xref: /openssl/crypto/evp/pmeth_check.c (revision 11f18ef1)
1 /*
2  * Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved.
3  *
4  * Licensed under the Apache License 2.0 (the "License").  You may not use
5  * this file except in compliance with the License.  You can obtain a copy
6  * in the file LICENSE in the source distribution or at
7  * https://www.openssl.org/source/license.html
8  */
9 
10 #include <stdio.h>
11 #include <stdlib.h>
12 #include "internal/cryptlib.h"
13 #include <openssl/objects.h>
14 #include <openssl/evp.h>
15 #include "crypto/bn.h"
16 #ifndef FIPS_MODULE
17 # include "crypto/asn1.h"
18 #endif
19 #include "crypto/evp.h"
20 #include "evp_local.h"
21 
22 /*
23  * Returns:
24  *  1   True
25  *  0   False
26  * -1   Unsupported (use legacy path)
27  */
try_provided_check(EVP_PKEY_CTX * ctx,int selection,int checktype)28 static int try_provided_check(EVP_PKEY_CTX *ctx, int selection, int checktype)
29 {
30     EVP_KEYMGMT *keymgmt;
31     void *keydata;
32 
33     if (evp_pkey_ctx_is_legacy(ctx))
34         return -1;
35 
36     keymgmt = ctx->keymgmt;
37     keydata = evp_pkey_export_to_provider(ctx->pkey, ctx->libctx,
38                                           &keymgmt, ctx->propquery);
39     if (keydata == NULL) {
40         ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
41         return 0;
42     }
43 
44     return evp_keymgmt_validate(keymgmt, keydata, selection, checktype);
45 }
46 
evp_pkey_public_check_combined(EVP_PKEY_CTX * ctx,int checktype)47 static int evp_pkey_public_check_combined(EVP_PKEY_CTX *ctx, int checktype)
48 {
49     EVP_PKEY *pkey = ctx->pkey;
50     int ok;
51 
52     if (pkey == NULL) {
53         ERR_raise(ERR_LIB_EVP, EVP_R_NO_KEY_SET);
54         return 0;
55     }
56 
57     if ((ok = try_provided_check(ctx, OSSL_KEYMGMT_SELECT_PUBLIC_KEY,
58                                  checktype)) != -1)
59         return ok;
60 
61     if (pkey->type == EVP_PKEY_NONE)
62         goto not_supported;
63 
64 #ifndef FIPS_MODULE
65     /* legacy */
66     /* call customized public key check function first */
67     if (ctx->pmeth->public_check != NULL)
68         return ctx->pmeth->public_check(pkey);
69 
70     /* use default public key check function in ameth */
71     if (pkey->ameth == NULL || pkey->ameth->pkey_public_check == NULL)
72         goto not_supported;
73 
74     return pkey->ameth->pkey_public_check(pkey);
75 #endif
76  not_supported:
77     ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
78     return -2;
79 }
80 
EVP_PKEY_public_check(EVP_PKEY_CTX * ctx)81 int EVP_PKEY_public_check(EVP_PKEY_CTX *ctx)
82 {
83     return evp_pkey_public_check_combined(ctx, OSSL_KEYMGMT_VALIDATE_FULL_CHECK);
84 }
85 
EVP_PKEY_public_check_quick(EVP_PKEY_CTX * ctx)86 int EVP_PKEY_public_check_quick(EVP_PKEY_CTX *ctx)
87 {
88     return evp_pkey_public_check_combined(ctx, OSSL_KEYMGMT_VALIDATE_QUICK_CHECK);
89 }
90 
evp_pkey_param_check_combined(EVP_PKEY_CTX * ctx,int checktype)91 static int evp_pkey_param_check_combined(EVP_PKEY_CTX *ctx, int checktype)
92 {
93     EVP_PKEY *pkey = ctx->pkey;
94     int ok;
95 
96     if (pkey == NULL) {
97         ERR_raise(ERR_LIB_EVP, EVP_R_NO_KEY_SET);
98         return 0;
99     }
100 
101     if ((ok = try_provided_check(ctx,
102                                  OSSL_KEYMGMT_SELECT_ALL_PARAMETERS,
103                                  checktype)) != -1)
104         return ok;
105 
106     if (pkey->type == EVP_PKEY_NONE)
107         goto not_supported;
108 
109 #ifndef FIPS_MODULE
110     /* legacy */
111     /* call customized param check function first */
112     if (ctx->pmeth->param_check != NULL)
113         return ctx->pmeth->param_check(pkey);
114 
115     /* use default param check function in ameth */
116     if (pkey->ameth == NULL || pkey->ameth->pkey_param_check == NULL)
117         goto not_supported;
118 
119     return pkey->ameth->pkey_param_check(pkey);
120 #endif
121  not_supported:
122     ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
123     return -2;
124 }
125 
EVP_PKEY_param_check(EVP_PKEY_CTX * ctx)126 int EVP_PKEY_param_check(EVP_PKEY_CTX *ctx)
127 {
128     return evp_pkey_param_check_combined(ctx, OSSL_KEYMGMT_VALIDATE_FULL_CHECK);
129 }
130 
EVP_PKEY_param_check_quick(EVP_PKEY_CTX * ctx)131 int EVP_PKEY_param_check_quick(EVP_PKEY_CTX *ctx)
132 {
133     return evp_pkey_param_check_combined(ctx, OSSL_KEYMGMT_VALIDATE_QUICK_CHECK);
134 }
135 
EVP_PKEY_private_check(EVP_PKEY_CTX * ctx)136 int EVP_PKEY_private_check(EVP_PKEY_CTX *ctx)
137 {
138     EVP_PKEY *pkey = ctx->pkey;
139     int ok;
140 
141     if (pkey == NULL) {
142         ERR_raise(ERR_LIB_EVP, EVP_R_NO_KEY_SET);
143         return 0;
144     }
145 
146     if ((ok = try_provided_check(ctx, OSSL_KEYMGMT_SELECT_PRIVATE_KEY,
147                                  OSSL_KEYMGMT_VALIDATE_FULL_CHECK)) != -1)
148         return ok;
149 
150     /* not supported for legacy keys */
151     ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
152     return -2;
153 }
154 
EVP_PKEY_check(EVP_PKEY_CTX * ctx)155 int EVP_PKEY_check(EVP_PKEY_CTX *ctx)
156 {
157     return EVP_PKEY_pairwise_check(ctx);
158 }
159 
EVP_PKEY_pairwise_check(EVP_PKEY_CTX * ctx)160 int EVP_PKEY_pairwise_check(EVP_PKEY_CTX *ctx)
161 {
162     EVP_PKEY *pkey = ctx->pkey;
163     int ok;
164 
165     if (pkey == NULL) {
166         ERR_raise(ERR_LIB_EVP, EVP_R_NO_KEY_SET);
167         return 0;
168     }
169 
170     if ((ok = try_provided_check(ctx, OSSL_KEYMGMT_SELECT_KEYPAIR,
171                                  OSSL_KEYMGMT_VALIDATE_FULL_CHECK)) != -1)
172         return ok;
173 
174     if (pkey->type == EVP_PKEY_NONE)
175         goto not_supported;
176 
177 #ifndef FIPS_MODULE
178     /* legacy */
179     /* call customized check function first */
180     if (ctx->pmeth->check != NULL)
181         return ctx->pmeth->check(pkey);
182 
183     /* use default check function in ameth */
184     if (pkey->ameth == NULL || pkey->ameth->pkey_check == NULL)
185         goto not_supported;
186 
187     return pkey->ameth->pkey_check(pkey);
188 #endif
189  not_supported:
190     ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
191     return -2;
192 }
193 
194