openssl
/
openssl
mirror of https://github.com/openssl/openssl
1
0
Fork 0
Code Issues Releases Wiki Activity

APPS: pkeyparam: Support setting properties 

The -provider and -propquery options did not work on pkeyparam. Fix this
and add tests that check that operations that would usually fail with
the FIPS provider work when run with

| -provider default -propquery '?fips!=yes'

See also 30b2c3592e, which previously
fixed the same problem in dsaparam and gendsa. See also the initial
report in https://bugzilla.redhat.com/show_bug.cgi?id=2094956.

Signed-off-by: Clemens Lang <cllang@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/18717)
This commit is contained in:
Clemens Lang 2022-07-01 15:35:22 +02:00 committed by Dmitry Belyavskiy
parent 2b8f687d76
commit 0185538799
2 changed files with 21 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
apps/pkeyparam.c
View File

@ -100,7 +100,8 @@ int pkeyparam_main(int argc, char **argv)
out = bio_open_default(outfile, 'w', FORMAT_PEM);
if (out == NULL)
goto end;
pkey = PEM_read_bio_Parameters(in, NULL);
pkey = PEM_read_bio_Parameters_ex(in, NULL, app_get0_libctx(),
app_get0_propq());
if (pkey == NULL) {
BIO_printf(bio_err, "Error reading parameters\n");
ERR_print_errors(bio_err);
@ -108,7 +109,11 @@ int pkeyparam_main(int argc, char **argv)
}
if (check) {
ctx = EVP_PKEY_CTX_new(pkey, e);
if (e == NULL)
ctx = EVP_PKEY_CTX_new_from_pkey(app_get0_libctx(), pkey,
app_get0_propq());
else
ctx = EVP_PKEY_CTX_new(pkey, e);
if (ctx == NULL) {
ERR_print_errors(bio_err);
goto end;

15
test/recipes/15-test_ecparam.t
View File

@ -119,7 +119,7 @@ subtest "Check pkeyparam does not change the parameter file on output" => sub {
subtest "Check loading of fips and non-fips params" => sub {
plan skip_all => "FIPS is disabled"
if $no_fips;
plan tests => 6;
plan tests => 8;
my $fipsconf = srctop_file("test", "fips-and-base.cnf");
my $defaultconf = srctop_file("test", "default.cnf");
@ -141,6 +141,11 @@ subtest "Check loading of fips and non-fips params" => sub {
'-check'])),
"Fail loading named non-fips curve");
ok(!run(app(['openssl', 'pkeyparam',
'-in', data_file('valid', 'secp112r1-named.pem'),
'-check'])),
"Fail loading named non-fips curve using pkeyparam");
ok(run(app(['openssl', 'ecparam',
'-provider', 'default',
'-propquery', '?fips!=yes',
@ -149,6 +154,14 @@ subtest "Check loading of fips and non-fips params" => sub {
"Loading named non-fips curve in FIPS mode with non-FIPS property".
" query");
ok(run(app(['openssl', 'pkeyparam',
'-provider', 'default',
'-propquery', '?fips!=yes',
'-in', data_file('valid', 'secp112r1-named.pem'),
'-check'])),
"Loading named non-fips curve in FIPS mode with non-FIPS property".
" query using pkeyparam");
ok(!run(app(['openssl', 'ecparam',
'-genkey', '-name', 'secp112r1'])),
"Fail generating key for named non-fips curve");