1 /*
2 * Copyright 1999-2021 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 #include <stdio.h>
11 #include "internal/cryptlib.h"
12 #include <openssl/pkcs12.h>
13 #include "p12_local.h"
14
15 #ifndef OPENSSL_NO_DEPRECATED_1_1_0
PKCS12_get_attr(const PKCS12_SAFEBAG * bag,int attr_nid)16 ASN1_TYPE *PKCS12_get_attr(const PKCS12_SAFEBAG *bag, int attr_nid)
17 {
18 return PKCS12_get_attr_gen(bag->attrib, attr_nid);
19 }
20 #endif
21
PKCS12_SAFEBAG_get0_attr(const PKCS12_SAFEBAG * bag,int attr_nid)22 const ASN1_TYPE *PKCS12_SAFEBAG_get0_attr(const PKCS12_SAFEBAG *bag,
23 int attr_nid)
24 {
25 return PKCS12_get_attr_gen(bag->attrib, attr_nid);
26 }
27
PKCS8_get_attr(PKCS8_PRIV_KEY_INFO * p8,int attr_nid)28 ASN1_TYPE *PKCS8_get_attr(PKCS8_PRIV_KEY_INFO *p8, int attr_nid)
29 {
30 return PKCS12_get_attr_gen(PKCS8_pkey_get0_attrs(p8), attr_nid);
31 }
32
PKCS12_SAFEBAG_get0_p8inf(const PKCS12_SAFEBAG * bag)33 const PKCS8_PRIV_KEY_INFO *PKCS12_SAFEBAG_get0_p8inf(const PKCS12_SAFEBAG *bag)
34 {
35 if (PKCS12_SAFEBAG_get_nid(bag) != NID_keyBag)
36 return NULL;
37 return bag->value.keybag;
38 }
39
PKCS12_SAFEBAG_get0_pkcs8(const PKCS12_SAFEBAG * bag)40 const X509_SIG *PKCS12_SAFEBAG_get0_pkcs8(const PKCS12_SAFEBAG *bag)
41 {
42 if (OBJ_obj2nid(bag->type) != NID_pkcs8ShroudedKeyBag)
43 return NULL;
44 return bag->value.shkeybag;
45 }
46
STACK_OF(PKCS12_SAFEBAG)47 const STACK_OF(PKCS12_SAFEBAG) *
48 PKCS12_SAFEBAG_get0_safes(const PKCS12_SAFEBAG *bag)
49 {
50 if (OBJ_obj2nid(bag->type) != NID_safeContentsBag)
51 return NULL;
52 return bag->value.safes;
53 }
54
PKCS12_SAFEBAG_get0_type(const PKCS12_SAFEBAG * bag)55 const ASN1_OBJECT *PKCS12_SAFEBAG_get0_type(const PKCS12_SAFEBAG *bag)
56 {
57 return bag->type;
58 }
59
PKCS12_SAFEBAG_get_nid(const PKCS12_SAFEBAG * bag)60 int PKCS12_SAFEBAG_get_nid(const PKCS12_SAFEBAG *bag)
61 {
62 return OBJ_obj2nid(bag->type);
63 }
64
PKCS12_SAFEBAG_get_bag_nid(const PKCS12_SAFEBAG * bag)65 int PKCS12_SAFEBAG_get_bag_nid(const PKCS12_SAFEBAG *bag)
66 {
67 int btype = PKCS12_SAFEBAG_get_nid(bag);
68
69 if (btype != NID_certBag && btype != NID_crlBag && btype != NID_secretBag)
70 return -1;
71 return OBJ_obj2nid(bag->value.bag->type);
72 }
73
PKCS12_SAFEBAG_get0_bag_type(const PKCS12_SAFEBAG * bag)74 const ASN1_OBJECT *PKCS12_SAFEBAG_get0_bag_type(const PKCS12_SAFEBAG *bag)
75 {
76 return bag->value.bag->type;
77 }
78
PKCS12_SAFEBAG_get0_bag_obj(const PKCS12_SAFEBAG * bag)79 const ASN1_TYPE *PKCS12_SAFEBAG_get0_bag_obj(const PKCS12_SAFEBAG *bag)
80 {
81 return bag->value.bag->value.other;
82 }
83
PKCS12_SAFEBAG_get1_cert(const PKCS12_SAFEBAG * bag)84 X509 *PKCS12_SAFEBAG_get1_cert(const PKCS12_SAFEBAG *bag)
85 {
86 if (PKCS12_SAFEBAG_get_nid(bag) != NID_certBag)
87 return NULL;
88 if (OBJ_obj2nid(bag->value.bag->type) != NID_x509Certificate)
89 return NULL;
90 return ASN1_item_unpack(bag->value.bag->value.octet,
91 ASN1_ITEM_rptr(X509));
92 }
93
PKCS12_SAFEBAG_get1_crl(const PKCS12_SAFEBAG * bag)94 X509_CRL *PKCS12_SAFEBAG_get1_crl(const PKCS12_SAFEBAG *bag)
95 {
96 if (PKCS12_SAFEBAG_get_nid(bag) != NID_crlBag)
97 return NULL;
98 if (OBJ_obj2nid(bag->value.bag->type) != NID_x509Crl)
99 return NULL;
100 return ASN1_item_unpack(bag->value.bag->value.octet,
101 ASN1_ITEM_rptr(X509_CRL));
102 }
103
PKCS12_SAFEBAG_create_cert(X509 * x509)104 PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_cert(X509 *x509)
105 {
106 return PKCS12_item_pack_safebag(x509, ASN1_ITEM_rptr(X509),
107 NID_x509Certificate, NID_certBag);
108 }
109
PKCS12_SAFEBAG_create_crl(X509_CRL * crl)110 PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_crl(X509_CRL *crl)
111 {
112 return PKCS12_item_pack_safebag(crl, ASN1_ITEM_rptr(X509_CRL),
113 NID_x509Crl, NID_crlBag);
114 }
115
PKCS12_SAFEBAG_create_secret(int type,int vtype,const unsigned char * value,int len)116 PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_secret(int type, int vtype, const unsigned char *value, int len)
117 {
118 PKCS12_BAGS *bag;
119 PKCS12_SAFEBAG *safebag;
120
121 if ((bag = PKCS12_BAGS_new()) == NULL) {
122 ERR_raise(ERR_LIB_PKCS12, ERR_R_MALLOC_FAILURE);
123 return NULL;
124 }
125 bag->type = OBJ_nid2obj(type);
126
127 switch(vtype) {
128 case V_ASN1_OCTET_STRING:
129 {
130 ASN1_OCTET_STRING *strtmp = ASN1_OCTET_STRING_new();
131
132 if (strtmp == NULL) {
133 ERR_raise(ERR_LIB_PKCS12, ERR_R_MALLOC_FAILURE);
134 goto err;
135 }
136 /* Pack data into an octet string */
137 if (!ASN1_OCTET_STRING_set(strtmp, value, len)) {
138 ASN1_OCTET_STRING_free(strtmp);
139 ERR_raise(ERR_LIB_PKCS12, PKCS12_R_ENCODE_ERROR);
140 goto err;
141 }
142 bag->value.other = ASN1_TYPE_new();
143 if (bag->value.other == NULL) {
144 ASN1_OCTET_STRING_free(strtmp);
145 ERR_raise(ERR_LIB_PKCS12, ERR_R_MALLOC_FAILURE);
146 goto err;
147 }
148 ASN1_TYPE_set(bag->value.other, vtype, strtmp);
149 }
150 break;
151
152 default:
153 ERR_raise(ERR_LIB_PKCS12, PKCS12_R_INVALID_TYPE);
154 goto err;
155 }
156
157 if ((safebag = PKCS12_SAFEBAG_new()) == NULL) {
158 ERR_raise(ERR_LIB_PKCS12, ERR_R_MALLOC_FAILURE);
159 goto err;
160 }
161 safebag->value.bag = bag;
162 safebag->type = OBJ_nid2obj(NID_secretBag);
163 return safebag;
164
165 err:
166 PKCS12_BAGS_free(bag);
167 return NULL;
168 }
169
170 /* Turn PKCS8 object into a keybag */
171
PKCS12_SAFEBAG_create0_p8inf(PKCS8_PRIV_KEY_INFO * p8)172 PKCS12_SAFEBAG *PKCS12_SAFEBAG_create0_p8inf(PKCS8_PRIV_KEY_INFO *p8)
173 {
174 PKCS12_SAFEBAG *bag = PKCS12_SAFEBAG_new();
175
176 if (bag == NULL) {
177 ERR_raise(ERR_LIB_PKCS12, ERR_R_MALLOC_FAILURE);
178 return NULL;
179 }
180 bag->type = OBJ_nid2obj(NID_keyBag);
181 bag->value.keybag = p8;
182 return bag;
183 }
184
185 /* Turn PKCS8 object into a shrouded keybag */
186
PKCS12_SAFEBAG_create0_pkcs8(X509_SIG * p8)187 PKCS12_SAFEBAG *PKCS12_SAFEBAG_create0_pkcs8(X509_SIG *p8)
188 {
189 PKCS12_SAFEBAG *bag = PKCS12_SAFEBAG_new();
190
191 /* Set up the safe bag */
192 if (bag == NULL) {
193 ERR_raise(ERR_LIB_PKCS12, ERR_R_MALLOC_FAILURE);
194 return NULL;
195 }
196 bag->type = OBJ_nid2obj(NID_pkcs8ShroudedKeyBag);
197 bag->value.shkeybag = p8;
198 return bag;
199 }
200
PKCS12_SAFEBAG_create_pkcs8_encrypt_ex(int pbe_nid,const char * pass,int passlen,unsigned char * salt,int saltlen,int iter,PKCS8_PRIV_KEY_INFO * p8inf,OSSL_LIB_CTX * ctx,const char * propq)201 PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_pkcs8_encrypt_ex(int pbe_nid,
202 const char *pass,
203 int passlen,
204 unsigned char *salt,
205 int saltlen, int iter,
206 PKCS8_PRIV_KEY_INFO *p8inf,
207 OSSL_LIB_CTX *ctx,
208 const char *propq)
209 {
210 PKCS12_SAFEBAG *bag = NULL;
211 const EVP_CIPHER *pbe_ciph = NULL;
212 EVP_CIPHER *pbe_ciph_fetch = NULL;
213 X509_SIG *p8;
214
215 ERR_set_mark();
216 pbe_ciph = pbe_ciph_fetch = EVP_CIPHER_fetch(ctx, OBJ_nid2sn(pbe_nid), propq);
217 if (pbe_ciph == NULL)
218 pbe_ciph = EVP_get_cipherbynid(pbe_nid);
219 ERR_pop_to_mark();
220
221 if (pbe_ciph != NULL)
222 pbe_nid = -1;
223
224 p8 = PKCS8_encrypt_ex(pbe_nid, pbe_ciph, pass, passlen, salt, saltlen, iter,
225 p8inf, ctx, propq);
226 if (p8 == NULL)
227 goto err;
228
229 bag = PKCS12_SAFEBAG_create0_pkcs8(p8);
230 if (bag == NULL)
231 X509_SIG_free(p8);
232
233 err:
234 EVP_CIPHER_free(pbe_ciph_fetch);
235 return bag;
236 }
237
PKCS12_SAFEBAG_create_pkcs8_encrypt(int pbe_nid,const char * pass,int passlen,unsigned char * salt,int saltlen,int iter,PKCS8_PRIV_KEY_INFO * p8inf)238 PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_pkcs8_encrypt(int pbe_nid,
239 const char *pass,
240 int passlen,
241 unsigned char *salt,
242 int saltlen, int iter,
243 PKCS8_PRIV_KEY_INFO *p8inf)
244 {
245 return PKCS12_SAFEBAG_create_pkcs8_encrypt_ex(pbe_nid, pass, passlen,
246 salt, saltlen, iter, p8inf,
247 NULL, NULL);
248 }
249