1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
|
/*
* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
*
* Licensed under the Apache License, Version 2.0 (the "License").
* You may not use this file except in compliance with the License.
* A copy of the License is located at
*
* http://aws.amazon.com/apache2.0
*
* or in the "license" file accompanying this file. This file is distributed
* on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied. See the License for the specific language governing
* permissions and limitations under the License.
*/
#include <openssl/evp.h>
#include <string.h>
#include "error/s2n_errno.h"
#include "stuffer/s2n_stuffer.h"
#include "utils/s2n_safety.h"
#define S2N_PEM_DELIMTER_CHAR '-'
#define S2N_PEM_DELIMITER_MIN_COUNT 1
#define S2N_PEM_DELIMITER_MAX_COUNT 64
#define S2N_PEM_BEGIN_TOKEN "BEGIN "
#define S2N_PEM_END_TOKEN "END "
#define S2N_PEM_PKCS1_RSA_PRIVATE_KEY "RSA PRIVATE KEY"
#define S2N_PEM_PKCS1_EC_PRIVATE_KEY "EC PRIVATE KEY"
#define S2N_PEM_PKCS8_PRIVATE_KEY "PRIVATE KEY"
#define S2N_PEM_DH_PARAMETERS "DH PARAMETERS"
#define S2N_PEM_EC_PARAMETERS "EC PARAMETERS"
#define S2N_PEM_CERTIFICATE "CERTIFICATE"
#define S2N_PEM_CRL "X509 CRL"
static int s2n_stuffer_pem_read_encapsulation_line(struct s2n_stuffer *pem, const char *encap_marker,
const char *keyword)
{
/* Skip any number of Chars until a "-" is reached */
POSIX_GUARD(s2n_stuffer_skip_to_char(pem, S2N_PEM_DELIMTER_CHAR));
/* Ensure between 1 and 64 '-' chars at start of line */
POSIX_GUARD(s2n_stuffer_skip_expected_char(pem, S2N_PEM_DELIMTER_CHAR, S2N_PEM_DELIMITER_MIN_COUNT,
S2N_PEM_DELIMITER_MAX_COUNT, NULL));
/* Ensure next string in stuffer is "BEGIN " or "END " */
POSIX_GUARD(s2n_stuffer_read_expected_str(pem, encap_marker));
/* Ensure next string is stuffer is the keyword (Eg "CERTIFICATE", "PRIVATE KEY", etc) */
POSIX_GUARD(s2n_stuffer_read_expected_str(pem, keyword));
/* Ensure between 1 and 64 '-' chars at end of line */
POSIX_GUARD(s2n_stuffer_skip_expected_char(pem, S2N_PEM_DELIMTER_CHAR, S2N_PEM_DELIMITER_MIN_COUNT,
S2N_PEM_DELIMITER_MAX_COUNT, NULL));
/* Check for missing newline between dashes case: "-----END CERTIFICATE----------BEGIN CERTIFICATE-----" */
if (strncmp(encap_marker, S2N_PEM_END_TOKEN, strlen(S2N_PEM_END_TOKEN)) == 0
&& s2n_stuffer_peek_check_for_str(pem, S2N_PEM_BEGIN_TOKEN) == S2N_SUCCESS) {
/* Rewind stuffer by 1 byte before BEGIN, so that next read will find the dash before the BEGIN */
POSIX_GUARD(s2n_stuffer_rewind_read(pem, 1));
}
/* Skip newlines and other whitepsace that may be after the dashes */
return s2n_stuffer_skip_whitespace(pem, NULL);
}
static int s2n_stuffer_pem_read_begin(struct s2n_stuffer *pem, const char *keyword)
{
return s2n_stuffer_pem_read_encapsulation_line(pem, S2N_PEM_BEGIN_TOKEN, keyword);
}
static int s2n_stuffer_pem_read_end(struct s2n_stuffer *pem, const char *keyword)
{
return s2n_stuffer_pem_read_encapsulation_line(pem, S2N_PEM_END_TOKEN, keyword);
}
static int s2n_stuffer_pem_read_contents(struct s2n_stuffer *pem, struct s2n_stuffer *asn1)
{
s2n_stack_blob(base64__blob, 64, 64);
struct s2n_stuffer base64_stuffer = { 0 };
POSIX_GUARD(s2n_stuffer_init(&base64_stuffer, &base64__blob));
while (1) {
/* We need a byte... */
POSIX_ENSURE(s2n_stuffer_data_available(pem) >= 1, S2N_ERR_STUFFER_OUT_OF_DATA);
/* Peek to see if the next char is a dash, meaning end of pem_contents */
uint8_t c = pem->blob.data[pem->read_cursor];
if (c == '-') {
break;
}
/* Else, move read pointer forward by 1 byte since we will be consuming it. */
pem->read_cursor += 1;
/* Skip non-base64 characters */
if (!s2n_is_base64_char(c)) {
continue;
}
/* Flush base64_stuffer to asn1 stuffer if we're out of space, and reset base64_stuffer read/write pointers */
if (s2n_stuffer_space_remaining(&base64_stuffer) == 0) {
POSIX_GUARD(s2n_stuffer_read_base64(&base64_stuffer, asn1));
POSIX_GUARD(s2n_stuffer_rewrite(&base64_stuffer));
}
/* Copy next char to base64_stuffer */
POSIX_GUARD(s2n_stuffer_write_bytes(&base64_stuffer, (uint8_t *) &c, 1));
};
/* Flush any remaining bytes to asn1 */
POSIX_GUARD(s2n_stuffer_read_base64(&base64_stuffer, asn1));
return S2N_SUCCESS;
}
static int s2n_stuffer_data_from_pem(struct s2n_stuffer *pem, struct s2n_stuffer *asn1, const char *keyword)
{
POSIX_PRECONDITION(s2n_stuffer_validate(pem));
POSIX_PRECONDITION(s2n_stuffer_validate(asn1));
POSIX_ENSURE_REF(keyword);
POSIX_GUARD(s2n_stuffer_pem_read_begin(pem, keyword));
POSIX_GUARD(s2n_stuffer_pem_read_contents(pem, asn1));
POSIX_GUARD(s2n_stuffer_pem_read_end(pem, keyword));
POSIX_POSTCONDITION(s2n_stuffer_validate(pem));
POSIX_POSTCONDITION(s2n_stuffer_validate(asn1));
return S2N_SUCCESS;
}
int s2n_stuffer_private_key_from_pem(struct s2n_stuffer *pem, struct s2n_stuffer *asn1, int *type)
{
POSIX_PRECONDITION(s2n_stuffer_validate(pem));
POSIX_PRECONDITION(s2n_stuffer_validate(asn1));
POSIX_ENSURE_REF(type);
if (s2n_stuffer_data_from_pem(pem, asn1, S2N_PEM_PKCS1_RSA_PRIVATE_KEY) == S2N_SUCCESS) {
*type = EVP_PKEY_RSA;
return S2N_SUCCESS;
}
s2n_stuffer_reread(pem);
s2n_stuffer_reread(asn1);
/* By default, OpenSSL tools always generate both "EC PARAMETERS" and "EC PRIVATE
* KEY" PEM objects in the keyfile. Skip the first "EC PARAMETERS" object so that we're
* compatible with OpenSSL's default output, and since "EC PARAMETERS" is
* only needed for non-standard curves that aren't currently supported.
*/
if (s2n_stuffer_data_from_pem(pem, asn1, S2N_PEM_EC_PARAMETERS) != S2N_SUCCESS) {
s2n_stuffer_reread(pem);
}
s2n_stuffer_wipe(asn1);
if (s2n_stuffer_data_from_pem(pem, asn1, S2N_PEM_PKCS1_EC_PRIVATE_KEY) == S2N_SUCCESS) {
*type = EVP_PKEY_EC;
return S2N_SUCCESS;
}
/* If it does not match either format, try PKCS#8 */
s2n_stuffer_reread(pem);
s2n_stuffer_reread(asn1);
if (s2n_stuffer_data_from_pem(pem, asn1, S2N_PEM_PKCS8_PRIVATE_KEY) == S2N_SUCCESS) {
*type = EVP_PKEY_RSA;
return S2N_SUCCESS;
}
POSIX_BAIL(S2N_ERR_INVALID_PEM);
}
int s2n_stuffer_certificate_from_pem(struct s2n_stuffer *pem, struct s2n_stuffer *asn1)
{
return s2n_stuffer_data_from_pem(pem, asn1, S2N_PEM_CERTIFICATE);
}
int s2n_stuffer_crl_from_pem(struct s2n_stuffer *pem, struct s2n_stuffer *asn1)
{
return s2n_stuffer_data_from_pem(pem, asn1, S2N_PEM_CRL);
}
int s2n_stuffer_dhparams_from_pem(struct s2n_stuffer *pem, struct s2n_stuffer *pkcs3)
{
return s2n_stuffer_data_from_pem(pem, pkcs3, S2N_PEM_DH_PARAMETERS);
}
|
