diff options
author | Jon Spillett <jon.spillett@oracle.com> | 2021-02-17 17:56:36 +1000 |
---|---|---|
committer | Pauli <pauli@openssl.org> | 2021-04-30 09:15:50 +1000 |
commit | b536880c45722777df5ebe62897a6efcef757945 (patch) | |
tree | 015ad29f74586e3407079864fa686ffcde658fad /crypto/pkcs12 | |
parent | d77ba503a2cf1c83098baca345327761b991d191 (diff) |
Add library context and property query support into the PKCS12 API
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14434)
Diffstat (limited to 'crypto/pkcs12')
-rw-r--r-- | crypto/pkcs12/p12_add.c | 76 | ||||
-rw-r--r-- | crypto/pkcs12/p12_crpt.c | 49 | ||||
-rw-r--r-- | crypto/pkcs12/p12_crt.c | 64 | ||||
-rw-r--r-- | crypto/pkcs12/p12_decr.c | 64 | ||||
-rw-r--r-- | crypto/pkcs12/p12_init.c | 16 | ||||
-rw-r--r-- | crypto/pkcs12/p12_key.c | 66 | ||||
-rw-r--r-- | crypto/pkcs12/p12_mutl.c | 66 | ||||
-rw-r--r-- | crypto/pkcs12/p12_p8d.c | 17 | ||||
-rw-r--r-- | crypto/pkcs12/p12_p8e.c | 44 | ||||
-rw-r--r-- | crypto/pkcs12/p12_sbag.c | 48 |
10 files changed, 363 insertions, 147 deletions
diff --git a/crypto/pkcs12/p12_add.c b/crypto/pkcs12/p12_add.c index 4b6e6b9c22..f0b0819f84 100644 --- a/crypto/pkcs12/p12_add.c +++ b/crypto/pkcs12/p12_add.c @@ -9,8 +9,11 @@ #include <stdio.h> #include "internal/cryptlib.h" +#include <openssl/core.h> +#include <openssl/core_names.h> #include <openssl/pkcs12.h> #include "p12_local.h" +#include "crypto/pkcs7/pk7_local.h" /* Pack an object into an OCTET STRING and turn into a safebag */ @@ -80,15 +83,17 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_p7data(PKCS7 *p7) /* Turn a stack of SAFEBAGS into a PKCS#7 encrypted data ContentInfo */ -PKCS7 *PKCS12_pack_p7encdata(int pbe_nid, const char *pass, int passlen, - unsigned char *salt, int saltlen, int iter, - STACK_OF(PKCS12_SAFEBAG) *bags) +PKCS7 *PKCS12_pack_p7encdata_ex(int pbe_nid, const char *pass, int passlen, + unsigned char *salt, int saltlen, int iter, + STACK_OF(PKCS12_SAFEBAG) *bags, + OSSL_LIB_CTX *ctx, const char *propq) { PKCS7 *p7; X509_ALGOR *pbe; - const EVP_CIPHER *pbe_ciph; + const EVP_CIPHER *pbe_ciph = NULL; + EVP_CIPHER *pbe_ciph_fetch = NULL; - if ((p7 = PKCS7_new()) == NULL) { + if ((p7 = PKCS7_new_ex(ctx, propq)) == NULL) { ERR_raise(ERR_LIB_PKCS12, ERR_R_MALLOC_FAILURE); return NULL; } @@ -97,12 +102,16 @@ PKCS7 *PKCS12_pack_p7encdata(int pbe_nid, const char *pass, int passlen, goto err; } - pbe_ciph = EVP_get_cipherbynid(pbe_nid); + pbe_ciph = pbe_ciph_fetch = EVP_CIPHER_fetch(ctx, OBJ_nid2sn(pbe_nid), propq); + if (pbe_ciph == NULL) + pbe_ciph = EVP_get_cipherbynid(pbe_nid); - if (pbe_ciph) - pbe = PKCS5_pbe2_set(pbe_ciph, iter, salt, saltlen); - else - pbe = PKCS5_pbe_set(pbe_nid, iter, salt, saltlen); + if (pbe_ciph != NULL) { + pbe = PKCS5_pbe2_set_iv_ex(pbe_ciph, iter, salt, saltlen, NULL, -1, ctx); + } else { + ERR_clear_error(); + pbe = PKCS5_pbe_set_ex(pbe_nid, iter, salt, saltlen, ctx); + } if (pbe == NULL) { ERR_raise(ERR_LIB_PKCS12, ERR_R_MALLOC_FAILURE); @@ -112,34 +121,52 @@ PKCS7 *PKCS12_pack_p7encdata(int pbe_nid, const char *pass, int passlen, p7->d.encrypted->enc_data->algorithm = pbe; ASN1_OCTET_STRING_free(p7->d.encrypted->enc_data->enc_data); if (!(p7->d.encrypted->enc_data->enc_data = - PKCS12_item_i2d_encrypt(pbe, ASN1_ITEM_rptr(PKCS12_SAFEBAGS), pass, - passlen, bags, 1))) { + PKCS12_item_i2d_encrypt_ex(pbe, ASN1_ITEM_rptr(PKCS12_SAFEBAGS), pass, + passlen, bags, 1, ctx, propq))) { ERR_raise(ERR_LIB_PKCS12, PKCS12_R_ENCRYPT_ERROR); goto err; } + EVP_CIPHER_free(pbe_ciph_fetch); return p7; err: PKCS7_free(p7); + EVP_CIPHER_free(pbe_ciph_fetch); return NULL; } +PKCS7 *PKCS12_pack_p7encdata(int pbe_nid, const char *pass, int passlen, + unsigned char *salt, int saltlen, int iter, + STACK_OF(PKCS12_SAFEBAG) *bags) +{ + return PKCS12_pack_p7encdata_ex(pbe_nid, pass, passlen, salt, saltlen, + iter, bags, NULL, NULL); +} + STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_p7encdata(PKCS7 *p7, const char *pass, int passlen) { if (!PKCS7_type_is_encrypted(p7)) return NULL; - return PKCS12_item_decrypt_d2i(p7->d.encrypted->enc_data->algorithm, + return PKCS12_item_decrypt_d2i_ex(p7->d.encrypted->enc_data->algorithm, ASN1_ITEM_rptr(PKCS12_SAFEBAGS), pass, passlen, - p7->d.encrypted->enc_data->enc_data, 1); + p7->d.encrypted->enc_data->enc_data, 1, + p7->ctx.libctx, p7->ctx.propq); +} + +PKCS8_PRIV_KEY_INFO *PKCS12_decrypt_skey_ex(const PKCS12_SAFEBAG *bag, + const char *pass, int passlen, + OSSL_LIB_CTX *ctx, const char *propq) +{ + return PKCS8_decrypt_ex(bag->value.shkeybag, pass, passlen, ctx, propq); } PKCS8_PRIV_KEY_INFO *PKCS12_decrypt_skey(const PKCS12_SAFEBAG *bag, const char *pass, int passlen) { - return PKCS8_decrypt(bag->value.shkeybag, pass, passlen); + return PKCS12_decrypt_skey_ex(bag, pass, passlen, NULL, NULL); } int PKCS12_pack_authsafes(PKCS12 *p12, STACK_OF(PKCS7) *safes) @@ -152,10 +179,25 @@ int PKCS12_pack_authsafes(PKCS12 *p12, STACK_OF(PKCS7) *safes) STACK_OF(PKCS7) *PKCS12_unpack_authsafes(const PKCS12 *p12) { + STACK_OF(PKCS7) *p7s; + PKCS7 *p7; + int i; + if (!PKCS7_type_is_data(p12->authsafes)) { ERR_raise(ERR_LIB_PKCS12, PKCS12_R_CONTENT_TYPE_NOT_DATA); return NULL; } - return ASN1_item_unpack(p12->authsafes->d.data, - ASN1_ITEM_rptr(PKCS12_AUTHSAFES)); + p7s = ASN1_item_unpack(p12->authsafes->d.data, + ASN1_ITEM_rptr(PKCS12_AUTHSAFES)); + if (p7s != NULL) { + for (i = 0; i < sk_PKCS7_num(p7s); i++) { + p7 = sk_PKCS7_value(p7s, i); + if (!ossl_pkcs7_ctx_propagate(p12->authsafes, p7)) + goto err; + } + } + return p7s; +err: + sk_PKCS7_free(p7s); + return NULL; } diff --git a/crypto/pkcs12/p12_crpt.c b/crypto/pkcs12/p12_crpt.c index 8a6f71f7bb..aeea598696 100644 --- a/crypto/pkcs12/p12_crpt.c +++ b/crypto/pkcs12/p12_crpt.c @@ -9,6 +9,9 @@ #include <stdio.h> #include "internal/cryptlib.h" +#include <openssl/core.h> +#include <openssl/core_names.h> +#include "crypto/evp.h" #include <openssl/pkcs12.h> /* PKCS#12 PBE algorithms now in static table */ @@ -17,21 +20,16 @@ void PKCS12_PBE_add(void) { } -int PKCS12_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen, - ASN1_TYPE *param, const EVP_CIPHER *cipher, - const EVP_MD *md, int en_de) +int PKCS12_PBE_keyivgen_ex(EVP_CIPHER_CTX *ctx, const char *pass, int passlen, + ASN1_TYPE *param, const EVP_CIPHER *cipher, + const EVP_MD *md, int en_de, + OSSL_LIB_CTX *libctx, const char *propq) { PBEPARAM *pbe; int saltlen, iter, ret; unsigned char *salt; unsigned char key[EVP_MAX_KEY_LENGTH], iv[EVP_MAX_IV_LENGTH]; - int (*pkcs12_key_gen)(const char *pass, int passlen, - unsigned char *salt, int slen, - int id, int iter, int n, - unsigned char *out, - const EVP_MD *md_type); - - pkcs12_key_gen = PKCS12_key_gen_utf8; + unsigned char *piv = iv; if (cipher == NULL) return 0; @@ -50,21 +48,36 @@ int PKCS12_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen, iter = ASN1_INTEGER_get(pbe->iter); salt = pbe->salt->data; saltlen = pbe->salt->length; - if (!(*pkcs12_key_gen)(pass, passlen, salt, saltlen, PKCS12_KEY_ID, - iter, EVP_CIPHER_key_length(cipher), key, md)) { + if (!PKCS12_key_gen_utf8_ex(pass, passlen, salt, saltlen, PKCS12_KEY_ID, + iter, EVP_CIPHER_key_length(cipher), key, md, + libctx, propq)) { ERR_raise(ERR_LIB_PKCS12, PKCS12_R_KEY_GEN_ERROR); PBEPARAM_free(pbe); return 0; } - if (!(*pkcs12_key_gen)(pass, passlen, salt, saltlen, PKCS12_IV_ID, - iter, EVP_CIPHER_iv_length(cipher), iv, md)) { - ERR_raise(ERR_LIB_PKCS12, PKCS12_R_IV_GEN_ERROR); - PBEPARAM_free(pbe); - return 0; + if (EVP_CIPHER_iv_length(cipher) > 0) { + if (!PKCS12_key_gen_utf8_ex(pass, passlen, salt, saltlen, PKCS12_IV_ID, + iter, EVP_CIPHER_iv_length(cipher), iv, md, + libctx, propq)) { + ERR_raise(ERR_LIB_PKCS12, PKCS12_R_IV_GEN_ERROR); + PBEPARAM_free(pbe); + return 0; + } + } else { + piv = NULL; } PBEPARAM_free(pbe); - ret = EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, en_de); + ret = EVP_CipherInit_ex(ctx, cipher, NULL, key, piv, en_de); OPENSSL_cleanse(key, EVP_MAX_KEY_LENGTH); OPENSSL_cleanse(iv, EVP_MAX_IV_LENGTH); return ret; } + +int PKCS12_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen, + ASN1_TYPE *param, const EVP_CIPHER *cipher, + const EVP_MD *md, int en_de) +{ + return PKCS12_PBE_keyivgen_ex(ctx, pass, passlen, param, cipher, md, en_de, + NULL, NULL); +} + diff --git a/crypto/pkcs12/p12_crt.c b/crypto/pkcs12/p12_crt.c index f735cb2a67..00c7129746 100644 --- a/crypto/pkcs12/p12_crt.c +++ b/crypto/pkcs12/p12_crt.c @@ -28,9 +28,10 @@ static int copy_bag_attr(PKCS12_SAFEBAG *bag, EVP_PKEY *pkey, int nid) return 1; } -PKCS12 *PKCS12_create(const char *pass, const char *name, EVP_PKEY *pkey, X509 *cert, - STACK_OF(X509) *ca, int nid_key, int nid_cert, int iter, - int mac_iter, int keytype) +PKCS12 *PKCS12_create_ex(const char *pass, const char *name, EVP_PKEY *pkey, + X509 *cert, STACK_OF(X509) *ca, int nid_key, int nid_cert, + int iter, int mac_iter, int keytype, + OSSL_LIB_CTX *ctx, const char *propq) { PKCS12 *p12 = NULL; STACK_OF(PKCS7) *safes = NULL; @@ -76,14 +77,16 @@ PKCS12 *PKCS12_create(const char *pass, const char *name, EVP_PKEY *pkey, X509 * goto err; } - if (bags && !PKCS12_add_safe(&safes, bags, nid_cert, iter, pass)) + if (bags && !PKCS12_add_safe_ex(&safes, bags, nid_cert, iter, pass, + ctx, propq)) goto err; sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free); bags = NULL; if (pkey) { - bag = PKCS12_add_key(&bags, pkey, keytype, iter, nid_key, pass); + bag = PKCS12_add_key_ex(&bags, pkey, keytype, iter, nid_key, pass, + ctx, propq); if (!bag) goto err; @@ -105,7 +108,7 @@ PKCS12 *PKCS12_create(const char *pass, const char *name, EVP_PKEY *pkey, X509 * sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free); bags = NULL; - p12 = PKCS12_add_safes(safes, 0); + p12 = PKCS12_add_safes_ex(safes, 0, ctx, propq); if (p12 == NULL) goto err; @@ -128,6 +131,14 @@ PKCS12 *PKCS12_create(const char *pass, const char *name, EVP_PKEY *pkey, X509 * } +PKCS12 *PKCS12_create(const char *pass, const char *name, EVP_PKEY *pkey, X509 *cert, + STACK_OF(X509) *ca, int nid_key, int nid_cert, int iter, + int mac_iter, int keytype) +{ + return PKCS12_create_ex(pass, name, pkey, cert, ca, nid_key, nid_cert, + iter, mac_iter, keytype, NULL, NULL); +} + PKCS12_SAFEBAG *PKCS12_add_cert(STACK_OF(PKCS12_SAFEBAG) **pbags, X509 *cert) { PKCS12_SAFEBAG *bag = NULL; @@ -165,9 +176,10 @@ PKCS12_SAFEBAG *PKCS12_add_cert(STACK_OF(PKCS12_SAFEBAG) **pbags, X509 *cert) } -PKCS12_SAFEBAG *PKCS12_add_key(STACK_OF(PKCS12_SAFEBAG) **pbags, - EVP_PKEY *key, int key_usage, int iter, - int nid_key, const char *pass) +PKCS12_SAFEBAG *PKCS12_add_key_ex(STACK_OF(PKCS12_SAFEBAG) **pbags, + EVP_PKEY *key, int key_usage, int iter, + int nid_key, const char *pass, + OSSL_LIB_CTX *ctx, const char *propq) { PKCS12_SAFEBAG *bag = NULL; @@ -179,8 +191,8 @@ PKCS12_SAFEBAG *PKCS12_add_key(STACK_OF(PKCS12_SAFEBAG) **pbags, if (key_usage && !PKCS8_add_keyusage(p8, key_usage)) goto err; if (nid_key != -1) { - bag = PKCS12_SAFEBAG_create_pkcs8_encrypt(nid_key, pass, -1, NULL, 0, - iter, p8); + bag = PKCS12_SAFEBAG_create_pkcs8_encrypt_ex(nid_key, pass, -1, NULL, 0, + iter, p8, ctx, propq); PKCS8_PRIV_KEY_INFO_free(p8); } else bag = PKCS12_SAFEBAG_create0_p8inf(p8); @@ -199,6 +211,14 @@ PKCS12_SAFEBAG *PKCS12_add_key(STACK_OF(PKCS12_SAFEBAG) **pbags, } +PKCS12_SAFEBAG *PKCS12_add_key(STACK_OF(PKCS12_SAFEBAG) **pbags, + EVP_PKEY *key, int key_usage, int iter, + int nid_key, const char *pass) +{ + return PKCS12_add_key_ex(pbags, key, key_usage, iter, nid_key, pass, + NULL, NULL); +} + PKCS12_SAFEBAG *PKCS12_add_secret(STACK_OF(PKCS12_SAFEBAG) **pbags, int nid_type, const unsigned char *value, int len) { @@ -217,8 +237,9 @@ PKCS12_SAFEBAG *PKCS12_add_secret(STACK_OF(PKCS12_SAFEBAG) **pbags, return NULL; } -int PKCS12_add_safe(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags, - int nid_safe, int iter, const char *pass) +int PKCS12_add_safe_ex(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags, + int nid_safe, int iter, const char *pass, + OSSL_LIB_CTX *ctx, const char *propq) { PKCS7 *p7 = NULL; int free_safes = 0; @@ -240,7 +261,7 @@ int PKCS12_add_safe(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags, if (nid_safe == -1) p7 = PKCS12_pack_p7data(bags); else - p7 = PKCS12_pack_p7encdata(nid_safe, pass, -1, NULL, 0, iter, bags); + p7 = PKCS12_pack_p7encdata_ex(nid_safe, pass, -1, NULL, 0, iter, bags, ctx, propq); if (p7 == NULL) goto err; @@ -256,7 +277,12 @@ int PKCS12_add_safe(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags, } PKCS7_free(p7); return 0; +} +int PKCS12_add_safe(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags, + int nid_safe, int iter, const char *pass) +{ + return PKCS12_add_safe_ex(psafes, bags, nid_safe, iter, pass, NULL, NULL); } static int pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG) **pbags, @@ -285,13 +311,14 @@ static int pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG) **pbags, } -PKCS12 *PKCS12_add_safes(STACK_OF(PKCS7) *safes, int nid_p7) +PKCS12 *PKCS12_add_safes_ex(STACK_OF(PKCS7) *safes, int nid_p7, + OSSL_LIB_CTX *ctx, const char *propq) { PKCS12 *p12; if (nid_p7 <= 0) nid_p7 = NID_pkcs7_data; - p12 = PKCS12_init(nid_p7); + p12 = PKCS12_init_ex(nid_p7, ctx, propq); if (p12 == NULL) return NULL; @@ -303,3 +330,8 @@ PKCS12 *PKCS12_add_safes(STACK_OF(PKCS7) *safes, int nid_p7) return p12; } + +PKCS12 *PKCS12_add_safes(STACK_OF(PKCS7) *safes, int nid_p7) +{ + return PKCS12_add_safes_ex(safes, nid_p7, NULL, NULL); +} diff --git a/crypto/pkcs12/p12_decr.c b/crypto/pkcs12/p12_decr.c index e7a32f9cd6..ef316d044b 100644 --- a/crypto/pkcs12/p12_decr.c +++ b/crypto/pkcs12/p12_decr.c @@ -16,10 +16,11 @@ * Encrypt/Decrypt a buffer based on password and algor, result in a * OPENSSL_malloc'ed buffer */ -unsigned char *PKCS12_pbe_crypt(const X509_ALGOR *algor, - const char *pass, int passlen, - const unsigned char *in, int inlen, - unsigned char **data, int *datalen, int en_de) +unsigned char *PKCS12_pbe_crypt_ex(const X509_ALGOR *algor, + const char *pass, int passlen, + const unsigned char *in, int inlen, + unsigned char **data, int *datalen, int en_de, + OSSL_LIB_CTX *libctx, const char *propq) { unsigned char *out = NULL; int outlen, i; @@ -32,8 +33,8 @@ unsigned char *PKCS12_pbe_crypt(const X509_ALGOR *algor, } /* Process data */ - if (!EVP_PBE_CipherInit(algor->algorithm, pass, passlen, - algor->parameter, ctx, en_de)) + if (!EVP_PBE_CipherInit_ex(algor->algorithm, pass, passlen, + algor->parameter, ctx, en_de, libctx, propq)) goto err; /* @@ -109,22 +110,33 @@ unsigned char *PKCS12_pbe_crypt(const X509_ALGOR *algor, } +unsigned char *PKCS12_pbe_crypt(const X509_ALGOR *algor, + const char *pass, int passlen, + const unsigned char *in, int inlen, + unsigned char **data, int *datalen, int en_de) +{ + return PKCS12_pbe_crypt_ex(algor, pass, passlen, in, inlen, data, datalen, + en_de, NULL, NULL); +} + /* * Decrypt an OCTET STRING and decode ASN1 structure if zbuf set zero buffer * after use. */ -void *PKCS12_item_decrypt_d2i(const X509_ALGOR *algor, const ASN1_ITEM *it, - const char *pass, int passlen, - const ASN1_OCTET_STRING *oct, int zbuf) +void *PKCS12_item_decrypt_d2i_ex(const X509_ALGOR *algor, const ASN1_ITEM *it, + const char *pass, int passlen, + const ASN1_OCTET_STRING *oct, int zbuf, + OSSL_LIB_CTX *libctx, + const char *propq) { unsigned char *out = NULL; const unsigned char *p; void *ret; int outlen = 0; - if (!PKCS12_pbe_crypt(algor, pass, passlen, oct->data, oct->length, - &out, &outlen, 0)) + if (!PKCS12_pbe_crypt_ex(algor, pass, passlen, oct->data, oct->length, + &out, &outlen, 0, libctx, propq)) return NULL; p = out; OSSL_TRACE_BEGIN(PKCS12_DECRYPT) { @@ -141,15 +153,25 @@ void *PKCS12_item_decrypt_d2i(const X509_ALGOR *algor, const ASN1_ITEM *it, return ret; } +void *PKCS12_item_decrypt_d2i(const X509_ALGOR *algor, const ASN1_ITEM *it, + const char *pass, int passlen, + const ASN1_OCTET_STRING *oct, int zbuf) +{ + return PKCS12_item_decrypt_d2i_ex(algor, it, pass, passlen, oct, zbuf, + NULL, NULL); +} + /* * Encode ASN1 structure and encrypt, return OCTET STRING if zbuf set zero * encoding. */ -ASN1_OCTET_STRING *PKCS12_item_i2d_encrypt(X509_ALGOR *algor, - const ASN1_ITEM *it, - const char *pass, int passlen, - void *obj, int zbuf) +ASN1_OCTET_STRING *PKCS12_item_i2d_encrypt_ex(X509_ALGOR *algor, + const ASN1_ITEM *it, + const char *pass, int passlen, + void *obj, int zbuf, + OSSL_LIB_CTX *ctx, + const char *propq) { ASN1_OCTET_STRING *oct = NULL; unsigned char *in = NULL; @@ -164,8 +186,8 @@ ASN1_OCTET_STRING *PKCS12_item_i2d_encrypt(X509_ALGOR *algor, ERR_raise(ERR_LIB_PKCS12, PKCS12_R_ENCODE_ERROR); goto err; } - if (!PKCS12_pbe_crypt(algor, pass, passlen, in, inlen, &oct->data, - &oct->length, 1)) { + if (!PKCS12_pbe_crypt_ex(algor, pass, passlen, in, inlen, &oct->data, + &oct->length, 1, ctx, propq)) { ERR_raise(ERR_LIB_PKCS12, PKCS12_R_ENCRYPT_ERROR); OPENSSL_free(in); goto err; @@ -178,3 +200,11 @@ ASN1_OCTET_STRING *PKCS12_item_i2d_encrypt(X509_ALGOR *algor, ASN1_OCTET_STRING_free(oct); return NULL; } + +ASN1_OCTET_STRING *PKCS12_item_i2d_encrypt(X509_ALGOR *algor, + const ASN1_ITEM *it, + const char *pass, int passlen, + void *obj, int zbuf) +{ + return PKCS12_item_i2d_encrypt_ex(algor, it, pass, passlen, obj, zbuf, NULL, NULL); +} diff --git a/crypto/pkcs12/p12_init.c b/crypto/pkcs12/p12_init.c index 3ab7692ab9..dcfdd5ba13 100644 --- a/crypto/pkcs12/p12_init.c +++ b/crypto/pkcs12/p12_init.c @@ -10,11 +10,12 @@ #include <stdio.h> #include "internal/cryptlib.h" #include <openssl/pkcs12.h> +#include "crypto/pkcs7.h" #include "p12_local.h" /* Initialise a PKCS12 structure to take data */ -PKCS12 *PKCS12_init(int mode) +PKCS12 *PKCS12_init_ex(int mode, OSSL_LIB_CTX *ctx, const char *propq) { PKCS12 *pkcs12; @@ -25,6 +26,13 @@ PKCS12 *PKCS12_init(int mode) if (!ASN1_INTEGER_set(pkcs12->version, 3)) goto err; pkcs12->authsafes->type = OBJ_nid2obj(mode); + + ossl_pkcs7_set0_libctx(pkcs12->authsafes, ctx); + if (!ossl_pkcs7_set1_propq(pkcs12->authsafes, propq)) { + ERR_raise(ERR_LIB_PKCS12, ERR_R_MALLOC_FAILURE); + goto err; + } + switch (mode) { case NID_pkcs7_data: if ((pkcs12->authsafes->d.data = ASN1_OCTET_STRING_new()) == NULL) { @@ -42,3 +50,9 @@ PKCS12 *PKCS12_init(int mode) PKCS12_free(pkcs12); return NULL; } + +PKCS12 *PKCS12_init(int mode) +{ + return PKCS12_init_ex(mode, NULL, NULL); +} + diff --git a/crypto/pkcs12/p12_key.c b/crypto/pkcs12/p12_key.c index fd7f7a926b..a4ed0e516c 100644 --- a/crypto/pkcs12/p12_key.c +++ b/crypto/pkcs12/p12_key.c @@ -16,9 +16,10 @@ #include <openssl/core_names.h> #include "internal/provider.h" -int PKCS12_key_gen_asc(const char *pass, int passlen, unsigned char *salt, - int saltlen, int id, int iter, int n, - unsigned char *out, const EVP_MD *md_type) +int PKCS12_key_gen_asc_ex(const char *pass, int passlen, unsigned char *salt, + int saltlen, int id, int iter, int n, + unsigned char *out, const EVP_MD *md_type, + OSSL_LIB_CTX *ctx, const char *propq) { int ret; unsigned char *unipass; @@ -31,15 +32,24 @@ int PKCS12_key_gen_asc(const char *pass, int passlen, unsigned char *salt, ERR_raise(ERR_LIB_PKCS12, ERR_R_MALLOC_FAILURE); return 0; } - ret = PKCS12_key_gen_uni(unipass, uniplen, salt, saltlen, - id, iter, n, out, md_type); + ret = PKCS12_key_gen_uni_ex(unipass, uniplen, salt, saltlen, id, iter, + n, out, md_type, ctx, propq); OPENSSL_clear_free(unipass, uniplen); return ret > 0; } -int PKCS12_key_gen_utf8(const char *pass, int passlen, unsigned char *salt, - int saltlen, int id, int iter, int n, - unsigned char *out, const EVP_MD *md_type) +int PKCS12_key_gen_asc(const char *pass, int passlen, unsigned char *salt, + int saltlen, int id, int iter, int n, + unsigned char *out, const EVP_MD *md_type) +{ + return PKCS12_key_gen_asc_ex(pass, passlen, salt, saltlen, id, iter, n, + out, md_type, NULL, NULL); +} + +int PKCS12_key_gen_utf8_ex(const char *pass, int passlen, unsigned char *salt, + int saltlen, int id, int iter, int n, + unsigned char *out, const EVP_MD *md_type, + OSSL_LIB_CTX *ctx, const char *propq) { int ret; unsigned char *unipass; @@ -52,15 +62,24 @@ int PKCS12_key_gen_utf8(const char *pass, int passlen, unsigned char *salt, ERR_raise(ERR_LIB_PKCS12, ERR_R_MALLOC_FAILURE); return 0; } - ret = PKCS12_key_gen_uni(unipass, uniplen, salt, saltlen, - id, iter, n, out, md_type); + ret = PKCS12_key_gen_uni_ex(unipass, uniplen, salt, saltlen, id, iter, + n, out, md_type, ctx, propq); OPENSSL_clear_free(unipass, uniplen); return ret > 0; } -int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, - int saltlen, int id, int iter, int n, - unsigned char *out, const EVP_MD *md_type) +int PKCS12_key_gen_utf8(const char *pass, int passlen, unsigned char *salt, + int saltlen, int id, int iter, int n, + unsigned char *out, const EVP_MD *md_type) +{ + return PKCS12_key_gen_utf8_ex(pass, passlen, salt, saltlen, id, iter, n, + out, md_type, NULL, NULL); +} + +int PKCS12_key_gen_uni_ex(unsigned char *pass, int passlen, unsigned char *salt, + int saltlen, int id, int iter, int n, + unsigned char *out, const EVP_MD *md_type, + OSSL_LIB_CTX *libctx, const char *propq) { int res = 0; EVP_KDF *kdf; @@ -70,12 +89,7 @@ int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, if (n <= 0) return 0; - /* - * The parameter query isn't available but the library context can be - * extracted from the passed digest. - */ - kdf = EVP_KDF_fetch(ossl_provider_libctx(EVP_MD_provider(md_type)), - "PKCS12KDF", NULL); + kdf = EVP_KDF_fetch(libctx, "PKCS12KDF", propq); if (kdf == NULL) return 0; ctx = EVP_KDF_CTX_new(kdf); @@ -92,11 +106,9 @@ int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_PKCS12_ID, &id); *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_ITER, &iter); *p = OSSL_PARAM_construct_end(); - if (!EVP_KDF_CTX_set_params(ctx, params)) - goto err; OSSL_TRACE_BEGIN(PKCS12_KEYGEN) { - BIO_printf(trc_out, "PKCS12_key_gen_uni(): ID %d, ITER %d\n", id, iter); + BIO_printf(trc_out, "PKCS12_key_gen_uni_ex(): ID %d, ITER %d\n", id, iter); BIO_printf(trc_out, "Password (length %d):\n", passlen); BIO_hex_string(trc_out, 0, passlen, pass, passlen); BIO_printf(trc_out, "\n"); @@ -105,7 +117,7 @@ int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, BIO_printf(trc_out, "\n"); } OSSL_TRACE_END(PKCS12_KEYGEN); - if (EVP_KDF_derive(ctx, out, (size_t)n, NULL)) { + if (EVP_KDF_derive(ctx, out, (size_t)n, params)) { res = 1; OSSL_TRACE_BEGIN(PKCS12_KEYGEN) { BIO_printf(trc_out, "Output KEY (length %d)\n", n); @@ -113,7 +125,13 @@ int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, BIO_printf(trc_out, "\n"); } OSSL_TRACE_END(PKCS12_KEYGEN); } - err: EVP_KDF_CTX_free(ctx); return res; } + +int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, + int saltlen, int id, int iter, int n, + unsigned char *out, const EVP_MD *md_type) +{ + return PKCS12_key_gen_uni_ex(pass, passlen, salt, saltlen, id, iter, n, out, md_type, NULL, NULL); +} diff --git a/crypto/pkcs12/p12_mutl.c b/crypto/pkcs12/p12_mutl.c index 70b3ec702b..f072436110 100644 --- a/crypto/pkcs12/p12_mutl.c +++ b/crypto/pkcs12/p12_mutl.c @@ -82,18 +82,17 @@ static int pkcs12_gen_mac(PKCS12 *p12, const char *pass, int passlen, const EVP_MD *md_type)) { int ret = 0; - const EVP_MD *md_type; + const EVP_MD *md; + EVP_MD *md_fetch; HMAC_CTX *hmac = NULL; unsigned char key[EVP_MAX_MD_SIZE], *salt; int saltlen, iter; + char md_name[80]; int md_size = 0; - int md_type_nid; + int md_nid; const X509_ALGOR *macalg; const ASN1_OBJECT *macoid; - if (pkcs12_key_gen == NULL) - pkcs12_key_gen = PKCS12_key_gen_utf8; - if (!PKCS7_type_is_data(p12->authsafes)) { ERR_raise(ERR_LIB_PKCS12, PKCS12_R_CONTENT_TYPE_NOT_DATA); return 0; @@ -107,32 +106,51 @@ static int pkcs12_gen_mac(PKCS12 *p12, const char *pass, int passlen, iter = ASN1_INTEGER_get(p12->mac->iter); X509_SIG_get0(p12->mac->dinfo, &macalg, NULL); X509_ALGOR_get0(&macoid, NULL, NULL, macalg); - if ((md_type = EVP_get_digestbyobj(macoid)) == NULL) { + if (OBJ_obj2txt(md_name, sizeof(md_name), macoid, 0) < 0) + return 0; + md = md_fetch = EVP_MD_fetch(p12->authsafes->ctx.libctx, md_name, + p12->authsafes->ctx.propq); + if (md == NULL) + md = EVP_get_digestbynid(OBJ_obj2nid(macoid)); + + if (md == NULL) { ERR_raise(ERR_LIB_PKCS12, PKCS12_R_UNKNOWN_DIGEST_ALGORITHM); return 0; } - md_size = EVP_MD_size(md_type); - md_type_nid = EVP_MD_type(md_type); + md_size = EVP_MD_size(md); + md_nid = EVP_MD_type(md); if (md_size < 0) - return 0; - if ((md_type_nid == NID_id_GostR3411_94 - || md_type_nid == NID_id_GostR3411_2012_256 - || md_type_nid == NID_id_GostR3411_2012_512) + goto err; + if ((md_nid == NID_id_GostR3411_94 + || md_nid == NID_id_GostR3411_2012_256 + || md_nid == NID_id_GostR3411_2012_512) && ossl_safe_getenv("LEGACY_GOST_PKCS12") == NULL) { md_size = TK26_MAC_KEY_LEN; if (!pkcs12_gen_gost_mac_key(pass, passlen, salt, saltlen, iter, - md_size, key, md_type)) { + md_size, key, md)) { ERR_raise(ERR_LIB_PKCS12, PKCS12_R_KEY_GEN_ERROR); goto err; } - } else - if (!(*pkcs12_key_gen)(pass, passlen, salt, saltlen, PKCS12_MAC_ID, - iter, md_size, key, md_type)) { - ERR_raise(ERR_LIB_PKCS12, PKCS12_R_KEY_GEN_ERROR); - goto err; + } else { + if (pkcs12_key_gen != NULL) { + if (!(*pkcs12_key_gen)(pass, passlen, salt, saltlen, PKCS12_MAC_ID, + iter, md_size, key, md)) { + ERR_raise(ERR_LIB_PKCS12, PKCS12_R_KEY_GEN_ERROR); + goto err; + } + } else { + /* Default to UTF-8 password */ + if (!PKCS12_key_gen_utf8_ex(pass, passlen, salt, saltlen, PKCS12_MAC_ID, + iter, md_size, key, md, + p12->authsafes->ctx.libctx, + p12->authsafes->ctx.propq)) { + ERR_raise(ERR_LIB_PKCS12, PKCS12_R_KEY_GEN_ERROR); + goto err; + } + } } if ((hmac = HMAC_CTX_new()) == NULL - || !HMAC_Init_ex(hmac, key, md_size, md_type, NULL) + || !HMAC_Init_ex(hmac, key, md_size, md, NULL) || !HMAC_Update(hmac, p12->authsafes->d.data->data, p12->authsafes->d.data->length) || !HMAC_Final(hmac, mac, maclen)) { @@ -143,6 +161,7 @@ static int pkcs12_gen_mac(PKCS12 *p12, const char *pass, int passlen, err: OPENSSL_cleanse(key, sizeof(key)); HMAC_CTX_free(hmac); + EVP_MD_free(md_fetch); return ret; } @@ -163,8 +182,7 @@ int PKCS12_verify_mac(PKCS12 *p12, const char *pass, int passlen) ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_ABSENT); return 0; } - if (!pkcs12_gen_mac(p12, pass, passlen, mac, &maclen, - PKCS12_key_gen_utf8)) { + if (!pkcs12_gen_mac(p12, pass, passlen, mac, &maclen, NULL)) { ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_GENERATION_ERROR); return 0; } @@ -198,8 +216,7 @@ int PKCS12_set_mac(PKCS12 *p12, const char *pass, int passlen, /* * Note that output mac is forced to UTF-8... */ - if (!pkcs12_gen_mac(p12, pass, passlen, mac, &maclen, - PKCS12_key_gen_utf8)) { + if (!pkcs12_gen_mac(p12, pass, passlen, mac, &maclen, NULL)) { ERR_raise(ERR_LIB_PKCS12, PKCS12_R_MAC_GENERATION_ERROR); return 0; } @@ -242,7 +259,8 @@ int PKCS12_setup_mac(PKCS12 *p12, int iter, unsigned char *salt, int saltlen, } p12->mac->salt->length = saltlen; if (!salt) { - if (RAND_bytes(p12->mac->salt->data, saltlen) <= 0) + if (RAND_bytes_ex(p12->authsafes->ctx.libctx, p12->mac->salt->data, + saltlen) <= 0) return 0; } else memcpy(p12->mac->salt->data, salt, saltlen); diff --git a/crypto/pkcs12/p12_p8d.c b/crypto/pkcs12/p12_p8d.c index 2577cba46c..599a64f878 100644 --- a/crypto/pkcs12/p12_p8d.c +++ b/ |