diff options
author | Richard Levitte <levitte@openssl.org> | 2020-11-30 07:25:46 +0100 |
---|---|---|
committer | Richard Levitte <levitte@openssl.org> | 2020-12-02 20:19:31 +0100 |
commit | f91d003a0ef0c748a11ccdb19c7661a3f2df9ab0 (patch) | |
tree | 20ead7bd3ed8cee5bd59e1076644526959709a5b /apps | |
parent | 0b27381fd544beca44df905991923a7fa374d80a (diff) | |
download | openssl-f91d003a0ef0c748a11ccdb19c7661a3f2df9ab0.tar.gz |
APPS: Adapt load_key() and load_pubkey() for the engine: loader
These two functions react when the FORMAT_ENGINE format is given, and
use the passed ENGINE |e| and the passed key argument to form a URI
suitable for the engine: loader.
Co-authored-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/13570)
Diffstat (limited to 'apps')
-rw-r--r-- | apps/cmp.c | 6 | ||||
-rw-r--r-- | apps/include/apps.h | 5 | ||||
-rw-r--r-- | apps/lib/apps.c | 67 | ||||
-rw-r--r-- | apps/lib/engine.c | 59 |
4 files changed, 65 insertions, 72 deletions
diff --git a/apps/cmp.c b/apps/cmp.c index c9bbbb32ba..d57c67c644 100644 --- a/apps/cmp.c +++ b/apps/cmp.c @@ -409,11 +409,7 @@ const OPTIONS cmp_options[] = { {"engine", OPT_ENGINE, 's', "Use crypto engine with given identifier, possibly a hardware device."}, {OPT_MORE_STR, 0, 0, - "Engines may be defined in OpenSSL config file engine section."}, - {OPT_MORE_STR, 0, 0, - "Options like -key specifying keys held in the engine can give key IDs"}, - {OPT_MORE_STR, 0, 0, - "prefixed by 'engine:', e.g. '-key engine:pkcs11:object=mykey;pin-value=1234'"}, + "Engines may also be defined in OpenSSL config file engine section."}, #endif OPT_PROV_OPTIONS, diff --git a/apps/include/apps.h b/apps/include/apps.h index dd2d9cdebd..ddfa3c8383 100644 --- a/apps/include/apps.h +++ b/apps/include/apps.h @@ -156,10 +156,7 @@ ENGINE *setup_engine_methods(const char *id, unsigned int methods, int debug); void release_engine(ENGINE *e); int init_engine(ENGINE *e); int finish_engine(ENGINE *e); -EVP_PKEY *load_engine_private_key(ENGINE *e, const char *keyid, - const char *pass, const char *desc); -EVP_PKEY *load_engine_public_key(ENGINE *e, const char *keyid, - const char *pass, const char *desc); +char *make_engine_uri(ENGINE *e, const char *key_id, const char *desc); int get_legacy_pkey_id(OSSL_LIB_CTX *libctx, const char *algname, ENGINE *e); diff --git a/apps/lib/apps.c b/apps/lib/apps.c index 7d63ff4216..699802044d 100644 --- a/apps/lib/apps.c +++ b/apps/lib/apps.c @@ -560,25 +560,18 @@ EVP_PKEY *load_key(const char *uri, int format, int may_stdin, const char *pass, ENGINE *e, const char *desc) { EVP_PKEY *pkey = NULL; + char *allocated_uri = NULL; if (desc == NULL) desc = "private key"; if (format == FORMAT_ENGINE) { - if (e == NULL) { - BIO_printf(bio_err, "No engine specified for loading %s\n", desc); - } else { - pkey = load_engine_private_key(e, uri, pass, desc); - if (pkey == NULL) { - BIO_printf(bio_err, "Cannot load %s from engine\n", desc); - ERR_print_errors(bio_err); - } - } - } else { - (void)load_key_certs_crls(uri, may_stdin, pass, desc, - &pkey, NULL, NULL, NULL, NULL, NULL, NULL); + uri = allocated_uri = make_engine_uri(e, uri, desc); } + (void)load_key_certs_crls(uri, may_stdin, pass, desc, + &pkey, NULL, NULL, NULL, NULL, NULL, NULL); + OPENSSL_free(allocated_uri); return pkey; } @@ -586,25 +579,18 @@ EVP_PKEY *load_pubkey(const char *uri, int format, int maybe_stdin, const char *pass, ENGINE *e, const char *desc) { EVP_PKEY *pkey = NULL; + char *allocated_uri = NULL; if (desc == NULL) desc = "public key"; if (format == FORMAT_ENGINE) { - if (e == NULL) { - BIO_printf(bio_err, "No engine specified for loading %s\n", desc); - } else { - pkey = load_engine_public_key(e, uri, pass, desc); - if (pkey == NULL) { - BIO_printf(bio_err, "Cannot load %s from engine\n", desc); - ERR_print_errors(bio_err); - } - } - } else { - (void)load_key_certs_crls(uri, maybe_stdin, pass, desc, - NULL, &pkey, NULL, NULL, NULL, NULL, NULL); + uri = allocated_uri = make_engine_uri(e, uri, desc); } + (void)load_key_certs_crls(uri, maybe_stdin, pass, desc, + NULL, &pkey, NULL, NULL, NULL, NULL, NULL); + OPENSSL_free(allocated_uri); return pkey; } @@ -717,14 +703,25 @@ int load_key_certs_crls(const char *uri, int maybe_stdin, pparams != NULL ? "params" : pcert != NULL ? "cert" : pcrl != NULL ? "CRL" : pcerts != NULL ? "certs" : pcrls != NULL ? "CRLs" : NULL; + int cnt_expectations = 0; + int expect = 0; /* TODO make use of the engine reference 'eng' when loading pkeys */ - if (ppkey != NULL) + if (ppkey != NULL) { *ppkey = NULL; - if (ppubkey != NULL) + cnt_expectations++; + expect = OSSL_STORE_INFO_PKEY; + } + if (ppubkey != NULL) { *ppubkey = NULL; - if (pcert != NULL) + cnt_expectations++; + expect = OSSL_STORE_INFO_PUBKEY; + } + if (pcert != NULL) { *pcert = NULL; + cnt_expectations++; + expect = OSSL_STORE_INFO_CERT; + } if (failed == NULL) { BIO_printf(bio_err, "Internal error: nothing to load into from %s\n", uri != NULL ? uri : "<stdin>"); @@ -735,13 +732,22 @@ int load_key_certs_crls(const char *uri, int maybe_stdin, && (*pcerts = sk_X509_new_null()) == NULL) { BIO_printf(bio_err, "Out of memory loading"); goto end; + } else { + cnt_expectations++; + expect = OSSL_STORE_INFO_CERT; } - if (pcrl != NULL) + if (pcrl != NULL) { *pcrl = NULL; + cnt_expectations++; + expect = OSSL_STORE_INFO_CRL; + } if (pcrls != NULL && *pcrls == NULL && (*pcrls = sk_X509_CRL_new_null()) == NULL) { BIO_printf(bio_err, "Out of memory loading"); goto end; + } else { + cnt_expectations++; + expect = OSSL_STORE_INFO_CRL; } uidata.password = pass; @@ -769,6 +775,11 @@ int load_key_certs_crls(const char *uri, int maybe_stdin, goto end; } + if (cnt_expectations != 1) + expect = 0; + if (!OSSL_STORE_expect(ctx, expect)) + goto end; + failed = NULL; while (!OSSL_STORE_eof(ctx)) { OSSL_STORE_INFO *info = OSSL_STORE_load(ctx); diff --git a/apps/lib/engine.c b/apps/lib/engine.c index 4d9adc2818..e4a65b04e2 100644 --- a/apps/lib/engine.c +++ b/apps/lib/engine.c @@ -102,48 +102,37 @@ int finish_engine(ENGINE *e) return rv; } -EVP_PKEY *load_engine_private_key(ENGINE *e, const char *keyid, - const char *pass, const char *desc) +char *make_engine_uri(ENGINE *e, const char *key_id, const char *desc) { - EVP_PKEY *rv = NULL; + char *new_uri = NULL; #ifndef OPENSSL_NO_ENGINE - if (init_engine(e)) { - PW_CB_DATA cb_data; - - cb_data.password = pass; - cb_data.prompt_info = keyid; - - rv = ENGINE_load_private_key(e, keyid, - (UI_METHOD *)get_ui_method(), &cb_data); - finish_engine(e); - } -#else - BIO_printf(bio_err, "Engines not supported for loading %s\n", desc); -#endif - return rv; -} - -EVP_PKEY *load_engine_public_key(ENGINE *e, const char *keyid, - const char *pass, const char *desc) -{ - EVP_PKEY *rv = NULL; - -#ifndef OPENSSL_NO_ENGINE - if (init_engine(e)) { - PW_CB_DATA cb_data; - - cb_data.password = pass; - cb_data.prompt_info = keyid; - - rv = ENGINE_load_public_key(e, keyid, - (UI_METHOD *)get_ui_method(), &cb_data); - finish_engine(e); + if (e == NULL) { + BIO_printf(bio_err, "No engine specified for loading %s\n", desc); + } else if (key_id == NULL) { + BIO_printf(bio_err, "No engine key id specified for loading %s\n", desc); + } else { + const char *engineid = ENGINE_get_id(e); + size_t uri_sz = + sizeof(ENGINE_SCHEME_COLON) - 1 + + strlen(engineid) + + 1 /* : */ + + strlen(key_id) + + 1 /* \0 */ + ; + + new_uri = OPENSSL_malloc(uri_sz); + if (new_uri != NULL) { + OPENSSL_strlcpy(new_uri, ENGINE_SCHEME_COLON, uri_sz); + OPENSSL_strlcat(new_uri, engineid, uri_sz); + OPENSSL_strlcat(new_uri, ":", uri_sz); + OPENSSL_strlcat(new_uri, key_id, uri_sz); + } } #else BIO_printf(bio_err, "Engines not supported for loading %s\n", desc); #endif - return rv; + return new_uri; } int get_legacy_pkey_id(OSSL_LIB_CTX *libctx, const char *algname, ENGINE *e) |