mirror of
https://github.com/QuasarApp/openssl.git
synced 2025-05-10 16:39:40 +00:00
c24937d5e7
We've started to see "magic" numbers being used for certain sizes, such as algorithm names and property query strings. This change takes care of the few items where buffers for algorithm names and property query strings are used. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10928)
409 lines
12 KiB
C
409 lines
12 KiB
C
/*
|
|
* Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
|
|
*
|
|
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
|
* this file except in compliance with the License. You can obtain a copy
|
|
* in the file LICENSE in the source distribution or at
|
|
* https://www.openssl.org/source/license.html
|
|
*/
|
|
|
|
#include <openssl/crypto.h>
|
|
#include <openssl/core_numbers.h>
|
|
#include <openssl/core_names.h>
|
|
#include <openssl/dsa.h>
|
|
#include <openssl/params.h>
|
|
#include <openssl/evp.h>
|
|
#include "internal/sizes.h"
|
|
#include "prov/implementations.h"
|
|
#include "prov/provider_ctx.h"
|
|
#include "crypto/dsa.h"
|
|
|
|
static OSSL_OP_signature_newctx_fn dsa_newctx;
|
|
static OSSL_OP_signature_sign_init_fn dsa_signature_init;
|
|
static OSSL_OP_signature_verify_init_fn dsa_signature_init;
|
|
static OSSL_OP_signature_sign_fn dsa_sign;
|
|
static OSSL_OP_signature_verify_fn dsa_verify;
|
|
static OSSL_OP_signature_digest_sign_init_fn dsa_digest_signverify_init;
|
|
static OSSL_OP_signature_digest_sign_update_fn dsa_digest_signverify_update;
|
|
static OSSL_OP_signature_digest_sign_final_fn dsa_digest_sign_final;
|
|
static OSSL_OP_signature_digest_verify_init_fn dsa_digest_signverify_init;
|
|
static OSSL_OP_signature_digest_verify_update_fn dsa_digest_signverify_update;
|
|
static OSSL_OP_signature_digest_verify_final_fn dsa_digest_verify_final;
|
|
static OSSL_OP_signature_freectx_fn dsa_freectx;
|
|
static OSSL_OP_signature_dupctx_fn dsa_dupctx;
|
|
static OSSL_OP_signature_get_ctx_params_fn dsa_get_ctx_params;
|
|
static OSSL_OP_signature_gettable_ctx_params_fn dsa_gettable_ctx_params;
|
|
static OSSL_OP_signature_set_ctx_params_fn dsa_set_ctx_params;
|
|
static OSSL_OP_signature_settable_ctx_params_fn dsa_settable_ctx_params;
|
|
static OSSL_OP_signature_get_ctx_md_params_fn dsa_get_ctx_md_params;
|
|
static OSSL_OP_signature_gettable_ctx_md_params_fn dsa_gettable_ctx_md_params;
|
|
static OSSL_OP_signature_set_ctx_md_params_fn dsa_set_ctx_md_params;
|
|
static OSSL_OP_signature_settable_ctx_md_params_fn dsa_settable_ctx_md_params;
|
|
|
|
/*
|
|
* What's passed as an actual key is defined by the KEYMGMT interface.
|
|
* We happen to know that our KEYMGMT simply passes DSA structures, so
|
|
* we use that here too.
|
|
*/
|
|
|
|
typedef struct {
|
|
OPENSSL_CTX *libctx;
|
|
DSA *dsa;
|
|
size_t mdsize;
|
|
char mdname[OSSL_MAX_NAME_SIZE];
|
|
EVP_MD *md;
|
|
EVP_MD_CTX *mdctx;
|
|
} PROV_DSA_CTX;
|
|
|
|
static void *dsa_newctx(void *provctx)
|
|
{
|
|
PROV_DSA_CTX *pdsactx = OPENSSL_zalloc(sizeof(PROV_DSA_CTX));
|
|
|
|
if (pdsactx == NULL)
|
|
return NULL;
|
|
|
|
pdsactx->libctx = PROV_LIBRARY_CONTEXT_OF(provctx);
|
|
return pdsactx;
|
|
}
|
|
|
|
static int dsa_signature_init(void *vpdsactx, void *vdsa)
|
|
{
|
|
PROV_DSA_CTX *pdsactx = (PROV_DSA_CTX *)vpdsactx;
|
|
|
|
if (pdsactx == NULL || vdsa == NULL || !DSA_up_ref(vdsa))
|
|
return 0;
|
|
DSA_free(pdsactx->dsa);
|
|
pdsactx->dsa = vdsa;
|
|
return 1;
|
|
}
|
|
|
|
static int dsa_sign(void *vpdsactx, unsigned char *sig, size_t *siglen,
|
|
size_t sigsize, const unsigned char *tbs, size_t tbslen)
|
|
{
|
|
PROV_DSA_CTX *pdsactx = (PROV_DSA_CTX *)vpdsactx;
|
|
int ret;
|
|
unsigned int sltmp;
|
|
size_t dsasize = DSA_size(pdsactx->dsa);
|
|
|
|
if (sig == NULL) {
|
|
*siglen = dsasize;
|
|
return 1;
|
|
}
|
|
|
|
if (sigsize < (size_t)dsasize)
|
|
return 0;
|
|
|
|
if (pdsactx->mdsize != 0 && tbslen != pdsactx->mdsize)
|
|
return 0;
|
|
|
|
ret = dsa_sign_int(pdsactx->libctx, 0, tbs, tbslen, sig, &sltmp,
|
|
pdsactx->dsa);
|
|
if (ret <= 0)
|
|
return 0;
|
|
|
|
*siglen = sltmp;
|
|
return 1;
|
|
}
|
|
|
|
static int dsa_verify(void *vpdsactx, const unsigned char *sig, size_t siglen,
|
|
const unsigned char *tbs, size_t tbslen)
|
|
{
|
|
PROV_DSA_CTX *pdsactx = (PROV_DSA_CTX *)vpdsactx;
|
|
|
|
if (pdsactx->mdsize != 0 && tbslen != pdsactx->mdsize)
|
|
return 0;
|
|
|
|
return DSA_verify(0, tbs, tbslen, sig, siglen, pdsactx->dsa);
|
|
}
|
|
|
|
static int dsa_digest_signverify_init(void *vpdsactx, const char *mdname,
|
|
const char *props, void *vdsa)
|
|
{
|
|
PROV_DSA_CTX *pdsactx = (PROV_DSA_CTX *)vpdsactx;
|
|
EVP_MD *md;
|
|
|
|
if (!dsa_signature_init(vpdsactx, vdsa))
|
|
return 0;
|
|
|
|
md = EVP_MD_fetch(pdsactx->libctx, mdname, props);
|
|
if (md == NULL)
|
|
return 0;
|
|
pdsactx->md = md;
|
|
pdsactx->mdsize = EVP_MD_size(md);
|
|
pdsactx->mdctx = EVP_MD_CTX_new();
|
|
if (pdsactx->mdctx == NULL)
|
|
return 0;
|
|
|
|
if (!EVP_DigestInit_ex(pdsactx->mdctx, md, NULL))
|
|
return 0;
|
|
|
|
return 1;
|
|
}
|
|
|
|
int dsa_digest_signverify_update(void *vpdsactx, const unsigned char *data,
|
|
size_t datalen)
|
|
{
|
|
PROV_DSA_CTX *pdsactx = (PROV_DSA_CTX *)vpdsactx;
|
|
|
|
if (pdsactx == NULL || pdsactx->mdctx == NULL)
|
|
return 0;
|
|
|
|
return EVP_DigestUpdate(pdsactx->mdctx, data, datalen);
|
|
}
|
|
|
|
int dsa_digest_sign_final(void *vpdsactx, unsigned char *sig, size_t *siglen,
|
|
size_t sigsize)
|
|
{
|
|
PROV_DSA_CTX *pdsactx = (PROV_DSA_CTX *)vpdsactx;
|
|
unsigned char digest[EVP_MAX_MD_SIZE];
|
|
unsigned int dlen = 0;
|
|
|
|
if (pdsactx == NULL || pdsactx->mdctx == NULL)
|
|
return 0;
|
|
|
|
/*
|
|
* If sig is NULL then we're just finding out the sig size. Other fields
|
|
* are ignored. Defer to dsa_sign.
|
|
*/
|
|
if (sig != NULL) {
|
|
/*
|
|
* TODO(3.0): There is the possibility that some externally provided
|
|
* digests exceed EVP_MAX_MD_SIZE. We should probably handle that somehow -
|
|
* but that problem is much larger than just in DSA.
|
|
*/
|
|
if (!EVP_DigestFinal_ex(pdsactx->mdctx, digest, &dlen))
|
|
return 0;
|
|
}
|
|
|
|
return dsa_sign(vpdsactx, sig, siglen, sigsize, digest, (size_t)dlen);
|
|
}
|
|
|
|
|
|
int dsa_digest_verify_final(void *vpdsactx, const unsigned char *sig,
|
|
size_t siglen)
|
|
{
|
|
PROV_DSA_CTX *pdsactx = (PROV_DSA_CTX *)vpdsactx;
|
|
unsigned char digest[EVP_MAX_MD_SIZE];
|
|
unsigned int dlen = 0;
|
|
|
|
if (pdsactx == NULL || pdsactx->mdctx == NULL)
|
|
return 0;
|
|
|
|
/*
|
|
* TODO(3.0): There is the possibility that some externally provided
|
|
* digests exceed EVP_MAX_MD_SIZE. We should probably handle that somehow -
|
|
* but that problem is much larger than just in DSA.
|
|
*/
|
|
if (!EVP_DigestFinal_ex(pdsactx->mdctx, digest, &dlen))
|
|
return 0;
|
|
|
|
return dsa_verify(vpdsactx, sig, siglen, digest, (size_t)dlen);
|
|
}
|
|
|
|
static void dsa_freectx(void *vpdsactx)
|
|
{
|
|
PROV_DSA_CTX *pdsactx = (PROV_DSA_CTX *)vpdsactx;
|
|
|
|
DSA_free(pdsactx->dsa);
|
|
EVP_MD_CTX_free(pdsactx->mdctx);
|
|
EVP_MD_free(pdsactx->md);
|
|
|
|
OPENSSL_free(pdsactx);
|
|
}
|
|
|
|
static void *dsa_dupctx(void *vpdsactx)
|
|
{
|
|
PROV_DSA_CTX *srcctx = (PROV_DSA_CTX *)vpdsactx;
|
|
PROV_DSA_CTX *dstctx;
|
|
|
|
dstctx = OPENSSL_zalloc(sizeof(*srcctx));
|
|
if (dstctx == NULL)
|
|
return NULL;
|
|
|
|
*dstctx = *srcctx;
|
|
dstctx->dsa = NULL;
|
|
dstctx->md = NULL;
|
|
dstctx->mdctx = NULL;
|
|
|
|
if (srcctx->dsa != NULL && !DSA_up_ref(srcctx->dsa))
|
|
goto err;
|
|
dstctx->dsa = srcctx->dsa;
|
|
|
|
if (srcctx->md != NULL && !EVP_MD_up_ref(srcctx->md))
|
|
goto err;
|
|
dstctx->md = srcctx->md;
|
|
|
|
if (srcctx->mdctx != NULL) {
|
|
dstctx->mdctx = EVP_MD_CTX_new();
|
|
if (dstctx->mdctx == NULL
|
|
|| !EVP_MD_CTX_copy_ex(dstctx->mdctx, srcctx->mdctx))
|
|
goto err;
|
|
}
|
|
|
|
return dstctx;
|
|
err:
|
|
dsa_freectx(dstctx);
|
|
return NULL;
|
|
}
|
|
|
|
static int dsa_get_ctx_params(void *vpdsactx, OSSL_PARAM *params)
|
|
{
|
|
PROV_DSA_CTX *pdsactx = (PROV_DSA_CTX *)vpdsactx;
|
|
OSSL_PARAM *p;
|
|
|
|
if (pdsactx == NULL || params == NULL)
|
|
return 0;
|
|
|
|
p = OSSL_PARAM_locate(params, OSSL_SIGNATURE_PARAM_DIGEST_SIZE);
|
|
if (p != NULL && !OSSL_PARAM_set_size_t(p, pdsactx->mdsize))
|
|
return 0;
|
|
|
|
p = OSSL_PARAM_locate(params, OSSL_SIGNATURE_PARAM_DIGEST);
|
|
if (p != NULL && !OSSL_PARAM_set_utf8_string(p, pdsactx->md == NULL
|
|
? pdsactx->mdname
|
|
: EVP_MD_name(pdsactx->md)))
|
|
return 0;
|
|
|
|
return 1;
|
|
}
|
|
|
|
static const OSSL_PARAM known_gettable_ctx_params[] = {
|
|
OSSL_PARAM_size_t(OSSL_SIGNATURE_PARAM_DIGEST_SIZE, NULL),
|
|
OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_DIGEST, NULL, 0),
|
|
OSSL_PARAM_END
|
|
};
|
|
|
|
static const OSSL_PARAM *dsa_gettable_ctx_params(void)
|
|
{
|
|
return known_gettable_ctx_params;
|
|
}
|
|
|
|
static int dsa_set_ctx_params(void *vpdsactx, const OSSL_PARAM params[])
|
|
{
|
|
PROV_DSA_CTX *pdsactx = (PROV_DSA_CTX *)vpdsactx;
|
|
const OSSL_PARAM *p;
|
|
char *mdname;
|
|
|
|
if (pdsactx == NULL || params == NULL)
|
|
return 0;
|
|
|
|
if (pdsactx->md != NULL) {
|
|
/*
|
|
* You cannot set the digest name/size when doing a DigestSign or
|
|
* DigestVerify.
|
|
*/
|
|
return 1;
|
|
}
|
|
|
|
p = OSSL_PARAM_locate_const(params, OSSL_SIGNATURE_PARAM_DIGEST_SIZE);
|
|
if (p != NULL && !OSSL_PARAM_get_size_t(p, &pdsactx->mdsize))
|
|
return 0;
|
|
|
|
/*
|
|
* We never actually use the mdname, but we do support getting it later.
|
|
* This can be useful for applications that want to know the MD that they
|
|
* previously set.
|
|
*/
|
|
p = OSSL_PARAM_locate_const(params, OSSL_SIGNATURE_PARAM_DIGEST);
|
|
mdname = pdsactx->mdname;
|
|
if (p != NULL
|
|
&& !OSSL_PARAM_get_utf8_string(p, &mdname, sizeof(pdsactx->mdname)))
|
|
return 0;
|
|
|
|
return 1;
|
|
}
|
|
|
|
static const OSSL_PARAM known_settable_ctx_params[] = {
|
|
OSSL_PARAM_size_t(OSSL_SIGNATURE_PARAM_DIGEST_SIZE, NULL),
|
|
OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_DIGEST, NULL, 0),
|
|
OSSL_PARAM_END
|
|
};
|
|
|
|
static const OSSL_PARAM *dsa_settable_ctx_params(void)
|
|
{
|
|
/*
|
|
* TODO(3.0): Should this function return a different set of settable ctx
|
|
* params if the ctx is being used for a DigestSign/DigestVerify? In that
|
|
* case it is not allowed to set the digest size/digest name because the
|
|
* digest is explicitly set as part of the init.
|
|
*/
|
|
return known_settable_ctx_params;
|
|
}
|
|
|
|
static int dsa_get_ctx_md_params(void *vpdsactx, OSSL_PARAM *params)
|
|
{
|
|
PROV_DSA_CTX *pdsactx = (PROV_DSA_CTX *)vpdsactx;
|
|
|
|
if (pdsactx->mdctx == NULL)
|
|
return 0;
|
|
|
|
return EVP_MD_CTX_get_params(pdsactx->mdctx, params);
|
|
}
|
|
|
|
static const OSSL_PARAM *dsa_gettable_ctx_md_params(void *vpdsactx)
|
|
{
|
|
PROV_DSA_CTX *pdsactx = (PROV_DSA_CTX *)vpdsactx;
|
|
|
|
if (pdsactx->md == NULL)
|
|
return 0;
|
|
|
|
return EVP_MD_gettable_ctx_params(pdsactx->md);
|
|
}
|
|
|
|
static int dsa_set_ctx_md_params(void *vpdsactx, const OSSL_PARAM params[])
|
|
{
|
|
PROV_DSA_CTX *pdsactx = (PROV_DSA_CTX *)vpdsactx;
|
|
|
|
if (pdsactx->mdctx == NULL)
|
|
return 0;
|
|
|
|
return EVP_MD_CTX_set_params(pdsactx->mdctx, params);
|
|
}
|
|
|
|
static const OSSL_PARAM *dsa_settable_ctx_md_params(void *vpdsactx)
|
|
{
|
|
PROV_DSA_CTX *pdsactx = (PROV_DSA_CTX *)vpdsactx;
|
|
|
|
if (pdsactx->md == NULL)
|
|
return 0;
|
|
|
|
return EVP_MD_settable_ctx_params(pdsactx->md);
|
|
}
|
|
|
|
const OSSL_DISPATCH dsa_signature_functions[] = {
|
|
{ OSSL_FUNC_SIGNATURE_NEWCTX, (void (*)(void))dsa_newctx },
|
|
{ OSSL_FUNC_SIGNATURE_SIGN_INIT, (void (*)(void))dsa_signature_init },
|
|
{ OSSL_FUNC_SIGNATURE_SIGN, (void (*)(void))dsa_sign },
|
|
{ OSSL_FUNC_SIGNATURE_VERIFY_INIT, (void (*)(void))dsa_signature_init },
|
|
{ OSSL_FUNC_SIGNATURE_VERIFY, (void (*)(void))dsa_verify },
|
|
{ OSSL_FUNC_SIGNATURE_DIGEST_SIGN_INIT,
|
|
(void (*)(void))dsa_digest_signverify_init },
|
|
{ OSSL_FUNC_SIGNATURE_DIGEST_SIGN_UPDATE,
|
|
(void (*)(void))dsa_digest_signverify_update },
|
|
{ OSSL_FUNC_SIGNATURE_DIGEST_SIGN_FINAL,
|
|
(void (*)(void))dsa_digest_sign_final },
|
|
{ OSSL_FUNC_SIGNATURE_DIGEST_VERIFY_INIT,
|
|
(void (*)(void))dsa_digest_signverify_init },
|
|
{ OSSL_FUNC_SIGNATURE_DIGEST_VERIFY_UPDATE,
|
|
(void (*)(void))dsa_digest_signverify_update },
|
|
{ OSSL_FUNC_SIGNATURE_DIGEST_VERIFY_FINAL,
|
|
(void (*)(void))dsa_digest_verify_final },
|
|
{ OSSL_FUNC_SIGNATURE_FREECTX, (void (*)(void))dsa_freectx },
|
|
{ OSSL_FUNC_SIGNATURE_DUPCTX, (void (*)(void))dsa_dupctx },
|
|
{ OSSL_FUNC_SIGNATURE_GET_CTX_PARAMS, (void (*)(void))dsa_get_ctx_params },
|
|
{ OSSL_FUNC_SIGNATURE_GETTABLE_CTX_PARAMS,
|
|
(void (*)(void))dsa_gettable_ctx_params },
|
|
{ OSSL_FUNC_SIGNATURE_SET_CTX_PARAMS, (void (*)(void))dsa_set_ctx_params },
|
|
{ OSSL_FUNC_SIGNATURE_SETTABLE_CTX_PARAMS,
|
|
(void (*)(void))dsa_settable_ctx_params },
|
|
{ OSSL_FUNC_SIGNATURE_GET_CTX_MD_PARAMS,
|
|
(void (*)(void))dsa_get_ctx_md_params },
|
|
{ OSSL_FUNC_SIGNATURE_GETTABLE_CTX_MD_PARAMS,
|
|
(void (*)(void))dsa_gettable_ctx_md_params },
|
|
{ OSSL_FUNC_SIGNATURE_SET_CTX_MD_PARAMS,
|
|
(void (*)(void))dsa_set_ctx_md_params },
|
|
{ OSSL_FUNC_SIGNATURE_SETTABLE_CTX_MD_PARAMS,
|
|
(void (*)(void))dsa_settable_ctx_md_params },
|
|
{ 0, NULL }
|
|
};
|