pem_info.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399
  1. /* crypto/pem/pem_info.c */
  2. /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  3. * All rights reserved.
  4. *
  5. * This package is an SSL implementation written
  6. * by Eric Young (eay@cryptsoft.com).
  7. * The implementation was written so as to conform with Netscapes SSL.
  8. *
  9. * This library is free for commercial and non-commercial use as long as
  10. * the following conditions are aheared to. The following conditions
  11. * apply to all code found in this distribution, be it the RC4, RSA,
  12. * lhash, DES, etc., code; not just the SSL code. The SSL documentation
  13. * included with this distribution is covered by the same copyright terms
  14. * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15. *
  16. * Copyright remains Eric Young's, and as such any Copyright notices in
  17. * the code are not to be removed.
  18. * If this package is used in a product, Eric Young should be given attribution
  19. * as the author of the parts of the library used.
  20. * This can be in the form of a textual message at program startup or
  21. * in documentation (online or textual) provided with the package.
  22. *
  23. * Redistribution and use in source and binary forms, with or without
  24. * modification, are permitted provided that the following conditions
  25. * are met:
  26. * 1. Redistributions of source code must retain the copyright
  27. * notice, this list of conditions and the following disclaimer.
  28. * 2. Redistributions in binary form must reproduce the above copyright
  29. * notice, this list of conditions and the following disclaimer in the
  30. * documentation and/or other materials provided with the distribution.
  31. * 3. All advertising materials mentioning features or use of this software
  32. * must display the following acknowledgement:
  33. * "This product includes cryptographic software written by
  34. * Eric Young (eay@cryptsoft.com)"
  35. * The word 'cryptographic' can be left out if the rouines from the library
  36. * being used are not cryptographic related :-).
  37. * 4. If you include any Windows specific code (or a derivative thereof) from
  38. * the apps directory (application code) you must include an acknowledgement:
  39. * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40. *
  41. * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42. * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44. * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45. * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46. * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47. * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49. * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50. * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51. * SUCH DAMAGE.
  52. *
  53. * The licence and distribution terms for any publically available version or
  54. * derivative of this code cannot be changed. i.e. this code cannot simply be
  55. * copied and put under another distribution licence
  56. * [including the GNU Public Licence.]
  57. */
  58. #include <stdio.h>
  59. #include "cryptlib.h"
  60. #include <openssl/buffer.h>
  61. #include <openssl/objects.h>
  62. #include <openssl/evp.h>
  63. #include <openssl/x509.h>
  64. #include <openssl/pem.h>
  65. #ifndef OPENSSL_NO_RSA
  66. #include <openssl/rsa.h>
  67. #endif
  68. #ifndef OPENSSL_NO_DSA
  69. #include <openssl/dsa.h>
  70. #endif
  71. #ifndef OPENSSL_NO_FP_API
  72. STACK_OF(X509_INFO) *PEM_X509_INFO_read(FILE *fp, STACK_OF(X509_INFO) *sk, pem_password_cb *cb, void *u)
  73. {
  74. BIO *b;
  75. STACK_OF(X509_INFO) *ret;
  76. if ((b=BIO_new(BIO_s_file())) == NULL)
  77. {
  78. PEMerr(PEM_F_PEM_X509_INFO_READ,ERR_R_BUF_LIB);
  79. return(0);
  80. }
  81. BIO_set_fp(b,fp,BIO_NOCLOSE);
  82. ret=PEM_X509_INFO_read_bio(b,sk,cb,u);
  83. BIO_free(b);
  84. return(ret);
  85. }
  86. #endif
  87. STACK_OF(X509_INFO) *PEM_X509_INFO_read_bio(BIO *bp, STACK_OF(X509_INFO) *sk, pem_password_cb *cb, void *u)
  88. {
  89. X509_INFO *xi=NULL;
  90. char *name=NULL,*header=NULL;
  91. void *pp;
  92. unsigned char *data=NULL;
  93. const unsigned char *p;
  94. long len,error=0;
  95. int ok=0;
  96. STACK_OF(X509_INFO) *ret=NULL;
  97. unsigned int i,raw,ptype;
  98. d2i_of_void *d2i;
  99. if (sk == NULL)
  100. {
  101. if ((ret=sk_X509_INFO_new_null()) == NULL)
  102. {
  103. PEMerr(PEM_F_PEM_X509_INFO_READ_BIO,ERR_R_MALLOC_FAILURE);
  104. goto err;
  105. }
  106. }
  107. else
  108. ret=sk;
  109. if ((xi=X509_INFO_new()) == NULL) goto err;
  110. for (;;)
  111. {
  112. raw=0;
  113. ptype = 0;
  114. i=PEM_read_bio(bp,&name,&header,&data,&len);
  115. if (i == 0)
  116. {
  117. error=ERR_GET_REASON(ERR_peek_last_error());
  118. if (error == PEM_R_NO_START_LINE)
  119. {
  120. ERR_clear_error();
  121. break;
  122. }
  123. goto err;
  124. }
  125. start:
  126. if ( (strcmp(name,PEM_STRING_X509) == 0) ||
  127. (strcmp(name,PEM_STRING_X509_OLD) == 0))
  128. {
  129. d2i=(D2I_OF(void))d2i_X509;
  130. if (xi->x509 != NULL)
  131. {
  132. if (!sk_X509_INFO_push(ret,xi)) goto err;
  133. if ((xi=X509_INFO_new()) == NULL) goto err;
  134. goto start;
  135. }
  136. pp=&(xi->x509);
  137. }
  138. else if ((strcmp(name,PEM_STRING_X509_TRUSTED) == 0))
  139. {
  140. d2i=(D2I_OF(void))d2i_X509_AUX;
  141. if (xi->x509 != NULL)
  142. {
  143. if (!sk_X509_INFO_push(ret,xi)) goto err;
  144. if ((xi=X509_INFO_new()) == NULL) goto err;
  145. goto start;
  146. }
  147. pp=&(xi->x509);
  148. }
  149. else if (strcmp(name,PEM_STRING_X509_CRL) == 0)
  150. {
  151. d2i=(D2I_OF(void))d2i_X509_CRL;
  152. if (xi->crl != NULL)
  153. {
  154. if (!sk_X509_INFO_push(ret,xi)) goto err;
  155. if ((xi=X509_INFO_new()) == NULL) goto err;
  156. goto start;
  157. }
  158. pp=&(xi->crl);
  159. }
  160. else
  161. #ifndef OPENSSL_NO_RSA
  162. if (strcmp(name,PEM_STRING_RSA) == 0)
  163. {
  164. if (xi->x_pkey != NULL)
  165. {
  166. if (!sk_X509_INFO_push(ret,xi)) goto err;
  167. if ((xi=X509_INFO_new()) == NULL) goto err;
  168. goto start;
  169. }
  170. xi->enc_data=NULL;
  171. xi->enc_len=0;
  172. xi->x_pkey=X509_PKEY_new();
  173. ptype=EVP_PKEY_RSA;
  174. pp=&xi->x_pkey->dec_pkey;
  175. if ((int)strlen(header) > 10) /* assume encrypted */
  176. raw=1;
  177. }
  178. else
  179. #endif
  180. #ifndef OPENSSL_NO_DSA
  181. if (strcmp(name,PEM_STRING_DSA) == 0)
  182. {
  183. d2i=(D2I_OF(void))d2i_DSAPrivateKey;
  184. if (xi->x_pkey != NULL)
  185. {
  186. if (!sk_X509_INFO_push(ret,xi)) goto err;
  187. if ((xi=X509_INFO_new()) == NULL) goto err;
  188. goto start;
  189. }
  190. xi->enc_data=NULL;
  191. xi->enc_len=0;
  192. xi->x_pkey=X509_PKEY_new();
  193. ptype = EVP_PKEY_DSA;
  194. pp=&xi->x_pkey->dec_pkey;
  195. if ((int)strlen(header) > 10) /* assume encrypted */
  196. raw=1;
  197. }
  198. else
  199. #endif
  200. #ifndef OPENSSL_NO_EC
  201. if (strcmp(name,PEM_STRING_ECPRIVATEKEY) == 0)
  202. {
  203. d2i=(D2I_OF(void))d2i_ECPrivateKey;
  204. if (xi->x_pkey != NULL)
  205. {
  206. if (!sk_X509_INFO_push(ret,xi)) goto err;
  207. if ((xi=X509_INFO_new()) == NULL) goto err;
  208. goto start;
  209. }
  210. xi->enc_data=NULL;
  211. xi->enc_len=0;
  212. xi->x_pkey=X509_PKEY_new();
  213. ptype = EVP_PKEY_EC;
  214. pp=&xi->x_pkey->dec_pkey;
  215. if ((int)strlen(header) > 10) /* assume encrypted */
  216. raw=1;
  217. }
  218. else
  219. #endif
  220. {
  221. d2i=NULL;
  222. pp=NULL;
  223. }
  224. if (d2i != NULL)
  225. {
  226. if (!raw)
  227. {
  228. EVP_CIPHER_INFO cipher;
  229. if (!PEM_get_EVP_CIPHER_INFO(header,&cipher))
  230. goto err;
  231. if (!PEM_do_header(&cipher,data,&len,cb,u))
  232. goto err;
  233. p=data;
  234. if (ptype)
  235. {
  236. if (!d2i_PrivateKey(ptype, pp, &p, len))
  237. {
  238. PEMerr(PEM_F_PEM_X509_INFO_READ_BIO,ERR_R_ASN1_LIB);
  239. goto err;
  240. }
  241. }
  242. else if (d2i(pp,&p,len) == NULL)
  243. {
  244. PEMerr(PEM_F_PEM_X509_INFO_READ_BIO,ERR_R_ASN1_LIB);
  245. goto err;
  246. }
  247. }
  248. else
  249. { /* encrypted RSA data */
  250. if (!PEM_get_EVP_CIPHER_INFO(header,
  251. &xi->enc_cipher)) goto err;
  252. xi->enc_data=(char *)data;
  253. xi->enc_len=(int)len;
  254. data=NULL;
  255. }
  256. }
  257. else {
  258. /* unknown */
  259. }
  260. if (name != NULL) OPENSSL_free(name);
  261. if (header != NULL) OPENSSL_free(header);
  262. if (data != NULL) OPENSSL_free(data);
  263. name=NULL;
  264. header=NULL;
  265. data=NULL;
  266. }
  267. /* if the last one hasn't been pushed yet and there is anything
  268. * in it then add it to the stack ...
  269. */
  270. if ((xi->x509 != NULL) || (xi->crl != NULL) ||
  271. (xi->x_pkey != NULL) || (xi->enc_data != NULL))
  272. {
  273. if (!sk_X509_INFO_push(ret,xi)) goto err;
  274. xi=NULL;
  275. }
  276. ok=1;
  277. err:
  278. if (xi != NULL) X509_INFO_free(xi);
  279. if (!ok)
  280. {
  281. for (i=0; ((int)i)<sk_X509_INFO_num(ret); i++)
  282. {
  283. xi=sk_X509_INFO_value(ret,i);
  284. X509_INFO_free(xi);
  285. }
  286. if (ret != sk) sk_X509_INFO_free(ret);
  287. ret=NULL;
  288. }
  289. if (name != NULL) OPENSSL_free(name);
  290. if (header != NULL) OPENSSL_free(header);
  291. if (data != NULL) OPENSSL_free(data);
  292. return(ret);
  293. }
  294. /* A TJH addition */
  295. int PEM_X509_INFO_write_bio(BIO *bp, X509_INFO *xi, EVP_CIPHER *enc,
  296. unsigned char *kstr, int klen, pem_password_cb *cb, void *u)
  297. {
  298. EVP_CIPHER_CTX ctx;
  299. int i,ret=0;
  300. unsigned char *data=NULL;
  301. const char *objstr=NULL;
  302. char buf[PEM_BUFSIZE];
  303. unsigned char *iv=NULL;
  304. if (enc != NULL)
  305. {
  306. objstr=OBJ_nid2sn(EVP_CIPHER_nid(enc));
  307. if (objstr == NULL)
  308. {
  309. PEMerr(PEM_F_PEM_X509_INFO_WRITE_BIO,PEM_R_UNSUPPORTED_CIPHER);
  310. goto err;
  311. }
  312. }
  313. /* now for the fun part ... if we have a private key then
  314. * we have to be able to handle a not-yet-decrypted key
  315. * being written out correctly ... if it is decrypted or
  316. * it is non-encrypted then we use the base code
  317. */
  318. if (xi->x_pkey!=NULL)
  319. {
  320. if ( (xi->enc_data!=NULL) && (xi->enc_len>0) )
  321. {
  322. /* copy from weirdo names into more normal things */
  323. iv=xi->enc_cipher.iv;
  324. data=(unsigned char *)xi->enc_data;
  325. i=xi->enc_len;
  326. /* we take the encryption data from the
  327. * internal stuff rather than what the
  328. * user has passed us ... as we have to
  329. * match exactly for some strange reason
  330. */
  331. objstr=OBJ_nid2sn(
  332. EVP_CIPHER_nid(xi->enc_cipher.cipher));
  333. if (objstr == NULL)
  334. {
  335. PEMerr(PEM_F_PEM_X509_INFO_WRITE_BIO,PEM_R_UNSUPPORTED_CIPHER);
  336. goto err;
  337. }
  338. /* create the right magic header stuff */
  339. OPENSSL_assert(strlen(objstr)+23+2*enc->iv_len+13 <= sizeof buf);
  340. buf[0]='\0';
  341. PEM_proc_type(buf,PEM_TYPE_ENCRYPTED);
  342. PEM_dek_info(buf,objstr,enc->iv_len,(char *)iv);
  343. /* use the normal code to write things out */
  344. i=PEM_write_bio(bp,PEM_STRING_RSA,buf,data,i);
  345. if (i <= 0) goto err;
  346. }
  347. else
  348. {
  349. /* Add DSA/DH */
  350. #ifndef OPENSSL_NO_RSA
  351. /* normal optionally encrypted stuff */
  352. if (PEM_write_bio_RSAPrivateKey(bp,
  353. xi->x_pkey->dec_pkey->pkey.rsa,
  354. enc,kstr,klen,cb,u)<=0)
  355. goto err;
  356. #endif
  357. }
  358. }
  359. /* if we have a certificate then write it out now */
  360. if ((xi->x509 != NULL) && (PEM_write_bio_X509(bp,xi->x509) <= 0))
  361. goto err;
  362. /* we are ignoring anything else that is loaded into the X509_INFO
  363. * structure for the moment ... as I don't need it so I'm not
  364. * coding it here and Eric can do it when this makes it into the
  365. * base library --tjh
  366. */
  367. ret=1;
  368. err:
  369. OPENSSL_cleanse((char *)&ctx,sizeof(ctx));
  370. OPENSSL_cleanse(buf,PEM_BUFSIZE);
  371. return(ret);
  372. }