1 /*
2 * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 /* We need to use some engine deprecated APIs */
11 #define OPENSSL_SUPPRESS_DEPRECATED
12
13 #include <stdio.h>
14 #include <limits.h>
15 #include <assert.h>
16 #include <openssl/evp.h>
17 #include <openssl/err.h>
18 #include <openssl/rand.h>
19 #ifndef FIPS_MODULE
20 # include <openssl/engine.h>
21 #endif
22 #include <openssl/params.h>
23 #include <openssl/core_names.h>
24 #include "internal/cryptlib.h"
25 #include "internal/provider.h"
26 #include "internal/core.h"
27 #include "internal/safe_math.h"
28 #include "crypto/evp.h"
29 #include "evp_local.h"
30
OSSL_SAFE_MATH_SIGNED(int,int)31 OSSL_SAFE_MATH_SIGNED(int, int)
32
33 int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *ctx)
34 {
35 if (ctx == NULL)
36 return 1;
37
38 if (ctx->cipher == NULL || ctx->cipher->prov == NULL)
39 goto legacy;
40
41 if (ctx->algctx != NULL) {
42 if (ctx->cipher->freectx != NULL)
43 ctx->cipher->freectx(ctx->algctx);
44 ctx->algctx = NULL;
45 }
46 if (ctx->fetched_cipher != NULL)
47 EVP_CIPHER_free(ctx->fetched_cipher);
48 memset(ctx, 0, sizeof(*ctx));
49 ctx->iv_len = -1;
50
51 return 1;
52
53 /* Remove legacy code below when legacy support is removed. */
54 legacy:
55
56 if (ctx->cipher != NULL) {
57 if (ctx->cipher->cleanup && !ctx->cipher->cleanup(ctx))
58 return 0;
59 /* Cleanse cipher context data */
60 if (ctx->cipher_data && ctx->cipher->ctx_size)
61 OPENSSL_cleanse(ctx->cipher_data, ctx->cipher->ctx_size);
62 }
63 OPENSSL_free(ctx->cipher_data);
64 #if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
65 ENGINE_finish(ctx->engine);
66 #endif
67 memset(ctx, 0, sizeof(*ctx));
68 ctx->iv_len = -1;
69 return 1;
70 }
71
EVP_CIPHER_CTX_new(void)72 EVP_CIPHER_CTX *EVP_CIPHER_CTX_new(void)
73 {
74 EVP_CIPHER_CTX *ctx;
75
76 ctx = OPENSSL_zalloc(sizeof(EVP_CIPHER_CTX));
77 if (ctx == NULL)
78 return NULL;
79
80 ctx->iv_len = -1;
81 return ctx;
82 }
83
EVP_CIPHER_CTX_free(EVP_CIPHER_CTX * ctx)84 void EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *ctx)
85 {
86 if (ctx == NULL)
87 return;
88 EVP_CIPHER_CTX_reset(ctx);
89 OPENSSL_free(ctx);
90 }
91
evp_cipher_init_internal(EVP_CIPHER_CTX * ctx,const EVP_CIPHER * cipher,ENGINE * impl,const unsigned char * key,const unsigned char * iv,int enc,uint8_t is_pipeline,const OSSL_PARAM params[])92 static int evp_cipher_init_internal(EVP_CIPHER_CTX *ctx,
93 const EVP_CIPHER *cipher,
94 ENGINE *impl, const unsigned char *key,
95 const unsigned char *iv, int enc,
96 uint8_t is_pipeline,
97 const OSSL_PARAM params[])
98 {
99 int n;
100 #if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
101 ENGINE *tmpimpl = NULL;
102 #endif
103
104 /*
105 * enc == 1 means we are encrypting.
106 * enc == 0 means we are decrypting.
107 * enc == -1 means, use the previously initialised value for encrypt/decrypt
108 */
109 if (enc == -1) {
110 enc = ctx->encrypt;
111 } else {
112 if (enc)
113 enc = 1;
114 ctx->encrypt = enc;
115 }
116
117 if (cipher == NULL && ctx->cipher == NULL) {
118 ERR_raise(ERR_LIB_EVP, EVP_R_NO_CIPHER_SET);
119 return 0;
120 }
121
122 /* Code below to be removed when legacy support is dropped. */
123 if (is_pipeline)
124 goto nonlegacy;
125
126 #if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
127 /*
128 * Whether it's nice or not, "Inits" can be used on "Final"'d contexts so
129 * this context may already have an ENGINE! Try to avoid releasing the
130 * previous handle, re-querying for an ENGINE, and having a
131 * reinitialisation, when it may all be unnecessary.
132 */
133 if (ctx->engine && ctx->cipher
134 && (cipher == NULL || cipher->nid == ctx->cipher->nid))
135 goto skip_to_init;
136
137 if (cipher != NULL && impl == NULL) {
138 /* Ask if an ENGINE is reserved for this job */
139 tmpimpl = ENGINE_get_cipher_engine(cipher->nid);
140 }
141 #endif
142
143 /*
144 * If there are engines involved then we should use legacy handling for now.
145 */
146 if (ctx->engine != NULL
147 #if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
148 || tmpimpl != NULL
149 #endif
150 || impl != NULL
151 || (cipher != NULL && cipher->origin == EVP_ORIG_METH)
152 || (cipher == NULL && ctx->cipher != NULL
153 && ctx->cipher->origin == EVP_ORIG_METH)) {
154 if (ctx->cipher == ctx->fetched_cipher)
155 ctx->cipher = NULL;
156 EVP_CIPHER_free(ctx->fetched_cipher);
157 ctx->fetched_cipher = NULL;
158 goto legacy;
159 }
160 /*
161 * Ensure a context left lying around from last time is cleared
162 * (legacy code)
163 */
164 if (cipher != NULL && ctx->cipher != NULL) {
165 if (ctx->cipher->cleanup != NULL && !ctx->cipher->cleanup(ctx))
166 return 0;
167 OPENSSL_clear_free(ctx->cipher_data, ctx->cipher->ctx_size);
168 ctx->cipher_data = NULL;
169 }
170
171 /* Start of non-legacy code below */
172 nonlegacy:
173 /* Ensure a context left lying around from last time is cleared */
174 if (cipher != NULL && ctx->cipher != NULL) {
175 unsigned long flags = ctx->flags;
176
177 EVP_CIPHER_CTX_reset(ctx);
178 /* Restore encrypt and flags */
179 ctx->encrypt = enc;
180 ctx->flags = flags;
181 }
182
183 if (cipher == NULL)
184 cipher = ctx->cipher;
185
186 if (cipher->prov == NULL) {
187 #ifdef FIPS_MODULE
188 /* We only do explicit fetches inside the FIPS module */
189 ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
190 return 0;
191 #else
192 EVP_CIPHER *provciph =
193 EVP_CIPHER_fetch(NULL,
194 cipher->nid == NID_undef ? "NULL"
195 : OBJ_nid2sn(cipher->nid),
196 "");
197
198 if (provciph == NULL)
199 return 0;
200 cipher = provciph;
201 EVP_CIPHER_free(ctx->fetched_cipher);
202 ctx->fetched_cipher = provciph;
203 #endif
204 }
205
206 if (!ossl_assert(cipher->prov != NULL)) {
207 ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
208 return 0;
209 }
210
211 if (cipher != ctx->fetched_cipher) {
212 if (!EVP_CIPHER_up_ref((EVP_CIPHER *)cipher)) {
213 ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
214 return 0;
215 }
216 EVP_CIPHER_free(ctx->fetched_cipher);
217 /* Coverity false positive, the reference counting is confusing it */
218 /* coverity[use_after_free] */
219 ctx->fetched_cipher = (EVP_CIPHER *)cipher;
220 }
221 ctx->cipher = cipher;
222
223 if (is_pipeline && !EVP_CIPHER_can_pipeline(cipher, enc)) {
224 ERR_raise(ERR_LIB_EVP, EVP_R_PIPELINE_NOT_SUPPORTED);
225 return 0;
226 }
227
228 if (ctx->algctx == NULL) {
229 ctx->algctx = ctx->cipher->newctx(ossl_provider_ctx(cipher->prov));
230 if (ctx->algctx == NULL) {
231 ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
232 return 0;
233 }
234 }
235
236 if ((ctx->flags & EVP_CIPH_NO_PADDING) != 0) {
237 /*
238 * If this ctx was already set up for no padding then we need to tell
239 * the new cipher about it.
240 */
241 if (!EVP_CIPHER_CTX_set_padding(ctx, 0))
242 return 0;
243 }
244
245 #ifndef FIPS_MODULE
246 /*
247 * Fix for CVE-2023-5363
248 * Passing in a size as part of the init call takes effect late
249 * so, force such to occur before the initialisation.
250 *
251 * The FIPS provider's internal library context is used in a manner
252 * such that this is not an issue.
253 */
254 if (params != NULL) {
255 OSSL_PARAM param_lens[3] = { OSSL_PARAM_END, OSSL_PARAM_END,
256 OSSL_PARAM_END };
257 OSSL_PARAM *q = param_lens;
258 const OSSL_PARAM *p;
259
260 p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_KEYLEN);
261 if (p != NULL)
262 memcpy(q++, p, sizeof(*q));
263
264 /*
265 * Note that OSSL_CIPHER_PARAM_AEAD_IVLEN is a synonym for
266 * OSSL_CIPHER_PARAM_IVLEN so both are covered here.
267 */
268 p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_IVLEN);
269 if (p != NULL)
270 memcpy(q++, p, sizeof(*q));
271
272 if (q != param_lens) {
273 if (!EVP_CIPHER_CTX_set_params(ctx, param_lens)) {
274 ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_LENGTH);
275 return 0;
276 }
277 }
278 }
279 #endif
280
281 if (is_pipeline)
282 return 1;
283
284 if (enc) {
285 if (ctx->cipher->einit == NULL) {
286 /*
287 * We still should be able to set the IV using the new API
288 * if the key is not specified and old API is not available
289 */
290 if (key == NULL && ctx->cipher->einit_skey != NULL) {
291 return ctx->cipher->einit_skey(ctx->algctx, NULL,
292 iv,
293 iv == NULL ? 0
294 : EVP_CIPHER_CTX_get_iv_length(ctx),
295 params);
296 }
297 ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
298 return 0;
299 }
300
301 return ctx->cipher->einit(ctx->algctx,
302 key,
303 key == NULL ? 0
304 : EVP_CIPHER_CTX_get_key_length(ctx),
305 iv,
306 iv == NULL ? 0
307 : EVP_CIPHER_CTX_get_iv_length(ctx),
308 params);
309 }
310
311 if (ctx->cipher->dinit == NULL) {
312 /*
313 * We still should be able to set the IV using the new API
314 * if the key is not specified and old API is not available
315 */
316 if (key == NULL && ctx->cipher->dinit_skey != NULL) {
317 return ctx->cipher->dinit_skey(ctx->algctx, NULL,
318 iv,
319 iv == NULL ? 0
320 : EVP_CIPHER_CTX_get_iv_length(ctx),
321 params);
322 }
323 ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
324 return 0;
325 }
326
327 return ctx->cipher->dinit(ctx->algctx,
328 key,
329 key == NULL ? 0
330 : EVP_CIPHER_CTX_get_key_length(ctx),
331 iv,
332 iv == NULL ? 0
333 : EVP_CIPHER_CTX_get_iv_length(ctx),
334 params);
335
336 /* Code below to be removed when legacy support is dropped. */
337 legacy:
338
339 if (cipher != NULL) {
340 /*
341 * Ensure a context left lying around from last time is cleared (we
342 * previously attempted to avoid this if the same ENGINE and
343 * EVP_CIPHER could be used).
344 */
345 if (ctx->cipher) {
346 unsigned long flags = ctx->flags;
347 EVP_CIPHER_CTX_reset(ctx);
348 /* Restore encrypt and flags */
349 ctx->encrypt = enc;
350 ctx->flags = flags;
351 }
352 #if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
353 if (impl != NULL) {
354 if (!ENGINE_init(impl)) {
355 ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
356 return 0;
357 }
358 } else {
359 impl = tmpimpl;
360 }
361 if (impl != NULL) {
362 /* There's an ENGINE for this job ... (apparently) */
363 const EVP_CIPHER *c = ENGINE_get_cipher(impl, cipher->nid);
364
365 if (c == NULL) {
366 /*
367 * One positive side-effect of US's export control history,
368 * is that we should at least be able to avoid using US
369 * misspellings of "initialisation"?
370 */
371 ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
372 return 0;
373 }
374 /* We'll use the ENGINE's private cipher definition */
375 cipher = c;
376 /*
377 * Store the ENGINE functional reference so we know 'cipher' came
378 * from an ENGINE and we need to release it when done.
379 */
380 ctx->engine = impl;
381 } else {
382 ctx->engine = NULL;
383 }
384 #endif
385
386 ctx->cipher = cipher;
387 if (ctx->cipher->ctx_size) {
388 ctx->cipher_data = OPENSSL_zalloc(ctx->cipher->ctx_size);
389 if (ctx->cipher_data == NULL) {
390 ctx->cipher = NULL;
391 return 0;
392 }
393 } else {
394 ctx->cipher_data = NULL;
395 }
396 ctx->key_len = cipher->key_len;
397 /* Preserve wrap enable flag, zero everything else */
398 ctx->flags &= EVP_CIPHER_CTX_FLAG_WRAP_ALLOW;
399 if (ctx->cipher->flags & EVP_CIPH_CTRL_INIT) {
400 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_INIT, 0, NULL) <= 0) {
401 ctx->cipher = NULL;
402 ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
403 return 0;
404 }
405 }
406 }
407 #if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
408 skip_to_init:
409 #endif
410 if (ctx->cipher == NULL)
411 return 0;
412
413 /* we assume block size is a power of 2 in *cryptUpdate */
414 OPENSSL_assert(ctx->cipher->block_size == 1
415 || ctx->cipher->block_size == 8
416 || ctx->cipher->block_size == 16);
417
418 if (!(ctx->flags & EVP_CIPHER_CTX_FLAG_WRAP_ALLOW)
419 && EVP_CIPHER_CTX_get_mode(ctx) == EVP_CIPH_WRAP_MODE) {
420 ERR_raise(ERR_LIB_EVP, EVP_R_WRAP_MODE_NOT_ALLOWED);
421 return 0;
422 }
423
424 if ((EVP_CIPHER_get_flags(EVP_CIPHER_CTX_get0_cipher(ctx))
425 & EVP_CIPH_CUSTOM_IV) == 0) {
426 switch (EVP_CIPHER_CTX_get_mode(ctx)) {
427
428 case EVP_CIPH_STREAM_CIPHER:
429 case EVP_CIPH_ECB_MODE:
430 break;
431
432 case EVP_CIPH_CFB_MODE:
433 case EVP_CIPH_OFB_MODE:
434
435 ctx->num = 0;
436 /* fall-through */
437
438 case EVP_CIPH_CBC_MODE:
439 n = EVP_CIPHER_CTX_get_iv_length(ctx);
440 if (n < 0 || n > (int)sizeof(ctx->iv)) {
441 ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_IV_LENGTH);
442 return 0;
443 }
444 if (iv != NULL)
445 memcpy(ctx->oiv, iv, n);
446 memcpy(ctx->iv, ctx->oiv, n);
447 break;
448
449 case EVP_CIPH_CTR_MODE:
450 ctx->num = 0;
451 /* Don't reuse IV for CTR mode */
452 if (iv != NULL) {
453 n = EVP_CIPHER_CTX_get_iv_length(ctx);
454 if (n <= 0 || n > (int)sizeof(ctx->iv)) {
455 ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_IV_LENGTH);
456 return 0;
457 }
458 memcpy(ctx->iv, iv, n);
459 }
460 break;
461
462 default:
463 return 0;
464 }
465 }
466
467 if (key != NULL || (ctx->cipher->flags & EVP_CIPH_ALWAYS_CALL_INIT)) {
468 if (!ctx->cipher->init(ctx, key, iv, enc))
469 return 0;
470 }
471 ctx->buf_len = 0;
472 ctx->final_used = 0;
473 ctx->block_mask = ctx->cipher->block_size - 1;
474 return 1;
475 }
476
477 /*
478 * This function is basically evp_cipher_init_internal without ENGINE support.
479 * They should be combined when engines are not supported any longer.
480 */
evp_cipher_init_skey_internal(EVP_CIPHER_CTX * ctx,const EVP_CIPHER * cipher,const EVP_SKEY * skey,const unsigned char * iv,size_t iv_len,int enc,const OSSL_PARAM params[])481 static int evp_cipher_init_skey_internal(EVP_CIPHER_CTX *ctx,
482 const EVP_CIPHER *cipher,
483 const EVP_SKEY *skey,
484 const unsigned char *iv, size_t iv_len,
485 int enc, const OSSL_PARAM params[])
486 {
487 int ret;
488
489 /*
490 * enc == 1 means we are encrypting.
491 * enc == 0 means we are decrypting.
492 * enc == -1 means, use the previously initialised value for encrypt/decrypt
493 */
494 if (enc == -1)
495 enc = ctx->encrypt;
496 else
497 ctx->encrypt = enc != 0;
498
499 if (cipher == NULL && ctx->cipher == NULL) {
500 ERR_raise(ERR_LIB_EVP, EVP_R_NO_CIPHER_SET);
501 return 0;
502 }
503
504 /*
505 * If there are engines involved then we throw an error
506 */
507 if (ctx->engine != NULL
508 || (cipher != NULL && cipher->origin == EVP_ORIG_METH)
509 || (cipher == NULL && ctx->cipher != NULL
510 && ctx->cipher->origin == EVP_ORIG_METH)) {
511 ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
512 return 0;
513 }
514 /*
515 * Ensure a context left lying around from last time is cleared
516 * (legacy code)
517 */
518 if (cipher != NULL && ctx->cipher != NULL) {
519 if (ctx->cipher->cleanup != NULL && !ctx->cipher->cleanup(ctx))
520 return 0;
521 OPENSSL_clear_free(ctx->cipher_data, ctx->cipher->ctx_size);
522 ctx->cipher_data = NULL;
523 }
524
525 /* Ensure a context left lying around from last time is cleared */
526 if (cipher != NULL && ctx->cipher != NULL) {
527 unsigned long flags = ctx->flags;
528
529 EVP_CIPHER_CTX_reset(ctx);
530 /* Restore encrypt and flags */
531 ctx->encrypt = enc;
532 ctx->flags = flags;
533 }
534
535 if (cipher == NULL)
536 cipher = ctx->cipher;
537
538 if (cipher->prov == NULL) {
539 ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
540 return 0;
541 }
542
543 if (cipher != ctx->fetched_cipher) {
544 if (!EVP_CIPHER_up_ref((EVP_CIPHER *)cipher)) {
545 ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
546 return 0;
547 }
548 EVP_CIPHER_free(ctx->fetched_cipher);
549 /* Coverity false positive, the reference counting is confusing it */
550 /* coverity[use_after_free] */
551 ctx->fetched_cipher = (EVP_CIPHER *)cipher;
552 }
553 ctx->cipher = cipher;
554 if (ctx->algctx == NULL) {
555 ctx->algctx = ctx->cipher->newctx(ossl_provider_ctx(cipher->prov));
556 if (ctx->algctx == NULL) {
557 ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
558 return 0;
559 }
560 }
561
562 if (skey != NULL && ctx->cipher->prov != skey->skeymgmt->prov) {
563 ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
564 return 0;
565 }
566
567 if ((ctx->flags & EVP_CIPH_NO_PADDING) != 0) {
568 /*
569 * If this ctx was already set up for no padding then we need to tell
570 * the new cipher about it.
571 */
572 if (!EVP_CIPHER_CTX_set_padding(ctx, 0))
573 return 0;
574 }
575
576 if (iv == NULL)
577 iv_len = 0;
578
579 /* We have a data managed via key management, using the new callbacks */
580 if (enc) {
581 if (ctx->cipher->einit_skey == NULL) {
582 /*
583 * When skey is NULL, it's a multiple-step init as the current API does.
584 * Otherwise we try to fallback for providers that do not support SKEYs.
585 */
586 const unsigned char *keydata = NULL;
587 size_t keylen = 0;
588
589 if (skey != NULL && !EVP_SKEY_get0_raw_key(skey, &keydata, &keylen)) {
590 ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
591 return 0;
592 }
593
594 ret = ctx->cipher->einit(ctx->algctx, keydata, keylen,
595 iv, iv_len, params);
596 } else {
597 ret = ctx->cipher->einit_skey(ctx->algctx,
598 skey == NULL ? NULL : skey->keydata,
599 iv, iv_len, params);
600 }
601 } else {
602 if (ctx->cipher->dinit_skey == NULL) {
603 /*
604 * When skey is NULL, it's a multiple-step init as the current API does.
605 * Otherwise we try to fallback for providers that do not support SKEYs.
606 */
607 const unsigned char *keydata = NULL;
608 size_t keylen = 0;
609
610 if (skey != NULL && !EVP_SKEY_get0_raw_key(skey, &keydata, &keylen)) {
611 ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
612 return 0;
613 }
614
615 ret = ctx->cipher->dinit(ctx->algctx, keydata, keylen,
616 iv, iv_len, params);
617 } else {
618 ret = ctx->cipher->dinit_skey(ctx->algctx,
619 skey == NULL ? NULL : skey->keydata,
620 iv, iv_len, params);
621 }
622 }
623
624 return ret;
625 }
626
EVP_CipherInit_SKEY(EVP_CIPHER_CTX * ctx,const EVP_CIPHER * cipher,EVP_SKEY * skey,const unsigned char * iv,size_t iv_len,int enc,const OSSL_PARAM params[])627 int EVP_CipherInit_SKEY(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
628 EVP_SKEY *skey, const unsigned char *iv, size_t iv_len,
629 int enc, const OSSL_PARAM params[])
630 {
631 return evp_cipher_init_skey_internal(ctx, cipher, skey, iv, iv_len, enc, params);
632 }
633
EVP_CipherInit_ex2(EVP_CIPHER_CTX * ctx,const EVP_CIPHER * cipher,const unsigned char * key,const unsigned char * iv,int enc,const OSSL_PARAM params[])634 int EVP_CipherInit_ex2(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
635 const unsigned char *key, const unsigned char *iv,
636 int enc, const OSSL_PARAM params[])
637 {
638 return evp_cipher_init_internal(ctx, cipher, NULL, key, iv, enc, 0, params);
639 }
640
EVP_CipherInit(EVP_CIPHER_CTX * ctx,const EVP_CIPHER * cipher,const unsigned char * key,const unsigned char * iv,int enc)641 int EVP_CipherInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
642 const unsigned char *key, const unsigned char *iv, int enc)
643 {
644 if (cipher != NULL)
645 EVP_CIPHER_CTX_reset(ctx);
646 return evp_cipher_init_internal(ctx, cipher, NULL, key, iv, enc, 0, NULL);
647 }
648
EVP_CipherInit_ex(EVP_CIPHER_CTX * ctx,const EVP_CIPHER * cipher,ENGINE * impl,const unsigned char * key,const unsigned char * iv,int enc)649 int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
650 ENGINE *impl, const unsigned char *key,
651 const unsigned char *iv, int enc)
652 {
653 return evp_cipher_init_internal(ctx, cipher, impl, key, iv, enc, 0, NULL);
654 }
655
EVP_CipherPipelineEncryptInit(EVP_CIPHER_CTX * ctx,const EVP_CIPHER * cipher,const unsigned char * key,size_t keylen,size_t numpipes,const unsigned char ** iv,size_t ivlen)656 int EVP_CipherPipelineEncryptInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
657 const unsigned char *key, size_t keylen,
658 size_t numpipes,
659 const unsigned char **iv, size_t ivlen)
660 {
661 if (numpipes > EVP_MAX_PIPES) {
662 ERR_raise(ERR_LIB_EVP, EVP_R_TOO_MANY_PIPES);
663 return 0;
664 }
665
666 ctx->numpipes = numpipes;
667
668 if (!evp_cipher_init_internal(ctx, cipher, NULL, NULL, NULL, 1, 1,
669 NULL))
670 return 0;
671
672 if (ctx->cipher->p_einit == NULL) {
673 ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
674 return 0;
675 }
676
677 return ctx->cipher->p_einit(ctx->algctx,
678 key,
679 keylen,
680 numpipes,
681 iv,
682 ivlen,
683 NULL);
684 }
685
EVP_CipherPipelineDecryptInit(EVP_CIPHER_CTX * ctx,const EVP_CIPHER * cipher,const unsigned char * key,size_t keylen,size_t numpipes,const unsigned char ** iv,size_t ivlen)686 int EVP_CipherPipelineDecryptInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
687 const unsigned char *key, size_t keylen,
688 size_t numpipes,
689 const unsigned char **iv, size_t ivlen)
690 {
691 if (numpipes > EVP_MAX_PIPES) {
692 ERR_raise(ERR_LIB_EVP, EVP_R_TOO_MANY_PIPES);
693 return 0;
694 }
695
696 ctx->numpipes = numpipes;
697
698 if (!evp_cipher_init_internal(ctx, cipher, NULL, NULL, NULL, 0, 1,
699 NULL))
700 return 0;
701
702 if (ctx->cipher->p_dinit == NULL) {
703 ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
704 return 0;
705 }
706
707 return ctx->cipher->p_dinit(ctx->algctx,
708 key,
709 keylen,
710 numpipes,
711 iv,
712 ivlen,
713 NULL);
714 }
715
EVP_CipherUpdate(EVP_CIPHER_CTX * ctx,unsigned char * out,int * outl,const unsigned char * in,int inl)716 int EVP_CipherUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
717 const unsigned char *in, int inl)
718 {
719 if (ctx->encrypt)
720 return EVP_EncryptUpdate(ctx, out, outl, in, inl);
721 else
722 return EVP_DecryptUpdate(ctx, out, outl, in, inl);
723 }
724
EVP_CipherPipelineUpdate(EVP_CIPHER_CTX * ctx,unsigned char ** out,size_t * outl,const size_t * outsize,const unsigned char ** in,const size_t * inl)725 int EVP_CipherPipelineUpdate(EVP_CIPHER_CTX *ctx,
726 unsigned char **out, size_t *outl,
727 const size_t *outsize,
728 const unsigned char **in, const size_t *inl)
729 {
730 size_t i;
731
732 if (ossl_unlikely(outl == NULL || inl == NULL)) {
733 ERR_raise(ERR_LIB_EVP, ERR_R_PASSED_NULL_PARAMETER);
734 return 0;
735 }
736
737 if (ossl_unlikely(ctx->cipher == NULL)) {
738 ERR_raise(ERR_LIB_EVP, EVP_R_NO_CIPHER_SET);
739 return 0;
740 }
741
742 if (ossl_unlikely(ctx->cipher->prov == NULL)) {
743 ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_OPERATION);
744 return 0;
745 }
746
747 if (ossl_unlikely(ctx->cipher->p_cupdate == NULL)) {
748 ERR_raise(ERR_LIB_EVP, EVP_R_UPDATE_ERROR);
749 return 0;
750 }
751
752 for (i = 0; i < ctx->numpipes; i++)
753 outl[i] = 0;
754
755 return ctx->cipher->p_cupdate(ctx->algctx, ctx->numpipes,
756 out, outl, outsize,
757 in, inl);
758 }
759
EVP_CipherFinal_ex(EVP_CIPHER_CTX * ctx,unsigned char * out,int * outl)760 int EVP_CipherFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
761 {
762 if (ctx->encrypt)
763 return EVP_EncryptFinal_ex(ctx, out, outl);
764 else
765 return EVP_DecryptFinal_ex(ctx, out, outl);
766 }
767
EVP_CipherFinal(EVP_CIPHER_CTX * ctx,unsigned char * out,int * outl)768 int EVP_CipherFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
769 {
770 if (ctx->encrypt)
771 return EVP_EncryptFinal(ctx, out, outl);
772 else
773 return EVP_DecryptFinal(ctx, out, outl);
774 }
775
EVP_CipherPipelineFinal(EVP_CIPHER_CTX * ctx,unsigned char ** out,size_t * outl,const size_t * outsize)776 int EVP_CipherPipelineFinal(EVP_CIPHER_CTX *ctx,
777 unsigned char **out, size_t *outl,
778 const size_t *outsize)
779 {
780 size_t i;
781
782 if (ossl_unlikely(outl == NULL)) {
783 ERR_raise(ERR_LIB_EVP, ERR_R_PASSED_NULL_PARAMETER);
784 return 0;
785 }
786
787 if (ossl_unlikely(ctx->cipher == NULL)) {
788 ERR_raise(ERR_LIB_EVP, EVP_R_NO_CIPHER_SET);
789 return 0;
790 }
791
792 if (ossl_unlikely(ctx->cipher->prov == NULL)) {
793 ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_OPERATION);
794 return 0;
795 }
796
797 if (ossl_unlikely(ctx->cipher->p_cfinal == NULL)) {
798 ERR_raise(ERR_LIB_EVP, EVP_R_FINAL_ERROR);
799 return 0;
800 }
801
802 for (i = 0; i < ctx->numpipes; i++)
803 outl[i] = 0;
804
805 return ctx->cipher->p_cfinal(ctx->algctx, ctx->numpipes,
806 out, outl, outsize);
807 }
808
EVP_EncryptInit(EVP_CIPHER_CTX * ctx,const EVP_CIPHER * cipher,const unsigned char * key,const unsigned char * iv)809 int EVP_EncryptInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
810 const unsigned char *key, const unsigned char *iv)
811 {
812 return EVP_CipherInit(ctx, cipher, key, iv, 1);
813 }
814
EVP_EncryptInit_ex(EVP_CIPHER_CTX * ctx,const EVP_CIPHER * cipher,ENGINE * impl,const unsigned char * key,const unsigned char * iv)815 int EVP_EncryptInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
816 ENGINE *impl, const unsigned char *key,
817 const unsigned char *iv)
818 {
819 return EVP_CipherInit_ex(ctx, cipher, impl, key, iv, 1);
820 }
821
EVP_EncryptInit_ex2(EVP_CIPHER_CTX * ctx,const EVP_CIPHER * cipher,const unsigned char * key,const unsigned char * iv,const OSSL_PARAM params[])822 int EVP_EncryptInit_ex2(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
823 const unsigned char *key, const unsigned char *iv,
824 const OSSL_PARAM params[])
825 {
826 return EVP_CipherInit_ex2(ctx, cipher, key, iv, 1, params);
827 }
828
EVP_DecryptInit(EVP_CIPHER_CTX * ctx,const EVP_CIPHER * cipher,const unsigned char * key,const unsigned char * iv)829 int EVP_DecryptInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
830 const unsigned char *key, const unsigned char *iv)
831 {
832 return EVP_CipherInit(ctx, cipher, key, iv, 0);
833 }
834
EVP_DecryptInit_ex(EVP_CIPHER_CTX * ctx,const EVP_CIPHER * cipher,ENGINE * impl,const unsigned char * key,const unsigned char * iv)835 int EVP_DecryptInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
836 ENGINE *impl, const unsigned char *key,
837 const unsigned char *iv)
838 {
839 return EVP_CipherInit_ex(ctx, cipher, impl, key, iv, 0);
840 }
841
EVP_DecryptInit_ex2(EVP_CIPHER_CTX * ctx,const EVP_CIPHER * cipher,const unsigned char * key,const unsigned char * iv,const OSSL_PARAM params[])842 int EVP_DecryptInit_ex2(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
843 const unsigned char *key, const unsigned char *iv,
844 const OSSL_PARAM params[])
845 {
846 return EVP_CipherInit_ex2(ctx, cipher, key, iv, 0, params);
847 }
848
849 /*
850 * According to the letter of standard difference between pointers
851 * is specified to be valid only within same object. This makes
852 * it formally challenging to determine if input and output buffers
853 * are not partially overlapping with standard pointer arithmetic.
854 */
855 #ifdef PTRDIFF_T
856 # undef PTRDIFF_T
857 #endif
858 #if defined(OPENSSL_SYS_VMS) && __INITIAL_POINTER_SIZE==64
859 /*
860 * Then we have VMS that distinguishes itself by adhering to
861 * sizeof(size_t)==4 even in 64-bit builds, which means that
862 * difference between two pointers might be truncated to 32 bits.
863 * In the context one can even wonder how comparison for
864 * equality is implemented. To be on the safe side we adhere to
865 * PTRDIFF_T even for comparison for equality.
866 */
867 # define PTRDIFF_T uint64_t
868 #else
869 # define PTRDIFF_T size_t
870 #endif
871
ossl_is_partially_overlapping(const void * ptr1,const void * ptr2,int len)872 int ossl_is_partially_overlapping(const void *ptr1, const void *ptr2, int len)
873 {
874 PTRDIFF_T diff = (PTRDIFF_T)ptr1-(PTRDIFF_T)ptr2;
875 /*
876 * Check for partially overlapping buffers. [Binary logical
877 * operations are used instead of boolean to minimize number
878 * of conditional branches.]
879 */
880 int overlapped = (len > 0) & (diff != 0) & ((diff < (PTRDIFF_T)len) |
881 (diff > (0 - (PTRDIFF_T)len)));
882
883 return overlapped;
884 }
885
evp_EncryptDecryptUpdate(EVP_CIPHER_CTX * ctx,unsigned char * out,int * outl,const unsigned char * in,int inl)886 static int evp_EncryptDecryptUpdate(EVP_CIPHER_CTX *ctx,
887 unsigned char *out, int *outl,
888 const unsigned char *in, int inl)
889 {
890 int i, j, bl, cmpl = inl;
891
892 if (EVP_CIPHER_CTX_test_flags(ctx, EVP_CIPH_FLAG_LENGTH_BITS))
893 cmpl = safe_div_round_up_int(cmpl, 8, NULL);
894
895 bl = ctx->cipher->block_size;
896
897 if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) {
898 /* If block size > 1 then the cipher will have to do this check */
899 if (bl == 1 && ossl_is_partially_overlapping(out, in, cmpl)) {
900 ERR_raise(ERR_LIB_EVP, EVP_R_PARTIALLY_OVERLAPPING);
901 return 0;
902 }
903
904 i = ctx->cipher->do_cipher(ctx, out, in, inl);
905 if (i < 0)
906 return 0;
907 else
908 *outl = i;
909 return 1;
910 }
911
912 if (inl <= 0) {
913 *outl = 0;
914 return inl == 0;
915 }
916 if (ossl_is_partially_overlapping(out + ctx->buf_len, in, cmpl)) {
917 ERR_raise(ERR_LIB_EVP, EVP_R_PARTIALLY_OVERLAPPING);
918 return 0;
919 }
920
921 if (ctx->buf_len == 0 && (inl & (ctx->block_mask)) == 0) {
922 if (ctx->cipher->do_cipher(ctx, out, in, inl)) {
923 *outl = inl;
924 return 1;
925 } else {
926 *outl = 0;
927 return 0;
928 }
929 }
930 i = ctx->buf_len;
931 OPENSSL_assert(bl <= (int)sizeof(ctx->buf));
932 if (i != 0) {
933 if (bl - i > inl) {
934 memcpy(&(ctx->buf[i]), in, inl);
935 ctx->buf_len += inl;
936 *outl = 0;
937 return 1;
938 } else {
939 j = bl - i;
940
941 /*
942 * Once we've processed the first j bytes from in, the amount of
943 * data left that is a multiple of the block length is:
944 * (inl - j) & ~(bl - 1)
945 * We must ensure that this amount of data, plus the one block that
946 * we process from ctx->buf does not exceed INT_MAX
947 */
948 if (((inl - j) & ~(bl - 1)) > INT_MAX - bl) {
949 ERR_raise(ERR_LIB_EVP, EVP_R_OUTPUT_WOULD_OVERFLOW);
950 return 0;
951 }
952 memcpy(&(ctx->buf[i]), in, j);
953 inl -= j;
954 in += j;
955 if (!ctx->cipher->do_cipher(ctx, out, ctx->buf, bl))
956 return 0;
957 out += bl;
958 *outl = bl;
959 }
960 } else
961 *outl = 0;
962 i = inl & (bl - 1);
963 inl -= i;
964 if (inl > 0) {
965 if (!ctx->cipher->do_cipher(ctx, out, in, inl))
966 return 0;
967 *outl += inl;
968 }
969
970 if (i != 0)
971 memcpy(ctx->buf, &(in[inl]), i);
972 ctx->buf_len = i;
973 return 1;
974 }
975
976
EVP_EncryptUpdate(EVP_CIPHER_CTX * ctx,unsigned char * out,int * outl,const unsigned char * in,int inl)977 int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
978 const unsigned char *in, int inl)
979 {
980 int ret;
981 size_t soutl, inl_ = (size_t)inl;
982 int blocksize;
983
984 if (ossl_likely(outl != NULL)) {
985 *outl = 0;
986 } else {
987 ERR_raise(ERR_LIB_EVP, ERR_R_PASSED_NULL_PARAMETER);
988 return 0;
989 }
990
991 /* Prevent accidental use of decryption context when encrypting */
992 if (ossl_unlikely(!ctx->encrypt)) {
993 ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_OPERATION);
994 return 0;
995 }
996
997 if (ossl_unlikely(ctx->cipher == NULL)) {
998 ERR_raise(ERR_LIB_EVP, EVP_R_NO_CIPHER_SET);
999 return 0;
1000 }
1001
1002 if (ossl_unlikely(ctx->cipher->prov == NULL))
1003 goto legacy;
1004
1005 blocksize = ctx->cipher->block_size;
1006
1007 if (ossl_unlikely(ctx->cipher->cupdate == NULL || blocksize < 1)) {
1008 ERR_raise(ERR_LIB_EVP, EVP_R_UPDATE_ERROR);
1009 return 0;
1010 }
1011
1012 ret = ctx->cipher->cupdate(ctx->algctx, out, &soutl,
1013 inl_ + (size_t)(blocksize == 1 ? 0 : blocksize),
1014 in, inl_);
1015
1016 if (ossl_likely(ret)) {
1017 if (soutl > INT_MAX) {
1018 ERR_raise(ERR_LIB_EVP, EVP_R_UPDATE_ERROR);
1019 return 0;
1020 }
1021 *outl = soutl;
1022 }
1023
1024 return ret;
1025
1026 /* Code below to be removed when legacy support is dropped. */
1027 legacy:
1028
1029 return evp_EncryptDecryptUpdate(ctx, out, outl, in, inl);
1030 }
1031
EVP_EncryptFinal(EVP_CIPHER_CTX * ctx,unsigned char * out,int * outl)1032 int EVP_EncryptFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
1033 {
1034 int ret;
1035 ret = EVP_EncryptFinal_ex(ctx, out, outl);
1036 return ret;
1037 }
1038
EVP_EncryptFinal_ex(EVP_CIPHER_CTX * ctx,unsigned char * out,int * outl)1039 int EVP_EncryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
1040 {
1041 int n, ret;
1042 unsigned int i, b, bl;
1043 size_t soutl;
1044 int blocksize;
1045
1046 if (outl != NULL) {
1047 *outl = 0;
1048 } else {
1049 ERR_raise(ERR_LIB_EVP, ERR_R_PASSED_NULL_PARAMETER);
1050 return 0;
1051 }
1052
1053 /* Prevent accidental use of decryption context when encrypting */
1054 if (!ctx->encrypt) {
1055 ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_OPERATION);
1056 return 0;
1057 }
1058
1059 if (ctx->cipher == NULL) {
1060 ERR_raise(ERR_LIB_EVP, EVP_R_NO_CIPHER_SET);
1061 return 0;
1062 }
1063 if (ctx->cipher->prov == NULL)
1064 goto legacy;
1065
1066 blocksize = EVP_CIPHER_CTX_get_block_size(ctx);
1067
1068 if (blocksize < 1 || ctx->cipher->cfinal == NULL) {
1069 ERR_raise(ERR_LIB_EVP, EVP_R_FINAL_ERROR);
1070 return 0;
1071 }
1072
1073 ret = ctx->cipher->cfinal(ctx->algctx, out, &soutl,
1074 blocksize == 1 ? 0 : blocksize);
1075
1076 if (ret) {
1077 if (soutl > INT_MAX) {
1078 ERR_raise(ERR_LIB_EVP, EVP_R_FINAL_ERROR);
1079 return 0;
1080 }
1081 *outl = soutl;
1082 }
1083
1084 return ret;
1085
1086 /* Code below to be removed when legacy support is dropped. */
1087 legacy:
1088
1089 if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) {
1090 ret = ctx->cipher->do_cipher(ctx, out, NULL, 0);
1091 if (ret < 0)
1092 return 0;
1093 else
1094 *outl = ret;
1095 return 1;
1096 }
1097
1098 b = ctx->cipher->block_size;
1099 OPENSSL_assert(b <= sizeof(ctx->buf));
1100 if (b == 1) {
1101 *outl = 0;
1102 return 1;
1103 }
1104 bl = ctx->buf_len;
1105 if (ctx->flags & EVP_CIPH_NO_PADDING) {
1106 if (bl) {
1107 ERR_raise(ERR_LIB_EVP, EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH);
1108 return 0;
1109 }
1110 *outl = 0;
1111 return 1;
1112 }
1113
1114 n = b - bl;
1115 for (i = bl; i < b; i++)
1116 ctx->buf[i] = n;
1117 ret = ctx->cipher->do_cipher(ctx, out, ctx->buf, b);
1118
1119 if (ret)
1120 *outl = b;
1121
1122 return ret;
1123 }
1124
EVP_DecryptUpdate(EVP_CIPHER_CTX * ctx,unsigned char * out,int * outl,const unsigned char * in,int inl)1125 int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
1126 const unsigned char *in, int inl)
1127 {
1128 int fix_len, cmpl = inl, ret;
1129 unsigned int b;
1130 size_t soutl, inl_ = (size_t)inl;
1131 int blocksize;
1132
1133 if (ossl_likely(outl != NULL)) {
1134 *outl = 0;
1135 } else {
1136 ERR_raise(ERR_LIB_EVP, ERR_R_PASSED_NULL_PARAMETER);
1137 return 0;
1138 }
1139
1140 /* Prevent accidental use of encryption context when decrypting */
1141 if (ossl_unlikely(ctx->encrypt)) {
1142 ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_OPERATION);
1143 return 0;
1144 }
1145
1146 if (ossl_unlikely(ctx->cipher == NULL)) {
1147 ERR_raise(ERR_LIB_EVP, EVP_R_NO_CIPHER_SET);
1148 return 0;
1149 }
1150 if (ossl_unlikely(ctx->cipher->prov == NULL))
1151 goto legacy;
1152
1153 blocksize = EVP_CIPHER_CTX_get_block_size(ctx);
1154
1155 if (ossl_unlikely(ctx->cipher->cupdate == NULL || blocksize < 1)) {
1156 ERR_raise(ERR_LIB_EVP, EVP_R_UPDATE_ERROR);
1157 return 0;
1158 }
1159 ret = ctx->cipher->cupdate(ctx->algctx, out, &soutl,
1160 inl_ + (size_t)(blocksize == 1 ? 0 : blocksize),
1161 in, inl_);
1162
1163 if (ossl_likely(ret)) {
1164 if (soutl > INT_MAX) {
1165 ERR_raise(ERR_LIB_EVP, EVP_R_UPDATE_ERROR);
1166 return 0;
1167 }
1168 *outl = soutl;
1169 }
1170
1171 return ret;
1172
1173 /* Code below to be removed when legacy support is dropped. */
1174 legacy:
1175
1176 b = ctx->cipher->block_size;
1177
1178 if (EVP_CIPHER_CTX_test_flags(ctx, EVP_CIPH_FLAG_LENGTH_BITS))
1179 cmpl = safe_div_round_up_int(cmpl, 8, NULL);
1180
1181 if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) {
1182 if (b == 1 && ossl_is_partially_overlapping(out, in, cmpl)) {
1183 ERR_raise(ERR_LIB_EVP, EVP_R_PARTIALLY_OVERLAPPING);
1184 return 0;
1185 }
1186
1187 fix_len = ctx->cipher->do_cipher(ctx, out, in, inl);
1188 if (fix_len < 0) {
1189 *outl = 0;
1190 return 0;
1191 } else
1192 *outl = fix_len;
1193 return 1;
1194 }
1195
1196 if (inl <= 0) {
1197 *outl = 0;
1198 return inl == 0;
1199 }
1200
1201 if (ctx->flags & EVP_CIPH_NO_PADDING)
1202 return evp_EncryptDecryptUpdate(ctx, out, outl, in, inl);
1203
1204 OPENSSL_assert(b <= sizeof(ctx->final));
1205
1206 if (ctx->final_used) {
1207 /* see comment about PTRDIFF_T comparison above */
1208 if (((PTRDIFF_T)out == (PTRDIFF_T)in)
1209 || ossl_is_partially_overlapping(out, in, b)) {
1210 ERR_raise(ERR_LIB_EVP, EVP_R_PARTIALLY_OVERLAPPING);
1211 return 0;
1212 }
1213 /*
1214 * final_used is only ever set if buf_len is 0. Therefore the maximum
1215 * length output we will ever see from evp_EncryptDecryptUpdate is
1216 * the maximum multiple of the block length that is <= inl, or just:
1217 * inl & ~(b - 1)
1218 * Since final_used has been set then the final output length is:
1219 * (inl & ~(b - 1)) + b
1220 * This must never exceed INT_MAX
1221 */
1222 if ((inl & ~(b - 1)) > INT_MAX - b) {
1223 ERR_raise(ERR_LIB_EVP, EVP_R_OUTPUT_WOULD_OVERFLOW);
1224 return 0;
1225 }
1226 memcpy(out, ctx->final, b);
1227 out += b;
1228 fix_len = 1;
1229 } else
1230 fix_len = 0;
1231
1232 if (!evp_EncryptDecryptUpdate(ctx, out, outl, in, inl))
1233 return 0;
1234
1235 /*
1236 * if we have 'decrypted' a multiple of block size, make sure we have a
1237 * copy of this last block
1238 */
1239 if (b > 1 && !ctx->buf_len) {
1240 *outl -= b;
1241 ctx->final_used = 1;
1242 memcpy(ctx->final, &out[*outl], b);
1243 } else
1244 ctx->final_used = 0;
1245
1246 if (fix_len)
1247 *outl += b;
1248
1249 return 1;
1250 }
1251
EVP_DecryptFinal(EVP_CIPHER_CTX * ctx,unsigned char * out,int * outl)1252 int EVP_DecryptFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
1253 {
1254 int ret;
1255 ret = EVP_DecryptFinal_ex(ctx, out, outl);
1256 return ret;
1257 }
1258
EVP_DecryptFinal_ex(EVP_CIPHER_CTX * ctx,unsigned char * out,int * outl)1259 int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
1260 {
1261 int i, n;
1262 unsigned int b;
1263 size_t soutl;
1264 int ret;
1265 int blocksize;
1266
1267 if (outl != NULL) {
1268 *outl = 0;
1269 } else {
1270 ERR_raise(ERR_LIB_EVP, ERR_R_PASSED_NULL_PARAMETER);
1271 return 0;
1272 }
1273
1274 /* Prevent accidental use of encryption context when decrypting */
1275 if (ctx->encrypt) {
1276 ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_OPERATION);
1277 return 0;
1278 }
1279
1280 if (ctx->cipher == NULL) {
1281 ERR_raise(ERR_LIB_EVP, EVP_R_NO_CIPHER_SET);
1282 return 0;
1283 }
1284
1285 if (ctx->cipher->prov == NULL)
1286 goto legacy;
1287
1288 blocksize = EVP_CIPHER_CTX_get_block_size(ctx);
1289
1290 if (blocksize < 1 || ctx->cipher->cfinal == NULL) {
1291 ERR_raise(ERR_LIB_EVP, EVP_R_FINAL_ERROR);
1292 return 0;
1293 }
1294
1295 ret = ctx->cipher->cfinal(ctx->algctx, out, &soutl,
1296 blocksize == 1 ? 0 : blocksize);
1297
1298 if (ret) {
1299 if (soutl > INT_MAX) {
1300 ERR_raise(ERR_LIB_EVP, EVP_R_FINAL_ERROR);
1301 return 0;
1302 }
1303 *outl = soutl;
1304 }
1305
1306 return ret;
1307
1308 /* Code below to be removed when legacy support is dropped. */
1309 legacy:
1310
1311 *outl = 0;
1312 if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) {
1313 i = ctx->cipher->do_cipher(ctx, out, NULL, 0);
1314 if (i < 0)
1315 return 0;
1316 else
1317 *outl = i;
1318 return 1;
1319 }
1320
1321 b = ctx->cipher->block_size;
1322 if (ctx->flags & EVP_CIPH_NO_PADDING) {
1323 if (ctx->buf_len) {
1324 ERR_raise(ERR_LIB_EVP, EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH);
1325 return 0;
1326 }
1327 *outl = 0;
1328 return 1;
1329 }
1330 if (b > 1) {
1331 if (ctx->buf_len || !ctx->final_used) {
1332 ERR_raise(ERR_LIB_EVP, EVP_R_WRONG_FINAL_BLOCK_LENGTH);
1333 return 0;
1334 }
1335 OPENSSL_assert(b <= sizeof(ctx->final));
1336
1337 /*
1338 * The following assumes that the ciphertext has been authenticated.
1339 * Otherwise it provides a padding oracle.
1340 */
1341 n = ctx->final[b - 1];
1342 if (n == 0 || n > (int)b) {
1343 ERR_raise(ERR_LIB_EVP, EVP_R_BAD_DECRYPT);
1344 return 0;
1345 }
1346 for (i = 0; i < n; i++) {
1347 if (ctx->final[--b] != n) {
1348 ERR_raise(ERR_LIB_EVP, EVP_R_BAD_DECRYPT);
1349 return 0;
1350 }
1351 }
1352 n = ctx->cipher->block_size - n;
1353 for (i = 0; i < n; i++)
1354 out[i] = ctx->final[i];
1355 *outl = n;
1356 }
1357 return 1;
1358 }
1359
EVP_CIPHER_CTX_set_key_length(EVP_CIPHER_CTX * c,int keylen)1360 int EVP_CIPHER_CTX_set_key_length(EVP_CIPHER_CTX *c, int keylen)
1361 {
1362 if (c->cipher->prov != NULL) {
1363 int ok;
1364 OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
1365 size_t len;
1366
1367 if (EVP_CIPHER_CTX_get_key_length(c) == keylen)
1368 return 1;
1369
1370 /* Check the cipher actually understands this parameter */
1371 if (OSSL_PARAM_locate_const(EVP_CIPHER_settable_ctx_params(c->cipher),
1372 OSSL_CIPHER_PARAM_KEYLEN) == NULL) {
1373 ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_KEY_LENGTH);
1374 return 0;
1375 }
1376
1377 params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_KEYLEN, &len);
1378 if (!OSSL_PARAM_set_int(params, keylen))
1379 return 0;
1380 ok = evp_do_ciph_ctx_setparams(c->cipher, c->algctx, params);
1381 if (ok <= 0)
1382 return 0;
1383 c->key_len = keylen;
1384 return 1;
1385 }
1386
1387 /* Code below to be removed when legacy support is dropped. */
1388
1389 /*
1390 * Note there have never been any built-in ciphers that define this flag
1391 * since it was first introduced.
1392 */
1393 if (c->cipher->flags & EVP_CIPH_CUSTOM_KEY_LENGTH)
1394 return EVP_CIPHER_CTX_ctrl(c, EVP_CTRL_SET_KEY_LENGTH, keylen, NULL);
1395 if (EVP_CIPHER_CTX_get_key_length(c) == keylen)
1396 return 1;
1397 if ((keylen > 0) && (c->cipher->flags & EVP_CIPH_VARIABLE_LENGTH)) {
1398 c->key_len = keylen;
1399 return 1;
1400 }
1401 ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_KEY_LENGTH);
1402 return 0;
1403 }
1404
EVP_CIPHER_CTX_set_padding(EVP_CIPHER_CTX * ctx,int pad)1405 int EVP_CIPHER_CTX_set_padding(EVP_CIPHER_CTX *ctx, int pad)
1406 {
1407 int ok;
1408 OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
1409 unsigned int pd = pad;
1410
1411 if (pad)
1412 ctx->flags &= ~EVP_CIPH_NO_PADDING;
1413 else
1414 ctx->flags |= EVP_CIPH_NO_PADDING;
1415
1416 if (ctx->cipher != NULL && ctx->cipher->prov == NULL)
1417 return 1;
1418 params[0] = OSSL_PARAM_construct_uint(OSSL_CIPHER_PARAM_PADDING, &pd);
1419 ok = evp_do_ciph_ctx_setparams(ctx->cipher, ctx->algctx, params);
1420
1421 return ok != 0;
1422 }
1423
EVP_CIPHER_CTX_ctrl(EVP_CIPHER_CTX * ctx,int type,int arg,void * ptr)1424 int EVP_CIPHER_CTX_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr)
1425 {
1426 int ret = EVP_CTRL_RET_UNSUPPORTED;
1427 int set_params = 1;
1428 size_t sz = arg;
1429 unsigned int i;
1430 OSSL_PARAM params[4] = {
1431 OSSL_PARAM_END, OSSL_PARAM_END, OSSL_PARAM_END, OSSL_PARAM_END
1432 };
1433
1434 if (ctx == NULL || ctx->cipher == NULL) {
1435 ERR_raise(ERR_LIB_EVP, EVP_R_NO_CIPHER_SET);
1436 return 0;
1437 }
1438
1439 if (ctx->cipher->prov == NULL)
1440 goto legacy;
1441
1442 switch (type) {
1443 case EVP_CTRL_SET_KEY_LENGTH:
1444 if (arg < 0)
1445 return 0;
1446 if (ctx->key_len == arg)
1447 /* Skip calling into provider if unchanged. */
1448 return 1;
1449 params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_KEYLEN, &sz);
1450 ctx->key_len = -1;
1451 break;
1452 case EVP_CTRL_RAND_KEY: /* Used by DES */
1453 set_params = 0;
1454 params[0] =
1455 OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_RANDOM_KEY,
1456 ptr, sz);
1457 break;
1458
1459 case EVP_CTRL_INIT:
1460 /*
1461 * EVP_CTRL_INIT is purely legacy, no provider counterpart.
1462 * As a matter of fact, this should be dead code, but some caller
1463 * might still do a direct control call with this command, so...
1464 * Legacy methods return 1 except for exceptional circumstances, so
1465 * we do the same here to not be disruptive.
1466 */
1467 return 1;
1468 case EVP_CTRL_SET_PIPELINE_OUTPUT_BUFS: /* Used by DASYNC */
1469 default:
1470 goto end;
1471 case EVP_CTRL_AEAD_SET_IVLEN:
1472 if (arg < 0)
1473 return 0;
1474 if (ctx->iv_len == arg)
1475 /* Skip calling into provider if unchanged. */
1476 return 1;
1477 params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_IVLEN, &sz);
1478 ctx->iv_len = -1;
1479 break;
1480 case EVP_CTRL_CCM_SET_L:
1481 if (arg < 2 || arg > 8)
1482 return 0;
1483 sz = 15 - arg;
1484 params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_IVLEN, &sz);
1485 ctx->iv_len = -1;
1486 break;
1487 case EVP_CTRL_AEAD_SET_IV_FIXED:
1488 params[0] = OSSL_PARAM_construct_octet_string(
1489 OSSL_CIPHER_PARAM_AEAD_TLS1_IV_FIXED, ptr, sz);
1490 break;
1491 case EVP_CTRL_GCM_IV_GEN:
1492 set_params = 0;
1493 if (arg < 0)
1494 sz = 0; /* special case that uses the iv length */
1495 params[0] = OSSL_PARAM_construct_octet_string(
1496 OSSL_CIPHER_PARAM_AEAD_TLS1_GET_IV_GEN, ptr, sz);
1497 break;
1498 case EVP_CTRL_GCM_SET_IV_INV:
1499 if (arg < 0)
1500 return 0;
1501 params[0] = OSSL_PARAM_construct_octet_string(
1502 OSSL_CIPHER_PARAM_AEAD_TLS1_SET_IV_INV, ptr, sz);
1503 break;
1504 case EVP_CTRL_GET_RC5_ROUNDS:
1505 set_params = 0; /* Fall thru */
1506 case EVP_CTRL_SET_RC5_ROUNDS:
1507 if (arg < 0)
1508 return 0;
1509 i = (unsigned int)arg;
1510 params[0] = OSSL_PARAM_construct_uint(OSSL_CIPHER_PARAM_ROUNDS, &i);
1511 break;
1512 case EVP_CTRL_SET_SPEED:
1513 if (arg < 0)
1514 return 0;
1515 i = (unsigned int)arg;
1516 params[0] = OSSL_PARAM_construct_uint(OSSL_CIPHER_PARAM_SPEED, &i);
1517 break;
1518 case EVP_CTRL_AEAD_GET_TAG:
1519 set_params = 0; /* Fall thru */
1520 case EVP_CTRL_AEAD_SET_TAG:
1521 params[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG,
1522 ptr, sz);
1523 break;
1524 case EVP_CTRL_AEAD_TLS1_AAD:
1525 /* This one does a set and a get - since it returns a size */
1526 params[0] =
1527 OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TLS1_AAD,
1528 ptr, sz);
1529 ret = evp_do_ciph_ctx_setparams(ctx->cipher, ctx->algctx, params);
1530 if (ret <= 0)
1531 goto end;
1532 params[0] =
1533 OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_AEAD_TLS1_AAD_PAD, &sz);
1534 ret = evp_do_ciph_ctx_getparams(ctx->cipher, ctx->algctx, params);
1535 if (ret <= 0)
1536 goto end;
1537 return sz;
1538 #ifndef OPENSSL_NO_RC2
1539 case EVP_CTRL_GET_RC2_KEY_BITS:
1540 set_params = 0; /* Fall thru */
1541 case EVP_CTRL_SET_RC2_KEY_BITS:
1542 params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_RC2_KEYBITS, &sz);
1543 break;
1544 #endif /* OPENSSL_NO_RC2 */
1545 #if !defined(OPENSSL_NO_MULTIBLOCK)
1546 case EVP_CTRL_TLS1_1_MULTIBLOCK_MAX_BUFSIZE:
1547 params[0] = OSSL_PARAM_construct_size_t(
1548 OSSL_CIPHER_PARAM_TLS1_MULTIBLOCK_MAX_SEND_FRAGMENT, &sz);
1549 ret = evp_do_ciph_ctx_setparams(ctx->cipher, ctx->algctx, params);
1550 if (ret <= 0)
1551 return 0;
1552
1553 params[0] = OSSL_PARAM_construct_size_t(
1554 OSSL_CIPHER_PARAM_TLS1_MULTIBLOCK_MAX_BUFSIZE, &sz);
1555 params[1] = OSSL_PARAM_construct_end();
1556 ret = evp_do_ciph_ctx_getparams(ctx->cipher, ctx->algctx, params);
1557 if (ret <= 0)
1558 return 0;
1559 return sz;
1560 case EVP_CTRL_TLS1_1_MULTIBLOCK_AAD: {
1561 EVP_CTRL_TLS1_1_MULTIBLOCK_PARAM *p =
1562 (EVP_CTRL_TLS1_1_MULTIBLOCK_PARAM *)ptr;
1563
1564 if (arg < (int)sizeof(EVP_CTRL_TLS1_1_MULTIBLOCK_PARAM))
1565 return 0;
1566
1567 params[0] = OSSL_PARAM_construct_octet_string(
1568 OSSL_CIPHER_PARAM_TLS1_MULTIBLOCK_AAD, (void*)p->inp, p->len);
1569 params[1] = OSSL_PARAM_construct_uint(
1570 OSSL_CIPHER_PARAM_TLS1_MULTIBLOCK_INTERLEAVE, &p->interleave);
1571 ret = evp_do_ciph_ctx_setparams(ctx->cipher, ctx->algctx, params);
1572 if (ret <= 0)
1573 return ret;
1574 /* Retrieve the return values changed by the set */
1575 params[0] = OSSL_PARAM_construct_size_t(
1576 OSSL_CIPHER_PARAM_TLS1_MULTIBLOCK_AAD_PACKLEN, &sz);
1577 params[1] = OSSL_PARAM_construct_uint(
1578 OSSL_CIPHER_PARAM_TLS1_MULTIBLOCK_INTERLEAVE, &p->interleave);
1579 params[2] = OSSL_PARAM_construct_end();
1580 ret = evp_do_ciph_ctx_getparams(ctx->cipher, ctx->algctx, params);
1581 if (ret <= 0)
1582 return 0;
1583 return sz;
1584 }
1585 case EVP_CTRL_TLS1_1_MULTIBLOCK_ENCRYPT: {
1586 EVP_CTRL_TLS1_1_MULTIBLOCK_PARAM *p =
1587 (EVP_CTRL_TLS1_1_MULTIBLOCK_PARAM *)ptr;
1588
1589 params[0] = OSSL_PARAM_construct_octet_string(
1590 OSSL_CIPHER_PARAM_TLS1_MULTIBLOCK_ENC, p->out, p->len);
1591
1592 params[1] = OSSL_PARAM_construct_octet_string(
1593 OSSL_CIPHER_PARAM_TLS1_MULTIBLOCK_ENC_IN, (void*)p->inp,
1594 p->len);
1595 params[2] = OSSL_PARAM_construct_uint(
1596 OSSL_CIPHER_PARAM_TLS1_MULTIBLOCK_INTERLEAVE, &p->interleave);
1597 ret = evp_do_ciph_ctx_setparams(ctx->cipher, ctx->algctx, params);
1598 if (ret <= 0)
1599 return ret;
1600 params[0] = OSSL_PARAM_construct_size_t(
1601 OSSL_CIPHER_PARAM_TLS1_MULTIBLOCK_ENC_LEN, &sz);
1602 params[1] = OSSL_PARAM_construct_end();
1603 ret = evp_do_ciph_ctx_getparams(ctx->cipher, ctx->algctx, params);
1604 if (ret <= 0)
1605 return 0;
1606 return sz;
1607 }
1608 #endif /* OPENSSL_NO_MULTIBLOCK */
1609 case EVP_CTRL_AEAD_SET_MAC_KEY:
1610 if (arg < 0)
1611 return -1;
1612 params[0] = OSSL_PARAM_construct_octet_string(
1613 OSSL_CIPHER_PARAM_AEAD_MAC_KEY, ptr, sz);
1614 break;
1615 }
1616
1617 if (set_params)
1618 ret = evp_do_ciph_ctx_setparams(ctx->cipher, ctx->algctx, params);
1619 else
1620 ret = evp_do_ciph_ctx_getparams(ctx->cipher, ctx->algctx, params);
1621 goto end;
1622
1623 /* Code below to be removed when legacy support is dropped. */
1624 legacy:
1625 if (ctx->cipher->ctrl == NULL) {
1626 ERR_raise(ERR_LIB_EVP, EVP_R_CTRL_NOT_IMPLEMENTED);
1627 return 0;
1628 }
1629
1630 ret = ctx->cipher->ctrl(ctx, type, arg, ptr);
1631
1632 end:
1633 if (ret == EVP_CTRL_RET_UNSUPPORTED) {
1634 ERR_raise(ERR_LIB_EVP, EVP_R_CTRL_OPERATION_NOT_IMPLEMENTED);
1635 return 0;
1636 }
1637 return ret;
1638 }
1639
EVP_CIPHER_get_params(EVP_CIPHER * cipher,OSSL_PARAM params[])1640 int EVP_CIPHER_get_params(EVP_CIPHER *cipher, OSSL_PARAM params[])
1641 {
1642 if (cipher != NULL && cipher->get_params != NULL)
1643 return cipher->get_params(params);
1644 return 0;
1645 }
1646
EVP_CIPHER_CTX_set_params(EVP_CIPHER_CTX * ctx,const OSSL_PARAM params[])1647 int EVP_CIPHER_CTX_set_params(EVP_CIPHER_CTX *ctx, const OSSL_PARAM params[])
1648 {
1649 int r = 0;
1650 const OSSL_PARAM *p;
1651
1652 if (ctx->cipher != NULL && ctx->cipher->set_ctx_params != NULL) {
1653 r = ctx->cipher->set_ctx_params(ctx->algctx, params);
1654 if (r > 0) {
1655 p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_KEYLEN);
1656 if (p != NULL && !OSSL_PARAM_get_int(p, &ctx->key_len)) {
1657 r = 0;
1658 ctx->key_len = -1;
1659 }
1660 }
1661 if (r > 0) {
1662 p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_IVLEN);
1663 if (p != NULL && !OSSL_PARAM_get_int(p, &ctx->iv_len)) {
1664 r = 0;
1665 ctx->iv_len = -1;
1666 }
1667 }
1668 }
1669 return r;
1670 }
1671
EVP_CIPHER_CTX_get_params(EVP_CIPHER_CTX * ctx,OSSL_PARAM params[])1672 int EVP_CIPHER_CTX_get_params(EVP_CIPHER_CTX *ctx, OSSL_PARAM params[])
1673 {
1674 if (ctx->cipher != NULL && ctx->cipher->get_ctx_params != NULL)
1675 return ctx->cipher->get_ctx_params(ctx->algctx, params);
1676 return 0;
1677 }
1678
EVP_CIPHER_gettable_params(const EVP_CIPHER * cipher)1679 const OSSL_PARAM *EVP_CIPHER_gettable_params(const EVP_CIPHER *cipher)
1680 {
1681 if (cipher != NULL && cipher->gettable_params != NULL)
1682 return cipher->gettable_params(
1683 ossl_provider_ctx(EVP_CIPHER_get0_provider(cipher)));
1684 return NULL;
1685 }
1686
EVP_CIPHER_settable_ctx_params(const EVP_CIPHER * cipher)1687 const OSSL_PARAM *EVP_CIPHER_settable_ctx_params(const EVP_CIPHER *cipher)
1688 {
1689 void *provctx;
1690
1691 if (cipher != NULL && cipher->settable_ctx_params != NULL) {
1692 provctx = ossl_provider_ctx(EVP_CIPHER_get0_provider(cipher));
1693 return cipher->settable_ctx_params(NULL, provctx);
1694 }
1695 return NULL;
1696 }
1697
EVP_CIPHER_gettable_ctx_params(const EVP_CIPHER * cipher)1698 const OSSL_PARAM *EVP_CIPHER_gettable_ctx_params(const EVP_CIPHER *cipher)
1699 {
1700 void *provctx;
1701
1702 if (cipher != NULL && cipher->gettable_ctx_params != NULL) {
1703 provctx = ossl_provider_ctx(EVP_CIPHER_get0_provider(cipher));
1704 return cipher->gettable_ctx_params(NULL, provctx);
1705 }
1706 return NULL;
1707 }
1708
EVP_CIPHER_CTX_settable_params(EVP_CIPHER_CTX * cctx)1709 const OSSL_PARAM *EVP_CIPHER_CTX_settable_params(EVP_CIPHER_CTX *cctx)
1710 {
1711 void *alg;
1712
1713 if (cctx != NULL && cctx->cipher->settable_ctx_params != NULL) {
1714 alg = ossl_provider_ctx(EVP_CIPHER_get0_provider(cctx->cipher));
1715 return cctx->cipher->settable_ctx_params(cctx->algctx, alg);
1716 }
1717 return NULL;
1718 }
1719
EVP_CIPHER_CTX_gettable_params(EVP_CIPHER_CTX * cctx)1720 const OSSL_PARAM *EVP_CIPHER_CTX_gettable_params(EVP_CIPHER_CTX *cctx)
1721 {
1722 void *provctx;
1723
1724 if (cctx != NULL && cctx->cipher->gettable_ctx_params != NULL) {
1725 provctx = ossl_provider_ctx(EVP_CIPHER_get0_provider(cctx->cipher));
1726 return cctx->cipher->gettable_ctx_params(cctx->algctx, provctx);
1727 }
1728 return NULL;
1729 }
1730
1731 #ifndef FIPS_MODULE
EVP_CIPHER_CTX_get_libctx(EVP_CIPHER_CTX * ctx)1732 static OSSL_LIB_CTX *EVP_CIPHER_CTX_get_libctx(EVP_CIPHER_CTX *ctx)
1733 {
1734 const EVP_CIPHER *cipher = ctx->cipher;
1735 const OSSL_PROVIDER *prov;
1736
1737 if (cipher == NULL)
1738 return NULL;
1739
1740 prov = EVP_CIPHER_get0_provider(cipher);
1741 return ossl_provider_libctx(prov);
1742 }
1743 #endif
1744
EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX * ctx,unsigned char * key)1745 int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key)
1746 {
1747 if (ctx->cipher->flags & EVP_CIPH_RAND_KEY)
1748 return EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_RAND_KEY, 0, key);
1749
1750 #ifdef FIPS_MODULE
1751 return 0;
1752 #else
1753 {
1754 int kl;
1755 OSSL_LIB_CTX *libctx = EVP_CIPHER_CTX_get_libctx(ctx);
1756
1757 kl = EVP_CIPHER_CTX_get_key_length(ctx);
1758 if (kl <= 0 || RAND_priv_bytes_ex(libctx, key, kl, 0) <= 0)
1759 return 0;
1760 return 1;
1761 }
1762 #endif /* FIPS_MODULE */
1763 }
1764
EVP_CIPHER_CTX_dup(const EVP_CIPHER_CTX * in)1765 EVP_CIPHER_CTX *EVP_CIPHER_CTX_dup(const EVP_CIPHER_CTX *in)
1766 {
1767 EVP_CIPHER_CTX *out = EVP_CIPHER_CTX_new();
1768
1769 if (out != NULL && !EVP_CIPHER_CTX_copy(out, in)) {
1770 EVP_CIPHER_CTX_free(out);
1771 out = NULL;
1772 }
1773 return out;
1774 }
1775
EVP_CIPHER_CTX_copy(EVP_CIPHER_CTX * out,const EVP_CIPHER_CTX * in)1776 int EVP_CIPHER_CTX_copy(EVP_CIPHER_CTX *out, const EVP_CIPHER_CTX *in)
1777 {
1778 if ((in == NULL) || (in->cipher == NULL)) {
1779 ERR_raise(ERR_LIB_EVP, EVP_R_INPUT_NOT_INITIALIZED);
1780 return 0;
1781 }
1782
1783 if (in->cipher->prov == NULL)
1784 goto legacy;
1785
1786 if (in->cipher->dupctx == NULL) {
1787 ERR_raise(ERR_LIB_EVP, EVP_R_NOT_ABLE_TO_COPY_CTX);
1788 return 0;
1789 }
1790
1791 EVP_CIPHER_CTX_reset(out);
1792
1793 *out = *in;
1794 out->algctx = NULL;
1795
1796 if (in->fetched_cipher != NULL && !EVP_CIPHER_up_ref(in->fetched_cipher)) {
1797 out->fetched_cipher = NULL;
1798 return 0;
1799 }
1800
1801 out->algctx = in->cipher->dupctx(in->algctx);
1802 if (out->algctx == NULL) {
1803 ERR_raise(ERR_LIB_EVP, EVP_R_NOT_ABLE_TO_COPY_CTX);
1804 return 0;
1805 }
1806
1807 return 1;
1808
1809 /* Code below to be removed when legacy support is dropped. */
1810 legacy:
1811
1812 #if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
1813 /* Make sure it's safe to copy a cipher context using an ENGINE */
1814 if (in->engine && !ENGINE_init(in->engine)) {
1815 ERR_raise(ERR_LIB_EVP, ERR_R_ENGINE_LIB);
1816 return 0;
1817 }
1818 #endif
1819
1820 EVP_CIPHER_CTX_reset(out);
1821 memcpy(out, in, sizeof(*out));
1822
1823 if (in->cipher_data && in->cipher->ctx_size) {
1824 out->cipher_data = OPENSSL_malloc(in->cipher->ctx_size);
1825 if (out->cipher_data == NULL) {
1826 out->cipher = NULL;
1827 return 0;
1828 }
1829 memcpy(out->cipher_data, in->cipher_data, in->cipher->ctx_size);
1830 }
1831
1832 if (in->cipher->flags & EVP_CIPH_CUSTOM_COPY)
1833 if (!in->cipher->ctrl((EVP_CIPHER_CTX *)in, EVP_CTRL_COPY, 0, out)) {
1834 out->cipher = NULL;
1835 ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
1836 return 0;
1837 }
1838 return 1;
1839 }
1840
evp_cipher_new(void)1841 EVP_CIPHER *evp_cipher_new(void)
1842 {
1843 EVP_CIPHER *cipher = OPENSSL_zalloc(sizeof(EVP_CIPHER));
1844
1845 if (cipher != NULL && !CRYPTO_NEW_REF(&cipher->refcnt, 1)) {
1846 OPENSSL_free(cipher);
1847 return NULL;
1848 }
1849 return cipher;
1850 }
1851
1852 /*
1853 * FIPS module note: since internal fetches will be entirely
1854 * provider based, we know that none of its code depends on legacy
1855 * NIDs or any functionality that use them.
1856 */
1857 #ifndef FIPS_MODULE
1858 /* After removal of legacy support get rid of the need for legacy NIDs */
set_legacy_nid(const char * name,void * vlegacy_nid)1859 static void set_legacy_nid(const char *name, void *vlegacy_nid)
1860 {
1861 int nid;
1862 int *legacy_nid = vlegacy_nid;
1863 /*
1864 * We use lowest level function to get the associated method, because
1865 * higher level functions such as EVP_get_cipherbyname() have changed
1866 * to look at providers too.
1867 */
1868 const void *legacy_method = OBJ_NAME_get(name, OBJ_NAME_TYPE_CIPHER_METH);
1869
1870 if (*legacy_nid == -1) /* We found a clash already */
1871 return;
1872 if (legacy_method == NULL)
1873 return;
1874 nid = EVP_CIPHER_get_nid(legacy_method);
1875 if (*legacy_nid != NID_undef && *legacy_nid != nid) {
1876 *legacy_nid = -1;
1877 return;
1878 }
1879 *legacy_nid = nid;
1880 }
1881 #endif
1882
evp_cipher_from_algorithm(const int name_id,const OSSL_ALGORITHM * algodef,OSSL_PROVIDER * prov)1883 static void *evp_cipher_from_algorithm(const int name_id,
1884 const OSSL_ALGORITHM *algodef,
1885 OSSL_PROVIDER *prov)
1886 {
1887 const OSSL_DISPATCH *fns = algodef->implementation;
1888 EVP_CIPHER *cipher = NULL;
1889 int fnciphcnt = 0, encinit = 0, decinit = 0, fnpipecnt = 0, fnctxcnt = 0;
1890
1891 if ((cipher = evp_cipher_new()) == NULL) {
1892 ERR_raise(ERR_LIB_EVP, ERR_R_EVP_LIB);
1893 return NULL;
1894 }
1895
1896 #ifndef FIPS_MODULE
1897 cipher->nid = NID_undef;
1898 if (!evp_names_do_all(prov, name_id, set_legacy_nid, &cipher->nid)
1899 || cipher->nid == -1) {
1900 ERR_raise(ERR_LIB_EVP, ERR_R_INTERNAL_ERROR);
1901 goto err;
1902 }
1903 #endif
1904
1905 cipher->name_id = name_id;
1906 if ((cipher->type_name = ossl_algorithm_get1_first_name(algodef)) == NULL)
1907 goto err;
1908
1909 cipher->description = algodef->algorithm_description;
1910
1911 for (; fns->function_id != 0; fns++) {
1912 switch (fns->function_id) {
1913 case OSSL_FUNC_CIPHER_NEWCTX:
1914 if (cipher->newctx != NULL)
1915 break;
1916 cipher->newctx = OSSL_FUNC_cipher_newctx(fns);
1917 fnctxcnt++;
1918 break;
1919 case OSSL_FUNC_CIPHER_ENCRYPT_INIT:
1920 if (cipher->einit != NULL)
1921 break;
1922 cipher->einit = OSSL_FUNC_cipher_encrypt_init(fns);
1923 encinit = 1;
1924 break;
1925 case OSSL_FUNC_CIPHER_DECRYPT_INIT:
1926 if (cipher->dinit != NULL)
1927 break;
1928 cipher->dinit = OSSL_FUNC_cipher_decrypt_init(fns);
1929 decinit = 1;
1930 break;
1931 case OSSL_FUNC_CIPHER_ENCRYPT_SKEY_INIT:
1932 if (cipher->einit_skey != NULL)
1933 break;
1934 cipher->einit_skey = OSSL_FUNC_cipher_encrypt_skey_init(fns);
1935 encinit = 1;
1936 break;
1937 case OSSL_FUNC_CIPHER_DECRYPT_SKEY_INIT:
1938 if (cipher->dinit_skey != NULL)
1939 break;
1940 cipher->dinit_skey = OSSL_FUNC_cipher_decrypt_skey_init(fns);
1941 decinit = 1;
1942 break;
1943 case OSSL_FUNC_CIPHER_UPDATE:
1944 if (cipher->cupdate != NULL)
1945 break;
1946 cipher->cupdate = OSSL_FUNC_cipher_update(fns);
1947 fnciphcnt++;
1948 break;
1949 case OSSL_FUNC_CIPHER_FINAL:
1950 if (cipher->cfinal != NULL)
1951 break;
1952 cipher->cfinal = OSSL_FUNC_cipher_final(fns);
1953 fnciphcnt++;
1954 break;
1955 case OSSL_FUNC_CIPHER_CIPHER:
1956 if (cipher->ccipher != NULL)
1957 break;
1958 cipher->ccipher = OSSL_FUNC_cipher_cipher(fns);
1959 break;
1960 case OSSL_FUNC_CIPHER_PIPELINE_ENCRYPT_INIT:
1961 if (cipher->p_einit != NULL)
1962 break;
1963 cipher->p_einit = OSSL_FUNC_cipher_pipeline_encrypt_init(fns);
1964 fnpipecnt++;
1965 break;
1966 case OSSL_FUNC_CIPHER_PIPELINE_DECRYPT_INIT:
1967 if (cipher->p_dinit != NULL)
1968 break;
1969 cipher->p_dinit = OSSL_FUNC_cipher_pipeline_decrypt_init(fns);
1970 fnpipecnt++;
1971 break;
1972 case OSSL_FUNC_CIPHER_PIPELINE_UPDATE:
1973 if (cipher->p_cupdate != NULL)
1974 break;
1975 cipher->p_cupdate = OSSL_FUNC_cipher_pipeline_update(fns);
1976 fnpipecnt++;
1977 break;
1978 case OSSL_FUNC_CIPHER_PIPELINE_FINAL:
1979 if (cipher->p_cfinal != NULL)
1980 break;
1981 cipher->p_cfinal = OSSL_FUNC_cipher_pipeline_final(fns);
1982 fnpipecnt++;
1983 break;
1984 case OSSL_FUNC_CIPHER_FREECTX:
1985 if (cipher->freectx != NULL)
1986 break;
1987 cipher->freectx = OSSL_FUNC_cipher_freectx(fns);
1988 fnctxcnt++;
1989 break;
1990 case OSSL_FUNC_CIPHER_DUPCTX:
1991 if (cipher->dupctx != NULL)
1992 break;
1993 cipher->dupctx = OSSL_FUNC_cipher_dupctx(fns);
1994 break;
1995 case OSSL_FUNC_CIPHER_GET_PARAMS:
1996 if (cipher->get_params != NULL)
1997 break;
1998 cipher->get_params = OSSL_FUNC_cipher_get_params(fns);
1999 break;
2000 case OSSL_FUNC_CIPHER_GET_CTX_PARAMS:
2001 if (cipher->get_ctx_params != NULL)
2002 break;
2003 cipher->get_ctx_params = OSSL_FUNC_cipher_get_ctx_params(fns);
2004 break;
2005 case OSSL_FUNC_CIPHER_SET_CTX_PARAMS:
2006 if (cipher->set_ctx_params != NULL)
2007 break;
2008 cipher->set_ctx_params = OSSL_FUNC_cipher_set_ctx_params(fns);
2009 break;
2010 case OSSL_FUNC_CIPHER_GETTABLE_PARAMS:
2011 if (cipher->gettable_params != NULL)
2012 break;
2013 cipher->gettable_params = OSSL_FUNC_cipher_gettable_params(fns);
2014 break;
2015 case OSSL_FUNC_CIPHER_GETTABLE_CTX_PARAMS:
2016 if (cipher->gettable_ctx_params != NULL)
2017 break;
2018 cipher->gettable_ctx_params =
2019 OSSL_FUNC_cipher_gettable_ctx_params(fns);
2020 break;
2021 case OSSL_FUNC_CIPHER_SETTABLE_CTX_PARAMS:
2022 if (cipher->settable_ctx_params != NULL)
2023 break;
2024 cipher->settable_ctx_params =
2025 OSSL_FUNC_cipher_settable_ctx_params(fns);
2026 break;
2027 }
2028 }
2029 fnciphcnt += encinit + decinit;
2030 if ((fnciphcnt != 0 && fnciphcnt != 3 && fnciphcnt != 4)
2031 || (fnciphcnt == 0 && cipher->ccipher == NULL && fnpipecnt == 0)
2032 || (fnpipecnt != 0 && (fnpipecnt < 3 || cipher->p_cupdate == NULL
2033 || cipher->p_cfinal == NULL))
2034 || fnctxcnt != 2) {
2035 /*
2036 * In order to be a consistent set of functions we must have at least
2037 * a complete set of "encrypt" functions, or a complete set of "decrypt"
2038 * functions, or a single "cipher" function. In all cases we need both
2039 * the "newctx" and "freectx" functions.
2040 */
2041 ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_PROVIDER_FUNCTIONS);
2042 goto err;
2043 }
2044 if (prov != NULL && !ossl_provider_up_ref(prov))
2045 goto err;
2046
2047 cipher->prov = prov;
2048
2049 if (!evp_cipher_cache_constants(cipher)) {
2050 ERR_raise(ERR_LIB_EVP, EVP_R_CACHE_CONSTANTS_FAILED);
2051 goto err;
2052 }
2053
2054 return cipher;
2055
2056 err:
2057 EVP_CIPHER_free(cipher);
2058 return NULL;
2059 }
2060
evp_cipher_up_ref(void * cipher)2061 static int evp_cipher_up_ref(void *cipher)
2062 {
2063 return EVP_CIPHER_up_ref(cipher);
2064 }
2065
evp_cipher_free(void * cipher)2066 static void evp_cipher_free(void *cipher)
2067 {
2068 EVP_CIPHER_free(cipher);
2069 }
2070
EVP_CIPHER_fetch(OSSL_LIB_CTX * ctx,const char * algorithm,const char * properties)2071 EVP_CIPHER *EVP_CIPHER_fetch(OSSL_LIB_CTX *ctx, const char *algorithm,
2072 const char *properties)
2073 {
2074 EVP_CIPHER *cipher =
2075 evp_generic_fetch(ctx, OSSL_OP_CIPHER, algorithm, properties,
2076 evp_cipher_from_algorithm, evp_cipher_up_ref,
2077 evp_cipher_free);
2078
2079 return cipher;
2080 }
2081
evp_cipher_fetch_from_prov(OSSL_PROVIDER * prov,const char * algorithm,const char * properties)2082 EVP_CIPHER *evp_cipher_fetch_from_prov(OSSL_PROVIDER *prov,
2083 const char *algorithm,
2084 const char *properties)
2085 {
2086 return evp_generic_fetch_from_prov(prov, OSSL_OP_CIPHER,
2087 algorithm, properties,
2088 evp_cipher_from_algorithm,
2089 evp_cipher_up_ref,
2090 evp_cipher_free);
2091 }
2092
EVP_CIPHER_can_pipeline(const EVP_CIPHER * cipher,int enc)2093 int EVP_CIPHER_can_pipeline(const EVP_CIPHER *cipher, int enc)
2094 {
2095 if (((enc && cipher->p_einit != NULL) || (!enc && cipher->p_dinit != NULL))
2096 && cipher->p_cupdate != NULL && cipher->p_cfinal != NULL)
2097 return 1;
2098
2099 return 0;
2100 }
2101
EVP_CIPHER_up_ref(EVP_CIPHER * cipher)2102 int EVP_CIPHER_up_ref(EVP_CIPHER *cipher)
2103 {
2104 int ref = 0;
2105
2106 if (cipher->origin == EVP_ORIG_DYNAMIC)
2107 CRYPTO_UP_REF(&cipher->refcnt, &ref);
2108 return 1;
2109 }
2110
evp_cipher_free_int(EVP_CIPHER * cipher)2111 void evp_cipher_free_int(EVP_CIPHER *cipher)
2112 {
2113 OPENSSL_free(cipher->type_name);
2114 ossl_provider_free(cipher->prov);
2115 CRYPTO_FREE_REF(&cipher->refcnt);
2116 OPENSSL_free(cipher);
2117 }
2118
EVP_CIPHER_free(EVP_CIPHER * cipher)2119 void EVP_CIPHER_free(EVP_CIPHER *cipher)
2120 {
2121 int i;
2122
2123 if (cipher == NULL || cipher->origin != EVP_ORIG_DYNAMIC)
2124 return;
2125
2126 CRYPTO_DOWN_REF(&cipher->refcnt, &i);
2127 if (i > 0)
2128 return;
2129 evp_cipher_free_int(cipher);
2130 }
2131
EVP_CIPHER_do_all_provided(OSSL_LIB_CTX * libctx,void (* fn)(EVP_CIPHER * mac,void * arg),void * arg)2132 void EVP_CIPHER_do_all_provided(OSSL_LIB_CTX *libctx,
2133 void (*fn)(EVP_CIPHER *mac, void *arg),
2134 void *arg)
2135 {
2136 evp_generic_do_all(libctx, OSSL_OP_CIPHER,
2137 (void (*)(void *, void *))fn, arg,
2138 evp_cipher_from_algorithm, evp_cipher_up_ref,
2139 evp_cipher_free);
2140 }
2141