[Openvpn-devel] [S] Change in openvpn[master]: OpenSSL: avoid resetting the HMAC key on every packet

plaisthos has uploaded this change for review. ( http://gerrit.openvpn.net/c/openvpn/+/1840?usp=email )


Change subject: OpenSSL: avoid resetting the HMAC key on every packet
......................................................................

OpenSSL: avoid resetting the HMAC key on every packet

OpenSSL 3.0.3 and newer can reinitialize an EVP_MAC HMAC
context with its existing key when EVP_MAC_init is called without
parameters. Use that path instead of supplying the digest and key
again on every OpenVPN HMAC reset.

Retain the old parameter-based reset for OpenSSL 3.0.0 through
3.0.2, where parameterless EVP_MAC reinitialization did not reset
the underlying HMAC implementation.

Change-Id: I1913a6e64b7ce22b66d2034df2a2fac33f60ea9f
Signed-off-by: Arne Schwabe <[email protected]>
---
M src/openvpn/crypto_openssl.c
1 file changed, 9 insertions(+), 5 deletions(-)



  git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/40/1840/1

diff --git a/src/openvpn/crypto_openssl.c b/src/openvpn/crypto_openssl.c
index 1191f20..2019280 100644
--- a/src/openvpn/crypto_openssl.c
+++ b/src/openvpn/crypto_openssl.c
@@ -1209,7 +1209,7 @@
 
     HMAC_Final(ctx, dst, &in_hmac_len);
 }
-#else  /* if OPENSSL_VERSION_NUMBER < 0x30000000L */
+#else /* if OPENSSL_VERSION_NUMBER < 0x30000000L */
 hmac_ctx_t *
 hmac_ctx_new(void)
 {
@@ -1275,10 +1275,14 @@
 void
 hmac_ctx_reset(hmac_ctx_t *ctx)
 {
-    /* The OpenSSL MAC API lacks a reset method and passing NULL as params
-     * does not reset it either, so use the params array to reinitialise it the
-     * same way as before */
-    if (!EVP_MAC_init(ctx->ctx, NULL, 0, ctx->params))
+    /* OpenSSL 3.0.3 fixed EVP_MAC reinitialization with an existing key.
+     * Older versions need the parameters, including the key, to reset. */
+#if OPENSSL_VERSION_NUMBER >= 0x30000030L
+    const OSSL_PARAM *params = NULL;
+#else
+    const OSSL_PARAM *params = ctx->params;
+#endif
+    if (!EVP_MAC_init(ctx->ctx, NULL, 0, params))
     {
         crypto_msg(M_FATAL, "EVP_MAC_init failed");
     }

-- 
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1840?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: newchange
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I1913a6e64b7ce22b66d2034df2a2fac33f60ea9f
Gerrit-Change-Number: 1840
Gerrit-PatchSet: 1
Gerrit-Owner: plaisthos <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>

_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel