|
 |
a912db |
From 561356ec1d46abb939e4eed10ee2c9e639eb88db Mon Sep 17 00:00:00 2001
|
|
|
a912db |
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
|
|
|
a912db |
Date: Thu, 8 Sep 2022 17:19:20 +0200
|
|
|
a912db |
Subject: [PATCH 2/3] Do not use OSSL_PARAM when engine API is compiled
|
|
|
a912db |
|
|
|
a912db |
OpenSSL has deprecated many things in version 3.0. If pkcs11 engine
|
|
|
a912db |
should work then no builder from OpenSSL 3.0 API can be used.
|
|
|
a912db |
|
|
|
a912db |
Allow switching to OpenSSL 1.1 like calls even on OpenSSL 3.0 when
|
|
|
a912db |
OPENSSL_API_COMPAT=10100 is defined. It would still compile and allow
|
|
|
a912db |
working keys loading from the engine passed on command line.
|
|
|
a912db |
---
|
|
|
a912db |
lib/dns/openssldh_link.c | 136 +++++++++++++++++++-----------------
|
|
|
a912db |
lib/dns/opensslecdsa_link.c | 119 +++++++++++++++----------------
|
|
|
a912db |
lib/dns/opensslrsa_link.c | 118 +++++++++++++++----------------
|
|
|
a912db |
3 files changed, 189 insertions(+), 184 deletions(-)
|
|
|
a912db |
|
|
|
a912db |
diff --git a/lib/dns/openssldh_link.c b/lib/dns/openssldh_link.c
|
|
|
a912db |
index d5dbc2e889..96c1d523b7 100644
|
|
|
a912db |
--- a/lib/dns/openssldh_link.c
|
|
|
a912db |
+++ b/lib/dns/openssldh_link.c
|
|
|
a912db |
@@ -91,7 +91,7 @@ static BIGNUM *bn2 = NULL, *bn768 = NULL, *bn1024 = NULL, *bn1536 = NULL;
|
|
|
a912db |
static isc_result_t
|
|
|
a912db |
openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv,
|
|
|
a912db |
isc_buffer_t *secret) {
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
DH *dhpub, *dhpriv;
|
|
|
a912db |
const BIGNUM *pub_key = NULL;
|
|
|
a912db |
int secret_len = 0;
|
|
|
a912db |
@@ -99,11 +99,11 @@ openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv,
|
|
|
a912db |
EVP_PKEY_CTX *ctx = NULL;
|
|
|
a912db |
EVP_PKEY *dhpub, *dhpriv;
|
|
|
a912db |
size_t secret_len = 0;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
isc_region_t r;
|
|
|
a912db |
unsigned int len;
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
REQUIRE(pub->keydata.dh != NULL);
|
|
|
a912db |
REQUIRE(priv->keydata.dh != NULL);
|
|
|
a912db |
|
|
|
a912db |
@@ -119,14 +119,14 @@ openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv,
|
|
|
a912db |
dhpriv = priv->keydata.pkey;
|
|
|
a912db |
|
|
|
a912db |
len = EVP_PKEY_get_size(dhpriv);
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
isc_buffer_availableregion(secret, &r);
|
|
|
a912db |
if (r.length < len) {
|
|
|
a912db |
return (ISC_R_NOSPACE);
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
DH_get0_key(dhpub, &pub_key, NULL);
|
|
|
a912db |
secret_len = DH_compute_key(r.base, pub_key, dhpriv);
|
|
|
a912db |
if (secret_len <= 0) {
|
|
|
a912db |
@@ -156,7 +156,7 @@ openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv,
|
|
|
a912db |
DST_R_COMPUTESECRETFAILURE));
|
|
|
a912db |
}
|
|
|
a912db |
EVP_PKEY_CTX_free(ctx);
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
isc_buffer_add(secret, (unsigned int)secret_len);
|
|
|
a912db |
|
|
|
a912db |
@@ -165,7 +165,7 @@ openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv,
|
|
|
a912db |
|
|
|
a912db |
static bool
|
|
|
a912db |
openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) {
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
DH *dh1, *dh2;
|
|
|
a912db |
const BIGNUM *pub_key1 = NULL, *pub_key2 = NULL;
|
|
|
a912db |
const BIGNUM *priv_key1 = NULL, *priv_key2 = NULL;
|
|
|
a912db |
@@ -175,9 +175,9 @@ openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) {
|
|
|
a912db |
BIGNUM *pub_key1 = NULL, *pub_key2 = NULL;
|
|
|
a912db |
BIGNUM *priv_key1 = NULL, *priv_key2 = NULL;
|
|
|
a912db |
BIGNUM *p1 = NULL, *g1 = NULL, *p2 = NULL, *g2 = NULL;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
dh1 = key1->keydata.dh;
|
|
|
a912db |
dh2 = key2->keydata.dh;
|
|
|
a912db |
|
|
|
a912db |
@@ -209,7 +209,7 @@ openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) {
|
|
|
a912db |
EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_PUB_KEY, &pub_key2);
|
|
|
a912db |
EVP_PKEY_get_bn_param(pkey1, OSSL_PKEY_PARAM_PRIV_KEY, &priv_key1);
|
|
|
a912db |
EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_PRIV_KEY, &priv_key2);
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L*/
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000*/
|
|
|
a912db |
|
|
|
a912db |
if (BN_cmp(p1, p2) != 0 || BN_cmp(g1, g2) != 0 ||
|
|
|
a912db |
BN_cmp(pub_key1, pub_key2) != 0)
|
|
|
a912db |
@@ -226,7 +226,7 @@ openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) {
|
|
|
a912db |
}
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
|
|
a912db |
if (p1 != NULL) {
|
|
|
a912db |
BN_free(p1);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -251,22 +251,23 @@ openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) {
|
|
|
a912db |
if (priv_key2 != NULL) {
|
|
|
a912db |
BN_clear_free(priv_key2);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 \
|
|
|
a912db |
+ */
|
|
|
a912db |
|
|
|
a912db |
return (true);
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
static bool
|
|
|
a912db |
openssldh_paramcompare(const dst_key_t *key1, const dst_key_t *key2) {
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
DH *dh1, *dh2;
|
|
|
a912db |
const BIGNUM *p1 = NULL, *g1 = NULL, *p2 = NULL, *g2 = NULL;
|
|
|
a912db |
#else
|
|
|
a912db |
EVP_PKEY *pkey1, *pkey2;
|
|
|
a912db |
BIGNUM *p1 = NULL, *g1 = NULL, *p2 = NULL, *g2 = NULL;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
dh1 = key1->keydata.dh;
|
|
|
a912db |
dh2 = key2->keydata.dh;
|
|
|
a912db |
|
|
|
a912db |
@@ -292,13 +293,13 @@ openssldh_paramcompare(const dst_key_t *key1, const dst_key_t *key2) {
|
|
|
a912db |
EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_FFC_P, &p2;;
|
|
|
a912db |
EVP_PKEY_get_bn_param(pkey1, OSSL_PKEY_PARAM_FFC_G, &g1;;
|
|
|
a912db |
EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_FFC_G, &g2;;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
if (BN_cmp(p1, p2) != 0 || BN_cmp(g1, g2) != 0) {
|
|
|
a912db |
return (false);
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
|
|
a912db |
if (p1 != NULL) {
|
|
|
a912db |
BN_free(p1);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -311,12 +312,13 @@ openssldh_paramcompare(const dst_key_t *key1, const dst_key_t *key2) {
|
|
|
a912db |
if (g2 != NULL) {
|
|
|
a912db |
BN_free(g2);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 \
|
|
|
a912db |
+ */
|
|
|
a912db |
|
|
|
a912db |
return (true);
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
static int
|
|
|
a912db |
progress_cb(int p, int n, BN_GENCB *cb) {
|
|
|
a912db |
union {
|
|
|
a912db |
@@ -347,7 +349,7 @@ progress_cb(EVP_PKEY_CTX *ctx) {
|
|
|
a912db |
}
|
|
|
a912db |
return (1);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
static isc_result_t
|
|
|
a912db |
openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
|
|
|
a912db |
@@ -357,7 +359,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
|
|
|
a912db |
void (*fptr)(int);
|
|
|
a912db |
} u;
|
|
|
a912db |
BIGNUM *p = NULL, *g = NULL;
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
DH *dh = NULL;
|
|
|
a912db |
BN_GENCB *cb = NULL;
|
|
|
a912db |
#if !HAVE_BN_GENCB_NEW
|
|
|
a912db |
@@ -370,9 +372,9 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
|
|
|
a912db |
EVP_PKEY_CTX *ctx = NULL;
|
|
|
a912db |
EVP_PKEY *param_pkey = NULL;
|
|
|
a912db |
EVP_PKEY *pkey = NULL;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
dh = DH_new();
|
|
|
a912db |
if (dh == NULL) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult(ISC_R_NOMEMORY));
|
|
|
a912db |
@@ -386,7 +388,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
|
|
|
a912db |
if (param_ctx == NULL) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
if (generator == 0) {
|
|
|
a912db |
/*
|
|
|
a912db |
@@ -406,7 +408,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
|
|
|
a912db |
if (p == NULL || g == NULL) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult(ISC_R_NOMEMORY));
|
|
|
a912db |
}
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
if (DH_set0_pqg(dh, p, NULL, g) != 1) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult2(
|
|
|
a912db |
"DH_set0_pqg", DST_R_OPENSSLFAILURE));
|
|
|
a912db |
@@ -430,7 +432,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
|
|
|
a912db |
DST_R_OPENSSLFAILURE));
|
|
|
a912db |
}
|
|
|
a912db |
params = OSSL_PARAM_BLD_to_param(bld);
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
} else {
|
|
|
a912db |
/*
|
|
|
a912db |
@@ -443,7 +445,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
if (generator != 0) {
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
cb = BN_GENCB_new();
|
|
|
a912db |
#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
|
|
|
a912db |
if (cb == NULL) {
|
|
|
a912db |
@@ -486,10 +488,10 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
|
|
|
a912db |
DST_R_OPENSSLFAILURE));
|
|
|
a912db |
}
|
|
|
a912db |
params = OSSL_PARAM_BLD_to_param(bld);
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
if (DH_generate_key(dh) == 0) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult2("DH_generate_key",
|
|
|
a912db |
DST_R_OPENSSLFAILURE));
|
|
|
a912db |
@@ -557,12 +559,12 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
|
|
|
a912db |
|
|
|
a912db |
key->keydata.pkey = pkey;
|
|
|
a912db |
pkey = NULL;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
ret = ISC_R_SUCCESS;
|
|
|
a912db |
|
|
|
a912db |
err:
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
if (dh != NULL) {
|
|
|
a912db |
DH_free(dh);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -594,14 +596,14 @@ err:
|
|
|
a912db |
if (g != NULL) {
|
|
|
a912db |
BN_free(g);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
return (ret);
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
static bool
|
|
|
a912db |
openssldh_isprivate(const dst_key_t *key) {
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
DH *dh = key->keydata.dh;
|
|
|
a912db |
const BIGNUM *priv_key = NULL;
|
|
|
a912db |
|
|
|
a912db |
@@ -626,12 +628,12 @@ openssldh_isprivate(const dst_key_t *key) {
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
return (ret);
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
static void
|
|
|
a912db |
openssldh_destroy(dst_key_t *key) {
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
DH *dh = key->keydata.dh;
|
|
|
a912db |
|
|
|
a912db |
if (dh == NULL) {
|
|
|
a912db |
@@ -649,7 +651,7 @@ openssldh_destroy(dst_key_t *key) {
|
|
|
a912db |
|
|
|
a912db |
EVP_PKEY_free(pkey);
|
|
|
a912db |
key->keydata.pkey = NULL;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
static void
|
|
|
a912db |
@@ -675,17 +677,17 @@ uint16_fromregion(isc_region_t *region) {
|
|
|
a912db |
|
|
|
a912db |
static isc_result_t
|
|
|
a912db |
openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
DH *dh;
|
|
|
a912db |
const BIGNUM *pub_key = NULL, *p = NULL, *g = NULL;
|
|
|
a912db |
#else
|
|
|
a912db |
EVP_PKEY *pkey;
|
|
|
a912db |
BIGNUM *pub_key = NULL, *p = NULL, *g = NULL;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
isc_region_t r;
|
|
|
a912db |
uint16_t dnslen, plen, glen, publen;
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
REQUIRE(key->keydata.dh != NULL);
|
|
|
a912db |
|
|
|
a912db |
dh = key->keydata.dh;
|
|
|
a912db |
@@ -698,7 +700,7 @@ openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_FFC_P, &p);
|
|
|
a912db |
EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_FFC_G, &g);
|
|
|
a912db |
EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_PUB_KEY, &pub_key);
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
isc_buffer_availableregion(data, &r);
|
|
|
a912db |
|
|
|
a912db |
@@ -745,7 +747,7 @@ openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
|
|
|
a912db |
isc_buffer_add(data, dnslen);
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
|
|
a912db |
if (p != NULL) {
|
|
|
a912db |
BN_free(p);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -755,7 +757,8 @@ openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
if (pub_key != NULL) {
|
|
|
a912db |
BN_free(pub_key);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 \
|
|
|
a912db |
+ */
|
|
|
a912db |
|
|
|
a912db |
return (ISC_R_SUCCESS);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -763,14 +766,14 @@ openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
static isc_result_t
|
|
|
a912db |
openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
isc_result_t ret;
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
DH *dh;
|
|
|
a912db |
#else
|
|
|
a912db |
OSSL_PARAM_BLD *bld = NULL;
|
|
|
a912db |
OSSL_PARAM *params = NULL;
|
|
|
a912db |
EVP_PKEY_CTX *ctx = NULL;
|
|
|
a912db |
EVP_PKEY *pkey = NULL;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
BIGNUM *pub_key = NULL, *p = NULL, *g = NULL;
|
|
|
a912db |
int key_size;
|
|
|
a912db |
isc_region_t r;
|
|
|
a912db |
@@ -782,7 +785,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
return (ISC_R_SUCCESS);
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
dh = DH_new();
|
|
|
a912db |
if (dh == NULL) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult(ISC_R_NOMEMORY));
|
|
|
a912db |
@@ -797,7 +800,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
if (ctx == NULL) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
/*
|
|
|
a912db |
* Read the prime length. 1 & 2 are table entries, > 16 means a
|
|
|
a912db |
@@ -873,7 +876,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
|
|
|
a912db |
key_size = BN_num_bits(p);
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
if (DH_set0_pqg(dh, p, NULL, g) != 1) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult2("DH_set0_pqg",
|
|
|
a912db |
DST_R_OPENSSLFAILURE));
|
|
|
a912db |
@@ -889,7 +892,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult2("OSSL_PARAM_BLD_push_BN",
|
|
|
a912db |
DST_R_OPENSSLFAILURE));
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
if (r.length < 2) {
|
|
|
a912db |
DST_RET(DST_R_INVALIDPUBLICKEY);
|
|
|
a912db |
@@ -907,7 +910,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
|
|
|
a912db |
isc_buffer_forward(data, plen + glen + publen + 6);
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
#if (LIBRESSL_VERSION_NUMBER >= 0x2070000fL) && \
|
|
|
a912db |
(LIBRESSL_VERSION_NUMBER <= 0x2070200fL)
|
|
|
a912db |
/*
|
|
|
a912db |
@@ -951,14 +954,14 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
|
|
|
a912db |
key->keydata.pkey = pkey;
|
|
|
a912db |
pkey = NULL;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
key->key_size = (unsigned int)key_size;
|
|
|
a912db |
|
|
|
a912db |
ret = ISC_R_SUCCESS;
|
|
|
a912db |
|
|
|
a912db |
err:
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
if (dh != NULL) {
|
|
|
a912db |
DH_free(dh);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -975,7 +978,7 @@ err:
|
|
|
a912db |
if (bld != NULL) {
|
|
|
a912db |
OSSL_PARAM_BLD_free(bld);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
if (p != NULL) {
|
|
|
a912db |
BN_free(p);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -991,13 +994,13 @@ err:
|
|
|
a912db |
|
|
|
a912db |
static isc_result_t
|
|
|
a912db |
openssldh_tofile(const dst_key_t *key, const char *directory) {
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
DH *dh;
|
|
|
a912db |
const BIGNUM *pub_key = NULL, *priv_key = NULL, *p = NULL, *g = NULL;
|
|
|
a912db |
#else
|
|
|
a912db |
EVP_PKEY *pkey;
|
|
|
a912db |
BIGNUM *pub_key = NULL, *priv_key = NULL, *p = NULL, *g = NULL;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
dst_private_t priv;
|
|
|
a912db |
unsigned char *bufs[4] = { NULL };
|
|
|
a912db |
unsigned short i = 0;
|
|
|
a912db |
@@ -1007,7 +1010,7 @@ openssldh_tofile(const dst_key_t *key, const char *directory) {
|
|
|
a912db |
return (DST_R_EXTERNALKEY);
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
if (key->keydata.dh == NULL) {
|
|
|
a912db |
return (DST_R_NULLKEY);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -1025,7 +1028,7 @@ openssldh_tofile(const dst_key_t *key, const char *directory) {
|
|
|
a912db |
EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_FFC_G, &g);
|
|
|
a912db |
EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_PUB_KEY, &pub_key);
|
|
|
a912db |
EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_PRIV_KEY, &priv_key);
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
priv.elements[i].tag = TAG_DH_PRIME;
|
|
|
a912db |
priv.elements[i].length = BN_num_bytes(p);
|
|
|
a912db |
@@ -1065,7 +1068,7 @@ openssldh_tofile(const dst_key_t *key, const char *directory) {
|
|
|
a912db |
}
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
|
|
a912db |
if (p != NULL) {
|
|
|
a912db |
BN_free(p);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -1078,7 +1081,8 @@ openssldh_tofile(const dst_key_t *key, const char *directory) {
|
|
|
a912db |
if (priv_key != NULL) {
|
|
|
a912db |
BN_clear_free(priv_key);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 \
|
|
|
a912db |
+ */
|
|
|
a912db |
|
|
|
a912db |
return (result);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -1088,14 +1092,14 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
|
|
|
a912db |
dst_private_t priv;
|
|
|
a912db |
isc_result_t ret;
|
|
|
a912db |
int i;
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
DH *dh = NULL;
|
|
|
a912db |
#else
|
|
|
a912db |
OSSL_PARAM_BLD *bld = NULL;
|
|
|
a912db |
OSSL_PARAM *params = NULL;
|
|
|
a912db |
EVP_PKEY_CTX *ctx = NULL;
|
|
|
a912db |
EVP_PKEY *pkey = NULL;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
BIGNUM *pub_key = NULL, *priv_key = NULL, *p = NULL, *g = NULL;
|
|
|
a912db |
int key_size = 0;
|
|
|
a912db |
isc_mem_t *mctx;
|
|
|
a912db |
@@ -1113,7 +1117,7 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
|
|
|
a912db |
DST_RET(DST_R_EXTERNALKEY);
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
dh = DH_new();
|
|
|
a912db |
if (dh == NULL) {
|
|
|
a912db |
DST_RET(ISC_R_NOMEMORY);
|
|
|
a912db |
@@ -1128,7 +1132,7 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
|
|
|
a912db |
if (ctx == NULL) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
for (i = 0; i < priv.nelements; i++) {
|
|
|
a912db |
BIGNUM *bn;
|
|
|
a912db |
@@ -1155,7 +1159,7 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
|
|
|
a912db |
}
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
if (DH_set0_key(dh, pub_key, priv_key) != 1) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult2("DH_set0_key",
|
|
|
a912db |
DST_R_OPENSSLFAILURE));
|
|
|
a912db |
@@ -1202,13 +1206,13 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
|
|
|
a912db |
|
|
|
a912db |
key->keydata.pkey = pkey;
|
|
|
a912db |
pkey = NULL;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
key->key_size = (unsigned int)key_size;
|
|
|
a912db |
ret = ISC_R_SUCCESS;
|
|
|
a912db |
|
|
|
a912db |
err:
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
if (dh != NULL) {
|
|
|
a912db |
DH_free(dh);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -1225,7 +1229,7 @@ err:
|
|
|
a912db |
if (bld != NULL) {
|
|
|
a912db |
OSSL_PARAM_BLD_free(bld);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
if (p != NULL) {
|
|
|
a912db |
BN_free(p);
|
|
|
a912db |
}
|
|
|
a912db |
diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
|
|
|
a912db |
index 519e88b7e7..04f0d80b5e 100644
|
|
|
a912db |
--- a/lib/dns/opensslecdsa_link.c
|
|
|
a912db |
+++ b/lib/dns/opensslecdsa_link.c
|
|
|
a912db |
@@ -17,14 +17,14 @@
|
|
|
a912db |
|
|
|
a912db |
#include <openssl/bn.h>
|
|
|
a912db |
#include <openssl/opensslv.h>
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
|
|
a912db |
#include <openssl/core_names.h>
|
|
|
a912db |
#endif
|
|
|
a912db |
#include <openssl/ecdsa.h>
|
|
|
a912db |
#include <openssl/err.h>
|
|
|
a912db |
#include <openssl/evp.h>
|
|
|
a912db |
#include <openssl/objects.h>
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
|
|
a912db |
#include <openssl/param_build.h>
|
|
|
a912db |
#endif
|
|
|
a912db |
#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
@@ -57,7 +57,7 @@
|
|
|
a912db |
goto err; \
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
|
|
a912db |
static isc_result_t
|
|
|
a912db |
raw_key_to_ossl(unsigned int key_alg, int private, const unsigned char *key,
|
|
|
a912db |
size_t key_len, EVP_PKEY **pkey) {
|
|
|
a912db |
@@ -159,7 +159,8 @@ err:
|
|
|
a912db |
|
|
|
a912db |
return (ret);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 \
|
|
|
a912db |
+ */
|
|
|
a912db |
|
|
|
a912db |
static isc_result_t
|
|
|
a912db |
opensslecdsa_createctx(dst_key_t *key, dst_context_t *dctx) {
|
|
|
a912db |
@@ -411,7 +412,7 @@ opensslecdsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
|
|
|
a912db |
bool ret;
|
|
|
a912db |
EVP_PKEY *pkey1 = key1->keydata.pkey;
|
|
|
a912db |
EVP_PKEY *pkey2 = key2->keydata.pkey;
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
EC_KEY *eckey1 = NULL;
|
|
|
a912db |
EC_KEY *eckey2 = NULL;
|
|
|
a912db |
const BIGNUM *priv1;
|
|
|
a912db |
@@ -419,7 +420,7 @@ opensslecdsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
|
|
|
a912db |
#else
|
|
|
a912db |
BIGNUM *priv1 = NULL;
|
|
|
a912db |
BIGNUM *priv2 = NULL;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
if (pkey1 == NULL && pkey2 == NULL) {
|
|
|
a912db |
return (true);
|
|
|
a912db |
@@ -432,7 +433,7 @@ opensslecdsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
|
|
|
a912db |
DST_RET(false);
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
eckey1 = EVP_PKEY_get1_EC_KEY(pkey1);
|
|
|
a912db |
eckey2 = EVP_PKEY_get1_EC_KEY(pkey2);
|
|
|
a912db |
if (eckey1 == NULL && eckey2 == NULL) {
|
|
|
a912db |
@@ -445,7 +446,7 @@ opensslecdsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
|
|
|
a912db |
#else
|
|
|
a912db |
EVP_PKEY_get_bn_param(pkey1, OSSL_PKEY_PARAM_PRIV_KEY, &priv1);
|
|
|
a912db |
EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_PRIV_KEY, &priv2);
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
if (priv1 != NULL || priv2 != NULL) {
|
|
|
a912db |
if (priv1 == NULL || priv2 == NULL || BN_cmp(priv1, priv2) != 0)
|
|
|
a912db |
@@ -457,7 +458,7 @@ opensslecdsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
|
|
|
a912db |
ret = true;
|
|
|
a912db |
|
|
|
a912db |
err:
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
if (eckey1 != NULL) {
|
|
|
a912db |
EC_KEY_free(eckey1);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -471,7 +472,7 @@ err:
|
|
|
a912db |
if (priv2 != NULL) {
|
|
|
a912db |
BN_clear_free(priv2);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
return (ret);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -481,12 +482,12 @@ opensslecdsa_generate(dst_key_t *key, int unused, void (*callback)(int)) {
|
|
|
a912db |
isc_result_t ret;
|
|
|
a912db |
int status;
|
|
|
a912db |
EVP_PKEY *pkey = NULL;
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
EC_KEY *eckey = NULL;
|
|
|
a912db |
#else
|
|
|
a912db |
EVP_PKEY_CTX *ctx = NULL;
|
|
|
a912db |
EVP_PKEY *params_pkey = NULL;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
int group_nid;
|
|
|
a912db |
|
|
|
a912db |
REQUIRE(key->key_alg == DST_ALG_ECDSA256 ||
|
|
|
a912db |
@@ -502,7 +503,7 @@ opensslecdsa_generate(dst_key_t *key, int unused, void (*callback)(int)) {
|
|
|
a912db |
key->key_size = DNS_KEY_ECDSA384SIZE * 4;
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
eckey = EC_KEY_new_by_curve_name(group_nid);
|
|
|
a912db |
if (eckey == NULL) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult2("EC_KEY_new_by_curve_name",
|
|
|
a912db |
@@ -563,7 +564,7 @@ opensslecdsa_generate(dst_key_t *key, int unused, void (*callback)(int)) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult2("EVP_PKEY_keygen",
|
|
|
a912db |
DST_R_OPENSSLFAILURE));
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
key->keydata.pkey = pkey;
|
|
|
a912db |
pkey = NULL;
|
|
|
a912db |
@@ -573,7 +574,7 @@ err:
|
|
|
a912db |
if (pkey != NULL) {
|
|
|
a912db |
EVP_PKEY_free(pkey);
|
|
|
a912db |
}
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
if (eckey != NULL) {
|
|
|
a912db |
EC_KEY_free(eckey);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -584,7 +585,7 @@ err:
|
|
|
a912db |
if (ctx != NULL) {
|
|
|
a912db |
EVP_PKEY_CTX_free(ctx);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
return (ret);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -593,11 +594,11 @@ static bool
|
|
|
a912db |
opensslecdsa_isprivate(const dst_key_t *key) {
|
|
|
a912db |
bool ret;
|
|
|
a912db |
EVP_PKEY *pkey;
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
EC_KEY *eckey;
|
|
|
a912db |
#else
|
|
|
a912db |
BIGNUM *priv = NULL;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
REQUIRE(key->key_alg == DST_ALG_ECDSA256 ||
|
|
|
a912db |
key->key_alg == DST_ALG_ECDSA384);
|
|
|
a912db |
@@ -607,7 +608,7 @@ opensslecdsa_isprivate(const dst_key_t *key) {
|
|
|
a912db |
return (false);
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
eckey = EVP_PKEY_get1_EC_KEY(pkey);
|
|
|
a912db |
|
|
|
a912db |
ret = (eckey != NULL && EC_KEY_get0_private_key(eckey) != NULL);
|
|
|
a912db |
@@ -621,7 +622,7 @@ opensslecdsa_isprivate(const dst_key_t *key) {
|
|
|
a912db |
if (priv != NULL) {
|
|
|
a912db |
BN_clear_free(priv);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
return (ret);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -640,7 +641,7 @@ static isc_result_t
|
|
|
a912db |
opensslecdsa_todns(const dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
isc_result_t ret;
|
|
|
a912db |
EVP_PKEY *pkey;
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
EC_KEY *eckey = NULL;
|
|
|
a912db |
int len;
|
|
|
a912db |
unsigned char *cp;
|
|
|
a912db |
@@ -650,7 +651,7 @@ opensslecdsa_todns(const dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
BIGNUM *y = NULL;
|
|
|
a912db |
size_t keysize = 0;
|
|
|
a912db |
size_t len = 0;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
isc_region_t r;
|
|
|
a912db |
unsigned char buf[DNS_KEY_ECDSA384SIZE + 1];
|
|
|
a912db |
|
|
|
a912db |
@@ -658,7 +659,7 @@ opensslecdsa_todns(const dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
|
|
|
a912db |
pkey = key->keydata.pkey;
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
eckey = EVP_PKEY_get1_EC_KEY(pkey);
|
|
|
a912db |
if (eckey == NULL) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult(ISC_R_FAILURE));
|
|
|
a912db |
@@ -677,14 +678,14 @@ opensslecdsa_todns(const dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
len = keysize;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
isc_buffer_availableregion(data, &r);
|
|
|
a912db |
if (r.length < (unsigned int)len) {
|
|
|
a912db |
DST_RET(ISC_R_NOSPACE);
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
cp = buf;
|
|
|
a912db |
if (!i2o_ECPublicKey(eckey, &cp)) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult(ISC_R_FAILURE));
|
|
|
a912db |
@@ -704,13 +705,13 @@ opensslecdsa_todns(const dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
BN_bn2bin_fixed(x, &buf[0], keysize / 2);
|
|
|
a912db |
BN_bn2bin_fixed(y, &buf[keysize / 2], keysize / 2);
|
|
|
a912db |
memmove(r.base, buf, len);
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
isc_buffer_add(data, len);
|
|
|
a912db |
ret = ISC_R_SUCCESS;
|
|
|
a912db |
|
|
|
a912db |
err:
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
if (eckey != NULL) {
|
|
|
a912db |
EC_KEY_free(eckey);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -721,7 +722,7 @@ err:
|
|
|
a912db |
if (y != NULL) {
|
|
|
a912db |
BN_clear_free(y);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
return (ret);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -731,7 +732,7 @@ opensslecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
isc_result_t ret;
|
|
|
a912db |
EVP_PKEY *pkey = NULL;
|
|
|
a912db |
isc_region_t r;
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
EC_KEY *eckey = NULL;
|
|
|
a912db |
const unsigned char *cp;
|
|
|
a912db |
unsigned int len;
|
|
|
a912db |
@@ -739,7 +740,7 @@ opensslecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
int group_nid;
|
|
|
a912db |
#else
|
|
|
a912db |
size_t len;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
REQUIRE(key->key_alg == DST_ALG_ECDSA256 ||
|
|
|
a912db |
key->key_alg == DST_ALG_ECDSA384);
|
|
|
a912db |
@@ -758,7 +759,7 @@ opensslecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
DST_RET(DST_R_INVALIDPUBLICKEY);
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
if (key->key_alg == DST_ALG_ECDSA256) {
|
|
|
a912db |
group_nid = NID_X9_62_prime256v1;
|
|
|
a912db |
} else {
|
|
|
a912db |
@@ -794,7 +795,7 @@ opensslecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
if (ret != ISC_R_SUCCESS) {
|
|
|
a912db |
DST_RET(ret);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
isc_buffer_forward(data, len);
|
|
|
a912db |
key->keydata.pkey = pkey;
|
|
|
a912db |
@@ -802,11 +803,11 @@ opensslecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
ret = ISC_R_SUCCESS;
|
|
|
a912db |
|
|
|
a912db |
err:
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
if (eckey != NULL) {
|
|
|
a912db |
EC_KEY_free(eckey);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
return (ret);
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
@@ -814,13 +815,13 @@ static isc_result_t
|
|
|
a912db |
opensslecdsa_tofile(const dst_key_t *key, const char *directory) {
|
|
|
a912db |
isc_result_t ret;
|
|
|
a912db |
EVP_PKEY *pkey;
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
EC_KEY *eckey = NULL;
|
|
|
a912db |
const BIGNUM *privkey = NULL;
|
|
|
a912db |
#else
|
|
|
a912db |
int status;
|
|
|
a912db |
BIGNUM *privkey = NULL;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
dst_private_t priv;
|
|
|
a912db |
unsigned char *buf = NULL;
|
|
|
a912db |
unsigned short i;
|
|
|
a912db |
@@ -835,7 +836,7 @@ opensslecdsa_tofile(const dst_key_t *key, const char *directory) {
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
pkey = key->keydata.pkey;
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
eckey = EVP_PKEY_get1_EC_KEY(pkey);
|
|
|
a912db |
if (eckey == NULL) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult2("EVP_PKEY_get1_EC_KEY",
|
|
|
a912db |
@@ -853,7 +854,7 @@ opensslecdsa_tofile(const dst_key_t *key, const char *directory) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult2("EVP_PKEY_get_bn_param",
|
|
|
a912db |
DST_R_OPENSSLFAILURE));
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
buf = isc_mem_get(key->mctx, BN_num_bytes(privkey));
|
|
|
a912db |
|
|
|
a912db |
@@ -888,7 +889,7 @@ err:
|
|
|
a912db |
if (buf != NULL && privkey != NULL) {
|
|
|
a912db |
isc_mem_put(key->mctx, buf, BN_num_bytes(privkey));
|
|
|
a912db |
}
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
if (eckey != NULL) {
|
|
|
a912db |
EC_KEY_free(eckey);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -896,12 +897,12 @@ err:
|
|
|
a912db |
if (privkey != NULL) {
|
|
|
a912db |
BN_clear_free(privkey);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
return (ret);
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
static isc_result_t
|
|
|
a912db |
ecdsa_check(EC_KEY *eckey, EC_KEY *pubeckey) {
|
|
|
a912db |
const EC_POINT *pubkey;
|
|
|
a912db |
@@ -1065,9 +1066,9 @@ err:
|
|
|
a912db |
|
|
|
a912db |
return (ret);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
static isc_result_t
|
|
|
a912db |
load_privkey_from_privstruct(EC_KEY *eckey, dst_private_t *priv,
|
|
|
a912db |
int privkey_index) {
|
|
|
a912db |
@@ -1102,16 +1103,16 @@ eckey_to_pkey(EC_KEY *eckey, EVP_PKEY **pkey) {
|
|
|
a912db |
}
|
|
|
a912db |
return (ISC_R_SUCCESS);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
static isc_result_t
|
|
|
a912db |
finalize_eckey(dst_key_t *key,
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
EC_KEY *eckey,
|
|
|
a912db |
#endif
|
|
|
a912db |
const char *engine, const char *label) {
|
|
|
a912db |
isc_result_t result = ISC_R_SUCCESS;
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
EVP_PKEY *pkey = NULL;
|
|
|
a912db |
|
|
|
a912db |
REQUIRE(eckey != NULL);
|
|
|
a912db |
@@ -1122,7 +1123,7 @@ finalize_eckey(dst_key_t *key,
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
key->keydata.pkey = pkey;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
if (label != NULL) {
|
|
|
a912db |
key->label = isc_mem_strdup(key->mctx, label);
|
|
|
a912db |
@@ -1138,7 +1139,7 @@ finalize_eckey(dst_key_t *key,
|
|
|
a912db |
return (result);
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
static isc_result_t
|
|
|
a912db |
dst__key_to_eckey(dst_key_t *key, EC_KEY **eckey) {
|
|
|
a912db |
int group_nid;
|
|
|
a912db |
@@ -1163,7 +1164,7 @@ dst__key_to_eckey(dst_key_t *key, EC_KEY **eckey) {
|
|
|
a912db |
|
|
|
a912db |
return (ISC_R_SUCCESS);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
static isc_result_t
|
|
|
a912db |
opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
|
|
|
a912db |
@@ -1173,10 +1174,10 @@ static isc_result_t
|
|
|
a912db |
opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
|
|
|
a912db |
dst_private_t priv;
|
|
|
a912db |
isc_result_t ret;
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
EC_KEY *eckey = NULL;
|
|
|
a912db |
EC_KEY *pubeckey = NULL;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
const char *engine = NULL;
|
|
|
a912db |
const char *label = NULL;
|
|
|
a912db |
int i, privkey_index = -1;
|
|
|
a912db |
@@ -1227,14 +1228,14 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
|
|
|
a912db |
goto err;
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
eckey = EVP_PKEY_get1_EC_KEY(key->keydata.pkey);
|
|
|
a912db |
if (eckey == NULL) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
} else {
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
ret = dst__key_to_eckey(key, &eckey);
|
|
|
a912db |
if (ret != ISC_R_SUCCESS) {
|
|
|
a912db |
goto err;
|
|
|
a912db |
@@ -1251,7 +1252,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
|
|
|
a912db |
priv.elements[privkey_index].data,
|
|
|
a912db |
priv.elements[privkey_index].length,
|
|
|
a912db |
&key->keydata.pkey);
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
if (ret != ISC_R_SUCCESS) {
|
|
|
a912db |
goto err;
|
|
|
a912db |
@@ -1260,7 +1261,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
|
|
|
a912db |
finalize_key = true;
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
if (pub != NULL && pub->keydata.pkey != NULL) {
|
|
|
a912db |
pubeckey = EVP_PKEY_get1_EC_KEY(pub->keydata.pkey);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -1283,17 +1284,17 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
|
|
|
a912db |
if (finalize_key) {
|
|
|
a912db |
ret = finalize_eckey(key, engine, label);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
err:
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
if (pubeckey != NULL) {
|
|
|
a912db |
EC_KEY_free(pubeckey);
|
|
|
a912db |
}
|
|
|
a912db |
if (eckey != NULL) {
|
|
|
a912db |
EC_KEY_free(eckey);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
if (ret != ISC_R_SUCCESS) {
|
|
|
a912db |
key->keydata.generic = NULL;
|
|
|
a912db |
}
|
|
|
a912db |
diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
|
|
|
a912db |
index fc905b7d60..867b486a2f 100644
|
|
|
a912db |
--- a/lib/dns/opensslrsa_link.c
|
|
|
a912db |
+++ b/lib/dns/opensslrsa_link.c
|
|
|
a912db |
@@ -18,7 +18,7 @@
|
|
|
a912db |
|
|
|
a912db |
#include <openssl/bn.h>
|
|
|
a912db |
#include <openssl/opensslv.h>
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
|
|
a912db |
#include <openssl/core_names.h>
|
|
|
a912db |
#endif
|
|
|
a912db |
#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
@@ -26,7 +26,7 @@
|
|
|
a912db |
#endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
#include <openssl/err.h>
|
|
|
a912db |
#include <openssl/objects.h>
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
|
|
a912db |
#include <openssl/param_build.h>
|
|
|
a912db |
#endif
|
|
|
a912db |
#include <openssl/rsa.h>
|
|
|
a912db |
@@ -180,12 +180,12 @@ static isc_result_t
|
|
|
a912db |
opensslrsa_verify2(dst_context_t *dctx, int maxbits, const isc_region_t *sig) {
|
|
|
a912db |
dst_key_t *key = dctx->key;
|
|
|
a912db |
int status = 0;
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
RSA *rsa;
|
|
|
a912db |
const BIGNUM *e = NULL;
|
|
|
a912db |
#else
|
|
|
a912db |
BIGNUM *e = NULL;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
EVP_MD_CTX *evp_md_ctx = dctx->ctxdata.evp_md_ctx;
|
|
|
a912db |
EVP_PKEY *pkey = key->keydata.pkey;
|
|
|
a912db |
int bits;
|
|
|
a912db |
@@ -195,7 +195,7 @@ opensslrsa_verify2(dst_context_t *dctx, int maxbits, const isc_region_t *sig) {
|
|
|
a912db |
dctx->key->key_alg == DST_ALG_RSASHA256 ||
|
|
|
a912db |
dctx->key->key_alg == DST_ALG_RSASHA512);
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
rsa = EVP_PKEY_get1_RSA(pkey);
|
|
|
a912db |
if (rsa == NULL) {
|
|
|
a912db |
return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
|
|
|
a912db |
@@ -213,7 +213,7 @@ opensslrsa_verify2(dst_context_t *dctx, int maxbits, const isc_region_t *sig) {
|
|
|
a912db |
}
|
|
|
a912db |
bits = BN_num_bits(e);
|
|
|
a912db |
BN_free(e);
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
if (bits > maxbits && maxbits != 0) {
|
|
|
a912db |
return (DST_R_VERIFYFAILURE);
|
|
|
a912db |
@@ -243,7 +243,7 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
|
|
|
a912db |
int status;
|
|
|
a912db |
EVP_PKEY *pkey1 = key1->keydata.pkey;
|
|
|
a912db |
EVP_PKEY *pkey2 = key2->keydata.pkey;
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
RSA *rsa1 = NULL;
|
|
|
a912db |
RSA *rsa2 = NULL;
|
|
|
a912db |
const BIGNUM *d1 = NULL, *d2 = NULL;
|
|
|
a912db |
@@ -253,7 +253,7 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
|
|
|
a912db |
BIGNUM *d1 = NULL, *d2 = NULL;
|
|
|
a912db |
BIGNUM *p1 = NULL, *p2 = NULL;
|
|
|
a912db |
BIGNUM *q1 = NULL, *q2 = NULL;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
if (pkey1 == NULL && pkey2 == NULL) {
|
|
|
a912db |
return (true);
|
|
|
a912db |
@@ -267,7 +267,7 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
|
|
|
a912db |
DST_RET(false);
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
rsa1 = EVP_PKEY_get1_RSA(pkey1);
|
|
|
a912db |
rsa2 = EVP_PKEY_get1_RSA(pkey2);
|
|
|
a912db |
if (rsa1 == NULL && rsa2 == NULL) {
|
|
|
a912db |
@@ -280,14 +280,14 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
|
|
|
a912db |
#else
|
|
|
a912db |
EVP_PKEY_get_bn_param(pkey1, OSSL_PKEY_PARAM_RSA_D, &d1;;
|
|
|
a912db |
EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_RSA_D, &d2;;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
if (d1 != NULL || d2 != NULL) {
|
|
|
a912db |
if (d1 == NULL || d2 == NULL) {
|
|
|
a912db |
DST_RET(false);
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
RSA_get0_factors(rsa1, &p1, &q1;;
|
|
|
a912db |
RSA_get0_factors(rsa2, &p2, &q2;;
|
|
|
a912db |
#else
|
|
|
a912db |
@@ -295,7 +295,7 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
|
|
|
a912db |
EVP_PKEY_get_bn_param(pkey1, OSSL_PKEY_PARAM_RSA_FACTOR2, &q1;;
|
|
|
a912db |
EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_RSA_FACTOR1, &p2;;
|
|
|
a912db |
EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_RSA_FACTOR2, &q2;;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
if (BN_cmp(d1, d2) != 0 || BN_cmp(p1, p2) != 0 ||
|
|
|
a912db |
BN_cmp(q1, q2) != 0) {
|
|
|
a912db |
@@ -306,7 +306,7 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
|
|
|
a912db |
ret = true;
|
|
|
a912db |
|
|
|
a912db |
err:
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
if (rsa1 != NULL) {
|
|
|
a912db |
RSA_free(rsa1);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -332,12 +332,12 @@ err:
|
|
|
a912db |
if (q2 != NULL) {
|
|
|
a912db |
BN_clear_free(q2);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
return (ret);
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
static int
|
|
|
a912db |
progress_cb(int p, int n, BN_GENCB *cb) {
|
|
|
a912db |
union {
|
|
|
a912db |
@@ -368,7 +368,7 @@ progress_cb(EVP_PKEY_CTX *ctx) {
|
|
|
a912db |
}
|
|
|
a912db |
return (1);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
static isc_result_t
|
|
|
a912db |
opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
|
|
|
a912db |
@@ -378,7 +378,7 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
|
|
|
a912db |
void (*fptr)(int);
|
|
|
a912db |
} u;
|
|
|
a912db |
BIGNUM *e = BN_new();
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
RSA *rsa = RSA_new();
|
|
|
a912db |
EVP_PKEY *pkey = EVP_PKEY_new();
|
|
|
a912db |
#if !HAVE_BN_GENCB_NEW
|
|
|
a912db |
@@ -388,9 +388,9 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
|
|
|
a912db |
#else
|
|
|
a912db |
EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_from_name(NULL, "RSA", NULL);
|
|
|
a912db |
EVP_PKEY *pkey = NULL;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
if (e == NULL || rsa == NULL || pkey == NULL || cb == NULL) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
|
|
|
a912db |
}
|
|
|
a912db |
@@ -398,7 +398,7 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
|
|
|
a912db |
if (e == NULL || ctx == NULL) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
/*
|
|
|
a912db |
* Reject incorrect RSA key lengths.
|
|
|
a912db |
@@ -437,7 +437,7 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
|
|
|
a912db |
BN_set_bit(e, 32);
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
if (EVP_PKEY_set1_RSA(pkey, rsa) != 1) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
|
|
|
a912db |
}
|
|
|
a912db |
@@ -476,7 +476,7 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult2("EVP_PKEY_keygen",
|
|
|
a912db |
DST_R_OPENSSLFAILURE));
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
key->keydata.pkey = pkey;
|
|
|
a912db |
pkey = NULL;
|
|
|
a912db |
@@ -486,7 +486,7 @@ err:
|
|
|
a912db |
if (pkey != NULL) {
|
|
|
a912db |
EVP_PKEY_free(pkey);
|
|
|
a912db |
}
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
if (rsa != NULL) {
|
|
|
a912db |
RSA_free(rsa);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -497,7 +497,7 @@ err:
|
|
|
a912db |
if (ctx != NULL) {
|
|
|
a912db |
EVP_PKEY_CTX_free(ctx);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
if (e != NULL) {
|
|
|
a912db |
BN_free(e);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -508,12 +508,12 @@ static bool
|
|
|
a912db |
opensslrsa_isprivate(const dst_key_t *key) {
|
|
|
a912db |
bool ret;
|
|
|
a912db |
EVP_PKEY *pkey;
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
RSA *rsa;
|
|
|
a912db |
const BIGNUM *d = NULL;
|
|
|
a912db |
#else
|
|
|
a912db |
BIGNUM *d = NULL;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
REQUIRE(key->key_alg == DST_ALG_RSASHA1 ||
|
|
|
a912db |
key->key_alg == DST_ALG_NSEC3RSASHA1 ||
|
|
|
a912db |
@@ -525,7 +525,7 @@ opensslrsa_isprivate(const dst_key_t *key) {
|
|
|
a912db |
return (false);
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
rsa = EVP_PKEY_get1_RSA(pkey);
|
|
|
a912db |
INSIST(rsa != NULL);
|
|
|
a912db |
|
|
|
a912db |
@@ -542,7 +542,7 @@ opensslrsa_isprivate(const dst_key_t *key) {
|
|
|
a912db |
if (d != NULL) {
|
|
|
a912db |
BN_clear_free(d);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
return (ret);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -564,19 +564,19 @@ opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
unsigned int mod_bytes;
|
|
|
a912db |
isc_result_t ret;
|
|
|
a912db |
EVP_PKEY *pkey;
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
RSA *rsa;
|
|
|
a912db |
const BIGNUM *e = NULL, *n = NULL;
|
|
|
a912db |
#else
|
|
|
a912db |
BIGNUM *e = NULL, *n = NULL;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
REQUIRE(key->keydata.pkey != NULL);
|
|
|
a912db |
|
|
|
a912db |
pkey = key->keydata.pkey;
|
|
|
a912db |
isc_buffer_availableregion(data, &r);
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
rsa = EVP_PKEY_get1_RSA(pkey);
|
|
|
a912db |
if (rsa == NULL) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
|
|
|
a912db |
@@ -588,7 +588,7 @@ opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
if (e == NULL || n == NULL) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
mod_bytes = BN_num_bytes(n);
|
|
|
a912db |
e_bytes = BN_num_bytes(e);
|
|
|
a912db |
@@ -621,7 +621,7 @@ opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
|
|
|
a912db |
ret = ISC_R_SUCCESS;
|
|
|
a912db |
err:
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
if (rsa != NULL) {
|
|
|
a912db |
RSA_free(rsa);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -632,7 +632,7 @@ err:
|
|
|
a912db |
if (n != NULL) {
|
|
|
a912db |
BN_free(n);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
return (ret);
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
@@ -643,13 +643,13 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
isc_region_t r;
|
|
|
a912db |
unsigned int e_bytes;
|
|
|
a912db |
unsigned int length;
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
RSA *rsa = NULL;
|
|
|
a912db |
#else
|
|
|
a912db |
OSSL_PARAM_BLD *bld = NULL;
|
|
|
a912db |
OSSL_PARAM *params = NULL;
|
|
|
a912db |
EVP_PKEY_CTX *ctx = NULL;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
EVP_PKEY *pkey = NULL;
|
|
|
a912db |
BIGNUM *e = NULL, *n = NULL;
|
|
|
a912db |
|
|
|
a912db |
@@ -691,7 +691,7 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
|
|
|
a912db |
isc_buffer_forward(data, length);
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
rsa = RSA_new();
|
|
|
a912db |
if (rsa == NULL) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult2("RSA_new",
|
|
|
a912db |
@@ -749,7 +749,7 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult2("EVP_PKEY_fromdata",
|
|
|
a912db |
DST_R_OPENSSLFAILURE));
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
key->keydata.pkey = pkey;
|
|
|
a912db |
pkey = NULL;
|
|
|
a912db |
@@ -757,7 +757,7 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
|
|
|
a912db |
|
|
|
a912db |
err:
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
if (rsa != NULL) {
|
|
|
a912db |
RSA_free(rsa);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -771,7 +771,7 @@ err:
|
|
|
a912db |
if (bld != NULL) {
|
|
|
a912db |
OSSL_PARAM_BLD_free(bld);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
if (n != NULL) {
|
|
|
a912db |
BN_free(n);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -792,7 +792,7 @@ opensslrsa_tofile(const dst_key_t *key, const char *directory) {
|
|
|
a912db |
unsigned char *bufs[8] = { NULL };
|
|
|
a912db |
unsigned short i = 0;
|
|
|
a912db |
EVP_PKEY *pkey;
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
RSA *rsa = NULL;
|
|
|
a912db |
const BIGNUM *n = NULL, *e = NULL, *d = NULL;
|
|
|
a912db |
const BIGNUM *p = NULL, *q = NULL;
|
|
|
a912db |
@@ -801,7 +801,7 @@ opensslrsa_tofile(const dst_key_t *key, const char *directory) {
|
|
|
a912db |
BIGNUM *n = NULL, *e = NULL, *d = NULL;
|
|
|
a912db |
BIGNUM *p = NULL, *q = NULL;
|
|
|
a912db |
BIGNUM *dmp1 = NULL, *dmq1 = NULL, *iqmp = NULL;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
if (key->keydata.pkey == NULL) {
|
|
|
a912db |
DST_RET(DST_R_NULLKEY);
|
|
|
a912db |
@@ -812,7 +812,7 @@ opensslrsa_tofile(const dst_key_t *key, const char *directory) {
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
pkey = key->keydata.pkey;
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
rsa = EVP_PKEY_get1_RSA(pkey);
|
|
|
a912db |
if (rsa == NULL) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
|
|
|
a912db |
@@ -829,7 +829,7 @@ opensslrsa_tofile(const dst_key_t *key, const char *directory) {
|
|
|
a912db |
EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_EXPONENT1, &dmp1);
|
|
|
a912db |
EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_EXPONENT2, &dmq1);
|
|
|
a912db |
EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_COEFFICIENT1, &iqmp);
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
if (n == NULL || e == NULL) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
|
|
|
a912db |
@@ -935,7 +935,7 @@ err:
|
|
|
a912db |
priv.elements[i].length);
|
|
|
a912db |
}
|
|
|
a912db |
}
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
RSA_free(rsa);
|
|
|
a912db |
#else
|
|
|
a912db |
if (n != NULL) {
|
|
|
a912db |
@@ -962,12 +962,12 @@ err:
|
|
|
a912db |
if (iqmp != NULL) {
|
|
|
a912db |
BN_clear_free(iqmp);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
return (ret);
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
static isc_result_t
|
|
|
a912db |
rsa_check(RSA *rsa, RSA *pub) {
|
|
|
a912db |
const BIGNUM *n1 = NULL, *n2 = NULL;
|
|
|
a912db |
@@ -1079,14 +1079,14 @@ err:
|
|
|
a912db |
|
|
|
a912db |
return (ret);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
static isc_result_t
|
|
|
a912db |
opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
|
|
|
a912db |
dst_private_t priv;
|
|
|
a912db |
isc_result_t ret;
|
|
|
a912db |
int i;
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
RSA *rsa = NULL, *pubrsa = NULL;
|
|
|
a912db |
const BIGNUM *ex = NULL;
|
|
|
a912db |
#else
|
|
|
a912db |
@@ -1094,7 +1094,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
|
|
|
a912db |
OSSL_PARAM *params = NULL;
|
|
|
a912db |
EVP_PKEY_CTX *ctx = NULL;
|
|
|
a912db |
BIGNUM *ex = NULL;
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
ENGINE *ep = NULL;
|
|
|
a912db |
#endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
@@ -1126,11 +1126,11 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
|
|
|
a912db |
DST_RET(ISC_R_SUCCESS);
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
if (pub != NULL && pub->keydata.pkey != NULL) {
|
|
|
a912db |
pubrsa = EVP_PKEY_get1_RSA(pub->keydata.pkey);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
for (i = 0; i < priv.nelements; i++) {
|
|
|
a912db |
switch (priv.elements[i].tag) {
|
|
|
a912db |
@@ -1249,7 +1249,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
|
|
|
a912db |
}
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
rsa = RSA_new();
|
|
|
a912db |
if (rsa == NULL) {
|
|
|
a912db |
DST_RET(ISC_R_NOMEMORY);
|
|
|
a912db |
@@ -1361,7 +1361,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
|
|
|
a912db |
ISC_R_SUCCESS) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
|
|
|
a912db |
if (BN_num_bits(e) > RSA_MAX_PUBEXP_BITS) {
|
|
|
a912db |
DST_RET(ISC_R_RANGE);
|
|
|
a912db |
@@ -1375,7 +1375,7 @@ err:
|
|
|
a912db |
if (pkey != NULL) {
|
|
|
a912db |
EVP_PKEY_free(pkey);
|
|
|
a912db |
}
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
if (rsa != NULL) {
|
|
|
a912db |
RSA_free(rsa);
|
|
|
a912db |
}
|
|
|
a912db |
@@ -1419,7 +1419,7 @@ err:
|
|
|
a912db |
if (iqmp != NULL) {
|
|
|
a912db |
BN_clear_free(iqmp);
|
|
|
a912db |
}
|
|
|
a912db |
-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|
|
|
a912db |
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
|
|
|
a912db |
if (ret != ISC_R_SUCCESS) {
|
|
|
a912db |
key->keydata.generic = NULL;
|
|
|
a912db |
}
|
|
|
a912db |
@@ -1643,7 +1643,7 @@ check_algorithm(unsigned char algorithm) {
|
|
|
a912db |
int status;
|
|
|
a912db |
isc_result_t ret = ISC_R_SUCCESS;
|
|
|
a912db |
size_t len;
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
RSA *rsa = NULL;
|
|
|
a912db |
#else
|
|
|
a912db |
OSSL_PARAM *params = NULL;
|
|
|
a912db |
@@ -1689,7 +1689,7 @@ check_algorithm(unsigned char algorithm) {
|
|
|
a912db |
DST_RET(ISC_R_NOMEMORY);
|
|
|
a912db |
}
|
|
|
a912db |
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
rsa = RSA_new();
|
|
|
a912db |
if (rsa == NULL) {
|
|
|
a912db |
DST_RET(dst__openssl_toresult2("RSA_new",
|
|
|
a912db |
@@ -1762,7 +1762,7 @@ check_algorithm(unsigned char algorithm) {
|
|
|
a912db |
err:
|
|
|
a912db |
BN_free(e);
|
|
|
a912db |
BN_free(n);
|
|
|
a912db |
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
|
a912db |
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
|
|
|
a912db |
if (rsa != NULL) {
|
|
|
a912db |
RSA_free(rsa);
|
|
|
a912db |
}
|
|
|
a912db |
--
|
|
|
a912db |
2.37.2
|
|
|
a912db |
|