@@ -4406,12 +4406,79 @@ bool SSLCtxPointer::setCipherSuites(const char* ciphers) {
44064406
44074407// ============================================================================
44084408
4409+ #if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4410+ Cipher::Cipher (DeleteFnPtr<EVP_CIPHER , EVP_CIPHER_free> cipher)
4411+ : cipher_ (cipher.get ()), fetched_cipher_ (std::move (cipher)) {}
4412+ #endif
4413+
4414+ Cipher::Cipher (const Cipher& other) : cipher_ (other.cipher_ ) {
4415+ #if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4416+ if (other.fetched_cipher_ != nullptr ) {
4417+ if (EVP_CIPHER_up_ref (other.fetched_cipher_ .get ()) == 1 ) {
4418+ fetched_cipher_.reset (other.fetched_cipher_ .get ());
4419+ } else {
4420+ cipher_ = nullptr ;
4421+ }
4422+ }
4423+ #endif
4424+ }
4425+
4426+ Cipher& Cipher::operator =(const Cipher& other) {
4427+ if (this == &other) return *this ;
4428+ #if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4429+ if (other.fetched_cipher_ != nullptr ) {
4430+ if (EVP_CIPHER_up_ref (other.fetched_cipher_ .get ()) == 1 ) {
4431+ fetched_cipher_.reset (other.fetched_cipher_ .get ());
4432+ } else {
4433+ fetched_cipher_.reset ();
4434+ cipher_ = nullptr ;
4435+ return *this ;
4436+ }
4437+ } else {
4438+ fetched_cipher_.reset ();
4439+ }
4440+ #endif
4441+ cipher_ = other.cipher_ ;
4442+ return *this ;
4443+ }
4444+
44094445const Cipher Cipher::FromName (const char * name) {
4410- return Cipher (EVP_get_cipherbyname (name));
4446+ const EVP_CIPHER * cipher = EVP_get_cipherbyname (name);
4447+ if (cipher != nullptr ) return Cipher (cipher);
4448+
4449+ #if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4450+ MarkPopErrorOnReturn mark_pop_error_on_return;
4451+ DeleteFnPtr<EVP_CIPHER , EVP_CIPHER_free> fetched (
4452+ EVP_CIPHER_fetch (nullptr , name, nullptr ));
4453+ if (fetched == nullptr ) return Cipher ();
4454+
4455+ const int mode = EVP_CIPHER_mode (fetched.get ());
4456+ const bool is_siv_mode =
4457+ #if OPENSSL_WITH_AES_SIV
4458+ mode == EVP_CIPH_SIV_MODE ||
4459+ #endif
4460+ #if OPENSSL_WITH_AES_GCM_SIV
4461+ mode == EVP_CIPH_GCM_SIV_MODE ||
4462+ #endif
4463+ false ;
4464+ if (is_siv_mode) return Cipher (std::move (fetched));
4465+
4466+ return Cipher ();
4467+ #else
4468+ return Cipher ();
4469+ #endif
44114470}
44124471
44134472const Cipher Cipher::FromNid (int nid) {
4414- return Cipher (EVP_get_cipherbynid (nid));
4473+ const EVP_CIPHER * cipher = EVP_get_cipherbynid (nid);
4474+ if (cipher != nullptr ) return Cipher (cipher);
4475+
4476+ #if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4477+ const char * name = OBJ_nid2sn (nid);
4478+ if (name != nullptr ) return FromName (name);
4479+ #endif
4480+
4481+ return Cipher ();
44154482}
44164483
44174484const Cipher Cipher::FromCtx (const CipherCtxPointer& ctx) {
@@ -4465,6 +4532,24 @@ bool Cipher::isOcbMode() const {
44654532 return getMode () == EVP_CIPH_OCB_MODE ;
44664533}
44674534
4535+ bool Cipher::isSivMode () const {
4536+ if (!cipher_) return false ;
4537+ #if OPENSSL_WITH_AES_SIV
4538+ return getMode () == EVP_CIPH_SIV_MODE ;
4539+ #else
4540+ return false ;
4541+ #endif
4542+ }
4543+
4544+ bool Cipher::isGcmSivMode () const {
4545+ if (!cipher_) return false ;
4546+ #if OPENSSL_WITH_AES_GCM_SIV
4547+ return getMode () == EVP_CIPH_GCM_SIV_MODE ;
4548+ #else
4549+ return false ;
4550+ #endif
4551+ }
4552+
44684553bool Cipher::isStreamMode () const {
44694554 if (!cipher_) return false ;
44704555 return getMode () == EVP_CIPH_STREAM_CIPHER ;
@@ -4519,6 +4604,14 @@ std::string_view Cipher::getModeLabel() const {
45194604 return " ocb"
45204605 case EVP_CIPH_OFB_MODE :
45214606 return " ofb"
4607+ #if OPENSSL_WITH_AES_SIV
4608+ case EVP_CIPH_SIV_MODE :
4609+ return " siv"
4610+ #endif
4611+ #if OPENSSL_WITH_AES_GCM_SIV
4612+ case EVP_CIPH_GCM_SIV_MODE :
4613+ return " gcm-siv"
4614+ #endif
45224615 case EVP_CIPH_WRAP_MODE :
45234616 return " wrap"
45244617 case EVP_CIPH_XTS_MODE :
@@ -4533,7 +4626,16 @@ const char* Cipher::getName() const {
45334626 if (!cipher_) return {};
45344627 // OBJ_nid2sn(EVP_CIPHER_nid(cipher)) is used here instead of
45354628 // EVP_CIPHER_name(cipher) for compatibility with BoringSSL.
4536- return OBJ_nid2sn (getNid ());
4629+ const int nid = getNid ();
4630+ if (nid != NID_undef) {
4631+ const char * name = OBJ_nid2sn (nid);
4632+ if (name != nullptr ) return name;
4633+ }
4634+ #if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4635+ return EVP_CIPHER_get0_name (cipher_);
4636+ #else
4637+ return {};
4638+ #endif
45374639}
45384640
45394641bool Cipher::isSupportedAuthenticatedMode () const {
@@ -4542,6 +4644,12 @@ bool Cipher::isSupportedAuthenticatedMode() const {
45424644 case EVP_CIPH_GCM_MODE :
45434645#ifndef OPENSSL_NO_OCB
45444646 case EVP_CIPH_OCB_MODE :
4647+ #endif
4648+ #if OPENSSL_WITH_AES_SIV
4649+ case EVP_CIPH_SIV_MODE :
4650+ #endif
4651+ #if OPENSSL_WITH_AES_GCM_SIV
4652+ case EVP_CIPH_GCM_SIV_MODE :
45454653#endif
45464654 return true ;
45474655 case EVP_CIPH_STREAM_CIPHER :
@@ -4655,6 +4763,24 @@ bool CipherCtxPointer::isWrapMode() const {
46554763 return getMode () == EVP_CIPH_WRAP_MODE ;
46564764}
46574765
4766+ bool CipherCtxPointer::isSivMode () const {
4767+ if (!ctx_) return false ;
4768+ #if OPENSSL_WITH_AES_SIV
4769+ return getMode () == EVP_CIPH_SIV_MODE ;
4770+ #else
4771+ return false ;
4772+ #endif
4773+ }
4774+
4775+ bool CipherCtxPointer::isGcmSivMode () const {
4776+ if (!ctx_) return false ;
4777+ #if OPENSSL_WITH_AES_GCM_SIV
4778+ return getMode () == EVP_CIPH_GCM_SIV_MODE ;
4779+ #else
4780+ return false ;
4781+ #endif
4782+ }
4783+
46584784bool CipherCtxPointer::isChaCha20Poly1305 () const {
46594785 if (!ctx_) return false ;
46604786 return getNid () == NID_chacha20_poly1305;
@@ -6103,6 +6229,22 @@ struct CipherCallbackContext {
61036229 void operator ()(const char * name) { cb (name); }
61046230};
61056231
6232+ #if OPENSSL_WITH_AES_SIV
6233+ constexpr const char * kProviderOnlyAesSivCiphers [] = {
6234+ " aes-128-siv"
6235+ " aes-192-siv"
6236+ " aes-256-siv"
6237+ };
6238+ #endif
6239+
6240+ #if OPENSSL_WITH_AES_GCM_SIV
6241+ constexpr const char * kProviderOnlyAesGcmSivCiphers [] = {
6242+ " aes-128-gcm-siv"
6243+ " aes-192-gcm-siv"
6244+ " aes-256-gcm-siv"
6245+ };
6246+ #endif
6247+
61066248#if OPENSSL_VERSION_MAJOR >= 3
61076249template <class TypeName ,
61086250 TypeName* fetch_type (OSSL_LIB_CTX *, const char *, const char *),
@@ -6169,6 +6311,24 @@ void Cipher::ForEach(Cipher::CipherNameCallback callback) {
61696311 array_push_back<EVP_CIPHER >,
61706312#endif
61716313 &context);
6314+ #if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
6315+ auto maybe_push_provider_only_cipher = [&](const char * name) {
6316+ EVP_CIPHER * cipher = EVP_CIPHER_fetch (nullptr , name, nullptr );
6317+ if (cipher == nullptr ) return ;
6318+ EVP_CIPHER_free (cipher);
6319+ context.cb (name);
6320+ };
6321+ #endif
6322+ #if OPENSSL_WITH_AES_SIV
6323+ for (const char * name : kProviderOnlyAesSivCiphers ) {
6324+ maybe_push_provider_only_cipher (name);
6325+ }
6326+ #endif
6327+ #if OPENSSL_WITH_AES_GCM_SIV
6328+ for (const char * name : kProviderOnlyAesGcmSivCiphers ) {
6329+ maybe_push_provider_only_cipher (name);
6330+ }
6331+ #endif
61726332#endif
61736333}
61746334
0 commit comments