1 /*
2 * Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 #include <stdio.h>
11 #include <stdlib.h>
12 #include "internal/cryptlib.h"
13 #include <openssl/objects.h>
14 #include <openssl/evp.h>
15 #include "crypto/bn.h"
16 #ifndef FIPS_MODULE
17 # include "crypto/asn1.h"
18 #endif
19 #include "crypto/evp.h"
20 #include "evp_local.h"
21
22 /*
23 * Returns:
24 * 1 True
25 * 0 False
26 * -1 Unsupported (use legacy path)
27 */
try_provided_check(EVP_PKEY_CTX * ctx,int selection,int checktype)28 static int try_provided_check(EVP_PKEY_CTX *ctx, int selection, int checktype)
29 {
30 EVP_KEYMGMT *keymgmt;
31 void *keydata;
32
33 if (evp_pkey_ctx_is_legacy(ctx))
34 return -1;
35
36 keymgmt = ctx->keymgmt;
37 keydata = evp_pkey_export_to_provider(ctx->pkey, ctx->libctx,
38 &keymgmt, ctx->propquery);
39 if (keydata == NULL) {
40 ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
41 return 0;
42 }
43
44 return evp_keymgmt_validate(keymgmt, keydata, selection, checktype);
45 }
46
evp_pkey_public_check_combined(EVP_PKEY_CTX * ctx,int checktype)47 static int evp_pkey_public_check_combined(EVP_PKEY_CTX *ctx, int checktype)
48 {
49 EVP_PKEY *pkey = ctx->pkey;
50 int ok;
51
52 if (pkey == NULL) {
53 ERR_raise(ERR_LIB_EVP, EVP_R_NO_KEY_SET);
54 return 0;
55 }
56
57 if ((ok = try_provided_check(ctx, OSSL_KEYMGMT_SELECT_PUBLIC_KEY,
58 checktype)) != -1)
59 return ok;
60
61 if (pkey->type == EVP_PKEY_NONE)
62 goto not_supported;
63
64 #ifndef FIPS_MODULE
65 /* legacy */
66 /* call customized public key check function first */
67 if (ctx->pmeth->public_check != NULL)
68 return ctx->pmeth->public_check(pkey);
69
70 /* use default public key check function in ameth */
71 if (pkey->ameth == NULL || pkey->ameth->pkey_public_check == NULL)
72 goto not_supported;
73
74 return pkey->ameth->pkey_public_check(pkey);
75 #endif
76 not_supported:
77 ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
78 return -2;
79 }
80
EVP_PKEY_public_check(EVP_PKEY_CTX * ctx)81 int EVP_PKEY_public_check(EVP_PKEY_CTX *ctx)
82 {
83 return evp_pkey_public_check_combined(ctx, OSSL_KEYMGMT_VALIDATE_FULL_CHECK);
84 }
85
EVP_PKEY_public_check_quick(EVP_PKEY_CTX * ctx)86 int EVP_PKEY_public_check_quick(EVP_PKEY_CTX *ctx)
87 {
88 return evp_pkey_public_check_combined(ctx, OSSL_KEYMGMT_VALIDATE_QUICK_CHECK);
89 }
90
evp_pkey_param_check_combined(EVP_PKEY_CTX * ctx,int checktype)91 static int evp_pkey_param_check_combined(EVP_PKEY_CTX *ctx, int checktype)
92 {
93 EVP_PKEY *pkey = ctx->pkey;
94 int ok;
95
96 if (pkey == NULL) {
97 ERR_raise(ERR_LIB_EVP, EVP_R_NO_KEY_SET);
98 return 0;
99 }
100
101 if ((ok = try_provided_check(ctx,
102 OSSL_KEYMGMT_SELECT_ALL_PARAMETERS,
103 checktype)) != -1)
104 return ok;
105
106 if (pkey->type == EVP_PKEY_NONE)
107 goto not_supported;
108
109 #ifndef FIPS_MODULE
110 /* legacy */
111 /* call customized param check function first */
112 if (ctx->pmeth->param_check != NULL)
113 return ctx->pmeth->param_check(pkey);
114
115 /* use default param check function in ameth */
116 if (pkey->ameth == NULL || pkey->ameth->pkey_param_check == NULL)
117 goto not_supported;
118
119 return pkey->ameth->pkey_param_check(pkey);
120 #endif
121 not_supported:
122 ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
123 return -2;
124 }
125
EVP_PKEY_param_check(EVP_PKEY_CTX * ctx)126 int EVP_PKEY_param_check(EVP_PKEY_CTX *ctx)
127 {
128 return evp_pkey_param_check_combined(ctx, OSSL_KEYMGMT_VALIDATE_FULL_CHECK);
129 }
130
EVP_PKEY_param_check_quick(EVP_PKEY_CTX * ctx)131 int EVP_PKEY_param_check_quick(EVP_PKEY_CTX *ctx)
132 {
133 return evp_pkey_param_check_combined(ctx, OSSL_KEYMGMT_VALIDATE_QUICK_CHECK);
134 }
135
EVP_PKEY_private_check(EVP_PKEY_CTX * ctx)136 int EVP_PKEY_private_check(EVP_PKEY_CTX *ctx)
137 {
138 EVP_PKEY *pkey = ctx->pkey;
139 int ok;
140
141 if (pkey == NULL) {
142 ERR_raise(ERR_LIB_EVP, EVP_R_NO_KEY_SET);
143 return 0;
144 }
145
146 if ((ok = try_provided_check(ctx, OSSL_KEYMGMT_SELECT_PRIVATE_KEY,
147 OSSL_KEYMGMT_VALIDATE_FULL_CHECK)) != -1)
148 return ok;
149
150 /* not supported for legacy keys */
151 ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
152 return -2;
153 }
154
EVP_PKEY_check(EVP_PKEY_CTX * ctx)155 int EVP_PKEY_check(EVP_PKEY_CTX *ctx)
156 {
157 return EVP_PKEY_pairwise_check(ctx);
158 }
159
EVP_PKEY_pairwise_check(EVP_PKEY_CTX * ctx)160 int EVP_PKEY_pairwise_check(EVP_PKEY_CTX *ctx)
161 {
162 EVP_PKEY *pkey = ctx->pkey;
163 int ok;
164
165 if (pkey == NULL) {
166 ERR_raise(ERR_LIB_EVP, EVP_R_NO_KEY_SET);
167 return 0;
168 }
169
170 if ((ok = try_provided_check(ctx, OSSL_KEYMGMT_SELECT_KEYPAIR,
171 OSSL_KEYMGMT_VALIDATE_FULL_CHECK)) != -1)
172 return ok;
173
174 if (pkey->type == EVP_PKEY_NONE)
175 goto not_supported;
176
177 #ifndef FIPS_MODULE
178 /* legacy */
179 /* call customized check function first */
180 if (ctx->pmeth->check != NULL)
181 return ctx->pmeth->check(pkey);
182
183 /* use default check function in ameth */
184 if (pkey->ameth == NULL || pkey->ameth->pkey_check == NULL)
185 goto not_supported;
186
187 return pkey->ameth->pkey_check(pkey);
188 #endif
189 not_supported:
190 ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
191 return -2;
192 }
193
194