diff options
-rw-r--r-- | CHANGES | 5 | ||||
-rw-r--r-- | Makefile.org | 2 | ||||
-rw-r--r-- | crypto/Makefile.ssl | 2 | ||||
-rw-r--r-- | crypto/asn1/p5_pbe.c | 68 | ||||
-rw-r--r-- | crypto/err/err.h | 2 | ||||
-rw-r--r-- | crypto/err/err_all.c | 2 | ||||
-rw-r--r-- | crypto/err/ssleay.ec | 1 | ||||
-rw-r--r-- | crypto/evp/c_all.c | 2 | ||||
-rw-r--r-- | crypto/pkcs12/Makefile.ssl | 91 | ||||
-rw-r--r-- | crypto/pkcs12/p12_add.c | 236 | ||||
-rw-r--r-- | crypto/pkcs12/p12_attr.c | 244 | ||||
-rw-r--r-- | crypto/pkcs12/p12_bags.c | 203 | ||||
-rw-r--r-- | crypto/pkcs12/p12_crpt.c | 104 | ||||
-rw-r--r-- | crypto/pkcs12/p12_crt.c | 170 | ||||
-rw-r--r-- | crypto/pkcs12/p12_decr.c | 206 | ||||
-rw-r--r-- | crypto/pkcs12/p12_init.c | 102 | ||||
-rw-r--r-- | crypto/pkcs12/p12_key.c | 190 | ||||
-rw-r--r-- | crypto/pkcs12/p12_kiss.c | 269 | ||||
-rw-r--r-- | crypto/pkcs12/p12_lib.c | 123 | ||||
-rw-r--r-- | crypto/pkcs12/p12_mac.c | 120 | ||||
-rw-r--r-- | crypto/pkcs12/p12_mutl.c | 187 | ||||
-rw-r--r-- | crypto/pkcs12/p12_sbag.c | 238 | ||||
-rw-r--r-- | crypto/pkcs12/p12_utl.c | 140 | ||||
-rw-r--r-- | crypto/pkcs12/pk12err.c | 136 | ||||
-rw-r--r-- | crypto/pkcs12/pkcs12.err | 52 | ||||
-rw-r--r-- | crypto/pkcs12/pkcs12.h | 407 | ||||
-rw-r--r-- | crypto/x509/x509.h | 2 |
27 files changed, 3302 insertions, 2 deletions
@@ -5,6 +5,11 @@ Changes between 0.9.2b and 0.9.3 + *) More PKCS#12 integration. Add new pkcs12 directory with Makefile.ssl and + modify error routines to work internally. Add error codes and PBE init + to library startup routines. + [Steve Henson] + *) Further PKCS#12 integration. Added password based encryption, PKCS#8 and packing functions to asn1 and evp. Changed function names and error codes along the way. diff --git a/Makefile.org b/Makefile.org index d8af86e92a..7c000f2567 100644 --- a/Makefile.org +++ b/Makefile.org @@ -133,7 +133,7 @@ SDIRS= \ des rc2 rc4 rc5 idea bf cast \ bn rsa dsa dh \ buffer bio stack lhash rand err objects \ - evp asn1 pem x509 x509v3 conf txt_db pkcs7 comp + evp asn1 pem x509 x509v3 conf txt_db pkcs7 pkcs12 comp # Do not edit this manually. Use util/ssldir.pl do change this! INSTALLTOP=/usr/local/ssl diff --git a/crypto/Makefile.ssl b/crypto/Makefile.ssl index 70194b4c33..1a03301060 100644 --- a/crypto/Makefile.ssl +++ b/crypto/Makefile.ssl @@ -29,7 +29,7 @@ SDIRS= md2 md5 sha mdc2 hmac ripemd \ des rc2 rc4 rc5 idea bf cast \ bn rsa dsa dh \ buffer bio stack lhash rand err objects \ - evp asn1 pem x509 x509v3 conf txt_db pkcs7 comp + evp asn1 pem x509 x509v3 conf txt_db pkcs7 pkcs12 comp GENERAL=Makefile README diff --git a/crypto/asn1/p5_pbe.c b/crypto/asn1/p5_pbe.c index a94d6c14d8..afcf955996 100644 --- a/crypto/asn1/p5_pbe.c +++ b/crypto/asn1/p5_pbe.c @@ -59,9 +59,12 @@ #include <stdio.h> #include "cryptlib.h" #include "asn1_mac.h" +#include "rand.h" /* PKCS#5 password based encryption structure */ +#define PKCS5_SALT_LEN 8 + /* *ASN1err(ASN1_F_PBEPARAM_NEW,ASN1_R_DEOCDE_ERROR) *ASN1err(ASN1_F_D2I_PBEPARAM,ASN1_R_DEOCDE_ERROR) @@ -114,3 +117,68 @@ PBEPARAM *a; ASN1_INTEGER_free (a->iter); Free ((char *)a); } + +/* Return an algorithm identifier for a PKCS#5 PBE algorithm */ + +X509_ALGOR *PKCS5_pbe_set(alg, iter, salt, saltlen) +int alg; +int iter; +unsigned char *salt; +int saltlen; +{ + unsigned char *pdata, *ptmp; + int plen; + PBEPARAM *pbe; + ASN1_OBJECT *al; + X509_ALGOR *algor; + ASN1_TYPE *astype; + + if (!(pbe = PBEPARAM_new ())) { + ASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE); + return NULL; + } + ASN1_INTEGER_set (pbe->iter, iter); + if (!saltlen) saltlen = PKCS5_SALT_LEN; + if (!(pbe->salt->data = Malloc (saltlen))) { + ASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE); + return NULL; + } + pbe->salt->length = saltlen; + if (salt) memcpy (pbe->salt->data, salt, saltlen); + else RAND_bytes (pbe->salt->data, saltlen); + if (!(plen = i2d_PBEPARAM (pbe, NULL))) { + ASN1err(ASN1_F_ASN1_PBE_SET,ASN1_R_ENCODE_ERROR); + return NULL; + } + if (!(pdata = Malloc (plen))) { + ASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE); + return NULL; + } + ptmp = pdata; + i2d_PBEPARAM (pbe, &ptmp); + PBEPARAM_free (pbe); + + if (!(astype = ASN1_TYPE_new())) { + ASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE); + return NULL; + } + + astype->type = V_ASN1_SEQUENCE; + if (!(astype->value.sequence=ASN1_STRING_new())) { + ASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE); + return NULL; + } + ASN1_STRING_set (astype->value.sequence, pdata, plen); + Free (pdata); + + al = OBJ_nid2obj(alg); /* never need to free al */ + if (!(algor = X509_ALGOR_new())) { + ASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE); + return NULL; + } + ASN1_OBJECT_free(algor->algorithm); + algor->algorithm = al; + algor->parameter = astype; + + return (algor); +} diff --git a/crypto/err/err.h b/crypto/err/err.h index fe037109d9..c10868ac7f 100644 --- a/crypto/err/err.h +++ b/crypto/err/err.h @@ -117,6 +117,7 @@ typedef struct err_state_st #define ERR_LIB_BIO 32 #define ERR_LIB_PKCS7 33 #define ERR_LIB_X509V3 34 +#define ERR_LIB_PKCS12 35 #define ERR_LIB_USER 128 @@ -143,6 +144,7 @@ typedef struct err_state_st #define PROXYerr(f,r) ERR_PUT_error(ERR_LIB_PROXY,(f),(r),ERR_file_name,__LINE__) #define PKCS7err(f,r) ERR_PUT_error(ERR_LIB_PKCS7,(f),(r),ERR_file_name,__LINE__) #define X509V3err(f,r) ERR_PUT_error(ERR_LIB_X509V3,(f),(r),ERR_file_name,__LINE__) +#define PKCS12err(f,r) ERR_PUT_error(ERR_LIB_PKCS12,(f),(r),ERR_file_name,__LINE__) /* Borland C seems too stupid to be able to shift and do longs in * the pre-processor :-( */ diff --git a/crypto/err/err_all.c b/crypto/err/err_all.c index 6917b48fb2..06076064f6 100644 --- a/crypto/err/err_all.c +++ b/crypto/err/err_all.c @@ -79,6 +79,7 @@ #include "x509.h" #include "x509v3.h" #include "conf.h" +#include "pkcs12.h" #include "err.h" void ERR_load_crypto_strings() @@ -114,5 +115,6 @@ void ERR_load_crypto_strings() ERR_load_X509V3_strings(); ERR_load_CRYPTO_strings(); ERR_load_PKCS7_strings(); + ERR_load_PKCS12_strings(); #endif } diff --git a/crypto/err/ssleay.ec b/crypto/err/ssleay.ec index fa2df26ca2..2f9fd16edc 100644 --- a/crypto/err/ssleay.ec +++ b/crypto/err/ssleay.ec @@ -16,6 +16,7 @@ L ASN1 asn1/asn1.err L CONF conf/conf.err L PROXY proxy/proxy.err L PKCS7 pkcs7/pkcs7.err +L PKCS12 pkcs12/pkcs12.err L RSAREF ../rsaref/rsaref.err L SSL ../ssl/ssl.err L SSL2 ../ssl/ssl2.err diff --git a/crypto/evp/c_all.c b/crypto/evp/c_all.c index f2e0500dd3..51f7aba805 100644 --- a/crypto/evp/c_all.c +++ b/crypto/evp/c_all.c @@ -59,6 +59,7 @@ #include <stdio.h> #include "cryptlib.h" #include "evp.h" +#include "pkcs12.h" #include "objects.h" void SSLeay_add_all_algorithms() @@ -187,4 +188,5 @@ void SSLeay_add_all_digests() EVP_add_digest_alias(SN_ripemd160,"ripemd"); EVP_add_digest_alias(SN_ripemd160,"rmd160"); #endif + PKCS12_PBE_add(); } diff --git a/crypto/pkcs12/Makefile.ssl b/crypto/pkcs12/Makefile.ssl new file mode 100644 index 0000000000..a53e1c425f --- /dev/null +++ b/crypto/pkcs12/Makefile.ssl @@ -0,0 +1,91 @@ +# +# SSLeay/crypto/asn1/Makefile +# + +DIR= pkcs12 +TOP= ../.. +CC= cc +INCLUDES= -I.. -I../../include +CFLAG=-g +INSTALLTOP=/usr/local/ssl +MAKE= make -f Makefile.ssl +MAKEDEPEND= $(TOP)/util/domd $(TOP) +MAKEFILE= Makefile.ssl +AR= ar r + +CFLAGS= $(INCLUDES) $(CFLAG) + +ERR=pkcs12 +ERRC=pk12err +GENERAL=Makefile +TEST= +APPS= + +LIB=$(TOP)/libcrypto.a +LIBSRC= p12_add.c p12_attr.c p12_bags.c p12_crpt.c p12_crt.c p12_decr.c \ + p12_init.c p12_key.c p12_kiss.c p12_lib.c p12_mac.c p12_mutl.c\ + p12_sbag.c p12_utl.c pk12err.c +LIBOBJ= p12_add.o p12_attr.o p12_bags.o p12_crpt.o p12_crt.o p12_decr.o \ + p12_init.o p12_key.o p12_kiss.o p12_lib.o p12_mac.o p12_mutl.o\ + p12_sbag.o p12_utl.o pk12err.o + +SRC= $(LIBSRC) + +EXHEADER= pkcs12.h +HEADER= $(EXHEADER) + +ALL= $(GENERAL) $(SRC) $(HEADER) + +top: + (cd ../..; $(MAKE) DIRS=crypto SDIRS=$(DIR) sub_all) + +test: + +all: lib + +lib: $(LIBOBJ) + $(AR) $(LIB) $(LIBOBJ) + sh $(TOP)/util/ranlib.sh $(LIB) + @touch lib + +files: + perl $(TOP)/util/files.pl Makefile.ssl >> $(TOP)/MINFO + +links: + @$(TOP)/util/point.sh Makefile.ssl Makefile + @$(TOP)/util/mklink.sh ../../include $(EXHEADER) + @$(TOP)/util/mklink.sh ../../test $(TEST) + @$(TOP)/util/mklink.sh ../../apps $(APPS) + +install: + @for i in $(EXHEADER) ; \ + do \ + (cp $$i $(INSTALLTOP)/include/$$i; \ + chmod 644 $(INSTALLTOP)/include/$$i ); \ + done; + +tags: + ctags $(SRC) + +tests: + +lint: + lint -DLINT $(INCLUDES) $(SRC)>fluff + +depend: + $(MAKEDEPEND) $(INCLUDES) $(PROGS) $(LIBSRC) + +dclean: + perl -pe 'if (/^# DO NOT DELETE THIS LINE/) {print; exit(0);}' $(MAKEFILE) >Makefile.new + mv -f Makefile.new $(MAKEFILE) + +clean: + rm -f *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff + +errors: $(ERRC).c + +$(ERRC).c: $(ERR).err + perl $(TOP)/util/err-ins.pl $(ERR).err $(ERR).h + perl ../err/err_genc.pl -s $(ERR).h $(ERRC).c + +# DO NOT DELETE THIS LINE -- make depend depends on it. diff --git a/crypto/pkcs12/p12_add.c b/crypto/pkcs12/p12_add.c new file mode 100644 index 0000000000..2022b953f5 --- /dev/null +++ b/crypto/pkcs12/p12_add.c @@ -0,0 +1,236 @@ +/* p12_add.c */ +/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL + * project 1999. + */ +/* ==================================================================== + * Copyright (c) 1999 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * licensing@OpenSSL.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ + +#include <stdio.h> +#include <stdlib.h> +#include <err.h> +#include "pkcs12.h" + +/* Pack an object into an OCTET STRING and turn into a safebag */ + +PKCS12_SAFEBAG *PKCS12_pack_safebag (obj, i2d, nid1, nid2) +char *obj; +int (*i2d)(); +int nid1; +int nid2; + +{ + PKCS12_BAGS *bag; + PKCS12_SAFEBAG *safebag; + if (!(bag = PKCS12_BAGS_new ())) { + PKCS12err(PKCS12_F_PKCS12_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE); + return NULL; + } + M_ASN1_OBJECT_set(bag->type, nid1); + if (!ASN1_pack_string(obj, i2d, &bag->value.octet)) { + PKCS12err(PKCS12_F_PKCS12_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE); + return NULL; + } + if (!(safebag = PKCS12_SAFEBAG_new ())) { + PKCS12err(PKCS12_F_PKCS12_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE); + return NULL; + } + safebag->value.bag = bag; + M_ASN1_OBJECT_set(safebag->type, nid2); + return safebag; +} + +/* Turn PKCS8 object into a keybag */ + +PKCS12_SAFEBAG *PKCS12_MAKE_KEYBAG (p8) +PKCS8_PRIV_KEY_INFO *p8; +{ + PKCS12_SAFEBAG *bag; + if (!(bag = PKCS12_SAFEBAG_new())) { + PKCS12err(PKCS12_F_PKCS12_MAKE_SAFEBAG, ERR_R_MALLOC_FAILURE); + return NULL; + } + M_ASN1_OBJECT_set(bag->type, NID_keyBag); + bag->value.keybag = p8; + return bag; +} + +/* Turn PKCS8 object into a shrouded keybag */ + +PKCS12_SAFEBAG + *PKCS12_MAKE_SHKEYBAG (pbe_nid, pass, passlen, salt, saltlen, iter, p8)int pbe_nid; +unsigned char *pass; +int passlen; +unsigned char *salt; +int saltlen; +int iter; +PKCS8_PRIV_KEY_INFO *p8; +{ + PKCS12_SAFEBAG *bag; + + /* Set up the safe bag */ + if (!(bag = PKCS12_SAFEBAG_new ())) { + PKCS12err(PKCS12_F_PKCS12_MAKE_SHKEYBAG, ERR_R_MALLOC_FAILURE); + return NULL; + } + + M_ASN1_OBJECT_set(bag->type, NID_pkcs8ShroudedKeyBag); + if (!(bag->value.shkeybag = + PKCS8_encrypt(pbe_nid, pass, passlen, salt, saltlen, iter, p8))) { + PKCS12err(PKCS12_F_PKCS12_MAKE_SHKEYBAG, ERR_R_MALLOC_FAILURE); + return NULL; + } + + return bag; +} + +/* Turn a stack of SAFEBAGS into a PKCS#7 data Contentinfo */ +PKCS7 *PKCS12_pack_p7data (sk) +STACK *sk; +{ + PKCS7 *p7; + if (!(p7 = PKCS7_new())) { + PKCS12err(PKCS12_F_PKCS12_PACK_P7_DATA, ERR_R_MALLOC_FAILURE); + return NULL; + } + M_ASN1_OBJECT_set(p7->type, NID_pkcs7_data); + if (!(p7->d.data = ASN1_OCTET_STRING_new())) { + PKCS12err(PKCS12_F_PKCS12_PACK_P7_DATA, ERR_R_MALLOC_FAILURE); + return NULL; + } + + if (!ASN1_seq_pack(sk, i2d_PKCS12_SAFEBAG, &p7->d.data->data, + &p7->d.data->length)) { + PKCS12err(PKCS12_F_PKCS12_PACK_P7DATA, PKCS12_R_CANT_PACK_STRUCTURE); + return NULL; + } + return p7; +} + +/* Turn a stack of SAFEBAGS into a PKCS#7 encrypted data ContentInfo */ + +PKCS7 *PKCS12_pack_p7encdata (pbe_nid, pass, passlen, salt, saltlen, iter, + bags) +int pbe_nid; +unsigned char *pass; +int passlen; +unsigned char *salt; +int saltlen; +int iter; +STACK *bags; +{ + PKCS7 *p7; + X509_ALGOR *pbe; + if (!(p7 = PKCS7_new())) { + PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE); + return NULL; + } + /* The next bit may end up in PKCS7_set_type eventually */ + M_ASN1_OBJECT_set(p7->type, NID_pkcs7_encrypted); + if (!(p7->d.encrypted = PKCS7_ENCRYPT_new ())) { + PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE); + return NULL; + } + ASN1_INTEGER_set (p7->d.encrypted->version, 0); + M_ASN1_OBJECT_set(p7->d.encrypted->enc_data->content_type, + NID_pkcs7_data); + if (!(pbe = PKCS5_pbe_set (pbe_nid, iter, salt, saltlen))) { + PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE); + return NULL; + } + X509_ALGOR_free(p7->d.encrypted->enc_data->algorithm); + p7->d.encrypted->enc_data->algorithm = pbe; + ASN1_OCTET_STRING_free(p7->d.encrypted->enc_data->enc_data); + if (!(p7->d.encrypted->enc_data->enc_data = + PKCS12_i2d_encrypt (pbe, i2d_PKCS12_SAFEBAG, pass, passlen, + (char *)bags, 1))) { + PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, PKCS12_R_ENCRYPT_ERROR); + return NULL; + } + + return p7; +} + +X509_SIG *PKCS8_encrypt (pbe_nid, pass, passlen, salt, saltlen, iter, p8inf) +int pbe_nid; +unsigned char *pass; +int passlen; +unsigned char *salt; +int saltlen; +int iter; +PKCS8_PRIV_KEY_INFO *p8inf; +{ + X509_SIG *p8; + X509_ALGOR *pbe; + + if (!(p8 = X509_SIG_new())) { + PKCS12err(PKCS12_F_PKCS8_ENCRYPT, ERR_R_MALLOC_FAILURE); + return NULL; + } + + if (!(pbe = PKCS5_pbe_set (pbe_nid, iter, salt, saltlen))) { + PKCS12err(PKCS12_F_PKCS8_ENCRYPT, ERR_R_MALLOC_FAILURE); + return NULL; + } + X509_ALGOR_free(p8->algor); + p8->algor = pbe; + ASN1_OCTET_STRING_free(p8->digest); + if (!(p8->digest = + PKCS12_i2d_encrypt (pbe, i2d_PKCS8_PRIV_KEY_INFO, pass, passlen, + (char *)p8inf, 0))) { + PKCS12err(PKCS12_F_PKCS8_ENCRYPT, PKCS12_R_ENCRYPT_ERROR); + return NULL; + } + + return p8; +} diff --git a/crypto/pkcs12/p12_attr.c b/crypto/pkcs12/p12_attr.c new file mode 100644 index 0000000000..f528742d39 --- /dev/null +++ b/crypto/pkcs12/p12_attr.c @@ -0,0 +1,244 @@ +/* p12_attr.c */ +/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL + * project 1999. + */ +/* ==================================================================== + * Copyright (c) 1999 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * licensing@OpenSSL.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <err.h> +#include "pkcs12.h" + +/* Add a local keyid to a safebag */ + +int PKCS12_add_localkeyid (bag, name, namelen) +PKCS12_SAFEBAG *bag; +unsigned char *name; +int namelen; +{ + X509_ATTRIBUTE *attrib; + ASN1_BMPSTRING *oct; + ASN1_TYPE *keyid; + if (!(keyid = ASN1_TYPE_new ())) { + PKCS12err(PKCS12_F_PKCS12_ADD_LOCALKEYID, ERR_R_MALLOC_FAILURE); + return 0; + } + keyid->type = V_ASN1_OCTET_STRING; + if (!(oct = ASN1_OCTET_STRING_new())) { + PKCS12err(PKCS12_F_PKCS12_ADD_LOCALKEYID, ERR_R_MALLOC_FAILURE); + return 0; + } + if (!ASN1_OCTET_STRING_set(oct, name, namelen)) { + PKCS12err(PKCS12_F_PKCS12_ADD_LOCALKEYID, ERR_R_MALLOC_FAILURE); + return 0; + } + keyid->value.octet_string = oct; + if (!(attrib = X509_ATTRIBUTE_new ())) { + PKCS12err(PKCS12_F_PKCS12_ADD_LOCALKEYID, ERR_R_MALLOC_FAILURE); + return 0; + } + M_ASN1_OBJECT_set(attrib->object, NID_localKeyID); + if (!(attrib->value.set = sk_new(NULL))) { + PKCS12err(PKCS12_F_PKCS12_ADD_LOCALKEYID, ERR_R_MALLOC_FAILURE); + return 0; + } + sk_push (attrib->value.set, (char *)keyid); + attrib->set = 1; + if (!bag->attrib && !(bag->attrib = sk_new (NULL))) { + PKCS12err(PKCS12_F_PKCS12_ADD_LOCALKEYID, ERR_R_MALLOC_FAILURE); + return 0; + } + sk_push (bag->attrib, (char *)attrib); + return 1; +} + +/* Add key usage to PKCS#8 structure */ + +int PKCS8_add_keyusage (p8, usage) +PKCS8_PRIV_KEY_INFO *p8; +int usage; +{ + X509_ATTRIBUTE *attrib; + ASN1_BIT_STRING *bstr; + ASN1_TYPE *keyid; + unsigned char us_val; + us_val = (unsigned char) usage; + if (!(keyid = ASN1_TYPE_new ())) { + PKCS12err(PKCS12_F_PKCS8_ADD_KEYUSAGE, ERR_R_MALLOC_FAILURE); + return 0; + } + keyid->type = V_ASN1_BIT_STRING; + if (!(bstr = ASN1_BIT_STRING_new())) { + PKCS12err(PKCS12_F_PKCS8_ADD_KEYUSAGE, ERR_R_MALLOC_FAILURE); + return 0; + } + if (!ASN1_BIT_STRING_set(bstr, &us_val, 1)) { + PKCS12err(PKCS12_F_PKCS8_ADD_KEYUSAGE, ERR_R_MALLOC_FAILURE); + return 0; + } + keyid->value.bit_string = bstr; + if (!(attrib = X509_ATTRIBUTE_new ())) { + PKCS12err(PKCS12_F_PKCS8_ADD_KEYUSAGE, ERR_R_MALLOC_FAILURE); + return 0; + } + M_ASN1_OBJECT_set(attrib->object, NID_key_usage); + if (!(attrib->value.set = sk_new(NULL))) { + PKCS12err(PKCS12_F_PKCS8_ADD_KEYUSAGE, ERR_R_MALLOC_FAILURE); + return 0; + } + sk_push (attrib->value.set, (char *)keyid); + attrib->set = 1; + if (!p8->attributes && !(p8->attributes = sk_new (NULL))) { + PKCS12err(PKCS12_F_PKCS8_ADD_KEYUSAGE, ERR_R_MALLOC_FAILURE); + return 0; + } + sk_push (p8->attributes, (char *)attrib); + return 1; +} + +/* Add a friendlyname to a safebag */ + +int PKCS12_add_friendlyname_asc (bag, name, namelen) +PKCS12_SAFEBAG *bag; +unsigned char *name; +int namelen; +{ + unsigned char *uniname; + int ret, unilen; + if (!asc2uni(name, &uniname, &unilen)) { + PKCS12err(PKCS12_F_ADD_FRIENDLYNAME_ASC,ERR_R_MALLOC_FAILURE); + return 0; + } + ret = PKCS12_add_friendlyname_uni (bag, uniname, unilen); + Free(uniname); + return ret; +} + + +int PKCS12_add_friendlyname_uni (bag, name, namelen) +PKCS12_SAFEBAG *bag; +unsigned char *name; +int namelen; +{ + X509_ATTRIBUTE *attrib; + ASN1_BMPSTRING *bmp; + ASN1_TYPE *fname; + /* Zap ending double null if included */ + if(!name[namelen - 1] && !name[namelen - 2]) namelen -= 2; + if (!(fname = ASN1_TYPE_new ())) { + PKCS12err(PKCS12_F_ADD_FRIENDLYNAME_UNI,ERR_R_MALLOC_FAILURE); + return 0; + } + fname->type = V_ASN1_BMPSTRING; + if (!(bmp = ASN1_BMPSTRING_new())) { + PKCS12err(PKCS12_F_ADD_FRIENDLYNAME_UNI,ERR_R_MALLOC_FAILURE); + return 0; + } + if (!(bmp->data = Malloc (namelen))) { + PKCS12err(PKCS12_F_ADD_FRIENDLYNAME_UNI,ERR_R_MALLOC_FAILURE); + return 0; + } + memcpy (bmp->data, name, namelen); + bmp->length = namelen; + fname->value.bmpstring = bmp; + if (!(attrib = X509_ATTRIBUTE_new ())) { + PKCS12err(PKCS12_F_ADD_FRIENDLYNAME_UNI,ERR_R_MALLOC_FAILURE); + return 0; + } + M_ASN1_OBJECT_set(attrib->object, NID_friendlyName); + if (!(attrib->value.set = sk_new(NULL))) { + PKCS12err(PKCS12_F_ADD_FRIENDLYNAME,ERR_R_MALLOC_FAILURE); + return 0; + } + sk_push (attrib->value.set, (char *)fname); + attrib->set = 1; + if (!bag->attrib && !(bag->attrib = sk_new (NULL))) { + PKCS12err(PKCS12_F_ADD_FRIENDLYNAME_UNI, ERR_R_MALLOC_FAILURE); + return 0; + } + sk_push (bag->attrib, (char *)attrib); + return PKCS12_OK; +} + +ASN1_TYPE *PKCS12_get_attr_gen (attrs, attr_nid) +STACK *attrs; +int attr_nid; +{ + X509_ATTRIBUTE *attrib; + int i; + if (!attrs) return NULL; + for (i = 0; i < sk_num (attrs); i++) { + attrib = (X509_ATTRIBUTE *) sk_value (attrs, i); + if (OBJ_obj2nid (attrib->object) == attr_nid) { + if (sk_num (attrib->value.set)) + return (ASN1_TYPE *) + sk_value (attrib->value.set, 0); + else return NULL; + } + } + return NULL; +} + +char *PKCS12_get_friendlyname(bag) +PKCS12_SAFEBAG *bag; +{ + ASN1_TYPE *atype; + if (!(atype = PKCS12_get_attr(bag, NID_friendlyName))) return NULL; + if (atype->type != V_ASN1_BMPSTRING) return NULL; + return uni2asc(atype->value.bmpstring->data, + atype->value.bmpstring->length); +} + diff --git a/crypto/pkcs12/p12_bags.c b/crypto/pkcs12/p12_bags.c new file mode 100644 index 0000000000..60d12fb0f2 --- /dev/null +++ b/crypto/pkcs12/p12_bags.c @@ -0,0 +1,203 @@ +/* p12_bags.c */ +/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL + * project 1999. + */ +/* ==================================================================== + * Copyright (c) 1999 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * licensing@OpenSSL.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ + +#include <stdio.h> +#include <stdlib.h> +#include <asn1_mac.h> +#include <err.h> +#include "pkcs12.h" |