zzy/openssl
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feat: Implement EVP_PKEY_CTX_{set,get}_algor_params() and EVP_PKEY_CTX_get_algor()

Browse Source 
This should be sufficient to cover the intent with the following legacy ctrls:

- EVP_PKEY_CTRL_PKCS7_ENCRYPT (through EVP_ASYM_CIPHER implementations)
- EVP_PKEY_CTRL_PKCS7_DECRYPT (through EVP_ASYM_CIPHER implementations)
- EVP_PKEY_CTRL_PKCS7_SIGN (through EVP_SIGNATURE implementations)
- EVP_PKEY_CTRL_CMS_ENCRYPT (through EVP_ASYM_CIPHER implementations)
- EVP_PKEY_CTRL_CMS_DECRYPT (through EVP_ASYM_CIPHER implementations)
- EVP_PKEY_CTRL_CMS_SIGN (through EVP_SIGNATURE implementations)

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25000)
This commit is contained in:
Richard Levitte 2024-07-25 13:30:28 +02:00
parent 258aaa97b8
commit 033dcce2ba
3 changed files with 124 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

116
crypto/evp/evp_lib.c
View File

@ -1344,4 +1344,120 @@ int EVP_CIPHER_CTX_get_algor(EVP_CIPHER_CTX *ctx, X509_ALGOR **alg)
return ret;
}
int EVP_PKEY_CTX_set_algor_params(EVP_PKEY_CTX *ctx, const X509_ALGOR *alg)
{
int ret = -1; /* Assume the worst */
unsigned char *der = NULL;
int derl = -1;
if ((derl = i2d_ASN1_TYPE(alg->parameter, &der)) >= 0) {
const char *k = OSSL_PKEY_PARAM_ALGORITHM_ID_PARAMS;
OSSL_PARAM params[2];
/*
* Passing the same data with both the old (deprecated) and the
* new AlgID parameters OSSL_PARAM key.
*/
params[0] = OSSL_PARAM_construct_octet_string(k, der, (size_t)derl);
params[1] = OSSL_PARAM_construct_end();
ret = EVP_PKEY_CTX_set_params(ctx, params);
}
OPENSSL_free(der);
return ret;
}
int EVP_PKEY_CTX_get_algor_params(EVP_PKEY_CTX *ctx, X509_ALGOR *alg)
{
int ret = -1; /* Assume the worst */
OSSL_PARAM params[2];
unsigned char *der = NULL;
size_t derl;
ASN1_TYPE *type = NULL;
const char *k = OSSL_PKEY_PARAM_ALGORITHM_ID_PARAMS;
/*
* We make two passes, the first to get the appropriate buffer size,
* and the second to get the actual value.
* Also, using both the old (deprecated) and the new AlgID parameters
* OSSL_PARAM key, and using whichever the provider responds to.
* Should the provider respond on both, the new key takes priority.
*/
params[0] = OSSL_PARAM_construct_octet_string(k, NULL, 0);
params[1] = OSSL_PARAM_construct_end();
if (!EVP_PKEY_CTX_get_params(ctx, params))
goto err;
/*
* If alg->parameter is non-NULL, it will be changed by d2i_ASN1_TYPE()
* below. If it is NULL, the d2i_ASN1_TYPE() call will allocate new
* space for it. Either way, alg->parameter can be safely assigned
* with type after the d2i_ASN1_TYPE() call, with the safety that it
* will be ok.
*/
type = alg->parameter;
derl = params[0].return_size;
if (OSSL_PARAM_modified(&params[0])
/* ... but, we should get a return size too! */
&& derl != 0
&& (der = OPENSSL_malloc(derl)) != NULL) {
unsigned char *derp = der;
params[0] = OSSL_PARAM_construct_octet_string(k, der, derl);
if (EVP_PKEY_CTX_get_params(ctx, params)
&& OSSL_PARAM_modified(&params[0])
&& d2i_ASN1_TYPE(&type, (const unsigned char **)&derp,
derl) != NULL) {
/*
* Don't free alg->parameter, see comment further up.
* Worst case, alg->parameter gets assigned its own value.
*/
alg->parameter = type;
ret = 1;
}
}
err:
OPENSSL_free(der);
return ret;
}
int EVP_PKEY_CTX_get_algor(EVP_PKEY_CTX *ctx, X509_ALGOR **alg)
{
int ret = -1; /* Assume the worst */
OSSL_PARAM params[2];
size_t aid_len = 0;
const char *k_aid = OSSL_SIGNATURE_PARAM_ALGORITHM_ID;
params[0] = OSSL_PARAM_construct_octet_string(k_aid, NULL, 0);
params[1] = OSSL_PARAM_construct_end();
if (EVP_PKEY_CTX_get_params(ctx, params) <= 0)
goto err;
if (OSSL_PARAM_modified(&params[0]))
aid_len = params[0].return_size;
if (aid_len == 0) {
ERR_raise(ERR_LIB_EVP, EVP_R_GETTING_ALGORITHMIDENTIFIER_NOT_SUPPORTED);
ret = -2;
goto err;
}
if (alg != NULL) {
unsigned char *aid = NULL;
const unsigned char *pp = NULL;
if ((aid = OPENSSL_malloc(aid_len)) != NULL) {
params[0] = OSSL_PARAM_construct_octet_string(k_aid, aid, aid_len);
pp = aid;
if (EVP_PKEY_CTX_get_params(ctx, params)
&& OSSL_PARAM_modified(&params[0])
&& d2i_X509_ALGOR(alg, &pp, aid_len) != NULL)
ret = 1;
}
OPENSSL_free(aid);
}
err:
return ret;
}
#endif /* !defined(FIPS_MODULE) */

5
include/openssl/evp.h
View File

@ -1815,6 +1815,11 @@ int EVP_PKEY_CTX_get_params(EVP_PKEY_CTX *ctx, OSSL_PARAM *params);
const OSSL_PARAM *EVP_PKEY_CTX_gettable_params(const EVP_PKEY_CTX *ctx);
int EVP_PKEY_CTX_set_params(EVP_PKEY_CTX *ctx, const OSSL_PARAM *params);
const OSSL_PARAM *EVP_PKEY_CTX_settable_params(const EVP_PKEY_CTX *ctx);
int EVP_PKEY_CTX_set_algor_params(EVP_PKEY_CTX *ctx, const X509_ALGOR *alg);
int EVP_PKEY_CTX_get_algor_params(EVP_PKEY_CTX *ctx, X509_ALGOR *alg);
int EVP_PKEY_CTX_get_algor(EVP_PKEY_CTX *ctx, X509_ALGOR **alg);
int EVP_PKEY_CTX_ctrl(EVP_PKEY_CTX *ctx, int keytype, int optype,
int cmd, int p1, void *p2);
int EVP_PKEY_CTX_ctrl_str(EVP_PKEY_CTX *ctx, const char *type,

3
util/libcrypto.num
View File

@ -5729,3 +5729,6 @@ EVP_PKEY_verify_recover_init_ex2 ? 3_4_0 EXIST::FUNCTION:
EVP_CIPHER_CTX_set_algor_params ? 3_4_0 EXIST::FUNCTION:
EVP_CIPHER_CTX_get_algor_params ? 3_4_0 EXIST::FUNCTION:
EVP_CIPHER_CTX_get_algor ? 3_4_0 EXIST::FUNCTION:
EVP_PKEY_CTX_set_algor_params ? 3_4_0 EXIST::FUNCTION:
EVP_PKEY_CTX_get_algor_params ? 3_4_0 EXIST::FUNCTION:
EVP_PKEY_CTX_get_algor ? 3_4_0 EXIST::FUNCTION: