2 * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #include "internal/cryptlib.h"
11 #include "internal/nelem.h"
12 #include "crypto/evp.h"
13 #include "crypto/asn1.h"
14 #include "internal/provider.h"
15 #include "evp_local.h"
17 static OSSL_PARAM *paramdefs_to_params(const OSSL_PARAM *paramdefs)
21 OSSL_PARAM *params = NULL, *q;
23 for (cnt = 1, p = paramdefs; p->key != NULL; p++, cnt++)
26 params = OPENSSL_zalloc(cnt * sizeof(*params));
30 for (p = paramdefs, q = params; ; p++, q++) {
35 q->data = NULL; /* In case the provider used it */
42 static OSSL_PARAM *reduce_params(OSSL_PARAM *params)
44 OSSL_PARAM *curr, *next;
47 for (cnt = 0, curr = next = params; next->key != NULL; next++) {
48 if (next->return_size == 0)
55 *curr = *next; /* Terminating record */
58 curr = OPENSSL_realloc(params, cnt * sizeof(*params));
64 typedef union align_block_un {
68 #define ALIGN_SIZE sizeof(ALIGN_BLOCK)
70 static void *allocate_params_space(OSSL_PARAM *params)
72 unsigned char *data = NULL;
76 for (space = 0, p = params; p->key != NULL; p++)
77 space += ((p->return_size + ALIGN_SIZE - 1) / ALIGN_SIZE) * ALIGN_SIZE;
82 data = OPENSSL_zalloc(space);
86 for (space = 0, p = params; p->key != NULL; p++) {
87 p->data = data + space;
88 space += ((p->return_size + ALIGN_SIZE - 1) / ALIGN_SIZE) * ALIGN_SIZE;
94 void *evp_keymgmt_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt,
95 int want_domainparams)
97 void *provdata = NULL;
101 * If there is an underlying legacy key and it has changed, invalidate
102 * the cache of provider keys.
104 if (pk->pkey.ptr != NULL) {
106 * If there is no dirty counter, this key can't be used with
109 if (pk->ameth->dirty_cnt == NULL)
112 if (pk->ameth->dirty_cnt(pk) != pk->dirty_cnt_copy)
113 evp_keymgmt_clear_pkey_cache(pk);
117 * See if we have exported to this provider already.
118 * If we have, return immediately.
121 i < OSSL_NELEM(pk->pkeys) && pk->pkeys[i].keymgmt != NULL;
123 if (keymgmt == pk->pkeys[i].keymgmt
124 && want_domainparams == pk->pkeys[i].domainparams)
125 return pk->pkeys[i].provdata;
128 if (pk->pkey.ptr != NULL) {
129 /* There is a legacy key, try to export that one to the provider */
131 /* If the legacy key doesn't have an export function, give up */
132 if (pk->ameth->export_to == NULL)
135 /* Otherwise, simply use it. */
136 provdata = pk->ameth->export_to(pk, keymgmt, want_domainparams);
138 /* Synchronize the dirty count, but only if we exported successfully */
139 if (provdata != NULL)
140 pk->dirty_cnt_copy = pk->ameth->dirty_cnt(pk);
144 * Here, there is no legacy key, so we look at the already cached
145 * provider keys, and import from the first that supports it
146 * (i.e. use its export function), and export the imported data to
150 void *(*importfn)(void *provctx, const OSSL_PARAM params[]) =
151 want_domainparams ? keymgmt->importdomparams : keymgmt->importkey;
154 * If the given keymgmt doesn't have an import function, give up
156 if (importfn == NULL)
159 for (j = 0; j < i && pk->pkeys[j].keymgmt != NULL; j++) {
160 if (pk->pkeys[j].keymgmt->exportkey != NULL) {
161 const OSSL_PARAM *paramdefs = NULL;
162 OSSL_PARAM *params = NULL;
165 ossl_provider_ctx(EVP_KEYMGMT_provider(keymgmt));
166 int (*exportfn)(void *provctx, OSSL_PARAM params[]) = NULL;
168 if (pk->pkeys[j].domainparams != want_domainparams)
171 exportfn = want_domainparams
172 ? pk->pkeys[j].keymgmt->exportdomparams
173 : pk->pkeys[j].keymgmt->exportkey;
175 paramdefs = pk->pkeys[j].keymgmt->exportkey_types();
177 * All params have 'data' set to NULL. In that case,
178 * the exportkey call should just fill in 'return_size'
179 * in all applicable params.
181 params = paramdefs_to_params(paramdefs);
182 /* Get 'return_size' filled */
183 exportfn(pk->pkeys[j].provdata, params);
186 * Reduce the params by removing any entry that got return
187 * size zero, then allocate space and assign 'data' to point
188 * into the data block
190 params = reduce_params(params);
191 if ((data = allocate_params_space(params)) == NULL)
195 * Call the exportkey function a second time, to get
197 * If something goes wrong, go to the next cached key.
199 if (!exportfn(pk->pkeys[j].provdata, params))
203 * We should have all the data at this point, so import
204 * into the new provider and hope to get a key back.
206 provdata = importfn(provctx, params);
209 OPENSSL_free(params);
212 if (provdata != NULL)
219 * TODO(3.0) Right now, we assume we have ample space. We will
220 * have to think about a cache aging scheme, though, if |i| indexes
223 j = ossl_assert(i < OSSL_NELEM(pk->pkeys));
225 if (provdata != NULL) {
226 EVP_KEYMGMT_up_ref(keymgmt);
227 pk->pkeys[i].keymgmt = keymgmt;
228 pk->pkeys[i].provdata = provdata;
229 pk->pkeys[i].domainparams = want_domainparams;
235 void evp_keymgmt_clear_pkey_cache(EVP_PKEY *pk)
241 i < OSSL_NELEM(pk->pkeys) && pk->pkeys[i].keymgmt != NULL;
243 EVP_KEYMGMT *keymgmt = pk->pkeys[i].keymgmt;
244 void *provdata = pk->pkeys[i].provdata;
246 pk->pkeys[i].keymgmt = NULL;
247 pk->pkeys[i].provdata = NULL;
248 if (pk->pkeys[i].domainparams)
249 keymgmt->freedomparams(provdata);
251 keymgmt->freekey(provdata);
252 EVP_KEYMGMT_free(keymgmt);
257 void *evp_keymgmt_fromdata(EVP_PKEY *target, EVP_KEYMGMT *keymgmt,
258 const OSSL_PARAM params[], int domainparams)
260 void *provctx = ossl_provider_ctx(EVP_KEYMGMT_provider(keymgmt));
261 void *provdata = domainparams
262 ? keymgmt->importdomparams(provctx, params)
263 : keymgmt->importkey(provctx, params);
265 evp_keymgmt_clear_pkey_cache(target);
266 if (provdata != NULL) {
267 EVP_KEYMGMT_up_ref(keymgmt);
268 target->pkeys[0].keymgmt = keymgmt;
269 target->pkeys[0].provdata = provdata;
270 target->pkeys[0].domainparams = domainparams;
276 /* internal functions */
277 /* TODO(3.0) decide if these should be public or internal */
278 void *evp_keymgmt_importdomparams(const EVP_KEYMGMT *keymgmt,
279 const OSSL_PARAM params[])
281 void *provctx = ossl_provider_ctx(EVP_KEYMGMT_provider(keymgmt));
283 return keymgmt->importdomparams(provctx, params);
286 void *evp_keymgmt_gendomparams(const EVP_KEYMGMT *keymgmt,
287 const OSSL_PARAM params[])
289 void *provctx = ossl_provider_ctx(EVP_KEYMGMT_provider(keymgmt));
291 return keymgmt->gendomparams(provctx, params);
294 void evp_keymgmt_freedomparams(const EVP_KEYMGMT *keymgmt,
297 keymgmt->freedomparams(provdomparams);
300 int evp_keymgmt_exportdomparams(const EVP_KEYMGMT *keymgmt,
301 void *provdomparams, OSSL_PARAM params[])
303 return keymgmt->exportdomparams(provdomparams, params);
306 const OSSL_PARAM *evp_keymgmt_importdomparam_types(const EVP_KEYMGMT *keymgmt)
308 return keymgmt->importdomparam_types();
311 const OSSL_PARAM *evp_keymgmt_exportdomparam_types(const EVP_KEYMGMT *keymgmt)
313 return keymgmt->exportdomparam_types();
317 void *evp_keymgmt_importkey(const EVP_KEYMGMT *keymgmt,
318 const OSSL_PARAM params[])
320 void *provctx = ossl_provider_ctx(EVP_KEYMGMT_provider(keymgmt));
322 return keymgmt->importkey(provctx, params);
325 void *evp_keymgmt_genkey(const EVP_KEYMGMT *keymgmt, void *domparams,
326 const OSSL_PARAM params[])
328 void *provctx = ossl_provider_ctx(EVP_KEYMGMT_provider(keymgmt));
330 return keymgmt->genkey(provctx, domparams, params);
333 void *evp_keymgmt_loadkey(const EVP_KEYMGMT *keymgmt,
334 void *id, size_t idlen)
336 void *provctx = ossl_provider_ctx(EVP_KEYMGMT_provider(keymgmt));
338 return keymgmt->loadkey(provctx, id, idlen);
341 void evp_keymgmt_freekey(const EVP_KEYMGMT *keymgmt, void *provkey)
343 keymgmt->freekey(provkey);
346 int evp_keymgmt_exportkey(const EVP_KEYMGMT *keymgmt, void *provkey,
349 return keymgmt->exportkey(provkey, params);
352 const OSSL_PARAM *evp_keymgmt_importkey_types(const EVP_KEYMGMT *keymgmt)
354 return keymgmt->importkey_types();
357 const OSSL_PARAM *evp_keymgmt_exportkey_types(const EVP_KEYMGMT *keymgmt)
359 return keymgmt->exportkey_types();