p12_crt.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411
  1. /*
  2. * Copyright 1999-2023 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <stdio.h>
  10. #include "internal/cryptlib.h"
  11. #include <openssl/pkcs12.h>
  12. #include "p12_local.h"
  13. static int pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG) **pbags,
  14. PKCS12_SAFEBAG *bag);
  15. static int pkcs12_remove_bag(STACK_OF(PKCS12_SAFEBAG) **pbags,
  16. PKCS12_SAFEBAG *bag);
  17. static PKCS12_SAFEBAG *pkcs12_add_cert_bag(STACK_OF(PKCS12_SAFEBAG) **pbags,
  18. X509 *cert,
  19. const char *name,
  20. int namelen,
  21. unsigned char *keyid,
  22. int keyidlen);
  23. static int copy_bag_attr(PKCS12_SAFEBAG *bag, EVP_PKEY *pkey, int nid)
  24. {
  25. int idx = EVP_PKEY_get_attr_by_NID(pkey, nid, -1);
  26. if (idx < 0)
  27. return 1;
  28. return X509at_add1_attr(&bag->attrib, EVP_PKEY_get_attr(pkey, idx)) != NULL;
  29. }
  30. PKCS12 *PKCS12_create_ex2(const char *pass, const char *name, EVP_PKEY *pkey,
  31. X509 *cert, STACK_OF(X509) *ca, int nid_key, int nid_cert,
  32. int iter, int mac_iter, int keytype,
  33. OSSL_LIB_CTX *ctx, const char *propq,
  34. PKCS12_create_cb *cb, void *cbarg)
  35. {
  36. PKCS12 *p12 = NULL;
  37. STACK_OF(PKCS7) *safes = NULL;
  38. STACK_OF(PKCS12_SAFEBAG) *bags = NULL;
  39. PKCS12_SAFEBAG *bag = NULL;
  40. int i, cbret;
  41. unsigned char keyid[EVP_MAX_MD_SIZE];
  42. unsigned int keyidlen = 0;
  43. int namelen = -1;
  44. unsigned char *pkeyid = NULL;
  45. int pkeyidlen = -1;
  46. /* Set defaults */
  47. if (nid_cert == NID_undef)
  48. nid_cert = NID_aes_256_cbc;
  49. if (nid_key == NID_undef)
  50. nid_key = NID_aes_256_cbc;
  51. if (!iter)
  52. iter = PKCS12_DEFAULT_ITER;
  53. if (!mac_iter)
  54. mac_iter = PKCS12_DEFAULT_ITER;
  55. if (pkey == NULL && cert == NULL && ca == NULL) {
  56. ERR_raise(ERR_LIB_PKCS12, PKCS12_R_INVALID_NULL_ARGUMENT);
  57. return NULL;
  58. }
  59. if (pkey && cert) {
  60. if (!X509_check_private_key(cert, pkey))
  61. return NULL;
  62. if (!X509_digest(cert, EVP_sha1(), keyid, &keyidlen))
  63. return NULL;
  64. }
  65. if (cert) {
  66. if (name == NULL)
  67. name = (char *)X509_alias_get0(cert, &namelen);
  68. if (keyidlen > 0) {
  69. pkeyid = keyid;
  70. pkeyidlen = keyidlen;
  71. } else {
  72. pkeyid = X509_keyid_get0(cert, &pkeyidlen);
  73. }
  74. bag = pkcs12_add_cert_bag(&bags, cert, name, namelen, pkeyid, pkeyidlen);
  75. if (cb != NULL) {
  76. cbret = cb(bag, cbarg);
  77. if (cbret == -1) {
  78. ERR_raise(ERR_LIB_PKCS12, PKCS12_R_CALLBACK_FAILED);
  79. goto err;
  80. } else if (cbret == 0) {
  81. pkcs12_remove_bag(&bags, bag);
  82. }
  83. }
  84. }
  85. /* Add all other certificates */
  86. for (i = 0; i < sk_X509_num(ca); i++) {
  87. if ((bag = PKCS12_add_cert(&bags, sk_X509_value(ca, i))) == NULL)
  88. goto err;
  89. if (cb != NULL) {
  90. cbret = cb(bag, cbarg);
  91. if (cbret == -1) {
  92. ERR_raise(ERR_LIB_PKCS12, PKCS12_R_CALLBACK_FAILED);
  93. goto err;
  94. } else if (cbret == 0) {
  95. pkcs12_remove_bag(&bags, bag);
  96. }
  97. }
  98. }
  99. if (bags && !PKCS12_add_safe_ex(&safes, bags, nid_cert, iter, pass,
  100. ctx, propq))
  101. goto err;
  102. sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
  103. bags = NULL;
  104. if (pkey) {
  105. bag = PKCS12_add_key_ex(&bags, pkey, keytype, iter, nid_key, pass,
  106. ctx, propq);
  107. if (!bag)
  108. goto err;
  109. if (!copy_bag_attr(bag, pkey, NID_ms_csp_name))
  110. goto err;
  111. if (!copy_bag_attr(bag, pkey, NID_LocalKeySet))
  112. goto err;
  113. if (name && !PKCS12_add_friendlyname(bag, name, -1))
  114. goto err;
  115. if (keyidlen && !PKCS12_add_localkeyid(bag, keyid, keyidlen))
  116. goto err;
  117. if (cb != NULL) {
  118. cbret = cb(bag, cbarg);
  119. if (cbret == -1) {
  120. ERR_raise(ERR_LIB_PKCS12, PKCS12_R_CALLBACK_FAILED);
  121. goto err;
  122. } else if (cbret == 0) {
  123. pkcs12_remove_bag(&bags, bag);
  124. }
  125. }
  126. }
  127. if (bags && !PKCS12_add_safe(&safes, bags, -1, 0, NULL))
  128. goto err;
  129. sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
  130. bags = NULL;
  131. p12 = PKCS12_add_safes_ex(safes, 0, ctx, propq);
  132. if (p12 == NULL)
  133. goto err;
  134. sk_PKCS7_pop_free(safes, PKCS7_free);
  135. safes = NULL;
  136. if ((mac_iter != -1) &&
  137. !PKCS12_set_mac(p12, pass, -1, NULL, 0, mac_iter, NULL))
  138. goto err;
  139. return p12;
  140. err:
  141. PKCS12_free(p12);
  142. sk_PKCS7_pop_free(safes, PKCS7_free);
  143. sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
  144. return NULL;
  145. }
  146. PKCS12 *PKCS12_create_ex(const char *pass, const char *name, EVP_PKEY *pkey, X509 *cert,
  147. STACK_OF(X509) *ca, int nid_key, int nid_cert, int iter,
  148. int mac_iter, int keytype,
  149. OSSL_LIB_CTX *ctx, const char *propq)
  150. {
  151. return PKCS12_create_ex2(pass, name, pkey, cert, ca, nid_key, nid_cert,
  152. iter, mac_iter, keytype, ctx, propq,
  153. NULL, NULL);
  154. }
  155. PKCS12 *PKCS12_create(const char *pass, const char *name, EVP_PKEY *pkey, X509 *cert,
  156. STACK_OF(X509) *ca, int nid_key, int nid_cert, int iter,
  157. int mac_iter, int keytype)
  158. {
  159. return PKCS12_create_ex(pass, name, pkey, cert, ca, nid_key, nid_cert,
  160. iter, mac_iter, keytype, NULL, NULL);
  161. }
  162. static PKCS12_SAFEBAG *pkcs12_add_cert_bag(STACK_OF(PKCS12_SAFEBAG) **pbags,
  163. X509 *cert,
  164. const char *name,
  165. int namelen,
  166. unsigned char *keyid,
  167. int keyidlen)
  168. {
  169. PKCS12_SAFEBAG *bag = NULL;
  170. /* Add user certificate */
  171. if ((bag = PKCS12_SAFEBAG_create_cert(cert)) == NULL)
  172. goto err;
  173. if (name != NULL && !PKCS12_add_friendlyname(bag, name, namelen))
  174. goto err;
  175. if (keyid != NULL && !PKCS12_add_localkeyid(bag, keyid, keyidlen))
  176. goto err;
  177. if (!pkcs12_add_bag(pbags, bag))
  178. goto err;
  179. return bag;
  180. err:
  181. PKCS12_SAFEBAG_free(bag);
  182. return NULL;
  183. }
  184. PKCS12_SAFEBAG *PKCS12_add_cert(STACK_OF(PKCS12_SAFEBAG) **pbags, X509 *cert)
  185. {
  186. char *name = NULL;
  187. int namelen = -1;
  188. unsigned char *keyid = NULL;
  189. int keyidlen = -1;
  190. /*
  191. * Use friendlyName and localKeyID in certificate. (if present)
  192. */
  193. name = (char *)X509_alias_get0(cert, &namelen);
  194. keyid = X509_keyid_get0(cert, &keyidlen);
  195. return pkcs12_add_cert_bag(pbags, cert, name, namelen, keyid, keyidlen);
  196. }
  197. PKCS12_SAFEBAG *PKCS12_add_key_ex(STACK_OF(PKCS12_SAFEBAG) **pbags,
  198. EVP_PKEY *key, int key_usage, int iter,
  199. int nid_key, const char *pass,
  200. OSSL_LIB_CTX *ctx, const char *propq)
  201. {
  202. PKCS12_SAFEBAG *bag = NULL;
  203. PKCS8_PRIV_KEY_INFO *p8 = NULL;
  204. /* Make a PKCS#8 structure */
  205. if ((p8 = EVP_PKEY2PKCS8(key)) == NULL)
  206. goto err;
  207. if (key_usage && !PKCS8_add_keyusage(p8, key_usage))
  208. goto err;
  209. if (nid_key != -1) {
  210. bag = PKCS12_SAFEBAG_create_pkcs8_encrypt_ex(nid_key, pass, -1, NULL, 0,
  211. iter, p8, ctx, propq);
  212. PKCS8_PRIV_KEY_INFO_free(p8);
  213. } else
  214. bag = PKCS12_SAFEBAG_create0_p8inf(p8);
  215. if (!bag)
  216. goto err;
  217. if (!pkcs12_add_bag(pbags, bag))
  218. goto err;
  219. return bag;
  220. err:
  221. PKCS12_SAFEBAG_free(bag);
  222. return NULL;
  223. }
  224. PKCS12_SAFEBAG *PKCS12_add_key(STACK_OF(PKCS12_SAFEBAG) **pbags,
  225. EVP_PKEY *key, int key_usage, int iter,
  226. int nid_key, const char *pass)
  227. {
  228. return PKCS12_add_key_ex(pbags, key, key_usage, iter, nid_key, pass,
  229. NULL, NULL);
  230. }
  231. PKCS12_SAFEBAG *PKCS12_add_secret(STACK_OF(PKCS12_SAFEBAG) **pbags,
  232. int nid_type, const unsigned char *value, int len)
  233. {
  234. PKCS12_SAFEBAG *bag = NULL;
  235. /* Add secret, storing the value as an octet string */
  236. if ((bag = PKCS12_SAFEBAG_create_secret(nid_type, V_ASN1_OCTET_STRING, value, len)) == NULL)
  237. goto err;
  238. if (!pkcs12_add_bag(pbags, bag))
  239. goto err;
  240. return bag;
  241. err:
  242. PKCS12_SAFEBAG_free(bag);
  243. return NULL;
  244. }
  245. int PKCS12_add_safe_ex(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags,
  246. int nid_safe, int iter, const char *pass,
  247. OSSL_LIB_CTX *ctx, const char *propq)
  248. {
  249. PKCS7 *p7 = NULL;
  250. int free_safes = 0;
  251. if (*psafes == NULL) {
  252. *psafes = sk_PKCS7_new_null();
  253. if (*psafes == NULL)
  254. return 0;
  255. free_safes = 1;
  256. }
  257. if (nid_safe == 0)
  258. #ifdef OPENSSL_NO_RC2
  259. nid_safe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
  260. #else
  261. nid_safe = NID_pbe_WithSHA1And40BitRC2_CBC;
  262. #endif
  263. if (nid_safe == -1)
  264. p7 = PKCS12_pack_p7data(bags);
  265. else
  266. p7 = PKCS12_pack_p7encdata_ex(nid_safe, pass, -1, NULL, 0, iter, bags, ctx, propq);
  267. if (p7 == NULL)
  268. goto err;
  269. if (!sk_PKCS7_push(*psafes, p7))
  270. goto err;
  271. return 1;
  272. err:
  273. if (free_safes) {
  274. sk_PKCS7_free(*psafes);
  275. *psafes = NULL;
  276. }
  277. PKCS7_free(p7);
  278. return 0;
  279. }
  280. int PKCS12_add_safe(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags,
  281. int nid_safe, int iter, const char *pass)
  282. {
  283. return PKCS12_add_safe_ex(psafes, bags, nid_safe, iter, pass, NULL, NULL);
  284. }
  285. static int pkcs12_remove_bag(STACK_OF(PKCS12_SAFEBAG) **pbags,
  286. PKCS12_SAFEBAG *bag)
  287. {
  288. PKCS12_SAFEBAG *tmp;
  289. if (pbags == NULL || bag == NULL)
  290. return 1;
  291. if ((tmp = sk_PKCS12_SAFEBAG_delete_ptr(*pbags, bag)) == NULL)
  292. return 0;
  293. PKCS12_SAFEBAG_free(tmp);
  294. return 1;
  295. }
  296. static int pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG) **pbags,
  297. PKCS12_SAFEBAG *bag)
  298. {
  299. int free_bags = 0;
  300. if (pbags == NULL)
  301. return 1;
  302. if (*pbags == NULL) {
  303. *pbags = sk_PKCS12_SAFEBAG_new_null();
  304. if (*pbags == NULL)
  305. return 0;
  306. free_bags = 1;
  307. }
  308. if (!sk_PKCS12_SAFEBAG_push(*pbags, bag)) {
  309. if (free_bags) {
  310. sk_PKCS12_SAFEBAG_free(*pbags);
  311. *pbags = NULL;
  312. }
  313. return 0;
  314. }
  315. return 1;
  316. }
  317. PKCS12 *PKCS12_add_safes_ex(STACK_OF(PKCS7) *safes, int nid_p7,
  318. OSSL_LIB_CTX *ctx, const char *propq)
  319. {
  320. PKCS12 *p12;
  321. if (nid_p7 <= 0)
  322. nid_p7 = NID_pkcs7_data;
  323. p12 = PKCS12_init_ex(nid_p7, ctx, propq);
  324. if (p12 == NULL)
  325. return NULL;
  326. if (!PKCS12_pack_authsafes(p12, safes)) {
  327. PKCS12_free(p12);
  328. return NULL;
  329. }
  330. return p12;
  331. }
  332. PKCS12 *PKCS12_add_safes(STACK_OF(PKCS7) *safes, int nid_p7)
  333. {
  334. return PKCS12_add_safes_ex(safes, nid_p7, NULL, NULL);
  335. }