abc/GmSSL
1
0
Fork 0
mirror of https://github.com/guanzhi/GmSSL.git synced 2026-05-27 02:36:29 +08:00
Code Issues Packages Projects Releases Wiki Activity

update crypto

Browse Source
This commit is contained in:
Zhi Guan
2017-03-08 15:02:42 +08:00
parent 4d84dd7557
commit 002096751c
29 changed files with 1062 additions and 134 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
crypto/saf/saf_base64.c
View File

@@ -362,51 +362,3 @@ end:
SAF_Base64_DestroyBase64Obj(handle);
return ret;
}
int SAF_Base64_test(int verbose)
{
int ret = SAR_UnknownErr;
/* sizeof(buf1)%3 == 1 makes base64 ended with "==" */
unsigned char buf1[121];
unsigned char buf2[512];
unsigned char buf3[512];
unsigned int len1, len2, len3;
/* generate some random binary for testing */
RAND_bytes(buf1, sizeof(buf1));
memset(buf2, 0, sizeof(buf2));
memset(buf3, 0, sizeof(buf3));
len1 = (unsigned int)sizeof(buf1);
len2 = (unsigned int)sizeof(buf2);
if ((ret = SAF_Base64_Encode(buf1, len1, buf2, &len2)) != SAR_OK) {
ERR_print_errors_fp(stderr);
goto end;
}
if (verbose) {
printf("%s\n", buf2);
}
len3 = sizeof(buf3);
if ((ret = SAF_Base64_Decode(buf2, len2, buf3, &len3)) != SAR_OK) {
ERR_print_errors_fp(stderr);
goto end;
}
/* check correctness */
if (len1 == len3 && memcmp(buf1, buf3, len1) == 0) {
ret = SAR_OK;
} else {
/* make sure to assign `ret`, or it might be set as OK by
* previous functions */
ret = SAR_UnknownErr;
}
end:
if (verbose) {
printf("%s %s\n", __FUNCTION__,
ret == SAR_OK ? "passed" : "failed");
}
return SAR_OK;
}

18
crypto/saf/saf_err.c
View File

@@ -56,10 +56,18 @@ static ERR_STRING_DATA SAF_str_functs[] = {
{ERR_FUNC(SAF_F_SAF_HASHUPDATE), "SAF_HashUpdate"},
{ERR_FUNC(SAF_F_SAF_INITIALIZE), "SAF_Initialize"},
{ERR_FUNC(SAF_F_SAF_KEY_NEW), "SAF_KEY_new"},
{ERR_FUNC(SAF_F_SAF_LOAD_PRIVATE_KEY), "SAF_load_private_key"},
{ERR_FUNC(SAF_F_SAF_LOAD_PUBLIC_KEY), "SAF_load_public_key"},
{ERR_FUNC(SAF_F_SAF_LOGIN), "SAF_Login"},
{ERR_FUNC(SAF_F_SAF_LOGOUT), "SAF_Logout"},
{ERR_FUNC(SAF_F_SAF_MACFINAL), "SAF_MacFinal"},
{ERR_FUNC(SAF_F_SAF_MACUPDATE), "SAF_MacUpdate"},
{ERR_FUNC(SAF_F_SAF_PKCS7_DECODEDIGESTEDDATA),
"SAF_Pkcs7_DecodeDigestedData"},
{ERR_FUNC(SAF_F_SAF_PKCS7_DECODEENVELOPEDDATA),
"SAF_Pkcs7_DecodeEnvelopedData"},
{ERR_FUNC(SAF_F_SAF_PKCS7_DECODESIGNEDDATA),
"SAF_Pkcs7_DecodeSignedData"},
{ERR_FUNC(SAF_F_SAF_PKCS7_ENCODEDIGESTEDDATA),
"SAF_Pkcs7_EncodeDigestedData"},
{ERR_FUNC(SAF_F_SAF_PKCS7_ENCODEENVELOPEDDATA),
@@ -89,6 +97,7 @@ static ERR_STRING_DATA SAF_str_reasons[] = {
{ERR_REASON(SAF_R_GEN_RANDOM_FAILURE), "gen random failure"},
{ERR_REASON(SAF_R_INT_OVERFLOW), "int overflow"},
{ERR_REASON(SAF_R_INVALID_ALGOR), "invalid algor"},
{ERR_REASON(SAF_R_INVALID_APP), "invalid app"},
{ERR_REASON(SAF_R_INVALID_CERTIFICATE), "invalid certificate"},
{ERR_REASON(SAF_R_INVALID_DIGEST_ALGOR), "invalid digest algor"},
{ERR_REASON(SAF_R_INVALID_HANDLE), "invalid handle"},
@@ -98,14 +107,23 @@ static ERR_STRING_DATA SAF_str_reasons[] = {
{ERR_REASON(SAF_R_INVALID_KEY_LENGTH), "invalid key length"},
{ERR_REASON(SAF_R_INVALID_KEY_USAGE), "invalid key usage"},
{ERR_REASON(SAF_R_INVALID_LENGTH), "invalid length"},
{ERR_REASON(SAF_R_INVALID_PKCS7), "invalid pkcs7"},
{ERR_REASON(SAF_R_INVALID_PKCS7_DATA), "invalid pkcs7 data"},
{ERR_REASON(SAF_R_INVALID_PKCS7_TYPE), "invalid pkcs7 type"},
{ERR_REASON(SAF_R_INVALID_PKEY_TYPE), "invalid pkey type"},
{ERR_REASON(SAF_R_INVALID_PUBLIC_KEY), "invalid public key"},
{ERR_REASON(SAF_R_LOA), "loa"},
{ERR_REASON(SAF_R_LOAD_CERTS_FAILURE), "load certs failure"},
{ERR_REASON(SAF_R_LOAD_KEY_FAILURE), "load key failure"},
{ERR_REASON(SAF_R_LOAD_PRIVATE_KEY_FAILURE), "load private key failure"},
{ERR_REASON(SAF_R_LOAD_PUBLIC_KEY_FAILURE), "load public key failure"},
{ERR_REASON(SAF_R_MAC_FAILURE), "mac failure"},
{ERR_REASON(SAF_R_NOT_SUPPORTED), "not supported"},
{ERR_REASON(SAF_R_OPERATION_NOT_INITIALIZED),
"operation not initialized"},
{ERR_REASON(SAF_R_PKCS7_VERIFY_FAILURE), "pkcs7 verify failure"},
{ERR_REASON(SAF_R_UNSUPPORTED_ALGOR), "unsupported algor"},
{ERR_REASON(SAF_R_UNSUPPORTED_DIGEST_ALGOR), "unsupported digest algor"},
{0, NULL}
};

7
crypto/saf/saf_lcl.h
View File

@@ -77,7 +77,7 @@ typedef struct {
typedef struct {
SAF_SYMMKEYOBJ *hSymmKeyObj;
unsigned char key[64];
int keylen;
size_t keylen;
EVP_CIPHER_CTX *cipher_ctx;
CMAC_CTX *cmac_ctx;
} SAF_KEY;
@@ -87,3 +87,8 @@ void SAF_KEY_free(SAF_KEY *key);
SAF_SYMMKEYOBJ *SAF_SYMMKEYOBJ_dup(const SAF_SYMMKEYOBJ *a);
void SAF_SYMMKEYOBJ_free(SAF_SYMMKEYOBJ *a);
EVP_PKEY *SAF_load_private_key(SAF_APP *app, const char *container, int flags);
EVP_PKEY *SAF_load_public_key(SAF_APP *app, const char *container, int flags);

63
crypto/saf/saf_lib.c
View File

@@ -50,9 +50,68 @@
#include <openssl/gmsaf.h>
#include "saf_lcl.h"
static int readfile(const char *file, unsigned char **pout, size_t *len)
EVP_PKEY *SAF_load_private_key(SAF_APP *app, const char *container, int flags)
{
return SAR_Ok;
EVP_PKEY *ret = NULL;
EVP_PKEY *pkey = NULL;
char key_id[1024];
int type;
if (!app->engine) {
SAFerr(SAF_F_SAF_LOAD_PRIVATE_KEY, SAF_R_INVALID_APP);
return NULL;
}
snprintf(key_id, sizeof(key_id), "%s.%s", container,
((flags & EVP_PKT_SIGN) ? "sign" : "enc"));
if (!(pkey = ENGINE_load_private_key(app->engine, key_id, NULL, NULL))) {
SAFerr(SAF_F_SAF_LOAD_PRIVATE_KEY, SAF_R_LOAD_PRIVATE_KEY_FAILURE);
goto end;
}
if (EVP_PKEY_base_id(pkey) !=
((flags & EVP_PK_EC) ? EVP_PKEY_EC : EVP_PKEY_RSA)) {
SAFerr(SAF_F_SAF_LOAD_PRIVATE_KEY, SAF_R_INVALID_PKEY_TYPE);
goto end;
}
ret = pkey;
pkey = NULL;
end:
EVP_PKEY_free(pkey);
return ret;
}
EVP_PKEY *SAF_load_public_key(SAF_APP *app, const char *container, int flags)
{
EVP_PKEY *ret = NULL;
EVP_PKEY *pkey = NULL;
char key_id[1024];
if (!app->engine) {
SAFerr(SAF_F_SAF_LOAD_PUBLIC_KEY, SAF_R_INVALID_APP);
return NULL;
}
snprintf(key_id, sizeof(key_id), "%s.%s", container,
((flags & EVP_PKT_SIGN) ? "sign" : "enc"));
if (!(pkey = ENGINE_load_public_key(app->engine, key_id, NULL, NULL))) {
SAFerr(SAF_F_SAF_LOAD_PUBLIC_KEY, SAF_R_LOAD_PUBLIC_KEY_FAILURE);
goto end;
}
if (EVP_PKEY_base_id(pkey) !=
((flags & EVP_PK_EC) ? EVP_PKEY_EC : EVP_PKEY_RSA)) {
SAFerr(SAF_F_SAF_LOAD_PUBLIC_KEY, SAF_R_INVALID_PKEY_TYPE);
goto end;
}
ret = pkey;
pkey = NULL;
end:
EVP_PKEY_free(pkey);
return ret;
}

168
crypto/saf/saf_pkcs7.c
View File

@@ -48,6 +48,7 @@
*/
#include <openssl/evp.h>
#include <openssl/asn1.h>
#include <openssl/pkcs7.h>
#include <openssl/gmapi.h>
#include <openssl/gmsaf.h>
@@ -70,37 +71,28 @@ int SAF_Pkcs7_EncodeData(
unsigned int *puiDerP7DataLen)
{
int ret = SAR_UnknownErr;
STACK_OF(X509) *encerts = NULL;
p7 = PKCS7_encrypt(encerts, in, cipher, flags);
p7 = PKCS7_sign(NULL, NULL, other, in, flags);
return ret;
}
/* 7.4.3 */
int SAF_Pkcs7_DecodeData(
void *hAppHandle)
void *hAppHandle,
unsigned char *pucDecContainerName,
unsigned int uiDecContainerNameLen,
unsigned int uiDecKeyUsage,
unsigned char *pucDerP7Data,
unsigned int uiDerP7DataLen,
unsigned char *pucData,
unsigned int *puiDataLen,
unsigned char *pucSignerCertificate,
unsigned int *puiSignerCertificateLen,
unsigned int *puiDigestAlgorithm)
{
int ret = SAR_UnknownErr;
return ret;
}
EVP_PKEY *SAF_LoadPrivateKey(
void *hAppHandle,
unsigned char *pucSignContainerName,
unsigned int uiSignContainerNameLen)
{
return NULL;
}
/* 7.4.4 */
int SAF_Pkcs7_EncodeSignedData(
void *hAppHandle,
@@ -116,9 +108,12 @@ int SAF_Pkcs7_EncodeSignedData(
unsigned int *puiDerP7DataLen)
{
int ret = SAR_UnknownErr;
SAF_APP *app = (SAF_APP *)hAppHandle;
PKCS7 *p7 = NULL;
EVP_PKEY *pkey = NULL;
X509 *x509 = NULL;
BIO *data = NULL;
int len;
if (!hAppHandle || !pucSignContainerName || !pucSignerCertificate
|| !pucData || !pucDerP7Data || !puiDerP7DataLen) {
@@ -127,21 +122,21 @@ int SAF_Pkcs7_EncodeSignedData(
}
if (uiSignContainerNameLen <= 0 || uiSignContainerNameLen > INT_MAX
|| strlen((char *)pucSignContainerName) != uiSignContainerNameLen
|| uiSignerCertificateLen <= 0 || uiSignerCertificateLen > INT_MAX
|| uiDataLen <= 0 || uiDataLen > INT_MAX) {
SAFerr(SAF_F_SAF_PKCS7_ENCODESIGNEDDATA, SAF_R_INVALID_INPUT_LENGTH);
return SAR_IndataLenErr;
}
if (!(pkey = SAF_LoadPrivateKey(
hAppHandle,
pucSignContainerName,
uiSignContainerNameLen))) {
if (!(pkey = SAF_load_private_key(app, (char *)pucSignContainerName,
EVP_PK_EC|EVP_PKT_SIGN))) {
SAFerr(SAF_F_SAF_PKCS7_ENCODESIGNEDDATA, SAF_R_LOAD_KEY_FAILURE);
goto end;
}
if (!(x509 = d2i_X509(NULL, &pucSignerCertificate, uiSignerCertificateLen))) {
if (!(x509 = d2i_X509(NULL, (const unsigned char **)&pucSignerCertificate,
uiSignerCertificateLen))) {
SAFerr(SAF_F_SAF_PKCS7_ENCODESIGNEDDATA, ERR_R_X509_LIB);
goto end;
}
@@ -192,36 +187,114 @@ int SAF_Pkcs7_DecodeSignedData(
{
int ret = SAR_UnknownErr;
PKCS7 *p7 = NULL;
PKCS7_SIGNED *p7signed;
X509 *x509 = NULL;
PKCS7_SIGNER_INFO *signer_info;
X509_ALGOR *algor;
BIO *bio = NULL;
p7 = d2i_PKCS7(NULL, &pucDerP7SignedData, uiDerP7SignedDataLen);
if (!hAppHandle || !pucDerP7SignedData || !puiDigestAlgorithm
|| !puiSignerCertificateLen || !puiDataLen || !puiSigLen) {
SAFerr(SAF_F_SAF_PKCS7_DECODESIGNEDDATA, ERR_R_PASSED_NULL_PARAMETER);
return SAR_IndataErr;
}
if (uiDerP7SignedDataLen <= 0 || uiDerP7SignedDataLen > INT_MAX) {
SAFerr(SAF_F_SAF_PKCS7_DECODESIGNEDDATA, SAF_R_INVALID_INPUT_LENGTH);
return SAR_IndataLenErr;
}
/* process */
if (!(p7 = d2i_PKCS7(NULL, (const unsigned char **)&pucDerP7SignedData,
uiDerP7SignedDataLen))) {
SAFerr(SAF_F_SAF_PKCS7_DECODESIGNEDDATA, SAF_R_INVALID_PKCS7_DATA);
goto end;
}
if (!(bio = BIO_new(BIO_s_mem()))) {
SAFerr(SAF_F_SAF_PKCS7_DECODESIGNEDDATA, ERR_R_MALLOC_FAILURE);
goto end;
}
if (!PKCS7_type_is_signed(p7)) {
SAFerr(SAF_F_SAF_PKCS7_DECODESIGNEDDATA, SAF_R_INVALID_PKCS7_TYPE);
goto end;
}
PKCS7_SIGNED *p7signed = p7->d.sign;
X509_ALGOR *algor = sk_X509_ALGOR_value(p7signed->md_algs, 0);
const EVP_MD *md = EVP_get_digestbyobj(algor->algorithm);
*puiDigestAlgorithm = EVP_MD_sdg(md);
X509 *x509 = sk_X509_ALGOR_value(p7signed->cert);
PKCS7_SIGNER_INFO *signer_info = sk_PKCS7_SIGNER_INFO_value(p7signed->signer_info, 0);
PKCS7 *p7data = p7signed->contents;
if (!PKCS7_type_is_data(p7data)) {
if (!PKCS7_verify(p7, NULL, NULL, NULL, bio, 0)) {
SAFerr(SAF_F_SAF_PKCS7_DECODESIGNEDDATA, SAF_R_PKCS7_VERIFY_FAILURE);
goto end;
}
ASN1_OCTET_STRING *data = p7data->d.data;
if (!(p7signed = p7->d.sign)) {
SAFerr(SAF_F_SAF_PKCS7_DECODESIGNEDDATA, SAF_R_INVALID_PKCS7_DATA);
goto end;
}
/* get digest algor */
if (sk_X509_ALGOR_num(p7signed->md_algs) != 1
|| !(algor = sk_X509_ALGOR_value(p7signed->md_algs, 0))
|| (*puiDigestAlgorithm = EVP_MD_sgd(EVP_get_digestbyobj(algor->algorithm))) <= 0) {
SAFerr(SAF_F_SAF_PKCS7_DECODESIGNEDDATA, SAF_R_INVALID_PKCS7_DATA);
goto end;
}
/* get signer's certificate */
if (sk_X509_ALGOR_num(p7signed->cert) != 1
|| !(x509 = sk_X509_ALGOR_value(p7signed->cert, 0))) {
SAFerr(SAF_F_SAF_PKCS7_DECODESIGNEDDATA, SAF_R_INVALID_PKCS7_DATA);
goto end;
}
if ((len = i2d_X509(x509, NULL)) <= 0) {
SAFerr(SAF_F_SAF_PKCS7_DECODESIGNEDDATA, ERR_R_X509_LIB);
goto end;
}
if (*puiSignerCertificateLen < len) {
SAFerr(SAF_F_SAF_PKCS7_DECODESIGNEDDATA, SAF_R_BUFFER_TOO_SMALL);
goto end;
}
if ((len = i2d_X509(x509, &pucSignerCertficate)) <= 0) {
SAFerr(SAF_F_SAF_PKCS7_DECODESIGNEDDATA, ERR_R_X509_LIB);
goto end;
}
*puiSignerCertificateLen = len;
/* get data */
if (!(p7signed->contents)
|| !PKCS7_type_is_data(p7signed->contents)
|| !(data = p7signed->contents->d.data)) {
SAFerr(SAF_F_SAF_PKCS7_DECODESIGNEDDATA, SAF_R_INVALID_PKCS7_DATA);
goto end;
}
if (*puiDataLen < ASN1_OCTET_STRING_length(data)) {
SAFerr(SAF_F_SAF_PKCS7_DECODESIGNEDDATA, SAF_R_BUFFER_TOO_SMALL);
goto end;
}
memcpy(pucData, ASN1_OCTET_STRING_get0_data(data), ASN1_OCTET_STRING_length(data));
*puiDataLen = ASN1_OCTET_STRING_length(data);
memcpy(pucData, ASN1_OCTET_STRING_get0_data(data), *puiDataLen);
/* get signature */
if (sk_SIGNER_INFO_num(p7signed->signer_info) <= 0
|| !(signer_info = sk_SIGNER_INFO_value(p7signed->signer_info, 0))) {
SAFerr(SAF_F_SAF_PKCS7_DECODESIGNEDDATA, SAF_R_INVALID_PKCS7_DATA);
goto end;
}
PKCS7_verify(p7, NULL, chain_store, NULL, outbio, flags);
if (*puiSigLen < ASN1_OCTET_STRING_length(signer_info->enc_digest)) {
SAFerr(SAF_F_SAF_PKCS7_DECODESIGNEDDATA, SAF_R_BUFFER_TOO_SMALL);
goto end;
}
memcpy(pucSig, ASN1_OCTET_STRING_get0_data(signer_info->enc_digest),
ASN1_OCTET_STRING_length(signer_info->enc_digest));
*puiSigLen = ASN1_OCTET_STRING_length(signer_info->enc_digest);
ret = SAR_Ok;
end:
PKCS7_free(p7);
X509_free(x509);
BIO_free(bio);
return ret;
}
@@ -275,7 +348,6 @@ int SAF_Pkcs7_EncodeEnvelopedData(
ret = SAR_CertEncodeErr;
goto end;
}
// FIXME: check usage, valid time of x509
sk_X509_push(certs, x509);
x509 = NULL;
@@ -340,7 +412,7 @@ int SAF_Pkcs7_DecodeEnvelopedData(
if (uiDecContainerNameLen <= 0 || uiDecContainerNameLen > INT_MAX
|| uiDerP7EnvelopedDataLen <= 0 || uiDerP7EnvelopedDataLen > INT_MAX) {
SAFerr(SAF_F_SAF_PKCS7_DECODEENVELOPEDDATA, SAR_R_INVALID_INPUT_LENGTH);
SAFerr(SAF_F_SAF_PKCS7_DECODEENVELOPEDDATA, SAF_R_INVALID_INPUT_LENGTH);
return SAR_IndataLenErr;
}
@@ -352,21 +424,27 @@ int SAF_Pkcs7_DecodeEnvelopedData(
return SAR_IndataLenErr;
}
if (!(pkey = SAF_load_private_key(app, pucDecContainerName,
uiDecContainerNameLen, SGD_PK_ENC))) {
if (!(pkey = SAF_load_private_key(app, (char *)pucDecContainerName,
EVP_PK_EC|EVP_PKT_ENC))) {
SAFerr(SAF_F_SAF_PKCS7_DECODEENVELOPEDDATA, SAF_R_LOAd_PUBLIC_KEY_FAILURE);
goto end;
}
if (!(x509 = SAF_LoadCertificate(app, pucDecContainerName,
uiDecContainerNameLen, SGD_PK_ENC))) {
goto end;
}
if (!(bio = BIO_new(BIO_s_membuf()))) {
goto end;
}
if (!PKCS7_decrypt(p7, pkey, x509, bio, 0)) {
goto end;
}
if (!BIO_get_mem_buf(bio, &buf)) {
goto end;
}
memcpy(pucData, buf->data, buf->length);

17
crypto/saf/saf_pkcs7.d.tmp Normal file
View File

@@ -0,0 +1,17 @@
crypto/saf/saf_pkcs7.o: crypto/saf/saf_pkcs7.c include/openssl/evp.h \
include/openssl/opensslconf.h include/openssl/ossl_typ.h \
include/openssl/e_os2.h include/openssl/symhacks.h \
include/openssl/bio.h include/openssl/crypto.h include/openssl/stack.h \
include/openssl/safestack.h include/openssl/opensslv.h \
include/openssl/objects.h include/openssl/obj_mac.h \
include/openssl/asn1.h include/openssl/bn.h include/openssl/pkcs7.h \
include/openssl/gmapi.h include/openssl/ec.h include/openssl/sm2.h \
include/openssl/err.h include/openssl/lhash.h include/openssl/kdf2.h \
include/openssl/kdf.h include/openssl/x509.h include/openssl/buffer.h \
include/openssl/rsa.h include/openssl/dsa.h include/openssl/dh.h \
include/openssl/sha.h include/openssl/x509_vfy.h \
include/openssl/ecies.h include/openssl/sm3.h include/openssl/sgd.h \
include/openssl/saf.h include/openssl/sdf.h include/openssl/skf.h \
include/openssl/sof.h include/openssl/gmsaf.h crypto/saf/saf_lcl.h \
include/openssl/cmac.h include/openssl/gmsdf.h \
include/openssl/engine.h include/openssl/rand.h include/openssl/ui.h