1b077aed3SPierre Pronchery /*
2*e7be843bSPierre Pronchery * Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved.
3b077aed3SPierre Pronchery *
4b077aed3SPierre Pronchery * Licensed under the Apache License 2.0 (the "License"). You may not use
5b077aed3SPierre Pronchery * this file except in compliance with the License. You can obtain a copy
6b077aed3SPierre Pronchery * in the file LICENSE in the source distribution or at
7b077aed3SPierre Pronchery * https://www.openssl.org/source/license.html
8b077aed3SPierre Pronchery */
9b077aed3SPierre Pronchery
10b077aed3SPierre Pronchery #include <openssl/core.h>
11b077aed3SPierre Pronchery #include <openssl/core_dispatch.h>
12b077aed3SPierre Pronchery #include <openssl/core_names.h>
13b077aed3SPierre Pronchery #include <openssl/core_object.h>
14b077aed3SPierre Pronchery #include <openssl/asn1.h>
15b077aed3SPierre Pronchery #include <openssl/err.h>
16b077aed3SPierre Pronchery #include <openssl/objects.h>
17b077aed3SPierre Pronchery #include <openssl/pkcs12.h>
18b077aed3SPierre Pronchery #include <openssl/x509.h>
19b077aed3SPierre Pronchery #include <openssl/proverr.h>
20b077aed3SPierre Pronchery #include "internal/asn1.h"
21b077aed3SPierre Pronchery #include "internal/sizes.h"
22b077aed3SPierre Pronchery #include "prov/bio.h"
23*e7be843bSPierre Pronchery #include "prov/decoders.h"
24b077aed3SPierre Pronchery #include "prov/implementations.h"
25b077aed3SPierre Pronchery #include "endecoder_local.h"
26b077aed3SPierre Pronchery
27b077aed3SPierre Pronchery static OSSL_FUNC_decoder_newctx_fn epki2pki_newctx;
28b077aed3SPierre Pronchery static OSSL_FUNC_decoder_freectx_fn epki2pki_freectx;
29b077aed3SPierre Pronchery static OSSL_FUNC_decoder_decode_fn epki2pki_decode;
30*e7be843bSPierre Pronchery static OSSL_FUNC_decoder_settable_ctx_params_fn epki2pki_settable_ctx_params;
31*e7be843bSPierre Pronchery static OSSL_FUNC_decoder_set_ctx_params_fn epki2pki_set_ctx_params;
32b077aed3SPierre Pronchery
33b077aed3SPierre Pronchery /*
34b077aed3SPierre Pronchery * Context used for EncryptedPrivateKeyInfo to PrivateKeyInfo decoding.
35b077aed3SPierre Pronchery */
36b077aed3SPierre Pronchery struct epki2pki_ctx_st {
37b077aed3SPierre Pronchery PROV_CTX *provctx;
38*e7be843bSPierre Pronchery char propq[OSSL_MAX_PROPQUERY_SIZE];
39b077aed3SPierre Pronchery };
40b077aed3SPierre Pronchery
epki2pki_newctx(void * provctx)41b077aed3SPierre Pronchery static void *epki2pki_newctx(void *provctx)
42b077aed3SPierre Pronchery {
43b077aed3SPierre Pronchery struct epki2pki_ctx_st *ctx = OPENSSL_zalloc(sizeof(*ctx));
44b077aed3SPierre Pronchery
45b077aed3SPierre Pronchery if (ctx != NULL)
46b077aed3SPierre Pronchery ctx->provctx = provctx;
47b077aed3SPierre Pronchery return ctx;
48b077aed3SPierre Pronchery }
49b077aed3SPierre Pronchery
epki2pki_freectx(void * vctx)50b077aed3SPierre Pronchery static void epki2pki_freectx(void *vctx)
51b077aed3SPierre Pronchery {
52b077aed3SPierre Pronchery struct epki2pki_ctx_st *ctx = vctx;
53b077aed3SPierre Pronchery
54b077aed3SPierre Pronchery OPENSSL_free(ctx);
55b077aed3SPierre Pronchery }
56b077aed3SPierre Pronchery
epki2pki_settable_ctx_params(ossl_unused void * provctx)57*e7be843bSPierre Pronchery static const OSSL_PARAM *epki2pki_settable_ctx_params(ossl_unused void *provctx)
58*e7be843bSPierre Pronchery {
59*e7be843bSPierre Pronchery static const OSSL_PARAM settables[] = {
60*e7be843bSPierre Pronchery OSSL_PARAM_utf8_string(OSSL_DECODER_PARAM_PROPERTIES, NULL, 0),
61*e7be843bSPierre Pronchery OSSL_PARAM_END
62*e7be843bSPierre Pronchery };
63*e7be843bSPierre Pronchery return settables;
64*e7be843bSPierre Pronchery }
65*e7be843bSPierre Pronchery
epki2pki_set_ctx_params(void * vctx,const OSSL_PARAM params[])66*e7be843bSPierre Pronchery static int epki2pki_set_ctx_params(void *vctx, const OSSL_PARAM params[])
67*e7be843bSPierre Pronchery {
68*e7be843bSPierre Pronchery struct epki2pki_ctx_st *ctx = vctx;
69*e7be843bSPierre Pronchery const OSSL_PARAM *p;
70*e7be843bSPierre Pronchery char *str = ctx->propq;
71*e7be843bSPierre Pronchery
72*e7be843bSPierre Pronchery p = OSSL_PARAM_locate_const(params, OSSL_DECODER_PARAM_PROPERTIES);
73*e7be843bSPierre Pronchery if (p != NULL && !OSSL_PARAM_get_utf8_string(p, &str, sizeof(ctx->propq)))
74*e7be843bSPierre Pronchery return 0;
75*e7be843bSPierre Pronchery
76*e7be843bSPierre Pronchery return 1;
77*e7be843bSPierre Pronchery }
78*e7be843bSPierre Pronchery
79b077aed3SPierre Pronchery /*
80b077aed3SPierre Pronchery * The selection parameter in epki2pki_decode() is not used by this function
81b077aed3SPierre Pronchery * because it's not relevant just to decode EncryptedPrivateKeyInfo to
82b077aed3SPierre Pronchery * PrivateKeyInfo.
83b077aed3SPierre Pronchery */
epki2pki_decode(void * vctx,OSSL_CORE_BIO * cin,int selection,OSSL_CALLBACK * data_cb,void * data_cbarg,OSSL_PASSPHRASE_CALLBACK * pw_cb,void * pw_cbarg)84b077aed3SPierre Pronchery static int epki2pki_decode(void *vctx, OSSL_CORE_BIO *cin, int selection,
85b077aed3SPierre Pronchery OSSL_CALLBACK *data_cb, void *data_cbarg,
86b077aed3SPierre Pronchery OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg)
87b077aed3SPierre Pronchery {
88b077aed3SPierre Pronchery struct epki2pki_ctx_st *ctx = vctx;
89b077aed3SPierre Pronchery BUF_MEM *mem = NULL;
90b077aed3SPierre Pronchery unsigned char *der = NULL;
91b077aed3SPierre Pronchery long der_len = 0;
92b077aed3SPierre Pronchery BIO *in = ossl_bio_new_from_core_bio(ctx->provctx, cin);
93b077aed3SPierre Pronchery int ok = 0;
94b077aed3SPierre Pronchery
95b077aed3SPierre Pronchery if (in == NULL)
96b077aed3SPierre Pronchery return 0;
97b077aed3SPierre Pronchery
98b077aed3SPierre Pronchery ok = (asn1_d2i_read_bio(in, &mem) >= 0);
99b077aed3SPierre Pronchery BIO_free(in);
100b077aed3SPierre Pronchery
101b077aed3SPierre Pronchery /* We return "empty handed". This is not an error. */
102b077aed3SPierre Pronchery if (!ok)
103b077aed3SPierre Pronchery return 1;
104b077aed3SPierre Pronchery
105*e7be843bSPierre Pronchery der = (unsigned char *)mem->data;
106b077aed3SPierre Pronchery der_len = (long)mem->length;
107b077aed3SPierre Pronchery OPENSSL_free(mem);
108b077aed3SPierre Pronchery
109*e7be843bSPierre Pronchery ok = ossl_epki2pki_der_decode(der, der_len, selection, data_cb, data_cbarg,
110*e7be843bSPierre Pronchery pw_cb, pw_cbarg, PROV_LIBCTX_OF(ctx->provctx),
111*e7be843bSPierre Pronchery ctx->propq);
112*e7be843bSPierre Pronchery OPENSSL_free(der);
113*e7be843bSPierre Pronchery return ok;
114*e7be843bSPierre Pronchery }
115*e7be843bSPierre Pronchery
ossl_epki2pki_der_decode(unsigned char * der,long der_len,int selection,OSSL_CALLBACK * data_cb,void * data_cbarg,OSSL_PASSPHRASE_CALLBACK * pw_cb,void * pw_cbarg,OSSL_LIB_CTX * libctx,const char * propq)116*e7be843bSPierre Pronchery int ossl_epki2pki_der_decode(unsigned char *der, long der_len, int selection,
117*e7be843bSPierre Pronchery OSSL_CALLBACK *data_cb, void *data_cbarg,
118*e7be843bSPierre Pronchery OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg,
119*e7be843bSPierre Pronchery OSSL_LIB_CTX *libctx, const char *propq)
120*e7be843bSPierre Pronchery {
121*e7be843bSPierre Pronchery const unsigned char *pder = der;
122*e7be843bSPierre Pronchery unsigned char *new_der = NULL;
123*e7be843bSPierre Pronchery X509_SIG *p8 = NULL;
124*e7be843bSPierre Pronchery PKCS8_PRIV_KEY_INFO *p8inf = NULL;
125*e7be843bSPierre Pronchery const X509_ALGOR *alg = NULL;
126*e7be843bSPierre Pronchery int ok = 1; /* Assume good */
127*e7be843bSPierre Pronchery
128b077aed3SPierre Pronchery ERR_set_mark();
129b077aed3SPierre Pronchery if ((p8 = d2i_X509_SIG(NULL, &pder, der_len)) != NULL) {
130b077aed3SPierre Pronchery char pbuf[1024];
131b077aed3SPierre Pronchery size_t plen = 0;
132b077aed3SPierre Pronchery
133b077aed3SPierre Pronchery ERR_clear_last_mark();
134b077aed3SPierre Pronchery
135b077aed3SPierre Pronchery if (!pw_cb(pbuf, sizeof(pbuf), &plen, NULL, pw_cbarg)) {
136b077aed3SPierre Pronchery ERR_raise(ERR_LIB_PROV, PROV_R_UNABLE_TO_GET_PASSPHRASE);
137b077aed3SPierre Pronchery ok = 0;
138b077aed3SPierre Pronchery } else {
139b077aed3SPierre Pronchery const ASN1_OCTET_STRING *oct;
140b077aed3SPierre Pronchery int new_der_len = 0;
141b077aed3SPierre Pronchery
142b077aed3SPierre Pronchery X509_SIG_get0(p8, &alg, &oct);
143b077aed3SPierre Pronchery if (!PKCS12_pbe_crypt_ex(alg, pbuf, plen,
144b077aed3SPierre Pronchery oct->data, oct->length,
145b077aed3SPierre Pronchery &new_der, &new_der_len, 0,
146*e7be843bSPierre Pronchery libctx, propq)) {
147b077aed3SPierre Pronchery ok = 0;
148b077aed3SPierre Pronchery } else {
149b077aed3SPierre Pronchery der = new_der;
150b077aed3SPierre Pronchery der_len = new_der_len;
151b077aed3SPierre Pronchery }
152b077aed3SPierre Pronchery alg = NULL;
153b077aed3SPierre Pronchery }
154b077aed3SPierre Pronchery X509_SIG_free(p8);
155b077aed3SPierre Pronchery } else {
156b077aed3SPierre Pronchery ERR_pop_to_mark();
157b077aed3SPierre Pronchery }
158b077aed3SPierre Pronchery
159b077aed3SPierre Pronchery ERR_set_mark();
160b077aed3SPierre Pronchery pder = der;
161b077aed3SPierre Pronchery p8inf = d2i_PKCS8_PRIV_KEY_INFO(NULL, &pder, der_len);
162b077aed3SPierre Pronchery ERR_pop_to_mark();
163b077aed3SPierre Pronchery
164b077aed3SPierre Pronchery if (p8inf != NULL && PKCS8_pkey_get0(NULL, NULL, NULL, &alg, p8inf)) {
165b077aed3SPierre Pronchery /*
166b077aed3SPierre Pronchery * We have something and recognised it as PrivateKeyInfo, so let's
167b077aed3SPierre Pronchery * pass all the applicable data to the callback.
168b077aed3SPierre Pronchery */
169b077aed3SPierre Pronchery char keytype[OSSL_MAX_NAME_SIZE];
170*e7be843bSPierre Pronchery OSSL_PARAM params[6], *p = params;
171b077aed3SPierre Pronchery int objtype = OSSL_OBJECT_PKEY;
172b077aed3SPierre Pronchery
173b077aed3SPierre Pronchery OBJ_obj2txt(keytype, sizeof(keytype), alg->algorithm, 0);
174b077aed3SPierre Pronchery
175b077aed3SPierre Pronchery *p++ = OSSL_PARAM_construct_utf8_string(OSSL_OBJECT_PARAM_DATA_TYPE,
176b077aed3SPierre Pronchery keytype, 0);
177*e7be843bSPierre Pronchery *p++ = OSSL_PARAM_construct_utf8_string(OSSL_OBJECT_PARAM_INPUT_TYPE,
178*e7be843bSPierre Pronchery "DER", 0);
179b077aed3SPierre Pronchery *p++ = OSSL_PARAM_construct_utf8_string(OSSL_OBJECT_PARAM_DATA_STRUCTURE,
180b077aed3SPierre Pronchery "PrivateKeyInfo", 0);
181b077aed3SPierre Pronchery *p++ = OSSL_PARAM_construct_octet_string(OSSL_OBJECT_PARAM_DATA,
182b077aed3SPierre Pronchery der, der_len);
183b077aed3SPierre Pronchery *p++ = OSSL_PARAM_construct_int(OSSL_OBJECT_PARAM_TYPE, &objtype);
184b077aed3SPierre Pronchery *p = OSSL_PARAM_construct_end();
185b077aed3SPierre Pronchery
186b077aed3SPierre Pronchery ok = data_cb(params, data_cbarg);
187b077aed3SPierre Pronchery }
188b077aed3SPierre Pronchery PKCS8_PRIV_KEY_INFO_free(p8inf);
189*e7be843bSPierre Pronchery OPENSSL_free(new_der);
190b077aed3SPierre Pronchery return ok;
191b077aed3SPierre Pronchery }
192b077aed3SPierre Pronchery
193b077aed3SPierre Pronchery const OSSL_DISPATCH ossl_EncryptedPrivateKeyInfo_der_to_der_decoder_functions[] = {
194b077aed3SPierre Pronchery { OSSL_FUNC_DECODER_NEWCTX, (void (*)(void))epki2pki_newctx },
195b077aed3SPierre Pronchery { OSSL_FUNC_DECODER_FREECTX, (void (*)(void))epki2pki_freectx },
196b077aed3SPierre Pronchery { OSSL_FUNC_DECODER_DECODE, (void (*)(void))epki2pki_decode },
197*e7be843bSPierre Pronchery { OSSL_FUNC_DECODER_SETTABLE_CTX_PARAMS,
198*e7be843bSPierre Pronchery (void (*)(void))epki2pki_settable_ctx_params },
199*e7be843bSPierre Pronchery { OSSL_FUNC_DECODER_SET_CTX_PARAMS,
200*e7be843bSPierre Pronchery (void (*)(void))epki2pki_set_ctx_params },
201*e7be843bSPierre Pronchery OSSL_DISPATCH_END
202b077aed3SPierre Pronchery };
203