1*0Sstevel@tonic-gate /*
2*0Sstevel@tonic-gate * ====================================================================
3*0Sstevel@tonic-gate * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
4*0Sstevel@tonic-gate *
5*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without
6*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions
7*0Sstevel@tonic-gate * are met:
8*0Sstevel@tonic-gate *
9*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the above copyright
10*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer.
11*0Sstevel@tonic-gate *
12*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright
13*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in
14*0Sstevel@tonic-gate * the documentation and/or other materials provided with the
15*0Sstevel@tonic-gate * distribution.
16*0Sstevel@tonic-gate *
17*0Sstevel@tonic-gate * 3. All advertising materials mentioning features or use of this
18*0Sstevel@tonic-gate * software must display the following acknowledgment:
19*0Sstevel@tonic-gate * "This product includes software developed by the OpenSSL Project
20*0Sstevel@tonic-gate * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
21*0Sstevel@tonic-gate *
22*0Sstevel@tonic-gate * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
23*0Sstevel@tonic-gate * endorse or promote products derived from this software without
24*0Sstevel@tonic-gate * prior written permission. For written permission, please contact
25*0Sstevel@tonic-gate * licensing@OpenSSL.org.
26*0Sstevel@tonic-gate *
27*0Sstevel@tonic-gate * 5. Products derived from this software may not be called "OpenSSL"
28*0Sstevel@tonic-gate * nor may "OpenSSL" appear in their names without prior written
29*0Sstevel@tonic-gate * permission of the OpenSSL Project.
30*0Sstevel@tonic-gate *
31*0Sstevel@tonic-gate * 6. Redistributions of any form whatsoever must retain the following
32*0Sstevel@tonic-gate * acknowledgment:
33*0Sstevel@tonic-gate * "This product includes software developed by the OpenSSL Project
34*0Sstevel@tonic-gate * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
35*0Sstevel@tonic-gate *
36*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
37*0Sstevel@tonic-gate * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
38*0Sstevel@tonic-gate * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
39*0Sstevel@tonic-gate * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
40*0Sstevel@tonic-gate * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
41*0Sstevel@tonic-gate * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
42*0Sstevel@tonic-gate * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
43*0Sstevel@tonic-gate * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
44*0Sstevel@tonic-gate * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
45*0Sstevel@tonic-gate * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
46*0Sstevel@tonic-gate * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
47*0Sstevel@tonic-gate * OF THE POSSIBILITY OF SUCH DAMAGE.
48*0Sstevel@tonic-gate * ====================================================================
49*0Sstevel@tonic-gate *
50*0Sstevel@tonic-gate * This product includes cryptographic software written by Eric Young
51*0Sstevel@tonic-gate * (eay@cryptsoft.com). This product includes software written by Tim
52*0Sstevel@tonic-gate * Hudson (tjh@cryptsoft.com).
53*0Sstevel@tonic-gate *
54*0Sstevel@tonic-gate */
55*0Sstevel@tonic-gate
56*0Sstevel@tonic-gate /*
57*0Sstevel@tonic-gate * Copyright 2002, 2003 Sun Microsystems, Inc. All rights reserved.
58*0Sstevel@tonic-gate * Use is subject to license terms.
59*0Sstevel@tonic-gate */
60*0Sstevel@tonic-gate
61*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI"
62*0Sstevel@tonic-gate
63*0Sstevel@tonic-gate #include <stdio.h>
64*0Sstevel@tonic-gate #include <strings.h>
65*0Sstevel@tonic-gate #include <stdlib.h>
66*0Sstevel@tonic-gate
67*0Sstevel@tonic-gate #include <openssl/crypto.h>
68*0Sstevel@tonic-gate #include <openssl/err.h>
69*0Sstevel@tonic-gate #include <openssl/x509.h>
70*0Sstevel@tonic-gate
71*0Sstevel@tonic-gate #include <openssl/pkcs12.h>
72*0Sstevel@tonic-gate #include <p12aux.h>
73*0Sstevel@tonic-gate #include <auxutil.h>
74*0Sstevel@tonic-gate #include <p12err.h>
75*0Sstevel@tonic-gate
76*0Sstevel@tonic-gate /*
77*0Sstevel@tonic-gate * Briefly, a note on the APIs provided by this module.
78*0Sstevel@tonic-gate *
79*0Sstevel@tonic-gate * The sunw_PKCS_parse, parse_pkcs12 and sunw_PKCS12_contents APIs
80*0Sstevel@tonic-gate * replace OpenSSL funcionality provided by PKCS12_parse and its
81*0Sstevel@tonic-gate * supporting routines.
82*0Sstevel@tonic-gate *
83*0Sstevel@tonic-gate * The APIs provided here provide more functionality:
84*0Sstevel@tonic-gate *
85*0Sstevel@tonic-gate * - sunw_PKCS12_parse provides:
86*0Sstevel@tonic-gate *
87*0Sstevel@tonic-gate * earlier MAC processing than PKCS12_parse
88*0Sstevel@tonic-gate *
89*0Sstevel@tonic-gate * treats the handling of the difference between CA certs and certs
90*0Sstevel@tonic-gate * with matching private keys differently that PKCS12_parse does. In
91*0Sstevel@tonic-gate * PKCS12_parse, any cert which is not the one selected is assumed to be
92*0Sstevel@tonic-gate * a CA cert. In parse_pkcs12, certs which have matching private keys are
93*0Sstevel@tonic-gate * not returned as part of the CA certs.
94*0Sstevel@tonic-gate *
95*0Sstevel@tonic-gate * the matching of private keys and certs is done at this level, rather than
96*0Sstevel@tonic-gate * at the lower levels which were used in the openssl implementation. This
97*0Sstevel@tonic-gate * is part of the changes introduced so that the parsing functions can
98*0Sstevel@tonic-gate * return just a cert, just a private key, the stack of CA certs or any
99*0Sstevel@tonic-gate * combination.
100*0Sstevel@tonic-gate *
101*0Sstevel@tonic-gate * added DO_FIRST_PAIR, DO_LAST_PAIR and DO_UNMATCHING matchty support.
102*0Sstevel@tonic-gate *
103*0Sstevel@tonic-gate * do a much better job of cleaning up. Specifically, free the added
104*0Sstevel@tonic-gate * attributes on the private key which was done by calling
105*0Sstevel@tonic-gate * sunw_evp_pkey_free().
106*0Sstevel@tonic-gate *
107*0Sstevel@tonic-gate * in sunw_PKCS12_contents, handle allocation of the stacks of certificates
108*0Sstevel@tonic-gate * and private keys so that a) the original stacks are not changed unless
109*0Sstevel@tonic-gate * the parsing was successful; b) it will either extend stacks passed in,
110*0Sstevel@tonic-gate * or allocate new ones if none were supplied.
111*0Sstevel@tonic-gate *
112*0Sstevel@tonic-gate * - for parse_outer vs. parse_pk12() (from the openssl source base):
113*0Sstevel@tonic-gate *
114*0Sstevel@tonic-gate * this calls lower levels with stacks of private keys and certs, rather
115*0Sstevel@tonic-gate * that a cert, a private key and a stack for CA certs.
116*0Sstevel@tonic-gate *
117*0Sstevel@tonic-gate * - In the case of parse_all_bags vs. parse_bags, there is no real difference,
118*0Sstevel@tonic-gate * other than use of stacks of private keys and certificates (as opposed
119*0Sstevel@tonic-gate * to one cert, one private key and a stack of CA certificates).
120*0Sstevel@tonic-gate *
121*0Sstevel@tonic-gate * - Finally, for parse_one_bag vs. parse_bag:
122*0Sstevel@tonic-gate *
123*0Sstevel@tonic-gate * got rid of the bugs the openssl matching of keys and certificates.
124*0Sstevel@tonic-gate *
125*0Sstevel@tonic-gate * got rid of the requirement that there is one private key and a matching
126*0Sstevel@tonic-gate * cert somewhere in the input. This was done by moving the matching
127*0Sstevel@tonic-gate * code to a higher level.
128*0Sstevel@tonic-gate *
129*0Sstevel@tonic-gate * put any localKeyID and/or friendlyName attributes found in the structures
130*0Sstevel@tonic-gate * returned, so that they can be used at higher levels for searching, etc.
131*0Sstevel@tonic-gate *
132*0Sstevel@tonic-gate * added some error returns (like an error when there is an unsupported
133*0Sstevel@tonic-gate * bag type, an unsupported certificate type or an unsupported key type)
134*0Sstevel@tonic-gate *
135*0Sstevel@tonic-gate * Added cleanup before returning.
136*0Sstevel@tonic-gate */
137*0Sstevel@tonic-gate
138*0Sstevel@tonic-gate static int parse_pkcs12(PKCS12 *, const char *, int, char *, int, char *,
139*0Sstevel@tonic-gate EVP_PKEY **, X509 **, STACK_OF(X509) **);
140*0Sstevel@tonic-gate
141*0Sstevel@tonic-gate static int parse_outer(PKCS12 *, const char *, STACK_OF(EVP_PKEY) *,
142*0Sstevel@tonic-gate STACK_OF(X509) *);
143*0Sstevel@tonic-gate
144*0Sstevel@tonic-gate static int parse_all_bags(STACK_OF(PKCS12_SAFEBAG) *, const char *,
145*0Sstevel@tonic-gate STACK_OF(EVP_PKEY) *, STACK_OF(X509) *);
146*0Sstevel@tonic-gate
147*0Sstevel@tonic-gate static int parse_one_bag(PKCS12_SAFEBAG *, const char *, STACK_OF(EVP_PKEY) *,
148*0Sstevel@tonic-gate STACK_OF(X509) *);
149*0Sstevel@tonic-gate
150*0Sstevel@tonic-gate static int sunw_PKCS12_contents(PKCS12 *p12, const char *pass,
151*0Sstevel@tonic-gate STACK_OF(EVP_PKEY) **pkey, STACK_OF(X509) **certs);
152*0Sstevel@tonic-gate
153*0Sstevel@tonic-gate /*
154*0Sstevel@tonic-gate * sunw_PKCS12_parse - Parse a PKCS12 structure and break it into its parts.
155*0Sstevel@tonic-gate *
156*0Sstevel@tonic-gate * Parse and decrypt a PKCS#12 structure returning user key, user cert and/or
157*0Sstevel@tonic-gate * other (CA) certs. Note either ca should be NULL, *ca should be NULL,
158*0Sstevel@tonic-gate * or it should point to a valid STACK_OF(X509) structure. pkey and cert can
159*0Sstevel@tonic-gate * be passed uninitialized.
160*0Sstevel@tonic-gate *
161*0Sstevel@tonic-gate * Arguments:
162*0Sstevel@tonic-gate * p12 - Structure with pkcs12 info to be parsed
163*0Sstevel@tonic-gate * pass - Pass phrase for the private key (possibly empty) or NULL if
164*0Sstevel@tonic-gate * there is none.
165*0Sstevel@tonic-gate * matchty - Info about which certs/keys to return if many are in the file.
166*0Sstevel@tonic-gate * keyid - If private key localkeyids friendlynames are to match a
167*0Sstevel@tonic-gate * predetermined value, the value to match. This value should
168*0Sstevel@tonic-gate * be an octet string.
169*0Sstevel@tonic-gate * keyid_len- Length of the keyid byte string.
170*0Sstevel@tonic-gate * name_str - If friendlynames are to match a predetermined value, the value
171*0Sstevel@tonic-gate * to match. This value should be a NULL terminated string.
172*0Sstevel@tonic-gate * pkey - Points to location pointing to the private key returned.
173*0Sstevel@tonic-gate * cert - Points to locaiton which points to the client cert returned
174*0Sstevel@tonic-gate * ca - Points to location that points to a stack of 'certificate
175*0Sstevel@tonic-gate * authority' certs/trust anchors.
176*0Sstevel@tonic-gate *
177*0Sstevel@tonic-gate * Match based on the value of 'matchty' and the contents of 'keyid'
178*0Sstevel@tonic-gate * and/or 'name_str', as appropriate. Go through the lists of certs and
179*0Sstevel@tonic-gate * private keys which were taken from the pkcs12 structure, looking for
180*0Sstevel@tonic-gate * matches of the requested type. This function only searches the lists of
181*0Sstevel@tonic-gate * matching private keys and client certificates. Kinds of matches allowed,
182*0Sstevel@tonic-gate * and the order in which they will be checked, are:
183*0Sstevel@tonic-gate *
184*0Sstevel@tonic-gate * 1) Find the key and/or cert whose localkeyid attributes matches
185*0Sstevel@tonic-gate * 'keyid'.
186*0Sstevel@tonic-gate * 2) Find the key and/or cert whose friendlyname attributes matches
187*0Sstevel@tonic-gate * 'name_str'
188*0Sstevel@tonic-gate * 3) Return the first matching key/cert pair found.
189*0Sstevel@tonic-gate * 4) Return the last matching key/cert pair found.
190*0Sstevel@tonic-gate * 5) Return whatever cert and/or key are available, even unmatching.
191*0Sstevel@tonic-gate *
192*0Sstevel@tonic-gate * Append to the CA list, the certs which do not have matching private
193*0Sstevel@tonic-gate * keys and which were not selected.
194*0Sstevel@tonic-gate *
195*0Sstevel@tonic-gate * If none of the bits are set, no client certs or private keys will be
196*0Sstevel@tonic-gate * returned. CA (aka trust anchor) certs can be.
197*0Sstevel@tonic-gate *
198*0Sstevel@tonic-gate * Notes: If #3 is selected, then #4 will never occur. CA certs will be
199*0Sstevel@tonic-gate * selected after a cert/key pairs are isolated.
200*0Sstevel@tonic-gate *
201*0Sstevel@tonic-gate * Returns:
202*0Sstevel@tonic-gate * < 0 - An error returned. Call ERR_get_error() to get errors information.
203*0Sstevel@tonic-gate * Where possible, memory has been freed.
204*0Sstevel@tonic-gate * >= 0 - Objects were found and returned. Which objects are indicated by
205*0Sstevel@tonic-gate * which bits are set (FOUND_PKEY, FOUND_CERT, FOUND_CA_CERTS).
206*0Sstevel@tonic-gate */
207*0Sstevel@tonic-gate int
sunw_PKCS12_parse(PKCS12 * p12,const char * pass,int matchty,char * keyid,int keyid_len,char * name_str,EVP_PKEY ** pkey,X509 ** cert,STACK_OF (X509)** ca)208*0Sstevel@tonic-gate sunw_PKCS12_parse(PKCS12 *p12, const char *pass, int matchty, char *keyid,
209*0Sstevel@tonic-gate int keyid_len, char *name_str, EVP_PKEY **pkey, X509 **cert,
210*0Sstevel@tonic-gate STACK_OF(X509) **ca)
211*0Sstevel@tonic-gate {
212*0Sstevel@tonic-gate boolean_t ca_supplied;
213*0Sstevel@tonic-gate int retval = -1;
214*0Sstevel@tonic-gate
215*0Sstevel@tonic-gate /* If NULL PKCS12 structure, this is an error */
216*0Sstevel@tonic-gate if (p12 == NULL) {
217*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_PARSE, SUNW_R_INVALID_ARG);
218*0Sstevel@tonic-gate return (-1);
219*0Sstevel@tonic-gate }
220*0Sstevel@tonic-gate
221*0Sstevel@tonic-gate /* Set up arguments.... These will be allocated if needed */
222*0Sstevel@tonic-gate if (pkey)
223*0Sstevel@tonic-gate *pkey = NULL;
224*0Sstevel@tonic-gate if (cert)
225*0Sstevel@tonic-gate *cert = NULL;
226*0Sstevel@tonic-gate
227*0Sstevel@tonic-gate /*
228*0Sstevel@tonic-gate * If there is already a ca list, use it. Otherwise, allocate one
229*0Sstevel@tonic-gate * and free is later if an error occurs or whatever.)
230*0Sstevel@tonic-gate */
231*0Sstevel@tonic-gate ca_supplied = (ca != NULL && *ca != NULL);
232*0Sstevel@tonic-gate if (ca != NULL && *ca == NULL) {
233*0Sstevel@tonic-gate if ((*ca = sk_X509_new_null()) == NULL) {
234*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_PARSE, SUNW_R_MEMORY_FAILURE);
235*0Sstevel@tonic-gate return (-1);
236*0Sstevel@tonic-gate }
237*0Sstevel@tonic-gate }
238*0Sstevel@tonic-gate
239*0Sstevel@tonic-gate /*
240*0Sstevel@tonic-gate * If password is zero length or NULL then try verifying both cases
241*0Sstevel@tonic-gate * to determine which password is correct. The reason for this is that
242*0Sstevel@tonic-gate * under PKCS#12 password based encryption no password and a zero
243*0Sstevel@tonic-gate * length password are two different things. If the password has a
244*0Sstevel@tonic-gate * non-zero length and is not NULL then call PKCS12_verify_mac() with
245*0Sstevel@tonic-gate * a length of '-1' and let it use strlen() to figure out the length
246*0Sstevel@tonic-gate * of the password.
247*0Sstevel@tonic-gate */
248*0Sstevel@tonic-gate /* Check the mac */
249*0Sstevel@tonic-gate if (pass == NULL || *pass == '\0') {
250*0Sstevel@tonic-gate if (PKCS12_verify_mac(p12, NULL, 0))
251*0Sstevel@tonic-gate pass = NULL;
252*0Sstevel@tonic-gate else if (PKCS12_verify_mac(p12, "", 0))
253*0Sstevel@tonic-gate pass = "";
254*0Sstevel@tonic-gate else {
255*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_PARSE,
256*0Sstevel@tonic-gate SUNW_R_MAC_VERIFY_FAILURE);
257*0Sstevel@tonic-gate goto err;
258*0Sstevel@tonic-gate }
259*0Sstevel@tonic-gate } else if (PKCS12_verify_mac(p12, pass, -1) == 0) {
260*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_PARSE, SUNW_R_MAC_VERIFY_FAILURE);
261*0Sstevel@tonic-gate goto err;
262*0Sstevel@tonic-gate }
263*0Sstevel@tonic-gate
264*0Sstevel@tonic-gate retval = parse_pkcs12(p12, pass, matchty, keyid, keyid_len,
265*0Sstevel@tonic-gate name_str, pkey, cert, ca);
266*0Sstevel@tonic-gate if (retval < 0) {
267*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_PARSE, SUNW_R_PKCS12_PARSE_ERR);
268*0Sstevel@tonic-gate goto err;
269*0Sstevel@tonic-gate }
270*0Sstevel@tonic-gate return (retval);
271*0Sstevel@tonic-gate
272*0Sstevel@tonic-gate err:
273*0Sstevel@tonic-gate if (pkey && *pkey) {
274*0Sstevel@tonic-gate sunw_evp_pkey_free(*pkey);
275*0Sstevel@tonic-gate }
276*0Sstevel@tonic-gate if (cert && *cert)
277*0Sstevel@tonic-gate X509_free(*cert);
278*0Sstevel@tonic-gate if (ca_supplied == B_FALSE && ca != NULL)
279*0Sstevel@tonic-gate sk_X509_pop_free(*ca, X509_free);
280*0Sstevel@tonic-gate
281*0Sstevel@tonic-gate return (-1);
282*0Sstevel@tonic-gate
283*0Sstevel@tonic-gate }
284*0Sstevel@tonic-gate
285*0Sstevel@tonic-gate /*
286*0Sstevel@tonic-gate * parse_pkcs12 - Oversee parsing of the pkcs12 structure. Get it
287*0Sstevel@tonic-gate * parsed. After that either return what's found directly, or
288*0Sstevel@tonic-gate * do any required matching.
289*0Sstevel@tonic-gate *
290*0Sstevel@tonic-gate * Arguments:
291*0Sstevel@tonic-gate * p12 - Structure with pkcs12 info to be parsed
292*0Sstevel@tonic-gate * pass - Pass phrase for the private key (possibly empty) or NULL if
293*0Sstevel@tonic-gate * there is none.
294*0Sstevel@tonic-gate * matchty - Info about which certs/keys to return if many are in the file.
295*0Sstevel@tonic-gate * keyid - If private key localkeyids friendlynames are to match a
296*0Sstevel@tonic-gate * predetermined value, the value to match. This value should
297*0Sstevel@tonic-gate * be an octet string.
298*0Sstevel@tonic-gate * keyid_len- Length of the keyid byte string.
299*0Sstevel@tonic-gate * name_str - If friendlynames are to match a predetermined value, the value
300*0Sstevel@tonic-gate * to match. This value should be a NULL terminated string.
301*0Sstevel@tonic-gate * pkey - Points to location pointing to the private key returned.
302*0Sstevel@tonic-gate * cert - Points to locaiton which points to the client cert returned
303*0Sstevel@tonic-gate * ca - Points to location that points to a stack of 'certificate
304*0Sstevel@tonic-gate * authority' certs/trust anchors.
305*0Sstevel@tonic-gate *
306*0Sstevel@tonic-gate * Note about error codes: This function is an internal function, and the
307*0Sstevel@tonic-gate * place where it is called sets error codes. Therefore only set an error
308*0Sstevel@tonic-gate * code if it is something that is unique or if the function which detected
309*0Sstevel@tonic-gate * the error doesn't set one.
310*0Sstevel@tonic-gate *
311*0Sstevel@tonic-gate * Returns:
312*0Sstevel@tonic-gate * == -1 - An error occurred. Call ERR_get_error() to get error information.
313*0Sstevel@tonic-gate * Where possible, memory has been freed.
314*0Sstevel@tonic-gate * == 0 - No matching returns were found.
315*0Sstevel@tonic-gate * > 0 - This is the aithmetic 'or' of the FOUND_* bits that indicate which
316*0Sstevel@tonic-gate * of the requested entries were found.
317*0Sstevel@tonic-gate */
318*0Sstevel@tonic-gate static int
parse_pkcs12(PKCS12 * p12,const char * pass,int matchty,char * keyid,int kstr_len,char * name_str,EVP_PKEY ** pkey,X509 ** cert,STACK_OF (X509)** ca)319*0Sstevel@tonic-gate parse_pkcs12(PKCS12 *p12, const char *pass, int matchty, char *keyid,
320*0Sstevel@tonic-gate int kstr_len, char *name_str, EVP_PKEY **pkey, X509 **cert,
321*0Sstevel@tonic-gate STACK_OF(X509) **ca)
322*0Sstevel@tonic-gate {
323*0Sstevel@tonic-gate STACK_OF(EVP_PKEY) *work_kl = NULL; /* Head for private key list */
324*0Sstevel@tonic-gate STACK_OF(EVP_PKEY) *nocerts = NULL; /* Head for alt. key list */
325*0Sstevel@tonic-gate STACK_OF(X509) *work_ca = NULL; /* Head for cert list */
326*0Sstevel@tonic-gate STACK_OF(X509) *work_cl = NULL;
327*0Sstevel@tonic-gate int retval = 0;
328*0Sstevel@tonic-gate int n;
329*0Sstevel@tonic-gate
330*0Sstevel@tonic-gate retval = sunw_PKCS12_contents(p12, pass, &work_kl, &work_ca);
331*0Sstevel@tonic-gate if (retval < 0) {
332*0Sstevel@tonic-gate goto cleanup;
333*0Sstevel@tonic-gate } else if (retval == 0) {
334*0Sstevel@tonic-gate /*
335*0Sstevel@tonic-gate * Not really an error here - its just that nothing was found.
336*0Sstevel@tonic-gate */
337*0Sstevel@tonic-gate goto cleanup;
338*0Sstevel@tonic-gate }
339*0Sstevel@tonic-gate
340*0Sstevel@tonic-gate if (sk_EVP_PKEY_num(work_kl) > 0) {
341*0Sstevel@tonic-gate
342*0Sstevel@tonic-gate if (sunw_split_certs(work_kl, work_ca, &work_cl, &nocerts)
343*0Sstevel@tonic-gate < 0) {
344*0Sstevel@tonic-gate goto cleanup;
345*0Sstevel@tonic-gate }
346*0Sstevel@tonic-gate }
347*0Sstevel@tonic-gate
348*0Sstevel@tonic-gate /*
349*0Sstevel@tonic-gate * Go through the lists of certs and private keys which were
350*0Sstevel@tonic-gate * returned, looking for matches of the appropriate type. Do these
351*0Sstevel@tonic-gate * in the order described above.
352*0Sstevel@tonic-gate */
353*0Sstevel@tonic-gate if ((matchty & DO_FIND_KEYID) != 0) {
354*0Sstevel@tonic-gate
355*0Sstevel@tonic-gate if (keyid == NULL) {
356*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_PARSE, SUNW_R_INVALID_ARG);
357*0Sstevel@tonic-gate retval = -1;
358*0Sstevel@tonic-gate goto cleanup;
359*0Sstevel@tonic-gate }
360*0Sstevel@tonic-gate
361*0Sstevel@tonic-gate /* See if string matches localkeyid's */
362*0Sstevel@tonic-gate retval = sunw_find_localkeyid(keyid, kstr_len,
363*0Sstevel@tonic-gate work_kl, work_cl, pkey, cert);
364*0Sstevel@tonic-gate if (retval != 0) {
365*0Sstevel@tonic-gate if (retval == -1)
366*0Sstevel@tonic-gate goto cleanup;
367*0Sstevel@tonic-gate else
368*0Sstevel@tonic-gate goto last_part;
369*0Sstevel@tonic-gate }
370*0Sstevel@tonic-gate }
371*0Sstevel@tonic-gate if ((matchty & DO_FIND_FN) != 0) {
372*0Sstevel@tonic-gate
373*0Sstevel@tonic-gate if (name_str == NULL) {
374*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_PARSE, SUNW_R_INVALID_ARG);
375*0Sstevel@tonic-gate retval = -1;
376*0Sstevel@tonic-gate goto cleanup;
377*0Sstevel@tonic-gate }
378*0Sstevel@tonic-gate
379*0Sstevel@tonic-gate /* See if string matches friendly names */
380*0Sstevel@tonic-gate retval = sunw_find_fname(name_str, work_kl, work_cl,
381*0Sstevel@tonic-gate pkey, cert);
382*0Sstevel@tonic-gate if (retval != 0) {
383*0Sstevel@tonic-gate if (retval == -1)
384*0Sstevel@tonic-gate goto cleanup;
385*0Sstevel@tonic-gate else
386*0Sstevel@tonic-gate goto last_part;
387*0Sstevel@tonic-gate }
388*0Sstevel@tonic-gate }
389*0Sstevel@tonic-gate
390*0Sstevel@tonic-gate if (matchty & DO_FIRST_PAIR) {
391*0Sstevel@tonic-gate
392*0Sstevel@tonic-gate /* Find the first cert and private key and return them */
393*0Sstevel@tonic-gate retval = get_key_cert(0, work_kl, pkey, work_cl, cert);
394*0Sstevel@tonic-gate if (retval != 0) {
395*0Sstevel@tonic-gate if (retval == -1)
396*0Sstevel@tonic-gate goto cleanup;
397*0Sstevel@tonic-gate else
398*0Sstevel@tonic-gate goto last_part;
399*0Sstevel@tonic-gate }
400*0Sstevel@tonic-gate }
401*0Sstevel@tonic-gate
402*0Sstevel@tonic-gate if (matchty & DO_LAST_PAIR) {
403*0Sstevel@tonic-gate
404*0Sstevel@tonic-gate /*
405*0Sstevel@tonic-gate * Find the last matching cert and private key and return
406*0Sstevel@tonic-gate * them. Since keys which don't have matching client certs
407*0Sstevel@tonic-gate * are at the end of the list of keys, use the number of
408*0Sstevel@tonic-gate * client certs to compute the position of the last private
409*0Sstevel@tonic-gate * key which matches a client cert.
410*0Sstevel@tonic-gate */
411*0Sstevel@tonic-gate n = sk_X509_num(work_cl) - 1;
412*0Sstevel@tonic-gate retval = get_key_cert(n, work_kl, pkey, work_cl, cert);
413*0Sstevel@tonic-gate if (retval != 0) {
414*0Sstevel@tonic-gate if (retval == -1)
415*0Sstevel@tonic-gate goto cleanup;
416*0Sstevel@tonic-gate else
417*0Sstevel@tonic-gate goto last_part;
418*0Sstevel@tonic-gate }
419*0Sstevel@tonic-gate }
420*0Sstevel@tonic-gate
421*0Sstevel@tonic-gate if (matchty & DO_UNMATCHING) {
422*0Sstevel@tonic-gate STACK_OF(EVP_PKEY) *tmpk;
423*0Sstevel@tonic-gate STACK_OF(X509) *tmpc;
424*0Sstevel@tonic-gate
425*0Sstevel@tonic-gate /* Find the first cert and private key and return them */
426*0Sstevel@tonic-gate tmpc = work_cl;
427*0Sstevel@tonic-gate if (work_cl == NULL || sk_X509_num(work_cl) == 0)
428*0Sstevel@tonic-gate tmpc = work_ca;
429*0Sstevel@tonic-gate tmpk = work_kl;
430*0Sstevel@tonic-gate if (work_kl == NULL || sk_EVP_PKEY_num(work_kl) == 0)
431*0Sstevel@tonic-gate tmpk = nocerts;
432*0Sstevel@tonic-gate retval = get_key_cert(0, tmpk, pkey, tmpc, cert);
433*0Sstevel@tonic-gate if (retval != 0) {
434*0Sstevel@tonic-gate if (retval == -1)
435*0Sstevel@tonic-gate goto cleanup;
436*0Sstevel@tonic-gate else
437*0Sstevel@tonic-gate goto last_part;
438*0Sstevel@tonic-gate }
439*0Sstevel@tonic-gate }
440*0Sstevel@tonic-gate
441*0Sstevel@tonic-gate last_part:
442*0Sstevel@tonic-gate /* If no errors, terminate normally */
443*0Sstevel@tonic-gate if (retval != -1)
444*0Sstevel@tonic-gate retval |= set_results(NULL, NULL, NULL, NULL, ca, &work_ca,
445*0Sstevel@tonic-gate NULL, NULL);
446*0Sstevel@tonic-gate if (retval >= 0) {
447*0Sstevel@tonic-gate goto clean_part;
448*0Sstevel@tonic-gate }
449*0Sstevel@tonic-gate
450*0Sstevel@tonic-gate /* Fallthrough is intentional in error cases. */
451*0Sstevel@tonic-gate cleanup:
452*0Sstevel@tonic-gate if (pkey != NULL && *pkey != NULL) {
453*0Sstevel@tonic-gate sunw_evp_pkey_free(*pkey);
454*0Sstevel@tonic-gate *pkey = NULL;
455*0Sstevel@tonic-gate }
456*0Sstevel@tonic-gate if (cert != NULL && *cert != NULL) {
457*0Sstevel@tonic-gate X509_free(*cert);
458*0Sstevel@tonic-gate *cert = NULL;
459*0Sstevel@tonic-gate }
460*0Sstevel@tonic-gate
461*0Sstevel@tonic-gate clean_part:
462*0Sstevel@tonic-gate
463*0Sstevel@tonic-gate if (work_kl != NULL) {
464*0Sstevel@tonic-gate sk_EVP_PKEY_pop_free(work_kl, sunw_evp_pkey_free);
465*0Sstevel@tonic-gate }
466*0Sstevel@tonic-gate if (work_ca != NULL)
467*0Sstevel@tonic-gate sk_X509_pop_free(work_ca, X509_free);
468*0Sstevel@tonic-gate if (work_cl != NULL)
469*0Sstevel@tonic-gate sk_X509_pop_free(work_cl, X509_free);
470*0Sstevel@tonic-gate
471*0Sstevel@tonic-gate return (retval);
472*0Sstevel@tonic-gate }
473*0Sstevel@tonic-gate
474*0Sstevel@tonic-gate /*
475*0Sstevel@tonic-gate * sunw_PKCS12_contents() parses a pkcs#12 structure and returns component
476*0Sstevel@tonic-gate * parts found, without evaluation.
477*0Sstevel@tonic-gate *
478*0Sstevel@tonic-gate * Parse and decrypt a PKCS#12 structure returning any user keys and/or
479*0Sstevel@tonic-gate * various certs. Note these should either be NULL, *whatever should
480*0Sstevel@tonic-gate * be NULL, or it should point to a valid STACK_OF(X509) structure.
481*0Sstevel@tonic-gate *
482*0Sstevel@tonic-gate * Arguments:
483*0Sstevel@tonic-gate * p12 - Structure with pkcs12 info to be parsed
484*0Sstevel@tonic-gate * pass - Pass phrase for the private key and entire pkcs12 wad (possibly
485*0Sstevel@tonic-gate * empty) or NULL if there is none.
486*0Sstevel@tonic-gate * pkeys - Points to address of a stack of private keys to return.
487*0Sstevel@tonic-gate * certs - Points to address of a stack of client certs return.
488*0Sstevel@tonic-gate *
489*0Sstevel@tonic-gate * Note: The certs and keys being returned are in random order.
490*0Sstevel@tonic-gate *
491*0Sstevel@tonic-gate * Returns:
492*0Sstevel@tonic-gate * < 0 - An error returned. Call ERR_get_error() to get errors information.
493*0Sstevel@tonic-gate * Where possible, memory has been freed.
494*0Sstevel@tonic-gate * >= 0 - Objects were found and returned. Which objects are indicated by
495*0Sstevel@tonic-gate * which bits are set (FOUND_PKEY or FOUND_CERT)
496*0Sstevel@tonic-gate */
497*0Sstevel@tonic-gate static int
sunw_PKCS12_contents(PKCS12 * p12,const char * pass,STACK_OF (EVP_PKEY)** pkey,STACK_OF (X509)** certs)498*0Sstevel@tonic-gate sunw_PKCS12_contents(PKCS12 *p12, const char *pass, STACK_OF(EVP_PKEY) **pkey,
499*0Sstevel@tonic-gate STACK_OF(X509) **certs)
500*0Sstevel@tonic-gate {
501*0Sstevel@tonic-gate STACK_OF(EVP_PKEY) *work_kl = NULL;
502*0Sstevel@tonic-gate STACK_OF(X509) *work_ca = NULL;
503*0Sstevel@tonic-gate int retval = -1;
504*0Sstevel@tonic-gate
505*0Sstevel@tonic-gate /*
506*0Sstevel@tonic-gate * Allocate the working stacks for private key and for the
507*0Sstevel@tonic-gate * ca certs.
508*0Sstevel@tonic-gate */
509*0Sstevel@tonic-gate if ((work_kl = sk_EVP_PKEY_new_null()) == NULL) {
510*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CONTENTS, SUNW_R_MEMORY_FAILURE);
511*0Sstevel@tonic-gate goto cleanup;
512*0Sstevel@tonic-gate }
513*0Sstevel@tonic-gate
514*0Sstevel@tonic-gate if ((work_ca = sk_X509_new_null()) == NULL) {
515*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CONTENTS, SUNW_R_MEMORY_FAILURE);
516*0Sstevel@tonic-gate goto cleanup;
517*0Sstevel@tonic-gate }
518*0Sstevel@tonic-gate
519*0Sstevel@tonic-gate if (parse_outer(p12, pass, work_kl, work_ca) == 0) {
520*0Sstevel@tonic-gate /*
521*0Sstevel@tonic-gate * Error already on stack
522*0Sstevel@tonic-gate */
523*0Sstevel@tonic-gate goto cleanup;
524*0Sstevel@tonic-gate }
525*0Sstevel@tonic-gate
526*0Sstevel@tonic-gate /* on error, set_results() returns an error on the stack */
527*0Sstevel@tonic-gate retval = set_results(pkey, &work_kl, certs, &work_ca, NULL,
528*0Sstevel@tonic-gate NULL, NULL, NULL);
529*0Sstevel@tonic-gate
530*0Sstevel@tonic-gate cleanup:
531*0Sstevel@tonic-gate if (work_kl != NULL) {
532*0Sstevel@tonic-gate sk_EVP_PKEY_pop_free(work_kl, sunw_evp_pkey_free);
533*0Sstevel@tonic-gate }
534*0Sstevel@tonic-gate
535*0Sstevel@tonic-gate return (retval);
536*0Sstevel@tonic-gate }
537*0Sstevel@tonic-gate
538*0Sstevel@tonic-gate /*
539*0Sstevel@tonic-gate * parse_outer - Unpack the outer PKCS#12 structure and go through the
540*0Sstevel@tonic-gate * individual bags. Return stacks of certs, private keys found and
541*0Sstevel@tonic-gate * CA certs found.
542*0Sstevel@tonic-gate *
543*0Sstevel@tonic-gate * Note about error codes: This function is an internal function, and the
544*0Sstevel@tonic-gate * place where it is called sets error codes.
545*0Sstevel@tonic-gate *
546*0Sstevel@tonic-gate * Returns:
547*0Sstevel@tonic-gate * 0 - An error returned. Call ERR_get_error() to get errors information.
548*0Sstevel@tonic-gate * Where possible, memory has been freed.
549*0Sstevel@tonic-gate * 1 - PKCS12 data object was parsed and lists of certs and private keys
550*0Sstevel@tonic-gate * were returned.
551*0Sstevel@tonic-gate */
552*0Sstevel@tonic-gate static int
parse_outer(PKCS12 * p12,const char * pass,STACK_OF (EVP_PKEY)* kl,STACK_OF (X509)* cl)553*0Sstevel@tonic-gate parse_outer(PKCS12 *p12, const char *pass, STACK_OF(EVP_PKEY) *kl,
554*0Sstevel@tonic-gate STACK_OF(X509) *cl)
555*0Sstevel@tonic-gate {
556*0Sstevel@tonic-gate STACK_OF(PKCS12_SAFEBAG) *bags;
557*0Sstevel@tonic-gate STACK_OF(PKCS7) *asafes;
558*0Sstevel@tonic-gate int i, bagnid;
559*0Sstevel@tonic-gate PKCS7 *p7;
560*0Sstevel@tonic-gate
561*0Sstevel@tonic-gate if ((asafes = M_PKCS12_unpack_authsafes(p12)) == NULL)
562*0Sstevel@tonic-gate return (0);
563*0Sstevel@tonic-gate
564*0Sstevel@tonic-gate for (i = 0; i < sk_PKCS7_num(asafes); i++) {
565*0Sstevel@tonic-gate p7 = sk_PKCS7_value(asafes, i);
566*0Sstevel@tonic-gate bagnid = OBJ_obj2nid(p7->type);
567*0Sstevel@tonic-gate if (bagnid == NID_pkcs7_data) {
568*0Sstevel@tonic-gate bags = M_PKCS12_unpack_p7data(p7);
569*0Sstevel@tonic-gate } else if (bagnid == NID_pkcs7_encrypted) {
570*0Sstevel@tonic-gate /*
571*0Sstevel@tonic-gate * A length of '-1' means strlen() can be used
572*0Sstevel@tonic-gate * to determine the password length.
573*0Sstevel@tonic-gate */
574*0Sstevel@tonic-gate bags = M_PKCS12_unpack_p7encdata(p7, pass, -1);
575*0Sstevel@tonic-gate } else {
576*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_OUTER, SUNW_R_BAD_BAGTYPE);
577*0Sstevel@tonic-gate return (0);
578*0Sstevel@tonic-gate }
579*0Sstevel@tonic-gate
580*0Sstevel@tonic-gate if (bags == NULL) {
581*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_OUTER, SUNW_R_PARSE_BAG_ERR);
582*0Sstevel@tonic-gate sk_PKCS7_pop_free(asafes, PKCS7_free);
583*0Sstevel@tonic-gate return (0);
584*0Sstevel@tonic-gate }
585*0Sstevel@tonic-gate if (parse_all_bags(bags, pass, kl, cl) == 0) {
586*0Sstevel@tonic-gate sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
587*0Sstevel@tonic-gate sk_PKCS7_pop_free(asafes, PKCS7_free);
588*0Sstevel@tonic-gate return (0);
589*0Sstevel@tonic-gate }
590*0Sstevel@tonic-gate }
591*0Sstevel@tonic-gate
592*0Sstevel@tonic-gate return (1);
593*0Sstevel@tonic-gate }
594*0Sstevel@tonic-gate
595*0Sstevel@tonic-gate /*
596*0Sstevel@tonic-gate * parse_all_bags - go through the stack of bags, parsing each.
597*0Sstevel@tonic-gate *
598*0Sstevel@tonic-gate * Note about error codes: This function is an internal function, and the
599*0Sstevel@tonic-gate * place where it is called sets error codes.
600*0Sstevel@tonic-gate *
601*0Sstevel@tonic-gate * Returns:
602*0Sstevel@tonic-gate * 0 - An error returned. Call ERR_get_error() to get errors information.
603*0Sstevel@tonic-gate * Where possible, memory has been freed.
604*0Sstevel@tonic-gate * 1 - Stack of safebags was parsed and lists of certs and private keys
605*0Sstevel@tonic-gate * were returned.
606*0Sstevel@tonic-gate */
607*0Sstevel@tonic-gate static int
parse_all_bags(STACK_OF (PKCS12_SAFEBAG)* bags,const char * pass,STACK_OF (EVP_PKEY)* kl,STACK_OF (X509)* cl)608*0Sstevel@tonic-gate parse_all_bags(STACK_OF(PKCS12_SAFEBAG) *bags, const char *pass,
609*0Sstevel@tonic-gate STACK_OF(EVP_PKEY) *kl, STACK_OF(X509) *cl)
610*0Sstevel@tonic-gate {
611*0Sstevel@tonic-gate int i;
612*0Sstevel@tonic-gate for (i = 0; i < sk_PKCS12_SAFEBAG_num(bags); i++) {
613*0Sstevel@tonic-gate if (parse_one_bag(sk_PKCS12_SAFEBAG_value(bags, i),
614*0Sstevel@tonic-gate pass, kl, cl) == 0)
615*0Sstevel@tonic-gate return (0);
616*0Sstevel@tonic-gate }
617*0Sstevel@tonic-gate return (1);
618*0Sstevel@tonic-gate }
619*0Sstevel@tonic-gate
620*0Sstevel@tonic-gate /*
621*0Sstevel@tonic-gate * parse_one_bag - Parse an individual bag
622*0Sstevel@tonic-gate *
623*0Sstevel@tonic-gate * i = parse_one_bag(bag, pass, kl, cl);
624*0Sstevel@tonic-gate *
625*0Sstevel@tonic-gate * Arguments:
626*0Sstevel@tonic-gate * bag - pkcs12 safebag to parse.
627*0Sstevel@tonic-gate * pass - password for use in decryption of shrouded keybag
628*0Sstevel@tonic-gate * kl - Stack of private keys found so far. New private keys will
629*0Sstevel@tonic-gate * be added here if found.
630*0Sstevel@tonic-gate * cl - Stack of certs found so far. New certificates will be
631*0Sstevel@tonic-gate * added here if found.
632*0Sstevel@tonic-gate *
633*0Sstevel@tonic-gate * Returns:
634*0Sstevel@tonic-gate * 0 - An error returned. Call ERR_get_error() to get errors information.
635*0Sstevel@tonic-gate * Where possible, memory has been freed.
636*0Sstevel@tonic-gate * 1 - one safebag was parsed. If it contained a cert or private key, it
637*0Sstevel@tonic-gate * was added to the stack of certs or private keys found, respectively.
638*0Sstevel@tonic-gate * localKeyId or friendlyName attributes are returned with the
639*0Sstevel@tonic-gate * private key or certificate.
640*0Sstevel@tonic-gate */
641*0Sstevel@tonic-gate static int
parse_one_bag(PKCS12_SAFEBAG * bag,const char * pass,STACK_OF (EVP_PKEY)* kl,STACK_OF (X509)* cl)642*0Sstevel@tonic-gate parse_one_bag(PKCS12_SAFEBAG *bag, const char *pass, STACK_OF(EVP_PKEY) *kl,
643*0Sstevel@tonic-gate STACK_OF(X509) *cl)
644*0Sstevel@tonic-gate {
645*0Sstevel@tonic-gate X509_ATTRIBUTE *attr = NULL;
646*0Sstevel@tonic-gate ASN1_TYPE *keyid = NULL;
647*0Sstevel@tonic-gate ASN1_TYPE *fname = NULL;
648*0Sstevel@tonic-gate PKCS8_PRIV_KEY_INFO *p8;
649*0Sstevel@tonic-gate EVP_PKEY *pkey = NULL;
650*0Sstevel@tonic-gate X509 *x509 = NULL;
651*0Sstevel@tonic-gate uchar_t *data = NULL;
652*0Sstevel@tonic-gate char *str = NULL;
653*0Sstevel@tonic-gate int retval = 1;
654*0Sstevel@tonic-gate
655*0Sstevel@tonic-gate keyid = PKCS12_get_attr(bag, NID_localKeyID);
656*0Sstevel@tonic-gate fname = PKCS12_get_attr(bag, NID_friendlyName);
657*0Sstevel@tonic-gate
658*0Sstevel@tonic-gate switch (M_PKCS12_bag_type(bag)) {
659*0Sstevel@tonic-gate case NID_keyBag:
660*0Sstevel@tonic-gate if ((pkey = EVP_PKCS82PKEY(bag->value.keybag)) == NULL) {
661*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG, SUNW_R_PARSE_BAG_ERR);
662*0Sstevel@tonic-gate retval = 0;
663*0Sstevel@tonic-gate break;
664*0Sstevel@tonic-gate }
665*0Sstevel@tonic-gate break;
666*0Sstevel@tonic-gate
667*0Sstevel@tonic-gate case NID_pkcs8ShroudedKeyBag:
668*0Sstevel@tonic-gate /*
669*0Sstevel@tonic-gate * A length of '-1' means strlen() can be used
670*0Sstevel@tonic-gate * to determine the password length.
671*0Sstevel@tonic-gate */
672*0Sstevel@tonic-gate if ((p8 = M_PKCS12_decrypt_skey(bag, pass, -1)) == NULL) {
673*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG, SUNW_R_PARSE_BAG_ERR);
674*0Sstevel@tonic-gate retval = 0;
675*0Sstevel@tonic-gate break;
676*0Sstevel@tonic-gate }
677*0Sstevel@tonic-gate pkey = EVP_PKCS82PKEY(p8);
678*0Sstevel@tonic-gate PKCS8_PRIV_KEY_INFO_free(p8);
679*0Sstevel@tonic-gate if (pkey == NULL) {
680*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG, SUNW_R_PARSE_BAG_ERR);
681*0Sstevel@tonic-gate retval = 0;
682*0Sstevel@tonic-gate }
683*0Sstevel@tonic-gate break;
684*0Sstevel@tonic-gate
685*0Sstevel@tonic-gate case NID_certBag:
686*0Sstevel@tonic-gate if (M_PKCS12_cert_bag_type(bag) != NID_x509Certificate) {
687*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG, SUNW_R_BAD_CERTTYPE);
688*0Sstevel@tonic-gate break;
689*0Sstevel@tonic-gate }
690*0Sstevel@tonic-gate if ((x509 = M_PKCS12_certbag2x509(bag)) == NULL) {
691*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG,
692*0Sstevel@tonic-gate SUNW_R_PARSE_CERT_ERR);
693*0Sstevel@tonic-gate retval = 0;
694*0Sstevel@tonic-gate break;
695*0Sstevel@tonic-gate }
696*0Sstevel@tonic-gate
697*0Sstevel@tonic-gate if (keyid != NULL) {
698*0Sstevel@tonic-gate if (keyid->type != V_ASN1_OCTET_STRING) {
699*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG,
700*0Sstevel@tonic-gate SUNW_R_BAD_LKID);
701*0Sstevel@tonic-gate retval = 0;
702*0Sstevel@tonic-gate break;
703*0Sstevel@tonic-gate }
704*0Sstevel@tonic-gate if (X509_keyid_set1(x509,
705*0Sstevel@tonic-gate keyid->value.octet_string->data,
706*0Sstevel@tonic-gate keyid->value.octet_string->length) == 0) {
707*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG,
708*0Sstevel@tonic-gate SUNW_R_SET_LKID_ERR);
709*0Sstevel@tonic-gate retval = 0;
710*0Sstevel@tonic-gate break;
711*0Sstevel@tonic-gate }
712*0Sstevel@tonic-gate }
713*0Sstevel@tonic-gate
714*0Sstevel@tonic-gate if (fname != NULL) {
715*0Sstevel@tonic-gate ASN1_STRING *tmpstr = NULL;
716*0Sstevel@tonic-gate int len;
717*0Sstevel@tonic-gate
718*0Sstevel@tonic-gate if (fname->type != V_ASN1_BMPSTRING) {
719*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG,
720*0Sstevel@tonic-gate SUNW_R_BAD_FNAME);
721*0Sstevel@tonic-gate retval = 0;
722*0Sstevel@tonic-gate break;
723*0Sstevel@tonic-gate }
724*0Sstevel@tonic-gate
725*0Sstevel@tonic-gate tmpstr = fname->value.asn1_string;
726*0Sstevel@tonic-gate len = ASN1_STRING_to_UTF8(&data, tmpstr);
727*0Sstevel@tonic-gate if (len < 0) {
728*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG,
729*0Sstevel@tonic-gate SUNW_R_SET_FNAME_ERR);
730*0Sstevel@tonic-gate retval = 0;
731*0Sstevel@tonic-gate break;
732*0Sstevel@tonic-gate }
733*0Sstevel@tonic-gate
734*0Sstevel@tonic-gate if (X509_alias_set1(x509, data, len) == 0) {
735*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG,
736*0Sstevel@tonic-gate SUNW_R_SET_FNAME_ERR);
737*0Sstevel@tonic-gate retval = 0;
738*0Sstevel@tonic-gate break;
739*0Sstevel@tonic-gate }
740*0Sstevel@tonic-gate }
741*0Sstevel@tonic-gate
742*0Sstevel@tonic-gate if (sk_X509_push(cl, x509) == 0) {
743*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG, SUNW_R_MEMORY_FAILURE);
744*0Sstevel@tonic-gate retval = 0;
745*0Sstevel@tonic-gate break;
746*0Sstevel@tonic-gate }
747*0Sstevel@tonic-gate x509 = NULL;
748*0Sstevel@tonic-gate break;
749*0Sstevel@tonic-gate
750*0Sstevel@tonic-gate case NID_safeContentsBag:
751*0Sstevel@tonic-gate if (keyid != NULL)
752*0Sstevel@tonic-gate ASN1_TYPE_free(keyid);
753*0Sstevel@tonic-gate if (fname != NULL)
754*0Sstevel@tonic-gate ASN1_TYPE_free(fname);
755*0Sstevel@tonic-gate if (parse_all_bags(bag->value.safes, pass, kl, cl) == 0) {
756*0Sstevel@tonic-gate /*
757*0Sstevel@tonic-gate * Error already on stack
758*0Sstevel@tonic-gate */
759*0Sstevel@tonic-gate return (0);
760*0Sstevel@tonic-gate }
761*0Sstevel@tonic-gate return (1);
762*0Sstevel@tonic-gate
763*0Sstevel@tonic-gate default:
764*0Sstevel@tonic-gate if (keyid != NULL)
765*0Sstevel@tonic-gate ASN1_TYPE_free(keyid);
766*0Sstevel@tonic-gate if (fname != NULL)
767*0Sstevel@tonic-gate ASN1_TYPE_free(fname);
768*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG, SUNW_R_BAD_BAGTYPE);
769*0Sstevel@tonic-gate return (0);
770*0Sstevel@tonic-gate }
771*0Sstevel@tonic-gate
772*0Sstevel@tonic-gate
773*0Sstevel@tonic-gate if (pkey != NULL) {
774*0Sstevel@tonic-gate if (retval != 0 && (keyid != NULL || fname != NULL) &&
775*0Sstevel@tonic-gate pkey->attributes == NULL) {
776*0Sstevel@tonic-gate pkey->attributes = sk_X509_ATTRIBUTE_new_null();
777*0Sstevel@tonic-gate if (pkey->attributes == NULL) {
778*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG,
779*0Sstevel@tonic-gate SUNW_R_MEMORY_FAILURE);
780*0Sstevel@tonic-gate retval = 0;
781*0Sstevel@tonic-gate }
782*0Sstevel@tonic-gate }
783*0Sstevel@tonic-gate
784*0Sstevel@tonic-gate if (retval != 0 && keyid != NULL) {
785*0Sstevel@tonic-gate attr = type2attrib(keyid, NID_localKeyID);
786*0Sstevel@tonic-gate if (attr == NULL)
787*0Sstevel@tonic-gate /*
788*0Sstevel@tonic-gate * Error already on stack
789*0Sstevel@tonic-gate */
790*0Sstevel@tonic-gate retval = 0;
791*0Sstevel@tonic-gate else {
792*0Sstevel@tonic-gate keyid = NULL;
793*0Sstevel@tonic-gate if (sk_X509_ATTRIBUTE_push(pkey->attributes,
794*0Sstevel@tonic-gate attr) == 0) {
795*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG,
796*0Sstevel@tonic-gate SUNW_R_MEMORY_FAILURE);
797*0Sstevel@tonic-gate retval = 0;
798*0Sstevel@tonic-gate } else {
799*0Sstevel@tonic-gate attr = NULL;
800*0Sstevel@tonic-gate }
801*0Sstevel@tonic-gate }
802*0Sstevel@tonic-gate }
803*0Sstevel@tonic-gate
804*0Sstevel@tonic-gate if (retval != 0 && fname != NULL) {
805*0Sstevel@tonic-gate attr = type2attrib(fname, NID_friendlyName);
806*0Sstevel@tonic-gate if (attr == NULL) {
807*0Sstevel@tonic-gate /*
808*0Sstevel@tonic-gate * Error already on stack
809*0Sstevel@tonic-gate */
810*0Sstevel@tonic-gate retval = 0;
811*0Sstevel@tonic-gate } else {
812*0Sstevel@tonic-gate fname = NULL;
813*0Sstevel@tonic-gate if (sk_X509_ATTRIBUTE_push(pkey->attributes,
814*0Sstevel@tonic-gate attr) == 0) {
815*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG,
816*0Sstevel@tonic-gate SUNW_R_MEMORY_FAILURE);
817*0Sstevel@tonic-gate retval = 0;
818*0Sstevel@tonic-gate } else {
819*0Sstevel@tonic-gate attr = NULL;
820*0Sstevel@tonic-gate }
821*0Sstevel@tonic-gate }
822*0Sstevel@tonic-gate }
823*0Sstevel@tonic-gate
824*0Sstevel@tonic-gate /* Save the private key */
825*0Sstevel@tonic-gate if (retval != 0) {
826*0Sstevel@tonic-gate if (sk_EVP_PKEY_push(kl, pkey) == 0) {
827*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG,
828*0Sstevel@tonic-gate SUNW_R_MEMORY_FAILURE);
829*0Sstevel@tonic-gate retval = 0;
830*0Sstevel@tonic-gate } else {
831*0Sstevel@tonic-gate pkey = NULL;
832*0Sstevel@tonic-gate }
833*0Sstevel@tonic-gate }
834*0Sstevel@tonic-gate }
835*0Sstevel@tonic-gate
836*0Sstevel@tonic-gate if (pkey != NULL) {
837*0Sstevel@tonic-gate sunw_evp_pkey_free(pkey);
838*0Sstevel@tonic-gate }
839*0Sstevel@tonic-gate
840*0Sstevel@tonic-gate if (x509 != NULL)
841*0Sstevel@tonic-gate X509_free(x509);
842*0Sstevel@tonic-gate
843*0Sstevel@tonic-gate if (keyid != NULL)
844*0Sstevel@tonic-gate ASN1_TYPE_free(keyid);
845*0Sstevel@tonic-gate
846*0Sstevel@tonic-gate if (fname != NULL)
847*0Sstevel@tonic-gate ASN1_TYPE_free(fname);
848*0Sstevel@tonic-gate
849*0Sstevel@tonic-gate if (attr != NULL)
850*0Sstevel@tonic-gate X509_ATTRIBUTE_free(attr);
851*0Sstevel@tonic-gate
852*0Sstevel@tonic-gate if (data != NULL)
853*0Sstevel@tonic-gate OPENSSL_free(data);
854*0Sstevel@tonic-gate
855*0Sstevel@tonic-gate if (str != NULL)
856*0Sstevel@tonic-gate OPENSSL_free(str);
857*0Sstevel@tonic-gate
858*0Sstevel@tonic-gate return (retval);
859*0Sstevel@tonic-gate }
860