1 /*
2 * Copyright 2019-2023 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 #include <openssl/err.h>
11 #include <openssl/ui.h>
12 #include <openssl/params.h>
13 #include <openssl/encoder.h>
14 #include <openssl/core_names.h>
15 #include <openssl/provider.h>
16 #include <openssl/safestack.h>
17 #include <openssl/trace.h>
18 #include "internal/provider.h"
19 #include "internal/property.h"
20 #include "internal/namemap.h"
21 #include "crypto/evp.h"
22 #include "encoder_local.h"
23
DEFINE_STACK_OF(OSSL_ENCODER)24 DEFINE_STACK_OF(OSSL_ENCODER)
25
26 int OSSL_ENCODER_CTX_set_cipher(OSSL_ENCODER_CTX *ctx,
27 const char *cipher_name,
28 const char *propquery)
29 {
30 OSSL_PARAM params[] = { OSSL_PARAM_END, OSSL_PARAM_END, OSSL_PARAM_END };
31
32 params[0] =
33 OSSL_PARAM_construct_utf8_string(OSSL_ENCODER_PARAM_CIPHER,
34 (void *)cipher_name, 0);
35 params[1] =
36 OSSL_PARAM_construct_utf8_string(OSSL_ENCODER_PARAM_PROPERTIES,
37 (void *)propquery, 0);
38
39 return OSSL_ENCODER_CTX_set_params(ctx, params);
40 }
41
OSSL_ENCODER_CTX_set_passphrase(OSSL_ENCODER_CTX * ctx,const unsigned char * kstr,size_t klen)42 int OSSL_ENCODER_CTX_set_passphrase(OSSL_ENCODER_CTX *ctx,
43 const unsigned char *kstr,
44 size_t klen)
45 {
46 return ossl_pw_set_passphrase(&ctx->pwdata, kstr, klen);
47 }
48
OSSL_ENCODER_CTX_set_passphrase_ui(OSSL_ENCODER_CTX * ctx,const UI_METHOD * ui_method,void * ui_data)49 int OSSL_ENCODER_CTX_set_passphrase_ui(OSSL_ENCODER_CTX *ctx,
50 const UI_METHOD *ui_method,
51 void *ui_data)
52 {
53 return ossl_pw_set_ui_method(&ctx->pwdata, ui_method, ui_data);
54 }
55
OSSL_ENCODER_CTX_set_pem_password_cb(OSSL_ENCODER_CTX * ctx,pem_password_cb * cb,void * cbarg)56 int OSSL_ENCODER_CTX_set_pem_password_cb(OSSL_ENCODER_CTX *ctx,
57 pem_password_cb *cb, void *cbarg)
58 {
59 return ossl_pw_set_pem_password_cb(&ctx->pwdata, cb, cbarg);
60 }
61
OSSL_ENCODER_CTX_set_passphrase_cb(OSSL_ENCODER_CTX * ctx,OSSL_PASSPHRASE_CALLBACK * cb,void * cbarg)62 int OSSL_ENCODER_CTX_set_passphrase_cb(OSSL_ENCODER_CTX *ctx,
63 OSSL_PASSPHRASE_CALLBACK *cb,
64 void *cbarg)
65 {
66 return ossl_pw_set_ossl_passphrase_cb(&ctx->pwdata, cb, cbarg);
67 }
68
69 /*
70 * Support for OSSL_ENCODER_CTX_new_for_type:
71 * finding a suitable encoder
72 */
73
74 struct collected_encoder_st {
75 STACK_OF(OPENSSL_CSTRING) *names;
76 int *id_names;
77 const char *output_structure;
78 const char *output_type;
79
80 const OSSL_PROVIDER *keymgmt_prov;
81 OSSL_ENCODER_CTX *ctx;
82 unsigned int flag_find_same_provider:1;
83
84 int error_occurred;
85 };
86
collect_encoder(OSSL_ENCODER * encoder,void * arg)87 static void collect_encoder(OSSL_ENCODER *encoder, void *arg)
88 {
89 struct collected_encoder_st *data = arg;
90 const OSSL_PROVIDER *prov;
91
92 if (data->error_occurred)
93 return;
94
95 data->error_occurred = 1; /* Assume the worst */
96
97 prov = OSSL_ENCODER_get0_provider(encoder);
98 /*
99 * collect_encoder() is called in two passes, one where the encoders
100 * from the same provider as the keymgmt are looked up, and one where
101 * the other encoders are looked up. |data->flag_find_same_provider|
102 * tells us which pass we're in.
103 */
104 if ((data->keymgmt_prov == prov) == data->flag_find_same_provider) {
105 void *provctx = OSSL_PROVIDER_get0_provider_ctx(prov);
106 int i, end_i = sk_OPENSSL_CSTRING_num(data->names);
107 int match;
108
109 for (i = 0; i < end_i; i++) {
110 if (data->flag_find_same_provider)
111 match = (data->id_names[i] == encoder->base.id);
112 else
113 match = OSSL_ENCODER_is_a(encoder,
114 sk_OPENSSL_CSTRING_value(data->names, i));
115 if (!match
116 || (encoder->does_selection != NULL
117 && !encoder->does_selection(provctx, data->ctx->selection))
118 || (data->keymgmt_prov != prov
119 && encoder->import_object == NULL))
120 continue;
121
122 /* Only add each encoder implementation once */
123 if (OSSL_ENCODER_CTX_add_encoder(data->ctx, encoder))
124 break;
125 }
126 }
127
128 data->error_occurred = 0; /* All is good now */
129 }
130
131 struct collected_names_st {
132 STACK_OF(OPENSSL_CSTRING) *names;
133 unsigned int error_occurred:1;
134 };
135
collect_name(const char * name,void * arg)136 static void collect_name(const char *name, void *arg)
137 {
138 struct collected_names_st *data = arg;
139
140 if (data->error_occurred)
141 return;
142
143 data->error_occurred = 1; /* Assume the worst */
144
145 if (sk_OPENSSL_CSTRING_push(data->names, name) <= 0)
146 return;
147
148 data->error_occurred = 0; /* All is good now */
149 }
150
151 /*
152 * Support for OSSL_ENCODER_to_bio:
153 * writing callback for the OSSL_PARAM (the implementation doesn't have
154 * intimate knowledge of the provider side object)
155 */
156
157 struct construct_data_st {
158 const EVP_PKEY *pk;
159 int selection;
160
161 OSSL_ENCODER_INSTANCE *encoder_inst;
162 const void *obj;
163 void *constructed_obj;
164 };
165
encoder_import_cb(const OSSL_PARAM params[],void * arg)166 static int encoder_import_cb(const OSSL_PARAM params[], void *arg)
167 {
168 struct construct_data_st *construct_data = arg;
169 OSSL_ENCODER_INSTANCE *encoder_inst = construct_data->encoder_inst;
170 OSSL_ENCODER *encoder = OSSL_ENCODER_INSTANCE_get_encoder(encoder_inst);
171 void *encoderctx = OSSL_ENCODER_INSTANCE_get_encoder_ctx(encoder_inst);
172
173 construct_data->constructed_obj =
174 encoder->import_object(encoderctx, construct_data->selection, params);
175
176 return (construct_data->constructed_obj != NULL);
177 }
178
179 static const void *
encoder_construct_pkey(OSSL_ENCODER_INSTANCE * encoder_inst,void * arg)180 encoder_construct_pkey(OSSL_ENCODER_INSTANCE *encoder_inst, void *arg)
181 {
182 struct construct_data_st *data = arg;
183
184 if (data->obj == NULL) {
185 OSSL_ENCODER *encoder =
186 OSSL_ENCODER_INSTANCE_get_encoder(encoder_inst);
187 const EVP_PKEY *pk = data->pk;
188 const OSSL_PROVIDER *k_prov = EVP_KEYMGMT_get0_provider(pk->keymgmt);
189 const OSSL_PROVIDER *e_prov = OSSL_ENCODER_get0_provider(encoder);
190
191 if (k_prov != e_prov) {
192 int selection = data->selection;
193
194 if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0)
195 selection |= OSSL_KEYMGMT_SELECT_PUBLIC_KEY;
196 data->encoder_inst = encoder_inst;
197
198 if (!evp_keymgmt_export(pk->keymgmt, pk->keydata, selection,
199 &encoder_import_cb, data))
200 return NULL;
201 data->obj = data->constructed_obj;
202 } else {
203 data->obj = pk->keydata;
204 }
205 }
206
207 return data->obj;
208 }
209
encoder_destruct_pkey(void * arg)210 static void encoder_destruct_pkey(void *arg)
211 {
212 struct construct_data_st *data = arg;
213
214 if (data->encoder_inst != NULL) {
215 OSSL_ENCODER *encoder =
216 OSSL_ENCODER_INSTANCE_get_encoder(data->encoder_inst);
217
218 encoder->free_object(data->constructed_obj);
219 }
220 data->constructed_obj = NULL;
221 }
222
223 /*
224 * OSSL_ENCODER_CTX_new_for_pkey() returns a ctx with no encoder if
225 * it couldn't find a suitable encoder. This allows a caller to detect if
226 * a suitable encoder was found, with OSSL_ENCODER_CTX_get_num_encoder(),
227 * and to use fallback methods if the result is NULL.
228 */
ossl_encoder_ctx_setup_for_pkey(OSSL_ENCODER_CTX * ctx,const EVP_PKEY * pkey,int selection,const char * propquery)229 static int ossl_encoder_ctx_setup_for_pkey(OSSL_ENCODER_CTX *ctx,
230 const EVP_PKEY *pkey,
231 int selection,
232 const char *propquery)
233 {
234 struct construct_data_st *data = NULL;
235 const OSSL_PROVIDER *prov = NULL;
236 OSSL_LIB_CTX *libctx = NULL;
237 int ok = 0, i, end;
238 OSSL_NAMEMAP *namemap;
239
240 if (!ossl_assert(ctx != NULL) || !ossl_assert(pkey != NULL)) {
241 ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_NULL_PARAMETER);
242 return 0;
243 }
244
245 if (evp_pkey_is_provided(pkey)) {
246 prov = EVP_KEYMGMT_get0_provider(pkey->keymgmt);
247 libctx = ossl_provider_libctx(prov);
248 }
249
250 if (pkey->keymgmt != NULL) {
251 struct collected_encoder_st encoder_data;
252 struct collected_names_st keymgmt_data;
253
254 if ((data = OPENSSL_zalloc(sizeof(*data))) == NULL)
255 goto err;
256
257 /*
258 * Select the first encoder implementations in two steps.
259 * First, collect the keymgmt names, then the encoders that match.
260 */
261 keymgmt_data.names = sk_OPENSSL_CSTRING_new_null();
262 if (keymgmt_data.names == NULL) {
263 ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_CRYPTO_LIB);
264 goto err;
265 }
266
267 keymgmt_data.error_occurred = 0;
268 EVP_KEYMGMT_names_do_all(pkey->keymgmt, collect_name, &keymgmt_data);
269 if (keymgmt_data.error_occurred) {
270 sk_OPENSSL_CSTRING_free(keymgmt_data.names);
271 goto err;
272 }
273
274 encoder_data.names = keymgmt_data.names;
275 encoder_data.output_type = ctx->output_type;
276 encoder_data.output_structure = ctx->output_structure;
277 encoder_data.error_occurred = 0;
278 encoder_data.keymgmt_prov = prov;
279 encoder_data.ctx = ctx;
280 encoder_data.id_names = NULL;
281
282 /*
283 * collect_encoder() is called many times, and for every call it converts all encoder_data.names
284 * into namemap ids if it calls OSSL_ENCODER_is_a(). We cache the ids here instead,
285 * and can use them for encoders with the same provider as the keymgmt.
286 */
287 namemap = ossl_namemap_stored(libctx);
288 end = sk_OPENSSL_CSTRING_num(encoder_data.names);
289 if (end > 0) {
290 encoder_data.id_names = OPENSSL_malloc(end * sizeof(int));
291 if (encoder_data.id_names == NULL) {
292 sk_OPENSSL_CSTRING_free(keymgmt_data.names);
293 goto err;
294 }
295 for (i = 0; i < end; ++i) {
296 const char *name = sk_OPENSSL_CSTRING_value(keymgmt_data.names, i);
297
298 encoder_data.id_names[i] = ossl_namemap_name2num(namemap, name);
299 }
300 }
301 /*
302 * Place the encoders with the a different provider as the keymgmt
303 * last (the chain is processed in reverse order)
304 */
305 encoder_data.flag_find_same_provider = 0;
306 OSSL_ENCODER_do_all_provided(libctx, collect_encoder, &encoder_data);
307
308 /*
309 * Place the encoders with the same provider as the keymgmt first
310 * (the chain is processed in reverse order)
311 */
312 encoder_data.flag_find_same_provider = 1;
313 OSSL_ENCODER_do_all_provided(libctx, collect_encoder, &encoder_data);
314
315 OPENSSL_free(encoder_data.id_names);
316 sk_OPENSSL_CSTRING_free(keymgmt_data.names);
317 if (encoder_data.error_occurred) {
318 ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_CRYPTO_LIB);
319 goto err;
320 }
321 }
322
323 if (data != NULL && OSSL_ENCODER_CTX_get_num_encoders(ctx) != 0) {
324 if (!OSSL_ENCODER_CTX_set_construct(ctx, encoder_construct_pkey)
325 || !OSSL_ENCODER_CTX_set_construct_data(ctx, data)
326 || !OSSL_ENCODER_CTX_set_cleanup(ctx, encoder_destruct_pkey))
327 goto err;
328
329 data->pk = pkey;
330 data->selection = selection;
331
332 data = NULL; /* Avoid it being freed */
333 }
334
335 ok = 1;
336 err:
337 if (data != NULL) {
338 OSSL_ENCODER_CTX_set_construct_data(ctx, NULL);
339 OPENSSL_free(data);
340 }
341 return ok;
342 }
343
OSSL_ENCODER_CTX_new_for_pkey(const EVP_PKEY * pkey,int selection,const char * output_type,const char * output_struct,const char * propquery)344 OSSL_ENCODER_CTX *OSSL_ENCODER_CTX_new_for_pkey(const EVP_PKEY *pkey,
345 int selection,
346 const char *output_type,
347 const char *output_struct,
348 const char *propquery)
349 {
350 OSSL_ENCODER_CTX *ctx = NULL;
351 OSSL_LIB_CTX *libctx = NULL;
352
353 if (pkey == NULL) {
354 ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_NULL_PARAMETER);
355 return NULL;
356 }
357
358 if (!evp_pkey_is_assigned(pkey)) {
359 ERR_raise_data(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_INVALID_ARGUMENT,
360 "The passed EVP_PKEY must be assigned a key");
361 return NULL;
362 }
363
364 if ((ctx = OSSL_ENCODER_CTX_new()) == NULL) {
365 ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_OSSL_ENCODER_LIB);
366 return NULL;
367 }
368
369 if (evp_pkey_is_provided(pkey)) {
370 const OSSL_PROVIDER *prov = EVP_KEYMGMT_get0_provider(pkey->keymgmt);
371
372 libctx = ossl_provider_libctx(prov);
373 }
374
375 OSSL_TRACE_BEGIN(ENCODER) {
376 BIO_printf(trc_out,
377 "(ctx %p) Looking for %s encoders with selection %d\n",
378 (void *)ctx, EVP_PKEY_get0_type_name(pkey), selection);
379 BIO_printf(trc_out, " output type: %s, output structure: %s\n",
380 output_type, output_struct);
381 } OSSL_TRACE_END(ENCODER);
382
383 if (OSSL_ENCODER_CTX_set_output_type(ctx, output_type)
384 && (output_struct == NULL
385 || OSSL_ENCODER_CTX_set_output_structure(ctx, output_struct))
386 && OSSL_ENCODER_CTX_set_selection(ctx, selection)
387 && ossl_encoder_ctx_setup_for_pkey(ctx, pkey, selection, propquery)
388 && OSSL_ENCODER_CTX_add_extra(ctx, libctx, propquery)) {
389 OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
390 int save_parameters = pkey->save_parameters;
391
392 params[0] = OSSL_PARAM_construct_int(OSSL_ENCODER_PARAM_SAVE_PARAMETERS,
393 &save_parameters);
394 /* ignoring error as this is only auxiliary parameter */
395 (void)OSSL_ENCODER_CTX_set_params(ctx, params);
396
397 OSSL_TRACE_BEGIN(ENCODER) {
398 BIO_printf(trc_out, "(ctx %p) Got %d encoders\n",
399 (void *)ctx, OSSL_ENCODER_CTX_get_num_encoders(ctx));
400 } OSSL_TRACE_END(ENCODER);
401 return ctx;
402 }
403
404 OSSL_ENCODER_CTX_free(ctx);
405 return NULL;
406 }
407
