Provide DH_check*_ex and many error codes

DH_check{,_pub_key}_ex() wrap their non-ex versions to translate
the flags argument of the original functions into OpenSSL errors.
For this almost a dozen new error codes need to be added.

DH_params_check{,_ex}() is a new version of DH_check that only
performs a cheap subset of the checks.

They are needed to implement EVP_PKEY_{public,param}_check()
(observe the consistent naming) although the actual implementation
of EVP_PKEY_param_check() chose to use DH_check_ex().

As far as I can tell, the only raison d'être of the _ex functions
and error codes is to spew them to stderr in a couple of openssl(1)
commands. This couldn't have been solved differently...

These functions will not be exposed publicly.

ok inoguchi jsing

1 files changed, 12 insertions, 1 deletions

diff --git a/src/lib/libcrypto/dh/dh.h b/src/lib/libcrypto/dh/dh.h
index 3059b291cf..21e840efc4 100644
--- a/src/lib/libcrypto/dh/dh.h
+++ b/src/lib/libcrypto/dh/dh.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh.h,v 1.29 2022/01/07 09:21:21 tb Exp $ */
+/* $OpenBSD: dh.h,v 1.30 2022/01/10 12:00:52 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -288,6 +288,17 @@ void ERR_load_DH_strings(void);
 #define DH_R_NO_PARAMETERS_SET                           107
 #define DH_R_NO_PRIVATE_VALUE                            100
 #define DH_R_PARAMETER_ENCODING_ERROR                    105
+#define DH_R_CHECK_INVALID_J_VALUE                       115
+#define DH_R_CHECK_INVALID_Q_VALUE                       116
+#define DH_R_CHECK_PUBKEY_INVALID                        122
+#define DH_R_CHECK_PUBKEY_TOO_LARGE                      123
+#define DH_R_CHECK_PUBKEY_TOO_SMALL                      124
+#define DH_R_CHECK_P_NOT_PRIME                           117
+#define DH_R_CHECK_P_NOT_SAFE_PRIME                      118
+#define DH_R_CHECK_Q_NOT_PRIME                           119
+#define DH_R_MISSING_PUBKEY                              125
+#define DH_R_NOT_SUITABLE_GENERATOR                      120
+#define DH_R_UNABLE_TO_CHECK_GENERATOR                   121
 
 #ifdef  __cplusplus
 }