[thirdparty/systemd.git] / src / shared / openssl-util.h

/* SPDX-License-Identifier: LGPL-2.1-or-later */
#pragma once

#include "macro.h"
#include "sha256.h"

#define X509_FINGERPRINT_SIZE SHA256_DIGEST_SIZE

#if HAVE_OPENSSL
#  include <openssl/bio.h>
#  include <openssl/bn.h>
#  include <openssl/crypto.h>
#  include <openssl/err.h>
#  include <openssl/evp.h>
#  include <openssl/opensslv.h>
#  include <openssl/pkcs7.h>
#  include <openssl/ssl.h>
#  include <openssl/x509v3.h>
#  ifndef OPENSSL_VERSION_MAJOR
/* OPENSSL_VERSION_MAJOR macro was added in OpenSSL 3. Thus, if it doesn't exist,  we must be before OpenSSL 3. */
#    define OPENSSL_VERSION_MAJOR 1
#  endif
#  if OPENSSL_VERSION_MAJOR >= 3
#    include <openssl/core_names.h>
#    include <openssl/param_build.h>
#  endif

DEFINE_TRIVIAL_CLEANUP_FUNC_FULL_MACRO(void*, OPENSSL_free, NULL);
DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(X509_NAME*, X509_NAME_free, NULL);
DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(EVP_PKEY_CTX*, EVP_PKEY_CTX_free, NULL);
DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(EVP_CIPHER_CTX*, EVP_CIPHER_CTX_free, NULL);
DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(EC_POINT*, EC_POINT_free, NULL);
DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(EC_GROUP*, EC_GROUP_free, NULL);
DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(BIGNUM*, BN_free, NULL);
DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(BN_CTX*, BN_CTX_free, NULL);
DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(ECDSA_SIG*, ECDSA_SIG_free, NULL);
DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(PKCS7*, PKCS7_free, NULL);
DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(SSL*, SSL_free, NULL);
DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(BIO*, BIO_free, NULL);
DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(EVP_MD_CTX*, EVP_MD_CTX_free, NULL);
#if OPENSSL_VERSION_MAJOR >= 3
DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(OSSL_PARAM*, OSSL_PARAM_free, NULL);
DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(OSSL_PARAM_BLD*, OSSL_PARAM_BLD_free, NULL);
#else
DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(EC_KEY*, EC_KEY_free, NULL);
DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(RSA*, RSA_free, NULL);
#endif

static inline void sk_X509_free_allp(STACK_OF(X509) **sk) {
        if (!sk || !*sk)
                return;

        sk_X509_pop_free(*sk, X509_free);
}

int openssl_pkey_from_pem(const void *pem, size_t pem_size, EVP_PKEY **ret);

int openssl_hash(const EVP_MD *alg, const void *msg, size_t msg_len, uint8_t *ret_hash, size_t *ret_hash_len);

int rsa_encrypt_bytes(EVP_PKEY *pkey, const void *decrypted_key, size_t decrypted_key_size, void **ret_encrypt_key, size_t *ret_encrypt_key_size);

int rsa_pkey_to_suitable_key_size(EVP_PKEY *pkey, size_t *ret_suitable_key_size);

int rsa_pkey_new(size_t bits, EVP_PKEY **ret);

int rsa_pkey_from_n_e(const void *n, size_t n_size, const void *e, size_t e_size, EVP_PKEY **ret);

int rsa_pkey_to_n_e(const EVP_PKEY *pkey, void **ret_n, size_t *ret_n_size, void **ret_e, size_t *ret_e_size);

int ecc_pkey_from_curve_x_y(int curve_id, const void *x, size_t x_size, const void *y, size_t y_size, EVP_PKEY **ret);

int ecc_pkey_to_curve_x_y(const EVP_PKEY *pkey, int *ret_curve_id, void **ret_x, size_t *ret_x_size, void **ret_y, size_t *ret_y_size);

int ecc_pkey_new(int curve_id, EVP_PKEY **ret);

int pubkey_fingerprint(EVP_PKEY *pk, const EVP_MD *md, void **ret, size_t *ret_size);

int digest_and_sign(const EVP_MD *md, EVP_PKEY *privkey, const void *data, size_t size, void **ret, size_t *ret_size);

#else

typedef struct X509 X509;
typedef struct EVP_PKEY EVP_PKEY;

static inline void *X509_free(X509 *p) {
        assert(p == NULL);
        return NULL;
}

static inline void *EVP_PKEY_free(EVP_PKEY *p) {
        assert(p == NULL);
        return NULL;
}

#endif

DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(X509*, X509_free, NULL);
DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(EVP_PKEY*, EVP_PKEY_free, NULL);

int x509_fingerprint(X509 *cert, uint8_t buffer[static X509_FINGERPRINT_SIZE]);

#if PREFER_OPENSSL
/* The openssl definition */
typedef const EVP_MD* hash_md_t;
typedef const EVP_MD* hash_algorithm_t;
typedef int elliptic_curve_t;
typedef EVP_MD_CTX* hash_context_t;
#  define OPENSSL_OR_GCRYPT(a, b) (a)

#elif HAVE_GCRYPT

#  include <gcrypt.h>

/* The gcrypt definition */
typedef int hash_md_t;
typedef const char* hash_algorithm_t;
typedef const char* elliptic_curve_t;
typedef gcry_md_hd_t hash_context_t;
#  define OPENSSL_OR_GCRYPT(a, b) (b)
#endif

#if PREFER_OPENSSL
int string_hashsum(const char *s, size_t len, hash_algorithm_t md_algorithm, char **ret);

static inline int string_hashsum_sha224(const char *s, size_t len, char **ret) {
        return string_hashsum(s, len, EVP_sha224(), ret);
}

static inline int string_hashsum_sha256(const char *s, size_t len, char **ret) {
        return string_hashsum(s, len, EVP_sha256(), ret);
}
#endif
Commit	Line	Data
db9ecf05	1	/* SPDX-License-Identifier: LGPL-2.1-or-later */
3f637019 LP	2	#pragma once
3f637019 LP	3
f2d5df8a	4	#include "macro.h"
8939d335 DDM	5	#include "sha256.h"
	6
	7	#define X509_FINGERPRINT_SIZE SHA256_DIGEST_SIZE
f2d5df8a	8
b012a1f4	9	#if HAVE_OPENSSL
c2fa92e7	10	# include <openssl/bio.h>
57633d23	11	# include <openssl/bn.h>
900e73f8	12	# include <openssl/crypto.h>
57633d23	13	# include <openssl/err.h>
4ef65db3	14	# include <openssl/evp.h>
d9b5841d	15	# include <openssl/opensslv.h>
c2fa92e7 LP	16	# include <openssl/pkcs7.h>
	17	# include <openssl/ssl.h>
	18	# include <openssl/x509v3.h>
d9b5841d LP	19	# ifndef OPENSSL_VERSION_MAJOR
	20	/* OPENSSL_VERSION_MAJOR macro was added in OpenSSL 3. Thus, if it doesn't exist, we must be before OpenSSL 3. */
	21	# define OPENSSL_VERSION_MAJOR 1
	22	# endif
	23	# if OPENSSL_VERSION_MAJOR >= 3
	24	# include <openssl/core_names.h>
dcec950c	25	# include <openssl/param_build.h>
d9b5841d	26	# endif
3f637019	27
900e73f8	28	DEFINE_TRIVIAL_CLEANUP_FUNC_FULL_MACRO(void*, OPENSSL_free, NULL);
fd421c4a ZJS	29	DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(X509_NAME*, X509_NAME_free, NULL);
	30	DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(EVP_PKEY_CTX*, EVP_PKEY_CTX_free, NULL);
	31	DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(EVP_CIPHER_CTX*, EVP_CIPHER_CTX_free, NULL);
57633d23 ZJS	32	DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(EC_POINT*, EC_POINT_free, NULL);
	33	DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(EC_GROUP*, EC_GROUP_free, NULL);
	34	DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(BIGNUM*, BN_free, NULL);
	35	DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(BN_CTX*, BN_CTX_free, NULL);
	36	DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(ECDSA_SIG*, ECDSA_SIG_free, NULL);
c2fa92e7 LP	37	DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(PKCS7*, PKCS7_free, NULL);
	38	DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(SSL*, SSL_free, NULL);
	39	DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(BIO*, BIO_free, NULL);
18f568b8	40	DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(EVP_MD_CTX*, EVP_MD_CTX_free, NULL);
dcec950c DS	41	#if OPENSSL_VERSION_MAJOR >= 3
	42	DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(OSSL_PARAM*, OSSL_PARAM_free, NULL);
	43	DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(OSSL_PARAM_BLD*, OSSL_PARAM_BLD_free, NULL);
	44	#else
	45	DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(EC_KEY*, EC_KEY_free, NULL);
	46	DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(RSA*, RSA_free, NULL);
	47	#endif
c2fa92e7 LP	48
	49	static inline void sk_X509_free_allp(STACK_OF(X509) **sk) {
	50	if (!sk \|\| !*sk)
	51	return;
	52
	53	sk_X509_pop_free(*sk, X509_free);
	54	}
b012a1f4	55
4af788c7 DS	56	int openssl_pkey_from_pem(const void pem, size_t pem_size, EVP_PKEY *ret);
4af788c7 DS	57
fc169a6f KK	58	int openssl_hash(const EVP_MD alg, const void msg, size_t msg_len, uint8_t ret_hash, size_t ret_hash_len);
fc169a6f KK	59
f2d5df8a LP	60	int rsa_encrypt_bytes(EVP_PKEY pkey, const void decrypted_key, size_t decrypted_key_size, void *ret_encrypt_key, size_t ret_encrypt_key_size);
f2d5df8a LP	61
d041e4fc	62	int rsa_pkey_to_suitable_key_size(EVP_PKEY pkey, size_t ret_suitable_key_size);
e8ccb5c7	63
dcec950c DS	64	int rsa_pkey_new(size_t bits, EVP_PKEY **ret);
	65
	66	int rsa_pkey_from_n_e(const void n, size_t n_size, const void e, size_t e_size, EVP_PKEY **ret);
	67
	68	int rsa_pkey_to_n_e(const EVP_PKEY pkey, void ret_n, size_t ret_n_size, void *ret_e, size_t ret_e_size);
	69
900e73f8 DS	70	int ecc_pkey_from_curve_x_y(int curve_id, const void x, size_t x_size, const void y, size_t y_size, EVP_PKEY **ret);
	71
	72	int ecc_pkey_to_curve_x_y(const EVP_PKEY pkey, int ret_curve_id, void *ret_x, size_t ret_x_size, void *ret_y, size_t ret_y_size);
	73
	74	int ecc_pkey_new(int curve_id, EVP_PKEY **ret);
	75
e8ccb5c7 LP	76	int pubkey_fingerprint(EVP_PKEY pk, const EVP_MD md, void *ret, size_t ret_size);
e8ccb5c7 LP	77
ef65c0f6 LP	78	int digest_and_sign(const EVP_MD md, EVP_PKEY privkey, const void data, size_t size, void ret, size_t ret_size);
ef65c0f6 LP	79
bc958a19 DDM	80	#else
	81
	82	typedef struct X509 X509;
	83	typedef struct EVP_PKEY EVP_PKEY;
	84
	85	static inline void X509_free(X509 p) {
	86	assert(p == NULL);
	87	return NULL;
	88	}
	89
	90	static inline void EVP_PKEY_free(EVP_PKEY p) {
	91	assert(p == NULL);
	92	return NULL;
	93	}
	94
57633d23 ZJS	95	#endif
57633d23 ZJS	96
bc958a19 DDM	97	DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(X509*, X509_free, NULL);
	98	DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(EVP_PKEY*, EVP_PKEY_free, NULL);
	99
8939d335 DDM	100	int x509_fingerprint(X509 *cert, uint8_t buffer[static X509_FINGERPRINT_SIZE]);
8939d335 DDM	101
57633d23 ZJS	102	#if PREFER_OPENSSL
	103	/* The openssl definition */
	104	typedef const EVP_MD* hash_md_t;
	105	typedef const EVP_MD* hash_algorithm_t;
	106	typedef int elliptic_curve_t;
	107	typedef EVP_MD_CTX* hash_context_t;
	108	# define OPENSSL_OR_GCRYPT(a, b) (a)
	109
	110	#elif HAVE_GCRYPT
	111
	112	# include <gcrypt.h>
d041e4fc	113
57633d23 ZJS	114	/* The gcrypt definition */
	115	typedef int hash_md_t;
	116	typedef const char* hash_algorithm_t;
	117	typedef const char* elliptic_curve_t;
	118	typedef gcry_md_hd_t hash_context_t;
	119	# define OPENSSL_OR_GCRYPT(a, b) (b)
b012a1f4	120	#endif
7e8facb3 ZJS	121
	122	#if PREFER_OPENSSL
	123	int string_hashsum(const char s, size_t len, hash_algorithm_t md_algorithm, char *ret);
	124
	125	static inline int string_hashsum_sha224(const char s, size_t len, char *ret) {
	126	return string_hashsum(s, len, EVP_sha224(), ret);
	127	}
	128
	129	static inline int string_hashsum_sha256(const char s, size_t len, char *ret) {
	130	return string_hashsum(s, len, EVP_sha256(), ret);
	131	}
	132	#endif