1 /* $OpenBSD: tls_util.c,v 1.16 2023/05/14 07:26:25 op Exp $ */ 2 /* 3 * Copyright (c) 2014 Joel Sing <jsing@openbsd.org> 4 * Copyright (c) 2014 Ted Unangst <tedu@openbsd.org> 5 * Copyright (c) 2015 Reyk Floeter <reyk@openbsd.org> 6 * 7 * Permission to use, copy, modify, and distribute this software for any 8 * purpose with or without fee is hereby granted, provided that the above 9 * copyright notice and this permission notice appear in all copies. 10 * 11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 */ 19 20 #include <sys/stat.h> 21 22 #include <stdlib.h> 23 #include <string.h> 24 #include <unistd.h> 25 #include <fcntl.h> 26 27 #include "tls.h" 28 #include "tls_internal.h" 29 30 static void * 31 memdup(const void *in, size_t len) 32 { 33 void *out; 34 35 if ((out = malloc(len)) == NULL) 36 return NULL; 37 memcpy(out, in, len); 38 return out; 39 } 40 41 int 42 tls_set_mem(char **dest, size_t *destlen, const void *src, size_t srclen) 43 { 44 free(*dest); 45 *dest = NULL; 46 *destlen = 0; 47 if (src != NULL) { 48 if ((*dest = memdup(src, srclen)) == NULL) 49 return -1; 50 *destlen = srclen; 51 } 52 return 0; 53 } 54 55 int 56 tls_set_string(const char **dest, const char *src) 57 { 58 free((char *)*dest); 59 *dest = NULL; 60 if (src != NULL) 61 if ((*dest = strdup(src)) == NULL) 62 return -1; 63 return 0; 64 } 65 66 /* 67 * Extract the host and port from a colon separated value. For a literal IPv6 68 * address the address must be contained with square braces. If a host and 69 * port are successfully extracted, the function will return 0 and the 70 * caller is responsible for freeing the host and port. If no port is found 71 * then the function will return 1, with both host and port being NULL. 72 * On memory allocation failure -1 will be returned. 73 */ 74 int 75 tls_host_port(const char *hostport, char **host, char **port) 76 { 77 char *h, *p, *s; 78 int rv = 1; 79 80 *host = NULL; 81 *port = NULL; 82 83 if ((s = strdup(hostport)) == NULL) 84 goto err; 85 86 h = p = s; 87 88 /* See if this is an IPv6 literal with square braces. */ 89 if (p[0] == '[') { 90 h++; 91 if ((p = strchr(s, ']')) == NULL) 92 goto done; 93 *p++ = '\0'; 94 } 95 96 /* Find the port separator. */ 97 if ((p = strchr(p, ':')) == NULL) 98 goto done; 99 100 /* If there is another separator then we have issues. */ 101 if (strchr(p + 1, ':') != NULL) 102 goto done; 103 104 *p++ = '\0'; 105 106 if (asprintf(host, "%s", h) == -1) { 107 *host = NULL; 108 goto err; 109 } 110 if (asprintf(port, "%s", p) == -1) { 111 *port = NULL; 112 goto err; 113 } 114 115 rv = 0; 116 goto done; 117 118 err: 119 free(*host); 120 *host = NULL; 121 free(*port); 122 *port = NULL; 123 rv = -1; 124 125 done: 126 free(s); 127 128 return (rv); 129 } 130 131 int 132 tls_password_cb(char *buf, int size, int rwflag, void *u) 133 { 134 size_t len; 135 136 if (size < 0) 137 return (0); 138 139 if (u == NULL) { 140 memset(buf, 0, size); 141 return (0); 142 } 143 144 if ((len = strlcpy(buf, u, size)) >= (size_t)size) 145 return (0); 146 147 return (len); 148 } 149 150 uint8_t * 151 tls_load_file(const char *name, size_t *len, char *password) 152 { 153 FILE *fp; 154 EVP_PKEY *key = NULL; 155 BIO *bio = NULL; 156 char *data; 157 uint8_t *buf = NULL; 158 struct stat st; 159 size_t size = 0; 160 int fd = -1; 161 ssize_t n; 162 163 *len = 0; 164 165 if ((fd = open(name, O_RDONLY)) == -1) 166 return (NULL); 167 168 /* Just load the file into memory without decryption */ 169 if (password == NULL) { 170 if (fstat(fd, &st) != 0) 171 goto err; 172 if (st.st_size < 0) 173 goto err; 174 size = (size_t)st.st_size; 175 if ((buf = malloc(size)) == NULL) 176 goto err; 177 n = read(fd, buf, size); 178 if (n < 0 || (size_t)n != size) 179 goto err; 180 close(fd); 181 goto done; 182 } 183 184 /* Or read the (possibly) encrypted key from file */ 185 if ((fp = fdopen(fd, "r")) == NULL) 186 goto err; 187 fd = -1; 188 189 key = PEM_read_PrivateKey(fp, NULL, tls_password_cb, password); 190 fclose(fp); 191 if (key == NULL) 192 goto err; 193 194 /* Write unencrypted key to memory buffer */ 195 if ((bio = BIO_new(BIO_s_mem())) == NULL) 196 goto err; 197 if (!PEM_write_bio_PrivateKey(bio, key, NULL, NULL, 0, NULL, NULL)) 198 goto err; 199 if ((size = BIO_get_mem_data(bio, &data)) <= 0) 200 goto err; 201 if ((buf = malloc(size)) == NULL) 202 goto err; 203 memcpy(buf, data, size); 204 205 BIO_free_all(bio); 206 EVP_PKEY_free(key); 207 208 done: 209 *len = size; 210 return (buf); 211 212 err: 213 if (fd != -1) 214 close(fd); 215 freezero(buf, size); 216 BIO_free_all(bio); 217 EVP_PKEY_free(key); 218 219 return (NULL); 220 } 221 222 void 223 tls_unload_file(uint8_t *buf, size_t len) 224 { 225 freezero(buf, len); 226 } 227