Add definition of OSSL_PARAM OSSL_PARAM was previously not defined and was expected to be null when passed as function parameters. Since some consumers need it to compile, for compatibility with OpenSSL, this CL defines the struct and adds the macro for a terminating OSSL_PARAM. BoringSSL functions still expect an OSSL_PARAM array argument to either be null or start with a terminaing OSSL_PARAM. Bug: 497718229 Change-Id: I6c42cf488d8f2aefc6dd69c4b2b994c86a6a6964 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/91887 Commit-Queue: Lily Chen <chlily@google.com> Reviewed-by: David Benjamin <davidben@google.com>
diff --git a/build.json b/build.json index 88d962c..65c021d 100644 --- a/build.json +++ b/build.json
@@ -465,6 +465,7 @@ "include/openssl/opensslconf.h", "include/openssl/opensslv.h", "include/openssl/ossl_typ.h", + "include/openssl/params.h", "include/openssl/pem.h", "include/openssl/pkcs12.h", "include/openssl/pkcs7.h", @@ -548,6 +549,7 @@ "crypto/md5/internal.h", "crypto/mem_internal.h", "crypto/obj/obj_dat.h", + "crypto/params_internal.h", "crypto/pem/internal.h", "crypto/pkcs7/internal.h", "crypto/pkcs8/internal.h",
diff --git a/crypto/evp/evp_ctx.cc b/crypto/evp/evp_ctx.cc index 6ca54ca..bcb9c59 100644 --- a/crypto/evp/evp_ctx.cc +++ b/crypto/evp/evp_ctx.cc
@@ -19,9 +19,11 @@ #include <openssl/digest.h> #include <openssl/err.h> #include <openssl/mem.h> +#include <openssl/params.h> #include "../internal.h" #include "../mem_internal.h" +#include "../params_internal.h" #include "internal.h" @@ -477,7 +479,7 @@ } int EVP_PKEY_encapsulate_init(EVP_PKEY_CTX *ctx, const OSSL_PARAM *params) { - if (params != nullptr) { + if (params != nullptr && !IsEndParam(*params)) { OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_PARAMETERS); return 0; } @@ -511,7 +513,7 @@ } int EVP_PKEY_decapsulate_init(EVP_PKEY_CTX *ctx, const OSSL_PARAM *params) { - if (params != nullptr) { + if (params != nullptr && !IsEndParam(*params)) { OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_PARAMETERS); return 0; }
diff --git a/crypto/evp/evp_extra_test.cc b/crypto/evp/evp_extra_test.cc index 511a85f..675718b 100644 --- a/crypto/evp/evp_extra_test.cc +++ b/crypto/evp/evp_extra_test.cc
@@ -31,6 +31,7 @@ #include <openssl/ec.h> #include <openssl/ec_key.h> #include <openssl/err.h> +#include <openssl/params.h> #include <openssl/pkcs8.h> #include <openssl/rsa.h> #include <openssl/span.h> @@ -1487,5 +1488,26 @@ ErrorEquals(ERR_peek_last_error(), ERR_LIB_EVP, EVP_R_DECODE_ERROR)); } +// Tests that EVP_PKEY_(en|de)capsulate_init correctly handles the stub +// OSSL_PARAM struct. +TEST(EVPExtraTest, EncapsulateDecapsulateOsslParam) { + OSSL_PARAM kOneEndParam[] = {OSSL_PARAM_END}; + OSSL_PARAM kTwoEndParams[] = {OSSL_PARAM_END, OSSL_PARAM_END}; + OSSL_PARAM kNotEndParam[] = {{"foo", 0, nullptr, 0, 0}}; + UniquePtr<EVP_PKEY> pkey(EVP_PKEY_generate_from_alg(EVP_pkey_ml_kem_768())); + UniquePtr<EVP_PKEY_CTX> ctx; + + for (const auto init_func : + {&EVP_PKEY_encapsulate_init, &EVP_PKEY_decapsulate_init}) { + ctx.reset(EVP_PKEY_CTX_new(pkey.get(), nullptr)); + EXPECT_TRUE(init_func(ctx.get(), nullptr)); + EXPECT_TRUE(init_func(ctx.get(), kOneEndParam)); + EXPECT_TRUE(init_func(ctx.get(), kTwoEndParams)); + EXPECT_FALSE(init_func(ctx.get(), kNotEndParam)); + EXPECT_TRUE(ErrorEquals(ERR_peek_last_error(), ERR_LIB_EVP, + EVP_R_INVALID_PARAMETERS)); + } +} + } // namespace BSSL_NAMESPACE_END
diff --git a/crypto/params_internal.h b/crypto/params_internal.h new file mode 100644 index 0000000..7baa2a8 --- /dev/null +++ b/crypto/params_internal.h
@@ -0,0 +1,30 @@ +// Copyright 2026 The BoringSSL Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef OPENSSL_HEADER_CRYPTO_PARAMS_INTERNAL_H +#define OPENSSL_HEADER_CRYPTO_PARAMS_INTERNAL_H + +#include <openssl/params.h> + + +BSSL_NAMESPACE_BEGIN + +// IsEndParam returns whether `param` is a terminating element. +inline bool IsEndParam(const OSSL_PARAM ¶m) { + return param.key == nullptr; +} + +BSSL_NAMESPACE_END + +#endif // OPENSSL_HEADER_CRYPTO_PARAMS_INTERNAL_H
diff --git a/gen/sources.bzl b/gen/sources.bzl index 098130f..8255517 100644 --- a/gen/sources.bzl +++ b/gen/sources.bzl
@@ -594,6 +594,7 @@ "include/openssl/opensslconf.h", "include/openssl/opensslv.h", "include/openssl/ossl_typ.h", + "include/openssl/params.h", "include/openssl/pem.h", "include/openssl/pkcs12.h", "include/openssl/pkcs7.h", @@ -679,6 +680,7 @@ "crypto/md5/internal.h", "crypto/mem_internal.h", "crypto/obj/obj_dat.h", + "crypto/params_internal.h", "crypto/pem/internal.h", "crypto/pkcs7/internal.h", "crypto/pkcs8/internal.h",
diff --git a/gen/sources.cmake b/gen/sources.cmake index c605e01..a20322f 100644 --- a/gen/sources.cmake +++ b/gen/sources.cmake
@@ -614,6 +614,7 @@ include/openssl/opensslconf.h include/openssl/opensslv.h include/openssl/ossl_typ.h + include/openssl/params.h include/openssl/pem.h include/openssl/pkcs12.h include/openssl/pkcs7.h @@ -701,6 +702,7 @@ crypto/md5/internal.h crypto/mem_internal.h crypto/obj/obj_dat.h + crypto/params_internal.h crypto/pem/internal.h crypto/pkcs7/internal.h crypto/pkcs8/internal.h
diff --git a/gen/sources.gni b/gen/sources.gni index fc32cb1..af72a77 100644 --- a/gen/sources.gni +++ b/gen/sources.gni
@@ -594,6 +594,7 @@ "include/openssl/opensslconf.h", "include/openssl/opensslv.h", "include/openssl/ossl_typ.h", + "include/openssl/params.h", "include/openssl/pem.h", "include/openssl/pkcs12.h", "include/openssl/pkcs7.h", @@ -679,6 +680,7 @@ "crypto/md5/internal.h", "crypto/mem_internal.h", "crypto/obj/obj_dat.h", + "crypto/params_internal.h", "crypto/pem/internal.h", "crypto/pkcs7/internal.h", "crypto/pkcs8/internal.h",
diff --git a/gen/sources.json b/gen/sources.json index 5694bf5..d5e1b0d 100644 --- a/gen/sources.json +++ b/gen/sources.json
@@ -577,6 +577,7 @@ "include/openssl/opensslconf.h", "include/openssl/opensslv.h", "include/openssl/ossl_typ.h", + "include/openssl/params.h", "include/openssl/pem.h", "include/openssl/pkcs12.h", "include/openssl/pkcs7.h", @@ -661,6 +662,7 @@ "crypto/md5/internal.h", "crypto/mem_internal.h", "crypto/obj/obj_dat.h", + "crypto/params_internal.h", "crypto/pem/internal.h", "crypto/pkcs7/internal.h", "crypto/pkcs8/internal.h",
diff --git a/gen/sources.mk b/gen/sources.mk index 8298fc0..8b8173c 100644 --- a/gen/sources.mk +++ b/gen/sources.mk
@@ -585,6 +585,7 @@ include/openssl/opensslconf.h \ include/openssl/opensslv.h \ include/openssl/ossl_typ.h \ + include/openssl/params.h \ include/openssl/pem.h \ include/openssl/pkcs12.h \ include/openssl/pkcs7.h \ @@ -669,6 +670,7 @@ crypto/md5/internal.h \ crypto/mem_internal.h \ crypto/obj/obj_dat.h \ + crypto/params_internal.h \ crypto/pem/internal.h \ crypto/pkcs7/internal.h \ crypto/pkcs8/internal.h \
diff --git a/include/openssl/base.h b/include/openssl/base.h index cf79cdc..0526ea5 100644 --- a/include/openssl/base.h +++ b/include/openssl/base.h
@@ -231,11 +231,6 @@ // It is used in function parameters that must be NULL. typedef struct crypto_must_be_null_st CRYPTO_MUST_BE_NULL; -// OSSL_PARAM is an opaque type defined only for OpenSSL compatiblity. It is -// never returned from BoringSSL and must be NULL when passed as function -// parameters. -typedef struct ossl_param_st OSSL_PARAM; - typedef int ASN1_BOOLEAN; typedef struct ASN1_ITEM_st ASN1_ITEM; typedef struct asn1_object_st ASN1_OBJECT; @@ -325,6 +320,7 @@ typedef struct md4_state_st MD4_CTX; typedef struct md5_state_st MD5_CTX; typedef struct ossl_init_settings_st OPENSSL_INIT_SETTINGS; +typedef struct ossl_param_st OSSL_PARAM; typedef struct pkcs12_st PKCS12; typedef struct pkcs8_priv_key_info_st PKCS8_PRIV_KEY_INFO; typedef struct private_key_st X509_PKEY;
diff --git a/include/openssl/evp.h b/include/openssl/evp.h index 7611d1f..cfb071d 100644 --- a/include/openssl/evp.h +++ b/include/openssl/evp.h
@@ -917,7 +917,8 @@ // EVP_PKEY_encapsulate_init initialises an |EVP_PKEY_CTX| for an encapsulate // operation. It should be called before |EVP_PKEY_encapsulate|. |params| is -// included for OpenSSL compatibility, but this parameter should be NULL. +// included for OpenSSL compatibility, but this parameter should be NULL or have +// |OSSL_PARAM_END| as its first element. // // It returns one on success or zero on error. OPENSSL_EXPORT int EVP_PKEY_encapsulate_init(EVP_PKEY_CTX *ctx, @@ -949,7 +950,8 @@ // EVP_PKEY_decapsulate_init initialises an |EVP_PKEY_CTX| for a decapsulate // operation. It should be called before |EVP_PKEY_decapsulate|. |params| is -// included for OpenSSL compatibility, but this parameter should be NULL. +// included for OpenSSL compatibility, but this parameter should be NULL or have +// |OSSL_PARAM_END| as its first element. // // It returns one on success or zero on error. OPENSSL_EXPORT int EVP_PKEY_decapsulate_init(EVP_PKEY_CTX *ctx,
diff --git a/include/openssl/params.h b/include/openssl/params.h new file mode 100644 index 0000000..95e3f4e --- /dev/null +++ b/include/openssl/params.h
@@ -0,0 +1,42 @@ +// Copyright 2026 The BoringSSL Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef OPENSSL_HEADER_PARAMS_H +#define OPENSSL_HEADER_PARAMS_H + +#include <openssl/base.h> // IWYU pragma: export + +#if defined(__cplusplus) +extern "C" { +#endif + +// ossl_param_st is a structure for passing arbitrary parameters. It is +// currently never returned from BoringSSL, but is defined here for +// compatibility with OpenSSL. +struct ossl_param_st { + const char *key; + uint32_t data_type; + void *data; + size_t data_size; + size_t return_size; +}; + +// OSSL_PARAM_END is a terminating element in an array of |OSSL_PARAM|s. +#define OSSL_PARAM_END {NULL, 0, NULL, 0, 0} + +#if defined(__cplusplus) +} // extern C +#endif + +#endif // OPENSSL_HEADER_PARAMS_H