Skip to content

Commit 298129f

Browse files
SparkiDevSparkiDev
committed
Fixes to get nginx tests passing
Support encoding format X9.62 for ECC. Handle reading one PEM item at a time. Handle 'TRUSTED CERTIFICATE' in PEM header/footer. Support getting DER encoded algorithms for ECDSA and RSA. Support DER encrypted RSA private keys.
1 parent bc35b82 commit 298129f

File tree

9 files changed

+500
-32
lines changed

9 files changed

+500
-32
lines changed

‎include/wolfprovider/alg_funcs.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -339,6 +339,7 @@ extern const OSSL_DISPATCH wp_dh_pki_decoder_functions[];
339339
extern const OSSL_DISPATCH wp_ecc_type_specific_decoder_functions[];
340340
extern const OSSL_DISPATCH wp_ecc_spki_decoder_functions[];
341341
extern const OSSL_DISPATCH wp_ecc_pki_decoder_functions[];
342+
extern const OSSL_DISPATCH wp_ecc_x9_62_decoder_functions[];
342343
extern const OSSL_DISPATCH wp_x25519_spki_decoder_functions[];
343344
extern const OSSL_DISPATCH wp_x25519_pki_decoder_functions[];
344345
extern const OSSL_DISPATCH wp_ed25519_spki_decoder_functions[];
@@ -378,6 +379,8 @@ extern const OSSL_DISPATCH wp_ecc_pki_der_encoder_functions[];
378379
extern const OSSL_DISPATCH wp_ecc_pki_pem_encoder_functions[];
379380
extern const OSSL_DISPATCH wp_ecc_epki_der_encoder_functions[];
380381
extern const OSSL_DISPATCH wp_ecc_epki_pem_encoder_functions[];
382+
extern const OSSL_DISPATCH wp_ecc_x9_62_der_encoder_functions[];
383+
extern const OSSL_DISPATCH wp_ecc_x9_62_pem_encoder_functions[];
381384
extern const OSSL_DISPATCH wp_x25519_spki_der_encoder_functions[];
382385
extern const OSSL_DISPATCH wp_x25519_spki_pem_encoder_functions[];
383386
extern const OSSL_DISPATCH wp_x25519_pki_der_encoder_functions[];

‎include/wolfprovider/internal.h‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,8 @@
7474
#define WP_ENC_FORMAT_EPKI 3
7575
/** Type-specific encoding format. */
7676
#define WP_ENC_FORMAT_TYPE_SPECIFIC 4
77+
/** X9_62 encoding format. */
78+
#define WP_ENC_FORMAT_X9_62 5
7779

7880
/* Data format. */
7981
/** DER - Binary encoding. */
@@ -94,6 +96,9 @@
9496
/** Default iterations for PKCS#12 PBKDF2. */
9597
#define WP_PKCS12_ITERATIONS_DEFAULT 2048
9698

99+
/** Maximum salt length for PKCS. */
100+
#define WP_MAX_SALT_SIZE 64
101+
97102

98103
/* These values are taken from ssl.h.
99104
* Can't include this header as it re-declares OpenSSL types.
@@ -175,6 +180,8 @@ int wp_encrypt_key(WOLFPROV_CTX* provCtx, const char* cipherName,
175180
OSSL_PASSPHRASE_CALLBACK *pwCb, void *pwCbArg, byte** cipherInfo);
176181

177182
int wp_read_der_bio(WOLFPROV_CTX* provCtx, OSSL_CORE_BIO *coreBio, unsigned char** data, word32* len);
183+
int wp_read_pem_bio(WOLFPROV_CTX *provctx, OSSL_CORE_BIO *coreBio,
184+
unsigned char** data, word32* len);
178185
BIO* wp_corebio_get_bio(WOLFPROV_CTX* provCtx, OSSL_CORE_BIO *coreBio);
179186

180187
byte wp_ct_byte_mask_eq(byte a, byte b);

‎src/wp_dec_pem2der.c‎

Lines changed: 32 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -133,36 +133,38 @@ static int wp_pem_password_cb(char* passwd, int sz, int rw, void* userdata)
133133
#endif /* WOLFSSL_ENCRYPTED_KEYS */
134134

135135
/**
136-
* Convert PEM encoded EC parameters to DER.
136+
* Convert PEM to DER for unsupported header/footer.
137137
*
138138
* wolfSSL does not support PEM encoded EC parameters.
139139
*
140-
* @param [in] data PEM encoded data.
141-
* @param [in] len Length of data in bytes.
142-
* @param [out] pDer DER Buffer holding decoded data.
143-
* @param [in, out] info Information about decodeding PEM.
140+
* @param [in] data PEM encoded data.
141+
* @param [in] len Length of data in bytes.
142+
* @param [out] pDer DER Buffer holding decoded data.
143+
* @param [in, out] info Information about decodeding PEM.
144+
* @param [in] nameLen Length of name in header and footer.
144145
* @return 1 on success.
145146
* @return 0 on failure.
146147
*/
147-
static int wp_pem2der_ec_params(const char* data, word32 len, DerBuffer** pDer,
148-
EncryptedInfo* info)
148+
static int wp_pem2der_convert(const char* data, word32 len, DerBuffer** pDer,
149+
EncryptedInfo* info, int nameLen)
149150
{
150151
int ok = 1;
151152
int rc;
152153
const char* footer;
153154
const char* base64Data;
154155
size_t base64Len;
155156

156-
base64Data = data + 29;
157-
base64Len = len - 29;
158-
footer = strstr(base64Data, "-----END EC PARAMETERS-----");
157+
/* Skip '-----BEGIN <name>-----\n'. */
158+
base64Data = data + 16 + nameLen + 1;
159+
base64Len = len - 16 + nameLen + 1;
160+
footer = XSTRSTR(base64Data, "-----END ");
159161
if (footer == NULL) {
160162
info->consumed = len;
161163
ok = 0;
162164
}
163165
if (ok) {
164166
/* Include footer and '\n'. */
165-
info->consumed = (long)(footer - data) + 27 + 1;
167+
info->consumed = (long)(footer - data) + 14 + nameLen + 1;
166168
base64Len = footer - base64Data;
167169
rc = wc_AllocDer(pDer, (word32)base64Len, ECC_TYPE, NULL);
168170
if (rc != 0) {
@@ -226,6 +228,22 @@ static int wp_pem2der_decode_data(const unsigned char* data, word32 len,
226228
type = CERT_TYPE;
227229
obj = OSSL_OBJECT_CERT;
228230
}
231+
#if LIBWOLFSSL_VERSION_HEX > 0x05007006
232+
else if (XMEMCMP(data, "-----BEGIN TRUSTED CERTIFICATE-----", 35) == 0) {
233+
type = TRUSTED_CERT_TYPE;
234+
obj = OSSL_OBJECT_CERT;
235+
}
236+
#else
237+
else if (XMEMCMP(data, "-----BEGIN TRUSTED CERTIFICATE-----", 35) == 0) {
238+
type = CERT_TYPE;
239+
obj = OSSL_OBJECT_CERT;
240+
if (!wp_pem2der_convert((const char*)data, len, &der, &info,
241+
XSTRLEN("TRUSTED CERTIFICATE"))) {
242+
ok = 0;
243+
}
244+
done = 1;
245+
}
246+
#endif
229247
else if (XMEMCMP(data, "-----BEGIN X509 CRL-----", 24) == 0) {
230248
type = CRL_TYPE;
231249
obj = OSSL_OBJECT_CRL;
@@ -246,7 +264,8 @@ static int wp_pem2der_decode_data(const unsigned char* data, word32 len,
246264
dataType = "EC";
247265
dataFormat = "type-specific";
248266
obj = OSSL_OBJECT_PKEY;
249-
if (!wp_pem2der_ec_params((const char*)data, len, &der, &info)) {
267+
if (!wp_pem2der_convert((const char*)data, len, &der, &info,
268+
XSTRLEN("EC PARAMETERS"))) {
250269
ok = 0;
251270
}
252271
done = 1;
@@ -391,7 +410,7 @@ static int wp_pem2der_decode(wp_Pem2Der* ctx, OSSL_CORE_BIO* coreBio,
391410
(void)selection;
392411

393412
/* Read the data from the BIO into buffer that is allocated on the fly. */
394-
if (!wp_read_der_bio(ctx->provCtx, coreBio, &data, &len)) {
413+
if (!wp_read_pem_bio(ctx->provCtx, coreBio, &data, &len)) {
395414
ok = 0;
396415
}
397416
/* No data - nothing to do. */

‎src/wp_ecc_kmgmt.c‎

Lines changed: 127 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2076,7 +2076,8 @@ static int wp_ecc_decode(wp_EccEncDecCtx* ctx, OSSL_CORE_BIO *cBio,
20762076
if (ok && (!wp_read_der_bio(ctx->provCtx, cBio, &data, &len))) {
20772077
ok = 0;
20782078
}
2079-
if (ok && (ctx->format == WP_ENC_FORMAT_TYPE_SPECIFIC)) {
2079+
if (ok && ((ctx->format == WP_ENC_FORMAT_TYPE_SPECIFIC) ||
2080+
(ctx->format == WP_ENC_FORMAT_X9_62))) {
20802081
if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0) {
20812082
if (!wp_ecc_decode_pki(ecc, data, len)) {
20822083
ok = 0;
@@ -2439,7 +2440,8 @@ static int wp_ecc_encode(wp_EccEncDecCtx* ctx, OSSL_CORE_BIO *cBio,
24392440
ok = 0;
24402441
}
24412442

2442-
if (ok && (ctx->format == WP_ENC_FORMAT_TYPE_SPECIFIC)) {
2443+
if (ok && ((ctx->format == WP_ENC_FORMAT_TYPE_SPECIFIC) ||
2444+
(ctx->format == WP_ENC_FORMAT_X9_62))) {
24432445
if (selection == OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS) {
24442446
if (!wp_ecc_encode_params_size(key, &derLen)) {
24452447
ok = 0;
@@ -2480,14 +2482,18 @@ static int wp_ecc_encode(wp_EccEncDecCtx* ctx, OSSL_CORE_BIO *cBio,
24802482
}
24812483
}
24822484

2483-
if (ok && (ctx->format == WP_ENC_FORMAT_TYPE_SPECIFIC)) {
2485+
if (ok && ((ctx->format == WP_ENC_FORMAT_TYPE_SPECIFIC) ||
2486+
(ctx->format == WP_ENC_FORMAT_X9_62))) {
24842487
if (selection == OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS) {
24852488
pemType = DH_PARAM_TYPE;
24862489
if (!wp_ecc_encode_params(key, derData, &derLen)) {
24872490
ok = 0;
24882491
}
24892492
}
24902493
else {
2494+
if (ctx->format == WP_ENC_FORMAT_X9_62) {
2495+
pemType = ECC_PRIVATEKEY_TYPE;
2496+
}
24912497
private = 1;
24922498
if (!wp_ecc_encode_priv(key, derData, &derLen)) {
24932499
ok = 0;
@@ -2543,8 +2549,9 @@ static int wp_ecc_encode(wp_EccEncDecCtx* ctx, OSSL_CORE_BIO *cBio,
25432549
keyLen = pemLen = rc;
25442550
keyData = pemData;
25452551
}
2546-
if (ok && (ctx->format == WP_ENC_FORMAT_TYPE_SPECIFIC) &&
2547-
(selection == OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS)) {
2552+
if (ok && ((ctx->format == WP_ENC_FORMAT_TYPE_SPECIFIC) ||
2553+
(ctx->format == WP_ENC_FORMAT_X9_62)) &&
2554+
(selection == OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS)) {
25482555
pemData[11] = 'E';
25492556
pemData[12] = 'C';
25502557
pemData[pemLen - 19] = 'E';
@@ -2984,4 +2991,119 @@ const OSSL_DISPATCH wp_ecc_epki_pem_encoder_functions[] = {
29842991
{ 0, NULL }
29852992
};
29862993

2994+
/*
2995+
* ECC X9.62
2996+
*/
2997+
2998+
/**
2999+
* Create a new ECC encoder/decoder context that handles decoding X9.62.
3000+
*
3001+
* @param [in] provCtx Provider context.
3002+
* @return New ECC encoder/decoder context object on success.
3003+
* @return NULL on failure.
3004+
*/
3005+
static wp_EccEncDecCtx* wp_ecc_x9_62_dec_new(WOLFPROV_CTX* provCtx)
3006+
{
3007+
return wp_ecc_enc_dec_new(provCtx, WP_ENC_FORMAT_X9_62, 0);
3008+
}
3009+
3010+
/**
3011+
* Return whether the X9.62 decoder/encoder handles the part of the key.
3012+
*
3013+
* @param [in] ctx ECC encoder/decoder context object.
3014+
* @param [in] selection Parts of key to handle.
3015+
* @return 1 when supported.
3016+
* @return 0 when not supported.
3017+
*/
3018+
static int wp_ecc_x9_62_does_selection(WOLFPROV_CTX* provCtx,
3019+
int selection)
3020+
{
3021+
int ok;
3022+
3023+
(void)provCtx;
3024+
3025+
if (selection == 0) {
3026+
ok = 1;
3027+
}
3028+
else {
3029+
ok = (selection & (OSSL_KEYMGMT_SELECT_ALL_PARAMETERS |
3030+
OSSL_KEYMGMT_SELECT_PRIVATE_KEY)) != 0;
3031+
}
3032+
3033+
WOLFPROV_LEAVE(WP_LOG_PK, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), ok);
3034+
return ok;
3035+
}
3036+
3037+
/**
3038+
* Dispatch table for x9_62 decoder.
3039+
*/
3040+
const OSSL_DISPATCH wp_ecc_x9_62_decoder_functions[] = {
3041+
{ OSSL_FUNC_DECODER_NEWCTX, (DFUNC)wp_ecc_x9_62_dec_new },
3042+
{ OSSL_FUNC_DECODER_FREECTX, (DFUNC)wp_ecc_enc_dec_free },
3043+
{ OSSL_FUNC_DECODER_DOES_SELECTION,
3044+
(DFUNC)wp_ecc_x9_62_does_selection },
3045+
{ OSSL_FUNC_DECODER_DECODE, (DFUNC)wp_ecc_decode },
3046+
{ OSSL_FUNC_DECODER_EXPORT_OBJECT, (DFUNC)wp_ecc_export_object },
3047+
{ 0, NULL }
3048+
};
3049+
3050+
/**
3051+
* Create a new ECC encoder/decoder context that handles encoding params in DER.
3052+
*
3053+
* @param [in] provCtx Provider context.
3054+
* @return New ECC encoder/decoder context object on success.
3055+
* @return NULL on failure.
3056+
*/
3057+
static wp_EccEncDecCtx* wp_ecc_x9_62_der_enc_new(WOLFPROV_CTX* provCtx)
3058+
{
3059+
return wp_ecc_enc_dec_new(provCtx, WP_ENC_FORMAT_X9_62, WP_FORMAT_DER);
3060+
}
3061+
3062+
/**
3063+
* Dispatch table for X9.62 to DER encoder.
3064+
*/
3065+
const OSSL_DISPATCH wp_ecc_x9_62_der_encoder_functions[] = {
3066+
{ OSSL_FUNC_ENCODER_NEWCTX, (DFUNC)wp_ecc_x9_62_der_enc_new },
3067+
{ OSSL_FUNC_ENCODER_FREECTX, (DFUNC)wp_ecc_enc_dec_free },
3068+
{ OSSL_FUNC_ENCODER_SETTABLE_CTX_PARAMS,
3069+
(DFUNC)wp_ecc_enc_dec_settable_ctx_params },
3070+
{ OSSL_FUNC_ENCODER_SET_CTX_PARAMS, (DFUNC)wp_ecc_enc_dec_set_ctx_params },
3071+
{ OSSL_FUNC_ENCODER_DOES_SELECTION,
3072+
(DFUNC)wp_ecc_x9_62_does_selection },
3073+
{ OSSL_FUNC_ENCODER_ENCODE, (DFUNC)wp_ecc_encode },
3074+
{ OSSL_FUNC_ENCODER_IMPORT_OBJECT, (DFUNC)wp_ecc_import },
3075+
{ OSSL_FUNC_ENCODER_FREE_OBJECT, (DFUNC)wp_ecc_free },
3076+
{ 0, NULL }
3077+
};
3078+
3079+
/**
3080+
* Create a new ECC encoder/decoder context that handles encoding X9.62 in PEM.
3081+
*
3082+
* @param [in] provCtx Provider context.
3083+
* @return New ECC encoder/decoder context object on success.
3084+
* @return NULL on failure.
3085+
*/
3086+
static wp_EccEncDecCtx* wp_ecc_x9_62_pem_enc_new(WOLFPROV_CTX* provCtx)
3087+
{
3088+
return wp_ecc_enc_dec_new(provCtx, WP_ENC_FORMAT_X9_62, WP_FORMAT_PEM);
3089+
}
3090+
3091+
/**
3092+
* Dispatch table for X9.62 to PEM encoder.
3093+
*/
3094+
const OSSL_DISPATCH wp_ecc_x9_62_pem_encoder_functions[] = {
3095+
{ OSSL_FUNC_ENCODER_NEWCTX,
3096+
(DFUNC)wp_ecc_x9_62_pem_enc_new },
3097+
{ OSSL_FUNC_ENCODER_FREECTX, (DFUNC)wp_ecc_enc_dec_free },
3098+
{ OSSL_FUNC_ENCODER_SETTABLE_CTX_PARAMS,
3099+
(DFUNC)wp_ecc_enc_dec_settable_ctx_params },
3100+
{ OSSL_FUNC_ENCODER_SET_CTX_PARAMS, (DFUNC)wp_ecc_enc_dec_set_ctx_params },
3101+
{ OSSL_FUNC_ENCODER_DOES_SELECTION,
3102+
(DFUNC)wp_ecc_x9_62_does_selection },
3103+
{ OSSL_FUNC_ENCODER_ENCODE, (DFUNC)wp_ecc_encode },
3104+
{ OSSL_FUNC_ENCODER_IMPORT_OBJECT, (DFUNC)wp_ecc_import },
3105+
{ OSSL_FUNC_ENCODER_FREE_OBJECT, (DFUNC)wp_ecc_free },
3106+
{ 0, NULL }
3107+
};
3108+
29873109
#endif /* WP_HAVE_ECC */

‎src/wp_ecdsa_sig.c‎

Lines changed: 23 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -677,10 +677,29 @@ static int wp_ecdsa_digest_verify_final(wp_EcdsaSigCtx *ctx, unsigned char *sig,
677677
*/
678678
static int wp_ecdsa_get_alg_id(wp_EcdsaSigCtx *ctx, OSSL_PARAM *p)
679679
{
680-
/* TODO: implement */
681-
(void)ctx;
682-
(void)p;
683-
return 0;
680+
int ok = 0;
681+
682+
if (XMEMCMP(ctx->mdName, "SHA256", 7) == 0) {
683+
static const unsigned char ecdsa_sha256[] = {
684+
0x30, 0x0a, 0x06, 0x08, 42, 134, 72, 206, 61, 4, 3, 2
685+
};
686+
ok = OSSL_PARAM_set_octet_string(p, ecdsa_sha256, sizeof(ecdsa_sha256));
687+
}
688+
if (XMEMCMP(ctx->mdName, "SHA384", 7) == 0) {
689+
static const unsigned char ecdsa_sha384[] = {
690+
0x30, 0x0a, 0x06, 0x08, 42, 134, 72, 206, 61, 4, 3, 3
691+
};
692+
ok = OSSL_PARAM_set_octet_string(p, ecdsa_sha384, sizeof(ecdsa_sha384));
693+
}
694+
if (XMEMCMP(ctx->mdName, "SHA512", 7) == 0) {
695+
static const unsigned char ecdsa_sha512[] = {
696+
0x30, 0x0a, 0x06, 0x08, 42, 134, 72, 206, 61, 4, 3, 4
697+
};
698+
ok = OSSL_PARAM_set_octet_string(p, ecdsa_sha512, sizeof(ecdsa_sha512));
699+
}
700+
/* TODO: support more digests */
701+
702+
return ok;
684703
}
685704

686705
/**

0 commit comments

Comments
 (0)