pmeth_check.c 5.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193
  1. /*
  2. * Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <stdio.h>
  10. #include <stdlib.h>
  11. #include "internal/cryptlib.h"
  12. #include <openssl/objects.h>
  13. #include <openssl/evp.h>
  14. #include "crypto/bn.h"
  15. #ifndef FIPS_MODULE
  16. # include "crypto/asn1.h"
  17. #endif
  18. #include "crypto/evp.h"
  19. #include "evp_local.h"
  20. /*
  21. * Returns:
  22. * 1 True
  23. * 0 False
  24. * -1 Unsupported (use legacy path)
  25. */
  26. static int try_provided_check(EVP_PKEY_CTX *ctx, int selection, int checktype)
  27. {
  28. EVP_KEYMGMT *keymgmt;
  29. void *keydata;
  30. if (evp_pkey_ctx_is_legacy(ctx))
  31. return -1;
  32. keymgmt = ctx->keymgmt;
  33. keydata = evp_pkey_export_to_provider(ctx->pkey, ctx->libctx,
  34. &keymgmt, ctx->propquery);
  35. if (keydata == NULL) {
  36. ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
  37. return 0;
  38. }
  39. return evp_keymgmt_validate(keymgmt, keydata, selection, checktype);
  40. }
  41. static int evp_pkey_public_check_combined(EVP_PKEY_CTX *ctx, int checktype)
  42. {
  43. EVP_PKEY *pkey = ctx->pkey;
  44. int ok;
  45. if (pkey == NULL) {
  46. ERR_raise(ERR_LIB_EVP, EVP_R_NO_KEY_SET);
  47. return 0;
  48. }
  49. if ((ok = try_provided_check(ctx, OSSL_KEYMGMT_SELECT_PUBLIC_KEY,
  50. checktype)) != -1)
  51. return ok;
  52. if (pkey->type == EVP_PKEY_NONE)
  53. goto not_supported;
  54. #ifndef FIPS_MODULE
  55. /* legacy */
  56. /* call customized public key check function first */
  57. if (ctx->pmeth->public_check != NULL)
  58. return ctx->pmeth->public_check(pkey);
  59. /* use default public key check function in ameth */
  60. if (pkey->ameth == NULL || pkey->ameth->pkey_public_check == NULL)
  61. goto not_supported;
  62. return pkey->ameth->pkey_public_check(pkey);
  63. #endif
  64. not_supported:
  65. ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
  66. return -2;
  67. }
  68. int EVP_PKEY_public_check(EVP_PKEY_CTX *ctx)
  69. {
  70. return evp_pkey_public_check_combined(ctx, OSSL_KEYMGMT_VALIDATE_FULL_CHECK);
  71. }
  72. int EVP_PKEY_public_check_quick(EVP_PKEY_CTX *ctx)
  73. {
  74. return evp_pkey_public_check_combined(ctx, OSSL_KEYMGMT_VALIDATE_QUICK_CHECK);
  75. }
  76. static int evp_pkey_param_check_combined(EVP_PKEY_CTX *ctx, int checktype)
  77. {
  78. EVP_PKEY *pkey = ctx->pkey;
  79. int ok;
  80. if (pkey == NULL) {
  81. ERR_raise(ERR_LIB_EVP, EVP_R_NO_KEY_SET);
  82. return 0;
  83. }
  84. if ((ok = try_provided_check(ctx,
  85. OSSL_KEYMGMT_SELECT_ALL_PARAMETERS,
  86. checktype)) != -1)
  87. return ok;
  88. if (pkey->type == EVP_PKEY_NONE)
  89. goto not_supported;
  90. #ifndef FIPS_MODULE
  91. /* legacy */
  92. /* call customized param check function first */
  93. if (ctx->pmeth->param_check != NULL)
  94. return ctx->pmeth->param_check(pkey);
  95. /* use default param check function in ameth */
  96. if (pkey->ameth == NULL || pkey->ameth->pkey_param_check == NULL)
  97. goto not_supported;
  98. return pkey->ameth->pkey_param_check(pkey);
  99. #endif
  100. not_supported:
  101. ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
  102. return -2;
  103. }
  104. int EVP_PKEY_param_check(EVP_PKEY_CTX *ctx)
  105. {
  106. return evp_pkey_param_check_combined(ctx, OSSL_KEYMGMT_VALIDATE_FULL_CHECK);
  107. }
  108. int EVP_PKEY_param_check_quick(EVP_PKEY_CTX *ctx)
  109. {
  110. return evp_pkey_param_check_combined(ctx, OSSL_KEYMGMT_VALIDATE_QUICK_CHECK);
  111. }
  112. int EVP_PKEY_private_check(EVP_PKEY_CTX *ctx)
  113. {
  114. EVP_PKEY *pkey = ctx->pkey;
  115. int ok;
  116. if (pkey == NULL) {
  117. ERR_raise(ERR_LIB_EVP, EVP_R_NO_KEY_SET);
  118. return 0;
  119. }
  120. if ((ok = try_provided_check(ctx, OSSL_KEYMGMT_SELECT_PRIVATE_KEY,
  121. OSSL_KEYMGMT_VALIDATE_FULL_CHECK)) != -1)
  122. return ok;
  123. /* not supported for legacy keys */
  124. ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
  125. return -2;
  126. }
  127. int EVP_PKEY_check(EVP_PKEY_CTX *ctx)
  128. {
  129. return EVP_PKEY_pairwise_check(ctx);
  130. }
  131. int EVP_PKEY_pairwise_check(EVP_PKEY_CTX *ctx)
  132. {
  133. EVP_PKEY *pkey = ctx->pkey;
  134. int ok;
  135. if (pkey == NULL) {
  136. ERR_raise(ERR_LIB_EVP, EVP_R_NO_KEY_SET);
  137. return 0;
  138. }
  139. if ((ok = try_provided_check(ctx, OSSL_KEYMGMT_SELECT_KEYPAIR,
  140. OSSL_KEYMGMT_VALIDATE_FULL_CHECK)) != -1)
  141. return ok;
  142. if (pkey->type == EVP_PKEY_NONE)
  143. goto not_supported;
  144. #ifndef FIPS_MODULE
  145. /* legacy */
  146. /* call customized check function first */
  147. if (ctx->pmeth->check != NULL)
  148. return ctx->pmeth->check(pkey);
  149. /* use default check function in ameth */
  150. if (pkey->ameth == NULL || pkey->ameth->pkey_check == NULL)
  151. goto not_supported;
  152. return pkey->ameth->pkey_check(pkey);
  153. #endif
  154. not_supported:
  155. ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
  156. return -2;
  157. }