1 /*
2 * Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 /*
11 * Low level APIs are deprecated for public use, but still ok for internal use.
12 */
13 #include "internal/deprecated.h"
14
15 #include <string.h>
16 #include <openssl/core.h>
17 #include <openssl/core_dispatch.h>
18 #include <openssl/core_names.h>
19 #include <openssl/params.h>
20 #include <openssl/err.h>
21 #include <openssl/pem.h> /* Functions for writing MSBLOB and PVK */
22 #include <openssl/dsa.h>
23 #include "internal/passphrase.h"
24 #include "crypto/rsa.h"
25 #include "prov/implementations.h"
26 #include "prov/bio.h"
27 #include "prov/provider_ctx.h"
28 #include "endecoder_local.h"
29
30 struct key2ms_ctx_st {
31 PROV_CTX *provctx;
32
33 int pvk_encr_level;
34
35 struct ossl_passphrase_data_st pwdata;
36 };
37
write_msblob(struct key2ms_ctx_st * ctx,OSSL_CORE_BIO * cout,EVP_PKEY * pkey,int ispub)38 static int write_msblob(struct key2ms_ctx_st *ctx, OSSL_CORE_BIO *cout,
39 EVP_PKEY *pkey, int ispub)
40 {
41 BIO *out = ossl_bio_new_from_core_bio(ctx->provctx, cout);
42 int ret;
43
44 if (out == NULL)
45 return 0;
46 ret = ispub ? i2b_PublicKey_bio(out, pkey) : i2b_PrivateKey_bio(out, pkey);
47
48 BIO_free(out);
49 return ret;
50 }
51
write_pvk(struct key2ms_ctx_st * ctx,OSSL_CORE_BIO * cout,EVP_PKEY * pkey)52 static int write_pvk(struct key2ms_ctx_st *ctx, OSSL_CORE_BIO *cout,
53 EVP_PKEY *pkey)
54 {
55 BIO *out = NULL;
56 int ret;
57 OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx);
58
59 out = ossl_bio_new_from_core_bio(ctx->provctx, cout);
60 if (out == NULL)
61 return 0;
62 ret = i2b_PVK_bio_ex(out, pkey, ctx->pvk_encr_level,
63 ossl_pw_pvk_password, &ctx->pwdata, libctx, NULL);
64 BIO_free(out);
65 return ret;
66 }
67
68 static OSSL_FUNC_encoder_newctx_fn key2ms_newctx;
69 static OSSL_FUNC_encoder_freectx_fn key2ms_freectx;
70 static OSSL_FUNC_encoder_does_selection_fn key2ms_does_selection;
71
key2ms_newctx(void * provctx)72 static void *key2ms_newctx(void *provctx)
73 {
74 struct key2ms_ctx_st *ctx = OPENSSL_zalloc(sizeof(*ctx));
75
76 if (ctx != NULL) {
77 ctx->provctx = provctx;
78 /* This is the strongest encryption level */
79 ctx->pvk_encr_level = 2;
80 }
81 return ctx;
82 }
83
key2ms_freectx(void * vctx)84 static void key2ms_freectx(void *vctx)
85 {
86 struct key2ms_ctx_st *ctx = vctx;
87
88 ossl_pw_clear_passphrase_data(&ctx->pwdata);
89 OPENSSL_free(ctx);
90 }
91
key2pvk_settable_ctx_params(ossl_unused void * provctx)92 static const OSSL_PARAM *key2pvk_settable_ctx_params(ossl_unused void *provctx)
93 {
94 static const OSSL_PARAM settables[] = {
95 OSSL_PARAM_int(OSSL_ENCODER_PARAM_ENCRYPT_LEVEL, NULL),
96 OSSL_PARAM_END,
97 };
98
99 return settables;
100 }
101
key2pvk_set_ctx_params(void * vctx,const OSSL_PARAM params[])102 static int key2pvk_set_ctx_params(void *vctx, const OSSL_PARAM params[])
103 {
104 struct key2ms_ctx_st *ctx = vctx;
105 const OSSL_PARAM *p;
106
107 p = OSSL_PARAM_locate_const(params, OSSL_ENCODER_PARAM_ENCRYPT_LEVEL);
108 if (p != NULL && !OSSL_PARAM_get_int(p, &ctx->pvk_encr_level))
109 return 0;
110 return 1;
111 }
112
key2ms_does_selection(void * vctx,int selection)113 static int key2ms_does_selection(void *vctx, int selection)
114 {
115 return (selection & OSSL_KEYMGMT_SELECT_KEYPAIR) != 0;
116 }
117
118 /*
119 * The real EVP_PKEY_set1_TYPE() functions take a non-const key, while the key
120 * pointer in the encode function is a const pointer. We violate the constness
121 * knowingly, since we know that the key comes from the same provider, is never
122 * actually const, and the implied reference count change is safe.
123 *
124 * EVP_PKEY_assign() can't be used, because there's no way to clear the internal
125 * key using that function without freeing the existing internal key.
126 */
127 typedef int evp_pkey_set1_fn(EVP_PKEY *, const void *key);
128
key2msblob_encode(void * vctx,const void * key,int selection,OSSL_CORE_BIO * cout,evp_pkey_set1_fn * set1_key,OSSL_PASSPHRASE_CALLBACK * pw_cb,void * pw_cbarg)129 static int key2msblob_encode(void *vctx, const void *key, int selection,
130 OSSL_CORE_BIO *cout, evp_pkey_set1_fn *set1_key,
131 OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg)
132 {
133 struct key2ms_ctx_st *ctx = vctx;
134 int ispub = -1;
135 EVP_PKEY *pkey = NULL;
136 int ok = 0;
137
138 if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0)
139 ispub = 0;
140 else if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0)
141 ispub = 1;
142 else
143 return 0; /* Error */
144
145 if ((pkey = EVP_PKEY_new()) != NULL && set1_key(pkey, key))
146 ok = write_msblob(ctx, cout, pkey, ispub);
147 EVP_PKEY_free(pkey);
148 return ok;
149 }
150
key2pvk_encode(void * vctx,const void * key,int selection,OSSL_CORE_BIO * cout,evp_pkey_set1_fn * set1_key,OSSL_PASSPHRASE_CALLBACK * pw_cb,void * pw_cbarg)151 static int key2pvk_encode(void *vctx, const void *key, int selection,
152 OSSL_CORE_BIO *cout, evp_pkey_set1_fn *set1_key,
153 OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg)
154 {
155 struct key2ms_ctx_st *ctx = vctx;
156 EVP_PKEY *pkey = NULL;
157 int ok = 0;
158
159 if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) == 0)
160 return 0; /* Error */
161
162 if ((pkey = EVP_PKEY_new()) != NULL && set1_key(pkey, key)
163 && (pw_cb == NULL
164 || ossl_pw_set_ossl_passphrase_cb(&ctx->pwdata, pw_cb, pw_cbarg)))
165 ok = write_pvk(ctx, cout, pkey);
166 EVP_PKEY_free(pkey);
167 return ok;
168 }
169
170 #define dsa_set1 (evp_pkey_set1_fn *)EVP_PKEY_set1_DSA
171 #define rsa_set1 (evp_pkey_set1_fn *)EVP_PKEY_set1_RSA
172
173 #define msblob_set_params
174 #define pvk_set_params \
175 { OSSL_FUNC_ENCODER_SETTABLE_CTX_PARAMS, \
176 (void (*)(void))key2pvk_settable_ctx_params }, \
177 { OSSL_FUNC_ENCODER_SET_CTX_PARAMS, \
178 (void (*)(void))key2pvk_set_ctx_params },
179
180 #define MAKE_MS_ENCODER(impl, output, type) \
181 static OSSL_FUNC_encoder_import_object_fn \
182 impl##2##output##_import_object; \
183 static OSSL_FUNC_encoder_free_object_fn impl##2##output##_free_object; \
184 static OSSL_FUNC_encoder_encode_fn impl##2##output##_encode; \
185 \
186 static void * \
187 impl##2##output##_import_object(void *ctx, int selection, \
188 const OSSL_PARAM params[]) \
189 { \
190 return ossl_prov_import_key(ossl_##impl##_keymgmt_functions, \
191 ctx, selection, params); \
192 } \
193 static void impl##2##output##_free_object(void *key) \
194 { \
195 ossl_prov_free_key(ossl_##impl##_keymgmt_functions, key); \
196 } \
197 static int impl##2##output##_encode(void *vctx, OSSL_CORE_BIO *cout, \
198 const void *key, \
199 const OSSL_PARAM key_abstract[], \
200 int selection, \
201 OSSL_PASSPHRASE_CALLBACK *cb, \
202 void *cbarg) \
203 { \
204 /* We don't deal with abstract objects */ \
205 if (key_abstract != NULL) { \
206 ERR_raise(ERR_LIB_PROV, ERR_R_PASSED_INVALID_ARGUMENT); \
207 return 0; \
208 } \
209 return key2##output##_encode(vctx, key, selection, cout, type##_set1, \
210 cb, cbarg); \
211 } \
212 const OSSL_DISPATCH ossl_##impl##_to_##output##_encoder_functions[] = { \
213 { OSSL_FUNC_ENCODER_NEWCTX, \
214 (void (*)(void))key2ms_newctx }, \
215 { OSSL_FUNC_ENCODER_FREECTX, \
216 (void (*)(void))key2ms_freectx }, \
217 output##_set_params { OSSL_FUNC_ENCODER_DOES_SELECTION, \
218 (void (*)(void))key2ms_does_selection }, \
219 { OSSL_FUNC_ENCODER_IMPORT_OBJECT, \
220 (void (*)(void))impl##2##output##_import_object }, \
221 { OSSL_FUNC_ENCODER_FREE_OBJECT, \
222 (void (*)(void))impl##2##output##_free_object }, \
223 { OSSL_FUNC_ENCODER_ENCODE, \
224 (void (*)(void))impl##2##output##_encode }, \
225 OSSL_DISPATCH_END \
226 }
227
228 #ifndef OPENSSL_NO_DSA
229 MAKE_MS_ENCODER(dsa, pvk, dsa);
230 MAKE_MS_ENCODER(dsa, msblob, dsa);
231 #endif
232
233 MAKE_MS_ENCODER(rsa, pvk, rsa);
234 MAKE_MS_ENCODER(rsa, msblob, rsa);
235