1 /* $OpenBSD: tls_keypair.c,v 1.8 2021/01/05 17:37:12 jsing Exp $ */
2 /*
3  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include "config.h"
19 
20 #include <openssl/bio.h>
21 #include <openssl/err.h>
22 #include <openssl/pem.h>
23 
24 #include <tls.h>
25 
26 #include "tls_internal.h"
27 
28 struct tls_keypair *
29 tls_keypair_new(void)
30 {
31 	return calloc(1, sizeof(struct tls_keypair));
32 }
33 
34 static int
35 tls_keypair_pubkey_hash(struct tls_keypair *keypair, struct tls_error *error)
36 {
37 	X509 *cert = NULL;
38 	int rv = -1;
39 
40 	free(keypair->pubkey_hash);
41 	keypair->pubkey_hash = NULL;
42 
43 	if (keypair->cert_mem == NULL) {
44 		rv = 0;
45 		goto done;
46 	}
47 
48 	if (tls_keypair_load_cert(keypair, error, &cert) == -1)
49 		goto err;
50 	if (tls_cert_pubkey_hash(cert, &keypair->pubkey_hash) == -1)
51 		goto err;
52 
53 	rv = 0;
54 
55  err:
56 	X509_free(cert);
57  done:
58 	return (rv);
59 }
60 
61 void
62 tls_keypair_clear_key(struct tls_keypair *keypair)
63 {
64 	freezero(keypair->key_mem, keypair->key_len);
65 	keypair->key_mem = NULL;
66 	keypair->key_len = 0;
67 }
68 
69 int
70 tls_keypair_set_cert_file(struct tls_keypair *keypair, struct tls_error *error,
71     const char *cert_file)
72 {
73 	if (tls_config_load_file(error, "certificate", cert_file,
74 	    &keypair->cert_mem, &keypair->cert_len) == -1)
75 		return -1;
76 	return tls_keypair_pubkey_hash(keypair, error);
77 }
78 
79 int
80 tls_keypair_set_cert_mem(struct tls_keypair *keypair, struct tls_error *error,
81     const uint8_t *cert, size_t len)
82 {
83 	if (tls_set_mem(&keypair->cert_mem, &keypair->cert_len, cert, len) == -1)
84 		return -1;
85 	return tls_keypair_pubkey_hash(keypair, error);
86 }
87 
88 int
89 tls_keypair_set_key_file(struct tls_keypair *keypair, struct tls_error *error,
90     const char *key_file)
91 {
92 	tls_keypair_clear_key(keypair);
93 	return tls_config_load_file(error, "key", key_file,
94 	    &keypair->key_mem, &keypair->key_len);
95 }
96 
97 int
98 tls_keypair_set_key_mem(struct tls_keypair *keypair, struct tls_error *error,
99     const uint8_t *key, size_t len)
100 {
101 	tls_keypair_clear_key(keypair);
102 	return tls_set_mem(&keypair->key_mem, &keypair->key_len, key, len);
103 }
104 
105 int
106 tls_keypair_set_ocsp_staple_file(struct tls_keypair *keypair,
107     struct tls_error *error, const char *ocsp_file)
108 {
109 	return tls_config_load_file(error, "ocsp", ocsp_file,
110 	    &keypair->ocsp_staple, &keypair->ocsp_staple_len);
111 }
112 
113 int
114 tls_keypair_set_ocsp_staple_mem(struct tls_keypair *keypair,
115     struct tls_error *error, const uint8_t *staple, size_t len)
116 {
117 	return tls_set_mem(&keypair->ocsp_staple, &keypair->ocsp_staple_len,
118 	    staple, len);
119 }
120 
121 void
122 tls_keypair_free(struct tls_keypair *keypair)
123 {
124 	if (keypair == NULL)
125 		return;
126 
127 	tls_keypair_clear_key(keypair);
128 
129 	free(keypair->cert_mem);
130 	free(keypair->ocsp_staple);
131 	free(keypair->pubkey_hash);
132 
133 	free(keypair);
134 }
135 
136 int
137 tls_keypair_load_cert(struct tls_keypair *keypair, struct tls_error *error,
138     X509 **cert)
139 {
140 	char *errstr = "unknown";
141 	BIO *cert_bio = NULL;
142 	unsigned long ssl_err;
143 	int rv = -1;
144 
145 	X509_free(*cert);
146 	*cert = NULL;
147 
148 	if (keypair->cert_mem == NULL) {
149 		tls_error_set(error, "keypair has no certificate");
150 		goto err;
151 	}
152 	if ((cert_bio = BIO_new_mem_buf(keypair->cert_mem,
153 	    keypair->cert_len)) == NULL) {
154 		tls_error_set(error, "failed to create certificate bio");
155 		goto err;
156 	}
157 	if ((*cert = PEM_read_bio_X509(cert_bio, NULL, tls_password_cb,
158 	    NULL)) == NULL) {
159 		if ((ssl_err = ERR_peek_error()) != 0)
160 			errstr = ERR_error_string(ssl_err, NULL);
161 		tls_error_set(error, "failed to load certificate: %s", errstr);
162 		goto err;
163 	}
164 
165 	rv = 0;
166 
167  err:
168 	BIO_free(cert_bio);
169 
170 	return (rv);
171 }