x_all.c 23 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813
  1. /*
  2. * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. /*
  10. * Low level APIs are deprecated for public use, but still ok for
  11. * internal use.
  12. */
  13. #include "internal/deprecated.h"
  14. #include <stdio.h>
  15. #include "internal/cryptlib.h"
  16. #include <openssl/buffer.h>
  17. #include <openssl/asn1.h>
  18. #include <openssl/evp.h>
  19. #include <openssl/x509.h>
  20. #include <openssl/http.h>
  21. #include <openssl/rsa.h>
  22. #include <openssl/dsa.h>
  23. #include <openssl/x509v3.h>
  24. #include "internal/asn1.h"
  25. #include "crypto/pkcs7.h"
  26. #include "crypto/x509.h"
  27. #include "crypto/rsa.h"
  28. int X509_verify(X509 *a, EVP_PKEY *r)
  29. {
  30. if (X509_ALGOR_cmp(&a->sig_alg, &a->cert_info.signature) != 0)
  31. return 0;
  32. return ASN1_item_verify_ex(ASN1_ITEM_rptr(X509_CINF), &a->sig_alg,
  33. &a->signature, &a->cert_info,
  34. a->distinguishing_id, r, a->libctx, a->propq);
  35. }
  36. int X509_REQ_verify_ex(X509_REQ *a, EVP_PKEY *r, OSSL_LIB_CTX *libctx,
  37. const char *propq)
  38. {
  39. return ASN1_item_verify_ex(ASN1_ITEM_rptr(X509_REQ_INFO), &a->sig_alg,
  40. a->signature, &a->req_info, a->distinguishing_id,
  41. r, libctx, propq);
  42. }
  43. int X509_REQ_verify(X509_REQ *a, EVP_PKEY *r)
  44. {
  45. return X509_REQ_verify_ex(a, r, NULL, NULL);
  46. }
  47. int NETSCAPE_SPKI_verify(NETSCAPE_SPKI *a, EVP_PKEY *r)
  48. {
  49. return ASN1_item_verify(ASN1_ITEM_rptr(NETSCAPE_SPKAC),
  50. &a->sig_algor, a->signature, a->spkac, r);
  51. }
  52. int X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)
  53. {
  54. if (x == NULL) {
  55. ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
  56. return 0;
  57. }
  58. /*
  59. * Setting the modified flag before signing it. This makes the cached
  60. * encoding to be ignored, so even if the certificate fields have changed,
  61. * they are signed correctly.
  62. * The X509_sign_ctx, X509_REQ_sign{,_ctx}, X509_CRL_sign{,_ctx} functions
  63. * which exist below are the same.
  64. */
  65. x->cert_info.enc.modified = 1;
  66. return ASN1_item_sign_ex(ASN1_ITEM_rptr(X509_CINF), &x->cert_info.signature,
  67. &x->sig_alg, &x->signature, &x->cert_info, NULL,
  68. pkey, md, x->libctx, x->propq);
  69. }
  70. int X509_sign_ctx(X509 *x, EVP_MD_CTX *ctx)
  71. {
  72. if (x == NULL) {
  73. ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
  74. return 0;
  75. }
  76. x->cert_info.enc.modified = 1;
  77. return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_CINF),
  78. &x->cert_info.signature,
  79. &x->sig_alg, &x->signature, &x->cert_info, ctx);
  80. }
  81. static ASN1_VALUE *simple_get_asn1(const char *url, BIO *bio, BIO *rbio,
  82. int timeout, const ASN1_ITEM *it)
  83. {
  84. BIO *mem = OSSL_HTTP_get(url, NULL /* proxy */, NULL /* no_proxy */,
  85. bio, rbio, NULL /* cb */, NULL /* arg */,
  86. 1024 /* buf_size */, NULL /* headers */,
  87. NULL /* expected_ct */, 1 /* expect_asn1 */,
  88. OSSL_HTTP_DEFAULT_MAX_RESP_LEN, timeout);
  89. ASN1_VALUE *res = ASN1_item_d2i_bio(it, mem, NULL);
  90. BIO_free(mem);
  91. return res;
  92. }
  93. X509 *X509_load_http(const char *url, BIO *bio, BIO *rbio, int timeout)
  94. {
  95. return (X509 *)simple_get_asn1(url, bio, rbio, timeout,
  96. ASN1_ITEM_rptr(X509));
  97. }
  98. int X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md)
  99. {
  100. if (x == NULL) {
  101. ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
  102. return 0;
  103. }
  104. x->req_info.enc.modified = 1;
  105. return ASN1_item_sign_ex(ASN1_ITEM_rptr(X509_REQ_INFO), &x->sig_alg, NULL,
  106. x->signature, &x->req_info, NULL,
  107. pkey, md, x->libctx, x->propq);
  108. }
  109. int X509_REQ_sign_ctx(X509_REQ *x, EVP_MD_CTX *ctx)
  110. {
  111. if (x == NULL) {
  112. ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
  113. return 0;
  114. }
  115. x->req_info.enc.modified = 1;
  116. return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_REQ_INFO),
  117. &x->sig_alg, NULL, x->signature, &x->req_info,
  118. ctx);
  119. }
  120. int X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md)
  121. {
  122. if (x == NULL) {
  123. ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
  124. return 0;
  125. }
  126. x->crl.enc.modified = 1;
  127. return ASN1_item_sign_ex(ASN1_ITEM_rptr(X509_CRL_INFO), &x->crl.sig_alg,
  128. &x->sig_alg, &x->signature, &x->crl, NULL,
  129. pkey, md, x->libctx, x->propq);
  130. }
  131. int X509_CRL_sign_ctx(X509_CRL *x, EVP_MD_CTX *ctx)
  132. {
  133. if (x == NULL) {
  134. ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
  135. return 0;
  136. }
  137. x->crl.enc.modified = 1;
  138. return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_CRL_INFO),
  139. &x->crl.sig_alg, &x->sig_alg, &x->signature,
  140. &x->crl, ctx);
  141. }
  142. X509_CRL *X509_CRL_load_http(const char *url, BIO *bio, BIO *rbio, int timeout)
  143. {
  144. return (X509_CRL *)simple_get_asn1(url, bio, rbio, timeout,
  145. ASN1_ITEM_rptr(X509_CRL));
  146. }
  147. int NETSCAPE_SPKI_sign(NETSCAPE_SPKI *x, EVP_PKEY *pkey, const EVP_MD *md)
  148. {
  149. return
  150. ASN1_item_sign_ex(ASN1_ITEM_rptr(NETSCAPE_SPKAC), &x->sig_algor, NULL,
  151. x->signature, x->spkac, NULL, pkey, md, NULL, NULL);
  152. }
  153. #ifndef OPENSSL_NO_STDIO
  154. X509 *d2i_X509_fp(FILE *fp, X509 **x509)
  155. {
  156. return ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509), fp, x509);
  157. }
  158. int i2d_X509_fp(FILE *fp, const X509 *x509)
  159. {
  160. return ASN1_item_i2d_fp(ASN1_ITEM_rptr(X509), fp, x509);
  161. }
  162. #endif
  163. X509 *d2i_X509_bio(BIO *bp, X509 **x509)
  164. {
  165. return ASN1_item_d2i_bio(ASN1_ITEM_rptr(X509), bp, x509);
  166. }
  167. int i2d_X509_bio(BIO *bp, const X509 *x509)
  168. {
  169. return ASN1_item_i2d_bio(ASN1_ITEM_rptr(X509), bp, x509);
  170. }
  171. #ifndef OPENSSL_NO_STDIO
  172. X509_CRL *d2i_X509_CRL_fp(FILE *fp, X509_CRL **crl)
  173. {
  174. return ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509_CRL), fp, crl);
  175. }
  176. int i2d_X509_CRL_fp(FILE *fp, const X509_CRL *crl)
  177. {
  178. return ASN1_item_i2d_fp(ASN1_ITEM_rptr(X509_CRL), fp, crl);
  179. }
  180. #endif
  181. X509_CRL *d2i_X509_CRL_bio(BIO *bp, X509_CRL **crl)
  182. {
  183. return ASN1_item_d2i_bio(ASN1_ITEM_rptr(X509_CRL), bp, crl);
  184. }
  185. int i2d_X509_CRL_bio(BIO *bp, const X509_CRL *crl)
  186. {
  187. return ASN1_item_i2d_bio(ASN1_ITEM_rptr(X509_CRL), bp, crl);
  188. }
  189. #ifndef OPENSSL_NO_STDIO
  190. PKCS7 *d2i_PKCS7_fp(FILE *fp, PKCS7 **p7)
  191. {
  192. PKCS7 *ret;
  193. OSSL_LIB_CTX *libctx = NULL;
  194. const char *propq = NULL;
  195. if (p7 != NULL && *p7 != NULL) {
  196. libctx = (*p7)->ctx.libctx;
  197. propq = (*p7)->ctx.propq;
  198. }
  199. ret = ASN1_item_d2i_fp_ex(ASN1_ITEM_rptr(PKCS7), fp, p7, libctx, propq);
  200. if (ret != NULL)
  201. ossl_pkcs7_resolve_libctx(ret);
  202. return ret;
  203. }
  204. int i2d_PKCS7_fp(FILE *fp, const PKCS7 *p7)
  205. {
  206. return ASN1_item_i2d_fp(ASN1_ITEM_rptr(PKCS7), fp, p7);
  207. }
  208. #endif
  209. PKCS7 *d2i_PKCS7_bio(BIO *bp, PKCS7 **p7)
  210. {
  211. PKCS7 *ret;
  212. OSSL_LIB_CTX *libctx = NULL;
  213. const char *propq = NULL;
  214. if (p7 != NULL && *p7 != NULL) {
  215. libctx = (*p7)->ctx.libctx;
  216. propq = (*p7)->ctx.propq;
  217. }
  218. ret = ASN1_item_d2i_bio_ex(ASN1_ITEM_rptr(PKCS7), bp, p7, libctx, propq);
  219. if (ret != NULL)
  220. ossl_pkcs7_resolve_libctx(ret);
  221. return ret;
  222. }
  223. int i2d_PKCS7_bio(BIO *bp, const PKCS7 *p7)
  224. {
  225. return ASN1_item_i2d_bio(ASN1_ITEM_rptr(PKCS7), bp, p7);
  226. }
  227. #ifndef OPENSSL_NO_STDIO
  228. X509_REQ *d2i_X509_REQ_fp(FILE *fp, X509_REQ **req)
  229. {
  230. return ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509_REQ), fp, req);
  231. }
  232. int i2d_X509_REQ_fp(FILE *fp, const X509_REQ *req)
  233. {
  234. return ASN1_item_i2d_fp(ASN1_ITEM_rptr(X509_REQ), fp, req);
  235. }
  236. #endif
  237. X509_REQ *d2i_X509_REQ_bio(BIO *bp, X509_REQ **req)
  238. {
  239. OSSL_LIB_CTX *libctx = NULL;
  240. const char *propq = NULL;
  241. if (req != NULL && *req != NULL) {
  242. libctx = (*req)->libctx;
  243. propq = (*req)->propq;
  244. }
  245. return ASN1_item_d2i_bio_ex(ASN1_ITEM_rptr(X509_REQ), bp, req, libctx, propq);
  246. }
  247. int i2d_X509_REQ_bio(BIO *bp, const X509_REQ *req)
  248. {
  249. return ASN1_item_i2d_bio(ASN1_ITEM_rptr(X509_REQ), bp, req);
  250. }
  251. #ifndef OPENSSL_NO_STDIO
  252. RSA *d2i_RSAPrivateKey_fp(FILE *fp, RSA **rsa)
  253. {
  254. return ASN1_item_d2i_fp(ASN1_ITEM_rptr(RSAPrivateKey), fp, rsa);
  255. }
  256. int i2d_RSAPrivateKey_fp(FILE *fp, const RSA *rsa)
  257. {
  258. return ASN1_item_i2d_fp(ASN1_ITEM_rptr(RSAPrivateKey), fp, rsa);
  259. }
  260. RSA *d2i_RSAPublicKey_fp(FILE *fp, RSA **rsa)
  261. {
  262. return ASN1_item_d2i_fp(ASN1_ITEM_rptr(RSAPublicKey), fp, rsa);
  263. }
  264. RSA *d2i_RSA_PUBKEY_fp(FILE *fp, RSA **rsa)
  265. {
  266. return ASN1_d2i_fp((void *(*)(void))
  267. RSA_new, (D2I_OF(void)) d2i_RSA_PUBKEY, fp,
  268. (void **)rsa);
  269. }
  270. int i2d_RSAPublicKey_fp(FILE *fp, const RSA *rsa)
  271. {
  272. return ASN1_item_i2d_fp(ASN1_ITEM_rptr(RSAPublicKey), fp, rsa);
  273. }
  274. int i2d_RSA_PUBKEY_fp(FILE *fp, const RSA *rsa)
  275. {
  276. return ASN1_i2d_fp((I2D_OF(void))i2d_RSA_PUBKEY, fp, rsa);
  277. }
  278. #endif
  279. RSA *d2i_RSAPrivateKey_bio(BIO *bp, RSA **rsa)
  280. {
  281. return ASN1_item_d2i_bio(ASN1_ITEM_rptr(RSAPrivateKey), bp, rsa);
  282. }
  283. int i2d_RSAPrivateKey_bio(BIO *bp, const RSA *rsa)
  284. {
  285. return ASN1_item_i2d_bio(ASN1_ITEM_rptr(RSAPrivateKey), bp, rsa);
  286. }
  287. RSA *d2i_RSAPublicKey_bio(BIO *bp, RSA **rsa)
  288. {
  289. return ASN1_item_d2i_bio(ASN1_ITEM_rptr(RSAPublicKey), bp, rsa);
  290. }
  291. RSA *d2i_RSA_PUBKEY_bio(BIO *bp, RSA **rsa)
  292. {
  293. return ASN1_d2i_bio_of(RSA, RSA_new, d2i_RSA_PUBKEY, bp, rsa);
  294. }
  295. int i2d_RSAPublicKey_bio(BIO *bp, const RSA *rsa)
  296. {
  297. return ASN1_item_i2d_bio(ASN1_ITEM_rptr(RSAPublicKey), bp, rsa);
  298. }
  299. int i2d_RSA_PUBKEY_bio(BIO *bp, const RSA *rsa)
  300. {
  301. return ASN1_i2d_bio_of(RSA, i2d_RSA_PUBKEY, bp, rsa);
  302. }
  303. #ifndef OPENSSL_NO_DSA
  304. # ifndef OPENSSL_NO_STDIO
  305. DSA *d2i_DSAPrivateKey_fp(FILE *fp, DSA **dsa)
  306. {
  307. return ASN1_d2i_fp_of(DSA, DSA_new, d2i_DSAPrivateKey, fp, dsa);
  308. }
  309. int i2d_DSAPrivateKey_fp(FILE *fp, const DSA *dsa)
  310. {
  311. return ASN1_i2d_fp_of(DSA, i2d_DSAPrivateKey, fp, dsa);
  312. }
  313. DSA *d2i_DSA_PUBKEY_fp(FILE *fp, DSA **dsa)
  314. {
  315. return ASN1_d2i_fp_of(DSA, DSA_new, d2i_DSA_PUBKEY, fp, dsa);
  316. }
  317. int i2d_DSA_PUBKEY_fp(FILE *fp, const DSA *dsa)
  318. {
  319. return ASN1_i2d_fp_of(DSA, i2d_DSA_PUBKEY, fp, dsa);
  320. }
  321. # endif
  322. DSA *d2i_DSAPrivateKey_bio(BIO *bp, DSA **dsa)
  323. {
  324. return ASN1_d2i_bio_of(DSA, DSA_new, d2i_DSAPrivateKey, bp, dsa);
  325. }
  326. int i2d_DSAPrivateKey_bio(BIO *bp, const DSA *dsa)
  327. {
  328. return ASN1_i2d_bio_of(DSA, i2d_DSAPrivateKey, bp, dsa);
  329. }
  330. DSA *d2i_DSA_PUBKEY_bio(BIO *bp, DSA **dsa)
  331. {
  332. return ASN1_d2i_bio_of(DSA, DSA_new, d2i_DSA_PUBKEY, bp, dsa);
  333. }
  334. int i2d_DSA_PUBKEY_bio(BIO *bp, const DSA *dsa)
  335. {
  336. return ASN1_i2d_bio_of(DSA, i2d_DSA_PUBKEY, bp, dsa);
  337. }
  338. #endif
  339. #ifndef OPENSSL_NO_EC
  340. # ifndef OPENSSL_NO_STDIO
  341. EC_KEY *d2i_EC_PUBKEY_fp(FILE *fp, EC_KEY **eckey)
  342. {
  343. return ASN1_d2i_fp_of(EC_KEY, EC_KEY_new, d2i_EC_PUBKEY, fp, eckey);
  344. }
  345. int i2d_EC_PUBKEY_fp(FILE *fp, const EC_KEY *eckey)
  346. {
  347. return ASN1_i2d_fp_of(EC_KEY, i2d_EC_PUBKEY, fp, eckey);
  348. }
  349. EC_KEY *d2i_ECPrivateKey_fp(FILE *fp, EC_KEY **eckey)
  350. {
  351. return ASN1_d2i_fp_of(EC_KEY, EC_KEY_new, d2i_ECPrivateKey, fp, eckey);
  352. }
  353. int i2d_ECPrivateKey_fp(FILE *fp, const EC_KEY *eckey)
  354. {
  355. return ASN1_i2d_fp_of(EC_KEY, i2d_ECPrivateKey, fp, eckey);
  356. }
  357. # endif
  358. EC_KEY *d2i_EC_PUBKEY_bio(BIO *bp, EC_KEY **eckey)
  359. {
  360. return ASN1_d2i_bio_of(EC_KEY, EC_KEY_new, d2i_EC_PUBKEY, bp, eckey);
  361. }
  362. int i2d_EC_PUBKEY_bio(BIO *bp, const EC_KEY *ecdsa)
  363. {
  364. return ASN1_i2d_bio_of(EC_KEY, i2d_EC_PUBKEY, bp, ecdsa);
  365. }
  366. EC_KEY *d2i_ECPrivateKey_bio(BIO *bp, EC_KEY **eckey)
  367. {
  368. return ASN1_d2i_bio_of(EC_KEY, EC_KEY_new, d2i_ECPrivateKey, bp, eckey);
  369. }
  370. int i2d_ECPrivateKey_bio(BIO *bp, const EC_KEY *eckey)
  371. {
  372. return ASN1_i2d_bio_of(EC_KEY, i2d_ECPrivateKey, bp, eckey);
  373. }
  374. #endif
  375. int X509_pubkey_digest(const X509 *data, const EVP_MD *type,
  376. unsigned char *md, unsigned int *len)
  377. {
  378. ASN1_BIT_STRING *key = X509_get0_pubkey_bitstr(data);
  379. if (key == NULL)
  380. return 0;
  381. return EVP_Digest(key->data, key->length, md, len, type, NULL);
  382. }
  383. int X509_digest(const X509 *cert, const EVP_MD *md, unsigned char *data,
  384. unsigned int *len)
  385. {
  386. if (EVP_MD_is_a(md, SN_sha1) && (cert->ex_flags & EXFLAG_SET) != 0
  387. && (cert->ex_flags & EXFLAG_NO_FINGERPRINT) == 0) {
  388. /* Asking for SHA1 and we already computed it. */
  389. if (len != NULL)
  390. *len = sizeof(cert->sha1_hash);
  391. memcpy(data, cert->sha1_hash, sizeof(cert->sha1_hash));
  392. return 1;
  393. }
  394. return ossl_asn1_item_digest_ex(ASN1_ITEM_rptr(X509), md, (char *)cert,
  395. data, len, cert->libctx, cert->propq);
  396. }
  397. /* calculate cert digest using the same hash algorithm as in its signature */
  398. ASN1_OCTET_STRING *X509_digest_sig(const X509 *cert,
  399. EVP_MD **md_used, int *md_is_fallback)
  400. {
  401. unsigned int len;
  402. unsigned char hash[EVP_MAX_MD_SIZE];
  403. int mdnid, pknid;
  404. EVP_MD *md = NULL;
  405. const char *md_name;
  406. ASN1_OCTET_STRING *new;
  407. if (md_used != NULL)
  408. *md_used = NULL;
  409. if (md_is_fallback != NULL)
  410. *md_is_fallback = 0;
  411. if (cert == NULL) {
  412. ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
  413. return NULL;
  414. }
  415. if (!OBJ_find_sigid_algs(X509_get_signature_nid(cert), &mdnid, &pknid)) {
  416. ERR_raise(ERR_LIB_X509, X509_R_UNKNOWN_SIGID_ALGS);
  417. return NULL;
  418. }
  419. if (mdnid == NID_undef) {
  420. if (pknid == EVP_PKEY_RSA_PSS) {
  421. RSA_PSS_PARAMS *pss = ossl_rsa_pss_decode(&cert->sig_alg);
  422. const EVP_MD *mgf1md, *mmd = NULL;
  423. int saltlen, trailerfield;
  424. if (pss == NULL
  425. || !ossl_rsa_pss_get_param_unverified(pss, &mmd, &mgf1md,
  426. &saltlen,
  427. &trailerfield)
  428. || mmd == NULL) {
  429. RSA_PSS_PARAMS_free(pss);
  430. ERR_raise(ERR_LIB_X509, X509_R_UNSUPPORTED_ALGORITHM);
  431. return NULL;
  432. }
  433. RSA_PSS_PARAMS_free(pss);
  434. /* Fetch explicitly and do not fallback */
  435. if ((md = EVP_MD_fetch(cert->libctx, EVP_MD_get0_name(mmd),
  436. cert->propq)) == NULL)
  437. /* Error code from fetch is sufficient */
  438. return NULL;
  439. } else if (pknid != NID_undef) {
  440. /* A known algorithm, but without a digest */
  441. switch (pknid) {
  442. case NID_ED25519: /* Follow CMS default given in RFC8419 */
  443. md_name = "SHA512";
  444. break;
  445. case NID_ED448: /* Follow CMS default given in RFC8419 */
  446. md_name = "SHAKE256";
  447. break;
  448. default: /* Fall back to SHA-256 */
  449. md_name = "SHA256";
  450. break;
  451. }
  452. if ((md = EVP_MD_fetch(cert->libctx, md_name,
  453. cert->propq)) == NULL)
  454. return NULL;
  455. if (md_is_fallback != NULL)
  456. *md_is_fallback = 1;
  457. } else {
  458. /* A completely unknown algorithm */
  459. ERR_raise(ERR_LIB_X509, X509_R_UNSUPPORTED_ALGORITHM);
  460. return NULL;
  461. }
  462. } else if ((md = EVP_MD_fetch(cert->libctx, OBJ_nid2sn(mdnid),
  463. cert->propq)) == NULL
  464. && (md = (EVP_MD *)EVP_get_digestbynid(mdnid)) == NULL) {
  465. ERR_raise(ERR_LIB_X509, X509_R_UNSUPPORTED_ALGORITHM);
  466. return NULL;
  467. }
  468. if (!X509_digest(cert, md, hash, &len)
  469. || (new = ASN1_OCTET_STRING_new()) == NULL)
  470. goto err;
  471. if (ASN1_OCTET_STRING_set(new, hash, len)) {
  472. if (md_used != NULL)
  473. *md_used = md;
  474. else
  475. EVP_MD_free(md);
  476. return new;
  477. }
  478. ASN1_OCTET_STRING_free(new);
  479. err:
  480. EVP_MD_free(md);
  481. return NULL;
  482. }
  483. int X509_CRL_digest(const X509_CRL *data, const EVP_MD *type,
  484. unsigned char *md, unsigned int *len)
  485. {
  486. if (type == NULL) {
  487. ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
  488. return 0;
  489. }
  490. if (EVP_MD_is_a(type, SN_sha1)
  491. && (data->flags & EXFLAG_SET) != 0
  492. && (data->flags & EXFLAG_NO_FINGERPRINT) == 0) {
  493. /* Asking for SHA1; always computed in CRL d2i. */
  494. if (len != NULL)
  495. *len = sizeof(data->sha1_hash);
  496. memcpy(md, data->sha1_hash, sizeof(data->sha1_hash));
  497. return 1;
  498. }
  499. return ossl_asn1_item_digest_ex(ASN1_ITEM_rptr(X509_CRL), type, (char *)data,
  500. md, len, data->libctx, data->propq);
  501. }
  502. int X509_REQ_digest(const X509_REQ *data, const EVP_MD *type,
  503. unsigned char *md, unsigned int *len)
  504. {
  505. return ossl_asn1_item_digest_ex(ASN1_ITEM_rptr(X509_REQ), type, (char *)data,
  506. md, len, data->libctx, data->propq);
  507. }
  508. int X509_NAME_digest(const X509_NAME *data, const EVP_MD *type,
  509. unsigned char *md, unsigned int *len)
  510. {
  511. return ASN1_item_digest(ASN1_ITEM_rptr(X509_NAME), type, (char *)data,
  512. md, len);
  513. }
  514. int PKCS7_ISSUER_AND_SERIAL_digest(PKCS7_ISSUER_AND_SERIAL *data,
  515. const EVP_MD *type, unsigned char *md,
  516. unsigned int *len)
  517. {
  518. return ASN1_item_digest(ASN1_ITEM_rptr(PKCS7_ISSUER_AND_SERIAL), type,
  519. (char *)data, md, len);
  520. }
  521. #ifndef OPENSSL_NO_STDIO
  522. X509_SIG *d2i_PKCS8_fp(FILE *fp, X509_SIG **p8)
  523. {
  524. return ASN1_d2i_fp_of(X509_SIG, X509_SIG_new, d2i_X509_SIG, fp, p8);
  525. }
  526. int i2d_PKCS8_fp(FILE *fp, const X509_SIG *p8)
  527. {
  528. return ASN1_i2d_fp_of(X509_SIG, i2d_X509_SIG, fp, p8);
  529. }
  530. #endif
  531. X509_SIG *d2i_PKCS8_bio(BIO *bp, X509_SIG **p8)
  532. {
  533. return ASN1_d2i_bio_of(X509_SIG, X509_SIG_new, d2i_X509_SIG, bp, p8);
  534. }
  535. int i2d_PKCS8_bio(BIO *bp, const X509_SIG *p8)
  536. {
  537. return ASN1_i2d_bio_of(X509_SIG, i2d_X509_SIG, bp, p8);
  538. }
  539. #ifndef OPENSSL_NO_STDIO
  540. X509_PUBKEY *d2i_X509_PUBKEY_fp(FILE *fp, X509_PUBKEY **xpk)
  541. {
  542. return ASN1_d2i_fp_of(X509_PUBKEY, X509_PUBKEY_new, d2i_X509_PUBKEY,
  543. fp, xpk);
  544. }
  545. int i2d_X509_PUBKEY_fp(FILE *fp, const X509_PUBKEY *xpk)
  546. {
  547. return ASN1_i2d_fp_of(X509_PUBKEY, i2d_X509_PUBKEY, fp, xpk);
  548. }
  549. #endif
  550. X509_PUBKEY *d2i_X509_PUBKEY_bio(BIO *bp, X509_PUBKEY **xpk)
  551. {
  552. return ASN1_d2i_bio_of(X509_PUBKEY, X509_PUBKEY_new, d2i_X509_PUBKEY,
  553. bp, xpk);
  554. }
  555. int i2d_X509_PUBKEY_bio(BIO *bp, const X509_PUBKEY *xpk)
  556. {
  557. return ASN1_i2d_bio_of(X509_PUBKEY, i2d_X509_PUBKEY, bp, xpk);
  558. }
  559. #ifndef OPENSSL_NO_STDIO
  560. PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO_fp(FILE *fp,
  561. PKCS8_PRIV_KEY_INFO **p8inf)
  562. {
  563. return ASN1_d2i_fp_of(PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_new,
  564. d2i_PKCS8_PRIV_KEY_INFO, fp, p8inf);
  565. }
  566. int i2d_PKCS8_PRIV_KEY_INFO_fp(FILE *fp, const PKCS8_PRIV_KEY_INFO *p8inf)
  567. {
  568. return ASN1_i2d_fp_of(PKCS8_PRIV_KEY_INFO, i2d_PKCS8_PRIV_KEY_INFO, fp,
  569. p8inf);
  570. }
  571. int i2d_PKCS8PrivateKeyInfo_fp(FILE *fp, const EVP_PKEY *key)
  572. {
  573. PKCS8_PRIV_KEY_INFO *p8inf;
  574. int ret;
  575. p8inf = EVP_PKEY2PKCS8(key);
  576. if (p8inf == NULL)
  577. return 0;
  578. ret = i2d_PKCS8_PRIV_KEY_INFO_fp(fp, p8inf);
  579. PKCS8_PRIV_KEY_INFO_free(p8inf);
  580. return ret;
  581. }
  582. int i2d_PrivateKey_fp(FILE *fp, const EVP_PKEY *pkey)
  583. {
  584. return ASN1_i2d_fp_of(EVP_PKEY, i2d_PrivateKey, fp, pkey);
  585. }
  586. EVP_PKEY *d2i_PrivateKey_fp(FILE *fp, EVP_PKEY **a)
  587. {
  588. return ASN1_d2i_fp_of(EVP_PKEY, EVP_PKEY_new, d2i_AutoPrivateKey, fp, a);
  589. }
  590. EVP_PKEY *d2i_PrivateKey_ex_fp(FILE *fp, EVP_PKEY **a, OSSL_LIB_CTX *libctx,
  591. const char *propq)
  592. {
  593. BIO *b;
  594. void *ret;
  595. if ((b = BIO_new(BIO_s_file())) == NULL) {
  596. ERR_raise(ERR_LIB_X509, ERR_R_BUF_LIB);
  597. return NULL;
  598. }
  599. BIO_set_fp(b, fp, BIO_NOCLOSE);
  600. ret = d2i_PrivateKey_ex_bio(b, a, libctx, propq);
  601. BIO_free(b);
  602. return ret;
  603. }
  604. int i2d_PUBKEY_fp(FILE *fp, const EVP_PKEY *pkey)
  605. {
  606. return ASN1_i2d_fp_of(EVP_PKEY, i2d_PUBKEY, fp, pkey);
  607. }
  608. EVP_PKEY *d2i_PUBKEY_ex_fp(FILE *fp, EVP_PKEY **a, OSSL_LIB_CTX *libctx,
  609. const char *propq)
  610. {
  611. BIO *b;
  612. void *ret;
  613. if ((b = BIO_new(BIO_s_file())) == NULL) {
  614. ERR_raise(ERR_LIB_X509, ERR_R_BUF_LIB);
  615. return NULL;
  616. }
  617. BIO_set_fp(b, fp, BIO_NOCLOSE);
  618. ret = d2i_PUBKEY_ex_bio(b, a, libctx, propq);
  619. BIO_free(b);
  620. return ret;
  621. }
  622. EVP_PKEY *d2i_PUBKEY_fp(FILE *fp, EVP_PKEY **a)
  623. {
  624. return ASN1_d2i_fp_of(EVP_PKEY, EVP_PKEY_new, d2i_PUBKEY, fp, a);
  625. }
  626. #endif
  627. PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO_bio(BIO *bp,
  628. PKCS8_PRIV_KEY_INFO **p8inf)
  629. {
  630. return ASN1_d2i_bio_of(PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_new,
  631. d2i_PKCS8_PRIV_KEY_INFO, bp, p8inf);
  632. }
  633. int i2d_PKCS8_PRIV_KEY_INFO_bio(BIO *bp, const PKCS8_PRIV_KEY_INFO *p8inf)
  634. {
  635. return ASN1_i2d_bio_of(PKCS8_PRIV_KEY_INFO, i2d_PKCS8_PRIV_KEY_INFO, bp,
  636. p8inf);
  637. }
  638. int i2d_PKCS8PrivateKeyInfo_bio(BIO *bp, const EVP_PKEY *key)
  639. {
  640. PKCS8_PRIV_KEY_INFO *p8inf;
  641. int ret;
  642. p8inf = EVP_PKEY2PKCS8(key);
  643. if (p8inf == NULL)
  644. return 0;
  645. ret = i2d_PKCS8_PRIV_KEY_INFO_bio(bp, p8inf);
  646. PKCS8_PRIV_KEY_INFO_free(p8inf);
  647. return ret;
  648. }
  649. int i2d_PrivateKey_bio(BIO *bp, const EVP_PKEY *pkey)
  650. {
  651. return ASN1_i2d_bio_of(EVP_PKEY, i2d_PrivateKey, bp, pkey);
  652. }
  653. EVP_PKEY *d2i_PrivateKey_bio(BIO *bp, EVP_PKEY **a)
  654. {
  655. return ASN1_d2i_bio_of(EVP_PKEY, EVP_PKEY_new, d2i_AutoPrivateKey, bp, a);
  656. }
  657. EVP_PKEY *d2i_PrivateKey_ex_bio(BIO *bp, EVP_PKEY **a, OSSL_LIB_CTX *libctx,
  658. const char *propq)
  659. {
  660. BUF_MEM *b = NULL;
  661. const unsigned char *p;
  662. void *ret = NULL;
  663. int len;
  664. len = asn1_d2i_read_bio(bp, &b);
  665. if (len < 0)
  666. goto err;
  667. p = (unsigned char *)b->data;
  668. ret = d2i_AutoPrivateKey_ex(a, &p, len, libctx, propq);
  669. err:
  670. BUF_MEM_free(b);
  671. return ret;
  672. }
  673. int i2d_PUBKEY_bio(BIO *bp, const EVP_PKEY *pkey)
  674. {
  675. return ASN1_i2d_bio_of(EVP_PKEY, i2d_PUBKEY, bp, pkey);
  676. }
  677. EVP_PKEY *d2i_PUBKEY_ex_bio(BIO *bp, EVP_PKEY **a, OSSL_LIB_CTX *libctx,
  678. const char *propq)
  679. {
  680. BUF_MEM *b = NULL;
  681. const unsigned char *p;
  682. void *ret = NULL;
  683. int len;
  684. len = asn1_d2i_read_bio(bp, &b);
  685. if (len < 0)
  686. goto err;
  687. p = (unsigned char *)b->data;
  688. ret = d2i_PUBKEY_ex(a, &p, len, libctx, propq);
  689. err:
  690. BUF_MEM_free(b);
  691. return ret;
  692. }
  693. EVP_PKEY *d2i_PUBKEY_bio(BIO *bp, EVP_PKEY **a)
  694. {
  695. return ASN1_d2i_bio_of(EVP_PKEY, EVP_PKEY_new, d2i_PUBKEY, bp, a);
  696. }