kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
0ee319322c
boringssl/include/openssl/pkcs8.h

238 lines
11 KiB
C
Raw Normal View History

Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
* project 1999.
*/
/* ====================================================================
* Copyright (c) 1999 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* licensing@OpenSSL.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com). */
#ifndef OPENSSL_HEADER_PKCS8_H
#define OPENSSL_HEADER_PKCS8_H
#include <openssl/base.h>
#include <openssl/x509.h>
Eliminate unnecessary includes from low-level crypto modules. Beyond generally eliminating unnecessary includes, eliminate as many includes of headers that declare/define particularly error-prone functionality like strlen, malloc, and free. crypto/err/internal.h was added to remove the dependency on openssl/thread.h from the public openssl/err.h header. The include of <stdlib.h> in openssl/mem.h was retained since it defines OPENSSL_malloc and friends as macros around the stdlib.h functions. The public x509.h, x509v3.h, and ssl.h headers were not changed in order to minimize breakage of source compatibility with external code. Change-Id: I0d264b73ad0a720587774430b2ab8f8275960329 Reviewed-on: https://boringssl-review.googlesource.com/4220 Reviewed-by: Adam Langley <agl@google.com>
2015-03-28 07:12:01 +00:00
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
#if defined(__cplusplus)
extern "C" {
#endif
Add PKCS8_{decrypt,encrypt}_pbe. The original functions do an ascii_to_ucs2 transformation on the password. Deprecate them in favor of making that encoding the caller's problem. ascii_to_ucs2 doesn't handle, say, UTF-8 anyway. And with the original OpenSSL function, some ciphers would do the transformation, and some wouldn't making the text-string/bytes-string confusion even messier. BUG=399121 Change-Id: I7d1cea20a260f21eec2e8ffb7cd6be239fe92873 Reviewed-on: https://boringssl-review.googlesource.com/1347 Reviewed-by: Adam Langley <agl@google.com>
2014-07-31 18:59:47 +01:00
pkcs8.c: Add PBES2 to list of password-based encryption methods. This consists mostly of re-adding OpenSSL's implementation of PBKDF2 (very loosely based upon e0d26bb3). The meat of it, namely |PKCS5_PBKDF2_HMAC|, was already present, but unused. In addition, |PKCS8_encrypt| and |PKCS8_decrypt| must be changed to not perform UCS-2 conversion in the PBES2 case. Change-Id: Id170ecabc43c79491600051147d1d6d3c7273dbc Reviewed-on: https://boringssl-review.googlesource.com/5745 Reviewed-by: Adam Langley <agl@google.com>
2015-08-21 19:09:44 +01:00
/* PKCS8_encrypt_pbe serializes and encrypts a PKCS8_PRIV_KEY_INFO with PBES1 or
* PBES2 as defined in PKCS #5. Only pbeWithSHAAnd128BitRC4,
Add PKCS#12 parser. This is cleaner than the OpenSSL code was, at least, but it's hardly beautiful due to the "standard" that it's trying to implement. (See [1].) The references from the PKCS#8 code to various ciphers have digests have been made into function pointer references rather than NIDs so that the linker will be able to drop RC2 code for binaries that don't call PKCS#8 or #12 functions. A bug that crashed OpenSSL/BoringSSL when parsing a malformed PKCS#8 structure has been fixed too. See https://www.cs.auckland.ac.nz/~pgut001/pubs/pfx.html Change-Id: Iaa1039e04ed7877b90792835e8ce3ebc3b29f89e Reviewed-on: https://boringssl-review.googlesource.com/1592 Reviewed-by: Adam Langley <agl@google.com>
2014-08-21 22:11:39 +01:00
* pbeWithSHAAnd3-KeyTripleDES-CBC and pbeWithSHA1And40BitRC2, defined in PKCS
pkcs8.c: Add PBES2 to list of password-based encryption methods. This consists mostly of re-adding OpenSSL's implementation of PBKDF2 (very loosely based upon e0d26bb3). The meat of it, namely |PKCS5_PBKDF2_HMAC|, was already present, but unused. In addition, |PKCS8_encrypt| and |PKCS8_decrypt| must be changed to not perform UCS-2 conversion in the PBES2 case. Change-Id: Id170ecabc43c79491600051147d1d6d3c7273dbc Reviewed-on: https://boringssl-review.googlesource.com/5745 Reviewed-by: Adam Langley <agl@google.com>
2015-08-21 19:09:44 +01:00
* #12, and PBES2, are supported. PBES2 is selected by setting |cipher| and
* passing -1 for |pbe_nid|. Otherwise, PBES1 is used and |cipher| is ignored.
*
* The |pass_raw_len| bytes pointed to by |pass_raw| are used as the password.
* Note that any conversions from the password as supplied in a text string
* (such as those specified in B.1 of PKCS #12) must be performed by the caller.
Add PKCS8_{decrypt,encrypt}_pbe. The original functions do an ascii_to_ucs2 transformation on the password. Deprecate them in favor of making that encoding the caller's problem. ascii_to_ucs2 doesn't handle, say, UTF-8 anyway. And with the original OpenSSL function, some ciphers would do the transformation, and some wouldn't making the text-string/bytes-string confusion even messier. BUG=399121 Change-Id: I7d1cea20a260f21eec2e8ffb7cd6be239fe92873 Reviewed-on: https://boringssl-review.googlesource.com/1347 Reviewed-by: Adam Langley <agl@google.com>
2014-07-31 18:59:47 +01:00
*
* If |salt| is NULL, a random salt of |salt_len| bytes is generated. If
* |salt_len| is zero, a default salt length is used instead.
*
* The resulting structure is stored in an X509_SIG which must be freed by the
* caller.
*
* TODO(davidben): Really? An X509_SIG? OpenSSL probably did that because it has
* the same structure as EncryptedPrivateKeyInfo. */
OPENSSL_EXPORT X509_SIG *PKCS8_encrypt_pbe(int pbe_nid,
pkcs8.c: Add PBES2 to list of password-based encryption methods. This consists mostly of re-adding OpenSSL's implementation of PBKDF2 (very loosely based upon e0d26bb3). The meat of it, namely |PKCS5_PBKDF2_HMAC|, was already present, but unused. In addition, |PKCS8_encrypt| and |PKCS8_decrypt| must be changed to not perform UCS-2 conversion in the PBES2 case. Change-Id: Id170ecabc43c79491600051147d1d6d3c7273dbc Reviewed-on: https://boringssl-review.googlesource.com/5745 Reviewed-by: Adam Langley <agl@google.com>
2015-08-21 19:09:44 +01:00
const EVP_CIPHER *cipher,
Add PKCS8_{decrypt,encrypt}_pbe. The original functions do an ascii_to_ucs2 transformation on the password. Deprecate them in favor of making that encoding the caller's problem. ascii_to_ucs2 doesn't handle, say, UTF-8 anyway. And with the original OpenSSL function, some ciphers would do the transformation, and some wouldn't making the text-string/bytes-string confusion even messier. BUG=399121 Change-Id: I7d1cea20a260f21eec2e8ffb7cd6be239fe92873 Reviewed-on: https://boringssl-review.googlesource.com/1347 Reviewed-by: Adam Langley <agl@google.com>
2014-07-31 18:59:47 +01:00
const uint8_t *pass_raw,
size_t pass_raw_len,
uint8_t *salt, size_t salt_len,
int iterations,
PKCS8_PRIV_KEY_INFO *p8inf);
pkcs8.c: Add PBES2 to list of password-based encryption methods. This consists mostly of re-adding OpenSSL's implementation of PBKDF2 (very loosely based upon e0d26bb3). The meat of it, namely |PKCS5_PBKDF2_HMAC|, was already present, but unused. In addition, |PKCS8_encrypt| and |PKCS8_decrypt| must be changed to not perform UCS-2 conversion in the PBES2 case. Change-Id: Id170ecabc43c79491600051147d1d6d3c7273dbc Reviewed-on: https://boringssl-review.googlesource.com/5745 Reviewed-by: Adam Langley <agl@google.com>
2015-08-21 19:09:44 +01:00
/* PKCS8_decrypt_pbe decrypts and decodes a PKCS8_PRIV_KEY_INFO with PBES1 or
* PBES2 as defined in PKCS #5. Only pbeWithSHAAnd128BitRC4,
* pbeWithSHAAnd3-KeyTripleDES-CBC and pbeWithSHA1And40BitRC2, and PBES2,
* defined in PKCS #12, are supported.
*
* The |pass_raw_len| bytes pointed to by |pass_raw| are used as the password.
* Note that any conversions from the password as supplied in a text string
* (such as those specified in B.1 of PKCS #12) must be performed by the caller.
Add PKCS8_{decrypt,encrypt}_pbe. The original functions do an ascii_to_ucs2 transformation on the password. Deprecate them in favor of making that encoding the caller's problem. ascii_to_ucs2 doesn't handle, say, UTF-8 anyway. And with the original OpenSSL function, some ciphers would do the transformation, and some wouldn't making the text-string/bytes-string confusion even messier. BUG=399121 Change-Id: I7d1cea20a260f21eec2e8ffb7cd6be239fe92873 Reviewed-on: https://boringssl-review.googlesource.com/1347 Reviewed-by: Adam Langley <agl@google.com>
2014-07-31 18:59:47 +01:00
*
* The resulting structure must be freed by the caller. */
OPENSSL_EXPORT PKCS8_PRIV_KEY_INFO *PKCS8_decrypt_pbe(X509_SIG *pkcs8,
const uint8_t *pass_raw,
size_t pass_raw_len);
Fix up pkcs8.h. Somehow we ended up with duplicate 'Deprecated functions' sections. PKCS12_get_key_and_certs ended up in one of them was probably an oversight. Change-Id: Ia6d6a44132cb2730ee1f92a6bbcfa8ce168e7d08 Reviewed-on: https://boringssl-review.googlesource.com/6020 Reviewed-by: Adam Langley <agl@google.com>
2015-09-28 23:52:28 +01:00
/* PKCS12_get_key_and_certs parses a PKCS#12 structure from |in|, authenticates
* and decrypts it using |password|, sets |*out_key| to the included private
* key and appends the included certificates to |out_certs|. It returns one on
* success and zero on error. The caller takes ownership of the outputs. */
OPENSSL_EXPORT int PKCS12_get_key_and_certs(EVP_PKEY **out_key,
STACK_OF(X509) *out_certs,
CBS *in, const char *password);
Add PKCS8_{decrypt,encrypt}_pbe. The original functions do an ascii_to_ucs2 transformation on the password. Deprecate them in favor of making that encoding the caller's problem. ascii_to_ucs2 doesn't handle, say, UTF-8 anyway. And with the original OpenSSL function, some ciphers would do the transformation, and some wouldn't making the text-string/bytes-string confusion even messier. BUG=399121 Change-Id: I7d1cea20a260f21eec2e8ffb7cd6be239fe92873 Reviewed-on: https://boringssl-review.googlesource.com/1347 Reviewed-by: Adam Langley <agl@google.com>
2014-07-31 18:59:47 +01:00
/* Deprecated functions. */
pkcs8.c: Add PBES2 to list of password-based encryption methods. This consists mostly of re-adding OpenSSL's implementation of PBKDF2 (very loosely based upon e0d26bb3). The meat of it, namely |PKCS5_PBKDF2_HMAC|, was already present, but unused. In addition, |PKCS8_encrypt| and |PKCS8_decrypt| must be changed to not perform UCS-2 conversion in the PBES2 case. Change-Id: Id170ecabc43c79491600051147d1d6d3c7273dbc Reviewed-on: https://boringssl-review.googlesource.com/5745 Reviewed-by: Adam Langley <agl@google.com>
2015-08-21 19:09:44 +01:00
/* PKCS8_encrypt calls |PKCS8_encrypt_pbe| after (in the PKCS#12 case) treating
* |pass| as an ASCII string, appending U+0000, and converting to UCS-2. (So the
* empty password encodes as two NUL bytes.) In the PBES2 case, the password is
* unchanged. */
Add visibility rules. This change marks public symbols as dynamically exported. This means that it becomes viable to build a shared library of libcrypto and libssl with -fvisibility=hidden. On Windows, one not only needs to mark functions for export in a component, but also for import when using them from a different component. Because of this we have to build with |BORINGSSL_IMPLEMENTATION| defined when building the code. Other components, when including our headers, won't have that defined and then the |OPENSSL_EXPORT| tag becomes an import tag instead. See the #defines in base.h In the asm code, symbols are now hidden by default and those that need to be exported are wrapped by a C function. In order to support Chromium, a couple of libssl functions were moved to ssl.h from ssl_locl.h: ssl_get_new_session and ssl_update_cache. Change-Id: Ib4b76e2f1983ee066e7806c24721e8626d08a261 Reviewed-on: https://boringssl-review.googlesource.com/1350 Reviewed-by: Adam Langley <agl@google.com>
2014-07-31 00:02:14 +01:00
OPENSSL_EXPORT X509_SIG *PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher,
const char *pass, int pass_len,
uint8_t *salt, size_t salt_len,
int iterations,
PKCS8_PRIV_KEY_INFO *p8inf);
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
pkcs8.c: Add PBES2 to list of password-based encryption methods. This consists mostly of re-adding OpenSSL's implementation of PBKDF2 (very loosely based upon e0d26bb3). The meat of it, namely |PKCS5_PBKDF2_HMAC|, was already present, but unused. In addition, |PKCS8_encrypt| and |PKCS8_decrypt| must be changed to not perform UCS-2 conversion in the PBES2 case. Change-Id: Id170ecabc43c79491600051147d1d6d3c7273dbc Reviewed-on: https://boringssl-review.googlesource.com/5745 Reviewed-by: Adam Langley <agl@google.com>
2015-08-21 19:09:44 +01:00
/* PKCS8_decrypt calls PKCS8_decrypt_pbe after (in the PKCS#12 case) treating
* |pass| as an ASCII string, appending U+0000, and converting to UCS-2. (So the
* empty password encodes as two NUL bytes.) In the PBES2 case, the password is
* unchanged. */
Add visibility rules. This change marks public symbols as dynamically exported. This means that it becomes viable to build a shared library of libcrypto and libssl with -fvisibility=hidden. On Windows, one not only needs to mark functions for export in a component, but also for import when using them from a different component. Because of this we have to build with |BORINGSSL_IMPLEMENTATION| defined when building the code. Other components, when including our headers, won't have that defined and then the |OPENSSL_EXPORT| tag becomes an import tag instead. See the #defines in base.h In the asm code, symbols are now hidden by default and those that need to be exported are wrapped by a C function. In order to support Chromium, a couple of libssl functions were moved to ssl.h from ssl_locl.h: ssl_get_new_session and ssl_update_cache. Change-Id: Ib4b76e2f1983ee066e7806c24721e8626d08a261 Reviewed-on: https://boringssl-review.googlesource.com/1350 Reviewed-by: Adam Langley <agl@google.com>
2014-07-31 00:02:14 +01:00
OPENSSL_EXPORT PKCS8_PRIV_KEY_INFO *PKCS8_decrypt(X509_SIG *pkcs8,
const char *pass,
int pass_len);
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
Add misc functions for easier porting. Android requested that the wpa_supplicant go upstream. This change adds some dummy functions and reinstates DSA_dup_DH in order to make the diff smaller and easier for upstream. Change-Id: I77ac271b8652bae5a0bbe16afde51d9096f3dfb5 Reviewed-on: https://boringssl-review.googlesource.com/1740 Reviewed-by: Adam Langley <agl@google.com>
2014-09-06 01:04:51 +01:00
/* PKCS12_PBE_add does nothing. It exists for compatibility with OpenSSL. */
Add void in place of empty function arguments. Since this is C89 we need to maintain this ancient practice. Change-Id: I7223e7c38a35cf551b6e3c9159d2e21ebf7e62be Reviewed-on: https://boringssl-review.googlesource.com/2631 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-12-16 23:53:01 +00:00
OPENSSL_EXPORT void PKCS12_PBE_add(void);
Add misc functions for easier porting. Android requested that the wpa_supplicant go upstream. This change adds some dummy functions and reinstates DSA_dup_DH in order to make the diff smaller and easier for upstream. Change-Id: I77ac271b8652bae5a0bbe16afde51d9096f3dfb5 Reviewed-on: https://boringssl-review.googlesource.com/1740 Reviewed-by: Adam Langley <agl@google.com>
2014-09-06 01:04:51 +01:00
Provide compatibility functions for PKCS#12 parsing. In order to minimise the upstream diffs needed for bits of Android to build with BoringSSL, this change implements the old style PKCS#12 functions as wrappers around the modern parser. The function to read all the contents of a BIO could almost be a utility function but I'll wait until there are two uses for it first. The important change from the original functions is that these will always read the complete buffer/BIO/FILE passed in. Based on a survey of uses of d2i_PKCS12 that I found, this appears to be universally what callers want anyway. Change-Id: I3f5b84e710b161d975f91f4d16c83d44371368d1 Reviewed-on: https://boringssl-review.googlesource.com/1791 Reviewed-by: Adam Langley <agl@google.com>
2014-09-19 18:49:56 +01:00
/* d2i_PKCS12 is a dummy function that copies |*ber_bytes| into a
Changes to support node.js's use of PKCS#12. node.js uses a memory BIO in the wrong mode which, for now, we work around. It also passes in NULL (rather than empty) strings and a non-NULL out-arg for |d2i_PKCS12_bio|. Change-Id: Ib565b4a202775bb32fdcb76db8a4e8c54268c052 Reviewed-on: https://boringssl-review.googlesource.com/7012 Reviewed-by: Adam Langley <agl@google.com>
2016-02-01 22:30:02 +00:00
* |PKCS12| structure. The |out_p12| argument should be NULL(✝). On exit,
Provide compatibility functions for PKCS#12 parsing. In order to minimise the upstream diffs needed for bits of Android to build with BoringSSL, this change implements the old style PKCS#12 functions as wrappers around the modern parser. The function to read all the contents of a BIO could almost be a utility function but I'll wait until there are two uses for it first. The important change from the original functions is that these will always read the complete buffer/BIO/FILE passed in. Based on a survey of uses of d2i_PKCS12 that I found, this appears to be universally what callers want anyway. Change-Id: I3f5b84e710b161d975f91f4d16c83d44371368d1 Reviewed-on: https://boringssl-review.googlesource.com/1791 Reviewed-by: Adam Langley <agl@google.com>
2014-09-19 18:49:56 +01:00
* |*ber_bytes| will be advanced by |ber_len|. It returns a fresh |PKCS12|
* structure or NULL on error.
*
* Note: unlike other d2i functions, |d2i_PKCS12| will always consume |ber_len|
Changes to support node.js's use of PKCS#12. node.js uses a memory BIO in the wrong mode which, for now, we work around. It also passes in NULL (rather than empty) strings and a non-NULL out-arg for |d2i_PKCS12_bio|. Change-Id: Ib565b4a202775bb32fdcb76db8a4e8c54268c052 Reviewed-on: https://boringssl-review.googlesource.com/7012 Reviewed-by: Adam Langley <agl@google.com>
2016-02-01 22:30:02 +00:00
* bytes.
*
* (✝) If |out_p12| is not NULL and the function is successful, |*out_p12| will
* be freed if not NULL itself and the result will be written to |*out_p12|.
* New code should not depend on this. */
Provide compatibility functions for PKCS#12 parsing. In order to minimise the upstream diffs needed for bits of Android to build with BoringSSL, this change implements the old style PKCS#12 functions as wrappers around the modern parser. The function to read all the contents of a BIO could almost be a utility function but I'll wait until there are two uses for it first. The important change from the original functions is that these will always read the complete buffer/BIO/FILE passed in. Based on a survey of uses of d2i_PKCS12 that I found, this appears to be universally what callers want anyway. Change-Id: I3f5b84e710b161d975f91f4d16c83d44371368d1 Reviewed-on: https://boringssl-review.googlesource.com/1791 Reviewed-by: Adam Langley <agl@google.com>
2014-09-19 18:49:56 +01:00
OPENSSL_EXPORT PKCS12 *d2i_PKCS12(PKCS12 **out_p12, const uint8_t **ber_bytes,
size_t ber_len);
/* d2i_PKCS12_bio acts like |d2i_PKCS12| but reads from a |BIO|. */
OPENSSL_EXPORT PKCS12* d2i_PKCS12_bio(BIO *bio, PKCS12 **out_p12);
/* d2i_PKCS12_fp acts like |d2i_PKCS12| but reads from a |FILE|. */
OPENSSL_EXPORT PKCS12* d2i_PKCS12_fp(FILE *fp, PKCS12 **out_p12);
/* PKCS12_parse calls |PKCS12_get_key_and_certs| on the ASN.1 data stored in
* |p12|. The |out_pkey| and |out_cert| arguments must not be NULL and, on
* successful exit, the private key and first certificate will be stored in
* them. The |out_ca_certs| argument may be NULL but, if not, then any extra
* certificates will be appended to |*out_ca_certs|. If |*out_ca_certs| is NULL
* then it will be set to a freshly allocated stack containing the extra certs.
*
* It returns one on success and zero on error. */
OPENSSL_EXPORT int PKCS12_parse(const PKCS12 *p12, const char *password,
EVP_PKEY **out_pkey, X509 **out_cert,
STACK_OF(X509) **out_ca_certs);
Add |PKCS12_verify_mac|. This utility function is provided for API-compatibility and simply calls |PKCS12_parse| internally. BUG=536939 Change-Id: I86c548e5dfd64b6c473e497b95adfa5947fe9529 Reviewed-on: https://boringssl-review.googlesource.com/6008 Reviewed-by: Adam Langley <agl@google.com>
2015-09-29 18:56:57 +01:00
/* PKCS12_verify_mac returns one if |password| is a valid password for |p12|
* and zero otherwise. Since |PKCS12_parse| doesn't take a length parameter,
* it's not actually possible to use a non-NUL-terminated password to actually
* get anything from a |PKCS12|. Thus |password| and |password_len| may be
* |NULL| and zero, respectively, or else |password_len| may be -1, or else
* |password[password_len]| must be zero and no other NUL bytes may appear in
* |password|. If the |password_len| checks fail, zero is returned
* immediately. */
OPENSSL_EXPORT int PKCS12_verify_mac(const PKCS12 *p12, const char *password,
int password_len);
Provide compatibility functions for PKCS#12 parsing. In order to minimise the upstream diffs needed for bits of Android to build with BoringSSL, this change implements the old style PKCS#12 functions as wrappers around the modern parser. The function to read all the contents of a BIO could almost be a utility function but I'll wait until there are two uses for it first. The important change from the original functions is that these will always read the complete buffer/BIO/FILE passed in. Based on a survey of uses of d2i_PKCS12 that I found, this appears to be universally what callers want anyway. Change-Id: I3f5b84e710b161d975f91f4d16c83d44371368d1 Reviewed-on: https://boringssl-review.googlesource.com/1791 Reviewed-by: Adam Langley <agl@google.com>
2014-09-19 18:49:56 +01:00
/* PKCS12_free frees |p12| and its contents. */
OPENSSL_EXPORT void PKCS12_free(PKCS12 *p12);
Add misc functions for easier porting. Android requested that the wpa_supplicant go upstream. This change adds some dummy functions and reinstates DSA_dup_DH in order to make the diff smaller and easier for upstream. Change-Id: I77ac271b8652bae5a0bbe16afde51d9096f3dfb5 Reviewed-on: https://boringssl-review.googlesource.com/1740 Reviewed-by: Adam Langley <agl@google.com>
2014-09-06 01:04:51 +01:00
Add |PKCS12_verify_mac|. This utility function is provided for API-compatibility and simply calls |PKCS12_parse| internally. BUG=536939 Change-Id: I86c548e5dfd64b6c473e497b95adfa5947fe9529 Reviewed-on: https://boringssl-review.googlesource.com/6008 Reviewed-by: Adam Langley <agl@google.com>
2015-09-29 18:56:57 +01:00
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
#if defined(__cplusplus)
} /* extern C */
Remove scoped_types.h. This change scatters the contents of the two scoped_types.h files into the headers for each of the areas of the code. The types are now in the |bssl| namespace. Change-Id: I802b8de68fba4786b6a0ac1bacd11d81d5842423 Reviewed-on: https://boringssl-review.googlesource.com/8731 Reviewed-by: Adam Langley <agl@google.com>
2016-07-11 23:22:19 +01:00
#if __cplusplus >= 201103
namespace bssl {
using ScopedPKCS8_PRIV_KEY_INFO =
ScopedType<PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_free>;
using ScopedPKCS12 = ScopedType<PKCS12, PKCS12_free>;
} // namespace bssl
#endif
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
#endif
Reset all the error codes. This saves about 6-7k of error data. Change-Id: Ic28593d4a1f5454f00fb2399d281c351ee57fb14 Reviewed-on: https://boringssl-review.googlesource.com/3385 Reviewed-by: Adam Langley <agl@google.com>
2015-02-11 20:55:26 +00:00
#define PKCS8_R_BAD_PKCS12_DATA 100
#define PKCS8_R_BAD_PKCS12_VERSION 101
#define PKCS8_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER 102
#define PKCS8_R_CRYPT_ERROR 103
#define PKCS8_R_DECODE_ERROR 104
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
#define PKCS8_R_ENCODE_ERROR 105
Reset all the error codes. This saves about 6-7k of error data. Change-Id: Ic28593d4a1f5454f00fb2399d281c351ee57fb14 Reviewed-on: https://boringssl-review.googlesource.com/3385 Reviewed-by: Adam Langley <agl@google.com>
2015-02-11 20:55:26 +00:00
#define PKCS8_R_ENCRYPT_ERROR 106
#define PKCS8_R_ERROR_SETTING_CIPHER_PARAMS 107
#define PKCS8_R_INCORRECT_PASSWORD 108
#define PKCS8_R_KEYGEN_FAILURE 109
#define PKCS8_R_KEY_GEN_ERROR 110
#define PKCS8_R_METHOD_NOT_SUPPORTED 111
#define PKCS8_R_MISSING_MAC 112
#define PKCS8_R_MULTIPLE_PRIVATE_KEYS_IN_PKCS12 113
#define PKCS8_R_PKCS12_PUBLIC_KEY_INTEGRITY_NOT_SUPPORTED 114
#define PKCS8_R_PKCS12_TOO_DEEPLY_NESTED 115
#define PKCS8_R_PRIVATE_KEY_DECODE_ERROR 116
#define PKCS8_R_PRIVATE_KEY_ENCODE_ERROR 117
#define PKCS8_R_TOO_LONG 118
#define PKCS8_R_UNKNOWN_ALGORITHM 119
#define PKCS8_R_UNKNOWN_CIPHER 120
#define PKCS8_R_UNKNOWN_CIPHER_ALGORITHM 121
#define PKCS8_R_UNKNOWN_DIGEST 122
#define PKCS8_R_UNKNOWN_HASH 123
#define PKCS8_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM 124
pkcs8.c: Add PBES2 to list of password-based encryption methods. This consists mostly of re-adding OpenSSL's implementation of PBKDF2 (very loosely based upon e0d26bb3). The meat of it, namely |PKCS5_PBKDF2_HMAC|, was already present, but unused. In addition, |PKCS8_encrypt| and |PKCS8_decrypt| must be changed to not perform UCS-2 conversion in the PBES2 case. Change-Id: Id170ecabc43c79491600051147d1d6d3c7273dbc Reviewed-on: https://boringssl-review.googlesource.com/5745 Reviewed-by: Adam Langley <agl@google.com>
2015-08-21 19:09:44 +01:00
#define PKCS8_R_UNSUPPORTED_KEYLENGTH 125
#define PKCS8_R_UNSUPPORTED_SALT_TYPE 126
#define PKCS8_R_UNSUPPORTED_CIPHER 127
#define PKCS8_R_UNSUPPORTED_KEY_DERIVATION_FUNCTION 128
#define PKCS8_R_BAD_ITERATION_COUNT 129
#define PKCS8_R_UNSUPPORTED_PRF 130
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
#endif /* OPENSSL_HEADER_PKCS8_H */
Reference in New Issue Copy Permalink