]>
Commit | Line | Data |
---|---|---|
846e33c7 | 1 | /* |
33388b44 | 2 | * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved. |
d02b48c6 | 3 | * |
2c18d164 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
846e33c7 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
d02b48c6 RE |
8 | */ |
9 | ||
10 | #include <stdio.h> | |
706457b7 | 11 | #include "ssl_local.h" |
0d345f0e | 12 | #include "internal/packet.h" |
ec577822 BM |
13 | #include <openssl/bio.h> |
14 | #include <openssl/objects.h> | |
15 | #include <openssl/evp.h> | |
16 | #include <openssl/x509.h> | |
9f0f53b7 | 17 | #include <openssl/x509v3.h> |
ec577822 | 18 | #include <openssl/pem.h> |
d02b48c6 | 19 | |
852c2ed2 RS |
20 | DEFINE_STACK_OF(X509) |
21 | ||
d02b48c6 RE |
22 | static int ssl_set_cert(CERT *c, X509 *x509); |
23 | static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey); | |
bade29da | 24 | |
7a4e6a1e MC |
25 | #define SYNTHV1CONTEXT (SSL_EXT_TLS1_2_AND_BELOW_ONLY \ |
26 | | SSL_EXT_CLIENT_HELLO \ | |
27 | | SSL_EXT_TLS1_2_SERVER_HELLO \ | |
28 | | SSL_EXT_IGNORE_ON_RESUMPTION) | |
bade29da | 29 | |
6b691a5c | 30 | int SSL_use_certificate(SSL *ssl, X509 *x) |
0f113f3e MC |
31 | { |
32 | int rv; | |
33 | if (x == NULL) { | |
34 | SSLerr(SSL_F_SSL_USE_CERTIFICATE, ERR_R_PASSED_NULL_PARAMETER); | |
26a7d938 | 35 | return 0; |
0f113f3e | 36 | } |
6725682d | 37 | |
0f113f3e MC |
38 | rv = ssl_security_cert(ssl, NULL, x, 0, 1); |
39 | if (rv != 1) { | |
40 | SSLerr(SSL_F_SSL_USE_CERTIFICATE, rv); | |
41 | return 0; | |
42 | } | |
43 | ||
26a7d938 | 44 | return ssl_set_cert(ssl->cert, x); |
0f113f3e | 45 | } |
d02b48c6 | 46 | |
303c0028 | 47 | int SSL_use_certificate_file(SSL *ssl, const char *file, int type) |
0f113f3e MC |
48 | { |
49 | int j; | |
50 | BIO *in; | |
51 | int ret = 0; | |
6725682d | 52 | X509 *cert = NULL, *x = NULL; |
0f113f3e | 53 | |
9982cbbb | 54 | in = BIO_new(BIO_s_file()); |
0f113f3e MC |
55 | if (in == NULL) { |
56 | SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, ERR_R_BUF_LIB); | |
57 | goto end; | |
58 | } | |
59 | ||
60 | if (BIO_read_filename(in, file) <= 0) { | |
61 | SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, ERR_R_SYS_LIB); | |
62 | goto end; | |
63 | } | |
6725682d SL |
64 | |
65 | if (type != SSL_FILETYPE_ASN1 && type != SSL_FILETYPE_PEM) { | |
66 | SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, SSL_R_BAD_SSL_FILETYPE); | |
67 | goto end; | |
68 | } | |
69 | x = X509_new_with_libctx(ssl->ctx->libctx, ssl->ctx->propq); | |
70 | if (x == NULL) { | |
71 | SSLerr(0, ERR_R_MALLOC_FAILURE); | |
72 | goto end; | |
73 | } | |
0f113f3e MC |
74 | if (type == SSL_FILETYPE_ASN1) { |
75 | j = ERR_R_ASN1_LIB; | |
6725682d | 76 | cert = d2i_X509_bio(in, &x); |
0f113f3e MC |
77 | } else if (type == SSL_FILETYPE_PEM) { |
78 | j = ERR_R_PEM_LIB; | |
6725682d SL |
79 | cert = PEM_read_bio_X509(in, &x, ssl->default_passwd_callback, |
80 | ssl->default_passwd_callback_userdata); | |
0f113f3e MC |
81 | } else { |
82 | SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, SSL_R_BAD_SSL_FILETYPE); | |
83 | goto end; | |
84 | } | |
85 | ||
6725682d | 86 | if (cert == NULL) { |
0f113f3e MC |
87 | SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, j); |
88 | goto end; | |
89 | } | |
90 | ||
91 | ret = SSL_use_certificate(ssl, x); | |
92 | end: | |
222561fe | 93 | X509_free(x); |
ca3a82c3 | 94 | BIO_free(in); |
26a7d938 | 95 | return ret; |
0f113f3e | 96 | } |
d02b48c6 | 97 | |
875a644a | 98 | int SSL_use_certificate_ASN1(SSL *ssl, const unsigned char *d, int len) |
0f113f3e MC |
99 | { |
100 | X509 *x; | |
101 | int ret; | |
102 | ||
6725682d | 103 | x = X509_new_with_libctx(ssl->ctx->libctx, ssl->ctx->propq); |
0f113f3e | 104 | if (x == NULL) { |
6725682d SL |
105 | SSLerr(0, ERR_R_MALLOC_FAILURE); |
106 | return 0; | |
107 | } | |
108 | ||
109 | if (d2i_X509(&x, &d, (long)len)== NULL) { | |
110 | X509_free(x); | |
0f113f3e | 111 | SSLerr(SSL_F_SSL_USE_CERTIFICATE_ASN1, ERR_R_ASN1_LIB); |
26a7d938 | 112 | return 0; |
0f113f3e MC |
113 | } |
114 | ||
115 | ret = SSL_use_certificate(ssl, x); | |
116 | X509_free(x); | |
26a7d938 | 117 | return ret; |
0f113f3e | 118 | } |
d02b48c6 | 119 | |
bc36ee62 | 120 | #ifndef OPENSSL_NO_RSA |
6b691a5c | 121 | int SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa) |
0f113f3e MC |
122 | { |
123 | EVP_PKEY *pkey; | |
124 | int ret; | |
125 | ||
126 | if (rsa == NULL) { | |
127 | SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY, ERR_R_PASSED_NULL_PARAMETER); | |
26a7d938 | 128 | return 0; |
0f113f3e | 129 | } |
0f113f3e MC |
130 | if ((pkey = EVP_PKEY_new()) == NULL) { |
131 | SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY, ERR_R_EVP_LIB); | |
26a7d938 | 132 | return 0; |
0f113f3e MC |
133 | } |
134 | ||
135 | RSA_up_ref(rsa); | |
5f3d93e4 MC |
136 | if (EVP_PKEY_assign_RSA(pkey, rsa) <= 0) { |
137 | RSA_free(rsa); | |
563c1ec6 | 138 | EVP_PKEY_free(pkey); |
5f3d93e4 MC |
139 | return 0; |
140 | } | |
0f113f3e MC |
141 | |
142 | ret = ssl_set_pkey(ssl->cert, pkey); | |
143 | EVP_PKEY_free(pkey); | |
26a7d938 | 144 | return ret; |
0f113f3e | 145 | } |
d02b48c6 RE |
146 | #endif |
147 | ||
6b691a5c | 148 | static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey) |
0f113f3e | 149 | { |
52fd27f9 DSH |
150 | size_t i; |
151 | ||
152 | if (ssl_cert_lookup_by_pkey(pkey, &i) == NULL) { | |
0f113f3e | 153 | SSLerr(SSL_F_SSL_SET_PKEY, SSL_R_UNKNOWN_CERTIFICATE_TYPE); |
26a7d938 | 154 | return 0; |
0f113f3e MC |
155 | } |
156 | ||
157 | if (c->pkeys[i].x509 != NULL) { | |
158 | EVP_PKEY *pktmp; | |
8382fd3a | 159 | pktmp = X509_get0_pubkey(c->pkeys[i].x509); |
5f3d93e4 MC |
160 | if (pktmp == NULL) { |
161 | SSLerr(SSL_F_SSL_SET_PKEY, ERR_R_MALLOC_FAILURE); | |
5f3d93e4 MC |
162 | return 0; |
163 | } | |
164 | /* | |
165 | * The return code from EVP_PKEY_copy_parameters is deliberately | |
166 | * ignored. Some EVP_PKEY types cannot do this. | |
167 | */ | |
0f113f3e | 168 | EVP_PKEY_copy_parameters(pktmp, pkey); |
0f113f3e | 169 | ERR_clear_error(); |
dfeab068 | 170 | |
bc36ee62 | 171 | #ifndef OPENSSL_NO_RSA |
0f113f3e MC |
172 | /* |
173 | * Don't check the public/private key, this is mostly for smart | |
174 | * cards. | |
175 | */ | |
3aeb9348 | 176 | if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA |
a230b26e | 177 | && RSA_flags(EVP_PKEY_get0_RSA(pkey)) & RSA_METHOD_FLAG_NO_CHECK) ; |
0f113f3e | 178 | else |
58964a49 | 179 | #endif |
0f113f3e MC |
180 | if (!X509_check_private_key(c->pkeys[i].x509, pkey)) { |
181 | X509_free(c->pkeys[i].x509); | |
182 | c->pkeys[i].x509 = NULL; | |
183 | return 0; | |
184 | } | |
185 | } | |
186 | ||
25aaa98a | 187 | EVP_PKEY_free(c->pkeys[i].privatekey); |
3aeb9348 | 188 | EVP_PKEY_up_ref(pkey); |
0f113f3e | 189 | c->pkeys[i].privatekey = pkey; |
52fd27f9 DSH |
190 | c->key = &c->pkeys[i]; |
191 | return 1; | |
0f113f3e | 192 | } |
d02b48c6 | 193 | |
bc36ee62 | 194 | #ifndef OPENSSL_NO_RSA |
303c0028 | 195 | int SSL_use_RSAPrivateKey_file(SSL *ssl, const char *file, int type) |
0f113f3e MC |
196 | { |
197 | int j, ret = 0; | |
198 | BIO *in; | |
199 | RSA *rsa = NULL; | |
200 | ||
9982cbbb | 201 | in = BIO_new(BIO_s_file()); |
0f113f3e MC |
202 | if (in == NULL) { |
203 | SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, ERR_R_BUF_LIB); | |
204 | goto end; | |
205 | } | |
206 | ||
207 | if (BIO_read_filename(in, file) <= 0) { | |
208 | SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, ERR_R_SYS_LIB); | |
209 | goto end; | |
210 | } | |
211 | if (type == SSL_FILETYPE_ASN1) { | |
212 | j = ERR_R_ASN1_LIB; | |
213 | rsa = d2i_RSAPrivateKey_bio(in, NULL); | |
214 | } else if (type == SSL_FILETYPE_PEM) { | |
215 | j = ERR_R_PEM_LIB; | |
216 | rsa = PEM_read_bio_RSAPrivateKey(in, NULL, | |
d61461a7 P |
217 | ssl->default_passwd_callback, |
218 | ssl->default_passwd_callback_userdata); | |
0f113f3e MC |
219 | } else { |
220 | SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, SSL_R_BAD_SSL_FILETYPE); | |
221 | goto end; | |
222 | } | |
223 | if (rsa == NULL) { | |
224 | SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, j); | |
225 | goto end; | |
226 | } | |
227 | ret = SSL_use_RSAPrivateKey(ssl, rsa); | |
228 | RSA_free(rsa); | |
229 | end: | |
ca3a82c3 | 230 | BIO_free(in); |
26a7d938 | 231 | return ret; |
0f113f3e | 232 | } |
d02b48c6 | 233 | |
693b71fa | 234 | int SSL_use_RSAPrivateKey_ASN1(SSL *ssl, const unsigned char *d, long len) |
0f113f3e MC |
235 | { |
236 | int ret; | |
237 | const unsigned char *p; | |
238 | RSA *rsa; | |
239 | ||
240 | p = d; | |
241 | if ((rsa = d2i_RSAPrivateKey(NULL, &p, (long)len)) == NULL) { | |
242 | SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1, ERR_R_ASN1_LIB); | |
26a7d938 | 243 | return 0; |
0f113f3e MC |
244 | } |
245 | ||
246 | ret = SSL_use_RSAPrivateKey(ssl, rsa); | |
247 | RSA_free(rsa); | |
26a7d938 | 248 | return ret; |
0f113f3e MC |
249 | } |
250 | #endif /* !OPENSSL_NO_RSA */ | |
d02b48c6 | 251 | |
6b691a5c | 252 | int SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey) |
0f113f3e MC |
253 | { |
254 | int ret; | |
255 | ||
256 | if (pkey == NULL) { | |
257 | SSLerr(SSL_F_SSL_USE_PRIVATEKEY, ERR_R_PASSED_NULL_PARAMETER); | |
26a7d938 | 258 | return 0; |
0f113f3e | 259 | } |
0f113f3e | 260 | ret = ssl_set_pkey(ssl->cert, pkey); |
26a7d938 | 261 | return ret; |
0f113f3e | 262 | } |
d02b48c6 | 263 | |
303c0028 | 264 | int SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type) |
0f113f3e MC |
265 | { |
266 | int j, ret = 0; | |
267 | BIO *in; | |
268 | EVP_PKEY *pkey = NULL; | |
269 | ||
9982cbbb | 270 | in = BIO_new(BIO_s_file()); |
0f113f3e MC |
271 | if (in == NULL) { |
272 | SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE, ERR_R_BUF_LIB); | |
273 | goto end; | |
274 | } | |
275 | ||
276 | if (BIO_read_filename(in, file) <= 0) { | |
277 | SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE, ERR_R_SYS_LIB); | |
278 | goto end; | |
279 | } | |
280 | if (type == SSL_FILETYPE_PEM) { | |
281 | j = ERR_R_PEM_LIB; | |
d6a2bdf7 MC |
282 | pkey = PEM_read_bio_PrivateKey_ex(in, NULL, |
283 | ssl->default_passwd_callback, | |
284 | ssl->default_passwd_callback_userdata, | |
285 | ssl->ctx->libctx, | |
286 | ssl->ctx->propq); | |
0f113f3e MC |
287 | } else if (type == SSL_FILETYPE_ASN1) { |
288 | j = ERR_R_ASN1_LIB; | |
d6a2bdf7 MC |
289 | pkey = d2i_PrivateKey_ex_bio(in, NULL, ssl->ctx->libctx, |
290 | ssl->ctx->propq); | |
0f113f3e MC |
291 | } else { |
292 | SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE, SSL_R_BAD_SSL_FILETYPE); | |
293 | goto end; | |
294 | } | |
295 | if (pkey == NULL) { | |
296 | SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE, j); | |
297 | goto end; | |
298 | } | |
299 | ret = SSL_use_PrivateKey(ssl, pkey); | |
300 | EVP_PKEY_free(pkey); | |
301 | end: | |
ca3a82c3 | 302 | BIO_free(in); |
26a7d938 | 303 | return ret; |
0f113f3e | 304 | } |
d02b48c6 | 305 | |
0f113f3e MC |
306 | int SSL_use_PrivateKey_ASN1(int type, SSL *ssl, const unsigned char *d, |
307 | long len) | |
308 | { | |
309 | int ret; | |
310 | const unsigned char *p; | |
311 | EVP_PKEY *pkey; | |
d02b48c6 | 312 | |
0f113f3e | 313 | p = d; |
d6a2bdf7 MC |
314 | if ((pkey = d2i_PrivateKey_ex(type, NULL, &p, (long)len, ssl->ctx->libctx, |
315 | ssl->ctx->propq)) == NULL) { | |
0f113f3e | 316 | SSLerr(SSL_F_SSL_USE_PRIVATEKEY_ASN1, ERR_R_ASN1_LIB); |
26a7d938 | 317 | return 0; |
0f113f3e | 318 | } |
d02b48c6 | 319 | |
0f113f3e MC |
320 | ret = SSL_use_PrivateKey(ssl, pkey); |
321 | EVP_PKEY_free(pkey); | |
26a7d938 | 322 | return ret; |
0f113f3e | 323 | } |
d02b48c6 | 324 | |
6b691a5c | 325 | int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x) |
0f113f3e MC |
326 | { |
327 | int rv; | |
328 | if (x == NULL) { | |
329 | SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE, ERR_R_PASSED_NULL_PARAMETER); | |
26a7d938 | 330 | return 0; |
0f113f3e | 331 | } |
6725682d | 332 | |
0f113f3e MC |
333 | rv = ssl_security_cert(NULL, ctx, x, 0, 1); |
334 | if (rv != 1) { | |
335 | SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE, rv); | |
336 | return 0; | |
337 | } | |
26a7d938 | 338 | return ssl_set_cert(ctx->cert, x); |
0f113f3e | 339 | } |
d02b48c6 | 340 | |
6b691a5c | 341 | static int ssl_set_cert(CERT *c, X509 *x) |
0f113f3e MC |
342 | { |
343 | EVP_PKEY *pkey; | |
52fd27f9 | 344 | size_t i; |
0f113f3e | 345 | |
8382fd3a | 346 | pkey = X509_get0_pubkey(x); |
0f113f3e MC |
347 | if (pkey == NULL) { |
348 | SSLerr(SSL_F_SSL_SET_CERT, SSL_R_X509_LIB); | |
26a7d938 | 349 | return 0; |
0f113f3e MC |
350 | } |
351 | ||
52fd27f9 | 352 | if (ssl_cert_lookup_by_pkey(pkey, &i) == NULL) { |
0f113f3e | 353 | SSLerr(SSL_F_SSL_SET_CERT, SSL_R_UNKNOWN_CERTIFICATE_TYPE); |
8382fd3a | 354 | return 0; |
0f113f3e | 355 | } |
760f317d | 356 | #ifndef OPENSSL_NO_EC |
c2041da8 | 357 | if (i == SSL_PKEY_ECC && !EVP_PKEY_can_sign(pkey)) { |
1db3107a DSH |
358 | SSLerr(SSL_F_SSL_SET_CERT, SSL_R_ECC_CERT_NOT_FOR_SIGNING); |
359 | return 0; | |
360 | } | |
760f317d | 361 | #endif |
0f113f3e | 362 | if (c->pkeys[i].privatekey != NULL) { |
5f3d93e4 MC |
363 | /* |
364 | * The return code from EVP_PKEY_copy_parameters is deliberately | |
365 | * ignored. Some EVP_PKEY types cannot do this. | |
366 | */ | |
0f113f3e MC |
367 | EVP_PKEY_copy_parameters(pkey, c->pkeys[i].privatekey); |
368 | ERR_clear_error(); | |
dfeab068 | 369 | |
bc36ee62 | 370 | #ifndef OPENSSL_NO_RSA |
0f113f3e MC |
371 | /* |
372 | * Don't check the public/private key, this is mostly for smart | |
373 | * cards. | |
374 | */ | |
3aeb9348 DSH |
375 | if (EVP_PKEY_id(c->pkeys[i].privatekey) == EVP_PKEY_RSA |
376 | && RSA_flags(EVP_PKEY_get0_RSA(c->pkeys[i].privatekey)) & | |
a230b26e | 377 | RSA_METHOD_FLAG_NO_CHECK) ; |
0f113f3e MC |
378 | else |
379 | #endif /* OPENSSL_NO_RSA */ | |
380 | if (!X509_check_private_key(x, c->pkeys[i].privatekey)) { | |
381 | /* | |
382 | * don't fail for a cert/key mismatch, just free current private | |
383 | * key (when switching to a different cert & key, first this | |
384 | * function should be used, then ssl_set_pkey | |
385 | */ | |
386 | EVP_PKEY_free(c->pkeys[i].privatekey); | |
387 | c->pkeys[i].privatekey = NULL; | |
388 | /* clear error queue */ | |
389 | ERR_clear_error(); | |
390 | } | |
391 | } | |
392 | ||
222561fe | 393 | X509_free(c->pkeys[i].x509); |
05f0fb9f | 394 | X509_up_ref(x); |
0f113f3e MC |
395 | c->pkeys[i].x509 = x; |
396 | c->key = &(c->pkeys[i]); | |
397 | ||
8382fd3a | 398 | return 1; |
0f113f3e | 399 | } |
d02b48c6 | 400 | |
303c0028 | 401 | int SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type) |
0f113f3e | 402 | { |
6725682d | 403 | int j = SSL_R_BAD_VALUE; |
0f113f3e MC |
404 | BIO *in; |
405 | int ret = 0; | |
6725682d | 406 | X509 *x = NULL, *cert = NULL; |
0f113f3e | 407 | |
9982cbbb | 408 | in = BIO_new(BIO_s_file()); |
0f113f3e MC |
409 | if (in == NULL) { |
410 | SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, ERR_R_BUF_LIB); | |
411 | goto end; | |
412 | } | |
413 | ||
414 | if (BIO_read_filename(in, file) <= 0) { | |
415 | SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, ERR_R_SYS_LIB); | |
416 | goto end; | |
417 | } | |
6725682d SL |
418 | if (type != SSL_FILETYPE_ASN1 && type != SSL_FILETYPE_PEM) { |
419 | SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, SSL_R_BAD_SSL_FILETYPE); | |
420 | goto end; | |
421 | } | |
422 | x = X509_new_with_libctx(ctx->libctx, ctx->propq); | |
423 | if (x == NULL) { | |
424 | SSLerr(0, ERR_R_MALLOC_FAILURE); | |
425 | goto end; | |
426 | } | |
0f113f3e MC |
427 | if (type == SSL_FILETYPE_ASN1) { |
428 | j = ERR_R_ASN1_LIB; | |
6725682d | 429 | cert = d2i_X509_bio(in, &x); |
0f113f3e MC |
430 | } else if (type == SSL_FILETYPE_PEM) { |
431 | j = ERR_R_PEM_LIB; | |
6725682d SL |
432 | cert = PEM_read_bio_X509(in, &x, ctx->default_passwd_callback, |
433 | ctx->default_passwd_callback_userdata); | |
0f113f3e | 434 | } |
6725682d | 435 | if (cert == NULL) { |
0f113f3e MC |
436 | SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, j); |
437 | goto end; | |
438 | } | |
439 | ||
440 | ret = SSL_CTX_use_certificate(ctx, x); | |
441 | end: | |
222561fe | 442 | X509_free(x); |
ca3a82c3 | 443 | BIO_free(in); |
26a7d938 | 444 | return ret; |
0f113f3e | 445 | } |
d02b48c6 | 446 | |
a230b26e | 447 | int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, const unsigned char *d) |
0f113f3e MC |
448 | { |
449 | X509 *x; | |
450 | int ret; | |
d02b48c6 | 451 | |
6725682d | 452 | x = X509_new_with_libctx(ctx->libctx, ctx->propq); |
0f113f3e | 453 | if (x == NULL) { |
6725682d SL |
454 | SSLerr(0, ERR_R_MALLOC_FAILURE); |
455 | return 0; | |
456 | } | |
457 | ||
458 | if (d2i_X509(&x, &d, (long)len) == NULL) { | |
459 | X509_free(x); | |
0f113f3e | 460 | SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1, ERR_R_ASN1_LIB); |
26a7d938 | 461 | return 0; |
0f113f3e | 462 | } |
d02b48c6 | 463 | |
0f113f3e MC |
464 | ret = SSL_CTX_use_certificate(ctx, x); |
465 | X509_free(x); | |
26a7d938 | 466 | return ret; |
0f113f3e | 467 | } |
d02b48c6 | 468 | |
bc36ee62 | 469 | #ifndef OPENSSL_NO_RSA |
6b691a5c | 470 | int SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa) |
0f113f3e MC |
471 | { |
472 | int ret; | |
473 | EVP_PKEY *pkey; | |
474 | ||
475 | if (rsa == NULL) { | |
476 | SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY, ERR_R_PASSED_NULL_PARAMETER); | |
26a7d938 | 477 | return 0; |
0f113f3e | 478 | } |
0f113f3e MC |
479 | if ((pkey = EVP_PKEY_new()) == NULL) { |
480 | SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY, ERR_R_EVP_LIB); | |
26a7d938 | 481 | return 0; |
0f113f3e MC |
482 | } |
483 | ||
484 | RSA_up_ref(rsa); | |
5f3d93e4 MC |
485 | if (EVP_PKEY_assign_RSA(pkey, rsa) <= 0) { |
486 | RSA_free(rsa); | |
563c1ec6 | 487 | EVP_PKEY_free(pkey); |
5f3d93e4 MC |
488 | return 0; |
489 | } | |
0f113f3e MC |
490 | |
491 | ret = ssl_set_pkey(ctx->cert, pkey); | |
492 | EVP_PKEY_free(pkey); | |
26a7d938 | 493 | return ret; |
0f113f3e MC |
494 | } |
495 | ||
303c0028 | 496 | int SSL_CTX_use_RSAPrivateKey_file(SSL_CTX *ctx, const char *file, int type) |
0f113f3e MC |
497 | { |
498 | int j, ret = 0; | |
499 | BIO *in; | |
500 | RSA *rsa = NULL; | |
501 | ||
9982cbbb | 502 | in = BIO_new(BIO_s_file()); |
0f113f3e MC |
503 | if (in == NULL) { |
504 | SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, ERR_R_BUF_LIB); | |
505 | goto end; | |
506 | } | |
507 | ||
508 | if (BIO_read_filename(in, file) <= 0) { | |
509 | SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, ERR_R_SYS_LIB); | |
510 | goto end; | |
511 | } | |
512 | if (type == SSL_FILETYPE_ASN1) { | |
513 | j = ERR_R_ASN1_LIB; | |
514 | rsa = d2i_RSAPrivateKey_bio(in, NULL); | |
515 | } else if (type == SSL_FILETYPE_PEM) { | |
516 | j = ERR_R_PEM_LIB; | |
517 | rsa = PEM_read_bio_RSAPrivateKey(in, NULL, | |
518 | ctx->default_passwd_callback, | |
519 | ctx->default_passwd_callback_userdata); | |
520 | } else { | |
521 | SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, SSL_R_BAD_SSL_FILETYPE); | |
522 | goto end; | |
523 | } | |
524 | if (rsa == NULL) { | |
525 | SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, j); | |
526 | goto end; | |
527 | } | |
528 | ret = SSL_CTX_use_RSAPrivateKey(ctx, rsa); | |
529 | RSA_free(rsa); | |
530 | end: | |
ca3a82c3 | 531 | BIO_free(in); |
26a7d938 | 532 | return ret; |
0f113f3e | 533 | } |
0f113f3e MC |
534 | |
535 | int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, const unsigned char *d, | |
536 | long len) | |
537 | { | |
538 | int ret; | |
539 | const unsigned char *p; | |
540 | RSA *rsa; | |
541 | ||
542 | p = d; | |
543 | if ((rsa = d2i_RSAPrivateKey(NULL, &p, (long)len)) == NULL) { | |
544 | SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1, ERR_R_ASN1_LIB); | |
26a7d938 | 545 | return 0; |
0f113f3e MC |
546 | } |
547 | ||
548 | ret = SSL_CTX_use_RSAPrivateKey(ctx, rsa); | |
549 | RSA_free(rsa); | |
26a7d938 | 550 | return ret; |
0f113f3e MC |
551 | } |
552 | #endif /* !OPENSSL_NO_RSA */ | |
d02b48c6 | 553 | |
6b691a5c | 554 | int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey) |
0f113f3e MC |
555 | { |
556 | if (pkey == NULL) { | |
557 | SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY, ERR_R_PASSED_NULL_PARAMETER); | |
26a7d938 | 558 | return 0; |
0f113f3e | 559 | } |
26a7d938 | 560 | return ssl_set_pkey(ctx->cert, pkey); |
0f113f3e | 561 | } |
d02b48c6 | 562 | |
303c0028 | 563 | int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type) |
0f113f3e MC |
564 | { |
565 | int j, ret = 0; | |
566 | BIO *in; | |
567 | EVP_PKEY *pkey = NULL; | |
568 | ||
9982cbbb | 569 | in = BIO_new(BIO_s_file()); |
0f113f3e MC |
570 | if (in == NULL) { |
571 | SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, ERR_R_BUF_LIB); | |
572 | goto end; | |
573 | } | |
574 | ||
575 | if (BIO_read_filename(in, file) <= 0) { | |
576 | SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, ERR_R_SYS_LIB); | |
577 | goto end; | |
578 | } | |
579 | if (type == SSL_FILETYPE_PEM) { | |
580 | j = ERR_R_PEM_LIB; | |
d6a2bdf7 | 581 | pkey = PEM_read_bio_PrivateKey_ex(in, NULL, |
0f113f3e | 582 | ctx->default_passwd_callback, |
d6a2bdf7 MC |
583 | ctx->default_passwd_callback_userdata, |
584 | ctx->libctx, ctx->propq); | |
0f113f3e MC |
585 | } else if (type == SSL_FILETYPE_ASN1) { |
586 | j = ERR_R_ASN1_LIB; | |
d6a2bdf7 | 587 | pkey = d2i_PrivateKey_ex_bio(in, NULL, ctx->libctx, ctx->propq); |
0f113f3e MC |
588 | } else { |
589 | SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, SSL_R_BAD_SSL_FILETYPE); | |
590 | goto end; | |
591 | } | |
592 | if (pkey == NULL) { | |
593 | SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, j); | |
594 | goto end; | |
595 | } | |
596 | ret = SSL_CTX_use_PrivateKey(ctx, pkey); | |
597 | EVP_PKEY_free(pkey); | |
598 | end: | |
ca3a82c3 | 599 | BIO_free(in); |
26a7d938 | 600 | return ret; |
0f113f3e | 601 | } |
d02b48c6 | 602 | |
0f113f3e MC |
603 | int SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx, |
604 | const unsigned char *d, long len) | |
605 | { | |
606 | int ret; | |
607 | const unsigned char *p; | |
608 | EVP_PKEY *pkey; | |
d02b48c6 | 609 | |
0f113f3e | 610 | p = d; |
d6a2bdf7 MC |
611 | if ((pkey = d2i_PrivateKey_ex(type, NULL, &p, (long)len, ctx->libctx, |
612 | ctx->propq)) == NULL) { | |
0f113f3e | 613 | SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1, ERR_R_ASN1_LIB); |
26a7d938 | 614 | return 0; |
0f113f3e | 615 | } |
d02b48c6 | 616 | |
0f113f3e MC |
617 | ret = SSL_CTX_use_PrivateKey(ctx, pkey); |
618 | EVP_PKEY_free(pkey); | |
26a7d938 | 619 | return ret; |
0f113f3e | 620 | } |
d02b48c6 | 621 | |
0f113f3e MC |
622 | /* |
623 | * Read a file that contains our certificate in "PEM" format, possibly | |
624 | * followed by a sequence of CA certificates that should be sent to the peer | |
625 | * in the Certificate message. | |
b3ca645f | 626 | */ |
fae4772c | 627 | static int use_certificate_chain_file(SSL_CTX *ctx, SSL *ssl, const char *file) |
0f113f3e MC |
628 | { |
629 | BIO *in; | |
630 | int ret = 0; | |
631 | X509 *x = NULL; | |
a974e64a MC |
632 | pem_password_cb *passwd_callback; |
633 | void *passwd_callback_userdata; | |
6725682d | 634 | SSL_CTX *real_ctx = (ssl == NULL) ? ctx : ssl->ctx; |
0f113f3e MC |
635 | |
636 | ERR_clear_error(); /* clear error stack for | |
637 | * SSL_CTX_use_certificate() */ | |
638 | ||
a974e64a MC |
639 | if (ctx != NULL) { |
640 | passwd_callback = ctx->default_passwd_callback; | |
641 | passwd_callback_userdata = ctx->default_passwd_callback_userdata; | |
642 | } else { | |
643 | passwd_callback = ssl->default_passwd_callback; | |
644 | passwd_callback_userdata = ssl->default_passwd_callback_userdata; | |
645 | } | |
646 | ||
9982cbbb | 647 | in = BIO_new(BIO_s_file()); |
0f113f3e | 648 | if (in == NULL) { |
fae4772c | 649 | SSLerr(SSL_F_USE_CERTIFICATE_CHAIN_FILE, ERR_R_BUF_LIB); |
0f113f3e MC |
650 | goto end; |
651 | } | |
652 | ||
653 | if (BIO_read_filename(in, file) <= 0) { | |
fae4772c | 654 | SSLerr(SSL_F_USE_CERTIFICATE_CHAIN_FILE, ERR_R_SYS_LIB); |
0f113f3e MC |
655 | goto end; |
656 | } | |
657 | ||
6725682d | 658 | x = X509_new_with_libctx(real_ctx->libctx, real_ctx->propq); |
0f113f3e | 659 | if (x == NULL) { |
6725682d SL |
660 | SSLerr(SSL_F_USE_CERTIFICATE_CHAIN_FILE, ERR_R_MALLOC_FAILURE); |
661 | goto end; | |
662 | } | |
663 | if (PEM_read_bio_X509_AUX(in, &x, passwd_callback, | |
664 | passwd_callback_userdata) == NULL) { | |
fae4772c | 665 | SSLerr(SSL_F_USE_CERTIFICATE_CHAIN_FILE, ERR_R_PEM_LIB); |
0f113f3e MC |
666 | goto end; |
667 | } | |
668 | ||
fae4772c DSH |
669 | if (ctx) |
670 | ret = SSL_CTX_use_certificate(ctx, x); | |
671 | else | |
672 | ret = SSL_use_certificate(ssl, x); | |
0f113f3e MC |
673 | |
674 | if (ERR_peek_error() != 0) | |
675 | ret = 0; /* Key/certificate mismatch doesn't imply | |
676 | * ret==0 ... */ | |
677 | if (ret) { | |
678 | /* | |
679 | * If we could set up our certificate, now proceed to the CA | |
680 | * certificates. | |
681 | */ | |
682 | X509 *ca; | |
683 | int r; | |
684 | unsigned long err; | |
685 | ||
fae4772c DSH |
686 | if (ctx) |
687 | r = SSL_CTX_clear_chain_certs(ctx); | |
688 | else | |
689 | r = SSL_clear_chain_certs(ssl); | |
690 | ||
691 | if (r == 0) { | |
69f68237 MC |
692 | ret = 0; |
693 | goto end; | |
694 | } | |
0f113f3e | 695 | |
6725682d SL |
696 | while (1) { |
697 | ca = X509_new_with_libctx(real_ctx->libctx, real_ctx->propq); | |
698 | if (ca == NULL) { | |
699 | SSLerr(SSL_F_USE_CERTIFICATE_CHAIN_FILE, ERR_R_MALLOC_FAILURE); | |
0f113f3e MC |
700 | goto end; |
701 | } | |
6725682d SL |
702 | if (PEM_read_bio_X509(in, &ca, passwd_callback, |
703 | passwd_callback_userdata) != NULL) { | |
704 | if (ctx) | |
705 | r = SSL_CTX_add0_chain_cert(ctx, ca); | |
706 | else | |
707 | r = SSL_add0_chain_cert(ssl, ca); | |
708 | /* | |
709 | * Note that we must not free ca if it was successfully added to | |
710 | * the chain (while we must free the main certificate, since its | |
711 | * reference count is increased by SSL_CTX_use_certificate). | |
712 | */ | |
713 | if (!r) { | |
714 | X509_free(ca); | |
715 | ret = 0; | |
716 | goto end; | |
717 | } | |
718 | } else { | |
719 | X509_free(ca); | |
720 | break; | |
721 | } | |
0f113f3e MC |
722 | } |
723 | /* When the while loop ends, it's usually just EOF. */ | |
724 | err = ERR_peek_last_error(); | |
725 | if (ERR_GET_LIB(err) == ERR_LIB_PEM | |
726 | && ERR_GET_REASON(err) == PEM_R_NO_START_LINE) | |
727 | ERR_clear_error(); | |
728 | else | |
729 | ret = 0; /* some real error */ | |
730 | } | |
731 | ||
732 | end: | |
25aaa98a | 733 | X509_free(x); |
ca3a82c3 | 734 | BIO_free(in); |
26a7d938 | 735 | return ret; |
0f113f3e | 736 | } |
fae4772c DSH |
737 | |
738 | int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file) | |
739 | { | |
740 | return use_certificate_chain_file(ctx, NULL, file); | |
741 | } | |
742 | ||
743 | int SSL_use_certificate_chain_file(SSL *ssl, const char *file) | |
744 | { | |
745 | return use_certificate_chain_file(NULL, ssl, file); | |
746 | } | |
a9e1c50b | 747 | |
a398f821 | 748 | static int serverinfo_find_extension(const unsigned char *serverinfo, |
0f113f3e MC |
749 | size_t serverinfo_length, |
750 | unsigned int extension_type, | |
751 | const unsigned char **extension_data, | |
752 | size_t *extension_length) | |
753 | { | |
84c34ba8 MC |
754 | PACKET pkt, data; |
755 | ||
0f113f3e MC |
756 | *extension_data = NULL; |
757 | *extension_length = 0; | |
758 | if (serverinfo == NULL || serverinfo_length == 0) | |
fae11ec7 | 759 | return -1; |
84c34ba8 MC |
760 | |
761 | if (!PACKET_buf_init(&pkt, serverinfo, serverinfo_length)) | |
762 | return -1; | |
763 | ||
0f113f3e MC |
764 | for (;;) { |
765 | unsigned int type = 0; | |
84c34ba8 | 766 | unsigned long context = 0; |
0f113f3e MC |
767 | |
768 | /* end of serverinfo */ | |
84c34ba8 | 769 | if (PACKET_remaining(&pkt) == 0) |
fae11ec7 | 770 | return 0; /* Extension not found */ |
0f113f3e | 771 | |
84c34ba8 MC |
772 | if (!PACKET_get_net_4(&pkt, &context) |
773 | || !PACKET_get_net_2(&pkt, &type) | |
774 | || !PACKET_get_length_prefixed_2(&pkt, &data)) | |
775 | return -1; | |
0f113f3e MC |
776 | |
777 | if (type == extension_type) { | |
84c34ba8 MC |
778 | *extension_data = PACKET_data(&data); |
779 | *extension_length = PACKET_remaining(&data);; | |
0f113f3e MC |
780 | return 1; /* Success */ |
781 | } | |
0f113f3e | 782 | } |
c6ef15c4 | 783 | /* Unreachable */ |
0f113f3e | 784 | } |
a398f821 | 785 | |
84c34ba8 MC |
786 | static int serverinfoex_srv_parse_cb(SSL *s, unsigned int ext_type, |
787 | unsigned int context, | |
788 | const unsigned char *in, | |
789 | size_t inlen, X509 *x, size_t chainidx, | |
790 | int *al, void *arg) | |
0f113f3e | 791 | { |
0a602875 | 792 | |
0f113f3e MC |
793 | if (inlen != 0) { |
794 | *al = SSL_AD_DECODE_ERROR; | |
795 | return 0; | |
796 | } | |
0a602875 | 797 | |
0f113f3e MC |
798 | return 1; |
799 | } | |
9cd50f73 | 800 | |
84c34ba8 MC |
801 | static int serverinfo_srv_parse_cb(SSL *s, unsigned int ext_type, |
802 | const unsigned char *in, | |
803 | size_t inlen, int *al, void *arg) | |
804 | { | |
805 | return serverinfoex_srv_parse_cb(s, ext_type, 0, in, inlen, NULL, 0, al, | |
806 | arg); | |
807 | } | |
808 | ||
809 | static int serverinfoex_srv_add_cb(SSL *s, unsigned int ext_type, | |
810 | unsigned int context, | |
811 | const unsigned char **out, | |
812 | size_t *outlen, X509 *x, size_t chainidx, | |
813 | int *al, void *arg) | |
0f113f3e MC |
814 | { |
815 | const unsigned char *serverinfo = NULL; | |
816 | size_t serverinfo_length = 0; | |
817 | ||
f233a9d1 MC |
818 | /* We only support extensions for the first Certificate */ |
819 | if ((context & SSL_EXT_TLS1_3_CERTIFICATE) != 0 && chainidx > 0) | |
820 | return 0; | |
821 | ||
0f113f3e MC |
822 | /* Is there serverinfo data for the chosen server cert? */ |
823 | if ((ssl_get_server_cert_serverinfo(s, &serverinfo, | |
824 | &serverinfo_length)) != 0) { | |
825 | /* Find the relevant extension from the serverinfo */ | |
826 | int retval = serverinfo_find_extension(serverinfo, serverinfo_length, | |
827 | ext_type, out, outlen); | |
fae11ec7 | 828 | if (retval == -1) { |
fb34a0f4 | 829 | *al = SSL_AD_INTERNAL_ERROR; |
fae11ec7 KR |
830 | return -1; /* Error */ |
831 | } | |
0f113f3e | 832 | if (retval == 0) |
fae11ec7 | 833 | return 0; /* No extension found, don't send extension */ |
0f113f3e MC |
834 | return 1; /* Send extension */ |
835 | } | |
5f18bc58 | 836 | return 0; /* No serverinfo data found, don't send |
0f113f3e MC |
837 | * extension */ |
838 | } | |
839 | ||
84c34ba8 MC |
840 | static int serverinfo_srv_add_cb(SSL *s, unsigned int ext_type, |
841 | const unsigned char **out, size_t *outlen, | |
842 | int *al, void *arg) | |
843 | { | |
844 | return serverinfoex_srv_add_cb(s, ext_type, 0, out, outlen, NULL, 0, al, | |
845 | arg); | |
846 | } | |
847 | ||
0f113f3e MC |
848 | /* |
849 | * With a NULL context, this function just checks that the serverinfo data | |
850 | * parses correctly. With a non-NULL context, it registers callbacks for | |
851 | * the included extensions. | |
852 | */ | |
84c34ba8 MC |
853 | static int serverinfo_process_buffer(unsigned int version, |
854 | const unsigned char *serverinfo, | |
0f113f3e MC |
855 | size_t serverinfo_length, SSL_CTX *ctx) |
856 | { | |
84c34ba8 MC |
857 | PACKET pkt; |
858 | ||
0f113f3e MC |
859 | if (serverinfo == NULL || serverinfo_length == 0) |
860 | return 0; | |
0f113f3e | 861 | |
2698bbfe | 862 | if (version != SSL_SERVERINFOV1 && version != SSL_SERVERINFOV2) |
84c34ba8 | 863 | return 0; |
0f113f3e | 864 | |
84c34ba8 MC |
865 | if (!PACKET_buf_init(&pkt, serverinfo, serverinfo_length)) |
866 | return 0; | |
0f113f3e | 867 | |
84c34ba8 MC |
868 | while (PACKET_remaining(&pkt)) { |
869 | unsigned long context = 0; | |
870 | unsigned int ext_type = 0; | |
871 | PACKET data; | |
0f113f3e | 872 | |
bade29da | 873 | if ((version == SSL_SERVERINFOV2 && !PACKET_get_net_4(&pkt, &context)) |
84c34ba8 MC |
874 | || !PACKET_get_net_2(&pkt, &ext_type) |
875 | || !PACKET_get_length_prefixed_2(&pkt, &data)) | |
0f113f3e MC |
876 | return 0; |
877 | ||
84c34ba8 MC |
878 | if (ctx == NULL) |
879 | continue; | |
880 | ||
bade29da MC |
881 | /* |
882 | * The old style custom extensions API could be set separately for | |
883 | * server/client, i.e. you could set one custom extension for a client, | |
884 | * and *for the same extension in the same SSL_CTX* you could set a | |
885 | * custom extension for the server as well. It seems quite weird to be | |
886 | * setting a custom extension for both client and server in a single | |
887 | * SSL_CTX - but theoretically possible. This isn't possible in the | |
888 | * new API. Therefore, if we have V1 serverinfo we use the old API. We | |
889 | * also use the old API even if we have V2 serverinfo but the context | |
890 | * looks like an old style <= TLSv1.2 extension. | |
891 | */ | |
7a4e6a1e | 892 | if (version == SSL_SERVERINFOV1 || context == SYNTHV1CONTEXT) { |
84c34ba8 MC |
893 | if (!SSL_CTX_add_server_custom_ext(ctx, ext_type, |
894 | serverinfo_srv_add_cb, | |
895 | NULL, NULL, | |
896 | serverinfo_srv_parse_cb, | |
897 | NULL)) | |
898 | return 0; | |
899 | } else { | |
900 | if (!SSL_CTX_add_custom_ext(ctx, ext_type, context, | |
901 | serverinfoex_srv_add_cb, | |
902 | NULL, NULL, | |
903 | serverinfoex_srv_parse_cb, | |
904 | NULL)) | |
905 | return 0; | |
906 | } | |
0f113f3e | 907 | } |
84c34ba8 MC |
908 | |
909 | return 1; | |
0f113f3e | 910 | } |
a398f821 | 911 | |
84c34ba8 MC |
912 | int SSL_CTX_use_serverinfo_ex(SSL_CTX *ctx, unsigned int version, |
913 | const unsigned char *serverinfo, | |
914 | size_t serverinfo_length) | |
0f113f3e MC |
915 | { |
916 | unsigned char *new_serverinfo; | |
917 | ||
918 | if (ctx == NULL || serverinfo == NULL || serverinfo_length == 0) { | |
84c34ba8 | 919 | SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_EX, ERR_R_PASSED_NULL_PARAMETER); |
0f113f3e MC |
920 | return 0; |
921 | } | |
84c34ba8 MC |
922 | if (!serverinfo_process_buffer(version, serverinfo, serverinfo_length, |
923 | NULL)) { | |
924 | SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_EX, SSL_R_INVALID_SERVERINFO_DATA); | |
0f113f3e MC |
925 | return 0; |
926 | } | |
0f113f3e | 927 | if (ctx->cert->key == NULL) { |
84c34ba8 | 928 | SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_EX, ERR_R_INTERNAL_ERROR); |
0f113f3e MC |
929 | return 0; |
930 | } | |
931 | new_serverinfo = OPENSSL_realloc(ctx->cert->key->serverinfo, | |
932 | serverinfo_length); | |
933 | if (new_serverinfo == NULL) { | |
84c34ba8 | 934 | SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_EX, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
935 | return 0; |
936 | } | |
937 | ctx->cert->key->serverinfo = new_serverinfo; | |
938 | memcpy(ctx->cert->key->serverinfo, serverinfo, serverinfo_length); | |
939 | ctx->cert->key->serverinfo_length = serverinfo_length; | |
940 | ||
941 | /* | |
942 | * Now that the serverinfo is validated and stored, go ahead and | |
943 | * register callbacks. | |
944 | */ | |
84c34ba8 MC |
945 | if (!serverinfo_process_buffer(version, serverinfo, serverinfo_length, |
946 | ctx)) { | |
947 | SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_EX, SSL_R_INVALID_SERVERINFO_DATA); | |
0f113f3e MC |
948 | return 0; |
949 | } | |
950 | return 1; | |
951 | } | |
952 | ||
84c34ba8 MC |
953 | int SSL_CTX_use_serverinfo(SSL_CTX *ctx, const unsigned char *serverinfo, |
954 | size_t serverinfo_length) | |
955 | { | |
2698bbfe | 956 | return SSL_CTX_use_serverinfo_ex(ctx, SSL_SERVERINFOV1, serverinfo, |
84c34ba8 MC |
957 | serverinfo_length); |
958 | } | |
959 | ||
a398f821 | 960 | int SSL_CTX_use_serverinfo_file(SSL_CTX *ctx, const char *file) |
0f113f3e MC |
961 | { |
962 | unsigned char *serverinfo = NULL; | |
7c0ef843 | 963 | unsigned char *tmp; |
0f113f3e MC |
964 | size_t serverinfo_length = 0; |
965 | unsigned char *extension = 0; | |
966 | long extension_length = 0; | |
967 | char *name = NULL; | |
968 | char *header = NULL; | |
4bac25e1 | 969 | static const char namePrefix1[] = "SERVERINFO FOR "; |
970 | static const char namePrefix2[] = "SERVERINFOV2 FOR "; | |
971 | unsigned int name_len; | |
0f113f3e MC |
972 | int ret = 0; |
973 | BIO *bin = NULL; | |
84c34ba8 | 974 | size_t num_extensions = 0, contextoff = 0; |
0f113f3e MC |
975 | |
976 | if (ctx == NULL || file == NULL) { | |
a230b26e | 977 | SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, ERR_R_PASSED_NULL_PARAMETER); |
0f113f3e MC |
978 | goto end; |
979 | } | |
980 | ||
9982cbbb | 981 | bin = BIO_new(BIO_s_file()); |
0f113f3e MC |
982 | if (bin == NULL) { |
983 | SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, ERR_R_BUF_LIB); | |
984 | goto end; | |
985 | } | |
986 | if (BIO_read_filename(bin, file) <= 0) { | |
987 | SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, ERR_R_SYS_LIB); | |
988 | goto end; | |
989 | } | |
990 | ||
991 | for (num_extensions = 0;; num_extensions++) { | |
7a4e6a1e MC |
992 | unsigned int version; |
993 | ||
0f113f3e MC |
994 | if (PEM_read_bio(bin, &name, &header, &extension, &extension_length) |
995 | == 0) { | |
996 | /* | |
997 | * There must be at least one extension in this file | |
998 | */ | |
999 | if (num_extensions == 0) { | |
1000 | SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, | |
1001 | SSL_R_NO_PEM_EXTENSIONS); | |
1002 | goto end; | |
1003 | } else /* End of file, we're done */ | |
1004 | break; | |
1005 | } | |
1006 | /* Check that PEM name starts with "BEGIN SERVERINFO FOR " */ | |
4bac25e1 | 1007 | name_len = strlen(name); |
1008 | if (name_len < sizeof(namePrefix1) - 1) { | |
a230b26e | 1009 | SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, SSL_R_PEM_NAME_TOO_SHORT); |
0f113f3e MC |
1010 | goto end; |
1011 | } | |
4bac25e1 | 1012 | if (strncmp(name, namePrefix1, sizeof(namePrefix1) - 1) == 0) { |
2698bbfe | 1013 | version = SSL_SERVERINFOV1; |
84c34ba8 | 1014 | } else { |
4bac25e1 | 1015 | if (name_len < sizeof(namePrefix2) - 1) { |
84c34ba8 MC |
1016 | SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, |
1017 | SSL_R_PEM_NAME_TOO_SHORT); | |
1018 | goto end; | |
1019 | } | |
4bac25e1 | 1020 | if (strncmp(name, namePrefix2, sizeof(namePrefix2) - 1) != 0) { |
84c34ba8 MC |
1021 | SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, |
1022 | SSL_R_PEM_NAME_BAD_PREFIX); | |
1023 | goto end; | |
1024 | } | |
2698bbfe | 1025 | version = SSL_SERVERINFOV2; |
0f113f3e MC |
1026 | } |
1027 | /* | |
1028 | * Check that the decoded PEM data is plausible (valid length field) | |
1029 | */ | |
2698bbfe | 1030 | if (version == SSL_SERVERINFOV1) { |
84c34ba8 MC |
1031 | /* 4 byte header: 2 bytes type, 2 bytes len */ |
1032 | if (extension_length < 4 | |
1033 | || (extension[2] << 8) + extension[3] | |
1034 | != extension_length - 4) { | |
1035 | SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, SSL_R_BAD_DATA); | |
1036 | goto end; | |
1037 | } | |
1038 | /* | |
1039 | * File does not have a context value so we must take account of | |
1040 | * this later. | |
1041 | */ | |
1042 | contextoff = 4; | |
1043 | } else { | |
1044 | /* 8 byte header: 4 bytes context, 2 bytes type, 2 bytes len */ | |
1045 | if (extension_length < 8 | |
1046 | || (extension[6] << 8) + extension[7] | |
1047 | != extension_length - 8) { | |
1048 | SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, SSL_R_BAD_DATA); | |
1049 | goto end; | |
1050 | } | |
0f113f3e MC |
1051 | } |
1052 | /* Append the decoded extension to the serverinfo buffer */ | |
84c34ba8 MC |
1053 | tmp = OPENSSL_realloc(serverinfo, serverinfo_length + extension_length |
1054 | + contextoff); | |
7c0ef843 | 1055 | if (tmp == NULL) { |
0f113f3e MC |
1056 | SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, ERR_R_MALLOC_FAILURE); |
1057 | goto end; | |
1058 | } | |
7c0ef843 | 1059 | serverinfo = tmp; |
84c34ba8 | 1060 | if (contextoff > 0) { |
84c34ba8 MC |
1061 | unsigned char *sinfo = serverinfo + serverinfo_length; |
1062 | ||
1063 | /* We know this only uses the last 2 bytes */ | |
1064 | sinfo[0] = 0; | |
1065 | sinfo[1] = 0; | |
7a4e6a1e MC |
1066 | sinfo[2] = (SYNTHV1CONTEXT >> 8) & 0xff; |
1067 | sinfo[3] = SYNTHV1CONTEXT & 0xff; | |
84c34ba8 MC |
1068 | } |
1069 | memcpy(serverinfo + serverinfo_length + contextoff, | |
1070 | extension, extension_length); | |
1071 | serverinfo_length += extension_length + contextoff; | |
0f113f3e MC |
1072 | |
1073 | OPENSSL_free(name); | |
1074 | name = NULL; | |
1075 | OPENSSL_free(header); | |
1076 | header = NULL; | |
1077 | OPENSSL_free(extension); | |
1078 | extension = NULL; | |
1079 | } | |
1080 | ||
bade29da | 1081 | ret = SSL_CTX_use_serverinfo_ex(ctx, SSL_SERVERINFOV2, serverinfo, |
bb78552e | 1082 | serverinfo_length); |
0f113f3e MC |
1083 | end: |
1084 | /* SSL_CTX_use_serverinfo makes a local copy of the serverinfo. */ | |
1085 | OPENSSL_free(name); | |
1086 | OPENSSL_free(header); | |
1087 | OPENSSL_free(extension); | |
1088 | OPENSSL_free(serverinfo); | |
ca3a82c3 | 1089 | BIO_free(bin); |
0f113f3e MC |
1090 | return ret; |
1091 | } | |
37933acb TS |
1092 | |
1093 | static int ssl_set_cert_and_key(SSL *ssl, SSL_CTX *ctx, X509 *x509, EVP_PKEY *privatekey, | |
1094 | STACK_OF(X509) *chain, int override) | |
1095 | { | |
1096 | int ret = 0; | |
1097 | size_t i; | |
1098 | int j; | |
1099 | int rv; | |
1100 | CERT *c = ssl != NULL ? ssl->cert : ctx->cert; | |
1101 | STACK_OF(X509) *dup_chain = NULL; | |
1102 | EVP_PKEY *pubkey = NULL; | |
1103 | ||
1104 | /* Do all security checks before anything else */ | |
1105 | rv = ssl_security_cert(ssl, ctx, x509, 0, 1); | |
1106 | if (rv != 1) { | |
1107 | SSLerr(SSL_F_SSL_SET_CERT_AND_KEY, rv); | |
1108 | goto out; | |
1109 | } | |
1110 | for (j = 0; j < sk_X509_num(chain); j++) { | |
1111 | rv = ssl_security_cert(ssl, ctx, sk_X509_value(chain, j), 0, 0); | |
1112 | if (rv != 1) { | |
1113 | SSLerr(SSL_F_SSL_SET_CERT_AND_KEY, rv); | |
1114 | goto out; | |
1115 | } | |
1116 | } | |
1117 | ||
1118 | pubkey = X509_get_pubkey(x509); /* bumps reference */ | |
1119 | if (pubkey == NULL) | |
1120 | goto out; | |
1121 | if (privatekey == NULL) { | |
1122 | privatekey = pubkey; | |
1123 | } else { | |
1124 | /* For RSA, which has no parameters, missing returns 0 */ | |
1125 | if (EVP_PKEY_missing_parameters(privatekey)) { | |
1126 | if (EVP_PKEY_missing_parameters(pubkey)) { | |
1127 | /* nobody has parameters? - error */ | |
1128 | SSLerr(SSL_F_SSL_SET_CERT_AND_KEY, SSL_R_MISSING_PARAMETERS); | |
1129 | goto out; | |
1130 | } else { | |
1131 | /* copy to privatekey from pubkey */ | |
1132 | EVP_PKEY_copy_parameters(privatekey, pubkey); | |
1133 | } | |
1134 | } else if (EVP_PKEY_missing_parameters(pubkey)) { | |
1135 | /* copy to pubkey from privatekey */ | |
1136 | EVP_PKEY_copy_parameters(pubkey, privatekey); | |
1137 | } /* else both have parameters */ | |
1138 | ||
1139 | /* Copied from ssl_set_cert/pkey */ | |
1140 | #ifndef OPENSSL_NO_RSA | |
1141 | if ((EVP_PKEY_id(privatekey) == EVP_PKEY_RSA) && | |
1142 | ((RSA_flags(EVP_PKEY_get0_RSA(privatekey)) & RSA_METHOD_FLAG_NO_CHECK))) | |
1143 | /* no-op */ ; | |
1144 | else | |
1145 | #endif | |
1146 | /* check that key <-> cert match */ | |
c74aaa39 | 1147 | if (EVP_PKEY_eq(pubkey, privatekey) != 1) { |
37933acb TS |
1148 | SSLerr(SSL_F_SSL_SET_CERT_AND_KEY, SSL_R_PRIVATE_KEY_MISMATCH); |
1149 | goto out; | |
1150 | } | |
1151 | } | |
1152 | if (ssl_cert_lookup_by_pkey(pubkey, &i) == NULL) { | |
1153 | SSLerr(SSL_F_SSL_SET_CERT_AND_KEY, SSL_R_UNKNOWN_CERTIFICATE_TYPE); | |
1154 | goto out; | |
1155 | } | |
1156 | ||
1157 | if (!override && (c->pkeys[i].x509 != NULL | |
1158 | || c->pkeys[i].privatekey != NULL | |
1159 | || c->pkeys[i].chain != NULL)) { | |
1160 | /* No override, and something already there */ | |
1161 | SSLerr(SSL_F_SSL_SET_CERT_AND_KEY, SSL_R_NOT_REPLACING_CERTIFICATE); | |
1162 | goto out; | |
1163 | } | |
1164 | ||
1165 | if (chain != NULL) { | |
1166 | dup_chain = X509_chain_up_ref(chain); | |
1167 | if (dup_chain == NULL) { | |
1168 | SSLerr(SSL_F_SSL_SET_CERT_AND_KEY, ERR_R_MALLOC_FAILURE); | |
1169 | goto out; | |
1170 | } | |
1171 | } | |
1172 | ||
1173 | sk_X509_pop_free(c->pkeys[i].chain, X509_free); | |
1174 | c->pkeys[i].chain = dup_chain; | |
1175 | ||
1176 | X509_free(c->pkeys[i].x509); | |
1177 | X509_up_ref(x509); | |
1178 | c->pkeys[i].x509 = x509; | |
1179 | ||
1180 | EVP_PKEY_free(c->pkeys[i].privatekey); | |
1181 | EVP_PKEY_up_ref(privatekey); | |
1182 | c->pkeys[i].privatekey = privatekey; | |
1183 | ||
1184 | c->key = &(c->pkeys[i]); | |
1185 | ||
1186 | ret = 1; | |
1187 | out: | |
1188 | EVP_PKEY_free(pubkey); | |
1189 | return ret; | |
1190 | } | |
1191 | ||
1192 | int SSL_use_cert_and_key(SSL *ssl, X509 *x509, EVP_PKEY *privatekey, | |
1193 | STACK_OF(X509) *chain, int override) | |
1194 | { | |
1195 | return ssl_set_cert_and_key(ssl, NULL, x509, privatekey, chain, override); | |
1196 | } | |
1197 | ||
1198 | int SSL_CTX_use_cert_and_key(SSL_CTX *ctx, X509 *x509, EVP_PKEY *privatekey, | |
1199 | STACK_OF(X509) *chain, int override) | |
1200 | { | |
1201 | return ssl_set_cert_and_key(NULL, ctx, x509, privatekey, chain, override); | |
1202 | } |