kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
4cb8494d25
boringssl/crypto/evp/p_rsa.c

679 lines
19 KiB
C
Raw Normal View History

Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
* project 2006.
*/
/* ====================================================================
* Copyright (c) 2006 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* licensing@OpenSSL.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com). */
#include <openssl/evp.h>
Route EVP_PKEY_CTRL_GET_RSA_OAEP_LABEL through a CBS. This is the only EVP_PKEY ctrl hook which returns something other than a boolean. Change-Id: Ic226aef168abdf72e5d30e8264a559ed5039a055 Reviewed-on: https://boringssl-review.googlesource.com/3873 Reviewed-by: Adam Langley <agl@google.com>
2015-03-10 20:56:35 +00:00
#include <limits.h>
Remove string.h from base.h. Including string.h in base.h causes any file that includes a BoringSSL header to include string.h. Generally this wouldn't be a problem, although string.h might slow down the compile if it wasn't otherwise needed. However, it also causes problems for ipsec-tools in Android because OpenSSL didn't have this behaviour. This change removes string.h from base.h and, instead, adds it to each .c file that requires it. Change-Id: I5968e50b0e230fd3adf9b72dd2836e6f52d6fb37 Reviewed-on: https://boringssl-review.googlesource.com/3200 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2015-01-31 01:08:37 +00:00
#include <string.h>
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
#include <openssl/bn.h>
#include <openssl/buf.h>
Route EVP_PKEY_CTRL_GET_RSA_OAEP_LABEL through a CBS. This is the only EVP_PKEY ctrl hook which returns something other than a boolean. Change-Id: Ic226aef168abdf72e5d30e8264a559ed5039a055 Reviewed-on: https://boringssl-review.googlesource.com/3873 Reviewed-by: Adam Langley <agl@google.com>
2015-03-10 20:56:35 +00:00
#include <openssl/bytestring.h>
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
#include <openssl/digest.h>
#include <openssl/err.h>
#include <openssl/mem.h>
Remove some easy obj.h dependencies. A lot of consumers of obj.h only want the NID values. Others didn't need it at all. This also removes some OBJ_nid2sn and OBJ_nid2ln calls in EVP error paths which isn't worth pulling a large table in for. BUG=chromium:499653 Change-Id: Id6dff578f993012e35b740a13b8e4f9c2edc0744 Reviewed-on: https://boringssl-review.googlesource.com/7563 Reviewed-by: David Benjamin <davidben@google.com>
2016-03-25 22:07:11 +00:00
#include <openssl/nid.h>
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
#include <openssl/rsa.h>
#include "../rsa/internal.h"
#include "internal.h"
typedef struct {
/* Key gen parameters */
int nbits;
BIGNUM *pub_exp;
/* RSA padding mode */
int pad_mode;
/* message digest */
const EVP_MD *md;
/* message digest for MGF1 */
const EVP_MD *mgf1md;
/* PSS salt length */
int saltlen;
/* tbuf is a buffer which is either NULL, or is the size of the RSA modulus.
* It's used to store the output of RSA operations. */
uint8_t *tbuf;
/* OAEP label */
uint8_t *oaep_label;
size_t oaep_labellen;
} RSA_PKEY_CTX;
static int pkey_rsa_init(EVP_PKEY_CTX *ctx) {
RSA_PKEY_CTX *rctx;
rctx = OPENSSL_malloc(sizeof(RSA_PKEY_CTX));
if (!rctx) {
return 0;
}
memset(rctx, 0, sizeof(RSA_PKEY_CTX));
rctx->nbits = 2048;
rctx->pad_mode = RSA_PKCS1_PADDING;
rctx->saltlen = -2;
ctx->data = rctx;
return 1;
}
static int pkey_rsa_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src) {
RSA_PKEY_CTX *dctx, *sctx;
if (!pkey_rsa_init(dst)) {
return 0;
}
sctx = src->data;
dctx = dst->data;
dctx->nbits = sctx->nbits;
if (sctx->pub_exp) {
dctx->pub_exp = BN_dup(sctx->pub_exp);
if (!dctx->pub_exp) {
return 0;
}
}
dctx->pad_mode = sctx->pad_mode;
dctx->md = sctx->md;
dctx->mgf1md = sctx->mgf1md;
if (sctx->oaep_label) {
Remove unnecessary NULL checks, part 3. Finish up the e's. Change-Id: Iabb8da000fbca6efee541edb469b90896f60d54b Reviewed-on: https://boringssl-review.googlesource.com/4516 Reviewed-by: Adam Langley <agl@google.com>
2015-04-22 20:49:27 +01:00
OPENSSL_free(dctx->oaep_label);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
dctx->oaep_label = BUF_memdup(sctx->oaep_label, sctx->oaep_labellen);
if (!dctx->oaep_label) {
return 0;
}
dctx->oaep_labellen = sctx->oaep_labellen;
}
return 1;
}
static void pkey_rsa_cleanup(EVP_PKEY_CTX *ctx) {
RSA_PKEY_CTX *rctx = ctx->data;
if (rctx == NULL) {
return;
}
Remove unnecessary NULL checks, part 3. Finish up the e's. Change-Id: Iabb8da000fbca6efee541edb469b90896f60d54b Reviewed-on: https://boringssl-review.googlesource.com/4516 Reviewed-by: Adam Langley <agl@google.com>
2015-04-22 20:49:27 +01:00
BN_free(rctx->pub_exp);
OPENSSL_free(rctx->tbuf);
OPENSSL_free(rctx->oaep_label);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
OPENSSL_free(rctx);
}
static int setup_tbuf(RSA_PKEY_CTX *ctx, EVP_PKEY_CTX *pk) {
if (ctx->tbuf) {
return 1;
}
ctx->tbuf = OPENSSL_malloc(EVP_PKEY_size(pk->pkey));
if (!ctx->tbuf) {
return 0;
}
return 1;
}
static int pkey_rsa_sign(EVP_PKEY_CTX *ctx, uint8_t *sig, size_t *siglen,
const uint8_t *tbs, size_t tbslen) {
RSA_PKEY_CTX *rctx = ctx->data;
RSA *rsa = ctx->pkey->pkey.rsa;
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
const size_t key_len = EVP_PKEY_size(ctx->pkey);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Fix EVP_PKEY_FLAG_AUTOARGLEN behavior. Converting check_autoarg from a macro to a function lost the behavior. Instead, just move the logic into p_rsa.c which was the only EVP_PKEY implementation that even needed the flag. Also document this behavior on each of the functions. Make note of the out = NULL case only returning the maximum output size, and not necessarily the actual size. For testing, update example_sign to determine the signature size using the NULL behavior rather than querying the RSA key. Change-Id: Iec6c2862028a5cfdefe8faa0e8c471755070898a Reviewed-on: https://boringssl-review.googlesource.com/1121 Reviewed-by: Adam Langley <agl@google.com>
2014-07-09 16:47:42 +01:00
if (!sig) {
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
*siglen = key_len;
Fix EVP_PKEY_FLAG_AUTOARGLEN behavior. Converting check_autoarg from a macro to a function lost the behavior. Instead, just move the logic into p_rsa.c which was the only EVP_PKEY implementation that even needed the flag. Also document this behavior on each of the functions. Make note of the out = NULL case only returning the maximum output size, and not necessarily the actual size. For testing, update example_sign to determine the signature size using the NULL behavior rather than querying the RSA key. Change-Id: Iec6c2862028a5cfdefe8faa0e8c471755070898a Reviewed-on: https://boringssl-review.googlesource.com/1121 Reviewed-by: Adam Langley <agl@google.com>
2014-07-09 16:47:42 +01:00
return 1;
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
}
if (*siglen < key_len) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(EVP, EVP_R_BUFFER_TOO_SMALL);
Fix EVP_PKEY_FLAG_AUTOARGLEN behavior. Converting check_autoarg from a macro to a function lost the behavior. Instead, just move the logic into p_rsa.c which was the only EVP_PKEY implementation that even needed the flag. Also document this behavior on each of the functions. Make note of the out = NULL case only returning the maximum output size, and not necessarily the actual size. For testing, update example_sign to determine the signature size using the NULL behavior rather than querying the RSA key. Change-Id: Iec6c2862028a5cfdefe8faa0e8c471755070898a Reviewed-on: https://boringssl-review.googlesource.com/1121 Reviewed-by: Adam Langley <agl@google.com>
2014-07-09 16:47:42 +01:00
return 0;
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
if (rctx->md) {
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
unsigned int out_len;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
if (tbslen != EVP_MD_size(rctx->md)) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_DIGEST_LENGTH);
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
return 0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
if (EVP_MD_type(rctx->md) == NID_mdc2) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(EVP, EVP_R_NO_MDC2_SUPPORT);
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
return 0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
switch (rctx->pad_mode) {
case RSA_PKCS1_PADDING:
if (!RSA_sign(EVP_MD_type(rctx->md), tbs, tbslen, sig, &out_len, rsa)) {
return 0;
}
*siglen = out_len;
return 1;
case RSA_PKCS1_PSS_PADDING:
if (!setup_tbuf(rctx, ctx) ||
!RSA_padding_add_PKCS1_PSS_mgf1(rsa, rctx->tbuf, tbs, rctx->md,
rctx->mgf1md, rctx->saltlen) ||
RSA_encrypt and RSA_sign_raw aren't the same. Change-Id: Ie09ab12baf59b8c1d628396424ce6cadf43bf0e1 Reviewed-on: https://boringssl-review.googlesource.com/1913 Reviewed-by: Adam Langley <agl@google.com>
2014-10-09 21:47:56 +01:00
!RSA_sign_raw(rsa, siglen, sig, *siglen, rctx->tbuf, key_len,
RSA_NO_PADDING)) {
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
return 0;
}
return 1;
default:
return 0;
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
return RSA_sign_raw(rsa, siglen, sig, *siglen, tbs, tbslen, rctx->pad_mode);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
static int pkey_rsa_verify(EVP_PKEY_CTX *ctx, const uint8_t *sig,
size_t siglen, const uint8_t *tbs,
size_t tbslen) {
RSA_PKEY_CTX *rctx = ctx->data;
RSA *rsa = ctx->pkey->pkey.rsa;
size_t rslen;
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
const size_t key_len = EVP_PKEY_size(ctx->pkey);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
if (rctx->md) {
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
switch (rctx->pad_mode) {
case RSA_PKCS1_PADDING:
return RSA_verify(EVP_MD_type(rctx->md), tbs, tbslen, sig, siglen, rsa);
case RSA_PKCS1_PSS_PADDING:
Check input length to pkey_rsa_verify and add initial tests. This is imported from upstream's 71bbc79b7d3b1195a7a7dd5f547d52ddce32d6f0 and test vectors taken initially from 2d7bbd6c9fb6865e0df480602c3612652189e182 (with a handful more added). The tests are a little odd because OpenSSL supports this "salt length recovery" mode and they go through that codepath for all verifications. Change-Id: I220104fe87e2a1a1458c99656f9791d8abfbbb98 Reviewed-on: https://boringssl-review.googlesource.com/12822 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-14 17:34:08 +00:00
if (tbslen != EVP_MD_size(rctx->md)) {
OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_DIGEST_LENGTH);
return 0;
}
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
if (!setup_tbuf(rctx, ctx) ||
!RSA_verify_raw(rsa, &rslen, rctx->tbuf, key_len, sig, siglen,
RSA_NO_PADDING) ||
!RSA_verify_PKCS1_PSS_mgf1(rsa, tbs, rctx->md, rctx->mgf1md,
rctx->tbuf, rctx->saltlen)) {
return 0;
}
return 1;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
default:
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 0;
}
}
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
if (!setup_tbuf(rctx, ctx) ||
!RSA_verify_raw(rsa, &rslen, rctx->tbuf, key_len, sig, siglen,
rctx->pad_mode) ||
rslen != tbslen ||
CRYPTO_memcmp(tbs, rctx->tbuf, rslen) != 0) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 0;
}
return 1;
}
Tweaks for node.js node.js is, effectively, another bindings library. However, it's better written than most and, with these changes, only a couple of tiny fixes are needed in node.js. Some of these changes are a little depressing however so we'll need to push node.js to use APIs where possible. Changes: ∙ Support verify_recover. This is very obscure and the motivation appears to be https://github.com/nodejs/node/issues/477 – where it's not clear that anyone understands what it means :( ∙ Add a few, no-op #defines ∙ Add some members to |SSL_CTX| and |SSL| – node.js needs to not reach into these structs in the future. ∙ Add EC_get_builtin_curves. ∙ Add EVP_[CIPHER|MD]_do_all_sorted – these functions are limited to decrepit. Change-Id: I9a3566054260d6c4db9d430beb7c46cc970a9d46 Reviewed-on: https://boringssl-review.googlesource.com/6952 Reviewed-by: Adam Langley <agl@google.com>
2016-01-24 23:58:39 +00:00
static int pkey_rsa_verify_recover(EVP_PKEY_CTX *ctx, uint8_t *out,
size_t *out_len, const uint8_t *sig,
size_t sig_len) {
RSA_PKEY_CTX *rctx = ctx->data;
RSA *rsa = ctx->pkey->pkey.rsa;
const size_t key_len = EVP_PKEY_size(ctx->pkey);
if (out == NULL) {
*out_len = key_len;
return 1;
}
if (*out_len < key_len) {
OPENSSL_PUT_ERROR(EVP, EVP_R_BUFFER_TOO_SMALL);
return 0;
}
if (!setup_tbuf(rctx, ctx)) {
return 0;
}
if (rctx->md == NULL) {
Fix error in ce9d85ee. I used a size_t out of habit, but |RSA_public_decrypt| is an old-style function. Change-Id: Ibd94d03743fe0099d61578ec15c19fa5333127db
2016-01-26 23:31:23 +00:00
const int ret = RSA_public_decrypt(sig_len, sig, rctx->tbuf,
ctx->pkey->pkey.rsa, rctx->pad_mode);
Tweaks for node.js node.js is, effectively, another bindings library. However, it's better written than most and, with these changes, only a couple of tiny fixes are needed in node.js. Some of these changes are a little depressing however so we'll need to push node.js to use APIs where possible. Changes: ∙ Support verify_recover. This is very obscure and the motivation appears to be https://github.com/nodejs/node/issues/477 – where it's not clear that anyone understands what it means :( ∙ Add a few, no-op #defines ∙ Add some members to |SSL_CTX| and |SSL| – node.js needs to not reach into these structs in the future. ∙ Add EC_get_builtin_curves. ∙ Add EVP_[CIPHER|MD]_do_all_sorted – these functions are limited to decrepit. Change-Id: I9a3566054260d6c4db9d430beb7c46cc970a9d46 Reviewed-on: https://boringssl-review.googlesource.com/6952 Reviewed-by: Adam Langley <agl@google.com>
2016-01-24 23:58:39 +00:00
if (ret < 0) {
return 0;
}
*out_len = ret;
memcpy(out, rctx->tbuf, *out_len);
return 1;
}
if (rctx->pad_mode != RSA_PKCS1_PADDING) {
return 0;
}
uint8_t *asn1_prefix;
size_t asn1_prefix_len;
int asn1_prefix_allocated;
if (!RSA_add_pkcs1_prefix(&asn1_prefix, &asn1_prefix_len,
&asn1_prefix_allocated, EVP_MD_type(rctx->md), NULL,
0)) {
return 0;
}
size_t rslen;
int ok = 1;
if (!RSA_verify_raw(rsa, &rslen, rctx->tbuf, key_len, sig, sig_len,
RSA_PKCS1_PADDING) ||
rslen < asn1_prefix_len ||
CRYPTO_memcmp(rctx->tbuf, asn1_prefix, asn1_prefix_len) != 0) {
ok = 0;
}
if (asn1_prefix_allocated) {
OPENSSL_free(asn1_prefix);
}
if (!ok) {
return 0;
}
const size_t result_len = rslen - asn1_prefix_len;
if (result_len != EVP_MD_size(rctx->md)) {
return 0;
}
if (out != NULL) {
memcpy(out, rctx->tbuf + asn1_prefix_len, result_len);
}
*out_len = result_len;
return 1;
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
static int pkey_rsa_encrypt(EVP_PKEY_CTX *ctx, uint8_t *out, size_t *outlen,
const uint8_t *in, size_t inlen) {
RSA_PKEY_CTX *rctx = ctx->data;
Fix EVP_PKEY_FLAG_AUTOARGLEN behavior. Converting check_autoarg from a macro to a function lost the behavior. Instead, just move the logic into p_rsa.c which was the only EVP_PKEY implementation that even needed the flag. Also document this behavior on each of the functions. Make note of the out = NULL case only returning the maximum output size, and not necessarily the actual size. For testing, update example_sign to determine the signature size using the NULL behavior rather than querying the RSA key. Change-Id: Iec6c2862028a5cfdefe8faa0e8c471755070898a Reviewed-on: https://boringssl-review.googlesource.com/1121 Reviewed-by: Adam Langley <agl@google.com>
2014-07-09 16:47:42 +01:00
RSA *rsa = ctx->pkey->pkey.rsa;
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
const size_t key_len = EVP_PKEY_size(ctx->pkey);
Fix EVP_PKEY_FLAG_AUTOARGLEN behavior. Converting check_autoarg from a macro to a function lost the behavior. Instead, just move the logic into p_rsa.c which was the only EVP_PKEY implementation that even needed the flag. Also document this behavior on each of the functions. Make note of the out = NULL case only returning the maximum output size, and not necessarily the actual size. For testing, update example_sign to determine the signature size using the NULL behavior rather than querying the RSA key. Change-Id: Iec6c2862028a5cfdefe8faa0e8c471755070898a Reviewed-on: https://boringssl-review.googlesource.com/1121 Reviewed-by: Adam Langley <agl@google.com>
2014-07-09 16:47:42 +01:00
if (!out) {
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
*outlen = key_len;
Fix EVP_PKEY_FLAG_AUTOARGLEN behavior. Converting check_autoarg from a macro to a function lost the behavior. Instead, just move the logic into p_rsa.c which was the only EVP_PKEY implementation that even needed the flag. Also document this behavior on each of the functions. Make note of the out = NULL case only returning the maximum output size, and not necessarily the actual size. For testing, update example_sign to determine the signature size using the NULL behavior rather than querying the RSA key. Change-Id: Iec6c2862028a5cfdefe8faa0e8c471755070898a Reviewed-on: https://boringssl-review.googlesource.com/1121 Reviewed-by: Adam Langley <agl@google.com>
2014-07-09 16:47:42 +01:00
return 1;
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
}
if (*outlen < key_len) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(EVP, EVP_R_BUFFER_TOO_SMALL);
Fix EVP_PKEY_FLAG_AUTOARGLEN behavior. Converting check_autoarg from a macro to a function lost the behavior. Instead, just move the logic into p_rsa.c which was the only EVP_PKEY implementation that even needed the flag. Also document this behavior on each of the functions. Make note of the out = NULL case only returning the maximum output size, and not necessarily the actual size. For testing, update example_sign to determine the signature size using the NULL behavior rather than querying the RSA key. Change-Id: Iec6c2862028a5cfdefe8faa0e8c471755070898a Reviewed-on: https://boringssl-review.googlesource.com/1121 Reviewed-by: Adam Langley <agl@google.com>
2014-07-09 16:47:42 +01:00
return 0;
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
if (rctx->pad_mode == RSA_PKCS1_OAEP_PADDING) {
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
if (!setup_tbuf(rctx, ctx) ||
!RSA_padding_add_PKCS1_OAEP_mgf1(rctx->tbuf, key_len, in, inlen,
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
rctx->oaep_label, rctx->oaep_labellen,
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
rctx->md, rctx->mgf1md) ||
!RSA_encrypt(rsa, outlen, out, *outlen, rctx->tbuf, key_len,
RSA_NO_PADDING)) {
return 0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
return 1;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
return RSA_encrypt(rsa, outlen, out, *outlen, in, inlen, rctx->pad_mode);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
static int pkey_rsa_decrypt(EVP_PKEY_CTX *ctx, uint8_t *out,
size_t *outlen, const uint8_t *in,
size_t inlen) {
RSA_PKEY_CTX *rctx = ctx->data;
Fix EVP_PKEY_FLAG_AUTOARGLEN behavior. Converting check_autoarg from a macro to a function lost the behavior. Instead, just move the logic into p_rsa.c which was the only EVP_PKEY implementation that even needed the flag. Also document this behavior on each of the functions. Make note of the out = NULL case only returning the maximum output size, and not necessarily the actual size. For testing, update example_sign to determine the signature size using the NULL behavior rather than querying the RSA key. Change-Id: Iec6c2862028a5cfdefe8faa0e8c471755070898a Reviewed-on: https://boringssl-review.googlesource.com/1121 Reviewed-by: Adam Langley <agl@google.com>
2014-07-09 16:47:42 +01:00
RSA *rsa = ctx->pkey->pkey.rsa;
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
const size_t key_len = EVP_PKEY_size(ctx->pkey);
Fix EVP_PKEY_FLAG_AUTOARGLEN behavior. Converting check_autoarg from a macro to a function lost the behavior. Instead, just move the logic into p_rsa.c which was the only EVP_PKEY implementation that even needed the flag. Also document this behavior on each of the functions. Make note of the out = NULL case only returning the maximum output size, and not necessarily the actual size. For testing, update example_sign to determine the signature size using the NULL behavior rather than querying the RSA key. Change-Id: Iec6c2862028a5cfdefe8faa0e8c471755070898a Reviewed-on: https://boringssl-review.googlesource.com/1121 Reviewed-by: Adam Langley <agl@google.com>
2014-07-09 16:47:42 +01:00
if (!out) {
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
*outlen = key_len;
Fix EVP_PKEY_FLAG_AUTOARGLEN behavior. Converting check_autoarg from a macro to a function lost the behavior. Instead, just move the logic into p_rsa.c which was the only EVP_PKEY implementation that even needed the flag. Also document this behavior on each of the functions. Make note of the out = NULL case only returning the maximum output size, and not necessarily the actual size. For testing, update example_sign to determine the signature size using the NULL behavior rather than querying the RSA key. Change-Id: Iec6c2862028a5cfdefe8faa0e8c471755070898a Reviewed-on: https://boringssl-review.googlesource.com/1121 Reviewed-by: Adam Langley <agl@google.com>
2014-07-09 16:47:42 +01:00
return 1;
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
}
if (*outlen < key_len) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(EVP, EVP_R_BUFFER_TOO_SMALL);
Fix EVP_PKEY_FLAG_AUTOARGLEN behavior. Converting check_autoarg from a macro to a function lost the behavior. Instead, just move the logic into p_rsa.c which was the only EVP_PKEY implementation that even needed the flag. Also document this behavior on each of the functions. Make note of the out = NULL case only returning the maximum output size, and not necessarily the actual size. For testing, update example_sign to determine the signature size using the NULL behavior rather than querying the RSA key. Change-Id: Iec6c2862028a5cfdefe8faa0e8c471755070898a Reviewed-on: https://boringssl-review.googlesource.com/1121 Reviewed-by: Adam Langley <agl@google.com>
2014-07-09 16:47:42 +01:00
return 0;
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
if (rctx->pad_mode == RSA_PKCS1_OAEP_PADDING) {
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
size_t plaintext_len;
int message_len;
if (!setup_tbuf(rctx, ctx) ||
!RSA_decrypt(rsa, &plaintext_len, rctx->tbuf, key_len, in, inlen,
RSA_NO_PADDING)) {
return 0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
message_len = RSA_padding_check_PKCS1_OAEP_mgf1(
out, key_len, rctx->tbuf, plaintext_len, rctx->oaep_label,
rctx->oaep_labellen, rctx->md, rctx->mgf1md);
if (message_len < 0) {
return 0;
}
*outlen = message_len;
return 1;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
return RSA_decrypt(rsa, outlen, out, key_len, in, inlen, rctx->pad_mode);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
static int check_padding_md(const EVP_MD *md, int padding) {
if (!md) {
return 1;
}
if (padding == RSA_NO_PADDING) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_PADDING_MODE);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 0;
}
return 1;
}
static int is_known_padding(int padding_mode) {
switch (padding_mode) {
case RSA_PKCS1_PADDING:
case RSA_NO_PADDING:
case RSA_PKCS1_OAEP_PADDING:
case RSA_PKCS1_PSS_PADDING:
return 1;
default:
return 0;
}
}
static int pkey_rsa_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) {
RSA_PKEY_CTX *rctx = ctx->data;
switch (type) {
case EVP_PKEY_CTRL_RSA_PADDING:
if (!is_known_padding(p1) || !check_padding_md(rctx->md, p1) ||
(p1 == RSA_PKCS1_PSS_PADDING &&
0 == (ctx->operation & (EVP_PKEY_OP_SIGN | EVP_PKEY_OP_VERIFY))) ||
(p1 == RSA_PKCS1_OAEP_PADDING &&
0 == (ctx->operation & EVP_PKEY_OP_TYPE_CRYPT))) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(EVP, EVP_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE);
Normalize all EVP_PKEY_CTX_ctrl return values. No code within BoringSSL or Google (grep for EVP_PKEY_CTX_(ctrl|get|set)) is sensitive to the various failure cases. Normalize it all to 0/1 for simplicity. This does carry a slight risk: any new ctrl hooks we import from upstream that, like EVP_PKEY_CTX_get_rsa_oaep_md, return something other than success/failure cannot be called directly via EVP_PKEY_CTX_ctrl. They instead need to internally be routed through a struct like CBS and only called through the wrappers. To that end, unexport EVP_PKEY_CTX_ctrl and require that callers use the wrappers. No code in Google uses it directly and, if need be, switching to the wrapper would be an incredibly upstreamable patch. Change-Id: I3fd4e5a1a0f3d4d1c4122c52d4c74a5105b99cd5 Reviewed-on: https://boringssl-review.googlesource.com/3874 Reviewed-by: Adam Langley <agl@google.com>
2015-03-10 21:10:22 +00:00
return 0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
if ((p1 == RSA_PKCS1_PSS_PADDING || p1 == RSA_PKCS1_OAEP_PADDING) &&
rctx->md == NULL) {
rctx->md = EVP_sha1();
}
rctx->pad_mode = p1;
return 1;
case EVP_PKEY_CTRL_GET_RSA_PADDING:
*(int *)p2 = rctx->pad_mode;
return 1;
case EVP_PKEY_CTRL_RSA_PSS_SALTLEN:
case EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN:
if (rctx->pad_mode != RSA_PKCS1_PSS_PADDING) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_PSS_SALTLEN);
Normalize all EVP_PKEY_CTX_ctrl return values. No code within BoringSSL or Google (grep for EVP_PKEY_CTX_(ctrl|get|set)) is sensitive to the various failure cases. Normalize it all to 0/1 for simplicity. This does carry a slight risk: any new ctrl hooks we import from upstream that, like EVP_PKEY_CTX_get_rsa_oaep_md, return something other than success/failure cannot be called directly via EVP_PKEY_CTX_ctrl. They instead need to internally be routed through a struct like CBS and only called through the wrappers. To that end, unexport EVP_PKEY_CTX_ctrl and require that callers use the wrappers. No code in Google uses it directly and, if need be, switching to the wrapper would be an incredibly upstreamable patch. Change-Id: I3fd4e5a1a0f3d4d1c4122c52d4c74a5105b99cd5 Reviewed-on: https://boringssl-review.googlesource.com/3874 Reviewed-by: Adam Langley <agl@google.com>
2015-03-10 21:10:22 +00:00
return 0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
if (type == EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN) {
*(int *)p2 = rctx->saltlen;
} else {
if (p1 < -2) {
Normalize all EVP_PKEY_CTX_ctrl return values. No code within BoringSSL or Google (grep for EVP_PKEY_CTX_(ctrl|get|set)) is sensitive to the various failure cases. Normalize it all to 0/1 for simplicity. This does carry a slight risk: any new ctrl hooks we import from upstream that, like EVP_PKEY_CTX_get_rsa_oaep_md, return something other than success/failure cannot be called directly via EVP_PKEY_CTX_ctrl. They instead need to internally be routed through a struct like CBS and only called through the wrappers. To that end, unexport EVP_PKEY_CTX_ctrl and require that callers use the wrappers. No code in Google uses it directly and, if need be, switching to the wrapper would be an incredibly upstreamable patch. Change-Id: I3fd4e5a1a0f3d4d1c4122c52d4c74a5105b99cd5 Reviewed-on: https://boringssl-review.googlesource.com/3874 Reviewed-by: Adam Langley <agl@google.com>
2015-03-10 21:10:22 +00:00
return 0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
rctx->saltlen = p1;
}
return 1;
case EVP_PKEY_CTRL_RSA_KEYGEN_BITS:
if (p1 < 256) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_KEYBITS);
Normalize all EVP_PKEY_CTX_ctrl return values. No code within BoringSSL or Google (grep for EVP_PKEY_CTX_(ctrl|get|set)) is sensitive to the various failure cases. Normalize it all to 0/1 for simplicity. This does carry a slight risk: any new ctrl hooks we import from upstream that, like EVP_PKEY_CTX_get_rsa_oaep_md, return something other than success/failure cannot be called directly via EVP_PKEY_CTX_ctrl. They instead need to internally be routed through a struct like CBS and only called through the wrappers. To that end, unexport EVP_PKEY_CTX_ctrl and require that callers use the wrappers. No code in Google uses it directly and, if need be, switching to the wrapper would be an incredibly upstreamable patch. Change-Id: I3fd4e5a1a0f3d4d1c4122c52d4c74a5105b99cd5 Reviewed-on: https://boringssl-review.googlesource.com/3874 Reviewed-by: Adam Langley <agl@google.com>
2015-03-10 21:10:22 +00:00
return 0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
rctx->nbits = p1;
return 1;
case EVP_PKEY_CTRL_RSA_KEYGEN_PUBEXP:
if (!p2) {
Normalize all EVP_PKEY_CTX_ctrl return values. No code within BoringSSL or Google (grep for EVP_PKEY_CTX_(ctrl|get|set)) is sensitive to the various failure cases. Normalize it all to 0/1 for simplicity. This does carry a slight risk: any new ctrl hooks we import from upstream that, like EVP_PKEY_CTX_get_rsa_oaep_md, return something other than success/failure cannot be called directly via EVP_PKEY_CTX_ctrl. They instead need to internally be routed through a struct like CBS and only called through the wrappers. To that end, unexport EVP_PKEY_CTX_ctrl and require that callers use the wrappers. No code in Google uses it directly and, if need be, switching to the wrapper would be an incredibly upstreamable patch. Change-Id: I3fd4e5a1a0f3d4d1c4122c52d4c74a5105b99cd5 Reviewed-on: https://boringssl-review.googlesource.com/3874 Reviewed-by: Adam Langley <agl@google.com>
2015-03-10 21:10:22 +00:00
return 0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
BN_free(rctx->pub_exp);
rctx->pub_exp = p2;
return 1;
case EVP_PKEY_CTRL_RSA_OAEP_MD:
case EVP_PKEY_CTRL_GET_RSA_OAEP_MD:
if (rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_PADDING_MODE);
Normalize all EVP_PKEY_CTX_ctrl return values. No code within BoringSSL or Google (grep for EVP_PKEY_CTX_(ctrl|get|set)) is sensitive to the various failure cases. Normalize it all to 0/1 for simplicity. This does carry a slight risk: any new ctrl hooks we import from upstream that, like EVP_PKEY_CTX_get_rsa_oaep_md, return something other than success/failure cannot be called directly via EVP_PKEY_CTX_ctrl. They instead need to internally be routed through a struct like CBS and only called through the wrappers. To that end, unexport EVP_PKEY_CTX_ctrl and require that callers use the wrappers. No code in Google uses it directly and, if need be, switching to the wrapper would be an incredibly upstreamable patch. Change-Id: I3fd4e5a1a0f3d4d1c4122c52d4c74a5105b99cd5 Reviewed-on: https://boringssl-review.googlesource.com/3874 Reviewed-by: Adam Langley <agl@google.com>
2015-03-10 21:10:22 +00:00
return 0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
if (type == EVP_PKEY_CTRL_GET_RSA_OAEP_MD) {
*(const EVP_MD **)p2 = rctx->md;
} else {
rctx->md = p2;
}
return 1;
case EVP_PKEY_CTRL_MD:
if (!check_padding_md(p2, rctx->pad_mode)) {
return 0;
}
rctx->md = p2;
return 1;
case EVP_PKEY_CTRL_GET_MD:
*(const EVP_MD **)p2 = rctx->md;
return 1;
case EVP_PKEY_CTRL_RSA_MGF1_MD:
case EVP_PKEY_CTRL_GET_RSA_MGF1_MD:
if (rctx->pad_mode != RSA_PKCS1_PSS_PADDING &&
rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_MGF1_MD);
Normalize all EVP_PKEY_CTX_ctrl return values. No code within BoringSSL or Google (grep for EVP_PKEY_CTX_(ctrl|get|set)) is sensitive to the various failure cases. Normalize it all to 0/1 for simplicity. This does carry a slight risk: any new ctrl hooks we import from upstream that, like EVP_PKEY_CTX_get_rsa_oaep_md, return something other than success/failure cannot be called directly via EVP_PKEY_CTX_ctrl. They instead need to internally be routed through a struct like CBS and only called through the wrappers. To that end, unexport EVP_PKEY_CTX_ctrl and require that callers use the wrappers. No code in Google uses it directly and, if need be, switching to the wrapper would be an incredibly upstreamable patch. Change-Id: I3fd4e5a1a0f3d4d1c4122c52d4c74a5105b99cd5 Reviewed-on: https://boringssl-review.googlesource.com/3874 Reviewed-by: Adam Langley <agl@google.com>
2015-03-10 21:10:22 +00:00
return 0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
if (type == EVP_PKEY_CTRL_GET_RSA_MGF1_MD) {
if (rctx->mgf1md) {
*(const EVP_MD **)p2 = rctx->mgf1md;
} else {
*(const EVP_MD **)p2 = rctx->md;
}
} else {
rctx->mgf1md = p2;
}
return 1;
case EVP_PKEY_CTRL_RSA_OAEP_LABEL:
if (rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_PADDING_MODE);
Normalize all EVP_PKEY_CTX_ctrl return values. No code within BoringSSL or Google (grep for EVP_PKEY_CTX_(ctrl|get|set)) is sensitive to the various failure cases. Normalize it all to 0/1 for simplicity. This does carry a slight risk: any new ctrl hooks we import from upstream that, like EVP_PKEY_CTX_get_rsa_oaep_md, return something other than success/failure cannot be called directly via EVP_PKEY_CTX_ctrl. They instead need to internally be routed through a struct like CBS and only called through the wrappers. To that end, unexport EVP_PKEY_CTX_ctrl and require that callers use the wrappers. No code in Google uses it directly and, if need be, switching to the wrapper would be an incredibly upstreamable patch. Change-Id: I3fd4e5a1a0f3d4d1c4122c52d4c74a5105b99cd5 Reviewed-on: https://boringssl-review.googlesource.com/3874 Reviewed-by: Adam Langley <agl@google.com>
2015-03-10 21:10:22 +00:00
return 0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Remove unnecessary NULL checks, part 3. Finish up the e's. Change-Id: Iabb8da000fbca6efee541edb469b90896f60d54b Reviewed-on: https://boringssl-review.googlesource.com/4516 Reviewed-by: Adam Langley <agl@google.com>
2015-04-22 20:49:27 +01:00
OPENSSL_free(rctx->oaep_label);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
if (p2 && p1 > 0) {
rctx->oaep_label = p2;
rctx->oaep_labellen = p1;
} else {
rctx->oaep_label = NULL;
rctx->oaep_labellen = 0;
}
return 1;
case EVP_PKEY_CTRL_GET_RSA_OAEP_LABEL:
if (rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_PADDING_MODE);
Normalize all EVP_PKEY_CTX_ctrl return values. No code within BoringSSL or Google (grep for EVP_PKEY_CTX_(ctrl|get|set)) is sensitive to the various failure cases. Normalize it all to 0/1 for simplicity. This does carry a slight risk: any new ctrl hooks we import from upstream that, like EVP_PKEY_CTX_get_rsa_oaep_md, return something other than success/failure cannot be called directly via EVP_PKEY_CTX_ctrl. They instead need to internally be routed through a struct like CBS and only called through the wrappers. To that end, unexport EVP_PKEY_CTX_ctrl and require that callers use the wrappers. No code in Google uses it directly and, if need be, switching to the wrapper would be an incredibly upstreamable patch. Change-Id: I3fd4e5a1a0f3d4d1c4122c52d4c74a5105b99cd5 Reviewed-on: https://boringssl-review.googlesource.com/3874 Reviewed-by: Adam Langley <agl@google.com>
2015-03-10 21:10:22 +00:00
return 0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Route EVP_PKEY_CTRL_GET_RSA_OAEP_LABEL through a CBS. This is the only EVP_PKEY ctrl hook which returns something other than a boolean. Change-Id: Ic226aef168abdf72e5d30e8264a559ed5039a055 Reviewed-on: https://boringssl-review.googlesource.com/3873 Reviewed-by: Adam Langley <agl@google.com>
2015-03-10 20:56:35 +00:00
CBS_init((CBS *)p2, rctx->oaep_label, rctx->oaep_labellen);
return 1;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
default:
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(EVP, EVP_R_COMMAND_NOT_SUPPORTED);
Normalize all EVP_PKEY_CTX_ctrl return values. No code within BoringSSL or Google (grep for EVP_PKEY_CTX_(ctrl|get|set)) is sensitive to the various failure cases. Normalize it all to 0/1 for simplicity. This does carry a slight risk: any new ctrl hooks we import from upstream that, like EVP_PKEY_CTX_get_rsa_oaep_md, return something other than success/failure cannot be called directly via EVP_PKEY_CTX_ctrl. They instead need to internally be routed through a struct like CBS and only called through the wrappers. To that end, unexport EVP_PKEY_CTX_ctrl and require that callers use the wrappers. No code in Google uses it directly and, if need be, switching to the wrapper would be an incredibly upstreamable patch. Change-Id: I3fd4e5a1a0f3d4d1c4122c52d4c74a5105b99cd5 Reviewed-on: https://boringssl-review.googlesource.com/3874 Reviewed-by: Adam Langley <agl@google.com>
2015-03-10 21:10:22 +00:00
return 0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
}
static int pkey_rsa_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey) {
RSA *rsa = NULL;
RSA_PKEY_CTX *rctx = ctx->data;
if (!rctx->pub_exp) {
rctx->pub_exp = BN_new();
Add in missing curly braces part 3. Everything else. Change-Id: Iac02b144465b4e7b6d69ea22ff2aaf52695ae732
2015-02-11 06:17:41 +00:00
if (!rctx->pub_exp || !BN_set_word(rctx->pub_exp, RSA_F4)) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 0;
Add in missing curly braces part 3. Everything else. Change-Id: Iac02b144465b4e7b6d69ea22ff2aaf52695ae732
2015-02-11 06:17:41 +00:00
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
rsa = RSA_new();
if (!rsa) {
return 0;
}
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
if (!RSA_generate_key_ex(rsa, rctx->nbits, rctx->pub_exp, NULL)) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
RSA_free(rsa);
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
return 0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
EVP_PKEY_assign_RSA(pkey, rsa);
return 1;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
const EVP_PKEY_METHOD rsa_pkey_meth = {
Tweaks for node.js node.js is, effectively, another bindings library. However, it's better written than most and, with these changes, only a couple of tiny fixes are needed in node.js. Some of these changes are a little depressing however so we'll need to push node.js to use APIs where possible. Changes: ∙ Support verify_recover. This is very obscure and the motivation appears to be https://github.com/nodejs/node/issues/477 – where it's not clear that anyone understands what it means :( ∙ Add a few, no-op #defines ∙ Add some members to |SSL_CTX| and |SSL| – node.js needs to not reach into these structs in the future. ∙ Add EC_get_builtin_curves. ∙ Add EVP_[CIPHER|MD]_do_all_sorted – these functions are limited to decrepit. Change-Id: I9a3566054260d6c4db9d430beb7c46cc970a9d46 Reviewed-on: https://boringssl-review.googlesource.com/6952 Reviewed-by: Adam Langley <agl@google.com>
2016-01-24 23:58:39 +00:00
EVP_PKEY_RSA,
pkey_rsa_init,
pkey_rsa_copy,
pkey_rsa_cleanup,
pkey_rsa_keygen,
pkey_rsa_sign,
pkey_rsa_verify,
pkey_rsa_verify_recover,
pkey_rsa_encrypt,
pkey_rsa_decrypt,
0 /* derive */,
pkey_rsa_ctrl,
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
};
int EVP_PKEY_CTX_set_rsa_padding(EVP_PKEY_CTX *ctx, int padding) {
return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, -1, EVP_PKEY_CTRL_RSA_PADDING,
padding, NULL);
}
int EVP_PKEY_CTX_get_rsa_padding(EVP_PKEY_CTX *ctx, int *out_padding) {
return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, -1, EVP_PKEY_CTRL_GET_RSA_PADDING,
0, out_padding);
}
int EVP_PKEY_CTX_set_rsa_pss_saltlen(EVP_PKEY_CTX *ctx, int salt_len) {
return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA,
(EVP_PKEY_OP_SIGN | EVP_PKEY_OP_VERIFY),
EVP_PKEY_CTRL_RSA_PSS_SALTLEN, salt_len, NULL);
}
int EVP_PKEY_CTX_get_rsa_pss_saltlen(EVP_PKEY_CTX *ctx, int *out_salt_len) {
return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA,
(EVP_PKEY_OP_SIGN | EVP_PKEY_OP_VERIFY),
EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN, 0, out_salt_len);
}
int EVP_PKEY_CTX_set_rsa_keygen_bits(EVP_PKEY_CTX *ctx, int bits) {
return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, EVP_PKEY_OP_KEYGEN,
EVP_PKEY_CTRL_RSA_KEYGEN_BITS, bits, NULL);
}
int EVP_PKEY_CTX_set_rsa_keygen_pubexp(EVP_PKEY_CTX *ctx, BIGNUM *e) {
return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, EVP_PKEY_OP_KEYGEN,
EVP_PKEY_CTRL_RSA_KEYGEN_PUBEXP, 0, e);
}
int EVP_PKEY_CTX_set_rsa_oaep_md(EVP_PKEY_CTX *ctx, const EVP_MD *md) {
return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, EVP_PKEY_OP_TYPE_CRYPT,
EVP_PKEY_CTRL_RSA_OAEP_MD, 0, (void *)md);
}
int EVP_PKEY_CTX_get_rsa_oaep_md(EVP_PKEY_CTX *ctx, const EVP_MD **out_md) {
return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, EVP_PKEY_OP_TYPE_CRYPT,
EVP_PKEY_CTRL_GET_RSA_OAEP_MD, 0, (void*) out_md);
}
int EVP_PKEY_CTX_set_rsa_mgf1_md(EVP_PKEY_CTX *ctx, const EVP_MD *md) {
return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA,
EVP_PKEY_OP_TYPE_SIG | EVP_PKEY_OP_TYPE_CRYPT,
EVP_PKEY_CTRL_RSA_MGF1_MD, 0, (void*) md);
}
int EVP_PKEY_CTX_get_rsa_mgf1_md(EVP_PKEY_CTX *ctx, const EVP_MD **out_md) {
return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA,
EVP_PKEY_OP_TYPE_SIG | EVP_PKEY_OP_TYPE_CRYPT,
EVP_PKEY_CTRL_GET_RSA_MGF1_MD, 0, (void*) out_md);
}
Un-const EVP_PKEY_CTX_set0_rsa_oaep_label and fix overflow check. It takes ownership of the buffer, so it's not actually const. The const-ness gets dropped once it transits through EVP_PKEY_CTX_ctrl. Also compare against INT_MAX explicitly for the overflow check. I'm not sure whether the casting version is undefined, but comparing against INT_MAX matches the rest of the codebase when transiting in and out of signed ints. Change-Id: I131165a4b5f0ebe02c6db3e7e3e0d1af5b771710 Reviewed-on: https://boringssl-review.googlesource.com/6850 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-12-25 06:02:37 +00:00
int EVP_PKEY_CTX_set0_rsa_oaep_label(EVP_PKEY_CTX *ctx, uint8_t *label,
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
size_t label_len) {
Un-const EVP_PKEY_CTX_set0_rsa_oaep_label and fix overflow check. It takes ownership of the buffer, so it's not actually const. The const-ness gets dropped once it transits through EVP_PKEY_CTX_ctrl. Also compare against INT_MAX explicitly for the overflow check. I'm not sure whether the casting version is undefined, but comparing against INT_MAX matches the rest of the codebase when transiting in and out of signed ints. Change-Id: I131165a4b5f0ebe02c6db3e7e3e0d1af5b771710 Reviewed-on: https://boringssl-review.googlesource.com/6850 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-12-25 06:02:37 +00:00
if (label_len > INT_MAX) {
Normalize all EVP_PKEY_CTX_ctrl return values. No code within BoringSSL or Google (grep for EVP_PKEY_CTX_(ctrl|get|set)) is sensitive to the various failure cases. Normalize it all to 0/1 for simplicity. This does carry a slight risk: any new ctrl hooks we import from upstream that, like EVP_PKEY_CTX_get_rsa_oaep_md, return something other than success/failure cannot be called directly via EVP_PKEY_CTX_ctrl. They instead need to internally be routed through a struct like CBS and only called through the wrappers. To that end, unexport EVP_PKEY_CTX_ctrl and require that callers use the wrappers. No code in Google uses it directly and, if need be, switching to the wrapper would be an incredibly upstreamable patch. Change-Id: I3fd4e5a1a0f3d4d1c4122c52d4c74a5105b99cd5 Reviewed-on: https://boringssl-review.googlesource.com/3874 Reviewed-by: Adam Langley <agl@google.com>
2015-03-10 21:10:22 +00:00
return 0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, EVP_PKEY_OP_TYPE_CRYPT,
Un-const EVP_PKEY_CTX_set0_rsa_oaep_label and fix overflow check. It takes ownership of the buffer, so it's not actually const. The const-ness gets dropped once it transits through EVP_PKEY_CTX_ctrl. Also compare against INT_MAX explicitly for the overflow check. I'm not sure whether the casting version is undefined, but comparing against INT_MAX matches the rest of the codebase when transiting in and out of signed ints. Change-Id: I131165a4b5f0ebe02c6db3e7e3e0d1af5b771710 Reviewed-on: https://boringssl-review.googlesource.com/6850 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-12-25 06:02:37 +00:00
EVP_PKEY_CTRL_RSA_OAEP_LABEL, (int)label_len,
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
(void *)label);
}
int EVP_PKEY_CTX_get0_rsa_oaep_label(EVP_PKEY_CTX *ctx,
const uint8_t **out_label) {
Route EVP_PKEY_CTRL_GET_RSA_OAEP_LABEL through a CBS. This is the only EVP_PKEY ctrl hook which returns something other than a boolean. Change-Id: Ic226aef168abdf72e5d30e8264a559ed5039a055 Reviewed-on: https://boringssl-review.googlesource.com/3873 Reviewed-by: Adam Langley <agl@google.com>
2015-03-10 20:56:35 +00:00
CBS label;
Take advantage of normalized return values. Now that much of EVP has been normalized to 0/1, a lot of code can just use boolean operators. (As can some code which was already using them...) Change-Id: I6bb17edfd6f67050bf1706d59d8f37df57535faa Reviewed-on: https://boringssl-review.googlesource.com/3875 Reviewed-by: Adam Langley <agl@google.com>
2015-03-10 21:16:26 +00:00
if (!EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, EVP_PKEY_OP_TYPE_CRYPT,
EVP_PKEY_CTRL_GET_RSA_OAEP_LABEL, 0, &label)) {
Route EVP_PKEY_CTRL_GET_RSA_OAEP_LABEL through a CBS. This is the only EVP_PKEY ctrl hook which returns something other than a boolean. Change-Id: Ic226aef168abdf72e5d30e8264a559ed5039a055 Reviewed-on: https://boringssl-review.googlesource.com/3873 Reviewed-by: Adam Langley <agl@google.com>
2015-03-10 20:56:35 +00:00
return -1;
}
if (CBS_len(&label) > INT_MAX) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(EVP, ERR_R_OVERFLOW);
Route EVP_PKEY_CTRL_GET_RSA_OAEP_LABEL through a CBS. This is the only EVP_PKEY ctrl hook which returns something other than a boolean. Change-Id: Ic226aef168abdf72e5d30e8264a559ed5039a055 Reviewed-on: https://boringssl-review.googlesource.com/3873 Reviewed-by: Adam Langley <agl@google.com>
2015-03-10 20:56:35 +00:00
return -1;
}
*out_label = CBS_data(&label);
return (int)CBS_len(&label);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Reference in New Issue Copy Permalink