123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220 |
- /*
- * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License"). You may not use
- * this file except in compliance with the License. You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
- /*
- * RSA low level APIs are deprecated for public use, but still ok for
- * internal use.
- */
- #include "internal/deprecated.h"
- #include <string.h>
- #include <openssl/core_dispatch.h>
- #include <openssl/core_names.h>
- #include <openssl/core_object.h>
- #include <openssl/crypto.h>
- #include <openssl/err.h>
- #include <openssl/params.h>
- #include <openssl/pem.h>
- #include <openssl/proverr.h>
- #include "internal/nelem.h"
- #include "prov/bio.h"
- #include "prov/implementations.h"
- #include "endecoder_local.h"
- static int read_pem(PROV_CTX *provctx, OSSL_CORE_BIO *cin,
- char **pem_name, char **pem_header,
- unsigned char **data, long *len)
- {
- BIO *in = ossl_bio_new_from_core_bio(provctx, cin);
- int ok;
- if (in == NULL)
- return 0;
- ok = (PEM_read_bio(in, pem_name, pem_header, data, len) > 0);
- BIO_free(in);
- return ok;
- }
- static OSSL_FUNC_decoder_newctx_fn pem2der_newctx;
- static OSSL_FUNC_decoder_freectx_fn pem2der_freectx;
- static OSSL_FUNC_decoder_decode_fn pem2der_decode;
- /*
- * Context used for PEM to DER decoding.
- */
- struct pem2der_ctx_st {
- PROV_CTX *provctx;
- };
- static void *pem2der_newctx(void *provctx)
- {
- struct pem2der_ctx_st *ctx = OPENSSL_zalloc(sizeof(*ctx));
- if (ctx != NULL)
- ctx->provctx = provctx;
- return ctx;
- }
- static void pem2der_freectx(void *vctx)
- {
- struct pem2der_ctx_st *ctx = vctx;
- OPENSSL_free(ctx);
- }
- /* pem_password_cb compatible function */
- struct pem2der_pass_data_st {
- OSSL_PASSPHRASE_CALLBACK *cb;
- void *cbarg;
- };
- static int pem2der_pass_helper(char *buf, int num, int w, void *data)
- {
- struct pem2der_pass_data_st *pass_data = data;
- size_t plen;
- if (pass_data == NULL
- || pass_data->cb == NULL
- || !pass_data->cb(buf, num, &plen, NULL, pass_data->cbarg))
- return -1;
- return (int)plen;
- }
- /*
- * The selection parameter in pem2der_decode() is not used by this function
- * because it's not relevant just to decode PEM to DER.
- */
- static int pem2der_decode(void *vctx, OSSL_CORE_BIO *cin, int selection,
- OSSL_CALLBACK *data_cb, void *data_cbarg,
- OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg)
- {
- /*
- * PEM names we recognise. Other PEM names should be recognised by
- * other decoder implementations.
- */
- static struct pem_name_map_st {
- const char *pem_name;
- int object_type;
- const char *data_type;
- const char *data_structure;
- } pem_name_map[] = {
- /* PKCS#8 and SubjectPublicKeyInfo */
- { PEM_STRING_PKCS8, OSSL_OBJECT_PKEY, NULL, "EncryptedPrivateKeyInfo" },
- { PEM_STRING_PKCS8INF, OSSL_OBJECT_PKEY, NULL, "PrivateKeyInfo" },
- { PEM_STRING_PUBLIC, OSSL_OBJECT_PKEY, NULL, "SubjectPublicKeyInfo" },
- /* Our set of type specific PEM types */
- { PEM_STRING_DHPARAMS, OSSL_OBJECT_PKEY, "DH", "type-specific" },
- { PEM_STRING_DHXPARAMS, OSSL_OBJECT_PKEY, "X9.42 DH", "type-specific" },
- { PEM_STRING_DSA, OSSL_OBJECT_PKEY, "DSA", "type-specific" },
- { PEM_STRING_DSA_PUBLIC, OSSL_OBJECT_PKEY, "DSA", "type-specific" },
- { PEM_STRING_DSAPARAMS, OSSL_OBJECT_PKEY, "DSA", "type-specific" },
- { PEM_STRING_ECPRIVATEKEY, OSSL_OBJECT_PKEY, "EC", "type-specific" },
- { PEM_STRING_ECPARAMETERS, OSSL_OBJECT_PKEY, "EC", "type-specific" },
- { PEM_STRING_SM2PARAMETERS, OSSL_OBJECT_PKEY, "SM2", "type-specific" },
- { PEM_STRING_RSA, OSSL_OBJECT_PKEY, "RSA", "type-specific" },
- { PEM_STRING_RSA_PUBLIC, OSSL_OBJECT_PKEY, "RSA", "type-specific" },
- /*
- * A few others that there is at least have an object type for, even
- * though there is no provider interface to handle such objects, yet.
- * However, this is beneficial for the OSSL_STORE result handler.
- */
- { PEM_STRING_X509, OSSL_OBJECT_CERT, NULL, "Certificate" },
- { PEM_STRING_X509_TRUSTED, OSSL_OBJECT_CERT, NULL, "Certificate" },
- { PEM_STRING_X509_OLD, OSSL_OBJECT_CERT, NULL, "Certificate" },
- { PEM_STRING_X509_CRL, OSSL_OBJECT_CRL, NULL, "CertificateList" }
- };
- struct pem2der_ctx_st *ctx = vctx;
- char *pem_name = NULL, *pem_header = NULL;
- size_t i;
- unsigned char *der = NULL;
- long der_len = 0;
- int ok = 0;
- int objtype = OSSL_OBJECT_UNKNOWN;
- ok = read_pem(ctx->provctx, cin, &pem_name, &pem_header,
- &der, &der_len) > 0;
- /* We return "empty handed". This is not an error. */
- if (!ok)
- return 1;
- /*
- * 10 is the number of characters in "Proc-Type:", which
- * PEM_get_EVP_CIPHER_INFO() requires to be present.
- * If the PEM header has less characters than that, it's
- * not worth spending cycles on it.
- */
- if (strlen(pem_header) > 10) {
- EVP_CIPHER_INFO cipher;
- struct pem2der_pass_data_st pass_data;
- ok = 0; /* Assume that we fail */
- pass_data.cb = pw_cb;
- pass_data.cbarg = pw_cbarg;
- if (!PEM_get_EVP_CIPHER_INFO(pem_header, &cipher)
- || !PEM_do_header(&cipher, der, &der_len,
- pem2der_pass_helper, &pass_data))
- goto end;
- }
- /*
- * Indicated that we successfully decoded something, or not at all.
- * Ending up "empty handed" is not an error.
- */
- ok = 1;
- /* Have a look to see if we recognise anything */
- for (i = 0; i < OSSL_NELEM(pem_name_map); i++)
- if (strcmp(pem_name, pem_name_map[i].pem_name) == 0)
- break;
- if (i < OSSL_NELEM(pem_name_map)) {
- OSSL_PARAM params[5], *p = params;
- /* We expect these to be read only so casting away the const is ok */
- char *data_type = (char *)pem_name_map[i].data_type;
- char *data_structure = (char *)pem_name_map[i].data_structure;
- objtype = pem_name_map[i].object_type;
- if (data_type != NULL)
- *p++ =
- OSSL_PARAM_construct_utf8_string(OSSL_OBJECT_PARAM_DATA_TYPE,
- data_type, 0);
- /* We expect this to be read only so casting away the const is ok */
- if (data_structure != NULL)
- *p++ =
- OSSL_PARAM_construct_utf8_string(OSSL_OBJECT_PARAM_DATA_STRUCTURE,
- data_structure, 0);
- *p++ =
- OSSL_PARAM_construct_octet_string(OSSL_OBJECT_PARAM_DATA,
- der, der_len);
- *p++ =
- OSSL_PARAM_construct_int(OSSL_OBJECT_PARAM_TYPE, &objtype);
- *p = OSSL_PARAM_construct_end();
- ok = data_cb(params, data_cbarg);
- }
- end:
- OPENSSL_free(pem_name);
- OPENSSL_free(pem_header);
- OPENSSL_free(der);
- return ok;
- }
- const OSSL_DISPATCH ossl_pem_to_der_decoder_functions[] = {
- { OSSL_FUNC_DECODER_NEWCTX, (void (*)(void))pem2der_newctx },
- { OSSL_FUNC_DECODER_FREECTX, (void (*)(void))pem2der_freectx },
- { OSSL_FUNC_DECODER_DECODE, (void (*)(void))pem2der_decode },
- OSSL_DISPATCH_END
- };
|