pem_info.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392
  1. /* crypto/pem/pem_info.c */
  2. /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  3. * All rights reserved.
  4. *
  5. * This package is an SSL implementation written
  6. * by Eric Young (eay@cryptsoft.com).
  7. * The implementation was written so as to conform with Netscapes SSL.
  8. *
  9. * This library is free for commercial and non-commercial use as long as
  10. * the following conditions are aheared to. The following conditions
  11. * apply to all code found in this distribution, be it the RC4, RSA,
  12. * lhash, DES, etc., code; not just the SSL code. The SSL documentation
  13. * included with this distribution is covered by the same copyright terms
  14. * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15. *
  16. * Copyright remains Eric Young's, and as such any Copyright notices in
  17. * the code are not to be removed.
  18. * If this package is used in a product, Eric Young should be given attribution
  19. * as the author of the parts of the library used.
  20. * This can be in the form of a textual message at program startup or
  21. * in documentation (online or textual) provided with the package.
  22. *
  23. * Redistribution and use in source and binary forms, with or without
  24. * modification, are permitted provided that the following conditions
  25. * are met:
  26. * 1. Redistributions of source code must retain the copyright
  27. * notice, this list of conditions and the following disclaimer.
  28. * 2. Redistributions in binary form must reproduce the above copyright
  29. * notice, this list of conditions and the following disclaimer in the
  30. * documentation and/or other materials provided with the distribution.
  31. * 3. All advertising materials mentioning features or use of this software
  32. * must display the following acknowledgement:
  33. * "This product includes cryptographic software written by
  34. * Eric Young (eay@cryptsoft.com)"
  35. * The word 'cryptographic' can be left out if the rouines from the library
  36. * being used are not cryptographic related :-).
  37. * 4. If you include any Windows specific code (or a derivative thereof) from
  38. * the apps directory (application code) you must include an acknowledgement:
  39. * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40. *
  41. * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42. * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44. * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45. * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46. * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47. * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49. * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50. * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51. * SUCH DAMAGE.
  52. *
  53. * The licence and distribution terms for any publically available version or
  54. * derivative of this code cannot be changed. i.e. this code cannot simply be
  55. * copied and put under another distribution licence
  56. * [including the GNU Public Licence.]
  57. */
  58. #include <stdio.h>
  59. #include "cryptlib.h"
  60. #include <openssl/buffer.h>
  61. #include <openssl/objects.h>
  62. #include <openssl/evp.h>
  63. #include <openssl/x509.h>
  64. #include <openssl/pem.h>
  65. #include <openssl/rsa.h>
  66. #include <openssl/dsa.h>
  67. #ifndef OPENSSL_NO_FP_API
  68. STACK_OF(X509_INFO) *PEM_X509_INFO_read(FILE *fp, STACK_OF(X509_INFO) *sk, pem_password_cb *cb, void *u)
  69. {
  70. BIO *b;
  71. STACK_OF(X509_INFO) *ret;
  72. if ((b=BIO_new(BIO_s_file())) == NULL)
  73. {
  74. PEMerr(PEM_F_PEM_X509_INFO_READ,ERR_R_BUF_LIB);
  75. return(0);
  76. }
  77. BIO_set_fp(b,fp,BIO_NOCLOSE);
  78. ret=PEM_X509_INFO_read_bio(b,sk,cb,u);
  79. BIO_free(b);
  80. return(ret);
  81. }
  82. #endif
  83. STACK_OF(X509_INFO) *PEM_X509_INFO_read_bio(BIO *bp, STACK_OF(X509_INFO) *sk, pem_password_cb *cb, void *u)
  84. {
  85. X509_INFO *xi=NULL;
  86. char *name=NULL,*header=NULL,**pp;
  87. unsigned char *data=NULL;
  88. const unsigned char *p;
  89. long len,error=0;
  90. int ok=0;
  91. STACK_OF(X509_INFO) *ret=NULL;
  92. unsigned int i,raw;
  93. char *(*d2i)(void *,const unsigned char **,long);
  94. if (sk == NULL)
  95. {
  96. if ((ret=sk_X509_INFO_new_null()) == NULL)
  97. {
  98. PEMerr(PEM_F_PEM_X509_INFO_READ_BIO,ERR_R_MALLOC_FAILURE);
  99. goto err;
  100. }
  101. }
  102. else
  103. ret=sk;
  104. if ((xi=X509_INFO_new()) == NULL) goto err;
  105. for (;;)
  106. {
  107. raw=0;
  108. i=PEM_read_bio(bp,&name,&header,&data,&len);
  109. if (i == 0)
  110. {
  111. error=ERR_GET_REASON(ERR_peek_last_error());
  112. if (error == PEM_R_NO_START_LINE)
  113. {
  114. ERR_clear_error();
  115. break;
  116. }
  117. goto err;
  118. }
  119. start:
  120. if ( (strcmp(name,PEM_STRING_X509) == 0) ||
  121. (strcmp(name,PEM_STRING_X509_OLD) == 0))
  122. {
  123. (D2I_OF(X509))d2i=d2i_X509;
  124. if (xi->x509 != NULL)
  125. {
  126. if (!sk_X509_INFO_push(ret,xi)) goto err;
  127. if ((xi=X509_INFO_new()) == NULL) goto err;
  128. goto start;
  129. }
  130. pp=(char **)&(xi->x509);
  131. }
  132. else if ((strcmp(name,PEM_STRING_X509_TRUSTED) == 0))
  133. {
  134. (D2I_OF(X509))d2i=d2i_X509_AUX;
  135. if (xi->x509 != NULL)
  136. {
  137. if (!sk_X509_INFO_push(ret,xi)) goto err;
  138. if ((xi=X509_INFO_new()) == NULL) goto err;
  139. goto start;
  140. }
  141. pp=(char **)&(xi->x509);
  142. }
  143. else if (strcmp(name,PEM_STRING_X509_CRL) == 0)
  144. {
  145. (D2I_OF(X509_CRL))d2i=d2i_X509_CRL;
  146. if (xi->crl != NULL)
  147. {
  148. if (!sk_X509_INFO_push(ret,xi)) goto err;
  149. if ((xi=X509_INFO_new()) == NULL) goto err;
  150. goto start;
  151. }
  152. pp=(char **)&(xi->crl);
  153. }
  154. else
  155. #ifndef OPENSSL_NO_RSA
  156. if (strcmp(name,PEM_STRING_RSA) == 0)
  157. {
  158. (D2I_OF(RSA))d2i=d2i_RSAPrivateKey;
  159. if (xi->x_pkey != NULL)
  160. {
  161. if (!sk_X509_INFO_push(ret,xi)) goto err;
  162. if ((xi=X509_INFO_new()) == NULL) goto err;
  163. goto start;
  164. }
  165. xi->enc_data=NULL;
  166. xi->enc_len=0;
  167. xi->x_pkey=X509_PKEY_new();
  168. if ((xi->x_pkey->dec_pkey=EVP_PKEY_new()) == NULL)
  169. goto err;
  170. xi->x_pkey->dec_pkey->type=EVP_PKEY_RSA;
  171. pp=(char **)&(xi->x_pkey->dec_pkey->pkey.rsa);
  172. if ((int)strlen(header) > 10) /* assume encrypted */
  173. raw=1;
  174. }
  175. else
  176. #endif
  177. #ifndef OPENSSL_NO_DSA
  178. if (strcmp(name,PEM_STRING_DSA) == 0)
  179. {
  180. (D2I_OF(RSA))d2i=d2i_DSAPrivateKey;
  181. if (xi->x_pkey != NULL)
  182. {
  183. if (!sk_X509_INFO_push(ret,xi)) goto err;
  184. if ((xi=X509_INFO_new()) == NULL) goto err;
  185. goto start;
  186. }
  187. xi->enc_data=NULL;
  188. xi->enc_len=0;
  189. xi->x_pkey=X509_PKEY_new();
  190. if ((xi->x_pkey->dec_pkey=EVP_PKEY_new()) == NULL)
  191. goto err;
  192. xi->x_pkey->dec_pkey->type=EVP_PKEY_DSA;
  193. pp=(char **)&(xi->x_pkey->dec_pkey->pkey.dsa);
  194. if ((int)strlen(header) > 10) /* assume encrypted */
  195. raw=1;
  196. }
  197. else
  198. #endif
  199. #ifndef OPENSSL_NO_EC
  200. if (strcmp(name,PEM_STRING_ECPRIVATEKEY) == 0)
  201. {
  202. (D2I_OF(EC_KEY))d2i=d2i_ECPrivateKey;
  203. if (xi->x_pkey != NULL)
  204. {
  205. if (!sk_X509_INFO_push(ret,xi)) goto err;
  206. if ((xi=X509_INFO_new()) == NULL) goto err;
  207. goto start;
  208. }
  209. xi->enc_data=NULL;
  210. xi->enc_len=0;
  211. xi->x_pkey=X509_PKEY_new();
  212. if ((xi->x_pkey->dec_pkey=EVP_PKEY_new()) == NULL)
  213. goto err;
  214. xi->x_pkey->dec_pkey->type=EVP_PKEY_EC;
  215. pp=(char **)&(xi->x_pkey->dec_pkey->pkey.eckey);
  216. if ((int)strlen(header) > 10) /* assume encrypted */
  217. raw=1;
  218. }
  219. else
  220. #endif
  221. {
  222. d2i=NULL;
  223. pp=NULL;
  224. }
  225. if (d2i != NULL)
  226. {
  227. if (!raw)
  228. {
  229. EVP_CIPHER_INFO cipher;
  230. if (!PEM_get_EVP_CIPHER_INFO(header,&cipher))
  231. goto err;
  232. if (!PEM_do_header(&cipher,data,&len,cb,u))
  233. goto err;
  234. p=data;
  235. if (d2i(pp,&p,len) == NULL)
  236. {
  237. PEMerr(PEM_F_PEM_X509_INFO_READ_BIO,ERR_R_ASN1_LIB);
  238. goto err;
  239. }
  240. }
  241. else
  242. { /* encrypted RSA data */
  243. if (!PEM_get_EVP_CIPHER_INFO(header,
  244. &xi->enc_cipher)) goto err;
  245. xi->enc_data=(char *)data;
  246. xi->enc_len=(int)len;
  247. data=NULL;
  248. }
  249. }
  250. else {
  251. /* unknown */
  252. }
  253. if (name != NULL) OPENSSL_free(name);
  254. if (header != NULL) OPENSSL_free(header);
  255. if (data != NULL) OPENSSL_free(data);
  256. name=NULL;
  257. header=NULL;
  258. data=NULL;
  259. }
  260. /* if the last one hasn't been pushed yet and there is anything
  261. * in it then add it to the stack ...
  262. */
  263. if ((xi->x509 != NULL) || (xi->crl != NULL) ||
  264. (xi->x_pkey != NULL) || (xi->enc_data != NULL))
  265. {
  266. if (!sk_X509_INFO_push(ret,xi)) goto err;
  267. xi=NULL;
  268. }
  269. ok=1;
  270. err:
  271. if (xi != NULL) X509_INFO_free(xi);
  272. if (!ok)
  273. {
  274. for (i=0; ((int)i)<sk_X509_INFO_num(ret); i++)
  275. {
  276. xi=sk_X509_INFO_value(ret,i);
  277. X509_INFO_free(xi);
  278. }
  279. if (ret != sk) sk_X509_INFO_free(ret);
  280. ret=NULL;
  281. }
  282. if (name != NULL) OPENSSL_free(name);
  283. if (header != NULL) OPENSSL_free(header);
  284. if (data != NULL) OPENSSL_free(data);
  285. return(ret);
  286. }
  287. /* A TJH addition */
  288. int PEM_X509_INFO_write_bio(BIO *bp, X509_INFO *xi, EVP_CIPHER *enc,
  289. unsigned char *kstr, int klen, pem_password_cb *cb, void *u)
  290. {
  291. EVP_CIPHER_CTX ctx;
  292. int i,ret=0;
  293. unsigned char *data=NULL;
  294. const char *objstr=NULL;
  295. char buf[PEM_BUFSIZE];
  296. unsigned char *iv=NULL;
  297. if (enc != NULL)
  298. {
  299. objstr=OBJ_nid2sn(EVP_CIPHER_nid(enc));
  300. if (objstr == NULL)
  301. {
  302. PEMerr(PEM_F_PEM_X509_INFO_WRITE_BIO,PEM_R_UNSUPPORTED_CIPHER);
  303. goto err;
  304. }
  305. }
  306. /* now for the fun part ... if we have a private key then
  307. * we have to be able to handle a not-yet-decrypted key
  308. * being written out correctly ... if it is decrypted or
  309. * it is non-encrypted then we use the base code
  310. */
  311. if (xi->x_pkey!=NULL)
  312. {
  313. if ( (xi->enc_data!=NULL) && (xi->enc_len>0) )
  314. {
  315. /* copy from weirdo names into more normal things */
  316. iv=xi->enc_cipher.iv;
  317. data=(unsigned char *)xi->enc_data;
  318. i=xi->enc_len;
  319. /* we take the encryption data from the
  320. * internal stuff rather than what the
  321. * user has passed us ... as we have to
  322. * match exactly for some strange reason
  323. */
  324. objstr=OBJ_nid2sn(
  325. EVP_CIPHER_nid(xi->enc_cipher.cipher));
  326. if (objstr == NULL)
  327. {
  328. PEMerr(PEM_F_PEM_X509_INFO_WRITE_BIO,PEM_R_UNSUPPORTED_CIPHER);
  329. goto err;
  330. }
  331. /* create the right magic header stuff */
  332. OPENSSL_assert(strlen(objstr)+23+2*enc->iv_len+13 <= sizeof buf);
  333. buf[0]='\0';
  334. PEM_proc_type(buf,PEM_TYPE_ENCRYPTED);
  335. PEM_dek_info(buf,objstr,enc->iv_len,(char *)iv);
  336. /* use the normal code to write things out */
  337. i=PEM_write_bio(bp,PEM_STRING_RSA,buf,data,i);
  338. if (i <= 0) goto err;
  339. }
  340. else
  341. {
  342. /* Add DSA/DH */
  343. #ifndef OPENSSL_NO_RSA
  344. /* normal optionally encrypted stuff */
  345. if (PEM_write_bio_RSAPrivateKey(bp,
  346. xi->x_pkey->dec_pkey->pkey.rsa,
  347. enc,kstr,klen,cb,u)<=0)
  348. goto err;
  349. #endif
  350. }
  351. }
  352. /* if we have a certificate then write it out now */
  353. if ((xi->x509 != NULL) && (PEM_write_bio_X509(bp,xi->x509) <= 0))
  354. goto err;
  355. /* we are ignoring anything else that is loaded into the X509_INFO
  356. * structure for the moment ... as I don't need it so I'm not
  357. * coding it here and Eric can do it when this makes it into the
  358. * base library --tjh
  359. */
  360. ret=1;
  361. err:
  362. OPENSSL_cleanse((char *)&ctx,sizeof(ctx));
  363. OPENSSL_cleanse(buf,PEM_BUFSIZE);
  364. return(ret);
  365. }