1 /* 2 * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved. 3 * 4 * Use is subject to license terms. 5 */ 6 /* 7 * Copyright (c) 2012, OmniTI Computer Consulting, Inc. All rights reserved. 8 */ 9 /* 10 * Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL 11 * project 2000. 12 */ 13 /* 14 * ==================================================================== 15 * Copyright (c) 2000-2004 The OpenSSL Project. All rights reserved. 16 * 17 * Redistribution and use in source and binary forms, with or without 18 * modification, are permitted provided that the following conditions 19 * are met: 20 * 21 * 1. Redistributions of source code must retain the above copyright 22 * notice, this list of conditions and the following disclaimer. 23 * 24 * 2. Redistributions in binary form must reproduce the above copyright 25 * notice, this list of conditions and the following disclaimer in 26 * the documentation and/or other materials provided with the 27 * distribution. 28 * 29 * 3. All advertising materials mentioning features or use of this 30 * software must display the following acknowledgment: 31 * "This product includes software developed by the OpenSSL Project 32 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 33 * 34 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 35 * endorse or promote products derived from this software without 36 * prior written permission. For written permission, please contact 37 * licensing@OpenSSL.org. 38 * 39 * 5. Products derived from this software may not be called "OpenSSL" 40 * nor may "OpenSSL" appear in their names without prior written 41 * permission of the OpenSSL Project. 42 * 43 * 6. Redistributions of any form whatsoever must retain the following 44 * acknowledgment: 45 * "This product includes software developed by the OpenSSL Project 46 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 47 * 48 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 49 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 51 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 52 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 53 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 54 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 55 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 56 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 57 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 58 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 59 * OF THE POSSIBILITY OF SUCH DAMAGE. 60 * ==================================================================== 61 * 62 * This product includes cryptographic software written by Eric Young 63 * (eay@cryptsoft.com). This product includes software written by Tim 64 * Hudson (tjh@cryptsoft.com). 65 * 66 */ 67 68 #include <stdlib.h> 69 #include <kmfapiP.h> 70 #include <ber_der.h> 71 #include <fcntl.h> 72 #include <sys/stat.h> 73 #include <dirent.h> 74 #include <cryptoutil.h> 75 #include <synch.h> 76 #include <thread.h> 77 78 /* OPENSSL related headers */ 79 #include <openssl/bio.h> 80 #include <openssl/bn.h> 81 #include <openssl/asn1.h> 82 #include <openssl/err.h> 83 #include <openssl/bn.h> 84 #include <openssl/x509.h> 85 #include <openssl/rsa.h> 86 #include <openssl/dsa.h> 87 #include <openssl/x509v3.h> 88 #include <openssl/objects.h> 89 #include <openssl/pem.h> 90 #include <openssl/pkcs12.h> 91 #include <openssl/ocsp.h> 92 #include <openssl/des.h> 93 #include <openssl/rand.h> 94 95 #define PRINT_ANY_EXTENSION (\ 96 KMF_X509_EXT_KEY_USAGE |\ 97 KMF_X509_EXT_CERT_POLICIES |\ 98 KMF_X509_EXT_SUBJALTNAME |\ 99 KMF_X509_EXT_BASIC_CONSTRAINTS |\ 100 KMF_X509_EXT_NAME_CONSTRAINTS |\ 101 KMF_X509_EXT_POLICY_CONSTRAINTS |\ 102 KMF_X509_EXT_EXT_KEY_USAGE |\ 103 KMF_X509_EXT_INHIBIT_ANY_POLICY |\ 104 KMF_X509_EXT_AUTH_KEY_ID |\ 105 KMF_X509_EXT_SUBJ_KEY_ID |\ 106 KMF_X509_EXT_POLICY_MAPPING) 107 108 static uchar_t P[] = { 0x00, 0x8d, 0xf2, 0xa4, 0x94, 0x49, 0x22, 0x76, 109 0xaa, 0x3d, 0x25, 0x75, 0x9b, 0xb0, 0x68, 0x69, 110 0xcb, 0xea, 0xc0, 0xd8, 0x3a, 0xfb, 0x8d, 0x0c, 111 0xf7, 0xcb, 0xb8, 0x32, 0x4f, 0x0d, 0x78, 0x82, 112 0xe5, 0xd0, 0x76, 0x2f, 0xc5, 0xb7, 0x21, 0x0e, 113 0xaf, 0xc2, 0xe9, 0xad, 0xac, 0x32, 0xab, 0x7a, 114 0xac, 0x49, 0x69, 0x3d, 0xfb, 0xf8, 0x37, 0x24, 115 0xc2, 0xec, 0x07, 0x36, 0xee, 0x31, 0xc8, 0x02, 116 0x91 }; 117 118 static uchar_t Q[] = { 0x00, 0xc7, 0x73, 0x21, 0x8c, 0x73, 0x7e, 0xc8, 119 0xee, 0x99, 0x3b, 0x4f, 0x2d, 0xed, 0x30, 0xf4, 120 0x8e, 0xda, 0xce, 0x91, 0x5f }; 121 122 static uchar_t G[] = { 0x00, 0x62, 0x6d, 0x02, 0x78, 0x39, 0xea, 0x0a, 123 0x13, 0x41, 0x31, 0x63, 0xa5, 0x5b, 0x4c, 0xb5, 124 0x00, 0x29, 0x9d, 0x55, 0x22, 0x95, 0x6c, 0xef, 125 0xcb, 0x3b, 0xff, 0x10, 0xf3, 0x99, 0xce, 0x2c, 126 0x2e, 0x71, 0xcb, 0x9d, 0xe5, 0xfa, 0x24, 0xba, 127 0xbf, 0x58, 0xe5, 0xb7, 0x95, 0x21, 0x92, 0x5c, 128 0x9c, 0xc4, 0x2e, 0x9f, 0x6f, 0x46, 0x4b, 0x08, 129 0x8c, 0xc5, 0x72, 0xaf, 0x53, 0xe6, 0xd7, 0x88, 130 0x02 }; 131 132 #define SET_ERROR(h, c) h->lasterr.kstype = KMF_KEYSTORE_OPENSSL; \ 133 h->lasterr.errcode = c; 134 135 #define SET_SYS_ERROR(h, c) h->lasterr.kstype = -1; h->lasterr.errcode = c; 136 137 /* 138 * Declare some new macros for managing stacks of EVP_PKEYS, similar to 139 * what wanboot did. 140 */ 141 DECLARE_STACK_OF(EVP_PKEY) 142 143 #define sk_EVP_PKEY_new_null() SKM_sk_new_null(EVP_PKEY) 144 #define sk_EVP_PKEY_free(st) SKM_sk_free(EVP_PKEY, (st)) 145 #define sk_EVP_PKEY_num(st) SKM_sk_num(EVP_PKEY, (st)) 146 #define sk_EVP_PKEY_value(st, i) SKM_sk_value(EVP_PKEY, (st), (i)) 147 #define sk_EVP_PKEY_push(st, val) SKM_sk_push(EVP_PKEY, (st), (val)) 148 #define sk_EVP_PKEY_pop_free(st, free_func) SKM_sk_pop_free(EVP_PKEY, (st), \ 149 (free_func)) 150 151 mutex_t init_lock = DEFAULTMUTEX; 152 static int ssl_initialized = 0; 153 static BIO *bio_err = NULL; 154 155 static int 156 test_for_file(char *, mode_t); 157 static KMF_RETURN 158 openssl_parse_bag(PKCS12_SAFEBAG *, char *, int, 159 STACK_OF(EVP_PKEY) *, STACK_OF(X509) *); 160 161 static KMF_RETURN 162 local_export_pk12(KMF_HANDLE_T, KMF_CREDENTIAL *, int, KMF_X509_DER_CERT *, 163 int, KMF_KEY_HANDLE *, char *); 164 165 static KMF_RETURN set_pkey_attrib(EVP_PKEY *, ASN1_TYPE *, int); 166 167 static KMF_RETURN 168 extract_pem(KMF_HANDLE *, char *, char *, KMF_BIGINT *, char *, 169 CK_UTF8CHAR *, CK_ULONG, EVP_PKEY **, KMF_DATA **, int *); 170 171 static KMF_RETURN 172 kmf_load_cert(KMF_HANDLE *, char *, char *, KMF_BIGINT *, KMF_CERT_VALIDITY, 173 char *, KMF_DATA *); 174 175 static KMF_RETURN 176 load_certs(KMF_HANDLE *, char *, char *, KMF_BIGINT *, KMF_CERT_VALIDITY, 177 char *, KMF_DATA **, uint32_t *); 178 179 static KMF_RETURN 180 sslBN2KMFBN(BIGNUM *, KMF_BIGINT *); 181 182 static EVP_PKEY * 183 ImportRawRSAKey(KMF_RAW_RSA_KEY *); 184 185 static KMF_RETURN 186 convertToRawKey(EVP_PKEY *, KMF_RAW_KEY_DATA *); 187 188 KMF_RETURN 189 OpenSSL_FindCert(KMF_HANDLE_T, int, KMF_ATTRIBUTE *); 190 191 void 192 OpenSSL_FreeKMFCert(KMF_HANDLE_T, KMF_X509_DER_CERT *); 193 194 KMF_RETURN 195 OpenSSL_StoreCert(KMF_HANDLE_T handle, int, KMF_ATTRIBUTE *); 196 197 KMF_RETURN 198 OpenSSL_DeleteCert(KMF_HANDLE_T handle, int, KMF_ATTRIBUTE *); 199 200 KMF_RETURN 201 OpenSSL_CreateKeypair(KMF_HANDLE_T, int, KMF_ATTRIBUTE *); 202 203 KMF_RETURN 204 OpenSSL_StoreKey(KMF_HANDLE_T, int, KMF_ATTRIBUTE *); 205 206 KMF_RETURN 207 OpenSSL_EncodePubKeyData(KMF_HANDLE_T, KMF_KEY_HANDLE *, KMF_DATA *); 208 209 KMF_RETURN 210 OpenSSL_SignData(KMF_HANDLE_T, KMF_KEY_HANDLE *, KMF_OID *, 211 KMF_DATA *, KMF_DATA *); 212 213 KMF_RETURN 214 OpenSSL_DeleteKey(KMF_HANDLE_T, int, KMF_ATTRIBUTE *); 215 216 KMF_RETURN 217 OpenSSL_ImportCRL(KMF_HANDLE_T, int, KMF_ATTRIBUTE *); 218 219 KMF_RETURN 220 OpenSSL_DeleteCRL(KMF_HANDLE_T, int, KMF_ATTRIBUTE *); 221 222 KMF_RETURN 223 OpenSSL_ListCRL(KMF_HANDLE_T, int, KMF_ATTRIBUTE *); 224 225 KMF_RETURN 226 OpenSSL_FindCertInCRL(KMF_HANDLE_T, int, KMF_ATTRIBUTE *); 227 228 KMF_RETURN 229 OpenSSL_CertGetPrintable(KMF_HANDLE_T, const KMF_DATA *, 230 KMF_PRINTABLE_ITEM, char *); 231 232 KMF_RETURN 233 OpenSSL_GetErrorString(KMF_HANDLE_T, char **); 234 235 KMF_RETURN 236 OpenSSL_FindPrikeyByCert(KMF_HANDLE_T, int, KMF_ATTRIBUTE *); 237 238 KMF_RETURN 239 OpenSSL_DecryptData(KMF_HANDLE_T, KMF_KEY_HANDLE *, KMF_OID *, 240 KMF_DATA *, KMF_DATA *); 241 242 KMF_RETURN 243 OpenSSL_CreateOCSPRequest(KMF_HANDLE_T, int, KMF_ATTRIBUTE *); 244 245 KMF_RETURN 246 OpenSSL_GetOCSPStatusForCert(KMF_HANDLE_T, int, KMF_ATTRIBUTE *); 247 248 KMF_RETURN 249 OpenSSL_FindKey(KMF_HANDLE_T, int, KMF_ATTRIBUTE *); 250 251 KMF_RETURN 252 OpenSSL_ExportPK12(KMF_HANDLE_T, int, KMF_ATTRIBUTE *); 253 254 KMF_RETURN 255 OpenSSL_CreateSymKey(KMF_HANDLE_T, int, KMF_ATTRIBUTE *); 256 257 KMF_RETURN 258 OpenSSL_GetSymKeyValue(KMF_HANDLE_T, KMF_KEY_HANDLE *, KMF_RAW_SYM_KEY *); 259 260 KMF_RETURN 261 OpenSSL_VerifyCRLFile(KMF_HANDLE_T, char *, KMF_DATA *); 262 263 KMF_RETURN 264 OpenSSL_CheckCRLDate(KMF_HANDLE_T, char *); 265 266 static 267 KMF_PLUGIN_FUNCLIST openssl_plugin_table = 268 { 269 1, /* Version */ 270 NULL, /* ConfigureKeystore */ 271 OpenSSL_FindCert, 272 OpenSSL_FreeKMFCert, 273 OpenSSL_StoreCert, 274 NULL, /* ImportCert */ 275 OpenSSL_ImportCRL, 276 OpenSSL_DeleteCert, 277 OpenSSL_DeleteCRL, 278 OpenSSL_CreateKeypair, 279 OpenSSL_FindKey, 280 OpenSSL_EncodePubKeyData, 281 OpenSSL_SignData, 282 OpenSSL_DeleteKey, 283 OpenSSL_ListCRL, 284 NULL, /* FindCRL */ 285 OpenSSL_FindCertInCRL, 286 OpenSSL_GetErrorString, 287 OpenSSL_FindPrikeyByCert, 288 OpenSSL_DecryptData, 289 OpenSSL_ExportPK12, 290 OpenSSL_CreateSymKey, 291 OpenSSL_GetSymKeyValue, 292 NULL, /* SetTokenPin */ 293 OpenSSL_StoreKey, 294 NULL /* Finalize */ 295 }; 296 297 static mutex_t *lock_cs; 298 static long *lock_count; 299 300 static void 301 /* ARGSUSED1 */ 302 locking_cb(int mode, int type, char *file, int line) 303 { 304 if (mode & CRYPTO_LOCK) { 305 (void) mutex_lock(&(lock_cs[type])); 306 lock_count[type]++; 307 } else { 308 (void) mutex_unlock(&(lock_cs[type])); 309 } 310 } 311 312 static unsigned long 313 thread_id() 314 { 315 return ((unsigned long)thr_self()); 316 } 317 318 KMF_PLUGIN_FUNCLIST * 319 KMF_Plugin_Initialize() 320 { 321 int i; 322 323 (void) mutex_lock(&init_lock); 324 if (!ssl_initialized) { 325 /* 326 * Add support for extension OIDs that are not yet in the 327 * openssl default set. 328 */ 329 (void) OBJ_create("2.5.29.30", "nameConstraints", 330 "X509v3 Name Constraints"); 331 (void) OBJ_create("2.5.29.33", "policyMappings", 332 "X509v3 Policy Mappings"); 333 (void) OBJ_create("2.5.29.36", "policyConstraints", 334 "X509v3 Policy Constraints"); 335 (void) OBJ_create("2.5.29.46", "freshestCRL", 336 "X509v3 Freshest CRL"); 337 (void) OBJ_create("2.5.29.54", "inhibitAnyPolicy", 338 "X509v3 Inhibit Any-Policy"); 339 /* 340 * Set up for thread-safe operation. 341 */ 342 lock_cs = OPENSSL_malloc(CRYPTO_num_locks() * sizeof (mutex_t)); 343 if (lock_cs == NULL) { 344 (void) mutex_unlock(&init_lock); 345 return (NULL); 346 } 347 348 lock_count = OPENSSL_malloc(CRYPTO_num_locks() * sizeof (long)); 349 if (lock_count == NULL) { 350 OPENSSL_free(lock_cs); 351 (void) mutex_unlock(&init_lock); 352 return (NULL); 353 } 354 355 for (i = 0; i < CRYPTO_num_locks(); i++) { 356 lock_count[i] = 0; 357 (void) mutex_init(&lock_cs[i], USYNC_THREAD, NULL); 358 } 359 360 CRYPTO_set_id_callback((unsigned long (*)())thread_id); 361 if (CRYPTO_get_locking_callback() == NULL) 362 CRYPTO_set_locking_callback((void (*)())locking_cb); 363 364 OpenSSL_add_all_algorithms(); 365 366 /* Enable error strings for reporting */ 367 ERR_load_crypto_strings(); 368 369 ssl_initialized = 1; 370 } 371 (void) mutex_unlock(&init_lock); 372 373 return (&openssl_plugin_table); 374 } 375 /* 376 * Convert an SSL DN to a KMF DN. 377 */ 378 static KMF_RETURN 379 get_x509_dn(X509_NAME *sslDN, KMF_X509_NAME *kmfDN) 380 { 381 KMF_DATA derdata; 382 KMF_RETURN rv = KMF_OK; 383 uchar_t *tmp; 384 385 /* Convert to raw DER format */ 386 derdata.Length = i2d_X509_NAME(sslDN, NULL); 387 if ((tmp = derdata.Data = (uchar_t *)OPENSSL_malloc(derdata.Length)) 388 == NULL) { 389 return (KMF_ERR_MEMORY); 390 } 391 (void) i2d_X509_NAME(sslDN, &tmp); 392 393 /* Decode to KMF format */ 394 rv = DerDecodeName(&derdata, kmfDN); 395 if (rv != KMF_OK) { 396 rv = KMF_ERR_BAD_CERT_FORMAT; 397 } 398 OPENSSL_free(derdata.Data); 399 400 return (rv); 401 } 402 403 int 404 isdir(char *path) 405 { 406 struct stat s; 407 408 if (stat(path, &s) == -1) 409 return (0); 410 411 return ((s.st_mode & S_IFMT) == S_IFDIR); 412 } 413 414 static KMF_RETURN 415 ssl_cert2KMFDATA(KMF_HANDLE *kmfh, X509 *x509cert, KMF_DATA *cert) 416 { 417 KMF_RETURN rv = KMF_OK; 418 unsigned char *buf = NULL, *p; 419 int len; 420 421 /* 422 * Convert the X509 internal struct to DER encoded data 423 */ 424 if ((len = i2d_X509(x509cert, NULL)) < 0) { 425 SET_ERROR(kmfh, ERR_get_error()); 426 rv = KMF_ERR_BAD_CERT_FORMAT; 427 goto cleanup; 428 } 429 if ((buf = malloc(len)) == NULL) { 430 SET_SYS_ERROR(kmfh, errno); 431 rv = KMF_ERR_MEMORY; 432 goto cleanup; 433 } 434 435 /* 436 * i2d_X509 will increment the buf pointer so that we need to 437 * save it. 438 */ 439 p = buf; 440 if ((len = i2d_X509(x509cert, &p)) < 0) { 441 SET_ERROR(kmfh, ERR_get_error()); 442 free(buf); 443 rv = KMF_ERR_BAD_CERT_FORMAT; 444 goto cleanup; 445 } 446 447 /* caller's responsibility to free it */ 448 cert->Data = buf; 449 cert->Length = len; 450 451 cleanup: 452 if (rv != KMF_OK) { 453 if (buf) 454 free(buf); 455 cert->Data = NULL; 456 cert->Length = 0; 457 } 458 459 return (rv); 460 } 461 462 463 static KMF_RETURN 464 check_cert(X509 *xcert, char *issuer, char *subject, KMF_BIGINT *serial, 465 boolean_t *match) 466 { 467 KMF_RETURN rv = KMF_OK; 468 boolean_t findIssuer = FALSE; 469 boolean_t findSubject = FALSE; 470 boolean_t findSerial = FALSE; 471 KMF_X509_NAME issuerDN, subjectDN; 472 KMF_X509_NAME certIssuerDN, certSubjectDN; 473 474 *match = FALSE; 475 if (xcert == NULL) { 476 return (KMF_ERR_BAD_PARAMETER); 477 } 478 479 (void) memset(&issuerDN, 0, sizeof (KMF_X509_NAME)); 480 (void) memset(&subjectDN, 0, sizeof (KMF_X509_NAME)); 481 (void) memset(&certIssuerDN, 0, sizeof (KMF_X509_NAME)); 482 (void) memset(&certSubjectDN, 0, sizeof (KMF_X509_NAME)); 483 484 if (issuer != NULL && strlen(issuer)) { 485 rv = kmf_dn_parser(issuer, &issuerDN); 486 if (rv != KMF_OK) 487 return (KMF_ERR_BAD_PARAMETER); 488 489 rv = get_x509_dn(xcert->cert_info->issuer, &certIssuerDN); 490 if (rv != KMF_OK) { 491 kmf_free_dn(&issuerDN); 492 return (KMF_ERR_BAD_PARAMETER); 493 } 494 495 findIssuer = TRUE; 496 } 497 if (subject != NULL && strlen(subject)) { 498 rv = kmf_dn_parser(subject, &subjectDN); 499 if (rv != KMF_OK) { 500 rv = KMF_ERR_BAD_PARAMETER; 501 goto cleanup; 502 } 503 504 rv = get_x509_dn(xcert->cert_info->subject, &certSubjectDN); 505 if (rv != KMF_OK) { 506 rv = KMF_ERR_BAD_PARAMETER; 507 goto cleanup; 508 } 509 findSubject = TRUE; 510 } 511 if (serial != NULL && serial->val != NULL) 512 findSerial = TRUE; 513 514 if (findSerial) { 515 BIGNUM *bn; 516 517 /* Comparing BIGNUMs is a pain! */ 518 bn = ASN1_INTEGER_to_BN(xcert->cert_info->serialNumber, NULL); 519 if (bn != NULL) { 520 int bnlen = BN_num_bytes(bn); 521 522 if (bnlen == serial->len) { 523 uchar_t *a = malloc(bnlen); 524 if (a == NULL) { 525 rv = KMF_ERR_MEMORY; 526 BN_free(bn); 527 goto cleanup; 528 } 529 bnlen = BN_bn2bin(bn, a); 530 *match = (memcmp(a, serial->val, serial->len) == 531 0); 532 rv = KMF_OK; 533 free(a); 534 } 535 BN_free(bn); 536 if (!(*match)) 537 goto cleanup; 538 } else { 539 rv = KMF_OK; 540 goto cleanup; 541 } 542 } 543 if (findIssuer) { 544 *match = (kmf_compare_rdns(&issuerDN, &certIssuerDN) == 0); 545 if ((*match) == B_FALSE) { 546 /* stop checking and bail */ 547 rv = KMF_OK; 548 goto cleanup; 549 } 550 } 551 if (findSubject) { 552 *match = (kmf_compare_rdns(&subjectDN, &certSubjectDN) == 0); 553 if ((*match) == B_FALSE) { 554 /* stop checking and bail */ 555 rv = KMF_OK; 556 goto cleanup; 557 } 558 } 559 560 *match = TRUE; 561 cleanup: 562 if (findIssuer) { 563 kmf_free_dn(&issuerDN); 564 kmf_free_dn(&certIssuerDN); 565 } 566 if (findSubject) { 567 kmf_free_dn(&subjectDN); 568 kmf_free_dn(&certSubjectDN); 569 } 570 571 return (rv); 572 } 573 574 575 /* 576 * This function loads a certificate file into an X509 data structure, and 577 * checks if its issuer, subject or the serial number matches with those 578 * values. If it matches, then return the X509 data structure. 579 */ 580 static KMF_RETURN 581 load_X509cert(KMF_HANDLE *kmfh, 582 char *issuer, char *subject, KMF_BIGINT *serial, 583 char *pathname, X509 **outcert) 584 { 585 KMF_RETURN rv = KMF_OK; 586 X509 *xcert = NULL; 587 BIO *bcert = NULL; 588 boolean_t match = FALSE; 589 KMF_ENCODE_FORMAT format; 590 591 /* 592 * auto-detect the file format, regardless of what 593 * the 'format' parameters in the params say. 594 */ 595 rv = kmf_get_file_format(pathname, &format); 596 if (rv != KMF_OK) { 597 if (rv == KMF_ERR_OPEN_FILE) 598 rv = KMF_ERR_CERT_NOT_FOUND; 599 return (rv); 600 } 601 602 /* Not ASN1(DER) format */ 603 if ((bcert = BIO_new_file(pathname, "rb")) == NULL) { 604 SET_ERROR(kmfh, ERR_get_error()); 605 rv = KMF_ERR_OPEN_FILE; 606 goto cleanup; 607 } 608 609 if (format == KMF_FORMAT_PEM) 610 xcert = PEM_read_bio_X509_AUX(bcert, NULL, NULL, NULL); 611 else if (format == KMF_FORMAT_ASN1) 612 xcert = d2i_X509_bio(bcert, NULL); 613 else if (format == KMF_FORMAT_PKCS12) { 614 PKCS12 *p12 = d2i_PKCS12_bio(bcert, NULL); 615 if (p12 != NULL) { 616 (void) PKCS12_parse(p12, NULL, NULL, &xcert, NULL); 617 PKCS12_free(p12); 618 p12 = NULL; 619 } else { 620 SET_ERROR(kmfh, ERR_get_error()); 621 rv = KMF_ERR_BAD_CERT_FORMAT; 622 } 623 } else { 624 rv = KMF_ERR_BAD_PARAMETER; 625 goto cleanup; 626 } 627 628 if (xcert == NULL) { 629 SET_ERROR(kmfh, ERR_get_error()); 630 rv = KMF_ERR_BAD_CERT_FORMAT; 631 goto cleanup; 632 } 633 634 if (check_cert(xcert, issuer, subject, serial, &match) != KMF_OK || 635 match == FALSE) { 636 rv = KMF_ERR_CERT_NOT_FOUND; 637 goto cleanup; 638 } 639 640 if (outcert != NULL) { 641 *outcert = xcert; 642 } 643 644 cleanup: 645 if (bcert != NULL) (void) BIO_free(bcert); 646 if (rv != KMF_OK && xcert != NULL) 647 X509_free(xcert); 648 649 return (rv); 650 } 651 652 static int 653 datacmp(const void *a, const void *b) 654 { 655 KMF_DATA *adata = (KMF_DATA *)a; 656 KMF_DATA *bdata = (KMF_DATA *)b; 657 if (adata->Length > bdata->Length) 658 return (-1); 659 if (adata->Length < bdata->Length) 660 return (1); 661 return (0); 662 } 663 664 static KMF_RETURN 665 load_certs(KMF_HANDLE *kmfh, char *issuer, char *subject, KMF_BIGINT *serial, 666 KMF_CERT_VALIDITY validity, char *pathname, 667 KMF_DATA **certlist, uint32_t *numcerts) 668 { 669 KMF_RETURN rv = KMF_OK; 670 int i; 671 KMF_DATA *certs = NULL; 672 int nc = 0; 673 int hits = 0; 674 KMF_ENCODE_FORMAT format; 675 676 rv = kmf_get_file_format(pathname, &format); 677 if (rv != KMF_OK) { 678 if (rv == KMF_ERR_OPEN_FILE) 679 rv = KMF_ERR_CERT_NOT_FOUND; 680 return (rv); 681 } 682 if (format == KMF_FORMAT_ASN1) { 683 /* load a single certificate */ 684 certs = (KMF_DATA *)malloc(sizeof (KMF_DATA)); 685 if (certs == NULL) 686 return (KMF_ERR_MEMORY); 687 certs->Data = NULL; 688 certs->Length = 0; 689 rv = kmf_load_cert(kmfh, issuer, subject, serial, validity, 690 pathname, certs); 691 if (rv == KMF_OK) { 692 *certlist = certs; 693 *numcerts = 1; 694 } else { 695 kmf_free_data(certs); 696 free(certs); 697 certs = NULL; 698 } 699 return (rv); 700 } else if (format == KMF_FORMAT_PKCS12) { 701 /* We need a credential to access a PKCS#12 file */ 702 rv = KMF_ERR_BAD_CERT_FORMAT; 703 } else if (format == KMF_FORMAT_PEM || 704 format != KMF_FORMAT_PEM_KEYPAIR) { 705 706 /* This function only works on PEM files */ 707 rv = extract_pem(kmfh, issuer, subject, serial, pathname, 708 (uchar_t *)NULL, 0, NULL, &certs, &nc); 709 } else { 710 return (KMF_ERR_ENCODING); 711 } 712 713 if (rv != KMF_OK) 714 return (rv); 715 716 for (i = 0; i < nc; i++) { 717 if (validity == KMF_NONEXPIRED_CERTS) { 718 rv = kmf_check_cert_date(kmfh, &certs[i]); 719 } else if (validity == KMF_EXPIRED_CERTS) { 720 rv = kmf_check_cert_date(kmfh, &certs[i]); 721 if (rv == KMF_OK) 722 rv = KMF_ERR_CERT_NOT_FOUND; 723 if (rv == KMF_ERR_VALIDITY_PERIOD) 724 rv = KMF_OK; 725 } 726 if (rv != KMF_OK) { 727 /* Remove this cert from the list by clearing it. */ 728 kmf_free_data(&certs[i]); 729 } else { 730 hits++; /* count valid certs found */ 731 } 732 rv = KMF_OK; 733 } 734 if (rv == KMF_OK && hits > 0) { 735 /* 736 * Sort the list of certs by length to put the cleared ones 737 * at the end so they don't get accessed by the caller. 738 */ 739 qsort((void *)certs, nc, sizeof (KMF_DATA), datacmp); 740 *certlist = certs; 741 742 /* since we sorted the list, just return the number of hits */ 743 *numcerts = hits; 744 } else { 745 if (rv == KMF_OK && hits == 0) 746 rv = KMF_ERR_CERT_NOT_FOUND; 747 if (certs != NULL) { 748 free(certs); 749 certs = NULL; 750 } 751 } 752 return (rv); 753 } 754 755 static KMF_RETURN 756 kmf_load_cert(KMF_HANDLE *kmfh, 757 char *issuer, char *subject, KMF_BIGINT *serial, 758 KMF_CERT_VALIDITY validity, 759 char *pathname, 760 KMF_DATA *cert) 761 { 762 KMF_RETURN rv = KMF_OK; 763 X509 *x509cert = NULL; 764 765 rv = load_X509cert(kmfh, issuer, subject, serial, pathname, &x509cert); 766 if (rv == KMF_OK && x509cert != NULL && cert != NULL) { 767 rv = ssl_cert2KMFDATA(kmfh, x509cert, cert); 768 if (rv != KMF_OK) { 769 goto cleanup; 770 } 771 if (validity == KMF_NONEXPIRED_CERTS) { 772 rv = kmf_check_cert_date(kmfh, cert); 773 } else if (validity == KMF_EXPIRED_CERTS) { 774 rv = kmf_check_cert_date(kmfh, cert); 775 if (rv == KMF_OK) { 776 /* 777 * This is a valid cert so skip it. 778 */ 779 rv = KMF_ERR_CERT_NOT_FOUND; 780 } 781 if (rv == KMF_ERR_VALIDITY_PERIOD) { 782 /* 783 * We want to return success when we 784 * find an invalid cert. 785 */ 786 rv = KMF_OK; 787 goto cleanup; 788 } 789 } 790 } 791 cleanup: 792 if (x509cert != NULL) 793 X509_free(x509cert); 794 795 return (rv); 796 } 797 798 static KMF_RETURN 799 readAltFormatPrivateKey(KMF_DATA *filedata, EVP_PKEY **pkey) 800 { 801 KMF_RETURN ret = KMF_OK; 802 KMF_RAW_RSA_KEY rsa; 803 BerElement *asn1 = NULL; 804 BerValue filebuf; 805 BerValue OID = { NULL, 0 }; 806 BerValue *Mod = NULL, *PubExp = NULL; 807 BerValue *PriExp = NULL, *Prime1 = NULL, *Prime2 = NULL; 808 BerValue *Coef = NULL; 809 BIGNUM *D = NULL, *P = NULL, *Q = NULL, *COEF = NULL; 810 BIGNUM *Exp1 = NULL, *Exp2 = NULL, *pminus1 = NULL; 811 BIGNUM *qminus1 = NULL; 812 BN_CTX *ctx = NULL; 813 814 *pkey = NULL; 815 816 filebuf.bv_val = (char *)filedata->Data; 817 filebuf.bv_len = filedata->Length; 818 819 asn1 = kmfder_init(&filebuf); 820 if (asn1 == NULL) { 821 ret = KMF_ERR_MEMORY; 822 goto out; 823 } 824 825 if (kmfber_scanf(asn1, "{{Dn{IIIIII}}}", 826 &OID, &Mod, &PubExp, &PriExp, &Prime1, 827 &Prime2, &Coef) == -1) { 828 ret = KMF_ERR_ENCODING; 829 goto out; 830 } 831 832 /* 833 * We have to derive the 2 Exponents using Bignumber math. 834 * Exp1 = PriExp mod (Prime1 - 1) 835 * Exp2 = PriExp mod (Prime2 - 1) 836 */ 837 838 /* D = PrivateExponent */ 839 D = BN_bin2bn((const uchar_t *)PriExp->bv_val, PriExp->bv_len, D); 840 if (D == NULL) { 841 ret = KMF_ERR_MEMORY; 842 goto out; 843 } 844 845 /* P = Prime1 (first prime factor of Modulus) */ 846 P = BN_bin2bn((const uchar_t *)Prime1->bv_val, Prime1->bv_len, P); 847 if (D == NULL) { 848 ret = KMF_ERR_MEMORY; 849 goto out; 850 } 851 852 /* Q = Prime2 (second prime factor of Modulus) */ 853 Q = BN_bin2bn((const uchar_t *)Prime2->bv_val, Prime2->bv_len, Q); 854 855 if ((ctx = BN_CTX_new()) == NULL) { 856 ret = KMF_ERR_MEMORY; 857 goto out; 858 } 859 860 /* Compute (P - 1) */ 861 pminus1 = BN_new(); 862 (void) BN_sub(pminus1, P, BN_value_one()); 863 864 /* Exponent1 = D mod (P - 1) */ 865 Exp1 = BN_new(); 866 (void) BN_mod(Exp1, D, pminus1, ctx); 867 868 /* Compute (Q - 1) */ 869 qminus1 = BN_new(); 870 (void) BN_sub(qminus1, Q, BN_value_one()); 871 872 /* Exponent2 = D mod (Q - 1) */ 873 Exp2 = BN_new(); 874 (void) BN_mod(Exp2, D, qminus1, ctx); 875 876 /* Coef = (Inverse Q) mod P */ 877 COEF = BN_new(); 878 (void) BN_mod_inverse(COEF, Q, P, ctx); 879 880 /* Convert back to KMF format */ 881 (void) memset(&rsa, 0, sizeof (rsa)); 882 883 if ((ret = sslBN2KMFBN(Exp1, &rsa.exp1)) != KMF_OK) 884 goto out; 885 if ((ret = sslBN2KMFBN(Exp2, &rsa.exp2)) != KMF_OK) 886 goto out; 887 if ((ret = sslBN2KMFBN(COEF, &rsa.coef)) != KMF_OK) 888 goto out; 889 890 rsa.mod.val = (uchar_t *)Mod->bv_val; 891 rsa.mod.len = Mod->bv_len; 892 893 rsa.pubexp.val = (uchar_t *)PubExp->bv_val; 894 rsa.pubexp.len = PubExp->bv_len; 895 896 rsa.priexp.val = (uchar_t *)PriExp->bv_val; 897 rsa.priexp.len = PriExp->bv_len; 898 899 rsa.prime1.val = (uchar_t *)Prime1->bv_val; 900 rsa.prime1.len = Prime1->bv_len; 901 902 rsa.prime2.val = (uchar_t *)Prime2->bv_val; 903 rsa.prime2.len = Prime2->bv_len; 904 905 *pkey = ImportRawRSAKey(&rsa); 906 out: 907 if (asn1 != NULL) 908 kmfber_free(asn1, 1); 909 910 if (OID.bv_val) { 911 free(OID.bv_val); 912 } 913 if (PriExp) 914 free(PriExp); 915 916 if (Mod) 917 free(Mod); 918 919 if (PubExp) 920 free(PubExp); 921 922 if (Coef) { 923 (void) memset(Coef->bv_val, 0, Coef->bv_len); 924 free(Coef->bv_val); 925 free(Coef); 926 } 927 if (Prime1) 928 free(Prime1); 929 if (Prime2) 930 free(Prime2); 931 932 if (ctx != NULL) 933 BN_CTX_free(ctx); 934 935 if (D) 936 BN_clear_free(D); 937 if (P) 938 BN_clear_free(P); 939 if (Q) 940 BN_clear_free(Q); 941 if (pminus1) 942 BN_clear_free(pminus1); 943 if (qminus1) 944 BN_clear_free(qminus1); 945 if (Exp1) 946 BN_clear_free(Exp1); 947 if (Exp2) 948 BN_clear_free(Exp2); 949 950 return (ret); 951 952 } 953 954 static EVP_PKEY * 955 openssl_load_key(KMF_HANDLE_T handle, const char *file) 956 { 957 BIO *keyfile = NULL; 958 EVP_PKEY *pkey = NULL; 959 KMF_HANDLE *kmfh = (KMF_HANDLE *)handle; 960 KMF_ENCODE_FORMAT format; 961 KMF_RETURN rv; 962 KMF_DATA filedata; 963 964 if (file == NULL) { 965 return (NULL); 966 } 967 968 if (kmf_get_file_format((char *)file, &format) != KMF_OK) 969 return (NULL); 970 971 keyfile = BIO_new_file(file, "rb"); 972 if (keyfile == NULL) { 973 goto end; 974 } 975 976 if (format == KMF_FORMAT_ASN1) { 977 pkey = d2i_PrivateKey_bio(keyfile, NULL); 978 if (pkey == NULL) { 979 980 (void) BIO_free(keyfile); 981 keyfile = NULL; 982 /* Try odd ASN.1 variations */ 983 rv = kmf_read_input_file(kmfh, (char *)file, 984 &filedata); 985 if (rv == KMF_OK) { 986 (void) readAltFormatPrivateKey(&filedata, 987 &pkey); 988 kmf_free_data(&filedata); 989 } 990 } 991 } else if (format == KMF_FORMAT_PEM || 992 format == KMF_FORMAT_PEM_KEYPAIR) { 993 pkey = PEM_read_bio_PrivateKey(keyfile, NULL, NULL, NULL); 994 if (pkey == NULL) { 995 KMF_DATA derdata; 996 /* 997 * Check if this is the alt. format 998 * RSA private key file. 999 */ 1000 rv = kmf_read_input_file(kmfh, (char *)file, 1001 &filedata); 1002 if (rv == KMF_OK) { 1003 uchar_t *d = NULL; 1004 int len; 1005 rv = kmf_pem_to_der(filedata.Data, 1006 filedata.Length, &d, &len); 1007 if (rv == KMF_OK && d != NULL) { 1008 derdata.Data = d; 1009 derdata.Length = (size_t)len; 1010 (void) readAltFormatPrivateKey( 1011 &derdata, &pkey); 1012 free(d); 1013 } 1014 kmf_free_data(&filedata); 1015 } 1016 } 1017 } 1018 1019 end: 1020 if (pkey == NULL) 1021 SET_ERROR(kmfh, ERR_get_error()); 1022 1023 if (keyfile != NULL) 1024 (void) BIO_free(keyfile); 1025 1026 return (pkey); 1027 } 1028 1029 KMF_RETURN 1030 OpenSSL_FindCert(KMF_HANDLE_T handle, int numattr, KMF_ATTRIBUTE *attrlist) 1031 { 1032 KMF_RETURN rv = KMF_OK; 1033 KMF_HANDLE *kmfh = (KMF_HANDLE *)handle; 1034 int i, n; 1035 uint32_t maxcerts = 0; 1036 uint32_t *num_certs; 1037 KMF_X509_DER_CERT *kmf_cert = NULL; 1038 char *dirpath = NULL; 1039 char *filename = NULL; 1040 char *fullpath = NULL; 1041 char *issuer = NULL; 1042 char *subject = NULL; 1043 KMF_BIGINT *serial = NULL; 1044 KMF_CERT_VALIDITY validity; 1045 1046 num_certs = kmf_get_attr_ptr(KMF_COUNT_ATTR, attrlist, numattr); 1047 if (num_certs == NULL) 1048 return (KMF_ERR_BAD_PARAMETER); 1049 1050 /* num_certs should reference the size of kmf_cert */ 1051 maxcerts = *num_certs; 1052 if (maxcerts == 0) 1053 maxcerts = 0xFFFFFFFF; 1054 *num_certs = 0; 1055 1056 /* Get the optional returned certificate list */ 1057 kmf_cert = kmf_get_attr_ptr(KMF_X509_DER_CERT_ATTR, attrlist, 1058 numattr); 1059 1060 /* 1061 * The dirpath attribute and the filename attribute can not be NULL 1062 * at the same time. 1063 */ 1064 dirpath = kmf_get_attr_ptr(KMF_DIRPATH_ATTR, attrlist, numattr); 1065 filename = kmf_get_attr_ptr(KMF_CERT_FILENAME_ATTR, attrlist, 1066 numattr); 1067 1068 fullpath = get_fullpath(dirpath, filename); 1069 if (fullpath == NULL) 1070 return (KMF_ERR_BAD_PARAMETER); 1071 1072 /* Get optional search criteria attributes */ 1073 issuer = kmf_get_attr_ptr(KMF_ISSUER_NAME_ATTR, attrlist, numattr); 1074 subject = kmf_get_attr_ptr(KMF_SUBJECT_NAME_ATTR, attrlist, numattr); 1075 serial = kmf_get_attr_ptr(KMF_BIGINT_ATTR, attrlist, numattr); 1076 rv = kmf_get_attr(KMF_CERT_VALIDITY_ATTR, attrlist, numattr, 1077 &validity, NULL); 1078 if (rv != KMF_OK) { 1079 validity = KMF_ALL_CERTS; 1080 rv = KMF_OK; 1081 } 1082 1083 if (isdir(fullpath)) { 1084 DIR *dirp; 1085 struct dirent *dp; 1086 1087 n = 0; 1088 /* open all files in the directory and attempt to read them */ 1089 if ((dirp = opendir(fullpath)) == NULL) { 1090 return (KMF_ERR_BAD_PARAMETER); 1091 } 1092 while ((dp = readdir(dirp)) != NULL) { 1093 char *fname; 1094 KMF_DATA *certlist = NULL; 1095 uint32_t loaded_certs = 0; 1096 1097 if (strcmp(dp->d_name, ".") == 0 || 1098 strcmp(dp->d_name, "..") == 0) 1099 continue; 1100 1101 fname = get_fullpath(fullpath, (char *)&dp->d_name); 1102 1103 rv = load_certs(kmfh, issuer, subject, serial, 1104 validity, fname, &certlist, &loaded_certs); 1105 1106 if (rv != KMF_OK) { 1107 free(fname); 1108 if (certlist != NULL) { 1109 for (i = 0; i < loaded_certs; i++) 1110 kmf_free_data(&certlist[i]); 1111 free(certlist); 1112 } 1113 continue; 1114 } 1115 1116 /* If load succeeds, add certdata to the list */ 1117 if (kmf_cert != NULL) { 1118 for (i = 0; i < loaded_certs && 1119 n < maxcerts; i++) { 1120 kmf_cert[n].certificate.Data = 1121 certlist[i].Data; 1122 kmf_cert[n].certificate.Length = 1123 certlist[i].Length; 1124 1125 kmf_cert[n].kmf_private.keystore_type = 1126 KMF_KEYSTORE_OPENSSL; 1127 kmf_cert[n].kmf_private.flags = 1128 KMF_FLAG_CERT_VALID; 1129 kmf_cert[n].kmf_private.label = 1130 strdup(fname); 1131 n++; 1132 } 1133 /* 1134 * If maxcerts < loaded_certs, clean up the 1135 * certs that were not used. 1136 */ 1137 for (; i < loaded_certs; i++) 1138 kmf_free_data(&certlist[i]); 1139 } else { 1140 for (i = 0; i < loaded_certs; i++) 1141 kmf_free_data(&certlist[i]); 1142 n += loaded_certs; 1143 } 1144 free(certlist); 1145 free(fname); 1146 } 1147 (*num_certs) = n; 1148 if (*num_certs == 0) 1149 rv = KMF_ERR_CERT_NOT_FOUND; 1150 if (*num_certs > 0) 1151 rv = KMF_OK; 1152 exit: 1153 (void) closedir(dirp); 1154 } else { 1155 KMF_DATA *certlist = NULL; 1156 uint32_t loaded_certs = 0; 1157 1158 rv = load_certs(kmfh, issuer, subject, serial, validity, 1159 fullpath, &certlist, &loaded_certs); 1160 if (rv != KMF_OK) { 1161 free(fullpath); 1162 return (rv); 1163 } 1164 1165 n = 0; 1166 if (kmf_cert != NULL && certlist != NULL) { 1167 for (i = 0; i < loaded_certs && i < maxcerts; i++) { 1168 kmf_cert[n].certificate.Data = 1169 certlist[i].Data; 1170 kmf_cert[n].certificate.Length = 1171 certlist[i].Length; 1172 kmf_cert[n].kmf_private.keystore_type = 1173 KMF_KEYSTORE_OPENSSL; 1174 kmf_cert[n].kmf_private.flags = 1175 KMF_FLAG_CERT_VALID; 1176 kmf_cert[n].kmf_private.label = 1177 strdup(fullpath); 1178 n++; 1179 } 1180 /* If maxcerts < loaded_certs, clean up */ 1181 for (; i < loaded_certs; i++) 1182 kmf_free_data(&certlist[i]); 1183 } else if (certlist != NULL) { 1184 for (i = 0; i < loaded_certs; i++) 1185 kmf_free_data(&certlist[i]); 1186 n = loaded_certs; 1187 } 1188 if (certlist != NULL) 1189 free(certlist); 1190 *num_certs = n; 1191 } 1192 1193 free(fullpath); 1194 1195 return (rv); 1196 } 1197 1198 void 1199 /*ARGSUSED*/ 1200 OpenSSL_FreeKMFCert(KMF_HANDLE_T handle, 1201 KMF_X509_DER_CERT *kmf_cert) 1202 { 1203 if (kmf_cert != NULL) { 1204 if (kmf_cert->certificate.Data != NULL) { 1205 kmf_free_data(&kmf_cert->certificate); 1206 } 1207 if (kmf_cert->kmf_private.label) 1208 free(kmf_cert->kmf_private.label); 1209 } 1210 } 1211 1212 /*ARGSUSED*/ 1213 KMF_RETURN 1214 OpenSSL_StoreCert(KMF_HANDLE_T handle, int numattr, KMF_ATTRIBUTE *attrlist) 1215 { 1216 KMF_RETURN ret = KMF_OK; 1217 KMF_DATA *cert = NULL; 1218 char *outfilename = NULL; 1219 char *dirpath = NULL; 1220 char *fullpath = NULL; 1221 KMF_ENCODE_FORMAT format; 1222 1223 /* Get the cert data */ 1224 cert = kmf_get_attr_ptr(KMF_CERT_DATA_ATTR, attrlist, numattr); 1225 if (cert == NULL || cert->Data == NULL) 1226 return (KMF_ERR_BAD_PARAMETER); 1227 1228 /* Check the output filename and directory attributes. */ 1229 outfilename = kmf_get_attr_ptr(KMF_CERT_FILENAME_ATTR, attrlist, 1230 numattr); 1231 if (outfilename == NULL) 1232 return (KMF_ERR_BAD_PARAMETER); 1233 1234 dirpath = kmf_get_attr_ptr(KMF_DIRPATH_ATTR, attrlist, numattr); 1235 fullpath = get_fullpath(dirpath, outfilename); 1236 if (fullpath == NULL) 1237 return (KMF_ERR_BAD_CERTFILE); 1238 1239 /* Check the optional format attribute */ 1240 ret = kmf_get_attr(KMF_ENCODE_FORMAT_ATTR, attrlist, numattr, 1241 &format, NULL); 1242 if (ret != KMF_OK) { 1243 /* If there is no format attribute, then default to PEM */ 1244 format = KMF_FORMAT_PEM; 1245 ret = KMF_OK; 1246 } else if (format != KMF_FORMAT_ASN1 && format != KMF_FORMAT_PEM) { 1247 ret = KMF_ERR_BAD_CERT_FORMAT; 1248 goto out; 1249 } 1250 1251 /* Store the certificate in the file with the specified format */ 1252 ret = kmf_create_cert_file(cert, format, fullpath); 1253 1254 out: 1255 if (fullpath != NULL) 1256 free(fullpath); 1257 1258 return (ret); 1259 } 1260 1261 1262 KMF_RETURN 1263 OpenSSL_DeleteCert(KMF_HANDLE_T handle, int numattr, KMF_ATTRIBUTE *attrlist) 1264 { 1265 KMF_RETURN rv; 1266 KMF_HANDLE *kmfh = (KMF_HANDLE *)handle; 1267 KMF_DATA certdata = { 0, NULL }; 1268 char *dirpath = NULL; 1269 char *filename = NULL; 1270 char *fullpath = NULL; 1271 char *issuer = NULL; 1272 char *subject = NULL; 1273 KMF_BIGINT *serial = NULL; 1274 KMF_CERT_VALIDITY validity; 1275 1276 /* 1277 * Get the DIRPATH and CERT_FILENAME attributes. They can not be 1278 * NULL at the same time. 1279 */ 1280 dirpath = kmf_get_attr_ptr(KMF_DIRPATH_ATTR, attrlist, numattr); 1281 filename = kmf_get_attr_ptr(KMF_CERT_FILENAME_ATTR, attrlist, 1282 numattr); 1283 fullpath = get_fullpath(dirpath, filename); 1284 if (fullpath == NULL) 1285 return (KMF_ERR_BAD_PARAMETER); 1286 1287 /* Get optional search criteria attributes */ 1288 issuer = kmf_get_attr_ptr(KMF_ISSUER_NAME_ATTR, attrlist, numattr); 1289 subject = kmf_get_attr_ptr(KMF_SUBJECT_NAME_ATTR, attrlist, numattr); 1290 serial = kmf_get_attr_ptr(KMF_BIGINT_ATTR, attrlist, numattr); 1291 rv = kmf_get_attr(KMF_CERT_VALIDITY_ATTR, attrlist, numattr, 1292 &validity, NULL); 1293 if (rv != KMF_OK) { 1294 validity = KMF_ALL_CERTS; 1295 rv = KMF_OK; 1296 } 1297 1298 if (isdir(fullpath)) { 1299 DIR *dirp; 1300 struct dirent *dp; 1301 1302 /* open all files in the directory and attempt to read them */ 1303 if ((dirp = opendir(fullpath)) == NULL) { 1304 return (KMF_ERR_BAD_PARAMETER); 1305 } 1306 1307 while ((dp = readdir(dirp)) != NULL) { 1308 if (strcmp(dp->d_name, ".") != 0 && 1309 strcmp(dp->d_name, "..") != 0) { 1310 char *fname; 1311 1312 fname = get_fullpath(fullpath, 1313 (char *)&dp->d_name); 1314 1315 if (fname == NULL) { 1316 rv = KMF_ERR_MEMORY; 1317 break; 1318 } 1319 1320 rv = kmf_load_cert(kmfh, issuer, subject, 1321 serial, validity, fname, &certdata); 1322 1323 if (rv == KMF_ERR_CERT_NOT_FOUND) { 1324 free(fname); 1325 kmf_free_data(&certdata); 1326 rv = KMF_OK; 1327 continue; 1328 } else if (rv != KMF_OK) { 1329 free(fname); 1330 break; 1331 } 1332 1333 if (unlink(fname) != 0) { 1334 SET_SYS_ERROR(kmfh, errno); 1335 rv = KMF_ERR_INTERNAL; 1336 free(fname); 1337 break; 1338 } 1339 free(fname); 1340 kmf_free_data(&certdata); 1341 } 1342 } 1343 (void) closedir(dirp); 1344 } else { 1345 /* Just try to load a single certificate */ 1346 rv = kmf_load_cert(kmfh, issuer, subject, serial, validity, 1347 fullpath, &certdata); 1348 if (rv == KMF_OK) { 1349 if (unlink(fullpath) != 0) { 1350 SET_SYS_ERROR(kmfh, errno); 1351 rv = KMF_ERR_INTERNAL; 1352 } 1353 } 1354 } 1355 1356 out: 1357 if (fullpath != NULL) 1358 free(fullpath); 1359 1360 kmf_free_data(&certdata); 1361 1362 return (rv); 1363 } 1364 1365 KMF_RETURN 1366 OpenSSL_EncodePubKeyData(KMF_HANDLE_T handle, KMF_KEY_HANDLE *key, 1367 KMF_DATA *keydata) 1368 { 1369 KMF_RETURN rv = KMF_OK; 1370 KMF_HANDLE *kmfh = (KMF_HANDLE *)handle; 1371 int n; 1372 1373 if (key == NULL || keydata == NULL || 1374 key->keyp == NULL) 1375 return (KMF_ERR_BAD_PARAMETER); 1376 1377 if (key->keyalg == KMF_RSA) { 1378 RSA *pubkey = EVP_PKEY_get1_RSA(key->keyp); 1379 1380 if (!(n = i2d_RSA_PUBKEY(pubkey, &keydata->Data))) { 1381 SET_ERROR(kmfh, ERR_get_error()); 1382 return (KMF_ERR_ENCODING); 1383 } 1384 RSA_free(pubkey); 1385 } else if (key->keyalg == KMF_DSA) { 1386 DSA *pubkey = EVP_PKEY_get1_DSA(key->keyp); 1387 1388 if (!(n = i2d_DSA_PUBKEY(pubkey, &keydata->Data))) { 1389 SET_ERROR(kmfh, ERR_get_error()); 1390 return (KMF_ERR_ENCODING); 1391 } 1392 DSA_free(pubkey); 1393 } else { 1394 return (KMF_ERR_BAD_PARAMETER); 1395 } 1396 keydata->Length = n; 1397 1398 cleanup: 1399 if (rv != KMF_OK) { 1400 if (keydata->Data) 1401 free(keydata->Data); 1402 keydata->Data = NULL; 1403 keydata->Length = 0; 1404 } 1405 1406 return (rv); 1407 } 1408 1409 static KMF_RETURN 1410 ssl_write_key(KMF_HANDLE *kmfh, KMF_ENCODE_FORMAT format, BIO *out, 1411 KMF_CREDENTIAL *cred, EVP_PKEY *pkey, boolean_t private) 1412 { 1413 int rv = 0; 1414 RSA *rsa; 1415 DSA *dsa; 1416 1417 if (pkey == NULL || out == NULL) 1418 return (KMF_ERR_BAD_PARAMETER); 1419 1420 switch (format) { 1421 case KMF_FORMAT_RAWKEY: 1422 /* same as ASN.1 */ 1423 case KMF_FORMAT_ASN1: 1424 if (pkey->type == EVP_PKEY_RSA) { 1425 rsa = EVP_PKEY_get1_RSA(pkey); 1426 if (private) 1427 rv = i2d_RSAPrivateKey_bio(out, rsa); 1428 else 1429 rv = i2d_RSAPublicKey_bio(out, rsa); 1430 RSA_free(rsa); 1431 } else if (pkey->type == EVP_PKEY_DSA) { 1432 dsa = EVP_PKEY_get1_DSA(pkey); 1433 rv = i2d_DSAPrivateKey_bio(out, dsa); 1434 DSA_free(dsa); 1435 } 1436 if (rv == 1) { 1437 rv = KMF_OK; 1438 } else { 1439 SET_ERROR(kmfh, rv); 1440 } 1441 break; 1442 case KMF_FORMAT_PEM: 1443 if (pkey->type == EVP_PKEY_RSA) { 1444 rsa = EVP_PKEY_get1_RSA(pkey); 1445 if (private) 1446 rv = PEM_write_bio_RSAPrivateKey(out, 1447 rsa, NULL, NULL, 0, NULL, 1448 (cred != NULL ? cred->cred : NULL)); 1449 else 1450 rv = PEM_write_bio_RSAPublicKey(out, 1451 rsa); 1452 RSA_free(rsa); 1453 } else if (pkey->type == EVP_PKEY_DSA) { 1454 dsa = EVP_PKEY_get1_DSA(pkey); 1455 rv = PEM_write_bio_DSAPrivateKey(out, 1456 dsa, NULL, NULL, 0, NULL, 1457 (cred != NULL ? cred->cred : NULL)); 1458 DSA_free(dsa); 1459 } 1460 1461 if (rv == 1) { 1462 rv = KMF_OK; 1463 } else { 1464 SET_ERROR(kmfh, rv); 1465 } 1466 break; 1467 1468 default: 1469 rv = KMF_ERR_BAD_PARAMETER; 1470 } 1471 1472 return (rv); 1473 } 1474 1475 KMF_RETURN 1476 OpenSSL_CreateKeypair(KMF_HANDLE_T handle, int numattr, 1477 KMF_ATTRIBUTE *attrlist) 1478 { 1479 KMF_RETURN rv = KMF_OK; 1480 KMF_HANDLE *kmfh = (KMF_HANDLE *)handle; 1481 uint32_t eValue = 0x010001; 1482 RSA *sslPrivKey = NULL; 1483 DSA *sslDSAKey = NULL; 1484 EVP_PKEY *eprikey = NULL; 1485 EVP_PKEY *epubkey = NULL; 1486 BIO *out = NULL; 1487 KMF_KEY_HANDLE *pubkey = NULL, *privkey = NULL; 1488 uint32_t keylen = 1024; 1489 uint32_t keylen_size = sizeof (uint32_t); 1490 boolean_t storekey = TRUE; 1491 KMF_KEY_ALG keytype = KMF_RSA; 1492 1493 rv = kmf_get_attr(KMF_STOREKEY_BOOL_ATTR, attrlist, numattr, 1494 &storekey, NULL); 1495 if (rv != KMF_OK) { 1496 /* "storekey" is optional. Default is TRUE */ 1497 rv = KMF_OK; 1498 } 1499 1500 rv = kmf_get_attr(KMF_KEYALG_ATTR, attrlist, numattr, 1501 (void *)&keytype, NULL); 1502 if (rv != KMF_OK) 1503 /* keytype is optional. KMF_RSA is default */ 1504 rv = KMF_OK; 1505 1506 pubkey = kmf_get_attr_ptr(KMF_PUBKEY_HANDLE_ATTR, attrlist, numattr); 1507 if (pubkey == NULL) 1508 return (KMF_ERR_BAD_PARAMETER); 1509 1510 privkey = kmf_get_attr_ptr(KMF_PRIVKEY_HANDLE_ATTR, attrlist, numattr); 1511 if (privkey == NULL) 1512 return (KMF_ERR_BAD_PARAMETER); 1513 1514 (void) memset(pubkey, 0, sizeof (KMF_KEY_HANDLE)); 1515 (void) memset(privkey, 0, sizeof (KMF_KEY_HANDLE)); 1516 1517 eprikey = EVP_PKEY_new(); 1518 if (eprikey == NULL) { 1519 SET_ERROR(kmfh, ERR_get_error()); 1520 rv = KMF_ERR_KEYGEN_FAILED; 1521 goto cleanup; 1522 } 1523 epubkey = EVP_PKEY_new(); 1524 if (epubkey == NULL) { 1525 SET_ERROR(kmfh, ERR_get_error()); 1526 rv = KMF_ERR_KEYGEN_FAILED; 1527 goto cleanup; 1528 } 1529 if (keytype == KMF_RSA) { 1530 KMF_BIGINT *rsaexp = NULL; 1531 1532 rsaexp = kmf_get_attr_ptr(KMF_RSAEXP_ATTR, attrlist, numattr); 1533 if (rsaexp != NULL) { 1534 if (rsaexp->len > 0 && 1535 rsaexp->len <= sizeof (eValue) && 1536 rsaexp->val != NULL) { 1537 /* LINTED E_BAD_PTR_CAST_ALIGN */ 1538 eValue = *(uint32_t *)rsaexp->val; 1539 } else { 1540 rv = KMF_ERR_BAD_PARAMETER; 1541 goto cleanup; 1542 } 1543 } else { 1544 /* RSA Exponent is optional. Default is 0x10001 */ 1545 rv = KMF_OK; 1546 } 1547 1548 rv = kmf_get_attr(KMF_KEYLENGTH_ATTR, attrlist, numattr, 1549 &keylen, &keylen_size); 1550 if (rv == KMF_ERR_ATTR_NOT_FOUND) 1551 /* keylen is optional, default is 1024 */ 1552 rv = KMF_OK; 1553 if (rv != KMF_OK) { 1554 rv = KMF_ERR_BAD_PARAMETER; 1555 goto cleanup; 1556 } 1557 1558 sslPrivKey = RSA_generate_key(keylen, eValue, NULL, NULL); 1559 if (sslPrivKey == NULL) { 1560 SET_ERROR(kmfh, ERR_get_error()); 1561 rv = KMF_ERR_KEYGEN_FAILED; 1562 } else { 1563 (void) EVP_PKEY_set1_RSA(eprikey, sslPrivKey); 1564 privkey->kstype = KMF_KEYSTORE_OPENSSL; 1565 privkey->keyalg = KMF_RSA; 1566 privkey->keyclass = KMF_ASYM_PRI; 1567 privkey->israw = FALSE; 1568 privkey->keyp = (void *)eprikey; 1569 1570 /* OpenSSL derives the public key from the private */ 1571 (void) EVP_PKEY_set1_RSA(epubkey, sslPrivKey); 1572 pubkey->kstype = KMF_KEYSTORE_OPENSSL; 1573 pubkey->keyalg = KMF_RSA; 1574 pubkey->israw = FALSE; 1575 pubkey->keyclass = KMF_ASYM_PUB; 1576 pubkey->keyp = (void *)epubkey; 1577 } 1578 } else if (keytype == KMF_DSA) { 1579 DSA *dp; 1580 sslDSAKey = DSA_new(); 1581 if (sslDSAKey == NULL) { 1582 SET_ERROR(kmfh, ERR_get_error()); 1583 return (KMF_ERR_MEMORY); 1584 } 1585 1586 if ((sslDSAKey->p = BN_bin2bn(P, sizeof (P), sslDSAKey->p)) == 1587 NULL) { 1588 SET_ERROR(kmfh, ERR_get_error()); 1589 rv = KMF_ERR_KEYGEN_FAILED; 1590 goto cleanup; 1591 } 1592 if ((sslDSAKey->q = BN_bin2bn(Q, sizeof (Q), sslDSAKey->q)) == 1593 NULL) { 1594 SET_ERROR(kmfh, ERR_get_error()); 1595 rv = KMF_ERR_KEYGEN_FAILED; 1596 goto cleanup; 1597 } 1598 if ((sslDSAKey->g = BN_bin2bn(G, sizeof (G), sslDSAKey->g)) == 1599 NULL) { 1600 SET_ERROR(kmfh, ERR_get_error()); 1601 rv = KMF_ERR_KEYGEN_FAILED; 1602 goto cleanup; 1603 } 1604 1605 if (!DSA_generate_key(sslDSAKey)) { 1606 SET_ERROR(kmfh, ERR_get_error()); 1607 rv = KMF_ERR_KEYGEN_FAILED; 1608 goto cleanup; 1609 } 1610 1611 privkey->kstype = KMF_KEYSTORE_OPENSSL; 1612 privkey->keyalg = KMF_DSA; 1613 privkey->keyclass = KMF_ASYM_PRI; 1614 privkey->israw = FALSE; 1615 if (EVP_PKEY_set1_DSA(eprikey, sslDSAKey)) { 1616 privkey->keyp = (void *)eprikey; 1617 } else { 1618 SET_ERROR(kmfh, ERR_get_error()); 1619 rv = KMF_ERR_KEYGEN_FAILED; 1620 goto cleanup; 1621 } 1622 dp = DSA_new(); 1623 /* Make a copy for the public key */ 1624 if (dp != NULL) { 1625 if ((dp->p = BN_new()) == NULL) { 1626 SET_ERROR(kmfh, ERR_get_error()); 1627 rv = KMF_ERR_MEMORY; 1628 DSA_free(dp); 1629 goto cleanup; 1630 } 1631 if ((dp->q = BN_new()) == NULL) { 1632 SET_ERROR(kmfh, ERR_get_error()); 1633 rv = KMF_ERR_MEMORY; 1634 BN_free(dp->p); 1635 DSA_free(dp); 1636 goto cleanup; 1637 } 1638 if ((dp->g = BN_new()) == NULL) { 1639 SET_ERROR(kmfh, ERR_get_error()); 1640 rv = KMF_ERR_MEMORY; 1641 BN_free(dp->q); 1642 BN_free(dp->p); 1643 DSA_free(dp); 1644 goto cleanup; 1645 } 1646 if ((dp->pub_key = BN_new()) == NULL) { 1647 SET_ERROR(kmfh, ERR_get_error()); 1648 rv = KMF_ERR_MEMORY; 1649 BN_free(dp->q); 1650 BN_free(dp->p); 1651 BN_free(dp->g); 1652 DSA_free(dp); 1653 goto cleanup; 1654 } 1655 (void) BN_copy(dp->p, sslDSAKey->p); 1656 (void) BN_copy(dp->q, sslDSAKey->q); 1657 (void) BN_copy(dp->g, sslDSAKey->g); 1658 (void) BN_copy(dp->pub_key, sslDSAKey->pub_key); 1659 1660 pubkey->kstype = KMF_KEYSTORE_OPENSSL; 1661 pubkey->keyalg = KMF_DSA; 1662 pubkey->keyclass = KMF_ASYM_PUB; 1663 pubkey->israw = FALSE; 1664 1665 if (EVP_PKEY_set1_DSA(epubkey, sslDSAKey)) { 1666 pubkey->keyp = (void *)epubkey; 1667 } else { 1668 SET_ERROR(kmfh, ERR_get_error()); 1669 rv = KMF_ERR_KEYGEN_FAILED; 1670 goto cleanup; 1671 } 1672 } 1673 } 1674 1675 if (rv != KMF_OK) { 1676 goto cleanup; 1677 } 1678 1679 if (storekey) { 1680 KMF_ATTRIBUTE storeattrs[4]; /* max. 4 attributes needed */ 1681 int i = 0; 1682 char *keyfile = NULL, *dirpath = NULL; 1683 KMF_ENCODE_FORMAT format; 1684 /* 1685 * Construct a new attribute arrray and call openssl_store_key 1686 */ 1687 kmf_set_attr_at_index(storeattrs, i, KMF_PRIVKEY_HANDLE_ATTR, 1688 privkey, sizeof (privkey)); 1689 i++; 1690 1691 dirpath = kmf_get_attr_ptr(KMF_DIRPATH_ATTR, attrlist, numattr); 1692 if (dirpath != NULL) { 1693 storeattrs[i].type = KMF_DIRPATH_ATTR; 1694 storeattrs[i].pValue = dirpath; 1695 storeattrs[i].valueLen = strlen(dirpath); 1696 i++; 1697 } else { 1698 rv = KMF_OK; /* DIRPATH is optional */ 1699 } 1700 keyfile = kmf_get_attr_ptr(KMF_KEY_FILENAME_ATTR, 1701 attrlist, numattr); 1702 if (keyfile != NULL) { 1703 storeattrs[i].type = KMF_KEY_FILENAME_ATTR; 1704 storeattrs[i].pValue = keyfile; 1705 storeattrs[i].valueLen = strlen(keyfile); 1706 i++; 1707 } else { 1708 goto cleanup; /* KEYFILE is required */ 1709 } 1710 rv = kmf_get_attr(KMF_ENCODE_FORMAT_ATTR, attrlist, numattr, 1711 (void *)&format, NULL); 1712 if (rv == KMF_OK) { 1713 storeattrs[i].type = KMF_ENCODE_FORMAT_ATTR; 1714 storeattrs[i].pValue = &format; 1715 storeattrs[i].valueLen = sizeof (format); 1716 i++; 1717 } 1718 1719 rv = OpenSSL_StoreKey(handle, i, storeattrs); 1720 } 1721 1722 cleanup: 1723 if (rv != KMF_OK) { 1724 if (eprikey != NULL) 1725 EVP_PKEY_free(eprikey); 1726 1727 if (epubkey != NULL) 1728 EVP_PKEY_free(epubkey); 1729 1730 if (pubkey->keylabel) { 1731 free(pubkey->keylabel); 1732 pubkey->keylabel = NULL; 1733 } 1734 1735 if (privkey->keylabel) { 1736 free(privkey->keylabel); 1737 privkey->keylabel = NULL; 1738 } 1739 1740 pubkey->keyp = NULL; 1741 privkey->keyp = NULL; 1742 } 1743 1744 if (sslPrivKey) 1745 RSA_free(sslPrivKey); 1746 1747 if (sslDSAKey) 1748 DSA_free(sslDSAKey); 1749 1750 if (out != NULL) 1751 (void) BIO_free(out); 1752 1753 return (rv); 1754 } 1755 1756 /* 1757 * Make sure the BN conversion is properly padded with 0x00 1758 * bytes. If not, signature verification for DSA signatures 1759 * may fail in the case where the bignum value does not use 1760 * all of the bits. 1761 */ 1762 static int 1763 fixbnlen(BIGNUM *bn, unsigned char *buf, int len) { 1764 int bytes = len - BN_num_bytes(bn); 1765 1766 /* prepend with leading 0x00 if necessary */ 1767 while (bytes-- > 0) 1768 *buf++ = 0; 1769 1770 (void) BN_bn2bin(bn, buf); 1771 /* 1772 * Return the desired length since we prepended it 1773 * with the necessary 0x00 padding. 1774 */ 1775 return (len); 1776 } 1777 1778 KMF_RETURN 1779 OpenSSL_SignData(KMF_HANDLE_T handle, KMF_KEY_HANDLE *key, 1780 KMF_OID *AlgOID, KMF_DATA *tobesigned, KMF_DATA *output) 1781 { 1782 KMF_RETURN ret = KMF_OK; 1783 KMF_HANDLE *kmfh = (KMF_HANDLE *)handle; 1784 KMF_ALGORITHM_INDEX AlgId; 1785 EVP_MD_CTX ctx; 1786 const EVP_MD *md; 1787 1788 if (key == NULL || AlgOID == NULL || 1789 tobesigned == NULL || output == NULL || 1790 tobesigned->Data == NULL || 1791 output->Data == NULL) 1792 return (KMF_ERR_BAD_PARAMETER); 1793 1794 /* Map the OID to an OpenSSL algorithm */ 1795 AlgId = x509_algoid_to_algid(AlgOID); 1796 if (AlgId == KMF_ALGID_NONE) 1797 return (KMF_ERR_BAD_ALGORITHM); 1798 1799 if (key->keyalg == KMF_RSA) { 1800 EVP_PKEY *pkey = (EVP_PKEY *)key->keyp; 1801 uchar_t *p; 1802 int len; 1803 if (AlgId == KMF_ALGID_MD5WithRSA) 1804 md = EVP_md5(); 1805 else if (AlgId == KMF_ALGID_SHA1WithRSA) 1806 md = EVP_sha1(); 1807 else if (AlgId == KMF_ALGID_SHA256WithRSA) 1808 md = EVP_sha256(); 1809 else if (AlgId == KMF_ALGID_SHA384WithRSA) 1810 md = EVP_sha384(); 1811 else if (AlgId == KMF_ALGID_SHA512WithRSA) 1812 md = EVP_sha512(); 1813 else if (AlgId == KMF_ALGID_RSA) 1814 md = NULL; 1815 else 1816 return (KMF_ERR_BAD_ALGORITHM); 1817 1818 if ((md == NULL) && (AlgId == KMF_ALGID_RSA)) { 1819 RSA *rsa = EVP_PKEY_get1_RSA((EVP_PKEY *)pkey); 1820 1821 p = output->Data; 1822 if ((len = RSA_private_encrypt(tobesigned->Length, 1823 tobesigned->Data, p, rsa, 1824 RSA_PKCS1_PADDING)) <= 0) { 1825 SET_ERROR(kmfh, ERR_get_error()); 1826 ret = KMF_ERR_INTERNAL; 1827 } 1828 output->Length = len; 1829 } else { 1830 (void) EVP_MD_CTX_init(&ctx); 1831 (void) EVP_SignInit_ex(&ctx, md, NULL); 1832 (void) EVP_SignUpdate(&ctx, tobesigned->Data, 1833 (uint32_t)tobesigned->Length); 1834 len = (uint32_t)output->Length; 1835 p = output->Data; 1836 if (!EVP_SignFinal(&ctx, p, (uint32_t *)&len, pkey)) { 1837 SET_ERROR(kmfh, ERR_get_error()); 1838 len = 0; 1839 ret = KMF_ERR_INTERNAL; 1840 } 1841 output->Length = len; 1842 (void) EVP_MD_CTX_cleanup(&ctx); 1843 } 1844 } else if (key->keyalg == KMF_DSA) { 1845 DSA *dsa = EVP_PKEY_get1_DSA(key->keyp); 1846 1847 uchar_t hash[EVP_MAX_MD_SIZE]; 1848 uint32_t hashlen; 1849 DSA_SIG *dsasig; 1850 1851 if (AlgId == KMF_ALGID_DSA || 1852 AlgId == KMF_ALGID_SHA1WithDSA) 1853 md = EVP_sha1(); 1854 else if (AlgId == KMF_ALGID_SHA256WithDSA) 1855 md = EVP_sha256(); 1856 else /* Bad algorithm */ 1857 return (KMF_ERR_BAD_ALGORITHM); 1858 1859 /* 1860 * OpenSSL EVP_Sign operation automatically converts to 1861 * ASN.1 output so we do the operations separately so we 1862 * are assured of NOT getting ASN.1 output returned. 1863 * KMF does not want ASN.1 encoded results because 1864 * not all mechanisms return ASN.1 encodings (PKCS#11 1865 * and NSS return raw signature data). 1866 */ 1867 EVP_MD_CTX_init(&ctx); 1868 (void) EVP_DigestInit_ex(&ctx, md, NULL); 1869 (void) EVP_DigestUpdate(&ctx, tobesigned->Data, 1870 tobesigned->Length); 1871 (void) EVP_DigestFinal_ex(&ctx, hash, &hashlen); 1872 1873 /* Only sign first 20 bytes for SHA2 */ 1874 if (AlgId == KMF_ALGID_SHA256WithDSA) 1875 hashlen = 20; 1876 dsasig = DSA_do_sign(hash, hashlen, dsa); 1877 if (dsasig != NULL) { 1878 int i; 1879 output->Length = i = fixbnlen(dsasig->r, output->Data, 1880 hashlen); 1881 1882 output->Length += fixbnlen(dsasig->s, &output->Data[i], 1883 hashlen); 1884 1885 DSA_SIG_free(dsasig); 1886 } else { 1887 SET_ERROR(kmfh, ERR_get_error()); 1888 } 1889 (void) EVP_MD_CTX_cleanup(&ctx); 1890 } else { 1891 return (KMF_ERR_BAD_PARAMETER); 1892 } 1893 cleanup: 1894 return (ret); 1895 } 1896 1897 KMF_RETURN 1898 /*ARGSUSED*/ 1899 OpenSSL_DeleteKey(KMF_HANDLE_T handle, 1900 int numattr, KMF_ATTRIBUTE *attrlist) 1901 { 1902 KMF_RETURN rv = KMF_OK; 1903 KMF_KEY_HANDLE *key; 1904 boolean_t destroy = B_TRUE; 1905 1906 key = kmf_get_attr_ptr(KMF_KEY_HANDLE_ATTR, attrlist, numattr); 1907 if (key == NULL || key->keyp == NULL) 1908 return (KMF_ERR_BAD_PARAMETER); 1909 1910 rv = kmf_get_attr(KMF_DESTROY_BOOL_ATTR, attrlist, numattr, 1911 (void *)&destroy, NULL); 1912 if (rv != KMF_OK) { 1913 /* "destroy" is optional. Default is TRUE */ 1914 rv = KMF_OK; 1915 } 1916 1917 if (key->keyclass != KMF_ASYM_PUB && 1918 key->keyclass != KMF_ASYM_PRI && 1919 key->keyclass != KMF_SYMMETRIC) 1920 return (KMF_ERR_BAD_KEY_CLASS); 1921 1922 if (key->keyclass == KMF_SYMMETRIC) { 1923 kmf_free_raw_sym_key((KMF_RAW_SYM_KEY *)key->keyp); 1924 key->keyp = NULL; 1925 } else { 1926 if (key->keyp != NULL) { 1927 EVP_PKEY_free(key->keyp); 1928 key->keyp = NULL; 1929 } 1930 } 1931 1932 if (key->keylabel != NULL) { 1933 EVP_PKEY *pkey = NULL; 1934 /* If the file exists, make sure it is a proper key. */ 1935 pkey = openssl_load_key(handle, key->keylabel); 1936 if (pkey == NULL) { 1937 if (key->keylabel != NULL) { 1938 free(key->keylabel); 1939 key->keylabel = NULL; 1940 } 1941 return (KMF_ERR_KEY_NOT_FOUND); 1942 } 1943 EVP_PKEY_free(pkey); 1944 1945 if (destroy) { 1946 if (unlink(key->keylabel) != 0) { 1947 KMF_HANDLE *kmfh = (KMF_HANDLE *)handle; 1948 SET_SYS_ERROR(kmfh, errno); 1949 rv = KMF_ERR_INTERNAL; 1950 } 1951 } 1952 if (key->keylabel != NULL) { 1953 free(key->keylabel); 1954 key->keylabel = NULL; 1955 } 1956 } 1957 return (rv); 1958 } 1959 1960 KMF_RETURN 1961 OpenSSL_GetErrorString(KMF_HANDLE_T handle, char **msgstr) 1962 { 1963 KMF_RETURN ret = KMF_OK; 1964 KMF_HANDLE *kmfh = (KMF_HANDLE *)handle; 1965 char str[256]; /* OpenSSL needs at least 120 byte buffer */ 1966 1967 ERR_error_string_n(kmfh->lasterr.errcode, str, sizeof (str)); 1968 if (strlen(str)) { 1969 *msgstr = (char *)strdup(str); 1970 if ((*msgstr) == NULL) 1971 ret = KMF_ERR_MEMORY; 1972 } else { 1973 *msgstr = NULL; 1974 } 1975 1976 return (ret); 1977 } 1978 1979 static int 1980 ext2NID(int kmfext) 1981 { 1982 switch (kmfext) { 1983 case KMF_X509_EXT_KEY_USAGE: 1984 return (NID_key_usage); 1985 case KMF_X509_EXT_PRIV_KEY_USAGE_PERIOD: 1986 return (NID_private_key_usage_period); 1987 case KMF_X509_EXT_CERT_POLICIES: 1988 return (NID_certificate_policies); 1989 case KMF_X509_EXT_SUBJ_ALTNAME: 1990 return (NID_subject_alt_name); 1991 case KMF_X509_EXT_ISSUER_ALTNAME: 1992 return (NID_issuer_alt_name); 1993 case KMF_X509_EXT_BASIC_CONSTRAINTS: 1994 return (NID_basic_constraints); 1995 case KMF_X509_EXT_EXT_KEY_USAGE: 1996 return (NID_ext_key_usage); 1997 case KMF_X509_EXT_AUTH_KEY_ID: 1998 return (NID_authority_key_identifier); 1999 case KMF_X509_EXT_CRL_DIST_POINTS: 2000 return (NID_crl_distribution_points); 2001 case KMF_X509_EXT_SUBJ_KEY_ID: 2002 return (NID_subject_key_identifier); 2003 case KMF_X509_EXT_POLICY_MAPPINGS: 2004 return (OBJ_sn2nid("policyMappings")); 2005 case KMF_X509_EXT_NAME_CONSTRAINTS: 2006 return (OBJ_sn2nid("nameConstraints")); 2007 case KMF_X509_EXT_POLICY_CONSTRAINTS: 2008 return (OBJ_sn2nid("policyConstraints")); 2009 case KMF_X509_EXT_INHIBIT_ANY_POLICY: 2010 return (OBJ_sn2nid("inhibitAnyPolicy")); 2011 case KMF_X509_EXT_FRESHEST_CRL: 2012 return (OBJ_sn2nid("freshestCRL")); 2013 default: 2014 return (NID_undef); 2015 } 2016 } 2017 2018 KMF_RETURN 2019 OpenSSL_CertGetPrintable(KMF_HANDLE_T handle, const KMF_DATA *pcert, 2020 KMF_PRINTABLE_ITEM flag, char *resultStr) 2021 { 2022 KMF_RETURN ret = KMF_OK; 2023 KMF_HANDLE *kmfh = (KMF_HANDLE *)handle; 2024 X509 *xcert = NULL; 2025 unsigned char *outbuf = NULL; 2026 unsigned char *outbuf_p; 2027 char *tmpstr = NULL; 2028 int j; 2029 int ext_index, nid, len; 2030 BIO *mem = NULL; 2031 #if OPENSSL_VERSION_NUMBER < 0x10000000L 2032 STACK *emlst = NULL; 2033 #else 2034 STACK_OF(OPENSSL_STRING) *emlst = NULL; 2035 #endif 2036 X509_EXTENSION *ex; 2037 X509_CINF *ci; 2038 2039 if (pcert == NULL || pcert->Data == NULL || pcert->Length == 0) { 2040 return (KMF_ERR_BAD_PARAMETER); 2041 } 2042 2043 /* copy cert data to outbuf */ 2044 outbuf = malloc(pcert->Length); 2045 if (outbuf == NULL) { 2046 return (KMF_ERR_MEMORY); 2047 } 2048 (void) memcpy(outbuf, pcert->Data, pcert->Length); 2049 2050 outbuf_p = outbuf; /* use a temp pointer; required by openssl */ 2051 xcert = d2i_X509(NULL, (const uchar_t **)&outbuf_p, pcert->Length); 2052 if (xcert == NULL) { 2053 SET_ERROR(kmfh, ERR_get_error()); 2054 ret = KMF_ERR_ENCODING; 2055 goto out; 2056 } 2057 2058 mem = BIO_new(BIO_s_mem()); 2059 if (mem == NULL) { 2060 SET_ERROR(kmfh, ERR_get_error()); 2061 ret = KMF_ERR_MEMORY; 2062 goto out; 2063 } 2064 2065 switch (flag) { 2066 case KMF_CERT_ISSUER: 2067 (void) X509_NAME_print_ex(mem, X509_get_issuer_name(xcert), 0, 2068 XN_FLAG_SEP_CPLUS_SPC); 2069 len = BIO_gets(mem, resultStr, KMF_CERT_PRINTABLE_LEN); 2070 break; 2071 2072 case KMF_CERT_SUBJECT: 2073 (void) X509_NAME_print_ex(mem, X509_get_subject_name(xcert), 0, 2074 XN_FLAG_SEP_CPLUS_SPC); 2075 len = BIO_gets(mem, resultStr, KMF_CERT_PRINTABLE_LEN); 2076 break; 2077 2078 case KMF_CERT_VERSION: 2079 tmpstr = i2s_ASN1_INTEGER(NULL, xcert->cert_info->version); 2080 (void) strncpy(resultStr, tmpstr, KMF_CERT_PRINTABLE_LEN); 2081 OPENSSL_free(tmpstr); 2082 len = strlen(resultStr); 2083 break; 2084 2085 case KMF_CERT_SERIALNUM: 2086 if (i2a_ASN1_INTEGER(mem, X509_get_serialNumber(xcert)) > 0) { 2087 (void) strcpy(resultStr, "0x"); 2088 len = BIO_gets(mem, &resultStr[2], 2089 KMF_CERT_PRINTABLE_LEN - 2); 2090 } 2091 break; 2092 2093 case KMF_CERT_NOTBEFORE: 2094 (void) ASN1_TIME_print(mem, X509_get_notBefore(xcert)); 2095 len = BIO_gets(mem, resultStr, KMF_CERT_PRINTABLE_LEN); 2096 break; 2097 2098 case KMF_CERT_NOTAFTER: 2099 (void) ASN1_TIME_print(mem, X509_get_notAfter(xcert)); 2100 len = BIO_gets(mem, resultStr, KMF_CERT_PRINTABLE_LEN); 2101 break; 2102 2103 case KMF_CERT_PUBKEY_DATA: 2104 { 2105 EVP_PKEY *pkey = X509_get_pubkey(xcert); 2106 if (pkey == NULL) { 2107 SET_ERROR(kmfh, ERR_get_error()); 2108 ret = KMF_ERR_ENCODING; 2109 goto out; 2110 } 2111 2112 if (pkey->type == EVP_PKEY_RSA) { 2113 (void) BIO_printf(mem, 2114 "RSA Public Key: (%d bit)\n", 2115 BN_num_bits(pkey->pkey.rsa->n)); 2116 (void) RSA_print(mem, pkey->pkey.rsa, 0); 2117 } else if (pkey->type == EVP_PKEY_DSA) { 2118 (void) BIO_printf(mem, 2119 "%12sDSA Public Key:\n", ""); 2120 (void) DSA_print(mem, pkey->pkey.dsa, 0); 2121 } else { 2122 (void) BIO_printf(mem, 2123 "%12sUnknown Public Key:\n", ""); 2124 } 2125 (void) BIO_printf(mem, "\n"); 2126 EVP_PKEY_free(pkey); 2127 } 2128 len = BIO_read(mem, resultStr, KMF_CERT_PRINTABLE_LEN); 2129 break; 2130 case KMF_CERT_SIGNATURE_ALG: 2131 case KMF_CERT_PUBKEY_ALG: 2132 if (flag == KMF_CERT_SIGNATURE_ALG) { 2133 len = i2a_ASN1_OBJECT(mem, 2134 xcert->sig_alg->algorithm); 2135 } else { 2136 len = i2a_ASN1_OBJECT(mem, 2137 xcert->cert_info->key->algor->algorithm); 2138 } 2139 2140 if (len > 0) { 2141 len = BIO_read(mem, resultStr, 2142 KMF_CERT_PRINTABLE_LEN); 2143 } 2144 break; 2145 2146 case KMF_CERT_EMAIL: 2147 emlst = X509_get1_email(xcert); 2148 #if OPENSSL_VERSION_NUMBER < 0x10000000L 2149 for (j = 0; j < sk_num(emlst); j++) 2150 (void) BIO_printf(mem, "%s\n", sk_value(emlst, j)); 2151 #else 2152 for (j = 0; j < sk_OPENSSL_STRING_num(emlst); j++) 2153 (void) BIO_printf(mem, "%s\n", 2154 sk_OPENSSL_STRING_value(emlst, j)); 2155 #endif 2156 2157 len = BIO_gets(mem, resultStr, KMF_CERT_PRINTABLE_LEN); 2158 X509_email_free(emlst); 2159 break; 2160 case KMF_X509_EXT_ISSUER_ALTNAME: 2161 case KMF_X509_EXT_SUBJ_ALTNAME: 2162 case KMF_X509_EXT_KEY_USAGE: 2163 case KMF_X509_EXT_PRIV_KEY_USAGE_PERIOD: 2164 case KMF_X509_EXT_CERT_POLICIES: 2165 case KMF_X509_EXT_BASIC_CONSTRAINTS: 2166 case KMF_X509_EXT_NAME_CONSTRAINTS: 2167 case KMF_X509_EXT_POLICY_CONSTRAINTS: 2168 case KMF_X509_EXT_EXT_KEY_USAGE: 2169 case KMF_X509_EXT_INHIBIT_ANY_POLICY: 2170 case KMF_X509_EXT_AUTH_KEY_ID: 2171 case KMF_X509_EXT_SUBJ_KEY_ID: 2172 case KMF_X509_EXT_POLICY_MAPPINGS: 2173 case KMF_X509_EXT_CRL_DIST_POINTS: 2174 case KMF_X509_EXT_FRESHEST_CRL: 2175 nid = ext2NID(flag); 2176 if (nid == NID_undef) { 2177 ret = KMF_ERR_EXTENSION_NOT_FOUND; 2178 goto out; 2179 } 2180 ci = xcert->cert_info; 2181 2182 ext_index = X509v3_get_ext_by_NID(ci->extensions, nid, -1); 2183 if (ext_index == -1) { 2184 SET_ERROR(kmfh, ERR_get_error()); 2185 2186 ret = KMF_ERR_EXTENSION_NOT_FOUND; 2187 goto out; 2188 } 2189 ex = X509v3_get_ext(ci->extensions, ext_index); 2190 2191 (void) i2a_ASN1_OBJECT(mem, X509_EXTENSION_get_object(ex)); 2192 2193 if (BIO_printf(mem, ": %s\n", 2194 X509_EXTENSION_get_critical(ex) ? "critical" : "") <= 0) { 2195 SET_ERROR(kmfh, ERR_get_error()); 2196 ret = KMF_ERR_ENCODING; 2197 goto out; 2198 } 2199 if (!X509V3_EXT_print(mem, ex, X509V3_EXT_DUMP_UNKNOWN, 4)) { 2200 (void) BIO_printf(mem, "%*s", 4, ""); 2201 (void) M_ASN1_OCTET_STRING_print(mem, ex->value); 2202 } 2203 if (BIO_write(mem, "\n", 1) <= 0) { 2204 SET_ERROR(kmfh, ERR_get_error()); 2205 ret = KMF_ERR_ENCODING; 2206 goto out; 2207 } 2208 len = BIO_read(mem, resultStr, KMF_CERT_PRINTABLE_LEN); 2209 } 2210 if (len <= 0) { 2211 SET_ERROR(kmfh, ERR_get_error()); 2212 ret = KMF_ERR_ENCODING; 2213 } 2214 2215 out: 2216 if (outbuf != NULL) { 2217 free(outbuf); 2218 } 2219 2220 if (xcert != NULL) { 2221 X509_free(xcert); 2222 } 2223 2224 if (mem != NULL) { 2225 (void) BIO_free(mem); 2226 } 2227 2228 return (ret); 2229 } 2230 2231 KMF_RETURN 2232 /*ARGSUSED*/ 2233 OpenSSL_FindPrikeyByCert(KMF_HANDLE_T handle, int numattr, 2234 KMF_ATTRIBUTE *attrlist) 2235 { 2236 KMF_RETURN rv = KMF_OK; 2237 KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_OPENSSL; 2238 KMF_KEY_CLASS keyclass = KMF_ASYM_PRI; 2239 KMF_KEY_HANDLE *key = NULL; 2240 uint32_t numkeys = 1; /* 1 key only */ 2241 char *dirpath = NULL; 2242 char *keyfile = NULL; 2243 KMF_ATTRIBUTE new_attrlist[16]; 2244 int i = 0; 2245 2246 /* 2247 * This is really just a FindKey operation, reuse the 2248 * FindKey function. 2249 */ 2250 kmf_set_attr_at_index(new_attrlist, i, 2251 KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype)); 2252 i++; 2253 2254 kmf_set_attr_at_index(new_attrlist, i, 2255 KMF_COUNT_ATTR, &numkeys, sizeof (uint32_t)); 2256 i++; 2257 2258 kmf_set_attr_at_index(new_attrlist, i, 2259 KMF_KEYCLASS_ATTR, &keyclass, sizeof (keyclass)); 2260 i++; 2261 2262 key = kmf_get_attr_ptr(KMF_KEY_HANDLE_ATTR, attrlist, numattr); 2263 if (key == NULL) { 2264 return (KMF_ERR_BAD_PARAMETER); 2265 } else { 2266 kmf_set_attr_at_index(new_attrlist, i, 2267 KMF_KEY_HANDLE_ATTR, key, sizeof (KMF_KEY_HANDLE)); 2268 i++; 2269 } 2270 2271 dirpath = kmf_get_attr_ptr(KMF_DIRPATH_ATTR, attrlist, numattr); 2272 if (dirpath != NULL) { 2273 kmf_set_attr_at_index(new_attrlist, i, 2274 KMF_DIRPATH_ATTR, dirpath, strlen(dirpath)); 2275 i++; 2276 } 2277 2278 keyfile = kmf_get_attr_ptr(KMF_KEY_FILENAME_ATTR, attrlist, numattr); 2279 if (keyfile == NULL) 2280 return (KMF_ERR_BAD_PARAMETER); 2281 else { 2282 kmf_set_attr_at_index(new_attrlist, i, 2283 KMF_KEY_FILENAME_ATTR, keyfile, strlen(keyfile)); 2284 i++; 2285 } 2286 2287 rv = OpenSSL_FindKey(handle, i, new_attrlist); 2288 return (rv); 2289 } 2290 2291 KMF_RETURN 2292 /*ARGSUSED*/ 2293 OpenSSL_DecryptData(KMF_HANDLE_T handle, KMF_KEY_HANDLE *key, 2294 KMF_OID *AlgOID, KMF_DATA *ciphertext, 2295 KMF_DATA *output) 2296 { 2297 KMF_RETURN ret = KMF_OK; 2298 RSA *rsa = NULL; 2299 unsigned int in_len = 0, out_len = 0; 2300 unsigned int total_decrypted = 0, modulus_len = 0; 2301 uint8_t *in_data, *out_data; 2302 int i, blocks; 2303 2304 if (key == NULL || AlgOID == NULL || 2305 ciphertext == NULL || output == NULL || 2306 ciphertext->Data == NULL || 2307 output->Data == NULL) 2308 return (KMF_ERR_BAD_PARAMETER); 2309 2310 if (key->keyalg == KMF_RSA) { 2311 rsa = EVP_PKEY_get1_RSA((EVP_PKEY *)key->keyp); 2312 modulus_len = RSA_size(rsa); 2313 } else { 2314 return (KMF_ERR_BAD_PARAMETER); 2315 } 2316 2317 blocks = ciphertext->Length/modulus_len; 2318 out_data = output->Data; 2319 in_data = ciphertext->Data; 2320 out_len = modulus_len - 11; 2321 in_len = modulus_len; 2322 2323 for (i = 0; i < blocks; i++) { 2324 out_len = RSA_private_decrypt(in_len, 2325 in_data, out_data, rsa, RSA_PKCS1_PADDING); 2326 2327 if (out_len == 0) { 2328 ret = KMF_ERR_INTERNAL; 2329 goto cleanup; 2330 } 2331 2332 out_data += out_len; 2333 total_decrypted += out_len; 2334 in_data += in_len; 2335 } 2336 2337 output->Length = total_decrypted; 2338 2339 cleanup: 2340 RSA_free(rsa); 2341 if (ret != KMF_OK) 2342 output->Length = 0; 2343 2344 return (ret); 2345 2346 } 2347 2348 /* 2349 * This function will create a certid from issuer_cert and user_cert. 2350 * The caller should use OCSP_CERTID_free(OCSP_CERTID *) to deallocate 2351 * certid memory after use. 2352 */ 2353 static KMF_RETURN 2354 create_certid(KMF_HANDLE_T handle, const KMF_DATA *issuer_cert, 2355 const KMF_DATA *user_cert, OCSP_CERTID **certid) 2356 { 2357 KMF_RETURN ret = KMF_OK; 2358 KMF_HANDLE *kmfh = (KMF_HANDLE *)handle; 2359 X509 *issuer = NULL; 2360 X509 *cert = NULL; 2361 unsigned char *ptmp; 2362 2363 if (issuer_cert == NULL || user_cert == NULL) { 2364 return (KMF_ERR_BAD_PARAMETER); 2365 } 2366 2367 /* convert the DER-encoded issuer cert to an internal X509 */ 2368 ptmp = issuer_cert->Data; 2369 issuer = d2i_X509(NULL, (const uchar_t **)&ptmp, 2370 issuer_cert->Length); 2371 if (issuer == NULL) { 2372 SET_ERROR(kmfh, ERR_get_error()); 2373 ret = KMF_ERR_OCSP_BAD_ISSUER; 2374 goto end; 2375 } 2376 2377 /* convert the DER-encoded user cert to an internal X509 */ 2378 ptmp = user_cert->Data; 2379 cert = d2i_X509(NULL, (const uchar_t **)&ptmp, 2380 user_cert->Length); 2381 if (cert == NULL) { 2382 SET_ERROR(kmfh, ERR_get_error()); 2383 2384 ret = KMF_ERR_OCSP_BAD_CERT; 2385 goto end; 2386 } 2387 2388 /* create a CERTID */ 2389 *certid = OCSP_cert_to_id(NULL, cert, issuer); 2390 if (*certid == NULL) { 2391 SET_ERROR(kmfh, ERR_get_error()); 2392 ret = KMF_ERR_OCSP_CERTID; 2393 goto end; 2394 } 2395 2396 end: 2397 if (issuer != NULL) { 2398 X509_free(issuer); 2399 } 2400 2401 if (cert != NULL) { 2402 X509_free(cert); 2403 } 2404 2405 return (ret); 2406 } 2407 2408 KMF_RETURN 2409 OpenSSL_CreateOCSPRequest(KMF_HANDLE_T handle, 2410 int numattr, KMF_ATTRIBUTE *attrlist) 2411 { 2412 KMF_RETURN ret = KMF_OK; 2413 KMF_HANDLE *kmfh = (KMF_HANDLE *)handle; 2414 OCSP_CERTID *id = NULL; 2415 OCSP_REQUEST *req = NULL; 2416 BIO *derbio = NULL; 2417 char *reqfile; 2418 KMF_DATA *issuer_cert; 2419 KMF_DATA *user_cert; 2420 2421 user_cert = kmf_get_attr_ptr(KMF_USER_CERT_DATA_ATTR, 2422 attrlist, numattr); 2423 if (user_cert == NULL) 2424 return (KMF_ERR_BAD_PARAMETER); 2425 2426 issuer_cert = kmf_get_attr_ptr(KMF_ISSUER_CERT_DATA_ATTR, 2427 attrlist, numattr); 2428 if (issuer_cert == NULL) 2429 return (KMF_ERR_BAD_PARAMETER); 2430 2431 reqfile = kmf_get_attr_ptr(KMF_OCSP_REQUEST_FILENAME_ATTR, 2432 attrlist, numattr); 2433 if (reqfile == NULL) 2434 return (KMF_ERR_BAD_PARAMETER); 2435 2436 ret = create_certid(handle, issuer_cert, user_cert, &id); 2437 if (ret != KMF_OK) { 2438 return (ret); 2439 } 2440 2441 /* Create an OCSP request */ 2442 req = OCSP_REQUEST_new(); 2443 if (req == NULL) { 2444 SET_ERROR(kmfh, ERR_get_error()); 2445 ret = KMF_ERR_OCSP_CREATE_REQUEST; 2446 goto end; 2447 } 2448 2449 if (!OCSP_request_add0_id(req, id)) { 2450 ret = KMF_ERR_OCSP_CREATE_REQUEST; 2451 goto end; 2452 } 2453 2454 /* Write the request to the output file with DER encoding */ 2455 derbio = BIO_new_file(reqfile, "wb"); 2456 if (!derbio) { 2457 SET_ERROR(kmfh, ERR_get_error()); 2458 ret = KMF_ERR_OPEN_FILE; 2459 goto end; 2460 } 2461 if (i2d_OCSP_REQUEST_bio(derbio, req) <= 0) { 2462 ret = KMF_ERR_ENCODING; 2463 } 2464 2465 end: 2466 /* 2467 * We don't need to free "id" explicitely, because OCSP_REQUEST_free() 2468 * will also deallocate certid's space. 2469 */ 2470 if (req != NULL) { 2471 OCSP_REQUEST_free(req); 2472 } 2473 2474 if (derbio != NULL) { 2475 (void) BIO_free(derbio); 2476 } 2477 2478 return (ret); 2479 } 2480 2481 /* ocsp_find_signer_sk() is copied from openssl source */ 2482 static X509 *ocsp_find_signer_sk(STACK_OF(X509) *certs, OCSP_RESPID *id) 2483 { 2484 int i; 2485 unsigned char tmphash[SHA_DIGEST_LENGTH], *keyhash; 2486 2487 /* Easy if lookup by name */ 2488 if (id->type == V_OCSP_RESPID_NAME) 2489 return (X509_find_by_subject(certs, id->value.byName)); 2490 2491 /* Lookup by key hash */ 2492 2493 /* If key hash isn't SHA1 length then forget it */ 2494 if (id->value.byKey->length != SHA_DIGEST_LENGTH) 2495 return (NULL); 2496 2497 keyhash = id->value.byKey->data; 2498 /* Calculate hash of each key and compare */ 2499 for (i = 0; i < sk_X509_num(certs); i++) { 2500 /* LINTED E_BAD_PTR_CAST_ALIGN */ 2501 X509 *x = sk_X509_value(certs, i); 2502 /* Use pubkey_digest to get the key ID value */ 2503 (void) X509_pubkey_digest(x, EVP_sha1(), tmphash, NULL); 2504 if (!memcmp(keyhash, tmphash, SHA_DIGEST_LENGTH)) 2505 return (x); 2506 } 2507 return (NULL); 2508 } 2509 2510 /* ocsp_find_signer() is copied from openssl source */ 2511 /* ARGSUSED2 */ 2512 static int 2513 ocsp_find_signer(X509 **psigner, OCSP_BASICRESP *bs, STACK_OF(X509) *certs, 2514 X509_STORE *st, unsigned long flags) 2515 { 2516 X509 *signer; 2517 OCSP_RESPID *rid = bs->tbsResponseData->responderId; 2518 if ((signer = ocsp_find_signer_sk(certs, rid))) { 2519 *psigner = signer; 2520 return (2); 2521 } 2522 if (!(flags & OCSP_NOINTERN) && 2523 (signer = ocsp_find_signer_sk(bs->certs, rid))) { 2524 *psigner = signer; 2525 return (1); 2526 } 2527 /* Maybe lookup from store if by subject name */ 2528 2529 *psigner = NULL; 2530 return (0); 2531 } 2532 2533 /* 2534 * This function will verify the signature of a basic response, using 2535 * the public key from the OCSP responder certificate. 2536 */ 2537 static KMF_RETURN 2538 check_response_signature(KMF_HANDLE_T handle, OCSP_BASICRESP *bs, 2539 KMF_DATA *signer_cert, KMF_DATA *issuer_cert) 2540 { 2541 KMF_RETURN ret = KMF_OK; 2542 KMF_HANDLE *kmfh = (KMF_HANDLE *)handle; 2543 STACK_OF(X509) *cert_stack = NULL; 2544 X509 *signer = NULL; 2545 X509 *issuer = NULL; 2546 EVP_PKEY *skey = NULL; 2547 unsigned char *ptmp; 2548 2549 2550 if (bs == NULL || issuer_cert == NULL) 2551 return (KMF_ERR_BAD_PARAMETER); 2552 2553 /* 2554 * Find the certificate that signed the basic response. 2555 * 2556 * If signer_cert is not NULL, we will use that as the signer cert. 2557 * Otherwise, we will check if the issuer cert is actually the signer. 2558 * If we still do not find a signer, we will look for it from the 2559 * certificate list came with the response file. 2560 */ 2561 if (signer_cert != NULL) { 2562 ptmp = signer_cert->Data; 2563 signer = d2i_X509(NULL, (const uchar_t **)&ptmp, 2564 signer_cert->Length); 2565 if (signer == NULL) { 2566 SET_ERROR(kmfh, ERR_get_error()); 2567 ret = KMF_ERR_OCSP_BAD_SIGNER; 2568 goto end; 2569 } 2570 } else { 2571 /* 2572 * Convert the issuer cert into X509 and push it into a 2573 * stack to be used by ocsp_find_signer(). 2574 */ 2575 ptmp = issuer_cert->Data; 2576 issuer = d2i_X509(NULL, (const uchar_t **)&ptmp, 2577 issuer_cert->Length); 2578 if (issuer == NULL) { 2579 SET_ERROR(kmfh, ERR_get_error()); 2580 ret = KMF_ERR_OCSP_BAD_ISSUER; 2581 goto end; 2582 } 2583 2584 if ((cert_stack = sk_X509_new_null()) == NULL) { 2585 ret = KMF_ERR_INTERNAL; 2586 goto end; 2587 } 2588 2589 if (sk_X509_push(cert_stack, issuer) == NULL) { 2590 ret = KMF_ERR_INTERNAL; 2591 goto end; 2592 } 2593 2594 ret = ocsp_find_signer(&signer, bs, cert_stack, NULL, 0); 2595 if (!ret) { 2596 /* can not find the signer */ 2597 ret = KMF_ERR_OCSP_BAD_SIGNER; 2598 goto end; 2599 } 2600 } 2601 2602 /* Verify the signature of the response */ 2603 skey = X509_get_pubkey(signer); 2604 if (skey == NULL) { 2605 ret = KMF_ERR_OCSP_BAD_SIGNER; 2606 goto end; 2607 } 2608 2609 ret = OCSP_BASICRESP_verify(bs, skey, 0); 2610 if (ret == 0) { 2611 ret = KMF_ERR_OCSP_RESPONSE_SIGNATURE; 2612 goto end; 2613 } 2614 2615 end: 2616 if (issuer != NULL) { 2617 X509_free(issuer); 2618 } 2619 2620 if (signer != NULL) { 2621 X509_free(signer); 2622 } 2623 2624 if (skey != NULL) { 2625 EVP_PKEY_free(skey); 2626 } 2627 2628 if (cert_stack != NULL) { 2629 sk_X509_free(cert_stack); 2630 } 2631 2632 return (ret); 2633 } 2634 2635 2636 2637 KMF_RETURN 2638 OpenSSL_GetOCSPStatusForCert(KMF_HANDLE_T handle, 2639 int numattr, KMF_ATTRIBUTE *attrlist) 2640 { 2641 KMF_RETURN ret = KMF_OK; 2642 BIO *derbio = NULL; 2643 OCSP_RESPONSE *resp = NULL; 2644 OCSP_BASICRESP *bs = NULL; 2645 OCSP_CERTID *id = NULL; 2646 OCSP_SINGLERESP *single = NULL; 2647 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd; 2648 int index, status, reason; 2649 KMF_DATA *issuer_cert; 2650 KMF_DATA *user_cert; 2651 KMF_DATA *signer_cert; 2652 KMF_DATA *response; 2653 int *response_reason, *response_status, *cert_status; 2654 boolean_t ignore_response_sign = B_FALSE; /* default is FALSE */ 2655 uint32_t response_lifetime; 2656 2657 issuer_cert = kmf_get_attr_ptr(KMF_ISSUER_CERT_DATA_ATTR, 2658 attrlist, numattr); 2659 if (issuer_cert == NULL) 2660 return (KMF_ERR_BAD_PARAMETER); 2661 2662 user_cert = kmf_get_attr_ptr(KMF_USER_CERT_DATA_ATTR, 2663 attrlist, numattr); 2664 if (user_cert == NULL) 2665 return (KMF_ERR_BAD_PARAMETER); 2666 2667 response = kmf_get_attr_ptr(KMF_OCSP_RESPONSE_DATA_ATTR, 2668 attrlist, numattr); 2669 if (response == NULL) 2670 return (KMF_ERR_BAD_PARAMETER); 2671 2672 response_status = kmf_get_attr_ptr(KMF_OCSP_RESPONSE_STATUS_ATTR, 2673 attrlist, numattr); 2674 if (response_status == NULL) 2675 return (KMF_ERR_BAD_PARAMETER); 2676 2677 response_reason = kmf_get_attr_ptr(KMF_OCSP_RESPONSE_REASON_ATTR, 2678 attrlist, numattr); 2679 if (response_reason == NULL) 2680 return (KMF_ERR_BAD_PARAMETER); 2681 2682 cert_status = kmf_get_attr_ptr(KMF_OCSP_RESPONSE_CERT_STATUS_ATTR, 2683 attrlist, numattr); 2684 if (cert_status == NULL) 2685 return (KMF_ERR_BAD_PARAMETER); 2686 2687 /* Read in the response */ 2688 derbio = BIO_new_mem_buf(response->Data, response->Length); 2689 if (!derbio) { 2690 ret = KMF_ERR_MEMORY; 2691 return (ret); 2692 } 2693 2694 resp = d2i_OCSP_RESPONSE_bio(derbio, NULL); 2695 if (resp == NULL) { 2696 ret = KMF_ERR_OCSP_MALFORMED_RESPONSE; 2697 goto end; 2698 } 2699 2700 /* Check the response status */ 2701 status = OCSP_response_status(resp); 2702 *response_status = status; 2703 if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL) { 2704 ret = KMF_ERR_OCSP_RESPONSE_STATUS; 2705 goto end; 2706 } 2707 2708 #ifdef DEBUG 2709 printf("Successfully checked the response file status.\n"); 2710 #endif /* DEBUG */ 2711 2712 /* Extract basic response */ 2713 bs = OCSP_response_get1_basic(resp); 2714 if (bs == NULL) { 2715 ret = KMF_ERR_OCSP_NO_BASIC_RESPONSE; 2716 goto end; 2717 } 2718 2719 #ifdef DEBUG 2720 printf("Successfully retrieved the basic response.\n"); 2721 #endif /* DEBUG */ 2722 2723 /* Check the basic response signature if required */ 2724 ret = kmf_get_attr(KMF_IGNORE_RESPONSE_SIGN_ATTR, attrlist, numattr, 2725 (void *)&ignore_response_sign, NULL); 2726 if (ret != KMF_OK) 2727 ret = KMF_OK; 2728 2729 signer_cert = kmf_get_attr_ptr(KMF_SIGNER_CERT_DATA_ATTR, 2730 attrlist, numattr); 2731 2732 if (ignore_response_sign == B_FALSE) { 2733 ret = check_response_signature(handle, bs, 2734 signer_cert, issuer_cert); 2735 if (ret != KMF_OK) 2736 goto end; 2737 } 2738 2739 #ifdef DEBUG 2740 printf("Successfully verified the response signature.\n"); 2741 #endif /* DEBUG */ 2742 2743 /* Create a certid for the certificate in question */ 2744 ret = create_certid(handle, issuer_cert, user_cert, &id); 2745 if (ret != KMF_OK) { 2746 ret = KMF_ERR_OCSP_CERTID; 2747 goto end; 2748 } 2749 2750 #ifdef DEBUG 2751 printf("successfully created a certid for the cert.\n"); 2752 #endif /* DEBUG */ 2753 2754 /* Find the index of the single response for the certid */ 2755 index = OCSP_resp_find(bs, id, -1); 2756 if (index < 0) { 2757 /* cound not find this certificate in the response */ 2758 ret = KMF_ERR_OCSP_UNKNOWN_CERT; 2759 goto end; 2760 } 2761 2762 #ifdef DEBUG 2763 printf("Successfully found the single response index for the cert.\n"); 2764 #endif /* DEBUG */ 2765 2766 /* Retrieve the single response and get the cert status */ 2767 single = OCSP_resp_get0(bs, index); 2768 status = OCSP_single_get0_status(single, &reason, &rev, &thisupd, 2769 &nextupd); 2770 if (status == V_OCSP_CERTSTATUS_GOOD) { 2771 *cert_status = OCSP_GOOD; 2772 } else if (status == V_OCSP_CERTSTATUS_UNKNOWN) { 2773 *cert_status = OCSP_UNKNOWN; 2774 } else { /* revoked */ 2775 *cert_status = OCSP_REVOKED; 2776 *response_reason = reason; 2777 } 2778 ret = KMF_OK; 2779 2780 /* resp. time is optional, so we don't care about the return code. */ 2781 (void) kmf_get_attr(KMF_RESPONSE_LIFETIME_ATTR, attrlist, numattr, 2782 (void *)&response_lifetime, NULL); 2783 2784 if (!OCSP_check_validity(thisupd, nextupd, 300, 2785 response_lifetime)) { 2786 ret = KMF_ERR_OCSP_STATUS_TIME_INVALID; 2787 goto end; 2788 } 2789 2790 #ifdef DEBUG 2791 printf("Successfully verify the time.\n"); 2792 #endif /* DEBUG */ 2793 2794 end: 2795 if (derbio != NULL) 2796 (void) BIO_free(derbio); 2797 2798 if (resp != NULL) 2799 OCSP_RESPONSE_free(resp); 2800 2801 if (bs != NULL) 2802 OCSP_BASICRESP_free(bs); 2803 2804 if (id != NULL) 2805 OCSP_CERTID_free(id); 2806 2807 return (ret); 2808 } 2809 2810 static KMF_RETURN 2811 fetch_key(KMF_HANDLE_T handle, char *path, 2812 KMF_KEY_CLASS keyclass, KMF_KEY_HANDLE *key) 2813 { 2814 KMF_RETURN rv = KMF_OK; 2815 EVP_PKEY *pkey = NULL; 2816 KMF_RAW_SYM_KEY *rkey = NULL; 2817 2818 if (keyclass == KMF_ASYM_PRI || 2819 keyclass == KMF_ASYM_PUB) { 2820 pkey = openssl_load_key(handle, path); 2821 if (pkey == NULL) { 2822 return (KMF_ERR_KEY_NOT_FOUND); 2823 } 2824 if (key != NULL) { 2825 if (pkey->type == EVP_PKEY_RSA) 2826 key->keyalg = KMF_RSA; 2827 else if (pkey->type == EVP_PKEY_DSA) 2828 key->keyalg = KMF_DSA; 2829 2830 key->kstype = KMF_KEYSTORE_OPENSSL; 2831 key->keyclass = keyclass; 2832 key->keyp = (void *)pkey; 2833 key->israw = FALSE; 2834 if (path != NULL && 2835 ((key->keylabel = strdup(path)) == NULL)) { 2836 EVP_PKEY_free(pkey); 2837 return (KMF_ERR_MEMORY); 2838 } 2839 } else { 2840 EVP_PKEY_free(pkey); 2841 pkey = NULL; 2842 } 2843 } else if (keyclass == KMF_SYMMETRIC) { 2844 KMF_ENCODE_FORMAT fmt; 2845 /* 2846 * If the file is a recognized format, 2847 * then it is NOT a symmetric key. 2848 */ 2849 rv = kmf_get_file_format(path, &fmt); 2850 if (rv == KMF_OK || fmt != 0) { 2851 return (KMF_ERR_KEY_NOT_FOUND); 2852 } else if (rv == KMF_ERR_ENCODING) { 2853 /* 2854 * If we don't know the encoding, 2855 * it is probably a symmetric key. 2856 */ 2857 rv = KMF_OK; 2858 } else if (rv == KMF_ERR_OPEN_FILE) { 2859 return (KMF_ERR_KEY_NOT_FOUND); 2860 } 2861 2862 if (key != NULL) { 2863 KMF_DATA keyvalue; 2864 rkey = malloc(sizeof (KMF_RAW_SYM_KEY)); 2865 if (rkey == NULL) { 2866 rv = KMF_ERR_MEMORY; 2867 goto out; 2868 } 2869 2870 (void) memset(rkey, 0, sizeof (KMF_RAW_SYM_KEY)); 2871 rv = kmf_read_input_file(handle, path, &keyvalue); 2872 if (rv != KMF_OK) 2873 goto out; 2874 2875 rkey->keydata.len = keyvalue.Length; 2876 rkey->keydata.val = keyvalue.Data; 2877 2878 key->kstype = KMF_KEYSTORE_OPENSSL; 2879 key->keyclass = keyclass; 2880 key->israw = TRUE; 2881 key->keyp = (void *)rkey; 2882 if (path != NULL && 2883 ((key->keylabel = strdup(path)) == NULL)) { 2884 rv = KMF_ERR_MEMORY; 2885 } 2886 } 2887 } 2888 out: 2889 if (rv != KMF_OK) { 2890 if (rkey != NULL) { 2891 kmf_free_raw_sym_key(rkey); 2892 } 2893 if (pkey != NULL) 2894 EVP_PKEY_free(pkey); 2895 2896 if (key != NULL) { 2897 key->keyalg = KMF_KEYALG_NONE; 2898 key->keyclass = KMF_KEYCLASS_NONE; 2899 key->keyp = NULL; 2900 } 2901 } 2902 2903 return (rv); 2904 } 2905 2906 KMF_RETURN 2907 OpenSSL_FindKey(KMF_HANDLE_T handle, 2908 int numattr, KMF_ATTRIBUTE *attrlist) 2909 { 2910 KMF_RETURN rv = KMF_OK; 2911 char *fullpath = NULL; 2912 uint32_t maxkeys; 2913 KMF_KEY_HANDLE *key; 2914 uint32_t *numkeys; 2915 KMF_KEY_CLASS keyclass; 2916 KMF_RAW_KEY_DATA *rawkey; 2917 char *dirpath; 2918 char *keyfile; 2919 2920 if (handle == NULL) 2921 return (KMF_ERR_BAD_PARAMETER); 2922 2923 numkeys = kmf_get_attr_ptr(KMF_COUNT_ATTR, attrlist, numattr); 2924 if (numkeys == NULL) 2925 return (KMF_ERR_BAD_PARAMETER); 2926 2927 rv = kmf_get_attr(KMF_KEYCLASS_ATTR, attrlist, numattr, 2928 (void *)&keyclass, NULL); 2929 if (rv != KMF_OK) 2930 return (KMF_ERR_BAD_PARAMETER); 2931 2932 if (keyclass != KMF_ASYM_PUB && 2933 keyclass != KMF_ASYM_PRI && 2934 keyclass != KMF_SYMMETRIC) 2935 return (KMF_ERR_BAD_KEY_CLASS); 2936 2937 dirpath = kmf_get_attr_ptr(KMF_DIRPATH_ATTR, attrlist, numattr); 2938 keyfile = kmf_get_attr_ptr(KMF_KEY_FILENAME_ATTR, attrlist, numattr); 2939 2940 fullpath = get_fullpath(dirpath, keyfile); 2941 2942 if (fullpath == NULL) 2943 return (KMF_ERR_BAD_PARAMETER); 2944 2945 maxkeys = *numkeys; 2946 if (maxkeys == 0) 2947 maxkeys = 0xFFFFFFFF; 2948 *numkeys = 0; 2949 2950 key = kmf_get_attr_ptr(KMF_KEY_HANDLE_ATTR, attrlist, numattr); 2951 /* it is okay to have "keys" contains NULL */ 2952 2953 /* 2954 * The caller may want a list of the raw key data as well. 2955 * Useful for importing keys from a file into other keystores. 2956 */ 2957 rawkey = kmf_get_attr_ptr(KMF_RAW_KEY_ATTR, attrlist, numattr); 2958 2959 if (isdir(fullpath)) { 2960 DIR *dirp; 2961 struct dirent *dp; 2962 int n = 0; 2963 2964 /* open all files in the directory and attempt to read them */ 2965 if ((dirp = opendir(fullpath)) == NULL) { 2966 return (KMF_ERR_BAD_PARAMETER); 2967 } 2968 rewinddir(dirp); 2969 while ((dp = readdir(dirp)) != NULL && n < maxkeys) { 2970 if (strcmp(dp->d_name, ".") && 2971 strcmp(dp->d_name, "..")) { 2972 char *fname; 2973 2974 fname = get_fullpath(fullpath, 2975 (char *)&dp->d_name); 2976 2977 rv = fetch_key(handle, fname, 2978 keyclass, key ? &key[n] : NULL); 2979 2980 if (rv == KMF_OK) { 2981 if (key != NULL && rawkey != NULL) 2982 rv = convertToRawKey( 2983 key[n].keyp, &rawkey[n]); 2984 n++; 2985 } 2986 2987 if (rv != KMF_OK || key == NULL) 2988 free(fname); 2989 } 2990 } 2991 (void) closedir(dirp); 2992 free(fullpath); 2993 (*numkeys) = n; 2994 } else { 2995 rv = fetch_key(handle, fullpath, keyclass, key); 2996 if (rv == KMF_OK) 2997 (*numkeys) = 1; 2998 2999 if (rv != KMF_OK || key == NULL) 3000 free(fullpath); 3001 3002 if (rv == KMF_OK && key != NULL && rawkey != NULL) { 3003 rv = convertToRawKey(key->keyp, rawkey); 3004 } 3005 } 3006 3007 if (rv == KMF_OK && (*numkeys) == 0) 3008 rv = KMF_ERR_KEY_NOT_FOUND; 3009 else if (rv == KMF_ERR_KEY_NOT_FOUND && (*numkeys) > 0) 3010 rv = KMF_OK; 3011 3012 return (rv); 3013 } 3014 3015 #define HANDLE_PK12_ERROR { \ 3016 SET_ERROR(kmfh, ERR_get_error()); \ 3017 rv = KMF_ERR_ENCODING; \ 3018 goto out; \ 3019 } 3020 3021 static int 3022 add_alias_to_bag(PKCS12_SAFEBAG *bag, X509 *xcert) 3023 { 3024 if (xcert != NULL && xcert->aux != NULL && 3025 xcert->aux->alias != NULL) { 3026 if (PKCS12_add_friendlyname_asc(bag, 3027 (const char *)xcert->aux->alias->data, 3028 xcert->aux->alias->length) == 0) 3029 return (0); 3030 } 3031 return (1); 3032 } 3033 3034 static PKCS7 * 3035 add_cert_to_safe(X509 *sslcert, KMF_CREDENTIAL *cred, 3036 uchar_t *keyid, unsigned int keyidlen) 3037 { 3038 PKCS12_SAFEBAG *bag = NULL; 3039 PKCS7 *cert_authsafe = NULL; 3040 STACK_OF(PKCS12_SAFEBAG) *bag_stack; 3041 3042 bag_stack = sk_PKCS12_SAFEBAG_new_null(); 3043 if (bag_stack == NULL) 3044 return (NULL); 3045 3046 /* Convert cert from X509 struct to PKCS#12 bag */ 3047 bag = PKCS12_x5092certbag(sslcert); 3048 if (bag == NULL) { 3049 goto out; 3050 } 3051 3052 /* Add the key id to the certificate bag. */ 3053 if (keyidlen > 0 && !PKCS12_add_localkeyid(bag, keyid, keyidlen)) { 3054 goto out; 3055 } 3056 3057 if (!add_alias_to_bag(bag, sslcert)) 3058 goto out; 3059 3060 /* Pile it on the bag_stack. */ 3061 if (!sk_PKCS12_SAFEBAG_push(bag_stack, bag)) { 3062 goto out; 3063 } 3064 /* Turn bag_stack of certs into encrypted authsafe. */ 3065 cert_authsafe = PKCS12_pack_p7encdata( 3066 NID_pbe_WithSHA1And40BitRC2_CBC, 3067 cred->cred, cred->credlen, NULL, 0, 3068 PKCS12_DEFAULT_ITER, bag_stack); 3069 3070 out: 3071 if (bag_stack != NULL) 3072 sk_PKCS12_SAFEBAG_pop_free(bag_stack, PKCS12_SAFEBAG_free); 3073 3074 return (cert_authsafe); 3075 } 3076 3077 static PKCS7 * 3078 add_key_to_safe(EVP_PKEY *pkey, KMF_CREDENTIAL *cred, 3079 uchar_t *keyid, unsigned int keyidlen, 3080 char *label, int label_len) 3081 { 3082 PKCS8_PRIV_KEY_INFO *p8 = NULL; 3083 STACK_OF(PKCS12_SAFEBAG) *bag_stack = NULL; 3084 PKCS12_SAFEBAG *bag = NULL; 3085 PKCS7 *key_authsafe = NULL; 3086 3087 p8 = EVP_PKEY2PKCS8(pkey); 3088 if (p8 == NULL) { 3089 return (NULL); 3090 } 3091 /* Put the shrouded key into a PKCS#12 bag. */ 3092 bag = PKCS12_MAKE_SHKEYBAG( 3093 NID_pbe_WithSHA1And3_Key_TripleDES_CBC, 3094 cred->cred, cred->credlen, 3095 NULL, 0, PKCS12_DEFAULT_ITER, p8); 3096 3097 /* Clean up the PKCS#8 shrouded key, don't need it now. */ 3098 PKCS8_PRIV_KEY_INFO_free(p8); 3099 p8 = NULL; 3100 3101 if (bag == NULL) { 3102 return (NULL); 3103 } 3104 if (keyidlen && !PKCS12_add_localkeyid(bag, keyid, keyidlen)) 3105 goto out; 3106 if (label != NULL && !PKCS12_add_friendlyname(bag, label, label_len)) 3107 goto out; 3108 3109 /* Start a PKCS#12 safebag container for the private key. */ 3110 bag_stack = sk_PKCS12_SAFEBAG_new_null(); 3111 if (bag_stack == NULL) 3112 goto out; 3113 3114 /* Pile on the private key on the bag_stack. */ 3115 if (!sk_PKCS12_SAFEBAG_push(bag_stack, bag)) 3116 goto out; 3117 3118 key_authsafe = PKCS12_pack_p7data(bag_stack); 3119 3120 out: 3121 if (bag_stack != NULL) 3122 sk_PKCS12_SAFEBAG_pop_free(bag_stack, PKCS12_SAFEBAG_free); 3123 bag_stack = NULL; 3124 return (key_authsafe); 3125 } 3126 3127 static EVP_PKEY * 3128 ImportRawRSAKey(KMF_RAW_RSA_KEY *key) 3129 { 3130 RSA *rsa = NULL; 3131 EVP_PKEY *newkey = NULL; 3132 3133 if ((rsa = RSA_new()) == NULL) 3134 return (NULL); 3135 3136 if ((rsa->n = BN_bin2bn(key->mod.val, key->mod.len, rsa->n)) == NULL) 3137 return (NULL); 3138 3139 if ((rsa->e = BN_bin2bn(key->pubexp.val, key->pubexp.len, rsa->e)) == 3140 NULL) 3141 return (NULL); 3142 3143 if (key->priexp.val != NULL) 3144 if ((rsa->d = BN_bin2bn(key->priexp.val, key->priexp.len, 3145 rsa->d)) == NULL) 3146 return (NULL); 3147 3148 if (key->prime1.val != NULL) 3149 if ((rsa->p = BN_bin2bn(key->prime1.val, key->prime1.len, 3150 rsa->p)) == NULL) 3151 return (NULL); 3152 3153 if (key->prime2.val != NULL) 3154 if ((rsa->q = BN_bin2bn(key->prime2.val, key->prime2.len, 3155 rsa->q)) == NULL) 3156 return (NULL); 3157 3158 if (key->exp1.val != NULL) 3159 if ((rsa->dmp1 = BN_bin2bn(key->exp1.val, key->exp1.len, 3160 rsa->dmp1)) == NULL) 3161 return (NULL); 3162 3163 if (key->exp2.val != NULL) 3164 if ((rsa->dmq1 = BN_bin2bn(key->exp2.val, key->exp2.len, 3165 rsa->dmq1)) == NULL) 3166 return (NULL); 3167 3168 if (key->coef.val != NULL) 3169 if ((rsa->iqmp = BN_bin2bn(key->coef.val, key->coef.len, 3170 rsa->iqmp)) == NULL) 3171 return (NULL); 3172 3173 if ((newkey = EVP_PKEY_new()) == NULL) 3174 return (NULL); 3175 3176 (void) EVP_PKEY_set1_RSA(newkey, rsa); 3177 3178 /* The original key must be freed once here or it leaks memory */ 3179 RSA_free(rsa); 3180 3181 return (newkey); 3182 } 3183 3184 static EVP_PKEY * 3185 ImportRawDSAKey(KMF_RAW_DSA_KEY *key) 3186 { 3187 DSA *dsa = NULL; 3188 EVP_PKEY *newkey = NULL; 3189 3190 if ((dsa = DSA_new()) == NULL) 3191 return (NULL); 3192 3193 if ((dsa->p = BN_bin2bn(key->prime.val, key->prime.len, 3194 dsa->p)) == NULL) 3195 return (NULL); 3196 3197 if ((dsa->q = BN_bin2bn(key->subprime.val, key->subprime.len, 3198 dsa->q)) == NULL) 3199 return (NULL); 3200 3201 if ((dsa->g = BN_bin2bn(key->base.val, key->base.len, 3202 dsa->g)) == NULL) 3203 return (NULL); 3204 3205 if ((dsa->priv_key = BN_bin2bn(key->value.val, key->value.len, 3206 dsa->priv_key)) == NULL) 3207 return (NULL); 3208 3209 if (key->pubvalue.val != NULL) { 3210 if ((dsa->pub_key = BN_bin2bn(key->pubvalue.val, 3211 key->pubvalue.len, dsa->pub_key)) == NULL) 3212 return (NULL); 3213 } 3214 3215 if ((newkey = EVP_PKEY_new()) == NULL) 3216 return (NULL); 3217 3218 (void) EVP_PKEY_set1_DSA(newkey, dsa); 3219 3220 /* The original key must be freed once here or it leaks memory */ 3221 DSA_free(dsa); 3222 return (newkey); 3223 } 3224 3225 static EVP_PKEY * 3226 raw_key_to_pkey(KMF_KEY_HANDLE *key) 3227 { 3228 EVP_PKEY *pkey = NULL; 3229 KMF_RAW_KEY_DATA *rawkey; 3230 ASN1_TYPE *attr = NULL; 3231 KMF_RETURN ret; 3232 3233 if (key == NULL || !key->israw) 3234 return (NULL); 3235 3236 rawkey = (KMF_RAW_KEY_DATA *)key->keyp; 3237 if (rawkey->keytype == KMF_RSA) { 3238 pkey = ImportRawRSAKey(&rawkey->rawdata.rsa); 3239 } else if (rawkey->keytype == KMF_DSA) { 3240 pkey = ImportRawDSAKey(&rawkey->rawdata.dsa); 3241 } else if (rawkey->keytype == KMF_ECDSA) { 3242 /* 3243 * OpenSSL in Solaris does not support EC for 3244 * legal reasons 3245 */ 3246 return (NULL); 3247 } else { 3248 /* wrong kind of key */ 3249 return (NULL); 3250 } 3251 3252 if (rawkey->label != NULL) { 3253 if ((attr = ASN1_TYPE_new()) == NULL) { 3254 EVP_PKEY_free(pkey); 3255 return (NULL); 3256 } 3257 attr->value.bmpstring = ASN1_STRING_type_new(V_ASN1_BMPSTRING); 3258 (void) ASN1_STRING_set(attr->value.bmpstring, rawkey->label, 3259 strlen(rawkey->label)); 3260 attr->type = V_ASN1_BMPSTRING; 3261 attr->value.ptr = (char *)attr->value.bmpstring; 3262 ret = set_pkey_attrib(pkey, attr, NID_friendlyName); 3263 if (ret != KMF_OK) { 3264 EVP_PKEY_free(pkey); 3265 ASN1_TYPE_free(attr); 3266 return (NULL); 3267 } 3268 } 3269 if (rawkey->id.Data != NULL) { 3270 if ((attr = ASN1_TYPE_new()) == NULL) { 3271 EVP_PKEY_free(pkey); 3272 return (NULL); 3273 } 3274 attr->value.octet_string = 3275 ASN1_STRING_type_new(V_ASN1_OCTET_STRING); 3276 attr->type = V_ASN1_OCTET_STRING; 3277 (void) ASN1_STRING_set(attr->value.octet_string, 3278 rawkey->id.Data, rawkey->id.Length); 3279 attr->value.ptr = (char *)attr->value.octet_string; 3280 ret = set_pkey_attrib(pkey, attr, NID_localKeyID); 3281 if (ret != KMF_OK) { 3282 EVP_PKEY_free(pkey); 3283 ASN1_TYPE_free(attr); 3284 return (NULL); 3285 } 3286 } 3287 return (pkey); 3288 } 3289 3290 /* 3291 * Search a list of private keys to find one that goes with the certificate. 3292 */ 3293 static EVP_PKEY * 3294 find_matching_key(X509 *xcert, int numkeys, KMF_KEY_HANDLE *keylist) 3295 { 3296 int i; 3297 EVP_PKEY *pkey = NULL; 3298 3299 if (numkeys == 0 || keylist == NULL || xcert == NULL) 3300 return (NULL); 3301 for (i = 0; i < numkeys; i++) { 3302 if (keylist[i].israw) 3303 pkey = raw_key_to_pkey(&keylist[i]); 3304 else 3305 pkey = (EVP_PKEY *)keylist[i].keyp; 3306 if (pkey != NULL) { 3307 if (X509_check_private_key(xcert, pkey)) { 3308 return (pkey); 3309 } else { 3310 EVP_PKEY_free(pkey); 3311 pkey = NULL; 3312 } 3313 } 3314 } 3315 return (pkey); 3316 } 3317 3318 static KMF_RETURN 3319 local_export_pk12(KMF_HANDLE_T handle, 3320 KMF_CREDENTIAL *cred, 3321 int numcerts, KMF_X509_DER_CERT *certlist, 3322 int numkeys, KMF_KEY_HANDLE *keylist, 3323 char *filename) 3324 { 3325 KMF_RETURN rv = KMF_OK; 3326 KMF_HANDLE *kmfh = (KMF_HANDLE *)handle; 3327 BIO *bio = NULL; 3328 PKCS7 *cert_authsafe = NULL; 3329 PKCS7 *key_authsafe = NULL; 3330 STACK_OF(PKCS7) *authsafe_stack = NULL; 3331 PKCS12 *p12_elem = NULL; 3332 int i; 3333 3334 if (numcerts == 0 && numkeys == 0) 3335 return (KMF_ERR_BAD_PARAMETER); 3336 3337 /* 3338 * Open the output file. 3339 */ 3340 if ((bio = BIO_new_file(filename, "wb")) == NULL) { 3341 SET_ERROR(kmfh, ERR_get_error()); 3342 rv = KMF_ERR_OPEN_FILE; 3343 goto cleanup; 3344 } 3345 3346 /* Start a PKCS#7 stack. */ 3347 authsafe_stack = sk_PKCS7_new_null(); 3348 if (authsafe_stack == NULL) { 3349 rv = KMF_ERR_MEMORY; 3350 goto cleanup; 3351 } 3352 if (numcerts > 0) { 3353 for (i = 0; rv == KMF_OK && i < numcerts; i++) { 3354 const uchar_t *p = certlist[i].certificate.Data; 3355 long len = certlist[i].certificate.Length; 3356 X509 *xcert = NULL; 3357 EVP_PKEY *pkey = NULL; 3358 unsigned char keyid[EVP_MAX_MD_SIZE]; 3359 unsigned int keyidlen = 0; 3360 3361 xcert = d2i_X509(NULL, &p, len); 3362 if (xcert == NULL) { 3363 SET_ERROR(kmfh, ERR_get_error()); 3364 rv = KMF_ERR_ENCODING; 3365 } 3366 if (certlist[i].kmf_private.label != NULL) { 3367 /* Set alias attribute */ 3368 (void) X509_alias_set1(xcert, 3369 (uchar_t *)certlist[i].kmf_private.label, 3370 strlen(certlist[i].kmf_private.label)); 3371 } 3372 /* Check if there is a key corresponding to this cert */ 3373 pkey = find_matching_key(xcert, numkeys, keylist); 3374 3375 /* 3376 * If key is found, get fingerprint and create a 3377 * safebag. 3378 */ 3379 if (pkey != NULL) { 3380 (void) X509_digest(xcert, EVP_sha1(), 3381 keyid, &keyidlen); 3382 key_authsafe = add_key_to_safe(pkey, cred, 3383 keyid, keyidlen, 3384 certlist[i].kmf_private.label, 3385 (certlist[i].kmf_private.label ? 3386 strlen(certlist[i].kmf_private.label) : 0)); 3387 3388 if (key_authsafe == NULL) { 3389 X509_free(xcert); 3390 EVP_PKEY_free(pkey); 3391 goto cleanup; 3392 } 3393 /* Put the key safe into the Auth Safe */ 3394 if (!sk_PKCS7_push(authsafe_stack, 3395 key_authsafe)) { 3396 X509_free(xcert); 3397 EVP_PKEY_free(pkey); 3398 goto cleanup; 3399 } 3400 } 3401 3402 /* create a certificate safebag */ 3403 cert_authsafe = add_cert_to_safe(xcert, cred, keyid, 3404 keyidlen); 3405 if (cert_authsafe == NULL) { 3406 X509_free(xcert); 3407 EVP_PKEY_free(pkey); 3408 goto cleanup; 3409 } 3410 if (!sk_PKCS7_push(authsafe_stack, cert_authsafe)) { 3411 X509_free(xcert); 3412 EVP_PKEY_free(pkey); 3413 goto cleanup; 3414 } 3415 3416 X509_free(xcert); 3417 if (pkey) 3418 EVP_PKEY_free(pkey); 3419 } 3420 } else if (numcerts == 0 && numkeys > 0) { 3421 /* 3422 * If only adding keys to the file. 3423 */ 3424 for (i = 0; i < numkeys; i++) { 3425 EVP_PKEY *pkey = NULL; 3426 3427 if (keylist[i].israw) 3428 pkey = raw_key_to_pkey(&keylist[i]); 3429 else 3430 pkey = (EVP_PKEY *)keylist[i].keyp; 3431 3432 if (pkey == NULL) 3433 continue; 3434 3435 key_authsafe = add_key_to_safe(pkey, cred, 3436 NULL, 0, NULL, 0); 3437 3438 if (key_authsafe == NULL) { 3439 EVP_PKEY_free(pkey); 3440 goto cleanup; 3441 } 3442 if (!sk_PKCS7_push(authsafe_stack, key_authsafe)) { 3443 EVP_PKEY_free(pkey); 3444 goto cleanup; 3445 } 3446 } 3447 } 3448 p12_elem = PKCS12_init(NID_pkcs7_data); 3449 if (p12_elem == NULL) { 3450 goto cleanup; 3451 } 3452 3453 /* Put the PKCS#7 stack into the PKCS#12 element. */ 3454 if (!PKCS12_pack_authsafes(p12_elem, authsafe_stack)) { 3455 goto cleanup; 3456 } 3457 3458 /* Set the integrity MAC on the PKCS#12 element. */ 3459 if (!PKCS12_set_mac(p12_elem, cred->cred, cred->credlen, 3460 NULL, 0, PKCS12_DEFAULT_ITER, NULL)) { 3461 goto cleanup; 3462 } 3463 3464 /* Write the PKCS#12 element to the export file. */ 3465 if (!i2d_PKCS12_bio(bio, p12_elem)) { 3466 goto cleanup; 3467 } 3468 PKCS12_free(p12_elem); 3469 3470 cleanup: 3471 /* Clear away the PKCS#7 stack, we're done with it. */ 3472 if (authsafe_stack) 3473 sk_PKCS7_pop_free(authsafe_stack, PKCS7_free); 3474 3475 if (bio != NULL) 3476 (void) BIO_free_all(bio); 3477 3478 return (rv); 3479 } 3480 3481 KMF_RETURN 3482 openssl_build_pk12(KMF_HANDLE_T handle, int numcerts, 3483 KMF_X509_DER_CERT *certlist, int numkeys, KMF_KEY_HANDLE *keylist, 3484 KMF_CREDENTIAL *p12cred, char *filename) 3485 { 3486 KMF_RETURN rv; 3487 3488 if (certlist == NULL && keylist == NULL) 3489 return (KMF_ERR_BAD_PARAMETER); 3490 3491 rv = local_export_pk12(handle, p12cred, numcerts, certlist, 3492 numkeys, keylist, filename); 3493 3494 return (rv); 3495 } 3496 3497 KMF_RETURN 3498 OpenSSL_ExportPK12(KMF_HANDLE_T handle, int numattr, KMF_ATTRIBUTE *attrlist) 3499 { 3500 KMF_RETURN rv; 3501 KMF_HANDLE *kmfh = (KMF_HANDLE *)handle; 3502 char *fullpath = NULL; 3503 char *dirpath = NULL; 3504 char *certfile = NULL; 3505 char *keyfile = NULL; 3506 char *filename = NULL; 3507 KMF_CREDENTIAL *p12cred = NULL; 3508 KMF_X509_DER_CERT certdata; 3509 KMF_KEY_HANDLE key; 3510 int gotkey = 0; 3511 int gotcert = 0; 3512 3513 if (handle == NULL) 3514 return (KMF_ERR_BAD_PARAMETER); 3515 3516 /* 3517 * First, find the certificate. 3518 */ 3519 dirpath = kmf_get_attr_ptr(KMF_DIRPATH_ATTR, attrlist, numattr); 3520 certfile = kmf_get_attr_ptr(KMF_CERT_FILENAME_ATTR, attrlist, numattr); 3521 if (certfile != NULL) { 3522 fullpath = get_fullpath(dirpath, certfile); 3523 if (fullpath == NULL) 3524 return (KMF_ERR_BAD_PARAMETER); 3525 3526 if (isdir(fullpath)) { 3527 free(fullpath); 3528 return (KMF_ERR_AMBIGUOUS_PATHNAME); 3529 } 3530 3531 (void) memset(&certdata, 0, sizeof (certdata)); 3532 rv = kmf_load_cert(kmfh, NULL, NULL, NULL, NULL, 3533 fullpath, &certdata.certificate); 3534 if (rv != KMF_OK) 3535 goto end; 3536 3537 gotcert++; 3538 certdata.kmf_private.keystore_type = KMF_KEYSTORE_OPENSSL; 3539 free(fullpath); 3540 } 3541 3542 /* 3543 * Now find the private key. 3544 */ 3545 keyfile = kmf_get_attr_ptr(KMF_KEY_FILENAME_ATTR, attrlist, numattr); 3546 if (keyfile != NULL) { 3547 fullpath = get_fullpath(dirpath, keyfile); 3548 if (fullpath == NULL) 3549 return (KMF_ERR_BAD_PARAMETER); 3550 3551 if (isdir(fullpath)) { 3552 free(fullpath); 3553 return (KMF_ERR_AMBIGUOUS_PATHNAME); 3554 } 3555 3556 (void) memset(&key, 0, sizeof (KMF_KEY_HANDLE)); 3557 rv = fetch_key(handle, fullpath, KMF_ASYM_PRI, &key); 3558 if (rv != KMF_OK) 3559 goto end; 3560 gotkey++; 3561 } 3562 3563 /* 3564 * Open the output file. 3565 */ 3566 filename = kmf_get_attr_ptr(KMF_OUTPUT_FILENAME_ATTR, attrlist, 3567 numattr); 3568 if (filename == NULL) { 3569 rv = KMF_ERR_BAD_PARAMETER; 3570 goto end; 3571 } 3572 3573 /* Stick the key and the cert into a PKCS#12 file */ 3574 p12cred = kmf_get_attr_ptr(KMF_PK12CRED_ATTR, attrlist, numattr); 3575 if (p12cred == NULL) { 3576 rv = KMF_ERR_BAD_PARAMETER; 3577 goto end; 3578 } 3579 3580 rv = local_export_pk12(handle, p12cred, 1, &certdata, 3581 1, &key, filename); 3582 3583 end: 3584 if (fullpath) 3585 free(fullpath); 3586 3587 if (gotcert) 3588 kmf_free_kmf_cert(handle, &certdata); 3589 if (gotkey) 3590 kmf_free_kmf_key(handle, &key); 3591 return (rv); 3592 } 3593 3594 /* 3595 * Helper function to extract keys and certificates from 3596 * a single PEM file. Typically the file should contain a 3597 * private key and an associated public key wrapped in an x509 cert. 3598 * However, the file may be just a list of X509 certs with no keys. 3599 */ 3600 static KMF_RETURN 3601 extract_pem(KMF_HANDLE *kmfh, 3602 char *issuer, char *subject, KMF_BIGINT *serial, 3603 char *filename, CK_UTF8CHAR *pin, 3604 CK_ULONG pinlen, EVP_PKEY **priv_key, KMF_DATA **certs, 3605 int *numcerts) 3606 /* ARGSUSED6 */ 3607 { 3608 KMF_RETURN rv = KMF_OK; 3609 FILE *fp; 3610 STACK_OF(X509_INFO) *x509_info_stack = NULL; 3611 int i, ncerts = 0, matchcerts = 0; 3612 EVP_PKEY *pkey = NULL; 3613 X509_INFO *info; 3614 X509 *x; 3615 X509_INFO **cert_infos = NULL; 3616 KMF_DATA *certlist = NULL; 3617 3618 if (priv_key) 3619 *priv_key = NULL; 3620 if (certs) 3621 *certs = NULL; 3622 fp = fopen(filename, "r"); 3623 if (fp == NULL) 3624 return (KMF_ERR_OPEN_FILE); 3625 3626 x509_info_stack = PEM_X509_INFO_read(fp, NULL, NULL, pin); 3627 if (x509_info_stack == NULL) { 3628 (void) fclose(fp); 3629 return (KMF_ERR_ENCODING); 3630 } 3631 cert_infos = (X509_INFO **)malloc(sk_X509_INFO_num(x509_info_stack) * 3632 sizeof (X509_INFO *)); 3633 if (cert_infos == NULL) { 3634 (void) fclose(fp); 3635 rv = KMF_ERR_MEMORY; 3636 goto err; 3637 } 3638 3639 for (i = 0; i < sk_X509_INFO_num(x509_info_stack); i++) { 3640 /* LINTED E_BAD_PTR_CAST_ALIGN */ 3641 cert_infos[ncerts] = sk_X509_INFO_value(x509_info_stack, i); 3642 ncerts++; 3643 } 3644 3645 if (ncerts == 0) { 3646 (void) fclose(fp); 3647 rv = KMF_ERR_CERT_NOT_FOUND; 3648 goto err; 3649 } 3650 3651 if (priv_key != NULL) { 3652 rewind(fp); 3653 pkey = PEM_read_PrivateKey(fp, NULL, NULL, pin); 3654 } 3655 (void) fclose(fp); 3656 3657 x = cert_infos[ncerts - 1]->x509; 3658 /* 3659 * Make sure the private key matchs the last cert in the file. 3660 */ 3661 if (pkey != NULL && !X509_check_private_key(x, pkey)) { 3662 EVP_PKEY_free(pkey); 3663 rv = KMF_ERR_KEY_MISMATCH; 3664 goto err; 3665 } 3666 3667 certlist = (KMF_DATA *)calloc(ncerts, sizeof (KMF_DATA)); 3668 if (certlist == NULL) { 3669 if (pkey != NULL) 3670 EVP_PKEY_free(pkey); 3671 rv = KMF_ERR_MEMORY; 3672 goto err; 3673 } 3674 3675 /* 3676 * Convert all of the certs to DER format. 3677 */ 3678 matchcerts = 0; 3679 for (i = 0; rv == KMF_OK && certs != NULL && i < ncerts; i++) { 3680 boolean_t match = FALSE; 3681 info = cert_infos[ncerts - 1 - i]; 3682 3683 rv = check_cert(info->x509, issuer, subject, serial, &match); 3684 if (rv != KMF_OK || match != TRUE) { 3685 rv = KMF_OK; 3686 continue; 3687 } 3688 3689 rv = ssl_cert2KMFDATA(kmfh, info->x509, 3690 &certlist[matchcerts++]); 3691 3692 if (rv != KMF_OK) { 3693 int j; 3694 for (j = 0; j < matchcerts; j++) 3695 kmf_free_data(&certlist[j]); 3696 free(certlist); 3697 certlist = NULL; 3698 ncerts = matchcerts = 0; 3699 } 3700 } 3701 3702 if (numcerts != NULL) 3703 *numcerts = matchcerts; 3704 3705 if (certs != NULL) 3706 *certs = certlist; 3707 else if (certlist != NULL) { 3708 for (i = 0; i < ncerts; i++) 3709 kmf_free_data(&certlist[i]); 3710 free(certlist); 3711 certlist = NULL; 3712 } 3713 3714 if (priv_key == NULL && pkey != NULL) 3715 EVP_PKEY_free(pkey); 3716 else if (priv_key != NULL && pkey != NULL) 3717 *priv_key = pkey; 3718 3719 err: 3720 /* Cleanup the stack of X509 info records */ 3721 for (i = 0; i < sk_X509_INFO_num(x509_info_stack); i++) { 3722 /* LINTED E_BAD_PTR_CAST_ALIGN */ 3723 info = (X509_INFO *)sk_X509_INFO_value(x509_info_stack, i); 3724 X509_INFO_free(info); 3725 } 3726 if (x509_info_stack) 3727 sk_X509_INFO_free(x509_info_stack); 3728 3729 if (cert_infos != NULL) 3730 free(cert_infos); 3731 3732 return (rv); 3733 } 3734 3735 static KMF_RETURN 3736 openssl_parse_bags(STACK_OF(PKCS12_SAFEBAG) *bags, char *pin, 3737 STACK_OF(EVP_PKEY) *keys, STACK_OF(X509) *certs) 3738 { 3739 KMF_RETURN ret; 3740 int i; 3741 3742 for (i = 0; i < sk_PKCS12_SAFEBAG_num(bags); i++) { 3743 /* LINTED E_BAD_PTR_CAST_ALIGN */ 3744 PKCS12_SAFEBAG *bag = sk_PKCS12_SAFEBAG_value(bags, i); 3745 ret = openssl_parse_bag(bag, pin, (pin ? strlen(pin) : 0), 3746 keys, certs); 3747 3748 if (ret != KMF_OK) 3749 return (ret); 3750 } 3751 3752 return (ret); 3753 } 3754 3755 static KMF_RETURN 3756 set_pkey_attrib(EVP_PKEY *pkey, ASN1_TYPE *attrib, int nid) 3757 { 3758 X509_ATTRIBUTE *attr = NULL; 3759 3760 if (pkey == NULL || attrib == NULL) 3761 return (KMF_ERR_BAD_PARAMETER); 3762 3763 if (pkey->attributes == NULL) { 3764 pkey->attributes = sk_X509_ATTRIBUTE_new_null(); 3765 if (pkey->attributes == NULL) 3766 return (KMF_ERR_MEMORY); 3767 } 3768 attr = X509_ATTRIBUTE_create(nid, attrib->type, attrib->value.ptr); 3769 if (attr != NULL) { 3770 int i; 3771 X509_ATTRIBUTE *a; 3772 for (i = 0; 3773 i < sk_X509_ATTRIBUTE_num(pkey->attributes); i++) { 3774 /* LINTED E_BAD_PTR_CASE_ALIGN */ 3775 a = sk_X509_ATTRIBUTE_value(pkey->attributes, i); 3776 if (OBJ_obj2nid(a->object) == nid) { 3777 X509_ATTRIBUTE_free(a); 3778 /* LINTED E_BAD_PTR_CAST_ALIGN */ 3779 (void) sk_X509_ATTRIBUTE_set(pkey->attributes, 3780 i, attr); 3781 return (KMF_OK); 3782 } 3783 } 3784 if (sk_X509_ATTRIBUTE_push(pkey->attributes, attr) == NULL) { 3785 X509_ATTRIBUTE_free(attr); 3786 return (KMF_ERR_MEMORY); 3787 } 3788 } else { 3789 return (KMF_ERR_MEMORY); 3790 } 3791 3792 return (KMF_OK); 3793 } 3794 3795 static KMF_RETURN 3796 openssl_parse_bag(PKCS12_SAFEBAG *bag, char *pass, int passlen, 3797 STACK_OF(EVP_PKEY) *keylist, STACK_OF(X509) *certlist) 3798 { 3799 KMF_RETURN ret = KMF_OK; 3800 PKCS8_PRIV_KEY_INFO *p8 = NULL; 3801 EVP_PKEY *pkey = NULL; 3802 X509 *xcert = NULL; 3803 ASN1_TYPE *keyid = NULL; 3804 ASN1_TYPE *fname = NULL; 3805 uchar_t *data = NULL; 3806 3807 keyid = PKCS12_get_attr(bag, NID_localKeyID); 3808 fname = PKCS12_get_attr(bag, NID_friendlyName); 3809 3810 switch (M_PKCS12_bag_type(bag)) { 3811 case NID_keyBag: 3812 if (keylist == NULL) 3813 goto end; 3814 pkey = EVP_PKCS82PKEY(bag->value.keybag); 3815 if (pkey == NULL) 3816 ret = KMF_ERR_PKCS12_FORMAT; 3817 3818 break; 3819 case NID_pkcs8ShroudedKeyBag: 3820 if (keylist == NULL) 3821 goto end; 3822 p8 = M_PKCS12_decrypt_skey(bag, pass, passlen); 3823 if (p8 == NULL) 3824 return (KMF_ERR_AUTH_FAILED); 3825 pkey = EVP_PKCS82PKEY(p8); 3826 PKCS8_PRIV_KEY_INFO_free(p8); 3827 if (pkey == NULL) 3828 ret = KMF_ERR_PKCS12_FORMAT; 3829 break; 3830 case NID_certBag: 3831 if (certlist == NULL) 3832 goto end; 3833 if (M_PKCS12_cert_bag_type(bag) != NID_x509Certificate) 3834 return (KMF_ERR_PKCS12_FORMAT); 3835 xcert = M_PKCS12_certbag2x509(bag); 3836 if (xcert == NULL) { 3837 ret = KMF_ERR_PKCS12_FORMAT; 3838 goto end; 3839 } 3840 if (keyid != NULL) { 3841 if (X509_keyid_set1(xcert, 3842 keyid->value.octet_string->data, 3843 keyid->value.octet_string->length) == 0) { 3844 ret = KMF_ERR_PKCS12_FORMAT; 3845 goto end; 3846 } 3847 } 3848 if (fname != NULL) { 3849 int len, r; 3850 len = ASN1_STRING_to_UTF8(&data, 3851 fname->value.asn1_string); 3852 if (len > 0 && data != NULL) { 3853 r = X509_alias_set1(xcert, data, len); 3854 if (r == NULL) { 3855 ret = KMF_ERR_PKCS12_FORMAT; 3856 goto end; 3857 } 3858 } else { 3859 ret = KMF_ERR_PKCS12_FORMAT; 3860 goto end; 3861 } 3862 } 3863 if (sk_X509_push(certlist, xcert) == 0) 3864 ret = KMF_ERR_MEMORY; 3865 else 3866 xcert = NULL; 3867 break; 3868 case NID_safeContentsBag: 3869 return (openssl_parse_bags(bag->value.safes, pass, 3870 keylist, certlist)); 3871 default: 3872 ret = KMF_ERR_PKCS12_FORMAT; 3873 break; 3874 } 3875 3876 /* 3877 * Set the ID and/or FriendlyName attributes on the key. 3878 * If converting to PKCS11 objects, these can translate to CKA_ID 3879 * and CKA_LABEL values. 3880 */ 3881 if (pkey != NULL && ret == KMF_OK) { 3882 ASN1_TYPE *attr = NULL; 3883 if (keyid != NULL && keyid->type == V_ASN1_OCTET_STRING) { 3884 if ((attr = ASN1_TYPE_new()) == NULL) 3885 return (KMF_ERR_MEMORY); 3886 attr->value.octet_string = 3887 ASN1_STRING_dup(keyid->value.octet_string); 3888 attr->type = V_ASN1_OCTET_STRING; 3889 attr->value.ptr = (char *)attr->value.octet_string; 3890 ret = set_pkey_attrib(pkey, attr, NID_localKeyID); 3891 OPENSSL_free(attr); 3892 } 3893 3894 if (ret == KMF_OK && fname != NULL && 3895 fname->type == V_ASN1_BMPSTRING) { 3896 if ((attr = ASN1_TYPE_new()) == NULL) 3897 return (KMF_ERR_MEMORY); 3898 attr->value.bmpstring = 3899 ASN1_STRING_dup(fname->value.bmpstring); 3900 attr->type = V_ASN1_BMPSTRING; 3901 attr->value.ptr = (char *)attr->value.bmpstring; 3902 ret = set_pkey_attrib(pkey, attr, NID_friendlyName); 3903 OPENSSL_free(attr); 3904 } 3905 3906 if (ret == KMF_OK && keylist != NULL && 3907 sk_EVP_PKEY_push(keylist, pkey) == 0) 3908 ret = KMF_ERR_MEMORY; 3909 } 3910 if (ret == KMF_OK && keylist != NULL) 3911 pkey = NULL; 3912 end: 3913 if (pkey != NULL) 3914 EVP_PKEY_free(pkey); 3915 if (xcert != NULL) 3916 X509_free(xcert); 3917 if (data != NULL) 3918 OPENSSL_free(data); 3919 3920 return (ret); 3921 } 3922 3923 static KMF_RETURN 3924 openssl_pkcs12_parse(PKCS12 *p12, char *pin, 3925 STACK_OF(EVP_PKEY) *keys, 3926 STACK_OF(X509) *certs, 3927 STACK_OF(X509) *ca) 3928 /* ARGSUSED3 */ 3929 { 3930 KMF_RETURN ret = KMF_OK; 3931 STACK_OF(PKCS7) *asafes = NULL; 3932 STACK_OF(PKCS12_SAFEBAG) *bags = NULL; 3933 int i, bagnid; 3934 PKCS7 *p7; 3935 3936 if (p12 == NULL || (keys == NULL && certs == NULL)) 3937 return (KMF_ERR_BAD_PARAMETER); 3938 3939 if (pin == NULL || *pin == NULL) { 3940 if (PKCS12_verify_mac(p12, NULL, 0)) { 3941 pin = NULL; 3942 } else if (PKCS12_verify_mac(p12, "", 0)) { 3943 pin = ""; 3944 } else { 3945 return (KMF_ERR_AUTH_FAILED); 3946 } 3947 } else if (!PKCS12_verify_mac(p12, pin, -1)) { 3948 return (KMF_ERR_AUTH_FAILED); 3949 } 3950 3951 if ((asafes = PKCS12_unpack_authsafes(p12)) == NULL) 3952 return (KMF_ERR_PKCS12_FORMAT); 3953 3954 for (i = 0; ret == KMF_OK && i < sk_PKCS7_num(asafes); i++) { 3955 bags = NULL; 3956 /* LINTED E_BAD_PTR_CAST_ALIGN */ 3957 p7 = sk_PKCS7_value(asafes, i); 3958 bagnid = OBJ_obj2nid(p7->type); 3959 3960 if (bagnid == NID_pkcs7_data) { 3961 bags = PKCS12_unpack_p7data(p7); 3962 } else if (bagnid == NID_pkcs7_encrypted) { 3963 bags = PKCS12_unpack_p7encdata(p7, pin, 3964 (pin ? strlen(pin) : 0)); 3965 } else { 3966 continue; 3967 } 3968 if (bags == NULL) { 3969 ret = KMF_ERR_PKCS12_FORMAT; 3970 goto out; 3971 } 3972 3973 if (openssl_parse_bags(bags, pin, keys, certs) != KMF_OK) 3974 ret = KMF_ERR_PKCS12_FORMAT; 3975 3976 sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free); 3977 } 3978 out: 3979 if (asafes != NULL) 3980 sk_PKCS7_pop_free(asafes, PKCS7_free); 3981 3982 return (ret); 3983 } 3984 3985 /* 3986 * Helper function to decrypt and parse PKCS#12 import file. 3987 */ 3988 static KMF_RETURN 3989 extract_pkcs12(BIO *fbio, CK_UTF8CHAR *pin, CK_ULONG pinlen, 3990 STACK_OF(EVP_PKEY) **priv_key, STACK_OF(X509) **certs, 3991 STACK_OF(X509) **ca) 3992 /* ARGSUSED2 */ 3993 { 3994 PKCS12 *pk12, *pk12_tmp; 3995 STACK_OF(EVP_PKEY) *pkeylist = NULL; 3996 STACK_OF(X509) *xcertlist = NULL; 3997 STACK_OF(X509) *cacertlist = NULL; 3998 3999 if ((pk12 = PKCS12_new()) == NULL) { 4000 return (KMF_ERR_MEMORY); 4001 } 4002 4003 if ((pk12_tmp = d2i_PKCS12_bio(fbio, &pk12)) == NULL) { 4004 /* This is ok; it seems to mean there is no more to read. */ 4005 if (ERR_GET_LIB(ERR_peek_error()) == ERR_LIB_ASN1 && 4006 ERR_GET_REASON(ERR_peek_error()) == ASN1_R_HEADER_TOO_LONG) 4007 goto end_extract_pkcs12; 4008 4009 PKCS12_free(pk12); 4010 return (KMF_ERR_PKCS12_FORMAT); 4011 } 4012 pk12 = pk12_tmp; 4013 4014 xcertlist = sk_X509_new_null(); 4015 if (xcertlist == NULL) { 4016 PKCS12_free(pk12); 4017 return (KMF_ERR_MEMORY); 4018 } 4019 pkeylist = sk_EVP_PKEY_new_null(); 4020 if (pkeylist == NULL) { 4021 sk_X509_pop_free(xcertlist, X509_free); 4022 PKCS12_free(pk12); 4023 return (KMF_ERR_MEMORY); 4024 } 4025 4026 if (openssl_pkcs12_parse(pk12, (char *)pin, pkeylist, xcertlist, 4027 cacertlist) != KMF_OK) { 4028 sk_X509_pop_free(xcertlist, X509_free); 4029 sk_EVP_PKEY_pop_free(pkeylist, EVP_PKEY_free); 4030 PKCS12_free(pk12); 4031 return (KMF_ERR_PKCS12_FORMAT); 4032 } 4033 4034 if (priv_key && pkeylist) 4035 *priv_key = pkeylist; 4036 else if (pkeylist) 4037 sk_EVP_PKEY_pop_free(pkeylist, EVP_PKEY_free); 4038 if (certs && xcertlist) 4039 *certs = xcertlist; 4040 else if (xcertlist) 4041 sk_X509_pop_free(xcertlist, X509_free); 4042 if (ca && cacertlist) 4043 *ca = cacertlist; 4044 else if (cacertlist) 4045 sk_X509_pop_free(cacertlist, X509_free); 4046 4047 end_extract_pkcs12: 4048 4049 PKCS12_free(pk12); 4050 return (KMF_OK); 4051 } 4052 4053 static KMF_RETURN 4054 sslBN2KMFBN(BIGNUM *from, KMF_BIGINT *to) 4055 { 4056 KMF_RETURN rv = KMF_OK; 4057 uint32_t sz; 4058 4059 sz = BN_num_bytes(from); 4060 to->val = (uchar_t *)malloc(sz); 4061 if (to->val == NULL) 4062 return (KMF_ERR_MEMORY); 4063 4064 if ((to->len = BN_bn2bin(from, to->val)) != sz) { 4065 free(to->val); 4066 to->val = NULL; 4067 to->len = 0; 4068 rv = KMF_ERR_MEMORY; 4069 } 4070 4071 return (rv); 4072 } 4073 4074 static KMF_RETURN 4075 exportRawRSAKey(RSA *rsa, KMF_RAW_KEY_DATA *key) 4076 { 4077 KMF_RETURN rv; 4078 KMF_RAW_RSA_KEY *kmfkey = &key->rawdata.rsa; 4079 4080 (void) memset(kmfkey, 0, sizeof (KMF_RAW_RSA_KEY)); 4081 if ((rv = sslBN2KMFBN(rsa->n, &kmfkey->mod)) != KMF_OK) 4082 goto cleanup; 4083 4084 if ((rv = sslBN2KMFBN(rsa->e, &kmfkey->pubexp)) != KMF_OK) 4085 goto cleanup; 4086 4087 if (rsa->d != NULL) 4088 if ((rv = sslBN2KMFBN(rsa->d, &kmfkey->priexp)) != KMF_OK) 4089 goto cleanup; 4090 4091 if (rsa->p != NULL) 4092 if ((rv = sslBN2KMFBN(rsa->p, &kmfkey->prime1)) != KMF_OK) 4093 goto cleanup; 4094 4095 if (rsa->q != NULL) 4096 if ((rv = sslBN2KMFBN(rsa->q, &kmfkey->prime2)) != KMF_OK) 4097 goto cleanup; 4098 4099 if (rsa->dmp1 != NULL) 4100 if ((rv = sslBN2KMFBN(rsa->dmp1, &kmfkey->exp1)) != KMF_OK) 4101 goto cleanup; 4102 4103 if (rsa->dmq1 != NULL) 4104 if ((rv = sslBN2KMFBN(rsa->dmq1, &kmfkey->exp2)) != KMF_OK) 4105 goto cleanup; 4106 4107 if (rsa->iqmp != NULL) 4108 if ((rv = sslBN2KMFBN(rsa->iqmp, &kmfkey->coef)) != KMF_OK) 4109 goto cleanup; 4110 cleanup: 4111 if (rv != KMF_OK) 4112 kmf_free_raw_key(key); 4113 else 4114 key->keytype = KMF_RSA; 4115 4116 /* 4117 * Free the reference to this key, SSL will not actually free 4118 * the memory until the refcount == 0, so this is safe. 4119 */ 4120 RSA_free(rsa); 4121 4122 return (rv); 4123 } 4124 4125 static KMF_RETURN 4126 exportRawDSAKey(DSA *dsa, KMF_RAW_KEY_DATA *key) 4127 { 4128 KMF_RETURN rv; 4129 KMF_RAW_DSA_KEY *kmfkey = &key->rawdata.dsa; 4130 4131 (void) memset(kmfkey, 0, sizeof (KMF_RAW_DSA_KEY)); 4132 if ((rv = sslBN2KMFBN(dsa->p, &kmfkey->prime)) != KMF_OK) 4133 goto cleanup; 4134 4135 if ((rv = sslBN2KMFBN(dsa->q, &kmfkey->subprime)) != KMF_OK) 4136 goto cleanup; 4137 4138 if ((rv = sslBN2KMFBN(dsa->g, &kmfkey->base)) != KMF_OK) 4139 goto cleanup; 4140 4141 if ((rv = sslBN2KMFBN(dsa->priv_key, &kmfkey->value)) != KMF_OK) 4142 goto cleanup; 4143 4144 cleanup: 4145 if (rv != KMF_OK) 4146 kmf_free_raw_key(key); 4147 else 4148 key->keytype = KMF_DSA; 4149 4150 /* 4151 * Free the reference to this key, SSL will not actually free 4152 * the memory until the refcount == 0, so this is safe. 4153 */ 4154 DSA_free(dsa); 4155 4156 return (rv); 4157 } 4158 4159 static KMF_RETURN 4160 add_cert_to_list(KMF_HANDLE *kmfh, X509 *sslcert, 4161 KMF_X509_DER_CERT **certlist, int *ncerts) 4162 { 4163 KMF_RETURN rv = KMF_OK; 4164 KMF_X509_DER_CERT *list = (*certlist); 4165 KMF_X509_DER_CERT cert; 4166 int n = (*ncerts); 4167 4168 if (list == NULL) { 4169 list = (KMF_X509_DER_CERT *)malloc(sizeof (KMF_X509_DER_CERT)); 4170 } else { 4171 list = (KMF_X509_DER_CERT *)realloc(list, 4172 sizeof (KMF_X509_DER_CERT) * (n + 1)); 4173 } 4174 4175 if (list == NULL) 4176 return (KMF_ERR_MEMORY); 4177 4178 (void) memset(&cert, 0, sizeof (cert)); 4179 rv = ssl_cert2KMFDATA(kmfh, sslcert, &cert.certificate); 4180 if (rv == KMF_OK) { 4181 int len = 0; 4182 /* Get the alias name for the cert if there is one */ 4183 char *a = (char *)X509_alias_get0(sslcert, &len); 4184 if (a != NULL) 4185 cert.kmf_private.label = strdup(a); 4186 cert.kmf_private.keystore_type = KMF_KEYSTORE_OPENSSL; 4187 4188 list[n] = cert; 4189 (*ncerts) = n + 1; 4190 4191 *certlist = list; 4192 } else { 4193 free(list); 4194 } 4195 4196 return (rv); 4197 } 4198 4199 static KMF_RETURN 4200 add_key_to_list(KMF_RAW_KEY_DATA **keylist, 4201 KMF_RAW_KEY_DATA *newkey, int *nkeys) 4202 { 4203 KMF_RAW_KEY_DATA *list = (*keylist); 4204 int n = (*nkeys); 4205 4206 if (list == NULL) { 4207 list = (KMF_RAW_KEY_DATA *)malloc(sizeof (KMF_RAW_KEY_DATA)); 4208 } else { 4209 list = (KMF_RAW_KEY_DATA *)realloc(list, 4210 sizeof (KMF_RAW_KEY_DATA) * (n + 1)); 4211 } 4212 4213 if (list == NULL) 4214 return (KMF_ERR_MEMORY); 4215 4216 list[n] = *newkey; 4217 (*nkeys) = n + 1; 4218 4219 *keylist = list; 4220 4221 return (KMF_OK); 4222 } 4223 4224 static X509_ATTRIBUTE * 4225 find_attr(STACK_OF(X509_ATTRIBUTE) *attrs, int nid) 4226 { 4227 X509_ATTRIBUTE *a; 4228 int i; 4229 4230 if (attrs == NULL) 4231 return (NULL); 4232 4233 for (i = 0; i < sk_X509_ATTRIBUTE_num(attrs); i++) { 4234 /* LINTED E_BAD_PTR_CAST_ALIGN */ 4235 a = sk_X509_ATTRIBUTE_value(attrs, i); 4236 if (OBJ_obj2nid(a->object) == nid) 4237 return (a); 4238 } 4239 return (NULL); 4240 } 4241 4242 static KMF_RETURN 4243 convertToRawKey(EVP_PKEY *pkey, KMF_RAW_KEY_DATA *key) 4244 { 4245 KMF_RETURN rv = KMF_OK; 4246 X509_ATTRIBUTE *attr; 4247 4248 if (pkey == NULL || key == NULL) 4249 return (KMF_ERR_BAD_PARAMETER); 4250 /* Convert SSL key to raw key */ 4251 switch (pkey->type) { 4252 case EVP_PKEY_RSA: 4253 rv = exportRawRSAKey(EVP_PKEY_get1_RSA(pkey), 4254 key); 4255 if (rv != KMF_OK) 4256 return (rv); 4257 break; 4258 case EVP_PKEY_DSA: 4259 rv = exportRawDSAKey(EVP_PKEY_get1_DSA(pkey), 4260 key); 4261 if (rv != KMF_OK) 4262 return (rv); 4263 break; 4264 default: 4265 return (KMF_ERR_BAD_PARAMETER); 4266 } 4267 /* 4268 * If friendlyName, add it to record. 4269 */ 4270 attr = find_attr(pkey->attributes, NID_friendlyName); 4271 if (attr != NULL) { 4272 ASN1_TYPE *ty = NULL; 4273 int numattr = sk_ASN1_TYPE_num(attr->value.set); 4274 if (attr->single == 0 && numattr > 0) { 4275 /* LINTED E_BAD_PTR_CAST_ALIGN */ 4276 ty = sk_ASN1_TYPE_value(attr->value.set, 0); 4277 } 4278 if (ty != NULL) { 4279 #if OPENSSL_VERSION_NUMBER < 0x10000000L 4280 key->label = uni2asc(ty->value.bmpstring->data, 4281 ty->value.bmpstring->length); 4282 #else 4283 key->label = OPENSSL_uni2asc(ty->value.bmpstring->data, 4284 ty->value.bmpstring->length); 4285 #endif 4286 } 4287 } else { 4288 key->label = NULL; 4289 } 4290 4291 /* 4292 * If KeyID, add it to record as a KMF_DATA object. 4293 */ 4294 attr = find_attr(pkey->attributes, NID_localKeyID); 4295 if (attr != NULL) { 4296 ASN1_TYPE *ty = NULL; 4297 int numattr = sk_ASN1_TYPE_num(attr->value.set); 4298 if (attr->single == 0 && numattr > 0) { 4299 /* LINTED E_BAD_PTR_CAST_ALIGN */ 4300 ty = sk_ASN1_TYPE_value(attr->value.set, 0); 4301 } 4302 key->id.Data = (uchar_t *)malloc( 4303 ty->value.octet_string->length); 4304 if (key->id.Data == NULL) 4305 return (KMF_ERR_MEMORY); 4306 (void) memcpy(key->id.Data, ty->value.octet_string->data, 4307 ty->value.octet_string->length); 4308 key->id.Length = ty->value.octet_string->length; 4309 } else { 4310 (void) memset(&key->id, 0, sizeof (KMF_DATA)); 4311 } 4312 4313 return (rv); 4314 } 4315 4316 static KMF_RETURN 4317 convertPK12Objects( 4318 KMF_HANDLE *kmfh, 4319 STACK_OF(EVP_PKEY) *sslkeys, 4320 STACK_OF(X509) *sslcert, 4321 STACK_OF(X509) *sslcacerts, 4322 KMF_RAW_KEY_DATA **keylist, int *nkeys, 4323 KMF_X509_DER_CERT **certlist, int *ncerts) 4324 { 4325 KMF_RETURN rv = KMF_OK; 4326 KMF_RAW_KEY_DATA key; 4327 int i; 4328 4329 for (i = 0; sslkeys != NULL && i < sk_EVP_PKEY_num(sslkeys); i++) { 4330 /* LINTED E_BAD_PTR_CAST_ALIGN */ 4331 EVP_PKEY *pkey = sk_EVP_PKEY_value(sslkeys, i); 4332 rv = convertToRawKey(pkey, &key); 4333 if (rv == KMF_OK) 4334 rv = add_key_to_list(keylist, &key, nkeys); 4335 4336 if (rv != KMF_OK) 4337 return (rv); 4338 } 4339 4340 /* Now add the certificate to the certlist */ 4341 for (i = 0; sslcert != NULL && i < sk_X509_num(sslcert); i++) { 4342 /* LINTED E_BAD_PTR_CAST_ALIGN */ 4343 X509 *cert = sk_X509_value(sslcert, i); 4344 rv = add_cert_to_list(kmfh, cert, certlist, ncerts); 4345 if (rv != KMF_OK) 4346 return (rv); 4347 } 4348 4349 /* Also add any included CA certs to the list */ 4350 for (i = 0; sslcacerts != NULL && i < sk_X509_num(sslcacerts); i++) { 4351 X509 *c; 4352 /* 4353 * sk_X509_value() is macro that embeds a cast to (X509 *). 4354 * Here it translates into ((X509 *)sk_value((ca), (i))). 4355 * Lint is complaining about the embedded casting, and 4356 * to fix it, you need to fix openssl header files. 4357 */ 4358 /* LINTED E_BAD_PTR_CAST_ALIGN */ 4359 c = sk_X509_value(sslcacerts, i); 4360 4361 /* Now add the ca cert to the certlist */ 4362 rv = add_cert_to_list(kmfh, c, certlist, ncerts); 4363 if (rv != KMF_OK) 4364 return (rv); 4365 } 4366 return (rv); 4367 } 4368 4369 KMF_RETURN 4370 openssl_import_objects(KMF_HANDLE *kmfh, 4371 char *filename, KMF_CREDENTIAL *cred, 4372 KMF_X509_DER_CERT **certlist, int *ncerts, 4373 KMF_RAW_KEY_DATA **keylist, int *nkeys) 4374 { 4375 KMF_RETURN rv = KMF_OK; 4376 KMF_ENCODE_FORMAT format; 4377 BIO *bio = NULL; 4378 STACK_OF(EVP_PKEY) *privkeys = NULL; 4379 STACK_OF(X509) *certs = NULL; 4380 STACK_OF(X509) *cacerts = NULL; 4381 4382 /* 4383 * auto-detect the file format, regardless of what 4384 * the 'format' parameters in the params say. 4385 */ 4386 rv = kmf_get_file_format(filename, &format); 4387 if (rv != KMF_OK) { 4388 return (rv); 4389 } 4390 4391 /* This function only works for PEM or PKCS#12 files */ 4392 if (format != KMF_FORMAT_PEM && 4393 format != KMF_FORMAT_PEM_KEYPAIR && 4394 format != KMF_FORMAT_PKCS12) 4395 return (KMF_ERR_ENCODING); 4396 4397 *certlist = NULL; 4398 *keylist = NULL; 4399 *ncerts = 0; 4400 *nkeys = 0; 4401 4402 if (format == KMF_FORMAT_PKCS12) { 4403 bio = BIO_new_file(filename, "rb"); 4404 if (bio == NULL) { 4405 SET_ERROR(kmfh, ERR_get_error()); 4406 rv = KMF_ERR_OPEN_FILE; 4407 goto end; 4408 } 4409 4410 rv = extract_pkcs12(bio, (uchar_t *)cred->cred, 4411 (uint32_t)cred->credlen, &privkeys, &certs, &cacerts); 4412 4413 if (rv == KMF_OK) 4414 /* Convert keys and certs to exportable format */ 4415 rv = convertPK12Objects(kmfh, privkeys, certs, cacerts, 4416 keylist, nkeys, certlist, ncerts); 4417 } else { 4418 EVP_PKEY *pkey; 4419 KMF_DATA *certdata = NULL; 4420 KMF_X509_DER_CERT *kmfcerts = NULL; 4421 int i; 4422 rv = extract_pem(kmfh, NULL, NULL, NULL, filename, 4423 (uchar_t *)cred->cred, (uint32_t)cred->credlen, 4424 &pkey, &certdata, ncerts); 4425 4426 /* Reached end of import file? */ 4427 if (rv == KMF_OK && pkey != NULL) { 4428 privkeys = sk_EVP_PKEY_new_null(); 4429 if (privkeys == NULL) { 4430 rv = KMF_ERR_MEMORY; 4431 goto end; 4432 } 4433 (void) sk_EVP_PKEY_push(privkeys, pkey); 4434 /* convert the certificate list here */ 4435 if (*ncerts > 0 && certlist != NULL) { 4436 kmfcerts = (KMF_X509_DER_CERT *)calloc(*ncerts, 4437 sizeof (KMF_X509_DER_CERT)); 4438 if (kmfcerts == NULL) { 4439 rv = KMF_ERR_MEMORY; 4440 goto end; 4441 } 4442 for (i = 0; i < *ncerts; i++) { 4443 kmfcerts[i].certificate = certdata[i]; 4444 kmfcerts[i].kmf_private.keystore_type = 4445 KMF_KEYSTORE_OPENSSL; 4446 } 4447 *certlist = kmfcerts; 4448 } 4449 /* 4450 * Convert keys to exportable format, the certs 4451 * are already OK. 4452 */ 4453 rv = convertPK12Objects(kmfh, privkeys, NULL, NULL, 4454 keylist, nkeys, NULL, NULL); 4455 } 4456 } 4457 end: 4458 if (bio != NULL) 4459 (void) BIO_free(bio); 4460 4461 if (privkeys) 4462 sk_EVP_PKEY_pop_free(privkeys, EVP_PKEY_free); 4463 if (certs) 4464 sk_X509_pop_free(certs, X509_free); 4465 if (cacerts) 4466 sk_X509_pop_free(cacerts, X509_free); 4467 4468 return (rv); 4469 } 4470 4471 static KMF_RETURN 4472 create_deskey(DES_cblock **deskey) 4473 { 4474 DES_cblock *key; 4475 4476 key = (DES_cblock *) malloc(sizeof (DES_cblock)); 4477 if (key == NULL) { 4478 return (KMF_ERR_MEMORY); 4479 } 4480 4481 if (DES_random_key(key) == 0) { 4482 free(key); 4483 return (KMF_ERR_KEYGEN_FAILED); 4484 } 4485 4486 *deskey = key; 4487 return (KMF_OK); 4488 } 4489 4490 #define KEYGEN_RETRY 3 4491 #define DES3_KEY_SIZE 24 4492 4493 static KMF_RETURN 4494 create_des3key(unsigned char **des3key) 4495 { 4496 KMF_RETURN ret = KMF_OK; 4497 DES_cblock *deskey1 = NULL; 4498 DES_cblock *deskey2 = NULL; 4499 DES_cblock *deskey3 = NULL; 4500 unsigned char *newkey = NULL; 4501 int retry; 4502 4503 if ((newkey = malloc(DES3_KEY_SIZE)) == NULL) { 4504 return (KMF_ERR_MEMORY); 4505 } 4506 4507 /* create the 1st DES key */ 4508 if ((ret = create_deskey(&deskey1)) != KMF_OK) { 4509 goto out; 4510 } 4511 4512 /* 4513 * Create the 2nd DES key and make sure its value is different 4514 * from the 1st DES key. 4515 */ 4516 retry = 0; 4517 do { 4518 if (deskey2 != NULL) { 4519 free(deskey2); 4520 deskey2 = NULL; 4521 } 4522 4523 if ((ret = create_deskey(&deskey2)) != KMF_OK) { 4524 goto out; 4525 } 4526 4527 if (memcmp((const void *) deskey1, (const void *) deskey2, 8) 4528 == 0) { 4529 ret = KMF_ERR_KEYGEN_FAILED; 4530 retry++; 4531 } 4532 } while (ret == KMF_ERR_KEYGEN_FAILED && retry < KEYGEN_RETRY); 4533 4534 if (ret != KMF_OK) { 4535 goto out; 4536 } 4537 4538 /* 4539 * Create the 3rd DES key and make sure its value is different 4540 * from the 2nd DES key. 4541 */ 4542 retry = 0; 4543 do { 4544 if (deskey3 != NULL) { 4545 free(deskey3); 4546 deskey3 = NULL; 4547 } 4548 4549 if ((ret = create_deskey(&deskey3)) != KMF_OK) { 4550 goto out; 4551 } 4552 4553 if (memcmp((const void *)deskey2, (const void *)deskey3, 8) 4554 == 0) { 4555 ret = KMF_ERR_KEYGEN_FAILED; 4556 retry++; 4557 } 4558 } while (ret == KMF_ERR_KEYGEN_FAILED && retry < KEYGEN_RETRY); 4559 4560 if (ret != KMF_OK) { 4561 goto out; 4562 } 4563 4564 /* Concatenate 3 DES keys into a DES3 key */ 4565 (void) memcpy((void *)newkey, (const void *)deskey1, 8); 4566 (void) memcpy((void *)(newkey + 8), (const void *)deskey2, 8); 4567 (void) memcpy((void *)(newkey + 16), (const void *)deskey3, 8); 4568 *des3key = newkey; 4569 4570 out: 4571 if (deskey1 != NULL) 4572 free(deskey1); 4573 4574 if (deskey2 != NULL) 4575 free(deskey2); 4576 4577 if (deskey3 != NULL) 4578 free(deskey3); 4579 4580 if (ret != KMF_OK && newkey != NULL) 4581 free(newkey); 4582 4583 return (ret); 4584 } 4585 4586 KMF_RETURN 4587 OpenSSL_CreateSymKey(KMF_HANDLE_T handle, 4588 int numattr, KMF_ATTRIBUTE *attrlist) 4589 { 4590 KMF_RETURN ret = KMF_OK; 4591 KMF_HANDLE *kmfh = (KMF_HANDLE *)handle; 4592 char *fullpath = NULL; 4593 KMF_RAW_SYM_KEY *rkey = NULL; 4594 DES_cblock *deskey = NULL; 4595 unsigned char *des3key = NULL; 4596 unsigned char *random = NULL; 4597 int fd = -1; 4598 KMF_KEY_HANDLE *symkey; 4599 KMF_KEY_ALG keytype; 4600 uint32_t keylen; 4601 uint32_t keylen_size = sizeof (keylen); 4602 char *dirpath; 4603 char *keyfile; 4604 4605 if (kmfh == NULL) 4606 return (KMF_ERR_UNINITIALIZED); 4607 4608 symkey = kmf_get_attr_ptr(KMF_KEY_HANDLE_ATTR, attrlist, numattr); 4609 if (symkey == NULL) 4610 return (KMF_ERR_BAD_PARAMETER); 4611 4612 dirpath = kmf_get_attr_ptr(KMF_DIRPATH_ATTR, attrlist, numattr); 4613 4614 keyfile = kmf_get_attr_ptr(KMF_KEY_FILENAME_ATTR, attrlist, numattr); 4615 if (keyfile == NULL) 4616 return (KMF_ERR_BAD_PARAMETER); 4617 4618 ret = kmf_get_attr(KMF_KEYALG_ATTR, attrlist, numattr, 4619 (void *)&keytype, NULL); 4620 if (ret != KMF_OK) 4621 return (KMF_ERR_BAD_PARAMETER); 4622 4623 ret = kmf_get_attr(KMF_KEYLENGTH_ATTR, attrlist, numattr, 4624 &keylen, &keylen_size); 4625 if (ret == KMF_ERR_ATTR_NOT_FOUND && 4626 (keytype == KMF_DES || keytype == KMF_DES3)) 4627 /* keylength is not required for DES and 3DES */ 4628 ret = KMF_OK; 4629 if (ret != KMF_OK) 4630 return (KMF_ERR_BAD_PARAMETER); 4631 4632 fullpath = get_fullpath(dirpath, keyfile); 4633 if (fullpath == NULL) 4634 return (KMF_ERR_BAD_PARAMETER); 4635 4636 /* If the requested file exists, return an error */ 4637 if (test_for_file(fullpath, 0400) == 1) { 4638 free(fullpath); 4639 return (KMF_ERR_DUPLICATE_KEYFILE); 4640 } 4641 4642 fd = open(fullpath, O_CREAT|O_TRUNC|O_RDWR, 0400); 4643 if (fd == -1) { 4644 ret = KMF_ERR_OPEN_FILE; 4645 goto out; 4646 } 4647 4648 rkey = malloc(sizeof (KMF_RAW_SYM_KEY)); 4649 if (rkey == NULL) { 4650 ret = KMF_ERR_MEMORY; 4651 goto out; 4652 } 4653 (void) memset(rkey, 0, sizeof (KMF_RAW_SYM_KEY)); 4654 4655 if (keytype == KMF_DES) { 4656 if ((ret = create_deskey(&deskey)) != KMF_OK) { 4657 goto out; 4658 } 4659 rkey->keydata.val = (uchar_t *)deskey; 4660 rkey->keydata.len = 8; 4661 4662 symkey->keyalg = KMF_DES; 4663 4664 } else if (keytype == KMF_DES3) { 4665 if ((ret = create_des3key(&des3key)) != KMF_OK) { 4666 goto out; 4667 } 4668 rkey->keydata.val = (uchar_t *)des3key; 4669 rkey->keydata.len = DES3_KEY_SIZE; 4670 symkey->keyalg = KMF_DES3; 4671 4672 } else if (keytype == KMF_AES || keytype == KMF_RC4 || 4673 keytype == KMF_GENERIC_SECRET) { 4674 int bytes; 4675 4676 if (keylen % 8 != 0) { 4677 ret = KMF_ERR_BAD_KEY_SIZE; 4678 goto out; 4679 } 4680 4681 if (keytype == KMF_AES) { 4682 if (keylen != 128 && 4683 keylen != 192 && 4684 keylen != 256) { 4685 ret = KMF_ERR_BAD_KEY_SIZE; 4686 goto out; 4687 } 4688 } 4689 4690 bytes = keylen/8; 4691 random = malloc(bytes); 4692 if (random == NULL) { 4693 ret = KMF_ERR_MEMORY; 4694 goto out; 4695 } 4696 if (RAND_bytes(random, bytes) != 1) { 4697 ret = KMF_ERR_KEYGEN_FAILED; 4698 goto out; 4699 } 4700 4701 rkey->keydata.val = (uchar_t *)random; 4702 rkey->keydata.len = bytes; 4703 symkey->keyalg = keytype; 4704 4705 } else { 4706 ret = KMF_ERR_BAD_KEY_TYPE; 4707 goto out; 4708 } 4709 4710 (void) write(fd, (const void *) rkey->keydata.val, rkey->keydata.len); 4711 4712 symkey->kstype = KMF_KEYSTORE_OPENSSL; 4713 symkey->keyclass = KMF_SYMMETRIC; 4714 symkey->keylabel = (char *)fullpath; 4715 symkey->israw = TRUE; 4716 symkey->keyp = rkey; 4717 4718 out: 4719 if (fd != -1) 4720 (void) close(fd); 4721 4722 if (ret != KMF_OK && fullpath != NULL) { 4723 free(fullpath); 4724 } 4725 if (ret != KMF_OK) { 4726 kmf_free_raw_sym_key(rkey); 4727 symkey->keyp = NULL; 4728 symkey->keyalg = KMF_KEYALG_NONE; 4729 } 4730 4731 return (ret); 4732 } 4733 4734 /* 4735 * Check a file to see if it is a CRL file with PEM or DER format. 4736 * If success, return its format in the "pformat" argument. 4737 */ 4738 KMF_RETURN 4739 OpenSSL_IsCRLFile(KMF_HANDLE_T handle, char *filename, int *pformat) 4740 { 4741 KMF_RETURN ret = KMF_OK; 4742 KMF_HANDLE *kmfh = (KMF_HANDLE *)handle; 4743 BIO *bio = NULL; 4744 X509_CRL *xcrl = NULL; 4745 4746 if (filename == NULL) { 4747 return (KMF_ERR_BAD_PARAMETER); 4748 } 4749 4750 bio = BIO_new_file(filename, "rb"); 4751 if (bio == NULL) { 4752 SET_ERROR(kmfh, ERR_get_error()); 4753 ret = KMF_ERR_OPEN_FILE; 4754 goto out; 4755 } 4756 4757 if ((xcrl = PEM_read_bio_X509_CRL(bio, NULL, NULL, NULL)) != NULL) { 4758 *pformat = KMF_FORMAT_PEM; 4759 goto out; 4760 } 4761 (void) BIO_free(bio); 4762 4763 /* 4764 * Now try to read it as raw DER data. 4765 */ 4766 bio = BIO_new_file(filename, "rb"); 4767 if (bio == NULL) { 4768 SET_ERROR(kmfh, ERR_get_error()); 4769 ret = KMF_ERR_OPEN_FILE; 4770 goto out; 4771 } 4772 4773 if ((xcrl = d2i_X509_CRL_bio(bio, NULL)) != NULL) { 4774 *pformat = KMF_FORMAT_ASN1; 4775 } else { 4776 ret = KMF_ERR_BAD_CRLFILE; 4777 } 4778 4779 out: 4780 if (bio != NULL) 4781 (void) BIO_free(bio); 4782 4783 if (xcrl != NULL) 4784 X509_CRL_free(xcrl); 4785 4786 return (ret); 4787 } 4788 4789 KMF_RETURN 4790 OpenSSL_GetSymKeyValue(KMF_HANDLE_T handle, KMF_KEY_HANDLE *symkey, 4791 KMF_RAW_SYM_KEY *rkey) 4792 { 4793 KMF_RETURN rv = KMF_OK; 4794 KMF_HANDLE *kmfh = (KMF_HANDLE *)handle; 4795 KMF_DATA keyvalue; 4796 4797 if (kmfh == NULL) 4798 return (KMF_ERR_UNINITIALIZED); 4799 4800 if (symkey == NULL || rkey == NULL) 4801 return (KMF_ERR_BAD_PARAMETER); 4802 else if (symkey->keyclass != KMF_SYMMETRIC) 4803 return (KMF_ERR_BAD_KEY_CLASS); 4804 4805 if (symkey->israw) { 4806 KMF_RAW_SYM_KEY *rawkey = (KMF_RAW_SYM_KEY *)symkey->keyp; 4807 4808 if (rawkey == NULL || 4809 rawkey->keydata.val == NULL || 4810 rawkey->keydata.len == 0) 4811 return (KMF_ERR_BAD_KEYHANDLE); 4812 4813 rkey->keydata.len = rawkey->keydata.len; 4814 if ((rkey->keydata.val = malloc(rkey->keydata.len)) == NULL) 4815 return (KMF_ERR_MEMORY); 4816 (void) memcpy(rkey->keydata.val, rawkey->keydata.val, 4817 rkey->keydata.len); 4818 } else { 4819 rv = kmf_read_input_file(handle, symkey->keylabel, &keyvalue); 4820 if (rv != KMF_OK) 4821 return (rv); 4822 rkey->keydata.len = keyvalue.Length; 4823 rkey->keydata.val = keyvalue.Data; 4824 } 4825 4826 return (rv); 4827 } 4828 4829 /* 4830 * substitute for the unsafe access(2) function. 4831 * If the file in question already exists, return 1. 4832 * else 0. If an error occurs during testing (other 4833 * than EEXIST), return -1. 4834 */ 4835 static int 4836 test_for_file(char *filename, mode_t mode) 4837 { 4838 int fd; 4839 4840 /* 4841 * Try to create the file with the EXCL flag. 4842 * The call should fail if the file exists. 4843 */ 4844 fd = open(filename, O_WRONLY|O_CREAT|O_EXCL, mode); 4845 if (fd == -1 && errno == EEXIST) 4846 return (1); 4847 else if (fd == -1) /* some other error */ 4848 return (-1); 4849 4850 /* The file did NOT exist. Delete the testcase. */ 4851 (void) close(fd); 4852 (void) unlink(filename); 4853 return (0); 4854 } 4855 4856 KMF_RETURN 4857 OpenSSL_StoreKey(KMF_HANDLE_T handle, int numattr, 4858 KMF_ATTRIBUTE *attrlist) 4859 { 4860 KMF_RETURN rv = KMF_OK; 4861 KMF_HANDLE *kmfh = (KMF_HANDLE *)handle; 4862 KMF_KEY_HANDLE *pubkey = NULL, *prikey = NULL; 4863 KMF_RAW_KEY_DATA *rawkey; 4864 EVP_PKEY *pkey = NULL; 4865 KMF_ENCODE_FORMAT format = KMF_FORMAT_PEM; 4866 KMF_CREDENTIAL cred = { NULL, 0 }; 4867 BIO *out = NULL; 4868 int keys = 0; 4869 char *fullpath = NULL; 4870 char *keyfile = NULL; 4871 char *dirpath = NULL; 4872 4873 pubkey = kmf_get_attr_ptr(KMF_PUBKEY_HANDLE_ATTR, attrlist, numattr); 4874 if (pubkey != NULL) 4875 keys++; 4876 4877 prikey = kmf_get_attr_ptr(KMF_PRIVKEY_HANDLE_ATTR, attrlist, numattr); 4878 if (prikey != NULL) 4879 keys++; 4880 4881 rawkey = kmf_get_attr_ptr(KMF_RAW_KEY_ATTR, attrlist, numattr); 4882 if (rawkey != NULL) 4883 keys++; 4884 4885 /* 4886 * Exactly 1 type of key must be passed to this function. 4887 */ 4888 if (keys != 1) 4889 return (KMF_ERR_BAD_PARAMETER); 4890 4891 keyfile = (char *)kmf_get_attr_ptr(KMF_KEY_FILENAME_ATTR, attrlist, 4892 numattr); 4893 if (keyfile == NULL) 4894 return (KMF_ERR_BAD_PARAMETER); 4895 4896 dirpath = kmf_get_attr_ptr(KMF_DIRPATH_ATTR, attrlist, numattr); 4897 4898 fullpath = get_fullpath(dirpath, keyfile); 4899 4900 /* Once we have the full path, we don't need the pieces */ 4901 if (fullpath == NULL) 4902 return (KMF_ERR_BAD_PARAMETER); 4903 4904 /* If the requested file exists, return an error */ 4905 if (test_for_file(fullpath, 0400) == 1) { 4906 free(fullpath); 4907 return (KMF_ERR_DUPLICATE_KEYFILE); 4908 } 4909 4910 rv = kmf_get_attr(KMF_ENCODE_FORMAT_ATTR, attrlist, numattr, 4911 &format, NULL); 4912 if (rv != KMF_OK) 4913 /* format is optional. */ 4914 rv = KMF_OK; 4915 4916 /* CRED is not required for OpenSSL files */ 4917 (void) kmf_get_attr(KMF_CREDENTIAL_ATTR, attrlist, numattr, 4918 &cred, NULL); 4919 4920 /* Store the private key to the keyfile */ 4921 out = BIO_new_file(fullpath, "wb"); 4922 if (out == NULL) { 4923 SET_ERROR(kmfh, ERR_get_error()); 4924 rv = KMF_ERR_OPEN_FILE; 4925 goto end; 4926 } 4927 4928 if (prikey != NULL && prikey->keyp != NULL) { 4929 if (prikey->keyalg == KMF_RSA || 4930 prikey->keyalg == KMF_DSA) { 4931 pkey = (EVP_PKEY *)prikey->keyp; 4932 4933 rv = ssl_write_key(kmfh, format, 4934 out, &cred, pkey, TRUE); 4935 4936 if (rv == KMF_OK && prikey->keylabel == NULL) { 4937 prikey->keylabel = strdup(fullpath); 4938 if (prikey->keylabel == NULL) 4939 rv = KMF_ERR_MEMORY; 4940 } 4941 } 4942 } else if (pubkey != NULL && pubkey->keyp != NULL) { 4943 if (pubkey->keyalg == KMF_RSA || 4944 pubkey->keyalg == KMF_DSA) { 4945 pkey = (EVP_PKEY *)pubkey->keyp; 4946 4947 rv = ssl_write_key(kmfh, format, 4948 out, &cred, pkey, FALSE); 4949 4950 if (rv == KMF_OK && pubkey->keylabel == NULL) { 4951 pubkey->keylabel = strdup(fullpath); 4952 if (pubkey->keylabel == NULL) 4953 rv = KMF_ERR_MEMORY; 4954 } 4955 } 4956 } else if (rawkey != NULL) { 4957 if (rawkey->keytype == KMF_RSA) { 4958 pkey = ImportRawRSAKey(&rawkey->rawdata.rsa); 4959 } else if (rawkey->keytype == KMF_DSA) { 4960 pkey = ImportRawDSAKey(&rawkey->rawdata.dsa); 4961 } else { 4962 rv = KMF_ERR_BAD_PARAMETER; 4963 } 4964 if (pkey != NULL) { 4965 KMF_KEY_CLASS kclass = KMF_ASYM_PRI; 4966 4967 rv = kmf_get_attr(KMF_KEYCLASS_ATTR, attrlist, numattr, 4968 (void *)&kclass, NULL); 4969 if (rv != KMF_OK) 4970 rv = KMF_OK; 4971 rv = ssl_write_key(kmfh, format, out, 4972 &cred, pkey, (kclass == KMF_ASYM_PRI)); 4973 EVP_PKEY_free(pkey); 4974 } 4975 } 4976 4977 end: 4978 4979 if (out) 4980 (void) BIO_free(out); 4981 4982 4983 if (rv == KMF_OK) 4984 (void) chmod(fullpath, 0400); 4985 4986 free(fullpath); 4987 return (rv); 4988 } 4989 4990 KMF_RETURN 4991 OpenSSL_ImportCRL(KMF_HANDLE_T handle, int numattr, KMF_ATTRIBUTE *attrlist) 4992 { 4993 KMF_RETURN ret = KMF_OK; 4994 KMF_HANDLE *kmfh = (KMF_HANDLE *)handle; 4995 X509_CRL *xcrl = NULL; 4996 X509 *xcert = NULL; 4997 EVP_PKEY *pkey; 4998 KMF_ENCODE_FORMAT format; 4999 BIO *in = NULL, *out = NULL; 5000 int openssl_ret = 0; 5001 KMF_ENCODE_FORMAT outformat; 5002 boolean_t crlcheck = FALSE; 5003 char *certfile, *dirpath, *crlfile, *incrl, *outcrl, *outcrlfile; 5004 5005 if (numattr == 0 || attrlist == NULL) { 5006 return (KMF_ERR_BAD_PARAMETER); 5007 } 5008 5009 /* CRL check is optional */ 5010 (void) kmf_get_attr(KMF_CRL_CHECK_ATTR, attrlist, numattr, 5011 &crlcheck, NULL); 5012 5013 certfile = kmf_get_attr_ptr(KMF_CERT_FILENAME_ATTR, attrlist, numattr); 5014 if (crlcheck == B_TRUE && certfile == NULL) { 5015 return (KMF_ERR_BAD_CERTFILE); 5016 } 5017 5018 dirpath = kmf_get_attr_ptr(KMF_DIRPATH_ATTR, attrlist, numattr); 5019 incrl = kmf_get_attr_ptr(KMF_CRL_FILENAME_ATTR, attrlist, numattr); 5020 outcrl = kmf_get_attr_ptr(KMF_CRL_OUTFILE_ATTR, attrlist, numattr); 5021 5022 crlfile = get_fullpath(dirpath, incrl); 5023 5024 if (crlfile == NULL) 5025 return (KMF_ERR_BAD_CRLFILE); 5026 5027 outcrlfile = get_fullpath(dirpath, outcrl); 5028 if (outcrlfile == NULL) 5029 return (KMF_ERR_BAD_CRLFILE); 5030 5031 if (isdir(outcrlfile)) { 5032 free(outcrlfile); 5033 return (KMF_ERR_BAD_CRLFILE); 5034 } 5035 5036 ret = kmf_is_crl_file(handle, crlfile, &format); 5037 if (ret != KMF_OK) { 5038 free(outcrlfile); 5039 return (ret); 5040 } 5041 5042 in = BIO_new_file(crlfile, "rb"); 5043 if (in == NULL) { 5044 SET_ERROR(kmfh, ERR_get_error()); 5045 ret = KMF_ERR_OPEN_FILE; 5046 goto end; 5047 } 5048 5049 if (format == KMF_FORMAT_ASN1) { 5050 xcrl = d2i_X509_CRL_bio(in, NULL); 5051 } else if (format == KMF_FORMAT_PEM) { 5052 xcrl = PEM_read_bio_X509_CRL(in, NULL, NULL, NULL); 5053 } 5054 5055 if (xcrl == NULL) { 5056 SET_ERROR(kmfh, ERR_get_error()); 5057 ret = KMF_ERR_BAD_CRLFILE; 5058 goto end; 5059 } 5060 5061 /* If bypasscheck is specified, no need to verify. */ 5062 if (crlcheck == B_FALSE) 5063 goto output; 5064 5065 ret = kmf_is_cert_file(handle, certfile, &format); 5066 if (ret != KMF_OK) 5067 goto end; 5068 5069 /* Read in the CA cert file and convert to X509 */ 5070 if (BIO_read_filename(in, certfile) <= 0) { 5071 SET_ERROR(kmfh, ERR_get_error()); 5072 ret = KMF_ERR_OPEN_FILE; 5073 goto end; 5074 } 5075 5076 if (format == KMF_FORMAT_ASN1) { 5077 xcert = d2i_X509_bio(in, NULL); 5078 } else if (format == KMF_FORMAT_PEM) { 5079 xcert = PEM_read_bio_X509(in, NULL, NULL, NULL); 5080 } else { 5081 ret = KMF_ERR_BAD_CERT_FORMAT; 5082 goto end; 5083 } 5084 5085 if (xcert == NULL) { 5086 SET_ERROR(kmfh, ERR_get_error()); 5087 ret = KMF_ERR_BAD_CERT_FORMAT; 5088 goto end; 5089 } 5090 /* Now get the public key from the CA cert */ 5091 pkey = X509_get_pubkey(xcert); 5092 if (pkey == NULL) { 5093 SET_ERROR(kmfh, ERR_get_error()); 5094 ret = KMF_ERR_BAD_CERTFILE; 5095 goto end; 5096 } 5097 5098 /* Verify the CRL with the CA's public key */ 5099 openssl_ret = X509_CRL_verify(xcrl, pkey); 5100 EVP_PKEY_free(pkey); 5101 if (openssl_ret > 0) { 5102 ret = KMF_OK; /* verify succeed */ 5103 } else { 5104 SET_ERROR(kmfh, openssl_ret); 5105 ret = KMF_ERR_BAD_CRLFILE; 5106 } 5107 5108 output: 5109 ret = kmf_get_attr(KMF_ENCODE_FORMAT_ATTR, attrlist, numattr, 5110 &outformat, NULL); 5111 if (ret != KMF_OK) { 5112 ret = KMF_OK; 5113 outformat = KMF_FORMAT_PEM; 5114 } 5115 5116 out = BIO_new_file(outcrlfile, "wb"); 5117 if (out == NULL) { 5118 SET_ERROR(kmfh, ERR_get_error()); 5119 ret = KMF_ERR_OPEN_FILE; 5120 goto end; 5121 } 5122 5123 if (outformat == KMF_FORMAT_ASN1) { 5124 openssl_ret = (int)i2d_X509_CRL_bio(out, xcrl); 5125 } else if (outformat == KMF_FORMAT_PEM) { 5126 openssl_ret = PEM_write_bio_X509_CRL(out, xcrl); 5127 } else { 5128 ret = KMF_ERR_BAD_PARAMETER; 5129 goto end; 5130 } 5131 5132 if (openssl_ret <= 0) { 5133 SET_ERROR(kmfh, ERR_get_error()); 5134 ret = KMF_ERR_WRITE_FILE; 5135 } else { 5136 ret = KMF_OK; 5137 } 5138 5139 end: 5140 if (xcrl != NULL) 5141 X509_CRL_free(xcrl); 5142 5143 if (xcert != NULL) 5144 X509_free(xcert); 5145 5146 if (in != NULL) 5147 (void) BIO_free(in); 5148 5149 if (out != NULL) 5150 (void) BIO_free(out); 5151 5152 if (outcrlfile != NULL) 5153 free(outcrlfile); 5154 5155 return (ret); 5156 } 5157 5158 KMF_RETURN 5159 OpenSSL_ListCRL(KMF_HANDLE_T handle, int numattr, KMF_ATTRIBUTE *attrlist) 5160 { 5161 KMF_RETURN ret = KMF_OK; 5162 KMF_HANDLE *kmfh = (KMF_HANDLE *)handle; 5163 X509_CRL *x = NULL; 5164 KMF_ENCODE_FORMAT format; 5165 char *crlfile = NULL; 5166 BIO *in = NULL; 5167 BIO *mem = NULL; 5168 long len; 5169 char *memptr; 5170 char *data = NULL; 5171 char **crldata; 5172 char *crlfilename, *dirpath; 5173 5174 if (numattr == 0 || attrlist == NULL) { 5175 return (KMF_ERR_BAD_PARAMETER); 5176 } 5177 crlfilename = kmf_get_attr_ptr(KMF_CRL_FILENAME_ATTR, 5178 attrlist, numattr); 5179 if (crlfilename == NULL) 5180 return (KMF_ERR_BAD_CRLFILE); 5181 5182 crldata = (char **)kmf_get_attr_ptr(KMF_CRL_DATA_ATTR, 5183 attrlist, numattr); 5184 5185 if (crldata == NULL) 5186 return (KMF_ERR_BAD_PARAMETER); 5187 5188 dirpath = kmf_get_attr_ptr(KMF_DIRPATH_ATTR, attrlist, numattr); 5189 5190 crlfile = get_fullpath(dirpath, crlfilename); 5191 5192 if (crlfile == NULL) 5193 return (KMF_ERR_BAD_CRLFILE); 5194 5195 if (isdir(crlfile)) { 5196 free(crlfile); 5197 return (KMF_ERR_BAD_CRLFILE); 5198 } 5199 5200 ret = kmf_is_crl_file(handle, crlfile, &format); 5201 if (ret != KMF_OK) { 5202 free(crlfile); 5203 return (ret); 5204 } 5205 5206 if (bio_err == NULL) 5207 bio_err = BIO_new_fp(stderr, BIO_NOCLOSE); 5208 5209 in = BIO_new_file(crlfile, "rb"); 5210 if (in == NULL) { 5211 SET_ERROR(kmfh, ERR_get_error()); 5212 ret = KMF_ERR_OPEN_FILE; 5213 goto end; 5214 } 5215 5216 if (format == KMF_FORMAT_ASN1) { 5217 x = d2i_X509_CRL_bio(in, NULL); 5218 } else if (format == KMF_FORMAT_PEM) { 5219 x = PEM_read_bio_X509_CRL(in, NULL, NULL, NULL); 5220 } 5221 5222 if (x == NULL) { /* should not happen */ 5223 SET_ERROR(kmfh, ERR_get_error()); 5224 ret = KMF_ERR_OPEN_FILE; 5225 goto end; 5226 } 5227 5228 mem = BIO_new(BIO_s_mem()); 5229 if (mem == NULL) { 5230 SET_ERROR(kmfh, ERR_get_error()); 5231 ret = KMF_ERR_MEMORY; 5232 goto end; 5233 } 5234 5235 (void) X509_CRL_print(mem, x); 5236 len = BIO_get_mem_data(mem, &memptr); 5237 if (len <= 0) { 5238 SET_ERROR(kmfh, ERR_get_error()); 5239 ret = KMF_ERR_MEMORY; 5240 goto end; 5241 } 5242 5243 data = malloc(len + 1); 5244 if (data == NULL) { 5245 ret = KMF_ERR_MEMORY; 5246 goto end; 5247 } 5248 5249 (void) memcpy(data, memptr, len); 5250 data[len] = '\0'; 5251 *crldata = data; 5252 5253 end: 5254 if (x != NULL) 5255 X509_CRL_free(x); 5256 5257 if (crlfile != NULL) 5258 free(crlfile); 5259 5260 if (in != NULL) 5261 (void) BIO_free(in); 5262 5263 if (mem != NULL) 5264 (void) BIO_free(mem); 5265 5266 return (ret); 5267 } 5268 5269 KMF_RETURN 5270 OpenSSL_DeleteCRL(KMF_HANDLE_T handle, int numattr, KMF_ATTRIBUTE *attrlist) 5271 { 5272 KMF_RETURN ret = KMF_OK; 5273 KMF_HANDLE *kmfh = (KMF_HANDLE *)handle; 5274 KMF_ENCODE_FORMAT format; 5275 char *crlfile = NULL; 5276 BIO *in = NULL; 5277 char *crlfilename, *dirpath; 5278 5279 if (numattr == 0 || attrlist == NULL) { 5280 return (KMF_ERR_BAD_PARAMETER); 5281 } 5282 5283 crlfilename = kmf_get_attr_ptr(KMF_CRL_FILENAME_ATTR, 5284 attrlist, numattr); 5285 5286 if (crlfilename == NULL) 5287 return (KMF_ERR_BAD_CRLFILE); 5288 5289 dirpath = kmf_get_attr_ptr(KMF_DIRPATH_ATTR, attrlist, numattr); 5290 5291 crlfile = get_fullpath(dirpath, crlfilename); 5292 5293 if (crlfile == NULL) 5294 return (KMF_ERR_BAD_CRLFILE); 5295 5296 if (isdir(crlfile)) { 5297 ret = KMF_ERR_BAD_CRLFILE; 5298 goto end; 5299 } 5300 5301 ret = kmf_is_crl_file(handle, crlfile, &format); 5302 if (ret != KMF_OK) 5303 goto end; 5304 5305 if (unlink(crlfile) != 0) { 5306 SET_SYS_ERROR(kmfh, errno); 5307 ret = KMF_ERR_INTERNAL; 5308 goto end; 5309 } 5310 5311 end: 5312 if (in != NULL) 5313 (void) BIO_free(in); 5314 if (crlfile != NULL) 5315 free(crlfile); 5316 5317 return (ret); 5318 } 5319 5320 KMF_RETURN 5321 OpenSSL_FindCertInCRL(KMF_HANDLE_T handle, int numattr, KMF_ATTRIBUTE *attrlist) 5322 { 5323 KMF_RETURN ret = KMF_OK; 5324 KMF_HANDLE *kmfh = (KMF_HANDLE *)handle; 5325 KMF_ENCODE_FORMAT format; 5326 BIO *in = NULL; 5327 X509 *xcert = NULL; 5328 X509_CRL *xcrl = NULL; 5329 STACK_OF(X509_REVOKED) *revoke_stack = NULL; 5330 X509_REVOKED *revoke; 5331 int i; 5332 char *crlfilename, *crlfile, *dirpath, *certfile; 5333 5334 if (numattr == 0 || attrlist == NULL) { 5335 return (KMF_ERR_BAD_PARAMETER); 5336 } 5337 5338 crlfilename = kmf_get_attr_ptr(KMF_CRL_FILENAME_ATTR, 5339 attrlist, numattr); 5340 5341 if (crlfilename == NULL) 5342 return (KMF_ERR_BAD_CRLFILE); 5343 5344 certfile = kmf_get_attr_ptr(KMF_CERT_FILENAME_ATTR, attrlist, numattr); 5345 if (certfile == NULL) 5346 return (KMF_ERR_BAD_CRLFILE); 5347 5348 dirpath = kmf_get_attr_ptr(KMF_DIRPATH_ATTR, attrlist, numattr); 5349 5350 crlfile = get_fullpath(dirpath, crlfilename); 5351 5352 if (crlfile == NULL) 5353 return (KMF_ERR_BAD_CRLFILE); 5354 5355 if (isdir(crlfile)) { 5356 ret = KMF_ERR_BAD_CRLFILE; 5357 goto end; 5358 } 5359 5360 ret = kmf_is_crl_file(handle, crlfile, &format); 5361 if (ret != KMF_OK) 5362 goto end; 5363 5364 /* Read the CRL file and load it into a X509_CRL structure */ 5365 in = BIO_new_file(crlfilename, "rb"); 5366 if (in == NULL) { 5367 SET_ERROR(kmfh, ERR_get_error()); 5368 ret = KMF_ERR_OPEN_FILE; 5369 goto end; 5370 } 5371 5372 if (format == KMF_FORMAT_ASN1) { 5373 xcrl = d2i_X509_CRL_bio(in, NULL); 5374 } else if (format == KMF_FORMAT_PEM) { 5375 xcrl = PEM_read_bio_X509_CRL(in, NULL, NULL, NULL); 5376 } 5377 5378 if (xcrl == NULL) { 5379 SET_ERROR(kmfh, ERR_get_error()); 5380 ret = KMF_ERR_BAD_CRLFILE; 5381 goto end; 5382 } 5383 (void) BIO_free(in); 5384 5385 /* Read the Certificate file and load it into a X509 structure */ 5386 ret = kmf_is_cert_file(handle, certfile, &format); 5387 if (ret != KMF_OK) 5388 goto end; 5389 5390 in = BIO_new_file(certfile, "rb"); 5391 if (in == NULL) { 5392 SET_ERROR(kmfh, ERR_get_error()); 5393 ret = KMF_ERR_OPEN_FILE; 5394 goto end; 5395 } 5396 5397 if (format == KMF_FORMAT_ASN1) { 5398 xcert = d2i_X509_bio(in, NULL); 5399 } else if (format == KMF_FORMAT_PEM) { 5400 xcert = PEM_read_bio_X509(in, NULL, NULL, NULL); 5401 } 5402 5403 if (xcert == NULL) { 5404 SET_ERROR(kmfh, ERR_get_error()); 5405 ret = KMF_ERR_BAD_CERTFILE; 5406 goto end; 5407 } 5408 5409 /* Check if the certificate and the CRL have same issuer */ 5410 if (X509_NAME_cmp(xcert->cert_info->issuer, xcrl->crl->issuer) != 0) { 5411 ret = KMF_ERR_ISSUER; 5412 goto end; 5413 } 5414 5415 /* Check to see if the certificate serial number is revoked */ 5416 revoke_stack = X509_CRL_get_REVOKED(xcrl); 5417 if (sk_X509_REVOKED_num(revoke_stack) <= 0) { 5418 /* No revoked certificates in the CRL file */ 5419 SET_ERROR(kmfh, ERR_get_error()); 5420 ret = KMF_ERR_EMPTY_CRL; 5421 goto end; 5422 } 5423 5424 for (i = 0; i < sk_X509_REVOKED_num(revoke_stack); i++) { 5425 /* LINTED E_BAD_PTR_CAST_ALIGN */ 5426 revoke = sk_X509_REVOKED_value(revoke_stack, i); 5427 if (ASN1_INTEGER_cmp(xcert->cert_info->serialNumber, 5428 revoke->serialNumber) == 0) { 5429 break; 5430 } 5431 } 5432 5433 if (i < sk_X509_REVOKED_num(revoke_stack)) { 5434 ret = KMF_OK; 5435 } else { 5436 ret = KMF_ERR_NOT_REVOKED; 5437 } 5438 5439 end: 5440 if (in != NULL) 5441 (void) BIO_free(in); 5442 if (xcrl != NULL) 5443 X509_CRL_free(xcrl); 5444 if (xcert != NULL) 5445 X509_free(xcert); 5446 5447 return (ret); 5448 } 5449 5450 KMF_RETURN 5451 OpenSSL_VerifyCRLFile(KMF_HANDLE_T handle, char *crlname, KMF_DATA *tacert) 5452 { 5453 KMF_RETURN ret = KMF_OK; 5454 KMF_HANDLE *kmfh = (KMF_HANDLE *)handle; 5455 BIO *bcrl = NULL; 5456 X509_CRL *xcrl = NULL; 5457 X509 *xcert = NULL; 5458 EVP_PKEY *pkey; 5459 int sslret; 5460 KMF_ENCODE_FORMAT crl_format; 5461 unsigned char *p; 5462 long len; 5463 5464 if (handle == NULL || crlname == NULL || tacert == NULL) { 5465 return (KMF_ERR_BAD_PARAMETER); 5466 } 5467 5468 ret = kmf_get_file_format(crlname, &crl_format); 5469 if (ret != KMF_OK) 5470 return (ret); 5471 5472 bcrl = BIO_new_file(crlname, "rb"); 5473 if (bcrl == NULL) { 5474 SET_ERROR(kmfh, ERR_get_error()); 5475 ret = KMF_ERR_OPEN_FILE; 5476 goto cleanup; 5477 } 5478 5479 if (crl_format == KMF_FORMAT_ASN1) { 5480 xcrl = d2i_X509_CRL_bio(bcrl, NULL); 5481 } else if (crl_format == KMF_FORMAT_PEM) { 5482 xcrl = PEM_read_bio_X509_CRL(bcrl, NULL, NULL, NULL); 5483 } else { 5484 ret = KMF_ERR_BAD_PARAMETER; 5485 goto cleanup; 5486 } 5487 5488 if (xcrl == NULL) { 5489 SET_ERROR(kmfh, ERR_get_error()); 5490 ret = KMF_ERR_BAD_CRLFILE; 5491 goto cleanup; 5492 } 5493 5494 p = tacert->Data; 5495 len = tacert->Length; 5496 xcert = d2i_X509(NULL, (const uchar_t **)&p, len); 5497 5498 if (xcert == NULL) { 5499 SET_ERROR(kmfh, ERR_get_error()); 5500 ret = KMF_ERR_BAD_CERTFILE; 5501 goto cleanup; 5502 } 5503 5504 /* Get issuer certificate public key */ 5505 pkey = X509_get_pubkey(xcert); 5506 if (pkey == NULL) { 5507 SET_ERROR(kmfh, ERR_get_error()); 5508 ret = KMF_ERR_BAD_CERT_FORMAT; 5509 goto cleanup; 5510 } 5511 5512 /* Verify CRL signature */ 5513 sslret = X509_CRL_verify(xcrl, pkey); 5514 EVP_PKEY_free(pkey); 5515 if (sslret > 0) { 5516 ret = KMF_OK; 5517 } else { 5518 SET_ERROR(kmfh, sslret); 5519 ret = KMF_ERR_BAD_CRLFILE; 5520 } 5521 5522 cleanup: 5523 if (bcrl != NULL) 5524 (void) BIO_free(bcrl); 5525 5526 if (xcrl != NULL) 5527 X509_CRL_free(xcrl); 5528 5529 if (xcert != NULL) 5530 X509_free(xcert); 5531 5532 return (ret); 5533 5534 } 5535 5536 KMF_RETURN 5537 OpenSSL_CheckCRLDate(KMF_HANDLE_T handle, char *crlname) 5538 { 5539 KMF_RETURN ret = KMF_OK; 5540 KMF_HANDLE *kmfh = (KMF_HANDLE *)handle; 5541 KMF_ENCODE_FORMAT crl_format; 5542 BIO *bcrl = NULL; 5543 X509_CRL *xcrl = NULL; 5544 int i; 5545 5546 if (handle == NULL || crlname == NULL) { 5547 return (KMF_ERR_BAD_PARAMETER); 5548 } 5549 5550 ret = kmf_is_crl_file(handle, crlname, &crl_format); 5551 if (ret != KMF_OK) 5552 return (ret); 5553 5554 bcrl = BIO_new_file(crlname, "rb"); 5555 if (bcrl == NULL) { 5556 SET_ERROR(kmfh, ERR_get_error()); 5557 ret = KMF_ERR_OPEN_FILE; 5558 goto cleanup; 5559 } 5560 5561 if (crl_format == KMF_FORMAT_ASN1) 5562 xcrl = d2i_X509_CRL_bio(bcrl, NULL); 5563 else if (crl_format == KMF_FORMAT_PEM) 5564 xcrl = PEM_read_bio_X509_CRL(bcrl, NULL, NULL, NULL); 5565 5566 if (xcrl == NULL) { 5567 SET_ERROR(kmfh, ERR_get_error()); 5568 ret = KMF_ERR_BAD_CRLFILE; 5569 goto cleanup; 5570 } 5571 i = X509_cmp_time(X509_CRL_get_lastUpdate(xcrl), NULL); 5572 if (i >= 0) { 5573 ret = KMF_ERR_VALIDITY_PERIOD; 5574 goto cleanup; 5575 } 5576 if (X509_CRL_get_nextUpdate(xcrl)) { 5577 i = X509_cmp_time(X509_CRL_get_nextUpdate(xcrl), NULL); 5578 5579 if (i <= 0) { 5580 ret = KMF_ERR_VALIDITY_PERIOD; 5581 goto cleanup; 5582 } 5583 } 5584 5585 ret = KMF_OK; 5586 5587 cleanup: 5588 if (bcrl != NULL) 5589 (void) BIO_free(bcrl); 5590 5591 if (xcrl != NULL) 5592 X509_CRL_free(xcrl); 5593 5594 return (ret); 5595 } 5596