RSA_generate_key_ex: tighten up code a bit.

Change-Id: I2301ea3ce75292bcd4f0e943c916973fb543fdc3
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95567
Commit-Queue: Rudolf Polzer <rpolzer@google.com>
Reviewed-by: Rudolf Polzer <rpolzer@google.com>
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Adam Langley <agl@google.com>

crypto/fipsmodule/rsa/rsa_impl.cc.inc

diff --git a/crypto/fipsmodule/rsa/rsa_impl.cc.inc b/crypto/fipsmodule/rsa/rsa_impl.cc.inc
index 3ed7347..ba08ae7 100644
--- a/crypto/fipsmodule/rsa/rsa_impl.cc.inc
+++ b/crypto/fipsmodule/rsa/rsa_impl.cc.inc
@@ -753,31 +753,18 @@
   }
 
   // The smallest reasonable RSA exponent is 3, and it definitely must be odd.
-  // Catching this here prevents endless loops or slow computation when trying
-  // to actually generate keys later.
-  if (BN_is_negative(e_value)) {
-    // You're kidding.
-    //
-    // Would fail in |bn_lcm_consttime| anyway, as it only allows positive
-    // integers.
-    //
-    // However, |RSA_R_BAD_E_VALUE| is a better error return than |ERR_LIB_BN|.
-    OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_E_VALUE);
-    return 0;
-  }
-  if (!BN_is_odd(e_value)) {
-    // The R in RSA doesn't stand for Rabin.
-    //
-    // Would fail in |generate_prime| anyway, as only one |rsa->p|-1 is coprime
-    // with an even |e_value| and that one is a little bit short.
-    //
-    // However, |RSA_R_BAD_E_VALUE| is a better error return than |ERR_LIB_BN|.
-    OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_E_VALUE);
-    return 0;
-  }
-  if (BN_is_one(e_value)) {
-    // Would loop endlessly because _somehow_ it'll always compute a |rsa->d|
-    // exponent of 1, which is too small.
+  // Catching these here prevents endless loops or slow computation when trying
+  // to generate keys later, and results in a better error code.
+  if (
+      // Would fail in |bn_lcm_consttime| as it only allows positive integers.
+      BN_is_negative(e_value) ||
+      // Would fail in |generate_prime| as only one |rsa->p|-1 is coprime with
+      // an even |e_value| and that one is a little bit short. (The R in RSA
+      // doesn't stand for Rabin.)
+      !BN_is_odd(e_value) ||
+      // Would loop endlessly because it'll always compute an |rsa->d| exponent
+      // of 1, which is too small.
+      BN_is_one(e_value)) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_E_VALUE);
     return 0;
   }
@@ -830,8 +817,8 @@
     if (!generate_prime(rsa->p.get(), prime_bits, rsa->e.get(), nullptr,
                         pow2_prime_bits_100, ctx.get(), cb) ||
         !BN_GENCB_call(cb, 3, 0) ||
-        !generate_prime(rsa->q.get(), prime_bits, rsa->e.get(), rsa->p.get(), pow2_prime_bits_100,
-                        ctx.get(), cb) ||
+        !generate_prime(rsa->q.get(), prime_bits, rsa->e.get(), rsa->p.get(),
+                        pow2_prime_bits_100, ctx.get(), cb) ||
         !BN_GENCB_call(cb, 3, 1)) {
       OPENSSL_PUT_ERROR(RSA, ERR_LIB_BN);
       return 0;