1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
|
From ad7338d648cfeffbd595e9a7681f746ce834d59e Mon Sep 17 00:00:00 2001
From: Daniel Kurtz <djkurtz@chromium.org>
Date: Mon, 3 Jun 2019 16:46:17 -0600
Subject: [PATCH 04/10] libbrillo: Update for OpenSSL 1.1
OpenSSL 1.1 has made significant non-backwards compatible changes to its
API as outlined in:
https://wiki.openssl.org/index.php/OpenSSL_1.1.0_Changes
Note: There are cases (sludge, tael, tatl), where libbrillo is built
against a libchrome that has been built w/out libbase-crypto (ie,
USE="-crypto"). For this reason, we don't use its libcrypto-compat.h.
BUG=chromium:737445
TEST=cros_workon --board=sarien start libbrillo
TEST=w/ openssl-1.0.2t: FEATURES=test emerge-sarien libbrillo
TEST=w/ openssl-1.1.0j: FEATURES=test emerge-sarien libbrillo
=> Both build and pass all unittests
Change-Id: I911c733e63ccbe58b7d9ef6d8e84c9e121056725
Reviewed-on: https://chromium-review.googlesource.com/1641754
Tested-by: Daniel Kurtz <djkurtz@chromium.org>
Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com>
Legacy-Commit-Queue: Commit Bot <commit-bot@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
Reviewed-by: Nick Crews <ncrews@chromium.org>
---
.../brillo/streams/openssl_stream_bio.cc | 75 ++++++++++++++++---
libbrillo/brillo/streams/tls_stream.cc | 7 +-
libbrillo/policy/device_policy_impl.cc | 10 ++-
3 files changed, 77 insertions(+), 15 deletions(-)
diff --git a/libbrillo/brillo/streams/openssl_stream_bio.cc b/libbrillo/brillo/streams/openssl_stream_bio.cc
index a63d9c0cc..478b11233 100644
--- a/libbrillo/brillo/streams/openssl_stream_bio.cc
+++ b/libbrillo/brillo/streams/openssl_stream_bio.cc
@@ -13,9 +13,32 @@ namespace brillo {
namespace {
+// TODO(crbug.com/984789): Remove once support for OpenSSL <1.1 is dropped.
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+static void BIO_set_data(BIO* a, void* ptr) {
+ a->ptr = ptr;
+}
+
+static void* BIO_get_data(BIO* a) {
+ return a->ptr;
+}
+
+static void BIO_set_init(BIO* a, int init) {
+ a->init = init;
+}
+
+static int BIO_get_init(BIO* a) {
+ return a->init;
+}
+
+static void BIO_set_shutdown(BIO* a, int shut) {
+ a->shutdown = shut;
+}
+#endif
+
// Internal functions for implementing OpenSSL BIO on brillo::Stream.
int stream_write(BIO* bio, const char* buf, int size) {
- brillo::Stream* stream = static_cast<brillo::Stream*>(bio->ptr);
+ brillo::Stream* stream = static_cast<brillo::Stream*>(BIO_get_data(bio));
size_t written = 0;
BIO_clear_retry_flags(bio);
if (!stream->WriteNonBlocking(buf, size, &written, nullptr))
@@ -30,7 +53,7 @@ int stream_write(BIO* bio, const char* buf, int size) {
}
int stream_read(BIO* bio, char* buf, int size) {
- brillo::Stream* stream = static_cast<brillo::Stream*>(bio->ptr);
+ brillo::Stream* stream = static_cast<brillo::Stream*>(BIO_get_data(bio));
size_t read = 0;
BIO_clear_retry_flags(bio);
bool eos = false;
@@ -49,16 +72,16 @@ int stream_read(BIO* bio, char* buf, int size) {
// NOLINTNEXTLINE(runtime/int)
long stream_ctrl(BIO* bio, int cmd, long /* num */, void* /* ptr */) {
if (cmd == BIO_CTRL_FLUSH) {
- brillo::Stream* stream = static_cast<brillo::Stream*>(bio->ptr);
+ brillo::Stream* stream = static_cast<brillo::Stream*>(BIO_get_data(bio));
return stream->FlushBlocking(nullptr) ? 1 : 0;
}
return 0;
}
int stream_new(BIO* bio) {
- bio->shutdown = 0; // By default do not close underlying stream on shutdown.
- bio->init = 0;
- bio->num = -1; // not used.
+ // By default do not close underlying stream on shutdown.
+ BIO_set_shutdown(bio, 0);
+ BIO_set_init(bio, 0);
return 1;
}
@@ -66,13 +89,17 @@ int stream_free(BIO* bio) {
if (!bio)
return 0;
- if (bio->init) {
- bio->ptr = nullptr;
- bio->init = 0;
+ if (BIO_get_init(bio)) {
+ BIO_set_data(bio, nullptr);
+ BIO_set_init(bio, 0);
}
return 1;
}
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+// TODO(crbug.com/984789): Remove #ifdef once support for OpenSSL <1.1 is
+// dropped.
+
// BIO_METHOD structure describing the BIO built on top of brillo::Stream.
BIO_METHOD stream_method = {
0x7F | BIO_TYPE_SOURCE_SINK, // type: 0x7F is an arbitrary unused type ID.
@@ -87,13 +114,37 @@ BIO_METHOD stream_method = {
nullptr, // callback function, not used
};
+BIO_METHOD* stream_get_method() {
+ return &stream_method;
+}
+
+#else
+
+BIO_METHOD* stream_get_method() {
+ static BIO_METHOD* stream_method;
+
+ if (!stream_method) {
+ stream_method = BIO_meth_new(BIO_get_new_index() | BIO_TYPE_SOURCE_SINK,
+ "stream");
+ BIO_meth_set_write(stream_method, stream_write);
+ BIO_meth_set_read(stream_method, stream_read);
+ BIO_meth_set_ctrl(stream_method, stream_ctrl);
+ BIO_meth_set_create(stream_method, stream_new);
+ BIO_meth_set_destroy(stream_method, stream_free);
+ }
+
+ return stream_method;
+}
+
+#endif
+
} // anonymous namespace
BIO* BIO_new_stream(brillo::Stream* stream) {
- BIO* bio = BIO_new(&stream_method);
+ BIO* bio = BIO_new(stream_get_method());
if (bio) {
- bio->ptr = stream;
- bio->init = 1;
+ BIO_set_data(bio, stream);
+ BIO_set_init(bio, 1);
}
return bio;
}
diff --git a/libbrillo/brillo/streams/tls_stream.cc b/libbrillo/brillo/streams/tls_stream.cc
index 603bd1d54..cc63258db 100644
--- a/libbrillo/brillo/streams/tls_stream.cc
+++ b/libbrillo/brillo/streams/tls_stream.cc
@@ -68,6 +68,11 @@ const char kCACertificatePath[] =
namespace brillo {
+// TODO(crbug.com/984789): Remove once support for OpenSSL <1.1 is dropped.
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+#define TLS_client_method() TLSv1_2_client_method()
+#endif
+
// Helper implementation of TLS stream used to hide most of OpenSSL inner
// workings from the users of brillo::TlsStream.
class TlsStream::TlsStreamImpl {
@@ -342,7 +347,7 @@ bool TlsStream::TlsStreamImpl::Init(StreamPtr socket,
const base::Closure& success_callback,
const Stream::ErrorCallback& error_callback,
ErrorPtr* error) {
- ctx_.reset(SSL_CTX_new(TLSv1_2_client_method()));
+ ctx_.reset(SSL_CTX_new(TLS_client_method()));
if (!ctx_)
return ReportError(error, FROM_HERE, "Cannot create SSL_CTX");
diff --git a/libbrillo/policy/device_policy_impl.cc b/libbrillo/policy/device_policy_impl.cc
index eaf90c96a..3f96d12ee 100644
--- a/libbrillo/policy/device_policy_impl.cc
+++ b/libbrillo/policy/device_policy_impl.cc
@@ -30,6 +30,12 @@ namespace em = enterprise_management;
namespace policy {
+// TODO(crbug.com/984789): Remove once support for OpenSSL <1.1 is dropped.
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+#define EVP_MD_CTX_new EVP_MD_CTX_create
+#define EVP_MD_CTX_free EVP_MD_CTX_destroy
+#endif
+
// Maximum value of RollbackAllowedMilestones policy.
const int kMaxRollbackAllowedMilestones = 4;
@@ -55,8 +61,8 @@ bool ReadPublicKeyFromFile(const base::FilePath& key_file,
bool VerifySignature(const std::string& signed_data,
const std::string& signature,
const std::string& public_key) {
- std::unique_ptr<EVP_MD_CTX, void (*)(EVP_MD_CTX *)> ctx(EVP_MD_CTX_create(),
- EVP_MD_CTX_destroy);
+ std::unique_ptr<EVP_MD_CTX, void (*)(EVP_MD_CTX *)> ctx(EVP_MD_CTX_new(),
+ EVP_MD_CTX_free);
if (!ctx)
return false;
--
2.24.1
|