diff options
author | Richard Levitte <levitte@openssl.org> | 2021-06-28 05:52:42 +0200 |
---|---|---|
committer | Richard Levitte <levitte@openssl.org> | 2021-06-29 13:50:51 +0200 |
commit | 398f8fe1c48e19e29f099a55bb49d601911f463d (patch) | |
tree | 631e04d80070361e56e15415150892492257b225 /providers | |
parent | 6eaf139f62001b958861f25c5cebc41c76c579bd (diff) |
DECODER & ENCODER: Make sure to pass around the original selection bits
When decoding a key and asking the keymgmt to import the key data, it
was told that the key data includes everything. This may not be true,
since the user may have specified a different selection, and some
keymgmts may want to be informed.
Our key decoders' export function, on the other hand, didn't care
either, and simply export anything they could, regardless.
In both cases, the selection that was specified by the user is now
passed all the way.
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15934)
Diffstat (limited to 'providers')
3 files changed, 16 insertions, 10 deletions
diff --git a/providers/implementations/encode_decode/decode_der2key.c b/providers/implementations/encode_decode/decode_der2key.c index fd4a7c6e2a..356e65b403 100644 --- a/providers/implementations/encode_decode/decode_der2key.c +++ b/providers/implementations/encode_decode/decode_der2key.c @@ -89,6 +89,8 @@ struct keytype_desc_st { struct der2key_ctx_st { PROV_CTX *provctx; const struct keytype_desc_st *desc; + /* The selection that is passed to der2key_decode() */ + int selection; /* Flag used to signal that a failure is fatal */ unsigned int flag_fatal : 1; }; @@ -180,9 +182,9 @@ static int der2key_decode(void *vctx, OSSL_CORE_BIO *cin, int selection, const unsigned char *derp; long der_len = 0; void *key = NULL; - int orig_selection = selection; int ok = 0; + ctx->selection = selection; /* * The caller is allowed to specify 0 as a selection mark, to have the * structure and key type guessed. For type-specific structures, this @@ -213,7 +215,7 @@ static int der2key_decode(void *vctx, OSSL_CORE_BIO *cin, int selection, } else if (ctx->desc->d2i_private_key != NULL) { key = ctx->desc->d2i_private_key(NULL, &derp, der_len); } - if (key == NULL && orig_selection != 0) + if (key == NULL && ctx->selection != 0) goto next; } if (key == NULL && (selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0) { @@ -222,14 +224,14 @@ static int der2key_decode(void *vctx, OSSL_CORE_BIO *cin, int selection, key = ctx->desc->d2i_PUBKEY(NULL, &derp, der_len); else key = ctx->desc->d2i_public_key(NULL, &derp, der_len); - if (key == NULL && orig_selection != 0) + if (key == NULL && ctx->selection != 0) goto next; } if (key == NULL && (selection & OSSL_KEYMGMT_SELECT_ALL_PARAMETERS) != 0) { derp = der; if (ctx->desc->d2i_key_params != NULL) key = ctx->desc->d2i_key_params(NULL, &derp, der_len); - if (key == NULL && orig_selection != 0) + if (key == NULL && ctx->selection != 0) goto next; } @@ -304,8 +306,7 @@ static int der2key_export_object(void *vctx, /* The contents of the reference is the address to our object */ keydata = *(void **)reference; - return export(keydata, OSSL_KEYMGMT_SELECT_ALL, - export_cb, export_cbarg); + return export(keydata, ctx->selection, export_cb, export_cbarg); } return 0; } diff --git a/providers/implementations/encode_decode/decode_msblob2key.c b/providers/implementations/encode_decode/decode_msblob2key.c index 15dc8b05a7..0508e68b32 100644 --- a/providers/implementations/encode_decode/decode_msblob2key.c +++ b/providers/implementations/encode_decode/decode_msblob2key.c @@ -56,6 +56,8 @@ static OSSL_FUNC_decoder_export_object_fn msblob2key_export_object; struct msblob2key_ctx_st { PROV_CTX *provctx; const struct keytype_desc_st *desc; + /* The selection that is passed to msblob2key_decode() */ + int selection; }; static struct msblob2key_ctx_st * @@ -102,6 +104,7 @@ static int msblob2key_decode(void *vctx, OSSL_CORE_BIO *cin, int selection, if (!ok) goto next; + ctx->selection = selection; ok = 0; /* Assume that we fail */ if ((isdss && ctx->desc->type != EVP_PKEY_DSA) @@ -208,8 +211,7 @@ msblob2key_export_object(void *vctx, /* The contents of the reference is the address to our object */ keydata = *(void **)reference; - return export(keydata, OSSL_KEYMGMT_SELECT_ALL, - export_cb, export_cbarg); + return export(keydata, ctx->selection, export_cb, export_cbarg); } return 0; } diff --git a/providers/implementations/encode_decode/decode_pvk2key.c b/providers/implementations/encode_decode/decode_pvk2key.c index 5c26bfb908..30b42d2097 100644 --- a/providers/implementations/encode_decode/decode_pvk2key.c +++ b/providers/implementations/encode_decode/decode_pvk2key.c @@ -56,6 +56,8 @@ static OSSL_FUNC_decoder_export_object_fn pvk2key_export_object; struct pvk2key_ctx_st { PROV_CTX *provctx; const struct keytype_desc_st *desc; + /* The selection that is passed to der2key_decode() */ + int selection; }; static struct pvk2key_ctx_st * @@ -86,6 +88,8 @@ static int pvk2key_decode(void *vctx, OSSL_CORE_BIO *cin, int selection, void *key = NULL; int ok = 0; + ctx->selection = selection; + if ((selection == 0 || (selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0) && ctx->desc->read_private_key != NULL) { @@ -175,8 +179,7 @@ static int pvk2key_export_object(void *vctx, /* The contents of the reference is the address to our object */ keydata = *(void **)reference; - return export(keydata, OSSL_KEYMGMT_SELECT_ALL, - export_cb, export_cbarg); + return export(keydata, ctx->selection, export_cb, export_cbarg); } return 0; } |