Skip to content

Update magick plugin to OpenSSL 1.1.1 API #11441

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JosiahWI merged 5 commits into from
Jun 12, 2024
Merged

Update magick plugin to OpenSSL 1.1.1 API #11441

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d3cd659
Update magick plugin to OpenSSL 1.1.1 API
JosiahWI Jun 11, 2024
5b9caac
Add debug logging for signature verification
JosiahWI Jun 11, 2024
32c9035
Fix API call to get reason instead of library
JosiahWI Jun 11, 2024
3acecd9
Fix unintentional working directory changes
JosiahWI Jun 11, 2024
80bc025
Collapse EVP_DigestVerify failures into one case
JosiahWI Jun 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
51 changes: 28 additions & 23 deletions plugins/experimental/magick/magick.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -176,10 +176,10 @@ struct EVPContext {
~EVPContext()
{
assert(nullptr != context);
EVP_MD_CTX_destroy(context);
EVP_MD_CTX_free(context);
}

EVPContext() : context(EVP_MD_CTX_create()) { assert(nullptr != context); }
EVPContext() : context(EVP_MD_CTX_new()) { assert(nullptr != context); }
};

struct EVPKey {
Expand All @@ -203,6 +203,20 @@ struct EVPKey {
}
};

/** Remove the last error from this thread's error queue and print it.
*/
static void
ssl_error()
{
if (unsigned long error_code{ERR_get_error()}; 0 != error_code) {
if (char const *reason{ERR_reason_error_string(error_code)}; NULL == reason) {
Dbg(dbg_ctl, "SSL error: error code %lu", error_code);
} else {
Dbg(dbg_ctl, "SSL error: %s", reason);
}
}
}

bool
verify(const byte *const msg, const size_t mlen, const byte *const sig, const size_t slen, EVP_PKEY *const pkey)
{
Expand All @@ -218,30 +232,21 @@ verify(const byte *const msg, const size_t mlen, const byte *const sig, const si

EVPContext evp;

{
const int rc = EVP_DigestVerifyInit(evp.context, nullptr, EVP_sha256(), nullptr, pkey);
assert(1 == rc);
if (1 != rc) {
return false;
}
}

{
const int rc = EVP_DigestVerifyUpdate(evp.context, msg, mlen);
assert(1 == rc);
if (1 != rc) {
return false;
}
if (const int rc = EVP_DigestVerifyInit(evp.context, nullptr, EVP_sha256(), nullptr, pkey); 1 != rc) {
ssl_error();
return false;
}

ERR_clear_error();

{
const int rc = EVP_DigestVerifyFinal(evp.context, sig, slen);
return 1 == rc;
if (const int rc = EVP_DigestVerify(evp.context, sig, slen, msg, mlen); 1 == rc) {
return true;
} else {
// The OpenSSL 1.1.1 API distinguishes between a verification failure and a
// more serious error with a specific return value for the former, but we
// have collapsed them into one case because we don't do any special
// handling for serious errors.
ssl_error();
return false;
}

return false;
}

struct Exception {
Expand Down