providers/implementations/encode_decode/decode_der2key.c

   1 /*
   2  * Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 /*
  11  * low level APIs are deprecated for public use, but still ok for
  12  * internal use.
  13  */
  14 #include "internal/deprecated.h"
  15
  16 #include <openssl/core_dispatch.h>
  17 #include <openssl/core_names.h>
  18 #include <openssl/crypto.h>
  19 #include <openssl/params.h>
  20 #include <openssl/x509.h>
  21 #include "prov/bio.h"
  22 #include "prov/implementations.h"
  23 #include "encoder_local.h"
  24
  25 static OSSL_FUNC_decoder_newctx_fn der2rsa_newctx;
  26
  27 static OSSL_FUNC_decoder_freectx_fn der2key_freectx;
  28 static OSSL_FUNC_decoder_gettable_params_fn der2key_gettable_params;
  29 static OSSL_FUNC_decoder_get_params_fn der2key_get_params;
  30 static OSSL_FUNC_decoder_decode_fn der2key_decode;
  31 static OSSL_FUNC_decoder_export_object_fn der2key_export_object;
  32
  33 typedef void *(extract_key_fn)(EVP_PKEY *);
  34 typedef void (free_key_fn)(void *);
  35 struct keytype_desc_st {
  36     int type;                 /* EVP key type */
  37     const char *name;         /* Keytype */
  38     const OSSL_DISPATCH *fns; /* Keymgmt (to pilfer functions from) */
  39
  40     /*
  41      * These must be the correct EVP_PKEY_get1_{TYPE}() and {TYPE}_free()
  42      * function for the key.
  43      */
  44     extract_key_fn *extract_key;
  45     free_key_fn *free_key;
  46 };
  47
  48 /*
  49  * Context used for DER to key decoding.
  50  */
  51 struct der2key_ctx_st {
  52     PROV_CTX *provctx;
  53     const struct keytype_desc_st *desc;
  54 };
  55
  56 static struct der2key_ctx_st *
  57 der2key_newctx(void *provctx, const struct keytype_desc_st *desc)
  58 {
  59     struct der2key_ctx_st *ctx = OPENSSL_zalloc(sizeof(*ctx));
  60
  61     if (ctx != NULL) {
  62         ctx->provctx = provctx;
  63         ctx->desc = desc;
  64     }
  65     return ctx;
  66 }
  67
  68 static void der2key_freectx(void *vctx)
  69 {
  70     struct der2key_ctx_st *ctx = vctx;
  71
  72     OPENSSL_free(ctx);
  73 }
  74
  75 static const OSSL_PARAM *der2key_gettable_params(void *provctx)
  76 {
  77     static const OSSL_PARAM gettables[] = {
  78         { OSSL_DECODER_PARAM_INPUT_TYPE, OSSL_PARAM_UTF8_PTR, NULL, 0, 0 },
  79         OSSL_PARAM_END,
  80     };
  81
  82     return gettables;
  83 }
  84
  85 static int der2key_get_params(OSSL_PARAM params[])
  86 {
  87     OSSL_PARAM *p;
  88
  89     p = OSSL_PARAM_locate(params, OSSL_DECODER_PARAM_INPUT_TYPE);
  90     if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, "DER"))
  91         return 0;
  92
  93     return 1;
  94 }
  95
  96 static int der2key_decode(void *vctx, OSSL_CORE_BIO *cin,
  97                           OSSL_CALLBACK *data_cb, void *data_cbarg,
  98                           OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg)
  99 {
 100     struct der2key_ctx_st *ctx = vctx;
 101     void *libctx = PROV_LIBRARY_CONTEXT_OF(ctx->provctx);
 102     unsigned char *der = NULL;
 103     const unsigned char *derp;
 104     long der_len = 0;
 105     unsigned char *new_der = NULL;
 106     long new_der_len;
 107     EVP_PKEY *pkey = NULL;
 108     void *key = NULL;
 109     int ok = 0;
 110
 111     if (!ossl_prov_read_der(ctx->provctx, cin, &der, &der_len))
 112         return 0;
 113
 114     /*
 115      * Opportunistic attempt to decrypt.  If it doesn't work, we try to
 116      * decode our input unencrypted.
 117      */
 118     if (ossl_prov_der_from_p8(&new_der, &new_der_len, der, der_len,
 119                               pw_cb, pw_cbarg)) {
 120         OPENSSL_free(der);
 121         der = new_der;
 122         der_len = new_der_len;
 123     }
 124
 125     derp = der;
 126     pkey = d2i_PrivateKey_ex(ctx->desc->type, NULL, &derp, der_len,
 127                              libctx, NULL);
 128     if (pkey == NULL) {
 129         derp = der;
 130         pkey = d2i_PUBKEY_ex(NULL, &derp, der_len, libctx, NULL);
 131     }
 132
 133     if (pkey == NULL) {
 134         derp = der;
 135         pkey = d2i_KeyParams(ctx->desc->type, NULL, &derp, der_len);
 136     }
 137
 138     if (pkey != NULL) {
 139         /*
 140          * Tear out the low-level key pointer from the pkey,
 141          * but only if it matches the expected key type.
 142          *
 143          * TODO(3.0): The check should be done with EVP_PKEY_is_a(), but
 144          * as long as we still have #legacy internal keys, it's safer to
 145          * use the type numbers inside the provider.
 146          */
 147         if (EVP_PKEY_id(pkey) == ctx->desc->type)
 148             key = ctx->desc->extract_key(pkey);
 149
 150         /*
 151          * ctx->desc->extract_key() is expected to have incremented |key|'s
 152          * reference count, so it should be safe to free |pkey| now.
 153          */
 154         EVP_PKEY_free(pkey);
 155     }
 156
 157     OPENSSL_free(der);
 158
 159     if (key != NULL) {
 160         OSSL_PARAM params[3];
 161
 162         params[0] =
 163             OSSL_PARAM_construct_utf8_string(OSSL_DECODER_PARAM_DATA_TYPE,
 164                                              (char *)ctx->desc->name, 0);
 165         /* The address of the key becomes the octet string */
 166         params[1] =
 167             OSSL_PARAM_construct_octet_string(OSSL_DECODER_PARAM_REFERENCE,
 168                                               &key, sizeof(key));
 169         params[2] = OSSL_PARAM_construct_end();
 170
 171         ok = data_cb(params, data_cbarg);
 172     }
 173     ctx->desc->free_key(key);
 174
 175     return ok;
 176 }
 177
 178 static int der2key_export_object(void *vctx,
 179                                  const void *reference, size_t reference_sz,
 180                                  OSSL_CALLBACK *export_cb, void *export_cbarg)
 181 {
 182     struct der2key_ctx_st *ctx = vctx;
 183     OSSL_FUNC_keymgmt_export_fn *export =
 184         ossl_prov_get_keymgmt_export(ctx->desc->fns);
 185     void *keydata;
 186
 187     if (reference_sz == sizeof(keydata) && export != NULL) {
 188         /* The contents of the reference is the address to our object */
 189         keydata = *(void **)reference;
 190
 191         return export(keydata, OSSL_KEYMGMT_SELECT_ALL,
 192                       export_cb, export_cbarg);
 193     }
 194     return 0;
 195 }
 196
 197 #define IMPLEMENT_NEWCTX(KEYTYPEstr, KEYTYPE, keytype, extract, free)   \
 198     static const struct keytype_desc_st keytype##_desc =                \
 199         { EVP_PKEY_##KEYTYPE, KEYTYPEstr, keytype##_keymgmt_functions,  \
 200           (extract_key_fn *)extract,                                    \
 201           (free_key_fn *)free };                                        \
 202     static void *der2##keytype##_newctx(void *provctx)                  \
 203     {                                                                   \
 204         return der2key_newctx(provctx, &keytype##_desc);                \
 205     }                                                                   \
 206     const OSSL_DISPATCH der_to_##keytype##_decoder_functions[] = {      \
 207         { OSSL_FUNC_DECODER_NEWCTX,                                     \
 208           (void (*)(void))der2##keytype##_newctx },                     \
 209         { OSSL_FUNC_DECODER_FREECTX,                                    \
 210           (void (*)(void))der2key_freectx },                            \
 211         { OSSL_FUNC_DECODER_GETTABLE_PARAMS,                            \
 212           (void (*)(void))der2key_gettable_params },                    \
 213         { OSSL_FUNC_DECODER_GET_PARAMS,                                 \
 214           (void (*)(void))der2key_get_params },                         \
 215         { OSSL_FUNC_DECODER_DECODE,                                     \
 216           (void (*)(void))der2key_decode },                             \
 217         { OSSL_FUNC_DECODER_EXPORT_OBJECT,                              \
 218           (void (*)(void))der2key_export_object },                      \
 219         { 0, NULL }                                                     \
 220     }
 221
 222 #ifndef OPENSSL_NO_DH
 223 IMPLEMENT_NEWCTX("DH", DH, dh, EVP_PKEY_get1_DH, DH_free);
 224 IMPLEMENT_NEWCTX("DHX", DHX, dhx, EVP_PKEY_get1_DH, DH_free);
 225 #endif
 226 #ifndef OPENSSL_NO_DSA
 227 IMPLEMENT_NEWCTX("DSA", DSA, dsa, EVP_PKEY_get1_DSA, DSA_free);
 228 #endif
 229 #ifndef OPENSSL_NO_EC
 230 IMPLEMENT_NEWCTX("EC", EC, ec, EVP_PKEY_get1_EC_KEY, EC_KEY_free);
 231 IMPLEMENT_NEWCTX("X25519", X25519, x25519,
 232                  EVP_PKEY_get1_X25519, ecx_key_free);
 233 IMPLEMENT_NEWCTX("X448", X448, x448,
 234                  EVP_PKEY_get1_X448, ecx_key_free);
 235 IMPLEMENT_NEWCTX("ED25519", ED25519, ed25519,
 236                  EVP_PKEY_get1_ED25519, ecx_key_free);
 237 IMPLEMENT_NEWCTX("ED448", ED448, ed448, EVP_PKEY_get1_ED448, ecx_key_free);
 238 #endif
 239 IMPLEMENT_NEWCTX("RSA", RSA, rsa, EVP_PKEY_get1_RSA, RSA_free);
 240 IMPLEMENT_NEWCTX("RSA-PSS", RSA_PSS, rsapss, EVP_PKEY_get1_RSA, RSA_free);