Enable X/Ed25519 support on LibreSSL 3.7.0

sfackler · Mar 15, 2023 · 0d44062 · 0d44062
1 parent 39d1436
commit 0d44062
Show file tree

Hide file tree

Showing 5 changed files with 32 additions and 28 deletions.
diff --git a/openssl-sys/src/evp.rs b/openssl-sys/src/evp.rs
@@ -10,9 +10,9 @@ pub const EVP_PKEY_RSA: c_int = NID_rsaEncryption;
 pub const EVP_PKEY_DSA: c_int = NID_dsa;
 pub const EVP_PKEY_DH: c_int = NID_dhKeyAgreement;
 pub const EVP_PKEY_EC: c_int = NID_X9_62_id_ecPublicKey;
-#[cfg(ossl111)]
+#[cfg(any(ossl111, libressl370))]
 pub const EVP_PKEY_X25519: c_int = NID_X25519;
-#[cfg(ossl111)]
+#[cfg(any(ossl111, libressl370))]
 pub const EVP_PKEY_ED25519: c_int = NID_ED25519;
 #[cfg(ossl111)]
 pub const EVP_PKEY_X448: c_int = NID_X448;

diff --git a/openssl-sys/src/handwritten/evp.rs b/openssl-sys/src/handwritten/evp.rs
@@ -230,7 +230,7 @@ cfg_if! {
     }
 }
 cfg_if! {
-    if #[cfg(ossl111)] {
+    if #[cfg(any(ossl111, libressl370))] {
         extern "C" {
             pub fn EVP_DigestSign(
                 ctx: *mut EVP_MD_CTX,
@@ -566,7 +566,7 @@ const_ptr_api! {
 }
 
 cfg_if! {
-    if #[cfg(any(ossl111))] {
+    if #[cfg(any(ossl111, libressl370))] {
         extern "C" {
             pub fn EVP_PKEY_get_raw_public_key(
                 pkey: *const EVP_PKEY,

diff --git a/openssl-sys/src/obj_mac.rs b/openssl-sys/src/obj_mac.rs
@@ -920,12 +920,16 @@ pub const NID_aes_192_cbc_hmac_sha1: c_int = 917;
 pub const NID_aes_256_cbc_hmac_sha1: c_int = 918;
 #[cfg(ossl111)]
 pub const NID_X25519: c_int = 1034;
+#[cfg(libressl370)]
+pub const NID_X25519: c_int = 950;
 #[cfg(ossl111)]
 pub const NID_X448: c_int = 1035;
 #[cfg(ossl110)]
 pub const NID_hkdf: c_int = 1036;
 #[cfg(ossl111)]
 pub const NID_ED25519: c_int = 1087;
+#[cfg(libressl370)]
+pub const NID_ED25519: c_int = 952;
 #[cfg(ossl111)]
 pub const NID_ED448: c_int = 1088;
 #[cfg(ossl111)]

diff --git a/openssl/src/pkey.rs b/openssl/src/pkey.rs
@@ -47,7 +47,7 @@ use crate::dh::Dh;
 use crate::dsa::Dsa;
 use crate::ec::EcKey;
 use crate::error::ErrorStack;
-#[cfg(any(ossl110, boringssl))]
+#[cfg(any(ossl110, boringssl, libressl370))]
 use crate::pkey_ctx::PkeyCtx;
 use crate::rsa::Rsa;
 use crate::symm::Cipher;
@@ -89,11 +89,11 @@ impl Id {
     #[cfg(ossl110)]
     pub const HKDF: Id = Id(ffi::EVP_PKEY_HKDF);
 
-    #[cfg(any(ossl111, boringssl))]
+    #[cfg(any(ossl111, boringssl, libressl370))]
     pub const ED25519: Id = Id(ffi::EVP_PKEY_ED25519);
     #[cfg(ossl111)]
     pub const ED448: Id = Id(ffi::EVP_PKEY_ED448);
-    #[cfg(any(ossl111, boringssl))]
+    #[cfg(any(ossl111, boringssl, libressl370))]
     pub const X25519: Id = Id(ffi::EVP_PKEY_X25519);
     #[cfg(ossl111)]
     pub const X448: Id = Id(ffi::EVP_PKEY_X448);
@@ -252,7 +252,7 @@ where
     /// This function only works for algorithms that support raw public keys.
     /// Currently this is: [`Id::X25519`], [`Id::ED25519`], [`Id::X448`] or [`Id::ED448`].
     #[corresponds(EVP_PKEY_get_raw_public_key)]
-    #[cfg(any(ossl111, boringssl))]
+    #[cfg(any(ossl111, boringssl, libressl370))]
     pub fn raw_public_key(&self) -> Result<Vec<u8>, ErrorStack> {
         unsafe {
             let mut len = 0;
@@ -303,7 +303,7 @@ where
     /// This function only works for algorithms that support raw private keys.
     /// Currently this is: [`Id::HMAC`], [`Id::X25519`], [`Id::ED25519`], [`Id::X448`] or [`Id::ED448`].
     #[corresponds(EVP_PKEY_get_raw_private_key)]
-    #[cfg(any(ossl111, boringssl))]
+    #[cfg(any(ossl111, boringssl, libressl370))]
     pub fn raw_private_key(&self) -> Result<Vec<u8>, ErrorStack> {
         unsafe {
             let mut len = 0;
@@ -503,7 +503,7 @@ impl PKey<Private> {
         ctx.keygen()
     }
 
-    #[cfg(any(ossl111, boringssl))]
+    #[cfg(any(ossl111, boringssl, libressl370))]
     fn generate_eddsa(id: Id) -> Result<PKey<Private>, ErrorStack> {
         let mut ctx = PkeyCtx::new_id(id)?;
         ctx.keygen_init()?;
@@ -533,7 +533,7 @@ impl PKey<Private> {
     /// assert_eq!(secret.len(), 32);
     /// # Ok(()) }
     /// ```
-    #[cfg(any(ossl111, boringssl))]
+    #[cfg(any(ossl111, boringssl, libressl370))]
     pub fn generate_x25519() -> Result<PKey<Private>, ErrorStack> {
         PKey::generate_eddsa(Id::X25519)
     }
@@ -587,7 +587,7 @@ impl PKey<Private> {
     /// assert_eq!(signature.len(), 64);
     /// # Ok(()) }
     /// ```
-    #[cfg(any(ossl111, boringssl))]
+    #[cfg(any(ossl111, boringssl, libressl370))]
     pub fn generate_ed25519() -> Result<PKey<Private>, ErrorStack> {
         PKey::generate_eddsa(Id::ED25519)
     }
@@ -737,7 +737,7 @@ impl PKey<Private> {
     ///
     /// Algorithm types that support raw private keys are HMAC, X25519, ED25519, X448 or ED448
     #[corresponds(EVP_PKEY_new_raw_private_key)]
-    #[cfg(any(ossl111, boringssl))]
+    #[cfg(any(ossl111, boringssl, libressl370))]
     pub fn private_key_from_raw_bytes(
         bytes: &[u8],
         key_type: Id,
@@ -778,7 +778,7 @@ impl PKey<Public> {
     ///
     /// Algorithm types that support raw public keys are X25519, ED25519, X448 or ED448
     #[corresponds(EVP_PKEY_new_raw_public_key)]
-    #[cfg(any(ossl111, boringssl))]
+    #[cfg(any(ossl111, boringssl, libressl370))]
     pub fn public_key_from_raw_bytes(
         bytes: &[u8],
         key_type: Id,
@@ -1084,7 +1084,7 @@ mod tests {
         assert_eq!(&g, dh_.generator());
     }
 
-    #[cfg(any(ossl111, boringssl))]
+    #[cfg(any(ossl111, boringssl, libressl370))]
     fn test_raw_public_key(gen: fn() -> Result<PKey<Private>, ErrorStack>, key_type: Id) {
         // Generate a new key
         let key = gen().unwrap();
@@ -1100,7 +1100,7 @@ mod tests {
         );
     }
 
-    #[cfg(any(ossl111, boringssl))]
+    #[cfg(any(ossl111, boringssl, libressl370))]
     fn test_raw_private_key(gen: fn() -> Result<PKey<Private>, ErrorStack>, key_type: Id) {
         // Generate a new key
         let key = gen().unwrap();
@@ -1116,25 +1116,25 @@ mod tests {
         );
     }
 
-    #[cfg(any(ossl111, boringssl))]
+    #[cfg(any(ossl111, boringssl, libressl370))]
     #[test]
     fn test_raw_public_key_bytes() {
         test_raw_public_key(PKey::generate_x25519, Id::X25519);
         test_raw_public_key(PKey::generate_ed25519, Id::ED25519);
-        #[cfg(not(boringssl))]
+        #[cfg(all(not(boringssl), not(libressl370)))]
         test_raw_public_key(PKey::generate_x448, Id::X448);
-        #[cfg(not(boringssl))]
+        #[cfg(all(not(boringssl), not(libressl370)))]
         test_raw_public_key(PKey::generate_ed448, Id::ED448);
     }
 
-    #[cfg(any(ossl111, boringssl))]
+    #[cfg(any(ossl111, boringssl, libressl370))]
     #[test]
     fn test_raw_private_key_bytes() {
         test_raw_private_key(PKey::generate_x25519, Id::X25519);
         test_raw_private_key(PKey::generate_ed25519, Id::ED25519);
-        #[cfg(not(boringssl))]
+        #[cfg(all(not(boringssl), not(libressl370)))]
         test_raw_private_key(PKey::generate_x448, Id::X448);
-        #[cfg(not(boringssl))]
+        #[cfg(all(not(boringssl), not(libressl370)))]
         test_raw_private_key(PKey::generate_ed448, Id::ED448);
     }
 

diff --git a/openssl/src/sign.rs b/openssl/src/sign.rs
@@ -290,7 +290,7 @@ impl<'a> Signer<'a> {
         self.len_intern()
     }
 
-    #[cfg(all(not(ossl111), not(boringssl)))]
+    #[cfg(all(not(ossl111), not(boringssl), not(libressl370)))]
     fn len_intern(&self) -> Result<usize, ErrorStack> {
         unsafe {
             let mut len = 0;
@@ -303,7 +303,7 @@ impl<'a> Signer<'a> {
         }
     }
 
-    #[cfg(any(ossl111, boringssl))]
+    #[cfg(any(ossl111, boringssl, libressl370))]
     fn len_intern(&self) -> Result<usize, ErrorStack> {
         unsafe {
             let mut len = 0;
@@ -360,7 +360,7 @@ impl<'a> Signer<'a> {
     /// OpenSSL documentation at [`EVP_DigestSign`].
     ///
     /// [`EVP_DigestSign`]: https://www.openssl.org/docs/man1.1.1/man3/EVP_DigestSign.html
-    #[cfg(any(ossl111, boringssl))]
+    #[cfg(any(ossl111, boringssl, libressl370))]
     pub fn sign_oneshot(
         &mut self,
         sig_buf: &mut [u8],
@@ -382,7 +382,7 @@ impl<'a> Signer<'a> {
     /// Returns the signature.
     ///
     /// This is a simple convenience wrapper over `len` and `sign_oneshot`.
-    #[cfg(any(ossl111, boringssl))]
+    #[cfg(any(ossl111, boringssl, libressl370))]
     pub fn sign_oneshot_to_vec(&mut self, data_buf: &[u8]) -> Result<Vec<u8>, ErrorStack> {
         let mut sig_buf = vec![0; self.len()?];
         let len = self.sign_oneshot(&mut sig_buf, data_buf)?;
@@ -596,7 +596,7 @@ impl<'a> Verifier<'a> {
     /// OpenSSL documentation at [`EVP_DigestVerify`].
     ///
     /// [`EVP_DigestVerify`]: https://www.openssl.org/docs/man1.1.1/man3/EVP_DigestVerify.html
-    #[cfg(any(ossl111, boringssl))]
+    #[cfg(any(ossl111, boringssl, libressl370))]
     pub fn verify_oneshot(&mut self, signature: &[u8], buf: &[u8]) -> Result<bool, ErrorStack> {
         unsafe {
             let r = ffi::EVP_DigestVerify(
@@ -846,7 +846,7 @@ mod test {
     }
 
     #[test]
-    #[cfg(any(ossl111, boringssl))]
+    #[cfg(any(ossl111, boringssl, libressl370))]
     fn eddsa() {
         let key = PKey::generate_ed25519().unwrap();