2 * Copyright (c) 2005 - 2007 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 typedef enum { USE_PEM
, USE_DER
} outformat
;
49 parse_certificate(hx509_context context
, const char *fn
,
50 struct hx509_collector
*c
,
51 const hx509_pem_header
*headers
,
52 const void *data
, size_t len
,
53 const AlgorithmIdentifier
*ai
)
58 ret
= hx509_cert_init_data(context
, data
, len
, &cert
);
62 ret
= _hx509_collector_certs_add(context
, c
, cert
);
63 hx509_cert_free(cert
);
68 try_decrypt(hx509_context context
,
69 struct hx509_collector
*collector
,
70 const AlgorithmIdentifier
*alg
,
78 heim_octet_string clear
;
83 keylen
= EVP_CIPHER_key_length(c
);
87 hx509_clear_error_string(context
);
91 ret
= EVP_BytesToKey(c
, EVP_md5(), ivdata
,
92 password
, passwordlen
,
95 hx509_set_error_string(context
, 0, HX509_CRYPTO_INTERNAL_ERROR
,
96 "Failed to do string2key for private key");
97 return HX509_CRYPTO_INTERNAL_ERROR
;
100 clear
.data
= malloc(len
);
101 if (clear
.data
== NULL
) {
102 hx509_set_error_string(context
, 0, ENOMEM
,
103 "Out of memory to decrypt for private key");
111 EVP_CIPHER_CTX_init(&ctx
);
112 EVP_CipherInit_ex(&ctx
, c
, NULL
, key
, ivdata
, 0);
113 EVP_Cipher(&ctx
, clear
.data
, cipher
, len
);
114 EVP_CIPHER_CTX_cleanup(&ctx
);
117 ret
= _hx509_collector_private_key_add(context
,
124 memset(clear
.data
, 0, clear
.length
);
127 memset(key
, 0, keylen
);
133 parse_pkcs8_private_key(hx509_context context
, const char *fn
,
134 struct hx509_collector
*c
,
135 const hx509_pem_header
*headers
,
136 const void *data
, size_t length
,
137 const AlgorithmIdentifier
*ai
)
139 PKCS8PrivateKeyInfo ki
;
140 heim_octet_string keydata
;
144 ret
= decode_PKCS8PrivateKeyInfo(data
, length
, &ki
, NULL
);
148 keydata
.data
= rk_UNCONST(data
);
149 keydata
.length
= length
;
151 ret
= _hx509_collector_private_key_add(context
,
153 &ki
.privateKeyAlgorithm
,
157 free_PKCS8PrivateKeyInfo(&ki
);
162 parse_pem_private_key(hx509_context context
, const char *fn
,
163 struct hx509_collector
*c
,
164 const hx509_pem_header
*headers
,
165 const void *data
, size_t len
,
166 const AlgorithmIdentifier
*ai
)
171 enc
= hx509_pem_find_header(headers
, "Proc-Type");
177 const EVP_CIPHER
*cipher
;
178 const struct _hx509_password
*pw
;
180 int i
, decrypted
= 0;
182 lock
= _hx509_collector_get_lock(c
);
184 hx509_set_error_string(context
, 0, HX509_ALG_NOT_SUPP
,
185 "Failed to get password for "
186 "password protected file %s", fn
);
187 return HX509_ALG_NOT_SUPP
;
190 if (strcmp(enc
, "4,ENCRYPTED") != 0) {
191 hx509_set_error_string(context
, 0, HX509_PARSING_KEY_FAILED
,
192 "Private key encrypted in unknown method %s "
195 hx509_clear_error_string(context
);
196 return HX509_PARSING_KEY_FAILED
;
199 dek
= hx509_pem_find_header(headers
, "DEK-Info");
201 hx509_set_error_string(context
, 0, HX509_PARSING_KEY_FAILED
,
202 "Encrypted private key missing DEK-Info");
203 return HX509_PARSING_KEY_FAILED
;
208 hx509_clear_error_string(context
);
212 iv
= strchr(type
, ',');
215 hx509_set_error_string(context
, 0, HX509_PARSING_KEY_FAILED
,
217 return HX509_PARSING_KEY_FAILED
;
223 ivdata
= malloc(size
);
224 if (ivdata
== NULL
) {
225 hx509_clear_error_string(context
);
230 cipher
= EVP_get_cipherbyname(type
);
231 if (cipher
== NULL
) {
233 hx509_set_error_string(context
, 0, HX509_ALG_NOT_SUPP
,
234 "Private key encrypted with "
235 "unsupported cipher: %s",
238 return HX509_ALG_NOT_SUPP
;
241 #define PKCS5_SALT_LEN 8
243 ssize
= hex_decode(iv
, ivdata
, size
);
248 if (ssize
< 0 || ssize
< PKCS5_SALT_LEN
|| ssize
< EVP_CIPHER_iv_length(cipher
)) {
250 hx509_set_error_string(context
, 0, HX509_PARSING_KEY_FAILED
,
251 "Salt have wrong length in "
253 return HX509_PARSING_KEY_FAILED
;
256 pw
= _hx509_lock_get_passwords(lock
);
258 const void *password
;
261 for (i
= 0; i
< pw
->len
; i
++) {
262 password
= pw
->val
[i
];
263 passwordlen
= strlen(password
);
265 ret
= try_decrypt(context
, c
, ai
, cipher
, ivdata
,
266 password
, passwordlen
, data
, len
);
277 memset(&prompt
, 0, sizeof(prompt
));
279 prompt
.prompt
= "Password for keyfile: ";
280 prompt
.type
= HX509_PROMPT_TYPE_PASSWORD
;
281 prompt
.reply
.data
= password
;
282 prompt
.reply
.length
= sizeof(password
);
284 ret
= hx509_lock_prompt(lock
, &prompt
);
286 ret
= try_decrypt(context
, c
, ai
, cipher
, ivdata
, password
,
287 strlen(password
), data
, len
);
288 /* XXX add password to lock password collection ? */
289 memset(password
, 0, sizeof(password
));
294 heim_octet_string keydata
;
296 keydata
.data
= rk_UNCONST(data
);
297 keydata
.length
= len
;
299 ret
= _hx509_collector_private_key_add(context
, c
, ai
, NULL
,
309 int (*func
)(hx509_context
, const char *, struct hx509_collector
*,
310 const hx509_pem_header
*, const void *, size_t,
311 const AlgorithmIdentifier
*);
312 const AlgorithmIdentifier
*(*ai
)(void);
314 { "CERTIFICATE", parse_certificate
, NULL
},
315 { "PRIVATE KEY", parse_pkcs8_private_key
, NULL
},
316 { "RSA PRIVATE KEY", parse_pem_private_key
, hx509_signature_rsa
},
317 { "EC PRIVATE KEY", parse_pem_private_key
, hx509_signature_ecPublicKey
}
323 struct hx509_collector
*c
;
327 pem_func(hx509_context context
, const char *type
,
328 const hx509_pem_header
*header
,
329 const void *data
, size_t len
, void *ctx
)
331 struct pem_ctx
*pem_ctx
= (struct pem_ctx
*)ctx
;
334 for (j
= 0; j
< sizeof(formats
)/sizeof(formats
[0]); j
++) {
335 const char *q
= formats
[j
].name
;
336 if (strcasecmp(type
, q
) == 0) {
337 const AlgorithmIdentifier
*ai
= NULL
;
338 if (formats
[j
].ai
!= NULL
)
339 ai
= (*formats
[j
].ai
)();
341 ret
= (*formats
[j
].func
)(context
, NULL
, pem_ctx
->c
,
342 header
, data
, len
, ai
);
343 if (ret
&& (pem_ctx
->flags
& HX509_CERTS_UNPROTECT_ALL
)) {
344 hx509_set_error_string(context
, HX509_ERROR_APPEND
, ret
,
345 "Failed parseing PEM format %s", type
);
351 if (j
== sizeof(formats
)/sizeof(formats
[0])) {
352 ret
= HX509_UNSUPPORTED_OPERATION
;
353 hx509_set_error_string(context
, 0, ret
,
354 "Found no matching PEM format for %s", type
);
365 file_init_common(hx509_context context
,
366 hx509_certs certs
, void **data
, int flags
,
367 const char *residue
, hx509_lock lock
, outformat format
)
370 struct ks_file
*ksf
= NULL
;
371 hx509_private_key
*keys
= NULL
;
373 struct pem_ctx pem_ctx
;
375 pem_ctx
.flags
= flags
;
381 lock
= _hx509_empty_lock
;
383 ksf
= calloc(1, sizeof(*ksf
));
385 hx509_clear_error_string(context
);
388 ksf
->format
= format
;
390 ksf
->fn
= strdup(residue
);
391 if (ksf
->fn
== NULL
) {
392 hx509_clear_error_string(context
);
398 * XXX this is broken, the function should parse the file before
402 if (flags
& HX509_CERTS_CREATE
) {
403 ret
= hx509_certs_init(context
, "MEMORY:ks-file-create",
404 0, lock
, &ksf
->certs
);
411 ret
= _hx509_collector_alloc(context
, lock
, &pem_ctx
.c
);
415 for (p
= ksf
->fn
; p
!= NULL
; p
= pnext
) {
418 pnext
= strchr(p
, ',');
423 if ((f
= fopen(p
, "r")) == NULL
) {
425 hx509_set_error_string(context
, 0, ret
,
426 "Failed to open PEM file \"%s\": %s",
432 ret
= hx509_pem_read(context
, f
, pem_func
, &pem_ctx
);
434 if (ret
!= 0 && ret
!= HX509_PARSING_KEY_FAILED
)
436 else if (ret
== HX509_PARSING_KEY_FAILED
) {
441 ret
= rk_undumpdata(p
, &ptr
, &length
);
443 hx509_clear_error_string(context
);
447 for (i
= 0; i
< sizeof(formats
)/sizeof(formats
[0]); i
++) {
448 const AlgorithmIdentifier
*ai
= NULL
;
449 if (formats
[i
].ai
!= NULL
)
450 ai
= (*formats
[i
].ai
)();
452 ret
= (*formats
[i
].func
)(context
, p
, pem_ctx
.c
, NULL
, ptr
, length
, ai
);
458 hx509_clear_error_string(context
);
464 ret
= _hx509_collector_collect_certs(context
, pem_ctx
.c
, &ksf
->certs
);
468 ret
= _hx509_collector_collect_private_keys(context
, pem_ctx
.c
, &keys
);
472 for (i
= 0; keys
[i
]; i
++)
473 _hx509_certs_keys_add(context
, ksf
->certs
, keys
[i
]);
474 _hx509_certs_keys_free(context
, keys
);
486 _hx509_collector_free(pem_ctx
.c
);
492 file_init_pem(hx509_context context
,
493 hx509_certs certs
, void **data
, int flags
,
494 const char *residue
, hx509_lock lock
)
496 return file_init_common(context
, certs
, data
, flags
, residue
, lock
, USE_PEM
);
500 file_init_der(hx509_context context
,
501 hx509_certs certs
, void **data
, int flags
,
502 const char *residue
, hx509_lock lock
)
504 return file_init_common(context
, certs
, data
, flags
, residue
, lock
, USE_DER
);
508 file_free(hx509_certs certs
, void *data
)
510 struct ks_file
*ksf
= data
;
511 hx509_certs_free(&ksf
->certs
);
523 store_func(hx509_context context
, void *ctx
, hx509_cert c
)
525 struct store_ctx
*sc
= ctx
;
526 heim_octet_string data
;
529 ret
= hx509_cert_binary(context
, c
, &data
);
533 switch (sc
->format
) {
535 fwrite(data
.data
, data
.length
, 1, sc
->f
);
539 hx509_pem_write(context
, "CERTIFICATE", NULL
, sc
->f
,
540 data
.data
, data
.length
);
542 if (_hx509_cert_private_key_exportable(c
)) {
543 hx509_private_key key
= _hx509_cert_private_key(c
);
544 ret
= _hx509_private_key_export(context
, key
, &data
);
547 hx509_pem_write(context
, _hx509_private_pem_name(key
), NULL
, sc
->f
,
548 data
.data
, data
.length
);
558 file_store(hx509_context context
,
559 hx509_certs certs
, void *data
, int flags
, hx509_lock lock
)
561 struct ks_file
*ksf
= data
;
565 sc
.f
= fopen(ksf
->fn
, "w");
567 hx509_set_error_string(context
, 0, ENOENT
,
568 "Failed to open file %s for writing");
571 rk_cloexec_file(sc
.f
);
572 sc
.format
= ksf
->format
;
574 ret
= hx509_certs_iter(context
, ksf
->certs
, store_func
, &sc
);
580 file_add(hx509_context context
, hx509_certs certs
, void *data
, hx509_cert c
)
582 struct ks_file
*ksf
= data
;
583 return hx509_certs_add(context
, ksf
->certs
, c
);
587 file_iter_start(hx509_context context
,
588 hx509_certs certs
, void *data
, void **cursor
)
590 struct ks_file
*ksf
= data
;
591 return hx509_certs_start_seq(context
, ksf
->certs
, cursor
);
595 file_iter(hx509_context context
,
596 hx509_certs certs
, void *data
, void *iter
, hx509_cert
*cert
)
598 struct ks_file
*ksf
= data
;
599 return hx509_certs_next_cert(context
, ksf
->certs
, iter
, cert
);
603 file_iter_end(hx509_context context
,
608 struct ks_file
*ksf
= data
;
609 return hx509_certs_end_seq(context
, ksf
->certs
, cursor
);
613 file_getkeys(hx509_context context
,
616 hx509_private_key
**keys
)
618 struct ks_file
*ksf
= data
;
619 return _hx509_certs_keys_get(context
, ksf
->certs
, keys
);
623 file_addkey(hx509_context context
,
626 hx509_private_key key
)
628 struct ks_file
*ksf
= data
;
629 return _hx509_certs_keys_add(context
, ksf
->certs
, key
);
632 static struct hx509_keyset_ops keyset_file
= {
648 static struct hx509_keyset_ops keyset_pemfile
= {
664 static struct hx509_keyset_ops keyset_derfile
= {
682 _hx509_ks_file_register(hx509_context context
)
684 _hx509_ks_register(context
, &keyset_file
);
685 _hx509_ks_register(context
, &keyset_pemfile
);
686 _hx509_ks_register(context
, &keyset_derfile
);