Consolidate EVP_PKEY_CTX_new calls

aws · Aug 19, 2024 · d527c49 · d527c49
1 parent f690069
commit d527c49
Show file tree

Hide file tree

Showing 5 changed files with 32 additions and 47 deletions.
diff --git a/aws-lc-rs/src/agreement.rs b/aws-lc-rs/src/agreement.rs
@@ -61,11 +61,11 @@ use crate::fips::indicator_check;
 use crate::ptr::{ConstPointer, LcPtr};
 use crate::{ec, hex};
 use aws_lc::{
-    EVP_PKEY_CTX_new, EVP_PKEY_CTX_new_id, EVP_PKEY_derive, EVP_PKEY_derive_init,
-    EVP_PKEY_derive_set_peer, EVP_PKEY_get0_EC_KEY, EVP_PKEY_get_raw_private_key,
-    EVP_PKEY_get_raw_public_key, EVP_PKEY_keygen, EVP_PKEY_keygen_init,
-    EVP_PKEY_new_raw_private_key, EVP_PKEY_new_raw_public_key, NID_X9_62_prime256v1, NID_secp384r1,
-    NID_secp521r1, BIGNUM, EVP_PKEY, EVP_PKEY_X25519, NID_X25519,
+    EVP_PKEY_CTX_new_id, EVP_PKEY_derive, EVP_PKEY_derive_init, EVP_PKEY_derive_set_peer,
+    EVP_PKEY_get0_EC_KEY, EVP_PKEY_get_raw_private_key, EVP_PKEY_get_raw_public_key,
+    EVP_PKEY_keygen, EVP_PKEY_keygen_init, EVP_PKEY_new_raw_private_key,
+    EVP_PKEY_new_raw_public_key, NID_X9_62_prime256v1, NID_secp384r1, NID_secp521r1, BIGNUM,
+    EVP_PKEY, EVP_PKEY_X25519, NID_X25519,
 };
 
 use crate::encoding::{
@@ -704,11 +704,7 @@ fn ec_key_ecdh<'a>(
     let pub_key_point = ec_point_from_bytes(&ec_group, peer_pub_key_bytes)?;
     let mut pub_key = evp_pkey_from_public_point(&ec_group, &pub_key_point)?;
 
-    let mut pkey_ctx =
-        // The only modification made by EVP_PKEY_CTX_new to `priv_key` is to increment its
-        // refcount. The modification is made while holding a global lock:
-        // https://github.com/aws/aws-lc/blob/61503f7fe72457e12d3446853a5452d175560c49/crypto/refcount_lock.c#L29
-        LcPtr::new(unsafe { EVP_PKEY_CTX_new(*priv_key.as_mut_unsafe(), null_mut()) })?;
+    let mut pkey_ctx = priv_key.create_EVP_PKEY_CTX()?;
 
     if 1 != unsafe { EVP_PKEY_derive_init(*pkey_ctx.as_mut()) } {
         return Err(());
@@ -739,11 +735,7 @@ fn x25519_diffie_hellman<'a>(
     priv_key: &LcPtr<EVP_PKEY>,
     peer_pub_key: &[u8],
 ) -> Result<&'a [u8], ()> {
-    let mut pkey_ctx =
-        // The only modification made by EVP_PKEY_CTX_new to `priv_key` is to increment its
-        // refcount. The modification is made while holding a global lock:
-        // https://github.com/aws/aws-lc/blob/61503f7fe72457e12d3446853a5452d175560c49/crypto/refcount_lock.c#L29
-        LcPtr::new(unsafe { EVP_PKEY_CTX_new(*priv_key.as_mut_unsafe(), null_mut()) })?;
+    let mut pkey_ctx = priv_key.create_EVP_PKEY_CTX()?;
 
     if 1 != unsafe { EVP_PKEY_derive_init(*pkey_ctx.as_mut()) } {
         return Err(());

diff --git a/aws-lc-rs/src/endian.rs b/aws-lc-rs/src/endian.rs
@@ -14,6 +14,8 @@ where
     const ZERO: Self;
 }
 
+use core::mem::size_of_val;
+
 pub fn as_byte_slice<E: Encoding<T>, T>(x: &[E]) -> &[u8] {
     unsafe { core::slice::from_raw_parts(x.as_ptr().cast::<u8>(), size_of_val(x)) }
 }

diff --git a/aws-lc-rs/src/evp_pkey.rs b/aws-lc-rs/src/evp_pkey.rs
@@ -8,13 +8,14 @@ use crate::error::{KeyRejected, Unspecified};
 use crate::pkcs8::{Document, Version};
 use crate::ptr::LcPtr;
 use aws_lc::{
-    EVP_PKEY_bits, EVP_PKEY_get1_EC_KEY, EVP_PKEY_get1_RSA, EVP_PKEY_id, EVP_PKEY_up_ref,
-    EVP_marshal_private_key, EVP_marshal_private_key_v2, EVP_parse_private_key, EC_KEY, EVP_PKEY,
-    RSA,
+    EVP_PKEY_CTX_new, EVP_PKEY_bits, EVP_PKEY_get1_EC_KEY, EVP_PKEY_get1_RSA, EVP_PKEY_id,
+    EVP_PKEY_up_ref, EVP_marshal_private_key, EVP_marshal_private_key_v2, EVP_parse_private_key,
+    EC_KEY, EVP_PKEY, EVP_PKEY_CTX, RSA,
 };
 // TODO: Uncomment when MSRV >= 1.64
 // use core::ffi::c_int;
 use std::os::raw::c_int;
+use std::ptr::null_mut;
 
 impl TryFrom<&[u8]> for LcPtr<EVP_PKEY> {
     type Error = KeyRejected;
@@ -116,6 +117,14 @@ impl LcPtr<EVP_PKEY> {
 
         Ok(Document::new(buffer.into_boxed_slice()))
     }
+
+    #[allow(non_snake_case)]
+    pub(crate) fn create_EVP_PKEY_CTX(&self) -> Result<LcPtr<EVP_PKEY_CTX>, ()> {
+        // The only modification made by EVP_PKEY_CTX_new to `priv_key` is to increment its
+        // refcount. The modification is made while holding a global lock:
+        // https://github.com/aws/aws-lc/blob/61503f7fe72457e12d3446853a5452d175560c49/crypto/refcount_lock.c#L29
+        LcPtr::new(unsafe { EVP_PKEY_CTX_new(*self.as_mut_unsafe(), null_mut()) })
+    }
 }
 
 impl Clone for LcPtr<EVP_PKEY> {

diff --git a/aws-lc-rs/src/kem.rs b/aws-lc-rs/src/kem.rs
@@ -56,9 +56,9 @@ use crate::{
 };
 use alloc::borrow::Cow;
 use aws_lc::{
-    EVP_PKEY_CTX_kem_set_params, EVP_PKEY_CTX_new, EVP_PKEY_CTX_new_id, EVP_PKEY_decapsulate,
-    EVP_PKEY_encapsulate, EVP_PKEY_get_raw_private_key, EVP_PKEY_get_raw_public_key,
-    EVP_PKEY_kem_new_raw_public_key, EVP_PKEY_keygen, EVP_PKEY_keygen_init, EVP_PKEY, EVP_PKEY_KEM,
+    EVP_PKEY_CTX_kem_set_params, EVP_PKEY_CTX_new_id, EVP_PKEY_decapsulate, EVP_PKEY_encapsulate,
+    EVP_PKEY_get_raw_private_key, EVP_PKEY_get_raw_public_key, EVP_PKEY_kem_new_raw_public_key,
+    EVP_PKEY_keygen, EVP_PKEY_keygen_init, EVP_PKEY, EVP_PKEY_KEM,
 };
 use core::{cmp::Ordering, ptr::null_mut};
 use zeroize::Zeroize;
@@ -208,11 +208,7 @@ where
         let mut shared_secret_len = self.algorithm.shared_secret_size();
         let mut shared_secret: Vec<u8> = vec![0u8; shared_secret_len];
 
-        let mut ctx =
-            // The only modification made by EVP_PKEY_CTX_new to `priv_key` is to increment its
-            // refcount. The modification is made while holding a global lock:
-            // https://github.com/aws/aws-lc/blob/61503f7fe72457e12d3446853a5452d175560c49/crypto/refcount_lock.c#L29
-            LcPtr::new(unsafe { EVP_PKEY_CTX_new(*self.evp_pkey.as_mut_unsafe(), null_mut()) })?;
+        let mut ctx = self.evp_pkey.create_EVP_PKEY_CTX()?;
 
         let ciphertext = ciphertext.as_ref();
 
@@ -290,11 +286,7 @@ where
         let mut ciphertext: Vec<u8> = vec![0u8; ciphertext_len];
         let mut shared_secret: Vec<u8> = vec![0u8; shared_secret_len];
 
-        let mut ctx =
-            // The only modification made by EVP_PKEY_CTX_new to `priv_key` is to increment its
-            // refcount. The modification is made while holding a global lock:
-            // https://github.com/aws/aws-lc/blob/61503f7fe72457e12d3446853a5452d175560c49/crypto/refcount_lock.c#L29
-            LcPtr::new(unsafe { EVP_PKEY_CTX_new(*self.evp_pkey.as_mut_unsafe(), null_mut()) })?;
+        let mut ctx = self.evp_pkey.create_EVP_PKEY_CTX()?;
 
         if 1 != unsafe {
             EVP_PKEY_encapsulate(

diff --git a/aws-lc-rs/src/rsa/encryption/oaep.rs b/aws-lc-rs/src/rsa/encryption/oaep.rs
@@ -10,10 +10,10 @@ use crate::{
     ptr::{DetachableLcPtr, LcPtr},
 };
 use aws_lc::{
-    EVP_PKEY_CTX_new, EVP_PKEY_CTX_set0_rsa_oaep_label, EVP_PKEY_CTX_set_rsa_mgf1_md,
-    EVP_PKEY_CTX_set_rsa_oaep_md, EVP_PKEY_CTX_set_rsa_padding, EVP_PKEY_decrypt,
-    EVP_PKEY_decrypt_init, EVP_PKEY_encrypt, EVP_PKEY_encrypt_init, EVP_sha1, EVP_sha256,
-    EVP_sha384, EVP_sha512, OPENSSL_malloc, EVP_MD, EVP_PKEY_CTX, RSA_PKCS1_OAEP_PADDING,
+    EVP_PKEY_CTX_set0_rsa_oaep_label, EVP_PKEY_CTX_set_rsa_mgf1_md, EVP_PKEY_CTX_set_rsa_oaep_md,
+    EVP_PKEY_CTX_set_rsa_padding, EVP_PKEY_decrypt, EVP_PKEY_decrypt_init, EVP_PKEY_encrypt,
+    EVP_PKEY_encrypt_init, EVP_sha1, EVP_sha256, EVP_sha384, EVP_sha512, OPENSSL_malloc, EVP_MD,
+    EVP_PKEY_CTX, RSA_PKCS1_OAEP_PADDING,
 };
 use core::{fmt::Debug, mem::size_of_val, ptr::null_mut};
 use mirai_annotations::verify_unreachable;
@@ -112,12 +112,7 @@ impl OaepPublicEncryptingKey {
         ciphertext: &'ciphertext mut [u8],
         label: Option<&[u8]>,
     ) -> Result<&'ciphertext mut [u8], Unspecified> {
-        let mut pkey_ctx = LcPtr::new(unsafe {
-            // The only modification made by EVP_PKEY_CTX_new to `priv_key` is to increment its
-            // refcount. The modification is made while holding a global lock:
-            // https://github.com/aws/aws-lc/blob/61503f7fe72457e12d3446853a5452d175560c49/crypto/refcount_lock.c#L29
-            EVP_PKEY_CTX_new(*self.public_key.0.as_mut_unsafe(), null_mut())
-        })?;
+        let mut pkey_ctx = self.public_key.0.create_EVP_PKEY_CTX()?;
 
         if 1 != unsafe { EVP_PKEY_encrypt_init(*pkey_ctx.as_mut()) } {
             return Err(Unspecified);
@@ -221,12 +216,7 @@ impl OaepPrivateDecryptingKey {
         plaintext: &'plaintext mut [u8],
         label: Option<&[u8]>,
     ) -> Result<&'plaintext mut [u8], Unspecified> {
-        let mut pkey_ctx = LcPtr::new(unsafe {
-            // The only modification made by EVP_PKEY_CTX_new to `priv_key` is to increment its
-            // refcount. The modification is made while holding a global lock:
-            // https://github.com/aws/aws-lc/blob/61503f7fe72457e12d3446853a5452d175560c49/crypto/refcount_lock.c#L29
-            EVP_PKEY_CTX_new(*self.private_key.0.as_mut_unsafe(), null_mut())
-        })?;
+        let mut pkey_ctx = self.private_key.0.create_EVP_PKEY_CTX()?;
 
         if 1 != unsafe { EVP_PKEY_decrypt_init(*pkey_ctx.as_mut()) } {
             return Err(Unspecified);