[cpp-xmltooling] branch openssl1.1 updated: Rewind the cumulative OpenSSL1.1 changes onto the OpenSSL stream
Rod Widdowson
rdw at steadingsoftware.com
Tue Jul 19 12:13:11 EDT 2016
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch openssl1.1
in repository cpp-xmltooling.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-xmltooling.git;a=commit;h=3b8837571b5a2b0e6771abd7c3fa785bc1b79080
The following commit(s) were added to refs/heads/openssl1.1 by this push:
new 3b88375 Rewind the cumulative OpenSSL1.1 changes onto the OpenSSL stream
3b88375 is described below
commit 3b8837571b5a2b0e6771abd7c3fa785bc1b79080
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Tue Jul 19 17:12:02 2016 +0100
Rewind the cumulative OpenSSL1.1 changes onto the OpenSSL stream
Sharp tool, cut fingers.
---
Projects/vc10/xmltooling/xmltooling.vcxproj | 2 ++
Projects/vc10/xmltooling/xmltooling.vcxproj.filters | 9 +++++++++
xmltooling/Makefile.am | 2 ++
xmltooling/XMLToolingConfig.cpp | 9 +++++++++
xmltooling/security/impl/ExplicitKeyTrustEngine.cpp | 9 ++++++---
xmltooling/security/impl/FilesystemCredentialResolver.cpp | 1 +
xmltooling/security/impl/SecurityHelper.cpp | 13 +++++++------
xmltooling/soap/impl/CURLSOAPTransport.cpp | 11 ++++++-----
8 files changed, 42 insertions(+), 14 deletions(-)
diff --git a/Projects/vc10/xmltooling/xmltooling.vcxproj b/Projects/vc10/xmltooling/xmltooling.vcxproj
index 2320132..698918c 100644
--- a/Projects/vc10/xmltooling/xmltooling.vcxproj
+++ b/Projects/vc10/xmltooling/xmltooling.vcxproj
@@ -194,6 +194,7 @@
<ClCompile Include="..\..\..\XMLTooling\Lockable.cpp" />
<ClCompile Include="..\..\..\XMLTooling\Namespace.cpp" />
<ClCompile Include="..\..\..\XMLTooling\QName.cpp" />
+ <ClCompile Include="..\..\..\xmltooling\security\impl\OpenSSLSupport.cpp" />
<ClCompile Include="..\..\..\XMLTooling\security\impl\PKIXPathValidator.cpp" />
<ClCompile Include="..\..\..\XMLTooling\unicode.cpp" />
<ClCompile Include="..\..\..\XMLTooling\util\CloneInputStream.cpp" />
@@ -270,6 +271,7 @@
<ClInclude Include="..\..\..\XMLTooling\Namespace.h" />
<ClInclude Include="..\..\..\XMLTooling\PluginManager.h" />
<ClInclude Include="..\..\..\XMLTooling\QName.h" />
+ <ClInclude Include="..\..\..\xmltooling\security\impl\OpenSSLSupport.h" />
<ClInclude Include="..\..\..\XMLTooling\security\OpenSSLPathValidator.h" />
<ClInclude Include="..\..\..\XMLTooling\security\PathValidator.h" />
<ClInclude Include="..\..\..\XMLTooling\security\PKIXPathValidatorParams.h" />
diff --git a/Projects/vc10/xmltooling/xmltooling.vcxproj.filters b/Projects/vc10/xmltooling/xmltooling.vcxproj.filters
index bee07e2..1feba7b 100644
--- a/Projects/vc10/xmltooling/xmltooling.vcxproj.filters
+++ b/Projects/vc10/xmltooling/xmltooling.vcxproj.filters
@@ -73,6 +73,9 @@
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav</Extensions>
</Filter>
+ <Filter Include="Header Files\security\impl">
+ <UniqueIdentifier>{8ce132be-735f-49f0-899a-cc0e7cb8e775}</UniqueIdentifier>
+ </Filter>
</ItemGroup>
<ItemGroup>
<ClCompile Include="..\..\..\XMLTooling\AbstractAttributeExtensibleXMLObject.cpp">
@@ -270,6 +273,9 @@
<ClCompile Include="..\..\..\XMLTooling\util\CloneInputStream.cpp">
<Filter>Source Files\util</Filter>
</ClCompile>
+ <ClCompile Include="..\..\..\xmltooling\security\impl\OpenSSLSupport.cpp">
+ <Filter>Source Files\security\impl</Filter>
+ </ClCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="..\..\..\XMLTooling\AbstractAttributeExtensibleXMLObject.h">
@@ -521,6 +527,9 @@
<ClInclude Include="..\..\..\XMLTooling\util\CloneInputStream.h">
<Filter>Header Files\util</Filter>
</ClInclude>
+ <ClInclude Include="..\..\..\xmltooling\security\impl\OpenSSLSupport.h">
+ <Filter>Header Files\security\impl</Filter>
+ </ClInclude>
</ItemGroup>
<ItemGroup>
<ResourceCompile Include="..\..\..\XMLTooling\xmltooling.rc">
diff --git a/xmltooling/Makefile.am b/xmltooling/Makefile.am
index f265007..e2ced1a 100644
--- a/xmltooling/Makefile.am
+++ b/xmltooling/Makefile.am
@@ -57,6 +57,7 @@ encinclude_HEADERS = \
implinclude_HEADERS = \
impl/AnyElement.h \
+ security/impl\OpenSSLSupport.h \
impl/UnknownElement.h
ioinclude_HEADERS = \
@@ -147,6 +148,7 @@ xmlsec_sources = \
security/impl/InlineKeyResolver.cpp \
security/impl/KeyInfoResolver.cpp \
security/impl/OpenSSLCryptoX509CRL.cpp \
+ security/impl/OpenSSLSupport.cpp \
security/impl/PKIXPathValidator.cpp \
security/impl/SecurityHelper.cpp \
security/impl/StaticPKIXTrustEngine.cpp \
diff --git a/xmltooling/XMLToolingConfig.cpp b/xmltooling/XMLToolingConfig.cpp
index 6925a23..a8b4bb5 100644
--- a/xmltooling/XMLToolingConfig.cpp
+++ b/xmltooling/XMLToolingConfig.cpp
@@ -111,6 +111,15 @@ using namespace xmlsignature;
namespace {
static XMLToolingInternalConfig g_config;
#ifndef XMLTOOLING_NO_XMLSEC
+// NOTE:
+// "The old locking functions have been removed completely without compatibility macros"
+// see:
+// https://www.openssl.org/docs/manmaster/crypto/CRYPTO_THREAD_lock_free.html
+//
+// For now we just make the callback compile. More work TBD
+#ifndef CRYPTO_LOCK
+#define CRYPTO_LOCK 1
+#endif
static ptr_vector<Mutex> g_openssl_locks;
extern "C" void openssl_locking_callback(int mode,int n,const char *file,int line)
diff --git a/xmltooling/security/impl/ExplicitKeyTrustEngine.cpp b/xmltooling/security/impl/ExplicitKeyTrustEngine.cpp
index 6ad420f..a4a5dd2 100644
--- a/xmltooling/security/impl/ExplicitKeyTrustEngine.cpp
+++ b/xmltooling/security/impl/ExplicitKeyTrustEngine.cpp
@@ -34,17 +34,20 @@
#include "signature/Signature.h"
#include "signature/SignatureValidator.h"
#include "util/NDC.h"
+#include "security/impl/OpenSSLSupport.h"
#include <xercesc/util/XMLUniDefs.hpp>
#include <xsec/enc/OpenSSL/OpenSSLCryptoKeyDSA.hpp>
#include <xsec/enc/OpenSSL/OpenSSLCryptoKeyRSA.hpp>
#include <xsec/enc/OpenSSL/OpenSSLCryptoX509.hpp>
+
using namespace xmlsignature;
using namespace xmltooling::logging;
using namespace xmltooling;
using namespace std;
+
using xercesc::DOMElement;
namespace xmltooling {
@@ -260,8 +263,8 @@ bool ExplicitKeyTrustEngine::validate(
{
RSA* rsa = static_cast<OpenSSLCryptoKeyRSA*>(key)->getOpenSSLRSA();
EVP_PKEY* evp = X509_PUBKEY_get(X509_get_X509_PUBKEY(certEE));
- if (rsa && evp && evp->type == EVP_PKEY_RSA &&
- BN_cmp(rsa->n,evp->pkey.rsa->n) == 0 && BN_cmp(rsa->e,evp->pkey.rsa->e) == 0) {
+ if (rsa && evp && EVP_PKEY_id(evp) == EVP_PKEY_RSA &&
+ BN_cmp(RSA_get0_n(rsa),RSA_get0_n(EVP_PKEY_get0_RSA(evp))) == 0 && BN_cmp(RSA_get0_e(rsa), RSA_get0_e(EVP_PKEY_get0_RSA(evp))) == 0) {
if (evp)
EVP_PKEY_free(evp);
log.debug("end-entity certificate matches peer RSA key information");
@@ -276,7 +279,7 @@ bool ExplicitKeyTrustEngine::validate(
{
DSA* dsa = static_cast<OpenSSLCryptoKeyDSA*>(key)->getOpenSSLDSA();
EVP_PKEY* evp = X509_PUBKEY_get(X509_get_X509_PUBKEY(certEE));
- if (dsa && evp && evp->type == EVP_PKEY_DSA && BN_cmp(dsa->pub_key,evp->pkey.dsa->pub_key) == 0) {
+ if (dsa && evp && EVP_PKEY_id(evp) == EVP_PKEY_DSA && BN_cmp(DSA_get0_pubkey(dsa),DSA_get0_pubkey(EVP_PKEY_get0_DSA(evp))) == 0) {
if (evp)
EVP_PKEY_free(evp);
log.debug("end-entity certificate matches peer DSA key information");
diff --git a/xmltooling/security/impl/FilesystemCredentialResolver.cpp b/xmltooling/security/impl/FilesystemCredentialResolver.cpp
index dfeccf7..f9a337d 100644
--- a/xmltooling/security/impl/FilesystemCredentialResolver.cpp
+++ b/xmltooling/security/impl/FilesystemCredentialResolver.cpp
@@ -34,6 +34,7 @@
#include "security/OpenSSLCredential.h"
#include "security/SecurityHelper.h"
#include "security/XSECCryptoX509CRL.h"
+#include "security/impl/OpenSSLSupport.h"
#include "util/NDC.h"
#include "util/PathResolver.h"
#include "util/Threads.h"
diff --git a/xmltooling/security/impl/SecurityHelper.cpp b/xmltooling/security/impl/SecurityHelper.cpp
index 0c15f05..e53ed8d 100644
--- a/xmltooling/security/impl/SecurityHelper.cpp
+++ b/xmltooling/security/impl/SecurityHelper.cpp
@@ -30,6 +30,7 @@
#include "security/OpenSSLCryptoX509CRL.h"
#include "security/SecurityHelper.h"
#include "security/X509Credential.h"
+#include "security/impl/OpenSSLSupport.h"
#include "soap/HTTPSOAPTransport.h"
#include "util/NDC.h"
@@ -205,7 +206,7 @@ XSECCryptoKey* SecurityHelper::loadKeyFromFile(const char* pathname, const char*
// Now map it to an XSEC wrapper.
if (pkey) {
XSECCryptoKey* ret=nullptr;
- switch (pkey->type) {
+ switch (EVP_PKEY_id(pkey)) {
case EVP_PKEY_RSA:
ret=new OpenSSLCryptoKeyRSA(pkey);
break;
@@ -486,7 +487,7 @@ bool SecurityHelper::matches(const XSECCryptoKey& key1, const XSECCryptoKey& key
return false;
const RSA* rsa1 = static_cast<const OpenSSLCryptoKeyRSA&>(key1).getOpenSSLRSA();
const RSA* rsa2 = static_cast<const OpenSSLCryptoKeyRSA&>(key2).getOpenSSLRSA();
- return (rsa1 && rsa2 && BN_cmp(rsa1->n,rsa2->n) == 0 && BN_cmp(rsa1->e,rsa2->e) == 0);
+ return (rsa1 && rsa2 && BN_cmp(RSA_get0_n(rsa1),RSA_get0_n(rsa2)) == 0 && BN_cmp(RSA_get0_e(rsa1),RSA_get0_e(rsa2)) == 0);
}
// For a private key, compare the private half.
@@ -495,7 +496,7 @@ bool SecurityHelper::matches(const XSECCryptoKey& key1, const XSECCryptoKey& key
return false;
const RSA* rsa1 = static_cast<const OpenSSLCryptoKeyRSA&>(key1).getOpenSSLRSA();
const RSA* rsa2 = static_cast<const OpenSSLCryptoKeyRSA&>(key2).getOpenSSLRSA();
- return (rsa1 && rsa2 && BN_cmp(rsa1->n,rsa2->n) == 0 && BN_cmp(rsa1->d,rsa2->d) == 0);
+ return (rsa1 && rsa2 && BN_cmp(RSA_get0_n(rsa1),RSA_get0_n(rsa2)) == 0 && BN_cmp(RSA_get0_d(rsa1),RSA_get0_d(rsa2)) == 0);
}
// If one key is public or both, just compare the public key half.
@@ -504,7 +505,7 @@ bool SecurityHelper::matches(const XSECCryptoKey& key1, const XSECCryptoKey& key
return false;
const DSA* dsa1 = static_cast<const OpenSSLCryptoKeyDSA&>(key1).getOpenSSLDSA();
const DSA* dsa2 = static_cast<const OpenSSLCryptoKeyDSA&>(key2).getOpenSSLDSA();
- return (dsa1 && dsa2 && BN_cmp(dsa1->pub_key,dsa2->pub_key) == 0);
+ return (dsa1 && dsa2 && BN_cmp(DSA_get0_pubkey(dsa1),DSA_get0_pubkey(dsa2)) == 0);
}
// For a private key, compare the private half.
@@ -513,7 +514,7 @@ bool SecurityHelper::matches(const XSECCryptoKey& key1, const XSECCryptoKey& key
return false;
const DSA* dsa1 = static_cast<const OpenSSLCryptoKeyDSA&>(key1).getOpenSSLDSA();
const DSA* dsa2 = static_cast<const OpenSSLCryptoKeyDSA&>(key2).getOpenSSLDSA();
- return (dsa1 && dsa2 && BN_cmp(dsa1->priv_key,dsa2->priv_key) == 0);
+ return (dsa1 && dsa2 && BN_cmp(DSA_get0_privkey(dsa1),DSA_get0_privkey(dsa2)) == 0);
}
#if defined(XMLTOOLING_XMLSEC_ECC) && defined(XMLTOOLING_OPENSSL_HAVE_EC)
@@ -789,7 +790,7 @@ XSECCryptoKey* SecurityHelper::fromDEREncoding(const char* buf, unsigned long bu
// Now map it to an XSEC wrapper.
XSECCryptoKey* ret = nullptr;
try {
- switch (pkey->type) {
+ switch (EVP_PKEY_id(pkey)) {
case EVP_PKEY_RSA:
ret = new OpenSSLCryptoKeyRSA(pkey);
break;
diff --git a/xmltooling/soap/impl/CURLSOAPTransport.cpp b/xmltooling/soap/impl/CURLSOAPTransport.cpp
index 38e9271..b7ebe25 100644
--- a/xmltooling/soap/impl/CURLSOAPTransport.cpp
+++ b/xmltooling/soap/impl/CURLSOAPTransport.cpp
@@ -30,6 +30,7 @@
#include "security/CredentialCriteria.h"
#include "security/OpenSSLTrustEngine.h"
#include "security/OpenSSLCredential.h"
+#include "security/impl/OpenSSLSupport.h"
#include "soap/HTTPSOAPTransport.h"
#include "soap/OpenSSLSOAPTransport.h"
#include "util/NDC.h"
@@ -711,20 +712,20 @@ int xmltooling::verify_callback(X509_STORE_CTX* x509_ctx, void* arg)
ctx->m_criteria->setUsage(Credential::TLS_CREDENTIAL);
// Bypass name check (handled for us by curl).
ctx->m_criteria->setPeerName(nullptr);
- success = ctx->m_trustEngine->validate(x509_ctx->cert,x509_ctx->untrusted,*(ctx->m_peerResolver),ctx->m_criteria);
+ success = ctx->m_trustEngine->validate(X509_STORE_CTX_get0_cert(x509_ctx),X509_STORE_CTX_get0_untrusted(x509_ctx),*(ctx->m_peerResolver),ctx->m_criteria);
}
else {
// Bypass name check (handled for us by curl).
CredentialCriteria cc;
cc.setUsage(Credential::TLS_CREDENTIAL);
- success = ctx->m_trustEngine->validate(x509_ctx->cert,x509_ctx->untrusted,*(ctx->m_peerResolver),&cc);
+ success = ctx->m_trustEngine->validate(X509_STORE_CTX_get0_cert(x509_ctx),X509_STORE_CTX_get0_untrusted(x509_ctx),*(ctx->m_peerResolver),&cc);
}
if (!success) {
log.error("supplied TrustEngine failed to validate SSL/TLS server certificate");
- if (x509_ctx->cert) {
+ if (X509_STORE_CTX_get0_cert(x509_ctx)) {
BIO* b = BIO_new(BIO_s_mem());
- X509_print(b, x509_ctx->cert);
+ X509_print(b, X509_STORE_CTX_get0_cert(x509_ctx));
BUF_MEM* bptr = nullptr;
BIO_get_mem_ptr(b, &bptr);
if (bptr && bptr->length > 0) {
@@ -736,7 +737,7 @@ int xmltooling::verify_callback(X509_STORE_CTX* x509_ctx, void* arg)
}
BIO_free(b);
}
- x509_ctx->error = X509_V_ERR_APPLICATION_VERIFICATION; // generic error, check log for plugin specifics
+ X509_STORE_CTX_set_error(x509_ctx, X509_V_ERR_APPLICATION_VERIFICATION); // generic error, check log for plugin specifics
ctx->setAuthenticated(false);
return ctx->m_mandatory ? 0 : 1;
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list