OpenSolaris_b135/common/net/wanboot/p12access.c
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License, Version 1.0 only
* (the "License"). You may not use this file except in compliance
* with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* or http://www.opensolaris.org/os/licensing.
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* This file includes interfaces to be used together with SSL to get PKCS#12
* certs and pass them to SSL. They replace similar functions for PEM,
* already provided for within SSL.
*
* The interfaces included here are:
* sunw_p12_use_certfile - gets the user's cert from a pkcs12 file & pass
* it to SSL.
* sunw_p12_use_keyfile - gets the RSA private key from a pkcs12 file and
* pass it to SSL
* sunw_p12_use_trustfile - read the pkcs12 trust anchor (aka certificate
* authority certs) file into memory and hand them off to SSL.
*
* These functions use the sunw_PKCS12_parse to read the certs.
*
* Copyright 2002-2003 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
#pragma ident "%Z%%M% %I% %E% SMI"
#include <stdio.h>
#include <strings.h>
#include <stdlib.h>
#include <sys/stat.h>
#include <unistd.h>
#include <openssl/crypto.h>
#include <openssl/err.h>
#include <openssl/x509.h>
#include <openssl/ssl.h>
#include <openssl/pkcs12.h>
#include <p12access.h>
#include <p12err.h>
static PKCS12 *p12_read_file(char *);
static int p12_doparse(PKCS12 *, char *, int, EVP_PKEY **,
X509 **, STACK_OF(X509) **);
static int checkfile(char *);
static int check_password(PKCS12 *, char *);
/*
* sunw_use_x509cert - pass an x509 client certificate to ssl
*
* Arguments:
* ctx - SSL's context structure
* cert - Certificate to pass in x509 format
*
* Returns:
* <=0 - Error occurred. Check the error stack for specifics.
* >0 - Success. Cert was successfully added.
*/
static int
sunw_use_x509cert(SSL_CTX *ctx, X509 *cert)
{
ERR_clear_error();
if (ctx == NULL || cert == NULL) {
SUNWerr(SUNW_F_USE_X509CERT, SUNW_R_INVALID_ARG);
return (-1);
}
if (SSL_CTX_use_certificate(ctx, cert) != 1) {
SUNWerr(SUNW_F_USE_X509CERT, SUNW_R_CERT_ERR);
return (-1);
}
return (1);
}
/*
* sunw_use_pkey - pass an EVP_PKEY private key to ssl
*
* Arguments:
* ctx - SSL's context structure
* pkey - EVP_PKEY formatted private key
*
* Returns:
* <=0 - Error occurred. Check the error stack for specifics.
* >0 - Success.
*/
static int
sunw_use_pkey(SSL_CTX *ctx, EVP_PKEY *pkey)
{
ERR_clear_error();
if (ctx == NULL || pkey == NULL) {
SUNWerr(SUNW_F_USE_PKEY, SUNW_R_INVALID_ARG);
return (-1);
}
if (SSL_CTX_use_PrivateKey(ctx, pkey) != 1) {
SUNWerr(SUNW_F_USE_PKEY, SUNW_R_PKEY_ERR);
return (-1);
}
return (1);
}
/*
* sunw_use_tastore - take a stack of X509 certs and add them to the
* SSL store of trust anchors (aka CA certs).
*
* This function takes the certs in the stack and passes them into
* SSL for addition to the cache of TA certs.
*
* Arguments:
* ctx - SSL's context structure
* ta_certs - Stack of certs to add to the list of SSL trust anchors.
*
* Returns:
* <=0 - Error occurred. Check the error stack for specifics.
* >0 - Success. Certs were successfully added.
*/
static int
sunw_use_tastore(SSL_CTX *ctx, STACK_OF(X509) *ta_certs)
{
X509 *tmp;
int ret = -1;
int i;
ERR_clear_error();
if (ctx == NULL || ctx->cert_store == NULL || ta_certs == NULL) {
SUNWerr(SUNW_F_USE_TASTORE, SUNW_R_INVALID_ARG);
return (-1);
}
if (sk_X509_num(ta_certs) == 0) {
SUNWerr(SUNW_F_USE_TASTORE, SUNW_R_NO_TRUST_ANCHOR);
return (-1);
}
for (i = 0; i < sk_X509_num(ta_certs); i++) {
tmp = sk_X509_value(ta_certs, i);
ret = X509_STORE_add_cert(ctx->cert_store, tmp);
if (ret == 0) {
if (ERR_GET_REASON(ERR_peek_error()) ==
X509_R_CERT_ALREADY_IN_HASH_TABLE) {
ERR_clear_error();
continue;
}
SUNWerr(SUNW_F_USE_TASTORE, SUNW_R_ADD_TRUST_ERR);
return (-1);
} else if (ret < 0) {
break;
}
}
if (ret < 0) {
SUNWerr(SUNW_F_USE_TASTORE, SUNW_R_ADD_TRUST_ERR);
}
return (ret);
}
/*
* sunw_p12_use_certfile - read a client certificate from a pkcs12 file and
* pass it in to SSL.
*
* Read in the certificate in pkcs12-formated file. Use the provided
* passphrase to decrypt it. Pass the cert to SSL.
*
* Arguments:
* ctx - SSL's context structure
* filename - Name of file with the client certificate.
* passwd - Passphrase for pkcs12 data.
*
* Returns:
* <=0 - Error occurred. Check the error stack for specifics.
* >0 - Success. Cert was successfully added.
*/
int
sunw_p12_use_certfile(SSL_CTX *ctx, char *filename, char *passwd)
{
PKCS12 *p12 = NULL;
X509 *cert = NULL;
int ret = -1;
ERR_clear_error();
if (ctx == NULL || filename == NULL) {
SUNWerr(SUNW_F_USE_CERTFILE, SUNW_R_INVALID_ARG);
return (-1);
}
p12 = p12_read_file(filename);
if (p12 != NULL) {
ret = p12_doparse(p12, passwd, DO_UNMATCHING, NULL,
&cert, NULL);
if (ret > 0 && cert != NULL) {
if (sunw_use_x509cert(ctx, cert) == -1) {
/*
* Error already on stack
*/
ret = -1;
}
}
}
if (p12 != NULL)
PKCS12_free(p12);
if (ret == -1 && cert != NULL) {
X509_free(cert);
cert = NULL;
}
return (ret);
}
/*
* sunw_p12_use_keyfile - read a RSA private key from a pkcs12 file and pass
* it in to SSL.
*
* Read in the RSA private key in pkcs12 format. Use the provided
* passphrase to decrypt it. Pass the cert to SSL.
*
* Arguments:
* ctx - SSL's context structure
* filename - Name of file with private key.
* passwd - Passphrase for pkcs12 data.
*
* Returns:
* <=0 - Error occurred. Check the error stack for specifics.
* >0 - Success. Key was successfully added.
*/
int
sunw_p12_use_keyfile(SSL_CTX *ctx, char *filename, char *passwd)
{
EVP_PKEY *pkey = NULL;
PKCS12 *p12 = NULL;
int ret = -1;
ERR_clear_error();
if (ctx == NULL || filename == NULL) {
SUNWerr(SUNW_F_USE_KEYFILE, SUNW_R_INVALID_ARG);
return (-1);
}
p12 = p12_read_file(filename);
if (p12 != NULL) {
ret = p12_doparse(p12, passwd, DO_UNMATCHING, &pkey, NULL,
NULL);
if (ret > 0 && pkey != NULL) {
if (sunw_use_pkey(ctx, pkey) != 1) {
/*
* Error already on stack
*/
ret = -1;
}
} else {
SUNWerr(SUNW_F_USE_KEYFILE, SUNW_R_BAD_PKEY);
}
} else {
SUNWerr(SUNW_F_USE_KEYFILE, SUNW_R_PKEY_READ_ERR);
}
if (p12 != NULL)
PKCS12_free(p12);
if (ret == -1 && pkey != NULL) {
sunw_evp_pkey_free(pkey);
pkey = NULL;
}
return (ret);
}
/*
* sunw_p12_use_trustfile - read a list of trustanchors from a pkcs12 file and
* pass the stack in to SSL.
*
* Read in the trust anchors from pkcs12-formated file. Use the provided
* passphrase to decrypt it. Pass the cert to SSL.
*
* Arguments:
* ctx - SSL's context structure
* filename - Name of file with the certificates.
* passwd - Passphrase for pkcs12 data.
*
* Returns:
* <=0 - Error occurred. Check the error stack for specifics.
* >0 - Success. Trust anchors were successfully added.
*/
int
sunw_p12_use_trustfile(SSL_CTX *ctx, char *filename, char *passwd)
{
PKCS12 *p12 = NULL;
STACK_OF(X509) *ta_sk = NULL;
int ret = -1;
ERR_clear_error();
if (ctx == NULL || filename == NULL) {
SUNWerr(SUNW_F_USE_TRUSTFILE, SUNW_R_INVALID_ARG);
return (-1);
}
p12 = p12_read_file(filename);
if (p12 != NULL) {
ret = p12_doparse(p12, passwd, DO_NONE, NULL, NULL,
&ta_sk);
if (ret > 0 && ta_sk != NULL)
ret = sunw_use_tastore(ctx, ta_sk);
else {
SUNWerr(SUNW_F_USE_TRUSTFILE, SUNW_R_BAD_TRUST);
ret = -1;
}
} else {
SUNWerr(SUNW_F_USE_TRUSTFILE, SUNW_R_READ_TRUST_ERR);
}
if (p12 != NULL)
PKCS12_free(p12);
if (ta_sk != NULL)
sk_X509_pop_free(ta_sk, X509_free);
return (ret);
}
/*
* p12_read_file - read a pkcs12 file and get its contents. Return the
* pkcs12 structures.
*
* Arguments:
* filename - Name of file with the client certificate.
*
*
* Returns:
* NULL - Error occurred. Check the error stack for specifics.
* != NULL - Success. The return value is the address of a pkcs12
* structure.
*/
static PKCS12 *
p12_read_file(char *filename)
{
PKCS12 *p12 = NULL;
FILE *fp = NULL;
int ret = 0;
ERR_clear_error();
if (checkfile(filename) == -1) {
/*
* Error already on stack
*/
return (NULL);
}
if ((fp = fopen(filename, "r")) == 0) {
SYSerr(SYS_F_FOPEN, errno);
return (NULL);
}
p12 = d2i_PKCS12_fp(fp, NULL);
if (p12 == NULL) {
SUNWerr(SUNW_F_READ_FILE, SUNW_R_READ_ERR);
ret = -1;
}
if (fp != NULL)
(void) fclose(fp);
if (ret == -1 && p12 != NULL) {
PKCS12_free(p12);
p12 = NULL;
}
return (p12);
}
/*
* p12_doparse - Given a pkcs12 structure, check the passphrase and then
* parse it.
*
* Arguments:
* p12 - Structure with pkcs12 data which has been read in
* passwd - Passphrase for pkcs12 data & key.
* matchty - How to decide which matching entry to take... See the
* DO_* definitions for valid values.
* pkey - Points at pointer to private key structure.
* cert - Points at pointer to client certificate structure
* ca - Points at pointer to list of CA certs
*
* Returns:
* <=0 - Error occurred. Check the error stack for specifics.
* >0 - Success. Bits set reflect the kind of information
* returned. (See the FOUND_* definitions.)
*/
static int
p12_doparse(PKCS12 *p12, char *passwd, int matchty,
EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca)
{
int ret = 0;
ERR_clear_error();
/*
* Check passphrase (including null one).
*/
if (check_password(p12, passwd) == 0) {
SUNWerr(SUNW_F_DOPARSE, SUNW_R_MAC_VERIFY_FAILURE);
return (-1);
}
ret = sunw_PKCS12_parse(p12, passwd, matchty, NULL, 0, NULL,
pkey, cert, ca);
if (ret <= 0) {
/*
* Error already on stack
*/
return (-1);
}
return (ret);
}
/*
* checkfile - given a file name, verify that the file exists and is
* readable.
*/
/* ARGSUSED */
static int
checkfile(char *filename)
{
#ifndef _BOOT
struct stat sbuf;
if (access(filename, R_OK) == -1 || stat(filename, &sbuf) == -1) {
SYSerr(SYS_F_FOPEN, errno);
return (-1);
}
if (!S_ISREG(sbuf.st_mode)) {
SUNWerr(SUNW_F_CHECKFILE, SUNW_R_BAD_FILETYPE);
return (-1);
}
#endif
return (0);
}
/*
* check_password - do various password checks to see if the current password
* will work or we need to prompt for a new one.
*
* Arguments:
* pass - password to check
*
* Returns:
* 1 - Password is OK.
* 0 - Password not valid. Error stack was set - use ERR_get_error() to
* to get the error.
*/
static int
check_password(PKCS12 *p12, char *pass)
{
int ret = 1;
/*
* If password is zero length or NULL then try verifying both cases
* to determine which password is correct. The reason for this is that
* under PKCS#12 password based encryption no password and a zero
* length password are two different things. Otherwise, calling
* PKCS12_verify_mac() with a length of -1 means that the length
* can be determined via strlen().
*/
/* Check the mac */
if (pass == NULL || *pass == '\0') {
if (PKCS12_verify_mac(p12, NULL, 0) == 0 &&
PKCS12_verify_mac(p12, "", 0) == 0)
ret = 0;
} else if (PKCS12_verify_mac(p12, pass, -1) == 0) {
ret = 0;
}
return (ret);
}