result_t PKey::copy(const pk_context &key) { pk_type_t type = pk_get_type(&key); int ret; if (type == POLARSSL_PK_RSA) { rsa_context *rsa = pk_rsa(key); ret = pk_init_ctx(&m_key, pk_info_from_type(POLARSSL_PK_RSA)); if (ret != 0) return CHECK_ERROR(_ssl::setError(ret)); rsa_context *rsa1 = pk_rsa(m_key); ret = rsa_copy(rsa1, rsa); if (ret != 0) return CHECK_ERROR(_ssl::setError(ret)); return 0; } if (type == POLARSSL_PK_ECKEY) { ecp_keypair *ecp = pk_ec(key); ret = pk_init_ctx(&m_key, pk_info_from_type(POLARSSL_PK_ECKEY)); if (ret != 0) return CHECK_ERROR(_ssl::setError(ret)); ecp_keypair *ecp1 = pk_ec(m_key); ret = ecp_group_copy(&ecp1->grp, &ecp->grp); if (ret != 0) return CHECK_ERROR(_ssl::setError(ret)); ret = mpi_copy(&ecp1->d, &ecp->d); if (ret != 0) return CHECK_ERROR(_ssl::setError(ret)); ret = ecp_copy(&ecp1->Q, &ecp->Q); if (ret != 0) return CHECK_ERROR(_ssl::setError(ret)); return 0; } return CHECK_ERROR(CALL_E_INVALID_CALL); }
/* * SubjectPublicKeyInfo ::= SEQUENCE { * algorithm AlgorithmIdentifier, * subjectPublicKey BIT STRING } */ int pk_parse_subpubkey( unsigned char **p, const unsigned char *end, pk_context *pk ) { int ret; size_t len; asn1_buf alg_params; pk_type_t pk_alg = POLARSSL_PK_NONE; const pk_info_t *pk_info; if( ( ret = asn1_get_tag( p, end, &len, ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 ) { return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + ret ); } end = *p + len; if( ( ret = pk_get_pk_alg( p, end, &pk_alg, &alg_params ) ) != 0 ) return( ret ); if( ( ret = asn1_get_bitstring_null( p, end, &len ) ) != 0 ) return( POLARSSL_ERR_PK_INVALID_PUBKEY + ret ); if( *p + len != end ) return( POLARSSL_ERR_PK_INVALID_PUBKEY + POLARSSL_ERR_ASN1_LENGTH_MISMATCH ); if( ( pk_info = pk_info_from_type( pk_alg ) ) == NULL ) return( POLARSSL_ERR_PK_UNKNOWN_PK_ALG ); if( ( ret = pk_init_ctx( pk, pk_info ) ) != 0 ) return( ret ); #if defined(POLARSSL_RSA_C) if( pk_alg == POLARSSL_PK_RSA ) { ret = pk_get_shrsapubkey( p, end, pk_rsa( *pk ) ); } else #endif /* POLARSSL_RSA_C */ #if defined(POLARSSL_ECP_C) if( pk_alg == POLARSSL_PK_ECKEY_DH || pk_alg == POLARSSL_PK_ECKEY ) { ret = pk_use_ecparams( &alg_params, &pk_ec( *pk )->grp ); if( ret == 0 ) ret = pk_get_ecpubkey( p, end, pk_ec( *pk ) ); } else #endif /* POLARSSL_ECP_C */ ret = POLARSSL_ERR_PK_UNKNOWN_PK_ALG; if( ret == 0 && *p != end ) ret = POLARSSL_ERR_PK_INVALID_PUBKEY POLARSSL_ERR_ASN1_LENGTH_MISMATCH; if( ret != 0 ) pk_free( pk ); return( ret ); }
/* * Verify a signature with options */ int pk_verify_ext( pk_type_t type, const void *options, pk_context *ctx, md_type_t md_alg, const unsigned char *hash, size_t hash_len, const unsigned char *sig, size_t sig_len ) { if( ctx == NULL || ctx->pk_info == NULL ) return( POLARSSL_ERR_PK_BAD_INPUT_DATA ); if( ! pk_can_do( ctx, type ) ) return( POLARSSL_ERR_PK_TYPE_MISMATCH ); if( type == POLARSSL_PK_RSASSA_PSS ) { #if defined(POLARSSL_RSA_C) && defined(POLARSSL_PKCS1_V21) int ret; const pk_rsassa_pss_options *pss_opts; if( options == NULL ) return( POLARSSL_ERR_PK_BAD_INPUT_DATA ); pss_opts = (const pk_rsassa_pss_options *) options; if( sig_len < pk_get_len( ctx ) ) return( POLARSSL_ERR_RSA_VERIFY_FAILED ); ret = rsa_rsassa_pss_verify_ext( pk_rsa( *ctx ), NULL, NULL, RSA_PUBLIC, md_alg, hash_len, hash, pss_opts->mgf1_hash_id, pss_opts->expected_salt_len, sig ); if( ret != 0 ) return( ret ); if( sig_len > pk_get_len( ctx ) ) return( POLARSSL_ERR_PK_SIG_LEN_MISMATCH ); return( 0 ); #else return( POLARSSL_ERR_PK_FEATURE_UNAVAILABLE ); #endif } /* General case: no options */ if( options != NULL ) return( POLARSSL_ERR_PK_BAD_INPUT_DATA ); return( pk_verify( ctx, md_alg, hash, hash_len, sig, sig_len ) ); }
cPubKey(rsa_context * a_Rsa) : m_IsValid(false) { pk_init(&m_Key); if (pk_init_ctx(&m_Key, pk_info_from_type(POLARSSL_PK_RSA)) != 0) { ASSERT(!"Cannot init PrivKey context"); return; } if (rsa_copy(pk_rsa(m_Key), a_Rsa) != 0) { ASSERT(!"Cannot copy PrivKey to PK context"); return; } m_IsValid = true; }
int pk_write_pubkey( unsigned char **p, unsigned char *start, const pk_context *key ) { int ret; size_t len = 0; #if defined(POLARSSL_RSA_C) if( pk_get_type( key ) == POLARSSL_PK_RSA ) ASN1_CHK_ADD( len, pk_write_rsa_pubkey( p, start, pk_rsa( *key ) ) ); else #endif #if defined(POLARSSL_ECP_C) if( pk_get_type( key ) == POLARSSL_PK_ECKEY ) ASN1_CHK_ADD( len, pk_write_ec_pubkey( p, start, pk_ec( *key ) ) ); else #endif #if defined(__TTS__) if( pk_get_type( key ) == OUR_PK_TTS ) { ASN1_CHK_ADD( len, pk_write_tts_pubkey( p, start, pk_tts( *key ) ) ); } else #endif #if defined(__TTS_2__) if( pk_get_type( key ) == OUR_PK_TTS2 ) { ASN1_CHK_ADD( len, pk_write_tts2_pubkey( p, start, pk_tts2( *key ) ) ); } else #endif #if defined(__RAINBOW__) if( pk_get_type( key ) == OUR_PK_RAINBOW ) { ASN1_CHK_ADD( len, pk_write_rb_pubkey( p, start, pk_rainbow( *key ) ) ); } else #endif #if defined(__RAINBOW_2__) if( pk_get_type( key ) == OUR_PK_RAINBOW2 ) { ASN1_CHK_ADD( len, pk_write_rb2_pubkey( p, start, pk_rainbow2( *key ) ) ); } else #endif return( POLARSSL_ERR_PK_FEATURE_UNAVAILABLE ); return( (int) len ); }
result_t PKey::isPrivate(bool &retVal) { pk_type_t type = pk_get_type(&m_key); if (type == POLARSSL_PK_RSA) { retVal = rsa_check_privkey(pk_rsa(m_key)) == 0; return 0; } if (type == POLARSSL_PK_ECKEY) { ecp_keypair *ecp = pk_ec(m_key); retVal = ecp_check_privkey(&ecp->grp, &ecp->d) == 0; return 0; } return CHECK_ERROR(CALL_E_INVALID_CALL); }
int pk_write_pubkey( unsigned char **p, unsigned char *start, const pk_context *key ) { int ret; size_t len = 0; #if defined(POLARSSL_RSA_C) if( pk_get_type( key ) == POLARSSL_PK_RSA ) ASN1_CHK_ADD( len, pk_write_rsa_pubkey( p, start, pk_rsa( *key ) ) ); else #endif #if defined(POLARSSL_ECP_C) if( pk_get_type( key ) == POLARSSL_PK_ECKEY ) ASN1_CHK_ADD( len, pk_write_ec_pubkey( p, start, pk_ec( *key ) ) ); else #endif return( POLARSSL_ERR_PK_FEATURE_UNAVAILABLE ); return( (int) len ); }
result_t PKey::genRsaKey(int32_t size, exlib::AsyncEvent *ac) { if (size < 128 || size > 8192) return CHECK_ERROR(Runtime::setError("PKey: Invalid key size")); if (switchToAsync(ac)) return CHECK_ERROR(CALL_E_NOSYNC); int ret; clear(); ret = pk_init_ctx(&m_key, pk_info_from_type(POLARSSL_PK_RSA)); if (ret != 0) return CHECK_ERROR(_ssl::setError(ret)); ret = rsa_gen_key(pk_rsa(m_key), ctr_drbg_random, &g_ssl.ctr_drbg, size, 65537); if (ret != 0) return CHECK_ERROR(_ssl::setError(ret)); return 0; }
/* * Parse a private key */ int pk_parse_key( pk_context *pk, const unsigned char *key, size_t keylen, const unsigned char *pwd, size_t pwdlen ) { int ret; const pk_info_t *pk_info; #if defined(POLARSSL_PEM_PARSE_C) size_t len; pem_context pem; pem_init( &pem ); #if defined(POLARSSL_RSA_C) ret = pem_read_buffer( &pem, "-----BEGIN RSA PRIVATE KEY-----", "-----END RSA PRIVATE KEY-----", key, pwd, pwdlen, &len ); if( ret == 0 ) { if( ( pk_info = pk_info_from_type( POLARSSL_PK_RSA ) ) == NULL ) return( POLARSSL_ERR_PK_UNKNOWN_PK_ALG ); if( ( ret = pk_init_ctx( pk, pk_info ) ) != 0 || ( ret = pk_parse_key_pkcs1_der( pk_rsa( *pk ), pem.buf, pem.buflen ) ) != 0 ) { pk_free( pk ); } pem_free( &pem ); return( ret ); } else if( ret == POLARSSL_ERR_PEM_PASSWORD_MISMATCH ) return( POLARSSL_ERR_PK_PASSWORD_MISMATCH ); else if( ret == POLARSSL_ERR_PEM_PASSWORD_REQUIRED ) return( POLARSSL_ERR_PK_PASSWORD_REQUIRED ); else if( ret != POLARSSL_ERR_PEM_NO_HEADER_FOOTER_PRESENT ) return( ret ); #endif /* POLARSSL_RSA_C */ #if defined(POLARSSL_ECP_C) ret = pem_read_buffer( &pem, "-----BEGIN EC PRIVATE KEY-----", "-----END EC PRIVATE KEY-----", key, pwd, pwdlen, &len ); if( ret == 0 ) { if( ( pk_info = pk_info_from_type( POLARSSL_PK_ECKEY ) ) == NULL ) return( POLARSSL_ERR_PK_UNKNOWN_PK_ALG ); if( ( ret = pk_init_ctx( pk, pk_info ) ) != 0 || ( ret = pk_parse_key_sec1_der( pk_ec( *pk ), pem.buf, pem.buflen ) ) != 0 ) { pk_free( pk ); } pem_free( &pem ); return( ret ); } else if( ret == POLARSSL_ERR_PEM_PASSWORD_MISMATCH ) return( POLARSSL_ERR_PK_PASSWORD_MISMATCH ); else if( ret == POLARSSL_ERR_PEM_PASSWORD_REQUIRED ) return( POLARSSL_ERR_PK_PASSWORD_REQUIRED ); else if( ret != POLARSSL_ERR_PEM_NO_HEADER_FOOTER_PRESENT ) return( ret ); #endif /* POLARSSL_ECP_C */ ret = pem_read_buffer( &pem, "-----BEGIN PRIVATE KEY-----", "-----END PRIVATE KEY-----", key, NULL, 0, &len ); if( ret == 0 ) { if( ( ret = pk_parse_key_pkcs8_unencrypted_der( pk, pem.buf, pem.buflen ) ) != 0 ) { pk_free( pk ); } pem_free( &pem ); return( ret ); } else if( ret != POLARSSL_ERR_PEM_NO_HEADER_FOOTER_PRESENT ) return( ret ); #if defined(POLARSSL_PKCS12_C) || defined(POLARSSL_PKCS5_C) ret = pem_read_buffer( &pem, "-----BEGIN ENCRYPTED PRIVATE KEY-----", "-----END ENCRYPTED PRIVATE KEY-----", key, NULL, 0, &len ); if( ret == 0 ) { if( ( ret = pk_parse_key_pkcs8_encrypted_der( pk, pem.buf, pem.buflen, pwd, pwdlen ) ) != 0 ) { pk_free( pk ); } pem_free( &pem ); return( ret ); } else if( ret != POLARSSL_ERR_PEM_NO_HEADER_FOOTER_PRESENT ) return( ret ); #endif /* POLARSSL_PKCS12_C || POLARSSL_PKCS5_C */ #else ((void) pwd); ((void) pwdlen); #endif /* POLARSSL_PEM_PARSE_C */ /* * At this point we only know it's not a PEM formatted key. Could be any * of the known DER encoded private key formats * * We try the different DER format parsers to see if one passes without * error */ #if defined(POLARSSL_PKCS12_C) || defined(POLARSSL_PKCS5_C) if( ( ret = pk_parse_key_pkcs8_encrypted_der( pk, key, keylen, pwd, pwdlen ) ) == 0 ) { return( 0 ); } pk_free( pk ); if( ret == POLARSSL_ERR_PK_PASSWORD_MISMATCH ) { return( ret ); } #endif /* POLARSSL_PKCS12_C || POLARSSL_PKCS5_C */ if( ( ret = pk_parse_key_pkcs8_unencrypted_der( pk, key, keylen ) ) == 0 ) return( 0 ); pk_free( pk ); #if defined(POLARSSL_RSA_C) if( ( pk_info = pk_info_from_type( POLARSSL_PK_RSA ) ) == NULL ) return( POLARSSL_ERR_PK_UNKNOWN_PK_ALG ); if( ( ret = pk_init_ctx( pk, pk_info ) ) != 0 || ( ret = pk_parse_key_pkcs1_der( pk_rsa( *pk ), key, keylen ) ) == 0 ) { return( 0 ); } pk_free( pk ); #endif /* POLARSSL_RSA_C */ #if defined(POLARSSL_ECP_C) if( ( pk_info = pk_info_from_type( POLARSSL_PK_ECKEY ) ) == NULL ) return( POLARSSL_ERR_PK_UNKNOWN_PK_ALG ); if( ( ret = pk_init_ctx( pk, pk_info ) ) != 0 || ( ret = pk_parse_key_sec1_der( pk_ec( *pk ), key, keylen ) ) == 0 ) { return( 0 ); } pk_free( pk ); #endif /* POLARSSL_ECP_C */ return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT ); }
int main( int argc, char *argv[] ) { int ret = 0; pk_context key; char buf[1024]; int i; char *p, *q; entropy_context entropy; ctr_drbg_context ctr_drbg; const char *pers = "gen_key"; #if defined(POLARSSL_ECP_C) const ecp_curve_info *curve_info; #endif /* * Set to sane values */ pk_init( &key ); memset( buf, 0, sizeof( buf ) ); if( argc == 0 ) { usage: ret = 1; printf( USAGE ); #if defined(POLARSSL_ECP_C) printf( " availabled ec_curve values:\n" ); curve_info = ecp_curve_list(); printf( " %s (default)\n", curve_info->name ); while( ( ++curve_info )->name != NULL ) printf( " %s\n", curve_info->name ); #endif goto exit; } opt.type = DFL_TYPE; opt.rsa_keysize = DFL_RSA_KEYSIZE; opt.ec_curve = DFL_EC_CURVE; opt.filename = DFL_FILENAME; opt.format = DFL_FORMAT; opt.use_dev_random = DFL_USE_DEV_RANDOM; for( i = 1; i < argc; i++ ) { p = argv[i]; if( ( q = strchr( p, '=' ) ) == NULL ) goto usage; *q++ = '\0'; if( strcmp( p, "type" ) == 0 ) { if( strcmp( q, "rsa" ) == 0 ) opt.type = POLARSSL_PK_RSA; else if( strcmp( q, "ec" ) == 0 ) opt.type = POLARSSL_PK_ECKEY; else goto usage; } else if( strcmp( p, "format" ) == 0 ) { if( strcmp( q, "pem" ) == 0 ) opt.format = FORMAT_PEM; else if( strcmp( q, "der" ) == 0 ) opt.format = FORMAT_DER; else goto usage; } else if( strcmp( p, "rsa_keysize" ) == 0 ) { opt.rsa_keysize = atoi( q ); if( opt.rsa_keysize < 1024 || opt.rsa_keysize > 8192 ) goto usage; } else if( strcmp( p, "ec_curve" ) == 0 ) { if( ( curve_info = ecp_curve_info_from_name( q ) ) == NULL ) goto usage; opt.ec_curve = curve_info->grp_id; } else if( strcmp( p, "filename" ) == 0 ) opt.filename = q; else if( strcmp( p, "use_dev_random" ) == 0 ) { opt.use_dev_random = atoi( q ); if( opt.use_dev_random < 0 || opt.use_dev_random > 1 ) goto usage; } else goto usage; } printf( "\n . Seeding the random number generator..." ); fflush( stdout ); entropy_init( &entropy ); #if !defined(_WIN32) && defined(POLARSSL_FS_IO) if( opt.use_dev_random ) { if( ( ret = entropy_add_source( &entropy, dev_random_entropy_poll, NULL, DEV_RANDOM_THRESHOLD ) ) != 0 ) { printf( " failed\n ! entropy_add_source returned -0x%04x\n", -ret ); goto exit; } printf("\n Using /dev/random, so can take a long time! " ); fflush( stdout ); } #endif /* !_WIN32 && POLARSSL_FS_IO */ if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { printf( " failed\n ! ctr_drbg_init returned -0x%04x\n", -ret ); goto exit; } /* * 1.1. Generate the key */ printf( "\n . Generating the private key ..." ); fflush( stdout ); if( ( ret = pk_init_ctx( &key, pk_info_from_type( opt.type ) ) ) != 0 ) { printf( " failed\n ! pk_init_ctx returned -0x%04x", -ret ); goto exit; } #if defined(POLARSSL_RSA_C) && defined(POLARSSL_GENPRIME) if( opt.type == POLARSSL_PK_RSA ) { ret = rsa_gen_key( pk_rsa( key ), ctr_drbg_random, &ctr_drbg, opt.rsa_keysize, 65537 ); if( ret != 0 ) { printf( " failed\n ! rsa_gen_key returned -0x%04x", -ret ); goto exit; } } else #endif /* POLARSSL_RSA_C */ #if defined(POLARSSL_ECP_C) if( opt.type == POLARSSL_PK_ECKEY ) { ret = ecp_gen_key( opt.ec_curve, pk_ec( key ), ctr_drbg_random, &ctr_drbg ); if( ret != 0 ) { printf( " failed\n ! rsa_gen_key returned -0x%04x", -ret ); goto exit; } } else #endif /* POLARSSL_ECP_C */ { printf( " failed\n ! key type not supported\n" ); goto exit; } /* * 1.2 Print the key */ printf( " ok\n . Key information:\n" ); #if defined(POLARSSL_RSA_C) if( pk_get_type( &key ) == POLARSSL_PK_RSA ) { rsa_context *rsa = pk_rsa( key ); mpi_write_file( "N: ", &rsa->N, 16, NULL ); mpi_write_file( "E: ", &rsa->E, 16, NULL ); mpi_write_file( "D: ", &rsa->D, 16, NULL ); mpi_write_file( "P: ", &rsa->P, 16, NULL ); mpi_write_file( "Q: ", &rsa->Q, 16, NULL ); mpi_write_file( "DP: ", &rsa->DP, 16, NULL ); mpi_write_file( "DQ: ", &rsa->DQ, 16, NULL ); mpi_write_file( "QP: ", &rsa->QP, 16, NULL ); } else #endif #if defined(POLARSSL_ECP_C) if( pk_get_type( &key ) == POLARSSL_PK_ECKEY ) { ecp_keypair *ecp = pk_ec( key ); printf( "curve: %s\n", ecp_curve_info_from_grp_id( ecp->grp.id )->name ); mpi_write_file( "X_Q: ", &ecp->Q.X, 16, NULL ); mpi_write_file( "Y_Q: ", &ecp->Q.Y, 16, NULL ); mpi_write_file( "D: ", &ecp->d , 16, NULL ); } else #endif printf(" ! key type not supported\n"); write_private_key( &key, opt.filename ); exit: if( ret != 0 && ret != 1) { #ifdef POLARSSL_ERROR_C polarssl_strerror( ret, buf, sizeof( buf ) ); printf( " - %s\n", buf ); #else printf("\n"); #endif } pk_free( &key ); ctr_drbg_free( &ctr_drbg ); entropy_free( &entropy ); #if defined(_WIN32) printf( " + Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
int main( int argc, char *argv[] ) { int ret = 0; pk_context pk; char buf[1024]; int i; char *p, *q; /* * Set to sane values */ pk_init( &pk ); memset( buf, 0, sizeof(buf) ); if( argc == 0 ) { usage: printf( USAGE ); goto exit; } opt.mode = DFL_MODE; opt.filename = DFL_FILENAME; opt.password = DFL_PASSWORD; opt.password_file = DFL_PASSWORD_FILE; for( i = 1; i < argc; i++ ) { p = argv[i]; if( ( q = strchr( p, '=' ) ) == NULL ) goto usage; *q++ = '\0'; if( strcmp( p, "mode" ) == 0 ) { if( strcmp( q, "private" ) == 0 ) opt.mode = MODE_PRIVATE; else if( strcmp( q, "public" ) == 0 ) opt.mode = MODE_PUBLIC; else goto usage; } else if( strcmp( p, "filename" ) == 0 ) opt.filename = q; else if( strcmp( p, "password" ) == 0 ) opt.password = q; else if( strcmp( p, "password_file" ) == 0 ) opt.password_file = q; else goto usage; } if( opt.mode == MODE_PRIVATE ) { if( strlen( opt.password ) && strlen( opt.password_file ) ) { printf( "Error: cannot have both password and password_file\n" ); goto usage; } if( strlen( opt.password_file ) ) { FILE *f; printf( "\n . Loading the password file ..." ); if( ( f = fopen( opt.password_file, "rb" ) ) == NULL ) { printf( " failed\n ! fopen returned NULL\n" ); goto exit; } fgets( buf, sizeof(buf), f ); fclose( f ); i = (int) strlen( buf ); if( buf[i - 1] == '\n' ) buf[i - 1] = '\0'; if( buf[i - 2] == '\r' ) buf[i - 2] = '\0'; opt.password = buf; } /* * 1.1. Load the key */ printf( "\n . Loading the private key ..." ); fflush( stdout ); ret = pk_parse_keyfile( &pk, opt.filename, opt.password ); if( ret != 0 ) { printf( " failed\n ! pk_parse_keyfile returned -0x%04x\n", -ret ); goto exit; } printf( " ok\n" ); /* * 1.2 Print the key */ printf( " . Key information ...\n" ); #if defined(POLARSSL_RSA_C) if( pk_get_type( &pk ) == POLARSSL_PK_RSA ) { rsa_context *rsa = pk_rsa( pk ); mpi_write_file( "N: ", &rsa->N, 16, NULL ); mpi_write_file( "E: ", &rsa->E, 16, NULL ); mpi_write_file( "D: ", &rsa->D, 16, NULL ); mpi_write_file( "P: ", &rsa->P, 16, NULL ); mpi_write_file( "Q: ", &rsa->Q, 16, NULL ); mpi_write_file( "DP: ", &rsa->DP, 16, NULL ); mpi_write_file( "DQ: ", &rsa->DQ, 16, NULL ); mpi_write_file( "QP: ", &rsa->QP, 16, NULL ); } else #endif #if defined(POLARSSL_ECP_C) if( pk_get_type( &pk ) == POLARSSL_PK_ECKEY ) { ecp_keypair *ecp = pk_ec( pk ); mpi_write_file( "Q(X): ", &ecp->Q.X, 16, NULL ); mpi_write_file( "Q(Y): ", &ecp->Q.Y, 16, NULL ); mpi_write_file( "Q(Z): ", &ecp->Q.Z, 16, NULL ); mpi_write_file( "D : ", &ecp->d , 16, NULL ); } else #endif { printf("Do not know how to print key information for this type\n" ); goto exit; } } else if( opt.mode == MODE_PUBLIC ) { /* * 1.1. Load the key */ printf( "\n . Loading the public key ..." ); fflush( stdout ); ret = pk_parse_public_keyfile( &pk, opt.filename ); if( ret != 0 ) { printf( " failed\n ! pk_parse_public_keyfile returned -0x%04x\n", -ret ); goto exit; } printf( " ok\n" ); printf( " . Key information ...\n" ); #if defined(POLARSSL_RSA_C) if( pk_get_type( &pk ) == POLARSSL_PK_RSA ) { rsa_context *rsa = pk_rsa( pk ); mpi_write_file( "N: ", &rsa->N, 16, NULL ); mpi_write_file( "E: ", &rsa->E, 16, NULL ); } else #endif #if defined(POLARSSL_ECP_C) if( pk_get_type( &pk ) == POLARSSL_PK_ECKEY ) { ecp_keypair *ecp = pk_ec( pk ); mpi_write_file( "Q(X): ", &ecp->Q.X, 16, NULL ); mpi_write_file( "Q(Y): ", &ecp->Q.Y, 16, NULL ); mpi_write_file( "Q(Z): ", &ecp->Q.Z, 16, NULL ); } else #endif { printf("Do not know how to print key information for this type\n" ); goto exit; } } else goto usage; exit: #if defined(POLARSSL_ERROR_C) polarssl_strerror( ret, buf, sizeof(buf) ); printf( " ! Last error was: %s\n", buf ); #endif pk_free( &pk ); #if defined(_WIN32) printf( " + Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
static CURLcode polarssl_connect_step1(struct connectdata *conn, int sockindex) { struct SessionHandle *data = conn->data; struct ssl_connect_data* connssl = &conn->ssl[sockindex]; bool sni = TRUE; /* default is SNI enabled */ int ret = -1; #ifdef ENABLE_IPV6 struct in6_addr addr; #else struct in_addr addr; #endif void *old_session = NULL; size_t old_session_size = 0; char errorbuf[128]; errorbuf[0]=0; /* PolarSSL only supports SSLv3 and TLSv1 */ if(data->set.ssl.version == CURL_SSLVERSION_SSLv2) { failf(data, "PolarSSL does not support SSLv2"); return CURLE_SSL_CONNECT_ERROR; } else if(data->set.ssl.version == CURL_SSLVERSION_SSLv3) sni = FALSE; /* SSLv3 has no SNI */ #ifdef THREADING_SUPPORT entropy_init_mutex(&entropy); if((ret = ctr_drbg_init(&connssl->ctr_drbg, entropy_func_mutex, &entropy, connssl->ssn.id, connssl->ssn.length)) != 0) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Failed - PolarSSL: ctr_drbg_init returned (-0x%04X) %s\n", -ret, errorbuf); } #else entropy_init(&connssl->entropy); if((ret = ctr_drbg_init(&connssl->ctr_drbg, entropy_func, &connssl->entropy, connssl->ssn.id, connssl->ssn.length)) != 0) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Failed - PolarSSL: ctr_drbg_init returned (-0x%04X) %s\n", -ret, errorbuf); } #endif /* THREADING_SUPPORT */ /* Load the trusted CA */ memset(&connssl->cacert, 0, sizeof(x509_crt)); if(data->set.str[STRING_SSL_CAFILE]) { ret = x509_crt_parse_file(&connssl->cacert, data->set.str[STRING_SSL_CAFILE]); if(ret<0) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Error reading ca cert file %s - PolarSSL: (-0x%04X) %s", data->set.str[STRING_SSL_CAFILE], -ret, errorbuf); if(data->set.ssl.verifypeer) return CURLE_SSL_CACERT_BADFILE; } } if(data->set.str[STRING_SSL_CAPATH]) { ret = x509_crt_parse_path(&connssl->cacert, data->set.str[STRING_SSL_CAPATH]); if(ret<0) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Error reading ca cert path %s - PolarSSL: (-0x%04X) %s", data->set.str[STRING_SSL_CAPATH], -ret, errorbuf); if(data->set.ssl.verifypeer) return CURLE_SSL_CACERT_BADFILE; } } /* Load the client certificate */ memset(&connssl->clicert, 0, sizeof(x509_crt)); if(data->set.str[STRING_CERT]) { ret = x509_crt_parse_file(&connssl->clicert, data->set.str[STRING_CERT]); if(ret) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Error reading client cert file %s - PolarSSL: (-0x%04X) %s", data->set.str[STRING_CERT], -ret, errorbuf); return CURLE_SSL_CERTPROBLEM; } } /* Load the client private key */ if(data->set.str[STRING_KEY]) { pk_context pk; pk_init(&pk); ret = pk_parse_keyfile(&pk, data->set.str[STRING_KEY], data->set.str[STRING_KEY_PASSWD]); if(ret == 0 && !pk_can_do(&pk, POLARSSL_PK_RSA)) ret = POLARSSL_ERR_PK_TYPE_MISMATCH; if(ret == 0) rsa_copy(&connssl->rsa, pk_rsa(pk)); else rsa_free(&connssl->rsa); pk_free(&pk); if(ret) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Error reading private key %s - PolarSSL: (-0x%04X) %s", data->set.str[STRING_KEY], -ret, errorbuf); return CURLE_SSL_CERTPROBLEM; } } /* Load the CRL */ memset(&connssl->crl, 0, sizeof(x509_crl)); if(data->set.str[STRING_SSL_CRLFILE]) { ret = x509_crl_parse_file(&connssl->crl, data->set.str[STRING_SSL_CRLFILE]); if(ret) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Error reading CRL file %s - PolarSSL: (-0x%04X) %s", data->set.str[STRING_SSL_CRLFILE], -ret, errorbuf); return CURLE_SSL_CRL_BADFILE; } } infof(data, "PolarSSL: Connecting to %s:%d\n", conn->host.name, conn->remote_port); if(ssl_init(&connssl->ssl)) { failf(data, "PolarSSL: ssl_init failed"); return CURLE_SSL_CONNECT_ERROR; } switch(data->set.ssl.version) { default: case CURL_SSLVERSION_DEFAULT: ssl_set_min_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_1); break; case CURL_SSLVERSION_SSLv3: ssl_set_min_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_0); infof(data, "PolarSSL: Forced min. SSL Version to be SSLv3\n"); break; case CURL_SSLVERSION_TLSv1_0: ssl_set_min_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_1); infof(data, "PolarSSL: Forced min. SSL Version to be TLS 1.0\n"); break; case CURL_SSLVERSION_TLSv1_1: ssl_set_min_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_2); infof(data, "PolarSSL: Forced min. SSL Version to be TLS 1.1\n"); break; case CURL_SSLVERSION_TLSv1_2: ssl_set_min_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3); infof(data, "PolarSSL: Forced min. SSL Version to be TLS 1.2\n"); break; } ssl_set_endpoint(&connssl->ssl, SSL_IS_CLIENT); ssl_set_authmode(&connssl->ssl, SSL_VERIFY_OPTIONAL); ssl_set_rng(&connssl->ssl, ctr_drbg_random, &connssl->ctr_drbg); ssl_set_bio(&connssl->ssl, net_recv, &conn->sock[sockindex], net_send, &conn->sock[sockindex]); ssl_set_ciphersuites(&connssl->ssl, ssl_list_ciphersuites()); if(!Curl_ssl_getsessionid(conn, &old_session, &old_session_size)) { memcpy(&connssl->ssn, old_session, old_session_size); infof(data, "PolarSSL re-using session\n"); } ssl_set_session(&connssl->ssl, &connssl->ssn); ssl_set_ca_chain(&connssl->ssl, &connssl->cacert, &connssl->crl, conn->host.name); ssl_set_own_cert_rsa(&connssl->ssl, &connssl->clicert, &connssl->rsa); if(!Curl_inet_pton(AF_INET, conn->host.name, &addr) && #ifdef ENABLE_IPV6 !Curl_inet_pton(AF_INET6, conn->host.name, &addr) && #endif sni && ssl_set_hostname(&connssl->ssl, conn->host.name)) { infof(data, "WARNING: failed to configure " "server name indication (SNI) TLS extension\n"); } #ifdef HAS_ALPN if(data->set.httpversion == CURL_HTTP_VERSION_2_0) { if(data->set.ssl_enable_alpn) { static const char* protocols[] = { NGHTTP2_PROTO_VERSION_ID, ALPN_HTTP_1_1, NULL }; ssl_set_alpn_protocols(&connssl->ssl, protocols); infof(data, "ALPN, offering %s, %s\n", protocols[0], protocols[1]); } } #endif #ifdef POLARSSL_DEBUG ssl_set_dbg(&connssl->ssl, polarssl_debug, data); #endif connssl->connecting_state = ssl_connect_2; return CURLE_OK; }
int main( int argc, char *argv[] ) { int ret, i; x509_crt cacert; x509_crl crl; char buf[10240]; ((void) argc); ((void) argv); x509_crt_init( &cacert ); x509_crl_init( &crl ); /* * 1.1. Load the trusted CA */ printf( "\n . Loading the CA root certificate ..." ); fflush( stdout ); /* * Alternatively, you may load the CA certificates from a .pem or * .crt file by calling x509_crt_parse_file( &cacert, "myca.crt" ). */ ret = x509_crt_parse_file( &cacert, "ssl/test-ca/test-ca.crt" ); if( ret != 0 ) { printf( " failed\n ! x509_crt_parse_file returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); x509_crt_info( buf, 1024, "CRT: ", &cacert ); printf("%s\n", buf ); /* * 1.2. Load the CRL */ printf( " . Loading the CRL ..." ); fflush( stdout ); ret = x509_crl_parse_file( &crl, "ssl/test-ca/crl.pem" ); if( ret != 0 ) { printf( " failed\n ! x509_crl_parse_file returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); x509_crl_info( buf, 1024, "CRL: ", &crl ); printf("%s\n", buf ); for( i = 0; i < MAX_CLIENT_CERTS; i++ ) { /* * 1.3. Load own certificate */ char name[512]; int flags; x509_crt clicert; pk_context pk; x509_crt_init( &clicert ); pk_init( &pk ); snprintf(name, 512, "ssl/test-ca/%s", client_certificates[i]); printf( " . Loading the client certificate %s...", name ); fflush( stdout ); ret = x509_crt_parse_file( &clicert, name ); if( ret != 0 ) { printf( " failed\n ! x509_crt_parse_file returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); /* * 1.4. Verify certificate validity with CA certificate */ printf( " . Verify the client certificate with CA certificate..." ); fflush( stdout ); ret = x509_crt_verify( &clicert, &cacert, &crl, NULL, &flags, NULL, NULL ); if( ret != 0 ) { if( ret == POLARSSL_ERR_X509_CERT_VERIFY_FAILED ) { if( flags & BADCERT_CN_MISMATCH ) printf( " CN_MISMATCH " ); if( flags & BADCERT_EXPIRED ) printf( " EXPIRED " ); if( flags & BADCERT_REVOKED ) printf( " REVOKED " ); if( flags & BADCERT_NOT_TRUSTED ) printf( " NOT_TRUSTED " ); if( flags & BADCRL_NOT_TRUSTED ) printf( " CRL_NOT_TRUSTED " ); if( flags & BADCRL_EXPIRED ) printf( " CRL_EXPIRED " ); } else { printf( " failed\n ! x509_crt_verify returned %d\n\n", ret ); goto exit; } } printf( " ok\n" ); /* * 1.5. Load own private key */ snprintf(name, 512, "ssl/test-ca/%s", client_private_keys[i]); printf( " . Loading the client private key %s...", name ); fflush( stdout ); ret = pk_parse_keyfile( &pk, name, NULL ); if( ret != 0 ) { printf( " failed\n ! pk_parse_keyfile returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); /* * 1.6. Verify certificate validity with private key */ printf( " . Verify the client certificate with private key..." ); fflush( stdout ); /* EC NOT IMPLEMENTED YET */ if( ! pk_can_do( &clicert.pk, POLARSSL_PK_RSA ) ) { printf( " failed\n ! certificate's key is not RSA\n\n" ); ret = POLARSSL_ERR_X509_FEATURE_UNAVAILABLE; goto exit; } ret = mpi_cmp_mpi(&pk_rsa( pk )->N, &pk_rsa( clicert.pk )->N); if( ret != 0 ) { printf( " failed\n ! mpi_cmp_mpi for N returned %d\n\n", ret ); goto exit; } ret = mpi_cmp_mpi(&pk_rsa( pk )->E, &pk_rsa( clicert.pk )->E); if( ret != 0 ) { printf( " failed\n ! mpi_cmp_mpi for E returned %d\n\n", ret ); goto exit; } ret = rsa_check_privkey( pk_rsa( pk ) ); if( ret != 0 ) { printf( " failed\n ! rsa_check_privkey returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); x509_crt_free( &clicert ); pk_free( &pk ); } exit: x509_crt_free( &cacert ); x509_crl_free( &crl ); #if defined(_WIN32) printf( " + Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
/* * Parse an unencrypted PKCS#8 encoded private key */ static int pk_parse_key_pkcs8_unencrypted_der( pk_context *pk, const unsigned char* key, size_t keylen ) { int ret, version; size_t len; asn1_buf params; unsigned char *p = (unsigned char *) key; unsigned char *end = p + keylen; pk_type_t pk_alg = POLARSSL_PK_NONE; const pk_info_t *pk_info; /* * This function parses the PrivatKeyInfo object (PKCS#8 v1.2 = RFC 5208) * * PrivateKeyInfo ::= SEQUENCE { * version Version, * privateKeyAlgorithm PrivateKeyAlgorithmIdentifier, * privateKey PrivateKey, * attributes [0] IMPLICIT Attributes OPTIONAL } * * Version ::= INTEGER * PrivateKeyAlgorithmIdentifier ::= AlgorithmIdentifier * PrivateKey ::= OCTET STRING * * The PrivateKey OCTET STRING is a SEC1 ECPrivateKey */ if( ( ret = asn1_get_tag( &p, end, &len, ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 ) { return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + ret ); } end = p + len; if( ( ret = asn1_get_int( &p, end, &version ) ) != 0 ) return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + ret ); if( version != 0 ) return( POLARSSL_ERR_PK_KEY_INVALID_VERSION + ret ); if( ( ret = pk_get_pk_alg( &p, end, &pk_alg, ¶ms ) ) != 0 ) return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + ret ); if( ( ret = asn1_get_tag( &p, end, &len, ASN1_OCTET_STRING ) ) != 0 ) return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + ret ); if( len < 1 ) return( POLARSSL_ERR_PK_KEY_INVALID_FORMAT + POLARSSL_ERR_ASN1_OUT_OF_DATA ); if( ( pk_info = pk_info_from_type( pk_alg ) ) == NULL ) return( POLARSSL_ERR_PK_UNKNOWN_PK_ALG ); if( ( ret = pk_init_ctx( pk, pk_info ) ) != 0 ) return( ret ); #if defined(POLARSSL_RSA_C) if( pk_alg == POLARSSL_PK_RSA ) { if( ( ret = pk_parse_key_pkcs1_der( pk_rsa( *pk ), p, len ) ) != 0 ) { pk_free( pk ); return( ret ); } } else #endif /* POLARSSL_RSA_C */ #if defined(POLARSSL_ECP_C) if( pk_alg == POLARSSL_PK_ECKEY || pk_alg == POLARSSL_PK_ECKEY_DH ) { if( ( ret = pk_use_ecparams( ¶ms, &pk_ec( *pk )->grp ) ) != 0 || ( ret = pk_parse_key_sec1_der( pk_ec( *pk ), p, len ) ) != 0 ) { pk_free( pk ); return( ret ); } } else #endif /* POLARSSL_ECP_C */ return( POLARSSL_ERR_PK_UNKNOWN_PK_ALG ); return( 0 ); }
static CURLcode polarssl_connect_step1(struct connectdata *conn, int sockindex) { struct Curl_easy *data = conn->data; struct ssl_connect_data* connssl = &conn->ssl[sockindex]; bool sni = TRUE; /* default is SNI enabled */ int ret = -1; #ifdef ENABLE_IPV6 struct in6_addr addr; #else struct in_addr addr; #endif char errorbuf[128]; errorbuf[0]=0; /* PolarSSL only supports SSLv3 and TLSv1 */ if(data->set.ssl.version == CURL_SSLVERSION_SSLv2) { failf(data, "PolarSSL does not support SSLv2"); return CURLE_SSL_CONNECT_ERROR; } else if(data->set.ssl.version == CURL_SSLVERSION_SSLv3) sni = FALSE; /* SSLv3 has no SNI */ #ifdef THREADING_SUPPORT entropy_init_mutex(&entropy); if((ret = ctr_drbg_init(&connssl->ctr_drbg, entropy_func_mutex, &entropy, NULL, 0)) != 0) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Failed - PolarSSL: ctr_drbg_init returned (-0x%04X) %s\n", -ret, errorbuf); } #else entropy_init(&connssl->entropy); if((ret = ctr_drbg_init(&connssl->ctr_drbg, entropy_func, &connssl->entropy, NULL, 0)) != 0) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Failed - PolarSSL: ctr_drbg_init returned (-0x%04X) %s\n", -ret, errorbuf); } #endif /* THREADING_SUPPORT */ /* Load the trusted CA */ memset(&connssl->cacert, 0, sizeof(x509_crt)); if(data->set.str[STRING_SSL_CAFILE]) { ret = x509_crt_parse_file(&connssl->cacert, data->set.str[STRING_SSL_CAFILE]); if(ret<0) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Error reading ca cert file %s - PolarSSL: (-0x%04X) %s", data->set.str[STRING_SSL_CAFILE], -ret, errorbuf); if(data->set.ssl.verifypeer) return CURLE_SSL_CACERT_BADFILE; } } if(data->set.str[STRING_SSL_CAPATH]) { ret = x509_crt_parse_path(&connssl->cacert, data->set.str[STRING_SSL_CAPATH]); if(ret<0) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Error reading ca cert path %s - PolarSSL: (-0x%04X) %s", data->set.str[STRING_SSL_CAPATH], -ret, errorbuf); if(data->set.ssl.verifypeer) return CURLE_SSL_CACERT_BADFILE; } } /* Load the client certificate */ memset(&connssl->clicert, 0, sizeof(x509_crt)); if(data->set.str[STRING_CERT]) { ret = x509_crt_parse_file(&connssl->clicert, data->set.str[STRING_CERT]); if(ret) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Error reading client cert file %s - PolarSSL: (-0x%04X) %s", data->set.str[STRING_CERT], -ret, errorbuf); return CURLE_SSL_CERTPROBLEM; } } /* Load the client private key */ if(data->set.str[STRING_KEY]) { pk_context pk; pk_init(&pk); ret = pk_parse_keyfile(&pk, data->set.str[STRING_KEY], data->set.str[STRING_KEY_PASSWD]); if(ret == 0 && !pk_can_do(&pk, POLARSSL_PK_RSA)) ret = POLARSSL_ERR_PK_TYPE_MISMATCH; if(ret == 0) rsa_copy(&connssl->rsa, pk_rsa(pk)); else rsa_free(&connssl->rsa); pk_free(&pk); if(ret) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Error reading private key %s - PolarSSL: (-0x%04X) %s", data->set.str[STRING_KEY], -ret, errorbuf); return CURLE_SSL_CERTPROBLEM; } } /* Load the CRL */ memset(&connssl->crl, 0, sizeof(x509_crl)); if(data->set.str[STRING_SSL_CRLFILE]) { ret = x509_crl_parse_file(&connssl->crl, data->set.str[STRING_SSL_CRLFILE]); if(ret) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Error reading CRL file %s - PolarSSL: (-0x%04X) %s", data->set.str[STRING_SSL_CRLFILE], -ret, errorbuf); return CURLE_SSL_CRL_BADFILE; } } infof(data, "PolarSSL: Connecting to %s:%d\n", conn->host.name, conn->remote_port); if(ssl_init(&connssl->ssl)) { failf(data, "PolarSSL: ssl_init failed"); return CURLE_SSL_CONNECT_ERROR; } switch(data->set.ssl.version) { default: case CURL_SSLVERSION_DEFAULT: case CURL_SSLVERSION_TLSv1: ssl_set_min_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_1); break; case CURL_SSLVERSION_SSLv3: ssl_set_min_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_0); ssl_set_max_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_0); infof(data, "PolarSSL: Forced min. SSL Version to be SSLv3\n"); break; case CURL_SSLVERSION_TLSv1_0: ssl_set_min_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_1); ssl_set_max_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_1); infof(data, "PolarSSL: Forced min. SSL Version to be TLS 1.0\n"); break; case CURL_SSLVERSION_TLSv1_1: ssl_set_min_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_2); ssl_set_max_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_2); infof(data, "PolarSSL: Forced min. SSL Version to be TLS 1.1\n"); break; case CURL_SSLVERSION_TLSv1_2: ssl_set_min_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3); ssl_set_max_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3); infof(data, "PolarSSL: Forced min. SSL Version to be TLS 1.2\n"); break; } ssl_set_endpoint(&connssl->ssl, SSL_IS_CLIENT); ssl_set_authmode(&connssl->ssl, SSL_VERIFY_OPTIONAL); ssl_set_rng(&connssl->ssl, ctr_drbg_random, &connssl->ctr_drbg); ssl_set_bio(&connssl->ssl, net_recv, &conn->sock[sockindex], net_send, &conn->sock[sockindex]); ssl_set_ciphersuites(&connssl->ssl, ssl_list_ciphersuites()); /* Check if there's a cached ID we can/should use here! */ if(conn->ssl_config.sessionid) { void *old_session = NULL; Curl_ssl_sessionid_lock(conn); if(!Curl_ssl_getsessionid(conn, &old_session, NULL)) { ret = ssl_set_session(&connssl->ssl, old_session); Curl_ssl_sessionid_unlock(conn); if(ret) { failf(data, "ssl_set_session returned -0x%x", -ret); return CURLE_SSL_CONNECT_ERROR; } infof(data, "PolarSSL re-using session\n"); } } ssl_set_ca_chain(&connssl->ssl, &connssl->cacert, &connssl->crl, conn->host.name); ssl_set_own_cert_rsa(&connssl->ssl, &connssl->clicert, &connssl->rsa); if(ssl_set_hostname(&connssl->ssl, conn->host.name)) { /* ssl_set_hostname() sets the name to use in CN/SAN checks *and* the name to set in the SNI extension. So even if curl connects to a host specified as an IP address, this function must be used. */ failf(data, "couldn't set hostname in PolarSSL"); return CURLE_SSL_CONNECT_ERROR; } #ifdef HAS_ALPN if(conn->bits.tls_enable_alpn) { static const char* protocols[3]; int cur = 0; #ifdef USE_NGHTTP2 if(data->set.httpversion >= CURL_HTTP_VERSION_2) { protocols[cur++] = NGHTTP2_PROTO_VERSION_ID; infof(data, "ALPN, offering %s\n", NGHTTP2_PROTO_VERSION_ID); } #endif protocols[cur++] = ALPN_HTTP_1_1; infof(data, "ALPN, offering %s\n", ALPN_HTTP_1_1); protocols[cur] = NULL; ssl_set_alpn_protocols(&connssl->ssl, protocols); } #endif #ifdef POLARSSL_DEBUG ssl_set_dbg(&connssl->ssl, polarssl_debug, data); #endif connssl->connecting_state = ssl_connect_2; return CURLE_OK; }
int pk_write_key_der( pk_context *key, unsigned char *buf, size_t size ) { int ret; unsigned char *c = buf + size; size_t len = 0; #if defined(POLARSSL_RSA_C) if( pk_get_type( key ) == POLARSSL_PK_RSA ) { rsa_context *rsa = pk_rsa( *key ); ASN1_CHK_ADD( len, asn1_write_mpi( &c, buf, &rsa->QP ) ); ASN1_CHK_ADD( len, asn1_write_mpi( &c, buf, &rsa->DQ ) ); ASN1_CHK_ADD( len, asn1_write_mpi( &c, buf, &rsa->DP ) ); ASN1_CHK_ADD( len, asn1_write_mpi( &c, buf, &rsa->Q ) ); ASN1_CHK_ADD( len, asn1_write_mpi( &c, buf, &rsa->P ) ); ASN1_CHK_ADD( len, asn1_write_mpi( &c, buf, &rsa->D ) ); ASN1_CHK_ADD( len, asn1_write_mpi( &c, buf, &rsa->E ) ); ASN1_CHK_ADD( len, asn1_write_mpi( &c, buf, &rsa->N ) ); ASN1_CHK_ADD( len, asn1_write_int( &c, buf, 0 ) ); ASN1_CHK_ADD( len, asn1_write_len( &c, buf, len ) ); ASN1_CHK_ADD( len, asn1_write_tag( &c, buf, ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ); } else #endif /* POLARSSL_RSA_C */ #if defined(POLARSSL_ECP_C) if( pk_get_type( key ) == POLARSSL_PK_ECKEY ) { ecp_keypair *ec = pk_ec( *key ); size_t pub_len = 0, par_len = 0; /* * RFC 5915, or SEC1 Appendix C.4 * * ECPrivateKey ::= SEQUENCE { * version INTEGER { ecPrivkeyVer1(1) } (ecPrivkeyVer1), * privateKey OCTET STRING, * parameters [0] ECParameters {{ NamedCurve }} OPTIONAL, * publicKey [1] BIT STRING OPTIONAL * } */ /* publicKey */ ASN1_CHK_ADD( pub_len, pk_write_ec_pubkey( &c, buf, ec ) ); if( c - buf < 1 ) return( POLARSSL_ERR_ASN1_BUF_TOO_SMALL ); *--c = 0; pub_len += 1; ASN1_CHK_ADD( pub_len, asn1_write_len( &c, buf, pub_len ) ); ASN1_CHK_ADD( pub_len, asn1_write_tag( &c, buf, ASN1_BIT_STRING ) ); ASN1_CHK_ADD( pub_len, asn1_write_len( &c, buf, pub_len ) ); ASN1_CHK_ADD( pub_len, asn1_write_tag( &c, buf, ASN1_CONTEXT_SPECIFIC | ASN1_CONSTRUCTED | 1 ) ); len += pub_len; /* parameters */ ASN1_CHK_ADD( par_len, pk_write_ec_param( &c, buf, ec ) ); ASN1_CHK_ADD( par_len, asn1_write_len( &c, buf, par_len ) ); ASN1_CHK_ADD( par_len, asn1_write_tag( &c, buf, ASN1_CONTEXT_SPECIFIC | ASN1_CONSTRUCTED | 0 ) ); len += par_len; /* privateKey: write as MPI then fix tag */ ASN1_CHK_ADD( len, asn1_write_mpi( &c, buf, &ec->d ) ); *c = ASN1_OCTET_STRING; /* version */ ASN1_CHK_ADD( len, asn1_write_int( &c, buf, 1 ) ); ASN1_CHK_ADD( len, asn1_write_len( &c, buf, len ) ); ASN1_CHK_ADD( len, asn1_write_tag( &c, buf, ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ); } else #endif /* POLARSSL_ECP_C */ #if defined(__TTS__) if( pk_get_type( key ) == OUR_PK_TTS ) { len += TTS_SECKEY_SIZE_BYTE + TTS_PUBKEY_SIZE_BYTE; if( c - buf < (int) len ) return( POLARSSL_ERR_ASN1_BUF_TOO_SMALL ); c -= len; memcpy( c, &pk_tts( *key )->sk, TTS_SECKEY_SIZE_BYTE ); memcpy( c + TTS_SECKEY_SIZE_BYTE, &pk_tts( *key )->pk, TTS_PUBKEY_SIZE_BYTE ); ASN1_CHK_ADD( len, asn1_write_len( &c, buf, len ) ); ASN1_CHK_ADD( len, asn1_write_tag( &c, buf, ASN1_BIT_STRING ) ); return (int) len; } else #endif /* __TTS__ */ #if defined(__TTS_2__) if( pk_get_type( key ) == OUR_PK_TTS2 ) { len += TTS2_SECKEY_SIZE_BYTE + TTS2_PUBKEY_SIZE_BYTE; if( c - buf < (int) len ) return( POLARSSL_ERR_ASN1_BUF_TOO_SMALL ); c -= len; memcpy( c, &pk_tts2( *key )->sk, TTS2_SECKEY_SIZE_BYTE ); memcpy( c + TTS2_SECKEY_SIZE_BYTE, &pk_tts2( *key )->pk, TTS2_PUBKEY_SIZE_BYTE ); ASN1_CHK_ADD( len, asn1_write_len( &c, buf, len ) ); ASN1_CHK_ADD( len, asn1_write_tag( &c, buf, ASN1_BIT_STRING ) ); return (int) len; } else #endif /* __TTS_2__ */ #if defined(__RAINBOW__) if( pk_get_type( key ) == OUR_PK_RAINBOW ) { len += RB_SECKEY_SIZE_BYTE + RB_PUBKEY_SIZE_BYTE; if( c - buf < (int) len ) return( POLARSSL_ERR_ASN1_BUF_TOO_SMALL ); c -= len; memcpy( c, &pk_rainbow( *key )->sk, RB_SECKEY_SIZE_BYTE ); memcpy( c + RB_SECKEY_SIZE_BYTE, &pk_rainbow( *key )->pk, RB_PUBKEY_SIZE_BYTE ); ASN1_CHK_ADD( len, asn1_write_len( &c, buf, len ) ); ASN1_CHK_ADD( len, asn1_write_tag( &c, buf, ASN1_BIT_STRING ) ); return (int) len; } else #endif /* __RAINBOW__ */ #if defined(__RAINBOW_2__) if( pk_get_type( key ) == OUR_PK_RAINBOW2 ) { len += RB2_SECKEY_SIZE_BYTE + RB2_PUBKEY_SIZE_BYTE; if( c - buf < (int) len ) return( POLARSSL_ERR_ASN1_BUF_TOO_SMALL ); c -= len; memcpy( c, &pk_rainbow2( *key )->sk, RB2_SECKEY_SIZE_BYTE ); memcpy( c + RB2_SECKEY_SIZE_BYTE, &pk_rainbow2( *key )->pk, RB2_PUBKEY_SIZE_BYTE ); ASN1_CHK_ADD( len, asn1_write_len( &c, buf, len ) ); ASN1_CHK_ADD( len, asn1_write_tag( &c, buf, ASN1_BIT_STRING ) ); return (int) len; } else #endif /* __RAINBOW_2__ */ return( POLARSSL_ERR_PK_FEATURE_UNAVAILABLE ); return( (int) len ); }
int main( int argc, char *argv[] ) { int ret = 0; pk_context key; char buf[1024]; int i; char *p, *q; /* * Set to sane values */ pk_init( &key ); memset( buf, 0, sizeof( buf ) ); if( argc == 0 ) { usage: ret = 1; polarssl_printf( USAGE ); goto exit; } opt.mode = DFL_MODE; opt.filename = DFL_FILENAME; opt.output_mode = DFL_OUTPUT_MODE; opt.output_file = DFL_OUTPUT_FILENAME; opt.output_format = DFL_OUTPUT_FORMAT; for( i = 1; i < argc; i++ ) { p = argv[i]; if( ( q = strchr( p, '=' ) ) == NULL ) goto usage; *q++ = '\0'; if( strcmp( p, "mode" ) == 0 ) { if( strcmp( q, "private" ) == 0 ) opt.mode = MODE_PRIVATE; else if( strcmp( q, "public" ) == 0 ) opt.mode = MODE_PUBLIC; else goto usage; } else if( strcmp( p, "output_mode" ) == 0 ) { if( strcmp( q, "private" ) == 0 ) opt.output_mode = OUTPUT_MODE_PRIVATE; else if( strcmp( q, "public" ) == 0 ) opt.output_mode = OUTPUT_MODE_PUBLIC; else goto usage; } else if( strcmp( p, "output_format" ) == 0 ) { #if defined(POLARSSL_PEM_WRITE_C) if( strcmp( q, "pem" ) == 0 ) opt.output_format = OUTPUT_FORMAT_PEM; else #endif if( strcmp( q, "der" ) == 0 ) opt.output_format = OUTPUT_FORMAT_DER; else goto usage; } else if( strcmp( p, "filename" ) == 0 ) opt.filename = q; else if( strcmp( p, "output_file" ) == 0 ) opt.output_file = q; else goto usage; } if( opt.mode == MODE_NONE && opt.output_mode != OUTPUT_MODE_NONE ) { polarssl_printf( "\nCannot output a key without reading one.\n"); goto exit; } if( opt.mode == MODE_PUBLIC && opt.output_mode == OUTPUT_MODE_PRIVATE ) { polarssl_printf( "\nCannot output a private key from a public key.\n"); goto exit; } if( opt.mode == MODE_PRIVATE ) { /* * 1.1. Load the key */ polarssl_printf( "\n . Loading the private key ..." ); fflush( stdout ); ret = pk_parse_keyfile( &key, opt.filename, NULL ); if( ret != 0 ) { polarssl_strerror( ret, (char *) buf, sizeof(buf) ); polarssl_printf( " failed\n ! pk_parse_keyfile returned -0x%04x - %s\n\n", -ret, buf ); goto exit; } polarssl_printf( " ok\n" ); /* * 1.2 Print the key */ polarssl_printf( " . Key information ...\n" ); #if defined(POLARSSL_RSA_C) if( pk_get_type( &key ) == POLARSSL_PK_RSA ) { rsa_context *rsa = pk_rsa( key ); mpi_write_file( "N: ", &rsa->N, 16, NULL ); mpi_write_file( "E: ", &rsa->E, 16, NULL ); mpi_write_file( "D: ", &rsa->D, 16, NULL ); mpi_write_file( "P: ", &rsa->P, 16, NULL ); mpi_write_file( "Q: ", &rsa->Q, 16, NULL ); mpi_write_file( "DP: ", &rsa->DP, 16, NULL ); mpi_write_file( "DQ: ", &rsa->DQ, 16, NULL ); mpi_write_file( "QP: ", &rsa->QP, 16, NULL ); } else #endif #if defined(POLARSSL_ECP_C) if( pk_get_type( &key ) == POLARSSL_PK_ECKEY ) { ecp_keypair *ecp = pk_ec( key ); mpi_write_file( "Q(X): ", &ecp->Q.X, 16, NULL ); mpi_write_file( "Q(Y): ", &ecp->Q.Y, 16, NULL ); mpi_write_file( "Q(Z): ", &ecp->Q.Z, 16, NULL ); mpi_write_file( "D : ", &ecp->d , 16, NULL ); } else #endif polarssl_printf("key type not supported yet\n"); } else if( opt.mode == MODE_PUBLIC ) { /* * 1.1. Load the key */ polarssl_printf( "\n . Loading the public key ..." ); fflush( stdout ); ret = pk_parse_public_keyfile( &key, opt.filename ); if( ret != 0 ) { polarssl_strerror( ret, (char *) buf, sizeof(buf) ); polarssl_printf( " failed\n ! pk_parse_public_key returned -0x%04x - %s\n\n", -ret, buf ); goto exit; } polarssl_printf( " ok\n" ); /* * 1.2 Print the key */ polarssl_printf( " . Key information ...\n" ); #if defined(POLARSSL_RSA_C) if( pk_get_type( &key ) == POLARSSL_PK_RSA ) { rsa_context *rsa = pk_rsa( key ); mpi_write_file( "N: ", &rsa->N, 16, NULL ); mpi_write_file( "E: ", &rsa->E, 16, NULL ); } else #endif #if defined(POLARSSL_ECP_C) if( pk_get_type( &key ) == POLARSSL_PK_ECKEY ) { ecp_keypair *ecp = pk_ec( key ); mpi_write_file( "Q(X): ", &ecp->Q.X, 16, NULL ); mpi_write_file( "Q(Y): ", &ecp->Q.Y, 16, NULL ); mpi_write_file( "Q(Z): ", &ecp->Q.Z, 16, NULL ); } else #endif polarssl_printf("key type not supported yet\n"); } else goto usage; if( opt.output_mode == OUTPUT_MODE_PUBLIC ) { write_public_key( &key, opt.output_file ); } if( opt.output_mode == OUTPUT_MODE_PRIVATE ) { write_private_key( &key, opt.output_file ); } exit: if( ret != 0 && ret != 1) { #ifdef POLARSSL_ERROR_C polarssl_strerror( ret, buf, sizeof( buf ) ); polarssl_printf( " - %s\n", buf ); #else polarssl_printf("\n"); #endif } pk_free( &key ); #if defined(_WIN32) polarssl_printf( " + Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
result_t PKey::get_publicKey(obj_ptr<PKey_base> &retVal) { result_t hr; bool priv; hr = isPrivate(priv); if (hr < 0) return hr; if (!priv) return CALL_RETURN_NULL; pk_type_t type = pk_get_type(&m_key); int ret; if (type == POLARSSL_PK_RSA) { rsa_context *rsa = pk_rsa(m_key); obj_ptr<PKey> pk1 = new PKey(); ret = pk_init_ctx(&pk1->m_key, pk_info_from_type(POLARSSL_PK_RSA)); if (ret != 0) return CHECK_ERROR(_ssl::setError(ret)); rsa_context *rsa1 = pk_rsa(pk1->m_key); rsa1->len = rsa->len; rsa1->padding = rsa->padding; rsa1->hash_id = rsa->hash_id; ret = mpi_copy(&rsa1->N, &rsa->N); if (ret != 0) return CHECK_ERROR(_ssl::setError(ret)); ret = mpi_copy(&rsa1->E, &rsa->E); if (ret != 0) return CHECK_ERROR(_ssl::setError(ret)); retVal = pk1; return 0; } if (type == POLARSSL_PK_ECKEY) { ecp_keypair *ecp = pk_ec(m_key); obj_ptr<PKey> pk1 = new PKey(); ret = pk_init_ctx(&pk1->m_key, pk_info_from_type(POLARSSL_PK_ECKEY)); if (ret != 0) return CHECK_ERROR(_ssl::setError(ret)); ecp_keypair *ecp1 = pk_ec(pk1->m_key); ret = ecp_group_copy(&ecp1->grp, &ecp->grp); if (ret != 0) return CHECK_ERROR(_ssl::setError(ret)); ret = ecp_copy(&ecp1->Q, &ecp->Q); if (ret != 0) return CHECK_ERROR(_ssl::setError(ret)); retVal = pk1; return 0; } return CHECK_ERROR(CALL_E_INVALID_CALL); }
static CURLcode polarssl_connect_step1(struct connectdata *conn, int sockindex) { struct Curl_easy *data = conn->data; struct ssl_connect_data* connssl = &conn->ssl[sockindex]; const char *capath = SSL_CONN_CONFIG(CApath); const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name : conn->host.name; const long int port = SSL_IS_PROXY() ? conn->port : conn->remote_port; int ret = -1; char errorbuf[128]; errorbuf[0]=0; /* PolarSSL only supports SSLv3 and TLSv1 */ if(SSL_CONN_CONFIG(version) == CURL_SSLVERSION_SSLv2) { failf(data, "PolarSSL does not support SSLv2"); return CURLE_SSL_CONNECT_ERROR; } #ifdef THREADING_SUPPORT entropy_init_mutex(&entropy); if((ret = ctr_drbg_init(&BACKEND->ctr_drbg, entropy_func_mutex, &entropy, NULL, 0)) != 0) { error_strerror(ret, errorbuf, sizeof(errorbuf)); failf(data, "Failed - PolarSSL: ctr_drbg_init returned (-0x%04X) %s\n", -ret, errorbuf); } #else entropy_init(&BACKEND->entropy); if((ret = ctr_drbg_init(&BACKEND->ctr_drbg, entropy_func, &BACKEND->entropy, NULL, 0)) != 0) { error_strerror(ret, errorbuf, sizeof(errorbuf)); failf(data, "Failed - PolarSSL: ctr_drbg_init returned (-0x%04X) %s\n", -ret, errorbuf); } #endif /* THREADING_SUPPORT */ /* Load the trusted CA */ memset(&BACKEND->cacert, 0, sizeof(x509_crt)); if(SSL_CONN_CONFIG(CAfile)) { ret = x509_crt_parse_file(&BACKEND->cacert, SSL_CONN_CONFIG(CAfile)); if(ret<0) { error_strerror(ret, errorbuf, sizeof(errorbuf)); failf(data, "Error reading ca cert file %s - PolarSSL: (-0x%04X) %s", SSL_CONN_CONFIG(CAfile), -ret, errorbuf); if(SSL_CONN_CONFIG(verifypeer)) return CURLE_SSL_CACERT_BADFILE; } } if(capath) { ret = x509_crt_parse_path(&BACKEND->cacert, capath); if(ret<0) { error_strerror(ret, errorbuf, sizeof(errorbuf)); failf(data, "Error reading ca cert path %s - PolarSSL: (-0x%04X) %s", capath, -ret, errorbuf); if(SSL_CONN_CONFIG(verifypeer)) return CURLE_SSL_CACERT_BADFILE; } } /* Load the client certificate */ memset(&BACKEND->clicert, 0, sizeof(x509_crt)); if(SSL_SET_OPTION(cert)) { ret = x509_crt_parse_file(&BACKEND->clicert, SSL_SET_OPTION(cert)); if(ret) { error_strerror(ret, errorbuf, sizeof(errorbuf)); failf(data, "Error reading client cert file %s - PolarSSL: (-0x%04X) %s", SSL_SET_OPTION(cert), -ret, errorbuf); return CURLE_SSL_CERTPROBLEM; } } /* Load the client private key */ if(SSL_SET_OPTION(key)) { pk_context pk; pk_init(&pk); ret = pk_parse_keyfile(&pk, SSL_SET_OPTION(key), SSL_SET_OPTION(key_passwd)); if(ret == 0 && !pk_can_do(&pk, POLARSSL_PK_RSA)) ret = POLARSSL_ERR_PK_TYPE_MISMATCH; if(ret == 0) rsa_copy(&BACKEND->rsa, pk_rsa(pk)); else rsa_free(&BACKEND->rsa); pk_free(&pk); if(ret) { error_strerror(ret, errorbuf, sizeof(errorbuf)); failf(data, "Error reading private key %s - PolarSSL: (-0x%04X) %s", SSL_SET_OPTION(key), -ret, errorbuf); return CURLE_SSL_CERTPROBLEM; } } /* Load the CRL */ memset(&BACKEND->crl, 0, sizeof(x509_crl)); if(SSL_SET_OPTION(CRLfile)) { ret = x509_crl_parse_file(&BACKEND->crl, SSL_SET_OPTION(CRLfile)); if(ret) { error_strerror(ret, errorbuf, sizeof(errorbuf)); failf(data, "Error reading CRL file %s - PolarSSL: (-0x%04X) %s", SSL_SET_OPTION(CRLfile), -ret, errorbuf); return CURLE_SSL_CRL_BADFILE; } } infof(data, "PolarSSL: Connecting to %s:%d\n", hostname, port); if(ssl_init(&BACKEND->ssl)) { failf(data, "PolarSSL: ssl_init failed"); return CURLE_SSL_CONNECT_ERROR; } switch(SSL_CONN_CONFIG(version)) { case CURL_SSLVERSION_DEFAULT: case CURL_SSLVERSION_TLSv1: ssl_set_min_version(&BACKEND->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_1); break; case CURL_SSLVERSION_SSLv3: ssl_set_min_version(&BACKEND->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_0); ssl_set_max_version(&BACKEND->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_0); infof(data, "PolarSSL: Forced min. SSL Version to be SSLv3\n"); break; case CURL_SSLVERSION_TLSv1_0: case CURL_SSLVERSION_TLSv1_1: case CURL_SSLVERSION_TLSv1_2: case CURL_SSLVERSION_TLSv1_3: { CURLcode result = set_ssl_version_min_max(conn, sockindex); if(result != CURLE_OK) return result; break; } default: failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION"); return CURLE_SSL_CONNECT_ERROR; } ssl_set_endpoint(&BACKEND->ssl, SSL_IS_CLIENT); ssl_set_authmode(&BACKEND->ssl, SSL_VERIFY_OPTIONAL); ssl_set_rng(&BACKEND->ssl, ctr_drbg_random, &BACKEND->ctr_drbg); ssl_set_bio(&BACKEND->ssl, net_recv, &conn->sock[sockindex], net_send, &conn->sock[sockindex]); ssl_set_ciphersuites(&BACKEND->ssl, ssl_list_ciphersuites()); /* Check if there's a cached ID we can/should use here! */ if(SSL_SET_OPTION(primary.sessionid)) { void *old_session = NULL; Curl_ssl_sessionid_lock(conn); if(!Curl_ssl_getsessionid(conn, &old_session, NULL, sockindex)) { ret = ssl_set_session(&BACKEND->ssl, old_session); if(ret) { Curl_ssl_sessionid_unlock(conn); failf(data, "ssl_set_session returned -0x%x", -ret); return CURLE_SSL_CONNECT_ERROR; } infof(data, "PolarSSL re-using session\n"); } Curl_ssl_sessionid_unlock(conn); } ssl_set_ca_chain(&BACKEND->ssl, &BACKEND->cacert, &BACKEND->crl, hostname); ssl_set_own_cert_rsa(&BACKEND->ssl, &BACKEND->clicert, &BACKEND->rsa); if(ssl_set_hostname(&BACKEND->ssl, hostname)) { /* ssl_set_hostname() sets the name to use in CN/SAN checks *and* the name to set in the SNI extension. So even if curl connects to a host specified as an IP address, this function must be used. */ failf(data, "couldn't set hostname in PolarSSL"); return CURLE_SSL_CONNECT_ERROR; } #ifdef HAS_ALPN if(conn->bits.tls_enable_alpn) { static const char *protocols[3]; int cur = 0; #ifdef USE_NGHTTP2 if(data->set.httpversion >= CURL_HTTP_VERSION_2) { protocols[cur++] = NGHTTP2_PROTO_VERSION_ID; infof(data, "ALPN, offering %s\n", NGHTTP2_PROTO_VERSION_ID); } #endif protocols[cur++] = ALPN_HTTP_1_1; infof(data, "ALPN, offering %s\n", ALPN_HTTP_1_1); protocols[cur] = NULL; ssl_set_alpn_protocols(&BACKEND->ssl, protocols); } #endif #ifdef POLARSSL_DEBUG ssl_set_dbg(&BACKEND->ssl, polarssl_debug, data); #endif connssl->connecting_state = ssl_connect_2; return CURLE_OK; }
int main( int argc, char *argv[] ) { int ret = 0; x509_crt issuer_crt; pk_context loaded_issuer_key, loaded_subject_key; pk_context *issuer_key = &loaded_issuer_key, *subject_key = &loaded_subject_key; char buf[1024]; char issuer_name[128]; int i, j, n; char *p, *q, *r; #if defined(POLARSSL_X509_CSR_PARSE_C) char subject_name[128]; x509_csr csr; #endif x509write_cert crt; mpi serial; entropy_context entropy; ctr_drbg_context ctr_drbg; const char *pers = "crt example app"; /* * Set to sane values */ x509write_crt_init( &crt ); x509write_crt_set_md_alg( &crt, POLARSSL_MD_SHA1 ); pk_init( &loaded_issuer_key ); pk_init( &loaded_subject_key ); mpi_init( &serial ); #if defined(POLARSSL_X509_CSR_PARSE_C) x509_csr_init( &csr ); #endif x509_crt_init( &issuer_crt ); memset( buf, 0, 1024 ); if( argc == 0 ) { usage: printf( USAGE ); ret = 1; goto exit; } opt.issuer_crt = DFL_ISSUER_CRT; opt.request_file = DFL_REQUEST_FILE; opt.request_file = DFL_REQUEST_FILE; opt.subject_key = DFL_SUBJECT_KEY; opt.issuer_key = DFL_ISSUER_KEY; opt.subject_pwd = DFL_SUBJECT_PWD; opt.issuer_pwd = DFL_ISSUER_PWD; opt.output_file = DFL_OUTPUT_FILENAME; opt.subject_name = DFL_SUBJECT_NAME; opt.issuer_name = DFL_ISSUER_NAME; opt.not_before = DFL_NOT_BEFORE; opt.not_after = DFL_NOT_AFTER; opt.serial = DFL_SERIAL; opt.selfsign = DFL_SELFSIGN; opt.is_ca = DFL_IS_CA; opt.max_pathlen = DFL_MAX_PATHLEN; opt.key_usage = DFL_KEY_USAGE; opt.ns_cert_type = DFL_NS_CERT_TYPE; for( i = 1; i < argc; i++ ) { p = argv[i]; if( ( q = strchr( p, '=' ) ) == NULL ) goto usage; *q++ = '\0'; n = strlen( p ); for( j = 0; j < n; j++ ) { if( argv[i][j] >= 'A' && argv[i][j] <= 'Z' ) argv[i][j] |= 0x20; } if( strcmp( p, "request_file" ) == 0 ) opt.request_file = q; else if( strcmp( p, "subject_key" ) == 0 ) opt.subject_key = q; else if( strcmp( p, "issuer_key" ) == 0 ) opt.issuer_key = q; else if( strcmp( p, "subject_pwd" ) == 0 ) opt.subject_pwd = q; else if( strcmp( p, "issuer_pwd" ) == 0 ) opt.issuer_pwd = q; else if( strcmp( p, "issuer_crt" ) == 0 ) opt.issuer_crt = q; else if( strcmp( p, "output_file" ) == 0 ) opt.output_file = q; else if( strcmp( p, "subject_name" ) == 0 ) { opt.subject_name = q; } else if( strcmp( p, "issuer_name" ) == 0 ) { opt.issuer_name = q; } else if( strcmp( p, "not_before" ) == 0 ) { opt.not_before = q; } else if( strcmp( p, "not_after" ) == 0 ) { opt.not_after = q; } else if( strcmp( p, "serial" ) == 0 ) { opt.serial = q; } else if( strcmp( p, "selfsign" ) == 0 ) { opt.selfsign = atoi( q ); if( opt.selfsign < 0 || opt.selfsign > 1 ) goto usage; } else if( strcmp( p, "is_ca" ) == 0 ) { opt.is_ca = atoi( q ); if( opt.is_ca < 0 || opt.is_ca > 1 ) goto usage; } else if( strcmp( p, "max_pathlen" ) == 0 ) { opt.max_pathlen = atoi( q ); if( opt.max_pathlen < -1 || opt.max_pathlen > 127 ) goto usage; } else if( strcmp( p, "key_usage" ) == 0 ) { while( q != NULL ) { if( ( r = strchr( q, ',' ) ) != NULL ) *r++ = '\0'; if( strcmp( q, "digital_signature" ) == 0 ) opt.key_usage |= KU_DIGITAL_SIGNATURE; else if( strcmp( q, "non_repudiation" ) == 0 ) opt.key_usage |= KU_NON_REPUDIATION; else if( strcmp( q, "key_encipherment" ) == 0 ) opt.key_usage |= KU_KEY_ENCIPHERMENT; else if( strcmp( q, "data_encipherment" ) == 0 ) opt.key_usage |= KU_DATA_ENCIPHERMENT; else if( strcmp( q, "key_agreement" ) == 0 ) opt.key_usage |= KU_KEY_AGREEMENT; else if( strcmp( q, "key_cert_sign" ) == 0 ) opt.key_usage |= KU_KEY_CERT_SIGN; else if( strcmp( q, "crl_sign" ) == 0 ) opt.key_usage |= KU_CRL_SIGN; else goto usage; q = r; } } else if( strcmp( p, "ns_cert_type" ) == 0 ) { while( q != NULL ) { if( ( r = strchr( q, ',' ) ) != NULL ) *r++ = '\0'; if( strcmp( q, "ssl_client" ) == 0 ) opt.ns_cert_type |= NS_CERT_TYPE_SSL_CLIENT; else if( strcmp( q, "ssl_server" ) == 0 ) opt.ns_cert_type |= NS_CERT_TYPE_SSL_SERVER; else if( strcmp( q, "email" ) == 0 ) opt.ns_cert_type |= NS_CERT_TYPE_EMAIL; else if( strcmp( q, "object_signing" ) == 0 ) opt.ns_cert_type |= NS_CERT_TYPE_OBJECT_SIGNING; else if( strcmp( q, "ssl_ca" ) == 0 ) opt.ns_cert_type |= NS_CERT_TYPE_SSL_CA; else if( strcmp( q, "email_ca" ) == 0 ) opt.ns_cert_type |= NS_CERT_TYPE_EMAIL_CA; else if( strcmp( q, "object_signing_ca" ) == 0 ) opt.ns_cert_type |= NS_CERT_TYPE_OBJECT_SIGNING_CA; else goto usage; q = r; } } else goto usage; } printf("\n"); /* * 0. Seed the PRNG */ printf( " . Seeding the random number generator..." ); fflush( stdout ); entropy_init( &entropy ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! ctr_drbg_init returned %d - %s\n", ret, buf ); goto exit; } printf( " ok\n" ); // Parse serial to MPI // printf( " . Reading serial number..." ); fflush( stdout ); if( ( ret = mpi_read_string( &serial, 10, opt.serial ) ) != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! mpi_read_string returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } printf( " ok\n" ); // Parse issuer certificate if present // if( !opt.selfsign && strlen( opt.issuer_crt ) ) { /* * 1.0.a. Load the certificates */ printf( " . Loading the issuer certificate ..." ); fflush( stdout ); if( ( ret = x509_crt_parse_file( &issuer_crt, opt.issuer_crt ) ) != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509_crt_parse_file returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } ret = x509_dn_gets( issuer_name, sizeof(issuer_name), &issuer_crt.issuer ); if( ret < 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509_dn_gets returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } opt.issuer_name = issuer_name; printf( " ok\n" ); } #if defined(POLARSSL_X509_CSR_PARSE_C) // Parse certificate request if present // if( !opt.selfsign && strlen( opt.request_file ) ) { /* * 1.0.b. Load the CSR */ printf( " . Loading the certificate request ..." ); fflush( stdout ); if( ( ret = x509_csr_parse_file( &csr, opt.request_file ) ) != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509_csr_parse_file returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } ret = x509_dn_gets( subject_name, sizeof(subject_name), &csr.subject ); if( ret < 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509_dn_gets returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } opt.subject_name = subject_name; subject_key = &csr.pk; printf( " ok\n" ); } #endif /* POLARSSL_X509_CSR_PARSE_C */ /* * 1.1. Load the keys */ if( !opt.selfsign && !strlen( opt.request_file ) ) { printf( " . Loading the subject key ..." ); fflush( stdout ); ret = pk_parse_keyfile( &loaded_subject_key, opt.subject_key, opt.subject_pwd ); if( ret != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! pk_parse_keyfile returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } printf( " ok\n" ); } printf( " . Loading the issuer key ..." ); fflush( stdout ); ret = pk_parse_keyfile( &loaded_issuer_key, opt.issuer_key, opt.issuer_pwd ); if( ret != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! pk_parse_keyfile returned -x%02x - %s\n\n", -ret, buf ); goto exit; } // Check if key and issuer certificate match // if( strlen( opt.issuer_crt ) ) { if( !pk_can_do( &issuer_crt.pk, POLARSSL_PK_RSA ) || mpi_cmp_mpi( &pk_rsa( issuer_crt.pk )->N, &pk_rsa( *issuer_key )->N ) != 0 || mpi_cmp_mpi( &pk_rsa( issuer_crt.pk )->E, &pk_rsa( *issuer_key )->E ) != 0 ) { printf( " failed\n ! issuer_key does not match issuer certificate\n\n" ); ret = -1; goto exit; } } printf( " ok\n" ); if( opt.selfsign ) { opt.subject_name = opt.issuer_name; subject_key = issuer_key; } x509write_crt_set_subject_key( &crt, subject_key ); x509write_crt_set_issuer_key( &crt, issuer_key ); /* * 1.0. Check the names for validity */ if( ( ret = x509write_crt_set_subject_name( &crt, opt.subject_name ) ) != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509write_crt_set_subject_name returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } if( ( ret = x509write_crt_set_issuer_name( &crt, opt.issuer_name ) ) != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509write_crt_set_issuer_name returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } printf( " . Setting certificate values ..." ); fflush( stdout ); ret = x509write_crt_set_serial( &crt, &serial ); if( ret != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509write_crt_set_serial returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } ret = x509write_crt_set_validity( &crt, opt.not_before, opt.not_after ); if( ret != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509write_crt_set_validity returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } printf( " ok\n" ); printf( " . Adding the Basic Constraints extension ..." ); fflush( stdout ); ret = x509write_crt_set_basic_constraints( &crt, opt.is_ca, opt.max_pathlen ); if( ret != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509write_crt_set_basic_contraints returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } printf( " ok\n" ); #if defined(POLARSSL_SHA1_C) printf( " . Adding the Subject Key Identifier ..." ); fflush( stdout ); ret = x509write_crt_set_subject_key_identifier( &crt ); if( ret != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509write_crt_set_subject_key_identifier returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } printf( " ok\n" ); printf( " . Adding the Authority Key Identifier ..." ); fflush( stdout ); ret = x509write_crt_set_authority_key_identifier( &crt ); if( ret != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509write_crt_set_authority_key_identifier returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } printf( " ok\n" ); #endif /* POLARSSL_SHA1_C */ if( opt.key_usage ) { printf( " . Adding the Key Usage extension ..." ); fflush( stdout ); ret = x509write_crt_set_key_usage( &crt, opt.key_usage ); if( ret != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509write_crt_set_key_usage returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } printf( " ok\n" ); } if( opt.ns_cert_type ) { printf( " . Adding the NS Cert Type extension ..." ); fflush( stdout ); ret = x509write_crt_set_ns_cert_type( &crt, opt.ns_cert_type ); if( ret != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509write_crt_set_ns_cert_type returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } printf( " ok\n" ); } /* * 1.2. Writing the request */ printf( " . Writing the certificate..." ); fflush( stdout ); if( ( ret = write_certificate( &crt, opt.output_file, ctr_drbg_random, &ctr_drbg ) ) != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! write_certifcate -0x%02x - %s\n\n", -ret, buf ); goto exit; } printf( " ok\n" ); exit: x509write_crt_free( &crt ); pk_free( &loaded_subject_key ); pk_free( &loaded_issuer_key ); mpi_free( &serial ); entropy_free( &entropy ); #if defined(_WIN32) printf( " + Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }