1/*
2 * Copyright 2020-2023 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License").  You may not use
5 * this file except in compliance with the License.  You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9{-
10use OpenSSL::paramnames qw(produce_param_decoder);
11-}
12
13/*
14 * Low level APIs are deprecated for public use, but still ok for internal use.
15 */
16#include "internal/deprecated.h"
17
18#include <string.h>
19#include <openssl/core.h>
20#include <openssl/core_dispatch.h>
21#include <openssl/core_names.h>
22#include <openssl/params.h>
23#include <openssl/err.h>
24#include <openssl/proverr.h>
25#include <openssl/pem.h>         /* Functions for writing MSBLOB and PVK */
26#include <openssl/dsa.h>
27#include "internal/cryptlib.h"
28#include "internal/passphrase.h"
29#include "crypto/rsa.h"
30#include "prov/implementations.h"
31#include "prov/bio.h"
32#include "prov/provider_ctx.h"
33#include "prov/endecoder_local.h"
34
35struct key2ms_ctx_st {
36    PROV_CTX *provctx;
37
38    int pvk_encr_level;
39
40    struct ossl_passphrase_data_st pwdata;
41};
42
43static int write_msblob(struct key2ms_ctx_st *ctx, OSSL_CORE_BIO *cout,
44                        EVP_PKEY *pkey, int ispub)
45{
46    BIO *out = ossl_bio_new_from_core_bio(ctx->provctx, cout);
47    int ret;
48
49    if (out == NULL)
50        return 0;
51    ret = ispub ? i2b_PublicKey_bio(out, pkey) : i2b_PrivateKey_bio(out, pkey);
52
53    BIO_free(out);
54    return ret;
55}
56
57static int write_pvk(struct key2ms_ctx_st *ctx, OSSL_CORE_BIO *cout,
58                     EVP_PKEY *pkey)
59{
60    BIO *out = NULL;
61    int ret;
62    OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx);
63
64    out = ossl_bio_new_from_core_bio(ctx->provctx, cout);
65    if (out == NULL)
66        return 0;
67    ret = i2b_PVK_bio_ex(out, pkey, ctx->pvk_encr_level,
68                         ossl_pw_pvk_password, &ctx->pwdata, libctx, NULL);
69    BIO_free(out);
70    return ret;
71}
72
73static OSSL_FUNC_encoder_freectx_fn key2ms_freectx;
74static OSSL_FUNC_encoder_does_selection_fn key2ms_does_selection;
75
76static struct key2ms_ctx_st *key2ms_newctx(void *provctx)
77{
78    struct key2ms_ctx_st *ctx = OPENSSL_zalloc(sizeof(*ctx));
79
80    if (ctx != NULL) {
81        ctx->provctx = provctx;
82        /* This is the strongest encryption level */
83        ctx->pvk_encr_level = 2;
84    }
85    return ctx;
86}
87
88static void key2ms_freectx(void *vctx)
89{
90    struct key2ms_ctx_st *ctx = vctx;
91
92    ossl_pw_clear_passphrase_data(&ctx->pwdata);
93    OPENSSL_free(ctx);
94}
95
96{- produce_param_decoder('key2pvk_set_ctx_params',
97                         (['ENCODER_PARAM_ENCRYPT_LEVEL', 'enclvl', 'int'],
98                         )); -}
99
100static const OSSL_PARAM *key2pvk_settable_ctx_params(ossl_unused void *provctx)
101{
102    return key2pvk_set_ctx_params_list;
103}
104
105static int key2pvk_set_ctx_params(void *vctx, const OSSL_PARAM params[])
106{
107    struct key2ms_ctx_st *ctx = vctx;
108    struct key2pvk_set_ctx_params_st p;
109
110    if (ctx == NULL || !key2pvk_set_ctx_params_decoder(params, &p))
111        return 0;
112
113    if (p.enclvl != NULL && !OSSL_PARAM_get_int(p.enclvl, &ctx->pvk_encr_level))
114        return 0;
115    return 1;
116}
117
118static int key2ms_does_selection(void *vctx, int selection)
119{
120    return (selection & OSSL_KEYMGMT_SELECT_KEYPAIR) != 0;
121}
122
123/*
124 * The real EVP_PKEY_set1_TYPE() functions take a non-const key, while the key
125 * pointer in the encode function is a const pointer.  We violate the constness
126 * knowingly, since we know that the key comes from the same provider, is never
127 * actually const, and the implied reference count change is safe.
128 *
129 * EVP_PKEY_assign() can't be used, because there's no way to clear the internal
130 * key using that function without freeing the existing internal key.
131 */
132typedef int evp_pkey_set1_fn(EVP_PKEY *, const void *key);
133
134static int key2msblob_encode(void *vctx, const void *key, int selection,
135                             OSSL_CORE_BIO *cout, evp_pkey_set1_fn *set1_key,
136                             OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg)
137{
138    struct key2ms_ctx_st *ctx = vctx;
139    int ispub = -1;
140    EVP_PKEY *pkey = NULL;
141    int ok = 0;
142
143    if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0)
144        ispub = 0;
145    else if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0)
146        ispub = 1;
147    else
148        return 0;                /* Error */
149
150    if ((pkey = EVP_PKEY_new()) != NULL && set1_key(pkey, key))
151        ok = write_msblob(ctx, cout, pkey, ispub);
152    EVP_PKEY_free(pkey);
153    return ok;
154}
155
156static int key2pvk_encode(void *vctx, const void *key, int selection,
157                          OSSL_CORE_BIO *cout, evp_pkey_set1_fn *set1_key,
158                          OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg)
159{
160    struct key2ms_ctx_st *ctx = vctx;
161    EVP_PKEY *pkey = NULL;
162    int ok = 0;
163
164    if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) == 0)
165        return 0;                /* Error */
166
167    if ((pkey = EVP_PKEY_new()) != NULL && set1_key(pkey, key)
168        && (pw_cb == NULL
169            || ossl_pw_set_ossl_passphrase_cb(&ctx->pwdata, pw_cb, pw_cbarg)))
170        ok = write_pvk(ctx, cout, pkey);
171    EVP_PKEY_free(pkey);
172    return ok;
173}
174
175#define dsa_set1        (evp_pkey_set1_fn *)EVP_PKEY_set1_DSA
176#define rsa_set1        (evp_pkey_set1_fn *)EVP_PKEY_set1_RSA
177
178#define msblob_set_params
179#define pvk_set_params                                                        \
180        { OSSL_FUNC_ENCODER_SETTABLE_CTX_PARAMS,                              \
181          (void (*)(void))key2pvk_settable_ctx_params },                      \
182        { OSSL_FUNC_ENCODER_SET_CTX_PARAMS,                                   \
183          (void (*)(void))key2pvk_set_ctx_params },
184
185#define MAKE_MS_ENCODER(impl, output, type)                                   \
186    static OSSL_FUNC_encoder_import_object_fn                                 \
187    impl##2##output##_import_object;                                          \
188    static OSSL_FUNC_encoder_free_object_fn impl##2##output##_free_object;    \
189    static OSSL_FUNC_encoder_encode_fn impl##2##output##_encode;              \
190                                                                              \
191    static void *                                                             \
192    impl##2##output##_import_object(void *ctx, int selection,                 \
193                                    const OSSL_PARAM params[])                \
194    {                                                                         \
195        return ossl_prov_import_key(ossl_##impl##_keymgmt_functions,          \
196                                    ctx, selection, params);                  \
197    }                                                                         \
198    static void impl##2##output##_free_object(void *key)                      \
199    {                                                                         \
200        ossl_prov_free_key(ossl_##impl##_keymgmt_functions, key);             \
201    }                                                                         \
202    static int impl##2##output##_encode(void *vctx, OSSL_CORE_BIO *cout,      \
203                                        const void *key,                      \
204                                        const OSSL_PARAM key_abstract[],      \
205                                        int selection,                        \
206                                        OSSL_PASSPHRASE_CALLBACK *cb,         \
207                                        void *cbarg)                          \
208    {                                                                         \
209        /* We don't deal with abstract objects */                             \
210        if (key_abstract != NULL) {                                           \
211            ERR_raise(ERR_LIB_PROV, ERR_R_PASSED_INVALID_ARGUMENT);           \
212            return 0;                                                         \
213        }                                                                     \
214        return key2##output##_encode(vctx, key, selection, cout, type##_set1, \
215                                     cb, cbarg);                              \
216    }                                                                         \
217    const OSSL_DISPATCH ossl_##impl##_to_##output##_encoder_functions[] = {   \
218        { OSSL_FUNC_ENCODER_NEWCTX,                                           \
219          (void (*)(void))key2ms_newctx },                                    \
220        { OSSL_FUNC_ENCODER_FREECTX,                                          \
221          (void (*)(void))key2ms_freectx },                                   \
222        output##_set_params                                                   \
223        { OSSL_FUNC_ENCODER_DOES_SELECTION,                                   \
224          (void (*)(void))key2ms_does_selection },                            \
225        { OSSL_FUNC_ENCODER_IMPORT_OBJECT,                                    \
226          (void (*)(void))impl##2##output##_import_object },                  \
227        { OSSL_FUNC_ENCODER_FREE_OBJECT,                                      \
228          (void (*)(void))impl##2##output##_free_object },                    \
229        { OSSL_FUNC_ENCODER_ENCODE,                                           \
230          (void (*)(void))impl##2##output##_encode },                         \
231        OSSL_DISPATCH_END                                                     \
232    }
233
234#ifndef OPENSSL_NO_DSA
235MAKE_MS_ENCODER(dsa, pvk, dsa);
236MAKE_MS_ENCODER(dsa, msblob, dsa);
237#endif
238
239MAKE_MS_ENCODER(rsa, pvk, rsa);
240MAKE_MS_ENCODER(rsa, msblob, rsa);
241