]>
Commit | Line | Data |
---|---|---|
846e33c7 | 1 | /* |
4333b89f | 2 | * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. |
d02b48c6 | 3 | * |
2c18d164 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
846e33c7 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
d02b48c6 RE |
8 | */ |
9 | ||
10 | #include <stdio.h> | |
706457b7 | 11 | #include "ssl_local.h" |
0d345f0e | 12 | #include "internal/packet.h" |
ec577822 BM |
13 | #include <openssl/bio.h> |
14 | #include <openssl/objects.h> | |
15 | #include <openssl/evp.h> | |
16 | #include <openssl/x509.h> | |
9f0f53b7 | 17 | #include <openssl/x509v3.h> |
ec577822 | 18 | #include <openssl/pem.h> |
d02b48c6 | 19 | |
d02b48c6 RE |
20 | static int ssl_set_cert(CERT *c, X509 *x509); |
21 | static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey); | |
bade29da | 22 | |
7a4e6a1e MC |
23 | #define SYNTHV1CONTEXT (SSL_EXT_TLS1_2_AND_BELOW_ONLY \ |
24 | | SSL_EXT_CLIENT_HELLO \ | |
25 | | SSL_EXT_TLS1_2_SERVER_HELLO \ | |
26 | | SSL_EXT_IGNORE_ON_RESUMPTION) | |
bade29da | 27 | |
2ff286c2 DDO |
28 | #define NAME_PREFIX1 "SERVERINFO FOR " |
29 | #define NAME_PREFIX2 "SERVERINFOV2 FOR " | |
30 | ||
6b691a5c | 31 | int SSL_use_certificate(SSL *ssl, X509 *x) |
0f113f3e MC |
32 | { |
33 | int rv; | |
34 | if (x == NULL) { | |
6849b73c | 35 | ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); |
26a7d938 | 36 | return 0; |
0f113f3e | 37 | } |
6725682d | 38 | |
0f113f3e MC |
39 | rv = ssl_security_cert(ssl, NULL, x, 0, 1); |
40 | if (rv != 1) { | |
6849b73c | 41 | ERR_raise(ERR_LIB_SSL, rv); |
0f113f3e MC |
42 | return 0; |
43 | } | |
44 | ||
26a7d938 | 45 | return ssl_set_cert(ssl->cert, x); |
0f113f3e | 46 | } |
d02b48c6 | 47 | |
303c0028 | 48 | int SSL_use_certificate_file(SSL *ssl, const char *file, int type) |
0f113f3e MC |
49 | { |
50 | int j; | |
51 | BIO *in; | |
52 | int ret = 0; | |
6725682d | 53 | X509 *cert = NULL, *x = NULL; |
0f113f3e | 54 | |
9982cbbb | 55 | in = BIO_new(BIO_s_file()); |
0f113f3e | 56 | if (in == NULL) { |
6849b73c | 57 | ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); |
0f113f3e MC |
58 | goto end; |
59 | } | |
60 | ||
61 | if (BIO_read_filename(in, file) <= 0) { | |
6849b73c | 62 | ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB); |
0f113f3e MC |
63 | goto end; |
64 | } | |
6725682d SL |
65 | |
66 | if (type != SSL_FILETYPE_ASN1 && type != SSL_FILETYPE_PEM) { | |
6849b73c | 67 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_SSL_FILETYPE); |
6725682d SL |
68 | goto end; |
69 | } | |
d8652be0 | 70 | x = X509_new_ex(ssl->ctx->libctx, ssl->ctx->propq); |
6725682d | 71 | if (x == NULL) { |
6849b73c | 72 | ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE); |
6725682d SL |
73 | goto end; |
74 | } | |
0f113f3e MC |
75 | if (type == SSL_FILETYPE_ASN1) { |
76 | j = ERR_R_ASN1_LIB; | |
6725682d | 77 | cert = d2i_X509_bio(in, &x); |
0f113f3e MC |
78 | } else if (type == SSL_FILETYPE_PEM) { |
79 | j = ERR_R_PEM_LIB; | |
6725682d SL |
80 | cert = PEM_read_bio_X509(in, &x, ssl->default_passwd_callback, |
81 | ssl->default_passwd_callback_userdata); | |
0f113f3e | 82 | } else { |
6849b73c | 83 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_SSL_FILETYPE); |
0f113f3e MC |
84 | goto end; |
85 | } | |
86 | ||
6725682d | 87 | if (cert == NULL) { |
6849b73c | 88 | ERR_raise(ERR_LIB_SSL, j); |
0f113f3e MC |
89 | goto end; |
90 | } | |
91 | ||
92 | ret = SSL_use_certificate(ssl, x); | |
93 | end: | |
222561fe | 94 | X509_free(x); |
ca3a82c3 | 95 | BIO_free(in); |
26a7d938 | 96 | return ret; |
0f113f3e | 97 | } |
d02b48c6 | 98 | |
875a644a | 99 | int SSL_use_certificate_ASN1(SSL *ssl, const unsigned char *d, int len) |
0f113f3e MC |
100 | { |
101 | X509 *x; | |
102 | int ret; | |
103 | ||
d8652be0 | 104 | x = X509_new_ex(ssl->ctx->libctx, ssl->ctx->propq); |
0f113f3e | 105 | if (x == NULL) { |
6849b73c | 106 | ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE); |
6725682d SL |
107 | return 0; |
108 | } | |
109 | ||
110 | if (d2i_X509(&x, &d, (long)len)== NULL) { | |
111 | X509_free(x); | |
6849b73c | 112 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
26a7d938 | 113 | return 0; |
0f113f3e MC |
114 | } |
115 | ||
116 | ret = SSL_use_certificate(ssl, x); | |
117 | X509_free(x); | |
26a7d938 | 118 | return ret; |
0f113f3e | 119 | } |
d02b48c6 | 120 | |
6b691a5c | 121 | static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey) |
0f113f3e | 122 | { |
52fd27f9 DSH |
123 | size_t i; |
124 | ||
125 | if (ssl_cert_lookup_by_pkey(pkey, &i) == NULL) { | |
6849b73c | 126 | ERR_raise(ERR_LIB_SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE); |
26a7d938 | 127 | return 0; |
0f113f3e MC |
128 | } |
129 | ||
fc52ae8c MC |
130 | if (c->pkeys[i].x509 != NULL |
131 | && !X509_check_private_key(c->pkeys[i].x509, pkey)) | |
132 | return 0; | |
0f113f3e | 133 | |
25aaa98a | 134 | EVP_PKEY_free(c->pkeys[i].privatekey); |
3aeb9348 | 135 | EVP_PKEY_up_ref(pkey); |
0f113f3e | 136 | c->pkeys[i].privatekey = pkey; |
52fd27f9 DSH |
137 | c->key = &c->pkeys[i]; |
138 | return 1; | |
0f113f3e | 139 | } |
d02b48c6 | 140 | |
6b691a5c | 141 | int SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey) |
0f113f3e MC |
142 | { |
143 | int ret; | |
144 | ||
145 | if (pkey == NULL) { | |
6849b73c | 146 | ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); |
26a7d938 | 147 | return 0; |
0f113f3e | 148 | } |
0f113f3e | 149 | ret = ssl_set_pkey(ssl->cert, pkey); |
26a7d938 | 150 | return ret; |
0f113f3e | 151 | } |
d02b48c6 | 152 | |
303c0028 | 153 | int SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type) |
0f113f3e MC |
154 | { |
155 | int j, ret = 0; | |
156 | BIO *in; | |
157 | EVP_PKEY *pkey = NULL; | |
158 | ||
9982cbbb | 159 | in = BIO_new(BIO_s_file()); |
0f113f3e | 160 | if (in == NULL) { |
6849b73c | 161 | ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); |
0f113f3e MC |
162 | goto end; |
163 | } | |
164 | ||
165 | if (BIO_read_filename(in, file) <= 0) { | |
6849b73c | 166 | ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB); |
0f113f3e MC |
167 | goto end; |
168 | } | |
169 | if (type == SSL_FILETYPE_PEM) { | |
170 | j = ERR_R_PEM_LIB; | |
d6a2bdf7 MC |
171 | pkey = PEM_read_bio_PrivateKey_ex(in, NULL, |
172 | ssl->default_passwd_callback, | |
173 | ssl->default_passwd_callback_userdata, | |
174 | ssl->ctx->libctx, | |
175 | ssl->ctx->propq); | |
0f113f3e MC |
176 | } else if (type == SSL_FILETYPE_ASN1) { |
177 | j = ERR_R_ASN1_LIB; | |
d6a2bdf7 MC |
178 | pkey = d2i_PrivateKey_ex_bio(in, NULL, ssl->ctx->libctx, |
179 | ssl->ctx->propq); | |
0f113f3e | 180 | } else { |
6849b73c | 181 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_SSL_FILETYPE); |
0f113f3e MC |
182 | goto end; |
183 | } | |
184 | if (pkey == NULL) { | |
6849b73c | 185 | ERR_raise(ERR_LIB_SSL, j); |
0f113f3e MC |
186 | goto end; |
187 | } | |
188 | ret = SSL_use_PrivateKey(ssl, pkey); | |
189 | EVP_PKEY_free(pkey); | |
190 | end: | |
ca3a82c3 | 191 | BIO_free(in); |
26a7d938 | 192 | return ret; |
0f113f3e | 193 | } |
d02b48c6 | 194 | |
0f113f3e MC |
195 | int SSL_use_PrivateKey_ASN1(int type, SSL *ssl, const unsigned char *d, |
196 | long len) | |
197 | { | |
198 | int ret; | |
199 | const unsigned char *p; | |
200 | EVP_PKEY *pkey; | |
d02b48c6 | 201 | |
0f113f3e | 202 | p = d; |
d6a2bdf7 MC |
203 | if ((pkey = d2i_PrivateKey_ex(type, NULL, &p, (long)len, ssl->ctx->libctx, |
204 | ssl->ctx->propq)) == NULL) { | |
6849b73c | 205 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
26a7d938 | 206 | return 0; |
0f113f3e | 207 | } |
d02b48c6 | 208 | |
0f113f3e MC |
209 | ret = SSL_use_PrivateKey(ssl, pkey); |
210 | EVP_PKEY_free(pkey); | |
26a7d938 | 211 | return ret; |
0f113f3e | 212 | } |
d02b48c6 | 213 | |
6b691a5c | 214 | int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x) |
0f113f3e MC |
215 | { |
216 | int rv; | |
217 | if (x == NULL) { | |
6849b73c | 218 | ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); |
26a7d938 | 219 | return 0; |
0f113f3e | 220 | } |
6725682d | 221 | |
0f113f3e MC |
222 | rv = ssl_security_cert(NULL, ctx, x, 0, 1); |
223 | if (rv != 1) { | |
6849b73c | 224 | ERR_raise(ERR_LIB_SSL, rv); |
0f113f3e MC |
225 | return 0; |
226 | } | |
26a7d938 | 227 | return ssl_set_cert(ctx->cert, x); |
0f113f3e | 228 | } |
d02b48c6 | 229 | |
6b691a5c | 230 | static int ssl_set_cert(CERT *c, X509 *x) |
0f113f3e MC |
231 | { |
232 | EVP_PKEY *pkey; | |
52fd27f9 | 233 | size_t i; |
0f113f3e | 234 | |
8382fd3a | 235 | pkey = X509_get0_pubkey(x); |
0f113f3e | 236 | if (pkey == NULL) { |
6849b73c | 237 | ERR_raise(ERR_LIB_SSL, SSL_R_X509_LIB); |
26a7d938 | 238 | return 0; |
0f113f3e MC |
239 | } |
240 | ||
52fd27f9 | 241 | if (ssl_cert_lookup_by_pkey(pkey, &i) == NULL) { |
6849b73c | 242 | ERR_raise(ERR_LIB_SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE); |
8382fd3a | 243 | return 0; |
0f113f3e | 244 | } |
462f4f4b | 245 | |
c2041da8 | 246 | if (i == SSL_PKEY_ECC && !EVP_PKEY_can_sign(pkey)) { |
6849b73c | 247 | ERR_raise(ERR_LIB_SSL, SSL_R_ECC_CERT_NOT_FOR_SIGNING); |
1db3107a DSH |
248 | return 0; |
249 | } | |
462f4f4b | 250 | |
0f113f3e | 251 | if (c->pkeys[i].privatekey != NULL) { |
5f3d93e4 MC |
252 | /* |
253 | * The return code from EVP_PKEY_copy_parameters is deliberately | |
254 | * ignored. Some EVP_PKEY types cannot do this. | |
255 | */ | |
0f113f3e MC |
256 | EVP_PKEY_copy_parameters(pkey, c->pkeys[i].privatekey); |
257 | ERR_clear_error(); | |
dfeab068 | 258 | |
0f113f3e MC |
259 | if (!X509_check_private_key(x, c->pkeys[i].privatekey)) { |
260 | /* | |
261 | * don't fail for a cert/key mismatch, just free current private | |
262 | * key (when switching to a different cert & key, first this | |
263 | * function should be used, then ssl_set_pkey | |
264 | */ | |
265 | EVP_PKEY_free(c->pkeys[i].privatekey); | |
266 | c->pkeys[i].privatekey = NULL; | |
267 | /* clear error queue */ | |
268 | ERR_clear_error(); | |
269 | } | |
270 | } | |
271 | ||
222561fe | 272 | X509_free(c->pkeys[i].x509); |
05f0fb9f | 273 | X509_up_ref(x); |
0f113f3e MC |
274 | c->pkeys[i].x509 = x; |
275 | c->key = &(c->pkeys[i]); | |
276 | ||
8382fd3a | 277 | return 1; |
0f113f3e | 278 | } |
d02b48c6 | 279 | |
303c0028 | 280 | int SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type) |
0f113f3e | 281 | { |
6725682d | 282 | int j = SSL_R_BAD_VALUE; |
0f113f3e MC |
283 | BIO *in; |
284 | int ret = 0; | |
6725682d | 285 | X509 *x = NULL, *cert = NULL; |
0f113f3e | 286 | |
9982cbbb | 287 | in = BIO_new(BIO_s_file()); |
0f113f3e | 288 | if (in == NULL) { |
6849b73c | 289 | ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); |
0f113f3e MC |
290 | goto end; |
291 | } | |
292 | ||
293 | if (BIO_read_filename(in, file) <= 0) { | |
6849b73c | 294 | ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB); |
0f113f3e MC |
295 | goto end; |
296 | } | |
6725682d | 297 | if (type != SSL_FILETYPE_ASN1 && type != SSL_FILETYPE_PEM) { |
6849b73c | 298 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_SSL_FILETYPE); |
6725682d SL |
299 | goto end; |
300 | } | |
d8652be0 | 301 | x = X509_new_ex(ctx->libctx, ctx->propq); |
6725682d | 302 | if (x == NULL) { |
6849b73c | 303 | ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE); |
6725682d SL |
304 | goto end; |
305 | } | |
0f113f3e MC |
306 | if (type == SSL_FILETYPE_ASN1) { |
307 | j = ERR_R_ASN1_LIB; | |
6725682d | 308 | cert = d2i_X509_bio(in, &x); |
0f113f3e MC |
309 | } else if (type == SSL_FILETYPE_PEM) { |
310 | j = ERR_R_PEM_LIB; | |
6725682d SL |
311 | cert = PEM_read_bio_X509(in, &x, ctx->default_passwd_callback, |
312 | ctx->default_passwd_callback_userdata); | |
0f113f3e | 313 | } |
6725682d | 314 | if (cert == NULL) { |
6849b73c | 315 | ERR_raise(ERR_LIB_SSL, j); |
0f113f3e MC |
316 | goto end; |
317 | } | |
318 | ||
319 | ret = SSL_CTX_use_certificate(ctx, x); | |
320 | end: | |
222561fe | 321 | X509_free(x); |
ca3a82c3 | 322 | BIO_free(in); |
26a7d938 | 323 | return ret; |
0f113f3e | 324 | } |
d02b48c6 | 325 | |
a230b26e | 326 | int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, const unsigned char *d) |
0f113f3e MC |
327 | { |
328 | X509 *x; | |
329 | int ret; | |
d02b48c6 | 330 | |
d8652be0 | 331 | x = X509_new_ex(ctx->libctx, ctx->propq); |
0f113f3e | 332 | if (x == NULL) { |
6849b73c | 333 | ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE); |
6725682d SL |
334 | return 0; |
335 | } | |
336 | ||
337 | if (d2i_X509(&x, &d, (long)len) == NULL) { | |
338 | X509_free(x); | |
6849b73c | 339 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
26a7d938 | 340 | return 0; |
0f113f3e | 341 | } |
d02b48c6 | 342 | |
0f113f3e MC |
343 | ret = SSL_CTX_use_certificate(ctx, x); |
344 | X509_free(x); | |
26a7d938 | 345 | return ret; |
0f113f3e | 346 | } |
d02b48c6 | 347 | |
6b691a5c | 348 | int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey) |
0f113f3e MC |
349 | { |
350 | if (pkey == NULL) { | |
6849b73c | 351 | ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); |
26a7d938 | 352 | return 0; |
0f113f3e | 353 | } |
26a7d938 | 354 | return ssl_set_pkey(ctx->cert, pkey); |
0f113f3e | 355 | } |
d02b48c6 | 356 | |
303c0028 | 357 | int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type) |
0f113f3e MC |
358 | { |
359 | int j, ret = 0; | |
360 | BIO *in; | |
361 | EVP_PKEY *pkey = NULL; | |
362 | ||
9982cbbb | 363 | in = BIO_new(BIO_s_file()); |
0f113f3e | 364 | if (in == NULL) { |
6849b73c | 365 | ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); |
0f113f3e MC |
366 | goto end; |
367 | } | |
368 | ||
369 | if (BIO_read_filename(in, file) <= 0) { | |
6849b73c | 370 | ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB); |
0f113f3e MC |
371 | goto end; |
372 | } | |
373 | if (type == SSL_FILETYPE_PEM) { | |
374 | j = ERR_R_PEM_LIB; | |
d6a2bdf7 | 375 | pkey = PEM_read_bio_PrivateKey_ex(in, NULL, |
0f113f3e | 376 | ctx->default_passwd_callback, |
d6a2bdf7 MC |
377 | ctx->default_passwd_callback_userdata, |
378 | ctx->libctx, ctx->propq); | |
0f113f3e MC |
379 | } else if (type == SSL_FILETYPE_ASN1) { |
380 | j = ERR_R_ASN1_LIB; | |
d6a2bdf7 | 381 | pkey = d2i_PrivateKey_ex_bio(in, NULL, ctx->libctx, ctx->propq); |
0f113f3e | 382 | } else { |
6849b73c | 383 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_SSL_FILETYPE); |
0f113f3e MC |
384 | goto end; |
385 | } | |
386 | if (pkey == NULL) { | |
6849b73c | 387 | ERR_raise(ERR_LIB_SSL, j); |
0f113f3e MC |
388 | goto end; |
389 | } | |
390 | ret = SSL_CTX_use_PrivateKey(ctx, pkey); | |
391 | EVP_PKEY_free(pkey); | |
392 | end: | |
ca3a82c3 | 393 | BIO_free(in); |
26a7d938 | 394 | return ret; |
0f113f3e | 395 | } |
d02b48c6 | 396 | |
0f113f3e MC |
397 | int SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx, |
398 | const unsigned char *d, long len) | |
399 | { | |
400 | int ret; | |
401 | const unsigned char *p; | |
402 | EVP_PKEY *pkey; | |
d02b48c6 | 403 | |
0f113f3e | 404 | p = d; |
d6a2bdf7 MC |
405 | if ((pkey = d2i_PrivateKey_ex(type, NULL, &p, (long)len, ctx->libctx, |
406 | ctx->propq)) == NULL) { | |
6849b73c | 407 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
26a7d938 | 408 | return 0; |
0f113f3e | 409 | } |
d02b48c6 | 410 | |
0f113f3e MC |
411 | ret = SSL_CTX_use_PrivateKey(ctx, pkey); |
412 | EVP_PKEY_free(pkey); | |
26a7d938 | 413 | return ret; |
0f113f3e | 414 | } |
d02b48c6 | 415 | |
0f113f3e MC |
416 | /* |
417 | * Read a file that contains our certificate in "PEM" format, possibly | |
418 | * followed by a sequence of CA certificates that should be sent to the peer | |
419 | * in the Certificate message. | |
b3ca645f | 420 | */ |
fae4772c | 421 | static int use_certificate_chain_file(SSL_CTX *ctx, SSL *ssl, const char *file) |
0f113f3e MC |
422 | { |
423 | BIO *in; | |
424 | int ret = 0; | |
425 | X509 *x = NULL; | |
a974e64a MC |
426 | pem_password_cb *passwd_callback; |
427 | void *passwd_callback_userdata; | |
6725682d | 428 | SSL_CTX *real_ctx = (ssl == NULL) ? ctx : ssl->ctx; |
0f113f3e | 429 | |
88ce406c P |
430 | if (ctx == NULL && ssl == NULL) |
431 | return 0; | |
432 | ||
0f113f3e MC |
433 | ERR_clear_error(); /* clear error stack for |
434 | * SSL_CTX_use_certificate() */ | |
435 | ||
a974e64a MC |
436 | if (ctx != NULL) { |
437 | passwd_callback = ctx->default_passwd_callback; | |
438 | passwd_callback_userdata = ctx->default_passwd_callback_userdata; | |
439 | } else { | |
440 | passwd_callback = ssl->default_passwd_callback; | |
441 | passwd_callback_userdata = ssl->default_passwd_callback_userdata; | |
442 | } | |
443 | ||
9982cbbb | 444 | in = BIO_new(BIO_s_file()); |
0f113f3e | 445 | if (in == NULL) { |
6849b73c | 446 | ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); |
0f113f3e MC |
447 | goto end; |
448 | } | |
449 | ||
450 | if (BIO_read_filename(in, file) <= 0) { | |
6849b73c | 451 | ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB); |
0f113f3e MC |
452 | goto end; |
453 | } | |
454 | ||
d8652be0 | 455 | x = X509_new_ex(real_ctx->libctx, real_ctx->propq); |
0f113f3e | 456 | if (x == NULL) { |
6849b73c | 457 | ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE); |
6725682d SL |
458 | goto end; |
459 | } | |
460 | if (PEM_read_bio_X509_AUX(in, &x, passwd_callback, | |
461 | passwd_callback_userdata) == NULL) { | |
6849b73c | 462 | ERR_raise(ERR_LIB_SSL, ERR_R_PEM_LIB); |
0f113f3e MC |
463 | goto end; |
464 | } | |
465 | ||
fae4772c DSH |
466 | if (ctx) |
467 | ret = SSL_CTX_use_certificate(ctx, x); | |
468 | else | |
469 | ret = SSL_use_certificate(ssl, x); | |
0f113f3e MC |
470 | |
471 | if (ERR_peek_error() != 0) | |
472 | ret = 0; /* Key/certificate mismatch doesn't imply | |
473 | * ret==0 ... */ | |
474 | if (ret) { | |
475 | /* | |
476 | * If we could set up our certificate, now proceed to the CA | |
477 | * certificates. | |
478 | */ | |
479 | X509 *ca; | |
480 | int r; | |
481 | unsigned long err; | |
482 | ||
fae4772c DSH |
483 | if (ctx) |
484 | r = SSL_CTX_clear_chain_certs(ctx); | |
485 | else | |
486 | r = SSL_clear_chain_certs(ssl); | |
487 | ||
488 | if (r == 0) { | |
69f68237 MC |
489 | ret = 0; |
490 | goto end; | |
491 | } | |
0f113f3e | 492 | |
6725682d | 493 | while (1) { |
d8652be0 | 494 | ca = X509_new_ex(real_ctx->libctx, real_ctx->propq); |
6725682d | 495 | if (ca == NULL) { |
6849b73c | 496 | ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
497 | goto end; |
498 | } | |
6725682d SL |
499 | if (PEM_read_bio_X509(in, &ca, passwd_callback, |
500 | passwd_callback_userdata) != NULL) { | |
501 | if (ctx) | |
502 | r = SSL_CTX_add0_chain_cert(ctx, ca); | |
503 | else | |
504 | r = SSL_add0_chain_cert(ssl, ca); | |
505 | /* | |
506 | * Note that we must not free ca if it was successfully added to | |
507 | * the chain (while we must free the main certificate, since its | |
508 | * reference count is increased by SSL_CTX_use_certificate). | |
509 | */ | |
510 | if (!r) { | |
511 | X509_free(ca); | |
512 | ret = 0; | |
513 | goto end; | |
514 | } | |
515 | } else { | |
516 | X509_free(ca); | |
517 | break; | |
518 | } | |
0f113f3e MC |
519 | } |
520 | /* When the while loop ends, it's usually just EOF. */ | |
521 | err = ERR_peek_last_error(); | |
522 | if (ERR_GET_LIB(err) == ERR_LIB_PEM | |
523 | && ERR_GET_REASON(err) == PEM_R_NO_START_LINE) | |
524 | ERR_clear_error(); | |
525 | else | |
526 | ret = 0; /* some real error */ | |
527 | } | |
528 | ||
529 | end: | |
25aaa98a | 530 | X509_free(x); |
ca3a82c3 | 531 | BIO_free(in); |
26a7d938 | 532 | return ret; |
0f113f3e | 533 | } |
fae4772c DSH |
534 | |
535 | int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file) | |
536 | { | |
537 | return use_certificate_chain_file(ctx, NULL, file); | |
538 | } | |
539 | ||
540 | int SSL_use_certificate_chain_file(SSL *ssl, const char *file) | |
541 | { | |
542 | return use_certificate_chain_file(NULL, ssl, file); | |
543 | } | |
a9e1c50b | 544 | |
a398f821 | 545 | static int serverinfo_find_extension(const unsigned char *serverinfo, |
0f113f3e MC |
546 | size_t serverinfo_length, |
547 | unsigned int extension_type, | |
548 | const unsigned char **extension_data, | |
549 | size_t *extension_length) | |
550 | { | |
84c34ba8 MC |
551 | PACKET pkt, data; |
552 | ||
0f113f3e MC |
553 | *extension_data = NULL; |
554 | *extension_length = 0; | |
555 | if (serverinfo == NULL || serverinfo_length == 0) | |
fae11ec7 | 556 | return -1; |
84c34ba8 MC |
557 | |
558 | if (!PACKET_buf_init(&pkt, serverinfo, serverinfo_length)) | |
559 | return -1; | |
560 | ||
0f113f3e MC |
561 | for (;;) { |
562 | unsigned int type = 0; | |
84c34ba8 | 563 | unsigned long context = 0; |
0f113f3e MC |
564 | |
565 | /* end of serverinfo */ | |
84c34ba8 | 566 | if (PACKET_remaining(&pkt) == 0) |
fae11ec7 | 567 | return 0; /* Extension not found */ |
0f113f3e | 568 | |
84c34ba8 MC |
569 | if (!PACKET_get_net_4(&pkt, &context) |
570 | || !PACKET_get_net_2(&pkt, &type) | |
571 | || !PACKET_get_length_prefixed_2(&pkt, &data)) | |
572 | return -1; | |
0f113f3e MC |
573 | |
574 | if (type == extension_type) { | |
84c34ba8 MC |
575 | *extension_data = PACKET_data(&data); |
576 | *extension_length = PACKET_remaining(&data);; | |
0f113f3e MC |
577 | return 1; /* Success */ |
578 | } | |
0f113f3e | 579 | } |
c6ef15c4 | 580 | /* Unreachable */ |
0f113f3e | 581 | } |
a398f821 | 582 | |
84c34ba8 MC |
583 | static int serverinfoex_srv_parse_cb(SSL *s, unsigned int ext_type, |
584 | unsigned int context, | |
585 | const unsigned char *in, | |
586 | size_t inlen, X509 *x, size_t chainidx, | |
587 | int *al, void *arg) | |
0f113f3e | 588 | { |
0a602875 | 589 | |
0f113f3e MC |
590 | if (inlen != 0) { |
591 | *al = SSL_AD_DECODE_ERROR; | |
592 | return 0; | |
593 | } | |
0a602875 | 594 | |
0f113f3e MC |
595 | return 1; |
596 | } | |
9cd50f73 | 597 | |
84c34ba8 MC |
598 | static int serverinfo_srv_parse_cb(SSL *s, unsigned int ext_type, |
599 | const unsigned char *in, | |
600 | size_t inlen, int *al, void *arg) | |
601 | { | |
602 | return serverinfoex_srv_parse_cb(s, ext_type, 0, in, inlen, NULL, 0, al, | |
603 | arg); | |
604 | } | |
605 | ||
606 | static int serverinfoex_srv_add_cb(SSL *s, unsigned int ext_type, | |
607 | unsigned int context, | |
608 | const unsigned char **out, | |
609 | size_t *outlen, X509 *x, size_t chainidx, | |
610 | int *al, void *arg) | |
0f113f3e MC |
611 | { |
612 | const unsigned char *serverinfo = NULL; | |
613 | size_t serverinfo_length = 0; | |
614 | ||
f233a9d1 MC |
615 | /* We only support extensions for the first Certificate */ |
616 | if ((context & SSL_EXT_TLS1_3_CERTIFICATE) != 0 && chainidx > 0) | |
617 | return 0; | |
618 | ||
0f113f3e MC |
619 | /* Is there serverinfo data for the chosen server cert? */ |
620 | if ((ssl_get_server_cert_serverinfo(s, &serverinfo, | |
621 | &serverinfo_length)) != 0) { | |
622 | /* Find the relevant extension from the serverinfo */ | |
623 | int retval = serverinfo_find_extension(serverinfo, serverinfo_length, | |
624 | ext_type, out, outlen); | |
fae11ec7 | 625 | if (retval == -1) { |
fb34a0f4 | 626 | *al = SSL_AD_INTERNAL_ERROR; |
fae11ec7 KR |
627 | return -1; /* Error */ |
628 | } | |
0f113f3e | 629 | if (retval == 0) |
fae11ec7 | 630 | return 0; /* No extension found, don't send extension */ |
0f113f3e MC |
631 | return 1; /* Send extension */ |
632 | } | |
5f18bc58 | 633 | return 0; /* No serverinfo data found, don't send |
0f113f3e MC |
634 | * extension */ |
635 | } | |
636 | ||
84c34ba8 MC |
637 | static int serverinfo_srv_add_cb(SSL *s, unsigned int ext_type, |
638 | const unsigned char **out, size_t *outlen, | |
639 | int *al, void *arg) | |
640 | { | |
641 | return serverinfoex_srv_add_cb(s, ext_type, 0, out, outlen, NULL, 0, al, | |
642 | arg); | |
643 | } | |
644 | ||
0f113f3e MC |
645 | /* |
646 | * With a NULL context, this function just checks that the serverinfo data | |
647 | * parses correctly. With a non-NULL context, it registers callbacks for | |
648 | * the included extensions. | |
649 | */ | |
84c34ba8 MC |
650 | static int serverinfo_process_buffer(unsigned int version, |
651 | const unsigned char *serverinfo, | |
0f113f3e MC |
652 | size_t serverinfo_length, SSL_CTX *ctx) |
653 | { | |
84c34ba8 MC |
654 | PACKET pkt; |
655 | ||
0f113f3e MC |
656 | if (serverinfo == NULL || serverinfo_length == 0) |
657 | return 0; | |
0f113f3e | 658 | |
2698bbfe | 659 | if (version != SSL_SERVERINFOV1 && version != SSL_SERVERINFOV2) |
84c34ba8 | 660 | return 0; |
0f113f3e | 661 | |
84c34ba8 MC |
662 | if (!PACKET_buf_init(&pkt, serverinfo, serverinfo_length)) |
663 | return 0; | |
0f113f3e | 664 | |
84c34ba8 MC |
665 | while (PACKET_remaining(&pkt)) { |
666 | unsigned long context = 0; | |
667 | unsigned int ext_type = 0; | |
668 | PACKET data; | |
0f113f3e | 669 | |
bade29da | 670 | if ((version == SSL_SERVERINFOV2 && !PACKET_get_net_4(&pkt, &context)) |
84c34ba8 MC |
671 | || !PACKET_get_net_2(&pkt, &ext_type) |
672 | || !PACKET_get_length_prefixed_2(&pkt, &data)) | |
0f113f3e MC |
673 | return 0; |
674 | ||
84c34ba8 MC |
675 | if (ctx == NULL) |
676 | continue; | |
677 | ||
bade29da MC |
678 | /* |
679 | * The old style custom extensions API could be set separately for | |
680 | * server/client, i.e. you could set one custom extension for a client, | |
681 | * and *for the same extension in the same SSL_CTX* you could set a | |
682 | * custom extension for the server as well. It seems quite weird to be | |
683 | * setting a custom extension for both client and server in a single | |
684 | * SSL_CTX - but theoretically possible. This isn't possible in the | |
685 | * new API. Therefore, if we have V1 serverinfo we use the old API. We | |
686 | * also use the old API even if we have V2 serverinfo but the context | |
687 | * looks like an old style <= TLSv1.2 extension. | |
688 | */ | |
7a4e6a1e | 689 | if (version == SSL_SERVERINFOV1 || context == SYNTHV1CONTEXT) { |
84c34ba8 MC |
690 | if (!SSL_CTX_add_server_custom_ext(ctx, ext_type, |
691 | serverinfo_srv_add_cb, | |
692 | NULL, NULL, | |
693 | serverinfo_srv_parse_cb, | |
694 | NULL)) | |
695 | return 0; | |
696 | } else { | |
697 | if (!SSL_CTX_add_custom_ext(ctx, ext_type, context, | |
698 | serverinfoex_srv_add_cb, | |
699 | NULL, NULL, | |
700 | serverinfoex_srv_parse_cb, | |
701 | NULL)) | |
702 | return 0; | |
703 | } | |
0f113f3e | 704 | } |
84c34ba8 MC |
705 | |
706 | return 1; | |
0f113f3e | 707 | } |
a398f821 | 708 | |
84c34ba8 MC |
709 | int SSL_CTX_use_serverinfo_ex(SSL_CTX *ctx, unsigned int version, |
710 | const unsigned char *serverinfo, | |
711 | size_t serverinfo_length) | |
0f113f3e MC |
712 | { |
713 | unsigned char *new_serverinfo; | |
714 | ||
715 | if (ctx == NULL || serverinfo == NULL || serverinfo_length == 0) { | |
6849b73c | 716 | ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); |
0f113f3e MC |
717 | return 0; |
718 | } | |
84c34ba8 MC |
719 | if (!serverinfo_process_buffer(version, serverinfo, serverinfo_length, |
720 | NULL)) { | |
6849b73c | 721 | ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_SERVERINFO_DATA); |
0f113f3e MC |
722 | return 0; |
723 | } | |
0f113f3e | 724 | if (ctx->cert->key == NULL) { |
6849b73c | 725 | ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR); |
0f113f3e MC |
726 | return 0; |
727 | } | |
728 | new_serverinfo = OPENSSL_realloc(ctx->cert->key->serverinfo, | |
729 | serverinfo_length); | |
730 | if (new_serverinfo == NULL) { | |
6849b73c | 731 | ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
732 | return 0; |
733 | } | |
734 | ctx->cert->key->serverinfo = new_serverinfo; | |
735 | memcpy(ctx->cert->key->serverinfo, serverinfo, serverinfo_length); | |
736 | ctx->cert->key->serverinfo_length = serverinfo_length; | |
737 | ||
738 | /* | |
739 | * Now that the serverinfo is validated and stored, go ahead and | |
740 | * register callbacks. | |
741 | */ | |
84c34ba8 MC |
742 | if (!serverinfo_process_buffer(version, serverinfo, serverinfo_length, |
743 | ctx)) { | |
6849b73c | 744 | ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_SERVERINFO_DATA); |
0f113f3e MC |
745 | return 0; |
746 | } | |
747 | return 1; | |
748 | } | |
749 | ||
84c34ba8 MC |
750 | int SSL_CTX_use_serverinfo(SSL_CTX *ctx, const unsigned char *serverinfo, |
751 | size_t serverinfo_length) | |
752 | { | |
2698bbfe | 753 | return SSL_CTX_use_serverinfo_ex(ctx, SSL_SERVERINFOV1, serverinfo, |
84c34ba8 MC |
754 | serverinfo_length); |
755 | } | |
756 | ||
a398f821 | 757 | int SSL_CTX_use_serverinfo_file(SSL_CTX *ctx, const char *file) |
0f113f3e MC |
758 | { |
759 | unsigned char *serverinfo = NULL; | |
7c0ef843 | 760 | unsigned char *tmp; |
0f113f3e MC |
761 | size_t serverinfo_length = 0; |
762 | unsigned char *extension = 0; | |
763 | long extension_length = 0; | |
764 | char *name = NULL; | |
765 | char *header = NULL; | |
4bac25e1 | 766 | unsigned int name_len; |
0f113f3e MC |
767 | int ret = 0; |
768 | BIO *bin = NULL; | |
84c34ba8 | 769 | size_t num_extensions = 0, contextoff = 0; |
0f113f3e MC |
770 | |
771 | if (ctx == NULL || file == NULL) { | |
6849b73c | 772 | ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); |
0f113f3e MC |
773 | goto end; |
774 | } | |
775 | ||
9982cbbb | 776 | bin = BIO_new(BIO_s_file()); |
0f113f3e | 777 | if (bin == NULL) { |
6849b73c | 778 | ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); |
0f113f3e MC |
779 | goto end; |
780 | } | |
781 | if (BIO_read_filename(bin, file) <= 0) { | |
6849b73c | 782 | ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB); |
0f113f3e MC |
783 | goto end; |
784 | } | |
785 | ||
786 | for (num_extensions = 0;; num_extensions++) { | |
7a4e6a1e MC |
787 | unsigned int version; |
788 | ||
0f113f3e MC |
789 | if (PEM_read_bio(bin, &name, &header, &extension, &extension_length) |
790 | == 0) { | |
791 | /* | |
792 | * There must be at least one extension in this file | |
793 | */ | |
794 | if (num_extensions == 0) { | |
6849b73c | 795 | ERR_raise(ERR_LIB_SSL, SSL_R_NO_PEM_EXTENSIONS); |
0f113f3e MC |
796 | goto end; |
797 | } else /* End of file, we're done */ | |
798 | break; | |
799 | } | |
800 | /* Check that PEM name starts with "BEGIN SERVERINFO FOR " */ | |
4bac25e1 | 801 | name_len = strlen(name); |
2ff286c2 | 802 | if (name_len < sizeof(NAME_PREFIX1) - 1) { |
6849b73c | 803 | ERR_raise(ERR_LIB_SSL, SSL_R_PEM_NAME_TOO_SHORT); |
0f113f3e MC |
804 | goto end; |
805 | } | |
2ff286c2 | 806 | if (HAS_PREFIX(name, NAME_PREFIX1)) { |
2698bbfe | 807 | version = SSL_SERVERINFOV1; |
84c34ba8 | 808 | } else { |
2ff286c2 | 809 | if (name_len < sizeof(NAME_PREFIX2) - 1) { |
6849b73c | 810 | ERR_raise(ERR_LIB_SSL, SSL_R_PEM_NAME_TOO_SHORT); |
84c34ba8 MC |
811 | goto end; |
812 | } | |
2ff286c2 | 813 | if (!HAS_PREFIX(name, NAME_PREFIX2)) { |
6849b73c | 814 | ERR_raise(ERR_LIB_SSL, SSL_R_PEM_NAME_BAD_PREFIX); |
84c34ba8 MC |
815 | goto end; |
816 | } | |
2698bbfe | 817 | version = SSL_SERVERINFOV2; |
0f113f3e MC |
818 | } |
819 | /* | |
820 | * Check that the decoded PEM data is plausible (valid length field) | |
821 | */ | |
2698bbfe | 822 | if (version == SSL_SERVERINFOV1) { |
84c34ba8 MC |
823 | /* 4 byte header: 2 bytes type, 2 bytes len */ |
824 | if (extension_length < 4 | |
825 | || (extension[2] << 8) + extension[3] | |
826 | != extension_length - 4) { | |
6849b73c | 827 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_DATA); |
84c34ba8 MC |
828 | goto end; |
829 | } | |
830 | /* | |
831 | * File does not have a context value so we must take account of | |
832 | * this later. | |
833 | */ | |
834 | contextoff = 4; | |
835 | } else { | |
836 | /* 8 byte header: 4 bytes context, 2 bytes type, 2 bytes len */ | |
837 | if (extension_length < 8 | |
838 | || (extension[6] << 8) + extension[7] | |
839 | != extension_length - 8) { | |
6849b73c | 840 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_DATA); |
84c34ba8 MC |
841 | goto end; |
842 | } | |
0f113f3e MC |
843 | } |
844 | /* Append the decoded extension to the serverinfo buffer */ | |
84c34ba8 MC |
845 | tmp = OPENSSL_realloc(serverinfo, serverinfo_length + extension_length |
846 | + contextoff); | |
7c0ef843 | 847 | if (tmp == NULL) { |
6849b73c | 848 | ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
849 | goto end; |
850 | } | |
7c0ef843 | 851 | serverinfo = tmp; |
84c34ba8 | 852 | if (contextoff > 0) { |
84c34ba8 MC |
853 | unsigned char *sinfo = serverinfo + serverinfo_length; |
854 | ||
855 | /* We know this only uses the last 2 bytes */ | |
856 | sinfo[0] = 0; | |
857 | sinfo[1] = 0; | |
7a4e6a1e MC |
858 | sinfo[2] = (SYNTHV1CONTEXT >> 8) & 0xff; |
859 | sinfo[3] = SYNTHV1CONTEXT & 0xff; | |
84c34ba8 MC |
860 | } |
861 | memcpy(serverinfo + serverinfo_length + contextoff, | |
862 | extension, extension_length); | |
863 | serverinfo_length += extension_length + contextoff; | |
0f113f3e MC |
864 | |
865 | OPENSSL_free(name); | |
866 | name = NULL; | |
867 | OPENSSL_free(header); | |
868 | header = NULL; | |
869 | OPENSSL_free(extension); | |
870 | extension = NULL; | |
871 | } | |
872 | ||
bade29da | 873 | ret = SSL_CTX_use_serverinfo_ex(ctx, SSL_SERVERINFOV2, serverinfo, |
bb78552e | 874 | serverinfo_length); |
0f113f3e MC |
875 | end: |
876 | /* SSL_CTX_use_serverinfo makes a local copy of the serverinfo. */ | |
877 | OPENSSL_free(name); | |
878 | OPENSSL_free(header); | |
879 | OPENSSL_free(extension); | |
880 | OPENSSL_free(serverinfo); | |
ca3a82c3 | 881 | BIO_free(bin); |
0f113f3e MC |
882 | return ret; |
883 | } | |
37933acb TS |
884 | |
885 | static int ssl_set_cert_and_key(SSL *ssl, SSL_CTX *ctx, X509 *x509, EVP_PKEY *privatekey, | |
886 | STACK_OF(X509) *chain, int override) | |
887 | { | |
888 | int ret = 0; | |
889 | size_t i; | |
890 | int j; | |
891 | int rv; | |
892 | CERT *c = ssl != NULL ? ssl->cert : ctx->cert; | |
893 | STACK_OF(X509) *dup_chain = NULL; | |
894 | EVP_PKEY *pubkey = NULL; | |
895 | ||
896 | /* Do all security checks before anything else */ | |
897 | rv = ssl_security_cert(ssl, ctx, x509, 0, 1); | |
898 | if (rv != 1) { | |
6849b73c | 899 | ERR_raise(ERR_LIB_SSL, rv); |
37933acb TS |
900 | goto out; |
901 | } | |
902 | for (j = 0; j < sk_X509_num(chain); j++) { | |
903 | rv = ssl_security_cert(ssl, ctx, sk_X509_value(chain, j), 0, 0); | |
904 | if (rv != 1) { | |
6849b73c | 905 | ERR_raise(ERR_LIB_SSL, rv); |
37933acb TS |
906 | goto out; |
907 | } | |
908 | } | |
909 | ||
910 | pubkey = X509_get_pubkey(x509); /* bumps reference */ | |
911 | if (pubkey == NULL) | |
912 | goto out; | |
913 | if (privatekey == NULL) { | |
914 | privatekey = pubkey; | |
915 | } else { | |
916 | /* For RSA, which has no parameters, missing returns 0 */ | |
917 | if (EVP_PKEY_missing_parameters(privatekey)) { | |
918 | if (EVP_PKEY_missing_parameters(pubkey)) { | |
919 | /* nobody has parameters? - error */ | |
6849b73c | 920 | ERR_raise(ERR_LIB_SSL, SSL_R_MISSING_PARAMETERS); |
37933acb TS |
921 | goto out; |
922 | } else { | |
923 | /* copy to privatekey from pubkey */ | |
924 | EVP_PKEY_copy_parameters(privatekey, pubkey); | |
925 | } | |
926 | } else if (EVP_PKEY_missing_parameters(pubkey)) { | |
927 | /* copy to pubkey from privatekey */ | |
928 | EVP_PKEY_copy_parameters(pubkey, privatekey); | |
929 | } /* else both have parameters */ | |
930 | ||
37933acb | 931 | /* check that key <-> cert match */ |
c74aaa39 | 932 | if (EVP_PKEY_eq(pubkey, privatekey) != 1) { |
6849b73c | 933 | ERR_raise(ERR_LIB_SSL, SSL_R_PRIVATE_KEY_MISMATCH); |
37933acb TS |
934 | goto out; |
935 | } | |
936 | } | |
937 | if (ssl_cert_lookup_by_pkey(pubkey, &i) == NULL) { | |
6849b73c | 938 | ERR_raise(ERR_LIB_SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE); |
37933acb TS |
939 | goto out; |
940 | } | |
941 | ||
942 | if (!override && (c->pkeys[i].x509 != NULL | |
943 | || c->pkeys[i].privatekey != NULL | |
944 | || c->pkeys[i].chain != NULL)) { | |
945 | /* No override, and something already there */ | |
6849b73c | 946 | ERR_raise(ERR_LIB_SSL, SSL_R_NOT_REPLACING_CERTIFICATE); |
37933acb TS |
947 | goto out; |
948 | } | |
949 | ||
950 | if (chain != NULL) { | |
951 | dup_chain = X509_chain_up_ref(chain); | |
952 | if (dup_chain == NULL) { | |
6849b73c | 953 | ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE); |
37933acb TS |
954 | goto out; |
955 | } | |
956 | } | |
957 | ||
958 | sk_X509_pop_free(c->pkeys[i].chain, X509_free); | |
959 | c->pkeys[i].chain = dup_chain; | |
960 | ||
961 | X509_free(c->pkeys[i].x509); | |
962 | X509_up_ref(x509); | |
963 | c->pkeys[i].x509 = x509; | |
964 | ||
965 | EVP_PKEY_free(c->pkeys[i].privatekey); | |
966 | EVP_PKEY_up_ref(privatekey); | |
967 | c->pkeys[i].privatekey = privatekey; | |
968 | ||
969 | c->key = &(c->pkeys[i]); | |
970 | ||
971 | ret = 1; | |
972 | out: | |
973 | EVP_PKEY_free(pubkey); | |
974 | return ret; | |
975 | } | |
976 | ||
977 | int SSL_use_cert_and_key(SSL *ssl, X509 *x509, EVP_PKEY *privatekey, | |
978 | STACK_OF(X509) *chain, int override) | |
979 | { | |
980 | return ssl_set_cert_and_key(ssl, NULL, x509, privatekey, chain, override); | |
981 | } | |
982 | ||
983 | int SSL_CTX_use_cert_and_key(SSL_CTX *ctx, X509 *x509, EVP_PKEY *privatekey, | |
984 | STACK_OF(X509) *chain, int override) | |
985 | { | |
986 | return ssl_set_cert_and_key(NULL, ctx, x509, privatekey, chain, override); | |
987 | } |