path: root/usr/src/common/net/wanboot/p12access.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * This file includes interfaces to be used together with SSL to get PKCS#12
 * certs and pass them to SSL.  They replace similar functions for PEM,
 * already provided for within SSL.
 *
 * The interfaces included here are:
 *   sunw_p12_use_certfile - gets the user's cert from a pkcs12 file & pass
 *                it to SSL.
 *   sunw_p12_use_keyfile - gets the RSA private key from a pkcs12 file and
 *                pass it to SSL
 *   sunw_p12_use_trustfile - read the pkcs12 trust anchor (aka certificate
 *                authority certs) file into memory and hand them off to SSL.
 *
 * These functions use the sunw_PKCS12_parse to read the certs.
 *
 * Copyright 2002-2003 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#pragma ident	"%Z%%M%	%I%	%E% SMI"

#include <stdio.h>
#include <strings.h>
#include <stdlib.h>
#include <sys/stat.h>
#include <unistd.h>

#include <openssl/crypto.h>
#include <openssl/err.h>
#include <openssl/x509.h>
#include <openssl/ssl.h>

#include <openssl/pkcs12.h>
#include <p12access.h>
#include <p12err.h>

static PKCS12 *p12_read_file(char *);
static int p12_doparse(PKCS12 *, char *, int, EVP_PKEY **,
    X509 **, STACK_OF(X509) **);
static int checkfile(char *);
static int check_password(PKCS12 *, char *);

/*
 * sunw_use_x509cert - pass an x509 client certificate to ssl
 *
 * Arguments:
 *   ctx        - SSL's context structure
 *   cert	- Certificate to pass in x509 format
 *
 * Returns:
 *   <=0 	- Error occurred.  Check the error stack for specifics.
 *   >0         - Success.  Cert was successfully added.
 */
static int
sunw_use_x509cert(SSL_CTX *ctx, X509 *cert)
{
	ERR_clear_error();

	if (ctx == NULL || cert == NULL) {
		SUNWerr(SUNW_F_USE_X509CERT, SUNW_R_INVALID_ARG);
		return (-1);
	}

	if (SSL_CTX_use_certificate(ctx, cert) != 1) {
		SUNWerr(SUNW_F_USE_X509CERT, SUNW_R_CERT_ERR);
		return (-1);
	}
	return (1);
}

/*
 * sunw_use_pkey - pass an EVP_PKEY private key to ssl
 *
 * Arguments:
 *   ctx        - SSL's context structure
 *   pkey	- EVP_PKEY formatted private key
 *
 * Returns:
 *   <=0 	- Error occurred.  Check the error stack for specifics.
 *   >0         - Success.
 */
static int
sunw_use_pkey(SSL_CTX *ctx, EVP_PKEY *pkey)
{
	ERR_clear_error();
	if (ctx == NULL || pkey == NULL) {
		SUNWerr(SUNW_F_USE_PKEY, SUNW_R_INVALID_ARG);
		return (-1);
	}

	if (SSL_CTX_use_PrivateKey(ctx, pkey) != 1) {
		SUNWerr(SUNW_F_USE_PKEY, SUNW_R_PKEY_ERR);
		return (-1);
	}

	return (1);
}

/*
 * sunw_use_tastore - take a stack of X509 certs and add them to the
 *              SSL store of trust anchors (aka CA certs).
 *
 * This function takes the certs in the stack and passes them into
 * SSL for addition to the cache of TA certs.
 *
 * Arguments:
 *   ctx        - SSL's context structure
 *   ta_certs   - Stack of certs to add to the list of SSL trust anchors.
 *
 * Returns:
 *   <=0 	- Error occurred.  Check the error stack for specifics.
 *   >0         - Success.  Certs were successfully added.
 */
static int
sunw_use_tastore(SSL_CTX *ctx, STACK_OF(X509) *ta_certs)
{
	X509 *tmp;
	int ret = -1;
	int i;

	ERR_clear_error();
	if (ctx == NULL || ctx->cert_store == NULL || ta_certs == NULL) {
		SUNWerr(SUNW_F_USE_TASTORE, SUNW_R_INVALID_ARG);
		return (-1);
	}

	if (sk_X509_num(ta_certs) == 0) {
		SUNWerr(SUNW_F_USE_TASTORE, SUNW_R_NO_TRUST_ANCHOR);
		return (-1);
	}

	for (i = 0; i < sk_X509_num(ta_certs); i++) {
		tmp = sk_X509_value(ta_certs, i);

		ret = X509_STORE_add_cert(ctx->cert_store, tmp);
		if (ret == 0) {
			if (ERR_GET_REASON(ERR_peek_error()) ==
					X509_R_CERT_ALREADY_IN_HASH_TABLE) {
				ERR_clear_error();
				continue;
			}
			SUNWerr(SUNW_F_USE_TASTORE, SUNW_R_ADD_TRUST_ERR);
			return (-1);
		} else if (ret < 0) {
			break;
		}
	}

	if (ret < 0) {
		SUNWerr(SUNW_F_USE_TASTORE, SUNW_R_ADD_TRUST_ERR);
	}

	return (ret);
}

/*
 * sunw_p12_use_certfile - read a client certificate from a pkcs12 file and
 *              pass it in to SSL.
 *
 * Read in the certificate in pkcs12-formated file.  Use the provided
 * passphrase to decrypt it. Pass the cert to SSL.
 *
 * Arguments:
 *   ctx        - SSL's context structure
 *   filename	- Name of file with the client certificate.
 *   passwd     - Passphrase for pkcs12 data.
 *
 * Returns:
 *   <=0 	- Error occurred.  Check the error stack for specifics.
 *   >0         - Success.  Cert was successfully added.
 */
int
sunw_p12_use_certfile(SSL_CTX *ctx, char *filename, char *passwd)
{
	PKCS12 *p12 = NULL;
	X509 *cert = NULL;
	int ret = -1;

	ERR_clear_error();
	if (ctx == NULL || filename == NULL) {
		SUNWerr(SUNW_F_USE_CERTFILE, SUNW_R_INVALID_ARG);
		return (-1);
	}

	p12 = p12_read_file(filename);
	if (p12 != NULL) {
		ret = p12_doparse(p12, passwd, DO_UNMATCHING, NULL,
		    &cert, NULL);
		if (ret > 0 && cert != NULL) {
			if (sunw_use_x509cert(ctx, cert) == -1) {
				/*
				 * Error already on stack
				 */
				ret = -1;
			}
		}
	}

	if (p12 != NULL)
		PKCS12_free(p12);

	if (ret == -1 && cert != NULL) {
		X509_free(cert);
		cert = NULL;
	}

	return (ret);
}

/*
 * sunw_p12_use_keyfile - read a RSA private key from a pkcs12 file and pass
 *              it in to SSL.
 *
 * Read in the RSA private key in pkcs12 format. Use the provided
 * passphrase to decrypt it. Pass the cert to SSL.
 *
 * Arguments:
 *   ctx        - SSL's context structure
 *   filename	- Name of file with private key.
 *   passwd     - Passphrase for pkcs12 data.
 *
 * Returns:
 *   <=0 	- Error occurred.  Check the error stack for specifics.
 *   >0         - Success.  Key was successfully added.
 */
int
sunw_p12_use_keyfile(SSL_CTX *ctx, char *filename, char *passwd)
{
	EVP_PKEY *pkey = NULL;
	PKCS12 *p12 = NULL;
	int ret = -1;

	ERR_clear_error();
	if (ctx == NULL || filename == NULL) {
		SUNWerr(SUNW_F_USE_KEYFILE, SUNW_R_INVALID_ARG);
		return (-1);
	}

	p12 = p12_read_file(filename);
	if (p12 != NULL) {
		ret = p12_doparse(p12, passwd, DO_UNMATCHING, &pkey, NULL,
		    NULL);
		if (ret > 0 && pkey != NULL) {
			if (sunw_use_pkey(ctx, pkey) != 1) {
				/*
				 * Error already on stack
				 */
				ret = -1;
			}
		} else {
			SUNWerr(SUNW_F_USE_KEYFILE, SUNW_R_BAD_PKEY);
		}
	} else {
		SUNWerr(SUNW_F_USE_KEYFILE, SUNW_R_PKEY_READ_ERR);
	}

	if (p12 != NULL)
		PKCS12_free(p12);

	if (ret == -1 && pkey != NULL) {
		sunw_evp_pkey_free(pkey);
		pkey = NULL;
	}

	return (ret);
}

/*
 * sunw_p12_use_trustfile - read a list of trustanchors from a pkcs12 file and
 *              pass the stack in to SSL.
 *
 * Read in the trust anchors from pkcs12-formated file. Use the provided
 * passphrase to decrypt it. Pass the cert to SSL.
 *
 * Arguments:
 *   ctx        - SSL's context structure
 *   filename	- Name of file with the certificates.
 *   passwd     - Passphrase for pkcs12 data.
 *
 * Returns:
 *   <=0 	- Error occurred.  Check the error stack for specifics.
 *   >0         - Success.  Trust anchors were successfully added.
 */
int
sunw_p12_use_trustfile(SSL_CTX *ctx, char *filename, char *passwd)
{
	PKCS12 *p12 = NULL;
	STACK_OF(X509) *ta_sk = NULL;
	int ret = -1;

	ERR_clear_error();
	if (ctx == NULL || filename == NULL) {
		SUNWerr(SUNW_F_USE_TRUSTFILE, SUNW_R_INVALID_ARG);
		return (-1);
	}

	p12 = p12_read_file(filename);
	if (p12 != NULL) {
		ret = p12_doparse(p12, passwd, DO_NONE, NULL, NULL,
		    &ta_sk);
		if (ret > 0 && ta_sk != NULL)
			ret = sunw_use_tastore(ctx, ta_sk);
		else {
			SUNWerr(SUNW_F_USE_TRUSTFILE, SUNW_R_BAD_TRUST);
			ret = -1;
		}
	} else {
		SUNWerr(SUNW_F_USE_TRUSTFILE, SUNW_R_READ_TRUST_ERR);
	}

	if (p12 != NULL)
		PKCS12_free(p12);

	if (ta_sk != NULL)
		sk_X509_pop_free(ta_sk, X509_free);

	return (ret);
}

/*
 * p12_read_file - read a pkcs12 file and get its contents.  Return the
 *                 pkcs12 structures.
 *
 * Arguments:
 *   filename	- Name of file with the client certificate.
 *
 *
 * Returns:
 *   NULL 	- Error occurred.  Check the error stack for specifics.
 *   != NULL	- Success.  The return value is the address of a pkcs12
 *                structure.
 */
static PKCS12 *
p12_read_file(char *filename)
{
	PKCS12 *p12 = NULL;
	FILE *fp = NULL;
	int ret = 0;

	ERR_clear_error();
	if (checkfile(filename) == -1) {
		/*
		 * Error already on stack
		 */
		return (NULL);
	}

	if ((fp = fopen(filename, "r")) == 0) {
		SYSerr(SYS_F_FOPEN, errno);
		return (NULL);
	}

	p12 = d2i_PKCS12_fp(fp, NULL);
	if (p12 == NULL) {
		SUNWerr(SUNW_F_READ_FILE, SUNW_R_READ_ERR);
		ret = -1;
	}

	if (fp != NULL)
		(void) fclose(fp);

	if (ret == -1 && p12 != NULL) {
		PKCS12_free(p12);
		p12 = NULL;
	}

	return (p12);
}

/*
 * p12_doparse - Given a pkcs12 structure, check the passphrase and then
 *               parse it.
 *
 * Arguments:
 *   p12	- Structure with pkcs12 data which has been read in
 *   passwd     - Passphrase for pkcs12 data & key.
 *   matchty    - How to decide which matching entry to take... See the
 *                DO_* definitions for valid values.
 *   pkey       - Points at pointer to private key structure.
 *   cert       - Points at pointer to client certificate structure
 *   ca         - Points at pointer to list of CA certs
 *
 * Returns:
 *   <=0 	- Error occurred.  Check the error stack for specifics.
 *   >0         - Success.  Bits set reflect the kind of information
 *                returned.  (See the FOUND_* definitions.)
 */
static int
p12_doparse(PKCS12 *p12, char *passwd, int matchty,
    EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca)
{
	int ret = 0;

	ERR_clear_error();

	/*
	 * Check passphrase (including null one).
	 */
	if (check_password(p12, passwd) == 0)  {
		SUNWerr(SUNW_F_DOPARSE, SUNW_R_MAC_VERIFY_FAILURE);
		return (-1);
	}

	ret = sunw_PKCS12_parse(p12, passwd, matchty, NULL, 0, NULL,
	    pkey, cert, ca);
	if (ret <= 0) {
		/*
		 * Error already on stack
		 */
		return (-1);
	}

	return (ret);
}

/*
 * checkfile - given a file name, verify that the file exists and is
 *             readable.
 */
/* ARGSUSED */
static int
checkfile(char *filename)
{
#ifndef _BOOT
	struct stat sbuf;

	if (access(filename, R_OK) == -1 || stat(filename, &sbuf) == -1) {
		SYSerr(SYS_F_FOPEN, errno);
		return (-1);
	}

	if (!S_ISREG(sbuf.st_mode)) {
		SUNWerr(SUNW_F_CHECKFILE, SUNW_R_BAD_FILETYPE);
		return (-1);
	}
#endif
	return (0);
}

/*
 * check_password - do various password checks to see if the current password
 *                  will work or we need to prompt for a new one.
 *
 * Arguments:
 *   pass   - password to check
 *
 * Returns:
 *   1      - Password is OK.
 *   0      - Password not valid.  Error stack was set - use ERR_get_error() to
 *            to get the error.
 */
static int
check_password(PKCS12 *p12, char *pass)
{
	int ret = 1;

	/*
	 * If password is zero length or NULL then try verifying both cases
	 * to determine which password is correct. The reason for this is that
	 * under PKCS#12 password based encryption no password and a zero
	 * length password are two different things.  Otherwise, calling
	 * PKCS12_verify_mac() with a length of -1 means that the length
	 * can be determined via strlen().
	 */
	/* Check the mac */
	if (pass == NULL || *pass == '\0') {
		if (PKCS12_verify_mac(p12, NULL, 0) == 0 &&
		    PKCS12_verify_mac(p12, "", 0) == 0)
			ret = 0;
	} else if (PKCS12_verify_mac(p12, pass, -1) == 0) {
		ret = 0;
	}

	return (ret);
}