pem_info.c 10 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337
  1. /*
  2. * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the OpenSSL license (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <stdio.h>
  10. #include "internal/cryptlib.h"
  11. #include <openssl/buffer.h>
  12. #include <openssl/objects.h>
  13. #include <openssl/evp.h>
  14. #include <openssl/x509.h>
  15. #include <openssl/pem.h>
  16. #include <openssl/rsa.h>
  17. #include <openssl/dsa.h>
  18. #ifndef OPENSSL_NO_STDIO
  19. STACK_OF(X509_INFO) *PEM_X509_INFO_read(FILE *fp, STACK_OF(X509_INFO) *sk,
  20. pem_password_cb *cb, void *u)
  21. {
  22. BIO *b;
  23. STACK_OF(X509_INFO) *ret;
  24. if ((b = BIO_new(BIO_s_file())) == NULL) {
  25. PEMerr(PEM_F_PEM_X509_INFO_READ, ERR_R_BUF_LIB);
  26. return 0;
  27. }
  28. BIO_set_fp(b, fp, BIO_NOCLOSE);
  29. ret = PEM_X509_INFO_read_bio(b, sk, cb, u);
  30. BIO_free(b);
  31. return ret;
  32. }
  33. #endif
  34. STACK_OF(X509_INFO) *PEM_X509_INFO_read_bio(BIO *bp, STACK_OF(X509_INFO) *sk,
  35. pem_password_cb *cb, void *u)
  36. {
  37. X509_INFO *xi = NULL;
  38. char *name = NULL, *header = NULL;
  39. void *pp;
  40. unsigned char *data = NULL;
  41. const unsigned char *p;
  42. long len, error = 0;
  43. int ok = 0;
  44. STACK_OF(X509_INFO) *ret = NULL;
  45. unsigned int i, raw, ptype;
  46. d2i_of_void *d2i = 0;
  47. if (sk == NULL) {
  48. if ((ret = sk_X509_INFO_new_null()) == NULL) {
  49. PEMerr(PEM_F_PEM_X509_INFO_READ_BIO, ERR_R_MALLOC_FAILURE);
  50. goto err;
  51. }
  52. } else
  53. ret = sk;
  54. if ((xi = X509_INFO_new()) == NULL)
  55. goto err;
  56. for (;;) {
  57. raw = 0;
  58. ptype = 0;
  59. i = PEM_read_bio(bp, &name, &header, &data, &len);
  60. if (i == 0) {
  61. error = ERR_GET_REASON(ERR_peek_last_error());
  62. if (error == PEM_R_NO_START_LINE) {
  63. ERR_clear_error();
  64. break;
  65. }
  66. goto err;
  67. }
  68. start:
  69. if ((strcmp(name, PEM_STRING_X509) == 0) ||
  70. (strcmp(name, PEM_STRING_X509_OLD) == 0)) {
  71. d2i = (D2I_OF(void)) d2i_X509;
  72. if (xi->x509 != NULL) {
  73. if (!sk_X509_INFO_push(ret, xi))
  74. goto err;
  75. if ((xi = X509_INFO_new()) == NULL)
  76. goto err;
  77. goto start;
  78. }
  79. pp = &(xi->x509);
  80. } else if ((strcmp(name, PEM_STRING_X509_TRUSTED) == 0)) {
  81. d2i = (D2I_OF(void)) d2i_X509_AUX;
  82. if (xi->x509 != NULL) {
  83. if (!sk_X509_INFO_push(ret, xi))
  84. goto err;
  85. if ((xi = X509_INFO_new()) == NULL)
  86. goto err;
  87. goto start;
  88. }
  89. pp = &(xi->x509);
  90. } else if (strcmp(name, PEM_STRING_X509_CRL) == 0) {
  91. d2i = (D2I_OF(void)) d2i_X509_CRL;
  92. if (xi->crl != NULL) {
  93. if (!sk_X509_INFO_push(ret, xi))
  94. goto err;
  95. if ((xi = X509_INFO_new()) == NULL)
  96. goto err;
  97. goto start;
  98. }
  99. pp = &(xi->crl);
  100. } else
  101. #ifndef OPENSSL_NO_RSA
  102. if (strcmp(name, PEM_STRING_RSA) == 0) {
  103. d2i = (D2I_OF(void)) d2i_RSAPrivateKey;
  104. if (xi->x_pkey != NULL) {
  105. if (!sk_X509_INFO_push(ret, xi))
  106. goto err;
  107. if ((xi = X509_INFO_new()) == NULL)
  108. goto err;
  109. goto start;
  110. }
  111. xi->enc_data = NULL;
  112. xi->enc_len = 0;
  113. xi->x_pkey = X509_PKEY_new();
  114. if (xi->x_pkey == NULL)
  115. goto err;
  116. ptype = EVP_PKEY_RSA;
  117. pp = &xi->x_pkey->dec_pkey;
  118. if ((int)strlen(header) > 10) /* assume encrypted */
  119. raw = 1;
  120. } else
  121. #endif
  122. #ifndef OPENSSL_NO_DSA
  123. if (strcmp(name, PEM_STRING_DSA) == 0) {
  124. d2i = (D2I_OF(void)) d2i_DSAPrivateKey;
  125. if (xi->x_pkey != NULL) {
  126. if (!sk_X509_INFO_push(ret, xi))
  127. goto err;
  128. if ((xi = X509_INFO_new()) == NULL)
  129. goto err;
  130. goto start;
  131. }
  132. xi->enc_data = NULL;
  133. xi->enc_len = 0;
  134. xi->x_pkey = X509_PKEY_new();
  135. if (xi->x_pkey == NULL)
  136. goto err;
  137. ptype = EVP_PKEY_DSA;
  138. pp = &xi->x_pkey->dec_pkey;
  139. if ((int)strlen(header) > 10) /* assume encrypted */
  140. raw = 1;
  141. } else
  142. #endif
  143. #ifndef OPENSSL_NO_EC
  144. if (strcmp(name, PEM_STRING_ECPRIVATEKEY) == 0) {
  145. d2i = (D2I_OF(void)) d2i_ECPrivateKey;
  146. if (xi->x_pkey != NULL) {
  147. if (!sk_X509_INFO_push(ret, xi))
  148. goto err;
  149. if ((xi = X509_INFO_new()) == NULL)
  150. goto err;
  151. goto start;
  152. }
  153. xi->enc_data = NULL;
  154. xi->enc_len = 0;
  155. xi->x_pkey = X509_PKEY_new();
  156. if (xi->x_pkey == NULL)
  157. goto err;
  158. ptype = EVP_PKEY_EC;
  159. pp = &xi->x_pkey->dec_pkey;
  160. if ((int)strlen(header) > 10) /* assume encrypted */
  161. raw = 1;
  162. } else
  163. #endif
  164. {
  165. d2i = NULL;
  166. pp = NULL;
  167. }
  168. if (d2i != NULL) {
  169. if (!raw) {
  170. EVP_CIPHER_INFO cipher;
  171. if (!PEM_get_EVP_CIPHER_INFO(header, &cipher))
  172. goto err;
  173. if (!PEM_do_header(&cipher, data, &len, cb, u))
  174. goto err;
  175. p = data;
  176. if (ptype) {
  177. if (!d2i_PrivateKey(ptype, pp, &p, len)) {
  178. PEMerr(PEM_F_PEM_X509_INFO_READ_BIO, ERR_R_ASN1_LIB);
  179. goto err;
  180. }
  181. } else if (d2i(pp, &p, len) == NULL) {
  182. PEMerr(PEM_F_PEM_X509_INFO_READ_BIO, ERR_R_ASN1_LIB);
  183. goto err;
  184. }
  185. } else { /* encrypted RSA data */
  186. if (!PEM_get_EVP_CIPHER_INFO(header, &xi->enc_cipher))
  187. goto err;
  188. xi->enc_data = (char *)data;
  189. xi->enc_len = (int)len;
  190. data = NULL;
  191. }
  192. } else {
  193. /* unknown */
  194. }
  195. OPENSSL_free(name);
  196. name = NULL;
  197. OPENSSL_free(header);
  198. header = NULL;
  199. OPENSSL_free(data);
  200. data = NULL;
  201. }
  202. /*
  203. * if the last one hasn't been pushed yet and there is anything in it
  204. * then add it to the stack ...
  205. */
  206. if ((xi->x509 != NULL) || (xi->crl != NULL) ||
  207. (xi->x_pkey != NULL) || (xi->enc_data != NULL)) {
  208. if (!sk_X509_INFO_push(ret, xi))
  209. goto err;
  210. xi = NULL;
  211. }
  212. ok = 1;
  213. err:
  214. X509_INFO_free(xi);
  215. if (!ok) {
  216. for (i = 0; ((int)i) < sk_X509_INFO_num(ret); i++) {
  217. xi = sk_X509_INFO_value(ret, i);
  218. X509_INFO_free(xi);
  219. }
  220. if (ret != sk)
  221. sk_X509_INFO_free(ret);
  222. ret = NULL;
  223. }
  224. OPENSSL_free(name);
  225. OPENSSL_free(header);
  226. OPENSSL_free(data);
  227. return ret;
  228. }
  229. /* A TJH addition */
  230. int PEM_X509_INFO_write_bio(BIO *bp, X509_INFO *xi, EVP_CIPHER *enc,
  231. unsigned char *kstr, int klen,
  232. pem_password_cb *cb, void *u)
  233. {
  234. int i, ret = 0;
  235. unsigned char *data = NULL;
  236. const char *objstr = NULL;
  237. char buf[PEM_BUFSIZE];
  238. unsigned char *iv = NULL;
  239. if (enc != NULL) {
  240. objstr = OBJ_nid2sn(EVP_CIPHER_nid(enc));
  241. if (objstr == NULL
  242. /*
  243. * Check "Proc-Type: 4,Encrypted\nDEK-Info: objstr,hex-iv\n"
  244. * fits into buf
  245. */
  246. || (strlen(objstr) + 23 + 2 * EVP_CIPHER_iv_length(enc) + 13)
  247. > sizeof(buf)) {
  248. PEMerr(PEM_F_PEM_X509_INFO_WRITE_BIO, PEM_R_UNSUPPORTED_CIPHER);
  249. goto err;
  250. }
  251. }
  252. /*
  253. * now for the fun part ... if we have a private key then we have to be
  254. * able to handle a not-yet-decrypted key being written out correctly ...
  255. * if it is decrypted or it is non-encrypted then we use the base code
  256. */
  257. if (xi->x_pkey != NULL) {
  258. if ((xi->enc_data != NULL) && (xi->enc_len > 0)) {
  259. if (enc == NULL) {
  260. PEMerr(PEM_F_PEM_X509_INFO_WRITE_BIO, PEM_R_CIPHER_IS_NULL);
  261. goto err;
  262. }
  263. /* copy from weirdo names into more normal things */
  264. iv = xi->enc_cipher.iv;
  265. data = (unsigned char *)xi->enc_data;
  266. i = xi->enc_len;
  267. /*
  268. * we take the encryption data from the internal stuff rather
  269. * than what the user has passed us ... as we have to match
  270. * exactly for some strange reason
  271. */
  272. objstr = OBJ_nid2sn(EVP_CIPHER_nid(xi->enc_cipher.cipher));
  273. if (objstr == NULL) {
  274. PEMerr(PEM_F_PEM_X509_INFO_WRITE_BIO,
  275. PEM_R_UNSUPPORTED_CIPHER);
  276. goto err;
  277. }
  278. /* Create the right magic header stuff */
  279. buf[0] = '\0';
  280. PEM_proc_type(buf, PEM_TYPE_ENCRYPTED);
  281. PEM_dek_info(buf, objstr, EVP_CIPHER_iv_length(enc),
  282. (char *)iv);
  283. /* use the normal code to write things out */
  284. i = PEM_write_bio(bp, PEM_STRING_RSA, buf, data, i);
  285. if (i <= 0)
  286. goto err;
  287. } else {
  288. /* Add DSA/DH */
  289. #ifndef OPENSSL_NO_RSA
  290. /* normal optionally encrypted stuff */
  291. if (PEM_write_bio_RSAPrivateKey(bp,
  292. EVP_PKEY_get0_RSA(xi->x_pkey->dec_pkey),
  293. enc, kstr, klen, cb, u) <= 0)
  294. goto err;
  295. #endif
  296. }
  297. }
  298. /* if we have a certificate then write it out now */
  299. if ((xi->x509 != NULL) && (PEM_write_bio_X509(bp, xi->x509) <= 0))
  300. goto err;
  301. /*
  302. * we are ignoring anything else that is loaded into the X509_INFO
  303. * structure for the moment ... as I don't need it so I'm not coding it
  304. * here and Eric can do it when this makes it into the base library --tjh
  305. */
  306. ret = 1;
  307. err:
  308. OPENSSL_cleanse(buf, PEM_BUFSIZE);
  309. return ret;
  310. }