diff --git a/.github/setup_ci.sh b/.github/setup_ci.sh index 6ab4e4fb5..2572a2882 100755 --- a/.github/setup_ci.sh +++ b/.github/setup_ci.sh @@ -156,10 +156,6 @@ for TARGET in $TARGETS; do tcmalloc) PACKAGES="$PACKAGES libgoogle-perftools-dev" ;; - openssl-noec) - INSTALL_OPENSSL=OpenSSL_1_1_1k - SSLCONFOPTS="no-ec" - ;; openssl-*) INSTALL_OPENSSL=$(echo ${TARGET} | cut -f2 -d-) case ${INSTALL_OPENSSL} in diff --git a/.github/workflows/c-cpp.yml b/.github/workflows/c-cpp.yml index ffead602f..119cdcc17 100644 --- a/.github/workflows/c-cpp.yml +++ b/.github/workflows/c-cpp.yml @@ -86,7 +86,6 @@ jobs: - { target: ubuntu-latest, config: libressl-4.2.0 } - { target: ubuntu-latest, config: libressl-4.3.2 } - { target: ubuntu-latest, config: openssl-master } - - { target: ubuntu-latest, config: openssl-noec } - { target: ubuntu-latest, config: openssl-1.1.1 } - { target: ubuntu-latest, config: openssl-1.1.1t } - { target: ubuntu-latest, config: openssl-1.1.1w } diff --git a/configure.ac b/configure.ac index a4d544cc5..d1f64cd62 100644 --- a/configure.ac +++ b/configure.ac @@ -3365,11 +3365,9 @@ if test "x$openssl" = "xyes" ; then if test x$enable_nistp256 = x1 || test x$enable_nistp384 = x1 || \ test x$enable_nistp521 = x1; then - AC_DEFINE(OPENSSL_HAS_ECC, [1], [OpenSSL has ECC]) AC_CHECK_FUNCS([EC_KEY_METHOD_new]) - openssl_ecc=yes else - openssl_ecc=no + AC_MSG_ERROR([libcrypto does not have required ECC support]) fi if test x$enable_nistp256 = x1; then AC_DEFINE([OPENSSL_HAS_NISTP256], [1], diff --git a/kex-names.c b/kex-names.c index 684e27e78..f9ba49b7f 100644 --- a/kex-names.c +++ b/kex-names.c @@ -58,10 +58,9 @@ static const struct kexalg kexalgs[] = { { KEX_DH16_SHA512, KEX_DH_GRP16_SHA512, 0, SSH_DIGEST_SHA512, KEX_NOT_PQ }, { KEX_DH18_SHA512, KEX_DH_GRP18_SHA512, 0, SSH_DIGEST_SHA512, KEX_NOT_PQ }, { KEX_DHGEX_SHA1, KEX_DH_GEX_SHA1, 0, SSH_DIGEST_SHA1, KEX_NOT_PQ }, -#ifdef HAVE_EVP_SHA256 +# ifdef HAVE_EVP_SHA256 { KEX_DHGEX_SHA256, KEX_DH_GEX_SHA256, 0, SSH_DIGEST_SHA256, KEX_NOT_PQ }, -#endif /* HAVE_EVP_SHA256 */ -#ifdef OPENSSL_HAS_ECC +# endif /* HAVE_EVP_SHA256 */ { KEX_ECDH_SHA2_NISTP256, KEX_ECDH_SHA2, NID_X9_62_prime256v1, SSH_DIGEST_SHA256, KEX_NOT_PQ }, { KEX_ECDH_SHA2_NISTP384, KEX_ECDH_SHA2, NID_secp384r1, @@ -72,11 +71,10 @@ static const struct kexalg kexalgs[] = { # endif /* OPENSSL_HAS_NISTP521 */ { KEX_MLKEM768NISTP256_SHA256, KEX_KEM_MLKEM768ECDH_SHA256, NID_X9_62_prime256v1, SSH_DIGEST_SHA256, KEX_IS_PQ }, -# ifdef NID_brainpoolP256r1 +# ifdef NID_brainpoolP256r1 { KEX_MLKEM768BRAINPOOLP256R1_SHA256, KEX_KEM_MLKEM768ECDH_SHA256, NID_brainpoolP256r1, SSH_DIGEST_SHA256, KEX_IS_PQ }, -# endif /* NID_brainpoolP256r1 */ -#endif /* OPENSSL_HAS_ECC */ +# endif /* NID_brainpoolP256r1 */ #endif /* WITH_OPENSSL */ #if defined(HAVE_EVP_SHA256) || !defined(WITH_OPENSSL) { KEX_CURVE25519_SHA256, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256, KEX_NOT_PQ }, diff --git a/kex.c b/kex.c index 11b271d47..b2c3d9720 100644 --- a/kex.c +++ b/kex.c @@ -732,9 +732,7 @@ kex_free(struct kex *kex) #ifdef WITH_OPENSSL DH_free(kex->dh); -#ifdef OPENSSL_HAS_ECC EC_KEY_free(kex->ec_client_key); -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ for (mode = 0; mode < MODE_MAX; mode++) { kex_free_newkeys(kex->newkeys[mode]); diff --git a/kex.h b/kex.h index 1bd0b6224..373325686 100644 --- a/kex.h +++ b/kex.h @@ -30,22 +30,15 @@ #include "crypto_api.h" #ifdef WITH_OPENSSL -# include -# include -# include -# ifdef OPENSSL_HAS_ECC -# include -# else /* OPENSSL_HAS_ECC */ -# define EC_KEY void -# define EC_GROUP void -# define EC_POINT void -# endif /* OPENSSL_HAS_ECC */ -#else /* WITH_OPENSSL */ -# define DH void -# define BIGNUM void -# define EC_KEY void -# define EC_GROUP void -# define EC_POINT void +#include +#include +#include +#include +#else /* OPENSSL */ +#define BIGNUM void +#define DH void +#define EC_KEY void +#define EC_GROUP void #endif /* WITH_OPENSSL */ #define KEX_COOKIE_LEN 16 @@ -299,10 +292,4 @@ int kexc25519_shared_key_ext(const u_char key[CURVE25519_SIZE], void dump_digest(const char *, const u_char *, int); #endif -#if !defined(WITH_OPENSSL) || !defined(OPENSSL_HAS_ECC) -# undef EC_KEY -# undef EC_GROUP -# undef EC_POINT -#endif - #endif diff --git a/kexecdh.c b/kexecdh.c index beded1255..f1a0b4765 100644 --- a/kexecdh.c +++ b/kexecdh.c @@ -26,7 +26,7 @@ #include "includes.h" -#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) +#if defined(WITH_OPENSSL) #include @@ -204,31 +204,4 @@ kex_ecdh_dec(struct kex *kex, const struct sshbuf *server_blob, return r; } -#else - -#include "ssherr.h" - -struct kex; -struct sshbuf; -struct sshkey; - -int -kex_ecdh_keypair(struct kex *kex) -{ - return SSH_ERR_SIGN_ALG_UNSUPPORTED; -} - -int -kex_ecdh_enc(struct kex *kex, const struct sshbuf *client_blob, - struct sshbuf **server_blobp, struct sshbuf **shared_secretp) -{ - return SSH_ERR_SIGN_ALG_UNSUPPORTED; -} - -int -kex_ecdh_dec(struct kex *kex, const struct sshbuf *server_blob, - struct sshbuf **shared_secretp) -{ - return SSH_ERR_SIGN_ALG_UNSUPPORTED; -} -#endif /* defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) */ +#endif /* WITH_OPENSSL */ diff --git a/monitor.c b/monitor.c index 013deae5f..149671145 100644 --- a/monitor.c +++ b/monitor.c @@ -1874,11 +1874,9 @@ monitor_apply_keystate(struct ssh *ssh, struct monitor *pmonitor) kex->kex[KEX_DH_GRP18_SHA512] = kex_gen_server; kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; kex->kex[KEX_DH_GEX_SHA256] = kexgex_server; -# ifdef OPENSSL_HAS_ECC kex->kex[KEX_ECDH_SHA2] = kex_gen_server; kex->kex[KEX_KEM_MLKEM768ECDH_SHA256] = kex_gen_server; -# endif -#endif /* WITH_OPENSSL */ +#endif kex->kex[KEX_C25519_SHA256] = kex_gen_server; kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server; kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_server; diff --git a/openbsd-compat/openssl-compat.h b/openbsd-compat/openssl-compat.h index 42e2e2833..0dc0794d5 100644 --- a/openbsd-compat/openssl-compat.h +++ b/openbsd-compat/openssl-compat.h @@ -25,9 +25,7 @@ #include #include #include -#ifdef OPENSSL_HAS_ECC #include -#endif #include int ssh_compatible_openssl(long, long); diff --git a/packet.c b/packet.c index 7c8589728..63dcb5351 100644 --- a/packet.c +++ b/packet.c @@ -67,9 +67,7 @@ #ifdef WITH_OPENSSL # include # include -# ifdef OPENSSL_HAS_ECC -# include -# endif +# include #endif #ifdef WITH_ZLIB @@ -2746,7 +2744,6 @@ sshpkt_put_stringb(struct ssh *ssh, const struct sshbuf *v) } #ifdef WITH_OPENSSL -#ifdef OPENSSL_HAS_ECC int sshpkt_put_ec(struct ssh *ssh, const EC_POINT *v, const EC_GROUP *g) { @@ -2758,7 +2755,6 @@ sshpkt_put_ec_pkey(struct ssh *ssh, EVP_PKEY *pkey) { return sshbuf_put_ec_pkey(ssh->state->outgoing_packet, pkey); } -#endif /* OPENSSL_HAS_ECC */ int sshpkt_put_bignum2(struct ssh *ssh, const BIGNUM *v) @@ -2824,13 +2820,11 @@ sshpkt_getb_froms(struct ssh *ssh, struct sshbuf **valp) } #ifdef WITH_OPENSSL -#ifdef OPENSSL_HAS_ECC int sshpkt_get_ec(struct ssh *ssh, EC_POINT *v, const EC_GROUP *g) { return sshbuf_get_ec(ssh->state->incoming_packet, v, g); } -#endif /* OPENSSL_HAS_ECC */ int sshpkt_get_bignum2(struct ssh *ssh, BIGNUM **valp) diff --git a/packet.h b/packet.h index 3e8acb2cd..442e38bb7 100644 --- a/packet.h +++ b/packet.h @@ -23,21 +23,15 @@ #include #ifdef WITH_OPENSSL -# include -# include -# ifdef OPENSSL_HAS_ECC -# include -# else /* OPENSSL_HAS_ECC */ -# define EC_KEY void -# define EC_GROUP void -# define EC_POINT void -# endif /* OPENSSL_HAS_ECC */ -#else /* WITH_OPENSSL */ -# define BIGNUM void -# define EC_KEY void -# define EC_GROUP void -# define EC_POINT void -# define EVP_PKEY void +#include +#include +#include +#include +#else /* OPENSSL */ +#define BIGNUM void +#define EC_GROUP void +#define EC_POINT void +#define EVP_PKEY void #endif /* WITH_OPENSSL */ struct kex; @@ -213,16 +207,4 @@ void sshpkt_fmt_connection_id(struct ssh *ssh, char *s, size_t l); const u_char *sshpkt_ptr(struct ssh *, size_t *lenp); char *connection_info_message(struct ssh *ssh); -#if !defined(WITH_OPENSSL) -# undef BIGNUM -# undef EC_KEY -# undef EC_GROUP -# undef EC_POINT -# undef EVP_PKEY -#elif !defined(OPENSSL_HAS_ECC) -# undef EC_KEY -# undef EC_GROUP -# undef EC_POINT -#endif - #endif /* PACKET_H */ diff --git a/readconf.c b/readconf.c index ecabd8389..bc48b4f55 100644 --- a/readconf.c +++ b/readconf.c @@ -2917,11 +2917,9 @@ fill_default_options(Options * options) } if (options->num_identity_files == 0) { add_identity_file(options, "~/", _PATH_SSH_CLIENT_ID_RSA, 0); -#ifdef OPENSSL_HAS_ECC add_identity_file(options, "~/", _PATH_SSH_CLIENT_ID_ECDSA, 0); add_identity_file(options, "~/", _PATH_SSH_CLIENT_ID_ECDSA_SK, 0); -#endif add_identity_file(options, "~/", _PATH_SSH_CLIENT_ID_ED25519, 0); add_identity_file(options, "~/", diff --git a/regress/misc/sk-dummy/sk-dummy.c b/regress/misc/sk-dummy/sk-dummy.c index 4c96e8827..cbbba7459 100644 --- a/regress/misc/sk-dummy/sk-dummy.c +++ b/regress/misc/sk-dummy/sk-dummy.c @@ -89,7 +89,7 @@ sk_api_version(void) static int pack_key_ecdsa(struct sk_enroll_response *response) { -#ifdef OPENSSL_HAS_ECC +#ifdef WITH_OPENSSL EC_KEY *key = NULL; const EC_GROUP *g; const EC_POINT *q; @@ -309,7 +309,7 @@ sig_ecdsa(const uint8_t *message, size_t message_len, const uint8_t *key_handle, size_t key_handle_len, struct sk_sign_response *response) { -#ifdef OPENSSL_HAS_ECC +#ifdef WITH_OPENSSL ECDSA_SIG *sig = NULL; const BIGNUM *sig_r, *sig_s; int ret = -1; diff --git a/regress/unittests/bitmap/tests.c b/regress/unittests/bitmap/tests.c index 6470f983d..e3bffadea 100644 --- a/regress/unittests/bitmap/tests.c +++ b/regress/unittests/bitmap/tests.c @@ -138,9 +138,9 @@ tests(void) TEST_DONE(); #endif } + void benchmarks(void) { printf("no benchmarks\n"); } - diff --git a/regress/unittests/conversion/tests.c b/regress/unittests/conversion/tests.c index fce4d1ca7..1c620e02d 100644 --- a/regress/unittests/conversion/tests.c +++ b/regress/unittests/conversion/tests.c @@ -11,6 +11,7 @@ #include #include #include +#include #include #include "../test_helper/test_helper.h" diff --git a/regress/unittests/hostkeys/test_iterate.c b/regress/unittests/hostkeys/test_iterate.c index a330adce5..6281e30df 100644 --- a/regress/unittests/hostkeys/test_iterate.c +++ b/regress/unittests/hostkeys/test_iterate.c @@ -87,11 +87,6 @@ check(struct hostkey_foreach_line *l, void *_ctx) expected_keytype = (parse_key || expected->no_parse_keytype < 0) ? expected->l.keytype : expected->no_parse_keytype; -#ifndef OPENSSL_HAS_ECC - if (expected->l.keytype == KEY_ECDSA || - expected->no_parse_keytype == KEY_ECDSA) - skip = 1; -#endif /* OPENSSL_HAS_ECC */ #ifndef WITH_OPENSSL if (expected->l.keytype == KEY_RSA || expected->no_parse_keytype == KEY_RSA || @@ -147,10 +142,6 @@ prepare_expected(struct expected *expected, size_t n) for (i = 0; i < n; i++) { if (expected[i].key_file == NULL) continue; -#ifndef OPENSSL_HAS_ECC - if (expected[i].l.keytype == KEY_ECDSA) - continue; -#endif /* OPENSSL_HAS_ECC */ #ifndef WITH_OPENSSL switch (expected[i].l.keytype) { case KEY_RSA: diff --git a/regress/unittests/kex/test_kex.c b/regress/unittests/kex/test_kex.c index 16c2f2dff..89376f115 100644 --- a/regress/unittests/kex/test_kex.c +++ b/regress/unittests/kex/test_kex.c @@ -158,14 +158,12 @@ do_kex_with_key(char *kex, char *cipher, char *mac, #ifdef WITH_OPENSSL server2->kex->kex[KEX_DH_GRP1_SHA1] = kex_gen_server; server2->kex->kex[KEX_DH_GRP14_SHA1] = kex_gen_server; - server2->kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; - server2->kex->kex[KEX_DH_GEX_SHA256] = kexgex_server; server2->kex->kex[KEX_DH_GRP14_SHA256] = kex_gen_server; server2->kex->kex[KEX_DH_GRP16_SHA512] = kex_gen_server; server2->kex->kex[KEX_DH_GRP18_SHA512] = kex_gen_server; -#ifdef OPENSSL_HAS_ECC + server2->kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; + server2->kex->kex[KEX_DH_GEX_SHA256] = kexgex_server; server2->kex->kex[KEX_ECDH_SHA2] = kex_gen_server; -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ server2->kex->kex[KEX_C25519_SHA256] = kex_gen_server; server2->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server; @@ -183,9 +181,9 @@ do_kex_with_key(char *kex, char *cipher, char *mac, TEST_DONE(); TEST_START("cleanup"); + sshkey_free(public); if (key == NULL) sshkey_free(private); - sshkey_free(public); ssh_free(client); ssh_free(server); ssh_free(server2); @@ -219,9 +217,7 @@ do_kex(char *kex) #ifdef WITH_OPENSSL do_kex_with_key(kex, NULL, NULL, NULL, KEY_RSA, 2048); -# ifdef OPENSSL_HAS_ECC do_kex_with_key(kex, NULL, NULL, NULL, KEY_ECDSA, 256); -# endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ do_kex_with_key(kex, NULL, NULL, NULL, KEY_ED25519, 256); } @@ -231,11 +227,9 @@ kex_tests(void) { do_kex("curve25519-sha256"); #ifdef WITH_OPENSSL -#ifdef OPENSSL_HAS_ECC do_kex("ecdh-sha2-nistp256"); do_kex("ecdh-sha2-nistp384"); do_kex("ecdh-sha2-nistp521"); -#endif /* OPENSSL_HAS_ECC */ do_kex("diffie-hellman-group-exchange-sha256"); do_kex("diffie-hellman-group-exchange-sha1"); do_kex("diffie-hellman-group14-sha1"); diff --git a/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c b/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c index 1d83ffd88..1ce2041c9 100644 --- a/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c +++ b/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c @@ -16,10 +16,8 @@ #include #include +#include #include -#ifdef OPENSSL_HAS_NISTP256 -# include -#endif #include "openbsd-compat/openssl-compat.h" #include "../test_helper/test_helper.h" @@ -45,7 +43,7 @@ sshbuf_getput_crypto_tests(void) 0x70, 0x60, 0x50, 0x40, 0x30, 0x20, 0x10, 0x00, 0x7f, 0xff, 0x11 }; -#if defined(OPENSSL_HAS_ECC) && defined(OPENSSL_HAS_NISTP256) +#if defined(OPENSSL_HAS_NISTP256) const u_char *d; size_t s; BIGNUM *bn_x, *bn_y; @@ -221,7 +219,7 @@ sshbuf_getput_crypto_tests(void) sshbuf_free(p1); TEST_DONE(); -#if defined(OPENSSL_HAS_ECC) && defined(OPENSSL_HAS_NISTP256) +#if defined(OPENSSL_HAS_NISTP256) TEST_START("sshbuf_put_ec"); eck = EC_KEY_new_by_curve_name(ec256_nid); ASSERT_PTR_NE(eck, NULL); diff --git a/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c b/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c index 7b2ffced3..5c53529df 100644 --- a/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c +++ b/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c @@ -33,9 +33,9 @@ attempt_parse_blob(u_char *blob, size_t len) struct sshbuf *p1; #ifdef WITH_OPENSSL BIGNUM *bn; -#if defined(OPENSSL_HAS_ECC) && defined(OPENSSL_HAS_NISTP256) +#if defined(OPENSSL_HAS_NISTP256) EC_KEY *eck; -#endif /* defined(OPENSSL_HAS_ECC) && defined(OPENSSL_HAS_NISTP256) */ +#endif /* defined(OPENSSL_HAS_NISTP256) */ #endif /* WITH_OPENSSL */ u_char *s; size_t l; @@ -59,12 +59,12 @@ attempt_parse_blob(u_char *blob, size_t len) bn = NULL; ASSERT_INT_EQ(sshbuf_get_bignum2(p1, &bn), 0); BN_clear_free(bn); -#if defined(OPENSSL_HAS_ECC) && defined(OPENSSL_HAS_NISTP256) +# if defined(OPENSSL_HAS_NISTP256) eck = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); ASSERT_PTR_NE(eck, NULL); ASSERT_INT_EQ(sshbuf_get_eckey(p1, eck), 0); EC_KEY_free(eck); -#endif /* defined(OPENSSL_HAS_ECC) && defined(OPENSSL_HAS_NISTP256) */ +# endif /* defined(OPENSSL_HAS_NISTP256) */ #endif /* WITH_OPENSSL */ sshbuf_free(p1); } diff --git a/regress/unittests/sshkey/test_file.c b/regress/unittests/sshkey/test_file.c index 296e90e78..f8fcc3abd 100644 --- a/regress/unittests/sshkey/test_file.c +++ b/regress/unittests/sshkey/test_file.c @@ -18,11 +18,9 @@ #ifdef WITH_OPENSSL #include +#include #include #include -#ifdef OPENSSL_HAS_NISTP256 -# include -#endif /* OPENSSL_HAS_NISTP256 */ #endif /* WITH_OPENSSL */ #include "../test_helper/test_helper.h" @@ -162,7 +160,7 @@ sshkey_file_tests(void) sshkey_free(k1); -#ifdef OPENSSL_HAS_ECC + TEST_START("parse ECDSA from private"); buf = load_file("ecdsa_1"); ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0); @@ -262,7 +260,6 @@ sshkey_file_tests(void) TEST_DONE(); sshkey_free(k1); -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ TEST_START("parse Ed25519 from private"); @@ -396,7 +393,7 @@ sshkey_file_tests(void) sshkey_free(k1); #ifdef ENABLE_SK -#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) +#if defined(WITH_OPENSSL) TEST_START("parse ECDSA-SK from private"); buf = load_file("ecdsa_sk1"); ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0); diff --git a/regress/unittests/sshkey/test_fuzz.c b/regress/unittests/sshkey/test_fuzz.c index fb178c1e4..0e5bdf748 100644 --- a/regress/unittests/sshkey/test_fuzz.c +++ b/regress/unittests/sshkey/test_fuzz.c @@ -18,11 +18,9 @@ #ifdef WITH_OPENSSL #include +#include #include #include -#ifdef OPENSSL_HAS_NISTP256 -# include -#endif #endif #include "../test_helper/test_helper.h" @@ -160,7 +158,7 @@ sshkey_fuzz_tests(void) fuzz_cleanup(fuzz); TEST_DONE(); -#ifdef OPENSSL_HAS_ECC + TEST_START("fuzz ECDSA private"); buf = load_file("ecdsa_1"); fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf), @@ -204,7 +202,6 @@ sshkey_fuzz_tests(void) sshbuf_free(fuzzed); fuzz_cleanup(fuzz); TEST_DONE(); -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ TEST_START("fuzz Ed25519 private"); @@ -270,7 +267,7 @@ sshkey_fuzz_tests(void) sshkey_free(k1); TEST_DONE(); -#ifdef OPENSSL_HAS_ECC + TEST_START("fuzz ECDSA public"); buf = load_file("ecdsa_1"); ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0); @@ -284,7 +281,6 @@ sshkey_fuzz_tests(void) public_fuzz(k1); sshkey_free(k1); TEST_DONE(); -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ TEST_START("fuzz Ed25519 public"); @@ -341,7 +337,7 @@ sshkey_fuzz_tests(void) sshkey_free(k1); TEST_DONE(); -#ifdef OPENSSL_HAS_ECC + TEST_START("fuzz ECDSA sig"); buf = load_file("ecdsa_1"); ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0); @@ -349,7 +345,6 @@ sshkey_fuzz_tests(void) sig_fuzz(k1, NULL); sshkey_free(k1); TEST_DONE(); -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ TEST_START("fuzz Ed25519 sig"); diff --git a/regress/unittests/sshkey/test_sshkey.c b/regress/unittests/sshkey/test_sshkey.c index ec0ce452c..59efbb28e 100644 --- a/regress/unittests/sshkey/test_sshkey.c +++ b/regress/unittests/sshkey/test_sshkey.c @@ -15,10 +15,8 @@ #ifdef WITH_OPENSSL #include +#include #include -#if defined(OPENSSL_HAS_ECC) && defined(OPENSSL_HAS_NISTP256) -# include -#endif #endif #include "../test_helper/test_helper.h" @@ -240,13 +238,8 @@ get_private(const char *n) void sshkey_tests(void) { - struct sshkey *k1 = NULL, *k2 = NULL, *k3 = NULL, *kf = NULL; -#ifdef WITH_OPENSSL - struct sshkey *k4 = NULL, *kr = NULL, *kd = NULL; -#ifdef OPENSSL_HAS_ECC - struct sshkey *ke = NULL; -#endif /* OPENSSL_HAS_ECC */ -#endif /* WITH_OPENSSL */ + struct sshkey *k1 = NULL, *k2 = NULL, *k3 = NULL, *k4 = NULL; + struct sshkey *kr = NULL, *kd = NULL, *ke = NULL, *kf = NULL; struct sshbuf *b = NULL; TEST_START("new invalid"); @@ -270,8 +263,6 @@ sshkey_tests(void) k1 = NULL; TEST_DONE(); - -#ifdef OPENSSL_HAS_ECC TEST_START("new/free KEY_ECDSA"); k1 = sshkey_new(KEY_ECDSA); ASSERT_PTR_NE(k1, NULL); @@ -279,7 +270,7 @@ sshkey_tests(void) sshkey_free(k1); k1 = NULL; TEST_DONE(); -#endif +#endif /* WITH_OPENSSL */ TEST_START("new/free KEY_ED25519"); k1 = sshkey_new(KEY_ED25519); @@ -300,6 +291,7 @@ sshkey_tests(void) k1 = NULL; TEST_DONE(); +#ifdef WITH_OPENSSL TEST_START("generate KEY_RSA too small modulus"); ASSERT_INT_EQ(sshkey_generate(KEY_RSA, 128, &k1), SSH_ERR_KEY_LENGTH); @@ -313,7 +305,6 @@ sshkey_tests(void) TEST_DONE(); -#ifdef OPENSSL_HAS_ECC TEST_START("generate KEY_ECDSA wrong bits"); ASSERT_INT_EQ(sshkey_generate(KEY_ECDSA, 42, &k1), SSH_ERR_KEY_LENGTH); @@ -321,7 +312,6 @@ sshkey_tests(void) sshkey_free(k1); k1 = NULL; TEST_DONE(); -#endif TEST_START("generate KEY_RSA"); ASSERT_INT_EQ(sshkey_generate(KEY_RSA, 767, &kr), @@ -336,7 +326,6 @@ sshkey_tests(void) TEST_DONE(); -#ifdef OPENSSL_HAS_ECC TEST_START("generate KEY_ECDSA"); ASSERT_INT_EQ(sshkey_generate(KEY_ECDSA, 256, &ke), 0); ASSERT_PTR_NE(ke, NULL); @@ -346,7 +335,6 @@ sshkey_tests(void) ASSERT_PTR_NE(EC_KEY_get0_private_key(EVP_PKEY_get0_EC_KEY(ke->pkey)), NULL); TEST_DONE(); -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ TEST_START("generate KEY_ED25519"); @@ -386,7 +374,6 @@ sshkey_tests(void) TEST_DONE(); -#ifdef OPENSSL_HAS_ECC TEST_START("demote KEY_ECDSA"); ASSERT_INT_EQ(sshkey_from_private(ke, &k1), 0); ASSERT_PTR_NE(k1, NULL); @@ -405,7 +392,6 @@ sshkey_tests(void) sshkey_free(k1); k1 = NULL; TEST_DONE(); -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ TEST_START("demote KEY_ED25519"); @@ -443,28 +429,21 @@ sshkey_tests(void) #ifdef WITH_OPENSSL TEST_START("equal mismatched key types"); ASSERT_INT_EQ(sshkey_equal(kd, kr), 0); -#ifdef OPENSSL_HAS_ECC ASSERT_INT_EQ(sshkey_equal(kd, ke), 0); ASSERT_INT_EQ(sshkey_equal(kr, ke), 0); ASSERT_INT_EQ(sshkey_equal(ke, kf), 0); -#endif /* OPENSSL_HAS_ECC */ ASSERT_INT_EQ(sshkey_equal(kd, kf), 0); TEST_DONE(); -#endif /* WITH_OPENSSL */ TEST_START("equal different keys"); -#ifdef WITH_OPENSSL ASSERT_INT_EQ(sshkey_generate(KEY_RSA, 1024, &k1), 0); ASSERT_INT_EQ(sshkey_equal(kr, k1), 0); sshkey_free(k1); k1 = NULL; -#ifdef OPENSSL_HAS_ECC ASSERT_INT_EQ(sshkey_generate(KEY_ECDSA, 256, &k1), 0); ASSERT_INT_EQ(sshkey_equal(ke, k1), 0); sshkey_free(k1); k1 = NULL; -#endif /* OPENSSL_HAS_ECC */ -#endif /* WITH_OPENSSL */ ASSERT_INT_EQ(sshkey_generate(KEY_ED25519, 256, &k1), 0); ASSERT_INT_EQ(sshkey_equal(kf, k1), 0); sshkey_free(k1); @@ -476,15 +455,13 @@ sshkey_tests(void) sshkey_free(k2); k1 = k2 = NULL; TEST_DONE(); +#endif /* WITH_OPENSSL */ -#ifdef WITH_OPENSSL sshkey_free(kr); sshkey_free(kd); -#ifdef OPENSSL_HAS_ECC sshkey_free(ke); -#endif /* OPENSSL_HAS_ECC */ -#endif /* WITH_OPENSSL */ sshkey_free(kf); + kr = kd = ke = kf = NULL; TEST_START("certify key"); ASSERT_INT_EQ(sshkey_load_public(test_data_file("ed25519_1.pub"), @@ -611,7 +588,6 @@ sshkey_tests(void) TEST_DONE(); -#ifdef OPENSSL_HAS_ECC TEST_START("sign and verify ECDSA"); k1 = get_private("ecdsa_1"); ASSERT_INT_EQ(sshkey_load_public(test_data_file("ecdsa_2.pub"), &k2, @@ -621,7 +597,6 @@ sshkey_tests(void) sshkey_free(k2); k1 = k2 = NULL; TEST_DONE(); -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ TEST_START("sign and verify ED25519"); diff --git a/regress/unittests/sshsig/tests.c b/regress/unittests/sshsig/tests.c index 68e893147..fa3013533 100644 --- a/regress/unittests/sshsig/tests.c +++ b/regress/unittests/sshsig/tests.c @@ -103,11 +103,9 @@ tests(void) TEST_DONE(); -#ifdef OPENSSL_HAS_ECC TEST_START("check ECDSA signature"); check_sig("ecdsa.pub", "ecdsa.sig", msg, namespace); TEST_DONE(); -#endif #endif TEST_START("check ED25519 signature"); @@ -119,7 +117,7 @@ tests(void) TEST_DONE(); #ifdef ENABLE_SK -#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) +#if defined(WITH_OPENSSL) TEST_START("check ECDSA-SK signature"); check_sig("ecdsa_sk.pub", "ecdsa_sk.sig", msg, namespace); TEST_DONE(); @@ -129,11 +127,11 @@ tests(void) check_sig("ed25519_sk.pub", "ed25519_sk.sig", msg, namespace); TEST_DONE(); -#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) +#if defined(WITH_OPENSSL) TEST_START("check ECDSA-SK webauthn signature"); check_sig("ecdsa_sk_webauthn.pub", "ecdsa_sk_webauthn.sig", msg, namespace); - TEST_DONE(); + TEST_DONE(); #endif #endif /* ENABLE_SK */ diff --git a/regress/unittests/test_helper/test_helper.c b/regress/unittests/test_helper/test_helper.c index a2cb02d83..898732d38 100644 --- a/regress/unittests/test_helper/test_helper.c +++ b/regress/unittests/test_helper/test_helper.c @@ -22,7 +22,7 @@ #include #include #include - + #include #include #include @@ -59,7 +59,7 @@ #define BENCH_COLUMN_WIDTH 40 #define MINIMUM(a, b) (((a) < (b)) ? (a) : (b)) - + #define TEST_CHECK_INT(r, pred) do { \ switch (pred) { \ case TEST_EQ: \ diff --git a/servconf.c b/servconf.c index 41d442907..ac0c31d95 100644 --- a/servconf.c +++ b/servconf.c @@ -313,10 +313,8 @@ fill_default_server_options(ServerOptions *options) /* fill default hostkeys */ servconf_add_hostkey("[default]", 0, options, _PATH_HOST_RSA_KEY_FILE, 0); -#ifdef OPENSSL_HAS_ECC servconf_add_hostkey("[default]", 0, options, _PATH_HOST_ECDSA_KEY_FILE, 0); -#endif servconf_add_hostkey("[default]", 0, options, _PATH_HOST_ED25519_KEY_FILE, 0); servconf_add_hostkey("[default]", 0, options, diff --git a/sk-usbhid.c b/sk-usbhid.c index ce59c4e93..647f88f61 100644 --- a/sk-usbhid.c +++ b/sk-usbhid.c @@ -31,15 +31,6 @@ #include #endif -/* - * Almost every use of OpenSSL in this file is for ECDSA-NISTP256. - * This is strictly a larger hammer than necessary, but it reduces changes - * with upstream. - */ -#ifndef OPENSSL_HAS_ECC -# undef WITH_OPENSSL -#endif - #ifdef WITH_OPENSSL #include #include diff --git a/ssh-add.c b/ssh-add.c index f2055df36..9231c5277 100644 --- a/ssh-add.c +++ b/ssh-add.c @@ -80,10 +80,8 @@ extern char *__progname; static char *default_files[] = { #ifdef WITH_OPENSSL _PATH_SSH_CLIENT_ID_RSA, -#ifdef OPENSSL_HAS_ECC _PATH_SSH_CLIENT_ID_ECDSA, _PATH_SSH_CLIENT_ID_ECDSA_SK, -#endif #endif /* WITH_OPENSSL */ _PATH_SSH_CLIENT_ID_ED25519, _PATH_SSH_CLIENT_ID_ED25519_SK, diff --git a/ssh-ecdsa-sk.c b/ssh-ecdsa-sk.c index eb5c8bc1e..ad8afd079 100644 --- a/ssh-ecdsa-sk.c +++ b/ssh-ecdsa-sk.c @@ -32,35 +32,21 @@ #include #ifdef WITH_OPENSSL +#include "openbsd-compat/openssl-compat.h" #include #include #include #include -#endif #include #include /* needed for DEBUG_SK only */ -#include "openbsd-compat/openssl-compat.h" - #include "sshbuf.h" #include "ssherr.h" #include "digest.h" #define SSHKEY_INTERNAL #include "sshkey.h" -#ifndef OPENSSL_HAS_ECC -/* ARGSUSED */ -int -ssh_ecdsa_sk_verify(const struct sshkey *key, - const u_char *signature, size_t signaturelen, - const u_char *data, size_t datalen, u_int compat, - struct sshkey_sig_details **detailsp) -{ - return SSH_ERR_FEATURE_UNSUPPORTED; -} -#else /* OPENSSL_HAS_ECC */ - /* Reuse some ECDSA internals */ extern struct sshkey_impl_funcs sshkey_ecdsa_funcs; @@ -502,5 +488,4 @@ const struct sshkey_impl sshkey_ecdsa_sk_webauthn_cert_impl = { /* .keybits = */ 256, /* .funcs = */ &sshkey_ecdsa_sk_funcs, }; - -#endif /* OPENSSL_HAS_ECC */ +#endif /* WITH_OPENSSL */ diff --git a/ssh-ecdsa.c b/ssh-ecdsa.c index 526ae7454..488db9c2a 100644 --- a/ssh-ecdsa.c +++ b/ssh-ecdsa.c @@ -26,7 +26,7 @@ #include "includes.h" -#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) +#if defined(WITH_OPENSSL) #include "openbsd-compat/openssl-compat.h" #include @@ -582,4 +582,4 @@ const struct sshkey_impl sshkey_ecdsa_nistp521_cert_impl = { }; #endif -#endif /* WITH_OPENSSL && OPENSSL_HAS_ECC */ +#endif /* WITH_OPENSSL */ diff --git a/ssh-keygen.c b/ssh-keygen.c index a62e5dc4a..fef27300e 100644 --- a/ssh-keygen.c +++ b/ssh-keygen.c @@ -251,7 +251,6 @@ ask_filename(struct passwd *pw, const char *prompt) name = _PATH_SSH_CLIENT_ID_ED25519; else { switch (sshkey_type_from_shortname(key_type_name)) { -#ifdef OPENSSL_HAS_ECC case KEY_ECDSA_CERT: case KEY_ECDSA: name = _PATH_SSH_CLIENT_ID_ECDSA; @@ -260,7 +259,6 @@ ask_filename(struct passwd *pw, const char *prompt) case KEY_ECDSA_SK: name = _PATH_SSH_CLIENT_ID_ECDSA_SK; break; -#endif case KEY_RSA_CERT: case KEY_RSA: name = _PATH_SSH_CLIENT_ID_RSA; @@ -364,13 +362,11 @@ do_convert_to_pkcs8(struct sshkey *k) EVP_PKEY_get0_RSA(k->pkey))) fatal("PEM_write_RSA_PUBKEY failed"); break; -#ifdef OPENSSL_HAS_ECC case KEY_ECDSA: if (!PEM_write_EC_PUBKEY(stdout, EVP_PKEY_get0_EC_KEY(k->pkey))) fatal("PEM_write_EC_PUBKEY failed"); break; -#endif default: fatal_f("unsupported key type %s", sshkey_type(k)); } @@ -385,13 +381,11 @@ do_convert_to_pem(struct sshkey *k) EVP_PKEY_get0_RSA(k->pkey))) fatal("PEM_write_RSAPublicKey failed"); break; -#ifdef OPENSSL_HAS_ECC case KEY_ECDSA: if (!PEM_write_EC_PUBKEY(stdout, EVP_PKEY_get0_EC_KEY(k->pkey))) fatal("PEM_write_EC_PUBKEY failed"); break; -#endif default: fatal_f("unsupported key type %s", sshkey_type(k)); } @@ -673,7 +667,6 @@ do_convert_from_pkcs8(struct sshkey **k, int *private) (*k)->pkey = pubkey; pubkey = NULL; break; -#ifdef OPENSSL_HAS_ECC case EVP_PKEY_EC: if ((*k = sshkey_new(KEY_UNSPEC)) == NULL) fatal("sshkey_new failed"); @@ -683,7 +676,6 @@ do_convert_from_pkcs8(struct sshkey **k, int *private) (*k)->pkey = pubkey; pubkey = NULL; break; -#endif default: fatal_f("unsupported pubkey type %d", EVP_PKEY_base_id(pubkey)); @@ -747,13 +739,11 @@ do_convert_from(struct passwd *pw) fprintf(stdout, "\n"); } else { switch (k->type) { -#ifdef OPENSSL_HAS_ECC case KEY_ECDSA: ok = PEM_write_ECPrivateKey(stdout, EVP_PKEY_get0_EC_KEY(k->pkey), NULL, NULL, 0, NULL, NULL); break; -#endif case KEY_RSA: ok = PEM_write_RSAPrivateKey(stdout, EVP_PKEY_get0_RSA(k->pkey), NULL, NULL, 0, @@ -1014,9 +1004,7 @@ do_gen_all_hostkeys(struct passwd *pw) } key_types[] = { #ifdef WITH_OPENSSL { "rsa", "RSA" ,_PATH_HOST_RSA_KEY_FILE }, -#ifdef OPENSSL_HAS_ECC { "ecdsa", "ECDSA",_PATH_HOST_ECDSA_KEY_FILE }, -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ { "ed25519", "ED25519",_PATH_HOST_ED25519_KEY_FILE }, #ifdef USE_MLDSA diff --git a/ssh-keyscan.c b/ssh-keyscan.c index 1c473913d..8f52f7e6e 100644 --- a/ssh-keyscan.c +++ b/ssh-keyscan.c @@ -290,9 +290,7 @@ keygrab_ssh2(con *c) c->c_ssh->kex->kex[KEX_DH_GRP18_SHA512] = kex_gen_client; c->c_ssh->kex->kex[KEX_DH_GEX_SHA1] = kexgex_client; c->c_ssh->kex->kex[KEX_DH_GEX_SHA256] = kexgex_client; -# ifdef OPENSSL_HAS_ECC c->c_ssh->kex->kex[KEX_ECDH_SHA2] = kex_gen_client; -# endif #endif c->c_ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_client; c->c_ssh->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_client; diff --git a/ssh-pkcs11.c b/ssh-pkcs11.c index 7a7d3b8ea..bd45ef090 100644 --- a/ssh-pkcs11.c +++ b/ssh-pkcs11.c @@ -86,7 +86,7 @@ TAILQ_HEAD(, pkcs11_key) pkcs11_keys; /* XXX a tree would be better */ int pkcs11_interactive = 0; -#if defined(OPENSSL_HAS_ECC) || defined(OPENSSL_HAS_ED25519) +#ifdef WITH_OPENSSL static void ossl_error(const char *msg) { @@ -622,7 +622,6 @@ pkcs11_sign_rsa(struct sshkey *key, return ret; } -#ifdef OPENSSL_HAS_ECC static int pkcs11_sign_ecdsa(struct sshkey *key, u_char **sigp, size_t *lenp, @@ -706,7 +705,6 @@ pkcs11_sign_ecdsa(struct sshkey *key, free(sig); return ret; } -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ static int @@ -849,7 +847,6 @@ pkcs11_key_included(struct sshkey ***keysp, int *nkeys, struct sshkey *key) } #ifdef WITH_OPENSSL -#ifdef OPENSSL_HAS_ECC static struct sshkey * pkcs11_fetch_ecdsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx, CK_OBJECT_HANDLE *obj) @@ -983,7 +980,6 @@ fail: return (key); } -#endif /* OPENSSL_HAS_ECC */ static struct sshkey * pkcs11_fetch_rsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx, @@ -1208,18 +1204,14 @@ pkcs11_fetch_x509_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx, X509_NAME *x509_name = NULL; EVP_PKEY *evp; RSA *rsa = NULL; - + EC_KEY *ec = NULL; struct sshkey *key = NULL; - int i, success = -1; + int r, i, nid, success = -1; const u_char *cp; char *subject = NULL; #ifdef OPENSSL_HAS_ED25519 size_t len; #endif /* OPENSSL_HAS_ED25519 */ -#ifdef OPENSSL_HAS_ECC - EC_KEY *ec = NULL; - int r, nid; -#endif *keyp = NULL; *labelp = NULL; @@ -1314,7 +1306,6 @@ pkcs11_fetch_x509_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx, goto out; /* success */ success = 0; -#ifdef OPENSSL_HAS_ECC } else if (EVP_PKEY_base_id(evp) == EVP_PKEY_EC) { if (EVP_PKEY_get0_EC_KEY(evp) == NULL) { error("invalid x509; no ec key"); @@ -1353,7 +1344,6 @@ pkcs11_fetch_x509_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx, goto out; /* success */ success = 0; -#endif /* OPENSSL_HAS_ECC */ #ifdef OPENSSL_HAS_ED25519 } else if (EVP_PKEY_base_id(evp) == EVP_PKEY_ED25519) { if ((key = sshkey_new(KEY_UNSPEC)) == NULL || @@ -1385,9 +1375,7 @@ pkcs11_fetch_x509_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx, free(cert_attr[i].pValue); X509_free(x509); RSA_free(rsa); -#ifdef OPENSSL_HAS_ECC EC_KEY_free(ec); -#endif /* OPENSSL_HAS_ECC */ if (success != 0 || key == NULL) { sshkey_free(key); free(subject); @@ -1593,11 +1581,9 @@ pkcs11_fetch_keys(struct pkcs11_provider *p, CK_ULONG slotidx, case CKK_RSA: key = pkcs11_fetch_rsa_pubkey(p, slotidx, &obj); break; -#ifdef OPENSSL_HAS_ECC case CKK_ECDSA: key = pkcs11_fetch_ecdsa_pubkey(p, slotidx, &obj); break; -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ case CKK_EC_EDWARDS: key = pkcs11_fetch_ed25519_pubkey(p, slotidx, &obj); @@ -2071,17 +2057,15 @@ pkcs11_sign(struct sshkey *key, const char *sk_pin, u_int compat) { switch (key->type) { +#ifdef WITH_OPENSSL case KEY_RSA: case KEY_RSA_CERT: -#ifdef WITH_OPENSSL return pkcs11_sign_rsa(key, sigp, lenp, data, datalen, alg, sk_provider, sk_pin, compat); -#ifdef OPENSSL_HAS_ECC case KEY_ECDSA: case KEY_ECDSA_CERT: return pkcs11_sign_ecdsa(key, sigp, lenp, data, datalen, alg, sk_provider, sk_pin, compat); -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ case KEY_ED25519: case KEY_ED25519_CERT: @@ -2246,11 +2230,9 @@ pkcs11_destroy_keypair(char *provider_id, char *pin, unsigned long slotidx, case CKK_RSA: k = pkcs11_fetch_rsa_pubkey(p, slotidx, &obj); break; -#ifdef OPENSSL_HAS_ECC case CKK_ECDSA: k = pkcs11_fetch_ecdsa_pubkey(p, slotidx, &obj); break; -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ case CKK_EC_EDWARDS: k = pkcs11_fetch_ed25519_pubkey(p, slotidx, &obj); diff --git a/ssh-sk.c b/ssh-sk.c index 6bb1edc90..aaf72a3f3 100644 --- a/ssh-sk.c +++ b/ssh-sk.c @@ -27,11 +27,11 @@ #include #include -#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) +#ifdef WITH_OPENSSL #include #include #include -#endif /* WITH_OPENSSL && OPENSSL_HAS_ECC */ +#endif /* WITH_OPENSSL */ #include "log.h" #include "misc.h" @@ -44,15 +44,6 @@ #include "sk-api.h" #include "crypto_api.h" -/* - * Almost every use of OpenSSL in this file is for ECDSA-NISTP256. - * This is strictly a larger hammer than necessary, but it reduces changes - * with upstream. - */ -#ifndef OPENSSL_HAS_ECC -# undef WITH_OPENSSL -#endif - struct sshsk_provider { char *path; void *dlhandle; diff --git a/ssh_api.c b/ssh_api.c index 4d1e2cd1a..d01ac5483 100644 --- a/ssh_api.c +++ b/ssh_api.c @@ -128,9 +128,7 @@ ssh_init(struct ssh **sshp, int is_server, struct kex_params *kex_params) ssh->kex->kex[KEX_DH_GRP18_SHA512] = kex_gen_server; ssh->kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; ssh->kex->kex[KEX_DH_GEX_SHA256] = kexgex_server; -# ifdef OPENSSL_HAS_ECC ssh->kex->kex[KEX_ECDH_SHA2] = kex_gen_server; -# endif #endif /* WITH_OPENSSL */ ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_server; ssh->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server; @@ -148,9 +146,7 @@ ssh_init(struct ssh **sshp, int is_server, struct kex_params *kex_params) ssh->kex->kex[KEX_DH_GRP18_SHA512] = kex_gen_client; ssh->kex->kex[KEX_DH_GEX_SHA1] = kexgex_client; ssh->kex->kex[KEX_DH_GEX_SHA256] = kexgex_client; -# ifdef OPENSSL_HAS_ECC ssh->kex->kex[KEX_ECDH_SHA2] = kex_gen_client; -# endif #endif /* WITH_OPENSSL */ ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_client; ssh->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_client; diff --git a/sshbuf-getput-crypto.c b/sshbuf-getput-crypto.c index 7516fd588..34463dc94 100644 --- a/sshbuf-getput-crypto.c +++ b/sshbuf-getput-crypto.c @@ -24,9 +24,7 @@ #ifdef WITH_OPENSSL #include -#ifdef OPENSSL_HAS_ECC -# include -#endif /* OPENSSL_HAS_ECC */ +#include #include "ssherr.h" #define SSHBUF_INTERNAL @@ -55,7 +53,6 @@ sshbuf_get_bignum2(struct sshbuf *buf, BIGNUM **valp) return 0; } -#ifdef OPENSSL_HAS_ECC static int get_ec(const u_char *d, size_t len, EC_POINT *v, const EC_GROUP *g) { @@ -125,7 +122,6 @@ sshbuf_get_eckey(struct sshbuf *buf, EC_KEY *v) } return 0; } -#endif /* OPENSSL_HAS_ECC */ int sshbuf_put_bignum2(struct sshbuf *buf, const BIGNUM *v) @@ -149,7 +145,6 @@ sshbuf_put_bignum2(struct sshbuf *buf, const BIGNUM *v) return 0; } -#ifdef OPENSSL_HAS_ECC int sshbuf_put_ec(struct sshbuf *buf, const EC_POINT *v, const EC_GROUP *g) { @@ -186,5 +181,4 @@ sshbuf_put_ec_pkey(struct sshbuf *buf, EVP_PKEY *pkey) return SSH_ERR_LIBCRYPTO_ERROR; return sshbuf_put_eckey(buf, ec); } -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ diff --git a/sshbuf.h b/sshbuf.h index 5ad230b37..70a54e180 100644 --- a/sshbuf.h +++ b/sshbuf.h @@ -24,11 +24,16 @@ #include #ifdef WITH_OPENSSL -# include -# include -# ifdef OPENSSL_HAS_ECC -# include -# endif /* OPENSSL_HAS_ECC */ +#include +#include +#include +#include +#else /* OPENSSL */ +#define BIGNUM void +#define EC_KEY void +#define EC_GROUP void +#define EC_POINT void +#define EVP_PKEY void #endif /* WITH_OPENSSL */ #define SSHBUF_SIZE_MAX 0x8000000 /* Hard maximum size */ @@ -234,20 +239,16 @@ int sshbuf_peek_string_direct(const struct sshbuf *buf, const u_char **valp, * Functions to extract or store SSH wire encoded bignums and elliptic * curve points. */ -int sshbuf_put_bignum2_bytes(struct sshbuf *buf, const void *v, size_t len); +int sshbuf_get_bignum2(struct sshbuf *buf, BIGNUM **valp); int sshbuf_get_bignum2_bytes_direct(struct sshbuf *buf, const u_char **valp, size_t *lenp); -#ifdef WITH_OPENSSL -int sshbuf_get_bignum2(struct sshbuf *buf, BIGNUM **valp); int sshbuf_put_bignum2(struct sshbuf *buf, const BIGNUM *v); -# ifdef OPENSSL_HAS_ECC +int sshbuf_put_bignum2_bytes(struct sshbuf *buf, const void *v, size_t len); int sshbuf_get_ec(struct sshbuf *buf, EC_POINT *v, const EC_GROUP *g); int sshbuf_get_eckey(struct sshbuf *buf, EC_KEY *v); int sshbuf_put_ec(struct sshbuf *buf, const EC_POINT *v, const EC_GROUP *g); int sshbuf_put_eckey(struct sshbuf *buf, const EC_KEY *v); int sshbuf_put_ec_pkey(struct sshbuf *buf, EVP_PKEY *pkey); -# endif /* OPENSSL_HAS_ECC */ -#endif /* WITH_OPENSSL */ /* Functions to extract or store various non-SSH wire encoded values */ int sshbuf_get_nulterminated_string(struct sshbuf *buf, size_t maxlen, diff --git a/sshconnect2.c b/sshconnect2.c index f46f29937..3ff05a578 100644 --- a/sshconnect2.c +++ b/sshconnect2.c @@ -270,9 +270,7 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr, ssh->kex->kex[KEX_DH_GRP18_SHA512] = kex_gen_client; ssh->kex->kex[KEX_DH_GEX_SHA1] = kexgex_client; ssh->kex->kex[KEX_DH_GEX_SHA256] = kexgex_client; -# ifdef OPENSSL_HAS_ECC ssh->kex->kex[KEX_ECDH_SHA2] = kex_gen_client; -# endif #endif ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_client; ssh->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_client; diff --git a/sshd-auth.c b/sshd-auth.c index 0005e4cf9..4888c8e62 100644 --- a/sshd-auth.c +++ b/sshd-auth.c @@ -806,11 +806,9 @@ do_ssh2_kex(struct ssh *ssh) kex->kex[KEX_DH_GRP18_SHA512] = kex_gen_server; kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; kex->kex[KEX_DH_GEX_SHA256] = kexgex_server; -# ifdef OPENSSL_HAS_ECC kex->kex[KEX_ECDH_SHA2] = kex_gen_server; kex->kex[KEX_KEM_MLKEM768ECDH_SHA256] = kex_gen_server; -# endif /* OPENSSL_HAS_ECC */ -#endif /* WITH_OPENSSL */ +#endif kex->kex[KEX_C25519_SHA256] = kex_gen_server; kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server; kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_server; diff --git a/sshkey.c b/sshkey.c index 7f389daa9..41a06dc34 100644 --- a/sshkey.c +++ b/sshkey.c @@ -90,27 +90,25 @@ extern const struct sshkey_impl sshkey_ed25519_impl; extern const struct sshkey_impl sshkey_ed25519_cert_impl; extern const struct sshkey_impl sshkey_ed25519_sk_impl; extern const struct sshkey_impl sshkey_ed25519_sk_cert_impl; -#ifdef USE_MLDSA +# ifdef USE_MLDSA extern const struct sshkey_impl sshkey_mldsa44_ed25519_impl; extern const struct sshkey_impl sshkey_mldsa44_ed25519_cert_impl; -#endif /* USE_MLDSA */ +# endif /* USE_MLDSA */ #ifdef WITH_OPENSSL -# ifdef OPENSSL_HAS_ECC -# ifdef ENABLE_SK +# ifdef ENABLE_SK extern const struct sshkey_impl sshkey_ecdsa_sk_impl; extern const struct sshkey_impl sshkey_ecdsa_sk_cert_impl; extern const struct sshkey_impl sshkey_ecdsa_sk_webauthn_impl; extern const struct sshkey_impl sshkey_ecdsa_sk_webauthn_cert_impl; -# endif /* ENABLE_SK */ +# endif /* ENABLE_SK */ extern const struct sshkey_impl sshkey_ecdsa_nistp256_impl; extern const struct sshkey_impl sshkey_ecdsa_nistp256_cert_impl; extern const struct sshkey_impl sshkey_ecdsa_nistp384_impl; extern const struct sshkey_impl sshkey_ecdsa_nistp384_cert_impl; -# ifdef OPENSSL_HAS_NISTP521 +# ifdef OPENSSL_HAS_NISTP521 extern const struct sshkey_impl sshkey_ecdsa_nistp521_impl; extern const struct sshkey_impl sshkey_ecdsa_nistp521_cert_impl; -# endif /* OPENSSL_HAS_NISTP521 */ -# endif /* OPENSSL_HAS_ECC */ +# endif /* OPENSSL_HAS_NISTP521 */ extern const struct sshkey_impl sshkey_rsa_impl; extern const struct sshkey_impl sshkey_rsa_cert_impl; extern const struct sshkey_impl sshkey_rsa_sha256_impl; @@ -131,22 +129,20 @@ const struct sshkey_impl * const keyimpls[] = { &sshkey_mldsa44_ed25519_cert_impl, #endif /* USE_MLDSA */ #ifdef WITH_OPENSSL -# ifdef OPENSSL_HAS_ECC &sshkey_ecdsa_nistp256_impl, &sshkey_ecdsa_nistp256_cert_impl, &sshkey_ecdsa_nistp384_impl, &sshkey_ecdsa_nistp384_cert_impl, -# ifdef OPENSSL_HAS_NISTP521 +# ifdef OPENSSL_HAS_NISTP521 &sshkey_ecdsa_nistp521_impl, &sshkey_ecdsa_nistp521_cert_impl, -# endif /* OPENSSL_HAS_NISTP521 */ -# ifdef ENABLE_SK +# endif /* OPENSSL_HAS_NISTP521 */ +# ifdef ENABLE_SK &sshkey_ecdsa_sk_impl, &sshkey_ecdsa_sk_cert_impl, &sshkey_ecdsa_sk_webauthn_impl, &sshkey_ecdsa_sk_webauthn_cert_impl, -# endif /* ENABLE_SK */ -# endif /* OPENSSL_HAS_ECC */ +# endif /* ENABLE_SK */ &sshkey_rsa_impl, &sshkey_rsa_cert_impl, &sshkey_rsa_sha256_impl, @@ -1482,7 +1478,7 @@ sshkey_check_rsa_length(const struct sshkey *k, int min_size) return 0; } -#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) +#ifdef WITH_OPENSSL int sshkey_ecdsa_key_to_nid(const EC_KEY *k) { @@ -1501,7 +1497,7 @@ sshkey_ecdsa_pkey_to_nid(EVP_PKEY *pkey) { return sshkey_ecdsa_key_to_nid(EVP_PKEY_get0_EC_KEY(pkey)); } -#endif /* defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) */ +#endif /* WITH_OPENSSL */ int sshkey_generate(int type, u_int bits, struct sshkey **keyp) @@ -2689,7 +2685,7 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp) return r; } -#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) +#ifdef WITH_OPENSSL int sshkey_ec_validate_public(const EC_GROUP *group, const EC_POINT *public) { @@ -2826,7 +2822,7 @@ sshkey_dump_ec_key(const EC_KEY *key) BN_print_fp(stderr, EC_KEY_get0_private_key(key)); fputs("\n", stderr); } -#endif /* WITH_OPENSSL && OPENSSL_HAS_ECC */ +#endif /* WITH_OPENSSL */ static int sshkey_private_to_blob2(struct sshkey *prv, struct sshbuf *blob, @@ -3313,7 +3309,6 @@ sshkey_private_to_blob_pem_pkcs8(struct sshkey *key, struct sshbuf *buf, goto out; switch (key->type) { -#ifdef OPENSSL_HAS_ECC case KEY_ECDSA: if (format == SSHKEY_PRIVATE_PEM) { success = PEM_write_bio_ECPrivateKey(bio, @@ -3325,7 +3320,6 @@ sshkey_private_to_blob_pem_pkcs8(struct sshkey *key, struct sshbuf *buf, success = 1; } break; -#endif case KEY_RSA: if (format == SSHKEY_PRIVATE_PEM) { success = PEM_write_bio_RSAPrivateKey(bio, @@ -3570,7 +3564,6 @@ sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type, prv->pkey = pk; if ((r = sshkey_check_rsa_length(prv, 0)) != 0) goto out; -#ifdef OPENSSL_HAS_ECC } else if (EVP_PKEY_base_id(pk) == EVP_PKEY_EC && (type == KEY_UNSPEC || type == KEY_ECDSA)) { if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { @@ -3596,7 +3589,6 @@ sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type, if (prv != NULL && prv->pkey != NULL) sshkey_dump_ec_key(EVP_PKEY_get0_EC_KEY(prv->pkey)); #endif -#endif /* OPENSSL_HAS_ECC */ #ifdef OPENSSL_HAS_ED25519 } else if (EVP_PKEY_base_id(pk) == EVP_PKEY_ED25519 && (type == KEY_UNSPEC || type == KEY_ED25519)) { @@ -3647,9 +3639,7 @@ sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type, BIO_free(bio); EVP_PKEY_free(pk); RSA_free(rsa); -#ifdef OPENSSL_HAS_ECC EC_KEY_free(ecdsa); -#endif sshkey_free(prv); return r; } diff --git a/sshkey.h b/sshkey.h index 9ad5583a2..e4f84f16f 100644 --- a/sshkey.h +++ b/sshkey.h @@ -30,23 +30,17 @@ #ifdef WITH_OPENSSL #include +#include +#include #include -# ifdef OPENSSL_HAS_ECC -# include -# include -# else /* OPENSSL_HAS_ECC */ -# define EC_KEY void -# define EC_GROUP void -# define EC_POINT void -# endif /* OPENSSL_HAS_ECC */ #define SSH_OPENSSL_VERSION OpenSSL_version(OPENSSL_VERSION) -#else /* WITH_OPENSSL */ -# define BIGNUM void -# define RSA void -# define EC_KEY void -# define EC_GROUP void -# define EC_POINT void -# define EVP_PKEY void +#else /* OPENSSL */ +#define BIGNUM void +#define RSA void +#define EC_KEY void +#define EC_GROUP void +#define EC_POINT void +#define EVP_PKEY void #define SSH_OPENSSL_VERSION "without OpenSSL" #endif /* WITH_OPENSSL */ @@ -334,16 +328,12 @@ int check_rsa_length(const RSA *rsa); /* XXX remove */ #endif #endif -#if !defined(WITH_OPENSSL) -# undef RSA -# undef EC_KEY -# undef EC_GROUP -# undef EC_POINT -# undef EVP_PKEY -#elif !defined(OPENSSL_HAS_ECC) -# undef EC_KEY -# undef EC_GROUP -# undef EC_POINT -#endif +#ifndef WITH_OPENSSL +#undef RSA +#undef EC_KEY +#undef EC_GROUP +#undef EC_POINT +#undef EVP_PKEY +#endif /* WITH_OPENSSL */ #endif /* SSHKEY_H */