2 * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
11 #include "internal/cryptlib.h"
12 #include <openssl/asn1t.h>
13 #include <openssl/x509.h>
14 #include "internal/asn1_int.h"
15 #include "internal/evp_int.h"
16 #include "internal/x509_int.h"
17 #include <openssl/rsa.h>
18 #include <openssl/dsa.h>
20 struct X509_pubkey_st
{
22 ASN1_BIT_STRING
*public_key
;
26 static int x509_pubkey_decode(EVP_PKEY
**pk
, X509_PUBKEY
*key
);
28 /* Minor tweak to operation: free up EVP_PKEY */
29 static int pubkey_cb(int operation
, ASN1_VALUE
**pval
, const ASN1_ITEM
*it
,
32 if (operation
== ASN1_OP_FREE_POST
) {
33 X509_PUBKEY
*pubkey
= (X509_PUBKEY
*)*pval
;
34 EVP_PKEY_free(pubkey
->pkey
);
35 } else if (operation
== ASN1_OP_D2I_POST
) {
36 /* Attempt to decode public key and cache in pubkey structure. */
37 X509_PUBKEY
*pubkey
= (X509_PUBKEY
*)*pval
;
38 EVP_PKEY_free(pubkey
->pkey
);
41 * Opportunistically decode the key but remove any non fatal errors
42 * from the queue. Subsequent explicit attempts to decode/use the key
43 * will return an appropriate error.
46 if (x509_pubkey_decode(&pubkey
->pkey
, pubkey
) == -1)
53 ASN1_SEQUENCE_cb(X509_PUBKEY
, pubkey_cb
) = {
54 ASN1_SIMPLE(X509_PUBKEY
, algor
, X509_ALGOR
),
55 ASN1_SIMPLE(X509_PUBKEY
, public_key
, ASN1_BIT_STRING
)
56 } ASN1_SEQUENCE_END_cb(X509_PUBKEY
, X509_PUBKEY
)
58 IMPLEMENT_ASN1_FUNCTIONS(X509_PUBKEY
)
60 int X509_PUBKEY_set(X509_PUBKEY
**x
, EVP_PKEY
*pkey
)
62 X509_PUBKEY
*pk
= NULL
;
67 if ((pk
= X509_PUBKEY_new()) == NULL
)
71 if (pkey
->ameth
->pub_encode
) {
72 if (!pkey
->ameth
->pub_encode(pk
, pkey
)) {
73 X509err(X509_F_X509_PUBKEY_SET
,
74 X509_R_PUBLIC_KEY_ENCODE_ERROR
);
78 X509err(X509_F_X509_PUBKEY_SET
, X509_R_METHOD_NOT_SUPPORTED
);
82 X509err(X509_F_X509_PUBKEY_SET
, X509_R_UNSUPPORTED_ALGORITHM
);
89 EVP_PKEY_up_ref(pkey
);
98 * Attempt to decode a public key.
99 * Returns 1 on success, 0 for a decode failure and -1 for a fatal
100 * error e.g. malloc failure.
104 static int x509_pubkey_decode(EVP_PKEY
**ppkey
, X509_PUBKEY
*key
)
106 EVP_PKEY
*pkey
= EVP_PKEY_new();
109 X509err(X509_F_X509_PUBKEY_DECODE
, ERR_R_MALLOC_FAILURE
);
113 if (!EVP_PKEY_set_type(pkey
, OBJ_obj2nid(key
->algor
->algorithm
))) {
114 X509err(X509_F_X509_PUBKEY_DECODE
, X509_R_UNSUPPORTED_ALGORITHM
);
118 if (pkey
->ameth
->pub_decode
) {
120 * Treat any failure of pub_decode as a decode error. In
121 * future we could have different return codes for decode
122 * errors and fatal errors such as malloc failure.
124 if (!pkey
->ameth
->pub_decode(pkey
, key
)) {
125 X509err(X509_F_X509_PUBKEY_DECODE
, X509_R_PUBLIC_KEY_DECODE_ERROR
);
129 X509err(X509_F_X509_PUBKEY_DECODE
, X509_R_METHOD_NOT_SUPPORTED
);
141 EVP_PKEY
*X509_PUBKEY_get0(X509_PUBKEY
*key
)
143 EVP_PKEY
*ret
= NULL
;
145 if (key
== NULL
|| key
->public_key
== NULL
)
148 if (key
->pkey
!= NULL
)
152 * When the key ASN.1 is initially parsed an attempt is made to
153 * decode the public key and cache the EVP_PKEY structure. If this
154 * operation fails the cached value will be NULL. Parsing continues
155 * to allow parsing of unknown key types or unsupported forms.
156 * We repeat the decode operation so the appropriate errors are left
159 x509_pubkey_decode(&ret
, key
);
160 /* If decode doesn't fail something bad happened */
162 X509err(X509_F_X509_PUBKEY_GET0
, ERR_R_INTERNAL_ERROR
);
169 EVP_PKEY
*X509_PUBKEY_get(X509_PUBKEY
*key
)
171 EVP_PKEY
*ret
= X509_PUBKEY_get0(key
);
173 EVP_PKEY_up_ref(ret
);
178 * Now two pseudo ASN1 routines that take an EVP_PKEY structure and encode or
179 * decode as X509_PUBKEY
182 EVP_PKEY
*d2i_PUBKEY(EVP_PKEY
**a
, const unsigned char **pp
, long length
)
186 const unsigned char *q
;
188 xpk
= d2i_X509_PUBKEY(NULL
, &q
, length
);
191 pktmp
= X509_PUBKEY_get(xpk
);
192 X509_PUBKEY_free(xpk
);
203 int i2d_PUBKEY(EVP_PKEY
*a
, unsigned char **pp
)
205 X509_PUBKEY
*xpk
= NULL
;
209 if (!X509_PUBKEY_set(&xpk
, a
))
211 ret
= i2d_X509_PUBKEY(xpk
, pp
);
212 X509_PUBKEY_free(xpk
);
217 * The following are equivalents but which return RSA and DSA keys
219 #ifndef OPENSSL_NO_RSA
220 RSA
*d2i_RSA_PUBKEY(RSA
**a
, const unsigned char **pp
, long length
)
224 const unsigned char *q
;
226 pkey
= d2i_PUBKEY(NULL
, &q
, length
);
229 key
= EVP_PKEY_get1_RSA(pkey
);
241 int i2d_RSA_PUBKEY(RSA
*a
, unsigned char **pp
)
247 pktmp
= EVP_PKEY_new();
249 ASN1err(ASN1_F_I2D_RSA_PUBKEY
, ERR_R_MALLOC_FAILURE
);
252 EVP_PKEY_set1_RSA(pktmp
, a
);
253 ret
= i2d_PUBKEY(pktmp
, pp
);
254 EVP_PKEY_free(pktmp
);
259 #ifndef OPENSSL_NO_DSA
260 DSA
*d2i_DSA_PUBKEY(DSA
**a
, const unsigned char **pp
, long length
)
264 const unsigned char *q
;
266 pkey
= d2i_PUBKEY(NULL
, &q
, length
);
269 key
= EVP_PKEY_get1_DSA(pkey
);
281 int i2d_DSA_PUBKEY(DSA
*a
, unsigned char **pp
)
287 pktmp
= EVP_PKEY_new();
289 ASN1err(ASN1_F_I2D_DSA_PUBKEY
, ERR_R_MALLOC_FAILURE
);
292 EVP_PKEY_set1_DSA(pktmp
, a
);
293 ret
= i2d_PUBKEY(pktmp
, pp
);
294 EVP_PKEY_free(pktmp
);
299 #ifndef OPENSSL_NO_EC
300 EC_KEY
*d2i_EC_PUBKEY(EC_KEY
**a
, const unsigned char **pp
, long length
)
304 const unsigned char *q
;
306 pkey
= d2i_PUBKEY(NULL
, &q
, length
);
309 key
= EVP_PKEY_get1_EC_KEY(pkey
);
321 int i2d_EC_PUBKEY(EC_KEY
*a
, unsigned char **pp
)
327 if ((pktmp
= EVP_PKEY_new()) == NULL
) {
328 ASN1err(ASN1_F_I2D_EC_PUBKEY
, ERR_R_MALLOC_FAILURE
);
331 EVP_PKEY_set1_EC_KEY(pktmp
, a
);
332 ret
= i2d_PUBKEY(pktmp
, pp
);
333 EVP_PKEY_free(pktmp
);
338 int X509_PUBKEY_set0_param(X509_PUBKEY
*pub
, ASN1_OBJECT
*aobj
,
339 int ptype
, void *pval
,
340 unsigned char *penc
, int penclen
)
342 if (!X509_ALGOR_set0(pub
->algor
, aobj
, ptype
, pval
))
345 OPENSSL_free(pub
->public_key
->data
);
346 pub
->public_key
->data
= penc
;
347 pub
->public_key
->length
= penclen
;
348 /* Set number of unused bits to zero */
349 pub
->public_key
->flags
&= ~(ASN1_STRING_FLAG_BITS_LEFT
| 0x07);
350 pub
->public_key
->flags
|= ASN1_STRING_FLAG_BITS_LEFT
;
355 int X509_PUBKEY_get0_param(ASN1_OBJECT
**ppkalg
,
356 const unsigned char **pk
, int *ppklen
,
357 X509_ALGOR
**pa
, X509_PUBKEY
*pub
)
360 *ppkalg
= pub
->algor
->algorithm
;
362 *pk
= pub
->public_key
->data
;
363 *ppklen
= pub
->public_key
->length
;
370 ASN1_BIT_STRING
*X509_get0_pubkey_bitstr(const X509
*x
)
374 return x
->cert_info
.key
->public_key
;