Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update.

Browse Source
This commit is contained in:
Hakase
2020-05-17 20:27:18 +09:00
parent ad9fce94c2
commit 3a6d64bb68
619 changed files with 13638 additions and 4698 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crypto/evp/digest.c
+14 -14
View File
@@ -24,7 +24,7 @@ int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)
if (ctx == NULL)
return 1;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* TODO(3.0): Temporarily no support for EVP_DigestSign* in FIPS module */
/*
* pctx should be freed by the user of EVP_MD_CTX
@@ -59,7 +59,7 @@ int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)
OPENSSL_clear_free(ctx->md_data, ctx->digest->ctx_size);
}
#if !defined(FIPS_MODE) && !defined(OPENSSL_NO_ENGINE)
#if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_ENGINE)
ENGINE_finish(ctx->engine);
#endif
@@ -94,7 +94,7 @@ int EVP_DigestInit(EVP_MD_CTX *ctx, const EVP_MD *type)
int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
{
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
ENGINE *tmpimpl = NULL;
#endif
@@ -114,7 +114,7 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
ctx->reqdigest = type;
/* TODO(3.0): Legacy work around code below. Remove this */
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
/*
* Whether it's nice or not, "Inits" can be used on "Final"'d contexts so
* this context may already have an ENGINE! Try to avoid releasing the
@@ -145,7 +145,7 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
*/
if (ctx->engine != NULL
|| impl != NULL
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
|| tmpimpl != NULL
#endif
|| (ctx->flags & EVP_MD_CTX_FLAG_NO_INIT) != 0) {
@@ -164,7 +164,7 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
/* TODO(3.0): Start of non-legacy code below */
if (type->prov == NULL) {
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
/* We only do explicit fetches inside the FIPS module */
EVPerr(EVP_F_EVP_DIGESTINIT_EX, EVP_R_INITIALIZATION_ERROR);
return 0;
@@ -205,7 +205,7 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
/* TODO(3.0): Remove legacy code below */
legacy:
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
if (type) {
if (impl != NULL) {
if (!ENGINE_init(impl)) {
@@ -257,10 +257,10 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
}
}
}
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
skip_to_init:
#endif
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/*
* TODO(3.0): Temporarily no support for EVP_DigestSign* inside FIPS module
* or when using providers.
@@ -452,7 +452,7 @@ int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in)
/* copied EVP_MD_CTX should free the copied EVP_PKEY_CTX */
EVP_MD_CTX_clear_flags(out, EVP_MD_CTX_FLAG_KEEP_PKEY_CTX);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* TODO(3.0): Temporarily no support for EVP_DigestSign* in FIPS module */
if (in->pctx != NULL) {
out->pctx = EVP_PKEY_CTX_dup(in->pctx);
@@ -468,7 +468,7 @@ int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in)
/* TODO(3.0): Remove legacy code below */
legacy:
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
/* Make sure it's safe to copy a digest context using an ENGINE */
if (in->engine && !ENGINE_init(in->engine)) {
EVPerr(EVP_F_EVP_MD_CTX_COPY_EX, ERR_R_ENGINE_LIB);
@@ -509,7 +509,7 @@ int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in)
out->update = in->update;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* TODO(3.0): Temporarily no support for EVP_DigestSign* in FIPS module */
if (in->pctx) {
out->pctx = EVP_PKEY_CTX_dup(in->pctx);
@@ -724,7 +724,7 @@ EVP_MD *evp_md_new(void)
* provider based, we know that none of its code depends on legacy
* NIDs or any functionality that use them.
*/
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* TODO(3.x) get rid of the need for legacy NIDs */
static void set_legacy_nid(const char *name, void *vlegacy_nid)
{
@@ -764,7 +764,7 @@ static void *evp_md_from_dispatch(int name_id,
return NULL;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* TODO(3.x) get rid of the need for legacy NIDs */
md->type = NID_undef;
evp_names_do_all(prov, name_id, set_legacy_nid, &md->type);
crypto/evp/e_aes.c
+5 -5
View File
@@ -71,7 +71,7 @@ typedef struct {
const unsigned char iv[16]);
} EVP_AES_XTS_CTX;
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
static const int allow_insecure_decrypt = 0;
#else
static const int allow_insecure_decrypt = 1;
@@ -2901,7 +2901,7 @@ static int aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
return rv;
}
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
/*
* See SP800-38D (GCM) Section 8 "Uniqueness requirement on IVS and keys"
*
@@ -2923,7 +2923,7 @@ static int aes_gcm_iv_generate(EVP_AES_GCM_CTX *gctx, int offset)
return 0;
return 1;
}
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
static int aes_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
const unsigned char *in, size_t len)
@@ -2937,7 +2937,7 @@ static int aes_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
if (gctx->tls_aad_len >= 0)
return aes_gcm_tls_cipher(ctx, out, in, len);
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
/*
* FIPS requires generation of AES-GCM IV's inside the FIPS module.
* The IV can still be set externally (the security policy will state that
@@ -2954,7 +2954,7 @@ static int aes_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
#else
if (!gctx->iv_set)
return -1;
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
if (in) {
if (out == NULL) {
crypto/evp/evp_cnf.c
+12 -8
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2012-2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2012-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -15,9 +15,10 @@
#include <openssl/x509v3.h>
#include <openssl/trace.h>
DEFINE_STACK_OF(CONF_VALUE)
/* Algorithm configuration module. */
/* TODO(3.0): the config module functions should be passed a library context */
static int alg_module_init(CONF_IMODULE *md, const CONF *cnf)
{
int i;
@@ -44,14 +45,17 @@ static int alg_module_init(CONF_IMODULE *md, const CONF *cnf)
}
/*
* fips_mode is deprecated and should not be used in new
* configurations. Old configurations are likely to ONLY
* have this, so we assume that no default properties have
* been set before this.
* configurations.
*/
if (m > 0)
EVP_set_default_properties(NULL, "fips=yes");
if (!EVP_default_properties_enable_fips(cnf->libctx, m > 0)) {
EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_SET_DEFAULT_PROPERTY_FAILURE);
return 0;
}
} else if (strcmp(oval->name, "default_properties") == 0) {
EVP_set_default_properties(NULL, oval->value);
if (!EVP_set_default_properties(cnf->libctx, oval->value)) {
EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_SET_DEFAULT_PROPERTY_FAILURE);
return 0;
}
} else {
EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_UNKNOWN_OPTION);
ERR_add_error_data(4, "name=", oval->name,
crypto/evp/evp_enc.c
+12 -12
View File
@@ -51,7 +51,7 @@ int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *ctx)
OPENSSL_cleanse(ctx->cipher_data, ctx->cipher->ctx_size);
}
OPENSSL_free(ctx->cipher_data);
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
ENGINE_finish(ctx->engine);
#endif
memset(ctx, 0, sizeof(*ctx));
@@ -81,7 +81,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
ENGINE *impl, const unsigned char *key,
const unsigned char *iv, int enc)
{
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
ENGINE *tmpimpl = NULL;
#endif
const EVP_CIPHER *tmpcipher;
@@ -106,7 +106,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
/* TODO(3.0): Legacy work around code below. Remove this */
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
/*
* Whether it's nice or not, "Inits" can be used on "Final"'d contexts so
* this context may already have an ENGINE! Try to avoid releasing the
@@ -127,7 +127,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
* If there are engines involved then we should use legacy handling for now.
*/
if (ctx->engine != NULL
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
|| tmpimpl != NULL
#endif
|| impl != NULL) {
@@ -321,7 +321,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
cipher = ctx->cipher;
if (cipher->prov == NULL) {
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
/* We only do explicit fetches inside the FIPS module */
EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_INITIALIZATION_ERROR);
return 0;
@@ -404,7 +404,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
ctx->encrypt = enc;
ctx->flags = flags;
}
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
if (impl != NULL) {
if (!ENGINE_init(impl)) {
EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_INITIALIZATION_ERROR);
@@ -460,7 +460,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
}
}
}
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
skip_to_init:
#endif
if (ctx->cipher == NULL)
@@ -1340,7 +1340,7 @@ int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key)
if (ctx->cipher->flags & EVP_CIPH_RAND_KEY)
return EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_RAND_KEY, 0, key);
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
return 0;
#else
{
@@ -1351,7 +1351,7 @@ int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key)
return 0;
return 1;
}
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
}
int EVP_CIPHER_CTX_copy(EVP_CIPHER_CTX *out, const EVP_CIPHER_CTX *in)
@@ -1390,7 +1390,7 @@ int EVP_CIPHER_CTX_copy(EVP_CIPHER_CTX *out, const EVP_CIPHER_CTX *in)
/* TODO(3.0): Remove legacy code below */
legacy:
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
/* Make sure it's safe to copy a cipher context using an ENGINE */
if (in->engine && !ENGINE_init(in->engine)) {
EVPerr(EVP_F_EVP_CIPHER_CTX_COPY, ERR_R_ENGINE_LIB);
@@ -1440,7 +1440,7 @@ EVP_CIPHER *evp_cipher_new(void)
* provider based, we know that none of its code depends on legacy
* NIDs or any functionality that use them.
*/
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* TODO(3.x) get rid of the need for legacy NIDs */
static void set_legacy_nid(const char *name, void *vlegacy_nid)
{
@@ -1478,7 +1478,7 @@ static void *evp_cipher_from_dispatch(const int name_id,
return NULL;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* TODO(3.x) get rid of the need for legacy NIDs */
cipher->nid = NID_undef;
evp_names_do_all(prov, name_id, set_legacy_nid, &cipher->nid);
crypto/evp/evp_err.c
+3
View File
@@ -114,6 +114,7 @@ static const ERR_STRING_DATA EVP_str_reasons[] = {
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_NO_KEYMGMT_PRESENT), "no keymgmt present"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_NO_KEY_SET), "no key set"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_NO_OPERATION_SET), "no operation set"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_NULL_MAC_PKEY_CTX), "null mac pkey ctx"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_ONLY_ONESHOT_SUPPORTED),
"only oneshot supported"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE),
@@ -132,6 +133,8 @@ static const ERR_STRING_DATA EVP_str_reasons[] = {
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_PRIVATE_KEY_ENCODE_ERROR),
"private key encode error"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_PUBLIC_KEY_NOT_RSA), "public key not rsa"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_SET_DEFAULT_PROPERTY_FAILURE),
"set default property failure"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_TOO_MANY_RECORDS), "too many records"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_UNKNOWN_CIPHER), "unknown cipher"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_UNKNOWN_DIGEST), "unknown digest"},
crypto/evp/evp_fetch.c
+35 -3
View File
@@ -301,7 +301,7 @@ void *evp_generic_fetch(OPENSSL_CTX *libctx, int operation_id,
if (ret == NULL) {
int code = EVP_R_FETCH_FAILED;
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
ERR_raise(ERR_LIB_EVP, code);
#else
ERR_raise_data(ERR_LIB_EVP, code,
@@ -339,7 +339,7 @@ void *evp_generic_fetch_by_number(OPENSSL_CTX *libctx, int operation_id,
if (ret == NULL) {
int code = EVP_R_FETCH_FAILED;
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
ERR_raise(ERR_LIB_EVP, code);
#else
{
@@ -367,10 +367,42 @@ int EVP_set_default_properties(OPENSSL_CTX *libctx, const char *propq)
if (store != NULL)
return ossl_method_store_set_global_properties(store, propq);
EVPerr(EVP_F_EVP_SET_DEFAULT_PROPERTIES, ERR_R_INTERNAL_ERROR);
EVPerr(0, ERR_R_INTERNAL_ERROR);
return 0;
}
static int evp_default_properties_merge(OPENSSL_CTX *libctx, const char *propq)
{
OSSL_METHOD_STORE *store = get_evp_method_store(libctx);
if (store != NULL)
return ossl_method_store_merge_global_properties(store, propq);
EVPerr(0, ERR_R_INTERNAL_ERROR);
return 0;
}
static int evp_default_property_is_enabled(OPENSSL_CTX *libctx,
const char *prop_name)
{
OSSL_METHOD_STORE *store = get_evp_method_store(libctx);
return ossl_method_store_global_property_is_enabled(store, prop_name);
}
int EVP_default_properties_is_fips_enabled(OPENSSL_CTX *libctx)
{
return evp_default_property_is_enabled(libctx, "fips");
}
int EVP_default_properties_enable_fips(OPENSSL_CTX *libctx, int enable)
{
const char *query = (enable != 0) ? "fips=yes" : "-fips";
return evp_default_properties_merge(libctx, query);
}
struct do_all_data_st {
void (*user_fn)(void *method, void *arg);
void *user_arg;
crypto/evp/evp_lib.c
+7 -7
View File
@@ -18,7 +18,7 @@
#include "internal/provider.h"
#include "evp_local.h"
#if !defined(FIPS_MODE)
#if !defined(FIPS_MODULE)
int EVP_CIPHER_param_to_asn1(EVP_CIPHER_CTX *c, ASN1_TYPE *type)
{
int ret = -1; /* Assume the worst */
@@ -206,7 +206,7 @@ int EVP_CIPHER_set_asn1_iv(EVP_CIPHER_CTX *c, ASN1_TYPE *type)
}
return i;
}
#endif /* !defined(FIPS_MODE) */
#endif /* !defined(FIPS_MODULE) */
/* Convert the various cipher NIDs and dummies to a proper OID NID */
int EVP_CIPHER_type(const EVP_CIPHER *ctx)
@@ -258,7 +258,7 @@ int EVP_CIPHER_type(const EVP_CIPHER *ctx)
return NID_des_cfb64;
default:
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
return NID_undef;
#else
{
@@ -548,7 +548,7 @@ const char *EVP_CIPHER_name(const EVP_CIPHER *cipher)
{
if (cipher->prov != NULL)
return evp_first_name(cipher->prov, cipher->name_id);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
return OBJ_nid2sn(EVP_CIPHER_nid(cipher));
#else
return NULL;
@@ -589,7 +589,7 @@ const char *EVP_MD_name(const EVP_MD *md)
{
if (md->prov != NULL)
return evp_first_name(md->prov, md->name_id);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
return OBJ_nid2sn(EVP_MD_nid(md));
#else
return NULL;
@@ -844,7 +844,7 @@ EVP_PKEY_CTX *EVP_MD_CTX_pkey_ctx(const EVP_MD_CTX *ctx)
return ctx->pctx;
}
#if !defined(FIPS_MODE)
#if !defined(FIPS_MODULE)
/* TODO(3.0): EVP_DigestSign* not yet supported in FIPS module */
void EVP_MD_CTX_set_pkey_ctx(EVP_MD_CTX *ctx, EVP_PKEY_CTX *pctx)
{
@@ -864,7 +864,7 @@ void EVP_MD_CTX_set_pkey_ctx(EVP_MD_CTX *ctx, EVP_PKEY_CTX *pctx)
EVP_MD_CTX_clear_flags(ctx, EVP_MD_CTX_FLAG_KEEP_PKEY_CTX);
}
}
#endif /* !defined(FIPS_MODE) */
#endif /* !defined(FIPS_MODULE) */
void *EVP_MD_CTX_md_data(const EVP_MD_CTX *ctx)
{
crypto/evp/evp_local.h
-2
View File
@@ -86,8 +86,6 @@ struct evp_keymgmt_st {
OSSL_OP_keymgmt_gen_set_template_fn *gen_set_template;
OSSL_OP_keymgmt_gen_set_params_fn *gen_set_params;
OSSL_OP_keymgmt_gen_settable_params_fn *gen_settable_params;
OSSL_OP_keymgmt_gen_get_params_fn *gen_get_params;
OSSL_OP_keymgmt_gen_gettable_params_fn *gen_gettable_params;
OSSL_OP_keymgmt_gen_fn *gen;
OSSL_OP_keymgmt_gen_cleanup_fn *gen_cleanup;
crypto/evp/exchange.c
+3 -2
View File
@@ -264,6 +264,7 @@ int EVP_PKEY_derive_init(EVP_PKEY_CTX *ctx)
return ret ? 1 : 0;
err:
evp_pkey_ctx_free_old_ops(ctx);
ctx->operation = EVP_PKEY_OP_UNDEFINED;
return 0;
@@ -275,7 +276,7 @@ int EVP_PKEY_derive_init(EVP_PKEY_CTX *ctx)
*/
ERR_pop_to_mark();
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
return 0;
#else
if (ctx->pmeth == NULL || ctx->pmeth->derive == NULL) {
@@ -323,7 +324,7 @@ int EVP_PKEY_derive_set_peer(EVP_PKEY_CTX *ctx, EVP_PKEY *peer)
return ctx->op.kex.exchange->set_peer(ctx->op.kex.exchprovctx, provkey);
legacy:
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
return ret;
#else
/*
crypto/evp/keymgmt_lib.c
+13 -3
View File
@@ -346,10 +346,19 @@ int evp_keymgmt_util_copy(EVP_PKEY *to, EVP_PKEY *from, int selection)
if (from == NULL || from->keydata == NULL)
return 0;
/*
* If |to| is unassigned, ensure it gets the same KEYMGMT as |from|,
* Note that the final setting of KEYMGMT is done further down, with
* EVP_PKEY_set_type_by_keymgmt(); we don't want to do that prematurely.
*/
if (to_keymgmt == NULL)
to_keymgmt = from->keymgmt;
if (to_keymgmt == from->keymgmt && to_keymgmt->copy != NULL) {
/* Make sure there's somewhere to copy to */
if (to_keydata == NULL
&& (to_keydata = evp_keymgmt_newdata(to_keymgmt)) == NULL) {
&& ((to_keydata = alloc_keydata = evp_keymgmt_newdata(to_keymgmt))
== NULL)) {
ERR_raise(ERR_LIB_EVP, ERR_R_MALLOC_FAILURE);
return 0;
}
@@ -375,10 +384,11 @@ int evp_keymgmt_util_copy(EVP_PKEY *to, EVP_PKEY *from, int selection)
}
/*
* In this case to_keydata was previously unallocated, try_import()
* In case to_keydata was previously unallocated, try_import()
* may have created it for us.
*/
to_keydata = import_data.keydata;
if (to_keydata == NULL)
to_keydata = alloc_keydata = import_data.keydata;
} else {
ERR_raise(ERR_LIB_EVP, EVP_R_DIFFERENT_KEY_TYPES);
return 0;
crypto/evp/keymgmt_meth.c
+1 -33
View File
@@ -39,7 +39,7 @@ static void *keymgmt_from_dispatch(int name_id,
{
EVP_KEYMGMT *keymgmt = NULL;
int setparamfncnt = 0, getparamfncnt = 0;
int setgenparamfncnt = 0, getgenparamfncnt = 0;
int setgenparamfncnt = 0;
int importfncnt = 0, exportfncnt = 0;
if ((keymgmt = keymgmt_new()) == NULL) {
@@ -77,20 +77,6 @@ static void *keymgmt_from_dispatch(int name_id,
OSSL_get_OP_keymgmt_gen_settable_params(fns);
}
break;
case OSSL_FUNC_KEYMGMT_GEN_GET_PARAMS:
if (keymgmt->gen_get_params == NULL) {
getgenparamfncnt++;
keymgmt->gen_get_params =
OSSL_get_OP_keymgmt_gen_get_params(fns);
}
break;
case OSSL_FUNC_KEYMGMT_GEN_GETTABLE_PARAMS:
if (keymgmt->gen_gettable_params == NULL) {
getgenparamfncnt++;
keymgmt->gen_gettable_params =
OSSL_get_OP_keymgmt_gen_gettable_params(fns);
}
break;
case OSSL_FUNC_KEYMGMT_GEN:
if (keymgmt->gen == NULL)
keymgmt->gen = OSSL_get_OP_keymgmt_gen(fns);
@@ -186,7 +172,6 @@ static void *keymgmt_from_dispatch(int name_id,
|| (getparamfncnt != 0 && getparamfncnt != 2)
|| (setparamfncnt != 0 && setparamfncnt != 2)
|| (setgenparamfncnt != 0 && setgenparamfncnt != 2)
|| (getgenparamfncnt != 0 && getgenparamfncnt != 2)
|| (importfncnt != 0 && importfncnt != 2)
|| (exportfncnt != 0 && exportfncnt != 2)
|| (keymgmt->gen != NULL
@@ -342,23 +327,6 @@ const OSSL_PARAM *evp_keymgmt_gen_settable_params(const EVP_KEYMGMT *keymgmt)
return keymgmt->gen_settable_params(provctx);
}
int evp_keymgmt_gen_get_params(const EVP_KEYMGMT *keymgmt, void *genctx,
OSSL_PARAM params[])
{
if (keymgmt->gen_get_params == NULL)
return 0;
return keymgmt->gen_get_params(genctx, params);
}
const OSSL_PARAM *evp_keymgmt_gen_gettable_params(const EVP_KEYMGMT *keymgmt)
{
void *provctx = ossl_provider_ctx(EVP_KEYMGMT_provider(keymgmt));
if (keymgmt->gen_gettable_params == NULL)
return NULL;
return keymgmt->gen_gettable_params(provctx);
}
void *evp_keymgmt_gen(const EVP_KEYMGMT *keymgmt, void *genctx,
OSSL_CALLBACK *cb, void *cbarg)
{
crypto/evp/m_sigver.c
+23 -16
View File
@@ -16,7 +16,7 @@
#include "internal/provider.h"
#include "evp_local.h"
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
static int update(EVP_MD_CTX *ctx, const void *data, size_t datalen)
{
@@ -71,6 +71,9 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
locpctx = ctx->pctx;
evp_pkey_ctx_free_old_ops(locpctx);
if (props == NULL)
props = locpctx->propquery;
/*
* TODO when we stop falling back to legacy, this and the ERR_pop_to_mark()
* calls can be removed.
@@ -142,7 +145,7 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
locpctx->operation = ver ? EVP_PKEY_OP_VERIFYCTX
: EVP_PKEY_OP_SIGNCTX;
locpctx->op.sig.sigprovctx
= signature->newctx(ossl_provider_ctx(signature->prov));
= signature->newctx(ossl_provider_ctx(signature->prov), props);
if (locpctx->op.sig.sigprovctx == NULL) {
ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
goto err;
@@ -182,14 +185,14 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
goto err;
}
ret = signature->digest_verify_init(locpctx->op.sig.sigprovctx,
mdname, props, provkey);
mdname, provkey);
} else {
if (signature->digest_sign_init == NULL) {
ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
goto err;
}
ret = signature->digest_sign_init(locpctx->op.sig.sigprovctx,
mdname, props, provkey);
mdname, provkey);
}
return ret ? 1 : 0;
@@ -317,11 +320,13 @@ int EVP_DigestSignUpdate(EVP_MD_CTX *ctx, const void *data, size_t dsize)
data, dsize);
legacy:
/* do_sigver_init() checked that |digest_custom| is non-NULL */
if (pctx->flag_call_digest_custom
&& !ctx->pctx->pmeth->digest_custom(ctx->pctx, ctx))
return 0;
pctx->flag_call_digest_custom = 0;
if (pctx != NULL) {
/* do_sigver_init() checked that |digest_custom| is non-NULL */
if (pctx->flag_call_digest_custom
&& !ctx->pctx->pmeth->digest_custom(ctx->pctx, ctx))
return 0;
pctx->flag_call_digest_custom = 0;
}
return EVP_DigestUpdate(ctx, data, dsize);
}
@@ -345,16 +350,18 @@ int EVP_DigestVerifyUpdate(EVP_MD_CTX *ctx, const void *data, size_t dsize)
data, dsize);
legacy:
/* do_sigver_init() checked that |digest_custom| is non-NULL */
if (pctx->flag_call_digest_custom
&& !ctx->pctx->pmeth->digest_custom(ctx->pctx, ctx))
return 0;
pctx->flag_call_digest_custom = 0;
if (pctx != NULL) {
/* do_sigver_init() checked that |digest_custom| is non-NULL */
if (pctx->flag_call_digest_custom
&& !ctx->pctx->pmeth->digest_custom(ctx->pctx, ctx))
return 0;
pctx->flag_call_digest_custom = 0;
}
return EVP_DigestUpdate(ctx, data, dsize);
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
int EVP_DigestSignFinal(EVP_MD_CTX *ctx, unsigned char *sigret,
size_t *siglen)
{
@@ -550,4 +557,4 @@ int EVP_DigestVerify(EVP_MD_CTX *ctx, const unsigned char *sigret,
return -1;
return EVP_DigestVerifyFinal(ctx, sigret, siglen);
}
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
crypto/evp/p_lib.c
+236 -79
View File
@@ -28,6 +28,7 @@
#include <openssl/cmac.h>
#include <openssl/engine.h>
#include <openssl/params.h>
#include <openssl/param_build.h>
#include <openssl/serializer.h>
#include <openssl/core_names.h>
@@ -36,6 +37,7 @@
#include "internal/evp.h"
#include "internal/provider.h"
#include "evp_local.h"
DEFINE_STACK_OF(X509_ATTRIBUTE)
#include "crypto/ec.h"
@@ -46,7 +48,7 @@ static int pkey_set_type(EVP_PKEY *pkey, ENGINE *e, int type, const char *str,
int len, EVP_KEYMGMT *keymgmt);
static void evp_pkey_free_it(EVP_PKEY *key);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* The type of parameters selected in key parameter functions */
# define SELECT_PARAMETERS OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS
@@ -229,9 +231,11 @@ static int evp_pkey_cmp_any(const EVP_PKEY *a, const EVP_PKEY *b,
* us to compare types using legacy NIDs.
*/
if ((a->type != EVP_PKEY_NONE
&& !EVP_KEYMGMT_is_a(b->keymgmt, OBJ_nid2sn(a->type)))
&& (b->keymgmt == NULL
|| !EVP_KEYMGMT_is_a(b->keymgmt, OBJ_nid2sn(a->type))))
|| (b->type != EVP_PKEY_NONE
&& !EVP_KEYMGMT_is_a(a->keymgmt, OBJ_nid2sn(b->type))))
&& (a->keymgmt == NULL
|| !EVP_KEYMGMT_is_a(a->keymgmt, OBJ_nid2sn(b->type)))))
return -1; /* not the same key type */
/*
@@ -317,78 +321,213 @@ int EVP_PKEY_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
return -2;
}
EVP_PKEY *EVP_PKEY_new_raw_private_key(int type, ENGINE *e,
const unsigned char *priv,
size_t len)
{
EVP_PKEY *ret = EVP_PKEY_new();
if (ret == NULL
|| !pkey_set_type(ret, e, type, NULL, -1, NULL)) {
static EVP_PKEY *new_raw_key_int(OPENSSL_CTX *libctx,
const char *strtype,
const char *propq,
int nidtype,
ENGINE *e,
const unsigned char *key,
size_t len,
int key_is_priv)
{
EVP_PKEY *pkey = NULL;
EVP_PKEY_CTX *ctx = NULL;
const EVP_PKEY_ASN1_METHOD *ameth = NULL;
int result = 0;
# ifndef OPENSSL_NO_ENGINE
/* Check if there is an Engine for this type */
if (e == NULL) {
ENGINE *tmpe = NULL;
if (strtype != NULL)
ameth = EVP_PKEY_asn1_find_str(&tmpe, strtype, -1);
else if (nidtype != EVP_PKEY_NONE)
ameth = EVP_PKEY_asn1_find(&tmpe, nidtype);
/* If tmpe is NULL then no engine is claiming to support this type */
if (tmpe == NULL)
ameth = NULL;
ENGINE_finish(tmpe);
}
# endif
if (e == NULL && ameth == NULL) {
/*
* No engine is claiming to support this type, so lets see if we have
* a provider.
*/
ctx = EVP_PKEY_CTX_new_from_name(libctx,
strtype != NULL ? strtype
: OBJ_nid2sn(nidtype),
propq);
if (ctx == NULL) {
EVPerr(0, ERR_R_MALLOC_FAILURE);
goto err;
}
/* May fail if no provider available */
ERR_set_mark();
if (EVP_PKEY_key_fromdata_init(ctx) == 1) {
OSSL_PARAM params[] = { OSSL_PARAM_END, OSSL_PARAM_END };
ERR_clear_last_mark();
params[0] = OSSL_PARAM_construct_octet_string(
key_is_priv ? OSSL_PKEY_PARAM_PRIV_KEY
: OSSL_PKEY_PARAM_PUB_KEY,
(void *)key, len);
if (EVP_PKEY_fromdata(ctx, &pkey, params) != 1) {
EVPerr(0, EVP_R_KEY_SETUP_FAILED);
goto err;
}
EVP_PKEY_CTX_free(ctx);
return pkey;
}
ERR_pop_to_mark();
/* else not supported so fallback to legacy */
}
/* Legacy code path */
pkey = EVP_PKEY_new();
if (pkey == NULL) {
EVPerr(0, ERR_R_MALLOC_FAILURE);
goto err;
}
if (!pkey_set_type(pkey, e, nidtype, strtype, -1, NULL)) {
/* EVPerr already called */
goto err;
}
if (ret->ameth->set_priv_key == NULL) {
EVPerr(EVP_F_EVP_PKEY_NEW_RAW_PRIVATE_KEY,
EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
if (!ossl_assert(pkey->ameth != NULL))
goto err;
if (key_is_priv) {
if (pkey->ameth->set_priv_key == NULL) {
EVPerr(0, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
goto err;
}
if (!pkey->ameth->set_priv_key(pkey, key, len)) {
EVPerr(0, EVP_R_KEY_SETUP_FAILED);
goto err;
}
} else {
if (pkey->ameth->set_pub_key == NULL) {
EVPerr(0, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
goto err;
}
if (!pkey->ameth->set_pub_key(pkey, key, len)) {
EVPerr(0, EVP_R_KEY_SETUP_FAILED);
goto err;
}
}
if (!ret->ameth->set_priv_key(ret, priv, len)) {
EVPerr(EVP_F_EVP_PKEY_NEW_RAW_PRIVATE_KEY, EVP_R_KEY_SETUP_FAILED);
goto err;
}
return ret;
result = 1;
err:
EVP_PKEY_free(ret);
return NULL;
if (!result) {
EVP_PKEY_free(pkey);
pkey = NULL;
}
EVP_PKEY_CTX_free(ctx);
return pkey;
}
EVP_PKEY *EVP_PKEY_new_raw_private_key_with_libctx(OPENSSL_CTX *libctx,
const char *keytype,
const char *propq,
const unsigned char *priv,
size_t len)
{
return new_raw_key_int(libctx, keytype, propq, EVP_PKEY_NONE, NULL, priv,
len, 1);
}
EVP_PKEY *EVP_PKEY_new_raw_private_key(int type, ENGINE *e,
const unsigned char *priv,
size_t len)
{
return new_raw_key_int(NULL, NULL, NULL, type, e, priv, len, 1);
}
EVP_PKEY *EVP_PKEY_new_raw_public_key_with_libctx(OPENSSL_CTX *libctx,
const char *keytype,
const char *propq,
const unsigned char *pub,
size_t len)
{
return new_raw_key_int(libctx, keytype, propq, EVP_PKEY_NONE, NULL, pub,
len, 0);
}
EVP_PKEY *EVP_PKEY_new_raw_public_key(int type, ENGINE *e,
const unsigned char *pub,
size_t len)
{
EVP_PKEY *ret = EVP_PKEY_new();
return new_raw_key_int(NULL, NULL, NULL, type, e, pub, len, 0);
}
if (ret == NULL
|| !pkey_set_type(ret, e, type, NULL, -1, NULL)) {
/* EVPerr already called */
goto err;
struct raw_key_details_st
{
unsigned char **key;
size_t *len;
int selection;
};
static OSSL_CALLBACK get_raw_key_details;
static int get_raw_key_details(const OSSL_PARAM params[], void *arg)
{
const OSSL_PARAM *p = NULL;
struct raw_key_details_st *raw_key = arg;
if (raw_key->selection == OSSL_KEYMGMT_SELECT_PRIVATE_KEY) {
if ((p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_PRIV_KEY))
!= NULL)
return OSSL_PARAM_get_octet_string(p, (void **)raw_key->key,
SIZE_MAX, raw_key->len);
} else if (raw_key->selection == OSSL_KEYMGMT_SELECT_PUBLIC_KEY) {
if ((p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_PUB_KEY))
!= NULL)
return OSSL_PARAM_get_octet_string(p, (void **)raw_key->key,
SIZE_MAX, raw_key->len);
}
if (ret->ameth->set_pub_key == NULL) {
EVPerr(EVP_F_EVP_PKEY_NEW_RAW_PUBLIC_KEY,
EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
goto err;
}
if (!ret->ameth->set_pub_key(ret, pub, len)) {
EVPerr(EVP_F_EVP_PKEY_NEW_RAW_PUBLIC_KEY, EVP_R_KEY_SETUP_FAILED);
goto err;
}
return ret;
err:
EVP_PKEY_free(ret);
return NULL;
return 0;
}
int EVP_PKEY_get_raw_private_key(const EVP_PKEY *pkey, unsigned char *priv,
size_t *len)
{
/* TODO(3.0) Do we need to do anything about provider side keys? */
if (pkey->ameth->get_priv_key == NULL) {
EVPerr(EVP_F_EVP_PKEY_GET_RAW_PRIVATE_KEY,
EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
if (pkey->keymgmt != NULL) {
struct raw_key_details_st raw_key;
raw_key.key = priv == NULL ? NULL : &priv;
raw_key.len = len;
raw_key.selection = OSSL_KEYMGMT_SELECT_PRIVATE_KEY;
return evp_keymgmt_export(pkey->keymgmt, pkey->keydata,
OSSL_KEYMGMT_SELECT_PRIVATE_KEY,
get_raw_key_details, &raw_key);
}
if (pkey->ameth == NULL) {
EVPerr(0, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
return 0;
}
if (pkey->ameth->get_priv_key == NULL) {
EVPerr(0, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
return 0;
}
if (!pkey->ameth->get_priv_key(pkey, priv, len)) {
EVPerr(EVP_F_EVP_PKEY_GET_RAW_PRIVATE_KEY, EVP_R_GET_RAW_KEY_FAILED);
EVPerr(0, EVP_R_GET_RAW_KEY_FAILED);
return 0;
}
@@ -398,7 +537,23 @@ int EVP_PKEY_get_raw_private_key(const EVP_PKEY *pkey, unsigned char *priv,
int EVP_PKEY_get_raw_public_key(const EVP_PKEY *pkey, unsigned char *pub,
size_t *len)
{
/* TODO(3.0) Do we need to do anything about provider side keys? */
if (pkey->keymgmt != NULL) {
struct raw_key_details_st raw_key;
raw_key.key = pub == NULL ? NULL : &pub;
raw_key.len = len;
raw_key.selection = OSSL_KEYMGMT_SELECT_PUBLIC_KEY;
return evp_keymgmt_export(pkey->keymgmt, pkey->keydata,
OSSL_KEYMGMT_SELECT_PUBLIC_KEY,
get_raw_key_details, &raw_key);
}
if (pkey->ameth == NULL) {
EVPerr(0, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
return 0;
}
if (pkey->ameth->get_pub_key == NULL) {
EVPerr(EVP_F_EVP_PKEY_GET_RAW_PUBLIC_KEY,
EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
@@ -655,9 +810,9 @@ DSA *EVP_PKEY_get1_DSA(EVP_PKEY *pkey)
return ret;
}
# endif /* OPENSSL_NO_DSA */
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
# ifndef OPENSSL_NO_EC
int EVP_PKEY_set1_EC_KEY(EVP_PKEY *pkey, EC_KEY *key)
{
@@ -751,7 +906,7 @@ int EVP_PKEY_base_id(const EVP_PKEY *pkey)
int EVP_PKEY_is_a(const EVP_PKEY *pkey, const char *name)
{
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (pkey->keymgmt == NULL) {
/*
* These hard coded cases are pure hackery to get around the fact
@@ -1063,9 +1218,9 @@ size_t EVP_PKEY_get1_tls_encodedpoint(EVP_PKEY *pkey, unsigned char **ppt)
return rv;
}
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
/*- All methods below can also be used in FIPS_MODE */
/*- All methods below can also be used in FIPS_MODULE */
EVP_PKEY *EVP_PKEY_new(void)
{
@@ -1084,7 +1239,7 @@ EVP_PKEY *EVP_PKEY_new(void)
EVPerr(EVP_F_EVP_PKEY_NEW, ERR_R_MALLOC_FAILURE);
goto err;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_EVP_PKEY, ret, &ret->ex_data)) {
EVPerr(EVP_F_EVP_PKEY_NEW, ERR_R_MALLOC_FAILURE);
goto err;
@@ -1114,7 +1269,7 @@ EVP_PKEY *EVP_PKEY_new(void)
static int pkey_set_type(EVP_PKEY *pkey, ENGINE *e, int type, const char *str,
int len, EVP_KEYMGMT *keymgmt)
{
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
const EVP_PKEY_ASN1_METHOD *ameth = NULL;
ENGINE **eptr = (e == NULL) ? &e : NULL;
#endif
@@ -1132,13 +1287,13 @@ static int pkey_set_type(EVP_PKEY *pkey, ENGINE *e, int type, const char *str,
if (pkey != NULL) {
int free_it = 0;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
free_it = free_it || pkey->pkey.ptr != NULL;
#endif
free_it = free_it || pkey->keydata != NULL;
if (free_it)
evp_pkey_free_it(pkey);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/*
* If key type matches and a method exists then this lookup has
* succeeded once so just indicate success.
@@ -1156,7 +1311,7 @@ static int pkey_set_type(EVP_PKEY *pkey, ENGINE *e, int type, const char *str,
# endif
#endif
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (str != NULL)
ameth = EVP_PKEY_asn1_find_str(eptr, str, len);
else if (type != EVP_PKEY_NONE)
@@ -1171,7 +1326,7 @@ static int pkey_set_type(EVP_PKEY *pkey, ENGINE *e, int type, const char *str,
{
int check = 1;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
check = check && ameth == NULL;
#endif
check = check && keymgmt == NULL;
@@ -1191,7 +1346,7 @@ static int pkey_set_type(EVP_PKEY *pkey, ENGINE *e, int type, const char *str,
pkey->save_type = type;
pkey->type = type;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/*
* If the internal "origin" key is provider side, don't save |ameth|.
* The main reason is that |ameth| is one factor to detect that the
@@ -1209,16 +1364,18 @@ static int pkey_set_type(EVP_PKEY *pkey, ENGINE *e, int type, const char *str,
* to the |save_type| field, because |type| is supposed to be set
* to EVP_PKEY_NONE in that case.
*/
if (keymgmt != NULL)
pkey->save_type = ameth->pkey_id;
else if (pkey->ameth != NULL)
pkey->type = ameth->pkey_id;
if (ameth != NULL) {
if (keymgmt != NULL)
pkey->save_type = ameth->pkey_id;
else if (pkey->ameth != NULL)
pkey->type = ameth->pkey_id;
}
#endif
}
return 1;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
static void find_ameth(const char *name, void *data)
{
const char **str = data;
@@ -1243,7 +1400,7 @@ static void find_ameth(const char *name, void *data)
int EVP_PKEY_set_type_by_keymgmt(EVP_PKEY *pkey, EVP_KEYMGMT *keymgmt)
{
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
# define EVP_PKEY_TYPE_STR str[0]
# define EVP_PKEY_TYPE_STRLEN (str[0] == NULL ? -1 : (int)strlen(str[0]))
/*
@@ -1282,7 +1439,7 @@ int EVP_PKEY_up_ref(EVP_PKEY *pkey)
return ((i > 1) ? 1 : 0);
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
void evp_pkey_free_legacy(EVP_PKEY *x)
{
if (x->ameth != NULL) {
@@ -1298,14 +1455,14 @@ void evp_pkey_free_legacy(EVP_PKEY *x)
# endif
x->type = EVP_PKEY_NONE;
}
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
static void evp_pkey_free_it(EVP_PKEY *x)
{
/* internal function; x is never NULL */
evp_keymgmt_util_clear_operation_cache(x);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
evp_pkey_free_legacy(x);
#endif
@@ -1330,11 +1487,11 @@ void EVP_PKEY_free(EVP_PKEY *x)
return;
REF_ASSERT_ISNT(i < 0);
evp_pkey_free_it(x);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
CRYPTO_free_ex_data(CRYPTO_EX_INDEX_EVP_PKEY, x, &x->ex_data);
#endif
CRYPTO_THREAD_lock_free(x->lock);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
sk_X509_ATTRIBUTE_pop_free(x->attributes, X509_ATTRIBUTE_free);
#endif
OPENSSL_free(x);
@@ -1346,7 +1503,7 @@ int EVP_PKEY_size(const EVP_PKEY *pkey)
if (pkey != NULL) {
size = pkey->cache.size;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (pkey->ameth != NULL && pkey->ameth->pkey_size != NULL)
size = pkey->ameth->pkey_size(pkey);
#endif
@@ -1368,14 +1525,14 @@ void *evp_pkey_export_to_provider(EVP_PKEY *pk, OPENSSL_CTX *libctx,
/* No key data => nothing to export */
check = 1;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
check = check && pk->pkey.ptr == NULL;
#endif
check = check && pk->keydata == NULL;
if (check)
return NULL;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (pk->pkey.ptr != NULL) {
/*
* If the legacy key doesn't have an dirty counter or export function,
@@ -1407,7 +1564,7 @@ void *evp_pkey_export_to_provider(EVP_PKEY *pk, OPENSSL_CTX *libctx,
if (tmp_keymgmt == NULL)
goto end;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
if (pk->pkey.ptr != NULL) {
size_t i = 0;
@@ -1479,7 +1636,7 @@ void *evp_pkey_export_to_provider(EVP_PKEY *pk, OPENSSL_CTX *libctx,
pk->dirty_cnt_copy = pk->ameth->dirty_cnt(pk);
goto end;
}
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
keydata = evp_keymgmt_util_export_to_provider(pk, tmp_keymgmt);
@@ -1499,7 +1656,7 @@ void *evp_pkey_export_to_provider(EVP_PKEY *pk, OPENSSL_CTX *libctx,
return keydata;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
int evp_pkey_downgrade(EVP_PKEY *pk)
{
EVP_KEYMGMT *keymgmt = pk->keymgmt;
@@ -1605,7 +1762,7 @@ int evp_pkey_downgrade(EVP_PKEY *pk)
evp_keymgmt_util_cache_keyinfo(pk);
return 0; /* No downgrade, but at least the key is restored */
}
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
const OSSL_PARAM *EVP_PKEY_gettable_params(EVP_PKEY *pkey)
{
crypto/evp/pkey_mac.c
+26 -17
View File
@@ -308,11 +308,14 @@ static int pkey_mac_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
OSSL_PARAM params[3];
size_t params_n = 0;
char *ciphname = (char *)OBJ_nid2sn(EVP_CIPHER_nid(p2));
#ifndef OPENSSL_NO_ENGINE
char *engineid = (char *)ENGINE_get_id(ctx->engine);
params[params_n++] =
OSSL_PARAM_construct_utf8_string("engine", engineid, 0);
#ifndef OPENSSL_NO_ENGINE
if (ctx->engine != NULL) {
char *engid = (char *)ENGINE_get_id(ctx->engine);
params[params_n++] =
OSSL_PARAM_construct_utf8_string("engine", engid, 0);
}
#endif
params[params_n++] =
OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_CIPHER,
@@ -458,13 +461,14 @@ static int pkey_mac_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
size_t params_n = 0;
char *mdname =
(char *)OBJ_nid2sn(EVP_MD_nid(hctx->raw_data.md));
#ifndef OPENSSL_NO_ENGINE
char *engineid = ctx->engine == NULL
? NULL : (char *)ENGINE_get_id(ctx->engine);
if (engineid != NULL)
#ifndef OPENSSL_NO_ENGINE
if (ctx->engine != NULL) {
char *engid = (char *)ENGINE_get_id(ctx->engine);
params[params_n++] =
OSSL_PARAM_construct_utf8_string("engine", engineid, 0);
OSSL_PARAM_construct_utf8_string("engine", engid, 0);
}
#endif
params[params_n++] =
OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST,
@@ -493,13 +497,24 @@ static int pkey_mac_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
}
static int pkey_mac_ctrl_str(EVP_PKEY_CTX *ctx,
const char *type, const char *value)
const char *type, const char *value)
{
MAC_PKEY_CTX *hctx = EVP_PKEY_CTX_get_data(ctx);
const EVP_MAC *mac = EVP_MAC_CTX_mac(hctx->ctx);
const EVP_MAC *mac;
OSSL_PARAM params[2];
int ok = 0;
if (hctx == NULL) {
EVPerr(0, EVP_R_NULL_MAC_PKEY_CTX);
return 0;
}
if (hctx->ctx == NULL) {
/* This actually means the fetch failed during the init call */
EVPerr(0, EVP_R_FETCH_FAILED);
return 0;
}
mac = EVP_MAC_CTX_mac(hctx->ctx);
/*
* Translation of some control names that are equivalent to a single
* parameter name.
@@ -520,12 +535,6 @@ static int pkey_mac_ctrl_str(EVP_PKEY_CTX *ctx,
return 0;
params[1] = OSSL_PARAM_construct_end();
if (hctx->ctx == NULL) {
/* This actually means the fetch failed during the init call */
EVPerr(0, EVP_R_FETCH_FAILED);
return 0;
}
ok = EVP_MAC_CTX_set_params(hctx->ctx, params);
OPENSSL_free(params[0].data);
return ok;
crypto/evp/pmeth_check.c
+3 -3
View File
@@ -38,7 +38,7 @@ int EVP_PKEY_public_check(EVP_PKEY_CTX *ctx)
if (pkey->type == EVP_PKEY_NONE)
goto not_supported;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* legacy */
/* call customized public key check function first */
if (ctx->pmeth->public_check != NULL)
@@ -76,7 +76,7 @@ int EVP_PKEY_param_check(EVP_PKEY_CTX *ctx)
if (pkey->type == EVP_PKEY_NONE)
goto not_supported;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* legacy */
/* call customized param check function first */
if (ctx->pmeth->param_check != NULL)
@@ -156,7 +156,7 @@ int EVP_PKEY_check(EVP_PKEY_CTX *ctx)
if (pkey->type == EVP_PKEY_NONE)
goto not_supported;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* legacy */
/* call customized check function first */
if (ctx->pmeth->check != NULL)
crypto/evp/pmeth_fn.c
+4 -5
View File
@@ -126,11 +126,8 @@ static int evp_pkey_asym_cipher_init(EVP_PKEY_CTX *ctx, int operation)
goto err;
}
if (ret <= 0) {
cipher->freectx(ctx->op.ciph.ciphprovctx);
ctx->op.ciph.ciphprovctx = NULL;
if (ret <= 0)
goto err;
}
return 1;
legacy:
@@ -162,8 +159,10 @@ static int evp_pkey_asym_cipher_init(EVP_PKEY_CTX *ctx, int operation)
}
err:
if (ret <= 0)
if (ret <= 0) {
evp_pkey_ctx_free_old_ops(ctx);
ctx->operation = EVP_PKEY_OP_UNDEFINED;
}
return ret;
}
crypto/evp/pmeth_gn.c
+14 -11
View File
@@ -20,7 +20,7 @@
#include "crypto/evp.h"
#include "evp_local.h"
#if !defined(FIPS_MODE) && !defined(OPENSSL_NO_EC)
#if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_EC)
# define TMP_SM2_HACK
#endif
@@ -69,7 +69,7 @@ static int gen_init(EVP_PKEY_CTX *ctx, int operation)
goto end;
legacy:
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
goto not_supported;
#else
if (ctx->pmeth == NULL
@@ -93,8 +93,10 @@ static int gen_init(EVP_PKEY_CTX *ctx, int operation)
#endif
end:
if (ret <= 0)
if (ret <= 0 && ctx != NULL) {
evp_pkey_ctx_free_old_ops(ctx);
ctx->operation = EVP_PKEY_OP_UNDEFINED;
}
return ret;
not_supported:
@@ -189,7 +191,7 @@ int EVP_PKEY_gen(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey)
ossl_callback_to_pkey_gencb, ctx)
!= NULL);
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* In case |*ppkey| was originally a legacy key */
if (ret)
evp_pkey_free_legacy(*ppkey);
@@ -210,8 +212,9 @@ int EVP_PKEY_gen(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey)
{
char curve_name[OSSL_MAX_NAME_SIZE] = "";
if (EVP_PKEY_CTX_get_ec_paramgen_curve_name(ctx, curve_name,
sizeof(curve_name)) < 1
if (!EVP_PKEY_get_utf8_string_param(*ppkey, OSSL_PKEY_PARAM_EC_NAME,
curve_name, sizeof(curve_name),
NULL)
|| strcmp(curve_name, "SM2") != 0)
goto end;
}
@@ -223,7 +226,7 @@ int EVP_PKEY_gen(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey)
goto end;
legacy:
#ifdef FIPS_MODE
#ifdef FIPS_MODULE
goto not_supported;
#else
if (ctx->pkey && !evp_pkey_downgrade(ctx->pkey))
@@ -256,7 +259,7 @@ int EVP_PKEY_gen(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey)
ERR_raise(ERR_LIB_EVP, EVP_R_OPERATON_NOT_INITIALIZED);
ret = -1;
goto end;
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
not_accessible:
ERR_raise(ERR_LIB_EVP, EVP_R_INACCESSIBLE_DOMAIN_PARAMETERS);
ret = -1;
@@ -319,7 +322,7 @@ int EVP_PKEY_CTX_get_keygen_info(EVP_PKEY_CTX *ctx, int idx)
return ctx->keygen_info[idx];
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
EVP_PKEY *EVP_PKEY_new_mac_key(int type, ENGINE *e,
const unsigned char *key, int keylen)
@@ -340,9 +343,9 @@ EVP_PKEY *EVP_PKEY_new_mac_key(int type, ENGINE *e,
return mac_key;
}
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
/*- All methods below can also be used in FIPS_MODE */
/*- All methods below can also be used in FIPS_MODULE */
static int fromdata_init(EVP_PKEY_CTX *ctx, int operation)
{
crypto/evp/pmeth_lib.c
+21 -23
View File
@@ -30,7 +30,7 @@
#include "internal/provider.h"
#include "evp_local.h"
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
typedef const EVP_PKEY_METHOD *(*pmeth_fn)(void);
typedef int sk_cmp_fn_type(const char *const *a, const char *const *b);
@@ -135,7 +135,7 @@ EVP_PKEY_METHOD *EVP_PKEY_meth_new(int id, int flags)
pmeth->flags = flags | EVP_PKEY_FLAG_DYNAMIC;
return pmeth;
}
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
static EVP_PKEY_CTX *int_ctx_new(OPENSSL_CTX *libctx,
EVP_PKEY *pkey, ENGINE *e,
@@ -165,7 +165,7 @@ static EVP_PKEY_CTX *int_ctx_new(OPENSSL_CTX *libctx,
keytype = evp_first_name(pkey->keymgmt->prov, pkey->keymgmt->name_id);
goto common;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
/* TODO(3.0) Legacy code should be removed when all is provider based */
/* BEGIN legacy */
if (id == -1) {
@@ -221,7 +221,7 @@ static EVP_PKEY_CTX *int_ctx_new(OPENSSL_CTX *libctx,
return NULL;
}
/* END legacy */
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
common:
/*
* If there's no engine and there's a name, we try fetching a provider
@@ -237,7 +237,7 @@ static EVP_PKEY_CTX *int_ctx_new(OPENSSL_CTX *libctx,
ret = OPENSSL_zalloc(sizeof(*ret));
if (ret == NULL) {
EVP_KEYMGMT_free(keymgmt);
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
ENGINE_finish(e);
#endif
EVPerr(EVP_F_INT_CTX_NEW, ERR_R_MALLOC_FAILURE);
@@ -265,7 +265,7 @@ static EVP_PKEY_CTX *int_ctx_new(OPENSSL_CTX *libctx,
return ret;
}
/*- All methods below can also be used in FIPS_MODE */
/*- All methods below can also be used in FIPS_MODULE */
EVP_PKEY_CTX *EVP_PKEY_CTX_new_from_name(OPENSSL_CTX *libctx,
const char *name,
@@ -296,7 +296,7 @@ void evp_pkey_ctx_free_old_ops(EVP_PKEY_CTX *ctx)
ctx->op.kex.exchange = NULL;
}
/* TODO(3.0): add dependancies and uncomment this when available for fips mode */
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
else if (EVP_PKEY_CTX_IS_ASYM_CIPHER_OP(ctx)) {
if (ctx->op.ciph.ciphprovctx != NULL && ctx->op.ciph.cipher != NULL)
ctx->op.ciph.cipher->freectx(ctx->op.ciph.ciphprovctx);
@@ -322,13 +322,13 @@ void EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx)
EVP_PKEY_free(ctx->pkey);
EVP_PKEY_free(ctx->peerkey);
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
ENGINE_finish(ctx->engine);
#endif
OPENSSL_free(ctx);
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
void EVP_PKEY_meth_get0_info(int *ppkey_id, int *pflags,
const EVP_PKEY_METHOD *meth)
@@ -592,7 +592,7 @@ int EVP_PKEY_CTX_set_params(EVP_PKEY_CTX *ctx, OSSL_PARAM *params)
return 0;
}
#ifndef FIPS_MODE
#ifndef FIPS_MODULE
int EVP_PKEY_CTX_get_params(EVP_PKEY_CTX *ctx, OSSL_PARAM *params)
{
if (EVP_PKEY_CTX_IS_DERIVE_OP(ctx)
@@ -613,12 +613,6 @@ int EVP_PKEY_CTX_get_params(EVP_PKEY_CTX *ctx, OSSL_PARAM *params)
&& ctx->op.ciph.cipher->get_ctx_params != NULL)
return ctx->op.ciph.cipher->get_ctx_params(ctx->op.ciph.ciphprovctx,
params);
if (EVP_PKEY_CTX_IS_GEN_OP(ctx)
&& ctx->op.keymgmt.genctx != NULL
&& ctx->keymgmt != NULL
&& ctx->keymgmt->gen_get_params != NULL)
return evp_keymgmt_gen_get_params(ctx->keymgmt, ctx->op.keymgmt.genctx,
params);
return 0;
}
@@ -632,12 +626,10 @@ const OSSL_PARAM *EVP_PKEY_CTX_gettable_params(EVP_PKEY_CTX *ctx)
&& ctx->op.sig.signature != NULL
&& ctx->op.sig.signature->gettable_ctx_params != NULL)
return ctx->op.sig.signature->gettable_ctx_params();
if (EVP_PKEY_CTX_IS_ASYM_CIPHER_OP(ctx)
&& ctx->op.ciph.cipher != NULL
&& ctx->op.ciph.cipher->gettable_ctx_params != NULL)
return ctx->op.ciph.cipher->gettable_ctx_params();
return NULL;
}
@@ -656,8 +648,7 @@ const OSSL_PARAM *EVP_PKEY_CTX_settable_params(EVP_PKEY_CTX *ctx)
&& ctx->op.ciph.cipher->settable_ctx_params != NULL)
return ctx->op.ciph.cipher->settable_ctx_params();
if (EVP_PKEY_CTX_IS_GEN_OP(ctx)
&& ctx->keymgmt != NULL
&& ctx->keymgmt->gen_settable_params != NULL)
&& ctx->keymgmt != NULL)
return evp_keymgmt_gen_settable_params(ctx->keymgmt);
return NULL;
@@ -670,7 +661,7 @@ const OSSL_PARAM *EVP_PKEY_CTX_settable_params(EVP_PKEY_CTX *ctx)
*
* In particular they return -2 if any of the params is not supported.
*
* They are not available in FIPS_MODE as they depend on
* They are not available in FIPS_MODULE as they depend on
* - EVP_PKEY_CTX_{get,set}_params()
* - EVP_PKEY_CTX_{gettable,settable}_params()
*
@@ -1026,6 +1017,12 @@ static int legacy_ctrl_str_to_param(EVP_PKEY_CTX *ctx, const char *name,
name = OSSL_PKEY_PARAM_RSA_E;
else if (strcmp(name, "rsa_keygen_primes") == 0)
name = OSSL_PKEY_PARAM_RSA_PRIMES;
else if (strcmp(name, "rsa_pss_keygen_md") == 0)
name = OSSL_PKEY_PARAM_RSA_DIGEST;
else if (strcmp(name, "rsa_pss_keygen_mgf1_md") == 0)
name = OSSL_PKEY_PARAM_RSA_MGF1_DIGEST;
else if (strcmp(name, "rsa_pss_keygen_saltlen") == 0)
name = OSSL_PKEY_PARAM_RSA_PSS_SALTLEN;
# ifndef OPENSSL_NO_DSA
else if (strcmp(name, "dsa_paramgen_bits") == 0)
name = OSSL_PKEY_PARAM_FFC_PBITS;
@@ -1075,7 +1072,8 @@ static int legacy_ctrl_str_to_param(EVP_PKEY_CTX *ctx, const char *name,
if (!OSSL_PARAM_allocate_from_text(&params[0], settable, name, value,
strlen(value), &exists)) {
if (!exists) {
ERR_raise(ERR_LIB_EVP, EVP_R_COMMAND_NOT_SUPPORTED);
ERR_raise_data(ERR_LIB_EVP, EVP_R_COMMAND_NOT_SUPPORTED,
"name=%s,value=%s", name, value);
return -2;
}
return 0;
@@ -1592,4 +1590,4 @@ void EVP_PKEY_meth_get_digest_custom(EVP_PKEY_METHOD *pmeth,
*pdigest_custom = pmeth->digest_custom;
}
#endif /* FIPS_MODE */
#endif /* FIPS_MODULE */
crypto/evp/signature.c
+3 -1
View File
@@ -417,7 +417,8 @@ static int evp_pkey_signature_init(EVP_PKEY_CTX *ctx, int operation)
/* No more legacy from here down to legacy: */
ctx->op.sig.signature = signature;
ctx->op.sig.sigprovctx = signature->newctx(ossl_provider_ctx(signature->prov));
ctx->op.sig.sigprovctx =
signature->newctx(ossl_provider_ctx(signature->prov), ctx->propquery);
if (ctx->op.sig.sigprovctx == NULL) {
/* The provider key can stay in the cache */
EVPerr(0, EVP_R_INITIALIZATION_ERROR);
@@ -503,6 +504,7 @@ static int evp_pkey_signature_init(EVP_PKEY_CTX *ctx, int operation)
return ret;
err:
evp_pkey_ctx_free_old_ops(ctx);
ctx->operation = EVP_PKEY_OP_UNDEFINED;
return ret;
}