1*0Sstevel@tonic-gate /* ssl/ssl_rsa.c */ 2*0Sstevel@tonic-gate /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 3*0Sstevel@tonic-gate * All rights reserved. 4*0Sstevel@tonic-gate * 5*0Sstevel@tonic-gate * This package is an SSL implementation written 6*0Sstevel@tonic-gate * by Eric Young (eay@cryptsoft.com). 7*0Sstevel@tonic-gate * The implementation was written so as to conform with Netscapes SSL. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * This library is free for commercial and non-commercial use as long as 10*0Sstevel@tonic-gate * the following conditions are aheared to. The following conditions 11*0Sstevel@tonic-gate * apply to all code found in this distribution, be it the RC4, RSA, 12*0Sstevel@tonic-gate * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13*0Sstevel@tonic-gate * included with this distribution is covered by the same copyright terms 14*0Sstevel@tonic-gate * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15*0Sstevel@tonic-gate * 16*0Sstevel@tonic-gate * Copyright remains Eric Young's, and as such any Copyright notices in 17*0Sstevel@tonic-gate * the code are not to be removed. 18*0Sstevel@tonic-gate * If this package is used in a product, Eric Young should be given attribution 19*0Sstevel@tonic-gate * as the author of the parts of the library used. 20*0Sstevel@tonic-gate * This can be in the form of a textual message at program startup or 21*0Sstevel@tonic-gate * in documentation (online or textual) provided with the package. 22*0Sstevel@tonic-gate * 23*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without 24*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions 25*0Sstevel@tonic-gate * are met: 26*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the copyright 27*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer. 28*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright 29*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in the 30*0Sstevel@tonic-gate * documentation and/or other materials provided with the distribution. 31*0Sstevel@tonic-gate * 3. All advertising materials mentioning features or use of this software 32*0Sstevel@tonic-gate * must display the following acknowledgement: 33*0Sstevel@tonic-gate * "This product includes cryptographic software written by 34*0Sstevel@tonic-gate * Eric Young (eay@cryptsoft.com)" 35*0Sstevel@tonic-gate * The word 'cryptographic' can be left out if the rouines from the library 36*0Sstevel@tonic-gate * being used are not cryptographic related :-). 37*0Sstevel@tonic-gate * 4. If you include any Windows specific code (or a derivative thereof) from 38*0Sstevel@tonic-gate * the apps directory (application code) you must include an acknowledgement: 39*0Sstevel@tonic-gate * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40*0Sstevel@tonic-gate * 41*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42*0Sstevel@tonic-gate * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43*0Sstevel@tonic-gate * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44*0Sstevel@tonic-gate * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45*0Sstevel@tonic-gate * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46*0Sstevel@tonic-gate * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47*0Sstevel@tonic-gate * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48*0Sstevel@tonic-gate * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49*0Sstevel@tonic-gate * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50*0Sstevel@tonic-gate * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51*0Sstevel@tonic-gate * SUCH DAMAGE. 52*0Sstevel@tonic-gate * 53*0Sstevel@tonic-gate * The licence and distribution terms for any publically available version or 54*0Sstevel@tonic-gate * derivative of this code cannot be changed. i.e. this code cannot simply be 55*0Sstevel@tonic-gate * copied and put under another distribution licence 56*0Sstevel@tonic-gate * [including the GNU Public Licence.] 57*0Sstevel@tonic-gate */ 58*0Sstevel@tonic-gate 59*0Sstevel@tonic-gate #include <stdio.h> 60*0Sstevel@tonic-gate #include "ssl_locl.h" 61*0Sstevel@tonic-gate #include <openssl/bio.h> 62*0Sstevel@tonic-gate #include <openssl/objects.h> 63*0Sstevel@tonic-gate #include <openssl/evp.h> 64*0Sstevel@tonic-gate #include <openssl/x509.h> 65*0Sstevel@tonic-gate #include <openssl/pem.h> 66*0Sstevel@tonic-gate 67*0Sstevel@tonic-gate static int ssl_set_cert(CERT *c, X509 *x509); 68*0Sstevel@tonic-gate static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey); 69*0Sstevel@tonic-gate int SSL_use_certificate(SSL *ssl, X509 *x) 70*0Sstevel@tonic-gate { 71*0Sstevel@tonic-gate if (x == NULL) 72*0Sstevel@tonic-gate { 73*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_USE_CERTIFICATE,ERR_R_PASSED_NULL_PARAMETER); 74*0Sstevel@tonic-gate return(0); 75*0Sstevel@tonic-gate } 76*0Sstevel@tonic-gate if (!ssl_cert_inst(&ssl->cert)) 77*0Sstevel@tonic-gate { 78*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_USE_CERTIFICATE,ERR_R_MALLOC_FAILURE); 79*0Sstevel@tonic-gate return(0); 80*0Sstevel@tonic-gate } 81*0Sstevel@tonic-gate return(ssl_set_cert(ssl->cert,x)); 82*0Sstevel@tonic-gate } 83*0Sstevel@tonic-gate 84*0Sstevel@tonic-gate #ifndef OPENSSL_NO_STDIO 85*0Sstevel@tonic-gate int SSL_use_certificate_file(SSL *ssl, const char *file, int type) 86*0Sstevel@tonic-gate { 87*0Sstevel@tonic-gate int j; 88*0Sstevel@tonic-gate BIO *in; 89*0Sstevel@tonic-gate int ret=0; 90*0Sstevel@tonic-gate X509 *x=NULL; 91*0Sstevel@tonic-gate 92*0Sstevel@tonic-gate in=BIO_new(BIO_s_file_internal()); 93*0Sstevel@tonic-gate if (in == NULL) 94*0Sstevel@tonic-gate { 95*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE,ERR_R_BUF_LIB); 96*0Sstevel@tonic-gate goto end; 97*0Sstevel@tonic-gate } 98*0Sstevel@tonic-gate 99*0Sstevel@tonic-gate if (BIO_read_filename(in,file) <= 0) 100*0Sstevel@tonic-gate { 101*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE,ERR_R_SYS_LIB); 102*0Sstevel@tonic-gate goto end; 103*0Sstevel@tonic-gate } 104*0Sstevel@tonic-gate if (type == SSL_FILETYPE_ASN1) 105*0Sstevel@tonic-gate { 106*0Sstevel@tonic-gate j=ERR_R_ASN1_LIB; 107*0Sstevel@tonic-gate x=d2i_X509_bio(in,NULL); 108*0Sstevel@tonic-gate } 109*0Sstevel@tonic-gate else if (type == SSL_FILETYPE_PEM) 110*0Sstevel@tonic-gate { 111*0Sstevel@tonic-gate j=ERR_R_PEM_LIB; 112*0Sstevel@tonic-gate x=PEM_read_bio_X509(in,NULL,ssl->ctx->default_passwd_callback,ssl->ctx->default_passwd_callback_userdata); 113*0Sstevel@tonic-gate } 114*0Sstevel@tonic-gate else 115*0Sstevel@tonic-gate { 116*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE,SSL_R_BAD_SSL_FILETYPE); 117*0Sstevel@tonic-gate goto end; 118*0Sstevel@tonic-gate } 119*0Sstevel@tonic-gate 120*0Sstevel@tonic-gate if (x == NULL) 121*0Sstevel@tonic-gate { 122*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE,j); 123*0Sstevel@tonic-gate goto end; 124*0Sstevel@tonic-gate } 125*0Sstevel@tonic-gate 126*0Sstevel@tonic-gate ret=SSL_use_certificate(ssl,x); 127*0Sstevel@tonic-gate end: 128*0Sstevel@tonic-gate if (x != NULL) X509_free(x); 129*0Sstevel@tonic-gate if (in != NULL) BIO_free(in); 130*0Sstevel@tonic-gate return(ret); 131*0Sstevel@tonic-gate } 132*0Sstevel@tonic-gate #endif 133*0Sstevel@tonic-gate 134*0Sstevel@tonic-gate int SSL_use_certificate_ASN1(SSL *ssl, unsigned char *d, int len) 135*0Sstevel@tonic-gate { 136*0Sstevel@tonic-gate X509 *x; 137*0Sstevel@tonic-gate int ret; 138*0Sstevel@tonic-gate 139*0Sstevel@tonic-gate x=d2i_X509(NULL,&d,(long)len); 140*0Sstevel@tonic-gate if (x == NULL) 141*0Sstevel@tonic-gate { 142*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_USE_CERTIFICATE_ASN1,ERR_R_ASN1_LIB); 143*0Sstevel@tonic-gate return(0); 144*0Sstevel@tonic-gate } 145*0Sstevel@tonic-gate 146*0Sstevel@tonic-gate ret=SSL_use_certificate(ssl,x); 147*0Sstevel@tonic-gate X509_free(x); 148*0Sstevel@tonic-gate return(ret); 149*0Sstevel@tonic-gate } 150*0Sstevel@tonic-gate 151*0Sstevel@tonic-gate #ifndef OPENSSL_NO_RSA 152*0Sstevel@tonic-gate int SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa) 153*0Sstevel@tonic-gate { 154*0Sstevel@tonic-gate EVP_PKEY *pkey; 155*0Sstevel@tonic-gate int ret; 156*0Sstevel@tonic-gate 157*0Sstevel@tonic-gate if (rsa == NULL) 158*0Sstevel@tonic-gate { 159*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY,ERR_R_PASSED_NULL_PARAMETER); 160*0Sstevel@tonic-gate return(0); 161*0Sstevel@tonic-gate } 162*0Sstevel@tonic-gate if (!ssl_cert_inst(&ssl->cert)) 163*0Sstevel@tonic-gate { 164*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY,ERR_R_MALLOC_FAILURE); 165*0Sstevel@tonic-gate return(0); 166*0Sstevel@tonic-gate } 167*0Sstevel@tonic-gate if ((pkey=EVP_PKEY_new()) == NULL) 168*0Sstevel@tonic-gate { 169*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY,ERR_R_EVP_LIB); 170*0Sstevel@tonic-gate return(0); 171*0Sstevel@tonic-gate } 172*0Sstevel@tonic-gate 173*0Sstevel@tonic-gate RSA_up_ref(rsa); 174*0Sstevel@tonic-gate EVP_PKEY_assign_RSA(pkey,rsa); 175*0Sstevel@tonic-gate 176*0Sstevel@tonic-gate ret=ssl_set_pkey(ssl->cert,pkey); 177*0Sstevel@tonic-gate EVP_PKEY_free(pkey); 178*0Sstevel@tonic-gate return(ret); 179*0Sstevel@tonic-gate } 180*0Sstevel@tonic-gate #endif 181*0Sstevel@tonic-gate 182*0Sstevel@tonic-gate static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey) 183*0Sstevel@tonic-gate { 184*0Sstevel@tonic-gate int i,ok=0,bad=0; 185*0Sstevel@tonic-gate 186*0Sstevel@tonic-gate i=ssl_cert_type(NULL,pkey); 187*0Sstevel@tonic-gate if (i < 0) 188*0Sstevel@tonic-gate { 189*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_SET_PKEY,SSL_R_UNKNOWN_CERTIFICATE_TYPE); 190*0Sstevel@tonic-gate return(0); 191*0Sstevel@tonic-gate } 192*0Sstevel@tonic-gate 193*0Sstevel@tonic-gate if (c->pkeys[i].x509 != NULL) 194*0Sstevel@tonic-gate { 195*0Sstevel@tonic-gate EVP_PKEY *pktmp; 196*0Sstevel@tonic-gate pktmp = X509_get_pubkey(c->pkeys[i].x509); 197*0Sstevel@tonic-gate EVP_PKEY_copy_parameters(pktmp,pkey); 198*0Sstevel@tonic-gate EVP_PKEY_free(pktmp); 199*0Sstevel@tonic-gate ERR_clear_error(); 200*0Sstevel@tonic-gate 201*0Sstevel@tonic-gate #ifndef OPENSSL_NO_RSA 202*0Sstevel@tonic-gate /* Don't check the public/private key, this is mostly 203*0Sstevel@tonic-gate * for smart cards. */ 204*0Sstevel@tonic-gate if ((pkey->type == EVP_PKEY_RSA) && 205*0Sstevel@tonic-gate (RSA_flags(pkey->pkey.rsa) & 206*0Sstevel@tonic-gate RSA_METHOD_FLAG_NO_CHECK)) 207*0Sstevel@tonic-gate ok=1; 208*0Sstevel@tonic-gate else 209*0Sstevel@tonic-gate #endif 210*0Sstevel@tonic-gate if (!X509_check_private_key(c->pkeys[i].x509,pkey)) 211*0Sstevel@tonic-gate { 212*0Sstevel@tonic-gate if ((i == SSL_PKEY_DH_RSA) || (i == SSL_PKEY_DH_DSA)) 213*0Sstevel@tonic-gate { 214*0Sstevel@tonic-gate i=(i == SSL_PKEY_DH_RSA)? 215*0Sstevel@tonic-gate SSL_PKEY_DH_DSA:SSL_PKEY_DH_RSA; 216*0Sstevel@tonic-gate 217*0Sstevel@tonic-gate if (c->pkeys[i].x509 == NULL) 218*0Sstevel@tonic-gate ok=1; 219*0Sstevel@tonic-gate else 220*0Sstevel@tonic-gate { 221*0Sstevel@tonic-gate if (!X509_check_private_key( 222*0Sstevel@tonic-gate c->pkeys[i].x509,pkey)) 223*0Sstevel@tonic-gate bad=1; 224*0Sstevel@tonic-gate else 225*0Sstevel@tonic-gate ok=1; 226*0Sstevel@tonic-gate } 227*0Sstevel@tonic-gate } 228*0Sstevel@tonic-gate else 229*0Sstevel@tonic-gate bad=1; 230*0Sstevel@tonic-gate } 231*0Sstevel@tonic-gate else 232*0Sstevel@tonic-gate ok=1; 233*0Sstevel@tonic-gate } 234*0Sstevel@tonic-gate else 235*0Sstevel@tonic-gate ok=1; 236*0Sstevel@tonic-gate 237*0Sstevel@tonic-gate if (bad) 238*0Sstevel@tonic-gate { 239*0Sstevel@tonic-gate X509_free(c->pkeys[i].x509); 240*0Sstevel@tonic-gate c->pkeys[i].x509=NULL; 241*0Sstevel@tonic-gate return(0); 242*0Sstevel@tonic-gate } 243*0Sstevel@tonic-gate 244*0Sstevel@tonic-gate ERR_clear_error(); /* make sure no error from X509_check_private_key() 245*0Sstevel@tonic-gate * is left if we have chosen to ignore it */ 246*0Sstevel@tonic-gate if (c->pkeys[i].privatekey != NULL) 247*0Sstevel@tonic-gate EVP_PKEY_free(c->pkeys[i].privatekey); 248*0Sstevel@tonic-gate CRYPTO_add(&pkey->references,1,CRYPTO_LOCK_EVP_PKEY); 249*0Sstevel@tonic-gate c->pkeys[i].privatekey=pkey; 250*0Sstevel@tonic-gate c->key= &(c->pkeys[i]); 251*0Sstevel@tonic-gate 252*0Sstevel@tonic-gate c->valid=0; 253*0Sstevel@tonic-gate return(1); 254*0Sstevel@tonic-gate } 255*0Sstevel@tonic-gate 256*0Sstevel@tonic-gate #ifndef OPENSSL_NO_RSA 257*0Sstevel@tonic-gate #ifndef OPENSSL_NO_STDIO 258*0Sstevel@tonic-gate int SSL_use_RSAPrivateKey_file(SSL *ssl, const char *file, int type) 259*0Sstevel@tonic-gate { 260*0Sstevel@tonic-gate int j,ret=0; 261*0Sstevel@tonic-gate BIO *in; 262*0Sstevel@tonic-gate RSA *rsa=NULL; 263*0Sstevel@tonic-gate 264*0Sstevel@tonic-gate in=BIO_new(BIO_s_file_internal()); 265*0Sstevel@tonic-gate if (in == NULL) 266*0Sstevel@tonic-gate { 267*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,ERR_R_BUF_LIB); 268*0Sstevel@tonic-gate goto end; 269*0Sstevel@tonic-gate } 270*0Sstevel@tonic-gate 271*0Sstevel@tonic-gate if (BIO_read_filename(in,file) <= 0) 272*0Sstevel@tonic-gate { 273*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,ERR_R_SYS_LIB); 274*0Sstevel@tonic-gate goto end; 275*0Sstevel@tonic-gate } 276*0Sstevel@tonic-gate if (type == SSL_FILETYPE_ASN1) 277*0Sstevel@tonic-gate { 278*0Sstevel@tonic-gate j=ERR_R_ASN1_LIB; 279*0Sstevel@tonic-gate rsa=d2i_RSAPrivateKey_bio(in,NULL); 280*0Sstevel@tonic-gate } 281*0Sstevel@tonic-gate else if (type == SSL_FILETYPE_PEM) 282*0Sstevel@tonic-gate { 283*0Sstevel@tonic-gate j=ERR_R_PEM_LIB; 284*0Sstevel@tonic-gate rsa=PEM_read_bio_RSAPrivateKey(in,NULL, 285*0Sstevel@tonic-gate ssl->ctx->default_passwd_callback,ssl->ctx->default_passwd_callback_userdata); 286*0Sstevel@tonic-gate } 287*0Sstevel@tonic-gate else 288*0Sstevel@tonic-gate { 289*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE); 290*0Sstevel@tonic-gate goto end; 291*0Sstevel@tonic-gate } 292*0Sstevel@tonic-gate if (rsa == NULL) 293*0Sstevel@tonic-gate { 294*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,j); 295*0Sstevel@tonic-gate goto end; 296*0Sstevel@tonic-gate } 297*0Sstevel@tonic-gate ret=SSL_use_RSAPrivateKey(ssl,rsa); 298*0Sstevel@tonic-gate RSA_free(rsa); 299*0Sstevel@tonic-gate end: 300*0Sstevel@tonic-gate if (in != NULL) BIO_free(in); 301*0Sstevel@tonic-gate return(ret); 302*0Sstevel@tonic-gate } 303*0Sstevel@tonic-gate #endif 304*0Sstevel@tonic-gate 305*0Sstevel@tonic-gate int SSL_use_RSAPrivateKey_ASN1(SSL *ssl, unsigned char *d, long len) 306*0Sstevel@tonic-gate { 307*0Sstevel@tonic-gate int ret; 308*0Sstevel@tonic-gate const unsigned char *p; 309*0Sstevel@tonic-gate RSA *rsa; 310*0Sstevel@tonic-gate 311*0Sstevel@tonic-gate p=d; 312*0Sstevel@tonic-gate if ((rsa=d2i_RSAPrivateKey(NULL,&p,(long)len)) == NULL) 313*0Sstevel@tonic-gate { 314*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1,ERR_R_ASN1_LIB); 315*0Sstevel@tonic-gate return(0); 316*0Sstevel@tonic-gate } 317*0Sstevel@tonic-gate 318*0Sstevel@tonic-gate ret=SSL_use_RSAPrivateKey(ssl,rsa); 319*0Sstevel@tonic-gate RSA_free(rsa); 320*0Sstevel@tonic-gate return(ret); 321*0Sstevel@tonic-gate } 322*0Sstevel@tonic-gate #endif /* !OPENSSL_NO_RSA */ 323*0Sstevel@tonic-gate 324*0Sstevel@tonic-gate int SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey) 325*0Sstevel@tonic-gate { 326*0Sstevel@tonic-gate int ret; 327*0Sstevel@tonic-gate 328*0Sstevel@tonic-gate if (pkey == NULL) 329*0Sstevel@tonic-gate { 330*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_USE_PRIVATEKEY,ERR_R_PASSED_NULL_PARAMETER); 331*0Sstevel@tonic-gate return(0); 332*0Sstevel@tonic-gate } 333*0Sstevel@tonic-gate if (!ssl_cert_inst(&ssl->cert)) 334*0Sstevel@tonic-gate { 335*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_USE_PRIVATEKEY,ERR_R_MALLOC_FAILURE); 336*0Sstevel@tonic-gate return(0); 337*0Sstevel@tonic-gate } 338*0Sstevel@tonic-gate ret=ssl_set_pkey(ssl->cert,pkey); 339*0Sstevel@tonic-gate return(ret); 340*0Sstevel@tonic-gate } 341*0Sstevel@tonic-gate 342*0Sstevel@tonic-gate #ifndef OPENSSL_NO_STDIO 343*0Sstevel@tonic-gate int SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type) 344*0Sstevel@tonic-gate { 345*0Sstevel@tonic-gate int j,ret=0; 346*0Sstevel@tonic-gate BIO *in; 347*0Sstevel@tonic-gate EVP_PKEY *pkey=NULL; 348*0Sstevel@tonic-gate 349*0Sstevel@tonic-gate in=BIO_new(BIO_s_file_internal()); 350*0Sstevel@tonic-gate if (in == NULL) 351*0Sstevel@tonic-gate { 352*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,ERR_R_BUF_LIB); 353*0Sstevel@tonic-gate goto end; 354*0Sstevel@tonic-gate } 355*0Sstevel@tonic-gate 356*0Sstevel@tonic-gate if (BIO_read_filename(in,file) <= 0) 357*0Sstevel@tonic-gate { 358*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,ERR_R_SYS_LIB); 359*0Sstevel@tonic-gate goto end; 360*0Sstevel@tonic-gate } 361*0Sstevel@tonic-gate if (type == SSL_FILETYPE_PEM) 362*0Sstevel@tonic-gate { 363*0Sstevel@tonic-gate j=ERR_R_PEM_LIB; 364*0Sstevel@tonic-gate pkey=PEM_read_bio_PrivateKey(in,NULL, 365*0Sstevel@tonic-gate ssl->ctx->default_passwd_callback,ssl->ctx->default_passwd_callback_userdata); 366*0Sstevel@tonic-gate } 367*0Sstevel@tonic-gate else 368*0Sstevel@tonic-gate { 369*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE); 370*0Sstevel@tonic-gate goto end; 371*0Sstevel@tonic-gate } 372*0Sstevel@tonic-gate if (pkey == NULL) 373*0Sstevel@tonic-gate { 374*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,j); 375*0Sstevel@tonic-gate goto end; 376*0Sstevel@tonic-gate } 377*0Sstevel@tonic-gate ret=SSL_use_PrivateKey(ssl,pkey); 378*0Sstevel@tonic-gate EVP_PKEY_free(pkey); 379*0Sstevel@tonic-gate end: 380*0Sstevel@tonic-gate if (in != NULL) BIO_free(in); 381*0Sstevel@tonic-gate return(ret); 382*0Sstevel@tonic-gate } 383*0Sstevel@tonic-gate #endif 384*0Sstevel@tonic-gate 385*0Sstevel@tonic-gate int SSL_use_PrivateKey_ASN1(int type, SSL *ssl, unsigned char *d, long len) 386*0Sstevel@tonic-gate { 387*0Sstevel@tonic-gate int ret; 388*0Sstevel@tonic-gate unsigned char *p; 389*0Sstevel@tonic-gate EVP_PKEY *pkey; 390*0Sstevel@tonic-gate 391*0Sstevel@tonic-gate p=d; 392*0Sstevel@tonic-gate if ((pkey=d2i_PrivateKey(type,NULL,&p,(long)len)) == NULL) 393*0Sstevel@tonic-gate { 394*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_USE_PRIVATEKEY_ASN1,ERR_R_ASN1_LIB); 395*0Sstevel@tonic-gate return(0); 396*0Sstevel@tonic-gate } 397*0Sstevel@tonic-gate 398*0Sstevel@tonic-gate ret=SSL_use_PrivateKey(ssl,pkey); 399*0Sstevel@tonic-gate EVP_PKEY_free(pkey); 400*0Sstevel@tonic-gate return(ret); 401*0Sstevel@tonic-gate } 402*0Sstevel@tonic-gate 403*0Sstevel@tonic-gate int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x) 404*0Sstevel@tonic-gate { 405*0Sstevel@tonic-gate if (x == NULL) 406*0Sstevel@tonic-gate { 407*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE,ERR_R_PASSED_NULL_PARAMETER); 408*0Sstevel@tonic-gate return(0); 409*0Sstevel@tonic-gate } 410*0Sstevel@tonic-gate if (!ssl_cert_inst(&ctx->cert)) 411*0Sstevel@tonic-gate { 412*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE,ERR_R_MALLOC_FAILURE); 413*0Sstevel@tonic-gate return(0); 414*0Sstevel@tonic-gate } 415*0Sstevel@tonic-gate return(ssl_set_cert(ctx->cert, x)); 416*0Sstevel@tonic-gate } 417*0Sstevel@tonic-gate 418*0Sstevel@tonic-gate static int ssl_set_cert(CERT *c, X509 *x) 419*0Sstevel@tonic-gate { 420*0Sstevel@tonic-gate EVP_PKEY *pkey; 421*0Sstevel@tonic-gate int i,ok=0,bad=0; 422*0Sstevel@tonic-gate 423*0Sstevel@tonic-gate pkey=X509_get_pubkey(x); 424*0Sstevel@tonic-gate if (pkey == NULL) 425*0Sstevel@tonic-gate { 426*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_SET_CERT,SSL_R_X509_LIB); 427*0Sstevel@tonic-gate return(0); 428*0Sstevel@tonic-gate } 429*0Sstevel@tonic-gate 430*0Sstevel@tonic-gate i=ssl_cert_type(x,pkey); 431*0Sstevel@tonic-gate if (i < 0) 432*0Sstevel@tonic-gate { 433*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_SET_CERT,SSL_R_UNKNOWN_CERTIFICATE_TYPE); 434*0Sstevel@tonic-gate EVP_PKEY_free(pkey); 435*0Sstevel@tonic-gate return(0); 436*0Sstevel@tonic-gate } 437*0Sstevel@tonic-gate 438*0Sstevel@tonic-gate if (c->pkeys[i].privatekey != NULL) 439*0Sstevel@tonic-gate { 440*0Sstevel@tonic-gate EVP_PKEY_copy_parameters(pkey,c->pkeys[i].privatekey); 441*0Sstevel@tonic-gate ERR_clear_error(); 442*0Sstevel@tonic-gate 443*0Sstevel@tonic-gate #ifndef OPENSSL_NO_RSA 444*0Sstevel@tonic-gate /* Don't check the public/private key, this is mostly 445*0Sstevel@tonic-gate * for smart cards. */ 446*0Sstevel@tonic-gate if ((c->pkeys[i].privatekey->type == EVP_PKEY_RSA) && 447*0Sstevel@tonic-gate (RSA_flags(c->pkeys[i].privatekey->pkey.rsa) & 448*0Sstevel@tonic-gate RSA_METHOD_FLAG_NO_CHECK)) 449*0Sstevel@tonic-gate ok=1; 450*0Sstevel@tonic-gate else 451*0Sstevel@tonic-gate #endif 452*0Sstevel@tonic-gate { 453*0Sstevel@tonic-gate if (!X509_check_private_key(x,c->pkeys[i].privatekey)) 454*0Sstevel@tonic-gate { 455*0Sstevel@tonic-gate if ((i == SSL_PKEY_DH_RSA) || (i == SSL_PKEY_DH_DSA)) 456*0Sstevel@tonic-gate { 457*0Sstevel@tonic-gate i=(i == SSL_PKEY_DH_RSA)? 458*0Sstevel@tonic-gate SSL_PKEY_DH_DSA:SSL_PKEY_DH_RSA; 459*0Sstevel@tonic-gate 460*0Sstevel@tonic-gate if (c->pkeys[i].privatekey == NULL) 461*0Sstevel@tonic-gate ok=1; 462*0Sstevel@tonic-gate else 463*0Sstevel@tonic-gate { 464*0Sstevel@tonic-gate if (!X509_check_private_key(x, 465*0Sstevel@tonic-gate c->pkeys[i].privatekey)) 466*0Sstevel@tonic-gate bad=1; 467*0Sstevel@tonic-gate else 468*0Sstevel@tonic-gate ok=1; 469*0Sstevel@tonic-gate } 470*0Sstevel@tonic-gate } 471*0Sstevel@tonic-gate else 472*0Sstevel@tonic-gate bad=1; 473*0Sstevel@tonic-gate } 474*0Sstevel@tonic-gate else 475*0Sstevel@tonic-gate ok=1; 476*0Sstevel@tonic-gate } /* OPENSSL_NO_RSA */ 477*0Sstevel@tonic-gate } 478*0Sstevel@tonic-gate else 479*0Sstevel@tonic-gate ok=1; 480*0Sstevel@tonic-gate 481*0Sstevel@tonic-gate EVP_PKEY_free(pkey); 482*0Sstevel@tonic-gate if (bad) 483*0Sstevel@tonic-gate { 484*0Sstevel@tonic-gate EVP_PKEY_free(c->pkeys[i].privatekey); 485*0Sstevel@tonic-gate c->pkeys[i].privatekey=NULL; 486*0Sstevel@tonic-gate } 487*0Sstevel@tonic-gate 488*0Sstevel@tonic-gate if (c->pkeys[i].x509 != NULL) 489*0Sstevel@tonic-gate X509_free(c->pkeys[i].x509); 490*0Sstevel@tonic-gate CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509); 491*0Sstevel@tonic-gate c->pkeys[i].x509=x; 492*0Sstevel@tonic-gate c->key= &(c->pkeys[i]); 493*0Sstevel@tonic-gate 494*0Sstevel@tonic-gate c->valid=0; 495*0Sstevel@tonic-gate return(1); 496*0Sstevel@tonic-gate } 497*0Sstevel@tonic-gate 498*0Sstevel@tonic-gate #ifndef OPENSSL_NO_STDIO 499*0Sstevel@tonic-gate int SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type) 500*0Sstevel@tonic-gate { 501*0Sstevel@tonic-gate int j; 502*0Sstevel@tonic-gate BIO *in; 503*0Sstevel@tonic-gate int ret=0; 504*0Sstevel@tonic-gate X509 *x=NULL; 505*0Sstevel@tonic-gate 506*0Sstevel@tonic-gate in=BIO_new(BIO_s_file_internal()); 507*0Sstevel@tonic-gate if (in == NULL) 508*0Sstevel@tonic-gate { 509*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,ERR_R_BUF_LIB); 510*0Sstevel@tonic-gate goto end; 511*0Sstevel@tonic-gate } 512*0Sstevel@tonic-gate 513*0Sstevel@tonic-gate if (BIO_read_filename(in,file) <= 0) 514*0Sstevel@tonic-gate { 515*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,ERR_R_SYS_LIB); 516*0Sstevel@tonic-gate goto end; 517*0Sstevel@tonic-gate } 518*0Sstevel@tonic-gate if (type == SSL_FILETYPE_ASN1) 519*0Sstevel@tonic-gate { 520*0Sstevel@tonic-gate j=ERR_R_ASN1_LIB; 521*0Sstevel@tonic-gate x=d2i_X509_bio(in,NULL); 522*0Sstevel@tonic-gate } 523*0Sstevel@tonic-gate else if (type == SSL_FILETYPE_PEM) 524*0Sstevel@tonic-gate { 525*0Sstevel@tonic-gate j=ERR_R_PEM_LIB; 526*0Sstevel@tonic-gate x=PEM_read_bio_X509(in,NULL,ctx->default_passwd_callback,ctx->default_passwd_callback_userdata); 527*0Sstevel@tonic-gate } 528*0Sstevel@tonic-gate else 529*0Sstevel@tonic-gate { 530*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,SSL_R_BAD_SSL_FILETYPE); 531*0Sstevel@tonic-gate goto end; 532*0Sstevel@tonic-gate } 533*0Sstevel@tonic-gate 534*0Sstevel@tonic-gate if (x == NULL) 535*0Sstevel@tonic-gate { 536*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,j); 537*0Sstevel@tonic-gate goto end; 538*0Sstevel@tonic-gate } 539*0Sstevel@tonic-gate 540*0Sstevel@tonic-gate ret=SSL_CTX_use_certificate(ctx,x); 541*0Sstevel@tonic-gate end: 542*0Sstevel@tonic-gate if (x != NULL) X509_free(x); 543*0Sstevel@tonic-gate if (in != NULL) BIO_free(in); 544*0Sstevel@tonic-gate return(ret); 545*0Sstevel@tonic-gate } 546*0Sstevel@tonic-gate #endif 547*0Sstevel@tonic-gate 548*0Sstevel@tonic-gate int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, unsigned char *d) 549*0Sstevel@tonic-gate { 550*0Sstevel@tonic-gate X509 *x; 551*0Sstevel@tonic-gate int ret; 552*0Sstevel@tonic-gate 553*0Sstevel@tonic-gate x=d2i_X509(NULL,&d,(long)len); 554*0Sstevel@tonic-gate if (x == NULL) 555*0Sstevel@tonic-gate { 556*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1,ERR_R_ASN1_LIB); 557*0Sstevel@tonic-gate return(0); 558*0Sstevel@tonic-gate } 559*0Sstevel@tonic-gate 560*0Sstevel@tonic-gate ret=SSL_CTX_use_certificate(ctx,x); 561*0Sstevel@tonic-gate X509_free(x); 562*0Sstevel@tonic-gate return(ret); 563*0Sstevel@tonic-gate } 564*0Sstevel@tonic-gate 565*0Sstevel@tonic-gate #ifndef OPENSSL_NO_RSA 566*0Sstevel@tonic-gate int SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa) 567*0Sstevel@tonic-gate { 568*0Sstevel@tonic-gate int ret; 569*0Sstevel@tonic-gate EVP_PKEY *pkey; 570*0Sstevel@tonic-gate 571*0Sstevel@tonic-gate if (rsa == NULL) 572*0Sstevel@tonic-gate { 573*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY,ERR_R_PASSED_NULL_PARAMETER); 574*0Sstevel@tonic-gate return(0); 575*0Sstevel@tonic-gate } 576*0Sstevel@tonic-gate if (!ssl_cert_inst(&ctx->cert)) 577*0Sstevel@tonic-gate { 578*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY,ERR_R_MALLOC_FAILURE); 579*0Sstevel@tonic-gate return(0); 580*0Sstevel@tonic-gate } 581*0Sstevel@tonic-gate if ((pkey=EVP_PKEY_new()) == NULL) 582*0Sstevel@tonic-gate { 583*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY,ERR_R_EVP_LIB); 584*0Sstevel@tonic-gate return(0); 585*0Sstevel@tonic-gate } 586*0Sstevel@tonic-gate 587*0Sstevel@tonic-gate RSA_up_ref(rsa); 588*0Sstevel@tonic-gate EVP_PKEY_assign_RSA(pkey,rsa); 589*0Sstevel@tonic-gate 590*0Sstevel@tonic-gate ret=ssl_set_pkey(ctx->cert, pkey); 591*0Sstevel@tonic-gate EVP_PKEY_free(pkey); 592*0Sstevel@tonic-gate return(ret); 593*0Sstevel@tonic-gate } 594*0Sstevel@tonic-gate 595*0Sstevel@tonic-gate #ifndef OPENSSL_NO_STDIO 596*0Sstevel@tonic-gate int SSL_CTX_use_RSAPrivateKey_file(SSL_CTX *ctx, const char *file, int type) 597*0Sstevel@tonic-gate { 598*0Sstevel@tonic-gate int j,ret=0; 599*0Sstevel@tonic-gate BIO *in; 600*0Sstevel@tonic-gate RSA *rsa=NULL; 601*0Sstevel@tonic-gate 602*0Sstevel@tonic-gate in=BIO_new(BIO_s_file_internal()); 603*0Sstevel@tonic-gate if (in == NULL) 604*0Sstevel@tonic-gate { 605*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,ERR_R_BUF_LIB); 606*0Sstevel@tonic-gate goto end; 607*0Sstevel@tonic-gate } 608*0Sstevel@tonic-gate 609*0Sstevel@tonic-gate if (BIO_read_filename(in,file) <= 0) 610*0Sstevel@tonic-gate { 611*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,ERR_R_SYS_LIB); 612*0Sstevel@tonic-gate goto end; 613*0Sstevel@tonic-gate } 614*0Sstevel@tonic-gate if (type == SSL_FILETYPE_ASN1) 615*0Sstevel@tonic-gate { 616*0Sstevel@tonic-gate j=ERR_R_ASN1_LIB; 617*0Sstevel@tonic-gate rsa=d2i_RSAPrivateKey_bio(in,NULL); 618*0Sstevel@tonic-gate } 619*0Sstevel@tonic-gate else if (type == SSL_FILETYPE_PEM) 620*0Sstevel@tonic-gate { 621*0Sstevel@tonic-gate j=ERR_R_PEM_LIB; 622*0Sstevel@tonic-gate rsa=PEM_read_bio_RSAPrivateKey(in,NULL, 623*0Sstevel@tonic-gate ctx->default_passwd_callback,ctx->default_passwd_callback_userdata); 624*0Sstevel@tonic-gate } 625*0Sstevel@tonic-gate else 626*0Sstevel@tonic-gate { 627*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE); 628*0Sstevel@tonic-gate goto end; 629*0Sstevel@tonic-gate } 630*0Sstevel@tonic-gate if (rsa == NULL) 631*0Sstevel@tonic-gate { 632*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,j); 633*0Sstevel@tonic-gate goto end; 634*0Sstevel@tonic-gate } 635*0Sstevel@tonic-gate ret=SSL_CTX_use_RSAPrivateKey(ctx,rsa); 636*0Sstevel@tonic-gate RSA_free(rsa); 637*0Sstevel@tonic-gate end: 638*0Sstevel@tonic-gate if (in != NULL) BIO_free(in); 639*0Sstevel@tonic-gate return(ret); 640*0Sstevel@tonic-gate } 641*0Sstevel@tonic-gate #endif 642*0Sstevel@tonic-gate 643*0Sstevel@tonic-gate int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, unsigned char *d, long len) 644*0Sstevel@tonic-gate { 645*0Sstevel@tonic-gate int ret; 646*0Sstevel@tonic-gate const unsigned char *p; 647*0Sstevel@tonic-gate RSA *rsa; 648*0Sstevel@tonic-gate 649*0Sstevel@tonic-gate p=d; 650*0Sstevel@tonic-gate if ((rsa=d2i_RSAPrivateKey(NULL,&p,(long)len)) == NULL) 651*0Sstevel@tonic-gate { 652*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1,ERR_R_ASN1_LIB); 653*0Sstevel@tonic-gate return(0); 654*0Sstevel@tonic-gate } 655*0Sstevel@tonic-gate 656*0Sstevel@tonic-gate ret=SSL_CTX_use_RSAPrivateKey(ctx,rsa); 657*0Sstevel@tonic-gate RSA_free(rsa); 658*0Sstevel@tonic-gate return(ret); 659*0Sstevel@tonic-gate } 660*0Sstevel@tonic-gate #endif /* !OPENSSL_NO_RSA */ 661*0Sstevel@tonic-gate 662*0Sstevel@tonic-gate int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey) 663*0Sstevel@tonic-gate { 664*0Sstevel@tonic-gate if (pkey == NULL) 665*0Sstevel@tonic-gate { 666*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY,ERR_R_PASSED_NULL_PARAMETER); 667*0Sstevel@tonic-gate return(0); 668*0Sstevel@tonic-gate } 669*0Sstevel@tonic-gate if (!ssl_cert_inst(&ctx->cert)) 670*0Sstevel@tonic-gate { 671*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY,ERR_R_MALLOC_FAILURE); 672*0Sstevel@tonic-gate return(0); 673*0Sstevel@tonic-gate } 674*0Sstevel@tonic-gate return(ssl_set_pkey(ctx->cert,pkey)); 675*0Sstevel@tonic-gate } 676*0Sstevel@tonic-gate 677*0Sstevel@tonic-gate #ifndef OPENSSL_NO_STDIO 678*0Sstevel@tonic-gate int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type) 679*0Sstevel@tonic-gate { 680*0Sstevel@tonic-gate int j,ret=0; 681*0Sstevel@tonic-gate BIO *in; 682*0Sstevel@tonic-gate EVP_PKEY *pkey=NULL; 683*0Sstevel@tonic-gate 684*0Sstevel@tonic-gate in=BIO_new(BIO_s_file_internal()); 685*0Sstevel@tonic-gate if (in == NULL) 686*0Sstevel@tonic-gate { 687*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,ERR_R_BUF_LIB); 688*0Sstevel@tonic-gate goto end; 689*0Sstevel@tonic-gate } 690*0Sstevel@tonic-gate 691*0Sstevel@tonic-gate if (BIO_read_filename(in,file) <= 0) 692*0Sstevel@tonic-gate { 693*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,ERR_R_SYS_LIB); 694*0Sstevel@tonic-gate goto end; 695*0Sstevel@tonic-gate } 696*0Sstevel@tonic-gate if (type == SSL_FILETYPE_PEM) 697*0Sstevel@tonic-gate { 698*0Sstevel@tonic-gate j=ERR_R_PEM_LIB; 699*0Sstevel@tonic-gate pkey=PEM_read_bio_PrivateKey(in,NULL, 700*0Sstevel@tonic-gate ctx->default_passwd_callback,ctx->default_passwd_callback_userdata); 701*0Sstevel@tonic-gate } 702*0Sstevel@tonic-gate else 703*0Sstevel@tonic-gate { 704*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE); 705*0Sstevel@tonic-gate goto end; 706*0Sstevel@tonic-gate } 707*0Sstevel@tonic-gate if (pkey == NULL) 708*0Sstevel@tonic-gate { 709*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,j); 710*0Sstevel@tonic-gate goto end; 711*0Sstevel@tonic-gate } 712*0Sstevel@tonic-gate ret=SSL_CTX_use_PrivateKey(ctx,pkey); 713*0Sstevel@tonic-gate EVP_PKEY_free(pkey); 714*0Sstevel@tonic-gate end: 715*0Sstevel@tonic-gate if (in != NULL) BIO_free(in); 716*0Sstevel@tonic-gate return(ret); 717*0Sstevel@tonic-gate } 718*0Sstevel@tonic-gate #endif 719*0Sstevel@tonic-gate 720*0Sstevel@tonic-gate int SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx, unsigned char *d, 721*0Sstevel@tonic-gate long len) 722*0Sstevel@tonic-gate { 723*0Sstevel@tonic-gate int ret; 724*0Sstevel@tonic-gate unsigned char *p; 725*0Sstevel@tonic-gate EVP_PKEY *pkey; 726*0Sstevel@tonic-gate 727*0Sstevel@tonic-gate p=d; 728*0Sstevel@tonic-gate if ((pkey=d2i_PrivateKey(type,NULL,&p,(long)len)) == NULL) 729*0Sstevel@tonic-gate { 730*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1,ERR_R_ASN1_LIB); 731*0Sstevel@tonic-gate return(0); 732*0Sstevel@tonic-gate } 733*0Sstevel@tonic-gate 734*0Sstevel@tonic-gate ret=SSL_CTX_use_PrivateKey(ctx,pkey); 735*0Sstevel@tonic-gate EVP_PKEY_free(pkey); 736*0Sstevel@tonic-gate return(ret); 737*0Sstevel@tonic-gate } 738*0Sstevel@tonic-gate 739*0Sstevel@tonic-gate 740*0Sstevel@tonic-gate #ifndef OPENSSL_NO_STDIO 741*0Sstevel@tonic-gate /* Read a file that contains our certificate in "PEM" format, 742*0Sstevel@tonic-gate * possibly followed by a sequence of CA certificates that should be 743*0Sstevel@tonic-gate * sent to the peer in the Certificate message. 744*0Sstevel@tonic-gate */ 745*0Sstevel@tonic-gate int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file) 746*0Sstevel@tonic-gate { 747*0Sstevel@tonic-gate BIO *in; 748*0Sstevel@tonic-gate int ret=0; 749*0Sstevel@tonic-gate X509 *x=NULL; 750*0Sstevel@tonic-gate 751*0Sstevel@tonic-gate in=BIO_new(BIO_s_file_internal()); 752*0Sstevel@tonic-gate if (in == NULL) 753*0Sstevel@tonic-gate { 754*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE,ERR_R_BUF_LIB); 755*0Sstevel@tonic-gate goto end; 756*0Sstevel@tonic-gate } 757*0Sstevel@tonic-gate 758*0Sstevel@tonic-gate if (BIO_read_filename(in,file) <= 0) 759*0Sstevel@tonic-gate { 760*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE,ERR_R_SYS_LIB); 761*0Sstevel@tonic-gate goto end; 762*0Sstevel@tonic-gate } 763*0Sstevel@tonic-gate 764*0Sstevel@tonic-gate x=PEM_read_bio_X509(in,NULL,ctx->default_passwd_callback,ctx->default_passwd_callback_userdata); 765*0Sstevel@tonic-gate if (x == NULL) 766*0Sstevel@tonic-gate { 767*0Sstevel@tonic-gate SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE,ERR_R_PEM_LIB); 768*0Sstevel@tonic-gate goto end; 769*0Sstevel@tonic-gate } 770*0Sstevel@tonic-gate 771*0Sstevel@tonic-gate ret=SSL_CTX_use_certificate(ctx,x); 772*0Sstevel@tonic-gate if (ERR_peek_error() != 0) 773*0Sstevel@tonic-gate ret = 0; /* Key/certificate mismatch doesn't imply ret==0 ... */ 774*0Sstevel@tonic-gate if (ret) 775*0Sstevel@tonic-gate { 776*0Sstevel@tonic-gate /* If we could set up our certificate, now proceed to 777*0Sstevel@tonic-gate * the CA certificates. 778*0Sstevel@tonic-gate */ 779*0Sstevel@tonic-gate X509 *ca; 780*0Sstevel@tonic-gate int r; 781*0Sstevel@tonic-gate unsigned long err; 782*0Sstevel@tonic-gate 783*0Sstevel@tonic-gate if (ctx->extra_certs != NULL) 784*0Sstevel@tonic-gate { 785*0Sstevel@tonic-gate sk_X509_pop_free(ctx->extra_certs, X509_free); 786*0Sstevel@tonic-gate ctx->extra_certs = NULL; 787*0Sstevel@tonic-gate } 788*0Sstevel@tonic-gate 789*0Sstevel@tonic-gate while ((ca = PEM_read_bio_X509(in,NULL,ctx->default_passwd_callback,ctx->default_passwd_callback_userdata)) 790*0Sstevel@tonic-gate != NULL) 791*0Sstevel@tonic-gate { 792*0Sstevel@tonic-gate r = SSL_CTX_add_extra_chain_cert(ctx, ca); 793*0Sstevel@tonic-gate if (!r) 794*0Sstevel@tonic-gate { 795*0Sstevel@tonic-gate X509_free(ca); 796*0Sstevel@tonic-gate ret = 0; 797*0Sstevel@tonic-gate goto end; 798*0Sstevel@tonic-gate } 799*0Sstevel@tonic-gate /* Note that we must not free r if it was successfully 800*0Sstevel@tonic-gate * added to the chain (while we must free the main 801*0Sstevel@tonic-gate * certificate, since its reference count is increased 802*0Sstevel@tonic-gate * by SSL_CTX_use_certificate). */ 803*0Sstevel@tonic-gate } 804*0Sstevel@tonic-gate /* When the while loop ends, it's usually just EOF. */ 805*0Sstevel@tonic-gate err = ERR_peek_last_error(); 806*0Sstevel@tonic-gate if (ERR_GET_LIB(err) == ERR_LIB_PEM && ERR_GET_REASON(err) == PEM_R_NO_START_LINE) 807*0Sstevel@tonic-gate (void)ERR_get_error(); 808*0Sstevel@tonic-gate else 809*0Sstevel@tonic-gate ret = 0; /* some real error */ 810*0Sstevel@tonic-gate } 811*0Sstevel@tonic-gate 812*0Sstevel@tonic-gate end: 813*0Sstevel@tonic-gate if (x != NULL) X509_free(x); 814*0Sstevel@tonic-gate if (in != NULL) BIO_free(in); 815*0Sstevel@tonic-gate return(ret); 816*0Sstevel@tonic-gate } 817*0Sstevel@tonic-gate #endif 818