denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pki: Allow specifying signature scheme for PKCS#7 signatures

Browse Source 
Also changed the error handling a bit so it is more like in the other
pki commands.
This commit is contained in:
Tobias Brunner
2023-03-31 09:11:20 +02:00
parent e2a2674476
commit b4e1863fa6
2 changed files with 85 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pki/commands/pkcs7.c
+73 -28
View File
@@ -151,7 +151,8 @@ static int verify(chunk_t chunk)
/** /**
* Sign data into PKCS#7 signed-data * Sign data into PKCS#7 signed-data
*/ */
static int sign(chunk_t chunk, certificate_t *cert, private_key_t *key) static int sign(chunk_t chunk, certificate_t *cert, private_key_t *key,
hash_algorithm_t digest, signature_params_t *scheme)
{ {
container_t *container; container_t *container;
chunk_t encoding; chunk_t encoding;
@@ -162,6 +163,8 @@ static int sign(chunk_t chunk, certificate_t *cert, private_key_t *key)
BUILD_BLOB, chunk, BUILD_BLOB, chunk,
BUILD_SIGNING_CERT, cert, BUILD_SIGNING_CERT, cert,
BUILD_SIGNING_KEY, key, BUILD_SIGNING_KEY, key,
BUILD_SIGNATURE_SCHEME, scheme,
BUILD_DIGEST_ALG, digest,
BUILD_END); BUILD_END);
if (container) if (container)
{ {
@@ -171,6 +174,7 @@ static int sign(chunk_t chunk, certificate_t *cert, private_key_t *key)
free(encoding.ptr); free(encoding.ptr);
} }
container->destroy(container); container->destroy(container);
res = 0;
} }
return res; return res;
} }
@@ -196,6 +200,7 @@ static int encrypt(chunk_t chunk, certificate_t *cert)
free(encoding.ptr); free(encoding.ptr);
} }
container->destroy(container); container->destroy(container);
res = 0;
} }
return res; return res;
} }
@@ -277,12 +282,14 @@ static int show(chunk_t chunk)
*/ */
static int pkcs7() static int pkcs7()
{ {
char *arg, *file = NULL; char *arg, *file = NULL, *error = NULL;
private_key_t *key = NULL; private_key_t *key = NULL;
certificate_t *cert = NULL; certificate_t *cert = NULL;
chunk_t data = chunk_empty; chunk_t data = chunk_empty;
hash_algorithm_t digest = HASH_UNKNOWN;
signature_params_t *scheme = NULL;
mem_cred_t *creds; mem_cred_t *creds;
int res = 1; int res = 0;
FILE *in; FILE *in;
enum { enum {
OP_NONE, OP_NONE,
@@ -292,6 +299,8 @@ static int pkcs7()
OP_DECRYPT, OP_DECRYPT,
OP_SHOW, OP_SHOW,
} op = OP_NONE; } op = OP_NONE;
bool pss = lib->settings->get_bool(lib->settings, "%s.rsa_pss", FALSE,
lib->ns);
creds = mem_cred_create(); creds = mem_cred_create();
@@ -300,8 +309,7 @@ static int pkcs7()
switch (command_getopt(&arg)) switch (command_getopt(&arg))
{ {
case 'h': case 'h':
creds->destroy(creds); goto usage;
return command_usage(NULL);
case 'i': case 'i':
file = arg; file = arg;
continue; continue;
@@ -342,12 +350,12 @@ static int pkcs7()
continue; continue;
case 'k': case 'k':
key = lib->creds->create(lib->creds, key = lib->creds->create(lib->creds,
CRED_PRIVATE_KEY, KEY_RSA, CRED_PRIVATE_KEY, KEY_ANY,
BUILD_FROM_FILE, arg, BUILD_END); BUILD_FROM_FILE, arg, BUILD_END);
if (!key) if (!key)
{ {
fprintf(stderr, "parsing private key failed\n"); error = "parsing private key failed";
goto end; goto usage;
} }
creds->add_key(creds, key); creds->add_key(creds, key);
continue; continue;
@@ -357,17 +365,31 @@ static int pkcs7()
BUILD_FROM_FILE, arg, BUILD_END); BUILD_FROM_FILE, arg, BUILD_END);
if (!cert) if (!cert)
{ {
fprintf(stderr, "parsing certificate failed\n"); error = "parsing certificate failed";
goto end; goto usage;
} }
creds->add_cert(creds, TRUE, cert); creds->add_cert(creds, TRUE, cert);
continue; continue;
case 'g':
if (!enum_from_name(hash_algorithm_short_names, arg, &digest))
{
error = "invalid --digest type";
goto usage;
}
continue;
case 'R':
if (!parse_rsa_padding(arg, &pss))
{
error = "invalid RSA padding";
goto usage;
}
continue;
case EOF: case EOF:
break; break;
default: default:
invalid: invalid:
creds->destroy(creds); error = "invalid --pkcs7 option";
return command_usage("invalid --pkcs7 option"); goto usage;
} }
break; break;
} }
@@ -388,12 +410,12 @@ static int pkcs7()
if (!data.len) if (!data.len)
{ {
fprintf(stderr, "reading input failed!\n"); error = "reading input failed";
goto end; goto end;
} }
if (op != OP_SHOW && !cert) if (op != OP_SHOW && !cert)
{ {
fprintf(stderr, "requiring a certificate!\n"); error = "requiring a certificate";
goto end; goto end;
} }
@@ -404,11 +426,21 @@ static int pkcs7()
case OP_SIGN: case OP_SIGN:
if (!key) if (!key)
{ {
fprintf(stderr, "signing requires a private key\n"); error = "signing requires a private key";
res = 1;
break; break;
} }
res = sign(data, cert, key); scheme = get_signature_scheme(key, digest, pss);
if (!scheme)
{
error = "no signature scheme found";
break;
}
if (digest == HASH_UNKNOWN)
{
digest = hasher_from_signature_scheme(scheme->scheme,
scheme->params);
}
res = sign(data, cert, key, digest, scheme);
break; break;
case OP_VERIFY: case OP_VERIFY:
res = verify(data); res = verify(data);
@@ -420,7 +452,6 @@ static int pkcs7()
if (!key) if (!key)
{ {
fprintf(stderr, "decryption requires a private key\n"); fprintf(stderr, "decryption requires a private key\n");
res = 1;
break; break;
} }
res = decrypt(data); res = decrypt(data);
@@ -435,9 +466,19 @@ static int pkcs7()
lib->credmgr->remove_local_set(lib->credmgr, &creds->set); lib->credmgr->remove_local_set(lib->credmgr, &creds->set);
end: end:
signature_params_destroy(scheme);
creds->destroy(creds); creds->destroy(creds);
free(data.ptr); free(data.ptr);
if (error)
{
fprintf(stderr, "%s\n", error);
return 1;
}
return res; return res;
usage:
creds->destroy(creds);
return command_usage(error);
} }
/** /**
@@ -448,17 +489,21 @@ static void __attribute__ ((constructor))reg()
command_register((command_t) { command_register((command_t) {
pkcs7, '7', "pkcs7", "PKCS#7 wrap/unwrap functions", pkcs7, '7', "pkcs7", "PKCS#7 wrap/unwrap functions",
{"--sign|--verify|--encrypt|--decrypt|--show", {"--sign|--verify|--encrypt|--decrypt|--show",
"[--in file] [--cert file]+ [--key file]"}, "[--in file] [--cert file]+ [--key file]",
"[--digest md5|sha1|sha224|sha256|sha384|sha512|sha3_224|sha3_256|sha3_384|sha3_512]",
"[--rsa-padding pkcs1|pss]"},
{ {
{"help", 'h', 0, "show usage information"}, {"help", 'h', 0, "show usage information"},
{"sign", 's', 0, "create PKCS#7 signed-data"}, {"sign", 's', 0, "create PKCS#7 signed-data"},
{"verify", 'u', 0, "verify PKCS#7 signed-data"}, {"verify", 'u', 0, "verify PKCS#7 signed-data"},
{"encrypt", 'e', 0, "create PKCS#7 enveloped-data"}, {"encrypt", 'e', 0, "create PKCS#7 enveloped-data"},
{"decrypt", 'd', 0, "decrypt PKCS#7 enveloped-data"}, {"decrypt", 'd', 0, "decrypt PKCS#7 enveloped-data"},
{"show", 'p', 0, "show info about PKCS#7, print certificates"}, {"show", 'p', 0, "show info about PKCS#7, print certificates"},
{"in", 'i', 1, "input file, default: stdin"}, {"in", 'i', 1, "input file, default: stdin"},
{"key", 'k', 1, "path to private key for sign/decrypt"}, {"key", 'k', 1, "path to private key for sign/decrypt"},
{"cert", 'c', 1, "path to certificate for sign/verify/encrypt"}, {"cert", 'c', 1, "path to certificate for sign/verify/encrypt"},
{"digest", 'g', 1, "digest for signature creation, default: key-specific"},
{"rsa-padding", 'R', 1, "padding for RSA signatures, default: pkcs1"},
} }
}); });
} }
src/pki/man/pki---pkcs7.1.in
+12 -1
View File
@@ -1,4 +1,4 @@
.TH "PKI \-\-PKCS7" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" .TH "PKI \-\-PKCS7" 1 "2023-03-30" "@PACKAGE_VERSION@" "strongSwan"
. .
.SH "NAME" .SH "NAME"
. .
@@ -11,6 +11,8 @@ pki \-\-pkcs7 \- Provides PKCS#7 wrap/unwrap functions
.OP \-\-in file .OP \-\-in file
.OP \-\-cert file .OP \-\-cert file
.OP \-\-key file .OP \-\-key file
.OP \-\-digest digest
.OP \-\-rsa\-padding padding
.OP \-\-debug level .OP \-\-debug level
.YS .YS
. .
@@ -73,6 +75,15 @@ Certificate for
and and
.BR \-\-encrypt. .BR \-\-encrypt.
Can be used multiple times. Can be used multiple times.
.TP
.BI "\-g, \-\-digest " digest
Digest to use for signature creation. One of \fImd5\fR, \fIsha1\fR,
\fIsha224\fR, \fIsha256\fR, \fIsha384\fR, or \fIsha512\fR. The default is
determined based on the type and size of the signature key.
.TP
.BI "\-R, \-\-rsa\-padding " padding
Padding to use for RSA signatures. Either \fIpkcs1\fR or \fIpss\fR, defaults
to \fIpkcs1\fR.
. .
.SH "SEE ALSO" .SH "SEE ALSO"
. .