1 | /* |
2 | * Copyright 1999-2016 The OpenSSL Project Authors. All Rights Reserved. |
3 | * |
4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at |
7 | * https://www.openssl.org/source/license.html |
8 | */ |
9 | |
10 | #include <stdio.h> |
11 | #include "internal/cryptlib.h" |
12 | #include <openssl/pkcs12.h> |
13 | #include "p12_local.h" |
14 | |
15 | /* Pack an object into an OCTET STRING and turn into a safebag */ |
16 | |
17 | PKCS12_SAFEBAG *PKCS12_item_pack_safebag(void *obj, const ASN1_ITEM *it, |
18 | int nid1, int nid2) |
19 | { |
20 | PKCS12_BAGS *bag; |
21 | PKCS12_SAFEBAG *safebag; |
22 | |
23 | if ((bag = PKCS12_BAGS_new()) == NULL) { |
24 | PKCS12err(PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE); |
25 | return NULL; |
26 | } |
27 | bag->type = OBJ_nid2obj(nid1); |
28 | if (!ASN1_item_pack(obj, it, &bag->value.octet)) { |
29 | PKCS12err(PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE); |
30 | goto err; |
31 | } |
32 | if ((safebag = PKCS12_SAFEBAG_new()) == NULL) { |
33 | PKCS12err(PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE); |
34 | goto err; |
35 | } |
36 | safebag->value.bag = bag; |
37 | safebag->type = OBJ_nid2obj(nid2); |
38 | return safebag; |
39 | |
40 | err: |
41 | PKCS12_BAGS_free(bag); |
42 | return NULL; |
43 | } |
44 | |
45 | /* Turn a stack of SAFEBAGS into a PKCS#7 data Contentinfo */ |
46 | PKCS7 *PKCS12_pack_p7data(STACK_OF(PKCS12_SAFEBAG) *sk) |
47 | { |
48 | PKCS7 *p7; |
49 | |
50 | if ((p7 = PKCS7_new()) == NULL) { |
51 | PKCS12err(PKCS12_F_PKCS12_PACK_P7DATA, ERR_R_MALLOC_FAILURE); |
52 | return NULL; |
53 | } |
54 | p7->type = OBJ_nid2obj(NID_pkcs7_data); |
55 | if ((p7->d.data = ASN1_OCTET_STRING_new()) == NULL) { |
56 | PKCS12err(PKCS12_F_PKCS12_PACK_P7DATA, ERR_R_MALLOC_FAILURE); |
57 | goto err; |
58 | } |
59 | |
60 | if (!ASN1_item_pack(sk, ASN1_ITEM_rptr(PKCS12_SAFEBAGS), &p7->d.data)) { |
61 | PKCS12err(PKCS12_F_PKCS12_PACK_P7DATA, PKCS12_R_CANT_PACK_STRUCTURE); |
62 | goto err; |
63 | } |
64 | return p7; |
65 | |
66 | err: |
67 | PKCS7_free(p7); |
68 | return NULL; |
69 | } |
70 | |
71 | /* Unpack SAFEBAGS from PKCS#7 data ContentInfo */ |
72 | STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_p7data(PKCS7 *p7) |
73 | { |
74 | if (!PKCS7_type_is_data(p7)) { |
75 | PKCS12err(PKCS12_F_PKCS12_UNPACK_P7DATA, |
76 | PKCS12_R_CONTENT_TYPE_NOT_DATA); |
77 | return NULL; |
78 | } |
79 | return ASN1_item_unpack(p7->d.data, ASN1_ITEM_rptr(PKCS12_SAFEBAGS)); |
80 | } |
81 | |
82 | /* Turn a stack of SAFEBAGS into a PKCS#7 encrypted data ContentInfo */ |
83 | |
84 | PKCS7 *PKCS12_pack_p7encdata(int pbe_nid, const char *pass, int passlen, |
85 | unsigned char *salt, int saltlen, int iter, |
86 | STACK_OF(PKCS12_SAFEBAG) *bags) |
87 | { |
88 | PKCS7 *p7; |
89 | X509_ALGOR *pbe; |
90 | const EVP_CIPHER *pbe_ciph; |
91 | |
92 | if ((p7 = PKCS7_new()) == NULL) { |
93 | PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE); |
94 | return NULL; |
95 | } |
96 | if (!PKCS7_set_type(p7, NID_pkcs7_encrypted)) { |
97 | PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, |
98 | PKCS12_R_ERROR_SETTING_ENCRYPTED_DATA_TYPE); |
99 | goto err; |
100 | } |
101 | |
102 | pbe_ciph = EVP_get_cipherbynid(pbe_nid); |
103 | |
104 | if (pbe_ciph) |
105 | pbe = PKCS5_pbe2_set(pbe_ciph, iter, salt, saltlen); |
106 | else |
107 | pbe = PKCS5_pbe_set(pbe_nid, iter, salt, saltlen); |
108 | |
109 | if (pbe == NULL) { |
110 | PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE); |
111 | goto err; |
112 | } |
113 | X509_ALGOR_free(p7->d.encrypted->enc_data->algorithm); |
114 | p7->d.encrypted->enc_data->algorithm = pbe; |
115 | ASN1_OCTET_STRING_free(p7->d.encrypted->enc_data->enc_data); |
116 | if (!(p7->d.encrypted->enc_data->enc_data = |
117 | PKCS12_item_i2d_encrypt(pbe, ASN1_ITEM_rptr(PKCS12_SAFEBAGS), pass, |
118 | passlen, bags, 1))) { |
119 | PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, PKCS12_R_ENCRYPT_ERROR); |
120 | goto err; |
121 | } |
122 | |
123 | return p7; |
124 | |
125 | err: |
126 | PKCS7_free(p7); |
127 | return NULL; |
128 | } |
129 | |
130 | STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_p7encdata(PKCS7 *p7, const char *pass, |
131 | int passlen) |
132 | { |
133 | if (!PKCS7_type_is_encrypted(p7)) |
134 | return NULL; |
135 | return PKCS12_item_decrypt_d2i(p7->d.encrypted->enc_data->algorithm, |
136 | ASN1_ITEM_rptr(PKCS12_SAFEBAGS), |
137 | pass, passlen, |
138 | p7->d.encrypted->enc_data->enc_data, 1); |
139 | } |
140 | |
141 | PKCS8_PRIV_KEY_INFO *PKCS12_decrypt_skey(const PKCS12_SAFEBAG *bag, |
142 | const char *pass, int passlen) |
143 | { |
144 | return PKCS8_decrypt(bag->value.shkeybag, pass, passlen); |
145 | } |
146 | |
147 | int PKCS12_pack_authsafes(PKCS12 *p12, STACK_OF(PKCS7) *safes) |
148 | { |
149 | if (ASN1_item_pack(safes, ASN1_ITEM_rptr(PKCS12_AUTHSAFES), |
150 | &p12->authsafes->d.data)) |
151 | return 1; |
152 | return 0; |
153 | } |
154 | |
155 | STACK_OF(PKCS7) *PKCS12_unpack_authsafes(const PKCS12 *p12) |
156 | { |
157 | if (!PKCS7_type_is_data(p12->authsafes)) { |
158 | PKCS12err(PKCS12_F_PKCS12_UNPACK_AUTHSAFES, |
159 | PKCS12_R_CONTENT_TYPE_NOT_DATA); |
160 | return NULL; |
161 | } |
162 | return ASN1_item_unpack(p12->authsafes->d.data, |
163 | ASN1_ITEM_rptr(PKCS12_AUTHSAFES)); |
164 | } |
165 | |