1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * ==================================================================== 3*0Sstevel@tonic-gate * Copyright (c) 1999 The OpenSSL Project. All rights reserved. 4*0Sstevel@tonic-gate * 5*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without 6*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions 7*0Sstevel@tonic-gate * are met: 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the above copyright 10*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer. 11*0Sstevel@tonic-gate * 12*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright 13*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in 14*0Sstevel@tonic-gate * the documentation and/or other materials provided with the 15*0Sstevel@tonic-gate * distribution. 16*0Sstevel@tonic-gate * 17*0Sstevel@tonic-gate * 3. All advertising materials mentioning features or use of this 18*0Sstevel@tonic-gate * software must display the following acknowledgment: 19*0Sstevel@tonic-gate * "This product includes software developed by the OpenSSL Project 20*0Sstevel@tonic-gate * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 21*0Sstevel@tonic-gate * 22*0Sstevel@tonic-gate * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 23*0Sstevel@tonic-gate * endorse or promote products derived from this software without 24*0Sstevel@tonic-gate * prior written permission. For written permission, please contact 25*0Sstevel@tonic-gate * licensing@OpenSSL.org. 26*0Sstevel@tonic-gate * 27*0Sstevel@tonic-gate * 5. Products derived from this software may not be called "OpenSSL" 28*0Sstevel@tonic-gate * nor may "OpenSSL" appear in their names without prior written 29*0Sstevel@tonic-gate * permission of the OpenSSL Project. 30*0Sstevel@tonic-gate * 31*0Sstevel@tonic-gate * 6. Redistributions of any form whatsoever must retain the following 32*0Sstevel@tonic-gate * acknowledgment: 33*0Sstevel@tonic-gate * "This product includes software developed by the OpenSSL Project 34*0Sstevel@tonic-gate * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 35*0Sstevel@tonic-gate * 36*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 37*0Sstevel@tonic-gate * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 38*0Sstevel@tonic-gate * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 39*0Sstevel@tonic-gate * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 40*0Sstevel@tonic-gate * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 41*0Sstevel@tonic-gate * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 42*0Sstevel@tonic-gate * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 43*0Sstevel@tonic-gate * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 44*0Sstevel@tonic-gate * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 45*0Sstevel@tonic-gate * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 46*0Sstevel@tonic-gate * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 47*0Sstevel@tonic-gate * OF THE POSSIBILITY OF SUCH DAMAGE. 48*0Sstevel@tonic-gate * ==================================================================== 49*0Sstevel@tonic-gate * 50*0Sstevel@tonic-gate * This product includes cryptographic software written by Eric Young 51*0Sstevel@tonic-gate * (eay@cryptsoft.com). This product includes software written by Tim 52*0Sstevel@tonic-gate * Hudson (tjh@cryptsoft.com). 53*0Sstevel@tonic-gate * 54*0Sstevel@tonic-gate */ 55*0Sstevel@tonic-gate 56*0Sstevel@tonic-gate /* 57*0Sstevel@tonic-gate * Copyright 2002, 2003 Sun Microsystems, Inc. All rights reserved. 58*0Sstevel@tonic-gate * Use is subject to license terms. 59*0Sstevel@tonic-gate */ 60*0Sstevel@tonic-gate 61*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 62*0Sstevel@tonic-gate 63*0Sstevel@tonic-gate #include <stdio.h> 64*0Sstevel@tonic-gate #include <strings.h> 65*0Sstevel@tonic-gate #include <stdlib.h> 66*0Sstevel@tonic-gate 67*0Sstevel@tonic-gate #include <openssl/crypto.h> 68*0Sstevel@tonic-gate #include <openssl/err.h> 69*0Sstevel@tonic-gate #include <openssl/x509.h> 70*0Sstevel@tonic-gate 71*0Sstevel@tonic-gate #include <openssl/pkcs12.h> 72*0Sstevel@tonic-gate #include <p12aux.h> 73*0Sstevel@tonic-gate #include <auxutil.h> 74*0Sstevel@tonic-gate #include <p12err.h> 75*0Sstevel@tonic-gate 76*0Sstevel@tonic-gate /* 77*0Sstevel@tonic-gate * Briefly, a note on the APIs provided by this module. 78*0Sstevel@tonic-gate * 79*0Sstevel@tonic-gate * The sunw_PKCS_parse, parse_pkcs12 and sunw_PKCS12_contents APIs 80*0Sstevel@tonic-gate * replace OpenSSL funcionality provided by PKCS12_parse and its 81*0Sstevel@tonic-gate * supporting routines. 82*0Sstevel@tonic-gate * 83*0Sstevel@tonic-gate * The APIs provided here provide more functionality: 84*0Sstevel@tonic-gate * 85*0Sstevel@tonic-gate * - sunw_PKCS12_parse provides: 86*0Sstevel@tonic-gate * 87*0Sstevel@tonic-gate * earlier MAC processing than PKCS12_parse 88*0Sstevel@tonic-gate * 89*0Sstevel@tonic-gate * treats the handling of the difference between CA certs and certs 90*0Sstevel@tonic-gate * with matching private keys differently that PKCS12_parse does. In 91*0Sstevel@tonic-gate * PKCS12_parse, any cert which is not the one selected is assumed to be 92*0Sstevel@tonic-gate * a CA cert. In parse_pkcs12, certs which have matching private keys are 93*0Sstevel@tonic-gate * not returned as part of the CA certs. 94*0Sstevel@tonic-gate * 95*0Sstevel@tonic-gate * the matching of private keys and certs is done at this level, rather than 96*0Sstevel@tonic-gate * at the lower levels which were used in the openssl implementation. This 97*0Sstevel@tonic-gate * is part of the changes introduced so that the parsing functions can 98*0Sstevel@tonic-gate * return just a cert, just a private key, the stack of CA certs or any 99*0Sstevel@tonic-gate * combination. 100*0Sstevel@tonic-gate * 101*0Sstevel@tonic-gate * added DO_FIRST_PAIR, DO_LAST_PAIR and DO_UNMATCHING matchty support. 102*0Sstevel@tonic-gate * 103*0Sstevel@tonic-gate * do a much better job of cleaning up. Specifically, free the added 104*0Sstevel@tonic-gate * attributes on the private key which was done by calling 105*0Sstevel@tonic-gate * sunw_evp_pkey_free(). 106*0Sstevel@tonic-gate * 107*0Sstevel@tonic-gate * in sunw_PKCS12_contents, handle allocation of the stacks of certificates 108*0Sstevel@tonic-gate * and private keys so that a) the original stacks are not changed unless 109*0Sstevel@tonic-gate * the parsing was successful; b) it will either extend stacks passed in, 110*0Sstevel@tonic-gate * or allocate new ones if none were supplied. 111*0Sstevel@tonic-gate * 112*0Sstevel@tonic-gate * - for parse_outer vs. parse_pk12() (from the openssl source base): 113*0Sstevel@tonic-gate * 114*0Sstevel@tonic-gate * this calls lower levels with stacks of private keys and certs, rather 115*0Sstevel@tonic-gate * that a cert, a private key and a stack for CA certs. 116*0Sstevel@tonic-gate * 117*0Sstevel@tonic-gate * - In the case of parse_all_bags vs. parse_bags, there is no real difference, 118*0Sstevel@tonic-gate * other than use of stacks of private keys and certificates (as opposed 119*0Sstevel@tonic-gate * to one cert, one private key and a stack of CA certificates). 120*0Sstevel@tonic-gate * 121*0Sstevel@tonic-gate * - Finally, for parse_one_bag vs. parse_bag: 122*0Sstevel@tonic-gate * 123*0Sstevel@tonic-gate * got rid of the bugs the openssl matching of keys and certificates. 124*0Sstevel@tonic-gate * 125*0Sstevel@tonic-gate * got rid of the requirement that there is one private key and a matching 126*0Sstevel@tonic-gate * cert somewhere in the input. This was done by moving the matching 127*0Sstevel@tonic-gate * code to a higher level. 128*0Sstevel@tonic-gate * 129*0Sstevel@tonic-gate * put any localKeyID and/or friendlyName attributes found in the structures 130*0Sstevel@tonic-gate * returned, so that they can be used at higher levels for searching, etc. 131*0Sstevel@tonic-gate * 132*0Sstevel@tonic-gate * added some error returns (like an error when there is an unsupported 133*0Sstevel@tonic-gate * bag type, an unsupported certificate type or an unsupported key type) 134*0Sstevel@tonic-gate * 135*0Sstevel@tonic-gate * Added cleanup before returning. 136*0Sstevel@tonic-gate */ 137*0Sstevel@tonic-gate 138*0Sstevel@tonic-gate static int parse_pkcs12(PKCS12 *, const char *, int, char *, int, char *, 139*0Sstevel@tonic-gate EVP_PKEY **, X509 **, STACK_OF(X509) **); 140*0Sstevel@tonic-gate 141*0Sstevel@tonic-gate static int parse_outer(PKCS12 *, const char *, STACK_OF(EVP_PKEY) *, 142*0Sstevel@tonic-gate STACK_OF(X509) *); 143*0Sstevel@tonic-gate 144*0Sstevel@tonic-gate static int parse_all_bags(STACK_OF(PKCS12_SAFEBAG) *, const char *, 145*0Sstevel@tonic-gate STACK_OF(EVP_PKEY) *, STACK_OF(X509) *); 146*0Sstevel@tonic-gate 147*0Sstevel@tonic-gate static int parse_one_bag(PKCS12_SAFEBAG *, const char *, STACK_OF(EVP_PKEY) *, 148*0Sstevel@tonic-gate STACK_OF(X509) *); 149*0Sstevel@tonic-gate 150*0Sstevel@tonic-gate static int sunw_PKCS12_contents(PKCS12 *p12, const char *pass, 151*0Sstevel@tonic-gate STACK_OF(EVP_PKEY) **pkey, STACK_OF(X509) **certs); 152*0Sstevel@tonic-gate 153*0Sstevel@tonic-gate /* 154*0Sstevel@tonic-gate * sunw_PKCS12_parse - Parse a PKCS12 structure and break it into its parts. 155*0Sstevel@tonic-gate * 156*0Sstevel@tonic-gate * Parse and decrypt a PKCS#12 structure returning user key, user cert and/or 157*0Sstevel@tonic-gate * other (CA) certs. Note either ca should be NULL, *ca should be NULL, 158*0Sstevel@tonic-gate * or it should point to a valid STACK_OF(X509) structure. pkey and cert can 159*0Sstevel@tonic-gate * be passed uninitialized. 160*0Sstevel@tonic-gate * 161*0Sstevel@tonic-gate * Arguments: 162*0Sstevel@tonic-gate * p12 - Structure with pkcs12 info to be parsed 163*0Sstevel@tonic-gate * pass - Pass phrase for the private key (possibly empty) or NULL if 164*0Sstevel@tonic-gate * there is none. 165*0Sstevel@tonic-gate * matchty - Info about which certs/keys to return if many are in the file. 166*0Sstevel@tonic-gate * keyid - If private key localkeyids friendlynames are to match a 167*0Sstevel@tonic-gate * predetermined value, the value to match. This value should 168*0Sstevel@tonic-gate * be an octet string. 169*0Sstevel@tonic-gate * keyid_len- Length of the keyid byte string. 170*0Sstevel@tonic-gate * name_str - If friendlynames are to match a predetermined value, the value 171*0Sstevel@tonic-gate * to match. This value should be a NULL terminated string. 172*0Sstevel@tonic-gate * pkey - Points to location pointing to the private key returned. 173*0Sstevel@tonic-gate * cert - Points to locaiton which points to the client cert returned 174*0Sstevel@tonic-gate * ca - Points to location that points to a stack of 'certificate 175*0Sstevel@tonic-gate * authority' certs/trust anchors. 176*0Sstevel@tonic-gate * 177*0Sstevel@tonic-gate * Match based on the value of 'matchty' and the contents of 'keyid' 178*0Sstevel@tonic-gate * and/or 'name_str', as appropriate. Go through the lists of certs and 179*0Sstevel@tonic-gate * private keys which were taken from the pkcs12 structure, looking for 180*0Sstevel@tonic-gate * matches of the requested type. This function only searches the lists of 181*0Sstevel@tonic-gate * matching private keys and client certificates. Kinds of matches allowed, 182*0Sstevel@tonic-gate * and the order in which they will be checked, are: 183*0Sstevel@tonic-gate * 184*0Sstevel@tonic-gate * 1) Find the key and/or cert whose localkeyid attributes matches 185*0Sstevel@tonic-gate * 'keyid'. 186*0Sstevel@tonic-gate * 2) Find the key and/or cert whose friendlyname attributes matches 187*0Sstevel@tonic-gate * 'name_str' 188*0Sstevel@tonic-gate * 3) Return the first matching key/cert pair found. 189*0Sstevel@tonic-gate * 4) Return the last matching key/cert pair found. 190*0Sstevel@tonic-gate * 5) Return whatever cert and/or key are available, even unmatching. 191*0Sstevel@tonic-gate * 192*0Sstevel@tonic-gate * Append to the CA list, the certs which do not have matching private 193*0Sstevel@tonic-gate * keys and which were not selected. 194*0Sstevel@tonic-gate * 195*0Sstevel@tonic-gate * If none of the bits are set, no client certs or private keys will be 196*0Sstevel@tonic-gate * returned. CA (aka trust anchor) certs can be. 197*0Sstevel@tonic-gate * 198*0Sstevel@tonic-gate * Notes: If #3 is selected, then #4 will never occur. CA certs will be 199*0Sstevel@tonic-gate * selected after a cert/key pairs are isolated. 200*0Sstevel@tonic-gate * 201*0Sstevel@tonic-gate * Returns: 202*0Sstevel@tonic-gate * < 0 - An error returned. Call ERR_get_error() to get errors information. 203*0Sstevel@tonic-gate * Where possible, memory has been freed. 204*0Sstevel@tonic-gate * >= 0 - Objects were found and returned. Which objects are indicated by 205*0Sstevel@tonic-gate * which bits are set (FOUND_PKEY, FOUND_CERT, FOUND_CA_CERTS). 206*0Sstevel@tonic-gate */ 207*0Sstevel@tonic-gate int 208*0Sstevel@tonic-gate sunw_PKCS12_parse(PKCS12 *p12, const char *pass, int matchty, char *keyid, 209*0Sstevel@tonic-gate int keyid_len, char *name_str, EVP_PKEY **pkey, X509 **cert, 210*0Sstevel@tonic-gate STACK_OF(X509) **ca) 211*0Sstevel@tonic-gate { 212*0Sstevel@tonic-gate boolean_t ca_supplied; 213*0Sstevel@tonic-gate int retval = -1; 214*0Sstevel@tonic-gate 215*0Sstevel@tonic-gate /* If NULL PKCS12 structure, this is an error */ 216*0Sstevel@tonic-gate if (p12 == NULL) { 217*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_PARSE, SUNW_R_INVALID_ARG); 218*0Sstevel@tonic-gate return (-1); 219*0Sstevel@tonic-gate } 220*0Sstevel@tonic-gate 221*0Sstevel@tonic-gate /* Set up arguments.... These will be allocated if needed */ 222*0Sstevel@tonic-gate if (pkey) 223*0Sstevel@tonic-gate *pkey = NULL; 224*0Sstevel@tonic-gate if (cert) 225*0Sstevel@tonic-gate *cert = NULL; 226*0Sstevel@tonic-gate 227*0Sstevel@tonic-gate /* 228*0Sstevel@tonic-gate * If there is already a ca list, use it. Otherwise, allocate one 229*0Sstevel@tonic-gate * and free is later if an error occurs or whatever.) 230*0Sstevel@tonic-gate */ 231*0Sstevel@tonic-gate ca_supplied = (ca != NULL && *ca != NULL); 232*0Sstevel@tonic-gate if (ca != NULL && *ca == NULL) { 233*0Sstevel@tonic-gate if ((*ca = sk_X509_new_null()) == NULL) { 234*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_PARSE, SUNW_R_MEMORY_FAILURE); 235*0Sstevel@tonic-gate return (-1); 236*0Sstevel@tonic-gate } 237*0Sstevel@tonic-gate } 238*0Sstevel@tonic-gate 239*0Sstevel@tonic-gate /* 240*0Sstevel@tonic-gate * If password is zero length or NULL then try verifying both cases 241*0Sstevel@tonic-gate * to determine which password is correct. The reason for this is that 242*0Sstevel@tonic-gate * under PKCS#12 password based encryption no password and a zero 243*0Sstevel@tonic-gate * length password are two different things. If the password has a 244*0Sstevel@tonic-gate * non-zero length and is not NULL then call PKCS12_verify_mac() with 245*0Sstevel@tonic-gate * a length of '-1' and let it use strlen() to figure out the length 246*0Sstevel@tonic-gate * of the password. 247*0Sstevel@tonic-gate */ 248*0Sstevel@tonic-gate /* Check the mac */ 249*0Sstevel@tonic-gate if (pass == NULL || *pass == '\0') { 250*0Sstevel@tonic-gate if (PKCS12_verify_mac(p12, NULL, 0)) 251*0Sstevel@tonic-gate pass = NULL; 252*0Sstevel@tonic-gate else if (PKCS12_verify_mac(p12, "", 0)) 253*0Sstevel@tonic-gate pass = ""; 254*0Sstevel@tonic-gate else { 255*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_PARSE, 256*0Sstevel@tonic-gate SUNW_R_MAC_VERIFY_FAILURE); 257*0Sstevel@tonic-gate goto err; 258*0Sstevel@tonic-gate } 259*0Sstevel@tonic-gate } else if (PKCS12_verify_mac(p12, pass, -1) == 0) { 260*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_PARSE, SUNW_R_MAC_VERIFY_FAILURE); 261*0Sstevel@tonic-gate goto err; 262*0Sstevel@tonic-gate } 263*0Sstevel@tonic-gate 264*0Sstevel@tonic-gate retval = parse_pkcs12(p12, pass, matchty, keyid, keyid_len, 265*0Sstevel@tonic-gate name_str, pkey, cert, ca); 266*0Sstevel@tonic-gate if (retval < 0) { 267*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_PARSE, SUNW_R_PKCS12_PARSE_ERR); 268*0Sstevel@tonic-gate goto err; 269*0Sstevel@tonic-gate } 270*0Sstevel@tonic-gate return (retval); 271*0Sstevel@tonic-gate 272*0Sstevel@tonic-gate err: 273*0Sstevel@tonic-gate if (pkey && *pkey) { 274*0Sstevel@tonic-gate sunw_evp_pkey_free(*pkey); 275*0Sstevel@tonic-gate } 276*0Sstevel@tonic-gate if (cert && *cert) 277*0Sstevel@tonic-gate X509_free(*cert); 278*0Sstevel@tonic-gate if (ca_supplied == B_FALSE && ca != NULL) 279*0Sstevel@tonic-gate sk_X509_pop_free(*ca, X509_free); 280*0Sstevel@tonic-gate 281*0Sstevel@tonic-gate return (-1); 282*0Sstevel@tonic-gate 283*0Sstevel@tonic-gate } 284*0Sstevel@tonic-gate 285*0Sstevel@tonic-gate /* 286*0Sstevel@tonic-gate * parse_pkcs12 - Oversee parsing of the pkcs12 structure. Get it 287*0Sstevel@tonic-gate * parsed. After that either return what's found directly, or 288*0Sstevel@tonic-gate * do any required matching. 289*0Sstevel@tonic-gate * 290*0Sstevel@tonic-gate * Arguments: 291*0Sstevel@tonic-gate * p12 - Structure with pkcs12 info to be parsed 292*0Sstevel@tonic-gate * pass - Pass phrase for the private key (possibly empty) or NULL if 293*0Sstevel@tonic-gate * there is none. 294*0Sstevel@tonic-gate * matchty - Info about which certs/keys to return if many are in the file. 295*0Sstevel@tonic-gate * keyid - If private key localkeyids friendlynames are to match a 296*0Sstevel@tonic-gate * predetermined value, the value to match. This value should 297*0Sstevel@tonic-gate * be an octet string. 298*0Sstevel@tonic-gate * keyid_len- Length of the keyid byte string. 299*0Sstevel@tonic-gate * name_str - If friendlynames are to match a predetermined value, the value 300*0Sstevel@tonic-gate * to match. This value should be a NULL terminated string. 301*0Sstevel@tonic-gate * pkey - Points to location pointing to the private key returned. 302*0Sstevel@tonic-gate * cert - Points to locaiton which points to the client cert returned 303*0Sstevel@tonic-gate * ca - Points to location that points to a stack of 'certificate 304*0Sstevel@tonic-gate * authority' certs/trust anchors. 305*0Sstevel@tonic-gate * 306*0Sstevel@tonic-gate * Note about error codes: This function is an internal function, and the 307*0Sstevel@tonic-gate * place where it is called sets error codes. Therefore only set an error 308*0Sstevel@tonic-gate * code if it is something that is unique or if the function which detected 309*0Sstevel@tonic-gate * the error doesn't set one. 310*0Sstevel@tonic-gate * 311*0Sstevel@tonic-gate * Returns: 312*0Sstevel@tonic-gate * == -1 - An error occurred. Call ERR_get_error() to get error information. 313*0Sstevel@tonic-gate * Where possible, memory has been freed. 314*0Sstevel@tonic-gate * == 0 - No matching returns were found. 315*0Sstevel@tonic-gate * > 0 - This is the aithmetic 'or' of the FOUND_* bits that indicate which 316*0Sstevel@tonic-gate * of the requested entries were found. 317*0Sstevel@tonic-gate */ 318*0Sstevel@tonic-gate static int 319*0Sstevel@tonic-gate parse_pkcs12(PKCS12 *p12, const char *pass, int matchty, char *keyid, 320*0Sstevel@tonic-gate int kstr_len, char *name_str, EVP_PKEY **pkey, X509 **cert, 321*0Sstevel@tonic-gate STACK_OF(X509) **ca) 322*0Sstevel@tonic-gate { 323*0Sstevel@tonic-gate STACK_OF(EVP_PKEY) *work_kl = NULL; /* Head for private key list */ 324*0Sstevel@tonic-gate STACK_OF(EVP_PKEY) *nocerts = NULL; /* Head for alt. key list */ 325*0Sstevel@tonic-gate STACK_OF(X509) *work_ca = NULL; /* Head for cert list */ 326*0Sstevel@tonic-gate STACK_OF(X509) *work_cl = NULL; 327*0Sstevel@tonic-gate int retval = 0; 328*0Sstevel@tonic-gate int n; 329*0Sstevel@tonic-gate 330*0Sstevel@tonic-gate retval = sunw_PKCS12_contents(p12, pass, &work_kl, &work_ca); 331*0Sstevel@tonic-gate if (retval < 0) { 332*0Sstevel@tonic-gate goto cleanup; 333*0Sstevel@tonic-gate } else if (retval == 0) { 334*0Sstevel@tonic-gate /* 335*0Sstevel@tonic-gate * Not really an error here - its just that nothing was found. 336*0Sstevel@tonic-gate */ 337*0Sstevel@tonic-gate goto cleanup; 338*0Sstevel@tonic-gate } 339*0Sstevel@tonic-gate 340*0Sstevel@tonic-gate if (sk_EVP_PKEY_num(work_kl) > 0) { 341*0Sstevel@tonic-gate 342*0Sstevel@tonic-gate if (sunw_split_certs(work_kl, work_ca, &work_cl, &nocerts) 343*0Sstevel@tonic-gate < 0) { 344*0Sstevel@tonic-gate goto cleanup; 345*0Sstevel@tonic-gate } 346*0Sstevel@tonic-gate } 347*0Sstevel@tonic-gate 348*0Sstevel@tonic-gate /* 349*0Sstevel@tonic-gate * Go through the lists of certs and private keys which were 350*0Sstevel@tonic-gate * returned, looking for matches of the appropriate type. Do these 351*0Sstevel@tonic-gate * in the order described above. 352*0Sstevel@tonic-gate */ 353*0Sstevel@tonic-gate if ((matchty & DO_FIND_KEYID) != 0) { 354*0Sstevel@tonic-gate 355*0Sstevel@tonic-gate if (keyid == NULL) { 356*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_PARSE, SUNW_R_INVALID_ARG); 357*0Sstevel@tonic-gate retval = -1; 358*0Sstevel@tonic-gate goto cleanup; 359*0Sstevel@tonic-gate } 360*0Sstevel@tonic-gate 361*0Sstevel@tonic-gate /* See if string matches localkeyid's */ 362*0Sstevel@tonic-gate retval = sunw_find_localkeyid(keyid, kstr_len, 363*0Sstevel@tonic-gate work_kl, work_cl, pkey, cert); 364*0Sstevel@tonic-gate if (retval != 0) { 365*0Sstevel@tonic-gate if (retval == -1) 366*0Sstevel@tonic-gate goto cleanup; 367*0Sstevel@tonic-gate else 368*0Sstevel@tonic-gate goto last_part; 369*0Sstevel@tonic-gate } 370*0Sstevel@tonic-gate } 371*0Sstevel@tonic-gate if ((matchty & DO_FIND_FN) != 0) { 372*0Sstevel@tonic-gate 373*0Sstevel@tonic-gate if (name_str == NULL) { 374*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_PARSE, SUNW_R_INVALID_ARG); 375*0Sstevel@tonic-gate retval = -1; 376*0Sstevel@tonic-gate goto cleanup; 377*0Sstevel@tonic-gate } 378*0Sstevel@tonic-gate 379*0Sstevel@tonic-gate /* See if string matches friendly names */ 380*0Sstevel@tonic-gate retval = sunw_find_fname(name_str, work_kl, work_cl, 381*0Sstevel@tonic-gate pkey, cert); 382*0Sstevel@tonic-gate if (retval != 0) { 383*0Sstevel@tonic-gate if (retval == -1) 384*0Sstevel@tonic-gate goto cleanup; 385*0Sstevel@tonic-gate else 386*0Sstevel@tonic-gate goto last_part; 387*0Sstevel@tonic-gate } 388*0Sstevel@tonic-gate } 389*0Sstevel@tonic-gate 390*0Sstevel@tonic-gate if (matchty & DO_FIRST_PAIR) { 391*0Sstevel@tonic-gate 392*0Sstevel@tonic-gate /* Find the first cert and private key and return them */ 393*0Sstevel@tonic-gate retval = get_key_cert(0, work_kl, pkey, work_cl, cert); 394*0Sstevel@tonic-gate if (retval != 0) { 395*0Sstevel@tonic-gate if (retval == -1) 396*0Sstevel@tonic-gate goto cleanup; 397*0Sstevel@tonic-gate else 398*0Sstevel@tonic-gate goto last_part; 399*0Sstevel@tonic-gate } 400*0Sstevel@tonic-gate } 401*0Sstevel@tonic-gate 402*0Sstevel@tonic-gate if (matchty & DO_LAST_PAIR) { 403*0Sstevel@tonic-gate 404*0Sstevel@tonic-gate /* 405*0Sstevel@tonic-gate * Find the last matching cert and private key and return 406*0Sstevel@tonic-gate * them. Since keys which don't have matching client certs 407*0Sstevel@tonic-gate * are at the end of the list of keys, use the number of 408*0Sstevel@tonic-gate * client certs to compute the position of the last private 409*0Sstevel@tonic-gate * key which matches a client cert. 410*0Sstevel@tonic-gate */ 411*0Sstevel@tonic-gate n = sk_X509_num(work_cl) - 1; 412*0Sstevel@tonic-gate retval = get_key_cert(n, work_kl, pkey, work_cl, cert); 413*0Sstevel@tonic-gate if (retval != 0) { 414*0Sstevel@tonic-gate if (retval == -1) 415*0Sstevel@tonic-gate goto cleanup; 416*0Sstevel@tonic-gate else 417*0Sstevel@tonic-gate goto last_part; 418*0Sstevel@tonic-gate } 419*0Sstevel@tonic-gate } 420*0Sstevel@tonic-gate 421*0Sstevel@tonic-gate if (matchty & DO_UNMATCHING) { 422*0Sstevel@tonic-gate STACK_OF(EVP_PKEY) *tmpk; 423*0Sstevel@tonic-gate STACK_OF(X509) *tmpc; 424*0Sstevel@tonic-gate 425*0Sstevel@tonic-gate /* Find the first cert and private key and return them */ 426*0Sstevel@tonic-gate tmpc = work_cl; 427*0Sstevel@tonic-gate if (work_cl == NULL || sk_X509_num(work_cl) == 0) 428*0Sstevel@tonic-gate tmpc = work_ca; 429*0Sstevel@tonic-gate tmpk = work_kl; 430*0Sstevel@tonic-gate if (work_kl == NULL || sk_EVP_PKEY_num(work_kl) == 0) 431*0Sstevel@tonic-gate tmpk = nocerts; 432*0Sstevel@tonic-gate retval = get_key_cert(0, tmpk, pkey, tmpc, cert); 433*0Sstevel@tonic-gate if (retval != 0) { 434*0Sstevel@tonic-gate if (retval == -1) 435*0Sstevel@tonic-gate goto cleanup; 436*0Sstevel@tonic-gate else 437*0Sstevel@tonic-gate goto last_part; 438*0Sstevel@tonic-gate } 439*0Sstevel@tonic-gate } 440*0Sstevel@tonic-gate 441*0Sstevel@tonic-gate last_part: 442*0Sstevel@tonic-gate /* If no errors, terminate normally */ 443*0Sstevel@tonic-gate if (retval != -1) 444*0Sstevel@tonic-gate retval |= set_results(NULL, NULL, NULL, NULL, ca, &work_ca, 445*0Sstevel@tonic-gate NULL, NULL); 446*0Sstevel@tonic-gate if (retval >= 0) { 447*0Sstevel@tonic-gate goto clean_part; 448*0Sstevel@tonic-gate } 449*0Sstevel@tonic-gate 450*0Sstevel@tonic-gate /* Fallthrough is intentional in error cases. */ 451*0Sstevel@tonic-gate cleanup: 452*0Sstevel@tonic-gate if (pkey != NULL && *pkey != NULL) { 453*0Sstevel@tonic-gate sunw_evp_pkey_free(*pkey); 454*0Sstevel@tonic-gate *pkey = NULL; 455*0Sstevel@tonic-gate } 456*0Sstevel@tonic-gate if (cert != NULL && *cert != NULL) { 457*0Sstevel@tonic-gate X509_free(*cert); 458*0Sstevel@tonic-gate *cert = NULL; 459*0Sstevel@tonic-gate } 460*0Sstevel@tonic-gate 461*0Sstevel@tonic-gate clean_part: 462*0Sstevel@tonic-gate 463*0Sstevel@tonic-gate if (work_kl != NULL) { 464*0Sstevel@tonic-gate sk_EVP_PKEY_pop_free(work_kl, sunw_evp_pkey_free); 465*0Sstevel@tonic-gate } 466*0Sstevel@tonic-gate if (work_ca != NULL) 467*0Sstevel@tonic-gate sk_X509_pop_free(work_ca, X509_free); 468*0Sstevel@tonic-gate if (work_cl != NULL) 469*0Sstevel@tonic-gate sk_X509_pop_free(work_cl, X509_free); 470*0Sstevel@tonic-gate 471*0Sstevel@tonic-gate return (retval); 472*0Sstevel@tonic-gate } 473*0Sstevel@tonic-gate 474*0Sstevel@tonic-gate /* 475*0Sstevel@tonic-gate * sunw_PKCS12_contents() parses a pkcs#12 structure and returns component 476*0Sstevel@tonic-gate * parts found, without evaluation. 477*0Sstevel@tonic-gate * 478*0Sstevel@tonic-gate * Parse and decrypt a PKCS#12 structure returning any user keys and/or 479*0Sstevel@tonic-gate * various certs. Note these should either be NULL, *whatever should 480*0Sstevel@tonic-gate * be NULL, or it should point to a valid STACK_OF(X509) structure. 481*0Sstevel@tonic-gate * 482*0Sstevel@tonic-gate * Arguments: 483*0Sstevel@tonic-gate * p12 - Structure with pkcs12 info to be parsed 484*0Sstevel@tonic-gate * pass - Pass phrase for the private key and entire pkcs12 wad (possibly 485*0Sstevel@tonic-gate * empty) or NULL if there is none. 486*0Sstevel@tonic-gate * pkeys - Points to address of a stack of private keys to return. 487*0Sstevel@tonic-gate * certs - Points to address of a stack of client certs return. 488*0Sstevel@tonic-gate * 489*0Sstevel@tonic-gate * Note: The certs and keys being returned are in random order. 490*0Sstevel@tonic-gate * 491*0Sstevel@tonic-gate * Returns: 492*0Sstevel@tonic-gate * < 0 - An error returned. Call ERR_get_error() to get errors information. 493*0Sstevel@tonic-gate * Where possible, memory has been freed. 494*0Sstevel@tonic-gate * >= 0 - Objects were found and returned. Which objects are indicated by 495*0Sstevel@tonic-gate * which bits are set (FOUND_PKEY or FOUND_CERT) 496*0Sstevel@tonic-gate */ 497*0Sstevel@tonic-gate static int 498*0Sstevel@tonic-gate sunw_PKCS12_contents(PKCS12 *p12, const char *pass, STACK_OF(EVP_PKEY) **pkey, 499*0Sstevel@tonic-gate STACK_OF(X509) **certs) 500*0Sstevel@tonic-gate { 501*0Sstevel@tonic-gate STACK_OF(EVP_PKEY) *work_kl = NULL; 502*0Sstevel@tonic-gate STACK_OF(X509) *work_ca = NULL; 503*0Sstevel@tonic-gate int retval = -1; 504*0Sstevel@tonic-gate 505*0Sstevel@tonic-gate /* 506*0Sstevel@tonic-gate * Allocate the working stacks for private key and for the 507*0Sstevel@tonic-gate * ca certs. 508*0Sstevel@tonic-gate */ 509*0Sstevel@tonic-gate if ((work_kl = sk_EVP_PKEY_new_null()) == NULL) { 510*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CONTENTS, SUNW_R_MEMORY_FAILURE); 511*0Sstevel@tonic-gate goto cleanup; 512*0Sstevel@tonic-gate } 513*0Sstevel@tonic-gate 514*0Sstevel@tonic-gate if ((work_ca = sk_X509_new_null()) == NULL) { 515*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CONTENTS, SUNW_R_MEMORY_FAILURE); 516*0Sstevel@tonic-gate goto cleanup; 517*0Sstevel@tonic-gate } 518*0Sstevel@tonic-gate 519*0Sstevel@tonic-gate if (parse_outer(p12, pass, work_kl, work_ca) == 0) { 520*0Sstevel@tonic-gate /* 521*0Sstevel@tonic-gate * Error already on stack 522*0Sstevel@tonic-gate */ 523*0Sstevel@tonic-gate goto cleanup; 524*0Sstevel@tonic-gate } 525*0Sstevel@tonic-gate 526*0Sstevel@tonic-gate /* on error, set_results() returns an error on the stack */ 527*0Sstevel@tonic-gate retval = set_results(pkey, &work_kl, certs, &work_ca, NULL, 528*0Sstevel@tonic-gate NULL, NULL, NULL); 529*0Sstevel@tonic-gate 530*0Sstevel@tonic-gate cleanup: 531*0Sstevel@tonic-gate if (work_kl != NULL) { 532*0Sstevel@tonic-gate sk_EVP_PKEY_pop_free(work_kl, sunw_evp_pkey_free); 533*0Sstevel@tonic-gate } 534*0Sstevel@tonic-gate 535*0Sstevel@tonic-gate return (retval); 536*0Sstevel@tonic-gate } 537*0Sstevel@tonic-gate 538*0Sstevel@tonic-gate /* 539*0Sstevel@tonic-gate * parse_outer - Unpack the outer PKCS#12 structure and go through the 540*0Sstevel@tonic-gate * individual bags. Return stacks of certs, private keys found and 541*0Sstevel@tonic-gate * CA certs found. 542*0Sstevel@tonic-gate * 543*0Sstevel@tonic-gate * Note about error codes: This function is an internal function, and the 544*0Sstevel@tonic-gate * place where it is called sets error codes. 545*0Sstevel@tonic-gate * 546*0Sstevel@tonic-gate * Returns: 547*0Sstevel@tonic-gate * 0 - An error returned. Call ERR_get_error() to get errors information. 548*0Sstevel@tonic-gate * Where possible, memory has been freed. 549*0Sstevel@tonic-gate * 1 - PKCS12 data object was parsed and lists of certs and private keys 550*0Sstevel@tonic-gate * were returned. 551*0Sstevel@tonic-gate */ 552*0Sstevel@tonic-gate static int 553*0Sstevel@tonic-gate parse_outer(PKCS12 *p12, const char *pass, STACK_OF(EVP_PKEY) *kl, 554*0Sstevel@tonic-gate STACK_OF(X509) *cl) 555*0Sstevel@tonic-gate { 556*0Sstevel@tonic-gate STACK_OF(PKCS12_SAFEBAG) *bags; 557*0Sstevel@tonic-gate STACK_OF(PKCS7) *asafes; 558*0Sstevel@tonic-gate int i, bagnid; 559*0Sstevel@tonic-gate PKCS7 *p7; 560*0Sstevel@tonic-gate 561*0Sstevel@tonic-gate if ((asafes = M_PKCS12_unpack_authsafes(p12)) == NULL) 562*0Sstevel@tonic-gate return (0); 563*0Sstevel@tonic-gate 564*0Sstevel@tonic-gate for (i = 0; i < sk_PKCS7_num(asafes); i++) { 565*0Sstevel@tonic-gate p7 = sk_PKCS7_value(asafes, i); 566*0Sstevel@tonic-gate bagnid = OBJ_obj2nid(p7->type); 567*0Sstevel@tonic-gate if (bagnid == NID_pkcs7_data) { 568*0Sstevel@tonic-gate bags = M_PKCS12_unpack_p7data(p7); 569*0Sstevel@tonic-gate } else if (bagnid == NID_pkcs7_encrypted) { 570*0Sstevel@tonic-gate /* 571*0Sstevel@tonic-gate * A length of '-1' means strlen() can be used 572*0Sstevel@tonic-gate * to determine the password length. 573*0Sstevel@tonic-gate */ 574*0Sstevel@tonic-gate bags = M_PKCS12_unpack_p7encdata(p7, pass, -1); 575*0Sstevel@tonic-gate } else { 576*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_OUTER, SUNW_R_BAD_BAGTYPE); 577*0Sstevel@tonic-gate return (0); 578*0Sstevel@tonic-gate } 579*0Sstevel@tonic-gate 580*0Sstevel@tonic-gate if (bags == NULL) { 581*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_OUTER, SUNW_R_PARSE_BAG_ERR); 582*0Sstevel@tonic-gate sk_PKCS7_pop_free(asafes, PKCS7_free); 583*0Sstevel@tonic-gate return (0); 584*0Sstevel@tonic-gate } 585*0Sstevel@tonic-gate if (parse_all_bags(bags, pass, kl, cl) == 0) { 586*0Sstevel@tonic-gate sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free); 587*0Sstevel@tonic-gate sk_PKCS7_pop_free(asafes, PKCS7_free); 588*0Sstevel@tonic-gate return (0); 589*0Sstevel@tonic-gate } 590*0Sstevel@tonic-gate } 591*0Sstevel@tonic-gate 592*0Sstevel@tonic-gate return (1); 593*0Sstevel@tonic-gate } 594*0Sstevel@tonic-gate 595*0Sstevel@tonic-gate /* 596*0Sstevel@tonic-gate * parse_all_bags - go through the stack of bags, parsing each. 597*0Sstevel@tonic-gate * 598*0Sstevel@tonic-gate * Note about error codes: This function is an internal function, and the 599*0Sstevel@tonic-gate * place where it is called sets error codes. 600*0Sstevel@tonic-gate * 601*0Sstevel@tonic-gate * Returns: 602*0Sstevel@tonic-gate * 0 - An error returned. Call ERR_get_error() to get errors information. 603*0Sstevel@tonic-gate * Where possible, memory has been freed. 604*0Sstevel@tonic-gate * 1 - Stack of safebags was parsed and lists of certs and private keys 605*0Sstevel@tonic-gate * were returned. 606*0Sstevel@tonic-gate */ 607*0Sstevel@tonic-gate static int 608*0Sstevel@tonic-gate parse_all_bags(STACK_OF(PKCS12_SAFEBAG) *bags, const char *pass, 609*0Sstevel@tonic-gate STACK_OF(EVP_PKEY) *kl, STACK_OF(X509) *cl) 610*0Sstevel@tonic-gate { 611*0Sstevel@tonic-gate int i; 612*0Sstevel@tonic-gate for (i = 0; i < sk_PKCS12_SAFEBAG_num(bags); i++) { 613*0Sstevel@tonic-gate if (parse_one_bag(sk_PKCS12_SAFEBAG_value(bags, i), 614*0Sstevel@tonic-gate pass, kl, cl) == 0) 615*0Sstevel@tonic-gate return (0); 616*0Sstevel@tonic-gate } 617*0Sstevel@tonic-gate return (1); 618*0Sstevel@tonic-gate } 619*0Sstevel@tonic-gate 620*0Sstevel@tonic-gate /* 621*0Sstevel@tonic-gate * parse_one_bag - Parse an individual bag 622*0Sstevel@tonic-gate * 623*0Sstevel@tonic-gate * i = parse_one_bag(bag, pass, kl, cl); 624*0Sstevel@tonic-gate * 625*0Sstevel@tonic-gate * Arguments: 626*0Sstevel@tonic-gate * bag - pkcs12 safebag to parse. 627*0Sstevel@tonic-gate * pass - password for use in decryption of shrouded keybag 628*0Sstevel@tonic-gate * kl - Stack of private keys found so far. New private keys will 629*0Sstevel@tonic-gate * be added here if found. 630*0Sstevel@tonic-gate * cl - Stack of certs found so far. New certificates will be 631*0Sstevel@tonic-gate * added here if found. 632*0Sstevel@tonic-gate * 633*0Sstevel@tonic-gate * Returns: 634*0Sstevel@tonic-gate * 0 - An error returned. Call ERR_get_error() to get errors information. 635*0Sstevel@tonic-gate * Where possible, memory has been freed. 636*0Sstevel@tonic-gate * 1 - one safebag was parsed. If it contained a cert or private key, it 637*0Sstevel@tonic-gate * was added to the stack of certs or private keys found, respectively. 638*0Sstevel@tonic-gate * localKeyId or friendlyName attributes are returned with the 639*0Sstevel@tonic-gate * private key or certificate. 640*0Sstevel@tonic-gate */ 641*0Sstevel@tonic-gate static int 642*0Sstevel@tonic-gate parse_one_bag(PKCS12_SAFEBAG *bag, const char *pass, STACK_OF(EVP_PKEY) *kl, 643*0Sstevel@tonic-gate STACK_OF(X509) *cl) 644*0Sstevel@tonic-gate { 645*0Sstevel@tonic-gate X509_ATTRIBUTE *attr = NULL; 646*0Sstevel@tonic-gate ASN1_TYPE *keyid = NULL; 647*0Sstevel@tonic-gate ASN1_TYPE *fname = NULL; 648*0Sstevel@tonic-gate PKCS8_PRIV_KEY_INFO *p8; 649*0Sstevel@tonic-gate EVP_PKEY *pkey = NULL; 650*0Sstevel@tonic-gate X509 *x509 = NULL; 651*0Sstevel@tonic-gate uchar_t *data = NULL; 652*0Sstevel@tonic-gate char *str = NULL; 653*0Sstevel@tonic-gate int retval = 1; 654*0Sstevel@tonic-gate 655*0Sstevel@tonic-gate keyid = PKCS12_get_attr(bag, NID_localKeyID); 656*0Sstevel@tonic-gate fname = PKCS12_get_attr(bag, NID_friendlyName); 657*0Sstevel@tonic-gate 658*0Sstevel@tonic-gate switch (M_PKCS12_bag_type(bag)) { 659*0Sstevel@tonic-gate case NID_keyBag: 660*0Sstevel@tonic-gate if ((pkey = EVP_PKCS82PKEY(bag->value.keybag)) == NULL) { 661*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG, SUNW_R_PARSE_BAG_ERR); 662*0Sstevel@tonic-gate retval = 0; 663*0Sstevel@tonic-gate break; 664*0Sstevel@tonic-gate } 665*0Sstevel@tonic-gate break; 666*0Sstevel@tonic-gate 667*0Sstevel@tonic-gate case NID_pkcs8ShroudedKeyBag: 668*0Sstevel@tonic-gate /* 669*0Sstevel@tonic-gate * A length of '-1' means strlen() can be used 670*0Sstevel@tonic-gate * to determine the password length. 671*0Sstevel@tonic-gate */ 672*0Sstevel@tonic-gate if ((p8 = M_PKCS12_decrypt_skey(bag, pass, -1)) == NULL) { 673*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG, SUNW_R_PARSE_BAG_ERR); 674*0Sstevel@tonic-gate retval = 0; 675*0Sstevel@tonic-gate break; 676*0Sstevel@tonic-gate } 677*0Sstevel@tonic-gate pkey = EVP_PKCS82PKEY(p8); 678*0Sstevel@tonic-gate PKCS8_PRIV_KEY_INFO_free(p8); 679*0Sstevel@tonic-gate if (pkey == NULL) { 680*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG, SUNW_R_PARSE_BAG_ERR); 681*0Sstevel@tonic-gate retval = 0; 682*0Sstevel@tonic-gate } 683*0Sstevel@tonic-gate break; 684*0Sstevel@tonic-gate 685*0Sstevel@tonic-gate case NID_certBag: 686*0Sstevel@tonic-gate if (M_PKCS12_cert_bag_type(bag) != NID_x509Certificate) { 687*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG, SUNW_R_BAD_CERTTYPE); 688*0Sstevel@tonic-gate break; 689*0Sstevel@tonic-gate } 690*0Sstevel@tonic-gate if ((x509 = M_PKCS12_certbag2x509(bag)) == NULL) { 691*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG, 692*0Sstevel@tonic-gate SUNW_R_PARSE_CERT_ERR); 693*0Sstevel@tonic-gate retval = 0; 694*0Sstevel@tonic-gate break; 695*0Sstevel@tonic-gate } 696*0Sstevel@tonic-gate 697*0Sstevel@tonic-gate if (keyid != NULL) { 698*0Sstevel@tonic-gate if (keyid->type != V_ASN1_OCTET_STRING) { 699*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG, 700*0Sstevel@tonic-gate SUNW_R_BAD_LKID); 701*0Sstevel@tonic-gate retval = 0; 702*0Sstevel@tonic-gate break; 703*0Sstevel@tonic-gate } 704*0Sstevel@tonic-gate if (X509_keyid_set1(x509, 705*0Sstevel@tonic-gate keyid->value.octet_string->data, 706*0Sstevel@tonic-gate keyid->value.octet_string->length) == 0) { 707*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG, 708*0Sstevel@tonic-gate SUNW_R_SET_LKID_ERR); 709*0Sstevel@tonic-gate retval = 0; 710*0Sstevel@tonic-gate break; 711*0Sstevel@tonic-gate } 712*0Sstevel@tonic-gate } 713*0Sstevel@tonic-gate 714*0Sstevel@tonic-gate if (fname != NULL) { 715*0Sstevel@tonic-gate ASN1_STRING *tmpstr = NULL; 716*0Sstevel@tonic-gate int len; 717*0Sstevel@tonic-gate 718*0Sstevel@tonic-gate if (fname->type != V_ASN1_BMPSTRING) { 719*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG, 720*0Sstevel@tonic-gate SUNW_R_BAD_FNAME); 721*0Sstevel@tonic-gate retval = 0; 722*0Sstevel@tonic-gate break; 723*0Sstevel@tonic-gate } 724*0Sstevel@tonic-gate 725*0Sstevel@tonic-gate tmpstr = fname->value.asn1_string; 726*0Sstevel@tonic-gate len = ASN1_STRING_to_UTF8(&data, tmpstr); 727*0Sstevel@tonic-gate if (len < 0) { 728*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG, 729*0Sstevel@tonic-gate SUNW_R_SET_FNAME_ERR); 730*0Sstevel@tonic-gate retval = 0; 731*0Sstevel@tonic-gate break; 732*0Sstevel@tonic-gate } 733*0Sstevel@tonic-gate 734*0Sstevel@tonic-gate if (X509_alias_set1(x509, data, len) == 0) { 735*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG, 736*0Sstevel@tonic-gate SUNW_R_SET_FNAME_ERR); 737*0Sstevel@tonic-gate retval = 0; 738*0Sstevel@tonic-gate break; 739*0Sstevel@tonic-gate } 740*0Sstevel@tonic-gate } 741*0Sstevel@tonic-gate 742*0Sstevel@tonic-gate if (sk_X509_push(cl, x509) == 0) { 743*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG, SUNW_R_MEMORY_FAILURE); 744*0Sstevel@tonic-gate retval = 0; 745*0Sstevel@tonic-gate break; 746*0Sstevel@tonic-gate } 747*0Sstevel@tonic-gate x509 = NULL; 748*0Sstevel@tonic-gate break; 749*0Sstevel@tonic-gate 750*0Sstevel@tonic-gate case NID_safeContentsBag: 751*0Sstevel@tonic-gate if (keyid != NULL) 752*0Sstevel@tonic-gate ASN1_TYPE_free(keyid); 753*0Sstevel@tonic-gate if (fname != NULL) 754*0Sstevel@tonic-gate ASN1_TYPE_free(fname); 755*0Sstevel@tonic-gate if (parse_all_bags(bag->value.safes, pass, kl, cl) == 0) { 756*0Sstevel@tonic-gate /* 757*0Sstevel@tonic-gate * Error already on stack 758*0Sstevel@tonic-gate */ 759*0Sstevel@tonic-gate return (0); 760*0Sstevel@tonic-gate } 761*0Sstevel@tonic-gate return (1); 762*0Sstevel@tonic-gate 763*0Sstevel@tonic-gate default: 764*0Sstevel@tonic-gate if (keyid != NULL) 765*0Sstevel@tonic-gate ASN1_TYPE_free(keyid); 766*0Sstevel@tonic-gate if (fname != NULL) 767*0Sstevel@tonic-gate ASN1_TYPE_free(fname); 768*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG, SUNW_R_BAD_BAGTYPE); 769*0Sstevel@tonic-gate return (0); 770*0Sstevel@tonic-gate } 771*0Sstevel@tonic-gate 772*0Sstevel@tonic-gate 773*0Sstevel@tonic-gate if (pkey != NULL) { 774*0Sstevel@tonic-gate if (retval != 0 && (keyid != NULL || fname != NULL) && 775*0Sstevel@tonic-gate pkey->attributes == NULL) { 776*0Sstevel@tonic-gate pkey->attributes = sk_X509_ATTRIBUTE_new_null(); 777*0Sstevel@tonic-gate if (pkey->attributes == NULL) { 778*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG, 779*0Sstevel@tonic-gate SUNW_R_MEMORY_FAILURE); 780*0Sstevel@tonic-gate retval = 0; 781*0Sstevel@tonic-gate } 782*0Sstevel@tonic-gate } 783*0Sstevel@tonic-gate 784*0Sstevel@tonic-gate if (retval != 0 && keyid != NULL) { 785*0Sstevel@tonic-gate attr = type2attrib(keyid, NID_localKeyID); 786*0Sstevel@tonic-gate if (attr == NULL) 787*0Sstevel@tonic-gate /* 788*0Sstevel@tonic-gate * Error already on stack 789*0Sstevel@tonic-gate */ 790*0Sstevel@tonic-gate retval = 0; 791*0Sstevel@tonic-gate else { 792*0Sstevel@tonic-gate keyid = NULL; 793*0Sstevel@tonic-gate if (sk_X509_ATTRIBUTE_push(pkey->attributes, 794*0Sstevel@tonic-gate attr) == 0) { 795*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG, 796*0Sstevel@tonic-gate SUNW_R_MEMORY_FAILURE); 797*0Sstevel@tonic-gate retval = 0; 798*0Sstevel@tonic-gate } else { 799*0Sstevel@tonic-gate attr = NULL; 800*0Sstevel@tonic-gate } 801*0Sstevel@tonic-gate } 802*0Sstevel@tonic-gate } 803*0Sstevel@tonic-gate 804*0Sstevel@tonic-gate if (retval != 0 && fname != NULL) { 805*0Sstevel@tonic-gate attr = type2attrib(fname, NID_friendlyName); 806*0Sstevel@tonic-gate if (attr == NULL) { 807*0Sstevel@tonic-gate /* 808*0Sstevel@tonic-gate * Error already on stack 809*0Sstevel@tonic-gate */ 810*0Sstevel@tonic-gate retval = 0; 811*0Sstevel@tonic-gate } else { 812*0Sstevel@tonic-gate fname = NULL; 813*0Sstevel@tonic-gate if (sk_X509_ATTRIBUTE_push(pkey->attributes, 814*0Sstevel@tonic-gate attr) == 0) { 815*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG, 816*0Sstevel@tonic-gate SUNW_R_MEMORY_FAILURE); 817*0Sstevel@tonic-gate retval = 0; 818*0Sstevel@tonic-gate } else { 819*0Sstevel@tonic-gate attr = NULL; 820*0Sstevel@tonic-gate } 821*0Sstevel@tonic-gate } 822*0Sstevel@tonic-gate } 823*0Sstevel@tonic-gate 824*0Sstevel@tonic-gate /* Save the private key */ 825*0Sstevel@tonic-gate if (retval != 0) { 826*0Sstevel@tonic-gate if (sk_EVP_PKEY_push(kl, pkey) == 0) { 827*0Sstevel@tonic-gate SUNWerr(SUNW_F_PARSE_ONE_BAG, 828*0Sstevel@tonic-gate SUNW_R_MEMORY_FAILURE); 829*0Sstevel@tonic-gate retval = 0; 830*0Sstevel@tonic-gate } else { 831*0Sstevel@tonic-gate pkey = NULL; 832*0Sstevel@tonic-gate } 833*0Sstevel@tonic-gate } 834*0Sstevel@tonic-gate } 835*0Sstevel@tonic-gate 836*0Sstevel@tonic-gate if (pkey != NULL) { 837*0Sstevel@tonic-gate sunw_evp_pkey_free(pkey); 838*0Sstevel@tonic-gate } 839*0Sstevel@tonic-gate 840*0Sstevel@tonic-gate if (x509 != NULL) 841*0Sstevel@tonic-gate X509_free(x509); 842*0Sstevel@tonic-gate 843*0Sstevel@tonic-gate if (keyid != NULL) 844*0Sstevel@tonic-gate ASN1_TYPE_free(keyid); 845*0Sstevel@tonic-gate 846*0Sstevel@tonic-gate if (fname != NULL) 847*0Sstevel@tonic-gate ASN1_TYPE_free(fname); 848*0Sstevel@tonic-gate 849*0Sstevel@tonic-gate if (attr != NULL) 850*0Sstevel@tonic-gate X509_ATTRIBUTE_free(attr); 851*0Sstevel@tonic-gate 852*0Sstevel@tonic-gate if (data != NULL) 853*0Sstevel@tonic-gate OPENSSL_free(data); 854*0Sstevel@tonic-gate 855*0Sstevel@tonic-gate if (str != NULL) 856*0Sstevel@tonic-gate OPENSSL_free(str); 857*0Sstevel@tonic-gate 858*0Sstevel@tonic-gate return (retval); 859*0Sstevel@tonic-gate } 860