Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update.

Browse Source
This commit is contained in:
Hakase
2020-05-17 20:27:18 +09:00
parent ad9fce94c2
commit 3a6d64bb68
619 changed files with 13638 additions and 4698 deletions
Download Patch File Download Diff File Expand all files Collapse all files
providers/common/bio_prov.c
+108 -6
View File
@@ -7,12 +7,15 @@
* https://www.openssl.org/source/license.html
*/
#include <assert.h>
#include <openssl/core_numbers.h>
#include "internal/cryptlib.h"
#include "prov/bio.h"
static OSSL_BIO_new_file_fn *c_bio_new_file = NULL;
static OSSL_BIO_new_membuf_fn *c_bio_new_membuf = NULL;
static OSSL_BIO_read_ex_fn *c_bio_read_ex = NULL;
static OSSL_BIO_write_ex_fn *c_bio_write_ex = NULL;
static OSSL_BIO_free_fn *c_bio_free = NULL;
static OSSL_BIO_vprintf_fn *c_bio_vprintf = NULL;
@@ -32,6 +35,10 @@ int ossl_prov_bio_from_dispatch(const OSSL_DISPATCH *fns)
if (c_bio_read_ex == NULL)
c_bio_read_ex = OSSL_get_BIO_read_ex(fns);
break;
case OSSL_FUNC_BIO_WRITE_EX:
if (c_bio_write_ex == NULL)
c_bio_write_ex = OSSL_get_BIO_write_ex(fns);
break;
case OSSL_FUNC_BIO_FREE:
if (c_bio_free == NULL)
c_bio_free = OSSL_get_BIO_free(fns);
@@ -46,21 +53,21 @@ int ossl_prov_bio_from_dispatch(const OSSL_DISPATCH *fns)
return 1;
}
BIO *ossl_prov_bio_new_file(const char *filename, const char *mode)
OSSL_CORE_BIO *ossl_prov_bio_new_file(const char *filename, const char *mode)
{
if (c_bio_new_file == NULL)
return NULL;
return c_bio_new_file(filename, mode);
}
BIO *ossl_prov_bio_new_membuf(const char *filename, int len)
OSSL_CORE_BIO *ossl_prov_bio_new_membuf(const char *filename, int len)
{
if (c_bio_new_membuf == NULL)
return NULL;
return c_bio_new_membuf(filename, len);
}
int ossl_prov_bio_read_ex(BIO *bio, void *data, size_t data_len,
int ossl_prov_bio_read_ex(OSSL_CORE_BIO *bio, void *data, size_t data_len,
size_t *bytes_read)
{
if (c_bio_read_ex == NULL)
@@ -68,21 +75,29 @@ int ossl_prov_bio_read_ex(BIO *bio, void *data, size_t data_len,
return c_bio_read_ex(bio, data, data_len, bytes_read);
}
int ossl_prov_bio_free(BIO *bio)
int ossl_prov_bio_write_ex(OSSL_CORE_BIO *bio, const void *data, size_t data_len,
size_t *written)
{
if (c_bio_write_ex == NULL)
return 0;
return c_bio_write_ex(bio, data, data_len, written);
}
int ossl_prov_bio_free(OSSL_CORE_BIO *bio)
{
if (c_bio_free == NULL)
return 0;
return c_bio_free(bio);
}
int ossl_prov_bio_vprintf(BIO *bio, const char *format, va_list ap)
int ossl_prov_bio_vprintf(OSSL_CORE_BIO *bio, const char *format, va_list ap)
{
if (c_bio_vprintf == NULL)
return -1;
return c_bio_vprintf(bio, format, ap);
}
int ossl_prov_bio_printf(BIO *bio, const char *format, ...)
int ossl_prov_bio_printf(OSSL_CORE_BIO *bio, const char *format, ...)
{
va_list ap;
int ret;
@@ -94,3 +109,90 @@ int ossl_prov_bio_printf(BIO *bio, const char *format, ...)
return ret;
}
#ifndef FIPS_MODULE
/* No direct BIO support in the FIPS module */
static int bio_core_read_ex(BIO *bio, char *data, size_t data_len,
size_t *bytes_read)
{
return ossl_prov_bio_read_ex(BIO_get_data(bio), data, data_len, bytes_read);
}
static int bio_core_write_ex(BIO *bio, const char *data, size_t data_len,
size_t *written)
{
return ossl_prov_bio_write_ex(BIO_get_data(bio), data, data_len, written);
}
static long bio_core_ctrl(BIO *bio, int cmd, long num, void *ptr)
{
/* We don't support this */
assert(0);
return 0;
}
static int bio_core_gets(BIO *bio, char *buf, int size)
{
/* We don't support this */
assert(0);
return -1;
}
static int bio_core_puts(BIO *bio, const char *str)
{
/* We don't support this */
assert(0);
return -1;
}
static int bio_core_new(BIO *bio)
{
BIO_set_init(bio, 1);
return 1;
}
static int bio_core_free(BIO *bio)
{
BIO_set_init(bio, 0);
return 1;
}
BIO_METHOD *bio_prov_init_bio_method(void)
{
BIO_METHOD *corebiometh = NULL;
corebiometh = BIO_meth_new(BIO_TYPE_CORE_TO_PROV, "BIO to Core filter");
if (corebiometh == NULL
|| !BIO_meth_set_write_ex(corebiometh, bio_core_write_ex)
|| !BIO_meth_set_read_ex(corebiometh, bio_core_read_ex)
|| !BIO_meth_set_puts(corebiometh, bio_core_puts)
|| !BIO_meth_set_gets(corebiometh, bio_core_gets)
|| !BIO_meth_set_ctrl(corebiometh, bio_core_ctrl)
|| !BIO_meth_set_create(corebiometh, bio_core_new)
|| !BIO_meth_set_destroy(corebiometh, bio_core_free)) {
BIO_meth_free(corebiometh);
return NULL;
}
return corebiometh;
}
BIO *bio_new_from_core_bio(PROV_CTX *provctx, OSSL_CORE_BIO *corebio)
{
BIO *outbio;
BIO_METHOD *corebiometh = PROV_CTX_get0_core_bio_method(provctx);
if (corebiometh == NULL)
return NULL;
outbio = BIO_new(corebiometh);
if (outbio != NULL)
BIO_set_data(outbio, corebio);
return outbio;
}
#endif
providers/common/build.info
+1 -1
View File
@@ -1,6 +1,6 @@
SUBDIRS=der
SOURCE[../libcommon.a]=provider_err.c bio_prov.c
SOURCE[../libcommon.a]=provider_err.c bio_prov.c provider_ctx.c
$FIPSCOMMON=provider_util.c
SOURCE[../libnonfips.a]=$FIPSCOMMON nid_to_name.c
SOURCE[../libfips.a]=$FIPSCOMMON
providers/common/der/DIGESTS.asn1
+19
View File
@@ -0,0 +1,19 @@
-- -------------------------------------------------------------------
-- Taken from https://csrc.nist.gov/projects/computer-security-objects-register/algorithm-registration
id-sha256 OBJECT IDENTIFIER ::= { hashAlgs 1 }
id-sha384 OBJECT IDENTIFIER ::= { hashAlgs 2 }
id-sha512 OBJECT IDENTIFIER ::= { hashAlgs 3 }
id-sha224 OBJECT IDENTIFIER ::= { hashAlgs 4 }
id-sha512-224 OBJECT IDENTIFIER ::= { hashAlgs 5 }
id-sha512-256 OBJECT IDENTIFIER ::= { hashAlgs 6 }
id-sha3-224 OBJECT IDENTIFIER ::= { hashAlgs 7 }
id-sha3-256 OBJECT IDENTIFIER ::= { hashAlgs 8 }
id-sha3-384 OBJECT IDENTIFIER ::= { hashAlgs 9 }
id-sha3-512 OBJECT IDENTIFIER ::= { hashAlgs 10 }
id-shake128 OBJECT IDENTIFIER ::= { hashAlgs 11 }
id-shake256 OBJECT IDENTIFIER ::= { hashAlgs 12 }
id-shake128-len OBJECT IDENTIFIER ::= { hashAlgs 17 }
id-shake256-len OBJECT IDENTIFIER ::= { hashAlgs 18 }
id-KMACWithSHAKE128 OBJECT IDENTIFIER ::={hashAlgs 19}
id-KMACWithSHAKE256 OBJECT IDENTIFIER ::={ hashAlgs 20}
providers/common/der/NIST.asn1
+8
View File
@@ -0,0 +1,8 @@
-- -------------------------------------------------------------------
-- Taken from https://csrc.nist.gov/projects/computer-security-objects-register/algorithm-registration
-- Copies of common OIDs used by other ASN.1 files.
csor OBJECT IDENTIFIER ::= { 2 16 840 1 101 3 }
nistAlgorithms OBJECT IDENTIFIER ::= { csor nistAlgorithm(4) }
hashAlgs OBJECT IDENTIFIER ::= { nistAlgorithms 2 }
sigAlgs OBJECT IDENTIFIER ::= { nistAlgorithms 3 }
providers/common/der/RSA.asn1
+11 -2
View File
@@ -80,9 +80,18 @@ id-mgf1 OBJECT IDENTIFIER ::= { pkcs-1 8 }
-- -------------------------------------------------------------------
-- Taken from https://csrc.nist.gov/projects/computer-security-objects-register/algorithm-registration
sigAlgs OBJECT IDENTIFIER ::= { 2 16 840 1 101 3 4 3 }
id-rsassa-pkcs1-v1_5-with-sha3-224 OBJECT IDENTIFIER ::= { sigAlgs 13 }
id-rsassa-pkcs1-v1_5-with-sha3-256 OBJECT IDENTIFIER ::= { sigAlgs 14 }
id-rsassa-pkcs1-v1_5-with-sha3-384 OBJECT IDENTIFIER ::= { sigAlgs 15 }
id-rsassa-pkcs1-v1_5-with-sha3-512 OBJECT IDENTIFIER ::= { sigAlgs 16 }
-- -------------------------------------------------------------------
-- These OID's exist in the codebase but may need to be deprecated at some point.
-- mdc2 and md5_sha1 have been omitted as they do not look like valid entries.
md4WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 3 }
ripemd160WithRSAEncryption OBJECT IDENTIFIER ::= {
iso(1) identified-organization(3) teletrust(36) algorithm(3) signatureAlgorithm(3) rsaSignature(1) 2
}
providers/common/der/build.info
+9 -2
View File
@@ -1,4 +1,4 @@
$FIPSABLE=der_rsa.c der_dsa.c der_ec.c
$FIPSABLE=der_rsa.c der_dsa.c der_ec.c der_digests.c
SOURCE[../../libfips.a]=$FIPSABLE
SOURCE[../../libnonfips.a]=$FIPSABLE
@@ -6,7 +6,7 @@ SOURCE[../../libnonfips.a]=$FIPSABLE
GENERATE[der_rsa.c]=der_rsa.c.in
DEPEND[der_rsa.c]=oids_to_c.pm
DEPEND[der_rsa.o]=../include/prov/der_rsa.h
DEPEND[der_rsa.o]=../include/prov/der_rsa.h ../include/prov/der_digests.h
GENERATE[../include/prov/der_rsa.h]=der_rsa.h.in
DEPEND[../include/prov/der_rsa.h]=oids_to_c.pm
@@ -23,3 +23,10 @@ DEPEND[der_ec.c]=oids_to_c.pm
DEPEND[der_ec.o]=../include/prov/der_ec.h
GENERATE[../include/prov/der_ec.h]=der_ec.h.in
DEPEND[../include/prov/der_ec.h]=oids_to_c.pm
GENERATE[der_digests.c]=der_digests.c.in
DEPEND[der_digests.c]=oids_to_c.pm
DEPEND[der_digests.o]=../include/prov/der_digests.h
GENERATE[../include/prov/der_digests.h]=der_digests.h.in
DEPEND[../include/prov/der_digests.h]=oids_to_c.pm
providers/common/der/der_digests.c.in
+18
View File
@@ -0,0 +1,18 @@
/*
* Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include "prov/der_digests.h"
/* Well known OIDs precompiled */
{-
$OUT = oids_to_c::process_leaves('providers/common/der/NIST.asn1',
'providers/common/der/DIGESTS.asn1',
{ dir => $config{sourcedir},
filter => \&oids_to_c::filter_to_C });
-}
providers/common/der/der_digests.h.in
+18
View File
@@ -0,0 +1,18 @@
/*
* Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include "internal/der.h"
/* Well known OIDs precompiled */
{-
$OUT = oids_to_c::process_leaves('providers/common/der/NIST.asn1',
'providers/common/der/DIGESTS.asn1',
{ dir => $config{sourcedir},
filter => \&oids_to_c::filter_to_H });
-}
providers/common/der/der_rsa.c.in
+382 -21
View File
@@ -9,25 +9,381 @@
#include <openssl/bn.h>
#include <openssl/obj_mac.h>
#include "internal/cryptlib.h"
#include "prov/der_rsa.h"
#include "prov/der_digests.h"
/* Well known OIDs precompiled */
{-
$OUT = oids_to_c::process_leaves('providers/common/der/RSA.asn1',
$OUT = oids_to_c::process_leaves('providers/common/der/NIST.asn1',
'providers/common/der/DIGESTS.asn1',
'providers/common/der/RSA.asn1',
{ dir => $config{sourcedir},
filter => \&oids_to_c::filter_to_C });
-}
int DER_w_algorithmIdentifier_RSA(WPACKET *pkt, int tag, RSA *rsa)
/* More complex pre-compiled sequences. TODO(3.0) refactor? */
/*-
* From https://tools.ietf.org/html/rfc8017#appendix-A.2.1
*
* OAEP-PSSDigestAlgorithms ALGORITHM-IDENTIFIER ::= {
* { OID id-sha1 PARAMETERS NULL }|
* { OID id-sha224 PARAMETERS NULL }|
* { OID id-sha256 PARAMETERS NULL }|
* { OID id-sha384 PARAMETERS NULL }|
* { OID id-sha512 PARAMETERS NULL }|
* { OID id-sha512-224 PARAMETERS NULL }|
* { OID id-sha512-256 PARAMETERS NULL },
* ... -- Allows for future expansion --
* }
*/
#define DER_V_NULL DER_P_NULL, 0
#define DER_SZ_NULL 2
/*
* The names for the hash function AlgorithmIdentifiers are borrowed and
* expanded from https://tools.ietf.org/html/rfc4055#section-2.1
*
* sha1Identifier AlgorithmIdentifier ::= { id-sha1, NULL }
* sha224Identifier AlgorithmIdentifier ::= { id-sha224, NULL }
* sha256Identifier AlgorithmIdentifier ::= { id-sha256, NULL }
* sha384Identifier AlgorithmIdentifier ::= { id-sha384, NULL }
* sha512Identifier AlgorithmIdentifier ::= { id-sha512, NULL }
*/
/*
* NOTE: Some of the arrays aren't used other than inside sizeof(), which
* clang complains about (-Wno-unneeded-internal-declaration). To get
* around that, we make them non-static, and declare them an extra time to
* avoid compilers complaining about definitions without declarations.
*/
#if 0 /* Currently unused */
#define DER_AID_V_sha1Identifier \
DER_P_SEQUENCE|DER_F_CONSTRUCTED, \
DER_OID_SZ_id_sha1 + DER_SZ_NULL, \
DER_OID_V_id_sha1, \
DER_V_NULL
extern const unsigned char der_aid_sha1Identifier[];
const unsigned char der_aid_sha1Identifier[] = {
DER_AID_V_sha1Identifier
};
#define DER_AID_SZ_sha1Identifier sizeof(der_aid_sha1Identifier)
#endif
#define DER_AID_V_sha224Identifier \
DER_P_SEQUENCE|DER_F_CONSTRUCTED, \
DER_OID_SZ_id_sha224 + DER_SZ_NULL, \
DER_OID_V_id_sha224, \
DER_V_NULL
extern const unsigned char der_aid_sha224Identifier[];
const unsigned char der_aid_sha224Identifier[] = {
DER_AID_V_sha224Identifier
};
#define DER_AID_SZ_sha224Identifier sizeof(der_aid_sha224Identifier)
#define DER_AID_V_sha256Identifier \
DER_P_SEQUENCE|DER_F_CONSTRUCTED, \
DER_OID_SZ_id_sha256 + DER_SZ_NULL, \
DER_OID_V_id_sha256, \
DER_V_NULL
extern const unsigned char der_aid_sha256Identifier[];
const unsigned char der_aid_sha256Identifier[] = {
DER_AID_V_sha256Identifier
};
#define DER_AID_SZ_sha256Identifier sizeof(der_aid_sha256Identifier)
#define DER_AID_V_sha384Identifier \
DER_P_SEQUENCE|DER_F_CONSTRUCTED, \
DER_OID_SZ_id_sha384 + DER_SZ_NULL, \
DER_OID_V_id_sha384, \
DER_V_NULL
extern const unsigned char der_aid_sha384Identifier[];
const unsigned char der_aid_sha384Identifier[] = {
DER_AID_V_sha384Identifier
};
#define DER_AID_SZ_sha384Identifier sizeof(der_aid_sha384Identifier)
#define DER_AID_V_sha512Identifier \
DER_P_SEQUENCE|DER_F_CONSTRUCTED, \
DER_OID_SZ_id_sha512 + DER_SZ_NULL, \
DER_OID_V_id_sha512, \
DER_V_NULL
extern const unsigned char der_aid_sha512Identifier[];
const unsigned char der_aid_sha512Identifier[] = {
DER_AID_V_sha512Identifier
};
#define DER_AID_SZ_sha512Identifier sizeof(der_aid_sha512Identifier)
#define DER_AID_V_sha512_224Identifier \
DER_P_SEQUENCE|DER_F_CONSTRUCTED, \
DER_OID_SZ_id_sha512_224 + DER_SZ_NULL, \
DER_OID_V_id_sha512_224, \
DER_V_NULL
extern const unsigned char der_aid_sha512_224Identifier[];
const unsigned char der_aid_sha512_224Identifier[] = {
DER_AID_V_sha512_224Identifier
};
#define DER_AID_SZ_sha512_224Identifier sizeof(der_aid_sha512_224Identifier)
#define DER_AID_V_sha512_256Identifier \
DER_P_SEQUENCE|DER_F_CONSTRUCTED, \
DER_OID_SZ_id_sha512_256 + DER_SZ_NULL, \
DER_OID_V_id_sha512_256, \
DER_V_NULL
extern const unsigned char der_aid_sha512_256Identifier[];
const unsigned char der_aid_sha512_256Identifier[] = {
DER_AID_V_sha512_256Identifier
};
#define DER_AID_SZ_sha512_256Identifier sizeof(der_aid_sha512_256Identifier)
/*-
* From https://tools.ietf.org/html/rfc8017#appendix-A.2.1
*
* HashAlgorithm ::= AlgorithmIdentifier {
* {OAEP-PSSDigestAlgorithms}
* }
*
* ...
*
* PKCS1MGFAlgorithms ALGORITHM-IDENTIFIER ::= {
* { OID id-mgf1 PARAMETERS HashAlgorithm },
* ... -- Allows for future expansion --
* }
*/
/*
* The names for the MGF1 AlgorithmIdentifiers are borrowed and expanded
* from https://tools.ietf.org/html/rfc4055#section-2.1
*
* mgf1SHA1Identifier AlgorithmIdentifier ::=
* { id-mgf1, sha1Identifier }
* mgf1SHA224Identifier AlgorithmIdentifier ::=
* { id-mgf1, sha224Identifier }
* mgf1SHA256Identifier AlgorithmIdentifier ::=
* { id-mgf1, sha256Identifier }
* mgf1SHA384Identifier AlgorithmIdentifier ::=
* { id-mgf1, sha384Identifier }
* mgf1SHA512Identifier AlgorithmIdentifier ::=
* { id-mgf1, sha512Identifier }
*/
#if 0 /* Currently unused */
#define DER_AID_V_mgf1SHA1Identifier \
DER_P_SEQUENCE|DER_F_CONSTRUCTED, \
DER_OID_SZ_id_mgf1 + DER_AID_SZ_sha1Identifier, \
DER_OID_V_id_mgf1, \
DER_AID_V_sha1Identifier
static const unsigned char der_aid_mgf1SHA1Identifier[] = {
DER_AID_V_mgf1SHA1Identifier
};
#define DER_AID_SZ_mgf1SHA1Identifier sizeof(der_aid_mgf1SHA1Identifier)
#endif
#define DER_AID_V_mgf1SHA224Identifier \
DER_P_SEQUENCE|DER_F_CONSTRUCTED, \
DER_OID_SZ_id_mgf1 + DER_AID_SZ_sha224Identifier, \
DER_OID_V_id_mgf1, \
DER_AID_V_sha224Identifier
static const unsigned char der_aid_mgf1SHA224Identifier[] = {
DER_AID_V_mgf1SHA224Identifier
};
#define DER_AID_SZ_mgf1SHA224Identifier sizeof(der_aid_mgf1SHA224Identifier)
#define DER_AID_V_mgf1SHA256Identifier \
DER_P_SEQUENCE|DER_F_CONSTRUCTED, \
DER_OID_SZ_id_mgf1 + DER_AID_SZ_sha256Identifier, \
DER_OID_V_id_mgf1, \
DER_AID_V_sha256Identifier
static const unsigned char der_aid_mgf1SHA256Identifier[] = {
DER_AID_V_mgf1SHA256Identifier
};
#define DER_AID_SZ_mgf1SHA256Identifier sizeof(der_aid_mgf1SHA256Identifier)
#define DER_AID_V_mgf1SHA384Identifier \
DER_P_SEQUENCE|DER_F_CONSTRUCTED, \
DER_OID_SZ_id_mgf1 + DER_AID_SZ_sha384Identifier, \
DER_OID_V_id_mgf1, \
DER_AID_V_sha384Identifier
static const unsigned char der_aid_mgf1SHA384Identifier[] = {
DER_AID_V_mgf1SHA384Identifier
};
#define DER_AID_SZ_mgf1SHA384Identifier sizeof(der_aid_mgf1SHA384Identifier)
#define DER_AID_V_mgf1SHA512Identifier \
DER_P_SEQUENCE|DER_F_CONSTRUCTED, \
DER_OID_SZ_id_mgf1 + DER_AID_SZ_sha512Identifier, \
DER_OID_V_id_mgf1, \
DER_AID_V_sha512Identifier
static const unsigned char der_aid_mgf1SHA512Identifier[] = {
DER_AID_V_mgf1SHA512Identifier
};
#define DER_AID_SZ_mgf1SHA512Identifier sizeof(der_aid_mgf1SHA512Identifier)
#define DER_AID_V_mgf1SHA512_224Identifier \
DER_P_SEQUENCE|DER_F_CONSTRUCTED, \
DER_OID_SZ_id_mgf1 + DER_AID_SZ_sha512_224Identifier, \
DER_OID_V_id_mgf1, \
DER_AID_V_sha512_224Identifier
static const unsigned char der_aid_mgf1SHA512_224Identifier[] = {
DER_AID_V_mgf1SHA512_224Identifier
};
#define DER_AID_SZ_mgf1SHA512_224Identifier sizeof(der_aid_mgf1SHA512_224Identifier)
#define DER_AID_V_mgf1SHA512_256Identifier \
DER_P_SEQUENCE|DER_F_CONSTRUCTED, \
DER_OID_SZ_id_mgf1 + DER_AID_SZ_sha512_256Identifier, \
DER_OID_V_id_mgf1, \
DER_AID_V_sha512_256Identifier
static const unsigned char der_aid_mgf1SHA512_256Identifier[] = {
DER_AID_V_mgf1SHA512_256Identifier
};
#define DER_AID_SZ_mgf1SHA512_256Identifier sizeof(der_aid_mgf1SHA512_256Identifier)
#define MGF1_SHA_CASE(bits, var) \
case NID_sha##bits: \
var = der_aid_mgf1SHA##bits##Identifier; \
var##_sz = sizeof(der_aid_mgf1SHA##bits##Identifier); \
break;
/*-
* The name is borrowed from https://tools.ietf.org/html/rfc8017#appendix-A.2.1
*
* MaskGenAlgorithm ::= AlgorithmIdentifier { {PKCS1MGFAlgorithms} }
*/
static int DER_w_MaskGenAlgorithm(WPACKET *pkt, int tag,
const RSA_PSS_PARAMS_30 *pss)
{
if (pss != NULL && rsa_pss_params_30_maskgenalg(pss) == NID_mgf1) {
int maskgenhashalg_nid = rsa_pss_params_30_maskgenhashalg(pss);
const unsigned char *maskgenalg = NULL;
size_t maskgenalg_sz = 0;
switch (maskgenhashalg_nid) {
case NID_sha1:
break;
MGF1_SHA_CASE(224, maskgenalg);
MGF1_SHA_CASE(256, maskgenalg);
MGF1_SHA_CASE(384, maskgenalg);
MGF1_SHA_CASE(512, maskgenalg);
MGF1_SHA_CASE(512_224, maskgenalg);
MGF1_SHA_CASE(512_256, maskgenalg);
default:
return 0;
}
/* If there is none (or it was the default), we write nothing */
if (maskgenalg == NULL)
return 1;
return DER_w_precompiled(pkt, tag, maskgenalg, maskgenalg_sz);
}
return 0;
}
#define OAEP_PSS_MD_CASE(name, var) \
case NID_##name: \
var = der_oid_id_##name; \
var##_sz = sizeof(der_oid_id_##name); \
break;
int DER_w_RSASSA_PSS_params(WPACKET *pkt, int tag, const RSA_PSS_PARAMS_30 *pss)
{
int hashalg_nid, default_hashalg_nid;
int saltlen, default_saltlen;
int trailerfield, default_trailerfield;
const unsigned char *hashalg = NULL;
size_t hashalg_sz = 0;
/*
* For an unrestricted key, this function should not have been called;
* the caller must be in control, because unrestricted keys are permitted
* in some situations (when encoding the public key in a SubjectKeyInfo,
* for example) while not in others, and this function doesn't know the
* intent. Therefore, we assert that here, the PSS parameters must show
* that the key is restricted.
*/
if (!ossl_assert(pss != NULL && !rsa_pss_params_30_is_unrestricted(pss)))
return 0;
hashalg_nid = rsa_pss_params_30_hashalg(pss);
saltlen = rsa_pss_params_30_saltlen(pss);
trailerfield = rsa_pss_params_30_trailerfield(pss);
/* Getting default values */
default_hashalg_nid = rsa_pss_params_30_hashalg(NULL);
default_saltlen = rsa_pss_params_30_saltlen(NULL);
default_trailerfield = rsa_pss_params_30_trailerfield(NULL);
/*
* From https://tools.ietf.org/html/rfc8017#appendix-A.2.1:
*
* OAEP-PSSDigestAlgorithms ALGORITHM-IDENTIFIER ::= {
* { OID id-sha1 PARAMETERS NULL }|
* { OID id-sha224 PARAMETERS NULL }|
* { OID id-sha256 PARAMETERS NULL }|
* { OID id-sha384 PARAMETERS NULL }|
* { OID id-sha512 PARAMETERS NULL }|
* { OID id-sha512-224 PARAMETERS NULL }|
* { OID id-sha512-256 PARAMETERS NULL },
* ... -- Allows for future expansion --
* }
*/
switch (hashalg_nid) {
OAEP_PSS_MD_CASE(sha1, hashalg);
OAEP_PSS_MD_CASE(sha224, hashalg);
OAEP_PSS_MD_CASE(sha256, hashalg);
OAEP_PSS_MD_CASE(sha384, hashalg);
OAEP_PSS_MD_CASE(sha512, hashalg);
OAEP_PSS_MD_CASE(sha512_224, hashalg);
OAEP_PSS_MD_CASE(sha512_256, hashalg);
default:
return 0;
}
return DER_w_begin_sequence(pkt, tag)
/* No parameters (yet?) */
&& DER_w_precompiled(pkt, -1, der_oid_rsaEncryption,
sizeof(der_oid_rsaEncryption))
&& (trailerfield == default_trailerfield
|| DER_w_ulong(pkt, 3, trailerfield))
&& (saltlen == default_saltlen || DER_w_ulong(pkt, 2, saltlen))
&& DER_w_MaskGenAlgorithm(pkt, 1, pss)
&& (hashalg_nid == default_hashalg_nid
|| DER_w_precompiled(pkt, 0, hashalg, hashalg_sz))
&& DER_w_end_sequence(pkt, tag);
}
/* Aliases so we can have a uniform MD_CASE */
/* Aliases so we can have a uniform RSA_CASE */
#define der_oid_rsassaPss der_oid_id_RSASSA_PSS
#define RSA_CASE(name, var) \
var##_nid = NID_##name; \
var##_oid = der_oid_##name; \
var##_oid_sz = sizeof(der_oid_##name); \
break;
int DER_w_algorithmIdentifier_RSA(WPACKET *pkt, int tag, RSA *rsa)
{
int rsa_nid = NID_undef;
const unsigned char *rsa_oid = NULL;
size_t rsa_oid_sz = 0;
RSA_PSS_PARAMS_30 *pss_params = rsa_get0_pss_params_30(rsa);
switch (RSA_test_flags(rsa, RSA_FLAG_TYPE_MASK)) {
case RSA_FLAG_TYPE_RSA:
RSA_CASE(rsaEncryption, rsa);
case RSA_FLAG_TYPE_RSASSAPSS:
RSA_CASE(rsassaPss, rsa);
}
if (rsa_oid == NULL)
return 0;
return DER_w_begin_sequence(pkt, tag)
&& (rsa_nid != NID_rsassaPss
|| rsa_pss_params_30_is_unrestricted(pss_params)
|| DER_w_RSASSA_PSS_params(pkt, -1, pss_params))
&& DER_w_precompiled(pkt, -1, rsa_oid, rsa_oid_sz)
&& DER_w_end_sequence(pkt, tag);
}
/* Aliases so we can have a uniform MD_with_RSA_CASE */
#define der_oid_sha3_224WithRSAEncryption \
der_oid_id_rsassa_pkcs1_v1_5_with_sha3_224
#define der_oid_sha3_256WithRSAEncryption \
@@ -37,10 +393,10 @@ int DER_w_algorithmIdentifier_RSA(WPACKET *pkt, int tag, RSA *rsa)
#define der_oid_sha3_512WithRSAEncryption \
der_oid_id_rsassa_pkcs1_v1_5_with_sha3_512
#define MD_CASE(name) \
#define MD_with_RSA_CASE(name, var) \
case NID_##name: \
precompiled = der_oid_##name##WithRSAEncryption; \
precompiled_sz = sizeof(der_oid_##name##WithRSAEncryption); \
var = der_oid_##name##WithRSAEncryption; \
var##_sz = sizeof(der_oid_##name##WithRSAEncryption); \
break;
int DER_w_algorithmIdentifier_RSA_with(WPACKET *pkt, int tag,
@@ -50,19 +406,24 @@ int DER_w_algorithmIdentifier_RSA_with(WPACKET *pkt, int tag,
size_t precompiled_sz = 0;
switch (mdnid) {
#ifndef FIPS_MODE
MD_CASE(md2);
MD_CASE(md5);
#ifndef FIPS_MODULE
MD_with_RSA_CASE(md2, precompiled);
MD_with_RSA_CASE(md5, precompiled);
MD_with_RSA_CASE(md4, precompiled);
MD_with_RSA_CASE(ripemd160, precompiled);
/* TODO(3.0) Decide what to do about mdc2 and md5_sha1 */
#endif
MD_CASE(sha1);
MD_CASE(sha224);
MD_CASE(sha256);
MD_CASE(sha384);
MD_CASE(sha512);
MD_CASE(sha3_224);
MD_CASE(sha3_256);
MD_CASE(sha3_384);
MD_CASE(sha3_512);
MD_with_RSA_CASE(sha1, precompiled);
MD_with_RSA_CASE(sha224, precompiled);
MD_with_RSA_CASE(sha256, precompiled);
MD_with_RSA_CASE(sha384, precompiled);
MD_with_RSA_CASE(sha512, precompiled);
MD_with_RSA_CASE(sha512_224, precompiled);
MD_with_RSA_CASE(sha512_256, precompiled);
MD_with_RSA_CASE(sha3_224, precompiled);
MD_with_RSA_CASE(sha3_256, precompiled);
MD_with_RSA_CASE(sha3_384, precompiled);
MD_with_RSA_CASE(sha3_512, precompiled);
default:
return 0;
}
providers/common/der/der_rsa.h.in
+6 -1
View File
@@ -7,15 +7,20 @@
* https://www.openssl.org/source/license.html
*/
#include "crypto/rsa.h"
#include "internal/der.h"
/* Well known OIDs precompiled */
{-
$OUT = oids_to_c::process_leaves('providers/common/der/RSA.asn1',
$OUT = oids_to_c::process_leaves('providers/common/der/NIST.asn1',
'providers/common/der/DIGESTS.asn1',
'providers/common/der/RSA.asn1',
{ dir => $config{sourcedir},
filter => \&oids_to_c::filter_to_H });
-}
int DER_w_RSASSA_PSS_params(WPACKET *pkt, int tag,
const RSA_PSS_PARAMS_30 *pss);
int DER_w_algorithmIdentifier_RSA(WPACKET *pkt, int tag, RSA *rsa);
int DER_w_algorithmIdentifier_RSA_with(WPACKET *pkt, int tag,
RSA *rsa, int mdnid);
providers/common/include/prov/bio.h
+12 -6
View File
@@ -10,13 +10,19 @@
#include <stdarg.h>
#include <openssl/bio.h>
#include <openssl/core.h>
#include "prov/provider_ctx.h"
int ossl_prov_bio_from_dispatch(const OSSL_DISPATCH *fns);
BIO *ossl_prov_bio_new_file(const char *filename, const char *mode);
BIO *ossl_prov_bio_new_membuf(const char *filename, int len);
int ossl_prov_bio_read_ex(BIO *bio, void *data, size_t data_len,
OSSL_CORE_BIO *ossl_prov_bio_new_file(const char *filename, const char *mode);
OSSL_CORE_BIO *ossl_prov_bio_new_membuf(const char *filename, int len);
int ossl_prov_bio_read_ex(OSSL_CORE_BIO *bio, void *data, size_t data_len,
size_t *bytes_read);
int ossl_prov_bio_free(BIO *bio);
int ossl_prov_bio_vprintf(BIO *bio, const char *format, va_list ap);
int ossl_prov_bio_printf(BIO *bio, const char *format, ...);
int ossl_prov_bio_write_ex(OSSL_CORE_BIO *bio, const void *data, size_t data_len,
size_t *written);
int ossl_prov_bio_free(OSSL_CORE_BIO *bio);
int ossl_prov_bio_vprintf(OSSL_CORE_BIO *bio, const char *format, va_list ap);
int ossl_prov_bio_printf(OSSL_CORE_BIO *bio, const char *format, ...);
BIO_METHOD *bio_prov_init_bio_method(void);
BIO *bio_new_from_core_bio(PROV_CTX *provctx, OSSL_CORE_BIO *corebio);
providers/common/include/prov/provider_ctx.h
+28 -2
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -7,8 +7,34 @@
* https://www.openssl.org/source/license.html
*/
#ifndef OSSL_PROV_PROVIDER_CTX_H
# define OSSL_PROV_PROVIDER_CTX_H
# include <openssl/types.h>
# include <openssl/crypto.h>
# include <openssl/bio.h>
# include <openssl/core.h>
typedef struct prov_ctx_st {
const OSSL_CORE_HANDLE *handle;
OPENSSL_CTX *libctx; /* For all provider modules */
BIO_METHOD *corebiometh;
} PROV_CTX;
/*
* To be used anywhere the library context needs to be passed, such as to
* fetching functions.
*/
#define PROV_LIBRARY_CONTEXT_OF(provctx) (provctx)
# define PROV_LIBRARY_CONTEXT_OF(provctx) \
PROV_CTX_get0_library_context((provctx))
PROV_CTX *PROV_CTX_new(void);
void PROV_CTX_free(PROV_CTX *ctx);
void PROV_CTX_set0_library_context(PROV_CTX *ctx, OPENSSL_CTX *libctx);
void PROV_CTX_set0_handle(PROV_CTX *ctx, const OSSL_CORE_HANDLE *handle);
void PROV_CTX_set0_core_bio_method(PROV_CTX *ctx, BIO_METHOD *corebiometh);
OPENSSL_CTX *PROV_CTX_get0_library_context(PROV_CTX *ctx);
const OSSL_CORE_HANDLE *PROV_CTX_get0_handle(PROV_CTX *ctx);
BIO_METHOD *PROV_CTX_get0_core_bio_method(PROV_CTX *ctx);
#endif
providers/common/include/prov/providercommon.h
+1 -1
View File
@@ -9,7 +9,7 @@
#include <openssl/provider.h>
const OSSL_PROVIDER *FIPS_get_provider(OPENSSL_CTX *ctx);
const OSSL_CORE_HANDLE *FIPS_get_core_handle(OPENSSL_CTX *ctx);
const char *ossl_prov_util_nid_to_name(int nid);
providers/common/include/prov/providercommonerr.h
+3
View File
@@ -10,6 +10,7 @@
#ifndef OPENSSL_PROVERR_H
# define OPENSSL_PROVERR_H
# pragma once
# include <openssl/opensslconf.h>
# include <openssl/symhacks.h>
@@ -89,6 +90,7 @@ int ERR_load_PROV_strings(void);
# define PROV_R_INVALID_PSS_SALTLEN 169
# define PROV_R_INVALID_SALT_LENGTH 112
# define PROV_R_INVALID_SEED_LENGTH 154
# define PROV_R_INVALID_SIGNATURE_SIZE 179
# define PROV_R_INVALID_TAG 110
# define PROV_R_INVALID_TAGLEN 118
# define PROV_R_INVALID_X931_DIGEST 170
@@ -110,6 +112,7 @@ int ERR_load_PROV_strings(void);
# define PROV_R_NOT_XOF_OR_INVALID_LENGTH 113
# define PROV_R_NO_KEY_SET 114
# define PROV_R_NO_PARAMETERS_SET 177
# define PROV_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE 178
# define PROV_R_OUTPUT_BUFFER_TOO_SMALL 106
# define PROV_R_PSS_SALTLEN_TOO_SMALL 172
# define PROV_R_READ_KEY 159
providers/common/provider_ctx.c
+61
View File
@@ -0,0 +1,61 @@
/*
* Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <stdlib.h>
#include "prov/provider_ctx.h"
#include "prov/bio.h"
PROV_CTX *PROV_CTX_new(void)
{
return OPENSSL_zalloc(sizeof(PROV_CTX));
}
void PROV_CTX_free(PROV_CTX *ctx)
{
OPENSSL_free(ctx);
}
void PROV_CTX_set0_library_context(PROV_CTX *ctx, OPENSSL_CTX *libctx)
{
if (ctx != NULL)
ctx->libctx = libctx;
}
void PROV_CTX_set0_handle(PROV_CTX *ctx, const OSSL_CORE_HANDLE *handle)
{
if (ctx != NULL)
ctx->handle = handle;
}
void PROV_CTX_set0_core_bio_method(PROV_CTX *ctx, BIO_METHOD *corebiometh)
{
if (ctx != NULL)
ctx->corebiometh = corebiometh;
}
OPENSSL_CTX *PROV_CTX_get0_library_context(PROV_CTX *ctx)
{
if (ctx == NULL)
return NULL;
return ctx->libctx;
}
const OSSL_CORE_HANDLE *PROV_CTX_get0_handle(PROV_CTX *ctx)
{
if (ctx == NULL)
return NULL;
return ctx->handle;
}
BIO_METHOD *PROV_CTX_get0_core_bio_method(PROV_CTX *ctx)
{
if (ctx == NULL)
return NULL;
return ctx->corebiometh;
}
providers/common/provider_err.c
+4
View File
@@ -75,6 +75,8 @@ static const ERR_STRING_DATA PROV_str_reasons[] = {
"invalid salt length"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_INVALID_SEED_LENGTH),
"invalid seed length"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_INVALID_SIGNATURE_SIZE),
"invalid signature size"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_INVALID_TAG), "invalid tag"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_INVALID_TAGLEN), "invalid taglen"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_INVALID_X931_DIGEST),
@@ -101,6 +103,8 @@ static const ERR_STRING_DATA PROV_str_reasons[] = {
"not xof or invalid length"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_NO_KEY_SET), "no key set"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_NO_PARAMETERS_SET), "no parameters set"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE),
"operation not supported for this keytype"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_OUTPUT_BUFFER_TOO_SMALL),
"output buffer too small"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_PSS_SALTLEN_TOO_SMALL),
providers/common/provider_util.c
+4 -4
View File
@@ -46,7 +46,7 @@ static int load_common(const OSSL_PARAM params[], const char **propquery,
*engine = NULL;
/* TODO legacy stuff, to be removed */
/* Inside the FIPS module, we don't support legacy ciphers */
#if !defined(FIPS_MODE) && !defined(OPENSSL_NO_ENGINE)
#if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_ENGINE)
p = OSSL_PARAM_locate_const(params, "engine");
if (p != NULL) {
if (p->data_type != OSSL_PARAM_UTF8_STRING)
@@ -80,7 +80,7 @@ int ossl_prov_cipher_load_from_params(PROV_CIPHER *pc,
ERR_set_mark();
pc->cipher = pc->alloc_cipher = EVP_CIPHER_fetch(ctx, p->data, propquery);
/* TODO legacy stuff, to be removed */
#ifndef FIPS_MODE /* Inside the FIPS module, we don't support legacy ciphers */
#ifndef FIPS_MODULE /* Inside the FIPS module, we don't support legacy ciphers */
if (pc->cipher == NULL)
pc->cipher = EVP_get_cipherbyname(p->data);
#endif
@@ -140,7 +140,7 @@ int ossl_prov_digest_load_from_params(PROV_DIGEST *pd,
ERR_set_mark();
pd->md = pd->alloc_md = EVP_MD_fetch(ctx, p->data, propquery);
/* TODO legacy stuff, to be removed */
#ifndef FIPS_MODE /* Inside the FIPS module, we don't support legacy digests */
#ifndef FIPS_MODULE /* Inside the FIPS module, we don't support legacy digests */
if (pd->md == NULL)
pd->md = EVP_get_digestbyname(p->data);
#endif
@@ -231,7 +231,7 @@ int ossl_prov_macctx_load_from_params(EVP_MAC_CTX **macctx,
*mp++ = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_PROPERTIES,
(char *)properties, 0);
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
if ((p = OSSL_PARAM_locate_const(params, "engine")) != NULL) {
if (p->data_type != OSSL_PARAM_UTF8_STRING)
return 0;