1 /* 2 * Copyright 2020-2024 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 /* 11 * low level APIs are deprecated for public use, but still ok for 12 * internal use. 13 */ 14 #include "internal/deprecated.h" 15 16 #include <openssl/core_dispatch.h> 17 #include <openssl/core_names.h> 18 #include <openssl/core_object.h> 19 #include <openssl/crypto.h> 20 #include <openssl/err.h> 21 #include <openssl/params.h> 22 #include <openssl/pem.h> /* PEM_BUFSIZE and public PEM functions */ 23 #include <openssl/pkcs12.h> 24 #include <openssl/x509.h> 25 #include <openssl/proverr.h> 26 #include "internal/cryptlib.h" /* ossl_assert() */ 27 #include "internal/asn1.h" 28 #include "crypto/dh.h" 29 #include "crypto/dsa.h" 30 #include "crypto/ec.h" 31 #include "crypto/evp.h" 32 #include "crypto/ecx.h" 33 #include "crypto/rsa.h" 34 #include "crypto/x509.h" 35 #include "openssl/obj_mac.h" 36 #include "prov/bio.h" 37 #include "prov/implementations.h" 38 #include "endecoder_local.h" 39 40 struct der2key_ctx_st; /* Forward declaration */ 41 typedef int check_key_fn(void *, struct der2key_ctx_st *ctx); 42 typedef void adjust_key_fn(void *, struct der2key_ctx_st *ctx); 43 typedef void free_key_fn(void *); 44 typedef void *d2i_PKCS8_fn(void **, const unsigned char **, long, 45 struct der2key_ctx_st *); 46 struct keytype_desc_st { 47 const char *keytype_name; 48 const OSSL_DISPATCH *fns; /* Keymgmt (to pilfer functions from) */ 49 50 /* The input structure name */ 51 const char *structure_name; 52 53 /* 54 * The EVP_PKEY_xxx type macro. Should be zero for type specific 55 * structures, non-zero when the outermost structure is PKCS#8 or 56 * SubjectPublicKeyInfo. This determines which of the function 57 * pointers below will be used. 58 */ 59 int evp_type; 60 61 /* The selection mask for OSSL_FUNC_decoder_does_selection() */ 62 int selection_mask; 63 64 /* For type specific decoders, we use the corresponding d2i */ 65 d2i_of_void *d2i_private_key; /* From type-specific DER */ 66 d2i_of_void *d2i_public_key; /* From type-specific DER */ 67 d2i_of_void *d2i_key_params; /* From type-specific DER */ 68 d2i_PKCS8_fn *d2i_PKCS8; /* Wrapped in a PrivateKeyInfo */ 69 d2i_of_void *d2i_PUBKEY; /* Wrapped in a SubjectPublicKeyInfo */ 70 71 /* 72 * For any key, we may need to check that the key meets expectations. 73 * This is useful when the same functions can decode several variants 74 * of a key. 75 */ 76 check_key_fn *check_key; 77 78 /* 79 * For any key, we may need to make provider specific adjustments, such 80 * as ensure the key carries the correct library context. 81 */ 82 adjust_key_fn *adjust_key; 83 /* {type}_free() */ 84 free_key_fn *free_key; 85 }; 86 87 /* 88 * Context used for DER to key decoding. 89 */ 90 struct der2key_ctx_st { 91 PROV_CTX *provctx; 92 const struct keytype_desc_st *desc; 93 /* The selection that is passed to der2key_decode() */ 94 int selection; 95 /* Flag used to signal that a failure is fatal */ 96 unsigned int flag_fatal : 1; 97 }; 98 99 typedef void *key_from_pkcs8_t(const PKCS8_PRIV_KEY_INFO *p8inf, 100 OSSL_LIB_CTX *libctx, const char *propq); 101 static void *der2key_decode_p8(const unsigned char **input_der, 102 long input_der_len, struct der2key_ctx_st *ctx, 103 key_from_pkcs8_t *key_from_pkcs8) 104 { 105 PKCS8_PRIV_KEY_INFO *p8inf = NULL; 106 const X509_ALGOR *alg = NULL; 107 void *key = NULL; 108 109 if ((p8inf = d2i_PKCS8_PRIV_KEY_INFO(NULL, input_der, input_der_len)) != NULL 110 && PKCS8_pkey_get0(NULL, NULL, NULL, &alg, p8inf) 111 && (OBJ_obj2nid(alg->algorithm) == ctx->desc->evp_type 112 /* Allow decoding sm2 private key with id_ecPublicKey */ 113 || (OBJ_obj2nid(alg->algorithm) == NID_X9_62_id_ecPublicKey 114 && ctx->desc->evp_type == NID_sm2))) 115 key = key_from_pkcs8(p8inf, PROV_LIBCTX_OF(ctx->provctx), NULL); 116 PKCS8_PRIV_KEY_INFO_free(p8inf); 117 118 return key; 119 } 120 121 /* ---------------------------------------------------------------------- */ 122 123 static OSSL_FUNC_decoder_freectx_fn der2key_freectx; 124 static OSSL_FUNC_decoder_decode_fn der2key_decode; 125 static OSSL_FUNC_decoder_export_object_fn der2key_export_object; 126 127 static struct der2key_ctx_st * 128 der2key_newctx(void *provctx, const struct keytype_desc_st *desc) 129 { 130 struct der2key_ctx_st *ctx = OPENSSL_zalloc(sizeof(*ctx)); 131 132 if (ctx != NULL) { 133 ctx->provctx = provctx; 134 ctx->desc = desc; 135 } 136 return ctx; 137 } 138 139 static void der2key_freectx(void *vctx) 140 { 141 struct der2key_ctx_st *ctx = vctx; 142 143 OPENSSL_free(ctx); 144 } 145 146 static int der2key_check_selection(int selection, 147 const struct keytype_desc_st *desc) 148 { 149 /* 150 * The selections are kinda sorta "levels", i.e. each selection given 151 * here is assumed to include those following. 152 */ 153 int checks[] = { 154 OSSL_KEYMGMT_SELECT_PRIVATE_KEY, 155 OSSL_KEYMGMT_SELECT_PUBLIC_KEY, 156 OSSL_KEYMGMT_SELECT_ALL_PARAMETERS 157 }; 158 size_t i; 159 160 /* The decoder implementations made here support guessing */ 161 if (selection == 0) 162 return 1; 163 164 for (i = 0; i < OSSL_NELEM(checks); i++) { 165 int check1 = (selection & checks[i]) != 0; 166 int check2 = (desc->selection_mask & checks[i]) != 0; 167 168 /* 169 * If the caller asked for the currently checked bit(s), return 170 * whether the decoder description says it's supported. 171 */ 172 if (check1) 173 return check2; 174 } 175 176 /* This should be dead code, but just to be safe... */ 177 return 0; 178 } 179 180 static int der2key_decode(void *vctx, OSSL_CORE_BIO *cin, int selection, 181 OSSL_CALLBACK *data_cb, void *data_cbarg, 182 OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg) 183 { 184 struct der2key_ctx_st *ctx = vctx; 185 unsigned char *der = NULL; 186 const unsigned char *derp; 187 long der_len = 0; 188 void *key = NULL; 189 int ok = 0; 190 191 ctx->selection = selection; 192 /* 193 * The caller is allowed to specify 0 as a selection mark, to have the 194 * structure and key type guessed. For type-specific structures, this 195 * is not recommended, as some structures are very similar. 196 * Note that 0 isn't the same as OSSL_KEYMGMT_SELECT_ALL, as the latter 197 * signifies a private key structure, where everything else is assumed 198 * to be present as well. 199 */ 200 if (selection == 0) 201 selection = ctx->desc->selection_mask; 202 if ((selection & ctx->desc->selection_mask) == 0) { 203 ERR_raise(ERR_LIB_PROV, ERR_R_PASSED_INVALID_ARGUMENT); 204 return 0; 205 } 206 207 ok = ossl_read_der(ctx->provctx, cin, &der, &der_len); 208 if (!ok) 209 goto next; 210 211 ok = 0; /* Assume that we fail */ 212 213 ERR_set_mark(); 214 if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0) { 215 derp = der; 216 if (ctx->desc->d2i_PKCS8 != NULL) { 217 key = ctx->desc->d2i_PKCS8(NULL, &derp, der_len, ctx); 218 if (ctx->flag_fatal) { 219 ERR_clear_last_mark(); 220 goto end; 221 } 222 } else if (ctx->desc->d2i_private_key != NULL) { 223 key = ctx->desc->d2i_private_key(NULL, &derp, der_len); 224 } 225 if (key == NULL && ctx->selection != 0) { 226 ERR_clear_last_mark(); 227 goto next; 228 } 229 } 230 if (key == NULL && (selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0) { 231 derp = der; 232 if (ctx->desc->d2i_PUBKEY != NULL) 233 key = ctx->desc->d2i_PUBKEY(NULL, &derp, der_len); 234 else if (ctx->desc->d2i_public_key != NULL) 235 key = ctx->desc->d2i_public_key(NULL, &derp, der_len); 236 if (key == NULL && ctx->selection != 0) { 237 ERR_clear_last_mark(); 238 goto next; 239 } 240 } 241 if (key == NULL && (selection & OSSL_KEYMGMT_SELECT_ALL_PARAMETERS) != 0) { 242 derp = der; 243 if (ctx->desc->d2i_key_params != NULL) 244 key = ctx->desc->d2i_key_params(NULL, &derp, der_len); 245 if (key == NULL && ctx->selection != 0) { 246 ERR_clear_last_mark(); 247 goto next; 248 } 249 } 250 if (key == NULL) 251 ERR_clear_last_mark(); 252 else 253 ERR_pop_to_mark(); 254 255 /* 256 * Last minute check to see if this was the correct type of key. This 257 * should never lead to a fatal error, i.e. the decoding itself was 258 * correct, it was just an unexpected key type. This is generally for 259 * classes of key types that have subtle variants, like RSA-PSS keys as 260 * opposed to plain RSA keys. 261 */ 262 if (key != NULL 263 && ctx->desc->check_key != NULL 264 && !ctx->desc->check_key(key, ctx)) { 265 ctx->desc->free_key(key); 266 key = NULL; 267 } 268 269 if (key != NULL && ctx->desc->adjust_key != NULL) 270 ctx->desc->adjust_key(key, ctx); 271 272 next: 273 /* 274 * Indicated that we successfully decoded something, or not at all. 275 * Ending up "empty handed" is not an error. 276 */ 277 ok = 1; 278 279 /* 280 * We free memory here so it's not held up during the callback, because 281 * we know the process is recursive and the allocated chunks of memory 282 * add up. 283 */ 284 OPENSSL_free(der); 285 der = NULL; 286 287 if (key != NULL) { 288 OSSL_PARAM params[4]; 289 int object_type = OSSL_OBJECT_PKEY; 290 291 params[0] = 292 OSSL_PARAM_construct_int(OSSL_OBJECT_PARAM_TYPE, &object_type); 293 294 #ifndef OPENSSL_NO_SM2 295 if (strcmp(ctx->desc->keytype_name, "EC") == 0 296 && (EC_KEY_get_flags(key) & EC_FLAG_SM2_RANGE) != 0) 297 params[1] = 298 OSSL_PARAM_construct_utf8_string(OSSL_OBJECT_PARAM_DATA_TYPE, 299 "SM2", 0); 300 else 301 #endif 302 params[1] = 303 OSSL_PARAM_construct_utf8_string(OSSL_OBJECT_PARAM_DATA_TYPE, 304 (char *)ctx->desc->keytype_name, 305 0); 306 /* The address of the key becomes the octet string */ 307 params[2] = 308 OSSL_PARAM_construct_octet_string(OSSL_OBJECT_PARAM_REFERENCE, 309 &key, sizeof(key)); 310 params[3] = OSSL_PARAM_construct_end(); 311 312 ok = data_cb(params, data_cbarg); 313 } 314 315 end: 316 ctx->desc->free_key(key); 317 OPENSSL_free(der); 318 319 return ok; 320 } 321 322 static int der2key_export_object(void *vctx, 323 const void *reference, size_t reference_sz, 324 OSSL_CALLBACK *export_cb, void *export_cbarg) 325 { 326 struct der2key_ctx_st *ctx = vctx; 327 OSSL_FUNC_keymgmt_export_fn *export = 328 ossl_prov_get_keymgmt_export(ctx->desc->fns); 329 void *keydata; 330 331 if (reference_sz == sizeof(keydata) && export != NULL) { 332 int selection = ctx->selection; 333 334 if (selection == 0) 335 selection = OSSL_KEYMGMT_SELECT_ALL; 336 /* The contents of the reference is the address to our object */ 337 keydata = *(void **)reference; 338 339 return export(keydata, selection, export_cb, export_cbarg); 340 } 341 return 0; 342 } 343 344 /* ---------------------------------------------------------------------- */ 345 346 #ifndef OPENSSL_NO_DH 347 # define dh_evp_type EVP_PKEY_DH 348 # define dh_d2i_private_key NULL 349 # define dh_d2i_public_key NULL 350 # define dh_d2i_key_params (d2i_of_void *)d2i_DHparams 351 352 static void *dh_d2i_PKCS8(void **key, const unsigned char **der, long der_len, 353 struct der2key_ctx_st *ctx) 354 { 355 return der2key_decode_p8(der, der_len, ctx, 356 (key_from_pkcs8_t *)ossl_dh_key_from_pkcs8); 357 } 358 359 # define dh_d2i_PUBKEY (d2i_of_void *)ossl_d2i_DH_PUBKEY 360 # define dh_free (free_key_fn *)DH_free 361 # define dh_check NULL 362 363 static void dh_adjust(void *key, struct der2key_ctx_st *ctx) 364 { 365 ossl_dh_set0_libctx(key, PROV_LIBCTX_OF(ctx->provctx)); 366 } 367 368 # define dhx_evp_type EVP_PKEY_DHX 369 # define dhx_d2i_private_key NULL 370 # define dhx_d2i_public_key NULL 371 # define dhx_d2i_key_params (d2i_of_void *)d2i_DHxparams 372 # define dhx_d2i_PKCS8 dh_d2i_PKCS8 373 # define dhx_d2i_PUBKEY (d2i_of_void *)ossl_d2i_DHx_PUBKEY 374 # define dhx_free (free_key_fn *)DH_free 375 # define dhx_check NULL 376 # define dhx_adjust dh_adjust 377 #endif 378 379 /* ---------------------------------------------------------------------- */ 380 381 #ifndef OPENSSL_NO_DSA 382 # define dsa_evp_type EVP_PKEY_DSA 383 # define dsa_d2i_private_key (d2i_of_void *)d2i_DSAPrivateKey 384 # define dsa_d2i_public_key (d2i_of_void *)d2i_DSAPublicKey 385 # define dsa_d2i_key_params (d2i_of_void *)d2i_DSAparams 386 387 static void *dsa_d2i_PKCS8(void **key, const unsigned char **der, long der_len, 388 struct der2key_ctx_st *ctx) 389 { 390 return der2key_decode_p8(der, der_len, ctx, 391 (key_from_pkcs8_t *)ossl_dsa_key_from_pkcs8); 392 } 393 394 # define dsa_d2i_PUBKEY (d2i_of_void *)ossl_d2i_DSA_PUBKEY 395 # define dsa_free (free_key_fn *)DSA_free 396 # define dsa_check NULL 397 398 static void dsa_adjust(void *key, struct der2key_ctx_st *ctx) 399 { 400 ossl_dsa_set0_libctx(key, PROV_LIBCTX_OF(ctx->provctx)); 401 } 402 #endif 403 404 /* ---------------------------------------------------------------------- */ 405 406 #ifndef OPENSSL_NO_EC 407 # define ec_evp_type EVP_PKEY_EC 408 # define ec_d2i_private_key (d2i_of_void *)d2i_ECPrivateKey 409 # define ec_d2i_public_key NULL 410 # define ec_d2i_key_params (d2i_of_void *)d2i_ECParameters 411 412 static void *ec_d2i_PKCS8(void **key, const unsigned char **der, long der_len, 413 struct der2key_ctx_st *ctx) 414 { 415 return der2key_decode_p8(der, der_len, ctx, 416 (key_from_pkcs8_t *)ossl_ec_key_from_pkcs8); 417 } 418 419 # define ec_d2i_PUBKEY (d2i_of_void *)d2i_EC_PUBKEY 420 # define ec_free (free_key_fn *)EC_KEY_free 421 422 static int ec_check(void *key, struct der2key_ctx_st *ctx) 423 { 424 /* We're trying to be clever by comparing two truths */ 425 int ret = 0; 426 int sm2 = (EC_KEY_get_flags(key) & EC_FLAG_SM2_RANGE) != 0; 427 428 if (sm2) 429 ret = ctx->desc->evp_type == EVP_PKEY_SM2 430 || ctx->desc->evp_type == NID_X9_62_id_ecPublicKey; 431 else 432 ret = ctx->desc->evp_type != EVP_PKEY_SM2; 433 434 return ret; 435 } 436 437 static void ec_adjust(void *key, struct der2key_ctx_st *ctx) 438 { 439 ossl_ec_key_set0_libctx(key, PROV_LIBCTX_OF(ctx->provctx)); 440 } 441 442 /* 443 * ED25519, ED448, X25519, X448 only implement PKCS#8 and SubjectPublicKeyInfo, 444 * so no d2i functions to be had. 445 */ 446 447 static void *ecx_d2i_PKCS8(void **key, const unsigned char **der, long der_len, 448 struct der2key_ctx_st *ctx) 449 { 450 return der2key_decode_p8(der, der_len, ctx, 451 (key_from_pkcs8_t *)ossl_ecx_key_from_pkcs8); 452 } 453 454 static void ecx_key_adjust(void *key, struct der2key_ctx_st *ctx) 455 { 456 ossl_ecx_key_set0_libctx(key, PROV_LIBCTX_OF(ctx->provctx)); 457 } 458 459 # define ed25519_evp_type EVP_PKEY_ED25519 460 # define ed25519_d2i_private_key NULL 461 # define ed25519_d2i_public_key NULL 462 # define ed25519_d2i_key_params NULL 463 # define ed25519_d2i_PKCS8 ecx_d2i_PKCS8 464 # define ed25519_d2i_PUBKEY (d2i_of_void *)ossl_d2i_ED25519_PUBKEY 465 # define ed25519_free (free_key_fn *)ossl_ecx_key_free 466 # define ed25519_check NULL 467 # define ed25519_adjust ecx_key_adjust 468 469 # define ed448_evp_type EVP_PKEY_ED448 470 # define ed448_d2i_private_key NULL 471 # define ed448_d2i_public_key NULL 472 # define ed448_d2i_key_params NULL 473 # define ed448_d2i_PKCS8 ecx_d2i_PKCS8 474 # define ed448_d2i_PUBKEY (d2i_of_void *)ossl_d2i_ED448_PUBKEY 475 # define ed448_free (free_key_fn *)ossl_ecx_key_free 476 # define ed448_check NULL 477 # define ed448_adjust ecx_key_adjust 478 479 # define x25519_evp_type EVP_PKEY_X25519 480 # define x25519_d2i_private_key NULL 481 # define x25519_d2i_public_key NULL 482 # define x25519_d2i_key_params NULL 483 # define x25519_d2i_PKCS8 ecx_d2i_PKCS8 484 # define x25519_d2i_PUBKEY (d2i_of_void *)ossl_d2i_X25519_PUBKEY 485 # define x25519_free (free_key_fn *)ossl_ecx_key_free 486 # define x25519_check NULL 487 # define x25519_adjust ecx_key_adjust 488 489 # define x448_evp_type EVP_PKEY_X448 490 # define x448_d2i_private_key NULL 491 # define x448_d2i_public_key NULL 492 # define x448_d2i_key_params NULL 493 # define x448_d2i_PKCS8 ecx_d2i_PKCS8 494 # define x448_d2i_PUBKEY (d2i_of_void *)ossl_d2i_X448_PUBKEY 495 # define x448_free (free_key_fn *)ossl_ecx_key_free 496 # define x448_check NULL 497 # define x448_adjust ecx_key_adjust 498 499 # ifndef OPENSSL_NO_SM2 500 # define sm2_evp_type EVP_PKEY_SM2 501 # define sm2_d2i_private_key (d2i_of_void *)d2i_ECPrivateKey 502 # define sm2_d2i_public_key NULL 503 # define sm2_d2i_key_params (d2i_of_void *)d2i_ECParameters 504 505 static void *sm2_d2i_PKCS8(void **key, const unsigned char **der, long der_len, 506 struct der2key_ctx_st *ctx) 507 { 508 return der2key_decode_p8(der, der_len, ctx, 509 (key_from_pkcs8_t *)ossl_ec_key_from_pkcs8); 510 } 511 512 # define sm2_d2i_PUBKEY (d2i_of_void *)d2i_EC_PUBKEY 513 # define sm2_free (free_key_fn *)EC_KEY_free 514 # define sm2_check ec_check 515 # define sm2_adjust ec_adjust 516 # endif 517 #endif 518 519 /* ---------------------------------------------------------------------- */ 520 521 #define rsa_evp_type EVP_PKEY_RSA 522 #define rsa_d2i_private_key (d2i_of_void *)d2i_RSAPrivateKey 523 #define rsa_d2i_public_key (d2i_of_void *)d2i_RSAPublicKey 524 #define rsa_d2i_key_params NULL 525 526 static void *rsa_d2i_PKCS8(void **key, const unsigned char **der, long der_len, 527 struct der2key_ctx_st *ctx) 528 { 529 return der2key_decode_p8(der, der_len, ctx, 530 (key_from_pkcs8_t *)ossl_rsa_key_from_pkcs8); 531 } 532 533 #define rsa_d2i_PUBKEY (d2i_of_void *)d2i_RSA_PUBKEY 534 #define rsa_free (free_key_fn *)RSA_free 535 536 static int rsa_check(void *key, struct der2key_ctx_st *ctx) 537 { 538 switch (RSA_test_flags(key, RSA_FLAG_TYPE_MASK)) { 539 case RSA_FLAG_TYPE_RSA: 540 return ctx->desc->evp_type == EVP_PKEY_RSA; 541 case RSA_FLAG_TYPE_RSASSAPSS: 542 return ctx->desc->evp_type == EVP_PKEY_RSA_PSS; 543 } 544 545 /* Currently unsupported RSA key type */ 546 return 0; 547 } 548 549 static void rsa_adjust(void *key, struct der2key_ctx_st *ctx) 550 { 551 ossl_rsa_set0_libctx(key, PROV_LIBCTX_OF(ctx->provctx)); 552 } 553 554 #define rsapss_evp_type EVP_PKEY_RSA_PSS 555 #define rsapss_d2i_private_key (d2i_of_void *)d2i_RSAPrivateKey 556 #define rsapss_d2i_public_key (d2i_of_void *)d2i_RSAPublicKey 557 #define rsapss_d2i_key_params NULL 558 #define rsapss_d2i_PKCS8 rsa_d2i_PKCS8 559 #define rsapss_d2i_PUBKEY (d2i_of_void *)d2i_RSA_PUBKEY 560 #define rsapss_free (free_key_fn *)RSA_free 561 #define rsapss_check rsa_check 562 #define rsapss_adjust rsa_adjust 563 564 /* ---------------------------------------------------------------------- */ 565 566 /* 567 * The DO_ macros help define the selection mask and the method functions 568 * for each kind of object we want to decode. 569 */ 570 #define DO_type_specific_keypair(keytype) \ 571 "type-specific", keytype##_evp_type, \ 572 ( OSSL_KEYMGMT_SELECT_KEYPAIR ), \ 573 keytype##_d2i_private_key, \ 574 keytype##_d2i_public_key, \ 575 NULL, \ 576 NULL, \ 577 NULL, \ 578 keytype##_check, \ 579 keytype##_adjust, \ 580 keytype##_free 581 582 #define DO_type_specific_pub(keytype) \ 583 "type-specific", keytype##_evp_type, \ 584 ( OSSL_KEYMGMT_SELECT_PUBLIC_KEY ), \ 585 NULL, \ 586 keytype##_d2i_public_key, \ 587 NULL, \ 588 NULL, \ 589 NULL, \ 590 keytype##_check, \ 591 keytype##_adjust, \ 592 keytype##_free 593 594 #define DO_type_specific_priv(keytype) \ 595 "type-specific", keytype##_evp_type, \ 596 ( OSSL_KEYMGMT_SELECT_PRIVATE_KEY ), \ 597 keytype##_d2i_private_key, \ 598 NULL, \ 599 NULL, \ 600 NULL, \ 601 NULL, \ 602 keytype##_check, \ 603 keytype##_adjust, \ 604 keytype##_free 605 606 #define DO_type_specific_params(keytype) \ 607 "type-specific", keytype##_evp_type, \ 608 ( OSSL_KEYMGMT_SELECT_ALL_PARAMETERS ), \ 609 NULL, \ 610 NULL, \ 611 keytype##_d2i_key_params, \ 612 NULL, \ 613 NULL, \ 614 keytype##_check, \ 615 keytype##_adjust, \ 616 keytype##_free 617 618 #define DO_type_specific(keytype) \ 619 "type-specific", keytype##_evp_type, \ 620 ( OSSL_KEYMGMT_SELECT_ALL ), \ 621 keytype##_d2i_private_key, \ 622 keytype##_d2i_public_key, \ 623 keytype##_d2i_key_params, \ 624 NULL, \ 625 NULL, \ 626 keytype##_check, \ 627 keytype##_adjust, \ 628 keytype##_free 629 630 #define DO_type_specific_no_pub(keytype) \ 631 "type-specific", keytype##_evp_type, \ 632 ( OSSL_KEYMGMT_SELECT_PRIVATE_KEY \ 633 | OSSL_KEYMGMT_SELECT_ALL_PARAMETERS ), \ 634 keytype##_d2i_private_key, \ 635 NULL, \ 636 keytype##_d2i_key_params, \ 637 NULL, \ 638 NULL, \ 639 keytype##_check, \ 640 keytype##_adjust, \ 641 keytype##_free 642 643 #define DO_PrivateKeyInfo(keytype) \ 644 "PrivateKeyInfo", keytype##_evp_type, \ 645 ( OSSL_KEYMGMT_SELECT_PRIVATE_KEY ), \ 646 NULL, \ 647 NULL, \ 648 NULL, \ 649 keytype##_d2i_PKCS8, \ 650 NULL, \ 651 keytype##_check, \ 652 keytype##_adjust, \ 653 keytype##_free 654 655 #define DO_SubjectPublicKeyInfo(keytype) \ 656 "SubjectPublicKeyInfo", keytype##_evp_type, \ 657 ( OSSL_KEYMGMT_SELECT_PUBLIC_KEY ), \ 658 NULL, \ 659 NULL, \ 660 NULL, \ 661 NULL, \ 662 keytype##_d2i_PUBKEY, \ 663 keytype##_check, \ 664 keytype##_adjust, \ 665 keytype##_free 666 667 #define DO_DH(keytype) \ 668 "DH", keytype##_evp_type, \ 669 ( OSSL_KEYMGMT_SELECT_ALL_PARAMETERS ), \ 670 NULL, \ 671 NULL, \ 672 keytype##_d2i_key_params, \ 673 NULL, \ 674 NULL, \ 675 keytype##_check, \ 676 keytype##_adjust, \ 677 keytype##_free 678 679 #define DO_DHX(keytype) \ 680 "DHX", keytype##_evp_type, \ 681 ( OSSL_KEYMGMT_SELECT_ALL_PARAMETERS ), \ 682 NULL, \ 683 NULL, \ 684 keytype##_d2i_key_params, \ 685 NULL, \ 686 NULL, \ 687 keytype##_check, \ 688 keytype##_adjust, \ 689 keytype##_free 690 691 #define DO_DSA(keytype) \ 692 "DSA", keytype##_evp_type, \ 693 ( OSSL_KEYMGMT_SELECT_ALL ), \ 694 keytype##_d2i_private_key, \ 695 keytype##_d2i_public_key, \ 696 keytype##_d2i_key_params, \ 697 NULL, \ 698 NULL, \ 699 keytype##_check, \ 700 keytype##_adjust, \ 701 keytype##_free 702 703 #define DO_EC(keytype) \ 704 "EC", keytype##_evp_type, \ 705 ( OSSL_KEYMGMT_SELECT_PRIVATE_KEY \ 706 | OSSL_KEYMGMT_SELECT_ALL_PARAMETERS ), \ 707 keytype##_d2i_private_key, \ 708 NULL, \ 709 keytype##_d2i_key_params, \ 710 NULL, \ 711 NULL, \ 712 keytype##_check, \ 713 keytype##_adjust, \ 714 keytype##_free 715 716 #define DO_RSA(keytype) \ 717 "RSA", keytype##_evp_type, \ 718 ( OSSL_KEYMGMT_SELECT_KEYPAIR ), \ 719 keytype##_d2i_private_key, \ 720 keytype##_d2i_public_key, \ 721 NULL, \ 722 NULL, \ 723 NULL, \ 724 keytype##_check, \ 725 keytype##_adjust, \ 726 keytype##_free 727 728 /* 729 * MAKE_DECODER is the single driver for creating OSSL_DISPATCH tables. 730 * It takes the following arguments: 731 * 732 * keytype_name The implementation key type as a string. 733 * keytype The implementation key type. This must correspond exactly 734 * to our existing keymgmt keytype names... in other words, 735 * there must exist an ossl_##keytype##_keymgmt_functions. 736 * type The type name for the set of functions that implement the 737 * decoder for the key type. This isn't necessarily the same 738 * as keytype. For example, the key types ed25519, ed448, 739 * x25519 and x448 are all handled by the same functions with 740 * the common type name ecx. 741 * kind The kind of support to implement. This translates into 742 * the DO_##kind macros above, to populate the keytype_desc_st 743 * structure. 744 */ 745 #define MAKE_DECODER(keytype_name, keytype, type, kind) \ 746 static const struct keytype_desc_st kind##_##keytype##_desc = \ 747 { keytype_name, ossl_##keytype##_keymgmt_functions, \ 748 DO_##kind(keytype) }; \ 749 \ 750 static OSSL_FUNC_decoder_newctx_fn kind##_der2##keytype##_newctx; \ 751 \ 752 static void *kind##_der2##keytype##_newctx(void *provctx) \ 753 { \ 754 return der2key_newctx(provctx, &kind##_##keytype##_desc); \ 755 } \ 756 static int kind##_der2##keytype##_does_selection(void *provctx, \ 757 int selection) \ 758 { \ 759 return der2key_check_selection(selection, \ 760 &kind##_##keytype##_desc); \ 761 } \ 762 const OSSL_DISPATCH \ 763 ossl_##kind##_der_to_##keytype##_decoder_functions[] = { \ 764 { OSSL_FUNC_DECODER_NEWCTX, \ 765 (void (*)(void))kind##_der2##keytype##_newctx }, \ 766 { OSSL_FUNC_DECODER_FREECTX, \ 767 (void (*)(void))der2key_freectx }, \ 768 { OSSL_FUNC_DECODER_DOES_SELECTION, \ 769 (void (*)(void))kind##_der2##keytype##_does_selection }, \ 770 { OSSL_FUNC_DECODER_DECODE, \ 771 (void (*)(void))der2key_decode }, \ 772 { OSSL_FUNC_DECODER_EXPORT_OBJECT, \ 773 (void (*)(void))der2key_export_object }, \ 774 { 0, NULL } \ 775 } 776 777 #ifndef OPENSSL_NO_DH 778 MAKE_DECODER("DH", dh, dh, PrivateKeyInfo); 779 MAKE_DECODER("DH", dh, dh, SubjectPublicKeyInfo); 780 MAKE_DECODER("DH", dh, dh, type_specific_params); 781 MAKE_DECODER("DH", dh, dh, DH); 782 MAKE_DECODER("DHX", dhx, dhx, PrivateKeyInfo); 783 MAKE_DECODER("DHX", dhx, dhx, SubjectPublicKeyInfo); 784 MAKE_DECODER("DHX", dhx, dhx, type_specific_params); 785 MAKE_DECODER("DHX", dhx, dhx, DHX); 786 #endif 787 #ifndef OPENSSL_NO_DSA 788 MAKE_DECODER("DSA", dsa, dsa, PrivateKeyInfo); 789 MAKE_DECODER("DSA", dsa, dsa, SubjectPublicKeyInfo); 790 MAKE_DECODER("DSA", dsa, dsa, type_specific); 791 MAKE_DECODER("DSA", dsa, dsa, DSA); 792 #endif 793 #ifndef OPENSSL_NO_EC 794 MAKE_DECODER("EC", ec, ec, PrivateKeyInfo); 795 MAKE_DECODER("EC", ec, ec, SubjectPublicKeyInfo); 796 MAKE_DECODER("EC", ec, ec, type_specific_no_pub); 797 MAKE_DECODER("EC", ec, ec, EC); 798 MAKE_DECODER("X25519", x25519, ecx, PrivateKeyInfo); 799 MAKE_DECODER("X25519", x25519, ecx, SubjectPublicKeyInfo); 800 MAKE_DECODER("X448", x448, ecx, PrivateKeyInfo); 801 MAKE_DECODER("X448", x448, ecx, SubjectPublicKeyInfo); 802 MAKE_DECODER("ED25519", ed25519, ecx, PrivateKeyInfo); 803 MAKE_DECODER("ED25519", ed25519, ecx, SubjectPublicKeyInfo); 804 MAKE_DECODER("ED448", ed448, ecx, PrivateKeyInfo); 805 MAKE_DECODER("ED448", ed448, ecx, SubjectPublicKeyInfo); 806 # ifndef OPENSSL_NO_SM2 807 MAKE_DECODER("SM2", sm2, ec, PrivateKeyInfo); 808 MAKE_DECODER("SM2", sm2, ec, SubjectPublicKeyInfo); 809 # endif 810 #endif 811 MAKE_DECODER("RSA", rsa, rsa, PrivateKeyInfo); 812 MAKE_DECODER("RSA", rsa, rsa, SubjectPublicKeyInfo); 813 MAKE_DECODER("RSA", rsa, rsa, type_specific_keypair); 814 MAKE_DECODER("RSA", rsa, rsa, RSA); 815 MAKE_DECODER("RSA-PSS", rsapss, rsapss, PrivateKeyInfo); 816 MAKE_DECODER("RSA-PSS", rsapss, rsapss, SubjectPublicKeyInfo); 817