1*0Sstevel@tonic-gate /*
2*0Sstevel@tonic-gate * CDDL HEADER START
3*0Sstevel@tonic-gate *
4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the
5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only
6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance
7*0Sstevel@tonic-gate * with the License.
8*0Sstevel@tonic-gate *
9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
11*0Sstevel@tonic-gate * See the License for the specific language governing permissions
12*0Sstevel@tonic-gate * and limitations under the License.
13*0Sstevel@tonic-gate *
14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
19*0Sstevel@tonic-gate *
20*0Sstevel@tonic-gate * CDDL HEADER END
21*0Sstevel@tonic-gate */
22*0Sstevel@tonic-gate /*
23*0Sstevel@tonic-gate * This file includes interfaces to be used together with SSL to get PKCS#12
24*0Sstevel@tonic-gate * certs and pass them to SSL. They replace similar functions for PEM,
25*0Sstevel@tonic-gate * already provided for within SSL.
26*0Sstevel@tonic-gate *
27*0Sstevel@tonic-gate * The interfaces included here are:
28*0Sstevel@tonic-gate * sunw_p12_use_certfile - gets the user's cert from a pkcs12 file & pass
29*0Sstevel@tonic-gate * it to SSL.
30*0Sstevel@tonic-gate * sunw_p12_use_keyfile - gets the RSA private key from a pkcs12 file and
31*0Sstevel@tonic-gate * pass it to SSL
32*0Sstevel@tonic-gate * sunw_p12_use_trustfile - read the pkcs12 trust anchor (aka certificate
33*0Sstevel@tonic-gate * authority certs) file into memory and hand them off to SSL.
34*0Sstevel@tonic-gate *
35*0Sstevel@tonic-gate * These functions use the sunw_PKCS12_parse to read the certs.
36*0Sstevel@tonic-gate *
37*0Sstevel@tonic-gate * Copyright 2002-2003 Sun Microsystems, Inc. All rights reserved.
38*0Sstevel@tonic-gate * Use is subject to license terms.
39*0Sstevel@tonic-gate */
40*0Sstevel@tonic-gate
41*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI"
42*0Sstevel@tonic-gate
43*0Sstevel@tonic-gate #include <stdio.h>
44*0Sstevel@tonic-gate #include <strings.h>
45*0Sstevel@tonic-gate #include <stdlib.h>
46*0Sstevel@tonic-gate #include <sys/stat.h>
47*0Sstevel@tonic-gate #include <unistd.h>
48*0Sstevel@tonic-gate
49*0Sstevel@tonic-gate #include <openssl/crypto.h>
50*0Sstevel@tonic-gate #include <openssl/err.h>
51*0Sstevel@tonic-gate #include <openssl/x509.h>
52*0Sstevel@tonic-gate #include <openssl/ssl.h>
53*0Sstevel@tonic-gate
54*0Sstevel@tonic-gate #include <openssl/pkcs12.h>
55*0Sstevel@tonic-gate #include <p12access.h>
56*0Sstevel@tonic-gate #include <p12err.h>
57*0Sstevel@tonic-gate
58*0Sstevel@tonic-gate static PKCS12 *p12_read_file(char *);
59*0Sstevel@tonic-gate static int p12_doparse(PKCS12 *, char *, int, EVP_PKEY **,
60*0Sstevel@tonic-gate X509 **, STACK_OF(X509) **);
61*0Sstevel@tonic-gate static int checkfile(char *);
62*0Sstevel@tonic-gate static int check_password(PKCS12 *, char *);
63*0Sstevel@tonic-gate
64*0Sstevel@tonic-gate /*
65*0Sstevel@tonic-gate * sunw_use_x509cert - pass an x509 client certificate to ssl
66*0Sstevel@tonic-gate *
67*0Sstevel@tonic-gate * Arguments:
68*0Sstevel@tonic-gate * ctx - SSL's context structure
69*0Sstevel@tonic-gate * cert - Certificate to pass in x509 format
70*0Sstevel@tonic-gate *
71*0Sstevel@tonic-gate * Returns:
72*0Sstevel@tonic-gate * <=0 - Error occurred. Check the error stack for specifics.
73*0Sstevel@tonic-gate * >0 - Success. Cert was successfully added.
74*0Sstevel@tonic-gate */
75*0Sstevel@tonic-gate static int
sunw_use_x509cert(SSL_CTX * ctx,X509 * cert)76*0Sstevel@tonic-gate sunw_use_x509cert(SSL_CTX *ctx, X509 *cert)
77*0Sstevel@tonic-gate {
78*0Sstevel@tonic-gate ERR_clear_error();
79*0Sstevel@tonic-gate
80*0Sstevel@tonic-gate if (ctx == NULL || cert == NULL) {
81*0Sstevel@tonic-gate SUNWerr(SUNW_F_USE_X509CERT, SUNW_R_INVALID_ARG);
82*0Sstevel@tonic-gate return (-1);
83*0Sstevel@tonic-gate }
84*0Sstevel@tonic-gate
85*0Sstevel@tonic-gate if (SSL_CTX_use_certificate(ctx, cert) != 1) {
86*0Sstevel@tonic-gate SUNWerr(SUNW_F_USE_X509CERT, SUNW_R_CERT_ERR);
87*0Sstevel@tonic-gate return (-1);
88*0Sstevel@tonic-gate }
89*0Sstevel@tonic-gate return (1);
90*0Sstevel@tonic-gate }
91*0Sstevel@tonic-gate
92*0Sstevel@tonic-gate /*
93*0Sstevel@tonic-gate * sunw_use_pkey - pass an EVP_PKEY private key to ssl
94*0Sstevel@tonic-gate *
95*0Sstevel@tonic-gate * Arguments:
96*0Sstevel@tonic-gate * ctx - SSL's context structure
97*0Sstevel@tonic-gate * pkey - EVP_PKEY formatted private key
98*0Sstevel@tonic-gate *
99*0Sstevel@tonic-gate * Returns:
100*0Sstevel@tonic-gate * <=0 - Error occurred. Check the error stack for specifics.
101*0Sstevel@tonic-gate * >0 - Success.
102*0Sstevel@tonic-gate */
103*0Sstevel@tonic-gate static int
sunw_use_pkey(SSL_CTX * ctx,EVP_PKEY * pkey)104*0Sstevel@tonic-gate sunw_use_pkey(SSL_CTX *ctx, EVP_PKEY *pkey)
105*0Sstevel@tonic-gate {
106*0Sstevel@tonic-gate ERR_clear_error();
107*0Sstevel@tonic-gate if (ctx == NULL || pkey == NULL) {
108*0Sstevel@tonic-gate SUNWerr(SUNW_F_USE_PKEY, SUNW_R_INVALID_ARG);
109*0Sstevel@tonic-gate return (-1);
110*0Sstevel@tonic-gate }
111*0Sstevel@tonic-gate
112*0Sstevel@tonic-gate if (SSL_CTX_use_PrivateKey(ctx, pkey) != 1) {
113*0Sstevel@tonic-gate SUNWerr(SUNW_F_USE_PKEY, SUNW_R_PKEY_ERR);
114*0Sstevel@tonic-gate return (-1);
115*0Sstevel@tonic-gate }
116*0Sstevel@tonic-gate
117*0Sstevel@tonic-gate return (1);
118*0Sstevel@tonic-gate }
119*0Sstevel@tonic-gate
120*0Sstevel@tonic-gate /*
121*0Sstevel@tonic-gate * sunw_use_tastore - take a stack of X509 certs and add them to the
122*0Sstevel@tonic-gate * SSL store of trust anchors (aka CA certs).
123*0Sstevel@tonic-gate *
124*0Sstevel@tonic-gate * This function takes the certs in the stack and passes them into
125*0Sstevel@tonic-gate * SSL for addition to the cache of TA certs.
126*0Sstevel@tonic-gate *
127*0Sstevel@tonic-gate * Arguments:
128*0Sstevel@tonic-gate * ctx - SSL's context structure
129*0Sstevel@tonic-gate * ta_certs - Stack of certs to add to the list of SSL trust anchors.
130*0Sstevel@tonic-gate *
131*0Sstevel@tonic-gate * Returns:
132*0Sstevel@tonic-gate * <=0 - Error occurred. Check the error stack for specifics.
133*0Sstevel@tonic-gate * >0 - Success. Certs were successfully added.
134*0Sstevel@tonic-gate */
135*0Sstevel@tonic-gate static int
sunw_use_tastore(SSL_CTX * ctx,STACK_OF (X509)* ta_certs)136*0Sstevel@tonic-gate sunw_use_tastore(SSL_CTX *ctx, STACK_OF(X509) *ta_certs)
137*0Sstevel@tonic-gate {
138*0Sstevel@tonic-gate X509 *tmp;
139*0Sstevel@tonic-gate int ret = -1;
140*0Sstevel@tonic-gate int i;
141*0Sstevel@tonic-gate
142*0Sstevel@tonic-gate ERR_clear_error();
143*0Sstevel@tonic-gate if (ctx == NULL || ctx->cert_store == NULL || ta_certs == NULL) {
144*0Sstevel@tonic-gate SUNWerr(SUNW_F_USE_TASTORE, SUNW_R_INVALID_ARG);
145*0Sstevel@tonic-gate return (-1);
146*0Sstevel@tonic-gate }
147*0Sstevel@tonic-gate
148*0Sstevel@tonic-gate if (sk_X509_num(ta_certs) == 0) {
149*0Sstevel@tonic-gate SUNWerr(SUNW_F_USE_TASTORE, SUNW_R_NO_TRUST_ANCHOR);
150*0Sstevel@tonic-gate return (-1);
151*0Sstevel@tonic-gate }
152*0Sstevel@tonic-gate
153*0Sstevel@tonic-gate for (i = 0; i < sk_X509_num(ta_certs); i++) {
154*0Sstevel@tonic-gate tmp = sk_X509_value(ta_certs, i);
155*0Sstevel@tonic-gate
156*0Sstevel@tonic-gate ret = X509_STORE_add_cert(ctx->cert_store, tmp);
157*0Sstevel@tonic-gate if (ret == 0) {
158*0Sstevel@tonic-gate if (ERR_GET_REASON(ERR_peek_error()) ==
159*0Sstevel@tonic-gate X509_R_CERT_ALREADY_IN_HASH_TABLE) {
160*0Sstevel@tonic-gate ERR_clear_error();
161*0Sstevel@tonic-gate continue;
162*0Sstevel@tonic-gate }
163*0Sstevel@tonic-gate SUNWerr(SUNW_F_USE_TASTORE, SUNW_R_ADD_TRUST_ERR);
164*0Sstevel@tonic-gate return (-1);
165*0Sstevel@tonic-gate } else if (ret < 0) {
166*0Sstevel@tonic-gate break;
167*0Sstevel@tonic-gate }
168*0Sstevel@tonic-gate }
169*0Sstevel@tonic-gate
170*0Sstevel@tonic-gate if (ret < 0) {
171*0Sstevel@tonic-gate SUNWerr(SUNW_F_USE_TASTORE, SUNW_R_ADD_TRUST_ERR);
172*0Sstevel@tonic-gate }
173*0Sstevel@tonic-gate
174*0Sstevel@tonic-gate return (ret);
175*0Sstevel@tonic-gate }
176*0Sstevel@tonic-gate
177*0Sstevel@tonic-gate /*
178*0Sstevel@tonic-gate * sunw_p12_use_certfile - read a client certificate from a pkcs12 file and
179*0Sstevel@tonic-gate * pass it in to SSL.
180*0Sstevel@tonic-gate *
181*0Sstevel@tonic-gate * Read in the certificate in pkcs12-formated file. Use the provided
182*0Sstevel@tonic-gate * passphrase to decrypt it. Pass the cert to SSL.
183*0Sstevel@tonic-gate *
184*0Sstevel@tonic-gate * Arguments:
185*0Sstevel@tonic-gate * ctx - SSL's context structure
186*0Sstevel@tonic-gate * filename - Name of file with the client certificate.
187*0Sstevel@tonic-gate * passwd - Passphrase for pkcs12 data.
188*0Sstevel@tonic-gate *
189*0Sstevel@tonic-gate * Returns:
190*0Sstevel@tonic-gate * <=0 - Error occurred. Check the error stack for specifics.
191*0Sstevel@tonic-gate * >0 - Success. Cert was successfully added.
192*0Sstevel@tonic-gate */
193*0Sstevel@tonic-gate int
sunw_p12_use_certfile(SSL_CTX * ctx,char * filename,char * passwd)194*0Sstevel@tonic-gate sunw_p12_use_certfile(SSL_CTX *ctx, char *filename, char *passwd)
195*0Sstevel@tonic-gate {
196*0Sstevel@tonic-gate PKCS12 *p12 = NULL;
197*0Sstevel@tonic-gate X509 *cert = NULL;
198*0Sstevel@tonic-gate int ret = -1;
199*0Sstevel@tonic-gate
200*0Sstevel@tonic-gate ERR_clear_error();
201*0Sstevel@tonic-gate if (ctx == NULL || filename == NULL) {
202*0Sstevel@tonic-gate SUNWerr(SUNW_F_USE_CERTFILE, SUNW_R_INVALID_ARG);
203*0Sstevel@tonic-gate return (-1);
204*0Sstevel@tonic-gate }
205*0Sstevel@tonic-gate
206*0Sstevel@tonic-gate p12 = p12_read_file(filename);
207*0Sstevel@tonic-gate if (p12 != NULL) {
208*0Sstevel@tonic-gate ret = p12_doparse(p12, passwd, DO_UNMATCHING, NULL,
209*0Sstevel@tonic-gate &cert, NULL);
210*0Sstevel@tonic-gate if (ret > 0 && cert != NULL) {
211*0Sstevel@tonic-gate if (sunw_use_x509cert(ctx, cert) == -1) {
212*0Sstevel@tonic-gate /*
213*0Sstevel@tonic-gate * Error already on stack
214*0Sstevel@tonic-gate */
215*0Sstevel@tonic-gate ret = -1;
216*0Sstevel@tonic-gate }
217*0Sstevel@tonic-gate }
218*0Sstevel@tonic-gate }
219*0Sstevel@tonic-gate
220*0Sstevel@tonic-gate if (p12 != NULL)
221*0Sstevel@tonic-gate PKCS12_free(p12);
222*0Sstevel@tonic-gate
223*0Sstevel@tonic-gate if (ret == -1 && cert != NULL) {
224*0Sstevel@tonic-gate X509_free(cert);
225*0Sstevel@tonic-gate cert = NULL;
226*0Sstevel@tonic-gate }
227*0Sstevel@tonic-gate
228*0Sstevel@tonic-gate return (ret);
229*0Sstevel@tonic-gate }
230*0Sstevel@tonic-gate
231*0Sstevel@tonic-gate /*
232*0Sstevel@tonic-gate * sunw_p12_use_keyfile - read a RSA private key from a pkcs12 file and pass
233*0Sstevel@tonic-gate * it in to SSL.
234*0Sstevel@tonic-gate *
235*0Sstevel@tonic-gate * Read in the RSA private key in pkcs12 format. Use the provided
236*0Sstevel@tonic-gate * passphrase to decrypt it. Pass the cert to SSL.
237*0Sstevel@tonic-gate *
238*0Sstevel@tonic-gate * Arguments:
239*0Sstevel@tonic-gate * ctx - SSL's context structure
240*0Sstevel@tonic-gate * filename - Name of file with private key.
241*0Sstevel@tonic-gate * passwd - Passphrase for pkcs12 data.
242*0Sstevel@tonic-gate *
243*0Sstevel@tonic-gate * Returns:
244*0Sstevel@tonic-gate * <=0 - Error occurred. Check the error stack for specifics.
245*0Sstevel@tonic-gate * >0 - Success. Key was successfully added.
246*0Sstevel@tonic-gate */
247*0Sstevel@tonic-gate int
sunw_p12_use_keyfile(SSL_CTX * ctx,char * filename,char * passwd)248*0Sstevel@tonic-gate sunw_p12_use_keyfile(SSL_CTX *ctx, char *filename, char *passwd)
249*0Sstevel@tonic-gate {
250*0Sstevel@tonic-gate EVP_PKEY *pkey = NULL;
251*0Sstevel@tonic-gate PKCS12 *p12 = NULL;
252*0Sstevel@tonic-gate int ret = -1;
253*0Sstevel@tonic-gate
254*0Sstevel@tonic-gate ERR_clear_error();
255*0Sstevel@tonic-gate if (ctx == NULL || filename == NULL) {
256*0Sstevel@tonic-gate SUNWerr(SUNW_F_USE_KEYFILE, SUNW_R_INVALID_ARG);
257*0Sstevel@tonic-gate return (-1);
258*0Sstevel@tonic-gate }
259*0Sstevel@tonic-gate
260*0Sstevel@tonic-gate p12 = p12_read_file(filename);
261*0Sstevel@tonic-gate if (p12 != NULL) {
262*0Sstevel@tonic-gate ret = p12_doparse(p12, passwd, DO_UNMATCHING, &pkey, NULL,
263*0Sstevel@tonic-gate NULL);
264*0Sstevel@tonic-gate if (ret > 0 && pkey != NULL) {
265*0Sstevel@tonic-gate if (sunw_use_pkey(ctx, pkey) != 1) {
266*0Sstevel@tonic-gate /*
267*0Sstevel@tonic-gate * Error already on stack
268*0Sstevel@tonic-gate */
269*0Sstevel@tonic-gate ret = -1;
270*0Sstevel@tonic-gate }
271*0Sstevel@tonic-gate } else {
272*0Sstevel@tonic-gate SUNWerr(SUNW_F_USE_KEYFILE, SUNW_R_BAD_PKEY);
273*0Sstevel@tonic-gate }
274*0Sstevel@tonic-gate } else {
275*0Sstevel@tonic-gate SUNWerr(SUNW_F_USE_KEYFILE, SUNW_R_PKEY_READ_ERR);
276*0Sstevel@tonic-gate }
277*0Sstevel@tonic-gate
278*0Sstevel@tonic-gate if (p12 != NULL)
279*0Sstevel@tonic-gate PKCS12_free(p12);
280*0Sstevel@tonic-gate
281*0Sstevel@tonic-gate if (ret == -1 && pkey != NULL) {
282*0Sstevel@tonic-gate sunw_evp_pkey_free(pkey);
283*0Sstevel@tonic-gate pkey = NULL;
284*0Sstevel@tonic-gate }
285*0Sstevel@tonic-gate
286*0Sstevel@tonic-gate return (ret);
287*0Sstevel@tonic-gate }
288*0Sstevel@tonic-gate
289*0Sstevel@tonic-gate /*
290*0Sstevel@tonic-gate * sunw_p12_use_trustfile - read a list of trustanchors from a pkcs12 file and
291*0Sstevel@tonic-gate * pass the stack in to SSL.
292*0Sstevel@tonic-gate *
293*0Sstevel@tonic-gate * Read in the trust anchors from pkcs12-formated file. Use the provided
294*0Sstevel@tonic-gate * passphrase to decrypt it. Pass the cert to SSL.
295*0Sstevel@tonic-gate *
296*0Sstevel@tonic-gate * Arguments:
297*0Sstevel@tonic-gate * ctx - SSL's context structure
298*0Sstevel@tonic-gate * filename - Name of file with the certificates.
299*0Sstevel@tonic-gate * passwd - Passphrase for pkcs12 data.
300*0Sstevel@tonic-gate *
301*0Sstevel@tonic-gate * Returns:
302*0Sstevel@tonic-gate * <=0 - Error occurred. Check the error stack for specifics.
303*0Sstevel@tonic-gate * >0 - Success. Trust anchors were successfully added.
304*0Sstevel@tonic-gate */
305*0Sstevel@tonic-gate int
sunw_p12_use_trustfile(SSL_CTX * ctx,char * filename,char * passwd)306*0Sstevel@tonic-gate sunw_p12_use_trustfile(SSL_CTX *ctx, char *filename, char *passwd)
307*0Sstevel@tonic-gate {
308*0Sstevel@tonic-gate PKCS12 *p12 = NULL;
309*0Sstevel@tonic-gate STACK_OF(X509) *ta_sk = NULL;
310*0Sstevel@tonic-gate int ret = -1;
311*0Sstevel@tonic-gate
312*0Sstevel@tonic-gate ERR_clear_error();
313*0Sstevel@tonic-gate if (ctx == NULL || filename == NULL) {
314*0Sstevel@tonic-gate SUNWerr(SUNW_F_USE_TRUSTFILE, SUNW_R_INVALID_ARG);
315*0Sstevel@tonic-gate return (-1);
316*0Sstevel@tonic-gate }
317*0Sstevel@tonic-gate
318*0Sstevel@tonic-gate p12 = p12_read_file(filename);
319*0Sstevel@tonic-gate if (p12 != NULL) {
320*0Sstevel@tonic-gate ret = p12_doparse(p12, passwd, DO_NONE, NULL, NULL,
321*0Sstevel@tonic-gate &ta_sk);
322*0Sstevel@tonic-gate if (ret > 0 && ta_sk != NULL)
323*0Sstevel@tonic-gate ret = sunw_use_tastore(ctx, ta_sk);
324*0Sstevel@tonic-gate else {
325*0Sstevel@tonic-gate SUNWerr(SUNW_F_USE_TRUSTFILE, SUNW_R_BAD_TRUST);
326*0Sstevel@tonic-gate ret = -1;
327*0Sstevel@tonic-gate }
328*0Sstevel@tonic-gate } else {
329*0Sstevel@tonic-gate SUNWerr(SUNW_F_USE_TRUSTFILE, SUNW_R_READ_TRUST_ERR);
330*0Sstevel@tonic-gate }
331*0Sstevel@tonic-gate
332*0Sstevel@tonic-gate if (p12 != NULL)
333*0Sstevel@tonic-gate PKCS12_free(p12);
334*0Sstevel@tonic-gate
335*0Sstevel@tonic-gate if (ta_sk != NULL)
336*0Sstevel@tonic-gate sk_X509_pop_free(ta_sk, X509_free);
337*0Sstevel@tonic-gate
338*0Sstevel@tonic-gate return (ret);
339*0Sstevel@tonic-gate }
340*0Sstevel@tonic-gate
341*0Sstevel@tonic-gate /*
342*0Sstevel@tonic-gate * p12_read_file - read a pkcs12 file and get its contents. Return the
343*0Sstevel@tonic-gate * pkcs12 structures.
344*0Sstevel@tonic-gate *
345*0Sstevel@tonic-gate * Arguments:
346*0Sstevel@tonic-gate * filename - Name of file with the client certificate.
347*0Sstevel@tonic-gate *
348*0Sstevel@tonic-gate *
349*0Sstevel@tonic-gate * Returns:
350*0Sstevel@tonic-gate * NULL - Error occurred. Check the error stack for specifics.
351*0Sstevel@tonic-gate * != NULL - Success. The return value is the address of a pkcs12
352*0Sstevel@tonic-gate * structure.
353*0Sstevel@tonic-gate */
354*0Sstevel@tonic-gate static PKCS12 *
p12_read_file(char * filename)355*0Sstevel@tonic-gate p12_read_file(char *filename)
356*0Sstevel@tonic-gate {
357*0Sstevel@tonic-gate PKCS12 *p12 = NULL;
358*0Sstevel@tonic-gate FILE *fp = NULL;
359*0Sstevel@tonic-gate int ret = 0;
360*0Sstevel@tonic-gate
361*0Sstevel@tonic-gate ERR_clear_error();
362*0Sstevel@tonic-gate if (checkfile(filename) == -1) {
363*0Sstevel@tonic-gate /*
364*0Sstevel@tonic-gate * Error already on stack
365*0Sstevel@tonic-gate */
366*0Sstevel@tonic-gate return (NULL);
367*0Sstevel@tonic-gate }
368*0Sstevel@tonic-gate
369*0Sstevel@tonic-gate if ((fp = fopen(filename, "r")) == 0) {
370*0Sstevel@tonic-gate SYSerr(SYS_F_FOPEN, errno);
371*0Sstevel@tonic-gate return (NULL);
372*0Sstevel@tonic-gate }
373*0Sstevel@tonic-gate
374*0Sstevel@tonic-gate p12 = d2i_PKCS12_fp(fp, NULL);
375*0Sstevel@tonic-gate if (p12 == NULL) {
376*0Sstevel@tonic-gate SUNWerr(SUNW_F_READ_FILE, SUNW_R_READ_ERR);
377*0Sstevel@tonic-gate ret = -1;
378*0Sstevel@tonic-gate }
379*0Sstevel@tonic-gate
380*0Sstevel@tonic-gate if (fp != NULL)
381*0Sstevel@tonic-gate (void) fclose(fp);
382*0Sstevel@tonic-gate
383*0Sstevel@tonic-gate if (ret == -1 && p12 != NULL) {
384*0Sstevel@tonic-gate PKCS12_free(p12);
385*0Sstevel@tonic-gate p12 = NULL;
386*0Sstevel@tonic-gate }
387*0Sstevel@tonic-gate
388*0Sstevel@tonic-gate return (p12);
389*0Sstevel@tonic-gate }
390*0Sstevel@tonic-gate
391*0Sstevel@tonic-gate /*
392*0Sstevel@tonic-gate * p12_doparse - Given a pkcs12 structure, check the passphrase and then
393*0Sstevel@tonic-gate * parse it.
394*0Sstevel@tonic-gate *
395*0Sstevel@tonic-gate * Arguments:
396*0Sstevel@tonic-gate * p12 - Structure with pkcs12 data which has been read in
397*0Sstevel@tonic-gate * passwd - Passphrase for pkcs12 data & key.
398*0Sstevel@tonic-gate * matchty - How to decide which matching entry to take... See the
399*0Sstevel@tonic-gate * DO_* definitions for valid values.
400*0Sstevel@tonic-gate * pkey - Points at pointer to private key structure.
401*0Sstevel@tonic-gate * cert - Points at pointer to client certificate structure
402*0Sstevel@tonic-gate * ca - Points at pointer to list of CA certs
403*0Sstevel@tonic-gate *
404*0Sstevel@tonic-gate * Returns:
405*0Sstevel@tonic-gate * <=0 - Error occurred. Check the error stack for specifics.
406*0Sstevel@tonic-gate * >0 - Success. Bits set reflect the kind of information
407*0Sstevel@tonic-gate * returned. (See the FOUND_* definitions.)
408*0Sstevel@tonic-gate */
409*0Sstevel@tonic-gate static int
p12_doparse(PKCS12 * p12,char * passwd,int matchty,EVP_PKEY ** pkey,X509 ** cert,STACK_OF (X509)** ca)410*0Sstevel@tonic-gate p12_doparse(PKCS12 *p12, char *passwd, int matchty,
411*0Sstevel@tonic-gate EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca)
412*0Sstevel@tonic-gate {
413*0Sstevel@tonic-gate int ret = 0;
414*0Sstevel@tonic-gate
415*0Sstevel@tonic-gate ERR_clear_error();
416*0Sstevel@tonic-gate
417*0Sstevel@tonic-gate /*
418*0Sstevel@tonic-gate * Check passphrase (including null one).
419*0Sstevel@tonic-gate */
420*0Sstevel@tonic-gate if (check_password(p12, passwd) == 0) {
421*0Sstevel@tonic-gate SUNWerr(SUNW_F_DOPARSE, SUNW_R_MAC_VERIFY_FAILURE);
422*0Sstevel@tonic-gate return (-1);
423*0Sstevel@tonic-gate }
424*0Sstevel@tonic-gate
425*0Sstevel@tonic-gate ret = sunw_PKCS12_parse(p12, passwd, matchty, NULL, 0, NULL,
426*0Sstevel@tonic-gate pkey, cert, ca);
427*0Sstevel@tonic-gate if (ret <= 0) {
428*0Sstevel@tonic-gate /*
429*0Sstevel@tonic-gate * Error already on stack
430*0Sstevel@tonic-gate */
431*0Sstevel@tonic-gate return (-1);
432*0Sstevel@tonic-gate }
433*0Sstevel@tonic-gate
434*0Sstevel@tonic-gate return (ret);
435*0Sstevel@tonic-gate }
436*0Sstevel@tonic-gate
437*0Sstevel@tonic-gate /*
438*0Sstevel@tonic-gate * checkfile - given a file name, verify that the file exists and is
439*0Sstevel@tonic-gate * readable.
440*0Sstevel@tonic-gate */
441*0Sstevel@tonic-gate /* ARGSUSED */
442*0Sstevel@tonic-gate static int
checkfile(char * filename)443*0Sstevel@tonic-gate checkfile(char *filename)
444*0Sstevel@tonic-gate {
445*0Sstevel@tonic-gate #ifndef _BOOT
446*0Sstevel@tonic-gate struct stat sbuf;
447*0Sstevel@tonic-gate
448*0Sstevel@tonic-gate if (access(filename, R_OK) == -1 || stat(filename, &sbuf) == -1) {
449*0Sstevel@tonic-gate SYSerr(SYS_F_FOPEN, errno);
450*0Sstevel@tonic-gate return (-1);
451*0Sstevel@tonic-gate }
452*0Sstevel@tonic-gate
453*0Sstevel@tonic-gate if (!S_ISREG(sbuf.st_mode)) {
454*0Sstevel@tonic-gate SUNWerr(SUNW_F_CHECKFILE, SUNW_R_BAD_FILETYPE);
455*0Sstevel@tonic-gate return (-1);
456*0Sstevel@tonic-gate }
457*0Sstevel@tonic-gate #endif
458*0Sstevel@tonic-gate return (0);
459*0Sstevel@tonic-gate }
460*0Sstevel@tonic-gate
461*0Sstevel@tonic-gate /*
462*0Sstevel@tonic-gate * check_password - do various password checks to see if the current password
463*0Sstevel@tonic-gate * will work or we need to prompt for a new one.
464*0Sstevel@tonic-gate *
465*0Sstevel@tonic-gate * Arguments:
466*0Sstevel@tonic-gate * pass - password to check
467*0Sstevel@tonic-gate *
468*0Sstevel@tonic-gate * Returns:
469*0Sstevel@tonic-gate * 1 - Password is OK.
470*0Sstevel@tonic-gate * 0 - Password not valid. Error stack was set - use ERR_get_error() to
471*0Sstevel@tonic-gate * to get the error.
472*0Sstevel@tonic-gate */
473*0Sstevel@tonic-gate static int
check_password(PKCS12 * p12,char * pass)474*0Sstevel@tonic-gate check_password(PKCS12 *p12, char *pass)
475*0Sstevel@tonic-gate {
476*0Sstevel@tonic-gate int ret = 1;
477*0Sstevel@tonic-gate
478*0Sstevel@tonic-gate /*
479*0Sstevel@tonic-gate * If password is zero length or NULL then try verifying both cases
480*0Sstevel@tonic-gate * to determine which password is correct. The reason for this is that
481*0Sstevel@tonic-gate * under PKCS#12 password based encryption no password and a zero
482*0Sstevel@tonic-gate * length password are two different things. Otherwise, calling
483*0Sstevel@tonic-gate * PKCS12_verify_mac() with a length of -1 means that the length
484*0Sstevel@tonic-gate * can be determined via strlen().
485*0Sstevel@tonic-gate */
486*0Sstevel@tonic-gate /* Check the mac */
487*0Sstevel@tonic-gate if (pass == NULL || *pass == '\0') {
488*0Sstevel@tonic-gate if (PKCS12_verify_mac(p12, NULL, 0) == 0 &&
489*0Sstevel@tonic-gate PKCS12_verify_mac(p12, "", 0) == 0)
490*0Sstevel@tonic-gate ret = 0;
491*0Sstevel@tonic-gate } else if (PKCS12_verify_mac(p12, pass, -1) == 0) {
492*0Sstevel@tonic-gate ret = 0;
493*0Sstevel@tonic-gate }
494*0Sstevel@tonic-gate
495*0Sstevel@tonic-gate return (ret);
496*0Sstevel@tonic-gate }
497