From e621d2dfa2eda2d4ba21cacf6fe084a7b28606c4 Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Mon, 27 Feb 2023 11:42:19 +0100 Subject: [PATCH] libseckey: Use OSSL_FUNC_keymgmt_im/export_types_ex functions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The provider functions OSSL_FUNC_keymgmt_import_types() and OSSL_FUNC_keymgmt_export_types() do not get the provider context passed. However, the implementation of these functions in the secure key provider need the provider context to pass the call to the default provider and append some of its own types to the result. Up to now, the provider context was obtained using a global variable holding the secure key provider handle. This may not be save if multiple instances of the provider exist. Just recently OpenSSL added support for an extended form of these functions, namely OSSL_FUNC_keymgmt_import_types_ex() and OSSL_FUNC_keymgmt_export_types_ex(), that get the provider context passed as argument. Make use of these new functions, if compiled against an OpenSSL version that supports them. For older OpenSSL versions still use the global variable as before. See OpenSSL commit https://github.com/openssl/openssl/commit/5e3b84505e44377b183e7529dab7585674b83936 Signed-off-by: Ingo Franzki Signed-off-by: Jan Höppner --- libseckey/sk_provider.c | 149 ++++++++++++++++++++++++++++++++++++---- 1 file changed, 135 insertions(+), 14 deletions(-) diff --git a/libseckey/sk_provider.c b/libseckey/sk_provider.c index e60f83a4..338f67e0 100644 --- a/libseckey/sk_provider.c +++ b/libseckey/sk_provider.c @@ -174,6 +174,20 @@ static OSSL_FUNC_keymgmt_settable_params_fn sk_prov_keymgmt_rsa_pss_settable_params; static OSSL_FUNC_keymgmt_settable_params_fn sk_prov_keymgmt_ec_settable_params; +#ifdef OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX +static OSSL_FUNC_keymgmt_export_types_ex_fn + sk_prov_keymgmt_rsa_export_types_ex; +static OSSL_FUNC_keymgmt_export_types_ex_fn + sk_prov_keymgmt_rsa_pss_export_types_ex; +static OSSL_FUNC_keymgmt_export_types_ex_fn + sk_prov_keymgmt_ec_export_types_ex; +static OSSL_FUNC_keymgmt_import_types_ex_fn + sk_prov_keymgmt_rsa_import_types_ex; +static OSSL_FUNC_keymgmt_import_types_ex_fn + sk_prov_keymgmt_rsa_pss_import_types_ex; +static OSSL_FUNC_keymgmt_import_types_ex_fn + sk_prov_keymgmt_ec_import_types_ex; +#else static OSSL_FUNC_keymgmt_export_types_fn sk_prov_keymgmt_rsa_export_types; static OSSL_FUNC_keymgmt_export_types_fn @@ -185,6 +199,7 @@ static OSSL_FUNC_keymgmt_import_types_fn static OSSL_FUNC_keymgmt_import_types_fn sk_prov_keymgmt_rsa_pss_import_types; static OSSL_FUNC_keymgmt_import_types_fn sk_prov_keymgmt_ec_import_types; +#endif static OSSL_FUNC_keyexch_newctx_fn sk_prov_keyexch_ec_newctx; static OSSL_FUNC_keyexch_dupctx_fn sk_prov_keyexch_ec_dupctx; @@ -2947,14 +2962,14 @@ static const OSSL_PARAM sk_prov_imexport_types[] = { OSSL_PARAM_END }; -static const OSSL_PARAM *sk_prov_keymgmt_export_types(int selection, - int pkey_type) +static const OSSL_PARAM *sk_prov_keymgmt_export_types( + struct sk_prov_ctx *provctx, + int selection, + int pkey_type) { OSSL_FUNC_keymgmt_export_types_fn *default_export_types_fn; const OSSL_PARAM *default_parms = NULL, *params; - struct sk_prov_ctx *provctx; - provctx = OSSL_PROVIDER_get0_provider_ctx(sk_prov_securekey_provider); if (provctx == NULL) return NULL; @@ -2982,14 +2997,14 @@ static const OSSL_PARAM *sk_prov_keymgmt_export_types(int selection, sk_prov_imexport_types); } -static const OSSL_PARAM *sk_prov_keymgmt_import_types(int selection, - int pkey_type) +static const OSSL_PARAM *sk_prov_keymgmt_import_types( + struct sk_prov_ctx *provctx, + int selection, + int pkey_type) { OSSL_FUNC_keymgmt_import_types_fn *default_import_types_fn; const OSSL_PARAM *default_parms = NULL, *params; - struct sk_prov_ctx *provctx; - provctx = OSSL_PROVIDER_get0_provider_ctx(sk_prov_securekey_provider); if (provctx == NULL) return NULL; @@ -3337,15 +3352,39 @@ static const OSSL_PARAM *sk_prov_keymgmt_rsa_settable_params(void *vprovctx) return sk_prov_keymgmt_settable_params(provctx, EVP_PKEY_RSA); } +#ifdef OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX +static const OSSL_PARAM *sk_prov_keymgmt_rsa_export_types_ex(void *vprovctx, + int selection) +{ + struct sk_prov_ctx *provctx = vprovctx; + + return sk_prov_keymgmt_export_types(provctx, selection, EVP_PKEY_RSA); +} + +static const OSSL_PARAM *sk_prov_keymgmt_rsa_import_types_ex(void *vprovctx, + int selection) +{ + struct sk_prov_ctx *provctx = vprovctx; + + return sk_prov_keymgmt_import_types(provctx, selection, EVP_PKEY_RSA); +} +#else static const OSSL_PARAM *sk_prov_keymgmt_rsa_export_types(int selection) { - return sk_prov_keymgmt_export_types(selection, EVP_PKEY_RSA); + struct sk_prov_ctx *provctx = + OSSL_PROVIDER_get0_provider_ctx(sk_prov_securekey_provider); + + return sk_prov_keymgmt_export_types(provctx, selection, EVP_PKEY_RSA); } static const OSSL_PARAM *sk_prov_keymgmt_rsa_import_types(int selection) { - return sk_prov_keymgmt_import_types(selection, EVP_PKEY_RSA); + struct sk_prov_ctx *provctx = + OSSL_PROVIDER_get0_provider_ctx(sk_prov_securekey_provider); + + return sk_prov_keymgmt_import_types(provctx, selection, EVP_PKEY_RSA); } +#endif static void *sk_prov_keymgmt_rsa_gen_init(void *vprovctx, int selection, const OSSL_PARAM params[]) @@ -3407,15 +3446,43 @@ static const OSSL_PARAM *sk_prov_keymgmt_rsa_pss_settable_params(void *vprovctx) return sk_prov_keymgmt_settable_params(provctx, EVP_PKEY_RSA_PSS); } +#ifdef OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX +static const OSSL_PARAM *sk_prov_keymgmt_rsa_pss_export_types_ex(void *vprovctx, + int selection) +{ + struct sk_prov_ctx *provctx = vprovctx; + + return sk_prov_keymgmt_export_types(provctx, selection, + EVP_PKEY_RSA_PSS); +} + +static const OSSL_PARAM *sk_prov_keymgmt_rsa_pss_import_types_ex(void *vprovctx, + int selection) +{ + struct sk_prov_ctx *provctx = vprovctx; + + return sk_prov_keymgmt_import_types(provctx, selection, + EVP_PKEY_RSA_PSS); +} +#else static const OSSL_PARAM *sk_prov_keymgmt_rsa_pss_export_types(int selection) { - return sk_prov_keymgmt_export_types(selection, EVP_PKEY_RSA_PSS); + struct sk_prov_ctx *provctx = + OSSL_PROVIDER_get0_provider_ctx(sk_prov_securekey_provider); + + return sk_prov_keymgmt_export_types(provctx, selection, + EVP_PKEY_RSA_PSS); } static const OSSL_PARAM *sk_prov_keymgmt_rsa_pss_import_types(int selection) { - return sk_prov_keymgmt_import_types(selection, EVP_PKEY_RSA_PSS); + struct sk_prov_ctx *provctx = + OSSL_PROVIDER_get0_provider_ctx(sk_prov_securekey_provider); + + return sk_prov_keymgmt_import_types(provctx, selection, + EVP_PKEY_RSA_PSS); } +#endif static void *sk_prov_keymgmt_rsa_pss_gen_init(void *vprovctx, int selection, const OSSL_PARAM params[]) @@ -3490,15 +3557,39 @@ static const OSSL_PARAM *sk_prov_keymgmt_ec_settable_params(void *vprovctx) return sk_prov_keymgmt_settable_params(provctx, EVP_PKEY_EC); } +#ifdef OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX +static const OSSL_PARAM *sk_prov_keymgmt_ec_export_types_ex(void *vprovctx, + int selection) +{ + struct sk_prov_ctx *provctx = vprovctx; + + return sk_prov_keymgmt_export_types(provctx, selection, EVP_PKEY_EC); +} + +static const OSSL_PARAM *sk_prov_keymgmt_ec_import_types_ex(void *vprovctx, + int selection) +{ + struct sk_prov_ctx *provctx = vprovctx; + + return sk_prov_keymgmt_import_types(provctx, selection, EVP_PKEY_EC); +} +#else static const OSSL_PARAM *sk_prov_keymgmt_ec_export_types(int selection) { - return sk_prov_keymgmt_export_types(selection, EVP_PKEY_EC); + struct sk_prov_ctx *provctx = + OSSL_PROVIDER_get0_provider_ctx(sk_prov_securekey_provider); + + return sk_prov_keymgmt_export_types(provctx, selection, EVP_PKEY_EC); } static const OSSL_PARAM *sk_prov_keymgmt_ec_import_types(int selection) { - return sk_prov_keymgmt_import_types(selection, EVP_PKEY_EC); + struct sk_prov_ctx *provctx = + OSSL_PROVIDER_get0_provider_ctx(sk_prov_securekey_provider); + + return sk_prov_keymgmt_import_types(provctx, selection, EVP_PKEY_EC); } +#endif static void *sk_prov_keymgmt_ec_gen_init(void *vprovctx, int selection, const OSSL_PARAM params[]) @@ -4648,11 +4739,21 @@ static const OSSL_DISPATCH sk_prov_rsa_keymgmt_functions[] = { /* Import and export routines */ { OSSL_FUNC_KEYMGMT_EXPORT, (void (*)(void))sk_prov_keymgmt_export }, +#ifdef OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX + { OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX, + (void (*)(void))sk_prov_keymgmt_rsa_export_types_ex }, +#else { OSSL_FUNC_KEYMGMT_EXPORT_TYPES, (void (*)(void))sk_prov_keymgmt_rsa_export_types }, +#endif { OSSL_FUNC_KEYMGMT_IMPORT, (void (*)(void))sk_prov_keymgmt_import }, +#ifdef OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX + { OSSL_FUNC_KEYMGMT_IMPORT_TYPES_EX, + (void (*)(void))sk_prov_keymgmt_rsa_import_types_ex }, +#else { OSSL_FUNC_KEYMGMT_IMPORT_TYPES, (void (*)(void))sk_prov_keymgmt_rsa_import_types }, +#endif /* No copy function, OpenSSL will use export/import to copy instead */ { 0, NULL } @@ -4697,11 +4798,21 @@ static const OSSL_DISPATCH sk_prov_rsapss_keymgmt_functions[] = { /* Import and export routines */ { OSSL_FUNC_KEYMGMT_EXPORT, (void (*)(void))sk_prov_keymgmt_export }, +#ifdef OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX + { OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX, + (void (*)(void))sk_prov_keymgmt_rsa_pss_export_types_ex }, +#else { OSSL_FUNC_KEYMGMT_EXPORT_TYPES, (void (*)(void))sk_prov_keymgmt_rsa_pss_export_types }, +#endif { OSSL_FUNC_KEYMGMT_IMPORT, (void (*)(void))sk_prov_keymgmt_import }, +#ifdef OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX + { OSSL_FUNC_KEYMGMT_IMPORT_TYPES_EX, + (void (*)(void))sk_prov_keymgmt_rsa_pss_import_types_ex }, +#else { OSSL_FUNC_KEYMGMT_IMPORT_TYPES, (void (*)(void))sk_prov_keymgmt_rsa_pss_import_types }, +#endif /* No copy function, OpenSSL will use export/import to copy instead */ { 0, NULL } @@ -4746,11 +4857,21 @@ static const OSSL_DISPATCH sk_prov_ec_keymgmt_functions[] = { /* Import and export routines */ { OSSL_FUNC_KEYMGMT_EXPORT, (void (*)(void))sk_prov_keymgmt_export }, +#ifdef OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX + { OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX, + (void (*)(void))sk_prov_keymgmt_ec_export_types_ex }, +#else { OSSL_FUNC_KEYMGMT_EXPORT_TYPES, (void (*)(void))sk_prov_keymgmt_ec_export_types }, +#endif { OSSL_FUNC_KEYMGMT_IMPORT, (void (*)(void))sk_prov_keymgmt_import }, +#ifdef OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX + { OSSL_FUNC_KEYMGMT_IMPORT_TYPES_EX, + (void (*)(void))sk_prov_keymgmt_ec_import_types_ex }, +#else { OSSL_FUNC_KEYMGMT_IMPORT_TYPES, (void (*)(void))sk_prov_keymgmt_ec_import_types }, +#endif /* No copy function, OpenSSL will use export/import to copy instead */ { 0, NULL }