mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
OpenSSL 3: fix warnings and tests
This commit fixes the compile-time warnings that OpenSSL 3.0 raises for our source-code. For the cases where this was necessary we now have two implementations - one for OpenSSL 1.1 and earlier, and one for OpenSSL 3.0. This also makes our testsuite pass with OpenSSL 3.0 Relates to GH-1379
This commit is contained in:
Johanna Amann
parent
6217851d6d
commit
253d214126
5 changed files with 82 additions and 5 deletions
|
|
@ -490,6 +490,9 @@ include(FindKqueue)
|
|||
if ( (OPENSSL_VERSION VERSION_EQUAL "1.1.0") OR (OPENSSL_VERSION VERSION_GREATER "1.1.0") )
|
||||
set(ZEEK_HAVE_OPENSSL_1_1 true CACHE INTERNAL "" FORCE)
|
||||
endif()
|
||||
if ( (OPENSSL_VERSION VERSION_EQUAL "3.0.0") OR (OPENSSL_VERSION VERSION_GREATER "3.0.0") )
|
||||
set(ZEEK_HAVE_OPENSSL_3_0 true CACHE INTERNAL "" FORCE)
|
||||
endif()
|
||||
|
||||
# Tell the plugin code that we're building as part of the main tree.
|
||||
set(ZEEK_PLUGIN_INTERNAL_BUILD true CACHE INTERNAL "" FORCE)
|
||||
|
|
|
|||
|
|
@ -11,6 +11,9 @@
|
|||
#include <openssl/x509.h>
|
||||
#include <openssl/x509v3.h>
|
||||
#include <string>
|
||||
#if OPENSSL_VERSION_NUMBER >= 0x30000000L
|
||||
#include <openssl/core_names.h>
|
||||
#endif
|
||||
|
||||
#include "zeek/Event.h"
|
||||
#include "zeek/file_analysis/File.h"
|
||||
|
|
@ -204,9 +207,20 @@ RecordValPtr X509::ParseCertificate(X509Val* cert_val, file_analysis::File* f)
|
|||
{
|
||||
pX509Cert->Assign(9, "rsa");
|
||||
|
||||
const BIGNUM* e;
|
||||
#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
||||
const BIGNUM* e = nullptr;
|
||||
RSA_get0_key(EVP_PKEY_get0_RSA(pkey), NULL, &e, NULL);
|
||||
#else
|
||||
BIGNUM* e = nullptr;
|
||||
EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_E, &e);
|
||||
#endif
|
||||
char* exponent = BN_bn2dec(e);
|
||||
#if OPENSSL_VERSION_NUMBER >= 0x30000000L
|
||||
// the OpenSSL 3.0 API allocates a new bignum; earlier APIs give a direct pointer
|
||||
// to the internal data structure that should not be freed.
|
||||
BN_free(e);
|
||||
e = nullptr;
|
||||
#endif
|
||||
if ( exponent != NULL )
|
||||
{
|
||||
pX509Cert->Assign(11, exponent);
|
||||
|
|
@ -456,6 +470,7 @@ StringValPtr X509::KeyCurve(EVP_PKEY* key)
|
|||
return nullptr;
|
||||
}
|
||||
|
||||
#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
||||
const EC_GROUP* group;
|
||||
int nid;
|
||||
if ( (group = EC_KEY_get0_group(EVP_PKEY_get0_EC_KEY(key))) == NULL )
|
||||
|
|
@ -472,7 +487,14 @@ StringValPtr X509::KeyCurve(EVP_PKEY* key)
|
|||
return nullptr;
|
||||
|
||||
return make_intrusive<StringVal>(curve_name);
|
||||
#endif
|
||||
#else
|
||||
static char buf[256];
|
||||
if ( ! EVP_PKEY_get_utf8_string_param(key, OSSL_PKEY_PARAM_GROUP_NAME, buf, 255, nullptr) )
|
||||
return nullptr;
|
||||
|
||||
return make_intrusive<StringVal>(buf);
|
||||
#endif /* OPENSSL_VERSION_NUMBER */
|
||||
#endif /* OPENSSL_NO_EC */
|
||||
}
|
||||
|
||||
unsigned int X509::KeyLength(EVP_PKEY* key)
|
||||
|
|
@ -482,18 +504,40 @@ unsigned int X509::KeyLength(EVP_PKEY* key)
|
|||
switch ( EVP_PKEY_base_id(key) )
|
||||
{
|
||||
case EVP_PKEY_RSA:
|
||||
const BIGNUM* n;
|
||||
{
|
||||
#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
||||
const BIGNUM* n = nullptr;
|
||||
RSA_get0_key(EVP_PKEY_get0_RSA(key), &n, NULL, NULL);
|
||||
return BN_num_bits(n);
|
||||
#else
|
||||
BIGNUM* n = nullptr;
|
||||
EVP_PKEY_get_bn_param(key, OSSL_PKEY_PARAM_RSA_N, &n);
|
||||
auto num_bits = BN_num_bits(n);
|
||||
BN_free(n);
|
||||
return num_bits;
|
||||
#endif
|
||||
}
|
||||
|
||||
case EVP_PKEY_DSA:
|
||||
{
|
||||
#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
||||
const BIGNUM* p;
|
||||
DSA_get0_pqg(EVP_PKEY_get0_DSA(key), &p, NULL, NULL);
|
||||
return BN_num_bits(p);
|
||||
#else
|
||||
BIGNUM* p = nullptr;
|
||||
EVP_PKEY_get_bn_param(key, OSSL_PKEY_PARAM_FFC_P, &p);
|
||||
auto num_bits = BN_num_bits(p);
|
||||
BN_free(p);
|
||||
return num_bits;
|
||||
#endif
|
||||
}
|
||||
|
||||
#ifndef OPENSSL_NO_EC
|
||||
|
||||
case EVP_PKEY_EC:
|
||||
{
|
||||
#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
||||
BIGNUM* ec_order = BN_new();
|
||||
if ( ! ec_order )
|
||||
// could not malloc bignum?
|
||||
|
|
@ -514,12 +558,16 @@ unsigned int X509::KeyLength(EVP_PKEY* key)
|
|||
BN_free(ec_order);
|
||||
return 0;
|
||||
}
|
||||
#else
|
||||
BIGNUM* ec_order = nullptr;
|
||||
EVP_PKEY_get_bn_param(key, OSSL_PKEY_PARAM_EC_ORDER, &ec_order);
|
||||
#endif /* OPENSSL_VERSION_NUMBER */
|
||||
|
||||
unsigned int length = BN_num_bits(ec_order);
|
||||
BN_free(ec_order);
|
||||
return length;
|
||||
}
|
||||
#endif
|
||||
#endif /* OPENSSL_NO_EC */
|
||||
default:
|
||||
return 0; // unknown public key type
|
||||
}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,19 @@
|
|||
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
||||
[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=3F:D5:B5:D0:D6:44:79:50:4A:17:A3:9B:8C:4A:DC:B8:B0:22:64:6B]
|
||||
[name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=A2:76:09:20:A8:40:FD:A1:AC:C8:E9:35:B9:11:A6:61:FF:8C:FF:A3]
|
||||
[name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment]
|
||||
[name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE]
|
||||
[name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication]
|
||||
[name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.3.6.1.4.1.6449.1.2.1.3.4\x0a CPS: https://secure.comodo.com/CPS]
|
||||
[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=CA Issuers - URI:http://crt.comodoca.com/COMODOHigh-AssuranceSecureServerCA.crt\x0aOCSP - URI:http://ocsp.comodoca.com]
|
||||
[name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.taleo.net, DNS:taleo.net]
|
||||
[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=AD:BD:98:7A:34:B4:26:F7:FA:C4:26:54:EF:03:BD:E0:24:CB:54:1A]
|
||||
[name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=3F:D5:B5:D0:D6:44:79:50:4A:17:A3:9B:8C:4A:DC:B8:B0:22:64:6B]
|
||||
[name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign]
|
||||
[name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0]
|
||||
[name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: X509v3 Any Policy]
|
||||
[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=CA Issuers - URI:http://crt.usertrust.com/AddTrustExternalCARoot.p7c\x0aCA Issuers - URI:http://crt.usertrust.com/AddTrustUTNSGCCA.crt\x0aOCSP - URI:http://ocsp.usertrust.com]
|
||||
[name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=AD:BD:98:7A:34:B4:26:F7:FA:C4:26:54:EF:03:BD:E0:24:CB:54:1A]
|
||||
[name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=F, value=Certificate Sign, CRL Sign]
|
||||
[name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE]
|
||||
[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:AD:BD:98:7A:34:B4:26:F7:FA:C4:26:54:EF:03:BD:E0:24:CB:54:1A\x0aDirName:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root\x0aserial:01]
|
||||
|
|
@ -1,5 +1,8 @@
|
|||
# @TEST-EXEC: zeek -b -r $TRACES/tls/tls1.2.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff .stdout
|
||||
# This is a hack to get around the fact that the output format changed between OpenSSL 1.1 and OpenSS:
|
||||
# 3.0.
|
||||
# @TEST-EXEC: cp .stdout stdout-openssl-3.0
|
||||
# @TEST-EXEC: grep -q "^ZEEK_HAVE_OPENSSL_3_0.*true" $BUILD/CMakeCache.txt && btest-diff stdout-openssl-3.0 || btest-diff .stdout
|
||||
|
||||
@load base/protocols/ssl
|
||||
@load base/files/x509
|
||||
|
|
|
|||
|
|
@ -1,3 +1,7 @@
|
|||
# Skip this test for OpenSSL 3.0 at the moment. We will switch it to only OpenSSL 3.0, once
|
||||
# a majority of distributions use is.
|
||||
# @TEST-REQUIRES: grep -q "^ZEEK_HAVE_OPENSSL_3_0.*true" $BUILD/CMakeCache.txt && test $? != 0
|
||||
|
||||
# @TEST-EXEC: zeek -r $TRACES/smtp.trace policy/misc/dump-events %INPUT >all-events.log
|
||||
# @TEST-EXEC: zeek -r $TRACES/smtp.trace policy/misc/dump-events %INPUT DumpEvents::include_args=F >all-events-no-args.log
|
||||
# @TEST-EXEC: zeek -r $TRACES/smtp.trace policy/misc/dump-events %INPUT DumpEvents::include=/smtp_/ >smtp-events.log
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue