1 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
2 * All rights reserved.
3 *
4 * This package is an SSL implementation written
5 * by Eric Young (eay@cryptsoft.com).
6 * The implementation was written so as to conform with Netscapes SSL.
7 *
8 * This library is free for commercial and non-commercial use as long as
9 * the following conditions are aheared to. The following conditions
10 * apply to all code found in this distribution, be it the RC4, RSA,
11 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
12 * included with this distribution is covered by the same copyright terms
13 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
14 *
15 * Copyright remains Eric Young's, and as such any Copyright notices in
16 * the code are not to be removed.
17 * If this package is used in a product, Eric Young should be given attribution
18 * as the author of the parts of the library used.
19 * This can be in the form of a textual message at program startup or
20 * in documentation (online or textual) provided with the package.
21 *
22 * Redistribution and use in source and binary forms, with or without
23 * modification, are permitted provided that the following conditions
24 * are met:
25 * 1. Redistributions of source code must retain the copyright
26 * notice, this list of conditions and the following disclaimer.
27 * 2. Redistributions in binary form must reproduce the above copyright
28 * notice, this list of conditions and the following disclaimer in the
29 * documentation and/or other materials provided with the distribution.
30 * 3. All advertising materials mentioning features or use of this software
31 * must display the following acknowledgement:
32 * "This product includes cryptographic software written by
33 * Eric Young (eay@cryptsoft.com)"
34 * The word 'cryptographic' can be left out if the rouines from the library
35 * being used are not cryptographic related :-).
36 * 4. If you include any Windows specific code (or a derivative thereof) from
37 * the apps directory (application code) you must include an acknowledgement:
38 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
39 *
40 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
41 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
43 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
44 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
45 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
46 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
48 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
49 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
50 * SUCH DAMAGE.
51 *
52 * The licence and distribution terms for any publically available version or
53 * derivative of this code cannot be changed. i.e. this code cannot simply be
54 * copied and put under another distribution licence
55 * [including the GNU Public Licence.] */
56
57 #include <openssl/x509.h>
58
59 #include <limits.h>
60
61 #include <openssl/asn1.h>
62 #include <openssl/digest.h>
63 #include <openssl/dsa.h>
64 #include <openssl/evp.h>
65 #include <openssl/mem.h>
66 #include <openssl/rsa.h>
67 #include <openssl/stack.h>
68
X509_verify(X509 * a,EVP_PKEY * r)69 int X509_verify(X509 *a, EVP_PKEY *r)
70 {
71 if (X509_ALGOR_cmp(a->sig_alg, a->cert_info->signature)) {
72 OPENSSL_PUT_ERROR(X509, X509_R_SIGNATURE_ALGORITHM_MISMATCH);
73 return 0;
74 }
75 return (ASN1_item_verify(ASN1_ITEM_rptr(X509_CINF), a->sig_alg,
76 a->signature, a->cert_info, r));
77 }
78
X509_REQ_verify(X509_REQ * a,EVP_PKEY * r)79 int X509_REQ_verify(X509_REQ *a, EVP_PKEY *r)
80 {
81 return (ASN1_item_verify(ASN1_ITEM_rptr(X509_REQ_INFO),
82 a->sig_alg, a->signature, a->req_info, r));
83 }
84
X509_sign(X509 * x,EVP_PKEY * pkey,const EVP_MD * md)85 int X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)
86 {
87 x->cert_info->enc.modified = 1;
88 return (ASN1_item_sign(ASN1_ITEM_rptr(X509_CINF), x->cert_info->signature,
89 x->sig_alg, x->signature, x->cert_info, pkey, md));
90 }
91
X509_sign_ctx(X509 * x,EVP_MD_CTX * ctx)92 int X509_sign_ctx(X509 *x, EVP_MD_CTX *ctx)
93 {
94 x->cert_info->enc.modified = 1;
95 return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_CINF),
96 x->cert_info->signature,
97 x->sig_alg, x->signature, x->cert_info, ctx);
98 }
99
X509_REQ_sign(X509_REQ * x,EVP_PKEY * pkey,const EVP_MD * md)100 int X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md)
101 {
102 return (ASN1_item_sign(ASN1_ITEM_rptr(X509_REQ_INFO), x->sig_alg, NULL,
103 x->signature, x->req_info, pkey, md));
104 }
105
X509_REQ_sign_ctx(X509_REQ * x,EVP_MD_CTX * ctx)106 int X509_REQ_sign_ctx(X509_REQ *x, EVP_MD_CTX *ctx)
107 {
108 return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_REQ_INFO),
109 x->sig_alg, NULL, x->signature, x->req_info,
110 ctx);
111 }
112
X509_CRL_sign(X509_CRL * x,EVP_PKEY * pkey,const EVP_MD * md)113 int X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md)
114 {
115 x->crl->enc.modified = 1;
116 return (ASN1_item_sign(ASN1_ITEM_rptr(X509_CRL_INFO), x->crl->sig_alg,
117 x->sig_alg, x->signature, x->crl, pkey, md));
118 }
119
X509_CRL_sign_ctx(X509_CRL * x,EVP_MD_CTX * ctx)120 int X509_CRL_sign_ctx(X509_CRL *x, EVP_MD_CTX *ctx)
121 {
122 x->crl->enc.modified = 1;
123 return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_CRL_INFO),
124 x->crl->sig_alg, x->sig_alg, x->signature,
125 x->crl, ctx);
126 }
127
NETSCAPE_SPKI_sign(NETSCAPE_SPKI * x,EVP_PKEY * pkey,const EVP_MD * md)128 int NETSCAPE_SPKI_sign(NETSCAPE_SPKI *x, EVP_PKEY *pkey, const EVP_MD *md)
129 {
130 return (ASN1_item_sign(ASN1_ITEM_rptr(NETSCAPE_SPKAC), x->sig_algor, NULL,
131 x->signature, x->spkac, pkey, md));
132 }
133
NETSCAPE_SPKI_verify(NETSCAPE_SPKI * x,EVP_PKEY * pkey)134 int NETSCAPE_SPKI_verify(NETSCAPE_SPKI *x, EVP_PKEY *pkey)
135 {
136 return (ASN1_item_verify(ASN1_ITEM_rptr(NETSCAPE_SPKAC), x->sig_algor,
137 x->signature, x->spkac, pkey));
138 }
139
140 #ifndef OPENSSL_NO_FP_API
d2i_X509_fp(FILE * fp,X509 ** x509)141 X509 *d2i_X509_fp(FILE *fp, X509 **x509)
142 {
143 return ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509), fp, x509);
144 }
145
i2d_X509_fp(FILE * fp,X509 * x509)146 int i2d_X509_fp(FILE *fp, X509 *x509)
147 {
148 return ASN1_item_i2d_fp(ASN1_ITEM_rptr(X509), fp, x509);
149 }
150 #endif
151
d2i_X509_bio(BIO * bp,X509 ** x509)152 X509 *d2i_X509_bio(BIO *bp, X509 **x509)
153 {
154 return ASN1_item_d2i_bio(ASN1_ITEM_rptr(X509), bp, x509);
155 }
156
i2d_X509_bio(BIO * bp,X509 * x509)157 int i2d_X509_bio(BIO *bp, X509 *x509)
158 {
159 return ASN1_item_i2d_bio(ASN1_ITEM_rptr(X509), bp, x509);
160 }
161
162 #ifndef OPENSSL_NO_FP_API
d2i_X509_CRL_fp(FILE * fp,X509_CRL ** crl)163 X509_CRL *d2i_X509_CRL_fp(FILE *fp, X509_CRL **crl)
164 {
165 return ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509_CRL), fp, crl);
166 }
167
i2d_X509_CRL_fp(FILE * fp,X509_CRL * crl)168 int i2d_X509_CRL_fp(FILE *fp, X509_CRL *crl)
169 {
170 return ASN1_item_i2d_fp(ASN1_ITEM_rptr(X509_CRL), fp, crl);
171 }
172 #endif
173
d2i_X509_CRL_bio(BIO * bp,X509_CRL ** crl)174 X509_CRL *d2i_X509_CRL_bio(BIO *bp, X509_CRL **crl)
175 {
176 return ASN1_item_d2i_bio(ASN1_ITEM_rptr(X509_CRL), bp, crl);
177 }
178
i2d_X509_CRL_bio(BIO * bp,X509_CRL * crl)179 int i2d_X509_CRL_bio(BIO *bp, X509_CRL *crl)
180 {
181 return ASN1_item_i2d_bio(ASN1_ITEM_rptr(X509_CRL), bp, crl);
182 }
183
184 #ifndef OPENSSL_NO_FP_API
d2i_X509_REQ_fp(FILE * fp,X509_REQ ** req)185 X509_REQ *d2i_X509_REQ_fp(FILE *fp, X509_REQ **req)
186 {
187 return ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509_REQ), fp, req);
188 }
189
i2d_X509_REQ_fp(FILE * fp,X509_REQ * req)190 int i2d_X509_REQ_fp(FILE *fp, X509_REQ *req)
191 {
192 return ASN1_item_i2d_fp(ASN1_ITEM_rptr(X509_REQ), fp, req);
193 }
194 #endif
195
d2i_X509_REQ_bio(BIO * bp,X509_REQ ** req)196 X509_REQ *d2i_X509_REQ_bio(BIO *bp, X509_REQ **req)
197 {
198 return ASN1_item_d2i_bio(ASN1_ITEM_rptr(X509_REQ), bp, req);
199 }
200
i2d_X509_REQ_bio(BIO * bp,X509_REQ * req)201 int i2d_X509_REQ_bio(BIO *bp, X509_REQ *req)
202 {
203 return ASN1_item_i2d_bio(ASN1_ITEM_rptr(X509_REQ), bp, req);
204 }
205
206 #ifndef OPENSSL_NO_FP_API
207
208 #define IMPLEMENT_D2I_FP(type, name, bio_func) \
209 type *name(FILE *fp, type **obj) { \
210 BIO *bio = BIO_new_fp(fp, BIO_NOCLOSE); \
211 if (bio == NULL) { \
212 return NULL; \
213 } \
214 type *ret = bio_func(bio, obj); \
215 BIO_free(bio); \
216 return ret; \
217 }
218
219 #define IMPLEMENT_I2D_FP(type, name, bio_func) \
220 int name(FILE *fp, type *obj) { \
221 BIO *bio = BIO_new_fp(fp, BIO_NOCLOSE); \
222 if (bio == NULL) { \
223 return 0; \
224 } \
225 int ret = bio_func(bio, obj); \
226 BIO_free(bio); \
227 return ret; \
228 }
229
IMPLEMENT_D2I_FP(RSA,d2i_RSAPrivateKey_fp,d2i_RSAPrivateKey_bio)230 IMPLEMENT_D2I_FP(RSA, d2i_RSAPrivateKey_fp, d2i_RSAPrivateKey_bio)
231 IMPLEMENT_I2D_FP(RSA, i2d_RSAPrivateKey_fp, i2d_RSAPrivateKey_bio)
232
233 IMPLEMENT_D2I_FP(RSA, d2i_RSAPublicKey_fp, d2i_RSAPublicKey_bio)
234 IMPLEMENT_I2D_FP(RSA, i2d_RSAPublicKey_fp, i2d_RSAPublicKey_bio)
235
236 IMPLEMENT_D2I_FP(RSA, d2i_RSA_PUBKEY_fp, d2i_RSA_PUBKEY_bio)
237 IMPLEMENT_I2D_FP(RSA, i2d_RSA_PUBKEY_fp, i2d_RSA_PUBKEY_bio)
238 #endif
239
240 #define IMPLEMENT_D2I_BIO(type, name, d2i_func) \
241 type *name(BIO *bio, type **obj) { \
242 uint8_t *data; \
243 size_t len; \
244 if (!BIO_read_asn1(bio, &data, &len, 100 * 1024)) { \
245 return NULL; \
246 } \
247 const uint8_t *ptr = data; \
248 type *ret = d2i_func(obj, &ptr, (long)len); \
249 OPENSSL_free(data); \
250 return ret; \
251 }
252
253 #define IMPLEMENT_I2D_BIO(type, name, i2d_func) \
254 int name(BIO *bio, type *obj) { \
255 uint8_t *data = NULL; \
256 int len = i2d_func(obj, &data); \
257 if (len < 0) { \
258 return 0; \
259 } \
260 int ret = BIO_write_all(bio, data, len); \
261 OPENSSL_free(data); \
262 return ret; \
263 }
264
265 IMPLEMENT_D2I_BIO(RSA, d2i_RSAPrivateKey_bio, d2i_RSAPrivateKey)
266 IMPLEMENT_I2D_BIO(RSA, i2d_RSAPrivateKey_bio, i2d_RSAPrivateKey)
267
268 IMPLEMENT_D2I_BIO(RSA, d2i_RSAPublicKey_bio, d2i_RSAPublicKey)
269 IMPLEMENT_I2D_BIO(RSA, i2d_RSAPublicKey_bio, i2d_RSAPublicKey)
270
271 IMPLEMENT_D2I_BIO(RSA, d2i_RSA_PUBKEY_bio, d2i_RSA_PUBKEY)
272 IMPLEMENT_I2D_BIO(RSA, i2d_RSA_PUBKEY_bio, i2d_RSA_PUBKEY)
273
274 #ifndef OPENSSL_NO_DSA
275 # ifndef OPENSSL_NO_FP_API
276 IMPLEMENT_D2I_FP(DSA, d2i_DSAPrivateKey_fp, d2i_DSAPrivateKey_bio)
277 IMPLEMENT_I2D_FP(DSA, i2d_DSAPrivateKey_fp, i2d_DSAPrivateKey_bio)
278
279 IMPLEMENT_D2I_FP(DSA, d2i_DSA_PUBKEY_fp, d2i_DSA_PUBKEY_bio)
280 IMPLEMENT_I2D_FP(DSA, i2d_DSA_PUBKEY_fp, i2d_DSA_PUBKEY_bio)
281 # endif
282
283 IMPLEMENT_D2I_BIO(DSA, d2i_DSAPrivateKey_bio, d2i_DSAPrivateKey)
284 IMPLEMENT_I2D_BIO(DSA, i2d_DSAPrivateKey_bio, i2d_DSAPrivateKey)
285
286 IMPLEMENT_D2I_BIO(DSA, d2i_DSA_PUBKEY_bio, d2i_DSA_PUBKEY)
287 IMPLEMENT_I2D_BIO(DSA, i2d_DSA_PUBKEY_bio, i2d_DSA_PUBKEY)
288 #endif
289
290 #ifndef OPENSSL_NO_FP_API
291 IMPLEMENT_D2I_FP(EC_KEY, d2i_ECPrivateKey_fp, d2i_ECPrivateKey_bio)
292 IMPLEMENT_I2D_FP(EC_KEY, i2d_ECPrivateKey_fp, i2d_ECPrivateKey_bio)
293
294 IMPLEMENT_D2I_FP(EC_KEY, d2i_EC_PUBKEY_fp, d2i_EC_PUBKEY_bio)
295 IMPLEMENT_I2D_FP(EC_KEY, i2d_EC_PUBKEY_fp, i2d_EC_PUBKEY_bio)
296 #endif
297
298 IMPLEMENT_D2I_BIO(EC_KEY, d2i_ECPrivateKey_bio, d2i_ECPrivateKey)
299 IMPLEMENT_I2D_BIO(EC_KEY, i2d_ECPrivateKey_bio, i2d_ECPrivateKey)
300
301 IMPLEMENT_D2I_BIO(EC_KEY, d2i_EC_PUBKEY_bio, d2i_EC_PUBKEY)
302 IMPLEMENT_I2D_BIO(EC_KEY, i2d_EC_PUBKEY_bio, i2d_EC_PUBKEY)
303
304 int X509_pubkey_digest(const X509 *data, const EVP_MD *type,
305 unsigned char *md, unsigned int *len)
306 {
307 ASN1_BIT_STRING *key;
308 key = X509_get0_pubkey_bitstr(data);
309 if (!key)
310 return 0;
311 return EVP_Digest(key->data, key->length, md, len, type, NULL);
312 }
313
X509_digest(const X509 * data,const EVP_MD * type,unsigned char * md,unsigned int * len)314 int X509_digest(const X509 *data, const EVP_MD *type, unsigned char *md,
315 unsigned int *len)
316 {
317 return (ASN1_item_digest
318 (ASN1_ITEM_rptr(X509), type, (char *)data, md, len));
319 }
320
X509_CRL_digest(const X509_CRL * data,const EVP_MD * type,unsigned char * md,unsigned int * len)321 int X509_CRL_digest(const X509_CRL *data, const EVP_MD *type,
322 unsigned char *md, unsigned int *len)
323 {
324 return (ASN1_item_digest
325 (ASN1_ITEM_rptr(X509_CRL), type, (char *)data, md, len));
326 }
327
X509_REQ_digest(const X509_REQ * data,const EVP_MD * type,unsigned char * md,unsigned int * len)328 int X509_REQ_digest(const X509_REQ *data, const EVP_MD *type,
329 unsigned char *md, unsigned int *len)
330 {
331 return (ASN1_item_digest
332 (ASN1_ITEM_rptr(X509_REQ), type, (char *)data, md, len));
333 }
334
X509_NAME_digest(const X509_NAME * data,const EVP_MD * type,unsigned char * md,unsigned int * len)335 int X509_NAME_digest(const X509_NAME *data, const EVP_MD *type,
336 unsigned char *md, unsigned int *len)
337 {
338 return (ASN1_item_digest
339 (ASN1_ITEM_rptr(X509_NAME), type, (char *)data, md, len));
340 }
341
342 #ifndef OPENSSL_NO_FP_API
IMPLEMENT_D2I_FP(X509_SIG,d2i_PKCS8_fp,d2i_PKCS8_bio)343 IMPLEMENT_D2I_FP(X509_SIG, d2i_PKCS8_fp, d2i_PKCS8_bio)
344 IMPLEMENT_I2D_FP(X509_SIG, i2d_PKCS8_fp, i2d_PKCS8_bio)
345 #endif
346
347 IMPLEMENT_D2I_BIO(X509_SIG, d2i_PKCS8_bio, d2i_X509_SIG)
348 IMPLEMENT_I2D_BIO(X509_SIG, i2d_PKCS8_bio, i2d_X509_SIG)
349
350 #ifndef OPENSSL_NO_FP_API
351 IMPLEMENT_D2I_FP(PKCS8_PRIV_KEY_INFO, d2i_PKCS8_PRIV_KEY_INFO_fp,
352 d2i_PKCS8_PRIV_KEY_INFO_bio)
353 IMPLEMENT_I2D_FP(PKCS8_PRIV_KEY_INFO, i2d_PKCS8_PRIV_KEY_INFO_fp,
354 i2d_PKCS8_PRIV_KEY_INFO_bio)
355
356 int i2d_PKCS8PrivateKeyInfo_fp(FILE *fp, EVP_PKEY *key)
357 {
358 PKCS8_PRIV_KEY_INFO *p8inf;
359 int ret;
360 p8inf = EVP_PKEY2PKCS8(key);
361 if (!p8inf)
362 return 0;
363 ret = i2d_PKCS8_PRIV_KEY_INFO_fp(fp, p8inf);
364 PKCS8_PRIV_KEY_INFO_free(p8inf);
365 return ret;
366 }
367
IMPLEMENT_D2I_FP(EVP_PKEY,d2i_PrivateKey_fp,d2i_PrivateKey_bio)368 IMPLEMENT_D2I_FP(EVP_PKEY, d2i_PrivateKey_fp, d2i_PrivateKey_bio)
369 IMPLEMENT_I2D_FP(EVP_PKEY, i2d_PrivateKey_fp, i2d_PrivateKey_bio)
370
371 IMPLEMENT_D2I_FP(EVP_PKEY, d2i_PUBKEY_fp, d2i_PUBKEY_bio)
372 IMPLEMENT_I2D_FP(EVP_PKEY, i2d_PUBKEY_fp, i2d_PUBKEY_bio)
373
374 IMPLEMENT_D2I_BIO(PKCS8_PRIV_KEY_INFO, d2i_PKCS8_PRIV_KEY_INFO_bio,
375 d2i_PKCS8_PRIV_KEY_INFO)
376 IMPLEMENT_I2D_BIO(PKCS8_PRIV_KEY_INFO, i2d_PKCS8_PRIV_KEY_INFO_bio,
377 i2d_PKCS8_PRIV_KEY_INFO)
378
379 int i2d_PKCS8PrivateKeyInfo_bio(BIO *bp, EVP_PKEY *key)
380 {
381 PKCS8_PRIV_KEY_INFO *p8inf;
382 int ret;
383 p8inf = EVP_PKEY2PKCS8(key);
384 if (!p8inf)
385 return 0;
386 ret = i2d_PKCS8_PRIV_KEY_INFO_bio(bp, p8inf);
387 PKCS8_PRIV_KEY_INFO_free(p8inf);
388 return ret;
389 }
390 #endif
391
392 IMPLEMENT_D2I_BIO(EVP_PKEY, d2i_PrivateKey_bio, d2i_AutoPrivateKey)
393 IMPLEMENT_I2D_BIO(EVP_PKEY, i2d_PrivateKey_bio, i2d_PrivateKey)
394
395 IMPLEMENT_D2I_BIO(EVP_PKEY, d2i_PUBKEY_bio, d2i_PUBKEY)
396 IMPLEMENT_I2D_BIO(EVP_PKEY, i2d_PUBKEY_bio, i2d_PUBKEY)
397
398 IMPLEMENT_D2I_BIO(DH, d2i_DHparams_bio, d2i_DHparams)
399 IMPLEMENT_I2D_BIO(const DH, i2d_DHparams_bio, i2d_DHparams)
400