1 files changed, 228 insertions, 57 deletions

diff --git a/src/lib/libcrypto/asn1/x_pubkey.c b/src/lib/libcrypto/asn1/x_pubkey.c
index 7d6d71af88..91c2756116 100644
--- a/src/lib/libcrypto/asn1/x_pubkey.c
+++ b/src/lib/libcrypto/asn1/x_pubkey.c
@@ -60,16 +60,23 @@
 #include "cryptlib.h"
 #include <openssl/asn1t.h>
 #include <openssl/x509.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
 
 /* Minor tweak to operation: free up EVP_PKEY */
 static int pubkey_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
-        if(operation == ASN1_OP_FREE_POST) {
+        {
+        if (operation == ASN1_OP_FREE_POST)
+                {
                 X509_PUBKEY *pubkey = (X509_PUBKEY *)*pval;
                 EVP_PKEY_free(pubkey->pkey);
-        }
+                }
         return 1;
-}
+        }
 
 ASN1_SEQUENCE_cb(X509_PUBKEY, pubkey_cb) = {
         ASN1_SIMPLE(X509_PUBKEY, algor, X509_ALGOR),
@@ -111,13 +118,12 @@ int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)
                         a->parameter->type=V_ASN1_NULL;
                         }
                 }
-        else
 #ifndef OPENSSL_NO_DSA
-                if (pkey->type == EVP_PKEY_DSA)
+        else if (pkey->type == EVP_PKEY_DSA)
                 {
                 unsigned char *pp;
                 DSA *dsa;
-
+                
                 dsa=pkey->pkey.dsa;
                 dsa->write_params=0;
                 ASN1_TYPE_free(a->parameter);
@@ -151,8 +157,64 @@ int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)
                         }
                 OPENSSL_free(p);
                 }
-        else
 #endif
+#ifndef OPENSSL_NO_EC
+        else if (pkey->type == EVP_PKEY_EC)
+                {
+                int nid=0;
+                unsigned char *pp;
+                EC_KEY *ec_key;
+                const EC_GROUP *group;
+                
+                ec_key = pkey->pkey.ec;
+                ASN1_TYPE_free(a->parameter);
+
+                if ((a->parameter = ASN1_TYPE_new()) == NULL)
+                        {
+                        X509err(X509_F_X509_PUBKEY_SET, ERR_R_ASN1_LIB);
+                        goto err;
+                        }
+
+                group = EC_KEY_get0_group(ec_key);
+                if (EC_GROUP_get_asn1_flag(group)
+                     && (nid = EC_GROUP_get_curve_name(group)))
+                        {
+                        /* just set the OID */
+                        a->parameter->type = V_ASN1_OBJECT;
+                        a->parameter->value.object = OBJ_nid2obj(nid);
+                        }
+                else /* explicit parameters */
+                        {
+                        if ((i = i2d_ECParameters(ec_key, NULL)) == 0)
+                                {
+                                X509err(X509_F_X509_PUBKEY_SET, ERR_R_EC_LIB);
+                                goto err;
+                                }
+                        if ((p = (unsigned char *) OPENSSL_malloc(i)) == NULL)
+                                {
+                                X509err(X509_F_X509_PUBKEY_SET, ERR_R_MALLOC_FAILURE);
+                                goto err;
+                                }       
+                        pp = p;
+                        if (!i2d_ECParameters(ec_key, &pp))
+                                {
+                                X509err(X509_F_X509_PUBKEY_SET, ERR_R_EC_LIB);
+                                OPENSSL_free(p);
+                                goto err;
+                                }
+                        a->parameter->type = V_ASN1_SEQUENCE;
+                        if ((a->parameter->value.sequence = ASN1_STRING_new()) == NULL)
+                                {
+                                X509err(X509_F_X509_PUBKEY_SET, ERR_R_ASN1_LIB);
+                                OPENSSL_free(p);
+                                goto err;
+                                }
+                        ASN1_STRING_set(a->parameter->value.sequence, p, i);
+                        OPENSSL_free(p);
+                        }
+                }
+#endif
+        else if (1)
                 {
                 X509err(X509_F_X509_PUBKEY_SET,X509_R_UNSUPPORTED_ALGORITHM);
                 goto err;
@@ -171,7 +233,7 @@ int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)
                 X509err(X509_F_X509_PUBKEY_SET,ERR_R_MALLOC_FAILURE);
                 goto err;
                 }
-        /* Set number of unused bits to zero */
+        /* Set number of unused bits to zero */
         pk->public_key->flags&= ~(ASN1_STRING_FLAG_BITS_LEFT|0x07);
         pk->public_key->flags|=ASN1_STRING_FLAG_BITS_LEFT;
 
@@ -198,8 +260,8 @@ EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
         EVP_PKEY *ret=NULL;
         long j;
         int type;
-        unsigned char *p;
-#ifndef OPENSSL_NO_DSA
+        const unsigned char *p;
+#if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_ECDSA)
         const unsigned char *cp;
         X509_ALGOR *a;
 #endif
@@ -207,40 +269,106 @@ EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
         if (key == NULL) goto err;
 
         if (key->pkey != NULL)
-            {
-            CRYPTO_add(&key->pkey->references,1,CRYPTO_LOCK_EVP_PKEY);
-            return(key->pkey);
-            }
+                {
+                CRYPTO_add(&key->pkey->references, 1, CRYPTO_LOCK_EVP_PKEY);
+                return(key->pkey);
+                }
 
         if (key->public_key == NULL) goto err;
 
         type=OBJ_obj2nid(key->algor->algorithm);
-        p=key->public_key->data;
-        j=key->public_key->length;
-        if ((ret=d2i_PublicKey(type,NULL,&p,(long)j)) == NULL)
+        if ((ret = EVP_PKEY_new()) == NULL)
                 {
-                X509err(X509_F_X509_PUBKEY_GET,X509_R_ERR_ASN1_LIB);
+                X509err(X509_F_X509_PUBKEY_GET, ERR_R_MALLOC_FAILURE);
                 goto err;
                 }
-        ret->save_parameters=0;
+        ret->type = EVP_PKEY_type(type);
 
-#ifndef OPENSSL_NO_DSA
+        /* the parameters must be extracted before the public key (ECDSA!) */
+        
+#if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_ECDSA)
         a=key->algor;
-        if (ret->type == EVP_PKEY_DSA)
+#endif
+
+        if (0)
+                ;
+#ifndef OPENSSL_NO_DSA
+        else if (ret->type == EVP_PKEY_DSA)
                 {
                 if (a->parameter && (a->parameter->type == V_ASN1_SEQUENCE))
                         {
+                        if ((ret->pkey.dsa = DSA_new()) == NULL)
+                                {
+                                X509err(X509_F_X509_PUBKEY_GET, ERR_R_MALLOC_FAILURE);
+                                goto err;
+                                }
                         ret->pkey.dsa->write_params=0;
                         cp=p=a->parameter->value.sequence->data;
                         j=a->parameter->value.sequence->length;
-                        if (!d2i_DSAparams(&ret->pkey.dsa,&cp,(long)j))
+                        if (!d2i_DSAparams(&ret->pkey.dsa, &cp, (long)j))
                                 goto err;
                         }
                 ret->save_parameters=1;
                 }
 #endif
-        key->pkey=ret;
-        CRYPTO_add(&ret->references,1,CRYPTO_LOCK_EVP_PKEY);
+#ifndef OPENSSL_NO_EC
+        else if (ret->type == EVP_PKEY_EC)
+                {
+                if (a->parameter && (a->parameter->type == V_ASN1_SEQUENCE))
+                        {
+                        /* type == V_ASN1_SEQUENCE => we have explicit parameters
+                         * (e.g. parameters in the X9_62_EC_PARAMETERS-structure )
+                         */
+                        if ((ret->pkey.ec= EC_KEY_new()) == NULL)
+                                {
+                                X509err(X509_F_X509_PUBKEY_GET, 
+                                        ERR_R_MALLOC_FAILURE);
+                                goto err;
+                                }
+                        cp = p = a->parameter->value.sequence->data;
+                        j = a->parameter->value.sequence->length;
+                        if (!d2i_ECParameters(&ret->pkey.ec, &cp, (long)j))
+                                {
+                                X509err(X509_F_X509_PUBKEY_GET, ERR_R_EC_LIB);
+                                goto err;
+                                }
+                        }
+                else if (a->parameter && (a->parameter->type == V_ASN1_OBJECT))
+                        {
+                        /* type == V_ASN1_OBJECT => the parameters are given
+                         * by an asn1 OID
+                         */
+                        EC_KEY   *ec_key;
+                        EC_GROUP *group;
+
+                        if (ret->pkey.ec == NULL)
+                                ret->pkey.ec = EC_KEY_new();
+                        ec_key = ret->pkey.ec;
+                        if (ec_key == NULL)
+                                goto err;
+                        group = EC_GROUP_new_by_curve_name(OBJ_obj2nid(a->parameter->value.object));
+                        if (group == NULL)
+                                goto err;
+                        EC_GROUP_set_asn1_flag(group, OPENSSL_EC_NAMED_CURVE);
+                        if (EC_KEY_set_group(ec_key, group) == 0)
+                                goto err;
+                        EC_GROUP_free(group);
+                        }
+                        /* the case implicitlyCA is currently not implemented */
+                ret->save_parameters = 1;
+                }
+#endif
+
+        p=key->public_key->data;
+        j=key->public_key->length;
+        if (!d2i_PublicKey(type, &ret, &p, (long)j))
+                {
+                X509err(X509_F_X509_PUBKEY_GET, X509_R_ERR_ASN1_LIB);
+                goto err;
+                }
+
+        key->pkey = ret;
+        CRYPTO_add(&ret->references, 1, CRYPTO_LOCK_EVP_PKEY);
         return(ret);
 err:
         if (ret != NULL)
@@ -252,9 +380,9 @@ err:
  * and encode or decode as X509_PUBKEY
  */
 
-EVP_PKEY *d2i_PUBKEY(EVP_PKEY **a, unsigned char **pp,
+EVP_PKEY *d2i_PUBKEY(EVP_PKEY **a, const unsigned char **pp,
              long length)
-{
+        {
         X509_PUBKEY *xpk;
         EVP_PKEY *pktmp;
         xpk = d2i_X509_PUBKEY(NULL, pp, length);
@@ -262,15 +390,16 @@ EVP_PKEY *d2i_PUBKEY(EVP_PKEY **a, unsigned char **pp,
         pktmp = X509_PUBKEY_get(xpk);
         X509_PUBKEY_free(xpk);
         if(!pktmp) return NULL;
-        if(a) {
+        if(a)
+                {
                 EVP_PKEY_free(*a);
                 *a = pktmp;
-        }
+                }
         return pktmp;
-}
+        }
 
 int i2d_PUBKEY(EVP_PKEY *a, unsigned char **pp)
-{
+        {
         X509_PUBKEY *xpk=NULL;
         int ret;
         if(!a) return 0;
@@ -278,83 +407,125 @@ int i2d_PUBKEY(EVP_PKEY *a, unsigned char **pp)
         ret = i2d_X509_PUBKEY(xpk, pp);
         X509_PUBKEY_free(xpk);
         return ret;
-}
+        }
 
 /* The following are equivalents but which return RSA and DSA
  * keys
  */
 #ifndef OPENSSL_NO_RSA
-RSA *d2i_RSA_PUBKEY(RSA **a, unsigned char **pp,
+RSA *d2i_RSA_PUBKEY(RSA **a, const unsigned char **pp,
              long length)
-{
+        {
         EVP_PKEY *pkey;
         RSA *key;
-        unsigned char *q;
+        const unsigned char *q;
         q = *pp;
         pkey = d2i_PUBKEY(NULL, &q, length);
-        if(!pkey) return NULL;
+        if (!pkey) return NULL;
         key = EVP_PKEY_get1_RSA(pkey);
         EVP_PKEY_free(pkey);
-        if(!key) return NULL;
+        if (!key) return NULL;
         *pp = q;
-        if(a) {
+        if (a)
+                {
                 RSA_free(*a);
                 *a = key;
-        }
+                }
         return key;
-}
+        }
 
 int i2d_RSA_PUBKEY(RSA *a, unsigned char **pp)
-{
+        {
         EVP_PKEY *pktmp;
         int ret;
-        if(!a) return 0;
+        if (!a) return 0;
         pktmp = EVP_PKEY_new();
-        if(!pktmp) {
+        if (!pktmp)
+                {
                 ASN1err(ASN1_F_I2D_RSA_PUBKEY, ERR_R_MALLOC_FAILURE);
                 return 0;
-        }
+                }
         EVP_PKEY_set1_RSA(pktmp, a);
         ret = i2d_PUBKEY(pktmp, pp);
         EVP_PKEY_free(pktmp);
         return ret;
-}
+        }
 #endif
 
 #ifndef OPENSSL_NO_DSA
-DSA *d2i_DSA_PUBKEY(DSA **a, unsigned char **pp,
+DSA *d2i_DSA_PUBKEY(DSA **a, const unsigned char **pp,
              long length)
-{
+        {
         EVP_PKEY *pkey;
         DSA *key;
-        unsigned char *q;
+        const unsigned char *q;
         q = *pp;
         pkey = d2i_PUBKEY(NULL, &q, length);
-        if(!pkey) return NULL;
+        if (!pkey) return NULL;
         key = EVP_PKEY_get1_DSA(pkey);
         EVP_PKEY_free(pkey);
-        if(!key) return NULL;
+        if (!key) return NULL;
         *pp = q;
-        if(a) {
+        if (a)
+                {
                 DSA_free(*a);
                 *a = key;
-        }
+                }
         return key;
-}
+        }
 
 int i2d_DSA_PUBKEY(DSA *a, unsigned char **pp)
-{
+        {
         EVP_PKEY *pktmp;
         int ret;
         if(!a) return 0;
         pktmp = EVP_PKEY_new();
-        if(!pktmp) {
+        if(!pktmp)
+                {
                 ASN1err(ASN1_F_I2D_DSA_PUBKEY, ERR_R_MALLOC_FAILURE);
                 return 0;
-        }
+                }
         EVP_PKEY_set1_DSA(pktmp, a);
         ret = i2d_PUBKEY(pktmp, pp);
         EVP_PKEY_free(pktmp);
         return ret;
-}
+        }
+#endif
+
+#ifndef OPENSSL_NO_EC
+EC_KEY *d2i_EC_PUBKEY(EC_KEY **a, const unsigned char **pp, long length)
+        {
+        EVP_PKEY *pkey;
+        EC_KEY *key;
+        const unsigned char *q;
+        q = *pp;
+        pkey = d2i_PUBKEY(NULL, &q, length);
+        if (!pkey) return(NULL);
+        key = EVP_PKEY_get1_EC_KEY(pkey);
+        EVP_PKEY_free(pkey);
+        if (!key)  return(NULL);
+        *pp = q;
+        if (a)
+                {
+                EC_KEY_free(*a);
+                *a = key;
+                }
+        return(key);
+        }
+
+int i2d_EC_PUBKEY(EC_KEY *a, unsigned char **pp)
+        {
+        EVP_PKEY *pktmp;
+        int ret;
+        if (!a) return(0);
+        if ((pktmp = EVP_PKEY_new()) == NULL)
+                {
+                ASN1err(ASN1_F_I2D_EC_PUBKEY, ERR_R_MALLOC_FAILURE);
+                return(0);
+                }
+        EVP_PKEY_set1_EC_KEY(pktmp, a);
+        ret = i2d_PUBKEY(pktmp, pp);
+        EVP_PKEY_free(pktmp);
+        return(ret);
+        }
 #endif