Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update (add quic)

Browse Source
This commit is contained in:
Hakase
2020-07-12 19:52:18 +09:00
parent 3a6d64bb68
commit e85ee33eee
501 changed files with 19166 additions and 10232 deletions
Download Patch File Download Diff File Expand all files Collapse all files
providers/common/bio_prov.c
+1 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
providers/common/der/DIGESTS.asn1
+18 -1
View File
@@ -1,5 +1,22 @@
-- -------------------------------------------------------------------
-- Taken from https://csrc.nist.gov/projects/computer-security-objects-register/algorithm-registration
-- From https://tools.ietf.org/html/rfc4055#section-2.1
id-sha1 OBJECT IDENTIFIER ::= { iso(1)
identified-organization(3) oiw(14)
secsig(3) algorithms(2) 26 }
-- -------------------------------------------------------------------
-- From https://tools.ietf.org/html/rfc5480#appendix-A
-- (OIDs for MD2 and MD5 are allowed only in EMSA-PKCS1-v1_5)
id-md2 OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 2 }
id-md5 OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 5 }
-- -------------------------------------------------------------------
-- From https://csrc.nist.gov/projects/computer-security-objects-register/algorithm-registration
id-sha256 OBJECT IDENTIFIER ::= { hashAlgs 1 }
id-sha384 OBJECT IDENTIFIER ::= { hashAlgs 2 }
providers/common/der/RSA.asn1
-19
View File
@@ -52,25 +52,6 @@ sha512WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 13 }
sha512-224WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 15 }
sha512-256WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 16 }
--
-- This OID really belongs in a module with the secsig OIDs.
--
id-sha1 OBJECT IDENTIFIER ::= {
iso(1) identified-organization(3) oiw(14) secsig(3) algorithms(2)
26
}
--
-- OIDs for MD2 and MD5, allowed only in EMSA-PKCS1-v1_5.
--
id-md2 OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 2
}
id-md5 OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 5
}
--
-- When id-mgf1 is used in an AlgorithmIdentifier, the parameters
-- MUST be present and MUST be a HashAlgorithm, for example, sha1.
providers/common/der/build.info
+55 -23
View File
@@ -1,32 +1,64 @@
$FIPSABLE=der_rsa.c der_dsa.c der_ec.c der_digests.c
#----- Digests
$DER_DIGESTS_H=../include/prov/der_digests.h
$DER_DIGESTS_GEN=der_digests_gen.c
SOURCE[../../libfips.a]=$FIPSABLE
SOURCE[../../libnonfips.a]=$FIPSABLE
GENERATE[$DER_DIGESTS_GEN]=der_digests_gen.c.in
DEPEND[$DER_DIGESTS_GEN]=oids_to_c.pm
GENERATE[der_rsa.c]=der_rsa.c.in
DEPEND[der_rsa.c]=oids_to_c.pm
DEPEND[${DER_DIGESTS_GEN/.c/.o}]=$DER_DIGESTS_H
GENERATE[$DER_DIGESTS_H]=der_digests.h.in
DEPEND[$DER_DIGESTS_H]=oids_to_c.pm
DEPEND[der_rsa.o]=../include/prov/der_rsa.h ../include/prov/der_digests.h
GENERATE[../include/prov/der_rsa.h]=der_rsa.h.in
DEPEND[../include/prov/der_rsa.h]=oids_to_c.pm
#----- RSA
$DER_RSA_H=../include/prov/der_rsa.h
$DER_RSA_GEN=der_rsa_gen.c
$DER_RSA_AUX=der_rsa_key.c der_rsa_sig.c
$DER_RSA_COMMON=$DER_RSA_GEN der_rsa_sig.c
$DER_RSA_FIPSABLE=der_rsa_key.c
GENERATE[der_dsa.c]=der_dsa.c.in
DEPEND[der_dsa.c]=oids_to_c.pm
GENERATE[$DER_RSA_GEN]=der_rsa_gen.c.in
DEPEND[$DER_RSA_GEN]=oids_to_c.pm
DEPEND[der_dsa.o]=../include/prov/der_dsa.h
GENERATE[../include/prov/der_dsa.h]=der_dsa.h.in
DEPEND[../include/prov/der_dsa.h]=oids_to_c.pm
DEPEND[${DER_RSA_AUX/.c/.o}]=$DER_RSA_H $DER_DIGESTS_H
DEPEND[${DER_RSA_GEN/.c/.o}]=$DER_RSA_H
GENERATE[$DER_RSA_H]=der_rsa.h.in
DEPEND[$DER_RSA_H]=oids_to_c.pm
GENERATE[der_ec.c]=der_ec.c.in
DEPEND[der_ec.c]=oids_to_c.pm
#----- DSA
$DER_DSA_H=../include/prov/der_dsa.h
$DER_DSA_GEN=der_dsa_gen.c
$DER_DSA_AUX=der_dsa_key.c der_dsa_sig.c
DEPEND[der_ec.o]=../include/prov/der_ec.h
GENERATE[../include/prov/der_ec.h]=der_ec.h.in
DEPEND[../include/prov/der_ec.h]=oids_to_c.pm
GENERATE[$DER_DSA_GEN]=der_dsa_gen.c.in
DEPEND[$DER_DSA_GEN]=oids_to_c.pm
GENERATE[der_digests.c]=der_digests.c.in
DEPEND[der_digests.c]=oids_to_c.pm
DEPEND[${DER_DSA_AUX/.c/.o}]=$DER_DSA_H $DER_DIGESTS_H
DEPEND[${DER_DSA_GEN/.c/.o}]=$DER_DSA_H
GENERATE[$DER_DSA_H]=der_dsa.h.in
DEPEND[$DER_DSA_H]=oids_to_c.pm
DEPEND[der_digests.o]=../include/prov/der_digests.h
GENERATE[../include/prov/der_digests.h]=der_digests.h.in
DEPEND[../include/prov/der_digests.h]=oids_to_c.pm
#----- EC
$DER_EC_H=../include/prov/der_ec.h
$DER_EC_GEN=der_ec_gen.c
$DER_EC_AUX=der_ec_key.c der_ec_sig.c
GENERATE[$DER_EC_GEN]=der_ec_gen.c.in
DEPEND[$DER_EC_GEN]=oids_to_c.pm
DEPEND[${DER_EC_AUX/.c/.o}]=$DER_EC_H $DER_DIGESTS_H
DEPEND[${DER_EC_GEN/.c/.o}]=$DER_EC_H
GENERATE[$DER_EC_H]=der_ec.h.in
DEPEND[$DER_EC_H]=oids_to_c.pm
#----- Conclusion
# TODO(3.0) $COMMON should go to libcommon.a, but this currently leads
# to linking conflicts, so we add it to libfips.a and libnonfips.a for
# the moment being
$COMMON=\
$DER_RSA_COMMON \
$DER_DSA_GEN $DER_DSA_AUX \
$DER_EC_GEN $DER_EC_AUX \
$DER_DIGESTS_GEN
SOURCE[../../libfips.a]=$COMMON $DER_RSA_FIPSABLE
SOURCE[../../libnonfips.a]=$COMMON $DER_RSA_FIPSABLE
providers/common/der/der_digests.c.in → providers/common/der/der_digests_gen.c.in
View File
providers/common/der/der_dsa.h.in
+4 -2
View File
@@ -16,6 +16,8 @@
filter => \&oids_to_c::filter_to_H });
-}
/* Subject Public Key Info */
int DER_w_algorithmIdentifier_DSA(WPACKET *pkt, int tag, DSA *dsa);
int DER_w_algorithmIdentifier_DSA_with(WPACKET *pkt, int tag,
DSA *dsa, int mdnid);
/* Signature */
int DER_w_algorithmIdentifier_DSA_with_MD(WPACKET *pkt, int tag,
DSA *dsa, int mdnid);
providers/common/der/der_dsa_gen.c.in
+17
View File
@@ -0,0 +1,17 @@
/*
* Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include "prov/der_dsa.h"
/* Well known OIDs precompiled */
{-
$OUT = oids_to_c::process_leaves('providers/common/der/DSA.asn1',
{ dir => $config{sourcedir},
filter => \&oids_to_c::filter_to_C });
-}
providers/common/der/der_dsa_key.c
+20
View File
@@ -0,0 +1,20 @@
/*
* Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <openssl/obj_mac.h>
#include "internal/packet.h"
#include "prov/der_dsa.h"
int DER_w_algorithmIdentifier_DSA(WPACKET *pkt, int tag, DSA *dsa)
{
return DER_w_begin_sequence(pkt, tag)
/* No parameters (yet?) */
&& DER_w_precompiled(pkt, -1, der_oid_id_dsa, sizeof(der_oid_id_dsa))
&& DER_w_end_sequence(pkt, tag);
}
providers/common/der/der_dsa.c.in → providers/common/der/der_dsa_sig.c
+3 -18
View File
@@ -7,33 +7,18 @@
* https://www.openssl.org/source/license.html
*/
#include <openssl/bn.h>
#include <openssl/obj_mac.h>
#include "internal/packet.h"
#include "prov/der_dsa.h"
/* Well known OIDs precompiled */
{-
$OUT = oids_to_c::process_leaves('providers/common/der/DSA.asn1',
{ dir => $config{sourcedir},
filter => \&oids_to_c::filter_to_C });
-}
int DER_w_algorithmIdentifier_DSA(WPACKET *pkt, int tag, DSA *dsa)
{
return DER_w_begin_sequence(pkt, tag)
/* No parameters (yet?) */
&& DER_w_precompiled(pkt, -1, der_oid_id_dsa, sizeof(der_oid_id_dsa))
&& DER_w_end_sequence(pkt, tag);
}
#define MD_CASE(name) \
case NID_##name: \
precompiled = der_oid_id_dsa_with_##name; \
precompiled_sz = sizeof(der_oid_id_dsa_with_##name); \
break;
int DER_w_algorithmIdentifier_DSA_with(WPACKET *pkt, int tag,
DSA *dsa, int mdnid)
int DER_w_algorithmIdentifier_DSA_with_MD(WPACKET *pkt, int tag,
DSA *dsa, int mdnid)
{
const unsigned char *precompiled = NULL;
size_t precompiled_sz = 0;
providers/common/der/der_ec.h.in
+4 -2
View File
@@ -16,6 +16,8 @@
filter => \&oids_to_c::filter_to_H });
-}
/* Subject Public Key Info */
int DER_w_algorithmIdentifier_EC(WPACKET *pkt, int cont, EC_KEY *ec);
int DER_w_algorithmIdentifier_ECDSA_with(WPACKET *pkt, int cont,
EC_KEY *ec, int mdnid);
/* Signature */
int DER_w_algorithmIdentifier_ECDSA_with_MD(WPACKET *pkt, int cont,
EC_KEY *ec, int mdnid);
providers/common/der/der_ec_gen.c.in
+17
View File
@@ -0,0 +1,17 @@
/*
* Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include "prov/der_ec.h"
/* Well known OIDs precompiled */
{-
$OUT = oids_to_c::process_leaves('providers/common/der/EC.asn1',
{ dir => $config{sourcedir},
filter => \&oids_to_c::filter_to_C });
-}
providers/common/der/der_ec_key.c
+21
View File
@@ -0,0 +1,21 @@
/*
* Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <openssl/obj_mac.h>
#include "internal/packet.h"
#include "prov/der_ec.h"
int DER_w_algorithmIdentifier_EC(WPACKET *pkt, int cont, EC_KEY *ec)
{
return DER_w_begin_sequence(pkt, cont)
/* No parameters (yet?) */
&& DER_w_precompiled(pkt, -1, der_oid_id_ecPublicKey,
sizeof(der_oid_id_ecPublicKey))
&& DER_w_end_sequence(pkt, cont);
}
providers/common/der/der_ec.c.in → providers/common/der/der_ec_sig.c
+3 -19
View File
@@ -7,26 +7,10 @@
* https://www.openssl.org/source/license.html
*/
#include <openssl/bn.h>
#include <openssl/obj_mac.h>
#include "internal/packet.h"
#include "prov/der_ec.h"
/* Well known OIDs precompiled */
{-
$OUT = oids_to_c::process_leaves('providers/common/der/EC.asn1',
{ dir => $config{sourcedir},
filter => \&oids_to_c::filter_to_C });
-}
int DER_w_algorithmIdentifier_EC(WPACKET *pkt, int cont, EC_KEY *ec)
{
return DER_w_begin_sequence(pkt, cont)
/* No parameters (yet?) */
&& DER_w_precompiled(pkt, -1, der_oid_id_ecPublicKey,
sizeof(der_oid_id_ecPublicKey))
&& DER_w_end_sequence(pkt, cont);
}
/* Aliases so we can have a uniform MD_CASE */
#define der_oid_id_ecdsa_with_sha1 der_oid_ecdsa_with_SHA1
#define der_oid_id_ecdsa_with_sha224 der_oid_ecdsa_with_SHA224
@@ -40,8 +24,8 @@ int DER_w_algorithmIdentifier_EC(WPACKET *pkt, int cont, EC_KEY *ec)
precompiled_sz = sizeof(der_oid_id_ecdsa_with_##name); \
break;
int DER_w_algorithmIdentifier_ECDSA_with(WPACKET *pkt, int cont,
EC_KEY *ec, int mdnid)
int DER_w_algorithmIdentifier_ECDSA_with_MD(WPACKET *pkt, int cont,
EC_KEY *ec, int mdnid)
{
const unsigned char *precompiled = NULL;
size_t precompiled_sz = 0;
providers/common/der/der_rsa.h.in
+5 -3
View File
@@ -13,14 +13,16 @@
/* Well known OIDs precompiled */
{-
$OUT = oids_to_c::process_leaves('providers/common/der/NIST.asn1',
'providers/common/der/DIGESTS.asn1',
'providers/common/der/RSA.asn1',
{ dir => $config{sourcedir},
filter => \&oids_to_c::filter_to_H });
-}
/* PSS parameters */
int DER_w_RSASSA_PSS_params(WPACKET *pkt, int tag,
const RSA_PSS_PARAMS_30 *pss);
/* Subject Public Key Info */
int DER_w_algorithmIdentifier_RSA(WPACKET *pkt, int tag, RSA *rsa);
int DER_w_algorithmIdentifier_RSA_with(WPACKET *pkt, int tag,
RSA *rsa, int mdnid);
/* Signature */
int DER_w_algorithmIdentifier_MDWithRSAEncryption(WPACKET *pkt, int tag,
RSA *rsa, int mdnid);
providers/common/der/der_rsa_gen.c.in
+18
View File
@@ -0,0 +1,18 @@
/*
* Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include "prov/der_rsa.h"
/* Well known OIDs precompiled */
{-
$OUT = oids_to_c::process_leaves('providers/common/der/NIST.asn1',
'providers/common/der/RSA.asn1',
{ dir => $config{sourcedir},
filter => \&oids_to_c::filter_to_C });
-}
providers/common/der/der_rsa.c.in → providers/common/der/der_rsa_key.c
-61
View File
@@ -7,21 +7,11 @@
* https://www.openssl.org/source/license.html
*/
#include <openssl/bn.h>
#include <openssl/obj_mac.h>
#include "internal/cryptlib.h"
#include "prov/der_rsa.h"
#include "prov/der_digests.h"
/* Well known OIDs precompiled */
{-
$OUT = oids_to_c::process_leaves('providers/common/der/NIST.asn1',
'providers/common/der/DIGESTS.asn1',
'providers/common/der/RSA.asn1',
{ dir => $config{sourcedir},
filter => \&oids_to_c::filter_to_C });
-}
/* More complex pre-compiled sequences. TODO(3.0) refactor? */
/*-
* From https://tools.ietf.org/html/rfc8017#appendix-A.2.1
@@ -382,54 +372,3 @@ int DER_w_algorithmIdentifier_RSA(WPACKET *pkt, int tag, RSA *rsa)
&& DER_w_precompiled(pkt, -1, rsa_oid, rsa_oid_sz)
&& DER_w_end_sequence(pkt, tag);
}
/* Aliases so we can have a uniform MD_with_RSA_CASE */
#define der_oid_sha3_224WithRSAEncryption \
der_oid_id_rsassa_pkcs1_v1_5_with_sha3_224
#define der_oid_sha3_256WithRSAEncryption \
der_oid_id_rsassa_pkcs1_v1_5_with_sha3_256
#define der_oid_sha3_384WithRSAEncryption \
der_oid_id_rsassa_pkcs1_v1_5_with_sha3_384
#define der_oid_sha3_512WithRSAEncryption \
der_oid_id_rsassa_pkcs1_v1_5_with_sha3_512
#define MD_with_RSA_CASE(name, var) \
case NID_##name: \
var = der_oid_##name##WithRSAEncryption; \
var##_sz = sizeof(der_oid_##name##WithRSAEncryption); \
break;
int DER_w_algorithmIdentifier_RSA_with(WPACKET *pkt, int tag,
RSA *rsa, int mdnid)
{
const unsigned char *precompiled = NULL;
size_t precompiled_sz = 0;
switch (mdnid) {
#ifndef FIPS_MODULE
MD_with_RSA_CASE(md2, precompiled);
MD_with_RSA_CASE(md5, precompiled);
MD_with_RSA_CASE(md4, precompiled);
MD_with_RSA_CASE(ripemd160, precompiled);
/* TODO(3.0) Decide what to do about mdc2 and md5_sha1 */
#endif
MD_with_RSA_CASE(sha1, precompiled);
MD_with_RSA_CASE(sha224, precompiled);
MD_with_RSA_CASE(sha256, precompiled);
MD_with_RSA_CASE(sha384, precompiled);
MD_with_RSA_CASE(sha512, precompiled);
MD_with_RSA_CASE(sha512_224, precompiled);
MD_with_RSA_CASE(sha512_256, precompiled);
MD_with_RSA_CASE(sha3_224, precompiled);
MD_with_RSA_CASE(sha3_256, precompiled);
MD_with_RSA_CASE(sha3_384, precompiled);
MD_with_RSA_CASE(sha3_512, precompiled);
default:
return 0;
}
return DER_w_begin_sequence(pkt, tag)
/* No parameters (yet?) */
&& DER_w_precompiled(pkt, -1, precompiled, precompiled_sz)
&& DER_w_end_sequence(pkt, tag);
}
providers/common/der/der_rsa_sig.c
+64
View File
@@ -0,0 +1,64 @@
/*
* Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <openssl/obj_mac.h>
#include "internal/packet.h"
#include "prov/der_rsa.h"
#include "prov/der_digests.h"
/* Aliases so we can have a uniform MD_with_RSA_CASE */
#define der_oid_sha3_224WithRSAEncryption \
der_oid_id_rsassa_pkcs1_v1_5_with_sha3_224
#define der_oid_sha3_256WithRSAEncryption \
der_oid_id_rsassa_pkcs1_v1_5_with_sha3_256
#define der_oid_sha3_384WithRSAEncryption \
der_oid_id_rsassa_pkcs1_v1_5_with_sha3_384
#define der_oid_sha3_512WithRSAEncryption \
der_oid_id_rsassa_pkcs1_v1_5_with_sha3_512
#define MD_with_RSA_CASE(name, var) \
case NID_##name: \
var = der_oid_##name##WithRSAEncryption; \
var##_sz = sizeof(der_oid_##name##WithRSAEncryption); \
break;
int DER_w_algorithmIdentifier_MDWithRSAEncryption(WPACKET *pkt, int tag,
RSA *rsa, int mdnid)
{
const unsigned char *precompiled = NULL;
size_t precompiled_sz = 0;
switch (mdnid) {
#ifndef FIPS_MODULE
MD_with_RSA_CASE(md2, precompiled);
MD_with_RSA_CASE(md5, precompiled);
MD_with_RSA_CASE(md4, precompiled);
MD_with_RSA_CASE(ripemd160, precompiled);
/* TODO(3.0) Decide what to do about mdc2 and md5_sha1 */
#endif
MD_with_RSA_CASE(sha1, precompiled);
MD_with_RSA_CASE(sha224, precompiled);
MD_with_RSA_CASE(sha256, precompiled);
MD_with_RSA_CASE(sha384, precompiled);
MD_with_RSA_CASE(sha512, precompiled);
MD_with_RSA_CASE(sha512_224, precompiled);
MD_with_RSA_CASE(sha512_256, precompiled);
MD_with_RSA_CASE(sha3_224, precompiled);
MD_with_RSA_CASE(sha3_256, precompiled);
MD_with_RSA_CASE(sha3_384, precompiled);
MD_with_RSA_CASE(sha3_512, precompiled);
default:
return 0;
}
return DER_w_begin_sequence(pkt, tag)
/* No parameters (yet?) */
&& DER_w_precompiled(pkt, -1, precompiled, precompiled_sz)
&& DER_w_end_sequence(pkt, tag);
}
providers/common/der/oids_to_c.pm
+8 -4
View File
@@ -28,12 +28,19 @@ use Data::Dumper;
sub filter_to_H {
my ($name, $comment) = @{ shift() };
my @oid_nums = @_;
my $oid_size = scalar @oid_nums;
(my $C_comment = $comment) =~ s|^| * |msg;
$C_comment = "\n/*\n${C_comment}\n */" if $C_comment ne '';
(my $C_name = $name) =~ s|-|_|g;
my $C_bytes_size = 2 + scalar @_;
my $C_bytes = join(', ', map { sprintf("0x%02X", $_) } @oid_nums );
return <<"_____";
extern const unsigned char der_oid_${C_name}[$C_bytes_size];
$C_comment
#define DER_OID_V_${C_name} DER_P_OBJECT, $oid_size, ${C_bytes}
#define DER_OID_SZ_${C_name} ${C_bytes_size}
extern const unsigned char der_oid_${C_name}[DER_OID_SZ_${C_name}];
_____
}
@@ -48,12 +55,9 @@ sub filter_to_C {
$C_comment = "\n/*\n${C_comment}\n */" if $C_comment ne '';
(my $C_name = $name) =~ s|-|_|g;
my $C_bytes_size = 2 + $oid_size;
my $C_bytes = join(', ', map { sprintf("0x%02X", $_) } @oid_nums );
return <<"_____";
$C_comment
#define DER_OID_V_${C_name} DER_P_OBJECT, $oid_size, ${C_bytes}
#define DER_OID_SZ_${C_name} ${C_bytes_size}
const unsigned char der_oid_${C_name}[DER_OID_SZ_${C_name}] = {
DER_OID_V_${C_name}
};
providers/common/include/prov/bio.h
+1 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
providers/common/provider_util.c
+4 -4
View File
@@ -189,8 +189,8 @@ int ossl_prov_macctx_load_from_params(EVP_MAC_CTX **macctx,
if (macname != NULL) {
EVP_MAC *mac = EVP_MAC_fetch(libctx, macname, properties);
EVP_MAC_CTX_free(*macctx);
*macctx = mac == NULL ? NULL : EVP_MAC_CTX_new(mac);
EVP_MAC_free_ctx(*macctx);
*macctx = mac == NULL ? NULL : EVP_MAC_new_ctx(mac);
/* The context holds on to the MAC */
EVP_MAC_free(mac);
if (*macctx == NULL)
@@ -241,10 +241,10 @@ int ossl_prov_macctx_load_from_params(EVP_MAC_CTX **macctx,
#endif
*mp = OSSL_PARAM_construct_end();
if (EVP_MAC_CTX_set_params(*macctx, mac_params))
if (EVP_MAC_set_ctx_params(*macctx, mac_params))
return 1;
EVP_MAC_CTX_free(*macctx);
EVP_MAC_free_ctx(*macctx);
*macctx = NULL;
return 0;
}
providers/fips/fipsprov.c
+36 -5
View File
@@ -113,11 +113,12 @@ static const OSSL_PARAM fips_param_types[] = {
/*
* Parameters to retrieve from the core provider - required for self testing.
* NOTE: inside core_get_params() these will be loaded from config items
* stored inside prov->parameters (except for OSSL_PROV_PARAM_MODULE_FILENAME).
* stored inside prov->parameters (except for
* OSSL_PROV_PARAM_CORE_MODULE_FILENAME).
*/
static OSSL_PARAM core_params[] =
{
OSSL_PARAM_utf8_ptr(OSSL_PROV_PARAM_MODULE_FILENAME,
OSSL_PARAM_utf8_ptr(OSSL_PROV_PARAM_CORE_MODULE_FILENAME,
selftest_params.module_filename,
sizeof(selftest_params.module_filename)),
OSSL_PARAM_utf8_ptr(OSSL_PROV_FIPS_PARAM_MODULE_MAC,
@@ -376,8 +377,17 @@ static const OSSL_ALGORITHM fips_digests[] = {
{ "SHA3-384", "provider=fips,fips=yes", sha3_384_functions },
{ "SHA3-512", "provider=fips,fips=yes", sha3_512_functions },
/* Non-FIPS algorithm to support oneshot_hash in the Ed448 code */
{ "SHAKE-256:SHAKE256", "provider=fips,fips=no", shake_256_functions },
{ "SHAKE-128:SHAKE128", "provider=fips,fips=yes", shake_128_functions },
{ "SHAKE-256:SHAKE256", "provider=fips,fips=yes", shake_256_functions },
/*
* KECCAK-KMAC-128 and KECCAK-KMAC-256 as hashes are mostly useful for
* KMAC128 and KMAC256.
*/
{ "KECCAK-KMAC-128:KECCAK-KMAC128", "provider=fips,fips=yes",
keccak_kmac_128_functions },
{ "KECCAK-KMAC-256:KECCAK-KMAC256", "provider=fips,fips=yes",
keccak_kmac_256_functions },
{ NULL, NULL, NULL }
};
@@ -389,6 +399,18 @@ static const OSSL_ALGORITHM_CAPABLE fips_ciphers[] = {
ALG("AES-256-CBC", aes256cbc_functions),
ALG("AES-192-CBC", aes192cbc_functions),
ALG("AES-128-CBC", aes128cbc_functions),
ALG("AES-256-OFB", aes256ofb_functions),
ALG("AES-192-OFB", aes192ofb_functions),
ALG("AES-128-OFB", aes128ofb_functions),
ALG("AES-256-CFB", aes256cfb_functions),
ALG("AES-192-CFB", aes192cfb_functions),
ALG("AES-128-CFB", aes128cfb_functions),
ALG("AES-256-CFB1", aes256cfb1_functions),
ALG("AES-192-CFB1", aes192cfb1_functions),
ALG("AES-128-CFB1", aes128cfb1_functions),
ALG("AES-256-CFB8", aes256cfb8_functions),
ALG("AES-192-CFB8", aes192cfb8_functions),
ALG("AES-128-CFB8", aes128cfb8_functions),
ALG("AES-256-CTR", aes256ctr_functions),
ALG("AES-192-CTR", aes192ctr_functions),
ALG("AES-128-CTR", aes128ctr_functions),
@@ -426,8 +448,13 @@ static const OSSL_ALGORITHM_CAPABLE fips_ciphers[] = {
static OSSL_ALGORITHM exported_fips_ciphers[OSSL_NELEM(fips_ciphers)];
static const OSSL_ALGORITHM fips_macs[] = {
#ifndef OPENSSL_NO_CMAC
{ "CMAC", "provider=fips,fips=yes", cmac_functions },
#endif
{ "GMAC", "provider=fips,fips=yes", gmac_functions },
{ "HMAC", "provider=fips,fips=yes", hmac_functions },
{ "KMAC-128:KMAC128", "provider=fips,fips=yes", kmac128_functions },
{ "KMAC-256:KMAC256", "provider=fips,fips=yes", kmac256_functions },
{ NULL, NULL, NULL }
};
@@ -435,7 +462,10 @@ static const OSSL_ALGORITHM fips_kdfs[] = {
{ "HKDF", "provider=fips,fips=yes", kdf_hkdf_functions },
{ "SSKDF", "provider=fips,fips=yes", kdf_sskdf_functions },
{ "PBKDF2", "provider=fips,fips=yes", kdf_pbkdf2_functions },
{ "SSHKDF", "provider=fips,fips=yes", kdf_sshkdf_functions },
{ "X963KDF", "provider=fips,fips=yes", kdf_x963_kdf_functions },
{ "TLS1-PRF", "provider=fips,fips=yes", kdf_tls1_prf_functions },
{ "KBKDF", "provider=fips,fips=yes", kdf_kbkdf_functions },
{ NULL, NULL, NULL }
};
@@ -477,7 +507,8 @@ static const OSSL_ALGORITHM fips_keymgmt[] = {
{ "DSA", "provider=fips,fips=yes", dsa_keymgmt_functions },
#endif
{ "RSA:rsaEncryption", "provider=fips,fips=yes", rsa_keymgmt_functions },
{ "RSA-PSS:RSASSA-PSS", "provider=default", rsapss_keymgmt_functions },
{ "RSA-PSS:RSASSA-PSS", "provider=fips,fips=yes",
rsapss_keymgmt_functions },
#ifndef OPENSSL_NO_EC
{ "EC:id-ecPublicKey", "provider=fips,fips=yes", ec_keymgmt_functions },
{ "X25519", "provider=fips,fips=no", x25519_keymgmt_functions },
providers/fips/self_test.c
+3 -3
View File
@@ -146,7 +146,7 @@ static int verify_integrity(OSSL_CORE_BIO *bio, OSSL_BIO_read_ex_fn read_ex_cb,
OSSL_SELF_TEST_onbegin(ev, event_type, OSSL_SELF_TEST_DESC_INTEGRITY_HMAC);
mac = EVP_MAC_fetch(libctx, MAC_NAME, NULL);
ctx = EVP_MAC_CTX_new(mac);
ctx = EVP_MAC_new_ctx(mac);
if (mac == NULL || ctx == NULL)
goto err;
@@ -156,7 +156,7 @@ static int verify_integrity(OSSL_CORE_BIO *bio, OSSL_BIO_read_ex_fn read_ex_cb,
sizeof(fixed_key));
*p = OSSL_PARAM_construct_end();
if (EVP_MAC_CTX_set_params(ctx, params) <= 0
if (EVP_MAC_set_ctx_params(ctx, params) <= 0
|| !EVP_MAC_init(ctx))
goto err;
@@ -177,7 +177,7 @@ static int verify_integrity(OSSL_CORE_BIO *bio, OSSL_BIO_read_ex_fn read_ex_cb,
ret = 1;
err:
OSSL_SELF_TEST_onend(ev, ret);
EVP_MAC_CTX_free(ctx);
EVP_MAC_free_ctx(ctx);
EVP_MAC_free(mac);
return ret;
}
providers/fips/self_test_kats.c
+3 -3
View File
@@ -204,7 +204,7 @@ static int self_test_kdf(const ST_KAT_KDF *t, OSSL_SELF_TEST *st,
if (kdf == NULL)
goto err;
ctx = EVP_KDF_CTX_new(kdf);
ctx = EVP_KDF_new_ctx(kdf);
if (ctx == NULL)
goto err;
@@ -216,7 +216,7 @@ static int self_test_kdf(const ST_KAT_KDF *t, OSSL_SELF_TEST *st,
params = OSSL_PARAM_BLD_to_param(bld);
if (params == NULL)
goto err;
if (!EVP_KDF_CTX_set_params(ctx, params))
if (!EVP_KDF_set_ctx_params(ctx, params))
goto err;
if (t->expected_len > sizeof(out))
@@ -232,7 +232,7 @@ static int self_test_kdf(const ST_KAT_KDF *t, OSSL_SELF_TEST *st,
ret = 1;
err:
EVP_KDF_free(kdf);
EVP_KDF_CTX_free(ctx);
EVP_KDF_free_ctx(ctx);
BN_CTX_free(bnctx);
OSSL_PARAM_BLD_free_params(params);
OSSL_PARAM_BLD_free(bld);
providers/implementations/asymciphers/rsa_enc.c
+13 -11
View File
@@ -38,13 +38,12 @@ static OSSL_OP_asym_cipher_set_ctx_params_fn rsa_set_ctx_params;
static OSSL_OP_asym_cipher_settable_ctx_params_fn rsa_settable_ctx_params;
static OSSL_ITEM padding_item[] = {
{ RSA_PKCS1_PADDING, "pkcs1" },
{ RSA_SSLV23_PADDING, "sslv23" },
{ RSA_NO_PADDING, "none" },
{ RSA_PKCS1_OAEP_PADDING, "oaep" }, /* Correct spelling first */
{ RSA_PKCS1_PADDING, OSSL_PKEY_RSA_PAD_MODE_PKCSV15 },
{ RSA_SSLV23_PADDING, OSSL_PKEY_RSA_PAD_MODE_SSLV23 },
{ RSA_NO_PADDING, OSSL_PKEY_RSA_PAD_MODE_NONE },
{ RSA_PKCS1_OAEP_PADDING, OSSL_PKEY_RSA_PAD_MODE_OAEP }, /* Correct spelling first */
{ RSA_PKCS1_OAEP_PADDING, "oeap" },
{ RSA_X931_PADDING, "x931" },
{ RSA_PKCS1_PSS_PADDING, "pss" },
{ RSA_X931_PADDING, OSSL_PKEY_RSA_PAD_MODE_X931 },
{ 0, NULL }
};
@@ -133,11 +132,13 @@ static int rsa_encrypt(void *vprsactx, unsigned char *out, size_t *outlen,
PROVerr(0, ERR_R_INTERNAL_ERROR);
return 0;
}
ret = RSA_padding_add_PKCS1_OAEP_mgf1(tbuf, rsasize, in, inlen,
prsactx->oaep_label,
prsactx->oaep_labellen,
prsactx->oaep_md,
prsactx->mgf1_md);
ret =
rsa_padding_add_PKCS1_OAEP_mgf1_with_libctx(prsactx->libctx, tbuf,
rsasize, in, inlen,
prsactx->oaep_label,
prsactx->oaep_labellen,
prsactx->oaep_md,
prsactx->mgf1_md);
if (!ret) {
OPENSSL_free(tbuf);
@@ -252,6 +253,7 @@ static void rsa_freectx(void *vprsactx)
EVP_MD_free(prsactx->oaep_md);
EVP_MD_free(prsactx->mgf1_md);
OPENSSL_free(prsactx->oaep_label);
OPENSSL_free(prsactx);
}
providers/implementations/kdfs/hkdf.c
+1 -1
View File
@@ -29,7 +29,7 @@
#include "prov/provider_util.h"
#include "e_os.h"
#define HKDF_MAXBUF 1024
#define HKDF_MAXBUF 2048
static OSSL_OP_kdf_newctx_fn kdf_hkdf_new;
static OSSL_OP_kdf_freectx_fn kdf_hkdf_free;
providers/implementations/kdfs/kbkdf.c
+7 -7
View File
@@ -123,7 +123,7 @@ static void kbkdf_reset(void *vctx)
{
KBKDF *ctx = (KBKDF *)vctx;
EVP_MAC_CTX_free(ctx->ctx_init);
EVP_MAC_free_ctx(ctx->ctx_init);
OPENSSL_clear_free(ctx->context, ctx->context_len);
OPENSSL_clear_free(ctx->label, ctx->label_len);
OPENSSL_clear_free(ctx->ki, ctx->ki_len);
@@ -151,7 +151,7 @@ static int derive(EVP_MAC_CTX *ctx_init, kbkdf_mode mode, unsigned char *iv,
for (counter = 1; written < ko_len; counter++) {
i = be32(counter);
ctx = EVP_MAC_CTX_dup(ctx_init);
ctx = EVP_MAC_dup_ctx(ctx_init);
if (ctx == NULL)
goto done;
@@ -172,13 +172,13 @@ static int derive(EVP_MAC_CTX *ctx_init, kbkdf_mode mode, unsigned char *iv,
written += h;
k_i_len = h;
EVP_MAC_CTX_free(ctx);
EVP_MAC_free_ctx(ctx);
ctx = NULL;
}
ret = 1;
done:
EVP_MAC_CTX_free(ctx);
EVP_MAC_free_ctx(ctx);
return ret;
}
@@ -247,9 +247,9 @@ static int kbkdf_set_ctx_params(void *vctx, const OSSL_PARAM params[])
NULL, NULL, libctx))
return 0;
else if (ctx->ctx_init != NULL
&& !EVP_MAC_is_a(EVP_MAC_CTX_mac(ctx->ctx_init),
&& !EVP_MAC_is_a(EVP_MAC_get_ctx_mac(ctx->ctx_init),
OSSL_MAC_NAME_HMAC)
&& !EVP_MAC_is_a(EVP_MAC_CTX_mac(ctx->ctx_init),
&& !EVP_MAC_is_a(EVP_MAC_get_ctx_mac(ctx->ctx_init),
OSSL_MAC_NAME_CMAC)) {
ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MAC);
return 0;
@@ -288,7 +288,7 @@ static int kbkdf_set_ctx_params(void *vctx, const OSSL_PARAM params[])
ctx->ki, ctx->ki_len);
mparams[1] = OSSL_PARAM_construct_end();
if (!EVP_MAC_CTX_set_params(ctx->ctx_init, mparams)
if (!EVP_MAC_set_ctx_params(ctx->ctx_init, mparams)
|| !EVP_MAC_init(ctx->ctx_init))
return 0;
}
providers/implementations/kdfs/sskdf.c
+8 -8
View File
@@ -168,7 +168,7 @@ static int kmac_init(EVP_MAC_CTX *ctx, const unsigned char *custom,
(void *)custom, custom_len);
params[1] = OSSL_PARAM_construct_end();
if (!EVP_MAC_CTX_set_params(ctx, params))
if (!EVP_MAC_set_ctx_params(ctx, params))
return 0;
/* By default only do one iteration if kmac_out_len is not specified */
@@ -186,7 +186,7 @@ static int kmac_init(EVP_MAC_CTX *ctx, const unsigned char *custom,
params[0] = OSSL_PARAM_construct_size_t(OSSL_MAC_PARAM_SIZE,
&kmac_out_len);
if (EVP_MAC_CTX_set_params(ctx, params) <= 0)
if (EVP_MAC_set_ctx_params(ctx, params) <= 0)
return 0;
/*
@@ -233,7 +233,7 @@ static int SSKDF_mac_kdm(EVP_MAC_CTX *ctx_init,
(void *)salt, salt_len);
*p = OSSL_PARAM_construct_end();
if (!EVP_MAC_CTX_set_params(ctx_init, params))
if (!EVP_MAC_set_ctx_params(ctx_init, params))
goto end;
if (!kmac_init(ctx_init, kmac_custom, kmac_custom_len, kmac_out_len,
@@ -256,7 +256,7 @@ static int SSKDF_mac_kdm(EVP_MAC_CTX *ctx_init,
c[2] = (unsigned char)((counter >> 8) & 0xff);
c[3] = (unsigned char)(counter & 0xff);
ctx = EVP_MAC_CTX_dup(ctx_init);
ctx = EVP_MAC_dup_ctx(ctx_init);
if (!(ctx != NULL
&& EVP_MAC_update(ctx, c, sizeof(c))
&& EVP_MAC_update(ctx, z, z_len)
@@ -275,7 +275,7 @@ static int SSKDF_mac_kdm(EVP_MAC_CTX *ctx_init,
memcpy(out, mac, len);
break;
}
EVP_MAC_CTX_free(ctx);
EVP_MAC_free_ctx(ctx);
ctx = NULL;
}
ret = 1;
@@ -285,7 +285,7 @@ end:
else
OPENSSL_cleanse(mac_buf, sizeof(mac_buf));
EVP_MAC_CTX_free(ctx);
EVP_MAC_free_ctx(ctx);
return ret;
}
@@ -303,7 +303,7 @@ static void sskdf_reset(void *vctx)
{
KDF_SSKDF *ctx = (KDF_SSKDF *)vctx;
EVP_MAC_CTX_free(ctx->macctx);
EVP_MAC_free_ctx(ctx->macctx);
ossl_prov_digest_reset(&ctx->digest);
OPENSSL_clear_free(ctx->secret, ctx->secret_len);
OPENSSL_clear_free(ctx->info, ctx->info_len);
@@ -360,7 +360,7 @@ static int sskdf_derive(void *vctx, unsigned char *key, size_t keylen)
const unsigned char *custom = NULL;
size_t custom_len = 0;
int default_salt_len;
EVP_MAC *mac = EVP_MAC_CTX_mac(ctx->macctx);
EVP_MAC *mac = EVP_MAC_get_ctx_mac(ctx->macctx);
/*
* TODO(3.0) investigate the necessity to have all these controls.
providers/implementations/kdfs/tls1_prf.c
+11 -11
View File
@@ -116,8 +116,8 @@ static void kdf_tls1_prf_reset(void *vctx)
{
TLS1_PRF *ctx = (TLS1_PRF *)vctx;
EVP_MAC_CTX_free(ctx->P_hash);
EVP_MAC_CTX_free(ctx->P_sha1);
EVP_MAC_free_ctx(ctx->P_hash);
EVP_MAC_free_ctx(ctx->P_sha1);
OPENSSL_clear_free(ctx->sec, ctx->seclen);
OPENSSL_cleanse(ctx->seed, ctx->seedlen);
memset(ctx, 0, sizeof(*ctx));
@@ -163,7 +163,7 @@ static int kdf_tls1_prf_set_ctx_params(void *vctx, const OSSL_PARAM params[])
NULL, SN_sha1, libctx))
return 0;
} else {
EVP_MAC_CTX_free(ctx->P_sha1);
EVP_MAC_free_ctx(ctx->P_sha1);
if (!ossl_prov_macctx_load_from_params(&ctx->P_hash, params,
OSSL_MAC_NAME_HMAC,
NULL, NULL, libctx))
@@ -280,7 +280,7 @@ static int tls1_prf_P_hash(EVP_MAC_CTX *ctx_init,
*p++ = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY,
(void *)sec, sec_len);
*p = OSSL_PARAM_construct_end();
if (!EVP_MAC_CTX_set_params(ctx_init, params))
if (!EVP_MAC_set_ctx_params(ctx_init, params))
goto err;
if (!EVP_MAC_init(ctx_init))
goto err;
@@ -288,7 +288,7 @@ static int tls1_prf_P_hash(EVP_MAC_CTX *ctx_init,
if (chunk == 0)
goto err;
/* A(0) = seed */
ctx_Ai = EVP_MAC_CTX_dup(ctx_init);
ctx_Ai = EVP_MAC_dup_ctx(ctx_init);
if (ctx_Ai == NULL)
goto err;
if (seed != NULL && !EVP_MAC_update(ctx_Ai, seed, seed_len))
@@ -298,18 +298,18 @@ static int tls1_prf_P_hash(EVP_MAC_CTX *ctx_init,
/* calc: A(i) = HMAC_<hash>(secret, A(i-1)) */
if (!EVP_MAC_final(ctx_Ai, Ai, &Ai_len, sizeof(Ai)))
goto err;
EVP_MAC_CTX_free(ctx_Ai);
EVP_MAC_free_ctx(ctx_Ai);
ctx_Ai = NULL;
/* calc next chunk: HMAC_<hash>(secret, A(i) + seed) */
ctx = EVP_MAC_CTX_dup(ctx_init);
ctx = EVP_MAC_dup_ctx(ctx_init);
if (ctx == NULL)
goto err;
if (!EVP_MAC_update(ctx, Ai, Ai_len))
goto err;
/* save state for calculating next A(i) value */
if (olen > chunk) {
ctx_Ai = EVP_MAC_CTX_dup(ctx);
ctx_Ai = EVP_MAC_dup_ctx(ctx);
if (ctx_Ai == NULL)
goto err;
}
@@ -324,15 +324,15 @@ static int tls1_prf_P_hash(EVP_MAC_CTX *ctx_init,
}
if (!EVP_MAC_final(ctx, out, NULL, olen))
goto err;
EVP_MAC_CTX_free(ctx);
EVP_MAC_free_ctx(ctx);
ctx = NULL;
out += chunk;
olen -= chunk;
}
ret = 1;
err:
EVP_MAC_CTX_free(ctx);
EVP_MAC_CTX_free(ctx_Ai);
EVP_MAC_free_ctx(ctx);
EVP_MAC_free_ctx(ctx_Ai);
OPENSSL_cleanse(Ai, sizeof(Ai));
return ret;
}
providers/implementations/keymgmt/dh_kmgmt.c
+45 -7
View File
@@ -36,6 +36,8 @@ static OSSL_OP_keymgmt_gen_fn dh_gen;
static OSSL_OP_keymgmt_gen_cleanup_fn dh_gen_cleanup;
static OSSL_OP_keymgmt_get_params_fn dh_get_params;
static OSSL_OP_keymgmt_gettable_params_fn dh_gettable_params;
static OSSL_OP_keymgmt_set_params_fn dh_set_params;
static OSSL_OP_keymgmt_settable_params_fn dh_settable_params;
static OSSL_OP_keymgmt_has_fn dh_has;
static OSSL_OP_keymgmt_match_fn dh_match;
static OSSL_OP_keymgmt_validate_fn dh_validate;
@@ -235,8 +237,8 @@ err:
OSSL_PARAM_int(OSSL_PKEY_PARAM_FFC_GINDEX, NULL), \
OSSL_PARAM_int(OSSL_PKEY_PARAM_FFC_PCOUNTER, NULL), \
OSSL_PARAM_int(OSSL_PKEY_PARAM_FFC_H, NULL), \
OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_FFC_GROUP, NULL, 0), \
OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_FFC_SEED, NULL, 0)
OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_FFC_SEED, NULL, 0), \
OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_DH_GROUP, NULL, 0)
# define DH_IMEXPORTABLE_PUBLIC_KEY \
OSSL_PARAM_BN(OSSL_PKEY_PARAM_PUB_KEY, NULL, 0)
# define DH_IMEXPORTABLE_PRIVATE_KEY \
@@ -298,6 +300,15 @@ static ossl_inline int dh_get_params(void *key, OSSL_PARAM params[])
if ((p = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_MAX_SIZE)) != NULL
&& !OSSL_PARAM_set_int(p, DH_size(dh)))
return 0;
if ((p = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_TLS_ENCODED_PT)) != NULL) {
if (p->data_type != OSSL_PARAM_OCTET_STRING)
return 0;
p->return_size = dh_key2buf(dh, (unsigned char **)&p->data,
p->data_size, 0);
if (p->return_size == 0)
return 0;
}
return ffc_params_todata(dh_get0_params(dh), NULL, params)
&& dh_key_todata(dh, NULL, params);
}
@@ -306,6 +317,7 @@ static const OSSL_PARAM dh_params[] = {
OSSL_PARAM_int(OSSL_PKEY_PARAM_BITS, NULL),
OSSL_PARAM_int(OSSL_PKEY_PARAM_SECURITY_BITS, NULL),
OSSL_PARAM_int(OSSL_PKEY_PARAM_MAX_SIZE, NULL),
OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_TLS_ENCODED_PT, NULL, 0),
DH_IMEXPORTABLE_PARAMETERS,
DH_IMEXPORTABLE_PUBLIC_KEY,
DH_IMEXPORTABLE_PRIVATE_KEY,
@@ -317,6 +329,30 @@ static const OSSL_PARAM *dh_gettable_params(void)
return dh_params;
}
static const OSSL_PARAM dh_known_settable_params[] = {
OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_TLS_ENCODED_PT, NULL, 0),
OSSL_PARAM_END
};
static const OSSL_PARAM *dh_settable_params(void)
{
return dh_known_settable_params;
}
static int dh_set_params(void *key, const OSSL_PARAM params[])
{
DH *dh = key;
const OSSL_PARAM *p;
p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_TLS_ENCODED_PT);
if (p != NULL
&& (p->data_type != OSSL_PARAM_OCTET_STRING
|| !dh_buf2key(dh, p->data, p->data_size)))
return 0;
return 1;
}
static int dh_validate_public(DH *dh)
{
const BIGNUM *pub_key = NULL;
@@ -427,7 +463,7 @@ static int dh_gen_set_params(void *genctx, const OSSL_PARAM params[])
return 0;
}
}
p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_FFC_GROUP);
p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_DH_GROUP);
if (p != NULL) {
if (p->data_type != OSSL_PARAM_UTF8_STRING
|| ((gctx->group_nid = ffc_named_group_to_uid(p->data)) == NID_undef)) {
@@ -436,7 +472,7 @@ static int dh_gen_set_params(void *genctx, const OSSL_PARAM params[])
}
gctx->gen_type = DH_PARAMGEN_TYPE_GROUP;
}
p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_FFC_GENERATOR);
p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_DH_GENERATOR);
if (p != NULL && !OSSL_PARAM_get_int(p, &gctx->generator))
return 0;
p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_FFC_GINDEX);
@@ -486,7 +522,9 @@ static int dh_gen_set_params(void *genctx, const OSSL_PARAM params[])
static const OSSL_PARAM *dh_gen_settable_params(void *provctx)
{
static OSSL_PARAM settable[] = {
OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_FFC_GROUP, NULL, 0),
OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_DH_GROUP, NULL, 0),
OSSL_PARAM_int(OSSL_PKEY_PARAM_DH_PRIV_LEN, NULL),
OSSL_PARAM_int(OSSL_PKEY_PARAM_DH_GENERATOR, NULL),
OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_FFC_TYPE, NULL, 0),
OSSL_PARAM_size_t(OSSL_PKEY_PARAM_FFC_PBITS, NULL),
OSSL_PARAM_size_t(OSSL_PKEY_PARAM_FFC_QBITS, NULL),
@@ -494,10 +532,8 @@ static const OSSL_PARAM *dh_gen_settable_params(void *provctx)
OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_FFC_DIGEST_PROPS, NULL, 0),
OSSL_PARAM_int(OSSL_PKEY_PARAM_FFC_GINDEX, NULL),
OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_FFC_SEED, NULL, 0),
OSSL_PARAM_int(OSSL_PKEY_PARAM_FFC_GENERATOR, NULL),
OSSL_PARAM_int(OSSL_PKEY_PARAM_FFC_PCOUNTER, NULL),
OSSL_PARAM_int(OSSL_PKEY_PARAM_FFC_H, NULL),
OSSL_PARAM_int(OSSL_PKEY_PARAM_DH_PRIV_LEN, NULL),
OSSL_PARAM_END
};
return settable;
@@ -621,6 +657,8 @@ const OSSL_DISPATCH dh_keymgmt_functions[] = {
{ OSSL_FUNC_KEYMGMT_FREE, (void (*)(void))dh_freedata },
{ OSSL_FUNC_KEYMGMT_GET_PARAMS, (void (*) (void))dh_get_params },
{ OSSL_FUNC_KEYMGMT_GETTABLE_PARAMS, (void (*) (void))dh_gettable_params },
{ OSSL_FUNC_KEYMGMT_SET_PARAMS, (void (*) (void))dh_set_params },
{ OSSL_FUNC_KEYMGMT_SETTABLE_PARAMS, (void (*) (void))dh_settable_params },
{ OSSL_FUNC_KEYMGMT_HAS, (void (*)(void))dh_has },
{ OSSL_FUNC_KEYMGMT_MATCH, (void (*)(void))dh_match },
{ OSSL_FUNC_KEYMGMT_VALIDATE, (void (*)(void))dh_validate },
providers/implementations/keymgmt/dsa_kmgmt.c
-1
View File
@@ -213,7 +213,6 @@ err:
OSSL_PARAM_int(OSSL_PKEY_PARAM_FFC_GINDEX, NULL), \
OSSL_PARAM_int(OSSL_PKEY_PARAM_FFC_PCOUNTER, NULL), \
OSSL_PARAM_int(OSSL_PKEY_PARAM_FFC_H, NULL), \
OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_FFC_GROUP, NULL, 0), \
OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_FFC_SEED, NULL, 0)
# define DSA_IMEXPORTABLE_PUBLIC_KEY \
OSSL_PARAM_BN(OSSL_PKEY_PARAM_PUB_KEY, NULL, 0)
providers/implementations/keymgmt/ec_kmgmt.c
+42 -6
View File
@@ -504,6 +504,20 @@ int ec_get_params(void *key, OSSL_PARAM params[])
if (!OSSL_PARAM_set_int(p, ecdh_cofactor_mode))
return 0;
}
if ((p = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_TLS_ENCODED_PT)) != NULL) {
BN_CTX *ctx = BN_CTX_new_ex(ec_key_get_libctx(key));
if (ctx == NULL)
return 0;
p->return_size = EC_POINT_point2oct(EC_KEY_get0_group(key),
EC_KEY_get0_public_key(key),
POINT_CONVERSION_UNCOMPRESSED,
p->data, p->return_size, ctx);
BN_CTX_free(ctx);
if (p->return_size == 0)
return 0;
}
ret = domparams_to_params(eck, NULL, params)
&& key_to_params(eck, NULL, params, 1, &pub_key)
&& otherparams_to_params(eck, NULL, params);
@@ -515,6 +529,7 @@ static const OSSL_PARAM ec_known_gettable_params[] = {
OSSL_PARAM_int(OSSL_PKEY_PARAM_BITS, NULL),
OSSL_PARAM_int(OSSL_PKEY_PARAM_SECURITY_BITS, NULL),
OSSL_PARAM_int(OSSL_PKEY_PARAM_MAX_SIZE, NULL),
OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_TLS_ENCODED_PT, NULL, 0),
EC_IMEXPORTABLE_DOM_PARAMETERS,
EC_IMEXPORTABLE_PUBLIC_KEY,
EC_IMEXPORTABLE_PRIVATE_KEY,
@@ -530,6 +545,7 @@ const OSSL_PARAM *ec_gettable_params(void)
static const OSSL_PARAM ec_known_settable_params[] = {
OSSL_PARAM_int(OSSL_PKEY_PARAM_USE_COFACTOR_ECDH, NULL),
OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_TLS_ENCODED_PT, NULL, 0),
OSSL_PARAM_END
};
@@ -545,11 +561,21 @@ int ec_set_params(void *key, const OSSL_PARAM params[])
EC_KEY *eck = key;
const OSSL_PARAM *p;
p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_USE_COFACTOR_ECDH);
if (p != NULL && !ec_set_param_ecdh_cofactor_mode(eck, p))
return 0;
p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_TLS_ENCODED_PT);
if (p != NULL) {
BN_CTX *ctx = BN_CTX_new_ex(ec_key_get_libctx(key));
int ret = 1;
return 1;
if (ctx == NULL
|| p->data_type != OSSL_PARAM_OCTET_STRING
|| !EC_KEY_oct2key(key, p->data, p->data_size, ctx))
ret = 0;
BN_CTX_free(ctx);
if (!ret)
return 0;
}
return ec_key_otherparams_fromdata(eck, params);
}
static
@@ -583,9 +609,9 @@ int ec_validate(void *keydata, int selection)
struct ec_gen_ctx {
OPENSSL_CTX *libctx;
EC_GROUP *gen_group;
int selection;
int ecdh_mode;
};
static void *ec_gen_init(void *provctx, int selection)
@@ -600,6 +626,7 @@ static void *ec_gen_init(void *provctx, int selection)
gctx->libctx = libctx;
gctx->gen_group = NULL;
gctx->selection = selection;
gctx->ecdh_mode = 0;
}
return gctx;
}
@@ -636,6 +663,11 @@ static int ec_gen_set_params(void *genctx, const OSSL_PARAM params[])
struct ec_gen_ctx *gctx = genctx;
const OSSL_PARAM *p;
if ((p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_USE_COFACTOR_ECDH))
!= NULL) {
if (!OSSL_PARAM_get_int(p, &gctx->ecdh_mode))
return 0;
}
if ((p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_EC_NAME))
!= NULL) {
const char *curve_name = NULL;
@@ -670,7 +702,8 @@ static int ec_gen_set_params(void *genctx, const OSSL_PARAM params[])
static const OSSL_PARAM *ec_gen_settable_params(void *provctx)
{
static OSSL_PARAM settable[] = {
{ OSSL_PKEY_PARAM_EC_NAME, OSSL_PARAM_UTF8_STRING, NULL, 0, 0 },
OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_EC_NAME, NULL, 0),
OSSL_PARAM_int(OSSL_PKEY_PARAM_USE_COFACTOR_ECDH, NULL),
OSSL_PARAM_END
};
@@ -705,6 +738,9 @@ static void *ec_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg)
if ((gctx->selection & OSSL_KEYMGMT_SELECT_KEYPAIR) != 0)
ret = ret && EC_KEY_generate_key(ec);
if (gctx->ecdh_mode != -1)
ret = ret && ec_set_ecdh_cofactor_mode(ec, gctx->ecdh_mode);
if (ret)
return ec;
providers/implementations/keymgmt/ecx_kmgmt.c
+99 -8
View File
@@ -46,6 +46,14 @@ static OSSL_OP_keymgmt_gettable_params_fn x25519_gettable_params;
static OSSL_OP_keymgmt_gettable_params_fn x448_gettable_params;
static OSSL_OP_keymgmt_gettable_params_fn ed25519_gettable_params;
static OSSL_OP_keymgmt_gettable_params_fn ed448_gettable_params;
static OSSL_OP_keymgmt_set_params_fn x25519_set_params;
static OSSL_OP_keymgmt_set_params_fn x448_set_params;
static OSSL_OP_keymgmt_set_params_fn ed25519_set_params;
static OSSL_OP_keymgmt_set_params_fn ed448_set_params;
static OSSL_OP_keymgmt_settable_params_fn x25519_settable_params;
static OSSL_OP_keymgmt_settable_params_fn x448_settable_params;
static OSSL_OP_keymgmt_settable_params_fn ed25519_settable_params;
static OSSL_OP_keymgmt_settable_params_fn ed448_settable_params;
static OSSL_OP_keymgmt_has_fn ecx_has;
static OSSL_OP_keymgmt_match_fn ecx_match;
static OSSL_OP_keymgmt_import_fn ecx_import;
@@ -93,8 +101,11 @@ static int ecx_has(void *keydata, int selection)
int ok = 0;
if (key != NULL) {
if ((selection & ECX_POSSIBLE_SELECTIONS) != 0)
ok = 1;
/*
* ECX keys always have all the parameters they need (i.e. none).
* Therefore we always return with 1, if asked about parameters.
*/
ok = 1;
if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0)
ok = ok && key->haspubkey;
@@ -233,6 +244,13 @@ static int ecx_get_params(void *key, OSSL_PARAM params[], int bits, int secbits,
if ((p = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_MAX_SIZE)) != NULL
&& !OSSL_PARAM_set_int(p, size))
return 0;
if ((p = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_TLS_ENCODED_PT)) != NULL
&& (ecx->type == ECX_KEY_TYPE_X25519
|| ecx->type == ECX_KEY_TYPE_X448)) {
if (!OSSL_PARAM_set_octet_string(p, ecx->pubkey, ecx->keylen))
return 0;
}
return key_to_params(ecx, NULL, params);
}
@@ -273,16 +291,17 @@ static int ed448_get_params(void *key, OSSL_PARAM params[])
&& ed_get_params(key, params);
}
static const OSSL_PARAM ecx_params[] = {
static const OSSL_PARAM ecx_gettable_params[] = {
OSSL_PARAM_int(OSSL_PKEY_PARAM_BITS, NULL),
OSSL_PARAM_int(OSSL_PKEY_PARAM_SECURITY_BITS, NULL),
OSSL_PARAM_int(OSSL_PKEY_PARAM_MAX_SIZE, NULL),
OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_MANDATORY_DIGEST, NULL, 0),
OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_TLS_ENCODED_PT, NULL, 0),
ECX_KEY_TYPES(),
OSSL_PARAM_END
};
static const OSSL_PARAM ed_params[] = {
static const OSSL_PARAM ed_gettable_params[] = {
OSSL_PARAM_int(OSSL_PKEY_PARAM_BITS, NULL),
OSSL_PARAM_int(OSSL_PKEY_PARAM_SECURITY_BITS, NULL),
OSSL_PARAM_int(OSSL_PKEY_PARAM_MAX_SIZE, NULL),
@@ -292,22 +311,92 @@ static const OSSL_PARAM ed_params[] = {
static const OSSL_PARAM *x25519_gettable_params(void)
{
return ecx_params;
return ecx_gettable_params;
}
static const OSSL_PARAM *x448_gettable_params(void)
{
return ecx_params;
return ecx_gettable_params;
}
static const OSSL_PARAM *ed25519_gettable_params(void)
{
return ed_params;
return ed_gettable_params;
}
static const OSSL_PARAM *ed448_gettable_params(void)
{
return ed_params;
return ed_gettable_params;
}
static int ecx_set_params(void *key, const OSSL_PARAM params[])
{
ECX_KEY *ecxkey = key;
const OSSL_PARAM *p;
p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_TLS_ENCODED_PT);
if (p != NULL) {
void *buf = ecxkey->pubkey;
if (p->data_size != ecxkey->keylen
|| !OSSL_PARAM_get_octet_string(p, &buf, sizeof(ecxkey->pubkey),
NULL))
return 0;
OPENSSL_clear_free(ecxkey->privkey, ecxkey->keylen);
ecxkey->privkey = NULL;
ecxkey->haspubkey = 1;
}
return 1;
}
static int x25519_set_params(void *key, const OSSL_PARAM params[])
{
return ecx_set_params(key, params);
}
static int x448_set_params(void *key, const OSSL_PARAM params[])
{
return ecx_set_params(key, params);
}
static int ed25519_set_params(void *key, const OSSL_PARAM params[])
{
return 1;
}
static int ed448_set_params(void *key, const OSSL_PARAM params[])
{
return 1;
}
static const OSSL_PARAM ecx_settable_params[] = {
OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_TLS_ENCODED_PT, NULL, 0),
OSSL_PARAM_END
};
static const OSSL_PARAM ed_settable_params[] = {
OSSL_PARAM_END
};
static const OSSL_PARAM *x25519_settable_params(void)
{
return ecx_settable_params;
}
static const OSSL_PARAM *x448_settable_params(void)
{
return ecx_settable_params;
}
static const OSSL_PARAM *ed25519_settable_params(void)
{
return ed_settable_params;
}
static const OSSL_PARAM *ed448_settable_params(void)
{
return ed_settable_params;
}
static void *ecx_gen_init(void *provctx, int selection, ECX_KEY_TYPE type)
@@ -450,6 +539,8 @@ static void ecx_gen_cleanup(void *genctx)
{ OSSL_FUNC_KEYMGMT_FREE, (void (*)(void))ecx_key_free }, \
{ OSSL_FUNC_KEYMGMT_GET_PARAMS, (void (*) (void))alg##_get_params }, \
{ OSSL_FUNC_KEYMGMT_GETTABLE_PARAMS, (void (*) (void))alg##_gettable_params }, \
{ OSSL_FUNC_KEYMGMT_SET_PARAMS, (void (*) (void))alg##_set_params }, \
{ OSSL_FUNC_KEYMGMT_SETTABLE_PARAMS, (void (*) (void))alg##_settable_params }, \
{ OSSL_FUNC_KEYMGMT_HAS, (void (*)(void))ecx_has }, \
{ OSSL_FUNC_KEYMGMT_MATCH, (void (*)(void))ecx_match }, \
{ OSSL_FUNC_KEYMGMT_IMPORT, (void (*)(void))ecx_import }, \
providers/implementations/keymgmt/rsa_kmgmt.c
+5 -3
View File
@@ -405,8 +405,8 @@ static void *gen_init(void *provctx, int selection, int rsa_type)
} else {
gctx->nbits = 2048;
gctx->primes = RSA_DEFAULT_PRIME_NUM;
gctx->rsa_type = rsa_type;
}
gctx->rsa_type = rsa_type;
}
return gctx;
}
@@ -490,6 +490,9 @@ static void *rsa_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg)
RSA *rsa = NULL, *rsa_tmp = NULL;
BN_GENCB *gencb = NULL;
if (gctx == NULL)
return NULL;
switch (gctx->rsa_type) {
case RSA_FLAG_TYPE_RSA:
/* For plain RSA keys, PSS parameters must not be set */
@@ -507,8 +510,7 @@ static void *rsa_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg)
return NULL;
}
if (gctx == NULL
|| (rsa_tmp = rsa_new_with_ctx(gctx->libctx)) == NULL)
if ((rsa_tmp = rsa_new_with_ctx(gctx->libctx)) == NULL)
return NULL;
gctx->cb = osslcb;
providers/implementations/serializers/serializer_rsa.c
+2 -2
View File
@@ -209,9 +209,9 @@ int ossl_prov_prepare_rsa_params(const void *rsa, int nid,
break;
}
if (!DER_w_RSASSA_PSS_params(&pkt, -1, pss)
|| !WPACKET_finish(&pkt))
|| !WPACKET_finish(&pkt)
|| !WPACKET_get_total_written(&pkt, &str_sz))
goto err;
WPACKET_get_total_written(&pkt, &str_sz);
WPACKET_cleanup(&pkt);
/*
providers/implementations/signature/dsa.c
+3 -1
View File
@@ -177,7 +177,8 @@ static int dsa_setup_md(PROV_DSA_CTX *ctx,
*/
ctx->aid_len = 0;
if (WPACKET_init_der(&pkt, ctx->aid_buf, sizeof(ctx->aid_buf))
&& DER_w_algorithmIdentifier_DSA_with(&pkt, -1, ctx->dsa, md_nid)
&& DER_w_algorithmIdentifier_DSA_with_MD(&pkt, -1, ctx->dsa,
md_nid)
&& WPACKET_finish(&pkt)) {
WPACKET_get_total_written(&pkt, &ctx->aid_len);
ctx->aid = WPACKET_get_curr(&pkt);
@@ -445,6 +446,7 @@ static int dsa_set_ctx_params(void *vpdsactx, const OSSL_PARAM params[])
static const OSSL_PARAM known_settable_ctx_params[] = {
OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_DIGEST, NULL, 0),
OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_PROPERTIES, NULL, 0),
OSSL_PARAM_END
};
providers/implementations/signature/ecdsa.c
+1 -1
View File
@@ -238,7 +238,7 @@ static int ecdsa_digest_signverify_init(void *vctx, const char *mdname,
*/
ctx->aid_len = 0;
if (WPACKET_init_der(&pkt, ctx->aid_buf, sizeof(ctx->aid_buf))
&& DER_w_algorithmIdentifier_ECDSA_with(&pkt, -1, ctx->ec, md_nid)
&& DER_w_algorithmIdentifier_ECDSA_with_MD(&pkt, -1, ctx->ec, md_nid)
&& WPACKET_finish(&pkt)) {
WPACKET_get_total_written(&pkt, &ctx->aid_len);
ctx->aid = WPACKET_get_curr(&pkt);
providers/implementations/signature/eddsa.c
+1 -1
View File
@@ -56,7 +56,7 @@ static int eddsa_digest_signverify_init(void *vpeddsactx, const char *mdname,
PROV_EDDSA_CTX *peddsactx = (PROV_EDDSA_CTX *)vpeddsactx;
ECX_KEY *edkey = (ECX_KEY *)vedkey;
if (mdname != NULL) {
if (mdname != NULL && mdname[0] != '\0') {
PROVerr(0, PROV_R_INVALID_DIGEST);
return 0;
}
providers/implementations/signature/rsa.c
+56 -26
View File
@@ -55,13 +55,11 @@ static OSSL_OP_signature_set_ctx_md_params_fn rsa_set_ctx_md_params;
static OSSL_OP_signature_settable_ctx_md_params_fn rsa_settable_ctx_md_params;
static OSSL_ITEM padding_item[] = {
{ RSA_PKCS1_PADDING, "pkcs1" },
{ RSA_SSLV23_PADDING, "sslv23" },
{ RSA_NO_PADDING, "none" },
{ RSA_PKCS1_OAEP_PADDING, "oaep" }, /* Correct spelling first */
{ RSA_PKCS1_OAEP_PADDING, "oeap" },
{ RSA_X931_PADDING, "x931" },
{ RSA_PKCS1_PSS_PADDING, "pss" },
{ RSA_PKCS1_PADDING, OSSL_PKEY_RSA_PAD_MODE_PKCSV15 },
{ RSA_SSLV23_PADDING, OSSL_PKEY_RSA_PAD_MODE_SSLV23 },
{ RSA_NO_PADDING, OSSL_PKEY_RSA_PAD_MODE_NONE },
{ RSA_X931_PADDING, OSSL_PKEY_RSA_PAD_MODE_X931 },
{ RSA_PKCS1_PSS_PADDING, OSSL_PKEY_RSA_PAD_MODE_PSS },
{ 0, NULL }
};
@@ -227,17 +225,22 @@ static int rsa_setup_md(PROV_RSA_CTX *ctx, const char *mdname,
EVP_MD *md = EVP_MD_fetch(ctx->libctx, mdname, mdprops);
int md_nid = rsa_get_md_nid(md);
WPACKET pkt;
size_t mdname_len = strlen(mdname);
if (md == NULL
|| md_nid == NID_undef
|| !rsa_check_padding(md_nid, ctx->pad_mode)
|| !rsa_check_parameters(md, ctx)) {
|| !rsa_check_parameters(md, ctx)
|| mdname_len >= sizeof(ctx->mdname)) {
if (md == NULL)
ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
"%s could not be fetched", mdname);
if (md_nid == NID_undef)
ERR_raise_data(ERR_LIB_PROV, PROV_R_DIGEST_NOT_ALLOWED,
"digest=%s", mdname);
if (mdname_len >= sizeof(ctx->mdname))
ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
"%s exceeds name buffer length", mdname);
EVP_MD_free(md);
return 0;
}
@@ -254,7 +257,8 @@ static int rsa_setup_md(PROV_RSA_CTX *ctx, const char *mdname,
*/
ctx->aid_len = 0;
if (WPACKET_init_der(&pkt, ctx->aid_buf, sizeof(ctx->aid_buf))
&& DER_w_algorithmIdentifier_RSA_with(&pkt, -1, ctx->rsa, md_nid)
&& DER_w_algorithmIdentifier_MDWithRSAEncryption(&pkt, -1, ctx->rsa,
md_nid)
&& WPACKET_finish(&pkt)) {
WPACKET_get_total_written(&pkt, &ctx->aid_len);
ctx->aid = WPACKET_get_curr(&pkt);
@@ -273,6 +277,8 @@ static int rsa_setup_md(PROV_RSA_CTX *ctx, const char *mdname,
static int rsa_setup_mgf1_md(PROV_RSA_CTX *ctx, const char *mdname,
const char *mdprops)
{
size_t len;
if (mdprops == NULL)
mdprops = ctx->propq;
@@ -284,7 +290,12 @@ static int rsa_setup_mgf1_md(PROV_RSA_CTX *ctx, const char *mdname,
"%s could not be fetched", mdname);
return 0;
}
OPENSSL_strlcpy(ctx->mgf1_mdname, mdname, sizeof(ctx->mgf1_mdname));
len = OPENSSL_strlcpy(ctx->mgf1_mdname, mdname, sizeof(ctx->mgf1_mdname));
if (len >= sizeof(ctx->mgf1_mdname)) {
ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
"%s exceeds name buffer length", mdname);
return 0;
}
return 1;
}
@@ -320,6 +331,7 @@ static int rsa_signature_init(void *vprsactx, void *vrsa, int operation)
int mgf1md_nid = rsa_pss_params_30_maskgenhashalg(pss);
int min_saltlen = rsa_pss_params_30_saltlen(pss);
const char *mdname, *mgf1mdname;
size_t len;
mdname = rsa_oaeppss_nid2name(md_nid);
mgf1mdname = rsa_oaeppss_nid2name(mgf1md_nid);
@@ -336,9 +348,20 @@ static int rsa_signature_init(void *vprsactx, void *vrsa, int operation)
return 0;
}
strncpy(prsactx->mdname, mdname, sizeof(prsactx->mdname));
strncpy(prsactx->mgf1_mdname, mgf1mdname,
sizeof(prsactx->mgf1_mdname));
len = OPENSSL_strlcpy(prsactx->mdname, mdname,
sizeof(prsactx->mdname));
if (len >= sizeof(prsactx->mdname)) {
ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
"hash algorithm name too long");
return 0;
}
len = OPENSSL_strlcpy(prsactx->mgf1_mdname, mgf1mdname,
sizeof(prsactx->mgf1_mdname));
if (len >= sizeof(prsactx->mgf1_mdname)) {
ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
"MGF1 hash algorithm name too long");
return 0;
}
prsactx->saltlen = min_saltlen;
return rsa_setup_md(prsactx, mdname, prsactx->propq)
@@ -914,25 +937,32 @@ static int rsa_get_ctx_params(void *vprsactx, OSSL_PARAM *params)
if (!OSSL_PARAM_set_int(p, prsactx->saltlen))
return 0;
} else if (p->data_type == OSSL_PARAM_UTF8_STRING) {
const char *value = NULL;
switch (prsactx->saltlen) {
case RSA_PSS_SALTLEN_DIGEST:
if (!OSSL_PARAM_set_utf8_string(p, "digest"))
return 0;
value = OSSL_PKEY_RSA_PSS_SALT_LEN_DIGEST;
break;
case RSA_PSS_SALTLEN_MAX:
if (!OSSL_PARAM_set_utf8_string(p, "max"))
return 0;
value = OSSL_PKEY_RSA_PSS_SALT_LEN_MAX;
break;
case RSA_PSS_SALTLEN_AUTO:
if (!OSSL_PARAM_set_utf8_string(p, "auto"))
return 0;
value = OSSL_PKEY_RSA_PSS_SALT_LEN_AUTO;
break;
default:
if (BIO_snprintf(p->data, p->data_size, "%d", prsactx->saltlen)
<= 0)
return 0;
break;
{
int len = BIO_snprintf(p->data, p->data_size, "%d",
prsactx->saltlen);
if (len <= 0)
return 0;
p->return_size = len;
break;
}
}
if (value != NULL
&& !OSSL_PARAM_set_utf8_string(p, value))
return 0;
}
}
@@ -1092,11 +1122,11 @@ static int rsa_set_ctx_params(void *vprsactx, const OSSL_PARAM params[])
return 0;
break;
case OSSL_PARAM_UTF8_STRING:
if (strcmp(p->data, "digest") == 0)
if (strcmp(p->data, OSSL_PKEY_RSA_PSS_SALT_LEN_DIGEST) == 0)
saltlen = RSA_PSS_SALTLEN_DIGEST;
else if (strcmp(p->data, "max") == 0)
else if (strcmp(p->data, OSSL_PKEY_RSA_PSS_SALT_LEN_MAX) == 0)
saltlen = RSA_PSS_SALTLEN_MAX;
else if (strcmp(p->data, "auto") == 0)
else if (strcmp(p->data, OSSL_PKEY_RSA_PSS_SALT_LEN_AUTO) == 0)
saltlen = RSA_PSS_SALTLEN_AUTO;
else
saltlen = atoi(p->data);