1 | /* |
2 | * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved. |
3 | * |
4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at |
7 | * https://www.openssl.org/source/license.html |
8 | */ |
9 | |
10 | #include <stdio.h> |
11 | #include <assert.h> |
12 | #include "internal/cryptlib.h" |
13 | #include <openssl/evp.h> |
14 | #include <openssl/err.h> |
15 | #include <openssl/rand.h> |
16 | #include <openssl/rand_drbg.h> |
17 | #include <openssl/engine.h> |
18 | #include <openssl/params.h> |
19 | #include <openssl/core_names.h> |
20 | #include "crypto/evp.h" |
21 | #include "internal/provider.h" |
22 | #include "evp_local.h" |
23 | |
24 | int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *ctx) |
25 | { |
26 | if (ctx == NULL) |
27 | return 1; |
28 | |
29 | if (ctx->cipher == NULL || ctx->cipher->prov == NULL) |
30 | goto legacy; |
31 | |
32 | if (ctx->provctx != NULL) { |
33 | if (ctx->cipher->freectx != NULL) |
34 | ctx->cipher->freectx(ctx->provctx); |
35 | ctx->provctx = NULL; |
36 | } |
37 | if (ctx->fetched_cipher != NULL) |
38 | EVP_CIPHER_free(ctx->fetched_cipher); |
39 | memset(ctx, 0, sizeof(*ctx)); |
40 | |
41 | return 1; |
42 | |
43 | /* TODO(3.0): Remove legacy code below */ |
44 | legacy: |
45 | |
46 | if (ctx->cipher != NULL) { |
47 | if (ctx->cipher->cleanup && !ctx->cipher->cleanup(ctx)) |
48 | return 0; |
49 | /* Cleanse cipher context data */ |
50 | if (ctx->cipher_data && ctx->cipher->ctx_size) |
51 | OPENSSL_cleanse(ctx->cipher_data, ctx->cipher->ctx_size); |
52 | } |
53 | OPENSSL_free(ctx->cipher_data); |
54 | #if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE) |
55 | ENGINE_finish(ctx->engine); |
56 | #endif |
57 | memset(ctx, 0, sizeof(*ctx)); |
58 | return 1; |
59 | } |
60 | |
61 | EVP_CIPHER_CTX *EVP_CIPHER_CTX_new(void) |
62 | { |
63 | return OPENSSL_zalloc(sizeof(EVP_CIPHER_CTX)); |
64 | } |
65 | |
66 | void EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *ctx) |
67 | { |
68 | EVP_CIPHER_CTX_reset(ctx); |
69 | OPENSSL_free(ctx); |
70 | } |
71 | |
72 | int EVP_CipherInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, |
73 | const unsigned char *key, const unsigned char *iv, int enc) |
74 | { |
75 | if (cipher != NULL) |
76 | EVP_CIPHER_CTX_reset(ctx); |
77 | return EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, enc); |
78 | } |
79 | |
80 | int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, |
81 | ENGINE *impl, const unsigned char *key, |
82 | const unsigned char *iv, int enc) |
83 | { |
84 | #if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE) |
85 | ENGINE *tmpimpl = NULL; |
86 | #endif |
87 | const EVP_CIPHER *tmpcipher; |
88 | |
89 | /* |
90 | * enc == 1 means we are encrypting. |
91 | * enc == 0 means we are decrypting. |
92 | * enc == -1 means, use the previously initialised value for encrypt/decrypt |
93 | */ |
94 | if (enc == -1) { |
95 | enc = ctx->encrypt; |
96 | } else { |
97 | if (enc) |
98 | enc = 1; |
99 | ctx->encrypt = enc; |
100 | } |
101 | |
102 | if (cipher == NULL && ctx->cipher == NULL) { |
103 | EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_NO_CIPHER_SET); |
104 | return 0; |
105 | } |
106 | |
107 | /* TODO(3.0): Legacy work around code below. Remove this */ |
108 | |
109 | #if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE) |
110 | /* |
111 | * Whether it's nice or not, "Inits" can be used on "Final"'d contexts so |
112 | * this context may already have an ENGINE! Try to avoid releasing the |
113 | * previous handle, re-querying for an ENGINE, and having a |
114 | * reinitialisation, when it may all be unnecessary. |
115 | */ |
116 | if (ctx->engine && ctx->cipher |
117 | && (cipher == NULL || cipher->nid == ctx->cipher->nid)) |
118 | goto skip_to_init; |
119 | |
120 | if (cipher != NULL && impl == NULL) { |
121 | /* Ask if an ENGINE is reserved for this job */ |
122 | tmpimpl = ENGINE_get_cipher_engine(cipher->nid); |
123 | } |
124 | #endif |
125 | |
126 | /* |
127 | * If there are engines involved then we should use legacy handling for now. |
128 | */ |
129 | if (ctx->engine != NULL |
130 | #if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE) |
131 | || tmpimpl != NULL |
132 | #endif |
133 | || impl != NULL) { |
134 | if (ctx->cipher == ctx->fetched_cipher) |
135 | ctx->cipher = NULL; |
136 | EVP_CIPHER_free(ctx->fetched_cipher); |
137 | ctx->fetched_cipher = NULL; |
138 | goto legacy; |
139 | } |
140 | |
141 | tmpcipher = (cipher == NULL) ? ctx->cipher : cipher; |
142 | |
143 | if (tmpcipher->prov == NULL) { |
144 | switch(tmpcipher->nid) { |
145 | case NID_aes_256_ecb: |
146 | case NID_aes_192_ecb: |
147 | case NID_aes_128_ecb: |
148 | case NID_aes_256_cbc: |
149 | case NID_aes_192_cbc: |
150 | case NID_aes_128_cbc: |
151 | case NID_aes_256_ofb128: |
152 | case NID_aes_192_ofb128: |
153 | case NID_aes_128_ofb128: |
154 | case NID_aes_256_cfb128: |
155 | case NID_aes_192_cfb128: |
156 | case NID_aes_128_cfb128: |
157 | case NID_aes_256_cfb1: |
158 | case NID_aes_192_cfb1: |
159 | case NID_aes_128_cfb1: |
160 | case NID_aes_256_cfb8: |
161 | case NID_aes_192_cfb8: |
162 | case NID_aes_128_cfb8: |
163 | case NID_aes_256_ctr: |
164 | case NID_aes_192_ctr: |
165 | case NID_aes_128_ctr: |
166 | case NID_aes_128_xts: |
167 | case NID_aes_256_xts: |
168 | case NID_aes_256_ocb: |
169 | case NID_aes_192_ocb: |
170 | case NID_aes_128_ocb: |
171 | case NID_aes_256_gcm: |
172 | case NID_aes_192_gcm: |
173 | case NID_aes_128_gcm: |
174 | case NID_aes_256_siv: |
175 | case NID_aes_192_siv: |
176 | case NID_aes_128_siv: |
177 | case NID_id_aes256_wrap: |
178 | case NID_id_aes256_wrap_pad: |
179 | case NID_id_aes192_wrap: |
180 | case NID_id_aes192_wrap_pad: |
181 | case NID_id_aes128_wrap: |
182 | case NID_id_aes128_wrap_pad: |
183 | case NID_aria_256_gcm: |
184 | case NID_aria_192_gcm: |
185 | case NID_aria_128_gcm: |
186 | case NID_aes_256_ccm: |
187 | case NID_aes_192_ccm: |
188 | case NID_aes_128_ccm: |
189 | case NID_aria_256_ccm: |
190 | case NID_aria_192_ccm: |
191 | case NID_aria_128_ccm: |
192 | case NID_aria_256_ecb: |
193 | case NID_aria_192_ecb: |
194 | case NID_aria_128_ecb: |
195 | case NID_aria_256_cbc: |
196 | case NID_aria_192_cbc: |
197 | case NID_aria_128_cbc: |
198 | case NID_aria_256_ofb128: |
199 | case NID_aria_192_ofb128: |
200 | case NID_aria_128_ofb128: |
201 | case NID_aria_256_cfb128: |
202 | case NID_aria_192_cfb128: |
203 | case NID_aria_128_cfb128: |
204 | case NID_aria_256_cfb1: |
205 | case NID_aria_192_cfb1: |
206 | case NID_aria_128_cfb1: |
207 | case NID_aria_256_cfb8: |
208 | case NID_aria_192_cfb8: |
209 | case NID_aria_128_cfb8: |
210 | case NID_aria_256_ctr: |
211 | case NID_aria_192_ctr: |
212 | case NID_aria_128_ctr: |
213 | case NID_camellia_256_ecb: |
214 | case NID_camellia_192_ecb: |
215 | case NID_camellia_128_ecb: |
216 | case NID_camellia_256_cbc: |
217 | case NID_camellia_192_cbc: |
218 | case NID_camellia_128_cbc: |
219 | case NID_camellia_256_ofb128: |
220 | case NID_camellia_192_ofb128: |
221 | case NID_camellia_128_ofb128: |
222 | case NID_camellia_256_cfb128: |
223 | case NID_camellia_192_cfb128: |
224 | case NID_camellia_128_cfb128: |
225 | case NID_camellia_256_cfb1: |
226 | case NID_camellia_192_cfb1: |
227 | case NID_camellia_128_cfb1: |
228 | case NID_camellia_256_cfb8: |
229 | case NID_camellia_192_cfb8: |
230 | case NID_camellia_128_cfb8: |
231 | case NID_camellia_256_ctr: |
232 | case NID_camellia_192_ctr: |
233 | case NID_camellia_128_ctr: |
234 | case NID_des_ede3_cbc: |
235 | case NID_des_ede3_ecb: |
236 | case NID_des_ede3_ofb64: |
237 | case NID_des_ede3_cfb64: |
238 | case NID_des_ede3_cfb8: |
239 | case NID_des_ede3_cfb1: |
240 | case NID_des_ede_cbc: |
241 | case NID_des_ede_ecb: |
242 | case NID_des_ede_ofb64: |
243 | case NID_des_ede_cfb64: |
244 | case NID_desx_cbc: |
245 | case NID_des_cbc: |
246 | case NID_des_ecb: |
247 | case NID_des_cfb1: |
248 | case NID_des_cfb8: |
249 | case NID_des_cfb64: |
250 | case NID_des_ofb64: |
251 | case NID_id_smime_alg_CMS3DESwrap: |
252 | case NID_bf_cbc: |
253 | case NID_bf_ecb: |
254 | case NID_bf_cfb64: |
255 | case NID_bf_ofb64: |
256 | case NID_idea_cbc: |
257 | case NID_idea_ecb: |
258 | case NID_idea_cfb64: |
259 | case NID_idea_ofb64: |
260 | case NID_cast5_cbc: |
261 | case NID_cast5_ecb: |
262 | case NID_cast5_cfb64: |
263 | case NID_cast5_ofb64: |
264 | case NID_seed_cbc: |
265 | case NID_seed_ecb: |
266 | case NID_seed_cfb128: |
267 | case NID_seed_ofb128: |
268 | case NID_sm4_cbc: |
269 | case NID_sm4_ecb: |
270 | case NID_sm4_ctr: |
271 | case NID_sm4_cfb128: |
272 | case NID_sm4_ofb128: |
273 | case NID_rc4: |
274 | case NID_rc4_40: |
275 | case NID_rc5_cbc: |
276 | case NID_rc5_ecb: |
277 | case NID_rc5_cfb64: |
278 | case NID_rc5_ofb64: |
279 | case NID_rc2_cbc: |
280 | case NID_rc2_40_cbc: |
281 | case NID_rc2_64_cbc: |
282 | case NID_rc2_cfb64: |
283 | case NID_rc2_ofb64: |
284 | case NID_chacha20: |
285 | case NID_chacha20_poly1305: |
286 | case NID_rc4_hmac_md5: |
287 | break; |
288 | default: |
289 | goto legacy; |
290 | } |
291 | } |
292 | |
293 | /* |
294 | * Ensure a context left lying around from last time is cleared |
295 | * (legacy code) |
296 | */ |
297 | if (cipher != NULL && ctx->cipher != NULL) { |
298 | OPENSSL_clear_free(ctx->cipher_data, ctx->cipher->ctx_size); |
299 | ctx->cipher_data = NULL; |
300 | } |
301 | |
302 | |
303 | /* TODO(3.0): Start of non-legacy code below */ |
304 | |
305 | /* Ensure a context left lying around from last time is cleared */ |
306 | if (cipher != NULL && ctx->cipher != NULL) { |
307 | unsigned long flags = ctx->flags; |
308 | |
309 | EVP_CIPHER_CTX_reset(ctx); |
310 | /* Restore encrypt and flags */ |
311 | ctx->encrypt = enc; |
312 | ctx->flags = flags; |
313 | } |
314 | |
315 | if (cipher == NULL) |
316 | cipher = ctx->cipher; |
317 | |
318 | if (cipher->prov == NULL) { |
319 | #ifdef FIPS_MODE |
320 | /* We only do explicit fetches inside the FIPS module */ |
321 | EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_INITIALIZATION_ERROR); |
322 | return 0; |
323 | #else |
324 | EVP_CIPHER *provciph = |
325 | EVP_CIPHER_fetch(NULL, OBJ_nid2sn(cipher->nid), "" ); |
326 | |
327 | if (provciph == NULL) { |
328 | EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_INITIALIZATION_ERROR); |
329 | return 0; |
330 | } |
331 | cipher = provciph; |
332 | EVP_CIPHER_free(ctx->fetched_cipher); |
333 | ctx->fetched_cipher = provciph; |
334 | #endif |
335 | } |
336 | |
337 | ctx->cipher = cipher; |
338 | if (ctx->provctx == NULL) { |
339 | ctx->provctx = ctx->cipher->newctx(ossl_provider_ctx(cipher->prov)); |
340 | if (ctx->provctx == NULL) { |
341 | EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_INITIALIZATION_ERROR); |
342 | return 0; |
343 | } |
344 | } |
345 | |
346 | if ((ctx->flags & EVP_CIPH_NO_PADDING) != 0) { |
347 | /* |
348 | * If this ctx was already set up for no padding then we need to tell |
349 | * the new cipher about it. |
350 | */ |
351 | if (!EVP_CIPHER_CTX_set_padding(ctx, 0)) |
352 | return 0; |
353 | } |
354 | |
355 | if (enc) { |
356 | if (ctx->cipher->einit == NULL) { |
357 | EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_INITIALIZATION_ERROR); |
358 | return 0; |
359 | } |
360 | |
361 | return ctx->cipher->einit(ctx->provctx, |
362 | key, |
363 | key == NULL ? 0 |
364 | : EVP_CIPHER_CTX_key_length(ctx), |
365 | iv, |
366 | iv == NULL ? 0 |
367 | : EVP_CIPHER_CTX_iv_length(ctx)); |
368 | } |
369 | |
370 | if (ctx->cipher->dinit == NULL) { |
371 | EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_INITIALIZATION_ERROR); |
372 | return 0; |
373 | } |
374 | |
375 | return ctx->cipher->dinit(ctx->provctx, |
376 | key, |
377 | key == NULL ? 0 |
378 | : EVP_CIPHER_CTX_key_length(ctx), |
379 | iv, |
380 | iv == NULL ? 0 |
381 | : EVP_CIPHER_CTX_iv_length(ctx)); |
382 | |
383 | /* TODO(3.0): Remove legacy code below */ |
384 | legacy: |
385 | |
386 | if (cipher != NULL) { |
387 | /* |
388 | * Ensure a context left lying around from last time is cleared (we |
389 | * previously attempted to avoid this if the same ENGINE and |
390 | * EVP_CIPHER could be used). |
391 | */ |
392 | if (ctx->cipher) { |
393 | unsigned long flags = ctx->flags; |
394 | EVP_CIPHER_CTX_reset(ctx); |
395 | /* Restore encrypt and flags */ |
396 | ctx->encrypt = enc; |
397 | ctx->flags = flags; |
398 | } |
399 | #if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE) |
400 | if (impl != NULL) { |
401 | if (!ENGINE_init(impl)) { |
402 | EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_INITIALIZATION_ERROR); |
403 | return 0; |
404 | } |
405 | } else { |
406 | impl = tmpimpl; |
407 | } |
408 | if (impl != NULL) { |
409 | /* There's an ENGINE for this job ... (apparently) */ |
410 | const EVP_CIPHER *c = ENGINE_get_cipher(impl, cipher->nid); |
411 | |
412 | if (c == NULL) { |
413 | /* |
414 | * One positive side-effect of US's export control history, |
415 | * is that we should at least be able to avoid using US |
416 | * misspellings of "initialisation"? |
417 | */ |
418 | EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_INITIALIZATION_ERROR); |
419 | return 0; |
420 | } |
421 | /* We'll use the ENGINE's private cipher definition */ |
422 | cipher = c; |
423 | /* |
424 | * Store the ENGINE functional reference so we know 'cipher' came |
425 | * from an ENGINE and we need to release it when done. |
426 | */ |
427 | ctx->engine = impl; |
428 | } else { |
429 | ctx->engine = NULL; |
430 | } |
431 | #endif |
432 | |
433 | ctx->cipher = cipher; |
434 | if (ctx->cipher->ctx_size) { |
435 | ctx->cipher_data = OPENSSL_zalloc(ctx->cipher->ctx_size); |
436 | if (ctx->cipher_data == NULL) { |
437 | ctx->cipher = NULL; |
438 | EVPerr(EVP_F_EVP_CIPHERINIT_EX, ERR_R_MALLOC_FAILURE); |
439 | return 0; |
440 | } |
441 | } else { |
442 | ctx->cipher_data = NULL; |
443 | } |
444 | ctx->key_len = cipher->key_len; |
445 | /* Preserve wrap enable flag, zero everything else */ |
446 | ctx->flags &= EVP_CIPHER_CTX_FLAG_WRAP_ALLOW; |
447 | if (ctx->cipher->flags & EVP_CIPH_CTRL_INIT) { |
448 | if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_INIT, 0, NULL)) { |
449 | ctx->cipher = NULL; |
450 | EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_INITIALIZATION_ERROR); |
451 | return 0; |
452 | } |
453 | } |
454 | } |
455 | #if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE) |
456 | skip_to_init: |
457 | #endif |
458 | if (ctx->cipher == NULL) |
459 | return 0; |
460 | |
461 | /* we assume block size is a power of 2 in *cryptUpdate */ |
462 | OPENSSL_assert(ctx->cipher->block_size == 1 |
463 | || ctx->cipher->block_size == 8 |
464 | || ctx->cipher->block_size == 16); |
465 | |
466 | if (!(ctx->flags & EVP_CIPHER_CTX_FLAG_WRAP_ALLOW) |
467 | && EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_WRAP_MODE) { |
468 | EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_WRAP_MODE_NOT_ALLOWED); |
469 | return 0; |
470 | } |
471 | |
472 | if (!(EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(ctx)) & EVP_CIPH_CUSTOM_IV)) { |
473 | switch (EVP_CIPHER_CTX_mode(ctx)) { |
474 | |
475 | case EVP_CIPH_STREAM_CIPHER: |
476 | case EVP_CIPH_ECB_MODE: |
477 | break; |
478 | |
479 | case EVP_CIPH_CFB_MODE: |
480 | case EVP_CIPH_OFB_MODE: |
481 | |
482 | ctx->num = 0; |
483 | /* fall-through */ |
484 | |
485 | case EVP_CIPH_CBC_MODE: |
486 | |
487 | OPENSSL_assert(EVP_CIPHER_CTX_iv_length(ctx) <= |
488 | (int)sizeof(ctx->iv)); |
489 | if (iv) |
490 | memcpy(ctx->oiv, iv, EVP_CIPHER_CTX_iv_length(ctx)); |
491 | memcpy(ctx->iv, ctx->oiv, EVP_CIPHER_CTX_iv_length(ctx)); |
492 | break; |
493 | |
494 | case EVP_CIPH_CTR_MODE: |
495 | ctx->num = 0; |
496 | /* Don't reuse IV for CTR mode */ |
497 | if (iv) |
498 | memcpy(ctx->iv, iv, EVP_CIPHER_CTX_iv_length(ctx)); |
499 | break; |
500 | |
501 | default: |
502 | return 0; |
503 | } |
504 | } |
505 | |
506 | if (key || (ctx->cipher->flags & EVP_CIPH_ALWAYS_CALL_INIT)) { |
507 | if (!ctx->cipher->init(ctx, key, iv, enc)) |
508 | return 0; |
509 | } |
510 | ctx->buf_len = 0; |
511 | ctx->final_used = 0; |
512 | ctx->block_mask = ctx->cipher->block_size - 1; |
513 | return 1; |
514 | } |
515 | |
516 | int EVP_CipherUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl, |
517 | const unsigned char *in, int inl) |
518 | { |
519 | if (ctx->encrypt) |
520 | return EVP_EncryptUpdate(ctx, out, outl, in, inl); |
521 | else |
522 | return EVP_DecryptUpdate(ctx, out, outl, in, inl); |
523 | } |
524 | |
525 | int EVP_CipherFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl) |
526 | { |
527 | if (ctx->encrypt) |
528 | return EVP_EncryptFinal_ex(ctx, out, outl); |
529 | else |
530 | return EVP_DecryptFinal_ex(ctx, out, outl); |
531 | } |
532 | |
533 | int EVP_CipherFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl) |
534 | { |
535 | if (ctx->encrypt) |
536 | return EVP_EncryptFinal(ctx, out, outl); |
537 | else |
538 | return EVP_DecryptFinal(ctx, out, outl); |
539 | } |
540 | |
541 | int EVP_EncryptInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, |
542 | const unsigned char *key, const unsigned char *iv) |
543 | { |
544 | return EVP_CipherInit(ctx, cipher, key, iv, 1); |
545 | } |
546 | |
547 | int EVP_EncryptInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, |
548 | ENGINE *impl, const unsigned char *key, |
549 | const unsigned char *iv) |
550 | { |
551 | return EVP_CipherInit_ex(ctx, cipher, impl, key, iv, 1); |
552 | } |
553 | |
554 | int EVP_DecryptInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, |
555 | const unsigned char *key, const unsigned char *iv) |
556 | { |
557 | return EVP_CipherInit(ctx, cipher, key, iv, 0); |
558 | } |
559 | |
560 | int EVP_DecryptInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, |
561 | ENGINE *impl, const unsigned char *key, |
562 | const unsigned char *iv) |
563 | { |
564 | return EVP_CipherInit_ex(ctx, cipher, impl, key, iv, 0); |
565 | } |
566 | |
567 | /* |
568 | * According to the letter of standard difference between pointers |
569 | * is specified to be valid only within same object. This makes |
570 | * it formally challenging to determine if input and output buffers |
571 | * are not partially overlapping with standard pointer arithmetic. |
572 | */ |
573 | #ifdef PTRDIFF_T |
574 | # undef PTRDIFF_T |
575 | #endif |
576 | #if defined(OPENSSL_SYS_VMS) && __INITIAL_POINTER_SIZE==64 |
577 | /* |
578 | * Then we have VMS that distinguishes itself by adhering to |
579 | * sizeof(size_t)==4 even in 64-bit builds, which means that |
580 | * difference between two pointers might be truncated to 32 bits. |
581 | * In the context one can even wonder how comparison for |
582 | * equality is implemented. To be on the safe side we adhere to |
583 | * PTRDIFF_T even for comparison for equality. |
584 | */ |
585 | # define PTRDIFF_T uint64_t |
586 | #else |
587 | # define PTRDIFF_T size_t |
588 | #endif |
589 | |
590 | int is_partially_overlapping(const void *ptr1, const void *ptr2, int len) |
591 | { |
592 | PTRDIFF_T diff = (PTRDIFF_T)ptr1-(PTRDIFF_T)ptr2; |
593 | /* |
594 | * Check for partially overlapping buffers. [Binary logical |
595 | * operations are used instead of boolean to minimize number |
596 | * of conditional branches.] |
597 | */ |
598 | int overlapped = (len > 0) & (diff != 0) & ((diff < (PTRDIFF_T)len) | |
599 | (diff > (0 - (PTRDIFF_T)len))); |
600 | |
601 | return overlapped; |
602 | } |
603 | |
604 | static int evp_EncryptDecryptUpdate(EVP_CIPHER_CTX *ctx, |
605 | unsigned char *out, int *outl, |
606 | const unsigned char *in, int inl) |
607 | { |
608 | int i, j, bl, cmpl = inl; |
609 | |
610 | if (EVP_CIPHER_CTX_test_flags(ctx, EVP_CIPH_FLAG_LENGTH_BITS)) |
611 | cmpl = (cmpl + 7) / 8; |
612 | |
613 | bl = ctx->cipher->block_size; |
614 | |
615 | if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) { |
616 | /* If block size > 1 then the cipher will have to do this check */ |
617 | if (bl == 1 && is_partially_overlapping(out, in, cmpl)) { |
618 | EVPerr(EVP_F_EVP_ENCRYPTDECRYPTUPDATE, EVP_R_PARTIALLY_OVERLAPPING); |
619 | return 0; |
620 | } |
621 | |
622 | i = ctx->cipher->do_cipher(ctx, out, in, inl); |
623 | if (i < 0) |
624 | return 0; |
625 | else |
626 | *outl = i; |
627 | return 1; |
628 | } |
629 | |
630 | if (inl <= 0) { |
631 | *outl = 0; |
632 | return inl == 0; |
633 | } |
634 | if (is_partially_overlapping(out + ctx->buf_len, in, cmpl)) { |
635 | EVPerr(EVP_F_EVP_ENCRYPTDECRYPTUPDATE, EVP_R_PARTIALLY_OVERLAPPING); |
636 | return 0; |
637 | } |
638 | |
639 | if (ctx->buf_len == 0 && (inl & (ctx->block_mask)) == 0) { |
640 | if (ctx->cipher->do_cipher(ctx, out, in, inl)) { |
641 | *outl = inl; |
642 | return 1; |
643 | } else { |
644 | *outl = 0; |
645 | return 0; |
646 | } |
647 | } |
648 | i = ctx->buf_len; |
649 | OPENSSL_assert(bl <= (int)sizeof(ctx->buf)); |
650 | if (i != 0) { |
651 | if (bl - i > inl) { |
652 | memcpy(&(ctx->buf[i]), in, inl); |
653 | ctx->buf_len += inl; |
654 | *outl = 0; |
655 | return 1; |
656 | } else { |
657 | j = bl - i; |
658 | memcpy(&(ctx->buf[i]), in, j); |
659 | inl -= j; |
660 | in += j; |
661 | if (!ctx->cipher->do_cipher(ctx, out, ctx->buf, bl)) |
662 | return 0; |
663 | out += bl; |
664 | *outl = bl; |
665 | } |
666 | } else |
667 | *outl = 0; |
668 | i = inl & (bl - 1); |
669 | inl -= i; |
670 | if (inl > 0) { |
671 | if (!ctx->cipher->do_cipher(ctx, out, in, inl)) |
672 | return 0; |
673 | *outl += inl; |
674 | } |
675 | |
676 | if (i != 0) |
677 | memcpy(ctx->buf, &(in[inl]), i); |
678 | ctx->buf_len = i; |
679 | return 1; |
680 | } |
681 | |
682 | |
683 | int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl, |
684 | const unsigned char *in, int inl) |
685 | { |
686 | int ret; |
687 | size_t soutl; |
688 | int blocksize; |
689 | |
690 | /* Prevent accidental use of decryption context when encrypting */ |
691 | if (!ctx->encrypt) { |
692 | EVPerr(EVP_F_EVP_ENCRYPTUPDATE, EVP_R_INVALID_OPERATION); |
693 | return 0; |
694 | } |
695 | |
696 | if (ctx->cipher == NULL) { |
697 | EVPerr(EVP_F_EVP_ENCRYPTUPDATE, EVP_R_NO_CIPHER_SET); |
698 | return 0; |
699 | } |
700 | |
701 | if (ctx->cipher->prov == NULL) |
702 | goto legacy; |
703 | |
704 | blocksize = EVP_CIPHER_CTX_block_size(ctx); |
705 | |
706 | if (ctx->cipher->cupdate == NULL || blocksize < 1) { |
707 | EVPerr(EVP_F_EVP_ENCRYPTUPDATE, EVP_R_UPDATE_ERROR); |
708 | return 0; |
709 | } |
710 | ret = ctx->cipher->cupdate(ctx->provctx, out, &soutl, |
711 | inl + (blocksize == 1 ? 0 : blocksize), in, |
712 | (size_t)inl); |
713 | |
714 | if (ret) { |
715 | if (soutl > INT_MAX) { |
716 | EVPerr(EVP_F_EVP_ENCRYPTUPDATE, EVP_R_UPDATE_ERROR); |
717 | return 0; |
718 | } |
719 | *outl = soutl; |
720 | } |
721 | |
722 | return ret; |
723 | |
724 | /* TODO(3.0): Remove legacy code below */ |
725 | legacy: |
726 | |
727 | return evp_EncryptDecryptUpdate(ctx, out, outl, in, inl); |
728 | } |
729 | |
730 | int EVP_EncryptFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl) |
731 | { |
732 | int ret; |
733 | ret = EVP_EncryptFinal_ex(ctx, out, outl); |
734 | return ret; |
735 | } |
736 | |
737 | int EVP_EncryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl) |
738 | { |
739 | int n, ret; |
740 | unsigned int i, b, bl; |
741 | size_t soutl; |
742 | int blocksize; |
743 | |
744 | /* Prevent accidental use of decryption context when encrypting */ |
745 | if (!ctx->encrypt) { |
746 | EVPerr(EVP_F_EVP_ENCRYPTFINAL_EX, EVP_R_INVALID_OPERATION); |
747 | return 0; |
748 | } |
749 | |
750 | if (ctx->cipher == NULL) { |
751 | EVPerr(EVP_F_EVP_ENCRYPTFINAL_EX, EVP_R_NO_CIPHER_SET); |
752 | return 0; |
753 | } |
754 | if (ctx->cipher->prov == NULL) |
755 | goto legacy; |
756 | |
757 | blocksize = EVP_CIPHER_CTX_block_size(ctx); |
758 | |
759 | if (blocksize < 1 || ctx->cipher->cfinal == NULL) { |
760 | EVPerr(EVP_F_EVP_ENCRYPTFINAL_EX, EVP_R_FINAL_ERROR); |
761 | return 0; |
762 | } |
763 | |
764 | ret = ctx->cipher->cfinal(ctx->provctx, out, &soutl, |
765 | blocksize == 1 ? 0 : blocksize); |
766 | |
767 | if (ret) { |
768 | if (soutl > INT_MAX) { |
769 | EVPerr(EVP_F_EVP_ENCRYPTFINAL_EX, EVP_R_FINAL_ERROR); |
770 | return 0; |
771 | } |
772 | *outl = soutl; |
773 | } |
774 | |
775 | return ret; |
776 | |
777 | /* TODO(3.0): Remove legacy code below */ |
778 | legacy: |
779 | |
780 | if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) { |
781 | ret = ctx->cipher->do_cipher(ctx, out, NULL, 0); |
782 | if (ret < 0) |
783 | return 0; |
784 | else |
785 | *outl = ret; |
786 | return 1; |
787 | } |
788 | |
789 | b = ctx->cipher->block_size; |
790 | OPENSSL_assert(b <= sizeof(ctx->buf)); |
791 | if (b == 1) { |
792 | *outl = 0; |
793 | return 1; |
794 | } |
795 | bl = ctx->buf_len; |
796 | if (ctx->flags & EVP_CIPH_NO_PADDING) { |
797 | if (bl) { |
798 | EVPerr(EVP_F_EVP_ENCRYPTFINAL_EX, |
799 | EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH); |
800 | return 0; |
801 | } |
802 | *outl = 0; |
803 | return 1; |
804 | } |
805 | |
806 | n = b - bl; |
807 | for (i = bl; i < b; i++) |
808 | ctx->buf[i] = n; |
809 | ret = ctx->cipher->do_cipher(ctx, out, ctx->buf, b); |
810 | |
811 | if (ret) |
812 | *outl = b; |
813 | |
814 | return ret; |
815 | } |
816 | |
817 | int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl, |
818 | const unsigned char *in, int inl) |
819 | { |
820 | int fix_len, cmpl = inl, ret; |
821 | unsigned int b; |
822 | size_t soutl; |
823 | int blocksize; |
824 | |
825 | /* Prevent accidental use of encryption context when decrypting */ |
826 | if (ctx->encrypt) { |
827 | EVPerr(EVP_F_EVP_DECRYPTUPDATE, EVP_R_INVALID_OPERATION); |
828 | return 0; |
829 | } |
830 | |
831 | if (ctx->cipher == NULL) { |
832 | EVPerr(EVP_F_EVP_DECRYPTUPDATE, EVP_R_NO_CIPHER_SET); |
833 | return 0; |
834 | } |
835 | if (ctx->cipher->prov == NULL) |
836 | goto legacy; |
837 | |
838 | blocksize = EVP_CIPHER_CTX_block_size(ctx); |
839 | |
840 | if (ctx->cipher->cupdate == NULL || blocksize < 1) { |
841 | EVPerr(EVP_F_EVP_DECRYPTUPDATE, EVP_R_UPDATE_ERROR); |
842 | return 0; |
843 | } |
844 | ret = ctx->cipher->cupdate(ctx->provctx, out, &soutl, |
845 | inl + (blocksize == 1 ? 0 : blocksize), in, |
846 | (size_t)inl); |
847 | |
848 | if (ret) { |
849 | if (soutl > INT_MAX) { |
850 | EVPerr(EVP_F_EVP_DECRYPTUPDATE, EVP_R_UPDATE_ERROR); |
851 | return 0; |
852 | } |
853 | *outl = soutl; |
854 | } |
855 | |
856 | return ret; |
857 | |
858 | /* TODO(3.0): Remove legacy code below */ |
859 | legacy: |
860 | |
861 | b = ctx->cipher->block_size; |
862 | |
863 | if (EVP_CIPHER_CTX_test_flags(ctx, EVP_CIPH_FLAG_LENGTH_BITS)) |
864 | cmpl = (cmpl + 7) / 8; |
865 | |
866 | if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) { |
867 | if (b == 1 && is_partially_overlapping(out, in, cmpl)) { |
868 | EVPerr(EVP_F_EVP_DECRYPTUPDATE, EVP_R_PARTIALLY_OVERLAPPING); |
869 | return 0; |
870 | } |
871 | |
872 | fix_len = ctx->cipher->do_cipher(ctx, out, in, inl); |
873 | if (fix_len < 0) { |
874 | *outl = 0; |
875 | return 0; |
876 | } else |
877 | *outl = fix_len; |
878 | return 1; |
879 | } |
880 | |
881 | if (inl <= 0) { |
882 | *outl = 0; |
883 | return inl == 0; |
884 | } |
885 | |
886 | if (ctx->flags & EVP_CIPH_NO_PADDING) |
887 | return evp_EncryptDecryptUpdate(ctx, out, outl, in, inl); |
888 | |
889 | OPENSSL_assert(b <= sizeof(ctx->final)); |
890 | |
891 | if (ctx->final_used) { |
892 | /* see comment about PTRDIFF_T comparison above */ |
893 | if (((PTRDIFF_T)out == (PTRDIFF_T)in) |
894 | || is_partially_overlapping(out, in, b)) { |
895 | EVPerr(EVP_F_EVP_DECRYPTUPDATE, EVP_R_PARTIALLY_OVERLAPPING); |
896 | return 0; |
897 | } |
898 | memcpy(out, ctx->final, b); |
899 | out += b; |
900 | fix_len = 1; |
901 | } else |
902 | fix_len = 0; |
903 | |
904 | if (!evp_EncryptDecryptUpdate(ctx, out, outl, in, inl)) |
905 | return 0; |
906 | |
907 | /* |
908 | * if we have 'decrypted' a multiple of block size, make sure we have a |
909 | * copy of this last block |
910 | */ |
911 | if (b > 1 && !ctx->buf_len) { |
912 | *outl -= b; |
913 | ctx->final_used = 1; |
914 | memcpy(ctx->final, &out[*outl], b); |
915 | } else |
916 | ctx->final_used = 0; |
917 | |
918 | if (fix_len) |
919 | *outl += b; |
920 | |
921 | return 1; |
922 | } |
923 | |
924 | int EVP_DecryptFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl) |
925 | { |
926 | int ret; |
927 | ret = EVP_DecryptFinal_ex(ctx, out, outl); |
928 | return ret; |
929 | } |
930 | |
931 | int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl) |
932 | { |
933 | int i, n; |
934 | unsigned int b; |
935 | size_t soutl; |
936 | int ret; |
937 | int blocksize; |
938 | |
939 | /* Prevent accidental use of encryption context when decrypting */ |
940 | if (ctx->encrypt) { |
941 | EVPerr(EVP_F_EVP_DECRYPTFINAL_EX, EVP_R_INVALID_OPERATION); |
942 | return 0; |
943 | } |
944 | |
945 | if (ctx->cipher == NULL) { |
946 | EVPerr(EVP_F_EVP_DECRYPTFINAL_EX, EVP_R_NO_CIPHER_SET); |
947 | return 0; |
948 | } |
949 | |
950 | if (ctx->cipher->prov == NULL) |
951 | goto legacy; |
952 | |
953 | blocksize = EVP_CIPHER_CTX_block_size(ctx); |
954 | |
955 | if (blocksize < 1 || ctx->cipher->cfinal == NULL) { |
956 | EVPerr(EVP_F_EVP_DECRYPTFINAL_EX, EVP_R_FINAL_ERROR); |
957 | return 0; |
958 | } |
959 | |
960 | ret = ctx->cipher->cfinal(ctx->provctx, out, &soutl, |
961 | blocksize == 1 ? 0 : blocksize); |
962 | |
963 | if (ret) { |
964 | if (soutl > INT_MAX) { |
965 | EVPerr(EVP_F_EVP_DECRYPTFINAL_EX, EVP_R_FINAL_ERROR); |
966 | return 0; |
967 | } |
968 | *outl = soutl; |
969 | } |
970 | |
971 | return ret; |
972 | |
973 | /* TODO(3.0): Remove legacy code below */ |
974 | legacy: |
975 | |
976 | *outl = 0; |
977 | if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) { |
978 | i = ctx->cipher->do_cipher(ctx, out, NULL, 0); |
979 | if (i < 0) |
980 | return 0; |
981 | else |
982 | *outl = i; |
983 | return 1; |
984 | } |
985 | |
986 | b = ctx->cipher->block_size; |
987 | if (ctx->flags & EVP_CIPH_NO_PADDING) { |
988 | if (ctx->buf_len) { |
989 | EVPerr(EVP_F_EVP_DECRYPTFINAL_EX, |
990 | EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH); |
991 | return 0; |
992 | } |
993 | *outl = 0; |
994 | return 1; |
995 | } |
996 | if (b > 1) { |
997 | if (ctx->buf_len || !ctx->final_used) { |
998 | EVPerr(EVP_F_EVP_DECRYPTFINAL_EX, EVP_R_WRONG_FINAL_BLOCK_LENGTH); |
999 | return 0; |
1000 | } |
1001 | OPENSSL_assert(b <= sizeof(ctx->final)); |
1002 | |
1003 | /* |
1004 | * The following assumes that the ciphertext has been authenticated. |
1005 | * Otherwise it provides a padding oracle. |
1006 | */ |
1007 | n = ctx->final[b - 1]; |
1008 | if (n == 0 || n > (int)b) { |
1009 | EVPerr(EVP_F_EVP_DECRYPTFINAL_EX, EVP_R_BAD_DECRYPT); |
1010 | return 0; |
1011 | } |
1012 | for (i = 0; i < n; i++) { |
1013 | if (ctx->final[--b] != n) { |
1014 | EVPerr(EVP_F_EVP_DECRYPTFINAL_EX, EVP_R_BAD_DECRYPT); |
1015 | return 0; |
1016 | } |
1017 | } |
1018 | n = ctx->cipher->block_size - n; |
1019 | for (i = 0; i < n; i++) |
1020 | out[i] = ctx->final[i]; |
1021 | *outl = n; |
1022 | } else |
1023 | *outl = 0; |
1024 | return 1; |
1025 | } |
1026 | |
1027 | int EVP_CIPHER_CTX_set_key_length(EVP_CIPHER_CTX *c, int keylen) |
1028 | { |
1029 | if (c->cipher->prov != NULL) { |
1030 | int ok; |
1031 | OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END }; |
1032 | size_t len = keylen; |
1033 | |
1034 | if (EVP_CIPHER_CTX_key_length(c) == keylen) |
1035 | return 1; |
1036 | |
1037 | /* Check the cipher actually understands this parameter */ |
1038 | if (OSSL_PARAM_locate_const(EVP_CIPHER_settable_ctx_params(c->cipher), |
1039 | OSSL_CIPHER_PARAM_KEYLEN) == NULL) |
1040 | return 0; |
1041 | |
1042 | params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_KEYLEN, &len); |
1043 | ok = evp_do_ciph_ctx_setparams(c->cipher, c->provctx, params); |
1044 | |
1045 | return ok > 0 ? 1 : 0; |
1046 | } |
1047 | |
1048 | /* TODO(3.0) legacy code follows */ |
1049 | |
1050 | /* |
1051 | * Note there have never been any built-in ciphers that define this flag |
1052 | * since it was first introduced. |
1053 | */ |
1054 | if (c->cipher->flags & EVP_CIPH_CUSTOM_KEY_LENGTH) |
1055 | return EVP_CIPHER_CTX_ctrl(c, EVP_CTRL_SET_KEY_LENGTH, keylen, NULL); |
1056 | if (EVP_CIPHER_CTX_key_length(c) == keylen) |
1057 | return 1; |
1058 | if ((keylen > 0) && (c->cipher->flags & EVP_CIPH_VARIABLE_LENGTH)) { |
1059 | c->key_len = keylen; |
1060 | return 1; |
1061 | } |
1062 | EVPerr(EVP_F_EVP_CIPHER_CTX_SET_KEY_LENGTH, EVP_R_INVALID_KEY_LENGTH); |
1063 | return 0; |
1064 | } |
1065 | |
1066 | int EVP_CIPHER_CTX_set_padding(EVP_CIPHER_CTX *ctx, int pad) |
1067 | { |
1068 | int ok; |
1069 | OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END }; |
1070 | unsigned int pd = pad; |
1071 | |
1072 | if (pad) |
1073 | ctx->flags &= ~EVP_CIPH_NO_PADDING; |
1074 | else |
1075 | ctx->flags |= EVP_CIPH_NO_PADDING; |
1076 | |
1077 | params[0] = OSSL_PARAM_construct_uint(OSSL_CIPHER_PARAM_PADDING, &pd); |
1078 | ok = evp_do_ciph_ctx_setparams(ctx->cipher, ctx->provctx, params); |
1079 | |
1080 | return ok != 0; |
1081 | } |
1082 | |
1083 | int EVP_CIPHER_CTX_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr) |
1084 | { |
1085 | int ret = EVP_CTRL_RET_UNSUPPORTED; |
1086 | int set_params = 1; |
1087 | size_t sz = arg; |
1088 | unsigned int i; |
1089 | OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END }; |
1090 | |
1091 | if (ctx == NULL || ctx->cipher == NULL) { |
1092 | EVPerr(EVP_F_EVP_CIPHER_CTX_CTRL, EVP_R_NO_CIPHER_SET); |
1093 | return 0; |
1094 | } |
1095 | |
1096 | if (ctx->cipher->prov == NULL) |
1097 | goto legacy; |
1098 | |
1099 | switch (type) { |
1100 | case EVP_CTRL_SET_KEY_LENGTH: |
1101 | params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_KEYLEN, &sz); |
1102 | break; |
1103 | case EVP_CTRL_RAND_KEY: /* Used by DES */ |
1104 | set_params = 0; |
1105 | params[0] = |
1106 | OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_RANDOM_KEY, |
1107 | ptr, sz); |
1108 | break; |
1109 | |
1110 | case EVP_CTRL_INIT: |
1111 | /* |
1112 | * TODO(3.0) EVP_CTRL_INIT is purely legacy, no provider counterpart |
1113 | * As a matter of fact, this should be dead code, but some caller |
1114 | * might still do a direct control call with this command, so... |
1115 | * Legacy methods return 1 except for exceptional circumstances, so |
1116 | * we do the same here to not be disruptive. |
1117 | */ |
1118 | return 1; |
1119 | case EVP_CTRL_SET_PIPELINE_OUTPUT_BUFS: /* Used by DASYNC */ |
1120 | default: |
1121 | goto end; |
1122 | case EVP_CTRL_GET_IV: |
1123 | set_params = 0; |
1124 | params[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_IV, |
1125 | ptr, sz); |
1126 | break; |
1127 | case EVP_CTRL_AEAD_SET_IVLEN: |
1128 | if (arg < 0) |
1129 | return 0; |
1130 | params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_IVLEN, &sz); |
1131 | break; |
1132 | case EVP_CTRL_GCM_SET_IV_FIXED: |
1133 | params[0] = |
1134 | OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TLS1_IV_FIXED, |
1135 | ptr, sz); |
1136 | break; |
1137 | case EVP_CTRL_GET_RC5_ROUNDS: |
1138 | set_params = 0; /* Fall thru */ |
1139 | case EVP_CTRL_SET_RC5_ROUNDS: |
1140 | if (arg < 0) |
1141 | return 0; |
1142 | i = (unsigned int)arg; |
1143 | params[0] = OSSL_PARAM_construct_uint(OSSL_CIPHER_PARAM_ROUNDS, &i); |
1144 | break; |
1145 | case EVP_CTRL_SET_SPEED: |
1146 | if (arg < 0) |
1147 | return 0; |
1148 | i = (unsigned int)arg; |
1149 | params[0] = OSSL_PARAM_construct_uint(OSSL_CIPHER_PARAM_SPEED, &i); |
1150 | break; |
1151 | case EVP_CTRL_AEAD_GET_TAG: |
1152 | set_params = 0; /* Fall thru */ |
1153 | case EVP_CTRL_AEAD_SET_TAG: |
1154 | params[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, |
1155 | ptr, sz); |
1156 | break; |
1157 | case EVP_CTRL_AEAD_SET_MAC_KEY: |
1158 | params[0] = |
1159 | OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_MAC_KEY, |
1160 | ptr, sz); |
1161 | break; |
1162 | case EVP_CTRL_AEAD_TLS1_AAD: |
1163 | /* This one does a set and a get - since it returns a padding size */ |
1164 | params[0] = |
1165 | OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TLS1_AAD, |
1166 | ptr, sz); |
1167 | ret = evp_do_ciph_ctx_setparams(ctx->cipher, ctx->provctx, params); |
1168 | if (ret <= 0) |
1169 | goto end; |
1170 | params[0] = |
1171 | OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_AEAD_TLS1_AAD_PAD, &sz); |
1172 | ret = evp_do_ciph_ctx_getparams(ctx->cipher, ctx->provctx, params); |
1173 | if (ret <= 0) |
1174 | goto end; |
1175 | return sz; |
1176 | #ifndef OPENSSL_NO_RC2 |
1177 | case EVP_CTRL_GET_RC2_KEY_BITS: |
1178 | set_params = 0; /* Fall thru */ |
1179 | case EVP_CTRL_SET_RC2_KEY_BITS: |
1180 | params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_RC2_KEYBITS, &sz); |
1181 | break; |
1182 | #endif /* OPENSSL_NO_RC2 */ |
1183 | } |
1184 | |
1185 | if (set_params) |
1186 | ret = evp_do_ciph_ctx_setparams(ctx->cipher, ctx->provctx, params); |
1187 | else |
1188 | ret = evp_do_ciph_ctx_getparams(ctx->cipher, ctx->provctx, params); |
1189 | goto end; |
1190 | |
1191 | /* TODO(3.0): Remove legacy code below */ |
1192 | legacy: |
1193 | if (ctx->cipher->ctrl == NULL) { |
1194 | EVPerr(EVP_F_EVP_CIPHER_CTX_CTRL, EVP_R_CTRL_NOT_IMPLEMENTED); |
1195 | return 0; |
1196 | } |
1197 | |
1198 | ret = ctx->cipher->ctrl(ctx, type, arg, ptr); |
1199 | |
1200 | end: |
1201 | if (ret == EVP_CTRL_RET_UNSUPPORTED) { |
1202 | EVPerr(EVP_F_EVP_CIPHER_CTX_CTRL, |
1203 | EVP_R_CTRL_OPERATION_NOT_IMPLEMENTED); |
1204 | return 0; |
1205 | } |
1206 | return ret; |
1207 | } |
1208 | |
1209 | int EVP_CIPHER_get_params(EVP_CIPHER *cipher, OSSL_PARAM params[]) |
1210 | { |
1211 | if (cipher != NULL && cipher->get_params != NULL) |
1212 | return cipher->get_params(params); |
1213 | return 0; |
1214 | } |
1215 | |
1216 | int EVP_CIPHER_CTX_set_params(EVP_CIPHER_CTX *ctx, const OSSL_PARAM params[]) |
1217 | { |
1218 | if (ctx->cipher != NULL && ctx->cipher->set_ctx_params != NULL) |
1219 | return ctx->cipher->set_ctx_params(ctx->provctx, params); |
1220 | return 0; |
1221 | } |
1222 | |
1223 | int EVP_CIPHER_CTX_get_params(EVP_CIPHER_CTX *ctx, OSSL_PARAM params[]) |
1224 | { |
1225 | if (ctx->cipher != NULL && ctx->cipher->get_ctx_params != NULL) |
1226 | return ctx->cipher->get_ctx_params(ctx->provctx, params); |
1227 | return 0; |
1228 | } |
1229 | |
1230 | const OSSL_PARAM *EVP_CIPHER_gettable_params(const EVP_CIPHER *cipher) |
1231 | { |
1232 | if (cipher != NULL && cipher->gettable_params != NULL) |
1233 | return cipher->gettable_params(); |
1234 | return NULL; |
1235 | } |
1236 | |
1237 | const OSSL_PARAM *EVP_CIPHER_settable_ctx_params(const EVP_CIPHER *cipher) |
1238 | { |
1239 | if (cipher != NULL && cipher->settable_ctx_params != NULL) |
1240 | return cipher->settable_ctx_params(); |
1241 | return NULL; |
1242 | } |
1243 | |
1244 | const OSSL_PARAM *EVP_CIPHER_gettable_ctx_params(const EVP_CIPHER *cipher) |
1245 | { |
1246 | if (cipher != NULL && cipher->gettable_ctx_params != NULL) |
1247 | return cipher->gettable_ctx_params(); |
1248 | return NULL; |
1249 | } |
1250 | |
1251 | int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key) |
1252 | { |
1253 | if (ctx->cipher->flags & EVP_CIPH_RAND_KEY) |
1254 | return EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_RAND_KEY, 0, key); |
1255 | |
1256 | #ifdef FIPS_MODE |
1257 | return 0; |
1258 | #else |
1259 | { |
1260 | int kl; |
1261 | |
1262 | kl = EVP_CIPHER_CTX_key_length(ctx); |
1263 | if (kl <= 0 || RAND_priv_bytes(key, kl) <= 0) |
1264 | return 0; |
1265 | return 1; |
1266 | } |
1267 | #endif /* FIPS_MODE */ |
1268 | } |
1269 | |
1270 | int EVP_CIPHER_CTX_copy(EVP_CIPHER_CTX *out, const EVP_CIPHER_CTX *in) |
1271 | { |
1272 | if ((in == NULL) || (in->cipher == NULL)) { |
1273 | EVPerr(EVP_F_EVP_CIPHER_CTX_COPY, EVP_R_INPUT_NOT_INITIALIZED); |
1274 | return 0; |
1275 | } |
1276 | |
1277 | if (in->cipher->prov == NULL) |
1278 | goto legacy; |
1279 | |
1280 | if (in->cipher->dupctx == NULL) { |
1281 | EVPerr(EVP_F_EVP_CIPHER_CTX_COPY, EVP_R_NOT_ABLE_TO_COPY_CTX); |
1282 | return 0; |
1283 | } |
1284 | |
1285 | EVP_CIPHER_CTX_reset(out); |
1286 | |
1287 | *out = *in; |
1288 | out->provctx = NULL; |
1289 | |
1290 | if (in->fetched_cipher != NULL && !EVP_CIPHER_up_ref(in->fetched_cipher)) { |
1291 | out->fetched_cipher = NULL; |
1292 | return 0; |
1293 | } |
1294 | |
1295 | out->provctx = in->cipher->dupctx(in->provctx); |
1296 | if (out->provctx == NULL) { |
1297 | EVPerr(EVP_F_EVP_CIPHER_CTX_COPY, EVP_R_NOT_ABLE_TO_COPY_CTX); |
1298 | return 0; |
1299 | } |
1300 | |
1301 | return 1; |
1302 | |
1303 | /* TODO(3.0): Remove legacy code below */ |
1304 | legacy: |
1305 | |
1306 | #if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE) |
1307 | /* Make sure it's safe to copy a cipher context using an ENGINE */ |
1308 | if (in->engine && !ENGINE_init(in->engine)) { |
1309 | EVPerr(EVP_F_EVP_CIPHER_CTX_COPY, ERR_R_ENGINE_LIB); |
1310 | return 0; |
1311 | } |
1312 | #endif |
1313 | |
1314 | EVP_CIPHER_CTX_reset(out); |
1315 | memcpy(out, in, sizeof(*out)); |
1316 | |
1317 | if (in->cipher_data && in->cipher->ctx_size) { |
1318 | out->cipher_data = OPENSSL_malloc(in->cipher->ctx_size); |
1319 | if (out->cipher_data == NULL) { |
1320 | out->cipher = NULL; |
1321 | EVPerr(EVP_F_EVP_CIPHER_CTX_COPY, ERR_R_MALLOC_FAILURE); |
1322 | return 0; |
1323 | } |
1324 | memcpy(out->cipher_data, in->cipher_data, in->cipher->ctx_size); |
1325 | } |
1326 | |
1327 | if (in->cipher->flags & EVP_CIPH_CUSTOM_COPY) |
1328 | if (!in->cipher->ctrl((EVP_CIPHER_CTX *)in, EVP_CTRL_COPY, 0, out)) { |
1329 | out->cipher = NULL; |
1330 | EVPerr(EVP_F_EVP_CIPHER_CTX_COPY, EVP_R_INITIALIZATION_ERROR); |
1331 | return 0; |
1332 | } |
1333 | return 1; |
1334 | } |
1335 | |
1336 | EVP_CIPHER *evp_cipher_new(void) |
1337 | { |
1338 | EVP_CIPHER *cipher = OPENSSL_zalloc(sizeof(EVP_CIPHER)); |
1339 | |
1340 | if (cipher != NULL) { |
1341 | cipher->lock = CRYPTO_THREAD_lock_new(); |
1342 | if (cipher->lock == NULL) { |
1343 | OPENSSL_free(cipher); |
1344 | return NULL; |
1345 | } |
1346 | cipher->refcnt = 1; |
1347 | } |
1348 | return cipher; |
1349 | } |
1350 | |
1351 | /* |
1352 | * FIPS module note: since internal fetches will be entirely |
1353 | * provider based, we know that none of its code depends on legacy |
1354 | * NIDs or any functionality that use them. |
1355 | */ |
1356 | #ifndef FIPS_MODE |
1357 | /* TODO(3.x) get rid of the need for legacy NIDs */ |
1358 | static void set_legacy_nid(const char *name, void *vlegacy_nid) |
1359 | { |
1360 | int nid; |
1361 | int *legacy_nid = vlegacy_nid; |
1362 | /* |
1363 | * We use lowest level function to get the associated method, because |
1364 | * higher level functions such as EVP_get_cipherbyname() have changed |
1365 | * to look at providers too. |
1366 | */ |
1367 | const void *legacy_method = OBJ_NAME_get(name, OBJ_NAME_TYPE_CIPHER_METH); |
1368 | |
1369 | if (*legacy_nid == -1) /* We found a clash already */ |
1370 | return; |
1371 | if (legacy_method == NULL) |
1372 | return; |
1373 | nid = EVP_CIPHER_nid(legacy_method); |
1374 | if (*legacy_nid != NID_undef && *legacy_nid != nid) { |
1375 | *legacy_nid = -1; |
1376 | return; |
1377 | } |
1378 | *legacy_nid = nid; |
1379 | } |
1380 | #endif |
1381 | |
1382 | static void *evp_cipher_from_dispatch(const int name_id, |
1383 | const OSSL_DISPATCH *fns, |
1384 | OSSL_PROVIDER *prov) |
1385 | { |
1386 | EVP_CIPHER *cipher = NULL; |
1387 | int fnciphcnt = 0, fnctxcnt = 0; |
1388 | |
1389 | if ((cipher = evp_cipher_new()) == NULL) { |
1390 | EVPerr(0, ERR_R_MALLOC_FAILURE); |
1391 | return NULL; |
1392 | } |
1393 | |
1394 | #ifndef FIPS_MODE |
1395 | /* TODO(3.x) get rid of the need for legacy NIDs */ |
1396 | cipher->nid = NID_undef; |
1397 | evp_names_do_all(prov, name_id, set_legacy_nid, &cipher->nid); |
1398 | if (cipher->nid == -1) { |
1399 | ERR_raise(ERR_LIB_EVP, ERR_R_INTERNAL_ERROR); |
1400 | EVP_CIPHER_free(cipher); |
1401 | return NULL; |
1402 | } |
1403 | #endif |
1404 | |
1405 | cipher->name_id = name_id; |
1406 | |
1407 | for (; fns->function_id != 0; fns++) { |
1408 | switch (fns->function_id) { |
1409 | case OSSL_FUNC_CIPHER_NEWCTX: |
1410 | if (cipher->newctx != NULL) |
1411 | break; |
1412 | cipher->newctx = OSSL_get_OP_cipher_newctx(fns); |
1413 | fnctxcnt++; |
1414 | break; |
1415 | case OSSL_FUNC_CIPHER_ENCRYPT_INIT: |
1416 | if (cipher->einit != NULL) |
1417 | break; |
1418 | cipher->einit = OSSL_get_OP_cipher_encrypt_init(fns); |
1419 | fnciphcnt++; |
1420 | break; |
1421 | case OSSL_FUNC_CIPHER_DECRYPT_INIT: |
1422 | if (cipher->dinit != NULL) |
1423 | break; |
1424 | cipher->dinit = OSSL_get_OP_cipher_decrypt_init(fns); |
1425 | fnciphcnt++; |
1426 | break; |
1427 | case OSSL_FUNC_CIPHER_UPDATE: |
1428 | if (cipher->cupdate != NULL) |
1429 | break; |
1430 | cipher->cupdate = OSSL_get_OP_cipher_update(fns); |
1431 | fnciphcnt++; |
1432 | break; |
1433 | case OSSL_FUNC_CIPHER_FINAL: |
1434 | if (cipher->cfinal != NULL) |
1435 | break; |
1436 | cipher->cfinal = OSSL_get_OP_cipher_final(fns); |
1437 | fnciphcnt++; |
1438 | break; |
1439 | case OSSL_FUNC_CIPHER_CIPHER: |
1440 | if (cipher->ccipher != NULL) |
1441 | break; |
1442 | cipher->ccipher = OSSL_get_OP_cipher_cipher(fns); |
1443 | break; |
1444 | case OSSL_FUNC_CIPHER_FREECTX: |
1445 | if (cipher->freectx != NULL) |
1446 | break; |
1447 | cipher->freectx = OSSL_get_OP_cipher_freectx(fns); |
1448 | fnctxcnt++; |
1449 | break; |
1450 | case OSSL_FUNC_CIPHER_DUPCTX: |
1451 | if (cipher->dupctx != NULL) |
1452 | break; |
1453 | cipher->dupctx = OSSL_get_OP_cipher_dupctx(fns); |
1454 | break; |
1455 | case OSSL_FUNC_CIPHER_GET_PARAMS: |
1456 | if (cipher->get_params != NULL) |
1457 | break; |
1458 | cipher->get_params = OSSL_get_OP_cipher_get_params(fns); |
1459 | break; |
1460 | case OSSL_FUNC_CIPHER_GET_CTX_PARAMS: |
1461 | if (cipher->get_ctx_params != NULL) |
1462 | break; |
1463 | cipher->get_ctx_params = OSSL_get_OP_cipher_get_ctx_params(fns); |
1464 | break; |
1465 | case OSSL_FUNC_CIPHER_SET_CTX_PARAMS: |
1466 | if (cipher->set_ctx_params != NULL) |
1467 | break; |
1468 | cipher->set_ctx_params = OSSL_get_OP_cipher_set_ctx_params(fns); |
1469 | break; |
1470 | case OSSL_FUNC_CIPHER_GETTABLE_PARAMS: |
1471 | if (cipher->gettable_params != NULL) |
1472 | break; |
1473 | cipher->gettable_params = OSSL_get_OP_cipher_gettable_params(fns); |
1474 | break; |
1475 | case OSSL_FUNC_CIPHER_GETTABLE_CTX_PARAMS: |
1476 | if (cipher->gettable_ctx_params != NULL) |
1477 | break; |
1478 | cipher->gettable_ctx_params = |
1479 | OSSL_get_OP_cipher_gettable_ctx_params(fns); |
1480 | break; |
1481 | case OSSL_FUNC_CIPHER_SETTABLE_CTX_PARAMS: |
1482 | if (cipher->settable_ctx_params != NULL) |
1483 | break; |
1484 | cipher->settable_ctx_params = |
1485 | OSSL_get_OP_cipher_settable_ctx_params(fns); |
1486 | break; |
1487 | } |
1488 | } |
1489 | if ((fnciphcnt != 0 && fnciphcnt != 3 && fnciphcnt != 4) |
1490 | || (fnciphcnt == 0 && cipher->ccipher == NULL) |
1491 | || fnctxcnt != 2) { |
1492 | /* |
1493 | * In order to be a consistent set of functions we must have at least |
1494 | * a complete set of "encrypt" functions, or a complete set of "decrypt" |
1495 | * functions, or a single "cipher" function. In all cases we need both |
1496 | * the "newctx" and "freectx" functions. |
1497 | */ |
1498 | EVP_CIPHER_free(cipher); |
1499 | EVPerr(EVP_F_EVP_CIPHER_FROM_DISPATCH, EVP_R_INVALID_PROVIDER_FUNCTIONS); |
1500 | return NULL; |
1501 | } |
1502 | cipher->prov = prov; |
1503 | if (prov != NULL) |
1504 | ossl_provider_up_ref(prov); |
1505 | |
1506 | return cipher; |
1507 | } |
1508 | |
1509 | static int evp_cipher_up_ref(void *cipher) |
1510 | { |
1511 | return EVP_CIPHER_up_ref(cipher); |
1512 | } |
1513 | |
1514 | static void evp_cipher_free(void *cipher) |
1515 | { |
1516 | EVP_CIPHER_free(cipher); |
1517 | } |
1518 | |
1519 | EVP_CIPHER *EVP_CIPHER_fetch(OPENSSL_CTX *ctx, const char *algorithm, |
1520 | const char *properties) |
1521 | { |
1522 | EVP_CIPHER *cipher = |
1523 | evp_generic_fetch(ctx, OSSL_OP_CIPHER, algorithm, properties, |
1524 | evp_cipher_from_dispatch, evp_cipher_up_ref, |
1525 | evp_cipher_free); |
1526 | |
1527 | if (cipher != NULL && !evp_cipher_cache_constants(cipher)) { |
1528 | EVP_CIPHER_free(cipher); |
1529 | cipher = NULL; |
1530 | } |
1531 | return cipher; |
1532 | } |
1533 | |
1534 | int EVP_CIPHER_up_ref(EVP_CIPHER *cipher) |
1535 | { |
1536 | int ref = 0; |
1537 | |
1538 | CRYPTO_UP_REF(&cipher->refcnt, &ref, cipher->lock); |
1539 | return 1; |
1540 | } |
1541 | |
1542 | void EVP_CIPHER_free(EVP_CIPHER *cipher) |
1543 | { |
1544 | int i; |
1545 | |
1546 | if (cipher == NULL) |
1547 | return; |
1548 | |
1549 | CRYPTO_DOWN_REF(&cipher->refcnt, &i, cipher->lock); |
1550 | if (i > 0) |
1551 | return; |
1552 | ossl_provider_free(cipher->prov); |
1553 | CRYPTO_THREAD_lock_free(cipher->lock); |
1554 | OPENSSL_free(cipher); |
1555 | } |
1556 | |
1557 | void EVP_CIPHER_do_all_provided(OPENSSL_CTX *libctx, |
1558 | void (*fn)(EVP_CIPHER *mac, void *arg), |
1559 | void *arg) |
1560 | { |
1561 | evp_generic_do_all(libctx, OSSL_OP_CIPHER, |
1562 | (void (*)(void *, void *))fn, arg, |
1563 | evp_cipher_from_dispatch, evp_cipher_free); |
1564 | } |
1565 | |