]>
Commit | Line | Data |
---|---|---|
846e33c7 | 1 | /* |
fecb3aae | 2 | * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. |
d02b48c6 | 3 | * |
2c18d164 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
846e33c7 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
d02b48c6 RE |
8 | */ |
9 | ||
10 | #include <stdio.h> | |
706457b7 | 11 | #include "ssl_local.h" |
0d345f0e | 12 | #include "internal/packet.h" |
ec577822 BM |
13 | #include <openssl/bio.h> |
14 | #include <openssl/objects.h> | |
15 | #include <openssl/evp.h> | |
16 | #include <openssl/x509.h> | |
9f0f53b7 | 17 | #include <openssl/x509v3.h> |
ec577822 | 18 | #include <openssl/pem.h> |
d02b48c6 | 19 | |
ee58915c MB |
20 | static int ssl_set_cert(CERT *c, X509 *x509, SSL_CTX *ctx); |
21 | static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey, SSL_CTX *ctx); | |
bade29da | 22 | |
7a4e6a1e MC |
23 | #define SYNTHV1CONTEXT (SSL_EXT_TLS1_2_AND_BELOW_ONLY \ |
24 | | SSL_EXT_CLIENT_HELLO \ | |
25 | | SSL_EXT_TLS1_2_SERVER_HELLO \ | |
26 | | SSL_EXT_IGNORE_ON_RESUMPTION) | |
bade29da | 27 | |
2ff286c2 DDO |
28 | #define NAME_PREFIX1 "SERVERINFO FOR " |
29 | #define NAME_PREFIX2 "SERVERINFOV2 FOR " | |
30 | ||
6b691a5c | 31 | int SSL_use_certificate(SSL *ssl, X509 *x) |
0f113f3e MC |
32 | { |
33 | int rv; | |
38b051a1 TM |
34 | SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); |
35 | ||
36 | if (sc == NULL) | |
37 | return 0; | |
38 | ||
0f113f3e | 39 | if (x == NULL) { |
6849b73c | 40 | ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); |
26a7d938 | 41 | return 0; |
0f113f3e | 42 | } |
6725682d | 43 | |
38b051a1 | 44 | rv = ssl_security_cert(sc, NULL, x, 0, 1); |
0f113f3e | 45 | if (rv != 1) { |
6849b73c | 46 | ERR_raise(ERR_LIB_SSL, rv); |
0f113f3e MC |
47 | return 0; |
48 | } | |
49 | ||
ee58915c | 50 | return ssl_set_cert(sc->cert, x, SSL_CONNECTION_GET_CTX(sc)); |
0f113f3e | 51 | } |
d02b48c6 | 52 | |
303c0028 | 53 | int SSL_use_certificate_file(SSL *ssl, const char *file, int type) |
0f113f3e MC |
54 | { |
55 | int j; | |
56 | BIO *in; | |
57 | int ret = 0; | |
6725682d | 58 | X509 *cert = NULL, *x = NULL; |
0f113f3e | 59 | |
9982cbbb | 60 | in = BIO_new(BIO_s_file()); |
0f113f3e | 61 | if (in == NULL) { |
6849b73c | 62 | ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); |
0f113f3e MC |
63 | goto end; |
64 | } | |
65 | ||
66 | if (BIO_read_filename(in, file) <= 0) { | |
6849b73c | 67 | ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB); |
0f113f3e MC |
68 | goto end; |
69 | } | |
6725682d SL |
70 | |
71 | if (type != SSL_FILETYPE_ASN1 && type != SSL_FILETYPE_PEM) { | |
6849b73c | 72 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_SSL_FILETYPE); |
6725682d SL |
73 | goto end; |
74 | } | |
d8652be0 | 75 | x = X509_new_ex(ssl->ctx->libctx, ssl->ctx->propq); |
6725682d | 76 | if (x == NULL) { |
e077455e | 77 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
6725682d SL |
78 | goto end; |
79 | } | |
0f113f3e MC |
80 | if (type == SSL_FILETYPE_ASN1) { |
81 | j = ERR_R_ASN1_LIB; | |
6725682d | 82 | cert = d2i_X509_bio(in, &x); |
0f113f3e | 83 | } else if (type == SSL_FILETYPE_PEM) { |
38b051a1 TM |
84 | SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); |
85 | ||
86 | if (sc == NULL) | |
87 | goto end; | |
88 | ||
0f113f3e | 89 | j = ERR_R_PEM_LIB; |
38b051a1 TM |
90 | cert = PEM_read_bio_X509(in, &x, sc->default_passwd_callback, |
91 | sc->default_passwd_callback_userdata); | |
0f113f3e | 92 | } else { |
6849b73c | 93 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_SSL_FILETYPE); |
0f113f3e MC |
94 | goto end; |
95 | } | |
96 | ||
6725682d | 97 | if (cert == NULL) { |
6849b73c | 98 | ERR_raise(ERR_LIB_SSL, j); |
0f113f3e MC |
99 | goto end; |
100 | } | |
101 | ||
102 | ret = SSL_use_certificate(ssl, x); | |
103 | end: | |
222561fe | 104 | X509_free(x); |
ca3a82c3 | 105 | BIO_free(in); |
26a7d938 | 106 | return ret; |
0f113f3e | 107 | } |
d02b48c6 | 108 | |
875a644a | 109 | int SSL_use_certificate_ASN1(SSL *ssl, const unsigned char *d, int len) |
0f113f3e MC |
110 | { |
111 | X509 *x; | |
112 | int ret; | |
113 | ||
d8652be0 | 114 | x = X509_new_ex(ssl->ctx->libctx, ssl->ctx->propq); |
0f113f3e | 115 | if (x == NULL) { |
e077455e | 116 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
6725682d SL |
117 | return 0; |
118 | } | |
119 | ||
120 | if (d2i_X509(&x, &d, (long)len)== NULL) { | |
121 | X509_free(x); | |
6849b73c | 122 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
26a7d938 | 123 | return 0; |
0f113f3e MC |
124 | } |
125 | ||
126 | ret = SSL_use_certificate(ssl, x); | |
127 | X509_free(x); | |
26a7d938 | 128 | return ret; |
0f113f3e | 129 | } |
d02b48c6 | 130 | |
ee58915c | 131 | static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey, SSL_CTX *ctx) |
0f113f3e | 132 | { |
52fd27f9 DSH |
133 | size_t i; |
134 | ||
ee58915c | 135 | if (ssl_cert_lookup_by_pkey(pkey, &i, ctx) == NULL) { |
6849b73c | 136 | ERR_raise(ERR_LIB_SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE); |
26a7d938 | 137 | return 0; |
0f113f3e MC |
138 | } |
139 | ||
fc52ae8c MC |
140 | if (c->pkeys[i].x509 != NULL |
141 | && !X509_check_private_key(c->pkeys[i].x509, pkey)) | |
142 | return 0; | |
0f113f3e | 143 | |
25aaa98a | 144 | EVP_PKEY_free(c->pkeys[i].privatekey); |
3aeb9348 | 145 | EVP_PKEY_up_ref(pkey); |
0f113f3e | 146 | c->pkeys[i].privatekey = pkey; |
52fd27f9 DSH |
147 | c->key = &c->pkeys[i]; |
148 | return 1; | |
0f113f3e | 149 | } |
d02b48c6 | 150 | |
6b691a5c | 151 | int SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey) |
0f113f3e MC |
152 | { |
153 | int ret; | |
38b051a1 TM |
154 | SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); |
155 | ||
156 | if (sc == NULL) | |
157 | return 0; | |
0f113f3e MC |
158 | |
159 | if (pkey == NULL) { | |
6849b73c | 160 | ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); |
26a7d938 | 161 | return 0; |
0f113f3e | 162 | } |
ee58915c | 163 | ret = ssl_set_pkey(sc->cert, pkey, SSL_CONNECTION_GET_CTX(sc)); |
26a7d938 | 164 | return ret; |
0f113f3e | 165 | } |
d02b48c6 | 166 | |
303c0028 | 167 | int SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type) |
0f113f3e MC |
168 | { |
169 | int j, ret = 0; | |
170 | BIO *in; | |
171 | EVP_PKEY *pkey = NULL; | |
172 | ||
9982cbbb | 173 | in = BIO_new(BIO_s_file()); |
0f113f3e | 174 | if (in == NULL) { |
6849b73c | 175 | ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); |
0f113f3e MC |
176 | goto end; |
177 | } | |
178 | ||
179 | if (BIO_read_filename(in, file) <= 0) { | |
6849b73c | 180 | ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB); |
0f113f3e MC |
181 | goto end; |
182 | } | |
183 | if (type == SSL_FILETYPE_PEM) { | |
38b051a1 TM |
184 | SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); |
185 | ||
186 | if (sc == NULL) | |
187 | goto end; | |
188 | ||
0f113f3e | 189 | j = ERR_R_PEM_LIB; |
d6a2bdf7 | 190 | pkey = PEM_read_bio_PrivateKey_ex(in, NULL, |
38b051a1 TM |
191 | sc->default_passwd_callback, |
192 | sc->default_passwd_callback_userdata, | |
d6a2bdf7 MC |
193 | ssl->ctx->libctx, |
194 | ssl->ctx->propq); | |
0f113f3e MC |
195 | } else if (type == SSL_FILETYPE_ASN1) { |
196 | j = ERR_R_ASN1_LIB; | |
d6a2bdf7 MC |
197 | pkey = d2i_PrivateKey_ex_bio(in, NULL, ssl->ctx->libctx, |
198 | ssl->ctx->propq); | |
0f113f3e | 199 | } else { |
6849b73c | 200 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_SSL_FILETYPE); |
0f113f3e MC |
201 | goto end; |
202 | } | |
203 | if (pkey == NULL) { | |
6849b73c | 204 | ERR_raise(ERR_LIB_SSL, j); |
0f113f3e MC |
205 | goto end; |
206 | } | |
207 | ret = SSL_use_PrivateKey(ssl, pkey); | |
208 | EVP_PKEY_free(pkey); | |
209 | end: | |
ca3a82c3 | 210 | BIO_free(in); |
26a7d938 | 211 | return ret; |
0f113f3e | 212 | } |
d02b48c6 | 213 | |
0f113f3e MC |
214 | int SSL_use_PrivateKey_ASN1(int type, SSL *ssl, const unsigned char *d, |
215 | long len) | |
216 | { | |
217 | int ret; | |
218 | const unsigned char *p; | |
219 | EVP_PKEY *pkey; | |
d02b48c6 | 220 | |
0f113f3e | 221 | p = d; |
d6a2bdf7 MC |
222 | if ((pkey = d2i_PrivateKey_ex(type, NULL, &p, (long)len, ssl->ctx->libctx, |
223 | ssl->ctx->propq)) == NULL) { | |
6849b73c | 224 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
26a7d938 | 225 | return 0; |
0f113f3e | 226 | } |
d02b48c6 | 227 | |
0f113f3e MC |
228 | ret = SSL_use_PrivateKey(ssl, pkey); |
229 | EVP_PKEY_free(pkey); | |
26a7d938 | 230 | return ret; |
0f113f3e | 231 | } |
d02b48c6 | 232 | |
6b691a5c | 233 | int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x) |
0f113f3e MC |
234 | { |
235 | int rv; | |
236 | if (x == NULL) { | |
6849b73c | 237 | ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); |
26a7d938 | 238 | return 0; |
0f113f3e | 239 | } |
6725682d | 240 | |
0f113f3e MC |
241 | rv = ssl_security_cert(NULL, ctx, x, 0, 1); |
242 | if (rv != 1) { | |
6849b73c | 243 | ERR_raise(ERR_LIB_SSL, rv); |
0f113f3e MC |
244 | return 0; |
245 | } | |
ee58915c | 246 | return ssl_set_cert(ctx->cert, x, ctx); |
0f113f3e | 247 | } |
d02b48c6 | 248 | |
ee58915c | 249 | static int ssl_set_cert(CERT *c, X509 *x, SSL_CTX *ctx) |
0f113f3e MC |
250 | { |
251 | EVP_PKEY *pkey; | |
52fd27f9 | 252 | size_t i; |
0f113f3e | 253 | |
8382fd3a | 254 | pkey = X509_get0_pubkey(x); |
0f113f3e | 255 | if (pkey == NULL) { |
6849b73c | 256 | ERR_raise(ERR_LIB_SSL, SSL_R_X509_LIB); |
26a7d938 | 257 | return 0; |
0f113f3e MC |
258 | } |
259 | ||
ee58915c | 260 | if (ssl_cert_lookup_by_pkey(pkey, &i, ctx) == NULL) { |
6849b73c | 261 | ERR_raise(ERR_LIB_SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE); |
8382fd3a | 262 | return 0; |
0f113f3e | 263 | } |
462f4f4b | 264 | |
c2041da8 | 265 | if (i == SSL_PKEY_ECC && !EVP_PKEY_can_sign(pkey)) { |
6849b73c | 266 | ERR_raise(ERR_LIB_SSL, SSL_R_ECC_CERT_NOT_FOR_SIGNING); |
1db3107a DSH |
267 | return 0; |
268 | } | |
462f4f4b | 269 | |
0f113f3e | 270 | if (c->pkeys[i].privatekey != NULL) { |
5f3d93e4 MC |
271 | /* |
272 | * The return code from EVP_PKEY_copy_parameters is deliberately | |
273 | * ignored. Some EVP_PKEY types cannot do this. | |
6d5f636c | 274 | * coverity[check_return] |
5f3d93e4 | 275 | */ |
0f113f3e MC |
276 | EVP_PKEY_copy_parameters(pkey, c->pkeys[i].privatekey); |
277 | ERR_clear_error(); | |
dfeab068 | 278 | |
0f113f3e MC |
279 | if (!X509_check_private_key(x, c->pkeys[i].privatekey)) { |
280 | /* | |
281 | * don't fail for a cert/key mismatch, just free current private | |
282 | * key (when switching to a different cert & key, first this | |
283 | * function should be used, then ssl_set_pkey | |
284 | */ | |
285 | EVP_PKEY_free(c->pkeys[i].privatekey); | |
286 | c->pkeys[i].privatekey = NULL; | |
287 | /* clear error queue */ | |
288 | ERR_clear_error(); | |
289 | } | |
290 | } | |
291 | ||
222561fe | 292 | X509_free(c->pkeys[i].x509); |
05f0fb9f | 293 | X509_up_ref(x); |
0f113f3e MC |
294 | c->pkeys[i].x509 = x; |
295 | c->key = &(c->pkeys[i]); | |
296 | ||
8382fd3a | 297 | return 1; |
0f113f3e | 298 | } |
d02b48c6 | 299 | |
303c0028 | 300 | int SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type) |
0f113f3e | 301 | { |
6725682d | 302 | int j = SSL_R_BAD_VALUE; |
0f113f3e MC |
303 | BIO *in; |
304 | int ret = 0; | |
6725682d | 305 | X509 *x = NULL, *cert = NULL; |
0f113f3e | 306 | |
9982cbbb | 307 | in = BIO_new(BIO_s_file()); |
0f113f3e | 308 | if (in == NULL) { |
6849b73c | 309 | ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); |
0f113f3e MC |
310 | goto end; |
311 | } | |
312 | ||
313 | if (BIO_read_filename(in, file) <= 0) { | |
6849b73c | 314 | ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB); |
0f113f3e MC |
315 | goto end; |
316 | } | |
6725682d | 317 | if (type != SSL_FILETYPE_ASN1 && type != SSL_FILETYPE_PEM) { |
6849b73c | 318 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_SSL_FILETYPE); |
6725682d SL |
319 | goto end; |
320 | } | |
d8652be0 | 321 | x = X509_new_ex(ctx->libctx, ctx->propq); |
6725682d | 322 | if (x == NULL) { |
e077455e | 323 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
6725682d SL |
324 | goto end; |
325 | } | |
0f113f3e MC |
326 | if (type == SSL_FILETYPE_ASN1) { |
327 | j = ERR_R_ASN1_LIB; | |
6725682d | 328 | cert = d2i_X509_bio(in, &x); |
0f113f3e MC |
329 | } else if (type == SSL_FILETYPE_PEM) { |
330 | j = ERR_R_PEM_LIB; | |
6725682d SL |
331 | cert = PEM_read_bio_X509(in, &x, ctx->default_passwd_callback, |
332 | ctx->default_passwd_callback_userdata); | |
0f113f3e | 333 | } |
6725682d | 334 | if (cert == NULL) { |
6849b73c | 335 | ERR_raise(ERR_LIB_SSL, j); |
0f113f3e MC |
336 | goto end; |
337 | } | |
338 | ||
339 | ret = SSL_CTX_use_certificate(ctx, x); | |
340 | end: | |
222561fe | 341 | X509_free(x); |
ca3a82c3 | 342 | BIO_free(in); |
26a7d938 | 343 | return ret; |
0f113f3e | 344 | } |
d02b48c6 | 345 | |
a230b26e | 346 | int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, const unsigned char *d) |
0f113f3e MC |
347 | { |
348 | X509 *x; | |
349 | int ret; | |
d02b48c6 | 350 | |
d8652be0 | 351 | x = X509_new_ex(ctx->libctx, ctx->propq); |
0f113f3e | 352 | if (x == NULL) { |
e077455e | 353 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
6725682d SL |
354 | return 0; |
355 | } | |
356 | ||
357 | if (d2i_X509(&x, &d, (long)len) == NULL) { | |
358 | X509_free(x); | |
6849b73c | 359 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
26a7d938 | 360 | return 0; |
0f113f3e | 361 | } |
d02b48c6 | 362 | |
0f113f3e MC |
363 | ret = SSL_CTX_use_certificate(ctx, x); |
364 | X509_free(x); | |
26a7d938 | 365 | return ret; |
0f113f3e | 366 | } |
d02b48c6 | 367 | |
6b691a5c | 368 | int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey) |
0f113f3e MC |
369 | { |
370 | if (pkey == NULL) { | |
6849b73c | 371 | ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); |
26a7d938 | 372 | return 0; |
0f113f3e | 373 | } |
ee58915c | 374 | return ssl_set_pkey(ctx->cert, pkey, ctx); |
0f113f3e | 375 | } |
d02b48c6 | 376 | |
303c0028 | 377 | int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type) |
0f113f3e MC |
378 | { |
379 | int j, ret = 0; | |
380 | BIO *in; | |
381 | EVP_PKEY *pkey = NULL; | |
382 | ||
9982cbbb | 383 | in = BIO_new(BIO_s_file()); |
0f113f3e | 384 | if (in == NULL) { |
6849b73c | 385 | ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); |
0f113f3e MC |
386 | goto end; |
387 | } | |
388 | ||
389 | if (BIO_read_filename(in, file) <= 0) { | |
6849b73c | 390 | ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB); |
0f113f3e MC |
391 | goto end; |
392 | } | |
393 | if (type == SSL_FILETYPE_PEM) { | |
394 | j = ERR_R_PEM_LIB; | |
d6a2bdf7 | 395 | pkey = PEM_read_bio_PrivateKey_ex(in, NULL, |
0f113f3e | 396 | ctx->default_passwd_callback, |
d6a2bdf7 MC |
397 | ctx->default_passwd_callback_userdata, |
398 | ctx->libctx, ctx->propq); | |
0f113f3e MC |
399 | } else if (type == SSL_FILETYPE_ASN1) { |
400 | j = ERR_R_ASN1_LIB; | |
d6a2bdf7 | 401 | pkey = d2i_PrivateKey_ex_bio(in, NULL, ctx->libctx, ctx->propq); |
0f113f3e | 402 | } else { |
6849b73c | 403 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_SSL_FILETYPE); |
0f113f3e MC |
404 | goto end; |
405 | } | |
406 | if (pkey == NULL) { | |
6849b73c | 407 | ERR_raise(ERR_LIB_SSL, j); |
0f113f3e MC |
408 | goto end; |
409 | } | |
410 | ret = SSL_CTX_use_PrivateKey(ctx, pkey); | |
411 | EVP_PKEY_free(pkey); | |
412 | end: | |
ca3a82c3 | 413 | BIO_free(in); |
26a7d938 | 414 | return ret; |
0f113f3e | 415 | } |
d02b48c6 | 416 | |
0f113f3e MC |
417 | int SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx, |
418 | const unsigned char *d, long len) | |
419 | { | |
420 | int ret; | |
421 | const unsigned char *p; | |
422 | EVP_PKEY *pkey; | |
d02b48c6 | 423 | |
0f113f3e | 424 | p = d; |
d6a2bdf7 MC |
425 | if ((pkey = d2i_PrivateKey_ex(type, NULL, &p, (long)len, ctx->libctx, |
426 | ctx->propq)) == NULL) { | |
6849b73c | 427 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
26a7d938 | 428 | return 0; |
0f113f3e | 429 | } |
d02b48c6 | 430 | |
0f113f3e MC |
431 | ret = SSL_CTX_use_PrivateKey(ctx, pkey); |
432 | EVP_PKEY_free(pkey); | |
26a7d938 | 433 | return ret; |
0f113f3e | 434 | } |
d02b48c6 | 435 | |
0f113f3e MC |
436 | /* |
437 | * Read a file that contains our certificate in "PEM" format, possibly | |
438 | * followed by a sequence of CA certificates that should be sent to the peer | |
439 | * in the Certificate message. | |
b3ca645f | 440 | */ |
fae4772c | 441 | static int use_certificate_chain_file(SSL_CTX *ctx, SSL *ssl, const char *file) |
0f113f3e MC |
442 | { |
443 | BIO *in; | |
444 | int ret = 0; | |
445 | X509 *x = NULL; | |
a974e64a MC |
446 | pem_password_cb *passwd_callback; |
447 | void *passwd_callback_userdata; | |
6725682d | 448 | SSL_CTX *real_ctx = (ssl == NULL) ? ctx : ssl->ctx; |
0f113f3e | 449 | |
88ce406c P |
450 | if (ctx == NULL && ssl == NULL) |
451 | return 0; | |
452 | ||
0f113f3e MC |
453 | ERR_clear_error(); /* clear error stack for |
454 | * SSL_CTX_use_certificate() */ | |
455 | ||
a974e64a MC |
456 | if (ctx != NULL) { |
457 | passwd_callback = ctx->default_passwd_callback; | |
458 | passwd_callback_userdata = ctx->default_passwd_callback_userdata; | |
459 | } else { | |
38b051a1 TM |
460 | SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); |
461 | ||
462 | if (sc == NULL) | |
463 | return 0; | |
464 | ||
465 | passwd_callback = sc->default_passwd_callback; | |
466 | passwd_callback_userdata = sc->default_passwd_callback_userdata; | |
a974e64a MC |
467 | } |
468 | ||
9982cbbb | 469 | in = BIO_new(BIO_s_file()); |
0f113f3e | 470 | if (in == NULL) { |
6849b73c | 471 | ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); |
0f113f3e MC |
472 | goto end; |
473 | } | |
474 | ||
475 | if (BIO_read_filename(in, file) <= 0) { | |
6849b73c | 476 | ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB); |
0f113f3e MC |
477 | goto end; |
478 | } | |
479 | ||
d8652be0 | 480 | x = X509_new_ex(real_ctx->libctx, real_ctx->propq); |
0f113f3e | 481 | if (x == NULL) { |
e077455e | 482 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
6725682d SL |
483 | goto end; |
484 | } | |
485 | if (PEM_read_bio_X509_AUX(in, &x, passwd_callback, | |
486 | passwd_callback_userdata) == NULL) { | |
6849b73c | 487 | ERR_raise(ERR_LIB_SSL, ERR_R_PEM_LIB); |
0f113f3e MC |
488 | goto end; |
489 | } | |
490 | ||
fae4772c DSH |
491 | if (ctx) |
492 | ret = SSL_CTX_use_certificate(ctx, x); | |
493 | else | |
494 | ret = SSL_use_certificate(ssl, x); | |
0f113f3e MC |
495 | |
496 | if (ERR_peek_error() != 0) | |
497 | ret = 0; /* Key/certificate mismatch doesn't imply | |
498 | * ret==0 ... */ | |
499 | if (ret) { | |
500 | /* | |
501 | * If we could set up our certificate, now proceed to the CA | |
502 | * certificates. | |
503 | */ | |
504 | X509 *ca; | |
505 | int r; | |
506 | unsigned long err; | |
507 | ||
fae4772c DSH |
508 | if (ctx) |
509 | r = SSL_CTX_clear_chain_certs(ctx); | |
510 | else | |
511 | r = SSL_clear_chain_certs(ssl); | |
512 | ||
513 | if (r == 0) { | |
69f68237 MC |
514 | ret = 0; |
515 | goto end; | |
516 | } | |
0f113f3e | 517 | |
6725682d | 518 | while (1) { |
d8652be0 | 519 | ca = X509_new_ex(real_ctx->libctx, real_ctx->propq); |
6725682d | 520 | if (ca == NULL) { |
e077455e | 521 | ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); |
0f113f3e MC |
522 | goto end; |
523 | } | |
6725682d SL |
524 | if (PEM_read_bio_X509(in, &ca, passwd_callback, |
525 | passwd_callback_userdata) != NULL) { | |
526 | if (ctx) | |
527 | r = SSL_CTX_add0_chain_cert(ctx, ca); | |
528 | else | |
529 | r = SSL_add0_chain_cert(ssl, ca); | |
530 | /* | |
531 | * Note that we must not free ca if it was successfully added to | |
532 | * the chain (while we must free the main certificate, since its | |
533 | * reference count is increased by SSL_CTX_use_certificate). | |
534 | */ | |
535 | if (!r) { | |
536 | X509_free(ca); | |
537 | ret = 0; | |
538 | goto end; | |
539 | } | |
540 | } else { | |
541 | X509_free(ca); | |
542 | break; | |
543 | } | |
0f113f3e MC |
544 | } |
545 | /* When the while loop ends, it's usually just EOF. */ | |
546 | err = ERR_peek_last_error(); | |
547 | if (ERR_GET_LIB(err) == ERR_LIB_PEM | |
548 | && ERR_GET_REASON(err) == PEM_R_NO_START_LINE) | |
549 | ERR_clear_error(); | |
550 | else | |
551 | ret = 0; /* some real error */ | |
552 | } | |
553 | ||
554 | end: | |
25aaa98a | 555 | X509_free(x); |
ca3a82c3 | 556 | BIO_free(in); |
26a7d938 | 557 | return ret; |
0f113f3e | 558 | } |
fae4772c DSH |
559 | |
560 | int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file) | |
561 | { | |
562 | return use_certificate_chain_file(ctx, NULL, file); | |
563 | } | |
564 | ||
565 | int SSL_use_certificate_chain_file(SSL *ssl, const char *file) | |
566 | { | |
567 | return use_certificate_chain_file(NULL, ssl, file); | |
568 | } | |
a9e1c50b | 569 | |
a398f821 | 570 | static int serverinfo_find_extension(const unsigned char *serverinfo, |
0f113f3e MC |
571 | size_t serverinfo_length, |
572 | unsigned int extension_type, | |
573 | const unsigned char **extension_data, | |
574 | size_t *extension_length) | |
575 | { | |
84c34ba8 MC |
576 | PACKET pkt, data; |
577 | ||
0f113f3e MC |
578 | *extension_data = NULL; |
579 | *extension_length = 0; | |
580 | if (serverinfo == NULL || serverinfo_length == 0) | |
fae11ec7 | 581 | return -1; |
84c34ba8 MC |
582 | |
583 | if (!PACKET_buf_init(&pkt, serverinfo, serverinfo_length)) | |
584 | return -1; | |
585 | ||
0f113f3e MC |
586 | for (;;) { |
587 | unsigned int type = 0; | |
84c34ba8 | 588 | unsigned long context = 0; |
0f113f3e MC |
589 | |
590 | /* end of serverinfo */ | |
84c34ba8 | 591 | if (PACKET_remaining(&pkt) == 0) |
fae11ec7 | 592 | return 0; /* Extension not found */ |
0f113f3e | 593 | |
84c34ba8 MC |
594 | if (!PACKET_get_net_4(&pkt, &context) |
595 | || !PACKET_get_net_2(&pkt, &type) | |
596 | || !PACKET_get_length_prefixed_2(&pkt, &data)) | |
597 | return -1; | |
0f113f3e MC |
598 | |
599 | if (type == extension_type) { | |
84c34ba8 | 600 | *extension_data = PACKET_data(&data); |
1e331727 | 601 | *extension_length = PACKET_remaining(&data); |
0f113f3e MC |
602 | return 1; /* Success */ |
603 | } | |
0f113f3e | 604 | } |
c6ef15c4 | 605 | /* Unreachable */ |
0f113f3e | 606 | } |
a398f821 | 607 | |
84c34ba8 MC |
608 | static int serverinfoex_srv_parse_cb(SSL *s, unsigned int ext_type, |
609 | unsigned int context, | |
610 | const unsigned char *in, | |
611 | size_t inlen, X509 *x, size_t chainidx, | |
612 | int *al, void *arg) | |
0f113f3e | 613 | { |
0a602875 | 614 | |
0f113f3e MC |
615 | if (inlen != 0) { |
616 | *al = SSL_AD_DECODE_ERROR; | |
617 | return 0; | |
618 | } | |
0a602875 | 619 | |
0f113f3e MC |
620 | return 1; |
621 | } | |
9cd50f73 | 622 | |
84c34ba8 MC |
623 | static int serverinfo_srv_parse_cb(SSL *s, unsigned int ext_type, |
624 | const unsigned char *in, | |
625 | size_t inlen, int *al, void *arg) | |
626 | { | |
627 | return serverinfoex_srv_parse_cb(s, ext_type, 0, in, inlen, NULL, 0, al, | |
628 | arg); | |
629 | } | |
630 | ||
631 | static int serverinfoex_srv_add_cb(SSL *s, unsigned int ext_type, | |
632 | unsigned int context, | |
633 | const unsigned char **out, | |
634 | size_t *outlen, X509 *x, size_t chainidx, | |
635 | int *al, void *arg) | |
0f113f3e MC |
636 | { |
637 | const unsigned char *serverinfo = NULL; | |
638 | size_t serverinfo_length = 0; | |
38b051a1 TM |
639 | SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); |
640 | ||
641 | if (sc == NULL) { | |
642 | *al = SSL_AD_INTERNAL_ERROR; | |
643 | return -1; | |
644 | } | |
0f113f3e | 645 | |
f233a9d1 MC |
646 | /* We only support extensions for the first Certificate */ |
647 | if ((context & SSL_EXT_TLS1_3_CERTIFICATE) != 0 && chainidx > 0) | |
648 | return 0; | |
649 | ||
0f113f3e | 650 | /* Is there serverinfo data for the chosen server cert? */ |
38b051a1 | 651 | if ((ssl_get_server_cert_serverinfo(sc, &serverinfo, |
0f113f3e MC |
652 | &serverinfo_length)) != 0) { |
653 | /* Find the relevant extension from the serverinfo */ | |
654 | int retval = serverinfo_find_extension(serverinfo, serverinfo_length, | |
655 | ext_type, out, outlen); | |
fae11ec7 | 656 | if (retval == -1) { |
fb34a0f4 | 657 | *al = SSL_AD_INTERNAL_ERROR; |
fae11ec7 KR |
658 | return -1; /* Error */ |
659 | } | |
0f113f3e | 660 | if (retval == 0) |
fae11ec7 | 661 | return 0; /* No extension found, don't send extension */ |
0f113f3e MC |
662 | return 1; /* Send extension */ |
663 | } | |
5f18bc58 | 664 | return 0; /* No serverinfo data found, don't send |
0f113f3e MC |
665 | * extension */ |
666 | } | |
667 | ||
84c34ba8 MC |
668 | static int serverinfo_srv_add_cb(SSL *s, unsigned int ext_type, |
669 | const unsigned char **out, size_t *outlen, | |
670 | int *al, void *arg) | |
671 | { | |
672 | return serverinfoex_srv_add_cb(s, ext_type, 0, out, outlen, NULL, 0, al, | |
673 | arg); | |
674 | } | |
675 | ||
0f113f3e MC |
676 | /* |
677 | * With a NULL context, this function just checks that the serverinfo data | |
678 | * parses correctly. With a non-NULL context, it registers callbacks for | |
679 | * the included extensions. | |
680 | */ | |
84c34ba8 MC |
681 | static int serverinfo_process_buffer(unsigned int version, |
682 | const unsigned char *serverinfo, | |
0f113f3e MC |
683 | size_t serverinfo_length, SSL_CTX *ctx) |
684 | { | |
84c34ba8 MC |
685 | PACKET pkt; |
686 | ||
0f113f3e MC |
687 | if (serverinfo == NULL || serverinfo_length == 0) |
688 | return 0; | |
0f113f3e | 689 | |
2698bbfe | 690 | if (version != SSL_SERVERINFOV1 && version != SSL_SERVERINFOV2) |
84c34ba8 | 691 | return 0; |
0f113f3e | 692 | |
84c34ba8 MC |
693 | if (!PACKET_buf_init(&pkt, serverinfo, serverinfo_length)) |
694 | return 0; | |
0f113f3e | 695 | |
84c34ba8 MC |
696 | while (PACKET_remaining(&pkt)) { |
697 | unsigned long context = 0; | |
698 | unsigned int ext_type = 0; | |
699 | PACKET data; | |
0f113f3e | 700 | |
bade29da | 701 | if ((version == SSL_SERVERINFOV2 && !PACKET_get_net_4(&pkt, &context)) |
84c34ba8 MC |
702 | || !PACKET_get_net_2(&pkt, &ext_type) |
703 | || !PACKET_get_length_prefixed_2(&pkt, &data)) | |
0f113f3e MC |
704 | return 0; |
705 | ||
84c34ba8 MC |
706 | if (ctx == NULL) |
707 | continue; | |
708 | ||
bade29da MC |
709 | /* |
710 | * The old style custom extensions API could be set separately for | |
711 | * server/client, i.e. you could set one custom extension for a client, | |
712 | * and *for the same extension in the same SSL_CTX* you could set a | |
713 | * custom extension for the server as well. It seems quite weird to be | |
714 | * setting a custom extension for both client and server in a single | |
715 | * SSL_CTX - but theoretically possible. This isn't possible in the | |
716 | * new API. Therefore, if we have V1 serverinfo we use the old API. We | |
717 | * also use the old API even if we have V2 serverinfo but the context | |
718 | * looks like an old style <= TLSv1.2 extension. | |
719 | */ | |
7a4e6a1e | 720 | if (version == SSL_SERVERINFOV1 || context == SYNTHV1CONTEXT) { |
84c34ba8 MC |
721 | if (!SSL_CTX_add_server_custom_ext(ctx, ext_type, |
722 | serverinfo_srv_add_cb, | |
723 | NULL, NULL, | |
724 | serverinfo_srv_parse_cb, | |
725 | NULL)) | |
726 | return 0; | |
727 | } else { | |
728 | if (!SSL_CTX_add_custom_ext(ctx, ext_type, context, | |
729 | serverinfoex_srv_add_cb, | |
730 | NULL, NULL, | |
731 | serverinfoex_srv_parse_cb, | |
732 | NULL)) | |
733 | return 0; | |
734 | } | |
0f113f3e | 735 | } |
84c34ba8 MC |
736 | |
737 | return 1; | |
0f113f3e | 738 | } |
a398f821 | 739 | |
555dd939 DF |
740 | static size_t extension_contextoff(unsigned int version) |
741 | { | |
742 | return version == SSL_SERVERINFOV1 ? 4 : 0; | |
743 | } | |
744 | ||
745 | static size_t extension_append_length(unsigned int version, size_t extension_length) | |
746 | { | |
747 | return extension_length + extension_contextoff(version); | |
748 | } | |
749 | ||
750 | static void extension_append(unsigned int version, | |
751 | const unsigned char *extension, | |
752 | const size_t extension_length, | |
753 | unsigned char *serverinfo) | |
754 | { | |
755 | const size_t contextoff = extension_contextoff(version); | |
756 | ||
757 | if (contextoff > 0) { | |
758 | /* We know this only uses the last 2 bytes */ | |
759 | serverinfo[0] = 0; | |
760 | serverinfo[1] = 0; | |
761 | serverinfo[2] = (SYNTHV1CONTEXT >> 8) & 0xff; | |
762 | serverinfo[3] = SYNTHV1CONTEXT & 0xff; | |
763 | } | |
764 | ||
765 | memcpy(serverinfo + contextoff, extension, extension_length); | |
766 | } | |
767 | ||
84c34ba8 MC |
768 | int SSL_CTX_use_serverinfo_ex(SSL_CTX *ctx, unsigned int version, |
769 | const unsigned char *serverinfo, | |
770 | size_t serverinfo_length) | |
0f113f3e | 771 | { |
555dd939 | 772 | unsigned char *new_serverinfo = NULL; |
0f113f3e MC |
773 | |
774 | if (ctx == NULL || serverinfo == NULL || serverinfo_length == 0) { | |
6849b73c | 775 | ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); |
0f113f3e MC |
776 | return 0; |
777 | } | |
555dd939 DF |
778 | if (version == SSL_SERVERINFOV1) { |
779 | /* | |
780 | * Convert serverinfo version v1 to v2 and call yourself recursively | |
781 | * over the converted serverinfo. | |
782 | */ | |
783 | const size_t sinfo_length = extension_append_length(SSL_SERVERINFOV1, | |
784 | serverinfo_length); | |
785 | unsigned char *sinfo; | |
786 | int ret; | |
787 | ||
788 | sinfo = OPENSSL_malloc(sinfo_length); | |
e077455e | 789 | if (sinfo == NULL) |
555dd939 | 790 | return 0; |
555dd939 DF |
791 | |
792 | extension_append(SSL_SERVERINFOV1, serverinfo, serverinfo_length, sinfo); | |
793 | ||
794 | ret = SSL_CTX_use_serverinfo_ex(ctx, SSL_SERVERINFOV2, sinfo, | |
795 | sinfo_length); | |
796 | ||
797 | OPENSSL_free(sinfo); | |
798 | return ret; | |
799 | } | |
84c34ba8 MC |
800 | if (!serverinfo_process_buffer(version, serverinfo, serverinfo_length, |
801 | NULL)) { | |
6849b73c | 802 | ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_SERVERINFO_DATA); |
0f113f3e MC |
803 | return 0; |
804 | } | |
0f113f3e | 805 | if (ctx->cert->key == NULL) { |
6849b73c | 806 | ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR); |
0f113f3e MC |
807 | return 0; |
808 | } | |
809 | new_serverinfo = OPENSSL_realloc(ctx->cert->key->serverinfo, | |
810 | serverinfo_length); | |
e077455e | 811 | if (new_serverinfo == NULL) |
0f113f3e | 812 | return 0; |
0f113f3e MC |
813 | ctx->cert->key->serverinfo = new_serverinfo; |
814 | memcpy(ctx->cert->key->serverinfo, serverinfo, serverinfo_length); | |
815 | ctx->cert->key->serverinfo_length = serverinfo_length; | |
816 | ||
817 | /* | |
818 | * Now that the serverinfo is validated and stored, go ahead and | |
819 | * register callbacks. | |
820 | */ | |
84c34ba8 MC |
821 | if (!serverinfo_process_buffer(version, serverinfo, serverinfo_length, |
822 | ctx)) { | |
6849b73c | 823 | ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_SERVERINFO_DATA); |
0f113f3e MC |
824 | return 0; |
825 | } | |
826 | return 1; | |
827 | } | |
828 | ||
84c34ba8 MC |
829 | int SSL_CTX_use_serverinfo(SSL_CTX *ctx, const unsigned char *serverinfo, |
830 | size_t serverinfo_length) | |
831 | { | |
2698bbfe | 832 | return SSL_CTX_use_serverinfo_ex(ctx, SSL_SERVERINFOV1, serverinfo, |
84c34ba8 MC |
833 | serverinfo_length); |
834 | } | |
835 | ||
a398f821 | 836 | int SSL_CTX_use_serverinfo_file(SSL_CTX *ctx, const char *file) |
0f113f3e MC |
837 | { |
838 | unsigned char *serverinfo = NULL; | |
7c0ef843 | 839 | unsigned char *tmp; |
0f113f3e MC |
840 | size_t serverinfo_length = 0; |
841 | unsigned char *extension = 0; | |
842 | long extension_length = 0; | |
843 | char *name = NULL; | |
844 | char *header = NULL; | |
4bac25e1 | 845 | unsigned int name_len; |
0f113f3e MC |
846 | int ret = 0; |
847 | BIO *bin = NULL; | |
555dd939 | 848 | size_t num_extensions = 0; |
0f113f3e MC |
849 | |
850 | if (ctx == NULL || file == NULL) { | |
6849b73c | 851 | ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); |
0f113f3e MC |
852 | goto end; |
853 | } | |
854 | ||
9982cbbb | 855 | bin = BIO_new(BIO_s_file()); |
0f113f3e | 856 | if (bin == NULL) { |
6849b73c | 857 | ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); |
0f113f3e MC |
858 | goto end; |
859 | } | |
860 | if (BIO_read_filename(bin, file) <= 0) { | |
6849b73c | 861 | ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB); |
0f113f3e MC |
862 | goto end; |
863 | } | |
864 | ||
865 | for (num_extensions = 0;; num_extensions++) { | |
7a4e6a1e | 866 | unsigned int version; |
555dd939 | 867 | size_t append_length; |
7a4e6a1e | 868 | |
0f113f3e MC |
869 | if (PEM_read_bio(bin, &name, &header, &extension, &extension_length) |
870 | == 0) { | |
871 | /* | |
872 | * There must be at least one extension in this file | |
873 | */ | |
874 | if (num_extensions == 0) { | |
6849b73c | 875 | ERR_raise(ERR_LIB_SSL, SSL_R_NO_PEM_EXTENSIONS); |
0f113f3e MC |
876 | goto end; |
877 | } else /* End of file, we're done */ | |
878 | break; | |
879 | } | |
880 | /* Check that PEM name starts with "BEGIN SERVERINFO FOR " */ | |
4bac25e1 | 881 | name_len = strlen(name); |
2ff286c2 | 882 | if (name_len < sizeof(NAME_PREFIX1) - 1) { |
6849b73c | 883 | ERR_raise(ERR_LIB_SSL, SSL_R_PEM_NAME_TOO_SHORT); |
0f113f3e MC |
884 | goto end; |
885 | } | |
2ff286c2 | 886 | if (HAS_PREFIX(name, NAME_PREFIX1)) { |
2698bbfe | 887 | version = SSL_SERVERINFOV1; |
84c34ba8 | 888 | } else { |
2ff286c2 | 889 | if (name_len < sizeof(NAME_PREFIX2) - 1) { |
6849b73c | 890 | ERR_raise(ERR_LIB_SSL, SSL_R_PEM_NAME_TOO_SHORT); |
84c34ba8 MC |
891 | goto end; |
892 | } | |
2ff286c2 | 893 | if (!HAS_PREFIX(name, NAME_PREFIX2)) { |
6849b73c | 894 | ERR_raise(ERR_LIB_SSL, SSL_R_PEM_NAME_BAD_PREFIX); |
84c34ba8 MC |
895 | goto end; |
896 | } | |
2698bbfe | 897 | version = SSL_SERVERINFOV2; |
0f113f3e MC |
898 | } |
899 | /* | |
900 | * Check that the decoded PEM data is plausible (valid length field) | |
901 | */ | |
2698bbfe | 902 | if (version == SSL_SERVERINFOV1) { |
84c34ba8 MC |
903 | /* 4 byte header: 2 bytes type, 2 bytes len */ |
904 | if (extension_length < 4 | |
905 | || (extension[2] << 8) + extension[3] | |
906 | != extension_length - 4) { | |
6849b73c | 907 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_DATA); |
84c34ba8 MC |
908 | goto end; |
909 | } | |
84c34ba8 MC |
910 | } else { |
911 | /* 8 byte header: 4 bytes context, 2 bytes type, 2 bytes len */ | |
912 | if (extension_length < 8 | |
913 | || (extension[6] << 8) + extension[7] | |
914 | != extension_length - 8) { | |
6849b73c | 915 | ERR_raise(ERR_LIB_SSL, SSL_R_BAD_DATA); |
84c34ba8 MC |
916 | goto end; |
917 | } | |
0f113f3e MC |
918 | } |
919 | /* Append the decoded extension to the serverinfo buffer */ | |
555dd939 DF |
920 | append_length = extension_append_length(version, extension_length); |
921 | tmp = OPENSSL_realloc(serverinfo, serverinfo_length + append_length); | |
e077455e | 922 | if (tmp == NULL) |
0f113f3e | 923 | goto end; |
7c0ef843 | 924 | serverinfo = tmp; |
555dd939 DF |
925 | extension_append(version, extension, extension_length, |
926 | serverinfo + serverinfo_length); | |
927 | serverinfo_length += append_length; | |
0f113f3e MC |
928 | |
929 | OPENSSL_free(name); | |
930 | name = NULL; | |
931 | OPENSSL_free(header); | |
932 | header = NULL; | |
933 | OPENSSL_free(extension); | |
934 | extension = NULL; | |
935 | } | |
936 | ||
bade29da | 937 | ret = SSL_CTX_use_serverinfo_ex(ctx, SSL_SERVERINFOV2, serverinfo, |
bb78552e | 938 | serverinfo_length); |
0f113f3e MC |
939 | end: |
940 | /* SSL_CTX_use_serverinfo makes a local copy of the serverinfo. */ | |
941 | OPENSSL_free(name); | |
942 | OPENSSL_free(header); | |
943 | OPENSSL_free(extension); | |
944 | OPENSSL_free(serverinfo); | |
ca3a82c3 | 945 | BIO_free(bin); |
0f113f3e MC |
946 | return ret; |
947 | } | |
37933acb TS |
948 | |
949 | static int ssl_set_cert_and_key(SSL *ssl, SSL_CTX *ctx, X509 *x509, EVP_PKEY *privatekey, | |
950 | STACK_OF(X509) *chain, int override) | |
951 | { | |
952 | int ret = 0; | |
953 | size_t i; | |
954 | int j; | |
955 | int rv; | |
38b051a1 | 956 | CERT *c; |
37933acb TS |
957 | STACK_OF(X509) *dup_chain = NULL; |
958 | EVP_PKEY *pubkey = NULL; | |
38b051a1 TM |
959 | SSL_CONNECTION *sc = NULL; |
960 | ||
961 | if (ctx == NULL && | |
962 | (sc = SSL_CONNECTION_FROM_SSL(ssl)) == NULL) | |
963 | return 0; | |
37933acb | 964 | |
38b051a1 | 965 | c = sc != NULL ? sc->cert : ctx->cert; |
37933acb | 966 | /* Do all security checks before anything else */ |
38b051a1 | 967 | rv = ssl_security_cert(sc, ctx, x509, 0, 1); |
37933acb | 968 | if (rv != 1) { |
6849b73c | 969 | ERR_raise(ERR_LIB_SSL, rv); |
37933acb TS |
970 | goto out; |
971 | } | |
972 | for (j = 0; j < sk_X509_num(chain); j++) { | |
38b051a1 | 973 | rv = ssl_security_cert(sc, ctx, sk_X509_value(chain, j), 0, 0); |
37933acb | 974 | if (rv != 1) { |
6849b73c | 975 | ERR_raise(ERR_LIB_SSL, rv); |
37933acb TS |
976 | goto out; |
977 | } | |
978 | } | |
979 | ||
980 | pubkey = X509_get_pubkey(x509); /* bumps reference */ | |
981 | if (pubkey == NULL) | |
982 | goto out; | |
983 | if (privatekey == NULL) { | |
984 | privatekey = pubkey; | |
985 | } else { | |
986 | /* For RSA, which has no parameters, missing returns 0 */ | |
987 | if (EVP_PKEY_missing_parameters(privatekey)) { | |
988 | if (EVP_PKEY_missing_parameters(pubkey)) { | |
989 | /* nobody has parameters? - error */ | |
6849b73c | 990 | ERR_raise(ERR_LIB_SSL, SSL_R_MISSING_PARAMETERS); |
37933acb TS |
991 | goto out; |
992 | } else { | |
993 | /* copy to privatekey from pubkey */ | |
6646e015 ZQ |
994 | if (!EVP_PKEY_copy_parameters(privatekey, pubkey)) { |
995 | ERR_raise(ERR_LIB_SSL, SSL_R_COPY_PARAMETERS_FAILED); | |
996 | goto out; | |
997 | } | |
37933acb TS |
998 | } |
999 | } else if (EVP_PKEY_missing_parameters(pubkey)) { | |
1000 | /* copy to pubkey from privatekey */ | |
6646e015 ZQ |
1001 | if (!EVP_PKEY_copy_parameters(pubkey, privatekey)) { |
1002 | ERR_raise(ERR_LIB_SSL, SSL_R_COPY_PARAMETERS_FAILED); | |
1003 | goto out; | |
1004 | } | |
37933acb TS |
1005 | } /* else both have parameters */ |
1006 | ||
37933acb | 1007 | /* check that key <-> cert match */ |
c74aaa39 | 1008 | if (EVP_PKEY_eq(pubkey, privatekey) != 1) { |
6849b73c | 1009 | ERR_raise(ERR_LIB_SSL, SSL_R_PRIVATE_KEY_MISMATCH); |
37933acb TS |
1010 | goto out; |
1011 | } | |
1012 | } | |
ee58915c | 1013 | if (ssl_cert_lookup_by_pkey(pubkey, &i, ctx) == NULL) { |
6849b73c | 1014 | ERR_raise(ERR_LIB_SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE); |
37933acb TS |
1015 | goto out; |
1016 | } | |
1017 | ||
1018 | if (!override && (c->pkeys[i].x509 != NULL | |
1019 | || c->pkeys[i].privatekey != NULL | |
1020 | || c->pkeys[i].chain != NULL)) { | |
1021 | /* No override, and something already there */ | |
6849b73c | 1022 | ERR_raise(ERR_LIB_SSL, SSL_R_NOT_REPLACING_CERTIFICATE); |
37933acb TS |
1023 | goto out; |
1024 | } | |
1025 | ||
1026 | if (chain != NULL) { | |
1027 | dup_chain = X509_chain_up_ref(chain); | |
1028 | if (dup_chain == NULL) { | |
e077455e | 1029 | ERR_raise(ERR_LIB_SSL, ERR_R_X509_LIB); |
37933acb TS |
1030 | goto out; |
1031 | } | |
1032 | } | |
1033 | ||
79b2a2f2 | 1034 | OSSL_STACK_OF_X509_free(c->pkeys[i].chain); |
37933acb TS |
1035 | c->pkeys[i].chain = dup_chain; |
1036 | ||
1037 | X509_free(c->pkeys[i].x509); | |
1038 | X509_up_ref(x509); | |
1039 | c->pkeys[i].x509 = x509; | |
1040 | ||
1041 | EVP_PKEY_free(c->pkeys[i].privatekey); | |
1042 | EVP_PKEY_up_ref(privatekey); | |
1043 | c->pkeys[i].privatekey = privatekey; | |
1044 | ||
1045 | c->key = &(c->pkeys[i]); | |
1046 | ||
1047 | ret = 1; | |
1048 | out: | |
1049 | EVP_PKEY_free(pubkey); | |
1050 | return ret; | |
1051 | } | |
1052 | ||
1053 | int SSL_use_cert_and_key(SSL *ssl, X509 *x509, EVP_PKEY *privatekey, | |
1054 | STACK_OF(X509) *chain, int override) | |
1055 | { | |
1056 | return ssl_set_cert_and_key(ssl, NULL, x509, privatekey, chain, override); | |
1057 | } | |
1058 | ||
1059 | int SSL_CTX_use_cert_and_key(SSL_CTX *ctx, X509 *x509, EVP_PKEY *privatekey, | |
1060 | STACK_OF(X509) *chain, int override) | |
1061 | { | |
1062 | return ssl_set_cert_and_key(NULL, ctx, x509, privatekey, chain, override); | |
1063 | } |