@@ -4407,12 +4407,79 @@ bool SSLCtxPointer::setCipherSuites(const char* ciphers) {
44074407
44084408// ============================================================================
44094409
4410+ #if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4411+ Cipher::Cipher (DeleteFnPtr<EVP_CIPHER , EVP_CIPHER_free> cipher)
4412+ : cipher_ (cipher.get ()), fetched_cipher_ (std::move (cipher)) {}
4413+ #endif
4414+
4415+ Cipher::Cipher (const Cipher& other) : cipher_ (other.cipher_ ) {
4416+ #if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4417+ if (other.fetched_cipher_ != nullptr ) {
4418+ if (EVP_CIPHER_up_ref (other.fetched_cipher_ .get ()) == 1 ) {
4419+ fetched_cipher_.reset (other.fetched_cipher_ .get ());
4420+ } else {
4421+ cipher_ = nullptr ;
4422+ }
4423+ }
4424+ #endif
4425+ }
4426+
4427+ Cipher& Cipher::operator =(const Cipher& other) {
4428+ if (this == &other) return *this ;
4429+ #if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4430+ if (other.fetched_cipher_ != nullptr ) {
4431+ if (EVP_CIPHER_up_ref (other.fetched_cipher_ .get ()) == 1 ) {
4432+ fetched_cipher_.reset (other.fetched_cipher_ .get ());
4433+ } else {
4434+ fetched_cipher_.reset ();
4435+ cipher_ = nullptr ;
4436+ return *this ;
4437+ }
4438+ } else {
4439+ fetched_cipher_.reset ();
4440+ }
4441+ #endif
4442+ cipher_ = other.cipher_ ;
4443+ return *this ;
4444+ }
4445+
44104446const Cipher Cipher::FromName (const char * name) {
4411- return Cipher (EVP_get_cipherbyname (name));
4447+ const EVP_CIPHER * cipher = EVP_get_cipherbyname (name);
4448+ if (cipher != nullptr ) return Cipher (cipher);
4449+
4450+ #if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4451+ MarkPopErrorOnReturn mark_pop_error_on_return;
4452+ DeleteFnPtr<EVP_CIPHER , EVP_CIPHER_free> fetched (
4453+ EVP_CIPHER_fetch (nullptr , name, nullptr ));
4454+ if (fetched == nullptr ) return Cipher ();
4455+
4456+ const int mode = EVP_CIPHER_mode (fetched.get ());
4457+ const bool is_siv_mode =
4458+ #if OPENSSL_WITH_AES_SIV
4459+ mode == EVP_CIPH_SIV_MODE ||
4460+ #endif
4461+ #if OPENSSL_WITH_AES_GCM_SIV
4462+ mode == EVP_CIPH_GCM_SIV_MODE ||
4463+ #endif
4464+ false ;
4465+ if (is_siv_mode) return Cipher (std::move (fetched));
4466+
4467+ return Cipher ();
4468+ #else
4469+ return Cipher ();
4470+ #endif
44124471}
44134472
44144473const Cipher Cipher::FromNid (int nid) {
4415- return Cipher (EVP_get_cipherbynid (nid));
4474+ const EVP_CIPHER * cipher = EVP_get_cipherbynid (nid);
4475+ if (cipher != nullptr ) return Cipher (cipher);
4476+
4477+ #if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4478+ const char * name = OBJ_nid2sn (nid);
4479+ if (name != nullptr ) return FromName (name);
4480+ #endif
4481+
4482+ return Cipher ();
44164483}
44174484
44184485const Cipher Cipher::FromCtx (const CipherCtxPointer& ctx) {
@@ -4466,6 +4533,24 @@ bool Cipher::isOcbMode() const {
44664533 return getMode () == EVP_CIPH_OCB_MODE ;
44674534}
44684535
4536+ bool Cipher::isSivMode () const {
4537+ if (!cipher_) return false ;
4538+ #if OPENSSL_WITH_AES_SIV
4539+ return getMode () == EVP_CIPH_SIV_MODE ;
4540+ #else
4541+ return false ;
4542+ #endif
4543+ }
4544+
4545+ bool Cipher::isGcmSivMode () const {
4546+ if (!cipher_) return false ;
4547+ #if OPENSSL_WITH_AES_GCM_SIV
4548+ return getMode () == EVP_CIPH_GCM_SIV_MODE ;
4549+ #else
4550+ return false ;
4551+ #endif
4552+ }
4553+
44694554bool Cipher::isStreamMode () const {
44704555 if (!cipher_) return false ;
44714556 return getMode () == EVP_CIPH_STREAM_CIPHER ;
@@ -4520,6 +4605,14 @@ std::string_view Cipher::getModeLabel() const {
45204605 return " ocb"
45214606 case EVP_CIPH_OFB_MODE :
45224607 return " ofb"
4608+ #if OPENSSL_WITH_AES_SIV
4609+ case EVP_CIPH_SIV_MODE :
4610+ return " siv"
4611+ #endif
4612+ #if OPENSSL_WITH_AES_GCM_SIV
4613+ case EVP_CIPH_GCM_SIV_MODE :
4614+ return " gcm-siv"
4615+ #endif
45234616 case EVP_CIPH_WRAP_MODE :
45244617 return " wrap"
45254618 case EVP_CIPH_XTS_MODE :
@@ -4534,7 +4627,16 @@ const char* Cipher::getName() const {
45344627 if (!cipher_) return {};
45354628 // OBJ_nid2sn(EVP_CIPHER_nid(cipher)) is used here instead of
45364629 // EVP_CIPHER_name(cipher) for compatibility with BoringSSL.
4537- return OBJ_nid2sn (getNid ());
4630+ const int nid = getNid ();
4631+ if (nid != NID_undef) {
4632+ const char * name = OBJ_nid2sn (nid);
4633+ if (name != nullptr ) return name;
4634+ }
4635+ #if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4636+ return EVP_CIPHER_get0_name (cipher_);
4637+ #else
4638+ return {};
4639+ #endif
45384640}
45394641
45404642bool Cipher::isSupportedAuthenticatedMode () const {
@@ -4543,6 +4645,12 @@ bool Cipher::isSupportedAuthenticatedMode() const {
45434645 case EVP_CIPH_GCM_MODE :
45444646#ifndef OPENSSL_NO_OCB
45454647 case EVP_CIPH_OCB_MODE :
4648+ #endif
4649+ #if OPENSSL_WITH_AES_SIV
4650+ case EVP_CIPH_SIV_MODE :
4651+ #endif
4652+ #if OPENSSL_WITH_AES_GCM_SIV
4653+ case EVP_CIPH_GCM_SIV_MODE :
45464654#endif
45474655 return true ;
45484656 case EVP_CIPH_STREAM_CIPHER :
@@ -4656,6 +4764,24 @@ bool CipherCtxPointer::isWrapMode() const {
46564764 return getMode () == EVP_CIPH_WRAP_MODE ;
46574765}
46584766
4767+ bool CipherCtxPointer::isSivMode () const {
4768+ if (!ctx_) return false ;
4769+ #if OPENSSL_WITH_AES_SIV
4770+ return getMode () == EVP_CIPH_SIV_MODE ;
4771+ #else
4772+ return false ;
4773+ #endif
4774+ }
4775+
4776+ bool CipherCtxPointer::isGcmSivMode () const {
4777+ if (!ctx_) return false ;
4778+ #if OPENSSL_WITH_AES_GCM_SIV
4779+ return getMode () == EVP_CIPH_GCM_SIV_MODE ;
4780+ #else
4781+ return false ;
4782+ #endif
4783+ }
4784+
46594785bool CipherCtxPointer::isChaCha20Poly1305 () const {
46604786 if (!ctx_) return false ;
46614787 return getNid () == NID_chacha20_poly1305;
@@ -6100,6 +6226,22 @@ struct CipherCallbackContext {
61006226 void operator ()(const char * name) { cb (name); }
61016227};
61026228
6229+ #if OPENSSL_WITH_AES_SIV
6230+ constexpr const char * kProviderOnlyAesSivCiphers [] = {
6231+ " aes-128-siv"
6232+ " aes-192-siv"
6233+ " aes-256-siv"
6234+ };
6235+ #endif
6236+
6237+ #if OPENSSL_WITH_AES_GCM_SIV
6238+ constexpr const char * kProviderOnlyAesGcmSivCiphers [] = {
6239+ " aes-128-gcm-siv"
6240+ " aes-192-gcm-siv"
6241+ " aes-256-gcm-siv"
6242+ };
6243+ #endif
6244+
61036245#if OPENSSL_VERSION_MAJOR >= 3
61046246template <class TypeName ,
61056247 TypeName* fetch_type (OSSL_LIB_CTX *, const char *, const char *),
@@ -6166,6 +6308,24 @@ void Cipher::ForEach(Cipher::CipherNameCallback callback) {
61666308 array_push_back<EVP_CIPHER >,
61676309#endif
61686310 &context);
6311+ #if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
6312+ auto maybe_push_provider_only_cipher = [&](const char * name) {
6313+ EVP_CIPHER * cipher = EVP_CIPHER_fetch (nullptr , name, nullptr );
6314+ if (cipher == nullptr ) return ;
6315+ EVP_CIPHER_free (cipher);
6316+ context.cb (name);
6317+ };
6318+ #endif
6319+ #if OPENSSL_WITH_AES_SIV
6320+ for (const char * name : kProviderOnlyAesSivCiphers ) {
6321+ maybe_push_provider_only_cipher (name);
6322+ }
6323+ #endif
6324+ #if OPENSSL_WITH_AES_GCM_SIV
6325+ for (const char * name : kProviderOnlyAesGcmSivCiphers ) {
6326+ maybe_push_provider_only_cipher (name);
6327+ }
6328+ #endif
61696329#endif
61706330}
61716331
0 commit comments