Skip to content

Commit 6a59700

Browse files
olszomalolszomal
committed
Disable custom EVP_PKEY methods in provider mode
1 parent 1c3c4a3 commit 6a59700

File tree

11 files changed

+65
-51
lines changed

11 files changed

+65
-51
lines changed

‎src/eng_back.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ ENGINE_CTX *ENGINE_CTX_new(void)
9696
if (!ctx)
9797
return NULL;
9898
memset(ctx, 0, sizeof(ENGINE_CTX));
99-
ctx->util_ctx = UTIL_CTX_new();
99+
ctx->util_ctx = UTIL_CTX_new(0);
100100
if (!ctx->util_ctx) {
101101
OPENSSL_free(ctx);
102102
return NULL;

‎src/libp11-int.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ typedef struct pkcs11_object_ops PKCS11_OBJECT_ops;
5656
* PKCS11_CTX: context for a PKCS11 implementation
5757
*/
5858
struct pkcs11_ctx_private {
59+
int flags;
5960
CK_FUNCTION_LIST_PTR method;
6061
void *handle;
6162
char *init_args;
@@ -213,7 +214,7 @@ extern void pkcs11_zap_attrs(PKCS11_TEMPLATE *);
213214
extern int pkcs11_atomic_add(int *, int, pthread_mutex_t *);
214215

215216
/* Allocate the context */
216-
extern PKCS11_CTX *pkcs11_CTX_new(void);
217+
extern PKCS11_CTX *pkcs11_CTX_new(int flags);
217218

218219
/* Specify any private PKCS#11 module initialization args, if necessary */
219220
extern void pkcs11_CTX_init_args(PKCS11_CTX *ctx, const char *init_args);

‎src/libp11.exports‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
PKCS11_CTX_init_args
2+
PKCS11_CTX_new_ex
23
PKCS11_CTX_new
34
PKCS11_CTX_load
45
PKCS11_CTX_unload

‎src/libp11.h‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,8 @@
3838
extern "C" {
3939
#endif
4040

41+
#define PKCS11_FLAG_NO_METHODS 1
42+
4143
int ERR_load_CKR_strings(void);
4244
void ERR_unload_CKR_strings(void);
4345
void ERR_CKR_error(int function, int reason, char *file, int line);
@@ -145,6 +147,14 @@ typedef struct PKCS11_kgen_attrs_st {
145147
/** PKCS11 ASCII logging callback */
146148
typedef void (*PKCS11_VLOG_A_CB)(int, const char *, va_list);
147149

150+
/**
151+
* Create a new libp11 context with specified flags
152+
*
153+
* This should be the first function called in the use of libp11
154+
* @return an allocated context
155+
*/
156+
extern PKCS11_CTX *PKCS11_CTX_new_ex(int flags);
157+
148158
/**
149159
* Create a new libp11 context
150160
*

‎src/p11_eddsa.c‎

Lines changed: 26 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -593,24 +593,22 @@ static EVP_PKEY *pkcs11_get_evp_key_ed25519(PKCS11_OBJECT_private *key)
593593
if (!pkey)
594594
return NULL;
595595

596-
if (key->object_class == CKO_PRIVATE_KEY) {
597596
#if OPENSSL_VERSION_NUMBER < 0x40000000L
598-
/* global initialize ED25519 EVP_PKEY_METHOD */
599-
if (!pkcs11_ed25519_method_new()) {
600-
EVP_PKEY_free(pkey);
601-
return NULL;
597+
if (key->object_class == CKO_PRIVATE_KEY) {
598+
if ((key->slot->ctx->flags & PKCS11_FLAG_NO_METHODS) == 0) {
599+
/* global initialize ED25519 EVP_PKEY_METHOD */
600+
if (!pkcs11_ed25519_method_new()) {
601+
EVP_PKEY_free(pkey);
602+
return NULL;
603+
}
604+
/* creates a new EVP_PKEY object which requires its own key object reference */
605+
key = pkcs11_object_ref(key);
606+
alloc_pkey_ex_index();
607+
pkcs11_set_ex_data_pkey(pkey, key);
608+
atexit(pkcs11_ed25519_method_free);
602609
}
603-
#endif /* OPENSSL_VERSION_NUMBER < 0x40000000L */
604-
605-
/* creates a new EVP_PKEY object which requires its own key object reference */
606-
key = pkcs11_object_ref(key);
607-
608-
#if OPENSSL_VERSION_NUMBER < 0x40000000L
609-
alloc_pkey_ex_index();
610-
pkcs11_set_ex_data_pkey(pkey, key);
611-
atexit(pkcs11_ed25519_method_free);
612-
#endif /* OPENSSL_VERSION_NUMBER < 0x40000000L */
613610
}
611+
#endif /* OPENSSL_VERSION_NUMBER < 0x40000000L */
614612
return pkey;
615613
}
616614

@@ -630,24 +628,22 @@ static EVP_PKEY *pkcs11_get_evp_key_ed448(PKCS11_OBJECT_private *key)
630628
if (!pkey)
631629
return NULL;
632630

633-
if (key->object_class == CKO_PRIVATE_KEY) {
634631
#if OPENSSL_VERSION_NUMBER < 0x40000000L
635-
/* global initialize ED448 EVP_PKEY_METHOD */
636-
if (!pkcs11_ed448_method_new()) {
637-
EVP_PKEY_free(pkey);
638-
return NULL;
632+
if (key->object_class == CKO_PRIVATE_KEY) {
633+
if ((key->slot->ctx->flags & PKCS11_FLAG_NO_METHODS) == 0) {
634+
/* global initialize ED448 EVP_PKEY_METHOD */
635+
if (!pkcs11_ed448_method_new()) {
636+
EVP_PKEY_free(pkey);
637+
return NULL;
638+
}
639+
/* create a new EVP_PKEY object which requires its own key object reference */
640+
key = pkcs11_object_ref(key);
641+
alloc_pkey_ex_index();
642+
pkcs11_set_ex_data_pkey(pkey, key);
643+
atexit(pkcs11_ed25519_method_free);
639644
}
640-
#endif /* OPENSSL_VERSION_NUMBER < 0x40000000L */
641-
642-
/* create a new EVP_PKEY object which requires its own key object reference */
643-
key = pkcs11_object_ref(key);
644-
645-
#if OPENSSL_VERSION_NUMBER < 0x40000000L
646-
alloc_pkey_ex_index();
647-
pkcs11_set_ex_data_pkey(pkey, key);
648-
atexit(pkcs11_ed448_method_free);
649-
#endif /* OPENSSL_VERSION_NUMBER < 0x40000000L */
650645
}
646+
#endif /* OPENSSL_VERSION_NUMBER < 0x40000000L */
651647
return pkey;
652648
}
653649

‎src/p11_front.c‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,14 @@
3232

3333
/* External interface to the libp11 features */
3434

35+
PKCS11_CTX *PKCS11_CTX_new_ex(int flags)
36+
{
37+
return pkcs11_CTX_new(flags);
38+
}
39+
3540
PKCS11_CTX *PKCS11_CTX_new(void)
3641
{
37-
return pkcs11_CTX_new();
42+
return pkcs11_CTX_new(0);
3843
}
3944

4045
void PKCS11_CTX_init_args(PKCS11_CTX *ctx, const char *init_args)

‎src/p11_load.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ int pkcs11_global_data_refs = 0;
2626
/*
2727
* Create a new context
2828
*/
29-
PKCS11_CTX *pkcs11_CTX_new(void)
29+
PKCS11_CTX *pkcs11_CTX_new(int flags)
3030
{
3131
PKCS11_CTX_private *cpriv = NULL;
3232
PKCS11_CTX *ctx = NULL;
@@ -38,6 +38,7 @@ PKCS11_CTX *pkcs11_CTX_new(void)
3838
if (!cpriv)
3939
goto fail;
4040
memset(cpriv, 0, sizeof(PKCS11_CTX_private));
41+
cpriv->flags = flags;
4142
ctx = OPENSSL_malloc(sizeof(PKCS11_CTX));
4243
if (!ctx)
4344
goto fail;

‎src/p11_rsa.c‎

Lines changed: 11 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -342,22 +342,20 @@ static EVP_PKEY *pkcs11_get_evp_key_rsa(PKCS11_OBJECT_private *key)
342342
}
343343
if (key->object_class == CKO_PRIVATE_KEY) {
344344
#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_VERSION_NUMBER < 0x40000000L
345-
/* global initialize RSA EVP_PKEY_METHOD */
346-
if (!pkcs11_pkey_method_rsa_new()) {
347-
EVP_PKEY_free(pk);
348-
return NULL;
345+
if ((key->slot->ctx->flags & PKCS11_FLAG_NO_METHODS) == 0) {
346+
/* global initialize RSA EVP_PKEY_METHOD */
347+
if (!pkcs11_pkey_method_rsa_new()) {
348+
EVP_PKEY_free(pk);
349+
return NULL;
350+
}
351+
/* creates a new EVP_PKEY object which requires its own key object reference */
352+
key = pkcs11_object_ref(key);
353+
alloc_pkey_ex_index();
354+
pkcs11_set_ex_data_pkey(pk, key);
355+
atexit(pkcs11_rsa_key_method_free);
349356
}
350357
#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_VERSION_NUMBER < 0x40000000L */
351358

352-
/* creates a new EVP_PKEY object which requires its own key object reference */
353-
key = pkcs11_object_ref(key);
354-
355-
#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_VERSION_NUMBER < 0x40000000L
356-
alloc_pkey_ex_index();
357-
pkcs11_set_ex_data_pkey(pk, key);
358-
atexit(pkcs11_rsa_key_method_free);
359-
#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_VERSION_NUMBER < 0x40000000L */
360-
361359
RSA_set_method(rsa, PKCS11_get_rsa_method());
362360
#if OPENSSL_VERSION_NUMBER >= 0x10100005L || ( defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER >= 0x3050000fL )
363361
RSA_set_flags(rsa, RSA_FLAG_EXT_PKEY);

‎src/provider_helpers.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -168,7 +168,7 @@ PROVIDER_CTX *PROVIDER_CTX_new(void)
168168
if (!prov_ctx)
169169
return NULL;
170170

171-
prov_ctx->util_ctx = UTIL_CTX_new();
171+
prov_ctx->util_ctx = UTIL_CTX_new(PKCS11_FLAG_NO_METHODS);
172172
if (!prov_ctx->util_ctx) {
173173
OPENSSL_free(prov_ctx);
174174
return NULL;

‎src/util.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@
5353
/* defined in util_uri.c */
5454
typedef struct util_ctx_st UTIL_CTX; /* opaque */
5555

56-
UTIL_CTX *UTIL_CTX_new(void);
56+
UTIL_CTX *UTIL_CTX_new(int flags);
5757
void UTIL_CTX_free(UTIL_CTX *ctx);
5858
int UTIL_CTX_set_module(UTIL_CTX *ctx, const char *module);
5959
int UTIL_CTX_set_init_args(UTIL_CTX *ctx, const char *init_args);

0 commit comments

Comments
 (0)