denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

openssl: Also load EC keys from an ENGINE

Browse Source
This commit is contained in:
Tobias Brunner
2017-11-02 09:42:52 +01:00
parent 7f86b0f639
commit b2266280ef
5 changed files with 168 additions and 155 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/openssl/openssl_rsa_private_key.c
+2 -148
View File
@@ -27,9 +27,6 @@
#include <openssl/bn.h>
#include <openssl/evp.h>
#include <openssl/rsa.h>
#ifndef OPENSSL_NO_ENGINE
#include <openssl/engine.h>
#endif /* OPENSSL_NO_ENGINE */
/**
* Public exponent to use for key generation.
@@ -386,7 +383,7 @@ error:
/*
* See header
*/
private_key_t *openssl_rsa_private_key_create(EVP_PKEY *key)
private_key_t *openssl_rsa_private_key_create(EVP_PKEY *key, bool engine)
{
private_openssl_rsa_private_key_t *this;
RSA *rsa;
@@ -399,6 +396,7 @@ private_key_t *openssl_rsa_private_key_create(EVP_PKEY *key)
}
this = create_empty();
this->rsa = rsa;
this->engine = engine;
return &this->public.key;
}
@@ -502,148 +500,4 @@ openssl_rsa_private_key_t *openssl_rsa_private_key_load(key_type_t type,
return NULL;
}
#ifndef OPENSSL_NO_ENGINE
/**
* Login to engine with a PIN specified for a keyid
*/
static bool login(ENGINE *engine, chunk_t keyid)
{
enumerator_t *enumerator;
shared_key_t *shared;
identification_t *id;
chunk_t key;
char pin[64];
bool found = FALSE, success = FALSE;
id = identification_create_from_encoding(ID_KEY_ID, keyid);
enumerator = lib->credmgr->create_shared_enumerator(lib->credmgr,
SHARED_PIN, id, NULL);
while (enumerator->enumerate(enumerator, &shared, NULL, NULL))
{
found = TRUE;
key = shared->get_key(shared);
if (snprintf(pin, sizeof(pin),
"%.*s", (int)key.len, key.ptr) >= sizeof(pin))
{
continue;
}
if (ENGINE_ctrl_cmd_string(engine, "PIN", pin, 0))
{
success = TRUE;
break;
}
else
{
DBG1(DBG_CFG, "setting PIN on engine failed");
}
}
enumerator->destroy(enumerator);
id->destroy(id);
if (!found)
{
DBG1(DBG_CFG, "no PIN found for %#B", &keyid);
}
return success;
}
#endif /* OPENSSL_NO_ENGINE */
/*
* See header.
*/
openssl_rsa_private_key_t *openssl_rsa_private_key_connect(key_type_t type,
va_list args)
{
#ifndef OPENSSL_NO_ENGINE
private_openssl_rsa_private_key_t *this;
char *engine_id = NULL;
char keyname[64];
chunk_t keyid = chunk_empty;;
EVP_PKEY *key;
ENGINE *engine;
int slot = -1;
while (TRUE)
{
switch (va_arg(args, builder_part_t))
{
case BUILD_PKCS11_KEYID:
keyid = va_arg(args, chunk_t);
continue;
case BUILD_PKCS11_SLOT:
slot = va_arg(args, int);
continue;
case BUILD_PKCS11_MODULE:
engine_id = va_arg(args, char*);
continue;
case BUILD_END:
break;
default:
return NULL;
}
break;
}
if (!keyid.len || keyid.len > 40)
{
return NULL;
}
memset(keyname, 0, sizeof(keyname));
if (slot != -1)
{
snprintf(keyname, sizeof(keyname), "%d:", slot);
}
if (sizeof(keyname) - strlen(keyname) <= keyid.len * 4 / 3 + 1)
{
return NULL;
}
chunk_to_hex(keyid, keyname + strlen(keyname), FALSE);
if (!engine_id)
{
engine_id = lib->settings->get_str(lib->settings,
"%s.plugins.openssl.engine_id", "pkcs11", lib->ns);
}
engine = ENGINE_by_id(engine_id);
if (!engine)
{
DBG2(DBG_LIB, "engine '%s' is not available", engine_id);
return NULL;
}
if (!ENGINE_init(engine))
{
DBG1(DBG_LIB, "failed to initialize engine '%s'", engine_id);
ENGINE_free(engine);
return NULL;
}
if (!login(engine, keyid))
{
DBG1(DBG_LIB, "login to engine '%s' failed", engine_id);
ENGINE_free(engine);
return NULL;
}
key = ENGINE_load_private_key(engine, keyname, NULL, NULL);
if (!key)
{
DBG1(DBG_LIB, "failed to load private key with ID '%s' from "
"engine '%s'", keyname, engine_id);
ENGINE_free(engine);
return NULL;
}
ENGINE_free(engine);
this = create_empty();
this->rsa = EVP_PKEY_get1_RSA(key);
this->engine = TRUE;
if (!this->rsa)
{
destroy(this);
return NULL;
}
return &this->public;
#else /* OPENSSL_NO_ENGINE */
return NULL;
#endif /* OPENSSL_NO_ENGINE */
}
#endif /* OPENSSL_NO_RSA */