From 100d51416eeb76c9a7b601ab46f0919cf6408315 Mon Sep 17 00:00:00 2001 From: jsing <> Date: Tue, 8 Jul 2014 09:27:21 +0000 Subject: KNF. --- src/lib/libcrypto/pkcs12/p12_add.c | 112 +++++++++------- src/lib/libcrypto/pkcs12/p12_asn.c | 45 ++++--- src/lib/libcrypto/pkcs12/p12_attr.c | 62 +++++---- src/lib/libcrypto/pkcs12/p12_crpt.c | 30 +++-- src/lib/libcrypto/pkcs12/p12_crt.c | 191 +++++++++++++--------------- src/lib/libcrypto/pkcs12/p12_decr.c | 85 ++++++++----- src/lib/libcrypto/pkcs12/p12_init.c | 32 +++-- src/lib/libcrypto/pkcs12/p12_key.c | 91 +++++++------ src/lib/libcrypto/pkcs12/p12_kiss.c | 150 +++++++++++----------- src/lib/libcrypto/pkcs12/p12_mutl.c | 113 +++++++++------- src/lib/libcrypto/pkcs12/p12_npas.c | 114 ++++++++++------- src/lib/libcrypto/pkcs12/p12_p8d.c | 12 +- src/lib/libcrypto/pkcs12/p12_p8e.c | 28 ++-- src/lib/libcrypto/pkcs12/p12_utl.c | 87 ++++++++----- src/lib/libcrypto/pkcs12/pk12err.c | 137 ++++++++++---------- src/lib/libcrypto/pkcs12/pkcs12.h | 124 +++++++++--------- src/lib/libssl/src/crypto/pkcs12/p12_add.c | 112 +++++++++------- src/lib/libssl/src/crypto/pkcs12/p12_asn.c | 45 ++++--- src/lib/libssl/src/crypto/pkcs12/p12_attr.c | 62 +++++---- src/lib/libssl/src/crypto/pkcs12/p12_crpt.c | 30 +++-- src/lib/libssl/src/crypto/pkcs12/p12_crt.c | 191 +++++++++++++--------------- src/lib/libssl/src/crypto/pkcs12/p12_decr.c | 85 ++++++++----- src/lib/libssl/src/crypto/pkcs12/p12_init.c | 32 +++-- src/lib/libssl/src/crypto/pkcs12/p12_key.c | 91 +++++++------ src/lib/libssl/src/crypto/pkcs12/p12_kiss.c | 150 +++++++++++----------- src/lib/libssl/src/crypto/pkcs12/p12_mutl.c | 113 +++++++++------- src/lib/libssl/src/crypto/pkcs12/p12_npas.c | 114 ++++++++++------- src/lib/libssl/src/crypto/pkcs12/p12_p8d.c | 12 +- src/lib/libssl/src/crypto/pkcs12/p12_p8e.c | 28 ++-- src/lib/libssl/src/crypto/pkcs12/p12_utl.c | 87 ++++++++----- src/lib/libssl/src/crypto/pkcs12/pk12err.c | 137 ++++++++++---------- src/lib/libssl/src/crypto/pkcs12/pkcs12.h | 124 +++++++++--------- 32 files changed, 1514 insertions(+), 1312 deletions(-) diff --git a/src/lib/libcrypto/pkcs12/p12_add.c b/src/lib/libcrypto/pkcs12/p12_add.c index 57cca926d8..6aa872631e 100644 --- a/src/lib/libcrypto/pkcs12/p12_add.c +++ b/src/lib/libcrypto/pkcs12/p12_add.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_add.c,v 1.9 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_add.c,v 1.10 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 1999. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -62,22 +62,26 @@ /* Pack an object into an OCTET STRING and turn into a safebag */ -PKCS12_SAFEBAG *PKCS12_item_pack_safebag(void *obj, const ASN1_ITEM *it, int nid1, - int nid2) +PKCS12_SAFEBAG * +PKCS12_item_pack_safebag(void *obj, const ASN1_ITEM *it, int nid1, int nid2) { PKCS12_BAGS *bag; PKCS12_SAFEBAG *safebag; + if (!(bag = PKCS12_BAGS_new())) { - PKCS12err(PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE); + PKCS12err(PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG, + ERR_R_MALLOC_FAILURE); return NULL; } bag->type = OBJ_nid2obj(nid1); if (!ASN1_item_pack(obj, it, &bag->value.octet)) { - PKCS12err(PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE); + PKCS12err(PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG, + ERR_R_MALLOC_FAILURE); return NULL; } if (!(safebag = PKCS12_SAFEBAG_new())) { - PKCS12err(PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE); + PKCS12err(PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG, + ERR_R_MALLOC_FAILURE); return NULL; } safebag->value.bag = bag; @@ -87,11 +91,13 @@ PKCS12_SAFEBAG *PKCS12_item_pack_safebag(void *obj, const ASN1_ITEM *it, int nid /* Turn PKCS8 object into a keybag */ -PKCS12_SAFEBAG *PKCS12_MAKE_KEYBAG(PKCS8_PRIV_KEY_INFO *p8) +PKCS12_SAFEBAG * +PKCS12_MAKE_KEYBAG(PKCS8_PRIV_KEY_INFO *p8) { PKCS12_SAFEBAG *bag; + if (!(bag = PKCS12_SAFEBAG_new())) { - PKCS12err(PKCS12_F_PKCS12_MAKE_KEYBAG,ERR_R_MALLOC_FAILURE); + PKCS12err(PKCS12_F_PKCS12_MAKE_KEYBAG, ERR_R_MALLOC_FAILURE); return NULL; } bag->type = OBJ_nid2obj(NID_keyBag); @@ -101,9 +107,9 @@ PKCS12_SAFEBAG *PKCS12_MAKE_KEYBAG(PKCS8_PRIV_KEY_INFO *p8) /* Turn PKCS8 object into a shrouded keybag */ -PKCS12_SAFEBAG *PKCS12_MAKE_SHKEYBAG(int pbe_nid, const char *pass, - int passlen, unsigned char *salt, int saltlen, int iter, - PKCS8_PRIV_KEY_INFO *p8) +PKCS12_SAFEBAG * +PKCS12_MAKE_SHKEYBAG(int pbe_nid, const char *pass, int passlen, + unsigned char *salt, int saltlen, int iter, PKCS8_PRIV_KEY_INFO *p8) { PKCS12_SAFEBAG *bag; const EVP_CIPHER *pbe_ciph; @@ -121,9 +127,8 @@ PKCS12_SAFEBAG *PKCS12_MAKE_SHKEYBAG(int pbe_nid, const char *pass, if (pbe_ciph) pbe_nid = -1; - if (!(bag->value.shkeybag = - PKCS8_encrypt(pbe_nid, pbe_ciph, pass, passlen, salt, saltlen, iter, - p8))) { + if (!(bag->value.shkeybag = PKCS8_encrypt(pbe_nid, pbe_ciph, pass, + passlen, salt, saltlen, iter, p8))) { PKCS12err(PKCS12_F_PKCS12_MAKE_SHKEYBAG, ERR_R_MALLOC_FAILURE); return NULL; } @@ -132,9 +137,11 @@ PKCS12_SAFEBAG *PKCS12_MAKE_SHKEYBAG(int pbe_nid, const char *pass, } /* Turn a stack of SAFEBAGS into a PKCS#7 data Contentinfo */ -PKCS7 *PKCS12_pack_p7data(STACK_OF(PKCS12_SAFEBAG) *sk) +PKCS7 * +PKCS12_pack_p7data(STACK_OF(PKCS12_SAFEBAG) *sk) { PKCS7 *p7; + if (!(p7 = PKCS7_new())) { PKCS12err(PKCS12_F_PKCS12_PACK_P7DATA, ERR_R_MALLOC_FAILURE); return NULL; @@ -144,41 +151,44 @@ PKCS7 *PKCS12_pack_p7data(STACK_OF(PKCS12_SAFEBAG) *sk) PKCS12err(PKCS12_F_PKCS12_PACK_P7DATA, ERR_R_MALLOC_FAILURE); return NULL; } - + if (!ASN1_item_pack(sk, ASN1_ITEM_rptr(PKCS12_SAFEBAGS), &p7->d.data)) { - PKCS12err(PKCS12_F_PKCS12_PACK_P7DATA, PKCS12_R_CANT_PACK_STRUCTURE); + PKCS12err(PKCS12_F_PKCS12_PACK_P7DATA, + PKCS12_R_CANT_PACK_STRUCTURE); return NULL; } return p7; } /* Unpack SAFEBAGS from PKCS#7 data ContentInfo */ -STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_p7data(PKCS7 *p7) +STACK_OF(PKCS12_SAFEBAG) * +PKCS12_unpack_p7data(PKCS7 *p7) { - if(!PKCS7_type_is_data(p7)) - { - PKCS12err(PKCS12_F_PKCS12_UNPACK_P7DATA,PKCS12_R_CONTENT_TYPE_NOT_DATA); + if (!PKCS7_type_is_data(p7)) { + PKCS12err(PKCS12_F_PKCS12_UNPACK_P7DATA, + PKCS12_R_CONTENT_TYPE_NOT_DATA); return NULL; - } + } return ASN1_item_unpack(p7->d.data, ASN1_ITEM_rptr(PKCS12_SAFEBAGS)); } /* Turn a stack of SAFEBAGS into a PKCS#7 encrypted data ContentInfo */ -PKCS7 *PKCS12_pack_p7encdata(int pbe_nid, const char *pass, int passlen, - unsigned char *salt, int saltlen, int iter, - STACK_OF(PKCS12_SAFEBAG) *bags) +PKCS7 * +PKCS12_pack_p7encdata(int pbe_nid, const char *pass, int passlen, + unsigned char *salt, int saltlen, int iter, STACK_OF(PKCS12_SAFEBAG) *bags) { PKCS7 *p7; X509_ALGOR *pbe; const EVP_CIPHER *pbe_ciph; + if (!(p7 = PKCS7_new())) { PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE); return NULL; } - if(!PKCS7_set_type(p7, NID_pkcs7_encrypted)) { + if (!PKCS7_set_type(p7, NID_pkcs7_encrypted)) { PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, - PKCS12_R_ERROR_SETTING_ENCRYPTED_DATA_TYPE); + PKCS12_R_ERROR_SETTING_ENCRYPTED_DATA_TYPE); return NULL; } @@ -196,45 +206,49 @@ PKCS7 *PKCS12_pack_p7encdata(int pbe_nid, const char *pass, int passlen, X509_ALGOR_free(p7->d.encrypted->enc_data->algorithm); p7->d.encrypted->enc_data->algorithm = pbe; M_ASN1_OCTET_STRING_free(p7->d.encrypted->enc_data->enc_data); - if (!(p7->d.encrypted->enc_data->enc_data = - PKCS12_item_i2d_encrypt(pbe, ASN1_ITEM_rptr(PKCS12_SAFEBAGS), pass, passlen, - bags, 1))) { - PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, PKCS12_R_ENCRYPT_ERROR); + if (!(p7->d.encrypted->enc_data->enc_data = PKCS12_item_i2d_encrypt( + pbe, ASN1_ITEM_rptr(PKCS12_SAFEBAGS), pass, passlen, bags, 1))) { + PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, + PKCS12_R_ENCRYPT_ERROR); return NULL; } return p7; } -STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_p7encdata(PKCS7 *p7, const char *pass, int passlen) +STACK_OF(PKCS12_SAFEBAG) * +PKCS12_unpack_p7encdata(PKCS7 *p7, const char *pass, int passlen) { - if(!PKCS7_type_is_encrypted(p7)) return NULL; + if (!PKCS7_type_is_encrypted(p7)) + return NULL; return PKCS12_item_decrypt_d2i(p7->d.encrypted->enc_data->algorithm, - ASN1_ITEM_rptr(PKCS12_SAFEBAGS), - pass, passlen, - p7->d.encrypted->enc_data->enc_data, 1); + ASN1_ITEM_rptr(PKCS12_SAFEBAGS), pass, passlen, + p7->d.encrypted->enc_data->enc_data, 1); } -PKCS8_PRIV_KEY_INFO *PKCS12_decrypt_skey(PKCS12_SAFEBAG *bag, const char *pass, - int passlen) +PKCS8_PRIV_KEY_INFO * +PKCS12_decrypt_skey(PKCS12_SAFEBAG *bag, const char *pass, int passlen) { return PKCS8_decrypt(bag->value.shkeybag, pass, passlen); } -int PKCS12_pack_authsafes(PKCS12 *p12, STACK_OF(PKCS7) *safes) +int +PKCS12_pack_authsafes(PKCS12 *p12, STACK_OF(PKCS7) *safes) { - if(ASN1_item_pack(safes, ASN1_ITEM_rptr(PKCS12_AUTHSAFES), - &p12->authsafes->d.data)) - return 1; + if (ASN1_item_pack(safes, ASN1_ITEM_rptr(PKCS12_AUTHSAFES), + &p12->authsafes->d.data)) + return 1; return 0; } -STACK_OF(PKCS7) *PKCS12_unpack_authsafes(PKCS12 *p12) +STACK_OF(PKCS7) * +PKCS12_unpack_authsafes(PKCS12 *p12) { - if (!PKCS7_type_is_data(p12->authsafes)) - { - PKCS12err(PKCS12_F_PKCS12_UNPACK_AUTHSAFES,PKCS12_R_CONTENT_TYPE_NOT_DATA); + if (!PKCS7_type_is_data(p12->authsafes)) { + PKCS12err(PKCS12_F_PKCS12_UNPACK_AUTHSAFES, + PKCS12_R_CONTENT_TYPE_NOT_DATA); return NULL; - } - return ASN1_item_unpack(p12->authsafes->d.data, ASN1_ITEM_rptr(PKCS12_AUTHSAFES)); + } + return ASN1_item_unpack(p12->authsafes->d.data, + ASN1_ITEM_rptr(PKCS12_AUTHSAFES)); } diff --git a/src/lib/libcrypto/pkcs12/p12_asn.c b/src/lib/libcrypto/pkcs12/p12_asn.c index e3987752b6..b72db76383 100644 --- a/src/lib/libcrypto/pkcs12/p12_asn.c +++ b/src/lib/libcrypto/pkcs12/p12_asn.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_asn.c,v 1.4 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_asn.c,v 1.5 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 1999. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -79,12 +79,16 @@ ASN1_SEQUENCE(PKCS12_MAC_DATA) = { IMPLEMENT_ASN1_FUNCTIONS(PKCS12_MAC_DATA) -ASN1_ADB_TEMPLATE(bag_default) = ASN1_EXP(PKCS12_BAGS, value.other, ASN1_ANY, 0); +ASN1_ADB_TEMPLATE(bag_default) = + ASN1_EXP(PKCS12_BAGS, value.other, ASN1_ANY, 0); ASN1_ADB(PKCS12_BAGS) = { - ADB_ENTRY(NID_x509Certificate, ASN1_EXP(PKCS12_BAGS, value.x509cert, ASN1_OCTET_STRING, 0)), - ADB_ENTRY(NID_x509Crl, ASN1_EXP(PKCS12_BAGS, value.x509crl, ASN1_OCTET_STRING, 0)), - ADB_ENTRY(NID_sdsiCertificate, ASN1_EXP(PKCS12_BAGS, value.sdsicert, ASN1_IA5STRING, 0)), + ADB_ENTRY(NID_x509Certificate, + ASN1_EXP(PKCS12_BAGS, value.x509cert, ASN1_OCTET_STRING, 0)), + ADB_ENTRY(NID_x509Crl, + ASN1_EXP(PKCS12_BAGS, value.x509crl, ASN1_OCTET_STRING, 0)), + ADB_ENTRY(NID_sdsiCertificate, + ASN1_EXP(PKCS12_BAGS, value.sdsicert, ASN1_IA5STRING, 0)), } ASN1_ADB_END(PKCS12_BAGS, 0, type, 0, &bag_default_tt, NULL); ASN1_SEQUENCE(PKCS12_BAGS) = { @@ -94,15 +98,22 @@ ASN1_SEQUENCE(PKCS12_BAGS) = { IMPLEMENT_ASN1_FUNCTIONS(PKCS12_BAGS) -ASN1_ADB_TEMPLATE(safebag_default) = ASN1_EXP(PKCS12_SAFEBAG, value.other, ASN1_ANY, 0); +ASN1_ADB_TEMPLATE(safebag_default) = + ASN1_EXP(PKCS12_SAFEBAG, value.other, ASN1_ANY, 0); ASN1_ADB(PKCS12_SAFEBAG) = { - ADB_ENTRY(NID_keyBag, ASN1_EXP(PKCS12_SAFEBAG, value.keybag, PKCS8_PRIV_KEY_INFO, 0)), - ADB_ENTRY(NID_pkcs8ShroudedKeyBag, ASN1_EXP(PKCS12_SAFEBAG, value.shkeybag, X509_SIG, 0)), - ADB_ENTRY(NID_safeContentsBag, ASN1_EXP_SET_OF(PKCS12_SAFEBAG, value.safes, PKCS12_SAFEBAG, 0)), - ADB_ENTRY(NID_certBag, ASN1_EXP(PKCS12_SAFEBAG, value.bag, PKCS12_BAGS, 0)), - ADB_ENTRY(NID_crlBag, ASN1_EXP(PKCS12_SAFEBAG, value.bag, PKCS12_BAGS, 0)), - ADB_ENTRY(NID_secretBag, ASN1_EXP(PKCS12_SAFEBAG, value.bag, PKCS12_BAGS, 0)) + ADB_ENTRY(NID_keyBag, + ASN1_EXP(PKCS12_SAFEBAG, value.keybag, PKCS8_PRIV_KEY_INFO, 0)), + ADB_ENTRY(NID_pkcs8ShroudedKeyBag, + ASN1_EXP(PKCS12_SAFEBAG, value.shkeybag, X509_SIG, 0)), + ADB_ENTRY(NID_safeContentsBag, + ASN1_EXP_SET_OF(PKCS12_SAFEBAG, value.safes, PKCS12_SAFEBAG, 0)), + ADB_ENTRY(NID_certBag, + ASN1_EXP(PKCS12_SAFEBAG, value.bag, PKCS12_BAGS, 0)), + ADB_ENTRY(NID_crlBag, + ASN1_EXP(PKCS12_SAFEBAG, value.bag, PKCS12_BAGS, 0)), + ADB_ENTRY(NID_secretBag, + ASN1_EXP(PKCS12_SAFEBAG, value.bag, PKCS12_BAGS, 0)) } ASN1_ADB_END(PKCS12_SAFEBAG, 0, type, 0, &safebag_default_tt, NULL); ASN1_SEQUENCE(PKCS12_SAFEBAG) = { @@ -114,12 +125,12 @@ ASN1_SEQUENCE(PKCS12_SAFEBAG) = { IMPLEMENT_ASN1_FUNCTIONS(PKCS12_SAFEBAG) /* SEQUENCE OF SafeBag */ -ASN1_ITEM_TEMPLATE(PKCS12_SAFEBAGS) = - ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, PKCS12_SAFEBAGS, PKCS12_SAFEBAG) +ASN1_ITEM_TEMPLATE(PKCS12_SAFEBAGS) = +ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, PKCS12_SAFEBAGS, PKCS12_SAFEBAG) ASN1_ITEM_TEMPLATE_END(PKCS12_SAFEBAGS) /* Authsafes: SEQUENCE OF PKCS7 */ -ASN1_ITEM_TEMPLATE(PKCS12_AUTHSAFES) = - ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, PKCS12_AUTHSAFES, PKCS7) +ASN1_ITEM_TEMPLATE(PKCS12_AUTHSAFES) = +ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, PKCS12_AUTHSAFES, PKCS7) ASN1_ITEM_TEMPLATE_END(PKCS12_AUTHSAFES) diff --git a/src/lib/libcrypto/pkcs12/p12_attr.c b/src/lib/libcrypto/pkcs12/p12_attr.c index 67ffb392ab..05e9b11fd1 100644 --- a/src/lib/libcrypto/pkcs12/p12_attr.c +++ b/src/lib/libcrypto/pkcs12/p12_attr.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_attr.c,v 1.8 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_attr.c,v 1.9 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 1999. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -62,24 +62,26 @@ /* Add a local keyid to a safebag */ -int PKCS12_add_localkeyid(PKCS12_SAFEBAG *bag, unsigned char *name, - int namelen) +int +PKCS12_add_localkeyid(PKCS12_SAFEBAG *bag, unsigned char *name, int namelen) { if (X509at_add1_attr_by_NID(&bag->attrib, NID_localKeyID, - V_ASN1_OCTET_STRING, name, namelen)) + V_ASN1_OCTET_STRING, name, namelen)) return 1; - else + else return 0; } /* Add key usage to PKCS#8 structure */ -int PKCS8_add_keyusage(PKCS8_PRIV_KEY_INFO *p8, int usage) +int +PKCS8_add_keyusage(PKCS8_PRIV_KEY_INFO *p8, int usage) { unsigned char us_val; + us_val = (unsigned char) usage; if (X509at_add1_attr_by_NID(&p8->attributes, NID_key_usage, - V_ASN1_BIT_STRING, &us_val, 1)) + V_ASN1_BIT_STRING, &us_val, 1)) return 1; else return 0; @@ -87,59 +89,67 @@ int PKCS8_add_keyusage(PKCS8_PRIV_KEY_INFO *p8, int usage) /* Add a friendlyname to a safebag */ -int PKCS12_add_friendlyname_asc(PKCS12_SAFEBAG *bag, const char *name, - int namelen) +int +PKCS12_add_friendlyname_asc(PKCS12_SAFEBAG *bag, const char *name, int namelen) { if (X509at_add1_attr_by_NID(&bag->attrib, NID_friendlyName, - MBSTRING_ASC, (unsigned char *)name, namelen)) + MBSTRING_ASC, (unsigned char *)name, namelen)) return 1; else return 0; } -int PKCS12_add_friendlyname_uni(PKCS12_SAFEBAG *bag, - const unsigned char *name, int namelen) +int +PKCS12_add_friendlyname_uni(PKCS12_SAFEBAG *bag, const unsigned char *name, + int namelen) { if (X509at_add1_attr_by_NID(&bag->attrib, NID_friendlyName, - MBSTRING_BMP, name, namelen)) + MBSTRING_BMP, name, namelen)) return 1; else return 0; } -int PKCS12_add_CSPName_asc(PKCS12_SAFEBAG *bag, const char *name, - int namelen) +int +PKCS12_add_CSPName_asc(PKCS12_SAFEBAG *bag, const char *name, int namelen) { if (X509at_add1_attr_by_NID(&bag->attrib, NID_ms_csp_name, - MBSTRING_ASC, (unsigned char *)name, namelen)) + MBSTRING_ASC, (unsigned char *)name, namelen)) return 1; else return 0; } -ASN1_TYPE *PKCS12_get_attr_gen(STACK_OF(X509_ATTRIBUTE) *attrs, int attr_nid) +ASN1_TYPE * +PKCS12_get_attr_gen(STACK_OF(X509_ATTRIBUTE) *attrs, int attr_nid) { X509_ATTRIBUTE *attrib; int i; - if (!attrs) return NULL; + + if (!attrs) + return NULL; for (i = 0; i < sk_X509_ATTRIBUTE_num (attrs); i++) { attrib = sk_X509_ATTRIBUTE_value (attrs, i); if (OBJ_obj2nid (attrib->object) == attr_nid) { if (sk_ASN1_TYPE_num (attrib->value.set)) - return sk_ASN1_TYPE_value(attrib->value.set, 0); - else return NULL; + return sk_ASN1_TYPE_value(attrib->value.set, 0); + else + return NULL; } } return NULL; } -char *PKCS12_get_friendlyname(PKCS12_SAFEBAG *bag) +char * +PKCS12_get_friendlyname(PKCS12_SAFEBAG *bag) { ASN1_TYPE *atype; - if (!(atype = PKCS12_get_attr(bag, NID_friendlyName))) return NULL; - if (atype->type != V_ASN1_BMPSTRING) return NULL; + + if (!(atype = PKCS12_get_attr(bag, NID_friendlyName))) + return NULL; + if (atype->type != V_ASN1_BMPSTRING) + return NULL; return OPENSSL_uni2asc(atype->value.bmpstring->data, - atype->value.bmpstring->length); + atype->value.bmpstring->length); } - diff --git a/src/lib/libcrypto/pkcs12/p12_crpt.c b/src/lib/libcrypto/pkcs12/p12_crpt.c index c0b41f9252..1709b30d5e 100644 --- a/src/lib/libcrypto/pkcs12/p12_crpt.c +++ b/src/lib/libcrypto/pkcs12/p12_crpt.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_crpt.c,v 1.9 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_crpt.c,v 1.10 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 1999. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -62,12 +62,14 @@ /* PKCS#12 PBE algorithms now in static table */ -void PKCS12_PBE_add(void) +void +PKCS12_PBE_add(void) { } -int PKCS12_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen, - ASN1_TYPE *param, const EVP_CIPHER *cipher, const EVP_MD *md, int en_de) +int +PKCS12_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen, + ASN1_TYPE *param, const EVP_CIPHER *cipher, const EVP_MD *md, int en_de) { PBEPARAM *pbe; int saltlen, iter, ret; @@ -78,29 +80,31 @@ int PKCS12_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen, /* Extract useful info from parameter */ if (param == NULL || param->type != V_ASN1_SEQUENCE || param->value.sequence == NULL) { - PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN,PKCS12_R_DECODE_ERROR); + PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN, PKCS12_R_DECODE_ERROR); return 0; } pbuf = param->value.sequence->data; if (!(pbe = d2i_PBEPARAM(NULL, &pbuf, param->value.sequence->length))) { - PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN,PKCS12_R_DECODE_ERROR); + PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN, PKCS12_R_DECODE_ERROR); return 0; } - if (!pbe->iter) iter = 1; - else iter = ASN1_INTEGER_get (pbe->iter); + if (!pbe->iter) + iter = 1; + else + iter = ASN1_INTEGER_get (pbe->iter); salt = pbe->salt->data; saltlen = pbe->salt->length; if (!PKCS12_key_gen (pass, passlen, salt, saltlen, PKCS12_KEY_ID, - iter, EVP_CIPHER_key_length(cipher), key, md)) { - PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN,PKCS12_R_KEY_GEN_ERROR); + iter, EVP_CIPHER_key_length(cipher), key, md)) { + PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN, PKCS12_R_KEY_GEN_ERROR); PBEPARAM_free(pbe); return 0; } if (!PKCS12_key_gen (pass, passlen, salt, saltlen, PKCS12_IV_ID, - iter, EVP_CIPHER_iv_length(cipher), iv, md)) { - PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN,PKCS12_R_IV_GEN_ERROR); + iter, EVP_CIPHER_iv_length(cipher), iv, md)) { + PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN, PKCS12_R_IV_GEN_ERROR); PBEPARAM_free(pbe); return 0; } diff --git a/src/lib/libcrypto/pkcs12/p12_crt.c b/src/lib/libcrypto/pkcs12/p12_crt.c index a5dffcebd7..538637e78a 100644 --- a/src/lib/libcrypto/pkcs12/p12_crt.c +++ b/src/lib/libcrypto/pkcs12/p12_crt.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_crt.c,v 1.13 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_crt.c,v 1.14 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -61,12 +61,15 @@ #include -static int pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG) **pbags, PKCS12_SAFEBAG *bag); +static int pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG) **pbags, + PKCS12_SAFEBAG *bag); -static int copy_bag_attr(PKCS12_SAFEBAG *bag, EVP_PKEY *pkey, int nid) - { +static int +copy_bag_attr(PKCS12_SAFEBAG *bag, EVP_PKEY *pkey, int nid) +{ int idx; X509_ATTRIBUTE *attr; + idx = EVP_PKEY_get_attr_by_NID(pkey, nid, -1); if (idx < 0) return 1; @@ -74,11 +77,12 @@ static int copy_bag_attr(PKCS12_SAFEBAG *bag, EVP_PKEY *pkey, int nid) if (!X509at_add1_attr(&bag->attrib, attr)) return 0; return 1; - } +} -PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert, - STACK_OF(X509) *ca, int nid_key, int nid_cert, int iter, int mac_iter, - int keytype) +PKCS12 * +PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert, + STACK_OF(X509) *ca, int nid_key, int nid_cert, int iter, int mac_iter, + int keytype) { PKCS12 *p12 = NULL; STACK_OF(PKCS7) *safes = NULL; @@ -89,10 +93,9 @@ PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert, unsigned int keyidlen = 0; /* Set defaults */ - if (!nid_cert) - { + if (!nid_cert) { nid_cert = NID_pbe_WithSHA1And40BitRC2_CBC; - } + } if (!nid_key) nid_key = NID_pbe_WithSHA1And3_Key_TripleDES_CBC; if (!iter) @@ -100,43 +103,39 @@ PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert, if (!mac_iter) mac_iter = 1; - if(!pkey && !cert && !ca) - { - PKCS12err(PKCS12_F_PKCS12_CREATE,PKCS12_R_INVALID_NULL_ARGUMENT); + if (!pkey && !cert && !ca) { + PKCS12err(PKCS12_F_PKCS12_CREATE, + PKCS12_R_INVALID_NULL_ARGUMENT); return NULL; - } + } - if (pkey && cert) - { - if(!X509_check_private_key(cert, pkey)) + if (pkey && cert) { + if (!X509_check_private_key(cert, pkey)) return NULL; X509_digest(cert, EVP_sha1(), keyid, &keyidlen); - } + } - if (cert) - { + if (cert) { bag = PKCS12_add_cert(&bags, cert); - if(name && !PKCS12_add_friendlyname(bag, name, -1)) + if (name && !PKCS12_add_friendlyname(bag, name, -1)) goto err; - if(keyidlen && !PKCS12_add_localkeyid(bag, keyid, keyidlen)) + if (keyidlen && !PKCS12_add_localkeyid(bag, keyid, keyidlen)) goto err; - } + } /* Add all other certificates */ - for(i = 0; i < sk_X509_num(ca); i++) - { + for (i = 0; i < sk_X509_num(ca); i++) { if (!PKCS12_add_cert(&bags, sk_X509_value(ca, i))) goto err; - } + } if (bags && !PKCS12_add_safe(&safes, bags, nid_cert, iter, pass)) - goto err; + goto err; sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free); bags = NULL; - if (pkey) - { + if (pkey) { bag = PKCS12_add_key(&bags, pkey, keytype, iter, nid_key, pass); if (!bag) @@ -147,14 +146,14 @@ PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert, if (!copy_bag_attr(bag, pkey, NID_LocalKeySet)) goto err; - if(name && !PKCS12_add_friendlyname(bag, name, -1)) + if (name && !PKCS12_add_friendlyname(bag, name, -1)) goto err; - if(keyidlen && !PKCS12_add_localkeyid(bag, keyid, keyidlen)) + if (keyidlen && !PKCS12_add_localkeyid(bag, keyid, keyidlen)) goto err; - } + } if (bags && !PKCS12_add_safe(&safes, bags, -1, 0, NULL)) - goto err; + goto err; sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free); bags = NULL; @@ -169,13 +168,12 @@ PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert, safes = NULL; if ((mac_iter != -1) && - !PKCS12_set_mac(p12, pass, -1, NULL, 0, mac_iter, NULL)) - goto err; + !PKCS12_set_mac(p12, pass, -1, NULL, 0, mac_iter, NULL)) + goto err; return p12; - err: - +err: if (p12) PKCS12_free(p12); if (safes) @@ -183,11 +181,11 @@ PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert, if (bags) sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free); return NULL; - } -PKCS12_SAFEBAG *PKCS12_add_cert(STACK_OF(PKCS12_SAFEBAG) **pbags, X509 *cert) - { +PKCS12_SAFEBAG * +PKCS12_add_cert(STACK_OF(PKCS12_SAFEBAG) **pbags, X509 *cert) +{ PKCS12_SAFEBAG *bag = NULL; char *name; int namelen = -1; @@ -195,21 +193,19 @@ PKCS12_SAFEBAG *PKCS12_add_cert(STACK_OF(PKCS12_SAFEBAG) **pbags, X509 *cert) int keyidlen = -1; /* Add user certificate */ - if(!(bag = PKCS12_x5092certbag(cert))) + if (!(bag = PKCS12_x5092certbag(cert))) goto err; /* Use friendlyName and localKeyID in certificate. * (if present) */ - name = (char *)X509_alias_get0(cert, &namelen); - - if(name && !PKCS12_add_friendlyname(bag, name, namelen)) + if (name && !PKCS12_add_friendlyname(bag, name, namelen)) goto err; keyid = X509_keyid_get0(cert, &keyidlen); - if(keyid && !PKCS12_add_localkeyid(bag, keyid, keyidlen)) + if (keyid && !PKCS12_add_localkeyid(bag, keyid, keyidlen)) goto err; if (!pkcs12_add_bag(pbags, bag)) @@ -217,37 +213,33 @@ PKCS12_SAFEBAG *PKCS12_add_cert(STACK_OF(PKCS12_SAFEBAG) **pbags, X509 *cert) return bag; - err: - +err: if (bag) PKCS12_SAFEBAG_free(bag); return NULL; +} - } - -PKCS12_SAFEBAG *PKCS12_add_key(STACK_OF(PKCS12_SAFEBAG) **pbags, EVP_PKEY *key, - int key_usage, int iter, - int nid_key, char *pass) - { - +PKCS12_SAFEBAG * +PKCS12_add_key(STACK_OF(PKCS12_SAFEBAG) **pbags, EVP_PKEY *key, int key_usage, + int iter, int nid_key, char *pass) +{ PKCS12_SAFEBAG *bag = NULL; PKCS8_PRIV_KEY_INFO *p8 = NULL; /* Make a PKCS#8 structure */ - if(!(p8 = EVP_PKEY2PKCS8(key))) + if (!(p8 = EVP_PKEY2PKCS8(key))) goto err; - if(key_usage && !PKCS8_add_keyusage(p8, key_usage)) + if (key_usage && !PKCS8_add_keyusage(p8, key_usage)) goto err; - if (nid_key != -1) - { - bag = PKCS12_MAKE_SHKEYBAG(nid_key, pass, -1, NULL, 0, iter, p8); + if (nid_key != -1) { + bag = PKCS12_MAKE_SHKEYBAG(nid_key, pass, -1, NULL, 0, + iter, p8); PKCS8_PRIV_KEY_INFO_free(p8); - } - else + } else bag = PKCS12_MAKE_KEYBAG(p8); - if(!bag) + if (!bag) goto err; if (!pkcs12_add_bag(pbags, bag)) @@ -255,29 +247,26 @@ PKCS12_SAFEBAG *PKCS12_add_key(STACK_OF(PKCS12_SAFEBAG) **pbags, EVP_PKEY *key, return bag; - err: - +err: if (bag) PKCS12_SAFEBAG_free(bag); return NULL; +} - } - -int PKCS12_add_safe(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags, - int nid_safe, int iter, char *pass) - { +int +PKCS12_add_safe(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags, + int nid_safe, int iter, char *pass) +{ PKCS7 *p7 = NULL; int free_safes = 0; - if (!*psafes) - { + if (!*psafes) { *psafes = sk_PKCS7_new_null(); if (!*psafes) return 0; free_safes = 1; - } - else + } else free_safes = 0; if (nid_safe == 0) @@ -287,7 +276,7 @@ int PKCS12_add_safe(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags, p7 = PKCS12_pack_p7data(bags); else p7 = PKCS12_pack_p7encdata(nid_safe, pass, -1, NULL, 0, - iter, bags); + iter, bags); if (!p7) goto err; @@ -296,53 +285,49 @@ int PKCS12_add_safe(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags, return 1; - err: - if (free_safes) - { +err: + if (free_safes) { sk_PKCS7_free(*psafes); *psafes = NULL; - } + } if (p7) PKCS7_free(p7); return 0; +} - } - -static int pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG) **pbags, PKCS12_SAFEBAG *bag) - { +static int +pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG) **pbags, PKCS12_SAFEBAG *bag) +{ int free_bags; + if (!pbags) return 1; - if (!*pbags) - { + if (!*pbags) { *pbags = sk_PKCS12_SAFEBAG_new_null(); if (!*pbags) return 0; free_bags = 1; - } - else + } else free_bags = 0; - if (!sk_PKCS12_SAFEBAG_push(*pbags, bag)) - { - if (free_bags) - { + if (!sk_PKCS12_SAFEBAG_push(*pbags, bag)) { + if (free_bags) { sk_PKCS12_SAFEBAG_free(*pbags); *pbags = NULL; - } - return 0; } + return 0; + } return 1; +} - } - - -PKCS12 *PKCS12_add_safes(STACK_OF(PKCS7) *safes, int nid_p7) - { +PKCS12 * +PKCS12_add_safes(STACK_OF(PKCS7) *safes, int nid_p7) +{ PKCS12 *p12; + if (nid_p7 <= 0) nid_p7 = NID_pkcs7_data; p12 = PKCS12_init(nid_p7); @@ -350,12 +335,10 @@ PKCS12 *PKCS12_add_safes(STACK_OF(PKCS7) *safes, int nid_p7) if (!p12) return NULL; - if(!PKCS12_pack_authsafes(p12, safes)) - { + if (!PKCS12_pack_authsafes(p12, safes)) { PKCS12_free(p12); return NULL; - } + } return p12; - - } +} diff --git a/src/lib/libcrypto/pkcs12/p12_decr.c b/src/lib/libcrypto/pkcs12/p12_decr.c index 01fe24835f..577bb06f80 100644 --- a/src/lib/libcrypto/pkcs12/p12_decr.c +++ b/src/lib/libcrypto/pkcs12/p12_decr.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_decr.c,v 1.10 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_decr.c,v 1.11 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 1999. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -68,9 +68,9 @@ * malloc'ed buffer */ -unsigned char * PKCS12_pbe_crypt(X509_ALGOR *algor, const char *pass, - int passlen, unsigned char *in, int inlen, unsigned char **data, - int *datalen, int en_de) +unsigned char * +PKCS12_pbe_crypt(X509_ALGOR *algor, const char *pass, int passlen, + unsigned char *in, int inlen, unsigned char **data, int *datalen, int en_de) { unsigned char *out; int outlen, i; @@ -78,47 +78,52 @@ unsigned char * PKCS12_pbe_crypt(X509_ALGOR *algor, const char *pass, EVP_CIPHER_CTX_init(&ctx); /* Decrypt data */ - if (!EVP_PBE_CipherInit(algor->algorithm, pass, passlen, - algor->parameter, &ctx, en_de)) { - PKCS12err(PKCS12_F_PKCS12_PBE_CRYPT,PKCS12_R_PKCS12_ALGOR_CIPHERINIT_ERROR); + if (!EVP_PBE_CipherInit(algor->algorithm, pass, passlen, + algor->parameter, &ctx, en_de)) { + PKCS12err(PKCS12_F_PKCS12_PBE_CRYPT, + PKCS12_R_PKCS12_ALGOR_CIPHERINIT_ERROR); return NULL; } - if(!(out = malloc(inlen + EVP_CIPHER_CTX_block_size(&ctx)))) { - PKCS12err(PKCS12_F_PKCS12_PBE_CRYPT,ERR_R_MALLOC_FAILURE); + if (!(out = malloc(inlen + EVP_CIPHER_CTX_block_size(&ctx)))) { + PKCS12err(PKCS12_F_PKCS12_PBE_CRYPT, ERR_R_MALLOC_FAILURE); goto err; } - if (!EVP_CipherUpdate(&ctx, out, &i, in, inlen)) - { + if (!EVP_CipherUpdate(&ctx, out, &i, in, inlen)) { free(out); out = NULL; - PKCS12err(PKCS12_F_PKCS12_PBE_CRYPT,ERR_R_EVP_LIB); + PKCS12err(PKCS12_F_PKCS12_PBE_CRYPT, ERR_R_EVP_LIB); goto err; - } + } outlen = i; - if(!EVP_CipherFinal_ex(&ctx, out + i, &i)) { + if (!EVP_CipherFinal_ex(&ctx, out + i, &i)) { free(out); out = NULL; - PKCS12err(PKCS12_F_PKCS12_PBE_CRYPT,PKCS12_R_PKCS12_CIPHERFINAL_ERROR); + PKCS12err(PKCS12_F_PKCS12_PBE_CRYPT, + PKCS12_R_PKCS12_CIPHERFINAL_ERROR); goto err; } outlen += i; - if (datalen) *datalen = outlen; - if (data) *data = out; - err: + if (datalen) + *datalen = outlen; + if (data) + *data = out; + +err: EVP_CIPHER_CTX_cleanup(&ctx); return out; } -/* Decrypt an OCTET STRING and decode ASN1 structure +/* Decrypt an OCTET STRING and decode ASN1 structure * if zbuf set zero buffer after use. */ -void * PKCS12_item_decrypt_d2i(X509_ALGOR *algor, const ASN1_ITEM *it, - const char *pass, int passlen, ASN1_OCTET_STRING *oct, int zbuf) +void * +PKCS12_item_decrypt_d2i(X509_ALGOR *algor, const ASN1_ITEM *it, + const char *pass, int passlen, ASN1_OCTET_STRING *oct, int zbuf) { unsigned char *out; const unsigned char *p; @@ -126,8 +131,9 @@ void * PKCS12_item_decrypt_d2i(X509_ALGOR *algor, const ASN1_ITEM *it, int outlen; if (!PKCS12_pbe_crypt(algor, pass, passlen, oct->data, oct->length, - &out, &outlen, 0)) { - PKCS12err(PKCS12_F_PKCS12_ITEM_DECRYPT_D2I,PKCS12_R_PKCS12_PBE_CRYPT_ERROR); + &out, &outlen, 0)) { + PKCS12err(PKCS12_F_PKCS12_ITEM_DECRYPT_D2I, + PKCS12_R_PKCS12_PBE_CRYPT_ERROR); return NULL; } p = out; @@ -144,39 +150,48 @@ void * PKCS12_item_decrypt_d2i(X509_ALGOR *algor, const ASN1_ITEM *it, } #endif ret = ASN1_item_d2i(NULL, &p, outlen, it); - if (zbuf) OPENSSL_cleanse(out, outlen); - if(!ret) PKCS12err(PKCS12_F_PKCS12_ITEM_DECRYPT_D2I,PKCS12_R_DECODE_ERROR); + if (zbuf) + OPENSSL_cleanse(out, outlen); + if (!ret) + PKCS12err(PKCS12_F_PKCS12_ITEM_DECRYPT_D2I, + PKCS12_R_DECODE_ERROR); free(out); return ret; } -/* Encode ASN1 structure and encrypt, return OCTET STRING +/* Encode ASN1 structure and encrypt, return OCTET STRING * if zbuf set zero encoding. */ -ASN1_OCTET_STRING *PKCS12_item_i2d_encrypt(X509_ALGOR *algor, const ASN1_ITEM *it, - const char *pass, int passlen, - void *obj, int zbuf) +ASN1_OCTET_STRING * +PKCS12_item_i2d_encrypt(X509_ALGOR *algor, const ASN1_ITEM *it, + const char *pass, int passlen, + void *obj, int zbuf) { ASN1_OCTET_STRING *oct; unsigned char *in = NULL; int inlen; + if (!(oct = M_ASN1_OCTET_STRING_new ())) { - PKCS12err(PKCS12_F_PKCS12_ITEM_I2D_ENCRYPT,ERR_R_MALLOC_FAILURE); + PKCS12err(PKCS12_F_PKCS12_ITEM_I2D_ENCRYPT, + ERR_R_MALLOC_FAILURE); return NULL; } inlen = ASN1_item_i2d(obj, &in, it); if (!in) { - PKCS12err(PKCS12_F_PKCS12_ITEM_I2D_ENCRYPT,PKCS12_R_ENCODE_ERROR); + PKCS12err(PKCS12_F_PKCS12_ITEM_I2D_ENCRYPT, + PKCS12_R_ENCODE_ERROR); return NULL; } if (!PKCS12_pbe_crypt(algor, pass, passlen, in, inlen, &oct->data, - &oct->length, 1)) { - PKCS12err(PKCS12_F_PKCS12_ITEM_I2D_ENCRYPT,PKCS12_R_ENCRYPT_ERROR); + &oct->length, 1)) { + PKCS12err(PKCS12_F_PKCS12_ITEM_I2D_ENCRYPT, + PKCS12_R_ENCRYPT_ERROR); free(in); return NULL; } - if (zbuf) OPENSSL_cleanse(in, inlen); + if (zbuf) + OPENSSL_cleanse(in, inlen); free(in); return oct; } diff --git a/src/lib/libcrypto/pkcs12/p12_init.c b/src/lib/libcrypto/pkcs12/p12_init.c index e9c55ea265..b4da7be77c 100644 --- a/src/lib/libcrypto/pkcs12/p12_init.c +++ b/src/lib/libcrypto/pkcs12/p12_init.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_init.c,v 1.7 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_init.c,v 1.8 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 1999. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -62,31 +62,35 @@ /* Initialise a PKCS12 structure to take data */ -PKCS12 *PKCS12_init(int mode) +PKCS12 * +PKCS12_init(int mode) { PKCS12 *pkcs12; + if (!(pkcs12 = PKCS12_new())) { - PKCS12err(PKCS12_F_PKCS12_INIT,ERR_R_MALLOC_FAILURE); + PKCS12err(PKCS12_F_PKCS12_INIT, ERR_R_MALLOC_FAILURE); return NULL; } ASN1_INTEGER_set(pkcs12->version, 3); pkcs12->authsafes->type = OBJ_nid2obj(mode); switch (mode) { - case NID_pkcs7_data: - if (!(pkcs12->authsafes->d.data = - M_ASN1_OCTET_STRING_new())) { - PKCS12err(PKCS12_F_PKCS12_INIT,ERR_R_MALLOC_FAILURE); + case NID_pkcs7_data: + if (!(pkcs12->authsafes->d.data = + M_ASN1_OCTET_STRING_new())) { + PKCS12err(PKCS12_F_PKCS12_INIT, ERR_R_MALLOC_FAILURE); goto err; } break; - default: - PKCS12err(PKCS12_F_PKCS12_INIT, - PKCS12_R_UNSUPPORTED_PKCS12_MODE); - goto err; + default: + PKCS12err(PKCS12_F_PKCS12_INIT, + PKCS12_R_UNSUPPORTED_PKCS12_MODE); + goto err; } - + return pkcs12; + err: - if (pkcs12 != NULL) PKCS12_free(pkcs12); + if (pkcs12 != NULL) + PKCS12_free(pkcs12); return NULL; } diff --git a/src/lib/libcrypto/pkcs12/p12_key.c b/src/lib/libcrypto/pkcs12/p12_key.c index 24c86b7fc8..ffa736a04f 100644 --- a/src/lib/libcrypto/pkcs12/p12_key.c +++ b/src/lib/libcrypto/pkcs12/p12_key.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_key.c,v 1.15 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_key.c,v 1.16 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 1999. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -74,35 +74,37 @@ void h__dump (unsigned char *p, int len); #define min(a,b) ((a) < (b) ? (a) : (b)) #endif -int PKCS12_key_gen_asc(const char *pass, int passlen, unsigned char *salt, - int saltlen, int id, int iter, int n, unsigned char *out, - const EVP_MD *md_type) +int +PKCS12_key_gen_asc(const char *pass, int passlen, unsigned char *salt, + int saltlen, int id, int iter, int n, unsigned char *out, + const EVP_MD *md_type) { int ret; unsigned char *unipass; int uniplen; - if(!pass) { + if (!pass) { unipass = NULL; uniplen = 0; } else if (!OPENSSL_asc2uni(pass, passlen, &unipass, &uniplen)) { - PKCS12err(PKCS12_F_PKCS12_KEY_GEN_ASC,ERR_R_MALLOC_FAILURE); + PKCS12err(PKCS12_F_PKCS12_KEY_GEN_ASC, ERR_R_MALLOC_FAILURE); return 0; } ret = PKCS12_key_gen_uni(unipass, uniplen, salt, saltlen, - id, iter, n, out, md_type); + id, iter, n, out, md_type); if (ret <= 0) - return 0; - if(unipass) { + return 0; + if (unipass) { OPENSSL_cleanse(unipass, uniplen); /* Clear password from memory */ free(unipass); } return ret; } -int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, - int saltlen, int id, int iter, int n, unsigned char *out, - const EVP_MD *md_type) +int +PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, + int saltlen, int id, int iter, int n, unsigned char *out, + const EVP_MD *md_type) { unsigned char *B, *D, *I, *p, *Ai; int Slen, Plen, Ilen, Ijlen; @@ -117,7 +119,7 @@ int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, #if 0 if (!pass) { - PKCS12err(PKCS12_F_PKCS12_KEY_GEN_UNI,ERR_R_PASSED_NULL_PARAMETER); + PKCS12err(PKCS12_F_PKCS12_KEY_GEN_UNI, ERR_R_PASSED_NULL_PARAMETER); return 0; } #endif @@ -131,37 +133,42 @@ int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, fprintf(stderr, "Salt (length %d):\n", saltlen); h__dump(salt, saltlen); #endif - v = EVP_MD_block_size (md_type); - u = EVP_MD_size (md_type); + v = EVP_MD_block_size(md_type); + u = EVP_MD_size(md_type); if (u < 0) - return 0; - D = malloc (v); - Ai = malloc (u); - B = malloc (v + 1); - Slen = v * ((saltlen+v-1)/v); - if(passlen) Plen = v * ((passlen+v-1)/v); - else Plen = 0; + return 0; + D = malloc(v); + Ai = malloc(u); + B = malloc(v + 1); + Slen = v * ((saltlen + v - 1) / v); + if (passlen) + Plen = v * ((passlen + v - 1)/v); + else + Plen = 0; Ilen = Slen + Plen; - I = malloc (Ilen); + I = malloc(Ilen); Ij = BN_new(); Bpl1 = BN_new(); if (!D || !Ai || !B || !I || !Ij || !Bpl1) goto err; - for (i = 0; i < v; i++) D[i] = id; + for (i = 0; i < v; i++) + D[i] = id; p = I; - for (i = 0; i < Slen; i++) *p++ = salt[i % saltlen]; - for (i = 0; i < Plen; i++) *p++ = pass[i % passlen]; + for (i = 0; i < Slen; i++) + *p++ = salt[i % saltlen]; + for (i = 0; i < Plen; i++) + *p++ = pass[i % passlen]; for (;;) { - if (!EVP_DigestInit_ex(&ctx, md_type, NULL) - || !EVP_DigestUpdate(&ctx, D, v) - || !EVP_DigestUpdate(&ctx, I, Ilen) - || !EVP_DigestFinal_ex(&ctx, Ai, NULL)) + if (!EVP_DigestInit_ex(&ctx, md_type, NULL) || + !EVP_DigestUpdate(&ctx, D, v) || + !EVP_DigestUpdate(&ctx, I, Ilen) || + !EVP_DigestFinal_ex(&ctx, Ai, NULL)) goto err; for (j = 1; j < iter; j++) { - if (!EVP_DigestInit_ex(&ctx, md_type, NULL) - || !EVP_DigestUpdate(&ctx, Ai, u) - || !EVP_DigestFinal_ex(&ctx, Ai, NULL)) - goto err; + if (!EVP_DigestInit_ex(&ctx, md_type, NULL) || + !EVP_DigestUpdate(&ctx, Ai, u) || + !EVP_DigestFinal_ex(&ctx, Ai, NULL)) + goto err; } memcpy (out, Ai, min (n, u)); if (u >= n) { @@ -174,13 +181,14 @@ int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, } n -= u; out += u; - for (j = 0; j < v; j++) B[j] = Ai[j % u]; + for (j = 0; j < v; j++) + B[j] = Ai[j % u]; /* Work out B + 1 first then can use B as tmp space */ if (!BN_bin2bn (B, v, Bpl1)) goto err; if (!BN_add_word (Bpl1, 1)) goto err; - for (j = 0; j < Ilen ; j+=v) { + for (j = 0; j < Ilen; j += v) { if (!BN_bin2bn(I + j, v, Ij)) goto err; if (!BN_add(Ij, Ij, Bpl1)) @@ -194,7 +202,7 @@ int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, goto err; memcpy (I + j, B + 1, v); #ifndef PKCS12_BROKEN_KEYGEN - /* If less than v bytes pad with zeroes */ + /* If less than v bytes pad with zeroes */ } else if (Ijlen < v) { memset(I + j, 0, v - Ijlen); if (!BN_bn2bin(Ij, I + j + v - Ijlen)) @@ -206,7 +214,7 @@ int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, } err: - PKCS12err(PKCS12_F_PKCS12_KEY_GEN_UNI,ERR_R_MALLOC_FAILURE); + PKCS12err(PKCS12_F_PKCS12_KEY_GEN_UNI, ERR_R_MALLOC_FAILURE); end: free (Ai); @@ -221,7 +229,8 @@ end: #ifdef DEBUG_KEYGEN void h__dump (unsigned char *p, int len) { - for (; len --; p++) fprintf(stderr, "%02X", *p); - fprintf(stderr, "\n"); + for (; len --; p++) + fprintf(stderr, "%02X", *p); + fprintf(stderr, "\n"); } #endif diff --git a/src/lib/libcrypto/pkcs12/p12_kiss.c b/src/lib/libcrypto/pkcs12/p12_kiss.c index 0772fa65af..4063ba4b82 100644 --- a/src/lib/libcrypto/pkcs12/p12_kiss.c +++ b/src/lib/libcrypto/pkcs12/p12_kiss.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_kiss.c,v 1.14 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_kiss.c,v 1.15 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 1999. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -63,13 +63,13 @@ /* Simplified PKCS#12 routines */ static int parse_pk12( PKCS12 *p12, const char *pass, int passlen, - EVP_PKEY **pkey, STACK_OF(X509) *ocerts); + EVP_PKEY **pkey, STACK_OF(X509) *ocerts); static int parse_bags( STACK_OF(PKCS12_SAFEBAG) *bags, const char *pass, - int passlen, EVP_PKEY **pkey, STACK_OF(X509) *ocerts); + int passlen, EVP_PKEY **pkey, STACK_OF(X509) *ocerts); static int parse_bag( PKCS12_SAFEBAG *bag, const char *pass, int passlen, - EVP_PKEY **pkey, STACK_OF(X509) *ocerts); + EVP_PKEY **pkey, STACK_OF(X509) *ocerts); /* Parse and decrypt a PKCS#12 structure returning user key, user cert * and other (CA) certs. Note either ca should be NULL, *ca should be NULL, @@ -77,22 +77,23 @@ static int parse_bag( PKCS12_SAFEBAG *bag, const char *pass, int passlen, * passed unitialised. */ -int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert, - STACK_OF(X509) **ca) +int +PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert, + STACK_OF(X509) **ca) { STACK_OF(X509) *ocerts = NULL; X509 *x = NULL; /* Check for NULL PKCS12 structure */ - if(!p12) - { - PKCS12err(PKCS12_F_PKCS12_PARSE,PKCS12_R_INVALID_NULL_PKCS12_POINTER); + if (!p12) { + PKCS12err(PKCS12_F_PKCS12_PARSE, + PKCS12_R_INVALID_NULL_PKCS12_POINTER); return 0; - } + } - if(pkey) + if (pkey) *pkey = NULL; - if(cert) + if (cert) *cert = NULL; /* Check the mac */ @@ -103,46 +104,42 @@ int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert, * password are two different things... */ - if(!pass || !*pass) { - if(PKCS12_verify_mac(p12, NULL, 0)) pass = NULL; - else if(PKCS12_verify_mac(p12, "", 0)) pass = ""; + if (!pass || !*pass) { + if (PKCS12_verify_mac(p12, NULL, 0)) + pass = NULL; + else if (PKCS12_verify_mac(p12, "", 0)) + pass = ""; else { - PKCS12err(PKCS12_F_PKCS12_PARSE,PKCS12_R_MAC_VERIFY_FAILURE); + PKCS12err(PKCS12_F_PKCS12_PARSE, + PKCS12_R_MAC_VERIFY_FAILURE); goto err; } } else if (!PKCS12_verify_mac(p12, pass, -1)) { - PKCS12err(PKCS12_F_PKCS12_PARSE,PKCS12_R_MAC_VERIFY_FAILURE); + PKCS12err(PKCS12_F_PKCS12_PARSE, PKCS12_R_MAC_VERIFY_FAILURE); goto err; } /* Allocate stack for other certificates */ ocerts = sk_X509_new_null(); - - if (!ocerts) - { - PKCS12err(PKCS12_F_PKCS12_PARSE,ERR_R_MALLOC_FAILURE); + if (!ocerts) { + PKCS12err(PKCS12_F_PKCS12_PARSE, ERR_R_MALLOC_FAILURE); return 0; - } + } - if (!parse_pk12 (p12, pass, -1, pkey, ocerts)) - { - PKCS12err(PKCS12_F_PKCS12_PARSE,PKCS12_R_PARSE_ERROR); + if (!parse_pk12 (p12, pass, -1, pkey, ocerts)) { + PKCS12err(PKCS12_F_PKCS12_PARSE, PKCS12_R_PARSE_ERROR); goto err; - } + } - while ((x = sk_X509_pop(ocerts))) - { - if (pkey && *pkey && cert && !*cert) - { - if (X509_check_private_key(x, *pkey)) - { + while ((x = sk_X509_pop(ocerts))) { + if (pkey && *pkey && cert && !*cert) { + if (X509_check_private_key(x, *pkey)) { *cert = x; x = NULL; - } } + } - if (ca && x) - { + if (ca && x) { if (!*ca) *ca = sk_X509_new_null(); if (!*ca) @@ -150,18 +147,17 @@ int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert, if (!sk_X509_push(*ca, x)) goto err; x = NULL; - } + } if (x) X509_free(x); - } + } if (ocerts) sk_X509_pop_free(ocerts, X509_free); return 1; - err: - +err: if (pkey && *pkey) EVP_PKEY_free(*pkey); if (cert && *cert) @@ -171,20 +167,21 @@ int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert, if (ocerts) sk_X509_pop_free(ocerts, X509_free); return 0; - } /* Parse the outer PKCS#12 structure */ -static int parse_pk12(PKCS12 *p12, const char *pass, int passlen, - EVP_PKEY **pkey, STACK_OF(X509) *ocerts) +static int +parse_pk12(PKCS12 *p12, const char *pass, int passlen, EVP_PKEY **pkey, + STACK_OF(X509) *ocerts) { STACK_OF(PKCS7) *asafes; STACK_OF(PKCS12_SAFEBAG) *bags; int i, bagnid; PKCS7 *p7; - if (!(asafes = PKCS12_unpack_authsafes (p12))) return 0; + if (!(asafes = PKCS12_unpack_authsafes (p12))) + return 0; for (i = 0; i < sk_PKCS7_num (asafes); i++) { p7 = sk_PKCS7_value (asafes, i); bagnid = OBJ_obj2nid (p7->type); @@ -192,12 +189,13 @@ static int parse_pk12(PKCS12 *p12, const char *pass, int passlen, bags = PKCS12_unpack_p7data(p7); } else if (bagnid == NID_pkcs7_encrypted) { bags = PKCS12_unpack_p7encdata(p7, pass, passlen); - } else continue; + } else + continue; if (!bags) { sk_PKCS7_pop_free(asafes, PKCS7_free); return 0; } - if (!parse_bags(bags, pass, passlen, pkey, ocerts)) { + if (!parse_bags(bags, pass, passlen, pkey, ocerts)) { sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free); sk_PKCS7_pop_free(asafes, PKCS7_free); return 0; @@ -208,21 +206,23 @@ static int parse_pk12(PKCS12 *p12, const char *pass, int passlen, return 1; } - -static int parse_bags(STACK_OF(PKCS12_SAFEBAG) *bags, const char *pass, - int passlen, EVP_PKEY **pkey, STACK_OF(X509) *ocerts) +static int +parse_bags(STACK_OF(PKCS12_SAFEBAG) *bags, const char *pass, int passlen, + EVP_PKEY **pkey, STACK_OF(X509) *ocerts) { int i; + for (i = 0; i < sk_PKCS12_SAFEBAG_num(bags); i++) { - if (!parse_bag(sk_PKCS12_SAFEBAG_value (bags, i), - pass, passlen, pkey, ocerts)) + if (!parse_bag(sk_PKCS12_SAFEBAG_value(bags, i), pass, passlen, + pkey, ocerts)) return 0; } return 1; } -static int parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen, - EVP_PKEY **pkey, STACK_OF(X509) *ocerts) +static int +parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen, EVP_PKEY **pkey, + STACK_OF(X509) *ocerts) { PKCS8_PRIV_KEY_INFO *p8; X509 *x509; @@ -236,67 +236,63 @@ static int parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen, if ((attrib = PKCS12_get_attr (bag, NID_localKeyID))) lkid = attrib->value.octet_string; - switch (M_PKCS12_bag_type(bag)) - { + switch (M_PKCS12_bag_type(bag)) { case NID_keyBag: if (!pkey || *pkey) - return 1; + return 1; if (!(*pkey = EVP_PKCS82PKEY(bag->value.keybag))) return 0; - break; + break; case NID_pkcs8ShroudedKeyBag: if (!pkey || *pkey) - return 1; + return 1; if (!(p8 = PKCS12_decrypt_skey(bag, pass, passlen))) - return 0; + return 0; *pkey = EVP_PKCS82PKEY(p8); PKCS8_PRIV_KEY_INFO_free(p8); - if (!(*pkey)) return 0; - break; + if (!(*pkey)) + return 0; + break; case NID_certBag: if (M_PKCS12_cert_bag_type(bag) != NID_x509Certificate ) return 1; if (!(x509 = PKCS12_certbag2x509(bag))) return 0; - if(lkid && !X509_keyid_set1(x509, lkid->data, lkid->length)) - { + if (lkid && !X509_keyid_set1(x509, lkid->data, lkid->length)) { X509_free(x509); return 0; - } - if(fname) { + } + if (fname) { int len, r; unsigned char *data; len = ASN1_STRING_to_UTF8(&data, fname); - if(len >= 0) { + if (len >= 0) { r = X509_alias_set1(x509, data, len); free(data); - if (!r) - { + if (!r) { X509_free(x509); return 0; - } + } } } - if(!sk_X509_push(ocerts, x509)) - { + if (!sk_X509_push(ocerts, x509)) { X509_free(x509); return 0; - } + } - break; + break; case NID_safeContentsBag: return parse_bags(bag->value.safes, pass, passlen, - pkey, ocerts); - break; + pkey, ocerts); + break; default: return 1; - break; + break; } return 1; } - diff --git a/src/lib/libcrypto/pkcs12/p12_mutl.c b/src/lib/libcrypto/pkcs12/p12_mutl.c index 203480fb15..7a2fab1666 100644 --- a/src/lib/libcrypto/pkcs12/p12_mutl.c +++ b/src/lib/libcrypto/pkcs12/p12_mutl.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_mutl.c,v 1.13 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_mutl.c,v 1.14 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 1999. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -64,8 +64,9 @@ #include /* Generate a MAC */ -int PKCS12_gen_mac(PKCS12 *p12, const char *pass, int passlen, - unsigned char *mac, unsigned int *maclen) +int +PKCS12_gen_mac(PKCS12 *p12, const char *pass, int passlen, + unsigned char *mac, unsigned int *maclen) { const EVP_MD *md_type; HMAC_CTX hmac; @@ -73,101 +74,115 @@ int PKCS12_gen_mac(PKCS12 *p12, const char *pass, int passlen, int saltlen, iter; int md_size; - if (!PKCS7_type_is_data(p12->authsafes)) - { - PKCS12err(PKCS12_F_PKCS12_GEN_MAC,PKCS12_R_CONTENT_TYPE_NOT_DATA); + if (!PKCS7_type_is_data(p12->authsafes)) { + PKCS12err(PKCS12_F_PKCS12_GEN_MAC, + PKCS12_R_CONTENT_TYPE_NOT_DATA); return 0; - } + } salt = p12->mac->salt->data; saltlen = p12->mac->salt->length; - if (!p12->mac->iter) iter = 1; - else iter = ASN1_INTEGER_get (p12->mac->iter); - if(!(md_type = - EVP_get_digestbyobj (p12->mac->dinfo->algor->algorithm))) { - PKCS12err(PKCS12_F_PKCS12_GEN_MAC,PKCS12_R_UNKNOWN_DIGEST_ALGORITHM); + if (!p12->mac->iter) + iter = 1; + else + iter = ASN1_INTEGER_get(p12->mac->iter); + if (!(md_type = EVP_get_digestbyobj( + p12->mac->dinfo->algor->algorithm))) { + PKCS12err(PKCS12_F_PKCS12_GEN_MAC, + PKCS12_R_UNKNOWN_DIGEST_ALGORITHM); return 0; } md_size = EVP_MD_size(md_type); if (md_size < 0) - return 0; - if(!PKCS12_key_gen (pass, passlen, salt, saltlen, PKCS12_MAC_ID, iter, - md_size, key, md_type)) { - PKCS12err(PKCS12_F_PKCS12_GEN_MAC,PKCS12_R_KEY_GEN_ERROR); + return 0; + if (!PKCS12_key_gen (pass, passlen, salt, saltlen, PKCS12_MAC_ID, iter, + md_size, key, md_type)) { + PKCS12err(PKCS12_F_PKCS12_GEN_MAC, PKCS12_R_KEY_GEN_ERROR); return 0; } HMAC_CTX_init(&hmac); - if (!HMAC_Init_ex(&hmac, key, md_size, md_type, NULL) - || !HMAC_Update(&hmac, p12->authsafes->d.data->data, - p12->authsafes->d.data->length) - || !HMAC_Final(&hmac, mac, maclen)) - { - HMAC_CTX_cleanup(&hmac); + if (!HMAC_Init_ex(&hmac, key, md_size, md_type, NULL) || + !HMAC_Update(&hmac, p12->authsafes->d.data->data, + p12->authsafes->d.data->length) || + !HMAC_Final(&hmac, mac, maclen)) { + HMAC_CTX_cleanup(&hmac); return 0; - } - HMAC_CTX_cleanup(&hmac); + } + HMAC_CTX_cleanup(&hmac); return 1; } /* Verify the mac */ -int PKCS12_verify_mac(PKCS12 *p12, const char *pass, int passlen) +int +PKCS12_verify_mac(PKCS12 *p12, const char *pass, int passlen) { unsigned char mac[EVP_MAX_MD_SIZE]; unsigned int maclen; - if(p12->mac == NULL) { - PKCS12err(PKCS12_F_PKCS12_VERIFY_MAC,PKCS12_R_MAC_ABSENT); + if (p12->mac == NULL) { + PKCS12err(PKCS12_F_PKCS12_VERIFY_MAC, PKCS12_R_MAC_ABSENT); return 0; } if (!PKCS12_gen_mac (p12, pass, passlen, mac, &maclen)) { - PKCS12err(PKCS12_F_PKCS12_VERIFY_MAC,PKCS12_R_MAC_GENERATION_ERROR); + PKCS12err(PKCS12_F_PKCS12_VERIFY_MAC, + PKCS12_R_MAC_GENERATION_ERROR); return 0; } - if ((maclen != (unsigned int)p12->mac->dinfo->digest->length) - || memcmp (mac, p12->mac->dinfo->digest->data, maclen)) return 0; + if ((maclen != (unsigned int)p12->mac->dinfo->digest->length) || + memcmp(mac, p12->mac->dinfo->digest->data, maclen)) + return 0; return 1; } /* Set a mac */ -int PKCS12_set_mac(PKCS12 *p12, const char *pass, int passlen, - unsigned char *salt, int saltlen, int iter, const EVP_MD *md_type) +int +PKCS12_set_mac(PKCS12 *p12, const char *pass, int passlen, unsigned char *salt, + int saltlen, int iter, const EVP_MD *md_type) { unsigned char mac[EVP_MAX_MD_SIZE]; unsigned int maclen; - if (!md_type) md_type = EVP_sha1(); + if (!md_type) + md_type = EVP_sha1(); if (PKCS12_setup_mac (p12, iter, salt, saltlen, md_type) == - PKCS12_ERROR) { - PKCS12err(PKCS12_F_PKCS12_SET_MAC,PKCS12_R_MAC_SETUP_ERROR); + PKCS12_ERROR) { + PKCS12err(PKCS12_F_PKCS12_SET_MAC, PKCS12_R_MAC_SETUP_ERROR); return 0; } if (!PKCS12_gen_mac (p12, pass, passlen, mac, &maclen)) { - PKCS12err(PKCS12_F_PKCS12_SET_MAC,PKCS12_R_MAC_GENERATION_ERROR); + PKCS12err(PKCS12_F_PKCS12_SET_MAC, + PKCS12_R_MAC_GENERATION_ERROR); return 0; } if (!(M_ASN1_OCTET_STRING_set (p12->mac->dinfo->digest, mac, maclen))) { - PKCS12err(PKCS12_F_PKCS12_SET_MAC,PKCS12_R_MAC_STRING_SET_ERROR); - return 0; + PKCS12err(PKCS12_F_PKCS12_SET_MAC, + PKCS12_R_MAC_STRING_SET_ERROR); + return 0; } return 1; } /* Set up a mac structure */ -int PKCS12_setup_mac(PKCS12 *p12, int iter, unsigned char *salt, int saltlen, - const EVP_MD *md_type) +int +PKCS12_setup_mac(PKCS12 *p12, int iter, unsigned char *salt, int saltlen, + const EVP_MD *md_type) { - if (!(p12->mac = PKCS12_MAC_DATA_new())) return PKCS12_ERROR; + if (!(p12->mac = PKCS12_MAC_DATA_new())) + return PKCS12_ERROR; if (iter > 1) { - if(!(p12->mac->iter = M_ASN1_INTEGER_new())) { - PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE); + if (!(p12->mac->iter = M_ASN1_INTEGER_new())) { + PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, + ERR_R_MALLOC_FAILURE); return 0; } if (!ASN1_INTEGER_set(p12->mac->iter, iter)) { - PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE); + PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, + ERR_R_MALLOC_FAILURE); return 0; } } - if (!saltlen) saltlen = PKCS12_SALT_LEN; + if (!saltlen) + saltlen = PKCS12_SALT_LEN; p12->mac->salt->length = saltlen; if (!(p12->mac->salt->data = malloc (saltlen))) { PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE); @@ -176,15 +191,15 @@ int PKCS12_setup_mac(PKCS12 *p12, int iter, unsigned char *salt, int saltlen, if (!salt) { if (RAND_pseudo_bytes (p12->mac->salt->data, saltlen) < 0) return 0; - } - else memcpy (p12->mac->salt->data, salt, saltlen); + } else + memcpy (p12->mac->salt->data, salt, saltlen); p12->mac->dinfo->algor->algorithm = OBJ_nid2obj(EVP_MD_type(md_type)); if (!(p12->mac->dinfo->algor->parameter = ASN1_TYPE_new())) { PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE); return 0; } p12->mac->dinfo->algor->parameter->type = V_ASN1_NULL; - + return 1; } #endif diff --git a/src/lib/libcrypto/pkcs12/p12_npas.c b/src/lib/libcrypto/pkcs12/p12_npas.c index 9477de4a08..ab7bdc6458 100644 --- a/src/lib/libcrypto/pkcs12/p12_npas.c +++ b/src/lib/libcrypto/pkcs12/p12_npas.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_npas.c,v 1.8 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_npas.c,v 1.9 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 1999. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -67,32 +67,34 @@ static int newpass_p12(PKCS12 *p12, char *oldpass, char *newpass); static int newpass_bags(STACK_OF(PKCS12_SAFEBAG) *bags, char *oldpass, - char *newpass); + char *newpass); static int newpass_bag(PKCS12_SAFEBAG *bag, char *oldpass, char *newpass); static int alg_get(X509_ALGOR *alg, int *pnid, int *piter, int *psaltlen); -/* +/* * Change the password on a PKCS#12 structure. */ -int PKCS12_newpass(PKCS12 *p12, char *oldpass, char *newpass) +int +PKCS12_newpass(PKCS12 *p12, char *oldpass, char *newpass) { /* Check for NULL PKCS12 structure */ - if(!p12) { - PKCS12err(PKCS12_F_PKCS12_NEWPASS,PKCS12_R_INVALID_NULL_PKCS12_POINTER); + if (!p12) { + PKCS12err(PKCS12_F_PKCS12_NEWPASS, + PKCS12_R_INVALID_NULL_PKCS12_POINTER); return 0; } /* Check the mac */ - + if (!PKCS12_verify_mac(p12, oldpass, -1)) { - PKCS12err(PKCS12_F_PKCS12_NEWPASS,PKCS12_R_MAC_VERIFY_FAILURE); + PKCS12err(PKCS12_F_PKCS12_NEWPASS, PKCS12_R_MAC_VERIFY_FAILURE); return 0; } if (!newpass_p12(p12, oldpass, newpass)) { - PKCS12err(PKCS12_F_PKCS12_NEWPASS,PKCS12_R_PARSE_ERROR); + PKCS12err(PKCS12_F_PKCS12_NEWPASS, PKCS12_R_PARSE_ERROR); return 0; } @@ -101,7 +103,8 @@ int PKCS12_newpass(PKCS12 *p12, char *oldpass, char *newpass) /* Parse the outer PKCS#12 structure */ -static int newpass_p12(PKCS12 *p12, char *oldpass, char *newpass) +static int +newpass_p12(PKCS12 *p12, char *oldpass, char *newpass) { STACK_OF(PKCS7) *asafes, *newsafes; STACK_OF(PKCS12_SAFEBAG) *bags; @@ -111,8 +114,10 @@ static int newpass_p12(PKCS12 *p12, char *oldpass, char *newpass) unsigned char mac[EVP_MAX_MD_SIZE]; unsigned int maclen; - if (!(asafes = PKCS12_unpack_authsafes(p12))) return 0; - if(!(newsafes = sk_PKCS7_new_null())) return 0; + if (!(asafes = PKCS12_unpack_authsafes(p12))) + return 0; + if (!(newsafes = sk_PKCS7_new_null())) + return 0; for (i = 0; i < sk_PKCS7_num (asafes); i++) { p7 = sk_PKCS7_value(asafes, i); bagnid = OBJ_obj2nid(p7->type); @@ -121,28 +126,30 @@ static int newpass_p12(PKCS12 *p12, char *oldpass, char *newpass) } else if (bagnid == NID_pkcs7_encrypted) { bags = PKCS12_unpack_p7encdata(p7, oldpass, -1); if (!alg_get(p7->d.encrypted->enc_data->algorithm, - &pbe_nid, &pbe_iter, &pbe_saltlen)) - { + &pbe_nid, &pbe_iter, &pbe_saltlen)) { sk_PKCS12_SAFEBAG_pop_free(bags, - PKCS12_SAFEBAG_free); + PKCS12_SAFEBAG_free); bags = NULL; - } - } else continue; + } + } else + continue; if (!bags) { sk_PKCS7_pop_free(asafes, PKCS7_free); return 0; } - if (!newpass_bags(bags, oldpass, newpass)) { + if (!newpass_bags(bags, oldpass, newpass)) { sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free); sk_PKCS7_pop_free(asafes, PKCS7_free); return 0; } /* Repack bag in same form with new password */ - if (bagnid == NID_pkcs7_data) p7new = PKCS12_pack_p7data(bags); - else p7new = PKCS12_pack_p7encdata(pbe_nid, newpass, -1, NULL, - pbe_saltlen, pbe_iter, bags); + if (bagnid == NID_pkcs7_data) + p7new = PKCS12_pack_p7data(bags); + else + p7new = PKCS12_pack_p7encdata(pbe_nid, newpass, -1, + NULL, pbe_saltlen, pbe_iter, bags); sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free); - if(!p7new) { + if (!p7new) { sk_PKCS7_pop_free(asafes, PKCS7_free); return 0; } @@ -153,73 +160,82 @@ static int newpass_p12(PKCS12 *p12, char *oldpass, char *newpass) /* Repack safe: save old safe in case of error */ p12_data_tmp = p12->authsafes->d.data; - if(!(p12->authsafes->d.data = ASN1_OCTET_STRING_new())) goto saferr; - if(!PKCS12_pack_authsafes(p12, newsafes)) goto saferr; - - if(!PKCS12_gen_mac(p12, newpass, -1, mac, &maclen)) goto saferr; - if(!(macnew = ASN1_OCTET_STRING_new())) goto saferr; - if(!ASN1_OCTET_STRING_set(macnew, mac, maclen)) goto saferr; + if (!(p12->authsafes->d.data = ASN1_OCTET_STRING_new())) + goto saferr; + if (!PKCS12_pack_authsafes(p12, newsafes)) + goto saferr; + + if (!PKCS12_gen_mac(p12, newpass, -1, mac, &maclen)) + goto saferr; + if (!(macnew = ASN1_OCTET_STRING_new())) + goto saferr; + if (!ASN1_OCTET_STRING_set(macnew, mac, maclen)) + goto saferr; ASN1_OCTET_STRING_free(p12->mac->dinfo->digest); p12->mac->dinfo->digest = macnew; ASN1_OCTET_STRING_free(p12_data_tmp); return 1; - saferr: +saferr: /* Restore old safe */ ASN1_OCTET_STRING_free(p12->authsafes->d.data); ASN1_OCTET_STRING_free(macnew); p12->authsafes->d.data = p12_data_tmp; return 0; - } -static int newpass_bags(STACK_OF(PKCS12_SAFEBAG) *bags, char *oldpass, - char *newpass) +static int +newpass_bags(STACK_OF(PKCS12_SAFEBAG) *bags, char *oldpass, char *newpass) { int i; + for (i = 0; i < sk_PKCS12_SAFEBAG_num(bags); i++) { if (!newpass_bag(sk_PKCS12_SAFEBAG_value(bags, i), - oldpass, newpass)) - return 0; + oldpass, newpass)) + return 0; } return 1; } /* Change password of safebag: only needs handle shrouded keybags */ -static int newpass_bag(PKCS12_SAFEBAG *bag, char *oldpass, char *newpass) +static int +newpass_bag(PKCS12_SAFEBAG *bag, char *oldpass, char *newpass) { PKCS8_PRIV_KEY_INFO *p8; X509_SIG *p8new; int p8_nid, p8_saltlen, p8_iter; - if(M_PKCS12_bag_type(bag) != NID_pkcs8ShroudedKeyBag) return 1; + if (M_PKCS12_bag_type(bag) != NID_pkcs8ShroudedKeyBag) + return 1; - if (!(p8 = PKCS8_decrypt(bag->value.shkeybag, oldpass, -1))) return 0; + if (!(p8 = PKCS8_decrypt(bag->value.shkeybag, oldpass, -1))) + return 0; if (!alg_get(bag->value.shkeybag->algor, &p8_nid, &p8_iter, - &p8_saltlen)) + &p8_saltlen)) return 0; - if(!(p8new = PKCS8_encrypt(p8_nid, NULL, newpass, -1, NULL, p8_saltlen, - p8_iter, p8))) return 0; + if (!(p8new = PKCS8_encrypt(p8_nid, NULL, newpass, -1, NULL, p8_saltlen, + p8_iter, p8))) return 0; X509_SIG_free(bag->value.shkeybag); bag->value.shkeybag = p8new; return 1; } -static int alg_get(X509_ALGOR *alg, int *pnid, int *piter, int *psaltlen) +static int +alg_get(X509_ALGOR *alg, int *pnid, int *piter, int *psaltlen) { - PBEPARAM *pbe; - const unsigned char *p; + PBEPARAM *pbe; + const unsigned char *p; - p = alg->parameter->value.sequence->data; - pbe = d2i_PBEPARAM(NULL, &p, alg->parameter->value.sequence->length); + p = alg->parameter->value.sequence->data; + pbe = d2i_PBEPARAM(NULL, &p, alg->parameter->value.sequence->length); if (!pbe) return 0; - *pnid = OBJ_obj2nid(alg->algorithm); + *pnid = OBJ_obj2nid(alg->algorithm); *piter = ASN1_INTEGER_get(pbe->iter); *psaltlen = pbe->salt->length; - PBEPARAM_free(pbe); - return 1; + PBEPARAM_free(pbe); + return 1; } diff --git a/src/lib/libcrypto/pkcs12/p12_p8d.c b/src/lib/libcrypto/pkcs12/p12_p8d.c index f6a333baa5..4aceae6a9f 100644 --- a/src/lib/libcrypto/pkcs12/p12_p8d.c +++ b/src/lib/libcrypto/pkcs12/p12_p8d.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_p8d.c,v 1.3 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_p8d.c,v 1.4 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 2001. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -60,9 +60,9 @@ #include "cryptlib.h" #include -PKCS8_PRIV_KEY_INFO *PKCS8_decrypt(X509_SIG *p8, const char *pass, int passlen) +PKCS8_PRIV_KEY_INFO * +PKCS8_decrypt(X509_SIG *p8, const char *pass, int passlen) { - return PKCS12_item_decrypt_d2i(p8->algor, ASN1_ITEM_rptr(PKCS8_PRIV_KEY_INFO), pass, - passlen, p8->digest, 1); + return PKCS12_item_decrypt_d2i(p8->algor, + ASN1_ITEM_rptr(PKCS8_PRIV_KEY_INFO), pass, passlen, p8->digest, 1); } - diff --git a/src/lib/libcrypto/pkcs12/p12_p8e.c b/src/lib/libcrypto/pkcs12/p12_p8e.c index 3d71a02a1c..1ee6a32f6a 100644 --- a/src/lib/libcrypto/pkcs12/p12_p8e.c +++ b/src/lib/libcrypto/pkcs12/p12_p8e.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_p8e.c,v 1.3 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_p8e.c,v 1.4 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 2001. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -60,10 +60,10 @@ #include "cryptlib.h" #include -X509_SIG *PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher, - const char *pass, int passlen, - unsigned char *salt, int saltlen, int iter, - PKCS8_PRIV_KEY_INFO *p8inf) +X509_SIG * +PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher, const char *pass, + int passlen, unsigned char *salt, int saltlen, int iter, + PKCS8_PRIV_KEY_INFO *p8inf) { X509_SIG *p8 = NULL; X509_ALGOR *pbe; @@ -73,25 +73,27 @@ X509_SIG *PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher, goto err; } - if(pbe_nid == -1) pbe = PKCS5_pbe2_set(cipher, iter, salt, saltlen); - else pbe = PKCS5_pbe_set(pbe_nid, iter, salt, saltlen); - if(!pbe) { + if (pbe_nid == -1) + pbe = PKCS5_pbe2_set(cipher, iter, salt, saltlen); + else + pbe = PKCS5_pbe_set(pbe_nid, iter, salt, saltlen); + if (!pbe) { PKCS12err(PKCS12_F_PKCS8_ENCRYPT, ERR_R_ASN1_LIB); goto err; } X509_ALGOR_free(p8->algor); p8->algor = pbe; M_ASN1_OCTET_STRING_free(p8->digest); - p8->digest = PKCS12_item_i2d_encrypt(pbe, ASN1_ITEM_rptr(PKCS8_PRIV_KEY_INFO), - pass, passlen, p8inf, 1); - if(!p8->digest) { + p8->digest = PKCS12_item_i2d_encrypt(pbe, + ASN1_ITEM_rptr(PKCS8_PRIV_KEY_INFO), pass, passlen, p8inf, 1); + if (!p8->digest) { PKCS12err(PKCS12_F_PKCS8_ENCRYPT, PKCS12_R_ENCRYPT_ERROR); goto err; } return p8; - err: +err: X509_SIG_free(p8); return NULL; } diff --git a/src/lib/libcrypto/pkcs12/p12_utl.c b/src/lib/libcrypto/pkcs12/p12_utl.c index 372b94e412..618e6c699f 100644 --- a/src/lib/libcrypto/pkcs12/p12_utl.c +++ b/src/lib/libcrypto/pkcs12/p12_utl.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_utl.c,v 1.9 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_utl.c,v 1.10 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 1999. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -62,81 +62,106 @@ /* Cheap and nasty Unicode stuff */ -unsigned char *OPENSSL_asc2uni(const char *asc, int asclen, unsigned char **uni, int *unilen) +unsigned char * +OPENSSL_asc2uni(const char *asc, int asclen, unsigned char **uni, int *unilen) { int ulen, i; unsigned char *unitmp; - if (asclen == -1) asclen = strlen(asc); - ulen = asclen*2 + 2; - if (!(unitmp = malloc(ulen))) return NULL; - for (i = 0; i < ulen - 2; i+=2) { + + if (asclen == -1) + asclen = strlen(asc); + ulen = asclen * 2 + 2; + if (!(unitmp = malloc(ulen))) + return NULL; + for (i = 0; i < ulen - 2; i += 2) { unitmp[i] = 0; - unitmp[i + 1] = asc[i>>1]; + unitmp[i + 1] = asc[i >> 1]; } /* Make result double null terminated */ unitmp[ulen - 2] = 0; unitmp[ulen - 1] = 0; - if (unilen) *unilen = ulen; - if (uni) *uni = unitmp; + if (unilen) + *unilen = ulen; + if (uni) + *uni = unitmp; return unitmp; } -char *OPENSSL_uni2asc(unsigned char *uni, int unilen) +char * +OPENSSL_uni2asc(unsigned char *uni, int unilen) { int asclen, i; char *asctmp; + asclen = unilen / 2; /* If no terminating zero allow for one */ - if (!unilen || uni[unilen - 1]) asclen++; + if (!unilen || uni[unilen - 1]) + asclen++; uni++; - if (!(asctmp = malloc(asclen))) return NULL; - for (i = 0; i < unilen; i+=2) asctmp[i>>1] = uni[i]; + if (!(asctmp = malloc(asclen))) + return NULL; + for (i = 0; i < unilen; i += 2) + asctmp[i >> 1] = uni[i]; asctmp[asclen - 1] = 0; return asctmp; } -int i2d_PKCS12_bio(BIO *bp, PKCS12 *p12) +int +i2d_PKCS12_bio(BIO *bp, PKCS12 *p12) { return ASN1_item_i2d_bio(ASN1_ITEM_rptr(PKCS12), bp, p12); } -int i2d_PKCS12_fp(FILE *fp, PKCS12 *p12) +int +i2d_PKCS12_fp(FILE *fp, PKCS12 *p12) { return ASN1_item_i2d_fp(ASN1_ITEM_rptr(PKCS12), fp, p12); } -PKCS12 *d2i_PKCS12_bio(BIO *bp, PKCS12 **p12) +PKCS12 * +d2i_PKCS12_bio(BIO *bp, PKCS12 **p12) { return ASN1_item_d2i_bio(ASN1_ITEM_rptr(PKCS12), bp, p12); } -PKCS12 *d2i_PKCS12_fp(FILE *fp, PKCS12 **p12) + +PKCS12 * +d2i_PKCS12_fp(FILE *fp, PKCS12 **p12) { - return ASN1_item_d2i_fp(ASN1_ITEM_rptr(PKCS12), fp, p12); + return ASN1_item_d2i_fp(ASN1_ITEM_rptr(PKCS12), fp, p12); } -PKCS12_SAFEBAG *PKCS12_x5092certbag(X509 *x509) +PKCS12_SAFEBAG * +PKCS12_x5092certbag(X509 *x509) { return PKCS12_item_pack_safebag(x509, ASN1_ITEM_rptr(X509), - NID_x509Certificate, NID_certBag); + NID_x509Certificate, NID_certBag); } -PKCS12_SAFEBAG *PKCS12_x509crl2certbag(X509_CRL *crl) +PKCS12_SAFEBAG * +PKCS12_x509crl2certbag(X509_CRL *crl) { return PKCS12_item_pack_safebag(crl, ASN1_ITEM_rptr(X509_CRL), - NID_x509Crl, NID_crlBag); + NID_x509Crl, NID_crlBag); } -X509 *PKCS12_certbag2x509(PKCS12_SAFEBAG *bag) +X509 * +PKCS12_certbag2x509(PKCS12_SAFEBAG *bag) { - if(M_PKCS12_bag_type(bag) != NID_certBag) return NULL; - if(M_PKCS12_cert_bag_type(bag) != NID_x509Certificate) return NULL; - return ASN1_item_unpack(bag->value.bag->value.octet, ASN1_ITEM_rptr(X509)); + if (M_PKCS12_bag_type(bag) != NID_certBag) + return NULL; + if (M_PKCS12_cert_bag_type(bag) != NID_x509Certificate) + return NULL; + return ASN1_item_unpack(bag->value.bag->value.octet, + ASN1_ITEM_rptr(X509)); } -X509_CRL *PKCS12_certbag2x509crl(PKCS12_SAFEBAG *bag) +X509_CRL * +PKCS12_certbag2x509crl(PKCS12_SAFEBAG *bag) { - if(M_PKCS12_bag_type(bag) != NID_crlBag) return NULL; - if(M_PKCS12_cert_bag_type(bag) != NID_x509Crl) return NULL; + if (M_PKCS12_bag_type(bag) != NID_crlBag) + return NULL; + if (M_PKCS12_cert_bag_type(bag) != NID_x509Crl) + return NULL; return ASN1_item_unpack(bag->value.bag->value.octet, - ASN1_ITEM_rptr(X509_CRL)); + ASN1_ITEM_rptr(X509_CRL)); } diff --git a/src/lib/libcrypto/pkcs12/pk12err.c b/src/lib/libcrypto/pkcs12/pk12err.c index 5f54a7d062..12f418eb23 100644 --- a/src/lib/libcrypto/pkcs12/pk12err.c +++ b/src/lib/libcrypto/pkcs12/pk12err.c @@ -1,4 +1,4 @@ -/* $OpenBSD: pk12err.c,v 1.8 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: pk12err.c,v 1.9 2014/07/08 09:24:53 jsing Exp $ */ /* ==================================================================== * Copyright (c) 1999-2006 The OpenSSL Project. All rights reserved. * @@ -7,7 +7,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -68,77 +68,74 @@ #define ERR_FUNC(func) ERR_PACK(ERR_LIB_PKCS12,func,0) #define ERR_REASON(reason) ERR_PACK(ERR_LIB_PKCS12,0,reason) -static ERR_STRING_DATA PKCS12_str_functs[]= - { -{ERR_FUNC(PKCS12_F_PARSE_BAG), "PARSE_BAG"}, -{ERR_FUNC(PKCS12_F_PARSE_BAGS), "PARSE_BAGS"}, -{ERR_FUNC(PKCS12_F_PKCS12_ADD_FRIENDLYNAME), "PKCS12_ADD_FRIENDLYNAME"}, -{ERR_FUNC(PKCS12_F_PKCS12_ADD_FRIENDLYNAME_ASC), "PKCS12_add_friendlyname_asc"}, -{ERR_FUNC(PKCS12_F_PKCS12_ADD_FRIENDLYNAME_UNI), "PKCS12_add_friendlyname_uni"}, -{ERR_FUNC(PKCS12_F_PKCS12_ADD_LOCALKEYID), "PKCS12_add_localkeyid"}, -{ERR_FUNC(PKCS12_F_PKCS12_CREATE), "PKCS12_create"}, -{ERR_FUNC(PKCS12_F_PKCS12_GEN_MAC), "PKCS12_gen_mac"}, -{ERR_FUNC(PKCS12_F_PKCS12_INIT), "PKCS12_init"}, -{ERR_FUNC(PKCS12_F_PKCS12_ITEM_DECRYPT_D2I), "PKCS12_item_decrypt_d2i"}, -{ERR_FUNC(PKCS12_F_PKCS12_ITEM_I2D_ENCRYPT), "PKCS12_item_i2d_encrypt"}, -{ERR_FUNC(PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG), "PKCS12_item_pack_safebag"}, -{ERR_FUNC(PKCS12_F_PKCS12_KEY_GEN_ASC), "PKCS12_key_gen_asc"}, -{ERR_FUNC(PKCS12_F_PKCS12_KEY_GEN_UNI), "PKCS12_key_gen_uni"}, -{ERR_FUNC(PKCS12_F_PKCS12_MAKE_KEYBAG), "PKCS12_MAKE_KEYBAG"}, -{ERR_FUNC(PKCS12_F_PKCS12_MAKE_SHKEYBAG), "PKCS12_MAKE_SHKEYBAG"}, -{ERR_FUNC(PKCS12_F_PKCS12_NEWPASS), "PKCS12_newpass"}, -{ERR_FUNC(PKCS12_F_PKCS12_PACK_P7DATA), "PKCS12_pack_p7data"}, -{ERR_FUNC(PKCS12_F_PKCS12_PACK_P7ENCDATA), "PKCS12_pack_p7encdata"}, -{ERR_FUNC(PKCS12_F_PKCS12_PARSE), "PKCS12_parse"}, -{ERR_FUNC(PKCS12_F_PKCS12_PBE_CRYPT), "PKCS12_pbe_crypt"}, -{ERR_FUNC(PKCS12_F_PKCS12_PBE_KEYIVGEN), "PKCS12_PBE_keyivgen"}, -{ERR_FUNC(PKCS12_F_PKCS12_SETUP_MAC), "PKCS12_setup_mac"}, -{ERR_FUNC(PKCS12_F_PKCS12_SET_MAC), "PKCS12_set_mac"}, -{ERR_FUNC(PKCS12_F_PKCS12_UNPACK_AUTHSAFES), "PKCS12_unpack_authsafes"}, -{ERR_FUNC(PKCS12_F_PKCS12_UNPACK_P7DATA), "PKCS12_unpack_p7data"}, -{ERR_FUNC(PKCS12_F_PKCS12_VERIFY_MAC), "PKCS12_verify_mac"}, -{ERR_FUNC(PKCS12_F_PKCS8_ADD_KEYUSAGE), "PKCS8_add_keyusage"}, -{ERR_FUNC(PKCS12_F_PKCS8_ENCRYPT), "PKCS8_encrypt"}, -{0,NULL} - }; +static ERR_STRING_DATA PKCS12_str_functs[]= { + {ERR_FUNC(PKCS12_F_PARSE_BAG), "PARSE_BAG"}, + {ERR_FUNC(PKCS12_F_PARSE_BAGS), "PARSE_BAGS"}, + {ERR_FUNC(PKCS12_F_PKCS12_ADD_FRIENDLYNAME), "PKCS12_ADD_FRIENDLYNAME"}, + {ERR_FUNC(PKCS12_F_PKCS12_ADD_FRIENDLYNAME_ASC), "PKCS12_add_friendlyname_asc"}, + {ERR_FUNC(PKCS12_F_PKCS12_ADD_FRIENDLYNAME_UNI), "PKCS12_add_friendlyname_uni"}, + {ERR_FUNC(PKCS12_F_PKCS12_ADD_LOCALKEYID), "PKCS12_add_localkeyid"}, + {ERR_FUNC(PKCS12_F_PKCS12_CREATE), "PKCS12_create"}, + {ERR_FUNC(PKCS12_F_PKCS12_GEN_MAC), "PKCS12_gen_mac"}, + {ERR_FUNC(PKCS12_F_PKCS12_INIT), "PKCS12_init"}, + {ERR_FUNC(PKCS12_F_PKCS12_ITEM_DECRYPT_D2I), "PKCS12_item_decrypt_d2i"}, + {ERR_FUNC(PKCS12_F_PKCS12_ITEM_I2D_ENCRYPT), "PKCS12_item_i2d_encrypt"}, + {ERR_FUNC(PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG), "PKCS12_item_pack_safebag"}, + {ERR_FUNC(PKCS12_F_PKCS12_KEY_GEN_ASC), "PKCS12_key_gen_asc"}, + {ERR_FUNC(PKCS12_F_PKCS12_KEY_GEN_UNI), "PKCS12_key_gen_uni"}, + {ERR_FUNC(PKCS12_F_PKCS12_MAKE_KEYBAG), "PKCS12_MAKE_KEYBAG"}, + {ERR_FUNC(PKCS12_F_PKCS12_MAKE_SHKEYBAG), "PKCS12_MAKE_SHKEYBAG"}, + {ERR_FUNC(PKCS12_F_PKCS12_NEWPASS), "PKCS12_newpass"}, + {ERR_FUNC(PKCS12_F_PKCS12_PACK_P7DATA), "PKCS12_pack_p7data"}, + {ERR_FUNC(PKCS12_F_PKCS12_PACK_P7ENCDATA), "PKCS12_pack_p7encdata"}, + {ERR_FUNC(PKCS12_F_PKCS12_PARSE), "PKCS12_parse"}, + {ERR_FUNC(PKCS12_F_PKCS12_PBE_CRYPT), "PKCS12_pbe_crypt"}, + {ERR_FUNC(PKCS12_F_PKCS12_PBE_KEYIVGEN), "PKCS12_PBE_keyivgen"}, + {ERR_FUNC(PKCS12_F_PKCS12_SETUP_MAC), "PKCS12_setup_mac"}, + {ERR_FUNC(PKCS12_F_PKCS12_SET_MAC), "PKCS12_set_mac"}, + {ERR_FUNC(PKCS12_F_PKCS12_UNPACK_AUTHSAFES), "PKCS12_unpack_authsafes"}, + {ERR_FUNC(PKCS12_F_PKCS12_UNPACK_P7DATA), "PKCS12_unpack_p7data"}, + {ERR_FUNC(PKCS12_F_PKCS12_VERIFY_MAC), "PKCS12_verify_mac"}, + {ERR_FUNC(PKCS12_F_PKCS8_ADD_KEYUSAGE), "PKCS8_add_keyusage"}, + {ERR_FUNC(PKCS12_F_PKCS8_ENCRYPT), "PKCS8_encrypt"}, + {0, NULL} +}; -static ERR_STRING_DATA PKCS12_str_reasons[]= - { -{ERR_REASON(PKCS12_R_CANT_PACK_STRUCTURE),"cant pack structure"}, -{ERR_REASON(PKCS12_R_CONTENT_TYPE_NOT_DATA),"content type not data"}, -{ERR_REASON(PKCS12_R_DECODE_ERROR) ,"decode error"}, -{ERR_REASON(PKCS12_R_ENCODE_ERROR) ,"encode error"}, -{ERR_REASON(PKCS12_R_ENCRYPT_ERROR) ,"encrypt error"}, -{ERR_REASON(PKCS12_R_ERROR_SETTING_ENCRYPTED_DATA_TYPE),"error setting encrypted data type"}, -{ERR_REASON(PKCS12_R_INVALID_NULL_ARGUMENT),"invalid null argument"}, -{ERR_REASON(PKCS12_R_INVALID_NULL_PKCS12_POINTER),"invalid null pkcs12 pointer"}, -{ERR_REASON(PKCS12_R_IV_GEN_ERROR) ,"iv gen error"}, -{ERR_REASON(PKCS12_R_KEY_GEN_ERROR) ,"key gen error"}, -{ERR_REASON(PKCS12_R_MAC_ABSENT) ,"mac absent"}, -{ERR_REASON(PKCS12_R_MAC_GENERATION_ERROR),"mac generation error"}, -{ERR_REASON(PKCS12_R_MAC_SETUP_ERROR) ,"mac setup error"}, -{ERR_REASON(PKCS12_R_MAC_STRING_SET_ERROR),"mac string set error"}, -{ERR_REASON(PKCS12_R_MAC_VERIFY_ERROR) ,"mac verify error"}, -{ERR_REASON(PKCS12_R_MAC_VERIFY_FAILURE) ,"mac verify failure"}, -{ERR_REASON(PKCS12_R_PARSE_ERROR) ,"parse error"}, -{ERR_REASON(PKCS12_R_PKCS12_ALGOR_CIPHERINIT_ERROR),"pkcs12 algor cipherinit error"}, -{ERR_REASON(PKCS12_R_PKCS12_CIPHERFINAL_ERROR),"pkcs12 cipherfinal error"}, -{ERR_REASON(PKCS12_R_PKCS12_PBE_CRYPT_ERROR),"pkcs12 pbe crypt error"}, -{ERR_REASON(PKCS12_R_UNKNOWN_DIGEST_ALGORITHM),"unknown digest algorithm"}, -{ERR_REASON(PKCS12_R_UNSUPPORTED_PKCS12_MODE),"unsupported pkcs12 mode"}, -{0,NULL} - }; +static ERR_STRING_DATA PKCS12_str_reasons[]= { + {ERR_REASON(PKCS12_R_CANT_PACK_STRUCTURE), "cant pack structure"}, + {ERR_REASON(PKCS12_R_CONTENT_TYPE_NOT_DATA), "content type not data"}, + {ERR_REASON(PKCS12_R_DECODE_ERROR) , "decode error"}, + {ERR_REASON(PKCS12_R_ENCODE_ERROR) , "encode error"}, + {ERR_REASON(PKCS12_R_ENCRYPT_ERROR) , "encrypt error"}, + {ERR_REASON(PKCS12_R_ERROR_SETTING_ENCRYPTED_DATA_TYPE), "error setting encrypted data type"}, + {ERR_REASON(PKCS12_R_INVALID_NULL_ARGUMENT), "invalid null argument"}, + {ERR_REASON(PKCS12_R_INVALID_NULL_PKCS12_POINTER), "invalid null pkcs12 pointer"}, + {ERR_REASON(PKCS12_R_IV_GEN_ERROR) , "iv gen error"}, + {ERR_REASON(PKCS12_R_KEY_GEN_ERROR) , "key gen error"}, + {ERR_REASON(PKCS12_R_MAC_ABSENT) , "mac absent"}, + {ERR_REASON(PKCS12_R_MAC_GENERATION_ERROR), "mac generation error"}, + {ERR_REASON(PKCS12_R_MAC_SETUP_ERROR) , "mac setup error"}, + {ERR_REASON(PKCS12_R_MAC_STRING_SET_ERROR), "mac string set error"}, + {ERR_REASON(PKCS12_R_MAC_VERIFY_ERROR) , "mac verify error"}, + {ERR_REASON(PKCS12_R_MAC_VERIFY_FAILURE) , "mac verify failure"}, + {ERR_REASON(PKCS12_R_PARSE_ERROR) , "parse error"}, + {ERR_REASON(PKCS12_R_PKCS12_ALGOR_CIPHERINIT_ERROR), "pkcs12 algor cipherinit error"}, + {ERR_REASON(PKCS12_R_PKCS12_CIPHERFINAL_ERROR), "pkcs12 cipherfinal error"}, + {ERR_REASON(PKCS12_R_PKCS12_PBE_CRYPT_ERROR), "pkcs12 pbe crypt error"}, + {ERR_REASON(PKCS12_R_UNKNOWN_DIGEST_ALGORITHM), "unknown digest algorithm"}, + {ERR_REASON(PKCS12_R_UNSUPPORTED_PKCS12_MODE), "unsupported pkcs12 mode"}, + {0, NULL} +}; #endif -void ERR_load_PKCS12_strings(void) - { +void +ERR_load_PKCS12_strings(void) +{ #ifndef OPENSSL_NO_ERR - - if (ERR_func_error_string(PKCS12_str_functs[0].error) == NULL) - { - ERR_load_strings(0,PKCS12_str_functs); - ERR_load_strings(0,PKCS12_str_reasons); - } -#endif + if (ERR_func_error_string(PKCS12_str_functs[0].error) == NULL) { + ERR_load_strings(0, PKCS12_str_functs); + ERR_load_strings(0, PKCS12_str_reasons); } +#endif +} diff --git a/src/lib/libcrypto/pkcs12/pkcs12.h b/src/lib/libcrypto/pkcs12/pkcs12.h index 5e61e4086c..ead29fd717 100644 --- a/src/lib/libcrypto/pkcs12/pkcs12.h +++ b/src/lib/libcrypto/pkcs12/pkcs12.h @@ -1,4 +1,4 @@ -/* $OpenBSD: pkcs12.h,v 1.12 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: pkcs12.h,v 1.13 2014/07/08 09:27:21 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 1999. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -97,27 +97,27 @@ extern "C" { #define KEY_SIG 0x80 typedef struct { -X509_SIG *dinfo; -ASN1_OCTET_STRING *salt; -ASN1_INTEGER *iter; /* defaults to 1 */ + X509_SIG *dinfo; + ASN1_OCTET_STRING *salt; + ASN1_INTEGER *iter; /* defaults to 1 */ } PKCS12_MAC_DATA; typedef struct { -ASN1_INTEGER *version; -PKCS12_MAC_DATA *mac; -PKCS7 *authsafes; + ASN1_INTEGER *version; + PKCS12_MAC_DATA *mac; + PKCS7 *authsafes; } PKCS12; typedef struct { -ASN1_OBJECT *type; -union { + ASN1_OBJECT *type; + union { struct pkcs12_bag_st *bag; /* secret, crl and certbag */ struct pkcs8_priv_key_info_st *keybag; /* keybag */ X509_SIG *shkeybag; /* shrouded key bag */ - STACK_OF(PKCS12_SAFEBAG) *safes; - ASN1_TYPE *other; -}value; -STACK_OF(X509_ATTRIBUTE) *attrib; + STACK_OF(PKCS12_SAFEBAG) *safes; + ASN1_TYPE *other; + } value; + STACK_OF(X509_ATTRIBUTE) *attrib; } PKCS12_SAFEBAG; DECLARE_STACK_OF(PKCS12_SAFEBAG) @@ -125,14 +125,14 @@ DECLARE_ASN1_SET_OF(PKCS12_SAFEBAG) DECLARE_PKCS12_STACK_OF(PKCS12_SAFEBAG) typedef struct pkcs12_bag_st { -ASN1_OBJECT *type; -union { - ASN1_OCTET_STRING *x509cert; - ASN1_OCTET_STRING *x509crl; - ASN1_OCTET_STRING *octet; - ASN1_IA5STRING *sdsicert; - ASN1_TYPE *other; /* Secret or other bag */ -}value; + ASN1_OBJECT *type; + union { + ASN1_OCTET_STRING *x509cert; + ASN1_OCTET_STRING *x509crl; + ASN1_OCTET_STRING *octet; + ASN1_IA5STRING *sdsicert; + ASN1_TYPE *other; /* Secret or other bag */ + } value; } PKCS12_BAGS; #define PKCS12_ERROR 0 @@ -144,7 +144,7 @@ union { #define M_PKCS12_x509crl2certbag PKCS12_x509crl2certbag #define M_PKCS12_certbag2x509 PKCS12_certbag2x509 -#define M_PKCS12_certbag2x509crl PKCS12_certbag2x509crl +#define M_PKCS12_certbag2x509crl PKCS12_certbag2x509crl #define M_PKCS12_unpack_p7data PKCS12_unpack_p7data #define M_PKCS12_pack_authsafes PKCS12_pack_authsafes @@ -172,65 +172,66 @@ PKCS12_SAFEBAG *PKCS12_x509crl2certbag(X509_CRL *crl); X509 *PKCS12_certbag2x509(PKCS12_SAFEBAG *bag); X509_CRL *PKCS12_certbag2x509crl(PKCS12_SAFEBAG *bag); -PKCS12_SAFEBAG *PKCS12_item_pack_safebag(void *obj, const ASN1_ITEM *it, int nid1, - int nid2); +PKCS12_SAFEBAG *PKCS12_item_pack_safebag(void *obj, const ASN1_ITEM *it, + int nid1, int nid2); PKCS12_SAFEBAG *PKCS12_MAKE_KEYBAG(PKCS8_PRIV_KEY_INFO *p8); PKCS8_PRIV_KEY_INFO *PKCS8_decrypt(X509_SIG *p8, const char *pass, int passlen); PKCS8_PRIV_KEY_INFO *PKCS12_decrypt_skey(PKCS12_SAFEBAG *bag, const char *pass, - int passlen); -X509_SIG *PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher, - const char *pass, int passlen, - unsigned char *salt, int saltlen, int iter, - PKCS8_PRIV_KEY_INFO *p8); + int passlen); +X509_SIG *PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher, + const char *pass, int passlen, unsigned char *salt, int saltlen, int iter, + PKCS8_PRIV_KEY_INFO *p8); PKCS12_SAFEBAG *PKCS12_MAKE_SHKEYBAG(int pbe_nid, const char *pass, - int passlen, unsigned char *salt, - int saltlen, int iter, - PKCS8_PRIV_KEY_INFO *p8); + int passlen, unsigned char *salt, int saltlen, int iter, + PKCS8_PRIV_KEY_INFO *p8); PKCS7 *PKCS12_pack_p7data(STACK_OF(PKCS12_SAFEBAG) *sk); STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_p7data(PKCS7 *p7); PKCS7 *PKCS12_pack_p7encdata(int pbe_nid, const char *pass, int passlen, - unsigned char *salt, int saltlen, int iter, - STACK_OF(PKCS12_SAFEBAG) *bags); -STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_p7encdata(PKCS7 *p7, const char *pass, int passlen); + unsigned char *salt, int saltlen, int iter, STACK_OF(PKCS12_SAFEBAG) *bags); +STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_p7encdata(PKCS7 *p7, const char *pass, + int passlen); int PKCS12_pack_authsafes(PKCS12 *p12, STACK_OF(PKCS7) *safes); STACK_OF(PKCS7) *PKCS12_unpack_authsafes(PKCS12 *p12); -int PKCS12_add_localkeyid(PKCS12_SAFEBAG *bag, unsigned char *name, int namelen); +int PKCS12_add_localkeyid(PKCS12_SAFEBAG *bag, unsigned char *name, + int namelen); int PKCS12_add_friendlyname_asc(PKCS12_SAFEBAG *bag, const char *name, - int namelen); + int namelen); int PKCS12_add_CSPName_asc(PKCS12_SAFEBAG *bag, const char *name, - int namelen); + int namelen); int PKCS12_add_friendlyname_uni(PKCS12_SAFEBAG *bag, const unsigned char *name, - int namelen); + int namelen); int PKCS8_add_keyusage(PKCS8_PRIV_KEY_INFO *p8, int usage); ASN1_TYPE *PKCS12_get_attr_gen(STACK_OF(X509_ATTRIBUTE) *attrs, int attr_nid); char *PKCS12_get_friendlyname(PKCS12_SAFEBAG *bag); unsigned char *PKCS12_pbe_crypt(X509_ALGOR *algor, const char *pass, - int passlen, unsigned char *in, int inlen, - unsigned char **data, int *datalen, int en_de); + int passlen, unsigned char *in, int inlen, unsigned char **data, + int *datalen, int en_de); void * PKCS12_item_decrypt_d2i(X509_ALGOR *algor, const ASN1_ITEM *it, - const char *pass, int passlen, ASN1_OCTET_STRING *oct, int zbuf); -ASN1_OCTET_STRING *PKCS12_item_i2d_encrypt(X509_ALGOR *algor, const ASN1_ITEM *it, - const char *pass, int passlen, - void *obj, int zbuf); + const char *pass, int passlen, ASN1_OCTET_STRING *oct, int zbuf); +ASN1_OCTET_STRING *PKCS12_item_i2d_encrypt(X509_ALGOR *algor, + const ASN1_ITEM *it, const char *pass, int passlen, void *obj, int zbuf); PKCS12 *PKCS12_init(int mode); int PKCS12_key_gen_asc(const char *pass, int passlen, unsigned char *salt, - int saltlen, int id, int iter, int n, - unsigned char *out, const EVP_MD *md_type); -int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, int saltlen, int id, int iter, int n, unsigned char *out, const EVP_MD *md_type); + int saltlen, int id, int iter, int n, unsigned char *out, + const EVP_MD *md_type); +int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, + int saltlen, int id, int iter, int n, unsigned char *out, + const EVP_MD *md_type); int PKCS12_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen, - ASN1_TYPE *param, const EVP_CIPHER *cipher, const EVP_MD *md_type, - int en_de); + ASN1_TYPE *param, const EVP_CIPHER *cipher, const EVP_MD *md_type, + int en_de); int PKCS12_gen_mac(PKCS12 *p12, const char *pass, int passlen, - unsigned char *mac, unsigned int *maclen); + unsigned char *mac, unsigned int *maclen); int PKCS12_verify_mac(PKCS12 *p12, const char *pass, int passlen); int PKCS12_set_mac(PKCS12 *p12, const char *pass, int passlen, - unsigned char *salt, int saltlen, int iter, - const EVP_MD *md_type); + unsigned char *salt, int saltlen, int iter, + const EVP_MD *md_type); int PKCS12_setup_mac(PKCS12 *p12, int iter, unsigned char *salt, - int saltlen, const EVP_MD *md_type); -unsigned char *OPENSSL_asc2uni(const char *asc, int asclen, unsigned char **uni, int *unilen); + int saltlen, const EVP_MD *md_type); +unsigned char *OPENSSL_asc2uni(const char *asc, int asclen, + unsigned char **uni, int *unilen); char *OPENSSL_uni2asc(unsigned char *uni, int unilen); DECLARE_ASN1_FUNCTIONS(PKCS12) @@ -243,17 +244,16 @@ DECLARE_ASN1_ITEM(PKCS12_AUTHSAFES) void PKCS12_PBE_add(void); int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert, - STACK_OF(X509) **ca); + STACK_OF(X509) **ca); PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert, - STACK_OF(X509) *ca, int nid_key, int nid_cert, int iter, - int mac_iter, int keytype); + STACK_OF(X509) *ca, int nid_key, int nid_cert, int iter, + int mac_iter, int keytype); PKCS12_SAFEBAG *PKCS12_add_cert(STACK_OF(PKCS12_SAFEBAG) **pbags, X509 *cert); PKCS12_SAFEBAG *PKCS12_add_key(STACK_OF(PKCS12_SAFEBAG) **pbags, EVP_PKEY *key, - int key_usage, int iter, - int key_nid, char *pass); + int key_usage, int iter, int key_nid, char *pass); int PKCS12_add_safe(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags, - int safe_nid, int iter, char *pass); + int safe_nid, int iter, char *pass); PKCS12 *PKCS12_add_safes(STACK_OF(PKCS7) *safes, int p7_nid); int i2d_PKCS12_bio(BIO *bp, PKCS12 *p12); diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_add.c b/src/lib/libssl/src/crypto/pkcs12/p12_add.c index 57cca926d8..6aa872631e 100644 --- a/src/lib/libssl/src/crypto/pkcs12/p12_add.c +++ b/src/lib/libssl/src/crypto/pkcs12/p12_add.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_add.c,v 1.9 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_add.c,v 1.10 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 1999. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -62,22 +62,26 @@ /* Pack an object into an OCTET STRING and turn into a safebag */ -PKCS12_SAFEBAG *PKCS12_item_pack_safebag(void *obj, const ASN1_ITEM *it, int nid1, - int nid2) +PKCS12_SAFEBAG * +PKCS12_item_pack_safebag(void *obj, const ASN1_ITEM *it, int nid1, int nid2) { PKCS12_BAGS *bag; PKCS12_SAFEBAG *safebag; + if (!(bag = PKCS12_BAGS_new())) { - PKCS12err(PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE); + PKCS12err(PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG, + ERR_R_MALLOC_FAILURE); return NULL; } bag->type = OBJ_nid2obj(nid1); if (!ASN1_item_pack(obj, it, &bag->value.octet)) { - PKCS12err(PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE); + PKCS12err(PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG, + ERR_R_MALLOC_FAILURE); return NULL; } if (!(safebag = PKCS12_SAFEBAG_new())) { - PKCS12err(PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE); + PKCS12err(PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG, + ERR_R_MALLOC_FAILURE); return NULL; } safebag->value.bag = bag; @@ -87,11 +91,13 @@ PKCS12_SAFEBAG *PKCS12_item_pack_safebag(void *obj, const ASN1_ITEM *it, int nid /* Turn PKCS8 object into a keybag */ -PKCS12_SAFEBAG *PKCS12_MAKE_KEYBAG(PKCS8_PRIV_KEY_INFO *p8) +PKCS12_SAFEBAG * +PKCS12_MAKE_KEYBAG(PKCS8_PRIV_KEY_INFO *p8) { PKCS12_SAFEBAG *bag; + if (!(bag = PKCS12_SAFEBAG_new())) { - PKCS12err(PKCS12_F_PKCS12_MAKE_KEYBAG,ERR_R_MALLOC_FAILURE); + PKCS12err(PKCS12_F_PKCS12_MAKE_KEYBAG, ERR_R_MALLOC_FAILURE); return NULL; } bag->type = OBJ_nid2obj(NID_keyBag); @@ -101,9 +107,9 @@ PKCS12_SAFEBAG *PKCS12_MAKE_KEYBAG(PKCS8_PRIV_KEY_INFO *p8) /* Turn PKCS8 object into a shrouded keybag */ -PKCS12_SAFEBAG *PKCS12_MAKE_SHKEYBAG(int pbe_nid, const char *pass, - int passlen, unsigned char *salt, int saltlen, int iter, - PKCS8_PRIV_KEY_INFO *p8) +PKCS12_SAFEBAG * +PKCS12_MAKE_SHKEYBAG(int pbe_nid, const char *pass, int passlen, + unsigned char *salt, int saltlen, int iter, PKCS8_PRIV_KEY_INFO *p8) { PKCS12_SAFEBAG *bag; const EVP_CIPHER *pbe_ciph; @@ -121,9 +127,8 @@ PKCS12_SAFEBAG *PKCS12_MAKE_SHKEYBAG(int pbe_nid, const char *pass, if (pbe_ciph) pbe_nid = -1; - if (!(bag->value.shkeybag = - PKCS8_encrypt(pbe_nid, pbe_ciph, pass, passlen, salt, saltlen, iter, - p8))) { + if (!(bag->value.shkeybag = PKCS8_encrypt(pbe_nid, pbe_ciph, pass, + passlen, salt, saltlen, iter, p8))) { PKCS12err(PKCS12_F_PKCS12_MAKE_SHKEYBAG, ERR_R_MALLOC_FAILURE); return NULL; } @@ -132,9 +137,11 @@ PKCS12_SAFEBAG *PKCS12_MAKE_SHKEYBAG(int pbe_nid, const char *pass, } /* Turn a stack of SAFEBAGS into a PKCS#7 data Contentinfo */ -PKCS7 *PKCS12_pack_p7data(STACK_OF(PKCS12_SAFEBAG) *sk) +PKCS7 * +PKCS12_pack_p7data(STACK_OF(PKCS12_SAFEBAG) *sk) { PKCS7 *p7; + if (!(p7 = PKCS7_new())) { PKCS12err(PKCS12_F_PKCS12_PACK_P7DATA, ERR_R_MALLOC_FAILURE); return NULL; @@ -144,41 +151,44 @@ PKCS7 *PKCS12_pack_p7data(STACK_OF(PKCS12_SAFEBAG) *sk) PKCS12err(PKCS12_F_PKCS12_PACK_P7DATA, ERR_R_MALLOC_FAILURE); return NULL; } - + if (!ASN1_item_pack(sk, ASN1_ITEM_rptr(PKCS12_SAFEBAGS), &p7->d.data)) { - PKCS12err(PKCS12_F_PKCS12_PACK_P7DATA, PKCS12_R_CANT_PACK_STRUCTURE); + PKCS12err(PKCS12_F_PKCS12_PACK_P7DATA, + PKCS12_R_CANT_PACK_STRUCTURE); return NULL; } return p7; } /* Unpack SAFEBAGS from PKCS#7 data ContentInfo */ -STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_p7data(PKCS7 *p7) +STACK_OF(PKCS12_SAFEBAG) * +PKCS12_unpack_p7data(PKCS7 *p7) { - if(!PKCS7_type_is_data(p7)) - { - PKCS12err(PKCS12_F_PKCS12_UNPACK_P7DATA,PKCS12_R_CONTENT_TYPE_NOT_DATA); + if (!PKCS7_type_is_data(p7)) { + PKCS12err(PKCS12_F_PKCS12_UNPACK_P7DATA, + PKCS12_R_CONTENT_TYPE_NOT_DATA); return NULL; - } + } return ASN1_item_unpack(p7->d.data, ASN1_ITEM_rptr(PKCS12_SAFEBAGS)); } /* Turn a stack of SAFEBAGS into a PKCS#7 encrypted data ContentInfo */ -PKCS7 *PKCS12_pack_p7encdata(int pbe_nid, const char *pass, int passlen, - unsigned char *salt, int saltlen, int iter, - STACK_OF(PKCS12_SAFEBAG) *bags) +PKCS7 * +PKCS12_pack_p7encdata(int pbe_nid, const char *pass, int passlen, + unsigned char *salt, int saltlen, int iter, STACK_OF(PKCS12_SAFEBAG) *bags) { PKCS7 *p7; X509_ALGOR *pbe; const EVP_CIPHER *pbe_ciph; + if (!(p7 = PKCS7_new())) { PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE); return NULL; } - if(!PKCS7_set_type(p7, NID_pkcs7_encrypted)) { + if (!PKCS7_set_type(p7, NID_pkcs7_encrypted)) { PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, - PKCS12_R_ERROR_SETTING_ENCRYPTED_DATA_TYPE); + PKCS12_R_ERROR_SETTING_ENCRYPTED_DATA_TYPE); return NULL; } @@ -196,45 +206,49 @@ PKCS7 *PKCS12_pack_p7encdata(int pbe_nid, const char *pass, int passlen, X509_ALGOR_free(p7->d.encrypted->enc_data->algorithm); p7->d.encrypted->enc_data->algorithm = pbe; M_ASN1_OCTET_STRING_free(p7->d.encrypted->enc_data->enc_data); - if (!(p7->d.encrypted->enc_data->enc_data = - PKCS12_item_i2d_encrypt(pbe, ASN1_ITEM_rptr(PKCS12_SAFEBAGS), pass, passlen, - bags, 1))) { - PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, PKCS12_R_ENCRYPT_ERROR); + if (!(p7->d.encrypted->enc_data->enc_data = PKCS12_item_i2d_encrypt( + pbe, ASN1_ITEM_rptr(PKCS12_SAFEBAGS), pass, passlen, bags, 1))) { + PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, + PKCS12_R_ENCRYPT_ERROR); return NULL; } return p7; } -STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_p7encdata(PKCS7 *p7, const char *pass, int passlen) +STACK_OF(PKCS12_SAFEBAG) * +PKCS12_unpack_p7encdata(PKCS7 *p7, const char *pass, int passlen) { - if(!PKCS7_type_is_encrypted(p7)) return NULL; + if (!PKCS7_type_is_encrypted(p7)) + return NULL; return PKCS12_item_decrypt_d2i(p7->d.encrypted->enc_data->algorithm, - ASN1_ITEM_rptr(PKCS12_SAFEBAGS), - pass, passlen, - p7->d.encrypted->enc_data->enc_data, 1); + ASN1_ITEM_rptr(PKCS12_SAFEBAGS), pass, passlen, + p7->d.encrypted->enc_data->enc_data, 1); } -PKCS8_PRIV_KEY_INFO *PKCS12_decrypt_skey(PKCS12_SAFEBAG *bag, const char *pass, - int passlen) +PKCS8_PRIV_KEY_INFO * +PKCS12_decrypt_skey(PKCS12_SAFEBAG *bag, const char *pass, int passlen) { return PKCS8_decrypt(bag->value.shkeybag, pass, passlen); } -int PKCS12_pack_authsafes(PKCS12 *p12, STACK_OF(PKCS7) *safes) +int +PKCS12_pack_authsafes(PKCS12 *p12, STACK_OF(PKCS7) *safes) { - if(ASN1_item_pack(safes, ASN1_ITEM_rptr(PKCS12_AUTHSAFES), - &p12->authsafes->d.data)) - return 1; + if (ASN1_item_pack(safes, ASN1_ITEM_rptr(PKCS12_AUTHSAFES), + &p12->authsafes->d.data)) + return 1; return 0; } -STACK_OF(PKCS7) *PKCS12_unpack_authsafes(PKCS12 *p12) +STACK_OF(PKCS7) * +PKCS12_unpack_authsafes(PKCS12 *p12) { - if (!PKCS7_type_is_data(p12->authsafes)) - { - PKCS12err(PKCS12_F_PKCS12_UNPACK_AUTHSAFES,PKCS12_R_CONTENT_TYPE_NOT_DATA); + if (!PKCS7_type_is_data(p12->authsafes)) { + PKCS12err(PKCS12_F_PKCS12_UNPACK_AUTHSAFES, + PKCS12_R_CONTENT_TYPE_NOT_DATA); return NULL; - } - return ASN1_item_unpack(p12->authsafes->d.data, ASN1_ITEM_rptr(PKCS12_AUTHSAFES)); + } + return ASN1_item_unpack(p12->authsafes->d.data, + ASN1_ITEM_rptr(PKCS12_AUTHSAFES)); } diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_asn.c b/src/lib/libssl/src/crypto/pkcs12/p12_asn.c index e3987752b6..b72db76383 100644 --- a/src/lib/libssl/src/crypto/pkcs12/p12_asn.c +++ b/src/lib/libssl/src/crypto/pkcs12/p12_asn.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_asn.c,v 1.4 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_asn.c,v 1.5 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 1999. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -79,12 +79,16 @@ ASN1_SEQUENCE(PKCS12_MAC_DATA) = { IMPLEMENT_ASN1_FUNCTIONS(PKCS12_MAC_DATA) -ASN1_ADB_TEMPLATE(bag_default) = ASN1_EXP(PKCS12_BAGS, value.other, ASN1_ANY, 0); +ASN1_ADB_TEMPLATE(bag_default) = + ASN1_EXP(PKCS12_BAGS, value.other, ASN1_ANY, 0); ASN1_ADB(PKCS12_BAGS) = { - ADB_ENTRY(NID_x509Certificate, ASN1_EXP(PKCS12_BAGS, value.x509cert, ASN1_OCTET_STRING, 0)), - ADB_ENTRY(NID_x509Crl, ASN1_EXP(PKCS12_BAGS, value.x509crl, ASN1_OCTET_STRING, 0)), - ADB_ENTRY(NID_sdsiCertificate, ASN1_EXP(PKCS12_BAGS, value.sdsicert, ASN1_IA5STRING, 0)), + ADB_ENTRY(NID_x509Certificate, + ASN1_EXP(PKCS12_BAGS, value.x509cert, ASN1_OCTET_STRING, 0)), + ADB_ENTRY(NID_x509Crl, + ASN1_EXP(PKCS12_BAGS, value.x509crl, ASN1_OCTET_STRING, 0)), + ADB_ENTRY(NID_sdsiCertificate, + ASN1_EXP(PKCS12_BAGS, value.sdsicert, ASN1_IA5STRING, 0)), } ASN1_ADB_END(PKCS12_BAGS, 0, type, 0, &bag_default_tt, NULL); ASN1_SEQUENCE(PKCS12_BAGS) = { @@ -94,15 +98,22 @@ ASN1_SEQUENCE(PKCS12_BAGS) = { IMPLEMENT_ASN1_FUNCTIONS(PKCS12_BAGS) -ASN1_ADB_TEMPLATE(safebag_default) = ASN1_EXP(PKCS12_SAFEBAG, value.other, ASN1_ANY, 0); +ASN1_ADB_TEMPLATE(safebag_default) = + ASN1_EXP(PKCS12_SAFEBAG, value.other, ASN1_ANY, 0); ASN1_ADB(PKCS12_SAFEBAG) = { - ADB_ENTRY(NID_keyBag, ASN1_EXP(PKCS12_SAFEBAG, value.keybag, PKCS8_PRIV_KEY_INFO, 0)), - ADB_ENTRY(NID_pkcs8ShroudedKeyBag, ASN1_EXP(PKCS12_SAFEBAG, value.shkeybag, X509_SIG, 0)), - ADB_ENTRY(NID_safeContentsBag, ASN1_EXP_SET_OF(PKCS12_SAFEBAG, value.safes, PKCS12_SAFEBAG, 0)), - ADB_ENTRY(NID_certBag, ASN1_EXP(PKCS12_SAFEBAG, value.bag, PKCS12_BAGS, 0)), - ADB_ENTRY(NID_crlBag, ASN1_EXP(PKCS12_SAFEBAG, value.bag, PKCS12_BAGS, 0)), - ADB_ENTRY(NID_secretBag, ASN1_EXP(PKCS12_SAFEBAG, value.bag, PKCS12_BAGS, 0)) + ADB_ENTRY(NID_keyBag, + ASN1_EXP(PKCS12_SAFEBAG, value.keybag, PKCS8_PRIV_KEY_INFO, 0)), + ADB_ENTRY(NID_pkcs8ShroudedKeyBag, + ASN1_EXP(PKCS12_SAFEBAG, value.shkeybag, X509_SIG, 0)), + ADB_ENTRY(NID_safeContentsBag, + ASN1_EXP_SET_OF(PKCS12_SAFEBAG, value.safes, PKCS12_SAFEBAG, 0)), + ADB_ENTRY(NID_certBag, + ASN1_EXP(PKCS12_SAFEBAG, value.bag, PKCS12_BAGS, 0)), + ADB_ENTRY(NID_crlBag, + ASN1_EXP(PKCS12_SAFEBAG, value.bag, PKCS12_BAGS, 0)), + ADB_ENTRY(NID_secretBag, + ASN1_EXP(PKCS12_SAFEBAG, value.bag, PKCS12_BAGS, 0)) } ASN1_ADB_END(PKCS12_SAFEBAG, 0, type, 0, &safebag_default_tt, NULL); ASN1_SEQUENCE(PKCS12_SAFEBAG) = { @@ -114,12 +125,12 @@ ASN1_SEQUENCE(PKCS12_SAFEBAG) = { IMPLEMENT_ASN1_FUNCTIONS(PKCS12_SAFEBAG) /* SEQUENCE OF SafeBag */ -ASN1_ITEM_TEMPLATE(PKCS12_SAFEBAGS) = - ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, PKCS12_SAFEBAGS, PKCS12_SAFEBAG) +ASN1_ITEM_TEMPLATE(PKCS12_SAFEBAGS) = +ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, PKCS12_SAFEBAGS, PKCS12_SAFEBAG) ASN1_ITEM_TEMPLATE_END(PKCS12_SAFEBAGS) /* Authsafes: SEQUENCE OF PKCS7 */ -ASN1_ITEM_TEMPLATE(PKCS12_AUTHSAFES) = - ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, PKCS12_AUTHSAFES, PKCS7) +ASN1_ITEM_TEMPLATE(PKCS12_AUTHSAFES) = +ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, PKCS12_AUTHSAFES, PKCS7) ASN1_ITEM_TEMPLATE_END(PKCS12_AUTHSAFES) diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_attr.c b/src/lib/libssl/src/crypto/pkcs12/p12_attr.c index 67ffb392ab..05e9b11fd1 100644 --- a/src/lib/libssl/src/crypto/pkcs12/p12_attr.c +++ b/src/lib/libssl/src/crypto/pkcs12/p12_attr.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_attr.c,v 1.8 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_attr.c,v 1.9 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 1999. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -62,24 +62,26 @@ /* Add a local keyid to a safebag */ -int PKCS12_add_localkeyid(PKCS12_SAFEBAG *bag, unsigned char *name, - int namelen) +int +PKCS12_add_localkeyid(PKCS12_SAFEBAG *bag, unsigned char *name, int namelen) { if (X509at_add1_attr_by_NID(&bag->attrib, NID_localKeyID, - V_ASN1_OCTET_STRING, name, namelen)) + V_ASN1_OCTET_STRING, name, namelen)) return 1; - else + else return 0; } /* Add key usage to PKCS#8 structure */ -int PKCS8_add_keyusage(PKCS8_PRIV_KEY_INFO *p8, int usage) +int +PKCS8_add_keyusage(PKCS8_PRIV_KEY_INFO *p8, int usage) { unsigned char us_val; + us_val = (unsigned char) usage; if (X509at_add1_attr_by_NID(&p8->attributes, NID_key_usage, - V_ASN1_BIT_STRING, &us_val, 1)) + V_ASN1_BIT_STRING, &us_val, 1)) return 1; else return 0; @@ -87,59 +89,67 @@ int PKCS8_add_keyusage(PKCS8_PRIV_KEY_INFO *p8, int usage) /* Add a friendlyname to a safebag */ -int PKCS12_add_friendlyname_asc(PKCS12_SAFEBAG *bag, const char *name, - int namelen) +int +PKCS12_add_friendlyname_asc(PKCS12_SAFEBAG *bag, const char *name, int namelen) { if (X509at_add1_attr_by_NID(&bag->attrib, NID_friendlyName, - MBSTRING_ASC, (unsigned char *)name, namelen)) + MBSTRING_ASC, (unsigned char *)name, namelen)) return 1; else return 0; } -int PKCS12_add_friendlyname_uni(PKCS12_SAFEBAG *bag, - const unsigned char *name, int namelen) +int +PKCS12_add_friendlyname_uni(PKCS12_SAFEBAG *bag, const unsigned char *name, + int namelen) { if (X509at_add1_attr_by_NID(&bag->attrib, NID_friendlyName, - MBSTRING_BMP, name, namelen)) + MBSTRING_BMP, name, namelen)) return 1; else return 0; } -int PKCS12_add_CSPName_asc(PKCS12_SAFEBAG *bag, const char *name, - int namelen) +int +PKCS12_add_CSPName_asc(PKCS12_SAFEBAG *bag, const char *name, int namelen) { if (X509at_add1_attr_by_NID(&bag->attrib, NID_ms_csp_name, - MBSTRING_ASC, (unsigned char *)name, namelen)) + MBSTRING_ASC, (unsigned char *)name, namelen)) return 1; else return 0; } -ASN1_TYPE *PKCS12_get_attr_gen(STACK_OF(X509_ATTRIBUTE) *attrs, int attr_nid) +ASN1_TYPE * +PKCS12_get_attr_gen(STACK_OF(X509_ATTRIBUTE) *attrs, int attr_nid) { X509_ATTRIBUTE *attrib; int i; - if (!attrs) return NULL; + + if (!attrs) + return NULL; for (i = 0; i < sk_X509_ATTRIBUTE_num (attrs); i++) { attrib = sk_X509_ATTRIBUTE_value (attrs, i); if (OBJ_obj2nid (attrib->object) == attr_nid) { if (sk_ASN1_TYPE_num (attrib->value.set)) - return sk_ASN1_TYPE_value(attrib->value.set, 0); - else return NULL; + return sk_ASN1_TYPE_value(attrib->value.set, 0); + else + return NULL; } } return NULL; } -char *PKCS12_get_friendlyname(PKCS12_SAFEBAG *bag) +char * +PKCS12_get_friendlyname(PKCS12_SAFEBAG *bag) { ASN1_TYPE *atype; - if (!(atype = PKCS12_get_attr(bag, NID_friendlyName))) return NULL; - if (atype->type != V_ASN1_BMPSTRING) return NULL; + + if (!(atype = PKCS12_get_attr(bag, NID_friendlyName))) + return NULL; + if (atype->type != V_ASN1_BMPSTRING) + return NULL; return OPENSSL_uni2asc(atype->value.bmpstring->data, - atype->value.bmpstring->length); + atype->value.bmpstring->length); } - diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_crpt.c b/src/lib/libssl/src/crypto/pkcs12/p12_crpt.c index c0b41f9252..1709b30d5e 100644 --- a/src/lib/libssl/src/crypto/pkcs12/p12_crpt.c +++ b/src/lib/libssl/src/crypto/pkcs12/p12_crpt.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_crpt.c,v 1.9 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_crpt.c,v 1.10 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 1999. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -62,12 +62,14 @@ /* PKCS#12 PBE algorithms now in static table */ -void PKCS12_PBE_add(void) +void +PKCS12_PBE_add(void) { } -int PKCS12_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen, - ASN1_TYPE *param, const EVP_CIPHER *cipher, const EVP_MD *md, int en_de) +int +PKCS12_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen, + ASN1_TYPE *param, const EVP_CIPHER *cipher, const EVP_MD *md, int en_de) { PBEPARAM *pbe; int saltlen, iter, ret; @@ -78,29 +80,31 @@ int PKCS12_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen, /* Extract useful info from parameter */ if (param == NULL || param->type != V_ASN1_SEQUENCE || param->value.sequence == NULL) { - PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN,PKCS12_R_DECODE_ERROR); + PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN, PKCS12_R_DECODE_ERROR); return 0; } pbuf = param->value.sequence->data; if (!(pbe = d2i_PBEPARAM(NULL, &pbuf, param->value.sequence->length))) { - PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN,PKCS12_R_DECODE_ERROR); + PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN, PKCS12_R_DECODE_ERROR); return 0; } - if (!pbe->iter) iter = 1; - else iter = ASN1_INTEGER_get (pbe->iter); + if (!pbe->iter) + iter = 1; + else + iter = ASN1_INTEGER_get (pbe->iter); salt = pbe->salt->data; saltlen = pbe->salt->length; if (!PKCS12_key_gen (pass, passlen, salt, saltlen, PKCS12_KEY_ID, - iter, EVP_CIPHER_key_length(cipher), key, md)) { - PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN,PKCS12_R_KEY_GEN_ERROR); + iter, EVP_CIPHER_key_length(cipher), key, md)) { + PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN, PKCS12_R_KEY_GEN_ERROR); PBEPARAM_free(pbe); return 0; } if (!PKCS12_key_gen (pass, passlen, salt, saltlen, PKCS12_IV_ID, - iter, EVP_CIPHER_iv_length(cipher), iv, md)) { - PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN,PKCS12_R_IV_GEN_ERROR); + iter, EVP_CIPHER_iv_length(cipher), iv, md)) { + PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN, PKCS12_R_IV_GEN_ERROR); PBEPARAM_free(pbe); return 0; } diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_crt.c b/src/lib/libssl/src/crypto/pkcs12/p12_crt.c index a5dffcebd7..538637e78a 100644 --- a/src/lib/libssl/src/crypto/pkcs12/p12_crt.c +++ b/src/lib/libssl/src/crypto/pkcs12/p12_crt.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_crt.c,v 1.13 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_crt.c,v 1.14 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -61,12 +61,15 @@ #include -static int pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG) **pbags, PKCS12_SAFEBAG *bag); +static int pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG) **pbags, + PKCS12_SAFEBAG *bag); -static int copy_bag_attr(PKCS12_SAFEBAG *bag, EVP_PKEY *pkey, int nid) - { +static int +copy_bag_attr(PKCS12_SAFEBAG *bag, EVP_PKEY *pkey, int nid) +{ int idx; X509_ATTRIBUTE *attr; + idx = EVP_PKEY_get_attr_by_NID(pkey, nid, -1); if (idx < 0) return 1; @@ -74,11 +77,12 @@ static int copy_bag_attr(PKCS12_SAFEBAG *bag, EVP_PKEY *pkey, int nid) if (!X509at_add1_attr(&bag->attrib, attr)) return 0; return 1; - } +} -PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert, - STACK_OF(X509) *ca, int nid_key, int nid_cert, int iter, int mac_iter, - int keytype) +PKCS12 * +PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert, + STACK_OF(X509) *ca, int nid_key, int nid_cert, int iter, int mac_iter, + int keytype) { PKCS12 *p12 = NULL; STACK_OF(PKCS7) *safes = NULL; @@ -89,10 +93,9 @@ PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert, unsigned int keyidlen = 0; /* Set defaults */ - if (!nid_cert) - { + if (!nid_cert) { nid_cert = NID_pbe_WithSHA1And40BitRC2_CBC; - } + } if (!nid_key) nid_key = NID_pbe_WithSHA1And3_Key_TripleDES_CBC; if (!iter) @@ -100,43 +103,39 @@ PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert, if (!mac_iter) mac_iter = 1; - if(!pkey && !cert && !ca) - { - PKCS12err(PKCS12_F_PKCS12_CREATE,PKCS12_R_INVALID_NULL_ARGUMENT); + if (!pkey && !cert && !ca) { + PKCS12err(PKCS12_F_PKCS12_CREATE, + PKCS12_R_INVALID_NULL_ARGUMENT); return NULL; - } + } - if (pkey && cert) - { - if(!X509_check_private_key(cert, pkey)) + if (pkey && cert) { + if (!X509_check_private_key(cert, pkey)) return NULL; X509_digest(cert, EVP_sha1(), keyid, &keyidlen); - } + } - if (cert) - { + if (cert) { bag = PKCS12_add_cert(&bags, cert); - if(name && !PKCS12_add_friendlyname(bag, name, -1)) + if (name && !PKCS12_add_friendlyname(bag, name, -1)) goto err; - if(keyidlen && !PKCS12_add_localkeyid(bag, keyid, keyidlen)) + if (keyidlen && !PKCS12_add_localkeyid(bag, keyid, keyidlen)) goto err; - } + } /* Add all other certificates */ - for(i = 0; i < sk_X509_num(ca); i++) - { + for (i = 0; i < sk_X509_num(ca); i++) { if (!PKCS12_add_cert(&bags, sk_X509_value(ca, i))) goto err; - } + } if (bags && !PKCS12_add_safe(&safes, bags, nid_cert, iter, pass)) - goto err; + goto err; sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free); bags = NULL; - if (pkey) - { + if (pkey) { bag = PKCS12_add_key(&bags, pkey, keytype, iter, nid_key, pass); if (!bag) @@ -147,14 +146,14 @@ PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert, if (!copy_bag_attr(bag, pkey, NID_LocalKeySet)) goto err; - if(name && !PKCS12_add_friendlyname(bag, name, -1)) + if (name && !PKCS12_add_friendlyname(bag, name, -1)) goto err; - if(keyidlen && !PKCS12_add_localkeyid(bag, keyid, keyidlen)) + if (keyidlen && !PKCS12_add_localkeyid(bag, keyid, keyidlen)) goto err; - } + } if (bags && !PKCS12_add_safe(&safes, bags, -1, 0, NULL)) - goto err; + goto err; sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free); bags = NULL; @@ -169,13 +168,12 @@ PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert, safes = NULL; if ((mac_iter != -1) && - !PKCS12_set_mac(p12, pass, -1, NULL, 0, mac_iter, NULL)) - goto err; + !PKCS12_set_mac(p12, pass, -1, NULL, 0, mac_iter, NULL)) + goto err; return p12; - err: - +err: if (p12) PKCS12_free(p12); if (safes) @@ -183,11 +181,11 @@ PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert, if (bags) sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free); return NULL; - } -PKCS12_SAFEBAG *PKCS12_add_cert(STACK_OF(PKCS12_SAFEBAG) **pbags, X509 *cert) - { +PKCS12_SAFEBAG * +PKCS12_add_cert(STACK_OF(PKCS12_SAFEBAG) **pbags, X509 *cert) +{ PKCS12_SAFEBAG *bag = NULL; char *name; int namelen = -1; @@ -195,21 +193,19 @@ PKCS12_SAFEBAG *PKCS12_add_cert(STACK_OF(PKCS12_SAFEBAG) **pbags, X509 *cert) int keyidlen = -1; /* Add user certificate */ - if(!(bag = PKCS12_x5092certbag(cert))) + if (!(bag = PKCS12_x5092certbag(cert))) goto err; /* Use friendlyName and localKeyID in certificate. * (if present) */ - name = (char *)X509_alias_get0(cert, &namelen); - - if(name && !PKCS12_add_friendlyname(bag, name, namelen)) + if (name && !PKCS12_add_friendlyname(bag, name, namelen)) goto err; keyid = X509_keyid_get0(cert, &keyidlen); - if(keyid && !PKCS12_add_localkeyid(bag, keyid, keyidlen)) + if (keyid && !PKCS12_add_localkeyid(bag, keyid, keyidlen)) goto err; if (!pkcs12_add_bag(pbags, bag)) @@ -217,37 +213,33 @@ PKCS12_SAFEBAG *PKCS12_add_cert(STACK_OF(PKCS12_SAFEBAG) **pbags, X509 *cert) return bag; - err: - +err: if (bag) PKCS12_SAFEBAG_free(bag); return NULL; +} - } - -PKCS12_SAFEBAG *PKCS12_add_key(STACK_OF(PKCS12_SAFEBAG) **pbags, EVP_PKEY *key, - int key_usage, int iter, - int nid_key, char *pass) - { - +PKCS12_SAFEBAG * +PKCS12_add_key(STACK_OF(PKCS12_SAFEBAG) **pbags, EVP_PKEY *key, int key_usage, + int iter, int nid_key, char *pass) +{ PKCS12_SAFEBAG *bag = NULL; PKCS8_PRIV_KEY_INFO *p8 = NULL; /* Make a PKCS#8 structure */ - if(!(p8 = EVP_PKEY2PKCS8(key))) + if (!(p8 = EVP_PKEY2PKCS8(key))) goto err; - if(key_usage && !PKCS8_add_keyusage(p8, key_usage)) + if (key_usage && !PKCS8_add_keyusage(p8, key_usage)) goto err; - if (nid_key != -1) - { - bag = PKCS12_MAKE_SHKEYBAG(nid_key, pass, -1, NULL, 0, iter, p8); + if (nid_key != -1) { + bag = PKCS12_MAKE_SHKEYBAG(nid_key, pass, -1, NULL, 0, + iter, p8); PKCS8_PRIV_KEY_INFO_free(p8); - } - else + } else bag = PKCS12_MAKE_KEYBAG(p8); - if(!bag) + if (!bag) goto err; if (!pkcs12_add_bag(pbags, bag)) @@ -255,29 +247,26 @@ PKCS12_SAFEBAG *PKCS12_add_key(STACK_OF(PKCS12_SAFEBAG) **pbags, EVP_PKEY *key, return bag; - err: - +err: if (bag) PKCS12_SAFEBAG_free(bag); return NULL; +} - } - -int PKCS12_add_safe(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags, - int nid_safe, int iter, char *pass) - { +int +PKCS12_add_safe(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags, + int nid_safe, int iter, char *pass) +{ PKCS7 *p7 = NULL; int free_safes = 0; - if (!*psafes) - { + if (!*psafes) { *psafes = sk_PKCS7_new_null(); if (!*psafes) return 0; free_safes = 1; - } - else + } else free_safes = 0; if (nid_safe == 0) @@ -287,7 +276,7 @@ int PKCS12_add_safe(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags, p7 = PKCS12_pack_p7data(bags); else p7 = PKCS12_pack_p7encdata(nid_safe, pass, -1, NULL, 0, - iter, bags); + iter, bags); if (!p7) goto err; @@ -296,53 +285,49 @@ int PKCS12_add_safe(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags, return 1; - err: - if (free_safes) - { +err: + if (free_safes) { sk_PKCS7_free(*psafes); *psafes = NULL; - } + } if (p7) PKCS7_free(p7); return 0; +} - } - -static int pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG) **pbags, PKCS12_SAFEBAG *bag) - { +static int +pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG) **pbags, PKCS12_SAFEBAG *bag) +{ int free_bags; + if (!pbags) return 1; - if (!*pbags) - { + if (!*pbags) { *pbags = sk_PKCS12_SAFEBAG_new_null(); if (!*pbags) return 0; free_bags = 1; - } - else + } else free_bags = 0; - if (!sk_PKCS12_SAFEBAG_push(*pbags, bag)) - { - if (free_bags) - { + if (!sk_PKCS12_SAFEBAG_push(*pbags, bag)) { + if (free_bags) { sk_PKCS12_SAFEBAG_free(*pbags); *pbags = NULL; - } - return 0; } + return 0; + } return 1; +} - } - - -PKCS12 *PKCS12_add_safes(STACK_OF(PKCS7) *safes, int nid_p7) - { +PKCS12 * +PKCS12_add_safes(STACK_OF(PKCS7) *safes, int nid_p7) +{ PKCS12 *p12; + if (nid_p7 <= 0) nid_p7 = NID_pkcs7_data; p12 = PKCS12_init(nid_p7); @@ -350,12 +335,10 @@ PKCS12 *PKCS12_add_safes(STACK_OF(PKCS7) *safes, int nid_p7) if (!p12) return NULL; - if(!PKCS12_pack_authsafes(p12, safes)) - { + if (!PKCS12_pack_authsafes(p12, safes)) { PKCS12_free(p12); return NULL; - } + } return p12; - - } +} diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_decr.c b/src/lib/libssl/src/crypto/pkcs12/p12_decr.c index 01fe24835f..577bb06f80 100644 --- a/src/lib/libssl/src/crypto/pkcs12/p12_decr.c +++ b/src/lib/libssl/src/crypto/pkcs12/p12_decr.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_decr.c,v 1.10 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_decr.c,v 1.11 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 1999. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -68,9 +68,9 @@ * malloc'ed buffer */ -unsigned char * PKCS12_pbe_crypt(X509_ALGOR *algor, const char *pass, - int passlen, unsigned char *in, int inlen, unsigned char **data, - int *datalen, int en_de) +unsigned char * +PKCS12_pbe_crypt(X509_ALGOR *algor, const char *pass, int passlen, + unsigned char *in, int inlen, unsigned char **data, int *datalen, int en_de) { unsigned char *out; int outlen, i; @@ -78,47 +78,52 @@ unsigned char * PKCS12_pbe_crypt(X509_ALGOR *algor, const char *pass, EVP_CIPHER_CTX_init(&ctx); /* Decrypt data */ - if (!EVP_PBE_CipherInit(algor->algorithm, pass, passlen, - algor->parameter, &ctx, en_de)) { - PKCS12err(PKCS12_F_PKCS12_PBE_CRYPT,PKCS12_R_PKCS12_ALGOR_CIPHERINIT_ERROR); + if (!EVP_PBE_CipherInit(algor->algorithm, pass, passlen, + algor->parameter, &ctx, en_de)) { + PKCS12err(PKCS12_F_PKCS12_PBE_CRYPT, + PKCS12_R_PKCS12_ALGOR_CIPHERINIT_ERROR); return NULL; } - if(!(out = malloc(inlen + EVP_CIPHER_CTX_block_size(&ctx)))) { - PKCS12err(PKCS12_F_PKCS12_PBE_CRYPT,ERR_R_MALLOC_FAILURE); + if (!(out = malloc(inlen + EVP_CIPHER_CTX_block_size(&ctx)))) { + PKCS12err(PKCS12_F_PKCS12_PBE_CRYPT, ERR_R_MALLOC_FAILURE); goto err; } - if (!EVP_CipherUpdate(&ctx, out, &i, in, inlen)) - { + if (!EVP_CipherUpdate(&ctx, out, &i, in, inlen)) { free(out); out = NULL; - PKCS12err(PKCS12_F_PKCS12_PBE_CRYPT,ERR_R_EVP_LIB); + PKCS12err(PKCS12_F_PKCS12_PBE_CRYPT, ERR_R_EVP_LIB); goto err; - } + } outlen = i; - if(!EVP_CipherFinal_ex(&ctx, out + i, &i)) { + if (!EVP_CipherFinal_ex(&ctx, out + i, &i)) { free(out); out = NULL; - PKCS12err(PKCS12_F_PKCS12_PBE_CRYPT,PKCS12_R_PKCS12_CIPHERFINAL_ERROR); + PKCS12err(PKCS12_F_PKCS12_PBE_CRYPT, + PKCS12_R_PKCS12_CIPHERFINAL_ERROR); goto err; } outlen += i; - if (datalen) *datalen = outlen; - if (data) *data = out; - err: + if (datalen) + *datalen = outlen; + if (data) + *data = out; + +err: EVP_CIPHER_CTX_cleanup(&ctx); return out; } -/* Decrypt an OCTET STRING and decode ASN1 structure +/* Decrypt an OCTET STRING and decode ASN1 structure * if zbuf set zero buffer after use. */ -void * PKCS12_item_decrypt_d2i(X509_ALGOR *algor, const ASN1_ITEM *it, - const char *pass, int passlen, ASN1_OCTET_STRING *oct, int zbuf) +void * +PKCS12_item_decrypt_d2i(X509_ALGOR *algor, const ASN1_ITEM *it, + const char *pass, int passlen, ASN1_OCTET_STRING *oct, int zbuf) { unsigned char *out; const unsigned char *p; @@ -126,8 +131,9 @@ void * PKCS12_item_decrypt_d2i(X509_ALGOR *algor, const ASN1_ITEM *it, int outlen; if (!PKCS12_pbe_crypt(algor, pass, passlen, oct->data, oct->length, - &out, &outlen, 0)) { - PKCS12err(PKCS12_F_PKCS12_ITEM_DECRYPT_D2I,PKCS12_R_PKCS12_PBE_CRYPT_ERROR); + &out, &outlen, 0)) { + PKCS12err(PKCS12_F_PKCS12_ITEM_DECRYPT_D2I, + PKCS12_R_PKCS12_PBE_CRYPT_ERROR); return NULL; } p = out; @@ -144,39 +150,48 @@ void * PKCS12_item_decrypt_d2i(X509_ALGOR *algor, const ASN1_ITEM *it, } #endif ret = ASN1_item_d2i(NULL, &p, outlen, it); - if (zbuf) OPENSSL_cleanse(out, outlen); - if(!ret) PKCS12err(PKCS12_F_PKCS12_ITEM_DECRYPT_D2I,PKCS12_R_DECODE_ERROR); + if (zbuf) + OPENSSL_cleanse(out, outlen); + if (!ret) + PKCS12err(PKCS12_F_PKCS12_ITEM_DECRYPT_D2I, + PKCS12_R_DECODE_ERROR); free(out); return ret; } -/* Encode ASN1 structure and encrypt, return OCTET STRING +/* Encode ASN1 structure and encrypt, return OCTET STRING * if zbuf set zero encoding. */ -ASN1_OCTET_STRING *PKCS12_item_i2d_encrypt(X509_ALGOR *algor, const ASN1_ITEM *it, - const char *pass, int passlen, - void *obj, int zbuf) +ASN1_OCTET_STRING * +PKCS12_item_i2d_encrypt(X509_ALGOR *algor, const ASN1_ITEM *it, + const char *pass, int passlen, + void *obj, int zbuf) { ASN1_OCTET_STRING *oct; unsigned char *in = NULL; int inlen; + if (!(oct = M_ASN1_OCTET_STRING_new ())) { - PKCS12err(PKCS12_F_PKCS12_ITEM_I2D_ENCRYPT,ERR_R_MALLOC_FAILURE); + PKCS12err(PKCS12_F_PKCS12_ITEM_I2D_ENCRYPT, + ERR_R_MALLOC_FAILURE); return NULL; } inlen = ASN1_item_i2d(obj, &in, it); if (!in) { - PKCS12err(PKCS12_F_PKCS12_ITEM_I2D_ENCRYPT,PKCS12_R_ENCODE_ERROR); + PKCS12err(PKCS12_F_PKCS12_ITEM_I2D_ENCRYPT, + PKCS12_R_ENCODE_ERROR); return NULL; } if (!PKCS12_pbe_crypt(algor, pass, passlen, in, inlen, &oct->data, - &oct->length, 1)) { - PKCS12err(PKCS12_F_PKCS12_ITEM_I2D_ENCRYPT,PKCS12_R_ENCRYPT_ERROR); + &oct->length, 1)) { + PKCS12err(PKCS12_F_PKCS12_ITEM_I2D_ENCRYPT, + PKCS12_R_ENCRYPT_ERROR); free(in); return NULL; } - if (zbuf) OPENSSL_cleanse(in, inlen); + if (zbuf) + OPENSSL_cleanse(in, inlen); free(in); return oct; } diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_init.c b/src/lib/libssl/src/crypto/pkcs12/p12_init.c index e9c55ea265..b4da7be77c 100644 --- a/src/lib/libssl/src/crypto/pkcs12/p12_init.c +++ b/src/lib/libssl/src/crypto/pkcs12/p12_init.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_init.c,v 1.7 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_init.c,v 1.8 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 1999. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -62,31 +62,35 @@ /* Initialise a PKCS12 structure to take data */ -PKCS12 *PKCS12_init(int mode) +PKCS12 * +PKCS12_init(int mode) { PKCS12 *pkcs12; + if (!(pkcs12 = PKCS12_new())) { - PKCS12err(PKCS12_F_PKCS12_INIT,ERR_R_MALLOC_FAILURE); + PKCS12err(PKCS12_F_PKCS12_INIT, ERR_R_MALLOC_FAILURE); return NULL; } ASN1_INTEGER_set(pkcs12->version, 3); pkcs12->authsafes->type = OBJ_nid2obj(mode); switch (mode) { - case NID_pkcs7_data: - if (!(pkcs12->authsafes->d.data = - M_ASN1_OCTET_STRING_new())) { - PKCS12err(PKCS12_F_PKCS12_INIT,ERR_R_MALLOC_FAILURE); + case NID_pkcs7_data: + if (!(pkcs12->authsafes->d.data = + M_ASN1_OCTET_STRING_new())) { + PKCS12err(PKCS12_F_PKCS12_INIT, ERR_R_MALLOC_FAILURE); goto err; } break; - default: - PKCS12err(PKCS12_F_PKCS12_INIT, - PKCS12_R_UNSUPPORTED_PKCS12_MODE); - goto err; + default: + PKCS12err(PKCS12_F_PKCS12_INIT, + PKCS12_R_UNSUPPORTED_PKCS12_MODE); + goto err; } - + return pkcs12; + err: - if (pkcs12 != NULL) PKCS12_free(pkcs12); + if (pkcs12 != NULL) + PKCS12_free(pkcs12); return NULL; } diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_key.c b/src/lib/libssl/src/crypto/pkcs12/p12_key.c index 24c86b7fc8..ffa736a04f 100644 --- a/src/lib/libssl/src/crypto/pkcs12/p12_key.c +++ b/src/lib/libssl/src/crypto/pkcs12/p12_key.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_key.c,v 1.15 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_key.c,v 1.16 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 1999. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -74,35 +74,37 @@ void h__dump (unsigned char *p, int len); #define min(a,b) ((a) < (b) ? (a) : (b)) #endif -int PKCS12_key_gen_asc(const char *pass, int passlen, unsigned char *salt, - int saltlen, int id, int iter, int n, unsigned char *out, - const EVP_MD *md_type) +int +PKCS12_key_gen_asc(const char *pass, int passlen, unsigned char *salt, + int saltlen, int id, int iter, int n, unsigned char *out, + const EVP_MD *md_type) { int ret; unsigned char *unipass; int uniplen; - if(!pass) { + if (!pass) { unipass = NULL; uniplen = 0; } else if (!OPENSSL_asc2uni(pass, passlen, &unipass, &uniplen)) { - PKCS12err(PKCS12_F_PKCS12_KEY_GEN_ASC,ERR_R_MALLOC_FAILURE); + PKCS12err(PKCS12_F_PKCS12_KEY_GEN_ASC, ERR_R_MALLOC_FAILURE); return 0; } ret = PKCS12_key_gen_uni(unipass, uniplen, salt, saltlen, - id, iter, n, out, md_type); + id, iter, n, out, md_type); if (ret <= 0) - return 0; - if(unipass) { + return 0; + if (unipass) { OPENSSL_cleanse(unipass, uniplen); /* Clear password from memory */ free(unipass); } return ret; } -int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, - int saltlen, int id, int iter, int n, unsigned char *out, - const EVP_MD *md_type) +int +PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, + int saltlen, int id, int iter, int n, unsigned char *out, + const EVP_MD *md_type) { unsigned char *B, *D, *I, *p, *Ai; int Slen, Plen, Ilen, Ijlen; @@ -117,7 +119,7 @@ int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, #if 0 if (!pass) { - PKCS12err(PKCS12_F_PKCS12_KEY_GEN_UNI,ERR_R_PASSED_NULL_PARAMETER); + PKCS12err(PKCS12_F_PKCS12_KEY_GEN_UNI, ERR_R_PASSED_NULL_PARAMETER); return 0; } #endif @@ -131,37 +133,42 @@ int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, fprintf(stderr, "Salt (length %d):\n", saltlen); h__dump(salt, saltlen); #endif - v = EVP_MD_block_size (md_type); - u = EVP_MD_size (md_type); + v = EVP_MD_block_size(md_type); + u = EVP_MD_size(md_type); if (u < 0) - return 0; - D = malloc (v); - Ai = malloc (u); - B = malloc (v + 1); - Slen = v * ((saltlen+v-1)/v); - if(passlen) Plen = v * ((passlen+v-1)/v); - else Plen = 0; + return 0; + D = malloc(v); + Ai = malloc(u); + B = malloc(v + 1); + Slen = v * ((saltlen + v - 1) / v); + if (passlen) + Plen = v * ((passlen + v - 1)/v); + else + Plen = 0; Ilen = Slen + Plen; - I = malloc (Ilen); + I = malloc(Ilen); Ij = BN_new(); Bpl1 = BN_new(); if (!D || !Ai || !B || !I || !Ij || !Bpl1) goto err; - for (i = 0; i < v; i++) D[i] = id; + for (i = 0; i < v; i++) + D[i] = id; p = I; - for (i = 0; i < Slen; i++) *p++ = salt[i % saltlen]; - for (i = 0; i < Plen; i++) *p++ = pass[i % passlen]; + for (i = 0; i < Slen; i++) + *p++ = salt[i % saltlen]; + for (i = 0; i < Plen; i++) + *p++ = pass[i % passlen]; for (;;) { - if (!EVP_DigestInit_ex(&ctx, md_type, NULL) - || !EVP_DigestUpdate(&ctx, D, v) - || !EVP_DigestUpdate(&ctx, I, Ilen) - || !EVP_DigestFinal_ex(&ctx, Ai, NULL)) + if (!EVP_DigestInit_ex(&ctx, md_type, NULL) || + !EVP_DigestUpdate(&ctx, D, v) || + !EVP_DigestUpdate(&ctx, I, Ilen) || + !EVP_DigestFinal_ex(&ctx, Ai, NULL)) goto err; for (j = 1; j < iter; j++) { - if (!EVP_DigestInit_ex(&ctx, md_type, NULL) - || !EVP_DigestUpdate(&ctx, Ai, u) - || !EVP_DigestFinal_ex(&ctx, Ai, NULL)) - goto err; + if (!EVP_DigestInit_ex(&ctx, md_type, NULL) || + !EVP_DigestUpdate(&ctx, Ai, u) || + !EVP_DigestFinal_ex(&ctx, Ai, NULL)) + goto err; } memcpy (out, Ai, min (n, u)); if (u >= n) { @@ -174,13 +181,14 @@ int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, } n -= u; out += u; - for (j = 0; j < v; j++) B[j] = Ai[j % u]; + for (j = 0; j < v; j++) + B[j] = Ai[j % u]; /* Work out B + 1 first then can use B as tmp space */ if (!BN_bin2bn (B, v, Bpl1)) goto err; if (!BN_add_word (Bpl1, 1)) goto err; - for (j = 0; j < Ilen ; j+=v) { + for (j = 0; j < Ilen; j += v) { if (!BN_bin2bn(I + j, v, Ij)) goto err; if (!BN_add(Ij, Ij, Bpl1)) @@ -194,7 +202,7 @@ int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, goto err; memcpy (I + j, B + 1, v); #ifndef PKCS12_BROKEN_KEYGEN - /* If less than v bytes pad with zeroes */ + /* If less than v bytes pad with zeroes */ } else if (Ijlen < v) { memset(I + j, 0, v - Ijlen); if (!BN_bn2bin(Ij, I + j + v - Ijlen)) @@ -206,7 +214,7 @@ int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, } err: - PKCS12err(PKCS12_F_PKCS12_KEY_GEN_UNI,ERR_R_MALLOC_FAILURE); + PKCS12err(PKCS12_F_PKCS12_KEY_GEN_UNI, ERR_R_MALLOC_FAILURE); end: free (Ai); @@ -221,7 +229,8 @@ end: #ifdef DEBUG_KEYGEN void h__dump (unsigned char *p, int len) { - for (; len --; p++) fprintf(stderr, "%02X", *p); - fprintf(stderr, "\n"); + for (; len --; p++) + fprintf(stderr, "%02X", *p); + fprintf(stderr, "\n"); } #endif diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_kiss.c b/src/lib/libssl/src/crypto/pkcs12/p12_kiss.c index 0772fa65af..4063ba4b82 100644 --- a/src/lib/libssl/src/crypto/pkcs12/p12_kiss.c +++ b/src/lib/libssl/src/crypto/pkcs12/p12_kiss.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_kiss.c,v 1.14 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_kiss.c,v 1.15 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 1999. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -63,13 +63,13 @@ /* Simplified PKCS#12 routines */ static int parse_pk12( PKCS12 *p12, const char *pass, int passlen, - EVP_PKEY **pkey, STACK_OF(X509) *ocerts); + EVP_PKEY **pkey, STACK_OF(X509) *ocerts); static int parse_bags( STACK_OF(PKCS12_SAFEBAG) *bags, const char *pass, - int passlen, EVP_PKEY **pkey, STACK_OF(X509) *ocerts); + int passlen, EVP_PKEY **pkey, STACK_OF(X509) *ocerts); static int parse_bag( PKCS12_SAFEBAG *bag, const char *pass, int passlen, - EVP_PKEY **pkey, STACK_OF(X509) *ocerts); + EVP_PKEY **pkey, STACK_OF(X509) *ocerts); /* Parse and decrypt a PKCS#12 structure returning user key, user cert * and other (CA) certs. Note either ca should be NULL, *ca should be NULL, @@ -77,22 +77,23 @@ static int parse_bag( PKCS12_SAFEBAG *bag, const char *pass, int passlen, * passed unitialised. */ -int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert, - STACK_OF(X509) **ca) +int +PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert, + STACK_OF(X509) **ca) { STACK_OF(X509) *ocerts = NULL; X509 *x = NULL; /* Check for NULL PKCS12 structure */ - if(!p12) - { - PKCS12err(PKCS12_F_PKCS12_PARSE,PKCS12_R_INVALID_NULL_PKCS12_POINTER); + if (!p12) { + PKCS12err(PKCS12_F_PKCS12_PARSE, + PKCS12_R_INVALID_NULL_PKCS12_POINTER); return 0; - } + } - if(pkey) + if (pkey) *pkey = NULL; - if(cert) + if (cert) *cert = NULL; /* Check the mac */ @@ -103,46 +104,42 @@ int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert, * password are two different things... */ - if(!pass || !*pass) { - if(PKCS12_verify_mac(p12, NULL, 0)) pass = NULL; - else if(PKCS12_verify_mac(p12, "", 0)) pass = ""; + if (!pass || !*pass) { + if (PKCS12_verify_mac(p12, NULL, 0)) + pass = NULL; + else if (PKCS12_verify_mac(p12, "", 0)) + pass = ""; else { - PKCS12err(PKCS12_F_PKCS12_PARSE,PKCS12_R_MAC_VERIFY_FAILURE); + PKCS12err(PKCS12_F_PKCS12_PARSE, + PKCS12_R_MAC_VERIFY_FAILURE); goto err; } } else if (!PKCS12_verify_mac(p12, pass, -1)) { - PKCS12err(PKCS12_F_PKCS12_PARSE,PKCS12_R_MAC_VERIFY_FAILURE); + PKCS12err(PKCS12_F_PKCS12_PARSE, PKCS12_R_MAC_VERIFY_FAILURE); goto err; } /* Allocate stack for other certificates */ ocerts = sk_X509_new_null(); - - if (!ocerts) - { - PKCS12err(PKCS12_F_PKCS12_PARSE,ERR_R_MALLOC_FAILURE); + if (!ocerts) { + PKCS12err(PKCS12_F_PKCS12_PARSE, ERR_R_MALLOC_FAILURE); return 0; - } + } - if (!parse_pk12 (p12, pass, -1, pkey, ocerts)) - { - PKCS12err(PKCS12_F_PKCS12_PARSE,PKCS12_R_PARSE_ERROR); + if (!parse_pk12 (p12, pass, -1, pkey, ocerts)) { + PKCS12err(PKCS12_F_PKCS12_PARSE, PKCS12_R_PARSE_ERROR); goto err; - } + } - while ((x = sk_X509_pop(ocerts))) - { - if (pkey && *pkey && cert && !*cert) - { - if (X509_check_private_key(x, *pkey)) - { + while ((x = sk_X509_pop(ocerts))) { + if (pkey && *pkey && cert && !*cert) { + if (X509_check_private_key(x, *pkey)) { *cert = x; x = NULL; - } } + } - if (ca && x) - { + if (ca && x) { if (!*ca) *ca = sk_X509_new_null(); if (!*ca) @@ -150,18 +147,17 @@ int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert, if (!sk_X509_push(*ca, x)) goto err; x = NULL; - } + } if (x) X509_free(x); - } + } if (ocerts) sk_X509_pop_free(ocerts, X509_free); return 1; - err: - +err: if (pkey && *pkey) EVP_PKEY_free(*pkey); if (cert && *cert) @@ -171,20 +167,21 @@ int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert, if (ocerts) sk_X509_pop_free(ocerts, X509_free); return 0; - } /* Parse the outer PKCS#12 structure */ -static int parse_pk12(PKCS12 *p12, const char *pass, int passlen, - EVP_PKEY **pkey, STACK_OF(X509) *ocerts) +static int +parse_pk12(PKCS12 *p12, const char *pass, int passlen, EVP_PKEY **pkey, + STACK_OF(X509) *ocerts) { STACK_OF(PKCS7) *asafes; STACK_OF(PKCS12_SAFEBAG) *bags; int i, bagnid; PKCS7 *p7; - if (!(asafes = PKCS12_unpack_authsafes (p12))) return 0; + if (!(asafes = PKCS12_unpack_authsafes (p12))) + return 0; for (i = 0; i < sk_PKCS7_num (asafes); i++) { p7 = sk_PKCS7_value (asafes, i); bagnid = OBJ_obj2nid (p7->type); @@ -192,12 +189,13 @@ static int parse_pk12(PKCS12 *p12, const char *pass, int passlen, bags = PKCS12_unpack_p7data(p7); } else if (bagnid == NID_pkcs7_encrypted) { bags = PKCS12_unpack_p7encdata(p7, pass, passlen); - } else continue; + } else + continue; if (!bags) { sk_PKCS7_pop_free(asafes, PKCS7_free); return 0; } - if (!parse_bags(bags, pass, passlen, pkey, ocerts)) { + if (!parse_bags(bags, pass, passlen, pkey, ocerts)) { sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free); sk_PKCS7_pop_free(asafes, PKCS7_free); return 0; @@ -208,21 +206,23 @@ static int parse_pk12(PKCS12 *p12, const char *pass, int passlen, return 1; } - -static int parse_bags(STACK_OF(PKCS12_SAFEBAG) *bags, const char *pass, - int passlen, EVP_PKEY **pkey, STACK_OF(X509) *ocerts) +static int +parse_bags(STACK_OF(PKCS12_SAFEBAG) *bags, const char *pass, int passlen, + EVP_PKEY **pkey, STACK_OF(X509) *ocerts) { int i; + for (i = 0; i < sk_PKCS12_SAFEBAG_num(bags); i++) { - if (!parse_bag(sk_PKCS12_SAFEBAG_value (bags, i), - pass, passlen, pkey, ocerts)) + if (!parse_bag(sk_PKCS12_SAFEBAG_value(bags, i), pass, passlen, + pkey, ocerts)) return 0; } return 1; } -static int parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen, - EVP_PKEY **pkey, STACK_OF(X509) *ocerts) +static int +parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen, EVP_PKEY **pkey, + STACK_OF(X509) *ocerts) { PKCS8_PRIV_KEY_INFO *p8; X509 *x509; @@ -236,67 +236,63 @@ static int parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen, if ((attrib = PKCS12_get_attr (bag, NID_localKeyID))) lkid = attrib->value.octet_string; - switch (M_PKCS12_bag_type(bag)) - { + switch (M_PKCS12_bag_type(bag)) { case NID_keyBag: if (!pkey || *pkey) - return 1; + return 1; if (!(*pkey = EVP_PKCS82PKEY(bag->value.keybag))) return 0; - break; + break; case NID_pkcs8ShroudedKeyBag: if (!pkey || *pkey) - return 1; + return 1; if (!(p8 = PKCS12_decrypt_skey(bag, pass, passlen))) - return 0; + return 0; *pkey = EVP_PKCS82PKEY(p8); PKCS8_PRIV_KEY_INFO_free(p8); - if (!(*pkey)) return 0; - break; + if (!(*pkey)) + return 0; + break; case NID_certBag: if (M_PKCS12_cert_bag_type(bag) != NID_x509Certificate ) return 1; if (!(x509 = PKCS12_certbag2x509(bag))) return 0; - if(lkid && !X509_keyid_set1(x509, lkid->data, lkid->length)) - { + if (lkid && !X509_keyid_set1(x509, lkid->data, lkid->length)) { X509_free(x509); return 0; - } - if(fname) { + } + if (fname) { int len, r; unsigned char *data; len = ASN1_STRING_to_UTF8(&data, fname); - if(len >= 0) { + if (len >= 0) { r = X509_alias_set1(x509, data, len); free(data); - if (!r) - { + if (!r) { X509_free(x509); return 0; - } + } } } - if(!sk_X509_push(ocerts, x509)) - { + if (!sk_X509_push(ocerts, x509)) { X509_free(x509); return 0; - } + } - break; + break; case NID_safeContentsBag: return parse_bags(bag->value.safes, pass, passlen, - pkey, ocerts); - break; + pkey, ocerts); + break; default: return 1; - break; + break; } return 1; } - diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_mutl.c b/src/lib/libssl/src/crypto/pkcs12/p12_mutl.c index 203480fb15..7a2fab1666 100644 --- a/src/lib/libssl/src/crypto/pkcs12/p12_mutl.c +++ b/src/lib/libssl/src/crypto/pkcs12/p12_mutl.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_mutl.c,v 1.13 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_mutl.c,v 1.14 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 1999. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -64,8 +64,9 @@ #include /* Generate a MAC */ -int PKCS12_gen_mac(PKCS12 *p12, const char *pass, int passlen, - unsigned char *mac, unsigned int *maclen) +int +PKCS12_gen_mac(PKCS12 *p12, const char *pass, int passlen, + unsigned char *mac, unsigned int *maclen) { const EVP_MD *md_type; HMAC_CTX hmac; @@ -73,101 +74,115 @@ int PKCS12_gen_mac(PKCS12 *p12, const char *pass, int passlen, int saltlen, iter; int md_size; - if (!PKCS7_type_is_data(p12->authsafes)) - { - PKCS12err(PKCS12_F_PKCS12_GEN_MAC,PKCS12_R_CONTENT_TYPE_NOT_DATA); + if (!PKCS7_type_is_data(p12->authsafes)) { + PKCS12err(PKCS12_F_PKCS12_GEN_MAC, + PKCS12_R_CONTENT_TYPE_NOT_DATA); return 0; - } + } salt = p12->mac->salt->data; saltlen = p12->mac->salt->length; - if (!p12->mac->iter) iter = 1; - else iter = ASN1_INTEGER_get (p12->mac->iter); - if(!(md_type = - EVP_get_digestbyobj (p12->mac->dinfo->algor->algorithm))) { - PKCS12err(PKCS12_F_PKCS12_GEN_MAC,PKCS12_R_UNKNOWN_DIGEST_ALGORITHM); + if (!p12->mac->iter) + iter = 1; + else + iter = ASN1_INTEGER_get(p12->mac->iter); + if (!(md_type = EVP_get_digestbyobj( + p12->mac->dinfo->algor->algorithm))) { + PKCS12err(PKCS12_F_PKCS12_GEN_MAC, + PKCS12_R_UNKNOWN_DIGEST_ALGORITHM); return 0; } md_size = EVP_MD_size(md_type); if (md_size < 0) - return 0; - if(!PKCS12_key_gen (pass, passlen, salt, saltlen, PKCS12_MAC_ID, iter, - md_size, key, md_type)) { - PKCS12err(PKCS12_F_PKCS12_GEN_MAC,PKCS12_R_KEY_GEN_ERROR); + return 0; + if (!PKCS12_key_gen (pass, passlen, salt, saltlen, PKCS12_MAC_ID, iter, + md_size, key, md_type)) { + PKCS12err(PKCS12_F_PKCS12_GEN_MAC, PKCS12_R_KEY_GEN_ERROR); return 0; } HMAC_CTX_init(&hmac); - if (!HMAC_Init_ex(&hmac, key, md_size, md_type, NULL) - || !HMAC_Update(&hmac, p12->authsafes->d.data->data, - p12->authsafes->d.data->length) - || !HMAC_Final(&hmac, mac, maclen)) - { - HMAC_CTX_cleanup(&hmac); + if (!HMAC_Init_ex(&hmac, key, md_size, md_type, NULL) || + !HMAC_Update(&hmac, p12->authsafes->d.data->data, + p12->authsafes->d.data->length) || + !HMAC_Final(&hmac, mac, maclen)) { + HMAC_CTX_cleanup(&hmac); return 0; - } - HMAC_CTX_cleanup(&hmac); + } + HMAC_CTX_cleanup(&hmac); return 1; } /* Verify the mac */ -int PKCS12_verify_mac(PKCS12 *p12, const char *pass, int passlen) +int +PKCS12_verify_mac(PKCS12 *p12, const char *pass, int passlen) { unsigned char mac[EVP_MAX_MD_SIZE]; unsigned int maclen; - if(p12->mac == NULL) { - PKCS12err(PKCS12_F_PKCS12_VERIFY_MAC,PKCS12_R_MAC_ABSENT); + if (p12->mac == NULL) { + PKCS12err(PKCS12_F_PKCS12_VERIFY_MAC, PKCS12_R_MAC_ABSENT); return 0; } if (!PKCS12_gen_mac (p12, pass, passlen, mac, &maclen)) { - PKCS12err(PKCS12_F_PKCS12_VERIFY_MAC,PKCS12_R_MAC_GENERATION_ERROR); + PKCS12err(PKCS12_F_PKCS12_VERIFY_MAC, + PKCS12_R_MAC_GENERATION_ERROR); return 0; } - if ((maclen != (unsigned int)p12->mac->dinfo->digest->length) - || memcmp (mac, p12->mac->dinfo->digest->data, maclen)) return 0; + if ((maclen != (unsigned int)p12->mac->dinfo->digest->length) || + memcmp(mac, p12->mac->dinfo->digest->data, maclen)) + return 0; return 1; } /* Set a mac */ -int PKCS12_set_mac(PKCS12 *p12, const char *pass, int passlen, - unsigned char *salt, int saltlen, int iter, const EVP_MD *md_type) +int +PKCS12_set_mac(PKCS12 *p12, const char *pass, int passlen, unsigned char *salt, + int saltlen, int iter, const EVP_MD *md_type) { unsigned char mac[EVP_MAX_MD_SIZE]; unsigned int maclen; - if (!md_type) md_type = EVP_sha1(); + if (!md_type) + md_type = EVP_sha1(); if (PKCS12_setup_mac (p12, iter, salt, saltlen, md_type) == - PKCS12_ERROR) { - PKCS12err(PKCS12_F_PKCS12_SET_MAC,PKCS12_R_MAC_SETUP_ERROR); + PKCS12_ERROR) { + PKCS12err(PKCS12_F_PKCS12_SET_MAC, PKCS12_R_MAC_SETUP_ERROR); return 0; } if (!PKCS12_gen_mac (p12, pass, passlen, mac, &maclen)) { - PKCS12err(PKCS12_F_PKCS12_SET_MAC,PKCS12_R_MAC_GENERATION_ERROR); + PKCS12err(PKCS12_F_PKCS12_SET_MAC, + PKCS12_R_MAC_GENERATION_ERROR); return 0; } if (!(M_ASN1_OCTET_STRING_set (p12->mac->dinfo->digest, mac, maclen))) { - PKCS12err(PKCS12_F_PKCS12_SET_MAC,PKCS12_R_MAC_STRING_SET_ERROR); - return 0; + PKCS12err(PKCS12_F_PKCS12_SET_MAC, + PKCS12_R_MAC_STRING_SET_ERROR); + return 0; } return 1; } /* Set up a mac structure */ -int PKCS12_setup_mac(PKCS12 *p12, int iter, unsigned char *salt, int saltlen, - const EVP_MD *md_type) +int +PKCS12_setup_mac(PKCS12 *p12, int iter, unsigned char *salt, int saltlen, + const EVP_MD *md_type) { - if (!(p12->mac = PKCS12_MAC_DATA_new())) return PKCS12_ERROR; + if (!(p12->mac = PKCS12_MAC_DATA_new())) + return PKCS12_ERROR; if (iter > 1) { - if(!(p12->mac->iter = M_ASN1_INTEGER_new())) { - PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE); + if (!(p12->mac->iter = M_ASN1_INTEGER_new())) { + PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, + ERR_R_MALLOC_FAILURE); return 0; } if (!ASN1_INTEGER_set(p12->mac->iter, iter)) { - PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE); + PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, + ERR_R_MALLOC_FAILURE); return 0; } } - if (!saltlen) saltlen = PKCS12_SALT_LEN; + if (!saltlen) + saltlen = PKCS12_SALT_LEN; p12->mac->salt->length = saltlen; if (!(p12->mac->salt->data = malloc (saltlen))) { PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE); @@ -176,15 +191,15 @@ int PKCS12_setup_mac(PKCS12 *p12, int iter, unsigned char *salt, int saltlen, if (!salt) { if (RAND_pseudo_bytes (p12->mac->salt->data, saltlen) < 0) return 0; - } - else memcpy (p12->mac->salt->data, salt, saltlen); + } else + memcpy (p12->mac->salt->data, salt, saltlen); p12->mac->dinfo->algor->algorithm = OBJ_nid2obj(EVP_MD_type(md_type)); if (!(p12->mac->dinfo->algor->parameter = ASN1_TYPE_new())) { PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE); return 0; } p12->mac->dinfo->algor->parameter->type = V_ASN1_NULL; - + return 1; } #endif diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_npas.c b/src/lib/libssl/src/crypto/pkcs12/p12_npas.c index 9477de4a08..ab7bdc6458 100644 --- a/src/lib/libssl/src/crypto/pkcs12/p12_npas.c +++ b/src/lib/libssl/src/crypto/pkcs12/p12_npas.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_npas.c,v 1.8 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_npas.c,v 1.9 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 1999. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -67,32 +67,34 @@ static int newpass_p12(PKCS12 *p12, char *oldpass, char *newpass); static int newpass_bags(STACK_OF(PKCS12_SAFEBAG) *bags, char *oldpass, - char *newpass); + char *newpass); static int newpass_bag(PKCS12_SAFEBAG *bag, char *oldpass, char *newpass); static int alg_get(X509_ALGOR *alg, int *pnid, int *piter, int *psaltlen); -/* +/* * Change the password on a PKCS#12 structure. */ -int PKCS12_newpass(PKCS12 *p12, char *oldpass, char *newpass) +int +PKCS12_newpass(PKCS12 *p12, char *oldpass, char *newpass) { /* Check for NULL PKCS12 structure */ - if(!p12) { - PKCS12err(PKCS12_F_PKCS12_NEWPASS,PKCS12_R_INVALID_NULL_PKCS12_POINTER); + if (!p12) { + PKCS12err(PKCS12_F_PKCS12_NEWPASS, + PKCS12_R_INVALID_NULL_PKCS12_POINTER); return 0; } /* Check the mac */ - + if (!PKCS12_verify_mac(p12, oldpass, -1)) { - PKCS12err(PKCS12_F_PKCS12_NEWPASS,PKCS12_R_MAC_VERIFY_FAILURE); + PKCS12err(PKCS12_F_PKCS12_NEWPASS, PKCS12_R_MAC_VERIFY_FAILURE); return 0; } if (!newpass_p12(p12, oldpass, newpass)) { - PKCS12err(PKCS12_F_PKCS12_NEWPASS,PKCS12_R_PARSE_ERROR); + PKCS12err(PKCS12_F_PKCS12_NEWPASS, PKCS12_R_PARSE_ERROR); return 0; } @@ -101,7 +103,8 @@ int PKCS12_newpass(PKCS12 *p12, char *oldpass, char *newpass) /* Parse the outer PKCS#12 structure */ -static int newpass_p12(PKCS12 *p12, char *oldpass, char *newpass) +static int +newpass_p12(PKCS12 *p12, char *oldpass, char *newpass) { STACK_OF(PKCS7) *asafes, *newsafes; STACK_OF(PKCS12_SAFEBAG) *bags; @@ -111,8 +114,10 @@ static int newpass_p12(PKCS12 *p12, char *oldpass, char *newpass) unsigned char mac[EVP_MAX_MD_SIZE]; unsigned int maclen; - if (!(asafes = PKCS12_unpack_authsafes(p12))) return 0; - if(!(newsafes = sk_PKCS7_new_null())) return 0; + if (!(asafes = PKCS12_unpack_authsafes(p12))) + return 0; + if (!(newsafes = sk_PKCS7_new_null())) + return 0; for (i = 0; i < sk_PKCS7_num (asafes); i++) { p7 = sk_PKCS7_value(asafes, i); bagnid = OBJ_obj2nid(p7->type); @@ -121,28 +126,30 @@ static int newpass_p12(PKCS12 *p12, char *oldpass, char *newpass) } else if (bagnid == NID_pkcs7_encrypted) { bags = PKCS12_unpack_p7encdata(p7, oldpass, -1); if (!alg_get(p7->d.encrypted->enc_data->algorithm, - &pbe_nid, &pbe_iter, &pbe_saltlen)) - { + &pbe_nid, &pbe_iter, &pbe_saltlen)) { sk_PKCS12_SAFEBAG_pop_free(bags, - PKCS12_SAFEBAG_free); + PKCS12_SAFEBAG_free); bags = NULL; - } - } else continue; + } + } else + continue; if (!bags) { sk_PKCS7_pop_free(asafes, PKCS7_free); return 0; } - if (!newpass_bags(bags, oldpass, newpass)) { + if (!newpass_bags(bags, oldpass, newpass)) { sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free); sk_PKCS7_pop_free(asafes, PKCS7_free); return 0; } /* Repack bag in same form with new password */ - if (bagnid == NID_pkcs7_data) p7new = PKCS12_pack_p7data(bags); - else p7new = PKCS12_pack_p7encdata(pbe_nid, newpass, -1, NULL, - pbe_saltlen, pbe_iter, bags); + if (bagnid == NID_pkcs7_data) + p7new = PKCS12_pack_p7data(bags); + else + p7new = PKCS12_pack_p7encdata(pbe_nid, newpass, -1, + NULL, pbe_saltlen, pbe_iter, bags); sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free); - if(!p7new) { + if (!p7new) { sk_PKCS7_pop_free(asafes, PKCS7_free); return 0; } @@ -153,73 +160,82 @@ static int newpass_p12(PKCS12 *p12, char *oldpass, char *newpass) /* Repack safe: save old safe in case of error */ p12_data_tmp = p12->authsafes->d.data; - if(!(p12->authsafes->d.data = ASN1_OCTET_STRING_new())) goto saferr; - if(!PKCS12_pack_authsafes(p12, newsafes)) goto saferr; - - if(!PKCS12_gen_mac(p12, newpass, -1, mac, &maclen)) goto saferr; - if(!(macnew = ASN1_OCTET_STRING_new())) goto saferr; - if(!ASN1_OCTET_STRING_set(macnew, mac, maclen)) goto saferr; + if (!(p12->authsafes->d.data = ASN1_OCTET_STRING_new())) + goto saferr; + if (!PKCS12_pack_authsafes(p12, newsafes)) + goto saferr; + + if (!PKCS12_gen_mac(p12, newpass, -1, mac, &maclen)) + goto saferr; + if (!(macnew = ASN1_OCTET_STRING_new())) + goto saferr; + if (!ASN1_OCTET_STRING_set(macnew, mac, maclen)) + goto saferr; ASN1_OCTET_STRING_free(p12->mac->dinfo->digest); p12->mac->dinfo->digest = macnew; ASN1_OCTET_STRING_free(p12_data_tmp); return 1; - saferr: +saferr: /* Restore old safe */ ASN1_OCTET_STRING_free(p12->authsafes->d.data); ASN1_OCTET_STRING_free(macnew); p12->authsafes->d.data = p12_data_tmp; return 0; - } -static int newpass_bags(STACK_OF(PKCS12_SAFEBAG) *bags, char *oldpass, - char *newpass) +static int +newpass_bags(STACK_OF(PKCS12_SAFEBAG) *bags, char *oldpass, char *newpass) { int i; + for (i = 0; i < sk_PKCS12_SAFEBAG_num(bags); i++) { if (!newpass_bag(sk_PKCS12_SAFEBAG_value(bags, i), - oldpass, newpass)) - return 0; + oldpass, newpass)) + return 0; } return 1; } /* Change password of safebag: only needs handle shrouded keybags */ -static int newpass_bag(PKCS12_SAFEBAG *bag, char *oldpass, char *newpass) +static int +newpass_bag(PKCS12_SAFEBAG *bag, char *oldpass, char *newpass) { PKCS8_PRIV_KEY_INFO *p8; X509_SIG *p8new; int p8_nid, p8_saltlen, p8_iter; - if(M_PKCS12_bag_type(bag) != NID_pkcs8ShroudedKeyBag) return 1; + if (M_PKCS12_bag_type(bag) != NID_pkcs8ShroudedKeyBag) + return 1; - if (!(p8 = PKCS8_decrypt(bag->value.shkeybag, oldpass, -1))) return 0; + if (!(p8 = PKCS8_decrypt(bag->value.shkeybag, oldpass, -1))) + return 0; if (!alg_get(bag->value.shkeybag->algor, &p8_nid, &p8_iter, - &p8_saltlen)) + &p8_saltlen)) return 0; - if(!(p8new = PKCS8_encrypt(p8_nid, NULL, newpass, -1, NULL, p8_saltlen, - p8_iter, p8))) return 0; + if (!(p8new = PKCS8_encrypt(p8_nid, NULL, newpass, -1, NULL, p8_saltlen, + p8_iter, p8))) return 0; X509_SIG_free(bag->value.shkeybag); bag->value.shkeybag = p8new; return 1; } -static int alg_get(X509_ALGOR *alg, int *pnid, int *piter, int *psaltlen) +static int +alg_get(X509_ALGOR *alg, int *pnid, int *piter, int *psaltlen) { - PBEPARAM *pbe; - const unsigned char *p; + PBEPARAM *pbe; + const unsigned char *p; - p = alg->parameter->value.sequence->data; - pbe = d2i_PBEPARAM(NULL, &p, alg->parameter->value.sequence->length); + p = alg->parameter->value.sequence->data; + pbe = d2i_PBEPARAM(NULL, &p, alg->parameter->value.sequence->length); if (!pbe) return 0; - *pnid = OBJ_obj2nid(alg->algorithm); + *pnid = OBJ_obj2nid(alg->algorithm); *piter = ASN1_INTEGER_get(pbe->iter); *psaltlen = pbe->salt->length; - PBEPARAM_free(pbe); - return 1; + PBEPARAM_free(pbe); + return 1; } diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_p8d.c b/src/lib/libssl/src/crypto/pkcs12/p12_p8d.c index f6a333baa5..4aceae6a9f 100644 --- a/src/lib/libssl/src/crypto/pkcs12/p12_p8d.c +++ b/src/lib/libssl/src/crypto/pkcs12/p12_p8d.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_p8d.c,v 1.3 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_p8d.c,v 1.4 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 2001. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -60,9 +60,9 @@ #include "cryptlib.h" #include -PKCS8_PRIV_KEY_INFO *PKCS8_decrypt(X509_SIG *p8, const char *pass, int passlen) +PKCS8_PRIV_KEY_INFO * +PKCS8_decrypt(X509_SIG *p8, const char *pass, int passlen) { - return PKCS12_item_decrypt_d2i(p8->algor, ASN1_ITEM_rptr(PKCS8_PRIV_KEY_INFO), pass, - passlen, p8->digest, 1); + return PKCS12_item_decrypt_d2i(p8->algor, + ASN1_ITEM_rptr(PKCS8_PRIV_KEY_INFO), pass, passlen, p8->digest, 1); } - diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_p8e.c b/src/lib/libssl/src/crypto/pkcs12/p12_p8e.c index 3d71a02a1c..1ee6a32f6a 100644 --- a/src/lib/libssl/src/crypto/pkcs12/p12_p8e.c +++ b/src/lib/libssl/src/crypto/pkcs12/p12_p8e.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_p8e.c,v 1.3 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_p8e.c,v 1.4 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 2001. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -60,10 +60,10 @@ #include "cryptlib.h" #include -X509_SIG *PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher, - const char *pass, int passlen, - unsigned char *salt, int saltlen, int iter, - PKCS8_PRIV_KEY_INFO *p8inf) +X509_SIG * +PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher, const char *pass, + int passlen, unsigned char *salt, int saltlen, int iter, + PKCS8_PRIV_KEY_INFO *p8inf) { X509_SIG *p8 = NULL; X509_ALGOR *pbe; @@ -73,25 +73,27 @@ X509_SIG *PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher, goto err; } - if(pbe_nid == -1) pbe = PKCS5_pbe2_set(cipher, iter, salt, saltlen); - else pbe = PKCS5_pbe_set(pbe_nid, iter, salt, saltlen); - if(!pbe) { + if (pbe_nid == -1) + pbe = PKCS5_pbe2_set(cipher, iter, salt, saltlen); + else + pbe = PKCS5_pbe_set(pbe_nid, iter, salt, saltlen); + if (!pbe) { PKCS12err(PKCS12_F_PKCS8_ENCRYPT, ERR_R_ASN1_LIB); goto err; } X509_ALGOR_free(p8->algor); p8->algor = pbe; M_ASN1_OCTET_STRING_free(p8->digest); - p8->digest = PKCS12_item_i2d_encrypt(pbe, ASN1_ITEM_rptr(PKCS8_PRIV_KEY_INFO), - pass, passlen, p8inf, 1); - if(!p8->digest) { + p8->digest = PKCS12_item_i2d_encrypt(pbe, + ASN1_ITEM_rptr(PKCS8_PRIV_KEY_INFO), pass, passlen, p8inf, 1); + if (!p8->digest) { PKCS12err(PKCS12_F_PKCS8_ENCRYPT, PKCS12_R_ENCRYPT_ERROR); goto err; } return p8; - err: +err: X509_SIG_free(p8); return NULL; } diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_utl.c b/src/lib/libssl/src/crypto/pkcs12/p12_utl.c index 372b94e412..618e6c699f 100644 --- a/src/lib/libssl/src/crypto/pkcs12/p12_utl.c +++ b/src/lib/libssl/src/crypto/pkcs12/p12_utl.c @@ -1,4 +1,4 @@ -/* $OpenBSD: p12_utl.c,v 1.9 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: p12_utl.c,v 1.10 2014/07/08 09:24:53 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 1999. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -62,81 +62,106 @@ /* Cheap and nasty Unicode stuff */ -unsigned char *OPENSSL_asc2uni(const char *asc, int asclen, unsigned char **uni, int *unilen) +unsigned char * +OPENSSL_asc2uni(const char *asc, int asclen, unsigned char **uni, int *unilen) { int ulen, i; unsigned char *unitmp; - if (asclen == -1) asclen = strlen(asc); - ulen = asclen*2 + 2; - if (!(unitmp = malloc(ulen))) return NULL; - for (i = 0; i < ulen - 2; i+=2) { + + if (asclen == -1) + asclen = strlen(asc); + ulen = asclen * 2 + 2; + if (!(unitmp = malloc(ulen))) + return NULL; + for (i = 0; i < ulen - 2; i += 2) { unitmp[i] = 0; - unitmp[i + 1] = asc[i>>1]; + unitmp[i + 1] = asc[i >> 1]; } /* Make result double null terminated */ unitmp[ulen - 2] = 0; unitmp[ulen - 1] = 0; - if (unilen) *unilen = ulen; - if (uni) *uni = unitmp; + if (unilen) + *unilen = ulen; + if (uni) + *uni = unitmp; return unitmp; } -char *OPENSSL_uni2asc(unsigned char *uni, int unilen) +char * +OPENSSL_uni2asc(unsigned char *uni, int unilen) { int asclen, i; char *asctmp; + asclen = unilen / 2; /* If no terminating zero allow for one */ - if (!unilen || uni[unilen - 1]) asclen++; + if (!unilen || uni[unilen - 1]) + asclen++; uni++; - if (!(asctmp = malloc(asclen))) return NULL; - for (i = 0; i < unilen; i+=2) asctmp[i>>1] = uni[i]; + if (!(asctmp = malloc(asclen))) + return NULL; + for (i = 0; i < unilen; i += 2) + asctmp[i >> 1] = uni[i]; asctmp[asclen - 1] = 0; return asctmp; } -int i2d_PKCS12_bio(BIO *bp, PKCS12 *p12) +int +i2d_PKCS12_bio(BIO *bp, PKCS12 *p12) { return ASN1_item_i2d_bio(ASN1_ITEM_rptr(PKCS12), bp, p12); } -int i2d_PKCS12_fp(FILE *fp, PKCS12 *p12) +int +i2d_PKCS12_fp(FILE *fp, PKCS12 *p12) { return ASN1_item_i2d_fp(ASN1_ITEM_rptr(PKCS12), fp, p12); } -PKCS12 *d2i_PKCS12_bio(BIO *bp, PKCS12 **p12) +PKCS12 * +d2i_PKCS12_bio(BIO *bp, PKCS12 **p12) { return ASN1_item_d2i_bio(ASN1_ITEM_rptr(PKCS12), bp, p12); } -PKCS12 *d2i_PKCS12_fp(FILE *fp, PKCS12 **p12) + +PKCS12 * +d2i_PKCS12_fp(FILE *fp, PKCS12 **p12) { - return ASN1_item_d2i_fp(ASN1_ITEM_rptr(PKCS12), fp, p12); + return ASN1_item_d2i_fp(ASN1_ITEM_rptr(PKCS12), fp, p12); } -PKCS12_SAFEBAG *PKCS12_x5092certbag(X509 *x509) +PKCS12_SAFEBAG * +PKCS12_x5092certbag(X509 *x509) { return PKCS12_item_pack_safebag(x509, ASN1_ITEM_rptr(X509), - NID_x509Certificate, NID_certBag); + NID_x509Certificate, NID_certBag); } -PKCS12_SAFEBAG *PKCS12_x509crl2certbag(X509_CRL *crl) +PKCS12_SAFEBAG * +PKCS12_x509crl2certbag(X509_CRL *crl) { return PKCS12_item_pack_safebag(crl, ASN1_ITEM_rptr(X509_CRL), - NID_x509Crl, NID_crlBag); + NID_x509Crl, NID_crlBag); } -X509 *PKCS12_certbag2x509(PKCS12_SAFEBAG *bag) +X509 * +PKCS12_certbag2x509(PKCS12_SAFEBAG *bag) { - if(M_PKCS12_bag_type(bag) != NID_certBag) return NULL; - if(M_PKCS12_cert_bag_type(bag) != NID_x509Certificate) return NULL; - return ASN1_item_unpack(bag->value.bag->value.octet, ASN1_ITEM_rptr(X509)); + if (M_PKCS12_bag_type(bag) != NID_certBag) + return NULL; + if (M_PKCS12_cert_bag_type(bag) != NID_x509Certificate) + return NULL; + return ASN1_item_unpack(bag->value.bag->value.octet, + ASN1_ITEM_rptr(X509)); } -X509_CRL *PKCS12_certbag2x509crl(PKCS12_SAFEBAG *bag) +X509_CRL * +PKCS12_certbag2x509crl(PKCS12_SAFEBAG *bag) { - if(M_PKCS12_bag_type(bag) != NID_crlBag) return NULL; - if(M_PKCS12_cert_bag_type(bag) != NID_x509Crl) return NULL; + if (M_PKCS12_bag_type(bag) != NID_crlBag) + return NULL; + if (M_PKCS12_cert_bag_type(bag) != NID_x509Crl) + return NULL; return ASN1_item_unpack(bag->value.bag->value.octet, - ASN1_ITEM_rptr(X509_CRL)); + ASN1_ITEM_rptr(X509_CRL)); } diff --git a/src/lib/libssl/src/crypto/pkcs12/pk12err.c b/src/lib/libssl/src/crypto/pkcs12/pk12err.c index 5f54a7d062..12f418eb23 100644 --- a/src/lib/libssl/src/crypto/pkcs12/pk12err.c +++ b/src/lib/libssl/src/crypto/pkcs12/pk12err.c @@ -1,4 +1,4 @@ -/* $OpenBSD: pk12err.c,v 1.8 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: pk12err.c,v 1.9 2014/07/08 09:24:53 jsing Exp $ */ /* ==================================================================== * Copyright (c) 1999-2006 The OpenSSL Project. All rights reserved. * @@ -7,7 +7,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -68,77 +68,74 @@ #define ERR_FUNC(func) ERR_PACK(ERR_LIB_PKCS12,func,0) #define ERR_REASON(reason) ERR_PACK(ERR_LIB_PKCS12,0,reason) -static ERR_STRING_DATA PKCS12_str_functs[]= - { -{ERR_FUNC(PKCS12_F_PARSE_BAG), "PARSE_BAG"}, -{ERR_FUNC(PKCS12_F_PARSE_BAGS), "PARSE_BAGS"}, -{ERR_FUNC(PKCS12_F_PKCS12_ADD_FRIENDLYNAME), "PKCS12_ADD_FRIENDLYNAME"}, -{ERR_FUNC(PKCS12_F_PKCS12_ADD_FRIENDLYNAME_ASC), "PKCS12_add_friendlyname_asc"}, -{ERR_FUNC(PKCS12_F_PKCS12_ADD_FRIENDLYNAME_UNI), "PKCS12_add_friendlyname_uni"}, -{ERR_FUNC(PKCS12_F_PKCS12_ADD_LOCALKEYID), "PKCS12_add_localkeyid"}, -{ERR_FUNC(PKCS12_F_PKCS12_CREATE), "PKCS12_create"}, -{ERR_FUNC(PKCS12_F_PKCS12_GEN_MAC), "PKCS12_gen_mac"}, -{ERR_FUNC(PKCS12_F_PKCS12_INIT), "PKCS12_init"}, -{ERR_FUNC(PKCS12_F_PKCS12_ITEM_DECRYPT_D2I), "PKCS12_item_decrypt_d2i"}, -{ERR_FUNC(PKCS12_F_PKCS12_ITEM_I2D_ENCRYPT), "PKCS12_item_i2d_encrypt"}, -{ERR_FUNC(PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG), "PKCS12_item_pack_safebag"}, -{ERR_FUNC(PKCS12_F_PKCS12_KEY_GEN_ASC), "PKCS12_key_gen_asc"}, -{ERR_FUNC(PKCS12_F_PKCS12_KEY_GEN_UNI), "PKCS12_key_gen_uni"}, -{ERR_FUNC(PKCS12_F_PKCS12_MAKE_KEYBAG), "PKCS12_MAKE_KEYBAG"}, -{ERR_FUNC(PKCS12_F_PKCS12_MAKE_SHKEYBAG), "PKCS12_MAKE_SHKEYBAG"}, -{ERR_FUNC(PKCS12_F_PKCS12_NEWPASS), "PKCS12_newpass"}, -{ERR_FUNC(PKCS12_F_PKCS12_PACK_P7DATA), "PKCS12_pack_p7data"}, -{ERR_FUNC(PKCS12_F_PKCS12_PACK_P7ENCDATA), "PKCS12_pack_p7encdata"}, -{ERR_FUNC(PKCS12_F_PKCS12_PARSE), "PKCS12_parse"}, -{ERR_FUNC(PKCS12_F_PKCS12_PBE_CRYPT), "PKCS12_pbe_crypt"}, -{ERR_FUNC(PKCS12_F_PKCS12_PBE_KEYIVGEN), "PKCS12_PBE_keyivgen"}, -{ERR_FUNC(PKCS12_F_PKCS12_SETUP_MAC), "PKCS12_setup_mac"}, -{ERR_FUNC(PKCS12_F_PKCS12_SET_MAC), "PKCS12_set_mac"}, -{ERR_FUNC(PKCS12_F_PKCS12_UNPACK_AUTHSAFES), "PKCS12_unpack_authsafes"}, -{ERR_FUNC(PKCS12_F_PKCS12_UNPACK_P7DATA), "PKCS12_unpack_p7data"}, -{ERR_FUNC(PKCS12_F_PKCS12_VERIFY_MAC), "PKCS12_verify_mac"}, -{ERR_FUNC(PKCS12_F_PKCS8_ADD_KEYUSAGE), "PKCS8_add_keyusage"}, -{ERR_FUNC(PKCS12_F_PKCS8_ENCRYPT), "PKCS8_encrypt"}, -{0,NULL} - }; +static ERR_STRING_DATA PKCS12_str_functs[]= { + {ERR_FUNC(PKCS12_F_PARSE_BAG), "PARSE_BAG"}, + {ERR_FUNC(PKCS12_F_PARSE_BAGS), "PARSE_BAGS"}, + {ERR_FUNC(PKCS12_F_PKCS12_ADD_FRIENDLYNAME), "PKCS12_ADD_FRIENDLYNAME"}, + {ERR_FUNC(PKCS12_F_PKCS12_ADD_FRIENDLYNAME_ASC), "PKCS12_add_friendlyname_asc"}, + {ERR_FUNC(PKCS12_F_PKCS12_ADD_FRIENDLYNAME_UNI), "PKCS12_add_friendlyname_uni"}, + {ERR_FUNC(PKCS12_F_PKCS12_ADD_LOCALKEYID), "PKCS12_add_localkeyid"}, + {ERR_FUNC(PKCS12_F_PKCS12_CREATE), "PKCS12_create"}, + {ERR_FUNC(PKCS12_F_PKCS12_GEN_MAC), "PKCS12_gen_mac"}, + {ERR_FUNC(PKCS12_F_PKCS12_INIT), "PKCS12_init"}, + {ERR_FUNC(PKCS12_F_PKCS12_ITEM_DECRYPT_D2I), "PKCS12_item_decrypt_d2i"}, + {ERR_FUNC(PKCS12_F_PKCS12_ITEM_I2D_ENCRYPT), "PKCS12_item_i2d_encrypt"}, + {ERR_FUNC(PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG), "PKCS12_item_pack_safebag"}, + {ERR_FUNC(PKCS12_F_PKCS12_KEY_GEN_ASC), "PKCS12_key_gen_asc"}, + {ERR_FUNC(PKCS12_F_PKCS12_KEY_GEN_UNI), "PKCS12_key_gen_uni"}, + {ERR_FUNC(PKCS12_F_PKCS12_MAKE_KEYBAG), "PKCS12_MAKE_KEYBAG"}, + {ERR_FUNC(PKCS12_F_PKCS12_MAKE_SHKEYBAG), "PKCS12_MAKE_SHKEYBAG"}, + {ERR_FUNC(PKCS12_F_PKCS12_NEWPASS), "PKCS12_newpass"}, + {ERR_FUNC(PKCS12_F_PKCS12_PACK_P7DATA), "PKCS12_pack_p7data"}, + {ERR_FUNC(PKCS12_F_PKCS12_PACK_P7ENCDATA), "PKCS12_pack_p7encdata"}, + {ERR_FUNC(PKCS12_F_PKCS12_PARSE), "PKCS12_parse"}, + {ERR_FUNC(PKCS12_F_PKCS12_PBE_CRYPT), "PKCS12_pbe_crypt"}, + {ERR_FUNC(PKCS12_F_PKCS12_PBE_KEYIVGEN), "PKCS12_PBE_keyivgen"}, + {ERR_FUNC(PKCS12_F_PKCS12_SETUP_MAC), "PKCS12_setup_mac"}, + {ERR_FUNC(PKCS12_F_PKCS12_SET_MAC), "PKCS12_set_mac"}, + {ERR_FUNC(PKCS12_F_PKCS12_UNPACK_AUTHSAFES), "PKCS12_unpack_authsafes"}, + {ERR_FUNC(PKCS12_F_PKCS12_UNPACK_P7DATA), "PKCS12_unpack_p7data"}, + {ERR_FUNC(PKCS12_F_PKCS12_VERIFY_MAC), "PKCS12_verify_mac"}, + {ERR_FUNC(PKCS12_F_PKCS8_ADD_KEYUSAGE), "PKCS8_add_keyusage"}, + {ERR_FUNC(PKCS12_F_PKCS8_ENCRYPT), "PKCS8_encrypt"}, + {0, NULL} +}; -static ERR_STRING_DATA PKCS12_str_reasons[]= - { -{ERR_REASON(PKCS12_R_CANT_PACK_STRUCTURE),"cant pack structure"}, -{ERR_REASON(PKCS12_R_CONTENT_TYPE_NOT_DATA),"content type not data"}, -{ERR_REASON(PKCS12_R_DECODE_ERROR) ,"decode error"}, -{ERR_REASON(PKCS12_R_ENCODE_ERROR) ,"encode error"}, -{ERR_REASON(PKCS12_R_ENCRYPT_ERROR) ,"encrypt error"}, -{ERR_REASON(PKCS12_R_ERROR_SETTING_ENCRYPTED_DATA_TYPE),"error setting encrypted data type"}, -{ERR_REASON(PKCS12_R_INVALID_NULL_ARGUMENT),"invalid null argument"}, -{ERR_REASON(PKCS12_R_INVALID_NULL_PKCS12_POINTER),"invalid null pkcs12 pointer"}, -{ERR_REASON(PKCS12_R_IV_GEN_ERROR) ,"iv gen error"}, -{ERR_REASON(PKCS12_R_KEY_GEN_ERROR) ,"key gen error"}, -{ERR_REASON(PKCS12_R_MAC_ABSENT) ,"mac absent"}, -{ERR_REASON(PKCS12_R_MAC_GENERATION_ERROR),"mac generation error"}, -{ERR_REASON(PKCS12_R_MAC_SETUP_ERROR) ,"mac setup error"}, -{ERR_REASON(PKCS12_R_MAC_STRING_SET_ERROR),"mac string set error"}, -{ERR_REASON(PKCS12_R_MAC_VERIFY_ERROR) ,"mac verify error"}, -{ERR_REASON(PKCS12_R_MAC_VERIFY_FAILURE) ,"mac verify failure"}, -{ERR_REASON(PKCS12_R_PARSE_ERROR) ,"parse error"}, -{ERR_REASON(PKCS12_R_PKCS12_ALGOR_CIPHERINIT_ERROR),"pkcs12 algor cipherinit error"}, -{ERR_REASON(PKCS12_R_PKCS12_CIPHERFINAL_ERROR),"pkcs12 cipherfinal error"}, -{ERR_REASON(PKCS12_R_PKCS12_PBE_CRYPT_ERROR),"pkcs12 pbe crypt error"}, -{ERR_REASON(PKCS12_R_UNKNOWN_DIGEST_ALGORITHM),"unknown digest algorithm"}, -{ERR_REASON(PKCS12_R_UNSUPPORTED_PKCS12_MODE),"unsupported pkcs12 mode"}, -{0,NULL} - }; +static ERR_STRING_DATA PKCS12_str_reasons[]= { + {ERR_REASON(PKCS12_R_CANT_PACK_STRUCTURE), "cant pack structure"}, + {ERR_REASON(PKCS12_R_CONTENT_TYPE_NOT_DATA), "content type not data"}, + {ERR_REASON(PKCS12_R_DECODE_ERROR) , "decode error"}, + {ERR_REASON(PKCS12_R_ENCODE_ERROR) , "encode error"}, + {ERR_REASON(PKCS12_R_ENCRYPT_ERROR) , "encrypt error"}, + {ERR_REASON(PKCS12_R_ERROR_SETTING_ENCRYPTED_DATA_TYPE), "error setting encrypted data type"}, + {ERR_REASON(PKCS12_R_INVALID_NULL_ARGUMENT), "invalid null argument"}, + {ERR_REASON(PKCS12_R_INVALID_NULL_PKCS12_POINTER), "invalid null pkcs12 pointer"}, + {ERR_REASON(PKCS12_R_IV_GEN_ERROR) , "iv gen error"}, + {ERR_REASON(PKCS12_R_KEY_GEN_ERROR) , "key gen error"}, + {ERR_REASON(PKCS12_R_MAC_ABSENT) , "mac absent"}, + {ERR_REASON(PKCS12_R_MAC_GENERATION_ERROR), "mac generation error"}, + {ERR_REASON(PKCS12_R_MAC_SETUP_ERROR) , "mac setup error"}, + {ERR_REASON(PKCS12_R_MAC_STRING_SET_ERROR), "mac string set error"}, + {ERR_REASON(PKCS12_R_MAC_VERIFY_ERROR) , "mac verify error"}, + {ERR_REASON(PKCS12_R_MAC_VERIFY_FAILURE) , "mac verify failure"}, + {ERR_REASON(PKCS12_R_PARSE_ERROR) , "parse error"}, + {ERR_REASON(PKCS12_R_PKCS12_ALGOR_CIPHERINIT_ERROR), "pkcs12 algor cipherinit error"}, + {ERR_REASON(PKCS12_R_PKCS12_CIPHERFINAL_ERROR), "pkcs12 cipherfinal error"}, + {ERR_REASON(PKCS12_R_PKCS12_PBE_CRYPT_ERROR), "pkcs12 pbe crypt error"}, + {ERR_REASON(PKCS12_R_UNKNOWN_DIGEST_ALGORITHM), "unknown digest algorithm"}, + {ERR_REASON(PKCS12_R_UNSUPPORTED_PKCS12_MODE), "unsupported pkcs12 mode"}, + {0, NULL} +}; #endif -void ERR_load_PKCS12_strings(void) - { +void +ERR_load_PKCS12_strings(void) +{ #ifndef OPENSSL_NO_ERR - - if (ERR_func_error_string(PKCS12_str_functs[0].error) == NULL) - { - ERR_load_strings(0,PKCS12_str_functs); - ERR_load_strings(0,PKCS12_str_reasons); - } -#endif + if (ERR_func_error_string(PKCS12_str_functs[0].error) == NULL) { + ERR_load_strings(0, PKCS12_str_functs); + ERR_load_strings(0, PKCS12_str_reasons); } +#endif +} diff --git a/src/lib/libssl/src/crypto/pkcs12/pkcs12.h b/src/lib/libssl/src/crypto/pkcs12/pkcs12.h index 5e61e4086c..ead29fd717 100644 --- a/src/lib/libssl/src/crypto/pkcs12/pkcs12.h +++ b/src/lib/libssl/src/crypto/pkcs12/pkcs12.h @@ -1,4 +1,4 @@ -/* $OpenBSD: pkcs12.h,v 1.12 2014/06/12 15:49:30 deraadt Exp $ */ +/* $OpenBSD: pkcs12.h,v 1.13 2014/07/08 09:27:21 jsing Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 1999. */ @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -97,27 +97,27 @@ extern "C" { #define KEY_SIG 0x80 typedef struct { -X509_SIG *dinfo; -ASN1_OCTET_STRING *salt; -ASN1_INTEGER *iter; /* defaults to 1 */ + X509_SIG *dinfo; + ASN1_OCTET_STRING *salt; + ASN1_INTEGER *iter; /* defaults to 1 */ } PKCS12_MAC_DATA; typedef struct { -ASN1_INTEGER *version; -PKCS12_MAC_DATA *mac; -PKCS7 *authsafes; + ASN1_INTEGER *version; + PKCS12_MAC_DATA *mac; + PKCS7 *authsafes; } PKCS12; typedef struct { -ASN1_OBJECT *type; -union { + ASN1_OBJECT *type; + union { struct pkcs12_bag_st *bag; /* secret, crl and certbag */ struct pkcs8_priv_key_info_st *keybag; /* keybag */ X509_SIG *shkeybag; /* shrouded key bag */ - STACK_OF(PKCS12_SAFEBAG) *safes; - ASN1_TYPE *other; -}value; -STACK_OF(X509_ATTRIBUTE) *attrib; + STACK_OF(PKCS12_SAFEBAG) *safes; + ASN1_TYPE *other; + } value; + STACK_OF(X509_ATTRIBUTE) *attrib; } PKCS12_SAFEBAG; DECLARE_STACK_OF(PKCS12_SAFEBAG) @@ -125,14 +125,14 @@ DECLARE_ASN1_SET_OF(PKCS12_SAFEBAG) DECLARE_PKCS12_STACK_OF(PKCS12_SAFEBAG) typedef struct pkcs12_bag_st { -ASN1_OBJECT *type; -union { - ASN1_OCTET_STRING *x509cert; - ASN1_OCTET_STRING *x509crl; - ASN1_OCTET_STRING *octet; - ASN1_IA5STRING *sdsicert; - ASN1_TYPE *other; /* Secret or other bag */ -}value; + ASN1_OBJECT *type; + union { + ASN1_OCTET_STRING *x509cert; + ASN1_OCTET_STRING *x509crl; + ASN1_OCTET_STRING *octet; + ASN1_IA5STRING *sdsicert; + ASN1_TYPE *other; /* Secret or other bag */ + } value; } PKCS12_BAGS; #define PKCS12_ERROR 0 @@ -144,7 +144,7 @@ union { #define M_PKCS12_x509crl2certbag PKCS12_x509crl2certbag #define M_PKCS12_certbag2x509 PKCS12_certbag2x509 -#define M_PKCS12_certbag2x509crl PKCS12_certbag2x509crl +#define M_PKCS12_certbag2x509crl PKCS12_certbag2x509crl #define M_PKCS12_unpack_p7data PKCS12_unpack_p7data #define M_PKCS12_pack_authsafes PKCS12_pack_authsafes @@ -172,65 +172,66 @@ PKCS12_SAFEBAG *PKCS12_x509crl2certbag(X509_CRL *crl); X509 *PKCS12_certbag2x509(PKCS12_SAFEBAG *bag); X509_CRL *PKCS12_certbag2x509crl(PKCS12_SAFEBAG *bag); -PKCS12_SAFEBAG *PKCS12_item_pack_safebag(void *obj, const ASN1_ITEM *it, int nid1, - int nid2); +PKCS12_SAFEBAG *PKCS12_item_pack_safebag(void *obj, const ASN1_ITEM *it, + int nid1, int nid2); PKCS12_SAFEBAG *PKCS12_MAKE_KEYBAG(PKCS8_PRIV_KEY_INFO *p8); PKCS8_PRIV_KEY_INFO *PKCS8_decrypt(X509_SIG *p8, const char *pass, int passlen); PKCS8_PRIV_KEY_INFO *PKCS12_decrypt_skey(PKCS12_SAFEBAG *bag, const char *pass, - int passlen); -X509_SIG *PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher, - const char *pass, int passlen, - unsigned char *salt, int saltlen, int iter, - PKCS8_PRIV_KEY_INFO *p8); + int passlen); +X509_SIG *PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher, + const char *pass, int passlen, unsigned char *salt, int saltlen, int iter, + PKCS8_PRIV_KEY_INFO *p8); PKCS12_SAFEBAG *PKCS12_MAKE_SHKEYBAG(int pbe_nid, const char *pass, - int passlen, unsigned char *salt, - int saltlen, int iter, - PKCS8_PRIV_KEY_INFO *p8); + int passlen, unsigned char *salt, int saltlen, int iter, + PKCS8_PRIV_KEY_INFO *p8); PKCS7 *PKCS12_pack_p7data(STACK_OF(PKCS12_SAFEBAG) *sk); STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_p7data(PKCS7 *p7); PKCS7 *PKCS12_pack_p7encdata(int pbe_nid, const char *pass, int passlen, - unsigned char *salt, int saltlen, int iter, - STACK_OF(PKCS12_SAFEBAG) *bags); -STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_p7encdata(PKCS7 *p7, const char *pass, int passlen); + unsigned char *salt, int saltlen, int iter, STACK_OF(PKCS12_SAFEBAG) *bags); +STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_p7encdata(PKCS7 *p7, const char *pass, + int passlen); int PKCS12_pack_authsafes(PKCS12 *p12, STACK_OF(PKCS7) *safes); STACK_OF(PKCS7) *PKCS12_unpack_authsafes(PKCS12 *p12); -int PKCS12_add_localkeyid(PKCS12_SAFEBAG *bag, unsigned char *name, int namelen); +int PKCS12_add_localkeyid(PKCS12_SAFEBAG *bag, unsigned char *name, + int namelen); int PKCS12_add_friendlyname_asc(PKCS12_SAFEBAG *bag, const char *name, - int namelen); + int namelen); int PKCS12_add_CSPName_asc(PKCS12_SAFEBAG *bag, const char *name, - int namelen); + int namelen); int PKCS12_add_friendlyname_uni(PKCS12_SAFEBAG *bag, const unsigned char *name, - int namelen); + int namelen); int PKCS8_add_keyusage(PKCS8_PRIV_KEY_INFO *p8, int usage); ASN1_TYPE *PKCS12_get_attr_gen(STACK_OF(X509_ATTRIBUTE) *attrs, int attr_nid); char *PKCS12_get_friendlyname(PKCS12_SAFEBAG *bag); unsigned char *PKCS12_pbe_crypt(X509_ALGOR *algor, const char *pass, - int passlen, unsigned char *in, int inlen, - unsigned char **data, int *datalen, int en_de); + int passlen, unsigned char *in, int inlen, unsigned char **data, + int *datalen, int en_de); void * PKCS12_item_decrypt_d2i(X509_ALGOR *algor, const ASN1_ITEM *it, - const char *pass, int passlen, ASN1_OCTET_STRING *oct, int zbuf); -ASN1_OCTET_STRING *PKCS12_item_i2d_encrypt(X509_ALGOR *algor, const ASN1_ITEM *it, - const char *pass, int passlen, - void *obj, int zbuf); + const char *pass, int passlen, ASN1_OCTET_STRING *oct, int zbuf); +ASN1_OCTET_STRING *PKCS12_item_i2d_encrypt(X509_ALGOR *algor, + const ASN1_ITEM *it, const char *pass, int passlen, void *obj, int zbuf); PKCS12 *PKCS12_init(int mode); int PKCS12_key_gen_asc(const char *pass, int passlen, unsigned char *salt, - int saltlen, int id, int iter, int n, - unsigned char *out, const EVP_MD *md_type); -int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, int saltlen, int id, int iter, int n, unsigned char *out, const EVP_MD *md_type); + int saltlen, int id, int iter, int n, unsigned char *out, + const EVP_MD *md_type); +int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, + int saltlen, int id, int iter, int n, unsigned char *out, + const EVP_MD *md_type); int PKCS12_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen, - ASN1_TYPE *param, const EVP_CIPHER *cipher, const EVP_MD *md_type, - int en_de); + ASN1_TYPE *param, const EVP_CIPHER *cipher, const EVP_MD *md_type, + int en_de); int PKCS12_gen_mac(PKCS12 *p12, const char *pass, int passlen, - unsigned char *mac, unsigned int *maclen); + unsigned char *mac, unsigned int *maclen); int PKCS12_verify_mac(PKCS12 *p12, const char *pass, int passlen); int PKCS12_set_mac(PKCS12 *p12, const char *pass, int passlen, - unsigned char *salt, int saltlen, int iter, - const EVP_MD *md_type); + unsigned char *salt, int saltlen, int iter, + const EVP_MD *md_type); int PKCS12_setup_mac(PKCS12 *p12, int iter, unsigned char *salt, - int saltlen, const EVP_MD *md_type); -unsigned char *OPENSSL_asc2uni(const char *asc, int asclen, unsigned char **uni, int *unilen); + int saltlen, const EVP_MD *md_type); +unsigned char *OPENSSL_asc2uni(const char *asc, int asclen, + unsigned char **uni, int *unilen); char *OPENSSL_uni2asc(unsigned char *uni, int unilen); DECLARE_ASN1_FUNCTIONS(PKCS12) @@ -243,17 +244,16 @@ DECLARE_ASN1_ITEM(PKCS12_AUTHSAFES) void PKCS12_PBE_add(void); int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert, - STACK_OF(X509) **ca); + STACK_OF(X509) **ca); PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert, - STACK_OF(X509) *ca, int nid_key, int nid_cert, int iter, - int mac_iter, int keytype); + STACK_OF(X509) *ca, int nid_key, int nid_cert, int iter, + int mac_iter, int keytype); PKCS12_SAFEBAG *PKCS12_add_cert(STACK_OF(PKCS12_SAFEBAG) **pbags, X509 *cert); PKCS12_SAFEBAG *PKCS12_add_key(STACK_OF(PKCS12_SAFEBAG) **pbags, EVP_PKEY *key, - int key_usage, int iter, - int key_nid, char *pass); + int key_usage, int iter, int key_nid, char *pass); int PKCS12_add_safe(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags, - int safe_nid, int iter, char *pass); + int safe_nid, int iter, char *pass); PKCS12 *PKCS12_add_safes(STACK_OF(PKCS7) *safes, int p7_nid); int i2d_PKCS12_bio(BIO *bp, PKCS12 *p12); -- cgit v1.2.3-55-g6feb