]>
Commit | Line | Data |
---|---|---|
70a1f7b4 | 1 | /* |
a28d06f3 | 2 | * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved. |
70a1f7b4 RL |
3 | * |
4 | * Licensed under the Apache License 2.0 (the "License"). You may not use | |
5 | * this file except in compliance with the License. You can obtain a copy | |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
8 | */ | |
9 | ||
6508e858 | 10 | #include <openssl/core_names.h> |
70a1f7b4 RL |
11 | #include "internal/cryptlib.h" |
12 | #include "internal/nelem.h" | |
25f2138b DMSP |
13 | #include "crypto/evp.h" |
14 | #include "crypto/asn1.h" | |
1640d48c | 15 | #include "internal/core.h" |
70a1f7b4 | 16 | #include "internal/provider.h" |
706457b7 | 17 | #include "evp_local.h" |
70a1f7b4 | 18 | |
3f7ce7f1 RL |
19 | /* |
20 | * match_type() checks if two EVP_KEYMGMT are matching key types. This | |
21 | * function assumes that the caller has made all the necessary NULL checks. | |
22 | */ | |
23 | static int match_type(const EVP_KEYMGMT *keymgmt1, const EVP_KEYMGMT *keymgmt2) | |
24 | { | |
25 | const OSSL_PROVIDER *prov2 = EVP_KEYMGMT_provider(keymgmt2); | |
26 | const char *name2 = evp_first_name(prov2, EVP_KEYMGMT_number(keymgmt2)); | |
27 | ||
28 | return EVP_KEYMGMT_is_a(keymgmt1, name2); | |
29 | } | |
30 | ||
af836c22 | 31 | int evp_keymgmt_util_try_import(const OSSL_PARAM params[], void *arg) |
651101e1 | 32 | { |
af836c22 | 33 | struct evp_keymgmt_util_try_import_data_st *data = arg; |
70a1f7b4 | 34 | |
11391da2 MC |
35 | /* Just in time creation of keydata */ |
36 | if (data->keydata == NULL | |
37 | && (data->keydata = evp_keymgmt_newdata(data->keymgmt)) == NULL) { | |
38 | ERR_raise(ERR_LIB_EVP, ERR_R_MALLOC_FAILURE); | |
39 | return 0; | |
40 | } | |
41 | ||
adc9f731 RL |
42 | /* |
43 | * It's fine if there was no data to transfer, we just end up with an | |
44 | * empty destination key. | |
45 | */ | |
46 | if (params[0].key == NULL) | |
47 | return 1; | |
48 | ||
b305452f RL |
49 | return evp_keymgmt_import(data->keymgmt, data->keydata, data->selection, |
50 | params); | |
70a1f7b4 RL |
51 | } |
52 | ||
af836c22 RL |
53 | int evp_keymgmt_util_assign_pkey(EVP_PKEY *pkey, EVP_KEYMGMT *keymgmt, |
54 | void *keydata) | |
55 | { | |
56 | if (pkey == NULL || keymgmt == NULL || keydata == NULL | |
57 | || !EVP_PKEY_set_type_by_keymgmt(pkey, keymgmt)) { | |
58 | ERR_raise(ERR_LIB_EVP, ERR_R_INTERNAL_ERROR); | |
59 | return 0; | |
60 | } | |
61 | pkey->keydata = keydata; | |
62 | evp_keymgmt_util_cache_keyinfo(pkey); | |
63 | return 1; | |
64 | } | |
65 | ||
66 | EVP_PKEY *evp_keymgmt_util_make_pkey(EVP_KEYMGMT *keymgmt, void *keydata) | |
67 | { | |
68 | EVP_PKEY *pkey = NULL; | |
69 | ||
70 | if (keymgmt == NULL | |
71 | || keydata == NULL | |
72 | || (pkey = EVP_PKEY_new()) == NULL | |
73 | || !evp_keymgmt_util_assign_pkey(pkey, keymgmt, keydata)) { | |
74 | EVP_PKEY_free(pkey); | |
75 | return NULL; | |
76 | } | |
77 | return pkey; | |
78 | } | |
79 | ||
655f73ce RL |
80 | int evp_keymgmt_util_export(const EVP_PKEY *pk, int selection, |
81 | OSSL_CALLBACK *export_cb, void *export_cbarg) | |
82 | { | |
83 | return evp_keymgmt_export(pk->keymgmt, pk->keydata, selection, | |
84 | export_cb, export_cbarg); | |
85 | } | |
86 | ||
b305452f | 87 | void *evp_keymgmt_util_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt) |
70a1f7b4 | 88 | { |
af836c22 | 89 | struct evp_keymgmt_util_try_import_data_st import_data; |
64954e2f | 90 | OP_CACHE_ELEM *op; |
70a1f7b4 | 91 | |
3f7ce7f1 RL |
92 | /* Export to where? */ |
93 | if (keymgmt == NULL) | |
94 | return NULL; | |
70a1f7b4 | 95 | |
3f7ce7f1 | 96 | /* If we have an unassigned key, give up */ |
adc9f731 | 97 | if (pk->keydata == NULL) |
3f7ce7f1 | 98 | return NULL; |
70a1f7b4 | 99 | |
3c6ed955 RL |
100 | /* If |keymgmt| matches the "origin" |keymgmt|, no more to do */ |
101 | if (pk->keymgmt == keymgmt) | |
102 | return pk->keydata; | |
103 | ||
cd3f8c1b RS |
104 | if (!CRYPTO_THREAD_read_lock(pk->lock)) |
105 | return NULL; | |
f4a3799c RL |
106 | /* |
107 | * If the provider native "origin" hasn't changed since last time, we | |
64954e2f P |
108 | * try to find our keymgmt in the operation cache. If it has changed |
109 | * and our keymgmt isn't found, we will clear the cache further down. | |
f4a3799c RL |
110 | */ |
111 | if (pk->dirty_cnt == pk->dirty_cnt_copy) { | |
112 | /* If this key is already exported to |keymgmt|, no more to do */ | |
64954e2f P |
113 | op = evp_keymgmt_util_find_operation_cache(pk, keymgmt); |
114 | if (op != NULL && op->keymgmt != NULL) { | |
115 | void *ret = op->keydata; | |
f4a3799c RL |
116 | |
117 | CRYPTO_THREAD_unlock(pk->lock); | |
118 | return ret; | |
119 | } | |
0b07db6f MC |
120 | } |
121 | CRYPTO_THREAD_unlock(pk->lock); | |
3c6ed955 RL |
122 | |
123 | /* If the "origin" |keymgmt| doesn't support exporting, give up */ | |
70a1f7b4 | 124 | /* |
3c6ed955 RL |
125 | * TODO(3.0) consider an evp_keymgmt_export() return value that indicates |
126 | * that the method is unsupported. | |
70a1f7b4 | 127 | */ |
3c6ed955 RL |
128 | if (pk->keymgmt->export == NULL) |
129 | return NULL; | |
3f7ce7f1 | 130 | |
3f7ce7f1 RL |
131 | /* |
132 | * Make sure that the type of the keymgmt to export to matches the type | |
3c6ed955 | 133 | * of the "origin" |
3f7ce7f1 | 134 | */ |
3c6ed955 | 135 | if (!ossl_assert(match_type(pk->keymgmt, keymgmt))) |
3f7ce7f1 | 136 | return NULL; |
70a1f7b4 | 137 | |
3f7ce7f1 RL |
138 | /* |
139 | * We look at the already cached provider keys, and import from the | |
140 | * first that supports it (i.e. use its export function), and export | |
141 | * the imported data to the new provider. | |
142 | */ | |
143 | ||
144 | /* Setup for the export callback */ | |
af836c22 | 145 | import_data.keydata = NULL; /* evp_keymgmt_util_try_import will create it */ |
3f7ce7f1 RL |
146 | import_data.keymgmt = keymgmt; |
147 | import_data.selection = OSSL_KEYMGMT_SELECT_ALL; | |
148 | ||
3c6ed955 | 149 | /* |
af836c22 RL |
150 | * The export function calls the callback (evp_keymgmt_util_try_import), |
151 | * which does the import for us. If successful, we're done. | |
3c6ed955 | 152 | */ |
655f73ce RL |
153 | if (!evp_keymgmt_util_export(pk, OSSL_KEYMGMT_SELECT_ALL, |
154 | &evp_keymgmt_util_try_import, &import_data)) { | |
3f7ce7f1 | 155 | /* If there was an error, bail out */ |
adc9f731 | 156 | evp_keymgmt_freedata(keymgmt, import_data.keydata); |
3f7ce7f1 | 157 | return NULL; |
70a1f7b4 RL |
158 | } |
159 | ||
cd3f8c1b RS |
160 | if (!CRYPTO_THREAD_write_lock(pk->lock)) { |
161 | evp_keymgmt_freedata(keymgmt, import_data.keydata); | |
162 | return NULL; | |
163 | } | |
0b07db6f | 164 | /* Check to make sure some other thread didn't get there first */ |
64954e2f P |
165 | op = evp_keymgmt_util_find_operation_cache(pk, keymgmt); |
166 | if (op != NULL && op->keydata != NULL) { | |
167 | void *ret = op->keydata; | |
0b07db6f MC |
168 | |
169 | CRYPTO_THREAD_unlock(pk->lock); | |
170 | ||
171 | /* | |
172 | * Another thread seemms to have already exported this so we abandon | |
173 | * all the work we just did. | |
174 | */ | |
175 | evp_keymgmt_freedata(keymgmt, import_data.keydata); | |
176 | ||
177 | return ret; | |
178 | } | |
179 | ||
f4a3799c RL |
180 | /* |
181 | * If the dirty counter changed since last time, then clear the | |
182 | * operation cache. In that case, we know that |i| is zero. | |
183 | */ | |
184 | if (pk->dirty_cnt != pk->dirty_cnt_copy) | |
185 | evp_keymgmt_util_clear_operation_cache(pk, 0); | |
186 | ||
3c6ed955 | 187 | /* Add the new export to the operation cache */ |
64954e2f | 188 | if (!evp_keymgmt_util_cache_keydata(pk, keymgmt, import_data.keydata)) { |
adc9f731 | 189 | evp_keymgmt_freedata(keymgmt, import_data.keydata); |
d5e66eab | 190 | return NULL; |
3c6ed955 | 191 | } |
02f060d1 | 192 | |
f4a3799c RL |
193 | /* Synchronize the dirty count */ |
194 | pk->dirty_cnt_copy = pk->dirty_cnt; | |
195 | ||
0b07db6f MC |
196 | CRYPTO_THREAD_unlock(pk->lock); |
197 | ||
adc9f731 | 198 | return import_data.keydata; |
70a1f7b4 | 199 | } |
4cae07fe | 200 | |
64954e2f | 201 | static void op_cache_free(OP_CACHE_ELEM *e) |
4cae07fe | 202 | { |
64954e2f P |
203 | evp_keymgmt_freedata(e->keymgmt, e->keydata); |
204 | EVP_KEYMGMT_free(e->keymgmt); | |
205 | OPENSSL_free(e); | |
206 | } | |
4cae07fe | 207 | |
64954e2f P |
208 | int evp_keymgmt_util_clear_operation_cache(EVP_PKEY *pk, int locking) |
209 | { | |
4cae07fe | 210 | if (pk != NULL) { |
0b07db6f MC |
211 | if (locking && pk->lock != NULL && !CRYPTO_THREAD_write_lock(pk->lock)) |
212 | return 0; | |
64954e2f P |
213 | sk_OP_CACHE_ELEM_pop_free(pk->operation_cache, op_cache_free); |
214 | pk->operation_cache = NULL; | |
0b07db6f MC |
215 | if (locking && pk->lock != NULL) |
216 | CRYPTO_THREAD_unlock(pk->lock); | |
6508e858 | 217 | } |
0b07db6f MC |
218 | |
219 | return 1; | |
6508e858 RL |
220 | } |
221 | ||
64954e2f P |
222 | OP_CACHE_ELEM *evp_keymgmt_util_find_operation_cache(EVP_PKEY *pk, |
223 | EVP_KEYMGMT *keymgmt) | |
3f7ce7f1 | 224 | { |
64954e2f P |
225 | int i, end = sk_OP_CACHE_ELEM_num(pk->operation_cache); |
226 | OP_CACHE_ELEM *p; | |
3f7ce7f1 | 227 | |
64954e2f P |
228 | /* |
229 | * A comparison and sk_P_CACHE_ELEM_find() are avoided to not cause | |
230 | * problems when we've only a read lock. | |
231 | */ | |
232 | for (i = 0; i < end; i++) { | |
233 | p = sk_OP_CACHE_ELEM_value(pk->operation_cache, i); | |
234 | if (keymgmt == p->keymgmt) | |
235 | return p; | |
3f7ce7f1 | 236 | } |
64954e2f | 237 | return NULL; |
3f7ce7f1 RL |
238 | } |
239 | ||
64954e2f | 240 | int evp_keymgmt_util_cache_keydata(EVP_PKEY *pk, |
3c6ed955 | 241 | EVP_KEYMGMT *keymgmt, void *keydata) |
6508e858 | 242 | { |
64954e2f P |
243 | OP_CACHE_ELEM *p = NULL; |
244 | ||
b305452f | 245 | if (keydata != NULL) { |
64954e2f P |
246 | if (pk->operation_cache == NULL) { |
247 | pk->operation_cache = sk_OP_CACHE_ELEM_new_null(); | |
248 | if (pk->operation_cache == NULL) | |
249 | return 0; | |
250 | } | |
251 | ||
252 | p = OPENSSL_malloc(sizeof(*p)); | |
253 | if (p == NULL) | |
3c6ed955 | 254 | return 0; |
64954e2f P |
255 | p->keydata = keydata; |
256 | p->keymgmt = keymgmt; | |
0b07db6f | 257 | |
64954e2f P |
258 | if (!EVP_KEYMGMT_up_ref(keymgmt)) { |
259 | OPENSSL_free(p); | |
260 | return 0; | |
261 | } | |
262 | ||
263 | if (!sk_OP_CACHE_ELEM_push(pk->operation_cache, p)) { | |
264 | EVP_KEYMGMT_free(keymgmt); | |
265 | OPENSSL_free(p); | |
266 | return 0; | |
267 | } | |
3c6ed955 RL |
268 | } |
269 | return 1; | |
270 | } | |
271 | ||
272 | void evp_keymgmt_util_cache_keyinfo(EVP_PKEY *pk) | |
273 | { | |
274 | /* | |
275 | * Cache information about the provider "origin" key. | |
276 | * | |
277 | * This services functions like EVP_PKEY_size, EVP_PKEY_bits, etc | |
278 | */ | |
adc9f731 | 279 | if (pk->keydata != NULL) { |
3c6ed955 RL |
280 | int bits = 0; |
281 | int security_bits = 0; | |
282 | int size = 0; | |
283 | OSSL_PARAM params[4]; | |
284 | ||
285 | params[0] = OSSL_PARAM_construct_int(OSSL_PKEY_PARAM_BITS, &bits); | |
286 | params[1] = OSSL_PARAM_construct_int(OSSL_PKEY_PARAM_SECURITY_BITS, | |
287 | &security_bits); | |
288 | params[2] = OSSL_PARAM_construct_int(OSSL_PKEY_PARAM_MAX_SIZE, &size); | |
289 | params[3] = OSSL_PARAM_construct_end(); | |
290 | if (evp_keymgmt_get_params(pk->keymgmt, pk->keydata, params)) { | |
291 | pk->cache.size = size; | |
292 | pk->cache.bits = bits; | |
293 | pk->cache.security_bits = security_bits; | |
6508e858 | 294 | } |
4cae07fe RL |
295 | } |
296 | } | |
fa9faf01 | 297 | |
68552cde | 298 | void *evp_keymgmt_util_fromdata(EVP_PKEY *target, EVP_KEYMGMT *keymgmt, |
b305452f | 299 | int selection, const OSSL_PARAM params[]) |
46e2dd05 | 300 | { |
8243d8d1 | 301 | void *keydata = NULL; |
46e2dd05 | 302 | |
8243d8d1 RL |
303 | if ((keydata = evp_keymgmt_newdata(keymgmt)) == NULL |
304 | || !evp_keymgmt_import(keymgmt, keydata, selection, params) | |
af836c22 | 305 | || !evp_keymgmt_util_assign_pkey(target, keymgmt, keydata)) { |
8243d8d1 RL |
306 | evp_keymgmt_freedata(keymgmt, keydata); |
307 | keydata = NULL; | |
308 | } | |
b305452f | 309 | return keydata; |
46e2dd05 | 310 | } |
157ded39 RL |
311 | |
312 | int evp_keymgmt_util_has(EVP_PKEY *pk, int selection) | |
313 | { | |
314 | /* Check if key is even assigned */ | |
315 | if (pk->keymgmt == NULL) | |
316 | return 0; | |
317 | ||
318 | return evp_keymgmt_has(pk->keymgmt, pk->keydata, selection); | |
319 | } | |
1e9101c4 RL |
320 | |
321 | /* | |
322 | * evp_keymgmt_util_match() doesn't just look at the provider side "origin", | |
323 | * but also in the operation cache to see if there's any common keymgmt that | |
324 | * supplies OP_keymgmt_match. | |
325 | * | |
c74aaa39 DDO |
326 | * evp_keymgmt_util_match() adheres to the return values that EVP_PKEY_eq() |
327 | * and EVP_PKEY_parameters_eq() return, i.e.: | |
1e9101c4 RL |
328 | * |
329 | * 1 same key | |
330 | * 0 not same key | |
331 | * -1 not same key type | |
332 | * -2 unsupported operation | |
333 | */ | |
334 | int evp_keymgmt_util_match(EVP_PKEY *pk1, EVP_PKEY *pk2, int selection) | |
335 | { | |
336 | EVP_KEYMGMT *keymgmt1 = NULL, *keymgmt2 = NULL; | |
337 | void *keydata1 = NULL, *keydata2 = NULL; | |
338 | ||
339 | if (pk1 == NULL || pk2 == NULL) { | |
340 | if (pk1 == NULL && pk2 == NULL) | |
341 | return 1; | |
342 | return 0; | |
343 | } | |
344 | ||
345 | keymgmt1 = pk1->keymgmt; | |
346 | keydata1 = pk1->keydata; | |
347 | keymgmt2 = pk2->keymgmt; | |
348 | keydata2 = pk2->keydata; | |
349 | ||
350 | if (keymgmt1 != keymgmt2) { | |
adc9f731 RL |
351 | /* |
352 | * The condition for a successful cross export is that the | |
353 | * keydata to be exported is NULL (typed, but otherwise empty | |
354 | * EVP_PKEY), or that it was possible to export it with | |
355 | * evp_keymgmt_util_export_to_provider(). | |
356 | * | |
357 | * We use |ok| to determine if it's ok to cross export one way, | |
358 | * but also to determine if we should attempt a cross export | |
359 | * the other way. There's no point doing it both ways. | |
360 | */ | |
361 | int ok = 1; | |
1e9101c4 RL |
362 | |
363 | /* Complex case, where the keymgmt differ */ | |
364 | if (keymgmt1 != NULL | |
365 | && keymgmt2 != NULL | |
366 | && !match_type(keymgmt1, keymgmt2)) { | |
367 | ERR_raise(ERR_LIB_EVP, EVP_R_DIFFERENT_KEY_TYPES); | |
368 | return -1; /* Not the same type */ | |
369 | } | |
370 | ||
371 | /* | |
372 | * The key types are determined to match, so we try cross export, | |
373 | * but only to keymgmt's that supply a matching function. | |
374 | */ | |
375 | if (keymgmt2 != NULL | |
376 | && keymgmt2->match != NULL) { | |
adc9f731 RL |
377 | void *tmp_keydata = NULL; |
378 | ||
379 | ok = 1; | |
380 | if (keydata1 != NULL) { | |
381 | tmp_keydata = | |
382 | evp_keymgmt_util_export_to_provider(pk1, keymgmt2); | |
383 | ok = (tmp_keydata != NULL); | |
384 | } | |
385 | if (ok) { | |
1e9101c4 RL |
386 | keymgmt1 = keymgmt2; |
387 | keydata1 = tmp_keydata; | |
388 | } | |
389 | } | |
adc9f731 | 390 | /* |
8243d8d1 | 391 | * If we've successfully cross exported one way, there's no point |
adc9f731 RL |
392 | * doing it the other way, hence the |!ok| check. |
393 | */ | |
394 | if (!ok | |
1e9101c4 RL |
395 | && keymgmt1 != NULL |
396 | && keymgmt1->match != NULL) { | |
adc9f731 RL |
397 | void *tmp_keydata = NULL; |
398 | ||
399 | ok = 1; | |
400 | if (keydata2 != NULL) { | |
401 | tmp_keydata = | |
402 | evp_keymgmt_util_export_to_provider(pk2, keymgmt1); | |
403 | ok = (tmp_keydata != NULL); | |
404 | } | |
405 | if (ok) { | |
1e9101c4 RL |
406 | keymgmt2 = keymgmt1; |
407 | keydata2 = tmp_keydata; | |
408 | } | |
409 | } | |
410 | } | |
411 | ||
412 | /* If we still don't have matching keymgmt implementations, we give up */ | |
413 | if (keymgmt1 != keymgmt2) | |
414 | return -2; | |
415 | ||
adc9f731 RL |
416 | /* If both keydata are NULL, then they're the same key */ |
417 | if (keydata1 == NULL && keydata2 == NULL) | |
418 | return 1; | |
419 | /* If only one of the keydata is NULL, then they're different keys */ | |
420 | if (keydata1 == NULL || keydata2 == NULL) | |
421 | return 0; | |
422 | /* If both keydata are non-NULL, we let the backend decide */ | |
1e9101c4 RL |
423 | return evp_keymgmt_match(keymgmt1, keydata1, keydata2, selection); |
424 | } | |
ff3b59e1 RL |
425 | |
426 | int evp_keymgmt_util_copy(EVP_PKEY *to, EVP_PKEY *from, int selection) | |
427 | { | |
428 | /* Save copies of pointers we want to play with without affecting |to| */ | |
429 | EVP_KEYMGMT *to_keymgmt = to->keymgmt; | |
430 | void *to_keydata = to->keydata, *alloc_keydata = NULL; | |
431 | ||
432 | /* An unassigned key can't be copied */ | |
adc9f731 | 433 | if (from == NULL || from->keydata == NULL) |
ff3b59e1 RL |
434 | return 0; |
435 | ||
036ee370 RL |
436 | /* |
437 | * If |to| is unassigned, ensure it gets the same KEYMGMT as |from|, | |
438 | * Note that the final setting of KEYMGMT is done further down, with | |
439 | * EVP_PKEY_set_type_by_keymgmt(); we don't want to do that prematurely. | |
440 | */ | |
441 | if (to_keymgmt == NULL) | |
442 | to_keymgmt = from->keymgmt; | |
443 | ||
adc9f731 RL |
444 | if (to_keymgmt == from->keymgmt && to_keymgmt->copy != NULL) { |
445 | /* Make sure there's somewhere to copy to */ | |
446 | if (to_keydata == NULL | |
036ee370 RL |
447 | && ((to_keydata = alloc_keydata = evp_keymgmt_newdata(to_keymgmt)) |
448 | == NULL)) { | |
adc9f731 | 449 | ERR_raise(ERR_LIB_EVP, ERR_R_MALLOC_FAILURE); |
ff3b59e1 | 450 | return 0; |
adc9f731 | 451 | } |
ff3b59e1 | 452 | |
adc9f731 RL |
453 | /* |
454 | * |to| and |from| have the same keymgmt, and the copy function is | |
455 | * implemented, so just copy and be done | |
456 | */ | |
ff3b59e1 RL |
457 | if (!evp_keymgmt_copy(to_keymgmt, to_keydata, from->keydata, |
458 | selection)) | |
459 | return 0; | |
460 | } else if (match_type(to_keymgmt, from->keymgmt)) { | |
af836c22 | 461 | struct evp_keymgmt_util_try_import_data_st import_data; |
ff3b59e1 RL |
462 | |
463 | import_data.keymgmt = to_keymgmt; | |
464 | import_data.keydata = to_keydata; | |
465 | import_data.selection = selection; | |
466 | ||
655f73ce RL |
467 | if (!evp_keymgmt_util_export(from, selection, |
468 | &evp_keymgmt_util_try_import, | |
469 | &import_data)) { | |
ff3b59e1 RL |
470 | evp_keymgmt_freedata(to_keymgmt, alloc_keydata); |
471 | return 0; | |
472 | } | |
adc9f731 RL |
473 | |
474 | /* | |
af836c22 RL |
475 | * In case to_keydata was previously unallocated, |
476 | * evp_keymgmt_util_try_import() may have created it for us. | |
adc9f731 | 477 | */ |
036ee370 RL |
478 | if (to_keydata == NULL) |
479 | to_keydata = alloc_keydata = import_data.keydata; | |
ff3b59e1 RL |
480 | } else { |
481 | ERR_raise(ERR_LIB_EVP, EVP_R_DIFFERENT_KEY_TYPES); | |
482 | return 0; | |
483 | } | |
484 | ||
af836c22 RL |
485 | /* |
486 | * We only need to set the |to| type when its |keymgmt| isn't set. | |
487 | * We can then just set its |keydata| to what we have, which might | |
488 | * be exactly what it had when entering this function. | |
489 | * This is a bit different from using evp_keymgmt_util_assign_pkey(), | |
490 | * which isn't as careful with |to|'s original |keymgmt|, since it's | |
491 | * meant to forcibly reassign an EVP_PKEY no matter what, which is | |
492 | * why we don't use that one here. | |
493 | */ | |
ff3b59e1 | 494 | if (to->keymgmt == NULL |
8243d8d1 | 495 | && !EVP_PKEY_set_type_by_keymgmt(to, to_keymgmt)) { |
ff3b59e1 RL |
496 | evp_keymgmt_freedata(to_keymgmt, alloc_keydata); |
497 | return 0; | |
498 | } | |
ff3b59e1 RL |
499 | to->keydata = to_keydata; |
500 | evp_keymgmt_util_cache_keyinfo(to); | |
501 | ||
502 | return 1; | |
503 | } | |
62924755 RL |
504 | |
505 | void *evp_keymgmt_util_gen(EVP_PKEY *target, EVP_KEYMGMT *keymgmt, | |
506 | void *genctx, OSSL_CALLBACK *cb, void *cbarg) | |
507 | { | |
8243d8d1 | 508 | void *keydata = NULL; |
62924755 | 509 | |
8243d8d1 | 510 | if ((keydata = evp_keymgmt_gen(keymgmt, genctx, cb, cbarg)) == NULL |
af836c22 | 511 | || !evp_keymgmt_util_assign_pkey(target, keymgmt, keydata)) { |
8243d8d1 RL |
512 | evp_keymgmt_freedata(keymgmt, keydata); |
513 | keydata = NULL; | |
514 | } | |
62924755 RL |
515 | |
516 | return keydata; | |
517 | } | |
3b924da0 RL |
518 | |
519 | /* | |
520 | * Returns the same numbers as EVP_PKEY_get_default_digest_name() | |
521 | * When the string from the EVP_KEYMGMT implementation is "", we use | |
522 | * SN_undef, since that corresponds to what EVP_PKEY_get_default_nid() | |
523 | * returns for no digest. | |
524 | */ | |
525 | int evp_keymgmt_util_get_deflt_digest_name(EVP_KEYMGMT *keymgmt, | |
526 | void *keydata, | |
527 | char *mdname, size_t mdname_sz) | |
528 | { | |
529 | OSSL_PARAM params[3]; | |
530 | char mddefault[100] = ""; | |
531 | char mdmandatory[100] = ""; | |
532 | char *result = NULL; | |
533 | int rv = -2; | |
534 | ||
535 | params[0] = | |
536 | OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_DEFAULT_DIGEST, | |
537 | mddefault, sizeof(mddefault)); | |
3b924da0 RL |
538 | params[1] = |
539 | OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_MANDATORY_DIGEST, | |
540 | mdmandatory, | |
541 | sizeof(mdmandatory)); | |
3b924da0 RL |
542 | params[2] = OSSL_PARAM_construct_end(); |
543 | ||
544 | if (!evp_keymgmt_get_params(keymgmt, keydata, params)) | |
545 | return 0; | |
546 | ||
54b47afe P |
547 | if (OSSL_PARAM_modified(params + 1)) { |
548 | if (params[1].return_size <= 1) /* Only a NUL byte */ | |
3b924da0 RL |
549 | result = SN_undef; |
550 | else | |
551 | result = mdmandatory; | |
552 | rv = 2; | |
54b47afe P |
553 | } else if (OSSL_PARAM_modified(params)) { |
554 | if (params[0].return_size <= 1) /* Only a NUL byte */ | |
3b924da0 RL |
555 | result = SN_undef; |
556 | else | |
557 | result = mddefault; | |
558 | rv = 1; | |
559 | } | |
560 | if (rv > 0) | |
561 | OPENSSL_strlcpy(mdname, result, mdname_sz); | |
562 | return rv; | |
563 | } |