p12_crt.c 6.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290
  1. /*
  2. * Copyright 1999-2016 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <stdio.h>
  10. #include "internal/cryptlib.h"
  11. #include <openssl/pkcs12.h>
  12. #include "p12_local.h"
  13. static int pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG) **pbags,
  14. PKCS12_SAFEBAG *bag);
  15. static int copy_bag_attr(PKCS12_SAFEBAG *bag, EVP_PKEY *pkey, int nid)
  16. {
  17. int idx;
  18. X509_ATTRIBUTE *attr;
  19. idx = EVP_PKEY_get_attr_by_NID(pkey, nid, -1);
  20. if (idx < 0)
  21. return 1;
  22. attr = EVP_PKEY_get_attr(pkey, idx);
  23. if (!X509at_add1_attr(&bag->attrib, attr))
  24. return 0;
  25. return 1;
  26. }
  27. PKCS12 *PKCS12_create(const char *pass, const char *name, EVP_PKEY *pkey, X509 *cert,
  28. STACK_OF(X509) *ca, int nid_key, int nid_cert, int iter,
  29. int mac_iter, int keytype)
  30. {
  31. PKCS12 *p12 = NULL;
  32. STACK_OF(PKCS7) *safes = NULL;
  33. STACK_OF(PKCS12_SAFEBAG) *bags = NULL;
  34. PKCS12_SAFEBAG *bag = NULL;
  35. int i;
  36. unsigned char keyid[EVP_MAX_MD_SIZE];
  37. unsigned int keyidlen = 0;
  38. /* Set defaults */
  39. if (!nid_cert)
  40. #ifdef OPENSSL_NO_RC2
  41. nid_cert = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
  42. #else
  43. nid_cert = NID_pbe_WithSHA1And40BitRC2_CBC;
  44. #endif
  45. if (!nid_key)
  46. nid_key = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
  47. if (!iter)
  48. iter = PKCS12_DEFAULT_ITER;
  49. if (!mac_iter)
  50. mac_iter = 1;
  51. if (pkey == NULL && cert == NULL && ca == NULL) {
  52. PKCS12err(PKCS12_F_PKCS12_CREATE, PKCS12_R_INVALID_NULL_ARGUMENT);
  53. return NULL;
  54. }
  55. if (pkey && cert) {
  56. if (!X509_check_private_key(cert, pkey))
  57. return NULL;
  58. X509_digest(cert, EVP_sha1(), keyid, &keyidlen);
  59. }
  60. if (cert) {
  61. bag = PKCS12_add_cert(&bags, cert);
  62. if (name && !PKCS12_add_friendlyname(bag, name, -1))
  63. goto err;
  64. if (keyidlen && !PKCS12_add_localkeyid(bag, keyid, keyidlen))
  65. goto err;
  66. }
  67. /* Add all other certificates */
  68. for (i = 0; i < sk_X509_num(ca); i++) {
  69. if (!PKCS12_add_cert(&bags, sk_X509_value(ca, i)))
  70. goto err;
  71. }
  72. if (bags && !PKCS12_add_safe(&safes, bags, nid_cert, iter, pass))
  73. goto err;
  74. sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
  75. bags = NULL;
  76. if (pkey) {
  77. bag = PKCS12_add_key(&bags, pkey, keytype, iter, nid_key, pass);
  78. if (!bag)
  79. goto err;
  80. if (!copy_bag_attr(bag, pkey, NID_ms_csp_name))
  81. goto err;
  82. if (!copy_bag_attr(bag, pkey, NID_LocalKeySet))
  83. goto err;
  84. if (name && !PKCS12_add_friendlyname(bag, name, -1))
  85. goto err;
  86. if (keyidlen && !PKCS12_add_localkeyid(bag, keyid, keyidlen))
  87. goto err;
  88. }
  89. if (bags && !PKCS12_add_safe(&safes, bags, -1, 0, NULL))
  90. goto err;
  91. sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
  92. bags = NULL;
  93. p12 = PKCS12_add_safes(safes, 0);
  94. if (p12 == NULL)
  95. goto err;
  96. sk_PKCS7_pop_free(safes, PKCS7_free);
  97. safes = NULL;
  98. if ((mac_iter != -1) &&
  99. !PKCS12_set_mac(p12, pass, -1, NULL, 0, mac_iter, NULL))
  100. goto err;
  101. return p12;
  102. err:
  103. PKCS12_free(p12);
  104. sk_PKCS7_pop_free(safes, PKCS7_free);
  105. sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
  106. return NULL;
  107. }
  108. PKCS12_SAFEBAG *PKCS12_add_cert(STACK_OF(PKCS12_SAFEBAG) **pbags, X509 *cert)
  109. {
  110. PKCS12_SAFEBAG *bag = NULL;
  111. char *name;
  112. int namelen = -1;
  113. unsigned char *keyid;
  114. int keyidlen = -1;
  115. /* Add user certificate */
  116. if ((bag = PKCS12_SAFEBAG_create_cert(cert)) == NULL)
  117. goto err;
  118. /*
  119. * Use friendlyName and localKeyID in certificate. (if present)
  120. */
  121. name = (char *)X509_alias_get0(cert, &namelen);
  122. if (name && !PKCS12_add_friendlyname(bag, name, namelen))
  123. goto err;
  124. keyid = X509_keyid_get0(cert, &keyidlen);
  125. if (keyid && !PKCS12_add_localkeyid(bag, keyid, keyidlen))
  126. goto err;
  127. if (!pkcs12_add_bag(pbags, bag))
  128. goto err;
  129. return bag;
  130. err:
  131. PKCS12_SAFEBAG_free(bag);
  132. return NULL;
  133. }
  134. PKCS12_SAFEBAG *PKCS12_add_key(STACK_OF(PKCS12_SAFEBAG) **pbags,
  135. EVP_PKEY *key, int key_usage, int iter,
  136. int nid_key, const char *pass)
  137. {
  138. PKCS12_SAFEBAG *bag = NULL;
  139. PKCS8_PRIV_KEY_INFO *p8 = NULL;
  140. /* Make a PKCS#8 structure */
  141. if ((p8 = EVP_PKEY2PKCS8(key)) == NULL)
  142. goto err;
  143. if (key_usage && !PKCS8_add_keyusage(p8, key_usage))
  144. goto err;
  145. if (nid_key != -1) {
  146. bag = PKCS12_SAFEBAG_create_pkcs8_encrypt(nid_key, pass, -1, NULL, 0,
  147. iter, p8);
  148. PKCS8_PRIV_KEY_INFO_free(p8);
  149. } else
  150. bag = PKCS12_SAFEBAG_create0_p8inf(p8);
  151. if (!bag)
  152. goto err;
  153. if (!pkcs12_add_bag(pbags, bag))
  154. goto err;
  155. return bag;
  156. err:
  157. PKCS12_SAFEBAG_free(bag);
  158. return NULL;
  159. }
  160. int PKCS12_add_safe(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags,
  161. int nid_safe, int iter, const char *pass)
  162. {
  163. PKCS7 *p7 = NULL;
  164. int free_safes = 0;
  165. if (*psafes == NULL) {
  166. *psafes = sk_PKCS7_new_null();
  167. if (*psafes == NULL)
  168. return 0;
  169. free_safes = 1;
  170. }
  171. if (nid_safe == 0)
  172. #ifdef OPENSSL_NO_RC2
  173. nid_safe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
  174. #else
  175. nid_safe = NID_pbe_WithSHA1And40BitRC2_CBC;
  176. #endif
  177. if (nid_safe == -1)
  178. p7 = PKCS12_pack_p7data(bags);
  179. else
  180. p7 = PKCS12_pack_p7encdata(nid_safe, pass, -1, NULL, 0, iter, bags);
  181. if (p7 == NULL)
  182. goto err;
  183. if (!sk_PKCS7_push(*psafes, p7))
  184. goto err;
  185. return 1;
  186. err:
  187. if (free_safes) {
  188. sk_PKCS7_free(*psafes);
  189. *psafes = NULL;
  190. }
  191. PKCS7_free(p7);
  192. return 0;
  193. }
  194. static int pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG) **pbags,
  195. PKCS12_SAFEBAG *bag)
  196. {
  197. int free_bags = 0;
  198. if (pbags == NULL)
  199. return 1;
  200. if (*pbags == NULL) {
  201. *pbags = sk_PKCS12_SAFEBAG_new_null();
  202. if (*pbags == NULL)
  203. return 0;
  204. free_bags = 1;
  205. }
  206. if (!sk_PKCS12_SAFEBAG_push(*pbags, bag)) {
  207. if (free_bags) {
  208. sk_PKCS12_SAFEBAG_free(*pbags);
  209. *pbags = NULL;
  210. }
  211. return 0;
  212. }
  213. return 1;
  214. }
  215. PKCS12 *PKCS12_add_safes(STACK_OF(PKCS7) *safes, int nid_p7)
  216. {
  217. PKCS12 *p12;
  218. if (nid_p7 <= 0)
  219. nid_p7 = NID_pkcs7_data;
  220. p12 = PKCS12_init(nid_p7);
  221. if (p12 == NULL)
  222. return NULL;
  223. if (!PKCS12_pack_authsafes(p12, safes)) {
  224. PKCS12_free(p12);
  225. return NULL;
  226. }
  227. return p12;
  228. }