Implement OSSL_SIGNATURE_PARAM_ALGORITHM_ID in provider sign. context

[frank-heimes]

When creating self-signed certificates or signing certificate requests with OpenSSL using pkcs11prov (e.g., openssl req -x509 ... -provider pkcs11prov), OpenSSL queries the provider signature context for OSSL_SIGNATURE_PARAM_ALGORITHM_ID ("algorithm-id") to obtain the DER-encoded AlgorithmIdentifier.

Without handling OSSL_SIGNATURE_PARAM_ALGORITHM_ID, OpenSSL fails during certificate creation with:
error:068000E0:asn1 encoding routines:asn1_item_embed_d2i:too small
error:0680006E:asn1 encoding routines:replace_algor_contents_from_DER:decode error

This change implements OSSL_SIGNATURE_PARAM_ALGORITHM_ID in signature_get_ctx_params() and registers it in signature_gettable_ctx_params() for RSA, EC, Ed25519, and Ed448 keys.

Pull Request Type

Bug fix

Related Issue

Issue number: N/A

Current Behavior

| libtool: compile: gcc -DHAVE_CONFIG_H -I. -Wdate-time -D_FORTIFY_SOURCE=2 -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/libp11-0.4.18=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -pthread -c p11_ec.c -fPIC -DPIC -o .libs/libp11_la-p11_ec.o
| p11_ec.c: In function 'pkcs11_get_point':
| p11_ec.c:282:23: error: invalid use of incomplete typedef 'ASN1_OCTET_STRING' {aka 'struct asn1_string_st'}
| 282 | a = os->data;
| | ^~
| p11_ec.c:283:49: error: invalid use of incomplete typedef 'ASN1_OCTET_STRING' {aka 'struct asn1_string_st'}
| 283 | rv = o2i_ECPublicKey(&ec, &a, os->length) == NULL;
| | ^~
| make[3]: *** [Makefile:908: libp11_la-p11_ec.lo] Error 1

New Behavior

no build issues anymore (tested on all major architectures (armhf, arm64, amd64, s390x, ppc64el, riscv)

Scope of Changes

If OSSL_SIGNATURE_PARAM_ALGORITHM_ID is not handled, OpenSSL fails during certificate creation with: "error:068000E0:asn1 encoding routines:asn1 ..."
Change implements OSSL_SIGNATURE_PARAM_ALGORITHM_ID in signature_get_ctx_params() and registers it in signature_gettable_ctx_params() for RSA, EC, Ed25519, and Ed448 keys.

Testing

Test build was done here:
https://launchpad.net/~fheimes/+archive/ubuntu/lp2155023-libp11
(build logs are also available there, as well as the tests as part of it)

Additional Notes

n/a

License Declaration

I hereby agree to license my contribution under the project's license.

[mtrojnar]

Don't we have this fix already merged from #670?

[frank-heimes]

Oh, I'm sorry if this is the case.
I have a patch since a while,
but wanted to let build and tests complete before I created the PR.

So I must have missed that - I apologize.

[mtrojnar]

Thank you for submitting your fix. Apparently, we were developing and testing our fixes for the same issue at the same time. This happens quite often.