ks_file.c revision 178826 
1/*
2 * Copyright (c) 2005 - 2007 Kungliga Tekniska H�gskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * 3. Neither the name of the Institute nor the names of its contributors
18 *    may be used to endorse or promote products derived from this software
19 *    without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34#include "hx_locl.h"
35RCSID("$Id: ks_file.c 22465 2008-01-16 14:25:24Z lha $");
36
37typedef enum { USE_PEM, USE_DER } outformat;
38
39struct ks_file {
40    hx509_certs certs;
41    char *fn;
42    outformat format;
43};
44
45/*
46 *
47 */
48
49static int
50parse_certificate(hx509_context context, const char *fn,
51		  struct hx509_collector *c,
52		  const hx509_pem_header *headers,
53		  const void *data, size_t len)
54{
55    hx509_cert cert;
56    int ret;
57
58    ret = hx509_cert_init_data(context, data, len, &cert);
59    if (ret)
60	return ret;
61
62    ret = _hx509_collector_certs_add(context, c, cert);
63    hx509_cert_free(cert);
64    return ret;
65}
66
67static int
68try_decrypt(hx509_context context,
69	    struct hx509_collector *collector,
70	    const AlgorithmIdentifier *alg,
71	    const EVP_CIPHER *c,
72	    const void *ivdata,
73	    const void *password,
74	    size_t passwordlen,
75	    const void *cipher,
76	    size_t len)
77{
78    heim_octet_string clear;
79    size_t keylen;
80    void *key;
81    int ret;
82
83    keylen = EVP_CIPHER_key_length(c);
84
85    key = malloc(keylen);
86    if (key == NULL) {
87	hx509_clear_error_string(context);
88	return ENOMEM;
89    }
90
91    ret = EVP_BytesToKey(c, EVP_md5(), ivdata,
92			 password, passwordlen,
93			 1, key, NULL);
94    if (ret <= 0) {
95	hx509_set_error_string(context, 0, HX509_CRYPTO_INTERNAL_ERROR,
96			       "Failed to do string2key for private key");
97	return HX509_CRYPTO_INTERNAL_ERROR;
98    }
99
100    clear.data = malloc(len);
101    if (clear.data == NULL) {
102	hx509_set_error_string(context, 0, ENOMEM,
103			       "Out of memory to decrypt for private key");
104	ret = ENOMEM;
105	goto out;
106    }
107    clear.length = len;
108
109    {
110	EVP_CIPHER_CTX ctx;
111	EVP_CIPHER_CTX_init(&ctx);
112	EVP_CipherInit_ex(&ctx, c, NULL, key, ivdata, 0);
113	EVP_Cipher(&ctx, clear.data, cipher, len);
114	EVP_CIPHER_CTX_cleanup(&ctx);
115    }
116
117    ret = _hx509_collector_private_key_add(context,
118					   collector,
119					   alg,
120					   NULL,
121					   &clear,
122					   NULL);
123
124    memset(clear.data, 0, clear.length);
125    free(clear.data);
126out:
127    memset(key, 0, keylen);
128    free(key);
129    return ret;
130}
131
132static int
133parse_rsa_private_key(hx509_context context, const char *fn,
134		      struct hx509_collector *c,
135		      const hx509_pem_header *headers,
136		      const void *data, size_t len)
137{
138    int ret = 0;
139    const char *enc;
140
141    enc = hx509_pem_find_header(headers, "Proc-Type");
142    if (enc) {
143	const char *dek;
144	char *type, *iv;
145	ssize_t ssize, size;
146	void *ivdata;
147	const EVP_CIPHER *cipher;
148	const struct _hx509_password *pw;
149	hx509_lock lock;
150	int i, decrypted = 0;
151
152	lock = _hx509_collector_get_lock(c);
153	if (lock == NULL) {
154	    hx509_set_error_string(context, 0, HX509_ALG_NOT_SUPP,
155				   "Failed to get password for "
156				   "password protected file %s", fn);
157	    return HX509_ALG_NOT_SUPP;
158	}
159
160	if (strcmp(enc, "4,ENCRYPTED") != 0) {
161	    hx509_set_error_string(context, 0, HX509_PARSING_KEY_FAILED,
162				   "RSA key encrypted in unknown method %s "
163				   "in file",
164				   enc, fn);
165	    hx509_clear_error_string(context);
166	    return HX509_PARSING_KEY_FAILED;
167	}
168
169	dek = hx509_pem_find_header(headers, "DEK-Info");
170	if (dek == NULL) {
171	    hx509_set_error_string(context, 0, HX509_PARSING_KEY_FAILED,
172				   "Encrypted RSA missing DEK-Info");
173	    return HX509_PARSING_KEY_FAILED;
174	}
175
176	type = strdup(dek);
177	if (type == NULL) {
178	    hx509_clear_error_string(context);
179	    return ENOMEM;
180	}
181
182	iv = strchr(type, ',');
183	if (iv == NULL) {
184	    free(type);
185	    hx509_set_error_string(context, 0, HX509_PARSING_KEY_FAILED,
186				   "IV missing");
187	    return HX509_PARSING_KEY_FAILED;
188	}
189
190	*iv++ = '\0';
191
192	size = strlen(iv);
193	ivdata = malloc(size);
194	if (ivdata == NULL) {
195	    hx509_clear_error_string(context);
196	    free(type);
197	    return ENOMEM;
198	}
199
200	cipher = EVP_get_cipherbyname(type);
201	if (cipher == NULL) {
202	    free(ivdata);
203	    hx509_set_error_string(context, 0, HX509_ALG_NOT_SUPP,
204				   "RSA key encrypted with "
205				   "unsupported cipher: %s",
206				   type);
207	    free(type);
208	    return HX509_ALG_NOT_SUPP;
209	}
210
211#define PKCS5_SALT_LEN 8
212
213	ssize = hex_decode(iv, ivdata, size);
214	free(type);
215	type = NULL;
216	iv = NULL;
217
218	if (ssize < 0 || ssize < PKCS5_SALT_LEN || ssize < EVP_CIPHER_iv_length(cipher)) {
219	    free(ivdata);
220	    hx509_set_error_string(context, 0, HX509_PARSING_KEY_FAILED,
221				   "Salt have wrong length in RSA key file");
222	    return HX509_PARSING_KEY_FAILED;
223	}
224
225	pw = _hx509_lock_get_passwords(lock);
226	if (pw != NULL) {
227	    const void *password;
228	    size_t passwordlen;
229
230	    for (i = 0; i < pw->len; i++) {
231		password = pw->val[i];
232		passwordlen = strlen(password);
233
234		ret = try_decrypt(context, c, hx509_signature_rsa(),
235				  cipher, ivdata, password, passwordlen,
236				  data, len);
237		if (ret == 0) {
238		    decrypted = 1;
239		    break;
240		}
241	    }
242	}
243	if (!decrypted) {
244	    hx509_prompt prompt;
245	    char password[128];
246
247	    memset(&prompt, 0, sizeof(prompt));
248
249	    prompt.prompt = "Password for keyfile: ";
250	    prompt.type = HX509_PROMPT_TYPE_PASSWORD;
251	    prompt.reply.data = password;
252	    prompt.reply.length = sizeof(password);
253
254	    ret = hx509_lock_prompt(lock, &prompt);
255	    if (ret == 0)
256		ret = try_decrypt(context, c, hx509_signature_rsa(),
257				  cipher, ivdata, password, strlen(password),
258				  data, len);
259	    /* XXX add password to lock password collection ? */
260	    memset(password, 0, sizeof(password));
261	}
262	free(ivdata);
263
264    } else {
265	heim_octet_string keydata;
266
267	keydata.data = rk_UNCONST(data);
268	keydata.length = len;
269
270	ret = _hx509_collector_private_key_add(context,
271					       c,
272					       hx509_signature_rsa(),
273					       NULL,
274					       &keydata,
275					       NULL);
276    }
277
278    return ret;
279}
280
281
282struct pem_formats {
283    const char *name;
284    int (*func)(hx509_context, const char *, struct hx509_collector *,
285		const hx509_pem_header *, const void *, size_t);
286} formats[] = {
287    { "CERTIFICATE", parse_certificate },
288    { "RSA PRIVATE KEY", parse_rsa_private_key }
289};
290
291
292struct pem_ctx {
293    int flags;
294    struct hx509_collector *c;
295};
296
297static int
298pem_func(hx509_context context, const char *type,
299	 const hx509_pem_header *header,
300	 const void *data, size_t len, void *ctx)
301{
302    struct pem_ctx *pem_ctx = (struct pem_ctx*)ctx;
303    int ret = 0, j;
304
305    for (j = 0; j < sizeof(formats)/sizeof(formats[0]); j++) {
306	const char *q = formats[j].name;
307	if (strcasecmp(type, q) == 0) {
308	    ret = (*formats[j].func)(context, NULL, pem_ctx->c,  header, data, len);
309	    if (ret == 0)
310		break;
311	}
312    }
313    if (j == sizeof(formats)/sizeof(formats[0])) {
314	ret = HX509_UNSUPPORTED_OPERATION;
315	hx509_set_error_string(context, 0, ret,
316			       "Found no matching PEM format for %s", type);
317	return ret;
318    }
319    if (ret && (pem_ctx->flags & HX509_CERTS_UNPROTECT_ALL))
320	return ret;
321    return 0;
322}
323
324/*
325 *
326 */
327
328static int
329file_init_common(hx509_context context,
330		 hx509_certs certs, void **data, int flags,
331		 const char *residue, hx509_lock lock, outformat format)
332{
333    char *p, *pnext;
334    struct ks_file *f = NULL;
335    hx509_private_key *keys = NULL;
336    int ret;
337    struct pem_ctx pem_ctx;
338
339    pem_ctx.flags = flags;
340    pem_ctx.c = NULL;
341
342    *data = NULL;
343
344    if (lock == NULL)
345	lock = _hx509_empty_lock;
346
347    f = calloc(1, sizeof(*f));
348    if (f == NULL) {
349	hx509_clear_error_string(context);
350	return ENOMEM;
351    }
352    f->format = format;
353
354    f->fn = strdup(residue);
355    if (f->fn == NULL) {
356	hx509_clear_error_string(context);
357	ret = ENOMEM;
358	goto out;
359    }
360
361    /*
362     * XXX this is broken, the function should parse the file before
363     * overwriting it
364     */
365
366    if (flags & HX509_CERTS_CREATE) {
367	ret = hx509_certs_init(context, "MEMORY:ks-file-create",
368			       0, lock, &f->certs);
369	if (ret)
370	    goto out;
371	*data = f;
372	return 0;
373    }
374
375    ret = _hx509_collector_alloc(context, lock, &pem_ctx.c);
376    if (ret)
377	goto out;
378
379    for (p = f->fn; p != NULL; p = pnext) {
380	FILE *f;
381
382	pnext = strchr(p, ',');
383	if (pnext)
384	    *pnext++ = '\0';
385
386
387	if ((f = fopen(p, "r")) == NULL) {
388	    ret = ENOENT;
389	    hx509_set_error_string(context, 0, ret,
390				   "Failed to open PEM file \"%s\": %s",
391				   p, strerror(errno));
392	    goto out;
393	}
394
395	ret = hx509_pem_read(context, f, pem_func, &pem_ctx);
396	fclose(f);
397	if (ret != 0 && ret != HX509_PARSING_KEY_FAILED)
398	    goto out;
399	else if (ret == HX509_PARSING_KEY_FAILED) {
400	    size_t length;
401	    void *ptr;
402	    int i;
403
404	    ret = _hx509_map_file(p, &ptr, &length, NULL);
405	    if (ret) {
406		hx509_clear_error_string(context);
407		goto out;
408	    }
409
410	    for (i = 0; i < sizeof(formats)/sizeof(formats[0]); i++) {
411		ret = (*formats[i].func)(context, p, pem_ctx.c, NULL, ptr, length);
412		if (ret == 0)
413		    break;
414	    }
415	    _hx509_unmap_file(ptr, length);
416	    if (ret)
417		goto out;
418	}
419    }
420
421    ret = _hx509_collector_collect_certs(context, pem_ctx.c, &f->certs);
422    if (ret)
423	goto out;
424
425    ret = _hx509_collector_collect_private_keys(context, pem_ctx.c, &keys);
426    if (ret == 0) {
427	int i;
428
429	for (i = 0; keys[i]; i++)
430	    _hx509_certs_keys_add(context, f->certs, keys[i]);
431	_hx509_certs_keys_free(context, keys);
432    }
433
434out:
435    if (ret == 0)
436	*data = f;
437    else {
438	if (f->fn)
439	    free(f->fn);
440	free(f);
441    }
442    if (pem_ctx.c)
443	_hx509_collector_free(pem_ctx.c);
444
445    return ret;
446}
447
448static int
449file_init_pem(hx509_context context,
450	      hx509_certs certs, void **data, int flags,
451	      const char *residue, hx509_lock lock)
452{
453    return file_init_common(context, certs, data, flags, residue, lock, USE_PEM);
454}
455
456static int
457file_init_der(hx509_context context,
458	      hx509_certs certs, void **data, int flags,
459	      const char *residue, hx509_lock lock)
460{
461    return file_init_common(context, certs, data, flags, residue, lock, USE_DER);
462}
463
464static int
465file_free(hx509_certs certs, void *data)
466{
467    struct ks_file *f = data;
468    hx509_certs_free(&f->certs);
469    free(f->fn);
470    free(f);
471    return 0;
472}
473
474struct store_ctx {
475    FILE *f;
476    outformat format;
477};
478
479static int
480store_func(hx509_context context, void *ctx, hx509_cert c)
481{
482    struct store_ctx *sc = ctx;
483    heim_octet_string data;
484    int ret;
485
486    ret = hx509_cert_binary(context, c, &data);
487    if (ret)
488	return ret;
489
490    switch (sc->format) {
491    case USE_DER:
492	fwrite(data.data, data.length, 1, sc->f);
493	free(data.data);
494	break;
495    case USE_PEM:
496	hx509_pem_write(context, "CERTIFICATE", NULL, sc->f,
497			data.data, data.length);
498	free(data.data);
499	if (_hx509_cert_private_key_exportable(c)) {
500	    hx509_private_key key = _hx509_cert_private_key(c);
501	    ret = _hx509_private_key_export(context, key, &data);
502	    if (ret)
503		break;
504	    hx509_pem_write(context, _hx509_private_pem_name(key), NULL, sc->f,
505			    data.data, data.length);
506	    free(data.data);
507	}
508	break;
509    }
510
511    return 0;
512}
513
514static int
515file_store(hx509_context context,
516	   hx509_certs certs, void *data, int flags, hx509_lock lock)
517{
518    struct ks_file *f = data;
519    struct store_ctx sc;
520    int ret;
521
522    sc.f = fopen(f->fn, "w");
523    if (sc.f == NULL) {
524	hx509_set_error_string(context, 0, ENOENT,
525			       "Failed to open file %s for writing");
526	return ENOENT;
527    }
528    sc.format = f->format;
529
530    ret = hx509_certs_iter(context, f->certs, store_func, &sc);
531    fclose(sc.f);
532    return ret;
533}
534
535static int
536file_add(hx509_context context, hx509_certs certs, void *data, hx509_cert c)
537{
538    struct ks_file *f = data;
539    return hx509_certs_add(context, f->certs, c);
540}
541
542static int
543file_iter_start(hx509_context context,
544		hx509_certs certs, void *data, void **cursor)
545{
546    struct ks_file *f = data;
547    return hx509_certs_start_seq(context, f->certs, cursor);
548}
549
550static int
551file_iter(hx509_context context,
552	  hx509_certs certs, void *data, void *iter, hx509_cert *cert)
553{
554    struct ks_file *f = data;
555    return hx509_certs_next_cert(context, f->certs, iter, cert);
556}
557
558static int
559file_iter_end(hx509_context context,
560	      hx509_certs certs,
561	      void *data,
562	      void *cursor)
563{
564    struct ks_file *f = data;
565    return hx509_certs_end_seq(context, f->certs, cursor);
566}
567
568static int
569file_getkeys(hx509_context context,
570	     hx509_certs certs,
571	     void *data,
572	     hx509_private_key **keys)
573{
574    struct ks_file *f = data;
575    return _hx509_certs_keys_get(context, f->certs, keys);
576}
577
578static int
579file_addkey(hx509_context context,
580	     hx509_certs certs,
581	     void *data,
582	     hx509_private_key key)
583{
584    struct ks_file *f = data;
585    return _hx509_certs_keys_add(context, f->certs, key);
586}
587
588static struct hx509_keyset_ops keyset_file = {
589    "FILE",
590    0,
591    file_init_pem,
592    file_store,
593    file_free,
594    file_add,
595    NULL,
596    file_iter_start,
597    file_iter,
598    file_iter_end,
599    NULL,
600    file_getkeys,
601    file_addkey
602};
603
604static struct hx509_keyset_ops keyset_pemfile = {
605    "PEM-FILE",
606    0,
607    file_init_pem,
608    file_store,
609    file_free,
610    file_add,
611    NULL,
612    file_iter_start,
613    file_iter,
614    file_iter_end,
615    NULL,
616    file_getkeys,
617    file_addkey
618};
619
620static struct hx509_keyset_ops keyset_derfile = {
621    "DER-FILE",
622    0,
623    file_init_der,
624    file_store,
625    file_free,
626    file_add,
627    NULL,
628    file_iter_start,
629    file_iter,
630    file_iter_end,
631    NULL,
632    file_getkeys,
633    file_addkey
634};
635
636
637void
638_hx509_ks_file_register(hx509_context context)
639{
640    _hx509_ks_register(context, &keyset_file);
641    _hx509_ks_register(context, &keyset_pemfile);
642    _hx509_ks_register(context, &keyset_derfile);
643}
644