From e416edf1b2b58b0195714bafbec614f85ebd7768 Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Fri, 31 Jul 2026 21:32:53 +1000 Subject: [PATCH] Remove support for libcrypto w/out ECC. Since 2010, we have supported building against an OpenSSL that did not have any ECC support, since at the time many systems still shipped with OpenSSL versions prior to ECC being added. We no longer support OpenSSL versions that old, and while it's possible to build a modern libcrypto without ECC, doing so seems very uncommon. Having OPENSSL_HAS_ECC sprinkled throughout the code increases the cost of syncing changes and is a maintenance burden, so this has now outlived its usefulness and is being removed. It is still possible to build --without-openssl on such systems if required. This includes a few whitespace and header order changes to bring Portable back into sync with OpenBSD in those places, and removes the corresponding test. ok djm@ --- .github/setup_ci.sh | 4 -- .github/workflows/c-cpp.yml | 1 - configure.ac | 4 +- kex-names.c | 10 ++--- kex.c | 2 - kex.h | 31 ++++---------- kexecdh.c | 31 +------------- monitor.c | 4 +- openbsd-compat/openssl-compat.h | 2 - packet.c | 8 +--- packet.h | 36 ++++------------ readconf.c | 2 - regress/misc/sk-dummy/sk-dummy.c | 4 +- regress/unittests/bitmap/tests.c | 2 +- regress/unittests/conversion/tests.c | 1 + regress/unittests/hostkeys/test_iterate.c | 9 ---- regress/unittests/kex/test_kex.c | 12 ++---- .../sshbuf/test_sshbuf_getput_crypto.c | 8 ++-- .../sshbuf/test_sshbuf_getput_fuzz.c | 8 ++-- regress/unittests/sshkey/test_file.c | 9 ++-- regress/unittests/sshkey/test_fuzz.c | 13 ++---- regress/unittests/sshkey/test_sshkey.c | 39 ++++------------- regress/unittests/sshsig/tests.c | 8 ++-- regress/unittests/test_helper/test_helper.c | 4 +- servconf.c | 2 - sk-usbhid.c | 9 ---- ssh-add.c | 2 - ssh-ecdsa-sk.c | 19 +-------- ssh-ecdsa.c | 4 +- ssh-keygen.c | 12 ------ ssh-keyscan.c | 2 - ssh-pkcs11.c | 26 ++---------- ssh-sk.c | 13 +----- ssh_api.c | 4 -- sshbuf-getput-crypto.c | 8 +--- sshbuf.h | 23 +++++----- sshconnect2.c | 2 - sshd-auth.c | 4 +- sshkey.c | 38 +++++++---------- sshkey.h | 42 +++++++------------ 40 files changed, 114 insertions(+), 348 deletions(-) diff --git a/.github/setup_ci.sh b/.github/setup_ci.sh index 6ab4e4fb5..2572a2882 100755 --- a/.github/setup_ci.sh +++ b/.github/setup_ci.sh @@ -156,10 +156,6 @@ for TARGET in $TARGETS; do tcmalloc) PACKAGES="$PACKAGES libgoogle-perftools-dev" ;; - openssl-noec) - INSTALL_OPENSSL=OpenSSL_1_1_1k - SSLCONFOPTS="no-ec" - ;; openssl-*) INSTALL_OPENSSL=$(echo ${TARGET} | cut -f2 -d-) case ${INSTALL_OPENSSL} in diff --git a/.github/workflows/c-cpp.yml b/.github/workflows/c-cpp.yml index ffead602f..119cdcc17 100644 --- a/.github/workflows/c-cpp.yml +++ b/.github/workflows/c-cpp.yml @@ -86,7 +86,6 @@ jobs: - { target: ubuntu-latest, config: libressl-4.2.0 } - { target: ubuntu-latest, config: libressl-4.3.2 } - { target: ubuntu-latest, config: openssl-master } - - { target: ubuntu-latest, config: openssl-noec } - { target: ubuntu-latest, config: openssl-1.1.1 } - { target: ubuntu-latest, config: openssl-1.1.1t } - { target: ubuntu-latest, config: openssl-1.1.1w } diff --git a/configure.ac b/configure.ac index a4d544cc5..d1f64cd62 100644 --- a/configure.ac +++ b/configure.ac @@ -3365,11 +3365,9 @@ if test "x$openssl" = "xyes" ; then if test x$enable_nistp256 = x1 || test x$enable_nistp384 = x1 || \ test x$enable_nistp521 = x1; then - AC_DEFINE(OPENSSL_HAS_ECC, [1], [OpenSSL has ECC]) AC_CHECK_FUNCS([EC_KEY_METHOD_new]) - openssl_ecc=yes else - openssl_ecc=no + AC_MSG_ERROR([libcrypto does not have required ECC support]) fi if test x$enable_nistp256 = x1; then AC_DEFINE([OPENSSL_HAS_NISTP256], [1], diff --git a/kex-names.c b/kex-names.c index 684e27e78..f9ba49b7f 100644 --- a/kex-names.c +++ b/kex-names.c @@ -58,10 +58,9 @@ static const struct kexalg kexalgs[] = { { KEX_DH16_SHA512, KEX_DH_GRP16_SHA512, 0, SSH_DIGEST_SHA512, KEX_NOT_PQ }, { KEX_DH18_SHA512, KEX_DH_GRP18_SHA512, 0, SSH_DIGEST_SHA512, KEX_NOT_PQ }, { KEX_DHGEX_SHA1, KEX_DH_GEX_SHA1, 0, SSH_DIGEST_SHA1, KEX_NOT_PQ }, -#ifdef HAVE_EVP_SHA256 +# ifdef HAVE_EVP_SHA256 { KEX_DHGEX_SHA256, KEX_DH_GEX_SHA256, 0, SSH_DIGEST_SHA256, KEX_NOT_PQ }, -#endif /* HAVE_EVP_SHA256 */ -#ifdef OPENSSL_HAS_ECC +# endif /* HAVE_EVP_SHA256 */ { KEX_ECDH_SHA2_NISTP256, KEX_ECDH_SHA2, NID_X9_62_prime256v1, SSH_DIGEST_SHA256, KEX_NOT_PQ }, { KEX_ECDH_SHA2_NISTP384, KEX_ECDH_SHA2, NID_secp384r1, @@ -72,11 +71,10 @@ static const struct kexalg kexalgs[] = { # endif /* OPENSSL_HAS_NISTP521 */ { KEX_MLKEM768NISTP256_SHA256, KEX_KEM_MLKEM768ECDH_SHA256, NID_X9_62_prime256v1, SSH_DIGEST_SHA256, KEX_IS_PQ }, -# ifdef NID_brainpoolP256r1 +# ifdef NID_brainpoolP256r1 { KEX_MLKEM768BRAINPOOLP256R1_SHA256, KEX_KEM_MLKEM768ECDH_SHA256, NID_brainpoolP256r1, SSH_DIGEST_SHA256, KEX_IS_PQ }, -# endif /* NID_brainpoolP256r1 */ -#endif /* OPENSSL_HAS_ECC */ +# endif /* NID_brainpoolP256r1 */ #endif /* WITH_OPENSSL */ #if defined(HAVE_EVP_SHA256) || !defined(WITH_OPENSSL) { KEX_CURVE25519_SHA256, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256, KEX_NOT_PQ }, diff --git a/kex.c b/kex.c index 11b271d47..b2c3d9720 100644 --- a/kex.c +++ b/kex.c @@ -732,9 +732,7 @@ kex_free(struct kex *kex) #ifdef WITH_OPENSSL DH_free(kex->dh); -#ifdef OPENSSL_HAS_ECC EC_KEY_free(kex->ec_client_key); -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ for (mode = 0; mode < MODE_MAX; mode++) { kex_free_newkeys(kex->newkeys[mode]); diff --git a/kex.h b/kex.h index 1bd0b6224..373325686 100644 --- a/kex.h +++ b/kex.h @@ -30,22 +30,15 @@ #include "crypto_api.h" #ifdef WITH_OPENSSL -# include -# include -# include -# ifdef OPENSSL_HAS_ECC -# include -# else /* OPENSSL_HAS_ECC */ -# define EC_KEY void -# define EC_GROUP void -# define EC_POINT void -# endif /* OPENSSL_HAS_ECC */ -#else /* WITH_OPENSSL */ -# define DH void -# define BIGNUM void -# define EC_KEY void -# define EC_GROUP void -# define EC_POINT void +#include +#include +#include +#include +#else /* OPENSSL */ +#define BIGNUM void +#define DH void +#define EC_KEY void +#define EC_GROUP void #endif /* WITH_OPENSSL */ #define KEX_COOKIE_LEN 16 @@ -299,10 +292,4 @@ int kexc25519_shared_key_ext(const u_char key[CURVE25519_SIZE], void dump_digest(const char *, const u_char *, int); #endif -#if !defined(WITH_OPENSSL) || !defined(OPENSSL_HAS_ECC) -# undef EC_KEY -# undef EC_GROUP -# undef EC_POINT -#endif - #endif diff --git a/kexecdh.c b/kexecdh.c index beded1255..f1a0b4765 100644 --- a/kexecdh.c +++ b/kexecdh.c @@ -26,7 +26,7 @@ #include "includes.h" -#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) +#if defined(WITH_OPENSSL) #include @@ -204,31 +204,4 @@ kex_ecdh_dec(struct kex *kex, const struct sshbuf *server_blob, return r; } -#else - -#include "ssherr.h" - -struct kex; -struct sshbuf; -struct sshkey; - -int -kex_ecdh_keypair(struct kex *kex) -{ - return SSH_ERR_SIGN_ALG_UNSUPPORTED; -} - -int -kex_ecdh_enc(struct kex *kex, const struct sshbuf *client_blob, - struct sshbuf **server_blobp, struct sshbuf **shared_secretp) -{ - return SSH_ERR_SIGN_ALG_UNSUPPORTED; -} - -int -kex_ecdh_dec(struct kex *kex, const struct sshbuf *server_blob, - struct sshbuf **shared_secretp) -{ - return SSH_ERR_SIGN_ALG_UNSUPPORTED; -} -#endif /* defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) */ +#endif /* WITH_OPENSSL */ diff --git a/monitor.c b/monitor.c index 013deae5f..149671145 100644 --- a/monitor.c +++ b/monitor.c @@ -1874,11 +1874,9 @@ monitor_apply_keystate(struct ssh *ssh, struct monitor *pmonitor) kex->kex[KEX_DH_GRP18_SHA512] = kex_gen_server; kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; kex->kex[KEX_DH_GEX_SHA256] = kexgex_server; -# ifdef OPENSSL_HAS_ECC kex->kex[KEX_ECDH_SHA2] = kex_gen_server; kex->kex[KEX_KEM_MLKEM768ECDH_SHA256] = kex_gen_server; -# endif -#endif /* WITH_OPENSSL */ +#endif kex->kex[KEX_C25519_SHA256] = kex_gen_server; kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server; kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_server; diff --git a/openbsd-compat/openssl-compat.h b/openbsd-compat/openssl-compat.h index 42e2e2833..0dc0794d5 100644 --- a/openbsd-compat/openssl-compat.h +++ b/openbsd-compat/openssl-compat.h @@ -25,9 +25,7 @@ #include #include #include -#ifdef OPENSSL_HAS_ECC #include -#endif #include int ssh_compatible_openssl(long, long); diff --git a/packet.c b/packet.c index 7c8589728..63dcb5351 100644 --- a/packet.c +++ b/packet.c @@ -67,9 +67,7 @@ #ifdef WITH_OPENSSL # include # include -# ifdef OPENSSL_HAS_ECC -# include -# endif +# include #endif #ifdef WITH_ZLIB @@ -2746,7 +2744,6 @@ sshpkt_put_stringb(struct ssh *ssh, const struct sshbuf *v) } #ifdef WITH_OPENSSL -#ifdef OPENSSL_HAS_ECC int sshpkt_put_ec(struct ssh *ssh, const EC_POINT *v, const EC_GROUP *g) { @@ -2758,7 +2755,6 @@ sshpkt_put_ec_pkey(struct ssh *ssh, EVP_PKEY *pkey) { return sshbuf_put_ec_pkey(ssh->state->outgoing_packet, pkey); } -#endif /* OPENSSL_HAS_ECC */ int sshpkt_put_bignum2(struct ssh *ssh, const BIGNUM *v) @@ -2824,13 +2820,11 @@ sshpkt_getb_froms(struct ssh *ssh, struct sshbuf **valp) } #ifdef WITH_OPENSSL -#ifdef OPENSSL_HAS_ECC int sshpkt_get_ec(struct ssh *ssh, EC_POINT *v, const EC_GROUP *g) { return sshbuf_get_ec(ssh->state->incoming_packet, v, g); } -#endif /* OPENSSL_HAS_ECC */ int sshpkt_get_bignum2(struct ssh *ssh, BIGNUM **valp) diff --git a/packet.h b/packet.h index 3e8acb2cd..442e38bb7 100644 --- a/packet.h +++ b/packet.h @@ -23,21 +23,15 @@ #include #ifdef WITH_OPENSSL -# include -# include -# ifdef OPENSSL_HAS_ECC -# include -# else /* OPENSSL_HAS_ECC */ -# define EC_KEY void -# define EC_GROUP void -# define EC_POINT void -# endif /* OPENSSL_HAS_ECC */ -#else /* WITH_OPENSSL */ -# define BIGNUM void -# define EC_KEY void -# define EC_GROUP void -# define EC_POINT void -# define EVP_PKEY void +#include +#include +#include +#include +#else /* OPENSSL */ +#define BIGNUM void +#define EC_GROUP void +#define EC_POINT void +#define EVP_PKEY void #endif /* WITH_OPENSSL */ struct kex; @@ -213,16 +207,4 @@ void sshpkt_fmt_connection_id(struct ssh *ssh, char *s, size_t l); const u_char *sshpkt_ptr(struct ssh *, size_t *lenp); char *connection_info_message(struct ssh *ssh); -#if !defined(WITH_OPENSSL) -# undef BIGNUM -# undef EC_KEY -# undef EC_GROUP -# undef EC_POINT -# undef EVP_PKEY -#elif !defined(OPENSSL_HAS_ECC) -# undef EC_KEY -# undef EC_GROUP -# undef EC_POINT -#endif - #endif /* PACKET_H */ diff --git a/readconf.c b/readconf.c index ecabd8389..bc48b4f55 100644 --- a/readconf.c +++ b/readconf.c @@ -2917,11 +2917,9 @@ fill_default_options(Options * options) } if (options->num_identity_files == 0) { add_identity_file(options, "~/", _PATH_SSH_CLIENT_ID_RSA, 0); -#ifdef OPENSSL_HAS_ECC add_identity_file(options, "~/", _PATH_SSH_CLIENT_ID_ECDSA, 0); add_identity_file(options, "~/", _PATH_SSH_CLIENT_ID_ECDSA_SK, 0); -#endif add_identity_file(options, "~/", _PATH_SSH_CLIENT_ID_ED25519, 0); add_identity_file(options, "~/", diff --git a/regress/misc/sk-dummy/sk-dummy.c b/regress/misc/sk-dummy/sk-dummy.c index 4c96e8827..cbbba7459 100644 --- a/regress/misc/sk-dummy/sk-dummy.c +++ b/regress/misc/sk-dummy/sk-dummy.c @@ -89,7 +89,7 @@ sk_api_version(void) static int pack_key_ecdsa(struct sk_enroll_response *response) { -#ifdef OPENSSL_HAS_ECC +#ifdef WITH_OPENSSL EC_KEY *key = NULL; const EC_GROUP *g; const EC_POINT *q; @@ -309,7 +309,7 @@ sig_ecdsa(const uint8_t *message, size_t message_len, const uint8_t *key_handle, size_t key_handle_len, struct sk_sign_response *response) { -#ifdef OPENSSL_HAS_ECC +#ifdef WITH_OPENSSL ECDSA_SIG *sig = NULL; const BIGNUM *sig_r, *sig_s; int ret = -1; diff --git a/regress/unittests/bitmap/tests.c b/regress/unittests/bitmap/tests.c index 6470f983d..e3bffadea 100644 --- a/regress/unittests/bitmap/tests.c +++ b/regress/unittests/bitmap/tests.c @@ -138,9 +138,9 @@ tests(void) TEST_DONE(); #endif } + void benchmarks(void) { printf("no benchmarks\n"); } - diff --git a/regress/unittests/conversion/tests.c b/regress/unittests/conversion/tests.c index fce4d1ca7..1c620e02d 100644 --- a/regress/unittests/conversion/tests.c +++ b/regress/unittests/conversion/tests.c @@ -11,6 +11,7 @@ #include #include #include +#include #include #include "../test_helper/test_helper.h" diff --git a/regress/unittests/hostkeys/test_iterate.c b/regress/unittests/hostkeys/test_iterate.c index a330adce5..6281e30df 100644 --- a/regress/unittests/hostkeys/test_iterate.c +++ b/regress/unittests/hostkeys/test_iterate.c @@ -87,11 +87,6 @@ check(struct hostkey_foreach_line *l, void *_ctx) expected_keytype = (parse_key || expected->no_parse_keytype < 0) ? expected->l.keytype : expected->no_parse_keytype; -#ifndef OPENSSL_HAS_ECC - if (expected->l.keytype == KEY_ECDSA || - expected->no_parse_keytype == KEY_ECDSA) - skip = 1; -#endif /* OPENSSL_HAS_ECC */ #ifndef WITH_OPENSSL if (expected->l.keytype == KEY_RSA || expected->no_parse_keytype == KEY_RSA || @@ -147,10 +142,6 @@ prepare_expected(struct expected *expected, size_t n) for (i = 0; i < n; i++) { if (expected[i].key_file == NULL) continue; -#ifndef OPENSSL_HAS_ECC - if (expected[i].l.keytype == KEY_ECDSA) - continue; -#endif /* OPENSSL_HAS_ECC */ #ifndef WITH_OPENSSL switch (expected[i].l.keytype) { case KEY_RSA: diff --git a/regress/unittests/kex/test_kex.c b/regress/unittests/kex/test_kex.c index 16c2f2dff..89376f115 100644 --- a/regress/unittests/kex/test_kex.c +++ b/regress/unittests/kex/test_kex.c @@ -158,14 +158,12 @@ do_kex_with_key(char *kex, char *cipher, char *mac, #ifdef WITH_OPENSSL server2->kex->kex[KEX_DH_GRP1_SHA1] = kex_gen_server; server2->kex->kex[KEX_DH_GRP14_SHA1] = kex_gen_server; - server2->kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; - server2->kex->kex[KEX_DH_GEX_SHA256] = kexgex_server; server2->kex->kex[KEX_DH_GRP14_SHA256] = kex_gen_server; server2->kex->kex[KEX_DH_GRP16_SHA512] = kex_gen_server; server2->kex->kex[KEX_DH_GRP18_SHA512] = kex_gen_server; -#ifdef OPENSSL_HAS_ECC + server2->kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; + server2->kex->kex[KEX_DH_GEX_SHA256] = kexgex_server; server2->kex->kex[KEX_ECDH_SHA2] = kex_gen_server; -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ server2->kex->kex[KEX_C25519_SHA256] = kex_gen_server; server2->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server; @@ -183,9 +181,9 @@ do_kex_with_key(char *kex, char *cipher, char *mac, TEST_DONE(); TEST_START("cleanup"); + sshkey_free(public); if (key == NULL) sshkey_free(private); - sshkey_free(public); ssh_free(client); ssh_free(server); ssh_free(server2); @@ -219,9 +217,7 @@ do_kex(char *kex) #ifdef WITH_OPENSSL do_kex_with_key(kex, NULL, NULL, NULL, KEY_RSA, 2048); -# ifdef OPENSSL_HAS_ECC do_kex_with_key(kex, NULL, NULL, NULL, KEY_ECDSA, 256); -# endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ do_kex_with_key(kex, NULL, NULL, NULL, KEY_ED25519, 256); } @@ -231,11 +227,9 @@ kex_tests(void) { do_kex("curve25519-sha256"); #ifdef WITH_OPENSSL -#ifdef OPENSSL_HAS_ECC do_kex("ecdh-sha2-nistp256"); do_kex("ecdh-sha2-nistp384"); do_kex("ecdh-sha2-nistp521"); -#endif /* OPENSSL_HAS_ECC */ do_kex("diffie-hellman-group-exchange-sha256"); do_kex("diffie-hellman-group-exchange-sha1"); do_kex("diffie-hellman-group14-sha1"); diff --git a/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c b/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c index 1d83ffd88..1ce2041c9 100644 --- a/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c +++ b/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c @@ -16,10 +16,8 @@ #include #include +#include #include -#ifdef OPENSSL_HAS_NISTP256 -# include -#endif #include "openbsd-compat/openssl-compat.h" #include "../test_helper/test_helper.h" @@ -45,7 +43,7 @@ sshbuf_getput_crypto_tests(void) 0x70, 0x60, 0x50, 0x40, 0x30, 0x20, 0x10, 0x00, 0x7f, 0xff, 0x11 }; -#if defined(OPENSSL_HAS_ECC) && defined(OPENSSL_HAS_NISTP256) +#if defined(OPENSSL_HAS_NISTP256) const u_char *d; size_t s; BIGNUM *bn_x, *bn_y; @@ -221,7 +219,7 @@ sshbuf_getput_crypto_tests(void) sshbuf_free(p1); TEST_DONE(); -#if defined(OPENSSL_HAS_ECC) && defined(OPENSSL_HAS_NISTP256) +#if defined(OPENSSL_HAS_NISTP256) TEST_START("sshbuf_put_ec"); eck = EC_KEY_new_by_curve_name(ec256_nid); ASSERT_PTR_NE(eck, NULL); diff --git a/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c b/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c index 7b2ffced3..5c53529df 100644 --- a/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c +++ b/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c @@ -33,9 +33,9 @@ attempt_parse_blob(u_char *blob, size_t len) struct sshbuf *p1; #ifdef WITH_OPENSSL BIGNUM *bn; -#if defined(OPENSSL_HAS_ECC) && defined(OPENSSL_HAS_NISTP256) +#if defined(OPENSSL_HAS_NISTP256) EC_KEY *eck; -#endif /* defined(OPENSSL_HAS_ECC) && defined(OPENSSL_HAS_NISTP256) */ +#endif /* defined(OPENSSL_HAS_NISTP256) */ #endif /* WITH_OPENSSL */ u_char *s; size_t l; @@ -59,12 +59,12 @@ attempt_parse_blob(u_char *blob, size_t len) bn = NULL; ASSERT_INT_EQ(sshbuf_get_bignum2(p1, &bn), 0); BN_clear_free(bn); -#if defined(OPENSSL_HAS_ECC) && defined(OPENSSL_HAS_NISTP256) +# if defined(OPENSSL_HAS_NISTP256) eck = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); ASSERT_PTR_NE(eck, NULL); ASSERT_INT_EQ(sshbuf_get_eckey(p1, eck), 0); EC_KEY_free(eck); -#endif /* defined(OPENSSL_HAS_ECC) && defined(OPENSSL_HAS_NISTP256) */ +# endif /* defined(OPENSSL_HAS_NISTP256) */ #endif /* WITH_OPENSSL */ sshbuf_free(p1); } diff --git a/regress/unittests/sshkey/test_file.c b/regress/unittests/sshkey/test_file.c index 296e90e78..f8fcc3abd 100644 --- a/regress/unittests/sshkey/test_file.c +++ b/regress/unittests/sshkey/test_file.c @@ -18,11 +18,9 @@ #ifdef WITH_OPENSSL #include +#include #include #include -#ifdef OPENSSL_HAS_NISTP256 -# include -#endif /* OPENSSL_HAS_NISTP256 */ #endif /* WITH_OPENSSL */ #include "../test_helper/test_helper.h" @@ -162,7 +160,7 @@ sshkey_file_tests(void) sshkey_free(k1); -#ifdef OPENSSL_HAS_ECC + TEST_START("parse ECDSA from private"); buf = load_file("ecdsa_1"); ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0); @@ -262,7 +260,6 @@ sshkey_file_tests(void) TEST_DONE(); sshkey_free(k1); -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ TEST_START("parse Ed25519 from private"); @@ -396,7 +393,7 @@ sshkey_file_tests(void) sshkey_free(k1); #ifdef ENABLE_SK -#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) +#if defined(WITH_OPENSSL) TEST_START("parse ECDSA-SK from private"); buf = load_file("ecdsa_sk1"); ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0); diff --git a/regress/unittests/sshkey/test_fuzz.c b/regress/unittests/sshkey/test_fuzz.c index fb178c1e4..0e5bdf748 100644 --- a/regress/unittests/sshkey/test_fuzz.c +++ b/regress/unittests/sshkey/test_fuzz.c @@ -18,11 +18,9 @@ #ifdef WITH_OPENSSL #include +#include #include #include -#ifdef OPENSSL_HAS_NISTP256 -# include -#endif #endif #include "../test_helper/test_helper.h" @@ -160,7 +158,7 @@ sshkey_fuzz_tests(void) fuzz_cleanup(fuzz); TEST_DONE(); -#ifdef OPENSSL_HAS_ECC + TEST_START("fuzz ECDSA private"); buf = load_file("ecdsa_1"); fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf), @@ -204,7 +202,6 @@ sshkey_fuzz_tests(void) sshbuf_free(fuzzed); fuzz_cleanup(fuzz); TEST_DONE(); -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ TEST_START("fuzz Ed25519 private"); @@ -270,7 +267,7 @@ sshkey_fuzz_tests(void) sshkey_free(k1); TEST_DONE(); -#ifdef OPENSSL_HAS_ECC + TEST_START("fuzz ECDSA public"); buf = load_file("ecdsa_1"); ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0); @@ -284,7 +281,6 @@ sshkey_fuzz_tests(void) public_fuzz(k1); sshkey_free(k1); TEST_DONE(); -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ TEST_START("fuzz Ed25519 public"); @@ -341,7 +337,7 @@ sshkey_fuzz_tests(void) sshkey_free(k1); TEST_DONE(); -#ifdef OPENSSL_HAS_ECC + TEST_START("fuzz ECDSA sig"); buf = load_file("ecdsa_1"); ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0); @@ -349,7 +345,6 @@ sshkey_fuzz_tests(void) sig_fuzz(k1, NULL); sshkey_free(k1); TEST_DONE(); -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ TEST_START("fuzz Ed25519 sig"); diff --git a/regress/unittests/sshkey/test_sshkey.c b/regress/unittests/sshkey/test_sshkey.c index ec0ce452c..59efbb28e 100644 --- a/regress/unittests/sshkey/test_sshkey.c +++ b/regress/unittests/sshkey/test_sshkey.c @@ -15,10 +15,8 @@ #ifdef WITH_OPENSSL #include +#include #include -#if defined(OPENSSL_HAS_ECC) && defined(OPENSSL_HAS_NISTP256) -# include -#endif #endif #include "../test_helper/test_helper.h" @@ -240,13 +238,8 @@ get_private(const char *n) void sshkey_tests(void) { - struct sshkey *k1 = NULL, *k2 = NULL, *k3 = NULL, *kf = NULL; -#ifdef WITH_OPENSSL - struct sshkey *k4 = NULL, *kr = NULL, *kd = NULL; -#ifdef OPENSSL_HAS_ECC - struct sshkey *ke = NULL; -#endif /* OPENSSL_HAS_ECC */ -#endif /* WITH_OPENSSL */ + struct sshkey *k1 = NULL, *k2 = NULL, *k3 = NULL, *k4 = NULL; + struct sshkey *kr = NULL, *kd = NULL, *ke = NULL, *kf = NULL; struct sshbuf *b = NULL; TEST_START("new invalid"); @@ -270,8 +263,6 @@ sshkey_tests(void) k1 = NULL; TEST_DONE(); - -#ifdef OPENSSL_HAS_ECC TEST_START("new/free KEY_ECDSA"); k1 = sshkey_new(KEY_ECDSA); ASSERT_PTR_NE(k1, NULL); @@ -279,7 +270,7 @@ sshkey_tests(void) sshkey_free(k1); k1 = NULL; TEST_DONE(); -#endif +#endif /* WITH_OPENSSL */ TEST_START("new/free KEY_ED25519"); k1 = sshkey_new(KEY_ED25519); @@ -300,6 +291,7 @@ sshkey_tests(void) k1 = NULL; TEST_DONE(); +#ifdef WITH_OPENSSL TEST_START("generate KEY_RSA too small modulus"); ASSERT_INT_EQ(sshkey_generate(KEY_RSA, 128, &k1), SSH_ERR_KEY_LENGTH); @@ -313,7 +305,6 @@ sshkey_tests(void) TEST_DONE(); -#ifdef OPENSSL_HAS_ECC TEST_START("generate KEY_ECDSA wrong bits"); ASSERT_INT_EQ(sshkey_generate(KEY_ECDSA, 42, &k1), SSH_ERR_KEY_LENGTH); @@ -321,7 +312,6 @@ sshkey_tests(void) sshkey_free(k1); k1 = NULL; TEST_DONE(); -#endif TEST_START("generate KEY_RSA"); ASSERT_INT_EQ(sshkey_generate(KEY_RSA, 767, &kr), @@ -336,7 +326,6 @@ sshkey_tests(void) TEST_DONE(); -#ifdef OPENSSL_HAS_ECC TEST_START("generate KEY_ECDSA"); ASSERT_INT_EQ(sshkey_generate(KEY_ECDSA, 256, &ke), 0); ASSERT_PTR_NE(ke, NULL); @@ -346,7 +335,6 @@ sshkey_tests(void) ASSERT_PTR_NE(EC_KEY_get0_private_key(EVP_PKEY_get0_EC_KEY(ke->pkey)), NULL); TEST_DONE(); -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ TEST_START("generate KEY_ED25519"); @@ -386,7 +374,6 @@ sshkey_tests(void) TEST_DONE(); -#ifdef OPENSSL_HAS_ECC TEST_START("demote KEY_ECDSA"); ASSERT_INT_EQ(sshkey_from_private(ke, &k1), 0); ASSERT_PTR_NE(k1, NULL); @@ -405,7 +392,6 @@ sshkey_tests(void) sshkey_free(k1); k1 = NULL; TEST_DONE(); -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ TEST_START("demote KEY_ED25519"); @@ -443,28 +429,21 @@ sshkey_tests(void) #ifdef WITH_OPENSSL TEST_START("equal mismatched key types"); ASSERT_INT_EQ(sshkey_equal(kd, kr), 0); -#ifdef OPENSSL_HAS_ECC ASSERT_INT_EQ(sshkey_equal(kd, ke), 0); ASSERT_INT_EQ(sshkey_equal(kr, ke), 0); ASSERT_INT_EQ(sshkey_equal(ke, kf), 0); -#endif /* OPENSSL_HAS_ECC */ ASSERT_INT_EQ(sshkey_equal(kd, kf), 0); TEST_DONE(); -#endif /* WITH_OPENSSL */ TEST_START("equal different keys"); -#ifdef WITH_OPENSSL ASSERT_INT_EQ(sshkey_generate(KEY_RSA, 1024, &k1), 0); ASSERT_INT_EQ(sshkey_equal(kr, k1), 0); sshkey_free(k1); k1 = NULL; -#ifdef OPENSSL_HAS_ECC ASSERT_INT_EQ(sshkey_generate(KEY_ECDSA, 256, &k1), 0); ASSERT_INT_EQ(sshkey_equal(ke, k1), 0); sshkey_free(k1); k1 = NULL; -#endif /* OPENSSL_HAS_ECC */ -#endif /* WITH_OPENSSL */ ASSERT_INT_EQ(sshkey_generate(KEY_ED25519, 256, &k1), 0); ASSERT_INT_EQ(sshkey_equal(kf, k1), 0); sshkey_free(k1); @@ -476,15 +455,13 @@ sshkey_tests(void) sshkey_free(k2); k1 = k2 = NULL; TEST_DONE(); +#endif /* WITH_OPENSSL */ -#ifdef WITH_OPENSSL sshkey_free(kr); sshkey_free(kd); -#ifdef OPENSSL_HAS_ECC sshkey_free(ke); -#endif /* OPENSSL_HAS_ECC */ -#endif /* WITH_OPENSSL */ sshkey_free(kf); + kr = kd = ke = kf = NULL; TEST_START("certify key"); ASSERT_INT_EQ(sshkey_load_public(test_data_file("ed25519_1.pub"), @@ -611,7 +588,6 @@ sshkey_tests(void) TEST_DONE(); -#ifdef OPENSSL_HAS_ECC TEST_START("sign and verify ECDSA"); k1 = get_private("ecdsa_1"); ASSERT_INT_EQ(sshkey_load_public(test_data_file("ecdsa_2.pub"), &k2, @@ -621,7 +597,6 @@ sshkey_tests(void) sshkey_free(k2); k1 = k2 = NULL; TEST_DONE(); -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ TEST_START("sign and verify ED25519"); diff --git a/regress/unittests/sshsig/tests.c b/regress/unittests/sshsig/tests.c index 68e893147..fa3013533 100644 --- a/regress/unittests/sshsig/tests.c +++ b/regress/unittests/sshsig/tests.c @@ -103,11 +103,9 @@ tests(void) TEST_DONE(); -#ifdef OPENSSL_HAS_ECC TEST_START("check ECDSA signature"); check_sig("ecdsa.pub", "ecdsa.sig", msg, namespace); TEST_DONE(); -#endif #endif TEST_START("check ED25519 signature"); @@ -119,7 +117,7 @@ tests(void) TEST_DONE(); #ifdef ENABLE_SK -#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) +#if defined(WITH_OPENSSL) TEST_START("check ECDSA-SK signature"); check_sig("ecdsa_sk.pub", "ecdsa_sk.sig", msg, namespace); TEST_DONE(); @@ -129,11 +127,11 @@ tests(void) check_sig("ed25519_sk.pub", "ed25519_sk.sig", msg, namespace); TEST_DONE(); -#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) +#if defined(WITH_OPENSSL) TEST_START("check ECDSA-SK webauthn signature"); check_sig("ecdsa_sk_webauthn.pub", "ecdsa_sk_webauthn.sig", msg, namespace); - TEST_DONE(); + TEST_DONE(); #endif #endif /* ENABLE_SK */ diff --git a/regress/unittests/test_helper/test_helper.c b/regress/unittests/test_helper/test_helper.c index a2cb02d83..898732d38 100644 --- a/regress/unittests/test_helper/test_helper.c +++ b/regress/unittests/test_helper/test_helper.c @@ -22,7 +22,7 @@ #include #include #include - + #include #include #include @@ -59,7 +59,7 @@ #define BENCH_COLUMN_WIDTH 40 #define MINIMUM(a, b) (((a) < (b)) ? (a) : (b)) - + #define TEST_CHECK_INT(r, pred) do { \ switch (pred) { \ case TEST_EQ: \ diff --git a/servconf.c b/servconf.c index 41d442907..ac0c31d95 100644 --- a/servconf.c +++ b/servconf.c @@ -313,10 +313,8 @@ fill_default_server_options(ServerOptions *options) /* fill default hostkeys */ servconf_add_hostkey("[default]", 0, options, _PATH_HOST_RSA_KEY_FILE, 0); -#ifdef OPENSSL_HAS_ECC servconf_add_hostkey("[default]", 0, options, _PATH_HOST_ECDSA_KEY_FILE, 0); -#endif servconf_add_hostkey("[default]", 0, options, _PATH_HOST_ED25519_KEY_FILE, 0); servconf_add_hostkey("[default]", 0, options, diff --git a/sk-usbhid.c b/sk-usbhid.c index ce59c4e93..647f88f61 100644 --- a/sk-usbhid.c +++ b/sk-usbhid.c @@ -31,15 +31,6 @@ #include #endif -/* - * Almost every use of OpenSSL in this file is for ECDSA-NISTP256. - * This is strictly a larger hammer than necessary, but it reduces changes - * with upstream. - */ -#ifndef OPENSSL_HAS_ECC -# undef WITH_OPENSSL -#endif - #ifdef WITH_OPENSSL #include #include diff --git a/ssh-add.c b/ssh-add.c index f2055df36..9231c5277 100644 --- a/ssh-add.c +++ b/ssh-add.c @@ -80,10 +80,8 @@ extern char *__progname; static char *default_files[] = { #ifdef WITH_OPENSSL _PATH_SSH_CLIENT_ID_RSA, -#ifdef OPENSSL_HAS_ECC _PATH_SSH_CLIENT_ID_ECDSA, _PATH_SSH_CLIENT_ID_ECDSA_SK, -#endif #endif /* WITH_OPENSSL */ _PATH_SSH_CLIENT_ID_ED25519, _PATH_SSH_CLIENT_ID_ED25519_SK, diff --git a/ssh-ecdsa-sk.c b/ssh-ecdsa-sk.c index eb5c8bc1e..ad8afd079 100644 --- a/ssh-ecdsa-sk.c +++ b/ssh-ecdsa-sk.c @@ -32,35 +32,21 @@ #include #ifdef WITH_OPENSSL +#include "openbsd-compat/openssl-compat.h" #include #include #include #include -#endif #include #include /* needed for DEBUG_SK only */ -#include "openbsd-compat/openssl-compat.h" - #include "sshbuf.h" #include "ssherr.h" #include "digest.h" #define SSHKEY_INTERNAL #include "sshkey.h" -#ifndef OPENSSL_HAS_ECC -/* ARGSUSED */ -int -ssh_ecdsa_sk_verify(const struct sshkey *key, - const u_char *signature, size_t signaturelen, - const u_char *data, size_t datalen, u_int compat, - struct sshkey_sig_details **detailsp) -{ - return SSH_ERR_FEATURE_UNSUPPORTED; -} -#else /* OPENSSL_HAS_ECC */ - /* Reuse some ECDSA internals */ extern struct sshkey_impl_funcs sshkey_ecdsa_funcs; @@ -502,5 +488,4 @@ const struct sshkey_impl sshkey_ecdsa_sk_webauthn_cert_impl = { /* .keybits = */ 256, /* .funcs = */ &sshkey_ecdsa_sk_funcs, }; - -#endif /* OPENSSL_HAS_ECC */ +#endif /* WITH_OPENSSL */ diff --git a/ssh-ecdsa.c b/ssh-ecdsa.c index 526ae7454..488db9c2a 100644 --- a/ssh-ecdsa.c +++ b/ssh-ecdsa.c @@ -26,7 +26,7 @@ #include "includes.h" -#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) +#if defined(WITH_OPENSSL) #include "openbsd-compat/openssl-compat.h" #include @@ -582,4 +582,4 @@ const struct sshkey_impl sshkey_ecdsa_nistp521_cert_impl = { }; #endif -#endif /* WITH_OPENSSL && OPENSSL_HAS_ECC */ +#endif /* WITH_OPENSSL */ diff --git a/ssh-keygen.c b/ssh-keygen.c index a62e5dc4a..fef27300e 100644 --- a/ssh-keygen.c +++ b/ssh-keygen.c @@ -251,7 +251,6 @@ ask_filename(struct passwd *pw, const char *prompt) name = _PATH_SSH_CLIENT_ID_ED25519; else { switch (sshkey_type_from_shortname(key_type_name)) { -#ifdef OPENSSL_HAS_ECC case KEY_ECDSA_CERT: case KEY_ECDSA: name = _PATH_SSH_CLIENT_ID_ECDSA; @@ -260,7 +259,6 @@ ask_filename(struct passwd *pw, const char *prompt) case KEY_ECDSA_SK: name = _PATH_SSH_CLIENT_ID_ECDSA_SK; break; -#endif case KEY_RSA_CERT: case KEY_RSA: name = _PATH_SSH_CLIENT_ID_RSA; @@ -364,13 +362,11 @@ do_convert_to_pkcs8(struct sshkey *k) EVP_PKEY_get0_RSA(k->pkey))) fatal("PEM_write_RSA_PUBKEY failed"); break; -#ifdef OPENSSL_HAS_ECC case KEY_ECDSA: if (!PEM_write_EC_PUBKEY(stdout, EVP_PKEY_get0_EC_KEY(k->pkey))) fatal("PEM_write_EC_PUBKEY failed"); break; -#endif default: fatal_f("unsupported key type %s", sshkey_type(k)); } @@ -385,13 +381,11 @@ do_convert_to_pem(struct sshkey *k) EVP_PKEY_get0_RSA(k->pkey))) fatal("PEM_write_RSAPublicKey failed"); break; -#ifdef OPENSSL_HAS_ECC case KEY_ECDSA: if (!PEM_write_EC_PUBKEY(stdout, EVP_PKEY_get0_EC_KEY(k->pkey))) fatal("PEM_write_EC_PUBKEY failed"); break; -#endif default: fatal_f("unsupported key type %s", sshkey_type(k)); } @@ -673,7 +667,6 @@ do_convert_from_pkcs8(struct sshkey **k, int *private) (*k)->pkey = pubkey; pubkey = NULL; break; -#ifdef OPENSSL_HAS_ECC case EVP_PKEY_EC: if ((*k = sshkey_new(KEY_UNSPEC)) == NULL) fatal("sshkey_new failed"); @@ -683,7 +676,6 @@ do_convert_from_pkcs8(struct sshkey **k, int *private) (*k)->pkey = pubkey; pubkey = NULL; break; -#endif default: fatal_f("unsupported pubkey type %d", EVP_PKEY_base_id(pubkey)); @@ -747,13 +739,11 @@ do_convert_from(struct passwd *pw) fprintf(stdout, "\n"); } else { switch (k->type) { -#ifdef OPENSSL_HAS_ECC case KEY_ECDSA: ok = PEM_write_ECPrivateKey(stdout, EVP_PKEY_get0_EC_KEY(k->pkey), NULL, NULL, 0, NULL, NULL); break; -#endif case KEY_RSA: ok = PEM_write_RSAPrivateKey(stdout, EVP_PKEY_get0_RSA(k->pkey), NULL, NULL, 0, @@ -1014,9 +1004,7 @@ do_gen_all_hostkeys(struct passwd *pw) } key_types[] = { #ifdef WITH_OPENSSL { "rsa", "RSA" ,_PATH_HOST_RSA_KEY_FILE }, -#ifdef OPENSSL_HAS_ECC { "ecdsa", "ECDSA",_PATH_HOST_ECDSA_KEY_FILE }, -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ { "ed25519", "ED25519",_PATH_HOST_ED25519_KEY_FILE }, #ifdef USE_MLDSA diff --git a/ssh-keyscan.c b/ssh-keyscan.c index 1c473913d..8f52f7e6e 100644 --- a/ssh-keyscan.c +++ b/ssh-keyscan.c @@ -290,9 +290,7 @@ keygrab_ssh2(con *c) c->c_ssh->kex->kex[KEX_DH_GRP18_SHA512] = kex_gen_client; c->c_ssh->kex->kex[KEX_DH_GEX_SHA1] = kexgex_client; c->c_ssh->kex->kex[KEX_DH_GEX_SHA256] = kexgex_client; -# ifdef OPENSSL_HAS_ECC c->c_ssh->kex->kex[KEX_ECDH_SHA2] = kex_gen_client; -# endif #endif c->c_ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_client; c->c_ssh->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_client; diff --git a/ssh-pkcs11.c b/ssh-pkcs11.c index 7a7d3b8ea..bd45ef090 100644 --- a/ssh-pkcs11.c +++ b/ssh-pkcs11.c @@ -86,7 +86,7 @@ TAILQ_HEAD(, pkcs11_key) pkcs11_keys; /* XXX a tree would be better */ int pkcs11_interactive = 0; -#if defined(OPENSSL_HAS_ECC) || defined(OPENSSL_HAS_ED25519) +#ifdef WITH_OPENSSL static void ossl_error(const char *msg) { @@ -622,7 +622,6 @@ pkcs11_sign_rsa(struct sshkey *key, return ret; } -#ifdef OPENSSL_HAS_ECC static int pkcs11_sign_ecdsa(struct sshkey *key, u_char **sigp, size_t *lenp, @@ -706,7 +705,6 @@ pkcs11_sign_ecdsa(struct sshkey *key, free(sig); return ret; } -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ static int @@ -849,7 +847,6 @@ pkcs11_key_included(struct sshkey ***keysp, int *nkeys, struct sshkey *key) } #ifdef WITH_OPENSSL -#ifdef OPENSSL_HAS_ECC static struct sshkey * pkcs11_fetch_ecdsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx, CK_OBJECT_HANDLE *obj) @@ -983,7 +980,6 @@ fail: return (key); } -#endif /* OPENSSL_HAS_ECC */ static struct sshkey * pkcs11_fetch_rsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx, @@ -1208,18 +1204,14 @@ pkcs11_fetch_x509_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx, X509_NAME *x509_name = NULL; EVP_PKEY *evp; RSA *rsa = NULL; - + EC_KEY *ec = NULL; struct sshkey *key = NULL; - int i, success = -1; + int r, i, nid, success = -1; const u_char *cp; char *subject = NULL; #ifdef OPENSSL_HAS_ED25519 size_t len; #endif /* OPENSSL_HAS_ED25519 */ -#ifdef OPENSSL_HAS_ECC - EC_KEY *ec = NULL; - int r, nid; -#endif *keyp = NULL; *labelp = NULL; @@ -1314,7 +1306,6 @@ pkcs11_fetch_x509_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx, goto out; /* success */ success = 0; -#ifdef OPENSSL_HAS_ECC } else if (EVP_PKEY_base_id(evp) == EVP_PKEY_EC) { if (EVP_PKEY_get0_EC_KEY(evp) == NULL) { error("invalid x509; no ec key"); @@ -1353,7 +1344,6 @@ pkcs11_fetch_x509_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx, goto out; /* success */ success = 0; -#endif /* OPENSSL_HAS_ECC */ #ifdef OPENSSL_HAS_ED25519 } else if (EVP_PKEY_base_id(evp) == EVP_PKEY_ED25519) { if ((key = sshkey_new(KEY_UNSPEC)) == NULL || @@ -1385,9 +1375,7 @@ pkcs11_fetch_x509_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx, free(cert_attr[i].pValue); X509_free(x509); RSA_free(rsa); -#ifdef OPENSSL_HAS_ECC EC_KEY_free(ec); -#endif /* OPENSSL_HAS_ECC */ if (success != 0 || key == NULL) { sshkey_free(key); free(subject); @@ -1593,11 +1581,9 @@ pkcs11_fetch_keys(struct pkcs11_provider *p, CK_ULONG slotidx, case CKK_RSA: key = pkcs11_fetch_rsa_pubkey(p, slotidx, &obj); break; -#ifdef OPENSSL_HAS_ECC case CKK_ECDSA: key = pkcs11_fetch_ecdsa_pubkey(p, slotidx, &obj); break; -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ case CKK_EC_EDWARDS: key = pkcs11_fetch_ed25519_pubkey(p, slotidx, &obj); @@ -2071,17 +2057,15 @@ pkcs11_sign(struct sshkey *key, const char *sk_pin, u_int compat) { switch (key->type) { +#ifdef WITH_OPENSSL case KEY_RSA: case KEY_RSA_CERT: -#ifdef WITH_OPENSSL return pkcs11_sign_rsa(key, sigp, lenp, data, datalen, alg, sk_provider, sk_pin, compat); -#ifdef OPENSSL_HAS_ECC case KEY_ECDSA: case KEY_ECDSA_CERT: return pkcs11_sign_ecdsa(key, sigp, lenp, data, datalen, alg, sk_provider, sk_pin, compat); -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ case KEY_ED25519: case KEY_ED25519_CERT: @@ -2246,11 +2230,9 @@ pkcs11_destroy_keypair(char *provider_id, char *pin, unsigned long slotidx, case CKK_RSA: k = pkcs11_fetch_rsa_pubkey(p, slotidx, &obj); break; -#ifdef OPENSSL_HAS_ECC case CKK_ECDSA: k = pkcs11_fetch_ecdsa_pubkey(p, slotidx, &obj); break; -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ case CKK_EC_EDWARDS: k = pkcs11_fetch_ed25519_pubkey(p, slotidx, &obj); diff --git a/ssh-sk.c b/ssh-sk.c index 6bb1edc90..aaf72a3f3 100644 --- a/ssh-sk.c +++ b/ssh-sk.c @@ -27,11 +27,11 @@ #include #include -#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) +#ifdef WITH_OPENSSL #include #include #include -#endif /* WITH_OPENSSL && OPENSSL_HAS_ECC */ +#endif /* WITH_OPENSSL */ #include "log.h" #include "misc.h" @@ -44,15 +44,6 @@ #include "sk-api.h" #include "crypto_api.h" -/* - * Almost every use of OpenSSL in this file is for ECDSA-NISTP256. - * This is strictly a larger hammer than necessary, but it reduces changes - * with upstream. - */ -#ifndef OPENSSL_HAS_ECC -# undef WITH_OPENSSL -#endif - struct sshsk_provider { char *path; void *dlhandle; diff --git a/ssh_api.c b/ssh_api.c index 4d1e2cd1a..d01ac5483 100644 --- a/ssh_api.c +++ b/ssh_api.c @@ -128,9 +128,7 @@ ssh_init(struct ssh **sshp, int is_server, struct kex_params *kex_params) ssh->kex->kex[KEX_DH_GRP18_SHA512] = kex_gen_server; ssh->kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; ssh->kex->kex[KEX_DH_GEX_SHA256] = kexgex_server; -# ifdef OPENSSL_HAS_ECC ssh->kex->kex[KEX_ECDH_SHA2] = kex_gen_server; -# endif #endif /* WITH_OPENSSL */ ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_server; ssh->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server; @@ -148,9 +146,7 @@ ssh_init(struct ssh **sshp, int is_server, struct kex_params *kex_params) ssh->kex->kex[KEX_DH_GRP18_SHA512] = kex_gen_client; ssh->kex->kex[KEX_DH_GEX_SHA1] = kexgex_client; ssh->kex->kex[KEX_DH_GEX_SHA256] = kexgex_client; -# ifdef OPENSSL_HAS_ECC ssh->kex->kex[KEX_ECDH_SHA2] = kex_gen_client; -# endif #endif /* WITH_OPENSSL */ ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_client; ssh->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_client; diff --git a/sshbuf-getput-crypto.c b/sshbuf-getput-crypto.c index 7516fd588..34463dc94 100644 --- a/sshbuf-getput-crypto.c +++ b/sshbuf-getput-crypto.c @@ -24,9 +24,7 @@ #ifdef WITH_OPENSSL #include -#ifdef OPENSSL_HAS_ECC -# include -#endif /* OPENSSL_HAS_ECC */ +#include #include "ssherr.h" #define SSHBUF_INTERNAL @@ -55,7 +53,6 @@ sshbuf_get_bignum2(struct sshbuf *buf, BIGNUM **valp) return 0; } -#ifdef OPENSSL_HAS_ECC static int get_ec(const u_char *d, size_t len, EC_POINT *v, const EC_GROUP *g) { @@ -125,7 +122,6 @@ sshbuf_get_eckey(struct sshbuf *buf, EC_KEY *v) } return 0; } -#endif /* OPENSSL_HAS_ECC */ int sshbuf_put_bignum2(struct sshbuf *buf, const BIGNUM *v) @@ -149,7 +145,6 @@ sshbuf_put_bignum2(struct sshbuf *buf, const BIGNUM *v) return 0; } -#ifdef OPENSSL_HAS_ECC int sshbuf_put_ec(struct sshbuf *buf, const EC_POINT *v, const EC_GROUP *g) { @@ -186,5 +181,4 @@ sshbuf_put_ec_pkey(struct sshbuf *buf, EVP_PKEY *pkey) return SSH_ERR_LIBCRYPTO_ERROR; return sshbuf_put_eckey(buf, ec); } -#endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ diff --git a/sshbuf.h b/sshbuf.h index 5ad230b37..70a54e180 100644 --- a/sshbuf.h +++ b/sshbuf.h @@ -24,11 +24,16 @@ #include #ifdef WITH_OPENSSL -# include -# include -# ifdef OPENSSL_HAS_ECC -# include -# endif /* OPENSSL_HAS_ECC */ +#include +#include +#include +#include +#else /* OPENSSL */ +#define BIGNUM void +#define EC_KEY void +#define EC_GROUP void +#define EC_POINT void +#define EVP_PKEY void #endif /* WITH_OPENSSL */ #define SSHBUF_SIZE_MAX 0x8000000 /* Hard maximum size */ @@ -234,20 +239,16 @@ int sshbuf_peek_string_direct(const struct sshbuf *buf, const u_char **valp, * Functions to extract or store SSH wire encoded bignums and elliptic * curve points. */ -int sshbuf_put_bignum2_bytes(struct sshbuf *buf, const void *v, size_t len); +int sshbuf_get_bignum2(struct sshbuf *buf, BIGNUM **valp); int sshbuf_get_bignum2_bytes_direct(struct sshbuf *buf, const u_char **valp, size_t *lenp); -#ifdef WITH_OPENSSL -int sshbuf_get_bignum2(struct sshbuf *buf, BIGNUM **valp); int sshbuf_put_bignum2(struct sshbuf *buf, const BIGNUM *v); -# ifdef OPENSSL_HAS_ECC +int sshbuf_put_bignum2_bytes(struct sshbuf *buf, const void *v, size_t len); int sshbuf_get_ec(struct sshbuf *buf, EC_POINT *v, const EC_GROUP *g); int sshbuf_get_eckey(struct sshbuf *buf, EC_KEY *v); int sshbuf_put_ec(struct sshbuf *buf, const EC_POINT *v, const EC_GROUP *g); int sshbuf_put_eckey(struct sshbuf *buf, const EC_KEY *v); int sshbuf_put_ec_pkey(struct sshbuf *buf, EVP_PKEY *pkey); -# endif /* OPENSSL_HAS_ECC */ -#endif /* WITH_OPENSSL */ /* Functions to extract or store various non-SSH wire encoded values */ int sshbuf_get_nulterminated_string(struct sshbuf *buf, size_t maxlen, diff --git a/sshconnect2.c b/sshconnect2.c index f46f29937..3ff05a578 100644 --- a/sshconnect2.c +++ b/sshconnect2.c @@ -270,9 +270,7 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr, ssh->kex->kex[KEX_DH_GRP18_SHA512] = kex_gen_client; ssh->kex->kex[KEX_DH_GEX_SHA1] = kexgex_client; ssh->kex->kex[KEX_DH_GEX_SHA256] = kexgex_client; -# ifdef OPENSSL_HAS_ECC ssh->kex->kex[KEX_ECDH_SHA2] = kex_gen_client; -# endif #endif ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_client; ssh->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_client; diff --git a/sshd-auth.c b/sshd-auth.c index 0005e4cf9..4888c8e62 100644 --- a/sshd-auth.c +++ b/sshd-auth.c @@ -806,11 +806,9 @@ do_ssh2_kex(struct ssh *ssh) kex->kex[KEX_DH_GRP18_SHA512] = kex_gen_server; kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; kex->kex[KEX_DH_GEX_SHA256] = kexgex_server; -# ifdef OPENSSL_HAS_ECC kex->kex[KEX_ECDH_SHA2] = kex_gen_server; kex->kex[KEX_KEM_MLKEM768ECDH_SHA256] = kex_gen_server; -# endif /* OPENSSL_HAS_ECC */ -#endif /* WITH_OPENSSL */ +#endif kex->kex[KEX_C25519_SHA256] = kex_gen_server; kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server; kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_server; diff --git a/sshkey.c b/sshkey.c index 7f389daa9..41a06dc34 100644 --- a/sshkey.c +++ b/sshkey.c @@ -90,27 +90,25 @@ extern const struct sshkey_impl sshkey_ed25519_impl; extern const struct sshkey_impl sshkey_ed25519_cert_impl; extern const struct sshkey_impl sshkey_ed25519_sk_impl; extern const struct sshkey_impl sshkey_ed25519_sk_cert_impl; -#ifdef USE_MLDSA +# ifdef USE_MLDSA extern const struct sshkey_impl sshkey_mldsa44_ed25519_impl; extern const struct sshkey_impl sshkey_mldsa44_ed25519_cert_impl; -#endif /* USE_MLDSA */ +# endif /* USE_MLDSA */ #ifdef WITH_OPENSSL -# ifdef OPENSSL_HAS_ECC -# ifdef ENABLE_SK +# ifdef ENABLE_SK extern const struct sshkey_impl sshkey_ecdsa_sk_impl; extern const struct sshkey_impl sshkey_ecdsa_sk_cert_impl; extern const struct sshkey_impl sshkey_ecdsa_sk_webauthn_impl; extern const struct sshkey_impl sshkey_ecdsa_sk_webauthn_cert_impl; -# endif /* ENABLE_SK */ +# endif /* ENABLE_SK */ extern const struct sshkey_impl sshkey_ecdsa_nistp256_impl; extern const struct sshkey_impl sshkey_ecdsa_nistp256_cert_impl; extern const struct sshkey_impl sshkey_ecdsa_nistp384_impl; extern const struct sshkey_impl sshkey_ecdsa_nistp384_cert_impl; -# ifdef OPENSSL_HAS_NISTP521 +# ifdef OPENSSL_HAS_NISTP521 extern const struct sshkey_impl sshkey_ecdsa_nistp521_impl; extern const struct sshkey_impl sshkey_ecdsa_nistp521_cert_impl; -# endif /* OPENSSL_HAS_NISTP521 */ -# endif /* OPENSSL_HAS_ECC */ +# endif /* OPENSSL_HAS_NISTP521 */ extern const struct sshkey_impl sshkey_rsa_impl; extern const struct sshkey_impl sshkey_rsa_cert_impl; extern const struct sshkey_impl sshkey_rsa_sha256_impl; @@ -131,22 +129,20 @@ const struct sshkey_impl * const keyimpls[] = { &sshkey_mldsa44_ed25519_cert_impl, #endif /* USE_MLDSA */ #ifdef WITH_OPENSSL -# ifdef OPENSSL_HAS_ECC &sshkey_ecdsa_nistp256_impl, &sshkey_ecdsa_nistp256_cert_impl, &sshkey_ecdsa_nistp384_impl, &sshkey_ecdsa_nistp384_cert_impl, -# ifdef OPENSSL_HAS_NISTP521 +# ifdef OPENSSL_HAS_NISTP521 &sshkey_ecdsa_nistp521_impl, &sshkey_ecdsa_nistp521_cert_impl, -# endif /* OPENSSL_HAS_NISTP521 */ -# ifdef ENABLE_SK +# endif /* OPENSSL_HAS_NISTP521 */ +# ifdef ENABLE_SK &sshkey_ecdsa_sk_impl, &sshkey_ecdsa_sk_cert_impl, &sshkey_ecdsa_sk_webauthn_impl, &sshkey_ecdsa_sk_webauthn_cert_impl, -# endif /* ENABLE_SK */ -# endif /* OPENSSL_HAS_ECC */ +# endif /* ENABLE_SK */ &sshkey_rsa_impl, &sshkey_rsa_cert_impl, &sshkey_rsa_sha256_impl, @@ -1482,7 +1478,7 @@ sshkey_check_rsa_length(const struct sshkey *k, int min_size) return 0; } -#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) +#ifdef WITH_OPENSSL int sshkey_ecdsa_key_to_nid(const EC_KEY *k) { @@ -1501,7 +1497,7 @@ sshkey_ecdsa_pkey_to_nid(EVP_PKEY *pkey) { return sshkey_ecdsa_key_to_nid(EVP_PKEY_get0_EC_KEY(pkey)); } -#endif /* defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) */ +#endif /* WITH_OPENSSL */ int sshkey_generate(int type, u_int bits, struct sshkey **keyp) @@ -2689,7 +2685,7 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp) return r; } -#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) +#ifdef WITH_OPENSSL int sshkey_ec_validate_public(const EC_GROUP *group, const EC_POINT *public) { @@ -2826,7 +2822,7 @@ sshkey_dump_ec_key(const EC_KEY *key) BN_print_fp(stderr, EC_KEY_get0_private_key(key)); fputs("\n", stderr); } -#endif /* WITH_OPENSSL && OPENSSL_HAS_ECC */ +#endif /* WITH_OPENSSL */ static int sshkey_private_to_blob2(struct sshkey *prv, struct sshbuf *blob, @@ -3313,7 +3309,6 @@ sshkey_private_to_blob_pem_pkcs8(struct sshkey *key, struct sshbuf *buf, goto out; switch (key->type) { -#ifdef OPENSSL_HAS_ECC case KEY_ECDSA: if (format == SSHKEY_PRIVATE_PEM) { success = PEM_write_bio_ECPrivateKey(bio, @@ -3325,7 +3320,6 @@ sshkey_private_to_blob_pem_pkcs8(struct sshkey *key, struct sshbuf *buf, success = 1; } break; -#endif case KEY_RSA: if (format == SSHKEY_PRIVATE_PEM) { success = PEM_write_bio_RSAPrivateKey(bio, @@ -3570,7 +3564,6 @@ sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type, prv->pkey = pk; if ((r = sshkey_check_rsa_length(prv, 0)) != 0) goto out; -#ifdef OPENSSL_HAS_ECC } else if (EVP_PKEY_base_id(pk) == EVP_PKEY_EC && (type == KEY_UNSPEC || type == KEY_ECDSA)) { if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { @@ -3596,7 +3589,6 @@ sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type, if (prv != NULL && prv->pkey != NULL) sshkey_dump_ec_key(EVP_PKEY_get0_EC_KEY(prv->pkey)); #endif -#endif /* OPENSSL_HAS_ECC */ #ifdef OPENSSL_HAS_ED25519 } else if (EVP_PKEY_base_id(pk) == EVP_PKEY_ED25519 && (type == KEY_UNSPEC || type == KEY_ED25519)) { @@ -3647,9 +3639,7 @@ sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type, BIO_free(bio); EVP_PKEY_free(pk); RSA_free(rsa); -#ifdef OPENSSL_HAS_ECC EC_KEY_free(ecdsa); -#endif sshkey_free(prv); return r; } diff --git a/sshkey.h b/sshkey.h index 9ad5583a2..e4f84f16f 100644 --- a/sshkey.h +++ b/sshkey.h @@ -30,23 +30,17 @@ #ifdef WITH_OPENSSL #include +#include +#include #include -# ifdef OPENSSL_HAS_ECC -# include -# include -# else /* OPENSSL_HAS_ECC */ -# define EC_KEY void -# define EC_GROUP void -# define EC_POINT void -# endif /* OPENSSL_HAS_ECC */ #define SSH_OPENSSL_VERSION OpenSSL_version(OPENSSL_VERSION) -#else /* WITH_OPENSSL */ -# define BIGNUM void -# define RSA void -# define EC_KEY void -# define EC_GROUP void -# define EC_POINT void -# define EVP_PKEY void +#else /* OPENSSL */ +#define BIGNUM void +#define RSA void +#define EC_KEY void +#define EC_GROUP void +#define EC_POINT void +#define EVP_PKEY void #define SSH_OPENSSL_VERSION "without OpenSSL" #endif /* WITH_OPENSSL */ @@ -334,16 +328,12 @@ int check_rsa_length(const RSA *rsa); /* XXX remove */ #endif #endif -#if !defined(WITH_OPENSSL) -# undef RSA -# undef EC_KEY -# undef EC_GROUP -# undef EC_POINT -# undef EVP_PKEY -#elif !defined(OPENSSL_HAS_ECC) -# undef EC_KEY -# undef EC_GROUP -# undef EC_POINT -#endif +#ifndef WITH_OPENSSL +#undef RSA +#undef EC_KEY +#undef EC_GROUP +#undef EC_POINT +#undef EVP_PKEY +#endif /* WITH_OPENSSL */ #endif /* SSHKEY_H */