2 * Copyright (c) 2005 - 2007 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 typedef enum { USE_PEM
, USE_DER
} outformat
;
49 parse_certificate(hx509_context context
, const char *fn
,
50 struct hx509_collector
*c
,
51 const hx509_pem_header
*headers
,
52 const void *data
, size_t len
,
53 const AlgorithmIdentifier
*ai
)
58 ret
= hx509_cert_init_data(context
, data
, len
, &cert
);
62 ret
= _hx509_collector_certs_add(context
, c
, cert
);
63 hx509_cert_free(cert
);
68 try_decrypt(hx509_context context
,
69 struct hx509_collector
*collector
,
70 const AlgorithmIdentifier
*alg
,
78 heim_octet_string clear
;
83 keylen
= EVP_CIPHER_key_length(c
);
87 hx509_clear_error_string(context
);
91 ret
= EVP_BytesToKey(c
, EVP_md5(), ivdata
,
92 password
, passwordlen
,
95 hx509_set_error_string(context
, 0, HX509_CRYPTO_INTERNAL_ERROR
,
96 "Failed to do string2key for private key");
97 return HX509_CRYPTO_INTERNAL_ERROR
;
100 clear
.data
= malloc(len
);
101 if (clear
.data
== NULL
) {
102 hx509_set_error_string(context
, 0, ENOMEM
,
103 "Out of memory to decrypt for private key");
111 EVP_CIPHER_CTX_init(&ctx
);
112 EVP_CipherInit_ex(&ctx
, c
, NULL
, key
, ivdata
, 0);
113 EVP_Cipher(&ctx
, clear
.data
, cipher
, len
);
114 EVP_CIPHER_CTX_cleanup(&ctx
);
117 ret
= _hx509_collector_private_key_add(context
,
124 memset(clear
.data
, 0, clear
.length
);
127 memset(key
, 0, keylen
);
133 parse_pkcs8_private_key(hx509_context context
, const char *fn
,
134 struct hx509_collector
*c
,
135 const hx509_pem_header
*headers
,
136 const void *data
, size_t length
,
137 const AlgorithmIdentifier
*ai
)
139 PKCS8PrivateKeyInfo ki
;
140 heim_octet_string keydata
;
144 ret
= decode_PKCS8PrivateKeyInfo(data
, length
, &ki
, NULL
);
148 keydata
.data
= rk_UNCONST(data
);
149 keydata
.length
= length
;
151 ret
= _hx509_collector_private_key_add(context
,
153 &ki
.privateKeyAlgorithm
,
157 free_PKCS8PrivateKeyInfo(&ki
);
162 parse_pem_private_key(hx509_context context
, const char *fn
,
163 struct hx509_collector
*c
,
164 const hx509_pem_header
*headers
,
165 const void *data
, size_t len
,
166 const AlgorithmIdentifier
*ai
)
171 enc
= hx509_pem_find_header(headers
, "Proc-Type");
177 const EVP_CIPHER
*cipher
;
178 const struct _hx509_password
*pw
;
183 lock
= _hx509_collector_get_lock(c
);
185 hx509_set_error_string(context
, 0, HX509_ALG_NOT_SUPP
,
186 "Failed to get password for "
187 "password protected file %s", fn
);
188 return HX509_ALG_NOT_SUPP
;
191 if (strcmp(enc
, "4,ENCRYPTED") != 0) {
192 hx509_set_error_string(context
, 0, HX509_PARSING_KEY_FAILED
,
193 "Private key encrypted in unknown method %s "
196 hx509_clear_error_string(context
);
197 return HX509_PARSING_KEY_FAILED
;
200 dek
= hx509_pem_find_header(headers
, "DEK-Info");
202 hx509_set_error_string(context
, 0, HX509_PARSING_KEY_FAILED
,
203 "Encrypted private key missing DEK-Info");
204 return HX509_PARSING_KEY_FAILED
;
209 hx509_clear_error_string(context
);
213 iv
= strchr(type
, ',');
216 hx509_set_error_string(context
, 0, HX509_PARSING_KEY_FAILED
,
218 return HX509_PARSING_KEY_FAILED
;
224 ivdata
= malloc(size
);
225 if (ivdata
== NULL
) {
226 hx509_clear_error_string(context
);
231 cipher
= EVP_get_cipherbyname(type
);
232 if (cipher
== NULL
) {
234 hx509_set_error_string(context
, 0, HX509_ALG_NOT_SUPP
,
235 "Private key encrypted with "
236 "unsupported cipher: %s",
239 return HX509_ALG_NOT_SUPP
;
242 #define PKCS5_SALT_LEN 8
244 ssize
= hex_decode(iv
, ivdata
, size
);
249 if (ssize
< 0 || ssize
< PKCS5_SALT_LEN
|| ssize
< EVP_CIPHER_iv_length(cipher
)) {
251 hx509_set_error_string(context
, 0, HX509_PARSING_KEY_FAILED
,
252 "Salt have wrong length in "
254 return HX509_PARSING_KEY_FAILED
;
257 pw
= _hx509_lock_get_passwords(lock
);
259 const void *password
;
262 for (i
= 0; i
< pw
->len
; i
++) {
263 password
= pw
->val
[i
];
264 passwordlen
= strlen(password
);
266 ret
= try_decrypt(context
, c
, ai
, cipher
, ivdata
,
267 password
, passwordlen
, data
, len
);
278 memset(&prompt
, 0, sizeof(prompt
));
280 prompt
.prompt
= "Password for keyfile: ";
281 prompt
.type
= HX509_PROMPT_TYPE_PASSWORD
;
282 prompt
.reply
.data
= password
;
283 prompt
.reply
.length
= sizeof(password
);
285 ret
= hx509_lock_prompt(lock
, &prompt
);
287 ret
= try_decrypt(context
, c
, ai
, cipher
, ivdata
, password
,
288 strlen(password
), data
, len
);
289 /* XXX add password to lock password collection ? */
290 memset(password
, 0, sizeof(password
));
295 heim_octet_string keydata
;
297 keydata
.data
= rk_UNCONST(data
);
298 keydata
.length
= len
;
300 ret
= _hx509_collector_private_key_add(context
, c
, ai
, NULL
,
310 int (*func
)(hx509_context
, const char *, struct hx509_collector
*,
311 const hx509_pem_header
*, const void *, size_t,
312 const AlgorithmIdentifier
*);
313 const AlgorithmIdentifier
*(*ai
)(void);
315 { "CERTIFICATE", parse_certificate
, NULL
},
316 { "PRIVATE KEY", parse_pkcs8_private_key
, NULL
},
317 { "RSA PRIVATE KEY", parse_pem_private_key
, hx509_signature_rsa
},
318 { "EC PRIVATE KEY", parse_pem_private_key
, hx509_signature_ecPublicKey
}
324 struct hx509_collector
*c
;
328 pem_func(hx509_context context
, const char *type
,
329 const hx509_pem_header
*header
,
330 const void *data
, size_t len
, void *ctx
)
332 struct pem_ctx
*pem_ctx
= (struct pem_ctx
*)ctx
;
336 for (j
= 0; j
< sizeof(formats
)/sizeof(formats
[0]); j
++) {
337 const char *q
= formats
[j
].name
;
338 if (strcasecmp(type
, q
) == 0) {
339 const AlgorithmIdentifier
*ai
= NULL
;
340 if (formats
[j
].ai
!= NULL
)
341 ai
= (*formats
[j
].ai
)();
343 ret
= (*formats
[j
].func
)(context
, NULL
, pem_ctx
->c
,
344 header
, data
, len
, ai
);
345 if (ret
&& (pem_ctx
->flags
& HX509_CERTS_UNPROTECT_ALL
)) {
346 hx509_set_error_string(context
, HX509_ERROR_APPEND
, ret
,
347 "Failed parseing PEM format %s", type
);
353 if (j
== sizeof(formats
)/sizeof(formats
[0])) {
354 ret
= HX509_UNSUPPORTED_OPERATION
;
355 hx509_set_error_string(context
, 0, ret
,
356 "Found no matching PEM format for %s", type
);
367 file_init_common(hx509_context context
,
368 hx509_certs certs
, void **data
, int flags
,
369 const char *residue
, hx509_lock lock
, outformat format
)
372 struct ks_file
*ksf
= NULL
;
373 hx509_private_key
*keys
= NULL
;
375 struct pem_ctx pem_ctx
;
377 pem_ctx
.flags
= flags
;
383 lock
= _hx509_empty_lock
;
385 ksf
= calloc(1, sizeof(*ksf
));
387 hx509_clear_error_string(context
);
390 ksf
->format
= format
;
392 ksf
->fn
= strdup(residue
);
393 if (ksf
->fn
== NULL
) {
394 hx509_clear_error_string(context
);
400 * XXX this is broken, the function should parse the file before
404 if (flags
& HX509_CERTS_CREATE
) {
405 ret
= hx509_certs_init(context
, "MEMORY:ks-file-create",
406 0, lock
, &ksf
->certs
);
413 ret
= _hx509_collector_alloc(context
, lock
, &pem_ctx
.c
);
417 for (p
= ksf
->fn
; p
!= NULL
; p
= pnext
) {
420 pnext
= strchr(p
, ',');
425 if ((f
= fopen(p
, "r")) == NULL
) {
427 hx509_set_error_string(context
, 0, ret
,
428 "Failed to open PEM file \"%s\": %s",
434 ret
= hx509_pem_read(context
, f
, pem_func
, &pem_ctx
);
436 if (ret
!= 0 && ret
!= HX509_PARSING_KEY_FAILED
)
438 else if (ret
== HX509_PARSING_KEY_FAILED
) {
443 ret
= rk_undumpdata(p
, &ptr
, &length
);
445 hx509_clear_error_string(context
);
449 for (i
= 0; i
< sizeof(formats
)/sizeof(formats
[0]); i
++) {
450 const AlgorithmIdentifier
*ai
= NULL
;
451 if (formats
[i
].ai
!= NULL
)
452 ai
= (*formats
[i
].ai
)();
454 ret
= (*formats
[i
].func
)(context
, p
, pem_ctx
.c
, NULL
, ptr
, length
, ai
);
460 hx509_clear_error_string(context
);
466 ret
= _hx509_collector_collect_certs(context
, pem_ctx
.c
, &ksf
->certs
);
470 ret
= _hx509_collector_collect_private_keys(context
, pem_ctx
.c
, &keys
);
474 for (i
= 0; keys
[i
]; i
++)
475 _hx509_certs_keys_add(context
, ksf
->certs
, keys
[i
]);
476 _hx509_certs_keys_free(context
, keys
);
488 _hx509_collector_free(pem_ctx
.c
);
494 file_init_pem(hx509_context context
,
495 hx509_certs certs
, void **data
, int flags
,
496 const char *residue
, hx509_lock lock
)
498 return file_init_common(context
, certs
, data
, flags
, residue
, lock
, USE_PEM
);
502 file_init_der(hx509_context context
,
503 hx509_certs certs
, void **data
, int flags
,
504 const char *residue
, hx509_lock lock
)
506 return file_init_common(context
, certs
, data
, flags
, residue
, lock
, USE_DER
);
510 file_free(hx509_certs certs
, void *data
)
512 struct ks_file
*ksf
= data
;
513 hx509_certs_free(&ksf
->certs
);
525 store_func(hx509_context context
, void *ctx
, hx509_cert c
)
527 struct store_ctx
*sc
= ctx
;
528 heim_octet_string data
;
531 ret
= hx509_cert_binary(context
, c
, &data
);
535 switch (sc
->format
) {
537 fwrite(data
.data
, data
.length
, 1, sc
->f
);
541 hx509_pem_write(context
, "CERTIFICATE", NULL
, sc
->f
,
542 data
.data
, data
.length
);
544 if (_hx509_cert_private_key_exportable(c
)) {
545 hx509_private_key key
= _hx509_cert_private_key(c
);
546 ret
= _hx509_private_key_export(context
, key
,
547 HX509_KEY_FORMAT_DER
, &data
);
550 hx509_pem_write(context
, _hx509_private_pem_name(key
), NULL
, sc
->f
,
551 data
.data
, data
.length
);
561 file_store(hx509_context context
,
562 hx509_certs certs
, void *data
, int flags
, hx509_lock lock
)
564 struct ks_file
*ksf
= data
;
568 sc
.f
= fopen(ksf
->fn
, "w");
570 hx509_set_error_string(context
, 0, ENOENT
,
571 "Failed to open file %s for writing");
574 rk_cloexec_file(sc
.f
);
575 sc
.format
= ksf
->format
;
577 ret
= hx509_certs_iter_f(context
, ksf
->certs
, store_func
, &sc
);
583 file_add(hx509_context context
, hx509_certs certs
, void *data
, hx509_cert c
)
585 struct ks_file
*ksf
= data
;
586 return hx509_certs_add(context
, ksf
->certs
, c
);
590 file_iter_start(hx509_context context
,
591 hx509_certs certs
, void *data
, void **cursor
)
593 struct ks_file
*ksf
= data
;
594 return hx509_certs_start_seq(context
, ksf
->certs
, cursor
);
598 file_iter(hx509_context context
,
599 hx509_certs certs
, void *data
, void *iter
, hx509_cert
*cert
)
601 struct ks_file
*ksf
= data
;
602 return hx509_certs_next_cert(context
, ksf
->certs
, iter
, cert
);
606 file_iter_end(hx509_context context
,
611 struct ks_file
*ksf
= data
;
612 return hx509_certs_end_seq(context
, ksf
->certs
, cursor
);
616 file_getkeys(hx509_context context
,
619 hx509_private_key
**keys
)
621 struct ks_file
*ksf
= data
;
622 return _hx509_certs_keys_get(context
, ksf
->certs
, keys
);
626 file_addkey(hx509_context context
,
629 hx509_private_key key
)
631 struct ks_file
*ksf
= data
;
632 return _hx509_certs_keys_add(context
, ksf
->certs
, key
);
635 static struct hx509_keyset_ops keyset_file
= {
651 static struct hx509_keyset_ops keyset_pemfile
= {
667 static struct hx509_keyset_ops keyset_derfile
= {
685 _hx509_ks_file_register(hx509_context context
)
687 _hx509_ks_register(context
, &keyset_file
);
688 _hx509_ks_register(context
, &keyset_pemfile
);
689 _hx509_ks_register(context
, &keyset_derfile
);