Skip to content

Refactor raw public key handling and legacy EVP_PKEY methods #669

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
olszomal wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Refactor raw public key handling and legacy EVP_PKEY methods #669

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions src/Makefile.am
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,9 +62,9 @@ libeng_err_la_CFLAGS = $(AM_CFLAGS) $(OPENSSL_EXTRA_CFLAGS) $(OPENSSL_CFLAGS) \
# because it is compiled as part of libp11_err.la (above).
# ----------------------------------------------------------
libp11_la_SOURCES = libpkcs11.c p11_attr.c p11_cert.c p11_ckr.c \
p11_key.c p11_load.c p11_misc.c p11_rsa.c p11_ec.c p11_eddsa.c \
p11_mldsa.c p11_slhdsa.c p11_falcon.c \
p11_pkey.c p11_slot.c p11_front.c p11_atfork.c libp11.exports
p11_key.c p11_load.c p11_misc.c p11_rsa.c p11_ec.c p11_ecx.c \
p11_rawkey.c p11_pkey.c p11_slot.c p11_front.c p11_atfork.c \
libp11.exports

# Compiler flags for libp11
libp11_la_CFLAGS = $(AM_CFLAGS) $(OPENSSL_CFLAGS)
Expand Down
4 changes: 2 additions & 2 deletions src/Makefile.mak
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@ TOPDIR = ..

LIBP11_OBJECTS = libpkcs11.obj p11_attr.obj p11_cert.obj \
p11_err.obj p11_ckr.obj p11_key.obj p11_load.obj p11_misc.obj \
p11_rsa.obj p11_ec.obj p11_pkey.obj p11_slot.obj p11_front.obj \
p11_atfork.obj p11_eddsa.obj p11_mldsa.obj p11_slhdsa.obj p11_falcon.obj
p11_rsa.obj p11_ec.obj p11_ecx.obj p11_rawkey.obj p11_pkey.obj \
p11_slot.obj p11_front.obj p11_atfork.obj
LIBP11_LIB = libp11.lib
LIBP11_TARGET = libp11.dll

Expand Down
60 changes: 26 additions & 34 deletions src/libp11-int.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,13 @@

#include "p11_pthread.h"

#if OPENSSL_VERSION_NUMBER >= 0x30000000L && \
OPENSSL_VERSION_NUMBER < 0x40000000L && \
!defined(OPENSSL_NO_DEPRECATED_3_0) && \
!defined(OPENSSL_NO_ECX)
#define LIBP11_HAVE_ECX_METHODS
#endif

#if OPENSSL_VERSION_NUMBER >= 0x30000000L
#define EVP_PKEY_FALCON512 0x10001
#define EVP_PKEY_FALCON1024 0x10002
Expand Down Expand Up @@ -364,6 +371,12 @@ extern PKCS11_KEY *pkcs11_find_key(PKCS11_OBJECT_private *cert);
#if OPENSSL_VERSION_NUMBER >= 0x30000000L
/* Return the borrowed PKCS#11 object associated with the EVP_PKEY */
extern PKCS11_OBJECT_private *pkcs11_get_ex_data_object(const EVP_PKEY *pk);

/* Return the borrowed private PKCS#11 object for EVP_PKEY_METHOD operations */
extern PKCS11_OBJECT_private *pkcs11_get_legacy_pkey_object(const EVP_PKEY *pkey);

/* Free the allocated EVP_PKEY ex_data index. */
extern void free_evp_pkey_ex_index(void);
#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */

/* Get a list of all certificates matching with template associated with this token */
Expand Down Expand Up @@ -581,25 +594,6 @@ extern PKCS11_OBJECT_private *pkcs11_get_ex_data_ec(const EC_KEY *ec);
extern void pkcs11_set_ex_data_ec(EC_KEY *ec, PKCS11_OBJECT_private *key);
#endif /* OPENSSL_NO_EC */

# if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_VERSION_NUMBER < 0x40000000L
/* Set PKCS11_OBJECT_private for an EVP_PKEY */
extern void pkcs11_set_ex_data_pkey(EVP_PKEY *pkey, PKCS11_OBJECT_private *key);

/* Retrieve PKCS11_OBJECT_private from an EVP_PKEY */
extern PKCS11_OBJECT_private *pkcs11_get_ex_data_pkey(const EVP_PKEY *pkey);

/* Allocate a global EVP_PKEY ex_data index */
extern void alloc_pkey_ex_index(void);

/* Free the allocated EVP_PKEY ex_data index. */
extern void free_pkey_ex_index(void);
# endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_VERSION_NUMBER < 0x40000000L */

#if OPENSSL_VERSION_NUMBER >= 0x30000000L
/* Free the allocated EVP_PKEY ex_data index. */
extern void free_evp_pkey_ex_index(void);
#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */

/* Convert an OpenSSL digest (EVP_MD) to the corresponding PKCS#11 hash mechanism */
extern CK_MECHANISM_TYPE pkcs11_md2ckm(const EVP_MD *md);

Expand All @@ -618,18 +612,21 @@ extern void pkcs11_ecdsa_method_free(void);
/* Free the global ECDH_METHOD */
extern void pkcs11_ecdh_method_free(void);

#if !defined(OPENSSL_NO_ECX) && OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_VERSION_NUMBER < 0x40000000L
/* Free the global ED25519/ED448 EVP_PKEY_METHOD */
extern void pkcs11_ed_key_method_free(void);
#ifdef LIBP11_HAVE_ECX_METHODS
/* Enable an ECX EVP_PKEY_METHOD wrapper for a PKCS#11 private key */
extern int pkcs11_ecx_method_enable(PKCS11_OBJECT_private *key, int type);

/* Free the global X25519/X448 EVP_PKEY_METHOD */
extern void pkcs11_xdh_key_method_free(void);
#endif /* !defined(OPENSSL_NO_ECX) && OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_VERSION_NUMBER < 0x40000000L */
/* Remove and free all registered ECX EVP_PKEY_METHOD wrappers */
extern void pkcs11_ecx_methods_free(void);
#endif /* LIBP11_HAVE_ECX_METHODS */

#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_VERSION_NUMBER < 0x40000000L
/* Free the global RSA EVP_PKEY_METHOD */
extern void pkcs11_rsa_key_method_free(void);
# endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_VERSION_NUMBER < 0x40000000L */
#if OPENSSL_VERSION_NUMBER < 0x40000000L
/* Enable the RSA EVP_PKEY_METHOD wrapper for a PKCS#11 private key. */
extern int pkcs11_rsa_method_enable(PKCS11_OBJECT_private *key);

/* Remove and free the registered RSA EVP_PKEY_METHOD wrapper. */
extern void pkcs11_rsa_pkey_method_free(void);
#endif /* OPENSSL_VERSION_NUMBER < 0x40000000L */

#if OPENSSL_VERSION_NUMBER < 0x100020d0L || defined(LIBRESSL_VERSION_NUMBER)
/* Get sign_init and sign callbacks from EVP_PKEY_METHOD */
Expand All @@ -640,11 +637,6 @@ extern void EVP_PKEY_meth_get_sign(EVP_PKEY_METHOD *pmeth,
const unsigned char *tbs, size_t tbslen));
#endif /* OPENSSL_VERSION_NUMBER < 0x100020d0L || defined(LIBRESSL_VERSION_NUMBER) */

#if OPENSSL_VERSION_NUMBER < 0x40000000L
/* Attempt to sign using the PKCS#11-backed RSA implementation */
extern EVP_PKEY_METHOD *pkcs11_pkey_method_rsa(void);
#endif /* OPENSSL_VERSION_NUMBER < 0x40000000L */

#endif /* _LIBP11_INT_H */

/* vim: set noexpandtab: */
20 changes: 13 additions & 7 deletions src/p11_ec.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -387,11 +387,10 @@ static EVP_PKEY *pkcs11_get_evp_key_ec(PKCS11_OBJECT_private *key)
ec = pkcs11_get_ec(key);
if (!ec)
return NULL;

pk = EVP_PKEY_new();
if (!pk) {
EC_KEY_free(ec);
return NULL;
}
if (!pk)
goto error;

if (key->object_class == CKO_PRIVATE_KEY) {
#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
Expand All @@ -400,17 +399,24 @@ static EVP_PKEY *pkcs11_get_evp_key_ec(PKCS11_OBJECT_private *key)
ECDSA_set_method(ec, PKCS11_get_ecdsa_method());
ECDH_set_method(ec, PKCS11_get_ecdh_method());
#endif
/* This creates a new EC_KEY object which requires its own key object reference */
/* The EC_KEY object owns the reference stored in its ex_data,
* released by pkcs11_ec_finish() */
key = pkcs11_object_ref(key);
pkcs11_set_ex_data_ec(ec, key);
}
/* TODO: Retrieve the ECDSA private key object attributes instead,
* unless the key has the "sensitive" attribute set */

EVP_PKEY_set1_EC_KEY(pk, ec); /* Also increments the ec ref count */
EC_KEY_free(ec); /* Drops our reference to it */
if (EVP_PKEY_set1_EC_KEY(pk, ec) != 1) /* Also increments the ec ref count */
goto error;

EC_KEY_free(ec); /* Drops our reference to it */
return pk;

error:
EVP_PKEY_free(pk);
EC_KEY_free(ec);
return NULL;
}

/********** ECDSA signing */
Expand Down
Loading
Loading