Adding in curl and openssl repos

openssl-3.4.2/crypto/encode_decode/build.info

@@ -0,0 +1,5 @@
+SOURCE[../../libcrypto]=encoder_meth.c encoder_lib.c encoder_pkey.c
+SOURCE[../../libcrypto]=decoder_meth.c decoder_lib.c decoder_pkey.c
+
+SOURCE[../../libcrypto]=encoder_err.c
+SOURCE[../../libcrypto]=decoder_err.c

openssl-3.4.2/crypto/encode_decode/decoder_err.c

@@ -0,0 +1,36 @@
+/*
+ * Generated by util/mkerr.pl DO NOT EDIT
+ * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <openssl/err.h>
+#include <openssl/decodererr.h>
+#include "crypto/decodererr.h"
+
+#ifndef OPENSSL_NO_ERR
+
+static const ERR_STRING_DATA OSSL_DECODER_str_reasons[] = {
+    {ERR_PACK(ERR_LIB_OSSL_DECODER, 0, OSSL_DECODER_R_COULD_NOT_DECODE_OBJECT),
+    "could not decode object"},
+    {ERR_PACK(ERR_LIB_OSSL_DECODER, 0, OSSL_DECODER_R_DECODER_NOT_FOUND),
+    "decoder not found"},
+    {ERR_PACK(ERR_LIB_OSSL_DECODER, 0, OSSL_DECODER_R_MISSING_GET_PARAMS),
+    "missing get params"},
+    {0, NULL}
+};
+
+#endif
+
+int ossl_err_load_OSSL_DECODER_strings(void)
+{
+#ifndef OPENSSL_NO_ERR
+    if (ERR_reason_error_string(OSSL_DECODER_str_reasons[0].error) == NULL)
+        ERR_load_strings_const(OSSL_DECODER_str_reasons);
+#endif
+    return 1;
+}

openssl-3.4.2/crypto/encode_decode/decoder_meth.c

@@ -0,0 +1,672 @@
+/*
+ * Copyright 2020-2023 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <openssl/core.h>
+#include <openssl/core_dispatch.h>
+#include <openssl/decoder.h>
+#include <openssl/ui.h>
+#include "internal/core.h"
+#include "internal/namemap.h"
+#include "internal/property.h"
+#include "internal/provider.h"
+#include "crypto/decoder.h"
+#include "encoder_local.h"
+#include "crypto/context.h"
+
+/*
+ * Decoder can have multiple names, separated with colons in a name string
+ */
+#define NAME_SEPARATOR ':'
+
+/* Simple method structure constructor and destructor */
+static OSSL_DECODER *ossl_decoder_new(void)
+{
+    OSSL_DECODER *decoder = NULL;
+
+    if ((decoder = OPENSSL_zalloc(sizeof(*decoder))) == NULL)
+        return NULL;
+    if (!CRYPTO_NEW_REF(&decoder->base.refcnt, 1)) {
+        OSSL_DECODER_free(decoder);
+        return NULL;
+    }
+
+    return decoder;
+}
+
+int OSSL_DECODER_up_ref(OSSL_DECODER *decoder)
+{
+    int ref = 0;
+
+    CRYPTO_UP_REF(&decoder->base.refcnt, &ref);
+    return 1;
+}
+
+void OSSL_DECODER_free(OSSL_DECODER *decoder)
+{
+    int ref = 0;
+
+    if (decoder == NULL)
+        return;
+
+    CRYPTO_DOWN_REF(&decoder->base.refcnt, &ref);
+    if (ref > 0)
+        return;
+    OPENSSL_free(decoder->base.name);
+    ossl_property_free(decoder->base.parsed_propdef);
+    ossl_provider_free(decoder->base.prov);
+    CRYPTO_FREE_REF(&decoder->base.refcnt);
+    OPENSSL_free(decoder);
+}
+
+/* Data to be passed through ossl_method_construct() */
+struct decoder_data_st {
+    OSSL_LIB_CTX *libctx;
+    int id;                      /* For get_decoder_from_store() */
+    const char *names;           /* For get_decoder_from_store() */
+    const char *propquery;       /* For get_decoder_from_store() */
+
+    OSSL_METHOD_STORE *tmp_store; /* For get_tmp_decoder_store() */
+
+    unsigned int flag_construct_error_occurred : 1;
+};
+
+/*
+ * Generic routines to fetch / create DECODER methods with
+ * ossl_method_construct()
+ */
+
+/* Temporary decoder method store, constructor and destructor */
+static void *get_tmp_decoder_store(void *data)
+{
+    struct decoder_data_st *methdata = data;
+
+    if (methdata->tmp_store == NULL)
+        methdata->tmp_store = ossl_method_store_new(methdata->libctx);
+    return methdata->tmp_store;
+}
+
+static void dealloc_tmp_decoder_store(void *store)
+{
+    if (store != NULL)
+        ossl_method_store_free(store);
+}
+
+/* Get the permanent decoder store */
+static OSSL_METHOD_STORE *get_decoder_store(OSSL_LIB_CTX *libctx)
+{
+    return ossl_lib_ctx_get_data(libctx, OSSL_LIB_CTX_DECODER_STORE_INDEX);
+}
+
+static int reserve_decoder_store(void *store, void *data)
+{
+    struct decoder_data_st *methdata = data;
+
+    if (store == NULL
+        && (store = get_decoder_store(methdata->libctx)) == NULL)
+        return 0;
+
+    return ossl_method_lock_store(store);
+}
+
+static int unreserve_decoder_store(void *store, void *data)
+{
+    struct decoder_data_st *methdata = data;
+
+    if (store == NULL
+        && (store = get_decoder_store(methdata->libctx)) == NULL)
+        return 0;
+
+    return ossl_method_unlock_store(store);
+}
+
+/* Get decoder methods from a store, or put one in */
+static void *get_decoder_from_store(void *store, const OSSL_PROVIDER **prov,
+                                    void *data)
+{
+    struct decoder_data_st *methdata = data;
+    void *method = NULL;
+    int id;
+
+    /*
+     * get_decoder_from_store() is only called to try and get the method
+     * that OSSL_DECODER_fetch() is asking for, and the name or name id are
+     * passed via methdata.
+     */
+    if ((id = methdata->id) == 0 && methdata->names != NULL) {
+        OSSL_NAMEMAP *namemap = ossl_namemap_stored(methdata->libctx);
+        const char *names = methdata->names;
+        const char *q = strchr(names, NAME_SEPARATOR);
+        size_t l = (q == NULL ? strlen(names) : (size_t)(q - names));
+
+        if (namemap == 0)
+            return NULL;
+        id = ossl_namemap_name2num_n(namemap, names, l);
+    }
+
+    if (id == 0)
+        return NULL;
+
+    if (store == NULL
+        && (store = get_decoder_store(methdata->libctx)) == NULL)
+        return NULL;
+
+    if (!ossl_method_store_fetch(store, id, methdata->propquery, prov, &method))
+        return NULL;
+    return method;
+}
+
+static int put_decoder_in_store(void *store, void *method,
+                                const OSSL_PROVIDER *prov,
+                                const char *names, const char *propdef,
+                                void *data)
+{
+    struct decoder_data_st *methdata = data;
+    OSSL_NAMEMAP *namemap;
+    int id;
+    size_t l = 0;
+
+    /*
+     * put_decoder_in_store() is only called with an OSSL_DECODER method that
+     * was successfully created by construct_decoder() below, which means that
+     * all the names should already be stored in the namemap with the same
+     * numeric identity, so just use the first to get that identity.
+     */
+    if (names != NULL) {
+        const char *q = strchr(names, NAME_SEPARATOR);
+
+        l = (q == NULL ? strlen(names) : (size_t)(q - names));
+    }
+
+    if ((namemap = ossl_namemap_stored(methdata->libctx)) == NULL
+        || (id = ossl_namemap_name2num_n(namemap, names, l)) == 0)
+        return 0;
+
+    if (store == NULL && (store = get_decoder_store(methdata->libctx)) == NULL)
+        return 0;
+
+    return ossl_method_store_add(store, prov, id, propdef, method,
+                                 (int (*)(void *))OSSL_DECODER_up_ref,
+                                 (void (*)(void *))OSSL_DECODER_free);
+}
+
+/* Create and populate a decoder method */
+void *ossl_decoder_from_algorithm(int id, const OSSL_ALGORITHM *algodef,
+                                  OSSL_PROVIDER *prov)
+{
+    OSSL_DECODER *decoder = NULL;
+    const OSSL_DISPATCH *fns = algodef->implementation;
+    OSSL_LIB_CTX *libctx = ossl_provider_libctx(prov);
+
+    if ((decoder = ossl_decoder_new()) == NULL)
+        return NULL;
+    decoder->base.id = id;
+    if ((decoder->base.name = ossl_algorithm_get1_first_name(algodef)) == NULL) {
+        OSSL_DECODER_free(decoder);
+        return NULL;
+    }
+    decoder->base.algodef = algodef;
+    if ((decoder->base.parsed_propdef
+         = ossl_parse_property(libctx, algodef->property_definition)) == NULL) {
+        OSSL_DECODER_free(decoder);
+        return NULL;
+    }
+
+    for (; fns->function_id != 0; fns++) {
+        switch (fns->function_id) {
+        case OSSL_FUNC_DECODER_NEWCTX:
+            if (decoder->newctx == NULL)
+                decoder->newctx = OSSL_FUNC_decoder_newctx(fns);
+            break;
+        case OSSL_FUNC_DECODER_FREECTX:
+            if (decoder->freectx == NULL)
+                decoder->freectx = OSSL_FUNC_decoder_freectx(fns);
+            break;
+        case OSSL_FUNC_DECODER_GET_PARAMS:
+            if (decoder->get_params == NULL)
+                decoder->get_params =
+                    OSSL_FUNC_decoder_get_params(fns);
+            break;
+        case OSSL_FUNC_DECODER_GETTABLE_PARAMS:
+            if (decoder->gettable_params == NULL)
+                decoder->gettable_params =
+                    OSSL_FUNC_decoder_gettable_params(fns);
+            break;
+        case OSSL_FUNC_DECODER_SET_CTX_PARAMS:
+            if (decoder->set_ctx_params == NULL)
+                decoder->set_ctx_params =
+                    OSSL_FUNC_decoder_set_ctx_params(fns);
+            break;
+        case OSSL_FUNC_DECODER_SETTABLE_CTX_PARAMS:
+            if (decoder->settable_ctx_params == NULL)
+                decoder->settable_ctx_params =
+                    OSSL_FUNC_decoder_settable_ctx_params(fns);
+            break;
+        case OSSL_FUNC_DECODER_DOES_SELECTION:
+            if (decoder->does_selection == NULL)
+                decoder->does_selection =
+                    OSSL_FUNC_decoder_does_selection(fns);
+            break;
+        case OSSL_FUNC_DECODER_DECODE:
+            if (decoder->decode == NULL)
+                decoder->decode = OSSL_FUNC_decoder_decode(fns);
+            break;
+        case OSSL_FUNC_DECODER_EXPORT_OBJECT:
+            if (decoder->export_object == NULL)
+                decoder->export_object = OSSL_FUNC_decoder_export_object(fns);
+            break;
+        }
+    }
+    /*
+     * Try to check that the method is sensible.
+     * If you have a constructor, you must have a destructor and vice versa.
+     * You must have at least one of the encoding driver functions.
+     */
+    if (!((decoder->newctx == NULL && decoder->freectx == NULL)
+          || (decoder->newctx != NULL && decoder->freectx != NULL))
+        || decoder->decode == NULL) {
+        OSSL_DECODER_free(decoder);
+        ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_INVALID_PROVIDER_FUNCTIONS);
+        return NULL;
+    }
+
+    if (prov != NULL && !ossl_provider_up_ref(prov)) {
+        OSSL_DECODER_free(decoder);
+        return NULL;
+    }
+
+    decoder->base.prov = prov;
+    return decoder;
+}
+
+
+/*
+ * The core fetching functionality passes the names of the implementation.
+ * This function is responsible to getting an identity number for them,
+ * then call ossl_decoder_from_algorithm() with that identity number.
+ */
+static void *construct_decoder(const OSSL_ALGORITHM *algodef,
+                               OSSL_PROVIDER *prov, void *data)
+{
+    /*
+     * This function is only called if get_decoder_from_store() returned
+     * NULL, so it's safe to say that of all the spots to create a new
+     * namemap entry, this is it.  Should the name already exist there, we
+     * know that ossl_namemap_add() will return its corresponding number.
+     */
+    struct decoder_data_st *methdata = data;
+    OSSL_LIB_CTX *libctx = ossl_provider_libctx(prov);
+    OSSL_NAMEMAP *namemap = ossl_namemap_stored(libctx);
+    const char *names = algodef->algorithm_names;
+    int id = ossl_namemap_add_names(namemap, 0, names, NAME_SEPARATOR);
+    void *method = NULL;
+
+    if (id != 0)
+        method = ossl_decoder_from_algorithm(id, algodef, prov);
+
+    /*
+     * Flag to indicate that there was actual construction errors.  This
+     * helps inner_evp_generic_fetch() determine what error it should
+     * record on inaccessible algorithms.
+     */
+    if (method == NULL)
+        methdata->flag_construct_error_occurred = 1;
+
+    return method;
+}
+
+/* Intermediary function to avoid ugly casts, used below */
+static void destruct_decoder(void *method, void *data)
+{
+    OSSL_DECODER_free(method);
+}
+
+static int up_ref_decoder(void *method)
+{
+    return OSSL_DECODER_up_ref(method);
+}
+
+static void free_decoder(void *method)
+{
+    OSSL_DECODER_free(method);
+}
+
+/* Fetching support.  Can fetch by numeric identity or by name */
+static OSSL_DECODER *
+inner_ossl_decoder_fetch(struct decoder_data_st *methdata,
+                         const char *name, const char *properties)
+{
+    OSSL_METHOD_STORE *store = get_decoder_store(methdata->libctx);
+    OSSL_NAMEMAP *namemap = ossl_namemap_stored(methdata->libctx);
+    const char *const propq = properties != NULL ? properties : "";
+    void *method = NULL;
+    int unsupported, id;
+
+    if (store == NULL || namemap == NULL) {
+        ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_INVALID_ARGUMENT);
+        return NULL;
+    }
+
+    id = name != NULL ? ossl_namemap_name2num(namemap, name) : 0;
+
+    /*
+     * If we haven't found the name yet, chances are that the algorithm to
+     * be fetched is unsupported.
+     */
+    unsupported = id == 0;
+
+    if (id == 0
+        || !ossl_method_store_cache_get(store, NULL, id, propq, &method)) {
+        OSSL_METHOD_CONSTRUCT_METHOD mcm = {
+            get_tmp_decoder_store,
+            reserve_decoder_store,
+            unreserve_decoder_store,
+            get_decoder_from_store,
+            put_decoder_in_store,
+            construct_decoder,
+            destruct_decoder
+        };
+        OSSL_PROVIDER *prov = NULL;
+
+        methdata->id = id;
+        methdata->names = name;
+        methdata->propquery = propq;
+        methdata->flag_construct_error_occurred = 0;
+        if ((method = ossl_method_construct(methdata->libctx, OSSL_OP_DECODER,
+                                            &prov, 0 /* !force_cache */,
+                                            &mcm, methdata)) != NULL) {
+            /*
+             * If construction did create a method for us, we know that
+             * there is a correct name_id and meth_id, since those have
+             * already been calculated in get_decoder_from_store() and
+             * put_decoder_in_store() above.
+             */
+            if (id == 0 && name != NULL)
+                id = ossl_namemap_name2num(namemap, name);
+            if (id != 0)
+                ossl_method_store_cache_set(store, prov, id, propq, method,
+                                            up_ref_decoder, free_decoder);
+        }
+
+        /*
+         * If we never were in the constructor, the algorithm to be fetched
+         * is unsupported.
+         */
+        unsupported = !methdata->flag_construct_error_occurred;
+    }
+
+    if ((id != 0 || name != NULL) && method == NULL) {
+        int code = unsupported ? ERR_R_UNSUPPORTED : ERR_R_FETCH_FAILED;
+
+        if (name == NULL)
+            name = ossl_namemap_num2name(namemap, id, 0);
+        ERR_raise_data(ERR_LIB_OSSL_DECODER, code,
+                       "%s, Name (%s : %d), Properties (%s)",
+                       ossl_lib_ctx_get_descriptor(methdata->libctx),
+                       name == NULL ? "<null>" : name, id,
+                       properties == NULL ? "<null>" : properties);
+    }
+
+    return method;
+}
+
+OSSL_DECODER *OSSL_DECODER_fetch(OSSL_LIB_CTX *libctx, const char *name,
+                                 const char *properties)
+{
+    struct decoder_data_st methdata;
+    void *method;
+
+    methdata.libctx = libctx;
+    methdata.tmp_store = NULL;
+    method = inner_ossl_decoder_fetch(&methdata, name, properties);
+    dealloc_tmp_decoder_store(methdata.tmp_store);
+    return method;
+}
+
+int ossl_decoder_store_cache_flush(OSSL_LIB_CTX *libctx)
+{
+    OSSL_METHOD_STORE *store = get_decoder_store(libctx);
+
+    if (store != NULL)
+        return ossl_method_store_cache_flush_all(store);
+    return 1;
+}
+
+int ossl_decoder_store_remove_all_provided(const OSSL_PROVIDER *prov)
+{
+    OSSL_LIB_CTX *libctx = ossl_provider_libctx(prov);
+    OSSL_METHOD_STORE *store = get_decoder_store(libctx);
+
+    if (store != NULL)
+        return ossl_method_store_remove_all_provided(store, prov);
+    return 1;
+}
+
+/*
+ * Library of basic method functions
+ */
+
+const OSSL_PROVIDER *OSSL_DECODER_get0_provider(const OSSL_DECODER *decoder)
+{
+    if (!ossl_assert(decoder != NULL)) {
+        ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+    }
+
+    return decoder->base.prov;
+}
+
+const char *OSSL_DECODER_get0_properties(const OSSL_DECODER *decoder)
+{
+    if (!ossl_assert(decoder != NULL)) {
+        ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+    }
+
+    return decoder->base.algodef->property_definition;
+}
+
+const OSSL_PROPERTY_LIST *
+ossl_decoder_parsed_properties(const OSSL_DECODER *decoder)
+{
+    if (!ossl_assert(decoder != NULL)) {
+        ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+    }
+
+    return decoder->base.parsed_propdef;
+}
+
+int ossl_decoder_get_number(const OSSL_DECODER *decoder)
+{
+    if (!ossl_assert(decoder != NULL)) {
+        ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+    }
+
+    return decoder->base.id;
+}
+
+const char *OSSL_DECODER_get0_name(const OSSL_DECODER *decoder)
+{
+    return decoder->base.name;
+}
+
+const char *OSSL_DECODER_get0_description(const OSSL_DECODER *decoder)
+{
+    return decoder->base.algodef->algorithm_description;
+}
+
+int OSSL_DECODER_is_a(const OSSL_DECODER *decoder, const char *name)
+{
+    if (decoder->base.prov != NULL) {
+        OSSL_LIB_CTX *libctx = ossl_provider_libctx(decoder->base.prov);
+        OSSL_NAMEMAP *namemap = ossl_namemap_stored(libctx);
+
+        return ossl_namemap_name2num(namemap, name) == decoder->base.id;
+    }
+    return 0;
+}
+
+static int resolve_name(OSSL_DECODER *decoder, const char *name)
+{
+    OSSL_LIB_CTX *libctx = ossl_provider_libctx(decoder->base.prov);
+    OSSL_NAMEMAP *namemap = ossl_namemap_stored(libctx);
+
+    return ossl_namemap_name2num(namemap, name);
+}
+
+int ossl_decoder_fast_is_a(OSSL_DECODER *decoder, const char *name, int *id_cache)
+{
+    int id = *id_cache;
+
+    if (id <= 0)
+        *id_cache = id = resolve_name(decoder, name);
+
+    return id > 0 && ossl_decoder_get_number(decoder) == id;
+}
+
+struct do_one_data_st {
+    void (*user_fn)(OSSL_DECODER *decoder, void *arg);
+    void *user_arg;
+};
+
+static void do_one(ossl_unused int id, void *method, void *arg)
+{
+    struct do_one_data_st *data = arg;
+
+    data->user_fn(method, data->user_arg);
+}
+
+void OSSL_DECODER_do_all_provided(OSSL_LIB_CTX *libctx,
+                                  void (*user_fn)(OSSL_DECODER *decoder,
+                                                  void *arg),
+                                  void *user_arg)
+{
+    struct decoder_data_st methdata;
+    struct do_one_data_st data;
+
+    methdata.libctx = libctx;
+    methdata.tmp_store = NULL;
+    (void)inner_ossl_decoder_fetch(&methdata, NULL, NULL /* properties */);
+
+    data.user_fn = user_fn;
+    data.user_arg = user_arg;
+    if (methdata.tmp_store != NULL)
+        ossl_method_store_do_all(methdata.tmp_store, &do_one, &data);
+    ossl_method_store_do_all(get_decoder_store(libctx), &do_one, &data);
+    dealloc_tmp_decoder_store(methdata.tmp_store);
+}
+
+int OSSL_DECODER_names_do_all(const OSSL_DECODER *decoder,
+                              void (*fn)(const char *name, void *data),
+                              void *data)
+{
+    if (decoder == NULL)
+        return 0;
+
+    if (decoder->base.prov != NULL) {
+        OSSL_LIB_CTX *libctx = ossl_provider_libctx(decoder->base.prov);
+        OSSL_NAMEMAP *namemap = ossl_namemap_stored(libctx);
+
+        return ossl_namemap_doall_names(namemap, decoder->base.id, fn, data);
+    }
+
+    return 1;
+}
+
+const OSSL_PARAM *
+OSSL_DECODER_gettable_params(OSSL_DECODER *decoder)
+{
+    if (decoder != NULL && decoder->gettable_params != NULL) {
+        void *provctx = ossl_provider_ctx(OSSL_DECODER_get0_provider(decoder));
+
+        return decoder->gettable_params(provctx);
+    }
+    return NULL;
+}
+
+int OSSL_DECODER_get_params(OSSL_DECODER *decoder, OSSL_PARAM params[])
+{
+    if (decoder != NULL && decoder->get_params != NULL)
+        return decoder->get_params(params);
+    return 0;
+}
+
+const OSSL_PARAM *
+OSSL_DECODER_settable_ctx_params(OSSL_DECODER *decoder)
+{
+    if (decoder != NULL && decoder->settable_ctx_params != NULL) {
+        void *provctx = ossl_provider_ctx(OSSL_DECODER_get0_provider(decoder));
+
+        return decoder->settable_ctx_params(provctx);
+    }
+    return NULL;
+}
+
+/*
+ * Decoder context support
+ */
+
+/*
+ * |encoder| value NULL is valid, and signifies that there is no decoder.
+ * This is useful to provide fallback mechanisms.
+ *  Functions that want to verify if there is a decoder can do so with
+ * OSSL_DECODER_CTX_get_decoder()
+ */
+OSSL_DECODER_CTX *OSSL_DECODER_CTX_new(void)
+{
+    OSSL_DECODER_CTX *ctx;
+
+    ctx = OPENSSL_zalloc(sizeof(*ctx));
+    return ctx;
+}
+
+int OSSL_DECODER_CTX_set_params(OSSL_DECODER_CTX *ctx,
+                                const OSSL_PARAM params[])
+{
+    int ok = 1;
+    size_t i;
+    size_t l;
+
+    if (!ossl_assert(ctx != NULL)) {
+        ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+    }
+
+    if (ctx->decoder_insts == NULL)
+        return 1;
+
+    l = OSSL_DECODER_CTX_get_num_decoders(ctx);
+    for (i = 0; i < l; i++) {
+        OSSL_DECODER_INSTANCE *decoder_inst =
+            sk_OSSL_DECODER_INSTANCE_value(ctx->decoder_insts, i);
+        OSSL_DECODER *decoder =
+            OSSL_DECODER_INSTANCE_get_decoder(decoder_inst);
+        OSSL_DECODER *decoderctx =
+            OSSL_DECODER_INSTANCE_get_decoder_ctx(decoder_inst);
+
+        if (decoderctx == NULL || decoder->set_ctx_params == NULL)
+            continue;
+        if (!decoder->set_ctx_params(decoderctx, params))
+            ok = 0;
+    }
+    return ok;
+}
+
+void OSSL_DECODER_CTX_free(OSSL_DECODER_CTX *ctx)
+{
+    if (ctx != NULL) {
+        if (ctx->cleanup != NULL)
+            ctx->cleanup(ctx->construct_data);
+        sk_OSSL_DECODER_INSTANCE_pop_free(ctx->decoder_insts,
+                                          ossl_decoder_instance_free);
+        ossl_pw_clear_passphrase_data(&ctx->pwdata);
+        OPENSSL_free(ctx);
+    }
+}

openssl-3.4.2/crypto/encode_decode/decoder_pkey.c

@@ -0,0 +1,879 @@
+/*
+ * Copyright 2020-2023 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <openssl/core_names.h>
+#include <openssl/core_object.h>
+#include <openssl/provider.h>
+#include <openssl/evp.h>
+#include <openssl/ui.h>
+#include <openssl/decoder.h>
+#include <openssl/safestack.h>
+#include <openssl/trace.h>
+#include "crypto/evp.h"
+#include "crypto/decoder.h"
+#include "crypto/evp/evp_local.h"
+#include "crypto/lhash.h"
+#include "encoder_local.h"
+#include "internal/namemap.h"
+#include "internal/sizes.h"
+
+int OSSL_DECODER_CTX_set_passphrase(OSSL_DECODER_CTX *ctx,
+                                    const unsigned char *kstr,
+                                    size_t klen)
+{
+    return ossl_pw_set_passphrase(&ctx->pwdata, kstr, klen);
+}
+
+int OSSL_DECODER_CTX_set_passphrase_ui(OSSL_DECODER_CTX *ctx,
+                                       const UI_METHOD *ui_method,
+                                       void *ui_data)
+{
+    return ossl_pw_set_ui_method(&ctx->pwdata, ui_method, ui_data);
+}
+
+int OSSL_DECODER_CTX_set_pem_password_cb(OSSL_DECODER_CTX *ctx,
+                                         pem_password_cb *cb, void *cbarg)
+{
+    return ossl_pw_set_pem_password_cb(&ctx->pwdata, cb, cbarg);
+}
+
+int OSSL_DECODER_CTX_set_passphrase_cb(OSSL_DECODER_CTX *ctx,
+                                       OSSL_PASSPHRASE_CALLBACK *cb,
+                                       void *cbarg)
+{
+    return ossl_pw_set_ossl_passphrase_cb(&ctx->pwdata, cb, cbarg);
+}
+
+/*
+ * Support for OSSL_DECODER_CTX_new_for_pkey:
+ * The construct data, and collecting keymgmt information for it
+ */
+
+DEFINE_STACK_OF(EVP_KEYMGMT)
+
+struct decoder_pkey_data_st {
+    OSSL_LIB_CTX *libctx;
+    char *propq;
+    int selection;
+
+    STACK_OF(EVP_KEYMGMT) *keymgmts;
+    char *object_type;           /* recorded object data type, may be NULL */
+    void **object;               /* Where the result should end up */
+};
+
+static int decoder_construct_pkey(OSSL_DECODER_INSTANCE *decoder_inst,
+                                  const OSSL_PARAM *params,
+                                  void *construct_data)
+{
+    struct decoder_pkey_data_st *data = construct_data;
+    OSSL_DECODER *decoder = OSSL_DECODER_INSTANCE_get_decoder(decoder_inst);
+    void *decoderctx = OSSL_DECODER_INSTANCE_get_decoder_ctx(decoder_inst);
+    const OSSL_PROVIDER *decoder_prov = OSSL_DECODER_get0_provider(decoder);
+    EVP_KEYMGMT *keymgmt = NULL;
+    const OSSL_PROVIDER *keymgmt_prov = NULL;
+    int i, end;
+    /*
+     * |object_ref| points to a provider reference to an object, its exact
+     * contents entirely opaque to us, but may be passed to any provider
+     * function that expects this (such as OSSL_FUNC_keymgmt_load().
+     *
+     * This pointer is considered volatile, i.e. whatever it points at
+     * is assumed to be freed as soon as this function returns.
+     */
+    void *object_ref = NULL;
+    size_t object_ref_sz = 0;
+    const OSSL_PARAM *p;
+
+    p = OSSL_PARAM_locate_const(params, OSSL_OBJECT_PARAM_DATA_TYPE);
+    if (p != NULL) {
+        char *object_type = NULL;
+
+        if (!OSSL_PARAM_get_utf8_string(p, &object_type, 0))
+            return 0;
+        OPENSSL_free(data->object_type);
+        data->object_type = object_type;
+    }
+
+    /*
+     * For stuff that should end up in an EVP_PKEY, we only accept an object
+     * reference for the moment.  This enforces that the key data itself
+     * remains with the provider.
+     */
+    p = OSSL_PARAM_locate_const(params, OSSL_OBJECT_PARAM_REFERENCE);
+    if (p == NULL || p->data_type != OSSL_PARAM_OCTET_STRING)
+        return 0;
+    object_ref = p->data;
+    object_ref_sz = p->data_size;
+
+    /*
+     * First, we try to find a keymgmt that comes from the same provider as
+     * the decoder that passed the params.
+     */
+    end = sk_EVP_KEYMGMT_num(data->keymgmts);
+    for (i = 0; i < end; i++) {
+        keymgmt = sk_EVP_KEYMGMT_value(data->keymgmts, i);
+        keymgmt_prov = EVP_KEYMGMT_get0_provider(keymgmt);
+
+        if (keymgmt_prov == decoder_prov
+            && evp_keymgmt_has_load(keymgmt)
+            && EVP_KEYMGMT_is_a(keymgmt, data->object_type))
+            break;
+    }
+    if (i < end) {
+        /* To allow it to be freed further down */
+        if (!EVP_KEYMGMT_up_ref(keymgmt))
+            return 0;
+    } else if ((keymgmt = EVP_KEYMGMT_fetch(data->libctx,
+                                            data->object_type,
+                                            data->propq)) != NULL) {
+        keymgmt_prov = EVP_KEYMGMT_get0_provider(keymgmt);
+    }
+
+    if (keymgmt != NULL) {
+        EVP_PKEY *pkey = NULL;
+        void *keydata = NULL;
+
+        /*
+         * If the EVP_KEYMGMT and the OSSL_DECODER are from the
+         * same provider, we assume that the KEYMGMT has a key loading
+         * function that can handle the provider reference we hold.
+         *
+         * Otherwise, we export from the decoder and import the
+         * result in the keymgmt.
+         */
+        if (keymgmt_prov == decoder_prov) {
+            keydata = evp_keymgmt_load(keymgmt, object_ref, object_ref_sz);
+        } else {
+            struct evp_keymgmt_util_try_import_data_st import_data;
+
+            import_data.keymgmt = keymgmt;
+            import_data.keydata = NULL;
+            if (data->selection == 0)
+                /* import/export functions do not tolerate 0 selection */
+                import_data.selection = OSSL_KEYMGMT_SELECT_ALL;
+            else
+                import_data.selection = data->selection;
+
+            /*
+             * No need to check for errors here, the value of
+             * |import_data.keydata| is as much an indicator.
+             */
+            (void)decoder->export_object(decoderctx,
+                                         object_ref, object_ref_sz,
+                                         &evp_keymgmt_util_try_import,
+                                         &import_data);
+            keydata = import_data.keydata;
+            import_data.keydata = NULL;
+        }
+
+        if (keydata != NULL
+            && (pkey = evp_keymgmt_util_make_pkey(keymgmt, keydata)) == NULL)
+            evp_keymgmt_freedata(keymgmt, keydata);
+
+        *data->object = pkey;
+
+        /*
+         * evp_keymgmt_util_make_pkey() increments the reference count when
+         * assigning the EVP_PKEY, so we can free the keymgmt here.
+         */
+        EVP_KEYMGMT_free(keymgmt);
+    }
+    /*
+     * We successfully looked through, |*ctx->object| determines if we
+     * actually found something.
+     */
+    return (*data->object != NULL);
+}
+
+static void decoder_clean_pkey_construct_arg(void *construct_data)
+{
+    struct decoder_pkey_data_st *data = construct_data;
+
+    if (data != NULL) {
+        sk_EVP_KEYMGMT_pop_free(data->keymgmts, EVP_KEYMGMT_free);
+        OPENSSL_free(data->propq);
+        OPENSSL_free(data->object_type);
+        OPENSSL_free(data);
+    }
+}
+
+struct collect_data_st {
+    OSSL_LIB_CTX *libctx;
+    OSSL_DECODER_CTX *ctx;
+
+    const char *keytype; /* the keytype requested, if any */
+    int keytype_id; /* if keytype_resolved is set, keymgmt name_id; else 0 */
+    int sm2_id;     /* if keytype_resolved is set and EC, SM2 name_id; else 0 */
+    int total;      /* number of matching results */
+    char error_occurred;
+    char keytype_resolved;
+
+    STACK_OF(EVP_KEYMGMT) *keymgmts;
+};
+
+static void collect_decoder_keymgmt(EVP_KEYMGMT *keymgmt, OSSL_DECODER *decoder,
+                                    void *provctx, struct collect_data_st *data)
+{
+    void *decoderctx = NULL;
+    OSSL_DECODER_INSTANCE *di = NULL;
+
+    /*
+     * We already checked the EVP_KEYMGMT is applicable in check_keymgmt so we
+     * don't check it again here.
+     */
+
+    if (keymgmt->name_id != decoder->base.id)
+        /* Mismatch is not an error, continue. */
+        return;
+
+    if ((decoderctx = decoder->newctx(provctx)) == NULL) {
+        data->error_occurred = 1;
+        return;
+    }
+
+    if ((di = ossl_decoder_instance_new(decoder, decoderctx)) == NULL) {
+        decoder->freectx(decoderctx);
+        data->error_occurred = 1;
+        return;
+    }
+
+    OSSL_TRACE_BEGIN(DECODER) {
+        BIO_printf(trc_out,
+                   "(ctx %p) Checking out decoder %p:\n"
+                   "    %s with %s\n",
+                   (void *)data->ctx, (void *)decoder,
+                   OSSL_DECODER_get0_name(decoder),
+                   OSSL_DECODER_get0_properties(decoder));
+    } OSSL_TRACE_END(DECODER);
+
+    if (!ossl_decoder_ctx_add_decoder_inst(data->ctx, di)) {
+        ossl_decoder_instance_free(di);
+        data->error_occurred = 1;
+        return;
+    }
+
+    ++data->total;
+}
+
+static void collect_decoder(OSSL_DECODER *decoder, void *arg)
+{
+    struct collect_data_st *data = arg;
+    STACK_OF(EVP_KEYMGMT) *keymgmts = data->keymgmts;
+    int i, end_i;
+    EVP_KEYMGMT *keymgmt;
+    const OSSL_PROVIDER *prov;
+    void *provctx;
+
+    if (data->error_occurred)
+        return;
+
+    prov = OSSL_DECODER_get0_provider(decoder);
+    provctx = OSSL_PROVIDER_get0_provider_ctx(prov);
+
+    /*
+     * Either the caller didn't give us a selection, or if they did, the decoder
+     * must tell us if it supports that selection to be accepted. If the decoder
+     * doesn't have |does_selection|, it's seen as taking anything.
+     */
+    if (decoder->does_selection != NULL
+            && !decoder->does_selection(provctx, data->ctx->selection))
+        return;
+
+    OSSL_TRACE_BEGIN(DECODER) {
+        BIO_printf(trc_out,
+                   "(ctx %p) Checking out decoder %p:\n"
+                   "    %s with %s\n",
+                   (void *)data->ctx, (void *)decoder,
+                   OSSL_DECODER_get0_name(decoder),
+                   OSSL_DECODER_get0_properties(decoder));
+    } OSSL_TRACE_END(DECODER);
+
+    end_i = sk_EVP_KEYMGMT_num(keymgmts);
+    for (i = 0; i < end_i; ++i) {
+        keymgmt = sk_EVP_KEYMGMT_value(keymgmts, i);
+
+        collect_decoder_keymgmt(keymgmt, decoder, provctx, data);
+        if (data->error_occurred)
+            return;
+    }
+}
+
+/*
+ * Is this EVP_KEYMGMT applicable given the key type given in the call to
+ * ossl_decoder_ctx_setup_for_pkey (if any)?
+ */
+static int check_keymgmt(EVP_KEYMGMT *keymgmt, struct collect_data_st *data)
+{
+    /* If no keytype was specified, everything matches. */
+    if (data->keytype == NULL)
+        return 1;
+
+    if (!data->keytype_resolved) {
+        /* We haven't cached the IDs from the keytype string yet. */
+        OSSL_NAMEMAP *namemap = ossl_namemap_stored(data->libctx);
+        data->keytype_id = ossl_namemap_name2num(namemap, data->keytype);
+
+        /*
+         * If keytype is a value ambiguously used for both EC and SM2,
+         * collect the ID for SM2 as well.
+         */
+        if (data->keytype_id != 0
+            && (strcmp(data->keytype, "id-ecPublicKey") == 0
+                || strcmp(data->keytype, "1.2.840.10045.2.1") == 0))
+            data->sm2_id = ossl_namemap_name2num(namemap, "SM2");
+
+        /*
+         * If keytype_id is zero the name was not found, but we still
+         * set keytype_resolved to avoid trying all this again.
+         */
+        data->keytype_resolved = 1;
+    }
+
+    /* Specified keytype could not be resolved, so nothing matches. */
+    if (data->keytype_id == 0)
+        return 0;
+
+    /* Does not match the keytype specified, so skip. */
+    if (keymgmt->name_id != data->keytype_id
+        && keymgmt->name_id != data->sm2_id)
+        return 0;
+
+    return 1;
+}
+
+static void collect_keymgmt(EVP_KEYMGMT *keymgmt, void *arg)
+{
+    struct collect_data_st *data = arg;
+
+    if (!check_keymgmt(keymgmt, data))
+        return;
+
+    /*
+     * We have to ref EVP_KEYMGMT here because in the success case,
+     * data->keymgmts is referenced by the constructor we register in the
+     * OSSL_DECODER_CTX. The registered cleanup function
+     * (decoder_clean_pkey_construct_arg) unrefs every element of the stack and
+     * frees it.
+     */
+    if (!EVP_KEYMGMT_up_ref(keymgmt))
+        return;
+
+    if (sk_EVP_KEYMGMT_push(data->keymgmts, keymgmt) <= 0) {
+        EVP_KEYMGMT_free(keymgmt);
+        data->error_occurred = 1;
+    }
+}
+
+/*
+ * This function does the actual binding of decoders to the OSSL_DECODER_CTX. It
+ * searches for decoders matching 'keytype', which is a string like "RSA", "DH",
+ * etc. If 'keytype' is NULL, decoders for all keytypes are bound.
+ */
+static int ossl_decoder_ctx_setup_for_pkey(OSSL_DECODER_CTX *ctx,
+                                           const char *keytype,
+                                           OSSL_LIB_CTX *libctx,
+                                           const char *propquery)
+{
+    int ok = 0;
+    struct decoder_pkey_data_st *process_data = NULL;
+    struct collect_data_st collect_data = { NULL };
+    STACK_OF(EVP_KEYMGMT) *keymgmts = NULL;
+
+    OSSL_TRACE_BEGIN(DECODER) {
+        const char *input_type = ctx->start_input_type;
+        const char *input_structure = ctx->input_structure;
+
+        BIO_printf(trc_out,
+                   "(ctx %p) Looking for decoders producing %s%s%s%s%s%s\n",
+                   (void *)ctx,
+                   keytype != NULL ? keytype : "",
+                   keytype != NULL ? " keys" : "keys of any type",
+                   input_type != NULL ? " from " : "",
+                   input_type != NULL ? input_type : "",
+                   input_structure != NULL ? " with " : "",
+                   input_structure != NULL ? input_structure : "");
+    } OSSL_TRACE_END(DECODER);
+
+    /* Allocate data. */
+    if ((process_data = OPENSSL_zalloc(sizeof(*process_data))) == NULL)
+        goto err;
+    if ((propquery != NULL
+            && (process_data->propq = OPENSSL_strdup(propquery)) == NULL))
+        goto err;
+
+    /* Allocate our list of EVP_KEYMGMTs. */
+    keymgmts = sk_EVP_KEYMGMT_new_null();
+    if (keymgmts == NULL) {
+        ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_CRYPTO_LIB);
+        goto err;
+    }
+
+    process_data->object    = NULL;
+    process_data->libctx    = libctx;
+    process_data->selection = ctx->selection;
+    process_data->keymgmts  = keymgmts;
+
+    /*
+     * Enumerate all keymgmts into a stack.
+     *
+     * We could nest EVP_KEYMGMT_do_all_provided inside
+     * OSSL_DECODER_do_all_provided or vice versa but these functions become
+     * bottlenecks if called repeatedly, which is why we collect the
+     * EVP_KEYMGMTs into a stack here and call both functions only once.
+     *
+     * We resolve the keytype string to a name ID so we don't have to resolve it
+     * multiple times, avoiding repeated calls to EVP_KEYMGMT_is_a, which is a
+     * performance bottleneck. However, we do this lazily on the first call to
+     * collect_keymgmt made by EVP_KEYMGMT_do_all_provided, rather than do it
+     * upfront, as this ensures that the names for all loaded providers have
+     * been registered by the time we try to resolve the keytype string.
+     */
+    collect_data.ctx        = ctx;
+    collect_data.libctx     = libctx;
+    collect_data.keymgmts   = keymgmts;
+    collect_data.keytype    = keytype;
+    EVP_KEYMGMT_do_all_provided(libctx, collect_keymgmt, &collect_data);
+
+    if (collect_data.error_occurred)
+        goto err;
+
+    /* Enumerate all matching decoders. */
+    OSSL_DECODER_do_all_provided(libctx, collect_decoder, &collect_data);
+
+    if (collect_data.error_occurred)
+        goto err;
+
+    OSSL_TRACE_BEGIN(DECODER) {
+        BIO_printf(trc_out,
+                   "(ctx %p) Got %d decoders producing keys\n",
+                   (void *)ctx, collect_data.total);
+    } OSSL_TRACE_END(DECODER);
+
+    /*
+     * Finish initializing the decoder context. If one or more decoders matched
+     * above then the number of decoders attached to the OSSL_DECODER_CTX will
+     * be nonzero. Else nothing was found and we do nothing.
+     */
+    if (OSSL_DECODER_CTX_get_num_decoders(ctx) != 0) {
+        if (!OSSL_DECODER_CTX_set_construct(ctx, decoder_construct_pkey)
+            || !OSSL_DECODER_CTX_set_construct_data(ctx, process_data)
+            || !OSSL_DECODER_CTX_set_cleanup(ctx,
+                                             decoder_clean_pkey_construct_arg))
+            goto err;
+
+        process_data = NULL; /* Avoid it being freed */
+    }
+
+    ok = 1;
+ err:
+    decoder_clean_pkey_construct_arg(process_data);
+    return ok;
+}
+
+/* Only const here because deep_copy requires it */
+static EVP_KEYMGMT *keymgmt_dup(const EVP_KEYMGMT *keymgmt)
+{
+    if (!EVP_KEYMGMT_up_ref((EVP_KEYMGMT *)keymgmt))
+        return NULL;
+
+    return (EVP_KEYMGMT *)keymgmt;
+}
+
+/*
+ * Duplicates a template OSSL_DECODER_CTX that has been setup for an EVP_PKEY
+ * operation and sets up the duplicate for a new operation.
+ * It does not duplicate the pwdata on the assumption that this does not form
+ * part of the template. That is set up later.
+ */
+static OSSL_DECODER_CTX *
+ossl_decoder_ctx_for_pkey_dup(OSSL_DECODER_CTX *src,
+                              EVP_PKEY **pkey,
+                              const char *input_type,
+                              const char *input_structure)
+{
+    OSSL_DECODER_CTX *dest;
+    struct decoder_pkey_data_st *process_data_src, *process_data_dest = NULL;
+
+    if (src == NULL)
+        return NULL;
+
+    if ((dest = OSSL_DECODER_CTX_new()) == NULL) {
+        ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_OSSL_DECODER_LIB);
+        return NULL;
+    }
+
+    if (!OSSL_DECODER_CTX_set_input_type(dest, input_type)
+            || !OSSL_DECODER_CTX_set_input_structure(dest, input_structure)) {
+        ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_OSSL_DECODER_LIB);
+        goto err;
+    }
+    dest->selection = src->selection;
+
+    if (src->decoder_insts != NULL) {
+        dest->decoder_insts
+            = sk_OSSL_DECODER_INSTANCE_deep_copy(src->decoder_insts,
+                                                 ossl_decoder_instance_dup,
+                                                 ossl_decoder_instance_free);
+        if (dest->decoder_insts == NULL) {
+            ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_OSSL_DECODER_LIB);
+            goto err;
+        }
+    }
+
+    if (!OSSL_DECODER_CTX_set_construct(dest,
+                                        OSSL_DECODER_CTX_get_construct(src))) {
+        ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_OSSL_DECODER_LIB);
+        goto err;
+    }
+
+    process_data_src = OSSL_DECODER_CTX_get_construct_data(src);
+    if (process_data_src != NULL) {
+        process_data_dest = OPENSSL_zalloc(sizeof(*process_data_dest));
+        if (process_data_dest == NULL) {
+            ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_CRYPTO_LIB);
+            goto err;
+        }
+        if (process_data_src->propq != NULL) {
+            process_data_dest->propq = OPENSSL_strdup(process_data_src->propq);
+            if (process_data_dest->propq == NULL) {
+                ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_CRYPTO_LIB);
+                goto err;
+            }
+        }
+
+        if (process_data_src->keymgmts != NULL) {
+            process_data_dest->keymgmts
+                = sk_EVP_KEYMGMT_deep_copy(process_data_src->keymgmts,
+                                           keymgmt_dup,
+                                           EVP_KEYMGMT_free);
+            if (process_data_dest->keymgmts == NULL) {
+                ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_EVP_LIB);
+                goto err;
+            }
+        }
+
+        process_data_dest->object    = (void **)pkey;
+        process_data_dest->libctx    = process_data_src->libctx;
+        process_data_dest->selection = process_data_src->selection;
+        if (!OSSL_DECODER_CTX_set_construct_data(dest, process_data_dest)) {
+            ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_OSSL_DECODER_LIB);
+            goto err;
+        }
+        process_data_dest = NULL;
+    }
+
+    if (!OSSL_DECODER_CTX_set_cleanup(dest,
+                                      OSSL_DECODER_CTX_get_cleanup(src))) {
+        ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_OSSL_DECODER_LIB);
+        goto err;
+    }
+
+    return dest;
+ err:
+    if (process_data_dest != NULL) {
+        OPENSSL_free(process_data_dest->propq);
+        sk_EVP_KEYMGMT_pop_free(process_data_dest->keymgmts, EVP_KEYMGMT_free);
+        OPENSSL_free(process_data_dest);
+    }
+    OSSL_DECODER_CTX_free(dest);
+    return NULL;
+}
+
+typedef struct {
+    char *input_type;
+    char *input_structure;
+    char *keytype;
+    int selection;
+    char *propquery;
+    OSSL_DECODER_CTX *template;
+} DECODER_CACHE_ENTRY;
+
+DEFINE_LHASH_OF_EX(DECODER_CACHE_ENTRY);
+
+typedef struct {
+    CRYPTO_RWLOCK *lock;
+    LHASH_OF(DECODER_CACHE_ENTRY) *hashtable;
+} DECODER_CACHE;
+
+static void decoder_cache_entry_free(DECODER_CACHE_ENTRY *entry)
+{
+    if (entry == NULL)
+        return;
+    OPENSSL_free(entry->input_type);
+    OPENSSL_free(entry->input_structure);
+    OPENSSL_free(entry->keytype);
+    OPENSSL_free(entry->propquery);
+    OSSL_DECODER_CTX_free(entry->template);
+    OPENSSL_free(entry);
+}
+
+static unsigned long decoder_cache_entry_hash(const DECODER_CACHE_ENTRY *cache)
+{
+    unsigned long hash = 17;
+
+    hash = (hash * 23)
+           + (cache->propquery == NULL
+              ? 0 : ossl_lh_strcasehash(cache->propquery));
+    hash = (hash * 23)
+           + (cache->input_structure == NULL
+              ? 0  : ossl_lh_strcasehash(cache->input_structure));
+    hash = (hash * 23)
+           + (cache->input_type == NULL
+              ? 0  : ossl_lh_strcasehash(cache->input_type));
+    hash = (hash * 23)
+           + (cache->keytype == NULL
+              ? 0  : ossl_lh_strcasehash(cache->keytype));
+
+    hash ^= cache->selection;
+
+    return hash;
+}
+
+static ossl_inline int nullstrcmp(const char *a, const char *b, int casecmp)
+{
+    if (a == NULL || b == NULL) {
+        if (a == NULL) {
+            if (b == NULL)
+                return 0;
+            else
+                return 1;
+        } else {
+            return -1;
+        }
+    } else {
+        if (casecmp)
+            return OPENSSL_strcasecmp(a, b);
+        else
+            return strcmp(a, b);
+    }
+}
+
+static int decoder_cache_entry_cmp(const DECODER_CACHE_ENTRY *a,
+                                   const DECODER_CACHE_ENTRY *b)
+{
+    int cmp;
+
+    if (a->selection != b->selection)
+        return (a->selection < b->selection) ? -1 : 1;
+
+    cmp = nullstrcmp(a->keytype, b->keytype, 1);
+    if (cmp != 0)
+        return cmp;
+
+    cmp = nullstrcmp(a->input_type, b->input_type, 1);
+    if (cmp != 0)
+        return cmp;
+
+    cmp = nullstrcmp(a->input_structure, b->input_structure, 1);
+    if (cmp != 0)
+        return cmp;
+
+    cmp = nullstrcmp(a->propquery, b->propquery, 0);
+
+    return cmp;
+}
+
+void *ossl_decoder_cache_new(OSSL_LIB_CTX *ctx)
+{
+    DECODER_CACHE *cache = OPENSSL_malloc(sizeof(*cache));
+
+    if (cache == NULL)
+        return NULL;
+
+    cache->lock = CRYPTO_THREAD_lock_new();
+    if (cache->lock == NULL) {
+        OPENSSL_free(cache);
+        return NULL;
+    }
+    cache->hashtable = lh_DECODER_CACHE_ENTRY_new(decoder_cache_entry_hash,
+                                                  decoder_cache_entry_cmp);
+    if (cache->hashtable == NULL) {
+        CRYPTO_THREAD_lock_free(cache->lock);
+        OPENSSL_free(cache);
+        return NULL;
+    }
+
+    return cache;
+}
+
+void ossl_decoder_cache_free(void *vcache)
+{
+    DECODER_CACHE *cache = (DECODER_CACHE *)vcache;
+
+    lh_DECODER_CACHE_ENTRY_doall(cache->hashtable, decoder_cache_entry_free);
+    lh_DECODER_CACHE_ENTRY_free(cache->hashtable);
+    CRYPTO_THREAD_lock_free(cache->lock);
+    OPENSSL_free(cache);
+}
+
+/*
+ * Called whenever a provider gets activated/deactivated. In that case the
+ * decoders that are available might change so we flush our cache.
+ */
+int ossl_decoder_cache_flush(OSSL_LIB_CTX *libctx)
+{
+    DECODER_CACHE *cache
+        = ossl_lib_ctx_get_data(libctx, OSSL_LIB_CTX_DECODER_CACHE_INDEX);
+
+    if (cache == NULL)
+        return 0;
+
+
+    if (!CRYPTO_THREAD_write_lock(cache->lock)) {
+        ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_OSSL_DECODER_LIB);
+        return 0;
+    }
+
+    lh_DECODER_CACHE_ENTRY_doall(cache->hashtable, decoder_cache_entry_free);
+    lh_DECODER_CACHE_ENTRY_flush(cache->hashtable);
+
+    CRYPTO_THREAD_unlock(cache->lock);
+    return 1;
+}
+
+OSSL_DECODER_CTX *
+OSSL_DECODER_CTX_new_for_pkey(EVP_PKEY **pkey,
+                              const char *input_type,
+                              const char *input_structure,
+                              const char *keytype, int selection,
+                              OSSL_LIB_CTX *libctx, const char *propquery)
+{
+    OSSL_DECODER_CTX *ctx = NULL;
+    OSSL_PARAM decoder_params[] = {
+        OSSL_PARAM_END,
+        OSSL_PARAM_END
+    };
+    DECODER_CACHE *cache
+        = ossl_lib_ctx_get_data(libctx, OSSL_LIB_CTX_DECODER_CACHE_INDEX);
+    DECODER_CACHE_ENTRY cacheent, *res, *newcache = NULL;
+
+    if (cache == NULL) {
+        ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_OSSL_DECODER_LIB);
+        return NULL;
+    }
+    if (propquery != NULL)
+        decoder_params[0] = OSSL_PARAM_construct_utf8_string(OSSL_DECODER_PARAM_PROPERTIES,
+                                                             (char *)propquery, 0);
+
+    /* It is safe to cast away the const here */
+    cacheent.input_type = (char *)input_type;
+    cacheent.input_structure = (char *)input_structure;
+    cacheent.keytype = (char *)keytype;
+    cacheent.selection = selection;
+    cacheent.propquery = (char *)propquery;
+
+    if (!CRYPTO_THREAD_read_lock(cache->lock)) {
+        ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_CRYPTO_LIB);
+        return NULL;
+    }
+
+    /* First see if we have a template OSSL_DECODER_CTX */
+    res = lh_DECODER_CACHE_ENTRY_retrieve(cache->hashtable, &cacheent);
+
+    if (res == NULL) {
+        /*
+         * There is no template so we will have to construct one. This will be
+         * time consuming so release the lock and we will later upgrade it to a
+         * write lock.
+         */
+        CRYPTO_THREAD_unlock(cache->lock);
+
+        if ((ctx = OSSL_DECODER_CTX_new()) == NULL) {
+            ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_OSSL_DECODER_LIB);
+            return NULL;
+        }
+
+        OSSL_TRACE_BEGIN(DECODER) {
+            BIO_printf(trc_out,
+                    "(ctx %p) Looking for %s decoders with selection %d\n",
+                    (void *)ctx, keytype, selection);
+            BIO_printf(trc_out, "    input type: %s, input structure: %s\n",
+                    input_type, input_structure);
+        } OSSL_TRACE_END(DECODER);
+
+        if (OSSL_DECODER_CTX_set_input_type(ctx, input_type)
+            && OSSL_DECODER_CTX_set_input_structure(ctx, input_structure)
+            && OSSL_DECODER_CTX_set_selection(ctx, selection)
+            && ossl_decoder_ctx_setup_for_pkey(ctx, keytype, libctx, propquery)
+            && OSSL_DECODER_CTX_add_extra(ctx, libctx, propquery)
+            && (propquery == NULL
+                || OSSL_DECODER_CTX_set_params(ctx, decoder_params))) {
+            OSSL_TRACE_BEGIN(DECODER) {
+                BIO_printf(trc_out, "(ctx %p) Got %d decoders\n",
+                        (void *)ctx, OSSL_DECODER_CTX_get_num_decoders(ctx));
+            } OSSL_TRACE_END(DECODER);
+        } else {
+            ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_OSSL_DECODER_LIB);
+            OSSL_DECODER_CTX_free(ctx);
+            return NULL;
+        }
+
+        newcache = OPENSSL_zalloc(sizeof(*newcache));
+        if (newcache == NULL) {
+            OSSL_DECODER_CTX_free(ctx);
+            return NULL;
+        }
+
+        if (input_type != NULL) {
+            newcache->input_type = OPENSSL_strdup(input_type);
+            if (newcache->input_type == NULL)
+                goto err;
+        }
+        if (input_structure != NULL) {
+            newcache->input_structure = OPENSSL_strdup(input_structure);
+            if (newcache->input_structure == NULL)
+                goto err;
+        }
+        if (keytype != NULL) {
+            newcache->keytype = OPENSSL_strdup(keytype);
+            if (newcache->keytype == NULL)
+                goto err;
+        }
+        if (propquery != NULL) {
+            newcache->propquery = OPENSSL_strdup(propquery);
+            if (newcache->propquery == NULL)
+                goto err;
+        }
+        newcache->selection = selection;
+        newcache->template = ctx;
+
+        if (!CRYPTO_THREAD_write_lock(cache->lock)) {
+            ctx = NULL;
+            ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_CRYPTO_LIB);
+            goto err;
+        }
+        res = lh_DECODER_CACHE_ENTRY_retrieve(cache->hashtable, &cacheent);
+        if (res == NULL) {
+            (void)lh_DECODER_CACHE_ENTRY_insert(cache->hashtable, newcache);
+            if (lh_DECODER_CACHE_ENTRY_error(cache->hashtable)) {
+                ctx = NULL;
+                ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_CRYPTO_LIB);
+                goto err;
+            }
+        } else {
+            /*
+             * We raced with another thread to construct this and lost. Free
+             * what we just created and use the entry from the hashtable instead
+             */
+            decoder_cache_entry_free(newcache);
+            ctx = res->template;
+        }
+    } else {
+        ctx = res->template;
+    }
+
+    ctx = ossl_decoder_ctx_for_pkey_dup(ctx, pkey, input_type, input_structure);
+    CRYPTO_THREAD_unlock(cache->lock);
+
+    return ctx;
+ err:
+    decoder_cache_entry_free(newcache);
+    OSSL_DECODER_CTX_free(ctx);
+    return NULL;
+}

openssl-3.4.2/crypto/encode_decode/encoder_err.c

@@ -0,0 +1,36 @@
+/*
+ * Generated by util/mkerr.pl DO NOT EDIT
+ * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <openssl/err.h>
+#include <openssl/encodererr.h>
+#include "crypto/encodererr.h"
+
+#ifndef OPENSSL_NO_ERR
+
+static const ERR_STRING_DATA OSSL_ENCODER_str_reasons[] = {
+    {ERR_PACK(ERR_LIB_OSSL_ENCODER, 0, OSSL_ENCODER_R_ENCODER_NOT_FOUND),
+    "encoder not found"},
+    {ERR_PACK(ERR_LIB_OSSL_ENCODER, 0, OSSL_ENCODER_R_INCORRECT_PROPERTY_QUERY),
+    "incorrect property query"},
+    {ERR_PACK(ERR_LIB_OSSL_ENCODER, 0, OSSL_ENCODER_R_MISSING_GET_PARAMS),
+    "missing get params"},
+    {0, NULL}
+};
+
+#endif
+
+int ossl_err_load_OSSL_ENCODER_strings(void)
+{
+#ifndef OPENSSL_NO_ERR
+    if (ERR_reason_error_string(OSSL_ENCODER_str_reasons[0].error) == NULL)
+        ERR_load_strings_const(OSSL_ENCODER_str_reasons);
+#endif
+    return 1;
+}

openssl-3.4.2/crypto/encode_decode/encoder_lib.c

@@ -0,0 +1,677 @@
+/*
+ * Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <openssl/core_names.h>
+#include <openssl/bio.h>
+#include <openssl/encoder.h>
+#include <openssl/buffer.h>
+#include <openssl/params.h>
+#include <openssl/provider.h>
+#include <openssl/trace.h>
+#include "internal/bio.h"
+#include "internal/provider.h"
+#include "encoder_local.h"
+
+struct encoder_process_data_st {
+    OSSL_ENCODER_CTX *ctx;
+
+    /* Current BIO */
+    BIO *bio;
+
+    /* Index of the current encoder instance to be processed */
+    int current_encoder_inst_index;
+
+    /* Processing data passed down through recursion */
+    int level;                   /* Recursion level */
+    OSSL_ENCODER_INSTANCE *next_encoder_inst;
+    int count_output_structure;
+
+    /* Processing data passed up through recursion */
+    OSSL_ENCODER_INSTANCE *prev_encoder_inst;
+    unsigned char *running_output;
+    size_t running_output_length;
+    /* Data type = the name of the first succeeding encoder implementation */
+    const char *data_type;
+};
+
+static int encoder_process(struct encoder_process_data_st *data);
+
+int OSSL_ENCODER_to_bio(OSSL_ENCODER_CTX *ctx, BIO *out)
+{
+    struct encoder_process_data_st data;
+
+    memset(&data, 0, sizeof(data));
+    data.ctx = ctx;
+    data.bio = out;
+    data.current_encoder_inst_index = OSSL_ENCODER_CTX_get_num_encoders(ctx);
+
+    if (data.current_encoder_inst_index == 0) {
+        ERR_raise_data(ERR_LIB_OSSL_ENCODER, OSSL_ENCODER_R_ENCODER_NOT_FOUND,
+                       "No encoders were found. For standard encoders you need "
+                       "at least one of the default or base providers "
+                       "available. Did you forget to load them?");
+        return 0;
+    }
+
+    if (ctx->cleanup == NULL || ctx->construct == NULL) {
+        ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_INIT_FAIL);
+        return 0;
+    }
+
+    return encoder_process(&data) > 0;
+}
+
+#ifndef OPENSSL_NO_STDIO
+static BIO *bio_from_file(FILE *fp)
+{
+    BIO *b;
+
+    if ((b = BIO_new(BIO_s_file())) == NULL) {
+        ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_BUF_LIB);
+        return NULL;
+    }
+    BIO_set_fp(b, fp, BIO_NOCLOSE);
+    return b;
+}
+
+int OSSL_ENCODER_to_fp(OSSL_ENCODER_CTX *ctx, FILE *fp)
+{
+    BIO *b = bio_from_file(fp);
+    int ret = 0;
+
+    if (b != NULL)
+        ret = OSSL_ENCODER_to_bio(ctx, b);
+
+    BIO_free(b);
+    return ret;
+}
+#endif
+
+int OSSL_ENCODER_to_data(OSSL_ENCODER_CTX *ctx, unsigned char **pdata,
+                         size_t *pdata_len)
+{
+    BIO *out;
+    BUF_MEM *buf = NULL;
+    int ret = 0;
+
+    if (pdata_len == NULL) {
+        ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+    }
+
+    out = BIO_new(BIO_s_mem());
+
+    if (out != NULL
+        && OSSL_ENCODER_to_bio(ctx, out)
+        && BIO_get_mem_ptr(out, &buf) > 0) {
+        ret = 1; /* Hope for the best. A too small buffer will clear this */
+
+        if (pdata != NULL && *pdata != NULL) {
+            if (*pdata_len < buf->length)
+                /*
+                 * It's tempting to do |*pdata_len = (size_t)buf->length|
+                 * However, it's believed to be confusing more than helpful,
+                 * so we don't.
+                 */
+                ret = 0;
+            else
+                *pdata_len -= buf->length;
+        } else {
+            /* The buffer with the right size is already allocated for us */
+            *pdata_len = (size_t)buf->length;
+        }
+
+        if (ret) {
+            if (pdata != NULL) {
+                if (*pdata != NULL) {
+                    memcpy(*pdata, buf->data, buf->length);
+                    *pdata += buf->length;
+                } else {
+                    /* In this case, we steal the data from BIO_s_mem() */
+                    *pdata = (unsigned char *)buf->data;
+                    buf->data = NULL;
+                }
+            }
+        }
+    }
+    BIO_free(out);
+    return ret;
+}
+
+int OSSL_ENCODER_CTX_set_selection(OSSL_ENCODER_CTX *ctx, int selection)
+{
+    if (!ossl_assert(ctx != NULL)) {
+        ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+    }
+
+    if (!ossl_assert(selection != 0)) {
+        ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_INVALID_ARGUMENT);
+        return 0;
+    }
+
+    ctx->selection = selection;
+    return 1;
+}
+
+int OSSL_ENCODER_CTX_set_output_type(OSSL_ENCODER_CTX *ctx,
+                                     const char *output_type)
+{
+    if (!ossl_assert(ctx != NULL) || !ossl_assert(output_type != NULL)) {
+        ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+    }
+
+    ctx->output_type = output_type;
+    return 1;
+}
+
+int OSSL_ENCODER_CTX_set_output_structure(OSSL_ENCODER_CTX *ctx,
+                                          const char *output_structure)
+{
+    if (!ossl_assert(ctx != NULL) || !ossl_assert(output_structure != NULL)) {
+        ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+    }
+
+    ctx->output_structure = output_structure;
+    return 1;
+}
+
+static OSSL_ENCODER_INSTANCE *ossl_encoder_instance_new(OSSL_ENCODER *encoder,
+                                                        void *encoderctx)
+{
+    OSSL_ENCODER_INSTANCE *encoder_inst = NULL;
+    const OSSL_PROVIDER *prov;
+    OSSL_LIB_CTX *libctx;
+    const OSSL_PROPERTY_LIST *props;
+    const OSSL_PROPERTY_DEFINITION *prop;
+
+    if (!ossl_assert(encoder != NULL)) {
+        ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+    }
+
+    if ((encoder_inst = OPENSSL_zalloc(sizeof(*encoder_inst))) == NULL)
+        return 0;
+
+    if (!OSSL_ENCODER_up_ref(encoder)) {
+        ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_INTERNAL_ERROR);
+        goto err;
+    }
+
+    prov = OSSL_ENCODER_get0_provider(encoder);
+    libctx = ossl_provider_libctx(prov);
+    props = ossl_encoder_parsed_properties(encoder);
+    if (props == NULL) {
+        ERR_raise_data(ERR_LIB_OSSL_DECODER, ERR_R_INVALID_PROPERTY_DEFINITION,
+                       "there are no property definitions with encoder %s",
+                       OSSL_ENCODER_get0_name(encoder));
+        goto err;
+    }
+
+    /* The "output" property is mandatory */
+    prop = ossl_property_find_property(props, libctx, "output");
+    encoder_inst->output_type = ossl_property_get_string_value(libctx, prop);
+    if (encoder_inst->output_type == NULL) {
+        ERR_raise_data(ERR_LIB_OSSL_DECODER, ERR_R_INVALID_PROPERTY_DEFINITION,
+                       "the mandatory 'output' property is missing "
+                       "for encoder %s (properties: %s)",
+                       OSSL_ENCODER_get0_name(encoder),
+                       OSSL_ENCODER_get0_properties(encoder));
+        goto err;
+    }
+
+    /* The "structure" property is optional */
+    prop = ossl_property_find_property(props, libctx, "structure");
+    if (prop != NULL)
+        encoder_inst->output_structure
+            = ossl_property_get_string_value(libctx, prop);
+
+    encoder_inst->encoder = encoder;
+    encoder_inst->encoderctx = encoderctx;
+    return encoder_inst;
+ err:
+    ossl_encoder_instance_free(encoder_inst);
+    return NULL;
+}
+
+void ossl_encoder_instance_free(OSSL_ENCODER_INSTANCE *encoder_inst)
+{
+    if (encoder_inst != NULL) {
+        if (encoder_inst->encoder != NULL)
+            encoder_inst->encoder->freectx(encoder_inst->encoderctx);
+        encoder_inst->encoderctx = NULL;
+        OSSL_ENCODER_free(encoder_inst->encoder);
+        encoder_inst->encoder = NULL;
+        OPENSSL_free(encoder_inst);
+    }
+}
+
+static int ossl_encoder_ctx_add_encoder_inst(OSSL_ENCODER_CTX *ctx,
+                                             OSSL_ENCODER_INSTANCE *ei)
+{
+    int ok;
+
+    if (ctx->encoder_insts == NULL
+        && (ctx->encoder_insts =
+            sk_OSSL_ENCODER_INSTANCE_new_null()) == NULL) {
+        ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_CRYPTO_LIB);
+        return 0;
+    }
+
+    ok = (sk_OSSL_ENCODER_INSTANCE_push(ctx->encoder_insts, ei) > 0);
+    if (ok) {
+        OSSL_TRACE_BEGIN(ENCODER) {
+            BIO_printf(trc_out,
+                       "(ctx %p) Added encoder instance %p (encoder %p):\n"
+                       "    %s with %s\n",
+                       (void *)ctx, (void *)ei, (void *)ei->encoder,
+                       OSSL_ENCODER_get0_name(ei->encoder),
+                       OSSL_ENCODER_get0_properties(ei->encoder));
+        } OSSL_TRACE_END(ENCODER);
+    }
+    return ok;
+}
+
+int OSSL_ENCODER_CTX_add_encoder(OSSL_ENCODER_CTX *ctx, OSSL_ENCODER *encoder)
+{
+    OSSL_ENCODER_INSTANCE *encoder_inst = NULL;
+    const OSSL_PROVIDER *prov = NULL;
+    void *encoderctx = NULL;
+    void *provctx = NULL;
+
+    if (!ossl_assert(ctx != NULL) || !ossl_assert(encoder != NULL)) {
+        ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+    }
+
+    prov = OSSL_ENCODER_get0_provider(encoder);
+    provctx = OSSL_PROVIDER_get0_provider_ctx(prov);
+
+    if ((encoderctx = encoder->newctx(provctx)) == NULL
+        || (encoder_inst =
+            ossl_encoder_instance_new(encoder, encoderctx)) == NULL)
+        goto err;
+    /* Avoid double free of encoderctx on further errors */
+    encoderctx = NULL;
+
+    if (!ossl_encoder_ctx_add_encoder_inst(ctx, encoder_inst))
+        goto err;
+
+    return 1;
+ err:
+    ossl_encoder_instance_free(encoder_inst);
+    if (encoderctx != NULL)
+        encoder->freectx(encoderctx);
+    return 0;
+}
+
+int OSSL_ENCODER_CTX_add_extra(OSSL_ENCODER_CTX *ctx,
+                               OSSL_LIB_CTX *libctx, const char *propq)
+{
+    return 1;
+}
+
+int OSSL_ENCODER_CTX_get_num_encoders(OSSL_ENCODER_CTX *ctx)
+{
+    if (ctx == NULL || ctx->encoder_insts == NULL)
+        return 0;
+    return sk_OSSL_ENCODER_INSTANCE_num(ctx->encoder_insts);
+}
+
+int OSSL_ENCODER_CTX_set_construct(OSSL_ENCODER_CTX *ctx,
+                                   OSSL_ENCODER_CONSTRUCT *construct)
+{
+    if (!ossl_assert(ctx != NULL)) {
+        ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+    }
+    ctx->construct = construct;
+    return 1;
+}
+
+int OSSL_ENCODER_CTX_set_construct_data(OSSL_ENCODER_CTX *ctx,
+                                        void *construct_data)
+{
+    if (!ossl_assert(ctx != NULL)) {
+        ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+    }
+    ctx->construct_data = construct_data;
+    return 1;
+}
+
+int OSSL_ENCODER_CTX_set_cleanup(OSSL_ENCODER_CTX *ctx,
+                                 OSSL_ENCODER_CLEANUP *cleanup)
+{
+    if (!ossl_assert(ctx != NULL)) {
+        ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+    }
+    ctx->cleanup = cleanup;
+    return 1;
+}
+
+OSSL_ENCODER *
+OSSL_ENCODER_INSTANCE_get_encoder(OSSL_ENCODER_INSTANCE *encoder_inst)
+{
+    if (encoder_inst == NULL)
+        return NULL;
+    return encoder_inst->encoder;
+}
+
+void *
+OSSL_ENCODER_INSTANCE_get_encoder_ctx(OSSL_ENCODER_INSTANCE *encoder_inst)
+{
+    if (encoder_inst == NULL)
+        return NULL;
+    return encoder_inst->encoderctx;
+}
+
+const char *
+OSSL_ENCODER_INSTANCE_get_output_type(OSSL_ENCODER_INSTANCE *encoder_inst)
+{
+    if (encoder_inst == NULL)
+        return NULL;
+    return encoder_inst->output_type;
+}
+
+const char *
+OSSL_ENCODER_INSTANCE_get_output_structure(OSSL_ENCODER_INSTANCE *encoder_inst)
+{
+    if (encoder_inst == NULL)
+        return NULL;
+    return encoder_inst->output_structure;
+}
+
+static int encoder_process(struct encoder_process_data_st *data)
+{
+    OSSL_ENCODER_INSTANCE *current_encoder_inst = NULL;
+    OSSL_ENCODER *current_encoder = NULL;
+    OSSL_ENCODER_CTX *current_encoder_ctx = NULL;
+    BIO *allocated_out = NULL;
+    const void *original_data = NULL;
+    OSSL_PARAM abstract[10];
+    const OSSL_PARAM *current_abstract = NULL;
+    int i;
+    int ok = -1;  /* -1 signifies that the lookup loop gave nothing */
+    int top = 0;
+
+    if (data->next_encoder_inst == NULL) {
+        /* First iteration, where we prepare for what is to come */
+
+        data->count_output_structure =
+            data->ctx->output_structure == NULL ? -1 : 0;
+        top = 1;
+    }
+
+    for (i = data->current_encoder_inst_index; i-- > 0;) {
+        OSSL_ENCODER *next_encoder = NULL;
+        const char *current_output_type;
+        const char *current_output_structure;
+        struct encoder_process_data_st new_data;
+
+        if (!top)
+            next_encoder =
+                OSSL_ENCODER_INSTANCE_get_encoder(data->next_encoder_inst);
+
+        current_encoder_inst =
+            sk_OSSL_ENCODER_INSTANCE_value(data->ctx->encoder_insts, i);
+        current_encoder =
+            OSSL_ENCODER_INSTANCE_get_encoder(current_encoder_inst);
+        current_encoder_ctx =
+            OSSL_ENCODER_INSTANCE_get_encoder_ctx(current_encoder_inst);
+        current_output_type =
+            OSSL_ENCODER_INSTANCE_get_output_type(current_encoder_inst);
+        current_output_structure =
+            OSSL_ENCODER_INSTANCE_get_output_structure(current_encoder_inst);
+        memset(&new_data, 0, sizeof(new_data));
+        new_data.ctx = data->ctx;
+        new_data.current_encoder_inst_index = i;
+        new_data.next_encoder_inst = current_encoder_inst;
+        new_data.count_output_structure = data->count_output_structure;
+        new_data.level = data->level + 1;
+
+        OSSL_TRACE_BEGIN(ENCODER) {
+            BIO_printf(trc_out,
+                       "[%d] (ctx %p) Considering encoder instance %p (encoder %p)\n",
+                       data->level, (void *)data->ctx,
+                       (void *)current_encoder_inst, (void *)current_encoder);
+        } OSSL_TRACE_END(ENCODER);
+
+        /*
+         * If this is the top call, we check if the output type of the current
+         * encoder matches the desired output type.
+         * If this isn't the top call, i.e. this is deeper in the recursion,
+         * we instead check if the output type of the current encoder matches
+         * the name of the next encoder (the one found by the parent call).
+         */
+        if (top) {
+            if (data->ctx->output_type != NULL
+                && OPENSSL_strcasecmp(current_output_type,
+                                      data->ctx->output_type) != 0) {
+                OSSL_TRACE_BEGIN(ENCODER) {
+                    BIO_printf(trc_out,
+                               "[%d]    Skipping because current encoder output type (%s) != desired output type (%s)\n",
+                               data->level,
+                               current_output_type, data->ctx->output_type);
+                } OSSL_TRACE_END(ENCODER);
+                continue;
+            }
+        } else {
+            if (!OSSL_ENCODER_is_a(next_encoder, current_output_type)) {
+                OSSL_TRACE_BEGIN(ENCODER) {
+                    BIO_printf(trc_out,
+                               "[%d]    Skipping because current encoder output type (%s) != name of encoder %p\n",
+                               data->level,
+                               current_output_type, (void *)next_encoder);
+                } OSSL_TRACE_END(ENCODER);
+                continue;
+            }
+        }
+
+        /*
+         * If the caller and the current encoder specify an output structure,
+         * Check if they match.  If they do, count the match, otherwise skip
+         * the current encoder.
+         */
+        if (data->ctx->output_structure != NULL
+            && current_output_structure != NULL) {
+            if (OPENSSL_strcasecmp(data->ctx->output_structure,
+                                   current_output_structure) != 0) {
+                OSSL_TRACE_BEGIN(ENCODER) {
+                    BIO_printf(trc_out,
+                               "[%d]    Skipping because current encoder output structure (%s) != ctx output structure (%s)\n",
+                               data->level,
+                               current_output_structure,
+                               data->ctx->output_structure);
+                } OSSL_TRACE_END(ENCODER);
+                continue;
+            }
+
+            data->count_output_structure++;
+        }
+
+        /*
+         * Recurse to process the encoder implementations before the current
+         * one.
+         */
+        ok = encoder_process(&new_data);
+
+        data->prev_encoder_inst = new_data.prev_encoder_inst;
+        data->running_output = new_data.running_output;
+        data->running_output_length = new_data.running_output_length;
+
+        /*
+         * ok == -1     means that the recursion call above gave no further
+         *              encoders, and that the one we're currently at should
+         *              be tried.
+         * ok == 0      means that something failed in the recursion call
+         *              above, making the result unsuitable for a chain.
+         *              In this case, we simply continue to try finding a
+         *              suitable encoder at this recursion level.
+         * ok == 1      means that the recursion call was successful, and we
+         *              try to use the result at this recursion level.
+         */
+        if (ok != 0)
+            break;
+
+        OSSL_TRACE_BEGIN(ENCODER) {
+            BIO_printf(trc_out,
+                       "[%d]    Skipping because recursion level %d failed\n",
+                       data->level, new_data.level);
+        } OSSL_TRACE_END(ENCODER);
+    }
+
+    /*
+     * If |i < 0|, we didn't find any useful encoder in this recursion, so
+     * we do the rest of the process only if |i >= 0|.
+     */
+    if (i < 0) {
+        ok = -1;
+
+        OSSL_TRACE_BEGIN(ENCODER) {
+            BIO_printf(trc_out,
+                       "[%d] (ctx %p) No suitable encoder found\n",
+                       data->level, (void *)data->ctx);
+        } OSSL_TRACE_END(ENCODER);
+    } else {
+        /* Preparations */
+
+        switch (ok) {
+        case 0:
+            break;
+        case -1:
+            /*
+             * We have reached the beginning of the encoder instance sequence,
+             * so we prepare the object to be encoded.
+             */
+
+            /*
+             * |data->count_output_structure| is one of these values:
+             *
+             * -1       There is no desired output structure
+             *  0       There is a desired output structure, and it wasn't
+             *          matched by any of the encoder instances that were
+             *          considered
+             * >0       There is a desired output structure, and at least one
+             *          of the encoder instances matched it
+             */
+            if (data->count_output_structure == 0)
+                return 0;
+
+            original_data =
+                data->ctx->construct(current_encoder_inst,
+                                     data->ctx->construct_data);
+
+            /* Also set the data type, using the encoder implementation name */
+            data->data_type = OSSL_ENCODER_get0_name(current_encoder);
+
+            /* Assume that the constructor recorded an error */
+            if (original_data != NULL)
+                ok = 1;
+            else
+                ok = 0;
+            break;
+        case 1:
+            if (!ossl_assert(data->running_output != NULL)) {
+                ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_INTERNAL_ERROR);
+                ok = 0;
+                break;
+            }
+
+            {
+                /*
+                 * Create an object abstraction from the latest output, which
+                 * was stolen from the previous round.
+                 */
+
+                OSSL_PARAM *abstract_p = abstract;
+                const char *prev_output_structure =
+                    OSSL_ENCODER_INSTANCE_get_output_structure(data->prev_encoder_inst);
+
+                *abstract_p++ =
+                    OSSL_PARAM_construct_utf8_string(OSSL_OBJECT_PARAM_DATA_TYPE,
+                                                     (char *)data->data_type, 0);
+                if (prev_output_structure != NULL)
+                    *abstract_p++ =
+                        OSSL_PARAM_construct_utf8_string(OSSL_OBJECT_PARAM_DATA_STRUCTURE,
+                                                         (char *)prev_output_structure,
+                                                         0);
+                *abstract_p++ =
+                    OSSL_PARAM_construct_octet_string(OSSL_OBJECT_PARAM_DATA,
+                                                      data->running_output,
+                                                      data->running_output_length);
+                *abstract_p = OSSL_PARAM_construct_end();
+                current_abstract = abstract;
+            }
+            break;
+        }
+
+        /* Calling the encoder implementation */
+
+        if (ok) {
+            OSSL_CORE_BIO *cbio = NULL;
+            BIO *current_out = NULL;
+
+            /*
+             * If we're at the last encoder instance to use, we're setting up
+             * final output.  Otherwise, set up an intermediary memory output.
+             */
+            if (top)
+                current_out = data->bio;
+            else if ((current_out = allocated_out = BIO_new(BIO_s_mem()))
+                     == NULL)
+                ok = 0;     /* Assume BIO_new() recorded an error */
+
+            if (ok)
+                ok = (cbio = ossl_core_bio_new_from_bio(current_out)) != NULL;
+            if (ok) {
+                ok = current_encoder->encode(current_encoder_ctx, cbio,
+                                             original_data, current_abstract,
+                                             data->ctx->selection,
+                                             ossl_pw_passphrase_callback_enc,
+                                             &data->ctx->pwdata);
+                OSSL_TRACE_BEGIN(ENCODER) {
+                    BIO_printf(trc_out,
+                               "[%d] (ctx %p) Running encoder instance %p => %d\n",
+                               data->level, (void *)data->ctx,
+                               (void *)current_encoder_inst, ok);
+                } OSSL_TRACE_END(ENCODER);
+            }
+
+            ossl_core_bio_free(cbio);
+            data->prev_encoder_inst = current_encoder_inst;
+        }
+    }
+
+    /* Cleanup and collecting the result */
+
+    OPENSSL_free(data->running_output);
+    data->running_output = NULL;
+
+    /*
+     * Steal the output from the BIO_s_mem, if we did allocate one.
+     * That'll be the data for an object abstraction in the next round.
+     */
+    if (allocated_out != NULL) {
+        BUF_MEM *buf;
+
+        BIO_get_mem_ptr(allocated_out, &buf);
+        data->running_output = (unsigned char *)buf->data;
+        data->running_output_length = buf->length;
+        memset(buf, 0, sizeof(*buf));
+    }
+
+    BIO_free(allocated_out);
+    if (original_data != NULL)
+        data->ctx->cleanup(data->ctx->construct_data);
+    return ok;
+}

openssl-3.4.2/crypto/encode_decode/encoder_local.h

@@ -0,0 +1,167 @@
+/*
+ * Copyright 2019-2023 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <openssl/core_dispatch.h>
+#include <openssl/types.h>
+#include <openssl/safestack.h>
+#include <openssl/encoder.h>
+#include <openssl/decoder.h>
+#include "internal/cryptlib.h"
+#include "internal/passphrase.h"
+#include "internal/property.h"
+#include "internal/refcount.h"
+
+struct ossl_endecode_base_st {
+    OSSL_PROVIDER *prov;
+    int id;
+    char *name;
+    const OSSL_ALGORITHM *algodef;
+    OSSL_PROPERTY_LIST *parsed_propdef;
+
+    CRYPTO_REF_COUNT refcnt;
+};
+
+struct ossl_encoder_st {
+    struct ossl_endecode_base_st base;
+    OSSL_FUNC_encoder_newctx_fn *newctx;
+    OSSL_FUNC_encoder_freectx_fn *freectx;
+    OSSL_FUNC_encoder_get_params_fn *get_params;
+    OSSL_FUNC_encoder_gettable_params_fn *gettable_params;
+    OSSL_FUNC_encoder_set_ctx_params_fn *set_ctx_params;
+    OSSL_FUNC_encoder_settable_ctx_params_fn *settable_ctx_params;
+    OSSL_FUNC_encoder_does_selection_fn *does_selection;
+    OSSL_FUNC_encoder_encode_fn *encode;
+    OSSL_FUNC_encoder_import_object_fn *import_object;
+    OSSL_FUNC_encoder_free_object_fn *free_object;
+};
+
+struct ossl_decoder_st {
+    struct ossl_endecode_base_st base;
+    OSSL_FUNC_decoder_newctx_fn *newctx;
+    OSSL_FUNC_decoder_freectx_fn *freectx;
+    OSSL_FUNC_decoder_get_params_fn *get_params;
+    OSSL_FUNC_decoder_gettable_params_fn *gettable_params;
+    OSSL_FUNC_decoder_set_ctx_params_fn *set_ctx_params;
+    OSSL_FUNC_decoder_settable_ctx_params_fn *settable_ctx_params;
+    OSSL_FUNC_decoder_does_selection_fn *does_selection;
+    OSSL_FUNC_decoder_decode_fn *decode;
+    OSSL_FUNC_decoder_export_object_fn *export_object;
+};
+
+struct ossl_encoder_instance_st {
+    OSSL_ENCODER *encoder;        /* Never NULL */
+    void *encoderctx;             /* Never NULL */
+    const char *output_type;      /* Never NULL */
+    const char *output_structure; /* May be NULL */
+};
+
+DEFINE_STACK_OF(OSSL_ENCODER_INSTANCE)
+
+void ossl_encoder_instance_free(OSSL_ENCODER_INSTANCE *encoder_inst);
+
+struct ossl_encoder_ctx_st {
+    /*
+     * Select what parts of an object will be encoded.  This selection is
+     * bit encoded, and the bits correspond to selection bits available with
+     * the provider side operation.  For example, when encoding an EVP_PKEY,
+     * the OSSL_KEYMGMT_SELECT_ macros are used for this.
+     */
+    int selection;
+    /*
+     * The desired output type.  The encoder implementation must have a
+     * gettable "output-type" parameter that this will match against.
+     */
+    const char *output_type;
+    /*
+     * The desired output structure, if that's relevant for the type of
+     * object being encoded.  It may be used for selection of the starting
+     * encoder implementations in a chain.
+     */
+    const char *output_structure;
+
+    /*
+     * Decoders that are components of any current decoding path.
+     */
+    STACK_OF(OSSL_ENCODER_INSTANCE) *encoder_insts;
+
+    /*
+     * The constructor and destructor of an object to pass to the first
+     * encoder in a chain.
+     */
+    OSSL_ENCODER_CONSTRUCT *construct;
+    OSSL_ENCODER_CLEANUP *cleanup;
+    void *construct_data;
+
+    /* For any function that needs a passphrase reader */
+    struct ossl_passphrase_data_st pwdata;
+};
+
+struct ossl_decoder_instance_st {
+    OSSL_DECODER *decoder;       /* Never NULL */
+    void *decoderctx;            /* Never NULL */
+    const char *input_type;      /* Never NULL */
+    const char *input_structure; /* May be NULL */
+    int input_type_id;
+
+    unsigned int flag_input_structure_was_set : 1;
+};
+
+DEFINE_STACK_OF(OSSL_DECODER_INSTANCE)
+
+struct ossl_decoder_ctx_st {
+    /*
+     * The caller may know the input type of the data they pass.  If not,
+     * this will remain NULL and the decoding functionality will start
+     * with trying to decode with any desencoder in |decoder_insts|,
+     * regardless of their respective input type.
+     */
+    const char *start_input_type;
+    /*
+     * The desired input structure, if that's relevant for the type of
+     * object being encoded.  It may be used for selection of the ending
+     * decoder implementations in a chain, i.e. those chosen using the
+     * expected output data type.
+     */
+    const char *input_structure;
+    /*
+     * Select what parts of an object are expected.  This may affect what
+     * decoder implementations are selected, because there are structures
+     * that look different depending on this selection; for example, EVP_PKEY
+     * objects often have different encoding structures for private keys,
+     * public keys and key parameters.
+     * This selection is bit encoded, and the bits correspond to selection
+     * bits available with the provider side operation.  For example, when
+     * encoding an EVP_PKEY, the OSSL_KEYMGMT_SELECT_ macros are used for
+     * this.
+     */
+    int selection;
+
+    /*
+     * Decoders that are components of any current decoding path.
+     */
+    STACK_OF(OSSL_DECODER_INSTANCE) *decoder_insts;
+
+    /*
+     * The constructors of a decoding, and its caller argument.
+     */
+    OSSL_DECODER_CONSTRUCT *construct;
+    OSSL_DECODER_CLEANUP *cleanup;
+    void *construct_data;
+
+    /* For any function that needs a passphrase reader */
+    struct ossl_passphrase_data_st pwdata;
+};
+
+const OSSL_PROPERTY_LIST *
+ossl_decoder_parsed_properties(const OSSL_DECODER *decoder);
+const OSSL_PROPERTY_LIST *
+ossl_encoder_parsed_properties(const OSSL_ENCODER *encoder);
+
+int ossl_decoder_fast_is_a(OSSL_DECODER *decoder,
+                           const char *name, int *id_cache);

openssl-3.4.2/crypto/encode_decode/encoder_meth.c

@@ -0,0 +1,653 @@
+/*
+ * Copyright 2019-2023 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <openssl/core.h>
+#include <openssl/core_dispatch.h>
+#include <openssl/encoder.h>
+#include <openssl/ui.h>
+#include "internal/core.h"
+#include "internal/namemap.h"
+#include "internal/property.h"
+#include "internal/provider.h"
+#include "crypto/encoder.h"
+#include "encoder_local.h"
+#include "crypto/context.h"
+
+/*
+ * Encoder can have multiple names, separated with colons in a name string
+ */
+#define NAME_SEPARATOR ':'
+
+/* Simple method structure constructor and destructor */
+static OSSL_ENCODER *ossl_encoder_new(void)
+{
+    OSSL_ENCODER *encoder = NULL;
+
+    if ((encoder = OPENSSL_zalloc(sizeof(*encoder))) == NULL)
+        return NULL;
+    if (!CRYPTO_NEW_REF(&encoder->base.refcnt, 1)) {
+        OSSL_ENCODER_free(encoder);
+        return NULL;
+    }
+
+    return encoder;
+}
+
+int OSSL_ENCODER_up_ref(OSSL_ENCODER *encoder)
+{
+    int ref = 0;
+
+    CRYPTO_UP_REF(&encoder->base.refcnt, &ref);
+    return 1;
+}
+
+void OSSL_ENCODER_free(OSSL_ENCODER *encoder)
+{
+    int ref = 0;
+
+    if (encoder == NULL)
+        return;
+
+    CRYPTO_DOWN_REF(&encoder->base.refcnt, &ref);
+    if (ref > 0)
+        return;
+    OPENSSL_free(encoder->base.name);
+    ossl_property_free(encoder->base.parsed_propdef);
+    ossl_provider_free(encoder->base.prov);
+    CRYPTO_FREE_REF(&encoder->base.refcnt);
+    OPENSSL_free(encoder);
+}
+
+/* Data to be passed through ossl_method_construct() */
+struct encoder_data_st {
+    OSSL_LIB_CTX *libctx;
+    int id;                      /* For get_encoder_from_store() */
+    const char *names;           /* For get_encoder_from_store() */
+    const char *propquery;       /* For get_encoder_from_store() */
+
+    OSSL_METHOD_STORE *tmp_store; /* For get_tmp_encoder_store() */
+
+    unsigned int flag_construct_error_occurred : 1;
+};
+
+/*
+ * Generic routines to fetch / create ENCODER methods with
+ * ossl_method_construct()
+ */
+
+/* Temporary encoder method store, constructor and destructor */
+static void *get_tmp_encoder_store(void *data)
+{
+    struct encoder_data_st *methdata = data;
+
+    if (methdata->tmp_store == NULL)
+        methdata->tmp_store = ossl_method_store_new(methdata->libctx);
+    return methdata->tmp_store;
+}
+
+static void dealloc_tmp_encoder_store(void *store)
+{
+    if (store != NULL)
+        ossl_method_store_free(store);
+}
+
+/* Get the permanent encoder store */
+static OSSL_METHOD_STORE *get_encoder_store(OSSL_LIB_CTX *libctx)
+{
+    return ossl_lib_ctx_get_data(libctx, OSSL_LIB_CTX_ENCODER_STORE_INDEX);
+}
+
+static int reserve_encoder_store(void *store, void *data)
+{
+    struct encoder_data_st *methdata = data;
+
+    if (store == NULL
+        && (store = get_encoder_store(methdata->libctx)) == NULL)
+        return 0;
+
+    return ossl_method_lock_store(store);
+}
+
+static int unreserve_encoder_store(void *store, void *data)
+{
+    struct encoder_data_st *methdata = data;
+
+    if (store == NULL
+        && (store = get_encoder_store(methdata->libctx)) == NULL)
+        return 0;
+
+    return ossl_method_unlock_store(store);
+}
+
+/* Get encoder methods from a store, or put one in */
+static void *get_encoder_from_store(void *store, const OSSL_PROVIDER **prov,
+                                    void *data)
+{
+    struct encoder_data_st *methdata = data;
+    void *method = NULL;
+    int id;
+
+    /*
+     * get_encoder_from_store() is only called to try and get the method
+     * that OSSL_ENCODER_fetch() is asking for, and the name or name id are
+     * passed via methdata.
+     */
+    if ((id = methdata->id) == 0 && methdata->names != NULL) {
+        OSSL_NAMEMAP *namemap = ossl_namemap_stored(methdata->libctx);
+        const char *names = methdata->names;
+        const char *q = strchr(names, NAME_SEPARATOR);
+        size_t l = (q == NULL ? strlen(names) : (size_t)(q - names));
+
+        if (namemap == 0)
+            return NULL;
+        id = ossl_namemap_name2num_n(namemap, methdata->names, l);
+    }
+
+    if (id == 0)
+        return NULL;
+
+    if (store == NULL
+        && (store = get_encoder_store(methdata->libctx)) == NULL)
+        return NULL;
+
+    if (!ossl_method_store_fetch(store, id, methdata->propquery, prov, &method))
+        return NULL;
+    return method;
+}
+
+static int put_encoder_in_store(void *store, void *method,
+                                const OSSL_PROVIDER *prov,
+                                const char *names, const char *propdef,
+                                void *data)
+{
+    struct encoder_data_st *methdata = data;
+    OSSL_NAMEMAP *namemap;
+    int id;
+    size_t l = 0;
+
+    /*
+     * put_encoder_in_store() is only called with an OSSL_ENCODER method that
+     * was successfully created by construct_encoder() below, which means that
+     * all the names should already be stored in the namemap with the same
+     * numeric identity, so just use the first to get that identity.
+     */
+    if (names != NULL) {
+        const char *q = strchr(names, NAME_SEPARATOR);
+
+        l = (q == NULL ? strlen(names) : (size_t)(q - names));
+    }
+
+    if ((namemap = ossl_namemap_stored(methdata->libctx)) == NULL
+        || (id = ossl_namemap_name2num_n(namemap, names, l)) == 0)
+        return 0;
+
+    if (store == NULL && (store = get_encoder_store(methdata->libctx)) == NULL)
+        return 0;
+
+    return ossl_method_store_add(store, prov, id, propdef, method,
+                                 (int (*)(void *))OSSL_ENCODER_up_ref,
+                                 (void (*)(void *))OSSL_ENCODER_free);
+}
+
+/* Create and populate a encoder method */
+static void *encoder_from_algorithm(int id, const OSSL_ALGORITHM *algodef,
+                                    OSSL_PROVIDER *prov)
+{
+    OSSL_ENCODER *encoder = NULL;
+    const OSSL_DISPATCH *fns = algodef->implementation;
+    OSSL_LIB_CTX *libctx = ossl_provider_libctx(prov);
+
+    if ((encoder = ossl_encoder_new()) == NULL)
+        return NULL;
+    encoder->base.id = id;
+    if ((encoder->base.name = ossl_algorithm_get1_first_name(algodef)) == NULL) {
+        OSSL_ENCODER_free(encoder);
+        return NULL;
+    }
+    encoder->base.algodef = algodef;
+    if ((encoder->base.parsed_propdef
+         = ossl_parse_property(libctx, algodef->property_definition)) == NULL) {
+        OSSL_ENCODER_free(encoder);
+        return NULL;
+    }
+
+    for (; fns->function_id != 0; fns++) {
+        switch (fns->function_id) {
+        case OSSL_FUNC_ENCODER_NEWCTX:
+            if (encoder->newctx == NULL)
+                encoder->newctx =
+                    OSSL_FUNC_encoder_newctx(fns);
+            break;
+        case OSSL_FUNC_ENCODER_FREECTX:
+            if (encoder->freectx == NULL)
+                encoder->freectx =
+                    OSSL_FUNC_encoder_freectx(fns);
+            break;
+        case OSSL_FUNC_ENCODER_GET_PARAMS:
+            if (encoder->get_params == NULL)
+                encoder->get_params =
+                    OSSL_FUNC_encoder_get_params(fns);
+            break;
+        case OSSL_FUNC_ENCODER_GETTABLE_PARAMS:
+            if (encoder->gettable_params == NULL)
+                encoder->gettable_params =
+                    OSSL_FUNC_encoder_gettable_params(fns);
+            break;
+        case OSSL_FUNC_ENCODER_SET_CTX_PARAMS:
+            if (encoder->set_ctx_params == NULL)
+                encoder->set_ctx_params =
+                    OSSL_FUNC_encoder_set_ctx_params(fns);
+            break;
+        case OSSL_FUNC_ENCODER_SETTABLE_CTX_PARAMS:
+            if (encoder->settable_ctx_params == NULL)
+                encoder->settable_ctx_params =
+                    OSSL_FUNC_encoder_settable_ctx_params(fns);
+            break;
+        case OSSL_FUNC_ENCODER_DOES_SELECTION:
+            if (encoder->does_selection == NULL)
+                encoder->does_selection =
+                    OSSL_FUNC_encoder_does_selection(fns);
+            break;
+        case OSSL_FUNC_ENCODER_ENCODE:
+            if (encoder->encode == NULL)
+                encoder->encode = OSSL_FUNC_encoder_encode(fns);
+            break;
+        case OSSL_FUNC_ENCODER_IMPORT_OBJECT:
+            if (encoder->import_object == NULL)
+                encoder->import_object =
+                    OSSL_FUNC_encoder_import_object(fns);
+            break;
+        case OSSL_FUNC_ENCODER_FREE_OBJECT:
+            if (encoder->free_object == NULL)
+                encoder->free_object =
+                    OSSL_FUNC_encoder_free_object(fns);
+            break;
+        }
+    }
+    /*
+     * Try to check that the method is sensible.
+     * If you have a constructor, you must have a destructor and vice versa.
+     * You must have the encoding driver functions.
+     */
+    if (!((encoder->newctx == NULL && encoder->freectx == NULL)
+          || (encoder->newctx != NULL && encoder->freectx != NULL)
+          || (encoder->import_object != NULL && encoder->free_object != NULL)
+          || (encoder->import_object == NULL && encoder->free_object == NULL))
+        || encoder->encode == NULL) {
+        OSSL_ENCODER_free(encoder);
+        ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_INVALID_PROVIDER_FUNCTIONS);
+        return NULL;
+    }
+
+    if (prov != NULL && !ossl_provider_up_ref(prov)) {
+        OSSL_ENCODER_free(encoder);
+        return NULL;
+    }
+
+    encoder->base.prov = prov;
+    return encoder;
+}
+
+
+/*
+ * The core fetching functionality passes the names of the implementation.
+ * This function is responsible to getting an identity number for them,
+ * then call encoder_from_algorithm() with that identity number.
+ */
+static void *construct_encoder(const OSSL_ALGORITHM *algodef,
+                               OSSL_PROVIDER *prov, void *data)
+{
+    /*
+     * This function is only called if get_encoder_from_store() returned
+     * NULL, so it's safe to say that of all the spots to create a new
+     * namemap entry, this is it.  Should the name already exist there, we
+     * know that ossl_namemap_add() will return its corresponding number.
+     */
+    struct encoder_data_st *methdata = data;
+    OSSL_LIB_CTX *libctx = ossl_provider_libctx(prov);
+    OSSL_NAMEMAP *namemap = ossl_namemap_stored(libctx);
+    const char *names = algodef->algorithm_names;
+    int id = ossl_namemap_add_names(namemap, 0, names, NAME_SEPARATOR);
+    void *method = NULL;
+
+    if (id != 0)
+        method = encoder_from_algorithm(id, algodef, prov);
+
+    /*
+     * Flag to indicate that there was actual construction errors.  This
+     * helps inner_evp_generic_fetch() determine what error it should
+     * record on inaccessible algorithms.
+     */
+    if (method == NULL)
+        methdata->flag_construct_error_occurred = 1;
+
+    return method;
+}
+
+/* Intermediary function to avoid ugly casts, used below */
+static void destruct_encoder(void *method, void *data)
+{
+    OSSL_ENCODER_free(method);
+}
+
+static int up_ref_encoder(void *method)
+{
+    return OSSL_ENCODER_up_ref(method);
+}
+
+static void free_encoder(void *method)
+{
+    OSSL_ENCODER_free(method);
+}
+
+/* Fetching support.  Can fetch by numeric identity or by name */
+static OSSL_ENCODER *
+inner_ossl_encoder_fetch(struct encoder_data_st *methdata,
+                         const char *name, const char *properties)
+{
+    OSSL_METHOD_STORE *store = get_encoder_store(methdata->libctx);
+    OSSL_NAMEMAP *namemap = ossl_namemap_stored(methdata->libctx);
+    const char *const propq = properties != NULL ? properties : "";
+    void *method = NULL;
+    int unsupported, id;
+
+    if (store == NULL || namemap == NULL) {
+        ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_INVALID_ARGUMENT);
+        return NULL;
+    }
+
+    id = name != NULL ? ossl_namemap_name2num(namemap, name) : 0;
+
+    /*
+     * If we haven't found the name yet, chances are that the algorithm to
+     * be fetched is unsupported.
+     */
+    unsupported = id == 0;
+
+    if (id == 0
+        || !ossl_method_store_cache_get(store, NULL, id, propq, &method)) {
+        OSSL_METHOD_CONSTRUCT_METHOD mcm = {
+            get_tmp_encoder_store,
+            reserve_encoder_store,
+            unreserve_encoder_store,
+            get_encoder_from_store,
+            put_encoder_in_store,
+            construct_encoder,
+            destruct_encoder
+        };
+        OSSL_PROVIDER *prov = NULL;
+
+        methdata->id = id;
+        methdata->names = name;
+        methdata->propquery = propq;
+        methdata->flag_construct_error_occurred = 0;
+        if ((method = ossl_method_construct(methdata->libctx, OSSL_OP_ENCODER,
+                                            &prov, 0 /* !force_cache */,
+                                            &mcm, methdata)) != NULL) {
+            /*
+             * If construction did create a method for us, we know that
+             * there is a correct name_id and meth_id, since those have
+             * already been calculated in get_encoder_from_store() and
+             * put_encoder_in_store() above.
+             */
+            if (id == 0)
+                id = ossl_namemap_name2num(namemap, name);
+            ossl_method_store_cache_set(store, prov, id, propq, method,
+                                        up_ref_encoder, free_encoder);
+        }
+
+        /*
+         * If we never were in the constructor, the algorithm to be fetched
+         * is unsupported.
+         */
+        unsupported = !methdata->flag_construct_error_occurred;
+    }
+
+    if ((id != 0 || name != NULL) && method == NULL) {
+        int code = unsupported ? ERR_R_UNSUPPORTED : ERR_R_FETCH_FAILED;
+
+        if (name == NULL)
+            name = ossl_namemap_num2name(namemap, id, 0);
+        ERR_raise_data(ERR_LIB_OSSL_ENCODER, code,
+                       "%s, Name (%s : %d), Properties (%s)",
+                       ossl_lib_ctx_get_descriptor(methdata->libctx),
+                       name == NULL ? "<null>" : name, id,
+                       properties == NULL ? "<null>" : properties);
+    }
+
+    return method;
+}
+
+OSSL_ENCODER *OSSL_ENCODER_fetch(OSSL_LIB_CTX *libctx, const char *name,
+                                 const char *properties)
+{
+    struct encoder_data_st methdata;
+    void *method;
+
+    methdata.libctx = libctx;
+    methdata.tmp_store = NULL;
+    method = inner_ossl_encoder_fetch(&methdata, name, properties);
+    dealloc_tmp_encoder_store(methdata.tmp_store);
+    return method;
+}
+
+int ossl_encoder_store_cache_flush(OSSL_LIB_CTX *libctx)
+{
+    OSSL_METHOD_STORE *store = get_encoder_store(libctx);
+
+    if (store != NULL)
+        return ossl_method_store_cache_flush_all(store);
+    return 1;
+}
+
+int ossl_encoder_store_remove_all_provided(const OSSL_PROVIDER *prov)
+{
+    OSSL_LIB_CTX *libctx = ossl_provider_libctx(prov);
+    OSSL_METHOD_STORE *store = get_encoder_store(libctx);
+
+    if (store != NULL)
+        return ossl_method_store_remove_all_provided(store, prov);
+    return 1;
+}
+
+/*
+ * Library of basic method functions
+ */
+
+const OSSL_PROVIDER *OSSL_ENCODER_get0_provider(const OSSL_ENCODER *encoder)
+{
+    if (!ossl_assert(encoder != NULL)) {
+        ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+    }
+
+    return encoder->base.prov;
+}
+
+const char *OSSL_ENCODER_get0_properties(const OSSL_ENCODER *encoder)
+{
+    if (!ossl_assert(encoder != NULL)) {
+        ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+    }
+
+    return encoder->base.algodef->property_definition;
+}
+
+const OSSL_PROPERTY_LIST *
+ossl_encoder_parsed_properties(const OSSL_ENCODER *encoder)
+{
+    if (!ossl_assert(encoder != NULL)) {
+        ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+    }
+
+    return encoder->base.parsed_propdef;
+}
+
+int ossl_encoder_get_number(const OSSL_ENCODER *encoder)
+{
+    if (!ossl_assert(encoder != NULL)) {
+        ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+    }
+
+    return encoder->base.id;
+}
+
+const char *OSSL_ENCODER_get0_name(const OSSL_ENCODER *encoder)
+{
+    return encoder->base.name;
+}
+
+const char *OSSL_ENCODER_get0_description(const OSSL_ENCODER *encoder)
+{
+    return encoder->base.algodef->algorithm_description;
+}
+
+int OSSL_ENCODER_is_a(const OSSL_ENCODER *encoder, const char *name)
+{
+    if (encoder->base.prov != NULL) {
+        OSSL_LIB_CTX *libctx = ossl_provider_libctx(encoder->base.prov);
+        OSSL_NAMEMAP *namemap = ossl_namemap_stored(libctx);
+
+        return ossl_namemap_name2num(namemap, name) == encoder->base.id;
+    }
+    return 0;
+}
+
+struct do_one_data_st {
+    void (*user_fn)(OSSL_ENCODER *encoder, void *arg);
+    void *user_arg;
+};
+
+static void do_one(ossl_unused int id, void *method, void *arg)
+{
+    struct do_one_data_st *data = arg;
+
+    data->user_fn(method, data->user_arg);
+}
+
+void OSSL_ENCODER_do_all_provided(OSSL_LIB_CTX *libctx,
+                                  void (*user_fn)(OSSL_ENCODER *encoder,
+                                                  void *arg),
+                                  void *user_arg)
+{
+    struct encoder_data_st methdata;
+    struct do_one_data_st data;
+
+    methdata.libctx = libctx;
+    methdata.tmp_store = NULL;
+    (void)inner_ossl_encoder_fetch(&methdata, NULL, NULL /* properties */);
+
+    data.user_fn = user_fn;
+    data.user_arg = user_arg;
+    if (methdata.tmp_store != NULL)
+        ossl_method_store_do_all(methdata.tmp_store, &do_one, &data);
+    ossl_method_store_do_all(get_encoder_store(libctx), &do_one, &data);
+    dealloc_tmp_encoder_store(methdata.tmp_store);
+}
+
+int OSSL_ENCODER_names_do_all(const OSSL_ENCODER *encoder,
+                              void (*fn)(const char *name, void *data),
+                              void *data)
+{
+    if (encoder == NULL)
+        return 0;
+
+    if (encoder->base.prov != NULL) {
+        OSSL_LIB_CTX *libctx = ossl_provider_libctx(encoder->base.prov);
+        OSSL_NAMEMAP *namemap = ossl_namemap_stored(libctx);
+
+        return ossl_namemap_doall_names(namemap, encoder->base.id, fn, data);
+    }
+
+    return 1;
+}
+
+const OSSL_PARAM *
+OSSL_ENCODER_gettable_params(OSSL_ENCODER *encoder)
+{
+    if (encoder != NULL && encoder->gettable_params != NULL) {
+        void *provctx = ossl_provider_ctx(OSSL_ENCODER_get0_provider(encoder));
+
+        return encoder->gettable_params(provctx);
+    }
+    return NULL;
+}
+
+int OSSL_ENCODER_get_params(OSSL_ENCODER *encoder, OSSL_PARAM params[])
+{
+    if (encoder != NULL && encoder->get_params != NULL)
+        return encoder->get_params(params);
+    return 0;
+}
+
+const OSSL_PARAM *OSSL_ENCODER_settable_ctx_params(OSSL_ENCODER *encoder)
+{
+    if (encoder != NULL && encoder->settable_ctx_params != NULL) {
+        void *provctx = ossl_provider_ctx(OSSL_ENCODER_get0_provider(encoder));
+
+        return encoder->settable_ctx_params(provctx);
+    }
+    return NULL;
+}
+
+/*
+ * Encoder context support
+ */
+
+OSSL_ENCODER_CTX *OSSL_ENCODER_CTX_new(void)
+{
+    OSSL_ENCODER_CTX *ctx;
+
+    ctx = OPENSSL_zalloc(sizeof(*ctx));
+    return ctx;
+}
+
+int OSSL_ENCODER_CTX_set_params(OSSL_ENCODER_CTX *ctx,
+                                const OSSL_PARAM params[])
+{
+    int ok = 1;
+    size_t i;
+    size_t l;
+
+    if (!ossl_assert(ctx != NULL)) {
+        ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+    }
+
+    if (ctx->encoder_insts == NULL)
+        return 1;
+
+    l = OSSL_ENCODER_CTX_get_num_encoders(ctx);
+    for (i = 0; i < l; i++) {
+        OSSL_ENCODER_INSTANCE *encoder_inst =
+            sk_OSSL_ENCODER_INSTANCE_value(ctx->encoder_insts, i);
+        OSSL_ENCODER *encoder = OSSL_ENCODER_INSTANCE_get_encoder(encoder_inst);
+        void *encoderctx = OSSL_ENCODER_INSTANCE_get_encoder_ctx(encoder_inst);
+
+        if (encoderctx == NULL || encoder->set_ctx_params == NULL)
+            continue;
+        if (!encoder->set_ctx_params(encoderctx, params))
+            ok = 0;
+    }
+    return ok;
+}
+
+void OSSL_ENCODER_CTX_free(OSSL_ENCODER_CTX *ctx)
+{
+    if (ctx != NULL) {
+        sk_OSSL_ENCODER_INSTANCE_pop_free(ctx->encoder_insts,
+                                          ossl_encoder_instance_free);
+        OPENSSL_free(ctx->construct_data);
+        ossl_pw_clear_passphrase_data(&ctx->pwdata);
+        OPENSSL_free(ctx);
+    }
+}

openssl-3.4.2/crypto/encode_decode/encoder_pkey.c

@@ -0,0 +1,409 @@
+/*
+ * Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <openssl/err.h>
+#include <openssl/ui.h>
+#include <openssl/params.h>
+#include <openssl/encoder.h>
+#include <openssl/core_names.h>
+#include <openssl/provider.h>
+#include <openssl/safestack.h>
+#include <openssl/trace.h>
+#include "internal/provider.h"
+#include "internal/property.h"
+#include "internal/namemap.h"
+#include "crypto/evp.h"
+#include "encoder_local.h"
+
+DEFINE_STACK_OF(OSSL_ENCODER)
+
+int OSSL_ENCODER_CTX_set_cipher(OSSL_ENCODER_CTX *ctx,
+                                const char *cipher_name,
+                                const char *propquery)
+{
+    OSSL_PARAM params[] = { OSSL_PARAM_END, OSSL_PARAM_END, OSSL_PARAM_END };
+
+    params[0] =
+        OSSL_PARAM_construct_utf8_string(OSSL_ENCODER_PARAM_CIPHER,
+                                         (void *)cipher_name, 0);
+    params[1] =
+        OSSL_PARAM_construct_utf8_string(OSSL_ENCODER_PARAM_PROPERTIES,
+                                         (void *)propquery, 0);
+
+    return OSSL_ENCODER_CTX_set_params(ctx, params);
+}
+
+int OSSL_ENCODER_CTX_set_passphrase(OSSL_ENCODER_CTX *ctx,
+                                    const unsigned char *kstr,
+                                    size_t klen)
+{
+    return ossl_pw_set_passphrase(&ctx->pwdata, kstr, klen);
+}
+
+int OSSL_ENCODER_CTX_set_passphrase_ui(OSSL_ENCODER_CTX *ctx,
+                                       const UI_METHOD *ui_method,
+                                       void *ui_data)
+{
+    return ossl_pw_set_ui_method(&ctx->pwdata, ui_method, ui_data);
+}
+
+int OSSL_ENCODER_CTX_set_pem_password_cb(OSSL_ENCODER_CTX *ctx,
+                                         pem_password_cb *cb, void *cbarg)
+{
+    return ossl_pw_set_pem_password_cb(&ctx->pwdata, cb, cbarg);
+}
+
+int OSSL_ENCODER_CTX_set_passphrase_cb(OSSL_ENCODER_CTX *ctx,
+                                       OSSL_PASSPHRASE_CALLBACK *cb,
+                                       void *cbarg)
+{
+    return ossl_pw_set_ossl_passphrase_cb(&ctx->pwdata, cb, cbarg);
+}
+
+/*
+ * Support for OSSL_ENCODER_CTX_new_for_type:
+ * finding a suitable encoder
+ */
+
+struct collected_encoder_st {
+    STACK_OF(OPENSSL_CSTRING) *names;
+    int *id_names;
+    const char *output_structure;
+    const char *output_type;
+
+    const OSSL_PROVIDER *keymgmt_prov;
+    OSSL_ENCODER_CTX *ctx;
+    unsigned int flag_find_same_provider:1;
+
+    int error_occurred;
+};
+
+static void collect_encoder(OSSL_ENCODER *encoder, void *arg)
+{
+    struct collected_encoder_st *data = arg;
+    const OSSL_PROVIDER *prov;
+
+    if (data->error_occurred)
+        return;
+
+    data->error_occurred = 1;     /* Assume the worst */
+
+    prov = OSSL_ENCODER_get0_provider(encoder);
+    /*
+     * collect_encoder() is called in two passes, one where the encoders
+     * from the same provider as the keymgmt are looked up, and one where
+     * the other encoders are looked up.  |data->flag_find_same_provider|
+     * tells us which pass we're in.
+     */
+    if ((data->keymgmt_prov == prov) == data->flag_find_same_provider) {
+        void *provctx = OSSL_PROVIDER_get0_provider_ctx(prov);
+        int i, end_i = sk_OPENSSL_CSTRING_num(data->names);
+        int match;
+
+        for (i = 0; i < end_i; i++) {
+            if (data->flag_find_same_provider)
+                match = (data->id_names[i] == encoder->base.id);
+            else
+                match = OSSL_ENCODER_is_a(encoder,
+                                          sk_OPENSSL_CSTRING_value(data->names, i));
+            if (!match
+                || (encoder->does_selection != NULL
+                    && !encoder->does_selection(provctx, data->ctx->selection))
+                || (data->keymgmt_prov != prov
+                    && encoder->import_object == NULL))
+                continue;
+
+            /* Only add each encoder implementation once */
+            if (OSSL_ENCODER_CTX_add_encoder(data->ctx, encoder))
+                break;
+        }
+    }
+
+    data->error_occurred = 0;         /* All is good now */
+}
+
+struct collected_names_st {
+    STACK_OF(OPENSSL_CSTRING) *names;
+    unsigned int error_occurred:1;
+};
+
+static void collect_name(const char *name, void *arg)
+{
+    struct collected_names_st *data = arg;
+
+    if (data->error_occurred)
+        return;
+
+    data->error_occurred = 1;         /* Assume the worst */
+
+    if (sk_OPENSSL_CSTRING_push(data->names, name) <= 0)
+        return;
+
+    data->error_occurred = 0;         /* All is good now */
+}
+
+/*
+ * Support for OSSL_ENCODER_to_bio:
+ * writing callback for the OSSL_PARAM (the implementation doesn't have
+ * intimate knowledge of the provider side object)
+ */
+
+struct construct_data_st {
+    const EVP_PKEY *pk;
+    int selection;
+
+    OSSL_ENCODER_INSTANCE *encoder_inst;
+    const void *obj;
+    void *constructed_obj;
+};
+
+static int encoder_import_cb(const OSSL_PARAM params[], void *arg)
+{
+    struct construct_data_st *construct_data = arg;
+    OSSL_ENCODER_INSTANCE *encoder_inst = construct_data->encoder_inst;
+    OSSL_ENCODER *encoder = OSSL_ENCODER_INSTANCE_get_encoder(encoder_inst);
+    void *encoderctx = OSSL_ENCODER_INSTANCE_get_encoder_ctx(encoder_inst);
+
+    construct_data->constructed_obj =
+        encoder->import_object(encoderctx, construct_data->selection, params);
+
+    return (construct_data->constructed_obj != NULL);
+}
+
+static const void *
+encoder_construct_pkey(OSSL_ENCODER_INSTANCE *encoder_inst, void *arg)
+{
+    struct construct_data_st *data = arg;
+
+    if (data->obj == NULL) {
+        OSSL_ENCODER *encoder =
+            OSSL_ENCODER_INSTANCE_get_encoder(encoder_inst);
+        const EVP_PKEY *pk = data->pk;
+        const OSSL_PROVIDER *k_prov = EVP_KEYMGMT_get0_provider(pk->keymgmt);
+        const OSSL_PROVIDER *e_prov = OSSL_ENCODER_get0_provider(encoder);
+
+        if (k_prov != e_prov) {
+            int selection = data->selection;
+
+            if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0)
+                selection |= OSSL_KEYMGMT_SELECT_PUBLIC_KEY;
+            data->encoder_inst = encoder_inst;
+
+            if (!evp_keymgmt_export(pk->keymgmt, pk->keydata, selection,
+                                    &encoder_import_cb, data))
+                return NULL;
+            data->obj = data->constructed_obj;
+        } else {
+            data->obj = pk->keydata;
+        }
+    }
+
+    return data->obj;
+}
+
+static void encoder_destruct_pkey(void *arg)
+{
+    struct construct_data_st *data = arg;
+    int match = (data->obj == data->constructed_obj);
+
+    if (data->encoder_inst != NULL) {
+        OSSL_ENCODER *encoder =
+            OSSL_ENCODER_INSTANCE_get_encoder(data->encoder_inst);
+
+        encoder->free_object(data->constructed_obj);
+    }
+    data->constructed_obj = NULL;
+    if (match)
+        data->obj = NULL;
+}
+
+/*
+ * OSSL_ENCODER_CTX_new_for_pkey() returns a ctx with no encoder if
+ * it couldn't find a suitable encoder.  This allows a caller to detect if
+ * a suitable encoder was found, with OSSL_ENCODER_CTX_get_num_encoder(),
+ * and to use fallback methods if the result is NULL.
+ */
+static int ossl_encoder_ctx_setup_for_pkey(OSSL_ENCODER_CTX *ctx,
+                                           const EVP_PKEY *pkey,
+                                           int selection,
+                                           const char *propquery)
+{
+    struct construct_data_st *data = NULL;
+    const OSSL_PROVIDER *prov = NULL;
+    OSSL_LIB_CTX *libctx = NULL;
+    int ok = 0, i, end;
+    OSSL_NAMEMAP *namemap;
+
+    if (!ossl_assert(ctx != NULL) || !ossl_assert(pkey != NULL)) {
+        ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+    }
+
+    if (evp_pkey_is_provided(pkey)) {
+        prov = EVP_KEYMGMT_get0_provider(pkey->keymgmt);
+        libctx = ossl_provider_libctx(prov);
+    }
+
+    if (pkey->keymgmt != NULL) {
+        struct collected_encoder_st encoder_data;
+        struct collected_names_st keymgmt_data;
+
+        if ((data = OPENSSL_zalloc(sizeof(*data))) == NULL)
+            goto err;
+
+        /*
+         * Select the first encoder implementations in two steps.
+         * First, collect the keymgmt names, then the encoders that match.
+         */
+        keymgmt_data.names = sk_OPENSSL_CSTRING_new_null();
+        if (keymgmt_data.names == NULL) {
+            ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_CRYPTO_LIB);
+            goto err;
+        }
+
+        keymgmt_data.error_occurred = 0;
+        EVP_KEYMGMT_names_do_all(pkey->keymgmt, collect_name, &keymgmt_data);
+        if (keymgmt_data.error_occurred) {
+            sk_OPENSSL_CSTRING_free(keymgmt_data.names);
+            goto err;
+        }
+
+        encoder_data.names = keymgmt_data.names;
+        encoder_data.output_type = ctx->output_type;
+        encoder_data.output_structure = ctx->output_structure;
+        encoder_data.error_occurred = 0;
+        encoder_data.keymgmt_prov = prov;
+        encoder_data.ctx = ctx;
+        encoder_data.id_names = NULL;
+
+        /*
+         * collect_encoder() is called many times, and for every call it converts all encoder_data.names
+         * into namemap ids if it calls OSSL_ENCODER_is_a(). We cache the ids here instead,
+         * and can use them for encoders with the same provider as the keymgmt.
+         */
+        namemap = ossl_namemap_stored(libctx);
+        end = sk_OPENSSL_CSTRING_num(encoder_data.names);
+        if (end > 0) {
+            encoder_data.id_names = OPENSSL_malloc(end * sizeof(int));
+            if (encoder_data.id_names == NULL) {
+                sk_OPENSSL_CSTRING_free(keymgmt_data.names);
+                goto err;
+            }
+            for (i = 0; i < end; ++i) {
+                const char *name = sk_OPENSSL_CSTRING_value(keymgmt_data.names, i);
+
+                encoder_data.id_names[i] = ossl_namemap_name2num(namemap, name);
+            }
+        }
+        /*
+         * Place the encoders with the a different provider as the keymgmt
+         * last (the chain is processed in reverse order)
+         */
+        encoder_data.flag_find_same_provider = 0;
+        OSSL_ENCODER_do_all_provided(libctx, collect_encoder, &encoder_data);
+
+        /*
+         * Place the encoders with the same provider as the keymgmt first
+         * (the chain is processed in reverse order)
+         */
+        encoder_data.flag_find_same_provider = 1;
+        OSSL_ENCODER_do_all_provided(libctx, collect_encoder, &encoder_data);
+
+        OPENSSL_free(encoder_data.id_names);
+        sk_OPENSSL_CSTRING_free(keymgmt_data.names);
+        if (encoder_data.error_occurred) {
+            ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_CRYPTO_LIB);
+            goto err;
+        }
+    }
+
+    if (data != NULL && OSSL_ENCODER_CTX_get_num_encoders(ctx) != 0) {
+        if (!OSSL_ENCODER_CTX_set_construct(ctx, encoder_construct_pkey)
+            || !OSSL_ENCODER_CTX_set_construct_data(ctx, data)
+            || !OSSL_ENCODER_CTX_set_cleanup(ctx, encoder_destruct_pkey))
+            goto err;
+
+        data->pk = pkey;
+        data->selection = selection;
+
+        data = NULL;             /* Avoid it being freed */
+    }
+
+    ok = 1;
+ err:
+    if (data != NULL) {
+        OSSL_ENCODER_CTX_set_construct_data(ctx, NULL);
+        OPENSSL_free(data);
+    }
+    return ok;
+}
+
+OSSL_ENCODER_CTX *OSSL_ENCODER_CTX_new_for_pkey(const EVP_PKEY *pkey,
+                                                int selection,
+                                                const char *output_type,
+                                                const char *output_struct,
+                                                const char *propquery)
+{
+    OSSL_ENCODER_CTX *ctx = NULL;
+    OSSL_LIB_CTX *libctx = NULL;
+
+    if (pkey == NULL) {
+        ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_NULL_PARAMETER);
+        return NULL;
+    }
+
+    if (!evp_pkey_is_assigned(pkey)) {
+        ERR_raise_data(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_INVALID_ARGUMENT,
+                       "The passed EVP_PKEY must be assigned a key");
+        return NULL;
+    }
+
+    if ((ctx = OSSL_ENCODER_CTX_new()) == NULL) {
+        ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_OSSL_ENCODER_LIB);
+        return NULL;
+    }
+
+    if (evp_pkey_is_provided(pkey)) {
+        const OSSL_PROVIDER *prov = EVP_KEYMGMT_get0_provider(pkey->keymgmt);
+
+        libctx = ossl_provider_libctx(prov);
+    }
+
+    OSSL_TRACE_BEGIN(ENCODER) {
+        BIO_printf(trc_out,
+                   "(ctx %p) Looking for %s encoders with selection %d\n",
+                   (void *)ctx, EVP_PKEY_get0_type_name(pkey), selection);
+        BIO_printf(trc_out, "    output type: %s, output structure: %s\n",
+                   output_type, output_struct);
+    } OSSL_TRACE_END(ENCODER);
+
+    if (OSSL_ENCODER_CTX_set_output_type(ctx, output_type)
+        && (output_struct == NULL
+            || OSSL_ENCODER_CTX_set_output_structure(ctx, output_struct))
+        && OSSL_ENCODER_CTX_set_selection(ctx, selection)
+        && ossl_encoder_ctx_setup_for_pkey(ctx, pkey, selection, propquery)
+        && OSSL_ENCODER_CTX_add_extra(ctx, libctx, propquery)) {
+        OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
+        int save_parameters = pkey->save_parameters;
+
+        params[0] = OSSL_PARAM_construct_int(OSSL_ENCODER_PARAM_SAVE_PARAMETERS,
+                                             &save_parameters);
+        /* ignoring error as this is only auxiliary parameter */
+        (void)OSSL_ENCODER_CTX_set_params(ctx, params);
+
+        OSSL_TRACE_BEGIN(ENCODER) {
+            BIO_printf(trc_out, "(ctx %p) Got %d encoders\n",
+                       (void *)ctx, OSSL_ENCODER_CTX_get_num_encoders(ctx));
+        } OSSL_TRACE_END(ENCODER);
+        return ctx;
+    }
+
+    OSSL_ENCODER_CTX_free(ctx);
+    return NULL;
+}

openssl-3.4.2/crypto/encode_decode/libcrypto-lib-decoder_err.d

@@ -0,0 +1,11 @@
+crypto/encode_decode/libcrypto-lib-decoder_err.o: \
+ crypto/encode_decode/decoder_err.c include/openssl/err.h \
+ include/openssl/macros.h include/openssl/opensslconf.h \
+ include/openssl/configuration.h include/openssl/opensslv.h \
+ include/openssl/e_os2.h include/openssl/types.h \
+ include/openssl/safestack.h include/openssl/stack.h \
+ include/openssl/bio.h include/openssl/crypto.h \
+ include/openssl/cryptoerr.h include/openssl/symhacks.h \
+ include/openssl/cryptoerr_legacy.h include/openssl/core.h \
+ include/openssl/bioerr.h include/openssl/lhash.h \
+ include/openssl/decodererr.h include/crypto/decodererr.h

openssl-3.4.2/crypto/encode_decode/libcrypto-lib-decoder_lib.d

@@ -0,0 +1,27 @@
+crypto/encode_decode/libcrypto-lib-decoder_lib.o: \
+ crypto/encode_decode/decoder_lib.c include/openssl/core_names.h \
+ include/openssl/bio.h include/openssl/macros.h \
+ include/openssl/opensslconf.h include/openssl/configuration.h \
+ include/openssl/opensslv.h include/openssl/e_os2.h \
+ include/openssl/crypto.h include/openssl/safestack.h \
+ include/openssl/stack.h include/openssl/types.h \
+ include/openssl/cryptoerr.h include/openssl/symhacks.h \
+ include/openssl/cryptoerr_legacy.h include/openssl/core.h \
+ include/openssl/bioerr.h include/openssl/params.h include/openssl/bn.h \
+ include/openssl/bnerr.h include/openssl/provider.h \
+ include/openssl/evperr.h include/openssl/ecerr.h \
+ include/openssl/pkcs12err.h include/openssl/x509err.h \
+ include/openssl/trace.h include/internal/bio.h \
+ include/internal/provider.h include/openssl/core_dispatch.h \
+ include/openssl/indicator.h include/internal/dso.h \
+ include/internal/dsoerr.h include/internal/symhacks.h \
+ include/internal/namemap.h include/internal/cryptlib.h \
+ include/internal/common.h include/internal/e_os.h \
+ include/internal/numbers.h include/internal/nelem.h \
+ include/openssl/buffer.h include/openssl/buffererr.h \
+ include/openssl/asn1.h include/openssl/asn1err.h include/openssl/err.h \
+ include/openssl/lhash.h include/crypto/decoder.h \
+ include/openssl/decoder.h include/openssl/decodererr.h \
+ crypto/encode_decode/encoder_local.h include/openssl/encoder.h \
+ include/openssl/encodererr.h include/internal/passphrase.h \
+ include/internal/property.h include/internal/refcount.h

openssl-3.4.2/crypto/encode_decode/libcrypto-lib-decoder_meth.d

@@ -0,0 +1,35 @@
+crypto/encode_decode/libcrypto-lib-decoder_meth.o: \
+ crypto/encode_decode/decoder_meth.c include/openssl/core.h \
+ include/openssl/types.h include/openssl/e_os2.h include/openssl/macros.h \
+ include/openssl/opensslconf.h include/openssl/configuration.h \
+ include/openssl/opensslv.h include/openssl/safestack.h \
+ include/openssl/stack.h include/openssl/core_dispatch.h \
+ include/openssl/indicator.h include/openssl/params.h \
+ include/openssl/bn.h include/openssl/crypto.h \
+ include/openssl/cryptoerr.h include/openssl/symhacks.h \
+ include/openssl/cryptoerr_legacy.h include/openssl/bnerr.h \
+ include/openssl/decoder.h include/openssl/decodererr.h \
+ include/openssl/ui.h include/openssl/pem.h include/openssl/bio.h \
+ include/openssl/bioerr.h include/openssl/evp.h include/openssl/evperr.h \
+ include/openssl/objects.h include/openssl/obj_mac.h \
+ include/openssl/asn1.h include/openssl/asn1err.h \
+ include/openssl/objectserr.h include/openssl/x509.h \
+ include/openssl/buffer.h include/openssl/buffererr.h \
+ include/openssl/ec.h include/openssl/ecerr.h include/openssl/rsa.h \
+ include/openssl/rsaerr.h include/openssl/dsa.h include/openssl/dh.h \
+ include/openssl/dherr.h include/openssl/dsaerr.h include/openssl/sha.h \
+ include/openssl/x509err.h include/openssl/x509_vfy.h \
+ include/openssl/lhash.h include/openssl/pkcs7.h \
+ include/openssl/pkcs7err.h include/openssl/http.h include/openssl/conf.h \
+ include/openssl/conferr.h include/openssl/conftypes.h \
+ include/openssl/pemerr.h include/openssl/uierr.h include/internal/core.h \
+ include/internal/namemap.h include/internal/cryptlib.h \
+ include/internal/common.h include/internal/e_os.h \
+ include/internal/numbers.h include/internal/nelem.h \
+ include/openssl/err.h include/internal/property.h \
+ include/internal/provider.h include/internal/dso.h \
+ include/internal/dsoerr.h include/internal/symhacks.h \
+ include/crypto/decoder.h crypto/encode_decode/encoder_local.h \
+ include/openssl/encoder.h include/openssl/encodererr.h \
+ include/internal/passphrase.h include/internal/refcount.h \
+ include/openssl/trace.h include/crypto/context.h

openssl-3.4.2/crypto/encode_decode/libcrypto-lib-decoder_pkey.d

@@ -0,0 +1,36 @@
+crypto/encode_decode/libcrypto-lib-decoder_pkey.o: \
+ crypto/encode_decode/decoder_pkey.c include/openssl/core_names.h \
+ include/openssl/core_object.h include/openssl/provider.h \
+ include/openssl/core.h include/openssl/types.h include/openssl/e_os2.h \
+ include/openssl/macros.h include/openssl/opensslconf.h \
+ include/openssl/configuration.h include/openssl/opensslv.h \
+ include/openssl/safestack.h include/openssl/stack.h \
+ include/openssl/evp.h include/openssl/core_dispatch.h \
+ include/openssl/indicator.h include/openssl/params.h \
+ include/openssl/bn.h include/openssl/crypto.h \
+ include/openssl/cryptoerr.h include/openssl/symhacks.h \
+ include/openssl/cryptoerr_legacy.h include/openssl/bnerr.h \
+ include/openssl/bio.h include/openssl/bioerr.h include/openssl/evperr.h \
+ include/openssl/objects.h include/openssl/obj_mac.h \
+ include/openssl/asn1.h include/openssl/asn1err.h \
+ include/openssl/objectserr.h include/openssl/ui.h include/openssl/pem.h \
+ include/openssl/x509.h include/openssl/buffer.h \
+ include/openssl/buffererr.h include/openssl/ec.h include/openssl/ecerr.h \
+ include/openssl/rsa.h include/openssl/rsaerr.h include/openssl/dsa.h \
+ include/openssl/dh.h include/openssl/dherr.h include/openssl/dsaerr.h \
+ include/openssl/sha.h include/openssl/x509err.h \
+ include/openssl/x509_vfy.h include/openssl/lhash.h \
+ include/openssl/pkcs7.h include/openssl/pkcs7err.h \
+ include/openssl/http.h include/openssl/conf.h include/openssl/conferr.h \
+ include/openssl/conftypes.h include/openssl/pemerr.h \
+ include/openssl/uierr.h include/openssl/decoder.h \
+ include/openssl/decodererr.h include/openssl/trace.h \
+ include/crypto/evp.h include/internal/refcount.h include/openssl/err.h \
+ include/crypto/ecx.h include/crypto/types.h include/crypto/decoder.h \
+ crypto/evp/evp_local.h include/crypto/lhash.h \
+ crypto/encode_decode/encoder_local.h include/openssl/encoder.h \
+ include/openssl/encodererr.h include/internal/cryptlib.h \
+ include/internal/common.h include/internal/e_os.h \
+ include/internal/numbers.h include/internal/nelem.h \
+ include/internal/passphrase.h include/internal/property.h \
+ include/internal/namemap.h include/internal/sizes.h

openssl-3.4.2/crypto/encode_decode/libcrypto-lib-encoder_err.d

@@ -0,0 +1,11 @@
+crypto/encode_decode/libcrypto-lib-encoder_err.o: \
+ crypto/encode_decode/encoder_err.c include/openssl/err.h \
+ include/openssl/macros.h include/openssl/opensslconf.h \
+ include/openssl/configuration.h include/openssl/opensslv.h \
+ include/openssl/e_os2.h include/openssl/types.h \
+ include/openssl/safestack.h include/openssl/stack.h \
+ include/openssl/bio.h include/openssl/crypto.h \
+ include/openssl/cryptoerr.h include/openssl/symhacks.h \
+ include/openssl/cryptoerr_legacy.h include/openssl/core.h \
+ include/openssl/bioerr.h include/openssl/lhash.h \
+ include/openssl/encodererr.h include/crypto/encodererr.h

openssl-3.4.2/crypto/encode_decode/libcrypto-lib-encoder_lib.d

@@ -0,0 +1,24 @@
+crypto/encode_decode/libcrypto-lib-encoder_lib.o: \
+ crypto/encode_decode/encoder_lib.c include/openssl/core_names.h \
+ include/openssl/bio.h include/openssl/macros.h \
+ include/openssl/opensslconf.h include/openssl/configuration.h \
+ include/openssl/opensslv.h include/openssl/e_os2.h \
+ include/openssl/crypto.h include/openssl/safestack.h \
+ include/openssl/stack.h include/openssl/types.h \
+ include/openssl/cryptoerr.h include/openssl/symhacks.h \
+ include/openssl/cryptoerr_legacy.h include/openssl/core.h \
+ include/openssl/bioerr.h include/openssl/encoder.h \
+ include/openssl/encodererr.h include/openssl/buffer.h \
+ include/openssl/buffererr.h include/openssl/params.h \
+ include/openssl/bn.h include/openssl/bnerr.h include/openssl/provider.h \
+ include/openssl/trace.h include/internal/bio.h \
+ include/internal/provider.h include/openssl/core_dispatch.h \
+ include/openssl/indicator.h include/internal/dso.h \
+ include/internal/dsoerr.h include/internal/symhacks.h \
+ crypto/encode_decode/encoder_local.h include/openssl/decoder.h \
+ include/openssl/decodererr.h include/internal/cryptlib.h \
+ include/internal/common.h include/internal/e_os.h \
+ include/internal/numbers.h include/internal/nelem.h \
+ include/openssl/asn1.h include/openssl/asn1err.h include/openssl/err.h \
+ include/openssl/lhash.h include/internal/passphrase.h \
+ include/internal/property.h include/internal/refcount.h

openssl-3.4.2/crypto/encode_decode/libcrypto-lib-encoder_meth.d

@@ -0,0 +1,35 @@
+crypto/encode_decode/libcrypto-lib-encoder_meth.o: \
+ crypto/encode_decode/encoder_meth.c include/openssl/core.h \
+ include/openssl/types.h include/openssl/e_os2.h include/openssl/macros.h \
+ include/openssl/opensslconf.h include/openssl/configuration.h \
+ include/openssl/opensslv.h include/openssl/safestack.h \
+ include/openssl/stack.h include/openssl/core_dispatch.h \
+ include/openssl/indicator.h include/openssl/params.h \
+ include/openssl/bn.h include/openssl/crypto.h \
+ include/openssl/cryptoerr.h include/openssl/symhacks.h \
+ include/openssl/cryptoerr_legacy.h include/openssl/bnerr.h \
+ include/openssl/encoder.h include/openssl/encodererr.h \
+ include/openssl/ui.h include/openssl/pem.h include/openssl/bio.h \
+ include/openssl/bioerr.h include/openssl/evp.h include/openssl/evperr.h \
+ include/openssl/objects.h include/openssl/obj_mac.h \
+ include/openssl/asn1.h include/openssl/asn1err.h \
+ include/openssl/objectserr.h include/openssl/x509.h \
+ include/openssl/buffer.h include/openssl/buffererr.h \
+ include/openssl/ec.h include/openssl/ecerr.h include/openssl/rsa.h \
+ include/openssl/rsaerr.h include/openssl/dsa.h include/openssl/dh.h \
+ include/openssl/dherr.h include/openssl/dsaerr.h include/openssl/sha.h \
+ include/openssl/x509err.h include/openssl/x509_vfy.h \
+ include/openssl/lhash.h include/openssl/pkcs7.h \
+ include/openssl/pkcs7err.h include/openssl/http.h include/openssl/conf.h \
+ include/openssl/conferr.h include/openssl/conftypes.h \
+ include/openssl/pemerr.h include/openssl/uierr.h include/internal/core.h \
+ include/internal/namemap.h include/internal/cryptlib.h \
+ include/internal/common.h include/internal/e_os.h \
+ include/internal/numbers.h include/internal/nelem.h \
+ include/openssl/err.h include/internal/property.h \
+ include/internal/provider.h include/internal/dso.h \
+ include/internal/dsoerr.h include/internal/symhacks.h \
+ include/crypto/encoder.h crypto/encode_decode/encoder_local.h \
+ include/openssl/decoder.h include/openssl/decodererr.h \
+ include/internal/passphrase.h include/internal/refcount.h \
+ include/openssl/trace.h include/crypto/context.h

openssl-3.4.2/crypto/encode_decode/libcrypto-lib-encoder_pkey.d

@@ -0,0 +1,36 @@
+crypto/encode_decode/libcrypto-lib-encoder_pkey.o: \
+ crypto/encode_decode/encoder_pkey.c include/openssl/err.h \
+ include/openssl/macros.h include/openssl/opensslconf.h \
+ include/openssl/configuration.h include/openssl/opensslv.h \
+ include/openssl/e_os2.h include/openssl/types.h \
+ include/openssl/safestack.h include/openssl/stack.h \
+ include/openssl/bio.h include/openssl/crypto.h \
+ include/openssl/cryptoerr.h include/openssl/symhacks.h \
+ include/openssl/cryptoerr_legacy.h include/openssl/core.h \
+ include/openssl/bioerr.h include/openssl/lhash.h include/openssl/ui.h \
+ include/openssl/pem.h include/openssl/evp.h \
+ include/openssl/core_dispatch.h include/openssl/indicator.h \
+ include/openssl/params.h include/openssl/bn.h include/openssl/bnerr.h \
+ include/openssl/evperr.h include/openssl/objects.h \
+ include/openssl/obj_mac.h include/openssl/asn1.h \
+ include/openssl/asn1err.h include/openssl/objectserr.h \
+ include/openssl/x509.h include/openssl/buffer.h \
+ include/openssl/buffererr.h include/openssl/ec.h include/openssl/ecerr.h \
+ include/openssl/rsa.h include/openssl/rsaerr.h include/openssl/dsa.h \
+ include/openssl/dh.h include/openssl/dherr.h include/openssl/dsaerr.h \
+ include/openssl/sha.h include/openssl/x509err.h \
+ include/openssl/x509_vfy.h include/openssl/pkcs7.h \
+ include/openssl/pkcs7err.h include/openssl/http.h include/openssl/conf.h \
+ include/openssl/conferr.h include/openssl/conftypes.h \
+ include/openssl/pemerr.h include/openssl/uierr.h \
+ include/openssl/encoder.h include/openssl/encodererr.h \
+ include/openssl/core_names.h include/openssl/provider.h \
+ include/openssl/trace.h include/internal/provider.h \
+ include/internal/dso.h include/internal/dsoerr.h \
+ include/internal/symhacks.h include/internal/property.h \
+ include/internal/cryptlib.h include/internal/common.h \
+ include/internal/e_os.h include/internal/numbers.h \
+ include/internal/nelem.h include/internal/namemap.h include/crypto/evp.h \
+ include/internal/refcount.h include/crypto/ecx.h include/crypto/types.h \
+ crypto/encode_decode/encoder_local.h include/openssl/decoder.h \
+ include/openssl/decodererr.h include/internal/passphrase.h