1 /* 2 * Copyright 1995-2017 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <stdio.h> 11 #include "internal/cryptlib.h" 12 #include <openssl/buffer.h> 13 #include <openssl/asn1.h> 14 #include <openssl/evp.h> 15 #include <openssl/x509.h> 16 #include "internal/x509_int.h" 17 #include <openssl/ocsp.h> 18 #include <openssl/rsa.h> 19 #include <openssl/dsa.h> 20 #include <openssl/x509v3.h> 21 22 int X509_verify(X509 *a, EVP_PKEY *r) 23 { 24 if (X509_ALGOR_cmp(&a->sig_alg, &a->cert_info.signature)) 25 return 0; 26 return (ASN1_item_verify(ASN1_ITEM_rptr(X509_CINF), &a->sig_alg, 27 &a->signature, &a->cert_info, r)); 28 } 29 30 int X509_REQ_verify(X509_REQ *a, EVP_PKEY *r) 31 { 32 return (ASN1_item_verify(ASN1_ITEM_rptr(X509_REQ_INFO), 33 &a->sig_alg, a->signature, &a->req_info, r)); 34 } 35 36 int NETSCAPE_SPKI_verify(NETSCAPE_SPKI *a, EVP_PKEY *r) 37 { 38 return (ASN1_item_verify(ASN1_ITEM_rptr(NETSCAPE_SPKAC), 39 &a->sig_algor, a->signature, a->spkac, r)); 40 } 41 42 int X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md) 43 { 44 x->cert_info.enc.modified = 1; 45 return (ASN1_item_sign(ASN1_ITEM_rptr(X509_CINF), &x->cert_info.signature, 46 &x->sig_alg, &x->signature, &x->cert_info, pkey, 47 md)); 48 } 49 50 int X509_sign_ctx(X509 *x, EVP_MD_CTX *ctx) 51 { 52 x->cert_info.enc.modified = 1; 53 return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_CINF), 54 &x->cert_info.signature, 55 &x->sig_alg, &x->signature, &x->cert_info, ctx); 56 } 57 58 #ifndef OPENSSL_NO_OCSP 59 int X509_http_nbio(OCSP_REQ_CTX *rctx, X509 **pcert) 60 { 61 return OCSP_REQ_CTX_nbio_d2i(rctx, 62 (ASN1_VALUE **)pcert, ASN1_ITEM_rptr(X509)); 63 } 64 #endif 65 66 int X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md) 67 { 68 return (ASN1_item_sign(ASN1_ITEM_rptr(X509_REQ_INFO), &x->sig_alg, NULL, 69 x->signature, &x->req_info, pkey, md)); 70 } 71 72 int X509_REQ_sign_ctx(X509_REQ *x, EVP_MD_CTX *ctx) 73 { 74 return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_REQ_INFO), 75 &x->sig_alg, NULL, x->signature, &x->req_info, 76 ctx); 77 } 78 79 int X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md) 80 { 81 x->crl.enc.modified = 1; 82 return (ASN1_item_sign(ASN1_ITEM_rptr(X509_CRL_INFO), &x->crl.sig_alg, 83 &x->sig_alg, &x->signature, &x->crl, pkey, md)); 84 } 85 86 int X509_CRL_sign_ctx(X509_CRL *x, EVP_MD_CTX *ctx) 87 { 88 x->crl.enc.modified = 1; 89 return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_CRL_INFO), 90 &x->crl.sig_alg, &x->sig_alg, &x->signature, 91 &x->crl, ctx); 92 } 93 94 #ifndef OPENSSL_NO_OCSP 95 int X509_CRL_http_nbio(OCSP_REQ_CTX *rctx, X509_CRL **pcrl) 96 { 97 return OCSP_REQ_CTX_nbio_d2i(rctx, 98 (ASN1_VALUE **)pcrl, 99 ASN1_ITEM_rptr(X509_CRL)); 100 } 101 #endif 102 103 int NETSCAPE_SPKI_sign(NETSCAPE_SPKI *x, EVP_PKEY *pkey, const EVP_MD *md) 104 { 105 return (ASN1_item_sign(ASN1_ITEM_rptr(NETSCAPE_SPKAC), &x->sig_algor, NULL, 106 x->signature, x->spkac, pkey, md)); 107 } 108 109 #ifndef OPENSSL_NO_STDIO 110 X509 *d2i_X509_fp(FILE *fp, X509 **x509) 111 { 112 return ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509), fp, x509); 113 } 114 115 int i2d_X509_fp(FILE *fp, X509 *x509) 116 { 117 return ASN1_item_i2d_fp(ASN1_ITEM_rptr(X509), fp, x509); 118 } 119 #endif 120 121 X509 *d2i_X509_bio(BIO *bp, X509 **x509) 122 { 123 return ASN1_item_d2i_bio(ASN1_ITEM_rptr(X509), bp, x509); 124 } 125 126 int i2d_X509_bio(BIO *bp, X509 *x509) 127 { 128 return ASN1_item_i2d_bio(ASN1_ITEM_rptr(X509), bp, x509); 129 } 130 131 #ifndef OPENSSL_NO_STDIO 132 X509_CRL *d2i_X509_CRL_fp(FILE *fp, X509_CRL **crl) 133 { 134 return ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509_CRL), fp, crl); 135 } 136 137 int i2d_X509_CRL_fp(FILE *fp, X509_CRL *crl) 138 { 139 return ASN1_item_i2d_fp(ASN1_ITEM_rptr(X509_CRL), fp, crl); 140 } 141 #endif 142 143 X509_CRL *d2i_X509_CRL_bio(BIO *bp, X509_CRL **crl) 144 { 145 return ASN1_item_d2i_bio(ASN1_ITEM_rptr(X509_CRL), bp, crl); 146 } 147 148 int i2d_X509_CRL_bio(BIO *bp, X509_CRL *crl) 149 { 150 return ASN1_item_i2d_bio(ASN1_ITEM_rptr(X509_CRL), bp, crl); 151 } 152 153 #ifndef OPENSSL_NO_STDIO 154 PKCS7 *d2i_PKCS7_fp(FILE *fp, PKCS7 **p7) 155 { 156 return ASN1_item_d2i_fp(ASN1_ITEM_rptr(PKCS7), fp, p7); 157 } 158 159 int i2d_PKCS7_fp(FILE *fp, PKCS7 *p7) 160 { 161 return ASN1_item_i2d_fp(ASN1_ITEM_rptr(PKCS7), fp, p7); 162 } 163 #endif 164 165 PKCS7 *d2i_PKCS7_bio(BIO *bp, PKCS7 **p7) 166 { 167 return ASN1_item_d2i_bio(ASN1_ITEM_rptr(PKCS7), bp, p7); 168 } 169 170 int i2d_PKCS7_bio(BIO *bp, PKCS7 *p7) 171 { 172 return ASN1_item_i2d_bio(ASN1_ITEM_rptr(PKCS7), bp, p7); 173 } 174 175 #ifndef OPENSSL_NO_STDIO 176 X509_REQ *d2i_X509_REQ_fp(FILE *fp, X509_REQ **req) 177 { 178 return ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509_REQ), fp, req); 179 } 180 181 int i2d_X509_REQ_fp(FILE *fp, X509_REQ *req) 182 { 183 return ASN1_item_i2d_fp(ASN1_ITEM_rptr(X509_REQ), fp, req); 184 } 185 #endif 186 187 X509_REQ *d2i_X509_REQ_bio(BIO *bp, X509_REQ **req) 188 { 189 return ASN1_item_d2i_bio(ASN1_ITEM_rptr(X509_REQ), bp, req); 190 } 191 192 int i2d_X509_REQ_bio(BIO *bp, X509_REQ *req) 193 { 194 return ASN1_item_i2d_bio(ASN1_ITEM_rptr(X509_REQ), bp, req); 195 } 196 197 #ifndef OPENSSL_NO_RSA 198 199 # ifndef OPENSSL_NO_STDIO 200 RSA *d2i_RSAPrivateKey_fp(FILE *fp, RSA **rsa) 201 { 202 return ASN1_item_d2i_fp(ASN1_ITEM_rptr(RSAPrivateKey), fp, rsa); 203 } 204 205 int i2d_RSAPrivateKey_fp(FILE *fp, RSA *rsa) 206 { 207 return ASN1_item_i2d_fp(ASN1_ITEM_rptr(RSAPrivateKey), fp, rsa); 208 } 209 210 RSA *d2i_RSAPublicKey_fp(FILE *fp, RSA **rsa) 211 { 212 return ASN1_item_d2i_fp(ASN1_ITEM_rptr(RSAPublicKey), fp, rsa); 213 } 214 215 RSA *d2i_RSA_PUBKEY_fp(FILE *fp, RSA **rsa) 216 { 217 return ASN1_d2i_fp((void *(*)(void)) 218 RSA_new, (D2I_OF(void)) d2i_RSA_PUBKEY, fp, 219 (void **)rsa); 220 } 221 222 int i2d_RSAPublicKey_fp(FILE *fp, RSA *rsa) 223 { 224 return ASN1_item_i2d_fp(ASN1_ITEM_rptr(RSAPublicKey), fp, rsa); 225 } 226 227 int i2d_RSA_PUBKEY_fp(FILE *fp, RSA *rsa) 228 { 229 return ASN1_i2d_fp((I2D_OF(void))i2d_RSA_PUBKEY, fp, rsa); 230 } 231 # endif 232 233 RSA *d2i_RSAPrivateKey_bio(BIO *bp, RSA **rsa) 234 { 235 return ASN1_item_d2i_bio(ASN1_ITEM_rptr(RSAPrivateKey), bp, rsa); 236 } 237 238 int i2d_RSAPrivateKey_bio(BIO *bp, RSA *rsa) 239 { 240 return ASN1_item_i2d_bio(ASN1_ITEM_rptr(RSAPrivateKey), bp, rsa); 241 } 242 243 RSA *d2i_RSAPublicKey_bio(BIO *bp, RSA **rsa) 244 { 245 return ASN1_item_d2i_bio(ASN1_ITEM_rptr(RSAPublicKey), bp, rsa); 246 } 247 248 RSA *d2i_RSA_PUBKEY_bio(BIO *bp, RSA **rsa) 249 { 250 return ASN1_d2i_bio_of(RSA, RSA_new, d2i_RSA_PUBKEY, bp, rsa); 251 } 252 253 int i2d_RSAPublicKey_bio(BIO *bp, RSA *rsa) 254 { 255 return ASN1_item_i2d_bio(ASN1_ITEM_rptr(RSAPublicKey), bp, rsa); 256 } 257 258 int i2d_RSA_PUBKEY_bio(BIO *bp, RSA *rsa) 259 { 260 return ASN1_i2d_bio_of(RSA, i2d_RSA_PUBKEY, bp, rsa); 261 } 262 #endif 263 264 #ifndef OPENSSL_NO_DSA 265 # ifndef OPENSSL_NO_STDIO 266 DSA *d2i_DSAPrivateKey_fp(FILE *fp, DSA **dsa) 267 { 268 return ASN1_d2i_fp_of(DSA, DSA_new, d2i_DSAPrivateKey, fp, dsa); 269 } 270 271 int i2d_DSAPrivateKey_fp(FILE *fp, DSA *dsa) 272 { 273 return ASN1_i2d_fp_of_const(DSA, i2d_DSAPrivateKey, fp, dsa); 274 } 275 276 DSA *d2i_DSA_PUBKEY_fp(FILE *fp, DSA **dsa) 277 { 278 return ASN1_d2i_fp_of(DSA, DSA_new, d2i_DSA_PUBKEY, fp, dsa); 279 } 280 281 int i2d_DSA_PUBKEY_fp(FILE *fp, DSA *dsa) 282 { 283 return ASN1_i2d_fp_of(DSA, i2d_DSA_PUBKEY, fp, dsa); 284 } 285 # endif 286 287 DSA *d2i_DSAPrivateKey_bio(BIO *bp, DSA **dsa) 288 { 289 return ASN1_d2i_bio_of(DSA, DSA_new, d2i_DSAPrivateKey, bp, dsa); 290 } 291 292 int i2d_DSAPrivateKey_bio(BIO *bp, DSA *dsa) 293 { 294 return ASN1_i2d_bio_of_const(DSA, i2d_DSAPrivateKey, bp, dsa); 295 } 296 297 DSA *d2i_DSA_PUBKEY_bio(BIO *bp, DSA **dsa) 298 { 299 return ASN1_d2i_bio_of(DSA, DSA_new, d2i_DSA_PUBKEY, bp, dsa); 300 } 301 302 int i2d_DSA_PUBKEY_bio(BIO *bp, DSA *dsa) 303 { 304 return ASN1_i2d_bio_of(DSA, i2d_DSA_PUBKEY, bp, dsa); 305 } 306 307 #endif 308 309 #ifndef OPENSSL_NO_EC 310 # ifndef OPENSSL_NO_STDIO 311 EC_KEY *d2i_EC_PUBKEY_fp(FILE *fp, EC_KEY **eckey) 312 { 313 return ASN1_d2i_fp_of(EC_KEY, EC_KEY_new, d2i_EC_PUBKEY, fp, eckey); 314 } 315 316 int i2d_EC_PUBKEY_fp(FILE *fp, EC_KEY *eckey) 317 { 318 return ASN1_i2d_fp_of(EC_KEY, i2d_EC_PUBKEY, fp, eckey); 319 } 320 321 EC_KEY *d2i_ECPrivateKey_fp(FILE *fp, EC_KEY **eckey) 322 { 323 return ASN1_d2i_fp_of(EC_KEY, EC_KEY_new, d2i_ECPrivateKey, fp, eckey); 324 } 325 326 int i2d_ECPrivateKey_fp(FILE *fp, EC_KEY *eckey) 327 { 328 return ASN1_i2d_fp_of(EC_KEY, i2d_ECPrivateKey, fp, eckey); 329 } 330 # endif 331 EC_KEY *d2i_EC_PUBKEY_bio(BIO *bp, EC_KEY **eckey) 332 { 333 return ASN1_d2i_bio_of(EC_KEY, EC_KEY_new, d2i_EC_PUBKEY, bp, eckey); 334 } 335 336 int i2d_EC_PUBKEY_bio(BIO *bp, EC_KEY *ecdsa) 337 { 338 return ASN1_i2d_bio_of(EC_KEY, i2d_EC_PUBKEY, bp, ecdsa); 339 } 340 341 EC_KEY *d2i_ECPrivateKey_bio(BIO *bp, EC_KEY **eckey) 342 { 343 return ASN1_d2i_bio_of(EC_KEY, EC_KEY_new, d2i_ECPrivateKey, bp, eckey); 344 } 345 346 int i2d_ECPrivateKey_bio(BIO *bp, EC_KEY *eckey) 347 { 348 return ASN1_i2d_bio_of(EC_KEY, i2d_ECPrivateKey, bp, eckey); 349 } 350 #endif 351 352 int X509_pubkey_digest(const X509 *data, const EVP_MD *type, 353 unsigned char *md, unsigned int *len) 354 { 355 ASN1_BIT_STRING *key; 356 key = X509_get0_pubkey_bitstr(data); 357 if (!key) 358 return 0; 359 return EVP_Digest(key->data, key->length, md, len, type, NULL); 360 } 361 362 int X509_digest(const X509 *data, const EVP_MD *type, unsigned char *md, 363 unsigned int *len) 364 { 365 if (type == EVP_sha1() && (data->ex_flags & EXFLAG_SET) != 0) { 366 /* Asking for SHA1 and we already computed it. */ 367 if (len != NULL) 368 *len = sizeof(data->sha1_hash); 369 memcpy(md, data->sha1_hash, sizeof(data->sha1_hash)); 370 return 1; 371 } 372 return (ASN1_item_digest 373 (ASN1_ITEM_rptr(X509), type, (char *)data, md, len)); 374 } 375 376 int X509_CRL_digest(const X509_CRL *data, const EVP_MD *type, 377 unsigned char *md, unsigned int *len) 378 { 379 if (type == EVP_sha1() && (data->flags & EXFLAG_SET) != 0) { 380 /* Asking for SHA1; always computed in CRL d2i. */ 381 if (len != NULL) 382 *len = sizeof(data->sha1_hash); 383 memcpy(md, data->sha1_hash, sizeof(data->sha1_hash)); 384 return 1; 385 } 386 return (ASN1_item_digest 387 (ASN1_ITEM_rptr(X509_CRL), type, (char *)data, md, len)); 388 } 389 390 int X509_REQ_digest(const X509_REQ *data, const EVP_MD *type, 391 unsigned char *md, unsigned int *len) 392 { 393 return (ASN1_item_digest 394 (ASN1_ITEM_rptr(X509_REQ), type, (char *)data, md, len)); 395 } 396 397 int X509_NAME_digest(const X509_NAME *data, const EVP_MD *type, 398 unsigned char *md, unsigned int *len) 399 { 400 return (ASN1_item_digest 401 (ASN1_ITEM_rptr(X509_NAME), type, (char *)data, md, len)); 402 } 403 404 int PKCS7_ISSUER_AND_SERIAL_digest(PKCS7_ISSUER_AND_SERIAL *data, 405 const EVP_MD *type, unsigned char *md, 406 unsigned int *len) 407 { 408 return (ASN1_item_digest(ASN1_ITEM_rptr(PKCS7_ISSUER_AND_SERIAL), type, 409 (char *)data, md, len)); 410 } 411 412 #ifndef OPENSSL_NO_STDIO 413 X509_SIG *d2i_PKCS8_fp(FILE *fp, X509_SIG **p8) 414 { 415 return ASN1_d2i_fp_of(X509_SIG, X509_SIG_new, d2i_X509_SIG, fp, p8); 416 } 417 418 int i2d_PKCS8_fp(FILE *fp, X509_SIG *p8) 419 { 420 return ASN1_i2d_fp_of(X509_SIG, i2d_X509_SIG, fp, p8); 421 } 422 #endif 423 424 X509_SIG *d2i_PKCS8_bio(BIO *bp, X509_SIG **p8) 425 { 426 return ASN1_d2i_bio_of(X509_SIG, X509_SIG_new, d2i_X509_SIG, bp, p8); 427 } 428 429 int i2d_PKCS8_bio(BIO *bp, X509_SIG *p8) 430 { 431 return ASN1_i2d_bio_of(X509_SIG, i2d_X509_SIG, bp, p8); 432 } 433 434 #ifndef OPENSSL_NO_STDIO 435 PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO_fp(FILE *fp, 436 PKCS8_PRIV_KEY_INFO **p8inf) 437 { 438 return ASN1_d2i_fp_of(PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_new, 439 d2i_PKCS8_PRIV_KEY_INFO, fp, p8inf); 440 } 441 442 int i2d_PKCS8_PRIV_KEY_INFO_fp(FILE *fp, PKCS8_PRIV_KEY_INFO *p8inf) 443 { 444 return ASN1_i2d_fp_of(PKCS8_PRIV_KEY_INFO, i2d_PKCS8_PRIV_KEY_INFO, fp, 445 p8inf); 446 } 447 448 int i2d_PKCS8PrivateKeyInfo_fp(FILE *fp, EVP_PKEY *key) 449 { 450 PKCS8_PRIV_KEY_INFO *p8inf; 451 int ret; 452 p8inf = EVP_PKEY2PKCS8(key); 453 if (!p8inf) 454 return 0; 455 ret = i2d_PKCS8_PRIV_KEY_INFO_fp(fp, p8inf); 456 PKCS8_PRIV_KEY_INFO_free(p8inf); 457 return ret; 458 } 459 460 int i2d_PrivateKey_fp(FILE *fp, EVP_PKEY *pkey) 461 { 462 return ASN1_i2d_fp_of(EVP_PKEY, i2d_PrivateKey, fp, pkey); 463 } 464 465 EVP_PKEY *d2i_PrivateKey_fp(FILE *fp, EVP_PKEY **a) 466 { 467 return ASN1_d2i_fp_of(EVP_PKEY, EVP_PKEY_new, d2i_AutoPrivateKey, fp, a); 468 } 469 470 int i2d_PUBKEY_fp(FILE *fp, EVP_PKEY *pkey) 471 { 472 return ASN1_i2d_fp_of(EVP_PKEY, i2d_PUBKEY, fp, pkey); 473 } 474 475 EVP_PKEY *d2i_PUBKEY_fp(FILE *fp, EVP_PKEY **a) 476 { 477 return ASN1_d2i_fp_of(EVP_PKEY, EVP_PKEY_new, d2i_PUBKEY, fp, a); 478 } 479 480 #endif 481 482 PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO_bio(BIO *bp, 483 PKCS8_PRIV_KEY_INFO **p8inf) 484 { 485 return ASN1_d2i_bio_of(PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_new, 486 d2i_PKCS8_PRIV_KEY_INFO, bp, p8inf); 487 } 488 489 int i2d_PKCS8_PRIV_KEY_INFO_bio(BIO *bp, PKCS8_PRIV_KEY_INFO *p8inf) 490 { 491 return ASN1_i2d_bio_of(PKCS8_PRIV_KEY_INFO, i2d_PKCS8_PRIV_KEY_INFO, bp, 492 p8inf); 493 } 494 495 int i2d_PKCS8PrivateKeyInfo_bio(BIO *bp, EVP_PKEY *key) 496 { 497 PKCS8_PRIV_KEY_INFO *p8inf; 498 int ret; 499 p8inf = EVP_PKEY2PKCS8(key); 500 if (!p8inf) 501 return 0; 502 ret = i2d_PKCS8_PRIV_KEY_INFO_bio(bp, p8inf); 503 PKCS8_PRIV_KEY_INFO_free(p8inf); 504 return ret; 505 } 506 507 int i2d_PrivateKey_bio(BIO *bp, EVP_PKEY *pkey) 508 { 509 return ASN1_i2d_bio_of(EVP_PKEY, i2d_PrivateKey, bp, pkey); 510 } 511 512 EVP_PKEY *d2i_PrivateKey_bio(BIO *bp, EVP_PKEY **a) 513 { 514 return ASN1_d2i_bio_of(EVP_PKEY, EVP_PKEY_new, d2i_AutoPrivateKey, bp, a); 515 } 516 517 int i2d_PUBKEY_bio(BIO *bp, EVP_PKEY *pkey) 518 { 519 return ASN1_i2d_bio_of(EVP_PKEY, i2d_PUBKEY, bp, pkey); 520 } 521 522 EVP_PKEY *d2i_PUBKEY_bio(BIO *bp, EVP_PKEY **a) 523 { 524 return ASN1_d2i_bio_of(EVP_PKEY, EVP_PKEY_new, d2i_PUBKEY, bp, a); 525 } 526