1 /* 2 * Copyright 1999-2021 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <stdio.h> 11 #include "internal/cryptlib.h" 12 #include <openssl/pkcs12.h> 13 #include "p12_local.h" 14 15 #ifndef OPENSSL_NO_DEPRECATED_1_1_0 16 ASN1_TYPE *PKCS12_get_attr(const PKCS12_SAFEBAG *bag, int attr_nid) 17 { 18 return PKCS12_get_attr_gen(bag->attrib, attr_nid); 19 } 20 #endif 21 22 const ASN1_TYPE *PKCS12_SAFEBAG_get0_attr(const PKCS12_SAFEBAG *bag, 23 int attr_nid) 24 { 25 return PKCS12_get_attr_gen(bag->attrib, attr_nid); 26 } 27 28 ASN1_TYPE *PKCS8_get_attr(PKCS8_PRIV_KEY_INFO *p8, int attr_nid) 29 { 30 return PKCS12_get_attr_gen(PKCS8_pkey_get0_attrs(p8), attr_nid); 31 } 32 33 const PKCS8_PRIV_KEY_INFO *PKCS12_SAFEBAG_get0_p8inf(const PKCS12_SAFEBAG *bag) 34 { 35 if (PKCS12_SAFEBAG_get_nid(bag) != NID_keyBag) 36 return NULL; 37 return bag->value.keybag; 38 } 39 40 const X509_SIG *PKCS12_SAFEBAG_get0_pkcs8(const PKCS12_SAFEBAG *bag) 41 { 42 if (OBJ_obj2nid(bag->type) != NID_pkcs8ShroudedKeyBag) 43 return NULL; 44 return bag->value.shkeybag; 45 } 46 47 const STACK_OF(PKCS12_SAFEBAG) * 48 PKCS12_SAFEBAG_get0_safes(const PKCS12_SAFEBAG *bag) 49 { 50 if (OBJ_obj2nid(bag->type) != NID_safeContentsBag) 51 return NULL; 52 return bag->value.safes; 53 } 54 55 const ASN1_OBJECT *PKCS12_SAFEBAG_get0_type(const PKCS12_SAFEBAG *bag) 56 { 57 return bag->type; 58 } 59 60 int PKCS12_SAFEBAG_get_nid(const PKCS12_SAFEBAG *bag) 61 { 62 return OBJ_obj2nid(bag->type); 63 } 64 65 int PKCS12_SAFEBAG_get_bag_nid(const PKCS12_SAFEBAG *bag) 66 { 67 int btype = PKCS12_SAFEBAG_get_nid(bag); 68 69 if (btype != NID_certBag && btype != NID_crlBag && btype != NID_secretBag) 70 return -1; 71 return OBJ_obj2nid(bag->value.bag->type); 72 } 73 74 const ASN1_OBJECT *PKCS12_SAFEBAG_get0_bag_type(const PKCS12_SAFEBAG *bag) 75 { 76 return bag->value.bag->type; 77 } 78 79 const ASN1_TYPE *PKCS12_SAFEBAG_get0_bag_obj(const PKCS12_SAFEBAG *bag) 80 { 81 return bag->value.bag->value.other; 82 } 83 84 X509 *PKCS12_SAFEBAG_get1_cert(const PKCS12_SAFEBAG *bag) 85 { 86 if (PKCS12_SAFEBAG_get_nid(bag) != NID_certBag) 87 return NULL; 88 if (OBJ_obj2nid(bag->value.bag->type) != NID_x509Certificate) 89 return NULL; 90 return ASN1_item_unpack(bag->value.bag->value.octet, 91 ASN1_ITEM_rptr(X509)); 92 } 93 94 X509_CRL *PKCS12_SAFEBAG_get1_crl(const PKCS12_SAFEBAG *bag) 95 { 96 if (PKCS12_SAFEBAG_get_nid(bag) != NID_crlBag) 97 return NULL; 98 if (OBJ_obj2nid(bag->value.bag->type) != NID_x509Crl) 99 return NULL; 100 return ASN1_item_unpack(bag->value.bag->value.octet, 101 ASN1_ITEM_rptr(X509_CRL)); 102 } 103 104 PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_cert(X509 *x509) 105 { 106 return PKCS12_item_pack_safebag(x509, ASN1_ITEM_rptr(X509), 107 NID_x509Certificate, NID_certBag); 108 } 109 110 PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_crl(X509_CRL *crl) 111 { 112 return PKCS12_item_pack_safebag(crl, ASN1_ITEM_rptr(X509_CRL), 113 NID_x509Crl, NID_crlBag); 114 } 115 116 PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_secret(int type, int vtype, const unsigned char *value, int len) 117 { 118 PKCS12_BAGS *bag; 119 PKCS12_SAFEBAG *safebag; 120 121 if ((bag = PKCS12_BAGS_new()) == NULL) { 122 ERR_raise(ERR_LIB_PKCS12, ERR_R_MALLOC_FAILURE); 123 return NULL; 124 } 125 bag->type = OBJ_nid2obj(type); 126 127 switch(vtype) { 128 case V_ASN1_OCTET_STRING: 129 { 130 ASN1_OCTET_STRING *strtmp = ASN1_OCTET_STRING_new(); 131 132 if (strtmp == NULL) { 133 ERR_raise(ERR_LIB_PKCS12, ERR_R_MALLOC_FAILURE); 134 goto err; 135 } 136 /* Pack data into an octet string */ 137 if (!ASN1_OCTET_STRING_set(strtmp, value, len)) { 138 ASN1_OCTET_STRING_free(strtmp); 139 ERR_raise(ERR_LIB_PKCS12, PKCS12_R_ENCODE_ERROR); 140 goto err; 141 } 142 bag->value.other = ASN1_TYPE_new(); 143 if (bag->value.other == NULL) { 144 ASN1_OCTET_STRING_free(strtmp); 145 ERR_raise(ERR_LIB_PKCS12, ERR_R_MALLOC_FAILURE); 146 goto err; 147 } 148 ASN1_TYPE_set(bag->value.other, vtype, strtmp); 149 } 150 break; 151 152 default: 153 ERR_raise(ERR_LIB_PKCS12, PKCS12_R_INVALID_TYPE); 154 goto err; 155 } 156 157 if ((safebag = PKCS12_SAFEBAG_new()) == NULL) { 158 ERR_raise(ERR_LIB_PKCS12, ERR_R_MALLOC_FAILURE); 159 goto err; 160 } 161 safebag->value.bag = bag; 162 safebag->type = OBJ_nid2obj(NID_secretBag); 163 return safebag; 164 165 err: 166 PKCS12_BAGS_free(bag); 167 return NULL; 168 } 169 170 /* Turn PKCS8 object into a keybag */ 171 172 PKCS12_SAFEBAG *PKCS12_SAFEBAG_create0_p8inf(PKCS8_PRIV_KEY_INFO *p8) 173 { 174 PKCS12_SAFEBAG *bag = PKCS12_SAFEBAG_new(); 175 176 if (bag == NULL) { 177 ERR_raise(ERR_LIB_PKCS12, ERR_R_MALLOC_FAILURE); 178 return NULL; 179 } 180 bag->type = OBJ_nid2obj(NID_keyBag); 181 bag->value.keybag = p8; 182 return bag; 183 } 184 185 /* Turn PKCS8 object into a shrouded keybag */ 186 187 PKCS12_SAFEBAG *PKCS12_SAFEBAG_create0_pkcs8(X509_SIG *p8) 188 { 189 PKCS12_SAFEBAG *bag = PKCS12_SAFEBAG_new(); 190 191 /* Set up the safe bag */ 192 if (bag == NULL) { 193 ERR_raise(ERR_LIB_PKCS12, ERR_R_MALLOC_FAILURE); 194 return NULL; 195 } 196 bag->type = OBJ_nid2obj(NID_pkcs8ShroudedKeyBag); 197 bag->value.shkeybag = p8; 198 return bag; 199 } 200 201 PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_pkcs8_encrypt_ex(int pbe_nid, 202 const char *pass, 203 int passlen, 204 unsigned char *salt, 205 int saltlen, int iter, 206 PKCS8_PRIV_KEY_INFO *p8inf, 207 OSSL_LIB_CTX *ctx, 208 const char *propq) 209 { 210 PKCS12_SAFEBAG *bag = NULL; 211 const EVP_CIPHER *pbe_ciph = NULL; 212 EVP_CIPHER *pbe_ciph_fetch = NULL; 213 X509_SIG *p8; 214 215 ERR_set_mark(); 216 pbe_ciph = pbe_ciph_fetch = EVP_CIPHER_fetch(ctx, OBJ_nid2sn(pbe_nid), propq); 217 if (pbe_ciph == NULL) 218 pbe_ciph = EVP_get_cipherbynid(pbe_nid); 219 ERR_pop_to_mark(); 220 221 if (pbe_ciph != NULL) 222 pbe_nid = -1; 223 224 p8 = PKCS8_encrypt_ex(pbe_nid, pbe_ciph, pass, passlen, salt, saltlen, iter, 225 p8inf, ctx, propq); 226 if (p8 == NULL) 227 goto err; 228 229 bag = PKCS12_SAFEBAG_create0_pkcs8(p8); 230 if (bag == NULL) 231 X509_SIG_free(p8); 232 233 err: 234 EVP_CIPHER_free(pbe_ciph_fetch); 235 return bag; 236 } 237 238 PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_pkcs8_encrypt(int pbe_nid, 239 const char *pass, 240 int passlen, 241 unsigned char *salt, 242 int saltlen, int iter, 243 PKCS8_PRIV_KEY_INFO *p8inf) 244 { 245 return PKCS12_SAFEBAG_create_pkcs8_encrypt_ex(pbe_nid, pass, passlen, 246 salt, saltlen, iter, p8inf, 247 NULL, NULL); 248 } 249