OpenSSL Engine的三種載入方式

AndGate發表於2024-07-24

本文測試程式碼基於Openssl版本：1.1.1f

建立一個Engine lib

#include <openssl/evp.h>
#include <openssl/engine.h>
#include <iostream>

static int encryptfn(EVP_PKEY_CTX *ctx,unsigned char *out,size_t *outlen,const unsigned char *in,size_t inlen){
  *outlen = 1;
  std::cout << "encryptfn call" << std::endl;
  return 1;
}

static int test_pkey_meths(ENGINE *e, EVP_PKEY_METHOD **pmeth,
                           const int **pnids, int nid)
{
    static const int rnid = EVP_PKEY_RSA;
    if (pmeth == NULL) {
        *pnids = &rnid;
        return 1;
    }

    if (nid == EVP_PKEY_RSA) {
        EVP_PKEY_METHOD* method{EVP_PKEY_meth_new(0,0)};
        EVP_PKEY_meth_set_encrypt(method, nullptr, encryptfn);//設定自定義方法
        *pmeth = method;
        return 1;
    }

    *pmeth = NULL;
    return 0;
}

static std::int32_t bind(ENGINE* const e, const char* const id) {
  std::int32_t ret{0};
  ENGINE_set_id(e,"test_ID");
  ENGINE_set_name(e,"test_name");

  ENGINE_set_pkey_meths(e,test_pkey_meths);

  return 1;
}

extern "C" std::int32_t bind_engine(ENGINE* const e, const char* const id,
                                    const dynamic_fns* const fns);
extern "C" std::int32_t bind_engine(ENGINE* const e, const char* const id,
                                    const dynamic_fns* const fns) {
  if (ENGINE_get_static_state() == fns->static_state) {
    if (0 == bind(e, id)) {
      return 0;
    }
    return 1;
  }

  static_cast<void>(CRYPTO_set_mem_functions(
      fns->mem_fns.malloc_fn, fns->mem_fns.realloc_fn, fns->mem_fns.free_fn));
  if (0 == bind(e, id)) {
    return 0;
  }
  return 1;
}


extern "C" uint64_t v_check(const uint64_t v) noexcept;
extern "C" uint64_t v_check(const uint64_t v) noexcept {
  if (v >= static_cast<uint64_t>(0x00030000U)) {
    return static_cast<uint64_t>(0x00030000U);
  }
  return 0U;
}

編譯動態庫：g++ -fPIC -shared engine_evp_so.cpp -o libengine_evp.so


Engine 載入方式1：cmd載入

方法1：openssl cmd載入

> engine dynamic -pre SO_PATH:/yourpath/libengine_evp.so -pre LOAD
(dynamic) Dynamic engine loading support
[Success]: SO_PATH:/yourpath/libengine_evp.so
[Success]: LOAD
Loaded: (test_ID) test_name

方法2：程序中呼叫cmd函式載入

在程式碼中使用ENGINE_ctrl_cmd_string()呼叫cmd能力來載入engine

#include <openssl/rsa.h>
#include <openssl/engine.h>
#include <iostream>

void dump_hex(const uint8_t *hex, uint32_t size) {
  uint32_t i = 0;
  for (i = 0; i < size; ++i) {
    if ((i % 8) == 0) {
      printf("\n");
    }
    printf("0x%02x ", hex[i]);
  }
  printf("\n");
}

RSA* rsa_create(){
    RSA* rsa = RSA_new();//分配空間
    BIGNUM* pBNe = BN_new();//分配空間
    BN_set_word(pBNe, RSA_F4);
    int ret = RSA_generate_key_ex(rsa, 1024, pBNe, NULL);
    if(ret < 0 ){
        printf("encrypt failed, ret:%d \n", ret);
        return nullptr;
    }
    BN_free(pBNe);
    return rsa;
}

int main(){
  ENGINE_load_dynamic();//載入dynamic engine

  ENGINE* engine = ENGINE_by_id("dynamic");
  if(engine == nullptr){
    std::cout << "ENGINE_by_id" << std::endl;
  }
  int ret{};
  ret = ENGINE_ctrl_cmd_string(engine, "SO_PATH", "engine_evp", 0);//libengine_evp.so
  if(ret == 0){
    std::cout << "ENGINE_ctrl_cmd_string0" << std::endl;
  }
  ret = ENGINE_ctrl_cmd_string(engine, "LOAD", NULL, 0);//load engine
  if(ret == 0){
    std::cout << "ENGINE_ctrl_cmd_string1" << std::endl;
  }


  RSA* rsa = rsa_create();
  if(rsa == nullptr){
    std::cout << "Read_Key" << std::endl;
  }

  EVP_PKEY* pkey = EVP_PKEY_new();
  
  ret = EVP_PKEY_assign_RSA(pkey, rsa);
  if(ret == 0){
    std::cout << "EVP_PKEY_assign_RSA" << std::endl;
  }

  EVP_PKEY_CTX* ctx;
  ctx = EVP_PKEY_CTX_new(pkey, engine);
  if (ctx == nullptr) {
    std::cout << "EVP_PKEY_CTX_new" << std::endl;
    ERR_print_errors_fp(stderr);
  }

  ret = EVP_PKEY_encrypt_init(ctx);
  if (ret == 0) {
    std::cout << "EVP_PKEY_encrypt_init" << std::endl;
  }

  ret = EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING);
  if (ret == 0) {
    std::cout << "EVP_PKEY_CTX_set_rsa_padding" << std::endl;
  }

  int plaintext_len = 100;
  unsigned char plaintext[plaintext_len]{"123"};
  std::cout << "plaintext: " << std::endl;
  std::cout << plaintext << std::endl;

  size_t ciphertext_len;
  ret = EVP_PKEY_encrypt(ctx, nullptr, &ciphertext_len, plaintext, plaintext_len);
  if (ret == 0) {
    std::cout << "EVP_PKEY_encrypt" << std::endl;
  }

  std::cout << "ciphertext_len: " << ciphertext_len << std::endl;

  return 0;
}

執行前記得配置環境變數：export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/DirToYourLib

Engine 載入方式2：載入conf檔案

方法1：程序中載入指定的配置檔案

首先準備好配置檔案openssl.cnf，存放在任意位置
填入engine_id，動態庫lib位置填入dynamic_path

openssl_conf            = openssl_def
[openssl_def]
engines = engine_section

[engine_section]
engine_test = engine_test_section

[engine_test_section]
engine_id = test_ID
dynamic_path = /yourpath/libengine_evp.so
default_algorithms = ALL
init = 1

在程式碼中使用CONF_modules_load_file()手動載入配置檔案

#include <openssl/rsa.h>
#include <openssl/engine.h>
#include <openssl/conf.h>
#include <iostream>

void dump_hex(const uint8_t *hex, uint32_t size) {
  uint32_t i = 0;
  for (i = 0; i < size; ++i) {
    if ((i % 8) == 0) {
      printf("\n");
    }
    printf("0x%02x ", hex[i]);
  }
  printf("\n");
}

RSA* rsa_create(){
    RSA* rsa = RSA_new();//分配空間
    BIGNUM* pBNe = BN_new();//分配空間
    BN_set_word(pBNe, RSA_F4);
    int ret = RSA_generate_key_ex(rsa, 1024, pBNe, NULL);
    if(ret < 0 ){
        printf("encrypt failed, ret:%d \n", ret);
        return nullptr;
    }
    BN_free(pBNe);
    return rsa;
}

int main(){
  OPENSSL_load_builtin_modules();
  ENGINE_load_dynamic();
  int ret{CONF_modules_load_file("/yourpath/openssl.cnf", "openssl_conf", 0)};//讀取配置檔案
  if (ret == 0) {
    std::cout << "CONF_modules_load_file" << std::endl;
  }

  ENGINE* engine = ENGINE_by_id("test_ID");//透過id找到engine
  if(engine == nullptr){
    std::cout << "ENGINE_by_id" << std::endl;
    ERR_print_errors_fp(stderr);
  }

  RSA* rsa = rsa_create();
  if(rsa == nullptr){
    std::cout << "Read_Key" << std::endl;
  }

  EVP_PKEY* pkey = EVP_PKEY_new();
  
  ret = EVP_PKEY_assign_RSA(pkey, rsa);
  if(ret == 0){
    std::cout << "EVP_PKEY_assign_RSA" << std::endl;
  }

  EVP_PKEY_CTX* ctx;
  ctx = EVP_PKEY_CTX_new(pkey, engine);//使用engine能力
  if (ctx == nullptr) {
    std::cout << "EVP_PKEY_CTX_new" << std::endl;
    ERR_print_errors_fp(stderr);
  }

  ret = EVP_PKEY_encrypt_init(ctx);
  if (ret == 0) {
    std::cout << "EVP_PKEY_encrypt_init" << std::endl;
  }

  ret = EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING);
  if (ret == 0) {
    std::cout << "EVP_PKEY_CTX_set_rsa_padding" << std::endl;
  }

  int plaintext_len = 100;
  unsigned char plaintext[plaintext_len]{"123"};
  std::cout << "plaintext: " << std::endl;
  std::cout << plaintext << std::endl;

  size_t ciphertext_len;
  ret = EVP_PKEY_encrypt(ctx, nullptr, &ciphertext_len, plaintext, plaintext_len);//先獲取ciphertext_len
  if (ret == 0) {
    std::cout << "EVP_PKEY_encrypt" << std::endl;
  }

  std::cout << "ciphertext_len: " << ciphertext_len << std::endl;

  return 0;
}

編譯：g++ engine_conf.cpp -lcrypto
無需配置環境變數


方法2：在程序中根據環境變數自動載入conf配置檔案

配置環境變數：export OPENSSL_CONF=/path/to/openssl.cnf
程式碼如下，和上小節的程式碼對比，只有main函式的前幾行做修改

int main(){
  OPENSSL_config("openssl_conf"); //載入配置檔案
  ENGINE* engine = ENGINE_by_id("test_ID");//根據id得到engine
  if(engine == nullptr){
    std::cout << "ENGINE_by_id" << std::endl;
    ERR_print_errors_fp(stderr);
  }

  RSA* rsa = rsa_create();
  if(rsa == nullptr){
    std::cout << "Read_Key" << std::endl;
  }

  EVP_PKEY* pkey = EVP_PKEY_new();
  
  int ret = EVP_PKEY_assign_RSA(pkey, rsa);
  if(ret == 0){
    std::cout << "EVP_PKEY_assign_RSA" << std::endl;
  }
...

總結

本文總結了三種OpenSSL Engine的載入方式，給出了程式設計示例

相關文章