]> git.ipfire.org Git - thirdparty/openssl.git/blame - engines/e_capi.c
projects / thirdparty / openssl.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Add initial support for multiple SSL client certifcate selection in
[thirdparty/openssl.git] / engines / e_capi.c
CommitLineData
7a18ecb2
DSH		 1/* engines/e_capi.c */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project.
4 */
5/* ====================================================================
6 * Copyright (c) 2008 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 */
53
54
55#include <stdio.h>
56#include <string.h>
b3c8dd4e
DSH		 57#include <windows.h>
58#include <wincrypt.h>
7a18ecb2
DSH		 59#include <openssl/crypto.h>
60#include <openssl/buffer.h>
61#include <openssl/engine.h>
62#include <openssl/rsa.h>
63#include <openssl/bn.h>
64#include <openssl/pem.h>
65
66#ifdef OPENSSL_SYS_WIN32
67#ifndef OPENSSL_NO_CAPIENG
68
69#ifndef _WIN32_WINNT
70#define _WIN32_WINNT 0x400
71#endif
72
7a18ecb2
DSH		 73
74#include "e_capi_err.h"
75#include "e_capi_err.c"
76
77
78static const char *engine_capi_id = "capi";
79static const char *engine_capi_name = "CryptoAPI ENGINE";
80
81typedef struct CAPI_CTX_st CAPI_CTX;
82typedef struct CAPI_KEY_st CAPI_KEY;
83
84static void capi_addlasterror(void);
85static void capi_adderror(DWORD err);
86
87static void CAPI_trace(CAPI_CTX *ctx, char *format, ...);
88
89static int capi_list_providers(CAPI_CTX *ctx, BIO *out);
90static int capi_list_containers(CAPI_CTX *ctx, BIO *out);
91int capi_list_certs(CAPI_CTX *ctx, BIO *out, char *storename);
92void capi_free_key(CAPI_KEY *key);
93
94static PCCERT_CONTEXT capi_find_cert(CAPI_CTX *ctx, const char *id, HCERTSTORE hstore);
95
96CAPI_KEY *capi_find_key(CAPI_CTX *ctx, const char *id);
97
98static EVP_PKEY *capi_load_privkey(ENGINE *eng, const char *key_id,
99 UI_METHOD *ui_method, void *callback_data);
100static int capi_rsa_sign(int dtype, const unsigned char *m, unsigned int m_len,
101 unsigned char *sigret, unsigned int *siglen, const RSA *rsa);
102static int capi_rsa_priv_enc(int flen, const unsigned char *from,
103 unsigned char *to, RSA *rsa, int padding);
104static int capi_rsa_priv_dec(int flen, const unsigned char *from,
105 unsigned char *to, RSA *rsa, int padding);
106static int capi_rsa_free(RSA *rsa);
107
108static DSA_SIG *capi_dsa_do_sign(const unsigned char *digest, int dlen,
109 DSA *dsa);
110static int capi_dsa_free(DSA *dsa);
b3c8dd4e
DSH		 111
112static int capi_load_ssl_client_cert(ENGINE *e, SSL *ssl,
113 STACK_OF(X509_NAME) *ca_dn, X509 **pcert, EVP_PKEY **pkey,
114 STACK_OF(X509) **pother, UI_METHOD *ui_method, void *callback_data);
7a18ecb2
DSH		 115
116/* This structure contains CAPI ENGINE specific data:
117 * it contains various global options and affects how
118 * other functions behave.
119 */
120
121#define CAPI_DBG_TRACE 2
122#define CAPI_DBG_ERROR 1
123
124struct CAPI_CTX_st {
125 int debug_level;
126 char *debug_file;
127 /* Parameters to use for container lookup */
128 DWORD keytype;
129 LPTSTR cspname;
130 DWORD csptype;
131 /* Certificate store name to use */
132 LPTSTR storename;
b3c8dd4e 133 LPTSTR ssl_client_store;
7a18ecb2
DSH		 134
135/* Lookup string meanings in load_private_key */
136/* Substring of subject: uses "storename" */
137#define CAPI_LU_SUBSTR 0
138/* Friendly name: uses storename */
139#define CAPI_LU_FNAME 1
140/* Container name: uses cspname, keytype */
141#define CAPI_LU_CONTNAME 2
142 int lookup_method;
143/* Info to dump with dumpcerts option */
144/* Issuer and serial name strings */
145#define CAPI_DMP_SUMMARY 0x1
146/* Friendly name */
147#define CAPI_DMP_FNAME 0x2
148/* Full X509_print dump */
149#define CAPI_DMP_FULL 0x4
150/* Dump PEM format certificate */
151#define CAPI_DMP_PEM 0x8
152/* Dump pseudo key (if possible) */
153#define CAPI_DMP_PSKEY 0x10
154/* Dump key info (if possible) */
155#define CAPI_DMP_PKEYINFO 0x20
156
157 DWORD dump_flags;
158};
159
160
161static CAPI_CTX *capi_ctx_new();
162static void capi_ctx_free(CAPI_CTX *ctx);
163static int capi_ctx_set_provname(CAPI_CTX *ctx, LPSTR pname, DWORD type, int check);
164static int capi_ctx_set_provname_idx(CAPI_CTX *ctx, int idx);
165
b3c8dd4e 166#define CAPI_CMD_LIST_CERTS ENGINE_CMD_BASE
7a18ecb2
DSH		 167#define CAPI_CMD_LOOKUP_CERT (ENGINE_CMD_BASE + 1)
168#define CAPI_CMD_DEBUG_LEVEL (ENGINE_CMD_BASE + 2)
b3c8dd4e
DSH		 169#define CAPI_CMD_DEBUG_FILE (ENGINE_CMD_BASE + 3)
170#define CAPI_CMD_KEYTYPE (ENGINE_CMD_BASE + 4)
171#define CAPI_CMD_LIST_CSPS (ENGINE_CMD_BASE + 5)
7a18ecb2
DSH		 172#define CAPI_CMD_SET_CSP_IDX (ENGINE_CMD_BASE + 6)
173#define CAPI_CMD_SET_CSP_NAME (ENGINE_CMD_BASE + 7)
174#define CAPI_CMD_SET_CSP_TYPE (ENGINE_CMD_BASE + 8)
175#define CAPI_CMD_LIST_CONTAINERS (ENGINE_CMD_BASE + 9)
176#define CAPI_CMD_LIST_OPTIONS (ENGINE_CMD_BASE + 10)
177#define CAPI_CMD_LOOKUP_METHOD (ENGINE_CMD_BASE + 11)
c621c7e4 178#define CAPI_CMD_STORE_NAME (ENGINE_CMD_BASE + 12)
7a18ecb2
DSH		 179
180static const ENGINE_CMD_DEFN capi_cmd_defns[] = {
181 {CAPI_CMD_LIST_CERTS,
182 "list_certs",
183 "List all certificates in store",
184 ENGINE_CMD_FLAG_NO_INPUT},
185 {CAPI_CMD_LOOKUP_CERT,
186 "lookup_cert",
187 "Lookup and output certificates",
188 ENGINE_CMD_FLAG_STRING},
189 {CAPI_CMD_DEBUG_LEVEL,
190 "debug_level",
191 "debug level (1=errors, 2=trace)",
192 ENGINE_CMD_FLAG_NUMERIC},
193 {CAPI_CMD_DEBUG_FILE,
194 "debug_file",
195 "debugging filename)",
196 ENGINE_CMD_FLAG_STRING},
197 {CAPI_CMD_KEYTYPE,
198 "key_type",
199 "Key type: 1=AT_KEYEXCHANGE (default), 2=AT_SIGNATURE",
200 ENGINE_CMD_FLAG_NUMERIC},
201 {CAPI_CMD_LIST_CSPS,
202 "list_csps",
203 "List all CSPs",
204 ENGINE_CMD_FLAG_NO_INPUT},
205 {CAPI_CMD_SET_CSP_IDX,
206 "csp_idx",
207 "Set CSP by index",
208 ENGINE_CMD_FLAG_NUMERIC},
209 {CAPI_CMD_SET_CSP_NAME,
210 "csp_name",
211 "Set CSP name, (default CSP used if not specified)",
212 ENGINE_CMD_FLAG_STRING},
213 {CAPI_CMD_SET_CSP_TYPE,
214 "csp_type",
215 "Set CSP type, (default RSA_PROV_FULL)",
216 ENGINE_CMD_FLAG_NUMERIC},
217 {CAPI_CMD_LIST_CONTAINERS,
218 "list_containers",
219 "list container names",
220 ENGINE_CMD_FLAG_NO_INPUT},
221 {CAPI_CMD_LIST_OPTIONS,
222 "list_options",
223 "Set list options (1=summary,2=friendly name, 4=full printout, 8=PEM output, 16=XXX, "
224 "32=private key info)",
225 ENGINE_CMD_FLAG_NUMERIC},
226 {CAPI_CMD_LOOKUP_METHOD,
227 "lookup_method",
228 "Set key lookup method (1=substring, 2=friendlyname, 3=container name)",
229 ENGINE_CMD_FLAG_NUMERIC},
c621c7e4
DSH		 230 {CAPI_CMD_STORE_NAME,
231 "store_name",
232 "certificate store name, default \"MY\"",
233 ENGINE_CMD_FLAG_STRING},
7a18ecb2
DSH		 234
235 {0, NULL, NULL, 0}
236 };
237
238static int capi_idx = -1;
239static int rsa_capi_idx = -1;
240static int dsa_capi_idx = -1;
7d537d4f 241static int cert_capi_idx = -1;
7a18ecb2
DSH		 242
243static int capi_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))
2aa2a577 244 {
7a18ecb2
DSH		 245 int ret = 1;
246 CAPI_CTX *ctx;
247 BIO *out;
248 if (capi_idx == -1)
249 {
250 CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_ENGINE_NOT_INITIALIZED);
251 return 0;
252 }
253 ctx = ENGINE_get_ex_data(e, capi_idx);
254 out = BIO_new_fp(stdout, BIO_NOCLOSE);
255 switch (cmd)
256 {
257 case CAPI_CMD_LIST_CSPS:
258 ret = capi_list_providers(ctx, out);
259 break;
260
261 case CAPI_CMD_LIST_CERTS:
262 ret = capi_list_certs(ctx, out, NULL);
263 break;
264
265 case CAPI_CMD_LOOKUP_CERT:
266 ret = capi_list_certs(ctx, out, p);
267 break;
268
269 case CAPI_CMD_LIST_CONTAINERS:
270 ret = capi_list_containers(ctx, out);
271 break;
272
c621c7e4 273 case CAPI_CMD_STORE_NAME:
953174f4
DSH		 274 if (ctx->storename)
275 OPENSSL_free(ctx->storename);
c621c7e4
DSH		 276 ctx->storename = BUF_strdup(p);
277 CAPI_trace(ctx, "Setting store name to %s\n", p);
278 break;
279
7a18ecb2
DSH		 280 case CAPI_CMD_DEBUG_LEVEL:
281 ctx->debug_level = (int)i;
282 CAPI_trace(ctx, "Setting debug level to %d\n", ctx->debug_level);
283 break;
284
285 case CAPI_CMD_DEBUG_FILE:
286 ctx->debug_file = BUF_strdup(p);
287 CAPI_trace(ctx, "Setting debug file to %s\n", ctx->debug_file);
288 break;
289
290 case CAPI_CMD_KEYTYPE:
291 ctx->keytype = i;
292 CAPI_trace(ctx, "Setting key type to %d\n", ctx->keytype);
293 break;
294
295 case CAPI_CMD_SET_CSP_IDX:
296 ret = capi_ctx_set_provname_idx(ctx, i);
297 break;
298
299 case CAPI_CMD_LIST_OPTIONS:
300 ctx->dump_flags = i;
301 break;
302
303 case CAPI_CMD_LOOKUP_METHOD:
304 if (i < 1 || i > 3)
305 {
306 CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_INVALID_LOOKUP_METHOD);
307 return 0;
308 }
309 ctx->lookup_method = i;
310 break;
311
312 case CAPI_CMD_SET_CSP_NAME:
313 ret = capi_ctx_set_provname(ctx, p, ctx->csptype, 1);
314 break;
315
316 case CAPI_CMD_SET_CSP_TYPE:
317 ctx->csptype = i;
318 break;
319
320 default:
321 CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_UNKNOWN_COMMAND);
322 ret = 0;
323 }
324
325 BIO_free(out);
326 return ret;
327
2aa2a577 328 }
7a18ecb2
DSH		 329
330static RSA_METHOD capi_rsa_method =
331 {
332 "CryptoAPI RSA method",
333 0, /* pub_enc */
334 0, /* pub_dec */
335 capi_rsa_priv_enc, /* priv_enc */
336 capi_rsa_priv_dec, /* priv_dec */
337 0, /* rsa_mod_exp */
338 0, /* bn_mod_exp */
339 0, /* init */
340 capi_rsa_free, /* finish */
341 RSA_FLAG_SIGN_VER, /* flags */
342 NULL, /* app_data */
343 capi_rsa_sign, /* rsa_sign */
344 0 /* rsa_verify */
345 };
346
347static DSA_METHOD capi_dsa_method =
348 {
349 "CryptoAPI DSA method",
350 capi_dsa_do_sign, /* dsa_do_sign */
351 0, /* dsa_sign_setup */
352 0, /* dsa_do_verify */
353 0, /* dsa_mod_exp */
354 0, /* bn_mod_exp */
355 0, /* init */
356 capi_dsa_free, /* finish */
357 0, /* flags */
358 NULL, /* app_data */
359 0, /* dsa_paramgen */
360 0 /* dsa_keygen */
361 };
362
363static int capi_init(ENGINE *e)
364 {
365 CAPI_CTX *ctx;
366 const RSA_METHOD *ossl_rsa_meth;
367 const DSA_METHOD *ossl_dsa_meth;
368 capi_idx = ENGINE_get_ex_new_index(0, NULL, NULL, NULL, 0);
7d537d4f 369 cert_capi_idx = X509_get_ex_new_index(0, NULL, NULL, NULL, 0);
7a18ecb2
DSH		 370
371 ctx = capi_ctx_new();
372 if (!ctx || (capi_idx < 0))
373 goto memerr;
374
375 ENGINE_set_ex_data(e, capi_idx, ctx);
376 /* Setup RSA_METHOD */
377 rsa_capi_idx = RSA_get_ex_new_index(0, NULL, NULL, NULL, 0);
378 ossl_rsa_meth = RSA_PKCS1_SSLeay();
379 capi_rsa_method.rsa_pub_enc = ossl_rsa_meth->rsa_pub_enc;
380 capi_rsa_method.rsa_pub_dec = ossl_rsa_meth->rsa_pub_dec;
381 capi_rsa_method.rsa_mod_exp = ossl_rsa_meth->rsa_mod_exp;
382 capi_rsa_method.bn_mod_exp = ossl_rsa_meth->bn_mod_exp;
383
384 /* Setup DSA Method */
385 dsa_capi_idx = DSA_get_ex_new_index(0, NULL, NULL, NULL, 0);
386 ossl_dsa_meth = DSA_OpenSSL();
387 capi_dsa_method.dsa_do_verify = ossl_dsa_meth->dsa_do_verify;
388 capi_dsa_method.dsa_mod_exp = ossl_dsa_meth->dsa_mod_exp;
389 capi_dsa_method.bn_mod_exp = ossl_dsa_meth->bn_mod_exp;
390
391 return 1;
392
393 memerr:
394 CAPIerr(CAPI_F_CAPI_INIT, ERR_R_MALLOC_FAILURE);
395 return 0;
396
397 return 1;
398 }
399
400static int capi_destroy(ENGINE *e)
401 {
7a18ecb2
DSH		 402 ERR_unload_CAPI_strings();
403 return 1;
404 }
405
406static int capi_finish(ENGINE *e)
407 {
408 CAPI_CTX *ctx;
409 ctx = ENGINE_get_ex_data(e, capi_idx);
410 capi_ctx_free(ctx);
411 ENGINE_set_ex_data(e, capi_idx, NULL);
412 return 1;
413 }
414
415
416/* CryptoAPI key application data. This contains
417 * a handle to the private key container (for sign operations)
418 * and a handle to the key (for decrypt operations).
419 */
420
421struct CAPI_KEY_st
422 {
7d537d4f
DSH		 423 /* Associated certificate context (if any) */
424 PCERT_CONTEXT pcert;
7a18ecb2
DSH		 425 HCRYPTPROV hprov;
426 HCRYPTKEY key;
4be0a5d4 427 DWORD keyspec;
7a18ecb2
DSH		 428 };
429
430static int bind_capi(ENGINE *e)
431 {
432 if (!ENGINE_set_id(e, engine_capi_id)
433 || !ENGINE_set_name(e, engine_capi_name)
434 || !ENGINE_set_init_function(e, capi_init)
435 || !ENGINE_set_finish_function(e, capi_finish)
436 || !ENGINE_set_destroy_function(e, capi_destroy)
437 || !ENGINE_set_RSA(e, &capi_rsa_method)
438 || !ENGINE_set_DSA(e, &capi_dsa_method)
439 || !ENGINE_set_load_privkey_function(e, capi_load_privkey)
b3c8dd4e
DSH		 440 || !ENGINE_set_load_ssl_client_cert_function(e,
441 capi_load_ssl_client_cert)
7a18ecb2
DSH		 442 || !ENGINE_set_cmd_defns(e, capi_cmd_defns)
443 || !ENGINE_set_ctrl_function(e, capi_ctrl))
444 return 0;
445 ERR_load_CAPI_strings();
446
447 return 1;
448
449 }
450
451#ifndef OPENSSL_NO_DYNAMIC_ENGINE
452static int bind_helper(ENGINE *e, const char *id)
453 {
454 if(id && (strcmp(id, engine_capi_id) != 0))
455 return 0;
456 if(!bind_capi(e))
457 return 0;
458 return 1;
459 }
460IMPLEMENT_DYNAMIC_CHECK_FN()
461IMPLEMENT_DYNAMIC_BIND_FN(bind_helper)
462#else
463static ENGINE *engine_capi(void)
464 {
465 ENGINE *ret = ENGINE_new();
466 if(!ret)
467 return NULL;
468 if(!bind_capi(ret))
469 {
470 ENGINE_free(ret);
471 return NULL;
472 }
473 return ret;
474 }
475
476void ENGINE_load_capi(void)
477 {
478 /* Copied from eng_[openssl|dyn].c */
479 ENGINE *toadd = engine_capi();
480 if(!toadd) return;
481 ENGINE_add(toadd);
482 ENGINE_free(toadd);
483 ERR_clear_error();
484 }
485#endif
486
487
488static int lend_tobn(BIGNUM *bn, unsigned char *bin, int binlen)
489 {
490 int i;
491 /* Reverse buffer in place: since this is a keyblob structure
492 * that will be freed up after conversion anyway it doesn't
493 * matter if we change it.
494 */
495 for(i = 0; i < binlen / 2; i++)
496 {
497 unsigned char c;
498 c = bin[i];
499 bin[i] = bin[binlen - i - 1];
500 bin[binlen - i - 1] = c;
501 }
502
503 if (!BN_bin2bn(bin, binlen, bn))
504 return 0;
505 return 1;
506 }
507
b3c8dd4e
DSH		 508/* Given a CAPI_KEY get an EVP_PKEY structure */
509
510static EVP_PKEY *capi_get_pkey(ENGINE *eng, CAPI_KEY *key)
7a18ecb2 511 {
7a18ecb2
DSH		 512 unsigned char *pubkey = NULL;
513 DWORD len;
514 BLOBHEADER *bh;
515 RSA *rkey = NULL;
516 DSA *dkey = NULL;
b3c8dd4e 517 EVP_PKEY *ret = NULL;
7a18ecb2
DSH		 518 if (!CryptExportKey(key->key, 0, PUBLICKEYBLOB, 0, NULL, &len))
519 {
b3c8dd4e 520 CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_PUBKEY_EXPORT_LENGTH_ERROR);
7a18ecb2
DSH		 521 capi_addlasterror();
522 return NULL;
523 }
524
525 pubkey = OPENSSL_malloc(len);
526
527 if (!pubkey)
528 goto memerr;
529
530 if (!CryptExportKey(key->key, 0, PUBLICKEYBLOB, 0, pubkey, &len))
531 {
b3c8dd4e 532 CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_PUBKEY_EXPORT_ERROR);
7a18ecb2
DSH		 533 capi_addlasterror();
534 goto err;
535 }
536
537 bh = (BLOBHEADER *)pubkey;
538 if (bh->bType != PUBLICKEYBLOB)
539 {
b3c8dd4e 540 CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_INVALID_PUBLIC_KEY_BLOB);
7a18ecb2
DSH		 541 goto err;
542 }
543 if (bh->aiKeyAlg == CALG_RSA_SIGN || bh->aiKeyAlg == CALG_RSA_KEYX)
544 {
545 RSAPUBKEY *rp;
546 DWORD rsa_modlen;
547 unsigned char *rsa_modulus;
548 rp = (RSAPUBKEY *)(bh + 1);
549 if (rp->magic != 0x31415352)
550 {
551 char magstr[10];
552 BIO_snprintf(magstr, 10, "%lx", rp->magic);
b3c8dd4e 553 CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_INVALID_RSA_PUBLIC_KEY_BLOB_MAGIC_NUMBER);
7a18ecb2
DSH		 554 ERR_add_error_data(2, "magic=0x", magstr);
555 goto err;
556 }
557 rsa_modulus = (unsigned char *)(rp + 1);
558 rkey = RSA_new_method(eng);
559 if (!rkey)
560 goto memerr;
561
562 rkey->e = BN_new();
563 rkey->n = BN_new();
564
565 if (!rkey->e || !rkey->n)
566 goto memerr;
567
568 if (!BN_set_word(rkey->e, rp->pubexp))
569 goto memerr;
570
571 rsa_modlen = rp->bitlen / 8;
572 if (!lend_tobn(rkey->n, rsa_modulus, rsa_modlen))
573 goto memerr;
574
575 RSA_set_ex_data(rkey, rsa_capi_idx, key);
576
577 if (!(ret = EVP_PKEY_new()))
578 goto memerr;
579
580 EVP_PKEY_assign_RSA(ret, rkey);
581 rkey = NULL;
582
583 }
584 else if (bh->aiKeyAlg == CALG_DSS_SIGN)
585 {
586 DSSPUBKEY *dp;
587 DWORD dsa_plen;
588 unsigned char *btmp;
589 dp = (DSSPUBKEY *)(bh + 1);
590 if (dp->magic != 0x31535344)
591 {
592 char magstr[10];
593 BIO_snprintf(magstr, 10, "%lx", dp->magic);
b3c8dd4e 594 CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_INVALID_DSA_PUBLIC_KEY_BLOB_MAGIC_NUMBER);
7a18ecb2
DSH		 595 ERR_add_error_data(2, "magic=0x", magstr);
596 goto err;
597 }
598 dsa_plen = dp->bitlen / 8;
599 btmp = (unsigned char *)(dp + 1);
600 dkey = DSA_new_method(eng);
601 if (!dkey)
602 goto memerr;
603 dkey->p = BN_new();
604 dkey->q = BN_new();
605 dkey->g = BN_new();
606 dkey->pub_key = BN_new();
607 if (!dkey->p || !dkey->q || !dkey->g || !dkey->pub_key)
608 goto memerr;
609 if (!lend_tobn(dkey->p, btmp, dsa_plen))
610 goto memerr;
611 btmp += dsa_plen;
612 if (!lend_tobn(dkey->q, btmp, 20))
613 goto memerr;
614 btmp += 20;
615 if (!lend_tobn(dkey->g, btmp, dsa_plen))
616 goto memerr;
617 btmp += dsa_plen;
618 if (!lend_tobn(dkey->pub_key, btmp, dsa_plen))
619 goto memerr;
620 btmp += dsa_plen;
621
622 DSA_set_ex_data(dkey, dsa_capi_idx, key);
623
624 if (!(ret = EVP_PKEY_new()))
625 goto memerr;
626
627 EVP_PKEY_assign_DSA(ret, dkey);
628 dkey = NULL;
629 }
630 else
631 {
632 char algstr[10];
633 BIO_snprintf(algstr, 10, "%lx", bh->aiKeyAlg);
b3c8dd4e 634 CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_UNSUPPORTED_PUBLIC_KEY_ALGORITHM);
7a18ecb2
DSH		 635 ERR_add_error_data(2, "aiKeyAlg=0x", algstr);
636 goto err;
637 }
638
b3c8dd4e 639
7a18ecb2
DSH		 640 err:
641 if (pubkey)
642 OPENSSL_free(pubkey);
643 if (!ret)
644 {
645 if (rkey)
646 RSA_free(rkey);
647 if (dkey)
648 DSA_free(dkey);
7a18ecb2
DSH		 649 }
650
651 return ret;
652
653memerr:
654 CAPIerr(CAPI_F_CAPI_LOAD_PRIVKEY, ERR_R_MALLOC_FAILURE);
655 goto err;
656
657 }
658
b3c8dd4e
DSH		 659static EVP_PKEY *capi_load_privkey(ENGINE *eng, const char *key_id,
660 UI_METHOD *ui_method, void *callback_data)
661 {
662 CAPI_CTX *ctx;
663 CAPI_KEY *key;
664 EVP_PKEY *ret;
665 ctx = ENGINE_get_ex_data(eng, capi_idx);
666
667 if (!ctx)
668 {
669 CAPIerr(CAPI_F_CAPI_LOAD_PRIVKEY, CAPI_R_CANT_FIND_CAPI_CONTEXT);
670 return NULL;
671 }
672
673 key = capi_find_key(ctx, key_id);
674
675 if (!key)
676 return NULL;
677
678 ret = capi_get_pkey(eng, key);
679
680 if (!ret)
681 capi_free_key(key);
682 return ret;
683
684 }
685
7a18ecb2
DSH		 686/* CryptoAPI RSA operations */
687
688int capi_rsa_priv_enc(int flen, const unsigned char *from,
689 unsigned char *to, RSA *rsa, int padding)
690 {
691 CAPIerr(CAPI_F_CAPI_RSA_PRIV_ENC, CAPI_R_FUNCTION_NOT_SUPPORTED);
692 return -1;
693 }
694
695int capi_rsa_sign(int dtype, const unsigned char *m, unsigned int m_len,
696 unsigned char *sigret, unsigned int *siglen, const RSA *rsa)
697 {
698 ALG_ID alg;
699 HCRYPTHASH hash;
700 DWORD slen;
701 unsigned int i;
702 int ret = -1;
703 CAPI_KEY *capi_key;
704 CAPI_CTX *ctx;
705
706 ctx = ENGINE_get_ex_data(rsa->engine, capi_idx);
707
708 CAPI_trace(ctx, "Called CAPI_rsa_sign()\n");
709
710 capi_key = RSA_get_ex_data(rsa, rsa_capi_idx);
711 if (!capi_key)
712 {
713 CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_GET_KEY);
714 return -1;
715 }
716/* Convert the signature type to a CryptoAPI algorithm ID */
2aa2a577
DSH		 717 switch(dtype)
718 {
7a18ecb2
DSH		 719 case NID_sha1:
720 alg = CALG_SHA1;
721 break;
722
723 case NID_md5:
724 alg = CALG_MD5;
725 break;
726
727 case NID_md5_sha1:
728 alg = CALG_SSL3_SHAMD5;
729 break;
730 default:
731 {
732 char algstr[10];
733 BIO_snprintf(algstr, 10, "%lx", dtype);
734 CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_UNSUPPORTED_ALGORITHM_NID);
735 ERR_add_error_data(2, "NID=0x", algstr);
736 return -1;
737 }
738 }
739
740
741
742/* Create the hash object */
2aa2a577
DSH		 743 if(!CryptCreateHash(capi_key->hprov, alg, 0, 0, &hash))
744 {
7a18ecb2
DSH		 745 CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_CREATE_HASH_OBJECT);
746 capi_addlasterror();
747 return -1;
2aa2a577 748 }
7a18ecb2
DSH		 749/* Set the hash value to the value passed */
750
2aa2a577
DSH		 751 if(!CryptSetHashParam(hash, HP_HASHVAL, (unsigned char *)m, 0))
752 {
7a18ecb2
DSH		 753 CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_SET_HASH_VALUE);
754 capi_addlasterror();
755 goto err;
2aa2a577 756 }
7a18ecb2
DSH		 757
758
759/* Finally sign it */
760 slen = RSA_size(rsa);
2aa2a577
DSH		 761 if(!CryptSignHash(hash, capi_key->keyspec, NULL, 0, sigret, &slen))
762 {
7a18ecb2
DSH		 763 CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_ERROR_SIGNING_HASH);
764 capi_addlasterror();
765 goto err;
2aa2a577
DSH		 766 }
767 else
768 {
7a18ecb2
DSH		 769 ret = 1;
770 /* Inplace byte reversal of signature */
2aa2a577
DSH		 771 for(i = 0; i < slen / 2; i++)
772 {
7a18ecb2
DSH		 773 unsigned char c;
774 c = sigret[i];
775 sigret[i] = sigret[slen - i - 1];
776 sigret[slen - i - 1] = c;
2aa2a577 777 }
7a18ecb2 778 *siglen = slen;
2aa2a577 779 }
7a18ecb2 780
7a18ecb2
DSH		 781 /* Now cleanup */
782
783err:
784 CryptDestroyHash(hash);
785
786 return ret;
2aa2a577 787 }
7a18ecb2
DSH		 788
789int capi_rsa_priv_dec(int flen, const unsigned char *from,
790 unsigned char *to, RSA *rsa, int padding)
2aa2a577 791 {
7a18ecb2
DSH		 792 int i;
793 unsigned char *tmpbuf;
794 CAPI_KEY *capi_key;
795 CAPI_CTX *ctx;
796 ctx = ENGINE_get_ex_data(rsa->engine, capi_idx);
797
798 CAPI_trace(ctx, "Called capi_rsa_priv_dec()\n");
799
800
801 capi_key = RSA_get_ex_data(rsa, rsa_capi_idx);
802 if (!capi_key)
803 {
804 CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_CANT_GET_KEY);
805 return -1;
806 }
807
808 if(padding != RSA_PKCS1_PADDING)
809 {
810 char errstr[10];
811 BIO_snprintf(errstr, 10, "%d", padding);
812 CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_UNSUPPORTED_PADDING);
813 ERR_add_error_data(2, "padding=", errstr);
814 return -1;
815 }
816
817 /* Create temp reverse order version of input */
818 if(!(tmpbuf = OPENSSL_malloc(flen)) )
819 {
820 CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, ERR_R_MALLOC_FAILURE);
821 return -1;
822 }
823 for(i = 0; i < flen; i++)
824 tmpbuf[flen - i - 1] = from[i];
825
826 /* Finally decrypt it */
827 if(!CryptDecrypt(capi_key->key, 0, TRUE, 0, tmpbuf, &flen))
828 {
829 CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_DECRYPT_ERROR);
830 capi_addlasterror();
831 OPENSSL_free(tmpbuf);
832 return -1;
833 }
834 else memcpy(to, tmpbuf, flen);
835
836 OPENSSL_free(tmpbuf);
837
838 return flen;
2aa2a577 839 }
7a18ecb2
DSH		 840
841static int capi_rsa_free(RSA *rsa)
842 {
843 CAPI_KEY *capi_key;
844 capi_key = RSA_get_ex_data(rsa, rsa_capi_idx);
845 capi_free_key(capi_key);
846 RSA_set_ex_data(rsa, rsa_capi_idx, 0);
847 return 1;
848 }
849
850/* CryptoAPI DSA operations */
851
852static DSA_SIG *capi_dsa_do_sign(const unsigned char *digest, int dlen,
853 DSA *dsa)
854 {
855 HCRYPTHASH hash;
856 DWORD slen;
857 DSA_SIG *ret = NULL;
858 CAPI_KEY *capi_key;
859 CAPI_CTX *ctx;
860 unsigned char csigbuf[40];
861
862 ctx = ENGINE_get_ex_data(dsa->engine, capi_idx);
863
864 CAPI_trace(ctx, "Called CAPI_dsa_do_sign()\n");
865
866 capi_key = DSA_get_ex_data(dsa, dsa_capi_idx);
867
868 if (!capi_key)
869 {
870 CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_GET_KEY);
871 return NULL;
872 }
873
874 if (dlen != 20)
875 {
876 CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_INVALID_DIGEST_LENGTH);
877 return NULL;
878 }
879
880 /* Create the hash object */
2aa2a577
DSH		 881 if(!CryptCreateHash(capi_key->hprov, CALG_SHA1, 0, 0, &hash))
882 {
7a18ecb2
DSH		 883 CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_CREATE_HASH_OBJECT);
884 capi_addlasterror();
885 return NULL;
2aa2a577 886 }
7a18ecb2
DSH		 887
888 /* Set the hash value to the value passed */
2aa2a577
DSH		 889 if(!CryptSetHashParam(hash, HP_HASHVAL, (unsigned char *)digest, 0))
890 {
7a18ecb2
DSH		 891 CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_SET_HASH_VALUE);
892 capi_addlasterror();
893 goto err;
2aa2a577 894 }
7a18ecb2
DSH		 895
896
897 /* Finally sign it */
898 slen = sizeof(csigbuf);
2bbe8f91 899 if(!CryptSignHash(hash, capi_key->keyspec, NULL, 0, csigbuf, &slen))
7a18ecb2
DSH		 900 {
901 CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_ERROR_SIGNING_HASH);
902 capi_addlasterror();
903 goto err;
904 }
905 else
906 {
907 ret = DSA_SIG_new();
908 if (!ret)
909 goto err;
910 ret->r = BN_new();
911 ret->s = BN_new();
912 if (!ret->r || !ret->s)
913 goto err;
914 if (!lend_tobn(ret->r, csigbuf, 20)
915 || !lend_tobn(ret->s, csigbuf + 20, 20))
916 {
917 DSA_SIG_free(ret);
918 ret = NULL;
919 goto err;
920 }
921 }
922
923 /* Now cleanup */
924
925err:
926 OPENSSL_cleanse(csigbuf, 40);
927 CryptDestroyHash(hash);
928 return ret;
929 }
930
931static int capi_dsa_free(DSA *dsa)
932 {
933 CAPI_KEY *capi_key;
934 capi_key = DSA_get_ex_data(dsa, dsa_capi_idx);
935 capi_free_key(capi_key);
936 DSA_set_ex_data(dsa, dsa_capi_idx, 0);
937 return 1;
938 }
939
940static void capi_vtrace(CAPI_CTX *ctx, int level, char *format, va_list argptr)
941 {
942 BIO *out;
943
944 if (!ctx || (ctx->debug_level < level) || (!ctx->debug_file))
945 return;
946 out = BIO_new_file(ctx->debug_file, "a+");
947 BIO_vprintf(out, format, argptr);
948 BIO_free(out);
949 }
950
951static void CAPI_trace(CAPI_CTX *ctx, char *format, ...)
952 {
953 va_list args;
954 va_start(args, format);
955 capi_vtrace(ctx, CAPI_DBG_TRACE, format, args);
956 va_end(args);
957 }
958
959static void capi_addlasterror(void)
960 {
961 capi_adderror(GetLastError());
962 }
963
964static void capi_adderror(DWORD err)
965 {
966 char errstr[10];
967 BIO_snprintf(errstr, 10, "%lX", err);
968 ERR_add_error_data(2, "Error code= 0x", errstr);
969 }
970
971static char *wide_to_asc(LPWSTR wstr)
972 {
973 char *str;
974 if (!wstr)
975 return NULL;
976 str = OPENSSL_malloc(wcslen(wstr) + 1);
977 if (!str)
978 {
979 CAPIerr(CAPI_F_WIDE_TO_ASC, ERR_R_MALLOC_FAILURE);
980 return NULL;
981 }
982 sprintf(str, "%S", wstr);
983 return str;
984 }
985
986static int capi_get_provname(CAPI_CTX *ctx, LPSTR *pname, DWORD *ptype, DWORD idx)
987 {
988 LPSTR name;
989 DWORD len, err;
990 CAPI_trace(ctx, "capi_get_provname, index=%d\n", idx);
991 if (!CryptEnumProviders(idx, NULL, 0, ptype, NULL, &len))
992 {
993 err = GetLastError();
994 if (err == ERROR_NO_MORE_ITEMS)
995 return 2;
996 CAPIerr(CAPI_F_CAPI_GET_PROVNAME, CAPI_R_CRYPTENUMPROVIDERS_ERROR);
997 capi_adderror(err);
998 return 0;
999 }
1000 name = OPENSSL_malloc(len);
1001 if (!CryptEnumProviders(idx, NULL, 0, ptype, name, &len))
1002 {
1003 err = GetLastError();
1004 if (err == ERROR_NO_MORE_ITEMS)
1005 return 2;
1006 CAPIerr(CAPI_F_CAPI_GET_PROVNAME, CAPI_R_CRYPTENUMPROVIDERS_ERROR);
1007 capi_adderror(err);
1008 return 0;
1009 }
1010 *pname = name;
1011 CAPI_trace(ctx, "capi_get_provname, returned name=%s, type=%d\n", name, *ptype);
1012
1013 return 1;
1014 }
1015
1016static int capi_list_providers(CAPI_CTX *ctx, BIO *out)
1017 {
1018 DWORD idx, ptype;
1019 int ret;
1020 LPTSTR provname = NULL;
1021 CAPI_trace(ctx, "capi_list_providers\n");
1022 BIO_printf(out, "Available CSPs:\n");
1023 for(idx = 0; ; idx++)
1024 {
1025 ret = capi_get_provname(ctx, &provname, &ptype, idx);
1026 if (ret == 2)
1027 break;
1028 if (ret == 0)
1029 break;
1030 BIO_printf(out, "%d. %s, type %d\n", idx, provname, ptype);
1031 OPENSSL_free(provname);
1032 }
1033 return 1;
1034 }
1035
1036static int capi_list_containers(CAPI_CTX *ctx, BIO *out)
1037 {
1038 int ret = 1;
1039 HCRYPTPROV hprov;
1040 DWORD err, idx, flags, buflen = 0, clen;
1041 LPSTR cname;
1042 CAPI_trace(ctx, "Listing containers CSP=%s, type = %d\n", ctx->cspname, ctx->csptype);
1043 if (!CryptAcquireContext(&hprov, NULL, ctx->cspname, ctx->csptype, CRYPT_VERIFYCONTEXT))
1044 {
1045 CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_CRYPTACQUIRECONTEXT_ERROR);
1046 capi_addlasterror();
1047 return 0;
1048 }
1049 if (!CryptGetProvParam(hprov, PP_ENUMCONTAINERS, NULL, &buflen, CRYPT_FIRST))
1050 {
1051 CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_ENUMCONTAINERS_ERROR);
1052 capi_addlasterror();
1053 return 0;
1054 }
1055 CAPI_trace(ctx, "Got max container len %d\n", buflen);
1056 if (buflen == 0)
1057 buflen = 1024;
1058 cname = OPENSSL_malloc(buflen);
1059 if (!cname)
1060 {
1061 CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, ERR_R_MALLOC_FAILURE);
1062 goto err;
1063 }
1064
1065 for (idx = 0;;idx++)
1066 {
2aa2a577
DSH		 1067 clen = buflen;
1068 cname[0] = 0;
1069
1070 if (idx == 0)
1071 flags = CRYPT_FIRST;
1072 else
1073 flags = 0;
1074 if(!CryptGetProvParam(hprov, PP_ENUMCONTAINERS, cname, &clen, flags))
1075 {
1076 err = GetLastError();
1077 if (err == ERROR_NO_MORE_ITEMS)
7a18ecb2 1078 goto done;
2aa2a577
DSH		 1079 CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_ENUMCONTAINERS_ERROR);
1080 capi_adderror(err);
1081 goto err;
1082 }
1083 CAPI_trace(ctx, "Container name %s, len=%d, index=%d, flags=%d\n", cname, clen, idx, flags);
1084 if (!cname[0] && (clen == buflen))
1085 {
1086 CAPI_trace(ctx, "Enumerate bug: using workaround\n");
1087 goto done;
1088 }
1089 BIO_printf(out, "%d. %s\n", idx, cname);
7a18ecb2
DSH		 1090 }
1091 err:
1092
1093 ret = 0;
1094
1095 done:
1096 if (cname)
1097 OPENSSL_free(cname);
1098 CryptReleaseContext(hprov, 0);
1099
1100 return ret;
1101 }
1102
1103CRYPT_KEY_PROV_INFO *capi_get_prov_info(CAPI_CTX *ctx, PCCERT_CONTEXT cert)
1104 {
1105 DWORD len;
1106 CRYPT_KEY_PROV_INFO *pinfo;
1107
1108 if(!CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, NULL, &len))
1109 return NULL;
1110 pinfo = OPENSSL_malloc(len);
1111 if (!pinfo)
1112 {
1113 CAPIerr(CAPI_F_CAPI_GET_PROV_INFO, ERR_R_MALLOC_FAILURE);
1114 return NULL;
1115 }
1116 if(!CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, pinfo, &len))
1117 {
1118 CAPIerr(CAPI_F_CAPI_GET_PROV_INFO, CAPI_R_ERROR_GETTING_KEY_PROVIDER_INFO);
1119 capi_addlasterror();
1120 OPENSSL_free(pinfo);
1121 return NULL;
1122 }
1123 return pinfo;
1124 }
1125
1126static void capi_dump_prov_info(CAPI_CTX *ctx, BIO *out, CRYPT_KEY_PROV_INFO *pinfo)
1127 {
1128 char *provname = NULL, *contname = NULL;
1129 if (!pinfo)
1130 {
1131 BIO_printf(out, " No Private Key\n");
1132 return;
1133 }
1134 provname = wide_to_asc(pinfo->pwszProvName);
1135 contname = wide_to_asc(pinfo->pwszContainerName);
1136 if (!provname || !contname)
1137 goto err;
1138
1139 BIO_printf(out, " Private Key Info:\n");
1140 BIO_printf(out, " Provider Name: %s, Provider Type %d\n", provname, pinfo->dwProvType);
1141 BIO_printf(out, " Container Name: %s, Key Type %d\n", contname, pinfo->dwKeySpec);
1142 err:
1143 if (provname)
1144 OPENSSL_free(provname);
1145 if (contname)
1146 OPENSSL_free(contname);
1147 }
1148
1149char * capi_cert_get_fname(CAPI_CTX *ctx, PCCERT_CONTEXT cert)
1150 {
1151 LPWSTR wfname;
1152 DWORD dlen;
1153
1154 CAPI_trace(ctx, "capi_cert_get_fname\n");
1155 if (!CertGetCertificateContextProperty(cert, CERT_FRIENDLY_NAME_PROP_ID, NULL, &dlen))
1156 return NULL;
1157 wfname = OPENSSL_malloc(dlen);
1158 if (CertGetCertificateContextProperty(cert, CERT_FRIENDLY_NAME_PROP_ID, wfname, &dlen))
1159 {
1160 char *fname = wide_to_asc(wfname);
1161 OPENSSL_free(wfname);
1162 return fname;
1163 }
1164 CAPIerr(CAPI_F_CAPI_CERT_GET_FNAME, CAPI_R_ERROR_GETTING_FRIENDLY_NAME);
1165 capi_addlasterror();
1166
1167 OPENSSL_free(wfname);
1168 return NULL;
1169 }
1170
1171
1172void capi_dump_cert(CAPI_CTX *ctx, BIO *out, PCCERT_CONTEXT cert)
1173 {
1174 X509 *x;
1175 unsigned char *p;
1176 unsigned long flags = ctx->dump_flags;
1177 if (flags & CAPI_DMP_FNAME)
1178 {
1179 char *fname;
1180 fname = capi_cert_get_fname(ctx, cert);
1181 if (fname)
1182 {
1183 BIO_printf(out, " Friendly Name \"%s\"\n", fname);
1184 OPENSSL_free(fname);
1185 }
1186 else
1187 BIO_printf(out, " <No Friendly Name>\n");
1188 }
1189
1190 p = cert->pbCertEncoded;
1191 x = d2i_X509(NULL, &p, cert->cbCertEncoded);
1192 if (!x)
1193 BIO_printf(out, " <Can't parse certificate>\n");
1194 if (flags & CAPI_DMP_SUMMARY)
1195 {
1196 BIO_printf(out, " Subject: ");
1197 X509_NAME_print_ex(out, X509_get_subject_name(x), 0, XN_FLAG_ONELINE);
1198 BIO_printf(out, "\n Issuer: ");
1199 X509_NAME_print_ex(out, X509_get_issuer_name(x), 0, XN_FLAG_ONELINE);
1200 BIO_printf(out, "\n");
1201 }
1202 if (flags & CAPI_DMP_FULL)
1203 X509_print_ex(out, x, XN_FLAG_ONELINE,0);
1204
1205 if (flags & CAPI_DMP_PKEYINFO)
1206 {
1207 CRYPT_KEY_PROV_INFO *pinfo;
1208 pinfo = capi_get_prov_info(ctx, cert);
1209 capi_dump_prov_info(ctx, out, pinfo);
1210 if (pinfo)
1211 OPENSSL_free(pinfo);
1212 }
1213
1214 if (flags & CAPI_DMP_PEM)
1215 PEM_write_bio_X509(out, x);
1216 X509_free(x);
1217 }
1218
1219HCERTSTORE capi_open_store(CAPI_CTX *ctx, char *storename)
1220 {
1221 HCERTSTORE hstore;
1222
1223 if (!storename)
1224 storename = ctx->storename;
1225 if (!storename)
1226 storename = "MY";
1227 CAPI_trace(ctx, "Opening certificate store %s\n", storename);
1228
1229 hstore = CertOpenSystemStore(0, storename);
1230 if (!hstore)
1231 {
1232 CAPIerr(CAPI_F_CAPI_OPEN_STORE, CAPI_R_ERROR_OPENING_STORE);
1233 capi_addlasterror();
1234 }
1235 return hstore;
1236 }
1237
1238int capi_list_certs(CAPI_CTX *ctx, BIO *out, char *id)
1239 {
1240 char *storename;
1241 int idx;
1242 int ret = 1;
1243 HCERTSTORE hstore;
1244 PCCERT_CONTEXT cert = NULL;
1245
1246 storename = ctx->storename;
1247 if (!storename)
1248 storename = "MY";
1249 CAPI_trace(ctx, "Listing certs for store %s\n", storename);
1250
1251 hstore = capi_open_store(ctx, storename);
1252 if (!hstore)
1253 return 0;
1254 if (id)
1255 {
1256 cert = capi_find_cert(ctx, id, hstore);
1257 if (!cert)
1258 {
1259 ret = 0;
1260 goto err;
1261 }
1262 capi_dump_cert(ctx, out, cert);
1263 CertFreeCertificateContext(cert);
1264 }
1265 else
1266 {
1267 for(idx = 0;;idx++)
1268 {
1269 LPWSTR fname = NULL;
1270 cert = CertEnumCertificatesInStore(hstore, cert);
1271 if (!cert)
1272 break;
1273 BIO_printf(out, "Certificate %d\n", idx);
1274 capi_dump_cert(ctx, out, cert);
1275 }
1276 }
1277 err:
1278 CertCloseStore(hstore, 0);
1279 return ret;
1280 }
1281
1282static PCCERT_CONTEXT capi_find_cert(CAPI_CTX *ctx, const char *id, HCERTSTORE hstore)
1283 {
1284 PCCERT_CONTEXT cert = NULL;
1285 char *fname = NULL;
1286 int match;
1287 switch(ctx->lookup_method)
1288 {
1289 case CAPI_LU_SUBSTR:
2aa2a577
DSH		 1290 return CertFindCertificateInStore(hstore,
1291 X509_ASN_ENCODING, 0,
1292 CERT_FIND_SUBJECT_STR_A, id, NULL);
7a18ecb2
DSH		 1293 case CAPI_LU_FNAME:
1294 for(;;)
1295 {
1296 cert = CertEnumCertificatesInStore(hstore, cert);
1297 if (!cert)
1298 return NULL;
1299 fname = capi_cert_get_fname(ctx, cert);
1300 if (fname)
1301 {
1302 if (strcmp(fname, id))
1303 match = 0;
1304 else
1305 match = 1;
1306 OPENSSL_free(fname);
1307 if (match)
1308 return cert;
1309 }
1310 }
1311 default:
1312 return NULL;
1313 }
1314 }
1315
1316static CAPI_KEY *capi_get_key(CAPI_CTX *ctx, const char *contname, char *provname, DWORD ptype, DWORD keyspec)
1317 {
1318 CAPI_KEY *key;
1319 key = OPENSSL_malloc(sizeof(CAPI_KEY));
1320 CAPI_trace(ctx, "capi_get_key, contname=%s, provname=%s, type=%d\n",
2aa2a577 1321 contname, provname, ptype);
7a18ecb2
DSH		 1322 if (!CryptAcquireContext(&key->hprov, contname, provname, ptype, 0))
1323 {
1324 CAPIerr(CAPI_F_CAPI_GET_KEY, CAPI_R_CRYPTACQUIRECONTEXT_ERROR);
1325 capi_addlasterror();
1326 goto err;
1327 }
1328 if (!CryptGetUserKey(key->hprov, keyspec, &key->key))
1329 {
1330 CAPIerr(CAPI_F_CAPI_GET_KEY, CAPI_R_GETUSERKEY_ERROR);
1331 capi_addlasterror();
1332 CryptReleaseContext(key->hprov, 0);
1333 goto err;
1334 }
4be0a5d4 1335 key->keyspec = keyspec;
7d537d4f 1336 key->pcert = NULL;
7a18ecb2
DSH		 1337 return key;
1338
1339 err:
1340 OPENSSL_free(key);
1341 return NULL;
1342 }
1343
1344static CAPI_KEY *capi_get_cert_key(CAPI_CTX *ctx, PCCERT_CONTEXT cert)
1345 {
1346 CAPI_KEY *key;
1347 CRYPT_KEY_PROV_INFO *pinfo = NULL;
1348 char *provname = NULL, *contname = NULL;
1349 pinfo = capi_get_prov_info(ctx, cert);
1350 if (!pinfo)
1351 goto err;
1352 provname = wide_to_asc(pinfo->pwszProvName);
1353 contname = wide_to_asc(pinfo->pwszContainerName);
1354 if (!provname || !contname)
1355 return 0;
1356
2aa2a577
DSH		 1357 key = capi_get_key(ctx, contname, provname,
1358 pinfo->dwProvType, pinfo->dwKeySpec);
7a18ecb2
DSH		 1359
1360 err:
1361 if (pinfo)
1362 OPENSSL_free(pinfo);
1363 if (provname)
1364 OPENSSL_free(provname);
1365 if (contname)
1366 OPENSSL_free(contname);
1367 return key;
1368 }
1369
1370CAPI_KEY *capi_find_key(CAPI_CTX *ctx, const char *id)
1371 {
1372 PCCERT_CONTEXT cert;
1373 HCERTSTORE hstore;
1374 CAPI_KEY *key = NULL;
1375 switch (ctx->lookup_method)
1376 {
1377 case CAPI_LU_SUBSTR:
1378 case CAPI_LU_FNAME:
1379 hstore = capi_open_store(ctx, NULL);
1380 if (!hstore)
1381 return NULL;
1382 cert = capi_find_cert(ctx, id, hstore);
1383 if (cert)
1384 {
1385 key = capi_get_cert_key(ctx, cert);
1386 CertFreeCertificateContext(cert);
1387 }
1388 CertCloseStore(hstore, 0);
1389 break;
1390
1391 case CAPI_LU_CONTNAME:
2aa2a577
DSH		 1392 key = capi_get_key(ctx, id, ctx->cspname, ctx->csptype,
1393 ctx->keytype);
7a18ecb2
DSH		 1394 break;
1395 }
1396
1397 return key;
1398 }
1399
1400void capi_free_key(CAPI_KEY *key)
1401 {
1402 if (!key)
1403 return;
1404 CryptDestroyKey(key->key);
1405 CryptReleaseContext(key->hprov, 0);
7d537d4f
DSH		 1406 if (key->pcert)
1407 CertFreeCertificateContext(key->pcert);
7a18ecb2
DSH		 1408 OPENSSL_free(key);
1409 }
1410
1411
1412/* Initialize a CAPI_CTX structure */
1413
1414static CAPI_CTX *capi_ctx_new()
1415 {
1416 CAPI_CTX *ctx;
1417 ctx = OPENSSL_malloc(sizeof(CAPI_CTX));
1418 if (!ctx)
1419 {
1420 CAPIerr(CAPI_F_CAPI_CTX_NEW, ERR_R_MALLOC_FAILURE);
1421 return NULL;
1422 }
1423 ctx->cspname = NULL;
1424 ctx->csptype = PROV_RSA_FULL;
1425 ctx->dump_flags = CAPI_DMP_SUMMARY|CAPI_DMP_FNAME;
1426 ctx->keytype = AT_KEYEXCHANGE;
1427 ctx->storename = NULL;
b3c8dd4e 1428 ctx->ssl_client_store = NULL;
7a18ecb2
DSH		 1429 ctx->lookup_method = CAPI_LU_SUBSTR;
1430 ctx->debug_level = 0;
1431 ctx->debug_file = NULL;
1432 return ctx;
1433 }
1434
1435static void capi_ctx_free(CAPI_CTX *ctx)
1436 {
1437 CAPI_trace(ctx, "Calling capi_ctx_free with %lx\n", ctx);
1438 if (!ctx)
1439 return;
1440 if (ctx->cspname)
1441 OPENSSL_free(ctx->cspname);
1442 if (ctx->debug_file)
1443 OPENSSL_free(ctx->debug_file);
1444 if (ctx->storename)
1445 OPENSSL_free(ctx->storename);
b3c8dd4e
DSH		 1446 if (ctx->ssl_client_store)
1447 OPENSSL_free(ctx->ssl_client_store);
7a18ecb2
DSH		 1448 OPENSSL_free(ctx);
1449 }
1450
1451static int capi_ctx_set_provname(CAPI_CTX *ctx, LPSTR pname, DWORD type, int check)
1452 {
1453 CAPI_trace(ctx, "capi_ctx_set_provname, name=%s, type=%d\n", pname, type);
1454 if (check)
1455 {
1456 HCRYPTPROV hprov;
2aa2a577
DSH		 1457 if (!CryptAcquireContext(&hprov, NULL, pname, type,
1458 CRYPT_VERIFYCONTEXT))
7a18ecb2
DSH		 1459 {
1460 CAPIerr(CAPI_F_CAPI_CTX_SET_PROVNAME, CAPI_R_CRYPTACQUIRECONTEXT_ERROR);
1461 capi_addlasterror();
1462 return 0;
1463 }
1464 CryptReleaseContext(hprov, 0);
1465 }
1466 ctx->cspname = BUF_strdup(pname);
1467 ctx->csptype = type;
1468 return 1;
1469 }
1470
1471static int capi_ctx_set_provname_idx(CAPI_CTX *ctx, int idx)
1472 {
1473 LPSTR pname;
1474 DWORD type;
1475 if (capi_get_provname(ctx, &pname, &type, idx) != 1)
1476 return 0;
1477 return capi_ctx_set_provname(ctx, pname, type, 0);
1478 }
1479
b3c8dd4e
DSH		 1480static int cert_issuer_match(STACK_OF(X509_NAME) *ca_dn, X509 *x)
1481 {
1482 int i;
1483 X509_NAME *nm;
ca89fc1f
DSH		 1484 /* Special case: empty list: match anything */
1485 if (sk_X509_NAME_num(ca_dn) <= 0)
1486 return 1;
b3c8dd4e
DSH		 1487 for (i = 0; i < sk_X509_NAME_num(ca_dn); i++)
1488 {
1489 nm = sk_X509_NAME_value(ca_dn, i);
1490 if (!X509_NAME_cmp(nm, X509_get_issuer_name(x)))
1491 return 1;
1492 }
1493 return 0;
1494 }
1495
7d537d4f
DSH		 1496static int client_cert_select(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs)
1497 {
1498fprintf(stderr, "%d certificates\n", sk_X509_num(certs));
1499 return 0;
1500 }
1501
b3c8dd4e
DSH		 1502static int capi_load_ssl_client_cert(ENGINE *e, SSL *ssl,
1503 STACK_OF(X509_NAME) *ca_dn, X509 **pcert, EVP_PKEY **pkey,
1504 STACK_OF(X509) **pother, UI_METHOD *ui_method, void *callback_data)
1505 {
b3c8dd4e 1506 STACK_OF(X509) *certs = NULL;
b3c8dd4e 1507 X509 *x;
b3c8dd4e
DSH		 1508 char *storename;
1509 const char *p;
7d537d4f 1510 int i, client_cert_idx;
b3c8dd4e 1511 HCERTSTORE hstore;
7d537d4f 1512 PCCERT_CONTEXT cert = NULL, excert = NULL;
b3c8dd4e 1513 CAPI_CTX *ctx;
7d537d4f 1514 CAPI_KEY *key;
b3c8dd4e
DSH		 1515 ctx = ENGINE_get_ex_data(e, capi_idx);
1516
1517 *pcert = NULL;
1518 *pkey = NULL;
1519
1520 storename = ctx->ssl_client_store;
1521 if (!storename)
1522 storename = "MY";
1523
1524 hstore = capi_open_store(ctx, storename);
1525 if (!hstore)
1526 return 0;
1527 /* Enumerate all certificates looking for a match */
7d537d4f 1528 for(i = 0;;i++)
b3c8dd4e
DSH		 1529 {
1530 cert = CertEnumCertificatesInStore(hstore, cert);
1531 if (!cert)
1532 break;
1533 p = cert->pbCertEncoded;
1534 x = d2i_X509(NULL, &p, cert->cbCertEncoded);
1535 if (!x)
1536 {
1537 CAPI_trace(ctx, "Can't Parse Certificate %d\n", i);
1538 continue;
1539 }
1540 if (cert_issuer_match(ca_dn, x))
1541 {
7d537d4f 1542 key = capi_get_cert_key(ctx, cert);
b3c8dd4e
DSH		 1543 if (!key)
1544 continue;
7d537d4f
DSH		 1545 excert = CertDuplicateCertificateContext(cert);
1546 X509_set_ex_data(x, cert_capi_idx, key);
1547
1548 if (!certs)
1549 certs = sk_X509_new_null();
1550
1551 sk_X509_push(certs, x);
1552#if 0
b3c8dd4e
DSH		 1553 pk = capi_get_pkey(e, key);
1554 if (!pk)
1555 {
1556 capi_free_key(key);
1557 continue;
1558 }
1559 *pcert = x;
1560 *pkey = pk;
7d537d4f 1561#endif
b3c8dd4e
DSH		 1562 }
1563 else
1564 X509_free(x);
1565
1566 }
1567
1568 if (cert)
1569 CertFreeCertificateContext(cert);
1570
7d537d4f 1571 if (!certs)
b3c8dd4e
DSH		 1572 return 0;
1573
7d537d4f
DSH		 1574 client_cert_idx = client_cert_select(e, ssl, certs);
1575
1576 for(i = 0; i < sk_X509_num(certs); i++)
1577 {
1578 x = sk_X509_value(certs, i);
1579 if (i == client_cert_idx)
1580 *pcert = x;
1581 else
1582 {
1583 key = X509_get_ex_data(x, cert_capi_idx);
1584 capi_free_key(key);
1585 X509_free(x);
1586 }
1587 }
1588
1589 sk_X509_free(certs);
1590
1591 if (!*pcert)
1592 return 0;
1593
1594 key = X509_get_ex_data(*pcert, cert_capi_idx);
1595 *pkey = capi_get_pkey(e, key);
1596 X509_set_ex_data(*pcert, cert_capi_idx, NULL);
1597
1598 return 1;
1599
b3c8dd4e
DSH		 1600 }
1601
7a18ecb2
DSH		 1602#endif
1603#endif
A mirror of the official openssl repository