]>
Commit | Line | Data |
---|---|---|
846e33c7 | 1 | /* |
fecb3aae | 2 | * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. |
d02b48c6 | 3 | * |
2c18d164 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
846e33c7 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
d02b48c6 RE |
8 | */ |
9 | ||
10 | #include <stdio.h> | |
706457b7 | 11 | #include "ssl_local.h" |
0d345f0e | 12 | #include "internal/packet.h" |
ec577822 BM |
13 | #include <openssl/bio.h> |
14 | #include <openssl/objects.h> | |
15 | #include <openssl/evp.h> | |
16 | #include <openssl/x509.h> | |
9f0f53b7 | 17 | #include <openssl/x509v3.h> |
ec577822 | 18 | #include <openssl/pem.h> |
d02b48c6 | 19 | |
d02b48c6 RE |
20 | static int ssl_set_cert(CERT *c, X509 *x509); |
21 | static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey); | |
bade29da | 22 | |
7a4e6a1e MC |
23 | #define SYNTHV1CONTEXT (SSL_EXT_TLS1_2_AND_BELOW_ONLY \ |
24 | | SSL_EXT_CLIENT_HELLO \ | |
25 | | SSL_EXT_TLS1_2_SERVER_HELLO \ | |
26 | | SSL_EXT_IGNORE_ON_RESUMPTION) | |
bade29da | 27 | |
2ff286c2 DDO |
28 | #define NAME_PREFIX1 "SERVERINFO FOR " |
29 | #define NAME_PREFIX2 "SERVERINFOV2 FOR " | |
30 | ||
6b691a5c | 31 | int SSL_use_certificate(SSL *ssl, X509 *x) |
0f113f3e MC |
32 | { |
33 | int rv; | |
34 | if (x == NULL) { | |
6849b73c | 35 | ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); |
26a7d938 | 36 | return 0; |
0f113f3e | 37 | } |
6725682d | 38 | |
0f113f3e MC |
39 | rv = ssl_security_cert(ssl, NULL, x, 0, 1); |
40 | if (rv != 1) { | |
6849b73c | 41 | ERR_raise(ERR_LIB_SSL, rv); |
0f113f3e MC |
42 | return 0; |
43 | } | |
44 | ||
26a7d938 | 45 | return ssl_set_cert(ssl->cert, x); |
0f113f3e | 46 | } |
d02b48c6 | 47 | |
303c0028 | 48 | int SSL_use_certificate_file(SSL *ssl, const char *file, int type) |
0f113f3e MC |
49 | { |
50 | int j; | |
51 | BIO *in; | |
52 | int ret = 0; | |
6725682d | 53 | X509 *cert = NULL, *x = NULL; |
0f113f3e | 54 | |
9982cbbb | 55 | in = BIO_new(BIO_s_file()); |
0f113f3e | 56 | if (in == NULL) { |
6849b73c | 57 | ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); |
0f113f3e MC |
58 | goto end; |
59 | } | |
60 | ||
61 | if (BIO_read_filename(in, file) <= 0) { | |
6849b73c | 62 | ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB); |
0f113f3e MC |
63 | goto end; |
64 | } | |
6725682d SL |
65 | |
66 | if (type != SSL_FILETYPE_ASN1 && type != SSL_FILETYPE_PEM) { | |
6849b73c | 67 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_SSL_FILETYPE); |
6725682d SL |
68 | goto end; |
69 | } | |
d8652be0 | 70 | x = X509_new_ex(ssl->ctx->libctx, ssl->ctx->propq); |
6725682d | 71 | if (x == NULL) { |
6849b73c | 72 | ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE); |
6725682d SL |
73 | goto end; |
74 | } | |
0f113f3e MC |
75 | if (type == SSL_FILETYPE_ASN1) { |
76 | j = ERR_R_ASN1_LIB; | |
6725682d | 77 | cert = d2i_X509_bio(in, &x); |
0f113f3e MC |
78 | } else if (type == SSL_FILETYPE_PEM) { |
79 | j = ERR_R_PEM_LIB; | |
6725682d SL |
80 | cert = PEM_read_bio_X509(in, &x, ssl->default_passwd_callback, |
81 | ssl->default_passwd_callback_userdata); | |
0f113f3e | 82 | } else { |
6849b73c | 83 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_SSL_FILETYPE); |
0f113f3e MC |
84 | goto end; |
85 | } | |
86 | ||
6725682d | 87 | if (cert == NULL) { |
6849b73c | 88 | ERR_raise(ERR_LIB_SSL, j); |
0f113f3e MC |
89 | goto end; |
90 | } | |
91 | ||
92 | ret = SSL_use_certificate(ssl, x); | |
93 | end: | |
222561fe | 94 | X509_free(x); |
ca3a82c3 | 95 | BIO_free(in); |
26a7d938 | 96 | return ret; |
0f113f3e | 97 | } |
d02b48c6 | 98 | |
875a644a | 99 | int SSL_use_certificate_ASN1(SSL *ssl, const unsigned char *d, int len) |
0f113f3e MC |
100 | { |
101 | X509 *x; | |
102 | int ret; | |
103 | ||
d8652be0 | 104 | x = X509_new_ex(ssl->ctx->libctx, ssl->ctx->propq); |
0f113f3e | 105 | if (x == NULL) { |
6849b73c | 106 | ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE); |
6725682d SL |
107 | return 0; |
108 | } | |
109 | ||
110 | if (d2i_X509(&x, &d, (long)len)== NULL) { | |
111 | X509_free(x); | |
6849b73c | 112 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
26a7d938 | 113 | return 0; |
0f113f3e MC |
114 | } |
115 | ||
116 | ret = SSL_use_certificate(ssl, x); | |
117 | X509_free(x); | |
26a7d938 | 118 | return ret; |
0f113f3e | 119 | } |
d02b48c6 | 120 | |
6b691a5c | 121 | static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey) |
0f113f3e | 122 | { |
52fd27f9 DSH |
123 | size_t i; |
124 | ||
125 | if (ssl_cert_lookup_by_pkey(pkey, &i) == NULL) { | |
6849b73c | 126 | ERR_raise(ERR_LIB_SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE); |
26a7d938 | 127 | return 0; |
0f113f3e MC |
128 | } |
129 | ||
fc52ae8c MC |
130 | if (c->pkeys[i].x509 != NULL |
131 | && !X509_check_private_key(c->pkeys[i].x509, pkey)) | |
132 | return 0; | |
0f113f3e | 133 | |
25aaa98a | 134 | EVP_PKEY_free(c->pkeys[i].privatekey); |
3aeb9348 | 135 | EVP_PKEY_up_ref(pkey); |
0f113f3e | 136 | c->pkeys[i].privatekey = pkey; |
52fd27f9 DSH |
137 | c->key = &c->pkeys[i]; |
138 | return 1; | |
0f113f3e | 139 | } |
d02b48c6 | 140 | |
6b691a5c | 141 | int SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey) |
0f113f3e MC |
142 | { |
143 | int ret; | |
144 | ||
145 | if (pkey == NULL) { | |
6849b73c | 146 | ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); |
26a7d938 | 147 | return 0; |
0f113f3e | 148 | } |
0f113f3e | 149 | ret = ssl_set_pkey(ssl->cert, pkey); |
26a7d938 | 150 | return ret; |
0f113f3e | 151 | } |
d02b48c6 | 152 | |
303c0028 | 153 | int SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type) |
0f113f3e MC |
154 | { |
155 | int j, ret = 0; | |
156 | BIO *in; | |
157 | EVP_PKEY *pkey = NULL; | |
158 | ||
9982cbbb | 159 | in = BIO_new(BIO_s_file()); |
0f113f3e | 160 | if (in == NULL) { |
6849b73c | 161 | ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); |
0f113f3e MC |
162 | goto end; |
163 | } | |
164 | ||
165 | if (BIO_read_filename(in, file) <= 0) { | |
6849b73c | 166 | ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB); |
0f113f3e MC |
167 | goto end; |
168 | } | |
169 | if (type == SSL_FILETYPE_PEM) { | |
170 | j = ERR_R_PEM_LIB; | |
d6a2bdf7 MC |
171 | pkey = PEM_read_bio_PrivateKey_ex(in, NULL, |
172 | ssl->default_passwd_callback, | |
173 | ssl->default_passwd_callback_userdata, | |
174 | ssl->ctx->libctx, | |
175 | ssl->ctx->propq); | |
0f113f3e MC |
176 | } else if (type == SSL_FILETYPE_ASN1) { |
177 | j = ERR_R_ASN1_LIB; | |
d6a2bdf7 MC |
178 | pkey = d2i_PrivateKey_ex_bio(in, NULL, ssl->ctx->libctx, |
179 | ssl->ctx->propq); | |
0f113f3e | 180 | } else { |
6849b73c | 181 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_SSL_FILETYPE); |
0f113f3e MC |
182 | goto end; |
183 | } | |
184 | if (pkey == NULL) { | |
6849b73c | 185 | ERR_raise(ERR_LIB_SSL, j); |
0f113f3e MC |
186 | goto end; |
187 | } | |
188 | ret = SSL_use_PrivateKey(ssl, pkey); | |
189 | EVP_PKEY_free(pkey); | |
190 | end: | |
ca3a82c3 | 191 | BIO_free(in); |
26a7d938 | 192 | return ret; |
0f113f3e | 193 | } |
d02b48c6 | 194 | |
0f113f3e MC |
195 | int SSL_use_PrivateKey_ASN1(int type, SSL *ssl, const unsigned char *d, |
196 | long len) | |
197 | { | |
198 | int ret; | |
199 | const unsigned char *p; | |
200 | EVP_PKEY *pkey; | |
d02b48c6 | 201 | |
0f113f3e | 202 | p = d; |
d6a2bdf7 MC |
203 | if ((pkey = d2i_PrivateKey_ex(type, NULL, &p, (long)len, ssl->ctx->libctx, |
204 | ssl->ctx->propq)) == NULL) { | |
6849b73c | 205 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
26a7d938 | 206 | return 0; |
0f113f3e | 207 | } |
d02b48c6 | 208 | |
0f113f3e MC |
209 | ret = SSL_use_PrivateKey(ssl, pkey); |
210 | EVP_PKEY_free(pkey); | |
26a7d938 | 211 | return ret; |
0f113f3e | 212 | } |
d02b48c6 | 213 | |
6b691a5c | 214 | int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x) |
0f113f3e MC |
215 | { |
216 | int rv; | |
217 | if (x == NULL) { | |
6849b73c | 218 | ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); |
26a7d938 | 219 | return 0; |
0f113f3e | 220 | } |
6725682d | 221 | |
0f113f3e MC |
222 | rv = ssl_security_cert(NULL, ctx, x, 0, 1); |
223 | if (rv != 1) { | |
6849b73c | 224 | ERR_raise(ERR_LIB_SSL, rv); |
0f113f3e MC |
225 | return 0; |
226 | } | |
26a7d938 | 227 | return ssl_set_cert(ctx->cert, x); |
0f113f3e | 228 | } |
d02b48c6 | 229 | |
6b691a5c | 230 | static int ssl_set_cert(CERT *c, X509 *x) |
0f113f3e MC |
231 | { |
232 | EVP_PKEY *pkey; | |
52fd27f9 | 233 | size_t i; |
0f113f3e | 234 | |
8382fd3a | 235 | pkey = X509_get0_pubkey(x); |
0f113f3e | 236 | if (pkey == NULL) { |
6849b73c | 237 | ERR_raise(ERR_LIB_SSL, SSL_R_X509_LIB); |
26a7d938 | 238 | return 0; |
0f113f3e MC |
239 | } |
240 | ||
52fd27f9 | 241 | if (ssl_cert_lookup_by_pkey(pkey, &i) == NULL) { |
6849b73c | 242 | ERR_raise(ERR_LIB_SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE); |
8382fd3a | 243 | return 0; |
0f113f3e | 244 | } |
462f4f4b | 245 | |
c2041da8 | 246 | if (i == SSL_PKEY_ECC && !EVP_PKEY_can_sign(pkey)) { |
6849b73c | 247 | ERR_raise(ERR_LIB_SSL, SSL_R_ECC_CERT_NOT_FOR_SIGNING); |
1db3107a DSH |
248 | return 0; |
249 | } | |
462f4f4b | 250 | |
0f113f3e | 251 | if (c->pkeys[i].privatekey != NULL) { |
5f3d93e4 MC |
252 | /* |
253 | * The return code from EVP_PKEY_copy_parameters is deliberately | |
254 | * ignored. Some EVP_PKEY types cannot do this. | |
6d5f636c | 255 | * coverity[check_return] |
5f3d93e4 | 256 | */ |
0f113f3e MC |
257 | EVP_PKEY_copy_parameters(pkey, c->pkeys[i].privatekey); |
258 | ERR_clear_error(); | |
dfeab068 | 259 | |
0f113f3e MC |
260 | if (!X509_check_private_key(x, c->pkeys[i].privatekey)) { |
261 | /* | |
262 | * don't fail for a cert/key mismatch, just free current private | |
263 | * key (when switching to a different cert & key, first this | |
264 | * function should be used, then ssl_set_pkey | |
265 | */ | |
266 | EVP_PKEY_free(c->pkeys[i].privatekey); | |
267 | c->pkeys[i].privatekey = NULL; | |
268 | /* clear error queue */ | |
269 | ERR_clear_error(); | |
270 | } | |
271 | } | |
272 | ||
222561fe | 273 | X509_free(c->pkeys[i].x509); |
05f0fb9f | 274 | X509_up_ref(x); |
0f113f3e MC |
275 | c->pkeys[i].x509 = x; |
276 | c->key = &(c->pkeys[i]); | |
277 | ||
8382fd3a | 278 | return 1; |
0f113f3e | 279 | } |
d02b48c6 | 280 | |
303c0028 | 281 | int SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type) |
0f113f3e | 282 | { |
6725682d | 283 | int j = SSL_R_BAD_VALUE; |
0f113f3e MC |
284 | BIO *in; |
285 | int ret = 0; | |
6725682d | 286 | X509 *x = NULL, *cert = NULL; |
0f113f3e | 287 | |
9982cbbb | 288 | in = BIO_new(BIO_s_file()); |
0f113f3e | 289 | if (in == NULL) { |
6849b73c | 290 | ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); |
0f113f3e MC |
291 | goto end; |
292 | } | |
293 | ||
294 | if (BIO_read_filename(in, file) <= 0) { | |
6849b73c | 295 | ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB); |
0f113f3e MC |
296 | goto end; |
297 | } | |
6725682d | 298 | if (type != SSL_FILETYPE_ASN1 && type != SSL_FILETYPE_PEM) { |
6849b73c | 299 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_SSL_FILETYPE); |
6725682d SL |
300 | goto end; |
301 | } | |
d8652be0 | 302 | x = X509_new_ex(ctx->libctx, ctx->propq); |
6725682d | 303 | if (x == NULL) { |
6849b73c | 304 | ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE); |
6725682d SL |
305 | goto end; |
306 | } | |
0f113f3e MC |
307 | if (type == SSL_FILETYPE_ASN1) { |
308 | j = ERR_R_ASN1_LIB; | |
6725682d | 309 | cert = d2i_X509_bio(in, &x); |
0f113f3e MC |
310 | } else if (type == SSL_FILETYPE_PEM) { |
311 | j = ERR_R_PEM_LIB; | |
6725682d SL |
312 | cert = PEM_read_bio_X509(in, &x, ctx->default_passwd_callback, |
313 | ctx->default_passwd_callback_userdata); | |
0f113f3e | 314 | } |
6725682d | 315 | if (cert == NULL) { |
6849b73c | 316 | ERR_raise(ERR_LIB_SSL, j); |
0f113f3e MC |
317 | goto end; |
318 | } | |
319 | ||
320 | ret = SSL_CTX_use_certificate(ctx, x); | |
321 | end: | |
222561fe | 322 | X509_free(x); |
ca3a82c3 | 323 | BIO_free(in); |
26a7d938 | 324 | return ret; |
0f113f3e | 325 | } |
d02b48c6 | 326 | |
a230b26e | 327 | int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, const unsigned char *d) |
0f113f3e MC |
328 | { |
329 | X509 *x; | |
330 | int ret; | |
d02b48c6 | 331 | |
d8652be0 | 332 | x = X509_new_ex(ctx->libctx, ctx->propq); |
0f113f3e | 333 | if (x == NULL) { |
6849b73c | 334 | ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE); |
6725682d SL |
335 | return 0; |
336 | } | |
337 | ||
338 | if (d2i_X509(&x, &d, (long)len) == NULL) { | |
339 | X509_free(x); | |
6849b73c | 340 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
26a7d938 | 341 | return 0; |
0f113f3e | 342 | } |
d02b48c6 | 343 | |
0f113f3e MC |
344 | ret = SSL_CTX_use_certificate(ctx, x); |
345 | X509_free(x); | |
26a7d938 | 346 | return ret; |
0f113f3e | 347 | } |
d02b48c6 | 348 | |
6b691a5c | 349 | int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey) |
0f113f3e MC |
350 | { |
351 | if (pkey == NULL) { | |
6849b73c | 352 | ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); |
26a7d938 | 353 | return 0; |
0f113f3e | 354 | } |
26a7d938 | 355 | return ssl_set_pkey(ctx->cert, pkey); |
0f113f3e | 356 | } |
d02b48c6 | 357 | |
303c0028 | 358 | int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type) |
0f113f3e MC |
359 | { |
360 | int j, ret = 0; | |
361 | BIO *in; | |
362 | EVP_PKEY *pkey = NULL; | |
363 | ||
9982cbbb | 364 | in = BIO_new(BIO_s_file()); |
0f113f3e | 365 | if (in == NULL) { |
6849b73c | 366 | ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); |
0f113f3e MC |
367 | goto end; |
368 | } | |
369 | ||
370 | if (BIO_read_filename(in, file) <= 0) { | |
6849b73c | 371 | ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB); |
0f113f3e MC |
372 | goto end; |
373 | } | |
374 | if (type == SSL_FILETYPE_PEM) { | |
375 | j = ERR_R_PEM_LIB; | |
d6a2bdf7 | 376 | pkey = PEM_read_bio_PrivateKey_ex(in, NULL, |
0f113f3e | 377 | ctx->default_passwd_callback, |
d6a2bdf7 MC |
378 | ctx->default_passwd_callback_userdata, |
379 | ctx->libctx, ctx->propq); | |
0f113f3e MC |
380 | } else if (type == SSL_FILETYPE_ASN1) { |
381 | j = ERR_R_ASN1_LIB; | |
d6a2bdf7 | 382 | pkey = d2i_PrivateKey_ex_bio(in, NULL, ctx->libctx, ctx->propq); |
0f113f3e | 383 | } else { |
6849b73c | 384 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_SSL_FILETYPE); |
0f113f3e MC |
385 | goto end; |
386 | } | |
387 | if (pkey == NULL) { | |
6849b73c | 388 | ERR_raise(ERR_LIB_SSL, j); |
0f113f3e MC |
389 | goto end; |
390 | } | |
391 | ret = SSL_CTX_use_PrivateKey(ctx, pkey); | |
392 | EVP_PKEY_free(pkey); | |
393 | end: | |
ca3a82c3 | 394 | BIO_free(in); |
26a7d938 | 395 | return ret; |
0f113f3e | 396 | } |
d02b48c6 | 397 | |
0f113f3e MC |
398 | int SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx, |
399 | const unsigned char *d, long len) | |
400 | { | |
401 | int ret; | |
402 | const unsigned char *p; | |
403 | EVP_PKEY *pkey; | |
d02b48c6 | 404 | |
0f113f3e | 405 | p = d; |
d6a2bdf7 MC |
406 | if ((pkey = d2i_PrivateKey_ex(type, NULL, &p, (long)len, ctx->libctx, |
407 | ctx->propq)) == NULL) { | |
6849b73c | 408 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
26a7d938 | 409 | return 0; |
0f113f3e | 410 | } |
d02b48c6 | 411 | |
0f113f3e MC |
412 | ret = SSL_CTX_use_PrivateKey(ctx, pkey); |
413 | EVP_PKEY_free(pkey); | |
26a7d938 | 414 | return ret; |
0f113f3e | 415 | } |
d02b48c6 | 416 | |
0f113f3e MC |
417 | /* |
418 | * Read a file that contains our certificate in "PEM" format, possibly | |
419 | * followed by a sequence of CA certificates that should be sent to the peer | |
420 | * in the Certificate message. | |
b3ca645f | 421 | */ |
fae4772c | 422 | static int use_certificate_chain_file(SSL_CTX *ctx, SSL *ssl, const char *file) |
0f113f3e MC |
423 | { |
424 | BIO *in; | |
425 | int ret = 0; | |
426 | X509 *x = NULL; | |
a974e64a MC |
427 | pem_password_cb *passwd_callback; |
428 | void *passwd_callback_userdata; | |
6725682d | 429 | SSL_CTX *real_ctx = (ssl == NULL) ? ctx : ssl->ctx; |
0f113f3e | 430 | |
88ce406c P |
431 | if (ctx == NULL && ssl == NULL) |
432 | return 0; | |
433 | ||
0f113f3e MC |
434 | ERR_clear_error(); /* clear error stack for |
435 | * SSL_CTX_use_certificate() */ | |
436 | ||
a974e64a MC |
437 | if (ctx != NULL) { |
438 | passwd_callback = ctx->default_passwd_callback; | |
439 | passwd_callback_userdata = ctx->default_passwd_callback_userdata; | |
440 | } else { | |
441 | passwd_callback = ssl->default_passwd_callback; | |
442 | passwd_callback_userdata = ssl->default_passwd_callback_userdata; | |
443 | } | |
444 | ||
9982cbbb | 445 | in = BIO_new(BIO_s_file()); |
0f113f3e | 446 | if (in == NULL) { |
6849b73c | 447 | ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); |
0f113f3e MC |
448 | goto end; |
449 | } | |
450 | ||
451 | if (BIO_read_filename(in, file) <= 0) { | |
6849b73c | 452 | ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB); |
0f113f3e MC |
453 | goto end; |
454 | } | |
455 | ||
d8652be0 | 456 | x = X509_new_ex(real_ctx->libctx, real_ctx->propq); |
0f113f3e | 457 | if (x == NULL) { |
6849b73c | 458 | ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE); |
6725682d SL |
459 | goto end; |
460 | } | |
461 | if (PEM_read_bio_X509_AUX(in, &x, passwd_callback, | |
462 | passwd_callback_userdata) == NULL) { | |
6849b73c | 463 | ERR_raise(ERR_LIB_SSL, ERR_R_PEM_LIB); |
0f113f3e MC |
464 | goto end; |
465 | } | |
466 | ||
fae4772c DSH |
467 | if (ctx) |
468 | ret = SSL_CTX_use_certificate(ctx, x); | |
469 | else | |
470 | ret = SSL_use_certificate(ssl, x); | |
0f113f3e MC |
471 | |
472 | if (ERR_peek_error() != 0) | |
473 | ret = 0; /* Key/certificate mismatch doesn't imply | |
474 | * ret==0 ... */ | |
475 | if (ret) { | |
476 | /* | |
477 | * If we could set up our certificate, now proceed to the CA | |
478 | * certificates. | |
479 | */ | |
480 | X509 *ca; | |
481 | int r; | |
482 | unsigned long err; | |
483 | ||
fae4772c DSH |
484 | if (ctx) |
485 | r = SSL_CTX_clear_chain_certs(ctx); | |
486 | else | |
487 | r = SSL_clear_chain_certs(ssl); | |
488 | ||
489 | if (r == 0) { | |
69f68237 MC |
490 | ret = 0; |
491 | goto end; | |
492 | } | |
0f113f3e | 493 | |
6725682d | 494 | while (1) { |
d8652be0 | 495 | ca = X509_new_ex(real_ctx->libctx, real_ctx->propq); |
6725682d | 496 | if (ca == NULL) { |
6849b73c | 497 | ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
498 | goto end; |
499 | } | |
6725682d SL |
500 | if (PEM_read_bio_X509(in, &ca, passwd_callback, |
501 | passwd_callback_userdata) != NULL) { | |
502 | if (ctx) | |
503 | r = SSL_CTX_add0_chain_cert(ctx, ca); | |
504 | else | |
505 | r = SSL_add0_chain_cert(ssl, ca); | |
506 | /* | |
507 | * Note that we must not free ca if it was successfully added to | |
508 | * the chain (while we must free the main certificate, since its | |
509 | * reference count is increased by SSL_CTX_use_certificate). | |
510 | */ | |
511 | if (!r) { | |
512 | X509_free(ca); | |
513 | ret = 0; | |
514 | goto end; | |
515 | } | |
516 | } else { | |
517 | X509_free(ca); | |
518 | break; | |
519 | } | |
0f113f3e MC |
520 | } |
521 | /* When the while loop ends, it's usually just EOF. */ | |
522 | err = ERR_peek_last_error(); | |
523 | if (ERR_GET_LIB(err) == ERR_LIB_PEM | |
524 | && ERR_GET_REASON(err) == PEM_R_NO_START_LINE) | |
525 | ERR_clear_error(); | |
526 | else | |
527 | ret = 0; /* some real error */ | |
528 | } | |
529 | ||
530 | end: | |
25aaa98a | 531 | X509_free(x); |
ca3a82c3 | 532 | BIO_free(in); |
26a7d938 | 533 | return ret; |
0f113f3e | 534 | } |
fae4772c DSH |
535 | |
536 | int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file) | |
537 | { | |
538 | return use_certificate_chain_file(ctx, NULL, file); | |
539 | } | |
540 | ||
541 | int SSL_use_certificate_chain_file(SSL *ssl, const char *file) | |
542 | { | |
543 | return use_certificate_chain_file(NULL, ssl, file); | |
544 | } | |
a9e1c50b | 545 | |
a398f821 | 546 | static int serverinfo_find_extension(const unsigned char *serverinfo, |
0f113f3e MC |
547 | size_t serverinfo_length, |
548 | unsigned int extension_type, | |
549 | const unsigned char **extension_data, | |
550 | size_t *extension_length) | |
551 | { | |
84c34ba8 MC |
552 | PACKET pkt, data; |
553 | ||
0f113f3e MC |
554 | *extension_data = NULL; |
555 | *extension_length = 0; | |
556 | if (serverinfo == NULL || serverinfo_length == 0) | |
fae11ec7 | 557 | return -1; |
84c34ba8 MC |
558 | |
559 | if (!PACKET_buf_init(&pkt, serverinfo, serverinfo_length)) | |
560 | return -1; | |
561 | ||
0f113f3e MC |
562 | for (;;) { |
563 | unsigned int type = 0; | |
84c34ba8 | 564 | unsigned long context = 0; |
0f113f3e MC |
565 | |
566 | /* end of serverinfo */ | |
84c34ba8 | 567 | if (PACKET_remaining(&pkt) == 0) |
fae11ec7 | 568 | return 0; /* Extension not found */ |
0f113f3e | 569 | |
84c34ba8 MC |
570 | if (!PACKET_get_net_4(&pkt, &context) |
571 | || !PACKET_get_net_2(&pkt, &type) | |
572 | || !PACKET_get_length_prefixed_2(&pkt, &data)) | |
573 | return -1; | |
0f113f3e MC |
574 | |
575 | if (type == extension_type) { | |
84c34ba8 | 576 | *extension_data = PACKET_data(&data); |
1e331727 | 577 | *extension_length = PACKET_remaining(&data); |
0f113f3e MC |
578 | return 1; /* Success */ |
579 | } | |
0f113f3e | 580 | } |
c6ef15c4 | 581 | /* Unreachable */ |
0f113f3e | 582 | } |
a398f821 | 583 | |
84c34ba8 MC |
584 | static int serverinfoex_srv_parse_cb(SSL *s, unsigned int ext_type, |
585 | unsigned int context, | |
586 | const unsigned char *in, | |
587 | size_t inlen, X509 *x, size_t chainidx, | |
588 | int *al, void *arg) | |
0f113f3e | 589 | { |
0a602875 | 590 | |
0f113f3e MC |
591 | if (inlen != 0) { |
592 | *al = SSL_AD_DECODE_ERROR; | |
593 | return 0; | |
594 | } | |
0a602875 | 595 | |
0f113f3e MC |
596 | return 1; |
597 | } | |
9cd50f73 | 598 | |
84c34ba8 MC |
599 | static int serverinfo_srv_parse_cb(SSL *s, unsigned int ext_type, |
600 | const unsigned char *in, | |
601 | size_t inlen, int *al, void *arg) | |
602 | { | |
603 | return serverinfoex_srv_parse_cb(s, ext_type, 0, in, inlen, NULL, 0, al, | |
604 | arg); | |
605 | } | |
606 | ||
607 | static int serverinfoex_srv_add_cb(SSL *s, unsigned int ext_type, | |
608 | unsigned int context, | |
609 | const unsigned char **out, | |
610 | size_t *outlen, X509 *x, size_t chainidx, | |
611 | int *al, void *arg) | |
0f113f3e MC |
612 | { |
613 | const unsigned char *serverinfo = NULL; | |
614 | size_t serverinfo_length = 0; | |
615 | ||
f233a9d1 MC |
616 | /* We only support extensions for the first Certificate */ |
617 | if ((context & SSL_EXT_TLS1_3_CERTIFICATE) != 0 && chainidx > 0) | |
618 | return 0; | |
619 | ||
0f113f3e MC |
620 | /* Is there serverinfo data for the chosen server cert? */ |
621 | if ((ssl_get_server_cert_serverinfo(s, &serverinfo, | |
622 | &serverinfo_length)) != 0) { | |
623 | /* Find the relevant extension from the serverinfo */ | |
624 | int retval = serverinfo_find_extension(serverinfo, serverinfo_length, | |
625 | ext_type, out, outlen); | |
fae11ec7 | 626 | if (retval == -1) { |
fb34a0f4 | 627 | *al = SSL_AD_INTERNAL_ERROR; |
fae11ec7 KR |
628 | return -1; /* Error */ |
629 | } | |
0f113f3e | 630 | if (retval == 0) |
fae11ec7 | 631 | return 0; /* No extension found, don't send extension */ |
0f113f3e MC |
632 | return 1; /* Send extension */ |
633 | } | |
5f18bc58 | 634 | return 0; /* No serverinfo data found, don't send |
0f113f3e MC |
635 | * extension */ |
636 | } | |
637 | ||
84c34ba8 MC |
638 | static int serverinfo_srv_add_cb(SSL *s, unsigned int ext_type, |
639 | const unsigned char **out, size_t *outlen, | |
640 | int *al, void *arg) | |
641 | { | |
642 | return serverinfoex_srv_add_cb(s, ext_type, 0, out, outlen, NULL, 0, al, | |
643 | arg); | |
644 | } | |
645 | ||
0f113f3e MC |
646 | /* |
647 | * With a NULL context, this function just checks that the serverinfo data | |
648 | * parses correctly. With a non-NULL context, it registers callbacks for | |
649 | * the included extensions. | |
650 | */ | |
84c34ba8 MC |
651 | static int serverinfo_process_buffer(unsigned int version, |
652 | const unsigned char *serverinfo, | |
0f113f3e MC |
653 | size_t serverinfo_length, SSL_CTX *ctx) |
654 | { | |
84c34ba8 MC |
655 | PACKET pkt; |
656 | ||
0f113f3e MC |
657 | if (serverinfo == NULL || serverinfo_length == 0) |
658 | return 0; | |
0f113f3e | 659 | |
2698bbfe | 660 | if (version != SSL_SERVERINFOV1 && version != SSL_SERVERINFOV2) |
84c34ba8 | 661 | return 0; |
0f113f3e | 662 | |
84c34ba8 MC |
663 | if (!PACKET_buf_init(&pkt, serverinfo, serverinfo_length)) |
664 | return 0; | |
0f113f3e | 665 | |
84c34ba8 MC |
666 | while (PACKET_remaining(&pkt)) { |
667 | unsigned long context = 0; | |
668 | unsigned int ext_type = 0; | |
669 | PACKET data; | |
0f113f3e | 670 | |
bade29da | 671 | if ((version == SSL_SERVERINFOV2 && !PACKET_get_net_4(&pkt, &context)) |
84c34ba8 MC |
672 | || !PACKET_get_net_2(&pkt, &ext_type) |
673 | || !PACKET_get_length_prefixed_2(&pkt, &data)) | |
0f113f3e MC |
674 | return 0; |
675 | ||
84c34ba8 MC |
676 | if (ctx == NULL) |
677 | continue; | |
678 | ||
bade29da MC |
679 | /* |
680 | * The old style custom extensions API could be set separately for | |
681 | * server/client, i.e. you could set one custom extension for a client, | |
682 | * and *for the same extension in the same SSL_CTX* you could set a | |
683 | * custom extension for the server as well. It seems quite weird to be | |
684 | * setting a custom extension for both client and server in a single | |
685 | * SSL_CTX - but theoretically possible. This isn't possible in the | |
686 | * new API. Therefore, if we have V1 serverinfo we use the old API. We | |
687 | * also use the old API even if we have V2 serverinfo but the context | |
688 | * looks like an old style <= TLSv1.2 extension. | |
689 | */ | |
7a4e6a1e | 690 | if (version == SSL_SERVERINFOV1 || context == SYNTHV1CONTEXT) { |
84c34ba8 MC |
691 | if (!SSL_CTX_add_server_custom_ext(ctx, ext_type, |
692 | serverinfo_srv_add_cb, | |
693 | NULL, NULL, | |
694 | serverinfo_srv_parse_cb, | |
695 | NULL)) | |
696 | return 0; | |
697 | } else { | |
698 | if (!SSL_CTX_add_custom_ext(ctx, ext_type, context, | |
699 | serverinfoex_srv_add_cb, | |
700 | NULL, NULL, | |
701 | serverinfoex_srv_parse_cb, | |
702 | NULL)) | |
703 | return 0; | |
704 | } | |
0f113f3e | 705 | } |
84c34ba8 MC |
706 | |
707 | return 1; | |
0f113f3e | 708 | } |
a398f821 | 709 | |
84c34ba8 MC |
710 | int SSL_CTX_use_serverinfo_ex(SSL_CTX *ctx, unsigned int version, |
711 | const unsigned char *serverinfo, | |
712 | size_t serverinfo_length) | |
0f113f3e MC |
713 | { |
714 | unsigned char *new_serverinfo; | |
715 | ||
716 | if (ctx == NULL || serverinfo == NULL || serverinfo_length == 0) { | |
6849b73c | 717 | ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); |
0f113f3e MC |
718 | return 0; |
719 | } | |
84c34ba8 MC |
720 | if (!serverinfo_process_buffer(version, serverinfo, serverinfo_length, |
721 | NULL)) { | |
6849b73c | 722 | ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_SERVERINFO_DATA); |
0f113f3e MC |
723 | return 0; |
724 | } | |
0f113f3e | 725 | if (ctx->cert->key == NULL) { |
6849b73c | 726 | ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR); |
0f113f3e MC |
727 | return 0; |
728 | } | |
729 | new_serverinfo = OPENSSL_realloc(ctx->cert->key->serverinfo, | |
730 | serverinfo_length); | |
731 | if (new_serverinfo == NULL) { | |
6849b73c | 732 | ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
733 | return 0; |
734 | } | |
735 | ctx->cert->key->serverinfo = new_serverinfo; | |
736 | memcpy(ctx->cert->key->serverinfo, serverinfo, serverinfo_length); | |
737 | ctx->cert->key->serverinfo_length = serverinfo_length; | |
738 | ||
739 | /* | |
740 | * Now that the serverinfo is validated and stored, go ahead and | |
741 | * register callbacks. | |
742 | */ | |
84c34ba8 MC |
743 | if (!serverinfo_process_buffer(version, serverinfo, serverinfo_length, |
744 | ctx)) { | |
6849b73c | 745 | ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_SERVERINFO_DATA); |
0f113f3e MC |
746 | return 0; |
747 | } | |
748 | return 1; | |
749 | } | |
750 | ||
84c34ba8 MC |
751 | int SSL_CTX_use_serverinfo(SSL_CTX *ctx, const unsigned char *serverinfo, |
752 | size_t serverinfo_length) | |
753 | { | |
2698bbfe | 754 | return SSL_CTX_use_serverinfo_ex(ctx, SSL_SERVERINFOV1, serverinfo, |
84c34ba8 MC |
755 | serverinfo_length); |
756 | } | |
757 | ||
a398f821 | 758 | int SSL_CTX_use_serverinfo_file(SSL_CTX *ctx, const char *file) |
0f113f3e MC |
759 | { |
760 | unsigned char *serverinfo = NULL; | |
7c0ef843 | 761 | unsigned char *tmp; |
0f113f3e MC |
762 | size_t serverinfo_length = 0; |
763 | unsigned char *extension = 0; | |
764 | long extension_length = 0; | |
765 | char *name = NULL; | |
766 | char *header = NULL; | |
4bac25e1 | 767 | unsigned int name_len; |
0f113f3e MC |
768 | int ret = 0; |
769 | BIO *bin = NULL; | |
84c34ba8 | 770 | size_t num_extensions = 0, contextoff = 0; |
0f113f3e MC |
771 | |
772 | if (ctx == NULL || file == NULL) { | |
6849b73c | 773 | ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); |
0f113f3e MC |
774 | goto end; |
775 | } | |
776 | ||
9982cbbb | 777 | bin = BIO_new(BIO_s_file()); |
0f113f3e | 778 | if (bin == NULL) { |
6849b73c | 779 | ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); |
0f113f3e MC |
780 | goto end; |
781 | } | |
782 | if (BIO_read_filename(bin, file) <= 0) { | |
6849b73c | 783 | ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB); |
0f113f3e MC |
784 | goto end; |
785 | } | |
786 | ||
787 | for (num_extensions = 0;; num_extensions++) { | |
7a4e6a1e MC |
788 | unsigned int version; |
789 | ||
0f113f3e MC |
790 | if (PEM_read_bio(bin, &name, &header, &extension, &extension_length) |
791 | == 0) { | |
792 | /* | |
793 | * There must be at least one extension in this file | |
794 | */ | |
795 | if (num_extensions == 0) { | |
6849b73c | 796 | ERR_raise(ERR_LIB_SSL, SSL_R_NO_PEM_EXTENSIONS); |
0f113f3e MC |
797 | goto end; |
798 | } else /* End of file, we're done */ | |
799 | break; | |
800 | } | |
801 | /* Check that PEM name starts with "BEGIN SERVERINFO FOR " */ | |
4bac25e1 | 802 | name_len = strlen(name); |
2ff286c2 | 803 | if (name_len < sizeof(NAME_PREFIX1) - 1) { |
6849b73c | 804 | ERR_raise(ERR_LIB_SSL, SSL_R_PEM_NAME_TOO_SHORT); |
0f113f3e MC |
805 | goto end; |
806 | } | |
2ff286c2 | 807 | if (HAS_PREFIX(name, NAME_PREFIX1)) { |
2698bbfe | 808 | version = SSL_SERVERINFOV1; |
84c34ba8 | 809 | } else { |
2ff286c2 | 810 | if (name_len < sizeof(NAME_PREFIX2) - 1) { |
6849b73c | 811 | ERR_raise(ERR_LIB_SSL, SSL_R_PEM_NAME_TOO_SHORT); |
84c34ba8 MC |
812 | goto end; |
813 | } | |
2ff286c2 | 814 | if (!HAS_PREFIX(name, NAME_PREFIX2)) { |
6849b73c | 815 | ERR_raise(ERR_LIB_SSL, SSL_R_PEM_NAME_BAD_PREFIX); |
84c34ba8 MC |
816 | goto end; |
817 | } | |
2698bbfe | 818 | version = SSL_SERVERINFOV2; |
0f113f3e MC |
819 | } |
820 | /* | |
821 | * Check that the decoded PEM data is plausible (valid length field) | |
822 | */ | |
2698bbfe | 823 | if (version == SSL_SERVERINFOV1) { |
84c34ba8 MC |
824 | /* 4 byte header: 2 bytes type, 2 bytes len */ |
825 | if (extension_length < 4 | |
826 | || (extension[2] << 8) + extension[3] | |
827 | != extension_length - 4) { | |
6849b73c | 828 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_DATA); |
84c34ba8 MC |
829 | goto end; |
830 | } | |
831 | /* | |
832 | * File does not have a context value so we must take account of | |
833 | * this later. | |
834 | */ | |
835 | contextoff = 4; | |
836 | } else { | |
837 | /* 8 byte header: 4 bytes context, 2 bytes type, 2 bytes len */ | |
838 | if (extension_length < 8 | |
839 | || (extension[6] << 8) + extension[7] | |
840 | != extension_length - 8) { | |
6849b73c | 841 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_DATA); |
84c34ba8 MC |
842 | goto end; |
843 | } | |
0f113f3e MC |
844 | } |
845 | /* Append the decoded extension to the serverinfo buffer */ | |
84c34ba8 MC |
846 | tmp = OPENSSL_realloc(serverinfo, serverinfo_length + extension_length |
847 | + contextoff); | |
7c0ef843 | 848 | if (tmp == NULL) { |
6849b73c | 849 | ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
850 | goto end; |
851 | } | |
7c0ef843 | 852 | serverinfo = tmp; |
84c34ba8 | 853 | if (contextoff > 0) { |
84c34ba8 MC |
854 | unsigned char *sinfo = serverinfo + serverinfo_length; |
855 | ||
856 | /* We know this only uses the last 2 bytes */ | |
857 | sinfo[0] = 0; | |
858 | sinfo[1] = 0; | |
7a4e6a1e MC |
859 | sinfo[2] = (SYNTHV1CONTEXT >> 8) & 0xff; |
860 | sinfo[3] = SYNTHV1CONTEXT & 0xff; | |
84c34ba8 MC |
861 | } |
862 | memcpy(serverinfo + serverinfo_length + contextoff, | |
863 | extension, extension_length); | |
864 | serverinfo_length += extension_length + contextoff; | |
0f113f3e MC |
865 | |
866 | OPENSSL_free(name); | |
867 | name = NULL; | |
868 | OPENSSL_free(header); | |
869 | header = NULL; | |
870 | OPENSSL_free(extension); | |
871 | extension = NULL; | |
872 | } | |
873 | ||
bade29da | 874 | ret = SSL_CTX_use_serverinfo_ex(ctx, SSL_SERVERINFOV2, serverinfo, |
bb78552e | 875 | serverinfo_length); |
0f113f3e MC |
876 | end: |
877 | /* SSL_CTX_use_serverinfo makes a local copy of the serverinfo. */ | |
878 | OPENSSL_free(name); | |
879 | OPENSSL_free(header); | |
880 | OPENSSL_free(extension); | |
881 | OPENSSL_free(serverinfo); | |
ca3a82c3 | 882 | BIO_free(bin); |
0f113f3e MC |
883 | return ret; |
884 | } | |
37933acb TS |
885 | |
886 | static int ssl_set_cert_and_key(SSL *ssl, SSL_CTX *ctx, X509 *x509, EVP_PKEY *privatekey, | |
887 | STACK_OF(X509) *chain, int override) | |
888 | { | |
889 | int ret = 0; | |
890 | size_t i; | |
891 | int j; | |
892 | int rv; | |
893 | CERT *c = ssl != NULL ? ssl->cert : ctx->cert; | |
894 | STACK_OF(X509) *dup_chain = NULL; | |
895 | EVP_PKEY *pubkey = NULL; | |
896 | ||
897 | /* Do all security checks before anything else */ | |
898 | rv = ssl_security_cert(ssl, ctx, x509, 0, 1); | |
899 | if (rv != 1) { | |
6849b73c | 900 | ERR_raise(ERR_LIB_SSL, rv); |
37933acb TS |
901 | goto out; |
902 | } | |
903 | for (j = 0; j < sk_X509_num(chain); j++) { | |
904 | rv = ssl_security_cert(ssl, ctx, sk_X509_value(chain, j), 0, 0); | |
905 | if (rv != 1) { | |
6849b73c | 906 | ERR_raise(ERR_LIB_SSL, rv); |
37933acb TS |
907 | goto out; |
908 | } | |
909 | } | |
910 | ||
911 | pubkey = X509_get_pubkey(x509); /* bumps reference */ | |
912 | if (pubkey == NULL) | |
913 | goto out; | |
914 | if (privatekey == NULL) { | |
915 | privatekey = pubkey; | |
916 | } else { | |
917 | /* For RSA, which has no parameters, missing returns 0 */ | |
918 | if (EVP_PKEY_missing_parameters(privatekey)) { | |
919 | if (EVP_PKEY_missing_parameters(pubkey)) { | |
920 | /* nobody has parameters? - error */ | |
6849b73c | 921 | ERR_raise(ERR_LIB_SSL, SSL_R_MISSING_PARAMETERS); |
37933acb TS |
922 | goto out; |
923 | } else { | |
924 | /* copy to privatekey from pubkey */ | |
6646e015 ZQ |
925 | if (!EVP_PKEY_copy_parameters(privatekey, pubkey)) { |
926 | ERR_raise(ERR_LIB_SSL, SSL_R_COPY_PARAMETERS_FAILED); | |
927 | goto out; | |
928 | } | |
37933acb TS |
929 | } |
930 | } else if (EVP_PKEY_missing_parameters(pubkey)) { | |
931 | /* copy to pubkey from privatekey */ | |
6646e015 ZQ |
932 | if (!EVP_PKEY_copy_parameters(pubkey, privatekey)) { |
933 | ERR_raise(ERR_LIB_SSL, SSL_R_COPY_PARAMETERS_FAILED); | |
934 | goto out; | |
935 | } | |
37933acb TS |
936 | } /* else both have parameters */ |
937 | ||
37933acb | 938 | /* check that key <-> cert match */ |
c74aaa39 | 939 | if (EVP_PKEY_eq(pubkey, privatekey) != 1) { |
6849b73c | 940 | ERR_raise(ERR_LIB_SSL, SSL_R_PRIVATE_KEY_MISMATCH); |
37933acb TS |
941 | goto out; |
942 | } | |
943 | } | |
944 | if (ssl_cert_lookup_by_pkey(pubkey, &i) == NULL) { | |
6849b73c | 945 | ERR_raise(ERR_LIB_SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE); |
37933acb TS |
946 | goto out; |
947 | } | |
948 | ||
949 | if (!override && (c->pkeys[i].x509 != NULL | |
950 | || c->pkeys[i].privatekey != NULL | |
951 | || c->pkeys[i].chain != NULL)) { | |
952 | /* No override, and something already there */ | |
6849b73c | 953 | ERR_raise(ERR_LIB_SSL, SSL_R_NOT_REPLACING_CERTIFICATE); |
37933acb TS |
954 | goto out; |
955 | } | |
956 | ||
957 | if (chain != NULL) { | |
958 | dup_chain = X509_chain_up_ref(chain); | |
959 | if (dup_chain == NULL) { | |
6849b73c | 960 | ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE); |
37933acb TS |
961 | goto out; |
962 | } | |
963 | } | |
964 | ||
79b2a2f2 | 965 | OSSL_STACK_OF_X509_free(c->pkeys[i].chain); |
37933acb TS |
966 | c->pkeys[i].chain = dup_chain; |
967 | ||
968 | X509_free(c->pkeys[i].x509); | |
969 | X509_up_ref(x509); | |
970 | c->pkeys[i].x509 = x509; | |
971 | ||
972 | EVP_PKEY_free(c->pkeys[i].privatekey); | |
973 | EVP_PKEY_up_ref(privatekey); | |
974 | c->pkeys[i].privatekey = privatekey; | |
975 | ||
976 | c->key = &(c->pkeys[i]); | |
977 | ||
978 | ret = 1; | |
979 | out: | |
980 | EVP_PKEY_free(pubkey); | |
981 | return ret; | |
982 | } | |
983 | ||
984 | int SSL_use_cert_and_key(SSL *ssl, X509 *x509, EVP_PKEY *privatekey, | |
985 | STACK_OF(X509) *chain, int override) | |
986 | { | |
987 | return ssl_set_cert_and_key(ssl, NULL, x509, privatekey, chain, override); | |
988 | } | |
989 | ||
990 | int SSL_CTX_use_cert_and_key(SSL_CTX *ctx, X509 *x509, EVP_PKEY *privatekey, | |
991 | STACK_OF(X509) *chain, int override) | |
992 | { | |
993 | return ssl_set_cert_and_key(NULL, ctx, x509, privatekey, chain, override); | |
994 | } |