|
 |
889aab1 |
From 0a2df89ba517bfbeaeadb81e42fe7bc3288b1985 Mon Sep 17 00:00:00 2001
|
|
|
889aab1 |
From: =?UTF-8?q?Micha=C5=82=20Trojnara?= <Michal.Trojnara@stunnel.org>
|
|
|
889aab1 |
Date: Thu, 23 Aug 2018 22:35:53 +0200
|
|
|
889aab1 |
Subject: [PATCH 05/23] Initial EVP_PKEY_EC framework
|
|
|
889aab1 |
|
|
|
889aab1 |
Fixes #243
|
|
|
889aab1 |
---
|
|
|
889aab1 |
src/p11_pkey.c | 94 +++++++++++++++++++++++++++++++++++++++++---------
|
|
|
889aab1 |
1 file changed, 78 insertions(+), 16 deletions(-)
|
|
|
889aab1 |
|
|
|
889aab1 |
diff --git a/src/p11_pkey.c b/src/p11_pkey.c
|
|
|
889aab1 |
index 45d5ad3..0efcaa4 100644
|
|
|
889aab1 |
--- a/src/p11_pkey.c
|
|
|
889aab1 |
+++ b/src/p11_pkey.c
|
|
|
889aab1 |
@@ -29,6 +29,13 @@ static int (*orig_pkey_rsa_decrypt) (EVP_PKEY_CTX *ctx,
|
|
|
889aab1 |
unsigned char *out, size_t *outlen,
|
|
|
889aab1 |
const unsigned char *in, size_t inlen);
|
|
|
889aab1 |
|
|
|
889aab1 |
+#ifndef OPENSSL_NO_EC
|
|
|
889aab1 |
+static int (*orig_pkey_ec_sign_init) (EVP_PKEY_CTX *ctx);
|
|
|
889aab1 |
+static int (*orig_pkey_ec_sign) (EVP_PKEY_CTX *ctx,
|
|
|
889aab1 |
+ unsigned char *sig, size_t *siglen,
|
|
|
889aab1 |
+ const unsigned char *tbs, size_t tbslen);
|
|
|
889aab1 |
+#endif /* OPENSSL_NO_EC */
|
|
|
889aab1 |
+
|
|
|
889aab1 |
#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
|
|
|
889aab1 |
struct evp_pkey_method_st {
|
|
|
889aab1 |
int pkey_id;
|
|
|
889aab1 |
@@ -490,54 +497,109 @@ static int pkcs11_pkey_rsa_decrypt(EVP_PKEY_CTX *evp_pkey_ctx,
|
|
|
889aab1 |
|
|
|
889aab1 |
static EVP_PKEY_METHOD *pkcs11_pkey_method_rsa()
|
|
|
889aab1 |
{
|
|
|
889aab1 |
- EVP_PKEY_METHOD *orig_evp_pkey_meth_rsa, *new_evp_pkey_meth_rsa;
|
|
|
889aab1 |
+ EVP_PKEY_METHOD *orig_meth, *new_meth;
|
|
|
889aab1 |
|
|
|
889aab1 |
- orig_evp_pkey_meth_rsa = (EVP_PKEY_METHOD *)EVP_PKEY_meth_find(EVP_PKEY_RSA);
|
|
|
889aab1 |
- EVP_PKEY_meth_get_sign(orig_evp_pkey_meth_rsa,
|
|
|
889aab1 |
+ orig_meth = (EVP_PKEY_METHOD *)EVP_PKEY_meth_find(EVP_PKEY_RSA);
|
|
|
889aab1 |
+ EVP_PKEY_meth_get_sign(orig_meth,
|
|
|
889aab1 |
&orig_pkey_rsa_sign_init, &orig_pkey_rsa_sign);
|
|
|
889aab1 |
- EVP_PKEY_meth_get_decrypt(orig_evp_pkey_meth_rsa,
|
|
|
889aab1 |
+ EVP_PKEY_meth_get_decrypt(orig_meth,
|
|
|
889aab1 |
&orig_pkey_rsa_decrypt_init,
|
|
|
889aab1 |
&orig_pkey_rsa_decrypt);
|
|
|
889aab1 |
|
|
|
889aab1 |
- new_evp_pkey_meth_rsa = EVP_PKEY_meth_new(EVP_PKEY_RSA,
|
|
|
889aab1 |
+ new_meth = EVP_PKEY_meth_new(EVP_PKEY_RSA,
|
|
|
889aab1 |
EVP_PKEY_FLAG_AUTOARGLEN);
|
|
|
889aab1 |
|
|
|
889aab1 |
- EVP_PKEY_meth_copy(new_evp_pkey_meth_rsa, orig_evp_pkey_meth_rsa);
|
|
|
889aab1 |
+ EVP_PKEY_meth_copy(new_meth, orig_meth);
|
|
|
889aab1 |
|
|
|
889aab1 |
- EVP_PKEY_meth_set_sign(new_evp_pkey_meth_rsa,
|
|
|
889aab1 |
+ EVP_PKEY_meth_set_sign(new_meth,
|
|
|
889aab1 |
orig_pkey_rsa_sign_init, pkcs11_pkey_rsa_sign);
|
|
|
889aab1 |
- EVP_PKEY_meth_set_decrypt(new_evp_pkey_meth_rsa,
|
|
|
889aab1 |
+ EVP_PKEY_meth_set_decrypt(new_meth,
|
|
|
889aab1 |
orig_pkey_rsa_decrypt_init, pkcs11_pkey_rsa_decrypt);
|
|
|
889aab1 |
|
|
|
889aab1 |
- return new_evp_pkey_meth_rsa;
|
|
|
889aab1 |
+ return new_meth;
|
|
|
889aab1 |
+}
|
|
|
889aab1 |
+
|
|
|
889aab1 |
+#ifndef OPENSSL_NO_EC
|
|
|
889aab1 |
+
|
|
|
889aab1 |
+static int pkcs11_try_pkey_ec_sign(EVP_PKEY_CTX *evp_pkey_ctx,
|
|
|
889aab1 |
+ unsigned char *sig, size_t *siglen,
|
|
|
889aab1 |
+ const unsigned char *tbs, size_t tbslen)
|
|
|
889aab1 |
+{
|
|
|
889aab1 |
+ fprintf(stderr, "%s:%d pkcs11_try_pkey_ec_sign() not implemented\n",
|
|
|
889aab1 |
+ __FILE__, __LINE__);
|
|
|
889aab1 |
+ return -1;
|
|
|
889aab1 |
}
|
|
|
889aab1 |
|
|
|
889aab1 |
+static int pkcs11_pkey_ec_sign(EVP_PKEY_CTX *evp_pkey_ctx,
|
|
|
889aab1 |
+ unsigned char *sig, size_t *siglen,
|
|
|
889aab1 |
+ const unsigned char *tbs, size_t tbslen)
|
|
|
889aab1 |
+{
|
|
|
889aab1 |
+ int ret;
|
|
|
889aab1 |
+
|
|
|
889aab1 |
+ ret = pkcs11_try_pkey_ec_sign(evp_pkey_ctx, sig, siglen, tbs, tbslen);
|
|
|
889aab1 |
+ if (ret < 0)
|
|
|
889aab1 |
+ ret = (*orig_pkey_ec_sign)(evp_pkey_ctx, sig, siglen, tbs, tbslen);
|
|
|
889aab1 |
+ return ret;
|
|
|
889aab1 |
+}
|
|
|
889aab1 |
+
|
|
|
889aab1 |
+static EVP_PKEY_METHOD *pkcs11_pkey_method_ec()
|
|
|
889aab1 |
+{
|
|
|
889aab1 |
+ EVP_PKEY_METHOD *orig_meth, *new_meth;
|
|
|
889aab1 |
+
|
|
|
889aab1 |
+ orig_meth = (EVP_PKEY_METHOD *)EVP_PKEY_meth_find(EVP_PKEY_EC);
|
|
|
889aab1 |
+ EVP_PKEY_meth_get_sign(orig_meth,
|
|
|
889aab1 |
+ &orig_pkey_ec_sign_init, &orig_pkey_ec_sign);
|
|
|
889aab1 |
+
|
|
|
889aab1 |
+ new_meth = EVP_PKEY_meth_new(EVP_PKEY_EC,
|
|
|
889aab1 |
+ EVP_PKEY_FLAG_AUTOARGLEN);
|
|
|
889aab1 |
+
|
|
|
889aab1 |
+ EVP_PKEY_meth_copy(new_meth, orig_meth);
|
|
|
889aab1 |
+
|
|
|
889aab1 |
+ EVP_PKEY_meth_set_sign(new_meth,
|
|
|
889aab1 |
+ orig_pkey_ec_sign_init, pkcs11_pkey_ec_sign);
|
|
|
889aab1 |
+
|
|
|
889aab1 |
+ return new_meth;
|
|
|
889aab1 |
+}
|
|
|
889aab1 |
+
|
|
|
889aab1 |
+#endif /* OPENSSL_NO_EC */
|
|
|
889aab1 |
+
|
|
|
889aab1 |
int PKCS11_pkey_meths(ENGINE *e, EVP_PKEY_METHOD **pmeth,
|
|
|
889aab1 |
const int **nids, int nid)
|
|
|
889aab1 |
{
|
|
|
889aab1 |
static int pkey_nids[] = {
|
|
|
889aab1 |
EVP_PKEY_RSA,
|
|
|
889aab1 |
+ EVP_PKEY_EC,
|
|
|
889aab1 |
0
|
|
|
889aab1 |
};
|
|
|
889aab1 |
static EVP_PKEY_METHOD *pkey_method_rsa = NULL;
|
|
|
889aab1 |
+ static EVP_PKEY_METHOD *pkey_method_ec = NULL;
|
|
|
889aab1 |
|
|
|
889aab1 |
(void)e; /* squash the unused parameter warning */
|
|
|
889aab1 |
/* all PKCS#11 engines currently share the same pkey_meths */
|
|
|
889aab1 |
|
|
|
889aab1 |
- if (pkey_method_rsa == NULL)
|
|
|
889aab1 |
- pkey_method_rsa = pkcs11_pkey_method_rsa();
|
|
|
889aab1 |
- if (pkey_method_rsa == NULL)
|
|
|
889aab1 |
- return 0;
|
|
|
889aab1 |
-
|
|
|
889aab1 |
if (!pmeth) { /* get the list of supported nids */
|
|
|
889aab1 |
*nids = pkey_nids;
|
|
|
889aab1 |
- return 1; /* the number of returned nids */
|
|
|
889aab1 |
+ return sizeof(pkey_nids) / sizeof(int) - 1;
|
|
|
889aab1 |
}
|
|
|
889aab1 |
|
|
|
889aab1 |
/* get the EVP_PKEY_METHOD */
|
|
|
889aab1 |
- if (nid == EVP_PKEY_RSA) {
|
|
|
889aab1 |
+ switch (nid) {
|
|
|
889aab1 |
+ case EVP_PKEY_RSA:
|
|
|
889aab1 |
+ if (pkey_method_rsa == NULL)
|
|
|
889aab1 |
+ pkey_method_rsa = pkcs11_pkey_method_rsa();
|
|
|
889aab1 |
+ if (pkey_method_rsa == NULL)
|
|
|
889aab1 |
+ return 0;
|
|
|
889aab1 |
*pmeth = pkey_method_rsa;
|
|
|
889aab1 |
return 1; /* success */
|
|
|
889aab1 |
+#ifndef OPENSSL_NO_EC
|
|
|
889aab1 |
+ case EVP_PKEY_EC:
|
|
|
889aab1 |
+ if (pkey_method_ec == NULL)
|
|
|
889aab1 |
+ pkey_method_ec = pkcs11_pkey_method_ec();
|
|
|
889aab1 |
+ if (pkey_method_ec == NULL)
|
|
|
889aab1 |
+ return 0;
|
|
|
889aab1 |
+ *pmeth = pkey_method_ec;
|
|
|
889aab1 |
+ return 1; /* success */
|
|
|
889aab1 |
+#endif /* OPENSSL_NO_EC */
|
|
|
889aab1 |
}
|
|
|
889aab1 |
*pmeth = NULL;
|
|
|
889aab1 |
return 0;
|
|
|
889aab1 |
--
|
|
|
889aab1 |
2.17.1
|
|
|
889aab1 |
|