From 8d8c7266d4de9887fb0190a0770df9dc254a16a3 Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Sun, 28 Mar 1999 23:17:34 +0000 Subject: Yet more PKCS#12 integration: add lots of files under crypto/pkcs12 and add them to the build environment. --- crypto/pkcs12/Makefile.ssl | 91 ++++++++++ crypto/pkcs12/p12_add.c | 236 ++++++++++++++++++++++++++ crypto/pkcs12/p12_attr.c | 244 +++++++++++++++++++++++++++ crypto/pkcs12/p12_bags.c | 203 ++++++++++++++++++++++ crypto/pkcs12/p12_crpt.c | 104 ++++++++++++ crypto/pkcs12/p12_crt.c | 170 +++++++++++++++++++ crypto/pkcs12/p12_decr.c | 206 +++++++++++++++++++++++ crypto/pkcs12/p12_init.c | 102 ++++++++++++ crypto/pkcs12/p12_key.c | 190 +++++++++++++++++++++ crypto/pkcs12/p12_kiss.c | 269 ++++++++++++++++++++++++++++++ crypto/pkcs12/p12_lib.c | 123 ++++++++++++++ crypto/pkcs12/p12_mac.c | 120 +++++++++++++ crypto/pkcs12/p12_mutl.c | 187 +++++++++++++++++++++ crypto/pkcs12/p12_sbag.c | 238 ++++++++++++++++++++++++++ crypto/pkcs12/p12_utl.c | 140 ++++++++++++++++ crypto/pkcs12/pk12err.c | 136 +++++++++++++++ crypto/pkcs12/pkcs12.err | 52 ++++++ crypto/pkcs12/pkcs12.h | 407 +++++++++++++++++++++++++++++++++++++++++++++ 18 files changed, 3218 insertions(+) create mode 100644 crypto/pkcs12/Makefile.ssl create mode 100644 crypto/pkcs12/p12_add.c create mode 100644 crypto/pkcs12/p12_attr.c create mode 100644 crypto/pkcs12/p12_bags.c create mode 100644 crypto/pkcs12/p12_crpt.c create mode 100644 crypto/pkcs12/p12_crt.c create mode 100644 crypto/pkcs12/p12_decr.c create mode 100644 crypto/pkcs12/p12_init.c create mode 100644 crypto/pkcs12/p12_key.c create mode 100644 crypto/pkcs12/p12_kiss.c create mode 100644 crypto/pkcs12/p12_lib.c create mode 100644 crypto/pkcs12/p12_mac.c create mode 100644 crypto/pkcs12/p12_mutl.c create mode 100644 crypto/pkcs12/p12_sbag.c create mode 100644 crypto/pkcs12/p12_utl.c create mode 100644 crypto/pkcs12/pk12err.c create mode 100644 crypto/pkcs12/pkcs12.err create mode 100644 crypto/pkcs12/pkcs12.h (limited to 'crypto/pkcs12') diff --git a/crypto/pkcs12/Makefile.ssl b/crypto/pkcs12/Makefile.ssl new file mode 100644 index 0000000000..a53e1c425f --- /dev/null +++ b/crypto/pkcs12/Makefile.ssl @@ -0,0 +1,91 @@ +# +# SSLeay/crypto/asn1/Makefile +# + +DIR= pkcs12 +TOP= ../.. +CC= cc +INCLUDES= -I.. -I../../include +CFLAG=-g +INSTALLTOP=/usr/local/ssl +MAKE= make -f Makefile.ssl +MAKEDEPEND= $(TOP)/util/domd $(TOP) +MAKEFILE= Makefile.ssl +AR= ar r + +CFLAGS= $(INCLUDES) $(CFLAG) + +ERR=pkcs12 +ERRC=pk12err +GENERAL=Makefile +TEST= +APPS= + +LIB=$(TOP)/libcrypto.a +LIBSRC= p12_add.c p12_attr.c p12_bags.c p12_crpt.c p12_crt.c p12_decr.c \ + p12_init.c p12_key.c p12_kiss.c p12_lib.c p12_mac.c p12_mutl.c\ + p12_sbag.c p12_utl.c pk12err.c +LIBOBJ= p12_add.o p12_attr.o p12_bags.o p12_crpt.o p12_crt.o p12_decr.o \ + p12_init.o p12_key.o p12_kiss.o p12_lib.o p12_mac.o p12_mutl.o\ + p12_sbag.o p12_utl.o pk12err.o + +SRC= $(LIBSRC) + +EXHEADER= pkcs12.h +HEADER= $(EXHEADER) + +ALL= $(GENERAL) $(SRC) $(HEADER) + +top: + (cd ../..; $(MAKE) DIRS=crypto SDIRS=$(DIR) sub_all) + +test: + +all: lib + +lib: $(LIBOBJ) + $(AR) $(LIB) $(LIBOBJ) + sh $(TOP)/util/ranlib.sh $(LIB) + @touch lib + +files: + perl $(TOP)/util/files.pl Makefile.ssl >> $(TOP)/MINFO + +links: + @$(TOP)/util/point.sh Makefile.ssl Makefile + @$(TOP)/util/mklink.sh ../../include $(EXHEADER) + @$(TOP)/util/mklink.sh ../../test $(TEST) + @$(TOP)/util/mklink.sh ../../apps $(APPS) + +install: + @for i in $(EXHEADER) ; \ + do \ + (cp $$i $(INSTALLTOP)/include/$$i; \ + chmod 644 $(INSTALLTOP)/include/$$i ); \ + done; + +tags: + ctags $(SRC) + +tests: + +lint: + lint -DLINT $(INCLUDES) $(SRC)>fluff + +depend: + $(MAKEDEPEND) $(INCLUDES) $(PROGS) $(LIBSRC) + +dclean: + perl -pe 'if (/^# DO NOT DELETE THIS LINE/) {print; exit(0);}' $(MAKEFILE) >Makefile.new + mv -f Makefile.new $(MAKEFILE) + +clean: + rm -f *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff + +errors: $(ERRC).c + +$(ERRC).c: $(ERR).err + perl $(TOP)/util/err-ins.pl $(ERR).err $(ERR).h + perl ../err/err_genc.pl -s $(ERR).h $(ERRC).c + +# DO NOT DELETE THIS LINE -- make depend depends on it. diff --git a/crypto/pkcs12/p12_add.c b/crypto/pkcs12/p12_add.c new file mode 100644 index 0000000000..2022b953f5 --- /dev/null +++ b/crypto/pkcs12/p12_add.c @@ -0,0 +1,236 @@ +/* p12_add.c */ +/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL + * project 1999. + */ +/* ==================================================================== + * Copyright (c) 1999 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * licensing@OpenSSL.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ + +#include +#include +#include +#include "pkcs12.h" + +/* Pack an object into an OCTET STRING and turn into a safebag */ + +PKCS12_SAFEBAG *PKCS12_pack_safebag (obj, i2d, nid1, nid2) +char *obj; +int (*i2d)(); +int nid1; +int nid2; + +{ + PKCS12_BAGS *bag; + PKCS12_SAFEBAG *safebag; + if (!(bag = PKCS12_BAGS_new ())) { + PKCS12err(PKCS12_F_PKCS12_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE); + return NULL; + } + M_ASN1_OBJECT_set(bag->type, nid1); + if (!ASN1_pack_string(obj, i2d, &bag->value.octet)) { + PKCS12err(PKCS12_F_PKCS12_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE); + return NULL; + } + if (!(safebag = PKCS12_SAFEBAG_new ())) { + PKCS12err(PKCS12_F_PKCS12_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE); + return NULL; + } + safebag->value.bag = bag; + M_ASN1_OBJECT_set(safebag->type, nid2); + return safebag; +} + +/* Turn PKCS8 object into a keybag */ + +PKCS12_SAFEBAG *PKCS12_MAKE_KEYBAG (p8) +PKCS8_PRIV_KEY_INFO *p8; +{ + PKCS12_SAFEBAG *bag; + if (!(bag = PKCS12_SAFEBAG_new())) { + PKCS12err(PKCS12_F_PKCS12_MAKE_SAFEBAG, ERR_R_MALLOC_FAILURE); + return NULL; + } + M_ASN1_OBJECT_set(bag->type, NID_keyBag); + bag->value.keybag = p8; + return bag; +} + +/* Turn PKCS8 object into a shrouded keybag */ + +PKCS12_SAFEBAG + *PKCS12_MAKE_SHKEYBAG (pbe_nid, pass, passlen, salt, saltlen, iter, p8)int pbe_nid; +unsigned char *pass; +int passlen; +unsigned char *salt; +int saltlen; +int iter; +PKCS8_PRIV_KEY_INFO *p8; +{ + PKCS12_SAFEBAG *bag; + + /* Set up the safe bag */ + if (!(bag = PKCS12_SAFEBAG_new ())) { + PKCS12err(PKCS12_F_PKCS12_MAKE_SHKEYBAG, ERR_R_MALLOC_FAILURE); + return NULL; + } + + M_ASN1_OBJECT_set(bag->type, NID_pkcs8ShroudedKeyBag); + if (!(bag->value.shkeybag = + PKCS8_encrypt(pbe_nid, pass, passlen, salt, saltlen, iter, p8))) { + PKCS12err(PKCS12_F_PKCS12_MAKE_SHKEYBAG, ERR_R_MALLOC_FAILURE); + return NULL; + } + + return bag; +} + +/* Turn a stack of SAFEBAGS into a PKCS#7 data Contentinfo */ +PKCS7 *PKCS12_pack_p7data (sk) +STACK *sk; +{ + PKCS7 *p7; + if (!(p7 = PKCS7_new())) { + PKCS12err(PKCS12_F_PKCS12_PACK_P7_DATA, ERR_R_MALLOC_FAILURE); + return NULL; + } + M_ASN1_OBJECT_set(p7->type, NID_pkcs7_data); + if (!(p7->d.data = ASN1_OCTET_STRING_new())) { + PKCS12err(PKCS12_F_PKCS12_PACK_P7_DATA, ERR_R_MALLOC_FAILURE); + return NULL; + } + + if (!ASN1_seq_pack(sk, i2d_PKCS12_SAFEBAG, &p7->d.data->data, + &p7->d.data->length)) { + PKCS12err(PKCS12_F_PKCS12_PACK_P7DATA, PKCS12_R_CANT_PACK_STRUCTURE); + return NULL; + } + return p7; +} + +/* Turn a stack of SAFEBAGS into a PKCS#7 encrypted data ContentInfo */ + +PKCS7 *PKCS12_pack_p7encdata (pbe_nid, pass, passlen, salt, saltlen, iter, + bags) +int pbe_nid; +unsigned char *pass; +int passlen; +unsigned char *salt; +int saltlen; +int iter; +STACK *bags; +{ + PKCS7 *p7; + X509_ALGOR *pbe; + if (!(p7 = PKCS7_new())) { + PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE); + return NULL; + } + /* The next bit may end up in PKCS7_set_type eventually */ + M_ASN1_OBJECT_set(p7->type, NID_pkcs7_encrypted); + if (!(p7->d.encrypted = PKCS7_ENCRYPT_new ())) { + PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE); + return NULL; + } + ASN1_INTEGER_set (p7->d.encrypted->version, 0); + M_ASN1_OBJECT_set(p7->d.encrypted->enc_data->content_type, + NID_pkcs7_data); + if (!(pbe = PKCS5_pbe_set (pbe_nid, iter, salt, saltlen))) { + PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE); + return NULL; + } + X509_ALGOR_free(p7->d.encrypted->enc_data->algorithm); + p7->d.encrypted->enc_data->algorithm = pbe; + ASN1_OCTET_STRING_free(p7->d.encrypted->enc_data->enc_data); + if (!(p7->d.encrypted->enc_data->enc_data = + PKCS12_i2d_encrypt (pbe, i2d_PKCS12_SAFEBAG, pass, passlen, + (char *)bags, 1))) { + PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, PKCS12_R_ENCRYPT_ERROR); + return NULL; + } + + return p7; +} + +X509_SIG *PKCS8_encrypt (pbe_nid, pass, passlen, salt, saltlen, iter, p8inf) +int pbe_nid; +unsigned char *pass; +int passlen; +unsigned char *salt; +int saltlen; +int iter; +PKCS8_PRIV_KEY_INFO *p8inf; +{ + X509_SIG *p8; + X509_ALGOR *pbe; + + if (!(p8 = X509_SIG_new())) { + PKCS12err(PKCS12_F_PKCS8_ENCRYPT, ERR_R_MALLOC_FAILURE); + return NULL; + } + + if (!(pbe = PKCS5_pbe_set (pbe_nid, iter, salt, saltlen))) { + PKCS12err(PKCS12_F_PKCS8_ENCRYPT, ERR_R_MALLOC_FAILURE); + return NULL; + } + X509_ALGOR_free(p8->algor); + p8->algor = pbe; + ASN1_OCTET_STRING_free(p8->digest); + if (!(p8->digest = + PKCS12_i2d_encrypt (pbe, i2d_PKCS8_PRIV_KEY_INFO, pass, passlen, + (char *)p8inf, 0))) { + PKCS12err(PKCS12_F_PKCS8_ENCRYPT, PKCS12_R_ENCRYPT_ERROR); + return NULL; + } + + return p8; +} diff --git a/crypto/pkcs12/p12_attr.c b/crypto/pkcs12/p12_attr.c new file mode 100644 index 0000000000..f528742d39 --- /dev/null +++ b/crypto/pkcs12/p12_attr.c @@ -0,0 +1,244 @@ +/* p12_attr.c */ +/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL + * project 1999. + */ +/* ==================================================================== + * Copyright (c) 1999 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * licensing@OpenSSL.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ + +#include +#include +#include +#include +#include "pkcs12.h" + +/* Add a local keyid to a safebag */ + +int PKCS12_add_localkeyid (bag, name, namelen) +PKCS12_SAFEBAG *bag; +unsigned char *name; +int namelen; +{ + X509_ATTRIBUTE *attrib; + ASN1_BMPSTRING *oct; + ASN1_TYPE *keyid; + if (!(keyid = ASN1_TYPE_new ())) { + PKCS12err(PKCS12_F_PKCS12_ADD_LOCALKEYID, ERR_R_MALLOC_FAILURE); + return 0; + } + keyid->type = V_ASN1_OCTET_STRING; + if (!(oct = ASN1_OCTET_STRING_new())) { + PKCS12err(PKCS12_F_PKCS12_ADD_LOCALKEYID, ERR_R_MALLOC_FAILURE); + return 0; + } + if (!ASN1_OCTET_STRING_set(oct, name, namelen)) { + PKCS12err(PKCS12_F_PKCS12_ADD_LOCALKEYID, ERR_R_MALLOC_FAILURE); + return 0; + } + keyid->value.octet_string = oct; + if (!(attrib = X509_ATTRIBUTE_new ())) { + PKCS12err(PKCS12_F_PKCS12_ADD_LOCALKEYID, ERR_R_MALLOC_FAILURE); + return 0; + } + M_ASN1_OBJECT_set(attrib->object, NID_localKeyID); + if (!(attrib->value.set = sk_new(NULL))) { + PKCS12err(PKCS12_F_PKCS12_ADD_LOCALKEYID, ERR_R_MALLOC_FAILURE); + return 0; + } + sk_push (attrib->value.set, (char *)keyid); + attrib->set = 1; + if (!bag->attrib && !(bag->attrib = sk_new (NULL))) { + PKCS12err(PKCS12_F_PKCS12_ADD_LOCALKEYID, ERR_R_MALLOC_FAILURE); + return 0; + } + sk_push (bag->attrib, (char *)attrib); + return 1; +} + +/* Add key usage to PKCS#8 structure */ + +int PKCS8_add_keyusage (p8, usage) +PKCS8_PRIV_KEY_INFO *p8; +int usage; +{ + X509_ATTRIBUTE *attrib; + ASN1_BIT_STRING *bstr; + ASN1_TYPE *keyid; + unsigned char us_val; + us_val = (unsigned char) usage; + if (!(keyid = ASN1_TYPE_new ())) { + PKCS12err(PKCS12_F_PKCS8_ADD_KEYUSAGE, ERR_R_MALLOC_FAILURE); + return 0; + } + keyid->type = V_ASN1_BIT_STRING; + if (!(bstr = ASN1_BIT_STRING_new())) { + PKCS12err(PKCS12_F_PKCS8_ADD_KEYUSAGE, ERR_R_MALLOC_FAILURE); + return 0; + } + if (!ASN1_BIT_STRING_set(bstr, &us_val, 1)) { + PKCS12err(PKCS12_F_PKCS8_ADD_KEYUSAGE, ERR_R_MALLOC_FAILURE); + return 0; + } + keyid->value.bit_string = bstr; + if (!(attrib = X509_ATTRIBUTE_new ())) { + PKCS12err(PKCS12_F_PKCS8_ADD_KEYUSAGE, ERR_R_MALLOC_FAILURE); + return 0; + } + M_ASN1_OBJECT_set(attrib->object, NID_key_usage); + if (!(attrib->value.set = sk_new(NULL))) { + PKCS12err(PKCS12_F_PKCS8_ADD_KEYUSAGE, ERR_R_MALLOC_FAILURE); + return 0; + } + sk_push (attrib->value.set, (char *)keyid); + attrib->set = 1; + if (!p8->attributes && !(p8->attributes = sk_new (NULL))) { + PKCS12err(PKCS12_F_PKCS8_ADD_KEYUSAGE, ERR_R_MALLOC_FAILURE); + return 0; + } + sk_push (p8->attributes, (char *)attrib); + return 1; +} + +/* Add a friendlyname to a safebag */ + +int PKCS12_add_friendlyname_asc (bag, name, namelen) +PKCS12_SAFEBAG *bag; +unsigned char *name; +int namelen; +{ + unsigned char *uniname; + int ret, unilen; + if (!asc2uni(name, &uniname, &unilen)) { + PKCS12err(PKCS12_F_ADD_FRIENDLYNAME_ASC,ERR_R_MALLOC_FAILURE); + return 0; + } + ret = PKCS12_add_friendlyname_uni (bag, uniname, unilen); + Free(uniname); + return ret; +} + + +int PKCS12_add_friendlyname_uni (bag, name, namelen) +PKCS12_SAFEBAG *bag; +unsigned char *name; +int namelen; +{ + X509_ATTRIBUTE *attrib; + ASN1_BMPSTRING *bmp; + ASN1_TYPE *fname; + /* Zap ending double null if included */ + if(!name[namelen - 1] && !name[namelen - 2]) namelen -= 2; + if (!(fname = ASN1_TYPE_new ())) { + PKCS12err(PKCS12_F_ADD_FRIENDLYNAME_UNI,ERR_R_MALLOC_FAILURE); + return 0; + } + fname->type = V_ASN1_BMPSTRING; + if (!(bmp = ASN1_BMPSTRING_new())) { + PKCS12err(PKCS12_F_ADD_FRIENDLYNAME_UNI,ERR_R_MALLOC_FAILURE); + return 0; + } + if (!(bmp->data = Malloc (namelen))) { + PKCS12err(PKCS12_F_ADD_FRIENDLYNAME_UNI,ERR_R_MALLOC_FAILURE); + return 0; + } + memcpy (bmp->data, name, namelen); + bmp->length = namelen; + fname->value.bmpstring = bmp; + if (!(attrib = X509_ATTRIBUTE_new ())) { + PKCS12err(PKCS12_F_ADD_FRIENDLYNAME_UNI,ERR_R_MALLOC_FAILURE); + return 0; + } + M_ASN1_OBJECT_set(attrib->object, NID_friendlyName); + if (!(attrib->value.set = sk_new(NULL))) { + PKCS12err(PKCS12_F_ADD_FRIENDLYNAME,ERR_R_MALLOC_FAILURE); + return 0; + } + sk_push (attrib->value.set, (char *)fname); + attrib->set = 1; + if (!bag->attrib && !(bag->attrib = sk_new (NULL))) { + PKCS12err(PKCS12_F_ADD_FRIENDLYNAME_UNI, ERR_R_MALLOC_FAILURE); + return 0; + } + sk_push (bag->attrib, (char *)attrib); + return PKCS12_OK; +} + +ASN1_TYPE *PKCS12_get_attr_gen (attrs, attr_nid) +STACK *attrs; +int attr_nid; +{ + X509_ATTRIBUTE *attrib; + int i; + if (!attrs) return NULL; + for (i = 0; i < sk_num (attrs); i++) { + attrib = (X509_ATTRIBUTE *) sk_value (attrs, i); + if (OBJ_obj2nid (attrib->object) == attr_nid) { + if (sk_num (attrib->value.set)) + return (ASN1_TYPE *) + sk_value (attrib->value.set, 0); + else return NULL; + } + } + return NULL; +} + +char *PKCS12_get_friendlyname(bag) +PKCS12_SAFEBAG *bag; +{ + ASN1_TYPE *atype; + if (!(atype = PKCS12_get_attr(bag, NID_friendlyName))) return NULL; + if (atype->type != V_ASN1_BMPSTRING) return NULL; + return uni2asc(atype->value.bmpstring->data, + atype->value.bmpstring->length); +} + diff --git a/crypto/pkcs12/p12_bags.c b/crypto/pkcs12/p12_bags.c new file mode 100644 index 0000000000..60d12fb0f2 --- /dev/null +++ b/crypto/pkcs12/p12_bags.c @@ -0,0 +1,203 @@ +/* p12_bags.c */ +/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL + * project 1999. + */ +/* ==================================================================== + * Copyright (c) 1999 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * licensing@OpenSSL.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ + +#include +#include +#include +#include +#include "pkcs12.h" + +/* + *ASN1err(ASN1_F_PKCS12_BAGS_NEW,ASN1_R_DECODE_ERROR) + *ASN1err(ASN1_F_D2I_PKCS12_BAGS,ASN1_R_DECODE_ERROR) + */ + +int i2d_PKCS12_BAGS(a,pp) +PKCS12_BAGS *a; +unsigned char **pp; +{ + int bagnid, v = 0; + M_ASN1_I2D_vars(a); + bagnid = OBJ_obj2nid (a->type); + M_ASN1_I2D_len (a->type, i2d_ASN1_OBJECT); + + switch (bagnid) { + + case NID_x509Certificate: + M_ASN1_I2D_len_EXP_opt (a->value.x509cert, + i2d_ASN1_OCTET_STRING, 0, v); + break; + + case NID_x509Crl: + M_ASN1_I2D_len_EXP_opt (a->value.x509crl, + i2d_ASN1_OCTET_STRING, 0, v); + break; + + case NID_sdsiCertificate: + M_ASN1_I2D_len_EXP_opt (a->value.sdsicert, + i2d_ASN1_IA5STRING, 0, v); + break; + + default: + M_ASN1_I2D_len_EXP_opt (a->value.other, + i2d_ASN1_TYPE, 0, v); + break; + } + + M_ASN1_I2D_seq_total (); + + M_ASN1_I2D_put (a->type, i2d_ASN1_OBJECT); + + switch (bagnid) { + + case NID_x509Certificate: + M_ASN1_I2D_put_EXP_opt (a->value.x509cert, + i2d_ASN1_OCTET_STRING, 0, v); + break; + + case NID_x509Crl: + M_ASN1_I2D_put_EXP_opt (a->value.x509crl, + i2d_ASN1_OCTET_STRING, 0, v); + break; + + case NID_sdsiCertificate: + M_ASN1_I2D_put_EXP_opt (a->value.sdsicert, + i2d_ASN1_IA5STRING, 0, v); + break; + + default: + M_ASN1_I2D_put_EXP_opt (a->value.other, i2d_ASN1_TYPE, 0, v); + break; + } + M_ASN1_I2D_finish(); +} + +PKCS12_BAGS *PKCS12_BAGS_new() +{ + PKCS12_BAGS *ret=NULL; + ASN1_CTX c; + M_ASN1_New_Malloc(ret, PKCS12_BAGS); + ret->type=NULL; + ret->value.other=NULL; + return (ret); + M_ASN1_New_Error(ASN1_F_PKCS12_BAGS_NEW); +} + +PKCS12_BAGS *d2i_PKCS12_BAGS(a,pp,length) +PKCS12_BAGS **a; +unsigned char **pp; +long length; +{ + int bagnid; + M_ASN1_D2I_vars(a,PKCS12_BAGS *,PKCS12_BAGS_new); + M_ASN1_D2I_Init(); + M_ASN1_D2I_start_sequence(); + M_ASN1_D2I_get (ret->type, d2i_ASN1_OBJECT); + bagnid = OBJ_obj2nid (ret->type); + switch (bagnid) { + + case NID_x509Certificate: + M_ASN1_D2I_get_EXP_opt (ret->value.x509cert, + d2i_ASN1_OCTET_STRING, 0); + break; + + case NID_x509Crl: + M_ASN1_D2I_get_EXP_opt (ret->value.x509crl, + d2i_ASN1_OCTET_STRING, 0); + break; + + case NID_sdsiCertificate: + M_ASN1_D2I_get_EXP_opt (ret->value.sdsicert, + d2i_ASN1_IA5STRING, 0); + break; + + default: + M_ASN1_D2I_get_EXP_opt (ret->value.other, + d2i_ASN1_TYPE, 0); + break; + } + + M_ASN1_D2I_Finish(a, PKCS12_BAGS_free, ASN1_F_D2I_PKCS12_BAGS); +} + +void PKCS12_BAGS_free (a) +PKCS12_BAGS *a; +{ + if (a == NULL) return; + switch (OBJ_obj2nid(a->type)) { + + case NID_x509Certificate: + ASN1_OCTET_STRING_free (a->value.x509cert); + break; + + case NID_x509Crl: + ASN1_OCTET_STRING_free (a->value.x509crl); + break; + + case NID_sdsiCertificate: + ASN1_IA5STRING_free (a->value.sdsicert); + break; + + default: + ASN1_TYPE_free (a->value.other); + break; + } + + ASN1_OBJECT_free (a->type); + Free ((char *)a); +} diff --git a/crypto/pkcs12/p12_crpt.c b/crypto/pkcs12/p12_crpt.c new file mode 100644 index 0000000000..96c551e074 --- /dev/null +++ b/crypto/pkcs12/p12_crpt.c @@ -0,0 +1,104 @@ +/* p12_crpt.c */ +/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL + * project 1999. + */ +/* ==================================================================== + * Copyright (c) 1999 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * licensing@OpenSSL.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ + +#include +#include +#include +#include "pkcs12.h" + +/* PKCS#12 specific PBE functions */ + +void PKCS12_PBE_add() +{ +EVP_PBE_alg_add(NID_pbe_WithSHA1And128BitRC4, EVP_rc4(), EVP_sha1(), + PKCS12_PBE_keyivgen); +EVP_PBE_alg_add(NID_pbe_WithSHA1And40BitRC4, EVP_rc4_40(), EVP_sha1(), + PKCS12_PBE_keyivgen); +EVP_PBE_alg_add(NID_pbe_WithSHA1And3_Key_TripleDES_CBC, + EVP_des_ede3_cbc(), EVP_sha1(), PKCS12_PBE_keyivgen); +EVP_PBE_alg_add(NID_pbe_WithSHA1And2_Key_TripleDES_CBC, + EVP_des_ede_cbc(), EVP_sha1(), PKCS12_PBE_keyivgen); +EVP_PBE_alg_add(NID_pbe_WithSHA1And128BitRC2_CBC, EVP_rc2_cbc(), + EVP_sha1(), PKCS12_PBE_keyivgen); +EVP_PBE_alg_add(NID_pbe_WithSHA1And40BitRC2_CBC, EVP_rc2_40_cbc(), + EVP_sha1(), PKCS12_PBE_keyivgen); +} + +int PKCS12_PBE_keyivgen (pass, passlen, salt, saltlen, iter, cipher, + md, key, iv) +unsigned char *pass; +int passlen; +unsigned char *salt; +int saltlen; +int iter; +EVP_CIPHER *cipher; +EVP_MD *md; +unsigned char *key, *iv; +{ + if (!PKCS12_key_gen (pass, passlen, salt, saltlen, PKCS12_KEY_ID, + iter, EVP_CIPHER_key_length(cipher), key, md)) { + PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN,PKCS12_R_KEY_GEN_ERROR); + return 0; + } + if (!PKCS12_key_gen (pass, passlen, salt, saltlen, PKCS12_IV_ID, + iter, EVP_CIPHER_iv_length(cipher), iv, md)) { + PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN,PKCS12_R_IV_GEN_ERROR); + return 0; + } + return 1; +} diff --git a/crypto/pkcs12/p12_crt.c b/crypto/pkcs12/p12_crt.c new file mode 100644 index 0000000000..f2e0aac347 --- /dev/null +++ b/crypto/pkcs12/p12_crt.c @@ -0,0 +1,170 @@ +/* p12_crt.c */ +/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL + * project 1999. + */ +/* ==================================================================== + * Copyright (c) 1999 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * licensing@OpenSSL.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ + +#include +#include +#include +#include +#include +#include "pkcs12.h" + +PKCS12 *PKCS12_create(pass, name, pkey, cert, ca, nid_key, nid_cert, iter, + mac_iter, keytype) +char *pass; +char *name; +EVP_PKEY *pkey; +X509 *cert; +STACK *ca; +int nid_key; +int nid_cert; +int iter; +int mac_iter; +int keytype; +{ + PKCS12 *p12; + STACK *bags, *safes; + PKCS12_SAFEBAG *bag; + PKCS8_PRIV_KEY_INFO *p8; + PKCS7 *authsafe; + X509 *tcert; + int i; + unsigned char keyid[EVP_MAX_MD_SIZE]; + int keyidlen; + + /* Set defaults */ + if(!nid_cert) nid_cert = NID_pbe_WithSHA1And40BitRC2_CBC; + if(!nid_key) nid_key = NID_pbe_WithSHA1And3_Key_TripleDES_CBC; + if(!iter) iter = 1000; + if(!mac_iter) mac_iter = 1; + + if(!pkey || !cert) { + PKCS12err(PKCS12_F_PKCS12_CREATE,PKCS12_R_INVALID_NULL_ARGUMENT); + return NULL; + } + + if(!(bags = sk_new (NULL))) { + PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE); + return NULL; + } + + /* Add user certificate */ + if(!(bag = M_PKCS12_x5092certbag(cert))) return NULL; + if(name && !PKCS12_add_friendlyname(bag, name, -1)) return NULL; + X509_digest(cert, EVP_sha1(), keyid, &keyidlen); + if(!PKCS12_add_localkeyid(bag, keyid, keyidlen)) return NULL; + + if(!sk_push(bags, (char *)bag)) { + PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE); + return NULL; + } + + /* Add all other certificates */ + if(ca) { + for(i = 0; i < sk_num(ca); i++) { + tcert = (X509 *)sk_value(ca, i); + if(!(bag = M_PKCS12_x5092certbag(tcert))) return NULL; + if(!sk_push(bags, (char *)bag)) { + PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE); + return NULL; + } + } + } + + /* Turn certbags into encrypted authsafe */ + authsafe = PKCS12_pack_p7encdata (nid_cert, pass, -1, NULL, 0, + iter, bags); + sk_pop_free(bags, PKCS12_SAFEBAG_free); + + if (!authsafe) return NULL; + + if(!(safes = sk_new (NULL)) || !sk_push(safes, (char *)authsafe)) { + PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE); + return NULL; + } + + /* Make a shrouded key bag */ + if(!(p8 = EVP_PKEY2PKCS8 (pkey))) return NULL; + if(keytype && !PKCS8_add_keyusage(p8, keytype)) return NULL; + bag = PKCS12_MAKE_SHKEYBAG (nid_key, pass, -1, NULL, 0, iter, p8); + if(!bag) return NULL; + PKCS8_PRIV_KEY_INFO_free(p8); + if (name && !PKCS12_add_friendlyname (bag, name, -1)) return NULL; + if(!PKCS12_add_localkeyid (bag, keyid, keyidlen)) return NULL; + if(!(bags = sk_new(NULL)) || !sk_push (bags, (char *)bag)) { + PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE); + return NULL; + } + /* Turn it into unencrypted safe bag */ + if(!(authsafe = PKCS12_pack_p7data (bags))) return NULL; + sk_pop_free(bags, PKCS12_SAFEBAG_free); + if(!sk_push(safes, (char *)authsafe)) { + PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE); + return NULL; + } + + if(!(p12 = PKCS12_init (NID_pkcs7_data))) return NULL; + + if(!M_PKCS12_pack_authsafes (p12, safes)) return NULL; + + sk_pop_free(safes, PKCS7_free); + + if(!PKCS12_set_mac (p12, pass, -1, NULL, 0, mac_iter, NULL)) return NULL; + + return p12; + +} diff --git a/crypto/pkcs12/p12_decr.c b/crypto/pkcs12/p12_decr.c new file mode 100644 index 0000000000..c4af4fa84b --- /dev/null +++ b/crypto/pkcs12/p12_decr.c @@ -0,0 +1,206 @@ +/* p12_decr.c */ +/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL + * project 1999. + */ +/* ==================================================================== + * Copyright (c) 1999 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * licensing@OpenSSL.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include "hmac.h" +#include "pkcs12.h" + +/* Define this to dump decrypted output to files called DERnnn */ +/*#define DEBUG_DECRYPT*/ + + +/* Encrypt/Decrypt a buffer based on password and algor, result in a + * Malloc'ed buffer + */ + +unsigned char * PKCS12_pbe_crypt (algor, pass, passlen, in, inlen, + data, datalen, en_de) +X509_ALGOR *algor; +unsigned char *pass; +int passlen; +unsigned char *in; +int inlen; +unsigned char **data; +int *datalen; +int en_de; +{ + unsigned char *out; + int outlen, i; + EVP_CIPHER_CTX ctx; + + if(!(out = Malloc (inlen + 8))) { + PKCS12err(PKCS12_F_PKCS12_PBE_CRYPT,ERR_R_MALLOC_FAILURE); + return NULL; + } + + /* Decrypt data */ + if (!EVP_PBE_ALGOR_CipherInit (algor, pass, passlen, &ctx, en_de)) { + PKCS12err(PKCS12_F_PKCS12_PBE_CRYPT,PKCS12_R_PKCS12_ALGOR_CIPHERINIT_ERROR); + return NULL; + } + EVP_CipherUpdate (&ctx, out, &i, in, inlen); + outlen = i; + if(!EVP_CipherFinal (&ctx, out + i, &i)) { + Free (out); + PKCS12err(PKCS12_F_PKCS12_PBE_CRYPT,PKCS12_R_PKCS12_CIPHERFINAL_ERROR); + return NULL; + } + outlen += i; + if (datalen) *datalen = outlen; + if (data) *data = out; + return out; + +} + +/* Decrypt an OCTET STRING and decode ASN1 structure + * if seq & 1 'obj' is a stack of structures to be encoded + * if seq & 2 zero buffer after use + * as a sequence. + */ + +char * PKCS12_decrypt_d2i (algor, d2i, free_func, pass, passlen, oct, seq) +X509_ALGOR *algor; +char * (*d2i)(); +void (*free_func)(); +unsigned char *pass; +int passlen; +ASN1_OCTET_STRING *oct; +int seq; +{ + unsigned char *out, *p, *ret; + int outlen; + if (!PKCS12_pbe_crypt (algor, pass, passlen, oct->data, oct->length, + &out, &outlen, 0)) { + PKCS12err(PKCS12_F_PKCS12_DECRYPT_D2I,PKCS12_R_PKCS12_PBE_CRYPT_ERROR); + return NULL; + } + p = out; +#ifdef DEBUG_DECRYPT + { + FILE *op; + + char fname[30]; + static int fnm = 1; + sprintf(fname, "DER%d", fnm++); + op = fopen(fname, "wb"); + fwrite (p, 1, outlen, op); + fclose(op); + } +#endif + if (seq & 1) ret = (char *) d2i_ASN1_SET(NULL, &p, outlen, d2i, + free_func, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL); + else ret = d2i(NULL, &p, outlen); + if (seq & 2) memset(out, 0, outlen); + if(!ret) PKCS12err(PKCS12_F_PKCS12_DECRYPT_D2I,PKCS12_R_DECODE_ERROR); + Free (out); + return ret; +} + +/* Encode ASN1 structure and encrypt, return OCTET STRING + * if 'seq' is non-zero 'obj' is a stack of structures to be encoded + * as a sequence + */ + +ASN1_OCTET_STRING *PKCS12_i2d_encrypt (algor, i2d, pass, passlen, obj, seq) +X509_ALGOR *algor; +int (*i2d)(); +unsigned char *pass; +int passlen; +char *obj; +int seq; +{ + ASN1_OCTET_STRING *oct; + unsigned char *in, *p; + int inlen; + if (!(oct = ASN1_OCTET_STRING_new ())) { + PKCS12err(PKCS12_F_PKCS12_I2D_ENCRYPT,ERR_R_MALLOC_FAILURE); + return NULL; + } + if (seq) inlen = i2d_ASN1_SET((STACK *)obj, NULL, i2d, V_ASN1_SEQUENCE, + V_ASN1_UNIVERSAL, IS_SEQUENCE); + else inlen = i2d (obj, NULL); + if (!inlen) { + PKCS12err(PKCS12_F_PKCS12_I2D_ENCRYPT,PKCS12_R_ENCODE_ERROR); + return NULL; + } + if (!(in = Malloc (inlen))) { + PKCS12err(PKCS12_F_PKCS12_I2D_ENCRYPT,ERR_R_MALLOC_FAILURE); + return NULL; + } + p = in; + if (seq) i2d_ASN1_SET((STACK *)obj, &p, i2d, V_ASN1_SEQUENCE, + V_ASN1_UNIVERSAL, IS_SEQUENCE); + else i2d (obj, &p); + if (!PKCS12_pbe_crypt (algor, pass, passlen, in, inlen, &oct->data, + &oct->length, 1)) { + PKCS12err(PKCS12_F_PKCS12_I2D_ENCRYPT,PKCS12_R_ENCRYPT_ERROR); + Free(in); + return NULL; + } + Free (in); + return oct; +} diff --git a/crypto/pkcs12/p12_init.c b/crypto/pkcs12/p12_init.c new file mode 100644 index 0000000000..055629131a --- /dev/null +++ b/crypto/pkcs12/p12_init.c @@ -0,0 +1,102 @@ +/* p12_init.c */ +/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL + * project 1999. + */ +/* ==================================================================== + * Copyright (c) 1999 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * licensing@OpenSSL.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ + +#include +#include +#include +#include +#include +#include "pkcs12.h" + +/* Initialise a PKCS12 structure to take data */ + +PKCS12 *PKCS12_init (mode) +int mode; +{ + PKCS12 *pkcs12; + if (!(pkcs12 = PKCS12_new())) { + PKCS12err(PKCS12_F_PKCS12_INIT,ERR_R_MALLOC_FAILURE); + return NULL; + } + if (!(pkcs12->version = ASN1_INTEGER_new ())) { + PKCS12err(PKCS12_F_PKCS12_INIT,ERR_R_MALLOC_FAILURE); + return NULL; + } + ASN1_INTEGER_set (pkcs12->version, 3); + if (!(pkcs12->authsafes = PKCS7_new())) { + PKCS12err(PKCS12_F_PKCS12_INIT,ERR_R_MALLOC_FAILURE); + return NULL; + } + M_ASN1_OBJECT_set(pkcs12->authsafes->type, mode); + switch (mode) { + case NID_pkcs7_data: + if (!(pkcs12->authsafes->d.data = + ASN1_OCTET_STRING_new())) { + PKCS12err(PKCS12_F_PKCS12_INIT,ERR_R_MALLOC_FAILURE); + return NULL; + } + break; + default: + PKCS12err(PKCS12_F_PKCS12_INIT,PKCS12_R_UNSUPPORTED_PKCS12_MODE); + PKCS12_free(pkcs12); + return NULL; + break; + } + + return pkcs12; +} diff --git a/crypto/pkcs12/p12_key.c b/crypto/pkcs12/p12_key.c new file mode 100644 index 0000000000..f1506ba1cd --- /dev/null +++ b/crypto/pkcs12/p12_key.c @@ -0,0 +1,190 @@ +/* p12_key.c */ +/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL + * project 1999. + */ +/* ==================================================================== + * Copyright (c) 1999 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * licensing@OpenSSL.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ + +#include +#include +#include +#include +#include +#include "pkcs12.h" + + +/* Uncomment out this line to get debugging info about key generation */ +/*#define DEBUG_KEYGEN*/ +#ifdef DEBUG_KEYGEN +#include +extern BIO *bio_err; +void h__dump (unsigned char *p, int len); +#endif + +/* PKCS12 compatible key/IV generation */ +#ifndef min +#define min(a,b) ((a) < (b) ? (a) : (b)) +#endif + +int PKCS12_key_gen_asc (pass, passlen, salt, saltlen, id, iter, n, out, md_type) +unsigned char *pass, *salt, *out; +int passlen, saltlen, id, iter, n; +EVP_MD *md_type; +{ + int ret; + unsigned char *unipass; + int uniplen; + if (!asc2uni (pass, &unipass, &uniplen)) { + PKCS12err(PKCS12_F_PKCS12_KEY_GEN_ASC,ERR_R_MALLOC_FAILURE); + return 0; + } + ret = PKCS12_key_gen_uni (unipass, uniplen, salt, saltlen, + id, iter, n, out, md_type); + memset(unipass, 0, uniplen); /* Clear password from memory */ + Free(unipass); + return ret; +} + +int PKCS12_key_gen_uni (pass, passlen, salt, saltlen, id, iter, n, out, md_type) +unsigned char *pass, *salt, *out; +int passlen, saltlen, id, iter, n; +EVP_MD *md_type; +{ + unsigned char *B, *D, *I, *p, *Ai; + int Slen, Plen, Ilen; + int i, j, u, v; + BIGNUM *Ij, *Bpl1; /* These hold Ij and B + 1 */ + EVP_MD_CTX ctx; +#ifdef DEBUG_KEYGEN + unsigned char *tmpout = out; + int tmpn = n; + BIO_printf (bio_err, "KEYGEN DEBUG\n"); + BIO_printf (bio_err, "ID %d, ITER %d\n", id, iter); + BIO_printf (bio_err, "Password (length %d):\n", passlen); + h__dump (pass, passlen); + BIO_printf (bio_err, "Salt (length %d):\n", saltlen); + h__dump (salt, saltlen); + BIO_printf (bio_err, "ID %d, ITER %d\n\n", id, iter); +#endif + v = EVP_MD_block_size (md_type); + u = EVP_MD_size (md_type); + D = Malloc (v); + Ai = Malloc (u); + B = Malloc (v + 1); + Slen = v * ((saltlen+v-1)/v); + Plen = v * ((passlen+v-1)/v); + Ilen = Slen + Plen; + I = Malloc (Ilen); + Ij = BN_new(); + Bpl1 = BN_new(); + if (!D || !Ai || !B || !I || !Ij || !Bpl1) { + PKCS12err(PKCS12_F_PKCS12_KEY_GEN_UNI,ERR_R_MALLOC_FAILURE); + return 0; + } + for (i = 0; i < v; i++) D[i] = id; + p = I; + for (i = 0; i < Slen; i++) *p++ = salt[i % saltlen]; + for (i = 0; i < Plen; i++) *p++ = pass[i % passlen]; + for (;;) { + EVP_DigestInit (&ctx, md_type); + EVP_DigestUpdate (&ctx, D, v); + EVP_DigestUpdate (&ctx, I, Ilen); + EVP_DigestFinal (&ctx, Ai, NULL); + for (j = 1; j < iter; j++) { + EVP_DigestInit (&ctx, md_type); + EVP_DigestUpdate (&ctx, Ai, u); + EVP_DigestFinal (&ctx, Ai, NULL); + } + memcpy (out, Ai, min (n, u)); + if (u >= n) { + Free (Ai); + Free (B); + Free (D); + Free (I); + BN_free (Ij); + BN_free (Bpl1); +#ifdef DEBUG_KEYGEN + BIO_printf (bio_err, "Output KEY (length %d)\n", tmpn); + h__dump (tmpout, tmpn); +#endif + return 1; + } + n -= u; + out += u; + for (j = 0; j < v; j++) B[j] = Ai[j % u]; + /* Work out B + 1 first then can use B as tmp space */ + BN_bin2bn (B, v, Bpl1); + BN_add_word (Bpl1, 1); + for (j = 0; j < Ilen ; j+=v) { + BN_bin2bn (I + j, v, Ij); + BN_add (Ij, Ij, Bpl1); + BN_bn2bin (Ij, B); + /* If more than 2^(v*8) - 1 cut off MSB */ + if (BN_num_bytes (Ij) > v) { + BN_bn2bin (Ij, B); + memcpy (I + j, B + 1, v); + } else BN_bn2bin (Ij, I + j); + } + } + return 0; /* This can't happen */ +} +#ifdef DEBUG_KEYGEN +void h__dump (p, len) +unsigned char *p; +int len; +{ + for (; len --; p++) BIO_printf (bio_err, "%02X", *p); + BIO_printf (bio_err, "\n"); +} +#endif diff --git a/crypto/pkcs12/p12_kiss.c b/crypto/pkcs12/p12_kiss.c new file mode 100644 index 0000000000..947e47644b --- /dev/null +++ b/crypto/pkcs12/p12_kiss.c @@ -0,0 +1,269 @@ +/* p12_kiss.c */ +/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL + * project 1999. + */ +/* ==================================================================== + * Copyright (c) 1999 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * licensing@OpenSSL.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ + +#include +#include +#include +#include +#include +#include +#include "pkcs12.h" + +/* Simplified PKCS#12 routines */ + +#ifndef NOPROTO +static int parse_pk12( PKCS12 *p12, unsigned char *pass, int passlen, EVP_PKEY **pkey, X509 **cert, STACK **ca); +static int parse_bags( STACK *bags, unsigned char *pass, int passlen, EVP_PKEY **pkey, X509 **cert, STACK **ca, ASN1_OCTET_STRING **keyid, char *keymatch); +static int parse_bag( PKCS12_SAFEBAG *bag, unsigned char *pass, int passlen, EVP_PKEY **pkey, X509 **cert, STACK **ca, ASN1_OCTET_STRING **keyid, char *keymatch); +#else +static int parse_pk12(); +static int parse_bags(); +static int parse_bag(); +#endif + +/* Parse and decrypt a PKCS#12 structure returning user key, user cert + * and other (CA) certs. Note either ca should be NULL, *ca should be NULL, + * or it should point to a valid STACK structure. pkey and cert can be + * passed unitialised. + */ + +int PKCS12_parse (p12, pass, pkey, cert, ca) +PKCS12 *p12; +char *pass; +EVP_PKEY **pkey; +X509 **cert; +STACK **ca; +{ + +/* Check for NULL PKCS12 structure */ + +if(!p12) { + PKCS12err(PKCS12_F_PKCS12_PARSE,PKCS12_R_INVALID_NULL_PKCS12_POINTER); + return 0; +} + +/* Allocate stack for ca certificates if needed */ +if ((ca != NULL) && (*ca == NULL)) { + if (!(*ca = sk_new(NULL))) { + PKCS12err(PKCS12_F_PKCS12_PARSE,ERR_R_MALLOC_FAILURE); + return 0; + } +} + +if(pkey) *pkey = NULL; +if(cert) *cert = NULL; + +/* Check the mac */ + +if (!PKCS12_verify_mac (p12, pass, -1)) { + PKCS12err(PKCS12_F_PKCS12_PARSE,PKCS12_R_MAC_VERIFY_FAILURE); + goto err; +} + +if (!parse_pk12 (p12, pass, -1, pkey, cert, ca)) { + PKCS12err(PKCS12_F_PKCS12_PARSE,PKCS12_R_PARSE_ERROR); + goto err; +} + +return 1; + +err: + +if (pkey && *pkey) EVP_PKEY_free (*pkey); +if (cert && *cert) X509_free (*cert); +if (ca) sk_pop_free (*ca, X509_free); +return 0; + +} + +/* Parse the outer PKCS#12 structure */ + +static int parse_pk12 (p12, pass, passlen, pkey, cert, ca) +PKCS12 *p12; +unsigned char *pass; +int passlen; +EVP_PKEY **pkey; +X509 **cert; +STACK **ca; +{ + STACK *asafes, *bags; + int i, bagnid; + PKCS7 *p7; + ASN1_OCTET_STRING *keyid = NULL; + char keymatch = 0; + if (!( asafes = M_PKCS12_unpack_authsafes (p12))) return 0; + for (i = 0; i < sk_num (asafes); i++) { + p7 = (PKCS7 *) sk_value (asafes, i); + bagnid = OBJ_obj2nid (p7->type); + if (bagnid == NID_pkcs7_data) { + bags = M_PKCS12_unpack_p7data (p7); + } else if (bagnid == NID_pkcs7_encrypted) { + bags = M_PKCS12_unpack_p7encdata (p7, pass, passlen); + } else continue; + if (!bags) { + sk_pop_free (asafes, PKCS7_free); + return 0; + } + if (!parse_bags (bags, pass, passlen, pkey, cert, ca, + &keyid, &keymatch)) { + sk_pop_free (bags, PKCS12_SAFEBAG_free); + sk_pop_free (asafes, PKCS7_free); + return 0; + } + sk_pop_free (bags, PKCS12_SAFEBAG_free); + } + sk_pop_free (asafes, PKCS7_free); + if (keyid) ASN1_OCTET_STRING_free (keyid); + return 1; +} + + +static int parse_bags (bags, pass, passlen, pkey, cert, ca, keyid, keymatch) +STACK *bags; +unsigned char *pass; +int passlen; +EVP_PKEY **pkey; +X509 **cert; +STACK **ca; +ASN1_OCTET_STRING **keyid; +char *keymatch; +{ + int i; + for (i = 0; i < sk_num (bags); i++) { + if (!parse_bag ((PKCS12_SAFEBAG *)sk_value (bags, i), + pass, passlen, pkey, cert, ca, keyid, + keymatch)) return 0; + } + return 1; +} + +#define MATCH_KEY 0x1 +#define MATCH_CERT 0x2 +#define MATCH_ALL 0x3 + +static int parse_bag (bag, pass, passlen, pkey, cert, ca, keyid, keymatch) +PKCS12_SAFEBAG *bag; +unsigned char *pass; +int passlen; +EVP_PKEY **pkey; +X509 **cert; +STACK **ca; +ASN1_OCTET_STRING **keyid; +char *keymatch; +{ + PKCS8_PRIV_KEY_INFO *p8; + X509 *x509; + ASN1_OCTET_STRING *lkey = NULL; + ASN1_TYPE *attrib; + + + if ((attrib = PKCS12_get_attr (bag, NID_localKeyID))) + lkey = attrib->value.octet_string; + + /* Check for any local key id matching (if needed) */ + if (lkey && ((*keymatch & MATCH_ALL) != MATCH_ALL)) { + if (*keyid) { + if (ASN1_OCTET_STRING_cmp (*keyid, lkey)) lkey = NULL; + } else { + if (!(*keyid = ASN1_OCTET_STRING_dup (lkey))) { + PKCS12err(PKCS12_F_PARSE_BAGS,ERR_R_MALLOC_FAILURE); + return 0; + } + } + } + + switch (M_PKCS12_bag_type(bag)) + { + case NID_keyBag: + if (!lkey || !pkey) return 1; + if (!(*pkey = EVP_PKCS82PKEY (bag->value.keybag))) return 0; + *keymatch |= MATCH_KEY; + break; + + case NID_pkcs8ShroudedKeyBag: + if (!lkey || !pkey) return 1; + if (!(p8 = M_PKCS12_decrypt_skey (bag, pass, passlen))) + return 0; + *pkey = EVP_PKCS82PKEY (p8); + PKCS8_PRIV_KEY_INFO_free (p8); + if (!(*pkey)) return 0; + *keymatch |= MATCH_KEY; + break; + + case NID_certBag: + if (M_PKCS12_cert_bag_type(bag) != NID_x509Certificate ) + return 1; + if (!(x509 = M_PKCS12_certbag2x509(bag))) return 0; + if (lkey) { + *keymatch |= MATCH_CERT; + if (cert) *cert = x509; + } else if (ca) sk_push (*ca, (char *)x509); + break; + + case NID_safeContentsBag: + return parse_bags(bag->value.safes, pass, passlen, + pkey, cert, ca, keyid, keymatch); + break; + + default: + return 1; + break; + } + return 1; +} + diff --git a/crypto/pkcs12/p12_lib.c b/crypto/pkcs12/p12_lib.c new file mode 100644 index 0000000000..f83aae28fc --- /dev/null +++ b/crypto/pkcs12/p12_lib.c @@ -0,0 +1,123 @@ +/* p12_lib.c */ +/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL + * project 1999. + */ +/* ==================================================================== + * Copyright (c) 1999 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * licensing@OpenSSL.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ + +#include +#include +#include +#include +#include "pkcs12.h" + +/* + *ASN1err(ASN1_F_PKCS12_NEW,ASN1_R_DECODE_ERROR) + *ASN1err(ASN1_F_D2I