1/*
2 * Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License").  You may not use
5 * this file except in compliance with the License.  You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10#include <stdio.h>
11#include <stdlib.h>
12#include "internal/cryptlib.h"
13#include <openssl/objects.h>
14#include <openssl/evp.h>
15#include "crypto/bn.h"
16#ifndef FIPS_MODULE
17# include "crypto/asn1.h"
18#endif
19#include "crypto/evp.h"
20#include "evp_local.h"
21
22/*
23 * Returns:
24 *  1   True
25 *  0   False
26 * -1   Unsupported (use legacy path)
27 */
28static int try_provided_check(EVP_PKEY_CTX *ctx, int selection, int checktype)
29{
30    EVP_KEYMGMT *keymgmt;
31    void *keydata;
32
33    if (evp_pkey_ctx_is_legacy(ctx))
34        return -1;
35
36    keymgmt = ctx->keymgmt;
37    keydata = evp_pkey_export_to_provider(ctx->pkey, ctx->libctx,
38                                          &keymgmt, ctx->propquery);
39    if (keydata == NULL) {
40        ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
41        return 0;
42    }
43
44    return evp_keymgmt_validate(keymgmt, keydata, selection, checktype);
45}
46
47static int evp_pkey_public_check_combined(EVP_PKEY_CTX *ctx, int checktype)
48{
49    EVP_PKEY *pkey = ctx->pkey;
50    int ok;
51
52    if (pkey == NULL) {
53        ERR_raise(ERR_LIB_EVP, EVP_R_NO_KEY_SET);
54        return 0;
55    }
56
57    if ((ok = try_provided_check(ctx, OSSL_KEYMGMT_SELECT_PUBLIC_KEY,
58                                 checktype)) != -1)
59        return ok;
60
61    if (pkey->type == EVP_PKEY_NONE)
62        goto not_supported;
63
64#ifndef FIPS_MODULE
65    /* legacy */
66    /* call customized public key check function first */
67    if (ctx->pmeth->public_check != NULL)
68        return ctx->pmeth->public_check(pkey);
69
70    /* use default public key check function in ameth */
71    if (pkey->ameth == NULL || pkey->ameth->pkey_public_check == NULL)
72        goto not_supported;
73
74    return pkey->ameth->pkey_public_check(pkey);
75#endif
76 not_supported:
77    ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
78    return -2;
79}
80
81int EVP_PKEY_public_check(EVP_PKEY_CTX *ctx)
82{
83    return evp_pkey_public_check_combined(ctx, OSSL_KEYMGMT_VALIDATE_FULL_CHECK);
84}
85
86int EVP_PKEY_public_check_quick(EVP_PKEY_CTX *ctx)
87{
88    return evp_pkey_public_check_combined(ctx, OSSL_KEYMGMT_VALIDATE_QUICK_CHECK);
89}
90
91static int evp_pkey_param_check_combined(EVP_PKEY_CTX *ctx, int checktype)
92{
93    EVP_PKEY *pkey = ctx->pkey;
94    int ok;
95
96    if (pkey == NULL) {
97        ERR_raise(ERR_LIB_EVP, EVP_R_NO_KEY_SET);
98        return 0;
99    }
100
101    if ((ok = try_provided_check(ctx,
102                                 OSSL_KEYMGMT_SELECT_ALL_PARAMETERS,
103                                 checktype)) != -1)
104        return ok;
105
106    if (pkey->type == EVP_PKEY_NONE)
107        goto not_supported;
108
109#ifndef FIPS_MODULE
110    /* legacy */
111    /* call customized param check function first */
112    if (ctx->pmeth->param_check != NULL)
113        return ctx->pmeth->param_check(pkey);
114
115    /* use default param check function in ameth */
116    if (pkey->ameth == NULL || pkey->ameth->pkey_param_check == NULL)
117        goto not_supported;
118
119    return pkey->ameth->pkey_param_check(pkey);
120#endif
121 not_supported:
122    ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
123    return -2;
124}
125
126int EVP_PKEY_param_check(EVP_PKEY_CTX *ctx)
127{
128    return evp_pkey_param_check_combined(ctx, OSSL_KEYMGMT_VALIDATE_FULL_CHECK);
129}
130
131int EVP_PKEY_param_check_quick(EVP_PKEY_CTX *ctx)
132{
133    return evp_pkey_param_check_combined(ctx, OSSL_KEYMGMT_VALIDATE_QUICK_CHECK);
134}
135
136int EVP_PKEY_private_check(EVP_PKEY_CTX *ctx)
137{
138    EVP_PKEY *pkey = ctx->pkey;
139    int ok;
140
141    if (pkey == NULL) {
142        ERR_raise(ERR_LIB_EVP, EVP_R_NO_KEY_SET);
143        return 0;
144    }
145
146    if ((ok = try_provided_check(ctx, OSSL_KEYMGMT_SELECT_PRIVATE_KEY,
147                                 OSSL_KEYMGMT_VALIDATE_FULL_CHECK)) != -1)
148        return ok;
149
150    /* not supported for legacy keys */
151    ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
152    return -2;
153}
154
155int EVP_PKEY_check(EVP_PKEY_CTX *ctx)
156{
157    return EVP_PKEY_pairwise_check(ctx);
158}
159
160int EVP_PKEY_pairwise_check(EVP_PKEY_CTX *ctx)
161{
162    EVP_PKEY *pkey = ctx->pkey;
163    int ok;
164
165    if (pkey == NULL) {
166        ERR_raise(ERR_LIB_EVP, EVP_R_NO_KEY_SET);
167        return 0;
168    }
169
170    if ((ok = try_provided_check(ctx, OSSL_KEYMGMT_SELECT_KEYPAIR,
171                                 OSSL_KEYMGMT_VALIDATE_FULL_CHECK)) != -1)
172        return ok;
173
174    if (pkey->type == EVP_PKEY_NONE)
175        goto not_supported;
176
177#ifndef FIPS_MODULE
178    /* legacy */
179    /* call customized check function first */
180    if (ctx->pmeth->check != NULL)
181        return ctx->pmeth->check(pkey);
182
183    /* use default check function in ameth */
184    if (pkey->ameth == NULL || pkey->ameth->pkey_check == NULL)
185        goto not_supported;
186
187    return pkey->ameth->pkey_check(pkey);
188#endif
189 not_supported:
190    ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
191    return -2;
192}
193
194