Skip to content

Commit 1c675b9

Browse files
committed
Switch mysqlnd auth to EVP_PKEY API
1 parent ef787ba commit 1c675b9

File tree

1 file changed

+26
-11
lines changed

1 file changed

+26
-11
lines changed

ext/mysqlnd/mysqlnd_auth.c

Lines changed: 26 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -700,14 +700,14 @@ mysqlnd_xor_string(char * dst, const size_t dst_len, const char * xor_str, const
700700
#include <openssl/pem.h>
701701
#include <openssl/err.h>
702702

703-
typedef RSA * mysqlnd_rsa_t;
703+
typedef EVP_PKEY * mysqlnd_rsa_t;
704704

705705
/* {{{ mysqlnd_sha256_get_rsa_from_pem */
706706
static mysqlnd_rsa_t
707707
mysqlnd_sha256_get_rsa_from_pem(const char *buf, size_t len)
708708
{
709-
BIO * bio = BIO_new_mem_buf(buf, len);
710-
RSA * ret = PEM_read_bio_RSA_PUBKEY(bio, NULL, NULL, NULL);
709+
BIO *bio = BIO_new_mem_buf(buf, len);
710+
EVP_PKEY *ret = PEM_read_bio_PUBKEY(bio, NULL, NULL, NULL);
711711
BIO_free(bio);
712712
return ret;
713713
}
@@ -718,7 +718,7 @@ static zend_uchar *
718718
mysqlnd_sha256_public_encrypt(MYSQLND_CONN_DATA * conn, mysqlnd_rsa_t server_public_key, size_t passwd_len, size_t * auth_data_len, char *xor_str)
719719
{
720720
zend_uchar * ret = NULL;
721-
size_t server_public_key_len = (size_t) RSA_size(server_public_key);
721+
size_t server_public_key_len = (size_t) EVP_PKEY_size(server_public_key);
722722

723723
DBG_ENTER("mysqlnd_sha256_public_encrypt");
724724
/*
@@ -728,16 +728,24 @@ mysqlnd_sha256_public_encrypt(MYSQLND_CONN_DATA * conn, mysqlnd_rsa_t server_pub
728728
*/
729729
if (server_public_key_len <= passwd_len + 41) {
730730
/* password message is to long */
731-
RSA_free(server_public_key);
731+
EVP_PKEY_free(server_public_key);
732732
SET_CLIENT_ERROR(conn->error_info, CR_UNKNOWN_ERROR, UNKNOWN_SQLSTATE, "password is too long");
733733
DBG_ERR("password is too long");
734734
DBG_RETURN(NULL);
735735
}
736736

737737
*auth_data_len = server_public_key_len;
738738
ret = malloc(*auth_data_len);
739-
RSA_public_encrypt(passwd_len + 1, (zend_uchar *) xor_str, ret, server_public_key, RSA_PKCS1_OAEP_PADDING);
740-
RSA_free(server_public_key);
739+
EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new(server_public_key, NULL);
740+
if (!ctx || EVP_PKEY_encrypt_init(ctx) <= 0 ||
741+
EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_OAEP_PADDING) <= 0 ||
742+
EVP_PKEY_encrypt(ctx, ret, &server_public_key_len, (zend_uchar *) xor_str, passwd_len + 1) <= 0) {
743+
DBG_ERR("encrypt failed");
744+
free(ret);
745+
ret = NULL;
746+
}
747+
EVP_PKEY_CTX_free(ctx);
748+
EVP_PKEY_free(server_public_key);
741749
DBG_RETURN(ret);
742750
}
743751
/* }}} */
@@ -1011,7 +1019,7 @@ void php_mysqlnd_scramble_sha2(zend_uchar * const buffer, const zend_uchar * con
10111019
static size_t
10121020
mysqlnd_caching_sha2_public_encrypt(MYSQLND_CONN_DATA * conn, mysqlnd_rsa_t server_public_key, size_t passwd_len, unsigned char **crypted, char *xor_str)
10131021
{
1014-
size_t server_public_key_len = (size_t) RSA_size(server_public_key);
1022+
size_t server_public_key_len = (size_t) EVP_PKEY_size(server_public_key);
10151023

10161024
DBG_ENTER("mysqlnd_caching_sha2_public_encrypt");
10171025
/*
@@ -1021,15 +1029,22 @@ mysqlnd_caching_sha2_public_encrypt(MYSQLND_CONN_DATA * conn, mysqlnd_rsa_t serv
10211029
*/
10221030
if (server_public_key_len <= passwd_len + 41) {
10231031
/* password message is to long */
1024-
RSA_free(server_public_key);
1032+
EVP_PKEY_free(server_public_key);
10251033
SET_CLIENT_ERROR(conn->error_info, CR_UNKNOWN_ERROR, UNKNOWN_SQLSTATE, "password is too long");
10261034
DBG_ERR("password is too long");
10271035
DBG_RETURN(0);
10281036
}
10291037

10301038
*crypted = emalloc(server_public_key_len);
1031-
RSA_public_encrypt(passwd_len + 1, (zend_uchar *) xor_str, *crypted, server_public_key, RSA_PKCS1_OAEP_PADDING);
1032-
RSA_free(server_public_key);
1039+
EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new(server_public_key, NULL);
1040+
if (!ctx || EVP_PKEY_encrypt_init(ctx) <= 0 ||
1041+
EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_OAEP_PADDING) <= 0 ||
1042+
EVP_PKEY_encrypt(ctx, *crypted, &server_public_key_len, (zend_uchar *) xor_str, passwd_len + 1) <= 0) {
1043+
DBG_ERR("encrypt failed");
1044+
server_public_key_len = 0;
1045+
}
1046+
EVP_PKEY_CTX_free(ctx);
1047+
EVP_PKEY_free(server_public_key);
10331048
DBG_RETURN(server_public_key_len);
10341049
}
10351050
/* }}} */

0 commit comments

Comments
 (0)