1 /*
2 * Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 /* We need to use some engine deprecated APIs */
11 #define OPENSSL_SUPPRESS_DEPRECATED
12
13 #include <openssl/evp.h>
14 #include <openssl/core_names.h>
15 #include <openssl/err.h>
16 #include <openssl/proverr.h>
17 #ifndef FIPS_MODULE
18 # include <openssl/engine.h>
19 # include "crypto/evp.h"
20 #endif
21 #include "prov/providercommon.h"
22 #include "prov/provider_util.h"
23
ossl_prov_cipher_reset(PROV_CIPHER * pc)24 void ossl_prov_cipher_reset(PROV_CIPHER *pc)
25 {
26 EVP_CIPHER_free(pc->alloc_cipher);
27 pc->alloc_cipher = NULL;
28 pc->cipher = NULL;
29 #if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_ENGINE)
30 ENGINE_finish(pc->engine);
31 #endif
32 pc->engine = NULL;
33 }
34
ossl_prov_cipher_copy(PROV_CIPHER * dst,const PROV_CIPHER * src)35 int ossl_prov_cipher_copy(PROV_CIPHER *dst, const PROV_CIPHER *src)
36 {
37 if (src->alloc_cipher != NULL && !EVP_CIPHER_up_ref(src->alloc_cipher))
38 return 0;
39 #if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_ENGINE)
40 if (src->engine != NULL && !ENGINE_init(src->engine)) {
41 EVP_CIPHER_free(src->alloc_cipher);
42 return 0;
43 }
44 #endif
45 dst->engine = src->engine;
46 dst->cipher = src->cipher;
47 dst->alloc_cipher = src->alloc_cipher;
48 return 1;
49 }
50
set_propq(const OSSL_PARAM * propq,const char ** propquery)51 static int set_propq(const OSSL_PARAM *propq, const char **propquery)
52 {
53 *propquery = NULL;
54 if (propq != NULL) {
55 if (propq->data_type != OSSL_PARAM_UTF8_STRING)
56 return 0;
57 *propquery = propq->data;
58 }
59 return 1;
60 }
61
set_engine(const OSSL_PARAM * e,ENGINE ** engine)62 static int set_engine(const OSSL_PARAM *e, ENGINE **engine)
63 {
64 #if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_ENGINE)
65 ENGINE_finish(*engine);
66 #endif
67 *engine = NULL;
68 /* Inside the FIPS module, we don't support legacy ciphers */
69 #if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_ENGINE)
70 if (e != NULL) {
71 if (e->data_type != OSSL_PARAM_UTF8_STRING)
72 return 0;
73 /* Get a structural reference */
74 *engine = ENGINE_by_id(e->data);
75 if (*engine == NULL)
76 return 0;
77 /* Get a functional reference */
78 if (!ENGINE_init(*engine)) {
79 ENGINE_free(*engine);
80 *engine = NULL;
81 return 0;
82 }
83 /* Free the structural reference */
84 ENGINE_free(*engine);
85 }
86 #endif
87 return 1;
88 }
89
ossl_prov_cipher_load(PROV_CIPHER * pc,const OSSL_PARAM * cipher,const OSSL_PARAM * propq,const OSSL_PARAM * engine,OSSL_LIB_CTX * ctx)90 int ossl_prov_cipher_load(PROV_CIPHER *pc, const OSSL_PARAM *cipher,
91 const OSSL_PARAM *propq, const OSSL_PARAM *engine,
92 OSSL_LIB_CTX *ctx)
93 {
94 const char *propquery;
95
96 if (!set_propq(propq, &propquery) || !set_engine(engine, &pc->engine))
97 return 0;
98
99 if (cipher == NULL)
100 return 1;
101 if (cipher->data_type != OSSL_PARAM_UTF8_STRING)
102 return 0;
103
104 EVP_CIPHER_free(pc->alloc_cipher);
105 ERR_set_mark();
106 pc->cipher = pc->alloc_cipher = EVP_CIPHER_fetch(ctx, cipher->data,
107 propquery);
108 #ifndef FIPS_MODULE /* Inside the FIPS module, we don't support legacy ciphers */
109 if (pc->cipher == NULL) {
110 const EVP_CIPHER *evp_cipher;
111
112 evp_cipher = EVP_get_cipherbyname(cipher->data);
113 /* Do not use global EVP_CIPHERs */
114 if (evp_cipher != NULL && evp_cipher->origin != EVP_ORIG_GLOBAL)
115 pc->cipher = evp_cipher;
116 }
117 #endif
118 if (pc->cipher != NULL)
119 ERR_pop_to_mark();
120 else
121 ERR_clear_last_mark();
122 return pc->cipher != NULL;
123 }
124
ossl_prov_cipher_load_from_params(PROV_CIPHER * pc,const OSSL_PARAM params[],OSSL_LIB_CTX * ctx)125 int ossl_prov_cipher_load_from_params(PROV_CIPHER *pc,
126 const OSSL_PARAM params[],
127 OSSL_LIB_CTX *ctx)
128 {
129 return ossl_prov_cipher_load(pc,
130 OSSL_PARAM_locate_const(params, OSSL_ALG_PARAM_CIPHER),
131 OSSL_PARAM_locate_const(params, OSSL_ALG_PARAM_PROPERTIES),
132 OSSL_PARAM_locate_const(params, OSSL_ALG_PARAM_ENGINE),
133 ctx);
134 }
135
ossl_prov_cipher_cipher(const PROV_CIPHER * pc)136 const EVP_CIPHER *ossl_prov_cipher_cipher(const PROV_CIPHER *pc)
137 {
138 return pc->cipher;
139 }
140
ossl_prov_cipher_engine(const PROV_CIPHER * pc)141 ENGINE *ossl_prov_cipher_engine(const PROV_CIPHER *pc)
142 {
143 return pc->engine;
144 }
145
ossl_prov_digest_reset(PROV_DIGEST * pd)146 void ossl_prov_digest_reset(PROV_DIGEST *pd)
147 {
148 EVP_MD_free(pd->alloc_md);
149 pd->alloc_md = NULL;
150 pd->md = NULL;
151 #if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_ENGINE)
152 ENGINE_finish(pd->engine);
153 #endif
154 pd->engine = NULL;
155 }
156
ossl_prov_digest_copy(PROV_DIGEST * dst,const PROV_DIGEST * src)157 int ossl_prov_digest_copy(PROV_DIGEST *dst, const PROV_DIGEST *src)
158 {
159 if (src->alloc_md != NULL && !EVP_MD_up_ref(src->alloc_md))
160 return 0;
161 #if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_ENGINE)
162 if (src->engine != NULL && !ENGINE_init(src->engine)) {
163 EVP_MD_free(src->alloc_md);
164 return 0;
165 }
166 #endif
167 dst->engine = src->engine;
168 dst->md = src->md;
169 dst->alloc_md = src->alloc_md;
170 return 1;
171 }
172
ossl_prov_digest_fetch(PROV_DIGEST * pd,OSSL_LIB_CTX * libctx,const char * mdname,const char * propquery)173 const EVP_MD *ossl_prov_digest_fetch(PROV_DIGEST *pd, OSSL_LIB_CTX *libctx,
174 const char *mdname, const char *propquery)
175 {
176 EVP_MD_free(pd->alloc_md);
177 pd->md = pd->alloc_md = EVP_MD_fetch(libctx, mdname, propquery);
178
179 return pd->md;
180 }
181
ossl_prov_digest_load(PROV_DIGEST * pd,const OSSL_PARAM * digest,const OSSL_PARAM * propq,const OSSL_PARAM * engine,OSSL_LIB_CTX * ctx)182 int ossl_prov_digest_load(PROV_DIGEST *pd, const OSSL_PARAM *digest,
183 const OSSL_PARAM *propq, const OSSL_PARAM *engine,
184 OSSL_LIB_CTX *ctx)
185 {
186 const char *propquery;
187
188 if (!set_propq(propq, &propquery) || !set_engine(engine, &pd->engine))
189 return 0;
190
191 if (digest == NULL)
192 return 1;
193 if (digest->data_type != OSSL_PARAM_UTF8_STRING)
194 return 0;
195
196 ERR_set_mark();
197 ossl_prov_digest_fetch(pd, ctx, digest->data, propquery);
198 #ifndef FIPS_MODULE /* Inside the FIPS module, we don't support legacy digests */
199 if (pd->md == NULL) {
200 const EVP_MD *md;
201
202 md = EVP_get_digestbyname(digest->data);
203 /* Do not use global EVP_MDs */
204 if (md != NULL && md->origin != EVP_ORIG_GLOBAL)
205 pd->md = md;
206 }
207 #endif
208 if (pd->md != NULL)
209 ERR_pop_to_mark();
210 else
211 ERR_clear_last_mark();
212 return pd->md != NULL;
213 }
214
ossl_prov_digest_load_from_params(PROV_DIGEST * pd,const OSSL_PARAM params[],OSSL_LIB_CTX * ctx)215 int ossl_prov_digest_load_from_params(PROV_DIGEST *pd,
216 const OSSL_PARAM params[],
217 OSSL_LIB_CTX *ctx)
218 {
219 return ossl_prov_digest_load(pd,
220 OSSL_PARAM_locate_const(params, OSSL_ALG_PARAM_DIGEST),
221 OSSL_PARAM_locate_const(params, OSSL_ALG_PARAM_PROPERTIES),
222 OSSL_PARAM_locate_const(params, OSSL_ALG_PARAM_ENGINE),
223 ctx);
224 }
225
ossl_prov_digest_set_md(PROV_DIGEST * pd,EVP_MD * md)226 void ossl_prov_digest_set_md(PROV_DIGEST *pd, EVP_MD *md)
227 {
228 ossl_prov_digest_reset(pd);
229 pd->md = pd->alloc_md = md;
230 }
231
ossl_prov_digest_md(const PROV_DIGEST * pd)232 const EVP_MD *ossl_prov_digest_md(const PROV_DIGEST *pd)
233 {
234 return pd->md;
235 }
236
ossl_prov_digest_engine(const PROV_DIGEST * pd)237 ENGINE *ossl_prov_digest_engine(const PROV_DIGEST *pd)
238 {
239 return pd->engine;
240 }
241
ossl_prov_set_macctx(EVP_MAC_CTX * macctx,const char * ciphername,const char * mdname,const char * engine,const char * properties)242 int ossl_prov_set_macctx(EVP_MAC_CTX *macctx,
243 const char *ciphername,
244 const char *mdname,
245 const char *engine,
246 const char *properties)
247 {
248 OSSL_PARAM mac_params[5], *mp = mac_params;
249
250 if (mdname != NULL)
251 *mp++ = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST,
252 (char *)mdname, 0);
253 if (ciphername != NULL)
254 *mp++ = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_CIPHER,
255 (char *)ciphername, 0);
256 if (properties != NULL)
257 *mp++ = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_PROPERTIES,
258 (char *)properties, 0);
259
260 #if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
261 if (engine != NULL)
262 *mp++ = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_ENGINE,
263 (char *) engine, 0);
264 #endif
265
266 *mp = OSSL_PARAM_construct_end();
267
268 return EVP_MAC_CTX_set_params(macctx, mac_params);
269
270 }
271
ossl_prov_macctx_load(EVP_MAC_CTX ** macctx,const OSSL_PARAM * pmac,const OSSL_PARAM * pcipher,const OSSL_PARAM * pdigest,const OSSL_PARAM * propq,const OSSL_PARAM * pengine,const char * macname,const char * ciphername,const char * mdname,OSSL_LIB_CTX * libctx)272 int ossl_prov_macctx_load(EVP_MAC_CTX **macctx,
273 const OSSL_PARAM *pmac, const OSSL_PARAM *pcipher,
274 const OSSL_PARAM *pdigest, const OSSL_PARAM *propq,
275 const OSSL_PARAM *pengine,
276 const char *macname, const char *ciphername,
277 const char *mdname, OSSL_LIB_CTX *libctx)
278 {
279 const char *properties = NULL;
280 const char *engine = NULL;
281
282 if (macname == NULL && pmac != NULL)
283 if (!OSSL_PARAM_get_utf8_string_ptr(pmac, &macname))
284 return 0;
285 if (propq != NULL && !OSSL_PARAM_get_utf8_string_ptr(propq, &properties))
286 return 0;
287
288 /* If we got a new mac name, we make a new EVP_MAC_CTX */
289 if (macname != NULL) {
290 EVP_MAC *mac = EVP_MAC_fetch(libctx, macname, properties);
291
292 EVP_MAC_CTX_free(*macctx);
293 *macctx = mac == NULL ? NULL : EVP_MAC_CTX_new(mac);
294 /* The context holds on to the MAC */
295 EVP_MAC_free(mac);
296 if (*macctx == NULL)
297 return 0;
298 }
299
300 /*
301 * If there is no MAC yet (and therefore, no MAC context), we ignore
302 * all other parameters.
303 */
304 if (*macctx == NULL)
305 return 1;
306
307 if (ciphername == NULL && pcipher != NULL)
308 if (!OSSL_PARAM_get_utf8_string_ptr(pcipher, &ciphername))
309 return 0;
310 if (mdname == NULL && pdigest != NULL)
311 if (!OSSL_PARAM_get_utf8_string_ptr(pdigest, &mdname))
312 return 0;
313 if (pengine != NULL && !OSSL_PARAM_get_utf8_string_ptr(pengine, &engine))
314 return 0;
315
316 if (ossl_prov_set_macctx(*macctx, ciphername, mdname, engine, properties))
317 return 1;
318
319 EVP_MAC_CTX_free(*macctx);
320 *macctx = NULL;
321 return 0;
322 }
323
ossl_prov_macctx_load_from_params(EVP_MAC_CTX ** macctx,const OSSL_PARAM params[],const char * macname,const char * ciphername,const char * mdname,OSSL_LIB_CTX * libctx)324 int ossl_prov_macctx_load_from_params(EVP_MAC_CTX **macctx,
325 const OSSL_PARAM params[],
326 const char *macname,
327 const char *ciphername,
328 const char *mdname,
329 OSSL_LIB_CTX *libctx)
330 {
331 return ossl_prov_macctx_load
332 (macctx, OSSL_PARAM_locate_const(params, OSSL_ALG_PARAM_MAC),
333 OSSL_PARAM_locate_const(params, OSSL_ALG_PARAM_CIPHER),
334 OSSL_PARAM_locate_const(params, OSSL_ALG_PARAM_DIGEST),
335 OSSL_PARAM_locate_const(params, OSSL_ALG_PARAM_PROPERTIES),
336 OSSL_PARAM_locate_const(params, OSSL_ALG_PARAM_ENGINE),
337 macname, ciphername, mdname, libctx);
338 }
339
ossl_prov_cache_exported_algorithms(const OSSL_ALGORITHM_CAPABLE * in,OSSL_ALGORITHM * out)340 void ossl_prov_cache_exported_algorithms(const OSSL_ALGORITHM_CAPABLE *in,
341 OSSL_ALGORITHM *out)
342 {
343 int i, j;
344
345 if (out[0].algorithm_names == NULL) {
346 for (i = j = 0; in[i].alg.algorithm_names != NULL; ++i) {
347 if (in[i].capable == NULL || in[i].capable())
348 out[j++] = in[i].alg;
349 }
350 out[j++] = in[i].alg;
351 }
352 }
353
354 /* Duplicate a lump of memory safely */
ossl_prov_memdup(const void * src,size_t src_len,unsigned char ** dest,size_t * dest_len)355 int ossl_prov_memdup(const void *src, size_t src_len,
356 unsigned char **dest, size_t *dest_len)
357 {
358 if (src != NULL) {
359 if ((*dest = OPENSSL_memdup(src, src_len)) == NULL)
360 return 0;
361 *dest_len = src_len;
362 } else {
363 *dest = NULL;
364 *dest_len = 0;
365 }
366 return 1;
367 }
368