Skip to content

Commit

Permalink
xmlsec-openssl: check if key matches key cert when loading from memor…
Browse files Browse the repository at this point in the history 
…y or file; fix no-x509 build (#586)
  • Loading branch information
@lsh123
lsh123 authored Mar 6, 2023
1 parent 440a6ab commit 045c12f
Show file tree
Hide file tree
Showing 18 changed files with 221 additions and 73 deletions.
29 changes: 28 additions & 1 deletion apps/crypto.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,10 @@

#include "crypto.h"

#ifndef UNREFERENCED_PARAMETER
#define UNREFERENCED_PARAMETER(param) ((void)(param))
#endif /* UNREFERENCED_PARAMETER */

int
xmlSecAppCryptoInit(const char* config) {
if(xmlSecCryptoAppInit(config) < 0) {
Expand Down Expand Up @@ -78,8 +82,15 @@ xmlSecAppCryptoSimpleKeysMngrCertLoad(xmlSecKeysMngrPtr mngr, const char *filena
xmlSecAssert2(filename != NULL, -1);

#ifndef XMLSEC_NO_X509

return(xmlSecCryptoAppKeysMngrCertLoad(mngr, filename, format, type));

#else /* XMLSEC_NO_X509 */

UNREFERENCED_PARAMETER(format);
UNREFERENCED_PARAMETER(type);

fprintf(stderr, "Error: X509 support is disabled\n");
return(-1);
#endif /* XMLSEC_NO_X509 */
}
Expand All @@ -91,8 +102,14 @@ xmlSecAppCryptoSimpleKeysMngrCrlLoad(xmlSecKeysMngrPtr mngr, const char *filenam
xmlSecAssert2(filename != NULL, -1);

#ifndef XMLSEC_NO_X509

return(xmlSecCryptoAppKeysMngrCrlLoad(mngr, filename, format));

#else /* XMLSEC_NO_X509 */

UNREFERENCED_PARAMETER(format);

fprintf(stderr, "Error: X509 support is disabled\n");
return(-1);
#endif /* XMLSEC_NO_X509 */
}
Expand Down Expand Up @@ -219,6 +236,8 @@ xmlSecAppCryptoSimpleKeysMngrEngineKeyAndCertsLoad(xmlSecKeysMngrPtr mngr,
}
}
#else /* XMLSEC_NO_X509 */
UNREFERENCED_PARAMETER(certFormat);

if(certFiles[0] != '\0') {
fprintf(stderr, "Error: X509 support is disabled\n");
xmlSecKeyDestroy(key);
Expand Down Expand Up @@ -256,14 +275,14 @@ int
xmlSecAppCryptoSimpleKeysMngrPkcs12KeyLoad(xmlSecKeysMngrPtr mngr, const char *filename, const char* pwd,
const char *name, xmlSecKeyInfoCtxPtr keyInfoCtx, int verifyKey
) {
#ifndef XMLSEC_NO_X509
xmlSecKeyPtr key;
int ret;

xmlSecAssert2(mngr != NULL, -1);
xmlSecAssert2(filename != NULL, -1);
xmlSecAssert2(keyInfoCtx != NULL, -1);

#ifndef XMLSEC_NO_X509
key = xmlSecCryptoAppKeyLoadEx(filename, xmlSecKeyDataTypePrivate, xmlSecKeyDataFormatPkcs12, pwd,
xmlSecCryptoAppGetDefaultPwdCallback(), (void*)filename);
if(key == NULL) {
Expand Down Expand Up @@ -306,6 +325,14 @@ xmlSecAppCryptoSimpleKeysMngrPkcs12KeyLoad(xmlSecKeysMngrPtr mngr, const char *f

return(0);
#else /* XMLSEC_NO_X509 */
xmlSecAssert2(mngr != NULL, -1);
xmlSecAssert2(filename != NULL, -1);
xmlSecAssert2(keyInfoCtx != NULL, -1);

UNREFERENCED_PARAMETER(pwd);
UNREFERENCED_PARAMETER(name);
UNREFERENCED_PARAMETER(verifyKey);

fprintf(stderr, "Error: X509 support is disabled\n");
return(-1);
#endif /* XMLSEC_NO_X509 */
Expand Down
3 changes: 3 additions & 0 deletions include/xmlsec/keys.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -218,6 +218,9 @@ XMLSEC_EXPORT xmlSecKeyDataPtr xmlSecKeyGetValue (xmlSecKeyPtr key);
XMLSEC_EXPORT int xmlSecKeySetValue (xmlSecKeyPtr key,
xmlSecKeyDataPtr value);

XMLSEC_EXPORT xmlSecSize xmlSecKeyGetSize (xmlSecKeyPtr key);


XMLSEC_EXPORT xmlSecKeyDataPtr xmlSecKeyGetData (xmlSecKeyPtr key,
xmlSecKeyDataId dataId);
XMLSEC_EXPORT xmlSecKeyDataPtr xmlSecKeyEnsureData (xmlSecKeyPtr key,
Expand Down
8 changes: 8 additions & 0 deletions include/xmlsec/openssl/evp.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,14 @@
extern "C" {
#endif /* __cplusplus */


/*********************************************************************************
*
* EVP_PKEY Util functions
*
******************************************************************************/
XMLSEC_CRYPTO_EXPORT EVP_PKEY* xmlSecOpenSSLKeyGetEvp (xmlSecKeyPtr key);

XMLSEC_CRYPTO_EXPORT int xmlSecOpenSSLEvpKeyDataAdoptEvp (xmlSecKeyDataPtr data,
EVP_PKEY* pKey);
XMLSEC_CRYPTO_EXPORT EVP_PKEY* xmlSecOpenSSLEvpKeyDataGetEvp (xmlSecKeyDataPtr data);
Expand Down
22 changes: 13 additions & 9 deletions src/gnutls/app.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@
#include "../cast_helpers.h"
#include "private.h"


static xmlSecKeyPtr xmlSecGnuTLSAppPemDerKeyLoadMemory (const xmlSecByte * data,
xmlSecSize dataSize,
gnutls_x509_crt_fmt_t fmt);
Expand All @@ -47,9 +48,12 @@ static xmlSecKeyPtr xmlSecGnuTLSAppPkcs8KeyLoadMemory (const xmlSecByt
void* pwdCallback,
void* pwdCallbackCtx);

#ifndef XMLSEC_NO_X509
static xmlSecKeyPtr xmlSecGnuTLSAppKeyFromCertLoadMemory (const xmlSecByte* data,
xmlSecSize dataSize,
xmlSecKeyDataFormat format);
#endif /* XMLSEC_NO_X509 */


/**
* xmlSecGnuTLSAppInit:
Expand Down Expand Up @@ -229,6 +233,7 @@ xmlSecGnuTLSAppKeyLoadMemory(const xmlSecByte* data, xmlSecSize dataSize, xmlSe
}

#ifndef XMLSEC_NO_X509

/**
* xmlSecGnuTLSAppKeyCertLoad:
* @key: the pointer to key.
Expand All @@ -240,8 +245,7 @@ xmlSecGnuTLSAppKeyLoadMemory(const xmlSecByte* data, xmlSecSize dataSize, xmlSe
* Returns: 0 on success or a negative value otherwise.
*/
int
xmlSecGnuTLSAppKeyCertLoad(xmlSecKeyPtr key, const char* filename,
xmlSecKeyDataFormat format) {
xmlSecGnuTLSAppKeyCertLoad(xmlSecKeyPtr key, const char* filename, xmlSecKeyDataFormat format) {
xmlSecBuffer buffer;
int ret;

Expand Down Expand Up @@ -291,9 +295,9 @@ xmlSecGnuTLSAppKeyCertLoad(xmlSecKeyPtr key, const char* filename,
* Returns: 0 on success or a negative value otherwise.
*/
int
xmlSecGnuTLSAppKeyCertLoadMemory(xmlSecKeyPtr key,
const xmlSecByte* data, xmlSecSize dataSize, xmlSecKeyDataFormat format)
{
xmlSecGnuTLSAppKeyCertLoadMemory(xmlSecKeyPtr key, const xmlSecByte* data, xmlSecSize dataSize,
xmlSecKeyDataFormat format
) {
gnutls_x509_crt_t cert = NULL;
xmlSecKeyDataPtr x509Data;
int ret;
Expand Down Expand Up @@ -381,10 +385,8 @@ xmlSecGnuTLSAppPkcs12Load(const char *filename,
*/
xmlSecKeyPtr
xmlSecGnuTLSAppPkcs12LoadMemory(const xmlSecByte* data, xmlSecSize dataSize,
const char *pwd,
void* pwdCallback ATTRIBUTE_UNUSED,
void* pwdCallbackCtx ATTRIBUTE_UNUSED)
{
const char *pwd, void* pwdCallback ATTRIBUTE_UNUSED, void* pwdCallbackCtx ATTRIBUTE_UNUSED
) {
xmlSecKeyPtr key = NULL;
xmlSecKeyPtr res = NULL;
xmlSecPtrList certsList;
Expand Down Expand Up @@ -518,6 +520,7 @@ xmlSecGnuTLSAppPkcs12LoadMemory(const xmlSecByte* data, xmlSecSize dataSize,
xmlSecPtrListFinalize(&certsList);
return(res);
}
#endif /* XMLSEC_NO_X509 */


static gnutls_privkey_t
Expand Down Expand Up @@ -686,6 +689,7 @@ xmlSecGnuTLSAppPkcs8KeyLoadMemory(const xmlSecByte * data, xmlSecSize dataSize,
return(key);
}

#ifndef XMLSEC_NO_X509
static xmlSecKeyPtr
xmlSecGnuTLSAppKeyFromCertLoadMemory(const xmlSecByte* data, xmlSecSize dataSize, xmlSecKeyDataFormat format)
{
Expand Down
7 changes: 6 additions & 1 deletion src/gnutls/crypto.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -333,11 +333,11 @@ xmlSecGnuTLSShutdown(void) {
*/
int
xmlSecGnuTLSKeysMngrInit(xmlSecKeysMngrPtr mngr) {
#ifndef XMLSEC_NO_X509
int ret;

xmlSecAssert2(mngr != NULL, -1);

#ifndef XMLSEC_NO_X509
/* create x509 store if needed */
if(xmlSecKeysMngrGetDataStore(mngr, xmlSecGnuTLSX509StoreId) == NULL) {
xmlSecKeyDataStorePtr x509Store;
Expand All @@ -355,7 +355,12 @@ xmlSecGnuTLSKeysMngrInit(xmlSecKeysMngrPtr mngr) {
return(-1);
}
}

#else /* XMLSEC_NO_X509 */
xmlSecAssert2(mngr != NULL, -1);

#endif /* XMLSEC_NO_X509 */

return(0);
}

Expand Down
10 changes: 7 additions & 3 deletions src/gnutls/keysstore.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -128,18 +128,17 @@ xmlSecGnuTLSKeysStoreFindKey(xmlSecKeyStorePtr store, const xmlChar* name,
}

static xmlSecKeyPtr
xmlSecGnuTLSKeysStoreFindKeyFromX509Data(xmlSecKeyStorePtr store, xmlSecKeyX509DataValuePtr x509Data,
xmlSecKeyInfoCtxPtr keyInfoCtx
xmlSecGnuTLSKeysStoreFindKeyFromX509Data(xmlSecKeyStorePtr store, xmlSecKeyX509DataValuePtr x509Data, xmlSecKeyInfoCtxPtr keyInfoCtx
) {
#ifndef XMLSEC_NO_X509
xmlSecKeyStorePtr* simplekeystore;
xmlSecPtrListPtr keysList;
xmlSecKeyPtr key, res;

xmlSecAssert2(xmlSecKeyStoreCheckId(store, xmlSecGnuTLSKeysStoreId), NULL);
xmlSecAssert2(x509Data != NULL, NULL);
xmlSecAssert2(keyInfoCtx != NULL, NULL);


simplekeystore = xmlSecGnuTLSKeysStoreGetCtx(store);
xmlSecAssert2(((simplekeystore != NULL) && (*simplekeystore != NULL)), NULL);

Expand All @@ -164,6 +163,11 @@ xmlSecGnuTLSKeysStoreFindKeyFromX509Data(xmlSecKeyStorePtr store, xmlSecKeyX509D

return(res);
#else /* XMLSEC_NO_X509 */
xmlSecAssert2(xmlSecKeyStoreCheckId(store, xmlSecGnuTLSKeysStoreId), NULL);
xmlSecAssert2(x509Data != NULL, NULL);
xmlSecAssert2(keyInfoCtx != NULL, NULL);

xmlSecNotImplementedError("X509 support is disabled");
return(NULL);
#endif /* XMLSEC_NO_X509 */
}
Expand Down
20 changes: 19 additions & 1 deletion src/keys.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -404,7 +404,7 @@ xmlSecKeyReqMatchKey(xmlSecKeyReqPtr keyReq, xmlSecKeyPtr key) {
xmlSecAssert2(xmlSecKeyIsValid(key), -1);

if((keyReq->keyType != xmlSecKeyDataTypeUnknown) && ((xmlSecKeyGetType(key) & keyReq->keyType) == 0)) {
return(0);
return(0);
}
if((keyReq->keyUsage != xmlSecKeyDataUsageUnknown) && ((keyReq->keyUsage & key->usage) == 0)) {
return(0);
Expand Down Expand Up @@ -824,6 +824,24 @@ xmlSecKeySetValue(xmlSecKeyPtr key, xmlSecKeyDataPtr value) {
return(0);
}

/**
* xmlSecKeyGetSize:
* @key: the pointer to key.
*
* Gets key size (see also #xmlSecKeyDataGetSize function).
*
* Returns: key size.
*/
xmlSecSize
xmlSecKeyGetSize(xmlSecKeyPtr key) {
xmlSecAssert2(key != NULL, 0);

if(key->value == NULL) {
return(0);
}
return(xmlSecKeyDataGetSize(key->value));
}

/**
* xmlSecKeyGetData:
* @key: the pointer to key.
Expand Down
18 changes: 11 additions & 7 deletions src/nss/app.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -60,10 +60,14 @@ static PRBool xmlSecNssAppAscii2UCS2Conv (PRBool toUnicod
unsigned int maxOutBufLen,
unsigned int *outBufLen,
PRBool swapBytes);
static xmlSecKeyPtr xmlSecNssAppDerKeyLoadSECItem (SECItem* secItem);


#ifndef XMLSEC_NO_X509
static SECItem *xmlSecNssAppNicknameCollisionCallback (SECItem *old_nick,
PRBool *cancel,
void *wincx);
static xmlSecKeyPtr xmlSecNssAppDerKeyLoadSECItem (SECItem* secItem);
#endif /* XMLSEC_NO_X509 */

/**
* xmlSecNssAppInit:
Expand Down Expand Up @@ -233,12 +237,12 @@ xmlSecNssAppAscii2UCS2Conv(PRBool toUnicode,
outBuf, maxOutBufLen, outBufLen));
}

#ifndef XMLSEC_NO_X509
/* rename certificate if needed */
static SECItem *
xmlSecNssAppNicknameCollisionCallback(SECItem *old_nick ATTRIBUTE_UNUSED,
PRBool *cancel,
void *wincx ATTRIBUTE_UNUSED)
{
PRBool *cancel, void *wincx ATTRIBUTE_UNUSED
) {
CERTCertificate *cert = (CERTCertificate *)wincx;
char *nick = NULL;
SECItem *ret_nick = NULL;
Expand Down Expand Up @@ -266,6 +270,7 @@ xmlSecNssAppNicknameCollisionCallback(SECItem *old_nick ATTRIBUTE_UNUSED,
ret_nick->len = (unsigned int)PORT_Strlen(nick);
return ret_nick;
}
#endif /* XMLSEC_NO_X509 */

/**
* xmlSecNssAppKeyLoad:
Expand Down Expand Up @@ -384,9 +389,8 @@ xmlSecNssAppKeyLoadMemory(const xmlSecByte* data, xmlSecSize dataSize, xmlSecKey
*/
xmlSecKeyPtr
xmlSecNssAppKeyLoadSECItem(SECItem* secItem, xmlSecKeyDataFormat format,
const char *pwd,
void* pwdCallback,
void* pwdCallbackCtx) {
const char *pwd, void* pwdCallback, void* pwdCallbackCtx
) {
xmlSecKeyPtr key = NULL;

xmlSecAssert2(secItem != NULL, NULL);
Expand Down
6 changes: 5 additions & 1 deletion src/nss/crypto.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -373,11 +373,11 @@ xmlSecNssShutdown(void) {
*/
int
xmlSecNssKeysMngrInit(xmlSecKeysMngrPtr mngr) {
#ifndef XMLSEC_NO_X509
int ret;

xmlSecAssert2(mngr != NULL, -1);

#ifndef XMLSEC_NO_X509
/* create x509 store if needed */
if(xmlSecKeysMngrGetDataStore(mngr, xmlSecNssX509StoreId) == NULL) {
xmlSecKeyDataStorePtr x509Store;
Expand All @@ -395,6 +395,10 @@ xmlSecNssKeysMngrInit(xmlSecKeysMngrPtr mngr) {
return(-1);
}
}

#else /* XMLSEC_NO_X509 */
xmlSecAssert2(mngr != NULL, -1);

#endif /* XMLSEC_NO_X509 */

return(0);
Expand Down
10 changes: 8 additions & 2 deletions src/nss/keysstore.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -191,8 +191,7 @@ xmlSecNssKeysStoreFinalize(xmlSecKeyStorePtr store) {
}

static xmlSecKeyPtr
xmlSecNssKeysStoreFindKey(xmlSecKeyStorePtr store, const xmlChar* name,
xmlSecKeyInfoCtxPtr keyInfoCtx) {
xmlSecNssKeysStoreFindKey(xmlSecKeyStorePtr store, const xmlChar* name, xmlSecKeyInfoCtxPtr keyInfoCtx) {
xmlSecKeyStorePtr* ss;
xmlSecKeyPtr key = NULL;
xmlSecKeyPtr retval = NULL;
Expand Down Expand Up @@ -264,6 +263,7 @@ xmlSecNssKeysStoreFindKey(xmlSecKeyStorePtr store, const xmlChar* name,
return (NULL);
}

#ifndef XMLSEC_NO_X509
x509Data = xmlSecKeyDataCreate(xmlSecNssKeyDataX509Id);
if(x509Data == NULL) {
xmlSecInternalError("xmlSecKeyDataCreate", NULL);
Expand All @@ -276,6 +276,7 @@ xmlSecNssKeysStoreFindKey(xmlSecKeyStorePtr store, const xmlChar* name,
goto done;
}
cert = NULL; /* owned by x509 data */
#endif /* XMLSEC_NO_X509 */

ret = xmlSecKeySetValue(key, data);
if (ret < 0) {
Expand Down Expand Up @@ -355,6 +356,11 @@ xmlSecNssKeysStoreFindKeyFromX509Data(xmlSecKeyStorePtr store, xmlSecKeyX509Data

return(res);
#else /* XMLSEC_NO_X509 */
xmlSecAssert2(xmlSecKeyStoreCheckId(store, xmlSecNssKeysStoreId), NULL);
xmlSecAssert2(x509Data != NULL, NULL);
xmlSecAssert2(keyInfoCtx != NULL, NULL);

xmlSecNotImplementedError("X509 support is disabled");
return(NULL);
#endif /* XMLSEC_NO_X509 */
}
Loading

0 comments on commit 045c12f

Please sign in to comment.