← Back to branch summary

~sbeattie/ubuntu/oneiric/openssl/lp850608

« back to all changes in this revision

Viewing changes to crypto/pkcs12/p12_kiss.c

  • Committer: Bazaar Package Importer
  • Author(s): Colin Watson
  • Date: 2011-05-01 23:51:53 UTC
  • mfrom: (11.1.20 sid)
  • Revision ID: james.westby@ubuntu.com-20110501235153-bjcxitndquaezb68
Tags: 1.0.0d-2ubuntu1
https://launchpad.net/bugs/675566
* Resynchronise with Debian (LP: #675566).  Remaining changes:
  - debian/libssl1.0.0.postinst:
    + Display a system restart required notification bubble on libssl1.0.0
      upgrade.
    + Use a different priority for libssl1.0.0/restart-services depending
      on whether a desktop, or server dist-upgrade is being performed.
  - debian/{libssl1.0.0-udeb.dirs, control, rules}: Create
    libssl1.0.0-udeb, for the benefit of wget-udeb (no wget-udeb package
    in Debian).
  - debian/{libcrypto1.0.0-udeb.dirs, libssl1.0.0.dirs, libssl1.0.0.files,
    rules}: Move runtime libraries to /lib, for the benefit of
    wpasupplicant.
  - debian/patches/aesni.patch: Backport Intel AES-NI support, now from
    http://rt.openssl.org/Ticket/Display.html?id=2065 rather than the
    0.9.8 variant.
  - debian/patches/Bsymbolic-functions.patch: Link using
    -Bsymbolic-functions.
  - debian/patches/perlpath-quilt.patch: Don't change perl #! paths under
    .pc.
  - debian/rules:
    + Don't run 'make test' when cross-building.
    + Use host compiler when cross-building.  Patch from Neil Williams.
    + Don't build for processors no longer supported: i486, i586 (on
      i386), v8 (on sparc).
    + Fix Makefile to properly clean up libs/ dirs in clean target.
    + Replace duplicate files in the doc directory with symlinks.
* Update architectures affected by Bsymbolic-functions.patch.
* Drop debian/patches/no-sslv2.patch; Debian now adds the 'no-ssl2'
  configure option, which compiles out SSLv2 support entirely, so this is
  no longer needed.
* Drop openssl-doc in favour of the libssl-doc package introduced by
  Debian.  Add Conflicts/Replaces until the next LTS release.

Show diffs side-by-side

added added

removed removed

Lines of Context:
crypto/pkcs12/p12_kiss.c
63
63
/* Simplified PKCS#12 routines */
64
64
 
65
65
static int parse_pk12( PKCS12 *p12, const char *pass, int passlen,
66
 
                EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca);
 
66
                EVP_PKEY **pkey, STACK_OF(X509) *ocerts);
67
67
 
68
68
static int parse_bags( STACK_OF(PKCS12_SAFEBAG) *bags, const char *pass,
69
 
                       int passlen, EVP_PKEY **pkey, X509 **cert,
70
 
                       STACK_OF(X509) **ca, ASN1_OCTET_STRING **keyid,
71
 
                       char *keymatch);
 
69
                       int passlen, EVP_PKEY **pkey, STACK_OF(X509) *ocerts);
72
70
 
73
71
static int parse_bag( PKCS12_SAFEBAG *bag, const char *pass, int passlen,
74
 
                        EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca,
75
 
                        ASN1_OCTET_STRING **keyid, char *keymatch);
 
72
                        EVP_PKEY **pkey, STACK_OF(X509) *ocerts);
76
73
 
77
74
/* Parse and decrypt a PKCS#12 structure returning user key, user cert
78
75
 * and other (CA) certs. Note either ca should be NULL, *ca should be NULL,
83
80
int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert,
84
81
             STACK_OF(X509) **ca)
85
82
{
86
 
 
 
83
        STACK_OF(X509) *ocerts = NULL;
 
84
        X509 *x = NULL;
87
85
        /* Check for NULL PKCS12 structure */
88
86
 
89
 
        if(!p12) {
 
87
        if(!p12)
 
88
                {
90
89
                PKCS12err(PKCS12_F_PKCS12_PARSE,PKCS12_R_INVALID_NULL_PKCS12_POINTER);
91
90
                return 0;
92
 
        }
93
 
 
94
 
        /* Allocate stack for ca certificates if needed */
95
 
        if ((ca != NULL) && (*ca == NULL)) {
96
 
                if (!(*ca = sk_X509_new_null())) {
97
 
                        PKCS12err(PKCS12_F_PKCS12_PARSE,ERR_R_MALLOC_FAILURE);
98
 
                        return 0;
99
91
                }
100
 
        }
101
92
 
102
 
        if(pkey) *pkey = NULL;
103
 
        if(cert) *cert = NULL;
 
93
        if(pkey)
 
94
                *pkey = NULL;
 
95
        if(cert)
 
96
                *cert = NULL;
104
97
 
105
98
        /* Check the mac */
106
99
 
122
115
                goto err;
123
116
        }
124
117
 
125
 
        if (!parse_pk12 (p12, pass, -1, pkey, cert, ca))
 
118
        /* Allocate stack for other certificates */
 
119
        ocerts = sk_X509_new_null();
 
120
 
 
121
        if (!ocerts)
 
122
                {
 
123
                PKCS12err(PKCS12_F_PKCS12_PARSE,ERR_R_MALLOC_FAILURE);
 
124
                return 0;
 
125
                }
 
126
 
 
127
        if (!parse_pk12 (p12, pass, -1, pkey, ocerts))
126
128
                {
127
129
                PKCS12err(PKCS12_F_PKCS12_PARSE,PKCS12_R_PARSE_ERROR);
128
130
                goto err;
129
131
                }
130
132
 
 
133
        while ((x = sk_X509_pop(ocerts)))
 
134
                {
 
135
                if (pkey && *pkey && cert && !*cert)
 
136
                        {
 
137
                        if (X509_check_private_key(x, *pkey))
 
138
                                {
 
139
                                *cert = x;
 
140
                                x = NULL;
 
141
                                }
 
142
                        }
 
143
 
 
144
                if (ca && x)
 
145
                        {
 
146
                        if (!*ca)
 
147
                                *ca = sk_X509_new_null();
 
148
                        if (!*ca)
 
149
                                goto err;
 
150
                        if (!sk_X509_push(*ca, x))
 
151
                                goto err;
 
152
                        x = NULL;
 
153
                        }
 
154
                if (x)
 
155
                        X509_free(x);
 
156
                }
 
157
 
 
158
        if (ocerts)
 
159
                sk_X509_pop_free(ocerts, X509_free);
 
160
 
131
161
        return 1;
132
162
 
133
163
 err:
134
164
 
135
 
        if (pkey && *pkey) EVP_PKEY_free(*pkey);
136
 
        if (cert && *cert) X509_free(*cert);
137
 
        if (ca) sk_X509_pop_free(*ca, X509_free);
 
165
        if (pkey && *pkey)
 
166
                EVP_PKEY_free(*pkey);
 
167
        if (cert && *cert)
 
168
                X509_free(*cert);
 
169
        if (x)
 
170
                X509_free(*cert);
 
171
        if (ocerts)
 
172
                sk_X509_pop_free(ocerts, X509_free);
138
173
        return 0;
139
174
 
140
175
}
142
177
/* Parse the outer PKCS#12 structure */
143
178
 
144
179
static int parse_pk12(PKCS12 *p12, const char *pass, int passlen,
145
 
             EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca)
 
180
             EVP_PKEY **pkey, STACK_OF(X509) *ocerts)
146
181
{
147
182
        STACK_OF(PKCS7) *asafes;
148
183
        STACK_OF(PKCS12_SAFEBAG) *bags;
149
184
        int i, bagnid;
150
185
        PKCS7 *p7;
151
 
        ASN1_OCTET_STRING *keyid = NULL;
152
186
 
153
 
        char keymatch = 0;
154
187
        if (!(asafes = PKCS12_unpack_authsafes (p12))) return 0;
155
188
        for (i = 0; i < sk_PKCS7_num (asafes); i++) {
156
189
                p7 = sk_PKCS7_value (asafes, i);
164
197
                        sk_PKCS7_pop_free(asafes, PKCS7_free);
165
198
                        return 0;
166
199
                }
167
 
                if (!parse_bags(bags, pass, passlen, pkey, cert, ca,
168
 
                                                         &keyid, &keymatch)) {
 
200
                if (!parse_bags(bags, pass, passlen, pkey, ocerts)) {
169
201
                        sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
170
202
                        sk_PKCS7_pop_free(asafes, PKCS7_free);
171
203
                        return 0;
173
205
                sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
174
206
        }
175
207
        sk_PKCS7_pop_free(asafes, PKCS7_free);
176
 
        if (keyid) M_ASN1_OCTET_STRING_free(keyid);
177
208
        return 1;
178
209
}
179
210
 
180
211
 
181
212
static int parse_bags(STACK_OF(PKCS12_SAFEBAG) *bags, const char *pass,
182
 
                      int passlen, EVP_PKEY **pkey, X509 **cert,
183
 
                      STACK_OF(X509) **ca, ASN1_OCTET_STRING **keyid,
184
 
                      char *keymatch)
 
213
                      int passlen, EVP_PKEY **pkey, STACK_OF(X509) *ocerts)
185
214
{
186
215
        int i;
187
216
        for (i = 0; i < sk_PKCS12_SAFEBAG_num(bags); i++) {
188
217
                if (!parse_bag(sk_PKCS12_SAFEBAG_value (bags, i),
189
 
                         pass, passlen, pkey, cert, ca, keyid,
190
 
                                                         keymatch)) return 0;
 
218
                                 pass, passlen, pkey, ocerts))
 
219
                        return 0;
191
220
        }
192
221
        return 1;
193
222
}
194
223
 
195
 
#define MATCH_KEY  0x1
196
 
#define MATCH_CERT 0x2
197
 
#define MATCH_ALL  0x3
198
 
 
199
224
static int parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen,
200
 
                     EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca,
201
 
                     ASN1_OCTET_STRING **keyid,
202
 
                     char *keymatch)
 
225
                     EVP_PKEY **pkey, STACK_OF(X509) *ocerts)
203
226
{
204
227
        PKCS8_PRIV_KEY_INFO *p8;
205
228
        X509 *x509;
206
 
        ASN1_OCTET_STRING *lkey = NULL, *ckid = NULL;
207
229
        ASN1_TYPE *attrib;
208
230
        ASN1_BMPSTRING *fname = NULL;
 
231
        ASN1_OCTET_STRING *lkid = NULL;
209
232
 
210
233
        if ((attrib = PKCS12_get_attr (bag, NID_friendlyName)))
211
234
                fname = attrib->value.bmpstring;
212
235
 
213
 
        if ((attrib = PKCS12_get_attr (bag, NID_localKeyID))) {
214
 
                lkey = attrib->value.octet_string;
215
 
                ckid = lkey;
216
 
        }
 
236
        if ((attrib = PKCS12_get_attr (bag, NID_localKeyID)))
 
237
                lkid = attrib->value.octet_string;
217
238
 
218
 
        /* Check for any local key id matching (if needed) */
219
 
        if (lkey && ((*keymatch & MATCH_ALL) != MATCH_ALL)) {
220
 
                if (*keyid) {
221
 
                        if (M_ASN1_OCTET_STRING_cmp(*keyid, lkey)) lkey = NULL;
222
 
                } else {
223
 
                        if (!(*keyid = M_ASN1_OCTET_STRING_dup(lkey))) {
224
 
                                PKCS12err(PKCS12_F_PARSE_BAG,ERR_R_MALLOC_FAILURE);
225
 
                                return 0;
226
 
                    }
227
 
                }
228
 
        }
229
 
        
230
239
        switch (M_PKCS12_bag_type(bag))
231
240
        {
232
241
        case NID_keyBag:
233
 
                if (!lkey || !pkey) return 1;   
234
 
                if (!(*pkey = EVP_PKCS82PKEY(bag->value.keybag))) return 0;
235
 
                *keymatch |= MATCH_KEY;
 
242
                if (!pkey || *pkey)
 
243
                        return 1;       
 
244
                if (!(*pkey = EVP_PKCS82PKEY(bag->value.keybag)))
 
245
                        return 0;
236
246
        break;
237
247
 
238
248
        case NID_pkcs8ShroudedKeyBag:
239
 
                if (!lkey || !pkey) return 1;   
 
249
                if (!pkey || *pkey)
 
250
                        return 1;       
240
251
                if (!(p8 = PKCS12_decrypt_skey(bag, pass, passlen)))
241
252
                                return 0;
242
253
                *pkey = EVP_PKCS82PKEY(p8);
243
254
                PKCS8_PRIV_KEY_INFO_free(p8);
244
255
                if (!(*pkey)) return 0;
245
 
                *keymatch |= MATCH_KEY;
246
256
        break;
247
257
 
248
258
        case NID_certBag:
249
259
                if (M_PKCS12_cert_bag_type(bag) != NID_x509Certificate )
250
 
                                                                 return 1;
251
 
                if (!(x509 = PKCS12_certbag2x509(bag))) return 0;
252
 
                if(ckid)
 
260
                        return 1;
 
261
                if (!(x509 = PKCS12_certbag2x509(bag)))
 
262
                        return 0;
 
263
                if(lkid && !X509_keyid_set1(x509, lkid->data, lkid->length))
253
264
                        {
254
 
                        if (!X509_keyid_set1(x509, ckid->data, ckid->length))
255
 
                                {
256
 
                                X509_free(x509);
257
 
                                return 0;
258
 
                                }
 
265
                        X509_free(x509);
 
266
                        return 0;
259
267
                        }
260
268
                if(fname) {
261
269
                        int len, r;
272
280
                        }
273
281
                }
274
282
 
 
283
                if(!sk_X509_push(ocerts, x509))
 
284
                        {
 
285
                        X509_free(x509);
 
286
                        return 0;
 
287
                        }
275
288
 
276
 
                if (lkey) {
277
 
                        *keymatch |= MATCH_CERT;
278
 
                        if (cert) *cert = x509;
279
 
                        else X509_free(x509);
280
 
                } else {
281
 
                        if(ca) sk_X509_push (*ca, x509);
282
 
                        else X509_free(x509);
283
 
                }
284
289
        break;
285
290
 
286
291
        case NID_safeContentsBag:
287
292
                return parse_bags(bag->value.safes, pass, passlen,
288
 
                                        pkey, cert, ca, keyid, keymatch);
 
293
                                        pkey, ocerts);
289
294
        break;
290
295
 
291
296
        default: