store_result.c 22 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623
  1. /*
  2. * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include "e_os.h"
  10. #include <string.h>
  11. #include <openssl/core.h>
  12. #include <openssl/core_names.h>
  13. #include <openssl/core_object.h>
  14. #include <openssl/err.h>
  15. #include <openssl/pkcs12.h>
  16. #include <openssl/provider.h>
  17. #include <openssl/decoder.h>
  18. #include <openssl/store.h>
  19. #include "internal/provider.h"
  20. #include "internal/passphrase.h"
  21. #include "crypto/evp.h"
  22. #include "crypto/x509.h"
  23. #include "store_local.h"
  24. #ifndef OSSL_OBJECT_PKCS12
  25. /*
  26. * The object abstraction doesn't know PKCS#12, but we want to indicate
  27. * it anyway, so we create our own. Since the public macros use positive
  28. * numbers, negative ones should be fine. They must never slip out from
  29. * this translation unit anyway.
  30. */
  31. # define OSSL_OBJECT_PKCS12 -1
  32. #endif
  33. /*
  34. * ossl_store_handle_load_result() is initially written to be a companion
  35. * to our 'file:' scheme provider implementation, but has been made generic
  36. * to serve others as well.
  37. *
  38. * This result handler takes any object abstraction (see provider-object(7))
  39. * and does the best it can with it. If the object is passed by value (not
  40. * by reference), the contents are currently expected to be DER encoded.
  41. * If an object type is specified, that will be respected; otherwise, this
  42. * handler will guess the contents, by trying the following in order:
  43. *
  44. * 1. Decode it into an EVP_PKEY, using OSSL_DECODER.
  45. * 2. Decode it into an X.509 certificate, using d2i_X509 / d2i_X509_AUX.
  46. * 3. Decode it into an X.509 CRL, using d2i_X509_CRL.
  47. * 4. Decode it into a PKCS#12 structure, using d2i_PKCS12 (*).
  48. *
  49. * For the 'file:' scheme implementation, this is division of labor. Since
  50. * the libcrypto <-> provider interface currently doesn't support certain
  51. * structures as first class objects, they must be unpacked from DER here
  52. * rather than in the provider. The current exception is asymmetric keys,
  53. * which can reside within the provider boundary, most of all thanks to
  54. * OSSL_FUNC_keymgmt_load(), which allows loading the key material by
  55. * reference.
  56. */
  57. struct extracted_param_data_st {
  58. int object_type;
  59. const char *data_type;
  60. const char *data_structure;
  61. const char *utf8_data;
  62. const void *octet_data;
  63. size_t octet_data_size;
  64. const void *ref;
  65. size_t ref_size;
  66. const char *desc;
  67. };
  68. static int try_name(struct extracted_param_data_st *, OSSL_STORE_INFO **);
  69. static int try_key(struct extracted_param_data_st *, OSSL_STORE_INFO **,
  70. OSSL_STORE_CTX *, const OSSL_PROVIDER *,
  71. OSSL_LIB_CTX *, const char *);
  72. static int try_cert(struct extracted_param_data_st *, OSSL_STORE_INFO **,
  73. OSSL_LIB_CTX *, const char *);
  74. static int try_crl(struct extracted_param_data_st *, OSSL_STORE_INFO **,
  75. OSSL_LIB_CTX *, const char *);
  76. static int try_pkcs12(struct extracted_param_data_st *, OSSL_STORE_INFO **,
  77. OSSL_STORE_CTX *, OSSL_LIB_CTX *, const char *);
  78. int ossl_store_handle_load_result(const OSSL_PARAM params[], void *arg)
  79. {
  80. struct ossl_load_result_data_st *cbdata = arg;
  81. OSSL_STORE_INFO **v = &cbdata->v;
  82. OSSL_STORE_CTX *ctx = cbdata->ctx;
  83. const OSSL_PROVIDER *provider =
  84. OSSL_STORE_LOADER_get0_provider(ctx->fetched_loader);
  85. OSSL_LIB_CTX *libctx = ossl_provider_libctx(provider);
  86. const char *propq = ctx->properties;
  87. const OSSL_PARAM *p;
  88. struct extracted_param_data_st helper_data;
  89. memset(&helper_data, 0, sizeof(helper_data));
  90. helper_data.object_type = OSSL_OBJECT_UNKNOWN;
  91. if ((p = OSSL_PARAM_locate_const(params, OSSL_OBJECT_PARAM_TYPE)) != NULL
  92. && !OSSL_PARAM_get_int(p, &helper_data.object_type))
  93. return 0;
  94. p = OSSL_PARAM_locate_const(params, OSSL_OBJECT_PARAM_DATA_TYPE);
  95. if (p != NULL
  96. && !OSSL_PARAM_get_utf8_string_ptr(p, &helper_data.data_type))
  97. return 0;
  98. p = OSSL_PARAM_locate_const(params, OSSL_OBJECT_PARAM_DATA);
  99. if (p != NULL
  100. && !OSSL_PARAM_get_octet_string_ptr(p, &helper_data.octet_data,
  101. &helper_data.octet_data_size)
  102. && !OSSL_PARAM_get_utf8_string_ptr(p, &helper_data.utf8_data))
  103. return 0;
  104. p = OSSL_PARAM_locate_const(params, OSSL_OBJECT_PARAM_DATA_STRUCTURE);
  105. if (p != NULL
  106. && !OSSL_PARAM_get_utf8_string_ptr(p, &helper_data.data_structure))
  107. return 0;
  108. p = OSSL_PARAM_locate_const(params, OSSL_OBJECT_PARAM_REFERENCE);
  109. if (p != NULL && !OSSL_PARAM_get_octet_string_ptr(p, &helper_data.ref,
  110. &helper_data.ref_size))
  111. return 0;
  112. p = OSSL_PARAM_locate_const(params, OSSL_OBJECT_PARAM_DESC);
  113. if (p != NULL && !OSSL_PARAM_get_utf8_string_ptr(p, &helper_data.desc))
  114. return 0;
  115. /*
  116. * The helper functions return 0 on actual errors, otherwise 1, even if
  117. * they didn't fill out |*v|.
  118. */
  119. ERR_set_mark();
  120. if (*v == NULL && !try_name(&helper_data, v))
  121. goto err;
  122. ERR_pop_to_mark();
  123. ERR_set_mark();
  124. if (*v == NULL && !try_key(&helper_data, v, ctx, provider, libctx, propq))
  125. goto err;
  126. ERR_pop_to_mark();
  127. ERR_set_mark();
  128. if (*v == NULL && !try_cert(&helper_data, v, libctx, propq))
  129. goto err;
  130. ERR_pop_to_mark();
  131. ERR_set_mark();
  132. if (*v == NULL && !try_crl(&helper_data, v, libctx, propq))
  133. goto err;
  134. ERR_pop_to_mark();
  135. ERR_set_mark();
  136. if (*v == NULL && !try_pkcs12(&helper_data, v, ctx, libctx, propq))
  137. goto err;
  138. ERR_pop_to_mark();
  139. if (*v == NULL)
  140. ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_UNSUPPORTED);
  141. return (*v != NULL);
  142. err:
  143. ERR_clear_last_mark();
  144. return 0;
  145. }
  146. static int try_name(struct extracted_param_data_st *data, OSSL_STORE_INFO **v)
  147. {
  148. if (data->object_type == OSSL_OBJECT_NAME) {
  149. char *newname = NULL, *newdesc = NULL;
  150. if (data->utf8_data == NULL)
  151. return 0;
  152. if ((newname = OPENSSL_strdup(data->utf8_data)) == NULL
  153. || (data->desc != NULL
  154. && (newdesc = OPENSSL_strdup(data->desc)) == NULL)
  155. || (*v = OSSL_STORE_INFO_new_NAME(newname)) == NULL) {
  156. OPENSSL_free(newname);
  157. OPENSSL_free(newdesc);
  158. return 0;
  159. }
  160. OSSL_STORE_INFO_set0_NAME_description(*v, newdesc);
  161. }
  162. return 1;
  163. }
  164. /*
  165. * For the rest of the object types, the provider code may not know what
  166. * type of data it gave us, so we may need to figure that out on our own.
  167. * Therefore, we do check for OSSL_OBJECT_UNKNOWN everywhere below, and
  168. * only return 0 on error if the object type is known.
  169. */
  170. static EVP_PKEY *try_key_ref(struct extracted_param_data_st *data,
  171. OSSL_STORE_CTX *ctx,
  172. const OSSL_PROVIDER *provider,
  173. OSSL_LIB_CTX *libctx, const char *propq)
  174. {
  175. EVP_PKEY *pk = NULL;
  176. EVP_KEYMGMT *keymgmt = NULL;
  177. void *keydata = NULL;
  178. /* If we have an object reference, we must have a data type */
  179. if (data->data_type == NULL)
  180. return 0;
  181. keymgmt = EVP_KEYMGMT_fetch(libctx, data->data_type, propq);
  182. if (keymgmt != NULL) {
  183. /*
  184. * There are two possible cases
  185. *
  186. * 1. The keymgmt is from the same provider as the loader,
  187. * so we can use evp_keymgmt_load()
  188. * 2. The keymgmt is from another provider, then we must
  189. * do the export/import dance.
  190. */
  191. if (EVP_KEYMGMT_get0_provider(keymgmt) == provider) {
  192. keydata = evp_keymgmt_load(keymgmt, data->ref, data->ref_size);
  193. } else {
  194. struct evp_keymgmt_util_try_import_data_st import_data;
  195. OSSL_FUNC_store_export_object_fn *export_object =
  196. ctx->fetched_loader->p_export_object;
  197. import_data.keymgmt = keymgmt;
  198. import_data.keydata = NULL;
  199. import_data.selection = OSSL_KEYMGMT_SELECT_ALL;
  200. if (export_object != NULL) {
  201. /*
  202. * No need to check for errors here, the value of
  203. * |import_data.keydata| is as much an indicator.
  204. */
  205. (void)export_object(ctx->loader_ctx,
  206. data->ref, data->ref_size,
  207. &evp_keymgmt_util_try_import,
  208. &import_data);
  209. }
  210. keydata = import_data.keydata;
  211. }
  212. }
  213. if (keydata != NULL)
  214. pk = evp_keymgmt_util_make_pkey(keymgmt, keydata);
  215. EVP_KEYMGMT_free(keymgmt);
  216. return pk;
  217. }
  218. static EVP_PKEY *try_key_value(struct extracted_param_data_st *data,
  219. OSSL_STORE_CTX *ctx,
  220. OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg,
  221. OSSL_LIB_CTX *libctx, const char *propq)
  222. {
  223. EVP_PKEY *pk = NULL;
  224. OSSL_DECODER_CTX *decoderctx = NULL;
  225. const unsigned char *pdata = data->octet_data;
  226. size_t pdatalen = data->octet_data_size;
  227. int selection = 0;
  228. switch (ctx->expected_type) {
  229. case 0:
  230. break;
  231. case OSSL_STORE_INFO_PARAMS:
  232. selection = OSSL_KEYMGMT_SELECT_ALL_PARAMETERS;
  233. break;
  234. case OSSL_STORE_INFO_PUBKEY:
  235. selection =
  236. OSSL_KEYMGMT_SELECT_PUBLIC_KEY
  237. | OSSL_KEYMGMT_SELECT_ALL_PARAMETERS;
  238. break;
  239. case OSSL_STORE_INFO_PKEY:
  240. selection = OSSL_KEYMGMT_SELECT_ALL;
  241. break;
  242. default:
  243. return NULL;
  244. }
  245. decoderctx =
  246. OSSL_DECODER_CTX_new_for_pkey(&pk, "DER", data->data_structure,
  247. data->data_type, selection, libctx,
  248. propq);
  249. (void)OSSL_DECODER_CTX_set_passphrase_cb(decoderctx, cb, cbarg);
  250. /* No error if this couldn't be decoded */
  251. (void)OSSL_DECODER_from_data(decoderctx, &pdata, &pdatalen);
  252. OSSL_DECODER_CTX_free(decoderctx);
  253. return pk;
  254. }
  255. typedef OSSL_STORE_INFO *store_info_new_fn(EVP_PKEY *);
  256. static EVP_PKEY *try_key_value_legacy(struct extracted_param_data_st *data,
  257. store_info_new_fn **store_info_new,
  258. OSSL_STORE_CTX *ctx,
  259. OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg,
  260. OSSL_LIB_CTX *libctx, const char *propq)
  261. {
  262. EVP_PKEY *pk = NULL;
  263. const unsigned char *der = data->octet_data, *derp;
  264. long der_len = (long)data->octet_data_size;
  265. /* Try PUBKEY first, that's a real easy target */
  266. if (ctx->expected_type == 0
  267. || ctx->expected_type == OSSL_STORE_INFO_PUBKEY) {
  268. derp = der;
  269. pk = d2i_PUBKEY_ex(NULL, &derp, der_len, libctx, propq);
  270. if (pk != NULL)
  271. *store_info_new = OSSL_STORE_INFO_new_PUBKEY;
  272. }
  273. /* Try private keys next */
  274. if (pk == NULL
  275. && (ctx->expected_type == 0
  276. || ctx->expected_type == OSSL_STORE_INFO_PKEY)) {
  277. unsigned char *new_der = NULL;
  278. X509_SIG *p8 = NULL;
  279. PKCS8_PRIV_KEY_INFO *p8info = NULL;
  280. /* See if it's an encrypted PKCS#8 and decrypt it. */
  281. derp = der;
  282. p8 = d2i_X509_SIG(NULL, &derp, der_len);
  283. if (p8 != NULL) {
  284. char pbuf[PEM_BUFSIZE];
  285. size_t plen = 0;
  286. if (!cb(pbuf, sizeof(pbuf), &plen, NULL, cbarg)) {
  287. ERR_raise(ERR_LIB_OSSL_STORE, OSSL_STORE_R_BAD_PASSWORD_READ);
  288. } else {
  289. const X509_ALGOR *alg = NULL;
  290. const ASN1_OCTET_STRING *oct = NULL;
  291. int len = 0;
  292. X509_SIG_get0(p8, &alg, &oct);
  293. /*
  294. * No need to check the returned value, |new_der|
  295. * will be NULL on error anyway.
  296. */
  297. PKCS12_pbe_crypt(alg, pbuf, plen,
  298. oct->data, oct->length,
  299. &new_der, &len, 0);
  300. der_len = len;
  301. der = new_der;
  302. }
  303. X509_SIG_free(p8);
  304. }
  305. /*
  306. * If the encrypted PKCS#8 couldn't be decrypted,
  307. * |der| is NULL
  308. */
  309. if (der != NULL) {
  310. /* Try to unpack an unencrypted PKCS#8, that's easy */
  311. derp = der;
  312. p8info = d2i_PKCS8_PRIV_KEY_INFO(NULL, &derp, der_len);
  313. if (p8info != NULL) {
  314. pk = EVP_PKCS82PKEY_ex(p8info, libctx, propq);
  315. PKCS8_PRIV_KEY_INFO_free(p8info);
  316. }
  317. }
  318. if (pk != NULL)
  319. *store_info_new = OSSL_STORE_INFO_new_PKEY;
  320. OPENSSL_free(new_der);
  321. }
  322. return pk;
  323. }
  324. static int try_key(struct extracted_param_data_st *data, OSSL_STORE_INFO **v,
  325. OSSL_STORE_CTX *ctx, const OSSL_PROVIDER *provider,
  326. OSSL_LIB_CTX *libctx, const char *propq)
  327. {
  328. store_info_new_fn *store_info_new = NULL;
  329. if (data->object_type == OSSL_OBJECT_UNKNOWN
  330. || data->object_type == OSSL_OBJECT_PKEY) {
  331. EVP_PKEY *pk = NULL;
  332. /* Prefer key by reference than key by value */
  333. if (data->object_type == OSSL_OBJECT_PKEY && data->ref != NULL) {
  334. pk = try_key_ref(data, ctx, provider, libctx, propq);
  335. /*
  336. * If for some reason we couldn't get a key, it's an error.
  337. * It indicates that while decoders could make a key reference,
  338. * the keymgmt somehow couldn't handle it, or doesn't have a
  339. * OSSL_FUNC_keymgmt_load function.
  340. */
  341. if (pk == NULL)
  342. return 0;
  343. } else if (data->octet_data != NULL) {
  344. OSSL_PASSPHRASE_CALLBACK *cb = ossl_pw_passphrase_callback_dec;
  345. void *cbarg = &ctx->pwdata;
  346. pk = try_key_value(data, ctx, cb, cbarg, libctx, propq);
  347. /*
  348. * Desperate last maneuver, in case the decoders don't support
  349. * the data we have, then we try on our own to at least get an
  350. * engine provided legacy key.
  351. * This is the same as der2key_decode() does, but in a limited
  352. * way and within the walls of libcrypto.
  353. */
  354. if (pk == NULL)
  355. pk = try_key_value_legacy(data, &store_info_new, ctx,
  356. cb, cbarg, libctx, propq);
  357. }
  358. if (pk != NULL) {
  359. data->object_type = OSSL_OBJECT_PKEY;
  360. if (store_info_new == NULL) {
  361. /*
  362. * We determined the object type for OSSL_STORE_INFO, which
  363. * makes an explicit difference between an EVP_PKEY with just
  364. * (domain) parameters and an EVP_PKEY with actual key
  365. * material.
  366. * The logic is that an EVP_PKEY with actual key material
  367. * always has the public half.
  368. */
  369. if (evp_keymgmt_util_has(pk, OSSL_KEYMGMT_SELECT_PRIVATE_KEY))
  370. store_info_new = OSSL_STORE_INFO_new_PKEY;
  371. else if (evp_keymgmt_util_has(pk,
  372. OSSL_KEYMGMT_SELECT_PUBLIC_KEY))
  373. store_info_new = OSSL_STORE_INFO_new_PUBKEY;
  374. else
  375. store_info_new = OSSL_STORE_INFO_new_PARAMS;
  376. }
  377. *v = store_info_new(pk);
  378. }
  379. if (*v == NULL)
  380. EVP_PKEY_free(pk);
  381. }
  382. return 1;
  383. }
  384. static int try_cert(struct extracted_param_data_st *data, OSSL_STORE_INFO **v,
  385. OSSL_LIB_CTX *libctx, const char *propq)
  386. {
  387. if (data->object_type == OSSL_OBJECT_UNKNOWN
  388. || data->object_type == OSSL_OBJECT_CERT) {
  389. /*
  390. * In most cases, we can try to interpret the serialized
  391. * data as a trusted cert (X509 + X509_AUX) and fall back
  392. * to reading it as a normal cert (just X509), but if
  393. * |data_type| (the PEM name) specifically declares it as a
  394. * trusted cert, then no fallback should be engaged.
  395. * |ignore_trusted| tells if the fallback can be used (1)
  396. * or not (0).
  397. */
  398. int ignore_trusted = 1;
  399. X509 *cert = X509_new_ex(libctx, propq);
  400. if (cert == NULL)
  401. return 0;
  402. /* If we have a data type, it should be a PEM name */
  403. if (data->data_type != NULL
  404. && (strcasecmp(data->data_type, PEM_STRING_X509_TRUSTED) == 0))
  405. ignore_trusted = 0;
  406. if (d2i_X509_AUX(&cert, (const unsigned char **)&data->octet_data,
  407. data->octet_data_size) == NULL
  408. && (!ignore_trusted
  409. || d2i_X509(&cert, (const unsigned char **)&data->octet_data,
  410. data->octet_data_size) == NULL)) {
  411. X509_free(cert);
  412. cert = NULL;
  413. }
  414. if (cert != NULL) {
  415. /* We determined the object type */
  416. data->object_type = OSSL_OBJECT_CERT;
  417. *v = OSSL_STORE_INFO_new_CERT(cert);
  418. if (*v == NULL)
  419. X509_free(cert);
  420. }
  421. }
  422. return 1;
  423. }
  424. static int try_crl(struct extracted_param_data_st *data, OSSL_STORE_INFO **v,
  425. OSSL_LIB_CTX *libctx, const char *propq)
  426. {
  427. if (data->object_type == OSSL_OBJECT_UNKNOWN
  428. || data->object_type == OSSL_OBJECT_CRL) {
  429. X509_CRL *crl;
  430. crl = d2i_X509_CRL(NULL, (const unsigned char **)&data->octet_data,
  431. data->octet_data_size);
  432. if (crl != NULL)
  433. /* We determined the object type */
  434. data->object_type = OSSL_OBJECT_CRL;
  435. if (crl != NULL && !ossl_x509_crl_set0_libctx(crl, libctx, propq)) {
  436. X509_CRL_free(crl);
  437. crl = NULL;
  438. }
  439. if (crl != NULL)
  440. *v = OSSL_STORE_INFO_new_CRL(crl);
  441. if (*v == NULL)
  442. X509_CRL_free(crl);
  443. }
  444. return 1;
  445. }
  446. static int try_pkcs12(struct extracted_param_data_st *data, OSSL_STORE_INFO **v,
  447. OSSL_STORE_CTX *ctx,
  448. OSSL_LIB_CTX *libctx, const char *propq)
  449. {
  450. int ok = 1;
  451. /* There is no specific object type for PKCS12 */
  452. if (data->object_type == OSSL_OBJECT_UNKNOWN) {
  453. /* Initial parsing */
  454. PKCS12 *p12;
  455. p12 = d2i_PKCS12(NULL, (const unsigned char **)&data->octet_data,
  456. data->octet_data_size);
  457. if (p12 != NULL) {
  458. char *pass = NULL;
  459. char tpass[PEM_BUFSIZE];
  460. size_t tpass_len;
  461. EVP_PKEY *pkey = NULL;
  462. X509 *cert = NULL;
  463. STACK_OF(X509) *chain = NULL;
  464. data->object_type = OSSL_OBJECT_PKCS12;
  465. ok = 0; /* Assume decryption or parse error */
  466. if (PKCS12_verify_mac(p12, "", 0)
  467. || PKCS12_verify_mac(p12, NULL, 0)) {
  468. pass = "";
  469. } else {
  470. static char prompt_info[] = "PKCS12 import pass phrase";
  471. OSSL_PARAM pw_params[] = {
  472. OSSL_PARAM_utf8_string(OSSL_PASSPHRASE_PARAM_INFO,
  473. prompt_info,
  474. sizeof(prompt_info) - 1),
  475. OSSL_PARAM_END
  476. };
  477. if (!ossl_pw_get_passphrase(tpass, sizeof(tpass), &tpass_len,
  478. pw_params, 0, &ctx->pwdata)) {
  479. ERR_raise(ERR_LIB_OSSL_STORE,
  480. OSSL_STORE_R_PASSPHRASE_CALLBACK_ERROR);
  481. goto p12_end;
  482. }
  483. pass = tpass;
  484. if (!PKCS12_verify_mac(p12, pass, strlen(pass))) {
  485. ERR_raise_data(ERR_LIB_OSSL_STORE,
  486. OSSL_STORE_R_ERROR_VERIFYING_PKCS12_MAC,
  487. strlen(pass) == 0 ? "empty password" :
  488. "maybe wrong password");
  489. goto p12_end;
  490. }
  491. }
  492. if (PKCS12_parse(p12, pass, &pkey, &cert, &chain)) {
  493. STACK_OF(OSSL_STORE_INFO) *infos = NULL;
  494. OSSL_STORE_INFO *osi_pkey = NULL;
  495. OSSL_STORE_INFO *osi_cert = NULL;
  496. OSSL_STORE_INFO *osi_ca = NULL;
  497. ok = 1; /* Parsing went through correctly! */
  498. if ((infos = sk_OSSL_STORE_INFO_new_null()) != NULL) {
  499. if (pkey != NULL) {
  500. if ((osi_pkey = OSSL_STORE_INFO_new_PKEY(pkey)) != NULL
  501. /* clearing pkey here avoids case distinctions */
  502. && (pkey = NULL) == NULL
  503. && sk_OSSL_STORE_INFO_push(infos, osi_pkey) != 0)
  504. osi_pkey = NULL;
  505. else
  506. ok = 0;
  507. }
  508. if (ok && cert != NULL) {
  509. if ((osi_cert = OSSL_STORE_INFO_new_CERT(cert)) != NULL
  510. /* clearing cert here avoids case distinctions */
  511. && (cert = NULL) == NULL
  512. && sk_OSSL_STORE_INFO_push(infos, osi_cert) != 0)
  513. osi_cert = NULL;
  514. else
  515. ok = 0;
  516. }
  517. while (ok && sk_X509_num(chain) > 0) {
  518. X509 *ca = sk_X509_value(chain, 0);
  519. if ((osi_ca = OSSL_STORE_INFO_new_CERT(ca)) != NULL
  520. && sk_X509_shift(chain) != NULL
  521. && sk_OSSL_STORE_INFO_push(infos, osi_ca) != 0)
  522. osi_ca = NULL;
  523. else
  524. ok = 0;
  525. }
  526. }
  527. EVP_PKEY_free(pkey);
  528. X509_free(cert);
  529. sk_X509_pop_free(chain, X509_free);
  530. OSSL_STORE_INFO_free(osi_pkey);
  531. OSSL_STORE_INFO_free(osi_cert);
  532. OSSL_STORE_INFO_free(osi_ca);
  533. if (!ok) {
  534. sk_OSSL_STORE_INFO_pop_free(infos, OSSL_STORE_INFO_free);
  535. infos = NULL;
  536. }
  537. ctx->cached_info = infos;
  538. }
  539. }
  540. p12_end:
  541. PKCS12_free(p12);
  542. *v = sk_OSSL_STORE_INFO_shift(ctx->cached_info);
  543. }
  544. return ok;
  545. }