Skip to content

Commit f0792e9

Browse files
schwabeschwabe
committed
Remove code for now unsupported versions < M
closes Github #1914
1 parent 5089605 commit f0792e9

4 files changed

Lines changed: 0 additions & 164 deletions

File tree

‎main/src/main/cpp/ovpnutil/osslutil.cpp‎

Lines changed: 0 additions & 132 deletions
Original file line numberDiff line numberDiff line change
@@ -21,136 +21,4 @@
2121
extern "C" jstring Java_de_blinkt_openvpn_core_NativeUtils_getOpenSSLVersionString(JNIEnv *env, jclass jo)
2222
{
2323
return env->NewStringUTF(OPENSSL_VERSION_TEXT);
24-
}
25-
26-
static const unsigned char zeroes[] = {0, 0, 0, 0, 0, 0, 0, 0};
27-
28-
static char opensslerr[1024];
29-
extern "C" jbyteArray Java_de_blinkt_openvpn_core_NativeUtils_rsapss(JNIEnv *env,
30-
jclass,
31-
jint hashtype,
32-
jint MSBits,
33-
jint rsa_size,
34-
jbyteArray from) {
35-
36-
/*
37-
unsigned char *EM,
38-
const unsigned char *mHash,
39-
const EVP_MD *Hash, const EVP_MD *mgf1Hash,
40-
int sLen)
41-
*/
42-
43-
jbyte *data = env->GetByteArrayElements(from, nullptr);
44-
int datalen = env->GetArrayLength(from);
45-
46-
const auto *mHash = reinterpret_cast<const unsigned char *>(data);
47-
48-
const EVP_MD *Hash;
49-
50-
if (hashtype == 0) {
51-
Hash = EVP_md5();
52-
} else if (hashtype == 1) {
53-
Hash = EVP_sha1();
54-
} else if (hashtype == 2) {
55-
Hash = EVP_sha224();
56-
} else if (hashtype == 3) {
57-
Hash = EVP_sha256();
58-
} else if (hashtype == 4) {
59-
Hash = EVP_sha384();
60-
} else if (hashtype == 5) {
61-
Hash = EVP_sha512();
62-
}
63-
64-
const EVP_MD *mgf1Hash = Hash;
65-
66-
int ret = 0;
67-
int maskedDBLen, emLen;
68-
unsigned char *H, *salt = nullptr, *p;
69-
EVP_MD_CTX *ctx = nullptr;
70-
71-
int hLen = EVP_MD_get_size(Hash);
72-
int sLen = hLen; /* RSA_PSS_SALTLEN_DIGEST */
73-
74-
std::array<unsigned char, 2048> buf{};
75-
unsigned char *EM = buf.data();
76-
77-
if (hLen < 0)
78-
goto err;
79-
80-
emLen = rsa_size;
81-
if (MSBits == 0) {
82-
*EM++ = 0;
83-
emLen--;
84-
}
85-
if (emLen < hLen + 2) {
86-
goto err;
87-
}
88-
if (sLen == RSA_PSS_SALTLEN_MAX) {
89-
sLen = emLen - hLen - 2;
90-
} else if (sLen > emLen - hLen - 2) {
91-
goto err;
92-
}
93-
94-
if (sLen > 0) {
95-
salt = (unsigned char *) OPENSSL_malloc(sLen);
96-
if (salt == nullptr) {
97-
goto err;
98-
}
99-
if (RAND_bytes_ex(nullptr, salt, sLen, 0) <= 0)
100-
goto err;
101-
}
102-
maskedDBLen = emLen - hLen - 1;
103-
H = EM + maskedDBLen;
104-
ctx = EVP_MD_CTX_new();
105-
if (ctx == nullptr)
106-
goto err;
107-
if (!EVP_DigestInit_ex(ctx, Hash, nullptr)
108-
|| !EVP_DigestUpdate(ctx, zeroes, sizeof(zeroes))
109-
|| !EVP_DigestUpdate(ctx, mHash, hLen))
110-
goto err;
111-
if (sLen && !EVP_DigestUpdate(ctx, salt, sLen))
112-
goto err;
113-
if (!EVP_DigestFinal_ex(ctx, H, nullptr))
114-
goto err;
115-
116-
#pragma clang diagnostic push
117-
#pragma clang diagnostic ignored "-Wdeprecated-declarations"
118-
/* Generate dbMask in place then perform XOR on it */
119-
if (PKCS1_MGF1(EM, maskedDBLen, H, hLen, mgf1Hash))
120-
goto err;
121-
#pragma clang diagnostic pop
122-
123-
p = EM;
124-
125-
/*
126-
* Initial PS XORs with all zeroes which is a NOP so just update pointer.
127-
* Note from a test above this value is guaranteed to be non-negative.
128-
*/
129-
p += emLen - sLen - hLen - 2;
130-
*p++ ^= 0x1;
131-
if (sLen > 0) {
132-
for (int i = 0; i < sLen; i++)
133-
*p++ ^= salt[i];
134-
}
135-
if (MSBits)
136-
EM[0] &= 0xFF >> (8 - MSBits);
137-
138-
/* H is already in place so just set final 0xbc */
139-
140-
EM[emLen - 1] = 0xbc;
141-
142-
ret = 1;
143-
144-
err:
145-
EVP_MD_CTX_free(ctx);
146-
OPENSSL_clear_free(salt, (size_t) sLen); /* salt != NULL implies sLen > 0 */
147-
148-
149-
jbyteArray jb;
150-
151-
jb = env->NewByteArray(emLen);
152-
153-
env->SetByteArrayRegion(jb, 0, emLen, (jbyte *) EM);
154-
155-
return jb;
15624
}

‎main/src/main/java/de/blinkt/openvpn/VpnProfile.java‎

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1307,21 +1307,6 @@ private byte[] getKeyChainSignedData(byte[] data, OpenVPNManagement.SignaturePad
13071307
}
13081308
}
13091309

1310-
private byte[] addPSSPadding(PrivateKey privkey, String digest, byte[] data) throws NoSuchAlgorithmException {
1311-
/* For < API 23, add padding ourselves */
1312-
int hashtype = getHashtype(digest);
1313-
1314-
MessageDigest msgDigest = MessageDigest.getInstance(digest);
1315-
byte[] hash = msgDigest.digest(data);
1316-
1317-
/* MSBits = (BN_num_bits(rsa->n) - 1) & 0x7; */
1318-
int numbits = ((RSAPrivateKey) privkey).getModulus().bitLength();
1319-
1320-
int MSBits = (numbits - 1) & 0x7;
1321-
1322-
return NativeUtils.addRssPssPadding(hashtype, MSBits, numbits / 8, hash);
1323-
}
1324-
13251310
private int getHashtype(String digest) throws NoSuchAlgorithmException {
13261311
int hashtype = 0;
13271312
switch (digest) {
@@ -1361,11 +1346,6 @@ private byte[] doDigestSign(PrivateKey privkey, byte[] data, OpenVPNManagement.S
13611346
if (!"digest".equals(saltlen))
13621347
throw new SignatureException("PSS signing requires saltlen=digest");
13631348

1364-
if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M) {
1365-
data = addPSSPadding(privkey, hashalg, data);
1366-
return getKeyChainSignedData(data, OpenVPNManagement.SignaturePadding.NO_PADDING, "none", "none", false);
1367-
}
1368-
13691349
sig = Signature.getInstance(hashalg + "withRSA/PSS");
13701350

13711351
PSSParameterSpec pssspec = null;

‎main/src/main/java/de/blinkt/openvpn/core/NativeUtils.java‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,6 @@
1111
import java.security.InvalidKeyException;
1212

1313
public class NativeUtils {
14-
public static native byte[] rsasign(byte[] input, int pkey, boolean pkcs1padding) throws InvalidKeyException;
15-
1614
public static native String[] getIfconfig() throws IllegalArgumentException;
1715

1816
static native void jniclose(int fdint);
@@ -39,21 +37,13 @@ public static String getOpenSSLVersion() {
3937

4038
static boolean osslutilloaded = false;
4139

42-
public static byte[] addRssPssPadding(int hashtype, int MSBits, int rsa_size, byte[] from)
43-
{
44-
loadOsslUtil();
45-
return rsapss(hashtype, MSBits, rsa_size, from);
46-
}
47-
4840
private static void loadOsslUtil() {
4941
if (!osslutilloaded) {
5042
osslutilloaded = true;
5143
System.loadLibrary("osslutil");
5244
}
5345
}
5446

55-
private static native byte[] rsapss(int hashtype, int MSBits, int rsa_size, byte[] from);
56-
5747
public final static int[] openSSLlengths = {
5848
16, 64, 256, 1024, 1500, 8 * 1024, 16 * 1024
5949
};

‎main/src/ui/java/de/blinkt/openvpn/core/ProfileEncryption.kt‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,6 @@ internal class ProfileEncryption {
2525
private var mMasterKey: MasterKey? = null
2626
@JvmStatic
2727
fun initMasterCryptAlias(context:Context) {
28-
if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M)
29-
return
3028
try {
3129
mMasterKey = MasterKey.Builder(context)
3230
.setKeyScheme(MasterKey.KeyScheme.AES256_GCM)

0 commit comments

Comments
 (0)