100-replace_polarssl_with_mbedtls.patch (14411B)
1 diff --git a/common.c b/common.c 2 index bf72127..2d4739e 100644 3 --- a/common.c 4 +++ b/common.c 5 @@ -54,17 +54,14 @@ 6 #include <openssl/buffer.h> 7 #endif 8 9 -#ifdef HAVE_LIBPOLARSSL 10 -#include <polarssl/version.h> 11 -#include <polarssl/base64.h> 12 -#include <polarssl/x509.h> 13 -#include <polarssl/md.h> 14 -#include "polarssl/entropy.h" 15 -#include "polarssl/ctr_drbg.h" 16 - 17 -#if POLARSSL_VERSION_NUMBER >= 0x01030000 18 -#include "polarssl/compat-1.2.h" 19 -#endif 20 +#ifdef HAVE_LIBMBEDTLS 21 +#include <mbedtls/version.h> 22 +#include <mbedtls/base64.h> 23 +#include <mbedtls/x509.h> 24 +#include <mbedtls/md.h> 25 +#include "mbedtls/entropy.h" 26 +#include "mbedtls/ctr_drbg.h" 27 + 28 #endif 29 30 #include "common.h" 31 @@ -126,16 +123,16 @@ void inform(char *format, ...) { 32 daemon_log(LOG_INFO, "%s", s); 33 } 34 35 -#ifdef HAVE_LIBPOLARSSL 36 +#ifdef HAVE_LIBMBEDTLS 37 char *base64_enc(uint8_t *input, int length) { 38 char *buf = NULL; 39 size_t dlen = 0; 40 - int rc = base64_encode(NULL, &dlen, input, length); 41 - if (rc && (rc != POLARSSL_ERR_BASE64_BUFFER_TOO_SMALL)) 42 + int rc = mbedtls_base64_encode(NULL, 0, &dlen, input, length); 43 + if (rc && (rc != MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL)) 44 debug(1, "Error %d getting length of base64 encode.", rc); 45 else { 46 buf = (char *)malloc(dlen); 47 - rc = base64_encode((unsigned char *)buf, &dlen, input, length); 48 + rc = mbedtls_base64_encode((unsigned char *)buf, dlen, &dlen, input, length); 49 if (rc != 0) 50 debug(1, "Error %d encoding base64.", rc); 51 } 52 @@ -156,10 +153,10 @@ uint8_t *base64_dec(char *input, int *outlen) { 53 else { 54 strcpy(inbuf, input); 55 strcat(inbuf, "==="); 56 - // debug(1,"base64_dec called with string \"%s\", length %d, filled string: \"%s\", length 57 - // %d.",input,strlen(input),inbuf,inbufsize); 58 - int rc = base64_decode(buf, &dlen, (unsigned char *)inbuf, inbufsize); 59 - if (rc && (rc != POLARSSL_ERR_BASE64_BUFFER_TOO_SMALL)) 60 + // debug(1,"base64_dec called with string \"%s\", length %d, filled string: \"%s\", length %d.", 61 + // input,strlen(input),inbuf,inbufsize); 62 + int rc = mbedtls_base64_decode(NULL, 0, &dlen, (unsigned char *)inbuf, inbufsize); 63 + if (rc && (rc != MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL)) 64 debug(1, "Error %d getting decode length, result is %d.", rc, dlen); 65 else { 66 // debug(1,"Decode size is %d.",dlen); 67 @@ -167,7 +164,7 @@ uint8_t *base64_dec(char *input, int *outlen) { 68 if (buf == 0) 69 debug(1, "Can't allocate memory in base64_dec."); 70 else { 71 - rc = base64_decode(buf, &dlen, (unsigned char *)inbuf, inbufsize); 72 + rc = mbedtls_base64_decode(buf, dlen, &dlen, (unsigned char *)inbuf, inbufsize); 73 if (rc != 0) 74 debug(1, "Error %d in base64_dec.", rc); 75 } 76 @@ -280,58 +277,59 @@ uint8_t *rsa_apply(uint8_t *input, int inlen, int *outlen, int mode) { 77 } 78 #endif 79 80 -#ifdef HAVE_LIBPOLARSSL 81 +#ifdef HAVE_LIBMBEDTLS 82 uint8_t *rsa_apply(uint8_t *input, int inlen, int *outlen, int mode) { 83 - rsa_context trsa; 84 + mbedtls_pk_context pkctx; 85 + mbedtls_rsa_context *trsa; 86 const char *pers = "rsa_encrypt"; 87 + size_t olen = *outlen; 88 int rc; 89 90 - entropy_context entropy; 91 - ctr_drbg_context ctr_drbg; 92 - entropy_init(&entropy); 93 - if ((rc = ctr_drbg_init(&ctr_drbg, entropy_func, &entropy, (const unsigned char *)pers, 94 - strlen(pers))) != 0) 95 - debug(1, "ctr_drbg_init returned %d\n", rc); 96 + mbedtls_entropy_context entropy; 97 + mbedtls_ctr_drbg_context ctr_drbg; 98 + 99 + mbedtls_entropy_init(&entropy); 100 + 101 + mbedtls_ctr_drbg_init(&ctr_drbg); 102 + mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, 103 + (const unsigned char *)pers, strlen(pers)); 104 105 - rsa_init(&trsa, RSA_PKCS_V21, POLARSSL_MD_SHA1); // padding and hash id get overwritten 106 - // BTW, this seems to reset a lot of parameters in the rsa_context 107 - rc = x509parse_key(&trsa, (unsigned char *)super_secret_key, strlen(super_secret_key), NULL, 0); 108 + mbedtls_pk_init(&pkctx); 109 + 110 + rc = mbedtls_pk_parse_key(&pkctx, (unsigned char *)super_secret_key, sizeof(super_secret_key), NULL, 0); 111 if (rc != 0) 112 - debug(1, "Error %d reading the private key."); 113 + debug(1, "Error %d reading the private key.", rc); 114 115 - uint8_t *out = NULL; 116 + uint8_t *outbuf = NULL; 117 + trsa = mbedtls_pk_rsa(pkctx); 118 119 switch (mode) { 120 case RSA_MODE_AUTH: 121 - trsa.padding = RSA_PKCS_V15; 122 - trsa.hash_id = POLARSSL_MD_NONE; 123 - debug(2, "rsa_apply encrypt"); 124 - out = malloc(trsa.len); 125 - rc = rsa_pkcs1_encrypt(&trsa, ctr_drbg_random, &ctr_drbg, RSA_PRIVATE, inlen, input, out); 126 + mbedtls_rsa_set_padding(trsa, MBEDTLS_RSA_PKCS_V15, MBEDTLS_MD_NONE); 127 + outbuf = malloc(trsa->len); 128 + rc = mbedtls_rsa_pkcs1_encrypt(trsa, mbedtls_ctr_drbg_random, &ctr_drbg, MBEDTLS_RSA_PRIVATE, 129 + inlen, input, outbuf); 130 if (rc != 0) 131 - debug(1, "rsa_pkcs1_encrypt error %d.", rc); 132 - *outlen = trsa.len; 133 + debug(1, "mbedtls_pk_encrypt error %d.", rc); 134 + *outlen = trsa->len; 135 break; 136 case RSA_MODE_KEY: 137 - debug(2, "rsa_apply decrypt"); 138 - trsa.padding = RSA_PKCS_V21; 139 - trsa.hash_id = POLARSSL_MD_SHA1; 140 - out = malloc(trsa.len); 141 -#if POLARSSL_VERSION_NUMBER >= 0x01020900 142 - rc = rsa_pkcs1_decrypt(&trsa, ctr_drbg_random, &ctr_drbg, RSA_PRIVATE, (size_t *)outlen, input, 143 - out, trsa.len); 144 -#else 145 - rc = rsa_pkcs1_decrypt(&trsa, RSA_PRIVATE, outlen, input, out, trsa.len); 146 -#endif 147 + mbedtls_rsa_set_padding(trsa, MBEDTLS_RSA_PKCS_V21, MBEDTLS_MD_SHA1); 148 + outbuf = malloc(trsa->len); 149 + rc = mbedtls_rsa_pkcs1_decrypt(trsa, mbedtls_ctr_drbg_random, &ctr_drbg, MBEDTLS_RSA_PRIVATE, 150 + &olen, input, outbuf, trsa->len); 151 if (rc != 0) 152 - debug(1, "decrypt error %d.", rc); 153 + debug(1, "mbedtls_pk_decrypt error %d.", rc); 154 + *outlen = olen; 155 break; 156 default: 157 die("bad rsa mode"); 158 } 159 - rsa_free(&trsa); 160 - debug(2, "rsa_apply exit"); 161 - return out; 162 + 163 + mbedtls_ctr_drbg_free(&ctr_drbg); 164 + mbedtls_entropy_free(&entropy); 165 + mbedtls_pk_free(&pkctx); 166 + return outbuf; 167 } 168 #endif 169 170 @@ -517,7 +515,7 @@ ssize_t non_blocking_write(int fd, const void *buf, size_t count) { 171 void *ibuf = (void *)buf; 172 size_t bytes_remaining = count; 173 int rc = 0; 174 - struct pollfd ufds[1]; 175 + struct pollfd ufds[1]; 176 while ((bytes_remaining>0) && (rc==0)) { 177 // check that we can do some writing 178 ufds[0].fd = fd; 179 diff --git a/configure.ac b/configure.ac 180 index 8d82da4..a2d1e4f 100644 181 --- a/configure.ac 182 +++ b/configure.ac 183 @@ -108,11 +108,11 @@ AC_ARG_WITH(piddir, [ --with-piddir=<pathname> Specify a pathname to a directory 184 AM_CONDITIONAL([USE_CUSTOMPIDDIR], [test "x$HAS_CUSTOMPIDDIR" = "x1"]) 185 186 # Check --with-ssl=argument 187 -AC_ARG_WITH(ssl, [ choose --with-ssl=openssl or --with-ssl=polarssl for encryption services], [ 188 +AC_ARG_WITH(ssl, [ choose --with-ssl=openssl or --with-ssl=mbedtls for encryption services], [ 189 AC_MSG_CHECKING(encryption libraries chosen) 190 if test "x${with_ssl}" = x -o "x${with_ssl}" = xyes ; then 191 AC_MSG_RESULT(not found) 192 - AC_MSG_ERROR(choose either "openssl" or "polarssl" encryption) 193 + AC_MSG_ERROR(choose either "openssl" or "mbedtls" encryption) 194 fi 195 if test "x${with_ssl}" = xopenssl ; then 196 if test "x${with_pkg_config}" = xyes ; then 197 @@ -127,10 +127,15 @@ AC_ARG_WITH(ssl, [ choose --with-ssl=openssl or --with-ssl=polarssl for encrypti 198 AC_DEFINE([HAVE_LIBCRYPTO],[1],[Define to 1 if you have libcrypto]) 199 AC_DEFINE([HAVE_LIBSSL],[1],[Define to 1 if you have libssl]) 200 fi 201 - elif test "x${with_ssl}" = xpolarssl ; then 202 - AC_CHECK_LIB([polarssl],[ssl_init], , AC_MSG_ERROR(PolarSSL selected but the library cannot be found!)) 203 + elif test "x${with_ssl}" = xmbedtls ; then 204 + AC_CHECK_LIB([mbedtls],[mbedtls_ssl_init],, 205 + [AC_MSG_ERROR([Cannot find required libray: libmbedtls],1)]) 206 + AC_CHECK_LIB([mbedcrypto], [mbedtls_entropy_func],, 207 + [AC_MSG_ERROR([Cannot find required library: libmbedcrypto],1)]) 208 + AC_CHECK_LIB([mbedx509], [mbedtls_pk_init],, 209 + [AC_MSG_ERROR([Cannot find required library: libmbedx509],1)]) 210 else 211 - AC_MSG_ERROR(unknown option "${with_ssl}"." Please choose with "openssl" or "polarssl") 212 + AC_MSG_ERROR(unknown option "${with_ssl}"." Please choose with "openssl" or "mbedtls") 213 fi 214 ], ) 215 216 diff --git a/player.c b/player.c 217 index 97eccfb..da2d735 100644 218 --- a/player.c 219 +++ b/player.c 220 @@ -47,9 +47,9 @@ 221 222 #include "config.h" 223 224 -#ifdef HAVE_LIBPOLARSSL 225 -#include <polarssl/aes.h> 226 -#include <polarssl/havege.h> 227 +#ifdef HAVE_LIBMBEDTLS 228 +#include <mbedtls/aes.h> 229 +#include <mbedtls/havege.h> 230 #endif 231 232 #ifdef HAVE_LIBSSL 233 @@ -82,8 +82,8 @@ static int max_frame_size_change = 1; 234 // maximal resampling shift - conservative 235 //#define OUTFRAME_BYTES(frame_size) (4 * (frame_size + 3)) 236 237 -#ifdef HAVE_LIBPOLARSSL 238 -static aes_context dctx; 239 +#ifdef HAVE_LIBMBEDTLS 240 +static mbedtls_aes_context dctx; 241 #endif 242 243 //static pthread_t player_thread = NULL; 244 @@ -247,8 +247,8 @@ static int alac_decode(short *dest, int *destlen, uint8_t *buf, int len) { 245 unsigned char iv[16]; 246 int aeslen = len & ~0xf; 247 memcpy(iv, aesiv, sizeof(iv)); 248 -#ifdef HAVE_LIBPOLARSSL 249 - aes_crypt_cbc(&dctx, AES_DECRYPT, aeslen, iv, buf, packet); 250 +#ifdef HAVE_LIBMBEDTLS 251 + mbedtls_aes_crypt_cbc(&dctx, MBEDTLS_AES_DECRYPT, aeslen, iv, buf, packet); 252 #endif 253 #ifdef HAVE_LIBSSL 254 AES_cbc_encrypt(buf, packet, aeslen, &aes, iv, AES_DECRYPT); 255 @@ -1685,9 +1685,9 @@ int player_play(stream_cfg *stream, pthread_t *player_thread) { 256 die("specified buffer starting fill %d > buffer size %d", config.buffer_start_fill, 257 BUFFER_FRAMES); 258 if (encrypted) { 259 -#ifdef HAVE_LIBPOLARSSL 260 - memset(&dctx, 0, sizeof(aes_context)); 261 - aes_setkey_dec(&dctx, stream->aeskey, 128); 262 +#ifdef HAVE_LIBMBEDTLS 263 + memset(&dctx, 0, sizeof(mbedtls_aes_context)); 264 + mbedtls_aes_setkey_dec(&dctx, stream->aeskey, 128); 265 #endif 266 267 #ifdef HAVE_LIBSSL 268 diff --git a/rtsp.c b/rtsp.c 269 index 38b0745..8003803 100644 270 --- a/rtsp.c 271 +++ b/rtsp.c 272 @@ -50,8 +50,8 @@ 273 #include <openssl/md5.h> 274 #endif 275 276 -#ifdef HAVE_LIBPOLARSSL 277 -#include <polarssl/md5.h> 278 +#ifdef HAVE_LIBMBEDTLS 279 +#include <mbedtls/md5.h> 280 #endif 281 282 #include "common.h" 283 @@ -979,7 +979,7 @@ static void handle_set_parameter_parameter(rtsp_conn_info *conn, 284 // more significant changes make it not malloc memory 285 // needs to initialise the docoding table first 286 287 -// add _so to end of name to avoid confusion with polarssl's implementation 288 +// add _so to end of name to avoid confusion with SSL library implementation 289 290 static char encoding_table[] = { 291 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 292 @@ -1651,21 +1651,21 @@ static int rtsp_auth(char **nonce, rtsp_message *req, rtsp_message *resp) { 293 MD5_Final(digest_mu, &ctx); 294 #endif 295 296 -#ifdef HAVE_LIBPOLARSSL 297 - md5_context tctx; 298 - md5_starts(&tctx); 299 - md5_update(&tctx, (const unsigned char *)username, strlen(username)); 300 - md5_update(&tctx, (unsigned char *)":", 1); 301 - md5_update(&tctx, (const unsigned char *)realm, strlen(realm)); 302 - md5_update(&tctx, (unsigned char *)":", 1); 303 - md5_update(&tctx, (const unsigned char *)config.password, 304 +#ifdef HAVE_LIBMBEDTLS 305 + mbedtls_md5_context tctx; 306 + mbedtls_md5_starts(&tctx); 307 + mbedtls_md5_update(&tctx, (const unsigned char *)username, strlen(username)); 308 + mbedtls_md5_update(&tctx, (unsigned char *)":", 1); 309 + mbedtls_md5_update(&tctx, (const unsigned char *)realm, strlen(realm)); 310 + mbedtls_md5_update(&tctx, (unsigned char *)":", 1); 311 + mbedtls_md5_update(&tctx, (const unsigned char *)config.password, 312 strlen(config.password)); 313 - md5_finish(&tctx, digest_urp); 314 - md5_starts(&tctx); 315 - md5_update(&tctx, (const unsigned char *)req->method, strlen(req->method)); 316 - md5_update(&tctx, (unsigned char *)":", 1); 317 - md5_update(&tctx, (const unsigned char *)uri, strlen(uri)); 318 - md5_finish(&tctx, digest_mu); 319 + mbedtls_md5_finish(&tctx, digest_urp); 320 + mbedtls_md5_starts(&tctx); 321 + mbedtls_md5_update(&tctx, (const unsigned char *)req->method, strlen(req->method)); 322 + mbedtls_md5_update(&tctx, (unsigned char *)":", 1); 323 + mbedtls_md5_update(&tctx, (const unsigned char *)uri, strlen(uri)); 324 + mbedtls_md5_finish(&tctx, digest_mu); 325 #endif 326 327 int i; 328 @@ -1685,16 +1685,16 @@ static int rtsp_auth(char **nonce, rtsp_message *req, rtsp_message *resp) { 329 MD5_Final(digest_total, &ctx); 330 #endif 331 332 -#ifdef HAVE_LIBPOLARSSL 333 - md5_starts(&tctx); 334 - md5_update(&tctx, buf, 32); 335 - md5_update(&tctx, (unsigned char *)":", 1); 336 - md5_update(&tctx, (const unsigned char *)*nonce, strlen(*nonce)); 337 - md5_update(&tctx, (unsigned char *)":", 1); 338 +#ifdef HAVE_LIBMBEDTLS 339 + mbedtls_md5_starts(&tctx); 340 + mbedtls_md5_update(&tctx, buf, 32); 341 + mbedtls_md5_update(&tctx, (unsigned char *)":", 1); 342 + mbedtls_md5_update(&tctx, (const unsigned char *)*nonce, strlen(*nonce)); 343 + mbedtls_md5_update(&tctx, (unsigned char *)":", 1); 344 for (i = 0; i < 16; i++) 345 sprintf((char *)buf + 2 * i, "%02x", digest_mu[i]); 346 - md5_update(&tctx, buf, 32); 347 - md5_finish(&tctx, digest_total); 348 + mbedtls_md5_update(&tctx, buf, 32); 349 + mbedtls_md5_finish(&tctx, digest_total); 350 #endif 351 352 for (i = 0; i < 16; i++) 353 diff --git a/shairport.c b/shairport.c 354 index f725d60..2349447 100644 355 --- a/shairport.c 356 +++ b/shairport.c 357 @@ -42,8 +42,8 @@ 358 359 #include "config.h" 360 361 -#ifdef HAVE_LIBPOLARSSL 362 -#include <polarssl/md5.h> 363 +#ifdef HAVE_LIBMBEDTLS 364 +#include <mbedtls/md5.h> 365 #endif 366 367 #ifdef HAVE_LIBSSL 368 @@ -109,8 +109,8 @@ char* get_version_string() { 369 char* version_string = malloc(200); 370 if (version_string) { 371 strcpy(version_string, PACKAGE_VERSION); 372 - #ifdef HAVE_LIBPOLARSSL 373 - strcat(version_string, "-PolarSSL"); 374 + #ifdef HAVE_LIBMBEDTLS 375 + strcat(version_string, "-mbedTLS"); 376 #endif 377 #ifdef HAVE_LIBSSL 378 strcat(version_string, "-OpenSSL"); 379 @@ -1046,11 +1046,11 @@ int main(int argc, char **argv) { 380 MD5_Final(ap_md5, &ctx); 381 #endif 382 383 -#ifdef HAVE_LIBPOLARSSL 384 - md5_context tctx; 385 - md5_starts(&tctx); 386 - md5_update(&tctx, (unsigned char *)config.service_name, strlen(config.service_name)); 387 - md5_finish(&tctx, ap_md5); 388 +#ifdef HAVE_LIBMBEDTLS 389 + mbedtls_md5_context tctx; 390 + mbedtls_md5_starts(&tctx); 391 + mbedtls_md5_update(&tctx, (unsigned char *)config.service_name, strlen(config.service_name)); 392 + mbedtls_md5_finish(&tctx, ap_md5); 393 #endif 394 memcpy(config.hw_addr, ap_md5, sizeof(config.hw_addr)); 395 #ifdef CONFIG_METADATA