encoder_pkey.c 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402
  1. /*
  2. * Copyright 2019-2023 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <openssl/err.h>
  10. #include <openssl/ui.h>
  11. #include <openssl/params.h>
  12. #include <openssl/encoder.h>
  13. #include <openssl/core_names.h>
  14. #include <openssl/provider.h>
  15. #include <openssl/safestack.h>
  16. #include <openssl/trace.h>
  17. #include "internal/provider.h"
  18. #include "internal/property.h"
  19. #include "internal/namemap.h"
  20. #include "crypto/evp.h"
  21. #include "encoder_local.h"
  22. DEFINE_STACK_OF(OSSL_ENCODER)
  23. int OSSL_ENCODER_CTX_set_cipher(OSSL_ENCODER_CTX *ctx,
  24. const char *cipher_name,
  25. const char *propquery)
  26. {
  27. OSSL_PARAM params[] = { OSSL_PARAM_END, OSSL_PARAM_END, OSSL_PARAM_END };
  28. params[0] =
  29. OSSL_PARAM_construct_utf8_string(OSSL_ENCODER_PARAM_CIPHER,
  30. (void *)cipher_name, 0);
  31. params[1] =
  32. OSSL_PARAM_construct_utf8_string(OSSL_ENCODER_PARAM_PROPERTIES,
  33. (void *)propquery, 0);
  34. return OSSL_ENCODER_CTX_set_params(ctx, params);
  35. }
  36. int OSSL_ENCODER_CTX_set_passphrase(OSSL_ENCODER_CTX *ctx,
  37. const unsigned char *kstr,
  38. size_t klen)
  39. {
  40. return ossl_pw_set_passphrase(&ctx->pwdata, kstr, klen);
  41. }
  42. int OSSL_ENCODER_CTX_set_passphrase_ui(OSSL_ENCODER_CTX *ctx,
  43. const UI_METHOD *ui_method,
  44. void *ui_data)
  45. {
  46. return ossl_pw_set_ui_method(&ctx->pwdata, ui_method, ui_data);
  47. }
  48. int OSSL_ENCODER_CTX_set_pem_password_cb(OSSL_ENCODER_CTX *ctx,
  49. pem_password_cb *cb, void *cbarg)
  50. {
  51. return ossl_pw_set_pem_password_cb(&ctx->pwdata, cb, cbarg);
  52. }
  53. int OSSL_ENCODER_CTX_set_passphrase_cb(OSSL_ENCODER_CTX *ctx,
  54. OSSL_PASSPHRASE_CALLBACK *cb,
  55. void *cbarg)
  56. {
  57. return ossl_pw_set_ossl_passphrase_cb(&ctx->pwdata, cb, cbarg);
  58. }
  59. /*
  60. * Support for OSSL_ENCODER_CTX_new_for_type:
  61. * finding a suitable encoder
  62. */
  63. struct collected_encoder_st {
  64. STACK_OF(OPENSSL_CSTRING) *names;
  65. int *id_names;
  66. const char *output_structure;
  67. const char *output_type;
  68. const OSSL_PROVIDER *keymgmt_prov;
  69. OSSL_ENCODER_CTX *ctx;
  70. unsigned int flag_find_same_provider:1;
  71. int error_occurred;
  72. };
  73. static void collect_encoder(OSSL_ENCODER *encoder, void *arg)
  74. {
  75. struct collected_encoder_st *data = arg;
  76. const OSSL_PROVIDER *prov;
  77. if (data->error_occurred)
  78. return;
  79. data->error_occurred = 1; /* Assume the worst */
  80. prov = OSSL_ENCODER_get0_provider(encoder);
  81. /*
  82. * collect_encoder() is called in two passes, one where the encoders
  83. * from the same provider as the keymgmt are looked up, and one where
  84. * the other encoders are looked up. |data->flag_find_same_provider|
  85. * tells us which pass we're in.
  86. */
  87. if ((data->keymgmt_prov == prov) == data->flag_find_same_provider) {
  88. void *provctx = OSSL_PROVIDER_get0_provider_ctx(prov);
  89. int i, end_i = sk_OPENSSL_CSTRING_num(data->names);
  90. int match;
  91. for (i = 0; i < end_i; i++) {
  92. if (data->flag_find_same_provider)
  93. match = (data->id_names[i] == encoder->base.id);
  94. else
  95. match = OSSL_ENCODER_is_a(encoder,
  96. sk_OPENSSL_CSTRING_value(data->names, i));
  97. if (!match
  98. || (encoder->does_selection != NULL
  99. && !encoder->does_selection(provctx, data->ctx->selection))
  100. || (data->keymgmt_prov != prov
  101. && encoder->import_object == NULL))
  102. continue;
  103. /* Only add each encoder implementation once */
  104. if (OSSL_ENCODER_CTX_add_encoder(data->ctx, encoder))
  105. break;
  106. }
  107. }
  108. data->error_occurred = 0; /* All is good now */
  109. }
  110. struct collected_names_st {
  111. STACK_OF(OPENSSL_CSTRING) *names;
  112. unsigned int error_occurred:1;
  113. };
  114. static void collect_name(const char *name, void *arg)
  115. {
  116. struct collected_names_st *data = arg;
  117. if (data->error_occurred)
  118. return;
  119. data->error_occurred = 1; /* Assume the worst */
  120. if (sk_OPENSSL_CSTRING_push(data->names, name) <= 0)
  121. return;
  122. data->error_occurred = 0; /* All is good now */
  123. }
  124. /*
  125. * Support for OSSL_ENCODER_to_bio:
  126. * writing callback for the OSSL_PARAM (the implementation doesn't have
  127. * intimate knowledge of the provider side object)
  128. */
  129. struct construct_data_st {
  130. const EVP_PKEY *pk;
  131. int selection;
  132. OSSL_ENCODER_INSTANCE *encoder_inst;
  133. const void *obj;
  134. void *constructed_obj;
  135. };
  136. static int encoder_import_cb(const OSSL_PARAM params[], void *arg)
  137. {
  138. struct construct_data_st *construct_data = arg;
  139. OSSL_ENCODER_INSTANCE *encoder_inst = construct_data->encoder_inst;
  140. OSSL_ENCODER *encoder = OSSL_ENCODER_INSTANCE_get_encoder(encoder_inst);
  141. void *encoderctx = OSSL_ENCODER_INSTANCE_get_encoder_ctx(encoder_inst);
  142. construct_data->constructed_obj =
  143. encoder->import_object(encoderctx, construct_data->selection, params);
  144. return (construct_data->constructed_obj != NULL);
  145. }
  146. static const void *
  147. encoder_construct_pkey(OSSL_ENCODER_INSTANCE *encoder_inst, void *arg)
  148. {
  149. struct construct_data_st *data = arg;
  150. if (data->obj == NULL) {
  151. OSSL_ENCODER *encoder =
  152. OSSL_ENCODER_INSTANCE_get_encoder(encoder_inst);
  153. const EVP_PKEY *pk = data->pk;
  154. const OSSL_PROVIDER *k_prov = EVP_KEYMGMT_get0_provider(pk->keymgmt);
  155. const OSSL_PROVIDER *e_prov = OSSL_ENCODER_get0_provider(encoder);
  156. if (k_prov != e_prov) {
  157. data->encoder_inst = encoder_inst;
  158. if (!evp_keymgmt_export(pk->keymgmt, pk->keydata, data->selection,
  159. &encoder_import_cb, data))
  160. return NULL;
  161. data->obj = data->constructed_obj;
  162. } else {
  163. data->obj = pk->keydata;
  164. }
  165. }
  166. return data->obj;
  167. }
  168. static void encoder_destruct_pkey(void *arg)
  169. {
  170. struct construct_data_st *data = arg;
  171. if (data->encoder_inst != NULL) {
  172. OSSL_ENCODER *encoder =
  173. OSSL_ENCODER_INSTANCE_get_encoder(data->encoder_inst);
  174. encoder->free_object(data->constructed_obj);
  175. }
  176. data->constructed_obj = NULL;
  177. }
  178. /*
  179. * OSSL_ENCODER_CTX_new_for_pkey() returns a ctx with no encoder if
  180. * it couldn't find a suitable encoder. This allows a caller to detect if
  181. * a suitable encoder was found, with OSSL_ENCODER_CTX_get_num_encoder(),
  182. * and to use fallback methods if the result is NULL.
  183. */
  184. static int ossl_encoder_ctx_setup_for_pkey(OSSL_ENCODER_CTX *ctx,
  185. const EVP_PKEY *pkey,
  186. int selection,
  187. const char *propquery)
  188. {
  189. struct construct_data_st *data = NULL;
  190. const OSSL_PROVIDER *prov = NULL;
  191. OSSL_LIB_CTX *libctx = NULL;
  192. int ok = 0, i, end;
  193. OSSL_NAMEMAP *namemap;
  194. if (!ossl_assert(ctx != NULL) || !ossl_assert(pkey != NULL)) {
  195. ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_NULL_PARAMETER);
  196. return 0;
  197. }
  198. if (evp_pkey_is_provided(pkey)) {
  199. prov = EVP_KEYMGMT_get0_provider(pkey->keymgmt);
  200. libctx = ossl_provider_libctx(prov);
  201. }
  202. if (pkey->keymgmt != NULL) {
  203. struct collected_encoder_st encoder_data;
  204. struct collected_names_st keymgmt_data;
  205. if ((data = OPENSSL_zalloc(sizeof(*data))) == NULL)
  206. goto err;
  207. /*
  208. * Select the first encoder implementations in two steps.
  209. * First, collect the keymgmt names, then the encoders that match.
  210. */
  211. keymgmt_data.names = sk_OPENSSL_CSTRING_new_null();
  212. if (keymgmt_data.names == NULL) {
  213. ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_CRYPTO_LIB);
  214. goto err;
  215. }
  216. keymgmt_data.error_occurred = 0;
  217. EVP_KEYMGMT_names_do_all(pkey->keymgmt, collect_name, &keymgmt_data);
  218. if (keymgmt_data.error_occurred) {
  219. sk_OPENSSL_CSTRING_free(keymgmt_data.names);
  220. goto err;
  221. }
  222. encoder_data.names = keymgmt_data.names;
  223. encoder_data.output_type = ctx->output_type;
  224. encoder_data.output_structure = ctx->output_structure;
  225. encoder_data.error_occurred = 0;
  226. encoder_data.keymgmt_prov = prov;
  227. encoder_data.ctx = ctx;
  228. encoder_data.id_names = NULL;
  229. /*
  230. * collect_encoder() is called many times, and for every call it converts all encoder_data.names
  231. * into namemap ids if it calls OSSL_ENCODER_is_a(). We cache the ids here instead,
  232. * and can use them for encoders with the same provider as the keymgmt.
  233. */
  234. namemap = ossl_namemap_stored(libctx);
  235. end = sk_OPENSSL_CSTRING_num(encoder_data.names);
  236. if (end > 0) {
  237. encoder_data.id_names = OPENSSL_malloc(end * sizeof(int));
  238. if (encoder_data.id_names == NULL) {
  239. sk_OPENSSL_CSTRING_free(keymgmt_data.names);
  240. goto err;
  241. }
  242. for (i = 0; i < end; ++i) {
  243. const char *name = sk_OPENSSL_CSTRING_value(keymgmt_data.names, i);
  244. encoder_data.id_names[i] = ossl_namemap_name2num(namemap, name);
  245. }
  246. }
  247. /*
  248. * Place the encoders with the a different provider as the keymgmt
  249. * last (the chain is processed in reverse order)
  250. */
  251. encoder_data.flag_find_same_provider = 0;
  252. OSSL_ENCODER_do_all_provided(libctx, collect_encoder, &encoder_data);
  253. /*
  254. * Place the encoders with the same provider as the keymgmt first
  255. * (the chain is processed in reverse order)
  256. */
  257. encoder_data.flag_find_same_provider = 1;
  258. OSSL_ENCODER_do_all_provided(libctx, collect_encoder, &encoder_data);
  259. OPENSSL_free(encoder_data.id_names);
  260. sk_OPENSSL_CSTRING_free(keymgmt_data.names);
  261. if (encoder_data.error_occurred) {
  262. ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_CRYPTO_LIB);
  263. goto err;
  264. }
  265. }
  266. if (data != NULL && OSSL_ENCODER_CTX_get_num_encoders(ctx) != 0) {
  267. if (!OSSL_ENCODER_CTX_set_construct(ctx, encoder_construct_pkey)
  268. || !OSSL_ENCODER_CTX_set_construct_data(ctx, data)
  269. || !OSSL_ENCODER_CTX_set_cleanup(ctx, encoder_destruct_pkey))
  270. goto err;
  271. data->pk = pkey;
  272. data->selection = selection;
  273. data = NULL; /* Avoid it being freed */
  274. }
  275. ok = 1;
  276. err:
  277. if (data != NULL) {
  278. OSSL_ENCODER_CTX_set_construct_data(ctx, NULL);
  279. OPENSSL_free(data);
  280. }
  281. return ok;
  282. }
  283. OSSL_ENCODER_CTX *OSSL_ENCODER_CTX_new_for_pkey(const EVP_PKEY *pkey,
  284. int selection,
  285. const char *output_type,
  286. const char *output_struct,
  287. const char *propquery)
  288. {
  289. OSSL_ENCODER_CTX *ctx = NULL;
  290. OSSL_LIB_CTX *libctx = NULL;
  291. if (pkey == NULL) {
  292. ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_NULL_PARAMETER);
  293. return NULL;
  294. }
  295. if (!evp_pkey_is_assigned(pkey)) {
  296. ERR_raise_data(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_INVALID_ARGUMENT,
  297. "The passed EVP_PKEY must be assigned a key");
  298. return NULL;
  299. }
  300. if ((ctx = OSSL_ENCODER_CTX_new()) == NULL) {
  301. ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_OSSL_ENCODER_LIB);
  302. return NULL;
  303. }
  304. if (evp_pkey_is_provided(pkey)) {
  305. const OSSL_PROVIDER *prov = EVP_KEYMGMT_get0_provider(pkey->keymgmt);
  306. libctx = ossl_provider_libctx(prov);
  307. }
  308. OSSL_TRACE_BEGIN(ENCODER) {
  309. BIO_printf(trc_out,
  310. "(ctx %p) Looking for %s encoders with selection %d\n",
  311. (void *)ctx, EVP_PKEY_get0_type_name(pkey), selection);
  312. BIO_printf(trc_out, " output type: %s, output structure: %s\n",
  313. output_type, output_struct);
  314. } OSSL_TRACE_END(ENCODER);
  315. if (OSSL_ENCODER_CTX_set_output_type(ctx, output_type)
  316. && (output_struct == NULL
  317. || OSSL_ENCODER_CTX_set_output_structure(ctx, output_struct))
  318. && OSSL_ENCODER_CTX_set_selection(ctx, selection)
  319. && ossl_encoder_ctx_setup_for_pkey(ctx, pkey, selection, propquery)
  320. && OSSL_ENCODER_CTX_add_extra(ctx, libctx, propquery)) {
  321. OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
  322. int save_parameters = pkey->save_parameters;
  323. params[0] = OSSL_PARAM_construct_int(OSSL_ENCODER_PARAM_SAVE_PARAMETERS,
  324. &save_parameters);
  325. /* ignoring error as this is only auxiliary parameter */
  326. (void)OSSL_ENCODER_CTX_set_params(ctx, params);
  327. OSSL_TRACE_BEGIN(ENCODER) {
  328. BIO_printf(trc_out, "(ctx %p) Got %d encoders\n",
  329. (void *)ctx, OSSL_ENCODER_CTX_get_num_encoders(ctx));
  330. } OSSL_TRACE_END(ENCODER);
  331. return ctx;
  332. }
  333. OSSL_ENCODER_CTX_free(ctx);
  334. return NULL;
  335. }