Few more OpenSSL 1.1.0 incompatibilities

tool/Makefile.am

@@ -40,7 +40,7 @@ noinst_LTLIBRARIES = libpiv_cmd.la libpiv_util.la
 libpiv_cmd_la_SOURCES = cmdline.ggo cmdline.c cmdline.h
 libpiv_cmd_la_CFLAGS =
 
-libpiv_util_la_SOURCES = util.c util.h openssl-compat.c
+libpiv_util_la_SOURCES = util.c util.h openssl-compat.c openssl-compat.h
 libpiv_util_la_LIBADD = $(top_builddir)/lib/libykpiv.la $(OPENSSL_LIBS)
 
 cmdline.c cmdline.h: cmdline.ggo Makefile.am $(top_srcdir)/configure.ac

tool/openssl-compat.c

@@ -7,6 +7,7 @@
  * https://www.openssl.org/source/license.html
  */
 
+#include <openssl/opensslv.h>
 #if OPENSSL_VERSION_NUMBER < 0x10100000L
 
 #include <string.h>
@@ -50,4 +51,33 @@ void RSA_get0_key(const RSA *r,
         *d = r->d;
 }
 
+void RSA_get0_factors(const RSA *r, const BIGNUM **p, const BIGNUM **q)
+{
+    if (p != NULL)
+        *p = r->p;
+    if (q != NULL)
+        *q = r->q;
+}
+
+void RSA_get0_crt_params(const RSA *r,
+                         const BIGNUM **dmp1, const BIGNUM **dmq1,
+                         const BIGNUM **iqmp)
+{
+    if (dmp1 != NULL)
+        *dmp1 = r->dmp1;
+    if (dmq1 != NULL)
+        *dmq1 = r->dmq1;
+    if (iqmp != NULL)
+        *iqmp = r->iqmp;
+}
+
+void X509_SIG_getm(X509_SIG *sig, X509_ALGOR **palg,
+                   ASN1_OCTET_STRING **pdigest)
+{
+    if (palg)
+        *palg = sig->algor;
+    if (pdigest)
+        *pdigest = sig->digest;
+}
+
 #endif /* OPENSSL_VERSION_NUMBER */

tool/openssl-compat.h

@@ -17,10 +17,17 @@
 #include <openssl/ecdsa.h>
 #include <openssl/dh.h>
 #include <openssl/evp.h>
+#include <openssl/x509.h>
 
 int RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
 void RSA_get0_key(const RSA *r,
                   const BIGNUM **n, const BIGNUM **e, const BIGNUM **d);
+void RSA_get0_factors(const RSA *r, const BIGNUM **p, const BIGNUM **q);
+void RSA_get0_crt_params(const RSA *r,
+                         const BIGNUM **dmp1, const BIGNUM **dmq1,
+                         const BIGNUM **iqmp);
+void X509_SIG_getm(X509_SIG *sig, X509_ALGOR **palg,
+                   ASN1_OCTET_STRING **pdigest);
 
 #endif /* OPENSSL_VERSION_NUMBER */
 #endif /* LIBCRYPTO_COMPAT_H */

tool/util.c

@@ -438,23 +438,23 @@ bool set_component(unsigned char *in_ptr, const BIGNUM *bn, int element_len) {
 }
 
 bool prepare_rsa_signature(const unsigned char *in, unsigned int in_len, unsigned char *out, unsigned int *out_len, int nid) {
-  X509_SIG digestInfo;
-  X509_ALGOR algor;
+  X509_SIG *digestInfo;
+  X509_ALGOR *algor;
   ASN1_TYPE parameter;
-  ASN1_OCTET_STRING digest;
+  ASN1_OCTET_STRING *digest;
   unsigned char data[1024];
 
   memcpy(data, in, in_len);
 
-  digestInfo.algor = &algor;
-  digestInfo.algor->algorithm = OBJ_nid2obj(nid);
-  digestInfo.algor->parameter = &parameter;
-  digestInfo.algor->parameter->type = V_ASN1_NULL;
-  digestInfo.algor->parameter->value.ptr = NULL;
-  digestInfo.digest = &digest;
-  digestInfo.digest->data = data;
-  digestInfo.digest->length = (int)in_len;
-  *out_len = (unsigned int)i2d_X509_SIG(&digestInfo, &out);
+  digestInfo = X509_SIG_new();
+  X509_SIG_getm(digestInfo, &algor, &digest);
+  algor = X509_ALGOR_new();
+  X509_ALGOR_set0(algor, OBJ_nid2obj(nid), V_ASN1_NULL, &parameter);
+  parameter.type = V_ASN1_NULL;
+  parameter.value.ptr = NULL;
+  digest->data = data;
+  digest->length = (int)in_len;
+  *out_len = (unsigned int)i2d_X509_SIG(digestInfo, &out);
   return true;
 }
 
@@ -637,7 +637,7 @@ int SSH_write_X509(FILE *fp, X509 *x) {
     return ret;
   }
 
-  switch (pkey->type) {
+  switch (EVP_PKEY_id(pkey)) {
   case EVP_PKEY_RSA:
   case EVP_PKEY_RSA2: {
     RSA *rsa;

tool/yubico-piv-tool.c

@@ -411,39 +411,43 @@ static bool import_key(ykpiv_state *state, enum enum_key_format key_format,
       unsigned char dmp1[128];
       unsigned char dmq1[128];
       unsigned char iqmp[128];
+      const BIGNUM *bn_e, *bn_p, *bn_q, *bn_dmp1, *bn_dmq1, *bn_iqmp;
 
       int element_len = 128;
       if(algorithm == YKPIV_ALGO_RSA1024) {
         element_len = 64;
       }
 
-      if((set_component(e, rsa_private_key->e, 3) == false) ||
+      RSA_get0_key(rsa_private_key, NULL, &bn_e, NULL);
+      RSA_get0_factors(rsa_private_key, &bn_p, &bn_q);
+      RSA_get0_crt_params(rsa_private_key, &bn_dmp1, &bn_dmq1, &bn_iqmp);
+      if((set_component(e, bn_e, 3) == false) ||
          !(e[0] == 0x01 && e[1] == 0x00 && e[2] == 0x01)) {
         fprintf(stderr, "Invalid public exponent for import (only 0x10001 supported)\n");
         goto import_out;
       }
 
-      if(set_component(p, rsa_private_key->p, element_len) == false) {
+      if(set_component(p, bn_p, element_len) == false) {
         fprintf(stderr, "Failed setting p component.\n");
         goto import_out;
       }
 
-      if(set_component(q, rsa_private_key->q, element_len) == false) {
+      if(set_component(q, bn_q, element_len) == false) {
         fprintf(stderr, "Failed setting q component.\n");
         goto import_out;
       }
 
-      if(set_component(dmp1, rsa_private_key->dmp1, element_len) == false) {
+      if(set_component(dmp1, bn_dmp1, element_len) == false) {
         fprintf(stderr, "Failed setting dmp1 component.\n");
         goto import_out;
       }
 
-      if(set_component(dmq1, rsa_private_key->dmq1, element_len) == false) {
+      if(set_component(dmq1, bn_dmq1, element_len) == false) {
         fprintf(stderr, "Failed setting dmq1 component.\n");
         goto import_out;
       }
 
-      if(set_component(iqmp, rsa_private_key->iqmp, element_len) == false) {
+      if(set_component(iqmp, bn_iqmp, element_len) == false) {
         fprintf(stderr, "Failed setting iqmp component.\n");
         goto import_out;
       }