diff options
| author | Simo Sorce <simo@redhat.com> | 2022-11-10 16:46:32 +0100 |
|---|---|---|
| committer | Tomas Mraz <tomas@openssl.org> | 2022-11-15 12:04:12 +0100 |
| commit | 98642df4ba886818900ab7e6b23703544e6addd4 (patch) | |
| tree | c2779bfde9324683c67718fc0ede90a607a55b94 /include/crypto/evp.h | |
| parent | apps/ocsp.c: Add missing test if make_ocsp_response failed (diff) | |
| download | openssl-98642df4ba886818900ab7e6b23703544e6addd4.tar.xz openssl-98642df4ba886818900ab7e6b23703544e6addd4.zip | |
Propagate selection all the way on key export
EVP_PKEY_eq() is used to check, among other things, if a certificate
public key corresponds to a private key. When the private key belongs to
a provider that does not allow to export private keys this currently
fails as the internal functions used to import/export keys ignored the
selection given (which specifies that only the public key needs to be
considered) and instead tries to export everything.
This patch allows to propagate the selection all the way down including
adding it in the cache so that a following operation actually looking
for other selection parameters does not mistakenly pick up an export
containing only partial information.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19648)
Diffstat (limited to 'include/crypto/evp.h')
| -rw-r--r-- | include/crypto/evp.h | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/include/crypto/evp.h b/include/crypto/evp.h index f601b72807..dbbdcccbda 100644 --- a/include/crypto/evp.h +++ b/include/crypto/evp.h @@ -589,6 +589,7 @@ int evp_cipher_asn1_to_param_ex(EVP_CIPHER_CTX *c, ASN1_TYPE *type, typedef struct { EVP_KEYMGMT *keymgmt; void *keydata; + int selection; } OP_CACHE_ELEM; DEFINE_STACK_OF(OP_CACHE_ELEM) @@ -778,12 +779,14 @@ EVP_PKEY *evp_keymgmt_util_make_pkey(EVP_KEYMGMT *keymgmt, void *keydata); int evp_keymgmt_util_export(const EVP_PKEY *pk, int selection, OSSL_CALLBACK *export_cb, void *export_cbarg); -void *evp_keymgmt_util_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt); +void *evp_keymgmt_util_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt, + int selection); OP_CACHE_ELEM *evp_keymgmt_util_find_operation_cache(EVP_PKEY *pk, - EVP_KEYMGMT *keymgmt); + EVP_KEYMGMT *keymgmt, + int selection); int evp_keymgmt_util_clear_operation_cache(EVP_PKEY *pk, int locking); -int evp_keymgmt_util_cache_keydata(EVP_PKEY *pk, - EVP_KEYMGMT *keymgmt, void *keydata); +int evp_keymgmt_util_cache_keydata(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt, + void *keydata, int selection); void evp_keymgmt_util_cache_keyinfo(EVP_PKEY *pk); void *evp_keymgmt_util_fromdata(EVP_PKEY *target, EVP_KEYMGMT *keymgmt, int selection, const OSSL_PARAM params[]); |