]>
Commit | Line | Data |
---|---|---|
846e33c7 | 1 | /* |
da1c088f | 2 | * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved. |
d02b48c6 | 3 | * |
2c18d164 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
846e33c7 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
d02b48c6 RE |
8 | */ |
9 | ||
10 | #include <stdio.h> | |
706457b7 | 11 | #include "ssl_local.h" |
0d345f0e | 12 | #include "internal/packet.h" |
ec577822 BM |
13 | #include <openssl/bio.h> |
14 | #include <openssl/objects.h> | |
15 | #include <openssl/evp.h> | |
16 | #include <openssl/x509.h> | |
9f0f53b7 | 17 | #include <openssl/x509v3.h> |
ec577822 | 18 | #include <openssl/pem.h> |
d02b48c6 | 19 | |
ee58915c MB |
20 | static int ssl_set_cert(CERT *c, X509 *x509, SSL_CTX *ctx); |
21 | static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey, SSL_CTX *ctx); | |
bade29da | 22 | |
7a4e6a1e MC |
23 | #define SYNTHV1CONTEXT (SSL_EXT_TLS1_2_AND_BELOW_ONLY \ |
24 | | SSL_EXT_CLIENT_HELLO \ | |
25 | | SSL_EXT_TLS1_2_SERVER_HELLO \ | |
26 | | SSL_EXT_IGNORE_ON_RESUMPTION) | |
bade29da | 27 | |
2ff286c2 DDO |
28 | #define NAME_PREFIX1 "SERVERINFO FOR " |
29 | #define NAME_PREFIX2 "SERVERINFOV2 FOR " | |
30 | ||
6b691a5c | 31 | int SSL_use_certificate(SSL *ssl, X509 *x) |
0f113f3e MC |
32 | { |
33 | int rv; | |
38b051a1 TM |
34 | SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); |
35 | ||
36 | if (sc == NULL) | |
37 | return 0; | |
38 | ||
0f113f3e | 39 | if (x == NULL) { |
6849b73c | 40 | ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); |
26a7d938 | 41 | return 0; |
0f113f3e | 42 | } |
6725682d | 43 | |
38b051a1 | 44 | rv = ssl_security_cert(sc, NULL, x, 0, 1); |
0f113f3e | 45 | if (rv != 1) { |
6849b73c | 46 | ERR_raise(ERR_LIB_SSL, rv); |
0f113f3e MC |
47 | return 0; |
48 | } | |
49 | ||
ee58915c | 50 | return ssl_set_cert(sc->cert, x, SSL_CONNECTION_GET_CTX(sc)); |
0f113f3e | 51 | } |
d02b48c6 | 52 | |
303c0028 | 53 | int SSL_use_certificate_file(SSL *ssl, const char *file, int type) |
0f113f3e MC |
54 | { |
55 | int j; | |
56 | BIO *in; | |
57 | int ret = 0; | |
6725682d | 58 | X509 *cert = NULL, *x = NULL; |
0f113f3e | 59 | |
9982cbbb | 60 | in = BIO_new(BIO_s_file()); |
0f113f3e | 61 | if (in == NULL) { |
6849b73c | 62 | ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); |
0f113f3e MC |
63 | goto end; |
64 | } | |
65 | ||
66 | if (BIO_read_filename(in, file) <= 0) { | |
6849b73c | 67 | ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB); |
0f113f3e MC |
68 | goto end; |
69 | } | |
6725682d | 70 | |
d8652be0 | 71 | x = X509_new_ex(ssl->ctx->libctx, ssl->ctx->propq); |
6725682d | 72 | if (x == NULL) { |
e077455e | 73 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
6725682d SL |
74 | goto end; |
75 | } | |
0f113f3e MC |
76 | if (type == SSL_FILETYPE_ASN1) { |
77 | j = ERR_R_ASN1_LIB; | |
6725682d | 78 | cert = d2i_X509_bio(in, &x); |
0f113f3e | 79 | } else if (type == SSL_FILETYPE_PEM) { |
38b051a1 TM |
80 | SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); |
81 | ||
82 | if (sc == NULL) | |
83 | goto end; | |
84 | ||
0f113f3e | 85 | j = ERR_R_PEM_LIB; |
38b051a1 TM |
86 | cert = PEM_read_bio_X509(in, &x, sc->default_passwd_callback, |
87 | sc->default_passwd_callback_userdata); | |
0f113f3e | 88 | } else { |
6849b73c | 89 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_SSL_FILETYPE); |
0f113f3e MC |
90 | goto end; |
91 | } | |
92 | ||
6725682d | 93 | if (cert == NULL) { |
6849b73c | 94 | ERR_raise(ERR_LIB_SSL, j); |
0f113f3e MC |
95 | goto end; |
96 | } | |
97 | ||
98 | ret = SSL_use_certificate(ssl, x); | |
99 | end: | |
222561fe | 100 | X509_free(x); |
ca3a82c3 | 101 | BIO_free(in); |
26a7d938 | 102 | return ret; |
0f113f3e | 103 | } |
d02b48c6 | 104 | |
875a644a | 105 | int SSL_use_certificate_ASN1(SSL *ssl, const unsigned char *d, int len) |
0f113f3e MC |
106 | { |
107 | X509 *x; | |
108 | int ret; | |
109 | ||
d8652be0 | 110 | x = X509_new_ex(ssl->ctx->libctx, ssl->ctx->propq); |
0f113f3e | 111 | if (x == NULL) { |
e077455e | 112 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
6725682d SL |
113 | return 0; |
114 | } | |
115 | ||
116 | if (d2i_X509(&x, &d, (long)len)== NULL) { | |
117 | X509_free(x); | |
6849b73c | 118 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
26a7d938 | 119 | return 0; |
0f113f3e MC |
120 | } |
121 | ||
122 | ret = SSL_use_certificate(ssl, x); | |
123 | X509_free(x); | |
26a7d938 | 124 | return ret; |
0f113f3e | 125 | } |
d02b48c6 | 126 | |
ee58915c | 127 | static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey, SSL_CTX *ctx) |
0f113f3e | 128 | { |
52fd27f9 DSH |
129 | size_t i; |
130 | ||
ee58915c | 131 | if (ssl_cert_lookup_by_pkey(pkey, &i, ctx) == NULL) { |
6849b73c | 132 | ERR_raise(ERR_LIB_SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE); |
26a7d938 | 133 | return 0; |
0f113f3e MC |
134 | } |
135 | ||
fc52ae8c MC |
136 | if (c->pkeys[i].x509 != NULL |
137 | && !X509_check_private_key(c->pkeys[i].x509, pkey)) | |
138 | return 0; | |
0f113f3e | 139 | |
25aaa98a | 140 | EVP_PKEY_free(c->pkeys[i].privatekey); |
3aeb9348 | 141 | EVP_PKEY_up_ref(pkey); |
0f113f3e | 142 | c->pkeys[i].privatekey = pkey; |
52fd27f9 DSH |
143 | c->key = &c->pkeys[i]; |
144 | return 1; | |
0f113f3e | 145 | } |
d02b48c6 | 146 | |
6b691a5c | 147 | int SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey) |
0f113f3e MC |
148 | { |
149 | int ret; | |
38b051a1 TM |
150 | SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); |
151 | ||
152 | if (sc == NULL) | |
153 | return 0; | |
0f113f3e MC |
154 | |
155 | if (pkey == NULL) { | |
6849b73c | 156 | ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); |
26a7d938 | 157 | return 0; |
0f113f3e | 158 | } |
ee58915c | 159 | ret = ssl_set_pkey(sc->cert, pkey, SSL_CONNECTION_GET_CTX(sc)); |
26a7d938 | 160 | return ret; |
0f113f3e | 161 | } |
d02b48c6 | 162 | |
303c0028 | 163 | int SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type) |
0f113f3e MC |
164 | { |
165 | int j, ret = 0; | |
166 | BIO *in; | |
167 | EVP_PKEY *pkey = NULL; | |
168 | ||
9982cbbb | 169 | in = BIO_new(BIO_s_file()); |
0f113f3e | 170 | if (in == NULL) { |
6849b73c | 171 | ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); |
0f113f3e MC |
172 | goto end; |
173 | } | |
174 | ||
175 | if (BIO_read_filename(in, file) <= 0) { | |
6849b73c | 176 | ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB); |
0f113f3e MC |
177 | goto end; |
178 | } | |
179 | if (type == SSL_FILETYPE_PEM) { | |
38b051a1 TM |
180 | SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); |
181 | ||
182 | if (sc == NULL) | |
183 | goto end; | |
184 | ||
0f113f3e | 185 | j = ERR_R_PEM_LIB; |
d6a2bdf7 | 186 | pkey = PEM_read_bio_PrivateKey_ex(in, NULL, |
38b051a1 TM |
187 | sc->default_passwd_callback, |
188 | sc->default_passwd_callback_userdata, | |
d6a2bdf7 MC |
189 | ssl->ctx->libctx, |
190 | ssl->ctx->propq); | |
0f113f3e MC |
191 | } else if (type == SSL_FILETYPE_ASN1) { |
192 | j = ERR_R_ASN1_LIB; | |
d6a2bdf7 MC |
193 | pkey = d2i_PrivateKey_ex_bio(in, NULL, ssl->ctx->libctx, |
194 | ssl->ctx->propq); | |
0f113f3e | 195 | } else { |
6849b73c | 196 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_SSL_FILETYPE); |
0f113f3e MC |
197 | goto end; |
198 | } | |
199 | if (pkey == NULL) { | |
6849b73c | 200 | ERR_raise(ERR_LIB_SSL, j); |
0f113f3e MC |
201 | goto end; |
202 | } | |
203 | ret = SSL_use_PrivateKey(ssl, pkey); | |
204 | EVP_PKEY_free(pkey); | |
205 | end: | |
ca3a82c3 | 206 | BIO_free(in); |
26a7d938 | 207 | return ret; |
0f113f3e | 208 | } |
d02b48c6 | 209 | |
0f113f3e MC |
210 | int SSL_use_PrivateKey_ASN1(int type, SSL *ssl, const unsigned char *d, |
211 | long len) | |
212 | { | |
213 | int ret; | |
214 | const unsigned char *p; | |
215 | EVP_PKEY *pkey; | |
d02b48c6 | 216 | |
0f113f3e | 217 | p = d; |
d6a2bdf7 MC |
218 | if ((pkey = d2i_PrivateKey_ex(type, NULL, &p, (long)len, ssl->ctx->libctx, |
219 | ssl->ctx->propq)) == NULL) { | |
6849b73c | 220 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
26a7d938 | 221 | return 0; |
0f113f3e | 222 | } |
d02b48c6 | 223 | |
0f113f3e MC |
224 | ret = SSL_use_PrivateKey(ssl, pkey); |
225 | EVP_PKEY_free(pkey); | |
26a7d938 | 226 | return ret; |
0f113f3e | 227 | } |
d02b48c6 | 228 | |
6b691a5c | 229 | int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x) |
0f113f3e MC |
230 | { |
231 | int rv; | |
232 | if (x == NULL) { | |
6849b73c | 233 | ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); |
26a7d938 | 234 | return 0; |
0f113f3e | 235 | } |
6725682d | 236 | |
0f113f3e MC |
237 | rv = ssl_security_cert(NULL, ctx, x, 0, 1); |
238 | if (rv != 1) { | |
6849b73c | 239 | ERR_raise(ERR_LIB_SSL, rv); |
0f113f3e MC |
240 | return 0; |
241 | } | |
ee58915c | 242 | return ssl_set_cert(ctx->cert, x, ctx); |
0f113f3e | 243 | } |
d02b48c6 | 244 | |
ee58915c | 245 | static int ssl_set_cert(CERT *c, X509 *x, SSL_CTX *ctx) |
0f113f3e MC |
246 | { |
247 | EVP_PKEY *pkey; | |
52fd27f9 | 248 | size_t i; |
0f113f3e | 249 | |
8382fd3a | 250 | pkey = X509_get0_pubkey(x); |
0f113f3e | 251 | if (pkey == NULL) { |
6849b73c | 252 | ERR_raise(ERR_LIB_SSL, SSL_R_X509_LIB); |
26a7d938 | 253 | return 0; |
0f113f3e MC |
254 | } |
255 | ||
ee58915c | 256 | if (ssl_cert_lookup_by_pkey(pkey, &i, ctx) == NULL) { |
6849b73c | 257 | ERR_raise(ERR_LIB_SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE); |
8382fd3a | 258 | return 0; |
0f113f3e | 259 | } |
462f4f4b | 260 | |
c2041da8 | 261 | if (i == SSL_PKEY_ECC && !EVP_PKEY_can_sign(pkey)) { |
6849b73c | 262 | ERR_raise(ERR_LIB_SSL, SSL_R_ECC_CERT_NOT_FOR_SIGNING); |
1db3107a DSH |
263 | return 0; |
264 | } | |
462f4f4b | 265 | |
0f113f3e | 266 | if (c->pkeys[i].privatekey != NULL) { |
5f3d93e4 MC |
267 | /* |
268 | * The return code from EVP_PKEY_copy_parameters is deliberately | |
269 | * ignored. Some EVP_PKEY types cannot do this. | |
6d5f636c | 270 | * coverity[check_return] |
5f3d93e4 | 271 | */ |
0f113f3e MC |
272 | EVP_PKEY_copy_parameters(pkey, c->pkeys[i].privatekey); |
273 | ERR_clear_error(); | |
dfeab068 | 274 | |
0f113f3e MC |
275 | if (!X509_check_private_key(x, c->pkeys[i].privatekey)) { |
276 | /* | |
277 | * don't fail for a cert/key mismatch, just free current private | |
278 | * key (when switching to a different cert & key, first this | |
279 | * function should be used, then ssl_set_pkey | |
280 | */ | |
281 | EVP_PKEY_free(c->pkeys[i].privatekey); | |
282 | c->pkeys[i].privatekey = NULL; | |
283 | /* clear error queue */ | |
284 | ERR_clear_error(); | |
285 | } | |
286 | } | |
287 | ||
222561fe | 288 | X509_free(c->pkeys[i].x509); |
05f0fb9f | 289 | X509_up_ref(x); |
0f113f3e MC |
290 | c->pkeys[i].x509 = x; |
291 | c->key = &(c->pkeys[i]); | |
292 | ||
8382fd3a | 293 | return 1; |
0f113f3e | 294 | } |
d02b48c6 | 295 | |
303c0028 | 296 | int SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type) |
0f113f3e | 297 | { |
6725682d | 298 | int j = SSL_R_BAD_VALUE; |
0f113f3e MC |
299 | BIO *in; |
300 | int ret = 0; | |
6725682d | 301 | X509 *x = NULL, *cert = NULL; |
0f113f3e | 302 | |
9982cbbb | 303 | in = BIO_new(BIO_s_file()); |
0f113f3e | 304 | if (in == NULL) { |
6849b73c | 305 | ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); |
0f113f3e MC |
306 | goto end; |
307 | } | |
308 | ||
309 | if (BIO_read_filename(in, file) <= 0) { | |
6849b73c | 310 | ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB); |
0f113f3e MC |
311 | goto end; |
312 | } | |
33ef5fc2 | 313 | |
d8652be0 | 314 | x = X509_new_ex(ctx->libctx, ctx->propq); |
6725682d | 315 | if (x == NULL) { |
e077455e | 316 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
6725682d SL |
317 | goto end; |
318 | } | |
0f113f3e MC |
319 | if (type == SSL_FILETYPE_ASN1) { |
320 | j = ERR_R_ASN1_LIB; | |
6725682d | 321 | cert = d2i_X509_bio(in, &x); |
0f113f3e MC |
322 | } else if (type == SSL_FILETYPE_PEM) { |
323 | j = ERR_R_PEM_LIB; | |
6725682d SL |
324 | cert = PEM_read_bio_X509(in, &x, ctx->default_passwd_callback, |
325 | ctx->default_passwd_callback_userdata); | |
33ef5fc2 | 326 | } else { |
327 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_SSL_FILETYPE); | |
328 | goto end; | |
0f113f3e | 329 | } |
6725682d | 330 | if (cert == NULL) { |
6849b73c | 331 | ERR_raise(ERR_LIB_SSL, j); |
0f113f3e MC |
332 | goto end; |
333 | } | |
334 | ||
335 | ret = SSL_CTX_use_certificate(ctx, x); | |
336 | end: | |
222561fe | 337 | X509_free(x); |
ca3a82c3 | 338 | BIO_free(in); |
26a7d938 | 339 | return ret; |
0f113f3e | 340 | } |
d02b48c6 | 341 | |
a230b26e | 342 | int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, const unsigned char *d) |
0f113f3e MC |
343 | { |
344 | X509 *x; | |
345 | int ret; | |
d02b48c6 | 346 | |
d8652be0 | 347 | x = X509_new_ex(ctx->libctx, ctx->propq); |
0f113f3e | 348 | if (x == NULL) { |
e077455e | 349 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
6725682d SL |
350 | return 0; |
351 | } | |
352 | ||
353 | if (d2i_X509(&x, &d, (long)len) == NULL) { | |
354 | X509_free(x); | |
6849b73c | 355 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
26a7d938 | 356 | return 0; |
0f113f3e | 357 | } |
d02b48c6 | 358 | |
0f113f3e MC |
359 | ret = SSL_CTX_use_certificate(ctx, x); |
360 | X509_free(x); | |
26a7d938 | 361 | return ret; |
0f113f3e | 362 | } |
d02b48c6 | 363 | |
6b691a5c | 364 | int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey) |
0f113f3e MC |
365 | { |
366 | if (pkey == NULL) { | |
6849b73c | 367 | ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); |
26a7d938 | 368 | return 0; |
0f113f3e | 369 | } |
ee58915c | 370 | return ssl_set_pkey(ctx->cert, pkey, ctx); |
0f113f3e | 371 | } |
d02b48c6 | 372 | |
303c0028 | 373 | int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type) |
0f113f3e MC |
374 | { |
375 | int j, ret = 0; | |
376 | BIO *in; | |
377 | EVP_PKEY *pkey = NULL; | |
378 | ||
9982cbbb | 379 | in = BIO_new(BIO_s_file()); |
0f113f3e | 380 | if (in == NULL) { |
6849b73c | 381 | ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); |
0f113f3e MC |
382 | goto end; |
383 | } | |
384 | ||
385 | if (BIO_read_filename(in, file) <= 0) { | |
6849b73c | 386 | ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB); |
0f113f3e MC |
387 | goto end; |
388 | } | |
389 | if (type == SSL_FILETYPE_PEM) { | |
390 | j = ERR_R_PEM_LIB; | |
d6a2bdf7 | 391 | pkey = PEM_read_bio_PrivateKey_ex(in, NULL, |
0f113f3e | 392 | ctx->default_passwd_callback, |
d6a2bdf7 MC |
393 | ctx->default_passwd_callback_userdata, |
394 | ctx->libctx, ctx->propq); | |
0f113f3e MC |
395 | } else if (type == SSL_FILETYPE_ASN1) { |
396 | j = ERR_R_ASN1_LIB; | |
d6a2bdf7 | 397 | pkey = d2i_PrivateKey_ex_bio(in, NULL, ctx->libctx, ctx->propq); |
0f113f3e | 398 | } else { |
6849b73c | 399 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_SSL_FILETYPE); |
0f113f3e MC |
400 | goto end; |
401 | } | |
402 | if (pkey == NULL) { | |
6849b73c | 403 | ERR_raise(ERR_LIB_SSL, j); |
0f113f3e MC |
404 | goto end; |
405 | } | |
406 | ret = SSL_CTX_use_PrivateKey(ctx, pkey); | |
407 | EVP_PKEY_free(pkey); | |
408 | end: | |
ca3a82c3 | 409 | BIO_free(in); |
26a7d938 | 410 | return ret; |
0f113f3e | 411 | } |
d02b48c6 | 412 | |
0f113f3e MC |
413 | int SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx, |
414 | const unsigned char *d, long len) | |
415 | { | |
416 | int ret; | |
417 | const unsigned char *p; | |
418 | EVP_PKEY *pkey; | |
d02b48c6 | 419 | |
0f113f3e | 420 | p = d; |
d6a2bdf7 MC |
421 | if ((pkey = d2i_PrivateKey_ex(type, NULL, &p, (long)len, ctx->libctx, |
422 | ctx->propq)) == NULL) { | |
6849b73c | 423 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
26a7d938 | 424 | return 0; |
0f113f3e | 425 | } |
d02b48c6 | 426 | |
0f113f3e MC |
427 | ret = SSL_CTX_use_PrivateKey(ctx, pkey); |
428 | EVP_PKEY_free(pkey); | |
26a7d938 | 429 | return ret; |
0f113f3e | 430 | } |
d02b48c6 | 431 | |
0f113f3e MC |
432 | /* |
433 | * Read a file that contains our certificate in "PEM" format, possibly | |
434 | * followed by a sequence of CA certificates that should be sent to the peer | |
435 | * in the Certificate message. | |
b3ca645f | 436 | */ |
fae4772c | 437 | static int use_certificate_chain_file(SSL_CTX *ctx, SSL *ssl, const char *file) |
0f113f3e MC |
438 | { |
439 | BIO *in; | |
440 | int ret = 0; | |
441 | X509 *x = NULL; | |
a974e64a MC |
442 | pem_password_cb *passwd_callback; |
443 | void *passwd_callback_userdata; | |
6725682d | 444 | SSL_CTX *real_ctx = (ssl == NULL) ? ctx : ssl->ctx; |
0f113f3e | 445 | |
88ce406c P |
446 | if (ctx == NULL && ssl == NULL) |
447 | return 0; | |
448 | ||
0f113f3e MC |
449 | ERR_clear_error(); /* clear error stack for |
450 | * SSL_CTX_use_certificate() */ | |
451 | ||
a974e64a MC |
452 | if (ctx != NULL) { |
453 | passwd_callback = ctx->default_passwd_callback; | |
454 | passwd_callback_userdata = ctx->default_passwd_callback_userdata; | |
455 | } else { | |
38b051a1 TM |
456 | SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); |
457 | ||
458 | if (sc == NULL) | |
459 | return 0; | |
460 | ||
461 | passwd_callback = sc->default_passwd_callback; | |
462 | passwd_callback_userdata = sc->default_passwd_callback_userdata; | |
a974e64a MC |
463 | } |
464 | ||
9982cbbb | 465 | in = BIO_new(BIO_s_file()); |
0f113f3e | 466 | if (in == NULL) { |
6849b73c | 467 | ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); |
0f113f3e MC |
468 | goto end; |
469 | } | |
470 | ||
471 | if (BIO_read_filename(in, file) <= 0) { | |
6849b73c | 472 | ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB); |
0f113f3e MC |
473 | goto end; |
474 | } | |
475 | ||
d8652be0 | 476 | x = X509_new_ex(real_ctx->libctx, real_ctx->propq); |
0f113f3e | 477 | if (x == NULL) { |
e077455e | 478 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
6725682d SL |
479 | goto end; |
480 | } | |
481 | if (PEM_read_bio_X509_AUX(in, &x, passwd_callback, | |
482 | passwd_callback_userdata) == NULL) { | |
6849b73c | 483 | ERR_raise(ERR_LIB_SSL, ERR_R_PEM_LIB); |
0f113f3e MC |
484 | goto end; |
485 | } | |
486 | ||
fae4772c DSH |
487 | if (ctx) |
488 | ret = SSL_CTX_use_certificate(ctx, x); | |
489 | else | |
490 | ret = SSL_use_certificate(ssl, x); | |
0f113f3e MC |
491 | |
492 | if (ERR_peek_error() != 0) | |
493 | ret = 0; /* Key/certificate mismatch doesn't imply | |
494 | * ret==0 ... */ | |
495 | if (ret) { | |
496 | /* | |
497 | * If we could set up our certificate, now proceed to the CA | |
498 | * certificates. | |
499 | */ | |
500 | X509 *ca; | |
501 | int r; | |
502 | unsigned long err; | |
503 | ||
fae4772c DSH |
504 | if (ctx) |
505 | r = SSL_CTX_clear_chain_certs(ctx); | |
506 | else | |
507 | r = SSL_clear_chain_certs(ssl); | |
508 | ||
509 | if (r == 0) { | |
69f68237 MC |
510 | ret = 0; |
511 | goto end; | |
512 | } | |
0f113f3e | 513 | |
6725682d | 514 | while (1) { |
d8652be0 | 515 | ca = X509_new_ex(real_ctx->libctx, real_ctx->propq); |
6725682d | 516 | if (ca == NULL) { |
e077455e | 517 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
0f113f3e MC |
518 | goto end; |
519 | } | |
6725682d SL |
520 | if (PEM_read_bio_X509(in, &ca, passwd_callback, |
521 | passwd_callback_userdata) != NULL) { | |
522 | if (ctx) | |
523 | r = SSL_CTX_add0_chain_cert(ctx, ca); | |
524 | else | |
525 | r = SSL_add0_chain_cert(ssl, ca); | |
526 | /* | |
527 | * Note that we must not free ca if it was successfully added to | |
528 | * the chain (while we must free the main certificate, since its | |
529 | * reference count is increased by SSL_CTX_use_certificate). | |
530 | */ | |
531 | if (!r) { | |
532 | X509_free(ca); | |
533 | ret = 0; | |
534 | goto end; | |
535 | } | |
536 | } else { | |
537 | X509_free(ca); | |
538 | break; | |
539 | } | |
0f113f3e MC |
540 | } |
541 | /* When the while loop ends, it's usually just EOF. */ | |
542 | err = ERR_peek_last_error(); | |
543 | if (ERR_GET_LIB(err) == ERR_LIB_PEM | |
544 | && ERR_GET_REASON(err) == PEM_R_NO_START_LINE) | |
545 | ERR_clear_error(); | |
546 | else | |
547 | ret = 0; /* some real error */ | |
548 | } | |
549 | ||
550 | end: | |
25aaa98a | 551 | X509_free(x); |
ca3a82c3 | 552 | BIO_free(in); |
26a7d938 | 553 | return ret; |
0f113f3e | 554 | } |
fae4772c DSH |
555 | |
556 | int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file) | |
557 | { | |
558 | return use_certificate_chain_file(ctx, NULL, file); | |
559 | } | |
560 | ||
561 | int SSL_use_certificate_chain_file(SSL *ssl, const char *file) | |
562 | { | |
563 | return use_certificate_chain_file(NULL, ssl, file); | |
564 | } | |
a9e1c50b | 565 | |
a398f821 | 566 | static int serverinfo_find_extension(const unsigned char *serverinfo, |
0f113f3e MC |
567 | size_t serverinfo_length, |
568 | unsigned int extension_type, | |
569 | const unsigned char **extension_data, | |
570 | size_t *extension_length) | |
571 | { | |
84c34ba8 MC |
572 | PACKET pkt, data; |
573 | ||
0f113f3e MC |
574 | *extension_data = NULL; |
575 | *extension_length = 0; | |
576 | if (serverinfo == NULL || serverinfo_length == 0) | |
fae11ec7 | 577 | return -1; |
84c34ba8 MC |
578 | |
579 | if (!PACKET_buf_init(&pkt, serverinfo, serverinfo_length)) | |
580 | return -1; | |
581 | ||
0f113f3e MC |
582 | for (;;) { |
583 | unsigned int type = 0; | |
84c34ba8 | 584 | unsigned long context = 0; |
0f113f3e MC |
585 | |
586 | /* end of serverinfo */ | |
84c34ba8 | 587 | if (PACKET_remaining(&pkt) == 0) |
fae11ec7 | 588 | return 0; /* Extension not found */ |
0f113f3e | 589 | |
84c34ba8 MC |
590 | if (!PACKET_get_net_4(&pkt, &context) |
591 | || !PACKET_get_net_2(&pkt, &type) | |
592 | || !PACKET_get_length_prefixed_2(&pkt, &data)) | |
593 | return -1; | |
0f113f3e MC |
594 | |
595 | if (type == extension_type) { | |
84c34ba8 | 596 | *extension_data = PACKET_data(&data); |
1e331727 | 597 | *extension_length = PACKET_remaining(&data); |
0f113f3e MC |
598 | return 1; /* Success */ |
599 | } | |
0f113f3e | 600 | } |
c6ef15c4 | 601 | /* Unreachable */ |
0f113f3e | 602 | } |
a398f821 | 603 | |
84c34ba8 MC |
604 | static int serverinfoex_srv_parse_cb(SSL *s, unsigned int ext_type, |
605 | unsigned int context, | |
606 | const unsigned char *in, | |
607 | size_t inlen, X509 *x, size_t chainidx, | |
608 | int *al, void *arg) | |
0f113f3e | 609 | { |
0a602875 | 610 | |
0f113f3e MC |
611 | if (inlen != 0) { |
612 | *al = SSL_AD_DECODE_ERROR; | |
613 | return 0; | |
614 | } | |
0a602875 | 615 | |
0f113f3e MC |
616 | return 1; |
617 | } | |
9cd50f73 | 618 | |
84c34ba8 MC |
619 | static int serverinfo_srv_parse_cb(SSL *s, unsigned int ext_type, |
620 | const unsigned char *in, | |
621 | size_t inlen, int *al, void *arg) | |
622 | { | |
623 | return serverinfoex_srv_parse_cb(s, ext_type, 0, in, inlen, NULL, 0, al, | |
624 | arg); | |
625 | } | |
626 | ||
627 | static int serverinfoex_srv_add_cb(SSL *s, unsigned int ext_type, | |
628 | unsigned int context, | |
629 | const unsigned char **out, | |
630 | size_t *outlen, X509 *x, size_t chainidx, | |
631 | int *al, void *arg) | |
0f113f3e MC |
632 | { |
633 | const unsigned char *serverinfo = NULL; | |
634 | size_t serverinfo_length = 0; | |
38b051a1 TM |
635 | SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); |
636 | ||
637 | if (sc == NULL) { | |
638 | *al = SSL_AD_INTERNAL_ERROR; | |
639 | return -1; | |
640 | } | |
0f113f3e | 641 | |
f233a9d1 MC |
642 | /* We only support extensions for the first Certificate */ |
643 | if ((context & SSL_EXT_TLS1_3_CERTIFICATE) != 0 && chainidx > 0) | |
644 | return 0; | |
645 | ||
0f113f3e | 646 | /* Is there serverinfo data for the chosen server cert? */ |
38b051a1 | 647 | if ((ssl_get_server_cert_serverinfo(sc, &serverinfo, |
0f113f3e MC |
648 | &serverinfo_length)) != 0) { |
649 | /* Find the relevant extension from the serverinfo */ | |
650 | int retval = serverinfo_find_extension(serverinfo, serverinfo_length, | |
651 | ext_type, out, outlen); | |
fae11ec7 | 652 | if (retval == -1) { |
fb34a0f4 | 653 | *al = SSL_AD_INTERNAL_ERROR; |
fae11ec7 KR |
654 | return -1; /* Error */ |
655 | } | |
0f113f3e | 656 | if (retval == 0) |
fae11ec7 | 657 | return 0; /* No extension found, don't send extension */ |
0f113f3e MC |
658 | return 1; /* Send extension */ |
659 | } | |
5f18bc58 | 660 | return 0; /* No serverinfo data found, don't send |
0f113f3e MC |
661 | * extension */ |
662 | } | |
663 | ||
84c34ba8 MC |
664 | static int serverinfo_srv_add_cb(SSL *s, unsigned int ext_type, |
665 | const unsigned char **out, size_t *outlen, | |
666 | int *al, void *arg) | |
667 | { | |
668 | return serverinfoex_srv_add_cb(s, ext_type, 0, out, outlen, NULL, 0, al, | |
669 | arg); | |
670 | } | |
671 | ||
0f113f3e MC |
672 | /* |
673 | * With a NULL context, this function just checks that the serverinfo data | |
674 | * parses correctly. With a non-NULL context, it registers callbacks for | |
675 | * the included extensions. | |
676 | */ | |
84c34ba8 MC |
677 | static int serverinfo_process_buffer(unsigned int version, |
678 | const unsigned char *serverinfo, | |
0f113f3e MC |
679 | size_t serverinfo_length, SSL_CTX *ctx) |
680 | { | |
84c34ba8 MC |
681 | PACKET pkt; |
682 | ||
0f113f3e MC |
683 | if (serverinfo == NULL || serverinfo_length == 0) |
684 | return 0; | |
0f113f3e | 685 | |
2698bbfe | 686 | if (version != SSL_SERVERINFOV1 && version != SSL_SERVERINFOV2) |
84c34ba8 | 687 | return 0; |
0f113f3e | 688 | |
84c34ba8 MC |
689 | if (!PACKET_buf_init(&pkt, serverinfo, serverinfo_length)) |
690 | return 0; | |
0f113f3e | 691 | |
84c34ba8 MC |
692 | while (PACKET_remaining(&pkt)) { |
693 | unsigned long context = 0; | |
694 | unsigned int ext_type = 0; | |
695 | PACKET data; | |
0f113f3e | 696 | |
bade29da | 697 | if ((version == SSL_SERVERINFOV2 && !PACKET_get_net_4(&pkt, &context)) |
84c34ba8 MC |
698 | || !PACKET_get_net_2(&pkt, &ext_type) |
699 | || !PACKET_get_length_prefixed_2(&pkt, &data)) | |
0f113f3e MC |
700 | return 0; |
701 | ||
84c34ba8 MC |
702 | if (ctx == NULL) |
703 | continue; | |
704 | ||
bade29da MC |
705 | /* |
706 | * The old style custom extensions API could be set separately for | |
707 | * server/client, i.e. you could set one custom extension for a client, | |
708 | * and *for the same extension in the same SSL_CTX* you could set a | |
709 | * custom extension for the server as well. It seems quite weird to be | |
710 | * setting a custom extension for both client and server in a single | |
711 | * SSL_CTX - but theoretically possible. This isn't possible in the | |
712 | * new API. Therefore, if we have V1 serverinfo we use the old API. We | |
713 | * also use the old API even if we have V2 serverinfo but the context | |
714 | * looks like an old style <= TLSv1.2 extension. | |
715 | */ | |
7a4e6a1e | 716 | if (version == SSL_SERVERINFOV1 || context == SYNTHV1CONTEXT) { |
84c34ba8 MC |
717 | if (!SSL_CTX_add_server_custom_ext(ctx, ext_type, |
718 | serverinfo_srv_add_cb, | |
719 | NULL, NULL, | |
720 | serverinfo_srv_parse_cb, | |
721 | NULL)) | |
722 | return 0; | |
723 | } else { | |
724 | if (!SSL_CTX_add_custom_ext(ctx, ext_type, context, | |
725 | serverinfoex_srv_add_cb, | |
726 | NULL, NULL, | |
727 | serverinfoex_srv_parse_cb, | |
728 | NULL)) | |
729 | return 0; | |
730 | } | |
0f113f3e | 731 | } |
84c34ba8 MC |
732 | |
733 | return 1; | |
0f113f3e | 734 | } |
a398f821 | 735 | |
555dd939 DF |
736 | static size_t extension_contextoff(unsigned int version) |
737 | { | |
738 | return version == SSL_SERVERINFOV1 ? 4 : 0; | |
739 | } | |
740 | ||
741 | static size_t extension_append_length(unsigned int version, size_t extension_length) | |
742 | { | |
743 | return extension_length + extension_contextoff(version); | |
744 | } | |
745 | ||
746 | static void extension_append(unsigned int version, | |
747 | const unsigned char *extension, | |
748 | const size_t extension_length, | |
749 | unsigned char *serverinfo) | |
750 | { | |
751 | const size_t contextoff = extension_contextoff(version); | |
752 | ||
753 | if (contextoff > 0) { | |
754 | /* We know this only uses the last 2 bytes */ | |
755 | serverinfo[0] = 0; | |
756 | serverinfo[1] = 0; | |
757 | serverinfo[2] = (SYNTHV1CONTEXT >> 8) & 0xff; | |
758 | serverinfo[3] = SYNTHV1CONTEXT & 0xff; | |
759 | } | |
760 | ||
761 | memcpy(serverinfo + contextoff, extension, extension_length); | |
762 | } | |
763 | ||
84c34ba8 MC |
764 | int SSL_CTX_use_serverinfo_ex(SSL_CTX *ctx, unsigned int version, |
765 | const unsigned char *serverinfo, | |
766 | size_t serverinfo_length) | |
0f113f3e | 767 | { |
555dd939 | 768 | unsigned char *new_serverinfo = NULL; |
0f113f3e MC |
769 | |
770 | if (ctx == NULL || serverinfo == NULL || serverinfo_length == 0) { | |
6849b73c | 771 | ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); |
0f113f3e MC |
772 | return 0; |
773 | } | |
555dd939 DF |
774 | if (version == SSL_SERVERINFOV1) { |
775 | /* | |
776 | * Convert serverinfo version v1 to v2 and call yourself recursively | |
777 | * over the converted serverinfo. | |
778 | */ | |
779 | const size_t sinfo_length = extension_append_length(SSL_SERVERINFOV1, | |
780 | serverinfo_length); | |
781 | unsigned char *sinfo; | |
782 | int ret; | |
783 | ||
784 | sinfo = OPENSSL_malloc(sinfo_length); | |
e077455e | 785 | if (sinfo == NULL) |
555dd939 | 786 | return 0; |
555dd939 DF |
787 | |
788 | extension_append(SSL_SERVERINFOV1, serverinfo, serverinfo_length, sinfo); | |
789 | ||
790 | ret = SSL_CTX_use_serverinfo_ex(ctx, SSL_SERVERINFOV2, sinfo, | |
791 | sinfo_length); | |
792 | ||
793 | OPENSSL_free(sinfo); | |
794 | return ret; | |
795 | } | |
84c34ba8 MC |
796 | if (!serverinfo_process_buffer(version, serverinfo, serverinfo_length, |
797 | NULL)) { | |
6849b73c | 798 | ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_SERVERINFO_DATA); |
0f113f3e MC |
799 | return 0; |
800 | } | |
0f113f3e | 801 | if (ctx->cert->key == NULL) { |
6849b73c | 802 | ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR); |
0f113f3e MC |
803 | return 0; |
804 | } | |
805 | new_serverinfo = OPENSSL_realloc(ctx->cert->key->serverinfo, | |
806 | serverinfo_length); | |
e077455e | 807 | if (new_serverinfo == NULL) |
0f113f3e | 808 | return 0; |
0f113f3e MC |
809 | ctx->cert->key->serverinfo = new_serverinfo; |
810 | memcpy(ctx->cert->key->serverinfo, serverinfo, serverinfo_length); | |
811 | ctx->cert->key->serverinfo_length = serverinfo_length; | |
812 | ||
813 | /* | |
814 | * Now that the serverinfo is validated and stored, go ahead and | |
815 | * register callbacks. | |
816 | */ | |
84c34ba8 MC |
817 | if (!serverinfo_process_buffer(version, serverinfo, serverinfo_length, |
818 | ctx)) { | |
6849b73c | 819 | ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_SERVERINFO_DATA); |
0f113f3e MC |
820 | return 0; |
821 | } | |
822 | return 1; | |
823 | } | |
824 | ||
84c34ba8 MC |
825 | int SSL_CTX_use_serverinfo(SSL_CTX *ctx, const unsigned char *serverinfo, |
826 | size_t serverinfo_length) | |
827 | { | |
2698bbfe | 828 | return SSL_CTX_use_serverinfo_ex(ctx, SSL_SERVERINFOV1, serverinfo, |
84c34ba8 MC |
829 | serverinfo_length); |
830 | } | |
831 | ||
a398f821 | 832 | int SSL_CTX_use_serverinfo_file(SSL_CTX *ctx, const char *file) |
0f113f3e MC |
833 | { |
834 | unsigned char *serverinfo = NULL; | |
7c0ef843 | 835 | unsigned char *tmp; |
0f113f3e MC |
836 | size_t serverinfo_length = 0; |
837 | unsigned char *extension = 0; | |
838 | long extension_length = 0; | |
839 | char *name = NULL; | |
840 | char *header = NULL; | |
4bac25e1 | 841 | unsigned int name_len; |
0f113f3e MC |
842 | int ret = 0; |
843 | BIO *bin = NULL; | |
555dd939 | 844 | size_t num_extensions = 0; |
0f113f3e MC |
845 | |
846 | if (ctx == NULL || file == NULL) { | |
6849b73c | 847 | ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); |
0f113f3e MC |
848 | goto end; |
849 | } | |
850 | ||
9982cbbb | 851 | bin = BIO_new(BIO_s_file()); |
0f113f3e | 852 | if (bin == NULL) { |
6849b73c | 853 | ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); |
0f113f3e MC |
854 | goto end; |
855 | } | |
856 | if (BIO_read_filename(bin, file) <= 0) { | |
6849b73c | 857 | ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB); |
0f113f3e MC |
858 | goto end; |
859 | } | |
860 | ||
861 | for (num_extensions = 0;; num_extensions++) { | |
7a4e6a1e | 862 | unsigned int version; |
555dd939 | 863 | size_t append_length; |
7a4e6a1e | 864 | |
0f113f3e MC |
865 | if (PEM_read_bio(bin, &name, &header, &extension, &extension_length) |
866 | == 0) { | |
867 | /* | |
868 | * There must be at least one extension in this file | |
869 | */ | |
870 | if (num_extensions == 0) { | |
6849b73c | 871 | ERR_raise(ERR_LIB_SSL, SSL_R_NO_PEM_EXTENSIONS); |
0f113f3e MC |
872 | goto end; |
873 | } else /* End of file, we're done */ | |
874 | break; | |
875 | } | |
876 | /* Check that PEM name starts with "BEGIN SERVERINFO FOR " */ | |
4bac25e1 | 877 | name_len = strlen(name); |
2ff286c2 | 878 | if (name_len < sizeof(NAME_PREFIX1) - 1) { |
6849b73c | 879 | ERR_raise(ERR_LIB_SSL, SSL_R_PEM_NAME_TOO_SHORT); |
0f113f3e MC |
880 | goto end; |
881 | } | |
2ff286c2 | 882 | if (HAS_PREFIX(name, NAME_PREFIX1)) { |
2698bbfe | 883 | version = SSL_SERVERINFOV1; |
84c34ba8 | 884 | } else { |
2ff286c2 | 885 | if (name_len < sizeof(NAME_PREFIX2) - 1) { |
6849b73c | 886 | ERR_raise(ERR_LIB_SSL, SSL_R_PEM_NAME_TOO_SHORT); |
84c34ba8 MC |
887 | goto end; |
888 | } | |
2ff286c2 | 889 | if (!HAS_PREFIX(name, NAME_PREFIX2)) { |
6849b73c | 890 | ERR_raise(ERR_LIB_SSL, SSL_R_PEM_NAME_BAD_PREFIX); |
84c34ba8 MC |
891 | goto end; |
892 | } | |
2698bbfe | 893 | version = SSL_SERVERINFOV2; |
0f113f3e MC |
894 | } |
895 | /* | |
896 | * Check that the decoded PEM data is plausible (valid length field) | |
897 | */ | |
2698bbfe | 898 | if (version == SSL_SERVERINFOV1) { |
84c34ba8 MC |
899 | /* 4 byte header: 2 bytes type, 2 bytes len */ |
900 | if (extension_length < 4 | |
901 | || (extension[2] << 8) + extension[3] | |
902 | != extension_length - 4) { | |
6849b73c | 903 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_DATA); |
84c34ba8 MC |
904 | goto end; |
905 | } | |
84c34ba8 MC |
906 | } else { |
907 | /* 8 byte header: 4 bytes context, 2 bytes type, 2 bytes len */ | |
908 | if (extension_length < 8 | |
909 | || (extension[6] << 8) + extension[7] | |
910 | != extension_length - 8) { | |
6849b73c | 911 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_DATA); |
84c34ba8 MC |
912 | goto end; |
913 | } | |
0f113f3e MC |
914 | } |
915 | /* Append the decoded extension to the serverinfo buffer */ | |
555dd939 DF |
916 | append_length = extension_append_length(version, extension_length); |
917 | tmp = OPENSSL_realloc(serverinfo, serverinfo_length + append_length); | |
e077455e | 918 | if (tmp == NULL) |
0f113f3e | 919 | goto end; |
7c0ef843 | 920 | serverinfo = tmp; |
555dd939 DF |
921 | extension_append(version, extension, extension_length, |
922 | serverinfo + serverinfo_length); | |
923 | serverinfo_length += append_length; | |
0f113f3e MC |
924 | |
925 | OPENSSL_free(name); | |
926 | name = NULL; | |
927 | OPENSSL_free(header); | |
928 | header = NULL; | |
929 | OPENSSL_free(extension); | |
930 | extension = NULL; | |
931 | } | |
932 | ||
bade29da | 933 | ret = SSL_CTX_use_serverinfo_ex(ctx, SSL_SERVERINFOV2, serverinfo, |
bb78552e | 934 | serverinfo_length); |
0f113f3e MC |
935 | end: |
936 | /* SSL_CTX_use_serverinfo makes a local copy of the serverinfo. */ | |
937 | OPENSSL_free(name); | |
938 | OPENSSL_free(header); | |
939 | OPENSSL_free(extension); | |
940 | OPENSSL_free(serverinfo); | |
ca3a82c3 | 941 | BIO_free(bin); |
0f113f3e MC |
942 | return ret; |
943 | } | |
37933acb TS |
944 | |
945 | static int ssl_set_cert_and_key(SSL *ssl, SSL_CTX *ctx, X509 *x509, EVP_PKEY *privatekey, | |
946 | STACK_OF(X509) *chain, int override) | |
947 | { | |
948 | int ret = 0; | |
949 | size_t i; | |
950 | int j; | |
951 | int rv; | |
38b051a1 | 952 | CERT *c; |
37933acb TS |
953 | STACK_OF(X509) *dup_chain = NULL; |
954 | EVP_PKEY *pubkey = NULL; | |
38b051a1 TM |
955 | SSL_CONNECTION *sc = NULL; |
956 | ||
957 | if (ctx == NULL && | |
958 | (sc = SSL_CONNECTION_FROM_SSL(ssl)) == NULL) | |
959 | return 0; | |
37933acb | 960 | |
38b051a1 | 961 | c = sc != NULL ? sc->cert : ctx->cert; |
37933acb | 962 | /* Do all security checks before anything else */ |
38b051a1 | 963 | rv = ssl_security_cert(sc, ctx, x509, 0, 1); |
37933acb | 964 | if (rv != 1) { |
6849b73c | 965 | ERR_raise(ERR_LIB_SSL, rv); |
37933acb TS |
966 | goto out; |
967 | } | |
968 | for (j = 0; j < sk_X509_num(chain); j++) { | |
38b051a1 | 969 | rv = ssl_security_cert(sc, ctx, sk_X509_value(chain, j), 0, 0); |
37933acb | 970 | if (rv != 1) { |
6849b73c | 971 | ERR_raise(ERR_LIB_SSL, rv); |
37933acb TS |
972 | goto out; |
973 | } | |
974 | } | |
975 | ||
976 | pubkey = X509_get_pubkey(x509); /* bumps reference */ | |
977 | if (pubkey == NULL) | |
978 | goto out; | |
979 | if (privatekey == NULL) { | |
980 | privatekey = pubkey; | |
981 | } else { | |
982 | /* For RSA, which has no parameters, missing returns 0 */ | |
983 | if (EVP_PKEY_missing_parameters(privatekey)) { | |
984 | if (EVP_PKEY_missing_parameters(pubkey)) { | |
985 | /* nobody has parameters? - error */ | |
6849b73c | 986 | ERR_raise(ERR_LIB_SSL, SSL_R_MISSING_PARAMETERS); |
37933acb TS |
987 | goto out; |
988 | } else { | |
989 | /* copy to privatekey from pubkey */ | |
6646e015 ZQ |
990 | if (!EVP_PKEY_copy_parameters(privatekey, pubkey)) { |
991 | ERR_raise(ERR_LIB_SSL, SSL_R_COPY_PARAMETERS_FAILED); | |
992 | goto out; | |
993 | } | |
37933acb TS |
994 | } |
995 | } else if (EVP_PKEY_missing_parameters(pubkey)) { | |
996 | /* copy to pubkey from privatekey */ | |
6646e015 ZQ |
997 | if (!EVP_PKEY_copy_parameters(pubkey, privatekey)) { |
998 | ERR_raise(ERR_LIB_SSL, SSL_R_COPY_PARAMETERS_FAILED); | |
999 | goto out; | |
1000 | } | |
37933acb TS |
1001 | } /* else both have parameters */ |
1002 | ||
37933acb | 1003 | /* check that key <-> cert match */ |
c74aaa39 | 1004 | if (EVP_PKEY_eq(pubkey, privatekey) != 1) { |
6849b73c | 1005 | ERR_raise(ERR_LIB_SSL, SSL_R_PRIVATE_KEY_MISMATCH); |
37933acb TS |
1006 | goto out; |
1007 | } | |
1008 | } | |
ee58915c | 1009 | if (ssl_cert_lookup_by_pkey(pubkey, &i, ctx) == NULL) { |
6849b73c | 1010 | ERR_raise(ERR_LIB_SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE); |
37933acb TS |
1011 | goto out; |
1012 | } | |
1013 | ||
1014 | if (!override && (c->pkeys[i].x509 != NULL | |
1015 | || c->pkeys[i].privatekey != NULL | |
1016 | || c->pkeys[i].chain != NULL)) { | |
1017 | /* No override, and something already there */ | |
6849b73c | 1018 | ERR_raise(ERR_LIB_SSL, SSL_R_NOT_REPLACING_CERTIFICATE); |
37933acb TS |
1019 | goto out; |
1020 | } | |
1021 | ||
1022 | if (chain != NULL) { | |
1023 | dup_chain = X509_chain_up_ref(chain); | |
1024 | if (dup_chain == NULL) { | |
e077455e | 1025 | ERR_raise(ERR_LIB_SSL, ERR_R_X509_LIB); |
37933acb TS |
1026 | goto out; |
1027 | } | |
1028 | } | |
1029 | ||
79b2a2f2 | 1030 | OSSL_STACK_OF_X509_free(c->pkeys[i].chain); |
37933acb TS |
1031 | c->pkeys[i].chain = dup_chain; |
1032 | ||
1033 | X509_free(c->pkeys[i].x509); | |
1034 | X509_up_ref(x509); | |
1035 | c->pkeys[i].x509 = x509; | |
1036 | ||
1037 | EVP_PKEY_free(c->pkeys[i].privatekey); | |
1038 | EVP_PKEY_up_ref(privatekey); | |
1039 | c->pkeys[i].privatekey = privatekey; | |
1040 | ||
1041 | c->key = &(c->pkeys[i]); | |
1042 | ||
1043 | ret = 1; | |
1044 | out: | |
1045 | EVP_PKEY_free(pubkey); | |
1046 | return ret; | |
1047 | } | |
1048 | ||
1049 | int SSL_use_cert_and_key(SSL *ssl, X509 *x509, EVP_PKEY *privatekey, | |
1050 | STACK_OF(X509) *chain, int override) | |
1051 | { | |
1052 | return ssl_set_cert_and_key(ssl, NULL, x509, privatekey, chain, override); | |
1053 | } | |
1054 | ||
1055 | int SSL_CTX_use_cert_and_key(SSL_CTX *ctx, X509 *x509, EVP_PKEY *privatekey, | |
1056 | STACK_OF(X509) *chain, int override) | |
1057 | { | |
1058 | return ssl_set_cert_and_key(NULL, ctx, x509, privatekey, chain, override); | |
1059 | } |