7 +268,7 @@ hmac_compare(const isc_md_type_t *type, const dst_key_t *key1,
 }
 
 static isc_result_t
-hmac_generate(const isc_md_type_t *type, dst_key_t *key) {
+hmac_generate(isc_md_type_t type, dst_key_t *key) {
        isc_buffer_t b;
        isc_result_t result;
        unsigned int bytes, len;
@@ -327,7 +325,7 @@ hmac_todns(const dst_key_t *key, isc_buffer_t *data) {
 }
 
 static isc_result_t
-hmac_fromdns(const isc_md_type_t *type, dst_key_t *key, isc_buffer_t *data) {
+hmac_fromdns(isc_md_type_t type, dst_key_t *key, isc_buffer_t *data) {
        dst_hmac_key_t *hkey;
        unsigned int keylen;
        isc_region_t r;
@@ -363,7 +361,7 @@ hmac_fromdns(const isc_md_type_t *type, dst_key_t *key, isc_buffer_t *data) {
 }
 
 static int
-hmac__get_tag_key(const isc_md_type_t *type) {
+hmac__get_tag_key(isc_md_type_t type) {
        if (type == ISC_MD_MD5) {
                return TAG_HMACMD5_KEY;
        } else if (type == ISC_MD_SHA1) {
@@ -382,7 +380,7 @@ hmac__get_tag_key(const isc_md_type_t *type) {
 }
 
 static int
-hmac__get_tag_bits(const isc_md_type_t *type) {
+hmac__get_tag_bits(isc_md_type_t type) {
        if (type == ISC_MD_MD5) {
                return TAG_HMACMD5_BITS;
        } else if (type == ISC_MD_SHA1) {
@@ -401,8 +399,7 @@ hmac__get_tag_bits(const isc_md_type_t *type) {
 }
 
 static isc_result_t
-hmac_tofile(const isc_md_type_t *type, const dst_key_t *key,
-           const char *directory) {
+hmac_tofile(isc_md_type_t type, const dst_key_t *key, const char *directory) {
        dst_hmac_key_t *hkey;
        dst_private_t priv;
        int bytes = (key->key_size + 7) / 8;
@@ -434,7 +431,7 @@ hmac_tofile(const isc_md_type_t *type, const dst_key_t *key,
 }
 
 static int
-hmac__to_dst_alg(const isc_md_type_t *type) {
+hmac__to_dst_alg(isc_md_type_t type) {
        if (type == ISC_MD_MD5) {
                return DST_ALG_HMACMD5;
        } else if (type == ISC_MD_SHA1) {
@@ -453,7 +450,7 @@ hmac__to_dst_alg(const isc_md_type_t *type) {
 }
 
 static isc_result_t
-hmac_parse(const isc_md_type_t *type, dst_key_t *key, isc_lex_t *lexer,
+hmac_parse(isc_md_type_t type, dst_key_t *key, isc_lex_t *lexer,
           dst_key_t *pub) {
        dst_private_t priv;
        isc_result_t result = ISC_R_SUCCESS, tresult;

diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
index 54213d5cdf3f6ec5334bd74f2dba49af85a7d9be..7bd3729b8bb5a3c699c89bdfc0701abe0bbd0d02 100644 (file)
--- a/lib/dns/opensslecdsa_link.c
+++ b/lib/dns/opensslecdsa_link.c
@@ -26,6 +26,7 @@
 #include <openssl/param_build.h>
 #endif
 
+#include <isc/md.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/safe.h>
@@ -39,6 +40,9 @@
 #include "dst_parse.h"
 #include "openssl_shim.h"
 
+/* TODO(aydin): remove this crap */
+extern EVP_MD *isc__crypto_md[];
+
 #ifndef NID_X9_62_prime256v1
 #error "P-256 group is not known (NID_X9_62_prime256v1)"
 #endif /* ifndef NID_X9_62_prime256v1 */
@@ -684,9 +688,9 @@ opensslecdsa_createctx(dst_key_t *key, dst_context_t *dctx) {
                CLEANUP(dst__openssl_toresult(ISC_R_NOMEMORY));
        }
        if (dctx->key->key_alg == DST_ALG_ECDSA256) {
-               type = isc__crypto_sha256;
+               type = isc__crypto_md[ISC_MD_SHA256];
        } else {
-               type = isc__crypto_sha384;
+               type = isc__crypto_md[ISC_MD_SHA384];
        }
 
        if (dctx->use == DO_SIGN) {

diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
index 465e1f663d344831de4c5745c6dae69ea75640ca..bc79ae010020f4a61ca390e55b1cbbceec37f49c 100644 (file)
--- a/lib/dns/opensslrsa_link.c
+++ b/lib/dns/opensslrsa_link.c
@@ -39,6 +39,9 @@
 
 #define OPENSSLRSA_MAX_MODULUS_BITS 4096
 
+/* TODO(aydin): remove this crap */
+extern EVP_MD *isc__crypto_md[];
+
 typedef struct rsa_components {
        bool bnfree;
        const BIGNUM *e, *n, *d, *p, *q, *dmp1, *dmq1, *iqmp;
@@ -210,15 +213,15 @@ opensslrsa_createctx(dst_key_t *key, dst_context_t *dctx) {
        switch (dctx->key->key_alg) {
        case DST_ALG_RSASHA1:
        case DST_ALG_NSEC3RSASHA1:
-               type = isc__crypto_sha1; /* SHA1 + RSA */
+               type = isc__crypto_md[ISC_MD_SHA1]; /* SHA1 + RSA */
                break;
        case DST_ALG_RSASHA256:
        case DST_ALG_RSASHA256PRIVATEOID:
-               type = isc__crypto_sha256; /* SHA256 + RSA */
+               type = isc__crypto_md[ISC_MD_SHA256]; /* SHA256 + RSA */
                break;
        case DST_ALG_RSASHA512:
        case DST_ALG_RSASHA512PRIVATEOID:
-               type = isc__crypto_sha512;
+               type = isc__crypto_md[ISC_MD_SHA512];
                break;
        default:
                UNREACHABLE();
@@ -1312,19 +1315,19 @@ check_algorithm(unsigned short algorithm) {
        switch (algorithm) {
        case DST_ALG_RSASHA1:
        case DST_ALG_NSEC3RSASHA1:
-               type = isc__crypto_sha1; /* SHA1 + RSA */
+               type = isc__crypto_md[ISC_MD_SHA1]; /* SHA1 + RSA */
                sig = sha1_sig;
                len = sizeof(sha1_sig) - 1;
                break;
        case DST_ALG_RSASHA256:
        case DST_ALG_RSASHA256PRIVATEOID:
-               type = isc__crypto_sha256; /* SHA256 + RSA */
+               type = isc__crypto_md[ISC_MD_SHA256]; /* SHA256 + RSA */
                sig = sha256_sig;
                len = sizeof(sha256_sig) - 1;
                break;
        case DST_ALG_RSASHA512:
        case DST_ALG_RSASHA512PRIVATEOID:
-               type = isc__crypto_sha512;
+               type = isc__crypto_md[ISC_MD_SHA512];
                sig = sha512_sig;
                len = sizeof(sha512_sig) - 1;
                break;

diff --git a/lib/isc/crypto/crypto_p.h b/lib/isc/crypto/crypto_p.h
new file mode 100644 (file)
index 0000000..899d9a2
--- /dev/null
+++ b/lib/isc/crypto/crypto_p.h
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+#include <openssl/evp.h>
+
+extern EVP_MD *isc__crypto_md[];

diff --git a/lib/isc/crypto/ossl1_1.c b/lib/isc/crypto/ossl1_1.c
index a8ac863fc6663b0f1e8d0767b49e7c298848b7e7..6920273b67c851d798a91e33bf1525b8cd97093b 100644 (file)
--- a/lib/isc/crypto/ossl1_1.c
+++ b/lib/isc/crypto/ossl1_1.c
@@ -19,31 +19,34 @@
 
 #include <isc/crypto.h>
 #include <isc/log.h>
+#include <isc/md.h>
 #include <isc/mem.h>
 #include <isc/tls.h>
 #include <isc/util.h>
 
+#include "crypto_p.h"
+
 static isc_mem_t *isc__crypto_mctx = NULL;
 
-#define md_register_algorithm(alg)                        \
-       {                                                 \
-               isc__crypto_##alg = UNCONST(EVP_##alg()); \
-               if (isc__crypto_##alg == NULL) {          \
-                       ERR_clear_error();                \
-               }                                         \
+#define md_register_algorithm(alg, upperalg)                              \
+       {                                                                 \
+               isc__crypto_md[ISC_MD_##upperalg] = UNCONST(EVP_##alg()); \
+               if (isc__crypto_md[ISC_MD_##upperalg] == NULL) {          \
+                       ERR_clear_error();                                \
+               }                                                         \
        }
 
 static isc_result_t
 register_algorithms(void) {
        if (!isc_crypto_fips_mode()) {
-               md_register_algorithm(md5);
+               md_register_algorithm(md5, MD5);
        }
 
-       md_register_algorithm(sha1);
-       md_register_algorithm(sha224);
-       md_register_algorithm(sha256);
-       md_register_algorithm(sha384);
-       md_register_algorithm(sha512);
+       md_register_algorithm(sha1, SHA1);
+       md_register_algorithm(sha224, SHA224);
+       md_register_algorithm(sha256, SHA256);
+       md_register_algorithm(sha384, SHA384);
+       md_register_algorithm(sha512, SHA512);
 
        return ISC_R_SUCCESS;
 }

diff --git a/lib/isc/crypto/ossl3.c b/lib/isc/crypto/ossl3.c
index 5f90df2bdda43ffe96206d0bb2bde6c515fd93a5..00ac7c82571c33a8149a241b71022c8b195dd84f 100644 (file)
--- a/lib/isc/crypto/ossl3.c
+++ b/lib/isc/crypto/ossl3.c
@@ -20,57 +20,51 @@
 
 #include <isc/crypto.h>
 #include <isc/log.h>
+#include <isc/md.h>
 #include <isc/mem.h>
 #include <isc/tls.h>
 #include <isc/util.h>
 
+#include "crypto_p.h"
+
 static isc_mem_t *isc__crypto_mctx = NULL;
 
 static OSSL_PROVIDER *base = NULL, *fips = NULL;
 
-#define md_register_algorithm(alg, algname)                            \
-       {                                                              \
-               REQUIRE(isc__crypto_##alg == NULL);                    \
-               isc__crypto_##alg = EVP_MD_fetch(NULL, algname, NULL); \
-               if (isc__crypto_##alg == NULL) {                       \
-                       ERR_clear_error();                             \
-               }                                                      \
-       }
-
-#define md_unregister_algorithm(alg)                    \
-       {                                               \
-               if (isc__crypto_##alg != NULL) {        \
-                       EVP_MD_free(isc__crypto_##alg); \
-                       isc__crypto_##alg = NULL;       \
-               }                                       \
+#define md_register_algorithm(alg)                                             \
+       {                                                                      \
+               REQUIRE(isc__crypto_md[ISC_MD_##alg] == NULL);                 \
+               isc__crypto_md[ISC_MD_##alg] = EVP_MD_fetch(NULL, #alg, NULL); \
+               if (isc__crypto_md[ISC_MD_##alg] == NULL) {                    \
+                       ERR_clear_error();                                     \
+               }                                                              \
        }
 
 static isc_result_t
 register_algorithms(void) {
        if (!isc_crypto_fips_mode()) {
-               md_register_algorithm(md5, "MD5");
+               md_register_algorithm(MD5);
        }
 
-       md_register_algorithm(sha1, "SHA1");
-       md_register_algorithm(sha224, "SHA224");
-       md_register_algorithm(sha256, "SHA256");
-       md_register_algorithm(sha384, "SHA384");
-       md_register_algorithm(sha512, "SHA512");
+       md_register_algorithm(SHA1);
+       md_register_algorithm(SHA224);
+       md_register_algorithm(SHA256);
+       md_register_algorithm(SHA384);
+       md_register_algorithm(SHA512);
 
        return ISC_R_SUCCESS;
 }
 
 static void
 unregister_algorithms(void) {
-       md_unregister_algorithm(sha512);
-       md_unregister_algorithm(sha384);
-       md_unregister_algorithm(sha256);
-       md_unregister_algorithm(sha224);
-       md_unregister_algorithm(sha1);
-       md_unregister_algorithm(md5);
+       for (size_t i = 0; i < ISC_MD_MAX; i++) {
+               if (isc__crypto_md[i] != NULL) {
+                       EVP_MD_free(isc__crypto_md[i]);
+                       isc__crypto_md[i] = NULL;
+               }
+       }
 }
 
-#undef md_unregister_algorithm
 #undef md_register_algorithm
 
 #if ISC_MEM_TRACKLINES

diff --git a/lib/isc/crypto/ossl_common.c b/lib/isc/crypto/ossl_common.c
index 1d940fa109583b99660126df94ae5726c914bac2..41bd2841027f75d474be10363ddb1d4a3b83dfc6 100644 (file)
--- a/lib/isc/crypto/ossl_common.c
+++ b/lib/isc/crypto/ossl_common.c
@@ -11,11 +11,16 @@
  * information regarding copyright ownership.
  */
 
+#include <openssl/err.h>
 #include <openssl/evp.h>
 
-EVP_MD *isc__crypto_md5 = NULL;
-EVP_MD *isc__crypto_sha1 = NULL;
-EVP_MD *isc__crypto_sha224 = NULL;
-EVP_MD *isc__crypto_sha256 = NULL;
-EVP_MD *isc__crypto_sha384 = NULL;
-EVP_MD *isc__crypto_sha512 = NULL;
+#include <isc/crypto.h>
+#include <isc/md.h>
+
+#include "crypto_p.h"
+
+EVP_MD *isc__crypto_md[] = {
+       [ISC_MD_UNKNOWN] = NULL, [ISC_MD_MD5] = NULL,    [ISC_MD_SHA1] = NULL,
+       [ISC_MD_SHA224] = NULL,  [ISC_MD_SHA256] = NULL, [ISC_MD_SHA384] = NULL,
+       [ISC_MD_SHA512] = NULL,
+};

diff --git a/lib/isc/hmac.c b/lib/isc/hmac.c
index 46582ea9ec268f5b26b68519009de6aa5ac94061..05134cc185388fd10a61c0261b69c6642461b8c7 100644 (file)
--- a/lib/isc/hmac.c
+++ b/lib/isc/hmac.c
@@ -23,6 +23,7 @@
 #include <isc/types.h>
 #include <isc/util.h>
 
+#include "crypto/crypto_p.h"
 #include "openssl_shim.h"
 
 isc_hmac_t *
@@ -43,14 +44,17 @@ isc_hmac_free(isc_hmac_t *hmac_st) {
 
 isc_result_t
 isc_hmac_init(isc_hmac_t *hmac_st, const void *key, const size_t keylen,
-             const isc_md_type_t *md_type) {
+             isc_md_type_t type) {
        EVP_PKEY *pkey;
+       EVP_MD *md;
 
        REQUIRE(hmac_st != NULL);
        REQUIRE(key != NULL);
        REQUIRE(keylen <= INT_MAX);
+       REQUIRE(type < ISC_MD_MAX);
 
-       if (md_type == NULL) {
+       md = isc__crypto_md[type];
+       if (md == NULL) {
                return ISC_R_NOTIMPLEMENTED;
        }
 
@@ -60,7 +64,7 @@ isc_hmac_init(isc_hmac_t *hmac_st, const void *key, const size_t keylen,
                return ISC_R_CRYPTOFAILURE;
        }
 
-       if (EVP_DigestSignInit(hmac_st, NULL, md_type, NULL, pkey) != 1) {
+       if (EVP_DigestSignInit(hmac_st, NULL, md, NULL, pkey) != 1) {
                EVP_PKEY_free(pkey);
                ERR_clear_error();
                return ISC_R_CRYPTOFAILURE;
@@ -119,13 +123,6 @@ isc_hmac_final(isc_hmac_t *hmac_st, unsigned char *digest,
        return ISC_R_SUCCESS;
 }
 
-const isc_md_type_t *
-isc_hmac_get_md_type(isc_hmac_t *hmac_st) {
-       REQUIRE(hmac_st != NULL);
-
-       return EVP_MD_CTX_get0_md(hmac_st);
-}
-
 size_t
 isc_hmac_get_size(isc_hmac_t *hmac_st) {
        REQUIRE(hmac_st != NULL);
@@ -141,7 +138,7 @@ isc_hmac_get_block_size(isc_hmac_t *hmac_st) {
 }
 
 isc_result_t
-isc_hmac(const isc_md_type_t *type, const void *key, const size_t keylen,
+isc_hmac(isc_md_type_t type, const void *key, const size_t keylen,
         const unsigned char *buf, const size_t len, unsigned char *digest,
         unsigned int *digestlen) {
        isc_result_t res;

diff --git a/lib/isc/include/isc/crypto.h b/lib/isc/include/isc/crypto.h
index a7dc9f45a4d12d2cc02f56a6a88107b4bbd35902..cd32da93918529efbd26b99bf5f990d61e995018 100644 (file)
--- a/lib/isc/include/isc/crypto.h
+++ b/lib/isc/include/isc/crypto.h
@@ -13,17 +13,8 @@
 
 #pragma once
 
-#include <openssl/evp.h>
-
 #include <isc/types.h>
 
-extern EVP_MD *isc__crypto_md5;
-extern EVP_MD *isc__crypto_sha1;
-extern EVP_MD *isc__crypto_sha224;
-extern EVP_MD *isc__crypto_sha256;
-extern EVP_MD *isc__crypto_sha384;
-extern EVP_MD *isc__crypto_sha512;
-
 bool
 isc_crypto_fips_mode(void);
 /*

diff --git a/lib/isc/include/isc/hmac.h b/lib/isc/include/isc/hmac.h
index 0a6ba8c4ff14857d77c543e6e2d6f4e2e279a51d..ecfc6e279c2932c2b1d0faa610c8cebf5fb421b1 100644 (file)
--- a/lib/isc/include/isc/hmac.h
+++ b/lib/isc/include/isc/hmac.h
@@ -43,7 +43,7 @@ typedef void isc_hmac_t;
  * of digest written to @digest.
  */
 isc_result_t
-isc_hmac(const isc_md_type_t *type, const void *key, const size_t keylen,
+isc_hmac(isc_md_type_t type, const void *key, const size_t keylen,
         const unsigned char *buf, const size_t len, unsigned char *digest,
         unsigned int *digestlen);
 
@@ -77,7 +77,7 @@ isc_hmac_free(isc_hmac_t *hmac);
 
 isc_result_t
 isc_hmac_init(isc_hmac_t *hmac, const void *key, const size_t keylen,
-             const isc_md_type_t *type);
+             isc_md_type_t type);
 
 /**
  * isc_hmac_reset:
@@ -118,16 +118,6 @@ isc_result_t
 isc_hmac_final(isc_hmac_t *hmac, unsigned char *digest,
               unsigned int *digestlen);
 
-/**
- * isc_hmac_md_type:
- * @hmac: HMAC context
- *
- * This function return the isc_md_type_t previously set for the supplied
- * HMAC context or NULL if no isc_md_type_t has been set.
- */
-const isc_md_type_t *
-isc_hmac_get_md_type(isc_hmac_t *hmac);
-
 /**
  * isc_hmac_get_size:
  *

diff --git a/lib/isc/include/isc/md.h b/lib/isc/include/isc/md.h
index 41c3447565c46e4cd32adb07cbb5512260a8e3d6..db95d1e84c64e431ce42a23900d5454a43b6e594 100644 (file)
--- a/lib/isc/include/isc/md.h
+++ b/lib/isc/include/isc/md.h
@@ -35,27 +35,29 @@ typedef void isc_md_t;
  *
  * Enumeration of supported message digest algorithms.
  */
-typedef void isc_md_type_t;
-
-#define ISC_MD_MD5    isc__crypto_md5
-#define ISC_MD_SHA1   isc__crypto_sha1
-#define ISC_MD_SHA224 isc__crypto_sha224
-#define ISC_MD_SHA256 isc__crypto_sha256
-#define ISC_MD_SHA384 isc__crypto_sha384
-#define ISC_MD_SHA512 isc__crypto_sha512
-
-#define ISC_MD5_DIGESTLENGTH   isc_md_type_get_size(ISC_MD_MD5)
-#define ISC_MD5_BLOCK_LENGTH   isc_md_type_get_block_size(ISC_MD_MD5)
-#define ISC_SHA1_DIGESTLENGTH  isc_md_type_get_size(ISC_MD_SHA1)
-#define ISC_SHA1_BLOCK_LENGTH  isc_md_type_get_block_size(ISC_MD_SHA1)
-#define ISC_SHA224_DIGESTLENGTH isc_md_type_get_size(ISC_MD_SHA224)
-#define ISC_SHA224_BLOCK_LENGTH isc_md_type_get_block_size(ISC_MD_SHA224)
-#define ISC_SHA256_DIGESTLENGTH isc_md_type_get_size(ISC_MD_SHA256)
-#define ISC_SHA256_BLOCK_LENGTH isc_md_type_get_block_size(ISC_MD_SHA256)
-#define ISC_SHA384_DIGESTLENGTH isc_md_type_get_size(ISC_MD_SHA384)
-#define ISC_SHA384_BLOCK_LENGTH isc_md_type_get_block_size(ISC_MD_SHA384)
-#define ISC_SHA512_DIGESTLENGTH isc_md_type_get_size(ISC_MD_SHA512)
-#define ISC_SHA512_BLOCK_LENGTH isc_md_type_get_block_size(ISC_MD_SHA512)
+typedef enum isc_md_type {
+       ISC_MD_UNKNOWN = 0x00,
+       ISC_MD_MD5 = 0x01,
+       ISC_MD_SHA1 = 0x02,
+       ISC_MD_SHA224 = 0x03,
+       ISC_MD_SHA256 = 0x04,
+       ISC_MD_SHA384 = 0x05,
+       ISC_MD_SHA512 = 0x06,
+       ISC_MD_MAX = 0x07,
+} isc_md_type_t;
+
+#define ISC_MD5_DIGESTLENGTH   16
+#define ISC_MD5_BLOCK_LENGTH   64
+#define ISC_SHA1_DIGESTLENGTH  20
+#define ISC_SHA1_BLOCK_LENGTH  64
+#define ISC_SHA224_DIGESTLENGTH 28
+#define ISC_SHA224_BLOCK_LENGTH 64
+#define ISC_SHA256_DIGESTLENGTH 32
+#define ISC_SHA256_BLOCK_LENGTH 64
+#define ISC_SHA384_DIGESTLENGTH 48
+#define ISC_SHA384_BLOCK_LENGTH 128
+#define ISC_SHA512_DIGESTLENGTH 64
+#define ISC_SHA512_BLOCK_LENGTH 128
 
 #define ISC_MAX_MD_SIZE           64U  /* EVP_MAX_MD_SIZE */
 #define ISC_MAX_BLOCK_SIZE 128U /* ISC_SHA512_BLOCK_LENGTH */
@@ -74,7 +76,7 @@ typedef void isc_md_type_t;
  * at @digestlen, at most ISC_MAX_MD_SIZE bytes will be written.
  */
 isc_result_t
-isc_md(const isc_md_type_t *type, const unsigned char *buf, const size_t len,
+isc_md(isc_md_type_t type, const unsigned char *buf, const size_t len,
        unsigned char *digest, unsigned int *digestlen);
 
 /**
@@ -93,7 +95,7 @@ isc_md_new(void);
  * to it.
  */
 void
-isc_md_free(isc_md_t *);
+isc_md_free(isc_md_t *md);
 
 /**
  * isc_md_init:
@@ -104,7 +106,7 @@ isc_md_free(isc_md_t *);
  * initialized before calling this function.
  */
 isc_result_t
-isc_md_init(isc_md_t *, const isc_md_type_t *md_type);
+isc_md_init(isc_md_t *md, isc_md_type_t type);
 
 /**
  * isc_md_reset:
@@ -144,16 +146,6 @@ isc_md_update(isc_md_t *md, const unsigned char *buf, const size_t len);
 isc_result_t
 isc_md_final(isc_md_t *md, unsigned char *digest, unsigned int *digestlen);
 
-/**
- * isc_md_get_type:
- * @md: message digest contezt
- *
- * This function return the isc_md_type_t previously set for the supplied
- * message digest context or NULL if no isc_md_type_t has been set.
- */
-const isc_md_type_t *
-isc_md_get_md_type(isc_md_t *md);
-
 /**
  * isc_md_size:
  *
@@ -172,15 +164,6 @@ isc_md_get_size(isc_md_t *md);
 size_t
 isc_md_get_block_size(isc_md_t *md);
 
-/**
- * isc_md_size:
- *
- * This function return the size of the message digest when passed an
- * isc_md_type_t , i.e. the size of the hash.
- */
-size_t
-isc_md_type_get_size(const isc_md_type_t *md_type);
-
 /**
  * isc_md_block_size:
  *
@@ -188,4 +171,4 @@ isc_md_type_get_size(const isc_md_type_t *md_type);
  * isc_md_type_t.
  */
 size_t
-isc_md_type_get_block_size(const isc_md_type_t *md_type);
+isc_md_type_get_block_size(isc_md_type_t type);

diff --git a/lib/isc/iterated_hash.c b/lib/isc/iterated_hash.c
index dfffe3b1297f736da6fb5c49a28d2fa0504110fd..fae098090739b6ec62e6af7661720167fb802fc2 100644 (file)
--- a/lib/isc/iterated_hash.c
+++ b/lib/isc/iterated_hash.c
@@ -17,11 +17,13 @@
 #include <openssl/err.h>
 #include <openssl/opensslv.h>
 
-#include <isc/crypto.h>
 #include <isc/iterated_hash.h>
+#include <isc/md.h>
 #include <isc/thread.h>
 #include <isc/util.h>
 
+#include "crypto/crypto_p.h"
+
 #if OPENSSL_VERSION_NUMBER < 0x30000000L
 
 #include <openssl/sha.h>
@@ -150,7 +152,8 @@ isc__iterated_hash_initialize(void) {
        mdctx = EVP_MD_CTX_new();
        INSIST(mdctx != NULL);
 
-       RUNTIME_CHECK(EVP_DigestInit_ex(basectx, isc__crypto_sha1, NULL) == 1);
+       RUNTIME_CHECK(EVP_DigestInit_ex(basectx, isc__crypto_md[ISC_MD_SHA1],
+                                       NULL) == 1);
        initialized = true;
 }
 

diff --git a/lib/isc/md.c b/lib/isc/md.c
index 8f461d60ca07a0174c6d2dc2e6f28edd0459f88a..87a167984c5c0a5c31fa400ed25dc8f87135ad0a 100644 (file)
--- a/lib/isc/md.c
+++ b/lib/isc/md.c
@@ -20,6 +20,7 @@
 #include <isc/md.h>
 #include <isc/util.h>
 
+#include "crypto/crypto_p.h"
 #include "openssl_shim.h"
 
 isc_md_t *
@@ -39,14 +40,18 @@ isc_md_free(isc_md_t *md) {
 }
 
 isc_result_t
-isc_md_init(isc_md_t *md, const isc_md_type_t *md_type) {
+isc_md_init(isc_md_t *md, isc_md_type_t type) {
+       EVP_MD *evp;
+
        REQUIRE(md != NULL);
+       REQUIRE(type < ISC_MD_MAX);
 
-       if (md_type == NULL) {
+       evp = isc__crypto_md[type];
+       if (evp == NULL) {
                return ISC_R_NOTIMPLEMENTED;
        }
 
-       if (EVP_DigestInit_ex(md, md_type, NULL) != 1) {
+       if (EVP_DigestInit_ex(md, evp, NULL) != 1) {
                ERR_clear_error();
                return ISC_R_CRYPTOFAILURE;
        }
@@ -95,13 +100,6 @@ isc_md_final(isc_md_t *md, unsigned char *digest, unsigned int *digestlen) {
        return ISC_R_SUCCESS;
 }
 
-const isc_md_type_t *
-isc_md_get_md_type(isc_md_t *md) {
-       REQUIRE(md != NULL);
-
-       return EVP_MD_CTX_get0_md(md);
-}
-
 size_t
 isc_md_get_size(isc_md_t *md) {
        REQUIRE(md != NULL);
@@ -117,38 +115,31 @@ isc_md_get_block_size(isc_md_t *md) {
 }
 
 size_t
-isc_md_type_get_size(const isc_md_type_t *md_type) {
-       STATIC_ASSERT(ISC_MAX_MD_SIZE >= EVP_MAX_MD_SIZE,
-                     "Change ISC_MAX_MD_SIZE to be greater than or equal to "
-                     "EVP_MAX_MD_SIZE");
-       if (md_type != NULL) {
-               return (size_t)EVP_MD_size(md_type);
-       }
+isc_md_type_get_block_size(isc_md_type_t type) {
+       EVP_MD *evp;
 
-       return ISC_MAX_MD_SIZE;
-}
-
-size_t
-isc_md_type_get_block_size(const isc_md_type_t *md_type) {
+       REQUIRE(type < ISC_MD_MAX);
        STATIC_ASSERT(ISC_MAX_MD_SIZE >= EVP_MAX_MD_SIZE,
                      "Change ISC_MAX_MD_SIZE to be greater than or equal to "
                      "EVP_MAX_MD_SIZE");
-       if (md_type != NULL) {
-               return (size_t)EVP_MD_block_size(md_type);
+
+       evp = isc__crypto_md[type];
+       if (evp != NULL) {
+               return (size_t)EVP_MD_block_size(evp);
        }
 
        return ISC_MAX_MD_SIZE;
 }
 
 isc_result_t
-isc_md(const isc_md_type_t *md_type, const unsigned char *buf, const size_t len,
+isc_md(isc_md_type_t type, const unsigned char *buf, const size_t len,
        unsigned char *digest, unsigned int *digestlen) {
        isc_md_t *md;
        isc_result_t res;
 
        md = isc_md_new();
 
-       res = isc_md_init(md, md_type);
+       res = isc_md_init(md, type);
        if (res != ISC_R_SUCCESS) {
                goto end;
        }

diff --git a/lib/isc/openssl_shim.h b/lib/isc/openssl_shim.h
index d2f8eeda7208d89dbc235dd22caaa43e167f452d..316d7ae7dd402902d4a8ff2151713a50eea03a86 100644 (file)
--- a/lib/isc/openssl_shim.h
+++ b/lib/isc/openssl_shim.h
@@ -18,10 +18,6 @@
 #include <openssl/opensslv.h>
 #include <openssl/ssl.h>
 
-#if !HAVE_EVP_MD_CTX_GET0_MD
-#define EVP_MD_CTX_get0_md EVP_MD_CTX_md
-#endif /* if !HAVE_EVP_MD_CTX_GET0_MD */
-
 #if !HAVE_BIO_READ_EX
 int
 BIO_read_ex(BIO *b, void *data, size_t dlen, size_t *readbytes);

diff --git a/lib/isc/tls.c b/lib/isc/tls.c
index 215730d76ba61fd054e19d2c179e07807df4c357..7477a1b9dea44c3dc9a87f7f2e4c4fff95af4e1c 100644 (file)
--- a/lib/isc/tls.c
+++ b/lib/isc/tls.c
@@ -38,6 +38,7 @@
 #include <isc/ht.h>
 #include <isc/log.h>
 #include <isc/magic.h>
+#include <isc/md.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
 #include <isc/once.h>
@@ -51,6 +52,9 @@
 
 #include "openssl_shim.h"
 
+/* TODO(aydin): remove this crap */
+extern EVP_MD *isc__crypto_md[];
+
 #define COMMON_SSL_OPTIONS \
        (SSL_OP_NO_COMPRESSION | SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION)
 
@@ -315,7 +319,7 @@ isc_tlsctx_createserver(const char *keyfile, const char *certfile,
                                           -1, -1, 0);
 
                X509_set_issuer_name(cert, name);
-               X509_sign(cert, pkey, isc__crypto_sha256);
+               X509_sign(cert, pkey, isc__crypto_md[ISC_MD_SHA256]);
                rv = SSL_CTX_use_certificate(ctx, cert);
                if (rv != 1) {
                        goto ssl_error;

diff --git a/lib/isccc/cc.c b/lib/isccc/cc.c
index a8f1a759affb79773d1ffa5b305d0d5af8b55e60..bb3f3530d5fdc5d55105aa7c640a8770188ef096 100644 (file)
--- a/lib/isccc/cc.c
+++ b/lib/isccc/cc.c
@@ -242,7 +242,7 @@ list_towire(isccc_sexpr_t *list, isc_buffer_t **buffer) {
 static isc_result_t
 sign(unsigned char *data, unsigned int length, unsigned char *out,
      uint32_t algorithm, isccc_region_t *secret) {
-       const isc_md_type_t *md_type;
+       isc_md_type_t md_type;
        isccc_region_t source, target;
        unsigned char digest[ISC_MAX_MD_SIZE];
        unsigned int digestlen = sizeof(digest);
@@ -353,7 +353,7 @@ isccc_cc_towire(isccc_sexpr_t *alist, isc_buffer_t **buffer, uint32_t algorithm,
 static isc_result_t
 verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,
        uint32_t algorithm, isccc_region_t *secret) {
-       const isc_md_type_t *md_type;
+       isc_md_type_t md_type;
        isccc_region_t source;
        isccc_region_t target;
        isccc_sexpr_t *_auth, *hmacvalue;

diff --git a/meson.build b/meson.build
index 2529a0155b43c985f5cb8bc21aea5af9bb190c4c..443c5760db40e148374b1ebbce241a5cf5a459f2 100644 (file)
--- a/meson.build
+++ b/meson.build
@@ -642,7 +642,6 @@ foreach fn, header : {
     'ERR_get_error_all': '#include <openssl/err.h>',
     'BIO_read_ex': '#include <openssl/bio.h>',
     'BIO_write_ex': '#include <openssl/bio.h>',
-    'EVP_MD_CTX_get0_md': '#include <openssl/evp.h>',
     'EVP_PKEY_eq': '#include <openssl/evp.h>',
     'SSL_CTX_set1_cert_store': '#include <openssl/ssl.h>',
 }

diff --git a/tests/isc/hmac_test.c b/tests/isc/hmac_test.c
index 05b93bf79a3391d2a38c802cec9ec76d484f48cb..0245d6041b46817c6c347553ed3e704fd1bb47be 100644 (file)
--- a/tests/isc/hmac_test.c
+++ b/tests/isc/hmac_test.c
@@ -94,7 +94,7 @@ ISC_RUN_TEST_IMPL(isc_hmac_free) {
 
 static void
 isc_hmac_test(isc_hmac_t *hmac_st, const void *key, size_t keylen,
-             const isc_md_type_t *type, const char *buf, size_t buflen,
+             isc_md_type_t type, const char *buf, size_t buflen,
              const char *result, const size_t repeats) {
        isc_result_t res;
 
@@ -131,7 +131,7 @@ ISC_RUN_TEST_IMPL(isc_hmac_init) {
        isc_hmac_t *hmac_st = *state;
        assert_non_null(hmac_st);
 
-       assert_int_equal(isc_hmac_init(hmac_st, "", 0, NULL),
+       assert_int_equal(isc_hmac_init(hmac_st, "", 0, ISC_MD_UNKNOWN),
                         ISC_R_NOTIMPLEMENTED);
 
        if (!isc_crypto_fips_mode()) {

diff --git a/tests/isc/md_test.c b/tests/isc/md_test.c
index 3602f968e7d3a0cb19ef2793897cde0221c6451e..b217a25b9c25ecb07e5ea4087fadc99c08900452 100644 (file)
--- a/tests/isc/md_test.c
+++ b/tests/isc/md_test.c
@@ -82,8 +82,8 @@ ISC_RUN_TEST_IMPL(isc_md_free) {
 }
 
 static void
-isc_md_test(isc_md_t *md, const isc_md_type_t *type, const char *buf,
-           size_t buflen, const char *result, const size_t repeats) {
+isc_md_test(isc_md_t *md, isc_md_type_t type, const char *buf, size_t buflen,
+           const char *result, const size_t repeats) {
        isc_result_t res;
 
        assert_non_null(md);
@@ -118,7 +118,7 @@ ISC_RUN_TEST_IMPL(isc_md_init) {
 
        expect_assert_failure(isc_md_init(NULL, ISC_MD_MD5));
 
-       assert_int_equal(isc_md_init(md, NULL), ISC_R_NOTIMPLEMENTED);
+       assert_int_equal(isc_md_init(md, ISC_MD_UNKNOWN), ISC_R_NOTIMPLEMENTED);
 
        if (isc_crypto_fips_mode()) {
                assert_int_equal(isc_md_init(md, ISC_MD_MD5),