]>
Commit | Line | Data |
---|---|---|
70a1f7b4 | 1 | /* |
a28d06f3 | 2 | * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved. |
70a1f7b4 RL |
3 | * |
4 | * Licensed under the Apache License 2.0 (the "License"). You may not use | |
5 | * this file except in compliance with the License. You can obtain a copy | |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
8 | */ | |
9 | ||
6508e858 | 10 | #include <openssl/core_names.h> |
70a1f7b4 RL |
11 | #include "internal/cryptlib.h" |
12 | #include "internal/nelem.h" | |
25f2138b | 13 | #include "crypto/evp.h" |
1640d48c | 14 | #include "internal/core.h" |
70a1f7b4 | 15 | #include "internal/provider.h" |
706457b7 | 16 | #include "evp_local.h" |
70a1f7b4 | 17 | |
3f7ce7f1 RL |
18 | /* |
19 | * match_type() checks if two EVP_KEYMGMT are matching key types. This | |
20 | * function assumes that the caller has made all the necessary NULL checks. | |
21 | */ | |
22 | static int match_type(const EVP_KEYMGMT *keymgmt1, const EVP_KEYMGMT *keymgmt2) | |
23 | { | |
ed576acd | 24 | const char *name2 = EVP_KEYMGMT_get0_name(keymgmt2); |
3f7ce7f1 RL |
25 | |
26 | return EVP_KEYMGMT_is_a(keymgmt1, name2); | |
27 | } | |
28 | ||
af836c22 | 29 | int evp_keymgmt_util_try_import(const OSSL_PARAM params[], void *arg) |
651101e1 | 30 | { |
af836c22 | 31 | struct evp_keymgmt_util_try_import_data_st *data = arg; |
e36a4dc4 | 32 | int delete_on_error = 0; |
70a1f7b4 | 33 | |
11391da2 | 34 | /* Just in time creation of keydata */ |
e36a4dc4 RL |
35 | if (data->keydata == NULL) { |
36 | if ((data->keydata = evp_keymgmt_newdata(data->keymgmt)) == NULL) { | |
37 | ERR_raise(ERR_LIB_EVP, ERR_R_MALLOC_FAILURE); | |
38 | return 0; | |
39 | } | |
40 | delete_on_error = 1; | |
11391da2 MC |
41 | } |
42 | ||
adc9f731 RL |
43 | /* |
44 | * It's fine if there was no data to transfer, we just end up with an | |
45 | * empty destination key. | |
46 | */ | |
47 | if (params[0].key == NULL) | |
48 | return 1; | |
49 | ||
e36a4dc4 RL |
50 | if (evp_keymgmt_import(data->keymgmt, data->keydata, data->selection, |
51 | params)) | |
52 | return 1; | |
53 | if (delete_on_error) { | |
54 | evp_keymgmt_freedata(data->keymgmt, data->keydata); | |
55 | data->keydata = NULL; | |
56 | } | |
57 | return 0; | |
70a1f7b4 RL |
58 | } |
59 | ||
af836c22 RL |
60 | int evp_keymgmt_util_assign_pkey(EVP_PKEY *pkey, EVP_KEYMGMT *keymgmt, |
61 | void *keydata) | |
62 | { | |
63 | if (pkey == NULL || keymgmt == NULL || keydata == NULL | |
64 | || !EVP_PKEY_set_type_by_keymgmt(pkey, keymgmt)) { | |
65 | ERR_raise(ERR_LIB_EVP, ERR_R_INTERNAL_ERROR); | |
66 | return 0; | |
67 | } | |
68 | pkey->keydata = keydata; | |
69 | evp_keymgmt_util_cache_keyinfo(pkey); | |
70 | return 1; | |
71 | } | |
72 | ||
73 | EVP_PKEY *evp_keymgmt_util_make_pkey(EVP_KEYMGMT *keymgmt, void *keydata) | |
74 | { | |
75 | EVP_PKEY *pkey = NULL; | |
76 | ||
77 | if (keymgmt == NULL | |
78 | || keydata == NULL | |
79 | || (pkey = EVP_PKEY_new()) == NULL | |
80 | || !evp_keymgmt_util_assign_pkey(pkey, keymgmt, keydata)) { | |
81 | EVP_PKEY_free(pkey); | |
82 | return NULL; | |
83 | } | |
84 | return pkey; | |
85 | } | |
86 | ||
655f73ce RL |
87 | int evp_keymgmt_util_export(const EVP_PKEY *pk, int selection, |
88 | OSSL_CALLBACK *export_cb, void *export_cbarg) | |
89 | { | |
a732a4c3 SL |
90 | if (pk == NULL || export_cb == NULL) |
91 | return 0; | |
655f73ce RL |
92 | return evp_keymgmt_export(pk->keymgmt, pk->keydata, selection, |
93 | export_cb, export_cbarg); | |
94 | } | |
95 | ||
b305452f | 96 | void *evp_keymgmt_util_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt) |
70a1f7b4 | 97 | { |
af836c22 | 98 | struct evp_keymgmt_util_try_import_data_st import_data; |
64954e2f | 99 | OP_CACHE_ELEM *op; |
70a1f7b4 | 100 | |
3f7ce7f1 RL |
101 | /* Export to where? */ |
102 | if (keymgmt == NULL) | |
103 | return NULL; | |
70a1f7b4 | 104 | |
3f7ce7f1 | 105 | /* If we have an unassigned key, give up */ |
adc9f731 | 106 | if (pk->keydata == NULL) |
3f7ce7f1 | 107 | return NULL; |
70a1f7b4 | 108 | |
1af9b646 P |
109 | /* |
110 | * If |keymgmt| matches the "origin" |keymgmt|, there is no more to do. | |
111 | * The "origin" is determined by the |keymgmt| pointers being identical | |
112 | * or when the provider and the name ID match. The latter case handles the | |
113 | * situation where the fetch cache is flushed and a "new" key manager is | |
114 | * created. | |
115 | */ | |
116 | if (pk->keymgmt == keymgmt | |
117 | || (pk->keymgmt->name_id == keymgmt->name_id | |
118 | && pk->keymgmt->prov == keymgmt->prov)) | |
3c6ed955 RL |
119 | return pk->keydata; |
120 | ||
cd3f8c1b RS |
121 | if (!CRYPTO_THREAD_read_lock(pk->lock)) |
122 | return NULL; | |
f4a3799c RL |
123 | /* |
124 | * If the provider native "origin" hasn't changed since last time, we | |
64954e2f P |
125 | * try to find our keymgmt in the operation cache. If it has changed |
126 | * and our keymgmt isn't found, we will clear the cache further down. | |
f4a3799c RL |
127 | */ |
128 | if (pk->dirty_cnt == pk->dirty_cnt_copy) { | |
129 | /* If this key is already exported to |keymgmt|, no more to do */ | |
64954e2f P |
130 | op = evp_keymgmt_util_find_operation_cache(pk, keymgmt); |
131 | if (op != NULL && op->keymgmt != NULL) { | |
132 | void *ret = op->keydata; | |
f4a3799c RL |
133 | |
134 | CRYPTO_THREAD_unlock(pk->lock); | |
135 | return ret; | |
136 | } | |
0b07db6f MC |
137 | } |
138 | CRYPTO_THREAD_unlock(pk->lock); | |
3c6ed955 RL |
139 | |
140 | /* If the "origin" |keymgmt| doesn't support exporting, give up */ | |
3c6ed955 RL |
141 | if (pk->keymgmt->export == NULL) |
142 | return NULL; | |
3f7ce7f1 | 143 | |
3f7ce7f1 RL |
144 | /* |
145 | * Make sure that the type of the keymgmt to export to matches the type | |
3c6ed955 | 146 | * of the "origin" |
3f7ce7f1 | 147 | */ |
3c6ed955 | 148 | if (!ossl_assert(match_type(pk->keymgmt, keymgmt))) |
3f7ce7f1 | 149 | return NULL; |
70a1f7b4 | 150 | |
3f7ce7f1 RL |
151 | /* |
152 | * We look at the already cached provider keys, and import from the | |
153 | * first that supports it (i.e. use its export function), and export | |
154 | * the imported data to the new provider. | |
155 | */ | |
156 | ||
157 | /* Setup for the export callback */ | |
af836c22 | 158 | import_data.keydata = NULL; /* evp_keymgmt_util_try_import will create it */ |
3f7ce7f1 RL |
159 | import_data.keymgmt = keymgmt; |
160 | import_data.selection = OSSL_KEYMGMT_SELECT_ALL; | |
161 | ||
3c6ed955 | 162 | /* |
af836c22 RL |
163 | * The export function calls the callback (evp_keymgmt_util_try_import), |
164 | * which does the import for us. If successful, we're done. | |
3c6ed955 | 165 | */ |
655f73ce | 166 | if (!evp_keymgmt_util_export(pk, OSSL_KEYMGMT_SELECT_ALL, |
e36a4dc4 | 167 | &evp_keymgmt_util_try_import, &import_data)) |
3f7ce7f1 | 168 | /* If there was an error, bail out */ |
3f7ce7f1 | 169 | return NULL; |
70a1f7b4 | 170 | |
cd3f8c1b RS |
171 | if (!CRYPTO_THREAD_write_lock(pk->lock)) { |
172 | evp_keymgmt_freedata(keymgmt, import_data.keydata); | |
173 | return NULL; | |
174 | } | |
0b07db6f | 175 | /* Check to make sure some other thread didn't get there first */ |
64954e2f P |
176 | op = evp_keymgmt_util_find_operation_cache(pk, keymgmt); |
177 | if (op != NULL && op->keydata != NULL) { | |
178 | void *ret = op->keydata; | |
0b07db6f MC |
179 | |
180 | CRYPTO_THREAD_unlock(pk->lock); | |
181 | ||
182 | /* | |
183 | * Another thread seemms to have already exported this so we abandon | |
184 | * all the work we just did. | |
185 | */ | |
186 | evp_keymgmt_freedata(keymgmt, import_data.keydata); | |
187 | ||
188 | return ret; | |
189 | } | |
190 | ||
f4a3799c RL |
191 | /* |
192 | * If the dirty counter changed since last time, then clear the | |
193 | * operation cache. In that case, we know that |i| is zero. | |
194 | */ | |
195 | if (pk->dirty_cnt != pk->dirty_cnt_copy) | |
196 | evp_keymgmt_util_clear_operation_cache(pk, 0); | |
197 | ||
3c6ed955 | 198 | /* Add the new export to the operation cache */ |
64954e2f | 199 | if (!evp_keymgmt_util_cache_keydata(pk, keymgmt, import_data.keydata)) { |
fb0f65ff | 200 | CRYPTO_THREAD_unlock(pk->lock); |
adc9f731 | 201 | evp_keymgmt_freedata(keymgmt, import_data.keydata); |
d5e66eab | 202 | return NULL; |
3c6ed955 | 203 | } |
02f060d1 | 204 | |
f4a3799c RL |
205 | /* Synchronize the dirty count */ |
206 | pk->dirty_cnt_copy = pk->dirty_cnt; | |
207 | ||
0b07db6f MC |
208 | CRYPTO_THREAD_unlock(pk->lock); |
209 | ||
adc9f731 | 210 | return import_data.keydata; |
70a1f7b4 | 211 | } |
4cae07fe | 212 | |
64954e2f | 213 | static void op_cache_free(OP_CACHE_ELEM *e) |
4cae07fe | 214 | { |
64954e2f P |
215 | evp_keymgmt_freedata(e->keymgmt, e->keydata); |
216 | EVP_KEYMGMT_free(e->keymgmt); | |
217 | OPENSSL_free(e); | |
218 | } | |
4cae07fe | 219 | |
64954e2f P |
220 | int evp_keymgmt_util_clear_operation_cache(EVP_PKEY *pk, int locking) |
221 | { | |
4cae07fe | 222 | if (pk != NULL) { |
0b07db6f MC |
223 | if (locking && pk->lock != NULL && !CRYPTO_THREAD_write_lock(pk->lock)) |
224 | return 0; | |
64954e2f P |
225 | sk_OP_CACHE_ELEM_pop_free(pk->operation_cache, op_cache_free); |
226 | pk->operation_cache = NULL; | |
0b07db6f MC |
227 | if (locking && pk->lock != NULL) |
228 | CRYPTO_THREAD_unlock(pk->lock); | |
6508e858 | 229 | } |
0b07db6f MC |
230 | |
231 | return 1; | |
6508e858 RL |
232 | } |
233 | ||
64954e2f P |
234 | OP_CACHE_ELEM *evp_keymgmt_util_find_operation_cache(EVP_PKEY *pk, |
235 | EVP_KEYMGMT *keymgmt) | |
3f7ce7f1 | 236 | { |
64954e2f P |
237 | int i, end = sk_OP_CACHE_ELEM_num(pk->operation_cache); |
238 | OP_CACHE_ELEM *p; | |
3f7ce7f1 | 239 | |
64954e2f P |
240 | /* |
241 | * A comparison and sk_P_CACHE_ELEM_find() are avoided to not cause | |
242 | * problems when we've only a read lock. | |
243 | */ | |
244 | for (i = 0; i < end; i++) { | |
245 | p = sk_OP_CACHE_ELEM_value(pk->operation_cache, i); | |
246 | if (keymgmt == p->keymgmt) | |
247 | return p; | |
3f7ce7f1 | 248 | } |
64954e2f | 249 | return NULL; |
3f7ce7f1 RL |
250 | } |
251 | ||
64954e2f | 252 | int evp_keymgmt_util_cache_keydata(EVP_PKEY *pk, |
3c6ed955 | 253 | EVP_KEYMGMT *keymgmt, void *keydata) |
6508e858 | 254 | { |
64954e2f P |
255 | OP_CACHE_ELEM *p = NULL; |
256 | ||
b305452f | 257 | if (keydata != NULL) { |
64954e2f P |
258 | if (pk->operation_cache == NULL) { |
259 | pk->operation_cache = sk_OP_CACHE_ELEM_new_null(); | |
260 | if (pk->operation_cache == NULL) | |
261 | return 0; | |
262 | } | |
263 | ||
264 | p = OPENSSL_malloc(sizeof(*p)); | |
265 | if (p == NULL) | |
3c6ed955 | 266 | return 0; |
64954e2f P |
267 | p->keydata = keydata; |
268 | p->keymgmt = keymgmt; | |
0b07db6f | 269 | |
64954e2f P |
270 | if (!EVP_KEYMGMT_up_ref(keymgmt)) { |
271 | OPENSSL_free(p); | |
272 | return 0; | |
273 | } | |
274 | ||
275 | if (!sk_OP_CACHE_ELEM_push(pk->operation_cache, p)) { | |
276 | EVP_KEYMGMT_free(keymgmt); | |
277 | OPENSSL_free(p); | |
278 | return 0; | |
279 | } | |
3c6ed955 RL |
280 | } |
281 | return 1; | |
282 | } | |
283 | ||
284 | void evp_keymgmt_util_cache_keyinfo(EVP_PKEY *pk) | |
285 | { | |
286 | /* | |
287 | * Cache information about the provider "origin" key. | |
288 | * | |
ed576acd | 289 | * This services functions like EVP_PKEY_get_size, EVP_PKEY_get_bits, etc |
3c6ed955 | 290 | */ |
adc9f731 | 291 | if (pk->keydata != NULL) { |
3c6ed955 RL |
292 | int bits = 0; |
293 | int security_bits = 0; | |
294 | int size = 0; | |
295 | OSSL_PARAM params[4]; | |
296 | ||
297 | params[0] = OSSL_PARAM_construct_int(OSSL_PKEY_PARAM_BITS, &bits); | |
298 | params[1] = OSSL_PARAM_construct_int(OSSL_PKEY_PARAM_SECURITY_BITS, | |
299 | &security_bits); | |
300 | params[2] = OSSL_PARAM_construct_int(OSSL_PKEY_PARAM_MAX_SIZE, &size); | |
301 | params[3] = OSSL_PARAM_construct_end(); | |
302 | if (evp_keymgmt_get_params(pk->keymgmt, pk->keydata, params)) { | |
303 | pk->cache.size = size; | |
304 | pk->cache.bits = bits; | |
305 | pk->cache.security_bits = security_bits; | |
6508e858 | 306 | } |
4cae07fe RL |
307 | } |
308 | } | |
fa9faf01 | 309 | |
68552cde | 310 | void *evp_keymgmt_util_fromdata(EVP_PKEY *target, EVP_KEYMGMT *keymgmt, |
b305452f | 311 | int selection, const OSSL_PARAM params[]) |
46e2dd05 | 312 | { |
8243d8d1 | 313 | void *keydata = NULL; |
46e2dd05 | 314 | |
8243d8d1 RL |
315 | if ((keydata = evp_keymgmt_newdata(keymgmt)) == NULL |
316 | || !evp_keymgmt_import(keymgmt, keydata, selection, params) | |
af836c22 | 317 | || !evp_keymgmt_util_assign_pkey(target, keymgmt, keydata)) { |
8243d8d1 RL |
318 | evp_keymgmt_freedata(keymgmt, keydata); |
319 | keydata = NULL; | |
320 | } | |
b305452f | 321 | return keydata; |
46e2dd05 | 322 | } |
157ded39 RL |
323 | |
324 | int evp_keymgmt_util_has(EVP_PKEY *pk, int selection) | |
325 | { | |
326 | /* Check if key is even assigned */ | |
327 | if (pk->keymgmt == NULL) | |
328 | return 0; | |
329 | ||
330 | return evp_keymgmt_has(pk->keymgmt, pk->keydata, selection); | |
331 | } | |
1e9101c4 RL |
332 | |
333 | /* | |
334 | * evp_keymgmt_util_match() doesn't just look at the provider side "origin", | |
335 | * but also in the operation cache to see if there's any common keymgmt that | |
336 | * supplies OP_keymgmt_match. | |
337 | * | |
c74aaa39 DDO |
338 | * evp_keymgmt_util_match() adheres to the return values that EVP_PKEY_eq() |
339 | * and EVP_PKEY_parameters_eq() return, i.e.: | |
1e9101c4 RL |
340 | * |
341 | * 1 same key | |
342 | * 0 not same key | |
343 | * -1 not same key type | |
344 | * -2 unsupported operation | |
345 | */ | |
346 | int evp_keymgmt_util_match(EVP_PKEY *pk1, EVP_PKEY *pk2, int selection) | |
347 | { | |
348 | EVP_KEYMGMT *keymgmt1 = NULL, *keymgmt2 = NULL; | |
349 | void *keydata1 = NULL, *keydata2 = NULL; | |
350 | ||
351 | if (pk1 == NULL || pk2 == NULL) { | |
352 | if (pk1 == NULL && pk2 == NULL) | |
353 | return 1; | |
354 | return 0; | |
355 | } | |
356 | ||
357 | keymgmt1 = pk1->keymgmt; | |
358 | keydata1 = pk1->keydata; | |
359 | keymgmt2 = pk2->keymgmt; | |
360 | keydata2 = pk2->keydata; | |
361 | ||
362 | if (keymgmt1 != keymgmt2) { | |
adc9f731 RL |
363 | /* |
364 | * The condition for a successful cross export is that the | |
365 | * keydata to be exported is NULL (typed, but otherwise empty | |
366 | * EVP_PKEY), or that it was possible to export it with | |
367 | * evp_keymgmt_util_export_to_provider(). | |
368 | * | |
369 | * We use |ok| to determine if it's ok to cross export one way, | |
370 | * but also to determine if we should attempt a cross export | |
371 | * the other way. There's no point doing it both ways. | |
372 | */ | |
373 | int ok = 1; | |
1e9101c4 RL |
374 | |
375 | /* Complex case, where the keymgmt differ */ | |
376 | if (keymgmt1 != NULL | |
377 | && keymgmt2 != NULL | |
378 | && !match_type(keymgmt1, keymgmt2)) { | |
379 | ERR_raise(ERR_LIB_EVP, EVP_R_DIFFERENT_KEY_TYPES); | |
380 | return -1; /* Not the same type */ | |
381 | } | |
382 | ||
383 | /* | |
384 | * The key types are determined to match, so we try cross export, | |
385 | * but only to keymgmt's that supply a matching function. | |
386 | */ | |
387 | if (keymgmt2 != NULL | |
388 | && keymgmt2->match != NULL) { | |
adc9f731 RL |
389 | void *tmp_keydata = NULL; |
390 | ||
391 | ok = 1; | |
392 | if (keydata1 != NULL) { | |
393 | tmp_keydata = | |
394 | evp_keymgmt_util_export_to_provider(pk1, keymgmt2); | |
395 | ok = (tmp_keydata != NULL); | |
396 | } | |
397 | if (ok) { | |
1e9101c4 RL |
398 | keymgmt1 = keymgmt2; |
399 | keydata1 = tmp_keydata; | |
400 | } | |
401 | } | |
adc9f731 | 402 | /* |
8243d8d1 | 403 | * If we've successfully cross exported one way, there's no point |
adc9f731 RL |
404 | * doing it the other way, hence the |!ok| check. |
405 | */ | |
406 | if (!ok | |
1e9101c4 RL |
407 | && keymgmt1 != NULL |
408 | && keymgmt1->match != NULL) { | |
adc9f731 RL |
409 | void *tmp_keydata = NULL; |
410 | ||
411 | ok = 1; | |
412 | if (keydata2 != NULL) { | |
413 | tmp_keydata = | |
414 | evp_keymgmt_util_export_to_provider(pk2, keymgmt1); | |
415 | ok = (tmp_keydata != NULL); | |
416 | } | |
417 | if (ok) { | |
1e9101c4 RL |
418 | keymgmt2 = keymgmt1; |
419 | keydata2 = tmp_keydata; | |
420 | } | |
421 | } | |
422 | } | |
423 | ||
424 | /* If we still don't have matching keymgmt implementations, we give up */ | |
425 | if (keymgmt1 != keymgmt2) | |
426 | return -2; | |
427 | ||
adc9f731 RL |
428 | /* If both keydata are NULL, then they're the same key */ |
429 | if (keydata1 == NULL && keydata2 == NULL) | |
430 | return 1; | |
431 | /* If only one of the keydata is NULL, then they're different keys */ | |
432 | if (keydata1 == NULL || keydata2 == NULL) | |
433 | return 0; | |
434 | /* If both keydata are non-NULL, we let the backend decide */ | |
1e9101c4 RL |
435 | return evp_keymgmt_match(keymgmt1, keydata1, keydata2, selection); |
436 | } | |
ff3b59e1 RL |
437 | |
438 | int evp_keymgmt_util_copy(EVP_PKEY *to, EVP_PKEY *from, int selection) | |
439 | { | |
440 | /* Save copies of pointers we want to play with without affecting |to| */ | |
441 | EVP_KEYMGMT *to_keymgmt = to->keymgmt; | |
442 | void *to_keydata = to->keydata, *alloc_keydata = NULL; | |
443 | ||
444 | /* An unassigned key can't be copied */ | |
adc9f731 | 445 | if (from == NULL || from->keydata == NULL) |
ff3b59e1 RL |
446 | return 0; |
447 | ||
036ee370 RL |
448 | /* |
449 | * If |to| is unassigned, ensure it gets the same KEYMGMT as |from|, | |
450 | * Note that the final setting of KEYMGMT is done further down, with | |
451 | * EVP_PKEY_set_type_by_keymgmt(); we don't want to do that prematurely. | |
452 | */ | |
453 | if (to_keymgmt == NULL) | |
454 | to_keymgmt = from->keymgmt; | |
455 | ||
85fcc3fb TM |
456 | if (to_keymgmt == from->keymgmt && to_keymgmt->dup != NULL |
457 | && to_keydata == NULL) { | |
b4f447c0 TM |
458 | to_keydata = alloc_keydata = evp_keymgmt_dup(to_keymgmt, |
459 | from->keydata, | |
460 | selection); | |
4a9fe33c TM |
461 | if (to_keydata == NULL) |
462 | return 0; | |
ff3b59e1 | 463 | } else if (match_type(to_keymgmt, from->keymgmt)) { |
af836c22 | 464 | struct evp_keymgmt_util_try_import_data_st import_data; |
ff3b59e1 RL |
465 | |
466 | import_data.keymgmt = to_keymgmt; | |
467 | import_data.keydata = to_keydata; | |
468 | import_data.selection = selection; | |
469 | ||
655f73ce RL |
470 | if (!evp_keymgmt_util_export(from, selection, |
471 | &evp_keymgmt_util_try_import, | |
e08993ea | 472 | &import_data)) |
ff3b59e1 | 473 | return 0; |
adc9f731 RL |
474 | |
475 | /* | |
af836c22 RL |
476 | * In case to_keydata was previously unallocated, |
477 | * evp_keymgmt_util_try_import() may have created it for us. | |
adc9f731 | 478 | */ |
036ee370 RL |
479 | if (to_keydata == NULL) |
480 | to_keydata = alloc_keydata = import_data.keydata; | |
ff3b59e1 RL |
481 | } else { |
482 | ERR_raise(ERR_LIB_EVP, EVP_R_DIFFERENT_KEY_TYPES); | |
483 | return 0; | |
484 | } | |
485 | ||
af836c22 RL |
486 | /* |
487 | * We only need to set the |to| type when its |keymgmt| isn't set. | |
488 | * We can then just set its |keydata| to what we have, which might | |
489 | * be exactly what it had when entering this function. | |
490 | * This is a bit different from using evp_keymgmt_util_assign_pkey(), | |
491 | * which isn't as careful with |to|'s original |keymgmt|, since it's | |
492 | * meant to forcibly reassign an EVP_PKEY no matter what, which is | |
493 | * why we don't use that one here. | |
494 | */ | |
ff3b59e1 | 495 | if (to->keymgmt == NULL |
8243d8d1 | 496 | && !EVP_PKEY_set_type_by_keymgmt(to, to_keymgmt)) { |
ff3b59e1 RL |
497 | evp_keymgmt_freedata(to_keymgmt, alloc_keydata); |
498 | return 0; | |
499 | } | |
ff3b59e1 RL |
500 | to->keydata = to_keydata; |
501 | evp_keymgmt_util_cache_keyinfo(to); | |
502 | ||
503 | return 1; | |
504 | } | |
62924755 RL |
505 | |
506 | void *evp_keymgmt_util_gen(EVP_PKEY *target, EVP_KEYMGMT *keymgmt, | |
507 | void *genctx, OSSL_CALLBACK *cb, void *cbarg) | |
508 | { | |
8243d8d1 | 509 | void *keydata = NULL; |
62924755 | 510 | |
8243d8d1 | 511 | if ((keydata = evp_keymgmt_gen(keymgmt, genctx, cb, cbarg)) == NULL |
af836c22 | 512 | || !evp_keymgmt_util_assign_pkey(target, keymgmt, keydata)) { |
8243d8d1 RL |
513 | evp_keymgmt_freedata(keymgmt, keydata); |
514 | keydata = NULL; | |
515 | } | |
62924755 RL |
516 | |
517 | return keydata; | |
518 | } | |
3b924da0 RL |
519 | |
520 | /* | |
521 | * Returns the same numbers as EVP_PKEY_get_default_digest_name() | |
522 | * When the string from the EVP_KEYMGMT implementation is "", we use | |
523 | * SN_undef, since that corresponds to what EVP_PKEY_get_default_nid() | |
524 | * returns for no digest. | |
525 | */ | |
526 | int evp_keymgmt_util_get_deflt_digest_name(EVP_KEYMGMT *keymgmt, | |
527 | void *keydata, | |
528 | char *mdname, size_t mdname_sz) | |
529 | { | |
530 | OSSL_PARAM params[3]; | |
531 | char mddefault[100] = ""; | |
532 | char mdmandatory[100] = ""; | |
533 | char *result = NULL; | |
534 | int rv = -2; | |
535 | ||
536 | params[0] = | |
537 | OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_DEFAULT_DIGEST, | |
538 | mddefault, sizeof(mddefault)); | |
3b924da0 RL |
539 | params[1] = |
540 | OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_MANDATORY_DIGEST, | |
541 | mdmandatory, | |
542 | sizeof(mdmandatory)); | |
3b924da0 RL |
543 | params[2] = OSSL_PARAM_construct_end(); |
544 | ||
545 | if (!evp_keymgmt_get_params(keymgmt, keydata, params)) | |
546 | return 0; | |
547 | ||
54b47afe P |
548 | if (OSSL_PARAM_modified(params + 1)) { |
549 | if (params[1].return_size <= 1) /* Only a NUL byte */ | |
3b924da0 RL |
550 | result = SN_undef; |
551 | else | |
552 | result = mdmandatory; | |
553 | rv = 2; | |
54b47afe P |
554 | } else if (OSSL_PARAM_modified(params)) { |
555 | if (params[0].return_size <= 1) /* Only a NUL byte */ | |
3b924da0 RL |
556 | result = SN_undef; |
557 | else | |
558 | result = mddefault; | |
559 | rv = 1; | |
560 | } | |
561 | if (rv > 0) | |
562 | OPENSSL_strlcpy(mdname, result, mdname_sz); | |
563 | return rv; | |
564 | } | |
5246183e RL |
565 | |
566 | /* | |
567 | * If |keymgmt| has the method function |query_operation_name|, use it to get | |
568 | * the name of a supported operation identity. Otherwise, return the keytype, | |
569 | * assuming that it works as a default operation name. | |
570 | */ | |
571 | const char *evp_keymgmt_util_query_operation_name(EVP_KEYMGMT *keymgmt, | |
572 | int op_id) | |
573 | { | |
574 | const char *name = NULL; | |
575 | ||
576 | if (keymgmt != NULL) { | |
577 | if (keymgmt->query_operation_name != NULL) | |
578 | name = keymgmt->query_operation_name(op_id); | |
579 | if (name == NULL) | |
580 | name = EVP_KEYMGMT_get0_name(keymgmt); | |
581 | } | |
582 | return name; | |
583 | } |