1 /*
2  * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
3  *
4  * Licensed under the Apache License 2.0 (the "License").  You may not use
5  * this file except in compliance with the License.  You can obtain a copy
6  * in the file LICENSE in the source distribution or at
7  * https://www.openssl.org/source/license.html
8  */
9 
10 /*
11  * RSA low level APIs are deprecated for public use, but still ok for
12  * internal use.
13  */
14 #include "internal/deprecated.h"
15 
16 #include <string.h>
17 
18 #include <openssl/core_dispatch.h>
19 #include <openssl/core_names.h>
20 #include <openssl/core_object.h>
21 #include <openssl/crypto.h>
22 #include <openssl/err.h>
23 #include <openssl/params.h>
24 #include <openssl/pem.h>
25 #include <openssl/proverr.h>
26 #include "internal/nelem.h"
27 #include "prov/bio.h"
28 #include "prov/implementations.h"
29 #include "endecoder_local.h"
30 
read_pem(PROV_CTX * provctx,OSSL_CORE_BIO * cin,char ** pem_name,char ** pem_header,unsigned char ** data,long * len)31 static int read_pem(PROV_CTX *provctx, OSSL_CORE_BIO *cin,
32                     char **pem_name, char **pem_header,
33                     unsigned char **data, long *len)
34 {
35     BIO *in = ossl_bio_new_from_core_bio(provctx, cin);
36     int ok = (PEM_read_bio(in, pem_name, pem_header, data, len) > 0);
37 
38     BIO_free(in);
39     return ok;
40 }
41 
42 static OSSL_FUNC_decoder_newctx_fn pem2der_newctx;
43 static OSSL_FUNC_decoder_freectx_fn pem2der_freectx;
44 static OSSL_FUNC_decoder_decode_fn pem2der_decode;
45 
46 /*
47  * Context used for PEM to DER decoding.
48  */
49 struct pem2der_ctx_st {
50     PROV_CTX *provctx;
51 };
52 
pem2der_newctx(void * provctx)53 static void *pem2der_newctx(void *provctx)
54 {
55     struct pem2der_ctx_st *ctx = OPENSSL_zalloc(sizeof(*ctx));
56 
57     if (ctx != NULL)
58         ctx->provctx = provctx;
59     return ctx;
60 }
61 
pem2der_freectx(void * vctx)62 static void pem2der_freectx(void *vctx)
63 {
64     struct pem2der_ctx_st *ctx = vctx;
65 
66     OPENSSL_free(ctx);
67 }
68 
69 /* pem_password_cb compatible function */
70 struct pem2der_pass_data_st {
71     OSSL_PASSPHRASE_CALLBACK *cb;
72     void *cbarg;
73 };
74 
pem2der_pass_helper(char * buf,int num,int w,void * data)75 static int pem2der_pass_helper(char *buf, int num, int w, void *data)
76 {
77     struct pem2der_pass_data_st *pass_data = data;
78     size_t plen;
79 
80     if (pass_data == NULL
81         || pass_data->cb == NULL
82         || !pass_data->cb(buf, num, &plen, NULL, pass_data->cbarg))
83         return -1;
84     return (int)plen;
85 }
86 
87 /*
88  * The selection parameter in pem2der_decode() is not used by this function
89  * because it's not relevant just to decode PEM to DER.
90  */
pem2der_decode(void * vctx,OSSL_CORE_BIO * cin,int selection,OSSL_CALLBACK * data_cb,void * data_cbarg,OSSL_PASSPHRASE_CALLBACK * pw_cb,void * pw_cbarg)91 static int pem2der_decode(void *vctx, OSSL_CORE_BIO *cin, int selection,
92                           OSSL_CALLBACK *data_cb, void *data_cbarg,
93                           OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg)
94 {
95     /*
96      * PEM names we recognise.  Other PEM names should be recognised by
97      * other decoder implementations.
98      */
99     static struct pem_name_map_st {
100         const char *pem_name;
101         int object_type;
102         const char *data_type;
103         const char *data_structure;
104     } pem_name_map[] = {
105         /* PKCS#8 and SubjectPublicKeyInfo */
106         { PEM_STRING_PKCS8, OSSL_OBJECT_PKEY, NULL, "EncryptedPrivateKeyInfo" },
107         { PEM_STRING_PKCS8INF, OSSL_OBJECT_PKEY, NULL, "PrivateKeyInfo" },
108         { PEM_STRING_PUBLIC, OSSL_OBJECT_PKEY, NULL, "SubjectPublicKeyInfo" },
109 
110         /* Our set of type specific PEM types */
111         { PEM_STRING_DHPARAMS, OSSL_OBJECT_PKEY, "DH", "type-specific" },
112         { PEM_STRING_DHXPARAMS, OSSL_OBJECT_PKEY, "X9.42 DH", "type-specific" },
113         { PEM_STRING_DSA, OSSL_OBJECT_PKEY, "DSA", "type-specific" },
114         { PEM_STRING_DSA_PUBLIC, OSSL_OBJECT_PKEY, "DSA", "type-specific" },
115         { PEM_STRING_DSAPARAMS, OSSL_OBJECT_PKEY, "DSA", "type-specific" },
116         { PEM_STRING_ECPRIVATEKEY, OSSL_OBJECT_PKEY, "EC", "type-specific" },
117         { PEM_STRING_ECPARAMETERS, OSSL_OBJECT_PKEY, "EC", "type-specific" },
118         { PEM_STRING_RSA, OSSL_OBJECT_PKEY, "RSA", "type-specific" },
119         { PEM_STRING_RSA_PUBLIC, OSSL_OBJECT_PKEY, "RSA", "type-specific" },
120 
121         /*
122          * A few others that there is at least have an object type for, even
123          * though there is no provider interface to handle such objects, yet.
124          * However, this is beneficial for the OSSL_STORE result handler.
125          */
126         { PEM_STRING_X509, OSSL_OBJECT_CERT, NULL, "Certificate" },
127         { PEM_STRING_X509_TRUSTED, OSSL_OBJECT_CERT, NULL, "Certificate" },
128         { PEM_STRING_X509_OLD, OSSL_OBJECT_CERT, NULL, "Certificate" },
129         { PEM_STRING_X509_CRL, OSSL_OBJECT_CRL, NULL, "CertificateList" }
130     };
131     struct pem2der_ctx_st *ctx = vctx;
132     char *pem_name = NULL, *pem_header = NULL;
133     size_t i;
134     unsigned char *der = NULL;
135     long der_len = 0;
136     int ok = 0;
137     int objtype = OSSL_OBJECT_UNKNOWN;
138 
139     ok = read_pem(ctx->provctx, cin, &pem_name, &pem_header,
140                   &der, &der_len) > 0;
141     /* We return "empty handed".  This is not an error. */
142     if (!ok)
143         return 1;
144 
145     /*
146      * 10 is the number of characters in "Proc-Type:", which
147      * PEM_get_EVP_CIPHER_INFO() requires to be present.
148      * If the PEM header has less characters than that, it's
149      * not worth spending cycles on it.
150      */
151     if (strlen(pem_header) > 10) {
152         EVP_CIPHER_INFO cipher;
153         struct pem2der_pass_data_st pass_data;
154 
155         ok = 0;                  /* Assume that we fail */
156         pass_data.cb = pw_cb;
157         pass_data.cbarg = pw_cbarg;
158         if (!PEM_get_EVP_CIPHER_INFO(pem_header, &cipher)
159             || !PEM_do_header(&cipher, der, &der_len,
160                               pem2der_pass_helper, &pass_data))
161             goto end;
162     }
163 
164     /*
165      * Indicated that we successfully decoded something, or not at all.
166      * Ending up "empty handed" is not an error.
167      */
168     ok = 1;
169 
170     /* Have a look to see if we recognise anything */
171     for (i = 0; i < OSSL_NELEM(pem_name_map); i++)
172         if (strcmp(pem_name, pem_name_map[i].pem_name) == 0)
173             break;
174 
175     if (i < OSSL_NELEM(pem_name_map)) {
176         OSSL_PARAM params[5], *p = params;
177         /* We expect these to be read only so casting away the const is ok */
178         char *data_type = (char *)pem_name_map[i].data_type;
179         char *data_structure = (char *)pem_name_map[i].data_structure;
180 
181         objtype = pem_name_map[i].object_type;
182         if (data_type != NULL)
183             *p++ =
184                 OSSL_PARAM_construct_utf8_string(OSSL_OBJECT_PARAM_DATA_TYPE,
185                                                  data_type, 0);
186 
187         /* We expect this to be read only so casting away the const is ok */
188         if (data_structure != NULL)
189             *p++ =
190                 OSSL_PARAM_construct_utf8_string(OSSL_OBJECT_PARAM_DATA_STRUCTURE,
191                                                  data_structure, 0);
192         *p++ =
193             OSSL_PARAM_construct_octet_string(OSSL_OBJECT_PARAM_DATA,
194                                               der, der_len);
195         *p++ =
196             OSSL_PARAM_construct_int(OSSL_OBJECT_PARAM_TYPE, &objtype);
197 
198         *p = OSSL_PARAM_construct_end();
199 
200         ok = data_cb(params, data_cbarg);
201     }
202 
203  end:
204     OPENSSL_free(pem_name);
205     OPENSSL_free(pem_header);
206     OPENSSL_free(der);
207     return ok;
208 }
209 
210 const OSSL_DISPATCH ossl_pem_to_der_decoder_functions[] = {
211     { OSSL_FUNC_DECODER_NEWCTX, (void (*)(void))pem2der_newctx },
212     { OSSL_FUNC_DECODER_FREECTX, (void (*)(void))pem2der_freectx },
213     { OSSL_FUNC_DECODER_DECODE, (void (*)(void))pem2der_decode },
214     { 0, NULL }
215 };
216