providers/implementations/encode_decode/decode_der2key.c

   1 /*
   2  * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 /*
  11  * low level APIs are deprecated for public use, but still ok for
  12  * internal use.
  13  */
  14 #include "internal/deprecated.h"
  15
  16 #include <openssl/core_dispatch.h>
  17 #include <openssl/core_names.h>
  18 #include <openssl/core_object.h>
  19 #include <openssl/crypto.h>
  20 #include <openssl/err.h>
  21 #include <openssl/params.h>
  22 #include <openssl/pem.h>         /* PEM_BUFSIZE and public PEM functions */
  23 #include <openssl/pkcs12.h>
  24 #include <openssl/x509.h>
  25 #include <openssl/proverr.h>
  26 #include "internal/cryptlib.h"   /* ossl_assert() */
  27 #include "internal/asn1.h"
  28 #include "crypto/dh.h"
  29 #include "crypto/dsa.h"
  30 #include "crypto/ec.h"
  31 #include "crypto/evp.h"
  32 #include "crypto/ecx.h"
  33 #include "crypto/rsa.h"
  34 #include "crypto/x509.h"
  35 #include "prov/bio.h"
  36 #include "prov/implementations.h"
  37 #include "endecoder_local.h"
  38
  39 #define SET_ERR_MARK() ERR_set_mark()
  40 #define CLEAR_ERR_MARK()                                                \
  41     do {                                                                \
  42         int err = ERR_peek_last_error();                                \
  43                                                                         \
  44         if (ERR_GET_LIB(err) == ERR_LIB_ASN1                            \
  45             && (ERR_GET_REASON(err) == ASN1_R_HEADER_TOO_LONG           \
  46                 || ERR_GET_REASON(err) == ASN1_R_UNSUPPORTED_TYPE       \
  47                 || ERR_GET_REASON(err) == ERR_R_NESTED_ASN1_ERROR))     \
  48             ERR_pop_to_mark();                                          \
  49         else                                                            \
  50             ERR_clear_last_mark();                                      \
  51     } while(0)
  52 #define RESET_ERR_MARK()                                                \
  53     do {                                                                \
  54         CLEAR_ERR_MARK();                                               \
  55         SET_ERR_MARK();                                                 \
  56     } while(0)
  57
  58 static int read_der(PROV_CTX *provctx, OSSL_CORE_BIO *cin,
  59                     unsigned char **data, long *len)
  60 {
  61     BUF_MEM *mem = NULL;
  62     BIO *in = bio_new_from_core_bio(provctx, cin);
  63     int ok = (asn1_d2i_read_bio(in, &mem) >= 0);
  64
  65     if (ok) {
  66         *data = (unsigned char *)mem->data;
  67         *len = (long)mem->length;
  68         OPENSSL_free(mem);
  69     }
  70     BIO_free(in);
  71     return ok;
  72 }
  73
  74 static int der_from_p8(unsigned char **new_der, long *new_der_len,
  75                        unsigned char *input_der, long input_der_len,
  76                        OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg)
  77 {
  78     const unsigned char *derp;
  79     X509_SIG *p8 = NULL;
  80     int ok = 0;
  81
  82     if (!ossl_assert(new_der != NULL && *new_der == NULL)
  83         || !ossl_assert(new_der_len != NULL))
  84         return 0;
  85
  86     derp = input_der;
  87     if ((p8 = d2i_X509_SIG(NULL, &derp, input_der_len)) != NULL) {
  88         char pbuf[PEM_BUFSIZE];
  89         size_t plen = 0;
  90
  91         if (!pw_cb(pbuf, sizeof(pbuf), &plen, NULL, pw_cbarg)) {
  92             ERR_raise(ERR_LIB_PROV, PROV_R_UNABLE_TO_GET_PASSPHRASE);
  93         } else {
  94             const X509_ALGOR *alg = NULL;
  95             const ASN1_OCTET_STRING *oct = NULL;
  96             int len = 0;
  97
  98             X509_SIG_get0(p8, &alg, &oct);
  99             if (PKCS12_pbe_crypt(alg, pbuf, plen, oct->data, oct->length,
 100                                  new_der, &len, 0) != NULL)
 101                 ok = 1;
 102             *new_der_len = len;
 103         }
 104     }
 105     X509_SIG_free(p8);
 106     return ok;
 107 }
 108
 109 /* ---------------------------------------------------------------------- */
 110
 111 static OSSL_FUNC_decoder_freectx_fn der2key_freectx;
 112 static OSSL_FUNC_decoder_decode_fn der2key_decode;
 113 static OSSL_FUNC_decoder_export_object_fn der2key_export_object;
 114
 115 struct der2key_ctx_st;           /* Forward declaration */
 116 typedef void *(extract_key_fn)(EVP_PKEY *);
 117 typedef void (adjust_key_fn)(void *, struct der2key_ctx_st *ctx);
 118 typedef void (free_key_fn)(void *);
 119 struct keytype_desc_st {
 120     const char *keytype_name;
 121     const OSSL_DISPATCH *fns; /* Keymgmt (to pilfer functions from) */
 122
 123     /* The input structure name */
 124     const char *structure_name;
 125
 126     /*
 127      * The EVP_PKEY_xxx type macro.  Should be zero for type specific
 128      * structures, non-zero when the outermost structure is PKCS#8 or
 129      * SubjectPublicKeyInfo.  This determines which of the function
 130      * pointers below will be used.
 131      */
 132     int evp_type;
 133
 134     /* The selection mask for OSSL_FUNC_decoder_does_selection() */
 135     int selection_mask;
 136
 137     /* For type specific decoders, we use the corresponding d2i */
 138     d2i_of_void *d2i_private_key;
 139     d2i_of_void *d2i_public_key;
 140     d2i_of_void *d2i_key_params;
 141
 142     /*
 143      * For PKCS#8 decoders, we use EVP_PKEY extractors, EVP_PKEY_get1_{TYPE}()
 144      */
 145     extract_key_fn *extract_key;
 146     /*
 147      * For any key, we may need to make provider specific adjustments, such
 148      * as ensure the key carries the correct library context.
 149      */
 150     adjust_key_fn *adjust_key;
 151     /* {type}_free() */
 152     free_key_fn *free_key;
 153 };
 154
 155 /*
 156  * Context used for DER to key decoding.
 157  */
 158 struct der2key_ctx_st {
 159     PROV_CTX *provctx;
 160     const struct keytype_desc_st *desc;
 161 };
 162
 163 static struct der2key_ctx_st *
 164 der2key_newctx(void *provctx, const struct keytype_desc_st *desc)
 165 {
 166     struct der2key_ctx_st *ctx = OPENSSL_zalloc(sizeof(*ctx));
 167
 168     if (ctx != NULL) {
 169         ctx->provctx = provctx;
 170         ctx->desc = desc;
 171     }
 172     return ctx;
 173 }
 174
 175 static void der2key_freectx(void *vctx)
 176 {
 177     struct der2key_ctx_st *ctx = vctx;
 178
 179     OPENSSL_free(ctx);
 180 }
 181
 182 static const OSSL_PARAM *
 183 der2key_gettable_params(void *provctx, const struct keytype_desc_st *desc)
 184 {
 185     static const OSSL_PARAM gettables[] = {
 186         { OSSL_DECODER_PARAM_INPUT_TYPE, OSSL_PARAM_UTF8_PTR, NULL, 0, 0 },
 187         OSSL_PARAM_END,
 188     };
 189     static const OSSL_PARAM gettables_w_structure[] = {
 190         { OSSL_DECODER_PARAM_INPUT_TYPE, OSSL_PARAM_UTF8_PTR, NULL, 0, 0 },
 191         { OSSL_DECODER_PARAM_INPUT_STRUCTURE, OSSL_PARAM_UTF8_PTR, NULL, 0, 0 },
 192         OSSL_PARAM_END,
 193     };
 194
 195     return desc->structure_name != NULL ? gettables_w_structure :  gettables;
 196 }
 197
 198 static int der2key_get_params(OSSL_PARAM params[],
 199                               const struct keytype_desc_st *desc)
 200 {
 201     OSSL_PARAM *p;
 202
 203     p = OSSL_PARAM_locate(params, OSSL_DECODER_PARAM_INPUT_TYPE);
 204     if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, "DER"))
 205         return 0;
 206     if (desc->structure_name != NULL) {
 207         p = OSSL_PARAM_locate(params, OSSL_DECODER_PARAM_INPUT_STRUCTURE);
 208         if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, desc->structure_name))
 209             return 0;
 210     }
 211
 212     return 1;
 213 }
 214
 215 static int der2key_check_selection(int selection,
 216                                    const struct keytype_desc_st *desc)
 217 {
 218     /*
 219      * The selections are kinda sorta "levels", i.e. each selection given
 220      * here is assumed to include those following.
 221      */
 222     int checks[] = {
 223         OSSL_KEYMGMT_SELECT_PRIVATE_KEY,
 224         OSSL_KEYMGMT_SELECT_PUBLIC_KEY,
 225         OSSL_KEYMGMT_SELECT_ALL_PARAMETERS
 226     };
 227     size_t i;
 228
 229     /* The decoder implementations made here support guessing */
 230     if (selection == 0)
 231         return 1;
 232
 233     for (i = 0; i < OSSL_NELEM(checks); i++) {
 234         int check1 = (selection & checks[i]) != 0;
 235         int check2 = (desc->selection_mask & checks[i]) != 0;
 236
 237         /*
 238          * If the caller asked for the currently checked bit(s), return
 239          * whether the decoder description says it's supported.
 240          */
 241         if (check1)
 242             return check2;
 243     }
 244
 245     /* This should be dead code, but just to be safe... */
 246     return 0;
 247 }
 248
 249 static int der2key_decode(void *vctx, OSSL_CORE_BIO *cin, int selection,
 250                           OSSL_CALLBACK *data_cb, void *data_cbarg,
 251                           OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg)
 252 {
 253     struct der2key_ctx_st *ctx = vctx;
 254     void *libctx = PROV_LIBCTX_OF(ctx->provctx);
 255     unsigned char *der = NULL;
 256     const unsigned char *derp;
 257     long der_len = 0;
 258     unsigned char *new_der = NULL;
 259     long new_der_len;
 260     EVP_PKEY *pkey = NULL;
 261     void *key = NULL;
 262     int orig_selection = selection;
 263     int ok = 0;
 264
 265     /*
 266      * The caller is allowed to specify 0 as a selection mark, to have the
 267      * structure and key type guessed.  For type-specific structures, this
 268      * is not recommended, as some structures are very similar.
 269      * Note that 0 isn't the same as OSSL_KEYMGMT_SELECT_ALL, as the latter
 270      * signifies a private key structure, where everything else is assumed
 271      * to be present as well.
 272      */
 273     if (selection == 0)
 274         selection = ctx->desc->selection_mask;
 275     if ((selection & ctx->desc->selection_mask) == 0) {
 276         ERR_raise(ERR_LIB_PROV, ERR_R_PASSED_INVALID_ARGUMENT);
 277         return 0;
 278     }
 279
 280     SET_ERR_MARK();
 281     if (!read_der(ctx->provctx, cin, &der, &der_len))
 282         goto end;
 283
 284     if (ctx->desc->extract_key == NULL) {
 285         /*
 286          * There's no EVP_PKEY extractor, so we use the type specific
 287          * functions.
 288          */
 289         derp = der;
 290         if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0) {
 291             key = ctx->desc->d2i_private_key(NULL, &derp, der_len);
 292             if (key == NULL && orig_selection != 0)
 293                 goto end;
 294         }
 295         if (key == NULL
 296             && (selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0) {
 297             key = ctx->desc->d2i_public_key(NULL, &derp, der_len);
 298             if (key == NULL && orig_selection != 0)
 299                 goto end;
 300         }
 301         if (key == NULL
 302             && (selection & OSSL_KEYMGMT_SELECT_ALL_PARAMETERS) != 0) {
 303             key = ctx->desc->d2i_key_params(NULL, &derp, der_len);
 304         }
 305     } else {
 306         /*
 307          * There is a EVP_PKEY extractor, so we use the more generic
 308          * EVP_PKEY functions, since they know how to unpack PKCS#8 and
 309          * SubjectPublicKeyInfo.
 310          */
 311
 312         /*
 313          * Opportunistic attempt to decrypt.  If it doesn't work, we try
 314          * to decode our input unencrypted.
 315          */
 316         if (der_from_p8(&new_der, &new_der_len, der, der_len,
 317                         pw_cb, pw_cbarg)) {
 318             OPENSSL_free(der);
 319             der = new_der;
 320             der_len = new_der_len;
 321         }
 322         RESET_ERR_MARK();
 323
 324         if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0) {
 325             derp = der;
 326             pkey = evp_privatekey_from_binary(ctx->desc->evp_type, NULL,
 327                                               &derp, der_len, libctx, NULL);
 328         }
 329
 330         if (pkey == NULL
 331             && (selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0) {
 332             RESET_ERR_MARK();
 333             derp = der;
 334             pkey = d2i_PUBKEY_legacy(NULL, &derp, der_len);
 335         }
 336
 337         if (pkey != NULL) {
 338             /*
 339              * Tear out the low-level key pointer from the pkey,
 340              * but only if it matches the expected key type.
 341              *
 342              * The check should be done with EVP_PKEY_is_a(), but
 343              * as long as we still have #legacy internal keys, it's safer
 344              * to use the type numbers inside the provider.
 345              */
 346             if (EVP_PKEY_id(pkey) == ctx->desc->evp_type)
 347                 key = ctx->desc->extract_key(pkey);
 348
 349             /*
 350              * ctx->desc->extract_key() is expected to have incremented
 351              * |key|'s reference count, so it should be safe to free |pkey|
 352              * now.
 353              */
 354             EVP_PKEY_free(pkey);
 355         }
 356     }
 357
 358     if (key != NULL && ctx->desc->adjust_key != NULL)
 359         ctx->desc->adjust_key(key, ctx);
 360
 361  end:
 362     /*
 363      * Prune low-level ASN.1 parse errors from error queue, assuming
 364      * that this is called by decoder_process() in a loop trying several
 365      * formats.
 366      */
 367     CLEAR_ERR_MARK();
 368
 369     OPENSSL_free(der);
 370
 371     if (key != NULL) {
 372         OSSL_PARAM params[4];
 373         int object_type = OSSL_OBJECT_PKEY;
 374
 375         params[0] =
 376             OSSL_PARAM_construct_int(OSSL_OBJECT_PARAM_TYPE, &object_type);
 377         params[1] =
 378             OSSL_PARAM_construct_utf8_string(OSSL_OBJECT_PARAM_DATA_TYPE,
 379                                              (char *)ctx->desc->keytype_name,
 380                                              0);
 381         /* The address of the key becomes the octet string */
 382         params[2] =
 383             OSSL_PARAM_construct_octet_string(OSSL_OBJECT_PARAM_REFERENCE,
 384                                               &key, sizeof(key));
 385         params[3] = OSSL_PARAM_construct_end();
 386
 387         ok = data_cb(params, data_cbarg);
 388     }
 389     ctx->desc->free_key(key);
 390
 391     return ok;
 392 }
 393
 394 static int der2key_export_object(void *vctx,
 395                                  const void *reference, size_t reference_sz,
 396                                  OSSL_CALLBACK *export_cb, void *export_cbarg)
 397 {
 398     struct der2key_ctx_st *ctx = vctx;
 399     OSSL_FUNC_keymgmt_export_fn *export =
 400         ossl_prov_get_keymgmt_export(ctx->desc->fns);
 401     void *keydata;
 402
 403     if (reference_sz == sizeof(keydata) && export != NULL) {
 404         /* The contents of the reference is the address to our object */
 405         keydata = *(void **)reference;
 406
 407         return export(keydata, OSSL_KEYMGMT_SELECT_ALL,
 408                       export_cb, export_cbarg);
 409     }
 410     return 0;
 411 }
 412
 413 /* ---------------------------------------------------------------------- */
 414
 415 #ifndef OPENSSL_NO_DH
 416 # define dh_evp_type                    EVP_PKEY_DH
 417 # define dh_evp_extract                 (extract_key_fn *)EVP_PKEY_get1_DH
 418 # define dh_d2i_private_key             NULL
 419 # define dh_d2i_public_key              NULL
 420 # define dh_d2i_key_params              (d2i_of_void *)d2i_DHparams
 421 # define dh_free                        (free_key_fn *)DH_free
 422
 423 static void dh_adjust(void *key, struct der2key_ctx_st *ctx)
 424 {
 425     ossl_dh_set0_libctx(key, PROV_LIBCTX_OF(ctx->provctx));
 426 }
 427
 428 # define dhx_evp_type                   EVP_PKEY_DHX
 429 # define dhx_evp_extract                (extract_key_fn *)EVP_PKEY_get1_DH
 430 # define dhx_d2i_private_key            NULL
 431 # define dhx_d2i_public_key             NULL
 432 # define dhx_d2i_key_params             (d2i_of_void *)d2i_DHxparams
 433 # define dhx_free                       (free_key_fn *)DH_free
 434 # define dhx_adjust                     dh_adjust
 435 #endif
 436
 437 /* ---------------------------------------------------------------------- */
 438
 439 #ifndef OPENSSL_NO_DSA
 440 # define dsa_evp_type                   EVP_PKEY_DSA
 441 # define dsa_evp_extract                (extract_key_fn *)EVP_PKEY_get1_DSA
 442 # define dsa_d2i_private_key            (d2i_of_void *)d2i_DSAPrivateKey
 443 # define dsa_d2i_public_key             (d2i_of_void *)d2i_DSAPublicKey
 444 # define dsa_d2i_key_params             (d2i_of_void *)d2i_DSAparams
 445 # define dsa_free                       (free_key_fn *)DSA_free
 446
 447 static void dsa_adjust(void *key, struct der2key_ctx_st *ctx)
 448 {
 449     ossl_dsa_set0_libctx(key, PROV_LIBCTX_OF(ctx->provctx));
 450 }
 451 #endif
 452
 453 /* ---------------------------------------------------------------------- */
 454
 455 #ifndef OPENSSL_NO_EC
 456 # define ec_evp_type                    EVP_PKEY_EC
 457 # define ec_evp_extract                 (extract_key_fn *)EVP_PKEY_get1_EC_KEY
 458 # define ec_d2i_private_key             (d2i_of_void *)d2i_ECPrivateKey
 459 # define ec_d2i_public_key              NULL
 460 # define ec_d2i_key_params              (d2i_of_void *)d2i_ECParameters
 461 # define ec_free                        (free_key_fn *)EC_KEY_free
 462
 463 static void ec_adjust(void *key, struct der2key_ctx_st *ctx)
 464 {
 465     ossl_ec_key_set0_libctx(key, PROV_LIBCTX_OF(ctx->provctx));
 466 }
 467
 468 /*
 469  * ED25519, ED448, X25519, X448 only implement PKCS#8 and SubjectPublicKeyInfo,
 470  * so no d2i functions to be had.
 471  */
 472
 473 static void ecx_key_adjust(void *key, struct der2key_ctx_st *ctx)
 474 {
 475     ossl_ecx_key_set0_libctx(key, PROV_LIBCTX_OF(ctx->provctx));
 476 }
 477
 478 # define ed25519_evp_type               EVP_PKEY_ED25519
 479 # define ed25519_evp_extract            (extract_key_fn *)ossl_evp_pkey_get1_ED25519
 480 # define ed25519_d2i_private_key        NULL
 481 # define ed25519_d2i_public_key         NULL
 482 # define ed25519_d2i_key_params         NULL
 483 # define ed25519_free                   (free_key_fn *)ossl_ecx_key_free
 484 # define ed25519_adjust                 ecx_key_adjust
 485
 486 # define ed448_evp_type                 EVP_PKEY_ED448
 487 # define ed448_evp_extract              (extract_key_fn *)ossl_evp_pkey_get1_ED448
 488 # define ed448_d2i_private_key          NULL
 489 # define ed448_d2i_public_key           NULL
 490 # define ed448_d2i_key_params           NULL
 491 # define ed448_free                     (free_key_fn *)ossl_ecx_key_free
 492 # define ed448_adjust                   ecx_key_adjust
 493
 494 # define x25519_evp_type                EVP_PKEY_X25519
 495 # define x25519_evp_extract             (extract_key_fn *)ossl_evp_pkey_get1_X25519
 496 # define x25519_d2i_private_key         NULL
 497 # define x25519_d2i_public_key          NULL
 498 # define x25519_d2i_key_params          NULL
 499 # define x25519_free                    (free_key_fn *)ossl_ecx_key_free
 500 # define x25519_adjust                  ecx_key_adjust
 501
 502 # define x448_evp_type                  EVP_PKEY_X448
 503 # define x448_evp_extract               (extract_key_fn *)ossl_evp_pkey_get1_X448
 504 # define x448_d2i_private_key           NULL
 505 # define x448_d2i_public_key            NULL
 506 # define x448_d2i_key_params            NULL
 507 # define x448_free                      (free_key_fn *)ossl_ecx_key_free
 508 # define x448_adjust                    ecx_key_adjust
 509
 510 # ifndef OPENSSL_NO_SM2
 511 #  define sm2_evp_type                  EVP_PKEY_SM2
 512 #  define sm2_evp_extract               (extract_key_fn *)EVP_PKEY_get1_EC_KEY
 513 #  define sm2_d2i_private_key           (d2i_of_void *)d2i_ECPrivateKey
 514 #  define sm2_d2i_public_key            NULL
 515 #  define sm2_d2i_key_params            (d2i_of_void *)d2i_ECParameters
 516 #  define sm2_free                      (free_key_fn *)EC_KEY_free
 517 #  define sm2_adjust                    ec_adjust
 518 # endif
 519 #endif
 520
 521 /* ---------------------------------------------------------------------- */
 522
 523 #define rsa_evp_type                    EVP_PKEY_RSA
 524 #define rsa_evp_extract                 (extract_key_fn *)EVP_PKEY_get1_RSA
 525 #define rsa_d2i_private_key             (d2i_of_void *)d2i_RSAPrivateKey
 526 #define rsa_d2i_public_key              (d2i_of_void *)d2i_RSAPublicKey
 527 #define rsa_d2i_key_params              NULL
 528 #define rsa_free                        (free_key_fn *)RSA_free
 529
 530 static void rsa_adjust(void *key, struct der2key_ctx_st *ctx)
 531 {
 532     ossl_rsa_set0_libctx(key, PROV_LIBCTX_OF(ctx->provctx));
 533 }
 534
 535 #define rsapss_evp_type                 EVP_PKEY_RSA_PSS
 536 #define rsapss_evp_extract              (extract_key_fn *)EVP_PKEY_get1_RSA
 537 #define rsapss_d2i_private_key          (d2i_of_void *)d2i_RSAPrivateKey
 538 #define rsapss_d2i_public_key           (d2i_of_void *)d2i_RSAPublicKey
 539 #define rsapss_d2i_key_params           NULL
 540 #define rsapss_free                     (free_key_fn *)RSA_free
 541 #define rsapss_adjust                   rsa_adjust
 542
 543 /* ---------------------------------------------------------------------- */
 544
 545 /*
 546  * The DO_ macros help define the selection mask and the method functions
 547  * for each kind of object we want to decode.
 548  */
 549 #define DO_type_specific_keypair(keytype)               \
 550     "type-specific", 0,                                 \
 551         ( OSSL_KEYMGMT_SELECT_KEYPAIR ),                \
 552         keytype##_d2i_private_key,                      \
 553         keytype##_d2i_public_key,                       \
 554         NULL,                                           \
 555         NULL,                                           \
 556         keytype##_adjust,                               \
 557         keytype##_free
 558
 559 #define DO_type_specific_pub(keytype)                   \
 560     "type-specific", 0,                                 \
 561         ( OSSL_KEYMGMT_SELECT_PUBLIC_KEY ),             \
 562         NULL,                                           \
 563         keytype##_d2i_public_key,                       \
 564         NULL,                                           \
 565         NULL,                                           \
 566         keytype##_adjust,                               \
 567         keytype##_free
 568
 569 #define DO_type_specific_priv(keytype)                  \
 570     "type-specific", 0,                                 \
 571         ( OSSL_KEYMGMT_SELECT_PRIVATE_KEY ),            \
 572         keytype##_d2i_private_key,                      \
 573         NULL,                                           \
 574         NULL,                                           \
 575         NULL,                                           \
 576         keytype##_adjust,                               \
 577         keytype##_free
 578
 579 #define DO_type_specific_params(keytype)                \
 580     "type-specific", 0,                                 \
 581         ( OSSL_KEYMGMT_SELECT_ALL_PARAMETERS ),         \
 582         NULL,                                           \
 583         NULL,                                           \
 584         keytype##_d2i_key_params,                       \
 585         NULL,                                           \
 586         keytype##_adjust,                               \
 587         keytype##_free
 588
 589 #define DO_type_specific(keytype)                       \
 590     "type-specific", 0,                                 \
 591         ( OSSL_KEYMGMT_SELECT_ALL ),                    \
 592         keytype##_d2i_private_key,                      \
 593         keytype##_d2i_public_key,                       \
 594         keytype##_d2i_key_params,                       \
 595         NULL,                                           \
 596         keytype##_adjust,                               \
 597         keytype##_free
 598
 599 #define DO_type_specific_no_pub(keytype)                \
 600     "type-specific", 0,                                 \
 601         ( OSSL_KEYMGMT_SELECT_PRIVATE_KEY               \
 602           | OSSL_KEYMGMT_SELECT_ALL_PARAMETERS ),       \
 603         keytype##_d2i_private_key,                      \
 604         NULL,                                           \
 605         keytype##_d2i_key_params,                       \
 606         NULL,                                           \
 607         keytype##_adjust,                               \
 608         keytype##_free
 609
 610 #define DO_PKCS8(keytype)                               \
 611     "pkcs8", keytype##_evp_type,                        \
 612         ( OSSL_KEYMGMT_SELECT_PRIVATE_KEY ),            \
 613         NULL,                                           \
 614         NULL,                                           \
 615         NULL,                                           \
 616         keytype##_evp_extract,                          \
 617         keytype##_adjust,                               \
 618         keytype##_free
 619
 620 #define DO_SubjectPublicKeyInfo(keytype)                \
 621     "SubjectPublicKeyInfo", keytype##_evp_type,         \
 622         ( OSSL_KEYMGMT_SELECT_PUBLIC_KEY ),             \
 623         NULL,                                           \
 624         NULL,                                           \
 625         NULL,                                           \
 626         keytype##_evp_extract,                          \
 627         keytype##_adjust,                               \
 628         keytype##_free
 629
 630 #define DO_DH(keytype)                                  \
 631     "DH", 0,                                            \
 632         ( OSSL_KEYMGMT_SELECT_ALL_PARAMETERS ),         \
 633         NULL,                                           \
 634         NULL,                                           \
 635         keytype##_d2i_key_params,                       \
 636         NULL,                                           \
 637         keytype##_adjust,                               \
 638         keytype##_free
 639
 640 #define DO_DHX(keytype)                                 \
 641     "DHX", 0,                                           \
 642         ( OSSL_KEYMGMT_SELECT_ALL_PARAMETERS ),         \
 643         NULL,                                           \
 644         NULL,                                           \
 645         keytype##_d2i_key_params,                       \
 646         NULL,                                           \
 647         keytype##_adjust,                               \
 648         keytype##_free
 649
 650 #define DO_DSA(keytype)                                 \
 651     "DSA", 0,                                           \
 652         ( OSSL_KEYMGMT_SELECT_ALL ),                    \
 653         keytype##_d2i_private_key,                      \
 654         keytype##_d2i_public_key,                       \
 655         keytype##_d2i_key_params,                       \
 656         NULL,                                           \
 657         keytype##_adjust,                               \
 658         keytype##_free
 659
 660 #define DO_EC(keytype)                                  \
 661     "EC", 0,                                            \
 662         ( OSSL_KEYMGMT_SELECT_PRIVATE_KEY               \
 663           | OSSL_KEYMGMT_SELECT_ALL_PARAMETERS ),       \
 664         keytype##_d2i_private_key,                      \
 665         NULL,                                           \
 666         keytype##_d2i_key_params,                       \
 667         NULL,                                           \
 668         keytype##_adjust,                               \
 669         keytype##_free
 670
 671 #define DO_RSA(keytype)                                 \
 672     "RSA", 0,                                           \
 673         ( OSSL_KEYMGMT_SELECT_KEYPAIR ),                \
 674         keytype##_d2i_private_key,                      \
 675         keytype##_d2i_public_key,                       \
 676         NULL,                                           \
 677         NULL,                                           \
 678         keytype##_adjust,                               \
 679         keytype##_free
 680
 681 /*
 682  * MAKE_DECODER is the single driver for creating OSSL_DISPATCH tables.
 683  * It takes the following arguments:
 684  *
 685  * keytype_name The implementation key type as a string.
 686  * keytype      The implementation key type.  This must correspond exactly
 687  *              to our existing keymgmt keytype names...  in other words,
 688  *              there must exist an ossl_##keytype##_keymgmt_functions.
 689  * type         The type name for the set of functions that implement the
 690  *              decoder for the key type.  This isn't necessarily the same
 691  *              as keytype.  For example, the key types ed25519, ed448,
 692  *              x25519 and x448 are all handled by the same functions with
 693  *              the common type name ecx.
 694  * kind         The kind of support to implement.  This translates into
 695  *              the DO_##kind macros above, to populate the keytype_desc_st
 696  *              structure.
 697  */
 698 #define MAKE_DECODER(keytype_name, keytype, type, kind)                 \
 699     static const struct keytype_desc_st kind##_##keytype##_desc =       \
 700         { keytype_name, ossl_##keytype##_keymgmt_functions,             \
 701           DO_##kind(keytype) };                                         \
 702                                                                         \
 703     static OSSL_FUNC_decoder_newctx_fn kind##_der2##keytype##_newctx;   \
 704     static OSSL_FUNC_decoder_gettable_params_fn                         \
 705     kind##_der2##keytype##_gettable_params;                             \
 706     static OSSL_FUNC_decoder_get_params_fn                              \
 707     kind##_der2##keytype##_get_params;                                  \
 708                                                                         \
 709     static void *kind##_der2##keytype##_newctx(void *provctx)           \
 710     {                                                                   \
 711         return der2key_newctx(provctx, &kind##_##keytype##_desc);       \
 712     }                                                                   \
 713     static const OSSL_PARAM *                                           \
 714     kind##_der2##keytype##_gettable_params(void *provctx)               \
 715     {                                                                   \
 716         return                                                          \
 717             der2key_gettable_params(provctx, &kind##_##keytype##_desc); \
 718     }                                                                   \
 719     static int kind##_der2##keytype##_get_params(OSSL_PARAM params[])   \
 720     {                                                                   \
 721         return der2key_get_params(params, &kind##_##keytype##_desc);    \
 722     }                                                                   \
 723     static int kind##_der2##keytype##_does_selection(void *provctx,     \
 724                                                      int selection)     \
 725     {                                                                   \
 726         return der2key_check_selection(selection,                       \
 727                                        &kind##_##keytype##_desc);       \
 728     }                                                                   \
 729     const OSSL_DISPATCH                                                 \
 730     ossl_##kind##_der_to_##keytype##_decoder_functions[] = {            \
 731         { OSSL_FUNC_DECODER_NEWCTX,                                     \
 732           (void (*)(void))kind##_der2##keytype##_newctx },              \
 733         { OSSL_FUNC_DECODER_FREECTX,                                    \
 734           (void (*)(void))der2key_freectx },                            \
 735         { OSSL_FUNC_DECODER_GETTABLE_PARAMS,                            \
 736           (void (*)(void))kind##_der2##keytype##_gettable_params },     \
 737         { OSSL_FUNC_DECODER_GET_PARAMS,                                 \
 738           (void (*)(void))kind##_der2##keytype##_get_params },          \
 739         { OSSL_FUNC_DECODER_DOES_SELECTION,                             \
 740           (void (*)(void))kind##_der2##keytype##_does_selection },      \
 741         { OSSL_FUNC_DECODER_DECODE,                                     \
 742           (void (*)(void))der2key_decode },                             \
 743         { OSSL_FUNC_DECODER_EXPORT_OBJECT,                              \
 744           (void (*)(void))der2key_export_object },                      \
 745         { 0, NULL }                                                     \
 746     }
 747
 748 #ifndef OPENSSL_NO_DH
 749 MAKE_DECODER("DH", dh, dh, PKCS8);
 750 MAKE_DECODER("DH", dh, dh, SubjectPublicKeyInfo);
 751 MAKE_DECODER("DH", dh, dh, type_specific_params);
 752 MAKE_DECODER("DH", dh, dh, DH);
 753 MAKE_DECODER("DHX", dhx, dhx, PKCS8);
 754 MAKE_DECODER("DHX", dhx, dhx, SubjectPublicKeyInfo);
 755 MAKE_DECODER("DHX", dhx, dhx, type_specific_params);
 756 MAKE_DECODER("DHX", dhx, dhx, DHX);
 757 #endif
 758 #ifndef OPENSSL_NO_DSA
 759 MAKE_DECODER("DSA", dsa, dsa, PKCS8);
 760 MAKE_DECODER("DSA", dsa, dsa, SubjectPublicKeyInfo);
 761 MAKE_DECODER("DSA", dsa, dsa, type_specific);
 762 MAKE_DECODER("DSA", dsa, dsa, DSA);
 763 #endif
 764 #ifndef OPENSSL_NO_EC
 765 MAKE_DECODER("EC", ec, ec, PKCS8);
 766 MAKE_DECODER("EC", ec, ec, SubjectPublicKeyInfo);
 767 MAKE_DECODER("EC", ec, ec, type_specific_no_pub);
 768 MAKE_DECODER("EC", ec, ec, EC);
 769 MAKE_DECODER("X25519", x25519, ecx, PKCS8);
 770 MAKE_DECODER("X25519", x25519, ecx, SubjectPublicKeyInfo);
 771 MAKE_DECODER("X448", x448, ecx, PKCS8);
 772 MAKE_DECODER("X448", x448, ecx, SubjectPublicKeyInfo);
 773 MAKE_DECODER("ED25519", ed25519, ecx, PKCS8);
 774 MAKE_DECODER("ED25519", ed25519, ecx, SubjectPublicKeyInfo);
 775 MAKE_DECODER("ED448", ed448, ecx, PKCS8);
 776 MAKE_DECODER("ED448", ed448, ecx, SubjectPublicKeyInfo);
 777 # ifndef OPENSSL_NO_SM2
 778 MAKE_DECODER("SM2", sm2, ec, PKCS8);
 779 MAKE_DECODER("SM2", sm2, ec, SubjectPublicKeyInfo);
 780 # endif
 781 #endif
 782 MAKE_DECODER("RSA", rsa, rsa, PKCS8);
 783 MAKE_DECODER("RSA", rsa, rsa, SubjectPublicKeyInfo);
 784 MAKE_DECODER("RSA", rsa, rsa, type_specific_keypair);
 785 MAKE_DECODER("RSA", rsa, rsa, RSA);
 786 MAKE_DECODER("RSA-PSS", rsapss, rsapss, PKCS8);
 787 MAKE_DECODER("RSA-PSS", rsapss, rsapss, SubjectPublicKeyInfo);