1 /* 2 * Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 /* 11 * Low level APIs are deprecated for public use, but still ok for internal use. 12 */ 13 #include "internal/deprecated.h" 14 15 #include <string.h> 16 #include <openssl/core.h> 17 #include <openssl/core_dispatch.h> 18 #include <openssl/core_names.h> 19 #include <openssl/params.h> 20 #include <openssl/err.h> 21 #include <openssl/pem.h> /* Functions for writing MSBLOB and PVK */ 22 #include <openssl/dsa.h> 23 #include "internal/passphrase.h" 24 #include "crypto/rsa.h" 25 #include "prov/implementations.h" 26 #include "prov/bio.h" 27 #include "prov/provider_ctx.h" 28 #include "endecoder_local.h" 29 30 struct key2ms_ctx_st { 31 PROV_CTX *provctx; 32 33 int pvk_encr_level; 34 35 struct ossl_passphrase_data_st pwdata; 36 }; 37 38 static int write_msblob(struct key2ms_ctx_st *ctx, OSSL_CORE_BIO *cout, 39 EVP_PKEY *pkey, int ispub) 40 { 41 BIO *out = ossl_bio_new_from_core_bio(ctx->provctx, cout); 42 int ret; 43 44 if (out == NULL) 45 return 0; 46 ret = ispub ? i2b_PublicKey_bio(out, pkey) : i2b_PrivateKey_bio(out, pkey); 47 48 BIO_free(out); 49 return ret; 50 } 51 52 static int write_pvk(struct key2ms_ctx_st *ctx, OSSL_CORE_BIO *cout, 53 EVP_PKEY *pkey) 54 { 55 BIO *out = NULL; 56 int ret; 57 OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx); 58 59 out = ossl_bio_new_from_core_bio(ctx->provctx, cout); 60 if (out == NULL) 61 return 0; 62 ret = i2b_PVK_bio_ex(out, pkey, ctx->pvk_encr_level, 63 ossl_pw_pvk_password, &ctx->pwdata, libctx, NULL); 64 BIO_free(out); 65 return ret; 66 } 67 68 static OSSL_FUNC_encoder_newctx_fn key2ms_newctx; 69 static OSSL_FUNC_encoder_freectx_fn key2ms_freectx; 70 static OSSL_FUNC_encoder_does_selection_fn key2ms_does_selection; 71 72 static void *key2ms_newctx(void *provctx) 73 { 74 struct key2ms_ctx_st *ctx = OPENSSL_zalloc(sizeof(*ctx)); 75 76 if (ctx != NULL) { 77 ctx->provctx = provctx; 78 /* This is the strongest encryption level */ 79 ctx->pvk_encr_level = 2; 80 } 81 return ctx; 82 } 83 84 static void key2ms_freectx(void *vctx) 85 { 86 struct key2ms_ctx_st *ctx = vctx; 87 88 ossl_pw_clear_passphrase_data(&ctx->pwdata); 89 OPENSSL_free(ctx); 90 } 91 92 static const OSSL_PARAM *key2pvk_settable_ctx_params(ossl_unused void *provctx) 93 { 94 static const OSSL_PARAM settables[] = { 95 OSSL_PARAM_int(OSSL_ENCODER_PARAM_ENCRYPT_LEVEL, NULL), 96 OSSL_PARAM_END, 97 }; 98 99 return settables; 100 } 101 102 static int key2pvk_set_ctx_params(void *vctx, const OSSL_PARAM params[]) 103 { 104 struct key2ms_ctx_st *ctx = vctx; 105 const OSSL_PARAM *p; 106 107 p = OSSL_PARAM_locate_const(params, OSSL_ENCODER_PARAM_ENCRYPT_LEVEL); 108 if (p != NULL && !OSSL_PARAM_get_int(p, &ctx->pvk_encr_level)) 109 return 0; 110 return 1; 111 } 112 113 static int key2ms_does_selection(void *vctx, int selection) 114 { 115 return (selection & OSSL_KEYMGMT_SELECT_KEYPAIR) != 0; 116 } 117 118 /* 119 * The real EVP_PKEY_set1_TYPE() functions take a non-const key, while the key 120 * pointer in the encode function is a const pointer. We violate the constness 121 * knowingly, since we know that the key comes from the same provider, is never 122 * actually const, and the implied reference count change is safe. 123 * 124 * EVP_PKEY_assign() can't be used, because there's no way to clear the internal 125 * key using that function without freeing the existing internal key. 126 */ 127 typedef int evp_pkey_set1_fn(EVP_PKEY *, const void *key); 128 129 static int key2msblob_encode(void *vctx, const void *key, int selection, 130 OSSL_CORE_BIO *cout, evp_pkey_set1_fn *set1_key, 131 OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg) 132 { 133 struct key2ms_ctx_st *ctx = vctx; 134 int ispub = -1; 135 EVP_PKEY *pkey = NULL; 136 int ok = 0; 137 138 if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0) 139 ispub = 0; 140 else if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0) 141 ispub = 1; 142 else 143 return 0; /* Error */ 144 145 if ((pkey = EVP_PKEY_new()) != NULL && set1_key(pkey, key)) 146 ok = write_msblob(ctx, cout, pkey, ispub); 147 EVP_PKEY_free(pkey); 148 return ok; 149 } 150 151 static int key2pvk_encode(void *vctx, const void *key, int selection, 152 OSSL_CORE_BIO *cout, evp_pkey_set1_fn *set1_key, 153 OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg) 154 { 155 struct key2ms_ctx_st *ctx = vctx; 156 EVP_PKEY *pkey = NULL; 157 int ok = 0; 158 159 if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) == 0) 160 return 0; /* Error */ 161 162 if ((pkey = EVP_PKEY_new()) != NULL && set1_key(pkey, key) 163 && (pw_cb == NULL 164 || ossl_pw_set_ossl_passphrase_cb(&ctx->pwdata, pw_cb, pw_cbarg))) 165 ok = write_pvk(ctx, cout, pkey); 166 EVP_PKEY_free(pkey); 167 return ok; 168 } 169 170 #define dsa_set1 (evp_pkey_set1_fn *)EVP_PKEY_set1_DSA 171 #define rsa_set1 (evp_pkey_set1_fn *)EVP_PKEY_set1_RSA 172 173 #define msblob_set_params 174 #define pvk_set_params \ 175 { OSSL_FUNC_ENCODER_SETTABLE_CTX_PARAMS, \ 176 (void (*)(void))key2pvk_settable_ctx_params }, \ 177 { OSSL_FUNC_ENCODER_SET_CTX_PARAMS, \ 178 (void (*)(void))key2pvk_set_ctx_params }, 179 180 #define MAKE_MS_ENCODER(impl, output, type) \ 181 static OSSL_FUNC_encoder_import_object_fn \ 182 impl##2##output##_import_object; \ 183 static OSSL_FUNC_encoder_free_object_fn impl##2##output##_free_object; \ 184 static OSSL_FUNC_encoder_encode_fn impl##2##output##_encode; \ 185 \ 186 static void * \ 187 impl##2##output##_import_object(void *ctx, int selection, \ 188 const OSSL_PARAM params[]) \ 189 { \ 190 return ossl_prov_import_key(ossl_##impl##_keymgmt_functions, \ 191 ctx, selection, params); \ 192 } \ 193 static void impl##2##output##_free_object(void *key) \ 194 { \ 195 ossl_prov_free_key(ossl_##impl##_keymgmt_functions, key); \ 196 } \ 197 static int impl##2##output##_encode(void *vctx, OSSL_CORE_BIO *cout, \ 198 const void *key, \ 199 const OSSL_PARAM key_abstract[], \ 200 int selection, \ 201 OSSL_PASSPHRASE_CALLBACK *cb, \ 202 void *cbarg) \ 203 { \ 204 /* We don't deal with abstract objects */ \ 205 if (key_abstract != NULL) { \ 206 ERR_raise(ERR_LIB_PROV, ERR_R_PASSED_INVALID_ARGUMENT); \ 207 return 0; \ 208 } \ 209 return key2##output##_encode(vctx, key, selection, cout, type##_set1, \ 210 cb, cbarg); \ 211 } \ 212 const OSSL_DISPATCH ossl_##impl##_to_##output##_encoder_functions[] = { \ 213 { OSSL_FUNC_ENCODER_NEWCTX, \ 214 (void (*)(void))key2ms_newctx }, \ 215 { OSSL_FUNC_ENCODER_FREECTX, \ 216 (void (*)(void))key2ms_freectx }, \ 217 output##_set_params { OSSL_FUNC_ENCODER_DOES_SELECTION, \ 218 (void (*)(void))key2ms_does_selection }, \ 219 { OSSL_FUNC_ENCODER_IMPORT_OBJECT, \ 220 (void (*)(void))impl##2##output##_import_object }, \ 221 { OSSL_FUNC_ENCODER_FREE_OBJECT, \ 222 (void (*)(void))impl##2##output##_free_object }, \ 223 { OSSL_FUNC_ENCODER_ENCODE, \ 224 (void (*)(void))impl##2##output##_encode }, \ 225 OSSL_DISPATCH_END \ 226 } 227 228 #ifndef OPENSSL_NO_DSA 229 MAKE_MS_ENCODER(dsa, pvk, dsa); 230 MAKE_MS_ENCODER(dsa, msblob, dsa); 231 #endif 232 233 MAKE_MS_ENCODER(rsa, pvk, rsa); 234 MAKE_MS_ENCODER(rsa, msblob, rsa); 235