2
0

ssl_rsa.c 18 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779
  1. /* ssl/ssl_rsa.c */
  2. /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  3. * All rights reserved.
  4. *
  5. * This package is an SSL implementation written
  6. * by Eric Young (eay@cryptsoft.com).
  7. * The implementation was written so as to conform with Netscapes SSL.
  8. *
  9. * This library is free for commercial and non-commercial use as long as
  10. * the following conditions are aheared to. The following conditions
  11. * apply to all code found in this distribution, be it the RC4, RSA,
  12. * lhash, DES, etc., code; not just the SSL code. The SSL documentation
  13. * included with this distribution is covered by the same copyright terms
  14. * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15. *
  16. * Copyright remains Eric Young's, and as such any Copyright notices in
  17. * the code are not to be removed.
  18. * If this package is used in a product, Eric Young should be given attribution
  19. * as the author of the parts of the library used.
  20. * This can be in the form of a textual message at program startup or
  21. * in documentation (online or textual) provided with the package.
  22. *
  23. * Redistribution and use in source and binary forms, with or without
  24. * modification, are permitted provided that the following conditions
  25. * are met:
  26. * 1. Redistributions of source code must retain the copyright
  27. * notice, this list of conditions and the following disclaimer.
  28. * 2. Redistributions in binary form must reproduce the above copyright
  29. * notice, this list of conditions and the following disclaimer in the
  30. * documentation and/or other materials provided with the distribution.
  31. * 3. All advertising materials mentioning features or use of this software
  32. * must display the following acknowledgement:
  33. * "This product includes cryptographic software written by
  34. * Eric Young (eay@cryptsoft.com)"
  35. * The word 'cryptographic' can be left out if the rouines from the library
  36. * being used are not cryptographic related :-).
  37. * 4. If you include any Windows specific code (or a derivative thereof) from
  38. * the apps directory (application code) you must include an acknowledgement:
  39. * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40. *
  41. * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42. * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44. * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45. * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46. * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47. * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49. * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50. * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51. * SUCH DAMAGE.
  52. *
  53. * The licence and distribution terms for any publically available version or
  54. * derivative of this code cannot be changed. i.e. this code cannot simply be
  55. * copied and put under another distribution licence
  56. * [including the GNU Public Licence.]
  57. */
  58. #include <stdio.h>
  59. #include "ssl_locl.h"
  60. #include <openssl/bio.h>
  61. #include <openssl/objects.h>
  62. #include <openssl/evp.h>
  63. #include <openssl/x509.h>
  64. #include <openssl/pem.h>
  65. static int ssl_set_cert(CERT *c, X509 *x509);
  66. static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey);
  67. int SSL_use_certificate(SSL *ssl, X509 *x)
  68. {
  69. if (x == NULL)
  70. {
  71. SSLerr(SSL_F_SSL_USE_CERTIFICATE,ERR_R_PASSED_NULL_PARAMETER);
  72. return(0);
  73. }
  74. if (!ssl_cert_inst(&ssl->cert))
  75. {
  76. SSLerr(SSL_F_SSL_USE_CERTIFICATE,ERR_R_MALLOC_FAILURE);
  77. return(0);
  78. }
  79. return(ssl_set_cert(ssl->cert,x));
  80. }
  81. #ifndef OPENSSL_NO_STDIO
  82. int SSL_use_certificate_file(SSL *ssl, const char *file, int type)
  83. {
  84. int j;
  85. BIO *in;
  86. int ret=0;
  87. X509 *x=NULL;
  88. in=BIO_new(BIO_s_file_internal());
  89. if (in == NULL)
  90. {
  91. SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE,ERR_R_BUF_LIB);
  92. goto end;
  93. }
  94. if (BIO_read_filename(in,file) <= 0)
  95. {
  96. SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE,ERR_R_SYS_LIB);
  97. goto end;
  98. }
  99. if (type == SSL_FILETYPE_ASN1)
  100. {
  101. j=ERR_R_ASN1_LIB;
  102. x=d2i_X509_bio(in,NULL);
  103. }
  104. else if (type == SSL_FILETYPE_PEM)
  105. {
  106. j=ERR_R_PEM_LIB;
  107. x=PEM_read_bio_X509(in,NULL,ssl->ctx->default_passwd_callback,ssl->ctx->default_passwd_callback_userdata);
  108. }
  109. else
  110. {
  111. SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE,SSL_R_BAD_SSL_FILETYPE);
  112. goto end;
  113. }
  114. if (x == NULL)
  115. {
  116. SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE,j);
  117. goto end;
  118. }
  119. ret=SSL_use_certificate(ssl,x);
  120. end:
  121. if (x != NULL) X509_free(x);
  122. if (in != NULL) BIO_free(in);
  123. return(ret);
  124. }
  125. #endif
  126. int SSL_use_certificate_ASN1(SSL *ssl, const unsigned char *d, int len)
  127. {
  128. X509 *x;
  129. int ret;
  130. x=d2i_X509(NULL,&d,(long)len);
  131. if (x == NULL)
  132. {
  133. SSLerr(SSL_F_SSL_USE_CERTIFICATE_ASN1,ERR_R_ASN1_LIB);
  134. return(0);
  135. }
  136. ret=SSL_use_certificate(ssl,x);
  137. X509_free(x);
  138. return(ret);
  139. }
  140. #ifndef OPENSSL_NO_RSA
  141. int SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa)
  142. {
  143. EVP_PKEY *pkey;
  144. int ret;
  145. if (rsa == NULL)
  146. {
  147. SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY,ERR_R_PASSED_NULL_PARAMETER);
  148. return(0);
  149. }
  150. if (!ssl_cert_inst(&ssl->cert))
  151. {
  152. SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY,ERR_R_MALLOC_FAILURE);
  153. return(0);
  154. }
  155. if ((pkey=EVP_PKEY_new()) == NULL)
  156. {
  157. SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY,ERR_R_EVP_LIB);
  158. return(0);
  159. }
  160. RSA_up_ref(rsa);
  161. EVP_PKEY_assign_RSA(pkey,rsa);
  162. ret=ssl_set_pkey(ssl->cert,pkey);
  163. EVP_PKEY_free(pkey);
  164. return(ret);
  165. }
  166. #endif
  167. static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
  168. {
  169. int i;
  170. i=ssl_cert_type(NULL,pkey);
  171. if (i < 0)
  172. {
  173. SSLerr(SSL_F_SSL_SET_PKEY,SSL_R_UNKNOWN_CERTIFICATE_TYPE);
  174. return(0);
  175. }
  176. if (c->pkeys[i].x509 != NULL)
  177. {
  178. EVP_PKEY *pktmp;
  179. pktmp = X509_get_pubkey(c->pkeys[i].x509);
  180. EVP_PKEY_copy_parameters(pktmp,pkey);
  181. EVP_PKEY_free(pktmp);
  182. ERR_clear_error();
  183. #ifndef OPENSSL_NO_RSA
  184. /* Don't check the public/private key, this is mostly
  185. * for smart cards. */
  186. if ((pkey->type == EVP_PKEY_RSA) &&
  187. (RSA_flags(pkey->pkey.rsa) & RSA_METHOD_FLAG_NO_CHECK))
  188. ;
  189. else
  190. #endif
  191. if (!X509_check_private_key(c->pkeys[i].x509,pkey))
  192. {
  193. X509_free(c->pkeys[i].x509);
  194. c->pkeys[i].x509 = NULL;
  195. return 0;
  196. }
  197. }
  198. if (c->pkeys[i].privatekey != NULL)
  199. EVP_PKEY_free(c->pkeys[i].privatekey);
  200. CRYPTO_add(&pkey->references,1,CRYPTO_LOCK_EVP_PKEY);
  201. c->pkeys[i].privatekey=pkey;
  202. c->key= &(c->pkeys[i]);
  203. c->valid=0;
  204. return(1);
  205. }
  206. #ifndef OPENSSL_NO_RSA
  207. #ifndef OPENSSL_NO_STDIO
  208. int SSL_use_RSAPrivateKey_file(SSL *ssl, const char *file, int type)
  209. {
  210. int j,ret=0;
  211. BIO *in;
  212. RSA *rsa=NULL;
  213. in=BIO_new(BIO_s_file_internal());
  214. if (in == NULL)
  215. {
  216. SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,ERR_R_BUF_LIB);
  217. goto end;
  218. }
  219. if (BIO_read_filename(in,file) <= 0)
  220. {
  221. SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,ERR_R_SYS_LIB);
  222. goto end;
  223. }
  224. if (type == SSL_FILETYPE_ASN1)
  225. {
  226. j=ERR_R_ASN1_LIB;
  227. rsa=d2i_RSAPrivateKey_bio(in,NULL);
  228. }
  229. else if (type == SSL_FILETYPE_PEM)
  230. {
  231. j=ERR_R_PEM_LIB;
  232. rsa=PEM_read_bio_RSAPrivateKey(in,NULL,
  233. ssl->ctx->default_passwd_callback,ssl->ctx->default_passwd_callback_userdata);
  234. }
  235. else
  236. {
  237. SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE);
  238. goto end;
  239. }
  240. if (rsa == NULL)
  241. {
  242. SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,j);
  243. goto end;
  244. }
  245. ret=SSL_use_RSAPrivateKey(ssl,rsa);
  246. RSA_free(rsa);
  247. end:
  248. if (in != NULL) BIO_free(in);
  249. return(ret);
  250. }
  251. #endif
  252. int SSL_use_RSAPrivateKey_ASN1(SSL *ssl, unsigned char *d, long len)
  253. {
  254. int ret;
  255. const unsigned char *p;
  256. RSA *rsa;
  257. p=d;
  258. if ((rsa=d2i_RSAPrivateKey(NULL,&p,(long)len)) == NULL)
  259. {
  260. SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1,ERR_R_ASN1_LIB);
  261. return(0);
  262. }
  263. ret=SSL_use_RSAPrivateKey(ssl,rsa);
  264. RSA_free(rsa);
  265. return(ret);
  266. }
  267. #endif /* !OPENSSL_NO_RSA */
  268. int SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey)
  269. {
  270. int ret;
  271. if (pkey == NULL)
  272. {
  273. SSLerr(SSL_F_SSL_USE_PRIVATEKEY,ERR_R_PASSED_NULL_PARAMETER);
  274. return(0);
  275. }
  276. if (!ssl_cert_inst(&ssl->cert))
  277. {
  278. SSLerr(SSL_F_SSL_USE_PRIVATEKEY,ERR_R_MALLOC_FAILURE);
  279. return(0);
  280. }
  281. ret=ssl_set_pkey(ssl->cert,pkey);
  282. return(ret);
  283. }
  284. #ifndef OPENSSL_NO_STDIO
  285. int SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type)
  286. {
  287. int j,ret=0;
  288. BIO *in;
  289. EVP_PKEY *pkey=NULL;
  290. in=BIO_new(BIO_s_file_internal());
  291. if (in == NULL)
  292. {
  293. SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,ERR_R_BUF_LIB);
  294. goto end;
  295. }
  296. if (BIO_read_filename(in,file) <= 0)
  297. {
  298. SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,ERR_R_SYS_LIB);
  299. goto end;
  300. }
  301. if (type == SSL_FILETYPE_PEM)
  302. {
  303. j=ERR_R_PEM_LIB;
  304. pkey=PEM_read_bio_PrivateKey(in,NULL,
  305. ssl->ctx->default_passwd_callback,ssl->ctx->default_passwd_callback_userdata);
  306. }
  307. else if (type == SSL_FILETYPE_ASN1)
  308. {
  309. j = ERR_R_ASN1_LIB;
  310. pkey = d2i_PrivateKey_bio(in,NULL);
  311. }
  312. else
  313. {
  314. SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE);
  315. goto end;
  316. }
  317. if (pkey == NULL)
  318. {
  319. SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,j);
  320. goto end;
  321. }
  322. ret=SSL_use_PrivateKey(ssl,pkey);
  323. EVP_PKEY_free(pkey);
  324. end:
  325. if (in != NULL) BIO_free(in);
  326. return(ret);
  327. }
  328. #endif
  329. int SSL_use_PrivateKey_ASN1(int type, SSL *ssl, const unsigned char *d, long len)
  330. {
  331. int ret;
  332. const unsigned char *p;
  333. EVP_PKEY *pkey;
  334. p=d;
  335. if ((pkey=d2i_PrivateKey(type,NULL,&p,(long)len)) == NULL)
  336. {
  337. SSLerr(SSL_F_SSL_USE_PRIVATEKEY_ASN1,ERR_R_ASN1_LIB);
  338. return(0);
  339. }
  340. ret=SSL_use_PrivateKey(ssl,pkey);
  341. EVP_PKEY_free(pkey);
  342. return(ret);
  343. }
  344. int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x)
  345. {
  346. if (x == NULL)
  347. {
  348. SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE,ERR_R_PASSED_NULL_PARAMETER);
  349. return(0);
  350. }
  351. if (!ssl_cert_inst(&ctx->cert))
  352. {
  353. SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE,ERR_R_MALLOC_FAILURE);
  354. return(0);
  355. }
  356. return(ssl_set_cert(ctx->cert, x));
  357. }
  358. static int ssl_set_cert(CERT *c, X509 *x)
  359. {
  360. EVP_PKEY *pkey;
  361. int i;
  362. pkey=X509_get_pubkey(x);
  363. if (pkey == NULL)
  364. {
  365. SSLerr(SSL_F_SSL_SET_CERT,SSL_R_X509_LIB);
  366. return(0);
  367. }
  368. i=ssl_cert_type(x,pkey);
  369. if (i < 0)
  370. {
  371. SSLerr(SSL_F_SSL_SET_CERT,SSL_R_UNKNOWN_CERTIFICATE_TYPE);
  372. EVP_PKEY_free(pkey);
  373. return(0);
  374. }
  375. if (c->pkeys[i].privatekey != NULL)
  376. {
  377. EVP_PKEY_copy_parameters(pkey,c->pkeys[i].privatekey);
  378. ERR_clear_error();
  379. #ifndef OPENSSL_NO_RSA
  380. /* Don't check the public/private key, this is mostly
  381. * for smart cards. */
  382. if ((c->pkeys[i].privatekey->type == EVP_PKEY_RSA) &&
  383. (RSA_flags(c->pkeys[i].privatekey->pkey.rsa) &
  384. RSA_METHOD_FLAG_NO_CHECK))
  385. ;
  386. else
  387. #endif /* OPENSSL_NO_RSA */
  388. if (!X509_check_private_key(x,c->pkeys[i].privatekey))
  389. {
  390. /* don't fail for a cert/key mismatch, just free
  391. * current private key (when switching to a different
  392. * cert & key, first this function should be used,
  393. * then ssl_set_pkey */
  394. EVP_PKEY_free(c->pkeys[i].privatekey);
  395. c->pkeys[i].privatekey=NULL;
  396. /* clear error queue */
  397. ERR_clear_error();
  398. }
  399. }
  400. EVP_PKEY_free(pkey);
  401. if (c->pkeys[i].x509 != NULL)
  402. X509_free(c->pkeys[i].x509);
  403. CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
  404. c->pkeys[i].x509=x;
  405. c->key= &(c->pkeys[i]);
  406. c->valid=0;
  407. return(1);
  408. }
  409. #ifndef OPENSSL_NO_STDIO
  410. int SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type)
  411. {
  412. int j;
  413. BIO *in;
  414. int ret=0;
  415. X509 *x=NULL;
  416. in=BIO_new(BIO_s_file_internal());
  417. if (in == NULL)
  418. {
  419. SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,ERR_R_BUF_LIB);
  420. goto end;
  421. }
  422. if (BIO_read_filename(in,file) <= 0)
  423. {
  424. SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,ERR_R_SYS_LIB);
  425. goto end;
  426. }
  427. if (type == SSL_FILETYPE_ASN1)
  428. {
  429. j=ERR_R_ASN1_LIB;
  430. x=d2i_X509_bio(in,NULL);
  431. }
  432. else if (type == SSL_FILETYPE_PEM)
  433. {
  434. j=ERR_R_PEM_LIB;
  435. x=PEM_read_bio_X509(in,NULL,ctx->default_passwd_callback,ctx->default_passwd_callback_userdata);
  436. }
  437. else
  438. {
  439. SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,SSL_R_BAD_SSL_FILETYPE);
  440. goto end;
  441. }
  442. if (x == NULL)
  443. {
  444. SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,j);
  445. goto end;
  446. }
  447. ret=SSL_CTX_use_certificate(ctx,x);
  448. end:
  449. if (x != NULL) X509_free(x);
  450. if (in != NULL) BIO_free(in);
  451. return(ret);
  452. }
  453. #endif
  454. int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, const unsigned char *d)
  455. {
  456. X509 *x;
  457. int ret;
  458. x=d2i_X509(NULL,&d,(long)len);
  459. if (x == NULL)
  460. {
  461. SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1,ERR_R_ASN1_LIB);
  462. return(0);
  463. }
  464. ret=SSL_CTX_use_certificate(ctx,x);
  465. X509_free(x);
  466. return(ret);
  467. }
  468. #ifndef OPENSSL_NO_RSA
  469. int SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa)
  470. {
  471. int ret;
  472. EVP_PKEY *pkey;
  473. if (rsa == NULL)
  474. {
  475. SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY,ERR_R_PASSED_NULL_PARAMETER);
  476. return(0);
  477. }
  478. if (!ssl_cert_inst(&ctx->cert))
  479. {
  480. SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY,ERR_R_MALLOC_FAILURE);
  481. return(0);
  482. }
  483. if ((pkey=EVP_PKEY_new()) == NULL)
  484. {
  485. SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY,ERR_R_EVP_LIB);
  486. return(0);
  487. }
  488. RSA_up_ref(rsa);
  489. EVP_PKEY_assign_RSA(pkey,rsa);
  490. ret=ssl_set_pkey(ctx->cert, pkey);
  491. EVP_PKEY_free(pkey);
  492. return(ret);
  493. }
  494. #ifndef OPENSSL_NO_STDIO
  495. int SSL_CTX_use_RSAPrivateKey_file(SSL_CTX *ctx, const char *file, int type)
  496. {
  497. int j,ret=0;
  498. BIO *in;
  499. RSA *rsa=NULL;
  500. in=BIO_new(BIO_s_file_internal());
  501. if (in == NULL)
  502. {
  503. SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,ERR_R_BUF_LIB);
  504. goto end;
  505. }
  506. if (BIO_read_filename(in,file) <= 0)
  507. {
  508. SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,ERR_R_SYS_LIB);
  509. goto end;
  510. }
  511. if (type == SSL_FILETYPE_ASN1)
  512. {
  513. j=ERR_R_ASN1_LIB;
  514. rsa=d2i_RSAPrivateKey_bio(in,NULL);
  515. }
  516. else if (type == SSL_FILETYPE_PEM)
  517. {
  518. j=ERR_R_PEM_LIB;
  519. rsa=PEM_read_bio_RSAPrivateKey(in,NULL,
  520. ctx->default_passwd_callback,ctx->default_passwd_callback_userdata);
  521. }
  522. else
  523. {
  524. SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE);
  525. goto end;
  526. }
  527. if (rsa == NULL)
  528. {
  529. SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,j);
  530. goto end;
  531. }
  532. ret=SSL_CTX_use_RSAPrivateKey(ctx,rsa);
  533. RSA_free(rsa);
  534. end:
  535. if (in != NULL) BIO_free(in);
  536. return(ret);
  537. }
  538. #endif
  539. int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, const unsigned char *d, long len)
  540. {
  541. int ret;
  542. const unsigned char *p;
  543. RSA *rsa;
  544. p=d;
  545. if ((rsa=d2i_RSAPrivateKey(NULL,&p,(long)len)) == NULL)
  546. {
  547. SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1,ERR_R_ASN1_LIB);
  548. return(0);
  549. }
  550. ret=SSL_CTX_use_RSAPrivateKey(ctx,rsa);
  551. RSA_free(rsa);
  552. return(ret);
  553. }
  554. #endif /* !OPENSSL_NO_RSA */
  555. int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey)
  556. {
  557. if (pkey == NULL)
  558. {
  559. SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY,ERR_R_PASSED_NULL_PARAMETER);
  560. return(0);
  561. }
  562. if (!ssl_cert_inst(&ctx->cert))
  563. {
  564. SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY,ERR_R_MALLOC_FAILURE);
  565. return(0);
  566. }
  567. return(ssl_set_pkey(ctx->cert,pkey));
  568. }
  569. #ifndef OPENSSL_NO_STDIO
  570. int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type)
  571. {
  572. int j,ret=0;
  573. BIO *in;
  574. EVP_PKEY *pkey=NULL;
  575. in=BIO_new(BIO_s_file_internal());
  576. if (in == NULL)
  577. {
  578. SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,ERR_R_BUF_LIB);
  579. goto end;
  580. }
  581. if (BIO_read_filename(in,file) <= 0)
  582. {
  583. SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,ERR_R_SYS_LIB);
  584. goto end;
  585. }
  586. if (type == SSL_FILETYPE_PEM)
  587. {
  588. j=ERR_R_PEM_LIB;
  589. pkey=PEM_read_bio_PrivateKey(in,NULL,
  590. ctx->default_passwd_callback,ctx->default_passwd_callback_userdata);
  591. }
  592. else if (type == SSL_FILETYPE_ASN1)
  593. {
  594. j = ERR_R_ASN1_LIB;
  595. pkey = d2i_PrivateKey_bio(in,NULL);
  596. }
  597. else
  598. {
  599. SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE);
  600. goto end;
  601. }
  602. if (pkey == NULL)
  603. {
  604. SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,j);
  605. goto end;
  606. }
  607. ret=SSL_CTX_use_PrivateKey(ctx,pkey);
  608. EVP_PKEY_free(pkey);
  609. end:
  610. if (in != NULL) BIO_free(in);
  611. return(ret);
  612. }
  613. #endif
  614. int SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx, const unsigned char *d,
  615. long len)
  616. {
  617. int ret;
  618. const unsigned char *p;
  619. EVP_PKEY *pkey;
  620. p=d;
  621. if ((pkey=d2i_PrivateKey(type,NULL,&p,(long)len)) == NULL)
  622. {
  623. SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1,ERR_R_ASN1_LIB);
  624. return(0);
  625. }
  626. ret=SSL_CTX_use_PrivateKey(ctx,pkey);
  627. EVP_PKEY_free(pkey);
  628. return(ret);
  629. }
  630. #ifndef OPENSSL_NO_STDIO
  631. /* Read a file that contains our certificate in "PEM" format,
  632. * possibly followed by a sequence of CA certificates that should be
  633. * sent to the peer in the Certificate message.
  634. */
  635. int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file)
  636. {
  637. BIO *in;
  638. int ret=0;
  639. X509 *x=NULL;
  640. ERR_clear_error(); /* clear error stack for SSL_CTX_use_certificate() */
  641. in=BIO_new(BIO_s_file_internal());
  642. if (in == NULL)
  643. {
  644. SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE,ERR_R_BUF_LIB);
  645. goto end;
  646. }
  647. if (BIO_read_filename(in,file) <= 0)
  648. {
  649. SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE,ERR_R_SYS_LIB);
  650. goto end;
  651. }
  652. x=PEM_read_bio_X509_AUX(in,NULL,ctx->default_passwd_callback,ctx->default_passwd_callback_userdata);
  653. if (x == NULL)
  654. {
  655. SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE,ERR_R_PEM_LIB);
  656. goto end;
  657. }
  658. ret=SSL_CTX_use_certificate(ctx,x);
  659. if (ERR_peek_error() != 0)
  660. ret = 0; /* Key/certificate mismatch doesn't imply ret==0 ... */
  661. if (ret)
  662. {
  663. /* If we could set up our certificate, now proceed to
  664. * the CA certificates.
  665. */
  666. X509 *ca;
  667. int r;
  668. unsigned long err;
  669. if (ctx->extra_certs != NULL)
  670. {
  671. sk_X509_pop_free(ctx->extra_certs, X509_free);
  672. ctx->extra_certs = NULL;
  673. }
  674. while ((ca = PEM_read_bio_X509(in,NULL,ctx->default_passwd_callback,ctx->default_passwd_callback_userdata))
  675. != NULL)
  676. {
  677. r = SSL_CTX_add_extra_chain_cert(ctx, ca);
  678. if (!r)
  679. {
  680. X509_free(ca);
  681. ret = 0;
  682. goto end;
  683. }
  684. /* Note that we must not free r if it was successfully
  685. * added to the chain (while we must free the main
  686. * certificate, since its reference count is increased
  687. * by SSL_CTX_use_certificate). */
  688. }
  689. /* When the while loop ends, it's usually just EOF. */
  690. err = ERR_peek_last_error();
  691. if (ERR_GET_LIB(err) == ERR_LIB_PEM && ERR_GET_REASON(err) == PEM_R_NO_START_LINE)
  692. ERR_clear_error();
  693. else
  694. ret = 0; /* some real error */
  695. }
  696. end:
  697. if (x != NULL) X509_free(x);
  698. if (in != NULL) BIO_free(in);
  699. return(ret);
  700. }
  701. #endif