[PATCH 2/5] lib/security: add in openssl support

[Samuel Mendoza-Jonas]

On Fri, 2018-05-04 at 11:40 +1000, Brett Grandbois wrote:
> Refactor to export a generic API rather than specific gpg_ prefixes by
> changing gpg.h to security.h and renaming some of the exports.
> 
> Break out the common and specific functionality into common.c and
> none.c/gpg.c/openssl.c for no/gpgme/openssl modes respectively.
> 
> gpgme should work as before
> 
> OpenSSL support works like this:
> 
> The pb-lockdown file is a PKCS12 file or X509 certificate or PEM-encoded
> raw public key.  To follow the current conventions the presence of a
> PKCS12 file as a lockdown signals decrypt mode because of the presence
> of the private key, anything else signals signature verification mode.
> The keyring path is currently ignored but in the future could be used to
> point to an X509 certificate chain for validity checking. Because of
> this self-signed certificates are currently supported and really just
> used as a public key container.
> 
> Signature verification mode supports:
> 
> * Cryptographic Message Syntax (CMS) as detached S/MIME, this is really
>   more for consistency for the encryption mode (see below). This mode
>   requires the lockdown file to be an X509 certificate.
> 
>   A sample creation command would be:
>     openssl cms -sign -in (infile) -out (outfile) -binary -nocerts \
>         -inkey (private key) -signer (recipient certificate)
> 
> * Raw signature digest as output from openssl dgst -sign command.  This
>   mode can have the lockdown file be an X509 certificate or a PEM raw
>   public key but the digest algorithm must be pre-defined by the
>   VERIFY_DIGEST configure argument. The default is SHA256.
> 
>   A sample creation command would be:
>     openssl dgst -sign (private key) -out (outfile) -(digest mode) \
>          (infile)
> 
> Decryption mode supports:
> 
> * CMS signed-envelope as attached S/MIME.  This is for consistency with
>   the current expectation of no external file for decryption.  Some
>   future enhancement could be to come up with some proprietary external
>   file format containing the cipher used, the encrypted cipher key, and
>   the IV (if necessary).
> 
>   A sample creation command would be:
>     openssl cms -sign -in (infile) -signer (recipient certificate) \
>         -binary -nocerts -nodetach -inkey (private key) | \
>         openssl cms -encrypt -(cipher mode) -out (outfile) \
>            (recipient certificate)
> 
> The PKCS12 file is expecting the private key to have password of NULL or
> "" as there is currently no mechanism to supply a custom one.
> 
> Signed-off-by: Brett Grandbois <brett.grandbois at opengear.com>
> ---
>  lib/Makefile.am         |  42 +++--
>  lib/security/common.c   | 230 ++++++++++++++++++++++++
>  lib/security/gpg.c      | 202 +--------------------
>  lib/security/gpg.h      |  83 ---------
>  lib/security/none.c     |  61 +++++++
>  lib/security/openssl.c  | 460 ++++++++++++++++++++++++++++++++++++++++++++++++
>  lib/security/security.h |  46 +++++
>  7 files changed, 833 insertions(+), 291 deletions(-)
>  create mode 100644 lib/security/common.c
>  delete mode 100644 lib/security/gpg.h
>  create mode 100644 lib/security/none.c
>  create mode 100644 lib/security/openssl.c
>  create mode 100644 lib/security/security.h

<snip>

> +int verify_file_signature(const char *plaintext_filename,
> +			  const char *signature_filename,
> +			  FILE *authorized_signatures_handle,
> +			  const char *keyring_path __attribute__((unused)))
> +{
> +	BIO *signature_bio = NULL, *plaintext_bio = NULL, *content_bio = NULL;
> +	STACK_OF(X509) *certs = NULL;
> +	CMS_ContentInfo *cms = NULL;
> +	ssize_t bytes_read = -1;
> +	EVP_PKEY *pkey = NULL;
> +	char *sigbuf = NULL;
> +	char rdbuf[8192];
> +	EVP_MD_CTX ctx;
> +	int nok = -1;
> +	int siglen;

My machine is running OpenSSL 1.1.0h and it complains here with:

	../lib/security/openssl.c: In function ‘verify_file_signature’:
	../lib/security/openssl.c:319:13: error: storage size of ‘ctx’ isn’t known
	  EVP_MD_CTX ctx;
		     ^~~
	../lib/security/openssl.c:425:2: warning: implicit declaration of function ‘EVP_MD_CTX_cleanup’; did you mean ‘EVP_MD_CTX_create’? [-Wimplicit-function-declaration]
	  EVP_MD_CTX_cleanup(&ctx);
	  ^~~~~~~~~~~~~~~~~~
	  EVP_MD_CTX_create
	../lib/security/openssl.c:319:13: warning: unused variable ‘ctx’ [-Wunused-variable]
	  EVP_MD_CTX ctx;
		     ^~~

It looks like in 1.1 they made this struct opaque and now we need to use
	ctx = EVP_MD_CTX_create();
and friends to set this up.

I'm not convinced older OpenSSL recognises the new format though - we might need
a wrapper to create the context depending on the library version :/

Otherwise everything else looks pretty good, fits in a lot cleaner than I expected!

Cheers,
Sam