OpenSSL Engine的三種加載方式

本文測試代碼基于Openssl版本：1.1.1f

創(chuàng)建一個(gè)Engine lib

#include <openssl/evp.h>
#include <openssl/engine.h>
#include <iostream>

static int encryptfn(EVP_PKEY_CTX *ctx,unsigned char *out,size_t *outlen,const unsigned char *in,size_t inlen){
  *outlen = 1;
  std::cout << "encryptfn call" << std::endl;
  return 1;
}

static int test_pkey_meths(ENGINE *e, EVP_PKEY_METHOD **pmeth,
                           const int **pnids, int nid)
{
    static const int rnid = EVP_PKEY_RSA;
    if (pmeth == NULL) {
        *pnids = &rnid;
        return 1;
    }

    if (nid == EVP_PKEY_RSA) {
        EVP_PKEY_METHOD* method{EVP_PKEY_meth_new(0,0)};
        EVP_PKEY_meth_set_encrypt(method, nullptr, encryptfn);//設(shè)置自定義方法
        *pmeth = method;
        return 1;
    }

    *pmeth = NULL;
    return 0;
}

static std::int32_t bind(ENGINE* const e, const char* const id) {
  std::int32_t ret{0};
  ENGINE_set_id(e,"test_ID");
  ENGINE_set_name(e,"test_name");

  ENGINE_set_pkey_meths(e,test_pkey_meths);

  return 1;
}

extern "C" std::int32_t bind_engine(ENGINE* const e, const char* const id,
                                    const dynamic_fns* const fns);
extern "C" std::int32_t bind_engine(ENGINE* const e, const char* const id,
                                    const dynamic_fns* const fns) {
  if (ENGINE_get_static_state() == fns->static_state) {
    if (0 == bind(e, id)) {
      return 0;
    }
    return 1;
  }

  static_cast<void>(CRYPTO_set_mem_functions(
      fns->mem_fns.malloc_fn, fns->mem_fns.realloc_fn, fns->mem_fns.free_fn));
  if (0 == bind(e, id)) {
    return 0;
  }
  return 1;
}


extern "C" uint64_t v_check(const uint64_t v) noexcept;
extern "C" uint64_t v_check(const uint64_t v) noexcept {
  if (v >= static_cast<uint64_t>(0x00030000U)) {
    return static_cast<uint64_t>(0x00030000U);
  }
  return 0U;
}

編譯動(dòng)態(tài)庫：g++ -fPIC -shared engine_evp_so.cpp -o libengine_evp.so

Engine 加載方式1：cmd加載

方法1：openssl cmd加載

> engine dynamic -pre SO_PATH:/yourpath/libengine_evp.so -pre LOAD
(dynamic) Dynamic engine loading support
[Success]: SO_PATH:/yourpath/libengine_evp.so
[Success]: LOAD
Loaded: (test_ID) test_name

方法2：進(jìn)程中調(diào)用cmd函數(shù)加載

在代碼中使用ENGINE_ctrl_cmd_string()調(diào)用cmd能力來加載engine

#include <openssl/rsa.h>
#include <openssl/engine.h>
#include <iostream>

void dump_hex(const uint8_t *hex, uint32_t size) {
  uint32_t i = 0;
  for (i = 0; i < size; ++i) {
    if ((i % 8) == 0) {
      printf("\n");
    }
    printf("0x%02x ", hex[i]);
  }
  printf("\n");
}

RSA* rsa_create(){
    RSA* rsa = RSA_new();//分配空間
    BIGNUM* pBNe = BN_new();//分配空間
    BN_set_word(pBNe, RSA_F4);
    int ret = RSA_generate_key_ex(rsa, 1024, pBNe, NULL);
    if(ret < 0 ){
        printf("encrypt failed, ret:%d \n", ret);
        return nullptr;
    }
    BN_free(pBNe);
    return rsa;
}

int main(){
  ENGINE_load_dynamic();//加載dynamic engine

  ENGINE* engine = ENGINE_by_id("dynamic");
  if(engine == nullptr){
    std::cout << "ENGINE_by_id" << std::endl;
  }
  int ret{};
  ret = ENGINE_ctrl_cmd_string(engine, "SO_PATH", "engine_evp", 0);//libengine_evp.so
  if(ret == 0){
    std::cout << "ENGINE_ctrl_cmd_string0" << std::endl;
  }
  ret = ENGINE_ctrl_cmd_string(engine, "LOAD", NULL, 0);//load engine
  if(ret == 0){
    std::cout << "ENGINE_ctrl_cmd_string1" << std::endl;
  }


  RSA* rsa = rsa_create();
  if(rsa == nullptr){
    std::cout << "Read_Key" << std::endl;
  }

  EVP_PKEY* pkey = EVP_PKEY_new();
  
  ret = EVP_PKEY_assign_RSA(pkey, rsa);
  if(ret == 0){
    std::cout << "EVP_PKEY_assign_RSA" << std::endl;
  }

  EVP_PKEY_CTX* ctx;
  ctx = EVP_PKEY_CTX_new(pkey, engine);
  if (ctx == nullptr) {
    std::cout << "EVP_PKEY_CTX_new" << std::endl;
    ERR_print_errors_fp(stderr);
  }

  ret = EVP_PKEY_encrypt_init(ctx);
  if (ret == 0) {
    std::cout << "EVP_PKEY_encrypt_init" << std::endl;
  }

  ret = EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING);
  if (ret == 0) {
    std::cout << "EVP_PKEY_CTX_set_rsa_padding" << std::endl;
  }

  int plaintext_len = 100;
  unsigned char plaintext[plaintext_len]{"123"};
  std::cout << "plaintext: " << std::endl;
  std::cout << plaintext << std::endl;

  size_t ciphertext_len;
  ret = EVP_PKEY_encrypt(ctx, nullptr, &ciphertext_len, plaintext, plaintext_len);
  if (ret == 0) {
    std::cout << "EVP_PKEY_encrypt" << std::endl;
  }

  std::cout << "ciphertext_len: " << ciphertext_len << std::endl;

  return 0;
}

運(yùn)行前記得配置環(huán)境變量：export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/DirToYourLib

Engine 加載方式2：加載conf文件

方法1：進(jìn)程中加載指定的配置文件

首先準(zhǔn)備好配置文件openssl.cnf，存放在任意位置
填入engine_id，動(dòng)態(tài)庫lib位置填入dynamic_path

openssl_conf            = openssl_def
[openssl_def]
engines = engine_section

[engine_section]
engine_test = engine_test_section

[engine_test_section]
engine_id = test_ID
dynamic_path = /yourpath/libengine_evp.so
default_algorithms = ALL
init = 1

在代碼中使用CONF_modules_load_file()手動(dòng)加載配置文件

#include <openssl/rsa.h>
#include <openssl/engine.h>
#include <openssl/conf.h>
#include <iostream>

void dump_hex(const uint8_t *hex, uint32_t size) {
  uint32_t i = 0;
  for (i = 0; i < size; ++i) {
    if ((i % 8) == 0) {
      printf("\n");
    }
    printf("0x%02x ", hex[i]);
  }
  printf("\n");
}

RSA* rsa_create(){
    RSA* rsa = RSA_new();//分配空間
    BIGNUM* pBNe = BN_new();//分配空間
    BN_set_word(pBNe, RSA_F4);
    int ret = RSA_generate_key_ex(rsa, 1024, pBNe, NULL);
    if(ret < 0 ){
        printf("encrypt failed, ret:%d \n", ret);
        return nullptr;
    }
    BN_free(pBNe);
    return rsa;
}

int main(){
  OPENSSL_load_builtin_modules();
  ENGINE_load_dynamic();
  int ret{CONF_modules_load_file("/yourpath/openssl.cnf", "openssl_conf", 0)};//讀取配置文件
  if (ret == 0) {
    std::cout << "CONF_modules_load_file" << std::endl;
  }

  ENGINE* engine = ENGINE_by_id("test_ID");//通過id找到engine
  if(engine == nullptr){
    std::cout << "ENGINE_by_id" << std::endl;
    ERR_print_errors_fp(stderr);
  }

  RSA* rsa = rsa_create();
  if(rsa == nullptr){
    std::cout << "Read_Key" << std::endl;
  }

  EVP_PKEY* pkey = EVP_PKEY_new();
  
  ret = EVP_PKEY_assign_RSA(pkey, rsa);
  if(ret == 0){
    std::cout << "EVP_PKEY_assign_RSA" << std::endl;
  }

  EVP_PKEY_CTX* ctx;
  ctx = EVP_PKEY_CTX_new(pkey, engine);//使用engine能力
  if (ctx == nullptr) {
    std::cout << "EVP_PKEY_CTX_new" << std::endl;
    ERR_print_errors_fp(stderr);
  }

  ret = EVP_PKEY_encrypt_init(ctx);
  if (ret == 0) {
    std::cout << "EVP_PKEY_encrypt_init" << std::endl;
  }

  ret = EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING);
  if (ret == 0) {
    std::cout << "EVP_PKEY_CTX_set_rsa_padding" << std::endl;
  }

  int plaintext_len = 100;
  unsigned char plaintext[plaintext_len]{"123"};
  std::cout << "plaintext: " << std::endl;
  std::cout << plaintext << std::endl;

  size_t ciphertext_len;
  ret = EVP_PKEY_encrypt(ctx, nullptr, &ciphertext_len, plaintext, plaintext_len);//先獲取ciphertext_len
  if (ret == 0) {
    std::cout << "EVP_PKEY_encrypt" << std::endl;
  }

  std::cout << "ciphertext_len: " << ciphertext_len << std::endl;

  return 0;
}

編譯：g++ engine_conf.cpp -lcrypto
無需配置環(huán)境變量

方法2：在進(jìn)程中根據(jù)環(huán)境變量自動(dòng)加載conf配置文件

配置環(huán)境變量：export OPENSSL_CONF=/path/to/openssl.cnf
代碼如下，和上小節(jié)的代碼對比，只有main函數(shù)的前幾行做修改

int main(){
  OPENSSL_config("openssl_conf"); //加載配置文件
  ENGINE* engine = ENGINE_by_id("test_ID");//根據(jù)id得到engine
  if(engine == nullptr){
    std::cout << "ENGINE_by_id" << std::endl;
    ERR_print_errors_fp(stderr);
  }

  RSA* rsa = rsa_create();
  if(rsa == nullptr){
    std::cout << "Read_Key" << std::endl;
  }

  EVP_PKEY* pkey = EVP_PKEY_new();
  
  int ret = EVP_PKEY_assign_RSA(pkey, rsa);
  if(ret == 0){
    std::cout << "EVP_PKEY_assign_RSA" << std::endl;
  }
...

總結(jié)

本文總結(jié)了三種OpenSSL Engine的加載方式，給出了編程示例

posted @ 2024-07-24 18:07 AndGate 閱讀(906) 評論(0) 收藏舉報(bào)

刷新頁面返回頂部

AndGate