2
0

x_all.c 23 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826
  1. /*
  2. * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. /*
  10. * Low level APIs are deprecated for public use, but still ok for
  11. * internal use.
  12. */
  13. #include "internal/deprecated.h"
  14. #include <stdio.h>
  15. #include "internal/cryptlib.h"
  16. #include <openssl/buffer.h>
  17. #include <openssl/asn1.h>
  18. #include <openssl/evp.h>
  19. #include <openssl/x509.h>
  20. #include <openssl/http.h>
  21. #include <openssl/rsa.h>
  22. #include <openssl/dsa.h>
  23. #include <openssl/x509v3.h>
  24. #include "internal/asn1.h"
  25. #include "crypto/pkcs7.h"
  26. #include "crypto/x509.h"
  27. #include "crypto/rsa.h"
  28. int X509_verify(X509 *a, EVP_PKEY *r)
  29. {
  30. if (X509_ALGOR_cmp(&a->sig_alg, &a->cert_info.signature) != 0)
  31. return 0;
  32. return ASN1_item_verify_ex(ASN1_ITEM_rptr(X509_CINF), &a->sig_alg,
  33. &a->signature, &a->cert_info,
  34. a->distinguishing_id, r, a->libctx, a->propq);
  35. }
  36. int X509_REQ_verify_ex(X509_REQ *a, EVP_PKEY *r, OSSL_LIB_CTX *libctx,
  37. const char *propq)
  38. {
  39. return ASN1_item_verify_ex(ASN1_ITEM_rptr(X509_REQ_INFO), &a->sig_alg,
  40. a->signature, &a->req_info, a->distinguishing_id,
  41. r, libctx, propq);
  42. }
  43. int X509_REQ_verify(X509_REQ *a, EVP_PKEY *r)
  44. {
  45. return X509_REQ_verify_ex(a, r, NULL, NULL);
  46. }
  47. int NETSCAPE_SPKI_verify(NETSCAPE_SPKI *a, EVP_PKEY *r)
  48. {
  49. return ASN1_item_verify(ASN1_ITEM_rptr(NETSCAPE_SPKAC),
  50. &a->sig_algor, a->signature, a->spkac, r);
  51. }
  52. int X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)
  53. {
  54. if (x == NULL) {
  55. ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
  56. return 0;
  57. }
  58. if (sk_X509_EXTENSION_num(X509_get0_extensions(x)) > 0
  59. && !X509_set_version(x, X509_VERSION_3))
  60. return 0;
  61. /*
  62. * Setting the modified flag before signing it. This makes the cached
  63. * encoding to be ignored, so even if the certificate fields have changed,
  64. * they are signed correctly.
  65. * The X509_sign_ctx, X509_REQ_sign{,_ctx}, X509_CRL_sign{,_ctx} functions
  66. * which exist below are the same.
  67. */
  68. x->cert_info.enc.modified = 1;
  69. return ASN1_item_sign_ex(ASN1_ITEM_rptr(X509_CINF), &x->cert_info.signature,
  70. &x->sig_alg, &x->signature, &x->cert_info, NULL,
  71. pkey, md, x->libctx, x->propq);
  72. }
  73. int X509_sign_ctx(X509 *x, EVP_MD_CTX *ctx)
  74. {
  75. if (x == NULL) {
  76. ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
  77. return 0;
  78. }
  79. if (sk_X509_EXTENSION_num(X509_get0_extensions(x)) > 0
  80. && !X509_set_version(x, X509_VERSION_3))
  81. return 0;
  82. x->cert_info.enc.modified = 1;
  83. return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_CINF),
  84. &x->cert_info.signature,
  85. &x->sig_alg, &x->signature, &x->cert_info, ctx);
  86. }
  87. static ASN1_VALUE *simple_get_asn1(const char *url, BIO *bio, BIO *rbio,
  88. int timeout, const ASN1_ITEM *it)
  89. {
  90. #ifndef OPENSSL_NO_HTTP
  91. BIO *mem = OSSL_HTTP_get(url, NULL /* proxy */, NULL /* no_proxy */,
  92. bio, rbio, NULL /* cb */, NULL /* arg */,
  93. 1024 /* buf_size */, NULL /* headers */,
  94. NULL /* expected_ct */, 1 /* expect_asn1 */,
  95. OSSL_HTTP_DEFAULT_MAX_RESP_LEN, timeout);
  96. ASN1_VALUE *res = ASN1_item_d2i_bio(it, mem, NULL);
  97. BIO_free(mem);
  98. return res;
  99. #else
  100. return 0;
  101. #endif
  102. }
  103. X509 *X509_load_http(const char *url, BIO *bio, BIO *rbio, int timeout)
  104. {
  105. return (X509 *)simple_get_asn1(url, bio, rbio, timeout,
  106. ASN1_ITEM_rptr(X509));
  107. }
  108. int X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md)
  109. {
  110. if (x == NULL) {
  111. ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
  112. return 0;
  113. }
  114. x->req_info.enc.modified = 1;
  115. return ASN1_item_sign_ex(ASN1_ITEM_rptr(X509_REQ_INFO), &x->sig_alg, NULL,
  116. x->signature, &x->req_info, NULL,
  117. pkey, md, x->libctx, x->propq);
  118. }
  119. int X509_REQ_sign_ctx(X509_REQ *x, EVP_MD_CTX *ctx)
  120. {
  121. if (x == NULL) {
  122. ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
  123. return 0;
  124. }
  125. x->req_info.enc.modified = 1;
  126. return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_REQ_INFO),
  127. &x->sig_alg, NULL, x->signature, &x->req_info,
  128. ctx);
  129. }
  130. int X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md)
  131. {
  132. if (x == NULL) {
  133. ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
  134. return 0;
  135. }
  136. x->crl.enc.modified = 1;
  137. return ASN1_item_sign_ex(ASN1_ITEM_rptr(X509_CRL_INFO), &x->crl.sig_alg,
  138. &x->sig_alg, &x->signature, &x->crl, NULL,
  139. pkey, md, x->libctx, x->propq);
  140. }
  141. int X509_CRL_sign_ctx(X509_CRL *x, EVP_MD_CTX *ctx)
  142. {
  143. if (x == NULL) {
  144. ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
  145. return 0;
  146. }
  147. x->crl.enc.modified = 1;
  148. return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_CRL_INFO),
  149. &x->crl.sig_alg, &x->sig_alg, &x->signature,
  150. &x->crl, ctx);
  151. }
  152. X509_CRL *X509_CRL_load_http(const char *url, BIO *bio, BIO *rbio, int timeout)
  153. {
  154. return (X509_CRL *)simple_get_asn1(url, bio, rbio, timeout,
  155. ASN1_ITEM_rptr(X509_CRL));
  156. }
  157. int NETSCAPE_SPKI_sign(NETSCAPE_SPKI *x, EVP_PKEY *pkey, const EVP_MD *md)
  158. {
  159. return
  160. ASN1_item_sign_ex(ASN1_ITEM_rptr(NETSCAPE_SPKAC), &x->sig_algor, NULL,
  161. x->signature, x->spkac, NULL, pkey, md, NULL, NULL);
  162. }
  163. #ifndef OPENSSL_NO_STDIO
  164. X509 *d2i_X509_fp(FILE *fp, X509 **x509)
  165. {
  166. return ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509), fp, x509);
  167. }
  168. int i2d_X509_fp(FILE *fp, const X509 *x509)
  169. {
  170. return ASN1_item_i2d_fp(ASN1_ITEM_rptr(X509), fp, x509);
  171. }
  172. #endif
  173. X509 *d2i_X509_bio(BIO *bp, X509 **x509)
  174. {
  175. return ASN1_item_d2i_bio(ASN1_ITEM_rptr(X509), bp, x509);
  176. }
  177. int i2d_X509_bio(BIO *bp, const X509 *x509)
  178. {
  179. return ASN1_item_i2d_bio(ASN1_ITEM_rptr(X509), bp, x509);
  180. }
  181. #ifndef OPENSSL_NO_STDIO
  182. X509_CRL *d2i_X509_CRL_fp(FILE *fp, X509_CRL **crl)
  183. {
  184. return ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509_CRL), fp, crl);
  185. }
  186. int i2d_X509_CRL_fp(FILE *fp, const X509_CRL *crl)
  187. {
  188. return ASN1_item_i2d_fp(ASN1_ITEM_rptr(X509_CRL), fp, crl);
  189. }
  190. #endif
  191. X509_CRL *d2i_X509_CRL_bio(BIO *bp, X509_CRL **crl)
  192. {
  193. return ASN1_item_d2i_bio(ASN1_ITEM_rptr(X509_CRL), bp, crl);
  194. }
  195. int i2d_X509_CRL_bio(BIO *bp, const X509_CRL *crl)
  196. {
  197. return ASN1_item_i2d_bio(ASN1_ITEM_rptr(X509_CRL), bp, crl);
  198. }
  199. #ifndef OPENSSL_NO_STDIO
  200. PKCS7 *d2i_PKCS7_fp(FILE *fp, PKCS7 **p7)
  201. {
  202. PKCS7 *ret;
  203. OSSL_LIB_CTX *libctx = NULL;
  204. const char *propq = NULL;
  205. if (p7 != NULL && *p7 != NULL) {
  206. libctx = (*p7)->ctx.libctx;
  207. propq = (*p7)->ctx.propq;
  208. }
  209. ret = ASN1_item_d2i_fp_ex(ASN1_ITEM_rptr(PKCS7), fp, p7, libctx, propq);
  210. if (ret != NULL)
  211. ossl_pkcs7_resolve_libctx(ret);
  212. return ret;
  213. }
  214. int i2d_PKCS7_fp(FILE *fp, const PKCS7 *p7)
  215. {
  216. return ASN1_item_i2d_fp(ASN1_ITEM_rptr(PKCS7), fp, p7);
  217. }
  218. #endif
  219. PKCS7 *d2i_PKCS7_bio(BIO *bp, PKCS7 **p7)
  220. {
  221. PKCS7 *ret;
  222. OSSL_LIB_CTX *libctx = NULL;
  223. const char *propq = NULL;
  224. if (p7 != NULL && *p7 != NULL) {
  225. libctx = (*p7)->ctx.libctx;
  226. propq = (*p7)->ctx.propq;
  227. }
  228. ret = ASN1_item_d2i_bio_ex(ASN1_ITEM_rptr(PKCS7), bp, p7, libctx, propq);
  229. if (ret != NULL)
  230. ossl_pkcs7_resolve_libctx(ret);
  231. return ret;
  232. }
  233. int i2d_PKCS7_bio(BIO *bp, const PKCS7 *p7)
  234. {
  235. return ASN1_item_i2d_bio(ASN1_ITEM_rptr(PKCS7), bp, p7);
  236. }
  237. #ifndef OPENSSL_NO_STDIO
  238. X509_REQ *d2i_X509_REQ_fp(FILE *fp, X509_REQ **req)
  239. {
  240. return ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509_REQ), fp, req);
  241. }
  242. int i2d_X509_REQ_fp(FILE *fp, const X509_REQ *req)
  243. {
  244. return ASN1_item_i2d_fp(ASN1_ITEM_rptr(X509_REQ), fp, req);
  245. }
  246. #endif
  247. X509_REQ *d2i_X509_REQ_bio(BIO *bp, X509_REQ **req)
  248. {
  249. OSSL_LIB_CTX *libctx = NULL;
  250. const char *propq = NULL;
  251. if (req != NULL && *req != NULL) {
  252. libctx = (*req)->libctx;
  253. propq = (*req)->propq;
  254. }
  255. return
  256. ASN1_item_d2i_bio_ex(ASN1_ITEM_rptr(X509_REQ), bp, req, libctx, propq);
  257. }
  258. int i2d_X509_REQ_bio(BIO *bp, const X509_REQ *req)
  259. {
  260. return ASN1_item_i2d_bio(ASN1_ITEM_rptr(X509_REQ), bp, req);
  261. }
  262. #ifndef OPENSSL_NO_STDIO
  263. RSA *d2i_RSAPrivateKey_fp(FILE *fp, RSA **rsa)
  264. {
  265. return ASN1_item_d2i_fp(ASN1_ITEM_rptr(RSAPrivateKey), fp, rsa);
  266. }
  267. int i2d_RSAPrivateKey_fp(FILE *fp, const RSA *rsa)
  268. {
  269. return ASN1_item_i2d_fp(ASN1_ITEM_rptr(RSAPrivateKey), fp, rsa);
  270. }
  271. RSA *d2i_RSAPublicKey_fp(FILE *fp, RSA **rsa)
  272. {
  273. return ASN1_item_d2i_fp(ASN1_ITEM_rptr(RSAPublicKey), fp, rsa);
  274. }
  275. RSA *d2i_RSA_PUBKEY_fp(FILE *fp, RSA **rsa)
  276. {
  277. return ASN1_d2i_fp((void *(*)(void))
  278. RSA_new, (D2I_OF(void)) d2i_RSA_PUBKEY, fp,
  279. (void **)rsa);
  280. }
  281. int i2d_RSAPublicKey_fp(FILE *fp, const RSA *rsa)
  282. {
  283. return ASN1_item_i2d_fp(ASN1_ITEM_rptr(RSAPublicKey), fp, rsa);
  284. }
  285. int i2d_RSA_PUBKEY_fp(FILE *fp, const RSA *rsa)
  286. {
  287. return ASN1_i2d_fp((I2D_OF(void))i2d_RSA_PUBKEY, fp, rsa);
  288. }
  289. #endif
  290. RSA *d2i_RSAPrivateKey_bio(BIO *bp, RSA **rsa)
  291. {
  292. return ASN1_item_d2i_bio(ASN1_ITEM_rptr(RSAPrivateKey), bp, rsa);
  293. }
  294. int i2d_RSAPrivateKey_bio(BIO *bp, const RSA *rsa)
  295. {
  296. return ASN1_item_i2d_bio(ASN1_ITEM_rptr(RSAPrivateKey), bp, rsa);
  297. }
  298. RSA *d2i_RSAPublicKey_bio(BIO *bp, RSA **rsa)
  299. {
  300. return ASN1_item_d2i_bio(ASN1_ITEM_rptr(RSAPublicKey), bp, rsa);
  301. }
  302. RSA *d2i_RSA_PUBKEY_bio(BIO *bp, RSA **rsa)
  303. {
  304. return ASN1_d2i_bio_of(RSA, RSA_new, d2i_RSA_PUBKEY, bp, rsa);
  305. }
  306. int i2d_RSAPublicKey_bio(BIO *bp, const RSA *rsa)
  307. {
  308. return ASN1_item_i2d_bio(ASN1_ITEM_rptr(RSAPublicKey), bp, rsa);
  309. }
  310. int i2d_RSA_PUBKEY_bio(BIO *bp, const RSA *rsa)
  311. {
  312. return ASN1_i2d_bio_of(RSA, i2d_RSA_PUBKEY, bp, rsa);
  313. }
  314. #ifndef OPENSSL_NO_DSA
  315. # ifndef OPENSSL_NO_STDIO
  316. DSA *d2i_DSAPrivateKey_fp(FILE *fp, DSA **dsa)
  317. {
  318. return ASN1_d2i_fp_of(DSA, DSA_new, d2i_DSAPrivateKey, fp, dsa);
  319. }
  320. int i2d_DSAPrivateKey_fp(FILE *fp, const DSA *dsa)
  321. {
  322. return ASN1_i2d_fp_of(DSA, i2d_DSAPrivateKey, fp, dsa);
  323. }
  324. DSA *d2i_DSA_PUBKEY_fp(FILE *fp, DSA **dsa)
  325. {
  326. return ASN1_d2i_fp_of(DSA, DSA_new, d2i_DSA_PUBKEY, fp, dsa);
  327. }
  328. int i2d_DSA_PUBKEY_fp(FILE *fp, const DSA *dsa)
  329. {
  330. return ASN1_i2d_fp_of(DSA, i2d_DSA_PUBKEY, fp, dsa);
  331. }
  332. # endif
  333. DSA *d2i_DSAPrivateKey_bio(BIO *bp, DSA **dsa)
  334. {
  335. return ASN1_d2i_bio_of(DSA, DSA_new, d2i_DSAPrivateKey, bp, dsa);
  336. }
  337. int i2d_DSAPrivateKey_bio(BIO *bp, const DSA *dsa)
  338. {
  339. return ASN1_i2d_bio_of(DSA, i2d_DSAPrivateKey, bp, dsa);
  340. }
  341. DSA *d2i_DSA_PUBKEY_bio(BIO *bp, DSA **dsa)
  342. {
  343. return ASN1_d2i_bio_of(DSA, DSA_new, d2i_DSA_PUBKEY, bp, dsa);
  344. }
  345. int i2d_DSA_PUBKEY_bio(BIO *bp, const DSA *dsa)
  346. {
  347. return ASN1_i2d_bio_of(DSA, i2d_DSA_PUBKEY, bp, dsa);
  348. }
  349. #endif
  350. #ifndef OPENSSL_NO_EC
  351. # ifndef OPENSSL_NO_STDIO
  352. EC_KEY *d2i_EC_PUBKEY_fp(FILE *fp, EC_KEY **eckey)
  353. {
  354. return ASN1_d2i_fp_of(EC_KEY, EC_KEY_new, d2i_EC_PUBKEY, fp, eckey);
  355. }
  356. int i2d_EC_PUBKEY_fp(FILE *fp, const EC_KEY *eckey)
  357. {
  358. return ASN1_i2d_fp_of(EC_KEY, i2d_EC_PUBKEY, fp, eckey);
  359. }
  360. EC_KEY *d2i_ECPrivateKey_fp(FILE *fp, EC_KEY **eckey)
  361. {
  362. return ASN1_d2i_fp_of(EC_KEY, EC_KEY_new, d2i_ECPrivateKey, fp, eckey);
  363. }
  364. int i2d_ECPrivateKey_fp(FILE *fp, const EC_KEY *eckey)
  365. {
  366. return ASN1_i2d_fp_of(EC_KEY, i2d_ECPrivateKey, fp, eckey);
  367. }
  368. # endif
  369. EC_KEY *d2i_EC_PUBKEY_bio(BIO *bp, EC_KEY **eckey)
  370. {
  371. return ASN1_d2i_bio_of(EC_KEY, EC_KEY_new, d2i_EC_PUBKEY, bp, eckey);
  372. }
  373. int i2d_EC_PUBKEY_bio(BIO *bp, const EC_KEY *ecdsa)
  374. {
  375. return ASN1_i2d_bio_of(EC_KEY, i2d_EC_PUBKEY, bp, ecdsa);
  376. }
  377. EC_KEY *d2i_ECPrivateKey_bio(BIO *bp, EC_KEY **eckey)
  378. {
  379. return ASN1_d2i_bio_of(EC_KEY, EC_KEY_new, d2i_ECPrivateKey, bp, eckey);
  380. }
  381. int i2d_ECPrivateKey_bio(BIO *bp, const EC_KEY *eckey)
  382. {
  383. return ASN1_i2d_bio_of(EC_KEY, i2d_ECPrivateKey, bp, eckey);
  384. }
  385. #endif
  386. int X509_pubkey_digest(const X509 *data, const EVP_MD *type,
  387. unsigned char *md, unsigned int *len)
  388. {
  389. ASN1_BIT_STRING *key = X509_get0_pubkey_bitstr(data);
  390. if (key == NULL)
  391. return 0;
  392. return EVP_Digest(key->data, key->length, md, len, type, NULL);
  393. }
  394. int X509_digest(const X509 *cert, const EVP_MD *md, unsigned char *data,
  395. unsigned int *len)
  396. {
  397. if (EVP_MD_is_a(md, SN_sha1) && (cert->ex_flags & EXFLAG_SET) != 0
  398. && (cert->ex_flags & EXFLAG_NO_FINGERPRINT) == 0) {
  399. /* Asking for SHA1 and we already computed it. */
  400. if (len != NULL)
  401. *len = sizeof(cert->sha1_hash);
  402. memcpy(data, cert->sha1_hash, sizeof(cert->sha1_hash));
  403. return 1;
  404. }
  405. return ossl_asn1_item_digest_ex(ASN1_ITEM_rptr(X509), md, (char *)cert,
  406. data, len, cert->libctx, cert->propq);
  407. }
  408. /* calculate cert digest using the same hash algorithm as in its signature */
  409. ASN1_OCTET_STRING *X509_digest_sig(const X509 *cert,
  410. EVP_MD **md_used, int *md_is_fallback)
  411. {
  412. unsigned int len;
  413. unsigned char hash[EVP_MAX_MD_SIZE];
  414. int mdnid, pknid;
  415. EVP_MD *md = NULL;
  416. const char *md_name;
  417. ASN1_OCTET_STRING *new;
  418. if (md_used != NULL)
  419. *md_used = NULL;
  420. if (md_is_fallback != NULL)
  421. *md_is_fallback = 0;
  422. if (cert == NULL) {
  423. ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
  424. return NULL;
  425. }
  426. if (!OBJ_find_sigid_algs(X509_get_signature_nid(cert), &mdnid, &pknid)) {
  427. ERR_raise(ERR_LIB_X509, X509_R_UNKNOWN_SIGID_ALGS);
  428. return NULL;
  429. }
  430. if (mdnid == NID_undef) {
  431. if (pknid == EVP_PKEY_RSA_PSS) {
  432. RSA_PSS_PARAMS *pss = ossl_rsa_pss_decode(&cert->sig_alg);
  433. const EVP_MD *mgf1md, *mmd = NULL;
  434. int saltlen, trailerfield;
  435. if (pss == NULL
  436. || !ossl_rsa_pss_get_param_unverified(pss, &mmd, &mgf1md,
  437. &saltlen,
  438. &trailerfield)
  439. || mmd == NULL) {
  440. RSA_PSS_PARAMS_free(pss);
  441. ERR_raise(ERR_LIB_X509, X509_R_UNSUPPORTED_ALGORITHM);
  442. return NULL;
  443. }
  444. RSA_PSS_PARAMS_free(pss);
  445. /* Fetch explicitly and do not fallback */
  446. if ((md = EVP_MD_fetch(cert->libctx, EVP_MD_get0_name(mmd),
  447. cert->propq)) == NULL)
  448. /* Error code from fetch is sufficient */
  449. return NULL;
  450. } else if (pknid != NID_undef) {
  451. /* A known algorithm, but without a digest */
  452. switch (pknid) {
  453. case NID_ED25519: /* Follow CMS default given in RFC8419 */
  454. md_name = "SHA512";
  455. break;
  456. case NID_ED448: /* Follow CMS default given in RFC8419 */
  457. md_name = "SHAKE256";
  458. break;
  459. default: /* Fall back to SHA-256 */
  460. md_name = "SHA256";
  461. break;
  462. }
  463. if ((md = EVP_MD_fetch(cert->libctx, md_name,
  464. cert->propq)) == NULL)
  465. return NULL;
  466. if (md_is_fallback != NULL)
  467. *md_is_fallback = 1;
  468. } else {
  469. /* A completely unknown algorithm */
  470. ERR_raise(ERR_LIB_X509, X509_R_UNSUPPORTED_ALGORITHM);
  471. return NULL;
  472. }
  473. } else if ((md = EVP_MD_fetch(cert->libctx, OBJ_nid2sn(mdnid),
  474. cert->propq)) == NULL
  475. && (md = (EVP_MD *)EVP_get_digestbynid(mdnid)) == NULL) {
  476. ERR_raise(ERR_LIB_X509, X509_R_UNSUPPORTED_ALGORITHM);
  477. return NULL;
  478. }
  479. if (!X509_digest(cert, md, hash, &len)
  480. || (new = ASN1_OCTET_STRING_new()) == NULL)
  481. goto err;
  482. if (ASN1_OCTET_STRING_set(new, hash, len)) {
  483. if (md_used != NULL)
  484. *md_used = md;
  485. else
  486. EVP_MD_free(md);
  487. return new;
  488. }
  489. ASN1_OCTET_STRING_free(new);
  490. err:
  491. EVP_MD_free(md);
  492. return NULL;
  493. }
  494. int X509_CRL_digest(const X509_CRL *data, const EVP_MD *type,
  495. unsigned char *md, unsigned int *len)
  496. {
  497. if (type == NULL) {
  498. ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
  499. return 0;
  500. }
  501. if (EVP_MD_is_a(type, SN_sha1)
  502. && (data->flags & EXFLAG_SET) != 0
  503. && (data->flags & EXFLAG_NO_FINGERPRINT) == 0) {
  504. /* Asking for SHA1; always computed in CRL d2i. */
  505. if (len != NULL)
  506. *len = sizeof(data->sha1_hash);
  507. memcpy(md, data->sha1_hash, sizeof(data->sha1_hash));
  508. return 1;
  509. }
  510. return
  511. ossl_asn1_item_digest_ex(ASN1_ITEM_rptr(X509_CRL), type, (char *)data,
  512. md, len, data->libctx, data->propq);
  513. }
  514. int X509_REQ_digest(const X509_REQ *data, const EVP_MD *type,
  515. unsigned char *md, unsigned int *len)
  516. {
  517. return
  518. ossl_asn1_item_digest_ex(ASN1_ITEM_rptr(X509_REQ), type, (char *)data,
  519. md, len, data->libctx, data->propq);
  520. }
  521. int X509_NAME_digest(const X509_NAME *data, const EVP_MD *type,
  522. unsigned char *md, unsigned int *len)
  523. {
  524. return ASN1_item_digest(ASN1_ITEM_rptr(X509_NAME), type, (char *)data,
  525. md, len);
  526. }
  527. int PKCS7_ISSUER_AND_SERIAL_digest(PKCS7_ISSUER_AND_SERIAL *data,
  528. const EVP_MD *type, unsigned char *md,
  529. unsigned int *len)
  530. {
  531. return ASN1_item_digest(ASN1_ITEM_rptr(PKCS7_ISSUER_AND_SERIAL), type,
  532. (char *)data, md, len);
  533. }
  534. #ifndef OPENSSL_NO_STDIO
  535. X509_SIG *d2i_PKCS8_fp(FILE *fp, X509_SIG **p8)
  536. {
  537. return ASN1_d2i_fp_of(X509_SIG, X509_SIG_new, d2i_X509_SIG, fp, p8);
  538. }
  539. int i2d_PKCS8_fp(FILE *fp, const X509_SIG *p8)
  540. {
  541. return ASN1_i2d_fp_of(X509_SIG, i2d_X509_SIG, fp, p8);
  542. }
  543. #endif
  544. X509_SIG *d2i_PKCS8_bio(BIO *bp, X509_SIG **p8)
  545. {
  546. return ASN1_d2i_bio_of(X509_SIG, X509_SIG_new, d2i_X509_SIG, bp, p8);
  547. }
  548. int i2d_PKCS8_bio(BIO *bp, const X509_SIG *p8)
  549. {
  550. return ASN1_i2d_bio_of(X509_SIG, i2d_X509_SIG, bp, p8);
  551. }
  552. #ifndef OPENSSL_NO_STDIO
  553. X509_PUBKEY *d2i_X509_PUBKEY_fp(FILE *fp, X509_PUBKEY **xpk)
  554. {
  555. return ASN1_d2i_fp_of(X509_PUBKEY, X509_PUBKEY_new, d2i_X509_PUBKEY,
  556. fp, xpk);
  557. }
  558. int i2d_X509_PUBKEY_fp(FILE *fp, const X509_PUBKEY *xpk)
  559. {
  560. return ASN1_i2d_fp_of(X509_PUBKEY, i2d_X509_PUBKEY, fp, xpk);
  561. }
  562. #endif
  563. X509_PUBKEY *d2i_X509_PUBKEY_bio(BIO *bp, X509_PUBKEY **xpk)
  564. {
  565. return ASN1_d2i_bio_of(X509_PUBKEY, X509_PUBKEY_new, d2i_X509_PUBKEY,
  566. bp, xpk);
  567. }
  568. int i2d_X509_PUBKEY_bio(BIO *bp, const X509_PUBKEY *xpk)
  569. {
  570. return ASN1_i2d_bio_of(X509_PUBKEY, i2d_X509_PUBKEY, bp, xpk);
  571. }
  572. #ifndef OPENSSL_NO_STDIO
  573. PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO_fp(FILE *fp,
  574. PKCS8_PRIV_KEY_INFO **p8inf)
  575. {
  576. return ASN1_d2i_fp_of(PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_new,
  577. d2i_PKCS8_PRIV_KEY_INFO, fp, p8inf);
  578. }
  579. int i2d_PKCS8_PRIV_KEY_INFO_fp(FILE *fp, const PKCS8_PRIV_KEY_INFO *p8inf)
  580. {
  581. return ASN1_i2d_fp_of(PKCS8_PRIV_KEY_INFO, i2d_PKCS8_PRIV_KEY_INFO, fp,
  582. p8inf);
  583. }
  584. int i2d_PKCS8PrivateKeyInfo_fp(FILE *fp, const EVP_PKEY *key)
  585. {
  586. PKCS8_PRIV_KEY_INFO *p8inf;
  587. int ret;
  588. p8inf = EVP_PKEY2PKCS8(key);
  589. if (p8inf == NULL)
  590. return 0;
  591. ret = i2d_PKCS8_PRIV_KEY_INFO_fp(fp, p8inf);
  592. PKCS8_PRIV_KEY_INFO_free(p8inf);
  593. return ret;
  594. }
  595. int i2d_PrivateKey_fp(FILE *fp, const EVP_PKEY *pkey)
  596. {
  597. return ASN1_i2d_fp_of(EVP_PKEY, i2d_PrivateKey, fp, pkey);
  598. }
  599. EVP_PKEY *d2i_PrivateKey_fp(FILE *fp, EVP_PKEY **a)
  600. {
  601. return ASN1_d2i_fp_of(EVP_PKEY, EVP_PKEY_new, d2i_AutoPrivateKey, fp, a);
  602. }
  603. EVP_PKEY *d2i_PrivateKey_ex_fp(FILE *fp, EVP_PKEY **a, OSSL_LIB_CTX *libctx,
  604. const char *propq)
  605. {
  606. BIO *b;
  607. void *ret;
  608. if ((b = BIO_new(BIO_s_file())) == NULL) {
  609. ERR_raise(ERR_LIB_X509, ERR_R_BUF_LIB);
  610. return NULL;
  611. }
  612. BIO_set_fp(b, fp, BIO_NOCLOSE);
  613. ret = d2i_PrivateKey_ex_bio(b, a, libctx, propq);
  614. BIO_free(b);
  615. return ret;
  616. }
  617. int i2d_PUBKEY_fp(FILE *fp, const EVP_PKEY *pkey)
  618. {
  619. return ASN1_i2d_fp_of(EVP_PKEY, i2d_PUBKEY, fp, pkey);
  620. }
  621. EVP_PKEY *d2i_PUBKEY_ex_fp(FILE *fp, EVP_PKEY **a, OSSL_LIB_CTX *libctx,
  622. const char *propq)
  623. {
  624. BIO *b;
  625. void *ret;
  626. if ((b = BIO_new(BIO_s_file())) == NULL) {
  627. ERR_raise(ERR_LIB_X509, ERR_R_BUF_LIB);
  628. return NULL;
  629. }
  630. BIO_set_fp(b, fp, BIO_NOCLOSE);
  631. ret = d2i_PUBKEY_ex_bio(b, a, libctx, propq);
  632. BIO_free(b);
  633. return ret;
  634. }
  635. EVP_PKEY *d2i_PUBKEY_fp(FILE *fp, EVP_PKEY **a)
  636. {
  637. return ASN1_d2i_fp_of(EVP_PKEY, EVP_PKEY_new, d2i_PUBKEY, fp, a);
  638. }
  639. #endif
  640. PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO_bio(BIO *bp,
  641. PKCS8_PRIV_KEY_INFO **p8inf)
  642. {
  643. return ASN1_d2i_bio_of(PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_new,
  644. d2i_PKCS8_PRIV_KEY_INFO, bp, p8inf);
  645. }
  646. int i2d_PKCS8_PRIV_KEY_INFO_bio(BIO *bp, const PKCS8_PRIV_KEY_INFO *p8inf)
  647. {
  648. return ASN1_i2d_bio_of(PKCS8_PRIV_KEY_INFO, i2d_PKCS8_PRIV_KEY_INFO, bp,
  649. p8inf);
  650. }
  651. int i2d_PKCS8PrivateKeyInfo_bio(BIO *bp, const EVP_PKEY *key)
  652. {
  653. PKCS8_PRIV_KEY_INFO *p8inf;
  654. int ret;
  655. p8inf = EVP_PKEY2PKCS8(key);
  656. if (p8inf == NULL)
  657. return 0;
  658. ret = i2d_PKCS8_PRIV_KEY_INFO_bio(bp, p8inf);
  659. PKCS8_PRIV_KEY_INFO_free(p8inf);
  660. return ret;
  661. }
  662. int i2d_PrivateKey_bio(BIO *bp, const EVP_PKEY *pkey)
  663. {
  664. return ASN1_i2d_bio_of(EVP_PKEY, i2d_PrivateKey, bp, pkey);
  665. }
  666. EVP_PKEY *d2i_PrivateKey_bio(BIO *bp, EVP_PKEY **a)
  667. {
  668. return ASN1_d2i_bio_of(EVP_PKEY, EVP_PKEY_new, d2i_AutoPrivateKey, bp, a);
  669. }
  670. EVP_PKEY *d2i_PrivateKey_ex_bio(BIO *bp, EVP_PKEY **a, OSSL_LIB_CTX *libctx,
  671. const char *propq)
  672. {
  673. BUF_MEM *b = NULL;
  674. const unsigned char *p;
  675. void *ret = NULL;
  676. int len;
  677. len = asn1_d2i_read_bio(bp, &b);
  678. if (len < 0)
  679. goto err;
  680. p = (unsigned char *)b->data;
  681. ret = d2i_AutoPrivateKey_ex(a, &p, len, libctx, propq);
  682. err:
  683. BUF_MEM_free(b);
  684. return ret;
  685. }
  686. int i2d_PUBKEY_bio(BIO *bp, const EVP_PKEY *pkey)
  687. {
  688. return ASN1_i2d_bio_of(EVP_PKEY, i2d_PUBKEY, bp, pkey);
  689. }
  690. EVP_PKEY *d2i_PUBKEY_ex_bio(BIO *bp, EVP_PKEY **a, OSSL_LIB_CTX *libctx,
  691. const char *propq)
  692. {
  693. BUF_MEM *b = NULL;
  694. const unsigned char *p;
  695. void *ret = NULL;
  696. int len;
  697. len = asn1_d2i_read_bio(bp, &b);
  698. if (len < 0)
  699. goto err;
  700. p = (unsigned char *)b->data;
  701. ret = d2i_PUBKEY_ex(a, &p, len, libctx, propq);
  702. err:
  703. BUF_MEM_free(b);
  704. return ret;
  705. }
  706. EVP_PKEY *d2i_PUBKEY_bio(BIO *bp, EVP_PKEY **a)
  707. {
  708. return ASN1_d2i_bio_of(EVP_PKEY, EVP_PKEY_new, d2i_PUBKEY, bp, a);
  709. }