1 /* 2 * Copyright 2020-2023 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 /* 11 * low level APIs are deprecated for public use, but still ok for 12 * internal use. 13 */ 14 #include "internal/deprecated.h" 15 16 #include <openssl/core_dispatch.h> 17 #include <openssl/core_names.h> 18 #include <openssl/core_object.h> 19 #include <openssl/crypto.h> 20 #include <openssl/err.h> 21 #include <openssl/params.h> 22 #include <openssl/pem.h> /* PEM_BUFSIZE and public PEM functions */ 23 #include <openssl/pkcs12.h> 24 #include <openssl/x509.h> 25 #include <openssl/proverr.h> 26 #include "internal/cryptlib.h" /* ossl_assert() */ 27 #include "internal/asn1.h" 28 #include "crypto/dh.h" 29 #include "crypto/dsa.h" 30 #include "crypto/ec.h" 31 #include "crypto/evp.h" 32 #include "crypto/ecx.h" 33 #include "crypto/rsa.h" 34 #include "crypto/x509.h" 35 #include "prov/bio.h" 36 #include "prov/implementations.h" 37 #include "endecoder_local.h" 38 39 struct der2key_ctx_st; /* Forward declaration */ 40 typedef int check_key_fn(void *, struct der2key_ctx_st *ctx); 41 typedef void adjust_key_fn(void *, struct der2key_ctx_st *ctx); 42 typedef void free_key_fn(void *); 43 typedef void *d2i_PKCS8_fn(void **, const unsigned char **, long, 44 struct der2key_ctx_st *); 45 struct keytype_desc_st { 46 const char *keytype_name; 47 const OSSL_DISPATCH *fns; /* Keymgmt (to pilfer functions from) */ 48 49 /* The input structure name */ 50 const char *structure_name; 51 52 /* 53 * The EVP_PKEY_xxx type macro. Should be zero for type specific 54 * structures, non-zero when the outermost structure is PKCS#8 or 55 * SubjectPublicKeyInfo. This determines which of the function 56 * pointers below will be used. 57 */ 58 int evp_type; 59 60 /* The selection mask for OSSL_FUNC_decoder_does_selection() */ 61 int selection_mask; 62 63 /* For type specific decoders, we use the corresponding d2i */ 64 d2i_of_void *d2i_private_key; /* From type-specific DER */ 65 d2i_of_void *d2i_public_key; /* From type-specific DER */ 66 d2i_of_void *d2i_key_params; /* From type-specific DER */ 67 d2i_PKCS8_fn *d2i_PKCS8; /* Wrapped in a PrivateKeyInfo */ 68 d2i_of_void *d2i_PUBKEY; /* Wrapped in a SubjectPublicKeyInfo */ 69 70 /* 71 * For any key, we may need to check that the key meets expectations. 72 * This is useful when the same functions can decode several variants 73 * of a key. 74 */ 75 check_key_fn *check_key; 76 77 /* 78 * For any key, we may need to make provider specific adjustments, such 79 * as ensure the key carries the correct library context. 80 */ 81 adjust_key_fn *adjust_key; 82 /* {type}_free() */ 83 free_key_fn *free_key; 84 }; 85 86 /* 87 * Context used for DER to key decoding. 88 */ 89 struct der2key_ctx_st { 90 PROV_CTX *provctx; 91 const struct keytype_desc_st *desc; 92 /* The selection that is passed to der2key_decode() */ 93 int selection; 94 /* Flag used to signal that a failure is fatal */ 95 unsigned int flag_fatal : 1; 96 }; 97 98 typedef void *key_from_pkcs8_t(const PKCS8_PRIV_KEY_INFO *p8inf, 99 OSSL_LIB_CTX *libctx, const char *propq); 100 static void *der2key_decode_p8(const unsigned char **input_der, 101 long input_der_len, struct der2key_ctx_st *ctx, 102 key_from_pkcs8_t *key_from_pkcs8) 103 { 104 PKCS8_PRIV_KEY_INFO *p8inf = NULL; 105 const X509_ALGOR *alg = NULL; 106 void *key = NULL; 107 108 if ((p8inf = d2i_PKCS8_PRIV_KEY_INFO(NULL, input_der, input_der_len)) != NULL 109 && PKCS8_pkey_get0(NULL, NULL, NULL, &alg, p8inf) 110 && OBJ_obj2nid(alg->algorithm) == ctx->desc->evp_type) 111 key = key_from_pkcs8(p8inf, PROV_LIBCTX_OF(ctx->provctx), NULL); 112 PKCS8_PRIV_KEY_INFO_free(p8inf); 113 114 return key; 115 } 116 117 /* ---------------------------------------------------------------------- */ 118 119 static OSSL_FUNC_decoder_freectx_fn der2key_freectx; 120 static OSSL_FUNC_decoder_decode_fn der2key_decode; 121 static OSSL_FUNC_decoder_export_object_fn der2key_export_object; 122 123 static struct der2key_ctx_st * 124 der2key_newctx(void *provctx, const struct keytype_desc_st *desc) 125 { 126 struct der2key_ctx_st *ctx = OPENSSL_zalloc(sizeof(*ctx)); 127 128 if (ctx != NULL) { 129 ctx->provctx = provctx; 130 ctx->desc = desc; 131 } 132 return ctx; 133 } 134 135 static void der2key_freectx(void *vctx) 136 { 137 struct der2key_ctx_st *ctx = vctx; 138 139 OPENSSL_free(ctx); 140 } 141 142 static int der2key_check_selection(int selection, 143 const struct keytype_desc_st *desc) 144 { 145 /* 146 * The selections are kinda sorta "levels", i.e. each selection given 147 * here is assumed to include those following. 148 */ 149 int checks[] = { 150 OSSL_KEYMGMT_SELECT_PRIVATE_KEY, 151 OSSL_KEYMGMT_SELECT_PUBLIC_KEY, 152 OSSL_KEYMGMT_SELECT_ALL_PARAMETERS 153 }; 154 size_t i; 155 156 /* The decoder implementations made here support guessing */ 157 if (selection == 0) 158 return 1; 159 160 for (i = 0; i < OSSL_NELEM(checks); i++) { 161 int check1 = (selection & checks[i]) != 0; 162 int check2 = (desc->selection_mask & checks[i]) != 0; 163 164 /* 165 * If the caller asked for the currently checked bit(s), return 166 * whether the decoder description says it's supported. 167 */ 168 if (check1) 169 return check2; 170 } 171 172 /* This should be dead code, but just to be safe... */ 173 return 0; 174 } 175 176 static int der2key_decode(void *vctx, OSSL_CORE_BIO *cin, int selection, 177 OSSL_CALLBACK *data_cb, void *data_cbarg, 178 OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg) 179 { 180 struct der2key_ctx_st *ctx = vctx; 181 unsigned char *der = NULL; 182 const unsigned char *derp; 183 long der_len = 0; 184 void *key = NULL; 185 int ok = 0; 186 187 ctx->selection = selection; 188 /* 189 * The caller is allowed to specify 0 as a selection mark, to have the 190 * structure and key type guessed. For type-specific structures, this 191 * is not recommended, as some structures are very similar. 192 * Note that 0 isn't the same as OSSL_KEYMGMT_SELECT_ALL, as the latter 193 * signifies a private key structure, where everything else is assumed 194 * to be present as well. 195 */ 196 if (selection == 0) 197 selection = ctx->desc->selection_mask; 198 if ((selection & ctx->desc->selection_mask) == 0) { 199 ERR_raise(ERR_LIB_PROV, ERR_R_PASSED_INVALID_ARGUMENT); 200 return 0; 201 } 202 203 ok = ossl_read_der(ctx->provctx, cin, &der, &der_len); 204 if (!ok) 205 goto next; 206 207 ok = 0; /* Assume that we fail */ 208 209 ERR_set_mark(); 210 if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0) { 211 derp = der; 212 if (ctx->desc->d2i_PKCS8 != NULL) { 213 key = ctx->desc->d2i_PKCS8(NULL, &derp, der_len, ctx); 214 if (ctx->flag_fatal) { 215 ERR_clear_last_mark(); 216 goto end; 217 } 218 } else if (ctx->desc->d2i_private_key != NULL) { 219 key = ctx->desc->d2i_private_key(NULL, &derp, der_len); 220 } 221 if (key == NULL && ctx->selection != 0) { 222 ERR_clear_last_mark(); 223 goto next; 224 } 225 } 226 if (key == NULL && (selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0) { 227 derp = der; 228 if (ctx->desc->d2i_PUBKEY != NULL) 229 key = ctx->desc->d2i_PUBKEY(NULL, &derp, der_len); 230 else if (ctx->desc->d2i_public_key != NULL) 231 key = ctx->desc->d2i_public_key(NULL, &derp, der_len); 232 if (key == NULL && ctx->selection != 0) { 233 ERR_clear_last_mark(); 234 goto next; 235 } 236 } 237 if (key == NULL && (selection & OSSL_KEYMGMT_SELECT_ALL_PARAMETERS) != 0) { 238 derp = der; 239 if (ctx->desc->d2i_key_params != NULL) 240 key = ctx->desc->d2i_key_params(NULL, &derp, der_len); 241 if (key == NULL && ctx->selection != 0) { 242 ERR_clear_last_mark(); 243 goto next; 244 } 245 } 246 if (key == NULL) 247 ERR_clear_last_mark(); 248 else 249 ERR_pop_to_mark(); 250 251 /* 252 * Last minute check to see if this was the correct type of key. This 253 * should never lead to a fatal error, i.e. the decoding itself was 254 * correct, it was just an unexpected key type. This is generally for 255 * classes of key types that have subtle variants, like RSA-PSS keys as 256 * opposed to plain RSA keys. 257 */ 258 if (key != NULL 259 && ctx->desc->check_key != NULL 260 && !ctx->desc->check_key(key, ctx)) { 261 ctx->desc->free_key(key); 262 key = NULL; 263 } 264 265 if (key != NULL && ctx->desc->adjust_key != NULL) 266 ctx->desc->adjust_key(key, ctx); 267 268 next: 269 /* 270 * Indicated that we successfully decoded something, or not at all. 271 * Ending up "empty handed" is not an error. 272 */ 273 ok = 1; 274 275 /* 276 * We free memory here so it's not held up during the callback, because 277 * we know the process is recursive and the allocated chunks of memory 278 * add up. 279 */ 280 OPENSSL_free(der); 281 der = NULL; 282 283 if (key != NULL) { 284 OSSL_PARAM params[4]; 285 int object_type = OSSL_OBJECT_PKEY; 286 287 params[0] = 288 OSSL_PARAM_construct_int(OSSL_OBJECT_PARAM_TYPE, &object_type); 289 params[1] = 290 OSSL_PARAM_construct_utf8_string(OSSL_OBJECT_PARAM_DATA_TYPE, 291 (char *)ctx->desc->keytype_name, 292 0); 293 /* The address of the key becomes the octet string */ 294 params[2] = 295 OSSL_PARAM_construct_octet_string(OSSL_OBJECT_PARAM_REFERENCE, 296 &key, sizeof(key)); 297 params[3] = OSSL_PARAM_construct_end(); 298 299 ok = data_cb(params, data_cbarg); 300 } 301 302 end: 303 ctx->desc->free_key(key); 304 OPENSSL_free(der); 305 306 return ok; 307 } 308 309 static int der2key_export_object(void *vctx, 310 const void *reference, size_t reference_sz, 311 OSSL_CALLBACK *export_cb, void *export_cbarg) 312 { 313 struct der2key_ctx_st *ctx = vctx; 314 OSSL_FUNC_keymgmt_export_fn *export = 315 ossl_prov_get_keymgmt_export(ctx->desc->fns); 316 void *keydata; 317 318 if (reference_sz == sizeof(keydata) && export != NULL) { 319 int selection = ctx->selection; 320 321 if (selection == 0) 322 selection = OSSL_KEYMGMT_SELECT_ALL; 323 /* The contents of the reference is the address to our object */ 324 keydata = *(void **)reference; 325 326 return export(keydata, selection, export_cb, export_cbarg); 327 } 328 return 0; 329 } 330 331 /* ---------------------------------------------------------------------- */ 332 333 #ifndef OPENSSL_NO_DH 334 # define dh_evp_type EVP_PKEY_DH 335 # define dh_d2i_private_key NULL 336 # define dh_d2i_public_key NULL 337 # define dh_d2i_key_params (d2i_of_void *)d2i_DHparams 338 339 static void *dh_d2i_PKCS8(void **key, const unsigned char **der, long der_len, 340 struct der2key_ctx_st *ctx) 341 { 342 return der2key_decode_p8(der, der_len, ctx, 343 (key_from_pkcs8_t *)ossl_dh_key_from_pkcs8); 344 } 345 346 # define dh_d2i_PUBKEY (d2i_of_void *)ossl_d2i_DH_PUBKEY 347 # define dh_free (free_key_fn *)DH_free 348 # define dh_check NULL 349 350 static void dh_adjust(void *key, struct der2key_ctx_st *ctx) 351 { 352 ossl_dh_set0_libctx(key, PROV_LIBCTX_OF(ctx->provctx)); 353 } 354 355 # define dhx_evp_type EVP_PKEY_DHX 356 # define dhx_d2i_private_key NULL 357 # define dhx_d2i_public_key NULL 358 # define dhx_d2i_key_params (d2i_of_void *)d2i_DHxparams 359 # define dhx_d2i_PKCS8 dh_d2i_PKCS8 360 # define dhx_d2i_PUBKEY (d2i_of_void *)ossl_d2i_DHx_PUBKEY 361 # define dhx_free (free_key_fn *)DH_free 362 # define dhx_check NULL 363 # define dhx_adjust dh_adjust 364 #endif 365 366 /* ---------------------------------------------------------------------- */ 367 368 #ifndef OPENSSL_NO_DSA 369 # define dsa_evp_type EVP_PKEY_DSA 370 # define dsa_d2i_private_key (d2i_of_void *)d2i_DSAPrivateKey 371 # define dsa_d2i_public_key (d2i_of_void *)d2i_DSAPublicKey 372 # define dsa_d2i_key_params (d2i_of_void *)d2i_DSAparams 373 374 static void *dsa_d2i_PKCS8(void **key, const unsigned char **der, long der_len, 375 struct der2key_ctx_st *ctx) 376 { 377 return der2key_decode_p8(der, der_len, ctx, 378 (key_from_pkcs8_t *)ossl_dsa_key_from_pkcs8); 379 } 380 381 # define dsa_d2i_PUBKEY (d2i_of_void *)ossl_d2i_DSA_PUBKEY 382 # define dsa_free (free_key_fn *)DSA_free 383 # define dsa_check NULL 384 385 static void dsa_adjust(void *key, struct der2key_ctx_st *ctx) 386 { 387 ossl_dsa_set0_libctx(key, PROV_LIBCTX_OF(ctx->provctx)); 388 } 389 #endif 390 391 /* ---------------------------------------------------------------------- */ 392 393 #ifndef OPENSSL_NO_EC 394 # define ec_evp_type EVP_PKEY_EC 395 # define ec_d2i_private_key (d2i_of_void *)d2i_ECPrivateKey 396 # define ec_d2i_public_key NULL 397 # define ec_d2i_key_params (d2i_of_void *)d2i_ECParameters 398 399 static void *ec_d2i_PKCS8(void **key, const unsigned char **der, long der_len, 400 struct der2key_ctx_st *ctx) 401 { 402 return der2key_decode_p8(der, der_len, ctx, 403 (key_from_pkcs8_t *)ossl_ec_key_from_pkcs8); 404 } 405 406 # define ec_d2i_PUBKEY (d2i_of_void *)d2i_EC_PUBKEY 407 # define ec_free (free_key_fn *)EC_KEY_free 408 409 static int ec_check(void *key, struct der2key_ctx_st *ctx) 410 { 411 /* We're trying to be clever by comparing two truths */ 412 413 int sm2 = (EC_KEY_get_flags(key) & EC_FLAG_SM2_RANGE) != 0; 414 415 return sm2 == (ctx->desc->evp_type == EVP_PKEY_SM2); 416 } 417 418 static void ec_adjust(void *key, struct der2key_ctx_st *ctx) 419 { 420 ossl_ec_key_set0_libctx(key, PROV_LIBCTX_OF(ctx->provctx)); 421 } 422 423 /* 424 * ED25519, ED448, X25519, X448 only implement PKCS#8 and SubjectPublicKeyInfo, 425 * so no d2i functions to be had. 426 */ 427 428 static void *ecx_d2i_PKCS8(void **key, const unsigned char **der, long der_len, 429 struct der2key_ctx_st *ctx) 430 { 431 return der2key_decode_p8(der, der_len, ctx, 432 (key_from_pkcs8_t *)ossl_ecx_key_from_pkcs8); 433 } 434 435 static void ecx_key_adjust(void *key, struct der2key_ctx_st *ctx) 436 { 437 ossl_ecx_key_set0_libctx(key, PROV_LIBCTX_OF(ctx->provctx)); 438 } 439 440 # define ed25519_evp_type EVP_PKEY_ED25519 441 # define ed25519_d2i_private_key NULL 442 # define ed25519_d2i_public_key NULL 443 # define ed25519_d2i_key_params NULL 444 # define ed25519_d2i_PKCS8 ecx_d2i_PKCS8 445 # define ed25519_d2i_PUBKEY (d2i_of_void *)ossl_d2i_ED25519_PUBKEY 446 # define ed25519_free (free_key_fn *)ossl_ecx_key_free 447 # define ed25519_check NULL 448 # define ed25519_adjust ecx_key_adjust 449 450 # define ed448_evp_type EVP_PKEY_ED448 451 # define ed448_d2i_private_key NULL 452 # define ed448_d2i_public_key NULL 453 # define ed448_d2i_key_params NULL 454 # define ed448_d2i_PKCS8 ecx_d2i_PKCS8 455 # define ed448_d2i_PUBKEY (d2i_of_void *)ossl_d2i_ED448_PUBKEY 456 # define ed448_free (free_key_fn *)ossl_ecx_key_free 457 # define ed448_check NULL 458 # define ed448_adjust ecx_key_adjust 459 460 # define x25519_evp_type EVP_PKEY_X25519 461 # define x25519_d2i_private_key NULL 462 # define x25519_d2i_public_key NULL 463 # define x25519_d2i_key_params NULL 464 # define x25519_d2i_PKCS8 ecx_d2i_PKCS8 465 # define x25519_d2i_PUBKEY (d2i_of_void *)ossl_d2i_X25519_PUBKEY 466 # define x25519_free (free_key_fn *)ossl_ecx_key_free 467 # define x25519_check NULL 468 # define x25519_adjust ecx_key_adjust 469 470 # define x448_evp_type EVP_PKEY_X448 471 # define x448_d2i_private_key NULL 472 # define x448_d2i_public_key NULL 473 # define x448_d2i_key_params NULL 474 # define x448_d2i_PKCS8 ecx_d2i_PKCS8 475 # define x448_d2i_PUBKEY (d2i_of_void *)ossl_d2i_X448_PUBKEY 476 # define x448_free (free_key_fn *)ossl_ecx_key_free 477 # define x448_check NULL 478 # define x448_adjust ecx_key_adjust 479 480 # ifndef OPENSSL_NO_SM2 481 # define sm2_evp_type EVP_PKEY_SM2 482 # define sm2_d2i_private_key (d2i_of_void *)d2i_ECPrivateKey 483 # define sm2_d2i_public_key NULL 484 # define sm2_d2i_key_params (d2i_of_void *)d2i_ECParameters 485 486 static void *sm2_d2i_PKCS8(void **key, const unsigned char **der, long der_len, 487 struct der2key_ctx_st *ctx) 488 { 489 return der2key_decode_p8(der, der_len, ctx, 490 (key_from_pkcs8_t *)ossl_ec_key_from_pkcs8); 491 } 492 493 # define sm2_d2i_PUBKEY (d2i_of_void *)d2i_EC_PUBKEY 494 # define sm2_free (free_key_fn *)EC_KEY_free 495 # define sm2_check ec_check 496 # define sm2_adjust ec_adjust 497 # endif 498 #endif 499 500 /* ---------------------------------------------------------------------- */ 501 502 #define rsa_evp_type EVP_PKEY_RSA 503 #define rsa_d2i_private_key (d2i_of_void *)d2i_RSAPrivateKey 504 #define rsa_d2i_public_key (d2i_of_void *)d2i_RSAPublicKey 505 #define rsa_d2i_key_params NULL 506 507 static void *rsa_d2i_PKCS8(void **key, const unsigned char **der, long der_len, 508 struct der2key_ctx_st *ctx) 509 { 510 return der2key_decode_p8(der, der_len, ctx, 511 (key_from_pkcs8_t *)ossl_rsa_key_from_pkcs8); 512 } 513 514 #define rsa_d2i_PUBKEY (d2i_of_void *)d2i_RSA_PUBKEY 515 #define rsa_free (free_key_fn *)RSA_free 516 517 static int rsa_check(void *key, struct der2key_ctx_st *ctx) 518 { 519 switch (RSA_test_flags(key, RSA_FLAG_TYPE_MASK)) { 520 case RSA_FLAG_TYPE_RSA: 521 return ctx->desc->evp_type == EVP_PKEY_RSA; 522 case RSA_FLAG_TYPE_RSASSAPSS: 523 return ctx->desc->evp_type == EVP_PKEY_RSA_PSS; 524 } 525 526 /* Currently unsupported RSA key type */ 527 return 0; 528 } 529 530 static void rsa_adjust(void *key, struct der2key_ctx_st *ctx) 531 { 532 ossl_rsa_set0_libctx(key, PROV_LIBCTX_OF(ctx->provctx)); 533 } 534 535 #define rsapss_evp_type EVP_PKEY_RSA_PSS 536 #define rsapss_d2i_private_key (d2i_of_void *)d2i_RSAPrivateKey 537 #define rsapss_d2i_public_key (d2i_of_void *)d2i_RSAPublicKey 538 #define rsapss_d2i_key_params NULL 539 #define rsapss_d2i_PKCS8 rsa_d2i_PKCS8 540 #define rsapss_d2i_PUBKEY (d2i_of_void *)d2i_RSA_PUBKEY 541 #define rsapss_free (free_key_fn *)RSA_free 542 #define rsapss_check rsa_check 543 #define rsapss_adjust rsa_adjust 544 545 /* ---------------------------------------------------------------------- */ 546 547 /* 548 * The DO_ macros help define the selection mask and the method functions 549 * for each kind of object we want to decode. 550 */ 551 #define DO_type_specific_keypair(keytype) \ 552 "type-specific", keytype##_evp_type, \ 553 ( OSSL_KEYMGMT_SELECT_KEYPAIR ), \ 554 keytype##_d2i_private_key, \ 555 keytype##_d2i_public_key, \ 556 NULL, \ 557 NULL, \ 558 NULL, \ 559 keytype##_check, \ 560 keytype##_adjust, \ 561 keytype##_free 562 563 #define DO_type_specific_pub(keytype) \ 564 "type-specific", keytype##_evp_type, \ 565 ( OSSL_KEYMGMT_SELECT_PUBLIC_KEY ), \ 566 NULL, \ 567 keytype##_d2i_public_key, \ 568 NULL, \ 569 NULL, \ 570 NULL, \ 571 keytype##_check, \ 572 keytype##_adjust, \ 573 keytype##_free 574 575 #define DO_type_specific_priv(keytype) \ 576 "type-specific", keytype##_evp_type, \ 577 ( OSSL_KEYMGMT_SELECT_PRIVATE_KEY ), \ 578 keytype##_d2i_private_key, \ 579 NULL, \ 580 NULL, \ 581 NULL, \ 582 NULL, \ 583 keytype##_check, \ 584 keytype##_adjust, \ 585 keytype##_free 586 587 #define DO_type_specific_params(keytype) \ 588 "type-specific", keytype##_evp_type, \ 589 ( OSSL_KEYMGMT_SELECT_ALL_PARAMETERS ), \ 590 NULL, \ 591 NULL, \ 592 keytype##_d2i_key_params, \ 593 NULL, \ 594 NULL, \ 595 keytype##_check, \ 596 keytype##_adjust, \ 597 keytype##_free 598 599 #define DO_type_specific(keytype) \ 600 "type-specific", keytype##_evp_type, \ 601 ( OSSL_KEYMGMT_SELECT_ALL ), \ 602 keytype##_d2i_private_key, \ 603 keytype##_d2i_public_key, \ 604 keytype##_d2i_key_params, \ 605 NULL, \ 606 NULL, \ 607 keytype##_check, \ 608 keytype##_adjust, \ 609 keytype##_free 610 611 #define DO_type_specific_no_pub(keytype) \ 612 "type-specific", keytype##_evp_type, \ 613 ( OSSL_KEYMGMT_SELECT_PRIVATE_KEY \ 614 | OSSL_KEYMGMT_SELECT_ALL_PARAMETERS ), \ 615 keytype##_d2i_private_key, \ 616 NULL, \ 617 keytype##_d2i_key_params, \ 618 NULL, \ 619 NULL, \ 620 keytype##_check, \ 621 keytype##_adjust, \ 622 keytype##_free 623 624 #define DO_PrivateKeyInfo(keytype) \ 625 "PrivateKeyInfo", keytype##_evp_type, \ 626 ( OSSL_KEYMGMT_SELECT_PRIVATE_KEY ), \ 627 NULL, \ 628 NULL, \ 629 NULL, \ 630 keytype##_d2i_PKCS8, \ 631 NULL, \ 632 keytype##_check, \ 633 keytype##_adjust, \ 634 keytype##_free 635 636 #define DO_SubjectPublicKeyInfo(keytype) \ 637 "SubjectPublicKeyInfo", keytype##_evp_type, \ 638 ( OSSL_KEYMGMT_SELECT_PUBLIC_KEY ), \ 639 NULL, \ 640 NULL, \ 641 NULL, \ 642 NULL, \ 643 keytype##_d2i_PUBKEY, \ 644 keytype##_check, \ 645 keytype##_adjust, \ 646 keytype##_free 647 648 #define DO_DH(keytype) \ 649 "DH", keytype##_evp_type, \ 650 ( OSSL_KEYMGMT_SELECT_ALL_PARAMETERS ), \ 651 NULL, \ 652 NULL, \ 653 keytype##_d2i_key_params, \ 654 NULL, \ 655 NULL, \ 656 keytype##_check, \ 657 keytype##_adjust, \ 658 keytype##_free 659 660 #define DO_DHX(keytype) \ 661 "DHX", keytype##_evp_type, \ 662 ( OSSL_KEYMGMT_SELECT_ALL_PARAMETERS ), \ 663 NULL, \ 664 NULL, \ 665 keytype##_d2i_key_params, \ 666 NULL, \ 667 NULL, \ 668 keytype##_check, \ 669 keytype##_adjust, \ 670 keytype##_free 671 672 #define DO_DSA(keytype) \ 673 "DSA", keytype##_evp_type, \ 674 ( OSSL_KEYMGMT_SELECT_ALL ), \ 675 keytype##_d2i_private_key, \ 676 keytype##_d2i_public_key, \ 677 keytype##_d2i_key_params, \ 678 NULL, \ 679 NULL, \ 680 keytype##_check, \ 681 keytype##_adjust, \ 682 keytype##_free 683 684 #define DO_EC(keytype) \ 685 "EC", keytype##_evp_type, \ 686 ( OSSL_KEYMGMT_SELECT_PRIVATE_KEY \ 687 | OSSL_KEYMGMT_SELECT_ALL_PARAMETERS ), \ 688 keytype##_d2i_private_key, \ 689 NULL, \ 690 keytype##_d2i_key_params, \ 691 NULL, \ 692 NULL, \ 693 keytype##_check, \ 694 keytype##_adjust, \ 695 keytype##_free 696 697 #define DO_RSA(keytype) \ 698 "RSA", keytype##_evp_type, \ 699 ( OSSL_KEYMGMT_SELECT_KEYPAIR ), \ 700 keytype##_d2i_private_key, \ 701 keytype##_d2i_public_key, \ 702 NULL, \ 703 NULL, \ 704 NULL, \ 705 keytype##_check, \ 706 keytype##_adjust, \ 707 keytype##_free 708 709 /* 710 * MAKE_DECODER is the single driver for creating OSSL_DISPATCH tables. 711 * It takes the following arguments: 712 * 713 * keytype_name The implementation key type as a string. 714 * keytype The implementation key type. This must correspond exactly 715 * to our existing keymgmt keytype names... in other words, 716 * there must exist an ossl_##keytype##_keymgmt_functions. 717 * type The type name for the set of functions that implement the 718 * decoder for the key type. This isn't necessarily the same 719 * as keytype. For example, the key types ed25519, ed448, 720 * x25519 and x448 are all handled by the same functions with 721 * the common type name ecx. 722 * kind The kind of support to implement. This translates into 723 * the DO_##kind macros above, to populate the keytype_desc_st 724 * structure. 725 */ 726 #define MAKE_DECODER(keytype_name, keytype, type, kind) \ 727 static const struct keytype_desc_st kind##_##keytype##_desc = \ 728 { keytype_name, ossl_##keytype##_keymgmt_functions, \ 729 DO_##kind(keytype) }; \ 730 \ 731 static OSSL_FUNC_decoder_newctx_fn kind##_der2##keytype##_newctx; \ 732 \ 733 static void *kind##_der2##keytype##_newctx(void *provctx) \ 734 { \ 735 return der2key_newctx(provctx, &kind##_##keytype##_desc); \ 736 } \ 737 static int kind##_der2##keytype##_does_selection(void *provctx, \ 738 int selection) \ 739 { \ 740 return der2key_check_selection(selection, \ 741 &kind##_##keytype##_desc); \ 742 } \ 743 const OSSL_DISPATCH \ 744 ossl_##kind##_der_to_##keytype##_decoder_functions[] = { \ 745 { OSSL_FUNC_DECODER_NEWCTX, \ 746 (void (*)(void))kind##_der2##keytype##_newctx }, \ 747 { OSSL_FUNC_DECODER_FREECTX, \ 748 (void (*)(void))der2key_freectx }, \ 749 { OSSL_FUNC_DECODER_DOES_SELECTION, \ 750 (void (*)(void))kind##_der2##keytype##_does_selection }, \ 751 { OSSL_FUNC_DECODER_DECODE, \ 752 (void (*)(void))der2key_decode }, \ 753 { OSSL_FUNC_DECODER_EXPORT_OBJECT, \ 754 (void (*)(void))der2key_export_object }, \ 755 { 0, NULL } \ 756 } 757 758 #ifndef OPENSSL_NO_DH 759 MAKE_DECODER("DH", dh, dh, PrivateKeyInfo); 760 MAKE_DECODER("DH", dh, dh, SubjectPublicKeyInfo); 761 MAKE_DECODER("DH", dh, dh, type_specific_params); 762 MAKE_DECODER("DH", dh, dh, DH); 763 MAKE_DECODER("DHX", dhx, dhx, PrivateKeyInfo); 764 MAKE_DECODER("DHX", dhx, dhx, SubjectPublicKeyInfo); 765 MAKE_DECODER("DHX", dhx, dhx, type_specific_params); 766 MAKE_DECODER("DHX", dhx, dhx, DHX); 767 #endif 768 #ifndef OPENSSL_NO_DSA 769 MAKE_DECODER("DSA", dsa, dsa, PrivateKeyInfo); 770 MAKE_DECODER("DSA", dsa, dsa, SubjectPublicKeyInfo); 771 MAKE_DECODER("DSA", dsa, dsa, type_specific); 772 MAKE_DECODER("DSA", dsa, dsa, DSA); 773 #endif 774 #ifndef OPENSSL_NO_EC 775 MAKE_DECODER("EC", ec, ec, PrivateKeyInfo); 776 MAKE_DECODER("EC", ec, ec, SubjectPublicKeyInfo); 777 MAKE_DECODER("EC", ec, ec, type_specific_no_pub); 778 MAKE_DECODER("EC", ec, ec, EC); 779 MAKE_DECODER("X25519", x25519, ecx, PrivateKeyInfo); 780 MAKE_DECODER("X25519", x25519, ecx, SubjectPublicKeyInfo); 781 MAKE_DECODER("X448", x448, ecx, PrivateKeyInfo); 782 MAKE_DECODER("X448", x448, ecx, SubjectPublicKeyInfo); 783 MAKE_DECODER("ED25519", ed25519, ecx, PrivateKeyInfo); 784 MAKE_DECODER("ED25519", ed25519, ecx, SubjectPublicKeyInfo); 785 MAKE_DECODER("ED448", ed448, ecx, PrivateKeyInfo); 786 MAKE_DECODER("ED448", ed448, ecx, SubjectPublicKeyInfo); 787 # ifndef OPENSSL_NO_SM2 788 MAKE_DECODER("SM2", sm2, ec, PrivateKeyInfo); 789 MAKE_DECODER("SM2", sm2, ec, SubjectPublicKeyInfo); 790 # endif 791 #endif 792 MAKE_DECODER("RSA", rsa, rsa, PrivateKeyInfo); 793 MAKE_DECODER("RSA", rsa, rsa, SubjectPublicKeyInfo); 794 MAKE_DECODER("RSA", rsa, rsa, type_specific_keypair); 795 MAKE_DECODER("RSA", rsa, rsa, RSA); 796 MAKE_DECODER("RSA-PSS", rsapss, rsapss, PrivateKeyInfo); 797 MAKE_DECODER("RSA-PSS", rsapss, rsapss, SubjectPublicKeyInfo); 798