From 3690939126cf84b166157bad96e724caea61346d Mon Sep 17 00:00:00 2001 From: Arne Schwabe Date: Thu, 12 May 2022 14:14:28 +0200 Subject: [PATCH] Fix allowing/showing unsupported ciphers and digests This is a minimal version to hide the non-supported ciphers in these show-cipher/show-digests listings. It also adds code to the kt_md_get/ kt_cipher_get functions to error out early instead of getting an ugly backtrace with OpenSSL errors later when actually trying to use the ciphers. This allows make check to work again on with OpenSSL 3.0. The changes are kept minimal to avoid pulling in all the other refactoring for OpenSSL 3.0. This commit is partly cherry-picked from ab3f32b9. Signed-off-by: Arne Schwabe Acked-by: Gert Doering Message-Id: <20220512121429.2096164-7-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24334.html Signed-off-by: Gert Doering --- src/openvpn/crypto_openssl.c | 52 +++++++++++++++++++++++++++++++++--- 1 file changed, 48 insertions(+), 4 deletions(-) diff --git a/src/openvpn/crypto_openssl.c b/src/openvpn/crypto_openssl.c index beeaee4b7..74685b386 100644 --- a/src/openvpn/crypto_openssl.c +++ b/src/openvpn/crypto_openssl.c @@ -166,7 +166,8 @@ crypto_load_provider(const char *provider) #endif } -void crypto_unload_provider(const char *provname, provider_t *provider) +void +crypto_unload_provider(const char *provname, provider_t *provider) { #if OPENSSL_VERSION_NUMBER >= 0x30000000L if (!OSSL_PROVIDER_unload(provider)) @@ -339,7 +340,11 @@ show_available_ciphers(void) || cipher_kt_mode_aead(cipher) )) { - cipher_list[num_ciphers++] = cipher; + /* Check explicit availibility (for OpenSSL 3.0) */ + if (cipher_kt_get(cipher_kt_name(cipher))) + { + cipher_list[num_ciphers++] = cipher; + } } if (num_ciphers == (sizeof(cipher_list)/sizeof(*cipher_list))) { @@ -371,6 +376,13 @@ show_available_ciphers(void) printf("\n"); } +void +print_digest(EVP_MD *digest, void *unused) +{ + printf("%s %d bit digest size\n", EVP_MD_name(digest), + EVP_MD_size(digest) * 8); +} + void show_available_digests(void) { @@ -384,16 +396,21 @@ show_available_digests(void) "the --auth option.\n\n"); #endif +#if OPENSSL_VERSION_NUMBER >= 0x30000000L + EVP_MD_do_all_provided(NULL, print_digest, NULL); +#else for (nid = 0; nid < 10000; ++nid) { const EVP_MD *digest = EVP_get_digestbynid(nid); if (digest) { - printf("%s %d bit digest size\n", - OBJ_nid2sn(nid), EVP_MD_size(digest) * 8); + /* We cast the const away so we can keep the function prototype + * compatible with EVP_MD_do_all_provided */ + print_digest((EVP_MD *)digest, NULL); } } printf("\n"); +#endif } void @@ -624,6 +641,19 @@ cipher_kt_get(const char *ciphername) ciphername = translate_cipher_name_from_openvpn(ciphername); cipher = EVP_get_cipherbyname(ciphername); + /* This is a workaround for OpenSSL 3.0 to infer if the cipher is valid + * without doing all the refactoring that OpenVPN 2.6 has. This will + * not support custom algorithm from providers but at least ignore + * algorithms that are not available without providers (legacy) */ +#if OPENSSL_VERSION_NUMBER >= 0x30000000L + EVP_CIPHER *tmpcipher = EVP_CIPHER_fetch(NULL, ciphername, NULL); + if (!tmpcipher) + { + cipher = NULL; + } + EVP_CIPHER_free(tmpcipher); +#endif + if (NULL == cipher) { crypto_msg(D_LOW, "Cipher algorithm '%s' not found", ciphername); @@ -924,6 +954,20 @@ md_kt_get(const char *digest) const EVP_MD *md = NULL; ASSERT(digest); md = EVP_get_digestbyname(digest); + + /* This is a workaround for OpenSSL 3.0 to infer if the digest is valid + * without doing all the refactoring that OpenVPN 2.6 has. This will + * not support custom algorithm from providers but at least ignore + * algorithms that are not available without providers (legacy) */ +#if OPENSSL_VERSION_NUMBER >= 0x30000000L + EVP_MD *tmpmd = EVP_MD_fetch(NULL, digest, NULL); + if (!tmpmd) + { + md = NULL; + } + EVP_MD_free(tmpmd); +#endif + if (!md) { crypto_msg(M_FATAL, "Message hash algorithm '%s' not found", digest); -- 2.47.2