Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update (add quic)

Browse Source
This commit is contained in:
Hakase
2020-07-12 19:52:18 +09:00
parent 3a6d64bb68
commit e85ee33eee
501 changed files with 19166 additions and 10232 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crypto/evp/encode.c
+1 -1
View File
@@ -423,7 +423,7 @@ static int evp_decodeblock_int(EVP_ENCODE_CTX *ctx, unsigned char *t,
table = data_ascii2bin;
/* trim white space from the start of the line. */
while ((conv_ascii2bin(*f, table) == B64_WS) && (n > 0)) {
while ((n > 0) && (conv_ascii2bin(*f, table) == B64_WS)) {
f++;
n--;
}
crypto/evp/evp_fetch.c
+7 -1
View File
@@ -444,7 +444,13 @@ void evp_generic_do_all(OPENSSL_CTX *libctx, int operation_id,
data.free_method = free_method;
data.user_fn = user_fn;
data.user_arg = user_arg;
ossl_algorithm_do_all(libctx, operation_id, NULL, do_one, &data);
/*
* No pre- or post-condition for this call, as this only creates methods
* temporarly and then promptly destroys them.
*/
ossl_algorithm_do_all(libctx, operation_id, NULL, NULL, do_one, NULL,
&data);
}
const char *evp_first_name(const OSSL_PROVIDER *prov, int name_id)
crypto/evp/exchange.c
+2 -2
View File
@@ -368,13 +368,13 @@ int EVP_PKEY_derive_set_peer(EVP_PKEY_CTX *ctx, EVP_PKEY *peer)
/*
* For clarity. The error is if parameters in peer are
* present (!missing) but don't match. EVP_PKEY_cmp_parameters may return
* present (!missing) but don't match. EVP_PKEY_parameters_eq may return
* 1 (match), 0 (don't match) and -2 (comparison is not defined). -1
* (different key types) is impossible here because it is checked earlier.
* -2 is OK for us here, as well as 1, so we can check for 0 only.
*/
if (!EVP_PKEY_missing_parameters(peer) &&
!EVP_PKEY_cmp_parameters(ctx->pkey, peer)) {
!EVP_PKEY_parameters_eq(ctx->pkey, peer)) {
EVPerr(EVP_F_EVP_PKEY_DERIVE_SET_PEER, EVP_R_DIFFERENT_PARAMETERS);
return -1;
}
crypto/evp/kdf_lib.c
+10 -10
View File
@@ -23,7 +23,7 @@
#include "internal/provider.h"
#include "evp_local.h"
EVP_KDF_CTX *EVP_KDF_CTX_new(EVP_KDF *kdf)
EVP_KDF_CTX *EVP_KDF_new_ctx(EVP_KDF *kdf)
{
EVP_KDF_CTX *ctx = NULL;
@@ -34,7 +34,7 @@ EVP_KDF_CTX *EVP_KDF_CTX_new(EVP_KDF *kdf)
if (ctx == NULL
|| (ctx->data = kdf->newctx(ossl_provider_ctx(kdf->prov))) == NULL
|| !EVP_KDF_up_ref(kdf)) {
EVPerr(EVP_F_EVP_KDF_CTX_NEW, ERR_R_MALLOC_FAILURE);
EVPerr(0, ERR_R_MALLOC_FAILURE);
if (ctx != NULL)
kdf->freectx(ctx->data);
OPENSSL_free(ctx);
@@ -45,7 +45,7 @@ EVP_KDF_CTX *EVP_KDF_CTX_new(EVP_KDF *kdf)
return ctx;
}
void EVP_KDF_CTX_free(EVP_KDF_CTX *ctx)
void EVP_KDF_free_ctx(EVP_KDF_CTX *ctx)
{
if (ctx != NULL) {
ctx->meth->freectx(ctx->data);
@@ -55,7 +55,7 @@ void EVP_KDF_CTX_free(EVP_KDF_CTX *ctx)
}
}
EVP_KDF_CTX *EVP_KDF_CTX_dup(const EVP_KDF_CTX *src)
EVP_KDF_CTX *EVP_KDF_dup_ctx(const EVP_KDF_CTX *src)
{
EVP_KDF_CTX *dst;
@@ -64,20 +64,20 @@ EVP_KDF_CTX *EVP_KDF_CTX_dup(const EVP_KDF_CTX *src)
dst = OPENSSL_malloc(sizeof(*dst));
if (dst == NULL) {
EVPerr(EVP_F_EVP_KDF_CTX_DUP, ERR_R_MALLOC_FAILURE);
EVPerr(0, ERR_R_MALLOC_FAILURE);
return NULL;
}
memcpy(dst, src, sizeof(*dst));
if (!EVP_KDF_up_ref(dst->meth)) {
EVPerr(EVP_F_EVP_KDF_CTX_DUP, ERR_R_MALLOC_FAILURE);
EVPerr(0, ERR_R_MALLOC_FAILURE);
OPENSSL_free(dst);
return NULL;
}
dst->data = src->meth->dupctx(src->data);
if (dst->data == NULL) {
EVP_KDF_CTX_free(dst);
EVP_KDF_free_ctx(dst);
return NULL;
}
return dst;
@@ -98,7 +98,7 @@ const OSSL_PROVIDER *EVP_KDF_provider(const EVP_KDF *kdf)
return kdf->prov;
}
const EVP_KDF *EVP_KDF_CTX_kdf(EVP_KDF_CTX *ctx)
const EVP_KDF *EVP_KDF_get_ctx_kdf(EVP_KDF_CTX *ctx)
{
return ctx->meth;
}
@@ -151,14 +151,14 @@ int EVP_KDF_get_params(EVP_KDF *kdf, OSSL_PARAM params[])
return 1;
}
int EVP_KDF_CTX_get_params(EVP_KDF_CTX *ctx, OSSL_PARAM params[])
int EVP_KDF_get_ctx_params(EVP_KDF_CTX *ctx, OSSL_PARAM params[])
{
if (ctx->meth->get_ctx_params != NULL)
return ctx->meth->get_ctx_params(ctx->data, params);
return 1;
}
int EVP_KDF_CTX_set_params(EVP_KDF_CTX *ctx, const OSSL_PARAM params[])
int EVP_KDF_set_ctx_params(EVP_KDF_CTX *ctx, const OSSL_PARAM params[])
{
if (ctx->meth->set_ctx_params != NULL)
return ctx->meth->set_ctx_params(ctx->data, params);
crypto/evp/keymgmt_lib.c
+9 -9
View File
@@ -39,6 +39,13 @@ static int try_import(const OSSL_PARAM params[], void *arg)
{
struct import_data_st *data = arg;
/* Just in time creation of keydata */
if (data->keydata == NULL
&& (data->keydata = evp_keymgmt_newdata(data->keymgmt)) == NULL) {
ERR_raise(ERR_LIB_EVP, ERR_R_MALLOC_FAILURE);
return 0;
}
/*
* It's fine if there was no data to transfer, we just end up with an
* empty destination key.
@@ -46,13 +53,6 @@ static int try_import(const OSSL_PARAM params[], void *arg)
if (params[0].key == NULL)
return 1;
/* Just in time creation of keydata, if needed */
if (data->keydata == NULL
&& (data->keydata = evp_keymgmt_newdata(data->keymgmt)) == NULL) {
ERR_raise(ERR_LIB_EVP, ERR_R_MALLOC_FAILURE);
return 0;
}
return evp_keymgmt_import(data->keymgmt, data->keydata, data->selection,
params);
}
@@ -236,8 +236,8 @@ int evp_keymgmt_util_has(EVP_PKEY *pk, int selection)
* but also in the operation cache to see if there's any common keymgmt that
* supplies OP_keymgmt_match.
*
* evp_keymgmt_util_match() adheres to the return values that EVP_PKEY_cmp()
* and EVP_PKEY_cmp_parameters() return, i.e.:
* evp_keymgmt_util_match() adheres to the return values that EVP_PKEY_eq()
* and EVP_PKEY_parameters_eq() return, i.e.:
*
* 1 same key
* 0 not same key
crypto/evp/mac_lib.c
+10 -10
View File
@@ -19,14 +19,14 @@
#include "internal/provider.h"
#include "evp_local.h"
EVP_MAC_CTX *EVP_MAC_CTX_new(EVP_MAC *mac)
EVP_MAC_CTX *EVP_MAC_new_ctx(EVP_MAC *mac)
{
EVP_MAC_CTX *ctx = OPENSSL_zalloc(sizeof(EVP_MAC_CTX));
if (ctx == NULL
|| (ctx->data = mac->newctx(ossl_provider_ctx(mac->prov))) == NULL
|| !EVP_MAC_up_ref(mac)) {
EVPerr(EVP_F_EVP_MAC_CTX_NEW, ERR_R_MALLOC_FAILURE);
EVPerr(0, ERR_R_MALLOC_FAILURE);
if (ctx != NULL)
mac->freectx(ctx->data);
OPENSSL_free(ctx);
@@ -37,7 +37,7 @@ EVP_MAC_CTX *EVP_MAC_CTX_new(EVP_MAC *mac)
return ctx;
}
void EVP_MAC_CTX_free(EVP_MAC_CTX *ctx)
void EVP_MAC_free_ctx(EVP_MAC_CTX *ctx)
{
if (ctx != NULL) {
ctx->meth->freectx(ctx->data);
@@ -48,7 +48,7 @@ void EVP_MAC_CTX_free(EVP_MAC_CTX *ctx)
OPENSSL_free(ctx);
}
EVP_MAC_CTX *EVP_MAC_CTX_dup(const EVP_MAC_CTX *src)
EVP_MAC_CTX *EVP_MAC_dup_ctx(const EVP_MAC_CTX *src)
{
EVP_MAC_CTX *dst;
@@ -57,27 +57,27 @@ EVP_MAC_CTX *EVP_MAC_CTX_dup(const EVP_MAC_CTX *src)
dst = OPENSSL_malloc(sizeof(*dst));
if (dst == NULL) {
EVPerr(EVP_F_EVP_MAC_CTX_DUP, ERR_R_MALLOC_FAILURE);
EVPerr(0, ERR_R_MALLOC_FAILURE);
return NULL;
}
*dst = *src;
if (!EVP_MAC_up_ref(dst->meth)) {
EVPerr(EVP_F_EVP_MAC_CTX_DUP, ERR_R_MALLOC_FAILURE);
EVPerr(0, ERR_R_MALLOC_FAILURE);
OPENSSL_free(dst);
return NULL;
}
dst->data = src->meth->dupctx(src->data);
if (dst->data == NULL) {
EVP_MAC_CTX_free(dst);
EVP_MAC_free_ctx(dst);
return NULL;
}
return dst;
}
EVP_MAC *EVP_MAC_CTX_mac(EVP_MAC_CTX *ctx)
EVP_MAC *EVP_MAC_get_ctx_mac(EVP_MAC_CTX *ctx)
{
return ctx->meth;
}
@@ -144,14 +144,14 @@ int EVP_MAC_get_params(EVP_MAC *mac, OSSL_PARAM params[])
return 1;
}
int EVP_MAC_CTX_get_params(EVP_MAC_CTX *ctx, OSSL_PARAM params[])
int EVP_MAC_get_ctx_params(EVP_MAC_CTX *ctx, OSSL_PARAM params[])
{
if (ctx->meth->get_ctx_params != NULL)
return ctx->meth->get_ctx_params(ctx->data, params);
return 1;
}
int EVP_MAC_CTX_set_params(EVP_MAC_CTX *ctx, const OSSL_PARAM params[])
int EVP_MAC_set_ctx_params(EVP_MAC_CTX *ctx, const OSSL_PARAM params[])
{
if (ctx->meth->set_ctx_params != NULL)
return ctx->meth->set_ctx_params(ctx->data, params);
crypto/evp/p5_crpt2.c
+3 -3
View File
@@ -41,7 +41,7 @@ int PKCS5_PBKDF2_HMAC(const char *pass, int passlen,
salt = (unsigned char *)empty;
kdf = EVP_KDF_fetch(NULL, OSSL_KDF_NAME_PBKDF2, NULL);
kctx = EVP_KDF_CTX_new(kdf);
kctx = EVP_KDF_new_ctx(kdf);
EVP_KDF_free(kdf);
if (kctx == NULL)
return 0;
@@ -54,11 +54,11 @@ int PKCS5_PBKDF2_HMAC(const char *pass, int passlen,
*p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
(char *)mdname, 0);
*p = OSSL_PARAM_construct_end();
if (EVP_KDF_CTX_set_params(kctx, params) != 1
if (EVP_KDF_set_ctx_params(kctx, params) != 1
|| EVP_KDF_derive(kctx, out, keylen) != 1)
rv = 0;
EVP_KDF_CTX_free(kctx);
EVP_KDF_free_ctx(kctx);
OSSL_TRACE_BEGIN(PKCS5V2) {
BIO_printf(trc_out, "Password:\n");
crypto/evp/p_lib.c
+87 -35
View File
@@ -119,7 +119,7 @@ int EVP_PKEY_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from)
* If |to| is a legacy key and |from| isn't, we must downgrade |from|.
* If that fails, this function fails.
*/
if (to->type != EVP_PKEY_NONE && from->keymgmt != NULL)
if (evp_pkey_is_legacy(to) && evp_pkey_is_provided(from))
if (!evp_pkey_downgrade((EVP_PKEY *)from))
return 0;
@@ -135,15 +135,15 @@ int EVP_PKEY_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from)
* like evp_keymgmt_util_copy() and evp_pkey_export_to_provider() called
* further down help us find out if they are the same or not.
*/
if (to->type == EVP_PKEY_NONE && to->keymgmt == NULL) {
if (from->type != EVP_PKEY_NONE) {
if (evp_pkey_is_blank(to)) {
if (evp_pkey_is_legacy(from)) {
if (EVP_PKEY_set_type(to, from->type) == 0)
return 0;
} else {
if (EVP_PKEY_set_type_by_keymgmt(to, from->keymgmt) == 0)
return 0;
}
} else if (to->type != EVP_PKEY_NONE) {
} else if (evp_pkey_is_legacy(to)) {
if (to->type != from->type) {
EVPerr(EVP_F_EVP_PKEY_COPY_PARAMETERS, EVP_R_DIFFERENT_KEY_TYPES);
goto err;
@@ -156,7 +156,7 @@ int EVP_PKEY_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from)
}
if (!EVP_PKEY_missing_parameters(to)) {
if (EVP_PKEY_cmp_parameters(to, from) == 1)
if (EVP_PKEY_parameters_eq(to, from) == 1)
return 1;
EVPerr(EVP_F_EVP_PKEY_COPY_PARAMETERS, EVP_R_DIFFERENT_PARAMETERS);
return 0;
@@ -272,7 +272,14 @@ static int evp_pkey_cmp_any(const EVP_PKEY *a, const EVP_PKEY *b,
return evp_keymgmt_match(keymgmt1, keydata1, keydata2, selection);
}
#ifndef OPENSSL_NO_DEPRECATED_3_0
int EVP_PKEY_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b)
{
return EVP_PKEY_parameters_eq(a, b);
}
#endif
int EVP_PKEY_parameters_eq(const EVP_PKEY *a, const EVP_PKEY *b)
{
/*
* TODO: clean up legacy stuff from this function when legacy support
@@ -290,7 +297,14 @@ int EVP_PKEY_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b)
return -2;
}
#ifndef OPENSSL_NO_DEPRECATED_3_0
int EVP_PKEY_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
{
return EVP_PKEY_eq(a, b);
}
#endif
int EVP_PKEY_eq(const EVP_PKEY *a, const EVP_PKEY *b)
{
/*
* TODO: clean up legacy stuff from this function when legacy support
@@ -581,7 +595,7 @@ EVP_PKEY *EVP_PKEY_new_CMAC_key(ENGINE *e, const unsigned char *priv,
prov == NULL ? NULL : ossl_provider_library_context(prov);
EVP_PKEY *ret = EVP_PKEY_new();
EVP_MAC *cmac = EVP_MAC_fetch(libctx, OSSL_MAC_NAME_CMAC, NULL);
EVP_MAC_CTX *cmctx = cmac != NULL ? EVP_MAC_CTX_new(cmac) : NULL;
EVP_MAC_CTX *cmctx = cmac != NULL ? EVP_MAC_new_ctx(cmac) : NULL;
OSSL_PARAM params[4];
size_t paramsn = 0;
@@ -606,7 +620,7 @@ EVP_PKEY *EVP_PKEY_new_CMAC_key(ENGINE *e, const unsigned char *priv,
(char *)priv, len);
params[paramsn] = OSSL_PARAM_construct_end();
if (!EVP_MAC_CTX_set_params(cmctx, params)) {
if (!EVP_MAC_set_ctx_params(cmctx, params)) {
EVPerr(EVP_F_EVP_PKEY_NEW_CMAC_KEY, EVP_R_KEY_SETUP_FAILED);
goto err;
}
@@ -616,7 +630,7 @@ EVP_PKEY *EVP_PKEY_new_CMAC_key(ENGINE *e, const unsigned char *priv,
err:
EVP_PKEY_free(ret);
EVP_MAC_CTX_free(cmctx);
EVP_MAC_free_ctx(cmctx);
EVP_MAC_free(cmac);
return NULL;
# else
@@ -1201,6 +1215,18 @@ int EVP_PKEY_supports_digest_nid(EVP_PKEY *pkey, int nid)
int EVP_PKEY_set1_tls_encodedpoint(EVP_PKEY *pkey,
const unsigned char *pt, size_t ptlen)
{
if (pkey->ameth == NULL) {
OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
if (pkey->keymgmt == NULL || pkey->keydata == NULL)
return 0;
params[0] =
OSSL_PARAM_construct_octet_string(OSSL_PKEY_PARAM_TLS_ENCODED_PT,
(unsigned char *)pt, ptlen);
return evp_keymgmt_set_params(pkey->keymgmt, pkey->keydata, params);
}
if (ptlen > INT_MAX)
return 0;
if (evp_pkey_asn1_ctrl(pkey, ASN1_PKEY_CTRL_SET1_TLS_ENCPT, ptlen,
@@ -1212,6 +1238,33 @@ int EVP_PKEY_set1_tls_encodedpoint(EVP_PKEY *pkey,
size_t EVP_PKEY_get1_tls_encodedpoint(EVP_PKEY *pkey, unsigned char **ppt)
{
int rv;
if (pkey->ameth == NULL) {
OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
if (pkey->keymgmt == NULL || pkey->keydata == NULL)
return 0;
params[0] =
OSSL_PARAM_construct_octet_string(OSSL_PKEY_PARAM_TLS_ENCODED_PT,
NULL, 0);
if (!evp_keymgmt_get_params(pkey->keymgmt, pkey->keydata, params))
return 0;
*ppt = OPENSSL_malloc(params[0].return_size);
if (*ppt == NULL)
return 0;
params[0] =
OSSL_PARAM_construct_octet_string(OSSL_PKEY_PARAM_TLS_ENCODED_PT,
*ppt, params[0].return_size);
if (!evp_keymgmt_get_params(pkey->keymgmt, pkey->keydata, params))
return 0;
return params[0].return_size;
}
rv = evp_pkey_asn1_ctrl(pkey, ASN1_PKEY_CTRL_GET1_TLS_ENCPT, 0, ppt);
if (rv <= 0)
return 0;
@@ -1357,19 +1410,17 @@ static int pkey_set_type(EVP_PKEY *pkey, ENGINE *e, int type, const char *str,
pkey->engine = e;
/*
* The EVP_PKEY_ASN1_METHOD |pkey_id| serves different purposes,
* depending on if we're setting this key to contain a legacy or
* a provider side "origin" key. For a legacy key, we assign it
* to the |type| field, but for a provider side key, we assign it
* to the |save_type| field, because |type| is supposed to be set
* to EVP_PKEY_NONE in that case.
* The EVP_PKEY_ASN1_METHOD |pkey_id| retains its legacy key purpose
* for any key type that has a legacy implementation, regardless of
* if the internal key is a legacy or a provider side one. When
* there is no legacy implementation for the key, the type becomes
* EVP_PKEY_KEYMGMT, which indicates that one should be cautious
* with functions that expect legacy internal keys.
*/
if (ameth != NULL) {
if (keymgmt != NULL)
pkey->save_type = ameth->pkey_id;
else if (pkey->ameth != NULL)
pkey->type = ameth->pkey_id;
}
if (ameth != NULL)
pkey->type = ameth->pkey_id;
else
pkey->type = EVP_PKEY_KEYMGMT;
#endif
}
return 1;
@@ -1453,7 +1504,6 @@ void evp_pkey_free_legacy(EVP_PKEY *x)
ENGINE_finish(x->pmeth_engine);
x->pmeth_engine = NULL;
# endif
x->type = EVP_PKEY_NONE;
}
#endif /* FIPS_MODULE */
@@ -1472,6 +1522,7 @@ static void evp_pkey_free_it(EVP_PKEY *x)
x->keymgmt = NULL;
x->keydata = NULL;
}
x->type = EVP_PKEY_NONE;
}
void EVP_PKEY_free(EVP_PKEY *x)
@@ -1661,32 +1712,33 @@ int evp_pkey_downgrade(EVP_PKEY *pk)
{
EVP_KEYMGMT *keymgmt = pk->keymgmt;
void *keydata = pk->keydata;
int type = pk->save_type;
int type = pk->type;
const char *keytype = NULL;
/* If this isn't a provider side key, we're done */
if (keymgmt == NULL)
return 1;
/* Get the key type name for error reporting */
if (type != EVP_PKEY_NONE)
keytype = OBJ_nid2sn(type);
else
keytype =
evp_first_name(EVP_KEYMGMT_provider(keymgmt), keymgmt->name_id);
keytype = evp_first_name(EVP_KEYMGMT_provider(keymgmt), keymgmt->name_id);
/*
* |save_type| was set when any of the EVP_PKEY_set_type functions
* was called. It was set to EVP_PKEY_NONE if the key type wasn't
* recognised to be any of the legacy key types, and the downgrade
* isn't possible.
* If the type is EVP_PKEY_NONE, then we have a problem somewhere else
* in our code. If it's not one of the well known EVP_PKEY_xxx values,
* it should at least be EVP_PKEY_KEYMGMT at this point.
* TODO(3.0) remove this check when we're confident that the rest of the
* code treats this correctly.
*/
if (type == EVP_PKEY_NONE) {
ERR_raise_data(ERR_LIB_EVP, EVP_R_UNKNOWN_KEY_TYPE,
"key type = %s, can't downgrade", keytype);
if (!ossl_assert(type != EVP_PKEY_NONE)) {
ERR_raise_data(ERR_LIB_EVP, ERR_R_INTERNAL_ERROR,
"keymgmt key type = %s but legacy type = EVP_PKEY_NONE",
keytype);
return 0;
}
/* Prefer the legacy key type name for error reporting */
if (type != EVP_PKEY_KEYMGMT)
keytype = OBJ_nid2sn(type);
/*
* To be able to downgrade, we steal the provider side "origin" keymgmt
* and keydata. We've already grabbed the pointers, so all we need to
crypto/evp/pbe_scrypt.c
+3 -3
View File
@@ -63,7 +63,7 @@ int EVP_PBE_scrypt(const char *pass, size_t passlen,
maxmem = SCRYPT_MAX_MEM;
kdf = EVP_KDF_fetch(NULL, OSSL_KDF_NAME_SCRYPT, NULL);
kctx = EVP_KDF_CTX_new(kdf);
kctx = EVP_KDF_new_ctx(kdf);
EVP_KDF_free(kdf);
if (kctx == NULL)
return 0;
@@ -78,11 +78,11 @@ int EVP_PBE_scrypt(const char *pass, size_t passlen,
*z++ = OSSL_PARAM_construct_uint64(OSSL_KDF_PARAM_SCRYPT_P, &p);
*z++ = OSSL_PARAM_construct_uint64(OSSL_KDF_PARAM_SCRYPT_MAXMEM, &maxmem);
*z = OSSL_PARAM_construct_end();
if (EVP_KDF_CTX_set_params(kctx, params) != 1
if (EVP_KDF_set_ctx_params(kctx, params) != 1
|| EVP_KDF_derive(kctx, key, keylen) != 1)
rv = 0;
EVP_KDF_CTX_free(kctx);
EVP_KDF_free_ctx(kctx);
return rv;
}
crypto/evp/pkey_kdf.c
+7 -7
View File
@@ -50,7 +50,7 @@ static int pkey_kdf_init(EVP_PKEY_CTX *ctx)
return 0;
kdf = EVP_KDF_fetch(NULL, kdf_name, NULL);
kctx = EVP_KDF_CTX_new(kdf);
kctx = EVP_KDF_new_ctx(kdf);
EVP_KDF_free(kdf);
if (kctx == NULL) {
OPENSSL_free(pkctx);
@@ -66,7 +66,7 @@ static void pkey_kdf_cleanup(EVP_PKEY_CTX *ctx)
{
EVP_PKEY_KDF_CTX *pkctx = ctx->data;
EVP_KDF_CTX_free(pkctx->kctx);
EVP_KDF_free_ctx(pkctx->kctx);
pkey_kdf_free_collected(pkctx);
OPENSSL_free(pkctx);
}
@@ -202,7 +202,7 @@ static int pkey_kdf_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
break;
}
return EVP_KDF_CTX_set_params(kctx, params);
return EVP_KDF_set_ctx_params(kctx, params);
}
static int pkey_kdf_ctrl_str(EVP_PKEY_CTX *ctx, const char *type,
@@ -210,7 +210,7 @@ static int pkey_kdf_ctrl_str(EVP_PKEY_CTX *ctx, const char *type,
{
EVP_PKEY_KDF_CTX *pkctx = ctx->data;
EVP_KDF_CTX *kctx = pkctx->kctx;
const EVP_KDF *kdf = EVP_KDF_CTX_kdf(kctx);
const EVP_KDF *kdf = EVP_KDF_get_ctx_kdf(kctx);
BUF_MEM **collector = NULL;
const OSSL_PARAM *defs = EVP_KDF_settable_ctx_params(kdf);
OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
@@ -239,7 +239,7 @@ static int pkey_kdf_ctrl_str(EVP_PKEY_CTX *ctx, const char *type,
if (collector != NULL)
ok = collect(collector, params[0].data, params[0].data_size);
else
ok = EVP_KDF_CTX_set_params(kctx, params);
ok = EVP_KDF_set_ctx_params(kctx, params);
OPENSSL_free(params[0].data);
return ok;
}
@@ -274,7 +274,7 @@ static int pkey_kdf_derive(EVP_PKEY_CTX *ctx, unsigned char *key,
pkctx->collected_seed->data,
pkctx->collected_seed->length);
r = EVP_KDF_CTX_set_params(kctx, params);
r = EVP_KDF_set_ctx_params(kctx, params);
pkey_kdf_free_collected(pkctx);
if (!r)
return 0;
@@ -287,7 +287,7 @@ static int pkey_kdf_derive(EVP_PKEY_CTX *ctx, unsigned char *key,
pkctx->collected_info->data,
pkctx->collected_info->length);
r = EVP_KDF_CTX_set_params(kctx, params);
r = EVP_KDF_set_ctx_params(kctx, params);
pkey_kdf_free_collected(pkctx);
if (!r)
return 0;
crypto/evp/pkey_mac.c
+20 -19
View File
@@ -71,7 +71,7 @@ static int pkey_mac_init(EVP_PKEY_CTX *ctx)
}
if (mac != NULL) {
hctx->ctx = EVP_MAC_CTX_new(mac);
hctx->ctx = EVP_MAC_new_ctx(mac);
if (hctx->ctx == NULL) {
OPENSSL_free(hctx);
return 0;
@@ -116,7 +116,7 @@ static int pkey_mac_copy(EVP_PKEY_CTX *dst, const EVP_PKEY_CTX *src)
EVP_PKEY_CTX_set_data(dst, dctx);
dst->keygen_info_count = 0;
dctx->ctx = EVP_MAC_CTX_dup(sctx->ctx);
dctx->ctx = EVP_MAC_dup_ctx(sctx->ctx);
if (dctx->ctx == NULL)
goto err;
@@ -128,7 +128,7 @@ static int pkey_mac_copy(EVP_PKEY_CTX *dst, const EVP_PKEY_CTX *src)
* fetches the MAC method anew in this case. Therefore, its reference
* count must be adjusted here.
*/
if (!EVP_MAC_up_ref(EVP_MAC_CTX_mac(dctx->ctx)))
if (!EVP_MAC_up_ref(EVP_MAC_get_ctx_mac(dctx->ctx)))
goto err;
dctx->type = sctx->type;
@@ -163,7 +163,8 @@ static void pkey_mac_cleanup(EVP_PKEY_CTX *ctx)
MAC_PKEY_CTX *hctx = ctx == NULL ? NULL : EVP_PKEY_CTX_get_data(ctx);
if (hctx != NULL) {
EVP_MAC *mac = hctx->ctx != NULL ? EVP_MAC_CTX_mac(hctx->ctx) : NULL;
EVP_MAC *mac = hctx->ctx != NULL ? EVP_MAC_get_ctx_mac(hctx->ctx)
: NULL;
switch (hctx->type) {
case MAC_TYPE_RAW:
@@ -171,7 +172,7 @@ static void pkey_mac_cleanup(EVP_PKEY_CTX *ctx)
hctx->raw_data.ktmp.length);
break;
}
EVP_MAC_CTX_free(hctx->ctx);
EVP_MAC_free_ctx(hctx->ctx);
EVP_MAC_free(mac);
OPENSSL_free(hctx);
EVP_PKEY_CTX_set_data(ctx, NULL);
@@ -206,10 +207,10 @@ static int pkey_mac_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
return 0;
}
cmkey = EVP_MAC_CTX_dup(hctx->ctx);
cmkey = EVP_MAC_dup_ctx(hctx->ctx);
if (cmkey == NULL)
return 0;
if (!EVP_MAC_up_ref(EVP_MAC_CTX_mac(hctx->ctx)))
if (!EVP_MAC_up_ref(EVP_MAC_get_ctx_mac(hctx->ctx)))
return 0;
EVP_PKEY_assign(pkey, nid, cmkey);
}
@@ -255,7 +256,7 @@ static int pkey_mac_signctx_init(EVP_PKEY_CTX *ctx, EVP_MD_CTX *mctx)
}
if (set_key) {
if (!EVP_MAC_is_a(EVP_MAC_CTX_mac(hctx->ctx),
if (!EVP_MAC_is_a(EVP_MAC_get_ctx_mac(hctx->ctx),
OBJ_nid2sn(EVP_PKEY_id(EVP_PKEY_CTX_get0_pkey(ctx)))))
return 0;
key = EVP_PKEY_get0(EVP_PKEY_CTX_get0_pkey(ctx));
@@ -280,7 +281,7 @@ static int pkey_mac_signctx_init(EVP_PKEY_CTX *ctx, EVP_MD_CTX *mctx)
OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY,
key->data, key->length);
params[params_n++] = OSSL_PARAM_construct_end();
rv = EVP_MAC_CTX_set_params(hctx->ctx, params);
rv = EVP_MAC_set_ctx_params(hctx->ctx, params);
}
return rv;
}
@@ -330,7 +331,7 @@ static int pkey_mac_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
return 0;
}
if (!EVP_MAC_CTX_set_params(hctx->ctx, params)
if (!EVP_MAC_set_ctx_params(hctx->ctx, params)
|| !EVP_MAC_init(hctx->ctx))
return 0;
}
@@ -351,10 +352,10 @@ static int pkey_mac_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
if (ctx->pkey == NULL)
return 0;
new_mac_ctx = EVP_MAC_CTX_dup(ctx->pkey->pkey.ptr);
new_mac_ctx = EVP_MAC_dup_ctx(ctx->pkey->pkey.ptr);
if (new_mac_ctx == NULL)
return 0;
EVP_MAC_CTX_free(hctx->ctx);
EVP_MAC_free_ctx(hctx->ctx);
hctx->ctx = new_mac_ctx;
}
break;
@@ -389,17 +390,17 @@ static int pkey_mac_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
return 0;
}
if (!EVP_MAC_CTX_set_params(hctx->ctx, params))
if (!EVP_MAC_set_ctx_params(hctx->ctx, params))
return 0;
params[0] =
OSSL_PARAM_construct_size_t(OSSL_MAC_PARAM_SIZE, &verify);
if (!EVP_MAC_CTX_get_params(hctx->ctx, params))
if (!EVP_MAC_get_ctx_params(hctx->ctx, params))
return 0;
/*
* Since EVP_MAC_CTX_{get,set}_params() returned successfully,
* Since EVP_MAC_{get,set}_ctx_params() returned successfully,
* we can only assume that the size was ignored, i.e. this
* control is unsupported.
*/
@@ -433,7 +434,7 @@ static int pkey_mac_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
return 0;
}
return EVP_MAC_CTX_set_params(hctx->ctx, params);
return EVP_MAC_set_ctx_params(hctx->ctx, params);
}
break;
default:
@@ -478,7 +479,7 @@ static int pkey_mac_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
key->data, key->length);
params[params_n] = OSSL_PARAM_construct_end();
return EVP_MAC_CTX_set_params(hctx->ctx, params);
return EVP_MAC_set_ctx_params(hctx->ctx, params);
}
break;
case MAC_TYPE_MAC:
@@ -513,7 +514,7 @@ static int pkey_mac_ctrl_str(EVP_PKEY_CTX *ctx,
EVPerr(0, EVP_R_FETCH_FAILED);
return 0;
}
mac = EVP_MAC_CTX_mac(hctx->ctx);
mac = EVP_MAC_get_ctx_mac(hctx->ctx);
/*
* Translation of some control names that are equivalent to a single
@@ -535,7 +536,7 @@ static int pkey_mac_ctrl_str(EVP_PKEY_CTX *ctx,
return 0;
params[1] = OSSL_PARAM_construct_end();
ok = EVP_MAC_CTX_set_params(hctx->ctx, params);
ok = EVP_MAC_set_ctx_params(hctx->ctx, params);
OPENSSL_free(params[0].data);
return ok;
}
crypto/evp/pmeth_gn.c
+16
View File
@@ -144,6 +144,8 @@ int EVP_PKEY_gen(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey)
int ret = 0;
OSSL_CALLBACK cb;
EVP_PKEY *allocated_pkey = NULL;
/* Legacy compatible keygen callback info, only used with provider impls */
int gentmp[2];
if (ppkey == NULL)
return -1;
@@ -165,6 +167,18 @@ int EVP_PKEY_gen(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey)
if (ctx->op.keymgmt.genctx == NULL)
goto legacy;
/*
* Asssigning gentmp to ctx->keygen_info is something our legacy
* implementations do. Because the provider implementations aren't
* allowed to reach into our EVP_PKEY_CTX, we need to provide similar
* space for backward compatibility. It's ok that we attach a local
* variable, as it should only be useful in the calls down from here.
* This is cleared as soon as it isn't useful any more, i.e. directly
* after the evp_keymgmt_util_gen() call.
*/
ctx->keygen_info = gentmp;
ctx->keygen_info_count = 2;
ret = 1;
if (ctx->pkey != NULL) {
EVP_KEYMGMT *tmp_keymgmt = ctx->keymgmt;
@@ -191,6 +205,8 @@ int EVP_PKEY_gen(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey)
ossl_callback_to_pkey_gencb, ctx)
!= NULL);
ctx->keygen_info = NULL;
#ifndef FIPS_MODULE
/* In case |*ppkey| was originally a legacy key */
if (ret)
crypto/evp/pmeth_lib.c
+59 -46
View File
@@ -137,6 +137,40 @@ EVP_PKEY_METHOD *EVP_PKEY_meth_new(int id, int flags)
}
#endif /* FIPS_MODULE */
static int is_legacy_alg(int id, const char *keytype)
{
#ifndef FIPS_MODULE
/* Certain EVP_PKEY keytypes are only available in legacy form */
if (id == -1) {
id = OBJ_sn2nid(keytype);
if (id == NID_undef)
id = OBJ_ln2nid(keytype);
if (id == NID_undef)
return 0;
}
switch (id) {
/*
* TODO(3.0): Remove SM2 and DHX when they are converted to have provider
* support
*/
case EVP_PKEY_SM2:
case EVP_PKEY_DHX:
case EVP_PKEY_SCRYPT:
case EVP_PKEY_TLS1_PRF:
case EVP_PKEY_HKDF:
case EVP_PKEY_CMAC:
case EVP_PKEY_HMAC:
case EVP_PKEY_SIPHASH:
case EVP_PKEY_POLY1305:
return 1;
default:
return 0;
}
#else
return 0;
#endif
}
static EVP_PKEY_CTX *int_ctx_new(OPENSSL_CTX *libctx,
EVP_PKEY *pkey, ENGINE *e,
const char *keytype, const char *propquery,
@@ -155,10 +189,10 @@ static EVP_PKEY_CTX *int_ctx_new(OPENSSL_CTX *libctx,
goto common;
/*
* If the key doesn't contain anything legacy, then it must be provided,
* so we extract the necessary information and use that.
* If the internal key is provided, we extract the keytype from its
* keymgmt and skip over the legacy code.
*/
if (pkey != NULL && pkey->type == EVP_PKEY_NONE) {
if (pkey != NULL && evp_pkey_is_provided(pkey)) {
/* If we have an engine, something went wrong somewhere... */
if (!ossl_assert(e == NULL))
return NULL;
@@ -228,10 +262,20 @@ static EVP_PKEY_CTX *int_ctx_new(OPENSSL_CTX *libctx,
* implementation.
*/
if (e == NULL && keytype != NULL) {
/* This could fail so ignore errors */
ERR_set_mark();
int legacy = is_legacy_alg(id, keytype);
if (legacy) {
/* This could fail so ignore errors */
ERR_set_mark();
}
keymgmt = EVP_KEYMGMT_fetch(libctx, keytype, propquery);
ERR_pop_to_mark();
if (legacy) {
ERR_pop_to_mark();
} else if (keymgmt == NULL) {
EVPerr(EVP_F_INT_CTX_NEW, EVP_R_FETCH_FAILED);
return NULL;
}
}
ret = OPENSSL_zalloc(sizeof(*ret));
@@ -341,45 +385,14 @@ void EVP_PKEY_meth_get0_info(int *ppkey_id, int *pflags,
void EVP_PKEY_meth_copy(EVP_PKEY_METHOD *dst, const EVP_PKEY_METHOD *src)
{
int pkey_id = dst->pkey_id;
int flags = dst->flags;
dst->init = src->init;
dst->copy = src->copy;
dst->cleanup = src->cleanup;
*dst = *src;
dst->paramgen_init = src->paramgen_init;
dst->paramgen = src->paramgen;
dst->keygen_init = src->keygen_init;
dst->keygen = src->keygen;
dst->sign_init = src->sign_init;
dst->sign = src->sign;
dst->verify_init = src->verify_init;
dst->verify = src->verify;
dst->verify_recover_init = src->verify_recover_init;
dst->verify_recover = src->verify_recover;
dst->signctx_init = src->signctx_init;
dst->signctx = src->signctx;
dst->verifyctx_init = src->verifyctx_init;
dst->verifyctx = src->verifyctx;
dst->encrypt_init = src->encrypt_init;
dst->encrypt = src->encrypt;
dst->decrypt_init = src->decrypt_init;
dst->decrypt = src->decrypt;
dst->derive_init = src->derive_init;
dst->derive = src->derive;
dst->ctrl = src->ctrl;
dst->ctrl_str = src->ctrl_str;
dst->check = src->check;
/* We only copy the function pointers so restore the other values */
dst->pkey_id = pkey_id;
dst->flags = flags;
}
void EVP_PKEY_meth_free(EVP_PKEY_METHOD *pmeth)
@@ -1033,7 +1046,7 @@ static int legacy_ctrl_str_to_param(EVP_PKEY_CTX *ctx, const char *name,
# endif
# ifndef OPENSSL_NO_DH
else if (strcmp(name, "dh_paramgen_generator") == 0)
name = OSSL_PKEY_PARAM_FFC_GENERATOR;
name = OSSL_PKEY_PARAM_DH_GENERATOR;
else if (strcmp(name, "dh_paramgen_prime_len") == 0)
name = OSSL_PKEY_PARAM_FFC_PBITS;
else if (strcmp(name, "dh_paramgen_subprime_len") == 0)
@@ -1042,9 +1055,9 @@ static int legacy_ctrl_str_to_param(EVP_PKEY_CTX *ctx, const char *name,
name = OSSL_PKEY_PARAM_FFC_TYPE;
value = dh_gen_type_id2name(atoi(value));
} else if (strcmp(name, "dh_param") == 0)
name = OSSL_PKEY_PARAM_FFC_GROUP;
name = OSSL_PKEY_PARAM_DH_GROUP;
else if (strcmp(name, "dh_rfc5114") == 0) {
name = OSSL_PKEY_PARAM_FFC_GROUP;
name = OSSL_PKEY_PARAM_DH_GROUP;
value = ffc_named_group_from_uid(atoi(value));
} else if (strcmp(name, "dh_pad") == 0)
name = OSSL_EXCHANGE_PARAM_PAD;