1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
|
/*
* OpenVPN -- An application to securely tunnel IP networks
* over a single TCP/UDP port, with support for SSL/TLS-based
* session authentication and key exchange,
* packet encryption, packet authentication, and
* packet compression.
*
* Copyright (C) 2002-2023 OpenVPN Inc <sales@openvpn.net>
* Copyright (C) 2010-2021 Fox Crypto B.V. <openvpn@foxcrypto.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2
* as published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License along
* with this program; if not, write to the Free Software Foundation, Inc.,
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
*/
/**
* @file Data Channel Cryptography OpenSSL-specific backend interface
*/
#ifndef CRYPTO_OPENSSL_H_
#define CRYPTO_OPENSSL_H_
#include <openssl/evp.h>
#include <openssl/hmac.h>
#include <openssl/md5.h>
#include <openssl/sha.h>
#if OPENSSL_VERSION_NUMBER >= 0x30000000L
#include <openssl/provider.h>
#endif
/** Generic cipher %context. */
typedef EVP_CIPHER_CTX cipher_ctx_t;
/** Generic message digest %context. */
typedef EVP_MD_CTX md_ctx_t;
/** Generic HMAC %context. */
#if OPENSSL_VERSION_NUMBER < 0x30000000L
typedef HMAC_CTX hmac_ctx_t;
/* Use a dummy type for the provider */
typedef void provider_t;
#else
typedef struct {
OSSL_PARAM params[3];
uint8_t key[EVP_MAX_KEY_LENGTH];
EVP_MAC_CTX *ctx;
} hmac_ctx_t;
typedef OSSL_PROVIDER provider_t;
#endif
/* In OpenSSL 3.0 the method that returns EVP_CIPHER, the cipher needs to be
* freed afterwards, thus needing a non-const type. In constrast OpenSSL 1.1.1
* and lower returns a const type, needing a const type */
#if OPENSSL_VERSION_NUMBER < 0x30000000L
typedef const EVP_CIPHER evp_cipher_type;
typedef const EVP_MD evp_md_type;
#else
typedef EVP_CIPHER evp_cipher_type;
typedef EVP_MD evp_md_type;
#endif
/** Maximum length of an IV */
#define OPENVPN_MAX_IV_LENGTH EVP_MAX_IV_LENGTH
/** Cipher is in CBC mode */
#define OPENVPN_MODE_CBC EVP_CIPH_CBC_MODE
/** Cipher is in OFB mode */
#define OPENVPN_MODE_OFB EVP_CIPH_OFB_MODE
/** Cipher is in CFB mode */
#define OPENVPN_MODE_CFB EVP_CIPH_CFB_MODE
/** Cipher is in GCM mode */
#define OPENVPN_MODE_GCM EVP_CIPH_GCM_MODE
/** Cipher should encrypt */
#define OPENVPN_OP_ENCRYPT 1
/** Cipher should decrypt */
#define OPENVPN_OP_DECRYPT 0
#define DES_KEY_LENGTH 8
#define MD4_DIGEST_LENGTH 16
/**
* Retrieve any occurred OpenSSL errors and print those errors.
*
* Note that this function uses the not thread-safe OpenSSL error API.
*
* @param flags Flags to indicate error type and priority.
*/
void crypto_print_openssl_errors(const unsigned int flags);
/**
* Retrieve any OpenSSL errors, then print the supplied error message.
*
* This is just a convenience wrapper for often occurring situations.
*
* @param flags Flags to indicate error type and priority.
* @param format Format string to print.
* @param format args (optional) arguments for the format string.
*/
#define crypto_msg(flags, ...) \
do { \
crypto_print_openssl_errors(nonfatal(flags)); \
msg((flags), __VA_ARGS__); \
} while (false)
/**
* Load a key file from an engine
*
* @param file The engine file to load
* @param ui The UI method for the password prompt
* @param data The data to pass to the UI method
*
* @return The private key if successful or NULL if not
*/
EVP_PKEY *
engine_load_key(const char *file, SSL_CTX *ctx);
#endif /* CRYPTO_OPENSSL_H_ */
|
