1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * ==================================================================== 3*0Sstevel@tonic-gate * Copyright (c) 1999 The OpenSSL Project. All rights reserved. 4*0Sstevel@tonic-gate * 5*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without 6*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions 7*0Sstevel@tonic-gate * are met: 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the above copyright 10*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer. 11*0Sstevel@tonic-gate * 12*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright 13*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in 14*0Sstevel@tonic-gate * the documentation and/or other materials provided with the 15*0Sstevel@tonic-gate * distribution. 16*0Sstevel@tonic-gate * 17*0Sstevel@tonic-gate * 3. All advertising materials mentioning features or use of this 18*0Sstevel@tonic-gate * software must display the following acknowledgment: 19*0Sstevel@tonic-gate * "This product includes software developed by the OpenSSL Project 20*0Sstevel@tonic-gate * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 21*0Sstevel@tonic-gate * 22*0Sstevel@tonic-gate * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 23*0Sstevel@tonic-gate * endorse or promote products derived from this software without 24*0Sstevel@tonic-gate * prior written permission. For written permission, please contact 25*0Sstevel@tonic-gate * licensing@OpenSSL.org. 26*0Sstevel@tonic-gate * 27*0Sstevel@tonic-gate * 5. Products derived from this software may not be called "OpenSSL" 28*0Sstevel@tonic-gate * nor may "OpenSSL" appear in their names without prior written 29*0Sstevel@tonic-gate * permission of the OpenSSL Project. 30*0Sstevel@tonic-gate * 31*0Sstevel@tonic-gate * 6. Redistributions of any form whatsoever must retain the following 32*0Sstevel@tonic-gate * acknowledgment: 33*0Sstevel@tonic-gate * "This product includes software developed by the OpenSSL Project 34*0Sstevel@tonic-gate * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 35*0Sstevel@tonic-gate * 36*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 37*0Sstevel@tonic-gate * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 38*0Sstevel@tonic-gate * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 39*0Sstevel@tonic-gate * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 40*0Sstevel@tonic-gate * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 41*0Sstevel@tonic-gate * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 42*0Sstevel@tonic-gate * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 43*0Sstevel@tonic-gate * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 44*0Sstevel@tonic-gate * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 45*0Sstevel@tonic-gate * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 46*0Sstevel@tonic-gate * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 47*0Sstevel@tonic-gate * OF THE POSSIBILITY OF SUCH DAMAGE. 48*0Sstevel@tonic-gate * ==================================================================== 49*0Sstevel@tonic-gate * 50*0Sstevel@tonic-gate * This product includes cryptographic software written by Eric Young 51*0Sstevel@tonic-gate * (eay@cryptsoft.com). This product includes software written by Tim 52*0Sstevel@tonic-gate * Hudson (tjh@cryptsoft.com). 53*0Sstevel@tonic-gate * 54*0Sstevel@tonic-gate */ 55*0Sstevel@tonic-gate 56*0Sstevel@tonic-gate /* 57*0Sstevel@tonic-gate * Copyright 2002, 2003 Sun Microsystems, Inc. All rights reserved. 58*0Sstevel@tonic-gate * Use is subject to license terms. 59*0Sstevel@tonic-gate */ 60*0Sstevel@tonic-gate 61*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 62*0Sstevel@tonic-gate 63*0Sstevel@tonic-gate #include <stdio.h> 64*0Sstevel@tonic-gate #include <strings.h> 65*0Sstevel@tonic-gate #include <stdlib.h> 66*0Sstevel@tonic-gate 67*0Sstevel@tonic-gate #include <openssl/crypto.h> 68*0Sstevel@tonic-gate #include <openssl/err.h> 69*0Sstevel@tonic-gate #include <openssl/x509.h> 70*0Sstevel@tonic-gate 71*0Sstevel@tonic-gate #include <openssl/pkcs12.h> 72*0Sstevel@tonic-gate #include <p12aux.h> 73*0Sstevel@tonic-gate #include <auxutil.h> 74*0Sstevel@tonic-gate #include <p12err.h> 75*0Sstevel@tonic-gate 76*0Sstevel@tonic-gate /* 77*0Sstevel@tonic-gate * sunw_cryto_init() does crypto-specific initialization. 78*0Sstevel@tonic-gate * 79*0Sstevel@tonic-gate * Arguments: 80*0Sstevel@tonic-gate * None. 81*0Sstevel@tonic-gate * 82*0Sstevel@tonic-gate * Returns: 83*0Sstevel@tonic-gate * None. 84*0Sstevel@tonic-gate */ 85*0Sstevel@tonic-gate void 86*0Sstevel@tonic-gate sunw_crypto_init(void) 87*0Sstevel@tonic-gate { 88*0Sstevel@tonic-gate OpenSSL_add_all_algorithms(); 89*0Sstevel@tonic-gate ERR_load_crypto_strings(); 90*0Sstevel@tonic-gate ERR_load_SUNW_strings(); 91*0Sstevel@tonic-gate } 92*0Sstevel@tonic-gate 93*0Sstevel@tonic-gate /* 94*0Sstevel@tonic-gate * sunw_split_certs() - Given a list of certs and a list of private keys, 95*0Sstevel@tonic-gate * moves certs which match one of the keys to a different stack. 96*0Sstevel@tonic-gate * 97*0Sstevel@tonic-gate * Arguments: 98*0Sstevel@tonic-gate * allkeys - Points to a stack of private keys to search. 99*0Sstevel@tonic-gate * allcerts - Points to a stack of certs to be searched. 100*0Sstevel@tonic-gate * keycerts - Points to address of a stack of certs with matching private 101*0Sstevel@tonic-gate * keys. They are moved from 'allcerts'. This may not be NULL 102*0Sstevel@tonic-gate * when called. If *keycerts is NULL upon entry, a new stack will 103*0Sstevel@tonic-gate * be allocated. Otherwise, it must be a valid STACK_OF(509). 104*0Sstevel@tonic-gate * nocerts - Points to address of a stack for keys which have no matching 105*0Sstevel@tonic-gate * certs. Keys are moved from 'allkeys' here when they have no 106*0Sstevel@tonic-gate * matching certs. If this is NULL, matchless keys will be 107*0Sstevel@tonic-gate * discarded. 108*0Sstevel@tonic-gate * 109*0Sstevel@tonic-gate * Notes: If an error occurs while moving certs, the cert being move may be 110*0Sstevel@tonic-gate * lost. 'keycerts' may only contain part of the matching certs. The number 111*0Sstevel@tonic-gate * of certs successfully moved can be found by checking sk_X509_num(keycerts). 112*0Sstevel@tonic-gate * 113*0Sstevel@tonic-gate * If there is a key which does not have a matching cert, it is moved to 114*0Sstevel@tonic-gate * the list nocerts. 115*0Sstevel@tonic-gate * 116*0Sstevel@tonic-gate * If all certs are removed from 'certs' and/or 'pkeys', it will be the 117*0Sstevel@tonic-gate * caller's responsibility to free the empty stacks. 118*0Sstevel@tonic-gate * 119*0Sstevel@tonic-gate * Returns: 120*0Sstevel@tonic-gate * < 0 - An error returned. Call ERR_get_error() to get errors information. 121*0Sstevel@tonic-gate * Where possible, memory has been freed. 122*0Sstevel@tonic-gate * >= 0 - The number of certs moved from 'cert' to 'pkcerts'. 123*0Sstevel@tonic-gate */ 124*0Sstevel@tonic-gate int 125*0Sstevel@tonic-gate sunw_split_certs(STACK_OF(EVP_PKEY) *allkeys, STACK_OF(X509) *allcerts, 126*0Sstevel@tonic-gate STACK_OF(X509) **keycerts, STACK_OF(EVP_PKEY) **nocerts) 127*0Sstevel@tonic-gate { 128*0Sstevel@tonic-gate STACK_OF(X509) *matching; 129*0Sstevel@tonic-gate STACK_OF(EVP_PKEY) *nomatch; 130*0Sstevel@tonic-gate EVP_PKEY *tmpkey; 131*0Sstevel@tonic-gate X509 *tmpcert; 132*0Sstevel@tonic-gate int count = 0; 133*0Sstevel@tonic-gate int found; 134*0Sstevel@tonic-gate int res; 135*0Sstevel@tonic-gate int i; 136*0Sstevel@tonic-gate int k; 137*0Sstevel@tonic-gate 138*0Sstevel@tonic-gate *keycerts = NULL; 139*0Sstevel@tonic-gate if (nocerts != NULL) 140*0Sstevel@tonic-gate *nocerts = NULL; 141*0Sstevel@tonic-gate nomatch = NULL; 142*0Sstevel@tonic-gate 143*0Sstevel@tonic-gate if ((matching = sk_X509_new_null()) == NULL) { 144*0Sstevel@tonic-gate SUNWerr(SUNW_F_SPLIT_CERTS, SUNW_R_MEMORY_FAILURE); 145*0Sstevel@tonic-gate return (-1); 146*0Sstevel@tonic-gate } 147*0Sstevel@tonic-gate *keycerts = matching; 148*0Sstevel@tonic-gate 149*0Sstevel@tonic-gate k = 0; 150*0Sstevel@tonic-gate while (k < sk_EVP_PKEY_num(allkeys)) { 151*0Sstevel@tonic-gate found = 0; 152*0Sstevel@tonic-gate tmpkey = sk_EVP_PKEY_value(allkeys, k); 153*0Sstevel@tonic-gate 154*0Sstevel@tonic-gate for (i = 0; i < sk_X509_num(allcerts); i++) { 155*0Sstevel@tonic-gate tmpcert = sk_X509_value(allcerts, i); 156*0Sstevel@tonic-gate res = X509_check_private_key(tmpcert, tmpkey); 157*0Sstevel@tonic-gate if (res != 0) { 158*0Sstevel@tonic-gate count++; 159*0Sstevel@tonic-gate found = 1; 160*0Sstevel@tonic-gate tmpcert = sk_X509_delete(allcerts, i); 161*0Sstevel@tonic-gate if (sk_X509_push(matching, tmpcert) == 0) { 162*0Sstevel@tonic-gate X509_free(tmpcert); 163*0Sstevel@tonic-gate SUNWerr(SUNW_F_SPLIT_CERTS, 164*0Sstevel@tonic-gate SUNW_R_MEMORY_FAILURE); 165*0Sstevel@tonic-gate return (-1); 166*0Sstevel@tonic-gate } 167*0Sstevel@tonic-gate break; 168*0Sstevel@tonic-gate } 169*0Sstevel@tonic-gate } 170*0Sstevel@tonic-gate if (found != 0) { 171*0Sstevel@tonic-gate /* 172*0Sstevel@tonic-gate * Found a match - keep the key & check out the next 173*0Sstevel@tonic-gate * one. 174*0Sstevel@tonic-gate */ 175*0Sstevel@tonic-gate k++; 176*0Sstevel@tonic-gate } else { 177*0Sstevel@tonic-gate /* 178*0Sstevel@tonic-gate * No cert matching this key. Move the key if 179*0Sstevel@tonic-gate * possible or discard it. Don't increment the 180*0Sstevel@tonic-gate * index. 181*0Sstevel@tonic-gate */ 182*0Sstevel@tonic-gate if (nocerts == NULL) { 183*0Sstevel@tonic-gate tmpkey = sk_EVP_PKEY_delete(allkeys, k); 184*0Sstevel@tonic-gate sunw_evp_pkey_free(tmpkey); 185*0Sstevel@tonic-gate } else { 186*0Sstevel@tonic-gate if (*nocerts == NULL) { 187*0Sstevel@tonic-gate nomatch = sk_EVP_PKEY_new_null(); 188*0Sstevel@tonic-gate if (nomatch == NULL) { 189*0Sstevel@tonic-gate SUNWerr(SUNW_F_SPLIT_CERTS, 190*0Sstevel@tonic-gate SUNW_R_MEMORY_FAILURE); 191*0Sstevel@tonic-gate return (-1); 192*0Sstevel@tonic-gate } 193*0Sstevel@tonic-gate *nocerts = nomatch; 194*0Sstevel@tonic-gate } 195*0Sstevel@tonic-gate tmpkey = sk_EVP_PKEY_delete(allkeys, k); 196*0Sstevel@tonic-gate if (sk_EVP_PKEY_push(nomatch, tmpkey) == 0) { 197*0Sstevel@tonic-gate sunw_evp_pkey_free(tmpkey); 198*0Sstevel@tonic-gate SUNWerr(SUNW_F_SPLIT_CERTS, 199*0Sstevel@tonic-gate SUNW_R_MEMORY_FAILURE); 200*0Sstevel@tonic-gate return (-1); 201*0Sstevel@tonic-gate } 202*0Sstevel@tonic-gate } 203*0Sstevel@tonic-gate } 204*0Sstevel@tonic-gate } 205*0Sstevel@tonic-gate 206*0Sstevel@tonic-gate return (count); 207*0Sstevel@tonic-gate } 208*0Sstevel@tonic-gate 209*0Sstevel@tonic-gate /* 210*0Sstevel@tonic-gate * sunw_evp_pkey_free() Given an EVP_PKEY structure, free any attributes 211*0Sstevel@tonic-gate * that are attached. Then free the EVP_PKEY itself. 212*0Sstevel@tonic-gate * 213*0Sstevel@tonic-gate * This is a replacement for EVP_PKEY_free() for the sunw stuff. 214*0Sstevel@tonic-gate * It should be used in places where EVP_PKEY_free would be used, 215*0Sstevel@tonic-gate * including calls to sk_EVP_PKEY_pop_free(). 216*0Sstevel@tonic-gate * 217*0Sstevel@tonic-gate * Arguments: 218*0Sstevel@tonic-gate * pkey - Entry which potentially has attributes to be freed. 219*0Sstevel@tonic-gate * 220*0Sstevel@tonic-gate * Returns: 221*0Sstevel@tonic-gate * None. 222*0Sstevel@tonic-gate */ 223*0Sstevel@tonic-gate void 224*0Sstevel@tonic-gate sunw_evp_pkey_free(EVP_PKEY *pkey) 225*0Sstevel@tonic-gate { 226*0Sstevel@tonic-gate if (pkey != NULL) { 227*0Sstevel@tonic-gate if (pkey->attributes != NULL) { 228*0Sstevel@tonic-gate sk_X509_ATTRIBUTE_pop_free(pkey->attributes, 229*0Sstevel@tonic-gate X509_ATTRIBUTE_free); 230*0Sstevel@tonic-gate pkey->attributes = NULL; 231*0Sstevel@tonic-gate } 232*0Sstevel@tonic-gate EVP_PKEY_free(pkey); 233*0Sstevel@tonic-gate } 234*0Sstevel@tonic-gate } 235*0Sstevel@tonic-gate 236*0Sstevel@tonic-gate /* 237*0Sstevel@tonic-gate * sunw_set_localkeyid() sets the localkeyid in a cert, a private key or 238*0Sstevel@tonic-gate * both. Any existing localkeyid will be discarded. 239*0Sstevel@tonic-gate * 240*0Sstevel@tonic-gate * Arguments: 241*0Sstevel@tonic-gate * keyid_str- A byte string with the localkeyid to set 242*0Sstevel@tonic-gate * keyid_len- Length of the keyid byte string. 243*0Sstevel@tonic-gate * pkey - Points to a private key to set the keyidstr in. 244*0Sstevel@tonic-gate * cert - Points to a cert to set the keyidstr in. 245*0Sstevel@tonic-gate * 246*0Sstevel@tonic-gate * Note that setting a keyid into a cert which will not be written out as 247*0Sstevel@tonic-gate * a PKCS12 cert is pointless since it will be lost. 248*0Sstevel@tonic-gate * 249*0Sstevel@tonic-gate * Returns: 250*0Sstevel@tonic-gate * 0 - Success. 251*0Sstevel@tonic-gate * < 0 - An error occurred. It was probably an error in allocating 252*0Sstevel@tonic-gate * memory. The error will be set in the error stack. Call 253*0Sstevel@tonic-gate * ERR_get_error() to get specific information. 254*0Sstevel@tonic-gate */ 255*0Sstevel@tonic-gate int 256*0Sstevel@tonic-gate sunw_set_localkeyid(const char *keyid_str, int keyid_len, EVP_PKEY *pkey, 257*0Sstevel@tonic-gate X509 *cert) 258*0Sstevel@tonic-gate { 259*0Sstevel@tonic-gate X509_ATTRIBUTE *attr = NULL; 260*0Sstevel@tonic-gate ASN1_STRING *str = NULL; 261*0Sstevel@tonic-gate ASN1_TYPE *keyid = NULL; 262*0Sstevel@tonic-gate int retval = -1; 263*0Sstevel@tonic-gate int i; 264*0Sstevel@tonic-gate 265*0Sstevel@tonic-gate if (cert != NULL) { 266*0Sstevel@tonic-gate if (X509_keyid_set1(cert, (uchar_t *)keyid_str, keyid_len) 267*0Sstevel@tonic-gate == 0) { 268*0Sstevel@tonic-gate SUNWerr(SUNW_F_SET_LOCALKEYID, SUNW_R_SET_LKID_ERR); 269*0Sstevel@tonic-gate goto cleanup; 270*0Sstevel@tonic-gate } 271*0Sstevel@tonic-gate } 272*0Sstevel@tonic-gate if (pkey != NULL) { 273*0Sstevel@tonic-gate str = (ASN1_STRING *)M_ASN1_OCTET_STRING_new(); 274*0Sstevel@tonic-gate if (str == NULL || 275*0Sstevel@tonic-gate M_ASN1_OCTET_STRING_set(str, keyid_str, keyid_len) == 0 || 276*0Sstevel@tonic-gate (keyid = ASN1_TYPE_new()) == NULL) { 277*0Sstevel@tonic-gate SUNWerr(SUNW_F_SET_LOCALKEYID, SUNW_R_MEMORY_FAILURE); 278*0Sstevel@tonic-gate goto cleanup; 279*0Sstevel@tonic-gate } 280*0Sstevel@tonic-gate 281*0Sstevel@tonic-gate ASN1_TYPE_set(keyid, V_ASN1_OCTET_STRING, str); 282*0Sstevel@tonic-gate str = NULL; 283*0Sstevel@tonic-gate 284*0Sstevel@tonic-gate attr = type2attrib(keyid, NID_localKeyID); 285*0Sstevel@tonic-gate if (attr == NULL) { 286*0Sstevel@tonic-gate /* 287*0Sstevel@tonic-gate * Error already on stack 288*0Sstevel@tonic-gate */ 289*0Sstevel@tonic-gate goto cleanup; 290*0Sstevel@tonic-gate } 291*0Sstevel@tonic-gate keyid = NULL; 292*0Sstevel@tonic-gate 293*0Sstevel@tonic-gate if (pkey->attributes == NULL) { 294*0Sstevel@tonic-gate pkey->attributes = sk_X509_ATTRIBUTE_new_null(); 295*0Sstevel@tonic-gate if (pkey->attributes == NULL) { 296*0Sstevel@tonic-gate SUNWerr(SUNW_F_SET_LOCALKEYID, 297*0Sstevel@tonic-gate SUNW_R_MEMORY_FAILURE); 298*0Sstevel@tonic-gate goto cleanup; 299*0Sstevel@tonic-gate } 300*0Sstevel@tonic-gate } else { 301*0Sstevel@tonic-gate i = find_attr_by_nid(pkey->attributes, NID_localKeyID); 302*0Sstevel@tonic-gate if (i >= 0) 303*0Sstevel@tonic-gate sk_X509_ATTRIBUTE_delete(pkey->attributes, i); 304*0Sstevel@tonic-gate } 305*0Sstevel@tonic-gate if (sk_X509_ATTRIBUTE_push(pkey->attributes, attr) == 0) { 306*0Sstevel@tonic-gate SUNWerr(SUNW_F_SET_LOCALKEYID, SUNW_R_MEMORY_FAILURE); 307*0Sstevel@tonic-gate goto cleanup; 308*0Sstevel@tonic-gate } 309*0Sstevel@tonic-gate attr = NULL; 310*0Sstevel@tonic-gate } 311*0Sstevel@tonic-gate retval = 0; 312*0Sstevel@tonic-gate 313*0Sstevel@tonic-gate cleanup: 314*0Sstevel@tonic-gate if (str != NULL) 315*0Sstevel@tonic-gate ASN1_STRING_free(str); 316*0Sstevel@tonic-gate if (keyid != NULL) 317*0Sstevel@tonic-gate ASN1_TYPE_free(keyid); 318*0Sstevel@tonic-gate if (attr != NULL) 319*0Sstevel@tonic-gate X509_ATTRIBUTE_free(attr); 320*0Sstevel@tonic-gate 321*0Sstevel@tonic-gate return (retval); 322*0Sstevel@tonic-gate } 323*0Sstevel@tonic-gate 324*0Sstevel@tonic-gate /* 325*0Sstevel@tonic-gate * sunw_get_pkey_localkeyid() gets the localkeyid from a private key. It can 326*0Sstevel@tonic-gate * optionally remove the value found. 327*0Sstevel@tonic-gate * 328*0Sstevel@tonic-gate * Arguments: 329*0Sstevel@tonic-gate * dowhat - What to do with the attributes (remove them or copy them). 330*0Sstevel@tonic-gate * pkey - Points to a private key to set the keyidstr in. 331*0Sstevel@tonic-gate * keyid_str- Points to a location which will receive the pointer to 332*0Sstevel@tonic-gate * a byte string containing the binary localkeyid. Note that 333*0Sstevel@tonic-gate * this is a copy, and the caller must free it. 334*0Sstevel@tonic-gate * keyid_len- Length of keyid_str. 335*0Sstevel@tonic-gate * 336*0Sstevel@tonic-gate * Returns: 337*0Sstevel@tonic-gate * >= 0 - The number of characters in the keyid returned. 338*0Sstevel@tonic-gate * < 0 - An error occurred. It was probably an error in allocating 339*0Sstevel@tonic-gate * memory. The error will be set in the error stack. Call 340*0Sstevel@tonic-gate * ERR_get_error() to get specific information. 341*0Sstevel@tonic-gate */ 342*0Sstevel@tonic-gate int 343*0Sstevel@tonic-gate sunw_get_pkey_localkeyid(getdo_actions_t dowhat, EVP_PKEY *pkey, 344*0Sstevel@tonic-gate char **keyid_str, int *keyid_len) 345*0Sstevel@tonic-gate { 346*0Sstevel@tonic-gate X509_ATTRIBUTE *attr = NULL; 347*0Sstevel@tonic-gate ASN1_OCTET_STRING *str = NULL; 348*0Sstevel@tonic-gate ASN1_TYPE *ty = NULL; 349*0Sstevel@tonic-gate int len = 0; 350*0Sstevel@tonic-gate int i; 351*0Sstevel@tonic-gate 352*0Sstevel@tonic-gate if (keyid_str != NULL) 353*0Sstevel@tonic-gate *keyid_str = NULL; 354*0Sstevel@tonic-gate if (keyid_len != NULL) 355*0Sstevel@tonic-gate *keyid_len = 0; 356*0Sstevel@tonic-gate 357*0Sstevel@tonic-gate if (pkey == NULL || pkey->attributes == NULL) { 358*0Sstevel@tonic-gate return (0); 359*0Sstevel@tonic-gate } 360*0Sstevel@tonic-gate 361*0Sstevel@tonic-gate if ((i = find_attr_by_nid(pkey->attributes, NID_localKeyID)) < 0) { 362*0Sstevel@tonic-gate return (0); 363*0Sstevel@tonic-gate } 364*0Sstevel@tonic-gate attr = sk_X509_ATTRIBUTE_value(pkey->attributes, i); 365*0Sstevel@tonic-gate 366*0Sstevel@tonic-gate if ((ty = attrib2type(attr)) == NULL || 367*0Sstevel@tonic-gate ty->type != V_ASN1_OCTET_STRING) { 368*0Sstevel@tonic-gate return (0); 369*0Sstevel@tonic-gate } 370*0Sstevel@tonic-gate 371*0Sstevel@tonic-gate if (dowhat == GETDO_DEL) { 372*0Sstevel@tonic-gate attr = sk_X509_ATTRIBUTE_delete(pkey->attributes, i); 373*0Sstevel@tonic-gate if (attr != NULL) 374*0Sstevel@tonic-gate X509_ATTRIBUTE_free(attr); 375*0Sstevel@tonic-gate return (0); 376*0Sstevel@tonic-gate } 377*0Sstevel@tonic-gate 378*0Sstevel@tonic-gate str = ty->value.octet_string; 379*0Sstevel@tonic-gate len = str->length; 380*0Sstevel@tonic-gate if ((*keyid_str = malloc(len)) == NULL) { 381*0Sstevel@tonic-gate SUNWerr(SUNW_F_GET_LOCALKEYID, SUNW_R_MEMORY_FAILURE); 382*0Sstevel@tonic-gate return (-1); 383*0Sstevel@tonic-gate } 384*0Sstevel@tonic-gate 385*0Sstevel@tonic-gate (void) memcpy(*keyid_str, str->data, len); 386*0Sstevel@tonic-gate *keyid_len = len; 387*0Sstevel@tonic-gate 388*0Sstevel@tonic-gate return (len); 389*0Sstevel@tonic-gate } 390*0Sstevel@tonic-gate 391*0Sstevel@tonic-gate /* 392*0Sstevel@tonic-gate * sunw_get_pkey_fname() gets the friendlyName from a private key. It can 393*0Sstevel@tonic-gate * optionally remove the value found. 394*0Sstevel@tonic-gate * 395*0Sstevel@tonic-gate * Arguments: 396*0Sstevel@tonic-gate * dowhat - What to do with the attributes (remove them or copy them). 397*0Sstevel@tonic-gate * pkey - Points to a private key to get the frientlyname from 398*0Sstevel@tonic-gate * fname - Points to a location which will receive the pointer to a 399*0Sstevel@tonic-gate * byte string with the ASCII friendlyname 400*0Sstevel@tonic-gate * 401*0Sstevel@tonic-gate * Returns: 402*0Sstevel@tonic-gate * >= 0 - The number of characters in the frienlyname returned. 403*0Sstevel@tonic-gate * < 0 - An error occurred. It was probably an error in allocating 404*0Sstevel@tonic-gate * memory. The error will be set in the error stack. Call 405*0Sstevel@tonic-gate * ERR_get_error() to get specific information. 406*0Sstevel@tonic-gate */ 407*0Sstevel@tonic-gate int 408*0Sstevel@tonic-gate sunw_get_pkey_fname(getdo_actions_t dowhat, EVP_PKEY *pkey, char **fname) 409*0Sstevel@tonic-gate { 410*0Sstevel@tonic-gate X509_ATTRIBUTE *attr = NULL; 411*0Sstevel@tonic-gate ASN1_BMPSTRING *str = NULL; 412*0Sstevel@tonic-gate ASN1_TYPE *ty = NULL; 413*0Sstevel@tonic-gate int len = 0; 414*0Sstevel@tonic-gate int i; 415*0Sstevel@tonic-gate 416*0Sstevel@tonic-gate if (fname != NULL) 417*0Sstevel@tonic-gate *fname = NULL; 418*0Sstevel@tonic-gate 419*0Sstevel@tonic-gate if (pkey == NULL || pkey->attributes == NULL) { 420*0Sstevel@tonic-gate return (0); 421*0Sstevel@tonic-gate } 422*0Sstevel@tonic-gate 423*0Sstevel@tonic-gate if ((i = find_attr_by_nid(pkey->attributes, NID_friendlyName)) < 0) { 424*0Sstevel@tonic-gate return (0); 425*0Sstevel@tonic-gate } 426*0Sstevel@tonic-gate attr = sk_X509_ATTRIBUTE_value(pkey->attributes, i); 427*0Sstevel@tonic-gate 428*0Sstevel@tonic-gate if ((ty = attrib2type(attr)) == NULL || 429*0Sstevel@tonic-gate ty->type != V_ASN1_BMPSTRING) { 430*0Sstevel@tonic-gate return (0); 431*0Sstevel@tonic-gate } 432*0Sstevel@tonic-gate 433*0Sstevel@tonic-gate if (dowhat == GETDO_DEL) { 434*0Sstevel@tonic-gate attr = sk_X509_ATTRIBUTE_delete(pkey->attributes, i); 435*0Sstevel@tonic-gate if (attr != NULL) 436*0Sstevel@tonic-gate X509_ATTRIBUTE_free(attr); 437*0Sstevel@tonic-gate return (0); 438*0Sstevel@tonic-gate } 439*0Sstevel@tonic-gate 440*0Sstevel@tonic-gate str = ty->value.bmpstring; 441*0Sstevel@tonic-gate *fname = uni2asc(str->data, str->length); 442*0Sstevel@tonic-gate if (*fname == NULL) { 443*0Sstevel@tonic-gate SUNWerr(SUNW_F_GET_PKEY_FNAME, SUNW_R_MEMORY_FAILURE); 444*0Sstevel@tonic-gate return (-1); 445*0Sstevel@tonic-gate } 446*0Sstevel@tonic-gate 447*0Sstevel@tonic-gate len = strlen(*fname); 448*0Sstevel@tonic-gate 449*0Sstevel@tonic-gate return (len); 450*0Sstevel@tonic-gate } 451*0Sstevel@tonic-gate 452*0Sstevel@tonic-gate /* 453*0Sstevel@tonic-gate * sunw_find_localkeyid() searches stacks of certs and private keys, 454*0Sstevel@tonic-gate * and returns the first matching cert/private key found. 455*0Sstevel@tonic-gate * 456*0Sstevel@tonic-gate * Look for a keyid in a stack of certs. if 'certs' is NULL and 'pkeys' is 457*0Sstevel@tonic-gate * not NULL, search the list of private keys. Move the matching cert to 458*0Sstevel@tonic-gate * 'matching_cert' and its matching private key to 'matching_pkey'. If no 459*0Sstevel@tonic-gate * cert or keys match, no match occurred. 460*0Sstevel@tonic-gate * 461*0Sstevel@tonic-gate * Arguments: 462*0Sstevel@tonic-gate * keyid_str- A byte string with the localkeyid to match 463*0Sstevel@tonic-gate * keyid_len- Length of the keyid byte string. 464*0Sstevel@tonic-gate * pkeys - Points to a stack of private keys which match the certs. 465*0Sstevel@tonic-gate * This may be NULL, in which case no keys are returned. 466*0Sstevel@tonic-gate * certs - Points to a stack of certs to search. If NULL, search the 467*0Sstevel@tonic-gate * stack of keys instead. 468*0Sstevel@tonic-gate * matching_pkey 469*0Sstevel@tonic-gate * - Pointer to receive address of first matching pkey found. 470*0Sstevel@tonic-gate * 'matching_pkey' must not be NULL; '*matching_pkey' will be 471*0Sstevel@tonic-gate * reset. 472*0Sstevel@tonic-gate * matching_cert 473*0Sstevel@tonic-gate * - Pointer to receive address of first matching cert found. 474*0Sstevel@tonic-gate * 'matching_cert' must not be NULL; '*matching_cert' will be 475*0Sstevel@tonic-gate * reset. 476*0Sstevel@tonic-gate * 477*0Sstevel@tonic-gate * Returns: 478*0Sstevel@tonic-gate * < 0 - An error returned. Call ERR_get_error() to get errors information. 479*0Sstevel@tonic-gate * Where possible, memory has been freed. 480*0Sstevel@tonic-gate * >= 0 - Objects were found and returned. Which objects are indicated by 481*0Sstevel@tonic-gate * which bits are set (FOUND_PKEY and/or FOUND_CERT). 482*0Sstevel@tonic-gate */ 483*0Sstevel@tonic-gate int 484*0Sstevel@tonic-gate sunw_find_localkeyid(char *keyid_str, int len, STACK_OF(EVP_PKEY) *pkeys, 485*0Sstevel@tonic-gate STACK_OF(X509) *certs, EVP_PKEY **matching_pkey, X509 **matching_cert) 486*0Sstevel@tonic-gate { 487*0Sstevel@tonic-gate ASN1_STRING *cmpstr = NULL; 488*0Sstevel@tonic-gate EVP_PKEY *tmp_pkey = NULL; 489*0Sstevel@tonic-gate X509 *tmp_cert = NULL; 490*0Sstevel@tonic-gate int retval = 0; 491*0Sstevel@tonic-gate 492*0Sstevel@tonic-gate /* If NULL arguments, this is an error */ 493*0Sstevel@tonic-gate if (keyid_str == NULL || 494*0Sstevel@tonic-gate (pkeys == NULL || certs == NULL) || 495*0Sstevel@tonic-gate (pkeys != NULL && matching_pkey == NULL) || 496*0Sstevel@tonic-gate (certs != NULL && matching_cert == NULL)) { 497*0Sstevel@tonic-gate SUNWerr(SUNW_F_FIND_LOCALKEYID, SUNW_R_INVALID_ARG); 498*0Sstevel@tonic-gate return (-1); 499*0Sstevel@tonic-gate } 500*0Sstevel@tonic-gate 501*0Sstevel@tonic-gate if (matching_pkey != NULL) 502*0Sstevel@tonic-gate *matching_pkey = NULL; 503*0Sstevel@tonic-gate if (matching_cert != NULL) 504*0Sstevel@tonic-gate *matching_cert = NULL; 505*0Sstevel@tonic-gate 506*0Sstevel@tonic-gate cmpstr = (ASN1_STRING *)M_ASN1_OCTET_STRING_new(); 507*0Sstevel@tonic-gate if (cmpstr == NULL || 508*0Sstevel@tonic-gate M_ASN1_OCTET_STRING_set(cmpstr, keyid_str, len) == 0) { 509*0Sstevel@tonic-gate SUNWerr(SUNW_F_FIND_LOCALKEYID, SUNW_R_MEMORY_FAILURE); 510*0Sstevel@tonic-gate return (-1); 511*0Sstevel@tonic-gate } 512*0Sstevel@tonic-gate 513*0Sstevel@tonic-gate retval = find_attr(NID_localKeyID, cmpstr, pkeys, &tmp_pkey, certs, 514*0Sstevel@tonic-gate &tmp_cert); 515*0Sstevel@tonic-gate if (retval == 0) { 516*0Sstevel@tonic-gate ASN1_STRING_free(cmpstr); 517*0Sstevel@tonic-gate return (retval); 518*0Sstevel@tonic-gate } 519*0Sstevel@tonic-gate 520*0Sstevel@tonic-gate if (matching_pkey != NULL) 521*0Sstevel@tonic-gate *matching_pkey = tmp_pkey; 522*0Sstevel@tonic-gate if (matching_cert != NULL) 523*0Sstevel@tonic-gate *matching_cert = tmp_cert; 524*0Sstevel@tonic-gate 525*0Sstevel@tonic-gate return (retval); 526*0Sstevel@tonic-gate } 527*0Sstevel@tonic-gate 528*0Sstevel@tonic-gate /* 529*0Sstevel@tonic-gate * sunw_find_fname() searches stacks of certs and private keys for one with 530*0Sstevel@tonic-gate * a matching friendlyname and returns the first matching cert/private 531*0Sstevel@tonic-gate * key found. 532*0Sstevel@tonic-gate * 533*0Sstevel@tonic-gate * Look for a friendlyname in a stack of certs. if 'certs' is NULL and 'pkeys' 534*0Sstevel@tonic-gate * is not NULL, search the list of private keys. Move the matching cert to 535*0Sstevel@tonic-gate * 'matching_cert' and its matching private key to 'matching_pkey'. If no 536*0Sstevel@tonic-gate * cert or keys match, no match occurred. 537*0Sstevel@tonic-gate * 538*0Sstevel@tonic-gate * Arguments: 539*0Sstevel@tonic-gate * fname - Friendlyname to find (NULL-terminated ASCII string). 540*0Sstevel@tonic-gate * pkeys - Points to a stack of private keys which match the certs. 541*0Sstevel@tonic-gate * This may be NULL, in which case no keys are returned. 542*0Sstevel@tonic-gate * certs - Points to a stack of certs to search. If NULL, search the 543*0Sstevel@tonic-gate * stack of keys instead. 544*0Sstevel@tonic-gate * matching_pkey 545*0Sstevel@tonic-gate * - Pointer to receive address of first matching pkey found. 546*0Sstevel@tonic-gate * matching_cert 547*0Sstevel@tonic-gate * - Pointer to receive address of first matching cert found. 548*0Sstevel@tonic-gate * 549*0Sstevel@tonic-gate * Returns: 550*0Sstevel@tonic-gate * < 0 - An error returned. Call ERR_get_error() to get errors information. 551*0Sstevel@tonic-gate * Where possible, memory has been freed. 552*0Sstevel@tonic-gate * >= 0 - Objects were found and returned. Which objects are indicated by 553*0Sstevel@tonic-gate * which bits are set (FOUND_PKEY and/or FOUND_CERT). 554*0Sstevel@tonic-gate */ 555*0Sstevel@tonic-gate int 556*0Sstevel@tonic-gate sunw_find_fname(char *fname, STACK_OF(EVP_PKEY) *pkeys, STACK_OF(X509) *certs, 557*0Sstevel@tonic-gate EVP_PKEY **matching_pkey, X509 ** matching_cert) 558*0Sstevel@tonic-gate { 559*0Sstevel@tonic-gate ASN1_STRING *cmpstr = NULL; 560*0Sstevel@tonic-gate EVP_PKEY *tmp_pkey = NULL; 561*0Sstevel@tonic-gate X509 *tmp_cert = NULL; 562*0Sstevel@tonic-gate int retval = 0; 563*0Sstevel@tonic-gate 564*0Sstevel@tonic-gate /* If NULL arguments, this is an error */ 565*0Sstevel@tonic-gate if (fname == NULL || 566*0Sstevel@tonic-gate (pkeys == NULL || certs == NULL) || 567*0Sstevel@tonic-gate (pkeys != NULL && matching_pkey == NULL) || 568*0Sstevel@tonic-gate (certs != NULL && matching_cert == NULL)) { 569*0Sstevel@tonic-gate SUNWerr(SUNW_F_FIND_FNAME, SUNW_R_INVALID_ARG); 570*0Sstevel@tonic-gate return (-1); 571*0Sstevel@tonic-gate } 572*0Sstevel@tonic-gate 573*0Sstevel@tonic-gate if (matching_pkey != NULL) 574*0Sstevel@tonic-gate *matching_pkey = NULL; 575*0Sstevel@tonic-gate if (matching_cert != NULL) 576*0Sstevel@tonic-gate *matching_cert = NULL; 577*0Sstevel@tonic-gate 578*0Sstevel@tonic-gate cmpstr = (ASN1_STRING *)asc2bmpstring(fname, strlen(fname)); 579*0Sstevel@tonic-gate if (cmpstr == NULL) { 580*0Sstevel@tonic-gate /* 581*0Sstevel@tonic-gate * Error already on stack 582*0Sstevel@tonic-gate */ 583*0Sstevel@tonic-gate return (-1); 584*0Sstevel@tonic-gate } 585*0Sstevel@tonic-gate 586*0Sstevel@tonic-gate retval = find_attr(NID_friendlyName, cmpstr, pkeys, &tmp_pkey, certs, 587*0Sstevel@tonic-gate &tmp_cert); 588*0Sstevel@tonic-gate if (retval == 0) { 589*0Sstevel@tonic-gate ASN1_STRING_free(cmpstr); 590*0Sstevel@tonic-gate return (retval); 591*0Sstevel@tonic-gate } 592*0Sstevel@tonic-gate 593*0Sstevel@tonic-gate if (matching_pkey != NULL) 594*0Sstevel@tonic-gate *matching_pkey = tmp_pkey; 595*0Sstevel@tonic-gate if (matching_cert != NULL) 596*0Sstevel@tonic-gate *matching_cert = tmp_cert; 597*0Sstevel@tonic-gate 598*0Sstevel@tonic-gate return (retval); 599*0Sstevel@tonic-gate } 600*0Sstevel@tonic-gate 601*0Sstevel@tonic-gate /* 602*0Sstevel@tonic-gate * sunw_print_times() formats and prints cert times to the given file. 603*0Sstevel@tonic-gate * 604*0Sstevel@tonic-gate * The label is printed on one line. One or both dates are printed on 605*0Sstevel@tonic-gate * the following line or two, each with it's own indented label in the 606*0Sstevel@tonic-gate * format: 607*0Sstevel@tonic-gate * 608*0Sstevel@tonic-gate * label 609*0Sstevel@tonic-gate * 'not before' date: whatever 610*0Sstevel@tonic-gate * 'not after' date: whatever 611*0Sstevel@tonic-gate * 612*0Sstevel@tonic-gate * Arguments: 613*0Sstevel@tonic-gate * fp - file pointer for file to write to. 614*0Sstevel@tonic-gate * dowhat - what field(s) to print. 615*0Sstevel@tonic-gate * label - Label to use. If NULL, no line will be printed. 616*0Sstevel@tonic-gate * cert - Points to a client or CA certs to check 617*0Sstevel@tonic-gate * 618*0Sstevel@tonic-gate * Returns: 619*0Sstevel@tonic-gate * < 0 - An error occured. 620*0Sstevel@tonic-gate * >= 0 - Number of lines written. 621*0Sstevel@tonic-gate */ 622*0Sstevel@tonic-gate int 623*0Sstevel@tonic-gate sunw_print_times(FILE *fp, prnt_actions_t dowhat, char *label, X509 *cert) 624*0Sstevel@tonic-gate { 625*0Sstevel@tonic-gate int lines = 0; 626*0Sstevel@tonic-gate 627*0Sstevel@tonic-gate if (label != NULL) { 628*0Sstevel@tonic-gate (void) fprintf(fp, "%s\n", label); 629*0Sstevel@tonic-gate lines++; 630*0Sstevel@tonic-gate } 631*0Sstevel@tonic-gate 632*0Sstevel@tonic-gate if (dowhat == PRNT_NOT_BEFORE || dowhat == PRNT_BOTH) { 633*0Sstevel@tonic-gate (void) fprintf(fp, "'not before' date: "); 634*0Sstevel@tonic-gate (void) print_time(fp, X509_get_notBefore(cert)); 635*0Sstevel@tonic-gate (void) fprintf(fp, "\n"); 636*0Sstevel@tonic-gate lines++; 637*0Sstevel@tonic-gate } 638*0Sstevel@tonic-gate 639*0Sstevel@tonic-gate if (dowhat == PRNT_NOT_AFTER || dowhat == PRNT_BOTH) { 640*0Sstevel@tonic-gate (void) fprintf(fp, "'not after' date: "); 641*0Sstevel@tonic-gate (void) print_time(fp, X509_get_notAfter(cert)); 642*0Sstevel@tonic-gate (void) fprintf(fp, "\n"); 643*0Sstevel@tonic-gate lines++; 644*0Sstevel@tonic-gate } 645*0Sstevel@tonic-gate return (lines); 646*0Sstevel@tonic-gate } 647*0Sstevel@tonic-gate 648*0Sstevel@tonic-gate /* 649*0Sstevel@tonic-gate * sunw_check_keys() compares the public key in the certificate and a 650*0Sstevel@tonic-gate * private key to ensure that they match. 651*0Sstevel@tonic-gate * 652*0Sstevel@tonic-gate * Arguments: 653*0Sstevel@tonic-gate * cert - Points to a certificate. 654*0Sstevel@tonic-gate * pkey - Points to a private key. 655*0Sstevel@tonic-gate * 656*0Sstevel@tonic-gate * Returns: 657*0Sstevel@tonic-gate * == 0 - These do not match. 658*0Sstevel@tonic-gate * != 0 - The cert's public key and the private key match. 659*0Sstevel@tonic-gate */ 660*0Sstevel@tonic-gate int 661*0Sstevel@tonic-gate sunw_check_keys(X509 *cert, EVP_PKEY *pkey) 662*0Sstevel@tonic-gate { 663*0Sstevel@tonic-gate int retval = 0; 664*0Sstevel@tonic-gate 665*0Sstevel@tonic-gate if (pkey != NULL && cert != NULL) 666*0Sstevel@tonic-gate retval = X509_check_private_key(cert, pkey); 667*0Sstevel@tonic-gate 668*0Sstevel@tonic-gate return (retval); 669*0Sstevel@tonic-gate } 670*0Sstevel@tonic-gate 671*0Sstevel@tonic-gate /* 672*0Sstevel@tonic-gate * sunw_issuer_attrs - Given a cert, return the issuer-specific attributes 673*0Sstevel@tonic-gate * as one ASCII string. 674*0Sstevel@tonic-gate * 675*0Sstevel@tonic-gate * Arguments: 676*0Sstevel@tonic-gate * cert - Cert to process 677*0Sstevel@tonic-gate * buf - If non-NULL, buffer to receive string. If NULL, one will 678*0Sstevel@tonic-gate * be allocated and its value will be returned to the caller. 679*0Sstevel@tonic-gate * len - If 'buff' is non-null, the buffer's length. 680*0Sstevel@tonic-gate * 681*0Sstevel@tonic-gate * This returns an ASCII string with all issuer-related attributes in one 682*0Sstevel@tonic-gate * string separated by '/' characters. Each attribute begins with its name 683*0Sstevel@tonic-gate * and an equal sign. Two attributes (ATTR1 and Attr2) would have the 684*0Sstevel@tonic-gate * following form: 685*0Sstevel@tonic-gate * 686*0Sstevel@tonic-gate * ATTR1=attr_value/ATTR2=attr2_value 687*0Sstevel@tonic-gate * 688*0Sstevel@tonic-gate * Returns: 689*0Sstevel@tonic-gate * != NULL - Pointer to the ASCII string containing the issuer-related 690*0Sstevel@tonic-gate * attributes. If the 'buf' argument was NULL, this is a 691*0Sstevel@tonic-gate * dynamically-allocated buffer and the caller will have the 692*0Sstevel@tonic-gate * responsibility for freeing it. 693*0Sstevel@tonic-gate * NULL - Memory needed to be allocated but could not be. Errors 694*0Sstevel@tonic-gate * are set on the error stack. 695*0Sstevel@tonic-gate */ 696*0Sstevel@tonic-gate char * 697*0Sstevel@tonic-gate sunw_issuer_attrs(X509 *cert, char *buf, int len) 698*0Sstevel@tonic-gate { 699*0Sstevel@tonic-gate return (X509_NAME_oneline(X509_get_issuer_name(cert), buf, len)); 700*0Sstevel@tonic-gate } 701*0Sstevel@tonic-gate 702*0Sstevel@tonic-gate /* 703*0Sstevel@tonic-gate * sunw_subject_attrs - Given a cert, return the subject-specific attributes 704*0Sstevel@tonic-gate * as one ASCII string. 705*0Sstevel@tonic-gate * 706*0Sstevel@tonic-gate * Arguments: 707*0Sstevel@tonic-gate * cert - Cert to process 708*0Sstevel@tonic-gate * buf - If non-NULL, buffer to receive string. If NULL, one will 709*0Sstevel@tonic-gate * be allocated and its value will be returned to the caller. 710*0Sstevel@tonic-gate * len - If 'buff' is non-null, the buffer's length. 711*0Sstevel@tonic-gate * 712*0Sstevel@tonic-gate * This returns an ASCII string with all subject-related attributes in one 713*0Sstevel@tonic-gate * string separated by '/' characters. Each attribute begins with its name 714*0Sstevel@tonic-gate * and an equal sign. Two attributes (ATTR1 and Attr2) would have the 715*0Sstevel@tonic-gate * following form: 716*0Sstevel@tonic-gate * 717*0Sstevel@tonic-gate * ATTR1=attr_value/ATTR2=attr2_value 718*0Sstevel@tonic-gate * 719*0Sstevel@tonic-gate * Returns: 720*0Sstevel@tonic-gate * != NULL - Pointer to the ASCII string containing the subject-related 721*0Sstevel@tonic-gate * attributes. If the 'buf' argument was NULL, this is a 722*0Sstevel@tonic-gate * dynamically-allocated buffer and the caller will have the 723*0Sstevel@tonic-gate * responsibility for freeing it. 724*0Sstevel@tonic-gate * NULL - Memory needed to be allocated but could not be. Errors 725*0Sstevel@tonic-gate * are set on the error stack. 726*0Sstevel@tonic-gate */ 727*0Sstevel@tonic-gate char * 728*0Sstevel@tonic-gate sunw_subject_attrs(X509 *cert, char *buf, int len) 729*0Sstevel@tonic-gate { 730*0Sstevel@tonic-gate return (X509_NAME_oneline(X509_get_subject_name(cert), buf, len)); 731*0Sstevel@tonic-gate } 732*0Sstevel@tonic-gate 733*0Sstevel@tonic-gate /* 734*0Sstevel@tonic-gate * sunw_append_keys - Given two stacks of private keys, remove the keys from 735*0Sstevel@tonic-gate * the second stack and append them to the first. Both stacks must exist 736*0Sstevel@tonic-gate * at time of call. 737*0Sstevel@tonic-gate * 738*0Sstevel@tonic-gate * Arguments: 739*0Sstevel@tonic-gate * dst - the stack to receive the keys from 'src' 740*0Sstevel@tonic-gate * src - the stack whose keys are to be moved. 741*0Sstevel@tonic-gate * 742*0Sstevel@tonic-gate * Returns: 743*0Sstevel@tonic-gate * -1 - An error occurred. The error status is set. 744*0Sstevel@tonic-gate * >= 0 - The number of keys that were copied. 745*0Sstevel@tonic-gate */ 746*0Sstevel@tonic-gate int 747*0Sstevel@tonic-gate sunw_append_keys(STACK_OF(EVP_PKEY) *dst, STACK_OF(EVP_PKEY) *src) 748*0Sstevel@tonic-gate { 749*0Sstevel@tonic-gate EVP_PKEY *tmpk; 750*0Sstevel@tonic-gate int count = 0; 751*0Sstevel@tonic-gate 752*0Sstevel@tonic-gate while (sk_EVP_PKEY_num(src) > 0) { 753*0Sstevel@tonic-gate tmpk = sk_EVP_PKEY_delete(src, 0); 754*0Sstevel@tonic-gate if (sk_EVP_PKEY_push(dst, tmpk) == 0) { 755*0Sstevel@tonic-gate sunw_evp_pkey_free(tmpk); 756*0Sstevel@tonic-gate SUNWerr(SUNW_F_APPEND_KEYS, SUNW_R_MEMORY_FAILURE); 757*0Sstevel@tonic-gate return (-1); 758*0Sstevel@tonic-gate } 759*0Sstevel@tonic-gate count++; 760*0Sstevel@tonic-gate } 761*0Sstevel@tonic-gate 762*0Sstevel@tonic-gate return (count); 763*0Sstevel@tonic-gate } 764