/src/openssl36/providers/implementations/encode_decode/encode_key2ms.c

Source
/*
 * Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */
/* clang-format off */

/* clang-format on */

/*
 * Low level APIs are deprecated for public use, but still ok for internal use.
 */
#include "internal/deprecated.h"

#include <string.h>
#include <openssl/core.h>
#include <openssl/core_dispatch.h>
#include <openssl/core_names.h>
#include <openssl/params.h>
#include <openssl/err.h>
#include <openssl/proverr.h>
#include <openssl/pem.h> /* Functions for writing MSBLOB and PVK */
#include <openssl/dsa.h>
#include "internal/cryptlib.h"
#include "internal/passphrase.h"
#include "crypto/rsa.h"
#include "prov/implementations.h"
#include "prov/bio.h"
#include "prov/provider_ctx.h"
#include "prov/endecoder_local.h"

struct key2ms_ctx_st {
    PROV_CTX *provctx;

    int pvk_encr_level;

    struct ossl_passphrase_data_st pwdata;
};

static int write_msblob(struct key2ms_ctx_st *ctx, OSSL_CORE_BIO *cout,
    EVP_PKEY *pkey, int ispub)
{
    BIO *out = ossl_bio_new_from_core_bio(ctx->provctx, cout);
    int ret;

    if (out == NULL)
        return 0;
    ret = ispub ? i2b_PublicKey_bio(out, pkey) : i2b_PrivateKey_bio(out, pkey);

    BIO_free(out);
    return ret;
}

static int write_pvk(struct key2ms_ctx_st *ctx, OSSL_CORE_BIO *cout,
    EVP_PKEY *pkey)
{
    BIO *out = NULL;
    int ret;
    OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx);

    out = ossl_bio_new_from_core_bio(ctx->provctx, cout);
    if (out == NULL)
        return 0;
    ret = i2b_PVK_bio_ex(out, pkey, ctx->pvk_encr_level,
        ossl_pw_pvk_password, &ctx->pwdata, libctx, NULL);
    BIO_free(out);
    return ret;
}

static OSSL_FUNC_encoder_newctx_fn key2ms_newctx;
static OSSL_FUNC_encoder_freectx_fn key2ms_freectx;
static OSSL_FUNC_encoder_does_selection_fn key2ms_does_selection;

static void *key2ms_newctx(void *provctx)
{
    struct key2ms_ctx_st *ctx = OPENSSL_zalloc(sizeof(*ctx));

    if (ctx != NULL) {
        ctx->provctx = provctx;
        /* This is the strongest encryption level */
        ctx->pvk_encr_level = 2;
    }
    return ctx;
}

static void key2ms_freectx(void *vctx)
{
    struct key2ms_ctx_st *ctx = vctx;

    ossl_pw_clear_passphrase_data(&ctx->pwdata);
    OPENSSL_free(ctx);
}

/* clang-format off */
/* Machine generated by util/perl/OpenSSL/paramnames.pm */
#ifndef key2pvk_set_ctx_params_list
static const OSSL_PARAM key2pvk_set_ctx_params_list[] = {
    OSSL_PARAM_int(OSSL_ENCODER_PARAM_ENCRYPT_LEVEL, NULL),
    OSSL_PARAM_END
};
#endif

#ifndef key2pvk_set_ctx_params_st
struct key2pvk_set_ctx_params_st {
    OSSL_PARAM *enclvl;
};
#endif

#ifndef key2pvk_set_ctx_params_decoder
static int key2pvk_set_ctx_params_decoder
    (const OSSL_PARAM *p, struct key2pvk_set_ctx_params_st *r)
{
    const char *s;

    memset(r, 0, sizeof(*r));
    if (p != NULL)
        for (; (s = p->key) != NULL; p++)
            if (ossl_likely(strcmp("encrypt-level", s + 0) == 0)) {
                /* OSSL_ENCODER_PARAM_ENCRYPT_LEVEL */
                if (ossl_unlikely(r->enclvl != NULL)) {
                    ERR_raise_data(ERR_LIB_PROV, PROV_R_REPEATED_PARAMETER,
                                   "param %s is repeated", s);
                    return 0;
                }
                r->enclvl = (OSSL_PARAM *)p;
            }
    return 1;
}
#endif
/* End of machine generated */
/* clang-format on */

static const OSSL_PARAM *key2pvk_settable_ctx_params(ossl_unused void *provctx)
{
    return key2pvk_set_ctx_params_list;
}

static int key2pvk_set_ctx_params(void *vctx, const OSSL_PARAM params[])
{
    struct key2ms_ctx_st *ctx = vctx;
    struct key2pvk_set_ctx_params_st p;

    if (ctx == NULL || !key2pvk_set_ctx_params_decoder(params, &p))
        return 0;

    if (p.enclvl != NULL && !OSSL_PARAM_get_int(p.enclvl, &ctx->pvk_encr_level))
        return 0;
    return 1;
}

static int key2ms_does_selection(void *vctx, int selection)
{
    return (selection & OSSL_KEYMGMT_SELECT_KEYPAIR) != 0;
}

/*
 * The real EVP_PKEY_set1_TYPE() functions take a non-const key, while the key
 * pointer in the encode function is a const pointer.  We violate the constness
 * knowingly, since we know that the key comes from the same provider, is never
 * actually const, and the implied reference count change is safe.
 *
 * EVP_PKEY_assign() can't be used, because there's no way to clear the internal
 * key using that function without freeing the existing internal key.
 */
typedef int evp_pkey_set1_fn(EVP_PKEY *, const void *key);

static int key2msblob_encode(void *vctx, const void *key, int selection,
    OSSL_CORE_BIO *cout, evp_pkey_set1_fn *set1_key,
    OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg)
{
    struct key2ms_ctx_st *ctx = vctx;
    int ispub = -1;
    EVP_PKEY *pkey = NULL;
    int ok = 0;

    if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0)
        ispub = 0;
    else if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0)
        ispub = 1;
    else
        return 0; /* Error */

    if ((pkey = EVP_PKEY_new()) != NULL && set1_key(pkey, key))
        ok = write_msblob(ctx, cout, pkey, ispub);
    EVP_PKEY_free(pkey);
    return ok;
}

static int key2pvk_encode(void *vctx, const void *key, int selection,
    OSSL_CORE_BIO *cout, evp_pkey_set1_fn *set1_key,
    OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg)
{
    struct key2ms_ctx_st *ctx = vctx;
    EVP_PKEY *pkey = NULL;
    int ok = 0;

    if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) == 0)
        return 0; /* Error */

    if ((pkey = EVP_PKEY_new()) != NULL && set1_key(pkey, key)
        && (pw_cb == NULL
            || ossl_pw_set_ossl_passphrase_cb(&ctx->pwdata, pw_cb, pw_cbarg)))
        ok = write_pvk(ctx, cout, pkey);
    EVP_PKEY_free(pkey);
    return ok;
}

#define dsa_set1 (evp_pkey_set1_fn *)EVP_PKEY_set1_DSA
#define rsa_set1 (evp_pkey_set1_fn *)EVP_PKEY_set1_RSA

#define msblob_set_params
#define pvk_set_params                                 \
    { OSSL_FUNC_ENCODER_SETTABLE_CTX_PARAMS,           \
        (void (*)(void))key2pvk_settable_ctx_params }, \
        { OSSL_FUNC_ENCODER_SET_CTX_PARAMS,            \
            (void (*)(void))key2pvk_set_ctx_params },

#define MAKE_MS_ENCODER(impl, output, type)                                   \
    static OSSL_FUNC_encoder_import_object_fn                                 \
        impl##2##output##_import_object;                                      \
    static OSSL_FUNC_encoder_free_object_fn impl##2##output##_free_object;    \
    static OSSL_FUNC_encoder_encode_fn impl##2##output##_encode;              \
                                                                              \
    static void *                                                             \
        impl##2##output##_import_object(void *ctx, int selection,             \
            const OSSL_PARAM params[])                                        \
    {                                                                         \
        return ossl_prov_import_key(ossl_##impl##_keymgmt_functions,          \
            ctx, selection, params);                                          \
    }                                                                         \
    static void impl##2##output##_free_object(void *key)                      \
    {                                                                         \
        ossl_prov_free_key(ossl_##impl##_keymgmt_functions, key);             \
    }                                                                         \
    static int impl##2##output##_encode(void *vctx, OSSL_CORE_BIO *cout,      \
        const void *key,                                                      \
        const OSSL_PARAM key_abstract[],                                      \
        int selection,                                                        \
        OSSL_PASSPHRASE_CALLBACK *cb,                                         \
        void *cbarg)                                                          \
    {                                                                         \
        /* We don't deal with abstract objects */                             \
        if (key_abstract != NULL) {                                           \
            ERR_raise(ERR_LIB_PROV, ERR_R_PASSED_INVALID_ARGUMENT);           \
            return 0;                                                         \
        }                                                                     \
        return key2##output##_encode(vctx, key, selection, cout, type##_set1, \
            cb, cbarg);                                                       \
    }                                                                         \
    const OSSL_DISPATCH ossl_##impl##_to_##output##_encoder_functions[] = {   \
        { OSSL_FUNC_ENCODER_NEWCTX,                                           \
            (void (*)(void))key2ms_newctx },                                  \
        { OSSL_FUNC_ENCODER_FREECTX,                                          \
            (void (*)(void))key2ms_freectx },                                 \
        output##_set_params { OSSL_FUNC_ENCODER_DOES_SELECTION,               \
            (void (*)(void))key2ms_does_selection },                          \
        { OSSL_FUNC_ENCODER_IMPORT_OBJECT,                                    \
            (void (*)(void))impl##2##output##_import_object },                \
        { OSSL_FUNC_ENCODER_FREE_OBJECT,                                      \
            (void (*)(void))impl##2##output##_free_object },                  \
        { OSSL_FUNC_ENCODER_ENCODE,                                           \
            (void (*)(void))impl##2##output##_encode },                       \
        OSSL_DISPATCH_END                                                     \
    }

#ifndef OPENSSL_NO_DSA
MAKE_MS_ENCODER(dsa, pvk, dsa);
MAKE_MS_ENCODER(dsa, msblob, dsa);
#endif

MAKE_MS_ENCODER(rsa, pvk, rsa);
MAKE_MS_ENCODER(rsa, msblob, rsa);

Coverage Report

Created: 2026-07-23 06:28

Line	Count	Source
1		/*
2		* Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved.
3		*
4		* Licensed under the Apache License 2.0 (the "License"). You may not use
5		* this file except in compliance with the License. You can obtain a copy
6		* in the file LICENSE in the source distribution or at
7		* https://www.openssl.org/source/license.html
8		*/
9		/* clang-format off */
10
11		/* clang-format on */
12
13		/*
14		* Low level APIs are deprecated for public use, but still ok for internal use.
15		*/
16		#include "internal/deprecated.h"
17
18		#include <string.h>
19		#include <openssl/core.h>
20		#include <openssl/core_dispatch.h>
21		#include <openssl/core_names.h>
22		#include <openssl/params.h>
23		#include <openssl/err.h>
24		#include <openssl/proverr.h>
25		#include <openssl/pem.h> /* Functions for writing MSBLOB and PVK */
26		#include <openssl/dsa.h>
27		#include "internal/cryptlib.h"
28		#include "internal/passphrase.h"
29		#include "crypto/rsa.h"
30		#include "prov/implementations.h"
31		#include "prov/bio.h"
32		#include "prov/provider_ctx.h"
33		#include "prov/endecoder_local.h"
34
35		struct key2ms_ctx_st {
36		PROV_CTX *provctx;
37
38		int pvk_encr_level;
39
40		struct ossl_passphrase_data_st pwdata;
41		};
42
43		static int write_msblob(struct key2ms_ctx_st ctx, OSSL_CORE_BIO cout,
44		EVP_PKEY *pkey, int ispub)
45	0	{
46	0	BIO *out = ossl_bio_new_from_core_bio(ctx->provctx, cout);
47	0	int ret;
48
49	0	if (out == NULL)
50	0	return 0;
51	0	ret = ispub ? i2b_PublicKey_bio(out, pkey) : i2b_PrivateKey_bio(out, pkey);
52
53	0	BIO_free(out);
54	0	return ret;
55	0	}
56
57		static int write_pvk(struct key2ms_ctx_st ctx, OSSL_CORE_BIO cout,
58		EVP_PKEY *pkey)
59	0	{
60	0	BIO *out = NULL;
61	0	int ret;
62	0	OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx);
63
64	0	out = ossl_bio_new_from_core_bio(ctx->provctx, cout);
65	0	if (out == NULL)
66	0	return 0;
67	0	ret = i2b_PVK_bio_ex(out, pkey, ctx->pvk_encr_level,
68	0	ossl_pw_pvk_password, &ctx->pwdata, libctx, NULL);
69	0	BIO_free(out);
70	0	return ret;
71	0	}
72
73		static OSSL_FUNC_encoder_newctx_fn key2ms_newctx;
74		static OSSL_FUNC_encoder_freectx_fn key2ms_freectx;
75		static OSSL_FUNC_encoder_does_selection_fn key2ms_does_selection;
76
77		static void key2ms_newctx(void provctx)
78	51.3k	{
79	51.3k	struct key2ms_ctx_st ctx = OPENSSL_zalloc(sizeof(ctx));
80
81	51.3k	if (ctx != NULL) {
82	51.3k	ctx->provctx = provctx;
83		/* This is the strongest encryption level */
84	51.3k	ctx->pvk_encr_level = 2;
85	51.3k	}
86	51.3k	return ctx;
87	51.3k	}
88
89		static void key2ms_freectx(void *vctx)
90	51.3k	{
91	51.3k	struct key2ms_ctx_st *ctx = vctx;
92
93	51.3k	ossl_pw_clear_passphrase_data(&ctx->pwdata);
94	51.3k	OPENSSL_free(ctx);
95	51.3k	}
96
97		/* clang-format off */
98		/* Machine generated by util/perl/OpenSSL/paramnames.pm */
99		#ifndef key2pvk_set_ctx_params_list
100		static const OSSL_PARAM key2pvk_set_ctx_params_list[] = {
101		OSSL_PARAM_int(OSSL_ENCODER_PARAM_ENCRYPT_LEVEL, NULL),
102		OSSL_PARAM_END
103		};
104		#endif
105
106		#ifndef key2pvk_set_ctx_params_st
107		struct key2pvk_set_ctx_params_st {
108		OSSL_PARAM *enclvl;
109		};
110		#endif
111
112		#ifndef key2pvk_set_ctx_params_decoder
113		static int key2pvk_set_ctx_params_decoder
114		(const OSSL_PARAM p, struct key2pvk_set_ctx_params_st r)
115	9.41k	{
116	9.41k	const char *s;
117
118	9.41k	memset(r, 0, sizeof(*r));
119	9.41k	if (p != NULL)
120	18.8k	for (; (s = p->key) != NULL; p++)
121	9.41k	if (ossl_likely(strcmp("encrypt-level", s + 0) == 0)) {
122		/* OSSL_ENCODER_PARAM_ENCRYPT_LEVEL */
123	0	if (ossl_unlikely(r->enclvl != NULL)) {
124	0	ERR_raise_data(ERR_LIB_PROV, PROV_R_REPEATED_PARAMETER,
125	0	"param %s is repeated", s);
126	0	return 0;
127	0	}
128	0	r->enclvl = (OSSL_PARAM *)p;
129	0	}
130	9.41k	return 1;
131	9.41k	}
132		#endif
133		/* End of machine generated */
134		/* clang-format on */
135
136		static const OSSL_PARAM key2pvk_settable_ctx_params(ossl_unused void provctx)
137	0	{
138	0	return key2pvk_set_ctx_params_list;
139	0	}
140
141		static int key2pvk_set_ctx_params(void *vctx, const OSSL_PARAM params[])
142	9.41k	{
143	9.41k	struct key2ms_ctx_st *ctx = vctx;
144	9.41k	struct key2pvk_set_ctx_params_st p;
145
146	9.41k	if (ctx == NULL \|\| !key2pvk_set_ctx_params_decoder(params, &p))
147	0	return 0;
148
149	9.41k	if (p.enclvl != NULL && !OSSL_PARAM_get_int(p.enclvl, &ctx->pvk_encr_level))
150	0	return 0;
151	9.41k	return 1;
152	9.41k	}
153
154		static int key2ms_does_selection(void *vctx, int selection)
155	128k	{
156	128k	return (selection & OSSL_KEYMGMT_SELECT_KEYPAIR) != 0;
157	128k	}
158
159		/*
160		* The real EVP_PKEY_set1_TYPE() functions take a non-const key, while the key
161		* pointer in the encode function is a const pointer. We violate the constness
162		* knowingly, since we know that the key comes from the same provider, is never
163		* actually const, and the implied reference count change is safe.
164		*
165		* EVP_PKEY_assign() can't be used, because there's no way to clear the internal
166		* key using that function without freeing the existing internal key.
167		*/
168		typedef int evp_pkey_set1_fn(EVP_PKEY , const void key);
169
170		static int key2msblob_encode(void vctx, const void key, int selection,
171		OSSL_CORE_BIO cout, evp_pkey_set1_fn set1_key,
172		OSSL_PASSPHRASE_CALLBACK pw_cb, void pw_cbarg)
173	0	{
174	0	struct key2ms_ctx_st *ctx = vctx;
175	0	int ispub = -1;
176	0	EVP_PKEY *pkey = NULL;
177	0	int ok = 0;
178
179	0	if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0)
180	0	ispub = 0;
181	0	else if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0)
182	0	ispub = 1;
183	0	else
184	0	return 0; /* Error */
185
186	0	if ((pkey = EVP_PKEY_new()) != NULL && set1_key(pkey, key))
187	0	ok = write_msblob(ctx, cout, pkey, ispub);
188	0	EVP_PKEY_free(pkey);
189	0	return ok;
190	0	}
191
192		static int key2pvk_encode(void vctx, const void key, int selection,
193		OSSL_CORE_BIO cout, evp_pkey_set1_fn set1_key,
194		OSSL_PASSPHRASE_CALLBACK pw_cb, void pw_cbarg)
195	0	{
196	0	struct key2ms_ctx_st *ctx = vctx;
197	0	EVP_PKEY *pkey = NULL;
198	0	int ok = 0;
199
200	0	if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) == 0)
201	0	return 0; /* Error */
202
203	0	if ((pkey = EVP_PKEY_new()) != NULL && set1_key(pkey, key)
204	0	&& (pw_cb == NULL
205	0	\|\| ossl_pw_set_ossl_passphrase_cb(&ctx->pwdata, pw_cb, pw_cbarg)))
206	0	ok = write_pvk(ctx, cout, pkey);
207	0	EVP_PKEY_free(pkey);
208	0	return ok;
209	0	}
210
211	0	#define dsa_set1 (evp_pkey_set1_fn *)EVP_PKEY_set1_DSA
212	0	#define rsa_set1 (evp_pkey_set1_fn *)EVP_PKEY_set1_RSA
213
214		#define msblob_set_params
215		#define pvk_set_params \
216		{ OSSL_FUNC_ENCODER_SETTABLE_CTX_PARAMS, \
217		(void (*)(void))key2pvk_settable_ctx_params }, \
218		{ OSSL_FUNC_ENCODER_SET_CTX_PARAMS, \
219		(void (*)(void))key2pvk_set_ctx_params },
220
221		#define MAKE_MS_ENCODER(impl, output, type) \
222		static OSSL_FUNC_encoder_import_object_fn \
223		impl##2##output##_import_object; \
224		static OSSL_FUNC_encoder_free_object_fn impl##2##output##_free_object; \
225		static OSSL_FUNC_encoder_encode_fn impl##2##output##_encode; \
226		\
227		static void * \
228		impl##2##output##_import_object(void *ctx, int selection, \
229		const OSSL_PARAM params[]) \
230	0	{ \
231	0	return ossl_prov_import_key(ossl_##impl##_keymgmt_functions, \
232	0	ctx, selection, params); \
233	0	} \ Unexecuted instantiation: encode_key2ms.c:dsa2pvk_import_object Unexecuted instantiation: encode_key2ms.c:dsa2msblob_import_object Unexecuted instantiation: encode_key2ms.c:rsa2pvk_import_object Unexecuted instantiation: encode_key2ms.c:rsa2msblob_import_object
234		static void impl##2##output##_free_object(void *key) \
235	0	{ \
236	0	ossl_prov_free_key(ossl_##impl##_keymgmt_functions, key); \
237	0	} \ Unexecuted instantiation: encode_key2ms.c:dsa2pvk_free_object Unexecuted instantiation: encode_key2ms.c:dsa2msblob_free_object Unexecuted instantiation: encode_key2ms.c:rsa2pvk_free_object Unexecuted instantiation: encode_key2ms.c:rsa2msblob_free_object
238		static int impl##2##output##_encode(void vctx, OSSL_CORE_BIO cout, \
239		const void *key, \
240		const OSSL_PARAM key_abstract[], \
241		int selection, \
242		OSSL_PASSPHRASE_CALLBACK *cb, \
243		void *cbarg) \
244	0	{ \
245	0	/* We don't deal with abstract objects */ \
246	0	if (key_abstract != NULL) { \
247	0	ERR_raise(ERR_LIB_PROV, ERR_R_PASSED_INVALID_ARGUMENT); \
248	0	return 0; \
249	0	} \
250	0	return key2##output##_encode(vctx, key, selection, cout, type##_set1, \
251	0	cb, cbarg); \
252	0	} \
253		const OSSL_DISPATCH ossl_##impl##_to_##output##_encoder_functions[] = { \
254		{ OSSL_FUNC_ENCODER_NEWCTX, \
255		(void (*)(void))key2ms_newctx }, \
256		{ OSSL_FUNC_ENCODER_FREECTX, \
257		(void (*)(void))key2ms_freectx }, \
258		output##_set_params { OSSL_FUNC_ENCODER_DOES_SELECTION, \
259		(void (*)(void))key2ms_does_selection }, \
260		{ OSSL_FUNC_ENCODER_IMPORT_OBJECT, \
261		(void (*)(void))impl##2##output##_import_object }, \
262		{ OSSL_FUNC_ENCODER_FREE_OBJECT, \
263		(void (*)(void))impl##2##output##_free_object }, \
264		{ OSSL_FUNC_ENCODER_ENCODE, \
265		(void (*)(void))impl##2##output##_encode }, \
266		OSSL_DISPATCH_END \
267		}
268
269		#ifndef OPENSSL_NO_DSA
270	0	MAKE_MS_ENCODER(dsa, pvk, dsa);
271	0	MAKE_MS_ENCODER(dsa, msblob, dsa);
272		#endif
273
274	0	MAKE_MS_ENCODER(rsa, pvk, rsa);
275		MAKE_MS_ENCODER(rsa, msblob, rsa);