Skip to content

Commit dc32fed

Browse files
author
coder-sageres
committed
Remove deprecated interfaces and internal interfaces, and use modern OpenSSL interfaces
Signed-off-by: coder-sageres <[email protected]>
1 parent 22d10f4 commit dc32fed

File tree

19 files changed

+1895
-1900
lines changed

19 files changed

+1895
-1900
lines changed

‎CMakeLists.txt‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -693,6 +693,11 @@ if(CMAKE_SYSTEM_NAME MATCHES "Linux")
693693
set(CMAKE_EXE_LINKER_FLAGS "")
694694

695695
set(CMAKE_C_LINK_EXECUTABLE "")
696+
elseif(TOOLCHAIN STREQUAL "NONE")
697+
# Use native toolchain with group linking for static libraries
698+
set(CMAKE_LINKER gcc)
699+
set(CMAKE_EXE_LINKER_FLAGS "-no-pie")
700+
set(CMAKE_C_LINK_EXECUTABLE "<CMAKE_LINKER> <LINK_FLAGS> <OBJECTS> -o <TARGET> -Wl,--start-group <LINK_LIBRARIES> -Wl,--end-group")
696701
endif()
697702

698703
if(NOT TOOLCHAIN STREQUAL "NIOS2_GCC")

‎library/spdm_crypt_lib/CMakeLists.txt‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,4 +38,11 @@ target_sources(spdm_crypt_lib
3838
fips/libspdm_selftest_mldsa_vec.c
3939
fips/libspdm_selftest_slhdsa.c
4040
fips/libspdm_selftest_slhdsa_vec.c
41-
)
41+
)
42+
43+
# Link to cryptlib implementation
44+
if(TARGET cryptlib_openssl)
45+
target_link_libraries(spdm_crypt_lib INTERFACE cryptlib_openssl)
46+
elseif(TARGET cryptlib_mbedtls)
47+
target_link_libraries(spdm_crypt_lib INTERFACE cryptlib_mbedtls)
48+
endif()

‎os_stub/cryptlib_openssl/CMakeLists.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,4 +68,4 @@ elseif(ARCH STREQUAL "loongarch64")
6868
target_compile_options(cryptlib_openssl PRIVATE -DLIBSPDM_CPU_LOONGARCH64)
6969
else()
7070
message(FATAL_ERROR "Unknown ARCH")
71-
endif()
71+
endif()

‎os_stub/cryptlib_openssl/der/der.c‎

Lines changed: 32 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -33,12 +33,25 @@
3333
* @retval false Invalid DER key data.
3434
*
3535
**/
36+
typedef struct {
37+
EVP_PKEY *pkey;
38+
BIGNUM *bn_n;
39+
BIGNUM *bn_e;
40+
BIGNUM *bn_d;
41+
BIGNUM *bn_p;
42+
BIGNUM *bn_q;
43+
BIGNUM *bn_dp;
44+
BIGNUM *bn_dq;
45+
BIGNUM *bn_q_inv;
46+
} libspdm_rsa_ctx_evp_t;
47+
3648
bool libspdm_rsa_get_public_key_from_der(const uint8_t *der_data,
3749
size_t der_size,
3850
void **rsa_context)
3951
{
4052
bool status;
4153
BIO *der_bio;
54+
EVP_PKEY *pkey;
4255

4356
/* Check input parameters.*/
4457

@@ -47,6 +60,7 @@ bool libspdm_rsa_get_public_key_from_der(const uint8_t *der_data,
4760
}
4861

4962
status = false;
63+
pkey = NULL;
5064

5165
/* Read DER data.*/
5266

@@ -59,11 +73,25 @@ bool libspdm_rsa_get_public_key_from_der(const uint8_t *der_data,
5973
goto done;
6074
}
6175

62-
/* Retrieve RSA Public key from DER data.*/
63-
64-
*rsa_context = d2i_RSA_PUBKEY_bio(der_bio, NULL);
65-
if (*rsa_context != NULL) {
76+
/* Retrieve RSA Public key from DER data as EVP_PKEY.*/
77+
pkey = d2i_PUBKEY_bio(der_bio, NULL);
78+
if (pkey == NULL) {
79+
goto done;
80+
}
81+
if (EVP_PKEY_base_id(pkey) != EVP_PKEY_RSA) {
82+
goto done;
83+
}
84+
{
85+
libspdm_rsa_ctx_evp_t *ctx;
86+
ctx = (libspdm_rsa_ctx_evp_t *)allocate_pool(sizeof(libspdm_rsa_ctx_evp_t));
87+
if (ctx == NULL) {
88+
goto done;
89+
}
90+
libspdm_zero_mem(ctx, sizeof(*ctx));
91+
ctx->pkey = pkey;
92+
*rsa_context = (void *)ctx;
6693
status = true;
94+
pkey = NULL; /* ownership moved */
6795
}
6896

6997
done:

‎os_stub/cryptlib_openssl/hmac/hmac_sha.c‎

Lines changed: 128 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,9 @@
99
**/
1010

1111
#include "internal_crypt_lib.h"
12-
#include <openssl/hmac.h>
12+
#include <openssl/evp.h>
13+
#include <openssl/core_names.h>
14+
#include <string.h>
1315

1416
/**
1517
* Allocates and initializes one HMAC_CTX context for subsequent HMAC-MD use.
@@ -20,24 +22,30 @@
2022
**/
2123
void *hmac_md_new(void)
2224
{
23-
24-
/* Allocates & Initializes HMAC_CTX context by OpenSSL HMAC_CTX_new()*/
25-
26-
return (void *)HMAC_CTX_new();
25+
/* Create EVP_MAC context for HMAC using new API */
26+
EVP_MAC *mac = EVP_MAC_fetch(NULL, "HMAC", NULL);
27+
if (mac == NULL) {
28+
return NULL;
29+
}
30+
31+
EVP_MAC_CTX *ctx = EVP_MAC_CTX_new(mac);
32+
EVP_MAC_free(mac);
33+
34+
return (void *)ctx;
2735
}
2836

2937
/**
3038
* Release the specified HMAC_CTX context.
31-
*
39+
*
3240
* @param[in] hmac_md_ctx Pointer to the HMAC_CTX context to be released.
3341
*
3442
**/
3543
void hmac_md_free(void *hmac_md_ctx)
3644
{
37-
38-
/* Free OpenSSL HMAC_CTX context*/
39-
40-
HMAC_CTX_free((HMAC_CTX *)hmac_md_ctx);
45+
/* Free EVP_MAC_CTX context */
46+
if (hmac_md_ctx != NULL) {
47+
EVP_MAC_CTX_free((EVP_MAC_CTX *)hmac_md_ctx);
48+
}
4149
}
4250

4351
/**
@@ -58,15 +66,29 @@ void hmac_md_free(void *hmac_md_ctx)
5866
bool hmac_md_set_key(const EVP_MD *md, void *hmac_md_ctx,
5967
const uint8_t *key, size_t key_size)
6068
{
69+
/* Check input parameters */
70+
if (hmac_md_ctx == NULL || key == NULL || key_size == 0) {
71+
return false;
72+
}
6173

62-
/* Check input parameters.*/
63-
64-
if (hmac_md_ctx == NULL || key_size > INT_MAX) {
74+
EVP_MAC_CTX *ctx = (EVP_MAC_CTX *)hmac_md_ctx;
75+
76+
/* Get digest name from EVP_MD */
77+
const char *digest_name = EVP_MD_get0_name(md);
78+
if (digest_name == NULL) {
6579
return false;
6680
}
6781

68-
if (HMAC_Init_ex((HMAC_CTX *)hmac_md_ctx, key, (uint32_t)key_size, md,
69-
NULL) != 1) {
82+
/* Setup parameters for HMAC */
83+
OSSL_PARAM params[3];
84+
params[0] = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST,
85+
(char *)digest_name, 0);
86+
params[1] = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY,
87+
(void *)key, key_size);
88+
params[2] = OSSL_PARAM_construct_end();
89+
90+
/* Initialize MAC operation with key and parameters */
91+
if (EVP_MAC_init(ctx, key, key_size, params) != 1) {
7092
return false;
7193
}
7294

@@ -88,19 +110,51 @@ bool hmac_md_set_key(const EVP_MD *md, void *hmac_md_ctx,
88110
**/
89111
bool hmac_md_duplicate(const void *hmac_md_ctx, void *new_hmac_md_ctx)
90112
{
113+
if (hmac_md_ctx == NULL || new_hmac_md_ctx == NULL) {
114+
return false;
115+
}
91116

92-
/* Check input parameters.*/
117+
EVP_MAC_CTX *src_ctx = (EVP_MAC_CTX *)hmac_md_ctx;
118+
EVP_MAC_CTX *dst_ctx = (EVP_MAC_CTX *)new_hmac_md_ctx;
93119

94-
if (hmac_md_ctx == NULL || new_hmac_md_ctx == NULL) {
120+
/* Get parameters from source context */
121+
OSSL_PARAM params[2];
122+
unsigned char *key = NULL;
123+
size_t key_len = 0;
124+
char digest_name[64] = {0}; // Preallocate buffer instead of using pointer to pointer
125+
126+
/* Get key - use fixed buffer size */
127+
params[0] = OSSL_PARAM_construct_octet_string("key", &key, 0);
128+
params[1] = OSSL_PARAM_construct_end();
129+
130+
if (EVP_MAC_CTX_get_params(src_ctx, params) != 1) {
95131
return false;
96132
}
97133

98-
if (HMAC_CTX_copy((HMAC_CTX *)new_hmac_md_ctx,
99-
(HMAC_CTX *)hmac_md_ctx) != 1) {
134+
/* Get digest algorithm name - use preallocated buffer */
135+
params[0] = OSSL_PARAM_construct_utf8_string("digest", digest_name, sizeof(digest_name));
136+
params[1] = OSSL_PARAM_construct_end();
137+
138+
if (EVP_MAC_CTX_get_params(src_ctx, params) != 1) {
139+
OPENSSL_free(key);
100140
return false;
101141
}
102142

103-
return true;
143+
/* Set parameters for destination context */
144+
OSSL_PARAM set_params[3];
145+
set_params[0] = OSSL_PARAM_construct_octet_string("key", key, key_len);
146+
set_params[1] = OSSL_PARAM_construct_utf8_string("digest", digest_name, 0);
147+
set_params[2] = OSSL_PARAM_construct_end();
148+
149+
bool result = false;
150+
if (EVP_MAC_init(dst_ctx, key, key_len, set_params) == 1) {
151+
result = true;
152+
}
153+
154+
/* Clean up temporarily allocated memory */
155+
OPENSSL_free(key);
156+
157+
return result;
104158
}
105159

106160
/**
@@ -124,24 +178,23 @@ bool hmac_md_duplicate(const void *hmac_md_ctx, void *new_hmac_md_ctx)
124178
bool hmac_md_update(void *hmac_md_ctx, const void *data,
125179
size_t data_size)
126180
{
127-
128-
/* Check input parameters.*/
129-
181+
/* Check input parameters */
130182
if (hmac_md_ctx == NULL) {
131183
return false;
132184
}
133185

134-
135-
/* Check invalid parameters, in case that only DataLength was checked in OpenSSL*/
136-
186+
/* Check invalid parameters */
137187
if (data == NULL && data_size != 0) {
138188
return false;
139189
}
140190

191+
/* If data_size is 0 and data is NULL, it's a valid case - do nothing */
192+
if (data_size == 0) {
193+
return true;
194+
}
141195

142-
/* OpenSSL HMAC-MD digest update*/
143-
144-
if (HMAC_Update((HMAC_CTX *)hmac_md_ctx, data, data_size) != 1) {
196+
/* Update MAC computation with new data */
197+
if (EVP_MAC_update((EVP_MAC_CTX *)hmac_md_ctx, data, data_size) != 1) {
145198
return false;
146199
}
147200

@@ -170,22 +223,16 @@ bool hmac_md_update(void *hmac_md_ctx, const void *data,
170223
**/
171224
bool hmac_md_final(void *hmac_md_ctx, uint8_t *hmac_value)
172225
{
173-
uint32_t length;
174-
175-
176-
/* Check input parameters.*/
177-
226+
size_t out_len = 0;
227+
228+
/* Check input parameters */
178229
if (hmac_md_ctx == NULL || hmac_value == NULL) {
179230
return false;
180231
}
181232

182-
183-
/* OpenSSL HMAC-MD digest finalization*/
184-
185-
if (HMAC_Final((HMAC_CTX *)hmac_md_ctx, hmac_value, &length) != 1) {
186-
return false;
187-
}
188-
if (HMAC_CTX_reset((HMAC_CTX *)hmac_md_ctx) != 1) {
233+
/* Finalize MAC computation and get the result */
234+
if (EVP_MAC_final((EVP_MAC_CTX *)hmac_md_ctx, hmac_value, &out_len,
235+
EVP_MAC_CTX_get_mac_size((EVP_MAC_CTX *)hmac_md_ctx)) != 1) {
189236
return false;
190237
}
191238

@@ -217,35 +264,60 @@ bool hmac_md_all(const EVP_MD *md, const void *data,
217264
size_t data_size, const uint8_t *key, size_t key_size,
218265
uint8_t *hmac_value)
219266
{
220-
uint32_t length;
221-
HMAC_CTX *ctx;
222-
bool ret_val;
267+
EVP_MAC *mac = NULL;
268+
EVP_MAC_CTX *ctx = NULL;
269+
size_t out_len = 0;
270+
bool ret_val = false;
271+
272+
/* Check input parameters */
273+
if (md == NULL || data == NULL || key == NULL || hmac_value == NULL) {
274+
return false;
275+
}
223276

224-
ctx = HMAC_CTX_new();
277+
/* Create MAC object and context */
278+
mac = EVP_MAC_fetch(NULL, "HMAC", NULL);
279+
if (mac == NULL) {
280+
goto done;
281+
}
282+
283+
ctx = EVP_MAC_CTX_new(mac);
225284
if (ctx == NULL) {
226-
return false;
285+
goto done;
227286
}
228287

229-
ret_val = (bool)HMAC_CTX_reset(ctx);
230-
if (!ret_val) {
288+
/* Get digest name */
289+
const char *digest_name = EVP_MD_get0_name(md);
290+
if (digest_name == NULL) {
231291
goto done;
232292
}
233-
ret_val = (bool)HMAC_Init_ex(ctx, key, (uint32_t)key_size, md, NULL);
234-
if (!ret_val) {
293+
294+
/* Setup parameters */
295+
OSSL_PARAM params[2];
296+
params[0] = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST,
297+
(char *)digest_name, 0);
298+
params[1] = OSSL_PARAM_construct_end();
299+
300+
/* Initialize with key */
301+
if (EVP_MAC_init(ctx, key, key_size, params) != 1) {
235302
goto done;
236303
}
237-
ret_val = (bool)HMAC_Update(ctx, data, data_size);
238-
if (!ret_val) {
304+
305+
/* Update with data */
306+
if (data_size > 0 && EVP_MAC_update(ctx, data, data_size) != 1) {
239307
goto done;
240308
}
241-
ret_val = (bool)HMAC_Final(ctx, hmac_value, &length);
242-
if (!ret_val) {
309+
310+
/* Finalize and get result */
311+
size_t mac_size = EVP_MAC_CTX_get_mac_size(ctx);
312+
if (EVP_MAC_final(ctx, hmac_value, &out_len, mac_size) != 1) {
243313
goto done;
244314
}
245315

246-
done:
247-
HMAC_CTX_free(ctx);
316+
ret_val = true;
248317

318+
done:
319+
EVP_MAC_CTX_free(ctx);
320+
EVP_MAC_free(mac);
249321
return ret_val;
250322
}
251323

0 commit comments

Comments
 (0)