From de7d0ab1c83083dedcf2e492963189bc2ba71ef0 Mon Sep 17 00:00:00 2001
From: tb <>
Date: Thu, 29 Aug 2024 16:58:19 +0000
Subject: Remove the pkey_{,public_,param_}check() handlers

This disables the EVP_PKEY_*check() API and makes it fail (more precisely
indicate lack of support) on all key types.

This is an intermediate step to full removal.
Removal is ok beck jsing
---
 src/lib/libcrypto/evp/evp_local.h | 10 +------
 src/lib/libcrypto/evp/pmeth_gn.c  | 60 +++++++--------------------------------
 2 files changed, 12 insertions(+), 58 deletions(-)

(limited to 'src/lib/libcrypto/evp')

diff --git a/src/lib/libcrypto/evp/evp_local.h b/src/lib/libcrypto/evp/evp_local.h
index 5d541ffec4..54cd65d0af 100644
--- a/src/lib/libcrypto/evp/evp_local.h
+++ b/src/lib/libcrypto/evp/evp_local.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: evp_local.h,v 1.24 2024/08/28 07:15:04 tb Exp $ */
+/* $OpenBSD: evp_local.h,v 1.25 2024/08/29 16:58:19 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -140,10 +140,6 @@ struct evp_pkey_asn1_method_st {
 	int (*item_sign)(EVP_MD_CTX *ctx, const ASN1_ITEM *it, void *asn,
 	    X509_ALGOR *alg1, X509_ALGOR *alg2, ASN1_BIT_STRING *sig);
 
-	int (*pkey_check)(const EVP_PKEY *pk);
-	int (*pkey_public_check)(const EVP_PKEY *pk);
-	int (*pkey_param_check)(const EVP_PKEY *pk);
-
 	int (*set_priv_key)(EVP_PKEY *pk, const unsigned char *private_key,
 	    size_t len);
 	int (*set_pub_key)(EVP_PKEY *pk, const unsigned char *public_key,
@@ -322,10 +318,6 @@ struct evp_pkey_method_st {
 	    const unsigned char *tbs, size_t tbslen);
 	int (*digestverify) (EVP_MD_CTX *ctx, const unsigned char *sig,
 	    size_t siglen, const unsigned char *tbs, size_t tbslen);
-
-	int (*check)(EVP_PKEY *pkey);
-	int (*public_check)(EVP_PKEY *pkey);
-	int (*param_check)(EVP_PKEY *pkey);
 } /* EVP_PKEY_METHOD */;
 
 void evp_pkey_set_cb_translate(BN_GENCB *cb, EVP_PKEY_CTX *ctx);
diff --git a/src/lib/libcrypto/evp/pmeth_gn.c b/src/lib/libcrypto/evp/pmeth_gn.c
index 1c355e594a..415690cd0e 100644
--- a/src/lib/libcrypto/evp/pmeth_gn.c
+++ b/src/lib/libcrypto/evp/pmeth_gn.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pmeth_gn.c,v 1.19 2024/04/17 08:24:11 tb Exp $ */
+/* $OpenBSD: pmeth_gn.c,v 1.20 2024/08/29 16:58:19 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006.
  */
@@ -226,68 +226,30 @@ merr:
 }
 LCRYPTO_ALIAS(EVP_PKEY_new_mac_key);
 
+/*
+ * XXX - remove the API below in the next bump.
+ */
+
 int
 EVP_PKEY_check(EVP_PKEY_CTX *ctx)
 {
-	EVP_PKEY *pkey;
-
-	if ((pkey = ctx->pkey) == NULL) {
-		EVPerror(EVP_R_NO_KEY_SET);
-		return 0;
-	}
-
-	if (ctx->pmeth->check != NULL)
-		return ctx->pmeth->check(pkey);
-
-	if (pkey->ameth == NULL || pkey->ameth->pkey_check == NULL) {
-		EVPerror(EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
-		return -2;
-	}
-
-	return pkey->ameth->pkey_check(pkey);
+	EVPerror(ERR_R_DISABLED);
+	return -2;
 }
 LCRYPTO_ALIAS(EVP_PKEY_check);
 
 int
 EVP_PKEY_public_check(EVP_PKEY_CTX *ctx)
 {
-	EVP_PKEY *pkey;
-
-	if ((pkey = ctx->pkey) == NULL) {
-		EVPerror(EVP_R_NO_KEY_SET);
-		return 0;
-	}
-
-	if (ctx->pmeth->public_check != NULL)
-		return ctx->pmeth->public_check(pkey);
-
-	if (pkey->ameth == NULL || pkey->ameth->pkey_public_check == NULL) {
-		EVPerror(EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
-		return -2;
-	}
-
-	return pkey->ameth->pkey_public_check(pkey);
+	EVPerror(ERR_R_DISABLED);
+	return -2;
 }
 LCRYPTO_ALIAS(EVP_PKEY_public_check);
 
 int
 EVP_PKEY_param_check(EVP_PKEY_CTX *ctx)
 {
-	EVP_PKEY *pkey;
-
-	if ((pkey = ctx->pkey) == NULL) {
-		EVPerror(EVP_R_NO_KEY_SET);
-		return 0;
-	}
-
-	if (ctx->pmeth->param_check != NULL)
-		return ctx->pmeth->param_check(pkey);
-
-	if (pkey->ameth == NULL || pkey->ameth->pkey_param_check == NULL) {
-		EVPerror(EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
-		return -2;
-	}
-
-	return pkey->ameth->pkey_param_check(pkey);
+	EVPerror(ERR_R_DISABLED);
+	return -2;
 }
 LCRYPTO_ALIAS(EVP_PKEY_param_check);
-- 
cgit v1.2.3-55-g6feb