From d527c492cdf85594b07b2466de3ebc47a8fd68f5 Mon Sep 17 00:00:00 2001 From: Justin Smith Date: Mon, 19 Aug 2024 12:13:04 -0400 Subject: [PATCH] Consolidate EVP_PKEY_CTX_new calls --- aws-lc-rs/src/agreement.rs | 22 +++++++--------------- aws-lc-rs/src/endian.rs | 2 ++ aws-lc-rs/src/evp_pkey.rs | 15 ++++++++++++--- aws-lc-rs/src/kem.rs | 18 +++++------------- aws-lc-rs/src/rsa/encryption/oaep.rs | 22 ++++++---------------- 5 files changed, 32 insertions(+), 47 deletions(-) diff --git a/aws-lc-rs/src/agreement.rs b/aws-lc-rs/src/agreement.rs index 175dfa999f5..b44de4bc59b 100644 --- a/aws-lc-rs/src/agreement.rs +++ b/aws-lc-rs/src/agreement.rs @@ -61,11 +61,11 @@ use crate::fips::indicator_check; use crate::ptr::{ConstPointer, LcPtr}; use crate::{ec, hex}; use aws_lc::{ - EVP_PKEY_CTX_new, EVP_PKEY_CTX_new_id, EVP_PKEY_derive, EVP_PKEY_derive_init, - EVP_PKEY_derive_set_peer, EVP_PKEY_get0_EC_KEY, EVP_PKEY_get_raw_private_key, - EVP_PKEY_get_raw_public_key, EVP_PKEY_keygen, EVP_PKEY_keygen_init, - EVP_PKEY_new_raw_private_key, EVP_PKEY_new_raw_public_key, NID_X9_62_prime256v1, NID_secp384r1, - NID_secp521r1, BIGNUM, EVP_PKEY, EVP_PKEY_X25519, NID_X25519, + EVP_PKEY_CTX_new_id, EVP_PKEY_derive, EVP_PKEY_derive_init, EVP_PKEY_derive_set_peer, + EVP_PKEY_get0_EC_KEY, EVP_PKEY_get_raw_private_key, EVP_PKEY_get_raw_public_key, + EVP_PKEY_keygen, EVP_PKEY_keygen_init, EVP_PKEY_new_raw_private_key, + EVP_PKEY_new_raw_public_key, NID_X9_62_prime256v1, NID_secp384r1, NID_secp521r1, BIGNUM, + EVP_PKEY, EVP_PKEY_X25519, NID_X25519, }; use crate::encoding::{ @@ -704,11 +704,7 @@ fn ec_key_ecdh<'a>( let pub_key_point = ec_point_from_bytes(&ec_group, peer_pub_key_bytes)?; let mut pub_key = evp_pkey_from_public_point(&ec_group, &pub_key_point)?; - let mut pkey_ctx = - // The only modification made by EVP_PKEY_CTX_new to `priv_key` is to increment its - // refcount. The modification is made while holding a global lock: - // https://github.com/aws/aws-lc/blob/61503f7fe72457e12d3446853a5452d175560c49/crypto/refcount_lock.c#L29 - LcPtr::new(unsafe { EVP_PKEY_CTX_new(*priv_key.as_mut_unsafe(), null_mut()) })?; + let mut pkey_ctx = priv_key.create_EVP_PKEY_CTX()?; if 1 != unsafe { EVP_PKEY_derive_init(*pkey_ctx.as_mut()) } { return Err(()); @@ -739,11 +735,7 @@ fn x25519_diffie_hellman<'a>( priv_key: &LcPtr, peer_pub_key: &[u8], ) -> Result<&'a [u8], ()> { - let mut pkey_ctx = - // The only modification made by EVP_PKEY_CTX_new to `priv_key` is to increment its - // refcount. The modification is made while holding a global lock: - // https://github.com/aws/aws-lc/blob/61503f7fe72457e12d3446853a5452d175560c49/crypto/refcount_lock.c#L29 - LcPtr::new(unsafe { EVP_PKEY_CTX_new(*priv_key.as_mut_unsafe(), null_mut()) })?; + let mut pkey_ctx = priv_key.create_EVP_PKEY_CTX()?; if 1 != unsafe { EVP_PKEY_derive_init(*pkey_ctx.as_mut()) } { return Err(()); diff --git a/aws-lc-rs/src/endian.rs b/aws-lc-rs/src/endian.rs index fd733c1450c..c7c9609413b 100644 --- a/aws-lc-rs/src/endian.rs +++ b/aws-lc-rs/src/endian.rs @@ -14,6 +14,8 @@ where const ZERO: Self; } +use core::mem::size_of_val; + pub fn as_byte_slice, T>(x: &[E]) -> &[u8] { unsafe { core::slice::from_raw_parts(x.as_ptr().cast::(), size_of_val(x)) } } diff --git a/aws-lc-rs/src/evp_pkey.rs b/aws-lc-rs/src/evp_pkey.rs index e932308ae6b..848fbf65923 100644 --- a/aws-lc-rs/src/evp_pkey.rs +++ b/aws-lc-rs/src/evp_pkey.rs @@ -8,13 +8,14 @@ use crate::error::{KeyRejected, Unspecified}; use crate::pkcs8::{Document, Version}; use crate::ptr::LcPtr; use aws_lc::{ - EVP_PKEY_bits, EVP_PKEY_get1_EC_KEY, EVP_PKEY_get1_RSA, EVP_PKEY_id, EVP_PKEY_up_ref, - EVP_marshal_private_key, EVP_marshal_private_key_v2, EVP_parse_private_key, EC_KEY, EVP_PKEY, - RSA, + EVP_PKEY_CTX_new, EVP_PKEY_bits, EVP_PKEY_get1_EC_KEY, EVP_PKEY_get1_RSA, EVP_PKEY_id, + EVP_PKEY_up_ref, EVP_marshal_private_key, EVP_marshal_private_key_v2, EVP_parse_private_key, + EC_KEY, EVP_PKEY, EVP_PKEY_CTX, RSA, }; // TODO: Uncomment when MSRV >= 1.64 // use core::ffi::c_int; use std::os::raw::c_int; +use std::ptr::null_mut; impl TryFrom<&[u8]> for LcPtr { type Error = KeyRejected; @@ -116,6 +117,14 @@ impl LcPtr { Ok(Document::new(buffer.into_boxed_slice())) } + + #[allow(non_snake_case)] + pub(crate) fn create_EVP_PKEY_CTX(&self) -> Result, ()> { + // The only modification made by EVP_PKEY_CTX_new to `priv_key` is to increment its + // refcount. The modification is made while holding a global lock: + // https://github.com/aws/aws-lc/blob/61503f7fe72457e12d3446853a5452d175560c49/crypto/refcount_lock.c#L29 + LcPtr::new(unsafe { EVP_PKEY_CTX_new(*self.as_mut_unsafe(), null_mut()) }) + } } impl Clone for LcPtr { diff --git a/aws-lc-rs/src/kem.rs b/aws-lc-rs/src/kem.rs index 72eb25360c3..959f998fd61 100644 --- a/aws-lc-rs/src/kem.rs +++ b/aws-lc-rs/src/kem.rs @@ -56,9 +56,9 @@ use crate::{ }; use alloc::borrow::Cow; use aws_lc::{ - EVP_PKEY_CTX_kem_set_params, EVP_PKEY_CTX_new, EVP_PKEY_CTX_new_id, EVP_PKEY_decapsulate, - EVP_PKEY_encapsulate, EVP_PKEY_get_raw_private_key, EVP_PKEY_get_raw_public_key, - EVP_PKEY_kem_new_raw_public_key, EVP_PKEY_keygen, EVP_PKEY_keygen_init, EVP_PKEY, EVP_PKEY_KEM, + EVP_PKEY_CTX_kem_set_params, EVP_PKEY_CTX_new_id, EVP_PKEY_decapsulate, EVP_PKEY_encapsulate, + EVP_PKEY_get_raw_private_key, EVP_PKEY_get_raw_public_key, EVP_PKEY_kem_new_raw_public_key, + EVP_PKEY_keygen, EVP_PKEY_keygen_init, EVP_PKEY, EVP_PKEY_KEM, }; use core::{cmp::Ordering, ptr::null_mut}; use zeroize::Zeroize; @@ -208,11 +208,7 @@ where let mut shared_secret_len = self.algorithm.shared_secret_size(); let mut shared_secret: Vec = vec![0u8; shared_secret_len]; - let mut ctx = - // The only modification made by EVP_PKEY_CTX_new to `priv_key` is to increment its - // refcount. The modification is made while holding a global lock: - // https://github.com/aws/aws-lc/blob/61503f7fe72457e12d3446853a5452d175560c49/crypto/refcount_lock.c#L29 - LcPtr::new(unsafe { EVP_PKEY_CTX_new(*self.evp_pkey.as_mut_unsafe(), null_mut()) })?; + let mut ctx = self.evp_pkey.create_EVP_PKEY_CTX()?; let ciphertext = ciphertext.as_ref(); @@ -290,11 +286,7 @@ where let mut ciphertext: Vec = vec![0u8; ciphertext_len]; let mut shared_secret: Vec = vec![0u8; shared_secret_len]; - let mut ctx = - // The only modification made by EVP_PKEY_CTX_new to `priv_key` is to increment its - // refcount. The modification is made while holding a global lock: - // https://github.com/aws/aws-lc/blob/61503f7fe72457e12d3446853a5452d175560c49/crypto/refcount_lock.c#L29 - LcPtr::new(unsafe { EVP_PKEY_CTX_new(*self.evp_pkey.as_mut_unsafe(), null_mut()) })?; + let mut ctx = self.evp_pkey.create_EVP_PKEY_CTX()?; if 1 != unsafe { EVP_PKEY_encapsulate( diff --git a/aws-lc-rs/src/rsa/encryption/oaep.rs b/aws-lc-rs/src/rsa/encryption/oaep.rs index 38b1ad6c956..45d4e723a71 100644 --- a/aws-lc-rs/src/rsa/encryption/oaep.rs +++ b/aws-lc-rs/src/rsa/encryption/oaep.rs @@ -10,10 +10,10 @@ use crate::{ ptr::{DetachableLcPtr, LcPtr}, }; use aws_lc::{ - EVP_PKEY_CTX_new, EVP_PKEY_CTX_set0_rsa_oaep_label, EVP_PKEY_CTX_set_rsa_mgf1_md, - EVP_PKEY_CTX_set_rsa_oaep_md, EVP_PKEY_CTX_set_rsa_padding, EVP_PKEY_decrypt, - EVP_PKEY_decrypt_init, EVP_PKEY_encrypt, EVP_PKEY_encrypt_init, EVP_sha1, EVP_sha256, - EVP_sha384, EVP_sha512, OPENSSL_malloc, EVP_MD, EVP_PKEY_CTX, RSA_PKCS1_OAEP_PADDING, + EVP_PKEY_CTX_set0_rsa_oaep_label, EVP_PKEY_CTX_set_rsa_mgf1_md, EVP_PKEY_CTX_set_rsa_oaep_md, + EVP_PKEY_CTX_set_rsa_padding, EVP_PKEY_decrypt, EVP_PKEY_decrypt_init, EVP_PKEY_encrypt, + EVP_PKEY_encrypt_init, EVP_sha1, EVP_sha256, EVP_sha384, EVP_sha512, OPENSSL_malloc, EVP_MD, + EVP_PKEY_CTX, RSA_PKCS1_OAEP_PADDING, }; use core::{fmt::Debug, mem::size_of_val, ptr::null_mut}; use mirai_annotations::verify_unreachable; @@ -112,12 +112,7 @@ impl OaepPublicEncryptingKey { ciphertext: &'ciphertext mut [u8], label: Option<&[u8]>, ) -> Result<&'ciphertext mut [u8], Unspecified> { - let mut pkey_ctx = LcPtr::new(unsafe { - // The only modification made by EVP_PKEY_CTX_new to `priv_key` is to increment its - // refcount. The modification is made while holding a global lock: - // https://github.com/aws/aws-lc/blob/61503f7fe72457e12d3446853a5452d175560c49/crypto/refcount_lock.c#L29 - EVP_PKEY_CTX_new(*self.public_key.0.as_mut_unsafe(), null_mut()) - })?; + let mut pkey_ctx = self.public_key.0.create_EVP_PKEY_CTX()?; if 1 != unsafe { EVP_PKEY_encrypt_init(*pkey_ctx.as_mut()) } { return Err(Unspecified); @@ -221,12 +216,7 @@ impl OaepPrivateDecryptingKey { plaintext: &'plaintext mut [u8], label: Option<&[u8]>, ) -> Result<&'plaintext mut [u8], Unspecified> { - let mut pkey_ctx = LcPtr::new(unsafe { - // The only modification made by EVP_PKEY_CTX_new to `priv_key` is to increment its - // refcount. The modification is made while holding a global lock: - // https://github.com/aws/aws-lc/blob/61503f7fe72457e12d3446853a5452d175560c49/crypto/refcount_lock.c#L29 - EVP_PKEY_CTX_new(*self.private_key.0.as_mut_unsafe(), null_mut()) - })?; + let mut pkey_ctx = self.private_key.0.create_EVP_PKEY_CTX()?; if 1 != unsafe { EVP_PKEY_decrypt_init(*pkey_ctx.as_mut()) } { return Err(Unspecified);