1 /*
2 * Copyright 2018-2022 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 /*
11 * Here is an STORE loader for ENGINE backed keys. It relies on deprecated
12 * functions, and therefore need to have deprecation warnings suppressed.
13 * This file is not compiled at all in a '--api=3 no-deprecated' configuration.
14 */
15 #define OPENSSL_SUPPRESS_DEPRECATED
16
17 #include "apps.h"
18
19 #ifndef OPENSSL_NO_ENGINE
20
21 # include <stdarg.h>
22 # include <string.h>
23 # include <openssl/engine.h>
24 # include <openssl/store.h>
25
26 /*
27 * Support for legacy private engine keys via the 'org.openssl.engine:' scheme
28 *
29 * org.openssl.engine:{engineid}:{keyid}
30 *
31 * Note: we ONLY support ENGINE_load_private_key() and ENGINE_load_public_key()
32 * Note 2: This scheme has a precedent in code in PKIX-SSH. for exactly
33 * this sort of purpose.
34 */
35
36 /* Local definition of OSSL_STORE_LOADER_CTX */
37 struct ossl_store_loader_ctx_st {
38 ENGINE *e; /* Structural reference */
39 char *keyid;
40 int expected;
41 int loaded; /* 0 = key not loaded yet, 1 = key loaded */
42 };
43
OSSL_STORE_LOADER_CTX_new(ENGINE * e,char * keyid)44 static OSSL_STORE_LOADER_CTX *OSSL_STORE_LOADER_CTX_new(ENGINE *e, char *keyid)
45 {
46 OSSL_STORE_LOADER_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx));
47
48 if (ctx != NULL) {
49 ctx->e = e;
50 ctx->keyid = keyid;
51 }
52 return ctx;
53 }
54
OSSL_STORE_LOADER_CTX_free(OSSL_STORE_LOADER_CTX * ctx)55 static void OSSL_STORE_LOADER_CTX_free(OSSL_STORE_LOADER_CTX *ctx)
56 {
57 if (ctx != NULL) {
58 ENGINE_free(ctx->e);
59 OPENSSL_free(ctx->keyid);
60 OPENSSL_free(ctx);
61 }
62 }
63
engine_open(const OSSL_STORE_LOADER * loader,const char * uri,const UI_METHOD * ui_method,void * ui_data)64 static OSSL_STORE_LOADER_CTX *engine_open(const OSSL_STORE_LOADER *loader,
65 const char *uri,
66 const UI_METHOD *ui_method,
67 void *ui_data)
68 {
69 const char *p = uri, *q;
70 ENGINE *e = NULL;
71 char *keyid = NULL;
72 OSSL_STORE_LOADER_CTX *ctx = NULL;
73
74 if (!CHECK_AND_SKIP_CASE_PREFIX(p, ENGINE_SCHEME_COLON))
75 return NULL;
76
77 /* Look for engine ID */
78 q = strchr(p, ':');
79 if (q != NULL /* There is both an engine ID and a key ID */
80 && p[0] != ':' /* The engine ID is at least one character */
81 && q[1] != '\0') { /* The key ID is at least one character */
82 char engineid[256];
83 size_t engineid_l = q - p;
84
85 strncpy(engineid, p, engineid_l);
86 engineid[engineid_l] = '\0';
87 e = ENGINE_by_id(engineid);
88
89 keyid = OPENSSL_strdup(q + 1);
90 }
91
92 if (e != NULL && keyid != NULL)
93 ctx = OSSL_STORE_LOADER_CTX_new(e, keyid);
94
95 if (ctx == NULL) {
96 OPENSSL_free(keyid);
97 ENGINE_free(e);
98 }
99
100 return ctx;
101 }
102
engine_expect(OSSL_STORE_LOADER_CTX * ctx,int expected)103 static int engine_expect(OSSL_STORE_LOADER_CTX *ctx, int expected)
104 {
105 if (expected == 0
106 || expected == OSSL_STORE_INFO_PUBKEY
107 || expected == OSSL_STORE_INFO_PKEY) {
108 ctx->expected = expected;
109 return 1;
110 }
111 return 0;
112 }
113
engine_load(OSSL_STORE_LOADER_CTX * ctx,const UI_METHOD * ui_method,void * ui_data)114 static OSSL_STORE_INFO *engine_load(OSSL_STORE_LOADER_CTX *ctx,
115 const UI_METHOD *ui_method, void *ui_data)
116 {
117 EVP_PKEY *pkey = NULL, *pubkey = NULL;
118 OSSL_STORE_INFO *info = NULL;
119
120 if (ctx->loaded == 0) {
121 if (ENGINE_init(ctx->e)) {
122 if (ctx->expected == 0
123 || ctx->expected == OSSL_STORE_INFO_PKEY)
124 pkey =
125 ENGINE_load_private_key(ctx->e, ctx->keyid,
126 (UI_METHOD *)ui_method, ui_data);
127 if ((pkey == NULL && ctx->expected == 0)
128 || ctx->expected == OSSL_STORE_INFO_PUBKEY)
129 pubkey =
130 ENGINE_load_public_key(ctx->e, ctx->keyid,
131 (UI_METHOD *)ui_method, ui_data);
132 ENGINE_finish(ctx->e);
133 }
134 }
135
136 ctx->loaded = 1;
137
138 if (pubkey != NULL)
139 info = OSSL_STORE_INFO_new_PUBKEY(pubkey);
140 else if (pkey != NULL)
141 info = OSSL_STORE_INFO_new_PKEY(pkey);
142 if (info == NULL) {
143 EVP_PKEY_free(pkey);
144 EVP_PKEY_free(pubkey);
145 }
146 return info;
147 }
148
engine_eof(OSSL_STORE_LOADER_CTX * ctx)149 static int engine_eof(OSSL_STORE_LOADER_CTX *ctx)
150 {
151 return ctx->loaded != 0;
152 }
153
engine_error(OSSL_STORE_LOADER_CTX * ctx)154 static int engine_error(OSSL_STORE_LOADER_CTX *ctx)
155 {
156 return 0;
157 }
158
engine_close(OSSL_STORE_LOADER_CTX * ctx)159 static int engine_close(OSSL_STORE_LOADER_CTX *ctx)
160 {
161 OSSL_STORE_LOADER_CTX_free(ctx);
162 return 1;
163 }
164
setup_engine_loader(void)165 int setup_engine_loader(void)
166 {
167 OSSL_STORE_LOADER *loader = NULL;
168
169 if ((loader = OSSL_STORE_LOADER_new(NULL, ENGINE_SCHEME)) == NULL
170 || !OSSL_STORE_LOADER_set_open(loader, engine_open)
171 || !OSSL_STORE_LOADER_set_expect(loader, engine_expect)
172 || !OSSL_STORE_LOADER_set_load(loader, engine_load)
173 || !OSSL_STORE_LOADER_set_eof(loader, engine_eof)
174 || !OSSL_STORE_LOADER_set_error(loader, engine_error)
175 || !OSSL_STORE_LOADER_set_close(loader, engine_close)
176 || !OSSL_STORE_register_loader(loader)) {
177 OSSL_STORE_LOADER_free(loader);
178 loader = NULL;
179 }
180
181 return loader != NULL;
182 }
183
destroy_engine_loader(void)184 void destroy_engine_loader(void)
185 {
186 OSSL_STORE_LOADER *loader = OSSL_STORE_unregister_loader(ENGINE_SCHEME);
187 OSSL_STORE_LOADER_free(loader);
188 }
189
190 #else /* !OPENSSL_NO_ENGINE */
191
setup_engine_loader(void)192 int setup_engine_loader(void)
193 {
194 return 0;
195 }
196
destroy_engine_loader(void)197 void destroy_engine_loader(void)
198 {
199 }
200
201 #endif
202
